Merge branch 'master' into staging

2017-03-30 12:54:41 -04:00 · 2017-03-30 12:54:41 -04:00 · 8b65437aae
commit 8b65437aae
parent 9b049849bf f9a1060199
638 changed files with 9456 additions and 8715 deletions
--- a/.travis.yml
+++ b/.travis.yml
@ -1,8 +1,14 @@
 language: nix
+sudo: true
+# 'sudo: false' == containers that start fast, but only get 4G ram;
+# 'sudo: true'  == VMs that start slow, but with 8G
+# ..as per:  https://docs.travis-ci.com/user/ci-environment/#Virtualization-environments
+# Nixpkgs PR tests OOM with 4G: https://github.com/NixOS/nixpkgs/issues/24200
+
 matrix:
    include:
        - os: linux
-          sudo: false
+          sudo: required
          script:
              - ./maintainers/scripts/travis-nox-review-pr.sh nixpkgs-verify nixpkgs-manual nixpkgs-tarball nixpkgs-unstable
              - ./maintainers/scripts/travis-nox-review-pr.sh nixos-options nixos-manual
--- a/README.md
+++ b/README.md
@ -13,12 +13,12 @@ build daemon as so-called channels. To get channel information via git, add
 ```

 For stability and maximum binary package support, it is recommended to maintain
-custom changes on top of one of the channels, e.g. `nixos-16.09` for the latest
+custom changes on top of one of the channels, e.g. `nixos-17.03` for the latest
 release and `nixos-unstable` for the latest successful build of master:

 ```
 % git remote update channels
-% git rebase channels/nixos-16.09
+% git rebase channels/nixos-17.03
 ```

 For pull-requests, please rebase onto nixpkgs `master`.
@ -32,9 +32,9 @@ For pull-requests, please rebase onto nixpkgs `master`.
 * [Manual (NixOS)](https://nixos.org/nixos/manual/)
 * [Nix Wiki](https://nixos.org/wiki/) (deprecated, see milestone ["Move the Wiki!"](https://github.com/NixOS/nixpkgs/issues?q=is%3Aopen+is%3Aissue+milestone%3A%22Move+the+wiki%21%22))
 * [Continuous package builds for unstable/master](https://hydra.nixos.org/jobset/nixos/trunk-combined)
-* [Continuous package builds for 16.09 release](https://hydra.nixos.org/jobset/nixos/release-16.09)
+* [Continuous package builds for 17.03 release](https://hydra.nixos.org/jobset/nixos/release-17.03)
 * [Tests for unstable/master](https://hydra.nixos.org/job/nixos/trunk-combined/tested#tabs-constituents)
-* [Tests for 16.09 release](https://hydra.nixos.org/job/nixos/release-16.09/tested#tabs-constituents)
+* [Tests for 17.03 release](https://hydra.nixos.org/job/nixos/release-17.03/tested#tabs-constituents)

 Communication:

--- a/doc/functions.xml
+++ b/doc/functions.xml
@ -529,7 +529,7 @@
  <note>
  <para>
  If you see errors similar to <literal>getProtocolByName: does not exist (no such protocol name: tcp)</literal>
-  you may need to add <literal>pkgs.iana_etc</literal> to <varname>contents</varname>.
+  you may need to add <literal>pkgs.iana-etc</literal> to <varname>contents</varname>.
  </para>
  </note>

--- a/lib/attrsets.nix
+++ b/lib/attrsets.nix
@ -1,12 +1,12 @@
 # Operations on attribute sets.

-with {
+let
  inherit (builtins) head tail length;
  inherit (import ./trivial.nix) or;
  inherit (import ./default.nix) fold;
  inherit (import ./strings.nix) concatStringsSep;
  inherit (import ./lists.nix) concatMap concatLists all deepSeqList;
-};
+in

 rec {
  inherit (builtins) attrNames listToAttrs hasAttr isAttrs getAttr;
--- a/lib/maintainers.nix
+++ b/lib/maintainers.nix
@ -316,6 +316,7 @@
  michalrus = "Michal Rus <m@michalrus.com>";
  michelk = "Michel Kuhlmann <michel@kuhlmanns.info>";
  mikefaille = "Michaël Faille <michael@faille.io>";
+  miltador = "Vasiliy Solovey <miltador@yandex.ua>";
  mimadrid = "Miguel Madrid <mimadrid@ucm.es>";
  mingchuan = "Ming Chuan <ming@culpring.com>";
  mirdhyn = "Merlin Gaillard <mirdhyn@gmail.com>";
@ -398,6 +399,7 @@
  pjones = "Peter Jones <pjones@devalot.com>";
  pkmx = "Chih-Mao Chen <pkmx.tw@gmail.com>";
  plcplc = "Philip Lykke Carlsen <plcplc@gmail.com>";
+  plumps = "Maksim Bronsky <maks.bronsky@web.de";
  pmahoney = "Patrick Mahoney <pat@polycrystal.org>";
  pmiddend = "Philipp Middendorf <pmidden@secure.mailbox.org>";
  polyrod = "Maurizio Di Pietro <dc1mdp@gmail.com>";
@ -460,6 +462,7 @@
  sepi = "Raffael Mancini <raffael@mancini.lu>";
  seppeljordan = "Sebastian Jordan <sebastian.jordan.mail@googlemail.com>";
  shanemikel = "Shane Pearlman <shanemikel1@gmail.com>";
+  shawndellysse = "Shawn Dellysse <sdellysse@gmail.com>";
  sheenobu = "Sheena Artrip <sheena.artrip@gmail.com>";
  sheganinans = "Aistis Raulinaitis <sheganinans@gmail.com>";
  shell = "Shell Turner <cam.turn@gmail.com>";
@ -515,7 +518,7 @@
  tvorog = "Marsel Zaripov <marszaripov@gmail.com>";
  twey = "James ‘Twey’ Kay <twey@twey.co.uk>";
  uralbash = "Svintsov Dmitry <root@uralbash.ru>";
-  urkud = "Yury G. Kudryashov <urkud+nix@ya.ru>";
+  #urkud = "Yury G. Kudryashov <urkud+nix@ya.ru>"; inactive since 2012
  uwap = "uwap <me@uwap.name>";
  vandenoever = "Jos van den Oever <jos@vandenoever.info>";
  vanzef = "Ivan Solyankin <vanzef@gmail.com>";
--- a/lib/types.nix
+++ b/lib/types.nix
@ -6,7 +6,7 @@ with import ./attrsets.nix;
 with import ./options.nix;
 with import ./trivial.nix;
 with import ./strings.nix;
-with {inherit (import ./modules.nix) mergeDefinitions filterOverrides; };
+let inherit (import ./modules.nix) mergeDefinitions filterOverrides; in

 rec {

--- a/maintainers/scripts/hydra-eval-failures.py
+++ b/maintainers/scripts/hydra-eval-failures.py
@ -48,8 +48,8 @@ def get_maintainers(attr_name):
@click.command()
@click.option(
    '--jobset',
-    default="nixos/release-16.09",
-    help='Hydra project like nixos/release-16.09')
+    default="nixos/release-17.03",
+    help='Hydra project like nixos/release-17.03')
 def cli(jobset):
    """
    Given a Hydra project, inspect latest evaluation
--- a/nixos/doc/manual/development/sources.xml
+++ b/nixos/doc/manual/development/sources.xml
@ -27,8 +27,8 @@ a subdirectory of the Nixpkgs repository.) The remote
 <literal>channels</literal> refers to a read-only repository that
 tracks the Nixpkgs/NixOS channels (see <xref linkend="sec-upgrading"/>
 for more information about channels). Thus, the Git branch
-<literal>channels/nixos-14.12</literal> will contain the latest built
-and tested version available in the <literal>nixos-14.12</literal>
+<literal>channels/nixos-17.03</literal> will contain the latest built
+and tested version available in the <literal>nixos-17.03</literal>
 channel.</para>

 <para>It’s often inconvenient to develop directly on the master
@ -39,9 +39,9 @@ branch based on your current NixOS version:

 <screen>
 $ nixos-version
-14.04.273.ea1952b (Baboon)
+17.09pre104379.6e0b727 (Hummingbird)

-$ git checkout -b local ea1952b
+$ git checkout -b local e3938c8
 </screen>

 Or, to base your local branch on the latest version available in a
@ -49,17 +49,17 @@ NixOS channel:

 <screen>
 $ git remote update channels
-$ git checkout -b local channels/nixos-14.12
+$ git checkout -b local channels/nixos-17.03
 </screen>

-(Replace <literal>nixos-14.12</literal> with the name of the channel
+(Replace <literal>nixos-17.03</literal> with the name of the channel
 you want to use.) You can use <command>git merge</command> or
 <command>git rebase</command> to keep your local branch in sync with
 the channel, e.g.

 <screen>
 $ git remote update channels
-$ git merge channels/nixos-14.12
+$ git merge channels/nixos-17.03
 </screen>

 You can use <command>git cherry-pick</command> to copy commits from
--- a/nixos/doc/manual/installation/installing-uefi.xml
+++ b/nixos/doc/manual/installation/installing-uefi.xml
@ -26,7 +26,8 @@ changes:
    <literal>vfat</literal> filesystem.</para>
  </listitem>
  <listitem>
-    <para>You must set <option>boot.loader.systemd-boot.enable</option> to
+    <para>Instead of <option>boot.loader.grub.device</option>,
+    you must set <option>boot.loader.systemd-boot.enable</option> to
    <literal>true</literal>. <command>nixos-generate-config</command>
    should do this automatically for new configurations when booted in
    UEFI mode.</para>
--- a/nixos/doc/manual/installation/upgrading.xml
+++ b/nixos/doc/manual/installation/upgrading.xml
@ -15,12 +15,12 @@ been built.  These channels are:
 <itemizedlist>
  <listitem>
    <para><emphasis>Stable channels</emphasis>, such as <literal
-    xlink:href="https://nixos.org/channels/nixos-14.12">nixos-14.12</literal>.
+    xlink:href="https://nixos.org/channels/nixos-17.03">nixos-17.03</literal>.
    These only get conservative bug fixes and package upgrades.  For
    instance, a channel update may cause the Linux kernel on your
-    system to be upgraded from 3.4.66 to 3.4.67 (a minor bug fix), but
-    not from 3.4.<replaceable>x</replaceable> to
-    3.11.<replaceable>x</replaceable> (a major change that has the
+    system to be upgraded from 4.9.16 to 4.9.17 (a minor bug fix), but
+    not from 4.9.<replaceable>x</replaceable> to
+    4.11.<replaceable>x</replaceable> (a major change that has the
    potential to break things).  Stable channels are generally
    maintained until the next stable branch is created.</para>
    <para></para>
@ -34,7 +34,7 @@ been built.  These channels are:
  </listitem>
  <listitem>
    <para><emphasis>Small channels</emphasis>, such as <literal
-    xlink:href="https://nixos.org/channels/nixos-14.12-small">nixos-14.12-small</literal>
+    xlink:href="https://nixos.org/channels/nixos-17.03-small">nixos-17.03-small</literal>
    or <literal
    xlink:href="https://nixos.org/channels/nixos-unstable-small">nixos-unstable-small</literal>. These
    are identical to the stable and unstable channels described above,
@ -55,8 +55,8 @@ appliances.)</para>

 <para>When you first install NixOS, you’re automatically subscribed to
 the NixOS channel that corresponds to your installation source.   For
-instance, if you installed from a 14.12 ISO, you will be subscribed to
-the <literal>nixos-14.12</literal> channel.  To see which NixOS
+instance, if you installed from a 17.03 ISO, you will be subscribed to
+the <literal>nixos-17.03</literal> channel.  To see which NixOS
 channel you’re subscribed to, run the following as root:

 <screen>
@ -71,16 +71,16 @@ To switch to a different NixOS channel, do
 </screen>

 (Be sure to include the <literal>nixos</literal> parameter at the
-end.)  For instance, to use the NixOS 14.12 stable channel:
+end.)  For instance, to use the NixOS 17.03 stable channel:

 <screen>
-# nix-channel --add https://nixos.org/channels/nixos-14.12 nixos
+# nix-channel --add https://nixos.org/channels/nixos-17.03 nixos
 </screen>

 If you have a server, you may want to use the “small” channel instead:

 <screen>
-# nix-channel --add https://nixos.org/channels/nixos-14.12-small nixos
+# nix-channel --add https://nixos.org/channels/nixos-17.03-small nixos
 </screen>

 And if you want to live on the bleeding edge:
@ -130,7 +130,7 @@ runs, see <command>systemctl list-timers</command>.)  You can also
 specify a channel explicitly, e.g.

 <programlisting>
-system.autoUpgrade.channel = https://nixos.org/channels/nixos-15.09;
+system.autoUpgrade.channel = https://nixos.org/channels/nixos-17.03;
 </programlisting>

 </para>
--- a/nixos/doc/manual/release-notes/rl-1703.xml
+++ b/nixos/doc/manual/release-notes/rl-1703.xml
@ -247,6 +247,17 @@ following incompatible changes:</para>
    </para>
  </listitem>

+  <listitem>
+    <para>
+      The dnscrypt-proxy module interface has been streamlined around the
+      <option>extraArgs</option> option.  Where possible, legacy option
+      declarations are mapped to <option>extraArgs</option> but will emit
+      warnings.  The <option>resolverList</option> has been outright
+      removed: to use an unlisted resolver, use the
+      <option>customResolver</option> option.
+    </para>
+  </listitem>
+
 </itemizedlist>


@ -305,6 +316,15 @@ following incompatible changes:</para>
    </para>
  </listitem>

+  <listitem>
+    <para>
+      The dnscrypt-proxy service supports synchronizing the list of public
+      resolvers without working DNS resolution.  This fixes issues caused by the
+      resolver list becoming outdated.  It also improves the viability of
+      DNSCrypt only configurations.
+    </para>
+  </listitem>
+
 </itemizedlist>


--- a/nixos/modules/config/networking.nix
+++ b/nixos/modules/config/networking.nix
@ -178,10 +178,10 @@ in

    environment.etc =
      { # /etc/services: TCP/UDP port assignments.
-        "services".source = pkgs.iana_etc + "/etc/services";
+        "services".source = pkgs.iana-etc + "/etc/services";

        # /etc/protocols: IP protocol numbers.
-        "protocols".source  = pkgs.iana_etc + "/etc/protocols";
+        "protocols".source  = pkgs.iana-etc + "/etc/protocols";

        # /etc/rpc: RPC program numbers.
        "rpc".source = pkgs.glibc.out + "/etc/rpc";
--- a/nixos/modules/config/update-users-groups.pl
+++ b/nixos/modules/config/update-users-groups.pl
@ -6,6 +6,21 @@ use JSON;
 make_path("/var/lib/nixos", { mode => 0755 });


+# Keep track of deleted uids and gids.
+my $uidMapFile = "/var/lib/nixos/uid-map";
+my $uidMap = -e $uidMapFile ? decode_json(read_file($uidMapFile)) : {};
+
+my $gidMapFile = "/var/lib/nixos/gid-map";
+my $gidMap = -e $gidMapFile ? decode_json(read_file($gidMapFile)) : {};
+
+
+sub updateFile {
+    my ($path, $contents, $perms) = @_;
+    write_file("$path.tmp", { binmode => ':utf8', perms => $perms // 0644 }, $contents);
+    rename("$path.tmp", $path) or die;
+}
+
+
 sub hashPassword {
    my ($password) = @_;
    my $salt = "";
@ -18,10 +33,10 @@ sub hashPassword {
 # Functions for allocating free GIDs/UIDs. FIXME: respect ID ranges in
 # /etc/login.defs.
 sub allocId {
-    my ($used, $idMin, $idMax, $up, $getid) = @_;
+    my ($used, $prevUsed, $idMin, $idMax, $up, $getid) = @_;
    my $id = $up ? $idMin : $idMax;
    while ($id >= $idMin && $id <= $idMax) {
-        if (!$used->{$id} && !defined &$getid($id)) {
+        if (!$used->{$id} && !$prevUsed->{$id} && !defined &$getid($id)) {
            $used->{$id} = 1;
            return $id;
        }
@ -31,23 +46,36 @@ sub allocId {
    die "$0: out of free UIDs or GIDs\n";
 }

-my (%gidsUsed, %uidsUsed);
+my (%gidsUsed, %uidsUsed, %gidsPrevUsed, %uidsPrevUsed);

 sub allocGid {
-    return allocId(\%gidsUsed, 400, 499, 0, sub { my ($gid) = @_; getgrgid($gid) });
+    my ($name) = @_;
+    my $prevGid = $gidMap->{$name};
+    if (defined $prevGid && !defined $gidsUsed{$prevGid}) {
+        print STDERR "reviving group '$name' with GID $prevGid\n";
+        $gidsUsed{$prevGid} = 1;
+        return $prevGid;
+    }
+    return allocId(\%gidsUsed, \%gidsPrevUsed, 400, 499, 0, sub { my ($gid) = @_; getgrgid($gid) });
 }

 sub allocUid {
-    my ($isSystemUser) = @_;
+    my ($name, $isSystemUser) = @_;
    my ($min, $max, $up) = $isSystemUser ? (400, 499, 0) : (1000, 29999, 1);
-    return allocId(\%uidsUsed, $min, $max, $up, sub { my ($uid) = @_; getpwuid($uid) });
+    my $prevUid = $uidMap->{$name};
+    if (defined $prevUid && $prevUid >= $min && $prevUid <= $max && !defined $uidsUsed{$prevUid}) {
+        print STDERR "reviving user '$name' with UID $prevUid\n";
+        $uidsUsed{$prevUid} = 1;
+        return $prevUid;
+    }
+    return allocId(\%uidsUsed, \%uidsPrevUsed, $min, $max, $up, sub { my ($uid) = @_; getpwuid($uid) });
 }


 # Read the declared users/groups.
 my $spec = decode_json(read_file($ARGV[0]));

-# Don't allocate UIDs/GIDs that are already in use.
+# Don't allocate UIDs/GIDs that are manually assigned.
 foreach my $g (@{$spec->{groups}}) {
    $gidsUsed{$g->{gid}} = 1 if defined $g->{gid};
 }
@ -56,6 +84,11 @@ foreach my $u (@{$spec->{users}}) {
    $uidsUsed{$u->{uid}} = 1 if defined $u->{uid};
 }

+# Likewise for previously used but deleted UIDs/GIDs.
+$uidsPrevUsed{$_} = 1 foreach values %{$uidMap};
+$gidsPrevUsed{$_} = 1 foreach values %{$gidMap};
+
+
 # Read the current /etc/group.
 sub parseGroup {
    chomp;
@ -114,16 +147,18 @@ foreach my $g (@{$spec->{groups}}) {
            }
        }
    } else {
-        $g->{gid} = allocGid if !defined $g->{gid};
+        $g->{gid} = allocGid($name) if !defined $g->{gid};
        $g->{password} = "x";
    }

    $g->{members} = join ",", sort(keys(%members));
    $groupsOut{$name} = $g;
+
+    $gidMap->{$name} = $g->{gid};
 }

 # Update the persistent list of declarative groups.
-write_file($declGroupsFile, { binmode => ':utf8' }, join(" ", sort(keys %groupsOut)));
+updateFile($declGroupsFile, join(" ", sort(keys %groupsOut)));

 # Merge in the existing /etc/group.
 foreach my $name (keys %groupsCur) {
@ -140,8 +175,8 @@ foreach my $name (keys %groupsCur) {
 # Rewrite /etc/group. FIXME: acquire lock.
 my @lines = map { join(":", $_->{name}, $_->{password}, $_->{gid}, $_->{members}) . "\n" }
    (sort { $a->{gid} <=> $b->{gid} } values(%groupsOut));
-write_file("/etc/group.tmp", { binmode => ':utf8' }, @lines);
-rename("/etc/group.tmp", "/etc/group") or die;
+updateFile($gidMapFile, encode_json($gidMap));
+updateFile("/etc/group", \@lines);
 system("nscd --invalidate group");

 # Generate a new /etc/passwd containing the declared users.
@ -167,7 +202,7 @@ foreach my $u (@{$spec->{users}}) {
            $u->{uid} = $existing->{uid};
        }
    } else {
-        $u->{uid} = allocUid($u->{isSystemUser}) if !defined $u->{uid};
+        $u->{uid} = allocUid($name, $u->{isSystemUser}) if !defined $u->{uid};

        if (defined $u->{initialPassword}) {
            $u->{hashedPassword} = hashPassword($u->{initialPassword});
@ -195,10 +230,12 @@ foreach my $u (@{$spec->{users}}) {

    $u->{fakePassword} = $existing->{fakePassword} // "x";
    $usersOut{$name} = $u;
+
+    $uidMap->{$name} = $u->{uid};
 }

 # Update the persistent list of declarative users.
-write_file($declUsersFile, { binmode => ':utf8' }, join(" ", sort(keys %usersOut)));
+updateFile($declUsersFile, join(" ", sort(keys %usersOut)));

 # Merge in the existing /etc/passwd.
 foreach my $name (keys %usersCur) {
@ -214,8 +251,8 @@ foreach my $name (keys %usersCur) {
 # Rewrite /etc/passwd. FIXME: acquire lock.
@lines = map { join(":", $_->{name}, $_->{fakePassword}, $_->{uid}, $_->{gid}, $_->{description}, $_->{home}, $_->{shell}) . "\n" }
    (sort { $a->{uid} <=> $b->{uid} } (values %usersOut));
-write_file("/etc/passwd.tmp", { binmode => ':utf8' }, @lines);
-rename("/etc/passwd.tmp", "/etc/passwd") or die;
+updateFile($uidMapFile, encode_json($uidMap));
+updateFile("/etc/passwd", \@lines);
 system("nscd --invalidate passwd");


@ -242,5 +279,4 @@ foreach my $u (values %usersOut) {
    push @shadowNew, join(":", $u->{name}, $hashedPassword, "1::::::") . "\n";
 }

-write_file("/etc/shadow.tmp", { binmode => ':utf8', perms => 0600 }, @shadowNew);
-rename("/etc/shadow.tmp", "/etc/shadow") or die;
+updateFile("/etc/shadow", \@shadowNew, 0600);
--- a/nixos/modules/installer/cd-dvd/channel.nix
+++ b/nixos/modules/installer/cd-dvd/channel.nix
@ -6,6 +6,16 @@
 with lib;

 let
+  # Do not include these things:
+  #   - The '.git' directory
+  #   - Result symlinks from nix-build ('result', 'result-2', 'result-bin', ...)
+  #   - VIM/Emacs swap/backup files ('.swp', '.swo', '.foo.swp', 'foo~', ...)
+  filterFn = path: type: let basename = baseNameOf (toString path); in
+    if type == "directory" then basename != ".git"
+    else if type == "symlink" then builtins.match "^result(|-.*)$" basename == null
+    else builtins.match "^((|\..*)\.sw[a-z]|.*~)$" basename == null;
+
+  nixpkgs = builtins.filterSource filterFn pkgs.path;

  # We need a copy of the Nix expressions for Nixpkgs and NixOS on the
  # CD.  These are installed into the "nixos" channel of the root
@ -15,12 +25,11 @@ let
    { }
    ''
      mkdir -p $out
-      cp -prd ${pkgs.path} $out/nixos
+      cp -prd ${nixpkgs} $out/nixos
      chmod -R u+w $out/nixos
      if [ ! -e $out/nixos/nixpkgs ]; then
        ln -s . $out/nixos/nixpkgs
      fi
-      rm -rf $out/nixos/.git
      echo -n ${config.system.nixosVersionSuffix} > $out/nixos/.version-suffix
    '';

--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -138,7 +138,6 @@
  ./services/backup/mysql-backup.nix
  ./services/backup/postgresql-backup.nix
  ./services/backup/rsnapshot.nix
-  ./services/backup/sitecopy-backup.nix
  ./services/backup/tarsnap.nix
  ./services/backup/znapzend.nix
  ./services/cluster/fleet.nix
@ -275,6 +274,7 @@
  ./services/misc/gpsd.nix
  #./services/misc/ihaskell.nix
  ./services/misc/irkerd.nix
+  ./services/misc/jackett.nix
  ./services/misc/leaps.nix
  ./services/misc/mantisbt.nix
  ./services/misc/mathics.nix
@ -295,6 +295,7 @@
  ./services/misc/parsoid.nix
  ./services/misc/phd.nix
  ./services/misc/plex.nix
+  ./services/misc/radarr.nix
  ./services/misc/redmine.nix
  ./services/misc/rippled.nix
  ./services/misc/ripple-rest.nix
@ -454,7 +455,7 @@
  ./services/networking/prayer.nix
  ./services/networking/privoxy.nix
  ./services/networking/prosody.nix
-  ./services/networking/quagga.nix
+  # ./services/networking/quagga.nix
  ./services/networking/quassel.nix
  ./services/networking/racoon.nix
  ./services/networking/radicale.nix
--- a/nixos/modules/security/wrappers/default.nix
+++ b/nixos/modules/security/wrappers/default.nix
@ -177,6 +177,35 @@ in
          # programs to be wrapped.
          WRAPPER_PATH=${config.system.path}/bin:${config.system.path}/sbin

+          # Remove the old /var/setuid-wrappers path from the system...
+          #
+          # TODO: this is only necessary for upgrades 16.09 => 17.x;
+          # this conditional removal block needs to be removed after
+          # the release.
+          if [ -d /var/setuid-wrappers ]; then
+            rm -rf /var/setuid-wrappers
+            ln -s /run/wrappers/bin /var/setuid-wrappers
+          fi
+
+          # Remove the old /run/setuid-wrappers-dir path from the
+          # system as well...
+          #
+          # TODO: this is only necessary for upgrades 16.09 => 17.x;
+          # this conditional removal block needs to be removed after
+          # the release.
+          if [ -d /run/setuid-wrapper-dirs ]; then
+            rm -rf /run/setuid-wrapper-dirs
+            ln -s /run/wrappers/bin /run/setuid-wrapper-dirs
+          fi
+
+          # TODO: this is only necessary for upgrades 16.09 => 17.x;
+          # this conditional removal block needs to be removed after
+          # the release.
+          if readlink -f /run/booted-system | grep nixos-17 > /dev/null; then
+            rm -rf /run/setuid-wrapper-dirs
+            rm -rf /var/setuid-wrappers
+          fi
+
          # We want to place the tmpdirs for the wrappers to the parent dir.
          wrapperDir=$(mktemp --directory --tmpdir="${parentWrapperDir}" wrappers.XXXXXXXXXX)
          chmod a+rx $wrapperDir
--- a/nixos/modules/services/backup/sitecopy-backup.nix
+++ b/nixos/modules/services/backup/sitecopy-backup.nix
@ -1,106 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let
-  inherit (pkgs) sitecopy;
-
-  stateDir = "/var/spool/sitecopy";
-
-  sitecopyCron = backup : ''
-    ${if backup ? period then backup.period else config.services.sitecopy.period} root ${sitecopy}/bin/sitecopy --storepath=${stateDir} --rcfile=${stateDir}/${backup.name}.conf --update ${backup.name} >> /var/log/sitecopy.log 2>&1
-  '';
-in
-
-{
-
-  options = {
-
-    services.sitecopy = {
-
-      enable = mkOption {
-        default = false;
-        description = ''
-          Whether to enable <command>sitecopy</command> backups of specified
-          directories.
-        '';
-      };
-
-      period = mkOption {
-        default = "15 04 * * *";
-        description = ''
-          This option defines (in the format used by <command>cron</command>)
-          when the <command>sitecopy</command> backups are to be run.
-          The default is to update at 04:15 (at night) every day.
-        '';
-      };
-
-      backups = mkOption {
-        example = [
-          { name = "test";
-            local = "/tmp/backup";
-            remote = "/staff-groups/ewi/st/strategoxt/backup/test";
-            server = "webdata.tudelft.nl";
-            protocol = "webdav";
-            https = true ;
-            symlinks = "maintain" ;
-          }
-        ];
-        default = [];
-        description = ''
-           List of attribute sets describing the backups.
-
-           Username/password are extracted from
-           <filename>${stateDir}/sitecopy.secrets</filename> at activation
-           time. The secrets file lines should have the following structure:
-           <screen>
-             server username password
-           </screen>
-        '';
-      };
-
-    };
-
-  };
-
-  config = mkIf config.services.sitecopy.enable {
-    environment.systemPackages = [ sitecopy ];
-
-    services.cron.systemCronJobs = map sitecopyCron config.services.sitecopy.backups;
-
-    system.activationScripts.sitecopyBackup = stringAfter [ "stdio" "users" ]
-      ''
-        mkdir -m 0700 -p ${stateDir}
-        chown root ${stateDir}
-        touch ${stateDir}/sitecopy.secrets
-        chown root ${stateDir}/sitecopy.secrets
-
-        ${lib.concatStrings (map ( b: ''
-            unset secrets
-            unset secret
-            secrets=`grep '^${b.server}' ${stateDir}/sitecopy.secrets | head -1`
-            secret=($secrets)
-            cat > ${stateDir}/${b.name}.conf << EOF
-              site ${b.name}
-              server ${b.server}
-              protocol ${b.protocol}
-              username ''${secret[1]}
-              password ''${secret[2]}
-              local ${b.local}
-              remote ${b.remote}
-              symlinks ${b.symlinks}
-              ${if b.https then "http secure" else ""}
-            EOF
-            chmod 0600 ${stateDir}/${b.name}.conf
-            if ! test -e ${stateDir}/${b.name} ; then
-              echo " * Initializing sitecopy '${b.name}'"
-              ${sitecopy}/bin/sitecopy --storepath=${stateDir} --rcfile=${stateDir}/${b.name}.conf --initialize ${b.name}
-            else
-              echo " * Sitecopy '${b.name}' already initialized"
-            fi
-          '' ) config.services.sitecopy.backups
-        )}
-      '';
-  };
-
-}
--- a/nixos/modules/services/continuous-integration/gitlab-runner.nix
+++ b/nixos/modules/services/continuous-integration/gitlab-runner.nix
@ -20,6 +20,14 @@ in
      description = "The working directory used";
    };

+    package = mkOption {
+      description = "Gitlab Runner package to use";
+      default = pkgs.gitlab-runner;
+      defaultText = "pkgs.gitlab-runner";
+      type = types.package;
+      example = literalExample "pkgs.gitlab-runner_1_11";
+    };
+
  };

  config = mkIf cfg.enable {
@ -29,7 +37,7 @@ in
      requires = [ "docker.service" ];
      wantedBy = [ "multi-user.target" ];
      serviceConfig = {
-        ExecStart = ''${pkgs.gitlab-runner.bin}/bin/gitlab-runner run \
+        ExecStart = ''${cfg.package.bin}/bin/gitlab-runner run \
          --working-directory ${cfg.workDir} \
          --config ${configFile} \
          --service gitlab-runner \
@ -38,6 +46,9 @@ in
      };
    };

+    # Make the gitlab-runner command availabe so users can query the runner
+    environment.systemPackages = [ cfg.package ];
+
    users.extraUsers.gitlab-runner = {
      group = "gitlab-runner";
      extraGroups = [ "docker" ];
--- a/nixos/modules/services/misc/jackett.nix
+++ b/nixos/modules/services/misc/jackett.nix
@ -0,0 +1,44 @@
+{ config, pkgs, lib, mono, ... }:
+
+with lib;
+
+let
+  cfg = config.services.jackett;
+in
+{
+  options = {
+    services.jackett = {
+      enable = mkEnableOption "Jackett";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.jackett = {
+      description = "Jackett";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      preStart = ''
+        test -d /var/lib/jackett/ || {
+          echo "Creating jackett data directory in /var/lib/jackett/"
+          mkdir -p /var/lib/jackett/
+        }
+        chown -R jackett /var/lib/jackett/
+        chmod 0700 /var/lib/jackett/
+      '';
+
+      serviceConfig = {
+        Type = "simple";
+        User = "jackett";
+        Group = "nogroup";
+        PermissionsStartOnly = "true";
+        ExecStart = "${pkgs.jackett}/bin/Jackett";
+        Restart = "on-failure";
+      };
+    };
+
+    users.extraUsers.jackett = {
+      home = "/var/lib/jackett";
+    };
+
+  };
+}
--- a/nixos/modules/services/misc/radarr.nix
+++ b/nixos/modules/services/misc/radarr.nix
@ -0,0 +1,44 @@
+{ config, pkgs, lib, mono, ... }:
+
+with lib;
+
+let
+  cfg = config.services.radarr;
+in
+{
+  options = {
+    services.radarr = {
+      enable = mkEnableOption "Radarr";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.radarr = {
+      description = "Radarr";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      preStart = ''
+        test -d /var/lib/radarr/ || {
+          echo "Creating radarr data directory in /var/lib/radarr/"
+          mkdir -p /var/lib/radarr/
+        }
+        chown -R radarr /var/lib/radarr/
+        chmod 0700 /var/lib/radarr/
+      '';
+
+      serviceConfig = {
+        Type = "simple";
+        User = "radarr";
+        Group = "nogroup";
+        PermissionsStartOnly = "true";
+        ExecStart = "${pkgs.radarr}/bin/Radarr";
+        Restart = "on-failure";
+      };
+    };
+
+    users.extraUsers.radarr = {
+      home = "/var/lib/radarr";
+    };
+
+  };
+}
--- a/nixos/modules/services/network-filesystems/openafs-client/default.nix
+++ b/nixos/modules/services/network-filesystems/openafs-client/default.nix
@ -76,6 +76,7 @@ in
      description = "AFS client";
      wantedBy = [ "multi-user.target" ];
      after = [ "network.target" ];
+      serviceConfig = { RemainAfterExit = true; };

      preStart = ''
        mkdir -p -m 0755 /afs
--- a/nixos/modules/services/networking/dnscrypt-proxy.nix
+++ b/nixos/modules/services/networking/dnscrypt-proxy.nix
@ -220,6 +220,8 @@ in
        ${getLib pkgs.attr}/lib/libattr.so.* mr, # */

        ${resolverList} r,
+
+        /run/systemd/notify rw,
      }
    '');
    })
--- a/nixos/modules/services/networking/nftables.nix
+++ b/nixos/modules/services/networking/nftables.nix
@ -17,6 +17,17 @@ in

          This conflicts with the standard networking firewall, so make sure to
          disable it before using nftables.
+
+          Note that if you have Docker enabled you will not be able to use
+          nftables without intervention. Docker uses iptables internally to
+          setup NAT for containers. This module disables the ip_tables kernel
+          module, however Docker automatically loads the module. Please see [1]
+          for more information.
+
+          There are other programs that use iptables internally too, such as
+          libvirt.
+
+          [1]: https://github.com/NixOS/nixpkgs/issues/24318#issuecomment-289216273
        '';
    };
    networking.nftables.ruleset = mkOption {
--- a/nixos/modules/services/web-servers/apache-httpd/wordpress.nix
+++ b/nixos/modules/services/web-servers/apache-httpd/wordpress.nix
@ -9,7 +9,7 @@ let
    <?php
    define('DB_NAME',     '${config.dbName}');
    define('DB_USER',     '${config.dbUser}');
-    define('DB_PASSWORD', '${config.dbPassword}');
+    define('DB_PASSWORD', file_get_contents('${config.dbPasswordFile}'));
    define('DB_HOST',     '${config.dbHost}');
    define('DB_CHARSET',  'utf8');
    $table_prefix  = '${config.tablePrefix}';
@ -137,9 +137,34 @@ in
    };
    dbPassword = mkOption {
      default = "wordpress";
-      description = "The mysql password to the respective dbUser.";
+      description = ''
+        The mysql password to the respective dbUser.
+
+        Warning: this password is stored in the world-readable Nix store. It's
+        recommended to use the $dbPasswordFile option since that gives you control over
+        the security of the password. $dbPasswordFile also takes precedence over $dbPassword.
+      '';
      example = "wordpress";
    };
+    dbPasswordFile = mkOption {
+      type = types.str;
+      default = toString (pkgs.writeTextFile {
+        name = "wordpress-dbpassword";
+        text = config.dbPassword;
+      });
+      example = "/run/keys/wordpress-dbpassword";
+      description = ''
+        Path to a file that contains the mysql password to the respective dbUser.
+        The file should be readable by the user: config.services.httpd.user.
+
+        $dbPasswordFile takes precedence over the $dbPassword option.
+
+        This defaults to a file in the world-readable Nix store that contains the value
+        of the $dbPassword option. It's recommended to override this with a path not in
+        the Nix store. Tip: use nixops key management:
+        <link xlink:href='https://nixos.org/nixops/manual/#idm140737318306400'/>
+      '';
+    };
    tablePrefix = mkOption {
      default = "wp_";
      description = ''
@ -251,7 +276,7 @@ in
        sleep 1
      done
      ${pkgs.mysql}/bin/mysql -e 'CREATE DATABASE ${config.dbName};'
-      ${pkgs.mysql}/bin/mysql -e 'GRANT ALL ON ${config.dbName}.* TO ${config.dbUser}@localhost IDENTIFIED BY "${config.dbPassword}";'
+      ${pkgs.mysql}/bin/mysql -e "GRANT ALL ON ${config.dbName}.* TO ${config.dbUser}@localhost IDENTIFIED BY \"$(cat ${config.dbPasswordFile})\";"
    else
      echo "Good, no need to do anything database related."
    fi
--- a/nixos/modules/services/web-servers/phpfpm/default.nix
+++ b/nixos/modules/services/web-servers/phpfpm/default.nix
@ -147,7 +147,6 @@ in {
          cfgFile = fpmCfgFile pool poolConfig;
        in {
          Slice = "phpfpm.slice";
-          PrivateTmp = true;
          PrivateDevices = true;
          ProtectSystem = "full";
          ProtectHome = true;
--- a/nixos/modules/services/x11/desktop-managers/enlightenment.nix
+++ b/nixos/modules/services/x11/desktop-managers/enlightenment.nix
@ -64,7 +64,7 @@ in
    security.wrappers.e_freqset.source = "${e.enlightenment.out}/bin/e_freqset";

    environment.etc = singleton
-      { source = "${pkgs.xkeyboard_config}/etc/X11/xkb";
+      { source = xcfg.xkbDir;
        target = "X11/xkb";
      };

--- a/nixos/modules/services/x11/desktop-managers/plasma5.nix
+++ b/nixos/modules/services/x11/desktop-managers/plasma5.nix
@ -176,7 +176,7 @@ in
      environment.pathsToLink = [ "/share" ];

      environment.etc = singleton {
-        source = "${pkgs.xkeyboard_config}/etc/X11/xkb";
+        source = xcfg.xkbDir;
        target = "X11/xkb";
      };

--- a/nixos/modules/tasks/network-interfaces-scripted.nix
+++ b/nixos/modules/tasks/network-interfaces-scripted.nix
@ -239,6 +239,10 @@ let
                ip link set "${i}" master "${n}"
                ip link set "${i}" up
              '')}
+              # Save list of enslaved interfaces
+              echo "${flip concatMapStrings v.interfaces (i: ''
+                ${i}
+              '')}" > /run/${n}.interfaces

              # Enable stp on the interface
              ${optionalString v.rstp ''
@ -250,7 +254,28 @@ let
            postStop = ''
              ip link set "${n}" down || true
              ip link del "${n}" || true
+              rm -f /run/${n}.interfaces
            '';
+            reload = ''
+              # Un-enslave child interfaces (old list of interfaces)
+              for interface in `cat /run/${n}.interfaces`; do
+                ip link set "$interface" nomaster up
+              done
+
+              # Enslave child interfaces (new list of interfaces)
+              ${flip concatMapStrings v.interfaces (i: ''
+                ip link set "${i}" master "${n}"
+                ip link set "${i}" up
+              '')}
+              # Save list of enslaved interfaces
+              echo "${flip concatMapStrings v.interfaces (i: ''
+                ${i}
+              '')}" > /run/${n}.interfaces
+
+              # (Un-)set stp on the bridge
+              echo ${if v.rstp then "2" else "0"} > /sys/class/net/${n}/bridge/stp_state
+            '';
+            reloadIfChanged = true;
          });

        createVswitchDevice = n: v: nameValuePair "${n}-netdev"
--- a/nixos/modules/tasks/network-interfaces-systemd.nix
+++ b/nixos/modules/tasks/network-interfaces-systemd.nix
@ -59,15 +59,16 @@ in
    systemd.network =
      let
        domains = cfg.search ++ (optional (cfg.domain != null) cfg.domain);
-        genericNetwork = override: {
-          DHCP = override (dhcpStr cfg.useDHCP);
-        } // optionalAttrs (cfg.defaultGateway != null) {
-          gateway = override [ cfg.defaultGateway.address ];
-        } // optionalAttrs (cfg.defaultGateway6 != null) {
-          gateway = override [ cfg.defaultGateway6.address ];
-        } // optionalAttrs (domains != [ ]) {
-          domains = override domains;
-        };
+        genericNetwork = override:
+          let gateway = optional (cfg.defaultGateway != null) cfg.defaultGateway.address
+            ++ optional (cfg.defaultGateway6 != null) cfg.defaultGateway6.address;
+          in {
+            DHCP = override (dhcpStr cfg.useDHCP);
+          } // optionalAttrs (gateway != [ ]) {
+            gateway = override gateway;
+          } // optionalAttrs (domains != [ ]) {
+            domains = override domains;
+          };
      in mkMerge [ {
        enable = true;
        networks."99-main" = genericNetwork mkDefault;
--- a/nixos/modules/virtualisation/google-compute-image.nix
+++ b/nixos/modules/virtualisation/google-compute-image.nix
@ -62,7 +62,7 @@ in

          mkdir -p /mnt/nix/store
          echo "copying everything (will take a while)..."
-          cp -prd $storePaths /mnt/nix/store/
+          ${pkgs.rsync}/bin/rsync -a $storePaths /mnt/nix/store/

          # Register the paths in the Nix database.
          printRegistration=1 perl ${pkgs.pathsFromGraph} /tmp/xchg/closure | \
@ -261,7 +261,7 @@ in
    "kernel.kptr_restrict" = mkDefault "1";

    # set ptrace protections
-    "kernel.yama.ptrace_scope" = mkDefault "1";
+    "kernel.yama.ptrace_scope" = mkOverride 500 "1";

    # set perf only available to root
    "kernel.perf_event_paranoid" = mkDefault "2";
--- a/nixos/modules/virtualisation/libvirtd.nix
+++ b/nixos/modules/virtualisation/libvirtd.nix
@ -90,14 +90,16 @@ in {

  config = mkIf cfg.enable {

-    environment.systemPackages =
-      [ pkgs.libvirt pkgs.netcat-openbsd ]
-       ++ optional cfg.enableKVM pkgs.qemu_kvm;
+    environment.systemPackages = with pkgs;
+      [ libvirt netcat-openbsd ]
+       ++ optional cfg.enableKVM qemu_kvm;

    boot.kernelModules = [ "tun" ];

    users.extraGroups.libvirtd.gid = config.ids.gids.libvirtd;

+    systemd.packages = [ pkgs.libvirt ];
+
    systemd.services.libvirtd = {
      description = "Libvirt Virtual Machine Management Daemon";

@ -105,13 +107,17 @@ in {
      after = [ "systemd-udev-settle.service" ]
              ++ optional vswitch.enable "vswitchd.service";

-      path = [
-          pkgs.bridge-utils
-          pkgs.dmidecode
-          pkgs.dnsmasq
-          pkgs.ebtables
+      environment = {
+        LIBVIRTD_ARGS = ''--config "${configFile}" ${concatStringsSep " " cfg.extraOptions}'';
+      };
+
+      path = with pkgs; [
+          bridge-utils
+          dmidecode
+          dnsmasq
+          ebtables
        ]
-        ++ optional cfg.enableKVM pkgs.qemu_kvm
+        ++ optional cfg.enableKVM qemu_kvm
        ++ optional vswitch.enable vswitch.package;

      preStart = ''
@ -153,13 +159,17 @@ in {
      ''; # */

      serviceConfig = {
-        ExecStart = ''@${pkgs.libvirt}/sbin/libvirtd libvirtd --config "${configFile}" ${concatStringsSep " " cfg.extraOptions}'';
        Type = "notify";
        KillMode = "process"; # when stopping, leave the VMs alone
        Restart = "on-failure";
      };
    };

+    systemd.services.libvirt-guests = {
+      wantedBy = [ "multi-user.target" ];
+      path = with pkgs; [ coreutils libvirt gawk ];
+    };
+
    systemd.sockets.virtlogd = {
      description = "Virtual machine log manager socket";
      wantedBy = [ "sockets.target" ];
--- a/nixos/modules/virtualisation/xen-dom0.nix
+++ b/nixos/modules/virtualisation/xen-dom0.nix
@ -29,7 +29,6 @@ in

    virtualisation.xen.package = mkOption {
      type = types.package;
-      default = pkgs.xen;
      defaultText = "pkgs.xen";
      example = literalExample "pkgs.xen-light";
      description = ''
@ -39,7 +38,6 @@ in

    virtualisation.xen.qemu = mkOption {
      type = types.path;
-      default = "${pkgs.xen}/lib/xen/bin/qemu-system-i386";
      defaultText = "\${pkgs.xen}/lib/xen/bin/qemu-system-i386";
      example = literalExample "''${pkgs.qemu_xen-light}/bin/qemu-system-i386";
      description = ''
@ -49,7 +47,6 @@ in

    virtualisation.xen.qemu-package = mkOption {
      type = types.package;
-      default = pkgs.xen;
      defaultText = "pkgs.xen";
      example = literalExample "pkgs.qemu_xen-light";
      description = ''
@ -136,6 +133,9 @@ in
      message = "Xen currently does not support EFI boot";
    } ];

+    virtualisation.xen.package = mkDefault pkgs.xen;
+    virtualisation.xen.qemu = mkDefault "${pkgs.xen}/lib/xen/bin/qemu-system-i386";
+    virtualisation.xen.qemu-package = mkDefault pkgs.xen;
    virtualisation.xen.stored = mkDefault "${cfg.package}/bin/oxenstored";

    environment.systemPackages = [ cfg.package ];
--- a/nixos/release-combined.nix
+++ b/nixos/release-combined.nix
@ -92,7 +92,7 @@ in rec {
        (all nixos.tests.openssh)
        (all nixos.tests.printing)
        (all nixos.tests.proxy)
-        (all nixos.tests.sddm)
+        (all nixos.tests.sddm.default)
        (all nixos.tests.simple)
        (all nixos.tests.udisks2)
        (all nixos.tests.xfce)
--- a/nixos/release.nix
+++ b/nixos/release.nix
@ -228,6 +228,7 @@ in rec {
  tests.containers-imperative = callTest tests/containers-imperative.nix {};
  tests.containers-extra_veth = callTest tests/containers-extra_veth.nix {};
  tests.containers-physical_interfaces = callTest tests/containers-physical_interfaces.nix {};
+  tests.containers-restart_networking = callTest tests/containers-restart_networking.nix {};
  tests.containers-tmpfs = callTest tests/containers-tmpfs.nix {};
  tests.containers-hosts = callTest tests/containers-hosts.nix {};
  tests.containers-macvlans = callTest tests/containers-macvlans.nix {};
@ -292,11 +293,11 @@ in rec {
  tests.printing = callTest tests/printing.nix {};
  tests.proxy = callTest tests/proxy.nix {};
  tests.pumpio = callTest tests/pump.io.nix {};
-  tests.quagga = callTest tests/quagga.nix {};
+  # tests.quagga = callTest tests/quagga.nix {};
  tests.quake3 = callTest tests/quake3.nix {};
  tests.runInMachine = callTest tests/run-in-machine.nix {};
  tests.samba = callTest tests/samba.nix {};
-  tests.sddm = callTest tests/sddm.nix {};
+  tests.sddm = callSubTests tests/sddm.nix {};
  tests.simple = callTest tests/simple.nix {};
  tests.smokeping = callTest tests/smokeping.nix {};
  tests.taskserver = callTest tests/taskserver.nix {};
--- a/nixos/tests/containers-restart_networking.nix
+++ b/nixos/tests/containers-restart_networking.nix
@ -0,0 +1,114 @@
+# Test for NixOS' container support.
+
+let
+  client_base = rec {
+    networking.firewall.enable = false;
+
+    containers.webserver = {
+      autoStart = true;
+      privateNetwork = true;
+      hostBridge = "br0";
+      config = {
+        networking.firewall.enable = false;
+        networking.firewall.allowPing = true;
+        networking.interfaces.eth0.ip4 = [
+          { address = "192.168.1.122"; prefixLength = 24; }
+        ];
+      };
+    };
+  };
+in import ./make-test.nix ({ pkgs, lib, ...} :
+{
+  name = "containers-restart_networking";
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ kampfschlaefer ];
+  };
+
+  nodes = {
+    client = { lib, pkgs, ... }: client_base // {
+      virtualisation.vlans = [ 1 ];
+
+      networking.bridges.br0 = {
+        interfaces = [];
+        rstp = false;
+      };
+      networking.interfaces = {
+        eth1.ip4 = lib.mkOverride 0 [ ];
+        br0.ip4 = [{ address = "192.168.1.1"; prefixLength = 24; }];
+      };
+
+    };
+    client_eth1 = { lib, pkgs, ... }: client_base // {
+      networking.bridges.br0 = {
+        interfaces = [ "eth1" ];
+        rstp = false;
+      };
+      networking.interfaces = {
+        eth1.ip4 = lib.mkOverride 0 [ ];
+        br0.ip4 = [{ address = "192.168.1.2"; prefixLength = 24; }];
+      };
+    };
+    client_eth1_rstp = { lib, pkgs, ... }: client_base // {
+      networking.bridges.br0 = {
+        interfaces = [ "eth1" ];
+        rstp = true;
+      };
+      networking.interfaces = {
+        eth1.ip4 = lib.mkOverride 0 [ ];
+        br0.ip4 = [{ address = "192.168.1.2"; prefixLength = 24; }];
+      };
+    };
+  };
+
+  testScript = {nodes, ...}: let
+    originalSystem = nodes.client.config.system.build.toplevel;
+    eth1_bridged = nodes.client_eth1.config.system.build.toplevel;
+    eth1_rstp = nodes.client_eth1_rstp.config.system.build.toplevel;
+  in ''
+    $client->start();
+
+    $client->waitForUnit("default.target");
+
+    subtest "initial state", sub {
+      $client->succeed("ping 192.168.1.122 -c 1 -n >&2");
+      $client->succeed("nixos-container run webserver -- ping -c 1 -n 192.168.1.1 >&2");
+
+      $client->fail("ip l show eth1 |grep \"master br0\" >&2");
+      $client->fail("grep eth1 /run/br0.interfaces >&2");
+    };
+
+    subtest "interfaces without stp", sub {
+      $client->succeed("${eth1_bridged}/bin/switch-to-configuration test >&2");
+
+      $client->succeed("ping 192.168.1.122 -c 1 -n >&2");
+      $client->succeed("nixos-container run webserver -- ping -c 1 -n 192.168.1.2 >&2");
+
+      $client->succeed("ip l show eth1 |grep \"master br0\" >&2");
+      $client->succeed("grep eth1 /run/br0.interfaces >&2");
+    };
+
+    # activating rstp needs another service, therefor the bridge will restart and the container will loose its connectivity
+    #subtest "interfaces with rstp", sub {
+    #  $client->succeed("${eth1_rstp}/bin/switch-to-configuration test >&2");
+    #  $client->execute("ip -4 a >&2");
+    #  $client->execute("ip l >&2");
+    #
+    #  $client->succeed("ping 192.168.1.122 -c 1 -n >&2");
+    #  $client->succeed("nixos-container run webserver -- ping -c 1 -n 192.168.1.2 >&2");
+    #
+    #  $client->succeed("ip l show eth1 |grep \"master br0\" >&2");
+    #  $client->succeed("grep eth1 /run/br0.interfaces >&2");
+    #};
+
+    subtest "back to no interfaces and no stp", sub {
+      $client->succeed("${originalSystem}/bin/switch-to-configuration test >&2");
+
+      $client->succeed("ping 192.168.1.122 -c 1 -n >&2");
+      $client->succeed("nixos-container run webserver -- ping -c 1 -n 192.168.1.1 >&2");
+
+      $client->fail("ip l show eth1 |grep \"master br0\" >&2");
+      $client->fail("grep eth1 /run/br0.interfaces >&2");
+    };
+  '';
+
+})
--- a/nixos/tests/dnscrypt-proxy.nix
+++ b/nixos/tests/dnscrypt-proxy.nix
@ -15,6 +15,7 @@ import ./make-test.nix ({ pkgs, ... }: {

      services.dnscrypt-proxy.enable = true;
      services.dnscrypt-proxy.localPort = localProxyPort;
+      services.dnscrypt-proxy.extraArgs = [ "-X libdcplugin_example.so" ];

      services.dnsmasq.enable = true;
      services.dnsmasq.servers = [ "127.0.0.1#${toString localProxyPort}" ];
--- a/nixos/tests/gnome3-gdm.nix
+++ b/nixos/tests/gnome3-gdm.nix
@ -11,6 +11,7 @@ import ./make-test.nix ({ pkgs, ...} : {

      services.xserver.enable = true;

+      services.xserver.displayManager.slim.enable = false;
      services.xserver.displayManager.gdm = {
        enable = true;
        autoLogin = {
--- a/nixos/tests/plasma5.nix
+++ b/nixos/tests/plasma5.nix
@ -8,25 +8,27 @@ import ./make-test.nix ({ pkgs, ...} :

  machine = { lib, ... }: {
    imports = [ ./common/user-account.nix ];
-    virtualisation.memorySize = 1024;
    services.xserver.enable = true;
-    services.xserver.displayManager.sddm = {
-      enable = true;
-      autoLogin = {
-        enable = true;
-        user = "alice";
-      };
-    };
+    services.xserver.displayManager.sddm.enable = true;
    services.xserver.desktopManager.plasma5.enable = true;
    services.xserver.desktopManager.default = "plasma5";
-    virtualisation.writableStore = false; # FIXME
+    virtualisation.memorySize = 1024;
  };

-  testScript = { nodes, ... }:
-  let xdo = "${pkgs.xdotool}/bin/xdotool"; in
-   ''
+  enableOCR = true;
+
+  testScript = { nodes, ... }: let
+    user = nodes.machine.config.users.extraUsers.alice;
+    xdo = "${pkgs.xdotool}/bin/xdotool";
+  in ''
    startAll;

+    # Wait for display manager to start
+    $machine->waitForText(qr/${user.description}/);
+    $machine->screenshot("sddm");
+
+    # Log in
+    $machine->sendChars("${user.password}\n");
    $machine->waitForFile("/home/alice/.Xauthority");
    $machine->succeed("xauth merge ~alice/.Xauthority");

--- a/nixos/tests/sddm.nix
+++ b/nixos/tests/sddm.nix
@ -1,28 +1,66 @@
-import ./make-test.nix ({ pkgs, ...} : {
-  name = "sddm";
-  meta = with pkgs.stdenv.lib.maintainers; {
-    maintainers = [ ttuegel ];
-  };
+{ system ? builtins.currentSystem }:

-  machine = { lib, ... }: {
-    imports = [ ./common/user-account.nix ];
-    services.xserver.enable = true;
-    services.xserver.displayManager.sddm = {
-      enable = true;
-      autoLogin = {
-        enable = true;
-        user = "alice";
+with import ../lib/testing.nix { inherit system; };
+
+let
+  inherit (pkgs) lib;
+
+  tests = {
+    default = {
+      name = "sddm";
+
+      machine = { lib, ... }: {
+        imports = [ ./common/user-account.nix ];
+        services.xserver.enable = true;
+        services.xserver.displayManager.sddm.enable = true;
+        services.xserver.windowManager.default = "icewm";
+        services.xserver.windowManager.icewm.enable = true;
+        services.xserver.desktopManager.default = "none";
      };
-    };
-    services.xserver.windowManager.default = "icewm";
-    services.xserver.windowManager.icewm.enable = true;
-    services.xserver.desktopManager.default = "none";
-  };

-  testScript = { nodes, ... }: ''
-    startAll;
-    $machine->waitForFile("/home/alice/.Xauthority");
-    $machine->succeed("xauth merge ~alice/.Xauthority");
-    $machine->waitForWindow("^IceWM ");
-  '';
-})
+      enableOCR = true;
+
+      testScript = { nodes, ... }: let
+        user = nodes.machine.config.users.extraUsers.alice;
+      in ''
+        startAll;
+        $machine->waitForText(qr/ALICE/);
+        $machine->screenshot("sddm");
+        $machine->sendChars("${user.password}\n");
+        $machine->waitForFile("/home/alice/.Xauthority");
+        $machine->succeed("xauth merge ~alice/.Xauthority");
+        $machine->waitForWindow("^IceWM ");
+      '';
+    };
+
+    autoLogin = {
+      name = "sddm-autologin";
+      meta = with pkgs.stdenv.lib.maintainers; {
+        maintainers = [ ttuegel ];
+      };
+
+      machine = { lib, ... }: {
+        imports = [ ./common/user-account.nix ];
+        services.xserver.enable = true;
+        services.xserver.displayManager.sddm = {
+          enable = true;
+          autoLogin = {
+            enable = true;
+            user = "alice";
+          };
+        };
+        services.xserver.windowManager.default = "icewm";
+        services.xserver.windowManager.icewm.enable = true;
+        services.xserver.desktopManager.default = "none";
+      };
+
+      testScript = { nodes, ... }: ''
+        startAll;
+        $machine->waitForFile("/home/alice/.Xauthority");
+        $machine->succeed("xauth merge ~alice/.Xauthority");
+        $machine->waitForWindow("^IceWM ");
+      '';
+    };
+  };
+in
+  lib.mapAttrs (lib.const makeTest) tests
--- a/nixos/tests/virtualbox.nix
+++ b/nixos/tests/virtualbox.nix
@ -65,7 +65,7 @@ let
      touch /mnt-root/boot-done
      hostname "${vmName}"
      mkdir -p /nix/store
-      unshare -m "@shell@" -c '
+      unshare -m ${escapeShellArg pkgs.stdenv.shell} -c '
        mount -t vboxsf nixstore /nix/store
        exec "$stage2Init"
      '
--- a/pkgs/applications/altcoins/bitcoin-classic.nix
+++ b/pkgs/applications/altcoins/bitcoin-classic.nix
@ -1,20 +1,24 @@
-{ stdenv, fetchurl, pkgconfig, autoreconfHook, openssl, db48, boost
-, zlib, miniupnpc, qt4, utillinux, protobuf, qrencode
+{ stdenv, fetchFromGitHub, pkgconfig, autoreconfHook, openssl, db48, boost
+, zlib, miniupnpc, qt4, utillinux, protobuf, qrencode, libevent
 , withGui }:

 with stdenv.lib;
+
 stdenv.mkDerivation rec {

  name = "bitcoin" + (toString (optional (!withGui) "d")) + "-classic-" + version;
-  version = "0.11.2.cl1.b1";
+  version = "1.2.3";

-  src = fetchurl {
-    url = "https://github.com/bitcoinclassic/bitcoinclassic/archive/v${version}.tar.gz";
-    sha256 = "1szsnx5aijk3hx7qkqzbqsr0basg8ydwp20mh3bhnf4ljryy2049";
+  src = fetchFromGitHub {
+    owner = "bitcoinclassic";
+    repo = "bitcoinclassic";
+    rev = "v${version}";
+    sha256 = "0y99c8zv42ps3pxp46p3fqj9sir580v7s5qyi3cxva12mq2z0cql";
  };

-  buildInputs = [ pkgconfig autoreconfHook openssl db48 boost zlib
-                  miniupnpc utillinux protobuf ]
+  nativeBuildInputs = [ pkgconfig autoreconfHook ];
+  buildInputs = [ openssl db48 boost zlib
+                  miniupnpc utillinux protobuf libevent ]
                  ++ optionals withGui [ qt4 qrencode ];

  configureFlags = [ "--with-boost-libdir=${boost.out}/lib" ]
@ -35,7 +39,7 @@ stdenv.mkDerivation rec {
      continue to release updates that are in line with Satoshi’s whitepaper &
      vision, and are agreed upon by the community.
    '';
-    homepage = "https://bitcoinclassic.com/";
+    homepage = https://bitcoinclassic.com/;
    maintainers = with maintainers; [ jefdaj ];
    license = licenses.mit;
    platforms = platforms.unix;
--- a/pkgs/applications/altcoins/default.nix
+++ b/pkgs/applications/altcoins/default.nix
@ -16,6 +16,7 @@ rec {
  dogecoin  = callPackage ./dogecoin.nix { withGui = true; };
  dogecoind = callPackage ./dogecoin.nix { withGui = false; };

+  freicoin = callPackage ./freicoin.nix { boost = pkgs.boost155; };
  go-ethereum = callPackage ./go-ethereum.nix { };

  litecoin  = callPackage ./litecoin.nix { withGui = true; };
@ -33,5 +34,4 @@ rec {
  primecoind = callPackage ./primecoin.nix { withGui = false; };

  stellar-core = callPackage ./stellar-core.nix { };
-
 }
--- a/pkgs/applications/altcoins/freicoin.nix
+++ b/pkgs/applications/altcoins/freicoin.nix
@ -0,0 +1,32 @@
+{ fetchFromGitHub, stdenv, db, boost, gmp, mpfr, miniupnpc, qt4, qmake4Hook, unzip }:
+
+stdenv.mkDerivation rec {
+  version = "0.8.6-2";
+  name = "freicoin-${version}";
+
+  src = fetchFromGitHub {
+    owner = "freicoin";
+    repo = "freicoin";
+    rev = "v${version}";
+    sha256 = "1m5pcnfhwhcj7q00p2sy3h73rkdm3w6grmljgiq53gshcj08cq1z";
+  };
+
+  # I think that openssl and zlib are required, but come through other
+  # packages
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp freicoin-qt $out/bin
+    '';
+
+  nativeBuildInputs = [ qmake4Hook ];
+  buildInputs = [ db boost gmp mpfr miniupnpc qt4 ];
+
+  meta = with stdenv.lib; {
+    description = "Peer-to-peer currency with demurrage fee";
+    homepage = http://freicoi.in/;
+    license = licenses.mit;
+    maintainers = [ maintainers.viric ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/audio/drumgizmo/default.nix
+++ b/pkgs/applications/audio/drumgizmo/default.nix
@ -3,12 +3,12 @@
 }:

 stdenv.mkDerivation rec {
-  version = "0.9.11";
+  version = "0.9.12";
  name = "drumgizmo-${version}";

  src = fetchurl {
    url = "http://www.drumgizmo.org/releases/${name}/${name}.tar.gz";
-    sha256 = "04hf3nhccwr98n2081rrvfccz50nly6k3gbk9zxccp1522qz5xvf";
+    sha256 = "0kqrss9v3vpznmh4jgi3783wmprr645s3i485jlvdscpysjfkh6z";
  };

  configureFlags = [ "--enable-lv2" ];
--- a/pkgs/applications/audio/drumkv1/default.nix
+++ b/pkgs/applications/audio/drumkv1/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name = "drumkv1-${version}";
-  version = "0.8.0";
+  version = "0.8.1";

  src = fetchurl {
    url = "mirror://sourceforge/drumkv1/${name}.tar.gz";
-    sha256 = "1n2kd468kn71yp2asmamprvblmdlvh0zd8lsh3598dwi4b7aa3ga";
+    sha256 = "0l6kjb1q9vslwy56836a0c65mf8z8ycam5vzz3k4qvd8g74bs1zq";
  };

  buildInputs = [ libjack2 alsaLib libsndfile liblo lv2 qt5.qtbase qt5.qttools ];
--- a/pkgs/applications/audio/musescore/default.nix
+++ b/pkgs/applications/audio/musescore/default.nix
@ -56,5 +56,6 @@ stdenv.mkDerivation rec {
    platforms = platforms.linux;
    maintainers = [ maintainers.vandenoever ];
    repositories.git = https://github.com/musescore/MuseScore;
+    broken = true;
  };
 }
--- a/pkgs/applications/audio/non/default.nix
+++ b/pkgs/applications/audio/non/default.nix
@ -4,12 +4,12 @@

 stdenv.mkDerivation rec {
  name = "non-${version}";
-  version = "2016-12-07";
+  version = "2017-03-29";
  src = fetchFromGitHub {
    owner = "original-male";
    repo = "non";
-    rev = "754d113b0e3144a145d50bde8370ff2cae98169c";
-    sha256 = "04h67vy966vys6krgjsxd7dph4z46r8c6maw1hascxlasy3bhhk0";
+    rev = "10c31e57291b6e42be53371567a722b62b32d220";
+    sha256 = "080rha4ffp7qycyg1mqcf4vj0s7z8qfvz6bxm0w29xgg2kkmb3fx";
  };

  buildInputs = [ pkgconfig python2 cairo libjpeg ntk libjack2 libsndfile
--- a/pkgs/applications/audio/spotify/default.nix
+++ b/pkgs/applications/audio/spotify/default.nix
@ -8,7 +8,7 @@ let
  # Please update the stable branch!
  # Latest version number can be found at:
  # http://repository-origin.spotify.com/pool/non-free/s/spotify-client/
-  version = "1.0.49.125.g72ee7853-111";
+  version = "1.0.52.717.g2f08534a-47";

  deps = [
    alsaLib
@ -42,6 +42,7 @@ let
    xorg.libXrender
    xorg.libXScrnSaver
    xorg.libXtst
+    xorg.libxcb
    zlib
  ];

@ -53,7 +54,7 @@ stdenv.mkDerivation {
  src =
    fetchurl {
      url = "https://repository-origin.spotify.com/pool/non-free/s/spotify-client/spotify-client_${version}_amd64.deb";
-      sha256 = "0l008x06d257vcw6gq3q90hvv93cq6mxpj11by1np6bzzg61qv8x";
+      sha256 = "1xqd4pjb69zmbac5fq3pckgr4khlkzfkx8b029qzjc2hi52zfnj7";
    };

  buildInputs = [ dpkg makeWrapper ];
--- a/pkgs/applications/display-managers/sddm/default.nix
+++ b/pkgs/applications/display-managers/sddm/default.nix
@ -29,10 +29,9 @@ let

    buildInputs = [
      libxcb libpthreadstubs libXdmcp libXau pam systemd
-      qtbase qtdeclarative
    ];

-    propagatedUserEnvPkgs = builtins.map lib.getBin [
+    propagatedBuildInputs = [
      qtbase qtdeclarative
    ];

@ -98,6 +97,7 @@ stdenv.mkDerivation {
      addToSearchPath RUNTIME_XDG_CONFIG_DIRS "$pkg/etc/xdg"
    done

+    mkdir -p "$out/bin"
    makeQtWrapper "$unwrapped/bin/sddm" "$out/bin/sddm"

    mkdir -p "$out/share/sddm"
--- a/pkgs/applications/editors/codeblocks/default.nix
+++ b/pkgs/applications/editors/codeblocks/default.nix
@ -1,20 +1,21 @@
-{ stdenv, fetchurl, autoconf, automake, libtool, pkgconfig, file, zip, wxGTK, gtk2
+{ stdenv, fetchurl, autoreconfHook, libtool, pkgconfig, file, zip, wxGTK, gtk2
 , contribPlugins ? false, hunspell, gamin, boost
 }:

-with { inherit (stdenv.lib) optionalString optional optionals; };
+with stdenv.lib;

 stdenv.mkDerivation rec {
  name = "${pname}-${stdenv.lib.optionalString contribPlugins "full-"}${version}";
-  version = "13.12";
+  version = "16.01";
  pname = "codeblocks";

  src = fetchurl {
-    url = "mirror://sourceforge/codeblocks/Sources/${version}/codeblocks_${version}-1.tar.gz";
-    sha256 = "044njhps4cm1ijfdyr5f9wjyd0vblhrz9b4603ma52wcdq25093p";
+    url = "mirror://sourceforge/codeblocks/Sources/${version}/codeblocks_${version}.tar.gz";
+    sha256 = "00sskm91r20ywydwqwx6v7z3nwn9lyh5297c5wp3razldlh9vyrh";
  };

-  buildInputs = [ automake autoconf libtool pkgconfig file zip wxGTK gtk2 ]
+  nativeBuildInputs = [ autoreconfHook pkgconfig libtool file zip ];
+  buildInputs = [ wxGTK gtk2 ]
    ++ optionals contribPlugins [ hunspell gamin boost ];
  enableParallelBuilding = true;
  patches = [ ./writable-projects.patch ];
@ -25,9 +26,9 @@ stdenv.mkDerivation rec {

  # Fix boost 1.59 compat
  # Try removing in the next version
-  CPPFLAGS = "-DBOOST_ERROR_CODE_HEADER_ONLY -DBOOST_SYSTEM_NO_DEPRECATED";
+  #CPPFLAGS = "-DBOOST_ERROR_CODE_HEADER_ONLY -DBOOST_SYSTEM_NO_DEPRECATED";

-  meta = with stdenv.lib; {
+  meta = {
    maintainers = [ maintainers.linquize ];
    platforms = platforms.all;
    description = "The open source, cross platform, free C, C++ and Fortran IDE";
--- a/pkgs/applications/editors/emacs-modes/elpa-generated.nix
+++ b/pkgs/applications/editors/emacs-modes/elpa-generated.nix
@ -358,15 +358,14 @@
          license = lib.licenses.free;
        };
      }) {};
-    company = callPackage ({ cl-lib ? null, elpaBuild, emacs, fetchurl, lib }:
-    elpaBuild {
+    company = callPackage ({ elpaBuild, emacs, fetchurl, lib }: elpaBuild {
        pname = "company";
-        version = "0.9.2";
+        version = "0.9.3";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/company-0.9.2.tar";
-          sha256 = "10divixs06gq9nm8s8x0q12ir07y27d06l52ix2dn84zvj853z4z";
+          url = "https://elpa.gnu.org/packages/company-0.9.3.tar";
+          sha256 = "1b38najmah4s2smxslik6wbdvb0x77rm6fv45pcq5x5aaiplh5ap";
        };
-        packageRequires = [ cl-lib emacs ];
+        packageRequires = [ emacs ];
        meta = {
          homepage = "https://elpa.gnu.org/packages/company.html";
          license = lib.licenses.free;
@ -821,10 +820,10 @@
    gnorb = callPackage ({ cl-lib ? null, elpaBuild, fetchurl, lib }:
    elpaBuild {
        pname = "gnorb";
-        version = "1.1.5";
+        version = "1.2.1";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/gnorb-1.1.5.tar";
-          sha256 = "128ag8zkfxspf6szxfd7dcscm1zzzcibx7p9dpbpk036cr7m5i1p";
+          url = "https://elpa.gnu.org/packages/gnorb-1.2.1.tar";
+          sha256 = "0mip0czvpdl26xz9wamii5azj9bacjhdg0jgkrxyv17vqqlbag9x";
        };
        packageRequires = [ cl-lib ];
        meta = {
--- a/pkgs/applications/editors/emacs-modes/melpa-generated.nix
+++ b/pkgs/applications/editors/emacs-modes/melpa-generated.nix
--- a/pkgs/applications/editors/emacs-modes/melpa-stable-generated.nix
+++ b/pkgs/applications/editors/emacs-modes/melpa-stable-generated.nix
@ -860,6 +860,27 @@
          license = lib.licenses.free;
        };
      }) {};
+    add-node-modules-path = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
+    melpaBuild {
+        pname = "add-node-modules-path";
+        version = "1.0.0";
+        src = fetchFromGitHub {
+          owner = "codesuki";
+          repo = "add-node-modules-path";
+          rev = "9ed240e05dcb9628ba380151b54b02688be5e78e";
+          sha256 = "0avv3ypdpscchq9n1lxs0ba0fc52zjyv7dbv54s7sclqxx4mi63k";
+        };
+        recipeFile = fetchurl {
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/63e99d8fc0678d7b1831cae8940e9e6547780861/recipes/add-node-modules-path";
+          sha256 = "0gbl875fgqr5np6r4cs8njs6fil1qmy8a5wir88x78ybdwwxsmbl";
+          name = "add-node-modules-path";
+        };
+        packageRequires = [];
+        meta = {
+          homepage = "https://melpa.org/#/add-node-modules-path";
+          license = lib.licenses.free;
+        };
+      }) {};
    adoc-mode = callPackage ({ fetchFromGitHub, fetchurl, lib, markup-faces, melpaBuild }:
    melpaBuild {
        pname = "adoc-mode";
@ -1166,12 +1187,12 @@
    android-mode = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "android-mode";
-        version = "0.4.0";
+        version = "0.5.0";
        src = fetchFromGitHub {
          owner = "remvee";
          repo = "android-mode";
-          rev = "146476c5ae958715520bec2b7f8de6b30c48c19f";
-          sha256 = "0gjynmzqlqz0d57fb4np6xrklqdn11y4vjbm18rlpvmk92bgw740";
+          rev = "f274da87429617b0b9c5889d46b36de64d982da4";
+          sha256 = "17m4hp2qb54widwadv23amc1lasnbwzh2ipc6180fnajg8zcbvyw";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/77633aa340803a433570327943fbe31b396f4355/recipes/android-mode";
@ -1480,12 +1501,12 @@
    anything-tramp = callPackage ({ anything, emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "anything-tramp";
-        version = "0.2";
+        version = "0.3.2";
        src = fetchFromGitHub {
          owner = "masasam";
          repo = "emacs-anything-tramp";
-          rev = "75df15ac263701f921649fefb29f03f6b7d49b9f";
-          sha256 = "0al2k5az5x6idnhkhckjxr4vh52f0n9fi20ranwid9ac8k6kspvz";
+          rev = "ca9d94c2a55c3cbbcc77b6818cc386dbd2f36d39";
+          sha256 = "0j1fm1ngd9vg3qrv9ks53ha9aijnl6mvx2sxsvlvn1libg7ym3zz";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/bf5be5351cb187dff8388865ac424f8e5be71639/recipes/anything-tramp";
@ -2452,12 +2473,12 @@
    beginend = callPackage ({ emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "beginend";
-        version = "1.0.0";
+        version = "1.1.0";
        src = fetchFromGitHub {
          owner = "DamienCassou";
          repo = "beginend";
-          rev = "de3833a1a651532e76df668bd92cfa07893501f1";
-          sha256 = "1agrci37bni1vfkxg171l53fvsnjdryhf05v54wj07jngnwf3cw9";
+          rev = "9c6ad190ecc71373f6ac7485c924f1ef3dce6fc4";
+          sha256 = "05z23amn1s1692y3wzwmbzpnm5m6qskq53aqp47wiyyxn3dq2kdj";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/31c1157d4fd9e47a780bbd91075252acdc7899dd/recipes/beginend";
@ -2764,22 +2785,22 @@
          license = lib.licenses.free;
        };
      }) {};
-    boxquote = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
+    boxquote = callPackage ({ cl-lib ? null, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "boxquote";
-        version = "1.22";
+        version = "2.0";
        src = fetchFromGitHub {
          owner = "davep";
          repo = "boxquote.el";
-          rev = "4c49b2046647ed187920c885e175ed388f4833dc";
-          sha256 = "0235l4f1cxj7nysfnay4fz52mg0c13pzqxbhw65vdpfzz1gl1p73";
+          rev = "b0239fb7b7a9d75d4ac3c66f9b96abd911dbf4e0";
+          sha256 = "0agnsghxf35b6g49radxigw81bmvw1ggljzzmy771nmwl44q2dbb";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/d2148f8f17b16154bfc337df69a5ad31e25a9b05/recipes/boxquote";
          sha256 = "0s6cxb8y1y8w9vxxhj1izs8d0gzk4z2zm0cm9gkw1h7k2kyggx6s";
          name = "boxquote";
        };
-        packageRequires = [];
+        packageRequires = [ cl-lib ];
        meta = {
          homepage = "https://melpa.org/#/boxquote";
          license = lib.licenses.free;
@ -3061,12 +3082,12 @@
    buttercup = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "buttercup";
-        version = "1.5";
+        version = "1.6";
        src = fetchFromGitHub {
          owner = "jorgenschaefer";
          repo = "emacs-buttercup";
-          rev = "657acef2132a6fdf0796f8ec62c5f261c1beebf0";
-          sha256 = "0wkivh8x75gfsks6hy1ps9mlk101hrwsk8hqxx7qhs7f5iv0a082";
+          rev = "c95b95fe8d93eeed510c281990842718a21e53b3";
+          sha256 = "077hxzichvr406m9grdxjf31k0l33g6wh9zdvx73f7crsmzxhkzy";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/d4b187cb5b3cc5b546bfa6b94b6792e6363242d1/recipes/buttercup";
@ -4185,12 +4206,12 @@
    cmake-mode = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "cmake-mode";
-        version = "3.8.0pre2";
+        version = "3.8.0pre3";
        src = fetchFromGitHub {
          owner = "Kitware";
          repo = "CMake";
-          rev = "e1adec32b8325fb731da084e99acd6070f5e39bf";
-          sha256 = "08illrxn9jks2z8yj7kczy65k7q3dkifima6j706kz8vjza60ikm";
+          rev = "3b7f19a72ff2216b4613fdc8c5edf5d56e74d6fc";
+          sha256 = "0da0ywk6bxr78hiy34m7yf0fwvir2v2hvdmspai8n8kcnlcinkyw";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/598723893ae4bc2e60f527a072efe6ed9d4e2488/recipes/cmake-mode";
@ -4434,22 +4455,22 @@
          license = lib.licenses.free;
        };
      }) {};
-    company = callPackage ({ cl-lib ? null, emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
+    company = callPackage ({ emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "company";
-        version = "0.9.2";
+        version = "0.9.3";
        src = fetchFromGitHub {
          owner = "company-mode";
          repo = "company-mode";
-          rev = "c9912e9ba7ef441677c1a9de7e14f78cb2da5e0e";
-          sha256 = "1jc9mnqj38lnn3yxkcixlwgqkxb7lsyzqybakk74mh3l3gr9cv8k";
+          rev = "f1499404163d8148e7a6303a8598f9c0f696d1cb";
+          sha256 = "1ncfvf6ndqnn95m02ij66l7674h7chzgwg2r9biymqadzxjxim9i";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/96e7b4184497d0d0db532947f2801398b72432e4/recipes/company";
          sha256 = "0v4x038ly970lkzb0n8fbqssfqwx1p46xldr7nss32jiqvavr4m4";
          name = "company";
        };
-        packageRequires = [ cl-lib emacs ];
+        packageRequires = [ emacs ];
        meta = {
          homepage = "https://melpa.org/#/company";
          license = lib.licenses.free;
@ -4968,12 +4989,12 @@
    company-ycmd = callPackage ({ company, dash, deferred, f, fetchFromGitHub, fetchurl, let-alist, lib, melpaBuild, s, ycmd }:
    melpaBuild {
        pname = "company-ycmd";
-        version = "1.0";
+        version = "1.1";
        src = fetchFromGitHub {
          owner = "abingham";
          repo = "emacs-ycmd";
-          rev = "be21ca7f807e70812b6fc0e0a4ea83b41723d815";
-          sha256 = "1q30k8rhk3plknkk544h2dk48yqmxwh4xp3rq1lz8isc3580qwxx";
+          rev = "9f5ad4a20e6bf893491635108adfff71f3c6b590";
+          sha256 = "08kvbvhx5y3239bzdb1xpr81lfrhjy9xka4kn9dpa5bdxs0xx92w";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/1138c8cc239183a2435ce8c1a6df5163e5fed2ea/recipes/company-ycmd";
@ -7076,8 +7097,8 @@
        version = "0.7";
        src = fetchhg {
          url = "https://bitbucket.com/harsman/dyalog-mode";
-          rev = "c4f10d72febc";
-          sha256 = "0x9h38vs5vnvswp3dm3i2pdzw8rvqwxpsfpsjx7r84bww9nr9dyd";
+          rev = "6f4b44fb1966";
+          sha256 = "10d69aah8kq5ln3rcd2vcdck1vvqq5x47kk0bk4vpphh26j14jjp";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/5b7972602399f9df9139cff177e38653bb0f43ed/recipes/dyalog-mode";
@ -7258,6 +7279,27 @@
          license = lib.licenses.free;
        };
      }) {};
+    easy-hugo = callPackage ({ emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
+    melpaBuild {
+        pname = "easy-hugo";
+        version = "0.4.1";
+        src = fetchFromGitHub {
+          owner = "masasam";
+          repo = "emacs-easy-hugo";
+          rev = "8e8dde2ce96c9bf561bffa1ee0886cf9b87db370";
+          sha256 = "13jf3rps8s54pyxnmxdrxmza5jnyhzcixmqqw4vp4br3kay7lbrz";
+        };
+        recipeFile = fetchurl {
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/544fa512dc3e6379f451fd9b596d74a5849c87d2/recipes/easy-hugo";
+          sha256 = "07pa48rv5aqpz7fwkbc48scvnvnvg1v3qkapn2h1qllfc0h2nn5i";
+          name = "easy-hugo";
+        };
+        packageRequires = [ emacs ];
+        meta = {
+          homepage = "https://melpa.org/#/easy-hugo";
+          license = lib.licenses.free;
+        };
+      }) {};
    easy-kill = callPackage ({ cl-lib ? null, emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "easy-kill";
@ -7366,12 +7408,12 @@
    ebib = callPackage ({ dash, emacs, fetchFromGitHub, fetchurl, lib, melpaBuild, parsebib, seq }:
    melpaBuild {
        pname = "ebib";
-        version = "2.10.1";
+        version = "2.10.2";
        src = fetchFromGitHub {
          owner = "joostkremers";
          repo = "ebib";
-          rev = "d415b91c91581ff39364384fec35c219cb89d43a";
-          sha256 = "13283ymm4av2gk7zj2rsppg6sk0lixy9g4lic4arrm8b5yb0vcsd";
+          rev = "558097220099505994b7e9a2ea9e1208da6c5668";
+          sha256 = "1v9x69jzsfl7kh5nnbax218xykylz6ib0f73f9yrsjbmgap3fvva";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/4e39cd8e8b4f61c04fa967def6a653bb22f45f5b/recipes/ebib";
@ -11528,12 +11570,12 @@
    flycheck-package = callPackage ({ fetchFromGitHub, fetchurl, flycheck, lib, melpaBuild, package-lint }:
    melpaBuild {
        pname = "flycheck-package";
-        version = "0.11";
+        version = "0.12";
        src = fetchFromGitHub {
          owner = "purcell";
          repo = "flycheck-package";
-          rev = "cf561bf9896d3e7b6bdcdb7801de6cb9f548b573";
-          sha256 = "124ahlxpkcb5mcndmg8k8rdxx0piis6372zllxk6ywmgxz9mlgy1";
+          rev = "afe8a49343d90d08ee72ac6f993d424dcc39cc38";
+          sha256 = "19pz8h01yacfqsyh5940pam6vigvavsqg6qd84994d7mmzl534qa";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/d17ec69c9f192625e74dfadf03b11d0d7dc575e7/recipes/flycheck-package";
@ -11714,15 +11756,36 @@
          license = lib.licenses.free;
        };
      }) {};
+    flycheck-yamllint = callPackage ({ fetchFromGitHub, fetchurl, flycheck, lib, melpaBuild }:
+    melpaBuild {
+        pname = "flycheck-yamllint";
+        version = "0.1.0";
+        src = fetchFromGitHub {
+          owner = "krzysztof-magosa";
+          repo = "flycheck-yamllint";
+          rev = "aa211b1243168a4f752888c0014c5b9d2da178b1";
+          sha256 = "1dg2lymb53vp16isdc6k0gq1a43h7vjpksbacskyd4nwmsxaf2bm";
+        };
+        recipeFile = fetchurl {
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/932ee0a1f13a52d53102b90911da79145208cbb5/recipes/flycheck-yamllint";
+          sha256 = "1q2sy0hsbnwdlwq99wk8n5gi9fd8bs4jvi859np8bylbhhb3kj8m";
+          name = "flycheck-yamllint";
+        };
+        packageRequires = [ flycheck ];
+        meta = {
+          homepage = "https://melpa.org/#/flycheck-yamllint";
+          license = lib.licenses.free;
+        };
+      }) {};
    flycheck-ycmd = callPackage ({ dash, emacs, fetchFromGitHub, fetchurl, flycheck, let-alist, lib, melpaBuild, ycmd }:
    melpaBuild {
        pname = "flycheck-ycmd";
-        version = "1.0";
+        version = "1.1";
        src = fetchFromGitHub {
          owner = "abingham";
          repo = "emacs-ycmd";
-          rev = "be21ca7f807e70812b6fc0e0a4ea83b41723d815";
-          sha256 = "1q30k8rhk3plknkk544h2dk48yqmxwh4xp3rq1lz8isc3580qwxx";
+          rev = "9f5ad4a20e6bf893491635108adfff71f3c6b590";
+          sha256 = "08kvbvhx5y3239bzdb1xpr81lfrhjy9xka4kn9dpa5bdxs0xx92w";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/332e5585963c04112a55894fe7151c380930b17c/recipes/flycheck-ycmd";
@ -15070,12 +15133,12 @@
    helm = callPackage ({ async, emacs, fetchFromGitHub, fetchurl, helm-core, lib, melpaBuild, popup }:
    melpaBuild {
        pname = "helm";
-        version = "2.5.3";
+        version = "2.5.4";
        src = fetchFromGitHub {
          owner = "emacs-helm";
          repo = "helm";
-          rev = "a7d4308604ae790ff568730f8a2f47e578209d3a";
-          sha256 = "10xjdq8ch68c2ysfynrby9sxms23b5g2vmhjv8gv0vn15cc50ir5";
+          rev = "7a969880e7ea607517dbaa9d98da036fd9fec2fd";
+          sha256 = "0y9jg4xidb0f496fi30p1xjr73kg220qsjrzcr1i6p96qxr0qpfd";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/7e8bccffdf69479892d76b9336a4bec3f35e919d/recipes/helm";
@ -15235,6 +15298,27 @@
          license = lib.licenses.free;
        };
      }) {};
+    helm-books = callPackage ({ fetchFromGitHub, fetchurl, helm, lib, melpaBuild }:
+    melpaBuild {
+        pname = "helm-books";
+        version = "1.0.1";
+        src = fetchFromGitHub {
+          owner = "grugrut";
+          repo = "helm-books";
+          rev = "b4c57d2aed596faad41a753dccbcd0a31a717b76";
+          sha256 = "1yr5prp9xvd73balxbn4yn52zah2advq1186ba5aanj436pal0fh";
+        };
+        recipeFile = fetchurl {
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/acba3db40f37e74e1bf9e30f2abed431c259ff50/recipes/helm-books";
+          sha256 = "0xh53vji7nsnpi0b38cjh97x26ryxk61mj7bd6m63qwh8dyhs3yx";
+          name = "helm-books";
+        };
+        packageRequires = [ helm ];
+        meta = {
+          homepage = "https://melpa.org/#/helm-books";
+          license = lib.licenses.free;
+        };
+      }) {};
    helm-bundle-show = callPackage ({ fetchFromGitHub, fetchurl, helm, lib, melpaBuild }:
    melpaBuild {
        pname = "helm-bundle-show";
@ -15364,12 +15448,12 @@
    helm-core = callPackage ({ async, emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "helm-core";
-        version = "2.5.3";
+        version = "2.5.4";
        src = fetchFromGitHub {
          owner = "emacs-helm";
          repo = "helm";
-          rev = "a7d4308604ae790ff568730f8a2f47e578209d3a";
-          sha256 = "10xjdq8ch68c2ysfynrby9sxms23b5g2vmhjv8gv0vn15cc50ir5";
+          rev = "7a969880e7ea607517dbaa9d98da036fd9fec2fd";
+          sha256 = "0y9jg4xidb0f496fi30p1xjr73kg220qsjrzcr1i6p96qxr0qpfd";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/ef7a700c5665e6d72cb4cecf7fb5a2dd43ef9bf7/recipes/helm-core";
@ -15448,12 +15532,12 @@
    helm-dired-history = callPackage ({ cl-lib ? null, fetchFromGitHub, fetchurl, helm, lib, melpaBuild }:
    melpaBuild {
        pname = "helm-dired-history";
-        version = "1.1";
+        version = "1.2";
        src = fetchFromGitHub {
          owner = "jixiuf";
          repo = "helm-dired-history";
-          rev = "75416fa6ca9c5e113cca409ef63518266b4d8d56";
-          sha256 = "17z84dx3z48mx2ssdhlhgzaqrxlzdy9mx3d14qlm0rcrmc0sck8i";
+          rev = "9480383b6ccede6f7c200fbd50aaeb2898b3a008";
+          sha256 = "0cfq06lray7hpnhkwnhjq18izyk2w0m4cxqg0m5nyidiwc4qssqa";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/56036d496c2a5fb1a6b32cdfcd1814944618e652/recipes/helm-dired-history";
@ -16435,12 +16519,12 @@
    helm-tramp = callPackage ({ emacs, fetchFromGitHub, fetchurl, helm, lib, melpaBuild }:
    melpaBuild {
        pname = "helm-tramp";
-        version = "0.2";
+        version = "0.3.2";
        src = fetchFromGitHub {
          owner = "masasam";
          repo = "emacs-helm-tramp";
-          rev = "87d323306a79bf5d71b0f556a7aefdfe5824f523";
-          sha256 = "08rzgfzd70xf1hh54py325p9kf5war40qi5w21anzs4wwg86rz1v";
+          rev = "604e4630070ce2e345cbd21c2fbd8414eb064ef2";
+          sha256 = "09nbg890ppjvz1v2a3zcb198k1zq9gaa04ai4v3xynz6c3kvzyr9";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/4a69f0a17c4efbaea012be8e878af4060fa0c93b/recipes/helm-tramp";
@ -19813,12 +19897,12 @@
    linum-relative = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "linum-relative";
-        version = "0.4";
+        version = "0.5";
        src = fetchFromGitHub {
          owner = "coldnew";
          repo = "linum-relative";
-          rev = "1074e12904d08e00dda438d9700f2a3bff238bd5";
-          sha256 = "1m4g4b96cxs05pfln7kdi6gvrdbv76f8dk806py5lq0gq7da2csc";
+          rev = "b8a99dcfe38a491172a8193053fb7849634b43c0";
+          sha256 = "11bjnqqwvr9zrvz5dlm8a0yw4zg9ysh3jdiq5a6iw09d3f0h1v2s";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/97ae01be4892a7c35aa0f82213433a2944041d87/recipes/linum-relative";
@ -21073,12 +21157,12 @@
    meghanada = callPackage ({ company, emacs, fetchFromGitHub, fetchurl, flycheck, lib, melpaBuild, yasnippet }:
    melpaBuild {
        pname = "meghanada";
-        version = "0.7.0";
+        version = "0.7.2";
        src = fetchFromGitHub {
          owner = "mopemope";
          repo = "meghanada-emacs";
-          rev = "7a6e26ae74c86cc2afffc21de7567a63feb19a7d";
-          sha256 = "1l23nj6fsnqf2xc766rnz5ib6578rvsbn0cdwmw5li6waqbzvla2";
+          rev = "1ddaca25ee978736dcb3922bb1952d750c39cd5a";
+          sha256 = "09g81d1l5mhji4vbljxgfrgr0051sv7kqy0vwf7awxa4slgl6bnd";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/4c75c69b2f00be9a93144f632738272c1e375785/recipes/meghanada";
@ -21531,6 +21615,27 @@
          license = lib.licenses.free;
        };
      }) {};
+    mocha-snippets = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild, yasnippet }:
+    melpaBuild {
+        pname = "mocha-snippets";
+        version = "1.0.0";
+        src = fetchFromGitHub {
+          owner = "cowboyd";
+          repo = "mocha-snippets.el";
+          rev = "e054137bd78f0d236e983874da1f345d30a71816";
+          sha256 = "0lxc5zhb03jpy48ql4mn2l35qhsdwav4dkxyqim72b7c75cy1cml";
+        };
+        recipeFile = fetchurl {
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/93c472e3d7f318373342907ca7253253ef12dab8/recipes/mocha-snippets";
+          sha256 = "0dbsdk4jpzxv2sxx0nia9zhd0a0wmkz1qcqmbd15m1909ccdwxds";
+          name = "mocha-snippets";
+        };
+        packageRequires = [ yasnippet ];
+        meta = {
+          homepage = "https://melpa.org/#/mocha-snippets";
+          license = lib.licenses.free;
+        };
+      }) {};
    mocker = callPackage ({ eieio ? null, el-x, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "mocker";
@ -22479,12 +22584,12 @@
    nix-mode = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "nix-mode";
-        version = "1.11.7";
+        version = "1.11.8";
        src = fetchFromGitHub {
          owner = "NixOS";
          repo = "nix";
-          rev = "13fe83dc8e28a32bdd454d04908fe1514ec50d51";
-          sha256 = "1mddzphb0xbsa5ma83h3hmama77fvxxhwp5qbcrnwpihz1g1l5dv";
+          rev = "206b61b07405229979ed9a1518da1560930d05ee";
+          sha256 = "1qlddlzkpavhsrb7h3cyqhif5qc2qhkhjwnv4pbzg9hamqbd45wc";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/f2b542189cfde5b9b1ebee4625684949b6704ded/recipes/nix-mode";
@ -22581,6 +22686,27 @@
          license = lib.licenses.free;
        };
      }) {};
+    nord-theme = callPackage ({ emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
+    melpaBuild {
+        pname = "nord-theme";
+        version = "0.1.2";
+        src = fetchFromGitHub {
+          owner = "arcticicestudio";
+          repo = "nord-emacs";
+          rev = "5327be91c155eb9fed19061a0f02619dd4284c64";
+          sha256 = "15gjcrx514790djsyfmm8z8q36a3kyf4yhrms5qj423hfc94d3s7";
+        };
+        recipeFile = fetchurl {
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/31cb60069825abe3998c8b43bc9177b39a7f3659/recipes/nord-theme";
+          sha256 = "0p4fqg4i2ayimd8kxsqnb1xkapzhhxf7szxi1skva4dcym3z67cc";
+          name = "nord-theme";
+        };
+        packageRequires = [ emacs ];
+        meta = {
+          homepage = "https://melpa.org/#/nord-theme";
+          license = lib.licenses.free;
+        };
+      }) {};
    nose = callPackage ({ fetchhg, fetchurl, lib, melpaBuild }: melpaBuild {
        pname = "nose";
        version = "0.1.1";
@ -22955,6 +23081,27 @@
          license = lib.licenses.free;
        };
      }) {};
+    obfusurl = callPackage ({ cl-lib ? null, fetchFromGitHub, fetchurl, lib, melpaBuild }:
+    melpaBuild {
+        pname = "obfusurl";
+        version = "2.0";
+        src = fetchFromGitHub {
+          owner = "davep";
+          repo = "obfusurl.el";
+          rev = "fb7524fe8432bf58f0c4f637e5a12565ae81134e";
+          sha256 = "15w8cnwl4hpcslfbmb3j81gbr2dvp0xra2z841503b26s5w91961";
+        };
+        recipeFile = fetchurl {
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/201fe11682cb06b26775a52c81b6a1258b74b4d0/recipes/obfusurl";
+          sha256 = "0xx2zsjbkd17iy7xzqc66f9xgc97f9js3nz656yhmmxakjk2krra";
+          name = "obfusurl";
+        };
+        packageRequires = [ cl-lib ];
+        meta = {
+          homepage = "https://melpa.org/#/obfusurl";
+          license = lib.licenses.free;
+        };
+      }) {};
    ocodo-svg-modelines = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild, svg-mode-line-themes }:
    melpaBuild {
        pname = "ocodo-svg-modelines";
@ -23151,8 +23298,8 @@
        src = fetchFromGitHub {
          owner = "OmniSharp";
          repo = "omnisharp-emacs";
-          rev = "d6a00ff463f53f7357fd7ffbad95accdc8d1c367";
-          sha256 = "0zq0rn1vbwmhr4z5dcgd5k9kslq3xxl05jiyab8835nfacb0zdf2";
+          rev = "bcc5d7ba940c1118ab61071783747162f0c927cf";
+          sha256 = "05i3z6whvgq81qnrwgvfglhwi214145ksg8h81rc0g4ir54wzsik";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/68bdb7e0100e120b95e9416398127d83530a221d/recipes/omnisharp";
@ -23408,12 +23555,12 @@
    org-board = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "org-board";
-        version = "1000";
+        version = "1011";
        src = fetchFromGitHub {
          owner = "scallywag";
          repo = "org-board";
-          rev = "ed62187790f415a006194f69bf86c6ca6959b2e4";
-          sha256 = "0kh32xkqiy4bh72mykswpi20x1fvr6m7751d4lnjczx836ncmggy";
+          rev = "53469a2f0577924de1c7d887fecea409d17fd588";
+          sha256 = "0fg7lkgcr7zwwjald7hbvwgl72m21lqxmz7p8sq31iw3jh42fqgf";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/d8063ee17586d9b1e7415f7b924239826b81ab08/recipes/org-board";
@ -23910,12 +24057,12 @@
    org-random-todo = callPackage ({ alert, emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "org-random-todo";
-        version = "0.4.1";
+        version = "0.5";
        src = fetchFromGitHub {
          owner = "unhammer";
          repo = "org-random-todo";
-          rev = "7398b8dff09bef54f579d158ce47b0090f00201e";
-          sha256 = "1bi09hd5m994rkqcx0a045h20419b6n4vvwiiggzsi0723dd9fb9";
+          rev = "14a065e1d376838f16a6ba32ed8710304542a4e6";
+          sha256 = "07qkn59613l32j6b06ckmccl9s2rfwwivmak5v86z0fafzhxk6ir";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/80fad6244ea3e5bdf7f448c9f62374fae45bae78/recipes/org-random-todo";
@ -24739,12 +24886,12 @@
    package-lint = callPackage ({ cl-lib ? null, emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "package-lint";
-        version = "0.3";
+        version = "0.4";
        src = fetchFromGitHub {
          owner = "purcell";
          repo = "package-lint";
-          rev = "93fdd7b51ad7456387b905ff4c9b104d0b3089a8";
-          sha256 = "17swzcd58zh7yf221pfk8pmz8yhx2dsi2ad1y6lb2xpxxc5csflm";
+          rev = "de08b846b3a031838b79445bb7a254c9de4a80f6";
+          sha256 = "0mvs4afjp5ab89vdz3bd9pca55brn57lxvjqjjyc6cyqxpclh06j";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/9744d8521b4ac5aeb1f28229c0897af7260c6f78/recipes/package-lint";
@ -25094,12 +25241,12 @@
    parsebib = callPackage ({ emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "parsebib";
-        version = "2.0.3";
+        version = "2.2";
        src = fetchFromGitHub {
          owner = "joostkremers";
          repo = "parsebib";
-          rev = "748d6a179fcbbc4af77c7b96059a66d579f34dc8";
-          sha256 = "0f8rcifzfp4fs52pjgfly39vqz54kgjb3yqyxlh4adq12zbq11cd";
+          rev = "621a87d444d9b9c479221fffcd8f7cb5ce2f7717";
+          sha256 = "14rvqjd24xwp2pvl4r00jvhvq7p2wndpz3yy1ml9yymkkn1p1hnh";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/c39633957475dcd6a033760ba20a957716cce59c/recipes/parsebib";
@ -26203,12 +26350,12 @@
    popup-imenu = callPackage ({ dash, fetchFromGitHub, fetchurl, flx-ido, lib, melpaBuild, popup }:
    melpaBuild {
        pname = "popup-imenu";
-        version = "0.5";
+        version = "0.6";
        src = fetchFromGitHub {
          owner = "ancane";
          repo = "popup-imenu";
-          rev = "540e8c0473fd50ff0a85c870057e397a0d3c5eb5";
-          sha256 = "19mqzfpki2zlnibp2vzymhdld1m20jinxwgdhmbl6zdfx74zbz7b";
+          rev = "c5e2e69adbd3a630e4cb750965a1aee8c10c1f09";
+          sha256 = "0vn0jli0ya7xnapifkgzynbnh3rpnzb82j5k9bla2j4miqfc6cg8";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/5ca5d65d6a9c7ef3fa2684271fe087dc132d3a61/recipes/popup-imenu";
@ -26724,6 +26871,27 @@
          license = lib.licenses.free;
        };
      }) {};
+    protocols = callPackage ({ cl-lib ? null, fetchFromGitHub, fetchurl, lib, melpaBuild }:
+    melpaBuild {
+        pname = "protocols";
+        version = "1.6";
+        src = fetchFromGitHub {
+          owner = "davep";
+          repo = "protocols.el";
+          rev = "f5549f5d873a683af45a0e19c732524d5b964026";
+          sha256 = "0v9is6r307814gvrnch2d3mvikd7j8lnmsqb2c3gj6gvfj4p9y7r";
+        };
+        recipeFile = fetchurl {
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/9c9a75671a00e9196d00b08911232aac87fd8c83/recipes/protocols";
+          sha256 = "1wg3qh8a1ms82lkzz4i1bk787147a8agcj8rszj1zfvwg0ckqq1a";
+          name = "protocols";
+        };
+        packageRequires = [ cl-lib ];
+        meta = {
+          homepage = "https://melpa.org/#/protocols";
+          license = lib.licenses.free;
+        };
+      }) {};
    psci = callPackage ({ dash, deferred, f, fetchFromGitHub, fetchurl, lib, melpaBuild, purescript-mode, s }:
    melpaBuild {
        pname = "psci";
@ -28008,12 +28176,12 @@
    resize-window = callPackage ({ cl-lib ? null, emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "resize-window";
-        version = "0.4.0";
+        version = "0.5";
        src = fetchFromGitHub {
          owner = "dpsutton";
          repo = "resize-window";
-          rev = "27364959798de0f019da799975027842c07e7829";
-          sha256 = "0x92s4cv9k566rc248zrcmh507df7d19p7b3vcfd0dlfpbqc0qnv";
+          rev = "e4879731f3a3bc2261d6ec465bff01f88bd77d1d";
+          sha256 = "0lhf1sk1gx0vpy038bdnmlqjzpg4kchlladihk36pv4hgqn5r9w7";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/601a8d8f9046db6c4d50af983a11fa2501304028/recipes/resize-window";
@ -28365,12 +28533,12 @@
    rtags = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "rtags";
-        version = "2.8";
+        version = "2.9";
        src = fetchFromGitHub {
          owner = "Andersbakken";
          repo = "rtags";
-          rev = "6ac7740eaf05cdd9b699185f71cc2d1f634a761b";
-          sha256 = "1w506qaklrly1lnq1i5kshl8m9aki8h2ba1y7h578gwx6lph3vhi";
+          rev = "ffa21b5408a30a346815bc4db6e74e2c6562d936";
+          sha256 = "0828i5lcbspacydjnbrp3zhgbw2gggaaizzm0qqgmvry4cs79bxv";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/ac3b84fe84a7f57d09f1a303d8947ef19aaf02fb/recipes/rtags";
@ -28810,8 +28978,8 @@
        src = fetchFromGitHub {
          owner = "ensime";
          repo = "emacs-scala-mode";
-          rev = "730e16d254478d6f63f62cb04d47c137c9002f2d";
-          sha256 = "1aq1bfv8jz53zp365awqk43ysjwkpj51pcy6fyp87j8bbb02mgq9";
+          rev = "970d88eeff82df635ee12336ab1eb185585f30c6";
+          sha256 = "0wfv20dyb13v7fbfsvy0k5dajvmyyhn80l6xyx6kppiv3qmy9s90";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/564aa1637485192a97803af46b3a1f8e0d042c9a/recipes/scala-mode";
@ -29032,6 +29200,27 @@
          license = lib.licenses.free;
        };
      }) {};
+    services = callPackage ({ cl-lib ? null, fetchFromGitHub, fetchurl, lib, melpaBuild }:
+    melpaBuild {
+        pname = "services";
+        version = "1.7";
+        src = fetchFromGitHub {
+          owner = "davep";
+          repo = "services.el";
+          rev = "514e4095e8964c4d0f38c4f3ad6c692e86d12faa";
+          sha256 = "1k6w2ghi1iczh65bbln5ryxwnxmkkjm3p0p54s155q9sjidiqlwb";
+        };
+        recipeFile = fetchurl {
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/beb91b4397f6e35a1d5c73a127d8cd7fc9201935/recipes/services";
+          sha256 = "02lgmpbw52ps6z4p9gwzvh9iaxisq5mb0n9aml9ajxac1473vpcd";
+          name = "services";
+        };
+        packageRequires = [ cl-lib ];
+        meta = {
+          homepage = "https://melpa.org/#/services";
+          license = lib.licenses.free;
+        };
+      }) {};
    session = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "session";
@ -29077,12 +29266,12 @@
    sexy-monochrome-theme = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "sexy-monochrome-theme";
-        version = "2.0";
+        version = "2.1";
        src = fetchFromGitHub {
          owner = "nuncostans";
          repo = "sexy-monochrome-theme";
-          rev = "436206eef592ca22e4c3e0cd3bd87a1fba4083a1";
-          sha256 = "0aaicpiihrd5ny2g68cpkasysyx5wj28gs727qwdqw3ljpc0qlz9";
+          rev = "d74cf7a50852c469ad13c634df74be2fcb3f3a96";
+          sha256 = "14va3sy94vpkn4fc9g7gsxk3anl25jvp9a92c8ppndqzfisy7vgg";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/9a09ffb7d271773f6cfa7c7eeaba45a717a5bdca/recipes/sexy-monochrome-theme";
@ -30064,12 +30253,12 @@
    snapshot-timemachine-rsnapshot = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild, seq, snapshot-timemachine }:
    melpaBuild {
        pname = "snapshot-timemachine-rsnapshot";
-        version = "0.3";
+        version = "0.4";
        src = fetchFromGitHub {
          owner = "NicolasPetton";
          repo = "snapshot-timemachine-rsnapshot";
-          rev = "4ff6b96219f4da576141e376b0348813c1c25615";
-          sha256 = "0krb1ziyjldyq27sp0phmygm1p9lssp251ycj08gdczbbfpw4lsa";
+          rev = "72b0b700d80f1a0442e62bbbb6a0c8c59182f97f";
+          sha256 = "1bdy7p0bjfdlv6l6yih6fvvi7xpldal4rj8l2ajpc6sgby24h8bb";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/94358fb8d1486491903c331d9e90ba5198117aa8/recipes/snapshot-timemachine-rsnapshot";
@ -31947,6 +32136,27 @@
          license = lib.licenses.free;
        };
      }) {};
+    thinks = callPackage ({ cl-lib ? null, fetchFromGitHub, fetchurl, lib, melpaBuild }:
+    melpaBuild {
+        pname = "thinks";
+        version = "1.10";
+        src = fetchFromGitHub {
+          owner = "davep";
+          repo = "thinks.el";
+          rev = "370d399703d232010599d24a242b5f91e25a1b9d";
+          sha256 = "1kac32mgk2gcchh9lvnny81xq03h4656v05xyd3fpkpr30sisyrq";
+        };
+        recipeFile = fetchurl {
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/439957cabf379651dc243219a83c3c96bae6f8cf/recipes/thinks";
+          sha256 = "11vj9mjfzmqwdmkq97aqns3fh8hkgx9scnki6c2iag5lj0av2vcq";
+          name = "thinks";
+        };
+        packageRequires = [ cl-lib ];
+        meta = {
+          homepage = "https://melpa.org/#/thinks";
+          license = lib.licenses.free;
+        };
+      }) {};
    thrift = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "thrift";
@ -32031,6 +32241,27 @@
          license = lib.licenses.free;
        };
      }) {};
+    timonier = callPackage ({ all-the-icons, dash, fetchFromGitHub, fetchurl, hydra, lib, melpaBuild, pkg-info, request, s }:
+    melpaBuild {
+        pname = "timonier";
+        version = "0.1.0";
+        src = fetchFromGitHub {
+          owner = "nlamirault";
+          repo = "timonier";
+          rev = "33ca5887a1d1b63349177237e9edfb73546511a5";
+          sha256 = "0z6s26kc50rbmgkkbxzpasphi8hcwhixmi8ksqzrclayccjjj7ar";
+        };
+        recipeFile = fetchurl {
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/a31b0c177fd83bdeb1842a6ec3095de143bb4eae/recipes/timonier";
+          sha256 = "0vb83kv2dkca2bq876icxs8iivv9qgkzmzrsxfpnvbv752b220b0";
+          name = "timonier";
+        };
+        packageRequires = [ all-the-icons dash hydra pkg-info request s ];
+        meta = {
+          homepage = "https://melpa.org/#/timonier";
+          license = lib.licenses.free;
+        };
+      }) {};
    toc-org = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "toc-org";
@ -32666,6 +32897,27 @@
          license = lib.licenses.free;
        };
      }) {};
+    uptimes = callPackage ({ cl-lib ? null, fetchFromGitHub, fetchurl, lib, melpaBuild }:
+    melpaBuild {
+        pname = "uptimes";
+        version = "3.1";
+        src = fetchFromGitHub {
+          owner = "davep";
+          repo = "uptimes.el";
+          rev = "5e321692bf5ccdc286f4831fa8fe55467c1c56aa";
+          sha256 = "04n4bryfid6scma43whw156wcza77ij7szgc5f73d98j9fji6lay";
+        };
+        recipeFile = fetchurl {
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/72099e35ce3e34ec6afc6a3f87a4da07ec91499a/recipes/uptimes";
+          sha256 = "0r8s5c2hdcb1ly7rnhzar4qzf1c9d49gd914ndnc3mg9yb9gyy5h";
+          name = "uptimes";
+        };
+        packageRequires = [ cl-lib ];
+        meta = {
+          homepage = "https://melpa.org/#/uptimes";
+          license = lib.licenses.free;
+        };
+      }) {};
    use-package = callPackage ({ bind-key, diminish, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "use-package";
@ -32918,27 +33170,6 @@
          license = lib.licenses.free;
        };
      }) {};
-    vimgolf = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
-    melpaBuild {
-        pname = "vimgolf";
-        version = "0.10.0";
-        src = fetchFromGitHub {
-          owner = "timvisher";
-          repo = "vimgolf";
-          rev = "9fd8aaf68bc69d1dd628de4c7cbb070e366545a9";
-          sha256 = "1f94qx8rbnn21cl0grxqa9gzkbrz68vmqsihv8vvi8qf1c1dmd0i";
-        };
-        recipeFile = fetchurl {
-          url = "https://raw.githubusercontent.com/milkypostman/melpa/0bded518d1544a9442c13c5cbfab64f0f1cbdb6d/recipes/vimgolf";
-          sha256 = "1hvw2pfa5a984hm6wd33bf6zz6hmlprc6qs3g789dfx91qm890vn";
-          name = "vimgolf";
-        };
-        packageRequires = [];
-        meta = {
-          homepage = "https://melpa.org/#/vimgolf";
-          license = lib.licenses.free;
-        };
-      }) {};
    vimish-fold = callPackage ({ cl-lib ? null, emacs, f, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "vimish-fold";
@ -33152,12 +33383,12 @@
    wandbox = callPackage ({ emacs, fetchFromGitHub, fetchurl, lib, melpaBuild, request, s }:
    melpaBuild {
        pname = "wandbox";
-        version = "0.6.0";
+        version = "0.6.2";
        src = fetchFromGitHub {
          owner = "kosh04";
          repo = "emacs-wandbox";
-          rev = "70728ba1bfa425dee7a66fd86c7bbf2747b2514c";
-          sha256 = "1nx7cr7d4qmzwbvp59kc8139nzc965ibc9vf7afrz8z2h5qg4d4l";
+          rev = "4e52c14aca11de4686d4f1de98588cb5cf42d815";
+          sha256 = "1c9wvnc8nqizh5sw424hznnqymfcyqdgdj8gzwfy5i04mi7mic4p";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/091dcc3775ec2137cb61d66df4e72aca4900897a/recipes/wandbox";
@ -33341,12 +33572,12 @@
    webpaste = callPackage ({ cl-lib ? null, emacs, fetchFromGitHub, fetchurl, lib, melpaBuild, request }:
    melpaBuild {
        pname = "webpaste";
-        version = "1.0.0";
+        version = "1.1.0";
        src = fetchFromGitHub {
          owner = "etu";
          repo = "webpaste.el";
-          rev = "58f66efcb8f061d25bf474b14f3867ae856f6b1d";
-          sha256 = "0qczw7pdkjgqmjibwyw8psxhqy1bx183qzni832qx59sds15j13q";
+          rev = "f6583397a4f8c9cde6b556175a6e05303d6238de";
+          sha256 = "0z7pkqfli1lqvfjjaf8p1sbbwf0f7xgz87k3rqqav9xyc9iqh0ni";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/13847d91c1780783e516943adee8a3530c757e17/recipes/webpaste";
@ -33785,8 +34016,8 @@
        version = "0.9.1";
        src = fetchhg {
          url = "https://bitbucket.com/ArneBab/wisp";
-          rev = "3447d48e8562";
-          sha256 = "1qym4wfcr3hiq0a1z3myvzalblwwp5xalq9sjx090w3ag3ghgjrg";
+          rev = "c5c0bb98b281";
+          sha256 = "0gxvx2n6xza17qf1p4v0nbcqfkkhrmg9a56c5d126b4vgmg3bf9v";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/5b7972602399f9df9139cff177e38653bb0f43ed/recipes/wisp-mode";
@ -34493,12 +34724,12 @@
    ycmd = callPackage ({ cl-lib ? null, dash, deferred, emacs, fetchFromGitHub, fetchurl, let-alist, lib, melpaBuild, pkg-info, request, request-deferred, s }:
    melpaBuild {
        pname = "ycmd";
-        version = "1.0";
+        version = "1.1";
        src = fetchFromGitHub {
          owner = "abingham";
          repo = "emacs-ycmd";
-          rev = "be21ca7f807e70812b6fc0e0a4ea83b41723d815";
-          sha256 = "1q30k8rhk3plknkk544h2dk48yqmxwh4xp3rq1lz8isc3580qwxx";
+          rev = "9f5ad4a20e6bf893491635108adfff71f3c6b590";
+          sha256 = "08kvbvhx5y3239bzdb1xpr81lfrhjy9xka4kn9dpa5bdxs0xx92w";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/4b25378540c64d0214797348579671bf2b8cc696/recipes/ycmd";
--- a/pkgs/applications/editors/emacs/macport.nix
+++ b/pkgs/applications/editors/emacs/macport.nix
@ -4,8 +4,10 @@
 }:

 stdenv.mkDerivation rec {
-  emacsName = "emacs-25.1";
-  name = "${emacsName}-mac-6.1";
+  emacsVersion = "25.1";
+  emacsName = "emacs-${emacsVersion}";
+  macportVersion = "6.1";
+  name = "emacs-mac-${emacsVersion}-${macportVersion}";

  builder = ./builder.sh;

@ -15,7 +17,7 @@ stdenv.mkDerivation rec {
  };

  macportSrc = fetchurl {
-    url = "ftp://ftp.math.s.chiba-u.ac.jp/emacs/${name}.tar.gz";
+    url = "ftp://ftp.math.s.chiba-u.ac.jp/emacs/${emacsName}-mac-${macportVersion}.tar.gz";
    sha256 = "1zwxh7zsvwcg221mpjh0dhpdas3j9mc5q92pprf8yljl7clqvg62";
  };

@ -35,7 +37,7 @@ stdenv.mkDerivation rec {

  postUnpack = ''
    mv $sourceRoot $name
-    tar xzf $macportSrc
+    tar xzf $macportSrc -C $name --strip-components=1
    mv $name $sourceRoot

    # extract retina image resources
@ -92,8 +94,8 @@ stdenv.mkDerivation rec {
      extensions are distributed with GNU Emacs; others are available
      separately.

-      This is "Mac port" addition to GNU Emacs 24. This provides a native
-      GUI support for Mac OS X 10.4 - 10.11. Note that Emacs 23 and later
+      This is "Mac port" addition to GNU Emacs 25. This provides a native
+      GUI support for Mac OS X 10.6 - 10.12. Note that Emacs 23 and later
      already contain the official GUI support via the NS (Cocoa) port for
      Mac OS X 10.4 and later. So if it is good enough for you, then you
      don't need to try this.
--- a/pkgs/applications/editors/idea/default.nix
+++ b/pkgs/applications/editors/idea/default.nix
@ -172,12 +172,12 @@ in

  idea-community = buildIdea rec {
    name = "idea-community-${version}";
-    version = "2016.3.5";
+    version = "2017.1";
    description = "Integrated Development Environment (IDE) by Jetbrains, community edition";
    license = stdenv.lib.licenses.asl20;
    src = fetchurl {
      url = "https://download.jetbrains.com/idea/ideaIC-${version}.tar.gz";
-      sha256 = "0v5wxjbzrax688knjsf7xd956i8pq5i4svkgnrrc4s390f0ixnl5";
+      sha256 = "0pfsf7ykwixvljcmrv4gldaaflf13brch70cd6xpax0m89vm22vm";
    };
    wmClass = "jetbrains-idea-ce";
  };
@ -208,12 +208,12 @@ in

  idea-ultimate = buildIdea rec {
    name = "idea-ultimate-${version}";
-    version = "2016.3.4";
+    version = "2017.1";
    description = "Integrated Development Environment (IDE) by Jetbrains, requires paid license";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/idea/ideaIU-${version}.tar.gz";
-      sha256 = "1ichjrdmnhyqv9cr73d8kif9l53k3x36i8js8nf9cmkbhdsfckn3";
+      sha256 = "1858jhmyyb7nhx08yxbn5bfgx9m32r8yqwjxjw17rf8gnfvs8225";
    };
    wmClass = "jetbrains-idea";
  };
@ -256,36 +256,36 @@ in

  pycharm-community = buildPycharm rec {
    name = "pycharm-community-${version}";
-    version = "2016.3.2";
+    version = "2017.1";
    description = "PyCharm Community Edition";
    license = stdenv.lib.licenses.asl20;
    src = fetchurl {
      url = "https://download.jetbrains.com/python/${name}.tar.gz";
-      sha256 = "0fag5ng9n953mnf3gmxpac1icnb1qz6dybhqwjbr13qij8v2s2g1";
+      sha256 = "14p6f15n0927awgpsdsdqgmdfbbwkykrw5xggz5hnfl7d05i4sb6";
    };
    wmClass = "jetbrains-pycharm-ce";
  };

  pycharm-professional = buildPycharm rec {
    name = "pycharm-professional-${version}";
-    version = "2016.3.2";
+    version = "2017.1";
    description = "PyCharm Professional Edition";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/python/${name}.tar.gz";
-      sha256 = "1nylq0fyvix68l4dp9852dak58dbiamjphx2hin087cadaji6r63";
+      sha256 = "1rvic3njsq480pslhw6rxld7jngchihkplq3dfnmkr2h9gx26lkf";
    };
    wmClass = "jetbrains-pycharm";
  };

  phpstorm = buildPhpStorm rec {
    name = "phpstorm-${version}";
-    version = "2016.3.2";
+    version = "2017.1";
    description = "Professional IDE for Web and PHP developers";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/webide/PhpStorm-${version}.tar.gz";
-      sha256 = "05ylhpn1mijjphcmv6ay3123xp72yypw19430dgr8101zpsnifa5";
+      sha256 = "1ynffm5x8fqq2r71rr9rbvdifbwbvbhqb2x1hkyy4az38gxal1bm";
    };
    wmClass = "jetbrains-phpstorm";
  };
@ -304,12 +304,12 @@ in

  webstorm = buildWebStorm rec {
    name = "webstorm-${version}";
-    version = "2016.3.3";
+    version = "2017.1";
    description = "Professional IDE for Web and JavaScript development";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/webstorm/WebStorm-${version}.tar.gz";
-      sha256 = "08f266afi8ia5jvvgk2lncra2n3i0l5c3h7c8fwxz6y8fhhlas4y";
+      sha256 = "e651ad78ff9de92bb5b76698eeca1e02ab0f0c36209908074fa4a6b48586071c";
    };
    wmClass = "jetbrains-webstorm";
  };
--- a/pkgs/applications/editors/notepadqq/default.nix
+++ b/pkgs/applications/editors/notepadqq/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchgit, pkgconfig, which, qtbase }:
+{ stdenv, fetchgit, pkgconfig, which, qtbase, qtsvg, qttools, qtwebkit }:

 let
  version = "0.53.0";
@ -12,11 +12,11 @@ in stdenv.mkDerivation {
  };

  nativeBuildInputs = [
-    pkgconfig which
+    pkgconfig which qttools
  ];

  buildInputs = [
-    qtbase.qtsvg qtbase.qtwebkit qtbase.qttools
+    qtbase qtsvg qtwebkit
  ];

  preConfigure = ''
--- a/pkgs/applications/editors/vscode/default.nix
+++ b/pkgs/applications/editors/vscode/default.nix
@ -2,24 +2,24 @@
  makeWrapper, libXScrnSaver }:

 let
-  version = "1.10.0";
-  rev = "49129d126e2c3c5592cfc8a509d872067b69d262";
+  version = "1.10.2";
+  rev = "8076a19fdcab7e1fc1707952d652f0bb6c6db331";
  channel = "stable";

  # The revision can be obtained with the following command (see https://github.com/NixOS/nixpkgs/issues/22465):
  # curl -w "%{url_effective}\n" -I -L -s -S https://vscode-update.azurewebsites.net/latest/linux-x64/stable -o /dev/null

-  sha256 = if stdenv.system == "i686-linux"    then "14ip00ysnn6daw7ws3vgnhib18pi7r1z1szfr7s996awbq12ir3i"
-      else if stdenv.system == "x86_64-linux"  then "1krrshsx2pjkr4pc1d6zad664f5khdbhwaq8lpx1aagxxd921mx6"
-      else if stdenv.system == "x86_64-darwin" then "1y574b4wpkk06a36clajx57ydj7a0scn2gms4070cqaf0afzy19f"
+  sha256 = if stdenv.system == "i686-linux"    then "1rhwrpv17c8j06qja7i58cggzka8jm9v9h27jy22z30yxjz0p241"
+      else if stdenv.system == "x86_64-linux"  then "1c1w7wc39a5vdap8j143ym976p9l9iwns1y28mcgjwrihdlb5wb8"
+      else if stdenv.system == "x86_64-darwin" then "1zznsn84k79lqirzv950q7caq7c88yh2gglwjc11y8k69awmlpva"
      else throw "Unsupported system: ${stdenv.system}";

  urlBase = "https://az764295.vo.msecnd.net/${channel}/${rev}/";

  urlStr = if stdenv.system == "i686-linux" then
-        urlBase + "code-${channel}-code_${version}-1488384152_i386.tar.gz"
+        urlBase + "code-${channel}-code_${version}-1488982317_i386.tar.gz"
      else if stdenv.system == "x86_64-linux" then
-        urlBase + "code-${channel}-code_${version}-1488387854_amd64.tar.gz"
+        urlBase + "code-${channel}-code_${version}-1488981323_amd64.tar.gz"
      else if stdenv.system == "x86_64-darwin" then
        urlBase + "VSCode-darwin-${channel}.zip"
      else throw "Unsupported system: ${stdenv.system}";
@ -47,17 +47,22 @@ in
      then [ unzip makeWrapper libXScrnSaver ]
      else [ makeWrapper libXScrnSaver ];

-    installPhase = ''
-      mkdir -p $out/lib/vscode $out/bin
-      cp -r ./* $out/lib/vscode
-      ln -s $out/lib/vscode/code $out/bin
+    installPhase =
+      if stdenv.system == "x86_64-darwin" then ''
+        mkdir -p $out/lib/vscode $out/bin
+        cp -r ./* $out/lib/vscode
+        ln -s $out/lib/vscode/Contents/Resources/app/bin/code $out/bin
+      '' else ''
+        mkdir -p $out/lib/vscode $out/bin
+        cp -r ./* $out/lib/vscode
+        ln -s $out/lib/vscode/code $out/bin

-      mkdir -p $out/share/applications
-      cp $desktopItem/share/applications/* $out/share/applications
+        mkdir -p $out/share/applications
+        cp $desktopItem/share/applications/* $out/share/applications

-      mkdir -p $out/share/pixmaps
-      cp $out/lib/vscode/resources/app/resources/linux/code.png $out/share/pixmaps/code.png
-    '';
+        mkdir -p $out/share/pixmaps
+        cp $out/lib/vscode/resources/app/resources/linux/code.png $out/share/pixmaps/code.png
+      '';

    postFixup = lib.optionalString (stdenv.system == "i686-linux" || stdenv.system == "x86_64-linux") ''
      patchelf \
--- a/pkgs/applications/graphics/dia/default.nix
+++ b/pkgs/applications/graphics/dia/default.nix
@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
  meta = {
    description = "Gnome Diagram drawing software";
    homepage = http://live.gnome.org/Dia;
-    maintainers = with stdenv.lib.maintainers; [raskin urkud];
+    maintainers = with stdenv.lib.maintainers; [raskin];
    platforms = stdenv.lib.platforms.linux;
  };
 }
--- a/pkgs/applications/graphics/djview/default.nix
+++ b/pkgs/applications/graphics/djview/default.nix
@ -23,6 +23,6 @@ stdenv.mkDerivation rec {
    description = "A portable DjVu viewer and browser plugin";
    license = licenses.gpl2;
    platforms = platforms.unix;
-    maintainers = [ maintainers.urkud ];
+    maintainers = [ ];
  };
 }
--- a/pkgs/applications/graphics/graphicsmagick/cmyka-bounds.patch
+++ b/pkgs/applications/graphics/graphicsmagick/cmyka-bounds.patch
@ -0,0 +1,36 @@
+# HG changeset patch
+# User Bob Friesenhahn <bfriesen@GraphicsMagick.org>
+# Date 1487905610 21600
+# Node ID 6156b4c2992d855ece6079653b3b93c3229fc4b8
+# Parent  0392c4305a4369984ec8069055acc470c0a73647
+Fix out of bounds access when reading CMYKA tiff which claims wrong samples/pixel.
+
+diff -r 0392c4305a43 -r 6156b4c2992d coders/tiff.c
+--- a/coders/tiff.c	Sun Jan 29 10:04:57 2017 -0600
+++ b/coders/tiff.c	Thu Feb 23 21:06:50 2017 -0600
+@@ -1230,8 +1230,8 @@
+                   case 0:
+                     if (samples_per_pixel == 1)
+                       *quantum_type=GrayQuantum;
+-                      else
+-                        *quantum_type=RedQuantum;
+                    else
+                      *quantum_type=RedQuantum;
+                     break;
+                   case 1:
+                     *quantum_type=GreenQuantum;
+@@ -1411,12 +1411,12 @@
+               }
+             else
+               {
+-                if (image->matte)
+                if (image->matte && samples_per_pixel >= 5)
+                   {
+                     *quantum_type=CMYKAQuantum;
+                     *quantum_samples=5;
+                   }
+-                else
+                else if (samples_per_pixel >= 4)
+                   {
+                     *quantum_type=CMYKQuantum;
+                     *quantum_samples=4;
--- a/pkgs/applications/graphics/graphicsmagick/default.nix
+++ b/pkgs/applications/graphics/graphicsmagick/default.nix
@ -42,6 +42,7 @@ stdenv.mkDerivation {
      url = "https://sources.debian.net/data/main/g/graphicsmagick/1.3.25-7/debian/patches/CVE-2016-9830.patch";
      sha256 = "0qh15sd7nx7vf9sld4453iml951bwsx2fx84hxc7plhds2k3gjpa";
    })
+    ./cmyka-bounds.patch
  ];

  configureFlags = [
--- a/pkgs/applications/graphics/rapcad/default.nix
+++ b/pkgs/applications/graphics/rapcad/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, cgal, boost, gmp, mpfr, flex, bison, dxflib, readline
+{ stdenv, fetchFromGitHub, fetchurl, cgal, boost, gmp, mpfr, flex, bison, dxflib, readline
 , qtbase, qmakeHook, mesa_glu
 }:

@ -13,6 +13,14 @@ stdenv.mkDerivation rec {
    sha256 = "0a0sqf6h227zalh0jrz6jpm8iwji7q3i31plqk76i4qm9vsgrhir";
  };

+  patches = [
+    (fetchurl {
+      url = "https://github.com/GilesBathgate/RapCAD/commit/278a8d6c7b8fe08f867002528bbab4a6319a7bb6.patch";
+      sha256 = "1vvkyf0wg79zdzs5zlggfrr1lrp1x75dglzl0mspnycwldsdwznj";
+      name = "disable-QVector-qHash.patch";
+    })
+  ];
+
  nativeBuildInputs = [ qmakeHook ];
  buildInputs = [ qtbase cgal boost gmp mpfr flex bison dxflib readline mesa_glu ];

--- a/pkgs/applications/graphics/vimiv/default.nix
+++ b/pkgs/applications/graphics/vimiv/default.nix
@ -68,5 +68,6 @@ python3Packages.buildPythonApplication rec {
    description = "An image viewer with Vim-like keybindings";
    license = lib.licenses.mit;
    platforms = lib.platforms.linux;
+    broken = true;
  };
 }
--- a/pkgs/applications/misc/audio/sox/default.nix
+++ b/pkgs/applications/misc/audio/sox/default.nix
@ -9,6 +9,7 @@
 , enableLibsndfile ? true, libsndfile ? null
 # amrnb and amrwb are unfree, disabled by default
 , enableAMR ? false, amrnb ? null, amrwb ? null
+, enableLibpulseaudio ? true, libpulseaudio ? null
 }:

 with stdenv.lib;
@ -30,7 +31,8 @@ stdenv.mkDerivation rec {
    optional enableFLAC flac ++
    optional enablePNG libpng ++
    optional enableLibsndfile libsndfile ++
-    optionals enableAMR [ amrnb amrwb ];
+    optionals enableAMR [ amrnb amrwb ] ++
+    optional enableLibpulseaudio libpulseaudio;

  meta = {
    description = "Sample Rate Converter for audio";
--- a/pkgs/applications/misc/direwolf/default.nix
+++ b/pkgs/applications/misc/direwolf/default.nix
@ -1,38 +1,43 @@
-{ stdenv, fetchFromGitHub, unzip, alsaLib }:
-let
-  version = "1.2";
-in
+{ stdenv, fetchFromGitHub
+, espeak, alsaLib, perl
+, python }:
+
+with stdenv.lib;
+
 stdenv.mkDerivation rec {
  name = "direwolf-${version}";
-  inherit version;
+  version = "1.3";

  src = fetchFromGitHub {
    owner = "wb2osz";
    repo = "direwolf";
-    rev = "8b81a32";
-    sha256 = "0r4fgdxghh292bzhqshr7zl5cg2lfsvlgmy4d5vqcli7x6qa1gcs";
+    rev = version;
+    sha256 = "1x6vvl3fy70ic5pqvqsyr0bkqwim8m9jaqnm5ls8z8i66rwq23fg";
  };

  buildInputs = [
-    unzip alsaLib
-  ];
+    espeak perl python
+  ] ++ (optional stdenv.isLinux alsaLib);

  patchPhase = ''
-    substituteInPlace Makefile.linux \
-      --replace "/usr/local" "$out" \
-      --replace "/usr/share" "$out/share"
-  '';
+        substituteInPlace Makefile.* \
+          --replace /usr/share $out/share

-  preInstall = ''
-    mkdir -p $out/bin
-  '';
+        substituteInPlace dwespeak.sh \
+          --replace espeak ${espeak}/bin/espeak
+        '';

-  meta = with stdenv.lib; {
+  installPhase = ''
+    mkdir -p $out/bin 
+    make INSTALLDIR=$out install
+    '';
+
+  meta = {
    description = "A Soundcard Packet TNC, APRS Digipeater, IGate, APRStt gateway";
    # On the page: This page will be disappearing on October 8, 2015.
-    homepage = https://home.comcast.net/~wb2osz/site/;
+    homepage = https://github.com/wb2osz/direwolf/;
    license = licenses.gpl2;
-    platforms = platforms.linux;
+    platforms = platforms.unix;
    maintainers = [ maintainers.the-kenny ];
  };
 }
--- a/pkgs/applications/misc/djvulibre/default.nix
+++ b/pkgs/applications/misc/djvulibre/default.nix
@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
    description = "A library and viewer for the DJVU file format for scanned images";
    homepage = http://djvu.sourceforge.net;
    license = licenses.gpl2;
-    maintainers = with maintainers; [ urkud ];
+    maintainers = with maintainers; [ ];
    platforms = platforms.all;
  };
 }
--- a/pkgs/applications/misc/emem/default.nix
+++ b/pkgs/applications/misc/emem/default.nix
@ -2,14 +2,14 @@

 stdenv.mkDerivation rec {
  pname = "emem";
-  version = "0.2.47";
+  version = "0.2.48";
  name = "${pname}-${version}";

  inherit jdk;

  src = fetchurl {
    url = "https://github.com/ebzzry/${pname}/releases/download/v${version}/${pname}.jar";
-    sha256 = "0hz862g7k42kik9vgzskqr99321llmmakl54ay9vsykvcxs632mx";
+    sha256 = "0l68qqjh8lbqb2yqvggiga9qz2j32h3qklcfkycmcffn6l1nlqnq";
  };

  phases = [ "buildPhase" "installPhase" ];
--- a/pkgs/applications/misc/exercism/default.nix
+++ b/pkgs/applications/misc/exercism/default.nix
@ -2,7 +2,7 @@

 buildGoPackage rec {
  name    = "exercism-${version}";
-  version = "2.3.0";
+  version = "2.4.0";

  goPackagePath = "github.com/exercism/cli";

@ -10,7 +10,7 @@ buildGoPackage rec {
    owner  = "exercism";
    repo   = "cli";
    rev    = "v${version}";
-    sha256 = "1zhvvmsh5kw739kylk0bqj1wa6vjyahz43dlxdpv42h8gfiiksf5";
+    sha256 = "1hl13sr4ymqg9sjhkxdmhf8cfw69cic3bysw34xfv2j6bjjxfwaa";
  };

  meta = with stdenv.lib; {
--- a/pkgs/applications/misc/freicoin/default.nix
+++ b/pkgs/applications/misc/freicoin/default.nix
@ -1,28 +0,0 @@
-{ fetchurl, stdenv, db, boost, gmp, mpfr, miniupnpc, qt4, qmake4Hook, unzip }:
-
-stdenv.mkDerivation rec {
-  version = "0.8.3-1";
-  name = "freicoin-${version}";
-
-  src = fetchurl {
-    url = "https://github.com/freicoin/freicoin/archive/v${version}.zip";
-    sha256 = "0v3mh8a96nnb86mkyaylyjj7qfdrl7i9gvybh7f8w2hrl9paszfh";
-  };
-
-  # I think that openssl and zlib are required, but come through other
-  # packages
-  buildInputs = [ db boost gmp mpfr miniupnpc qt4 unzip qmake4Hook ];
-
-  installPhase = ''
-    mkdir -p $out/bin
-    cp freicoin-qt $out/bin
-  '';
-
-  meta = {
-    description = "Peer-to-peer currency with demurrage fee";
-    homepage = "http://freicoi.in/";
-    license = stdenv.lib.licenses.mit;
-    maintainers = with stdenv.lib.maintainers; [viric];
-    platforms = with stdenv.lib.platforms; linux;
-  };
-}
--- a/pkgs/applications/misc/galculator/default.nix
+++ b/pkgs/applications/misc/galculator/default.nix
@ -1,17 +1,20 @@
-{ stdenv, fetchurl
-, intltool, pkgconfig, gtk }:
+{ stdenv, fetchFromGitHub
+, autoreconfHook, intltool
+, gtk, pkgconfig, flex }:

 stdenv.mkDerivation rec {
-  
  name = "galculator-${version}";
-  version = "2.1.3";
+  version = "2.1.4";

-  src = fetchurl {
-    url = "mirror://sourceforge/galculator/${name}.tar.gz";
-    sha256 = "12m7dldjk10lpkdxk7zpk98n32ci65zmxidghihb7n1m3rhp3q17";
+  src = fetchFromGitHub {
+    owner = "galculator";
+    repo = "galculator";
+    rev = "v${version}";
+    sha256 = "0q0hb62f266709ncyq96bpx4a40a1i6dc5869byvd7x285sx1c2w";
  };

-  buildInputs = [ intltool pkgconfig gtk ];
+  nativeBuildInputs = [ autoreconfHook intltool pkgconfig ];
+  buildInputs = [ gtk flex ];

  meta = with stdenv.lib; {
    description = "A GTK 2/3 algebraic and RPN calculator";
--- a/pkgs/applications/misc/gcalcli/default.nix
+++ b/pkgs/applications/misc/gcalcli/default.nix
@ -1,13 +1,14 @@
-{ fetchFromGitHub, lib, pythonPackages }:
+{ stdenv, lib, fetchFromGitHub, pythonPackages
+, libnotify ? null }:

 pythonPackages.buildPythonApplication rec {
  version = "3.4.0";
  name = "gcalcli-${version}";

  src = fetchFromGitHub {
-    owner = "insanum";
-    repo = "gcalcli";
-    rev = "v${version}";
+    owner  = "insanum";
+    repo   = "gcalcli";
+    rev    = "v${version}";
    sha256 = "171awccgnmfv4j7m2my9387sjy60g18kzgvscl6pzdid9fn9rrm8";
  };

@ -20,12 +21,23 @@ pythonPackages.buildPythonApplication rec {
    parsedatetime
    six
    vobject
-  ] ++ lib.optional (!pythonPackages.isPy3k) futures;
+  ]
+  ++ lib.optional (!pythonPackages.isPy3k) futures;
+
+  # there are no tests as of 3.4.0
+  doCheck = false;
+
+  postInstall = lib.optionalString stdenv.isLinux ''
+    substituteInPlace $out/bin/gcalcli \
+      --replace "command = 'notify-send -u critical -a gcalcli %s'" \
+                "command = '${libnotify}/bin/notify-send -i view-calendar-upcoming-events -u critical -a Calendar %s'"
+  '';

  meta = with lib; {
    homepage = https://github.com/insanum/gcalcli;
    description = "CLI for Google Calendar";
    license = licenses.mit;
-    maintainers = [ maintainers.nocoolnametom ];
+    maintainers = with maintainers; [ nocoolnametom ];
+    inherit version;
  };
 }
--- a/pkgs/applications/misc/gpscorrelate/default.nix
+++ b/pkgs/applications/misc/gpscorrelate/default.nix
@ -1,17 +1,22 @@
-{ fetchurl, stdenv, pkgconfig, exiv2, libxml2, gtk2
+{ fetchFromGitHub, stdenv, pkgconfig, exiv2, libxml2, gtk2
 , libxslt, docbook_xsl, docbook_xml_dtd_42 }:

 stdenv.mkDerivation rec {
-  name = "gpscorrelate-1.6.0";
+  name = "gpscorrelate-${version}";
+  version = "1.6.1";

-  src = fetchurl {
-    url = "http://freefoote.dview.net/linux/${name}.tar.gz";
-    sha256 = "1j0b244xkvvf0i4iivp4dw9k4xgyasx4sapd91mnwki35fy49sp0";
+  src = fetchFromGitHub {
+    owner = "freefoote";
+    repo = "gpscorrelate";
+    rev = version;
+    sha256 = "1z0fc75rx7dl6nnydksa578qv116j2c2xs1czfiijzxjghx8njdj";
  };

+  nativeBuildInputs = [ pkgconfig ];
  buildInputs = [
-    pkgconfig exiv2 libxml2 gtk2
-    libxslt docbook_xsl docbook_xml_dtd_42
+    exiv2 libxml2 gtk2
+    libxslt docbook_xsl 
+    docbook_xml_dtd_42
  ];

  patchPhase = ''
@ -19,7 +24,7 @@ stdenv.mkDerivation rec {
        -es",^[[:blank:]]*prefix[[:blank:]]*=.*$,prefix = $out,g"
  '';

-  meta = {
+  meta = with stdenv.lib; {
    description = "A GPS photo correlation tool, to add EXIF geotags";

    longDescription = ''
@ -38,9 +43,8 @@ stdenv.mkDerivation rec {
      one takes the GPS data in a different format.
    '';

-    license = stdenv.lib.licenses.gpl2Plus;
-
-    homepage = http://freefoote.dview.net/linux_gpscorr.html;
-    platforms = stdenv.lib.platforms.linux;
+    license = licenses.gpl2Plus;
+    homepage = https://github.com/freefoote/gpscorrelate;
+    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/misc/iterm2/default.nix
+++ b/pkgs/applications/misc/iterm2/default.nix
@ -2,16 +2,19 @@

 stdenv.mkDerivation rec {
  name = "iterm2-${version}";
-  version = "3.0.4";
+  version = "3.0.14";

  src = fetchFromGitHub {
    owner = "gnachman";
    repo = "iTerm2";
    rev = "v${version}";
-    sha256 = "0ffg9l2jvv503h13nd5rjkn5xrahswcqqwmm052qzd6d0lmqjm93";
+    sha256 = "03m0ja11w9910z96yi8fzq3436y8xl14q031rdb2w3sapjd54qrj";
  };

  patches = [ ./disable_updates.patch ];
+  postPatch = ''
+    sed -i -e 's/CODE_SIGN_IDENTITY = "Developer ID Application"/CODE_SIGN_IDENTITY = ""/g' ./iTerm2.xcodeproj/project.pbxproj
+  '';
  makeFlagsArray = ["Deployment"];
  installPhase = ''
    mkdir -p "$out/Applications"
--- a/pkgs/applications/misc/k3b/default.nix
+++ b/pkgs/applications/misc/k3b/default.nix
@ -41,7 +41,7 @@ in stdenv.mkDerivation rec {
  meta = with stdenv.lib; {
    description = "CD/DVD Burning Application for KDE";
    license = licenses.gpl2Plus;
-    maintainers = [ maintainers.sander maintainers.urkud maintainers.phreedom ];
+    maintainers = [ maintainers.sander maintainers.phreedom ];
    platforms = with stdenv.lib.platforms; linux;
  };
 }
--- a/pkgs/applications/misc/keepassx/community.nix
+++ b/pkgs/applications/misc/keepassx/community.nix
@ -7,13 +7,13 @@ with stdenv.lib;

 stdenv.mkDerivation rec {
  name = "keepassx-community-${version}";
-  version = "2.1.2";
+  version = "2.1.3";

  src = fetchFromGitHub {
    owner = "keepassxreboot";
    repo = "keepassxc";
    rev = "${version}";
-    sha256 = "0ncc157xki1mzxfa41bgwjfsz5jq9sq750ka578lq61smyzh5lq6";
+    sha256 = "1zamk3dc44fn61b880i3l1r0np2sx2hs05cvcf2x4748r3xicacf";
  };

  cmakeFlags = optional (withKeePassHTTP) [ "-DWITH_XC_HTTP=ON" ];
--- a/pkgs/applications/misc/krename/default.nix
+++ b/pkgs/applications/misc/krename/default.nix
@ -21,7 +21,7 @@ let
      homepage = http://www.krename.net;
      description = "A powerful batch renamer for KDE";
      inherit (kconfig.meta) platforms;
-      maintainers = with maintainers; [ urkud peterhoeg ];
+      maintainers = with maintainers; [ peterhoeg ];
    };

    buildInputs = [ taglib exiv2 podofo ];
--- a/pkgs/applications/misc/krusader/default.nix
+++ b/pkgs/applications/misc/krusader/default.nix
@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
    description = "Norton/Total Commander clone for KDE";
    license = "GPL";
    homepage = http://www.krusader.org;
-    maintainers = with stdenv.lib.maintainers; [ sander urkud ];
+    maintainers = with stdenv.lib.maintainers; [ sander ];
    inherit (kdelibs4.meta) platforms;
  };
 }
--- a/pkgs/applications/misc/merkaartor/default.nix
+++ b/pkgs/applications/misc/merkaartor/default.nix
@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
    description = "An openstreetmap editor";
    homepage = http://merkaartor.org/;
    license = stdenv.lib.licenses.gpl2Plus;
-    maintainers = with stdenv.lib.maintainers; [viric urkud];
+    maintainers = with stdenv.lib.maintainers; [viric];
    inherit (qt4.meta) platforms;
  };
 }
--- a/pkgs/applications/misc/octoprint/plugins.nix
+++ b/pkgs/applications/misc/octoprint/plugins.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, octoprint, pythonPackages }:
+{ stdenv, fetchFromGitHub, fetchpatch, octoprint, pythonPackages }:

 let
  buildPlugin = args: pythonPackages.buildPythonApplication (args // {
@ -23,6 +23,11 @@ let

      patches = [
        ./m33-fio-one-library.patch
+        # Fix incompatibility with new OctoPrint
+        (fetchpatch {
+          url = "https://github.com/foosel/M33-Fio/commit/bdf2422dee3fb8e53b33f087f734956c3b209d72.patch";
+          sha256 = "0jm415sx6d3m0z4gfhbnxlasg08zf3f3mslaj4amn9wbvsik9s5d";
+        })
      ];

      postPatch = ''
--- a/pkgs/applications/misc/stog/default.nix
+++ b/pkgs/applications/misc/stog/default.nix
@ -0,0 +1,31 @@
+{ stdenv, fetchFromGitHub, ocaml, findlib, ocf, ptime,
+  uutf, uri, ppx_blob, xtmpl, ocaml_lwt, higlo, camlp4, omd
+}:
+
+stdenv.mkDerivation rec {
+  name = "stog-${version}";
+  version = "0.17.0";
+  src = fetchFromGitHub {
+    owner = "zoggy";
+    repo = "stog";
+    rev = "release-${version}";
+    sha256 = "06fnl3im0rycn05w39adfmm7w4s8l3jrj43h8f8h3b56grh21x0d";
+  };
+
+  buildInputs = [ ocaml camlp4 uutf ];
+  propagatedBuildInputs = [ findlib omd ppx_blob ocf ptime uri xtmpl ocaml_lwt higlo ];
+
+  createFindlibDestdir = true;
+
+  patches = [ ./install.patch ];
+
+  meta = with stdenv.lib; {
+    description = "XML documents and web site compiler";
+    homepage = "https://zoggy.github.io/stog/";
+    license = licenses.lgpl3;
+    platforms = ocaml.meta.platforms or [];
+    maintainers = with maintainers; [ regnat ];
+  };
+}
+
+
--- a/pkgs/applications/misc/stog/install.patch
+++ b/pkgs/applications/misc/stog/install.patch
@ -0,0 +1,18 @@
+diff --git a/src/Makefile b/src/Makefile
+index 736dd037..79a85b9c 100644
+--- a/src/Makefile
+++ b/src/Makefile
+@@ -431,11 +431,12 @@ install-lib:
+ install-share:
+ 
+ install-bin:
+	mkdir $(out)/bin
+ 	$(CP) $(MAIN) $(MAIN_BYTE) $(TMPL) $(TMPL_BYTE) \
+ 		$(SERVER) $(SERVER_BYTE) $(OCAML_SESSION) \
+ 	  $(MK_STOG) $(MK_STOG_BYTE) $(MK_STOG_OCAML) \
+ 	  $(LATEX2STOG) $(LATEX2STOG_BYTE) \
+-		`dirname \`which $(OCAMLC)\``/
+	  $(out)/bin
+ 
+ uninstall: uninstall-lib uninstall-share uninstall-bin
+ 
--- a/pkgs/applications/networking/browsers/firefox-bin/sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/sources.nix
--- a/pkgs/applications/networking/browsers/firefox/default.nix
+++ b/pkgs/applications/networking/browsers/firefox/default.nix
@ -153,8 +153,8 @@ in {

  firefox-unwrapped = common {
    pname = "firefox";
-    version = "52.0.1";
-    sha512 = "535e2cc0ee645d4ebe9f1d2d1f4fbb16ff5d1745ce493add6b2e323ca3b0907c3054705c5a15eaadb314d5d6474ba1825554fd1ff0780ab7f76fd3f9672a6974";
+    version = "52.0.2";
+    sha512 = "15668625d212acf874b560d0adf738faf3e0df532c549ab94e1d91944542e13bf16265f08fca1eded42820f9b7ad3f0ff70a8b5bc9adde0a79d11e022bb1158e";
    updateScript = import ./update.nix {
      attrPath = "firefox-unwrapped";
      inherit writeScript lib common-updater-scripts xidel coreutils gnused gnugrep curl;
@ -163,8 +163,8 @@ in {

  firefox-esr-unwrapped = common {
    pname = "firefox-esr";
-    version = "52.0.1esr";
-    sha512 = "c1f0aea279254e7788f62bba7892840edd2b667f385a649d374c9e783b93ec7faf9e5ebfccd04cd94f46da37aeb6bd7785d17faca2ad441a0b6e8587917faab2";
+    version = "52.0.2esr";
+    sha512 = "a0f31479e5265c7f40d3013c3dc8368c6bdf03f21f1c9054fb2ae5557065584da433b288b493680d6147a3b11155f41bd33ad2a5d53c6eaa507258c7e00d7335";
    updateScript = import ./update.nix {
      attrPath = "firefox-esr-unwrapped";
      versionSuffix = "esr";
--- a/pkgs/applications/networking/browsers/links2/default.nix
+++ b/pkgs/applications/networking/browsers/links2/default.nix
@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
  meta = with stdenv.lib; {
    homepage = http://links.twibright.com/;
    description = "A small browser with some graphics support";
-    maintainers = with maintainers; [ raskin urkud viric ];
+    maintainers = with maintainers; [ raskin viric ];
    platforms = platforms.unix;
  };
 }
--- a/pkgs/applications/networking/browsers/opera/default.nix
+++ b/pkgs/applications/networking/browsers/opera/default.nix
@ -37,7 +37,7 @@
 let

  mirror = https://get.geo.opera.com/pub/opera/desktop;
-  version = "43.0.2442.991";
+  version = "44.0.2510.857";

  rpath = stdenv.lib.makeLibraryPath [

@ -91,12 +91,12 @@ in stdenv.mkDerivation {
    if stdenv.system == "i686-linux" then
      fetchurl {
        url = "${mirror}/${version}/linux/opera-stable_${version}_i386.deb";
-        sha256 = "0gd30b5gs2n4ypyn2ky2dlz648akmss2kixb8dqsy4yfd0mz7xqr";
+        sha256 = "1589phaxbzmsr70afzqkrlm4fy4nwf2c0gn4rbv2ah2bq62bcp36";
      }
    else if stdenv.system == "x86_64-linux" then
      fetchurl {
        url = "${mirror}/${version}/linux/opera-stable_${version}_amd64.deb";
-        sha256 = "1pj2d3zhzyavv2gj3v5w07m14679k2vlbfk6sd9bjdy6g7fb5f7x";
+        sha256 = "1fah9pm42ljdcdqgxjikb03c8393smhh3g2rbkhrvmjwknba05ym";
      }
    else throw "Opera is not supported on ${stdenv.system} (only i686-linux and x86_64 linux are supported)";

--- a/pkgs/applications/networking/browsers/palemoon/default.nix
+++ b/pkgs/applications/networking/browsers/palemoon/default.nix
@ -3,21 +3,21 @@
 , dbus, dbus_glib, file, fontconfig, freetype
 , gstreamer, gst-plugins-base, gst_all_1
 , gtk2, hunspell, icu, libevent, libjpeg, libnotify
-, libstartup_notification, libvpx, makeWrapper, mesa 
-, nspr, nss, pango, perl, python, libpulseaudio, sqlite 
+, libstartup_notification, libvpx, makeWrapper, mesa
+, nspr, nss, pango, perl, python, libpulseaudio, sqlite
 , unzip, xlibs, which, yasm, zip, zlib
 }:

 stdenv.mkDerivation rec {
  name = "palemoon-${version}";
-  version = "27.1.1";
+  version = "27.2.1";

  src = fetchFromGitHub {
    name   = "palemoon-src";
    owner  = "MoonchildProductions";
    repo   = "Pale-Moon";
-    rev    = "a35936746069e6591181eb67e5f9ea094938bae5";
-    sha256 = "0hns5993dh93brwz3z4xp1zp8n90x1hajxylv17zybpysax64jsk";
+    rev    = version + "_Release";
+    sha256 = "1yyipxd5lmavf4aca4vrcnp7hb8zkn4sv2zp6n2cm6w4pxlza0g4";
  };

  desktopItem = makeDesktopItem {
@ -79,6 +79,8 @@ stdenv.mkDerivation rec {
  '';

  installPhase = ''
+    mkdir -p $out/share/applications
+    cp ${desktopItem}/share/applications/* $out/share/applications
    cd $builddir
    $src/mach install
  '';
--- a/pkgs/applications/networking/browsers/surf/webkit2.nix
+++ b/pkgs/applications/networking/browsers/surf/webkit2.nix
@ -6,9 +6,9 @@

 let
  # http://git.suckless.org/surf/log/?h=surf-webkit2
-  rev = "37e43501d80710533f3ec0bd61ee84916c8524a4";
-  sha256 = "1q388rzm4irpaam4z8xycbyh5dgkjlar5jn1iw7zfls1pbpzr5br";
-  date = "2017-03-06";
+  rev = "7e02344a615a61246ccce1c7f770e88fbd57756e";
+  sha256 = "11f93fbjhl7nfgwkcc45lcm3x1wk5h87ap8fbw9w855021i57pp6";
+  date = "2017-03-22";
 in

 stdenv.mkDerivation rec {
--- a/pkgs/applications/networking/browsers/torbrowser/default.nix
+++ b/pkgs/applications/networking/browsers/torbrowser/default.nix
@ -0,0 +1,329 @@
+{ stdenv
+, fetchurl
+, makeDesktopItem
+
+# Common run-time dependencies
+, zlib
+
+# libxul run-time dependencies
+, alsaLib
+, atk
+, cairo
+, dbus
+, dbus_glib
+, fontconfig
+, freetype
+, gdk_pixbuf
+, glib
+, gtk2
+, libX11
+, libXext
+, libXrender
+, libXt
+, pango
+
+# Pulseaudio support
+, pulseaudioSupport ? mediaSupport
+, libpulseaudio
+
+# Media support (implies pulseaudio support)
+, mediaSupport ? false
+, gstreamer
+, gst-plugins-base
+, gst-plugins-good
+, gst-ffmpeg
+, gmp
+, ffmpeg
+
+# Pluggable transport dependencies
+, python27
+}:
+
+with stdenv.lib;
+
+let
+  libPath = makeLibraryPath ([
+    alsaLib
+    atk
+    cairo
+    dbus
+    dbus_glib
+    fontconfig
+    freetype
+    gdk_pixbuf
+    glib
+    gtk2
+    libX11
+    libXext
+    libXrender
+    libXt
+    pango
+    stdenv.cc.cc
+    zlib
+  ]
+  ++ optionals pulseaudioSupport [ libpulseaudio ]
+  ++ optionals mediaSupport [
+    gstreamer
+    gst-plugins-base
+    gmp
+    ffmpeg
+  ]);
+
+  gstPluginsPath = concatMapStringsSep ":" (x:
+    "${x}/lib/gstreamer-0.10") [
+      gstreamer
+      gst-plugins-base
+      gst-plugins-good
+      gst-ffmpeg
+    ];
+
+  # Library search path for the fte transport
+  fteLibPath = makeLibraryPath [ stdenv.cc.cc gmp ];
+
+  # Upstream source
+  version = "6.5.1";
+
+  lang = "en-US";
+
+  srcs = {
+    "x86_64-linux" = fetchurl {
+      url = "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz";
+      sha256 = "1p2bgavvyzahqpjg9vp14c0s50rmha3v1hs1c8zvz6fj8fgrhn0i";
+    };
+
+    "i686-linux" = fetchurl {
+      url = "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux32-${version}_${lang}.tar.xz";
+      sha256 = "1zfghr01bhpn39wqaw7hyx7yap7xyla4m3mrgz2vi9a5qsyxmbcr";
+    };
+  };
+in
+
+stdenv.mkDerivation rec {
+  name = "tor-browser-${version}";
+  inherit version;
+
+  src = srcs."${stdenv.system}" or (throw "unsupported system: ${stdenv.system}");
+
+  preferLocalBuild = true;
+
+  desktopItem = makeDesktopItem {
+    name = "torbrowser";
+    exec = "tor-browser";
+    icon = "torbrowser";
+    desktopName = "Tor Browser";
+    genericName = "Web Browser";
+    comment = meta.description;
+    categories = "Network;WebBrowser;Security;";
+  };
+
+  buildCommand = ''
+    # For convenience ...
+    TBB_IN_STORE=$out/share/tor-browser
+    interp=$(< $NIX_CC/nix-support/dynamic-linker)
+
+    # Unpack & enter
+    mkdir -p "$TBB_IN_STORE"
+    tar xf "${src}" -C "$TBB_IN_STORE" --strip-components=2
+    pushd "$TBB_IN_STORE"
+
+    # Set ELF interpreter
+    for exe in firefox TorBrowser/Tor/tor ; do
+      patchelf --set-interpreter "$interp" "$exe"
+    done
+
+    # The final libPath.  Note, we could split this into firefoxLibPath
+    # and torLibPath for accuracy, but this is more convenient ...
+    libPath=${libPath}:$TBB_IN_STORE:$TBB_IN_STORE/TorBrowser/Tor
+
+    # Fixup paths to pluggable transports.
+    sed -i TorBrowser/Data/Tor/torrc-defaults \
+        -e "s,./TorBrowser,$TBB_IN_STORE/TorBrowser,g"
+
+    # Fixup obfs transport.  Work around patchelf failing to set
+    # interpreter for pre-compiled Go binaries by invoking the interpreter
+    # directly.
+    sed -i TorBrowser/Data/Tor/torrc-defaults \
+        -e "s|\(ClientTransportPlugin obfs2,obfs3,obfs4,scramblesuit\) exec|\1 exec $interp|" \
+
+    # Fixup fte transport
+    #
+    # Note: the script adds its dirname to search path automatically
+    sed -i TorBrowser/Tor/PluggableTransports/fteproxy.bin \
+        -e "s,/usr/bin/env python,${python27.interpreter},"
+
+    patchelf --set-rpath "${fteLibPath}" TorBrowser/Tor/PluggableTransports/fte/cDFA.so
+
+    # Prepare for autoconfig.
+    #
+    # See https://developer.mozilla.org/en-US/Firefox/Enterprise_deployment
+    cat >defaults/pref/autoconfig.js <<EOF
+    //
+    pref("general.config.filename", "mozilla.cfg");
+    pref("general.config.obscure_value", 0);
+    EOF
+
+    # Hard-coded Firefox preferences.
+    cat >mozilla.cfg <<EOF
+    // First line must be a comment
+
+    // Always update via Nix
+    lockPref("app.update.auto", false);
+    lockPref("app.update.enabled", false);
+    lockPref("extensions.update.autoUpdateDefault", false);
+    lockPref("extensions.update.enabled", false);
+
+    // User should never change these.  Locking prevents these
+    // values from being written to prefs.js, avoiding Store
+    // path capture.
+    lockPref("extensions.torlauncher.torrc-defaults_path", "$TBB_IN_STORE/TorBrowser/Data/Tor/torrc-defaults");
+    lockPref("extensions.torlauncher.tor_path", "$TBB_IN_STORE/TorBrowser/Tor/tor");
+
+    // Reset pref that captures store paths.
+    clearPref("extensions.xpiState");
+
+    // Stop obnoxious first-run redirection.
+    lockPref("noscript.firstRunRedirection", false);
+    EOF
+
+    # Hard-code path to TBB fonts; see also FONTCONFIG_FILE in
+    # the wrapper below.
+    FONTCONFIG_FILE=$TBB_IN_STORE/TorBrowser/Data/fontconfig/fonts.conf
+    sed -i "$FONTCONFIG_FILE" \
+        -e "s,<dir>fonts</dir>,<dir>$TBB_IN_STORE/fonts</dir>,"
+
+    # Move default extension overrides into distribution dir, to avoid
+    # having to synchronize between local state and store.
+    mv TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js defaults/pref/torbrowser.js
+
+    # Hard-code paths to geoip data files.  TBB resolves the geoip files
+    # relative to torrc-defaults_path but if we do not hard-code them
+    # here, these paths end up being written to the torrc in the user's
+    # state dir.
+    cat >>TorBrowser/Data/Tor/torrc-defaults <<EOF
+    GeoIPFile $TBB_IN_STORE/TorBrowser/Data/Tor/geoip
+    GeoIPv6File $TBB_IN_STORE/TorBrowser/Data/Tor/geoip6
+    EOF
+
+    # Generate wrapper
+    mkdir -p $out/bin
+    cat > "$out/bin/tor-browser" << EOF
+    #! ${stdenv.shell}
+    set -o errexit -o nounset
+
+    # Enter local state directory.
+    REAL_HOME=\$HOME
+    TBB_HOME=\''${TBB_HOME:-''${XDG_DATA_HOME:-\$REAL_HOME/.local/share}/tor-browser}
+    HOME=\$TBB_HOME
+
+    mkdir -p "\$HOME"
+    cd "\$HOME"
+
+    # Initialize empty TBB local state directory hierarchy.  We
+    # intentionally mirror the layout that TBB would see if executed from
+    # the unpacked bundle dir.
+    mkdir -p "\$HOME/TorBrowser" "\$HOME/TorBrowser/Data"
+
+    # Initialize the Tor data directory.
+    mkdir -p "\$HOME/TorBrowser/Data/Tor"
+
+    # Initialize the browser profile state.  Note that the only data
+    # copied from the Store payload is the initial bookmark file, which is
+    # never updated once created.  All other files under user's profile
+    # dir are generated by TBB.
+    mkdir -p "\$HOME/TorBrowser/Data/Browser/profile.default"
+    cp -u --no-preserve=mode,owner "$TBB_IN_STORE/TorBrowser/Data/Browser/profile.default/bookmarks.html" \
+      "\$HOME/TorBrowser/Data/Browser/profile.default/bookmarks.html"
+
+    # Clear out some files that tend to capture store references but are
+    # easily generated by firefox at startup.
+    rm -f "\$HOME/TorBrowser/Data/Browser/profile.default"/{compatibility.ini,extensions.ini,extensions.json}
+
+    # Ensure that we're always using the up-to-date extensions.
+    ln -snf "$TBB_IN_STORE/TorBrowser/Data/Browser/profile.default/extensions" \
+      "\$HOME/TorBrowser/Data/Browser/profile.default/extensions"
+
+    ${optionalString pulseaudioSupport ''
+      # Figure out some envvars for pulseaudio
+      : "\''${XDG_RUNTIME_DIR:=/run/user/\$(id -u)}"
+      : "\''${XDG_CONFIG_HOME:=\$REAL_HOME/.config}"
+      : "\''${PULSE_SERVER:=\$XDG_RUNTIME_DIR/pulse/native}"
+      : "\''${PULSE_COOKIE:=\$XDG_CONFIG_HOME/pulse/cookie}"
+    ''}
+
+    # Font cache files capture store paths; clear them out on the off
+    # chance that TBB would continue using old font files.
+    rm -rf "\$HOME/.cache/fontconfig"
+
+    # Lift-off
+    #
+    # XAUTHORITY and DISPLAY are required for TBB to work at all.
+    #
+    # DBUS_SESSION_BUS_ADDRESS is inherited to avoid auto-launch; to
+    # prevent that, set it to an empty/invalid value prior to running
+    # tor-browser.
+    #
+    # PULSE_SERVER is necessary for audio playback.
+    #
+    # Setting FONTCONFIG_FILE is required to make fontconfig read the TBB
+    # fonts.conf; upstream uses FONTCONFIG_PATH, but FC_DEBUG=1024
+    # indicates the system fonts.conf being used instead.
+    exec env -i \
+      HOME="\$HOME" \
+      XAUTHORITY="\$XAUTHORITY" \
+      DISPLAY="\$DISPLAY" \
+      DBUS_SESSION_BUS_ADDRESS="\$DBUS_SESSION_BUS_ADDRESS" \
+      \
+      PULSE_SERVER="\''${PULSE_SERVER:-}" \
+      PULSE_COOKIE="\''${PULSE_COOKIE:-}" \
+      \
+      GST_PLUGIN_SYSTEM_PATH="${optionalString mediaSupport gstPluginsPath}" \
+      GST_REGISTRY="/dev/null" \
+      GST_REGISTRY_UPDATE="no" \
+      \
+      FONTCONFIG_FILE="$FONTCONFIG_FILE" \
+      \
+      LD_LIBRARY_PATH="$libPath" \
+      \
+      "$TBB_IN_STORE/firefox" \
+        --class "Tor Browser" \
+        -no-remote \
+        -profile "\$HOME/TorBrowser/Data/Browser/profile.default" \
+        "\''${@}"
+    EOF
+    chmod +x $out/bin/tor-browser
+
+    # Easier access to docs
+    mkdir -p $out/share/doc
+    ln -s $TBB_IN_STORE/TorBrowser/Docs $out/share/doc/tor-browser
+
+    # Install .desktop item
+    mkdir -p $out/share/applications
+    cp $desktopItem/share/applications"/"* $out/share/applications
+    sed -i $out/share/applications/torbrowser.desktop \
+        -e "s,Exec=.*,Exec=$out/bin/tor-browser,"
+
+    # Install icons
+    mkdir -p $out/share/pixmaps
+    cp browser/icons/mozicon128.png $out/share/pixmaps/torbrowser.png
+
+    # Check installed apps
+    echo "Checking bundled Tor ..."
+    LD_LIBRARY_PATH=$libPath $TBB_IN_STORE/TorBrowser/Tor/tor --version >/dev/null
+
+    echo "Checking tor-browser wrapper ..."
+    DISPLAY="" XAUTHORITY="" DBUS_SESSION_BUS_ADDRESS="" TBB_HOME=$(mktemp -d) \
+      $out/bin/tor-browser --version >/dev/null
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Tor Browser Bundle";
+    homepage = https://www.torproject.org/;
+    platforms = attrNames srcs;
+    maintainers = with maintainers; [ offline matejc doublec thoughtpolice joachifm ];
+    hydraPlatforms = [];
+    # MPL2.0+, GPL+, &c.  While it's not entirely clear whether
+    # the compound is "libre" in a strict sense (some components place certain
+    # restrictions on redistribution), it's free enough for our purposes.
+    license = licenses.free;
+  };
+}
--- a/pkgs/applications/networking/cluster/kubernetes/default.nix
+++ b/pkgs/applications/networking/cluster/kubernetes/default.nix
@ -18,13 +18,13 @@ with lib;

 stdenv.mkDerivation rec {
  name = "kubernetes-${version}";
-  version = "1.5.4";
+  version = "1.5.6";

  src = fetchFromGitHub {
    owner = "kubernetes";
    repo = "kubernetes";
    rev = "v${version}";
-    sha256 = "1xhz6m6ly6ffj60id9ms1liijlrik8n2pxyzb5m77ym3zf7rxlpl";
+    sha256 = "0mkg4vgz9szgq1k5ignkdr5gmg703xlq8zsrr422a1qfqb8zp15w";
  };

  buildInputs = [ removeReferencesTo makeWrapper which go rsync go-bindata ];
--- a/pkgs/applications/networking/cluster/spark/default.nix
+++ b/pkgs/applications/networking/cluster/spark/default.nix
@ -1,4 +1,5 @@
 { stdenv, fetchzip, makeWrapper, jre, pythonPackages
+, RSupport? true, R
 , mesosSupport ? true, mesos
 , version
 }:
@ -30,6 +31,7 @@ stdenv.mkDerivation rec {
  };

  buildInputs = [ makeWrapper jre pythonPackages.python pythonPackages.numpy ]
+    ++ optional RSupport R
    ++ optional mesosSupport mesos;

  untarDir = "${name}-bin-${hadoopVersion}";
@ -46,6 +48,9 @@ stdenv.mkDerivation rec {
    export SPARK_HOME="$out/lib/${untarDir}"
    export PYSPARK_PYTHON="${pythonPackages.python}/bin/${pythonPackages.python.executable}"
    export PYTHONPATH="\$PYTHONPATH:$PYTHONPATH"
+    ${optionalString RSupport
+      ''export SPARKR_R_SHELL="${R}/bin/R"
+        export PATH=$PATH:"${R}/bin/R"''}
    ${optionalString mesosSupport
      ''export MESOS_NATIVE_LIBRARY="$MESOS_NATIVE_LIBRARY"''}
    EOF
@ -57,7 +62,7 @@ stdenv.mkDerivation rec {
  '';

  meta = {
-    description      = "Lightning-fast cluster computing";
+    description      = "Apache Spark is a fast and general engine for large-scale data processing";
    homepage         = "http://spark.apache.org";
    license          = stdenv.lib.licenses.asl20;
    platforms        = stdenv.lib.platforms.all;
--- a/pkgs/applications/networking/dropbox-cli/default.nix
+++ b/pkgs/applications/networking/dropbox-cli/default.nix
@ -18,6 +18,8 @@ stdenv.mkDerivation {
  installPhase = ''
    mkdir -p "$out/bin/" "$out/share/applications"
    cp data/dropbox.desktop "$out/share/applications"
+    cp -a data/icons "$out/share/icons"
+    find "$out/share/icons" -type f \! -name '*.png' -delete
    substitute "dropbox.in" "$out/bin/dropbox" \
      --replace '@PACKAGE_VERSION@' ${version} \
      --replace '@DESKTOP_FILE_DIR@' "$out/share/applications" \
--- a/pkgs/applications/networking/dropbox/default.nix
+++ b/pkgs/applications/networking/dropbox/default.nix
@ -3,7 +3,7 @@
 , libdrm, libffi, libICE, libSM
 , libX11, libXcomposite, libXext, libXmu, libXrender, libxcb
 , libxml2, libxslt, ncurses, zlib
-, qtbase, qtdeclarative, qtwebkit
+, qtbase, qtdeclarative, qtwebkit, makeQtWrapper
 }:

 # this package contains the daemon version of dropbox
@ -23,11 +23,11 @@
 let
  # NOTE: When updating, please also update in current stable,
  # as older versions stop working
-  version = "21.4.25";
+  version = "22.4.24";
  sha256 =
    {
-      "x86_64-linux" = "1pgab1ah6rl30rm4dj0biq5714pfzd5jjd2bp0nmhdqn1hm5vmhv";
-      "i686-linux"   = "05kn8qman8ghknb0chrlmcxrxg7w6l79frkaqj6blgnhanh13h4n";
+      "x86_64-linux" = "1353mwk8hjqfc9a87zrp12klsc4anrxr7ccai4cffnq0yw2pnbfp";
+      "i686-linux"   = "07gpdxq61qkj3c4aywh61zwj34w7j24gcv5y2xf2qgcwn8bykks2";
    }."${stdenv.system}" or (throw "system ${stdenv.system} not supported");

  arch =
@ -68,31 +68,23 @@ in stdenv.mkDerivation {

  sourceRoot = ".dropbox-dist";

-  nativeBuildInputs = [ makeWrapper patchelf ];
-  dontPatchELF = true; # patchelf invoked explicitly below
+  nativeBuildInputs = [ makeQtWrapper patchelf ];
  dontStrip = true; # already done

  installPhase = ''
    mkdir -p "$out/${appdir}"
    cp -r --no-preserve=mode "dropbox-lnx.${arch}-${version}"/* "$out/${appdir}/"

+    # Vendored libraries interact poorly with our graphics drivers
    rm "$out/${appdir}/libdrm.so.2"
    rm "$out/${appdir}/libffi.so.6"
    rm "$out/${appdir}/libGL.so.1"
    rm "$out/${appdir}/libX11-xcb.so.1"

-    rm "$out/${appdir}/libQt5Core.so.5"
-    rm "$out/${appdir}/libQt5DBus.so.5"
-    rm "$out/${appdir}/libQt5Gui.so.5"
-    rm "$out/${appdir}/libQt5Network.so.5"
-    rm "$out/${appdir}/libQt5OpenGL.so.5"
-    rm "$out/${appdir}/libQt5PrintSupport.so.5"
-    rm "$out/${appdir}/libQt5Qml.so.5"
-    rm "$out/${appdir}/libQt5Quick.so.5"
-    rm "$out/${appdir}/libQt5Sql.so.5"
-    rm "$out/${appdir}/libQt5WebKit.so.5"
-    rm "$out/${appdir}/libQt5WebKitWidgets.so.5"
-    rm "$out/${appdir}/libQt5XcbQpa.so.5"
+    # Cannot use vendored Qt libraries due to problem with xkbcommon
+    rm "$out/${appdir}/"libQt5*.so.5
+    rm "$out/${appdir}/qt.conf"
+    rm -fr "$out/${appdir}/plugins"

    mkdir -p "$out/share/applications"
    cp "${desktopItem}/share/applications/"* $out/share/applications
@ -102,7 +94,7 @@ in stdenv.mkDerivation {

    mkdir -p "$out/bin"
    RPATH="${ldpath}:$out/${appdir}"
-    makeWrapper "$out/${appdir}/dropbox" "$out/bin/dropbox" \
+    makeQtWrapper "$out/${appdir}/dropbox" "$out/bin/dropbox" \
      --prefix LD_LIBRARY_PATH : "$RPATH"

    chmod 755 $out/${appdir}/dropbox
@ -112,33 +104,22 @@ in stdenv.mkDerivation {
    INTERP=$(cat $NIX_CC/nix-support/dynamic-linker)
    RPATH="${ldpath}:$out/${appdir}"
    getType='s/ *Type: *\([A-Z]*\) (.*/\1/'
-    find "$out/${appdir}" -type f -a -perm -0100 -print | while read obj; do
+    find "$out/${appdir}" -type f -print | while read obj; do
        dynamic=$(readelf -S "$obj" 2>/dev/null | grep "DYNAMIC" || true)
-
        if [[ -n "$dynamic" ]]; then
-            type=$(readelf -h "$obj" 2>/dev/null | grep 'Type:' | sed -e "$getType")
-
-            if [[ "$type" == "EXEC" ]]; then

+            if readelf -l "$obj" 2>/dev/null | grep "INTERP" >/dev/null; then
                echo "patching interpreter path in $type $obj"
                patchelf --set-interpreter "$INTERP" "$obj"
+            fi
+
+            type=$(readelf -h "$obj" 2>/dev/null | grep 'Type:' | sed -e "$getType")
+            if [ "$type" == "EXEC" ] || [ "$type" == "DYN" ]; then

                echo "patching RPATH in $type $obj"
                oldRPATH=$(patchelf --print-rpath "$obj")
                patchelf --set-rpath "''${oldRPATH:+$oldRPATH:}$RPATH" "$obj"

-                echo "shrinking RPATH in $type $obj"
-                patchelf --shrink-rpath "$obj"
-
-            elif [[ "$type" == "DYN" ]]; then
-
-                echo "patching RPATH in $type $obj"
-                oldRPATH=$(patchelf --print-rpath "$obj")
-                patchelf --set-rpath "''${oldRPATH:+$oldRPATH:}$RPATH" "$obj"
-
-                echo "shrinking RPATH in $type $obj"
-                patchelf --shrink-rpath "$obj"
-
            else

                echo "unknown ELF type \"$type\"; not patching $obj"
--- a/pkgs/applications/networking/ftp/filezilla/default.nix
+++ b/pkgs/applications/networking/ftp/filezilla/default.nix
@ -1,13 +1,13 @@
 { stdenv, fetchurl, dbus, gnutls, wxGTK30, libidn, tinyxml, gettext
 , pkgconfig, xdg_utils, gtk2, sqlite, pugixml, libfilezilla, nettle }:

-let version = "3.25.0"; in
+let version = "3.25.1"; in
 stdenv.mkDerivation {
  name = "filezilla-${version}";

  src = fetchurl {
    url = "mirror://sourceforge/project/filezilla/FileZilla_Client/${version}/FileZilla_${version}_src.tar.bz2";
-    sha256 = "1b1lb1zvm887xy3q9i5ziqvwk4ww2pd81a1msbwjrxzy5lq5ykhh";
+    sha256 = "1h9g26i16wvc3yjavd39lxifr8d21q9mvfidnwjp9ksrc1qvwww8";
  };

  configureFlags = [
--- a/pkgs/applications/networking/instant-messengers/bitlbee-facebook/default.nix
+++ b/pkgs/applications/networking/instant-messengers/bitlbee-facebook/default.nix
@ -2,16 +2,19 @@

 with stdenv.lib;
 stdenv.mkDerivation rec {
-  name = "bitlbee-facebook-2015-08-27";
+  name = "bitlbee-facebook-${version}";
+  version = "1.1.0";

  src = fetchFromGitHub {
-    rev = "094a11b542e2cd8fac4f00fe01870ecd1cb4c062";
+    rev = "v${version}";
    owner = "jgeboski";
    repo = "bitlbee-facebook";
-    sha256 = "1dvbl1z6fl3wswvqbs82vkqlggk24dyi8w7cmm5jh1fmaznmwqrl";
+    sha256 = "0qclyc2zz8144dc42bhfv2xxrahpiv9j2iwq9h3cmfxszvkb8r3s";
  };

-  buildInputs = [ bitlbee autoconf automake libtool pkgconfig glib json_glib ];
+  nativeBuildInputs = [ autoconf automake libtool pkgconfig ];
+
+  buildInputs = [ bitlbee glib json_glib ];

  preConfigure = ''
    export BITLBEE_PLUGINDIR=$out/lib/bitlbee
--- a/pkgs/applications/networking/instant-messengers/messenger-for-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/messenger-for-desktop/default.nix
@ -0,0 +1,104 @@
+{
+  stdenv, fetchurl, dpkg, alsaLib, atk, cairo, cups, curl, dbus, expat,
+  fontconfig, freetype, glib, gnome2, libnotify, nspr, nss, systemd, xorg
+}:
+
+with stdenv.lib;
+
+let
+
+  version = "2.0.6";
+
+  rpath = makeLibraryPath [
+    alsaLib
+    atk
+    cairo
+    cups
+    curl
+    dbus
+    expat
+    fontconfig
+    freetype
+    glib
+    gnome2.GConf
+    gnome2.gdk_pixbuf
+    gnome2.gtk
+    gnome2.pango
+    libnotify
+    nspr
+    nss
+    stdenv.cc.cc
+    systemd
+
+    xorg.libxkbfile
+    xorg.libX11
+    xorg.libXcomposite
+    xorg.libXcursor
+    xorg.libXdamage
+    xorg.libXext
+    xorg.libXfixes
+    xorg.libXi
+    xorg.libXrandr
+    xorg.libXrender
+    xorg.libXtst
+    xorg.libXScrnSaver
+  ] + ":${stdenv.cc.cc.lib}/lib64";
+
+  src =
+    if stdenv.system == "x86_64-linux" then
+      fetchurl {
+        url = "https://github.com/aluxian/Messenger-for-Desktop/releases/download/v2.0.6/messengerfordesktop-2.0.6-linux-amd64.deb";
+        sha256 = "bf3f3ed9ac46ceb4b7dffbeb33c7d15bbcbfcdd141c4dbfbb620e8bfefae906b";
+      }
+    else
+      throw "Messenger for Desktop is not supported on ${stdenv.system}";
+
+in stdenv.mkDerivation {
+  name = "messenger-for-desktop-${version}";
+
+  inherit src;
+
+  buildInputs = [ dpkg ];
+  unpackPhase = "true";
+  buildCommand = ''
+    mkdir -p $out
+    dpkg -x $src $out
+
+    mv $out/usr/share $out/share
+    mv $out/opt/messengerfordesktop $out/libexec
+    rmdir $out/usr $out/opt
+
+    chmod -R g-w $out
+
+    # patch the binaries
+    for file in $(find $out -type f \( -perm /0111 -o -name \*.so\* \) ); do
+      patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" "$file" || true
+      patchelf --set-rpath ${rpath}:$out/libexec $file || true
+    done
+
+    # add symlink to bin
+    mkdir -p $out/bin
+    ln -s $out/libexec/messengerfordesktop $out/bin/messengerfordesktop
+
+    # Fix the desktop link
+    substituteInPlace $out/share/applications/messengerfordesktop.desktop                 \
+      --replace /opt/messengerfordesktop/messengerfordesktop $out/bin/messengerfordesktop 
+  '';
+
+  meta = {
+    description = "Bring messenger.com to your Linux desktop.";
+    longDescription = ''
+      A simple & beautiful desktop client for Facebook Messenger. Chat without
+      distractions on OS X, Windows and Linux. Not affiliated with Facebook.
+      This is NOT an official product.
+    '';
+    homepage = https://messengerfordesktop.org;
+    license = licenses.mit;
+    maintainers = [
+      maintainers.shawndellysse
+    ];
+    platforms = [
+      "x86_64-linux"
+    ];
+  };
+}
--- a/pkgs/applications/networking/instant-messengers/pidgin-plugins/sipe/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pidgin-plugins/sipe/default.nix
@ -1,13 +1,13 @@
 { stdenv, fetchurl, pidgin, intltool, libxml2, nss, nspr }:

-let version = "1.20.0"; in
+let version = "1.22.0"; in

 stdenv.mkDerivation {
  name = "pidgin-sipe-${version}";

  src = fetchurl {
    url = "mirror://sourceforge/sipe/pidgin-sipe-${version}.tar.gz";
-    sha256 = "14d8q9by531hfssm6ydn75xkgidka3ar4sy3czjdb03s1ps82srs";
+    sha256 = "1aeb348e2ba79b82b1fd102555f86cdc42eaa6f9e761b771d74c4f9c9cf15fc3";
  };

  meta = with stdenv.lib; {
--- a/pkgs/applications/networking/instant-messengers/telegram/cutegram/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/cutegram/default.nix
@ -36,6 +36,7 @@ stdenv.mkDerivation rec {
    license = licenses.gpl3;
    maintainers = with maintainers; [ profpatsch AndersonTorres ];
    platforms = platforms.linux;
+    broken = true;
  };
 }
 #TODO: appindicator, for system tray plugin (by @profpatsch)
--- a/pkgs/applications/networking/instant-messengers/telepathy/kde/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telepathy/kde/default.nix
@ -54,7 +54,7 @@ let

        meta = {
          inherit (kdelibs4.meta) platforms;
-          maintainers = [ stdenv.lib.maintainers.urkud ];
+          maintainers = [ ];
        };
      }
    );
--- a/pkgs/applications/networking/instant-messengers/telepathy/logger/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telepathy/logger/default.nix
@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
  meta = {
    description = "Logger service for Telepathy framework";
    homepage = http://telepathy.freedesktop.org/wiki/Logger ;
-    maintainers = [ stdenv.lib.maintainers.urkud ];
+    maintainers = [ ];
    platforms = stdenv.lib.platforms.gnu; # Arbitrary choice
  };
 }
--- a/pkgs/applications/networking/instant-messengers/telepathy/rakia/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telepathy/rakia/default.nix
@ -1,19 +0,0 @@
-{ stdenv, fetchurl, pkgconfigUpstream, libxslt, telepathy_glib, libxml2, dbus_glib
-, sofia_sip }:
-
-stdenv.mkDerivation rec {
-  pname = "telepathy-rakia";
-  name = "${pname}-0.8.0";
-
-  src = fetchurl {
-    url = "${meta.homepage}/releases/${pname}/${name}.tar.gz";
-    sha256 = "18dxffa8hhjyvqkhhac05rrkx81vnncjrakg5ygikfp0j79vrbhv";
-  };
-
-  nativeBuildInputs = [pkgconfigUpstream libxslt ];
-  buildInputs = [ libxml2 dbus_glib telepathy_glib sofia_sip telepathy_glib.python ];
-
-  meta = {
-    homepage = http://telepathy.freedesktop.org;
-  };
-}
--- a/Show More
+++ b/Show More