Merge master into staging-next

2018-08-04 11:43:54 +02:00 · 2018-08-04 11:43:54 +02:00 · 699e0e50b7
commit 699e0e50b7
parent e7702dc7b7 82f80f4cfa
294 changed files with 10675 additions and 3554 deletions
--- a/README.md
+++ b/README.md
@ -8,7 +8,7 @@ build daemon as so-called channels. To get channel information via git, add
 [nixpkgs-channels](https://github.com/NixOS/nixpkgs-channels.git) as a remote:

 ```
-% git remote add channels git://github.com/NixOS/nixpkgs-channels.git
+% git remote add channels https://github.com/NixOS/nixpkgs-channels.git
 ```

 For stability and maximum binary package support, it is recommended to maintain
@ -37,5 +37,6 @@ For pull-requests, please rebase onto nixpkgs `master`.

 Communication:

+* [Discourse Forum](https://discourse.nixos.org/)
 * [Mailing list](https://groups.google.com/forum/#!forum/nix-devel)
 * [IRC - #nixos on freenode.net](irc://irc.freenode.net/#nixos)
--- a/doc/platform-notes.xml
+++ b/doc/platform-notes.xml
@ -29,6 +29,7 @@
      }
    </programlisting>
   </listitem>
+
   <listitem>
    <para>
     On darwin libraries are linked using absolute paths, libraries are
@ -46,6 +47,37 @@
      }
    </programlisting>
   </listitem>
+
+   <listitem>
+    <para>
+     Even if the libraries are linked using absolute paths and resolved via
+     their <literal>install_name</literal> correctly, tests can sometimes fail
+     to run binaries.  This happens because the <varname>checkPhase</varname>
+     runs before the libraries are installed.
+    </para>
+    <para>
+     This can usually be solved by running the tests after the
+     <varname>installPhase</varname> or alternatively by using
+     <varname>DYLD_LIBRARY_PATH</varname>. More information about this variable
+     can be found in the <citerefentry><refentrytitle>dyld</refentrytitle>
+     <manvolnum>1</manvolnum></citerefentry> manpage.
+    </para>
+<programlisting>
+      dyld: Library not loaded: /nix/store/7hnmbscpayxzxrixrgxvvlifzlxdsdir-jq-1.5-lib/lib/libjq.1.dylib
+      Referenced from: /private/tmp/nix-build-jq-1.5.drv-0/jq-1.5/tests/../jq
+      Reason: image not found
+      ./tests/jqtest: line 5: 75779 Abort trap: 6
+    </programlisting>
+<programlisting>
+      stdenv.mkDerivation {
+        name = "libfoo-1.2.3";
+        # ...
+        doInstallCheck = true;
+        installCheckTarget = "check";
+      }
+    </programlisting>
+   </listitem>
+
   <listitem>
    <para>
     Some packages assume xcode is available and use <command>xcrun</command>
--- a/doc/quick-start.xml
+++ b/doc/quick-start.xml
@ -9,7 +9,7 @@
    <para>
     Checkout the Nixpkgs source tree:
 <screen>
-$ git clone git://github.com/NixOS/nixpkgs.git 
+$ git clone https://github.com/NixOS/nixpkgs
 $ cd nixpkgs</screen>
    </para>
   </listitem>
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -539,6 +539,11 @@
    github = "boothead";
    name = "Ben Ford";
  };
+  borisbabic = {
+    email = "boris.ivan.babic@gmail.com";
+    github = "borisbabic";
+    name = "Boris Babić";
+  };
  bosu = {
    email = "boriss@gmail.com";
    github = "bosu";
@ -921,11 +926,21 @@
    github = "deepfire";
    name = "Kosyrev Serge";
  };
+  deltaevo = {
+    email = "deltaduartedavid@gmail.com";
+    github = "DeltaEvo";
+    name = "Duarte David";
+  };
  demin-dmitriy = {
    email = "demindf@gmail.com";
    github = "demin-dmitriy";
    name = "Dmitriy Demin";
  };
+  demize = {
+    email = "johannes@kyriasis.com";
+    github = "kyrias";
+    name = "Johannes Löthberg";
+  };
  demyanrogozhin = {
    email = "demyan.rogozhin@gmail.com";
    github = "demyanrogozhin";
@ -2164,6 +2179,11 @@
    github = "nathanielbaxter";
    name = "Nathaniel Baxter";
  };
+  lightdiscord = {
+    email = "arnaud@lightdiscord.me";
+    github = "lightdiscord";
+    name = "Arnaud Pascal";
+  };
  lihop = {
    email = "nixos@leroy.geek.nz";
    github = "lihop";
@ -2259,6 +2279,11 @@
    github = "luispedro";
    name = "Luis Pedro Coelho";
  };
+  lukeadams = {
+    email = "luke.adams@belljar.io";
+    github = "lukeadams";
+    name = "Luke Adams";
+  };
  lukego = {
    email = "luke@snabb.co";
    github = "lukego";
@ -3182,6 +3207,11 @@
    email = "patrick.callahan@latitudeengineering.com";
    name = "Patrick Callahan";
  };
+  q3k = {
+    email = "q3k@q3k.org";
+    github = "q3k";
+    name = "Serge Bazanski";
+  };
  qknight = {
    email = "js@lastlog.de";
    github = "qknight";
@ -3663,6 +3693,11 @@
    github = "s-na";
    name = "S. Nordin Abouzahra";
  };
+  snaar = {
+    email = "snaar@snaar.net";
+    github = "snaar";
+    name = "Serguei Narojnyi";
+  };
  snyh = {
    email = "snyh@snyh.org";
    github = "snyh";
--- a/nixos/doc/manual/configuration/adding-custom-packages.xml
+++ b/nixos/doc/manual/configuration/adding-custom-packages.xml
@ -14,7 +14,7 @@
 xlink:href="http://nixos.org/nixpkgs/manual">Nixpkgs
  manual</link>. In short, you clone Nixpkgs:
 <screen>
-$ git clone git://github.com/NixOS/nixpkgs.git
+$ git clone https://github.com/NixOS/nixpkgs
 $ cd nixpkgs
 </screen>
  Then you write and test the package as described in the Nixpkgs manual.
--- a/nixos/doc/manual/configuration/x-windows.xml
+++ b/nixos/doc/manual/configuration/x-windows.xml
@ -26,6 +26,7 @@
 <xref linkend="opt-services.xserver.desktopManager.plasma5.enable"/> = true;
 <xref linkend="opt-services.xserver.desktopManager.xfce.enable"/> = true;
 <xref linkend="opt-services.xserver.desktopManager.gnome3.enable"/> = true;
+<xref linkend="opt-services.xserver.desktopManager.mate.enable"/> = true;
 <xref linkend="opt-services.xserver.windowManager.xmonad.enable"/> = true;
 <xref linkend="opt-services.xserver.windowManager.twm.enable"/> = true;
 <xref linkend="opt-services.xserver.windowManager.icewm.enable"/> = true;
--- a/nixos/doc/manual/development/sources.xml
+++ b/nixos/doc/manual/development/sources.xml
@ -11,9 +11,9 @@
  modify NixOS, however, you should check out the latest sources from Git. This
  is as follows:
 <screen>
-$ git clone git://github.com/NixOS/nixpkgs.git
+$ git clone https://github.com/NixOS/nixpkgs
 $ cd nixpkgs
-$ git remote add channels git://github.com/NixOS/nixpkgs-channels.git
+$ git remote add channels https://github.com/NixOS/nixpkgs-channels
 $ git remote update channels
 </screen>
  This will check out the latest Nixpkgs sources to
--- a/nixos/doc/manual/release-notes/rl-1809.xml
+++ b/nixos/doc/manual/release-notes/rl-1809.xml
@ -81,6 +81,22 @@ $ nix-instantiate -E '(import &lt;nixpkgsunstable&gt; {}).gitFull'
     routing tables for instance.
    </para>
   </listitem>
+   <listitem>
+    <para>
+      <varname>services.strongswan-swanctl</varname>
+      is a modern replacement for <varname>services.strongswan</varname>.
+      You can use either one of them to setup IPsec VPNs but not both at the same time.
+    </para>
+    <para>
+      <varname>services.strongswan-swanctl</varname> uses the
+      <link xlink:href="https://wiki.strongswan.org/projects/strongswan/wiki/swanctl">swanctl</link>
+      command which uses the modern
+      <link xlink:href="https://github.com/strongswan/strongswan/blob/master/src/libcharon/plugins/vici/README.md">vici</link>
+      <emphasis>Versatile IKE Configuration Interface</emphasis>.
+      The deprecated <literal>ipsec</literal> command used in <varname>services.strongswan</varname> is using the legacy
+      <link xlink:href="https://github.com/strongswan/strongswan/blob/master/README_LEGACY.md">stroke configuration interface</link>.
+    </para>
+   </listitem>
  </itemizedlist>
 </section>

@ -370,7 +386,12 @@ inherit (pkgs.nixos {
      <varname>s6-dns</varname>, <varname>s6-networking</varname>,
      <varname>s6-linux-utils</varname> and <varname>s6-portable-utils</varname> respectively.
    </para>
-   </listitem>
+  </listitem>
+  <listitem>
+    <para>
+      The module option <option>nix.useSandbox</option> is now defaulted to <literal>true</literal>.
+    </para>
+  </listitem>
  </itemizedlist>
 </section>
 </section>
--- a/nixos/modules/misc/ids.nix
+++ b/nixos/modules/misc/ids.nix
@ -323,6 +323,7 @@
      mapred = 296;
      hadoop = 297;
      hydron = 298;
+      cfssl = 299;

      # When adding a uid, make sure it doesn't match an existing gid. And don't use uids above 399!

@ -606,6 +607,7 @@
      mapred = 296;
      hadoop = 297;
      hydron = 298;
+      cfssl = 299;

      # When adding a gid, make sure it doesn't match an existing
      # uid. Users and groups with the same name should have equal
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -543,6 +543,7 @@
  ./services/networking/ntopng.nix
  ./services/networking/ntpd.nix
  ./services/networking/nylon.nix
+  ./services/networking/ocserv.nix
  ./services/networking/oidentd.nix
  ./services/networking/openfire.nix
  ./services/networking/openntpd.nix
@ -621,6 +622,7 @@
  ./services/search/hound.nix
  ./services/search/kibana.nix
  ./services/search/solr.nix
+  ./services/security/cfssl.nix
  ./services/security/clamav.nix
  ./services/security/fail2ban.nix
  ./services/security/fprintd.nix
--- a/nixos/modules/services/audio/mpd.nix
+++ b/nixos/modules/services/audio/mpd.nix
@ -55,11 +55,11 @@ in {
      };

      musicDirectory = mkOption {
-        type = types.path;
+        type = with types; either path (strMatching "(http|https|nfs|smb)://.+");
        default = "${cfg.dataDir}/music";
        defaultText = ''''${dataDir}/music'';
        description = ''
-          The directory where mpd reads music from.
+          The directory or NFS/SMB network share where mpd reads music from.
        '';
      };

--- a/nixos/modules/services/backup/restic.nix
+++ b/nixos/modules/services/backup/restic.nix
@ -18,6 +18,7 @@ with lib;

        s3CredentialsFile = mkOption {
          type = with types; nullOr str;
+          default = null;
          description = ''
            file containing the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY
            for an S3-hosted repository, in the format of an EnvironmentFile
--- a/nixos/modules/services/cluster/kubernetes/default.nix
+++ b/nixos/modules/services/cluster/kubernetes/default.nix
@ -838,6 +838,8 @@ in {
        path = with pkgs; [ gitMinimal openssh docker utillinux iproute ethtool thin-provisioning-tools iptables socat ] ++ cfg.path;
        serviceConfig = {
          Slice = "kubernetes.slice";
+          CPUAccounting = true;
+          MemoryAccounting = true;
          ExecStart = ''${cfg.package}/bin/kubelet \
            ${optionalString (taints != "")
              "--register-with-taints=${taints}"} \
--- a/nixos/modules/services/misc/nix-daemon.nix
+++ b/nixos/modules/services/misc/nix-daemon.nix
@ -127,16 +127,16 @@ in

      useSandbox = mkOption {
        type = types.either types.bool (types.enum ["relaxed"]);
-        default = false;
+        default = true;
        description = "
          If set, Nix will perform builds in a sandboxed environment that it
          will set up automatically for each build. This prevents impurities
          in builds by disallowing access to dependencies outside of the Nix
          store by using network and mount namespaces in a chroot environment.
-          This isn't enabled by default for possible performance impacts due to
-          the initial setup time of a sandbox for each build. It doesn't affect
-          derivation hashes, so changing this option will not trigger a rebuild
-          of packages.
+          This is enabled by default even though it has a possible performance
+          impact due to the initial setup time of a sandbox for each build. It
+          doesn't affect derivation hashes, so changing this option will not
+          trigger a rebuild of packages.
        ";
      };

--- a/nixos/modules/services/monitoring/graphite.nix
+++ b/nixos/modules/services/monitoring/graphite.nix
@ -136,7 +136,7 @@ in {
      finders = mkOption {
        description = "List of finder plugins to load.";
        default = [];
-        example = literalExample "[ pkgs.python27Packages.graphite_influxdb ]";
+        example = literalExample "[ pkgs.python27Packages.influxgraph ]";
        type = types.listOf types.package;
      };

@ -485,7 +485,7 @@ in {
          PYTHONPATH = let
              penv = pkgs.python.buildEnv.override {
                extraLibs = [
-                  pythonPackages.graphite_web
+                  pythonPackages.graphite-web
                  pythonPackages.pysqlite
                ];
              };
@ -524,16 +524,16 @@ in {
          fi

          # Only collect static files when graphite_web changes.
-          if ! [ "${dataDir}/current_graphite_web" -ef "${pythonPackages.graphite_web}" ]; then
+          if ! [ "${dataDir}/current_graphite_web" -ef "${pythonPackages.graphite-web}" ]; then
            mkdir -p ${staticDir}
            ${pkgs.pythonPackages.django_1_8}/bin/django-admin.py collectstatic  --noinput --clear
            chown -R graphite:graphite ${staticDir}
-            ln -sfT "${pythonPackages.graphite_web}" "${dataDir}/current_graphite_web"
+            ln -sfT "${pythonPackages.graphite-web}" "${dataDir}/current_graphite_web"
          fi
        '';
      };

-      environment.systemPackages = [ pythonPackages.graphite_web ];
+      environment.systemPackages = [ pythonPackages.graphite-web ];
    }))

    (mkIf cfg.api.enable {
@ -607,7 +607,7 @@ in {
          GRAPHITE_URL = cfg.pager.graphiteUrl;
        };
        serviceConfig = {
-          ExecStart = "${pkgs.pythonPackages.graphite_pager}/bin/graphite-pager --config ${pagerConfig}";
+          ExecStart = "${pkgs.pythonPackages.graphitepager}/bin/graphite-pager --config ${pagerConfig}";
          User = "graphite";
          Group = "graphite";
        };
@ -615,7 +615,7 @@ in {

      services.redis.enable = mkDefault true;

-      environment.systemPackages = [ pkgs.pythonPackages.graphite_pager ];
+      environment.systemPackages = [ pkgs.pythonPackages.graphitepager ];
    })

    (mkIf cfg.beacon.enable {
--- a/nixos/modules/services/monitoring/prometheus/exporters.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters.nix
@ -73,7 +73,7 @@ let
      description = ''
        Specify a filter for iptables to use when
        <option>services.prometheus.exporters.${name}.openFirewall</option>
-        is true. It is used as `ip46tables -I INPUT <option>firewallFilter</option> -j ACCEPT`.
+        is true. It is used as `ip46tables -I nixos-fw <option>firewallFilter</option> -j nixos-fw-accept`.
      '';
    };
    user = mkOption {
@ -116,9 +116,10 @@ let

  mkExporterConf = { name, conf, serviceOpts }:
    mkIf conf.enable {
-      networking.firewall.extraCommands = mkIf conf.openFirewall ''
-        ip46tables -I INPUT ${conf.firewallFilter} -j ACCEPT
-      '';
+      networking.firewall.extraCommands = mkIf conf.openFirewall (concatStrings [
+        "ip46tables -I nixos-fw ${conf.firewallFilter} "
+        "-m comment --comment ${name}-exporter -j nixos-fw-accept"
+      ]);
      systemd.services."prometheus-${name}-exporter" = mkMerge ([{
        wantedBy = [ "multi-user.target" ];
        after = [ "network.target" ];
--- a/nixos/modules/services/networking/ocserv.nix
+++ b/nixos/modules/services/networking/ocserv.nix
@ -0,0 +1,99 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+
+  cfg = config.services.ocserv;
+
+in
+
+{
+  options.services.ocserv = {
+    enable = mkEnableOption "ocserv";
+
+    config = mkOption {
+      type = types.lines;
+
+      description = ''
+        Configuration content to start an OCServ server.
+
+        For a full configuration reference,please refer to the online documentation
+        (https://ocserv.gitlab.io/www/manual.html), the openconnect
+        recipes (https://github.com/openconnect/recipes) or `man ocserv`.
+      '';
+
+      example = ''
+        # configuration examples from $out/doc without explanatory comments.
+        # for a full reference please look at the installed man pages.
+        auth = "plain[passwd=./sample.passwd]"
+        tcp-port = 443
+        udp-port = 443
+        run-as-user = nobody
+        run-as-group = nogroup
+        socket-file = /var/run/ocserv-socket
+        server-cert = certs/server-cert.pem
+        server-key = certs/server-key.pem
+        keepalive = 32400
+        dpd = 90
+        mobile-dpd = 1800
+        switch-to-tcp-timeout = 25
+        try-mtu-discovery = false
+        cert-user-oid = 0.9.2342.19200300.100.1.1
+        tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-VERS-SSL3.0"
+        auth-timeout = 240
+        min-reauth-time = 300
+        max-ban-score = 80
+        ban-reset-time = 1200
+        cookie-timeout = 300
+        deny-roaming = false
+        rekey-time = 172800
+        rekey-method = ssl
+        use-occtl = true
+        pid-file = /var/run/ocserv.pid
+        device = vpns
+        predictable-ips = true
+        default-domain = example.com
+        ipv4-network = 192.168.1.0
+        ipv4-netmask = 255.255.255.0
+        dns = 192.168.1.2
+        ping-leases = false
+        route = 10.10.10.0/255.255.255.0
+        route = 192.168.0.0/255.255.0.0
+        no-route = 192.168.5.0/255.255.255.0
+        cisco-client-compat = true
+        dtls-legacy = true
+
+        [vhost:www.example.com]
+        auth = "certificate"
+        ca-cert = certs/ca.pem
+        server-cert = certs/server-cert-secp521r1.pem
+        server-key = cersts/certs/server-key-secp521r1.pem
+        ipv4-network = 192.168.2.0
+        ipv4-netmask = 255.255.255.0
+        cert-user-oid = 0.9.2342.19200300.100.1.1
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = [ pkgs.ocserv ];
+    environment.etc."ocserv/ocserv.conf".text = cfg.config;
+
+    security.pam.services.ocserv = {};
+
+    systemd.services.ocserv = {
+      description = "OpenConnect SSL VPN server";
+      documentation = [ "man:ocserv(8)" ];
+      after = [ "dbus.service" "network-online.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig = {
+        PrivateTmp = true;
+        PIDFile = "/var/run/ocserv.pid";
+        ExecStart = "${pkgs.ocserv}/bin/ocserv --foreground --pid-file /var/run/ocesrv.pid --config /etc/ocserv/ocserv.conf";
+        ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+      };
+    };
+  };
+}
--- a/nixos/modules/services/security/cfssl.nix
+++ b/nixos/modules/services/security/cfssl.nix
@ -0,0 +1,209 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.cfssl;
+in {
+  options.services.cfssl = {
+    enable = mkEnableOption "the CFSSL CA api-server";
+
+    dataDir = mkOption {
+      default = "/var/lib/cfssl";
+      type = types.path;
+      description = "Cfssl work directory.";
+    };
+
+    address = mkOption {
+      default = "127.0.0.1";
+      type = types.str;
+      description = "Address to bind.";
+    };
+
+    port = mkOption {
+      default = 8888;
+      type = types.ints.u16;
+      description = "Port to bind.";
+    };
+
+    ca = mkOption {
+      defaultText = "\${cfg.dataDir}/ca.pem";
+      type = types.str;
+      description = "CA used to sign the new certificate -- accepts '[file:]fname' or 'env:varname'.";
+    };
+
+    caKey = mkOption {
+      defaultText = "file:\${cfg.dataDir}/ca-key.pem";
+      type = types.str;
+      description = "CA private key -- accepts '[file:]fname' or 'env:varname'.";
+    };
+
+    caBundle = mkOption {
+      default = null;
+      type = types.nullOr types.path;
+      description = "Path to root certificate store.";
+    };
+
+    intBundle = mkOption {
+      default = null;
+      type = types.nullOr types.path;
+      description = "Path to intermediate certificate store.";
+    };
+
+    intDir = mkOption {
+      default = null;
+      type = types.nullOr types.path;
+      description = "Intermediates directory.";
+    };
+
+    metadata = mkOption {
+      default = null;
+      type = types.nullOr types.path;
+      description = ''
+        Metadata file for root certificate presence.
+        The content of the file is a json dictionary (k,v): each key k is
+        a SHA-1 digest of a root certificate while value v is a list of key
+        store filenames.
+      '';
+    };
+
+    remote = mkOption {
+      default = null;
+      type = types.nullOr types.str;
+      description = "Remote CFSSL server.";
+    };
+
+    configFile = mkOption {
+      default = null;
+      type = types.nullOr types.str;
+      description = "Path to configuration file. Do not put this in nix-store as it might contain secrets.";
+    };
+
+    responder = mkOption {
+      default = null;
+      type = types.nullOr types.path;
+      description = "Certificate for OCSP responder.";
+    };
+
+    responderKey = mkOption {
+      default = null;
+      type = types.nullOr types.str;
+      description = "Private key for OCSP responder certificate. Do not put this in nix-store.";
+    };
+
+    tlsKey = mkOption {
+      default = null;
+      type = types.nullOr types.str;
+      description = "Other endpoint's CA private key. Do not put this in nix-store.";
+    };
+
+    tlsCert = mkOption {
+      default = null;
+      type = types.nullOr types.path;
+      description = "Other endpoint's CA to set up TLS protocol.";
+    };
+
+    mutualTlsCa = mkOption {
+      default = null;
+      type = types.nullOr types.path;
+      description = "Mutual TLS - require clients be signed by this CA.";
+    };
+
+    mutualTlsCn = mkOption {
+      default = null;
+      type = types.nullOr types.str;
+      description = "Mutual TLS - regex for whitelist of allowed client CNs.";
+    };
+
+    tlsRemoteCa = mkOption {
+      default = null;
+      type = types.nullOr types.path;
+      description = "CAs to trust for remote TLS requests.";
+    };
+
+    mutualTlsClientCert = mkOption {
+      default = null;
+      type = types.nullOr types.path;
+      description = "Mutual TLS - client certificate to call remote instance requiring client certs.";
+    };
+
+    mutualTlsClientKey = mkOption {
+      default = null;
+      type = types.nullOr types.path;
+      description = "Mutual TLS - client key to call remote instance requiring client certs. Do not put this in nix-store.";
+    };
+
+    dbConfig = mkOption {
+      default = null;
+      type = types.nullOr types.path;
+      description = "Certificate db configuration file. Path must be writeable.";
+    };
+
+    logLevel = mkOption {
+      default = 1;
+      type = types.enum [ 0 1 2 3 4 5 ];
+      description = "Log level (0 = DEBUG, 5 = FATAL).";
+    };
+  };
+
+  config = {
+    users.extraGroups.cfssl = {
+      gid = config.ids.gids.cfssl;
+    };
+
+    users.extraUsers.cfssl = {
+      description = "cfssl user";
+      createHome = true;
+      home = cfg.dataDir;
+      group = "cfssl";
+      uid = config.ids.uids.cfssl;
+    };
+
+    systemd.services.cfssl = mkIf cfg.enable {
+      description = "CFSSL CA API server";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+
+      serviceConfig = {
+        WorkingDirectory = cfg.dataDir;
+        StateDirectory = cfg.dataDir;
+        StateDirectoryMode = 700;
+        Restart = "always";
+        User = "cfssl";
+
+        ExecStart = with cfg; let
+          opt = n: v: optionalString (v != null) ''-${n}="${v}"'';
+        in
+          lib.concatStringsSep " \\\n" [
+            "${pkgs.cfssl}/bin/cfssl serve"
+            (opt "address" address)
+            (opt "port" (toString port))
+            (opt "ca" ca)
+            (opt "ca-key" caKey)
+            (opt "ca-bundle" caBundle)
+            (opt "int-bundle" intBundle)
+            (opt "int-dir" intDir)
+            (opt "metadata" metadata)
+            (opt "remote" remote)
+            (opt "config" configFile)
+            (opt "responder" responder)
+            (opt "responder-key" responderKey)
+            (opt "tls-key" tlsKey)
+            (opt "tls-cert" tlsCert)
+            (opt "mutual-tls-ca" mutualTlsCa)
+            (opt "mutual-tls-cn" mutualTlsCn)
+            (opt "mutual-tls-client-key" mutualTlsClientKey)
+            (opt "mutual-tls-client-cert" mutualTlsClientCert)
+            (opt "tls-remote-ca" tlsRemoteCa)
+            (opt "db-config" dbConfig)
+            (opt "loglevel" (toString logLevel))
+          ];
+      };
+    };
+
+    services.cfssl = {
+      ca = mkDefault "${cfg.dataDir}/ca.pem";
+      caKey = mkDefault "${cfg.dataDir}/ca-key.pem";
+    };
+  };
+}
--- a/nixos/modules/services/web-servers/hydron.nix
+++ b/nixos/modules/services/web-servers/hydron.nix
@ -1,6 +1,8 @@
 { config, lib, pkgs, ... }:

-let cfg = config.services.hydron;
+let
+  cfg = config.services.hydron;
+  postgres = config.services.postgresql;
 in with lib; {
  options.services.hydron = {
    enable = mkEnableOption "hydron";
@ -25,6 +27,38 @@ in with lib; {
      '';
    };

+    password = mkOption {
+      type = types.str;
+      default = "hydron";
+      example = "dumbpass";
+      description = "Password for the hydron database.";
+    };
+
+    passwordFile = mkOption {
+      type = types.path;
+      default = "/run/keys/hydron-password-file";
+      example = "/home/okina/hydron/keys/pass";
+      description = "Password file for the hydron database.";
+    };
+
+    postgresArgs = mkOption {
+      type = types.str;
+      description = "Postgresql connection arguments.";
+      example = ''
+        {
+          "driver": "postgres",
+          "connection": "user=hydron password=dumbpass dbname=hydron sslmode=disable"
+        }
+      '';
+    };
+
+    postgresArgsFile = mkOption {
+      type = types.path;
+      default = "/run/keys/hydron-postgres-args";
+      example = "/home/okina/hydron/keys/postgres";
+      description = "Postgresql connection arguments file.";
+    };
+
    listenAddress = mkOption {
      type = types.nullOr types.str;
      default = null;
@ -47,16 +81,36 @@ in with lib; {
  };

  config = mkIf cfg.enable {
+    security.sudo.enable = cfg.enable;
+    services.postgresql.enable = cfg.enable;
+    services.hydron.passwordFile = mkDefault (pkgs.writeText "hydron-password-file" cfg.password);
+    services.hydron.postgresArgsFile = mkDefault (pkgs.writeText "hydron-postgres-args" cfg.postgresArgs);
+    services.hydron.postgresArgs = mkDefault ''
+      {
+        "driver": "postgres",
+        "connection": "user=hydron password=${cfg.password} dbname=hydron sslmode=disable"
+      }
+    '';
+
    systemd.services.hydron = {
      description = "hydron";
-      after = [ "network.target" ];
+      after = [ "network.target" "postgresql.service" ];
      wantedBy = [ "multi-user.target" ];

      preStart = ''
-        # Ensure folder exists and permissions are correct
-        mkdir -p ${escapeShellArg cfg.dataDir}/images
+        # Ensure folder exists or create it and permissions are correct
+        mkdir -p ${escapeShellArg cfg.dataDir}/{.hydron,images}
+        ln -sf ${escapeShellArg cfg.postgresArgsFile} ${escapeShellArg cfg.dataDir}/.hydron/db_conf.json
        chmod 750 ${escapeShellArg cfg.dataDir}
        chown -R hydron:hydron ${escapeShellArg cfg.dataDir}
+
+        # Ensure the database is correct or create it
+        ${pkgs.sudo}/bin/sudo -u ${postgres.superUser} ${postgres.package}/bin/createuser \
+          -SDR hydron || true
+        ${pkgs.sudo}/bin/sudo -u ${postgres.superUser} ${postgres.package}/bin/createdb \
+          -T template0 -E UTF8 -O hydron hydron || true
+        ${pkgs.sudo}/bin/sudo -u hydron ${postgres.package}/bin/psql \
+          -c "ALTER ROLE hydron WITH PASSWORD '$(cat ${escapeShellArg cfg.passwordFile})';" || true
      '';

      serviceConfig = {
@ -101,5 +155,9 @@ in with lib; {
    };
  };

+  imports = [
+    (mkRenamedOptionModule [ "services" "hydron" "baseDir" ] [ "services" "hydron" "dataDir" ])
+  ];
+
  meta.maintainers = with maintainers; [ chiiruno ];
 }
--- a/nixos/modules/services/web-servers/meguca.nix
+++ b/nixos/modules/services/web-servers/meguca.nix
@ -1,65 +1,71 @@
 { config, lib, pkgs, ... }:

-with lib;
 let
  cfg = config.services.meguca;
  postgres = config.services.postgresql;
-in
-{
+in with lib; {
  options.services.meguca = {
    enable = mkEnableOption "meguca";

-    baseDir = mkOption {
+    dataDir = mkOption {
      type = types.path;
-      default = "/run/meguca";
+      default = "/var/lib/meguca";
+      example = "/home/okina/meguca";
      description = "Location where meguca stores it's database and links.";
    };

    password = mkOption {
      type = types.str;
      default = "meguca";
+      example = "dumbpass";
      description = "Password for the meguca database.";
    };

    passwordFile = mkOption {
      type = types.path;
      default = "/run/keys/meguca-password-file";
+      example = "/home/okina/meguca/keys/pass";
      description = "Password file for the meguca database.";
    };

    reverseProxy = mkOption {
      type = types.nullOr types.str;
      default = null;
+      example = "192.168.1.5";
      description = "Reverse proxy IP.";
    };

    sslCertificate = mkOption {
      type = types.nullOr types.str;
      default = null;
+      example = "/home/okina/meguca/ssl.cert";
      description = "Path to the SSL certificate.";
    };

    listenAddress = mkOption {
      type = types.nullOr types.str;
      default = null;
+      example = "127.0.0.1:8000";
      description = "Listen on a specific IP address and port.";
    };

    cacheSize = mkOption {
      type = types.nullOr types.int;
      default = null;
+      example = 256;
      description = "Cache size in MB.";
    };

    postgresArgs = mkOption {
      type = types.str;
-      default = "user=meguca password=" + cfg.password + " dbname=meguca sslmode=disable";
+      example = "user=meguca password=dumbpass dbname=meguca sslmode=disable";
      description = "Postgresql connection arguments.";
    };

    postgresArgsFile = mkOption {
      type = types.path;
      default = "/run/keys/meguca-postgres-args";
+      example = "/home/okina/meguca/keys/postgres";
      description = "Postgresql connection arguments file.";
    };

@ -83,18 +89,11 @@ in
  };

  config = mkIf cfg.enable {
-    security.sudo.enable = cfg.enable == true;
-    services.postgresql.enable = cfg.enable == true;
-
-    services.meguca.passwordFile = mkDefault (toString (pkgs.writeTextFile {
-      name = "meguca-password-file";
-      text = cfg.password;
-    }));
-
-    services.meguca.postgresArgsFile = mkDefault (toString (pkgs.writeTextFile {
-      name = "meguca-postgres-args";
-      text = cfg.postgresArgs;
-    }));
+    security.sudo.enable = cfg.enable;
+    services.postgresql.enable = cfg.enable;
+    services.meguca.passwordFile = mkDefault (pkgs.writeText "meguca-password-file" cfg.password);
+    services.meguca.postgresArgsFile = mkDefault (pkgs.writeText "meguca-postgres-args" cfg.postgresArgs);
+    services.meguca.postgresArgs = mkDefault "user=meguca password=${cfg.password} dbname=meguca sslmode=disable";

    systemd.services.meguca = {
      description = "meguca";
@ -102,10 +101,11 @@ in
      wantedBy = [ "multi-user.target" ];

      preStart = ''
-        # Ensure folder exists and links are correct or create them
-        mkdir -p ${cfg.baseDir}
-        chmod 750 ${cfg.baseDir}
-        ln -sf ${pkgs.meguca}/share/meguca/www ${cfg.baseDir}
+        # Ensure folder exists or create it and links and permissions are correct
+        mkdir -p ${escapeShellArg cfg.dataDir}
+        ln -sf ${pkgs.meguca}/share/meguca/www ${escapeShellArg cfg.dataDir}
+        chmod 750 ${escapeShellArg cfg.dataDir}
+        chown -R meguca:meguca ${escapeShellArg cfg.dataDir}

        # Ensure the database is correct or create it
        ${pkgs.sudo}/bin/sudo -u ${postgres.superUser} ${postgres.package}/bin/createuser \
@ -113,47 +113,46 @@ in
        ${pkgs.sudo}/bin/sudo -u ${postgres.superUser} ${postgres.package}/bin/createdb \
          -T template0 -E UTF8 -O meguca meguca || true
        ${pkgs.sudo}/bin/sudo -u meguca ${postgres.package}/bin/psql \
-          -c "ALTER ROLE meguca WITH PASSWORD '$(cat ${cfg.passwordFile})';" || true
+          -c "ALTER ROLE meguca WITH PASSWORD '$(cat ${escapeShellArg cfg.passwordFile})';" || true
      '';

    script = ''
-      cd ${cfg.baseDir}
+      cd ${escapeShellArg cfg.dataDir}

-      ${pkgs.meguca}/bin/meguca -d "$(cat ${cfg.postgresArgsFile})"\
-        ${optionalString (cfg.reverseProxy != null) " -R ${cfg.reverseProxy}"}\
-        ${optionalString (cfg.sslCertificate != null) " -S ${cfg.sslCertificate}"}\
-        ${optionalString (cfg.listenAddress != null) " -a ${cfg.listenAddress}"}\
-        ${optionalString (cfg.cacheSize != null) " -c ${toString cfg.cacheSize}"}\
-        ${optionalString (cfg.compressTraffic) " -g"}\
-        ${optionalString (cfg.assumeReverseProxy) " -r"}\
-        ${optionalString (cfg.httpsOnly) " -s"} start
-    '';
+      ${pkgs.meguca}/bin/meguca -d "$(cat ${escapeShellArg cfg.postgresArgsFile})"''
+      + optionalString (cfg.reverseProxy != null) " -R ${cfg.reverseProxy}"
+      + optionalString (cfg.sslCertificate != null) " -S ${cfg.sslCertificate}"
+      + optionalString (cfg.listenAddress != null) " -a ${cfg.listenAddress}"
+      + optionalString (cfg.cacheSize != null) " -c ${toString cfg.cacheSize}"
+      + optionalString (cfg.compressTraffic) " -g"
+      + optionalString (cfg.assumeReverseProxy) " -r"
+      + optionalString (cfg.httpsOnly) " -s" + " start";

      serviceConfig = {
        PermissionsStartOnly = true;
        Type = "forking";
        User = "meguca";
        Group = "meguca";
-        RuntimeDirectory = "meguca";
        ExecStop = "${pkgs.meguca}/bin/meguca stop";
      };
    };

    users = {
+      groups.meguca.gid = config.ids.gids.meguca;
+
      users.meguca = {
        description = "meguca server service user";
-        home = cfg.baseDir;
+        home = cfg.dataDir;
        createHome = true;
        group = "meguca";
        uid = config.ids.uids.meguca;
      };
-
-      groups.meguca = {
-        gid = config.ids.gids.meguca;
-        members = [ "meguca" ];
-      };
    };
  };

+  imports = [
+    (mkRenamedOptionModule [ "services" "meguca" "baseDir" ] [ "services" "meguca" "dataDir" ])
+  ];
+
  meta.maintainers = with maintainers; [ chiiruno ];
 }
--- a/nixos/modules/services/web-servers/tomcat.nix
+++ b/nixos/modules/services/web-servers/tomcat.nix
@ -108,7 +108,7 @@ in
      };

      webapps = mkOption {
-        type = types.listOf types.package;
+        type = types.listOf types.path;
        default = [ tomcat.webapps ];
        defaultText = "[ pkgs.tomcat85.webapps ]";
        description = "List containing WAR files or directories with WAR files which are web applications to be deployed on Tomcat";
@ -118,8 +118,15 @@ in
        type = types.listOf (types.submodule {
          options = {
            name = mkOption {
-              type = types.listOf types.str;
+              type = types.str;
              description = "name of the virtualhost";
+            };
+            webapps = mkOption {
+              type = types.listOf types.path;
+              description = ''
+                List containing web application WAR files and/or directories containing
+                web applications and configuration files for the virtual host.
+              '';
              default = [];
            };
          };
--- a/nixos/modules/services/x11/desktop-managers/default.nix
+++ b/nixos/modules/services/x11/desktop-managers/default.nix
@ -96,13 +96,13 @@ in
          else if any (w: w.name == defaultDM) cfg.session.list then
            defaultDM
          else
-            throw ''
-              Default desktop manager (${defaultDM}) not found.
-              Probably you want to change
-                services.xserver.desktopManager.default = "${defaultDM}";
-              to one of
+            builtins.trace ''
+              Default desktop manager (${defaultDM}) not found at evaluation time.
+              These are the known valid session names:
                ${concatMapStringsSep "\n  " (w: "services.xserver.desktopManager.default = \"${w.name}\";") cfg.session.list}
-            '';
+              It's also possible the default can be found in one of these packages:
+                ${concatMapStringsSep "\n  " (p: p.name) config.services.xserver.displayManager.extraSessionFilePackages}
+            '' defaultDM;
      };

    };
--- a/nixos/modules/services/x11/desktop-managers/gnome3.nix
+++ b/nixos/modules/services/x11/desktop-managers/gnome3.nix
@ -57,8 +57,12 @@ in {
      sessionPath = mkOption {
        default = [];
        example = literalExample "[ pkgs.gnome3.gpaste ]";
-        description = "Additional list of packages to be added to the session search path.
-                       Useful for gnome shell extensions or gsettings-conditionated autostart.";
+        description = ''
+          Additional list of packages to be added to the session search path.
+          Useful for GNOME Shell extensions or GSettings-conditional autostart.
+
+          Note that this should be a last resort; patching the package is preferred (see GPaste).
+        '';
        apply = list: list ++ [ pkgs.gnome3.gnome-shell pkgs.gnome3.gnome-shell-extensions ];
      };

@ -126,18 +130,10 @@ in {

    fonts.fonts = [ pkgs.dejavu_fonts pkgs.cantarell-fonts ];

-    services.xserver.desktopManager.session = singleton
-      { name = "gnome3";
-        bgSupport = true;
-        start = ''
-          # Set GTK_DATA_PREFIX so that GTK+ can find the themes
-          export GTK_DATA_PREFIX=${config.system.path}
-
-          # find theme engines
-          export GTK_PATH=${config.system.path}/lib/gtk-3.0:${config.system.path}/lib/gtk-2.0
-
-          export XDG_MENU_PREFIX=gnome-
+    services.xserver.displayManager.extraSessionFilePackages = [ pkgs.gnome3.gnome-session ];

+    services.xserver.displayManager.sessionCommands = ''
+      if test "$XDG_CURRENT_DESKTOP" = "GNOME"; then
          ${concatMapStrings (p: ''
            if [ -d "${p}/share/gsettings-schemas/${p.name}" ]; then
              export XDG_DATA_DIRS=$XDG_DATA_DIRS''${XDG_DATA_DIRS:+:}${p}/share/gsettings-schemas/${p.name}
@ -148,34 +144,28 @@ in {
              export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}${p}/lib
            fi
          '') cfg.sessionPath}
+      fi
+    '';

-          # Override default mimeapps
-          export XDG_DATA_DIRS=$XDG_DATA_DIRS''${XDG_DATA_DIRS:+:}${mimeAppsList}/share
+    environment.variables.GNOME_SESSION_DEBUG = optionalString cfg.debug "1";

-          # Override gsettings-desktop-schema
-          export NIX_GSETTINGS_OVERRIDES_DIR=${nixos-gsettings-desktop-schemas}/share/gsettings-schemas/nixos-gsettings-overrides/glib-2.0/schemas
+    # Override default mimeapps
+    environment.variables.XDG_DATA_DIRS = [ "${mimeAppsList}/share" ];

-          # Let nautilus find extensions
-          export NAUTILUS_EXTENSION_DIR=${config.system.path}/lib/nautilus/extensions-3.0/
+    # Override GSettings schemas
+    environment.variables.NIX_GSETTINGS_OVERRIDES_DIR = "${nixos-gsettings-desktop-schemas}/share/gsettings-schemas/nixos-gsettings-overrides/glib-2.0/schemas";

-          # Find the mouse
-          export XCURSOR_PATH=~/.icons:${config.system.path}/share/icons
-
-          # Update user dirs as described in http://freedesktop.org/wiki/Software/xdg-user-dirs/
-          ${pkgs.xdg-user-dirs}/bin/xdg-user-dirs-update
-
-          ${pkgs.gnome3.gnome-session}/bin/gnome-session ${optionalString cfg.debug "--debug"} &
-          waitPID=$!
-        '';
-      };
-
-    services.xserver.updateDbusEnvironment = true;
+    # Let nautilus find extensions
+    # TODO: Create nautilus-with-extensions package
+    environment.variables.NAUTILUS_EXTENSION_DIR = "${config.system.path}/lib/nautilus/extensions-3.0";

    environment.variables.GIO_EXTRA_MODULES = [ "${lib.getLib pkgs.gnome3.dconf}/lib/gio/modules"
                                                "${pkgs.gnome3.glib-networking.out}/lib/gio/modules"
                                                "${pkgs.gnome3.gvfs}/lib/gio/modules" ];
    environment.systemPackages = pkgs.gnome3.corePackages ++ cfg.sessionPath
-      ++ (removePackagesByName pkgs.gnome3.optionalPackages config.environment.gnome3.excludePackages);
+      ++ (removePackagesByName pkgs.gnome3.optionalPackages config.environment.gnome3.excludePackages) ++ [
+      pkgs.xdg-user-dirs # Update user dirs as described in http://freedesktop.org/wiki/Software/xdg-user-dirs/
+    ];

    # Use the correct gnome3 packageSet
    networking.networkmanager.basePackages =
--- a/nixos/modules/services/x11/display-managers/default.nix
+++ b/nixos/modules/services/x11/display-managers/default.nix
@ -27,55 +27,26 @@ let
    Xft.hintstyle: hintslight
  '';

-  # file provided by services.xserver.displayManager.session.script
-  xsession = wm: dm: pkgs.writeScript "xsession"
+  # file provided by services.xserver.displayManager.session.wrapper
+  xsessionWrapper = pkgs.writeScript "xsession-wrapper"
    ''
      #! ${pkgs.bash}/bin/bash

-      # Expected parameters:
-      #   $1 = <desktop-manager>+<window-manager>
-
-      # Actual parameters (FIXME):
-      # SDDM is calling this script like the following:
-      #   $1 = /nix/store/xxx-xsession (= $0)
-      #   $2 = <desktop-manager>+<window-manager>
-      # SLiM is using the following parameter:
-      #   $1 = /nix/store/xxx-xsession <desktop-manager>+<window-manager>
-      # LightDM keeps the double quotes:
-      #   $1 = /nix/store/xxx-xsession "<desktop-manager>+<window-manager>"
-      # The fake/auto display manager doesn't use any parameters and GDM is
-      # broken.
-      # If you want to "debug" this script don't print the parameters to stdout
-      # or stderr because this script will be executed multiple times and the
-      # output won't be visible in the log when the script is executed for the
-      # first time (e.g. append them to a file instead)!
-
-      # All of the above cases are handled by the following hack (FIXME).
-      # Since this line is *very important* for *all display managers* it is
-      # very important to test changes to the following line with all display
-      # managers:
-      if [ "''${1:0:1}" = "/" ]; then eval exec "$1" "$2" ; fi
-
-      # Now it should be safe to assume that the script was called with the
-      # expected parameters.
+      # Shared environment setup for graphical sessions.

      . /etc/profile
      cd "$HOME"

-      # The first argument of this script is the session type.
-      sessionType="$1"
-      if [ "$sessionType" = default ]; then sessionType=""; fi
-
      ${optionalString cfg.startDbusSession ''
        if test -z "$DBUS_SESSION_BUS_ADDRESS"; then
-          exec ${pkgs.dbus.dbus-launch} --exit-with-session "$0" "$sessionType"
+          exec ${pkgs.dbus.dbus-launch} --exit-with-session "$0" "$@"
        fi
      ''}

      ${optionalString cfg.displayManager.job.logToJournal ''
        if [ -z "$_DID_SYSTEMD_CAT" ]; then
          export _DID_SYSTEMD_CAT=1
-          exec ${config.systemd.package}/bin/systemd-cat -t xsession "$0" "$sessionType"
+          exec ${config.systemd.package}/bin/systemd-cat -t xsession "$0" "$@"
        fi
      ''}

@ -90,7 +61,9 @@ let
        }

        # Publish access credentials in the root window.
-        ${config.hardware.pulseaudio.package.out}/bin/pactl load-module module-x11-publish "display=$DISPLAY"
+        if ${config.hardware.pulseaudio.package.out}/bin/pulseaudio --dump-modules | grep module-x11-publish &> /dev/null; then
+          ${config.hardware.pulseaudio.package.out}/bin/pactl load-module module-x11-publish "display=$DISPLAY"
+        fi
      ''}

      # Tell systemd about our $DISPLAY and $XAUTHORITY.
@ -101,6 +74,7 @@ let
      ${config.systemd.package}/bin/systemctl --user import-environment DISPLAY XAUTHORITY DBUS_SESSION_BUS_ADDRESS

      # Load X defaults.
+      # FIXME: Check XDG_SESSION_TYPE against x11
      ${xorg.xrdb}/bin/xrdb -merge ${xresourcesXft}
      if test -e ~/.Xresources; then
          ${xorg.xrdb}/bin/xrdb -merge ~/.Xresources
@ -132,12 +106,33 @@ let
      # Allow the user to setup a custom session type.
      if test -x ~/.xsession; then
          exec ~/.xsession
-      else
-          if test "$sessionType" = "custom"; then
-              sessionType="" # fall-thru if there is no ~/.xsession
-          fi
      fi

+      if test "$1"; then
+          # Run the supplied session command. Remove any double quotes with eval.
+          eval exec "$@"
+      else
+          # Fall back to the default window/desktopManager
+          exec ${cfg.displayManager.session.script}
+      fi
+    '';
+
+  # file provided by services.xserver.displayManager.session.script
+  xsession = wm: dm: pkgs.writeScript "xsession"
+    ''
+      #! ${pkgs.bash}/bin/bash
+
+      # Legacy session script used to construct .desktop files from
+      # `services.xserver.displayManager.session` entries. Called from
+      # `sessionWrapper`.
+
+      # Expected parameters:
+      #   $1 = <desktop-manager>+<window-manager>
+
+      # The first argument of this script is the session type.
+      sessionType="$1"
+      if [ "$sessionType" = default ]; then sessionType=""; fi
+
      # The session type is "<desktop-manager>+<window-manager>", so
      # extract those (see:
      # http://wiki.bash-hackers.org/syntax/pe#substring_removal).
@ -186,19 +181,22 @@ let
      allowSubstitutes = false;
    }
    ''
-      mkdir -p "$out"
+      mkdir -p "$out/share/xsessions"
      ${concatMapStrings (n: ''
-        cat - > "$out/${n}.desktop" << EODESKTOP
+        cat - > "$out/share/xsessions/${n}.desktop" << EODESKTOP
        [Desktop Entry]
        Version=1.0
        Type=XSession
        TryExec=${cfg.displayManager.session.script}
        Exec=${cfg.displayManager.session.script} "${n}"
-        X-GDM-BypassXsession=true
        Name=${n}
        Comment=
        EODESKTOP
      '') names}
+
+      ${concatMapStrings (pkg: ''
+        ${xorg.lndir}/bin/lndir ${pkg}/share/xsessions $out/share/xsessions
+      '') cfg.displayManager.extraSessionFilePackages}
    '';

 in
@ -245,6 +243,14 @@ in
        '';
      };

+      extraSessionFilePackages = mkOption {
+        type = types.listOf types.package;
+        default = [];
+        description = ''
+          A list of packages containing xsession files to be passed to the display manager.
+        '';
+      };
+
      session = mkOption {
        default = [];
        example = literalExample
@ -280,6 +286,7 @@ in
              (filter (w: d.name != "none" || w.name != "none") wm));
          desktops = mkDesktops names;
          script = xsession wm dm;
+          wrapper = xsessionWrapper;
        };
      };

--- a/nixos/modules/services/x11/display-managers/gdm.nix
+++ b/nixos/modules/services/x11/display-managers/gdm.nix
@ -109,7 +109,7 @@ in
        environment = {
          GDM_X_SERVER_EXTRA_ARGS = toString
            (filter (arg: arg != "-terminate") cfg.xserverArgs);
-          GDM_SESSIONS_DIR = "${cfg.session.desktops}";
+          GDM_SESSIONS_DIR = "${cfg.session.desktops}/share/xsessions";
          # Find the mouse
          XCURSOR_PATH = "~/.icons:${pkgs.gnome3.adwaita-icon-theme}/share/icons";
        };
@ -173,6 +173,8 @@ in
      ${optionalString cfg.gdm.debug "Enable=true"}
    '';

+    environment.etc."gdm/Xsession".source = config.services.xserver.displayManager.session.wrapper;
+
    # GDM LFS PAM modules, adapted somehow to NixOS
    security.pam.services = {
      gdm-launch-environment.text = ''
--- a/nixos/modules/services/x11/display-managers/lightdm.nix
+++ b/nixos/modules/services/x11/display-managers/lightdm.nix
@ -45,11 +45,11 @@ let
        greeter-user = ${config.users.users.lightdm.name}
        greeters-directory = ${cfg.greeter.package}
      ''}
-      sessions-directory = ${dmcfg.session.desktops}
+      sessions-directory = ${dmcfg.session.desktops}/share/xsessions

      [Seat:*]
      xserver-command = ${xserverWrapper}
-      session-wrapper = ${dmcfg.session.script}
+      session-wrapper = ${dmcfg.session.wrapper}
      ${optionalString cfg.greeter.enable ''
        greeter-session = ${cfg.greeter.name}
      ''}
@ -176,21 +176,13 @@ in
          LightDM auto-login requires services.xserver.displayManager.lightdm.autoLogin.user to be set
        '';
      }
-      { assertion = cfg.autoLogin.enable -> elem defaultSessionName dmcfg.session.names;
+      { assertion = cfg.autoLogin.enable -> dmDefault != "none" || wmDefault != "none";
        message = ''
          LightDM auto-login requires that services.xserver.desktopManager.default and
          services.xserver.windowMananger.default are set to valid values. The current
          default session: ${defaultSessionName} is not valid.
        '';
      }
-      { assertion = hasDefaultUserSession -> elem defaultSessionName dmcfg.session.names;
-        message = ''
-          services.xserver.desktopManager.default and
-          services.xserver.windowMananger.default are not set to valid
-          values. The current default session: ${defaultSessionName}
-          is not valid.
-        '';
-      }
      { assertion = !cfg.greeter.enable -> (cfg.autoLogin.enable && cfg.autoLogin.timeout == 0);
        message = ''
          LightDM can only run without greeter if automatic login is enabled and the timeout for it
--- a/nixos/modules/services/x11/display-managers/sddm.nix
+++ b/nixos/modules/services/x11/display-managers/sddm.nix
@ -49,8 +49,8 @@ let
    MinimumVT=${toString (if xcfg.tty != null then xcfg.tty else 7)}
    ServerPath=${xserverWrapper}
    XephyrPath=${pkgs.xorg.xorgserver.out}/bin/Xephyr
-    SessionCommand=${dmcfg.session.script}
-    SessionDir=${dmcfg.session.desktops}
+    SessionCommand=${dmcfg.session.wrapper}
+    SessionDir=${dmcfg.session.desktops}/share/xsessions
    XauthPath=${pkgs.xorg.xauth}/bin/xauth
    DisplayCommand=${Xsetup}
    DisplayStopCommand=${Xstop}
--- a/nixos/modules/services/x11/display-managers/slim.nix
+++ b/nixos/modules/services/x11/display-managers/slim.nix
@ -13,8 +13,8 @@ let
      xauth_path ${dmcfg.xauthBin}
      default_xserver ${dmcfg.xserverBin}
      xserver_arguments ${toString dmcfg.xserverArgs}
-      sessiondir ${dmcfg.session.desktops}
-      login_cmd exec ${pkgs.runtimeShell} ${dmcfg.session.script} "%session"
+      sessiondir ${dmcfg.session.desktops}/share/xsessions
+      login_cmd exec ${pkgs.runtimeShell} ${dmcfg.session.wrapper} "%session"
      halt_cmd ${config.systemd.package}/sbin/shutdown -h now
      reboot_cmd ${config.systemd.package}/sbin/shutdown -r now
      logfile /dev/stderr
--- a/nixos/release.nix
+++ b/nixos/release.nix
@ -256,6 +256,7 @@ in rec {
  tests.buildbot = callTest tests/buildbot.nix {};
  tests.cadvisor = callTestOnMatchingSystems ["x86_64-linux"] tests/cadvisor.nix {};
  tests.ceph = callTestOnMatchingSystems ["x86_64-linux"] tests/ceph.nix {};
+  tests.cfssl = callTestOnMatchingSystems ["x86_64-linux"] tests/cfssl.nix {};
  tests.chromium = (callSubTestsOnMatchingSystems ["x86_64-linux"] tests/chromium.nix {}).stable or {};
  tests.cjdns = callTest tests/cjdns.nix {};
  tests.cloud-init = callTest tests/cloud-init.nix {};
--- a/nixos/tests/cfssl.nix
+++ b/nixos/tests/cfssl.nix
@ -0,0 +1,67 @@
+import ./make-test.nix ({ pkgs, ...} : {
+  name = "cfssl";
+
+  machine = { config, lib, pkgs, ... }:
+  {
+    networking.firewall.allowedTCPPorts = [ config.services.cfssl.port ];
+
+    services.cfssl.enable = true;
+    systemd.services.cfssl.after = [ "cfssl-init.service" ];
+
+    systemd.services.cfssl-init = {
+      description = "Initialize the cfssl CA";
+      wantedBy    = [ "multi-user.target" ];
+      serviceConfig = {
+        User             = "cfssl";
+        Type             = "oneshot";
+        WorkingDirectory = config.services.cfssl.dataDir;
+      };
+      script = with pkgs; ''
+        ${cfssl}/bin/cfssl genkey -initca ${pkgs.writeText "ca.json" (builtins.toJSON {
+          hosts = [ "ca.example.com" ];
+          key = {
+            algo = "rsa"; size = 4096; };
+            names = [
+              {
+                C = "US";
+                L = "San Francisco";
+                O = "Internet Widgets, LLC";
+                OU = "Certificate Authority";
+                ST = "California";
+              }
+            ];
+        })} | ${cfssl}/bin/cfssljson -bare ca
+      '';
+    };
+  };
+
+  testScript =
+  let
+    cfsslrequest = with pkgs; writeScript "cfsslrequest" ''
+      curl -X POST -H "Content-Type: application/json" -d @${csr} \
+        http://localhost:8888/api/v1/cfssl/newkey | ${cfssl}/bin/cfssljson /tmp/certificate
+    '';
+    csr = pkgs.writeText "csr.json" (builtins.toJSON {
+      CN = "www.example.com";
+      hosts = [ "example.com" "www.example.com" ];
+      key = {
+        algo = "rsa";
+        size = 2048;
+      };
+      names = [
+        {
+          C = "US";
+          L = "San Francisco";
+          O = "Example Company, LLC";
+          OU = "Operations";
+          ST = "California";
+        }
+      ];
+    });
+  in
+    ''
+      $machine->waitForUnit('cfssl.service');
+      $machine->waitUntilSucceeds('${cfsslrequest}');
+      $machine->succeed('ls /tmp/certificate-key.pem');
+    '';
+})
--- a/nixos/tests/containers-imperative.nix
+++ b/nixos/tests/containers-imperative.nix
@ -9,6 +9,11 @@ import ./make-test.nix ({ pkgs, ...} : {
  machine =
    { config, pkgs, lib, ... }:
    { imports = [ ../modules/installer/cd-dvd/channel.nix ];
+
+      # XXX: Sandbox setup fails while trying to hardlink files from the host's
+      #      store file system into the prepared chroot directory.
+      nix.useSandbox = false;
+
      virtualisation.writableStore = true;
      virtualisation.memorySize = 1024;
      # Make sure we always have all the required dependencies for creating a
--- a/nixos/tests/gnome3.nix
+++ b/nixos/tests/gnome3.nix
@ -15,6 +15,7 @@ import ./make-test.nix ({ pkgs, ...} : {
      services.xserver.displayManager.lightdm.autoLogin.enable = true;
      services.xserver.displayManager.lightdm.autoLogin.user = "alice";
      services.xserver.desktopManager.gnome3.enable = true;
+      services.xserver.desktopManager.default = "gnome";

      virtualisation.memorySize = 1024;
    };
--- a/nixos/tests/graphite.nix
+++ b/nixos/tests/graphite.nix
@ -1,4 +1,4 @@
-import ./make-test.nix ({ ... } :
+import ./make-test.nix ({ pkgs, ... } :
 {
  name = "graphite";
  nodes = {
@ -11,10 +11,12 @@ import ./make-test.nix ({ ... } :
          api = {
            enable = true;
            port = 8082;
+            finders = [ pkgs.python27Packages.influxgraph ];
          };
          carbon.enableCache = true;
          seyren.enable = true;
          pager.enable = true;
+          beacon.enable = true;
        };
      };
  };
@ -25,6 +27,7 @@ import ./make-test.nix ({ ... } :
    $one->waitForUnit("graphiteWeb.service");
    $one->waitForUnit("graphiteApi.service");
    $one->waitForUnit("graphitePager.service");
+    $one->waitForUnit("graphite-beacon.service");
    $one->waitForUnit("carbonCache.service");
    $one->waitForUnit("seyren.service");
    # The services above are of type "simple". systemd considers them active immediately
--- a/pkgs/applications/altcoins/bitcoin.nix
+++ b/pkgs/applications/altcoins/bitcoin.nix
@ -5,13 +5,13 @@
 with stdenv.lib;
 stdenv.mkDerivation rec{
  name = "bitcoin" + (toString (optional (!withGui) "d")) + "-" + version;
-  version = "0.16.1";
+  version = "0.16.2";

  src = fetchurl {
    urls = [ "https://bitcoincore.org/bin/bitcoin-core-${version}/bitcoin-${version}.tar.gz"
             "https://bitcoin.org/bin/bitcoin-core-${version}/bitcoin-${version}.tar.gz"
           ];
-    sha256 = "1zkqp93yircd3pbxczxfnibkpq0sgcv5r7wg6d196b9pwgr9zd39";
+    sha256 = "1n07qykx5hc0ph8fwn7hfrbsrjv19fdzvs5h0nysq4wfgn5wa40r";
  };

  nativeBuildInputs = [ pkgconfig autoreconfHook ];
--- a/pkgs/applications/altcoins/default.nix
+++ b/pkgs/applications/altcoins/default.nix
@ -86,6 +86,7 @@ rec {
  };

  parity = callPackage ./parity { };
+  parity-beta = callPackage ./parity/beta.nix { };
  parity-ui = callPackage ./parity-ui { };

  particl-core = callPackage ./particl/particl-core.nix { boost = boost165; miniupnpc = miniupnpc_2; };
--- a/pkgs/applications/altcoins/parity/beta.nix
+++ b/pkgs/applications/altcoins/parity/beta.nix
@ -0,0 +1,7 @@
+let
+  version     = "2.0.1";
+  sha256      = "0rfq0izpswfwbyvr5kb6zjyf6sd7l1706c0sp7ccy6ykdfb4v6zs";
+  cargoSha256 = "1ij17bfwvikqi5aj71j1nwf3jhkf3y9a0kwydajviwal47p9grl9";
+  patches     = [ ./patches/vendored-sources-2.0.patch ];
+in
+  import ./parity.nix { inherit version sha256 cargoSha256 patches; }
--- a/pkgs/applications/altcoins/parity/default.nix
+++ b/pkgs/applications/altcoins/parity/default.nix
@ -1,7 +1,7 @@
 let
-  version     = "1.10.9";
-  sha256      = "1irfksx887vvvdf97q26qacn22kmyj8fgb3ghh9wv5qnzrn3564g";
-  cargoSha256 = "0rzhabyhprmcg0cdmibbb8zgqf6z4izsdq8m060mppkkv675x0lf";
-  patches     = [ ./patches/vendored-sources-1.10.patch ];
+  version     = "1.11.8";
+  sha256      = "0qk5vl8ql3pr9pz5iz7whahwqi1fcbsf8kphn6z4grgc87id7b19";
+  cargoSha256 = "0p2idd36cyzp2ax81k533bdma4hz0ws2981qj2s7jnhvmj4941l8";
+  patches     = [ ./patches/vendored-sources-1.11.patch ];
 in
  import ./parity.nix { inherit version sha256 cargoSha256 patches; }
--- a/pkgs/applications/altcoins/parity/parity.nix
+++ b/pkgs/applications/altcoins/parity/parity.nix
@ -10,6 +10,8 @@
 , pkgconfig
 , openssl
 , systemd
+, cmake
+, perl
 }:

 rustPlatform.buildRustPackage rec {
@ -18,12 +20,15 @@ rustPlatform.buildRustPackage rec {

  src = fetchFromGitHub {
    owner = "paritytech";
-    repo = "parity";
+    repo = "parity-ethereum";
    rev = "v${version}";
    inherit sha256;
  };

-  buildInputs = [ pkgconfig systemd.lib systemd.dev openssl openssl.dev ]; 
+  buildInputs = [
+    pkgconfig cmake perl
+    systemd.lib systemd.dev openssl openssl.dev
+  ];

  # Some checks failed
  doCheck = false;
--- a/pkgs/applications/altcoins/parity/patches/vendored-sources-1.11.patch
+++ b/pkgs/applications/altcoins/parity/patches/vendored-sources-1.11.patch
@ -1,5 +1,5 @@
 diff --git a/.cargo/config b/.cargo/config
-index 72652ad2f..b21c6aa7b 100644
+index 72652ad2f..57c5c2f8f 100644
 --- a/.cargo/config
 +++ b/.cargo/config
@@ -1,3 +1,108 @@
@ -52,19 +52,19 @@ index 72652ad2f..b21c6aa7b 100644
 +branch = "master"
 +replace-with = "vendored-sources"
 +
+[source."https://github.com/paritytech/daemonize"]
+git = "https://github.com/paritytech/daemonize"
+branch = "master"
+replace-with = "vendored-sources"
+
 +[source."https://github.com/paritytech/hidapi-rs"]
 +git = "https://github.com/paritytech/hidapi-rs"
 +branch = "master"
 +replace-with = "vendored-sources"
 +
-+[source."https://github.com/paritytech/hyper"]
-+git = "https://github.com/paritytech/hyper"
-+branch = "master"
-+replace-with = "vendored-sources"
-+
 +[source."https://github.com/paritytech/jsonrpc.git"]
 +git = "https://github.com/paritytech/jsonrpc.git"
-+branch = "parity-1.10"
+branch = "parity-1.11"
 +replace-with = "vendored-sources"
 +
 +[source."https://github.com/paritytech/libusb-rs"]
@ -77,6 +77,11 @@ index 72652ad2f..b21c6aa7b 100644
 +branch = "master"
 +replace-with = "vendored-sources"
 +
+[source."https://github.com/paritytech/ring"]
+git = "https://github.com/paritytech/ring"
+branch = "master"
+replace-with = "vendored-sources"
+
 +[source."https://github.com/paritytech/rust-ctrlc.git"]
 +git = "https://github.com/paritytech/rust-ctrlc.git"
 +branch = "master"
@ -102,13 +107,7 @@ index 72652ad2f..b21c6aa7b 100644
 +branch = "master"
 +replace-with = "vendored-sources"
 +
-+[source."https://github.com/tailhook/rotor"]
-+git = "https://github.com/tailhook/rotor"
-+branch = "master"
-+replace-with = "vendored-sources"
-+
 +[source."https://github.com/tomusdrw/ws-rs"]
 +git = "https://github.com/tomusdrw/ws-rs"
 +branch = "master"
 +replace-with = "vendored-sources"
-+
--- a/pkgs/applications/altcoins/parity/patches/vendored-sources-2.0.patch
+++ b/pkgs/applications/altcoins/parity/patches/vendored-sources-2.0.patch
@ -0,0 +1,98 @@
+diff --git a/.cargo/config b/.cargo/config
+index 72652ad2f..3c0eca89a 100644
+--- a/.cargo/config
+++ b/.cargo/config
+@@ -1,3 +1,93 @@
+ [target.x86_64-pc-windows-msvc]
+ # Link the C runtime statically ; https://github.com/paritytech/parity/issues/6643
+ rustflags = ["-Ctarget-feature=+crt-static"]
+
+[source."https://github.com/alexcrichton/mio-named-pipes"]
+git = "https://github.com/alexcrichton/mio-named-pipes"
+branch = "master"
+replace-with = "vendored-sources"
+
+[source."https://github.com/nikvolf/parity-tokio-ipc"]
+git = "https://github.com/nikvolf/parity-tokio-ipc"
+branch = "master"
+replace-with = "vendored-sources"
+
+[source."https://github.com/nikvolf/tokio-named-pipes"]
+git = "https://github.com/nikvolf/tokio-named-pipes"
+branch = "master"
+replace-with = "vendored-sources"
+
+[source."https://github.com/paritytech/app-dirs-rs"]
+git = "https://github.com/paritytech/app-dirs-rs"
+branch = "master"
+replace-with = "vendored-sources"
+
+[source."https://github.com/paritytech/bn"]
+git = "https://github.com/paritytech/bn"
+branch = "master"
+replace-with = "vendored-sources"
+
+[source."https://github.com/paritytech/daemonize"]
+git = "https://github.com/paritytech/daemonize"
+branch = "master"
+replace-with = "vendored-sources"
+
+[source."https://github.com/paritytech/hidapi-rs"]
+git = "https://github.com/paritytech/hidapi-rs"
+branch = "master"
+replace-with = "vendored-sources"
+
+[source."https://github.com/paritytech/jsonrpc.git"]
+git = "https://github.com/paritytech/jsonrpc.git"
+branch = "parity-1.11"
+replace-with = "vendored-sources"
+
+[source."https://github.com/paritytech/libusb-rs"]
+git = "https://github.com/paritytech/libusb-rs"
+branch = "master"
+replace-with = "vendored-sources"
+
+[source."https://github.com/paritytech/libusb-sys"]
+git = "https://github.com/paritytech/libusb-sys"
+branch = "master"
+replace-with = "vendored-sources"
+
+[source."https://github.com/paritytech/parity-common"]
+git = "https://github.com/paritytech/parity-common"
+branch = "master"
+replace-with = "vendored-sources"
+
+[source."https://github.com/paritytech/ring"]
+git = "https://github.com/paritytech/ring"
+branch = "master"
+replace-with = "vendored-sources"
+
+[source."https://github.com/paritytech/rust-ctrlc.git"]
+git = "https://github.com/paritytech/rust-ctrlc.git"
+branch = "master"
+replace-with = "vendored-sources"
+
+[source."https://github.com/paritytech/rust-rocksdb"]
+git = "https://github.com/paritytech/rust-rocksdb"
+branch = "master"
+replace-with = "vendored-sources"
+
+[source."https://github.com/paritytech/rust-secp256k1"]
+git = "https://github.com/paritytech/rust-secp256k1"
+branch = "master"
+replace-with = "vendored-sources"
+
+[source."https://github.com/paritytech/rust-snappy"]
+git = "https://github.com/paritytech/rust-snappy"
+branch = "master"
+replace-with = "vendored-sources"
+
+[source."https://github.com/paritytech/trezor-sys"]
+git = "https://github.com/paritytech/trezor-sys"
+branch = "master"
+replace-with = "vendored-sources"
+
+[source."https://github.com/tomusdrw/ws-rs"]
+git = "https://github.com/tomusdrw/ws-rs"
+branch = "master"
+replace-with = "vendored-sources"
--- a/pkgs/applications/audio/audio-recorder/default.nix
+++ b/pkgs/applications/audio/audio-recorder/default.nix
@ -1,41 +1,29 @@
-{ stdenv, fetchurl, lib
-, pkgconfig, intltool, autoconf, gnome3
-, glib, dbus, gtk3, libdbusmenu-gtk3, libappindicator-gtk3, gst_all_1
+{ stdenv, fetchurl
+, pkgconfig, intltool, gnome3
+, glib, dbus, gtk3, libappindicator-gtk3, gst_all_1
 , librsvg, wrapGAppsHook
 , pulseaudioSupport ? true, libpulseaudio ? null }:

-with lib;
-
 stdenv.mkDerivation rec {
  name = "audio-recorder-${version}";
-  version = "1.9.7";
+  version = "2.1.3";

  src = fetchurl {
-    name = "${name}-zesty.tar.gz";
-    url = "${meta.homepage}/+archive/ubuntu/ppa/+files/audio-recorder_${version}%7Ezesty.tar.gz";
-    sha256 = "163c0vs5qj72y62731yp6sl6s0indh2szhjg02mxigv9b68dx89c";
+    name = "${name}.tar.gz";
+    url = "${meta.homepage}/+archive/ubuntu/ppa/+files/audio-recorder_${version}%7Ebionic.tar.gz";
+    sha256 = "160pnmnmc9zwzyclsci3w1qwlgxkfx1y3x5ck6i587w78570an1r";
  };

-  nativeBuildInputs = [ pkgconfig intltool autoconf wrapGAppsHook ];
+  # https://bugs.launchpad.net/audio-recorder/+bug/1784622
+  NIX_CFLAGS_COMPILE = "-I${gnome3.glib.dev}/include/gio-unix-2.0";

-  buildInputs = with gst_all_1; [
-    glib dbus gtk3 librsvg libdbusmenu-gtk3 libappindicator-gtk3 (stdenv.lib.getLib gnome3.dconf)
+  nativeBuildInputs = [ pkgconfig intltool wrapGAppsHook ];
+
+  buildInputs = [
+    glib dbus gtk3 librsvg libappindicator-gtk3
+  ] ++ (with gst_all_1; [
    gstreamer gst-plugins-base gst-plugins-good gst-plugins-bad gst-plugins-ugly gst-libav
-  ] ++ optional pulseaudioSupport libpulseaudio;
-
-  postPatch = ''
-    substituteInPlace configure.ac \
-      --replace 'PKG_CHECK_MODULES(GIO, gio-2.0 >= $GLIB_REQUIRED)' \
-                'PKG_CHECK_MODULES(GIO, gio-2.0 >= $GLIB_REQUIRED gio-unix-2.0)'
-    autoconf
-    intltoolize
-  '';
-
-  preFixup = ''
-    gappsWrapperArgs+=(--prefix XDG_DATA_DIRS : $out/share:$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH
-      --prefix GST_PLUGIN_SYSTEM_PATH_1_0 : $GST_PLUGIN_SYSTEM_PATH_1_0
-      --prefix GIO_EXTRA_MODULES : ${stdenv.lib.getLib gnome3.dconf}/lib/gio/modules)
-  '';
+  ]) ++ stdenv.lib.optional pulseaudioSupport libpulseaudio;

  meta = with stdenv.lib; {
    description = "Audio recorder for GNOME and Unity Desktops";
--- a/pkgs/applications/audio/reaper/default.nix
+++ b/pkgs/applications/audio/reaper/default.nix
@ -0,0 +1,81 @@
+{ stdenv, fetchurl, autoPatchelfHook, makeWrapper
+, alsaLib, xorg
+, fetchFromGitHub, pkgconfig, gnome3
+, gnome2, gdk_pixbuf, cairo, glib, freetype
+, libpulseaudio
+}:
+
+let
+  libSwell = stdenv.mkDerivation {
+    name = "libSwell";
+
+    src = fetchFromGitHub {
+      owner = "justinfrankel";
+      repo = "WDL";
+      rev = "e87f5bdee7327b63398366fde6ec0a3f08bf600d";
+      sha256 = "147idjqc6nc23w9krl8a9w571k5jx190z3id6ir6cr8zsx0lakdb";
+    };
+
+    nativeBuildInputs = [ pkgconfig ];
+    buildInputs = [ gnome3.gtk ];
+
+    buildPhase = ''
+      cd WDL/swell
+      make
+    '';
+
+    installPhase = ''
+      mv libSwell.so $out
+    '';
+  };
+
+in stdenv.mkDerivation rec {
+  name = "reaper-${version}";
+  version = "5.94";
+
+  src = fetchurl {
+    url = "https://www.reaper.fm/files/${stdenv.lib.versions.major version}.x/reaper${builtins.replaceStrings ["."] [""] version}_linux_x86_64.tar.xz";
+    sha256 = "16g5q12wh1cfbl9wq03vb7vpsd870k7i7883z0wn492x7y9syz8z";
+  };
+
+  nativeBuildInputs = [ autoPatchelfHook makeWrapper ];
+
+  buildInputs = [
+    alsaLib
+    stdenv.cc.cc.lib
+
+    xorg.libX11
+    xorg.libXi
+
+    gnome3.gtk
+    gdk_pixbuf
+    gnome2.pango
+    cairo
+    glib
+    freetype
+  ];
+
+  dontBuild = true;
+
+  installPhase = ''
+    ./install-reaper.sh --install $out/opt
+    rm $out/opt/REAPER/uninstall-reaper.sh
+
+    cp ${libSwell.out} $out/opt/REAPER/libSwell.so
+
+    wrapProgram $out/opt/REAPER/reaper \
+      --prefix LD_LIBRARY_PATH : ${libpulseaudio}/lib
+
+    mkdir $out/bin
+    ln -s $out/opt/REAPER/reaper $out/bin/
+    ln -s $out/opt/REAPER/reamote-server $out/bin/
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Digital audio workstation";
+    homepage = https://www.reaper.fm/;
+    license = licenses.unfree;
+    platforms = [ "x86_64-linux" ];
+    maintainers = with maintainers; [ jfrankenau ];
+  };
+}
--- a/pkgs/applications/editors/android-studio/common.nix
+++ b/pkgs/applications/editors/android-studio/common.nix
@ -1,4 +1,5 @@
-{ pname, version, build, sha256Hash, meta }:
+{ channel, pname, version, build, sha256Hash }:
+
 { bash
 , buildFHSUserEnv
 , coreutils
@ -36,8 +37,9 @@
 }:

 let
+  drvName = "android-studio-${channel}-${version}";
  androidStudio = stdenv.mkDerivation {
-    name = "${pname}-${version}";
+    name = drvName;

    src = fetchurl {
      url = "https://dl.google.com/dl/android/studio/ide-zips/${version}/android-studio-ide-${build}-linux.zip";
@ -115,17 +117,32 @@ let
  # (e.g. `mksdcard`) have `/lib/ld-linux.so.2` set as the interpreter. An FHS
  # environment is used as a work around for that.
  fhsEnv = buildFHSUserEnv {
-    name = "${pname}-fhs-env";
+    name = "${drvName}-fhs-env";
    multiPkgs = pkgs: [ pkgs.ncurses5 ];
  };

 in
  writeTextFile {
-    name = "${pname}-${version}";
+    name = "${drvName}-wrapper";
+    # TODO: Rename preview -> beta (and add -stable suffix?):
    destination = "/bin/${pname}";
    executable = true;
    text = ''
      #!${bash}/bin/bash
-      ${fhsEnv}/bin/${pname}-fhs-env ${androidStudio}/bin/studio.sh
+      ${fhsEnv}/bin/${drvName}-fhs-env ${androidStudio}/bin/studio.sh
    '';
-  } // { inherit meta; }
+  } // {
+    meta = with stdenv.lib; {
+      description = "The Official IDE for Android (${channel} channel)";
+      longDescription = ''
+        Android Studio is the official IDE for Android app development, based on
+        IntelliJ IDEA.
+      '';
+      homepage = if channel == "stable"
+        then https://developer.android.com/studio/index.html
+        else https://developer.android.com/studio/preview/index.html;
+      license = licenses.asl20;
+      platforms = [ "x86_64-linux" ];
+      maintainers = with maintainers; [ primeos ];
+    };
+  }
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@ -12,60 +12,39 @@ let
    build = "173.4819257";
    sha256Hash = "196yaswbxh2nd83gimjxr8ggr5xkdxq7n3xlh6ax73v59pj4hryq";
  };
-  latestVersion = {
-    version = "3.3.0.2"; # "Android Studio 3.3 Canary 3"
-    build = "181.4884283";
-    sha256Hash = "0r93yzw87cgzz60p60gknij5vaqmv1a1kyd4cr9gx8cbxw46lhwh";
+  betaVersion = {
+    version = "3.2.0.22"; # "Android Studio 3.2 Beta 5"
+    build = "181.4913314";
+    sha256Hash = "016nyn1pqviy089hg0dq7m4cqb39fdxdcy4zknkaq7dmgv1dj6x9";
+  };
+  latestVersion = { # canary & dev
+    version = "3.3.0.3"; # "Android Studio 3.3 Canary 4"
+    build = "182.4924367";
+    sha256Hash = "03fxjxlsbrpklsss1nvlkb41skr5ymmq9vdns8iikcm1ng925vfd";
  };
 in rec {
  # Old alias
  preview = beta;

-  # Attributes are named by the corresponding release channels
+  # Attributes are named by their corresponding release channels

  stable = mkStudio (stableVersion // {
+    channel = "stable";
    pname = "android-studio";
-    #pname = "android-studio-stable"; # TODO: Rename and provide symlink
-
-    meta = with stdenv.lib; {
-      description = "The Official IDE for Android (stable channel)";
-      longDescription = ''
-        Android Studio is the official IDE for Android app development, based on
-        IntelliJ IDEA.
-      '';
-      homepage = https://developer.android.com/studio/index.html;
-      license = licenses.asl20;
-      platforms = [ "x86_64-linux" ];
-      maintainers = with maintainers; [ primeos ];
-    };
  });

-  beta = mkStudio (latestVersion // {
+  beta = mkStudio (betaVersion // {
+    channel = "beta";
    pname = "android-studio-preview";
-    #pname = "android-studio-beta"; # TODO: Rename and provide symlink
-    version = "3.2.0.21"; # "Android Studio 3.2 Beta 4"
-    build = "181.4886486";
-    sha256Hash = "1n4lcy0ng87fv45qjlpdb2zn3zl5lg6jwkbaijhbsm2rh4ljisr3";
-
-    meta = stable.meta // {
-      description = "The Official IDE for Android (beta channel)";
-      homepage = https://developer.android.com/studio/preview/index.html;
-    };
  });

  dev = mkStudio (latestVersion // {
+    channel = "dev";
    pname = "android-studio-dev";
-
-    meta = beta.meta // {
-      description = "The Official IDE for Android (dev channel)";
-    };
  });

  canary = mkStudio (latestVersion // {
+    channel = "canary";
    pname = "android-studio-canary";
-
-    meta = beta.meta // {
-      description = "The Official IDE for Android (canary channel)";
-    };
  });
 }
--- a/pkgs/applications/editors/atom/default.nix
+++ b/pkgs/applications/editors/atom/default.nix
@ -1,12 +1,15 @@
 { stdenv, pkgs, fetchurl, makeWrapper, gvfs, atomEnv}:

 let
-  common = pname: {version, sha256}: stdenv.mkDerivation rec {
-    name = "${pname}-${version}";
-    inherit version;
+  common = pname: {version, sha256, beta ? null}:
+      let fullVersion = version + stdenv.lib.optionalString (beta != null) "-beta${toString beta}";
+      name = "${pname}-${fullVersion}";
+  in stdenv.mkDerivation {
+    inherit name;
+    version = fullVersion;

    src = fetchurl {
-      url = "https://github.com/atom/atom/releases/download/v${version}/atom-amd64.deb";
+      url = "https://github.com/atom/atom/releases/download/v${fullVersion}/atom-amd64.deb";
      name = "${name}.deb";
      inherit sha256;
    };
@ -61,12 +64,13 @@ let
  };
 in stdenv.lib.mapAttrs common {
  atom = {
-    version = "1.28.2";
-    sha256 = "07lz4lj07dbfz952l3q9vplvg41pxl1cx89gzy8bzzr3ay7kn6za";
+    version = "1.29.0";
+    sha256 = "0f0qpn8aw2qlqk8ah71xvk4vcmwsnsf2f3g4hz0rvaqnhb9ri9fz";
  };

  atom-beta = {
-    version = "1.29.0-beta1";
-    sha256 = "121y716pnq4vpjrymr505prskvi5a2lnn8hw79q8b4hf7yz0j6rb";
+    version = "1.30.0";
+    beta = 1;
+    sha256 = "0ygqj81xlwhzmmci0d0rd2q7xfskxd1k7h6db3zvvjdxjcnyqp1z";
  };
 }
--- a/pkgs/applications/editors/gnome-builder/default.nix
+++ b/pkgs/applications/editors/gnome-builder/default.nix
@ -0,0 +1,155 @@
+{ stdenv
+, desktop-file-utils
+, docbook_xsl
+, docbook_xml_dtd_43
+, fetchpatch
+, fetchurl
+, flatpak
+, glibcLocales
+, gnome3
+, gobjectIntrospection
+, gspell
+, gtk-doc
+, gtk3
+, gtksourceview3
+, hicolor-icon-theme
+, json-glib
+, jsonrpc-glib
+, libdazzle
+, libxml2
+, meson
+, ninja
+, ostree
+, pcre
+, pkgconfig
+, python3
+, sysprof
+, template-glib
+, vala
+, webkitgtk
+, wrapGAppsHook
+}:
+let
+  version = "3.28.4";
+  pname = "gnome-builder";
+in stdenv.mkDerivation {
+  name = "${pname}-${version}";
+
+  src = fetchurl {
+    url = "mirror://gnome/sources/${pname}/${gnome3.versionBranch version}/${pname}-${version}.tar.xz";
+    sha256 = "0ibb74jlyrl5f6rj1b74196zfg2qaf870lxgi76qzpkgwq0iya05";
+  };
+
+  nativeBuildInputs = [
+    #appstream-glib # tests fail if these tools are available
+    desktop-file-utils
+    docbook_xsl
+    docbook_xml_dtd_43
+    glibcLocales # for Meson's gtkdochelper
+    gobjectIntrospection
+    gtk-doc
+    hicolor-icon-theme
+    meson
+    ninja
+    pkgconfig
+    python3.pkgs.wrapPython
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    flatpak
+    gnome3.devhelp
+    gnome3.libgit2-glib
+    gnome3.libpeas
+    gnome3.vte
+    gspell
+    gtk3
+    gtksourceview3
+    json-glib
+    jsonrpc-glib
+    libdazzle
+    libxml2
+    ostree
+    pcre
+    python3
+    sysprof
+    template-glib
+    vala
+    webkitgtk
+  ];
+
+  outputs = [ "out" "devdoc" ];
+
+  prePatch = ''
+    patchShebangs build-aux/meson/post_install.py
+  '';
+
+  patches = [
+    (fetchpatch {
+      name = "absolute-shared-library-path.patch";
+      url = "https://gitlab.gnome.org/GNOME/gnome-builder/commit/1011cabc519fd7322e2d695c79bfce3e18ff6200.patch";
+      sha256 = "1g12zziidzrphp527aa8sklfaln4qpjprkz73f0c9w5ph6k252fw";
+    })
+    (fetchpatch {
+      name = "python-libprefix.patch";
+      url = "https://gitlab.gnome.org/GNOME/gnome-builder/commit/43494ce83a347f369ed4cfb8dd71d3b93452736b.patch";
+      sha256 = "0kgi3n3g13n1j4xa61ln9xiahcfdc43bxi5mw4yva2d5px445msf";
+    })
+    (fetchpatch {
+      name = "ostree-dependency.patch";
+      url = "https://gitlab.gnome.org/GNOME/gnome-builder/commit/8b11773b65c95f464a0de16b91318c1ca73deeae.patch";
+      sha256 = "18r4hd90id0w6r0lzqpw83bcj45nm9jhr46a0ffi1mcayb18mgbk";
+    })
+  ];
+
+  mesonFlags = [
+    "-Dpython_libprefix=${python3.libPrefix}"
+    "-Dwith_docs=true"
+
+    # Making the build system correctly detect clang header and library paths
+    # is difficult. Somebody should look into fixing this.
+    "-Dwith_clang=false"
+  ];
+
+  # Some tests fail due to being unable to find the Vte typelib, and I don't
+  # understand why. Somebody should look into fixing this.
+  doCheck = false;
+
+  preInstall = ''
+    export LC_ALL="en_US.utf-8"
+  '';
+
+  pythonPath = with python3.pkgs; requiredPythonModules [ pygobject3 ];
+
+  preFixup = ''
+    buildPythonPath "$out $pythonPath"
+    gappsWrapperArgs+=(
+      --prefix PYTHONPATH : "$program_PYTHONPATH"
+    )
+
+    # Ensure that all plugins get their interpreter paths fixed up.
+    find $out/lib -name \*.py -type f -print0 | while read -d "" f; do
+      chmod a+x "$f"
+    done
+  '';
+
+  passthru.updateScript = gnome3.updateScript { packageName = pname; };
+
+  meta = with stdenv.lib; {
+    description = "An IDE for writing GNOME-based software";
+    longDescription = ''
+      Global search, auto-completion, source code map, documentation
+      reference, and other features expected in an IDE, but with a focus
+      on streamlining GNOME-based development projects.
+
+      This package does not pull in the dependencies needed for every
+      plugin. If you find that a plugin you wish to use doesn't work, we
+      currently recommend running gnome-builder inside a nix-shell with
+      appropriate dependencies loaded.
+    '';
+    homepage = https://wiki.gnome.org/Apps/Builder;
+    license = licenses.gpl3Plus;
+    maintainers = gnome3.maintainers;
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/gis/qgis/default.nix
+++ b/pkgs/applications/gis/qgis/default.nix
@ -5,7 +5,7 @@
 }:

 stdenv.mkDerivation rec {
-  name = "qgis-2.18.20";
+  name = "qgis-2.18.22";

  buildInputs = [ gdal qt4 flex openssl bison proj geos xlibsWrapper sqlite gsl qwt qscintilla
    fcgi libspatialindex libspatialite postgresql qjson qca2 txt2tags pkgconfig ]
@ -34,7 +34,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "https://qgis.org/downloads/${name}.tar.bz2";
-    sha256 = "0bm9sv268lc3v48zjypsjjs62xnyb7zabzrms4jsy020waz6sk9g";
+    sha256 = "00b3a2hfn3i7bdx7x96vz2nj0976vpkhid4ss7n8c33fdvw3k82a";
  };

  # CMAKE_FIND_FRAMEWORK=never stops the installer choosing system
--- a/pkgs/applications/misc/1password/default.nix
+++ b/pkgs/applications/misc/1password/default.nix
@ -2,24 +2,24 @@

 stdenv.mkDerivation rec {
  name = "1password-${version}";
-  version = "0.4.1";
+  version = "0.5.1";
  src =
    if stdenv.system == "i686-linux" then
      fetchzip {
        url = "https://cache.agilebits.com/dist/1P/op/pkg/v${version}/op_linux_386_v${version}.zip";
-        sha256 = "1yzzh1f6hx7vwdgzp0znsjarjiw4xqmmrkc5xwywgjpg81qqpl8c";
+        sha256 = "08kzjilxpkvlwqjyxnic1n6xiy6gkndijwxdksm59k7c56mdawsz";
        stripRoot = false;
      }
    else if stdenv.system == "x86_64-linux" then
      fetchzip {
        url = "https://cache.agilebits.com/dist/1P/op/pkg/v${version}/op_linux_amd64_v${version}.zip";
-        sha256 = "0dgj1zqmpdbnsz2v2j7nqm232cdgyp9wagc089dxi4hbzkmfcvzx";
+        sha256 = "1bsbzaqws0z991r6rkjrxay74fj4g5ld4d748ygr0950zwi1m3h7";
        stripRoot = false;
      }
    else if stdenv.system == "x86_64-darwin" then
      fetchzip {
        url = "https://cache.agilebits.com/dist/1P/op/pkg/v${version}/op_darwin_amd64_v${version}.zip";
-        sha256 = "116bvyfg38npdhlzaxan5y47cbw7jvj94q5w6v71kxsjzxk9l44a";
+        sha256 = "1dhr8m9icip27v802gxl1vhl9rf0jq5awirdm72lqmlypj86df0g";
        stripRoot = false;
      }
    else throw "Architecture not supported";
@ -34,13 +34,11 @@ stdenv.mkDerivation rec {
  '';

  meta = with stdenv.lib; {
-    description = "1Password command-line tool";
-    homepage    = [
-      "https://blog.agilebits.com/2017/09/06/announcing-the-1password-command-line-tool-public-beta/"
-      "https://app-updates.agilebits.com/product_history/CLI"
-    ];
-    maintainers = with maintainers; [ joelburget ];
-    license     = licenses.unfree;
-    platforms   = [ "i686-linux" "x86_64-linux" "x86_64-darwin" ];
+    description  = "1Password command-line tool";
+    homepage     = https://support.1password.com/command-line/;
+    downloadPage = https://app-updates.agilebits.com/product_history/CLI;
+    maintainers  = with maintainers; [ joelburget ];
+    license      = licenses.unfree;
+    platforms    = [ "i686-linux" "x86_64-linux" "x86_64-darwin" ];
  };
 }
--- a/pkgs/applications/misc/doing/Gemfile
+++ b/pkgs/applications/misc/doing/Gemfile
@ -0,0 +1,2 @@
+source 'https://rubygems.org'
+gem 'doing', '1.0.10pre'
--- a/pkgs/applications/misc/doing/Gemfile.lock
+++ b/pkgs/applications/misc/doing/Gemfile.lock
@ -0,0 +1,25 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    chronic (0.10.2)
+    deep_merge (1.2.1)
+    doing (1.0.10pre)
+      chronic (~> 0.10, >= 0.10.2)
+      deep_merge
+      gli (~> 2.17.1)
+      haml (= 4.0.3)
+      json (~> 1.8.1)
+    gli (2.17.1)
+    haml (4.0.3)
+      tilt
+    json (1.8.6)
+    tilt (2.0.8)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  doing (= 1.0.10pre)
+
+BUNDLED WITH
+   1.14.6
--- a/pkgs/applications/misc/doing/default.nix
+++ b/pkgs/applications/misc/doing/default.nix
@ -0,0 +1,25 @@
+{ lib, bundlerEnv, ruby
+}:
+
+# Bundix:
+# nix-shell -p bundix zlib
+bundlerEnv rec {
+  pname = "doing";
+  version = (import ./gemset.nix).doing.version;
+
+  inherit ruby;
+  gemdir = ./.;
+
+  meta = with lib; {
+    description = "A command line tool for keeping track of what you’re doing and tracking what you’ve done.";
+    longDescription = ''
+      doing is a basic CLI for adding and listing "what was I doing" reminders
+      in a TaskPaper-formatted text file. It allows for multiple
+      sections/categories and flexible output formatting.
+    '';
+    homepage    = http://brettterpstra.com/projects/doing/;
+    license     = licenses.mit;
+    maintainers = with maintainers; [ ktf ];
+    platforms   = platforms.unix;
+  };
+}
--- a/pkgs/applications/misc/doing/gemset.nix
+++ b/pkgs/applications/misc/doing/gemset.nix
@ -0,0 +1,60 @@
+{
+  chronic = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1hrdkn4g8x7dlzxwb1rfgr8kw3bp4ywg5l4y4i9c2g5cwv62yvvn";
+      type = "gem";
+    };
+    version = "0.10.2";
+  };
+  deep_merge = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1q3picw7zx1xdkybmrnhmk2hycxzaa0jv4gqrby1s90dy5n7fmsb";
+      type = "gem";
+    };
+    version = "1.2.1";
+  };
+  doing = {
+    dependencies = ["chronic" "deep_merge" "gli" "haml" "json"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1y42yc7h45sz9hqj3g1dd77ipx58l7v64i7mrsj3is2f5rszd1rv";
+      type = "gem";
+    };
+    version = "1.0.10pre";
+  };
+  gli = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0g7g3lxhh2b4h4im58zywj9vcfixfgndfsvp84cr3x67b5zm4kaq";
+      type = "gem";
+    };
+    version = "2.17.1";
+  };
+  haml = {
+    dependencies = ["tilt"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1l9zhfdk9z7xjfdp108r9fw4xa55hflin7hh3lpafbf9bdz96knr";
+      type = "gem";
+    };
+    version = "4.0.3";
+  };
+  json = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0qmj7fypgb9vag723w1a49qihxrcf5shzars106ynw2zk352gbv5";
+      type = "gem";
+    };
+    version = "1.8.6";
+  };
+  tilt = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0020mrgdf11q23hm1ddd6fv691l51vi10af00f137ilcdb2ycfra";
+      type = "gem";
+    };
+    version = "2.0.8";
+  };
+}
--- a/pkgs/applications/misc/hugo/default.nix
+++ b/pkgs/applications/misc/hugo/default.nix
@ -2,7 +2,7 @@

 buildGoPackage rec {
  name = "hugo-${version}";
-  version = "0.42.1";
+  version = "0.46";

  goPackagePath = "github.com/gohugoio/hugo";

@ -10,11 +10,13 @@ buildGoPackage rec {
    owner  = "gohugoio";
    repo   = "hugo";
    rev    = "v${version}";
-    sha256 = "17m8bkldvnd7yyzxi4rc8vv3qfypjzik38bjy4qavb7sjdjmfij9";
+    sha256 = "0w5xkb6s03hprb4v151gdk8zzsgvy0i406363j1w03bic8ajwgmj";
  };

  goDeps = ./deps.nix;

+  buildFlags = "-tags extended";
+
  postInstall = ''
    rm $bin/bin/generate
  '';
--- a/pkgs/applications/misc/hugo/deps.nix
+++ b/pkgs/applications/misc/hugo/deps.nix
@ -1,5 +1,14 @@
 # This file was generated by https://github.com/kamilchm/go2nix v1.2.1
 [
+  {
+    goPackagePath = "github.com/BurntSushi/locker";
+    fetch = {
+      type = "git";
+      url = "https://github.com/BurntSushi/locker";
+      rev = "a6e239ea1c69bff1cfdb20c4b73dadf52f784b6a";
+      sha256 = "1xak4aync4klswq5217qvw191asgla51jr42y94vp109lirm5dzg";
+    };
+  }
  {
    goPackagePath = "github.com/BurntSushi/toml";
    fetch = {
@ -32,8 +41,8 @@
    fetch = {
      type = "git";
      url = "https://github.com/alecthomas/chroma";
-      rev = "d7b2ed20a4989ab604703f61f86523560f8a6a87";
-      sha256 = "0ni2ncck787sxk9gl14xnyjnw4y27ipypjf4kc00g635fvc64ik6";
+      rev = "5d7fef2ae60b501bbf28d476c3f273b8017d8261";
+      sha256 = "150jv4vhsdi1gj3liwkgicdrwnzgv5qkq2fwznlnzf64vmfb0b9f";
    };
  }
  {
@ -50,8 +59,17 @@
    fetch = {
      type = "git";
      url = "https://github.com/bep/gitmap";
-      rev = "012701e8669671499fc43e9792335a1dcbfe2afb";
-      sha256 = "10ixv4zwmrpxvpchws78yzsjvw1zplljw3iqvwpina2mkwwp71ql";
+      rev = "ecb6fe06dbfd6bb4225e7fda7dc15612ecc8d960";
+      sha256 = "0zqdl5h4ayi2gi5aqf35f1sjszhbcriksm2bf84fkrg7ngr48jn6";
+    };
+  }
+  {
+    goPackagePath = "github.com/bep/go-tocss";
+    fetch = {
+      type = "git";
+      url = "https://github.com/bep/go-tocss";
+      rev = "2abb118dc8688b6c7df44e12f4152c2bded9b19c";
+      sha256 = "12q7h6nydklq4kg65kcgd85209rx7zf64ba6nf3k7y16knj4233q";
    };
  }
  {
@ -68,8 +86,8 @@
    fetch = {
      type = "git";
      url = "https://github.com/cpuguy83/go-md2man";
-      rev = "48d8747a2ca13185e7cc8efe6e9fc196a83f71a5";
-      sha256 = "01hpll16rvxhnvv35vs3z8p51x54c5jyl1gjdm0g7kwfwp2chvjx";
+      rev = "691ee98543af2f262f35fbb54bdd42f00b9b9cc5";
+      sha256 = "1864g10y9n6ni0p1yqjhvwyjdh0lgxnf7dlb0c4njazdg5rppww9";
    };
  }
  {
@ -86,8 +104,8 @@
    fetch = {
      type = "git";
      url = "https://github.com/disintegration/imaging";
-      rev = "5e63c9a565d0a3260d23d060a795783dab90fefe";
-      sha256 = "1mmiz439lygi30dj1rbps57iqh762jkinnpb4wfl382v4h136qvp";
+      rev = "8021a62ea0dfe0ed2e6107f5ccd37e0d4a92a996";
+      sha256 = "1c32sqfz78g9wxvpng8n9r404lf2lgjn9b24mg8y3rxylx29gks7";
    };
  }
  {
@ -176,8 +194,8 @@
    fetch = {
      type = "git";
      url = "https://github.com/jdkato/prose";
-      rev = "e27abfd3f31b84c37bbce37179b0428fcb1384be";
-      sha256 = "04rjqh3jdxaqr9czp4vcj14hqfv7yppv4nb7ynb04c9jcq23ajw7";
+      rev = "99216ea17cba4e2f2a4e8bca778643e5a529b7aa";
+      sha256 = "1mdh276lmj21jbi22ky8ngdsl9hfcdv6czshycbaiwjr5y9cv7bn";
    };
  }
  {
@ -234,13 +252,22 @@
      sha256 = "0hlqcwx6qqgy3vs13r10wn0d9x0xmww1v9jm09y2dp1ykgbampnk";
    };
  }
+  {
+    goPackagePath = "github.com/mitchellh/hashstructure";
+    fetch = {
+      type = "git";
+      url = "https://github.com/mitchellh/hashstructure";
+      rev = "2bca23e0e452137f789efbc8610126fd8b94f73b";
+      sha256 = "0vpacsls26474wya360fjhzi6l4y8s8s251c4szvqxh17n5f5gk1";
+    };
+  }
  {
    goPackagePath = "github.com/mitchellh/mapstructure";
    fetch = {
      type = "git";
      url = "https://github.com/mitchellh/mapstructure";
-      rev = "bb74f1db0675b241733089d5a1faa5dd8b0ef57b";
-      sha256 = "1aqk9qr46bwgdc5j7n7als61xvssvyjf4qzfsvhacl4izpygqnw7";
+      rev = "f15292f7a699fcc1a38a80977f80a046874ba8ac";
+      sha256 = "0zm3nhdvmj3f8q0vg2sjfw1sm3pwsw0ggz501awz95w99664a8al";
    };
  }
  {
@ -257,8 +284,8 @@
    fetch = {
      type = "git";
      url = "https://github.com/nicksnyder/go-i18n";
-      rev = "f6ac3d9cf0c4b6a32527779e992ebde26bd3d948";
-      sha256 = "1vg25khaf7lr90xwf97bsyn873cdi1j7nxh68s80jrg2a86zw0ff";
+      rev = "461e8b98df7454b4cb46a1611a6734f05ee331d0";
+      sha256 = "0aq1q06y6azsi6mfmary5xs7gmmg8fh8lhx1wbpdlqk11asm9rq0";
    };
  }
  {
@ -275,8 +302,8 @@
    fetch = {
      type = "git";
      url = "https://github.com/pelletier/go-toml";
-      rev = "c01d1270ff3e442a8a57cddc1c92dc1138598194";
-      sha256 = "1fjzpcjng60mc3a4b2ql5a00d5gah84wj740dabv9kq67mpg8fxy";
+      rev = "c2dbbc24a97911339e01bda0b8cabdbd8f13b602";
+      sha256 = "0v1dsqnk5zmn6ir8jgxijx14s47jvijlqfz3aq435snfrgybd5rz";
    };
  }
  {
@ -320,8 +347,8 @@
    fetch = {
      type = "git";
      url = "https://github.com/spf13/cobra";
-      rev = "1e58aa3361fd650121dceeedc399e7189c05674a";
-      sha256 = "1d6dy60dw7i2mcab10yp99wi5w28jzhzzf16w4ys6bna7ymndiin";
+      rev = "7c4570c3ebeb8129a1f7456d0908a8b676b6f9f1";
+      sha256 = "16amh0prlzqrrbg5j629sg0f688nfzfgn9sair8jyybqampr3wc7";
    };
  }
  {
@ -365,8 +392,35 @@
    fetch = {
      type = "git";
      url = "https://github.com/spf13/viper";
-      rev = "15738813a09db5c8e5b60a19d67d3f9bd38da3a4";
-      sha256 = "1mjfzg8zvnxckaq6l8gw99i2msrfqn9yr04dc3b7kd5bpxi6zr4v";
+      rev = "d493c32b69b8c6f2377bf30bc4d70267ffbc0793";
+      sha256 = "1jq46790rkjn6c1887wz98dqjk792ij6wnrifzk1maglmfb061hh";
+    };
+  }
+  {
+    goPackagePath = "github.com/tdewolff/minify";
+    fetch = {
+      type = "git";
+      url = "https://github.com/tdewolff/minify";
+      rev = "cf3a1790b606e292e4a0ee82e949a4f0d1c7617d";
+      sha256 = "1r496149l5iqzxkfcbll5dqcqxy4a7jjxvzm62c8hrybmwj574kn";
+    };
+  }
+  {
+    goPackagePath = "github.com/tdewolff/parse";
+    fetch = {
+      type = "git";
+      url = "https://github.com/tdewolff/parse";
+      rev = "4ceb50b40fad068875f5b093c5df0619012dc544";
+      sha256 = "1ap76hdiabn41r7zxc7nq3n3ld7zqf97jaf71zlzzjrphi3fwrg1";
+    };
+  }
+  {
+    goPackagePath = "github.com/wellington/go-libsass";
+    fetch = {
+      type = "git";
+      url = "https://github.com/wellington/go-libsass";
+      rev = "615eaa47ef794d037c1906a0eb7bf85375a5decf";
+      sha256 = "0imjiskn4vq7nml5jwb1scgl61jg53cfpkjnb9rsc6m8gsd8s16s";
    };
  }
  {
@ -374,8 +428,8 @@
    fetch = {
      type = "git";
      url = "https://github.com/yosssi/ace";
-      rev = "ea038f4770b6746c3f8f84f14fa60d9fe1205b56";
-      sha256 = "1kbvbc56grrpnl65grygd23gyn3nkkhxdg8awhzkjmd0cvki8w1f";
+      rev = "2b21b56204aee785bf8d500c3f9dcbe3ed7d4515";
+      sha256 = "0cgpq1zdnh8l8zsn9w63asc9k7cm6k4qvjgrb4hr1106h8fjwfma";
    };
  }
  {
@ -383,8 +437,8 @@
    fetch = {
      type = "git";
      url = "https://go.googlesource.com/image";
-      rev = "af66defab954cb421ca110193eed9477c8541e2a";
-      sha256 = "0dgi7svwzs37c7m5dz2jig3xr45fyjihhr8cg0x8nc8sc8fsyq4h";
+      rev = "c73c2afc3b812cdd6385de5a50616511c4a3d458";
+      sha256 = "1kkafy29vz5xf6r29ghbvvbwrgjxwxvzk6dsa2qhyp1ddk6l2vkz";
    };
  }
  {
@ -392,8 +446,8 @@
    fetch = {
      type = "git";
      url = "https://go.googlesource.com/net";
-      rev = "db08ff08e8622530d9ed3a0e8ac279f6d4c02196";
-      sha256 = "1f6q8kbijnrfy6wjqxrzgjf38ippckc5w34lhqsjs7kq045aar9a";
+      rev = "f4c29de78a2a91c00474a2e689954305c350adf9";
+      sha256 = "02nibjrr1il8sxnr0w1s5fj7gz6ayhg3hsywf948qhc68n5adv8x";
    };
  }
  {
@ -410,8 +464,8 @@
    fetch = {
      type = "git";
      url = "https://go.googlesource.com/sys";
-      rev = "6c888cc515d3ed83fc103cf1d84468aad274b0a7";
-      sha256 = "18anqrdajp4p015v3f5y641k3lmgp2jr0lfyx0pb3ia0qvn93mrp";
+      rev = "3dc4335d56c789b04b0ba99b7a37249d9b614314";
+      sha256 = "1105b7jqzz8g2bfkdbkj2pdzq4vhfmhm42khir88vjqfd1l7ha31";
    };
  }
  {
@ -419,8 +473,8 @@
    fetch = {
      type = "git";
      url = "https://go.googlesource.com/text";
-      rev = "5c1cf69b5978e5a34c5f9ba09a83e56acc4b7877";
-      sha256 = "03br8p1sb1ffr02l8hyrgcyib7ms0z06wy3v4r1dj2l6q4ghwzfs";
+      rev = "96e34ec0e18a62a1e59880c7bf617b655efecb66";
+      sha256 = "1n1p5zz0vyvlhac40hxml6c5xwpsw8rjx1pbls9381a0s19ncbdg";
    };
  }
  {
--- a/pkgs/applications/misc/masterpdfeditor/default.nix
+++ b/pkgs/applications/misc/masterpdfeditor/default.nix
@ -4,7 +4,7 @@ let
 in stdenv.mkDerivation {
  name = "masterpdfeditor-${version}";
  src = fetchurl {
-    url = "https://get.code-industry.net/public/master-pdf-editor-${version}_qt5.amd64.tar.gz";
+    url = "https://code-industry.net/public/master-pdf-editor-${version}_qt5.amd64.tar.gz";
    sha256 = "0k5bzlhqglskiiq86nmy18mnh5bf2w3mr9cq3pibrwn5pisxnxxc";
  };

--- a/pkgs/applications/misc/memo/default.nix
+++ b/pkgs/applications/misc/memo/default.nix
@ -8,13 +8,13 @@ stdenv.mkDerivation rec {

  name = "memo-${version}";

-  version = "0.4";
+  version = "0.5";

  src = fetchFromGitHub {
    owner  = "mrVanDalo";
    repo   = "memo";
    rev    = "${version}";
-    sha256 = "06999nps46dxrjakvpin1d2zvfpjil69hb3bxagq29icalag3y2z";
+    sha256 = "1kq8hmq4lgvkk717nhmdryr90g61xm0jm7y8dzya8jsxsn531gm8";
  };

  installPhase = let
@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
    else
      "#pandoc_cmd=pandoc";
  in ''
-    mkdir -p $out/{bin,share/man/man1,share/bash-completion/completions}
+    mkdir -p $out/{bin,share/man/man1,share/bash-completion/completions,share/zsh/site-functions}
    substituteInPlace memo \
      --replace "ack_cmd=ack"       "ack_cmd=${silver-searcher}/bin/ag" \
      --replace "tree_cmd=tree"     "tree_cmd=${tree}/bin/tree" \
@ -31,7 +31,8 @@ stdenv.mkDerivation rec {
      --replace "pandoc_cmd=pandoc" "${pandocReplacement}"
    mv memo $out/bin/
    mv doc/memo.1 $out/share/man/man1/memo.1
-    mv completion/memo.bash $out/share/bash-completion/completions/memo.sh
+    mv completion/bash/memo.sh $out/share/bash-completion/completions/memo.sh
+    mv completion/zsh/_memo    $out/share/zsh/site-functions/_memo
  '';

  meta = {
--- a/pkgs/applications/misc/termite/default.nix
+++ b/pkgs/applications/misc/termite/default.nix
@ -1,55 +1,42 @@
-{ stdenv, fetchFromGitHub, lib, pkgconfig, vte, gtk3, ncurses, makeWrapper, wrapGAppsHook, symlinkJoin
-, configFile ? null
-}:
+{ stdenv, fetchFromGitHub, pkgconfig, vte, gtk3, ncurses, wrapGAppsHook }:

-let
+stdenv.mkDerivation rec {
+  name = "termite-${version}";
  version = "13";
-  termite = stdenv.mkDerivation {
-    name = "termite-${version}";

-    src = fetchFromGitHub {
-      owner = "thestinger";
-      repo = "termite";
-      rev = "v${version}";
-      sha256 = "02cn70ygl93ghhkhs3xdxn5b1yadc255v3yp8cmhhyzsv5027hvj";
-      fetchSubmodules = true;
-    };
-
-    # https://github.com/thestinger/termite/pull/516
-    patches = [ ./url_regexp_trailing.patch ./add_errno_header.patch
-                ] ++ lib.optional stdenv.isDarwin ./remove_ldflags_macos.patch;
-
-    makeFlags = [ "VERSION=v${version}" "PREFIX=" "DESTDIR=$(out)" ];
-
-    buildInputs = [ vte gtk3 ncurses ];
-
-    nativeBuildInputs = [ wrapGAppsHook pkgconfig ];
-
-    outputs = [ "out" "terminfo" ];
-
-    postInstall = ''
-      mkdir -p $terminfo/share
-      mv $out/share/terminfo $terminfo/share/terminfo
-
-      mkdir -p $out/nix-support
-      echo "$terminfo" >> $out/nix-support/propagated-user-env-packages
-    '';
-
-    meta = with stdenv.lib; {
-      description = "A simple VTE-based terminal";
-      license = licenses.lgpl2Plus;
-      homepage = https://github.com/thestinger/termite/;
-      maintainers = with maintainers; [ koral garbas ];
-      platforms = platforms.all;
-    };
+  src = fetchFromGitHub {
+    owner = "thestinger";
+    repo = "termite";
+    rev = "v${version}";
+    sha256 = "02cn70ygl93ghhkhs3xdxn5b1yadc255v3yp8cmhhyzsv5027hvj";
+    fetchSubmodules = true;
  };
-in if configFile == null then termite else symlinkJoin {
-  name = "termite-with-config-${version}";
-  paths = [ termite ];
-  nativeBuildInputs = [ makeWrapper ];
-  postBuild = ''
-    wrapProgram $out/bin/termite \
-      --add-flags "--config ${configFile}"
+
+  # https://github.com/thestinger/termite/pull/516
+  patches = [ ./url_regexp_trailing.patch ./add_errno_header.patch
+              ] ++ stdenv.lib.optional stdenv.isDarwin ./remove_ldflags_macos.patch;
+
+  makeFlags = [ "VERSION=v${version}" "PREFIX=" "DESTDIR=$(out)" ];
+
+  buildInputs = [ vte gtk3 ncurses ];
+
+  nativeBuildInputs = [ wrapGAppsHook pkgconfig ];
+
+  outputs = [ "out" "terminfo" ];
+
+  postInstall = ''
+    mkdir -p $terminfo/share
+    mv $out/share/terminfo $terminfo/share/terminfo
+
+    mkdir -p $out/nix-support
+    echo "$terminfo" >> $out/nix-support/propagated-user-env-packages
  '';
-  passthru.terminfo = termite.terminfo;
+
+  meta = with stdenv.lib; {
+    description = "A simple VTE-based terminal";
+    license = licenses.lgpl2Plus;
+    homepage = https://github.com/thestinger/termite/;
+    maintainers = with maintainers; [ koral garbas ];
+    platforms = platforms.all;
+  };
 }
--- a/pkgs/applications/misc/termite/wrapper.nix
+++ b/pkgs/applications/misc/termite/wrapper.nix
@ -0,0 +1,15 @@
+{  makeWrapper, wrapGAppsHook, symlinkJoin, configFile ? null, termite }:
+
+if configFile == null then termite else symlinkJoin {
+  name = "termite-with-config-${termite.version}";
+
+  paths = [ termite ];
+  nativeBuildInputs = [ makeWrapper ];
+
+  postBuild = ''
+    wrapProgram $out/bin/termite \
+      --add-flags "--config ${configFile}"
+  '';
+
+  passthru.terminfo = termite.terminfo;
+}
--- a/pkgs/applications/misc/xca/default.nix
+++ b/pkgs/applications/misc/xca/default.nix
@ -3,13 +3,13 @@

 mkDerivation rec {
  name = "xca-${version}";
-  version = "2.0.1";
+  version = "2.1.0";

  src = fetchFromGitHub {
    owner  = "chris2511";
    repo   = "xca";
    rev    = "RELEASE.${version}";
-    sha256 = "0906xnmqzd9q5irxzm19361vhzig9yqsmf6wsc3rggniix5bk3a8";
+    sha256 = "039qz6hh43hx8dcw2bq71mgy95zk09jyd3xxpldmxxd5d69zcr8m";
  };

  postPatch = ''
@ -23,8 +23,6 @@ mkDerivation rec {

  enableParallelBuilding = true;

-  configureFlags = [ "CXXFLAGS=-std=c++11" ];
-
  meta = with lib; {
    description = "Interface for managing asymetric keys like RSA or DSA";
    homepage    = http://xca.sourceforge.net/;
--- a/pkgs/applications/networking/cluster/terraform-provider-libvirt/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-provider-libvirt/default.nix
@ -19,7 +19,7 @@

 buildGoPackage rec {
  name = "terraform-provider-libvirt-${version}";
-  version = "0.3";
+  version = "0.4";

  goPackagePath = "github.com/dmacvicar/terraform-provider-libvirt";

@ -27,13 +27,13 @@ buildGoPackage rec {
    owner = "dmacvicar";
    repo = "terraform-provider-libvirt";
    rev = "v${version}";
-    sha256 = "004gxy55p5cf39f2zpah0i2zhvs4x6ixnxy8z9v7314604ggpkna";
+    sha256 = "05jkjp1kis4ncryv34pkb9cz2yhzbwg62x9qmlqsqlxwz9hqny3r";
  };

  buildInputs = [ libvirt pkgconfig makeWrapper ];

-  goDeps = ./deps.nix;
-
+  # mkisofs needed to create ISOs holding cloud-init data,
+  # and wrapped to terraform via deecb4c1aab780047d79978c636eeb879dd68630
  propagatedBuildInputs = [ cdrtools ];

  meta = with stdenv.lib; {
--- a/pkgs/applications/networking/cluster/terraform-provider-libvirt/deps.nix
+++ b/pkgs/applications/networking/cluster/terraform-provider-libvirt/deps.nix
@ -1,12 +0,0 @@
-# This file was generated by https://github.com/kamilchm/go2nix v1.2.1
-[
-  {
-    goPackagePath = "github.com/aws/aws-sdk-go";
-    fetch = {
-      type = "git";
-      url = "https://github.com/aws/aws-sdk-go";
-      rev = "c861d27d0304a79f727e9a8a4e2ac1e74602fdc0";
-      sha256 = "023cyg551dvm2l50dx1qsikkj77lk2dhiya7by8in7h65av6hjgl";
-    };
-  }
-]
--- a/pkgs/applications/networking/cluster/terraform/providers/data.nix
+++ b/pkgs/applications/networking/cluster/terraform/providers/data.nix
@ -4,15 +4,15 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-alicloud";
-      version = "1.9.5";
-      sha256  = "12yhy0p4xciw70i0gvwzbg39f6mfin2cfdblxyqjlv9bwg26k7jz";
+      version = "1.10.0";
+      sha256  = "19lplakpl8dz4a8xw9va86gd774yq4gayq4kzv3pvr62b03a999x";
    };
  archive =
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-archive";
-      version = "1.0.3";
-      sha256  = "1il8v9zi838naprr8dqzipk6ns71l8vdqidarxklnn8wdwxmacg4";
+      version = "1.1.0";
+      sha256  = "1fsynv725cmqz819v9p4i4h4w4y77mbya5y9v81sqvacqvr3i05h";
    };
  arukas =
    {
@ -32,29 +32,22 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-aws";
-      version = "1.25.0";
-      sha256  = "1cg2pch6nip96qdzca7q0ak6308fkjxz9zjdcv74cwg0f65frh7d";
-    };
-  azure-classic =
-    {
-      owner   = "terraform-providers";
-      repo    = "terraform-provider-azure-classic";
-      version = "0.1.1";
-      sha256  = "11myqq3wnxvpysjycvwg7b14ll8d9vkn06xb3r26kmc42fkl5xv1";
+      version = "1.30.0";
+      sha256  = "1si2fm5nm7gad90lf410zwjf2q5kd8mv6nkkbfnfdzkpkchavr95";
    };
  azurerm =
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-azurerm";
-      version = "1.7.0";
-      sha256  = "0lf83pc5gdmd61i93221zdg9pdzfpfnvhis8kf1s2jlc6zshbabv";
+      version = "1.12.0";
+      sha256  = "1avp2vhlj60iw17pw39003p30byms7xvq5lkippm60ak4ky9p51b";
    };
  azurestack =
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-azurestack";
-      version = "0.1.0";
-      sha256  = "144dfaq16g41i9y2pcq2ilgygndad3vivr6fbygg8yl10m5l4qp0";
+      version = "0.2.0";
+      sha256  = "0s1ga0ga0rbpp552hbq1dfnkpdjvk1c40i7qqnqmm20xlz6k55mb";
    };
  bitbucket =
    {
@ -63,6 +56,13 @@
      version = "1.0.0";
      sha256  = "0gi8p1q0y8x5y8lqihijkpqs3v152h0q7icv7ixk33xsdcvb418y";
    };
+  brightbox =
+    {
+      owner   = "terraform-providers";
+      repo    = "terraform-provider-brightbox";
+      version = "1.0.5";
+      sha256  = "0sn7k5bqgms5sxjhjikmby0jf2n6y14z6s4wsifxaw7b0082fy28";
+    };
  chef =
    {
      owner   = "terraform-providers";
@ -88,8 +88,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-cloudflare";
-      version = "1.0.0";
-      sha256  = "1ar9wcgr45f2v6bqjn24zii0qwfppla8ya3gjc546sh1a7m0h9p3";
+      version = "1.1.0";
+      sha256  = "1rmg7gndhmb1wp0zszhwx9vrax8411iy24yrpkmayjify3vsvdpx";
    };
  cloudscale =
    {
@ -123,8 +123,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-datadog";
-      version = "1.0.3";
-      sha256  = "0nh2dww3hx6jrkcd9lq5hpnqr3grp9cmqi4nwmxlrc5azf8x0mii";
+      version = "1.1.0";
+      sha256  = "0ckmjpw9dkj5490kwxamdvnnidnjdgxnb1biqpvwj4139hlcl628";
    };
  digitalocean =
    {
@ -158,8 +158,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-docker";
-      version = "0.1.1";
-      sha256  = "02lhbl34dq7lsby3g32969i4g9l3z6xw1v00shljd3amgyz2l2r2";
+      version = "1.0.0";
+      sha256  = "09ribvyv02r907pdvyrwaklr14xyvyn14rijslnm16xp8d4waz9h";
    };
  dyn =
    {
@ -179,15 +179,15 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-fastly";
-      version = "0.2.0";
-      sha256  = "0vrvyqhzbrvhyhdkg2y2dgadf5j7bj0cbzd13f9m86d146zlf8lb";
+      version = "0.3.0";
+      sha256  = "1hh4s81g256iy1rvp9snqbyhidz8n6p7pzanlxp89ffrq9p32sp0";
    };
  flexibleengine =
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-flexibleengine";
-      version = "1.0.1";
-      sha256  = "1xf5cmn434a0zr9qxc7f0jma9gf111cp7fm2vgyhkd62hipafcas";
+      version = "1.1.0";
+      sha256  = "07g6kc211crxf9nvgvghg05jdahd1fb09lpwfcps9ph259pwwam3";
    };
  github =
    {
@ -207,15 +207,15 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-google";
-      version = "1.15.0";
-      sha256  = "0xwijnv7mzlyzplkylfphph568b9bxavrclnlwvp9ylvklq70nzl";
+      version = "1.16.2";
+      sha256  = "1d8by6rb4s2dggapcbb4b2g5hf280bjayz9p5q9njgsn83579pnm";
    };
  grafana =
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-grafana";
-      version = "1.0.2";
-      sha256  = "17pj4mm7ik9llhgckza822866x6986cdcr821f16dchvn3bfbf2i";
+      version = "1.2.0";
+      sha256  = "1kn2bbdgci6nfl2gyk4w8w203fscqws2748idv9m53ikczg8n573";
    };
  hcloud =
    {
@ -228,8 +228,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-heroku";
-      version = "1.0.1";
-      sha256  = "1kx74d0ywzim5zj3y5ac80r18igsqax39yv9qaam546a88ya31yy";
+      version = "1.2.0";
+      sha256  = "1w2r0wnfcr9aqij5ckq0apd8az8yzdg704hi1zjb1ggb54v97n31";
    };
  http =
    {
@ -238,6 +238,13 @@
      version = "1.0.1";
      sha256  = "1bnqrx4xya3lm5wp4byy6npazll6w1g6bv4rawgncswsgx08zqng";
    };
+  huaweicloud =
+    {
+      owner   = "terraform-providers";
+      repo    = "terraform-provider-huaweicloud";
+      version = "1.1.0";
+      sha256  = "1jsvv5yfxgz998p4wbldbq82hl4ykn1yp21igphl94n3b0jj33dj";
+    };
  icinga2 =
    {
      owner   = "terraform-providers";
@ -256,8 +263,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-influxdb";
-      version = "1.0.0";
-      sha256  = "1w1izzs22b2w2qmpdxbhaj9kvnfyw0wlq3nigrigwwvqav43knh9";
+      version = "1.0.1";
+      sha256  = "0713h50675njnpdy4w1azfq8h6yai40gx6w2fbvw4n59h6jlfny4";
    };
  kubernetes =
    {
@ -347,22 +354,22 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-oneandone";
-      version = "1.1.0";
-      sha256  = "1yps2mcdy61afxva7vg0i82s24zkdrn5abwblm0gcgc0cz588r9d";
+      version = "1.2.0";
+      sha256  = "1lrcy05zklv7vc8653f8cn3jjc9zjjwi488dpaphsmsl1md3m88b";
    };
  opc =
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-opc";
-      version = "1.1.2";
-      sha256  = "0v413wgnr8h682han88s0n15cdwd9a0dxr9s2mknpi4664c41qlk";
+      version = "1.2.0";
+      sha256  = "19rfm12w97ccyrzpdw0qlwfn7gh64lqh17kj3cv11y1f731z8rlw";
    };
  openstack =
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-openstack";
-      version = "1.6.0";
-      sha256  = "14chn2vb8y9rz5irh8m2ky9yxmw2za45gikncjm4gfc3xl6803iq";
+      version = "1.7.0";
+      sha256  = "0sw2kmcsi9sjzi549fj6knida01q0lnpqvc3cpyjyv92f6w4bznn";
    };
  opentelekomcloud =
    {
@ -382,15 +389,15 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-oraclepaas";
-      version = "1.2.1";
-      sha256  = "0r404rysjhbsxh45ad23k12rs8js2pdczakzavnjx508kr29gcqc";
+      version = "1.3.0";
+      sha256  = "09vsb52cbf2h1rdwfg4xb54gklwgmaxdgjcdq1yx5gxj7lfbdl9v";
    };
  ovh =
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-ovh";
-      version = "0.2.0";
-      sha256  = "12dpgx0fpmqw64v5a70fihbgixyw71bdjbdi17gal7s2pj1xw159";
+      version = "0.3.0";
+      sha256  = "05bzkwa50alh8mpslh64dddp815m8df240w1mmphdmp9rsi6hqp8";
    };
  packet =
    {
@ -417,8 +424,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-postgresql";
-      version = "0.1.1";
-      sha256  = "0ls5z02vaalcrbaq375qnk0267pb17rpsx4s3plfnr7qclv21pwn";
+      version = "0.1.2";
+      sha256  = "08wv03j70mych4nnamivjihwvca3aksjxgjlj8yasz5292qgl05w";
    };
  powerdns =
    {
@ -431,8 +438,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-profitbricks";
-      version = "1.3.1";
-      sha256  = "1g4filwv38rq9wcdbpnpgfnv8qj1kzdnjc8awvbsdlxlj4fa06bi";
+      version = "1.3.2";
+      sha256  = "0mk77n833np6ahm6bzvpg31a0m1qazaipd0vqzccqfkbz78sm3jb";
    };
  rabbitmq =
    {
@ -466,15 +473,15 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-runscope";
-      version = "0.1.0";
-      sha256  = "05l305423njds2cmmxg67swpdnp3zibs36dq4cfjk47i4byvipjz";
+      version = "0.3.0";
+      sha256  = "1srnnlw94q1av8rzy8753fk4vazv5ldbimgr9gd51vrmpvmlgxas";
    };
  scaleway =
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-scaleway";
-      version = "1.4.1";
-      sha256  = "1zxb3981w30hv1aax28ayiy0sl0vzrrwkynp4lmwwhfjyhyagnm1";
+      version = "1.5.1";
+      sha256  = "1b42fh7mwj2cx3g16lgp4sw6ca5qqj0mhm6i7qid8agwsga34v0y";
    };
  softlayer =
    {
@ -487,15 +494,22 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-spotinst";
-      version = "1.0.0";
-      sha256  = "1p05wamv70mywfqf0b3nxpvxc0m8ydb5zcl2kpzsrii9mq21pjrf";
+      version = "1.2.0";
+      sha256  = "09k79xg5cbs4qhxr0b4f42qpxj6j2795z5vmwbxfkirb5bkpqdq1";
    };
  statuscake =
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-statuscake";
-      version = "0.1.0";
-      sha256  = "084520cak2krwpks2ipqcjfw3k4rrzn6gqqncz8c4i6g01f1m7yg";
+      version = "0.2.0";
+      sha256  = "065izach0hq04664hz7rc3gd0r3l06lzwcbj5800zjfv1inp6pxs";
+    };
+  telefonicaopencloud =
+    {
+      owner   = "terraform-providers";
+      repo    = "terraform-provider-telefonicaopencloud";
+      version = "1.0.0";
+      sha256  = "1761wkjz3d2458xl7855lxklyxgyk05fddh92rp6975y0ca6xa5m";
    };
  template =
    {
@ -536,8 +550,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-vault";
-      version = "1.1.0";
-      sha256  = "1g0cca662glqcz83l1skhj3nb7g386x65kwz95kyp59nvyxywvbq";
+      version = "1.1.1";
+      sha256  = "0kiqpnb4669xw9b8nf6a8ky0jhnp14bipaizml3gdh1hnda6hflw";
    };
  vcd =
    {
--- a/pkgs/applications/networking/cluster/terraform/providers/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/providers/default.nix
@ -16,10 +16,5 @@ let
      # if the versions are not provided via file paths.
      postBuild = "mv go/bin/${repo}{,_v${version}}";
    };
-
-  maybeDrv = name: data:
-    # azure-classic is an archived repo
-    if name == "azure-classic" then null
-    else toDrv data;
 in
-  lib.mapAttrs maybeDrv list
+  lib.mapAttrs (n: v: toDrv v) list
--- a/pkgs/applications/networking/cluster/terraform/providers/update-all
+++ b/pkgs/applications/networking/cluster/terraform/providers/update-all
@ -71,7 +71,7 @@ fi

 org=terraform-providers

-repos=$(get_org_repos "$org" | grep terraform-provider- | grep -v terraform-provider-scaffolding | grep -v terraform-provider-telefonicaopencloud | sort)
+repos=$(get_org_repos "$org" | grep terraform-provider- | grep -v terraform-provider-scaffolding | grep -v terraform-provider-azure-classic | sort)


 # Get all the providers with index
--- a/pkgs/applications/networking/instant-messengers/dino/default.nix
+++ b/pkgs/applications/networking/instant-messengers/dino/default.nix
@ -13,13 +13,13 @@
 }:

 stdenv.mkDerivation rec {
-  name = "dino-unstable-2018-06-03";
+  name = "dino-unstable-2018-07-08";

  src = fetchFromGitHub {
    owner = "dino";
    repo = "dino";
-    rev = "52e116ee44be1667660c08858a28fe8fda125f79";
-    sha256 = "1yybmjd50r41366clrsw21qybbpjfkvim2n5b3dkcagjnifak0zl";
+    rev = "df8b5fcb722c4a33ed18cbbaafecb206f127b849";
+    sha256 = "1r7h9pxix0sylnwab7a8lir9h5yssk98128x2bzva77id9id33vi";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/networking/instant-messengers/gitter/default.nix
+++ b/pkgs/applications/networking/instant-messengers/gitter/default.nix
@ -0,0 +1,71 @@
+{ stdenv, alsaLib, atk, cairo, cups, dbus, dpkg, expat, fetchurl
+, fontconfig, freetype, gdk_pixbuf, glib, gnome2, gtk3, libX11
+, libXScrnSaver, libXcomposite, libXcursor, libXdamage, libXext, libXfixes
+, libXi, libXrandr, libXrender, libXtst, libappindicator-gtk3, libcxx
+, libnotify, libpulseaudio, libxcb, makeDesktopItem, makeWrapper, nspr, nss
+, nwjs, pango, systemd }:
+
+let gitterDirectorySuffix = "opt/gitter";
+    doELFPatch = target: ''
+      patchelf --set-interpreter ${stdenv.cc.bintools.dynamicLinker} \
+         --set-rpath "$out/${gitterDirectorySuffix}/lib:${libPath}" \
+         $out/${gitterDirectorySuffix}/${target}
+       '';
+   libPath = stdenv.lib.makeLibraryPath [
+     alsaLib atk cairo cups dbus expat fontconfig freetype gdk_pixbuf glib
+     gnome2.GConf gtk3 libX11 libXScrnSaver libXcomposite libXcursor libXdamage
+     libXext libXfixes libXi libXrandr libXrender libXtst libappindicator-gtk3
+     libcxx libnotify libpulseaudio libxcb nspr nss pango stdenv.cc.cc systemd
+  ];
+in stdenv.mkDerivation rec {
+  pname = "gitter";
+  version = "4.1.0";
+  name = "${pname}-${version}";
+
+  src = fetchurl {
+    url = "https://update.gitter.im/linux64/${pname}_${version}_amd64.deb";
+    sha256 = "1gny9i2pywvczzrs93k8krqn6hwm6c2zg8yr3xmjqs3p88817wbi";
+  };
+
+  nativeBuildInputs = [ makeWrapper dpkg ];
+
+  unpackPhase = "dpkg -x $src .";
+
+  installPhase = ''
+    mkdir -p $out/{bin,opt/gitter,share/pixmaps}
+    mv ./opt/Gitter/linux64/* $out/opt/gitter
+
+    ${doELFPatch "Gitter"}
+    ${doELFPatch "nacl_helper"}
+    ${doELFPatch "minidump_stackwalk"}
+    ${doELFPatch "nwjc"}
+    ${doELFPatch "chromedriver"}
+    ${doELFPatch "payload"}
+
+    patchelf --set-rpath "$out/${gitterDirectorySuffix}/lib:${libPath}" \
+         $out/${gitterDirectorySuffix}/lib/libnw.so
+
+    wrapProgram $out/${gitterDirectorySuffix}/Gitter --prefix LD_LIBRARY_PATH : ${libPath}
+
+    ln -s $out/${gitterDirectorySuffix}/Gitter $out/bin/
+    ln -s $out/${gitterDirectorySuffix}/logo.png $out/share/pixmaps/gitter.png
+    ln -s "${desktopItem}/share/applications" $out/share/
+  '';
+
+  desktopItem = makeDesktopItem {
+    name = pname;
+    exec = "Gitter";
+    icon = pname;
+    desktopName = "Gitter";
+    genericName = meta.description;
+    categories = "Network;InstantMessaging;";
+  };
+
+  meta = with stdenv.lib; {
+    description = "Where developers come to talk";
+    downloadPage = "https://gitter.im/apps";
+    license = licenses.mit;
+    maintainers = [ maintainers.imalison ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@ -40,11 +40,11 @@ let

 in stdenv.mkDerivation rec {
  name = "signal-desktop-${version}";
-  version = "1.14.4";
+  version = "1.15.0";

  src = fetchurl {
    url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-    sha256 = "0590r7748kv6g7zygq95v8qxf7vi2n5ypj6734x9yshrn8z6p8lr";
+    sha256 = "1q73jx92h8zwk1dn103ymskz35q6kfiqc44886jr0p7mlpndqsa4";
  };

  phases = [ "unpackPhase" "installPhase" ];
--- a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
@ -14,5 +14,7 @@ in {
  stable = mkTelegram stableVersion;
  preview = mkTelegram (stableVersion // {
    stable = false;
+    version = "1.3.11";
+    sha256Hash = "057b7ccba7k2slzbp9xzcs3fni40x7gz3wy13xfgxywr12f04h1r";
  });
 }
--- a/pkgs/applications/networking/protonmail-bridge/default.nix
+++ b/pkgs/applications/networking/protonmail-bridge/default.nix
@ -0,0 +1,83 @@
+{ stdenv, fetchurl, lib, qtbase, qtmultimedia, qtsvg, qtdeclarative, qttools, full,
+  libsecret, libGL, libpulseaudio, glib, makeWrapper, makeDesktopItem }:
+
+let
+  version = "1.0.5-1";
+
+  description = ''
+    An application that runs on your computer in the background and seamlessly encrypts
+    and decrypts your mail as it enters and leaves your computer
+  '';
+
+  desktopItem = makeDesktopItem {
+    name = "Desktop-Bridge";
+    exec = "Desktop-Bridge";
+    icon = "desktop-bridge";
+    comment = stdenv.lib.replaceStrings ["\n"] [" "] description;
+    desktopName = "ProtonMail Bridge";
+    genericName = "ProtonMail Bridge for Linux";
+    categories = "Utility;Security;Network;Email";
+  };
+in stdenv.mkDerivation rec {
+  name = "protonmail-bridge-${version}";
+
+  src = fetchurl {
+    url = "https://protonmail.com/download/protonmail-bridge_${version}_amd64.deb";
+    sha256 = "1fsf4l5c9ii370fgy721a71h34g7vjfddscal3jblb4mm3ywzxfl";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  sourceRoot = ".";
+
+  unpackCmd = ''
+    ar p "$src" data.tar.xz | tar xJ
+  '';
+
+  installPhase = ''
+    mkdir -p $out/{bin,lib,share}
+    mkdir -p $out/share/{applications,icons/hicolor/scalable/apps}
+
+    cp -r usr/lib/protonmail/bridge/Desktop-Bridge{,.sh} $out/lib
+    cp usr/share/icons/protonmail/Desktop-Bridge.svg $out/share/icons/hicolor/scalable/apps/desktop-bridge.svg
+    cp ${desktopItem}/share/applications/* $out/share/applications
+
+    ln -s $out/lib/Desktop-Bridge $out/bin/Desktop-Bridge
+  '';
+
+  postFixup = let
+    rpath = lib.makeLibraryPath [
+      stdenv.cc.cc.lib
+      qtbase
+      qtmultimedia
+      qtsvg
+      qtdeclarative
+      qttools
+      libGL
+      libsecret
+      libpulseaudio
+      glib
+    ];
+
+    qtPath = prefix: "${full}/${prefix}";
+  in ''
+    patchelf \
+      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      --set-rpath "${rpath}" \
+      $out/lib/Desktop-Bridge
+
+    wrapProgram $out/lib/Desktop-Bridge \
+      --set QT_PLUGIN_PATH "${qtPath qtbase.qtPluginPrefix}" \
+      --set QML_IMPORT_PATH "${qtPath qtbase.qtQmlPrefix}" \
+      --set QML2_IMPORT_PATH "${qtPath qtbase.qtQmlPrefix}" \
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = https://www.protonmail.com/bridge;
+    license = licenses.mit;
+    platforms = [ "x86_64-linux" ];
+    maintainers = with maintainers; [ lightdiscord ];
+
+    inherit description;
+  };
+}
--- a/pkgs/applications/office/tryton/default.nix
+++ b/pkgs/applications/office/tryton/default.nix
@ -14,10 +14,10 @@ with stdenv.lib;

 python2Packages.buildPythonApplication rec {
  pname = "tryton";
-  version = "4.8.2";
+  version = "4.8.3";
  src = python2Packages.fetchPypi {
    inherit pname version;
-    sha256 = "02jnqxwsqk7hn52hc4jd59nd94d810i4psaa3lqqig3br5blp8yx";
+    sha256 = "1e2862bbe7c943afbbdf2232cdc55f75d2357640115c7f1483f0814b2c5a6882";
  };
  nativeBuildInputs = [ pkgconfig gobjectIntrospection ];
  propagatedBuildInputs = with python2Packages; [
--- a/pkgs/applications/office/trytond/default.nix
+++ b/pkgs/applications/office/trytond/default.nix
@ -5,10 +5,10 @@ with stdenv.lib;

 python2Packages.buildPythonApplication rec {
  pname = "trytond";
-  version = "4.8.1";
+  version = "4.8.2";
  src = python2Packages.fetchPypi {
    inherit pname version;
-    sha256 = "8e72a24bdf2fd090c5e12ce5f73a00322e31519608b31db44d7bb76382078db9";
+    sha256 = "ec5c419418517bf9f7d2af08b2bfd3bcc7526f6d6f07d122abf1699c728ae2a9";
  };

  # Tells the tests which database to use
--- a/pkgs/applications/science/biology/somatic-sniper/default.nix
+++ b/pkgs/applications/science/biology/somatic-sniper/default.nix
@ -0,0 +1,28 @@
+{stdenv, fetchFromGitHub, cmake, zlib, ncurses}:
+
+stdenv.mkDerivation rec {
+  name = "somatic-sniper-${version}";
+  version = "1.0.5.0";
+
+  src = fetchFromGitHub {
+    owner = "genome";
+    repo = "somatic-sniper";
+    rev = "v${version}";
+    sha256 = "0lk7p9sp6mp50f6w1nppqhr40fcwy1asw06ivw8w8jvvnwaqf987";
+  };
+
+  patches = [ ./somatic-sniper.patch ];
+
+  buildInputs = [ cmake zlib ncurses ];
+
+  enableParallelBuilding = false;
+
+  meta = with stdenv.lib; {
+    description = "Identify single nucleotide positions that are different between tumor and normal";
+    license = licenses.mit;
+    homepage = https://github.com/genome/somatic-sniper;
+    maintainers = with maintainers; [ jbedo ];
+    platforms = platforms.linux;
+  };
+
+}
--- a/pkgs/applications/science/biology/somatic-sniper/somatic-sniper.patch
+++ b/pkgs/applications/science/biology/somatic-sniper/somatic-sniper.patch
@ -0,0 +1,26 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 6d5a180..7254292 100644
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -11,7 +11,7 @@ set(CMAKE_MODULE_PATH
+     )
+ 
+ include(TestHelper)
+-include(VersionHelper)
+#include(VersionHelper)
+ include(ProjectHelper)
+ 
+ # NOTE: for sniper we want the exe suffix to be like 0.7.4, not just 0.7
+diff --git a/vendor/samtools.patch b/vendor/samtools.patch
+index f173017..654f878 100644
+--- a/vendor/samtools.patch
+++ b/vendor/samtools.patch
+@@ -6,7 +6,7 @@ diff -Nuar a/Makefile b/Makefile
+  
+  samtools:lib $(AOBJS)
+ -		$(CC) $(CFLAGS) -o $@ $(AOBJS) -lm $(LIBPATH) $(LIBCURSES) -lz -L. -lbam
+-+		$(CC) $(CFLAGS) -o $@ $(AOBJS) -lm $(LIBPATH) $(LIBCURSES) -L. -lbam -lz
++		$(CC) $(CFLAGS) -o $@ $(AOBJS) -lm $(LIBPATH) -lncurses -L. -lbam -lz
+  
+  razip:razip.o razf.o
+  		$(CC) $(CFLAGS) -o $@ razf.o razip.o -lz
--- a/pkgs/applications/science/chemistry/openmolcas/default.nix
+++ b/pkgs/applications/science/chemistry/openmolcas/default.nix
@ -0,0 +1,72 @@
+{ stdenv, pkgs, fetchFromGitLab, cmake, gfortran, perl
+, openblas, hdf5-cpp, python3, texlive
+, armadillo, openmpi, globalarrays, openssh
+, makeWrapper
+} :
+
+let
+  version = "20180529";
+  gitLabRev = "b6b9ceffccae0dd7f14c099468334fee0b1071fc";
+
+  python = python3.withPackages (ps : with ps; [ six pyparsing ]);
+
+in stdenv.mkDerivation {
+  name = "openmolcas-${version}";
+
+  src = fetchFromGitLab {
+    owner = "Molcas";
+    repo = "OpenMolcas";
+    rev = gitLabRev;
+    sha256 = "1wbjjdv07lg1x4kdnf28anyrjgy33gdgrd5d7zi1c97nz7vhdjaz";
+  };
+
+  nativeBuildInputs = [ perl cmake texlive.combined.scheme-minimal makeWrapper ];
+  buildInputs = [
+    gfortran
+    openblas
+    hdf5-cpp
+    python
+    armadillo
+    openmpi
+    globalarrays
+    openssh
+  ];
+
+  enableParallelBuilding = true;
+
+  cmakeFlags = [
+    "-DOPENMP=ON"
+    "-DGA=ON"
+    "-DMPI=ON"
+    "-DLINALG=OpenBLAS"
+    "-DTOOLS=ON"
+    "-DHDF5=ON"
+    "-DFDE=ON"
+    "-DOPENBLASROOT=${openblas}"
+  ];
+
+  GAROOT=globalarrays;
+
+  postConfigure = ''
+    # The Makefile will install pymolcas during the build grrr.
+    mkdir -p $out/bin
+    export PATH=$PATH:$out/bin
+  '';
+
+  postFixup = ''
+    # Wrong store path in shebang (no Python pkgs), force re-patching
+    sed -i "1s:/.*:/usr/bin/env python:" $out/bin/pymolcas
+    patchShebangs $out/bin
+
+    wrapProgram $out/bin/pymolcas --set MOLCAS $out
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Advanced quantum chemistry software package";
+    homepage = https://gitlab.com/Molcas/OpenMolcas;
+    maintainers = [ maintainers.markuskowa ];
+    license = licenses.lgpl21;
+    platforms = platforms.linux;
+  };
+}
+
--- a/pkgs/applications/science/electronics/kicad/default.nix
+++ b/pkgs/applications/science/electronics/kicad/default.nix
@ -1,72 +1,73 @@
-{ stdenv, fetchurl, cmake, libGLU_combined, wxGTK, zlib, libX11, gettext, glew, cairo, curl, openssl, boost, pkgconfig, doxygen }:
+{ wxGTK, lib, stdenv, fetchurl, cmake, libGLU_combined, zlib
+, libX11, gettext, glew, glm, cairo, curl, openssl, boost, pkgconfig
+, doxygen, pcre, libpthreadstubs, libXdmcp
+, wrapGAppsHook
+, oceSupport ? true, opencascade
+, ngspiceSupport ? true, libngspice
+, swig, python, pythonPackages
+}:

+assert ngspiceSupport -> libngspice != null;
+
+with lib;
 stdenv.mkDerivation rec {
  name = "kicad-${version}";
-  series = "4.0";
-  version = "4.0.7";
+  series = "5.0";
+  version = "5.0.0";

-  srcs = [
-    (fetchurl {
-      url = "https://code.launchpad.net/kicad/${series}/${version}/+download/kicad-${version}.tar.xz";
-      sha256 = "1hgxan9321szgyqnkflb0q60yjf4yvbcc4cpwhm0yz89qrvlq1q9";
-    })
+  src = fetchurl {
+    url = "https://launchpad.net/kicad/${series}/${version}/+download/kicad-${version}.tar.xz";
+    sha256 = "17nqjszyvd25wi6550j981whlnb1wxzmlanljdjihiki53j84x9p";
+  };

-    (fetchurl {
-      url = "http://downloads.kicad-pcb.org/libraries/kicad-library-${version}.tar.gz";
-      sha256 = "1azb7v1y3l6j329r9gg7f4zlg0wz8nh4s4i5i0l9s4yh9r6i9zmv";
-    })
+  postPatch = ''
+    substituteInPlace CMakeModules/KiCadVersion.cmake \
+      --replace no-vcs-found ${version}
+  '';

-    (fetchurl {
-      url = "http://downloads.kicad-pcb.org/libraries/kicad-footprints-${version}.tar.gz";
-      sha256 = "08qrz5zzsb5127jlnv24j0sgiryd5nqwg3lfnwi8j9a25agqk13j";
-    })
+  cmakeFlags = [
+    "-DKICAD_SCRIPTING=ON"
+    "-DKICAD_SCRIPTING_MODULES=ON"
+    "-DKICAD_SCRIPTING_WXPYTHON=ON"
+    # nix installs wxPython headers in wxPython package, not in wxwidget
+    # as assumed. We explicitely set the header location.
+    "-DCMAKE_CXX_FLAGS=-I${pythonPackages.wxPython}/include/wx-3.0"
+  ] ++ optionals (oceSupport) [ "-DKICAD_USE_OCE=ON" "-DOCE_DIR=${opencascade}" ]
+    ++ optional (ngspiceSupport) "-DKICAD_SPICE=ON";
+
+  nativeBuildInputs = [
+    # https://www.mail-archive.com/kicad-developers@lists.launchpad.net/msg29840.html
+    (cmake.override {majorVersion = "3.10";})
+    doxygen
+    pkgconfig
+    wrapGAppsHook
+    pythonPackages.wrapPython
  ];
+  pythonPath = [ pythonPackages.wxPython ];
+  propagatedBuildInputs = [ pythonPackages.wxPython ];

-  sourceRoot = "kicad-${version}";
+  buildInputs = [
+    libGLU_combined zlib libX11 wxGTK pcre libXdmcp gettext glew glm libpthreadstubs
+    cairo curl openssl boost
+    swig python
+  ] ++ optional (oceSupport) opencascade
+    ++ optional (ngspiceSupport) libngspice;

-  cmakeFlags = ''
-    -DKICAD_SKIP_BOOST=ON
-    -DKICAD_BUILD_VERSION=${version}
-    -DKICAD_REPO_NAME=stable
+  # this breaks other applications in kicad
+  dontWrapGApps = true;
+
+  preFixup = ''
+    buildPythonPath "$out $pythonPath"
+    gappsWrapperArgs+=(--set PYTHONPATH "$program_PYTHONPATH")
+
+    wrapProgram "$out/bin/kicad" "''${gappsWrapperArgs[@]}"
  '';

-  enableParallelBuilding = true; # often fails on Hydra: fatal error: pcb_plot_params_lexer.h: No such file or directory
-
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ cmake libGLU_combined wxGTK zlib libX11 gettext glew cairo curl openssl boost doxygen ];
-
-  # They say they only support installs to /usr or /usr/local,
-  # so we have to handle this.
-  patchPhase = ''
-    sed -i -e 's,/usr/local/kicad,'$out,g common/gestfich.cpp
-  '';
-
-  postUnpack = ''
-    pushd $(pwd)
-  '';
-
-  postInstall = ''
-    popd
-
-    pushd kicad-library-*
-    cmake -DCMAKE_INSTALL_PREFIX=$out
-    make $MAKE_FLAGS
-    make install
-    popd
-
-    pushd kicad-footprints-*
-    mkdir -p $out/share/kicad/modules
-    cp -R *.pretty $out/share/kicad/modules/
-    popd
-  '';
-
-
  meta = {
    description = "Free Software EDA Suite";
    homepage = http://www.kicad-pcb.org/;
-    license = stdenv.lib.licenses.gpl2;
-    maintainers = with stdenv.lib.maintainers; [viric];
-    platforms = with stdenv.lib.platforms; linux;
-    hydraPlatforms = []; # 'output limit exceeded' error on hydra
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ berce ];
+    platforms = with platforms; linux;
  };
 }
--- a/pkgs/applications/science/math/almonds/default.nix
+++ b/pkgs/applications/science/math/almonds/default.nix
@ -1,11 +1,9 @@
-{ stdenv, buildPythonApplication, fetchFromGitHub, ncurses, pillow, pytest }:
+{ stdenv, python3, fetchFromGitHub, ncurses }:

-let
+with python3.pkgs; buildPythonApplication rec {
+  pname = "almonds";
  version = "1.25b";
-in

-buildPythonApplication {
-  name = "almonds-${version}";
  src = fetchFromGitHub {
    owner = "Tenchi2xh";
    repo = "Almonds";
--- a/pkgs/applications/science/math/bcal/default.nix
+++ b/pkgs/applications/science/math/bcal/default.nix
@ -1,20 +1,22 @@
-{ stdenv, fetchFromGitHub, python3Packages }:
+{ stdenv, fetchFromGitHub, python3Packages, readline }:

 with stdenv.lib;

 stdenv.mkDerivation rec {
  name = "bcal-${version}";
-  version = "1.8";
+  version = "1.9";

  src = fetchFromGitHub {
    owner = "jarun";
    repo = "bcal";
    rev = "v${version}";
-    sha256 = "0jdn46wzwq7yn3x6p1xyqarp52pcr0ghnfhkm7nyxv734g1abw7r";
+    sha256 = "0h6qi5rvzl6c6fsfdpdb3l4jcgip03l18i0b1x08z1y89i56y8mm";
  };

  nativeBuildInputs = [ python3Packages.pytest ];

+  buildInputs = [ readline ];
+
  doCheck = true;
  checkPhase = ''
    python3 -m pytest test.py
--- a/pkgs/applications/version-management/bazaar/CVE-2017-14176.patch
+++ b/pkgs/applications/version-management/bazaar/CVE-2017-14176.patch
@ -0,0 +1,149 @@
+diff --git a/bzrlib/tests/test_ssh_transport.py b/bzrlib/tests/test_ssh_transport.py
+index 9e37c3b..fe9f219 100644
+--- a/bzrlib/tests/test_ssh_transport.py
+++ b/bzrlib/tests/test_ssh_transport.py
+@@ -22,6 +22,7 @@ from bzrlib.transport.ssh import (
+     SSHCorpSubprocessVendor,
+     LSHSubprocessVendor,
+     SSHVendorManager,
+    StrangeHostname,
+     )
+ 
+ 
+@@ -161,6 +162,19 @@ class SSHVendorManagerTests(TestCase):
+ 
+ class SubprocessVendorsTests(TestCase):
+ 
+    def test_openssh_command_tricked(self):
+        vendor = OpenSSHSubprocessVendor()
+        self.assertEqual(
+            vendor._get_vendor_specific_argv(
+                "user", "-oProxyCommand=blah", 100, command=["bzr"]),
+            ["ssh", "-oForwardX11=no", "-oForwardAgent=no",
+                "-oClearAllForwardings=yes",
+                "-oNoHostAuthenticationForLocalhost=yes",
+                "-p", "100",
+                "-l", "user",
+                "--",
+                "-oProxyCommand=blah", "bzr"])
+
+     def test_openssh_command_arguments(self):
+         vendor = OpenSSHSubprocessVendor()
+         self.assertEqual(
+@@ -171,6 +185,7 @@ class SubprocessVendorsTests(TestCase):
+                 "-oNoHostAuthenticationForLocalhost=yes",
+                 "-p", "100",
+                 "-l", "user",
+                "--",
+                 "host", "bzr"]
+             )
+ 
+@@ -184,9 +199,16 @@ class SubprocessVendorsTests(TestCase):
+                 "-oNoHostAuthenticationForLocalhost=yes",
+                 "-p", "100",
+                 "-l", "user",
+-                "-s", "host", "sftp"]
+                "-s", "--", "host", "sftp"]
+             )
+ 
+    def test_openssh_command_tricked(self):
+        vendor = SSHCorpSubprocessVendor()
+        self.assertRaises(
+            StrangeHostname,
+            vendor._get_vendor_specific_argv,
+                "user", "-oProxyCommand=host", 100, command=["bzr"])
+
+     def test_sshcorp_command_arguments(self):
+         vendor = SSHCorpSubprocessVendor()
+         self.assertEqual(
+@@ -209,6 +231,13 @@ class SubprocessVendorsTests(TestCase):
+                 "-s", "sftp", "host"]
+             )
+ 
+    def test_lsh_command_tricked(self):
+        vendor = LSHSubprocessVendor()
+        self.assertRaises(
+            StrangeHostname,
+            vendor._get_vendor_specific_argv,
+                "user", "-oProxyCommand=host", 100, command=["bzr"])
+
+     def test_lsh_command_arguments(self):
+         vendor = LSHSubprocessVendor()
+         self.assertEqual(
+@@ -231,6 +260,13 @@ class SubprocessVendorsTests(TestCase):
+                 "--subsystem", "sftp", "host"]
+             )
+ 
+    def test_plink_command_tricked(self):
+        vendor = PLinkSubprocessVendor()
+        self.assertRaises(
+            StrangeHostname,
+            vendor._get_vendor_specific_argv,
+                "user", "-oProxyCommand=host", 100, command=["bzr"])
+
+     def test_plink_command_arguments(self):
+         vendor = PLinkSubprocessVendor()
+         self.assertEqual(
+diff --git a/bzrlib/transport/ssh.py b/bzrlib/transport/ssh.py
+index eecaa26..6f22341 100644
+--- a/bzrlib/transport/ssh.py
+++ b/bzrlib/transport/ssh.py
+@@ -46,6 +46,10 @@ else:
+     from paramiko.sftp_client import SFTPClient
+ 
+ 
+class StrangeHostname(errors.BzrError):
+    _fmt = "Refusing to connect to strange SSH hostname %(hostname)s"
+
+
+ SYSTEM_HOSTKEYS = {}
+ BZR_HOSTKEYS = {}
+ 
+@@ -360,6 +364,11 @@ class SubprocessVendor(SSHVendor):
+     # tests, but beware of using PIPE which may hang due to not being read.
+     _stderr_target = None
+ 
+    @staticmethod
+    def _check_hostname(arg):
+        if arg.startswith('-'):
+            raise StrangeHostname(hostname=arg)
+
+     def _connect(self, argv):
+         # Attempt to make a socketpair to use as stdin/stdout for the SSH
+         # subprocess.  We prefer sockets to pipes because they support
+@@ -424,9 +433,9 @@ class OpenSSHSubprocessVendor(SubprocessVendor):
+         if username is not None:
+             args.extend(['-l', username])
+         if subsystem is not None:
+-            args.extend(['-s', host, subsystem])
+            args.extend(['-s', '--', host, subsystem])
+         else:
+-            args.extend([host] + command)
+            args.extend(['--', host] + command)
+         return args
+ 
+ register_ssh_vendor('openssh', OpenSSHSubprocessVendor())
+@@ -439,6 +448,7 @@ class SSHCorpSubprocessVendor(SubprocessVendor):
+ 
+     def _get_vendor_specific_argv(self, username, host, port, subsystem=None,
+                                   command=None):
+        self._check_hostname(host)
+         args = [self.executable_path, '-x']
+         if port is not None:
+             args.extend(['-p', str(port)])
+@@ -460,6 +470,7 @@ class LSHSubprocessVendor(SubprocessVendor):
+ 
+     def _get_vendor_specific_argv(self, username, host, port, subsystem=None,
+                                   command=None):
+        self._check_hostname(host)
+         args = [self.executable_path]
+         if port is not None:
+             args.extend(['-p', str(port)])
+@@ -481,6 +492,7 @@ class PLinkSubprocessVendor(SubprocessVendor):
+ 
+     def _get_vendor_specific_argv(self, username, host, port, subsystem=None,
+                                   command=None):
+        self._check_hostname(host)
+         args = [self.executable_path, '-x', '-a', '-ssh', '-2', '-batch']
+         if port is not None:
+             args.extend(['-P', str(port)])
--- a/pkgs/applications/version-management/bazaar/default.nix
+++ b/pkgs/applications/version-management/bazaar/default.nix
@ -1,5 +1,4 @@
 { stdenv, fetchurl, python2Packages
-, fetchpatch
 , withSFTP ? true
 }:

@ -21,11 +20,7 @@ python2Packages.buildPythonApplication rec {
  patches = [
    # Bazaar can't find the certificates alone
    ./add_certificates.patch
-    (fetchpatch {
-      url = "https://bazaar.launchpad.net/~brz/brz/trunk/revision/6754";
-      sha256 = "0mdqa9w1p6cmli6976v4wi0sw9r4p5prkj7lzfd1877wk11c9c73";
-      name = "CVE-2017-14176.patch";
-    })
+    ./CVE-2017-14176.patch
  ];
  postPatch = ''
    substituteInPlace bzrlib/transport/http/_urllib2_wrappers.py \
--- a/pkgs/applications/version-management/git-and-tools/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/default.nix
@ -111,6 +111,8 @@ let

  hubUnstable = throw "use gitAndTools.hub instead";

+  pre-commit = callPackage ./pre-commit { };
+
  qgit = qt5.callPackage ./qgit { };

  stgit = callPackage ./stgit {
--- a/pkgs/applications/version-management/git-and-tools/pre-commit/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/pre-commit/default.nix
@ -0,0 +1,31 @@
+{ stdenv, python3Packages }:
+with python3Packages; buildPythonApplication rec {
+  pname = "pre_commit";
+  version = "1.10.4";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1kn8h9k9ca330m5n7r4cvxp679y3sc95m1x23a3qhzgam09n7jwr";
+  };
+
+  propagatedBuildInputs = [
+    aspy-yaml
+    cached-property
+    cfgv
+    identify
+    nodeenv
+    six
+    toml
+    virtualenv
+  ];
+
+  # Tests fail due to a missing windll dependency
+  doCheck = false;
+
+  meta = with stdenv.lib; {
+    description = "A framework for managing and maintaining multi-language pre-commit hooks";
+    homepage = https://pre-commit.com/;
+    license = licenses.mit;
+    maintainers = with maintainers; [ borisbabic ];
+  };
+}
--- a/pkgs/applications/version-management/monotone/default.nix
+++ b/pkgs/applications/version-management/monotone/default.nix
@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
    sha256 = "124cwgi2q86hagslbk5idxbs9j896rfjzryhr6z63r6l485gcp7r";
  };

-  patches = [ ];
+  patches = [ ./monotone-1.1-Adapt-to-changes-in-pcre-8.42.patch ];

  nativeBuildInputs = [ pkgconfig ];
  buildInputs = [ boost zlib botan libidn lua pcre sqlite expect 
--- a/pkgs/applications/version-management/monotone/monotone-1.1-Adapt-to-changes-in-pcre-8.42.patch
+++ b/pkgs/applications/version-management/monotone/monotone-1.1-Adapt-to-changes-in-pcre-8.42.patch
@ -0,0 +1,66 @@
+From 70f209ad582121750d54e3692b1e62c7f36af6f9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
+Date: Mon, 7 May 2018 14:09:06 +0200
+Subject: [PATCH] Adapt to changes in pcre-8.42
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+pcre-8.42 replaced internal real_pcre with real_pcre8_or_16. This
+broke monotone that decided not to use the public "pcre" type.
+
+This patch adapts monotone to the pcre >= 8.42.
+
+Signed-off-by: Petr Písař <ppisar@redhat.com>
+---
+ src/pcrewrap.cc | 4 ++--
+ src/pcrewrap.hh | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/src/pcrewrap.cc b/src/pcrewrap.cc
+index 8c0c9d1..30bafff 100644
+--- a/src/pcrewrap.cc
+++ b/src/pcrewrap.cc
+@@ -74,7 +74,7 @@ get_capturecount(void const * bd)
+ namespace pcre
+ {
+   typedef map<char const *,
+-              pair<struct real_pcre const *, struct pcre_extra const *> >
+              pair<struct real_pcre8_or_16 const *, struct pcre_extra const *> >
+               regex_cache;
+ 
+   class regex_cache_manager
+@@ -86,7 +86,7 @@ public:
+       }
+ 
+     void store(char const * pattern,
+-               pair<struct real_pcre const *, struct pcre_extra const *>
+               pair<struct real_pcre8_or_16 const *, struct pcre_extra const *>
+                data)
+       {
+         cache[pattern] = data;
+diff --git a/src/pcrewrap.hh b/src/pcrewrap.hh
+index 3359cdd..5008e88 100644
+--- a/src/pcrewrap.hh
+++ b/src/pcrewrap.hh
+@@ -18,7 +18,7 @@
+ // definitions and so we don't actually expose it here. Unfortunately, this
+ // means we have to hope this pair of forward declarations will not change...
+ 
+-struct real_pcre;
+struct real_pcre8_or_16;
+ struct pcre_extra;
+ 
+ namespace pcre
+@@ -61,7 +61,7 @@ namespace pcre
+     regex & operator=(regex const &);
+ 
+     // data
+-    struct real_pcre const * basedat;
+    struct real_pcre8_or_16 const * basedat;
+     struct pcre_extra const * extradat;
+ 
+     // used by constructors
+-- 
+2.14.3
+
--- a/pkgs/applications/version-management/reposurgeon/default.nix
+++ b/pkgs/applications/version-management/reposurgeon/default.nix
@ -1,17 +1,17 @@
 { stdenv, fetchurl, makeWrapper, python27Packages, git
-, docbook_xml_dtd_412, docbook_xsl, asciidoc, xmlto
+, docbook_xml_dtd_412, docbook_xsl, asciidoc, xmlto, pypy
 , bazaar ? null, cvs ? null, darcs ? null, fossil ? null
 , mercurial ? null, monotone ? null, rcs ? null
 , subversion ? null, cvs_fast_export ? null }:

 with stdenv; with lib;
 let
-  inherit (python27Packages) python cython;
+  inherit (python27Packages) python;
 in mkDerivation rec {
  name = "reposurgeon-${meta.version}";
  meta = {
    description = "A tool for editing version-control repository history";
-    version = "3.28";
+    version = "3.44";
    license = licenses.bsd3;
    homepage = http://www.catb.org/esr/reposurgeon/;
    maintainers = with maintainers; [ dfoxfranke ];
@ -19,17 +19,15 @@ in mkDerivation rec {
  };

  src = fetchurl {
-    url = "http://www.catb.org/~esr/reposurgeon/reposurgeon-3.28.tar.gz";
-    sha256 = "3225b44109b8630310a0ea6fe63a3485d27aa46deaf80e8d07820e01a6f62626";
+    url = "http://www.catb.org/~esr/reposurgeon/reposurgeon-3.44.tar.xz";
+    sha256 = "0il6hwrsm2qgg0vp5fcjh478y2x4zyw3mx2apcwc7svfj86pf7pn";
  };

-  # See https://gitlab.com/esr/reposurgeon/issues/17
-  patches = [ ./fix-preserve-type.patch ];
+  # install fails because the files README.md, NEWS, and TODO were not included in the source distribution
+  patches = [ ./fix-makefile.patch ];

  buildInputs =
-    [ docbook_xml_dtd_412 docbook_xsl asciidoc xmlto makeWrapper ] ++
-    optional (cython != null) cython
-  ;
+    [ docbook_xml_dtd_412 docbook_xsl asciidoc xmlto makeWrapper pypy ];

  preBuild = ''
    makeFlagsArray=(
@ -40,12 +38,6 @@ in mkDerivation rec {
    )
  '';

-  buildFlags = "all" + (if cython != null then " cyreposurgeon" else "");
-
-  installTargets =
-    "install" + (if cython != null then " install-cyreposurgeon" else "")
-  ;
-
  postInstall =
    let
      binpath = makeBinPath (
--- a/pkgs/applications/version-management/reposurgeon/fix-makefile.patch
+++ b/pkgs/applications/version-management/reposurgeon/fix-makefile.patch
@ -0,0 +1,12 @@
+diff -Naur reposurgeon-3.44/Makefile reposurgeon-3.44-new/Makefile
+--- reposurgeon-3.44/Makefile	2018-04-29 12:27:43.000000000 -0700
+++ reposurgeon-3.44-new/Makefile	2018-08-01 17:38:15.582789739 -0700
+@@ -36,7 +36,7 @@
+ MANPAGES = reposurgeon.1 repotool.1 repodiffer.1 repomapper.1 repocutter.1
+ HTMLFILES = $(MANPAGES:.1=.html) \
+             dvcs-migration-guide.html features.html reporting-bugs.html
+-SHARED    = README.md NEWS TODO reposurgeon-git-aliases $(HTMLFILES)
+SHARED    = reposurgeon-git-aliases $(HTMLFILES)
+ 
+ all:  $(MANPAGES) $(HTMLFILES)
+ 
--- a/pkgs/applications/version-management/reposurgeon/fix-preserve-type.patch
+++ b/pkgs/applications/version-management/reposurgeon/fix-preserve-type.patch
@ -1,12 +0,0 @@
-diff -Nru reposurgeon-3.28/reposurgeon reposurgeon-3.28-new/reposurgeon
--- reposurgeon-3.28/reposurgeon	2015-07-05 15:17:13.000000000 -0400
-+++ reposurgeon-3.28-new/reposurgeon	2015-08-25 18:23:11.347591137 -0400
-@@ -193,7 +193,7 @@
-         importer=b"git fast-import --quiet",
-         checkout=b"git checkout",
-         lister=b"git ls-files",
-        preserve=(b'.git/config', b'.git/hooks'),
-+        preserve=set((b'.git/config', b'.git/hooks')),
-         authormap=b".git/cvs-authors",
-         ignorename=b".gitignore",
-         dfltignores=b"",	# Has none
--- a/pkgs/applications/video/mpv/default.nix
+++ b/pkgs/applications/video/mpv/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchurl, fetchFromGitHub, makeWrapper
+{ stdenv, fetchpatch, fetchurl, fetchFromGitHub, makeWrapper
 , docutils, perl, pkgconfig, python3, which, ffmpeg_4
 , freefont_ttf, freetype, libass, libpthreadstubs
 , lua, luasocket, libuchardet, libiconv ? null, darwin
@ -21,6 +21,7 @@
 , sdl2Support        ? true,  SDL2          ? null
 , alsaSupport        ? true,  alsaLib       ? null
 , screenSaverSupport ? true,  libXScrnSaver ? null
+, cmsSupport         ? true,  lcms2         ? null
 , vdpauSupport       ? true,  libvdpau      ? null
 , dvdreadSupport     ? true,  libdvdread    ? null
 , dvdnavSupport      ? true,  libdvdnav     ? null
@ -34,7 +35,7 @@
 , youtubeSupport     ? true,  youtube-dl    ? null
 , vaapiSupport       ? true,  libva         ? null
 , drmSupport         ? true,  libdrm        ? null
-, openalSupport      ? true,  openalSoft   ? null
+, openalSupport      ? false, openalSoft    ? null
 , vapoursynthSupport ? false, vapoursynth   ? null
 , archiveSupport     ? false, libarchive    ? null
 , jackaudioSupport   ? false, libjack2      ? null
@ -53,6 +54,7 @@ assert xvSupport          -> x11Support && available libXv;
 assert sdl2Support        -> available SDL2;
 assert alsaSupport        -> available alsaLib;
 assert screenSaverSupport -> available libXScrnSaver;
+assert cmsSupport         -> available lcms2;
 assert vdpauSupport       -> available libvdpau;
 assert dvdreadSupport     -> available libdvdread;
 assert dvdnavSupport      -> available libdvdnav;
@ -91,6 +93,13 @@ in stdenv.mkDerivation rec {
    sha256 = "0i2nl65diqsjyz28dj07h6d8gq6ix72ysfm0nhs8514hqccaihs3";
  };

+  # FIXME: Remove this patch for building on macOS if it gets released in
+  # the future.
+  patches = optional stdenv.isDarwin (fetchpatch {
+    url = https://github.com/mpv-player/mpv/commit/dc553c8cf4349b2ab5d2a373ad2fac8bdd229ebb.patch;
+    sha256 = "0pa8vlb8rsxvd1s39c4iv7gbaqlkn3hx21a6xnpij99jdjkw3pg8";
+  });
+
  postPatch = ''
    patchShebangs ./TOOLS/
  '';
@ -105,6 +114,7 @@ in stdenv.mkDerivation rec {
    "--disable-libmpv-static"
    "--disable-static-build"
    "--disable-build-date" # Purity
+    "--disable-macos-cocoa-cb" # Disable whilst Swift isn't supported
    (enableFeature archiveSupport "libarchive")
    (enableFeature dvdreadSupport "dvdread")
    (enableFeature dvdnavSupport "dvdnav")
@ -136,11 +146,11 @@ in stdenv.mkDerivation rec {
    ++ optional pulseSupport       libpulseaudio
    ++ optional rubberbandSupport  rubberband
    ++ optional screenSaverSupport libXScrnSaver
+    ++ optional cmsSupport        lcms2
    ++ optional vdpauSupport       libvdpau
    ++ optional speexSupport       speex
    ++ optional bs2bSupport        libbs2b
    ++ optional openalSupport      openalSoft
-    ++ optional (openalSupport && stdenv.isDarwin) darwin.apple_sdk.frameworks.OpenAL
    ++ optional libpngSupport      libpng
    ++ optional youtubeSupport     youtube-dl
    ++ optional sdl2Support        SDL2
@ -149,11 +159,12 @@ in stdenv.mkDerivation rec {
    ++ optional drmSupport         libdrm
    ++ optional vapoursynthSupport vapoursynth
    ++ optional archiveSupport     libarchive
+    ++ optional stdenv.isDarwin    libiconv
    ++ optionals dvdnavSupport     [ libdvdnav libdvdnav.libdvdread ]
    ++ optionals x11Support        [ libX11 libXext libGLU_combined libXxf86vm libXrandr ]
    ++ optionals waylandSupport    [ wayland wayland-protocols libxkbcommon ]
    ++ optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [
-      CoreFoundation libiconv Cocoa CoreAudio
+      CoreFoundation Cocoa CoreAudio
    ]);

  enableParallelBuilding = true;
--- a/pkgs/applications/window-managers/stumpish/default.nix
+++ b/pkgs/applications/window-managers/stumpish/default.nix
@ -0,0 +1,44 @@
+{ stdenv, substituteAll, fetchurl, fetchFromGitHub, bash, gnused, ncurses, xorg, rlwrap }:
+
+stdenv.mkDerivation rec {
+  pname = "stumpish";
+  version = "0.0.1";
+  name = "${pname}-${version}";
+
+  src = fetchFromGitHub {
+    owner = "stumpwm";
+    repo = "stumpwm-contrib";
+    rev = "9f5f06652c480159ec57d1fd8751b16f02db06dc";
+    sha256 = "1dxzsnir3158p8y2128s08r9ca0ywr9mcznivmhn1lycw8mg4nfl";
+  };
+
+  buildInputs = [
+    gnused xorg.xprop rlwrap ncurses
+  ];
+
+  patches = [
+    (substituteAll {
+      src = ./paths.patch;
+      sed = "${gnused}/bin/sed";
+      xprop = "${xorg.xprop}/bin/xprop";
+      rlwrap = "${rlwrap}/bin/rlwrap";
+      tput = "${ncurses}/bin/tput";
+    })
+  ];
+
+  buildPhase = ''
+    mkdir -p $out/bin
+  '';
+
+  installPhase = ''
+    cp util/stumpish/stumpish $out/bin
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/stumpwm/stumpwm-contrib;
+    description = "STUMPwm Interactive SHell";
+    license = licenses.gpl2;
+    maintainers = [ maintainers.ebzzry ];
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/applications/window-managers/stumpish/paths.patch
+++ b/pkgs/applications/window-managers/stumpish/paths.patch
@ -0,0 +1,87 @@
+diff --git a/util/stumpish/stumpish b/util/stumpish/stumpish
+index 830cb1b..64213dc 100755
+--- a/util/stumpish/stumpish
+++ b/util/stumpish/stumpish
+@@ -28,8 +28,8 @@ then
+ fi
+ 
+ # replace -E with -r option for old versions of GNU sed
+-if ! sed -E 1p /dev/null 2>/dev/null; then
+-    sed() { shift; command sed -r "$@"; }
+if ! @sed@ -E 1p /dev/null 2>/dev/null; then
+    sed() { shift; command @sed@ -r "$@"; }
+ fi
+ 
+ # parse C-style backslash sequences by default
+@@ -41,9 +41,9 @@ wait_result ()
+ {
+     while true
+     do
+-	RESULT=$(xprop -root -f STUMPWM_COMMAND_RESULT 8s \
+	RESULT=$(@xprop@ -root -f STUMPWM_COMMAND_RESULT 8s \
+ 	    STUMPWM_COMMAND_RESULT 2>/dev/null |
+-	    sed -E 's/\\([[:digit:]]+)/\\0\1/g')
+	    @sed@ -E 's/\\([[:digit:]]+)/\\0\1/g')
+ 	if echo "$RESULT" | grep -v -q 'not found.$'
+ 	then
+ 	    break
+@@ -52,7 +52,7 @@ wait_result ()
+ 	sleep $DELAY
+     done
+ 
+-    xprop -root -remove STUMPWM_COMMAND_RESULT
+    @xprop@ -root -remove STUMPWM_COMMAND_RESULT
+ 
+     if echo "$RESULT" | grep -q '= $'
+     then
+@@ -60,7 +60,7 @@ wait_result ()
+     fi
+ 
+     echo "$RESULT" |
+-    sed -E 's/[^"\\n]+"//
+    @sed@ -E 's/[^"\\n]+"//
+             /^"[[:space:]]*$/d
+             s/(^|[^\\])\\n/\1\
+ /g
+@@ -80,7 +80,7 @@ send_cmd ()
+ 	exit
+     fi
+ 
+-    xprop -root -f STUMPWM_COMMAND 8s -set STUMPWM_COMMAND "$cmd"
+    @xprop@ -root -f STUMPWM_COMMAND 8s -set STUMPWM_COMMAND "$cmd"
+ 
+     wait_result
+ }
+@@ -123,8 +123,8 @@ tput ()
+     local cap1=$1 cap2=$2
+     shift 2
+ 
+-    command tput $cap1 $@ 2>/dev/null ||
+-    command tput $cap2 $@ 2>/dev/null
+    command @tput@ $cap1 $@ 2>/dev/null ||
+    command @tput@ $cap2 $@ 2>/dev/null
+ }
+ 
+ READLINE=yes
+@@ -156,18 +156,18 @@ then
+ else
+     if [ -t 0 ]
+     then
+-	if ! type rlwrap 2>/dev/null >&2
+	if ! type @rlwrap@ 2>/dev/null >&2
+ 	then
+ 	    warn rlwrap not found, command completion won\'t work
+ 	elif [ $READLINE = yes ]
+ 	then
+ 	    COMMANDS="${TMPDIR:-/tmp}/stumpish.commands.$$"
+ 	    echo $(send_cmd "commands") |
+-	    sed -E 's/[[:space:]]+/\
+	    @sed@ -E 's/[[:space:]]+/\
+ /g' |
+ 	    sort > "$COMMANDS"
+ 	    trap 'rm -f "$COMMANDS"' exit int term
+-	    rlwrap -b '' -f "$COMMANDS" "$0" -r
+	    @rlwrap@ -b '' -f "$COMMANDS" "$0" -r
+ 	    exit
+ 	fi
+ 
--- a/pkgs/data/fonts/ia-writer-duospace/default.nix
+++ b/pkgs/data/fonts/ia-writer-duospace/default.nix
@ -0,0 +1,26 @@
+{ lib, fetchFromGitHub }:
+
+let
+  version = "20180721";
+in fetchFromGitHub rec {
+  name = "ia-writer-duospace-${version}";
+
+  owner = "iaolo";
+  repo = "iA-Fonts";
+  rev = "55edf60f544078ab1e14987bc67e9029a200e0eb";
+  sha256 = "0932lcxf861vb3hz52z1xj8r99ag9sdyqsnq9brv7gc4kp2l339c";
+
+  postFetch = ''
+    tar --strip-components=1 -xzvf $downloadedFile
+    mkdir -p $out/share/fonts/opentype
+    cp "iA Writer Duospace/OTF (Mac)/"*.otf $out/share/fonts/opentype/
+  '';
+
+  meta = with lib; {
+    description = "iA Writer Duospace Typeface";
+    homepage = https://ia.net/topics/in-search-of-the-perfect-writing-font;
+    license = licenses.ofl;
+    platforms = platforms.all;
+    maintainers = [ maintainers.marsam ];
+  };
+}
--- a/pkgs/data/fonts/inriafonts/default.nix
+++ b/pkgs/data/fonts/inriafonts/default.nix
@ -0,0 +1,40 @@
+{ stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+
+  pname = "inriafonts";
+  version = "1.200";
+  name = "${pname}-${version}";
+
+src = fetchFromGitHub {
+  owner = "BlackFoundry";
+  repo = "InriaFonts";
+  rev = "v${version}";
+  sha256 = "06775y99lyh6hj5hzvrx56iybdck8a8xfqkipqd5c4cldg0a9hh8";
+};
+
+installPhase = ''
+  mkdir -p $out/share/fonts/truetype
+  cp fonts/*/TTF/*.ttf $out/share/fonts/truetype
+  mkdir -p $out/share/fonts/opentype
+  cp fonts/*/OTF/*.otf $out/share/fonts/opentype
+'';
+
+  meta = with stdenv.lib; {
+    homepage = https://black-foundry.com/work/inria;
+    description = "Inria Sans and Inria Serif";
+    longDescription = ''
+      Inria Sans and Inria Serif are the two members of a type family
+      design for the communication of Inria, the French national institute
+      dedicated to numeric research. The Institut needed a font
+      showing its values at the crossroad of humanity, technology,
+      excellence and creativity. Black[Foudry] created a humanist
+      typeface with a unapologetically contemporary design as the
+      Sans-serif part and a more rational axis and drawing for the
+      serif. Both members comes in 3 weights with matching italics.
+      '';
+    license = licenses.ofl;
+    maintainers = with maintainers; [ leenaars ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/data/fonts/inter-ui/default.nix
+++ b/pkgs/data/fonts/inter-ui/default.nix
@ -0,0 +1,25 @@
+{ stdenv, fetchzip }:
+
+let
+  version = "2.5";
+in fetchzip {
+  name = "inter-ui-${version}";
+
+  url = "https://github.com/rsms/inter/releases/download/v${version}/Inter-UI-${version}.zip";
+
+  postFetch = ''
+    mkdir -p $out/share/fonts/opentype
+    unzip -j $downloadedFile \*.otf -d $out/share/fonts/opentype
+  '';
+
+  sha256 = "1d88y6c9vbjz5siazhavnpfpazfkvpbcbb4pdycbnj03mmx6y07v";
+
+  meta = with stdenv.lib; {
+    homepage = https://rsms.me/inter/;
+    description = "A typeface specially designed for user interfaces";
+    license = licenses.ofl;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ demize ];
+  };
+}
+
--- a/pkgs/data/fonts/sarasa-gothic/default.nix
+++ b/pkgs/data/fonts/sarasa-gothic/default.nix
@ -1,12 +1,12 @@
 { stdenv, fetchurl, p7zip }:

 stdenv.mkDerivation rec {
-  version = "0.5.2";
+  version = "0.6.0";
  name = "sarasa-gothic-${version}";

  package = fetchurl {
    url = "https://github.com/be5invis/Sarasa-Gothic/releases/download/v${version}/sarasa-gothic-ttf-${version}.7z";
-    sha256 = "18ycw57k7yhrbb8njzhzk6x32xnjal61wr48qxkqy4lh9zfy0p22";
+    sha256 = "00kyx03lpgycxaw0cyx96hhrx8gwkcmy3qs35q7r09y60vg5i0nv";
  };

  nativeBuildInputs = [ p7zip ];
--- a/pkgs/data/icons/capitaine-cursors/default.nix
+++ b/pkgs/data/icons/capitaine-cursors/default.nix
@ -0,0 +1,45 @@
+{ stdenv, fetchFromGitHub
+, inkscape, xcursorgen }:
+
+stdenv.mkDerivation rec {
+  name = "capitaine-cursors-${version}";
+  version = "2.1";
+
+  src = fetchFromGitHub {
+    owner = "keeferrourke";
+    repo = "capitaine-cursors";
+    rev = "r${version}";
+    sha256 = "0ljvq1dqscp5gyf23qszn2ax80bxkqw2vx5zh3qln9vnzfascirb";
+  };
+
+  postPatch = ''
+    patchShebangs .
+  '';
+
+  buildInputs  =[
+    inkscape
+    xcursorgen
+  ];
+
+  buildPhase = ''
+    # https://github.com/NixOS/nixpkgs/blob/master/pkgs/data/fonts/emojione/default.nix#L16
+    HOME="$NIX_BUILD_ROOT" ./build.sh
+  '';
+
+  installPhase = ''
+    install -dm 0755 $out/share/icons
+    cp -pr dist $out/share/icons/capitaine-cursors
+  '';
+
+  meta = with stdenv.lib; {
+    description = ''
+      An x-cursor theme inspired by macOS and based on KDE Breeze
+    '';
+    homepage = https://github.com/keeferrourke/capitaine-cursors;
+    license = licenses.lgpl3;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [
+      eadwu
+    ];
+  };
+}
--- a/pkgs/desktops/gnome-3/apps/evolution/default.nix
+++ b/pkgs/desktops/gnome-3/apps/evolution/default.nix
@ -5,13 +5,13 @@
 , libcanberra-gtk3, bogofilter, gst_all_1, procps, p11-kit, openldap }:

 let
-  version = "3.28.3";
+  version = "3.28.5";
 in stdenv.mkDerivation rec {
  name = "evolution-${version}";

  src = fetchurl {
    url = "mirror://gnome/sources/evolution/${gnome3.versionBranch version}/${name}.tar.xz";
-    sha256 = "1s1vlznc22q1f8fm8fhggi8xak52b6n952s562f3kpv6g0dm2x6k";
+    sha256 = "1q1nfga39f44knrcvcxk8ivhl6fvg92g71cq3hcp4a7krb3jwa5v";
  };

  propagatedUserEnvPkgs = [ gnome3.evolution-data-server ];
--- a/pkgs/desktops/gnome-3/apps/file-roller/default.nix
+++ b/pkgs/desktops/gnome-3/apps/file-roller/default.nix
@ -3,11 +3,11 @@

 stdenv.mkDerivation rec {
  name = "file-roller-${version}";
-  version = "3.28.0";
+  version = "3.28.1";

  src = fetchurl {
    url = "mirror://gnome/sources/file-roller/${gnome3.versionBranch version}/${name}.tar.xz";
-    sha256 = "15pn2m80x45bzibig4zrqybnbr0n1f9wpqx7f2p6difldns3jwf1";
+    sha256 = "09y2blmlsccfxc2npcayhicq00r9n03897s1aizkahn1m970hjsp";
  };

  LANG = "en_US.UTF-8"; # postinstall.py
--- a/pkgs/desktops/gnome-3/apps/polari/default.nix
+++ b/pkgs/desktops/gnome-3/apps/polari/default.nix
@ -5,13 +5,13 @@

 let
  pname = "polari";
-  version = "3.28.0";
+  version = "3.28.1";
 in stdenv.mkDerivation rec {
  name = "${pname}-${version}";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${gnome3.versionBranch version}/${name}.tar.xz";
-    sha256 = "08zgdqrnxl752nv0gac1k7wvjd4j7h5n4c0flrq7q337p40k3dd5";
+    sha256 = "1066j1lbrkpcxhvrg3gcv7gv8dzqv5ny9qi9dnm8r1dsx2hil9yc";
  };

  propagatedUserEnvPkgs = [ telepathy-idle telepathy-logger ];
--- a/pkgs/desktops/gnome-3/core/eog/default.nix
+++ b/pkgs/desktops/gnome-3/core/eog/default.nix
@ -4,13 +4,13 @@

 let
  pname = "eog";
-  version = "3.28.2";
+  version = "3.28.3";
 in stdenv.mkDerivation rec {
  name = "${pname}-${version}";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${gnome3.versionBranch version}/${name}.tar.xz";
-    sha256 = "1gasrfqi7qrzdq1idh29r0n6ikkqjb6pbp7a8k5krfz5hkhyfin0";
+    sha256 = "1lj8v9m8jdxc3d4nzmgrxcccddg3hh8lkbmz4g71yxa0ykxxvbip";
  };

  nativeBuildInputs = [ meson ninja pkgconfig gettext itstool wrapGAppsHook libxml2 gobjectIntrospection ];
--- a/pkgs/desktops/gnome-3/core/evolution-data-server/default.nix
+++ b/pkgs/desktops/gnome-3/core/evolution-data-server/default.nix
@ -5,13 +5,13 @@

 stdenv.mkDerivation rec {
  name = "evolution-data-server-${version}";
-  version = "3.28.3";
+  version = "3.28.5";

  outputs = [ "out" "dev" ];

  src = fetchurl {
    url = "mirror://gnome/sources/evolution-data-server/${gnome3.versionBranch version}/${name}.tar.xz";
-    sha256 = "11sq795115vrcgxl9svscm6wg8isjj784c3d84qzb6z47zq92zj3";
+    sha256 = "1247gv0ggwnd1i2n7iglb3crfapx6s9nrl896bzy9k87fb94hlyr";
  };

  patches = [
--- a/pkgs/desktops/gnome-3/core/gdm/default.nix
+++ b/pkgs/desktops/gnome-3/core/gdm/default.nix
@ -21,6 +21,7 @@ stdenv.mkDerivation rec {
    "--sysconfdir=/etc"
    "--localstatedir=/var"
    "--with-plymouth=yes"
+    "--enable-gdm-xsession"
    "--with-initial-vt=7"
    "--with-systemdsystemunitdir=$(out)/etc/systemd/system"
  ];
--- a/Show more
+++ b/Show more