Merge remote-tracking branch 'origin/master' into syncserver

2014-12-14 14:17:56 +01:00 · 2014-12-14 14:17:56 +01:00 · 42c3c205c4
commit 42c3c205c4
parent 28f4ef2a5f 3d74b38101
234 changed files with 5007 additions and 827 deletions
--- a/README.md
+++ b/README.md
@ -1,10 +1,10 @@
-Nixpkgs is a collection of packages for [Nix](http://nixos.org/nix/) package
-manager. Nixpkgs also includes [NixOS](http://nixos.org/nixos/) linux distribution source code.
+Nixpkgs is a collection of packages for [Nix](https://nixos.org/nix/) package
+manager. Nixpkgs also includes [NixOS](https://nixos.org/nixos/) linux distribution source code.

-* [NixOS installation instructions](http://nixos.org/nixos/manual/#ch-installation)
-* [Manual (How to write packages for Nix)](http://nixos.org/nixpkgs/manual/)
-* [Manual (NixOS)](http://nixos.org/nixos/manual/)
-* [Continuous build](http://hydra.nixos.org/jobset/nixos/trunk-combined)
-* [Tests](http://hydra.nixos.org/job/nixos/trunk-combined/tested#tabs-constituents)
-* [Mailing list](http://lists.science.uu.nl/mailman/listinfo/nix-dev)
+* [NixOS installation instructions](https://nixos.org/nixos/manual/#ch-installation)
+* [Manual (How to write packages for Nix)](https://nixos.org/nixpkgs/manual/)
+* [Manual (NixOS)](https://nixos.org/nixos/manual/)
+* [Continuous build](https://hydra.nixos.org/jobset/nixos/trunk-combined)
+* [Tests](https://hydra.nixos.org/job/nixos/trunk-combined/tested#tabs-constituents)
+* [Mailing list](https://lists.science.uu.nl/mailman/listinfo/nix-dev)
 * [IRC - #nixos on freenode.net](irc://irc.freenode.net/#nixos)
--- a/maintainers/docker/Dockerfile
+++ b/maintainers/docker/Dockerfile
@ -1,7 +1,7 @@
 FROM busybox

 RUN dir=`mktemp -d` && trap 'rm -rf "$dir"' EXIT && \
-    wget -O- http://nixos.org/releases/nix/nix-1.7/nix-1.7-x86_64-linux.tar.bz2  | bzcat | tar x -C $dir && \
+    wget -O- https://nixos.org/releases/nix/nix-1.7/nix-1.7-x86_64-linux.tar.bz2  | bzcat | tar x -C $dir && \
    mkdir -m 0755 /nix && USER=root sh $dir/*/install && \
    echo ". /root/.nix-profile/etc/profile.d/nix.sh" >> /etc/profile

--- a/nixos/doc/manual/development/sources.xml
+++ b/nixos/doc/manual/development/sources.xml
@ -50,8 +50,8 @@ Or, to base your local branch on the latest version available in the
 NixOS channel:

 <screen>
-$ curl -sI http://nixos.org/channels/nixos-unstable/ | grep Location
-Location: http://releases.nixos.org/nixos/unstable/nixos-14.10pre43986.acaf4a6/
+$ curl -sI https://nixos.org/channels/nixos-unstable/ | grep Location
+Location: https://releases.nixos.org/nixos/unstable/nixos-14.10pre43986.acaf4a6/

 $ git checkout -b local acaf4a6
 </screen>
@ -92,4 +92,4 @@ to <command>nix-env</command>, as it will break after interpreting expressions
 in <filename>nixos/</filename> as packages.</para>
 -->

-</chapter>
+</chapter>
--- a/nixos/doc/manual/installation/upgrading.xml
+++ b/nixos/doc/manual/installation/upgrading.xml
@ -15,7 +15,7 @@ been built.  These channels are:
 <itemizedlist>
  <listitem>
    <para>Stable channels, such as <literal
-    xlink:href="http://nixos.org/channels/nixos-14.04">nixos-14.04</literal>.
+    xlink:href="https://nixos.org/channels/nixos-14.04">nixos-14.04</literal>.
    These only get conservative bug fixes and package upgrades.  For
    instance, a channel update may cause the Linux kernel on your
    system to be upgraded from 3.4.66 to 3.4.67 (a minor bug fix), but
@ -26,7 +26,7 @@ been built.  These channels are:
  </listitem>
  <listitem>
    <para>The unstable channel, <literal
-    xlink:href="http://nixos.org/channels/nixos-unstable">nixos-unstable</literal>.
+    xlink:href="https://nixos.org/channels/nixos-unstable">nixos-unstable</literal>.
    This corresponds to NixOS’s main development branch, and may thus
    see radical changes between channel updates.  It’s not recommended
    for production systems.</para>
@ -34,7 +34,7 @@ been built.  These channels are:
 </itemizedlist>

 To see what channels are available, go to <link
-xlink:href="http://nixos.org/channels"/>.  (Note that the URIs of the
+xlink:href="https://nixos.org/channels"/>.  (Note that the URIs of the
 various channels redirect to a directory that contains the channel’s
 latest version and includes ISO images and VirtualBox
 appliances.)</para>
@ -53,20 +53,20 @@ nixos https://nixos.org/channels/nixos-unstable
 To switch to a different NixOS channel, do

 <screen>
-$ nix-channel --add http://nixos.org/channels/<replaceable>channel-name</replaceable> nixos
+$ nix-channel --add https://nixos.org/channels/<replaceable>channel-name</replaceable> nixos
 </screen>

 (Be sure to include the <literal>nixos</literal> parameter at the
 end.)  For instance, to use the NixOS 14.04 stable channel:

 <screen>
-$ nix-channel --add http://nixos.org/channels/nixos-14.04 nixos
+$ nix-channel --add https://nixos.org/channels/nixos-14.04 nixos
 </screen>

 But if you want to live on the bleeding edge:

 <screen>
-$ nix-channel --add http://nixos.org/channels/nixos-unstable nixos
+$ nix-channel --add https://nixos.org/channels/nixos-unstable nixos
 </screen>

 </para>
--- a/nixos/maintainers/scripts/ec2/create-ebs-amis.py
+++ b/nixos/maintainers/scripts/ec2/create-ebs-amis.py
@ -75,7 +75,7 @@ m.run_command("mount {0} /mnt".format(device))
 m.run_command("touch /mnt/.ebs")
 m.run_command("mkdir -p /mnt/etc/nixos")

-m.run_command("nix-channel --add http://nixos.org/channels/nixos-{} nixos".format(args.channel))
+m.run_command("nix-channel --add https://nixos.org/channels/nixos-{} nixos".format(args.channel))
 m.run_command("nix-channel --update")

 version = m.run_command("nix-instantiate --eval-only -A lib.nixpkgsVersion '<nixpkgs>'", capture_stdout=True).split(' ')[0].replace('"','').strip()
--- a/nixos/modules/config/networking.nix
+++ b/nixos/modules/config/networking.nix
@ -140,7 +140,7 @@ in
            '' + optionalString config.services.nscd.enable ''
              # Invalidate the nscd cache whenever resolv.conf is
              # regenerated.
-              libc_restart='${pkgs.systemd}/bin/systemctl try-restart --no-block nscd.service'
+              libc_restart='${pkgs.systemd}/bin/systemctl try-restart --no-block nscd.service 2> /dev/null'
            '' + optionalString cfg.dnsSingleRequest ''
              # only send one DNS request at a time
              resolv_conf_options='single-request'
--- a/nixos/modules/installer/cd-dvd/system-tarball-pc-readme.txt
+++ b/nixos/modules/installer/cd-dvd/system-tarball-pc-readme.txt
@ -80,7 +80,7 @@ had booted this nixos. Run:
 *  `grep local-cmds run/current-system/init`

 Then you can proceed normally subscribing to a nixos channel:
-  nix-channel --add http://nixos.org/channels/nixos-unstable
+  nix-channel --add https://nixos.org/channels/nixos-unstable
  nix-channel --update

 Testing:
--- a/nixos/modules/installer/tools/nixos-install.sh
+++ b/nixos/modules/installer/tools/nixos-install.sh
@ -89,6 +89,12 @@ ln -s /run $mountPoint/var/run
 rm -f $mountPoint/etc/{resolv.conf,hosts}
 cp -Lf /etc/resolv.conf /etc/hosts $mountPoint/etc/

+if [ -e "$SSL_CERT_FILE" ]; then
+    cp -Lf "$SSL_CERT_FILE" "$mountPoint/tmp/ca-cert.crt"
+    export SSL_CERT_FILE=/tmp/ca-cert.crt
+    # For Nix 1.7
+    export CURL_CA_BUNDLE=/tmp/ca-cert.crt
+fi

 if [ -n "$runChroot" ]; then
    if ! [ -L $mountPoint/nix/var/nix/profiles/system ]; then
--- a/nixos/modules/misc/ids.nix
+++ b/nixos/modules/misc/ids.nix
@ -172,6 +172,7 @@
      kubernetes = 162;
      peerflix = 163;
      chronos = 164;
+      gitlab = 165;

      # When adding a uid, make sure it doesn't match an existing gid. And don't use uids above 399!

@ -308,6 +309,7 @@
      bosun = 157;
      kubernetes = 158;
      fleet = 159;
+      gitlab = 160;

      # When adding a gid, make sure it doesn't match an existing uid. And don't use gids above 399!

--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -137,6 +137,7 @@
  ./services/desktops/gnome3/seahorse.nix
  ./services/desktops/gnome3/sushi.nix
  ./services/desktops/gnome3/tracker.nix
+  ./services/desktops/profile-sync-daemon.nix
  ./services/desktops/telepathy.nix
  ./services/games/ghost-one.nix
  ./services/games/minecraft-server.nix
@ -176,6 +177,7 @@
  ./services/misc/etcd.nix
  ./services/misc/felix.nix
  ./services/misc/folding-at-home.nix
+  ./services/misc/gitlab.nix
  ./services/misc/gitolite.nix
  ./services/misc/gpsd.nix
  ./services/misc/mesos-master.nix
--- a/nixos/modules/profiles/container.nix
+++ b/nixos/modules/profiles/container.nix
@ -20,17 +20,18 @@ in {
    contents = [];
    extraArgs = "--owner=0";

-    # Some container managers like lxc need these
-    extraCommands = "mkdir -p proc sys dev";
-
    # Add init script to image
    storeContents = [
      { object = config.system.build.toplevel + "/init";
        symlink = "/init";
      }
    ] ++ (pkgs2storeContents [ pkgs.stdenv ]);
+
+    # Some container managers like lxc need these
+    extraCommands = "mkdir -p proc sys dev";
  };

+  boot.isContainer = true;
  boot.postBootCommands =
    ''
      # After booting, register the contents of the Nix store in the Nix
@ -40,18 +41,16 @@ in {
        rm /nix-path-registration
      fi

-      # nixos-rebuild also requires a "system" profile and an
-      # /etc/NIXOS tag.
-      touch /etc/NIXOS
+      # nixos-rebuild also requires a "system" profile
      ${config.nix.package}/bin/nix-env -p /nix/var/nix/profiles/system --set /run/current-system
    '';

-  boot.isContainer = true;
-
  # Disable some features that are not useful in a container.
  sound.enable = mkDefault false;
  services.udisks2.enable = mkDefault false;

-  # Shut up warnings about not having a boot loader.
-  system.build.installBootLoader = "${pkgs.coreutils}/bin/true";
+  # Install new init script
+  system.activationScripts.installInitScript = ''
+    ln -fs $systemConfig/init /init
+  '';
 }
--- a/nixos/modules/programs/virtualbox-host.nix
+++ b/nixos/modules/programs/virtualbox-host.nix
@ -9,9 +9,14 @@ in
 {
  options = {
    services.virtualboxHost.enable = mkEnableOption "VirtualBox Host support";
+    services.virtualboxHost.addNetworkInterface = mkOption {
+      type = types.bool;
+      default = true;
+      description = "Automatically set up a vboxnet0 host-only network interface.";
+    };
  };

-  config = mkIf config.services.virtualboxHost.enable {
+  config = mkIf config.services.virtualboxHost.enable (mkMerge [{
    boot.kernelModules = [ "vboxdrv" "vboxnetadp" "vboxnetflt" ];
    boot.extraModulePackages = [ virtualbox ];
    environment.systemPackages = [ virtualbox ];
@ -24,10 +29,7 @@ in
        setuid = true;
      };
    in map mkVboxStub [
-      "VBoxBFE"
-      "VBoxBalloonCtrl"
      "VBoxHeadless"
-      "VBoxManage"
      "VBoxSDL"
      "VirtualBox"
    ];
@ -46,7 +48,7 @@ in
      '';

    # Since we lack the right setuid binaries, set up a host-only network by default.
-
+  } (mkIf config.services.virtualboxHost.addNetworkInterface {
    systemd.services."vboxnet0" =
      { description = "VirtualBox vboxnet0 Interface";
        requires = [ "dev-vboxnetctl.device" ];
@ -68,5 +70,5 @@ in
      };

    networking.interfaces.vboxnet0.ip4 = [ { address = "192.168.56.1"; prefixLength = 24; } ];
-  };
+  })]);
 }
--- a/nixos/modules/services/desktops/profile-sync-daemon.nix
+++ b/nixos/modules/services/desktops/profile-sync-daemon.nix
@ -0,0 +1,139 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+  cfg = config.services.psd;
+
+  configFile = ''
+    ${if cfg.users != [ ] then ''
+      USERS="${concatStringsSep " " cfg.users}"
+    '' else ""}
+
+    ${if cfg.browsers != [ ] then ''
+      BROWSERS="${concatStringsSep " " cfg.browsers}"
+    '' else ""}
+
+    ${optionalString (cfg.volatile != "") "VOLATILE=${cfg.volatile}"}
+    ${optionalString (cfg.daemonFile != "") "DAEMON_FILE=${cfg.daemonFile}"}
+  '';
+in {
+  options.services.psd = with types; {
+    enable = mkOption {
+      type = bool;
+      default = false;
+      description = ''
+        Whether to enable the Profile Sync daemon.
+      '';
+    };
+
+    users = mkOption {
+      type = listOf str;
+      default = [ ];
+      example = [ "demo" ];
+      description = ''
+        A list of users whose browser profiles should be sync'd to tmpfs.
+      '';
+    };
+
+    browsers = mkOption {
+      type = listOf str;
+      default = [ ];
+      example = [ "chromium" "firefox" ];
+      description = ''
+        A list of browsers to sync. Available choices are:
+
+        chromium chromium-dev conkeror.mozdev.org epiphany firefox
+        firefox-trunk google-chrome google-chrome-beta google-chrome-unstable
+        heftig-aurora icecat luakit midori opera opera-developer opera-beta
+        qupzilla palemoon rekonq seamonkey
+
+        An empty list will enable all browsers.
+      '';
+    };
+
+    resyncTimer = mkOption {
+      type = str;
+      default = "1h";
+      example = "1h 30min";
+      description = ''
+        The amount of time to wait before syncing browser profiles back to the
+        disk.
+
+        Takes a systemd.unit time span. The time unit defaults to seconds if
+        omitted.
+      '';
+    };
+
+    volatile = mkOption {
+      type = str;
+      default = "/run/psd-profiles";
+      description = ''
+        The directory where browser profiles should reside(this should be
+        mounted as a tmpfs). Do not include a trailing backslash.
+      '';
+    };
+
+    daemonFile = mkOption {
+      type = str;
+      default = "/run/psd";
+      description = ''
+        Where the pid and backup configuration files will be stored.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+
+    systemd = {
+      services = {
+        psd = {
+          description = "Profile Sync daemon";
+          wants = [ "psd-resync.service" "local-fs.target" ];
+          wantedBy = [ "multi-user.target" ];
+          preStart = "mkdir -p ${cfg.volatile}";
+
+          path = with pkgs; [ glibc rsync gawk ];
+
+          unitConfig = {
+            RequiresMountsFor = [ "/home/" ];
+          };
+
+          serviceConfig = {
+            Type = "oneshot";
+            RemainAfterExit = "yes";
+            ExecStart = "${pkgs.profile-sync-daemon}/bin/profile-sync-daemon sync";
+
+            ExecStop = "${pkgs.profile-sync-daemon}/bin/profile-sync-daemon unsync";
+          };
+        };
+
+        psd-resync = {
+          description = "Timed profile resync";
+          after = [ "psd.service" ];
+          wants = [ "psd-resync.timer" ];
+          partOf = [ "psd.service" ];
+
+          path = with pkgs; [ glibc rsync gawk ];
+
+          serviceConfig = {
+            Type = "oneshot";
+            ExecStart = "${pkgs.profile-sync-daemon}/bin/profile-sync-daemon resync";
+          };
+        };
+      };
+
+      timers.psd-resync = {
+        description = "Timer for profile sync daemon - 1 Hour";
+        partOf = [ "psd-resync.service" "psd.service" ];
+
+        timerConfig = {
+          OnUnitActiveSec = "${cfg.resyncTimer}";
+        };
+      };
+    };
+
+    environment.etc."psd.conf".text = configFile;
+
+  };
+}
--- a/nixos/modules/services/misc/defaultUnicornConfig.rb
+++ b/nixos/modules/services/misc/defaultUnicornConfig.rb
@ -0,0 +1,206 @@
+# The following was taken from github.com/crohr/syslogger and is BSD
+# licensed.
+require 'syslog'
+require 'logger'
+require 'thread'
+
+class Syslogger
+
+  VERSION = "1.6.0"
+
+  attr_reader :level, :ident, :options, :facility, :max_octets
+  attr_accessor :formatter
+
+  MAPPING = {
+    Logger::DEBUG => Syslog::LOG_DEBUG,
+    Logger::INFO => Syslog::LOG_INFO,
+    Logger::WARN => Syslog::LOG_WARNING,
+    Logger::ERROR => Syslog::LOG_ERR,
+    Logger::FATAL => Syslog::LOG_CRIT,
+    Logger::UNKNOWN => Syslog::LOG_ALERT
+  }
+
+  #
+  # Initializes default options for the logger
+  # <tt>ident</tt>:: the name of your program [default=$0].
+  # <tt>options</tt>::  syslog options [default=<tt>Syslog::LOG_PID | Syslog::LOG_CONS</tt>].
+  #                     Correct values are:
+  #                       LOG_CONS    : writes the message on the console if an error occurs when sending the message;
+  #                       LOG_NDELAY  : no delay before sending the message;
+  #                       LOG_PERROR  : messages will also be written on STDERR;
+  #                       LOG_PID     : adds the process number to the message (just after the program name)
+  # <tt>facility</tt>:: the syslog facility [default=nil] Correct values include:
+  #                       Syslog::LOG_DAEMON
+  #                       Syslog::LOG_USER
+  #                       Syslog::LOG_SYSLOG
+  #                       Syslog::LOG_LOCAL2
+  #                       Syslog::LOG_NEWS
+  #                       etc.
+  #
+  # Usage:
+  #   logger = Syslogger.new("my_app", Syslog::LOG_PID | Syslog::LOG_CONS, Syslog::LOG_LOCAL0)
+  #   logger.level = Logger::INFO # use Logger levels
+  #   logger.warn "warning message"
+  #   logger.debug "debug message"
+  #
+  def initialize(ident = $0, options = Syslog::LOG_PID | Syslog::LOG_CONS, facility = nil)
+    @ident = ident
+    @options = options || (Syslog::LOG_PID | Syslog::LOG_CONS)
+    @facility = facility
+    @level = Logger::INFO
+    @mutex = Mutex.new
+    @formatter = Logger::Formatter.new
+  end
+
+  %w{debug info warn error fatal unknown}.each do |logger_method|
+    # Accepting *args as message could be nil.
+    #  Default params not supported in ruby 1.8.7
+    define_method logger_method.to_sym do |*args, &block|
+      return true if @level > Logger.const_get(logger_method.upcase)
+      message = args.first || block && block.call
+      add(Logger.const_get(logger_method.upcase), message)
+    end
+
+    unless logger_method == 'unknown'
+      define_method "#{logger_method}?".to_sym do
+        @level <= Logger.const_get(logger_method.upcase)
+      end
+    end
+  end
+
+  # Log a message at the Logger::INFO level. Useful for use with Rack::CommonLogger
+  def write(msg)
+    add(Logger::INFO, msg)
+  end
+
+  # Logs a message at the Logger::INFO level.
+  def <<(msg)
+    add(Logger::INFO, msg)
+  end
+
+  # Low level method to add a message.
+  # +severity+::  the level of the message. One of Logger::DEBUG, Logger::INFO, Logger::WARN, Logger::ERROR, Logger::FATAL, Logger::UNKNOWN
+  # +message+:: the message string.
+  #             If nil, the method will call the block and use the result as the message string.
+  #             If both are nil or no block is given, it will use the progname as per the behaviour of both the standard Ruby logger, and the Rails BufferedLogger.
+  # +progname+:: optionally, overwrite the program name that appears in the log message.
+  def add(severity, message = nil, progname = nil, &block)
+    if message.nil? && block.nil? && !progname.nil?
+      message, progname = progname, nil
+    end
+    progname ||= @ident
+
+    @mutex.synchronize do
+      Syslog.open(progname, @options, @facility) do |s|
+        s.mask = Syslog::LOG_UPTO(MAPPING[@level])
+        communication = clean(message || block && block.call)
+        if self.max_octets
+          buffer = "#{tags_text}"
+          communication.bytes do |byte|
+            buffer.concat(byte)
+            # if the last byte we added is potentially part of an escape, we'll go ahead and add another byte
+            if buffer.bytesize >= self.max_octets && !['%'.ord,'\\'.ord].include?(byte)
+              s.log(MAPPING[severity],buffer)
+              buffer = ""
+            end
+          end
+          s.log(MAPPING[severity],buffer) unless buffer.empty?
+        else
+          s.log(MAPPING[severity],"#{tags_text}#{communication}")
+        end
+      end
+    end
+  end
+
+  # Set the max octets of the messages written to the log
+  def max_octets=(max_octets)
+    @max_octets = max_octets
+  end
+
+  # Sets the minimum level for messages to be written in the log.
+  # +level+:: one of <tt>Logger::DEBUG</tt>, <tt>Logger::INFO</tt>, <tt>Logger::WARN</tt>, <tt>Logger::ERROR</tt>, <tt>Logger::FATAL</tt>, <tt>Logger::UNKNOWN</tt>
+  def level=(level)
+    level = Logger.const_get(level.to_s.upcase) if level.is_a?(Symbol)
+
+    unless level.is_a?(Fixnum)
+      raise ArgumentError.new("Invalid logger level `#{level.inspect}`")
+    end
+
+    @level = level
+  end
+
+  # Sets the ident string passed along to Syslog
+  def ident=(ident)
+    @ident = ident
+  end
+
+  # Tagging code borrowed from ActiveSupport gem
+  def tagged(*tags)
+    new_tags = push_tags(*tags)
+    yield self
+  ensure
+    pop_tags(new_tags.size)
+  end
+
+  def push_tags(*tags)
+    tags.flatten.reject{ |i| i.respond_to?(:empty?) ? i.empty? : !i }.tap do |new_tags|
+      current_tags.concat new_tags
+    end
+  end
+
+  def pop_tags(size = 1)
+    current_tags.pop size
+  end
+
+  def clear_tags!
+    current_tags.clear
+  end
+
+  protected
+
+  # Borrowed from SyslogLogger.
+  def clean(message)
+    message = message.to_s.dup
+    message.strip! # remove whitespace
+    message.gsub!(/\n/, '\\n') # escape newlines
+    message.gsub!(/%/, '%%') # syslog(3) freaks on % (printf)
+    message.gsub!(/\e\[[^m]*m/, '') # remove useless ansi color codes
+    message
+  end
+
+  private
+
+  def tags_text
+    tags = current_tags
+    if tags.any?
+      tags.collect { |tag| "[#{tag}] " }.join
+    end
+  end
+
+  def current_tags
+    Thread.current[:syslogger_tagged_logging_tags] ||= []
+  end
+end
+
+worker_processes 2
+working_directory ENV["GITLAB_PATH"]
+pid ENV["UNICORN_PATH"] + "/tmp/pids/unicorn.pid"
+
+listen ENV["UNICORN_PATH"] + "/tmp/sockets/gitlab.socket", :backlog => 1024
+listen "127.0.0.1:8080", :tcp_nopush => true
+
+timeout 60
+
+logger Syslogger.new
+
+preload_app true
+
+GC.respond_to?(:copy_on_write_friendly=) and
+  GC.copy_on_write_friendly = true
+
+check_client_connection false
+
+after_fork do |server, worker|
+  defined?(ActiveRecord::Base) and
+    ActiveRecord::Base.establish_connection
+end
--- a/nixos/modules/services/misc/gitlab.nix
+++ b/nixos/modules/services/misc/gitlab.nix
@ -0,0 +1,295 @@
+{ config, lib, pkgs, ... }:
+
+# TODO: support non-postgresql
+
+with lib;
+
+let
+  cfg = config.services.gitlab;
+
+  ruby = pkgs.ruby;
+  rubyLibs = pkgs.rubyLibs;
+
+  databaseYml = ''
+    production:
+      adapter: postgresql
+      database: ${cfg.databaseName}
+      host: ${cfg.databaseHost}
+      password: ${cfg.databasePassword}
+      username: ${cfg.databaseUsername}
+      encoding: utf8
+  '';
+  gitlabShellYml = ''
+    user: gitlab
+    gitlab_url: "http://${cfg.host}:${toString cfg.port}/"
+    http_settings:
+      self_signed_cert: false
+    repos_path: "${cfg.stateDir}/repositories"
+    log_file: "${cfg.stateDir}/log/gitlab-shell.log"
+    redis:
+      bin: ${pkgs.redis}/bin/redis-cli
+      host: 127.0.0.1
+      port: 6379
+      database: 0
+      namespace: resque:gitlab
+  '';
+
+  unicornConfig = builtins.readFile ./defaultUnicornConfig.rb;
+
+  gitlab-runner = pkgs.stdenv.mkDerivation rec {
+    name = "gitlab-runner";
+    buildInputs = [ pkgs.gitlab pkgs.rubyLibs.bundler pkgs.makeWrapper ];
+    phases = "installPhase fixupPhase";
+    buildPhase = "";
+    installPhase = ''
+      mkdir -p $out/bin
+      makeWrapper ${rubyLibs.bundler}/bin/bundle $out/bin/gitlab-runner\
+          --set RAKEOPT '"-f ${pkgs.gitlab}/share/gitlab/Rakefile"'\
+          --set UNICORN_PATH "${cfg.stateDir}/"\
+          --set GITLAB_PATH "${pkgs.gitlab}/share/gitlab/"\
+          --set GITLAB_APPLICATION_LOG_PATH "${cfg.stateDir}/log/application.log"\
+          --set GITLAB_SATELLITES_PATH "${cfg.stateDir}/satellites"\
+          --set GITLAB_SHELL_PATH "${pkgs.gitlab-shell}"\
+          --set GITLAB_REPOSITORIES_PATH "${cfg.stateDir}/repositories"\
+          --set GITLAB_SHELL_HOOKS_PATH "${cfg.stateDir}/shell/hooks"\
+          --set BUNDLE_GEMFILE "${pkgs.gitlab}/share/gitlab/Gemfile"\
+          --set GITLAB_EMAIL_FROM "${cfg.emailFrom}"\
+          --set GITLAB_SHELL_CONFIG_PATH "${cfg.stateDir}/shell/config.yml"\
+          --set GITLAB_SHELL_SECRET_PATH "${cfg.stateDir}/config/gitlab_shell_secret"\
+          --set GITLAB_HOST "${cfg.host}"\
+          --set GITLAB_PORT "${toString cfg.port}"\
+          --set GITLAB_BACKUP_PATH"${cfg.backupPath}"\
+          --set RAILS_ENV "production"
+    '';
+  };
+
+in {
+
+  options = {
+    services.gitlab = {
+      enable = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Enable the gitlab service.
+        '';
+      };
+
+      satelliteDir = mkOption {
+        type = types.str;
+        default = "/var/gitlab/git-satellites";
+        description = "Gitlab directory to store checked out git trees requires for operation.";
+      };
+
+      stateDir = mkOption {
+        type = types.str;
+        default = "/var/gitlab/state";
+        description = "Gitlab state directory, logs are stored here.";
+      };
+
+      backupPath = mkOption {
+        type = types.str;
+        default = cfg.stateDir + "/backup";
+        description = "Gitlab path for backups.";
+      };
+
+      databaseHost = mkOption {
+        type = types.str;
+        default = "127.0.0.1";
+        description = "Gitlab database hostname.";
+      };
+
+      databasePassword = mkOption {
+        type = types.str;
+        default = "";
+        description = "Gitlab database user password.";
+      };
+
+      databaseName = mkOption {
+        type = types.str;
+        default = "gitlab";
+        description = "Gitlab database name.";
+      };
+
+      databaseUsername = mkOption {
+        type = types.str;
+        default = "gitlab";
+        description = "Gitlab database user.";
+      };
+
+      emailFrom = mkOption {
+        type = types.str;
+        default = "example@example.org";
+        description = "The source address for emails sent by gitlab.";
+      };
+
+      host = mkOption {
+        type = types.str;
+        default = config.networking.hostName;
+        description = "Gitlab host name. Used e.g. for copy-paste URLs.";
+      };
+
+      port = mkOption {
+        type = types.int;
+        default = 8080;
+        description = "Gitlab server listening port.";
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+
+    environment.systemPackages = [ gitlab-runner pkgs.gitlab-shell ];
+
+    assertions = [
+      { assertion = cfg.databasePassword != "";
+        message = "databasePassword must be set";
+      }
+    ];
+
+    # Redis is required for the sidekiq queue runner.
+    services.redis.enable = mkDefault true;
+    # We use postgres as the main data store.
+    services.postgresql.enable = mkDefault true;
+    services.postgresql.package = mkDefault pkgs.postgresql;
+    # Use postfix to send out mails.
+    services.postfix.enable = mkDefault true;
+
+    users.extraUsers = [
+      { name = "gitlab";
+        group = "gitlab";
+        home = "${cfg.stateDir}/home";
+        shell = "${pkgs.bash}/bin/bash";
+        uid = config.ids.uids.gitlab;
+      } ];
+
+    users.extraGroups = [
+      { name = "gitlab";
+        gid = config.ids.gids.gitlab;
+      } ];
+
+    systemd.services.gitlab-sidekiq = {
+      after = [ "network.target" "redis.service" ];
+      wantedBy = [ "multi-user.target" ];
+      environment.HOME = "${cfg.stateDir}/home";
+      environment.UNICORN_PATH = "${cfg.stateDir}/";
+      environment.GITLAB_PATH = "${pkgs.gitlab}/share/gitlab/";
+      environment.GITLAB_APPLICATION_LOG_PATH = "${cfg.stateDir}/log/application.log";
+      environment.GITLAB_SATELLITES_PATH = "${cfg.stateDir}/satellites";
+      environment.GITLAB_SHELL_PATH = "${pkgs.gitlab-shell}";
+      environment.GITLAB_REPOSITORIES_PATH = "${cfg.stateDir}/repositories";
+      environment.GITLAB_SHELL_HOOKS_PATH = "${cfg.stateDir}/shell/hooks";
+      environment.BUNDLE_GEMFILE = "${pkgs.gitlab}/share/gitlab/Gemfile";
+      environment.GITLAB_EMAIL_FROM = "${cfg.emailFrom}";
+      environment.GITLAB_SHELL_CONFIG_PATH = "${cfg.stateDir}/shell/config.yml";
+      environment.GITLAB_SHELL_SECRET_PATH = "${cfg.stateDir}/config/gitlab_shell_secret";
+      environment.GITLAB_HOST = "${cfg.host}";
+      environment.GITLAB_PORT = "${toString cfg.port}";
+      environment.GITLAB_DATABASE_HOST = "${cfg.databaseHost}";
+      environment.GITLAB_DATABASE_PASSWORD = "${cfg.databasePassword}";
+      environment.RAILS_ENV = "production";
+      path = with pkgs; [
+        config.services.postgresql.package
+        gitAndTools.git
+        ruby
+        openssh
+        nodejs
+      ];
+      serviceConfig = {
+        Type = "simple";
+        User = "gitlab";
+        Group = "gitlab";
+        TimeoutSec = "300";
+        WorkingDirectory = "${pkgs.gitlab}/share/gitlab";
+        ExecStart="${rubyLibs.bundler}/bin/bundle exec \"sidekiq -q post_receive -q mailer -q system_hook -q project_web_hook -q gitlab_shell -q common -q default -e production -P ${cfg.stateDir}/tmp/sidekiq.pid\"";
+      };
+    };
+
+    systemd.services.gitlab = {
+      after = [ "network.target" "postgresql.service" "redis.service" ];
+      wantedBy = [ "multi-user.target" ];
+      environment.HOME = "${cfg.stateDir}/home";
+      environment.UNICORN_PATH = "${cfg.stateDir}/";
+      environment.GITLAB_PATH = "${pkgs.gitlab}/share/gitlab/";
+      environment.GITLAB_APPLICATION_LOG_PATH = "${cfg.stateDir}/log/application.log";
+      environment.GITLAB_SATELLITES_PATH = "${cfg.stateDir}/satellites";
+      environment.GITLAB_SHELL_PATH = "${pkgs.gitlab-shell}";
+      environment.GITLAB_REPOSITORIES_PATH = "${cfg.stateDir}/repositories";
+      environment.GITLAB_SHELL_HOOKS_PATH = "${cfg.stateDir}/shell/hooks";
+      environment.BUNDLE_GEMFILE = "${pkgs.gitlab}/share/gitlab/Gemfile";
+      environment.GITLAB_EMAIL_FROM = "${cfg.emailFrom}";
+      environment.GITLAB_HOST = "${cfg.host}";
+      environment.GITLAB_PORT = "${toString cfg.port}";
+      environment.GITLAB_DATABASE_HOST = "${cfg.databaseHost}";
+      environment.GITLAB_DATABASE_PASSWORD = "${cfg.databasePassword}";
+      environment.RAILS_ENV = "production";
+      path = with pkgs; [
+        config.services.postgresql.package
+        gitAndTools.git
+        ruby
+        openssh
+        nodejs
+      ];
+      preStart = ''
+        # TODO: use env vars
+        mkdir -p ${cfg.stateDir}
+        mkdir -p ${cfg.stateDir}/log
+        mkdir -p ${cfg.stateDir}/satellites
+        mkdir -p ${cfg.stateDir}/repositories
+        mkdir -p ${cfg.stateDir}/shell/hooks
+        mkdir -p ${cfg.stateDir}/tmp/pids
+        mkdir -p ${cfg.stateDir}/tmp/sockets
+        rm -rf ${cfg.stateDir}/config
+        mkdir -p ${cfg.stateDir}/config
+        # TODO: What exactly is gitlab-shell doing with the secret?
+        head -c 20 /dev/urandom > ${cfg.stateDir}/config/gitlab_shell_secret
+        mkdir -p ${cfg.stateDir}/home/.ssh
+        touch ${cfg.stateDir}/home/.ssh/authorized_keys
+
+        cp -rf ${pkgs.gitlab}/share/gitlab/config ${cfg.stateDir}/
+        cp ${pkgs.gitlab}/share/gitlab/VERSION ${cfg.stateDir}/VERSION
+
+        ln -fs ${pkgs.writeText "database.yml" databaseYml} ${cfg.stateDir}/config/database.yml
+        ln -fs ${pkgs.writeText "unicorn.rb" unicornConfig} ${cfg.stateDir}/config/unicorn.rb
+
+        chown -R gitlab:gitlab ${cfg.stateDir}/
+        chmod -R 755 ${cfg.stateDir}/
+
+        if [ "${cfg.databaseHost}" = "127.0.0.1" ]; then
+          if ! test -e "${cfg.stateDir}/db-created"; then
+            psql postgres -c "CREATE ROLE gitlab WITH LOGIN NOCREATEDB NOCREATEROLE NOCREATEUSER ENCRYPTED PASSWORD '${cfg.databasePassword}'"
+            ${config.services.postgresql.package}/bin/createdb --owner gitlab gitlab || true
+            touch "${cfg.stateDir}/db-created"
+
+            # force=yes disables the manual-interaction yes/no prompt
+            # which breaks without an stdin.
+            force=yes ${rubyLibs.bundler}/bin/bundle exec rake -f ${pkgs.gitlab}/share/gitlab/Rakefile gitlab:setup RAILS_ENV=production
+          fi
+        fi
+
+      # Install the shell required to push repositories
+      ln -fs ${pkgs.writeText "config.yml" gitlabShellYml} ${cfg.stateDir}/shell/config.yml
+      export GITLAB_SHELL_CONFIG_PATH=""${cfg.stateDir}/shell/config.yml
+      ${pkgs.gitlab-shell}/bin/install
+
+      # Change permissions in the last step because some of the
+      # intermediary scripts like to create directories as root.
+      chown -R gitlab:gitlab ${cfg.stateDir}/
+      chmod -R 755 ${cfg.stateDir}/
+      '';
+
+      serviceConfig = {
+        PermissionsStartOnly = true; # preStart must be run as root
+        Type = "simple";
+        User = "gitlab";
+        Group = "gitlab";
+        TimeoutSec = "300";
+        WorkingDirectory = "${pkgs.gitlab}/share/gitlab";
+        ExecStart="${rubyLibs.bundler}/bin/bundle exec \"unicorn -c ${cfg.stateDir}/config/unicorn.rb -E production\"";
+      };
+
+    };
+
+  };
+
+}
--- a/nixos/modules/services/networking/networkmanager.nix
+++ b/nixos/modules/services/networking/networkmanager.nix
@ -194,7 +194,7 @@ in {
    };

    powerManagement.resumeCommands = ''
-      Systemctl restart network-manager
+      systemctl restart network-manager
    '';

    security.polkit.extraConfig = polkitConf;
--- a/nixos/modules/system/boot/stage-1.nix
+++ b/nixos/modules/system/boot/stage-1.nix
@ -240,8 +240,9 @@ in
      example = "/dev/sda3";
      description = ''
        Device for manual resume attempt during boot. This should be used primarily
-        if you want to resume from file. Specify here the device where the file
-        resides. You should also use <varname>boot.kernelParams</varname> to specify
+        if you want to resume from file. If left empty, the swap partitions are used.
+        Specify here the device where the file resides.
+        You should also use <varname>boot.kernelParams</varname> to specify
        <literal><replaceable>resume_offset</replaceable></literal>.
      '';
    };
@ -355,10 +356,17 @@ in

  config = mkIf (!config.boot.isContainer) {

-    assertions = singleton
+    assertions = [
      { assertion = any (fs: fs.mountPoint == "/") (attrValues config.fileSystems);
        message = "The ‘fileSystems’ option does not specify your root file system.";
-      };
+      }
+      { assertion = let inherit (config.boot) resumeDevice; in
+          resumeDevice == "" || builtins.substring 0 1 resumeDevice == "/";
+        message = "boot.resumeDevice has to be an absolute path."
+          + " Old \"x:y\" style is no longer supported.";
+      }
+    ];
+

    system.build.bootStage1 = bootStage1;
    system.build.initialRamdisk = initialRamdisk;
--- a/nixos/release-combined.nix
+++ b/nixos/release-combined.nix
@ -48,6 +48,7 @@ in rec {
        (all nixos.ova)

        #(all nixos.tests.containers)
+        (all nixos.tests.chromium)
        (all nixos.tests.firefox)
        (all nixos.tests.firewall)
        (all nixos.tests.gnome3)
--- a/nixos/release.nix
+++ b/nixos/release.nix
@ -214,7 +214,7 @@ in rec {
  });

  # Provide container tarball for lxc, libvirt-lxc, docker-lxc, ...
-  container_tarball = forAllSystems (system: makeSystemTarball {
+  containerTarball = forAllSystems (system: makeSystemTarball {
    module = ./modules/virtualisation/lxc-container.nix;
    inherit system;
  });
@ -251,6 +251,7 @@ in rec {
  tests.firefox = callTest tests/firefox.nix {};
  tests.firewall = callTest tests/firewall.nix {};
  tests.fleet = scrubDrv (import tests/fleet.nix { system = "x86_64-linux"; });
+  tests.gitlab = callTest tests/gitlab.nix {};
  tests.gnome3 = callTest tests/gnome3.nix {};
  tests.installer.grub1 = forAllSystems (system: scrubDrv (import tests/installer.nix { inherit system; }).grub1.test);
  tests.installer.lvm = forAllSystems (system: scrubDrv (import tests/installer.nix { inherit system; }).lvm.test);
@ -306,6 +307,7 @@ in rec {
  tests.simple = callTest tests/simple.nix {};
  tests.tomcat = callTest tests/tomcat.nix {};
  tests.udisks2 = callTest tests/udisks2.nix {};
+  tests.virtualbox = callTest tests/virtualbox.nix {};
  tests.xfce = callTest tests/xfce.nix {};


--- a/nixos/tests/gitlab.nix
+++ b/nixos/tests/gitlab.nix
@ -0,0 +1,20 @@
+# This test runs gitlab and checks if it works
+
+import ./make-test.nix {
+  name = "gitlab";
+
+  nodes = {
+    gitlab = { config, pkgs, ... }: {
+      virtualisation.memorySize = 768;
+      services.gitlab.enable = true;
+      services.gitlab.databasePassword = "gitlab";
+    };
+  };
+
+  testScript = ''
+    $gitlab->start();
+    $gitlab->waitForUnit("gitlab.service");
+    $gitlab->waitForUnit("gitlab-sidekiq.service");
+    $gitlab->waitUntilSucceeds("curl http://localhost:8080/users/sign_in");
+  '';
+}
--- a/nixos/tests/kubernetes.nix
+++ b/nixos/tests/kubernetes.nix
@ -47,7 +47,7 @@ import ./make-test.nix rec {
    master =
      { config, pkgs, lib, nodes, ... }:
        {
-          virtualisation.memorySize = 512;
+          virtualisation.memorySize = 768;
          services.kubernetes = {
            roles = ["master" "node"];
            controllerManager.machines = ["master" "node"];
--- a/nixos/tests/quake3.nix
+++ b/nixos/tests/quake3.nix
@ -15,14 +15,14 @@ in
 rec {
  name = "quake3";

-  makeCoverageReport = true;
+  # TODO: lcov doesn't work atm
+  #makeCoverageReport = true;

  client =
    { config, pkgs, ... }:

    { imports = [ ./common/x11.nix ];
      hardware.opengl.driSupport = true;
-      services.xserver.defaultDepth = pkgs.lib.mkOverride 0 16;
      environment.systemPackages = [ pkgs.quake3demo ];
      nixpkgs.config.packageOverrides = overrides;
    };
--- a/nixos/tests/virtualbox.nix
+++ b/nixos/tests/virtualbox.nix
@ -0,0 +1,250 @@
+import ./make-test.nix ({ pkgs, ... }: let
+
+  testVMConfig = { config, pkgs, ... }: {
+    boot.kernelParams = [
+      "console=tty0" "console=ttyS0" "ignore_loglevel"
+      "boot.trace" "panic=1" "boot.panic_on_fail"
+    ];
+
+    fileSystems."/" = {
+      device = "vboxshare";
+      fsType = "vboxsf";
+    };
+
+    services.virtualboxGuest.enable = true;
+
+    boot.initrd.kernelModules = [ "vboxsf" ];
+
+    boot.initrd.extraUtilsCommands = ''
+      cp -av -t "$out/bin/" \
+        "${pkgs.linuxPackages.virtualboxGuestAdditions}/sbin/mount.vboxsf"
+    '';
+
+    boot.initrd.postMountCommands = ''
+      touch /mnt-root/boot-done
+
+      i=0
+      while [ ! -e /mnt-root/shutdown ]; do
+        sleep 10
+        i=$(($i + 10))
+        [ $i -le 120 ] || fail
+      done
+
+      rm -f /mnt-root/boot-done /mnt-root/shutdown
+      poweroff -f
+    '';
+
+    system.requiredKernelConfig = with config.lib.kernelConfig; [
+      (isYes "SERIAL_8250_CONSOLE")
+      (isYes "SERIAL_8250")
+    ];
+  };
+
+  testVM = let
+    cfg = (import ../lib/eval-config.nix {
+      system = "i686-linux";
+      modules = [
+        ../modules/profiles/minimal.nix
+        testVMConfig
+      ];
+    }).config;
+  in pkgs.vmTools.runInLinuxVM (pkgs.runCommand "virtualbox-image" {
+    preVM = ''
+      mkdir -p "$out"
+      diskImage="$(pwd)/qimage"
+      ${pkgs.vmTools.qemu}/bin/qemu-img create -f raw "$diskImage" 100M
+    '';
+
+    postVM = ''
+      echo "creating VirtualBox disk image..."
+      ${pkgs.vmTools.qemu}/bin/qemu-img convert -f raw -O vdi \
+        "$diskImage" "$out/disk.vdi"
+    '';
+
+    buildInputs = [ pkgs.utillinux pkgs.perl ];
+  } ''
+    ${pkgs.parted}/sbin/parted /dev/vda mklabel msdos
+    ${pkgs.parted}/sbin/parted /dev/vda -- mkpart primary ext2 1M -1s
+    . /sys/class/block/vda1/uevent
+    mknod /dev/vda1 b $MAJOR $MINOR
+
+    ${pkgs.e2fsprogs}/sbin/mkfs.ext4 /dev/vda1
+    ${pkgs.e2fsprogs}/sbin/tune2fs -c 0 -i 0 /dev/vda1
+    mkdir /mnt
+    mount /dev/vda1 /mnt
+    cp "${cfg.system.build.kernel}/bzImage" /mnt/linux
+    cp "${cfg.system.build.initialRamdisk}/initrd" /mnt/initrd
+
+    ${pkgs.grub2}/bin/grub-install --boot-directory=/mnt /dev/vda
+
+    cat > /mnt/grub/grub.cfg <<GRUB
+    set root=hd0,1
+    linux /linux ${pkgs.lib.concatStringsSep " " cfg.boot.kernelParams}
+    initrd /initrd
+    boot
+    GRUB
+    umount /mnt
+  '');
+
+in {
+  name = "virtualbox";
+
+  machine = { pkgs, ... }: {
+    imports = [ ./common/user-account.nix ./common/x11.nix ];
+    services.virtualboxHost.enable = true;
+
+    systemd.sockets.vboxtestlog = {
+      description = "VirtualBox Test Machine Log Socket";
+      wantedBy = [ "sockets.target" ];
+      before = [ "multi-user.target" ];
+      socketConfig.ListenStream = "/run/virtualbox-log.sock";
+      socketConfig.Accept = true;
+    };
+
+    systemd.services."vboxtestlog@" = {
+      description = "VirtualBox Test Machine Log";
+      serviceConfig.StandardInput = "socket";
+      serviceConfig.StandardOutput = "syslog";
+      serviceConfig.SyslogIdentifier = "testvm";
+      serviceConfig.ExecStart = "${pkgs.coreutils}/bin/cat";
+    };
+  };
+
+  testScript = let
+    mkFlags = pkgs.lib.concatStringsSep " ";
+
+    createFlags = mkFlags [
+      "--ostype Linux26"
+      "--register"
+    ];
+
+    vmFlags = mkFlags [
+      "--uart1 0x3F8 4"
+      "--uartmode1 client /run/virtualbox-log.sock"
+    ];
+
+    controllerFlags = mkFlags [
+      "--name SATA"
+      "--add sata"
+      "--bootable on"
+      "--hostiocache on"
+    ];
+
+    diskFlags = mkFlags [
+      "--storagectl SATA"
+      "--port 0"
+      "--device 0"
+      "--type hdd"
+      "--mtype immutable"
+      "--medium ${testVM}/disk.vdi"
+    ];
+
+    sharedFlags = mkFlags [
+      "--name vboxshare"
+      "--hostpath /home/alice/vboxshare"
+    ];
+  in ''
+    sub ru {
+      return "su - alice -c '$_[0]'";
+    }
+
+    sub waitForVMBoot {
+      $machine->execute(ru(
+        'set -e; i=0; '.
+        'while ! test -e /home/alice/vboxshare/boot-done; do '.
+        'sleep 10; i=$(($i + 10)); [ $i -le 3600 ]; '.
+        'VBoxManage list runningvms | grep -qF test; '.
+        'done'
+      ));
+    }
+
+    sub checkRunning {
+      my $checkrunning = ru "VBoxManage list runningvms | grep -qF test";
+      my ($status, $out) = $machine->execute($checkrunning);
+      return $status == 0;
+    }
+
+    sub waitForStartup {
+      for (my $i = 0; $i <= 120; $i += 10) {
+        $machine->sleep(10);
+        return if checkRunning;
+      }
+      die "VirtualBox VM didn't start up within 2 minutes";
+    }
+
+    sub waitForShutdown {
+      for (my $i = 0; $i <= 120; $i += 10) {
+        $machine->sleep(10);
+        return unless checkRunning;
+      }
+      die "VirtualBox VM didn't shut down within 2 minutes";
+    }
+
+    sub shutdownVM {
+      $machine->succeed(ru "touch /home/alice/vboxshare/shutdown");
+      $machine->waitUntilSucceeds(
+        "test ! -e /home/alice/vboxshare/shutdown ".
+        "  -a ! -e /home/alice/vboxshare/boot-done"
+      );
+      waitForShutdown;
+    }
+
+    sub cleanup {
+      $machine->execute(ru "VBoxManage controlvm test poweroff")
+        if checkRunning;
+      $machine->succeed("rm -rf /home/alice/vboxshare");
+      $machine->succeed("mkdir -p /home/alice/vboxshare");
+      $machine->succeed("chown alice.users /home/alice/vboxshare");
+    }
+
+    $machine->waitForX;
+
+    $machine->succeed(ru "VBoxManage createvm --name test ${createFlags}");
+    $machine->succeed(ru "VBoxManage modifyvm test ${vmFlags}");
+
+    $machine->fail("test -e '/root/VirtualBox VMs'");
+    $machine->succeed("test -e '/home/alice/VirtualBox VMs'");
+
+    $machine->succeed(ru "VBoxManage storagectl test ${controllerFlags}");
+    $machine->succeed(ru "VBoxManage storageattach test ${diskFlags}");
+
+    $machine->succeed(ru "VBoxManage sharedfolder add test ${sharedFlags}");
+
+    $machine->succeed(ru "VBoxManage showvminfo test >&2");
+
+    cleanup;
+
+    subtest "virtualbox-gui", sub {
+      $machine->succeed(ru "VirtualBox &");
+      $machine->waitForWindow(qr/Oracle VM VirtualBox Manager/);
+      $machine->sleep(5);
+      $machine->screenshot("gui_manager_started");
+      $machine->sendKeys("ret");
+      $machine->screenshot("gui_manager_sent_startup");
+      waitForStartup;
+      $machine->screenshot("gui_started");
+      waitForVMBoot;
+      $machine->screenshot("gui_booted");
+      shutdownVM;
+      $machine->sleep(5);
+      $machine->screenshot("gui_stopped");
+      $machine->sendKeys("ctrl-q");
+      $machine->sleep(5);
+      $machine->screenshot("gui_manager_stopped");
+    };
+
+    cleanup;
+
+    subtest "virtualbox-cli", sub {
+      $machine->succeed(ru "VBoxManage startvm test");
+      waitForStartup;
+      $machine->screenshot("cli_started");
+      waitForVMBoot;
+      $machine->screenshot("cli_booted");
+      shutdownVM;
+    };
+
+    $machine->fail("test -e '/root/VirtualBox VMs'");
+    $machine->succeed("test -e '/home/alice/VirtualBox VMs'");
+  '';
+})
--- a/pkgs/applications/audio/cava/default.nix
+++ b/pkgs/applications/audio/cava/default.nix
@ -0,0 +1,26 @@
+{ stdenv, fetchgit, alsaLib, fftw }:
+
+stdenv.mkDerivation rec {
+  name = "cava-${version}";
+  version = "27dbdf47daae44c780db9998c760007b3bf63738";
+
+  buildInputs = [ alsaLib fftw ];
+
+  src = fetchgit {
+    url = "https://github.com/karlstav/cava";
+    rev = version;
+    sha256 = "1a61e2c869376276cf78e6446cd1cc7f96b3e378fa8bc0bc4c5ca81945429909";
+  };
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp cava $out/bin
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Console-based Audio Visualizer for Alsa";
+    homepage = https://github.com/karlstav/cava;
+    maintainers = with maintainers; [offline];
+    platforms = with platforms; linux;
+  };
+}
--- a/pkgs/applications/misc/k2pdfopt/default.nix
+++ b/pkgs/applications/misc/k2pdfopt/default.nix
@ -96,7 +96,7 @@ in stdenv.mkDerivation rec {
            -ljbig2dec -ljpeg -lopenjp2 -lpng -lfreetype -lpthread -lmujs \
            -lPgm2asc -llept -ltesseract -lcrypto

-    mkdir -p $out/bin
+    mkdir -p $out/bin 
    cp k2pdfopt $out/bin
  '';

--- a/pkgs/applications/misc/llpp/default.nix
+++ b/pkgs/applications/misc/llpp/default.nix
@ -1,5 +1,5 @@
 { stdenv, makeWrapper, fetchgit, pkgconfig, ninja, ocaml, findlib, mupdf, lablgl
-, gtk3, openjpeg, jbig2dec, mujs }:
+, gtk3, openjpeg, jbig2dec, mujs, xsel }:

 let ocamlVersion = (builtins.parseDrvName (ocaml.name)).version;
 in stdenv.mkDerivation rec {
@ -28,7 +28,8 @@ in stdenv.mkDerivation rec {
    install link.so $out/lib
    wrapProgram $out/bin/llpp \
        --prefix CAML_LD_LIBRARY_PATH ":" "${lablgl}/lib/ocaml/${ocamlVersion}/site-lib/lablgl" \
-        --prefix CAML_LD_LIBRARY_PATH ":" "$out/lib"
+        --prefix CAML_LD_LIBRARY_PATH ":" "$out/lib" \
+        --prefix PATH ":" "${xsel}/bin"
  '';

  meta = with stdenv.lib; {
--- a/pkgs/applications/misc/taffybar/default.nix
+++ b/pkgs/applications/misc/taffybar/default.nix
@ -8,8 +8,8 @@

 cabal.mkDerivation (self: {
  pname = "taffybar";
-  version = "0.4.3";
-  sha256 = "1h7acdzq3bndy44lyvgnm3gvxpbhzcs0ymvkrhmn3y41bfcwaac2";
+  version = "0.4.4";
+  sha256 = "046nfp878mqj9acsid94mqp8q1yqnm1hsdkv88m5qpmn182xljwh";
  isLibrary = true;
  isExecutable = true;
  buildDepends = [
--- a/pkgs/applications/misc/xca/default.nix
+++ b/pkgs/applications/misc/xca/default.nix
@ -28,6 +28,5 @@ stdenv.mkDerivation rec {
    homepage = http://xca.sourceforge.net/;
    platforms = platforms.all;
    license = licenses.bsd3;
-    broken = true;
  };
 }
--- a/pkgs/applications/networking/browsers/firefox/wrapper.nix
+++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix
@ -1,5 +1,5 @@
 { stdenv, lib, browser, makeDesktopItem, makeWrapper, plugins, gst_plugins, libs, gtk_modules
-, browserName, desktopName, nameSuffix, icon
+, browserName, desktopName, nameSuffix, icon, libtrick ? true
 }:

 let p = builtins.parseDrvName browser.name; in
@ -33,7 +33,21 @@ stdenv.mkDerivation {
        --suffix-each GTK_PATH ':' "$gtk_modules" \
        --suffix-each LD_PRELOAD ':' "$(cat $(filterExisting $(addSuffix /extra-ld-preload $plugins)))" \
        --prefix GST_PLUGIN_SYSTEM_PATH : "$GST_PLUGIN_SYSTEM_PATH" \
-        --prefix-contents PATH ':' "$(filterExisting $(addSuffix /extra-bin-path $plugins))"
+        --prefix-contents PATH ':' "$(filterExisting $(addSuffix /extra-bin-path $plugins))" \
+        --set MOZ_OBJDIR "$(ls -d "${browser}/lib/${browserName}*")"
+
+    ${ lib.optionalString libtrick
+    ''
+    sed -e "s@exec @exec -a '$out/bin/${browserName}${nameSuffix}' @" -i "$out/bin/${browserName}${nameSuffix}"
+    libdirname="$(echo "${browser}/lib/${browserName}"*)"
+    libdirbasename="$(basename "$libdirname")"
+    mkdir -p "$out/lib/$libdirbasename"
+    ln -s "$libdirname"/* "$out/lib/$libdirbasename"
+    script_location="$(mktemp "$out/lib/$libdirbasename/${browserName}${nameSuffix}.XXXXXX")"
+    mv "$out/bin/${browserName}${nameSuffix}" "$script_location"
+    ln -s "$script_location" "$out/bin/${browserName}${nameSuffix}"
+    ''
+    }

    mkdir -p $out/share/applications
    cp $desktopItem/share/applications/* $out/share/applications
--- a/pkgs/applications/networking/instant-messengers/telepathy/idle/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telepathy/idle/default.nix
@ -0,0 +1,20 @@
+{ stdenv, fetchurl, glib, pkgconfig, dbus_glib, telepathy_glib, libxslt }:
+
+stdenv.mkDerivation rec {
+  pname = "telepathy-idle";
+  version = "0.2.0";
+  name = "${pname}-${version}";
+
+  src = fetchurl {
+    url = "http://telepathy.freedesktop.org/releases/${pname}/${name}.tar.gz";
+    sha256 = "1argdzbif1vdmwp5vqbgkadq9ancjmgdm2ncp0qfckni715ss4rh";
+  };
+
+  buildInputs = [ pkgconfig glib telepathy_glib dbus_glib libxslt ];
+
+  meta = {
+    description = "IRC connection manager for the Telepathy framework";
+    license = stdenv.lib.licenses.lgpl21;
+    platforms = stdenv.lib.platforms.gnu;
+  };
+}
--- a/pkgs/applications/version-management/git-and-tools/github-backup/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/github-backup/default.nix
@ -7,8 +7,8 @@

 cabal.mkDerivation (self: {
  pname = "github-backup";
-  version = "1.20141110";
-  sha256 = "0675zcijfap757076r3j7js4iadnj1jbihmchf6ikzaanczmq1kg";
+  version = "1.20141204";
+  sha256 = "0asj0ix81k6vi95rwlhs7ikk936lzfsav4gw0gvyzf31ggmf4j4c";
  isLibrary = false;
  isExecutable = true;
  buildDepends = [
--- a/pkgs/applications/version-management/gitlab-shell/default.nix
+++ b/pkgs/applications/version-management/gitlab-shell/default.nix
@ -0,0 +1,59 @@
+{ stdenv, ruby, rubyLibs, fetchgit }:
+
+stdenv.mkDerivation rec {
+  version = "2.1.0";
+  name = "gitlab-shell-${version}";
+  
+  srcs = fetchgit {
+    url = "https://gitlab.com/gitlab-org/gitlab-shell.git";
+    rev = "823aba63e444afa2f45477819770fec3cb5f0159";
+    sha256 = "0ppf547xs9pvmk49v4h043d0j93k5n4q0yx3b9ssrc4qf2smflgq";
+  };
+
+  buildInputs = [
+    ruby rubyLibs.bundler
+  ];
+
+  installPhase = ''
+    mkdir -p $out/
+    cp -R . $out/
+
+    # Nothing to install ATM for non-development but keeping the
+    # install command anyway in case that changes in the future:
+    export HOME=$(pwd)
+    bundle install -j4 --verbose --local --deployment --without development test
+  '';
+  
+  # gitlab-shell will try to read its config relative to the source
+  # code by default which doesn't work in nixos because it's a
+  # read-only filesystem
+  postPatch = ''
+    substituteInPlace lib/gitlab_config.rb --replace\
+       "File.join(ROOT_PATH, 'config.yml')"\
+       "ENV['GITLAB_SHELL_CONFIG_PATH']"
+    substituteInPlace lib/gitlab_net.rb --replace\
+       "File.read File.join(ROOT_PATH, '.gitlab_shell_secret')"\
+       "File.read ENV['GITLAB_SHELL_SECRET_PATH']"
+
+    # Note that we're running gitlab-shell from current-system/sw
+    # because otherwise updating gitlab-shell won't be reflected in
+    # the hardcoded path of the authorized-keys file:
+    substituteInPlace lib/gitlab_keys.rb --replace\
+        "auth_line = \"command=\\\"#{ROOT_PATH}/bin/gitlab-shell"\
+        "auth_line = \"command=\\\"GITLAB_SHELL_CONFIG_PATH=#{ENV['GITLAB_SHELL_CONFIG_PATH']} GITLAB_SHELL_SECRET_PATH=#{ENV['GITLAB_SHELL_SECRET_PATH']} /run/current-system/sw/bin/gitlab-shell"
+
+    # We're setting GITLAB_SHELL_CONFIG_PATH in the ssh authorized key
+    # environment because we need it in gitlab_configrb
+    # . unsetenv_others will remove that so we're not doing it for
+    # now.
+    #
+    # TODO: Are there any security implications? The commit adding
+    # unsetenv_others didn't mention anything...
+    # 
+    # Kernel::exec({'PATH' => ENV['PATH'], 'LD_LIBRARY_PATH' => ENV['LD_LIBRARY_PATH'], 'GL_ID' => ENV['GL_ID']}, *args, unsetenv_others: true)
+    substituteInPlace lib/gitlab_shell.rb --replace\
+        " *args, unsetenv_others: true)"\
+        " *args)"
+  '';
+
+}
--- a/pkgs/applications/version-management/gitlab/Gemfile.lock
+++ b/pkgs/applications/version-management/gitlab/Gemfile.lock
@ -0,0 +1,705 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    RedCloth (4.2.9)
+    ace-rails-ap (2.0.1)
+    actionmailer (4.1.1)
+      actionpack (= 4.1.1)
+      actionview (= 4.1.1)
+      mail (~> 2.5.4)
+    actionpack (4.1.1)
+      actionview (= 4.1.1)
+      activesupport (= 4.1.1)
+      rack (~> 1.5.2)
+      rack-test (~> 0.6.2)
+    actionview (4.1.1)
+      activesupport (= 4.1.1)
+      builder (~> 3.1)
+      erubis (~> 2.7.0)
+    activemodel (4.1.1)
+      activesupport (= 4.1.1)
+      builder (~> 3.1)
+    activerecord (4.1.1)
+      activemodel (= 4.1.1)
+      activesupport (= 4.1.1)
+      arel (~> 5.0.0)
+    activesupport (4.1.1)
+      i18n (~> 0.6, >= 0.6.9)
+      json (~> 1.7, >= 1.7.7)
+      minitest (~> 5.1)
+      thread_safe (~> 0.1)
+      tzinfo (~> 1.1)
+    acts-as-taggable-on (2.4.1)
+      rails (>= 3, < 5)
+    addressable (2.3.5)
+    annotate (2.6.0)
+      activerecord (>= 2.3.0)
+      rake (>= 0.8.7)
+    arel (5.0.1.20140414130214)
+    asciidoctor (0.1.4)
+    awesome_print (1.2.0)
+    axiom-types (0.0.5)
+      descendants_tracker (~> 0.0.1)
+      ice_nine (~> 0.9)
+    bcrypt (3.1.7)
+    better_errors (1.0.1)
+      coderay (>= 1.0.0)
+      erubis (>= 2.6.6)
+    binding_of_caller (0.7.2)
+      debug_inspector (>= 0.0.1)
+    bootstrap-sass (3.0.3.0)
+      sass (~> 3.2)
+    builder (3.2.2)
+    capybara (2.2.1)
+      mime-types (>= 1.16)
+      nokogiri (>= 1.3.3)
+      rack (>= 1.0.0)
+      rack-test (>= 0.5.4)
+      xpath (~> 2.0)
+    carrierwave (0.9.0)
+      activemodel (>= 3.2.0)
+      activesupport (>= 3.2.0)
+      json (>= 1.7)
+    celluloid (0.15.2)
+      timers (~> 1.1.0)
+    charlock_holmes (0.6.9.4)
+    cliver (0.3.2)
+    code_analyzer (0.4.3)
+      sexp_processor
+    coderay (1.1.0)
+    coercible (1.0.0)
+      descendants_tracker (~> 0.0.1)
+    coffee-rails (4.0.1)
+      coffee-script (>= 2.2.0)
+      railties (>= 4.0.0, < 5.0)
+    coffee-script (2.2.0)
+      coffee-script-source
+      execjs
+    coffee-script-source (1.6.3)
+    colored (1.2)
+    colorize (0.5.8)
+    connection_pool (1.2.0)
+    coveralls (0.7.0)
+      multi_json (~> 1.3)
+      rest-client
+      simplecov (>= 0.7)
+      term-ansicolor
+      thor
+    crack (0.4.1)
+      safe_yaml (~> 0.9.0)
+    creole (0.3.8)
+    d3_rails (3.1.10)
+      railties (>= 3.1.0)
+    daemons (1.1.9)
+    database_cleaner (1.3.0)
+    debug_inspector (0.0.2)
+    default_value_for (3.0.0)
+      activerecord (>= 3.2.0, < 5.0)
+    descendants_tracker (0.0.3)
+    devise (3.2.4)
+      bcrypt (~> 3.0)
+      orm_adapter (~> 0.1)
+      railties (>= 3.2.6, < 5)
+      thread_safe (~> 0.1)
+      warden (~> 1.2.3)
+    devise-async (0.9.0)
+      devise (~> 3.2)
+    diff-lcs (1.2.5)
+    diffy (3.0.3)
+    docile (1.1.5)
+    dotenv (0.9.0)
+    dropzonejs-rails (0.4.14)
+      rails (> 3.1)
+    email_spec (1.5.0)
+      launchy (~> 2.1)
+      mail (~> 2.2)
+    emoji (1.0.1)
+      json
+    enumerize (0.7.0)
+      activesupport (>= 3.2)
+    equalizer (0.0.8)
+    erubis (2.7.0)
+    escape_utils (0.2.4)
+    eventmachine (1.0.3)
+    excon (0.32.1)
+    execjs (2.0.2)
+    expression_parser (0.9.0)
+    factory_girl (4.3.0)
+      activesupport (>= 3.0.0)
+    factory_girl_rails (4.3.0)
+      factory_girl (~> 4.3.0)
+      railties (>= 3.0.0)
+    faraday (0.8.9)
+      multipart-post (~> 1.2.0)
+    faraday_middleware (0.9.0)
+      faraday (>= 0.7.4, < 0.9)
+    ffaker (1.22.1)
+    ffi (1.9.3)
+    fog (1.21.0)
+      fog-brightbox
+      fog-core (~> 1.21, >= 1.21.1)
+      fog-json
+      nokogiri (~> 1.5, >= 1.5.11)
+    fog-brightbox (0.0.1)
+      fog-core
+      fog-json
+    fog-core (1.21.1)
+      builder
+      excon (~> 0.32)
+      formatador (~> 0.2.0)
+      mime-types
+      net-scp (~> 1.1)
+      net-ssh (>= 2.1.3)
+    fog-json (1.0.0)
+      multi_json (~> 1.0)
+    font-awesome-rails (4.2.0.0)
+      railties (>= 3.2, < 5.0)
+    foreman (0.63.0)
+      dotenv (>= 0.7)
+      thor (>= 0.13.6)
+    formatador (0.2.4)
+    gemnasium-gitlab-service (0.2.2)
+      rugged (~> 0.19)
+    gherkin-ruby (0.3.1)
+      racc
+    github-markup (1.1.0)
+    gitlab-flowdock-git-hook (0.4.2.2)
+      gitlab-grit (>= 2.4.1)
+      multi_json
+    gitlab-grack (2.0.0.pre)
+      rack (~> 1.5.1)
+    gitlab-grit (2.6.12)
+      charlock_holmes (~> 0.6)
+      diff-lcs (~> 1.1)
+      mime-types (~> 1.15)
+      posix-spawn (~> 0.3)
+    gitlab-linguist (3.0.0)
+      charlock_holmes (~> 0.6.6)
+      escape_utils (~> 0.2.4)
+      mime-types (~> 1.19)
+    gitlab_emoji (0.0.1.1)
+      emoji (~> 1.0.1)
+    gitlab_git (7.0.0.rc10)
+      activesupport (~> 4.0)
+      charlock_holmes (~> 0.6)
+      gitlab-linguist (~> 3.0)
+      rugged (~> 0.21.0)
+    gitlab_meta (7.0)
+    gitlab_omniauth-ldap (1.1.0)
+      net-ldap (~> 0.7.0)
+      omniauth (~> 1.0)
+      pyu-ruby-sasl (~> 0.0.3.1)
+      rubyntlm (~> 0.1.1)
+    gollum-lib (3.0.0)
+      github-markup (~> 1.1.0)
+      gitlab-grit (~> 2.6.5)
+      nokogiri (~> 1.6.1)
+      rouge (~> 1.3.3)
+      sanitize (~> 2.1.0)
+      stringex (~> 2.5.1)
+    gon (5.0.1)
+      actionpack (>= 2.3.0)
+      json
+    grape (0.6.1)
+      activesupport
+      builder
+      hashie (>= 1.2.0)
+      multi_json (>= 1.3.2)
+      multi_xml (>= 0.5.2)
+      rack (>= 1.3.0)
+      rack-accept
+      rack-mount
+      virtus (>= 1.0.0)
+    grape-entity (0.4.2)
+      activesupport
+      multi_json (>= 1.3.2)
+    growl (1.0.3)
+    guard (2.2.4)
+      formatador (>= 0.2.4)
+      listen (~> 2.1)
+      lumberjack (~> 1.0)
+      pry (>= 0.9.12)
+      thor (>= 0.18.1)
+    guard-rspec (4.2.0)
+      guard (>= 2.1.1)
+      rspec (>= 2.14, < 4.0)
+    guard-spinach (0.0.2)
+      guard (>= 1.1)
+      spinach
+    haml (4.0.5)
+      tilt
+    haml-rails (0.5.3)
+      actionpack (>= 4.0.1)
+      activesupport (>= 4.0.1)
+      haml (>= 3.1, < 5.0)
+      railties (>= 4.0.1)
+    hashie (2.1.2)
+    hike (1.2.3)
+    hipchat (0.14.0)
+      httparty
+      httparty
+    html-pipeline (1.11.0)
+      activesupport (>= 2)
+      nokogiri (~> 1.4)
+    html-pipeline-gitlab (0.1.5)
+      actionpack (~> 4)
+      gitlab_emoji (~> 0.0.1)
+      html-pipeline (~> 1.11.0)
+      sanitize (~> 2.1)
+    http_parser.rb (0.5.3)
+    httparty (0.13.0)
+      json (~> 1.8)
+      multi_xml (>= 0.5.2)
+    httpauth (0.2.1)
+    i18n (0.6.11)
+    ice_nine (0.10.0)
+    jasmine (2.0.2)
+      jasmine-core (~> 2.0.0)
+      phantomjs
+      rack (>= 1.2.1)
+      rake
+    jasmine-core (2.0.0)
+    jquery-atwho-rails (0.3.3)
+    jquery-rails (3.1.0)
+      railties (>= 3.0, < 5.0)
+      thor (>= 0.14, < 2.0)
+    jquery-scrollto-rails (1.4.3)
+      railties (> 3.1, < 5.0)
+    jquery-turbolinks (2.0.1)
+      railties (>= 3.1.0)
+      turbolinks
+    jquery-ui-rails (4.2.1)
+      railties (>= 3.2.16)
+    json (1.8.1)
+    jwt (0.1.13)
+      multi_json (>= 1.5)
+    kaminari (0.15.1)
+      actionpack (>= 3.0.0)
+      activesupport (>= 3.0.0)
+    kgio (2.8.1)
+    launchy (2.4.2)
+      addressable (~> 2.3)
+    letter_opener (1.1.2)
+      launchy (~> 2.2)
+    listen (2.3.1)
+      celluloid (>= 0.15.2)
+      rb-fsevent (>= 0.9.3)
+      rb-inotify (>= 0.9)
+    lumberjack (1.0.4)
+    mail (2.5.4)
+      mime-types (~> 1.16)
+      treetop (~> 1.4.8)
+    method_source (0.8.2)
+    mime-types (1.25.1)
+    mini_portile (0.6.0)
+    minitest (5.3.5)
+    mousetrap-rails (1.4.6)
+    multi_json (1.10.1)
+    multi_xml (0.5.5)
+    multipart-post (1.2.0)
+    net-ldap (0.7.0)
+    net-scp (1.1.2)
+      net-ssh (>= 2.6.5)
+    net-ssh (2.8.0)
+    newrelic_rpm (3.9.4.245)
+    nokogiri (1.6.2.1)
+      mini_portile (= 0.6.0)
+    nprogress-rails (0.1.2.3)
+    oauth (0.4.7)
+    oauth2 (0.8.1)
+      faraday (~> 0.8)
+      httpauth (~> 0.1)
+      jwt (~> 0.1.4)
+      multi_json (~> 1.0)
+      rack (~> 1.2)
+    omniauth (1.1.4)
+      hashie (>= 1.2, < 3)
+      rack
+    omniauth-github (1.1.1)
+      omniauth (~> 1.0)
+      omniauth-oauth2 (~> 1.1)
+    omniauth-google-oauth2 (0.2.5)
+      omniauth (> 1.0)
+      omniauth-oauth2 (~> 1.1)
+    omniauth-oauth (1.0.1)
+      oauth
+      omniauth (~> 1.0)
+    omniauth-oauth2 (1.1.1)
+      oauth2 (~> 0.8.0)
+      omniauth (~> 1.0)
+    omniauth-shibboleth (1.1.1)
+      omniauth (>= 1.0.0)
+    omniauth-twitter (1.0.1)
+      multi_json (~> 1.3)
+      omniauth-oauth (~> 1.0)
+    org-ruby (0.9.9)
+      rubypants (~> 0.2)
+    orm_adapter (0.5.0)
+    pg (0.15.1)
+    phantomjs (1.9.2.0)
+    poltergeist (1.5.1)
+      capybara (~> 2.1)
+      cliver (~> 0.3.1)
+      multi_json (~> 1.0)
+      websocket-driver (>= 0.2.0)
+    polyglot (0.3.4)
+    posix-spawn (0.3.9)
+    pry (0.9.12.4)
+      coderay (~> 1.0)
+      method_source (~> 0.8)
+      slop (~> 3.4)
+    pyu-ruby-sasl (0.0.3.3)
+    quiet_assets (1.0.2)
+      railties (>= 3.1, < 5.0)
+    racc (1.4.10)
+    rack (1.5.2)
+    rack-accept (0.4.5)
+      rack (>= 0.4)
+    rack-attack (2.3.0)
+      rack
+    rack-cors (0.2.9)
+    rack-mini-profiler (0.9.0)
+      rack (>= 1.1.3)
+    rack-mount (0.8.3)
+      rack (>= 1.0.0)
+    rack-protection (1.5.1)
+      rack
+    rack-test (0.6.2)
+      rack (>= 1.0)
+    rails (4.1.1)
+      actionmailer (= 4.1.1)
+      actionpack (= 4.1.1)
+      actionview (= 4.1.1)
+      activemodel (= 4.1.1)
+      activerecord (= 4.1.1)
+      activesupport (= 4.1.1)
+      bundler (>= 1.3.0, < 2.0)
+      railties (= 4.1.1)
+      sprockets-rails (~> 2.0)
+    rails_autolink (1.1.6)
+      rails (> 3.1)
+    rails_best_practices (1.14.4)
+      activesupport
+      awesome_print
+      code_analyzer (>= 0.4.3)
+      colored
+      erubis
+      i18n
+      require_all
+      ruby-progressbar
+    railties (4.1.1)
+      actionpack (= 4.1.1)
+      activesupport (= 4.1.1)
+      rake (>= 0.8.7)
+      thor (>= 0.18.1, < 2.0)
+    raindrops (0.12.0)
+    rake (10.3.2)
+    raphael-rails (2.1.2)
+    rb-fsevent (0.9.3)
+    rb-inotify (0.9.2)
+      ffi (>= 0.5.0)
+    rdoc (3.12.2)
+      json (~> 1.4)
+    redcarpet (3.1.2)
+    redis (3.0.6)
+    redis-actionpack (4.0.0)
+      actionpack (~> 4)
+      redis-rack (~> 1.5.0)
+      redis-store (~> 1.1.0)
+    redis-activesupport (4.0.0)
+      activesupport (~> 4)
+      redis-store (~> 1.1.0)
+    redis-namespace (1.4.1)
+      redis (~> 3.0.4)
+    redis-rack (1.5.0)
+      rack (~> 1.5)
+      redis-store (~> 1.1.0)
+    redis-rails (4.0.0)
+      redis-actionpack (~> 4)
+      redis-activesupport (~> 4)
+      redis-store (~> 1.1.0)
+    redis-store (1.1.4)
+      redis (>= 2.2)
+    request_store (1.0.5)
+    require_all (1.3.2)
+    rest-client (1.6.7)
+      mime-types (>= 1.16)
+    rinku (1.7.3)
+    rouge (1.3.3)
+    rspec (2.14.1)
+      rspec-core (~> 2.14.0)
+      rspec-expectations (~> 2.14.0)
+      rspec-mocks (~> 2.14.0)
+    rspec-core (2.14.7)
+    rspec-expectations (2.14.4)
+      diff-lcs (>= 1.1.3, < 2.0)
+    rspec-mocks (2.14.4)
+    rspec-rails (2.14.0)
+      actionpack (>= 3.0)
+      activesupport (>= 3.0)
+      railties (>= 3.0)
+      rspec-core (~> 2.14.0)
+      rspec-expectations (~> 2.14.0)
+      rspec-mocks (~> 2.14.0)
+    ruby-progressbar (1.2.0)
+    rubyntlm (0.1.1)
+    rubypants (0.2.0)
+    rugged (0.21.0)
+    safe_yaml (0.9.7)
+    sanitize (2.1.0)
+      nokogiri (>= 1.4.4)
+    sass (3.2.19)
+    sass-rails (4.0.3)
+      railties (>= 4.0.0, < 5.0)
+      sass (~> 3.2.0)
+      sprockets (~> 2.8, <= 2.11.0)
+      sprockets-rails (~> 2.0)
+    sdoc (0.3.20)
+      json (>= 1.1.3)
+      rdoc (~> 3.10)
+    seed-fu (2.3.1)
+      activerecord (>= 3.1, < 4.2)
+      activesupport (>= 3.1, < 4.2)
+    select2-rails (3.5.2)
+      thor (~> 0.14)
+    semantic-ui-sass (0.16.1.0)
+      sass (~> 3.2)
+    settingslogic (2.0.9)
+    sexp_processor (4.4.0)
+    shoulda-matchers (2.1.0)
+      activesupport (>= 3.0.0)
+    sidekiq (2.17.0)
+      celluloid (>= 0.15.2)
+      connection_pool (>= 1.0.0)
+      json
+      redis (>= 3.0.4)
+      redis-namespace (>= 1.3.1)
+    simple_oauth (0.1.9)
+    simplecov (0.9.0)
+      docile (~> 1.1.0)
+      multi_json
+      simplecov-html (~> 0.8.0)
+    simplecov-html (0.8.0)
+    sinatra (1.4.4)
+      rack (~> 1.4)
+      rack-protection (~> 1.4)
+      tilt (~> 1.3, >= 1.3.4)
+    six (0.2.0)
+    slack-notifier (0.3.2)
+    slim (2.0.2)
+      temple (~> 0.6.6)
+      tilt (>= 1.3.3, < 2.1)
+    slop (3.4.7)
+    spinach (0.8.7)
+      colorize (= 0.5.8)
+      gherkin-ruby (>= 0.3.1)
+    spinach-rails (0.2.1)
+      capybara (>= 2.0.0)
+      railties (>= 3)
+      spinach (>= 0.4)
+    spring (1.1.3)
+    spring-commands-rspec (1.0.1)
+      spring (>= 0.9.1)
+    spring-commands-spinach (1.0.0)
+      spring (>= 0.9.1)
+    sprockets (2.11.0)
+      hike (~> 1.2)
+      multi_json (~> 1.0)
+      rack (~> 1.0)
+      tilt (~> 1.1, != 1.3.0)
+    sprockets-rails (2.1.3)
+      actionpack (>= 3.0)
+      activesupport (>= 3.0)
+      sprockets (~> 2.8)
+    stamp (0.5.0)
+    state_machine (1.2.0)
+    stringex (2.5.1)
+    temple (0.6.7)
+    term-ansicolor (1.2.2)
+      tins (~> 0.8)
+    test_after_commit (0.2.2)
+    thin (1.6.1)
+      daemons (>= 1.0.9)
+      eventmachine (>= 1.0.0)
+      rack (>= 1.0.0)
+    thor (0.19.1)
+    thread_safe (0.3.4)
+    tilt (1.4.1)
+    timers (1.1.0)
+    tinder (1.9.3)
+      eventmachine (~> 1.0)
+      faraday (~> 0.8)
+      faraday_middleware (~> 0.9)
+      hashie (>= 1.0, < 3)
+      json (~> 1.8.0)
+      mime-types (~> 1.19)
+      multi_json (~> 1.7)
+      twitter-stream (~> 0.1)
+    tins (0.13.1)
+    treetop (1.4.15)
+      polyglot
+      polyglot (>= 0.3.1)
+    turbolinks (2.0.0)
+      coffee-rails
+    twitter-stream (0.1.16)
+      eventmachine (>= 0.12.8)
+      http_parser.rb (~> 0.5.1)
+      simple_oauth (~> 0.1.4)
+    tzinfo (1.2.2)
+      thread_safe (~> 0.1)
+    uglifier (2.3.2)
+      execjs (>= 0.3.0)
+      json (>= 1.8.0)
+    underscore-rails (1.4.4)
+    unf (0.1.4)
+      unf_ext
+    unf_ext (0.0.6)
+    unicorn (4.6.3)
+      kgio (~> 2.6)
+      rack
+      raindrops (~> 0.7)
+    unicorn-worker-killer (0.4.2)
+      unicorn (~> 4)
+    version_sorter (1.1.0)
+    virtus (1.0.1)
+      axiom-types (~> 0.0.5)
+      coercible (~> 1.0)
+      descendants_tracker (~> 0.0.1)
+      equalizer (~> 0.0.7)
+    warden (1.2.3)
+      rack (>= 1.0)
+    webmock (1.16.0)
+      addressable (>= 2.2.7)
+      crack (>= 0.3.2)
+    websocket-driver (0.3.3)
+    wikicloth (0.8.1)
+      builder
+      expression_parser
+      rinku
+    xpath (2.0.0)
+      nokogiri (~> 1.3)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  RedCloth
+  ace-rails-ap
+  acts-as-taggable-on
+  annotate (~> 2.6.0.beta2)
+  asciidoctor (= 0.1.4)
+  awesome_print
+  better_errors
+  binding_of_caller
+  bootstrap-sass (~> 3.0)
+  capybara (~> 2.2.1)
+  carrierwave
+  coffee-rails
+  colored
+  coveralls
+  creole (~> 0.3.6)
+  d3_rails (~> 3.1.4)
+  database_cleaner
+  default_value_for (~> 3.0.0)
+  devise (= 3.2.4)
+  devise-async (= 0.9.0)
+  diffy (~> 3.0.3)
+  dropzonejs-rails
+  email_spec
+  enumerize
+  factory_girl_rails
+  ffaker
+  fog (~> 1.14)
+  font-awesome-rails (~> 4.2)
+  foreman
+  gemnasium-gitlab-service (~> 0.2)
+  github-markup
+  gitlab-flowdock-git-hook (~> 0.4.2)
+  gitlab-grack (~> 2.0.0.pre)
+  gitlab-linguist (~> 3.0.0)
+  gitlab_emoji (~> 0.0.1.1)
+  gitlab_git (= 7.0.0.rc10)
+  gitlab_meta (= 7.0)
+  gitlab_omniauth-ldap (= 1.1.0)
+  gollum-lib (~> 3.0.0)
+  gon (~> 5.0.0)
+  grape (~> 0.6.1)
+  grape-entity (~> 0.4.2)
+  growl
+  guard-rspec
+  guard-spinach
+  haml-rails
+  hipchat (~> 0.14.0)
+  html-pipeline-gitlab (~> 0.1.0)
+  httparty
+  jasmine (= 2.0.2)
+  jquery-atwho-rails (~> 0.3.3)
+  jquery-rails
+  jquery-scrollto-rails
+  jquery-turbolinks
+  jquery-ui-rails
+  kaminari (~> 0.15.1)
+  launchy
+  letter_opener
+  minitest (~> 5.3.0)
+  mousetrap-rails
+  mysql2
+  newrelic_rpm
+  nprogress-rails
+  omniauth (~> 1.1.3)
+  omniauth-github
+  omniauth-google-oauth2
+  omniauth-shibboleth
+  omniauth-twitter
+  org-ruby (= 0.9.9)
+  pg
+  poltergeist (~> 1.5.1)
+  pry
+  quiet_assets (~> 1.0.1)
+  rack-attack
+  rack-cors
+  rack-mini-profiler
+  rails (~> 4.1.0)
+  rails_autolink (~> 1.1)
+  rails_best_practices
+  raphael-rails (~> 2.1.2)
+  rb-fsevent
+  rb-inotify
+  rdoc (~> 3.6)
+  redcarpet (~> 3.1.2)
+  redis-rails
+  request_store
+  rspec-rails
+  sanitize (~> 2.0)
+  sass-rails (~> 4.0.2)
+  sdoc
+  seed-fu
+  select2-rails
+  semantic-ui-sass (~> 0.16.1.0)
+  settingslogic
+  shoulda-matchers (~> 2.1.0)
+  sidekiq (= 2.17.0)
+  simplecov
+  sinatra
+  six
+  slack-notifier (~> 0.3.2)
+  slim
+  spinach-rails
+  spring (= 1.1.3)
+  spring-commands-rspec (= 1.0.1)
+  spring-commands-spinach (= 1.0.0)
+  stamp
+  state_machine
+  test_after_commit
+  thin
+  tinder (~> 1.9.2)
+  turbolinks
+  uglifier
+  underscore-rails (~> 1.4.4)
+  unf
+  unicorn (~> 4.6.3)
+  unicorn-worker-killer
+  version_sorter
+  virtus
+  webmock
+  wikicloth (= 0.8.1)
--- a/pkgs/applications/version-management/gitlab/Gemfile.nix
+++ b/pkgs/applications/version-management/gitlab/Gemfile.nix
--- a/pkgs/applications/version-management/gitlab/README
+++ b/pkgs/applications/version-management/gitlab/README
@ -0,0 +1,5 @@
+to regenerate Gemfile.nix and Gemfile.lock you need to
+
+  % nix-build bootstrap.nix
+  % cp result/Gemfile.nix ./
+  % cp result/Gemfile.lock ./
--- a/pkgs/applications/version-management/gitlab/bootstrap.nix
+++ b/pkgs/applications/version-management/gitlab/bootstrap.nix
@ -0,0 +1,45 @@
+{ pkgs ? import <nixpkgs> {}
+}:
+
+with pkgs;
+
+let
+
+in stdenv.mkDerivation rec {
+  version = "7.4.2";
+  name = "gitlab-${version}";
+  __noChroot = true;
+  src = fetchurl {
+    url = "https://github.com/gitlabhq/gitlabhq/archive/v${version}.zip";
+    sha256 = "01iplkpa4scr0wcap6vjrc960dj15z4ciclaqswj0sz5hrp9glw6";
+  };
+  buildInputs = [
+    ruby rubyLibs.bundler libiconv libxslt libxml2 pkgconfig
+    libffi postgresql which stdenv unzip
+  ];
+  installPhase = ''
+    unset http_proxy
+    unset ftp_proxy
+
+    cp -R . $out
+    cp ${./generate_nix_requirements.rb} $out/generate_nix_requirements.rb
+    cd $out
+
+    cat > config/database.yml <<EOF
+    production:
+      adapter: postgresql
+    EOF
+
+    substituteInPlace Gemfile --replace 'gem "therubyracer"' ""
+
+    bundle config --local build.nokogiri --use-system-libraries \
+      --with-iconv-dir=${libiconv} \
+      --with-xslt-dir=${libxslt} \
+      --with-xml2-dir=${libxml2} \
+      --with-pkg-config \
+      --with-pg-config=${postgresql}/bin/pg_config
+
+    HOME="/tmp/gitlab-${version}" ruby generate_nix_requirements.rb
+    rm -R /tmp/gems
+  '';
+}
--- a/pkgs/applications/version-management/gitlab/default.nix
+++ b/pkgs/applications/version-management/gitlab/default.nix
@ -0,0 +1,87 @@
+{ stdenv, fetchurl, ruby, rubyLibs, libiconv, libxslt, libxml2, pkgconfig, libffi, postgresql, libyaml, ncurses, curl, openssh, redis, zlib, icu, checkinstall, logrotate, docutils, cmake, git, gdbm, readline, unzip, gnumake, which, tzdata, nodejs }:
+
+let
+  gemspec = map (gem: fetchurl { url=gem.url; sha256=gem.hash; }) (import ./Gemfile.nix);
+
+
+in stdenv.mkDerivation rec {
+  version = "7.4.2";
+  name = "gitlab-${version}";
+
+  src = fetchurl {
+    url = "https://github.com/gitlabhq/gitlabhq/archive/v${version}.zip";
+    sha256 = "01iplkpa4scr0wcap6vjrc960dj15z4ciclaqswj0sz5hrp9glw6";
+  };
+
+  buildInputs = [
+    ruby rubyLibs.bundler libyaml gdbm readline ncurses curl openssh redis zlib
+    postgresql libxslt libxml2 pkgconfig libffi icu checkinstall logrotate docutils nodejs
+    git unzip gnumake which cmake
+  ];
+
+  # cmake is required by a build depdenceny, not the main binary:
+  dontUseCmakeConfigure = true;
+
+  patches = [
+    ./remove-hardcoded-locations.patch
+  ];
+  postPatch = ''
+    mv config/gitlab.yml.example config/gitlab.yml
+  '';
+
+  installPhase = ''
+    mkdir -p $out/share/gitlab
+    cp -R . $out/share/gitlab
+    cd $out/share/gitlab
+
+    export HOME=$(pwd)
+    export GITLAB_EMAIL_FROM="required@to-make-it-work.org"
+
+    # required for some gems:
+    cat > config/database.yml <<EOF
+      production:
+        adapter: postgresql
+        database: gitlab
+        host: <%= ENV["GITLAB_DATABASE_HOST"] || "127.0.0.1" %>
+        password: <%= ENV["GITLAB_DATABASE_PASSWORD"] || "blerg" %>
+        username: gitlab
+        encoding: utf8
+    EOF
+
+    mkdir -p vendor/cache
+    ${stdenv.lib.concatStrings (map (gem: "ln -s ${gem} vendor/cache/${gem.name};") gemspec)}
+
+    cp ${./Gemfile.lock} Gemfile.lock
+    substituteInPlace Gemfile --replace 'gem "therubyracer"' ""
+
+    bundle config build.nokogiri \
+      --use-system-libraries \
+      --with-xslt-dir=${libxslt} \
+      --with-xml2-dir=${libxml2} \
+      --with-pkg-config=${pkgconfig}/bin/pkg-config \
+      --with-pg-config=${postgresql}/bin/pg_config
+
+    # See https://github.com/gitlabhq/gitlab-public-wiki/wiki/Trouble-Shooting-Guide:
+    bundle install -j4 --verbose --local --deployment --without development test mysql
+
+    # Fix timezone data directory
+    substituteInPlace $out/share/gitlab/vendor/bundle/ruby/*/gems/tzinfo-*/lib/tzinfo/zoneinfo_data_source.rb \
+      --replace "/etc/zoneinfo" "${tzdata}/share/zoneinfo"
+
+    # For reasons I don't understand "bundle exec" ignores the
+    # RAILS_ENV causing tests to be executed that fail because we're
+    # not installing development and test gems above. Deleting the
+    # tests works though.:
+    rm $out/share/gitlab/lib/tasks/test.rake
+
+    # Assets
+    bundle exec rake assets:precompile RAILS_ENV=production
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = http://www.gitlab.com/;
+    platforms = platforms.linux;
+    maintainers = [ ];
+    license = licenses.mit;
+  };
+}
--- a/pkgs/applications/version-management/gitlab/generate_nix_requirements.rb
+++ b/pkgs/applications/version-management/gitlab/generate_nix_requirements.rb
@ -0,0 +1,56 @@
+#!/usr/bin/env ruby
+
+require 'rubygems'
+require 'bundler'
+require 'fileutils'
+require 'net/http'
+require 'net/https'
+require 'uri'
+
+TMP_DIR = "/tmp/gems"
+
+FileUtils.rm_rf(TMP_DIR) if File.exists?(TMP_DIR)
+FileUtils.mkdir TMP_DIR
+
+GEMSERVER = "http://rubygems.org"
+
+# inspect Gemfile.lock
+lockfile = Bundler::LockfileParser.new(Bundler.read_file("Gemfile.lock"))
+
+to_mirror = {}
+
+uri = URI(GEMSERVER)
+http = Net::HTTP.new(uri.host, uri.port)
+http.use_ssl = uri.scheme == 'https'
+
+requirements = {}
+
+lockfile.specs.each do |s|
+  possible_gem_name = "#{s.name}-#{s.version.to_s}.gem"
+
+  Dir.chdir TMP_DIR do
+    filename = `gem fetch #{s.name} -v #{s.version.to_s}`.split()[1]
+    hash = `sha256sum #{filename}.gem`
+    url = "#{GEMSERVER}/downloads/#{filename}.gem"
+    puts url
+    requirements[s.name] = { :version => s.version.to_s, 
+                             :hash => hash.split().first,
+                             :url => url,}
+    
+  end
+end
+
+filename = 'Gemfile.nix'
+
+File.open(filename, 'w') do |file|
+  file.puts "["
+  requirements.each do |name, info|
+    file.puts "{"
+    file.puts ['name = ', '"', name, '";'].join('')
+    file.puts ['hash = ', '"', info[:hash], '";'].join('')
+    file.puts ['url = ', '"', info[:url], '";'].join('')
+    file.puts ['version = ', '"', info[:version], '";'].join('')
+    file.puts "}"
+  end
+  file.puts "]"
+end
--- a/pkgs/applications/version-management/gitlab/remove-hardcoded-locations.patch
+++ b/pkgs/applications/version-management/gitlab/remove-hardcoded-locations.patch
@ -0,0 +1,109 @@
+diff --git a/config/environments/production.rb b/config/environments/production.rb
+index 78bf543..9b37122 100644
+--- a/config/environments/production.rb
+++ b/config/environments/production.rb
+@@ -66,10 +66,10 @@ Gitlab::Application.configure do
+ 
+   config.action_mailer.delivery_method = :sendmail
+   # Defaults to:
+-  # # config.action_mailer.sendmail_settings = {
+-  # #   location: '/usr/sbin/sendmail',
+-  # #   arguments: '-i -t'
+-  # # }
+  config.action_mailer.sendmail_settings = {
+    location: '/var/setuid-wrappers/sendmail',
+    arguments: '-i -t'
+  }
+   config.action_mailer.perform_deliveries = true
+   config.action_mailer.raise_delivery_errors = true
+ 
+diff --git a/config/gitlab.yml.example b/config/gitlab.yml.example
+index e7a8d08..834ecaf 100644
+--- a/config/gitlab.yml.example
+++ b/config/gitlab.yml.example
+@@ -17,8 +17,8 @@ production: &base
+   ## GitLab settings
+   gitlab:
+     ## Web server settings (note: host is the FQDN, do not include http://)
+-    host: localhost
+-    port: 80 # Set to 443 if using HTTPS, see installation.md#using-https for additional HTTPS configuration details
+    host: <%= ENV['GITLAB_HOST'] || 'localhost' %>
+    port: <%= ENV['GITLAB_PORT'] || 80 %>
+     https: false # Set to true if using HTTPS, see installation.md#using-https for additional HTTPS configuration details
+ 
+     # Uncommment this line below if your ssh host is different from HTTP/HTTPS one
+@@ -31,11 +31,11 @@ production: &base
+     # relative_url_root: /gitlab
+ 
+     # Uncomment and customize if you can't use the default user to run GitLab (default: 'git')
+-    # user: git
+    user: gitlab
+ 
+     ## Email settings
+     # Email address used in the "From" field in mails sent by GitLab
+-    email_from: example@example.com
+    email_from: <%= ENV['GITLAB_EMAIL_FROM'] %>
+ 
+     # Email server smtp settings are in [a separate file](initializers/smtp_settings.rb.sample).
+ 
+@@ -230,12 +230,12 @@ production: &base
+   # GitLab Satellites
+   satellites:
+     # Relative paths are relative to Rails.root (default: tmp/repo_satellites/)
+-    path: /home/git/gitlab-satellites/
+    path: <%= ENV['GITLAB_SATELLITES_PATH'] %>
+     timeout: 30
+ 
+   ## Backup settings
+   backup:
+-    path: "tmp/backups"   # Relative paths are relative to Rails.root (default: tmp/backups/)
+    path: <%= ENV['GITLAB_BACKUP_PATH'] %>
+     # keep_time: 604800   # default: 0 (forever) (in seconds)
+     # upload:
+     #   # Fog storage connection settings, see http://fog.io/storage/ .
+@@ -249,11 +249,11 @@ production: &base
+ 
+   ## GitLab Shell settings
+   gitlab_shell:
+-    path: /home/git/gitlab-shell/
+    path: <%= ENV['GITLAB_SHELL_PATH'] %>
+ 
+     # REPOS_PATH MUST NOT BE A SYMLINK!!!
+-    repos_path: /home/git/repositories/
+-    hooks_path: /home/git/gitlab-shell/hooks/
+    repos_path: <%= ENV['GITLAB_REPOSITORIES_PATH'] %>
+    hooks_path: <%= ENV['GITLAB_SHELL_HOOKS_PATH'] %>
+ 
+     # Git over HTTP
+     upload_pack: true
+@@ -266,7 +266,7 @@ production: &base
+   # CAUTION!
+   # Use the default values unless you really know what you are doing
+   git:
+-    bin_path: /usr/bin/git
+    bin_path: git
+     # The next value is the maximum memory size grit can use
+     # Given in number of bytes per git object (e.g. a commit)
+     # This value can be increased if you have very large commits
+@@ -299,7 +299,7 @@ test:
+   gravatar:
+     enabled: true
+   gitlab:
+-    host: localhost
+    host: <%= ENV['GITLAB_HOST'] %>
+     port: 80
+ 
+     # When you run tests we clone and setup gitlab-shell
+diff --git a/lib/gitlab/app_logger.rb b/lib/gitlab/app_logger.rb
+index 8e4717b..abfe2e4 100644
+--- a/lib/gitlab/app_logger.rb
+++ b/lib/gitlab/app_logger.rb
+@@ -1,7 +1,7 @@
+ module Gitlab
+   class AppLogger < Gitlab::Logger
+     def self.file_name
+-      'application.log'
+      ENV["GITLAB_APPLICATION_LOG_PATH"]
+     end
+ 
+     def format_message(severity, timestamp, progname, msg)
--- a/pkgs/applications/version-management/redmine/default.nix
+++ b/pkgs/applications/version-management/redmine/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchurl, ruby, rubyLibs, libiconv, libxslt, libxml2, pkgconfig, libffi, imagemagickBig, postgresql }:
+{ stdenv, fetchurl, ruby, rubyLibs, libiconv, libiconvOrNull, libiconvOrLibc, libxslt, libxml2, pkgconfig, libffi, glibc, imagemagickBig, postgresql }:

 let
  gemspec = map (gem: fetchurl { url=gem.url; sha256=gem.hash; }) (import ./Gemfile.nix);
@ -25,7 +25,9 @@ in stdenv.mkDerivation rec {
  '';

  buildInputs = [
-    ruby rubyLibs.bundler libiconv libxslt libxml2 pkgconfig libffi
+    ruby rubyLibs.bundler 
+  ] ++ (if (libiconvOrNull != null) then [libiconv] else []) ++ [
+    libxslt libxml2 pkgconfig libffi
    imagemagickBig postgresql
  ];

@ -46,7 +48,7 @@ in stdenv.mkDerivation rec {

    bundle config build.nokogiri \
      --use-system-libraries \
-      --with-iconv-dir=${libiconv} \
+      --with-iconv-dir=${libiconvOrLibc} \
      --with-xslt-dir=${libxslt} \
      --with-xml2-dir=${libxml2} \
      --with-pkg-config \
--- a/pkgs/applications/video/dvdauthor/default.nix
+++ b/pkgs/applications/video/dvdauthor/default.nix
@ -1,4 +1,5 @@
-{ stdenv, fetchurl, imagemagick, libdvdread, libxml2, freetype, fribidi, libpng, zlib, pkgconfig }:
+{ stdenv, fetchurl, imagemagick, libdvdread, libxml2, freetype, fribidi, libpng, zlib, pkgconfig
+, flex, bison }:

 stdenv.mkDerivation rec{
  name = "dvdauthor-0.7.1";
@ -8,9 +9,15 @@ stdenv.mkDerivation rec{
    sha256 = "1s8zqlim0s3hk5sbdsilip3qqh0yv05l1jwx49d9rsy614dv27sh";
  };

-  buildInputs = [ libpng freetype libdvdread libxml2 zlib fribidi imagemagick ];
+  buildInputs = [ libpng freetype libdvdread libxml2 zlib fribidi imagemagick flex bison];
  nativeBuildInputs = [ pkgconfig ];

+  patches = [
+    ./dvdauthor-0.7.1-automake-1.13.patch
+    ./dvdauthor-0.7.1-mga-strndup.patch
+    ./dvdauthor-imagemagick-0.7.0.patch
+  ];
+
  meta = {
    description = "Tools for generating DVD files to be played on standalone DVD players";
    homepage = http://dvdauthor.sourceforge.net/;
--- a/pkgs/applications/video/dvdauthor/dvdauthor-0.7.1-automake-1.13.patch
+++ b/pkgs/applications/video/dvdauthor/dvdauthor-0.7.1-automake-1.13.patch
@ -0,0 +1,10 @@
+--- dvdauthor/configure.ac~	2013-01-04 08:27:40.713197029 +0800
+++ dvdauthor/configure.ac	2013-01-04 08:27:53.273525273 +0800
+@@ -1,6 +1,6 @@
+ AC_INIT(DVDAuthor,0.7.1,dvdauthor-users@lists.sourceforge.net)
+ 
+-AM_CONFIG_HEADER(src/config.h)
+AC_CONFIG_HEADERS(src/config.h)
+ AC_CONFIG_AUX_DIR(autotools)
+ 
+ AM_INIT_AUTOMAKE
--- a/pkgs/applications/video/dvdauthor/dvdauthor-0.7.1-mga-strndup.patch
+++ b/pkgs/applications/video/dvdauthor/dvdauthor-0.7.1-mga-strndup.patch
@ -0,0 +1,24 @@
+Index: dvdauthor/src/dvdvml.l
+===================================================================
+--- dvdauthor/src/dvdvml.l
+++ dvdauthor/src/dvdvml.l      2014-09-14 19:36:05.098847465 +0000
+@@ -19,6 +19,7 @@
+  * USA
+  */
+ 
+#include "config.h"
+ #include "compat.h" /* needed for bool */
+ #include "dvdvm.h"
+ #include "dvdvmy.h"
+Index: dvdauthor/src/dvdvmy.y
+===================================================================
+--- dvdauthor/src/dvdvmy.y
+++ dvdauthor/src/dvdvmy.y      2014-09-14 19:36:28.251618378 +0000
+@@ -19,6 +19,7 @@
+  * USA
+  */
+ 
+#include "config.h"
+ #include "compat.h" /* needed for bool */
+ #include "dvdvm.h"
+ 
--- a/pkgs/applications/video/dvdauthor/dvdauthor-imagemagick-0.7.0.patch
+++ b/pkgs/applications/video/dvdauthor/dvdauthor-imagemagick-0.7.0.patch
@ -0,0 +1,11 @@
+--- dvdauthor/configure.ac.orig	2010-10-23 04:26:49.000000000 +0200
+++ dvdauthor/configure.ac	2010-10-24 14:37:45.489064778 +0200
+@@ -31,7 +31,7 @@
+ 
+ usemagick=0
+ 
+-AC_CHECK_PROGS(MAGICKCONFIG, [Magick-config])
+AC_CHECK_PROGS(MAGICKCONFIG, [MagickCore-config])
+ if test -n "$MAGICKCONFIG"; then
+     ac_save_CPPFLAGS="$CPPFLAGS"
+     ac_save_LIBS="$LIBS"
--- a/pkgs/applications/video/mkvtoolnix/default.nix
+++ b/pkgs/applications/video/mkvtoolnix/default.nix
@ -28,6 +28,7 @@ stdenv.mkDerivation rec {
    expat wxGTK zlib ruby gettext pkgconfig curl
  ];

+  configureFlags = "--with-boost-libdir=${boost.lib}/lib";
  buildPhase = ''
    ruby ./drake
  '';
--- a/pkgs/applications/video/mpv/default.nix
+++ b/pkgs/applications/video/mpv/default.nix
@ -58,11 +58,11 @@ in

 stdenv.mkDerivation rec {
  name = "mpv-${version}";
-  version = "0.7.0";
+  version = "0.7.1";

  src = fetchurl {
    url = "https://github.com/mpv-player/mpv/archive/v${version}.tar.gz";
-    sha256 = "0rz8dp44yag442gamaa2vdmf69h25gqh2bgybx89prkfh8n4hy8x";
+    sha256 = "1grnmhj7hymi77ivvyzpgykj4wwrjd7a9apm5vyz2xqrankn3hyc";
  };

  buildInputs = with stdenv.lib;
@ -120,7 +120,7 @@ stdenv.mkDerivation rec {
    '';
    homepage = http://mpv.io;
    license = licenses.gpl2Plus;
-    maintainers = [ maintainers.AndersonTorres ];
+    maintainers = with stdenv.lib.maintainers; [ AndersonTorres fuuzetsu ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/build-support/fetchzip/default.nix
+++ b/pkgs/build-support/fetchzip/default.nix
@ -12,7 +12,7 @@
 , url
 , ... } @ args:

-fetchurl ({
+lib.overrideDerivation (fetchurl ({
  name = args.name or (baseNameOf url);

  recursiveHash = true;
@ -39,4 +39,6 @@ fetchurl ({
      mv $out/$fn/* "$out/"
      rmdir "$out/$fn"
    '';
-} // args)
+} // args))
+# Hackety-hack: we actually need unzip hooks, too
+(x: {nativeBuildInputs = x.nativeBuildInputs++ [unzip];})
--- a/pkgs/desktops/gnome-3/3.12/apps/polari/default.nix
+++ b/pkgs/desktops/gnome-3/3.12/apps/polari/default.nix
@ -0,0 +1,35 @@
+{stdenv, fetchurl, makeWrapper, intltool, pkgconfig, gobjectIntrospection, glib
+, gtk3, telepathy_glib, gnome3, telepathy_idle, telepathy_logger, libsoup
+, gdk_pixbuf, librsvg }:
+
+stdenv.mkDerivation rec {
+  name = "polari-3.12.2";
+
+  src = fetchurl {
+    url = "https://download.gnome.org/sources/polari/3.12/${name}.tar.xz";
+    sha256 = "8b10f369fac9e5e48a7bed51320754262d00c1bb14899a321b02843e20c0a995";
+  };
+
+  buildInputs = [ makeWrapper intltool pkgconfig gobjectIntrospection glib gtk3
+                  telepathy_glib gnome3.gjs telepathy_logger libsoup
+                  gdk_pixbuf librsvg
+                  gnome3.gnome_icon_theme gnome3.gnome_icon_theme_symbolic ];
+
+  propagatedUserEnvPkgs = [ telepathy_idle ];
+
+  preFixup = ''
+    wrapProgram "$out/bin/polari" \
+      --prefix GI_TYPELIB_PATH : "$GI_TYPELIB_PATH" \
+      --set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE" \
+      --prefix XDG_DATA_DIRS : "${gnome3.gnome_themes_standard}/share:$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH" 
+  '';
+
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
+    description = "Internet Relay Chat (IRC) client designed for GNOME 3";
+    homepage = https://wiki.gnome.org/Apps/Polari;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.lethalman ];
+  };
+}
--- a/pkgs/desktops/gnome-3/3.12/default.nix
+++ b/pkgs/desktops/gnome-3/3.12/default.nix
@ -234,6 +234,8 @@ rec {

  seahorse = callPackage ./apps/seahorse { };

+  polari = callPackage ./apps/polari { };
+
  pomodoro = callPackage ./apps/pomodoro { };

 #### Dev http://ftp.gnome.org/pub/GNOME/devtools/
--- a/pkgs/development/compilers/ghc/head.nix
+++ b/pkgs/development/compilers/ghc/head.nix
@ -1,12 +1,12 @@
 { stdenv, fetchurl, ghc, perl, gmp, ncurses, happy, alex }:

 stdenv.mkDerivation rec {
-  version = "7.9.20141106";
+  version = "7.9.20141210";
  name = "ghc-${version}";

  src = fetchurl {
-    url = "http://deb.haskell.org/dailies/2014-11-06/ghc_${version}.orig.tar.bz2";
-    sha256 = "1si8wx8a2lrg5ba13vwpisssxa3rcxi5a7fqxhgapa8d2i2w7gaz";
+    url = "http://deb.haskell.org/dailies/2014-12-10/ghc_${version}.orig.tar.bz2";
+    sha256 = "0487x0rvpz6c47v9qvc7rgk3hnabmali6c66mzh2bizkgmy1qpk0";
  };

  buildInputs = [ ghc perl gmp ncurses happy alex ];
--- a/pkgs/development/compilers/hhvm/3918a2ccceb98230ff517601ad60aa6bee36e2c4.patch
+++ b/pkgs/development/compilers/hhvm/3918a2ccceb98230ff517601ad60aa6bee36e2c4.patch
@ -0,0 +1,40 @@
+From 3918a2ccceb98230ff517601ad60aa6bee36e2c4 Mon Sep 17 00:00:00 2001
+From: Alex Malyshev <alexanderm@fb.com>
+Date: Tue, 28 Oct 2014 15:55:34 -0700
+Subject: [PATCH] Replace use of MAX macro with std::max in ZendPack
+
+Summary: This has randomly bitten me in open source builds. I intermittently get
+an error saying that MAX isn't defined.
+
+Instead of trying to figure out what's going on, I'm just gonna switch
+it to std::max.
+
+Reviewed By: @paulbiss
+
+Differential Revision: D1636740
+---
+ hphp/runtime/base/zend-pack.cpp | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/hphp/runtime/base/zend-pack.cpp b/hphp/runtime/base/zend-pack.cpp
+index d878ea4..c3ee14d 100644
+--- a/hphp/runtime/base/zend-pack.cpp
+++ b/hphp/runtime/base/zend-pack.cpp
+@@ -21,6 +21,8 @@
+ #include "hphp/runtime/base/builtin-functions.h"
+ #include "hphp/util/tiny-vector.h"
+ 
+#include <algorithm>
+
+ namespace HPHP {
+ 
+ #define INC_OUTPUTPOS(a,b)                                              \
+@@ -294,7 +296,7 @@ Variant ZendPack::pack(const String& fmt, const Array& argv) {
+     case 'a':
+     case 'A':
+     case 'Z': {
+-      int arg_cp = (code != 'Z') ? arg : MAX(0, arg - 1);
+      int arg_cp = (code != 'Z') ? arg : std::max(0, arg - 1);
+       memset(&output[outputpos], (code != 'A') ? '\0' : ' ', arg);
+       val = argv[currentarg++].toString();
+       s = val.c_str();
--- a/pkgs/development/compilers/hhvm/8207a31c26cc42fee79363a14c4a8f4fcbfffe63.patch
+++ b/pkgs/development/compilers/hhvm/8207a31c26cc42fee79363a14c4a8f4fcbfffe63.patch
@ -0,0 +1,40 @@
+From 8207a31c26cc42fee79363a14c4a8f4fcbfffe63 Mon Sep 17 00:00:00 2001
+From: Jordan DeLong <jdelong@fb.com>
+Date: Mon, 6 Oct 2014 18:30:28 -0700
+Subject: [PATCH] Remove some MIN/MAX macro uses in the emitter
+
+Summary: <algorithm> has preferable type-safe versions that don't double-eval
+their args.
+
+Reviewed By: @paulbiss
+
+Differential Revision: D1599803
+---
+ hphp/compiler/analysis/emitter.cpp | 6 +++---
+ hphp/util/compatibility.h          | 4 ----
+ 2 files changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/hphp/compiler/analysis/emitter.cpp b/hphp/compiler/analysis/emitter.cpp
+index 321e637..b1d3f2d 100644
+--- a/hphp/compiler/analysis/emitter.cpp
+++ b/hphp/compiler/analysis/emitter.cpp
+@@ -799,8 +799,8 @@ void SymbolicStack::push(char sym) {
+   if (sym != StackSym::W && sym != StackSym::K && sym != StackSym::L &&
+       sym != StackSym::T && sym != StackSym::I && sym != StackSym::H) {
+     m_actualStack.push_back(m_symStack.size());
+-    *m_actualStackHighWaterPtr = MAX(*m_actualStackHighWaterPtr,
+-                                     (int)m_actualStack.size());
+    *m_actualStackHighWaterPtr = std::max(*m_actualStackHighWaterPtr,
+                                          (int)m_actualStack.size());
+   }
+   m_symStack.push_back(SymEntry(sym));
+ }
+@@ -1010,7 +1010,7 @@ int SymbolicStack::sizeActual() const {
+ 
+ void SymbolicStack::pushFDesc() {
+   m_fdescCount += kNumActRecCells;
+-  *m_fdescHighWaterPtr = MAX(*m_fdescHighWaterPtr, m_fdescCount);
+  *m_fdescHighWaterPtr = std::max(*m_fdescHighWaterPtr, m_fdescCount);
+ }
+ 
+ void SymbolicStack::popFDesc() {
--- a/pkgs/development/compilers/hhvm/default.nix
+++ b/pkgs/development/compilers/hhvm/default.nix
@ -2,22 +2,28 @@
 , libevent, gd, curl, libxml2, icu, flex, bison, openssl, zlib, php, re2c
 , expat, libcap, oniguruma, libdwarf, libmcrypt, tbb, gperftools, glog
 , bzip2, openldap, readline, libelf, uwimap, binutils, cyrus_sasl, pam, libpng
-, libxslt, ocaml, freetype
+, libxslt, ocaml, freetype, gdb
 }:

 stdenv.mkDerivation rec {
  name    = "hhvm-${version}";
-  version = "3.2.0";
+  version = "3.3.0";

+  # use git version since we need submodules
  src = fetchgit {
    url    = "https://github.com/facebook/hhvm.git";
-    rev    = "01228273b8cf709aacbd3df1c51b1e690ecebac8";
-    sha256 = "418d5a55ac4ba5335a42329ebfb7dd96fdb8d5edbc2700251c86e9fa2ae4a967";
+    rev    = "e0c98e21167b425dddf1fc9efe78c9f7a36db268";
+    sha256 = "0s32v713xgf4iim1zb9sg08sg1r1fs49czar3jxajsi0dwc0lkj9";
    fetchSubmodules = true;
  };

+  patches = [
+    ./3918a2ccceb98230ff517601ad60aa6bee36e2c4.patch
+    ./8207a31c26cc42fee79363a14c4a8f4fcbfffe63.patch
+  ];
+
  buildInputs =
-    [ cmake pkgconfig boost libunwind mariadb libmemcached pcre
+    [ cmake pkgconfig boost libunwind mariadb libmemcached pcre gdb
      libevent gd curl libxml2 icu flex bison openssl zlib php expat libcap
      oniguruma libdwarf libmcrypt tbb gperftools bzip2 openldap readline
      libelf uwimap binutils cyrus_sasl pam glog libpng libxslt ocaml
@ -34,7 +40,7 @@ stdenv.mkDerivation rec {
  # work around broken build system
  NIX_CFLAGS_COMPILE = "-I${freetype}/include/freetype2";

-  patchPhase = ''
+  prePatch = ''
    substituteInPlace hphp/util/generate-buildinfo.sh \
      --replace /bin/bash ${stdenv.shell}
    substituteInPlace ./configure \
--- a/pkgs/development/compilers/openjdk/default.nix
+++ b/pkgs/development/compilers/openjdk/default.nix
@ -61,7 +61,12 @@ stdenv.mkDerivation rec {
    makeFlagsArray+=(CUPS_HEADERS_PATH=$cupsDir)
  '';

-  patches = [ ./cppflags-include-fix.patch ./fix-java-home.patch ./paxctl.patch ];
+  patches = [
+    ./cppflags-include-fix.patch
+    ./fix-java-home.patch
+    ./paxctl.patch
+    ./read-truststore-from-env.patch
+  ];

  NIX_NO_SELF_RPATH = true;

--- a/pkgs/development/compilers/openjdk/read-truststore-from-env.patch
+++ b/pkgs/development/compilers/openjdk/read-truststore-from-env.patch
@ -0,0 +1,21 @@
+diff -ur openjdk-7u65-b32/jdk/src/share/classes/sun/security/ssl/TrustManagerFactoryImpl.java openjdk-7u65-b32.new/jdk/src/share/classes/sun/security/ssl/TrustManagerFactoryImpl.java
+--- openjdk-7u65-b32/jdk/src/share/classes/sun/security/ssl/TrustManagerFactoryImpl.java	2014-07-17 12:12:14.000000000 +0200
+++ openjdk-7u65-b32.new/jdk/src/share/classes/sun/security/ssl/TrustManagerFactoryImpl.java	2014-12-09 13:31:27.821960372 +0100
+@@ -158,6 +158,7 @@
+         /*
+          * Try:
+          *      javax.net.ssl.trustStore  (if this variable exists, stop)
+         *      system environment variable JAVAX_NET_SSL_TRUSTSTORE
+          *      jssecacerts
+          *      cacerts
+          *
+@@ -165,6 +166,9 @@
+          */
+ 
+         storeFileName = props.get("trustStore");
+        if (storeFileName == null) {
+            storeFileName = System.getenv("JAVAX_NET_SSL_TRUSTSTORE");
+        }
+         if (!"NONE".equals(storeFileName)) {
+             if (storeFileName != null) {
+                 storeFile = new File(storeFileName);
--- a/pkgs/development/interpreters/j/default.nix
+++ b/pkgs/development/interpreters/j/default.nix
@ -37,14 +37,19 @@ rec {
    builtins.trace "assuming ${a.stdenv.system} is 32 bits" "32";

  doBuildJ = a.fullDepEntry ''
-    sed -i bin/jconfig -e 's@bits=32@bits=${bits}@g; s@readline=0@readline=1@; s@LIBREADLINE=""@LIBREADLINE=" -lreadline "@'
+    sed -i bin/jconfig -e '
+        s@bits=32@bits=${bits}@g;
+        s@readline=0@readline=1@;
+        s@LIBREADLINE=""@LIBREADLINE=" -lreadline "@;
+        s@-W1,soname,libj.so@-Wl,-soname,libj.so@
+        '
    sed -i bin/build_libj -e 's@>& make.txt@ 2>\&1 | tee make.txt@'

    touch *.c *.h
-    sh bin/build_jconsole
-    sh bin/build_libj
-    sh bin/build_defs
-    sh bin/build_tsdll
+    sh -o errexit bin/build_jconsole
+    sh -o errexit bin/build_libj
+    sh -o errexit bin/build_defs
+    sh -o errexit bin/build_tsdll

    sed -i j/bin/profile.ijs -e "s@userx=[.] *'.j'@userx=. '/.j'@; 
        s@bin,'/profilex.ijs'@user,'/profilex.ijs'@ ;
--- a/pkgs/development/interpreters/mujs/default.nix
+++ b/pkgs/development/interpreters/mujs/default.nix
@ -5,8 +5,8 @@ stdenv.mkDerivation rec {

  src = fetchgit {
    url = git://git.ghostscript.com/mujs.git;
-    rev  = "6afabf445cad0dd9afbc1f5870dba730801f09c0";
-    sha256 = "1afzmncw3jvfq6smhhhsi1ywfmdpxkjpzswb86pdmdh3p04g1r0n";
+    rev  = "9bc5fec0804381d59ef8dc62304ed6892fb7c4ca";
+    sha256 = "0ba6p92ygcssfzd4ij89vilfr2kwql2d1jpyqxflh5wyh1i92wjl";
  };

  buildInputs = [ clang ];
--- a/pkgs/development/libraries/haskell/DRBG/default.nix
+++ b/pkgs/development/libraries/haskell/DRBG/default.nix
@ -6,8 +6,8 @@

 cabal.mkDerivation (self: {
  pname = "DRBG";
-  version = "0.5.2";
-  sha256 = "0c8w8h2mxpk2avj6321q9a1smzp970cyn87aj98vn8dln7h9cqsi";
+  version = "0.5.3";
+  sha256 = "197kp2bchkj3zrl3f06glba9lbjf51mp710sx0qj8i4spvf3jfr8";
  isLibrary = true;
  isExecutable = true;
  buildDepends = [
--- a/pkgs/development/libraries/haskell/FontyFruity/default.nix
+++ b/pkgs/development/libraries/haskell/FontyFruity/default.nix
@ -4,8 +4,8 @@

 cabal.mkDerivation (self: {
  pname = "FontyFruity";
-  version = "0.3";
-  sha256 = "0ivz7hkz5mx8bqqv5av56a8rw4231wyzzg0dhz6465d59iqmjhd4";
+  version = "0.4";
+  sha256 = "0nrlsiwav1mwbmp555vwnc24250yn166yr5fjazjg9g7a0ikkivf";
  buildDepends = [ binary deepseq filepath text vector ];
  meta = {
    description = "A true type file format loader";
--- a/pkgs/development/libraries/haskell/JuicyPixels/default.nix
+++ b/pkgs/development/libraries/haskell/JuicyPixels/default.nix
@ -6,14 +6,14 @@

 cabal.mkDerivation (self: {
  pname = "JuicyPixels";
-  version = "3.1.7.1";
-  sha256 = "0mhsknqdrhxnm622mgrswvj4kvksh87x18s5ddgk4ylf0s2fjlap";
+  version = "3.2";
+  sha256 = "1z4i0464zdijv54b7wzc55zrp8h67ahm6mrdk7a6gi2qm0nihmy5";
  buildDepends = [
    binary deepseq mtl primitive transformers vector zlib
  ];
  meta = {
    homepage = "https://github.com/Twinside/Juicy.Pixels";
-    description = "Picture loading/serialization (in png, jpeg, bitmap, gif, tiff and radiance)";
+    description = "Picture loading/serialization (in png, jpeg, bitmap, gif, tga, tiff and radiance)";
    license = self.stdenv.lib.licenses.bsd3;
    platforms = self.ghc.meta.platforms;
  };
--- a/pkgs/development/libraries/haskell/MonadRandom/0.3.0.1.nix
+++ b/pkgs/development/libraries/haskell/MonadRandom/0.3.0.1.nix
@ -4,8 +4,8 @@

 cabal.mkDerivation (self: {
  pname = "MonadRandom";
-  version = "0.3";
-  sha256 = "0bmsccjcz6glb0x0nkjlq3qywfibf0wxxv4dvdhjfw5sx6im9qx3";
+  version = "0.3.0.1";
+  sha256 = "0bbj6rkxskrvl14lngpggql4q41pw21cj4z8h592mizrxjfa3rj0";
  buildDepends = [ mtl random transformers ];
  meta = {
    description = "Random-number generation monad";
--- a/pkgs/development/libraries/haskell/Rasterific/default.nix
+++ b/pkgs/development/libraries/haskell/Rasterific/default.nix
@ -1,16 +1,17 @@
 # This file was auto-generated by cabal2nix. Please do NOT edit manually!

 { cabal, binary, criterion, deepseq, dlist, filepath, FontyFruity
-, free, JuicyPixels, mtl, QuickCheck, statistics, vector
+, free, JuicyPixels, mtl, primitive, QuickCheck, statistics, vector
 , vectorAlgorithms
 }:

 cabal.mkDerivation (self: {
  pname = "Rasterific";
-  version = "0.3";
-  sha256 = "1chbcfcb5il7fbzivszap60qfwcwrq85kpx9y6qdr2pim39199fa";
+  version = "0.4";
+  sha256 = "1cw8lalxp9cs3w3kfr4ayp5h0kd71fdnyih99xpljy8zxw28hv3z";
  buildDepends = [
-    dlist FontyFruity free JuicyPixels mtl vector vectorAlgorithms
+    dlist FontyFruity free JuicyPixels mtl primitive vector
+    vectorAlgorithms
  ];
  testDepends = [
    binary criterion deepseq filepath FontyFruity JuicyPixels
--- a/pkgs/development/libraries/haskell/active/default.nix
+++ b/pkgs/development/libraries/haskell/active/default.nix
@ -6,8 +6,8 @@

 cabal.mkDerivation (self: {
  pname = "active";
-  version = "0.1.0.16";
-  sha256 = "0x4z9n0avk9pr9v64vfmbbpxx2n6cl32d8sw8y2w61345s2z628k";
+  version = "0.1.0.17";
+  sha256 = "1asp0han2737vfk92gasij804z4jsw8v2bc0m4nrmn3v80vmh7qb";
  buildDepends = [ newtype semigroupoids semigroups vectorSpace ];
  testDepends = [
    newtype QuickCheck semigroupoids semigroups vectorSpace
--- a/pkgs/development/libraries/haskell/ad/default.nix
+++ b/pkgs/development/libraries/haskell/ad/default.nix
@ -6,8 +6,8 @@

 cabal.mkDerivation (self: {
  pname = "ad";
-  version = "4.2.1";
-  sha256 = "05ndr26lsc4xa18vfb3qdjcp03gsq2bhc8dc0yr5g1x9dybq6dx2";
+  version = "4.2.1.1";
+  sha256 = "1zdpfh4k93ygrm91m7lw1la6n4yvaq3k2sqswgia04naf2wcmjka";
  buildDepends = [
    comonad dataReify erf free nats reflection tagged transformers
  ];
--- a/pkgs/development/libraries/haskell/aeson-pretty/default.nix
+++ b/pkgs/development/libraries/haskell/aeson-pretty/default.nix
@ -6,8 +6,8 @@

 cabal.mkDerivation (self: {
  pname = "aeson-pretty";
-  version = "0.7.1";
-  sha256 = "0gmm1kmdbanfyfdyij1gnazycp1x9703qfa5hgrz39j9046zg3y6";
+  version = "0.7.2";
+  sha256 = "03ap81853qi8yd9kdgczllrrni23a6glsfxrwj8zab6ipjrbh234";
  isLibrary = true;
  isExecutable = true;
  buildDepends = [
--- a/pkgs/development/libraries/haskell/algebra/default.nix
+++ b/pkgs/development/libraries/haskell/algebra/default.nix
@ -6,8 +6,8 @@

 cabal.mkDerivation (self: {
  pname = "algebra";
-  version = "4.1";
-  sha256 = "1wcwpngaqnr9w89p5dycmpsaihdwqqrs2vjap6jfwrscq16yyyc6";
+  version = "4.2";
+  sha256 = "1b74c55326qsnpyqzyhyq87j61wp3zrpsqhipgw8db8nm2lq9nhs";
  buildDepends = [
    adjunctions distributive mtl nats semigroupoids semigroups tagged
    transformers void
--- a/pkgs/development/libraries/haskell/atto-lisp/default.nix
+++ b/pkgs/development/libraries/haskell/atto-lisp/default.nix
@ -6,8 +6,8 @@

 cabal.mkDerivation (self: {
  pname = "atto-lisp";
-  version = "0.2.1.2";
-  sha256 = "0xl5b0gblab3v2sfaxvx3z96660r9xp1m2n3ri6aph3kldbpkfcg";
+  version = "0.2.2";
+  sha256 = "13lhdalam4gn9faa58c3c7nssdwp2y0jsfl1lnnvr3dx6wzp0jhc";
  buildDepends = [
    attoparsec blazeBuilder blazeTextual deepseq text
  ];
--- a/pkgs/development/libraries/haskell/aws/default.nix
+++ b/pkgs/development/libraries/haskell/aws/default.nix
@ -12,8 +12,8 @@

 cabal.mkDerivation (self: {
  pname = "aws";
-  version = "0.10.5";
-  sha256 = "1d82q2477wp08zavlkzsksalbkiczz3vzy17ijk2z5xsw5yslqnj";
+  version = "0.11";
+  sha256 = "19q7r74c5xw04vpwl2fwm675bvkp3vhlak63iqfl1927z2jsyva9";
  isLibrary = true;
  isExecutable = true;
  buildDepends = [
--- a/pkgs/development/libraries/haskell/base-prelude/default.nix
+++ b/pkgs/development/libraries/haskell/base-prelude/default.nix
@ -4,8 +4,8 @@

 cabal.mkDerivation (self: {
  pname = "base-prelude";
-  version = "0.1.6";
-  sha256 = "1lc8j3wfaqh42pqshlizkpr67ghkr1m90m1g9xiw8h36p8n72fcm";
+  version = "0.1.7";
+  sha256 = "0xzgwj5sqx7y57biby77d6vrsghcmq85ha3frn8k4xq7wqqk4aqp";
  meta = {
    homepage = "https://github.com/nikita-volkov/base-prelude";
    description = "The most complete prelude formed from only the \"base\" package";
--- a/pkgs/development/libraries/haskell/bound/default.nix
+++ b/pkgs/development/libraries/haskell/bound/default.nix
@ -7,8 +7,8 @@

 cabal.mkDerivation (self: {
  pname = "bound";
-  version = "1.0.3";
-  sha256 = "0nfcxq87i9lzdkrg7g65cprn4rg9rhn9nyk2jpjh4c1rc7gdn0aq";
+  version = "1.0.4";
+  sha256 = "17qnrjmqhx07cpzwd1z4lp2d42jx1lfxl6b86d65g4fd79miipky";
  buildDepends = [
    bifunctors binary bytes cereal comonad hashable hashableExtras
    preludeExtras profunctors transformers
--- a/pkgs/development/libraries/haskell/bytes/default.nix
+++ b/pkgs/development/libraries/haskell/bytes/default.nix
@ -6,8 +6,8 @@

 cabal.mkDerivation (self: {
  pname = "bytes";
-  version = "0.14.1.1";
-  sha256 = "11bsl31352h5lj7ad68byqqc27d5iz53kwx7b433l44g9kaijrvc";
+  version = "0.14.1.2";
+  sha256 = "1v1nnp1m5i4bfr0fshbps163v6yn6var53p0vcvav6g4w5wffd7d";
  buildDepends = [
    binary cereal mtl text time transformers transformersCompat void
  ];
--- a/pkgs/development/libraries/haskell/cgrep/default.nix
+++ b/pkgs/development/libraries/haskell/cgrep/default.nix
@ -6,8 +6,8 @@

 cabal.mkDerivation (self: {
  pname = "cgrep";
-  version = "6.4.8";
-  sha256 = "0xz2kzrvxxaa67x21dckv7l01s7jhmak7ka0rp8qygx6zjf836wy";
+  version = "6.4.9";
+  sha256 = "1g5np8r5h8hxgyxr3m7595xh7fiq1b8h9w6vm0ly81949lbwclga";
  isLibrary = false;
  isExecutable = true;
  buildDepends = [
--- a/pkgs/development/libraries/haskell/cheapskate/default.nix
+++ b/pkgs/development/libraries/haskell/cheapskate/default.nix
@ -1,17 +1,18 @@
 # This file was auto-generated by cabal2nix. Please do NOT edit manually!

-{ cabal, blazeHtml, dataDefault, mtl, syb, text, uniplate
-, xssSanitize
+{ cabal, aeson, blazeHtml, dataDefault, httpTypes, mtl, syb, text
+, uniplate, wai, waiExtra, xssSanitize
 }:

 cabal.mkDerivation (self: {
  pname = "cheapskate";
-  version = "0.1.0.1";
-  sha256 = "0slrvbaamnwxx89kqjcr62058j00s2dw4c16q1swf817az2p66h8";
+  version = "0.1.0.2";
+  sha256 = "1bz3zi2w5vm128csg21swcz4cm7h8ybqylpknr4fnyxmg3gxdd7d";
  isLibrary = true;
  isExecutable = true;
  buildDepends = [
-    blazeHtml dataDefault mtl syb text uniplate xssSanitize
+    aeson blazeHtml dataDefault httpTypes mtl syb text uniplate wai
+    waiExtra xssSanitize
  ];
  jailbreak = true;
  meta = {
--- a/pkgs/development/libraries/haskell/clientsession/default.nix
+++ b/pkgs/development/libraries/haskell/clientsession/default.nix
@ -7,8 +7,8 @@

 cabal.mkDerivation (self: {
  pname = "clientsession";
-  version = "0.9.1";
-  sha256 = "1hq4f5iq4xb9jilr6qprww9lql314vpfw5khwmizljry9cwd2gq7";
+  version = "0.9.1.1";
+  sha256 = "08h0461ydhfymw2pya472n81kx5rqp7awfgxlbz2r851rl5kqmn9";
  isLibrary = true;
  isExecutable = true;
  buildDepends = [
--- a/pkgs/development/libraries/haskell/concurrent-extra/default.nix
+++ b/pkgs/development/libraries/haskell/concurrent-extra/default.nix
@ -1,24 +1,22 @@
 # This file was auto-generated by cabal2nix. Please do NOT edit manually!

-{ cabal, async, baseUnicodeSymbols, HUnit, random, stm
-, testFramework, testFrameworkHunit, unboundedDelays
+{ cabal, async, HUnit, random, stm, testFramework
+, testFrameworkHunit, unboundedDelays
 }:

 cabal.mkDerivation (self: {
  pname = "concurrent-extra";
-  version = "0.7.0.8";
-  sha256 = "0q6n7wlakvnvfrjr3zmxbn9i0dxq96071j565vffp0r5abxkn83q";
-  buildDepends = [ baseUnicodeSymbols stm unboundedDelays ];
+  version = "0.7.0.9";
+  sha256 = "19bqm0brnbhhmp5nypi995p27mna7kd33xzw0kf7yx2w2p2kb1aw";
+  buildDepends = [ stm unboundedDelays ];
  testDepends = [
-    async baseUnicodeSymbols HUnit random stm testFramework
-    testFrameworkHunit unboundedDelays
+    async HUnit random stm testFramework testFrameworkHunit
+    unboundedDelays
  ];
  meta = {
    homepage = "https://github.com/basvandijk/concurrent-extra";
    description = "Extra concurrency primitives";
    license = self.stdenv.lib.licenses.bsd3;
    platforms = self.ghc.meta.platforms;
-    hydraPlatforms = self.stdenv.lib.platforms.none;
-    broken = true;
  };
 })
--- a/pkgs/development/libraries/haskell/conduit-extra/default.nix
+++ b/pkgs/development/libraries/haskell/conduit-extra/default.nix
@ -7,8 +7,8 @@

 cabal.mkDerivation (self: {
  pname = "conduit-extra";
-  version = "1.1.4.2";
-  sha256 = "0s2ggca6g2104dylbrkn090xwsfrp0946bhwf7fgpfpg9gi1sz1g";
+  version = "1.1.5";
+  sha256 = "1i38n3pdibjpi9kg37wvv4m6krfbsdd4baik804ss2ml1ry7gm4p";
  buildDepends = [
    attoparsec blazeBuilder conduit filepath monadControl network
    primitive resourcet stm streamingCommons text transformers
--- a/pkgs/development/libraries/haskell/crypto-pubkey/default.nix
+++ b/pkgs/development/libraries/haskell/crypto-pubkey/default.nix
@ -7,8 +7,8 @@

 cabal.mkDerivation (self: {
  pname = "crypto-pubkey";
-  version = "0.2.4";
-  sha256 = "0mdjr6zma2q7r2z9qibp2bwf73bis6zrv7ss62i4pz42kndb9hh4";
+  version = "0.2.5";
+  sha256 = "18rxm6mgxp8x4ns2725pw6ja2g6n6k64dj9cbwdlsb13pkdh3lxq";
  buildDepends = [
    byteable cryptohash cryptoNumbers cryptoPubkeyTypes cryptoRandom
  ];
--- a/pkgs/development/libraries/haskell/cuda/default.nix
+++ b/pkgs/development/libraries/haskell/cuda/default.nix
@ -4,8 +4,10 @@

 cabal.mkDerivation (self: {
  pname = "cuda";
-  version = "0.6.5.0";
-  sha256 = "0q4c2xgffkchn8kxhiwjganmb3ki4yjhx5665zwfd18bgvmlnp60";
+  version = "0.6.5.1";
+  sha256 = "04j57inw4wmd0l74ryxdgpjcbf3zkklgkqw9bv7yp4n96n40mp0y";
+  isLibrary = true;
+  isExecutable = true;
  buildTools = [ c2hs ];
  extraLibraries = [ cudatoolkit nvidia_x11 self.stdenv.gcc ];
  doCheck = false;
--- a/pkgs/development/libraries/haskell/data-lens-light/default.nix
+++ b/pkgs/development/libraries/haskell/data-lens-light/default.nix
@ -4,8 +4,8 @@

 cabal.mkDerivation (self: {
  pname = "data-lens-light";
-  version = "0.1.2";
-  sha256 = "1xxphcd36vw1ib48rfmrg207h0i1hlby01bm3xsxnq90ygizvxk7";
+  version = "0.1.2.1";
+  sha256 = "038vfzb4vxk1qb0246l2kgv9br37wg59wnlhzyjpn97lypwlf68w";
  buildDepends = [ mtl ];
  meta = {
    homepage = "https://github.com/feuerbach/data-lens-light";
--- a/pkgs/development/libraries/haskell/dbus/default.nix
+++ b/pkgs/development/libraries/haskell/dbus/default.nix
@ -7,8 +7,8 @@

 cabal.mkDerivation (self: {
  pname = "dbus";
-  version = "0.10.8";
-  sha256 = "1pqcb6fk6l2xzwyy3n9sa2q2k3qykym1f98n2zf75545ix46b1r6";
+  version = "0.10.9";
+  sha256 = "0sjnmxy0ikvg21sip7yadg4qr3lniy1wwpavkg48dc87gv98ymdb";
  buildDepends = [
    cereal libxmlSax network parsec random text transformers vector
    xmlTypes
--- a/pkgs/development/libraries/haskell/diagrams/contrib.nix
+++ b/pkgs/development/libraries/haskell/diagrams/contrib.nix
@ -9,8 +9,8 @@

 cabal.mkDerivation (self: {
  pname = "diagrams-contrib";
-  version = "1.1.2.3";
-  sha256 = "00bn9p2a6h26q7hfqqzwimfgr2avf7ilf61z3anz25raz8jqvfxc";
+  version = "1.1.2.4";
+  sha256 = "0iq5psy5wjm664hqsaprynba0b7x3ijxngh7mbk6hkh004vsna1w";
  buildDepends = [
    arithmoi circlePacking colour dataDefault dataDefaultClass
    diagramsCore diagramsLib forceLayout lens MonadRandom mtl parsec
--- a/pkgs/development/libraries/haskell/diagrams/core.nix
+++ b/pkgs/development/libraries/haskell/diagrams/core.nix
@ -6,8 +6,8 @@

 cabal.mkDerivation (self: {
  pname = "diagrams-core";
-  version = "1.2.0.3";
-  sha256 = "1pmdz75v2xl8y0clqifs017gq40syxqpfa2h2mc50pip3484a7m5";
+  version = "1.2.0.4";
+  sha256 = "1axkgprqs4jvzh5vfr118nzr1h0m48axr5jfiqqrqvy5xyjcagkq";
  buildDepends = [
    dualTree lens MemoTrie monoidExtras newtype semigroups vectorSpace
    vectorSpacePoints
--- a/pkgs/development/libraries/haskell/diagrams/lib.nix
+++ b/pkgs/development/libraries/haskell/diagrams/lib.nix
@ -8,8 +8,8 @@

 cabal.mkDerivation (self: {
  pname = "diagrams-lib";
-  version = "1.2.0.5";
-  sha256 = "0km2j74riybmlhpb3jp4i3xilz4q2ngkifnsq6bsk8d0m3kqizd6";
+  version = "1.2.0.7";
+  sha256 = "12ddlipp47j2mifwhi0ilb2fjdh2whk24s4d5h6ais2znj3hh99a";
  buildDepends = [
    active colour dataDefaultClass diagramsCore dualTree filepath
    fingertree hashable intervals JuicyPixels lens MemoTrie
--- a/pkgs/development/libraries/haskell/diagrams/postscript.nix
+++ b/pkgs/development/libraries/haskell/diagrams/postscript.nix
@ -7,8 +7,8 @@

 cabal.mkDerivation (self: {
  pname = "diagrams-postscript";
-  version = "1.1.0.2";
-  sha256 = "1djvra4igw43746wqhwg1ms76w2qlrsdwhr0b795si4wdx8k28b3";
+  version = "1.1.0.3";
+  sha256 = "172r7q9jzhy2kv5bsbakakwv6gpvy308gvp8xpirbch9mrvnjxhz";
  buildDepends = [
    dataDefaultClass diagramsCore diagramsLib dlist filepath hashable
    lens monoidExtras mtl semigroups split vectorSpace
--- a/pkgs/development/libraries/haskell/diagrams/rasterific.nix
+++ b/pkgs/development/libraries/haskell/diagrams/rasterific.nix
@ -7,8 +7,8 @@

 cabal.mkDerivation (self: {
  pname = "diagrams-rasterific";
-  version = "0.1.0.4";
-  sha256 = "0l6072blz56rc4nxr2s7gh5p3zdcyq8cfndbqgzndsfak6wyixgb";
+  version = "0.1.0.5";
+  sha256 = "1a95l8g55jsmqhbv9flk5kfkfa40z93axbjfz6xb74lyvl6xccwr";
  buildDepends = [
    dataDefaultClass diagramsCore diagramsLib filepath FontyFruity
    JuicyPixels lens mtl optparseApplicative Rasterific split
--- a/pkgs/development/libraries/haskell/diagrams/svg.nix
+++ b/pkgs/development/libraries/haskell/diagrams/svg.nix
@ -7,8 +7,8 @@

 cabal.mkDerivation (self: {
  pname = "diagrams-svg";
-  version = "1.1.0.2";
-  sha256 = "0dzws9c3swgnrx70a64614m9pc8rszfajgh674n7x56fbbp3ra1n";
+  version = "1.1.0.3";
+  sha256 = "0byqxwz9h1hi2yrq2vz32gv0az9q3l94qa2q3nl3j8sa64qmpdwq";
  buildDepends = [
    base64Bytestring blazeMarkup blazeSvg colour diagramsCore
    diagramsLib filepath hashable JuicyPixels lens monoidExtras mtl
--- a/pkgs/development/libraries/haskell/distributed-process/default.nix
+++ b/pkgs/development/libraries/haskell/distributed-process/default.nix
@ -7,8 +7,8 @@

 cabal.mkDerivation (self: {
  pname = "distributed-process";
-  version = "0.5.1";
-  sha256 = "1c654l7r3cn89nknh67vsg7crnfhgswh4523qyrmn8z4ykyd0zfk";
+  version = "0.5.2";
+  sha256 = "04llhz9z28365idgj13hhwkp98zwqv6mhhy9i7416wk5d3r70g7l";
  buildDepends = [
    binary dataAccessor deepseq distributedStatic hashable mtl
    networkTransport random rank1dynamic stm syb time transformers
--- a/pkgs/development/libraries/haskell/distributed-static/default.nix
+++ b/pkgs/development/libraries/haskell/distributed-static/default.nix
@ -4,8 +4,8 @@

 cabal.mkDerivation (self: {
  pname = "distributed-static";
-  version = "0.3.0.0";
-  sha256 = "1g8jr01jxlfshsz3mrpzl21q290whwz4va3zjp1h0d1pnfwz6jcj";
+  version = "0.3.1.0";
+  sha256 = "190b6vjcipgrvnfl72c0ssw8crza02gfw9kwyvwg043jcznihj08";
  buildDepends = [ binary rank1dynamic ];
  meta = {
    homepage = "http://haskell-distributed.github.com";
--- a/pkgs/development/libraries/haskell/dual-tree/default.nix
+++ b/pkgs/development/libraries/haskell/dual-tree/default.nix
@ -4,8 +4,8 @@

 cabal.mkDerivation (self: {
  pname = "dual-tree";
-  version = "0.2.0.4";
-  sha256 = "0visavx0zqgmcjcq07vfhk6dn867269w2gxa8nvc79gya56c6wdp";
+  version = "0.2.0.5";
+  sha256 = "077njr9m6x9n2id0419rn6v4xwb9nvxshrmas9pkknp52va4ljg5";
  buildDepends = [ monoidExtras newtype semigroups ];
  jailbreak = true;
  meta = {
--- a/pkgs/development/libraries/haskell/ekg/default.nix
+++ b/pkgs/development/libraries/haskell/ekg/default.nix
@ -6,8 +6,8 @@

 cabal.mkDerivation (self: {
  pname = "ekg";
-  version = "0.4.0.4";
-  sha256 = "1v1kskl1fwwpv72lay8c7nlvg2dswf6wij176fjfml1v8lmll2lr";
+  version = "0.4.0.5";
+  sha256 = "0ak06yz88p79bhayy8byy3j9yw9bix7zhw8yxfcdnxjwgnx621h0";
  buildDepends = [
    aeson ekgCore filepath network snapCore snapServer text time
    transformers unorderedContainers
--- a/pkgs/development/libraries/haskell/engine-io/default.nix
+++ b/pkgs/development/libraries/haskell/engine-io/default.nix
@ -7,8 +7,8 @@

 cabal.mkDerivation (self: {
  pname = "engine-io";
-  version = "1.2.2";
-  sha256 = "1d8323nxklbhva2y8ymgm5h57j2p86sdjfh0yi1fjjr8p26dh2py";
+  version = "1.2.3";
+  sha256 = "05sc939x24f3na6nxywgbq0yx4wdamh6zk4spdclqgq65j7v0hxc";
  buildDepends = [
    aeson async attoparsec base64Bytestring either free monadLoops
    mwcRandom stm stmDelay text transformers unorderedContainers vector
--- a/pkgs/development/libraries/haskell/equational-reasoning/default.nix
+++ b/pkgs/development/libraries/haskell/equational-reasoning/default.nix
@ -7,6 +7,7 @@ cabal.mkDerivation (self: {
  version = "0.2.0.4";
  sha256 = "1f94y6h7qg7rck7rxf6j8sygkh1xmfk0z1lr71inx6s74agjyc9j";
  buildDepends = [ singletons tagged void ];
+  jailbreak = true;
  meta = {
    description = "Proof assistant for Haskell using DataKinds & PolyKinds";
    license = self.stdenv.lib.licenses.bsd3;
--- a/pkgs/development/libraries/haskell/esqueleto/default.nix
+++ b/pkgs/development/libraries/haskell/esqueleto/default.nix
@ -7,8 +7,8 @@

 cabal.mkDerivation (self: {
  pname = "esqueleto";
-  version = "2.1.2";
-  sha256 = "18wcr5jwf7iz0rfrx07b4mm3j15rqwc43a6hycrabijik6s0v95v";
+  version = "2.1.2.1";
+  sha256 = "0lynhkbrxxrngvdj5d4xlmi92s4m3dzdpd7gs1k408slil2i7r7i";
  buildDepends = [
    conduit monadLogger persistent resourcet tagged text transformers
    unorderedContainers
--- a/pkgs/development/libraries/haskell/extensible-effects/default.nix
+++ b/pkgs/development/libraries/haskell/extensible-effects/default.nix
@ -2,16 +2,17 @@

 { cabal, HUnit, QuickCheck, testFramework, testFrameworkHunit
 , testFrameworkQuickcheck2, transformers, transformersBase
+, typeAligned, void
 }:

 cabal.mkDerivation (self: {
  pname = "extensible-effects";
-  version = "1.7.1.2";
-  sha256 = "1mvyiqlga6al81j4b4rg9yl46ml5s0hnx1g2hyvqljzr12njmajv";
-  buildDepends = [ transformers transformersBase ];
+  version = "1.9.0.1";
+  sha256 = "17hl4x4052jfn7xs6xhnc6d3x75a8haw2zsbnjd6rr5gsd1hq5kx";
+  buildDepends = [ transformers transformersBase typeAligned void ];
  testDepends = [
    HUnit QuickCheck testFramework testFrameworkHunit
-    testFrameworkQuickcheck2
+    testFrameworkQuickcheck2 void
  ];
  jailbreak = true;
  meta = {
--- a/pkgs/development/libraries/haskell/extra/default.nix
+++ b/pkgs/development/libraries/haskell/extra/default.nix
@ -4,8 +4,8 @@

 cabal.mkDerivation (self: {
  pname = "extra";
-  version = "0.8";
-  sha256 = "06ydgniar294i9xzviz7qmr3xpnlkpvyvgigwxqfz50kv77w8ijw";
+  version = "1.0";
+  sha256 = "0ainwq8f2mp1wc30srl971xy4qnrcyrcyig1kmrxx951hgav1dkb";
  buildDepends = [ filepath time ];
  testDepends = [ filepath QuickCheck time ];
  meta = {
--- a/pkgs/development/libraries/haskell/fay-base/default.nix
+++ b/pkgs/development/libraries/haskell/fay-base/default.nix
@ -4,11 +4,11 @@

 cabal.mkDerivation (self: {
  pname = "fay-base";
-  version = "0.19.2.1";
-  sha256 = "19vzrdbd1c8wws4mccycpq70594qy2ka3mr5x5fsdya56ff4xgld";
+  version = "0.19.4.1";
+  sha256 = "1pk1jjwyh2n9fg583v4cd0ll5qglphwnfm08q95klcvc61p4wqg6";
  buildDepends = [ fay ];
  meta = {
-    homepage = "https://github.com/faylang/fay-base";
+    homepage = "https://github.com/faylang/fay/";
    description = "The base package for Fay";
    license = self.stdenv.lib.licenses.bsd3;
    platforms = self.ghc.meta.platforms;
--- a/pkgs/development/libraries/haskell/fay-text/default.nix
+++ b/pkgs/development/libraries/haskell/fay-text/default.nix
@ -4,8 +4,8 @@

 cabal.mkDerivation (self: {
  pname = "fay-text";
-  version = "0.3.1";
-  sha256 = "0blr39vah0zd3i6clzzgmsfhxncwj8q6j4widk27iz3l27nlyin8";
+  version = "0.3.2";
+  sha256 = "1yjsn188ixpfqdr75xyl57rbv53dybik4g28h6p3jv73q494552m";
  buildDepends = [ fay fayBase text ];
  meta = {
    homepage = "https://github.com/faylang/fay-text";
--- a/pkgs/development/libraries/haskell/fay/default.nix
+++ b/pkgs/development/libraries/haskell/fay/default.nix
@ -9,8 +9,8 @@

 cabal.mkDerivation (self: {
  pname = "fay";
-  version = "0.21.0.2";
-  sha256 = "0hq9jfyl5ki3jcwffb9q7cxrgpchajgwk4j44kz37y1wji63lk96";
+  version = "0.21.2.1";
+  sha256 = "06ijfkm1x5a15hac9f4cs4f16rva2hkf07xfh0mm9q3wkamqxlfm";
  isLibrary = true;
  isExecutable = true;
  buildDepends = [
@ -19,6 +19,7 @@ cabal.mkDerivation (self: {
    sourcemap split spoon syb text time transformers uniplate
    unorderedContainers utf8String vector
  ];
+  jailbreak = true;
  meta = {
    homepage = "https://github.com/faylang/fay/wiki";
    description = "A compiler for Fay, a Haskell subset that compiles to JavaScript";
--- a/pkgs/development/libraries/haskell/free/default.nix
+++ b/pkgs/development/libraries/haskell/free/default.nix
@ -6,8 +6,8 @@

 cabal.mkDerivation (self: {
  pname = "free";
-  version = "4.9";
-  sha256 = "01pa9ax9i4pkh9a5achndx5s7sxvhnk6rm57g8rzav79hzsr4cnx";
+  version = "4.10.0.1";
+  sha256 = "0vs080bbcbncjqa7z0l6zd10kpmilj8khxiqdn4bq24mifyryhvq";
  buildDepends = [
    bifunctors comonad distributive mtl preludeExtras profunctors
    semigroupoids semigroups transformers
--- a/pkgs/development/libraries/haskell/generics-sop/default.nix
+++ b/pkgs/development/libraries/haskell/generics-sop/default.nix
@ -4,8 +4,8 @@

 cabal.mkDerivation (self: {
  pname = "generics-sop";
-  version = "0.1.0.2";
-  sha256 = "01s3v3a29wdsps9vas8in2ks5p4d2arqp3qvmzqa7v2sz786xjra";
+  version = "0.1.0.3";
+  sha256 = "0wvrav5armspfp6iixns1db45xfpqicx74asi14a2gnl28yqmfpl";
  buildDepends = [ tagged ];
  meta = {
    description = "Generic Programming using True Sums of Products";
--- a/Show More
+++ b/Show More