Merge remote-tracking branch 'upstream/master' into gcc-6

2017-01-23 00:21:18 +01:00 · 2017-01-23 00:21:18 +01:00 · 563dd7886c
parent f6a46e0be5 13d6681ce7
commit 563dd7886c
394 changed files with 10106 additions and 13996 deletions
--- a/doc/stdenv.xml
+++ b/doc/stdenv.xml
@ -1401,8 +1401,15 @@ These can be toggled using the <varname>stdenv.mkDerivation</varname> parameters
 <varname>hardeningDisable</varname> and <varname>hardeningEnable</varname>.
 </para>

-<para>The following flags are enabled by default and might require disabling
-if the program to package is incompatible.
+<para>
+Both parameters take a list of flags as strings. The special
+<varname>"all"</varname> flag can be passed to <varname>hardeningDisable</varname>
+to turn off all hardening. These flags can also be used as environment variables
+for testing or development purposes.
+</para>
+
+<para>The following flags are enabled by default and might require disabling with
+<varname>hardeningDisable</varname> if the program to package is incompatible.
 </para>

 <variablelist>
@ -1563,7 +1570,8 @@ intel_drv.so: undefined symbol: vgaHWFreeHWRec
 </variablelist>

 <para>The following flags are disabled by default and should be enabled
-for packages that take untrusted input, like network services.
+with <varname>hardeningEnable</varname> for packages that take untrusted
+input like network services.
 </para>

 <variablelist>
--- a/lib/maintainers.nix
+++ b/lib/maintainers.nix
@ -27,6 +27,7 @@
  akaWolf = "Artjom Vejsel <akawolf0@gmail.com>";
  akc = "Anders Claesson <akc@akc.is>";
  algorith = "Dries Van Daele <dries_van_daele@telenet.be>";
+  alibabzo = "Alistair Bill <alistair.bill@gmail.com>";
  all = "Nix Committers <nix-commits@lists.science.uu.nl>";
  ambrop72 = "Ambroz Bizjak <ambrop7@gmail.com>";
  amiddelk = "Arie Middelkoop <amiddelk@gmail.com>";
@ -102,6 +103,7 @@
  corngood = "David McFarland <corngood@gmail.com>";
  coroa = "Jonas Hörsch <jonas@chaoflow.net>";
  couchemar = "Andrey Pavlov <couchemar@yandex.ru>";
+  cpages = "Carles Pagès <page@ruiec.cat>";
  cransom = "Casey Ransom <cransom@hubns.net>";
  cryptix = "Henry Bubert <cryptix@riseup.net>";
  CrystalGamma = "Jona Stubbe <nixos@crystalgamma.de>";
@ -350,7 +352,6 @@
  osener = "Ozan Sener <ozan@ozansener.com>";
  otwieracz = "Slawomir Gonet <slawek@otwiera.cz>";
  oxij = "Jan Malakhovski <oxij@oxij.org>";
-  page = "Carles Pagès <page@cubata.homelinux.net>";
  paholg = "Paho Lurie-Gregg <paho@paholg.com>";
  pakhfn = "Fedor Pakhomov <pakhfn@gmail.com>";
  palo = "Ingolf Wanger <palipalo9@googlemail.com>";
--- a/nixos/modules/config/networking.nix
+++ b/nixos/modules/config/networking.nix
@ -13,7 +13,7 @@ let

  resolvconfOptions = cfg.resolvconfOptions
    ++ optional cfg.dnsSingleRequest "single-request"
-    ++ optional cfg.dnsExtensionMechanism "ends0";
+    ++ optional cfg.dnsExtensionMechanism "edns0";
 in

 {
--- a/nixos/modules/i18n/input-method/ibus.nix
+++ b/nixos/modules/i18n/input-method/ibus.nix
@ -10,6 +10,11 @@ let
    check = x: (lib.types.package.check x) && (attrByPath ["meta" "isIbusEngine"] false x);
  };

+  impanel =
+    if cfg.panel != null
+    then "--panel=${cfg.panel}"
+    else "";
+
  ibusAutostart = pkgs.writeTextFile {
    name = "autostart-ibus-daemon";
    destination = "/etc/xdg/autostart/ibus-daemon.desktop";
@ -17,7 +22,7 @@ let
      [Desktop Entry]
      Name=IBus
      Type=Application
-      Exec=${ibusPackage}/bin/ibus-daemon --daemonize --xim
+      Exec=${ibusPackage}/bin/ibus-daemon --daemonize --xim ${impanel}
    '';
  };
 in
@ -36,6 +41,12 @@ in
          in
            "Enabled IBus engines. Available engines are: ${engines}.";
      };
+      panel = mkOption {
+        type = with types; nullOr path;
+        default = null;
+        example = literalExample "${pkgs.kde5.plasma-desktop}/lib/libexec/kimpanel-ibus-panel";
+        description = "Replace the IBus panel with another panel.";
+      };
    };
  };

--- a/nixos/modules/misc/ids.nix
+++ b/nixos/modules/misc/ids.nix
@ -283,6 +283,7 @@
      keystone = 265;
      glance = 266;
      couchpotato = 267;
+      gogs = 268;

      # When adding a uid, make sure it doesn't match an existing gid. And don't use uids above 399!

@ -536,6 +537,7 @@
      keystone = 265;
      glance = 266;
      couchpotato = 267;
+      gogs = 268;

      # When adding a gid, make sure it doesn't match an existing
      # uid. Users and groups with the same name should have equal
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -258,6 +258,7 @@
  #./services/misc/gitit.nix
  ./services/misc/gitlab.nix
  ./services/misc/gitolite.nix
+  ./services/misc/gogs.nix
  ./services/misc/gpsd.nix
  ./services/misc/ihaskell.nix
  ./services/misc/leaps.nix
@ -311,6 +312,7 @@
  ./services/monitoring/monit.nix
  ./services/monitoring/munin.nix
  ./services/monitoring/nagios.nix
+  ./services/monitoring/netdata.nix
  ./services/monitoring/prometheus/default.nix
  ./services/monitoring/prometheus/alertmanager.nix
  ./services/monitoring/prometheus/blackbox-exporter.nix
--- a/nixos/modules/services/misc/gogs.nix
+++ b/nixos/modules/services/misc/gogs.nix
@ -0,0 +1,215 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.gogs;
+  configFile = pkgs.writeText "app.ini" ''
+    APP_NAME = ${cfg.appName}
+    RUN_USER = ${cfg.user}
+    RUN_MODE = prod
+
+    [database]
+    DB_TYPE = ${cfg.database.type}
+    HOST = ${cfg.database.host}:${toString cfg.database.port}
+    NAME = ${cfg.database.name}
+    USER = ${cfg.database.user}
+    PASSWD = ${cfg.database.password}
+    PATH = ${cfg.database.path}
+
+    [repository]
+    ROOT = ${cfg.repositoryRoot}
+
+    [server]
+    DOMAIN = ${cfg.domain}
+    HTTP_ADDR = ${cfg.httpAddress}
+    HTTP_PORT = ${toString cfg.httpPort}
+    ROOT_URL = ${cfg.rootUrl}
+
+    [security]
+    SECRET_KEY = #secretkey#
+    INSTALL_LOCK = true
+
+    ${cfg.extraConfig}
+  '';
+in
+
+{
+  options = {
+    services.gogs = {
+      enable = mkOption {
+        default = false;
+        type = types.bool;
+        description = "Enable Go Git Service.";
+      };
+
+      useWizard = mkOption {
+        default = false;
+        type = types.bool;
+        description = "Do not generate a configuration and use Gogs' installation wizard instead. The first registered user will be administrator.";
+      };
+
+      stateDir = mkOption {
+        default = "/var/lib/gogs";
+        type = types.str;
+        description = "Gogs data directory.";
+      };
+
+      user = mkOption {
+        type = types.str;
+        default = "gogs";
+        description = "User account under which Gogs runs.";
+      };
+
+      group = mkOption {
+        type = types.str;
+        default = "gogs";
+        description = "Group account under which Gogs runs.";
+      };
+
+      database = {
+        type = mkOption {
+          type = types.enum [ "sqlite3" "mysql" "postgres" ];
+          example = "mysql";
+          default = "sqlite3";
+          description = "Database engine to use.";
+        };
+
+        host = mkOption {
+          type = types.str;
+          default = "127.0.0.1";
+          description = "Database host address.";
+        };
+
+        port = mkOption {
+          type = types.int;
+          default = 3306;
+          description = "Database host port.";
+        };
+
+        name = mkOption {
+          type = types.str;
+          default = "gogs";
+          description = "Database name.";
+        };
+
+        user = mkOption {
+          type = types.str;
+          default = "gogs";
+          description = "Database user.";
+        };
+
+        password = mkOption {
+          type = types.str;
+          default = "";
+          description = "Database password.";
+        };
+
+        path = mkOption {
+          type = types.str;
+          default = "${cfg.stateDir}/data/gogs.db";
+          description = "Path to the sqlite3 database file.";
+        };
+      };
+
+      appName = mkOption {
+        type = types.str;
+        default = "Gogs: Go Git Service";
+        description = "Application name.";
+      };
+
+      repositoryRoot = mkOption {
+        type = types.str;
+        default = "${cfg.stateDir}/repositories";
+        description = "Path to the git repositories.";
+      };
+
+      domain = mkOption {
+        type = types.str;
+        default = "localhost";
+        description = "Domain name of your server.";
+      };
+
+      rootUrl = mkOption {
+        type = types.str;
+        default = "http://localhost:3000/";
+        description = "Full public URL of Gogs server.";
+      };
+
+      httpAddress = mkOption {
+        type = types.str;
+        default = "0.0.0.0";
+        description = "HTTP listen address.";
+      };
+
+      httpPort = mkOption {
+        type = types.int;
+        default = 3000;
+        description = "HTTP listen port.";
+      };
+
+      extraConfig = mkOption {
+        type = types.str;
+        default = "";
+        description = "Configuration lines appended to the generated Gogs configuration file.";
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+
+    systemd.services.gogs = {
+      description = "Gogs (Go Git Service)";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      path = [ pkgs.gogs.bin ];
+
+      preStart = ''
+        # copy custom configuration and generate a random secret key if needed
+        ${optionalString (cfg.useWizard == false) ''
+          mkdir -p ${cfg.stateDir}/custom/conf
+          cp -f ${configFile} ${cfg.stateDir}/custom/conf/app.ini
+          KEY=$(head -c 16 /dev/urandom | tr -dc A-Za-z0-9)
+          sed -i "s,#secretkey#,$KEY,g" ${cfg.stateDir}/custom/conf/app.ini
+        ''}
+
+        mkdir -p ${cfg.repositoryRoot}
+        # update all hooks' binary paths
+        HOOKS=$(find ${cfg.repositoryRoot} -mindepth 4 -maxdepth 4 -type f -wholename "*git/hooks/*")
+        if [ "$HOOKS" ]
+        then
+          sed -ri 's,/nix/store/[a-z0-9.-]+/bin/gogs,${pkgs.gogs.bin}/bin/gogs,g' $HOOKS
+          sed -ri 's,/nix/store/[a-z0-9.-]+/bin/env,${pkgs.coreutils}/bin/env,g' $HOOKS
+          sed -ri 's,/nix/store/[a-z0-9.-]+/bin/bash,${pkgs.bash}/bin/bash,g' $HOOKS
+          sed -ri 's,/nix/store/[a-z0-9.-]+/bin/perl,${pkgs.perl}/bin/perl,g' $HOOKS
+        fi
+      '';
+
+      serviceConfig = {
+        Type = "simple";
+        User = cfg.user;
+        Group = cfg.group;
+        WorkingDirectory = cfg.stateDir;
+        ExecStart = "${pkgs.gogs.bin}/bin/gogs web";
+        Restart = "always";
+      };
+
+      environment = {
+        USER = cfg.user;
+        HOME = cfg.stateDir;
+        GOGS_WORK_DIR = cfg.stateDir;
+      };
+    };
+
+    users = {
+      extraUsers.gogs = {
+        description = "Go Git Service";
+        uid = config.ids.uids.gogs;
+        group = "gogs";
+        home = cfg.stateDir;
+        createHome = true;
+      };
+      extraGroups.gogs.gid = config.ids.gids.gogs;
+    };
+  };
+}
--- a/nixos/modules/services/misc/mesos-master.nix
+++ b/nixos/modules/services/misc/mesos-master.nix
@ -16,12 +16,30 @@ in {
        type = types.bool;
      };

+      ip = mkOption {
+        description = "IP address to listen on.";
+        default = "0.0.0.0";
+        type = types.str;
+      };
+
      port = mkOption {
        description = "Mesos Master port";
        default = 5050;
        type = types.int;
      };

+      advertiseIp = mkOption {
+        description = "IP address advertised to reach this master.";
+        default = null;
+        type = types.nullOr types.str;
+      };
+
+      advertisePort = mkOption {
+        description = "Port advertised to reach this Mesos master.";
+        default = null;
+        type = types.nullOr types.int;
+      };
+
      zk = mkOption {
        description = ''
          ZooKeeper URL (used for leader election amongst masters).
@ -84,7 +102,10 @@ in {
      serviceConfig = {
        ExecStart = ''
          ${pkgs.mesos}/bin/mesos-master \
+            --ip=${cfg.ip} \
            --port=${toString cfg.port} \
+            ${optionalString (cfg.advertiseIp != null) "--advertise_ip=${cfg.advertiseIp}"} \
+            ${optionalString (cfg.advertisePort  != null) "--advertise_port=${toString cfg.advertisePort}"} \
            ${if cfg.quorum == 0
              then "--registry=in_memory"
              else "--zk=${cfg.zk} --registry=replicated_log --quorum=${toString cfg.quorum}"} \
--- a/nixos/modules/services/misc/mesos-slave.nix
+++ b/nixos/modules/services/misc/mesos-slave.nix
@ -12,7 +12,23 @@ let
  attribsArg = optionalString (cfg.attributes != {})
                              "--attributes=${mkAttributes cfg.attributes}";

-  containerizers = [ "mesos" ] ++ (optional cfg.withDocker "docker");
+  containerizersArg = concatStringsSep "," (
+    lib.unique (
+      cfg.containerizers ++ (optional cfg.withDocker "docker")
+    )
+  );
+
+  imageProvidersArg = concatStringsSep "," (
+    lib.unique (
+      cfg.imageProviders ++ (optional cfg.withDocker "docker")
+    )
+  );
+
+  isolationArg = concatStringsSep "," (
+    lib.unique (
+      cfg.isolation ++ (optionals cfg.withDocker [ "filesystem/linux" "docker/runtime"])
+    )
+  );

 in {

@ -27,7 +43,7 @@ in {
      ip = mkOption {
        description = "IP address to listen on.";
        default = "0.0.0.0";
-        type = types.string;
+        type = types.str;
      };

      port = mkOption {
@ -36,6 +52,53 @@ in {
        type = types.int;
      };

+      advertiseIp = mkOption {
+        description = "IP address advertised to reach this agent.";
+        default = null;
+        type = types.nullOr types.str;
+      };
+
+      advertisePort = mkOption {
+        description = "Port advertised to reach this agent.";
+        default = null;
+        type = types.nullOr types.int;
+      };
+
+      containerizers = mkOption {
+        description = ''
+          List of containerizer implementations to compose in order to provide
+          containerization. Available options are mesos and docker.
+          The order the containerizers are specified is the order they are tried.
+        '';
+        default = [ "mesos" ];
+        type = types.listOf types.str;
+      };
+
+      imageProviders = mkOption {
+        description = "List of supported image providers, e.g., APPC,DOCKER.";
+        default = [ ];
+        type = types.listOf types.str;
+      };
+
+      imageProvisionerBackend = mkOption {
+        description = ''
+          Strategy for provisioning container rootfs from images,
+          e.g., aufs, bind, copy, overlay.
+        '';
+        default = "copy";
+        type = types.str;
+      };
+
+      isolation = mkOption {
+        description = ''
+          Isolation mechanisms to use, e.g., posix/cpu,posix/mem, or
+          cgroups/cpu,cgroups/mem, or network/port_mapping, or `gpu/nvidia` for nvidia
+          specific gpu isolation.
+        '';
+        default = [ "posix/cpu" "posix/mem" ];
+        type = types.listOf types.str;
+      };
+
      master = mkOption {
        description = ''
          May be one of:
@ -57,6 +120,16 @@ in {
        type = types.bool;
      };

+      dockerRegistry = mkOption {
+        description = ''
+          The default url for pulling Docker images.
+          It could either be a Docker registry server url,
+          or a local path in which Docker image archives are stored.
+        '';
+        default = null;
+        type = types.nullOr (types.either types.str types.path);
+      };
+
      workDir = mkOption {
        description = "The Mesos work directory.";
        default = "/var/lib/mesos/slave";
@ -96,28 +169,45 @@ in {
                    host = "aabc123";
                    os = "nixos"; };
      };
+
+      executorEnvironmentVariables = mkOption {
+        description = ''
+          The environment variables that should be passed to the executor, and thus subsequently task(s).
+        '';
+        default = {
+          PATH = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
+        };
+        type = types.attrsOf types.str;
+      };
    };

  };

-
  config = mkIf cfg.enable {
    systemd.services.mesos-slave = {
      description = "Mesos Slave";
      wantedBy = [ "multi-user.target" ];
      after = [ "network.target" ];
-      environment.MESOS_CONTAINERIZERS = concatStringsSep "," containerizers;
+      path = [ pkgs.stdenv.shellPackage ];
      serviceConfig = {
        ExecStart = ''
          ${pkgs.mesos}/bin/mesos-slave \
+            --containerizers=${containerizersArg} \
+            --image_providers=${imageProvidersArg} \
+            --image_provisioner_backend=${cfg.imageProvisionerBackend} \
+            --isolation=${isolationArg} \
            --ip=${cfg.ip} \
            --port=${toString cfg.port} \
+            ${optionalString (cfg.advertiseIp != null) "--advertise_ip=${cfg.advertiseIp}"} \
+            ${optionalString (cfg.advertisePort  != null) "--advertise_port=${toString cfg.advertisePort}"} \
            --master=${cfg.master} \
            --work_dir=${cfg.workDir} \
            --logging_level=${cfg.logLevel} \
            ${attribsArg} \
            ${optionalString cfg.withHadoop "--hadoop-home=${pkgs.hadoop}"} \
            ${optionalString cfg.withDocker "--docker=${pkgs.docker}/libexec/docker/docker"} \
+            ${optionalString (cfg.dockerRegistry != null) "--docker_registry=${cfg.dockerRegistry}"} \
+            --executor_environment_variables=${lib.escapeShellArg (builtins.toJSON cfg.executorEnvironmentVariables)} \
            ${toString cfg.extraCmdLineOptions}
        '';
        PermissionsStartOnly = true;
--- a/nixos/modules/services/monitoring/netdata.nix
+++ b/nixos/modules/services/monitoring/netdata.nix
@ -0,0 +1,78 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+  cfg = config.services.netdata;
+
+  configFile = pkgs.writeText "netdata.conf" cfg.configText;
+
+  defaultUser = "netdata";
+
+in {
+  options = {
+    services.netdata = {
+      enable = mkOption {
+        default = false;
+        type = types.bool;
+        description = "Whether to enable netdata monitoring.";
+      };
+
+      user = mkOption {
+        type = types.str;
+        default = "netdata";
+        description = "User account under which netdata runs.";
+      };
+
+      group = mkOption {
+        type = types.str;
+        default = "netdata";
+        description = "Group under which netdata runs.";
+      };
+
+      configText = mkOption {
+        type = types.lines;
+        default = "";
+        description = "netdata.conf configuration.";
+        example = ''
+          [global]
+          debug log = syslog
+          access log = syslog
+          error log = syslog
+        '';
+      };
+
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.netdata = {
+      description = "Real time performance monitoring";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      preStart = concatStringsSep "\n" (map (dir: ''
+        mkdir -vp ${dir}
+        chmod 750 ${dir}
+        chown -R ${cfg.user}:${cfg.group} ${dir}
+        '') [ "/var/cache/netdata"
+              "/var/log/netdata"
+              "/var/lib/netdata" ]);
+      serviceConfig = {
+        User = cfg.user;
+        Group = cfg.group;
+        PermissionsStartOnly = true;
+        ExecStart = "${pkgs.netdata}/bin/netdata -D -c ${configFile}";
+        TimeoutStopSec = 60;
+      };
+    };
+
+    users.extraUsers = optional (cfg.user == defaultUser) {
+      name = defaultUser;
+    };
+
+    users.extraGroups = optional (cfg.group == defaultUser) {
+      name = defaultUser;
+    };
+
+  };
+}
--- a/nixos/modules/services/networking/flannel.nix
+++ b/nixos/modules/services/networking/flannel.nix
@ -149,6 +149,6 @@ in {
      serviceConfig.ExecStart = "${cfg.package}/bin/flannel";
    };

-    services.etcd.enable = mkDefault cfg.etcd.endpoints == ["http://127.0.0.1:2379"];
+    services.etcd.enable = mkDefault (cfg.etcd.endpoints == ["http://127.0.0.1:2379"]);
  };
 }
--- a/nixos/modules/services/networking/networkmanager.nix
+++ b/nixos/modules/services/networking/networkmanager.nix
@ -174,7 +174,7 @@ in {

    assertions = [{
      assertion = config.networking.wireless.enable == false;
-      message = "You can not use networking.networkmanager with services.networking.wireless";
+      message = "You can not use networking.networkmanager with networking.wireless";
    }];

    boot.kernelModules = [ "ppp_mppe" ]; # Needed for most (all?) PPTP VPN connections.
@ -239,7 +239,8 @@ in {
    # Turn off NixOS' network management
    networking = {
      useDHCP = false;
-      wireless.enable = false;
+      # use mkDefault to trigger the assertion about the conflict above
+      wireless.enable = lib.mkDefault false;
    };

    powerManagement.resumeCommands = ''
--- a/nixos/modules/services/x11/display-managers/slim.nix
+++ b/nixos/modules/services/x11/display-managers/slim.nix
@ -20,6 +20,7 @@ let
      ${optionalString (cfg.defaultUser != null) ("default_user " + cfg.defaultUser)}
      ${optionalString (cfg.defaultUser != null) ("focus_password yes")}
      ${optionalString cfg.autoLogin "auto_login yes"}
+      ${optionalString (cfg.consoleCmd != null) "console_cmd ${cfg.consoleCmd}"}
      ${cfg.extraConfig}
    '';

@ -105,6 +106,18 @@ in
        '';
      };

+      consoleCmd = mkOption {
+        type = types.nullOr types.str;
+        default = ''
+          ${pkgs.xterm}/bin/xterm -C -fg white -bg black +sb -T "Console login" -e ${pkgs.shadow}/bin/login
+        '';
+        defaultText = ''
+          ''${pkgs.xterm}/bin/xterm -C -fg white -bg black +sb -T "Console login" -e ''${pkgs.shadow}/bin/login
+        '';
+        description = ''
+          The command to run when "console" is given as the username.
+        '';
+      };
    };

  };
--- a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
+++ b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
@ -28,6 +28,8 @@ def write_loader_conf(generation):
        if "@timeout@" != "":
            f.write("timeout @timeout@\n")
        f.write("default nixos-generation-%d\n" % generation)
+        if not @editor@:
+            f.write("editor 0");
    os.rename("@efiSysMountPoint@/loader/loader.conf.tmp", "@efiSysMountPoint@/loader/loader.conf")

 def copy_from_profile(generation, name, dry_run=False):
--- a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix
+++ b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix
@ -20,6 +20,8 @@ let

    timeout = if config.boot.loader.timeout != null then config.boot.loader.timeout else "";

+    editor = if cfg.editor then "True" else "False";
+
    inherit (efi) efiSysMountPoint canTouchEfiVariables;
  };
 in {
@ -36,6 +38,20 @@ in {

      description = "Whether to enable the systemd-boot (formerly gummiboot) EFI boot manager";
    };
+
+    editor = mkOption {
+      default = true;
+
+      type = types.bool;
+
+      description = ''
+        Whether to allow editing the kernel command-line before
+        boot. It is recommended to set this to false, as it allows
+        gaining root access by passing init=/bin/sh as a kernel
+        parameter. However, it is enabled by default for backwards
+        compatibility.
+      '';
+    };
  };

  config = mkIf cfg.enable {
--- a/nixos/tests/mesos.nix
+++ b/nixos/tests/mesos.nix
@ -1,32 +1,91 @@
-import ./make-test.nix ({ pkgs, ...} : {
-  name = "simple";
+import ./make-test.nix ({ pkgs, ...} : rec {
+  name = "mesos";
  meta = with pkgs.stdenv.lib.maintainers; {
-    maintainers = [ offline ];
+    maintainers = [ offline kamilchm cstrahan ];
  };

-  machine = { config, pkgs, ... }: {
-    services.zookeeper.enable = true;
-    virtualisation.docker.enable = true;
-    services.mesos = {
-      slave = {
-        enable = true;
-        master = "zk://localhost:2181/mesos";
-        attributes = {
-          tag1 = "foo";
-          tag2 = "bar";
-        };
-      };
-      master = {
-        enable = true;
-        zk = "zk://localhost:2181/mesos";
+  nodes = {
+    master = { config, pkgs, ... }: {
+      networking.firewall.enable = false;
+      services.zookeeper.enable = true;
+      services.mesos.master = {
+          enable = true;
+          zk = "zk://master:2181/mesos";
      };
    };
+
+    slave = { config, pkgs, ... }: {
+      networking.firewall.enable = false;
+      networking.nat.enable = true;
+      virtualisation.docker.enable = true;
+      services.mesos = {
+        slave = {
+          enable = true;
+          master = "master:5050";
+          dockerRegistry = registry;
+          executorEnvironmentVariables = {
+            PATH = "/run/current-system/sw/bin";
+          };
+        };
+      };
+    };
+  };
+
+  simpleDocker = pkgs.dockerTools.buildImage {
+    name = "echo";
+    contents = [ pkgs.stdenv.shellPackage pkgs.coreutils ];
+    config = {
+      Env = [
+        # When shell=true, mesos invokes "sh -c '<cmd>'", so make sure "sh" is
+        # on the PATH.
+        "PATH=${pkgs.stdenv.shellPackage}/bin:${pkgs.coreutils}/bin"
+      ];
+      Entrypoint = [ "echo" ];
+    };
+  };
+
+  registry = pkgs.runCommand "registry" { } ''
+    mkdir -p $out
+    cp ${simpleDocker} $out/echo:latest.tar
+  '';
+
+  testFramework = pkgs.pythonPackages.buildPythonPackage {
+    name = "mesos-tests";
+    propagatedBuildInputs = [ pkgs.mesos ];
+    catchConflicts = false;
+    src = ./mesos_test.py;
+    phases = [ "installPhase" "fixupPhase" ];
+    installPhase = ''
+      mkdir $out
+      cp $src $out/mesos_test.py
+      chmod +x $out/mesos_test.py
+
+      echo "done" > test.result
+      tar czf $out/test.tar.gz test.result
+    '';
  };

  testScript =
    ''
      startAll;
-      $machine->waitForUnit("mesos-master.service");
-      $machine->waitForUnit("mesos-slave.service");
+      $master->waitForUnit("mesos-master.service");
+      $slave->waitForUnit("mesos-slave.service");
+
+      $master->waitForOpenPort(5050);
+      $slave->waitForOpenPort(5051);
+
+      # is slave registred? 
+      $master->waitUntilSucceeds("curl -s --fail http://master:5050/master/slaves".
+                                 " | grep -q \"\\\"hostname\\\":\\\"slave\\\"\"");
+
+      # try to run docker image 
+      $master->succeed("${pkgs.mesos}/bin/mesos-execute --master=master:5050".
+                       " --resources=\"cpus:0.1;mem:32\" --name=simple-docker".
+                       " --containerizer=mesos --docker_image=echo:latest".
+                       " --shell=true --command=\"echo done\" | grep -q TASK_FINISHED");
+
+      # simple command with .tar.gz uri
+      $master->succeed("${testFramework}/mesos_test.py master ".
+                       "${testFramework}/test.tar.gz");
    '';
 })
--- a/nixos/tests/mesos_test.py
+++ b/nixos/tests/mesos_test.py
@ -0,0 +1,72 @@
+#!/usr/bin/env python
+import uuid
+import time
+import subprocess
+import os
+
+import sys
+
+from mesos.interface import Scheduler
+from mesos.native import MesosSchedulerDriver
+from mesos.interface import mesos_pb2
+
+def log(msg):
+    process = subprocess.Popen("systemd-cat", stdin=subprocess.PIPE)
+    (out,err) = process.communicate(msg)
+
+class NixosTestScheduler(Scheduler):
+    def __init__(self):
+        self.master_ip = sys.argv[1]
+        self.download_uri = sys.argv[2]
+
+    def resourceOffers(self, driver, offers):
+        log("XXX got resource offer")
+
+        offer = offers[0]
+        task = self.new_task(offer)
+        uri = task.command.uris.add()
+        uri.value = self.download_uri
+        task.command.value = "cat test.result"
+        driver.launchTasks(offer.id, [task])
+
+    def statusUpdate(self, driver, update):
+        log("XXX status update")
+        if update.state == mesos_pb2.TASK_FAILED:
+            log("XXX test task failed with message: " + update.message)
+            driver.stop()
+            sys.exit(1)
+        elif update.state == mesos_pb2.TASK_FINISHED:
+            driver.stop()
+            sys.exit(0)
+
+    def new_task(self, offer):
+        task = mesos_pb2.TaskInfo()
+        id = uuid.uuid4()
+        task.task_id.value = str(id)
+        task.slave_id.value = offer.slave_id.value
+        task.name = "task {}".format(str(id))
+
+        cpus = task.resources.add()
+        cpus.name = "cpus"
+        cpus.type = mesos_pb2.Value.SCALAR
+        cpus.scalar.value = 0.1
+
+        mem = task.resources.add()
+        mem.name = "mem"
+        mem.type = mesos_pb2.Value.SCALAR
+        mem.scalar.value = 32
+
+        return task
+
+if __name__ == '__main__':
+    log("XXX framework started")
+
+    framework = mesos_pb2.FrameworkInfo()
+    framework.user = "root"
+    framework.name = "nixos-test-framework"
+    driver = MesosSchedulerDriver(
+        NixosTestScheduler(),
+        framework,
+        sys.argv[1] + ":5050"
+    )
+    driver.run()
--- a/pkgs/applications/graphics/pencil/default.nix
+++ b/pkgs/applications/graphics/pencil/default.nix
@ -1,12 +1,12 @@
 { stdenv, fetchurl, makeWrapper, xulrunner }:

 stdenv.mkDerivation rec {
-  version = "2.0.18";
+  version = "2.0.21";
  name = "pencil-${version}";

  src = fetchurl {
    url = "https://github.com/prikhi/pencil/releases/download/v${version}/Pencil-${version}-linux-pkg.tar.gz";
-    sha256 = "0x0kibb2na12fwl0x68xhkjpbm5h2widm346cx2r29gp1kq9kklc";
+    sha256 = "0xq3gczqy7gzf1997qxdql5z7qqk1vabr0rzgakmsi4dq2q4d3kq";
  };

  buildPhase = "";
@ -32,8 +32,5 @@ stdenv.mkDerivation rec {
    license = licenses.gpl2; # Commercial license is also available
    maintainers = with maintainers; [ bjornfor prikhi ];
    platforms = platforms.linux;
-    # See https://github.com/prikhi/pencil/issues/840
-    # ("Error: Platform version '47.0' is not compatible with minVersion >= 36.0 maxVersion <= 46.*")
-    broken = true;
  };
 }
--- a/pkgs/applications/misc/golden-cheetah/default.nix
+++ b/pkgs/applications/misc/golden-cheetah/default.nix
@ -1,34 +1,30 @@
-{ stdenv, fetchurl, qtbase, qtsvg, qtserialport, qtwebkit, qtmultimedia
-, qttools, yacc, flex, zlib, config, qmakeHook, makeQtWrapper }:
+{ stdenv, fetchurl
+, qtbase, qtsvg, qtserialport, qtwebkit, qtmultimedia, qttools, qtconnectivity
+, yacc, flex, zlib, config, qmakeHook, makeQtWrapper
+}:
 stdenv.mkDerivation rec {
  name = "golden-cheetah-${version}";
-  version = "4.0-DEV1603";
+  version = "3.4";
  src = fetchurl {
    name = "${name}.tar.gz";
    url = "https://github.com/GoldenCheetah/GoldenCheetah/archive/V${version}.tar.gz";
-    sha256 = "12knlzqmq8b3nyl3kvcsnzrbjksgd83mzwzj97wccyfiffjl4wah";
+    sha256 = "0fiz2pj155cd357kph50lc6rjyzwp045glfv4y68qls9j7m9ayaf";
  };
-  buildInputs = [
+  qtInputs = [
    qtbase qtsvg qtserialport qtwebkit qtmultimedia qttools yacc flex zlib
+    qtconnectivity
  ];
-  nativeBuildInputs = [ makeQtWrapper qmakeHook ];
+  nativeBuildInputs = [ makeQtWrapper qmakeHook ] ++ qtInputs;
  preConfigure = ''
    cp src/gcconfig.pri.in src/gcconfig.pri
    cp qwt/qwtconfig.pri.in qwt/qwtconfig.pri
    echo 'QMAKE_LRELEASE = ${qttools.dev}/bin/lrelease' >> src/gcconfig.pri
    sed -i -e '21,23d' qwt/qwtconfig.pri # Removed forced installation to /usr/local
  '';
-  #postConfigure =
-    #  + (
-    # with (config.golden-cheetah);
-    # stdenv.lib.optionalString (dropbox-client-id != null && dropbox-client-secret != null) ''
-    #   echo 'DEFINES += GC_DROPBOX_CLIENT_ID=\\\"${config.golden-cheetah.dropbox-client-id}\\\"' >>  src/gcconfig.pri
-    #   echo 'DEFINES += GC_DROPBOX_CLIENT_SECRET=\\\"${config.golden-cheetah.dropbox-client-secret}\\\"' >>  src/gcconfig.pri
-    # '');
  installPhase = ''
    mkdir -p $out/bin
    cp src/GoldenCheetah $out/bin
-    wrapQtProgram $out/bin/GoldenCheetah --set LD_LIBRARY_PATH "${zlib.out}/lib" # patchelf doesn't seem to work
+    wrapQtProgram $out/bin/GoldenCheetah --set LD_LIBRARY_PATH "${zlib.out}/lib"
  '';
  meta = {
    description = "Performance software for cyclists, runners and triathletes";
--- a/pkgs/applications/misc/termite/default.nix
+++ b/pkgs/applications/misc/termite/default.nix
@ -35,6 +35,7 @@ let
      homepage = https://github.com/thestinger/termite/;
      maintainers = with maintainers; [ koral garbas ];
      platforms = platforms.all;
+      broken = true;
    };
  };
 in if configFile == null then termite else symlinkJoin {
--- a/pkgs/applications/networking/browsers/palemoon/default.nix
+++ b/pkgs/applications/networking/browsers/palemoon/default.nix
@ -0,0 +1,94 @@
+{ stdenv, fetchFromGitHub, makeDesktopItem
+, pkgconfig, autoconf213, alsaLib, bzip2, cairo
+, dbus, dbus_glib, file, fontconfig, freetype
+, gstreamer, gst_plugins_base, gst_all_1
+, gtk2, hunspell, icu, libevent, libjpeg, libnotify
+, libstartup_notification, libvpx, makeWrapper, mesa 
+, nspr, nss, pango, perl, python, libpulseaudio, sqlite 
+, unzip, xlibs, which, yasm, zip, zlib
+}:
+
+stdenv.mkDerivation rec {
+  name = "palemoon-${version}";
+  version = "27.0.3";
+
+  src = fetchFromGitHub {
+    name   = "palemoon-src";
+    owner  = "MoonchildProductions";
+    repo   = "Pale-Moon";
+    rev    = "c09119484da17c682a66e32bacbffb8cff411608";
+    sha256 = "1i4hp1lz0xaryy4zpncr67gbqg8v7a2cnyqjwvs2an86rk1vg913";
+  };
+
+  desktopItem = makeDesktopItem {
+    name = "palemoon";
+    exec = "palemoon %U";
+    desktopName = "Pale Moon";
+    genericName = "Web Browser";
+    categories = "Application;Network;WebBrowser;";
+    mimeType = stdenv.lib.concatStringsSep ";" [
+      "text/html"
+      "text/xml"
+      "application/xhtml+xml"
+      "application/vnd.mozilla.xul+xml"
+      "x-scheme-handler/http"
+      "x-scheme-handler/https"
+      "x-scheme-handler/ftp"
+    ];
+  };
+
+  buildInputs = [
+    alsaLib bzip2 cairo dbus dbus_glib file fontconfig freetype
+    gst_plugins_base gstreamer gst_all_1.gst-plugins-base gtk2
+    hunspell icu libevent libjpeg libnotify libstartup_notification
+    libvpx makeWrapper mesa nspr nss pango perl pkgconfig python
+    libpulseaudio sqlite unzip which yasm zip zlib
+  ] ++ (with xlibs; [
+    libX11 libXext libXft libXi libXrender libXScrnSaver
+    libXt pixman scrnsaverproto xextproto
+  ]);
+
+  enableParallelBuilding = true;
+
+  configurePhase = ''
+    export AUTOCONF=${autoconf213}/bin/autoconf
+    export MOZBUILD_STATE_PATH=$(pwd)/.mozbuild
+    export MOZ_CONFIG=$(pwd)/.mozconfig
+    export builddir=$(pwd)/build
+    mkdir -p $MOZBUILD_STATE_PATH $builddir
+    echo > $MOZ_CONFIG "
+    . $src/build/mozconfig.common
+    ac_add_options --prefix=$out
+    ac_add_options --enable-application=browser
+    ac_add_options --enable-official-branding
+    ac_add_options --enable-optimize="-O2"
+    ac_add_options --enable-jemalloc
+    ac_add_options --enable-shared-js
+    ac_add_options --disable-tests
+    "
+  '';
+
+  patchPhase = ''
+    chmod u+w .
+    sed -i /status4evar/d browser/installer/package-manifest.in
+  '';
+
+  buildPhase = ''
+    cd $builddir
+    $src/mach build
+  '';
+
+  installPhase = ''
+    cd $builddir
+    $src/mach install
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A web browser";
+    homepage    = https://www.palemoon.org/;
+    license     = licenses.mpl20;
+    maintainers = with maintainers; [ rnhmjoj ];
+    platforms   = platforms.linux;
+  };
+
+}
--- a/pkgs/applications/networking/browsers/w3m/default.nix
+++ b/pkgs/applications/networking/browsers/w3m/default.nix
@ -15,7 +15,7 @@ assert mouseSupport -> gpm-ncurses != null;
 with stdenv.lib;

 stdenv.mkDerivation rec {
-  name = "w3m-v0.5.3+git20161120";
+  name = "w3m-0.5.3+git20161120";

  src = fetchFromGitHub {
    owner = "tats";
--- a/pkgs/applications/networking/cluster/mesos/default.nix
+++ b/pkgs/applications/networking/cluster/mesos/default.nix
@ -2,16 +2,27 @@
 , automake115x, libtool, unzip, gnutar, jdk, maven, python, wrapPython
 , setuptools, boto, pythonProtobuf, apr, subversion, gzip, systemd
 , leveldb, glog, perf, utillinux, libnl, iproute, openssl, libevent
-, ethtool, coreutils
+, ethtool, coreutils, which, iptables
 , bash
 }:

 let
  mavenRepo = import ./mesos-deps.nix { inherit stdenv curl; };
  soext = if stdenv.system == "x86_64-darwin" then "dylib" else "so";
+  # `tar -z` requires gzip on $PATH, so wrap tar.
+  # At some point, we should try to patch mesos so we add gzip to the PATH when
+  # tar is invoked. I think that only needs to be done here:
+  #   src/common/command_utils.cpp
+  # https://github.com/NixOS/nixpkgs/issues/13783
+  tarWithGzip = lib.overrideDerivation gnutar (oldAttrs: {
+    buildInputs = (oldAttrs.buildInputs or []) ++ [ makeWrapper ];
+    postInstall = (oldAttrs.postInstall or "") + ''
+      wrapProgram $out/bin/tar --prefix PATH ":" "${gzip}/bin"
+    '';
+  });

 in stdenv.mkDerivation rec {
-  version = "1.0.1";
+  version = "1.1.0";
  name = "mesos-${version}";

  enableParallelBuilding = true;
@ -19,17 +30,14 @@ in stdenv.mkDerivation rec {

  src = fetchurl {
    url = "mirror://apache/mesos/${version}/${name}.tar.gz";
-    sha256 = "1hdh2wh11ck98ycfrxfzgivgk2pjl3638vkyw14xj7faj9qxjlz0";
+    sha256 = "1hdjd4syyp88l0bnh88bhzvn9466ad2ysfp9pq3kwj3qzwg5jv8g";
  };

  patches = [
    # https://reviews.apache.org/r/36610/
+    # TODO: is this still needed?
    ./rb36610.patch

-    # https://issues.apache.org/jira/browse/MESOS-6013
-    ./rb51324.patch
-    ./rb51325.patch
-
    # see https://github.com/cstrahan/mesos/tree/nixos-${version}
    ./nixos.patch
  ];
@ -46,33 +54,55 @@ in stdenv.mkDerivation rec {
    pythonProtobuf
  ];

+  # note that we *must* statically link libprotobuf.
+  # if we dynamically link the lib, we get these errors:
+  # https://github.com/NixOS/nixpkgs/pull/19064#issuecomment-255082684
  preConfigure = ''
+    substituteInPlace 3rdparty/stout/include/stout/os/posix/chown.hpp \
+      --subst-var-by chown ${coreutils}/bin/chown
+
+    substituteInPlace 3rdparty/stout/Makefile.am \
+      --replace "-lprotobuf" \
+                "${pythonProtobuf.protobuf.lib}/lib/libprotobuf.a"
+
    substituteInPlace 3rdparty/stout/include/stout/os/posix/fork.hpp \
      --subst-var-by sh ${bash}/bin/bash

-    substituteInPlace 3rdparty/stout/include/stout/os/posix/shell.hpp \
-      --subst-var-by sh ${bash}/bin/bash
-
-    substituteInPlace src/Makefile.am \
-      --subst-var-by mavenRepo ${mavenRepo}
+    substituteInPlace 3rdparty/stout/include/stout/posix/os.hpp \
+      --subst-var-by tar ${tarWithGzip}/bin/tar

    substituteInPlace src/cli/mesos-scp \
      --subst-var-by scp ${openssh}/bin/scp

+    substituteInPlace src/common/command_utils.cpp \
+      --subst-var-by curl      ${curl}/bin/curl \
+      --subst-var-by gzip      ${gzip}/bin/gzip \
+      --subst-var-by sha512sum ${coreutils}/bin/sha512sum \
+      --subst-var-by tar       ${tarWithGzip}/bin/tar
+
    substituteInPlace src/launcher/fetcher.cpp \
+      --subst-var-by cp    ${coreutils}/bin/cp \
      --subst-var-by gzip  ${gzip}/bin/gzip \
-      --subst-var-by tar   ${gnutar}/bin/tar \
+      --subst-var-by tar   ${tarWithGzip}/bin/tar \
      --subst-var-by unzip ${unzip}/bin/unzip

    substituteInPlace src/python/cli/src/mesos/cli.py \
      --subst-var-by mesos-resolve $out/bin/mesos-resolve

+    substituteInPlace src/python/native_common/ext_modules.py.in \
+      --replace "-lprotobuf" \
+                "${pythonProtobuf.protobuf.lib}/lib/libprotobuf.a"
+
+    substituteInPlace src/slave/containerizer/mesos/isolators/gpu/volume.cpp \
+      --subst-var-by cp    ${coreutils}/bin/cp \
+      --subst-var-by which ${which}/bin/which
+
    substituteInPlace src/slave/containerizer/mesos/isolators/posix/disk.cpp \
-      --subst-var-by du ${coreutils}/bin/du \
-      --subst-var-by cp ${coreutils}/bin/cp
+      --subst-var-by du ${coreutils}/bin/du

    substituteInPlace src/slave/containerizer/mesos/provisioner/backends/copy.cpp \
-      --subst-var-by cp ${coreutils}/bin/cp
+      --subst-var-by cp ${coreutils}/bin/cp \
+      --subst-var-by rm ${coreutils}/bin/rm

    substituteInPlace src/uri/fetchers/copy.cpp \
      --subst-var-by cp ${coreutils}/bin/cp
@ -83,23 +113,48 @@ in stdenv.mkDerivation rec {
    substituteInPlace src/uri/fetchers/docker.cpp \
      --subst-var-by curl ${curl}/bin/curl

+    substituteInPlace src/Makefile.am \
+      --subst-var-by mavenRepo ${mavenRepo} \
+      --replace "-lprotobuf" \
+                "${pythonProtobuf.protobuf.lib}/lib/libprotobuf.a"
+
  '' + lib.optionalString stdenv.isLinux ''

    substituteInPlace src/linux/perf.cpp \
      --subst-var-by perf ${perf}/bin/perf

+    substituteInPlace src/slave/containerizer/mesos/isolators/docker/volume/isolator.cpp \
+      --subst-var-by mount ${utillinux}/bin/mount
+
+    substituteInPlace src/slave/containerizer/mesos/isolators/filesystem/linux.cpp \
+      --subst-var-by mount ${utillinux}/bin/mount
+
    substituteInPlace src/slave/containerizer/mesos/isolators/filesystem/shared.cpp \
      --subst-var-by mount ${utillinux}/bin/mount

+    substituteInPlace src/slave/containerizer/mesos/isolators/gpu/isolator.cpp \
+      --subst-var-by mount ${utillinux}/bin/mount
+
    substituteInPlace src/slave/containerizer/mesos/isolators/namespaces/pid.cpp \
      --subst-var-by mount ${utillinux}/bin/mount

+    substituteInPlace src/slave/containerizer/mesos/isolators/network/cni/cni.cpp \
+      --subst-var-by mount ${utillinux}/bin/mount
+
+    substituteInPlace src/slave/containerizer/mesos/isolators/network/cni/plugins/port_mapper/port_mapper.cpp \
+      --subst-var-by iptables ${iptables}/bin/iptables
+
    substituteInPlace src/slave/containerizer/mesos/isolators/network/port_mapping.cpp \
-      --subst-var-by tc      ${iproute}/bin/tc \
+      --subst-var-by ethtool ${ethtool}/sbin/ethtool \
      --subst-var-by ip      ${iproute}/bin/ip \
      --subst-var-by mount   ${utillinux}/bin/mount \
-      --subst-var-by sh      ${stdenv.shell} \
-      --subst-var-by ethtool ${ethtool}/sbin/ethtool
+      --subst-var-by tc      ${iproute}/bin/tc
+
+    substituteInPlace src/slave/containerizer/mesos/isolators/volume/image.cpp \
+      --subst-var-by mount   ${utillinux}/bin/mount
+
+    substituteInPlace src/slave/containerizer/mesos/isolators/volume/sandbox_path.cpp \
+      --subst-var-by mount   ${utillinux}/bin/mount
  '';

  configureFlags = [
@ -108,7 +163,6 @@ in stdenv.mkDerivation rec {
    "--with-svn=${subversion.dev}"
    "--with-leveldb=${leveldb}"
    "--with-glog=${glog}"
-    "--with-glog=${glog}"
    "--enable-optimize"
    "--disable-python-dependency-install"
    "--enable-ssl"
--- a/pkgs/applications/networking/cluster/mesos/maven_repo.patch
+++ b/pkgs/applications/networking/cluster/mesos/maven_repo.patch
@ -1,13 +0,0 @@
-diff --git a/src/Makefile.am b/src/Makefile.am
-index ae2740a..1df91a7 100644
--- a/src/Makefile.am
-+++ b/src/Makefile.am
-@@ -1310,7 +1310,7 @@ if HAS_JAVA
- 
- $(MESOS_JAR): $(MESOS_JAR_SOURCE) $(MESOS_JAR_GENERATED) java/mesos.pom
- 	@echo "Building mesos-$(PACKAGE_VERSION).jar ..."
-	@cd $(abs_top_builddir)/src/java && $(MVN) -f mesos.pom clean package
-+	@cd $(abs_top_builddir)/src/java && $(MVN) -f mesos.pom -Dmaven.repo.local=@mavenRepo@ clean package
- 
- # Convenience library for JNI bindings.
- # TODO(Charles Reiss): We really should be building the Java library
--- a/pkgs/applications/networking/cluster/mesos/nixos.patch
+++ b/pkgs/applications/networking/cluster/mesos/nixos.patch
@ -1,5 +1,18 @@
+diff --git a/3rdparty/stout/include/stout/os/posix/chown.hpp b/3rdparty/stout/include/stout/os/posix/chown.hpp
+index c82e2e574..15d332107 100644
+--- a/3rdparty/stout/include/stout/os/posix/chown.hpp
+++ b/3rdparty/stout/include/stout/os/posix/chown.hpp
+@@ -34,7 +34,7 @@ inline Try<Nothing> chown(
+     // TODO(bmahler): Consider walking the file tree instead. We would need
+     // to be careful to not miss dotfiles.
+     std::string command =
+-      "chown -R " + stringify(uid) + ':' + stringify(gid) + " '" + path + "'";
+      "@chown@ -R " + stringify(uid) + ':' + stringify(gid) + " '" + path + "'";
+ 
+     int status = os::system(command);
+     if (status != 0) {
 diff --git a/3rdparty/stout/include/stout/os/posix/fork.hpp b/3rdparty/stout/include/stout/os/posix/fork.hpp
-index a29967d..290b98b 100644
+index a29967dcb..290b98b50 100644
 --- a/3rdparty/stout/include/stout/os/posix/fork.hpp
 +++ b/3rdparty/stout/include/stout/os/posix/fork.hpp
@@ -369,7 +369,7 @@ private:
@ -11,48 +24,97 @@ index a29967d..290b98b 100644
       EXIT(EXIT_FAILURE)
         << "Failed to execute '" << command << "': " << os::strerror(errno);
     } else if (wait.isSome()) {
-diff --git a/3rdparty/stout/include/stout/os/posix/shell.hpp b/3rdparty/stout/include/stout/os/posix/shell.hpp
-index 1d73ae5..9bf89b5 100644
--- a/3rdparty/stout/include/stout/os/posix/shell.hpp
-+++ b/3rdparty/stout/include/stout/os/posix/shell.hpp
-@@ -37,7 +37,7 @@ namespace Shell {
- // received by the callee, usually the command name and `arg1` is the
- // second command argument received by the callee.
- 
-constexpr const char* name = "sh";
-+constexpr const char* name = "@sh@";
- constexpr const char* arg0 = "sh";
- constexpr const char* arg1 = "-c";
+diff --git a/3rdparty/stout/include/stout/posix/os.hpp b/3rdparty/stout/include/stout/posix/os.hpp
+index c37e64db6..d3d87b7f0 100644
+--- a/3rdparty/stout/include/stout/posix/os.hpp
+++ b/3rdparty/stout/include/stout/posix/os.hpp
+@@ -375,7 +375,7 @@ inline Option<std::string> getenv(const std::string& key)
+ inline Try<Nothing> tar(const std::string& path, const std::string& archive)
+ {
+   Try<std::string> tarOut =
+-    os::shell("tar %s %s %s", "-czf", archive.c_str(), path.c_str());
+    os::shell("@tar@ %s %s %s", "-czf", archive.c_str(), path.c_str());
 
+   if (tarOut.isError()) {
+     return Error("Failed to archive " + path + ": " + tarOut.error());
 diff --git a/src/Makefile.am b/src/Makefile.am
-index 28dd151..36fc6ec 100644
+index 3bcc0f2df..e5cbc57e8 100644
 --- a/src/Makefile.am
 +++ b/src/Makefile.am
-@@ -1528,7 +1528,8 @@ if HAS_JAVA
+@@ -1545,7 +1545,7 @@ if HAS_JAVA
 
 $(MESOS_JAR): $(MESOS_JAR_SOURCE) $(MESOS_JAR_GENERATED) java/mesos.pom
 	@echo "Building mesos-$(PACKAGE_VERSION).jar ..."
 -	@cd $(abs_top_builddir)/src/java && $(MVN) -B -f mesos.pom clean package
 +	@cd $(abs_top_builddir)/src/java && $(MVN) -B -f mesos.pom -Dmaven.repo.local=@mavenRepo@ clean package
-+
 
 # Convenience library for JNI bindings.
 # TODO(Charles Reiss): We really should be building the Java library
 diff --git a/src/cli/mesos-scp b/src/cli/mesos-scp
-index a71ab07..feed8c4 100755
+index a71ab0708..1043d1b3c 100755
 --- a/src/cli/mesos-scp
 +++ b/src/cli/mesos-scp
-@@ -19,7 +19,7 @@ if sys.version_info < (2,6,0):
+@@ -19,7 +19,8 @@ if sys.version_info < (2,6,0):
 
 
 def scp(host, src, dst):
 -    cmd = 'scp -pr %s %s' % (src, host + ':' + dst)
 +    cmd = '@scp@ -pr %s %s' % (src, host + ':' + dst)
+
     try:
         process = subprocess.Popen(
             cmd,
+diff --git a/src/common/command_utils.cpp b/src/common/command_utils.cpp
+index 09e805140..90bf65896 100644
+--- a/src/common/command_utils.cpp
+++ b/src/common/command_utils.cpp
+@@ -140,7 +140,7 @@ Future<Nothing> tar(
+ 
+   argv.emplace_back(input);
+ 
+-  return launch("tar", argv)
+  return launch("@tar@", argv)
+     .then([]() { return Nothing(); });
+ }
+ 
+@@ -162,7 +162,7 @@ Future<Nothing> untar(
+     argv.emplace_back(directory.get());
+   }
+ 
+-  return launch("tar", argv)
+  return launch("@tar@", argv)
+     .then([]() { return Nothing(); });
+ }
+ 
+@@ -170,7 +170,7 @@ Future<Nothing> untar(
+ Future<string> sha512(const Path& input)
+ {
+ #ifdef __linux__
+-  const string cmd = "sha512sum";
+  const string cmd = "@sha512sum@";
+   vector<string> argv = {
+     cmd,
+     input             // Input file to compute shasum.
+@@ -206,7 +206,7 @@ Future<Nothing> gzip(const Path& input)
+     input
+   };
+ 
+-  return launch("gzip", argv)
+  return launch("@gzip@", argv)
+     .then([]() { return Nothing(); });
+ }
+ 
+@@ -219,7 +219,7 @@ Future<Nothing> decompress(const Path& input)
+     input
+   };
+ 
+-  return launch("gzip", argv)
+  return launch("@gzip@", argv)
+     .then([]() { return Nothing(); });
+ }
+ 
 diff --git a/src/launcher/fetcher.cpp b/src/launcher/fetcher.cpp
-index 4456c28..e22c8fc 100644
+index 4456c2813..e22c8fc03 100644
 --- a/src/launcher/fetcher.cpp
 +++ b/src/launcher/fetcher.cpp
@@ -68,13 +68,13 @@ static Try<bool> extract(
@ -82,11 +144,11 @@ index 4456c28..e22c8fc 100644
   LOG(INFO) << "Copying resource with command:" << command;
 
 diff --git a/src/linux/perf.cpp b/src/linux/perf.cpp
-index ea823b3..170f54d 100644
+index aa31982eb..8b5331b17 100644
 --- a/src/linux/perf.cpp
 +++ b/src/linux/perf.cpp
-@@ -125,7 +125,7 @@ private:
-     // NOTE: The watchdog process places perf in its own process group
+@@ -127,7 +127,7 @@ private:
+     // NOTE: The supervisor childhook places perf in its own process group
     // and will kill the perf process when the parent dies.
     Try<Subprocess> _perf = subprocess(
 -        "perf",
@ -104,37 +166,51 @@ index ea823b3..170f54d 100644
     command << " --event " << event;
   }
 diff --git a/src/linux/systemd.cpp b/src/linux/systemd.cpp
-index 619aa27..c1cbfe4 100644
+index 6318f48fc..394d88d47 100644
 --- a/src/linux/systemd.cpp
 +++ b/src/linux/systemd.cpp
-@@ -196,12 +196,19 @@ bool exists()
+@@ -196,13 +196,21 @@ bool exists()
   // This is static as the init system should not change while we are running.
   static const bool exists = []() -> bool {
     // (1) Test whether `/sbin/init` links to systemd.
 -    const Result<string> realpath = os::realpath("/sbin/init");
 -    if (realpath.isError() || realpath.isNone()) {
 -      LOG(WARNING) << "Failed to test /sbin/init for systemd environment: "
-                   << realpath.error();
+-                   << (realpath.isError() ? realpath.error()
+-                                          : "does not exist");
 -
 -      return false;
-+    // cstrahan: first assume we're on NixOS, then try non-NixOS
+    // cstrahan(nixos): first assume we're on NixOS, then try non-NixOS
 +    Result<string> realpath = os::realpath("/run/current-system/systemd/lib/systemd/systemd");
 +    Result<string> realpathNixOS = realpath;
 +    if (realpathNixOS.isError() || realpathNixOS.isNone()) {
 +      Result<string> realpathNonNixOS = realpath = os::realpath("/sbin/init");
 +      if (realpathNonNixOS.isError() || realpathNonNixOS.isNone()) {
 +        LOG(WARNING) << "Failed to test /run/current-system/systemd/lib/systemd/systemd for systemd environment: "
-+                     << realpathNixOS.error();
+                     << (realpathNixOS.isError() ? realpathNixOS.error()
+                                                 : "does not exist");
 +        LOG(WARNING) << "Failed to test /sbin/init for systemd environment: "
-+                     << realpathNonNixOS.error();
+                     << (realpathNonNixOS.isError() ? realpathNonNixOS.error()
+                                                    : "does not exist");
 +
 +        return false;
 +      }
     }
 
     CHECK_SOME(realpath);
+@@ -278,6 +286,10 @@ Path hierarchy()
+ 
+ Try<Nothing> daemonReload()
+ {
+  // cstrahan(nixos): should we patch these `systemctl`s?
+  // probably don't want to hard-code a particular systemd store path here,
+  // but if we use /run/current-system/sw/bin/systemctl,
+  // we won't be able to support non-NixOS distros.
+   Try<string> daemonReload = os::shell("systemctl daemon-reload");
+   if (daemonReload.isError()) {
+     return Error("Failed to reload systemd daemon: " + daemonReload.error());
 diff --git a/src/python/cli/src/mesos/cli.py b/src/python/cli/src/mesos/cli.py
-index f342992..354abf4 100644
+index f342992e0..354abf443 100644
 --- a/src/python/cli/src/mesos/cli.py
 +++ b/src/python/cli/src/mesos/cli.py
@@ -40,7 +40,7 @@ def resolve(master):
@ -146,11 +222,70 @@ index f342992..354abf4 100644
         stdin=None,
         stdout=subprocess.PIPE,
         stderr=subprocess.PIPE,
+diff --git a/src/slave/containerizer/mesos/isolators/docker/volume/isolator.cpp b/src/slave/containerizer/mesos/isolators/docker/volume/isolator.cpp
+index af9f3736b..f8554d414 100644
+--- a/src/slave/containerizer/mesos/isolators/docker/volume/isolator.cpp
+++ b/src/slave/containerizer/mesos/isolators/docker/volume/isolator.cpp
+@@ -499,7 +499,7 @@ Future<Option<ContainerLaunchInfo>> DockerVolumeIsolatorProcess::_prepare(
+     // unsafe arbitrary commands).
+     CommandInfo* command = launchInfo.add_pre_exec_commands();
+     command->set_shell(false);
+-    command->set_value("mount");
+    command->set_value("@mount@");
+     command->add_arguments("mount");
+     command->add_arguments("-n");
+     command->add_arguments("--rbind");
+diff --git a/src/slave/containerizer/mesos/isolators/filesystem/linux.cpp b/src/slave/containerizer/mesos/isolators/filesystem/linux.cpp
+index df16b8fee..4a17475bd 100644
+--- a/src/slave/containerizer/mesos/isolators/filesystem/linux.cpp
+++ b/src/slave/containerizer/mesos/isolators/filesystem/linux.cpp
+@@ -159,9 +159,9 @@ Try<Isolator*> LinuxFilesystemIsolatorProcess::create(const Flags& flags)
+       // here because 'create' will only be invoked during
+       // initialization.
+       Try<string> mount = os::shell(
+-          "mount --bind %s %s && "
+-          "mount --make-private %s && "
+-          "mount --make-shared %s",
+          "@mount@ --bind %s %s && "
+          "@mount@ --make-private %s && "
+          "@mount@ --make-shared %s",
+           workDir->c_str(),
+           workDir->c_str(),
+           workDir->c_str(),
+@@ -180,8 +180,8 @@ Try<Isolator*> LinuxFilesystemIsolatorProcess::create(const Flags& flags)
+       LOG(INFO) << "Making '" << workDir.get() << "' a shared mount";
+ 
+       Try<string> mount = os::shell(
+-          "mount --make-private %s && "
+-          "mount --make-shared %s",
+          "@mount@ --make-private %s && "
+          "@mount@ --make-shared %s",
+           workDir->c_str(),
+           workDir->c_str());
+ 
+@@ -404,7 +404,7 @@ Try<vector<CommandInfo>> LinuxFilesystemIsolatorProcess::getPreExecCommands(
+ 
+     CommandInfo command;
+     command.set_shell(false);
+-    command.set_value("mount");
+    command.set_value("@mount@");
+     command.add_arguments("mount");
+     command.add_arguments("-n");
+     command.add_arguments("--rbind");
+@@ -569,7 +569,7 @@ Try<vector<CommandInfo>> LinuxFilesystemIsolatorProcess::getPreExecCommands(
+     // TODO(jieyu): Consider the mode in the volume.
+     CommandInfo command;
+     command.set_shell(false);
+-    command.set_value("mount");
+    command.set_value("@mount@");
+     command.add_arguments("mount");
+     command.add_arguments("-n");
+     command.add_arguments("--rbind");
 diff --git a/src/slave/containerizer/mesos/isolators/filesystem/shared.cpp b/src/slave/containerizer/mesos/isolators/filesystem/shared.cpp
-index 51d1518..783adb5 100644
+index a1283e5ee..a918427bf 100644
 --- a/src/slave/containerizer/mesos/isolators/filesystem/shared.cpp
 +++ b/src/slave/containerizer/mesos/isolators/filesystem/shared.cpp
-@@ -204,7 +204,7 @@ Future<Option<ContainerLaunchInfo>> SharedFilesystemIsolatorProcess::prepare(
+@@ -207,7 +207,7 @@ Future<Option<ContainerLaunchInfo>> SharedFilesystemIsolatorProcess::prepare(
     }
 
     launchInfo.add_pre_exec_commands()->set_value(
@ -159,36 +294,148 @@ index 51d1518..783adb5 100644
   }
 
   return launchInfo;
+diff --git a/src/slave/containerizer/mesos/isolators/gpu/isolator.cpp b/src/slave/containerizer/mesos/isolators/gpu/isolator.cpp
+index e3756c920..cfe458b59 100644
+--- a/src/slave/containerizer/mesos/isolators/gpu/isolator.cpp
+++ b/src/slave/containerizer/mesos/isolators/gpu/isolator.cpp
+@@ -355,7 +355,7 @@ Future<Option<ContainerLaunchInfo>> NvidiaGpuIsolatorProcess::_prepare(
+     }
+ 
+     launchInfo.add_pre_exec_commands()->set_value(
+-      "mount --no-mtab --rbind --read-only " +
+      "@mount@ --no-mtab --rbind --read-only " +
+       volume.HOST_PATH() + " " + target);
+   }
+ 
+diff --git a/src/slave/containerizer/mesos/isolators/gpu/volume.cpp b/src/slave/containerizer/mesos/isolators/gpu/volume.cpp
+index 478752f37..ab527f0cd 100644
+--- a/src/slave/containerizer/mesos/isolators/gpu/volume.cpp
+++ b/src/slave/containerizer/mesos/isolators/gpu/volume.cpp
+@@ -281,7 +281,7 @@ Try<NvidiaVolume> NvidiaVolume::create()
+     string path = path::join(hostPath, "bin", binary);
+ 
+     if (!os::exists(path)) {
+-      string command = "which " + binary;
+      string command = "@which@ " + binary;
+       Try<string> which = os::shell(command);
+ 
+       if (which.isSome()) {
+@@ -295,7 +295,7 @@ Try<NvidiaVolume> NvidiaVolume::create()
+                               : "No such file or directory"));
+         }
+ 
+-        command = "cp " + realpath.get() + " " + path;
+        command = "@cp@ " + realpath.get() + " " + path;
+         Try<string> cp = os::shell(command);
+         if (cp.isError()) {
+           return Error("Failed to os::shell '" + command + "': " + cp.error());
+@@ -367,7 +367,7 @@ Try<NvidiaVolume> NvidiaVolume::create()
+             Path(realpath.get()).basename());
+ 
+         if (!os::exists(libraryPath)) {
+-          string command = "cp " + realpath.get() + " " + libraryPath;
+          string command = "@cp@ " + realpath.get() + " " + libraryPath;
+           Try<string> cp = os::shell(command);
+           if (cp.isError()) {
+             return Error("Failed to os::shell '" + command + "':"
 diff --git a/src/slave/containerizer/mesos/isolators/namespaces/pid.cpp b/src/slave/containerizer/mesos/isolators/namespaces/pid.cpp
-index b41e266..e07c163 100644
+index 0d9ec57d9..a177e4476 100644
 --- a/src/slave/containerizer/mesos/isolators/namespaces/pid.cpp
 +++ b/src/slave/containerizer/mesos/isolators/namespaces/pid.cpp
-@@ -163,7 +163,7 @@ Future<Option<ContainerLaunchInfo>> NamespacesPidIsolatorProcess::prepare(
-   // containers cannot see the namespace bind mount of other
-   // containers.
-   launchInfo.add_pre_exec_commands()->set_value(
-      "mount -n --bind " + string(PID_NS_BIND_MOUNT_MASK_DIR) +
-+      "@mount@ -n --bind " + string(PID_NS_BIND_MOUNT_MASK_DIR) +
-       " " + string(PID_NS_BIND_MOUNT_ROOT));
- 
-   // Mount /proc for the container's pid namespace to show the
-@@ -176,9 +176,9 @@ Future<Option<ContainerLaunchInfo>> NamespacesPidIsolatorProcess::prepare(
-   // -n flag so the mount is not added to the mtab where it will not
-   // be correctly removed with the namespace terminates.
-   launchInfo.add_pre_exec_commands()->set_value(
-      "mount none /proc --make-private -o rec");
-+      "@mount@ none /proc --make-private -o rec");
+@@ -94,7 +94,7 @@ Future<Option<ContainerLaunchInfo>> NamespacesPidIsolatorProcess::prepare(
+   //
+   // TOOD(jieyu): Consider unmount the existing /proc.
   launchInfo.add_pre_exec_commands()->set_value(
 -      "mount -n -t proc proc /proc -o nosuid,noexec,nodev");
 +      "@mount@ -n -t proc proc /proc -o nosuid,noexec,nodev");
 
   return launchInfo;
 }
+diff --git a/src/slave/containerizer/mesos/isolators/network/cni/cni.cpp b/src/slave/containerizer/mesos/isolators/network/cni/cni.cpp
+index c87e6715a..6601cd1b3 100644
+--- a/src/slave/containerizer/mesos/isolators/network/cni/cni.cpp
+++ b/src/slave/containerizer/mesos/isolators/network/cni/cni.cpp
+@@ -262,9 +262,9 @@ Try<Isolator*> NetworkCniIsolatorProcess::create(const Flags& flags)
+       // here because 'create' will only be invoked during
+       // initialization.
+       Try<string> mount = os::shell(
+-          "mount --bind %s %s && "
+-          "mount --make-private %s && "
+-          "mount --make-shared %s",
+          "@mount@ --bind %s %s && "
+          "@mount@ --make-private %s && "
+          "@mount@ --make-shared %s",
+           rootDir->c_str(),
+           rootDir->c_str(),
+           rootDir->c_str(),
+@@ -284,8 +284,8 @@ Try<Isolator*> NetworkCniIsolatorProcess::create(const Flags& flags)
+       LOG(INFO) << "Making '" << rootDir.get() << "' a shared mount";
+ 
+       Try<string> mount = os::shell(
+-          "mount --make-private %s && "
+-          "mount --make-shared %s",
+          "@mount@ --make-private %s && "
+          "@mount@ --make-shared %s",
+           rootDir->c_str(),
+           rootDir->c_str());
+ 
+diff --git a/src/slave/containerizer/mesos/isolators/network/cni/plugins/port_mapper/port_mapper.cpp b/src/slave/containerizer/mesos/isolators/network/cni/plugins/port_mapper/port_mapper.cpp
+index b470f0c82..6110a43ee 100644
+--- a/src/slave/containerizer/mesos/isolators/network/cni/plugins/port_mapper/port_mapper.cpp
+++ b/src/slave/containerizer/mesos/isolators/network/cni/plugins/port_mapper/port_mapper.cpp
+@@ -303,7 +303,7 @@ Try<Nothing> PortMapper::addPortMapping(
+       # Check if the `chain` exists in the iptable. If it does not
+       # exist go ahead and install the chain in the iptables NAT
+       # table.
+-      iptables -w -t nat --list %s
+      @iptables@ -w -t nat --list %s
+       if [ $? -ne 0 ]; then
+         # NOTE: When we create the chain, there is a possibility of a
+         # race due to which a container launch can fail. This can
+@@ -317,25 +317,25 @@ Try<Nothing> PortMapper::addPortMapping(
+         # since it can happen only when the chain is created the first
+         # time and two commands for creation of the chain are executed
+         # simultaneously.
+-        (iptables -w -t nat -N %s || exit 1)
+        (@iptables@ -w -t nat -N %s || exit 1)
+ 
+         # Once the chain has been installed add a rule in the PREROUTING
+         # chain to jump to this chain for any packets that are
+         # destined to a local address.
+-        (iptables -w -t nat -A PREROUTING \
+        (@iptables@ -w -t nat -A PREROUTING \
+         -m addrtype --dst-type LOCAL -j %s || exit 1)
+ 
+         # For locally generated packets we need a rule in the OUTPUT
+         # chain as well, since locally generated packets directly hit
+         # the output CHAIN, bypassing PREROUTING.
+-        (iptables -w -t nat -A OUTPUT \
+        (@iptables@ -w -t nat -A OUTPUT \
+         ! -d 127.0.0.0/8 -m addrtype \
+         --dst-type LOCAL -j %s || exit 1)
+       fi
+ 
+       # Within the `chain` go ahead and install the DNAT rule, if it
+       # does not exist.
+-      (iptables -w -t nat -C %s || iptables -t nat -A %s))~",
+      (@iptables@ -w -t nat -C %s || @iptables@ -t nat -A %s))~",
+       chain,
+       chain,
+       chain,
+@@ -362,7 +362,7 @@ Try<Nothing> PortMapper::delPortMapping()
+       # The iptables command searches for the DNAT rules with tag
+       # "container_id: <CNI_CONTAINERID>", and if it exists goes ahead
+       # and deletes it.
+-      iptables -w -t nat -S %s | sed "/%s/ s/-A/iptables -w -t nat -D/e")~",
+      @iptables@ -w -t nat -S %s | sed "/%s/ s/-A/@iptables@ -w -t nat -D/e")~",
+       chain,
+       getIptablesRuleTag()).get();
+ 
 diff --git a/src/slave/containerizer/mesos/isolators/network/port_mapping.cpp b/src/slave/containerizer/mesos/isolators/network/port_mapping.cpp
-index 79ee960..d55a353 100644
+index 20fb6ab35..46c160977 100644
 --- a/src/slave/containerizer/mesos/isolators/network/port_mapping.cpp
 +++ b/src/slave/containerizer/mesos/isolators/network/port_mapping.cpp
-@@ -1392,19 +1392,19 @@ Try<Isolator*> PortMappingIsolatorProcess::create(const Flags& flags)
+@@ -1393,19 +1393,19 @@ Try<Isolator*> PortMappingIsolatorProcess::create(const Flags& flags)
   // Check the availability of a few Linux commands that we will use.
   // We use the blocking os::shell here because 'create' will only be
   // invoked during initialization.
@ -211,7 +458,7 @@ index 79ee960..d55a353 100644
   if (checkCommandIp.isError()) {
     return Error("Check command 'ip' failed: " + checkCommandIp.error());
   }
-@@ -1924,9 +1924,9 @@ Try<Isolator*> PortMappingIsolatorProcess::create(const Flags& flags)
+@@ -1925,9 +1925,9 @@ Try<Isolator*> PortMappingIsolatorProcess::create(const Flags& flags)
     // visible. It's OK to use the blocking os::shell here because
     // 'create' will only be invoked during initialization.
     Try<string> mount = os::shell(
@ -224,7 +471,7 @@ index 79ee960..d55a353 100644
         bindMountRoot->c_str(),
         bindMountRoot->c_str(),
         bindMountRoot->c_str(),
-@@ -1943,8 +1943,8 @@ Try<Isolator*> PortMappingIsolatorProcess::create(const Flags& flags)
+@@ -1944,8 +1944,8 @@ Try<Isolator*> PortMappingIsolatorProcess::create(const Flags& flags)
       // shared mount yet (possibly due to slave crash while preparing
       // the work directory mount). It's safe to re-do the following.
       Try<string> mount = os::shell(
@ -235,7 +482,7 @@ index 79ee960..d55a353 100644
           bindMountRoot->c_str(),
           bindMountRoot->c_str());
 
-@@ -1963,8 +1963,8 @@ Try<Isolator*> PortMappingIsolatorProcess::create(const Flags& flags)
+@@ -1964,8 +1964,8 @@ Try<Isolator*> PortMappingIsolatorProcess::create(const Flags& flags)
           // so that they are in different peer groups.
           if (entry.shared() == bindMountEntry->shared()) {
             Try<string> mount = os::shell(
@ -246,14 +493,16 @@ index 79ee960..d55a353 100644
                 bindMountRoot->c_str(),
                 bindMountRoot->c_str());
 
-@@ -3916,13 +3916,13 @@ string PortMappingIsolatorProcess::scripts(Info* info)
+@@ -3911,6 +3911,8 @@ Try<Nothing> PortMappingIsolatorProcess::removeHostIPFilters(
+ // TODO(jieyu): Use the Subcommand abstraction to remove most of the
+ // logic here. Completely remove this function once we can assume a
+ // newer kernel where 'setns' works for mount namespaces.
+// cstrahan(nixos): this is executed in the container,
+// so we don't want to substitute paths here.
+ string PortMappingIsolatorProcess::scripts(Info* info)
 {
   ostringstream script;
- 
-  script << "#!/bin/sh\n";
-+  script << "#!@sh@\n";
-   script << "set -xe\n";
- 
+@@ -3921,7 +3923,7 @@ string PortMappingIsolatorProcess::scripts(Info* info)
   // Mark the mount point PORT_MAPPING_BIND_MOUNT_ROOT() as slave
   // mount so that changes in the container will not be propagated to
   // the host.
@ -262,7 +511,7 @@ index 79ee960..d55a353 100644
 
   // Disable IPv6 when IPv6 module is loaded as IPv6 packets won't be
   // forwarded anyway.
-@@ -3930,7 +3930,7 @@ string PortMappingIsolatorProcess::scripts(Info* info)
+@@ -3929,7 +3931,7 @@ string PortMappingIsolatorProcess::scripts(Info* info)
          << " echo 1 > /proc/sys/net/ipv6/conf/all/disable_ipv6\n";
 
   // Configure lo and eth0.
@ -271,7 +520,7 @@ index 79ee960..d55a353 100644
          << " mtu " << hostEth0MTU << " up\n";
 
   // NOTE: This is mostly a kernel issue: in veth_xmit() the kernel
-@@ -3939,12 +3939,12 @@ string PortMappingIsolatorProcess::scripts(Info* info)
+@@ -3938,12 +3940,12 @@ string PortMappingIsolatorProcess::scripts(Info* info)
   // when we receive a packet with a bad checksum. Disabling rx
   // checksum offloading ensures the TCP layer will checksum and drop
   // it.
@ -288,7 +537,7 @@ index 79ee960..d55a353 100644
 
   // Restrict the ephemeral ports that can be used by the container.
   script << "echo " << info->ephemeralPorts.lower() << " "
-@@ -3973,19 +3973,19 @@ string PortMappingIsolatorProcess::scripts(Info* info)
+@@ -3972,19 +3974,19 @@ string PortMappingIsolatorProcess::scripts(Info* info)
   }
 
   // Set up filters on lo and eth0.
@ -312,7 +561,7 @@ index 79ee960..d55a353 100644
          << " protocol ip"
          << " prio " << Priority(IP_FILTER_PRIORITY, NORMAL).get() << " u32"
          << " flowid ffff:0"
-@@ -3996,7 +3996,7 @@ string PortMappingIsolatorProcess::scripts(Info* info)
+@@ -3995,7 +3997,7 @@ string PortMappingIsolatorProcess::scripts(Info* info)
   foreach (const PortRange& range,
            getPortRanges(info->nonEphemeralPorts + info->ephemeralPorts)) {
     // Local traffic inside a container will not be redirected to eth0.
@ -321,7 +570,7 @@ index 79ee960..d55a353 100644
            << " protocol ip"
            << " prio " << Priority(IP_FILTER_PRIORITY, HIGH).get() << " u32"
            << " flowid ffff:0"
-@@ -4005,7 +4005,7 @@ string PortMappingIsolatorProcess::scripts(Info* info)
+@@ -4004,7 +4006,7 @@ string PortMappingIsolatorProcess::scripts(Info* info)
 
     // Traffic going to host loopback IP and ports assigned to this
     // container will be redirected to lo.
@ -330,7 +579,7 @@ index 79ee960..d55a353 100644
            << " protocol ip"
            << " prio " << Priority(IP_FILTER_PRIORITY, NORMAL).get() << " u32"
            << " flowid ffff:0"
-@@ -4017,14 +4017,14 @@ string PortMappingIsolatorProcess::scripts(Info* info)
+@@ -4016,14 +4018,14 @@ string PortMappingIsolatorProcess::scripts(Info* info)
   }
 
   // Do not forward the ICMP packet if the destination IP is self.
@ -347,7 +596,7 @@ index 79ee960..d55a353 100644
          << " protocol ip"
          << " prio " << Priority(ICMP_FILTER_PRIORITY, NORMAL).get() << " u32"
          << " flowid ffff:0"
-@@ -4033,9 +4033,9 @@ string PortMappingIsolatorProcess::scripts(Info* info)
+@@ -4032,9 +4034,9 @@ string PortMappingIsolatorProcess::scripts(Info* info)
          << net::IPNetwork::LOOPBACK_V4().address() << "\n";
 
   // Display the filters created on eth0 and lo.
@ -359,7 +608,7 @@ index 79ee960..d55a353 100644
          << " parent " << ingress::HANDLE << "\n";
 
   // If throughput limit for container egress traffic exists, use HTB
-@@ -4047,9 +4047,9 @@ string PortMappingIsolatorProcess::scripts(Info* info)
+@@ -4046,9 +4048,9 @@ string PortMappingIsolatorProcess::scripts(Info* info)
   // throughput. TBF requires other parameters such as 'burst' that
   // HTB already has default values for.
   if (egressRateLimitPerContainer.isSome()) {
@ -371,12 +620,12 @@ index 79ee960..d55a353 100644
            << CONTAINER_TX_HTB_HANDLE << " classid "
            << CONTAINER_TX_HTB_CLASS_ID << " htb rate "
            << egressRateLimitPerContainer.get().bytes() * 8 << "bit\n";
-@@ -4060,12 +4060,12 @@ string PortMappingIsolatorProcess::scripts(Info* info)
+@@ -4059,12 +4061,12 @@ string PortMappingIsolatorProcess::scripts(Info* info)
     // fq_codel, which has a larger buffer and better control on
     // buffer bloat.
     // TODO(cwang): Verity that fq_codel qdisc is available.
 -    script << "tc qdisc add dev " << eth0
-+    script << "@tC@ qdisc add dev " << eth0
+    script << "@tc@ qdisc add dev " << eth0
            << " parent " << CONTAINER_TX_HTB_CLASS_ID << " fq_codel\n";
 
     // Display the htb qdisc and class created on eth0.
@ -388,11 +637,11 @@ index 79ee960..d55a353 100644
 
   return script.str();
 diff --git a/src/slave/containerizer/mesos/isolators/posix/disk.cpp b/src/slave/containerizer/mesos/isolators/posix/disk.cpp
-index 3dfe7ad..4288666 100644
+index db0583386..542586370 100644
 --- a/src/slave/containerizer/mesos/isolators/posix/disk.cpp
 +++ b/src/slave/containerizer/mesos/isolators/posix/disk.cpp
-@@ -492,7 +492,7 @@ private:
-     // NOTE: The monitor watchdog will watch the parent process and kill
+@@ -540,7 +540,7 @@ private:
+     // NOTE: The supervisor childhook will watch the parent process and kill
     // the 'du' process in case that the parent die.
     Try<Subprocess> s = subprocess(
 -        "du",
@ -400,11 +649,37 @@ index 3dfe7ad..4288666 100644
         command,
         Subprocess::PATH("/dev/null"),
         Subprocess::PIPE(),
+diff --git a/src/slave/containerizer/mesos/isolators/volume/image.cpp b/src/slave/containerizer/mesos/isolators/volume/image.cpp
+index 210e67ad0..60b3a15e4 100644
+--- a/src/slave/containerizer/mesos/isolators/volume/image.cpp
+++ b/src/slave/containerizer/mesos/isolators/volume/image.cpp
+@@ -214,7 +214,7 @@ Future<Option<ContainerLaunchInfo>> VolumeImageIsolatorProcess::_prepare(
+ 
+     CommandInfo* command = launchInfo.add_pre_exec_commands();
+     command->set_shell(false);
+-    command->set_value("mount");
+    command->set_value("@mount@");
+     command->add_arguments("mount");
+     command->add_arguments("-n");
+     command->add_arguments("--rbind");
+diff --git a/src/slave/containerizer/mesos/isolators/volume/sandbox_path.cpp b/src/slave/containerizer/mesos/isolators/volume/sandbox_path.cpp
+index 7b976d292..474dcd486 100644
+--- a/src/slave/containerizer/mesos/isolators/volume/sandbox_path.cpp
+++ b/src/slave/containerizer/mesos/isolators/volume/sandbox_path.cpp
+@@ -240,7 +240,7 @@ Future<Option<ContainerLaunchInfo>> VolumeSandboxPathIsolatorProcess::prepare(
+ 
+       CommandInfo* command = launchInfo.add_pre_exec_commands();
+       command->set_shell(false);
+-      command->set_value("mount");
+      command->set_value("@mount@");
+       command->add_arguments("mount");
+       command->add_arguments("-n");
+       command->add_arguments("--rbind");
 diff --git a/src/slave/containerizer/mesos/provisioner/backends/copy.cpp b/src/slave/containerizer/mesos/provisioner/backends/copy.cpp
-index b9f6d7a..0fcf455 100644
+index 9c5354e5f..a73a9692e 100644
 --- a/src/slave/containerizer/mesos/provisioner/backends/copy.cpp
 +++ b/src/slave/containerizer/mesos/provisioner/backends/copy.cpp
-@@ -141,7 +141,7 @@ Future<Nothing> CopyBackendProcess::_provision(
+@@ -147,7 +147,7 @@ Future<Nothing> CopyBackendProcess::_provision(
 #endif // __APPLE__ || __FreeBSD__
 
   Try<Subprocess> s = subprocess(
@ -413,11 +688,20 @@ index b9f6d7a..0fcf455 100644
       args,
       Subprocess::PATH("/dev/null"),
       Subprocess::PATH("/dev/null"),
+@@ -180,7 +180,7 @@ Future<bool> CopyBackendProcess::destroy(const string& rootfs)
+   vector<string> argv{"rm", "-rf", rootfs};
+ 
+   Try<Subprocess> s = subprocess(
+-      "rm",
+      "@rm@",
+       argv,
+       Subprocess::PATH("/dev/null"),
+       Subprocess::FD(STDOUT_FILENO),
 diff --git a/src/uri/fetchers/copy.cpp b/src/uri/fetchers/copy.cpp
-index f095ad6..ee0c2a7 100644
+index 2cfef5ab0..8a62f7699 100644
 --- a/src/uri/fetchers/copy.cpp
 +++ b/src/uri/fetchers/copy.cpp
-@@ -88,7 +88,7 @@ Future<Nothing> CopyFetcherPlugin::fetch(
+@@ -97,7 +97,7 @@ Future<Nothing> CopyFetcherPlugin::fetch(
   const vector<string> argv = {"cp", "-a", uri.path(), directory};
 
   Try<Subprocess> s = subprocess(
@ -427,10 +711,10 @@ index f095ad6..ee0c2a7 100644
       Subprocess::PATH("/dev/null"),
       Subprocess::PIPE(),
 diff --git a/src/uri/fetchers/curl.cpp b/src/uri/fetchers/curl.cpp
-index cc3f9ee..691d2d9 100644
+index 7b746d619..12bbb04df 100644
 --- a/src/uri/fetchers/curl.cpp
 +++ b/src/uri/fetchers/curl.cpp
-@@ -98,7 +98,7 @@ Future<Nothing> CurlFetcherPlugin::fetch(
+@@ -107,7 +107,7 @@ Future<Nothing> CurlFetcherPlugin::fetch(
   };
 
   Try<Subprocess> s = subprocess(
@ -440,10 +724,10 @@ index cc3f9ee..691d2d9 100644
       Subprocess::PATH("/dev/null"),
       Subprocess::PIPE(),
 diff --git a/src/uri/fetchers/docker.cpp b/src/uri/fetchers/docker.cpp
-index 211be6f..d7e3771 100644
+index 3f38dddfb..fd991ee74 100644
 --- a/src/uri/fetchers/docker.cpp
 +++ b/src/uri/fetchers/docker.cpp
-@@ -113,7 +113,7 @@ static Future<http::Response> curl(
+@@ -114,7 +114,7 @@ static Future<http::Response> curl(
 
   // TODO(jieyu): Kill the process if discard is called.
   Try<Subprocess> s = subprocess(
@ -452,7 +736,7 @@ index 211be6f..d7e3771 100644
       argv,
       Subprocess::PATH("/dev/null"),
       Subprocess::PIPE(),
-@@ -212,7 +212,7 @@ static Future<int> download(
+@@ -213,7 +213,7 @@ static Future<int> download(
 
   // TODO(jieyu): Kill the process if discard is called.
   Try<Subprocess> s = subprocess(
--- a/pkgs/applications/networking/cluster/mesos/rb36610.patch
+++ b/pkgs/applications/networking/cluster/mesos/rb36610.patch
@ -1,11 +1,12 @@
 diff --git a/src/linux/fs.cpp b/src/linux/fs.cpp
-index ea0891e320154b85a21ed2d138c192821efae9cd..7b24c377c9a28cad91738305c273fb53a4dc7365 100644
+index 913e233..c2917a6 100644
 --- a/src/linux/fs.cpp
 +++ b/src/linux/fs.cpp
-@@ -19,6 +19,7 @@
+@@ -17,6 +17,7 @@
 #include <errno.h>
 #include <stdio.h>
 #include <string.h>
 +#include <syscall.h>
-
+ 
 #include <linux/limits.h>
+ #include <linux/unistd.h>
--- a/pkgs/applications/networking/cluster/mesos/rb51324.patch
+++ b/pkgs/applications/networking/cluster/mesos/rb51324.patch
@ -1,71 +0,0 @@
-diff --git a/3rdparty/stout/include/stout/os/ls.hpp b/3rdparty/stout/include/stout/os/ls.hpp
-index f8da9ef..6d549d3 100644
--- a/3rdparty/stout/include/stout/os/ls.hpp
-+++ b/3rdparty/stout/include/stout/os/ls.hpp
-@@ -18,6 +18,7 @@
- #else
- #include <dirent.h>
- #endif // __WINDOWS__
-+
- #include <stdlib.h>
- 
- #include <list>
-@@ -26,8 +27,6 @@
- #include <stout/error.hpp>
- #include <stout/try.hpp>
- 
-#include <stout/os/direntsize.hpp>
-
- 
- namespace os {
- 
-@@ -36,36 +35,32 @@ inline Try<std::list<std::string>> ls(const std::string& directory)
-   DIR* dir = opendir(directory.c_str());
- 
-   if (dir == nullptr) {
-    // Preserve `opendir` error.
-     return ErrnoError("Failed to opendir '" + directory + "'");
-   }
- 
-  dirent* temp = (dirent*) malloc(os::dirent_size(dir));
-
-  if (temp == nullptr) {
-    // Preserve `malloc` error.
-    ErrnoError error("Failed to allocate directory entries");
-    closedir(dir);
-    return error;
-  }
-
-   std::list<std::string> result;
-   struct dirent* entry;
-  int error;
- 
-  while ((error = readdir_r(dir, temp, &entry)) == 0 && entry != nullptr) {
-+  // Zero `errno` before starting to call `readdir`. This is necessary
-+  // to allow us to determine when `readdir` returns an error.
-+  errno = 0;
-+
-+  while ((entry = readdir(dir)) != NULL) {
-     if (strcmp(entry->d_name, ".") == 0 || strcmp(entry->d_name, "..") == 0) {
-       continue;
-     }
-     result.push_back(entry->d_name);
-   }
- 
-  free(temp);
-  closedir(dir);
-+  if (errno != 0) {
-+    // Preserve `readdir` error.
-+    Error error = ErrnoError("Failed to read directory");
-+    closedir(dir);
-+    return error;
-+  }
- 
-  if (error != 0) {
-    // Preserve `readdir_r` error.
-    return ErrnoError("Failed to read directories");
-+  if (closedir(dir) == -1) {
-+    return ErrnoError("Failed to close directory");
-   }
- 
-   return result;
--- a/pkgs/applications/networking/cluster/mesos/rb51325.patch
+++ b/pkgs/applications/networking/cluster/mesos/rb51325.patch
@ -1,157 +0,0 @@
-diff --git a/3rdparty/stout/include/Makefile.am b/3rdparty/stout/include/Makefile.am
-index 1f2ee85..b0b08d8 100644
--- a/3rdparty/stout/include/Makefile.am
-+++ b/3rdparty/stout/include/Makefile.am
-@@ -64,7 +64,6 @@ nobase_include_HEADERS =			\
-   stout/os/chroot.hpp				\
-   stout/os/close.hpp				\
-   stout/os/constants.hpp			\
-  stout/os/direntsize.hpp			\
-   stout/os/environment.hpp			\
-   stout/os/exists.hpp				\
-   stout/os/fcntl.hpp				\
-@@ -108,7 +107,6 @@ nobase_include_HEADERS =			\
-   stout/os/posix/chown.hpp			\
-   stout/os/posix/chroot.hpp			\
-   stout/os/posix/close.hpp			\
-  stout/os/posix/direntsize.hpp			\
-   stout/os/posix/exists.hpp			\
-   stout/os/posix/fcntl.hpp			\
-   stout/os/posix/fork.hpp			\
-@@ -134,7 +132,6 @@ nobase_include_HEADERS =			\
-   stout/os/windows/bootid.hpp			\
-   stout/os/windows/chroot.hpp			\
-   stout/os/windows/close.hpp			\
-  stout/os/windows/direntsize.hpp		\
-   stout/os/windows/exists.hpp			\
-   stout/os/windows/fcntl.hpp			\
-   stout/os/windows/fork.hpp			\
-diff --git a/3rdparty/stout/include/stout/os/direntsize.hpp b/3rdparty/stout/include/stout/os/direntsize.hpp
-deleted file mode 100644
-index 819f99a..0000000
--- a/3rdparty/stout/include/stout/os/direntsize.hpp
-+++ /dev/null
-@@ -1,26 +0,0 @@
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//  http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-#ifndef __STOUT_OS_DIRENTSIZE_HPP__
-#define __STOUT_OS_DIRENTSIZE_HPP__
-
-
-// For readability, we minimize the number of #ifdef blocks in the code by
-// splitting platform specifc system calls into separate directories.
-#ifdef __WINDOWS__
-#include <stout/os/windows/direntsize.hpp>
-#else
-#include <stout/os/posix/direntsize.hpp>
-#endif // __WINDOWS__
-
-
-#endif // __STOUT_OS_DIRENTSIZE_HPP__
-diff --git a/3rdparty/stout/include/stout/os/posix/direntsize.hpp b/3rdparty/stout/include/stout/os/posix/direntsize.hpp
-deleted file mode 100644
-index 9d8f72e..0000000
--- a/3rdparty/stout/include/stout/os/posix/direntsize.hpp
-+++ /dev/null
-@@ -1,42 +0,0 @@
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//  http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-#ifndef __STOUT_OS_POSIX_DIRENTSIZE_HPP__
-#define __STOUT_OS_POSIX_DIRENTSIZE_HPP__
-
-#include <dirent.h>
-#include <unistd.h>
-
-
-namespace os {
-
-inline size_t dirent_size(DIR* dir)
-{
-  // Calculate the size for a "directory entry".
-  long name_max = fpathconf(dirfd(dir), _PC_NAME_MAX);
-
-  // If we don't get a valid size, check NAME_MAX, but fall back on
-  // 255 in the worst case ... Danger, Will Robinson!
-  if (name_max == -1) {
-    name_max = (NAME_MAX > 255) ? NAME_MAX : 255;
-  }
-
-  size_t name_end = (size_t) offsetof(dirent, d_name) + name_max + 1;
-
-  size_t size = (name_end > sizeof(dirent) ? name_end : sizeof(dirent));
-
-  return size;
-}
-
-} // namespace os {
-
-#endif // __STOUT_OS_POSIX_DIRENTSIZE_HPP__
-diff --git a/3rdparty/stout/include/stout/os/windows/direntsize.hpp b/3rdparty/stout/include/stout/os/windows/direntsize.hpp
-deleted file mode 100644
-index 7c8c7a0..0000000
--- a/3rdparty/stout/include/stout/os/windows/direntsize.hpp
-+++ /dev/null
-@@ -1,43 +0,0 @@
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//  http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-#ifndef __STOUT_OS_WINDOWS_DIRENTSIZE_HPP__
-#define __STOUT_OS_WINDOWS_DIRENTSIZE_HPP__
-
-#include <stout/internal/windows/dirent.hpp>
-
-#include <stout/windows.hpp>
-
-
-namespace os {
-
-inline size_t dirent_size(DIR* dir)
-{
-  // NOTE: Size calculation logic here is much simpler than on POSIX because
-  // our implementation of `dirent` is constant-sized. In particular, on POSIX,
-  // we usually have to calculate the maximum name size for a path before we
-  // can alloc a correctly-size `dirent`, but on Windows, `dirent.d_name` is
-  // always `MAX_PATH` bytes in size.
-  //
-  // This follows closely from the Windows standard API data structures for
-  // manipulating and querying directories. For example, the structures
-  // `WIN32_FIND_DATA`[1] (which in many ways is the Windows equivalent of
-  // `dirent`) has a field `cFileName` (which is much like `d_name`) that is
-  // also `MAX_PATH` in size.
-  //
-  // [1] https://msdn.microsoft.com/en-us/library/windows/desktop/aa365740(v=vs.85).aspx
-  return sizeof(dirent);
-}
-
-} // namespace os {
-
-#endif // __STOUT_OS_WINDOWS_DIRENTSIZE_HPP__
--- a/pkgs/applications/networking/ftp/filezilla/default.nix
+++ b/pkgs/applications/networking/ftp/filezilla/default.nix
@ -1,13 +1,13 @@
 { stdenv, fetchurl, dbus, gnutls, wxGTK30, libidn, tinyxml, gettext
 , pkgconfig, xdg_utils, gtk2, sqlite, pugixml, libfilezilla, nettle }:

-let version = "3.23.0.2"; in
+let version = "3.24.0"; in
 stdenv.mkDerivation {
  name = "filezilla-${version}";

  src = fetchurl {
    url = "mirror://sourceforge/project/filezilla/FileZilla_Client/${version}/FileZilla_${version}_src.tar.bz2";
-    sha256 = "0bq22nq2g1b0x5msm9if74ync2qk13n2782mwj2r1r7hsmx4liiz";
+    sha256 = "1bacrl8lj90hqbh129hpbgqj78k1i84j83rkzn507jnykj4x8p9x";
  };

  configureFlags = [
--- a/pkgs/applications/networking/instant-messengers/gajim/default.nix
+++ b/pkgs/applications/networking/instant-messengers/gajim/default.nix
@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
  patches = [
    (fetchurl {
      name = "gajim-icon-index.patch";
-      url = "http://hg.gajim.org/gajim/raw-rev/b9ec78663dfb";
+      url = "https://dev.gajim.org/gajim/gajim/commit/7d20ed2b98a3070add188efab7308a5a06d9f4a2.diff";
      sha256 = "0w54hr5dq9y36val55kmh8d6cid7h4fs2nghx09714jylz2nyxxv";
    })
  ];
--- a/pkgs/applications/networking/instant-messengers/jackline/default.nix
+++ b/pkgs/applications/networking/instant-messengers/jackline/default.nix
@ -13,6 +13,8 @@ stdenv.mkDerivation rec {
    sha256 = "0h7wdsic4v6ys130w61zvxm5s2vc7y574hn7zby12rq88lhhrjh7";
  };

+  patches = [ ./uchar.patch ];
+
  buildInputs = with ocamlPackages; [
                  ocaml ocamlbuild findlib topkg ppx_sexp_conv
                  erm_xmpp_0_3 tls nocrypto x509 ocaml_lwt otr astring
--- a/pkgs/applications/networking/instant-messengers/jackline/uchar.patch
+++ b/pkgs/applications/networking/instant-messengers/jackline/uchar.patch
@ -0,0 +1,302 @@
+diff --git a/_tags b/_tags
+index 88318d9..b433ee8 100644
+--- a/_tags
+++ b/_tags
+@@ -7,9 +7,11 @@ true : package(sexplib astring)
+ 
+ <src/xconfig.ml>: package(otr ppx_sexp_conv)
+ <src/utils.ml>: package(uutf)
+<src/muc.ml>: package(uchar)
+<src/contact.mli>: package(uchar)
+ <src/persistency.ml>: package(lwt nocrypto)
+ <src/xjid.{ml,mli}>: package(ppx_sexp_conv erm_xmpp)
+-<src/user.{ml,mli}>: package(ppx_sexp_conv otr hex ptime ptime.clock.os)
+<src/user.{ml,mli}>: package(uchar ppx_sexp_conv otr hex ptime ptime.clock.os)
+ <src/xmpp_callbacks.ml>: package(erm_xmpp lwt tls tls.lwt ptime)
+ <src/xmpp_connection.ml>: package(erm_xmpp lwt tls tls.lwt)
+ 
+@@ -18,6 +20,6 @@ true : package(sexplib astring)
+ <cli/cli_input.ml>: package(notty lwt erm_xmpp otr)
+ <cli/cli_commands.ml>: package(lwt otr erm_xmpp)
+ <cli/cli_config.ml>: package(lwt nocrypto otr notty tls.lwt x509)
+-<cli/cli_state.ml>: package(hex lwt nocrypto erm_xmpp tls.lwt x509)
+<cli/cli_state.ml>: package(uchar hex lwt nocrypto erm_xmpp tls.lwt x509)
+ 
+ <bin/jackline.{ml,byte,native}>: package(erm_xmpp hex lwt notty notty.lwt nocrypto otr sexplib tls tls.lwt ptime ptime.clock.os)
+diff --git a/cli/cli_config.ml b/cli/cli_config.ml
+index 618d655..dac6e68 100644
+--- a/cli/cli_config.ml
+++ b/cli/cli_config.ml
+@@ -34,7 +34,7 @@ let rewrap term above below (prefix, inp, inp2) (width, _) =
+     let height = if col mod width = 0 then succ h else h in
+     (succ (col mod width), height)
+   in
+-  Notty_lwt.Term.cursor term (Some (col, row))
+  Notty_lwt.Term.cursor term (Some (col - 1, row - 1))
+ 
+ let read_line ?(above = []) ?(prefix = "") ?default ?(below = []) term =
+   let rec go (pre, post) =
+@@ -56,8 +56,8 @@ let read_line ?(above = []) ?(prefix = "") ?default ?(below = []) term =
+       | `Unhandled k ->
+         match k with
+         | `Key (`Enter, []) -> Lwt.return (char_list_to_str (pre @ post))
+-        | `Key (`Uchar 0x43, [`Ctrl]) -> Lwt.fail (Invalid_argument "Ctrl-c")
+-        | `Key (`Uchar 0x44, [`Ctrl]) -> Lwt.fail (Invalid_argument "Ctrl-d")
+        | `Key (`Uchar u, [`Ctrl]) when Uchar.to_int u = 0x43 -> Lwt.fail (Invalid_argument "Ctrl-c")
+        | `Key (`Uchar u, [`Ctrl]) when Uchar.to_int u = 0x44 -> Lwt.fail (Invalid_argument "Ctrl-d")
+         | _ -> go (pre, post)
+   in
+   let pre = Utils.option [] str_to_char_list default in
+@@ -180,7 +180,7 @@ let configure term () =
+     let pw = "Password: " in
+     let chars = match password with
+       | None -> I.string A.empty "will be asked at startup"
+-      | Some _ -> I.uchar A.empty 0x2605 5 1
+      | Some _ -> I.uchar A.empty (Uchar.of_int 0x2605) 5 1
+     in
+     above @ [I.(string A.empty pw <|> chars)]
+   in
+diff --git a/cli/cli_input.ml b/cli/cli_input.ml
+index 34b4288..07488f2 100644
+--- a/cli/cli_input.ml
+++ b/cli/cli_input.ml
+@@ -314,19 +314,19 @@ let read_terminal term mvar input_mvar () =
+           | `Key (`Arrow `Up, []) -> p (fun s -> ok (history s Up)) >>= fun () -> loop ()
+           | `Key (`Arrow `Down, []) -> p (fun s -> ok (history s Down)) >>= fun () -> loop ()
+ 
+-          | `Key (`Uchar 0x44, [`Ctrl]) (* C-d *) -> p (fun s -> Lwt.return (`Quit s))
+          | `Key (`Uchar u, [`Ctrl]) when Uchar.to_int u = 0x44 (* C-d *) -> p (fun s -> Lwt.return (`Quit s))
+ 
+           (* UI navigation and toggles *)
+           | `Key (`Page `Up, []) -> p (fun s -> ok (navigate_buddy_list s Up)) >>= fun () -> loop ()
+           | `Key (`Page `Down, []) -> p (fun s -> ok (navigate_buddy_list s Down)) >>= fun () -> loop ()
+ 
+           | `Key (`Page `Up, [`Ctrl]) -> p (fun s -> ok (navigate_message_buffer s Up)) >>= fun () -> loop ()
+-          | `Key (`Uchar 0x50, [`Ctrl]) (* C-p *) -> p (fun s -> ok (navigate_message_buffer s Up)) >>= fun () -> loop ()
+          | `Key (`Uchar u, [`Ctrl]) when Uchar.to_int u = 0x50 (* C-p *) -> p (fun s -> ok (navigate_message_buffer s Up)) >>= fun () -> loop ()
+           | `Key (`Page `Down, [`Ctrl]) -> p (fun s -> ok (navigate_message_buffer s Down)) >>= fun () -> loop ()
+-          | `Key (`Uchar 0x4E, [`Ctrl]) (* C-n *) -> p (fun s -> ok (navigate_message_buffer s Down)) >>= fun () -> loop ()
+          | `Key (`Uchar u, [`Ctrl]) when Uchar.to_int u = 0x4E (* C-n *) -> p (fun s -> ok (navigate_message_buffer s Down)) >>= fun () -> loop ()
+ 
+-          | `Key (`Uchar 0x58, [`Ctrl]) (* C-x *) -> p (fun s -> ok (activate_contact s s.last_active_contact)) >>= fun () -> loop ()
+-          | `Key (`Uchar 0x51, [`Ctrl]) (* C-q *) ->
+          | `Key (`Uchar u, [`Ctrl]) when Uchar.to_int u = 0x58 (* C-x *) -> p (fun s -> ok (activate_contact s s.last_active_contact)) >>= fun () -> loop ()
+          | `Key (`Uchar u, [`Ctrl]) when Uchar.to_int u = 0x51 (* C-q *) ->
+             let handle s =
+               let s = match List.rev s.notifications with
+                 | x::_ -> activate_contact s x
+diff --git a/cli/cli_state.ml b/cli/cli_state.ml
+index 5603cfe..ee320ce 100644
+--- a/cli/cli_state.ml
+++ b/cli/cli_state.ml
+@@ -24,7 +24,7 @@ type connect_v =
+   | Reconnect
+   | Presence of (User.presence * string option * int option)
+ 
+-type input = int list * int list
+type input = Uchar.t list * Uchar.t list
+ 
+ type state = {
+   (* set only initially *)
+diff --git a/cli/cli_support.ml b/cli/cli_support.ml
+index 1c54df6..8275c38 100644
+--- a/cli/cli_support.ml
+++ b/cli/cli_support.ml
+@@ -4,17 +4,17 @@ open Notty
+ module Char = struct
+   let hdash a w =
+     if !Utils.unicode then
+-      I.uchar a 0x2500 w 1
+      I.uchar a (Uchar.of_int 0x2500) w 1
+     else
+       I.char a '-' w 1
+   and vdash a h =
+     if !Utils.unicode then
+-      I.uchar a 0x2502 1 h
+      I.uchar a (Uchar.of_int 0x2502) 1 h
+     else
+       I.char a '|' 1 h
+   and star a w =
+     if !Utils.unicode then
+-      I.uchar a 0x2605 w 1
+      I.uchar a (Uchar.of_int 0x2605) w 1
+     else
+       I.char a '*' w 1
+ end
+@@ -186,8 +186,8 @@ let v_center left right width =
+   and rw = I.width right
+   in
+   match rw, lw >= width with
+-  | 0, true -> (I.hcrop (lw - width + 1) 0 left, width)
+-  | 0, false -> (left, succ lw)
+  | 0, true -> (I.hcrop (lw - width + 1) 0 left, width - 1)
+  | 0, false -> (left, lw)
+   | _, _ ->
+     if lw + rw >= width then
+       let leftw = min (max (width - rw) (width / 2)) lw in
+@@ -195,11 +195,11 @@ let v_center left right width =
+       let l = I.hcrop (lw - leftw) 0 left
+       and r = I.hcrop 0 (rw - rightw) right
+       in
+-      (I.(l <|> r), succ leftw)
+      (I.(l <|> r), leftw)
+     else
+-      (I.(left <|> right), succ lw)
+      (I.(left <|> right), lw)
+ 
+-let str_to_char_list str : int list =
+let str_to_char_list str : Uchar.t list =
+   let open Uutf in
+   List.rev (String.fold_utf_8 (fun acc _ -> function `Uchar i -> i :: acc | `Malformed _ -> acc) [] str)
+ 
+@@ -236,22 +236,26 @@ let readline_input = function
+   | k -> `Unhandled k
+ 
+ let emacs_bindings = function
+-  | `Key (`Uchar 0x41, [`Ctrl]) (* C-a *) -> `Ok (fun (pre, post) -> ([], pre @ post))
+-  | `Key (`Uchar 0x45, [`Ctrl]) (* C-e *) -> `Ok (fun (pre, post) -> (pre @ post, []))
+  | `Key (`Uchar u, [`Ctrl]) as k ->
+    begin match Uchar.to_int u with
+    | 0x41 (* C-a *) -> `Ok (fun (pre, post) -> ([], pre @ post))
+    | 0x45 (* C-e *) -> `Ok (fun (pre, post) -> (pre @ post, []))
+ 
+-  | `Key (`Uchar 0x4b, [`Ctrl]) (* C-k *) -> `Ok (fun (pre, _) -> (pre, []))
+-  | `Key (`Uchar 0x55, [`Ctrl]) (* C-u *) -> `Ok (fun (_, post) -> ([], post))
+    | 0x4b (* C-k *) -> `Ok (fun (pre, _) -> (pre, []))
+    | 0x55 (* C-u *) -> `Ok (fun (_, post) -> ([], post))
+ 
+-  | `Key (`Uchar 0x46, [`Ctrl]) (* C-f *) ->
+    | 0x46 (* C-f *) ->
+     `Ok (fun (pre, post) ->
+         match post with
+         | [] -> (pre, post)
+         | hd::tl -> (pre @ [hd], tl))
+-  | `Key (`Uchar 0x42, [`Ctrl]) (* C-b *) ->
+    | 0x42 (* C-b *) ->
+     `Ok (fun (pre, post) ->
+         match List.rev pre with
+         | [] -> ([], post)
+         | hd::tl -> (List.rev tl, hd :: post))
+    | _ -> `Unhandled k
+    end
+ 
+   | `Key (`Arrow `Left, [`Ctrl]) ->
+     `Ok (fun (pre, post) ->
+diff --git a/src/contact.mli b/src/contact.mli
+index 6926296..d6c795b 100644
+--- a/src/contact.mli
+++ b/src/contact.mli
+@@ -8,7 +8,7 @@ val bare : contact -> Xjid.bare_jid
+ val preserve_messages : contact -> bool
+ val expanded : contact -> bool
+ val messages : contact -> User.message list
+-val input_buffer : contact -> (int list * int list)
+val input_buffer : contact -> (Uchar.t list * Uchar.t list)
+ 
+ val readline_history : contact -> string list
+ val add_readline_history : contact -> string -> contact
+@@ -18,7 +18,7 @@ val set_history_position : contact -> int -> contact
+ val received : contact -> string -> contact
+ 
+ val expand : contact -> contact
+-val set_input_buffer : contact -> (int list * int list) -> contact
+val set_input_buffer : contact -> (Uchar.t list * Uchar.t list) -> contact
+ val set_preserve_messages : contact -> bool -> contact
+ 
+ val reset : contact -> contact
+diff --git a/src/muc.ml b/src/muc.ml
+index 1c98037..3293541 100644
+--- a/src/muc.ml
+++ b/src/muc.ml
+@@ -132,7 +132,7 @@ type groupchat = {
+   expand : bool ;
+   preserve_messages : bool ;
+   message_history : User.message list ; (* persistent if preserve_messages *)
+-  input_buffer : (int list * int list) ;
+  input_buffer : (Uchar.t list * Uchar.t list) ;
+   readline_history : string list ;
+   history_position : int ;
+   autojoin : bool ;
+diff --git a/src/user.ml b/src/user.ml
+index d039278..42a8c47 100644
+--- a/src/user.ml
+++ b/src/user.ml
+@@ -229,7 +229,7 @@ type user = {
+   properties        : property list ;
+   preserve_messages : bool ;
+   message_history   : message list ; (* persistent if preserve_messages is true *)
+-  input_buffer: (int list * int list) ; (* not persistent *)
+  input_buffer: (Uchar.t list * Uchar.t list) ; (* not persistent *)
+   readline_history  : string list ; (* not persistent *)
+   history_position  : int ; (* not persistent *)
+   otr_fingerprints  : fingerprint list ;
+diff --git a/src/user.mli b/src/user.mli
+index 52b503d..5ce41be 100644
+--- a/src/user.mli
+++ b/src/user.mli
+@@ -118,7 +118,7 @@ type user = {
+   properties        : property list ;
+   preserve_messages : bool ;
+   message_history   : message list ; (* persistent if preserve_messages is true *)
+-  input_buffer: (int list * int list) ; (* not persistent *)
+  input_buffer: (Uchar.t list * Uchar.t list) ; (* not persistent *)
+   readline_history  : string list ; (* not persistent *)
+   history_position  : int ;
+   otr_fingerprints  : fingerprint list ;
+diff --git a/src/utils.ml b/src/utils.ml
+index 0b4a3a7..cd9cb10 100644
+--- a/src/utils.ml
+++ b/src/utils.ml
+@@ -30,31 +30,33 @@ let validate_utf8 txt =
+   let rec loop d buf = match Uutf.decode d with
+     | `Await -> Buffer.contents buf
+     | `End -> Buffer.contents buf
+-    | `Malformed _ -> if !unicode then Uutf.Buffer.add_utf_8 buf 0xFFFD; loop d buf
+-    | `Uchar 0x000A -> (* newline *) Uutf.Buffer.add_utf_8 buf 0x000A ; loop d buf
+-    | `Uchar 0x0009 -> (* tab -> 4 spaces *) Uutf.Buffer.add_utf_8 buf 0x0020 ; Uutf.Buffer.add_utf_8 buf 0x0020 ; Uutf.Buffer.add_utf_8 buf 0x0020 ; Uutf.Buffer.add_utf_8 buf 0x0020 ; loop d buf
+-    | `Uchar 0x007F (* DEL *)
+    | `Malformed _ -> if !unicode then Uutf.Buffer.add_utf_8 buf (Uchar.of_int 0xFFFD); loop d buf
+    | `Uchar u ->
+      match Uchar.to_int u with
+      | 0x000A -> (* newline *) Uutf.Buffer.add_utf_8 buf (Uchar.of_int 0x000A) ; loop d buf
+      | 0x0009 -> (* tab -> 4 spaces *) Uutf.Buffer.add_utf_8 buf (Uchar.of_int 0x0020) ; Uutf.Buffer.add_utf_8 buf (Uchar.of_int 0x0020) ; Uutf.Buffer.add_utf_8 buf (Uchar.of_int 0x0020) ; Uutf.Buffer.add_utf_8 buf (Uchar.of_int 0x0020) ; loop d buf
+      | 0x007F (* DEL *)
+     (* See https://en.wikipedia.org/wiki/Unicode_control_characters / https://en.wikipedia.org/wiki/Bi-directional_text *)
+-    | `Uchar 0x200E | `Uchar 0x200F (* left-to-right / right-to-left *)
+-    | `Uchar 0x202A | `Uchar 0x202D (* left-to-right embedding / override *)
+-    | `Uchar 0x202B | `Uchar 0x202E (* right-to-left embedding / override *)
+-    | `Uchar 0x202C  (* pop directional format *)
+-    | `Uchar 0x2066 | `Uchar 0x2067 (* l-t-r isolate r-t-l isolate *)
+-    | `Uchar 0x2068 | `Uchar 0x2069 (* first strong isolate / pop directional isolate *)
+-    | `Uchar 0x2028 | `Uchar 0x2029 (* line separator / page separator *) ->
+-      if !unicode then Uutf.Buffer.add_utf_8 buf 0xFFFD ; loop d buf
+-    | `Uchar x when x < 0x20 ->
+      | 0x200E | 0x200F (* left-to-right / right-to-left *)
+      | 0x202A | 0x202D (* left-to-right embedding / override *)
+      | 0x202B | 0x202E (* right-to-left embedding / override *)
+      | 0x202C  (* pop directional format *)
+      | 0x2066 | 0x2067 (* l-t-r isolate r-t-l isolate *)
+      | 0x2068 | 0x2069 (* first strong isolate / pop directional isolate *)
+      | 0x2028 | 0x2029 (* line separator / page separator *) ->
+      if !unicode then Uutf.Buffer.add_utf_8 buf (Uchar.of_int 0xFFFD) ; loop d buf
+      | x when x < 0x20 ->
+       (* other control characters *)
+-      if !unicode then Uutf.Buffer.add_utf_8 buf 0xFFFD ; loop d buf
+-    | `Uchar x when x >= 0x0080 && x <= 0x009F ->
+      if !unicode then Uutf.Buffer.add_utf_8 buf (Uchar.of_int 0xFFFD) ; loop d buf
+      | x when x >= 0x0080 && x <= 0x009F ->
+       (* ctrl chars used in conjunction with ISO 8859 character sets (C0/C1) *)
+-      if !unicode then Uutf.Buffer.add_utf_8 buf 0xFFFD ; loop d buf
+      if !unicode then Uutf.Buffer.add_utf_8 buf (Uchar.of_int 0xFFFD) ; loop d buf
+ 
+-    | `Uchar x ->
+      | x ->
+       let c = if !unicode then x else if x > 0xff then 0x3f else x in
+-      Uutf.Buffer.add_utf_8 buf c ; loop d buf
+      Uutf.Buffer.add_utf_8 buf (Uchar.of_int c) ; loop d buf
+   in
+-  let nln = `Readline 0x000A in
+  let nln = `Readline (Uchar.of_int 0x000A) in
+   loop (Uutf.decoder ~nln ~encoding:`UTF_8 (`String txt)) (Buffer.create (String.length txt))
+ 
+ let version = "%%VERSION_NUM%%"
--- a/pkgs/applications/networking/yafc/default.nix
+++ b/pkgs/applications/networking/yafc/default.nix
@ -1,19 +0,0 @@
-{stdenv, fetchurl, readline, libssh, intltool, libbsd, pkgconfig}:
-
-stdenv.mkDerivation rec {
-  name = "yafc-1.3.6";
-  src = fetchurl {
-    url = "http://www.yafc-ftp.com/downloads/${name}.tar.xz";
-    sha256 = "0wvrljihliggysfnzczc0s74i3ab2c1kzjjs99iqk98nxmb2b8v3";
-  };
-
-  buildInputs = [ readline libssh intltool libbsd pkgconfig ];
-
-  meta = {
-    description = "ftp/sftp client with readline, autocompletion and bookmarks";
-    homepage = http://www.yafc-ftp.com;
-    maintainers = [ stdenv.lib.maintainers.page ];
-    license = stdenv.lib.licenses.gpl2Plus;
-    platforms = stdenv.lib.platforms.linux;
-  };
-}
--- a/pkgs/applications/science/logic/alt-ergo/default.nix
+++ b/pkgs/applications/science/logic/alt-ergo/default.nix
@ -2,16 +2,16 @@

 stdenv.mkDerivation rec {
  name = "alt-ergo-${version}";
-  version = "0.99.1";
+  version = "1.30";

  src = fetchurl {
    url    = "http://alt-ergo.ocamlpro.com/download_manager.php?target=${name}.tar.gz";
    name   = "${name}.tar.gz";
-    sha256 = "0lnlf56ysisa45dxvbwzhl4fgyxyfz35psals2kv9x8gyq54zwpm";
+    sha256 = "025pacb4ax864fn5x8k78mw6hiig4jcazblj18gzxspg4f1l5n1g";
  };

  buildInputs = with ocamlPackages;
-    [ ocaml findlib ocamlgraph zarith lablgtk ];
+    [ ocaml findlib camlzip ocamlgraph zarith lablgtk ocplib-simplex ];

  meta = {
    description = "High-performance theorem prover and SMT solver";
--- a/pkgs/applications/science/logic/why3/default.nix
+++ b/pkgs/applications/science/logic/why3/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name    = "why3-${version}";
-  version = "0.87.1";
+  version = "0.87.3";

  src = fetchurl {
-    url    = https://gforge.inria.fr/frs/download.php/file/35893/why3-0.87.1.tar.gz;
-    sha256 = "1ssik2f6fkpvwpdmxz8hrm3p62qas3sjlqya0r57s60ilpkgiwwb";
+    url    = https://gforge.inria.fr/frs/download.php/file/36398/why3-0.87.3.tar.gz;
+    sha256 = "1fn9v6w1ilkrm2n4rz31w8qvjnchyvwxiqs67z3f59b5k99wb2ka";
  };

  buildInputs = (with ocamlPackages; [
--- a/pkgs/applications/version-management/gogs/default.nix
+++ b/pkgs/applications/version-management/gogs/default.nix
@ -0,0 +1,48 @@
+{ stdenv, buildGoPackage, fetchFromGitHub, makeWrapper
+, git, coreutils, bash, gzip, openssh
+, sqliteSupport ? true
+}:
+
+buildGoPackage rec {
+  name = "gogs-${version}";
+  version = "0.9.113";
+
+  src = fetchFromGitHub {
+    owner = "gogits";
+    repo = "gogs";
+    rev = "v${version}";
+    sha256 = "1zk83c9jiazfw3221yi2sidp7917q3dxb2xb7wrjg4an18gj46j7";
+  };
+
+  patchPhase = ''
+    substituteInPlace models/repo.go \
+      --replace '#!/usr/bin/env' '#!${coreutils}/bin/env'
+  '';
+
+  buildInputs = [ makeWrapper ];
+
+  buildFlags = stdenv.lib.optionalString sqliteSupport "-tags sqlite";
+
+  outputs = [ "bin" "out" "data" ];
+
+  postInstall = ''
+    mkdir $data
+    cp -R $src/{public,templates} $data
+
+    wrapProgram $bin/bin/gogs \
+      --prefix PATH : ${stdenv.lib.makeBinPath [ bash git gzip openssh ]} \
+      --run 'export GOGS_WORK_DIR=''${GOGS_WORK_DIR:-$PWD}' \
+      --run 'mkdir -p "$GOGS_WORK_DIR" && cd "$GOGS_WORK_DIR"' \
+      --run "ln -fs $data/{public,templates} ."
+  '';
+
+  goPackagePath = "github.com/gogits/gogs";
+  goDeps = ./deps.nix;
+
+  meta = {
+    description = "A painless self-hosted Git service";
+    homepage = "https://gogs.io";
+    license = stdenv.lib.licenses.mit;
+    maintainers = with stdenv.lib.maintainers; [ schneefux ];
+  };
+}
--- a/pkgs/applications/version-management/gogs/deps.nix
+++ b/pkgs/applications/version-management/gogs/deps.nix
@ -0,0 +1,443 @@
+[
+  {
+    goPackagePath = "github.com/Unknwon/cae";
+    fetch = {
+      type = "git";
+      url = "https://github.com/Unknwon/cae";
+      rev = "c6aac99ea2cae2ebaf23f26f76b04fe3fcfc9f8c";
+      sha256 = "0j6l1fcs6gp4qw6b9w3pg9fgah18lh1hanfz5y64r6ks244v3l7s";
+    };
+  }
+  {
+    goPackagePath = "github.com/Unknwon/com";
+    fetch = {
+      type = "git";
+      url = "https://github.com/Unknwon/com";
+      rev = "28b053d5a2923b87ce8c5a08f3af779894a72758";
+      sha256 = "09i9slj4zbsqmwkkx9bqi7cgpv6hqby6r98l6qx1wag89qijybz2";
+    };
+  }
+  {
+    goPackagePath = "github.com/Unknwon/i18n";
+    fetch = {
+      type = "git";
+      url = "https://github.com/Unknwon/i18n";
+      rev = "39d6f2727e0698b1021ceb6a77c1801aa92e7d5d";
+      sha256 = "1f4s9srdaqw2yqgc3d76vww3glbwka2f5q4zrwn8bb66kcazbfb7";
+    };
+  }
+  {
+    goPackagePath = "github.com/Unknwon/paginater";
+    fetch = {
+      type = "git";
+      url = "https://github.com/Unknwon/paginater";
+      rev = "701c23f468663c34d1b1768c3ae1bcc57e11c5b3";
+      sha256 = "09h3gyd9wyzgbkny5g5ihd4ckmv0bams8g5y2xfkd55gizlmx07p";
+    };
+  }
+  {
+    goPackagePath = "github.com/bradfitz/gomemcache";
+    fetch = {
+      type = "git";
+      url = "https://github.com/bradfitz/gomemcache";
+      rev = "2fafb84a66c4911e11a8f50955b01e74fe3ab9c5";
+      sha256 = "1k3vqmq008gad1cq1gaqa35k5ldn0z8fcx07c15x9v8p9xjbhkc9";
+    };
+  }
+  {
+    goPackagePath = "github.com/go-macaron/binding";
+    fetch = {
+      type = "git";
+      url = "https://github.com/go-macaron/binding";
+      rev = "48920167fa152d02f228cfbece7e0f1e452d200a";
+      sha256 = "00h4mdyhqkh75vgafyyyn54kdpwj82ifg9l6lxv9gnkw6frxhkan";
+    };
+  }
+  {
+    goPackagePath = "github.com/go-macaron/cache";
+    fetch = {
+      type = "git";
+      url = "https://github.com/go-macaron/cache";
+      rev = "56173531277692bc2925924d51fda1cd0a6b8178";
+      sha256 = "1116a22wm43q2l54nnycgli90kix787j20mpgya9qb6xnglcck59";
+    };
+  }
+  {
+    goPackagePath = "github.com/go-macaron/captcha";
+    fetch = {
+      type = "git";
+      url = "https://github.com/go-macaron/captcha";
+      rev = "8aa5919789ab301e865595eb4b1114d6b9847deb";
+      sha256 = "0wdihxbl7yw4wg2x0wb09kv9swfpr5j06wsj4hxn3xcbpqi9viwm";
+    };
+  }
+  {
+    goPackagePath = "github.com/go-macaron/csrf";
+    fetch = {
+      type = "git";
+      url = "https://github.com/go-macaron/csrf";
+      rev = "6a9a7df172cc1fcd81e4585f44b09200b6087cc0";
+      sha256 = "173da2hl9fcfgkn0nv1ws3pr0gyyp88amhj2bfk4414k5a3r0nsa";
+    };
+  }
+  {
+    goPackagePath = "github.com/go-macaron/gzip";
+    fetch = {
+      type = "git";
+      url = "https://github.com/go-macaron/gzip";
+      rev = "cad1c6580a07c56f5f6bc52d66002a05985c5854";
+      sha256 = "12mq3dd1vd0jbi80fxab4ysmipbz9zhbm9nw6y6a6bw3byc8w4jf";
+    };
+  }
+  {
+    goPackagePath = "github.com/go-macaron/i18n";
+    fetch = {
+      type = "git";
+      url = "https://github.com/go-macaron/i18n";
+      rev = "ef57533c3b0fc2d8581deda14937e52f11a203ab";
+      sha256 = "1nkrcnpjl3x6fhjss2vp29mnvam20vpvxvxpfg1zspi1rjmpyhqy";
+    };
+  }
+  {
+    goPackagePath = "github.com/go-macaron/inject";
+    fetch = {
+      type = "git";
+      url = "https://github.com/go-macaron/inject";
+      rev = "d8a0b8677191f4380287cfebd08e462217bac7ad";
+      sha256 = "0p47pz699xhmi8yxhahvrpai9r49rqap5ckwmz1dlkrnh3zwhrhh";
+    };
+  }
+  {
+    goPackagePath = "github.com/go-macaron/session";
+    fetch = {
+      type = "git";
+      url = "https://github.com/go-macaron/session";
+      rev = "b8a2b5ef7fb4c91c1c8ca23e2a52e29a4bcbb22f";
+      sha256 = "1nz823fn23wp87pzzhpxlbr6j7q4khywa9n0h1kpdikiy87z5k5m";
+    };
+  }
+  {
+    goPackagePath = "github.com/go-macaron/toolbox";
+    fetch = {
+      type = "git";
+      url = "https://github.com/go-macaron/toolbox";
+      rev = "99a42f20e9e88daec5c0d7beb4e7eac134680ab0";
+      sha256 = "0r6ksiqzrii7b9vv8daz68044pyifsxmpz48m6h8m6l3h9ygz8cx";
+    };
+  }
+  {
+    goPackagePath = "github.com/go-sql-driver/mysql";
+    fetch = {
+      type = "git";
+      url = "https://github.com/go-sql-driver/mysql";
+      rev = "2e00b5cd70399450106cec6431c2e2ce3cae5034";
+      sha256 = "085g48jq9hzmlcxg122n0c4pi41sc1nn2qpx1vrl2jfa8crsppa5";
+    };
+  }
+  {
+    goPackagePath = "github.com/go-xorm/builder";
+    fetch = {
+      type = "git";
+      url = "https://github.com/go-xorm/builder";
+      rev = "db75972580de4a7c6c20fff5b16a924c3de3fa12";
+      sha256 = "0qgrvjfghkgfhbrm989yhrwgs36d6wxcap012glpmd2ddp5klw46";
+    };
+  }
+  {
+    goPackagePath = "github.com/go-xorm/core";
+    fetch = {
+      type = "git";
+      url = "https://github.com/go-xorm/core";
+      rev = "2fbe2c76c6781d9e1c0398fc25386426e611f975";
+      sha256 = "1rfry5md6g8b6d6vyqpqys3wl2mxf6v55d2aapxlx3hqn6lz0lax";
+    };
+  }
+  {
+    goPackagePath = "github.com/go-xorm/xorm";
+    fetch = {
+      type = "git";
+      url = "https://github.com/go-xorm/xorm";
+      rev = "2189b36884a485d1d609fc5690bfc71a8a7de8c3";
+      sha256 = "02z140xbwqins6ql8hwdr6ar3d67jqrkm22bamqbj2rmfl7z0846";
+    };
+  }
+  {
+    goPackagePath = "github.com/gogits/chardet";
+    fetch = {
+      type = "git";
+      url = "https://github.com/gogits/chardet";
+      rev = "2404f777256163ea3eadb273dada5dcb037993c0";
+      sha256 = "1dki2pqhnzcmzlqrq4d4jwknnjxm82xqnmizjjdblb6h98ans1cd";
+    };
+  }
+  {
+    goPackagePath = "github.com/gogits/cron";
+    fetch = {
+      type = "git";
+      url = "https://github.com/gogits/cron";
+      rev = "2fc07a4c4f1e3c4d2301c5ed578d5e2c31c70421";
+      sha256 = "0a153pspisnhjpxjsryqdb29y6b8ics0203icbq5lps2g5jyaiw0";
+    };
+  }
+  {
+    goPackagePath = "github.com/gogits/git-module";
+    fetch = {
+      type = "git";
+      url = "https://github.com/gogits/git-module";
+      rev = "df1013f8eb4dc70de90bc5597bf560a4b7da802e";
+      sha256 = "1vnfiwdwp210hn7z7fgi5i80mggk76blbhykqg8wvx8bi0wxlrs8";
+    };
+  }
+  {
+    goPackagePath = "github.com/gogits/go-gogs-client";
+    fetch = {
+      type = "git";
+      url = "https://github.com/gogits/go-gogs-client";
+      rev = "98046bb98061fc6baa5bb86359af0b7c300d384a";
+      sha256 = "1wsg70irk4lwyak4kn2ml64j1fglqkyzs2lgc2mk4n4j5kn9hs1k";
+    };
+  }
+  {
+    goPackagePath = "github.com/gogits/go-libravatar";
+    fetch = {
+      type = "git";
+      url = "https://github.com/gogits/go-libravatar";
+      rev = "cd1abbd55d09b793672732a7a1dfdaa12a40dfd0";
+      sha256 = "00xvnddfh1m5g17mrnvp505i4sgwpk1r0wqz6a15bp6lvadwwlnj";
+    };
+  }
+  {
+    goPackagePath = "github.com/issue9/identicon";
+    fetch = {
+      type = "git";
+      url = "https://github.com/issue9/identicon";
+      rev = "d36b54562f4cf70c83653e13dc95c220c79ef521";
+      sha256 = "0y82b3gq8rpqglvf3lsqhgp5djfdammwd1w24k3i97iqls0rch7l";
+    };
+  }
+  {
+    goPackagePath = "github.com/jaytaylor/html2text";
+    fetch = {
+      type = "git";
+      url = "https://github.com/jaytaylor/html2text";
+      rev = "4b9124c9b0a2279e2092c4a9aaf1c83bbd2dcffc";
+      sha256 = "1yp0rawzziia9diffxs6k5g85acq3a62yb5ajbvy04r2p04dv85h";
+    };
+  }
+  {
+    goPackagePath = "github.com/klauspost/compress";
+    fetch = {
+      type = "git";
+      url = "https://github.com/klauspost/compress";
+      rev = "e3b7981a12dd3cab49afa1d3a50e715846f23732";
+      sha256 = "0hxciiaqrbf7rr112r7rwk7jcwhvjpbhnp8ikszp56zwqd64k9vn";
+    };
+  }
+  {
+    goPackagePath = "github.com/klauspost/cpuid";
+    fetch = {
+      type = "git";
+      url = "https://github.com/klauspost/cpuid";
+      rev = "09cded8978dc9e80714c4d85b0322337b0a1e5e0";
+      sha256 = "05l8pfch0gvxh0khapwxhsk4xajn40vbjr360n49vh2z5531v2xq";
+    };
+  }
+  {
+    goPackagePath = "github.com/klauspost/crc32";
+    fetch = {
+      type = "git";
+      url = "https://github.com/klauspost/crc32";
+      rev = "cb6bfca970f6908083f26f39a79009d608efd5cd";
+      sha256 = "0q4yr4isgmph1yf1vq527lpmid7vqv56q7vxh3gkp5679fb90q6n";
+    };
+  }
+  {
+    goPackagePath = "github.com/lib/pq";
+    fetch = {
+      type = "git";
+      url = "https://github.com/lib/pq";
+      rev = "8df6253d1317616f36b0c3740eb30c239a7372cb";
+      sha256 = "0djs6k6rdh06v8bz0msn0lv532hk2vrljj1pz4kgmbqcmd17y31k";
+    };
+  }
+  {
+    goPackagePath = "github.com/mcuadros/go-version";
+    fetch = {
+      type = "git";
+      url = "https://github.com/mcuadros/go-version";
+      rev = "257f7b9a7d87427c8d7f89469a5958d57f8abd7c";
+      sha256 = "0mpbcc698503hbrlc74l3nqd6hdr0n6vybfzw10pg7qx3cpmn512";
+    };
+  }
+  {
+    goPackagePath = "github.com/microcosm-cc/bluemonday";
+    fetch = {
+      type = "git";
+      url = "https://github.com/microcosm-cc/bluemonday";
+      rev = "e79763773ab6222ca1d5a7cbd9d62d83c1f77081";
+      sha256 = "04rd8jzy8kzzm0j0k7wy90pykl8ws43yhhwl2gkyz6rak10jhqpz";
+    };
+  }
+  {
+    goPackagePath = "github.com/nfnt/resize";
+    fetch = {
+      type = "git";
+      url = "https://github.com/nfnt/resize";
+      rev = "891127d8d1b52734debe1b3c3d7e747502b6c366";
+      sha256 = "08lg2v4s1iyzqja7xb69d57gpz1y43yqfwv7i4fa7a06m595r9iw";
+    };
+  }
+  {
+    goPackagePath = "github.com/russross/blackfriday";
+    fetch = {
+      type = "git";
+      url = "https://github.com/russross/blackfriday";
+      rev = "5f33e7b7878355cd2b7e6b8eefc48a5472c69f70";
+      sha256 = "0d7faqxrxvh8hwc1r8gbasgmr8x5blxvzciwspir2yafjfbqy87k";
+    };
+  }
+  {
+    goPackagePath = "github.com/satori/go.uuid";
+    fetch = {
+      type = "git";
+      url = "https://github.com/satori/go.uuid";
+      rev = "b061729afc07e77a8aa4fad0a2fd840958f1942a";
+      sha256 = "0q87n5an7ha2d8kl6gn9wi41rq0whsxq68w5x3nxz7w9vgkfnq1k";
+    };
+  }
+  {
+    goPackagePath = "github.com/sergi/go-diff";
+    fetch = {
+      type = "git";
+      url = "https://github.com/sergi/go-diff";
+      rev = "83532ca1c1caa393179c677b6facf48e61f4ca5d";
+      sha256 = "08niiivkn9a1hdl738w2sq4vq6csqhw91an8wq83dk40q62f4sq8";
+    };
+  }
+  {
+    goPackagePath = "github.com/shurcooL/sanitized_anchor_name";
+    fetch = {
+      type = "git";
+      url = "https://github.com/shurcooL/sanitized_anchor_name";
+      rev = "1dba4b3954bc059efc3991ec364f9f9a35f597d2";
+      sha256 = "0pwap8lp79pldd95a1qi3xhlsa17m8zddpgc5jzvk6d1cjpsm6qg";
+    };
+  }
+  {
+    goPackagePath = "github.com/urfave/cli";
+    fetch = {
+      type = "git";
+      url = "https://github.com/urfave/cli";
+      rev = "0bdeddeeb0f650497d603c4ad7b20cfe685682f6";
+      sha256 = "1ny63c7bfwfrsp7vfkvb4i0xhq4v7yxqnwxa52y4xlfxs4r6v6fg";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/crypto";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/crypto";
+      rev = "cb497ae8f18e3c55f81bc9f3876c8f4c3d8a2813";
+      sha256 = "0zah08y0a9rqk1ggp0ylkpycr3amrc22ncsppyrymry44g56xyfj";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/net";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/net";
+      rev = "ae05321a78c1401cec22ba7bc203b597ea372496";
+      sha256 = "1fzbijklrmhwj4mlwrnrxbbrhlzpgrsbv05zldbkvhic14g0ii2c";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/text";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/text";
+      rev = "44f4f658a783b0cee41fe0a23b8fc91d9c120558";
+      sha256 = "1hgwc2p5azfyzvl7i47my3wnbp2g7814a2sshqw63dvggs9mszcx";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/asn1-ber.v1";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/asn1-ber.v1";
+      rev = "4e86f4367175e39f69d9358a5f17b4dda270378d";
+      sha256 = "13p8s74kzklb5lklfpxwxb78rknihawv1civ4s9bfqx565010fwk";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/bufio.v1";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/bufio.v1";
+      rev = "567b2bfa514e796916c4747494d6ff5132a1dfce";
+      sha256 = "1z5pj778hdianlfj14p0d67g69v4gc2kvn6jg27z5jf75a88l19b";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/editorconfig/editorconfig-core-go.v1";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/editorconfig/editorconfig-core-go.v1";
+      rev = "a872f05c2e34b37b567401384d202aff11ba06d4";
+      sha256 = "17mc7rm0fl5vi7ky95c2bd7c8ck0ms5bghzmgx9qk7x1zrw91335";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/gomail.v2";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/gomail.v2";
+      rev = "81ebce5c23dfd25c6c67194b37d3dd3f338c98b1";
+      sha256 = "0zdykrv5s19lnq0g49p6njldy4cpk4g161vyjafiw7f84h8r28mc";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/ini.v1";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/ini.v1";
+      rev = "6f66b0e091edb3c7b380f7c4f0f884274d550b67";
+      sha256 = "1n09b7ypbayhk6x7qi3g3hrqjlmj5yszwl5d8jykjd5azp6h8sb8";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/ldap.v2";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/ldap.v2";
+      rev = "8168ee085ee43257585e50c6441aadf54ecb2c9f";
+      sha256 = "1w0993i8bl8sap01gwm1v6hjp0rsanj2mbpyabwcwnns2g79n895";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/macaron.v1";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/macaron.v1";
+      rev = "ddb19a9f3e8cedd44696b9dd5854dc8a43f3dd6c";
+      sha256 = "0riggdq8zxy5x6zhks66slvsg22b9i4399f7ns2l6daj79myqyvy";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/redis.v2";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/redis.v2";
+      rev = "e6179049628164864e6e84e973cfb56335748dea";
+      sha256 = "02hifpgak39y39lbn7v2ybbpk3rmb8nvmb3h3490frr8s4pfkb8h";
+    };
+  }
+  {
+    goPackagePath = "github.com/mattn/go-sqlite3";
+    fetch = {
+      type = "git";
+      url = "https://github.com/mattn/go-sqlite3";
+      rev = "b4142c444a8941d0d92b0b7103a24df9cd815e42";
+      sha256 = "0xq2y4am8dz9w9aaq24s1npg1sn8pf2gn4nki73ylz2fpjwq9vla";
+    };
+  }
+]
--- a/pkgs/applications/video/kodi/plugins.nix
+++ b/pkgs/applications/video/kodi/plugins.nix
@ -232,7 +232,7 @@ in
      homepage = https://github.com/kodi-pvr/pvr.hts;
      description = "Kodi's Tvheadend HTSP client addon";
      platforms = platforms.all;
-      maintainers = with maintainers; [ page ];
+      maintainers = with maintainers; [ cpages ];
    };
  }).override {
    buildInputs = [ cmake kodi libcec_platform kodi-platform ];
--- a/pkgs/applications/video/smplayer/default.nix
+++ b/pkgs/applications/video/smplayer/default.nix
@ -1,11 +1,11 @@
 { stdenv, fetchurl, qmakeHook, qtscript }:

 stdenv.mkDerivation rec {
-  name = "smplayer-16.11.0";
+  name = "smplayer-17.1.0";

  src = fetchurl {
    url = "mirror://sourceforge/smplayer/${name}.tar.bz2";
-    sha256 = "0nhbr33p21qb7n6wry0nkavl5nfjzl5yylrhnxz0pyv69n5msfp5";
+    sha256 = "0wgw940gxf3gqh6xzxvz037ipvr1xcw86gf0myvpb4lkwqh5jds0";
  };

  buildInputs = [ qtscript ];
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@ -1,5 +1,5 @@
 { stdenv, lib, fetchFromGitHub, makeWrapper, pkgconfig, go-md2man
-, go, containerd, runc
+, go, containerd, runc, docker-proxy, tini
 , sqlite, iproute, bridge-utils, devicemapper, systemd
 , btrfs-progs, iptables, e2fsprogs, xz, utillinux, xfsprogs
 , procps
@ -11,15 +11,53 @@ with lib;

 stdenv.mkDerivation rec {
  name = "docker-${version}";
-  version = "1.12.6";
+  version = "1.13.0";

  src = fetchFromGitHub {
    owner = "docker";
    repo = "docker";
    rev = "v${version}";
-    sha256 = "10jhjas07xxlxjsxby8865rr0d0zsc5azy16rsz1idmy7f7lk6jh";
+    sha256 = "03b181xiqgnwanc567w9p6rbdgdvrfv0lk4r7b604ksm0fr4cz23";
  };

+  docker-runc = runc.overrideAttrs (oldAttrs: rec {
+    name = "docker-runc";
+    src = fetchFromGitHub {
+      owner = "docker";
+      repo = "runc";
+      rev = "2f7393a47307a16f8cee44a37b262e8b81021e3e";
+      sha256 = "1s5nfnbinzmcnm8avhvsniz0ihxyva4w5qz1hzzyqdyr0w2scnbj";
+    };
+    # docker/runc already include these patches / are not applicable
+    patches = [];
+  });
+  docker-containerd = containerd.overrideAttrs (oldAttrs: rec {
+    name = "docker-containerd";
+    src = fetchFromGitHub {
+      owner = "docker";
+      repo = "containerd";
+      rev = "03e5862ec0d8d3b3f750e19fca3ee367e13c090e";
+      sha256 = "184sd9dwkcba3zhxnz9grw8p81x05977p36cif2dgkhjdhv12map";
+    };
+  });
+  docker-tini = tini.overrideAttrs  (oldAttrs: rec {
+    name = "docker-init";
+    src = fetchFromGitHub {
+      owner = "krallin";
+      repo = "tini";
+      rev = "949e6facb77383876aeff8a6944dde66b3089574";
+      sha256 = "0zj4kdis1vvc6dwn4gplqna0bs7v6d1y2zc8v80s3zi018inhznw";
+    };
+
+    # Do not remove static from make files as we want a static binary
+    patchPhase = ''
+    '';
+
+    NIX_CFLAGS_COMPILE = [
+      "-DMINIMAL=ON"
+    ];
+  });
+
  buildInputs = [
    makeWrapper pkgconfig go-md2man go
    sqlite devicemapper btrfs-progs systemd
@ -52,16 +90,17 @@ stdenv.mkDerivation rec {
  installPhase = ''
    install -Dm755 ./bundles/${version}/dynbinary-client/docker-${version} $out/libexec/docker/docker
    install -Dm755 ./bundles/${version}/dynbinary-daemon/dockerd-${version} $out/libexec/docker/dockerd
-    install -Dm755 ./bundles/${version}/dynbinary-daemon/docker-proxy-${version} $out/libexec/docker/docker-proxy
    makeWrapper $out/libexec/docker/docker $out/bin/docker \
      --prefix PATH : "$out/libexec/docker:$extraPath"
    makeWrapper $out/libexec/docker/dockerd $out/bin/dockerd \
      --prefix PATH : "$out/libexec/docker:$extraPath"

    # docker uses containerd now
-    ln -s ${containerd}/bin/containerd $out/libexec/docker/docker-containerd
-    ln -s ${containerd}/bin/containerd-shim $out/libexec/docker/docker-containerd-shim
-    ln -s ${runc}/bin/runc $out/libexec/docker/docker-runc
+    ln -s ${docker-containerd}/bin/containerd $out/libexec/docker/docker-containerd
+    ln -s ${docker-containerd}/bin/containerd-shim $out/libexec/docker/docker-containerd-shim
+    ln -s ${docker-runc}/bin/runc $out/libexec/docker/docker-runc
+    ln -s ${docker-proxy}/bin/docker-proxy $out/libexec/docker/docker-proxy
+    ln -s ${docker-tini}/bin/tini-static $out/libexec/docker/docker-init

    # systemd
    install -Dm644 ./contrib/init/systemd/docker.service $out/etc/systemd/system/docker.service
--- a/pkgs/applications/virtualization/docker/proxy.nix
+++ b/pkgs/applications/virtualization/docker/proxy.nix
@ -0,0 +1,36 @@
+{ stdenv, lib, fetchFromGitHub, go, docker }:
+
+with lib;
+
+stdenv.mkDerivation rec {
+  name = "docker-proxy-${rev}";
+  rev = "0f534354b813003a754606689722fe253101bc4e";
+
+  src = fetchFromGitHub {
+    inherit rev;
+    owner = "docker";
+    repo = "libnetwork";
+    sha256 = "1ah7h417llcq0xzdbp497pchb9m9qvjhrwajcjb0ybrs8v889m31";
+  };
+
+  buildInputs = [ go ];
+
+  buildPhase = ''
+    mkdir -p .gopath/src/github.com/docker
+    ln -sf $(pwd) .gopath/src/github.com/docker/libnetwork
+    GOPATH="$(pwd)/.gopath:$(pwd)/Godeps/_workspace" go build -ldflags="$PROXY_LDFLAGS" -o docker-proxy ./cmd/proxy
+  '';
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp docker-proxy $out/bin
+  '';
+
+  meta = {
+    description = "Docker proxy binary to forward traffic between host and containers";
+    license = licenses.asl20;
+    homepage = https://github.com/docker/libnetwork;
+    maintainers = with maintainers; [vdemeester];
+    platforms = docker.meta.platforms;
+  };
+}
--- a/pkgs/applications/virtualization/tini/default.nix
+++ b/pkgs/applications/virtualization/tini/default.nix
@ -1,18 +1,20 @@
-{ stdenv, fetchurl, cmake }:
+{ stdenv, fetchFromGitHub, cmake, glibc }:

 stdenv.mkDerivation rec {
-  version = "0.8.3";
+  version = "0.13.1";
  name = "tini-${version}";
-  src = fetchurl {
-    url = "https://github.com/krallin/tini/archive/v0.8.3.tar.gz";
-    sha256 ="1w7rj4crrcyv25idmh4asbp2sxzwyihy5mbpw384bzxjzaxn9xpa";
+  src = fetchFromGitHub {
+    owner = "krallin";
+    repo = "tini";
+    rev = "v${version}";
+    sha256 ="1g4n8v5d197zcb41fcpbhip2x342383zw1d2zkv57w73vkqgv6z6";
  };
  patchPhase = "sed -i /tini-static/d CMakeLists.txt";
  NIX_CFLAGS_COMPILE = [
    "-DPR_SET_CHILD_SUBREAPER=36"
    "-DPR_GET_CHILD_SUBREAPER=37"
  ];
-  buildInputs = [ cmake ];
+  buildInputs = [ cmake glibc glibc.static ];
  meta = with stdenv.lib; {
    description = "A tiny but valid init for containers";
    homepage = https://github.com/krallin/tini;
--- a/pkgs/data/fonts/paratype-pt/sans.nix
+++ b/pkgs/data/fonts/paratype-pt/sans.nix
@ -1,7 +1,7 @@
 { stdenv, fetchurl, unzip }:

 stdenv.mkDerivation rec {
-  name = "paratype-pt-sane";
+  name = "paratype-pt-sans";

  src = fetchurl rec {
    url = "http://www.paratype.ru/uni/public/PTSans.zip";
--- a/pkgs/desktops/gnome-3/3.20/apps/accerciser/default.nix
+++ b/pkgs/desktops/gnome-3/3.20/apps/accerciser/default.nix
@ -1,28 +0,0 @@
-{ stdenv, fetchurl, pkgconfig, gnome3, gtk3, wrapGAppsHook
-, itstool, libxml2, python3Packages, at_spi2_core
-, dbus, intltool, libwnck3 }:
-
-stdenv.mkDerivation rec {
-  name = "accerciser-3.14.0";
-
-  src = fetchurl {
-    url = "mirror://gnome/sources/accerciser/3.14/${name}.tar.xz";
-    sha256 = "0x05gpajpcs01g7m34g6fxz8122cf9kx3k0lchwl34jy8xfr39gm";
-  };
-
-  buildInputs = [
-    pkgconfig gtk3 wrapGAppsHook itstool libxml2 python3Packages.python python3Packages.pyatspi
-    python3Packages.pygobject3 python3Packages.ipython
-    at_spi2_core dbus intltool libwnck3 gnome3.defaultIconTheme
-  ];
-
-  wrapPrefixVariables = [ "PYTHONPATH" ];
-
-  meta = with stdenv.lib; {
-    homepage = https://wiki.gnome.org/Apps/Accerciser;
-    description = "Interactive Python accessibility explorer";
-    maintainers = gnome3.maintainers;
-    license = licenses.bsd3;
-    platforms = platforms.linux;
-  };
-}
--- a/pkgs/desktops/gnome-3/3.20/apps/bijiben/default.nix
+++ b/pkgs/desktops/gnome-3/3.20/apps/bijiben/default.nix
@ -1,36 +0,0 @@
-{ stdenv, intltool, fetchurl, pkgconfig, glib
-, evolution_data_server, evolution, sqlite
-, makeWrapper, itstool, desktop_file_utils
-, clutter_gtk, libuuid, webkitgtk, zeitgeist
-, gnome3, librsvg, gdk_pixbuf, libxml2 }:
-
-stdenv.mkDerivation rec {
-  inherit (import ./src.nix fetchurl) name src;
-
-  doCheck = true;
-
-  propagatedUserEnvPkgs = [ gnome3.gnome_themes_standard ];
-
-  buildInputs = [ pkgconfig glib intltool itstool libxml2
-                  clutter_gtk libuuid webkitgtk gnome3.tracker
-                  gnome3.gnome_online_accounts zeitgeist desktop_file_utils
-                  gnome3.gsettings_desktop_schemas makeWrapper
-                  gdk_pixbuf gnome3.defaultIconTheme librsvg
-                  evolution_data_server evolution sqlite ];
-
-  enableParallelBuilding = true;
-
-  preFixup = ''
-    wrapProgram "$out/bin/bijiben" \
-      --set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE" \
-      --prefix XDG_DATA_DIRS : "${gnome3.gnome_themes_standard}/share:$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH"
-  '';
-
-  meta = with stdenv.lib; {
-    homepage = https://wiki.gnome.org/Apps/Bijiben;
-    description = "Note editor designed to remain simple to use";
-    maintainers = gnome3.maintainers;
-    license = licenses.gpl3;
-    platforms = platforms.linux;
-  };
-}
--- a/pkgs/desktops/gnome-3/3.20/apps/bijiben/src.nix
+++ b/pkgs/desktops/gnome-3/3.20/apps/bijiben/src.nix
@ -1,10 +0,0 @@
-# Autogenerated by maintainers/scripts/gnome.sh update
-
-fetchurl: {
-  name = "bijiben-3.20.2";
-
-  src = fetchurl {
-    url = mirror://gnome/sources/bijiben/3.20/bijiben-3.20.2.tar.xz;
-    sha256 = "5774dfdedb79f5ffe5bac3cebe0816dc7e6410381744dcb999815061dee6a981";
-  };
-}
--- a/pkgs/desktops/gnome-3/3.20/apps/cheese/default.nix
+++ b/pkgs/desktops/gnome-3/3.20/apps/cheese/default.nix
@ -1,26 +0,0 @@
-{ stdenv, intltool, fetchurl, wrapGAppsHook, gnome-video-effects, libcanberra_gtk3
-, pkgconfig, gtk3, glib, clutter_gtk, clutter-gst, udev, gst_all_1, itstool
-, libgudev
-, adwaita-icon-theme, librsvg, gdk_pixbuf, gnome3, gnome_desktop, libxml2 }:
-
-stdenv.mkDerivation rec {
-  inherit (import ./src.nix fetchurl) name src;
-
-  buildInputs = [ pkgconfig gtk3 glib intltool wrapGAppsHook gnome-video-effects itstool
-                  gdk_pixbuf adwaita-icon-theme librsvg udev gst_all_1.gstreamer libxml2
-                  gst_all_1.gst-plugins-base gst_all_1.gst-plugins-good gnome_desktop
-                  gst_all_1.gst-plugins-bad clutter_gtk clutter-gst
-                  libcanberra_gtk3 libgudev ];
-
-  enableParallelBuilding = true;
-
-  NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
-
-  meta = with stdenv.lib; {
-    homepage = https://wiki.gnome.org/Apps/Cheese;
-    description = "Take photos and videos with your webcam, with fun graphical effects";
-    maintainers = gnome3.maintainers;
-    license = licenses.gpl3;
-    platforms = platforms.linux;
-  };
-}
--- a/pkgs/desktops/gnome-3/3.20/apps/cheese/src.nix
+++ b/pkgs/desktops/gnome-3/3.20/apps/cheese/src.nix
@ -1,10 +0,0 @@
-# Autogenerated by maintainers/scripts/gnome.sh update
-
-fetchurl: {
-  name = "cheese-3.20.2";
-
-  src = fetchurl {
-    url = mirror://gnome/sources/cheese/3.20/cheese-3.20.2.tar.xz;
-    sha256 = "b7c18719b708e039c063ef09278ee813923556e06af4a7e9598c5d3bdeb83775";
-  };
-}
--- a/pkgs/desktops/gnome-3/3.20/apps/evolution/default.nix
+++ b/pkgs/desktops/gnome-3/3.20/apps/evolution/default.nix
@ -1,47 +0,0 @@
-{ stdenv, intltool, fetchurl, libxml2, webkitgtk, highlight
-, pkgconfig, gtk3, glib, libnotify, gtkspell3
-, wrapGAppsHook, itstool, shared_mime_info, libical, db, gcr, sqlite
-, gnome3, librsvg, gdk_pixbuf, libsecret, nss, nspr, icu, libtool
-, libcanberra_gtk3, bogofilter, gst_all_1, procps, p11_kit, dconf }:
-
-let
-  majVer = gnome3.version;
-in stdenv.mkDerivation rec {
-  inherit (import ./src.nix fetchurl) name src;
-
-  doCheck = true;
-
-  propagatedUserEnvPkgs = [ gnome3.gnome_themes_standard
-                            gnome3.evolution_data_server ];
-
-  propagatedBuildInputs = [ gnome3.gtkhtml ];
-
-  buildInputs = [ gtk3 glib intltool itstool libxml2 libtool
-                  gdk_pixbuf gnome3.defaultIconTheme librsvg db icu
-                  gnome3.evolution_data_server libsecret libical gcr
-                  webkitgtk shared_mime_info gnome3.gnome_desktop gtkspell3
-                  libcanberra_gtk3 bogofilter gnome3.libgdata sqlite
-                  gst_all_1.gstreamer gst_all_1.gst-plugins-base p11_kit
-                  nss nspr libnotify procps highlight gnome3.libgweather
-                  gnome3.gsettings_desktop_schemas dconf
-                  gnome3.libgnome_keyring gnome3.glib_networking ];
-
-  nativeBuildInputs = [ pkgconfig wrapGAppsHook ];
-
-  configureFlags = [ "--disable-spamassassin" "--disable-pst-import" "--disable-autoar"
-                     "--disable-libcryptui" ];
-
-  NIX_CFLAGS_COMPILE = "-I${nspr.dev}/include/nspr -I${nss.dev}/include/nss -I${glib.dev}/include/gio-unix-2.0";
-
-  enableParallelBuilding = true;
-
-  requiredSystemFeatures = [ "big-parallel" ];
-
-  meta = with stdenv.lib; {
-    homepage = https://wiki.gnome.org/Apps/Evolution;
-    description = "Personal information management application that provides integrated mail, calendaring and address book functionality";
-    maintainers = gnome3.maintainers;
-    license = licenses.lgpl2Plus;
-    platforms = platforms.linux;
-  };
-}
--- a/pkgs/desktops/gnome-3/3.20/apps/evolution/src.nix
+++ b/pkgs/desktops/gnome-3/3.20/apps/evolution/src.nix
@ -1,10 +0,0 @@
-# Autogenerated by maintainers/scripts/gnome.sh update
-
-fetchurl: {
-  name = "evolution-3.20.5";
-
-  src = fetchurl {
-    url = mirror://gnome/sources/evolution/3.20/evolution-3.20.5.tar.xz;
-    sha256 = "2e13551ce0996963506f0bdde5e01c3b8aa0622849a272ff12877cd595baeb6e";
-  };
-}
--- a/pkgs/desktops/gnome-3/3.20/apps/file-roller/default.nix
+++ b/pkgs/desktops/gnome-3/3.20/apps/file-roller/default.nix
@ -1,21 +0,0 @@
-{ stdenv, fetchurl, glib, pkgconfig, gnome3, intltool, itstool, libxml2, libarchive
-, attr, bzip2, acl, wrapGAppsHook, librsvg, gdk_pixbuf, libnotify, nautilus }:
-
-stdenv.mkDerivation rec {
-  inherit (import ./src.nix fetchurl) name src;
-
-  nativeBuildInputs = [ pkgconfig wrapGAppsHook ];
-
-  buildInputs = [ glib gnome3.gtk intltool itstool libxml2 libarchive
-                  gnome3.defaultIconTheme attr bzip2 acl gdk_pixbuf librsvg
-                  gnome3.dconf libnotify nautilus ];
-
-  installFlags = [ "nautilus_extensiondir=$(out)/lib/nautilus/extensions-3.0" ];
-
-  meta = with stdenv.lib; {
-    homepage = https://wiki.gnome.org/Apps/FileRoller;
-    description = "Archive manager for the GNOME desktop environment";
-    platforms = platforms.linux;
-    maintainers = gnome3.maintainers;
-  };
-}
--- a/pkgs/desktops/gnome-3/3.20/apps/file-roller/src.nix
+++ b/pkgs/desktops/gnome-3/3.20/apps/file-roller/src.nix
@ -1,10 +0,0 @@
-# Autogenerated by maintainers/scripts/gnome.sh update
-
-fetchurl: {
-  name = "file-roller-3.20.3";
-
-  src = fetchurl {
-    url = mirror://gnome/sources/file-roller/3.20/file-roller-3.20.3.tar.xz;
-    sha256 = "6b5c2de4c6bd52318cacd2a398cdfa45a5f1df8a77c6652a38a6a1d3e53644e9";
-  };
-}
--- a/pkgs/desktops/gnome-3/3.20/apps/gedit/default.nix
+++ b/pkgs/desktops/gnome-3/3.20/apps/gedit/default.nix
@ -1,31 +0,0 @@
-{ stdenv, intltool, fetchurl, enchant, isocodes
-, pkgconfig, gtk3, glib
-, bash, wrapGAppsHook, itstool, libsoup, libxml2
-, gnome3, librsvg, gdk_pixbuf, file, gspell }:
-
-stdenv.mkDerivation rec {
-  inherit (import ./src.nix fetchurl) name src;
-
-  propagatedUserEnvPkgs = [ gnome3.gnome_themes_standard ];
-
-  nativeBuildInputs = [ pkgconfig wrapGAppsHook ];
-
-  buildInputs = [ gtk3 glib intltool itstool enchant isocodes
-                  gdk_pixbuf gnome3.defaultIconTheme librsvg libsoup
-                  gnome3.libpeas gnome3.gtksourceview libxml2
-                  gnome3.gsettings_desktop_schemas gnome3.dconf file gspell ];
-
-  enableParallelBuilding = true;
-
-  preFixup = ''
-    gappsWrapperArgs+=(--prefix LD_LIBRARY_PATH : "${stdenv.lib.makeLibraryPath [ gnome3.libpeas gnome3.gtksourceview ]}")
-  '';
-
-  meta = with stdenv.lib; {
-    homepage = https://wiki.gnome.org/Apps/Gedit;
-    description = "Official text editor of the GNOME desktop environment";
-    maintainers = gnome3.maintainers;
-    license = licenses.gpl2;
-    platforms = platforms.linux;
-  };
-}
--- a/pkgs/desktops/gnome-3/3.20/apps/gedit/src.nix
+++ b/pkgs/desktops/gnome-3/3.20/apps/gedit/src.nix
@ -1,10 +0,0 @@
-# Autogenerated by maintainers/scripts/gnome.sh update
-
-fetchurl: {
-  name = "gedit-3.20.2";
-
-  src = fetchurl {
-    url = mirror://gnome/sources/gedit/3.20/gedit-3.20.2.tar.xz;
-    sha256 = "32a1276a71a0d4a5af4e20a87bc273170ba8e075fc1ca7f51c8d3a6c150463f8";
-  };
-}
--- a/pkgs/desktops/gnome-3/3.20/apps/glade/default.nix
+++ b/pkgs/desktops/gnome-3/3.20/apps/glade/default.nix
@ -1,30 +0,0 @@
-{ stdenv, intltool, fetchurl, python
-, pkgconfig, gtk3, glib
-, makeWrapper, itstool, libxml2, docbook_xsl
-, gnome3, librsvg, gdk_pixbuf, libxslt }:
-
-stdenv.mkDerivation rec {
-  inherit (import ./src.nix fetchurl) name src;
-
-  propagatedUserEnvPkgs = [ gnome3.gnome_themes_standard ];
-
-  buildInputs = [ pkgconfig gtk3 glib intltool itstool libxml2 python
-                  gnome3.gsettings_desktop_schemas makeWrapper docbook_xsl
-                  gdk_pixbuf gnome3.defaultIconTheme librsvg libxslt ];
-
-  enableParallelBuilding = true;
-
-  preFixup = ''
-    wrapProgram "$out/bin/glade" \
-      --set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE" \
-      --prefix XDG_DATA_DIRS : "${gnome3.gnome_themes_standard}/share:$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH"
-  '';
-
-  meta = with stdenv.lib; {
-    homepage = https://wiki.gnome.org/Apps/Glade;
-    description = "User interface designer for GTK+ applications";
-    maintainers = gnome3.maintainers;
-    license = licenses.lgpl2;
-    platforms = platforms.linux;
-  };
-}
--- a/pkgs/desktops/gnome-3/3.20/apps/glade/src.nix
+++ b/pkgs/desktops/gnome-3/3.20/apps/glade/src.nix
@ -1,10 +0,0 @@
-# Autogenerated by maintainers/scripts/gnome.sh update
-
-fetchurl: {
-  name = "glade-3.20.0";
-
-  src = fetchurl {
-    url = mirror://gnome/sources/glade/3.20/glade-3.20.0.tar.xz;
-    sha256 = "82d96dca5dec40ee34e2f41d49c13b4ea50da8f32a3a49ca2da802ff14dc18fe";
-  };
-}
--- a/pkgs/desktops/gnome-3/3.20/apps/gnome-boxes/default.nix
+++ b/pkgs/desktops/gnome-3/3.20/apps/gnome-boxes/default.nix
@ -1,42 +0,0 @@
-{ stdenv, fetchurl, makeWrapper, pkgconfig, intltool, itstool, libvirt-glib
-, glib, gobjectIntrospection, libxml2, gtk3, gtkvnc, libvirt, spice_gtk
-, spice_protocol, libuuid, libsoup, libosinfo, systemd, tracker, vala_0_32
-, libcap_ng, libcap, yajl, gmp, gdbm, cyrus_sasl, gnome3, librsvg
-, desktop_file_utils, mtools, cdrkit, libcdio, numactl, xen
-, libusb, libarchive, acl, libgudev, qemu
-}:
-
-# TODO: ovirt (optional)
-
-stdenv.mkDerivation rec {
-  inherit (import ./src.nix fetchurl) name src;
-
-  enableParallelBuilding = true;
-
-  doCheck = true;
-
-  buildInputs = [
-    makeWrapper pkgconfig intltool itstool libvirt-glib glib
-    gobjectIntrospection libxml2 gtk3 gtkvnc libvirt spice_gtk spice_protocol
-    libuuid libsoup libosinfo systemd tracker vala_0_32 libcap_ng libcap yajl gmp
-    gdbm cyrus_sasl gnome3.defaultIconTheme libusb libarchive
-    librsvg desktop_file_utils acl libgudev numactl xen
-  ];
-
-  preFixup = ''
-    for prog in "$out/bin/"*; do
-        wrapProgram "$prog" \
-            --set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE" \
-            --prefix XDG_DATA_DIRS : "${gnome3.gnome_themes_standard}/share:$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH" \
-            --prefix PATH : "${stdenv.lib.makeBinPath [ mtools cdrkit libcdio qemu ]}"
-    done
-  '';
-
-  meta = with stdenv.lib; {
-    description = "Simple GNOME 3 application to access remote or virtual systems";
-    homepage = https://wiki.gnome.org/action/show/Apps/Boxes;
-    license = licenses.gpl3;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ bjornfor ];
-  };
-}
--- a/pkgs/desktops/gnome-3/3.20/apps/gnome-boxes/src.nix
+++ b/pkgs/desktops/gnome-3/3.20/apps/gnome-boxes/src.nix
@ -1,10 +0,0 @@
-# Autogenerated by maintainers/scripts/gnome.sh update
-
-fetchurl: {
-  name = "gnome-boxes-3.20.2";
-
-  src = fetchurl {
-    url = mirror://gnome/sources/gnome-boxes/3.20/gnome-boxes-3.20.2.tar.xz;
-    sha256 = "c0379ce1de9d2a43a6875cbe1f2ef7ef69161b284926d59c44246a9142130fc5";
-  };
-}
--- a/pkgs/desktops/gnome-3/3.20/apps/gnome-calendar/default.nix
+++ b/pkgs/desktops/gnome-3/3.20/apps/gnome-calendar/default.nix
@ -1,22 +0,0 @@
-{ stdenv, fetchurl, pkgconfig, gnome3, gtk3, wrapGAppsHook
-, intltool, evolution_data_server, sqlite, libxml2, libsoup
-, glib, gnome_online_accounts }:
-
-stdenv.mkDerivation rec {
-  inherit (import ./src.nix fetchurl) name src;
-
-  NIX_CFLAGS_COMPILE = "-I${gnome3.glib.dev}/include/gio-unix-2.0";
-
-  buildInputs = [
-    pkgconfig gtk3 wrapGAppsHook intltool evolution_data_server
-    sqlite libxml2 libsoup glib gnome3.defaultIconTheme gnome_online_accounts
-  ];
-
-  meta = with stdenv.lib; {
-    homepage = https://wiki.gnome.org/Apps/Calendar;
-    description = "Simple and beautiful calendar application for GNOME";
-    maintainers = gnome3.maintainers;
-    license = licenses.gpl3;
-    platforms = platforms.linux;
-  };
-}
--- a/pkgs/desktops/gnome-3/3.20/apps/gnome-calendar/src.nix
+++ b/pkgs/desktops/gnome-3/3.20/apps/gnome-calendar/src.nix
@ -1,10 +0,0 @@
-# Autogenerated by maintainers/scripts/gnome.sh update
-
-fetchurl: {
-  name = "gnome-calendar-3.20.2";
-
-  src = fetchurl {
-    url = mirror://gnome/sources/gnome-calendar/3.20/gnome-calendar-3.20.2.tar.xz;
-    sha256 = "f132cff56310b83cf086628e949685b04cdaf872e989d67dbb8a3e4e9943deee";
-  };
-}
--- a/pkgs/desktops/gnome-3/3.20/apps/gnome-characters/default.nix
+++ b/pkgs/desktops/gnome-3/3.20/apps/gnome-characters/default.nix
@ -1,19 +0,0 @@
-{ stdenv, fetchurl, pkgconfig, gnome3, gtk3, wrapGAppsHook
-, intltool, gjs, gdk_pixbuf, librsvg }:
-
-stdenv.mkDerivation rec {
-  inherit (import ./src.nix fetchurl) name src;
-
-  buildInputs = [
-    pkgconfig gtk3 wrapGAppsHook intltool gjs gdk_pixbuf
-    librsvg gnome3.defaultIconTheme
-  ];
-
-  meta = with stdenv.lib; {
-    homepage = https://wiki.gnome.org/Design/Apps/CharacterMap;
-    description = "Simple utility application to find and insert unusual characters";
-    maintainers = gnome3.maintainers;
-    license = licenses.gpl2;
-    platforms = platforms.linux;
-  };
-}
--- a/pkgs/desktops/gnome-3/3.20/apps/gnome-characters/src.nix
+++ b/pkgs/desktops/gnome-3/3.20/apps/gnome-characters/src.nix
@ -1,10 +0,0 @@
-# Autogenerated by maintainers/scripts/gnome.sh update
-
-fetchurl: {
-  name = "gnome-characters-3.20.1";
-
-  src = fetchurl {
-    url = mirror://gnome/sources/gnome-characters/3.20/gnome-characters-3.20.1.tar.xz;
-    sha256 = "6891eed27a5b023200992540266a9216d081eef890d6d0836380dc3c0033857c";
-  };
-}
--- a/pkgs/desktops/gnome-3/3.20/apps/gnome-clocks/default.nix
+++ b/pkgs/desktops/gnome-3/3.20/apps/gnome-clocks/default.nix
@ -1,27 +0,0 @@
-{ stdenv, intltool, fetchurl, libgweather, libnotify
-, pkgconfig, gtk3, glib, gsound
-, makeWrapper, itstool, libcanberra_gtk3, libtool
-, gnome3, librsvg, gdk_pixbuf, geoclue2, wrapGAppsHook }:
-
-stdenv.mkDerivation rec {
-  inherit (import ./src.nix fetchurl) name src;
-
-  doCheck = true;
-
-  buildInputs = [ pkgconfig gtk3 glib intltool itstool libcanberra_gtk3
-                  gnome3.gsettings_desktop_schemas makeWrapper
-                  gdk_pixbuf gnome3.defaultIconTheme librsvg
-                  gnome3.gnome_desktop gnome3.geocode_glib geoclue2
-                  libgweather libnotify libtool gsound
-                  wrapGAppsHook ];
-
-  enableParallelBuilding = true;
-
-  meta = with stdenv.lib; {
-    homepage = https://wiki.gnome.org/Apps/Clocks;
-    description = "Clock application designed for GNOME 3";
-    maintainers = gnome3.maintainers;
-    license = licenses.gpl2;
-    platforms = platforms.linux;
-  };
-}
--- a/pkgs/desktops/gnome-3/3.20/apps/gnome-clocks/src.nix
+++ b/pkgs/desktops/gnome-3/3.20/apps/gnome-clocks/src.nix
@ -1,10 +0,0 @@
-# Autogenerated by maintainers/scripts/gnome.sh update
-
-fetchurl: {
-  name = "gnome-clocks-3.20.1";
-
-  src = fetchurl {
-    url = mirror://gnome/sources/gnome-clocks/3.20/gnome-clocks-3.20.1.tar.xz;
-    sha256 = "92ad7b409c5118464af49ca28262ae43e9d377435ad2b10048b23e6e11ae476f";
-  };
-}
--- a/pkgs/desktops/gnome-3/3.20/apps/gnome-documents/default.nix
+++ b/pkgs/desktops/gnome-3/3.20/apps/gnome-documents/default.nix
@ -1,39 +0,0 @@
-{ stdenv, intltool, fetchurl, evince, gjs
-, pkgconfig, gtk3, glib
-, makeWrapper, itstool, libxslt, webkitgtk
-, gnome3, librsvg, gdk_pixbuf, libsoup, docbook_xsl
-, gobjectIntrospection, json_glib, inkscape, poppler_utils
-, gmp, desktop_file_utils, wrapGAppsHook }:
-
-stdenv.mkDerivation rec {
-  inherit (import ./src.nix fetchurl) name src;
-
-  doCheck = true;
-
-  configureFlags = [ "--enable-getting-started" ];
-
-  buildInputs = [ pkgconfig gtk3 glib intltool itstool libxslt
-                  docbook_xsl desktop_file_utils inkscape poppler_utils
-                  gnome3.gsettings_desktop_schemas makeWrapper gmp
-                  gdk_pixbuf gnome3.defaultIconTheme librsvg evince
-                  libsoup webkitgtk gjs gobjectIntrospection gnome3.rest
-                  gnome3.tracker gnome3.libgdata gnome3.gnome_online_accounts
-                  gnome3.gnome_desktop gnome3.libzapojit json_glib
-                  wrapGAppsHook ];
-
-  enableParallelBuilding = true;
-
-  preFixup = ''
-    substituteInPlace $out/bin/gnome-documents --replace gapplication "${glib.dev}/bin/gapplication"
-
-    gappsWrapperArgs+=(--run 'if [ -z "$XDG_CACHE_DIR" ]; then XDG_CACHE_DIR=$HOME/.cache; fi; if [ -w "$XDG_CACHE_DIR/.." ]; then mkdir -p "$XDG_CACHE_DIR/gnome-documents"; fi')
-  '';
-
-  meta = with stdenv.lib; {
-    homepage = https://wiki.gnome.org/Apps/Documents;
-    description = "Document manager application designed to work with GNOME 3";
-    maintainers = gnome3.maintainers;
-    license = licenses.gpl2;
-    platforms = platforms.linux;
-  };
-}
--- a/pkgs/desktops/gnome-3/3.20/apps/gnome-documents/src.nix
+++ b/pkgs/desktops/gnome-3/3.20/apps/gnome-documents/src.nix
@ -1,10 +0,0 @@
-# Autogenerated by maintainers/scripts/gnome.sh update
-
-fetchurl: {
-  name = "gnome-documents-3.20.0";
-
-  src = fetchurl {
-    url = mirror://gnome/sources/gnome-documents/3.20/gnome-documents-3.20.0.tar.xz;
-    sha256 = "a5fa496c5e80eccb8d2e5bba7f4d7dc4cc6c9f53d5bc028402428771be1237d2";
-  };
-}
--- a/pkgs/desktops/gnome-3/3.20/apps/gnome-getting-started-docs/default.nix
+++ b/pkgs/desktops/gnome-3/3.20/apps/gnome-getting-started-docs/default.nix
@ -1,15 +0,0 @@
-{ stdenv, fetchurl, gnome3, intltool, itstool, libxml2 }:
-
-stdenv.mkDerivation rec {
-  inherit (import ./src.nix fetchurl) name src;
-
-  buildInputs = [ intltool itstool libxml2 ];
-
-  meta = with stdenv.lib; {
-    homepage = https://live.gnome.org/DocumentationProject;
-    description = "Help a new user get started in GNOME";
-    maintainers = gnome3.maintainers;
-    license = licenses.cc-by-sa-30;
-    platforms = platforms.linux;
-  };
-}
--- a/pkgs/desktops/gnome-3/3.20/apps/gnome-getting-started-docs/src.nix
+++ b/pkgs/desktops/gnome-3/3.20/apps/gnome-getting-started-docs/src.nix
@ -1,10 +0,0 @@
-# Autogenerated by maintainers/scripts/gnome.sh update
-
-fetchurl: {
-  name = "gnome-getting-started-docs-3.20.0";
-
-  src = fetchurl {
-    url = mirror://gnome/sources/gnome-getting-started-docs/3.20/gnome-getting-started-docs-3.20.0.tar.xz;
-    sha256 = "0dc3a69d646c3ee3c6ef1a34dbc7f469d66275bd20215071fd495ae5900fcfdc";
-  };
-}
--- a/pkgs/desktops/gnome-3/3.20/apps/gnome-logs/default.nix
+++ b/pkgs/desktops/gnome-3/3.20/apps/gnome-logs/default.nix
@ -1,21 +0,0 @@
-{ stdenv, fetchurl, pkgconfig, gnome3, gtk3, wrapGAppsHook
-, intltool, itstool, libxml2, systemd }:
-
-stdenv.mkDerivation rec {
-  inherit (import ./src.nix fetchurl) name src;
-
-  configureFlags = [ "--disable-tests" ];
-
-  buildInputs = [
-    pkgconfig gtk3 wrapGAppsHook intltool itstool libxml2
-    systemd gnome3.defaultIconTheme
-  ];
-
-  meta = with stdenv.lib; {
-    homepage = https://wiki.gnome.org/Apps/Logs;
-    description = "A log viewer for the systemd journal";
-    maintainers = gnome3.maintainers;
-    license = licenses.gpl3;
-    platforms = platforms.linux;
-  };
-}
--- a/pkgs/desktops/gnome-3/3.20/apps/gnome-logs/src.nix
+++ b/pkgs/desktops/gnome-3/3.20/apps/gnome-logs/src.nix
@ -1,10 +0,0 @@
-# Autogenerated by maintainers/scripts/gnome.sh update
-
-fetchurl: {
-  name = "gnome-logs-3.20.1";
-
-  src = fetchurl {
-    url = mirror://gnome/sources/gnome-logs/3.20/gnome-logs-3.20.1.tar.xz;
-    sha256 = "b797841faac4e176c64497837de27b1b953d16d2482e8a773a48b38117b1367e";
-  };
-}
--- a/pkgs/desktops/gnome-3/3.20/apps/gnome-maps/default.nix
+++ b/pkgs/desktops/gnome-3/3.20/apps/gnome-maps/default.nix
@ -1,28 +0,0 @@
-{ stdenv, fetchurl, intltool, pkgconfig, gnome3, gtk3
-, gobjectIntrospection, gdk_pixbuf, librsvg, autoreconfHook
-, geoclue2, wrapGAppsHook, folks, libchamplain, gfbgraph, file, libsoup
-, webkitgtk }:
-
-stdenv.mkDerivation rec {
-  inherit (import ./src.nix fetchurl) name src;
-
-  doCheck = true;
-
-  buildInputs = [ pkgconfig intltool gobjectIntrospection wrapGAppsHook
-                  gtk3 geoclue2 gnome3.gjs gnome3.libgee folks gfbgraph
-                  gnome3.geocode_glib libchamplain file libsoup
-                  gdk_pixbuf librsvg autoreconfHook
-                  gnome3.gsettings_desktop_schemas gnome3.evolution_data_server
-                  gnome3.gnome_online_accounts gnome3.defaultIconTheme
-                  webkitgtk ];
-
-  patches = [ ./soup.patch ];
-
-  meta = with stdenv.lib; {
-    homepage = https://wiki.gnome.org/Apps/Maps;
-    description = "A map application for GNOME 3";
-    maintainers = gnome3.maintainers;
-    license = licenses.gpl2;
-    platforms = platforms.linux;
-  };
-}
--- a/pkgs/desktops/gnome-3/3.20/apps/gnome-maps/soup.patch
+++ b/pkgs/desktops/gnome-3/3.20/apps/gnome-maps/soup.patch
@ -1,12 +0,0 @@
--- gnome-maps-3.18.0/configure.ac.orig	2015-09-24 18:38:31.912498368 +0200
-+++ gnome-maps-3.18.0/configure.ac	2015-09-24 18:38:40.783320413 +0200
-@@ -50,8 +50,9 @@
-     folks                        >= $FOLKS_MIN_VERSION
-     geocode-glib-1.0             >= $GEOCODE_MIN_VERSION
-     champlain-0.12               >= $CHAMPLAIN_MIN_VERSION
-     libxml-2.0
-     rest-0.7
-+    libsoup-2.4
- ])
- AC_SUBST(GNOME_MAPS_LIB_CFLAGS)
- AC_SUBST(GNOME_MAPS_LIB_LIBS)
--- a/pkgs/desktops/gnome-3/3.20/apps/gnome-maps/src.nix
+++ b/pkgs/desktops/gnome-3/3.20/apps/gnome-maps/src.nix
@ -1,10 +0,0 @@
-# Autogenerated by maintainers/scripts/gnome.sh update
-
-fetchurl: {
-  name = "gnome-maps-3.20.2";
-
-  src = fetchurl {
-    url = mirror://gnome/sources/gnome-maps/3.20/gnome-maps-3.20.2.tar.xz;
-    sha256 = "e860144795339fdbb2f1239c4db092ad12beb9acaa3f3f8aa1d935c36d86bc3f";
-  };
-}
--- a/pkgs/desktops/gnome-3/3.20/apps/gnome-music/default.nix
+++ b/pkgs/desktops/gnome-3/3.20/apps/gnome-music/default.nix
@ -1,30 +0,0 @@
-{ stdenv, intltool, fetchurl, gdk_pixbuf, tracker
-, libxml2, python3Packages, libnotify, wrapGAppsHook
-, pkgconfig, gtk3, glib, cairo
-, makeWrapper, itstool, gnome3, librsvg, gst_all_1 }:
-
-stdenv.mkDerivation rec {
-  inherit (import ./src.nix fetchurl) name src;
-
-  propagatedUserEnvPkgs = [ gnome3.gnome_themes_standard ];
-
-  buildInputs = [ pkgconfig gtk3 glib intltool itstool gnome3.libmediaart
-                  gdk_pixbuf gnome3.defaultIconTheme librsvg python3Packages.python
-                  gnome3.grilo gnome3.grilo-plugins gnome3.totem-pl-parser libxml2 libnotify
-                  python3Packages.pycairo python3Packages.dbus-python python3Packages.requests2
-                  python3Packages.pygobject3 gst_all_1.gstreamer gst_all_1.gst-plugins-base
-                  gst_all_1.gst-plugins-good gst_all_1.gst-plugins-bad wrapGAppsHook
-                  gnome3.gsettings_desktop_schemas makeWrapper tracker ];
-
-  wrapPrefixVariables = [ "PYTHONPATH" ];
-
-  enableParallelBuilding = true;
-
-  meta = with stdenv.lib; {
-    homepage = https://wiki.gnome.org/Apps/Music;
-    description = "Music player and management application for the GNOME desktop environment";
-    maintainers = gnome3.maintainers;
-    license = licenses.gpl2;
-    platforms = platforms.linux;
-  };
-}
--- a/pkgs/desktops/gnome-3/3.20/apps/gnome-music/src.nix
+++ b/pkgs/desktops/gnome-3/3.20/apps/gnome-music/src.nix
@ -1,10 +0,0 @@
-# Autogenerated by maintainers/scripts/gnome.sh update
-
-fetchurl: {
-  name = "gnome-music-3.20.2";
-
-  src = fetchurl {
-    url = mirror://gnome/sources/gnome-music/3.20/gnome-music-3.20.2.tar.xz;
-    sha256 = "ca328bfd85ba8cb651e4e3c5d56499b111cb95b4f3e9b2e482cca7830213c7a0";
-  };
-}
--- a/pkgs/desktops/gnome-3/3.20/apps/gnome-nettool/default.nix
+++ b/pkgs/desktops/gnome-3/3.20/apps/gnome-nettool/default.nix
@ -1,26 +0,0 @@
-{ stdenv, fetchurl, pkgconfig, gnome3, gtk3, wrapGAppsHook
-, libgtop, intltool, itstool, libxml2, nmap, inetutils }:
-
-stdenv.mkDerivation rec {
-  name = "gnome-nettool-3.8.1";
-
-  src = fetchurl {
-    url = "mirror://gnome/sources/gnome-nettool/3.8/${name}.tar.xz";
-    sha256 = "1c9cvzvyqgfwa5zzyvp7118pkclji62fkbb33g4y9sp5kw6m397h";
-  };
-
-  buildInputs = [
-    pkgconfig gtk3 wrapGAppsHook libgtop intltool itstool libxml2
-    gnome3.defaultIconTheme
-  ];
-
-  propagatedUserEnvPkgs = [ nmap inetutils ];
-
-  meta = with stdenv.lib; {
-    homepage = http://projects.gnome.org/gnome-network;
-    description = "A collection of networking tools";
-    maintainers = gnome3.maintainers;
-    license = licenses.gpl2;
-    platforms = platforms.linux;
-  };
-}
--- a/pkgs/desktops/gnome-3/3.20/apps/gnome-photos/default.nix
+++ b/pkgs/desktops/gnome-3/3.20/apps/gnome-photos/default.nix
@ -1,31 +0,0 @@
-{ stdenv, intltool, fetchurl, exempi, libxml2
-, pkgconfig, gtk3, glib
-, makeWrapper, itstool, gegl, babl, lcms2
-, desktop_file_utils, gmp, libmediaart, wrapGAppsHook
-, gnome3, librsvg, gdk_pixbuf, libexif, gexiv2 }:
-
-stdenv.mkDerivation rec {
-  inherit (import ./src.nix fetchurl) name src;
-
-  # doCheck = true;
-
-  NIX_CFLAGS_COMPILE = "-I${gnome3.glib.dev}/include/gio-unix-2.0";
-
-  buildInputs = [ pkgconfig gtk3 glib intltool itstool gegl babl gnome3.libgdata
-                  gnome3.gsettings_desktop_schemas makeWrapper gmp libmediaart
-                  gdk_pixbuf gnome3.defaultIconTheme librsvg exempi
-                  gnome3.gfbgraph gnome3.grilo-plugins gnome3.grilo
-                  gnome3.gnome_online_accounts gnome3.gnome_desktop
-                  lcms2 libexif gnome3.tracker libxml2 desktop_file_utils
-                  wrapGAppsHook gexiv2 ];
-
-  enableParallelBuilding = true;
-
-  meta = with stdenv.lib; {
-    homepage = https://wiki.gnome.org/Apps/Photos;
-    description = "Photos is an application to access, organize and share your photos with GNOME 3";
-    maintainers = gnome3.maintainers;
-    license = licenses.gpl2;
-    platforms = platforms.linux;
-  };
-}
--- a/pkgs/desktops/gnome-3/3.20/apps/gnome-photos/src.nix
+++ b/pkgs/desktops/gnome-3/3.20/apps/gnome-photos/src.nix
@ -1,10 +0,0 @@
-# Autogenerated by maintainers/scripts/gnome.sh update
-
-fetchurl: {
-  name = "gnome-photos-3.20.3";
-
-  src = fetchurl {
-    url = mirror://gnome/sources/gnome-photos/3.20/gnome-photos-3.20.3.tar.xz;
-    sha256 = "d1dd8bd8178dd1d0120abd2ff3e959fb1199f4e1751558f925ce7f1278548996";
-  };
-}
--- a/pkgs/desktops/gnome-3/3.20/apps/gnome-weather/default.nix
+++ b/pkgs/desktops/gnome-3/3.20/apps/gnome-weather/default.nix
@ -1,19 +0,0 @@
-{ stdenv, fetchurl, pkgconfig, gnome3, gtk3, wrapGAppsHook, gjs
-, libgweather, intltool, itstool, geoclue2 }:
-
-stdenv.mkDerivation rec {
-  inherit (import ./src.nix fetchurl) name src;
-
-  buildInputs = [
-    pkgconfig gtk3 wrapGAppsHook gjs intltool itstool
-    libgweather gnome3.defaultIconTheme geoclue2
-  ];
-
-  meta = with stdenv.lib; {
-    homepage = https://wiki.gnome.org/Apps/Weather;
-    description = "Access current weather conditions and forecasts";
-    maintainers = gnome3.maintainers;
-    license = licenses.gpl2;
-    platforms = platforms.linux;
-  };
-}
--- a/pkgs/desktops/gnome-3/3.20/apps/gnome-weather/src.nix
+++ b/pkgs/desktops/gnome-3/3.20/apps/gnome-weather/src.nix
@ -1,10 +0,0 @@
-# Autogenerated by maintainers/scripts/gnome.sh update
-
-fetchurl: {
-  name = "gnome-weather-3.20.1";
-
-  src = fetchurl {
-    url = mirror://gnome/sources/gnome-weather/3.20/gnome-weather-3.20.1.tar.xz;
-    sha256 = "e310ecd56f396ac0e8e5652ac8b63258720034e23afbf32fbb2d509f25bbb2b6";
-  };
-}
--- a/pkgs/desktops/gnome-3/3.20/apps/nautilus-sendto/default.nix
+++ b/pkgs/desktops/gnome-3/3.20/apps/nautilus-sendto/default.nix
@ -1,22 +0,0 @@
-{ stdenv, fetchurl, glib, pkgconfig, gnome3, intltool
-, gobjectIntrospection, makeWrapper }:
-
-stdenv.mkDerivation rec {
-  name = "nautilus-sendto-${version}";
-
-  version = "3.8.1";
-
-  src = fetchurl {
-    url = "mirror://gnome/sources/nautilus-sendto/3.8/${name}.tar.xz";
-    sha256 = "03fa46bff271acdbdedab6243b2a84e5ed3daa19c81b69d087b3e852c8fe5dab";
-  };
-
-  buildInputs = [ glib pkgconfig gobjectIntrospection intltool makeWrapper ];
-
-  meta = with stdenv.lib; {
-    description = "Integrates Evolution and Pidgin into the Nautilus file manager";
-    maintainers = gnome3.maintainers;
-    license = licenses.gpl2;
-    platforms = platforms.linux;
-  };
-}
--- a/pkgs/desktops/gnome-3/3.20/apps/polari/default.nix
+++ b/pkgs/desktops/gnome-3/3.20/apps/polari/default.nix
@ -1,22 +0,0 @@
-{ stdenv, intltool, fetchurl, gdk_pixbuf, adwaita-icon-theme
-, telepathy_glib, gjs, itstool, telepathy_idle
-, pkgconfig, gtk3, glib, librsvg, gnome3, wrapGAppsHook }:
-
-stdenv.mkDerivation rec {
-  inherit (import ./src.nix fetchurl) name src;
-
-  propagatedUserEnvPkgs = [ telepathy_idle ];
-
-  buildInputs = [ pkgconfig gtk3 glib intltool itstool adwaita-icon-theme wrapGAppsHook
-                  telepathy_glib gjs gdk_pixbuf librsvg ];
-
-  enableParallelBuilding = true;
-
-  meta = with stdenv.lib; {
-    homepage = https://wiki.gnome.org/Apps/Polari;
-    description = "IRC chat client designed to integrate with the GNOME desktop";
-    maintainers = gnome3.maintainers;
-    license = licenses.gpl2;
-    platforms = platforms.linux;
-  };
-}
--- a/pkgs/desktops/gnome-3/3.20/apps/polari/src.nix
+++ b/pkgs/desktops/gnome-3/3.20/apps/polari/src.nix
@ -1,10 +0,0 @@
-# Autogenerated by maintainers/scripts/gnome.sh update
-
-fetchurl: {
-  name = "polari-3.20.2";
-
-  src = fetchurl {
-    url = mirror://gnome/sources/polari/3.20/polari-3.20.2.tar.xz;
-    sha256 = "4b7641e54ee8a2e6018e1b4cea4802d94d90c2f09b9558e0a767838effd1347f";
-  };
-}
--- a/pkgs/desktops/gnome-3/3.20/apps/seahorse/default.nix
+++ b/pkgs/desktops/gnome-3/3.20/apps/seahorse/default.nix
@ -1,35 +0,0 @@
-{ stdenv, intltool, fetchurl, vala_0_32
-, pkgconfig, gtk3, glib
-, makeWrapper, itstool, gnupg, libsoup
-, gnome3, librsvg, gdk_pixbuf, gpgme
-, libsecret, avahi, p11_kit, openssh }:
-
-stdenv.mkDerivation rec {
-  inherit (import ./src.nix fetchurl) name src;
-
-  doCheck = true;
-
-  propagatedUserEnvPkgs = [ gnome3.gnome_themes_standard ];
-
-  NIX_CFLAGS_COMPILE = "-I${gnome3.glib.dev}/include/gio-unix-2.0";
-
-  buildInputs = [ pkgconfig gtk3 glib intltool itstool gnome3.gcr
-                  gnome3.gsettings_desktop_schemas makeWrapper gnupg
-                  gdk_pixbuf gnome3.defaultIconTheme librsvg gpgme
-                  libsecret avahi libsoup p11_kit vala_0_32 gnome3.gcr
-                  openssh ];
-
-  preFixup = ''
-    wrapProgram "$out/bin/seahorse" \
-      --set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE" \
-      --prefix XDG_DATA_DIRS : "${gnome3.gnome_themes_standard}/share:$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH"
-  '';
-
-  meta = with stdenv.lib; {
-    homepage = https://wiki.gnome.org/Apps/Seahorse;
-    description = "Application for managing encryption keys and passwords in the GnomeKeyring";
-    maintainers = gnome3.maintainers;
-    license = licenses.gpl2;
-    platforms = platforms.linux;
-  };
-}
--- a/pkgs/desktops/gnome-3/3.20/apps/seahorse/src.nix
+++ b/pkgs/desktops/gnome-3/3.20/apps/seahorse/src.nix
@ -1,10 +0,0 @@
-# Autogenerated by maintainers/scripts/gnome.sh update
-
-fetchurl: {
-  name = "seahorse-3.20.0";
-
-  src = fetchurl {
-    url = mirror://gnome/sources/seahorse/3.20/seahorse-3.20.0.tar.xz;
-    sha256 = "e2b07461ed54a8333e5628e9b8e517ec2b731068377bf376570aad998274c6df";
-  };
-}
--- a/pkgs/desktops/gnome-3/3.20/apps/vinagre/default.nix
+++ b/pkgs/desktops/gnome-3/3.20/apps/vinagre/default.nix
@ -1,21 +0,0 @@
-{ stdenv, fetchurl, pkgconfig, gtk3, gnome3, vte, libxml2, gtkvnc, intltool
-, libsecret, itstool, makeWrapper, librsvg }:
-
-stdenv.mkDerivation rec {
-  inherit (import ./src.nix fetchurl) name src;
-
-  buildInputs = [ pkgconfig gtk3 vte libxml2 gtkvnc intltool libsecret
-                  itstool makeWrapper gnome3.defaultIconTheme librsvg ];
-
-  preFixup = ''
-    wrapProgram "$out/bin/vinagre" \
-      --prefix XDG_DATA_DIRS : "$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH:$out/share"
-  '';
-
-  meta = with stdenv.lib; {
-    homepage = https://wiki.gnome.org/Apps/Vinagre;
-    description = "Remote desktop viewer for GNOME";
-    platforms = platforms.linux;
-    maintainers = gnome3.maintainers;
-  };
-}
--- a/pkgs/desktops/gnome-3/3.20/apps/vinagre/src.nix
+++ b/pkgs/desktops/gnome-3/3.20/apps/vinagre/src.nix
@ -1,10 +0,0 @@
-# Autogenerated by maintainers/scripts/gnome.sh update
-
-fetchurl: {
-  name = "vinagre-3.20.2";
-
-  src = fetchurl {
-    url = mirror://gnome/sources/vinagre/3.20/vinagre-3.20.2.tar.xz;
-    sha256 = "5fc78ef9ab9ee7d4e3c50d38d82d9bcbd915191bcf0349d55a2fd56eaa87eaa0";
-  };
-}
--- a/pkgs/desktops/gnome-3/3.20/core/adwaita-icon-theme/default.nix
+++ b/pkgs/desktops/gnome-3/3.20/core/adwaita-icon-theme/default.nix
@ -1,21 +0,0 @@
-{ stdenv, fetchurl, pkgconfig, intltool, gnome3
-, iconnamingutils, gtk, gdk_pixbuf, librsvg, hicolor_icon_theme }:
-
-stdenv.mkDerivation rec {
-  inherit (import ./src.nix fetchurl) name src;
-
-  # For convenience, we can specify adwaita-icon-theme only in packages
-  propagatedBuildInputs = [ hicolor_icon_theme ];
-
-  buildInputs = [ gdk_pixbuf librsvg ];
-
-  nativeBuildInputs = [ pkgconfig intltool iconnamingutils gtk ];
-
-  # remove a tree of dirs with no files within
-  postInstall = '' rm -rf "$out/locale" '';
-
-  meta = with stdenv.lib; {
-    platforms = platforms.linux;
-    maintainers = gnome3.maintainers;
-  };
-}
--- a/pkgs/desktops/gnome-3/3.20/core/adwaita-icon-theme/src.nix
+++ b/pkgs/desktops/gnome-3/3.20/core/adwaita-icon-theme/src.nix
@ -1,10 +0,0 @@
-# Autogenerated by maintainers/scripts/gnome.sh update
-
-fetchurl: {
-  name = "adwaita-icon-theme-3.20";
-
-  src = fetchurl {
-    url = mirror://gnome/sources/adwaita-icon-theme/3.20/adwaita-icon-theme-3.20.tar.xz;
-    sha256 = "7a0a887349f340dd644032f89d81264b694c4b006bd51af1c2c368d431e7ae35";
-  };
-}
--- a/pkgs/desktops/gnome-3/3.20/core/baobab/default.nix
+++ b/pkgs/desktops/gnome-3/3.20/core/baobab/default.nix
@ -1,32 +0,0 @@
-{ stdenv, intltool, fetchurl, vala_0_32, libgtop
-, pkgconfig, gtk3, glib
-, bash, makeWrapper, itstool, libxml2
-, gnome3, librsvg, gdk_pixbuf, file }:
-
-stdenv.mkDerivation rec {
-  inherit (import ./src.nix fetchurl) name src;
-
-  doCheck = true;
-
-  NIX_CFLAGS_COMPILE = "-I${gnome3.glib.dev}/include/gio-unix-2.0";
-
-  propagatedUserEnvPkgs = [ gnome3.gnome_themes_standard ];
-
-  buildInputs = [ vala_0_32 pkgconfig gtk3 glib libgtop intltool itstool libxml2
-                  gnome3.gsettings_desktop_schemas makeWrapper file
-                  gdk_pixbuf gnome3.defaultIconTheme librsvg ];
-
-  preFixup = ''
-    wrapProgram "$out/bin/baobab" \
-      --set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE" \
-      --prefix XDG_DATA_DIRS : "${gnome3.gnome_themes_standard}/share:$out/share:$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH"
-  '';
-
-  meta = with stdenv.lib; {
-    homepage = https://wiki.gnome.org/Apps/Baobab;
-    description = "Graphical application to analyse disk usage in any Gnome environment";
-    maintainers = gnome3.maintainers;
-    license = licenses.gpl2;
-    platforms = platforms.linux;
-  };
-}
--- a/pkgs/desktops/gnome-3/3.20/core/baobab/src.nix
+++ b/pkgs/desktops/gnome-3/3.20/core/baobab/src.nix
@ -1,10 +0,0 @@
-# Autogenerated by maintainers/scripts/gnome.sh update
-
-fetchurl: {
-  name = "baobab-3.20.1";
-
-  src = fetchurl {
-    url = mirror://gnome/sources/baobab/3.20/baobab-3.20.1.tar.xz;
-    sha256 = "e9dff12a76b0d730ce224215860512eb0188280c622faf186937563b96249d1f";
-  };
-}
--- a/pkgs/desktops/gnome-3/3.20/core/caribou/default.nix
+++ b/pkgs/desktops/gnome-3/3.20/core/caribou/default.nix
@ -1,31 +0,0 @@
-{ fetchurl, stdenv, pkgconfig, gnome3, clutter, dbus, pythonPackages, libxml2, autoconf
-, libxklavier, libXtst, gtk2, intltool, libxslt, at_spi2_core, automake114x }:
-
-let
-  majorVersion = "0.4";
-in
-stdenv.mkDerivation rec {
-  name = "caribou-${majorVersion}.18.1";
-
-  src = fetchurl {
-    url = "mirror://gnome/sources/caribou/${majorVersion}/${name}.tar.xz";
-    sha256 = "0l1ikx56ddgayvny3s2xv8hs3p23xsclw4zljs3cczv4b89dzymf";
-  };
-
-  buildInputs = with gnome3;
-    [ glib pkgconfig gtk clutter at_spi2_core dbus pythonPackages.python automake114x
-      pythonPackages.pygobject3 libxml2 libXtst gtk2 intltool libxslt autoconf ];
-
-  propagatedBuildInputs = [ gnome3.libgee libxklavier ];
-
-  preBuild = ''
-    patchShebangs .
-    substituteInPlace libcaribou/Makefile.am --replace "--shared-library=libcaribou.so.0" "--shared-library=$out/lib/libcaribou.so.0"
-  '';
-
-  meta = with stdenv.lib; {
-    platforms = platforms.linux;
-    maintainers = gnome3.maintainers;
-  };
-
-}
--- a/pkgs/desktops/gnome-3/3.20/core/dconf-editor/default.nix
+++ b/pkgs/desktops/gnome-3/3.20/core/dconf-editor/default.nix
@ -1,16 +0,0 @@
-{ stdenv, fetchurl, vala_0_32, libxslt, pkgconfig, glib, dbus_glib, gnome3
-, libxml2, intltool, docbook_xsl_ns, docbook_xsl, wrapGAppsHook }:
-
-stdenv.mkDerivation rec {
-  inherit (import ./src.nix fetchurl) name src;
-
-  nativeBuildInputs = [ pkgconfig wrapGAppsHook ];
-
-  buildInputs = [ vala_0_32 libxslt glib dbus_glib gnome3.gtk libxml2 gnome3.defaultIconTheme
-                  intltool docbook_xsl docbook_xsl_ns gnome3.dconf ];
-
-  meta = with stdenv.lib; {
-    platforms = platforms.linux;
-    maintainers = gnome3.maintainers;
-  };
-}
--- a/pkgs/desktops/gnome-3/3.20/core/dconf-editor/src.nix
+++ b/pkgs/desktops/gnome-3/3.20/core/dconf-editor/src.nix
@ -1,10 +0,0 @@
-# Autogenerated by maintainers/scripts/gnome.sh update
-
-fetchurl: {
-  name = "dconf-editor-3.20.3";
-
-  src = fetchurl {
-    url = mirror://gnome/sources/dconf-editor/3.20/dconf-editor-3.20.3.tar.xz;
-    sha256 = "a8721499a277550b28d8dd94dafbea6efeb95fa153020da10603d0d4d628c579";
-  };
-}
--- a/pkgs/desktops/gnome-3/3.20/core/dconf/default.nix
+++ b/pkgs/desktops/gnome-3/3.20/core/dconf/default.nix
@ -1,23 +0,0 @@
-{ stdenv, fetchurl, vala_0_32, libxslt, pkgconfig, glib, dbus_glib, gnome3
-, libxml2, intltool, docbook_xsl_ns, docbook_xsl, makeWrapper }:
-
-let
-  majorVersion = "0.24";
-in
-stdenv.mkDerivation rec {
-  name = "dconf-${version}";
-  version = "${majorVersion}.0";
-
-  src = fetchurl {
-    url = "mirror://gnome/sources/dconf/${majorVersion}/${name}.tar.xz";
-    sha256 = "4373e0ced1f4d7d68d518038796c073696280e22957babb29feb0267c630fec2";
-  };
-
-  buildInputs = [ vala_0_32 libxslt pkgconfig glib dbus_glib gnome3.gtk libxml2
-                  intltool docbook_xsl docbook_xsl_ns makeWrapper ];
-
-  meta = with stdenv.lib; {
-    platforms = platforms.linux;
-    maintainers = gnome3.maintainers;
-  };
-}
--- a/pkgs/desktops/gnome-3/3.20/core/empathy/default.nix
+++ b/pkgs/desktops/gnome-3/3.20/core/empathy/default.nix
@ -1,57 +0,0 @@
-{ stdenv, intltool, fetchurl, webkitgtk, pkgconfig, gtk3, glib
-, file, librsvg, gnome3, gdk_pixbuf
-, dbus_glib, dbus_libs, telepathy_glib, telepathy_farstream
-, clutter_gtk, clutter-gst, gst_all_1, cogl, gnome_online_accounts
-, gcr, libsecret, folks, libpulseaudio, telepathy_mission_control
-, telepathy_logger, libnotify, clutter, libsoup, gnutls
-, evolution_data_server
-, libcanberra_gtk3, p11_kit, farstream, libtool, shared_mime_info
-, bash, makeWrapper, itstool, libxml2, libxslt, icu, libgee  }:
-
-# TODO: enable more features
-
-let
-  majorVersion = "3.12";
-in
-stdenv.mkDerivation rec {
-  name = "empathy-${majorVersion}.11";
-
-  src = fetchurl {
-    url = "mirror://gnome/sources/empathy/${majorVersion}/${name}.tar.xz";
-    sha256 = "11yl8msyf017197fm6h15yw159yjp9i08566l967yashbx7gzr6i";
-  };
-
-  propagatedUserEnvPkgs = [ gnome3.gnome_themes_standard
-                            gnome_online_accounts shared_mime_info ];
-  propagatedBuildInputs = [ folks telepathy_logger evolution_data_server
-                            telepathy_mission_control ];
-  buildInputs = [ pkgconfig gtk3 glib webkitgtk intltool itstool
-                  libxml2 libxslt icu file makeWrapper
-                  telepathy_glib clutter_gtk clutter-gst cogl
-                  gst_all_1.gstreamer gst_all_1.gst-plugins-base
-                  gcr libsecret libpulseaudio gnome3.yelp_xsl gdk_pixbuf
-                  libnotify clutter libsoup gnutls libgee p11_kit
-                  libcanberra_gtk3 telepathy_farstream farstream
-                  gnome3.defaultIconTheme gnome3.gsettings_desktop_schemas
-                  file libtool librsvg ];
-
-  NIX_CFLAGS_COMPILE = [ "-I${dbus_glib.dev}/include/dbus-1.0"
-                         "-I${dbus_libs.dev}/include/dbus-1.0"
-                         "-I${dbus_libs.dev}/lib/dbus-1.0/include" ];
-
-  preFixup = ''
-    for f in $out/bin/* $out/libexec/*; do
-      wrapProgram $f \
-        --set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE" \
-        --prefix XDG_DATA_DIRS : "$XDG_ICON_DIRS:${gnome3.gnome_themes_standard}/share:$out/share:$GSETTINGS_SCHEMAS_PATH"
-    done
-  '';
-
-  meta = with stdenv.lib; {
-    homepage = https://wiki.gnome.org/Apps/Empathy;
-    description = "Messaging program which supports text, voice, video chat, and file transfers over many different protocols";
-    maintainers = gnome3.maintainers;
-    # TODO: license = [ licenses.gpl2 licenses.lgpl2 ];
-    platforms = platforms.linux;
-  };
-}
--- a/pkgs/desktops/gnome-3/3.20/core/eog/default.nix
+++ b/pkgs/desktops/gnome-3/3.20/core/eog/default.nix
@ -1,20 +0,0 @@
-{ fetchurl, stdenv, intltool, pkgconfig, itstool, libxml2, libjpeg, gnome3
-, shared_mime_info, wrapGAppsHook, librsvg, libexif }:
-
-stdenv.mkDerivation rec {
-  inherit (import ./src.nix fetchurl) name src;
-
-  nativeBuildInputs = [ pkgconfig wrapGAppsHook ];
-
-  buildInputs = with gnome3;
-    [ intltool itstool libxml2 libjpeg gtk glib libpeas librsvg
-      gsettings_desktop_schemas shared_mime_info adwaita-icon-theme
-      gnome_desktop libexif dconf ];
-
-  meta = with stdenv.lib; {
-    homepage = https://wiki.gnome.org/Apps/EyeOfGnome; 
-    platforms = platforms.linux;
-    description = "GNOME image viewer";
-    maintainers = gnome3.maintainers;
-  };
-}
--- a/pkgs/desktops/gnome-3/3.20/core/eog/src.nix
+++ b/pkgs/desktops/gnome-3/3.20/core/eog/src.nix
@ -1,10 +0,0 @@
-# Autogenerated by maintainers/scripts/gnome.sh update
-
-fetchurl: {
-  name = "eog-3.20.4";
-
-  src = fetchurl {
-    url = mirror://gnome/sources/eog/3.20/eog-3.20.4.tar.xz;
-    sha256 = "1qsv3brhi8l8fr22nd3d0fwq5xhwspqw0bammhkkq3ga0z6791wn";
-  };
-}
--- a/pkgs/desktops/gnome-3/3.20/core/epiphany/default.nix
+++ b/pkgs/desktops/gnome-3/3.20/core/epiphany/default.nix
@ -1,37 +0,0 @@
-{ stdenv, intltool, fetchurl, pkgconfig, gtk3, glib, nspr, icu
-, bash, wrapGAppsHook, gnome3, libwnck3, libxml2, libxslt, libtool
-, webkitgtk214x, libsoup, glib_networking, libsecret, gnome_desktop, libnotify, p11_kit
-, sqlite, gcr, avahi, nss, isocodes, itstool, file, which
-, gdk_pixbuf, librsvg, gnome_common, gst_all_1 }:
-
-stdenv.mkDerivation rec {
-  inherit (import ./src.nix fetchurl) name src;
-
-  # Tests need an X display
-  configureFlags = [ "--disable-static --disable-tests" ];
-
-  propagatedUserEnvPkgs = [ gnome3.gnome_themes_standard ];
-
-  nativeBuildInputs = [ pkgconfig file wrapGAppsHook ];
-
-  buildInputs = [ gtk3 glib intltool libwnck3 libxml2 libxslt pkgconfig file
-                  webkitgtk214x libsoup libsecret gnome_desktop libnotify libtool
-                  sqlite isocodes nss itstool p11_kit nspr icu gnome3.yelp_tools
-                  gdk_pixbuf gnome3.defaultIconTheme librsvg which gnome_common
-                  gcr avahi gnome3.gsettings_desktop_schemas gnome3.dconf
-                  gnome3.glib_networking gst_all_1.gstreamer gst_all_1.gst-plugins-base
-                  gst_all_1.gst-plugins-good gst_all_1.gst-plugins-bad gst_all_1.gst-plugins-ugly
-                  gst_all_1.gst-libav];
-
-  NIX_CFLAGS_COMPILE = "-I${nspr.dev}/include/nspr -I${nss.dev}/include/nss -I${glib.dev}/include/gio-unix-2.0";
-
-  enableParallelBuilding = true;
-
-  meta = with stdenv.lib; {
-    homepage = https://wiki.gnome.org/Apps/Epiphany;
-    description = "WebKit based web browser for GNOME";
-    maintainers = gnome3.maintainers;
-    license = licenses.gpl2;
-    platforms = platforms.linux;
-  };
-}
--- a/pkgs/desktops/gnome-3/3.20/core/epiphany/src.nix
+++ b/pkgs/desktops/gnome-3/3.20/core/epiphany/src.nix
@ -1,10 +0,0 @@
-# Autogenerated by maintainers/scripts/gnome.sh update
-
-fetchurl: {
-  name = "epiphany-3.20.4";
-
-  src = fetchurl {
-    url = mirror://gnome/sources/epiphany/3.20/epiphany-3.20.4.tar.xz;
-    sha256 = "051av2xcg7ii2y273vqmdkzanygws9qsaq7ks0070y06d4rhl6xy";
-  };
-}
--- a/Show more
+++ b/Show more