Merge remote-tracking branch 'upstream/master' into staging

.github/CONTRIBUTING.md

@@ -30,3 +30,6 @@ under the terms of [COPYING](../COPYING), which is an MIT-like license.
 
 See the nixpkgs manual for more details on how to [Submit changes to nixpkgs](https://nixos.org/nixpkgs/manual/#chap-submitting-changes).
 
+## Reviewing contributions
+
+See the nixpkgs manual for more details on how to [Review contributions](http://hydra.nixos.org/job/nixpkgs/trunk/manual/latest/download-by-type/doc/manual#chap-reviewing-contributions).

lib/maintainers.nix

@@ -290,6 +290,7 @@
   nckx = "Tobias Geerinckx-Rice <tobias.geerinckx.rice@gmail.com>";
   nequissimus = "Tim Steinbach <tim@nequissimus.com>";
   nfjinjing = "Jinjing Wang <nfjinjing@gmail.com>";
+  nhooyr = "Anmol Sethi <anmol@aubble.com>";
   nico202 = "Nicolò Balzarotti <anothersms@gmail.com>";
   notthemessiah = "Brian Cohen <brian.cohen.88@gmail.com>";
   NikolaMandic = "Ratko Mladic <nikola@mandic.email>";

lib/modules.nix

@@ -1,4 +1,5 @@
 with import ./lists.nix;
+with import ./strings.nix;
 with import ./trivial.nix;
 with import ./attrsets.nix;
 with import ./options.nix;
@@ -545,6 +546,84 @@ rec {
     use = builtins.trace "Obsolete option `${showOption from}' is used. It was renamed to `${showOption to}'.";
   };
 
+  /* Return a module that causes a warning to be shown if any of the "from"
+     option is defined; the defined values can be used in the "mergeFn" to set
+     the "to" value.
+     This function can be used to merge multiple options into one that has a
+     different type.
+
+     "mergeFn" takes the module "config" as a parameter and must return a value
+     of "to" option type.
+
+       mkMergedOptionModule
+         [ [ "a" "b" "c" ]
+           [ "d" "e" "f" ] ]
+         [ "x" "y" "z" ]
+         (config:
+           let value = p: getAttrFromPath p config;
+           in
+           if      (value [ "a" "b" "c" ]) == true then "foo"
+           else if (value [ "d" "e" "f" ]) == true then "bar"
+           else "baz")
+
+     - options.a.b.c is a removed boolean option
+     - options.d.e.f is a removed boolean option
+     - options.x.y.z is a new str option that combines a.b.c and d.e.f
+       functionality
+
+     This show a warning if any a.b.c or d.e.f is set, and set the value of
+     x.y.z to the result of the merge function 
+  */
+  mkMergedOptionModule = from: to: mergeFn:
+    { config, options, ... }:
+    {
+      options = foldl recursiveUpdate {} (map (path: setAttrByPath path (mkOption {
+        visible = false;
+        # To use the value in mergeFn without triggering errors
+        default = "_mkMergedOptionModule";
+      })) from);
+
+      config = {
+        warnings = filter (x: x != "") (map (f:
+          let val = getAttrFromPath f config;
+              opt = getAttrFromPath f options;
+          in
+          optionalString 
+            (val != "_mkMergedOptionModule")
+            "The option `${showOption f}' defined in ${showFiles opt.files} has been changed to `${showOption to}' that has a different type. Please read `${showOption to}' documentation and update your configuration accordingly."
+        ) from);
+      } // setAttrByPath to (mkMerge
+             (optional 
+               (any (f: (getAttrFromPath f config) != "_mkMergedOptionModule") from)
+               (mergeFn config)));
+    };
+
+  /* Single "from" version of mkMergedOptionModule.
+     Return a module that causes a warning to be shown if the "from" option is
+     defined; the defined value can be used in the "mergeFn" to set the "to"
+     value.
+     This function can be used to change an option into another that has a
+     different type.
+
+     "mergeFn" takes the module "config" as a parameter and must return a value of
+     "to" option type.
+
+       mkChangedOptionModule [ "a" "b" "c" ] [ "x" "y" "z" ]
+         (config:
+           let value = getAttrFromPath [ "a" "b" "c" ] config;
+           in
+           if   value > 100 then "high"
+           else "normal")
+
+     - options.a.b.c is a removed int option
+     - options.x.y.z is a new str option that supersedes a.b.c
+
+     This show a warning if a.b.c is set, and set the value of x.y.z to the
+     result of the change function
+  */
+  mkChangedOptionModule = from: to: changeFn:
+    mkMergedOptionModule [ from ] to changeFn;
+
   /* Like ‘mkRenamedOptionModule’, but doesn't show a warning. */
   mkAliasOptionModule = from: to: doRename {
     inherit from to;

lib/types.nix

@@ -261,7 +261,7 @@ rec {
     # declarations from the ‘options’ attribute of containing option
     # declaration.
     optionSet = mkOptionType {
-      name = /* builtins.trace "types.optionSet is deprecated; use types.submodule instead" */ "option set";
+      name = builtins.trace "types.optionSet is deprecated; use types.submodule instead" "option set";
     };
 
     # Augment the given type with an additional type check function.

nixos/doc/manual/development/development.xml

@@ -17,5 +17,6 @@ NixOS.</para>
 <xi:include href="building-nixos.xml" />
 <xi:include href="nixos-tests.xml" />
 <xi:include href="testing-installer.xml" />
+<xi:include href="reviewing-contributions.xml" />
 
 </part>

nixos/doc/manual/development/reviewing-contributions.xml

@@ -0,0 +1,393 @@
+<chapter xmlns="http://docbook.org/ns/docbook"
+        xmlns:xlink="http://www.w3.org/1999/xlink"
+        xmlns:xi="http://www.w3.org/2001/XInclude"
+        version="5.0"
+        xml:id="sec-reviewing-contributions">
+
+<title>Reviewing contributions</title>
+
+<warning>
+  <para>The following section is a draft and reviewing policy is still being 
+    discussed.</para>
+</warning>
+
+<para>The nixpkgs projects receives a fairly high number of contributions via 
+  GitHub pull-requests. Reviewing and approving these is an important task and a 
+  way to contribute to the project.</para>
+
+<para>The high change rate of nixpkgs make any pull request that is open for 
+  long enough subject to conflicts that will require extra work from the 
+  submitter or the merger. Reviewing pull requests in a timely manner and being 
+  responsive to the comments is the key to avoid these. Github provides sort 
+  filters that can be used to see the <link 
+    xlink:href="https://github.com/NixOS/nixpkgs/pulls?q=is%3Apr+is%3Aopen+sort%3Aupdated-desc">most 
+    recently</link> and the <link 
+    xlink:href="https://github.com/NixOS/nixpkgs/pulls?q=is%3Apr+is%3Aopen+sort%3Aupdated-asc">least 
+    recently</link> updated pull-requests.</para>
+
+<para>When reviewing a pull request, please always be nice and polite. 
+  Controversial changes can lead to controversial opinions, but it is important 
+  to respect every community members and their work.</para>
+
+<para>GitHub provides reactions, they are a simple and quick way to provide 
+  feedback to pull-requests or any comments. The thumb-down reaction should be 
+  used with care and if possible accompanied with some explanations so the 
+  submitter has directions to improve his contribution.</para>
+
+<para>Pull-requests reviews should include a list of what has been reviewed in a 
+  comment, so other reviewers and mergers can know the state of the 
+  review.</para>
+
+<para>All the review template samples provided in this section are generic and 
+  meant as examples. Their usage is optional and the reviewer is free to adapt 
+  them to his liking.</para>
+
+<section><title>Package updates</title>
+
+<para>A package update is the most trivial and common type of pull-request. 
+  These pull-requests mainly consist in updating the version part of the package 
+  name and the source hash.</para>
+<para>It can happen that non trivial updates include patches or more complex 
+  changes.</para>
+
+<para>Reviewing process:</para>
+
+<itemizedlist>
+  <listitem><para>Add labels to the pull-request. (Requires commit 
+      rights)</para>
+    <itemizedlist>
+      <listitem><para><literal>8.has: package (update)</literal> and any topic 
+          label that fit the updated package.</para></listitem>
+    </itemizedlist>
+  </listitem>
+  <listitem><para>Ensure that the package versioning is fitting the 
+      guidelines.</para></listitem>
+  <listitem><para>Ensure that the commit text is fitting the 
+      guidelines.</para></listitem>
+  <listitem><para>Ensure that the package maintainers are notified.</para>
+    <itemizedlist>
+      <listitem><para>mention-bot usually notify GitHub users based on the 
+          submitted changes, but it can happen that it misses some of the 
+          package maintainers.</para></listitem>
+    </itemizedlist>
+  </listitem>
+  <listitem><para>Ensure that the meta field contains correct 
+      information.</para>
+    <itemizedlist>
+      <listitem><para>License can change with version updates, so it should be 
+          checked to be fitting upstream license.</para></listitem>
+      <listitem><para>If the package has no maintainer, a maintainer must be 
+          set. This can be the update submitter or a community member that 
+          accepts to take maintainership of the package.</para></listitem>
+    </itemizedlist>
+  </listitem>
+  <listitem><para>Ensure that the code contains no typos.</para></listitem>
+  <listitem><para>Building the package locally.</para>
+    <itemizedlist>
+      <listitem><para>Pull-requests are often targeted to the master or staging 
+          branch so building the pull-request locally as it is submitted can 
+          trigger a large amount of source builds.</para>
+        <para>It is possible to rebase the changes on nixos-unstable or 
+          nixpkgs-unstable for easier review by running the following commands 
+          from a nixpkgs clone.
+<screen>
+$ git remote add channels https://github.com/NixOS/nixpkgs-channels.git <co 
+  xml:id='reviewing-rebase-1' />
+$ git fetch channels nixos-unstable <co xml:id='reviewing-rebase-2' />
+$ git fetch origin pull/PRNUMBER/head <co xml:id='reviewing-rebase-3' />
+$ git rebase --onto nixos-unstable BASEBRANCH FETCH_HEAD <co 
+  xml:id='reviewing-rebase-4' />
+</screen>
+        <calloutlist>
+          <callout arearefs='reviewing-rebase-1'>
+            <para>This should be done only once to be able to fetch channel 
+              branches from the nixpkgs-channels repository.</para>
+          </callout>
+          <callout arearefs='reviewing-rebase-2'>
+            <para>Fetching the nixos-unstable branch.</para>
+          </callout>
+          <callout arearefs='reviewing-rebase-3'>
+            <para>Fetching the pull-request changes, <varname>PRNUMBER</varname> 
+              is the number at the end of the pull-request title and 
+              <varname>BASEBRANCH</varname> the base branch of the 
+              pull-request.</para>
+          </callout>
+          <callout arearefs='reviewing-rebase-3'>
+            <para>Rebasing the pull-request changes to the nixos-unstable 
+              branch.</para>
+          </callout>
+        </calloutlist>
+        </para>
+      </listitem>
+      <listitem>
+        <para>The <link xlink:href="https://github.com/madjar/nox">nox</link> 
+          tool can be used to review a pull-request content in a single command. 
+          It doesn't rebase on a channel branch so it might trigger multiple 
+          source builds. <varname>PRNUMBER</varname> should be replaced by the 
+          number at the end of the pull-request title.</para>
+<screen>
+$ nix-shell -p nox --run "nox-review -k pr PRNUMBER"
+</screen>
+      </listitem>
+    </itemizedlist>
+  </listitem>
+  <listitem><para>Running every binary.</para></listitem>
+</itemizedlist>
+
+<example><title>Sample template for a package update review</title>
+<screen>
+##### Reviewed points
+
+- [ ] package name fits guidelines
+- [ ] package version fits guidelines
+- [ ] package build on ARCHITECTURE
+- [ ] executables tested on ARCHITECTURE
+- [ ] all depending packages build
+
+##### Possible improvements
+
+##### Comments
+
+</screen></example>
+</section>
+
+<section><title>New packages</title>
+
+<para>New packages are a common type of pull-requests. These pull requests 
+  consists in adding a new nix-expression for a package.</para>
+
+<para>Reviewing process:</para>
+
+<itemizedlist>
+  <listitem><para>Add labels to the pull-request. (Requires commit 
+      rights)</para>
+    <itemizedlist>
+      <listitem><para><literal>8.has: package (new)</literal> and any topic 
+          label that fit the new package.</para></listitem>
+    </itemizedlist>
+  </listitem>
+  <listitem><para>Ensure that the package versioning is fitting the 
+      guidelines.</para></listitem>
+  <listitem><para>Ensure that the commit name is fitting the 
+      guidelines.</para></listitem>
+  <listitem><para>Ensure that the meta field contains correct 
+      information.</para>
+    <itemizedlist>
+      <listitem><para>License must be checked to be fitting upstream 
+          license.</para></listitem>
+      <listitem><para>Platforms should be set or the package will not get binary 
+          substitutes.</para></listitem>
+      <listitem><para>A maintainer must be set, this can be the package 
+          submitter or a community member that accepts to take maintainership of 
+          the package.</para></listitem>
+    </itemizedlist>
+  </listitem>
+  <listitem><para>Ensure that the code contains no typos.</para></listitem>
+  <listitem><para>Ensure the package source.</para>
+    <itemizedlist>
+      <listitem><para>Mirrors urls should be used when 
+          available.</para></listitem>
+      <listitem><para>The most appropriate function should be used (e.g. 
+          packages from GitHub should use 
+          <literal>fetchFromGitHub</literal>).</para></listitem>
+    </itemizedlist>
+  </listitem>
+  <listitem><para>Building the package locally.</para></listitem>
+  <listitem><para>Running every binary.</para></listitem>
+</itemizedlist>
+
+<example><title>Sample template for a new package review</title>
+<screen>
+##### Reviewed points
+
+- [ ] package path fits guidelines
+- [ ] package name fits guidelines
+- [ ] package version fits guidelines
+- [ ] package build on ARCHITECTURE
+- [ ] executables tested on ARCHITECTURE
+- [ ] `meta.description` is set and fits guidelines
+- [ ] `meta.license` fits upstream license
+- [ ] `meta.platforms` is set
+- [ ] `meta.maintainers` is set
+- [ ] build time only dependencies are declared in `nativeBuildInputs`
+- [ ] source is fetched using the appropriate function
+- [ ] phases are respected
+- [ ] patches that are remotely available are fetched with `fetchPatch`
+
+##### Possible improvements
+
+##### Comments
+
+</screen></example>
+</section>
+
+<section><title>Module updates</title>
+
+<para>Module updates are submissions changing modules in some ways. These often 
+  contains changes to the options or introduce new options.</para>
+
+<para>Reviewing process</para>
+
+<itemizedlist>
+  <listitem><para>Add labels to the pull-request. (Requires commit 
+      rights)</para>
+    <itemizedlist>
+      <listitem><para><literal>8.has: module (update)</literal> and any topic 
+          label that fit the module.</para></listitem>
+    </itemizedlist>
+  </listitem>
+  <listitem><para>Ensure that the module maintainers are notified.</para>
+    <itemizedlist>
+      <listitem><para>Mention-bot notify GitHub users based on the submitted 
+          changes, but it can happen that it miss some of the package 
+          maintainers.</para></listitem>
+    </itemizedlist>
+  </listitem>
+  <listitem><para>Ensure that the module tests, if any, are 
+      succeeding.</para></listitem>
+  <listitem><para>Ensure that the introduced options are correct.</para>
+    <itemizedlist>
+      <listitem><para>Type should be appropriate (string related types differs 
+          in their merging capabilities, <literal>optionSet</literal> and 
+          <literal>string</literal> types are deprecated).</para></listitem>
+      <listitem><para>Description, default and example should be 
+          provided.</para></listitem>
+    </itemizedlist>
+  </listitem>
+  <listitem><para>Ensure that option changes are backward compatible.</para>
+    <itemizedlist>
+      <listitem><para><literal>mkRenamedOptionModule</literal> and 
+          <literal>mkAliasOptionModule</literal> functions provide way to make 
+          option changes backward compatible.</para></listitem>
+    </itemizedlist>
+  </listitem>
+  <listitem><para>Ensure that removed options are declared with 
+      <literal>mkRemovedOptionModule</literal></para></listitem>
+  <listitem><para>Ensure that changes that are not backward compatible are 
+      mentioned in release notes.</para></listitem>
+  <listitem><para>Ensure that documentations affected by the change is 
+      updated.</para></listitem>
+</itemizedlist>
+
+<example><title>Sample template for a module update review</title>
+<screen>
+##### Reviewed points
+
+- [ ] changes are backward compatible
+- [ ] removed options are declared with `mkRemovedOptionModule`
+- [ ] changes that are not backward compatible are documented in release notes
+- [ ] module tests succeed on ARCHITECTURE
+- [ ] options types are appropriate
+- [ ] options description is set
+- [ ] options example is provided
+- [ ] documentation affected by the changes is updated
+
+##### Possible improvements
+
+##### Comments
+
+</screen></example>
+</section>
+
+<section><title>New modules</title>
+
+<para>New modules submissions introduce a new module to NixOS.</para>
+
+<itemizedlist>
+  <listitem><para>Add labels to the pull-request. (Requires commit 
+      rights)</para>
+    <itemizedlist>
+      <listitem><para><literal>8.has: module (new)</literal> and any topic label 
+          that fit the module.</para></listitem>
+    </itemizedlist>
+  </listitem>
+  <listitem><para>Ensure that the module tests, if any, are 
+      succeeding.</para></listitem>
+  <listitem><para>Ensure that the introduced options are correct.</para>
+    <itemizedlist>
+      <listitem><para>Type should be appropriate (string related types differs 
+          in their merging capabilities, <literal>optionSet</literal> and 
+          <literal>string</literal> types are deprecated).</para></listitem>
+      <listitem><para>Description, default and example should be 
+          provided.</para></listitem>
+    </itemizedlist>
+  </listitem>
+  <listitem><para>Ensure that module <literal>meta</literal> field is 
+      present</para>
+    <itemizedlist>
+      <listitem><para>Maintainers should be declared in 
+          <literal>meta.maintainers</literal>.</para></listitem>
+      <listitem><para>Module documentation should be declared with 
+          <literal>meta.doc</literal>.</para></listitem>
+    </itemizedlist>
+  </listitem>
+  <listitem><para>Ensure that the module respect other modules 
+      functionality.</para>
+    <itemizedlist>
+      <listitem><para>For example, enabling a module should not open firewall 
+          ports by default.</para></listitem>
+    </itemizedlist>
+  </listitem>
+</itemizedlist>
+
+<example><title>Sample template for a new module review</title>
+<screen>
+##### Reviewed points
+
+- [ ] module path fits the guidelines
+- [ ] module tests succeed on ARCHITECTURE
+- [ ] options have appropriate types
+- [ ] options have default
+- [ ] options have example
+- [ ] options have descriptions
+- [ ] No unneeded package is added to system.environmentPackages
+- [ ] meta.maintainers is set
+- [ ] module documentation is declared in meta.doc
+
+##### Possible improvements
+
+##### Comments
+
+</screen></example>
+</section>
+
+<section><title>Other submissions</title>
+
+<para>Other type of submissions requires different reviewing steps.</para>
+
+<para>If you consider having enough knowledge and experience in a topic and 
+  would like to be a long-term reviewer for related submissions, please contact 
+  the current reviewers for that topic. They will give you information about the 
+  reviewing process.
+The main reviewers for a topic can be hard to find as there is no list, but 
+checking past pull-requests to see who reviewed or git-blaming the code to see 
+who committed to that topic can give some hints.</para>
+
+<para>Container system, boot system and library changes are some examples of the 
+  pull requests fitting this category.</para>
+
+</section>
+
+<section><title>Merging pull-requests</title>
+
+<para>It is possible for community members that have enough knowledge and 
+  experience on a special topic to contribute by merging pull requests.</para>
+
+<para>TODO: add the procedure to request merging rights.</para>
+
+<!--
+The following paragraph about how to deal with unactive contributors is just a
+proposition and should be modified to what the community agrees to be the right
+policy.
+
+<para>Please note that contributors with commit rights unactive for more than 
+  three months will have their commit rights revoked.</para>
+-->
+
+<para>In a case a contributor leaves definitively the Nix community, he should 
+  create an issue or notify the mailing list with references of packages and 
+  modules he maintains so the maintainership can be taken over by other 
+  contributors.</para>
+
+</section>
+</chapter>

nixos/doc/manual/release-notes/rl-1609.xml

@@ -4,7 +4,7 @@
          version="5.0"
          xml:id="sec-release-16.09">
 
-<title>Release 16.09 (“Flounder”, 2016/09/??)</title>
+<title>Release 16.09 (“Flounder”, 2016/09/30)</title>
 
 <para>In addition to numerous new and upgraded packages, this release
 has the following highlights: </para>
@@ -12,22 +12,45 @@ has the following highlights: </para>
 <itemizedlist>
 
   <listitem>
-    <para>PXE "netboot" media has landed in <link xlink:href="https://github.com/NixOS/nixpkgs/pull/14740" />.
+    <para>Many NixOS configurations and Nix packages now use
-    See <xref linkend="sec-booting-from-pxe" /> for documentation.</para>
+    significantly less disk space, thanks to the <link
+    xlink:href="https://github.com/NixOS/nixpkgs/issues/7117">extensive
+    work on closure size reduction</link>. For example, the closure
+    size of a minimal NixOS container went down from ~424 MiB in 16.03
+    to ~212 MiB in 16.09, while the closure size of Firefox went from
+    ~651 MiB to ~259 MiB.</para>
   </listitem>
 
   <listitem>
-    <para>Xorg-server-1.18.*. If you choose <literal>"ati_unfree"</literal> driver,
+    <para>To improve security, packages are now <link
-    1.17.* is still used due to ABI incompatibility.</para>
+    xlink:href="https://github.com/NixOS/nixpkgs/pull/12895">built
+    using various hardening features</link>. See the Nixpkgs manual
+    for more information.</para>
   </listitem>
+
+  <listitem>
+    <para>Support for PXE netboot.  See <xref
+    linkend="sec-booting-from-pxe" /> for documentation.</para>
+  </listitem>
+
+  <listitem>
+    <para>X.org server 1.18. If you use the
+    <literal>ati_unfree</literal> driver, 1.17 is still used due to an
+    ABI incompatibility.</para>
+  </listitem>
+
+  <listitem>
+    <para>This release is based on Glibc 2.24, GCC 5.4.0 and systemd
+    231. The default Linux kernel remains 4.4.</para>
+  </listitem>
+
 </itemizedlist>
 
 <para>The following new services were added since the last release:</para>
 
-  <itemizedlist>
+<itemizedlist>
-    <listitem><para><literal>(this will get automatically generated at release time)</literal></para></listitem>
+  <listitem><para><literal>(this will get automatically generated at release time)</literal></para></listitem>
-  </itemizedlist>
+</itemizedlist>
-
 
 <para>When upgrading from a previous release, please be aware of the
 following incompatible changes:</para>
@@ -36,7 +59,8 @@ following incompatible changes:</para>
 
   <listitem>
     <para>A large number of packages have been converted to use the multiple outputs feature
-      of Nix to greatly reduce the amount of required disk space. This may require changes
+      of Nix to greatly reduce the amount of required disk space, as
+      mentioned above. This may require changes
       to any custom packages to make them build again; see the relevant chapter in the
       Nixpkgs manual for more information. (Additional caveat to packagers: some packaging conventions
       related to multiple-output packages
@@ -45,6 +69,25 @@ following incompatible changes:</para>
     </para>
   </listitem>
 
+  <listitem>
+    <para>Previous versions of Nixpkgs had support for all versions of the LTS
+    Haskell package set. That support has been dropped. The previously provided
+    <literal>haskell.packages.lts-x_y</literal> package sets still exist in
+    name to aviod breaking user code, but these package sets don't actually
+    contain the versions mandated by the corresponding LTS release. Instead,
+    our package set it loosely based on the latest available LTS release, i.e.
+    LTS 7.x at the time of this writing. New releases of NixOS and Nixpkgs will
+    drop those old names entirely. <link
+    xlink:href="http://lists.science.uu.nl/pipermail/nix-dev/2016-June/020585.html">The
+    motivation for this change</link> has been discussed at length on the
+    <literal>nix-dev</literal> mailing list and in <link
+    xlink:href="https://github.com/NixOS/nixpkgs/issues/14897">Github issue
+    #14897</link>. Development strategies for Haskell hackers who want to rely
+    on Nix and NixOS have been described in <link
+    xlink:href="http://lists.science.uu.nl/pipermail/nix-dev/2016-June/020642.html">another
+    nix-dev article</link>.</para>
+  </listitem>
+
   <listitem>
     <para>Shell aliases for systemd sub-commands
     <link xlink:href="https://github.com/NixOS/nixpkgs/pull/15598">were dropped</link>:
@@ -58,16 +101,20 @@ following incompatible changes:</para>
   </listitem>
 
   <listitem>
-    <para>/var/setuid-wrappers/
+    <para>
-      <link xlink:href="https://github.com/NixOS/nixpkgs/pull/18124">is now a symlink so
+      <literal>/var/empty</literal> is now immutable. Activation script runs <command>chattr +i</command>
-      it can be atomically updated</link>
+      to forbid any modifications inside the folder. See <link xlink:href="https://github.com/NixOS/nixpkgs/pull/18365">
-      and it's not mounted as tmpfs anymore since setuid binaries are located on /run/ as tmpfs.
+      the pull request</link> for what bugs this caused.
     </para>
   </listitem>
 
   <listitem>
-    <para>Gitlab's maintainence script gitlab-runner was removed and split up into the more clearer
+    <para>Gitlab's maintainance script
-      gitlab-run and gitlab-rake scripts because gitlab-runner is a component of Gitlab CI.</para>
+    <command>gitlab-runner</command> was removed and split up into the
+    more clearer <command>gitlab-run</command> and
+    <command>gitlab-rake</command> scripts, because
+    <command>gitlab-runner</command> is a component of Gitlab
+    CI.</para>
   </listitem>
 
   <listitem>
@@ -80,14 +127,14 @@ following incompatible changes:</para>
   <listitem>
     <para><literal>fonts.fontconfig.ultimate.rendering</literal> was removed
     because our presets were obsolete for some time. New presets are hardcoded
-    into freetype; one selects a preset via <literal>fonts.fontconfig.ultimate.preset</literal>.
+    into FreeType; you can select a preset via <literal>fonts.fontconfig.ultimate.preset</literal>.
     You can customize those presets via ordinary environment variables, using
     <literal>environment.variables</literal>.</para>
   </listitem>
 
   <listitem>
     <para>The <literal>audit</literal> service is no longer enabled by default.
-    Use <literal>security.audit.enable = true;</literal> to explicitly enable it.</para>
+    Use <literal>security.audit.enable = true</literal> to explicitly enable it.</para>
   </listitem>
 
   <listitem>
@@ -100,10 +147,11 @@ following incompatible changes:</para>
   </listitem>
 
   <listitem>
-    <para><literal>goPackages</literal> was replaced with separated Go applications
+    <para><literal>goPackages</literal> was replaced with separated Go
-    in appropriate <literal>nixpkgs</literal> categories. Each Go package uses its own
+    applications in appropriate <literal>nixpkgs</literal>
-    dependency set defined in nix. There's also a new <literal>go2nix</literal>
+    categories. Each Go package uses its own dependency set. There's
-    tool introduced to generate Go package definition from its Go source automatically.</para>
+    also a new <literal>go2nix</literal> tool introduced to generate a
+    Go package definition from its Go source automatically.</para>
   </listitem>
 
   <listitem>
@@ -111,6 +159,12 @@ following incompatible changes:</para>
     was changed to YAML.</para>
   </listitem>
 
+  <listitem>
+    <para>
+      PHP has been upgraded to 7.0
+    </para>
+  </listitem>
+
 </itemizedlist>
 
 
@@ -127,10 +181,11 @@ following incompatible changes:</para>
   </para></listitem>
 
   <listitem><para>Special filesystems, like <literal>/proc</literal>,
-  <literal>/run</literal> and others, now have the same mount options as
+  <literal>/run</literal> and others, now have the same mount options
-  recommended by systemd. They are now unified across different places in NixOS.
+  as recommended by systemd and are unified across different places in
-  Options are also updated on the system switch if possible. One benefit from
+  NixOS.  Mount options are updated during <command>nixos-rebuild
-  this is improved security -- most such filesystems are now mounted with
+  switch</command> if possible. One benefit from this is improved
+  security — most such filesystems are now mounted with
   <literal>noexec</literal>, <literal>nodev</literal> and/or
   <literal>nosuid</literal> options.</para></listitem>
 
@@ -141,10 +196,42 @@ following incompatible changes:</para>
   debugging.</para></listitem>
 
   <listitem><para>Containers configuration within
-  <literal>containers.&lt;name&gt;.config</literal> is now properly
+  <literal>containers.&lt;name&gt;.config</literal> is <link
-  typed and checked. In particular, partial configurations are merged
+  xlink:href="https://github.com/NixOS/nixpkgs/pull/17365">now
-  correctly.
+  properly typed and checked</link>. In particular, partial
-  (<link xlink:href="https://github.com/NixOS/nixpkgs/pull/17365">#17365</link>)
+  configurations are merged correctly.</para></listitem>
+
+  <listitem>
+    <para>The directory container setuid wrapper programs,
+    <filename>/var/setuid-wrappers</filename>, <link
+    xlink:href="https://github.com/NixOS/nixpkgs/pull/18124">is now
+    updated atomically to prevent failures if the switch to a new
+    configuration is interrupted.</link></para>
+  </listitem>
+
+  <listitem>
+    <para><literal>services.xserver.startGnuPGAgent</literal>
+      has been removed due to GnuPG 2.1.x bump. See <link
+        xlink:href="https://github.com/NixOS/nixpkgs/commit/5391882ebd781149e213e8817fba6ac3c503740c">
+        how to achieve similar behavior</link>. You might need to
+      <literal>pkill gpg-agent</literal> after the upgrade
+      to prevent a stale agent being in the way.
+    </para>
+  </listitem>
+
+  <listitem><para>
+    <link xlink:href="https://github.com/NixOS/nixpkgs/commit/e561edc322d275c3687fec431935095cfc717147">
+    Declarative users could share the uid due to the bug in
+    the script handling conflict resolution.
+    </link>
+  </para></listitem>
+
+  <listitem><para>
+    Gummi boot has been replaced using systemd-boot.
+  </para></listitem>
+
+  <listitem><para>
+    Hydra package and NixOS module were added for convenience.
   </para></listitem>
 
 </itemizedlist>

nixos/modules/config/users-groups.nix

@@ -131,13 +131,12 @@ let
       };
 
       subUidRanges = mkOption {
-        type = types.listOf types.optionSet;
+        type = with types; listOf (submodule subordinateUidRange);
         default = [];
         example = [
           { startUid = 1000; count = 1; }
           { startUid = 100001; count = 65534; }
         ];
-        options = [ subordinateUidRange ];
         description = ''
           Subordinate user ids that user is allowed to use.
           They are set into <filename>/etc/subuid</filename> and are used
@@ -146,13 +145,12 @@ let
       };
 
       subGidRanges = mkOption {
-        type = types.listOf types.optionSet;
+        type = with types; listOf (submodule subordinateGidRange);
         default = [];
         example = [
           { startGid = 100; count = 1; }
           { startGid = 1001; count = 999; }
         ];
-        options = [ subordinateGidRange ];
         description = ''
           Subordinate group ids that user is allowed to use.
           They are set into <filename>/etc/subgid</filename> and are used
@@ -310,32 +308,36 @@ let
   };
 
   subordinateUidRange = {
-    startUid = mkOption {
+    options = {
-      type = types.int;
+      startUid = mkOption {
-      description = ''
+        type = types.int;
-        Start of the range of subordinate user ids that user is
+        description = ''
-        allowed to use.
+          Start of the range of subordinate user ids that user is
-      '';
+          allowed to use.
-    };
+        '';
-    count = mkOption {
+      };
-      type = types.int;
+      count = mkOption {
-      default = 1;
+        type = types.int;
-      description = ''Count of subordinate user ids'';
+        default = 1;
+        description = ''Count of subordinate user ids'';
+      };
     };
   };
 
   subordinateGidRange = {
-    startGid = mkOption {
+    options = {
-      type = types.int;
+      startGid = mkOption {
-      description = ''
+        type = types.int;
-        Start of the range of subordinate group ids that user is
+        description = ''
-        allowed to use.
+          Start of the range of subordinate group ids that user is
-      '';
+          allowed to use.
-    };
+        '';
-    count = mkOption {
+      };
-      type = types.int;
+      count = mkOption {
-      default = 1;
+        type = types.int;
-      description = ''Count of subordinate group ids'';
+        default = 1;
+        description = ''Count of subordinate group ids'';
+      };
     };
   };
 
@@ -428,7 +430,7 @@ in {
 
     users.users = mkOption {
       default = {};
-      type = types.loaOf types.optionSet;
+      type = with types; loaOf (submodule userOpts);
       example = {
         alice = {
           uid = 1234;
@@ -444,7 +446,6 @@ in {
         Additional user accounts to be created automatically by the system.
         This can also be used to set options for root.
       '';
-      options = [ userOpts ];
     };
 
     users.groups = mkOption {
@@ -453,11 +454,10 @@ in {
         { students.gid = 1001;
           hackers = { };
         };
-      type = types.loaOf types.optionSet;
+      type = with types; loaOf (submodule groupOpts);
       description = ''
         Additional groups to be created automatically by the system.
       '';
-      options = [ groupOpts ];
     };
 
     # FIXME: obsolete - will remove.

nixos/modules/i18n/input-method/default.xml

@@ -56,8 +56,18 @@ i18n.inputMethod = {
   <listitem><para>Table (<literal>ibus-engines.table</literal>): An input method 
       that load tables of input methods.</para></listitem>
   <listitem><para>table-others (<literal>ibus-engines.table-others</literal>): 
-      Various table-based input methods.</para></listitem>
+      Various table-based input methods. To use this, and any other table-based
+      input methods, it must appear in the list of engines along with
+      <literal>table</literal>. For example:
+<programlisting>
+ibus.engines = with pkgs.ibus-engines; [ table table-others ];
+</programlisting>
+  </para></listitem>
 </itemizedlist>
+
+<para>To use any input method, the package must be added in the configuration,
+  as shown above, and also (after running <literal>nixos-rebuild</literal>) the
+  input method must be added from IBus' preference dialog.</para>
 </section>
 
 <section><title>Fcitx</title>

nixos/modules/installer/cd-dvd/installation-cd-graphical-kde.nix

@@ -105,4 +105,7 @@ with lib;
         cp -f ${plasmaInit} $out/share/apps/plasma-desktop/init/00-defaultLayout.js
       '';
 
+  # Disable large stuff that's not very useful on the installation CD.
+  services.xserver.desktopManager.kde4.enablePIM = false;
+
 }

nixos/modules/installer/tools/nixos-install.sh

@@ -259,7 +259,7 @@ chroot $mountPoint /nix/var/nix/profiles/system/activate
 
 
 # Ask the user to set a root password.
-if [ -z "$noRootPasswd" ] && [ -x $mountPoint/var/setuid-wrappers/passwd ] && [ -t 0 ]; then
+if [ -z "$noRootPasswd" ] && chroot $mountPoint [ -x /var/setuid-wrappers/passwd ] && [ -t 0 ]; then
     echo "setting root password..."
     chroot $mountPoint /var/setuid-wrappers/passwd
 fi

nixos/modules/misc/ids.nix

@@ -275,6 +275,7 @@
       prometheus = 255;
       telegraf = 256;
       gitlab-runner = 257;
+      postgrey = 258;
 
       # When adding a uid, make sure it doesn't match an existing gid. And don't use uids above 399!
 
@@ -520,6 +521,7 @@
       prometheus = 255;
       #telegraf = 256; # unused
       gitlab-runner = 257;
+      postgrey = 258;
 
       # When adding a gid, make sure it doesn't match an existing
       # uid. Users and groups with the same name should have equal

nixos/modules/module-list.nix

@@ -70,6 +70,7 @@
   ./programs/fish.nix
   ./programs/freetds.nix
   ./programs/info.nix
+  ./programs/java.nix
   ./programs/kbdlight.nix
   ./programs/light.nix
   ./programs/man.nix
@@ -216,6 +217,7 @@
   ./services/mail/opensmtpd.nix
   ./services/mail/postfix.nix
   ./services/mail/postsrsd.nix
+  ./services/mail/postgrey.nix
   ./services/mail/spamassassin.nix
   ./services/mail/rspamd.nix
   ./services/mail/rmilter.nix
@@ -345,6 +347,7 @@
   ./services/networking/ferm.nix
   ./services/networking/firefox/sync-server.nix
   ./services/networking/firewall.nix
+  ./services/networking/flannel.nix
   ./services/networking/flashpolicyd.nix
   ./services/networking/freenet.nix
   ./services/networking/gale.nix

nixos/modules/programs/java.nix

@@ -0,0 +1,57 @@
+# This module provides JAVA_HOME, with a different way to install java
+# system-wide.
+
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.programs.java;
+in
+
+{
+
+  options = {
+
+    programs.java = {
+
+      enable = mkEnableOption "java" // {
+        description = ''
+          Install and setup the Java development kit.
+          <note>
+          <para>This adds JAVA_HOME to the global environment, by sourcing the
+            jdk's setup-hook on shell init. It is equivalent to starting a shell
+            through 'nix-shell -p jdk', or roughly the following system-wide
+            configuration:
+          </para>
+          <programlisting>
+            environment.variables.JAVA_HOME = ''${pkgs.jdk.home}/lib/openjdk;
+            environment.systemPackages = [ pkgs.jdk ];
+          </programlisting>
+          </note>
+        '';
+      };
+
+      package = mkOption {
+        default = pkgs.jdk;
+        description = ''
+          Java package to install. Typical values are pkgs.jdk or pkgs.jre.
+        '';
+        type = types.package;
+      };
+
+    };
+
+  };
+
+  config = mkIf cfg.enable {
+
+    environment.systemPackages = [ cfg.package ];
+
+    environment.shellInit = ''
+      test -e ${cfg.package}/nix-support/setup-hook && source ${cfg.package}/nix-support/setup-hook
+    '';
+
+  };
+
+}

nixos/modules/rename.nix

@@ -153,7 +153,7 @@ with lib;
     (mkRemovedOptionModule [ "services" "printing" "cupsFilesConf" ] "")
     (mkRemovedOptionModule [ "services" "printing" "cupsdConf" ] "")
     (mkRemovedOptionModule [ "services" "xserver" "startGnuPGAgent" ]
-      "See the 16.03 release notes for more information.")
+      "See the 16.09 release notes for more information.")
     (mkRemovedOptionModule [ "services" "phpfpm" "phpIni" ] "")
     (mkRemovedOptionModule [ "services" "dovecot2" "package" ] "")
     (mkRemovedOptionModule [ "services" "dockerRegistry" ]

nixos/modules/security/acme.nix

@@ -129,11 +129,10 @@ in
 
       certs = mkOption {
         default = { };
-        type = types.loaOf types.optionSet;
+        type = with types; loaOf (submodule certOpts);
         description = ''
           Attribute set of certificates to get signed and renewed.
         '';
-        options = [ certOpts ];
         example = {
           "example.com" = {
             webroot = "/var/www/challenges/";

nixos/modules/security/pam.nix

@@ -386,8 +386,7 @@ in
 
     security.pam.services = mkOption {
       default = [];
-      type = types.loaOf types.optionSet;
+      type = with types; loaOf (submodule pamOpts);
-      options = [ pamOpts ];
       description =
         ''
           This option defines the PAM services.  A service typically

nixos/modules/services/backup/bacula.nix

@@ -198,8 +198,7 @@ in {
         description = ''
           This option defines director resources in Bacula File Daemon.
         '';
-        type = types.attrsOf types.optionSet;
+        type = with types; attrsOf (submodule directorOptions);
-        options = [ directorOptions ];
       };
 
       extraClientConfig = mkOption {
@@ -253,8 +252,7 @@ in {
         description = ''
           This option defines Director resources in Bacula Storage Daemon.
         '';
-        type = types.attrsOf types.optionSet;
+        type = with types; attrsOf (submodule directorOptions);
-        options = [ directorOptions ];
       };
 
       device = mkOption {
@@ -262,8 +260,7 @@ in {
         description = ''
           This option defines Device resources in Bacula Storage Daemon.
         '';
-        type = types.attrsOf types.optionSet;
+        type = with types; attrsOf (submodule deviceOptions);
-        options = [ deviceOptions ];
       };
  
       extraStorageConfig = mkOption {

nixos/modules/services/hardware/sane_extra_backends/brscan4.nix

@@ -81,12 +81,11 @@ in
         { office1 = { model = "MFC-7860DW"; ip = "192.168.1.2"; };
           office2 = { model = "MFC-7860DW"; nodename = "BRW0080927AFBCE"; };
         };
-      type = types.loaOf types.optionSet;
+      type = with types; loaOf (submodule netDeviceOpts);
       description = ''
         The list of network devices that will be registered against the brscan4
         sane backend.
       '';
-      options = [ netDeviceOpts ];
     };
   };
 
@@ -113,4 +112,4 @@ in
     ];
 
   };
-}
+}

nixos/modules/services/logging/logcheck.nix

@@ -62,42 +62,46 @@ let
   };
 
   ignoreOptions = {
-    level = levelOption;
+    options = {
+      level = levelOption;
 
-    regex = mkOption {
+      regex = mkOption {
-      default = "";
+        default = "";
-      type = types.str;
+        type = types.str;
-      description = ''
+        description = ''
-        Regex specifying which log lines to ignore.
+          Regex specifying which log lines to ignore.
-      '';
+        '';
+      };
     };
   };
 
   ignoreCronOptions = {
-    user = mkOption {
+    options = {
-      default = "root";
+      user = mkOption {
-      type = types.str;
+        default = "root";
-      description = ''
+        type = types.str;
-        User that runs the cronjob.
+        description = ''
-      '';
+          User that runs the cronjob.
-    };
+        '';
+      };
 
-    cmdline = mkOption {
+      cmdline = mkOption {
-      default = "";
+        default = "";
-      type = types.str;
+        type = types.str;
-      description = ''
+        description = ''
-        Command line for the cron job. Will be turned into a regex for the logcheck ignore rule.
+          Command line for the cron job. Will be turned into a regex for the logcheck ignore rule.
-      '';
+        '';
-    };
+      };
 
-    timeArgs = mkOption {
+      timeArgs = mkOption {
-      default = null;
+        default = null;
-      type = types.nullOr (types.str);
+        type = types.nullOr (types.str);
-      example = "02 06 * * *";
+        example = "02 06 * * *";
-      description = ''
+        description = ''
-        "min hr dom mon dow" crontab time args, to auto-create a cronjob too.
+          "min hr dom mon dow" crontab time args, to auto-create a cronjob too.
-        Leave at null to not do this and just add a logcheck ignore rule.
+          Leave at null to not do this and just add a logcheck ignore rule.
-      '';
+        '';
+      };
     };
   };
 
@@ -180,8 +184,7 @@ in
         description = ''
           This option defines extra ignore rules.
         '';
-        type = types.loaOf types.optionSet;
+        type = with types; loaOf (submodule ignoreOptions);
-        options = [ ignoreOptions ];
       };
 
       ignoreCron = mkOption {
@@ -189,8 +192,7 @@ in
         description = ''
           This option defines extra ignore rules for cronjobs.
         '';
-        type = types.loaOf types.optionSet;
+        type = with types; loaOf (submodule ignoreCronOptions);
-        options = [ ignoreOptions ignoreCronOptions ];
       };
 
       extraGroups = mkOption {

nixos/modules/services/mail/postgrey.nix

@@ -0,0 +1,79 @@
+{ config, lib, pkgs, ... }:
+
+with lib; let
+
+  cfg = config.services.postgrey;
+
+in {
+
+  options = {
+    services.postgrey = with types; {
+      enable = mkOption {
+        type = bool;
+        default = false;
+        description = "Whether to run the Postgrey daemon";
+      };
+      inetAddr = mkOption {
+        type = nullOr string;
+        default = null;
+        example = "127.0.0.1";
+        description = "The inet address to bind to. If none given, bind to /var/run/postgrey.sock";
+      };
+      inetPort = mkOption {
+        type = int;
+        default = 10030;
+        description = "The tcp port to bind to";
+      };
+      greylistText = mkOption {
+        type = string;
+        default = "Greylisted for %%s seconds";
+        description = "Response status text for greylisted messages";
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+
+    environment.systemPackages = [ pkgs.postgrey ];
+
+    users = {
+      extraUsers = {
+        postgrey = {
+          description = "Postgrey Daemon";
+          uid = config.ids.uids.postgrey;
+          group = "postgrey";
+        };
+      };
+      extraGroups = {
+        postgrey = {
+          gid = config.ids.gids.postgrey;
+        };
+      };
+    };
+
+    systemd.services.postgrey = let
+      bind-flag = if isNull cfg.inetAddr then
+        "--unix=/var/run/postgrey.sock"
+      else
+        "--inet=${cfg.inetAddr}:${cfg.inetPort}";
+    in {
+      description = "Postfix Greylisting Service";
+      wantedBy = [ "multi-user.target" ];
+      before = [ "postfix.service" ];
+      preStart = ''
+        mkdir -p /var/postgrey
+        chown postgrey:postgrey /var/postgrey
+        chmod 0770 /var/postgrey
+      '';
+      serviceConfig = {
+        Type = "simple";
+        ExecStart = ''${pkgs.postgrey}/bin/postgrey ${bind-flag} --pidfile=/var/run/postgrey.pid --group=postgrey --user=postgrey --dbdir=/var/postgrey --greylist-text="${cfg.greylistText}"'';
+        Restart = "always";
+        RestartSec = 5;
+        TimeoutSec = 10;
+      };
+    };
+
+  };
+
+}

nixos/modules/services/misc/confd.nix

@@ -33,7 +33,7 @@ in {
 
     nodes = mkOption {
       description = "Confd list of nodes to connect to.";
-      default = [ "http://127.0.0.1:4001" ];
+      default = [ "http://127.0.0.1:2379" ];
       type = types.listOf types.str;
     };
 

nixos/modules/services/misc/matrix-synapse.nix

@@ -5,15 +5,16 @@ with lib;
 let
   cfg = config.services.matrix-synapse;
   logConfigFile = pkgs.writeText "log_config.yaml" cfg.logConfig;
-  mkResource = r: ''{names: ${builtins.toJSON r.names}, compress: ${if r.compress then "true" else "false"}}'';
+  mkResource = r: ''{names: ${builtins.toJSON r.names}, compress: ${fromBool r.compress}}'';
-  mkListener = l: ''{port: ${toString l.port}, bind_address: "${l.bind_address}", type: ${l.type}, tls: ${if l.tls then "true" else "false"}, x_forwarded: ${if l.x_forwarded then "true" else "false"}, resources: [${concatStringsSep "," (map mkResource l.resources)}]}'';
+  mkListener = l: ''{port: ${toString l.port}, bind_address: "${l.bind_address}", type: ${l.type}, tls: ${fromBool l.tls}, x_forwarded: ${fromBool l.x_forwarded}, resources: [${concatStringsSep "," (map mkResource l.resources)}]}'';
+  fromBool = x: if x then "true" else "false";
   configFile = pkgs.writeText "homeserver.yaml" ''
 tls_certificate_path: "${cfg.tls_certificate_path}"
 ${optionalString (cfg.tls_private_key_path != null) ''
 tls_private_key_path: "${cfg.tls_private_key_path}"
 ''}
 tls_dh_params_path: "${cfg.tls_dh_params_path}"
-no_tls: ${if cfg.no_tls then "true" else "false"}
+no_tls: ${fromBool cfg.no_tls}
 ${optionalString (cfg.bind_port != null) ''
 bind_port: ${toString cfg.bind_port}
 ''}
@@ -25,7 +26,7 @@ bind_host: "${cfg.bind_host}"
 ''}
 server_name: "${cfg.server_name}"
 pid_file: "/var/run/matrix-synapse.pid"
-web_client: ${if cfg.web_client then "true" else "false"}
+web_client: ${fromBool cfg.web_client}
 ${optionalString (cfg.public_baseurl != null) ''
 public_baseurl: "${cfg.public_baseurl}"
 ''}
@@ -53,14 +54,14 @@ media_store_path: "/var/lib/matrix-synapse/media"
 uploads_path: "/var/lib/matrix-synapse/uploads"
 max_upload_size: "${cfg.max_upload_size}"
 max_image_pixels: "${cfg.max_image_pixels}"
-dynamic_thumbnails: ${if cfg.dynamic_thumbnails then "true" else "false"}
+dynamic_thumbnails: ${fromBool cfg.dynamic_thumbnails}
 url_preview_enabled: False
 recaptcha_private_key: "${cfg.recaptcha_private_key}"
 recaptcha_public_key: "${cfg.recaptcha_public_key}"
-enable_registration_captcha: ${if cfg.enable_registration_captcha then "true" else "false"}
+enable_registration_captcha: ${fromBool cfg.enable_registration_captcha}
 turn_uris: ${builtins.toJSON cfg.turn_uris}
 turn_shared_secret: "${cfg.turn_shared_secret}"
-enable_registration: ${if cfg.enable_registration then "true" else "false"}
+enable_registration: ${fromBool cfg.enable_registration}
 ${optionalString (cfg.registration_shared_secret != null) ''
 registration_shared_secret: "${cfg.registration_shared_secret}"
 ''}
@@ -68,9 +69,15 @@ recaptcha_siteverify_api: "https://www.google.com/recaptcha/api/siteverify"
 turn_user_lifetime: "${cfg.turn_user_lifetime}"
 user_creation_max_duration: ${cfg.user_creation_max_duration}
 bcrypt_rounds: ${cfg.bcrypt_rounds}
-allow_guest_access: {if cfg.allow_guest_access then "true" else "false"}
+allow_guest_access: ${fromBool cfg.allow_guest_access}
-enable_metrics: ${if cfg.enable_metrics then "true" else "false"}
+trusted_third_party_id_servers: ${builtins.toJSON cfg.trusted_third_party_id_servers}
-report_stats: ${if cfg.report_stats then "true" else "false"}
+room_invite_state_types: ${builtins.toJSON cfg.room_invite_state_types}
+${optionalString (cfg.macaroon_secret_key != null) ''
+  macaroon_secret_key: "${cfg.macaroon_secret_key}"
+''}
+expire_access_token: ${fromBool cfg.expire_access_token}
+enable_metrics: ${fromBool cfg.enable_metrics}
+report_stats: ${fromBool cfg.report_stats}
 signing_key_path: "/var/lib/matrix-synapse/homeserver.signing.key"
 key_refresh_interval: "${cfg.key_refresh_interval}"
 perspectives:
@@ -469,6 +476,34 @@ in {
           accessible to anonymous users.
         '';
       };
+      trusted_third_party_id_servers = mkOption {
+        type = types.listOf types.str;
+        default = ["matrix.org"];
+        description = ''
+          The list of identity servers trusted to verify third party identifiers by this server.
+        '';
+      };
+      room_invite_state_types = mkOption {
+        type = types.listOf types.str;
+        default = ["m.room.join_rules" "m.room.canonical_alias" "m.room.avatar" "m.room.name"];
+        description = ''
+          A list of event types that will be included in the room_invite_state
+        '';
+      };
+      macaroon_secret_key = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        description = ''
+          Secret key for authentication tokens
+        '';
+      };
+      expire_access_token = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to enable access token expiration.
+        '';
+      };
       key_refresh_interval = mkOption {
         type = types.str;
         default = "1d";

nixos/modules/services/misc/rippled.nix

@@ -154,43 +154,45 @@ let
   };
 
   dbOptions = {
-    type = mkOption {
+    options = {
-      description = "Rippled database type.";
+      type = mkOption {
-      type = types.enum ["rocksdb" "nudb"];
+        description = "Rippled database type.";
-      default = "rocksdb";
+        type = types.enum ["rocksdb" "nudb"];
-    };
+        default = "rocksdb";
+      };
 
-    path = mkOption {
+      path = mkOption {
-      description = "Location to store the database.";
+        description = "Location to store the database.";
-      type = types.path;
+        type = types.path;
-      default = cfg.databasePath;
+        default = cfg.databasePath;
-    };
+      };
 
-    compression = mkOption {
+      compression = mkOption {
-      description = "Whether to enable snappy compression.";
+        description = "Whether to enable snappy compression.";
-      type = types.nullOr types.bool;
+        type = types.nullOr types.bool;
-      default = null;
+        default = null;
-    };
+      };
 
-    onlineDelete = mkOption {
+      onlineDelete = mkOption {
-      description = "Enable automatic purging of older ledger information.";
+        description = "Enable automatic purging of older ledger information.";
-      type = types.addCheck (types.nullOr types.int) (v: v > 256);
+        type = types.addCheck (types.nullOr types.int) (v: v > 256);
-      default = cfg.ledgerHistory;
+        default = cfg.ledgerHistory;
-    };
+      };
 
-    advisoryDelete = mkOption {
+      advisoryDelete = mkOption {
-      description = ''
+        description = ''
-	If set, then require administrative RPC call "can_delete"
+	        If set, then require administrative RPC call "can_delete"
-	to enable online deletion of ledger records.
+	        to enable online deletion of ledger records.
-      '';
+        '';
-      type = types.nullOr types.bool;
+        type = types.nullOr types.bool;
-      default = null;
+        default = null;
-    };
+      };
 
-    extraOpts = mkOption {
+      extraOpts = mkOption {
-      description = "Extra database options.";
+        description = "Extra database options.";
-      type = types.lines;
+        type = types.lines;
-      default = "";
+        default = "";
+      };
     };
   };
 
@@ -213,8 +215,7 @@ in
 
       ports = mkOption {
 	description = "Ports exposed by rippled";
-	type = types.attrsOf types.optionSet;
+	type = with types; attrsOf (submodule portOptions);
-	options = [portOptions];
 	default = {
 	  rpc = {
 	    port = 5005;
@@ -238,8 +239,7 @@ in
 
       nodeDb = mkOption {
 	description = "Rippled main database options.";
-	type = types.nullOr types.optionSet;
+	type = with types; nullOr (submodule dbOptions);
-	options = dbOptions;
 	default = {
 	  type = "rocksdb";
 	  extraOpts = ''
@@ -254,15 +254,13 @@ in
 
       tempDb = mkOption {
 	description = "Rippled temporary database options.";
-	type = types.nullOr types.optionSet;
+	type = with types; nullOr (submodule dbOptions);
-	options = dbOptions;
 	default = null;
       };
 
       importDb = mkOption {
 	description = "Settings for performing a one-time import.";
-	type = types.nullOr types.optionSet;
+	type = with types; nullOr (submodule dbOptions);
-	options = dbOptions;
 	default = null;
       };
 

nixos/modules/services/monitoring/smartd.nix

@@ -197,8 +197,7 @@ in
       devices = mkOption {
         default = [];
         example = [ { device = "/dev/sda"; } { device = "/dev/sdb"; options = "-d sat"; } ];
-        type = types.listOf types.optionSet;
+        type = with types; listOf (submodule smartdOpts);
-        options = [ smartdOpts ];
         description = "List of devices to monitor.";
       };
 

nixos/modules/services/monitoring/ups.nix

@@ -169,8 +169,7 @@ in
           monitoring directly.  These are usually attached to serial ports,
           but USB devices are also supported.
         '';
-        type = types.attrsOf types.optionSet;
+        type = with types; attrsOf (submodule upsOptions);
-        options = [ upsOptions ];
       };
 
     };

nixos/modules/services/network-filesystems/samba.nix

@@ -56,6 +56,7 @@ let
       serviceConfig = {
         ExecStart = "${samba}/sbin/${appName} ${args}";
         ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+        Type = "notify";
       };
 
       restartTriggers = [ configFile ];
@@ -167,12 +168,12 @@ in
         type = types.attrsOf (types.attrsOf types.unspecified);
         example =
           { public =
-             { path = "/srv/public";
+            { path = "/srv/public";
-               "read only" = true;
+              "read only" = true;
-               browseable = "yes";
+              browseable = "yes";
-               "guest ok" = "yes";
+              "guest ok" = "yes";
-                comment = "Public samba share.";
+              comment = "Public samba share.";
-             };
+            };
           };
       };
 

nixos/modules/services/network-filesystems/tahoe.nix

@@ -8,148 +8,150 @@ in
     options.services.tahoe = {
       introducers = mkOption {
         default = {};
-        type = types.loaOf types.optionSet;
+        type = with types; loaOf (submodule {
+          options = {
+            nickname = mkOption {
+              type = types.str;
+              description = ''
+                The nickname of this Tahoe introducer.
+              '';
+            };
+            tub.port = mkOption {
+              default = 3458;
+              type = types.int;
+              description = ''
+                The port on which the introducer will listen.
+              '';
+            };
+            tub.location = mkOption {
+              default = null;
+              type = types.nullOr types.str;
+              description = ''
+                The external location that the introducer should listen on.
+
+                If specified, the port should be included.
+              '';
+            };
+            package = mkOption {
+              default = pkgs.tahoelafs;
+              defaultText = "pkgs.tahoelafs";
+              type = types.package;
+              example = literalExample "pkgs.tahoelafs";
+              description = ''
+                The package to use for the Tahoe LAFS daemon.
+              '';
+            };
+          };
+        });
         description = ''
           The Tahoe introducers.
         '';
-        options = {
-          nickname = mkOption {
-            type = types.str;
-            description = ''
-              The nickname of this Tahoe introducer.
-            '';
-          };
-          tub.port = mkOption {
-            default = 3458;
-            type = types.int;
-            description = ''
-              The port on which the introducer will listen.
-            '';
-          };
-          tub.location = mkOption {
-            default = null;
-            type = types.nullOr types.str;
-            description = ''
-              The external location that the introducer should listen on.
-
-              If specified, the port should be included.
-            '';
-          };
-          package = mkOption {
-            default = pkgs.tahoelafs;
-            defaultText = "pkgs.tahoelafs";
-            type = types.package;
-            example = literalExample "pkgs.tahoelafs";
-            description = ''
-              The package to use for the Tahoe LAFS daemon.
-            '';
-          };
-        };
       };
       nodes = mkOption {
         default = {};
-        type = types.loaOf types.optionSet;
+        type = with types; loaOf (submodule {
+          options = {
+            nickname = mkOption {
+              type = types.str;
+              description = ''
+                The nickname of this Tahoe node.
+              '';
+            };
+            tub.port = mkOption {
+              default = 3457;
+              type = types.int;
+              description = ''
+                The port on which the tub will listen.
+
+                This is the correct setting to tweak if you want Tahoe's storage
+                system to listen on a different port.
+              '';
+            };
+            tub.location = mkOption {
+              default = null;
+              type = types.nullOr types.str;
+              description = ''
+                The external location that the node should listen on.
+
+                This is the setting to tweak if there are multiple interfaces
+                and you want to alter which interface Tahoe is advertising.
+
+                If specified, the port should be included.
+              '';
+            };
+            web.port = mkOption {
+              default = 3456;
+              type = types.int;
+              description = ''
+                The port on which the Web server will listen.
+
+                This is the correct setting to tweak if you want Tahoe's WUI to
+                listen on a different port.
+              '';
+            };
+            client.introducer = mkOption {
+              default = null;
+              type = types.nullOr types.str;
+              description = ''
+                The furl for a Tahoe introducer node.
+
+                Like all furls, keep this safe and don't share it.
+              '';
+            };
+            client.helper = mkOption {
+              default = null;
+              type = types.nullOr types.str;
+              description = ''
+                The furl for a Tahoe helper node.
+
+                Like all furls, keep this safe and don't share it.
+              '';
+            };
+            client.shares.needed = mkOption {
+              default = 3;
+              type = types.int;
+              description = ''
+                The number of shares required to reconstitute a file.
+              '';
+            };
+            client.shares.happy = mkOption {
+              default = 7;
+              type = types.int;
+              description = ''
+                The number of distinct storage nodes required to store
+                a file.
+              '';
+            };
+            client.shares.total = mkOption {
+              default = 10;
+              type = types.int;
+              description = ''
+                The number of shares required to store a file.
+              '';
+            };
+            storage.enable = mkEnableOption "storage service";
+            storage.reservedSpace = mkOption {
+              default = "1G";
+              type = types.str;
+              description = ''
+                The amount of filesystem space to not use for storage.
+              '';
+            };
+            helper.enable = mkEnableOption "helper service";
+            package = mkOption {
+              default = pkgs.tahoelafs;
+              defaultText = "pkgs.tahoelafs";
+              type = types.package;
+              example = literalExample "pkgs.tahoelafs";
+              description = ''
+                The package to use for the Tahoe LAFS daemon.
+              '';
+            };
+          };
+        });
         description = ''
           The Tahoe nodes.
         '';
-        options = {
-          nickname = mkOption {
-            type = types.str;
-            description = ''
-              The nickname of this Tahoe node.
-            '';
-          };
-          tub.port = mkOption {
-            default = 3457;
-            type = types.int;
-            description = ''
-              The port on which the tub will listen.
-
-              This is the correct setting to tweak if you want Tahoe's storage
-              system to listen on a different port.
-            '';
-          };
-          tub.location = mkOption {
-            default = null;
-            type = types.nullOr types.str;
-            description = ''
-              The external location that the node should listen on.
-
-              This is the setting to tweak if there are multiple interfaces
-              and you want to alter which interface Tahoe is advertising.
-
-              If specified, the port should be included.
-            '';
-          };
-          web.port = mkOption {
-            default = 3456;
-            type = types.int;
-            description = ''
-              The port on which the Web server will listen.
-
-              This is the correct setting to tweak if you want Tahoe's WUI to
-              listen on a different port.
-            '';
-          };
-          client.introducer = mkOption {
-            default = null;
-            type = types.nullOr types.str;
-            description = ''
-              The furl for a Tahoe introducer node.
-
-              Like all furls, keep this safe and don't share it.
-            '';
-          };
-          client.helper = mkOption {
-            default = null;
-            type = types.nullOr types.str;
-            description = ''
-              The furl for a Tahoe helper node.
-
-              Like all furls, keep this safe and don't share it.
-            '';
-          };
-          client.shares.needed = mkOption {
-            default = 3;
-            type = types.int;
-            description = ''
-              The number of shares required to reconstitute a file.
-            '';
-          };
-          client.shares.happy = mkOption {
-            default = 7;
-            type = types.int;
-            description = ''
-              The number of distinct storage nodes required to store
-              a file.
-            '';
-          };
-          client.shares.total = mkOption {
-            default = 10;
-            type = types.int;
-            description = ''
-              The number of shares required to store a file.
-            '';
-          };
-          storage.enable = mkEnableOption "storage service";
-          storage.reservedSpace = mkOption {
-            default = "1G";
-            type = types.str;
-            description = ''
-              The amount of filesystem space to not use for storage.
-            '';
-          };
-          helper.enable = mkEnableOption "helper service";
-          package = mkOption {
-            default = pkgs.tahoelafs;
-            defaultText = "pkgs.tahoelafs";
-            type = types.package;
-            example = literalExample "pkgs.tahoelafs";
-            description = ''
-              The package to use for the Tahoe LAFS daemon.
-            '';
-          };
-        };
       };
     };
     config = mkMerge [

nixos/modules/services/networking/ddclient.nix

@@ -7,7 +7,7 @@ let
 
   stateDir = "/var/spool/ddclient";
   ddclientUser = "ddclient";
-  ddclientFlags = "-foreground -verbose -noquiet -file /etc/ddclient.conf";
+  ddclientFlags = "-foreground -verbose -noquiet -file ${config.services.ddclient.configFile}";
   ddclientPIDFile = "${stateDir}/ddclient.pid";
 
 in
@@ -52,6 +52,17 @@ in
         '';
       };
 
+      configFile = mkOption {
+        default = "/etc/ddclient.conf";
+        type = path;
+        description = ''
+          Path to configuration file.
+          When set to the default '/etc/ddclient.conf' it will be populated with the various other options in this module. When it is changed (for example: '/root/nixos/secrets/ddclient.conf') the file read directly to configure ddclient. This is a source of impurity.
+          The purpose of this is to avoid placing secrets into the store.
+        '';
+        example = "/root/nixos/secrets/ddclient.conf";
+      };
+
       protocol = mkOption {
         default = "dyndns2";
         type = str;
@@ -88,7 +99,7 @@ in
         default = "web, web=checkip.dyndns.com/, web-skip='Current IP Address: '";
         type = str;
         description = ''
-          Method to determine the IP address to send to the dymanic DNS provider.
+          Method to determine the IP address to send to the dynamic DNS provider.
         '';
       };
     };
@@ -109,9 +120,11 @@ in
     };
 
     environment.etc."ddclient.conf" = {
+      enable = config.services.ddclient.configFile == /etc/ddclient.conf;
       uid = config.ids.uids.ddclient;
       mode = "0600";
       text = ''
+        # This file can be used as a template for configFile or is automatically generated by Nix options.
         daemon=600
         cache=${stateDir}/ddclient.cache
         pid=${ddclientPIDFile}

nixos/modules/services/networking/flannel.nix

@@ -0,0 +1,153 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.flannel;
+
+  networkConfig = filterAttrs (n: v: v != null) {
+    Network = cfg.network;
+    SubnetLen = cfg.subnetLen;
+    SubnetMin = cfg.subnetMin;
+    SubnetMax = cfg.subnetMax;
+    Backend = cfg.backend;
+  };
+in {
+  options.services.flannel = {
+    enable = mkEnableOption "flannel";
+
+    package = mkOption {
+      description = "Package to use for flannel";
+      type = types.package;
+      default = pkgs.flannel.bin;
+    };
+
+    publicIp = mkOption {
+      description = ''
+        IP accessible by other nodes for inter-host communication.
+        Defaults to the IP of the interface being used for communication.
+      '';
+      type = types.nullOr types.str;
+      default = null;
+    };
+
+    iface = mkOption {
+      description = ''
+        Interface to use (IP or name) for inter-host communication.
+        Defaults to the interface for the default route on the machine.
+      '';
+      type = types.nullOr types.str;
+      default = null;
+    };
+
+    etcd = {
+      endpoints = mkOption {
+        description = "Etcd endpoints";
+        type = types.listOf types.str;
+        default = ["http://127.0.0.1:2379"];
+      };
+
+      prefix = mkOption {
+        description = "Etcd key prefix";
+        type = types.str;
+        default = "/coreos.com/network";
+      };
+
+      caFile = mkOption {
+        description = "Etcd certificate authority file";
+        type = types.nullOr types.path;
+        default = null;
+      };
+
+      certFile = mkOption {
+        description = "Etcd cert file";
+        type = types.nullOr types.path;
+        default = null;
+      };
+
+      keyFile = mkOption {
+        description = "Etcd key file";
+        type = types.nullOr types.path;
+        default = null;
+      };
+    };
+
+    network = mkOption {
+      description = " IPv4 network in CIDR format to use for the entire flannel network.";
+      type = types.str;
+    };
+
+    subnetLen = mkOption {
+      description = ''
+        The size of the subnet allocated to each host. Defaults to 24 (i.e. /24)
+        unless the Network was configured to be smaller than a /24 in which case
+        it is one less than the network.
+      '';
+      type = types.int;
+      default = 24;
+    };
+
+    subnetMin = mkOption {
+      description = ''
+        The beginning of IP range which the subnet allocation should start with.
+        Defaults to the first subnet of Network.
+      '';
+      type = types.nullOr types.str;
+      default = null;
+    };
+
+    subnetMax = mkOption {
+      description = ''
+        The end of IP range which the subnet allocation should start with.
+        Defaults to the last subnet of Network.
+      '';
+      type = types.nullOr types.str;
+      default = null;
+    };
+
+    backend = mkOption {
+      description = "Type of backend to use and specific configurations for that backend.";
+      type = types.attrs;
+      default = {
+        Type = "vxlan";
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.flannel = {
+      description = "Flannel Service";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+      environment = {
+        FLANNELD_PUBLIC_IP = cfg.publicIp;
+        FLANNELD_ETCD_ENDPOINTS = concatStringsSep "," cfg.etcd.endpoints;
+        FLANNELD_ETCD_KEYFILE = cfg.etcd.keyFile;
+        FLANNELD_ETCD_CERTFILE = cfg.etcd.certFile;
+        FLANNELD_ETCD_CAFILE = cfg.etcd.caFile;
+        FLANNELD_IFACE = cfg.iface;
+        ETCDCTL_CERT_FILE = cfg.etcd.certFile;
+        ETCDCTL_KEY_FILE = cfg.etcd.keyFile;
+        ETCDCTL_CA_FILE = cfg.etcd.caFile;
+        ETCDCTL_PEERS = concatStringsSep "," cfg.etcd.endpoints;
+      };
+      preStart = ''
+        echo "setting network configuration"
+        until ${pkgs.etcdctl.bin}/bin/etcdctl set /coreos.com/network/config '${builtins.toJSON networkConfig}'
+        do
+          echo "setting network configuration, retry"
+          sleep 1
+        done
+      '';
+      postStart = ''
+        while [ ! -f /run/flannel/subnet.env ]
+        do
+          sleep 1
+        done
+      '';
+      serviceConfig.ExecStart = "${cfg.package}/bin/flannel";
+    };
+
+    services.etcd.enable = mkDefault cfg.etcd.endpoints == ["http://127.0.0.1:2379"];
+  };
+}

nixos/modules/services/networking/i2pd.nix

@@ -187,44 +187,43 @@ in
 
       outTunnels = mkOption {
         default = {};
-        type = with types; loaOf optionSet;
+        type = with types; loaOf (submodule ( 
+          { name, config, ... }: {
+            options = commonTunOpts name;
+            config = {
+              name = mkDefault name;
+            };
+          }
+        ));
         description = ''
           Connect to someone as a client and establish a local accept endpoint
         '';
-        options = [ ({ name, config, ... }: {
-          options = commonTunOpts name;
-          config = {
-            name = mkDefault name;
-          };
-        }) ];
       };
 
       inTunnels = mkOption {
         default = {};
-        type = with types; loaOf optionSet;
+        type = with types; loaOf (submodule (
+          { name, config, ... }: {
+            options = {
+              inPort = mkOption {
+                type = types.int;
+                default = 0;
+                description = "Service port. Default to the tunnel's listen port.";
+              };
+              accessList = mkOption {
+                type = with types; listOf str;
+                default = [];
+                description = "I2P nodes that are allowed to connect to this service.";
+              };
+            } // commonTunOpts name;
+            config = {
+              name = mkDefault name;
+            };
+          }
+        ));
         description = ''
           Serve something on I2P network at port and delegate requests to address inPort.
         '';
-        options = [ ({ name, config, ... }: {
-
-          options = {
-            inPort = mkOption {
-              type = types.int;
-              default = 0;
-              description = "Service port. Default to the tunnel's listen port.";
-            };
-            accessList = mkOption {
-              type = with types; listOf str;
-              default = [];
-              description = "I2P nodes that are allowed to connect to this service.";
-            };
-          } // commonTunOpts name;
-
-          config = {
-            name = mkDefault name;
-          };
-
-        }) ];
       };
     };
   };

nixos/modules/services/networking/nat.nix

@@ -122,23 +122,23 @@ in
     };
 
     networking.nat.forwardPorts = mkOption {
-      type = types.listOf types.optionSet;
+      type = with types; listOf (submodule {
+        options = {
+          sourcePort = mkOption {
+            type = types.int;
+            example = 8080;
+            description = "Source port of the external interface";
+          };
+
+          destination = mkOption {
+            type = types.str;
+            example = "10.0.0.1:80";
+            description = "Forward tcp connection to destination ip:port";
+          };
+        };
+      });
       default = [];
       example = [ { sourcePort = 8080; destination = "10.0.0.1:80"; } ];
-      options = {
-        sourcePort = mkOption {
-          type = types.int;
-          example = 8080;
-          description = "Source port of the external interface";
-        };
-
-        destination = mkOption {
-          type = types.str;
-          example = "10.0.0.1:80";
-          description = "Forward tcp connection to destination ip:port";
-        };
-      };
-
       description =
         ''
           List of forwarded ports from the external interface to

nixos/modules/services/networking/openvpn.nix

@@ -116,52 +116,54 @@ in
         attribute name.
       '';
 
-      type = types.attrsOf types.optionSet;
+      type = with types; attrsOf (submodule {
 
-      options = {
+        options = {
+
+          config = mkOption {
+            type = types.lines;
+            description = ''
+              Configuration of this OpenVPN instance.  See
+              <citerefentry><refentrytitle>openvpn</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+              for details.
+            '';
+          };
+
+          up = mkOption {
+            default = "";
+            type = types.lines;
+            description = ''
+              Shell commands executed when the instance is starting.
+            '';
+          };
+
+          down = mkOption {
+            default = "";
+            type = types.lines;
+            description = ''
+              Shell commands executed when the instance is shutting down.
+            '';
+          };
+
+          autoStart = mkOption {
+            default = true;
+            type = types.bool;
+            description = "Whether this OpenVPN instance should be started automatically.";
+          };
+
+          updateResolvConf = mkOption {
+            default = false;
+            type = types.bool;
+            description = ''
+              Use the script from the update-resolv-conf package to automatically
+              update resolv.conf with the DNS information provided by openvpn. The
+              script will be run after the "up" commands and before the "down" commands.
+            '';
+          };
 
-        config = mkOption {
-          type = types.lines;
-          description = ''
-            Configuration of this OpenVPN instance.  See
-            <citerefentry><refentrytitle>openvpn</refentrytitle><manvolnum>8</manvolnum></citerefentry>
-            for details.
-          '';
         };
 
-        up = mkOption {
+      });
-          default = "";
-          type = types.lines;
-          description = ''
-            Shell commands executed when the instance is starting.
-          '';
-        };
-
-        down = mkOption {
-          default = "";
-          type = types.lines;
-          description = ''
-            Shell commands executed when the instance is shutting down.
-          '';
-        };
-
-        autoStart = mkOption {
-          default = true;
-          type = types.bool;
-          description = "Whether this OpenVPN instance should be started automatically.";
-        };
-
-        updateResolvConf = mkOption {
-          default = false;
-          type = types.bool;
-          description = ''
-            Use the script from the update-resolv-conf package to automatically
-            update resolv.conf with the DNS information provided by openvpn. The
-            script will be run after the "up" commands and before the "down" commands.
-          '';
-        };
-
-      };
 
     };
 

nixos/modules/services/networking/powerdns.nix

@@ -35,7 +35,6 @@ in {
         Restart="on-failure";
         RestartSec="1";
         StartLimitInterval="0";
-        PrivateTmp=true;
         PrivateDevices=true;
         CapabilityBoundingSet="CAP_CHOWN CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_CHROOT";
         NoNewPrivileges=true;

nixos/modules/services/networking/prosody.nix

@@ -164,7 +164,7 @@ in
 
         description = "Define the virtual hosts";
 
-        type = types.loaOf types.optionSet;
+        type = with types; loaOf (submodule vHostOpts);
 
         example = {
           myhost = {
@@ -180,7 +180,6 @@ in
           };
         };
 
-        options = [ vHostOpts ];
       };
 
       ssl = mkOption {

nixos/modules/services/networking/ssh/sshd.nix

@@ -129,7 +129,24 @@ in
       };
 
       listenAddresses = mkOption {
-        type = types.listOf types.optionSet;
+        type = with types; listOf (submodule {
+          options = {
+            addr = mkOption {
+              type = types.nullOr types.str;
+              default = null;
+              description = ''
+                Host, IPv4 or IPv6 address to listen to.
+              '';
+            };
+            port = mkOption {
+              type = types.nullOr types.int;
+              default = null;
+              description = ''
+                Port to listen to.
+              '';
+            };
+          };
+        });
         default = [];
         example = [ { addr = "192.168.3.1"; port = 22; } { addr = "0.0.0.0"; port = 64022; } ];
         description = ''
@@ -140,22 +157,6 @@ in
           NOTE: setting this option won't automatically enable given ports
           in firewall configuration.
         '';
-        options = {
-          addr = mkOption {
-            type = types.nullOr types.str;
-            default = null;
-            description = ''
-              Host, IPv4 or IPv6 address to listen to.
-            '';
-          };
-          port = mkOption {
-            type = types.nullOr types.int;
-            default = null;
-            description = ''
-              Port to listen to.
-            '';
-          };
-        };
       };
 
       passwordAuthentication = mkOption {

nixos/modules/services/networking/supplicant.nix

@@ -34,7 +34,7 @@ let
       '';
     in
       { description = "Supplicant ${iface}${optionalString (iface=="WLAN"||iface=="LAN") " %I"}";
-        wantedBy = [ "network.target" ];
+        wantedBy = [ "network.target" ] ++ deps;
         bindsTo = deps;
         after = deps;
         before = [ "network.target" ];
@@ -75,7 +75,107 @@ in
   options = {
 
     networking.supplicant = mkOption {
-      type = types.attrsOf types.optionSet;
+      type = with types; attrsOf (submodule {
+        options = {
+  
+          configFile = {
+  
+            path = mkOption {
+              type = types.path;
+              example = literalExample "/etc/wpa_supplicant.conf";
+              description = ''
+                External <literal>wpa_supplicant.conf</literal> configuration file.
+                The configuration options defined declaratively within <literal>networking.supplicant</literal> have
+                precedence over options defined in <literal>configFile</literal>.
+              '';
+            };
+  
+            writable = mkOption {
+              type = types.bool;
+              default = false;
+              description = ''
+                Whether the configuration file at <literal>configFile.path</literal> should be written to by
+                <literal>wpa_supplicant</literal>.
+              '';
+            };
+  
+          };
+  
+          extraConf = mkOption {
+            type = types.lines;
+            default = "";
+            example = ''
+              ap_scan=1
+              device_name=My-NixOS-Device
+              device_type=1-0050F204-1
+              driver_param=use_p2p_group_interface=1
+              disable_scan_offload=1
+              p2p_listen_reg_class=81
+              p2p_listen_channel=1
+              p2p_oper_reg_class=81
+              p2p_oper_channel=1
+              manufacturer=NixOS
+              model_name=NixOS_Unstable
+              model_number=2015
+            '';
+            description = ''
+              Configuration options for <literal>wpa_supplicant.conf</literal>.
+              Options defined here have precedence over options in <literal>configFile</literal>.
+              NOTE: Do not write sensitive data into <literal>extraConf</literal> as it will
+              be world-readable in the <literal>nix-store</literal>. For sensitive information
+              use the <literal>configFile</literal> instead.
+            '';
+          };
+  
+          extraCmdArgs = mkOption {
+            type = types.str;
+            default = "";
+            example = "-e/var/run/wpa_supplicant/entropy.bin";
+            description =
+              "Command line arguments to add when executing <literal>wpa_supplicant</literal>.";
+          };
+  
+          driver = mkOption {
+            type = types.nullOr types.str;
+            default = "nl80211,wext";
+            description = "Force a specific wpa_supplicant driver.";
+          };
+  
+          bridge = mkOption {
+            type = types.str;
+            default = "";
+            description = "Name of the bridge interface that wpa_supplicant should listen at.";
+          };
+  
+          userControlled = {
+  
+            enable = mkOption {
+              type = types.bool;
+              default = false;
+              description = ''
+                Allow normal users to control wpa_supplicant through wpa_gui or wpa_cli.
+                This is useful for laptop users that switch networks a lot and don't want
+                to depend on a large package such as NetworkManager just to pick nearby
+                access points.
+              '';
+            };
+  
+            socketDir = mkOption {
+              type = types.str;
+              default = "/var/run/wpa_supplicant";
+              description = "Directory of sockets for controlling wpa_supplicant.";
+            };
+  
+            group = mkOption {
+              type = types.str;
+              default = "wheel";
+              example = "network";
+              description = "Members of this group can control wpa_supplicant.";
+            };
+  
+          };
+        };
+      });
 
       default = { };
 
@@ -109,107 +209,6 @@ in
         service that can be accessed through <literal>D-Bus</literal>.
       '';
 
-      options = {
-
-        configFile = {
-
-          path = mkOption {
-            type = types.path;
-            example = literalExample "/etc/wpa_supplicant.conf";
-            description = ''
-              External <literal>wpa_supplicant.conf</literal> configuration file.
-              The configuration options defined declaratively within <literal>networking.supplicant</literal> have
-              precedence over options defined in <literal>configFile</literal>.
-            '';
-          };
-
-          writable = mkOption {
-            type = types.bool;
-            default = false;
-            description = ''
-              Whether the configuration file at <literal>configFile.path</literal> should be written to by
-              <literal>wpa_supplicant</literal>.
-            '';
-          };
-
-        };
-
-        extraConf = mkOption {
-          type = types.lines;
-          default = "";
-          example = ''
-            ap_scan=1
-            device_name=My-NixOS-Device
-            device_type=1-0050F204-1
-            driver_param=use_p2p_group_interface=1
-            disable_scan_offload=1
-            p2p_listen_reg_class=81
-            p2p_listen_channel=1
-            p2p_oper_reg_class=81
-            p2p_oper_channel=1
-            manufacturer=NixOS
-            model_name=NixOS_Unstable
-            model_number=2015
-          '';
-          description = ''
-            Configuration options for <literal>wpa_supplicant.conf</literal>.
-            Options defined here have precedence over options in <literal>configFile</literal>.
-            NOTE: Do not write sensitive data into <literal>extraConf</literal> as it will
-            be world-readable in the <literal>nix-store</literal>. For sensitive information
-            use the <literal>configFile</literal> instead.
-          '';
-        };
-
-        extraCmdArgs = mkOption {
-          type = types.str;
-          default = "";
-          example = "-e/var/run/wpa_supplicant/entropy.bin";
-          description =
-            "Command line arguments to add when executing <literal>wpa_supplicant</literal>.";
-        };
-
-        driver = mkOption {
-          type = types.nullOr types.str;
-          default = "nl80211,wext";
-          description = "Force a specific wpa_supplicant driver.";
-        };
-
-        bridge = mkOption {
-          type = types.str;
-          default = "";
-          description = "Name of the bridge interface that wpa_supplicant should listen at.";
-        };
-
-        userControlled = {
-
-          enable = mkOption {
-            type = types.bool;
-            default = false;
-            description = ''
-              Allow normal users to control wpa_supplicant through wpa_gui or wpa_cli.
-              This is useful for laptop users that switch networks a lot and don't want
-              to depend on a large package such as NetworkManager just to pick nearby
-              access points.
-            '';
-          };
-
-          socketDir = mkOption {
-            type = types.str;
-            default = "/var/run/wpa_supplicant";
-            description = "Directory of sockets for controlling wpa_supplicant.";
-          };
-
-          group = mkOption {
-            type = types.str;
-            default = "wheel";
-            example = "network";
-            description = "Members of this group can control wpa_supplicant.";
-          };
-
-        };
-
-      };
-
     };
 
   };

nixos/modules/services/networking/tinc.nix

@@ -18,94 +18,96 @@ in
 
       networks = mkOption {
         default = { };
-        type = types.loaOf types.optionSet;
+        type = with types; loaOf (submodule {
+          options = {
+
+            extraConfig = mkOption {
+              default = "";
+              type = types.lines;
+              description = ''
+                Extra lines to add to the tinc service configuration file.
+              '';
+            };
+
+            name = mkOption {
+              default = null;
+              type = types.nullOr types.str;
+              description = ''
+                The name of the node which is used as an identifier when communicating
+                with the remote nodes in the mesh. If null then the hostname of the system
+                is used.
+              '';
+            };
+
+            ed25519PrivateKeyFile = mkOption {
+              default = null;
+              type = types.nullOr types.path;
+              description = ''
+                Path of the private ed25519 keyfile.
+              '';
+            };
+
+            debugLevel = mkOption {
+              default = 0;
+              type = types.addCheck types.int (l: l >= 0 && l <= 5);
+              description = ''
+                The amount of debugging information to add to the log. 0 means little
+                logging while 5 is the most logging. <command>man tincd</command> for
+                more details.
+              '';
+            };
+
+            hosts = mkOption {
+              default = { };
+              type = types.loaOf types.lines;
+              description = ''
+                The name of the host in the network as well as the configuration for that host.
+                This name should only contain alphanumerics and underscores.
+              '';
+            };
+
+            interfaceType = mkOption {
+              default = "tun";
+              type = types.addCheck types.str (n: n == "tun" || n == "tap");
+              description = ''
+                The type of virtual interface used for the network connection
+              '';
+            };
+
+            listenAddress = mkOption {
+              default = null;
+              type = types.nullOr types.str;
+              description = ''
+                The ip adress to bind to.
+              '';
+            };
+
+            package = mkOption {
+              type = types.package;
+              default = pkgs.tinc_pre;
+              defaultText = "pkgs.tinc_pre";
+              description = ''
+                The package to use for the tinc daemon's binary.
+              '';
+            };
+
+            chroot = mkOption {
+              default = true;
+              type = types.bool;
+              description = ''
+                Change process root directory to the directory where the config file is located (/etc/tinc/netname/), for added security.
+                The chroot is performed after all the initialization is done, after writing pid files and opening network sockets.
+
+                Note that tinc can't run scripts anymore (such as tinc-down or host-up), unless it is setup to be runnable inside chroot environment.
+              '';
+            };
+          };
+        });
+
         description = ''
           Defines the tinc networks which will be started.
           Each network invokes a different daemon.
         '';
-        options = {
-
-          extraConfig = mkOption {
-            default = "";
-            type = types.lines;
-            description = ''
-              Extra lines to add to the tinc service configuration file.
-            '';
-          };
-
-          name = mkOption {
-            default = null;
-            type = types.nullOr types.str;
-            description = ''
-              The name of the node which is used as an identifier when communicating
-              with the remote nodes in the mesh. If null then the hostname of the system
-              is used.
-            '';
-          };
-
-          ed25519PrivateKeyFile = mkOption {
-            default = null;
-            type = types.nullOr types.path;
-            description = ''
-              Path of the private ed25519 keyfile.
-            '';
-          };
-
-          debugLevel = mkOption {
-            default = 0;
-            type = types.addCheck types.int (l: l >= 0 && l <= 5);
-            description = ''
-              The amount of debugging information to add to the log. 0 means little
-              logging while 5 is the most logging. <command>man tincd</command> for
-              more details.
-            '';
-          };
-
-          hosts = mkOption {
-            default = { };
-            type = types.loaOf types.lines;
-            description = ''
-              The name of the host in the network as well as the configuration for that host.
-              This name should only contain alphanumerics and underscores.
-            '';
-          };
-
-          interfaceType = mkOption {
-            default = "tun";
-            type = types.addCheck types.str (n: n == "tun" || n == "tap");
-            description = ''
-              The type of virtual interface used for the network connection
-            '';
-          };
-
-          listenAddress = mkOption {
-            default = null;
-            type = types.nullOr types.str;
-            description = ''
-              The ip adress to bind to.
-            '';
-          };
-
-          package = mkOption {
-            type = types.package;
-            default = pkgs.tinc_pre;
-            defaultText = "pkgs.tinc_pre";
-            description = ''
-              The package to use for the tinc daemon's binary.
-            '';
-          };
-
-          chroot = mkOption {
-            default = true;
-            type = types.bool;
-            description = ''
-              Change process root directory to the directory where the config file is located (/etc/tinc/netname/), for added security.
-              The chroot is performed after all the initialization is done, after writing pid files and opening network sockets.
-
-              Note that tinc can't run scripts anymore (such as tinc-down or host-up), unless it is setup to be runnable inside chroot environment.
-            '';
-          };
-        };
       };
     };
 

nixos/modules/services/networking/xinetd.nix

@@ -65,71 +65,73 @@ in
         A list of services provided by xinetd.
       '';
 
-      type = types.listOf types.optionSet;
+      type = with types; listOf (submodule ({
 
-      options = {
+        options = {
+
+          name = mkOption {
+            type = types.string;
+            example = "login";
+            description = "Name of the service.";
+          };
+
+          protocol = mkOption {
+            type = types.string;
+            default = "tcp";
+            description =
+              "Protocol of the service.  Usually <literal>tcp</literal> or <literal>udp</literal>.";
+          };
+
+          port = mkOption {
+            type = types.int;
+            default = 0;
+            example = 123;
+            description = "Port number of the service.";
+          };
+
+          user = mkOption {
+            type = types.string;
+            default = "nobody";
+            description = "User account for the service";
+          };
+
+          server = mkOption {
+            type = types.string;
+            example = "/foo/bin/ftpd";
+            description = "Path of the program that implements the service.";
+          };
+
+          serverArgs = mkOption {
+            type = types.string;
+            default = "";
+            description = "Command-line arguments for the server program.";
+          };
+
+          flags = mkOption {
+            type = types.string;
+            default = "";
+            description = "";
+          };
+
+          unlisted = mkOption {
+            type = types.bool;
+            default = false;
+            description = ''
+              Whether this server is listed in
+              <filename>/etc/services</filename>.  If so, the port
+              number can be omitted.
+            '';
+          };
+
+          extraConfig = mkOption {
+            type = types.string;
+            default = "";
+            description = "Extra configuration-lines added to the section of the service.";
+          };
 
-        name = mkOption {
-          type = types.string;
-          example = "login";
-          description = "Name of the service.";
         };
 
-        protocol = mkOption {
+      }));
-          type = types.string;
-          default = "tcp";
-          description =
-            "Protocol of the service.  Usually <literal>tcp</literal> or <literal>udp</literal>.";
-        };
-
-        port = mkOption {
-          type = types.int;
-          default = 0;
-          example = 123;
-          description = "Port number of the service.";
-        };
-
-        user = mkOption {
-          type = types.string;
-          default = "nobody";
-          description = "User account for the service";
-        };
-
-        server = mkOption {
-          type = types.string;
-          example = "/foo/bin/ftpd";
-          description = "Path of the program that implements the service.";
-        };
-
-        serverArgs = mkOption {
-          type = types.string;
-          default = "";
-          description = "Command-line arguments for the server program.";
-        };
-
-        flags = mkOption {
-          type = types.string;
-          default = "";
-          description = "";
-        };
-
-        unlisted = mkOption {
-          type = types.bool;
-          default = false;
-          description = ''
-            Whether this server is listed in
-            <filename>/etc/services</filename>.  If so, the port
-            number can be omitted.
-          '';
-        };
-
-        extraConfig = mkOption {
-          type = types.string;
-          default = "";
-          description = "Extra configuration-lines added to the section of the service.";
-        };
-
-      };
 
     };
 

nixos/modules/services/system/dbus.nix

@@ -8,7 +8,7 @@ let
 
   cfg = config.services.dbus;
 
-  homeDir = "/var/run/dbus";
+  homeDir = "/run/dbus";
 
   systemExtraxml = concatStrings (flip concatMap cfg.packages (d: [
     "<servicedir>${d}/share/dbus-1/system-services</servicedir>"
@@ -20,6 +20,8 @@ let
     "<includedir>${d}/etc/dbus-1/session.d</includedir>"
   ]));
 
+  daemonArgs = "--address=systemd: --nofork --nopidfile --systemd-activation";
+
   configDir = pkgs.runCommand "dbus-conf"
     { preferLocalBuild = true;
       allowSubstitutes = false;
@@ -27,6 +29,14 @@ let
     ''
       mkdir -p $out
 
+      cp ${pkgs.dbus.out}/share/dbus-1/{system,session}.conf $out
+
+      # avoid circular includes
+      sed -ri 's@(<include ignore_missing="yes">/etc/dbus-1/(system|session)\.conf</include>)@<!-- \1 -->@g' $out/{system,session}.conf
+
+      # include by full path
+      sed -ri "s@/etc/dbus-1/(system|session)-@$out/\1-@" $out/{system,session}.conf
+
       sed '${./dbus-system-local.conf.in}' \
         -e 's,@servicehelper@,${config.security.wrapperDir}/dbus-daemon-launch-helper,g' \
         -e 's,@extra@,${systemExtraxml},' \
@@ -72,11 +82,16 @@ in
         '';
       };
 
+      socketActivated = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Make the user instance socket activated.
+        '';
+      };
     };
-
   };
 
-
   ###### implementation
 
   config = mkIf cfg.enable {
@@ -114,13 +129,29 @@ in
       config.system.path
     ];
 
-    # Don't restart dbus-daemon. Bad things tend to happen if we do.
+    systemd.services.dbus = {
-    systemd.services.dbus.reloadIfChanged = true;
+      # Don't restart dbus-daemon. Bad things tend to happen if we do.
+      reloadIfChanged = true;
+      restartTriggers = [ configDir ];
+      serviceConfig.ExecStart = [
+        ""
+        "${lib.getBin pkgs.dbus}/bin/dbus-daemon --config-file=${configDir}/system.conf ${daemonArgs}"
+      ];
+    };
 
-    systemd.services.dbus.restartTriggers = [ configDir ];
+    systemd.user = {
+      services.dbus = {
+        # Don't restart dbus-daemon. Bad things tend to happen if we do.
+        reloadIfChanged = true;
+        restartTriggers = [ configDir ];
+        serviceConfig.ExecStart = [
+          ""
+          "${lib.getBin pkgs.dbus}/bin/dbus-daemon --config-file=${configDir}/session.conf ${daemonArgs}"
+        ];
+      };
+      sockets.dbus.wantedBy = mkIf cfg.socketActivated [ "sockets.target" ];
+    };
 
     environment.pathsToLink = [ "/etc/dbus-1" "/share/dbus-1" ];
-
   };
-
 }

nixos/modules/services/web-servers/phpfpm/default.nix

@@ -42,7 +42,7 @@ in {
         default = "";
         description = ''
           Extra configuration that should be put in the global section of
-          the PHP FPM configuration file. Do not specify the options
+          the PHP-FPM configuration file. Do not specify the options
           <literal>pid</literal>, <literal>error_log</literal> or
           <literal>daemonize</literal> here, since they are generated by
           NixOS.
@@ -54,7 +54,7 @@ in {
         default = pkgs.php;
         defaultText = "pkgs.php";
         description = ''
-          The PHP package to use for running the FPM service.
+          The PHP package to use for running the PHP-FPM service.
         '';
       };
 
@@ -86,7 +86,7 @@ in {
           }
         '';
         description = ''
-          A mapping between PHP FPM pool names and their configurations.
+          A mapping between PHP-FPM pool names and their configurations.
           See the documentation on <literal>php-fpm.conf</literal> for
           details on configuration directives. If no pools are defined,
           the phpfpm service is disabled.
@@ -98,8 +98,24 @@ in {
           inherit lib;
         }));
         default = {};
+        example = literalExample ''
+         {
+           mypool = {
+             listen = "/path/to/unix/socket";
+             extraConfig = '''
+               user = nobody
+               pm = dynamic
+               pm.max_children = 75
+               pm.start_servers = 10
+               pm.min_spare_servers = 5
+               pm.max_spare_servers = 20
+               pm.max_requests = 500
+             ''';
+           }
+         }'';
         description = ''
-          If no pools are defined, the phpfpm service is disabled.
+          PHP-FPM pools. If no pools or poolConfigs are defined, the PHP-FPM
+          service is disabled.
         '';
       };
     };

nixos/modules/services/web-servers/winstone.nix

@@ -113,8 +113,7 @@ in {
   options = {
     services.winstone = mkOption {
       default = {};
-      type = types.attrsOf types.optionSet;
+      type = with types; attrsOf (submodule winstoneOpts);
-      options = [ winstoneOpts ];
       description = ''
         Defines independent Winstone services, each serving one WAR-file.
       '';

nixos/modules/services/web-servers/zope2.nix

@@ -74,7 +74,7 @@ in
 
     services.zope2.instances = mkOption {
       default = {};
-      type = types.loaOf types.optionSet;
+      type = with types; loaOf (submodule zope2Opts);
       example = literalExample ''
         {
           plone01 = {
@@ -96,7 +96,6 @@ in
         }
       '';
       description = "zope2 instances to be created automaticaly by the system.";
-      options = [ zope2Opts ];
     };
   };
 

nixos/modules/services/x11/desktop-managers/kde4.nix

@@ -14,7 +14,7 @@ let
   # files), segfault sometimes and consume significant resources.
   # They can be re-enabled in the KDE System Settings under "Desktop
   # Search".
-  nepomukConfig = pkgs.writeTextFile
+  disableNepomuk = pkgs.writeTextFile
     { name = "nepomuk-config";
       destination = "/share/config/nepomukserverrc";
       text =
@@ -70,6 +70,18 @@ in
         type = types.package;
         description = "Custom kde-workspace, used for NixOS rebranding.";
       };
+
+      enablePIM = mkOption {
+        type = types.bool;
+        default = true;
+        description = "Whether to enable PIM support. Note that enabling this pulls in Akonadi and MariaDB as dependencies.";
+      };
+
+      enableNepomuk = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Whether to enable Nepomuk (deprecated).";
+      };
     };
   };
 
@@ -138,7 +150,6 @@ in
 
           pkgs.kde4.kde_wallpapers # contains kdm's default background
           pkgs.kde4.oxygen_icons
-          pkgs.virtuoso # to enable Nepomuk to find Virtuoso
 
           # Starts KDE's Polkit authentication agent.
           pkgs.kde4.polkit_kde_agent
@@ -149,20 +160,26 @@ in
           xorg.xmessage # so that startkde can show error messages
           xorg.xset # used by startkde, non-essential
           xorg.xauth # used by kdesu
-          pkgs.shared_desktop_ontologies # used by nepomuk
+        ]
-          pkgs.strigi # used by nepomuk
+      ++ optionals cfg.enablePIM
+        [ pkgs.kde4.kdepim_runtime
           pkgs.kde4.akonadi
           pkgs.mysql # used by akonadi
-          pkgs.kde4.kdepim_runtime
         ]
-      ++ lib.optional config.hardware.pulseaudio.enable pkgs.kde4.kmix  # Perhaps this should always be enabled
+      ++ (if cfg.enableNepomuk then
-      ++ lib.optional config.hardware.bluetooth.enable pkgs.kde4.bluedevil
+        [ pkgs.shared_desktop_ontologies # used by nepomuk
-      ++ lib.optional config.networking.networkmanager.enable pkgs.kde4.plasma-nm
+          pkgs.strigi # used by nepomuk
-      ++ [ nepomukConfig ] ++ phononBackendPackages;
+          pkgs.virtuoso # to enable Nepomuk to find Virtuoso
+        ] else
+        [ disableNepomuk ])
+      ++ optional config.hardware.pulseaudio.enable pkgs.kde4.kmix  # Perhaps this should always be enabled
+      ++ optional config.hardware.bluetooth.enable pkgs.kde4.bluedevil
+      ++ optional config.networking.networkmanager.enable pkgs.kde4.plasma-nm
+      ++ phononBackendPackages;
 
     environment.pathsToLink = [ "/share" ];
 
-    environment.profileRelativeEnvVars = mkIf (lib.elem "gstreamer" cfg.phononBackends) {
+    environment.profileRelativeEnvVars = mkIf (elem "gstreamer" cfg.phononBackends) {
       GST_PLUGIN_SYSTEM_PATH = [ "/lib/gstreamer-0.10" ];
     };
 

nixos/modules/services/x11/display-managers/default.nix

@@ -134,13 +134,8 @@ let
         (*) echo "$0: Desktop manager '$desktopManager' not found.";;
       esac
 
-      # FIXME: gdbus should not be in glib.dev!
+      ${optionalString cfg.updateDbusEnvironment ''
-      ${optionalString (cfg.startDbusSession && cfg.updateDbusEnvironment) ''
+        ${lib.getBin pkgs.dbus}/bin/dbus-update-activation-environment --systemd --all
-        ${pkgs.glib.dev}/bin/gdbus call --session \
-          --dest org.freedesktop.DBus --object-path /org/freedesktop/DBus \
-          --method org.freedesktop.DBus.UpdateActivationEnvironment \
-          "{$(env | ${pkgs.gnused}/bin/sed "s/'/\\\\'/g; s/\([^=]*\)=\(.*\)/'\1':'\2'/" \
-                  | ${pkgs.coreutils}/bin/paste -sd,)}"
       ''}
 
       test -n "$waitPID" && wait "$waitPID"

nixos/modules/system/activation/switch-to-configuration.pl

@@ -213,33 +213,30 @@ while (my ($unit, $state) = each %{$activePrev}) {
                 elsif (!boolIsTrue($unitInfo->{'X-RestartIfChanged'} // "yes") || boolIsTrue($unitInfo->{'RefuseManualStop'} // "no") ) {
                     $unitsToSkip{$unit} = 1;
                 } else {
-                    # If this unit is socket-activated, then stop the
-                    # socket unit(s) as well, and restart the
-                    # socket(s) instead of the service.
-                    my $socketActivated = 0;
-                    if ($unit =~ /\.service$/) {
-                        my @sockets = split / /, ($unitInfo->{Sockets} // "");
-                        if (scalar @sockets == 0) {
-                            @sockets = ("$baseName.socket");
-                        }
-                        foreach my $socket (@sockets) {
-                            if (defined $activePrev->{$socket}) {
-                                $unitsToStop{$unit} = 1;
-                                $unitsToStart{$unit} = 1;
-                                recordUnit($startListFile, $socket);
-                                $socketActivated = 1;
-                            }
-                        }
-                    }
-
                     if (!boolIsTrue($unitInfo->{'X-StopIfChanged'} // "yes")) {
-
                         # This unit should be restarted instead of
                         # stopped and started.
                         $unitsToRestart{$unit} = 1;
                         recordUnit($restartListFile, $unit);
-
                     } else {
+                        # If this unit is socket-activated, then stop the
+                        # socket unit(s) as well, and restart the
+                        # socket(s) instead of the service.
+                        my $socketActivated = 0;
+                        if ($unit =~ /\.service$/) {
+                            my @sockets = split / /, ($unitInfo->{Sockets} // "");
+                            if (scalar @sockets == 0) {
+                                @sockets = ("$baseName.socket");
+                            }
+                            foreach my $socket (@sockets) {
+                                if (defined $activePrev->{$socket}) {
+                                    $unitsToStop{$socket} = 1;
+                                    $unitsToStart{$socket} = 1;
+                                    recordUnit($startListFile, $socket);
+                                    $socketActivated = 1;
+                                }
+                            }
+                        }
 
                         # If the unit is not socket-activated, record
                         # that this unit needs to be started below.
@@ -251,7 +248,6 @@ while (my ($unit, $state) = each %{$activePrev}) {
                         }
 
                         $unitsToStop{$unit} = 1;
-
                     }
                 }
             }

nixos/modules/system/boot/loader/grub/grub.nix

@@ -131,51 +131,51 @@ in
           to the respective devices corresponding to those partitions.
         '';
 
-        type = types.listOf types.optionSet;
+        type = with types; listOf (submodule {
+          options = {
 
-        options = {
+            path = mkOption {
+              example = "/boot1";
+              type = types.str;
+              description = ''
+                The path to the boot directory where GRUB will be written. Generally
+                this boot path should double as an EFI path.
+              '';
+            };
+
+            efiSysMountPoint = mkOption {
+              default = null;
+              example = "/boot1/efi";
+              type = types.nullOr types.str;
+              description = ''
+                The path to the efi system mount point. Usually this is the same
+                partition as the above path and can be left as null.
+              '';
+            };
+
+            efiBootloaderId = mkOption {
+              default = null;
+              example = "NixOS-fsid";
+              type = types.nullOr types.str;
+              description = ''
+                The id of the bootloader to store in efi nvram.
+                The default is to name it NixOS and append the path or efiSysMountPoint.
+                This is only used if <literal>boot.loader.efi.canTouchEfiVariables</literal> is true.
+              '';
+            };
+
+            devices = mkOption {
+              default = [ ];
+              example = [ "/dev/sda" "/dev/sdb" ];
+              type = types.listOf types.str;
+              description = ''
+                The path to the devices which will have the GRUB MBR written.
+                Note these are typically device paths and not paths to partitions.
+              '';
+            };
 
-          path = mkOption {
-            example = "/boot1";
-            type = types.str;
-            description = ''
-              The path to the boot directory where GRUB will be written. Generally
-              this boot path should double as an EFI path.
-            '';
           };
-
+        });
-          efiSysMountPoint = mkOption {
-            default = null;
-            example = "/boot1/efi";
-            type = types.nullOr types.str;
-            description = ''
-              The path to the efi system mount point. Usually this is the same
-              partition as the above path and can be left as null.
-            '';
-          };
-
-          efiBootloaderId = mkOption {
-            default = null;
-            example = "NixOS-fsid";
-            type = types.nullOr types.str;
-            description = ''
-              The id of the bootloader to store in efi nvram.
-              The default is to name it NixOS and append the path or efiSysMountPoint.
-              This is only used if <literal>boot.loader.efi.canTouchEfiVariables</literal> is true.
-            '';
-          };
-
-          devices = mkOption {
-            default = [ ];
-            example = [ "/dev/sda" "/dev/sdb" ];
-            type = types.listOf types.str;
-            description = ''
-              The path to the devices which will have the GRUB MBR written.
-              Note these are typically device paths and not paths to partitions.
-            '';
-          };
-
-        };
       };
 
       configurationName = mkOption {

nixos/modules/system/boot/luksroot.nix

@@ -236,165 +236,165 @@ in
         <filename>/dev/mapper/<replaceable>name</replaceable></filename>.
       '';
 
-      type = types.loaOf types.optionSet;
+      type = with types; loaOf (submodule (
+        { name, ... }: { options = {
 
-      options = { name, ... }: { options = {
+          name = mkOption {
-
+            visible = false;
-        name = mkOption {
+            default = name;
-          visible = false;
+            example = "luksroot";
-          default = name;
+            type = types.str;
-          example = "luksroot";
+            description = "Name of the unencrypted device in <filename>/dev/mapper</filename>.";
-          type = types.str;
-          description = "Name of the unencrypted device in <filename>/dev/mapper</filename>.";
-        };
-
-        device = mkOption {
-          example = "/dev/disk/by-uuid/430e9eff-d852-4f68-aa3b-2fa3599ebe08";
-          type = types.str;
-          description = "Path of the underlying encrypted block device.";
-        };
-
-        header = mkOption {
-          default = null;
-          example = "/root/header.img";
-          type = types.nullOr types.str;
-          description = ''
-            The name of the file or block device that
-            should be used as header for the encrypted device.
-          '';
-        };
-
-        keyFile = mkOption {
-          default = null;
-          example = "/dev/sdb1";
-          type = types.nullOr types.str;
-          description = ''
-            The name of the file (can be a raw device or a partition) that
-            should be used as the decryption key for the encrypted device. If
-            not specified, you will be prompted for a passphrase instead.
-          '';
-        };
-
-        keyFileSize = mkOption {
-          default = null;
-          example = 4096;
-          type = types.nullOr types.int;
-          description = ''
-            The size of the key file. Use this if only the beginning of the
-            key file should be used as a key (often the case if a raw device
-            or partition is used as key file). If not specified, the whole
-            <literal>keyFile</literal> will be used decryption, instead of just
-            the first <literal>keyFileSize</literal> bytes.
-          '';
-        };
-
-        # FIXME: get rid of this option.
-        preLVM = mkOption {
-          default = true;
-          type = types.bool;
-          description = "Whether the luksOpen will be attempted before LVM scan or after it.";
-        };
-
-        allowDiscards = mkOption {
-          default = false;
-          type = types.bool;
-          description = ''
-            Whether to allow TRIM requests to the underlying device. This option
-            has security implications; please read the LUKS documentation before
-            activating it.
-          '';
-        };
-
-        yubikey = mkOption {
-          default = null;
-          type = types.nullOr types.optionSet;
-          description = ''
-            The options to use for this LUKS device in Yubikey-PBA.
-            If null (the default), Yubikey-PBA will be disabled for this device.
-          '';
-
-          options = {
-            twoFactor = mkOption {
-              default = true;
-              type = types.bool;
-              description = "Whether to use a passphrase and a Yubikey (true), or only a Yubikey (false).";
-            };
-
-            slot = mkOption {
-              default = 2;
-              type = types.int;
-              description = "Which slot on the Yubikey to challenge.";
-            };
-
-            saltLength = mkOption {
-              default = 16;
-              type = types.int;
-              description = "Length of the new salt in byte (64 is the effective maximum).";
-            };
-
-            keyLength = mkOption {
-              default = 64;
-              type = types.int;
-              description = "Length of the LUKS slot key derived with PBKDF2 in byte.";
-            };
-
-            iterationStep = mkOption {
-              default = 0;
-              type = types.int;
-              description = "How much the iteration count for PBKDF2 is increased at each successful authentication.";
-            };
-
-            gracePeriod = mkOption {
-              default = 2;
-              type = types.int;
-              description = "Time in seconds to wait before attempting to find the Yubikey.";
-            };
-
-            ramfsMountPoint = mkOption {
-              default = "/crypt-ramfs";
-              type = types.str;
-              description = "Path where the ramfs used to update the LUKS key will be mounted during early boot.";
-            };
-
-            /* TODO: Add to the documentation of the current module:
-
-               Options related to the storing the salt.
-            */
-            storage = {
-              device = mkOption {
-                default = "/dev/sda1";
-                type = types.path;
-                description = ''
-                  An unencrypted device that will temporarily be mounted in stage-1.
-                  Must contain the current salt to create the challenge for this LUKS device.
-                '';
-              };
-
-              fsType = mkOption {
-                default = "vfat";
-                type = types.str;
-                description = "The filesystem of the unencrypted device.";
-              };
-
-              mountPoint = mkOption {
-                default = "/crypt-storage";
-                type = types.str;
-                description = "Path where the unencrypted device will be mounted during early boot.";
-              };
-
-              path = mkOption {
-                default = "/crypt-storage/default";
-                type = types.str;
-                description = ''
-                  Absolute path of the salt on the unencrypted device with
-                  that device's root directory as "/".
-                '';
-              };
-            };
           };
-        };
 
-      }; };
+          device = mkOption {
+            example = "/dev/disk/by-uuid/430e9eff-d852-4f68-aa3b-2fa3599ebe08";
+            type = types.str;
+            description = "Path of the underlying encrypted block device.";
+          };
+
+          header = mkOption {
+            default = null;
+            example = "/root/header.img";
+            type = types.nullOr types.str;
+            description = ''
+              The name of the file or block device that
+              should be used as header for the encrypted device.
+            '';
+          };
+
+          keyFile = mkOption {
+            default = null;
+            example = "/dev/sdb1";
+            type = types.nullOr types.str;
+            description = ''
+              The name of the file (can be a raw device or a partition) that
+              should be used as the decryption key for the encrypted device. If
+              not specified, you will be prompted for a passphrase instead.
+            '';
+          };
+
+          keyFileSize = mkOption {
+            default = null;
+            example = 4096;
+            type = types.nullOr types.int;
+            description = ''
+              The size of the key file. Use this if only the beginning of the
+              key file should be used as a key (often the case if a raw device
+              or partition is used as key file). If not specified, the whole
+              <literal>keyFile</literal> will be used decryption, instead of just
+              the first <literal>keyFileSize</literal> bytes.
+            '';
+          };
+
+          # FIXME: get rid of this option.
+          preLVM = mkOption {
+            default = true;
+            type = types.bool;
+            description = "Whether the luksOpen will be attempted before LVM scan or after it.";
+          };
+
+          allowDiscards = mkOption {
+            default = false;
+            type = types.bool;
+            description = ''
+              Whether to allow TRIM requests to the underlying device. This option
+              has security implications; please read the LUKS documentation before
+              activating it.
+            '';
+          };
+
+          yubikey = mkOption {
+            default = null;
+            description = ''
+              The options to use for this LUKS device in Yubikey-PBA.
+              If null (the default), Yubikey-PBA will be disabled for this device.
+            '';
+
+            type = with types; nullOr (submodule {
+              options = {
+                twoFactor = mkOption {
+                  default = true;
+                  type = types.bool;
+                  description = "Whether to use a passphrase and a Yubikey (true), or only a Yubikey (false).";
+                };
+
+                slot = mkOption {
+                  default = 2;
+                  type = types.int;
+                  description = "Which slot on the Yubikey to challenge.";
+                };
+
+                saltLength = mkOption {
+                  default = 16;
+                  type = types.int;
+                  description = "Length of the new salt in byte (64 is the effective maximum).";
+                };
+
+                keyLength = mkOption {
+                  default = 64;
+                  type = types.int;
+                  description = "Length of the LUKS slot key derived with PBKDF2 in byte.";
+                };
+
+                iterationStep = mkOption {
+                  default = 0;
+                  type = types.int;
+                  description = "How much the iteration count for PBKDF2 is increased at each successful authentication.";
+                };
+
+                gracePeriod = mkOption {
+                  default = 2;
+                  type = types.int;
+                  description = "Time in seconds to wait before attempting to find the Yubikey.";
+                };
+
+                ramfsMountPoint = mkOption {
+                  default = "/crypt-ramfs";
+                  type = types.str;
+                  description = "Path where the ramfs used to update the LUKS key will be mounted during early boot.";
+                };
+
+                /* TODO: Add to the documentation of the current module:
+
+                   Options related to the storing the salt.
+                */
+                storage = {
+                  device = mkOption {
+                    default = "/dev/sda1";
+                    type = types.path;
+                    description = ''
+                      An unencrypted device that will temporarily be mounted in stage-1.
+                      Must contain the current salt to create the challenge for this LUKS device.
+                    '';
+                  };
+
+                  fsType = mkOption {
+                    default = "vfat";
+                    type = types.str;
+                    description = "The filesystem of the unencrypted device.";
+                  };
+
+                  mountPoint = mkOption {
+                    default = "/crypt-storage";
+                    type = types.str;
+                    description = "Path where the unencrypted device will be mounted during early boot.";
+                  };
+
+                  path = mkOption {
+                    default = "/crypt-storage/default";
+                    type = types.str;
+                    description = ''
+                      Absolute path of the salt on the unencrypted device with
+                      that device's root directory as "/".
+                    '';
+                  };
+                };
+              };
+            });
+          };
+
+        }; }));
     };
 
     boot.initrd.luks.yubikeySupport = mkOption {

nixos/modules/system/boot/networkd.nix

@@ -471,8 +471,7 @@ let
 
     addresses = mkOption {
       default = [ ];
-      type = types.listOf types.optionSet;
+      type = with types; listOf (submodule [ addressOptions ]);
-      options = [ addressOptions ];
       description = ''
         A list of address sections to be added to the unit.  See
         <citerefentry><refentrytitle>systemd.network</refentrytitle>
@@ -482,8 +481,7 @@ let
 
     routes = mkOption {
       default = [ ];
-      type = types.listOf types.optionSet;
+      type = with types; listOf (submodule [ routeOptions ]);
-      options = [ routeOptions ];
       description = ''
         A list of route sections to be added to the unit.  See
         <citerefentry><refentrytitle>systemd.network</refentrytitle>
@@ -624,35 +622,32 @@ in
 
     systemd.network.links = mkOption {
       default = {};
-      type = types.attrsOf types.optionSet;
+      type = with types; attrsOf (submodule [ linkOptions ]);
-      options = [ linkOptions ];
       description = "Definition of systemd network links.";
     };
 
     systemd.network.netdevs = mkOption {
       default = {};
-      type = types.attrsOf types.optionSet;
+      type = with types; attrsOf (submodule [ netdevOptions ]);
-      options = [ netdevOptions ];
       description = "Definition of systemd network devices.";
     };
 
     systemd.network.networks = mkOption {
       default = {};
-      type = types.attrsOf types.optionSet;
+      type = with types; attrsOf (submodule [ networkOptions networkConfig ]);
-      options = [ networkOptions networkConfig ];
       description = "Definition of systemd networks.";
     };
 
     systemd.network.units = mkOption {
       description = "Definition of networkd units.";
       default = {};
-      type = types.attrsOf types.optionSet;
+      type = with types; attrsOf (submodule (
-      options = { name, config, ... }:
+        { name, config, ... }:
         { options = concreteUnitOptions;
           config = {
             unit = mkDefault (makeUnit name config);
           };
-        };
+        }));
     };
 
   };

nixos/modules/system/boot/systemd.nix

@@ -389,13 +389,13 @@ in
     systemd.units = mkOption {
       description = "Definition of systemd units.";
       default = {};
-      type = types.attrsOf types.optionSet;
+      type = with types; attrsOf (submodule (
-      options = { name, config, ... }:
+        { name, config, ... }:
         { options = concreteUnitOptions;
           config = {
             unit = mkDefault (makeUnit name config);
           };
-        };
+        }));
     };
 
     systemd.packages = mkOption {
@@ -406,43 +406,37 @@ in
 
     systemd.targets = mkOption {
       default = {};
-      type = types.attrsOf types.optionSet;
+      type = with types; attrsOf (submodule [ { options = targetOptions; } unitConfig] );
-      options = [ targetOptions unitConfig ];
       description = "Definition of systemd target units.";
     };
 
     systemd.services = mkOption {
       default = {};
-      type = types.attrsOf types.optionSet;
+      type = with types; attrsOf (submodule [ { options = serviceOptions; } unitConfig serviceConfig ]);
-      options = [ serviceOptions unitConfig serviceConfig ];
       description = "Definition of systemd service units.";
     };
 
     systemd.sockets = mkOption {
       default = {};
-      type = types.attrsOf types.optionSet;
+      type = with types; attrsOf (submodule [ { options = socketOptions; } unitConfig ]);
-      options = [ socketOptions unitConfig ];
       description = "Definition of systemd socket units.";
     };
 
     systemd.timers = mkOption {
       default = {};
-      type = types.attrsOf types.optionSet;
+      type = with types; attrsOf (submodule [ { options = timerOptions; } unitConfig ]);
-      options = [ timerOptions unitConfig ];
       description = "Definition of systemd timer units.";
     };
 
     systemd.paths = mkOption {
       default = {};
-      type = types.attrsOf types.optionSet;
+      type = with types; attrsOf (submodule [ { options = pathOptions; } unitConfig ]);
-      options = [ pathOptions unitConfig ];
       description = "Definition of systemd path units.";
     };
 
     systemd.mounts = mkOption {
       default = [];
-      type = types.listOf types.optionSet;
+      type = with types; listOf (submodule [ { options = mountOptions; } unitConfig mountConfig ]);
-      options = [ mountOptions unitConfig mountConfig ];
       description = ''
         Definition of systemd mount units.
         This is a list instead of an attrSet, because systemd mandates the names to be derived from
@@ -452,8 +446,7 @@ in
 
     systemd.automounts = mkOption {
       default = [];
-      type = types.listOf types.optionSet;
+      type = with types; listOf (submodule [ { options = automountOptions; } unitConfig automountConfig ]);
-      options = [ automountOptions unitConfig automountConfig ];
       description = ''
         Definition of systemd automount units.
         This is a list instead of an attrSet, because systemd mandates the names to be derived from
@@ -600,33 +593,30 @@ in
     systemd.user.units = mkOption {
       description = "Definition of systemd per-user units.";
       default = {};
-      type = types.attrsOf types.optionSet;
+      type = with types; attrsOf (submodule (
-      options = { name, config, ... }:
+        { name, config, ... }:
         { options = concreteUnitOptions;
           config = {
             unit = mkDefault (makeUnit name config);
           };
-        };
+        }));
     };
 
     systemd.user.services = mkOption {
       default = {};
-      type = types.attrsOf types.optionSet;
+      type = with types; attrsOf (submodule [ { options = serviceOptions; } unitConfig serviceConfig ] );
-      options = [ serviceOptions unitConfig serviceConfig ];
       description = "Definition of systemd per-user service units.";
     };
 
     systemd.user.timers = mkOption {
       default = {};
-      type = types.attrsOf types.optionSet;
+      type = with types; attrsOf (submodule [ { options = timerOptions; } unitConfig ] );
-      options = [ timerOptions unitConfig ];
       description = "Definition of systemd per-user timer units.";
     };
 
     systemd.user.sockets = mkOption {
       default = {};
-      type = types.attrsOf types.optionSet;
+      type = with types; attrsOf (submodule [ { options = socketOptions; } unitConfig ] );
-      options = [ socketOptions unitConfig ];
       description = "Definition of systemd per-user socket units.";
     };
 
@@ -808,6 +798,8 @@ in
     systemd.services.systemd-user-sessions.restartIfChanged = false; # Restart kills all active sessions.
     systemd.services.systemd-logind.restartTriggers = [ config.environment.etc."systemd/logind.conf".source ];
     systemd.services.systemd-logind.stopIfChanged = false;
+    systemd.services.systemd-journald.restartTriggers = [ config.environment.etc."systemd/journald.conf".source ];
+    systemd.services.systemd-journald.stopIfChanged = false;
     systemd.targets.local-fs.unitConfig.X-StopOnReconfiguration = true;
     systemd.targets.remote-fs.unitConfig.X-StopOnReconfiguration = true;
     systemd.services.systemd-binfmt.wants = [ "proc-sys-fs-binfmt_misc.automount" ];

nixos/modules/system/etc/etc.nix

@@ -33,7 +33,6 @@ in
   options = {
 
     environment.etc = mkOption {
-      type = types.loaOf types.optionSet;
       default = {};
       example = literalExample ''
         { example-configuration-file =
@@ -47,7 +46,8 @@ in
         Set of files that have to be linked in <filename>/etc</filename>.
       '';
 
-      options = singleton ({ name, config, ... }:
+      type = with types; loaOf (submodule (
+        { name, config, ... }:
         { options = {
 
             enable = mkOption {
@@ -117,7 +117,7 @@ in
               in mkDefault (pkgs.writeText name' config.text));
           };
 
-        });
+        }));
 
     };
 

nixos/modules/tasks/filesystems.nix

@@ -258,7 +258,7 @@ in
           let
             mountPoint' = "${escapeSystemdPath fs.mountPoint}.mount";
             device'  = escapeSystemdPath fs.device;
-            device'' = "${device}.device";
+            device'' = "${device'}.device";
           in nameValuePair "mkfs-${device'}"
           { description = "Initialisation of Filesystem ${fs.device}";
             wantedBy = [ mountPoint' ];

nixos/modules/tasks/network-interfaces.nix

@@ -97,21 +97,22 @@ let
 
   addrOpts = v:
     assert v == 4 || v == 6;
-    {
+    { options = {
-      address = mkOption {
+        address = mkOption {
-        type = types.str;
+          type = types.str;
-        description = ''
+          description = ''
-          IPv${toString v} address of the interface.  Leave empty to configure the
+            IPv${toString v} address of the interface.  Leave empty to configure the
-          interface using DHCP.
+            interface using DHCP.
-        '';
+          '';
-      };
+        };
 
-      prefixLength = mkOption {
+        prefixLength = mkOption {
-        type = types.addCheck types.int (n: n >= 0 && n <= (if v == 4 then 32 else 128));
+          type = types.addCheck types.int (n: n >= 0 && n <= (if v == 4 then 32 else 128));
-        description = ''
+          description = ''
-          Subnet mask of the interface, specified as the number of
+            Subnet mask of the interface, specified as the number of
-          bits in the prefix (<literal>${if v == 4 then "24" else "64"}</literal>).
+            bits in the prefix (<literal>${if v == 4 then "24" else "64"}</literal>).
-        '';
+          '';
+        };
       };
     };
 
@@ -141,8 +142,7 @@ let
           { address = "10.0.0.1"; prefixLength = 16; }
           { address = "192.168.1.1"; prefixLength = 24; }
         ];
-        type = types.listOf types.optionSet;
+        type = with types; listOf (submodule (addrOpts 4));
-        options = addrOpts 4;
         description = ''
           List of IPv4 addresses that will be statically assigned to the interface.
         '';
@@ -154,8 +154,7 @@ let
           { address = "fdfd:b3f0:482::1"; prefixLength = 48; }
           { address = "2001:1470:fffd:2098::e006"; prefixLength = 64; }
         ];
-        type = types.listOf types.optionSet;
+        type = with types; listOf (submodule (addrOpts 6));
-        options = addrOpts 6;
         description = ''
           List of IPv6 addresses that will be statically assigned to the interface.
         '';
@@ -415,8 +414,7 @@ in
         <option>networking.useDHCP</option> is true, then every
         interface not listed here will be configured using DHCP.
       '';
-      type = types.loaOf types.optionSet;
+      type = with types; loaOf (submodule interfaceOpts);
-      options = [ interfaceOpts ];
     };
 
     networking.vswitches = mkOption {
@@ -434,53 +432,55 @@ in
           interface.
         '';
 
-      type = types.attrsOf types.optionSet;
+      type = with types; attrsOf (submodule {
 
-      options = {
+        options = {
+
+          interfaces = mkOption {
+            example = [ "eth0" "eth1" ];
+            type = types.listOf types.str;
+            description =
+              "The physical network interfaces connected by the vSwitch.";
+          };
+
+          controllers = mkOption {
+            type = types.listOf types.str;
+            default = [];
+            example = [ "ptcp:6653:[::1]" ];
+            description = ''
+              Specify the controller targets. For the allowed options see <literal>man 8 ovs-vsctl</literal>.
+            '';
+          };
+
+          openFlowRules = mkOption {
+            type = types.lines;
+            default = "";
+            example = ''
+              actions=normal
+            '';
+            description = ''
+              OpenFlow rules to insert into the Open vSwitch. All <literal>openFlowRules</literal> are
+              loaded with <literal>ovs-ofctl</literal> within one atomic operation.
+            '';
+          };
+
+          extraOvsctlCmds = mkOption {
+            type = types.lines;
+            default = "";
+            example = ''
+              set-fail-mode <switch_name> secure
+              set Bridge <switch_name> stp_enable=true
+            '';
+            description = ''
+              Commands to manipulate the Open vSwitch database. Every line executed with <literal>ovs-vsctl</literal>.
+              All commands are bundled together with the operations for adding the interfaces
+              into one atomic operation.
+            '';
+          };
 
-        interfaces = mkOption {
-          example = [ "eth0" "eth1" ];
-          type = types.listOf types.str;
-          description =
-            "The physical network interfaces connected by the vSwitch.";
         };
 
-        controllers = mkOption {
+      });
-          type = types.listOf types.str;
-          default = [];
-          example = [ "ptcp:6653:[::1]" ];
-          description = ''
-            Specify the controller targets. For the allowed options see <literal>man 8 ovs-vsctl</literal>.
-          '';
-        };
-
-        openFlowRules = mkOption {
-          type = types.lines;
-          default = "";
-          example = ''
-            actions=normal
-          '';
-          description = ''
-            OpenFlow rules to insert into the Open vSwitch. All <literal>openFlowRules</literal> are
-            loaded with <literal>ovs-ofctl</literal> within one atomic operation.
-          '';
-        };
-
-        extraOvsctlCmds = mkOption {
-          type = types.lines;
-          default = "";
-          example = ''
-            set-fail-mode <switch_name> secure
-            set Bridge <switch_name> stp_enable=true
-          '';
-          description = ''
-            Commands to manipulate the Open vSwitch database. Every line executed with <literal>ovs-vsctl</literal>.
-            All commands are bundled together with the operations for adding the interfaces
-            into one atomic operation.
-          '';
-        };
-
-      };
 
     };
 
@@ -499,25 +499,27 @@ in
           bridge's network interface.
         '';
 
-      type = types.attrsOf types.optionSet;
+      type = with types; attrsOf (submodule {
 
-      options = {
+        options = {
+
+          interfaces = mkOption {
+            example = [ "eth0" "eth1" ];
+            type = types.listOf types.str;
+            description =
+              "The physical network interfaces connected by the bridge.";
+          };
+
+          rstp = mkOption {
+            example = true;
+            default = false;
+            type = types.bool;
+            description = "Whether the bridge interface should enable rstp.";
+          };
 
-        interfaces = mkOption {
-          example = [ "eth0" "eth1" ];
-          type = types.listOf types.str;
-          description =
-            "The physical network interfaces connected by the bridge.";
         };
 
-        rstp = mkOption {
+      });
-          example = true;
-          default = false;
-          type = types.bool;
-          description = "Whether the bridge interface should enable rstp.";
-        };
-
-      };
 
     };
 
@@ -538,65 +540,66 @@ in
         name specifying the name of the bond's network interface
       '';
 
-      type = types.attrsOf types.optionSet;
+      type = with types; attrsOf (submodule {
 
-      options = {
+        options = {
+
+          interfaces = mkOption {
+            example = [ "enp4s0f0" "enp4s0f1" "wlan0" ];
+            type = types.listOf types.str;
+            description = "The interfaces to bond together";
+          };
+
+          lacp_rate = mkOption {
+            default = null;
+            example = "fast";
+            type = types.nullOr types.str;
+            description = ''
+              Option specifying the rate in which we'll ask our link partner
+              to transmit LACPDU packets in 802.3ad mode.
+            '';
+          };
+
+          miimon = mkOption {
+            default = null;
+            example = 100;
+            type = types.nullOr types.int;
+            description = ''
+              Miimon is the number of millisecond in between each round of polling
+              by the device driver for failed links. By default polling is not
+              enabled and the driver is trusted to properly detect and handle
+              failure scenarios.
+            '';
+          };
+
+          mode = mkOption {
+            default = null;
+            example = "active-backup";
+            type = types.nullOr types.str;
+            description = ''
+              The mode which the bond will be running. The default mode for
+              the bonding driver is balance-rr, optimizing for throughput.
+              More information about valid modes can be found at
+              https://www.kernel.org/doc/Documentation/networking/bonding.txt
+            '';
+          };
+
+          xmit_hash_policy = mkOption {
+            default = null;
+            example = "layer2+3";
+            type = types.nullOr types.str;
+            description = ''
+              Selects the transmit hash policy to use for slave selection in
+              balance-xor, 802.3ad, and tlb modes.
+            '';
+          };
 
-        interfaces = mkOption {
-          example = [ "enp4s0f0" "enp4s0f1" "wlan0" ];
-          type = types.listOf types.str;
-          description = "The interfaces to bond together";
         };
 
-        lacp_rate = mkOption {
+      });
-          default = null;
-          example = "fast";
-          type = types.nullOr types.str;
-          description = ''
-            Option specifying the rate in which we'll ask our link partner
-            to transmit LACPDU packets in 802.3ad mode.
-          '';
-        };
-
-        miimon = mkOption {
-          default = null;
-          example = 100;
-          type = types.nullOr types.int;
-          description = ''
-            Miimon is the number of millisecond in between each round of polling
-            by the device driver for failed links. By default polling is not
-            enabled and the driver is trusted to properly detect and handle
-            failure scenarios.
-          '';
-        };
-
-        mode = mkOption {
-          default = null;
-          example = "active-backup";
-          type = types.nullOr types.str;
-          description = ''
-            The mode which the bond will be running. The default mode for
-            the bonding driver is balance-rr, optimizing for throughput.
-            More information about valid modes can be found at
-            https://www.kernel.org/doc/Documentation/networking/bonding.txt
-          '';
-        };
-
-        xmit_hash_policy = mkOption {
-          default = null;
-          example = "layer2+3";
-          type = types.nullOr types.str;
-          description = ''
-            Selects the transmit hash policy to use for slave selection in
-            balance-xor, 802.3ad, and tlb modes.
-          '';
-        };
-
-      };
     };
 
     networking.macvlans = mkOption {
-      type = types.attrsOf types.optionSet;
       default = { };
       example = literalExample {
         wan = {
@@ -608,26 +611,28 @@ in
         This option allows you to define macvlan interfaces which should
         be automatically created.
       '';
-      options = {
+      type = with types; attrsOf (submodule {
+        options = {
+
+          interface = mkOption {
+            example = "enp4s0";
+            type = types.str;
+            description = "The interface the macvlan will transmit packets through.";
+          };
+
+          mode = mkOption {
+            default = null;
+            type = types.nullOr types.str;
+            example = "vepa";
+            description = "The mode of the macvlan device.";
+          };
 
-        interface = mkOption {
-          example = "enp4s0";
-          type = types.str;
-          description = "The interface the macvlan will transmit packets through.";
         };
 
-        mode = mkOption {
+      });
-          default = null;
-          type = types.nullOr types.str;
-          example = "vepa";
-          description = "The mode of the macvlan device.";
-        };
-
-      };
     };
 
     networking.sits = mkOption {
-      type = types.attrsOf types.optionSet;
       default = { };
       example = literalExample {
         hurricane = {
@@ -644,46 +649,49 @@ in
       description = ''
         This option allows you to define 6-to-4 interfaces which should be automatically created.
       '';
-      options = {
+      type = with types; attrsOf (submodule {
+        options = {
+
+          remote = mkOption {
+            type = types.nullOr types.str;
+            default = null;
+            example = "10.0.0.1";
+            description = ''
+              The address of the remote endpoint to forward traffic over.
+            '';
+          };
+
+          local = mkOption {
+            type = types.nullOr types.str;
+            default = null;
+            example = "10.0.0.22";
+            description = ''
+              The address of the local endpoint which the remote
+              side should send packets to.
+            '';
+          };
+
+          ttl = mkOption {
+            type = types.nullOr types.int;
+            default = null;
+            example = 255;
+            description = ''
+              The time-to-live of the connection to the remote tunnel endpoint.
+            '';
+          };
+
+          dev = mkOption {
+            type = types.nullOr types.str;
+            default = null;
+            example = "enp4s0f0";
+            description = ''
+              The underlying network device on which the tunnel resides.
+            '';
+          };
 
-        remote = mkOption {
-          type = types.nullOr types.str;
-          default = null;
-          example = "10.0.0.1";
-          description = ''
-            The address of the remote endpoint to forward traffic over.
-          '';
         };
 
-        local = mkOption {
+      });
-          type = types.nullOr types.str;
-          default = null;
-          example = "10.0.0.22";
-          description = ''
-            The address of the local endpoint which the remote
-            side should send packets to.
-          '';
-        };
-
-        ttl = mkOption {
-          type = types.nullOr types.int;
-          default = null;
-          example = 255;
-          description = ''
-            The time-to-live of the connection to the remote tunnel endpoint.
-          '';
-        };
-
-        dev = mkOption {
-          type = types.nullOr types.str;
-          default = null;
-          example = "enp4s0f0";
-          description = ''
-            The underlying network device on which the tunnel resides.
-          '';
-        };
-
-      };
     };
 
     networking.vlans = mkOption {
@@ -706,23 +714,26 @@ in
           specifying the name of the vlan interface.
         '';
 
-      type = types.attrsOf types.optionSet;
+      type = with types; attrsOf (submodule {
 
-      options = {
+        options = {
+
+          id = mkOption {
+            example = 1;
+            type = types.int;
+            description = "The vlan identifier";
+          };
+
+          interface = mkOption {
+            example = "enp4s0";
+            type = types.str;
+            description = "The interface the vlan will transmit packets through.";
+          };
 
-        id = mkOption {
-          example = 1;
-          type = types.int;
-          description = "The vlan identifier";
         };
 
-        interface = mkOption {
+      });
-          example = "enp4s0";
-          type = types.str;
-          description = "The interface the vlan will transmit packets through.";
-        };
 
-      };
     };
 
     networking.wlanInterfaces = mkOption {
@@ -760,73 +771,76 @@ in
           would have to be created explicitly.
         '';
 
-      type = types.attrsOf types.optionSet;
+      type = with types; attrsOf (submodule {
 
-      options = {
+        options = {
+
+          device = mkOption {
+            type = types.string;
+            example = "wlp6s0";
+            description = "The name of the underlying hardware WLAN device as assigned by <literal>udev</literal>.";
+          };
+
+          type = mkOption {
+            type = types.string;
+            default = "managed";
+            example = "ibss";
+            description = ''
+              The type of the WLAN interface. The type has to be either <literal>managed</literal>,
+              <literal>ibss</literal>, <literal>monitor</literal>, <literal>mesh</literal> or <literal>wds</literal>.
+              Also, the type has to be supported by the underlying hardware of the device.
+            '';
+          };
+
+          meshID = mkOption {
+            type = types.nullOr types.string;
+            default = null;
+            description = "MeshID of interface with type <literal>mesh</literal>.";
+          };
+
+          flags = mkOption {
+            type = types.nullOr types.string;
+            default = null;
+            example = "control";
+            description = ''
+              Flags for interface of type <literal>monitor</literal>. The valid flags are:
+              none:     no special flags
+              fcsfail:  show frames with FCS errors
+              control:  show control frames
+              otherbss: show frames from other BSSes
+              cook:     use cooked mode
+              active:   use active mode (ACK incoming unicast packets)
+            '';
+          };
+
+          fourAddr = mkOption {
+            type = types.nullOr types.bool;
+            default = null;
+            description = "Whether to enable <literal>4-address mode</literal> with type <literal>managed</literal>.";
+          };
+
+          mac = mkOption {
+            type = types.nullOr types.str;
+            default = null;
+            example = "02:00:00:00:00:01";
+            description = ''
+              MAC address to use for the device. If <literal>null</literal>, then the MAC of the
+              underlying hardware WLAN device is used.
+
+              INFO: Locally administered MAC addresses are of the form:
+              <itemizedlist>
+              <listitem><para>x2:xx:xx:xx:xx:xx</para></listitem>
+              <listitem><para>x6:xx:xx:xx:xx:xx</para></listitem>
+              <listitem><para>xA:xx:xx:xx:xx:xx</para></listitem>
+              <listitem><para>xE:xx:xx:xx:xx:xx</para></listitem>
+              </itemizedlist>
+            '';
+          };
 
-        device = mkOption {
-          type = types.string;
-          example = "wlp6s0";
-          description = "The name of the underlying hardware WLAN device as assigned by <literal>udev</literal>.";
         };
 
-        type = mkOption {
+      });
-          type = types.string;
-          default = "managed";
-          example = "ibss";
-          description = ''
-            The type of the WLAN interface. The type has to be either <literal>managed</literal>,
-            <literal>ibss</literal>, <literal>monitor</literal>, <literal>mesh</literal> or <literal>wds</literal>.
-            Also, the type has to be supported by the underlying hardware of the device.
-          '';
-        };
 
-        meshID = mkOption {
-          type = types.nullOr types.string;
-          default = null;
-          description = "MeshID of interface with type <literal>mesh</literal>.";
-        };
-
-        flags = mkOption {
-          type = types.nullOr types.string;
-          default = null;
-          example = "control";
-          description = ''
-            Flags for interface of type <literal>monitor</literal>. The valid flags are:
-            none:     no special flags
-            fcsfail:  show frames with FCS errors
-            control:  show control frames
-            otherbss: show frames from other BSSes
-            cook:     use cooked mode
-            active:   use active mode (ACK incoming unicast packets)
-          '';
-        };
-
-        fourAddr = mkOption {
-          type = types.nullOr types.bool;
-          default = null;
-          description = "Whether to enable <literal>4-address mode</literal> with type <literal>managed</literal>.";
-        };
-
-        mac = mkOption {
-          type = types.nullOr types.str;
-          default = null;
-          example = "02:00:00:00:00:01";
-          description = ''
-            MAC address to use for the device. If <literal>null</literal>, then the MAC of the
-            underlying hardware WLAN device is used.
-
-            INFO: Locally administered MAC addresses are of the form:
-            <itemizedlist>
-            <listitem><para>x2:xx:xx:xx:xx:xx</para></listitem>
-            <listitem><para>x6:xx:xx:xx:xx:xx</para></listitem>
-            <listitem><para>xA:xx:xx:xx:xx:xx</para></listitem>
-            <listitem><para>xE:xx:xx:xx:xx:xx</para></listitem>
-            </itemizedlist>
-          '';
-        };
-
-      };
     };
 
     networking.useDHCP = mkOption {

nixos/modules/virtualisation/containers.nix

@@ -129,6 +129,9 @@ let
         --setenv HOST_ADDRESS6="$HOST_ADDRESS6" \
         --setenv LOCAL_ADDRESS6="$LOCAL_ADDRESS6" \
         --setenv PATH="$PATH" \
+        ${if cfg.additionalCapabilities != null then
+          ''--capability="${concatStringsSep " " cfg.additionalCapabilities}"'' else ""
+        } \
         ${containerInit cfg} "''${SYSTEM_PATH:-/nix/var/nix/profiles/system}/init"
     '';
 
@@ -205,6 +208,41 @@ let
       ''
   );
 
+  serviceDirectives = cfg: {
+    ExecReload = pkgs.writeScript "reload-container"
+      ''
+        #! ${pkgs.stdenv.shell} -e
+        ${pkgs.nixos-container}/bin/nixos-container run "$INSTANCE" -- \
+          bash --login -c "''${SYSTEM_PATH:-/nix/var/nix/profiles/system}/bin/switch-to-configuration test"
+      '';
+
+    SyslogIdentifier = "container %i";
+
+    EnvironmentFile = "-/etc/containers/%i.conf";
+
+    Type = "notify";
+
+    # Note that on reboot, systemd-nspawn returns 133, so this
+    # unit will be restarted. On poweroff, it returns 0, so the
+    # unit won't be restarted.
+    RestartForceExitStatus = "133";
+    SuccessExitStatus = "133";
+
+    Restart = "on-failure";
+
+    # Hack: we don't want to kill systemd-nspawn, since we call
+    # "machinectl poweroff" in preStop to shut down the
+    # container cleanly. But systemd requires sending a signal
+    # (at least if we want remaining processes to be killed
+    # after the timeout). So send an ignored signal.
+    KillMode = "mixed";
+    KillSignal = "WINCH";
+
+    DevicePolicy = "closed";
+    DeviceAllow = map (d: "${d.node} ${d.modifier}") cfg.allowedDevices;
+  };
+
+
   system = config.nixpkgs.system;
 
   bindMountOpts = { name, config, ... }: {
@@ -235,6 +273,27 @@ let
 
   };
 
+  allowedDeviceOpts = { name, config, ... }: {
+    options = {
+      node = mkOption {
+        example = "/dev/net/tun";
+        type = types.str;
+        description = "Path to device node";
+      };
+      modifier = mkOption {
+        example = "rw";
+        type = types.str;
+        description = ''
+          Device node access modifier. Takes a combination
+          <literal>r</literal> (read), <literal>w</literal> (write), and
+          <literal>m</literal> (mknod). See the
+          <literal>systemd.resource-control(5)</literal> man page for more
+          information.'';
+      };
+    };
+  };
+
+
   mkBindFlag = d:
                let flagPrefix = if d.isReadOnly then " --bind-ro=" else " --bind=";
                    mountstr = if d.hostPath != null then "${d.hostPath}:${d.mountPoint}" else "${d.mountPoint}";
@@ -302,6 +361,8 @@ let
   dummyConfig =
     {
       extraVeths = {};
+      additionalCapabilities = [];
+      allowedDevices = [];
       hostAddress = null;
       hostAddress6 = null;
       localAddress = null;
@@ -368,6 +429,26 @@ in
               '';
             };
 
+            additionalCapabilities = mkOption {
+              type = types.listOf types.str;
+              default = [];
+              example = [ "CAP_NET_ADMIN" "CAP_MKNOD" ];
+              description = ''
+                Grant additional capabilities to the container.  See the
+                capabilities(7) and systemd-nspawn(1) man pages for more
+                information.
+              '';
+            };
+            enableTun = mkOption {
+              type = types.bool;
+              default = false;
+              description = ''
+                Allows the container to create and setup tunnel interfaces
+                by granting the <literal>NET_ADMIN</literal> capability and
+                enabling access to <literal>/dev/net/tun</literal>.
+              '';
+            };
+
             privateNetwork = mkOption {
               type = types.bool;
               default = false;
@@ -392,9 +473,8 @@ in
             };
 
             extraVeths = mkOption {
-              type = types.attrsOf types.optionSet;
+              type = with types; attrsOf (submodule networkOptions);
               default = {};
-              options = networkOptions;
               description = ''
                 Extra veth-pairs to be created for the container
               '';
@@ -409,8 +489,7 @@ in
             };
 
             bindMounts = mkOption {
-              type = types.loaOf types.optionSet;
+              type = with types; loaOf (submodule bindMountOpts);
-              options = [ bindMountOpts ];
               default = {};
               example = { "/home" = { hostPath = "/home/alice";
                                       isReadOnly = false; };
@@ -422,6 +501,16 @@ in
                 '';
             };
 
+            allowedDevices = mkOption {
+              type = types.listOf types.optionSet;
+              options = [ allowedDeviceOpts ];
+              default = [];
+              example = [ { node = "/dev/net/tun"; modifier = "rw"; } ];
+              description = ''
+                A list of device nodes to which the containers has access to.
+              '';
+            };
+
           } // networkOptions;
 
           config = mkMerge
@@ -488,59 +577,39 @@ in
 
       restartIfChanged = false;
 
-      serviceConfig = {
+      serviceConfig = serviceDirectives dummyConfig;
-        ExecReload = pkgs.writeScript "reload-container"
-          ''
-            #! ${pkgs.stdenv.shell} -e
-            ${pkgs.nixos-container}/bin/nixos-container run "$INSTANCE" -- \
-              bash --login -c "''${SYSTEM_PATH:-/nix/var/nix/profiles/system}/bin/switch-to-configuration test"
-          '';
-
-        SyslogIdentifier = "container %i";
-
-        EnvironmentFile = "-/etc/containers/%i.conf";
-
-        Type = "notify";
-
-        # Note that on reboot, systemd-nspawn returns 133, so this
-        # unit will be restarted. On poweroff, it returns 0, so the
-        # unit won't be restarted.
-        RestartForceExitStatus = "133";
-        SuccessExitStatus = "133";
-
-        Restart = "on-failure";
-
-        # Hack: we don't want to kill systemd-nspawn, since we call
-        # "machinectl poweroff" in preStop to shut down the
-        # container cleanly. But systemd requires sending a signal
-        # (at least if we want remaining processes to be killed
-        # after the timeout). So send an ignored signal.
-        KillMode = "mixed";
-        KillSignal = "WINCH";
-
-        DevicePolicy = "closed";
-      };
     };
   in {
     systemd.services = listToAttrs (filter (x: x.value != null) (
       # The generic container template used by imperative containers
       [{ name = "container@"; value = unit; }]
       # declarative containers
-      ++ (mapAttrsToList (name: cfg: nameValuePair "container@${name}" (
+      ++ (mapAttrsToList (name: cfg: nameValuePair "container@${name}" (let
-        unit // {
+          config = cfg // (
-          preStart = preStartScript cfg;
+          if cfg.enableTun then
-          script = startScript cfg;
+            {
-          postStart = postStartScript cfg;
+              allowedDevices = cfg.allowedDevices
-        } // (
+                ++ [ { node = "/dev/net/tun"; modifier = "rw"; } ];
-        if cfg.autoStart then
+              additionalCapabilities = cfg.additionalCapabilities
-          {
+                ++ [ "CAP_NET_ADMIN" ];
-            wantedBy = [ "multi-user.target" ];
+            }
-            wants = [ "network.target" ];
+          else {});
-            after = [ "network.target" ];
+        in
-            restartTriggers = [ cfg.path ];
+          unit // {
-            reloadIfChanged = true;
+            preStart = preStartScript config;
-          }
+            script = startScript config;
-        else {})
+            postStart = postStartScript config;
+            serviceConfig = serviceDirectives config;
+          } // (
+          if config.autoStart then
+            {
+              wantedBy = [ "multi-user.target" ];
+              wants = [ "network.target" ];
+              after = [ "network.target" ];
+              restartTriggers = [ config.path ];
+              reloadIfChanged = true;
+            }
+          else {})
       )) config.containers)
     ));
 

nixos/release.nix

@@ -284,6 +284,7 @@ in rec {
   tests.quagga = callTest tests/quagga.nix {};
   tests.quake3 = callTest tests/quake3.nix {};
   tests.runInMachine = callTest tests/run-in-machine.nix {};
+  tests.samba = callTest tests/samba.nix {};
   tests.sddm = callTest tests/sddm.nix {};
   tests.simple = callTest tests/simple.nix {};
   tests.smokeping = callTest tests/smokeping.nix {};

nixos/tests/flannel.nix

@@ -0,0 +1,55 @@
+import ./make-test.nix ({ pkgs, ...} : rec {
+  name = "flannel";
+
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ offline ];
+  };
+
+  nodes = let
+    flannelConfig = {
+      services.flannel = {
+        enable = true;
+        network = "10.1.0.0/16";
+        iface = "eth1";
+        etcd.endpoints = ["http://etcd:2379"];
+      };
+
+      networking.firewall.allowedUDPPorts = [ 8472 ];
+    };
+  in {
+    etcd = { config, pkgs, ... }: {
+      services = {
+        etcd = {
+          enable = true;
+          listenClientUrls = ["http://etcd:2379"];
+          listenPeerUrls = ["http://etcd:2380"];
+          initialAdvertisePeerUrls = ["http://etcd:2379"];
+          initialCluster = ["etcd=http://etcd:2379"];
+        };
+      };
+
+      networking.firewall.allowedTCPPorts = [ 2379 ];
+    };
+
+    node1 = { config, ... }: {
+      require = [flannelConfig];
+    };
+
+    node2 = { config, ... }: {
+      require = [flannelConfig];
+    };
+  };
+
+  testScript = ''
+    startAll;
+
+    $node1->waitForUnit("flannel.service");
+    $node2->waitForUnit("flannel.service");
+
+    my $ip1 = $node1->succeed("ip -4 addr show flannel.1 | grep -oP '(?<=inet).*(?=/)'");
+    my $ip2 = $node2->succeed("ip -4 addr show flannel.1 | grep -oP '(?<=inet).*(?=/)'");
+
+    $node1->waitUntilSucceeds("ping -c 1 $ip2");
+    $node2->waitUntilSucceeds("ping -c 1 $ip1");
+  '';
+})

nixos/tests/logstash.nix

@@ -25,7 +25,6 @@ import ./make-test.nix ({ pkgs, ...} : {
               '';
               outputConfig = ''
                 stdout { codec => rubydebug }
-                elasticsearch { embedded => true }
               '';
             };
           };
@@ -38,6 +37,5 @@ import ./make-test.nix ({ pkgs, ...} : {
     $one->waitForUnit("logstash.service");
     $one->waitUntilSucceeds("journalctl -n 20 _SYSTEMD_UNIT=logstash.service | grep flowers");
     $one->fail("journalctl -n 20 _SYSTEMD_UNIT=logstash.service | grep dragons");
-    $one->waitUntilSucceeds("curl -s http://127.0.0.1:9200/_status?pretty=true | grep logstash");
   '';
 })

nixos/tests/samba.nix

@@ -0,0 +1,48 @@
+import ./make-test.nix ({ pkgs, ... }:
+
+{
+  name = "samba";
+
+  meta.maintainers = [ pkgs.lib.maintainers.eelco ];
+
+  nodes =
+    { client =
+        { config, pkgs, ... }:
+        { fileSystems = pkgs.lib.mkVMOverride
+            { "/public" = {
+                fsType = "cifs";
+                device = "//server/public";
+                options = [ "guest" ];
+              };
+            };
+        };
+
+      server =
+        { config, pkgs, ... }:
+        { services.samba.enable = true;
+          services.samba.shares.public =
+            { path = "/public";
+              "read only" = true;
+              browseable = "yes";
+              "guest ok" = "yes";
+              comment = "Public samba share.";
+            };
+          networking.firewall.allowedTCPPorts = [ 139 445 ];
+          networking.firewall.allowedUDPPorts = [ 137 138 ];
+        };
+    };
+
+  # client# [    4.542997] mount[777]: sh: systemd-ask-password: command not found
+
+  testScript =
+    ''
+      $server->start;
+      $server->waitForUnit("samba-smbd");
+      $server->waitForUnit("samba-nmbd");
+      $server->succeed("mkdir -p /public; echo bar > /public/foo");
+
+      $client->start;
+      $client->waitForUnit("network.target");
+      $client->succeed("[[ \$(cat /public/foo) = bar ]]");
+    '';
+})

pkgs/applications/altcoins/bitcoin.nix

@@ -6,14 +6,14 @@ with stdenv.lib;
 stdenv.mkDerivation rec{
 
   name = "bitcoin" + (toString (optional (!withGui) "d")) + "-" + version;
-  core_version = "0.12.0";
+  core_version = "0.13.0";
   version = core_version;
 
   src = fetchurl {
     urls = [ "https://bitcoin.org/bin/bitcoin-core-${core_version}/bitcoin-${version}.tar.gz"
              "mirror://sourceforge/bitcoin/Bitcoin/bitcoin-${core_version}/bitcoin-${version}.tar.gz"
            ];
-    sha256 = "0f1cda66c841a548a07cc37e80b0727354b1236d9f374c7d44362acdb85eb3e1";
+    sha256 = "0c7d7049689bb17f4256f1e5ec20777f42acef61814d434b38e6c17091161cda";
   };
 
   buildInputs = [ pkgconfig autoreconfHook openssl db48 boost zlib

pkgs/applications/audio/cd-discid/default.nix

@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   installFlags = "PREFIX=$(out) INSTALL=install";
 
   buildInputs = []
-    ++ stdenv.lib.optional stdenv.isDarwin [ IOKit ];
+    ++ stdenv.lib.optional stdenv.isDarwin IOKit;
 
   meta = with stdenv.lib; {
     homepage = http://linukz.org/cd-discid.shtml;

pkgs/applications/audio/kid3/default.nix

@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     phonon automoc4 chromaprint id3lib taglib mp4v2 flac libogg libvorbis
     qt zlib readline makeWrapper ];
 
-  cmakeFlags = [ "-DCMAKE_BUILD_TYPE=Release" "-DWITH_APPS=Qt;CLI" ];
+  cmakeFlags = [ "-DWITH_APPS=Qt;CLI" ];
   NIX_LDFLAGS = "-lm -lpthread";
 
   preConfigure = ''

pkgs/applications/editors/tecoc/default.nix

@@ -0,0 +1,56 @@
+{ stdenv, fetchgit
+, ncurses }:
+
+stdenv.mkDerivation rec {
+
+  name = "tecoc-git-${version}";
+  version = "20150606";
+
+  src = fetchgit {
+    url = "https://github.com/blakemcbride/TECOC.git";
+    rev = "d7dffdeb1dfb812e579d6d3b518545b23e1b50cb";
+    sha256 = "11zfa73dlx71c0hmjz5n3wqcvk6082rpb4sss877nfiayisc0njj";
+  };
+
+  buildInputs = [ ncurses ];
+
+  configurePhase = ''
+    cp src/makefile.linux src/Makefile    
+  '';
+  buildPhase = ''
+    make CC=${stdenv.cc}/bin/cc -C src/
+  '';
+  installPhase = ''
+    mkdir -p $out/bin $out/share/doc/${name} $out/lib/teco/macros
+    cp src/tecoc $out/bin
+    cp src/aaout.txt doc/* $out/share/doc/${name}
+    cp lib/* lib2/* $out/lib/teco/macros
+    (cd $out/bin
+     ln -s tecoc Make
+     ln -s tecoc mung
+     ln -s tecoc teco
+     ln -s tecoc Inspect )
+  '';
+	
+  meta = with stdenv.lib; {
+    description = "A clone of the good old TECO editor";
+    longDescription = ''
+      For those who don't know: TECO is the acronym of Tape Editor and
+      COrrector (because it was a paper tape edition tool in its debut 
+      days). Now the acronym follows after Text Editor and Corrector, 
+      or Text Editor Character-Oriented.
+      
+      TECO is a character-oriented text editor, originally developed
+      bu Dan Murphy at MIT circa 1962. It is also a Turing-complete
+      imperative interpreted programming language for text
+      manipulation, done via user-loaded sets of macros. In fact, Emacs
+      was born as a set of Editor MACroS for TECO.
+
+      TECOC is a portable C implementation of TECO-11.
+ '';
+    homepage = https://github.com/blakemcbride/TECOC;
+    maintainers = [ maintainers.AndersonTorres ];
+    platforms = platforms.unix;
+  };
+}
+# TODO: test in other platforms - especially Darwin

pkgs/applications/editors/tiled/default.nix

@@ -5,12 +5,12 @@ let
 #  qtEnv = with qt5; env "qt-${qtbase.version}" [ qtbase qttools ];
 in stdenv.mkDerivation rec {
   name = "tiled-${version}";
-  version = "0.16.1";
+  version = "0.17.0";
 
   src = fetchurl {
     name = "${name}.tar.gz";
     url = "https://github.com/bjorn/tiled/archive/v${version}.tar.gz";
-    sha256 = "0s1i6yhm1z9ayzjh8cprcc9jvj5m87l9snyqg6w7zlj3q9zn4rn6";
+    sha256 = "0c9gykxmq0sk0yyfdq81g9psd922scqzn5asskjydj84d80f5z7p";
   };
 
   nativeBuildInputs = [ pkgconfig qmakeHook ];

pkgs/applications/editors/vis/default.nix

@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
     libtermkey
     lua
     lpeg
-  ] ++ stdenv.lib.optional stdenv.isLinux [
+  ] ++ stdenv.lib.optionals stdenv.isLinux [
     acl
     libselinux
   ];

pkgs/applications/graphics/feh/default.nix

@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   outputs = [ "out" "doc" ];
 
   nativeBuildInputs = [ makeWrapper xorg.libXt ]
-    ++ stdenv.lib.optional doCheck [ perlPackages.TestCommand perlPackages.TestHarness ];
+    ++ stdenv.lib.optionals doCheck [ perlPackages.TestCommand perlPackages.TestHarness ];
 
   buildInputs = [ xorg.libX11 xorg.libXinerama imlib2 libjpeg libpng curl libexif ];
 

pkgs/applications/misc/albert/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name    = "albert-${version}";
-  version = "0.8.10";
+  version = "0.8.11";
 
   src = fetchFromGitHub {
     owner  = "manuelschneid3r";
     repo   = "albert";
     rev    = "v${version}";
-    sha256 = "1x8fpc6rnjifh405p385avdaww4v8ld6qwczqwmkzgbcn15gman7";
+    sha256 = "12ag30l3dd05hg0d08ax4c8dvp24lgd677szkq445xzvvhggxr37";
   };
 
   nativeBuildInputs = [ cmake makeQtWrapper ];
@@ -21,11 +21,11 @@ stdenv.mkDerivation rec {
     wrapQtProgram $out/bin/albert
   '';
 
-  meta = {
+  meta = with stdenv.lib; {
     homepage    = https://github.com/manuelSchneid3r/albert;
     description = "Desktop agnostic launcher";
-    license     = stdenv.lib.licenses.gpl3Plus;
+    license     = licenses.gpl3Plus;
-    maintainers = [ stdenv.lib.maintainers.ericsagnes ];
+    maintainers = with maintainers; [ ericsagnes ];
-    platforms = stdenv.lib.platforms.linux;
+    platforms   = platforms.linux;
   };
 }

pkgs/applications/misc/blender/default.nix

@@ -1,7 +1,8 @@
 { stdenv, lib, fetchurl, boost, cmake, ffmpeg, gettext, glew
-, ilmbase, libXi, libX11, libjpeg, libpng, libsamplerate, libsndfile
+, ilmbase, libXi, libX11, libXext, libXrender
-, libtiff, mesa, openal, opencolorio, openexr, openimageio, openjpeg, python
+, libjpeg, libpng, libsamplerate, libsndfile
-, zlib, fftw, opensubdiv, freetype
+, libtiff, mesa, openal, opencolorio, openexr, openimageio, openjpeg_1, python
+, zlib, fftw, opensubdiv, freetype, jemalloc
 , jackaudioSupport ? false, libjack2
 , cudaSupport ? false, cudatoolkit
 , colladaSupport ? true, opencollada
@@ -10,17 +11,18 @@
 with lib;
 
 stdenv.mkDerivation rec {
-  name = "blender-2.77a";
+  name = "blender-2.78";
 
   src = fetchurl {
     url = "http://download.blender.org/source/${name}.tar.gz";
-    sha256 = "0rswx2n52wjr4jpvg1a6mir5das2i752brjzigmm8rhayl0glw1p";
+    sha256 = "0hfl7q6phydlk8mbkksnqxj004qqad99xkrp5n9wrz9vrcf3x1hp";
   };
 
   buildInputs =
-    [ boost cmake ffmpeg gettext glew ilmbase libXi libX11 freetype
+    [ boost cmake ffmpeg gettext glew ilmbase
-      libjpeg libpng libsamplerate libsndfile libtiff mesa openal
+      libXi libX11 libXext libXrender
-      opencolorio openexr openimageio openjpeg python zlib fftw
+      freetype libjpeg libpng libsamplerate libsndfile libtiff mesa openal
+      opencolorio openexr openimageio openjpeg_1 python zlib fftw jemalloc
       (opensubdiv.override { inherit cudaSupport; })
     ]
     ++ optional jackaudioSupport libjack2
@@ -38,7 +40,7 @@ stdenv.mkDerivation rec {
       "-DWITH_CODEC_SNDFILE=ON"
       "-DWITH_INSTALL_PORTABLE=OFF"
       "-DWITH_FFTW3=ON"
-      "-DWITH_SDL=ON"
+      #"-DWITH_SDL=ON"
       "-DWITH_GAMEENGINE=ON"
       "-DWITH_OPENCOLORIO=ON"
       "-DWITH_SYSTEM_OPENJPEG=ON"

pkgs/applications/misc/doomseeker/default.nix

@@ -8,8 +8,6 @@ stdenv.mkDerivation rec {
     sha256 = "172ybxg720r64hp6aah0hqvxklqv1cf8v7kwx0ng5ap0h20jydbw";
   };
 
-  cmakeFlags = [ "-DCMAKE_BUILD_TYPE=Release" ];
-
   buildInputs = [ qt4 zlib bzip2 ];
 
   nativeBuildInputs = [ cmake pkgconfig ];

pkgs/applications/misc/gnuradio-ais/default.nix

@@ -0,0 +1,36 @@
+{ stdenv, fetchFromGitHub, cmake, pkgconfig, boost, gnuradio
+, makeWrapper, cppunit, gnuradio-osmosdr
+, pythonSupport ? true, python, swig
+}:
+
+assert pythonSupport -> python != null && swig != null;
+
+stdenv.mkDerivation rec {
+  name = "gnuradio-ais-${version}";
+  version = "2016-08-26";
+
+  src = fetchFromGitHub {
+    owner = "bistromath";
+    repo = "gr-ais";
+    rev = "1863d1bf8a7709a8dfedb3ddb8e2b99112e7c872";
+    sha256 = "1vl3kk8xr2mh5lf31zdld7yzmwywqffffah8iblxdzblgsdwxfl6";
+  };
+
+  buildInputs = [
+    cmake pkgconfig boost gnuradio makeWrapper cppunit gnuradio-osmosdr
+  ] ++ stdenv.lib.optionals pythonSupport [ python swig ];
+
+  postInstall = ''
+    for prog in "$out"/bin/*; do
+        wrapProgram "$prog" --set PYTHONPATH $PYTHONPATH:$(toPythonPath "$out")
+    done
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Gnuradio block for ais";
+    homepage = https://github.com/bistromath/gr-ais;
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ mog ];
+  };
+}

pkgs/applications/misc/gnuradio-gsm/default.nix

@@ -0,0 +1,36 @@
+{ stdenv, fetchFromGitHub, cmake, pkgconfig, boost, gnuradio
+, makeWrapper, cppunit, libosmocore, gnuradio-osmosdr
+, pythonSupport ? true, python, swig
+}:
+
+assert pythonSupport -> python != null && swig != null;
+
+stdenv.mkDerivation rec {
+  name = "gnuradio-gsm-${version}";
+  version = "2016-08-25";
+
+  src = fetchFromGitHub {
+    owner = "ptrkrysik";
+    repo = "gr-gsm";
+    rev = "3ca05e6914ef29eb536da5dbec323701fbc2050d";
+    sha256 = "13nnq927kpf91iqccr8db9ripy5czjl5jiyivizn6bia0bam2pvx";
+  };
+
+  buildInputs = [
+    cmake pkgconfig boost gnuradio makeWrapper cppunit libosmocore gnuradio-osmosdr
+  ] ++ stdenv.lib.optionals pythonSupport [ python swig ];
+
+  postInstall = ''
+    for prog in "$out"/bin/*; do
+        wrapProgram "$prog" --set PYTHONPATH $PYTHONPATH:${gnuradio-osmosdr}/lib/${python.libPrefix}/site-packages:$(toPythonPath "$out")
+    done
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Gnuradio block for gsm";
+    homepage = https://github.com/ptrkrysik/gr-gsm;
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ mog ];
+  };
+}

pkgs/applications/misc/gnuradio-rds/default.nix

@@ -0,0 +1,35 @@
+{ stdenv, fetchFromGitHub, cmake, pkgconfig, boost, gnuradio
+, makeWrapper, pythonSupport ? true, python, swig
+}:
+
+assert pythonSupport -> python != null && swig != null;
+
+stdenv.mkDerivation rec {
+  name = "gnuradio-rds-${version}";
+  version = "2016-08-27";
+
+  src = fetchFromGitHub {
+    owner = "bastibl";
+    repo = "gr-rds";
+    rev = "5246b75180808d47f321cb26f6c16d7c7a7af4fc";
+    sha256 = "008284ya464q4h4fd0zvcn6g7bym231p8fl3kdxncz9ks4zsbsxs";
+  };
+
+  buildInputs = [
+    cmake pkgconfig boost gnuradio makeWrapper
+  ] ++ stdenv.lib.optionals pythonSupport [ python swig ];
+
+  postInstall = ''
+    for prog in "$out"/bin/*; do
+        wrapProgram "$prog" --set PYTHONPATH $PYTHONPATH:$(toPythonPath "$out")
+    done
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Gnuradio block for radio data system";
+    homepage = https://github.com/bastibl/gr-rds;
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ mog ];
+  };
+}

pkgs/applications/misc/libosmocore/default.nix

@@ -0,0 +1,30 @@
+{ stdenv, fetchFromGitHub, autoreconfHook, pcsclite, pkgconfig
+}:
+
+stdenv.mkDerivation rec {
+  name = "libosmocore-${version}";
+  version = "0.9.0";
+
+  src = fetchFromGitHub {
+    owner = "osmocom";
+    repo = "libosmocore";
+    rev = "8649d57f507d359c99a89654aac7e19ce22db282";
+    sha256 = "08mcpy9ljwb1i3l4cmlwn024q2psk5gg9f0ylgh99hy1ffx0n7am";
+  };
+
+  buildInputs = [
+    autoreconfHook pcsclite pkgconfig
+  ];
+
+  preConfigure = ''
+    autoreconf -i -f
+  '';
+
+  meta = with stdenv.lib; {
+    description = "libosmocore";
+    homepage = https://github.com/osmocom/libosmocore;
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ mog ];
+  };
+}

pkgs/applications/misc/redshift/default.nix

@@ -1,6 +1,6 @@
 { fetchurl, stdenv, gettext, intltool, makeWrapper, pkgconfig
 , geoclue2
-, guiSupport ? true, hicolor_icon_theme, gtk3, python, pygobject3, pyxdg
+, guiSupport ? true, hicolor_icon_theme, librsvg, gtk3, python, pygobject3, pyxdg
 , drmSupport ? true, libdrm
 , randrSupport ? true, libxcb
 , vidModeSupport ? true, libX11, libXxf86vm
@@ -21,8 +21,8 @@ stdenv.mkDerivation rec {
   };
 
   buildInputs = [ geoclue2 ]
-    ++ stdenv.lib.optionals guiSupport [ hicolor_icon_theme gtk3 python
+    ++ stdenv.lib.optionals guiSupport [ hicolor_icon_theme librsvg gtk3
-      pygobject3 pyxdg ]
+      python pygobject3 pyxdg ]
     ++ stdenv.lib.optionals drmSupport [ libdrm ]
     ++ stdenv.lib.optionals randrSupport [ libxcb ]
     ++ stdenv.lib.optionals vidModeSupport [ libX11 libXxf86vm ];
@@ -41,9 +41,9 @@ stdenv.mkDerivation rec {
     substituteInPlace src/redshift-gtk/redshift-gtk \
       --replace "/usr/bin/env python3" "${python}/bin/${python.executable}"
   '';
-
   postInstall = stdenv.lib.optionalString guiSupport ''
     wrapProgram "$out/bin/redshift-gtk" \
+      --set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE" \
       --prefix PYTHONPATH : "$PYTHONPATH" \
       --prefix GI_TYPELIB_PATH : "$GI_TYPELIB_PATH" \
       --prefix XDG_DATA_DIRS : "$out/share:${hicolor_icon_theme}/share"

pkgs/applications/misc/udiskie/default.nix

@@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub, asciidoc-full, gettext
-, gobjectIntrospection, gtk3, hicolor_icon_theme, libnotify
+, gobjectIntrospection, gtk3, hicolor_icon_theme, libnotify, librsvg
 , pythonPackages, udisks2, wrapGAppsHook }:
 
 pythonPackages.buildPythonApplication rec {
@@ -17,6 +17,7 @@ pythonPackages.buildPythonApplication rec {
     asciidoc-full        # For building man page.
     hicolor_icon_theme
     wrapGAppsHook
+    librsvg              # required for loading svg icons (udiskie uses svg icons)
   ];
 
   propagatedBuildInputs = [

pkgs/applications/misc/webthree-umbrella/default.nix

@@ -49,7 +49,6 @@ stdenv.mkDerivation rec {
   };
 
   cmakeFlags = with stdenv.lib; concatStringsSep " " (flatten [
-    "-DCMAKE_BUILD_TYPE=Release"
     "-DGUI=${toString withGUI}"
     "-DETHASHCL=${toString withOpenCL}"
     "-DPROFILING=${toString withProfiling}"
@@ -85,22 +84,10 @@ stdenv.mkDerivation rec {
     curl
     libmicrohttpd
     mesa
-    (optional withOpenCL [
+  ] ++ optionals withOpenCL [ opencl-headers ocl-icd ]
-      opencl-headers
+    ++ optionals withGUI [ qtwebengine qtbase qtdeclarative ]
-      ocl-icd
+    ++ optional withProfiling gperftools
-    ])
+    ++ optionals withEVMJIT [ llvm zlib ncurses ];
-    (optional withGUI [
-      qtwebengine
-      qtbase
-      qtdeclarative
-    ])
-    (optional withProfiling gperftools)
-    (optional withEVMJIT [
-      llvm
-      zlib
-      ncurses
-    ])
-  ];
 
   runPath = with stdenv.lib; (makeLibraryPath (flatten [ stdenv.cc.cc buildInputs ]));
 

pkgs/applications/networking/browsers/midori/default.nix

@@ -41,8 +41,7 @@ stdenv.mkDerivation rec {
     zeitgeist
   ];
 
-  cmakeFlags = [ 
+  cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=Release"
     "-DUSE_ZEITGEIST=${if zeitgeistSupport then "ON" else "OFF"}"
     "-DHALF_BRO_INCOM_WEBKIT2=ON"
     "-DUSE_GTK3=1"

pkgs/applications/networking/cluster/docker-machine/default.nix

@@ -23,6 +23,6 @@ buildGoPackage rec {
     description = "Docker Machine is a tool that lets you install Docker Engine on virtual hosts, and manage Docker Engine on the hosts.";
     license = licenses.asl20;
     maintainers = with maintainers; [ offline tailhook ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
   };
 }

pkgs/applications/networking/cluster/spark/default.nix

@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   };
 
   buildInputs = [ makeWrapper jre pythonPackages.python pythonPackages.numpy ]
-    ++ optional mesosSupport [ mesos ];
+    ++ optional mesosSupport mesos;
 
   untarDir = "${name}-bin-cdh4";
   installPhase = ''

pkgs/applications/networking/dropbox/default.nix

@@ -23,11 +23,11 @@
 let
   # NOTE: When updating, please also update in current stable,
   # as older versions stop working
-  version = "11.4.20";
+  version = "11.4.21";
   sha256 =
     {
-      "x86_64-linux" = "1mnjc00y1vs3c22hqf328idgsrrlq097kld67ab9q8d6l8r8qkr6";
+      "x86_64-linux" = "179ajawqy43jhgvysc386hdyz9hdandwvh8m2y2rassvycn9kr8z";
-      "i686-linux"   = "1s7m56if2wq34sc8aq46xnhrrnbhnsfi85jw0yp4dpcdwv6s38v5";
+      "i686-linux"   = "1y4z9rb06f2a3cj51xawgpzgar9x7gvr4jrazncqfpfqkv7zayv1";
     }."${stdenv.system}" or (throw "system ${stdenv.system} not supported");
 
   arch =

pkgs/applications/networking/instant-messengers/kadu/default.nix

@@ -19,7 +19,7 @@ stdenv.mkDerivation {
     export PKG_CONFIG_PATH="$PKG_CONFIG_PATH:${phonon}/lib64/pkgconfig:${phonon}/lib32/pkgconfig"
   '';
 
-  cmakeFlags = "-DENABLE_AUTODOWNLOAD=OFF -DBUILD_DESCRIPTION='NixOS' -DCMAKE_BUILD_TYPE=Release";
+  cmakeFlags = "-DENABLE_AUTODOWNLOAD=OFF -DBUILD_DESCRIPTION='NixOS'";
 
   prePatch = ''
     patchShebangs .

pkgs/applications/networking/mailreaders/thunderbird-bin/sources.nix

@@ -4,123 +4,123 @@
 # ruby generate_sources.rb 45.1.1 > sources.nix
 
 {
-  version = "45.3.0";
+  version = "45.4.0";
   sources = [
-    { locale = "ar"; arch = "linux-i686"; sha512 = "a2d1728cec3775a3a012ada32a8934fa1a94ff0af315e395e765c94873593c4e2ddb1ec5acee33a83f2970137087ff1fd6ba23b0bbea3780e4f67a3b46146911"; }
+    { locale = "ar"; arch = "linux-i686"; sha512 = "8db134f67ea813c12d97b0a44fb6169f42b45b8f9e7e151cb6389ee6628e301c95b5ca7492ec5c803cd44225b1929539e81c4df840bb533ef12740c4b9b82f28"; }
-    { locale = "ar"; arch = "linux-x86_64"; sha512 = "d29362ecf4abe3cb7224058ffb421feafe5ddb277ad8cae407907c0939028e7e03079ec3b6a691cf260ea29908be7df4377dbc626704da622548056f45b6e9d7"; }
+    { locale = "ar"; arch = "linux-x86_64"; sha512 = "b3da97b15b71aa536d0acdf08e9e980ddd1917113579db8c9058068bd104b3029c721bf1bac1c9ed56c39540bdb7fd667605259b1c2a8d910401259d2cb0e3e5"; }
-    { locale = "ast"; arch = "linux-i686"; sha512 = "51fb3626875acbf78f0d2337feee07aeaca24dec59042a2b6374afb205dce099df477ab3384e0e9c545fe68ac13af921a8d3a1c4c93f721d7831f3aca15e4783"; }
+    { locale = "ast"; arch = "linux-i686"; sha512 = "2e83efd53b191d7bee999fa45f09583c818377443b9bbf3203b7f11a31b67d371e34980267cc509c47a57b4a6540b1f7f4293252f02138b24869c29bfc64423d"; }
-    { locale = "ast"; arch = "linux-x86_64"; sha512 = "660376e67491f11d484ff112b8b8d1dc9187a7bb7f7ff1e8665d3693e5eee9737bff8f23f69f4d71b2d3f3be0ad4d816febb4894bb17ac911e19ef18411fc667"; }
+    { locale = "ast"; arch = "linux-x86_64"; sha512 = "9d9ef1a1bcbb32cf04e26ad499bf1f8122b3b1a964e6c4eb6726d2271fba28c78f0d7bc60641d8cc6c2a0e1153a25483a6f8eb12568128045f7d6cf5ed6746d3"; }
-    { locale = "be"; arch = "linux-i686"; sha512 = "be5fed683ee9b325f135e65fc6f641d81b7294f3d13f411b36b4e73d68a8b8592d0c93fa6ad55fc9aa8a281a5d2069f3f8dcf029038d867f3b87baf8e4a93411"; }
+    { locale = "be"; arch = "linux-i686"; sha512 = "21cf44b0eb90d3662ef690c56a393bd4453809631209c8953156a1b59b6011fce407c4b3d54d956e5c376f36dac663cd874b4c917f41b9132e445968fd7bc439"; }
-    { locale = "be"; arch = "linux-x86_64"; sha512 = "4b92f1999478d9a97737b31f34ca78bcbf6d657297b0ef791327c73d89a1737a29df9eaca47aed3e0f1ddf0d4925ba6c0a51584ca8009237ea98fec9007e69b9"; }
+    { locale = "be"; arch = "linux-x86_64"; sha512 = "ce33a0750430a462aa07ad8995656dbf2689077746de8ee42ec361c544ccd53e182192f95f6ac755ee739035b5f2a2c8233ac1c37c0d156c4a2aabb39806039d"; }
-    { locale = "bg"; arch = "linux-i686"; sha512 = "76d2450774254052ee216644f53025ffd4a928932955d856e16141a95b557fc327b17f01d4c47ff3b7f8a8c267a6a78511c126980554bf64f5fa5c06eba758fe"; }
+    { locale = "bg"; arch = "linux-i686"; sha512 = "fe763ecd1a572ed6e3864aa9d934b821fae2f91f02d959e22e96314e26271a9f5695930a0388fadd6bd34e0f7ab6938a48bfd346901e139128e0e24483c36d90"; }
-    { locale = "bg"; arch = "linux-x86_64"; sha512 = "53f2463e8838e6dc53fd1212745f401dbbffec484036745114f04e90e2270421efb0e579724023f1a153e2fbf5afb9e31b383b9d0a8e74ec15cdd17aff04b58c"; }
+    { locale = "bg"; arch = "linux-x86_64"; sha512 = "935bc0f19a45314341f76cb53dc4c617a5104a0a17c56f60679974eaec9fc8d9ee609d543a5a310bf4d1e8db6cdc54b660db5b2b85af7838dc5711e10ecff77c"; }
-    { locale = "bn-BD"; arch = "linux-i686"; sha512 = "c798161824be7fd3253308b3157c0dfb5dbec085f2b530fa4a7cd8992b8e602031c0c8f6959449a3a7f988f10b00b1f99f331b017c8d38358a017e54c2ff5166"; }
+    { locale = "bn-BD"; arch = "linux-i686"; sha512 = "d9bdc81c10d1ef370275d3f152669ca50a7fb2b126cdd396d63aa8b7c97a46d815b1fa77b8135887b0f6c825ba87617c81e1f3698e455d75b2bc9862e47fe761"; }
-    { locale = "bn-BD"; arch = "linux-x86_64"; sha512 = "8f8fafa9a79696a81e2e4a7e033edec1e37c44fc6b4a5a20cea0853f88ac978fa536109a81f5fe7baf574af6e1778975b8df5e0a47a0c6cb8161dd19f3e2c067"; }
+    { locale = "bn-BD"; arch = "linux-x86_64"; sha512 = "0b420e4168df1a0b7ff8e4983892de9b08cf644a6e7b28c090477b3efe557a7a34a17ac90a722b497298759d98c1a3346ff84789598359e4052a35b44b3bbba2"; }
-    { locale = "br"; arch = "linux-i686"; sha512 = "9007da613fd8930e669da228197d5be59d53a26f94453523ae468a0b4172adb4509e5ae1677ca21421031238910d19f45323fb09ef52ac95205f1fa3a1d8ce46"; }
+    { locale = "br"; arch = "linux-i686"; sha512 = "5e0726512ff28ee00498a4a8493d4f00e8375950fe8489c3e5906b37bf057c76eca66ccea8aaf7e165ca56b02ed14041efcab8b75170ae4daa2b2df2bf2ddc8f"; }
-    { locale = "br"; arch = "linux-x86_64"; sha512 = "57cead8865a052981729f55f85f402329dd4151cf3f89ad5c6cc1a83a068a9ba1e309db521ecde1cf90a3737b04a7d992087a68b93506ce0ab4a7ea26253b761"; }
+    { locale = "br"; arch = "linux-x86_64"; sha512 = "1240f62d8a0530ead4b19983a36bdd894b5f812c82b68c49a4f7d9a961e0ff2542244ef405e03bb281ec65f070e815246487347a99bec76dd3509ec4512c1d47"; }
-    { locale = "ca"; arch = "linux-i686"; sha512 = "5401395d2e57ada9b62fd1d8a90006e60884a38086fe74bc720109d1fd8d989292bcb2781c1b30f19fbfcb867bf157bf33c3948463ab1e0fd8ddbfbc790b492d"; }
+    { locale = "ca"; arch = "linux-i686"; sha512 = "ce79eebfe0a93a9e15237317fa3dcca6fd6f20c90adf431366e5d30ce026da0f4af4e1be0745cfa6620b2a75838fbed93a85ed0695c486eb46b58cfb3cea3571"; }
-    { locale = "ca"; arch = "linux-x86_64"; sha512 = "1d69ddc33643c7227d80cbb61087a73ff46c79e1531479531201b4e49a53400fc576f445306dad20b318f189e8b739179390f9ca7fd340e2d2cac46650569da6"; }
+    { locale = "ca"; arch = "linux-x86_64"; sha512 = "f290ac184b7086349a173b1597341731b6c696c8806b3b5adb8e7f0121f298ae9971f8f96981662bac72079f03d7d2ce17f0c385662d06657a1519d7bf32ef64"; }
-    { locale = "cs"; arch = "linux-i686"; sha512 = "25a9c864e60aced998c1599786a9cb3db92c02b9d855c7500fd466cd92f4bc8ff6fc7c5cb37c52b3dbba990ae4ce0eee1854f4f3459b4c2ce50e4e4ccd3ff445"; }
+    { locale = "cs"; arch = "linux-i686"; sha512 = "a06b8a0db00b35ba16541a72623fc764c87c45e15e69079b757449e9c67988764f65bf6ae214ac4a0c0c541549fb6fb48bd1dbb2efe02541e3bda12938e2d787"; }
-    { locale = "cs"; arch = "linux-x86_64"; sha512 = "0b1b72a4f43192afa03fcf17e234fa6d09ab20cccadc0a58682b37c96a576c31d2e5022d3d778992c188b826816d7d36e56fbf4055a0be2213e45062a162939d"; }
+    { locale = "cs"; arch = "linux-x86_64"; sha512 = "b96dca42026adb793ab5d37544d42ff8d5668adbff6a94f6c37a33ea63eb87622a7eeee8c02976b16c1d8c38b3348387aa46daa2bf5ccfd66f2a176ba4c113ff"; }
-    { locale = "cy"; arch = "linux-i686"; sha512 = "b69312902ede9687c804a068f9fcf70c0c3c68786d92c72a5b38ed38e9773382223e5d09a2067632b02ae9e2f224c85e0c95de9ada535e0b8e37ce5f6aa86006"; }
+    { locale = "cy"; arch = "linux-i686"; sha512 = "dee0395f80b3e0db7b6cedf3d7e22b574f3f2734da518db684ab8ddfb502a127d2e0c75849819638ea61fd8604b84f8b1118c036d8ffd5f444ebd8adce19fa2e"; }
-    { locale = "cy"; arch = "linux-x86_64"; sha512 = "bd03a664a14c2b7271db1ae66f65fada02eb995da9d8466f345d25b40bbd7f836e48e9e8f19276f7109e5e42effc3be70d0c20705d386620319c6e2c920027c4"; }
+    { locale = "cy"; arch = "linux-x86_64"; sha512 = "8162ba8abda1906ce0fa78455faf823ce4bf6eaab9ecafa50b5669f2485861f59fe2be3820d75d7f168432ede5e9ced170928e883ebd06f8ab3145065f31e610"; }
-    { locale = "da"; arch = "linux-i686"; sha512 = "2fce874759494b51d9f9081f26985834527984cec849f1f07ebd0f3b7523bdeb7a39cae6d17f021e82972f392ae7cc33d6b81606f81afc7bc35a75698889905d"; }
+    { locale = "da"; arch = "linux-i686"; sha512 = "f5bee461d1e0ba0ffc1de1fee05d41d0aa9db904061a7e4947d2a22ce8e3eb9ab40e15ace81a9cb248f72b5c08b699b39b46031f5673045eefe2e3346e7ae18a"; }
-    { locale = "da"; arch = "linux-x86_64"; sha512 = "c7fd6b68f50c2ea4abb2d72dfb804db0e5ff3a8dd932f36fb7e9f194f4a12469bf64785ba18ad6f989b5456e6a0387c17fcf421075341998dce315f658b70058"; }
+    { locale = "da"; arch = "linux-x86_64"; sha512 = "dab187762c44a7092136d5b12be43bb3675c37dbaa1ffb36171e9cc76ffd94fd0f80872008bd686515f0a84c3adc9c36d5eff9240e871dff457145bc21981777"; }
-    { locale = "de"; arch = "linux-i686"; sha512 = "8661fd16bcb94fba14156ea0d569364b495dd470359491b482f6e9c957a6ffd1c9b3a60728d6a0755a1789d6c3029952bead677df38d3f7e972469cd877d96a2"; }
+    { locale = "de"; arch = "linux-i686"; sha512 = "35994979446f4bcf5a6b79875e84999188d8ee58143b741e583302b29c0619566b5d4d65e640156168974e4c59c7d454ffeac47a8aaf35c344bcf2ec44520334"; }
-    { locale = "de"; arch = "linux-x86_64"; sha512 = "c98b8afbd38e3ea31196a2dfdd3e8a13639aed9a3052a25dbcf851139a75167481b67c94542be310c5a2fd8850c8396ff2fbb57ac14b0158c87b6e30562d1eb6"; }
+    { locale = "de"; arch = "linux-x86_64"; sha512 = "ae7169f84c945cd7886ef0ee84a1e57cb3017ad89b991c0f8dfb36d5537c2d9253345e111916a234c228a99e153c9d8c2f5bbb61e3d4d5fcbe95f507d863b735"; }
-    { locale = "dsb"; arch = "linux-i686"; sha512 = "2e5f781f0ea57f4cc129693d5085d17047ecdde3273a97b83717e793bef2693ddd543078c667635e2603e5a4867fdee60cecf0fe47170f84d31456c72f4753a1"; }
+    { locale = "dsb"; arch = "linux-i686"; sha512 = "1b10d6c4da26452c89089c2938db3559cc46c098baf917ebbcfc1d107bd9591630749aeae87a5b9e8819ebb5e4ad2b7d5321531bbdc3045df604e3929d2d6d93"; }
-    { locale = "dsb"; arch = "linux-x86_64"; sha512 = "fcaad0f6ea4f9610bbfb5efd414005ab1b62d13799e2f0ff0188c0e262910c881f0e7ca838c6d18df0bc629eb26e4dc34e48635fb64029f484c0fe3aec12cef0"; }
+    { locale = "dsb"; arch = "linux-x86_64"; sha512 = "c6195bdf00e05921a19eb37a74c34794cb08d8b8cd43609eed9f64bbe89788d9c87a45df449cc400e6cee31b7ac6f02ce57083581c85885acd620931c657a833"; }
-    { locale = "el"; arch = "linux-i686"; sha512 = "d71b2805881cf5b7f0c06e398289907f224bbb58ffe676c32587f98cdfa6d80b1a8497bf4d1d515a4b1ba8472f5250dc7df178a0fd47baf51746409c18157d69"; }
+    { locale = "el"; arch = "linux-i686"; sha512 = "e7d7f38fecea77d93bb99656a6dd566c6f396e108910152917cd1c908f09d1f276385ed771d5500feac572356e688e43ab3a91651d64bd7d522db9daaa4f32ef"; }
-    { locale = "el"; arch = "linux-x86_64"; sha512 = "89309f36b503f1be5a23f24def962a7ed6604369fc1e3a254deaf3fca6b020837813e7b3a5896320620301eb14025c604121c4b6727f1362d6783da6256be039"; }
+    { locale = "el"; arch = "linux-x86_64"; sha512 = "bec617a64ce06f7aacfd936cb85f29684d1afc4246c05f1de6bf1e11819a44eec0e395a446e64676fe6453ce41f173f938a845fb50a625e3f5bb325098e09d11"; }
-    { locale = "en-GB"; arch = "linux-i686"; sha512 = "233fb74c88ff43fc5520fef6fc052019551405ed43e786448c9b7921fb620b81b8b1569dbd3c57b7e8a0aa34043b29fa388100ab0ad66545bb84675de43d4b9b"; }
+    { locale = "en-GB"; arch = "linux-i686"; sha512 = "c06fcb56eafbe894e15a0380f49ce5455c95b2b6c9520ef3b15f699778a575e5c643db5797e72441a68e063bce0bd4c0003cd0b58c78c7d1a744223598ab3549"; }
-    { locale = "en-GB"; arch = "linux-x86_64"; sha512 = "70dddef3561b53d359ed59205dd77d661f6842a7ac4a62d79f2f2576a7d2b9a8735ae7e48759b669bade841dd7329857d4c273fd6e202f1ae22201b7d461def3"; }
+    { locale = "en-GB"; arch = "linux-x86_64"; sha512 = "1b095d5e254c2eef894b9954f42031b6e7eedbf0c753ac3e9f7b51b152dfb9c21d90ace238fe5bd58c63292587e477d23121dd0f96f7489b7564ae1bca27eef7"; }
-    { locale = "en-US"; arch = "linux-i686"; sha512 = "bf1f75d614dc0e401981b81d84911f2e13a1c8fc668b8a7c531963162ac293f72d6252aceb4447c97c57cc3b632452de6475f294f82090751141c3f8f681b868"; }
+    { locale = "en-US"; arch = "linux-i686"; sha512 = "7561111abeda21de3c4c9f585528ea9fc76409b15c0679b22743180f3b987aefac19ff45a682519511e347b0881e0f924f4efe35a782ceb4da9c6af05132fb78"; }
-    { locale = "en-US"; arch = "linux-x86_64"; sha512 = "5b7ba243783d5bd3eb1acc6cad872b5f2885cf289d33274932ceee2159295c84230f692a1338fc4c4c3e1947436917251ed54a6995922b4777bdee7e5303ec29"; }
+    { locale = "en-US"; arch = "linux-x86_64"; sha512 = "2beacec69acea8bdc98b5a7df5111318c6b47bbe1bb4356d3f9a2ce3b783ce6fad01a3ef11658c9d24d89e5c3f3e5c71de6b6623e93187d1221c25d415dac3c4"; }
-    { locale = "es-AR"; arch = "linux-i686"; sha512 = "9fddac56cc41a0b83c794ad7b7744573a6039c736d785a46666fb5c40360aae0397d129e523a7ac8b7e9b07295b56741e96e8cea770533c7c3611c209f9ae5ad"; }
+    { locale = "es-AR"; arch = "linux-i686"; sha512 = "c6d1fc35bb89ed23b5f4e3be2fa6c28c3e29a7e821be1ae79345bb26a6db1ecae67b27f7ac9d3bd5bd803b6c7613aba3f0ad35cb07b607c1030f84a365da2b2c"; }
-    { locale = "es-AR"; arch = "linux-x86_64"; sha512 = "f7d7a051bc7411d2811aa5672da7aff51ee96065eb26e47e9eda721c0e125a529353a6290195cc257f36e44dbca6d81dff1342478a52b0d700f7def335135440"; }
+    { locale = "es-AR"; arch = "linux-x86_64"; sha512 = "e3c95879782c17963e9f17dfde11a416502bb89d5c712ae445bd476e1bc1fb76bb0716764150b2b1f92ab8487d736c39f29ceb023f226b92f8c07bfb7da8e76e"; }
-    { locale = "es-ES"; arch = "linux-i686"; sha512 = "b0b32a37d13b76899037c7d34e2444cb45d54166516c6f6f141ae4713e5cca36827c0c02f4d9614a1c7eb5d9d859087586dda3e311d221f19091414557f9b713"; }
+    { locale = "es-ES"; arch = "linux-i686"; sha512 = "3f8f3263650fd4722da121566cd9afe8e671005eafee26f550a940dd76b1ed02c3f34f32f886c2cb2e2b1ed029f9997f2686a2494f4b24b6f32a7bcb8226f6aa"; }
-    { locale = "es-ES"; arch = "linux-x86_64"; sha512 = "918affe04e2dbf1f8d2f65a8a16cb30d575631d323eeb5cd29e76f2b30d003337e35792e57f78ca6bf8abd253f005296b44b71ecd4c48d055456b8820a2b8551"; }
+    { locale = "es-ES"; arch = "linux-x86_64"; sha512 = "587ca874ed5e035291099db107cf29f19562c0adb785c33ad92bab9d5eac2f2615143b5587bf7da7df61c071995eaf7894e5733d2fb311ffa14671c14aed54d3"; }
-    { locale = "et"; arch = "linux-i686"; sha512 = "7a2aaa9e81fa166ad66ef6a275ea1e1b1f333946e73bd22c7954b78641949a870e8c4ff38f763ef22bbf25cf81ad0138e5d4b154b1d2cb90126ef53e56b6e676"; }
+    { locale = "et"; arch = "linux-i686"; sha512 = "a08b99a3e444135d538f3b53669a2f4e900f86406e74076a2ca986c7d9bf55661aac248fa564eda3b6bd491cd284690da9c61a56a43f2884167998a10b666785"; }
-    { locale = "et"; arch = "linux-x86_64"; sha512 = "cfb751a0d94cbc3e130abe78dceb81117750b16c9665860a083a71554ce96e9102fa3c8b084c7acf07c9e10a8fe30e54e5964a214486c2bd16d93678a4b6948d"; }
+    { locale = "et"; arch = "linux-x86_64"; sha512 = "97043053f1512e6ac7298208e219bd2cd8dd1abd403ecbae90e365aa69b098becdef3f6cec9998fc71b237d78e3b7693fa93cf9452317bf1f4793425f23c0b5d"; }
-    { locale = "eu"; arch = "linux-i686"; sha512 = "c99dd3738739f06963cf3e31d72831d8861c898ac512b0563f0d9ab21e671fed55c0e16e07ff87e058873095204a81f1756d77453e792bcc522c81d6ac26638c"; }
+    { locale = "eu"; arch = "linux-i686"; sha512 = "2de3d5915801e62196339e6acaa7f601740212a59f4ec6c684cb40c830bc6fdab843b3497a168bc6b2889f80449900406c05cabb3ba656d7d6b0be5750a31aab"; }
-    { locale = "eu"; arch = "linux-x86_64"; sha512 = "4726d30ed22d79edca4d3a6082ecf40cb107b28aeebcc1ed21faca951cd955fca524d4c16f4e9ac71fd57651c2392d79c5adcafea9a7dadbe84dc3e3511f47f4"; }
+    { locale = "eu"; arch = "linux-x86_64"; sha512 = "834f9e712183f14af927ccb719325dad1a7f778d7d3beeec87cbb559d039b8764efb9447b8a0e40eb0ad55c88b525e5bbc2e2f5729c11b173ef86f63e4f92974"; }
-    { locale = "fi"; arch = "linux-i686"; sha512 = "3fe4ae74f046a0fcf95570ff7cd00abfa63567153bbabd036ecd8cccf1aab075b19e43642e247c741165d3990f1690d4c7f4b3eb16aaa34188d1bd17c202e06d"; }
+    { locale = "fi"; arch = "linux-i686"; sha512 = "b8b1c42b3ab0a365c9a478fea0e83ac49b709dd2d117c1d8ed6fd7946b5dd32a1d3907b653c5aa0fada4ba8cc365ee9fc723fbbed76219a7c5d4b70eb68dbf65"; }
-    { locale = "fi"; arch = "linux-x86_64"; sha512 = "5e76a85eb66d62c2fcd42d0274e43c052131bd2a8d54bce256e417782d1b97985cc9a917fba18ab1118e72fd3bacb94abdf5620c1be9a7225f6c9b62f1eb0e02"; }
+    { locale = "fi"; arch = "linux-x86_64"; sha512 = "64b5bc313fa64abc56961b0c6abdcc6fa72cd321f422857fece9bfb3673747d5992d96dc9d98a76c71148b6261ea9a750147c94f171c548170c0681d597d8402"; }
-    { locale = "fr"; arch = "linux-i686"; sha512 = "216e084442018d1e5925d4deb14c11bda248d5015696b22167693f2534dd98049dd385bc3061348085113487b93cfea675cb7ea528ca4385022b33860b39633a"; }
+    { locale = "fr"; arch = "linux-i686"; sha512 = "45e7a37ac6c18d31e834b88789d6039bed489bc1cb4601399b3cf76feef52c3c36249e297750d39e3e3071c2d90a1ff6f0bcfef8bec89997ac552cceff88e78f"; }
-    { locale = "fr"; arch = "linux-x86_64"; sha512 = "6fbb2935899d94b3f56b27c131e2574f6735fba4147430a1dd5cd8728db29b90fd1416bc3661b1a3a927f496e9d716ae165ed8c65951184c2b1e07c962f876df"; }
+    { locale = "fr"; arch = "linux-x86_64"; sha512 = "02a31ae95b6a6dac76eabd8e1de27ff50f29725be221841a738f60e41306d39ea050b73f78105561344d042ed988955e1801b5379bcecadccc89481c3bfcc13e"; }
-    { locale = "fy-NL"; arch = "linux-i686"; sha512 = "f752dbe8d2e90c0b5e60faa0b34280050463ea1bdda0749c9d46a46f08339e5952eacf70f0765144677362c9dad51c24a3bdffeb89e309563e472484f436993f"; }
+    { locale = "fy-NL"; arch = "linux-i686"; sha512 = "bc14d4d16f0b196eaf92d551df6b565bfdf56806dc97714e97db7fd201c6e4e80df0485f77ff4bc5218b8c2f96a01a39f87c6c3e156c5c0cd72a8b932248370e"; }
-    { locale = "fy-NL"; arch = "linux-x86_64"; sha512 = "302d8bf3941e0dff52918202f7f885dcb14ae9504baf52686a5c9201a644d469c57925181074ac0789d437d9bd8bfa965ae2ccbd54f51dbe2bc352b29d4a1e9c"; }
+    { locale = "fy-NL"; arch = "linux-x86_64"; sha512 = "025411d23fae36123a86b72818b486412aad0f532631e4c48da5dea9b41d7b2875aba463a4a721e422cc4b141c8cce155dab01fd7056dfbadd435cd3e3061f08"; }
-    { locale = "ga-IE"; arch = "linux-i686"; sha512 = "be52801d6995cd377d451a640e319c2b812d83d62cbb2c3bf7063a18f03838f9b758add09875aa9e4e973b3ce3ac285f6f3486a7495590acf5672ccb900e5528"; }
+    { locale = "ga-IE"; arch = "linux-i686"; sha512 = "56d20e9bd013dea41f8686f7ab4da48b1c96e0d93c7639e990daf174cf7c9313ab659eb9256f8ee52adc9659d6ce766921eab1a24a0f963a8a8dc1d614ed34e9"; }
-    { locale = "ga-IE"; arch = "linux-x86_64"; sha512 = "a475b35c3fbd9fee3e4fd1475b9d3138d58df296744660dd8cc1932f121bbe9b1a2324c6452a4159b5c97a3846f38e92b9214a512d739a897cffeb40805cc0c7"; }
+    { locale = "ga-IE"; arch = "linux-x86_64"; sha512 = "1bd36aababa4fa8e47bb62d9a49b2a5303b5b0404f5ea370fd4b6b152327766a42bc6c15a85c693aaf532b9c3aa8598911e313a861d3eb946bb4ac8d0642de6f"; }
-    { locale = "gd"; arch = "linux-i686"; sha512 = "88e209d87e38dd950b1248351d6b0518f63dd27423d2f30df1b177740dda4fb3568e19361b066ddd758fe071a7f2c747f8ff9307d6745b9d68002bb34be5dc77"; }
+    { locale = "gd"; arch = "linux-i686"; sha512 = "bc0f98937cb2c2ef98ebf6625179f77d36d12f6c95eb413cd570f4b3a9fbe733888b57ef946fcde2daf59183291a8bd1258e8c7f80b260e6af3138c8b83117f9"; }
-    { locale = "gd"; arch = "linux-x86_64"; sha512 = "a56c26c2393323a8ec9190a89b3c1a4a27de9086222791e6cc84de0f640e2700274b92ffda0a21aa1de39684443108499122a12fbf5ceec3df69301132cf3463"; }
+    { locale = "gd"; arch = "linux-x86_64"; sha512 = "d2729fddbd4db455b1f2b738d9bbd6d155db664c01ba6617128728caffe8f96aada8b02d49fb1b90695c4bf37db6960f51d6c074b5df94ab4e74996370679d2a"; }
-    { locale = "gl"; arch = "linux-i686"; sha512 = "bc180ce7132641596151a1b6516b6ab9aa6070c542fbe90be7e440580c8f7a488348ba238922e33c8aea10505814604d5f5568d03978bcc75db536a31f66c4ce"; }
+    { locale = "gl"; arch = "linux-i686"; sha512 = "6306be1026b9127e455a3b0c720f7de495811c3bfb578090ee33d8b4200bec3390c006767d45ce165b57325f1c41e98ce078cf78bdf0a2e9d0bf5fd704cf8374"; }
-    { locale = "gl"; arch = "linux-x86_64"; sha512 = "92bba67974146f832d91c6d023b60a7d4dd3f0391f4df9744379035bbf6fe2ca43d8eb81e05184658da34d5519b310f06fe4429287874ba618d3720931ef89a6"; }
+    { locale = "gl"; arch = "linux-x86_64"; sha512 = "cb977c4f60041ccba81ae9708b381d8e073c2041104549973f33695d6f08663d23fc9dccc112d6fd9e4c61847211ecd2b762b81d842853ff80a7b813955295c9"; }
-    { locale = "he"; arch = "linux-i686"; sha512 = "37da8123306823963ac02c9756d5ce3e76207ee0a1652fdad42cf2c8467062f1369c8f6640625fdc049e2c024d6ed71cb3c9c669d18e1d737246d510102d1d89"; }
+    { locale = "he"; arch = "linux-i686"; sha512 = "e39c70ed7711a4c7c5baf0594917e2727bf0d081f9d38d2f0d539e557fa9c20e639c3e98ef8926cdc9f57ffee2c4b8896b044bd1fe9aeca39e64af2b56e35dfd"; }
-    { locale = "he"; arch = "linux-x86_64"; sha512 = "62bb1f1735c13ac7adef4ce922eff64aba486bb2274691b8c3df12c4d87c30660dd2054e6fa314f56a690a0a8bf3533237d0d4bce89f83cc7a955e8de3f9fc43"; }
+    { locale = "he"; arch = "linux-x86_64"; sha512 = "86ad9d155916dbf7318fe054286b8808bd6072735b6264db61d51745abaa975311776d9a15da13b9f6c536e78714501f1855291bcf59b49cebc047da112fcc91"; }
-    { locale = "hr"; arch = "linux-i686"; sha512 = "b36128139442da20bdda63bf325a12e6f7467fe8f1baf8a56a3b0c55c8cce45f8c5a629b25a97b12c86e10fc12cddc2edd9aeea651bb9026427c6486270d80a2"; }
+    { locale = "hr"; arch = "linux-i686"; sha512 = "e82a125725373a5fcadb4ad010809fd307f5caea4bbdb428cce3c267da197bc73355f655397283fc6bf93838ce41896b7d6dd1174fc56526a04b61559babf42d"; }
-    { locale = "hr"; arch = "linux-x86_64"; sha512 = "ec3c826ed484ced10b417320d50f3c0c9b955b71eb656b2469c7a3268d712579901cba904a789f5f6a2fab6d7707401ff1ea0e112a575091c4196d7bd178387d"; }
+    { locale = "hr"; arch = "linux-x86_64"; sha512 = "ba8928e57b1eeeaa2b1e1b95ef87908247695b09d3f7220113820cc13a07223088a1c0468e362488b303a60456e2d63c631150025715d3a4b66b6a6204e31c9b"; }
-    { locale = "hsb"; arch = "linux-i686"; sha512 = "274b913c0a5c293b45c622c360380560c62b19772c0d5616d46040b6330cc5c330177084f743f2edc2624c88bcafda748fcd3beae606adf7eafbc4711845517e"; }
+    { locale = "hsb"; arch = "linux-i686"; sha512 = "276a97640f24aade9d0658529e13d4e50b70bd5e98d30c43d7af6e0cdb368d3a54ed9365aea9cc03bef6938bb3c7dc0649ca09543278538fea5dc24a15ab5072"; }
-    { locale = "hsb"; arch = "linux-x86_64"; sha512 = "5af289d7d57645959c0b1f1437239e8ed989720c586b6dff7734bd675258f6876b467b2e4a29686ac0f703685e41204b702df758ea25410271ecad9d9beee203"; }
+    { locale = "hsb"; arch = "linux-x86_64"; sha512 = "ab527b02bc792b2fe2a939a82b5ef4797f7ae94144a5161e11722d46d38da75203139faa85655248e4aba12090d79a46a0db0310b32ec0db02c4e68e932f0d2f"; }
-    { locale = "hu"; arch = "linux-i686"; sha512 = "fff9201e818d17b8ed453d272c5095625edac664555fc028efa9f08d23ad151d5aa22e3ddd9ee0eae9d0dfdfac27ca882107f12aa023741bcbd20be61e11c457"; }
+    { locale = "hu"; arch = "linux-i686"; sha512 = "34e1f7e790deb7d4594f2edcf6ba1641730bdb6ceb72fb08071daed02713de8ff6931e3986fb3125646ecb3d2f299e5bf5028fc0425ac9790d57d4aace9e81f0"; }
-    { locale = "hu"; arch = "linux-x86_64"; sha512 = "cbe561fbd504b14c59e5db745dcbf83edbb5bf1813f86888419d0dc5cab43bc700f96782c36d1bc8c8732311758209faee5d9755e872e626c0a6012e5be6e441"; }
+    { locale = "hu"; arch = "linux-x86_64"; sha512 = "e7df1f64c41110d56959237555ff3a066b8d503f28c6d504c7080f3af2548d5ee66a60771872065222db57624b40d1a647aa278f89c04fa3c520730147227c83"; }
-    { locale = "hy-AM"; arch = "linux-i686"; sha512 = "954e697b2400b93fc575c7336a613d3d63702e80a12617a9c86b08e294bf4dad54c2cae4669525e88ecb55a0c029bab028105659a12656f03ce2ba0f0a7e71b1"; }
+    { locale = "hy-AM"; arch = "linux-i686"; sha512 = "356ac76891199061fd4698c51903ddc7e92858252a6ca502543b0403790b9b80ba8799e847a00331f19b6ab56d2e3d02fac79ec7b5502ed8227c5abd82ad3fc3"; }
-    { locale = "hy-AM"; arch = "linux-x86_64"; sha512 = "9e27956960fb2154e8c4b895123ceb0cbc8538f3f4563e2888db2d056605de0612a629c66f3db9a9acc3db7032ef39b553a9791a11489e89b6485c00f0e1b903"; }
+    { locale = "hy-AM"; arch = "linux-x86_64"; sha512 = "410ca6dbd22d870ec4d74e0dc19b65009d860e93b905dc43ae0d5086f83ad1dbae81d2213b0f39afbd5e428287d0f35e5c7b923df594494e66fcf08d4663cf82"; }
-    { locale = "id"; arch = "linux-i686"; sha512 = "bdedb03a25ec664c0443fa4e1e0d5dfa84ac5644e2a5dcefc67a714b71c2d18d9a38962e7ca2661f4d0d4d518d3e4eab51fb499efc32825a0446387cd22ed34e"; }
+    { locale = "id"; arch = "linux-i686"; sha512 = "ddab3b64afba2862a18879845cea3945fd3a34295ab07e5c7f53435ef8af005fdaa3beb5fedbee27818917a320fa5e1d1cdc618ac1767db9ceb1bf3c912720b0"; }
-    { locale = "id"; arch = "linux-x86_64"; sha512 = "2c18f2b919a64f540e5a1e59a430d1c710959711757e06fb38a12b67f0ff139ddde822ef7cdf5836a32d3bf904e56fb56e9d8d97f9d49cf35b67650be54e131c"; }
+    { locale = "id"; arch = "linux-x86_64"; sha512 = "4b26928f579b56c965992b4425a9af6d85fd7a288d699942448ff8f331833e53625f0d48e62794356ed7056ce75d0efa3fcce3f3be9acee099060b4c5a20e281"; }
-    { locale = "is"; arch = "linux-i686"; sha512 = "73e866f713fc38ab7e56b97c985db69d49bdea2007c84e2ba54638f07433fc37a1a65a1189dd2b847394811e57ba8c767e20756686ec7fc86dcc3248168b110d"; }
+    { locale = "is"; arch = "linux-i686"; sha512 = "8ad9065d628cddc34fad8afb5477edc2ecbac7add4162c87e6790bbee58e8d40e40b087f879fd09a44f180b30e3929bcfe2ed268fe5bd549c0d5c011be7d974a"; }
-    { locale = "is"; arch = "linux-x86_64"; sha512 = "031c069a6c6dd79f21594dcd64801c9f11bf4e41ba8efd3b17020fdebae585ea746910c0186a5dcfb5a073ff33807d8324932e5ef3c2e04b5d35e24a714f2cd2"; }
+    { locale = "is"; arch = "linux-x86_64"; sha512 = "f2a14977d98e0e7575dbe1f3f068472bb90d25a9c333ed191ee17fbf647b1c47143136ef7fc1871bcdbf3b55c2d414a05a119a7a2337b9cd05f039d74915c727"; }
-    { locale = "it"; arch = "linux-i686"; sha512 = "86bf4650fabfb9716d228e8449792b620a0692e3f5c6af19398cb37b1079cdf79f42795e16cd13c6ed261c1a81b7b3a23ba305299d03bcf1d716ee0ccade903d"; }
+    { locale = "it"; arch = "linux-i686"; sha512 = "18a3951092f38dded053b25658da79188aff3a3dd6e008f269b0b4c32151f7d2d2483932145ccc50c6c9d199af94b43abde65b61e8b1093d9b4c52692382d8ca"; }
-    { locale = "it"; arch = "linux-x86_64"; sha512 = "5225af86242544e4fdc176fa68463c9ab03e4066ae57266f112aec179f7085b7621df7e46e34302bc3e3e30dc713eb45af568b86bfb1a4fa6b01f50fe677b5b2"; }
+    { locale = "it"; arch = "linux-x86_64"; sha512 = "f834a9ba6f6cc2745d4e54eb73ef174e913009e82e989d1386e8598f9f83c32fa65de6902de641b62ebbf183a25f0037d119bb61884f3548d8f425fa63c9f5d0"; }
-    { locale = "ja"; arch = "linux-i686"; sha512 = "401e4c7b9831f2a3342764b6a2de732c89fe5687ff1e611c4ba1b630f22936c0343b3ef5ec444925ccc68c8ad45cd98d67ca502c32094adb567bfa64481e82c0"; }
+    { locale = "ja"; arch = "linux-i686"; sha512 = "f91904e585e30ac18e4065046ec184607705bce423ea79aadbecf32fa0f9f598a439ae8f955e79389c411f0836dd6bcf9a74e1e78cb70471a3c523a807e43c41"; }
-    { locale = "ja"; arch = "linux-x86_64"; sha512 = "7962eaef19bc5bdcf5f3aa9dad6df110ffed9b247d13dd61f3c4c170e4c854985d061847b84058bac35c16391821bdbbf5ed05120687cfc75c4baeba2de6f5ee"; }
+    { locale = "ja"; arch = "linux-x86_64"; sha512 = "3052946955110d0f1df66df9933079bbe0b0247f9eef0a07c02c43f6463055bcde33e27b7ec1beb511e70f3b524d55ab404a0be755599f9e15f1902b4eb457c4"; }
-    { locale = "ko"; arch = "linux-i686"; sha512 = "d09e2083db577b308a65d1600bf15cbc6cae7b5137c66782d922a28588803a58348f87df5b9cb2cf9ca00713d542d441c5947475b551c8d5d929dc6293c00a48"; }
+    { locale = "ko"; arch = "linux-i686"; sha512 = "e0f79d30960bff54ee064ae381dd89b877c2f5055424eaf017382f6b2d1d0b34544cf3d88fefce8f2e294e84477e5109a17fca83083b0c5602ea5d0eec7b9c0c"; }
-    { locale = "ko"; arch = "linux-x86_64"; sha512 = "b8689c851b176ec82b73566bffecff54c0e6c85efcae7deb9dd542360fd7a0f8a6f8e53c193060dc36a98203ad7024a0c1d408ac2348f59fd9f3cbd591a17e5e"; }
+    { locale = "ko"; arch = "linux-x86_64"; sha512 = "ce515c74e7d69394f79ff7adf6ffe2118b0dc76f49672f19cbc299b21705ba18a88c6780f88bf28bcbf208ad33914da13031617a20494160d771ec09c10a798d"; }
-    { locale = "lt"; arch = "linux-i686"; sha512 = "8d5bd77d3d5d1b6168b65458bbb4f2409c447cfb6d019fcf7f8d81b3d4d486203533d3acb8a59257e664296636ee5b192b237ebf070b37a729926ff11bd81090"; }
+    { locale = "lt"; arch = "linux-i686"; sha512 = "f9d00ec17abd13d575d651caad02e1a46adef760ca6b706df31708375b7c721f3cfd1d99964cc2e16615f5fc422855dba8fa722d57b355782dba1541cf32e1e1"; }
-    { locale = "lt"; arch = "linux-x86_64"; sha512 = "7314e8138a913c7610227cbbf71d535f85bf008e09610d742d996be391ff4be0e9dd4daed8fa3ccf1e1556e5c66982e3f2cea0d34d76d78588fe9926420af75f"; }
+    { locale = "lt"; arch = "linux-x86_64"; sha512 = "2572ee32695dd0abf10a486453a3ca9d7fc26e88993a374677fb5f96edb319a5ba2892d8f9a236195ecd8199a7936d3969830571411ea35a8dc1f229089595e2"; }
-    { locale = "nb-NO"; arch = "linux-i686"; sha512 = "6b1cbcd9888b400ebcb4eccd416e12d09f29431a4afa3b890b05721d1c4108c35549c2f70800ca386f3b21c66b42be3d00a730d4fd2a4ba9c62069c92ab726f7"; }
+    { locale = "nb-NO"; arch = "linux-i686"; sha512 = "26db6cf82400b4a1bff5747d4e301c46f3391b97e28b64716e2b2dcfb2ab2da583142b487f90fe0798bee3cdf49d5965b9d9b124e95f1d65b32c9f84c42a7ebc"; }
-    { locale = "nb-NO"; arch = "linux-x86_64"; sha512 = "27f278b9f54b563f0aa907448eba04b4f84c9ab33eadb4737a662058e904e68baa481625c0303764ac7416cf5cad7bcf94a651db981fbcf94ab8e93625555415"; }
+    { locale = "nb-NO"; arch = "linux-x86_64"; sha512 = "9b83eed9b3e93a5ddf463aa631bb4905abb8e02574e1be8a4cc9fe5cea7f3aee743b0f570a748fba67adbf6096a8443378ddfeedaa9cb0aa8f072dadf906929d"; }
-    { locale = "nl"; arch = "linux-i686"; sha512 = "d932296e6cc61c634ab09a66328335e0c6049e9d6ca660a862dce3cbe8cc0900fb3bdc0956b82c9f70f18f5c68c1f37acacdd7a3b8a697acd24df1197683aea3"; }
+    { locale = "nl"; arch = "linux-i686"; sha512 = "ff00b25886df3a9ff0eb9c4c9a1b34be21edc69ac20f0d994b9dd9b0618037c92c15ead664b071d09766a0e764acb5e118185dc3f08c42f2cca62c4c70fc8ffe"; }
-    { locale = "nl"; arch = "linux-x86_64"; sha512 = "010e833b541b1a9ef20d10a1678b7b25cf2a9268cfc6b6f0f1c1e5b1803bfdc4cd214b9e3a86132f1335531f107773dfe01f9f4dcd996262dc2c3ece491b36a4"; }
+    { locale = "nl"; arch = "linux-x86_64"; sha512 = "6796f4f3d1525a3b617c99eacec76c1cdc5c8fcadc39120d1da052518cb663093c695060b37120ea6337e21b9fcc20c5a5119878ba1068553772f2d8ed89db32"; }
-    { locale = "nn-NO"; arch = "linux-i686"; sha512 = "b2ed20a973248031fb63b5652f6eea2c572c1fc2d8dc780db4cfa6a0450ccc211effc1d79ac67718b444f0247f8659d134586a0abe829df4090f65b1cdb59d93"; }
+    { locale = "nn-NO"; arch = "linux-i686"; sha512 = "ab236204028e79bb98e78b2900b434f1237e407e864d346fae975d123fa87e727710e41e19625b6c69548497cd9d7716467dc01002e4ff6025301a141125c723"; }
-    { locale = "nn-NO"; arch = "linux-x86_64"; sha512 = "5924aaeeb828464552b0de572ce24cbb94558aa30d599cb518d7dae74e6974d7da9ac5035c5bb2195fe826a8197907c29f02f5f0e83e36c84bb023b208fb56c7"; }
+    { locale = "nn-NO"; arch = "linux-x86_64"; sha512 = "0544c952ae8fddf43b784bab00aa9d4fd05566e06b9df15990ea91cc65aace6066855a8bdc3f6e6eb01e2a7030a49df67962de4af8d9d84d003cb2553af71006"; }
-    { locale = "pa-IN"; arch = "linux-i686"; sha512 = "6ac911f182c6c9b7e2617118efb76285136f0320d99f49401e5732841ffd846770bdd7ec98a200922536cfbd855debd037bdbe279b0f43e644d6e107afd73e68"; }
+    { locale = "pa-IN"; arch = "linux-i686"; sha512 = "618d3e621bed807521f4b933a44e8e87b38b2843a5f85f59a83a60a3df6e13a96d1b3c250a9d77200b03be69116cbdeb33c7e2e2b4d02b8672ab90f0e303dfe3"; }
-    { locale = "pa-IN"; arch = "linux-x86_64"; sha512 = "e16db609e60e4c79336e31d267af552124b2d2b62fac0066e0a84a6e48f082a46699010a9f2540df30ff5c1d4f8d481c4cfc4caea4acc68f50ab83f996105209"; }
+    { locale = "pa-IN"; arch = "linux-x86_64"; sha512 = "226844283b3aa5dd4f224a85101529099c8fde81aed5d354b685953019b27d445ac3347f642ea93145be4dce328c4f1711e0bd21bd9f5a2b97e6b822130546cd"; }
-    { locale = "pl"; arch = "linux-i686"; sha512 = "90217da5f30de60aef9da734355d6b5e0a93526e0d8f91db6c21405e2666df12d1ae37acb94638966b1bff6e3de3713c5243b683e4d321b916125ef89af42c15"; }
+    { locale = "pl"; arch = "linux-i686"; sha512 = "4ba51ed645292165343bd104dc36ba0126435fdc06764e587379ed4de6a89a9f7711890f5f12f6176851ffcfbcd267cc1927b6e8c2a710d505cb3bbc7120209c"; }
-    { locale = "pl"; arch = "linux-x86_64"; sha512 = "b77b19d6c413a92ae3c0da43f989725b3d74fd9d7c1f343711ea73d5a10e4310f005a2d728fa708fcad3b281c5694964ab91966df00b2667a7a8ef616c3a86eb"; }
+    { locale = "pl"; arch = "linux-x86_64"; sha512 = "2702db95f2e166dd5097ae7c2c83fea39f666a0a9e811e7876042e6b5ee0dcad6061fb6b6950a2f8fd8f97c434476155b8e2a306e1fee5cc54100e2d2ec7d619"; }
-    { locale = "pt-BR"; arch = "linux-i686"; sha512 = "d4ce84451941a9382d4fa6225b697e2bea2f72dcf76c72b779bd1e3d955803d7ad3bcbed47e9a7dafde72cd20bfa1e8616b691d275e1e390b2af415e0ea9610c"; }
+    { locale = "pt-BR"; arch = "linux-i686"; sha512 = "ec7bb46f323030f180bb7e83b40e421a245ca4a1aec5f548a2bde1796db00fec415889cca836394b172b1923638e61eba4b71f56bf8aaa55b902deaa7f57842e"; }
-    { locale = "pt-BR"; arch = "linux-x86_64"; sha512 = "c3585047b7b5611e5925f873e3a996142e9b73b5f5389729f3b609f3554030d39a988183f15aa2a5d07036fecc147cdd0abc02b13601a0e02e794c40cada5b40"; }
+    { locale = "pt-BR"; arch = "linux-x86_64"; sha512 = "48406e53ba5276f3721cc5a9af825aa48215862134addefdb136ccc013dc63ca664baa820c2f34f4dd02e79e747bcd4ab73b59ab71773f05c5fede7bfc005745"; }
-    { locale = "pt-PT"; arch = "linux-i686"; sha512 = "e28dce49f6660bea1f56f2515ae539701cc160956318305464ea6b8cf1cf6be21fa8b97b30b234eec9f7e5bc3987ed939b5eca50174ab148a988706f00a2ef0f"; }
+    { locale = "pt-PT"; arch = "linux-i686"; sha512 = "27f8bfc56044d000c8c43c759c16c3eb891a0d3b6aa4d62a18477a3dd816f0b67e899a1ec375376ee83fa97d0d2d836fcb5b1eb3407b09b194600206072d6c49"; }
-    { locale = "pt-PT"; arch = "linux-x86_64"; sha512 = "81a225e7d4f56b0c231d690b4da3f819a1549e8f5194cd6dd2da23d7909c24d9f5f9262e6bec5eee8701ce510980426c7d2612149c4c88da68f910cb7b046d1e"; }
+    { locale = "pt-PT"; arch = "linux-x86_64"; sha512 = "7fa5298de1e5128b4895491d99ab5222f23c1e36e2f07582b6e970de95f45b6ae89a8e4a03b394d0910129ca16be593a47217124b1619ec567ec9d470fe78100"; }
-    { locale = "rm"; arch = "linux-i686"; sha512 = "c4c724f0be3d6a1ada175ec87f840b177ab2a074d5ec858a49732ca7b5289a7d3b1e09b9d0e5c195e1e7565175cdef35e5b6e6e1a3344d7e307f9901e0ca1e6f"; }
+    { locale = "rm"; arch = "linux-i686"; sha512 = "2e25f6ed8e9c92a888c9b2fc0105d5912a9b85fe438c8889728d5522aebf23e86655af2066046e9ed0ea232a59d19b4affe73fa14d4e15af7cb337fef4438b49"; }
-    { locale = "rm"; arch = "linux-x86_64"; sha512 = "8e55f3b680a7b7d4299e59360413a339a99569af8c3a890cb95437c76dfd903f5fc60b6abfb3820e4dbd7d637015ebf8600f351f858022b535709879c9b0608a"; }
+    { locale = "rm"; arch = "linux-x86_64"; sha512 = "c2adc7519b2a6670e7c0e7190c6788a5c5c8882b86bbd58c3472de51e958a22126c575413b6a604eca737d120b1da1863f35702f65220bb0e7f81e4deaa21587"; }
-    { locale = "ro"; arch = "linux-i686"; sha512 = "cf91019d92850db3954690a403c13948f53d79574d874aa10effeac92d759d1b5e62cad9184f58c29b6e478903a4c6f4e27cc3e7e2457605332e361da5ab3ab4"; }
+    { locale = "ro"; arch = "linux-i686"; sha512 = "ac7c8df9f06cf03c4b91e22668697bc74fff7dfa2edbf6873786e98acd5bf79535d8ad9a913811ed3567cb7e4427a8b3751a7adb011bd0567e433064e712be43"; }
-    { locale = "ro"; arch = "linux-x86_64"; sha512 = "ed1106a9855752c951f232de0946665914051dda0e9ded0052b4ef10b7f8d19ce3994165eabeb8b2a1f04009fb7909a48c79c484451335ee24541ab3eee52f4c"; }
+    { locale = "ro"; arch = "linux-x86_64"; sha512 = "f4f80a8b25410b2a48c95dad316fc98b9f5391f08d3df699628b4bf9e343d00ded9cd1ff71b0d5e441ffe6c6a2edae29790a93b5e2117d7343a537d6cbd0738b"; }
-    { locale = "ru"; arch = "linux-i686"; sha512 = "e3175d29cee4f253f7adf4f1d9b9826840e434d11d0c3f10fd9163f904ca315764b4943fb9d2c8a2324aedaac26047e95b6cf87c3218bc5b941e0b9a07e2b49f"; }
+    { locale = "ru"; arch = "linux-i686"; sha512 = "73009743b635761c1ac5d588837084cfb7041f639fc81646d2b6ad7bd92be5d7f742562c8c5522248f20dbca7fd430826617ae706821f107911303d416cb5f4c"; }
-    { locale = "ru"; arch = "linux-x86_64"; sha512 = "62c15a60e2d600068273695f00e4d37416cd7c1804bbc814a3e0b7c0de2a3f23a03b4d6fa5666f25971b7726bd0cde1fccb40cde1e95522704c14252d52384dd"; }
+    { locale = "ru"; arch = "linux-x86_64"; sha512 = "cd2dbc81d761077f4fcff759dcb2ff02ae0e61b0b91007e7514081926e9f3cb2bcd2e65fc3ca44ad5d07caa4e4bd9e450feb25bc184f8c136ea3aa6cc4d05968"; }
-    { locale = "si"; arch = "linux-i686"; sha512 = "a94106b78937fa105eb254044f5ba808edb17b7b0f9b2b56ad918a48566ed43e181b652f4b4feb37d81ed749a5ecd9bd6997cfe6fd1cd7fc001567d9a888f582"; }
+    { locale = "si"; arch = "linux-i686"; sha512 = "d5a416aff2e5fd3b294d8028ee6008c9086b9c5fdb15b52b8810e9e623865b946d46e1b812849ecd7331923f7e7ba01711a909396c8676db917b2a36f7370504"; }
-    { locale = "si"; arch = "linux-x86_64"; sha512 = "974c8349b19e34e9262a98b44c691354061a8f802c8ce47609251023eb91a97096cc107fbd653e9ef9536deb81259cead57b5bcebadb602af8fe51b7e1224fc6"; }
+    { locale = "si"; arch = "linux-x86_64"; sha512 = "8284411d705c804fb0e90f7358e79e0687ef892342ed06c2030803d07b1a901e7f1a6ac2acb375eac10566b1885826c4fa187d3517a2bea35222bd2604d3992a"; }
-    { locale = "sk"; arch = "linux-i686"; sha512 = "63fea9c688a89717b5626e407abf82e650916ede2f01189a54d33e4af366474b39383c2d64bde4bfdfdde3bfe767afb8677b1638b3b327c8a387d0dc00b1318e"; }
+    { locale = "sk"; arch = "linux-i686"; sha512 = "c905adaeca4c3daa57cd54d9a7ce49762e4ab4d32594dffcbf5b9d581409a9f7a0eea1abb51ffa94c35433d20cfd0be3baa914d9821e8f754cdcdb80de7a82fc"; }
-    { locale = "sk"; arch = "linux-x86_64"; sha512 = "96684db63e28088ca0d1f6c3bc30b3075ee2f135900359060add36a34d539132655ec403847acd4d7823bf80d6fb5f7ce7a0c618031b64f6af725a8b3c4c5a22"; }
+    { locale = "sk"; arch = "linux-x86_64"; sha512 = "2741ea21d5714836116595529f4e240accf95ae1e549ac4cb083669beb20d40e7fdeb7805a836ada5d4310e31d74c8bebb1cb5c8f48b3fa585edfd880109b2a1"; }
-    { locale = "sl"; arch = "linux-i686"; sha512 = "6279d3656f2b0a71e7082fd728bd2b551b16838263d7f83a32eebbb28e6d69df11be3f25db259a464428529ddf389f221048f445f0a0f34de1c263aca6fc48ae"; }
+    { locale = "sl"; arch = "linux-i686"; sha512 = "b61cb4971cfd9701dc8aad80848e41bdd399a53fc3282d72e7a866b782cebce928bbc163d2557c24dd0fa3f51f2d2cc40e27fc578d39392d00c15ad08d0df3ad"; }
-    { locale = "sl"; arch = "linux-x86_64"; sha512 = "c69e0ae0d72229c59ca0fa68789c1bdab1ceff5159906ccb27766b854b677328cb1c305d5568c058b93c4e512fd5b7f7626531c5a6f1655519f0c07ecc02308f"; }
+    { locale = "sl"; arch = "linux-x86_64"; sha512 = "47491dfb70268c3ef00d4599e487fc2af35277de2746a106f59eb1b0813a4201c1e3ff735b0d7b48ea23bf3aac18fa1bb8e0c7948651e421f2677b988633e3ca"; }
-    { locale = "sq"; arch = "linux-i686"; sha512 = "d63f84b4e5d8b9728e354487b243c3de604c571af39e43a7552cebdf28139271a8acab85bd1dfc6506e1231bb1ed49dc127f3b0400c9fdaeba2bf6c3ea78829d"; }
+    { locale = "sq"; arch = "linux-i686"; sha512 = "7773088708cc1ca1c115acaafc2d1456b854a413daf9622c2d267dc33e8a4727b6836743c9cfaf8c5694c729241e317a53b8411e37b8d4f94b67bc02c2878e41"; }
-    { locale = "sq"; arch = "linux-x86_64"; sha512 = "df10b39b6cc461c2418d8b297fed5f7ce34e31a0892737b99076b11095602f250b7018af109555a0ce7959695e00c56835786a9ca10573bfca07d1f21af7dedb"; }
+    { locale = "sq"; arch = "linux-x86_64"; sha512 = "db776cedad7842e02a87347e2f97aa5e583e2d1e2859659032e338b5c855f24241a4a1950fdb3a13b6dec643a73a7cb5f7e527ecdf50deafa5138c9f273d3408"; }
-    { locale = "sr"; arch = "linux-i686"; sha512 = "57f710812a1f26212ad0cbc4a3506424d36d0560f5d7d17f8e01d7ed4836fb7a385753b17388b30074cd00985ce7edd7882cb5c326b89840cc816f0b5f1c19cd"; }
+    { locale = "sr"; arch = "linux-i686"; sha512 = "e9eb4827e12db0173643bab8ffca55d50238a1184a2e2ae3543248400f39685b999a068ddab523e429c2667f2966e4a0a09c432837f5e852065459cda67e96b4"; }
-    { locale = "sr"; arch = "linux-x86_64"; sha512 = "88a92d428e32b7c3f63fc898c1c3a448ef3b78afde1334d86dc4e68819f05cb8cba9816e875aaf36f52f1f04c42f9833d690c43dc5eedff3743416a76d33f38d"; }
+    { locale = "sr"; arch = "linux-x86_64"; sha512 = "a38c5f80c0e6a442d035f7b4c18a350421948e9246ac65389959978cfe51f317644c06ecc567bb09739bee0303e4e2b8920bc7903900eabe92ad244e20370345"; }
-    { locale = "sv-SE"; arch = "linux-i686"; sha512 = "f86b0d7fd4f5875dee70ec00efe7f4c99a59d34e877b21288c89f9d5c83d04b31eeafe7dadc01ee5bd91a76363dace2da86e5bc219909fa06d47c5351931efc4"; }
+    { locale = "sv-SE"; arch = "linux-i686"; sha512 = "d7692def00b3a47e86fc01ad192a610352a6c958e53d1b2e4ac6d27a017643e2c0e9887a173268278b9ee7d2e3116368a8dde4d2fce6ea9b56a2bb3963a31ba7"; }
-    { locale = "sv-SE"; arch = "linux-x86_64"; sha512 = "8994b908589746e5d8dc980b5dd06294988399be8e1ced10c6d4b3a6da440f69d6de7f101b9f96723fe55afdc21a7336c141058aa7fc70d283533e5fdd096b85"; }
+    { locale = "sv-SE"; arch = "linux-x86_64"; sha512 = "4656a0d46d358476fcba3be275740a289d79159fa346f4903cac0830341f9a630f1eb0c007d8429cde47821c441d01e792634d32d6e7b94f1bb2c94f18a56563"; }
-    { locale = "ta-LK"; arch = "linux-i686"; sha512 = "852a0132af6ed9d0c3da36025e0183b9c5bfc4a34af7870373989602059f05f6f5f779439c68ce577e6821295c2aa45135a2b90624b941c736089c391364e566"; }
+    { locale = "ta-LK"; arch = "linux-i686"; sha512 = "d6ed8ef83f1d4af62a5c2f92c791822d1b711ed4a51d9656c0e73dbe20510efe017f615537c892b43e43a5503ace92652faa5fa5f2d9956349386fe784fe0dc5"; }
-    { locale = "ta-LK"; arch = "linux-x86_64"; sha512 = "bf8332314c43a8f2709be4440e9eace27ce4ca097d0db7a25de99ac6447606fda297bdccd5d7bf865a964f5276f04371a022134c22962fa5743cc90f4e1a627e"; }
+    { locale = "ta-LK"; arch = "linux-x86_64"; sha512 = "7a994549f4f8c33b185d094e5d207942b62bdf983546aec357404b46e74ec0b790c9b83ffd3cf3687b5bf09457cdbc14593af30ea425718baeb5ecc5703ec15b"; }
-    { locale = "tr"; arch = "linux-i686"; sha512 = "e46e71d28a9bf4eefe453ad3841bfdbc261594e2b29322bc2e5cc072957674e1121c246d3be3fb56c84f64692d048f6792be526dd600dc85d5b2d7f5d2aaeab4"; }
+    { locale = "tr"; arch = "linux-i686"; sha512 = "c5833f7c43919a842f7b840a35ec8752401c24c559d620cdbdc83e70d77e5fbb5a364e44ac3c5f1f1339d9752b9a9825ac0e00d314aa9025760800fc4fc3ce18"; }
-    { locale = "tr"; arch = "linux-x86_64"; sha512 = "1c5d2d1f01129aa4456c166120ab21dd021e92bcd9ba9f4c1d2911699f856516bd9c9a5ae356397d117ae376fc5a44eb3b3880a2fe7e4f61a3b5bc581544f2b1"; }
+    { locale = "tr"; arch = "linux-x86_64"; sha512 = "f1338235583f5888fb7bd30c4c66341bf7ebc4a771e76571e22a5ef445398c9d2ced0f2f93d99bb2f180fa73a4a1f3560616570c8711e54d40a9b931e5eeb4d1"; }
-    { locale = "uk"; arch = "linux-i686"; sha512 = "7b3acee5c624600f908ec6ff7e664d2414a3fc48208bd54baf0cf209f66460e560137a52445805ccfb410913f2ab8ecee30f4a702fbe0c8bf758bf89411d06fe"; }
+    { locale = "uk"; arch = "linux-i686"; sha512 = "a40710948603a427c098619be1f203f2e7182eeb697de2b1dfdf824e556353b133839f0e5ce929fa9e31e70b1f248053bddeeba394dfb74e6c747aaa537d1df0"; }
-    { locale = "uk"; arch = "linux-x86_64"; sha512 = "3b90f1a04c8922889182b81c88a071de2ff54f3524110739878e80738513216ba133ab973219eef822d7c1f605c1d2fa1b32fdbee2451e4c6427a27f9d25599a"; }
+    { locale = "uk"; arch = "linux-x86_64"; sha512 = "5dc6979da2242e45c5ca8a4ca50dd2858c1781256e5b2a9b8bed84e1b2af9f98e5ddea285e49549b3afc1a98df2ab89d74c99a6082309f0150ff426c1d9449c0"; }
-    { locale = "vi"; arch = "linux-i686"; sha512 = "bd37a54a586e91b29c668a2995fc37ec5b2e6d0bab5af640575981aff2be91e97181f5f89e0c4720979fac38b19530c056562a2c4a07c3b9868b347ea5f7f831"; }
+    { locale = "vi"; arch = "linux-i686"; sha512 = "fa795ede70edb6c6237502cde8acdb7d5573db1d995d5e96f274b83f8ea0b827c37a5bcfc74b4aa99f1e15bf8dd68e30d756a0bcecc9e5946c2c5e275dad29bd"; }
-    { locale = "vi"; arch = "linux-x86_64"; sha512 = "a571cfd9e0e43e9ebf5d29969a9af08c16c3fb44abad302207ee17018b105cb7079a0e3da02433264cddfc2da7922296c41f4d5ee76d722b07211c9cb78c8caa"; }
+    { locale = "vi"; arch = "linux-x86_64"; sha512 = "de8a0e22cfc727ccbc460a26a0cb80985c1957da99b050f6f00e4b20b050ba605d815577d392504d0a5e53ba4e12045f3a9a36626ed21682c493259fe0400ecf"; }
-    { locale = "zh-CN"; arch = "linux-i686"; sha512 = "6560d28c15ec9e46787d8eaa1fd9b20630828f15b2ebea98591e25123e5c51a90e12889ac2474467f9d1e3e41b88ae3cacc75ebb67391af0abbe18aaffa29a48"; }
+    { locale = "zh-CN"; arch = "linux-i686"; sha512 = "381d66fc71d3f03f979ccd76aef75fdcf8eb2e182b4a0fa81c08976d195bd696d0213482d40ab365f2dad594587ba8359df4db2cf8febd8d724d5c50f3ba72ed"; }
-    { locale = "zh-CN"; arch = "linux-x86_64"; sha512 = "0ad5965f5028c7d0642cdbb140caabab24536e9bb386b6b14c59af52758e667a6217c7251445c462d3c283c72215a449545f06a1d176ad178a17ed51640715c3"; }
+    { locale = "zh-CN"; arch = "linux-x86_64"; sha512 = "d988114967c4656a13fa3fd562166e7444811ce16c5fc2af06619a47b941b8e07de0993a5593f2e5bad22ff6e856e969dc4cedb9c8df0f532a807e4a30b0c2ef"; }
-    { locale = "zh-TW"; arch = "linux-i686"; sha512 = "a44dc60451845e27560ba41ff5a37446f955076e0da8cbf8ed9ffe06c217dee8847f57c6a58913581ccd4d4039b0f2b570b660882e68bd0e9050371cd1220022"; }
+    { locale = "zh-TW"; arch = "linux-i686"; sha512 = "097a53d990af79e54e445e05c35fc08c86c0d003a04c48daadebb8dc0bd13f57072a82da01c3ae293f4a6766b3e2082bebe12bbb2a8c2f1c7d8eab23eecc2262"; }
-    { locale = "zh-TW"; arch = "linux-x86_64"; sha512 = "17cbdb81577522510f7538d843755f09465700f558d164e6e292070859c9e298165e16c57e5c6db109be6b570666986fd506b60ce6b8ea6f983070c36c5b28c4"; }
+    { locale = "zh-TW"; arch = "linux-x86_64"; sha512 = "9d4dd9e429623009e21b41383776864804803affc9837068bbafd7507bbc5ed70362582da0adb5c811d21c068a96bb4725c4581bf81ac0acb3d57b19fdb4fff6"; }
   ];
 }

pkgs/applications/networking/mumble/default.nix

@@ -104,7 +104,7 @@ let
       "CONFIG+=no-client"
     ];
 
-    buildInputs = [ libcap ] ++ optional iceSupport [ zeroc_ice ];
+    buildInputs = [ libcap ] ++ optional iceSupport zeroc_ice;
   };
 
   stableSource = rec {

pkgs/applications/networking/remote/freerdp/default.nix

@@ -62,5 +62,6 @@ stdenv.mkDerivation rec {
 
     license = stdenv.lib.licenses.free;
     platforms = stdenv.lib.platforms.linux;
+    broken = true;
   };
 }

pkgs/applications/networking/syncthing/default.nix

@@ -34,6 +34,6 @@ stdenv.mkDerivation rec {
     description = "Open Source Continuous File Synchronization";
     license = stdenv.lib.licenses.mpl20;
     maintainers = with stdenv.lib.maintainers; [ pshendry joko peterhoeg ];
-    platforms = with stdenv.lib.platforms; linux ++ freebsd ++ openbsd ++ netbsd;
+    platforms = stdenv.lib.platforms.unix;
   };
 }

pkgs/applications/science/electronics/kicad/default.nix

@@ -21,11 +21,10 @@ stdenv.mkDerivation rec {
       sha256 = "0vrzykgxx423iwgz6186bi8724kmbi5wfl92gfwb3r6mqammgwpg";
     })
   ];
-  
+
   sourceRoot = "kicad-${version}";
 
   cmakeFlags = ''
-    -DCMAKE_BUILD_TYPE=Release
     -DKICAD_SKIP_BOOST=ON
     -DKICAD_BUILD_VERSION=${version}
     -DKICAD_REPO_NAME=stable
@@ -43,7 +42,7 @@ stdenv.mkDerivation rec {
 
   postUnpack = ''
     pushd $(pwd)
-  '';  
+  '';
 
   postInstall = ''
     popd
@@ -53,7 +52,7 @@ stdenv.mkDerivation rec {
     make $MAKE_FLAGS
     make install
     popd
-   
+
     pushd kicad-footprints-*
     mkdir -p $out/share/kicad/modules
     cp -R *.pretty $out/share/kicad/modules/

pkgs/applications/science/logic/lean/default.nix

@@ -20,8 +20,6 @@ stdenv.mkDerivation rec {
     cd src
   '';
 
-  cmakeFlags = [ "-DCMAKE_BUILD_TYPE=Release" ];
-
   postInstall = ''
     wrapProgram $out/bin/linja --prefix PATH : $out/bin:${ninja}/bin
   '';

pkgs/applications/version-management/git-and-tools/git-crypt/default.nix

@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
     license = licenses.gpl3;
     version = "0.5.0";
     maintainers = [ maintainers.dochang ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
   };
 
 }

pkgs/applications/window-managers/weston/default.nix

@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   name = "weston-${version}";
-  version = "1.11.0";
+  version = "1.12.0";
 
   src = fetchurl {
     url = "http://wayland.freedesktop.org/releases/${name}.tar.xz";
-    sha256 = "09biddxw3ar797kxf9mywjkb2iwky6my39gpp51ni846y7lqdq05";
+    sha256 = "ac7ac2a32e3b9f50131fccded5d2326bd36b2226712d90b61999118a09af5033";
   };
 
   nativeBuildInputs = [ pkgconfig ];

pkgs/data/fonts/mplus-outline-fonts/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "mplus-${version}";
-  version = "059";
+  version = "061";
 
   src = fetchurl {
-    url = "mirror://sourceforgejp/mplus-fonts/62344/mplus-TESTFLIGHT-059.tar.xz";
+    url = "mirror://sourceforgejp/mplus-fonts/62344/mplus-TESTFLIGHT-${version}.tar.xz";
-    sha256 = "09dzdgqqflpijd3c30m38cyidshawfp4nz162xhn91j9w09y2qkq";
+    sha256 = "1yrv65l2y8f9jmpalqb5iiay7z1x3754mnqpgp2bax72g8k8728g";
   };
 
   phases = [ "unpackPhase" "installPhase" ];

pkgs/data/icons/maia-icon-theme/default.nix

@@ -0,0 +1,28 @@
+{ stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation {
+  name = "maia-icon-theme";
+
+  src = fetchFromGitHub {
+    owner = "manjaro";
+    repo = "artwork-maia";
+    rev = "23235fa56e6111d30e9f92576030cc855a0facbe";
+    sha256 = "1d5bv13gds1nx88pc6a9gkrz1lb8sji0wcc5h3bf4mjw0q072nfr";
+  };
+
+  dontBuild = true;
+  
+  installPhase = ''
+    install -dm 755 $out/share/icons
+    rm icons/CMakeLists.txt
+    cp -dr --no-preserve='ownership' icons $out/share/icons/Maia
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Icons based on Breeze and Super Flat Remix";
+    homepage = https://github.com/manjaro/artwork-maia;
+    licence = licenses.free;
+    maintainers = [ maintainers.mounium ];
+    platforms = platforms.all;
+  };
+}

pkgs/desktops/gnome-3/3.20/default.nix

@@ -46,14 +46,12 @@ let
   ];
 
   inherit (pkgs) glib gtk2 webkitgtk24x webkitgtk212x gtk3 gtkmm3 libcanberra_gtk2
-    clutter-gst clutter_gtk;
+    clutter clutter-gst clutter_gtk cogl;
   inherit (pkgs.gnome2) ORBit2;
   libsoup = pkgs.libsoup.override { gnomeSupport = true; };
   libchamplain = pkgs.libchamplain.override { libsoup = libsoup; };
   orbit = ORBit2;
   gnome3 = self // { recurseForDerivations = false; };
-  clutter = pkgs.clutter_1_26;
-  cogl = pkgs.cogl_1_22;
   gtk = gtk3;
   gtkmm = gtkmm3;
   gtkvnc = pkgs.gtkvnc.override { enableGTK3 = true; };

pkgs/desktops/kde-4.14/kactivities.nix

@@ -7,6 +7,12 @@ kde {
     sha256 = "12l9brpq8mr9hqqmnlz9xfsfr8ry6283b32nfqfx0p3f7w19vjy7";
   };
 
+  outputs = [ "out" "dev" ];
+
+  outputInclude = "out";
+
+  setOutputFlags = false;
+
   propagatedBuildInputs = [ kdelibs nepomuk_core ];
 
   meta = {

pkgs/desktops/kde-4.14/kde-runtime.nix

@@ -1,5 +1,5 @@
 { kde, kdelibs, bzip2, libssh, exiv2, attica, qca2, shared_mime_info
-, libcanberra, virtuoso, samba, libjpeg, ntrack, pkgconfig, xz, libpulseaudio
+, libcanberra, samba, libjpeg, ntrack, pkgconfig, xz, libpulseaudio
 , networkmanager, kactivities, kdepimlibs, openexr, ilmbase, gpgme, glib
 }:
 
@@ -18,8 +18,6 @@ kde {
 
   NIX_CFLAGS_COMPILE = "-I${ilmbase.dev}/include/OpenEXR -I${glib.dev}/include/glib-2.0 -I${glib.out}/lib/glib-2.0/include";
 
-  passthru.propagatedUserEnvPackages = [ virtuoso ];
-
   meta = {
     license = "LGPL";
   };

pkgs/desktops/kde-4.14/kdepimlibs.nix

@@ -5,6 +5,12 @@
 }:
 
 kde {
+  outputs = [ "out" "dev" ];
+
+  outputInclude = "out";
+
+  setOutputFlags = false;
+
   nativeBuildInputs = [ automoc4 cmake perl pkgconfig ];
 
   cmakeFlags = [

pkgs/desktops/kde-5/applications/kdelibs/default.nix

@@ -9,7 +9,11 @@
 kdeApp {
   name = "kdelibs";
 
-  outputs = [ "out" ];
+  outputs = [ "out" "dev" ];
+
+  outputInclude = "out";
+
+  setOutputFlags = false;
 
   nativeBuildInputs = [
     automoc4 bison cmake flex libxslt perl pkgconfig shared_mime_info

pkgs/development/compilers/hhvm/default.nix

@@ -46,8 +46,6 @@ stdenv.mkDerivation rec {
     patchShebangs .
   '';
 
-  cmakeFlags = [ "-DCMAKE_BUILD_TYPE=Release" ];
-
   meta = {
     description = "High-performance JIT compiler for PHP/Hack";
     homepage    = "http://hhvm.com";

pkgs/development/compilers/llvm/3.4/clang.nix

@@ -20,7 +20,6 @@ stdenv.mkDerivation {
   buildInputs = [ cmake libedit libxml2 zlib ];
 
   cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=Release"
     "-DCMAKE_CXX_FLAGS=-std=c++11"
     "-DCLANG_PATH_TO_LLVM_BUILD=${llvm}"
   ] ++

pkgs/development/compilers/llvm/3.4/lld.nix

@@ -14,7 +14,6 @@ stdenv.mkDerivation {
   buildInputs = [ cmake ncurses zlib python ];
 
   cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=Release"
     "-DCMAKE_CXX_FLAGS=-std=c++11"
     "-DLLD_PATH_TO_LLVM_BUILD=${llvm}"
   ];

pkgs/development/compilers/llvm/3.4/lldb.nix

@@ -26,7 +26,6 @@ stdenv.mkDerivation {
   buildInputs = [ cmake python which swig ncurses zlib libedit ];
 
   cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=Release"
     "-DCMAKE_CXX_FLAGS=-std=c++11"
     "-DLLDB_PATH_TO_LLVM_BUILD=${llvm}"
     "-DLLDB_PATH_TO_CLANG_BUILD=${clang}"

pkgs/development/compilers/llvm/3.4/polly.nix

@@ -10,7 +10,6 @@ stdenv.mkDerivation {
   buildInputs = [ cmake isl python gmp ];
 
   cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=Release"
     "-DCMAKE_CXX_FLAGS=-std=c++11"
     "-DLLVM_INSTALL_ROOT=${llvm}"
   ];