Merge pull request #45941 from NixOS/staging-next

Staging next
2018-09-23 09:31:28 +02:00 · 2018-09-23 09:31:28 +02:00 · 56853dc6d8
parent 343ac4d2fc 92158a4b2c
commit 56853dc6d8
65 changed files with 17573 additions and 8641 deletions
--- a/nixos/doc/manual/release-notes/rl-1809.xml
+++ b/nixos/doc/manual/release-notes/rl-1809.xml
@ -91,7 +91,7 @@ $ nix-instantiate -E '(import &lt;nixpkgsunstable&gt; {}).gitFull'
    <para>
     When enabled the <literal>iproute2</literal> will copy the files expected
     by ip route (e.g., <filename>rt_tables</filename>) in
-     <filename>/run/iproute2</filename>. This allows to write aliases for
+     <filename>/etc/iproute2</filename>. This allows to write aliases for
     routing tables for instance.
    </para>
   </listitem>
--- a/nixos/modules/config/iproute2.nix
+++ b/nixos/modules/config/iproute2.nix
@ -4,20 +4,29 @@ with lib;

 let
  cfg = config.networking.iproute2;
-  confDir = "/run/iproute2";
 in
 {
-  options.networking.iproute2.enable = mkEnableOption "copy IP route configuration files";
-
-  config = mkMerge [
-    ({ nixpkgs.config.iproute2.confDir = confDir; })
-
-    (mkIf cfg.enable {
-      system.activationScripts.iproute2 = ''
-        cp -R ${pkgs.iproute}/etc/iproute2 ${confDir}
-        chmod -R 664 ${confDir}
-        chmod +x ${confDir}
+  options.networking.iproute2 = {
+    enable = mkEnableOption "copy IP route configuration files";
+    rttablesExtraConfig = mkOption {
+      type = types.lines;
+      default = "";
+      description = ''
+        Verbatim lines to add to /etc/iproute2/rt_tables
      '';
-    })
-  ];
+    };
+  };
+
+  config = mkIf cfg.enable {
+    environment.etc."iproute2/bpf_pinning" = { mode = "0644"; text = fileContents "${pkgs.iproute}/etc/iproute2/bpf_pinning"; };
+    environment.etc."iproute2/ematch_map"  = { mode = "0644"; text = fileContents "${pkgs.iproute}/etc/iproute2/ematch_map";  };
+    environment.etc."iproute2/group"       = { mode = "0644"; text = fileContents "${pkgs.iproute}/etc/iproute2/group";       };
+    environment.etc."iproute2/nl_protos"   = { mode = "0644"; text = fileContents "${pkgs.iproute}/etc/iproute2/nl_protos";   };
+    environment.etc."iproute2/rt_dsfield"  = { mode = "0644"; text = fileContents "${pkgs.iproute}/etc/iproute2/rt_dsfield";  };
+    environment.etc."iproute2/rt_protos"   = { mode = "0644"; text = fileContents "${pkgs.iproute}/etc/iproute2/rt_protos";   };
+    environment.etc."iproute2/rt_realms"   = { mode = "0644"; text = fileContents "${pkgs.iproute}/etc/iproute2/rt_realms";   };
+    environment.etc."iproute2/rt_scopes"   = { mode = "0644"; text = fileContents "${pkgs.iproute}/etc/iproute2/rt_scopes";   };
+    environment.etc."iproute2/rt_tables"   = { mode = "0644"; text = (fileContents "${pkgs.iproute}/etc/iproute2/rt_tables")
+                                                                   + (optionalString (cfg.rttablesExtraConfig != "") "\n\n${cfg.rttablesExtraConfig}"); };
+  };
 }
--- a/nixos/modules/config/system-path.nix
+++ b/nixos/modules/config/system-path.nix
@ -13,7 +13,7 @@ let
      pkgs.attr
      pkgs.bashInteractive # bash with ncurses support
      pkgs.bzip2
-      pkgs.coreutils
+      pkgs.coreutils-full
      pkgs.cpio
      pkgs.curl
      pkgs.diffutils
--- a/nixos/modules/services/x11/hardware/libinput.nix
+++ b/nixos/modules/services/x11/hardware/libinput.nix
@ -205,7 +205,7 @@ in {
      })
    ];

-    services.udev.packages = [ pkgs.libinput ];
+    services.udev.packages = [ pkgs.libinput.out ];

    services.xserver.config =
      ''
--- a/pkgs/applications/audio/gradio/default.nix
+++ b/pkgs/applications/audio/gradio/default.nix
@ -56,7 +56,7 @@ in stdenv.mkDerivation rec {

  enableParallelBuilding = true;
  postInstall = ''
-    ${glib.dev}/bin/glib-compile-schemas $out/share/glib-2.0/schemas
+    glib-compile-schemas "$out"/share/glib-2.0/schemas
  '';

  patches = [ ./0001-Remove-post-install-script-that-hardcodes-paths.patch ];
--- a/pkgs/applications/gis/qgis/default.nix
+++ b/pkgs/applications/gis/qgis/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchurl, gdal, cmake, qt4, flex, bison, proj, geos, xlibsWrapper, sqlite, gsl
+{ stdenv, fetchurl, fetchpatch, gdal, cmake, qt4, flex, bison, proj, geos, xlibsWrapper, sqlite, gsl
 , qwt, fcgi, python2Packages, libspatialindex, libspatialite, qscintilla, postgresql, makeWrapper
 , qjson, qca2, txt2tags, openssl, darwin, pkgconfig
 , withGrass ? true, grass, IOKit, ApplicationServices
@ -37,6 +37,14 @@ stdenv.mkDerivation rec {
    sha256 = "00b3a2hfn3i7bdx7x96vz2nj0976vpkhid4ss7n8c33fdvw3k82a";
  };

+  patches = [
+    # https://github.com/qgis/QGIS/pull/7765
+    (fetchpatch {
+      url = "https://github.com/qgis/QGIS/commit/6b61ef361a77f057dc29eb07463007bd9012b253.patch";
+      sha256 = "1xibcahm18n7nxff1xvwwzjf505hvhiw5dk12is7aclv49h0rdf7";
+    })
+  ];
+
  # CMAKE_FIND_FRAMEWORK=never stops the installer choosing system
  # installed frameworks
  # QGIS_MACAPP_BUNDLE=0 stops the installer copying the Qt binaries into the
--- a/pkgs/applications/graphics/pbrt/default.nix
+++ b/pkgs/applications/graphics/pbrt/default.nix
@ -2,17 +2,22 @@

 stdenv.mkDerivation rec {

-  version = "2017-01-12";
+  version = "2018-08-15";
  name = "pbrt-v3-${version}";

  src = fetchFromGitHub {
-    rev = "35b6da3429526f2026fe5e5ebaf36d593e113028";
+    rev = "86b5821308088deea70b207bc8c22219d0103d65";
    owner  = "mmp";
    repo   = "pbrt-v3";
-    sha256 = "10lvbph13p6ilzqb8sgrvn9gg1zmi8wpy3hhjbqp8dnsa4x0mhj7";
+    sha256 = "0f7ivsczba6zfk5f0bba1js6dcwf6w6jrkiby147qp1sx5k35cv8";
    fetchSubmodules = true;
  };

+  patches = [
+    # https://github.com/mmp/pbrt-v3/issues/196
+    ./openexr-cmake-3.12.patch
+  ];
+
  buildInputs = [ git flex bison cmake zlib ];

  meta = with stdenv.lib; {
--- a/pkgs/applications/graphics/pbrt/openexr-cmake-3.12.patch
+++ b/pkgs/applications/graphics/pbrt/openexr-cmake-3.12.patch
@ -0,0 +1,26 @@
+diff -ur a/src/ext/openexr/CMakeLists.txt b/src/ext/openexr/CMakeLists.txt
+--- a/src/ext/openexr/CMakeLists.txt	1970-01-01 09:00:01.000000000 +0900
+++ b/src/ext/openexr/CMakeLists.txt	2018-08-31 21:44:56.490714484 +0900
+@@ -26,22 +26,4 @@
+   ${CMAKE_CURRENT_BINARY_DIR}/IlmBase/config
+ )
+ 
+-add_custom_target(CopyIlmBaseLibs
+-  COMMAND ${CMAKE_COMMAND} -E copy_directory
+-  ${CMAKE_CURRENT_BINARY_DIR}/IlmBase/Half/$<CONFIGURATION>
+-  ${CMAKE_CURRENT_BINARY_DIR}/OpenEXR/IlmImf/$<CONFIGURATION>
+-  COMMAND ${CMAKE_COMMAND} -E copy_directory
+-  ${CMAKE_CURRENT_BINARY_DIR}/IlmBase/IlmThread/$<CONFIGURATION>
+-  ${CMAKE_CURRENT_BINARY_DIR}/OpenEXR/IlmImf/$<CONFIGURATION>
+-  COMMAND ${CMAKE_COMMAND} -E copy_directory
+-  ${CMAKE_CURRENT_BINARY_DIR}/IlmBase/Iex/$<CONFIGURATION>
+-  ${CMAKE_CURRENT_BINARY_DIR}/OpenEXR/IlmImf/$<CONFIGURATION>
+-  COMMAND ${CMAKE_COMMAND} -E copy_directory
+-  ${CMAKE_CURRENT_BINARY_DIR}/IlmBase/Imath/$<CONFIGURATION>
+-  ${CMAKE_CURRENT_BINARY_DIR}/OpenEXR/IlmImf/$<CONFIGURATION>
+-)
+-add_dependencies(CopyIlmBaseLibs Iex Imath IlmThread Half)
+-
+ add_subdirectory(OpenEXR OpenEXR)
+-add_dependencies(b44ExpLogTable CopyIlmBaseLibs)
+-add_dependencies(dwaLookups CopyIlmBaseLibs)
--- a/pkgs/applications/misc/curaengine/default.nix
+++ b/pkgs/applications/misc/curaengine/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, cmake, libarcus, stb }:
+{ stdenv, fetchFromGitHub, fetchpatch, cmake, libarcus, stb }:

 stdenv.mkDerivation rec {
  name = "curaengine-${version}";
@ -11,6 +11,14 @@ stdenv.mkDerivation rec {
    sha256 = "083jmhzmb60rmqw0fhbnlxyblzkmpn3k6zc75xq90x5g3h60wib4";
  };

+  patches = [
+    # Fixed upstream, but not yet released
+    (fetchpatch {
+      url = "https://github.com/Ultimaker/CuraEngine/commit/5aad55bf67e52ce5bdb27a3925af8a4cab441b38.patch";
+      sha256 = "1hxbslzhkvdg8p33mvlbrpw62gwfqpsdbfca6yhdng9hifl86j3f";
+    })
+  ];
+
  nativeBuildInputs = [ cmake ];
  buildInputs = [ libarcus stb ];

--- a/pkgs/applications/science/electronics/kicad/default.nix
+++ b/pkgs/applications/science/electronics/kicad/default.nix
@ -36,8 +36,7 @@ stdenv.mkDerivation rec {
    ++ optional (ngspiceSupport) "-DKICAD_SPICE=ON";

  nativeBuildInputs = [
-    # https://www.mail-archive.com/kicad-developers@lists.launchpad.net/msg29840.html
-    (cmake.override {majorVersion = "3.10";})
+    cmake
    doxygen
    pkgconfig
    wrapGAppsHook
--- a/pkgs/applications/science/electronics/kicad/unstable.nix
+++ b/pkgs/applications/science/electronics/kicad/unstable.nix
@ -38,8 +38,7 @@ stdenv.mkDerivation rec {
      "-DCMAKE_CXX_FLAGS=-I${wxPython}/include/wx-3.0"
    ];

-  # https://www.mail-archive.com/kicad-developers@lists.launchpad.net/msg29840.html
-  nativeBuildInputs = [ (cmake.override {majorVersion = "3.10";}) doxygen  pkgconfig ];
+  nativeBuildInputs = [ cmake doxygen pkgconfig ];
  buildInputs = [
    libGLU_combined zlib libX11 wxGTK pcre libXdmcp gettext glew glm libpthreadstubs
    cairo curl openssl boost
--- a/pkgs/applications/science/logic/tlaplus/toolbox.nix
+++ b/pkgs/applications/science/logic/tlaplus/toolbox.nix
@ -44,7 +44,7 @@ in stdenv.mkDerivation {
      --run "set -x; cd $out/toolbox" \
      --add-flags "-data ~/.tla-toolbox" \
      --prefix PATH : "${jre}/bin" \
-      --prefix LD_LIBRARY_PATH : "${swt}/lib:${gtk}/lib:${libXtst}/lib:${glib}/lib"
+      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ swt gtk libXtst glib ]}"

    echo -e "\nCreating TLA Toolbox icons..."
    pushd "$src"
--- a/pkgs/desktops/gnome-3/apps/gnome-documents/default.nix
+++ b/pkgs/desktops/gnome-3/apps/gnome-documents/default.nix
@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
  '';

  preFixup = ''
-    substituteInPlace $out/bin/gnome-documents --replace gapplication "${glib.dev}/bin/gapplication"
+    substituteInPlace $out/bin/gnome-documents --replace gapplication "${glib.bin}/bin/gapplication"
  '';

  passthru = {
--- a/pkgs/desktops/gnome-3/core/gnome-user-share/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-user-share/default.nix
@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
  postInstall = ''
    mkdir -p $out/share/gsettings-schemas/$name
    mv $out/share/glib-2.0 $out/share/gsettings-schemas/$name
-    ${glib.dev}/bin/glib-compile-schemas $out/share/gsettings-schemas/$name/glib-2.0/schemas
+    glib-compile-schemas "$out/share/gsettings-schemas/$name/glib-2.0/schemas"
  '';

  meta = with stdenv.lib; {
--- a/pkgs/desktops/gnome-3/core/tracker-miners/default.nix
+++ b/pkgs/desktops/gnome-3/core/tracker-miners/default.nix
@ -85,7 +85,7 @@ in stdenv.mkDerivation rec {
  '';

  postInstall = ''
-    ${glib.dev}/bin/glib-compile-schemas $out/share/glib-2.0/schemas
+    glib-compile-schemas "$out/share/glib-2.0/schemas"
  '';

  passthru = {
--- a/pkgs/desktops/gnome-3/core/tracker/default.nix
+++ b/pkgs/desktops/gnome-3/core/tracker/default.nix
@ -40,7 +40,7 @@ in stdenv.mkDerivation rec {
  '';

  postInstall = ''
-    ${glib.dev}/bin/glib-compile-schemas $out/share/glib-2.0/schemas
+    glib-compile-schemas "$out/share/glib-2.0/schemas"
  '';

  passthru = {
--- a/pkgs/desktops/gnome-3/extensions/caffeine/default.nix
+++ b/pkgs/desktops/gnome-3/extensions/caffeine/default.nix
@ -19,7 +19,7 @@ stdenv.mkDerivation rec {

  buildPhase = ''
    ${bash}/bin/bash ./update-locale.sh
-    ${glib.dev}/bin/glib-compile-schemas --strict --targetdir=caffeine@patapon.info/schemas/ caffeine@patapon.info/schemas
+    glib-compile-schemas --strict --targetdir=caffeine@patapon.info/schemas/ caffeine@patapon.info/schemas
  '';

  installPhase = ''
--- a/pkgs/desktops/gnome-3/extensions/system-monitor/default.nix
+++ b/pkgs/desktops/gnome-3/extensions/system-monitor/default.nix
@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
  ];

  buildPhase = ''
-    ${glib.dev}/bin/glib-compile-schemas --targetdir=${uuid}/schemas ${uuid}/schemas
+    glib-compile-schemas --targetdir=${uuid}/schemas ${uuid}/schemas
  '';

  installPhase = ''
--- a/pkgs/desktops/gnome-3/extensions/volume-mixer.nix
+++ b/pkgs/desktops/gnome-3/extensions/volume-mixer.nix
@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
  ];

  buildPhase = ''
-    ${glib.dev}/bin/glib-compile-schemas --targetdir=${uuid}/schemas ${uuid}/schemas
+    glib-compile-schemas --targetdir=${uuid}/schemas ${uuid}/schemas
  '';

  installPhase = ''
--- a/pkgs/desktops/gnome-3/misc/pidgin/default.nix
+++ b/pkgs/desktops/gnome-3/misc/pidgin/default.nix
@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
    schemas_dir="$share_dir/gsettings-schemas/${name}/glib-2.0/schemas"
    mkdir -p "$schemas_dir"
    mv schemas/* "$schemas_dir" # fix Emacs syntax highlighting: */
-    ${glib.dev}/bin/glib-compile-schemas "$schemas_dir"
+    glib-compile-schemas "$schemas_dir"

    locale_dir="$share_dir/locale"
    mkdir -p "$locale_dir"
--- a/pkgs/development/libraries/boost/generic.nix
+++ b/pkgs/development/libraries/boost/generic.nix
@ -74,6 +74,7 @@ let
  ] ++ optional (link != "static") "runtime-link=${runtime-link}"
    ++ optional (variant == "release") "debug-symbols=off"
    ++ optional (toolset != null) "toolset=${toolset}"
+    ++ optional (!enablePython) "--without-python"
    ++ optional (mpi != null || stdenv.hostPlatform != stdenv.buildPlatform) "--user-config=user-config.jam"
    ++ optionals (stdenv.hostPlatform.libc == "msvcrt") [
    "threadapi=win32"
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@ -61,7 +61,7 @@ stdenv.mkDerivation rec {
      ./gobject_init_on_demand.patch
    ] ++ [ ./schema-override-variable.patch ];

-  outputs = [ "out" "dev" "devdoc" ];
+  outputs = [ "bin" "out" "dev" "devdoc" ];
  outputBin = "dev";

  setupHook = ./setup-hook.sh;
@ -104,12 +104,16 @@ stdenv.mkDerivation rec {
  DETERMINISTIC_BUILD = 1;

  postInstall = ''
+    mkdir -p $bin/bin
+    for app in gapplication gdbus gio gsettings; do
+      mv "$dev/bin/$app" "$bin/bin"
+    done
+
    moveToOutput "share/glib-2.0" "$dev"
    substituteInPlace "$dev/bin/gdbus-codegen" --replace "$out" "$dev"
    sed -i "$dev/bin/glib-gettextize" -e "s|^gettext_dir=.*|gettext_dir=$dev/share/glib-2.0/gettext|"
-  ''
-  # This file is *included* in gtk3 and would introduce runtime reference via __FILE__.
-  + ''
+
+    # This file is *included* in gtk3 and would introduce runtime reference via __FILE__.
    sed '1i#line 1 "${name}/include/glib-2.0/gobject/gobjectnotifyqueue.c"' \
      -i "$dev"/include/glib-2.0/gobject/gobjectnotifyqueue.c
  '';
--- a/pkgs/development/libraries/gstreamer/bad/default.nix
+++ b/pkgs/development/libraries/gstreamer/bad/default.nix
@ -17,7 +17,8 @@ let
  inherit (stdenv.lib) optional;
 in
 stdenv.mkDerivation rec {
-  name = "gst-plugins-bad-1.14.0";
+  name = "gst-plugins-bad-${version}";
+  version = "1.14.2";

  meta = with stdenv.lib; {
    description = "Gstreamer Bad Plugins";
@ -53,7 +54,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "${meta.homepage}/src/gst-plugins-bad/${name}.tar.xz";
-    sha256 = "17sgzgx1c54k5rzz7ljyz3is0n7yj56k74vv05h8z1gjnsnjnppd";
+    sha256 = "1bqy3dn7q4kdkd4lqznyly8fv854d0hhncv88jk6ai4rf3dbgyil";
  };

  outputs = [ "out" "dev" ];
--- a/pkgs/development/libraries/gstreamer/base/default.nix
+++ b/pkgs/development/libraries/gstreamer/base/default.nix
@ -9,7 +9,8 @@
 , enableCdparanoia ? (!stdenv.isDarwin), cdparanoia }:

 stdenv.mkDerivation rec {
-  name = "gst-plugins-base-1.14.0";
+  name = "gst-plugins-base-${version}";
+  version = "1.14.2";

  meta = with lib; {
    description = "Base plugins and helper libraries";
@ -21,7 +22,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "${meta.homepage}/src/gst-plugins-base/${name}.tar.xz";
-    sha256 = "0h39bcp7fcd9kgb189lxr8l0hm0almvzpzgpdh1jpq2nzxh4d43y";
+    sha256 = "0z0wy0p0nxxqhsis3n517d6ykldm02g7rca9fhq9kxb9m05yidx4";
  };

  outputs = [ "out" "dev" ];
--- a/pkgs/development/libraries/gstreamer/core/default.nix
+++ b/pkgs/development/libraries/gstreamer/core/default.nix
@ -6,7 +6,8 @@
 }:

 stdenv.mkDerivation rec {
-  name = "gstreamer-1.14.0";
+  name = "gstreamer-${version}";
+  version = "1.14.2";

  meta = with lib ;{
    description = "Open source multimedia framework";
@ -18,7 +19,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "${meta.homepage}/src/gstreamer/${name}.tar.xz";
-    sha256 = "0vj6k01lp2yva6rfd95fkyng9jdr62gkz0x8d2l81dyly1ki6dpw";
+    sha256 = "029fi3v0vrravysgfwhfkrb3ndg64sjmigbb0iwr7wpkk5r15mjb";
  };

  patches = [
--- a/pkgs/development/libraries/gstreamer/ges/default.nix
+++ b/pkgs/development/libraries/gstreamer/ges/default.nix
@ -4,7 +4,8 @@
 }:

 stdenv.mkDerivation rec {
-  name = "gstreamer-editing-services-1.14.0";
+  name = "gstreamer-editing-services-${version}";
+  version = "1.14.2";

  meta = with stdenv.lib; {
    description = "Library for creation of audio/video non-linear editors";
@ -15,7 +16,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "${meta.homepage}/src/gstreamer-editing-services/${name}.tar.xz";
-    sha256 = "14cdd6y9p4k603hsnyhdjw2igg855gwpx0362jmg8k1gagmr0pwd";
+    sha256 = "0d0zqvgxp51mmffz5vvscsdzqqw9mjsv6bnk6ivg2dxnkv8q1ch5";
  };

  outputs = [ "out" "dev" ];
--- a/pkgs/development/libraries/gstreamer/good/default.nix
+++ b/pkgs/development/libraries/gstreamer/good/default.nix
@ -15,7 +15,8 @@ let
  inherit (stdenv.lib) optional optionals;
 in
 stdenv.mkDerivation rec {
-  name = "gst-plugins-good-1.14.0";
+  name = "gst-plugins-good-${version}";
+  version = "1.14.2";

  meta = with stdenv.lib; {
    description = "Gstreamer Good Plugins";
@ -32,7 +33,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "${meta.homepage}/src/gst-plugins-good/${name}.tar.xz";
-    sha256 = "1226s30cf7pqg3fj8shd20l7sp93yw9sqplgxns3m3ajgms3byka";
+    sha256 = "1bfa4n6xhr4v4wga8pv1y00rm1aka498snw6kgszy2w624l5wmy0";
  };

  outputs = [ "out" "dev" ];
--- a/pkgs/development/libraries/gstreamer/libav/default.nix
+++ b/pkgs/development/libraries/gstreamer/libav/default.nix
@ -9,7 +9,8 @@
 assert withSystemLibav -> libav != null;

 stdenv.mkDerivation rec {
-  name = "gst-libav-1.14.0";
+  name = "gst-libav-${version}";
+  version = "1.14.2";

  meta = {
    homepage = https://gstreamer.freedesktop.org;
@ -19,7 +20,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "${meta.homepage}/src/gst-libav/${name}.tar.xz";
-    sha256 = "12gglx6rarnxbaj0h1wivlgkv467n1bz2bwjigplciq57r6ln4zv";
+    sha256 = "1pknqpjxq1l3vlprdsmxxwk0lwqa555fqd543k9vphngqlwiqdca";
  };

  outputs = [ "out" "dev" ];
--- a/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
+++ b/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
@ -3,7 +3,8 @@
 }:

 stdenv.mkDerivation rec {
-  name = "gst-rtsp-server-1.14.0";
+  name = "gst-rtsp-server-${version}";
+  version = "1.14.2";

  meta = with stdenv.lib; {
    description = "Gstreamer RTSP server";
@ -18,7 +19,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "${meta.homepage}/src/gst-rtsp-server/${name}.tar.xz";
-    sha256 = "0mlp9ms5hfbyzyvmc9xgi7934g4zrh1sbgky2p9zc5fqprvs0rbb";
+    sha256 = "161c49hg21xpkdw5ppc7ljbg6kyslxd1y3v1shsg7ibarxapff7p";
  };

  outputs = [ "out" "dev" ];
--- a/pkgs/development/libraries/gstreamer/ugly/default.nix
+++ b/pkgs/development/libraries/gstreamer/ugly/default.nix
@ -6,7 +6,8 @@
 }:

 stdenv.mkDerivation rec {
-  name = "gst-plugins-ugly-1.14.0";
+  name = "gst-plugins-ugly-${version}";
+  version = "1.14.2";

  meta = with lib; {
    description = "Gstreamer Ugly Plugins";
@ -24,7 +25,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "${meta.homepage}/src/gst-plugins-ugly/${name}.tar.xz";
-    sha256 = "1la2nny9hfw3rf3wvqggkg8ivn52qrqqs4n4mqz4ppm2r1gymf9z";
+    sha256 = "0s9xrz8knfv06fj1nbv3iq4xj7dj4cnzj3xvgb7zs89rv7crgq2m";
  };

  outputs = [ "out" "dev" ];
--- a/pkgs/development/libraries/gstreamer/vaapi/default.nix
+++ b/pkgs/development/libraries/gstreamer/vaapi/default.nix
@ -5,11 +5,11 @@

 stdenv.mkDerivation rec {
  name = "gst-vaapi-${version}";
-  version = "1.14.0";
+  version = "1.14.2";

  src = fetchurl {
    url = "${meta.homepage}/src/gstreamer-vaapi/gstreamer-vaapi-${version}.tar.xz";
-    sha256 = "1whxk428badv8ibji00sn6hj17cp8l9n93rr948bz2gjbq41zqz4";
+    sha256 = "12hdyfma2lnfj38dj6y891vsxnxrlbqjbd36xx13mgasgzi6843z";
  };

  outputs = [ "out" "dev" ];
--- a/pkgs/development/libraries/gstreamer/validate/default.nix
+++ b/pkgs/development/libraries/gstreamer/validate/default.nix
@ -3,7 +3,8 @@
 }:

 stdenv.mkDerivation rec {
-  name = "gst-validate-1.14.0";
+  name = "gst-validate-${version}";
+  version = "1.14.2";

  meta = {
    description = "Integration testing infrastructure for the GStreamer framework";
@ -14,7 +15,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "${meta.homepage}/src/gst-validate/${name}.tar.xz";
-    sha256 = "1pzzxqkv1spjrzpzpazdm2h4s2wk7gg5gag8nxj5v2gjfyzhiprk";
+    sha256 = "17zilvmwv13l6rbj0a7dnbg4kz5bwwa1gshaibpqbvvhahz457pa";
  };

  outputs = [ "out" "dev" ];
--- a/pkgs/development/libraries/gtkd/default.nix
+++ b/pkgs/development/libraries/gtkd/default.nix
@ -37,8 +37,8 @@ stdenv.mkDerivation rec {
      --replace libpango-1.0.0.dylib ${pango.out}/lib/libpango-1.0.0.dylib \
      --replace libpangocairo-1.0.0.dylib ${pango.out}/lib/libpangocairo-1.0.0.dylib
    substituteInPlace generated/gtkd/gobject/c/functions.d \
-      --replace libgobject-2.0.so.0 ${glib}/lib/libgobject-2.0.so.0 \
-      --replace libgobject-2.0.0.dylib ${glib}/lib/libgobject-2.0.0.dylib
+      --replace libgobject-2.0.so.0 ${glib.out}/lib/libgobject-2.0.so.0 \
+      --replace libgobject-2.0.0.dylib ${glib.out}/lib/libgobject-2.0.0.dylib
    substituteInPlace generated/gtkd/rsvg/c/functions.d \
      --replace librsvg-2.so.2 ${librsvg}/lib/librsvg-2.so.2 \
      --replace librsvg-2.2.dylib ${librsvg}/lib/librsvg-2.2.dylib
@ -63,15 +63,15 @@ stdenv.mkDerivation rec {
      --replace libgtksourceview-3.0.so.1 ${gtksourceview}/lib/libgtksourceview-3.0.so.1 \
      --replace libgtksourceview-3.0.1.dylib ${gtksourceview}/lib/libgtksourceview-3.0.1.dylib
    substituteInPlace generated/gtkd/glib/c/functions.d \
-      --replace libglib-2.0.so.0 ${glib}/lib/libglib-2.0.so.0 \
-      --replace libgmodule-2.0.so.0 ${glib}/lib/libgmodule-2.0.so.0 \
-      --replace libgobject-2.0.so.0 ${glib}/lib/libgobject-2.0.so.0 \
-      --replace libglib-2.0.0.dylib ${glib}/lib/libglib-2.0.0.dylib \
-      --replace libgmodule-2.0.0.dylib ${glib}/lib/libgmodule-2.0.0.dylib \
-      --replace libgobject-2.0.0.dylib ${glib}/lib/libgobject-2.0.0.dylib
+      --replace libglib-2.0.so.0 ${glib.out}/lib/libglib-2.0.so.0 \
+      --replace libgmodule-2.0.so.0 ${glib.out}/lib/libgmodule-2.0.so.0 \
+      --replace libgobject-2.0.so.0 ${glib.out}/lib/libgobject-2.0.so.0 \
+      --replace libglib-2.0.0.dylib ${glib.out}/lib/libglib-2.0.0.dylib \
+      --replace libgmodule-2.0.0.dylib ${glib.out}/lib/libgmodule-2.0.0.dylib \
+      --replace libgobject-2.0.0.dylib ${glib.out}/lib/libgobject-2.0.0.dylib
    substituteInPlace generated/gtkd/gio/c/functions.d \
-      --replace libgio-2.0.so.0 ${glib}/lib/libgio-2.0.so.0 \
-      --replace libgio-2.0.0.dylib ${glib}/lib/libgio-2.0.0.dylib
+      --replace libgio-2.0.so.0 ${glib.out}/lib/libgio-2.0.so.0 \
+      --replace libgio-2.0.0.dylib ${glib.out}/lib/libgio-2.0.0.dylib
    substituteInPlace generated/gstreamer/gstreamer/c/functions.d \
      --replace libgstreamer-1.0.so.0 ${gstreamer}/lib/libgstreamer-1.0.so.0 \
      --replace libgstreamer-1.0.0.dylib ${gstreamer}/lib/libgstreamer-1.0.0.dylib
--- a/pkgs/development/libraries/libgpg-error/default.nix
+++ b/pkgs/development/libraries/libgpg-error/default.nix
@ -17,21 +17,13 @@
  };
 in stdenv.mkDerivation (rec {
  name = "libgpg-error-${version}";
-  version = "1.28";
+  version = "1.32";

  src = fetchurl {
    url = "mirror://gnupg/libgpg-error/${name}.tar.bz2";
-    sha256 = "0jfsfnh9bxlxiwxws60yah4ybjw2hshmvqp31pri4m4h8ivrbnry";
+    sha256 = "1jj08ns4sh1hmafqp1giskvdicdz18la516va26jycy27kkwaif3";
  };

-  patches = [
-    # Fix builds on ARM, AArch64
-    (fetchpatch {
-      url = "https://github.com/gpg/libgpg-error/commit/791177de023574223eddf7288eb7c5a0721ac623.patch";
-      sha256 = "0vqfw0ak1j37wf6sk9y9vmdyk3kxdxkldhs0bv2waa76s11cmdx0";
-    })
-  ];
-
  postPatch = ''
    sed '/BUILD_TIMESTAMP=/s/=.*/=1970-01-01T00:01+0000/' -i ./configure
  '' + lib.optionalString (stdenv.hostPlatform.isAarch32 && stdenv.buildPlatform != stdenv.hostPlatform) ''
--- a/pkgs/development/libraries/libinput/default.nix
+++ b/pkgs/development/libraries/libinput/default.nix
@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
    sha256 = "01nb1shnl871d939wgfd7nc9svclcnfjfhlq64b4yns2dvcr24gk";
  };

-  outputs = [ "out" "dev" ];
+  outputs = [ "bin" "out" "dev" ];

  mesonFlags = [
    (mkFlag documentationSupport "documentation")
@ -31,6 +31,10 @@ stdenv.mkDerivation rec {
    (mkFlag testsSupport "tests")
  ];

+  preConfigure = ''
+    mesonFlags="$mesonFlags --libexecdir=$bin/libexec"
+  '';
+
  nativeBuildInputs = [ pkgconfig meson ninja ]
    ++ optionals documentationSupport [ doxygen graphviz ]
    ++ optionals testsSupport [ check valgrind python3Packages.pyparsing ];
--- a/pkgs/development/libraries/libuv/default.nix
+++ b/pkgs/development/libraries/libuv/default.nix
@ -1,14 +1,14 @@
 { stdenv, lib, fetchpatch, fetchFromGitHub, autoconf, automake, libtool, pkgconfig }:

 stdenv.mkDerivation rec {
-  version = "1.21.0";
+  version = "1.23.0";
  name = "libuv-${version}";

  src = fetchFromGitHub {
    owner = "libuv";
    repo = "libuv";
    rev = "v${version}";
-    sha256 = "1jjg34ppnlrnb634q9mla7whl7rm9xmjgnzckrznqcycwzir074b";
+    sha256 = "1yfx99f7qnq3qvcgbnih27dgwfg6c51xw6n6n2c3c1wb3mh95im0";
  };

  patches = [
--- a/pkgs/development/libraries/pango/default.nix
+++ b/pkgs/development/libraries/pango/default.nix
@ -1,37 +1,45 @@
 { stdenv, fetchurl, pkgconfig, libXft, cairo, harfbuzz
-, libintl, gobjectIntrospection, darwin, fribidi
+, libintl, gobjectIntrospection, darwin, fribidi, gnome3
+, gtk-doc, docbook_xsl, docbook_xml_dtd_43, makeFontsConf, freefont_ttf
 }:

 with stdenv.lib;

 let
-  ver_maj = "1.42";
-  ver_min = "1";
-in
-stdenv.mkDerivation rec {
-  name = "pango-${ver_maj}.${ver_min}";
+  pname = "pango";
+  version = "1.42.4";
+in stdenv.mkDerivation rec {
+  name = "${pname}-${version}";

  src = fetchurl {
-    url = "mirror://gnome/sources/pango/${ver_maj}/${name}.tar.xz";
-    sha256 = "0cnfgcya3wbs9m8g44cl5ww6wbp6qbw96qvsgkr8ymwqn9b6fnli";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
+    sha256 = "17bwb7dgbncrfsmchlib03k9n3xaalirb39g3yb43gg8cg6p8aqx";
  };

  outputs = [ "bin" "dev" "out" "devdoc" ];

-  buildInputs = [ gobjectIntrospection ];
-  nativeBuildInputs = [ pkgconfig ]
-    ++ optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [
-       Carbon
-       CoreGraphics
-       CoreText
-    ]);
+  nativeBuildInputs = [ pkgconfig gobjectIntrospection gtk-doc docbook_xsl docbook_xml_dtd_43 ];
+  buildInputs = optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [
+    Carbon
+    CoreGraphics
+    CoreText
+  ]);
  propagatedBuildInputs = [ cairo harfbuzz libXft libintl fribidi ];

  enableParallelBuilding = true;

-  configureFlags = optional stdenv.isDarwin "--without-x";
+  # Fontconfig error: Cannot load default config file
+  FONTCONFIG_FILE = makeFontsConf {
+    fontDirectories = [ freefont_ttf ];
+  };

-  doCheck = false; # fails 1 out of 12 tests with "Fontconfig error: Cannot load default config file"
+  doCheck = false; # /layout/valid-1.markup: FAIL
+
+  passthru = {
+    updateScript = gnome3.updateScript {
+      packageName = pname;
+    };
+  };

  meta = with stdenv.lib; {
    description = "A library for laying out and rendering of text, with an emphasis on internationalization";
--- a/pkgs/development/libraries/podofo/default.nix
+++ b/pkgs/development/libraries/podofo/default.nix
@ -1,5 +1,5 @@
 { stdenv, fetchurl, cmake, zlib, freetype, libjpeg, libtiff, fontconfig
-, openssl, libpng, lua5, pkgconfig, libidn, expat
+, openssl, libpng, lua5, pkgconfig, libidn, expat, fetchpatch
 , gcc5 # TODO(@Dridus) remove this at next hash break
 }:

@ -13,6 +13,15 @@ stdenv.mkDerivation rec {

  propagatedBuildInputs = [ zlib freetype libjpeg libtiff fontconfig openssl libpng libidn expat ];

+  patches = [
+    # https://sourceforge.net/p/podofo/tickets/24/
+    (fetchpatch {
+      url = "https://sourceforge.net/p/podofo/tickets/24/attachment/podofo-cmake-3.12.patch";
+      extraPrefix = "";
+      sha256 = "087h51x60zrakzx09baan77hwz99cwb5l1j802r5g4wj7pbjz0mb";
+    })
+  ];
+
  # TODO(@Dridus) remove the ++ ghc5 at next hash break
  nativeBuildInputs = [ cmake pkgconfig ] ++ stdenv.lib.optional stdenv.isLinux gcc5;

--- a/pkgs/development/libraries/poppler/0.61.nix
+++ b/pkgs/development/libraries/poppler/0.61.nix
@ -1,5 +1,5 @@
 { stdenv, lib, fetchurl, cmake, ninja, pkgconfig, libiconv, libintl
-, zlib, curl, cairo, freetype, fontconfig, lcms, libjpeg, openjpeg
+, zlib, curl, cairo, freetype, fontconfig, lcms, libjpeg, openjpeg, fetchpatch
 , withData ? true, poppler_data
 , qt5Support ? false, qtbase ? null
 , introspectionSupport ? false, gobjectIntrospection ? null
@ -21,6 +21,14 @@ stdenv.mkDerivation rec {

  outputs = [ "out" "dev" ];

+  patches = [
+    (fetchpatch {
+      name = "CVE-2018-13988";
+      url = "https://cgit.freedesktop.org/poppler/poppler/patch/?id=004e3c10df0abda214f0c293f9e269fdd979c5ee";
+      sha256 = "1l8713s57xc6g81bldw934rsfm140fqc7ggd50ha5mxdl1b3app2";
+    })
+  ];
+
  buildInputs = [ libiconv libintl ] ++ lib.optional withData poppler_data;

  # TODO: reduce propagation to necessary libs
--- a/pkgs/development/libraries/wayland/default.nix
+++ b/pkgs/development/libraries/wayland/default.nix
@ -8,11 +8,11 @@ assert expat != null;

 stdenv.mkDerivation rec {
  name = "wayland-${version}";
-  version = "1.15.0";
+  version = "1.16.0";

  src = fetchurl {
    url = "https://wayland.freedesktop.org/releases/${name}.tar.xz";
-    sha256 = "1c5fnys8hi71cnzjv5k7j0r8gx80p0yyqlrpmn06mmarhnxvwgzb";
+    sha256 = "1xajhxad43izq9f7sbww1hlg42nayijy8xnp21kgpk09c6sw4wjf";
  };

  configureFlags = [ "--with-scanner" "--disable-documentation" ];
--- a/pkgs/development/python-modules/gst-python/default.nix
+++ b/pkgs/development/python-modules/gst-python/default.nix
@ -4,7 +4,7 @@

 let
  pname = "gst-python";
-  version = "1.14.0";
+  version = "1.14.2";
  name = "${pname}-${version}";
 in buildPythonPackage rec {
  inherit pname version;
@ -15,7 +15,7 @@ in buildPythonPackage rec {
      "${meta.homepage}/src/gst-python/${name}.tar.xz"
      "mirror://gentoo/distfiles/${name}.tar.xz"
      ];
-    sha256 = "1rlr6gl4lg97ng4jxh3gb2ldmywm15vwsa72nvggr8qa2l8q3fg0";
+    sha256 = "08nb011acyvlz48fqh8c084k0dlssz9b7wha7zzk797inidbwh6w";
  };

  outputs = [ "out" "dev" ];
--- a/pkgs/development/tools/build-managers/cmake/2.8.nix
+++ b/pkgs/development/tools/build-managers/cmake/2.8.nix
@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
      sha256 = "136z63ff83hnwd247cq4m8m8164pklzyl5i2csf5h6wd8p01pdkj";
    })] ++
    # Don't search in non-Nix locations such as /usr, but do search in our libc.
-    [ ./search-path.patch ] ++
+    [ ./search-path-2.8.patch ] ++
    optional (stdenv.hostPlatform != stdenv.buildPlatform) (fetchurl {
      name = "fix-darwin-cross-compile.patch";
      url = "https://public.kitware.com/Bug/file_download.php?"
--- a/pkgs/development/tools/build-managers/cmake/application-services.patch
+++ b/pkgs/development/tools/build-managers/cmake/application-services.patch
@ -1,16 +1,15 @@
-diff --git a/Source/cmGlobalXCodeGenerator.cxx b/Source/cmGlobalXCodeGenerator.cxx
-index 2008a0b..5a3e8ee 100644
--- a/Source/cmGlobalXCodeGenerator.cxx
-+++ b/Source/cmGlobalXCodeGenerator.cxx
+diff -ur cmake-3.12.1/Source/cmGlobalXCodeGenerator.cxx cmake-3.12.1-patched/Source/cmGlobalXCodeGenerator.cxx
+--- cmake-3.12.1/Source/cmGlobalXCodeGenerator.cxx	2018-08-09 21:14:08.000000000 +0900
+++ cmake-3.12.1-patched/Source/cmGlobalXCodeGenerator.cxx	2018-08-12 02:47:28.719691934 +0900
@@ -35,11 +35,6 @@
 
 struct cmLinkImplementation;
 
 -#if defined(CMAKE_BUILD_WITH_CMAKE) && defined(__APPLE__)
-#define HAVE_APPLICATION_SERVICES
-#include <ApplicationServices/ApplicationServices.h>
+-#  define HAVE_APPLICATION_SERVICES
+-#  include <ApplicationServices/ApplicationServices.h>
 -#endif
 -
 #if defined(CMAKE_BUILD_WITH_CMAKE)
- #include "cmXMLParser.h"
+ #  include "cmXMLParser.h"
 
--- a/pkgs/development/tools/build-managers/cmake/default.nix
+++ b/pkgs/development/tools/build-managers/cmake/default.nix
@ -1,6 +1,5 @@
 { stdenv, fetchurl, fetchpatch, pkgconfig
 , bzip2, curl, expat, libarchive, xz, zlib, libuv, rhash
-, majorVersion ? "3.11"
 # darwin attributes
 , ps
 , isBootstrap ? false
@ -15,27 +14,12 @@ assert useQt4 -> withQt5 == false;

 with stdenv.lib;

-with (
-  {
-    "3.11" = {
-      minorVersion = "2";
-      sha256 = "0j2jpx94lnqx5w59i9xihl56hf6ghk04438rqhh7lk1bryxj5g2y";
-    };
-    "3.10" = {
-      minorVersion = "2";
-      sha256 = "80d0faad4ab56de07aa21a7fc692c88c4ce6156d42b0579c6962004a70a3218b";
-    };
-    "3.9" = {
-      minorVersion = "6";
-      sha256 = "7410851a783a41b521214ad987bb534a7e4a65e059651a2514e6ebfc8f46b218";
-    };
-
-  }.${majorVersion}
-    or (abort ''Unsupported configuration for cmake: majorVersion = "${majorVersion}";'')
-);
-
 let
  os = stdenv.lib.optionalString;
+  majorVersion = "3.12";
+  minorVersion = "1";
+  # from https://cmake.org/files/v3.12/cmake-3.12.1-SHA-256.txt
+  sha256 = "1ckswlaid3p2is1a80fmr4hgwpfsiif66giyx1z9ayhxx0n5qgf5";
  version = "${majorVersion}.${minorVersion}";
 in

@ -46,7 +30,6 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "${meta.homepage}files/v${majorVersion}/cmake-${version}.tar.gz";
-    # from https://cmake.org/files/v3.10/cmake-3.10.2-SHA-256.txt
    inherit sha256;
  };

@ -55,16 +38,16 @@ stdenv.mkDerivation rec {
      --replace '"-framework CoreServices"' '""'
  '';

-  # Don't search in non-Nix locations such as /usr, but do search in our libc.
-  patches = [ ./search-path-3.9.patch ]
-    ++ optional (versionOlder version "3.12") (fetchpatch {
-      name = "cmake-3.11-libuv-1.21.patch";
-      url = https://gitlab.kitware.com/cmake/cmake/commit/889033b5c6847cf1f7bd789384405d59dc333bf6.patch;
-      sha256 = "0683zbyb3bicaxqzrj4wgdan6x08k30m20kkmpjvw30nr6a8r6xq";
-    })
+  patches = [
+    # Don't search in non-Nix locations such as /usr, but do search in our libc.
+    ./search-path.patch
+
    # Don't depend on frameworks.
-    ++ optional (useSharedLibraries && majorVersion == "3.11") ./application-services.patch  # TODO: remove conditional
-    ++ optional stdenv.isCygwin ./3.2.2-cygwin.patch;
+    ./application-services.patch
+
+    # Derived from https://github.com/libuv/libuv/commit/1a5d4f08238dd532c3718e210078de1186a5920d
+    ./libuv-application-services.patch
+  ] ++ optional stdenv.isCygwin ./3.2.2-cygwin.patch;

  outputs = [ "out" ];
  setOutputFlags = false;
--- a/pkgs/development/tools/build-managers/cmake/libuv-application-services.patch
+++ b/pkgs/development/tools/build-managers/cmake/libuv-application-services.patch
@ -0,0 +1,83 @@
+diff -ur cmake-3.12.1/Utilities/cmlibuv/CMakeLists.txt cmake-3.12.1-patched/Utilities/cmlibuv/CMakeLists.txt
+--- cmake-3.12.1/Utilities/cmlibuv/CMakeLists.txt	2018-08-09 21:14:08.000000000 +0900
+++ cmake-3.12.1-patched/Utilities/cmlibuv/CMakeLists.txt	2018-08-13 10:14:53.000000000 +0900
+@@ -173,6 +173,22 @@
+     src/unix/kqueue.c
+     src/unix/proctitle.c
+     )
+
+  include(CheckIncludeFile)
+
+  check_include_file("ApplicationServices/ApplicationServices.h" HAVE_ApplicationServices)
+  if (HAVE_ApplicationServices)
+    list(APPEND uv_defines
+      HAVE_APPLICATIONSERVICES_APPLICATIONSERVICES_H=1
+      )
+  endif()
+
+  check_include_file("CoreServices/CoreServices.h" HAVE_CoreServices)
+  if (HAVE_CoreServices)
+    list(APPEND uv_defines
+      HAVE_CORESERVICES_CORESERVICES_H=1
+      )
+  endif()
+ endif()
+ 
+ if(CMAKE_SYSTEM_NAME STREQUAL "Linux")
+diff -ur cmake-3.12.1/Utilities/cmlibuv/src/unix/darwin-proctitle.c cmake-3.12.1-patched/Utilities/cmlibuv/src/unix/darwin-proctitle.c
+--- cmake-3.12.1/Utilities/cmlibuv/src/unix/darwin-proctitle.c	2018-08-09 21:14:08.000000000 +0900
+++ cmake-3.12.1-patched/Utilities/cmlibuv/src/unix/darwin-proctitle.c	2018-08-13 10:01:29.000000000 +0900
+@@ -26,9 +26,7 @@
+ #include <stdlib.h>
+ #include <string.h>
+ 
+-#include <TargetConditionals.h>
+-
+-#if !TARGET_OS_IPHONE
+#if HAVE_APPLICATIONSERVICES_APPLICATIONSERVICES_H
+ # include <CoreFoundation/CoreFoundation.h>
+ # include <ApplicationServices/ApplicationServices.h>
+ #endif
+@@ -58,7 +56,7 @@
+ 
+ 
+ int uv__set_process_title(const char* title) {
+-#if TARGET_OS_IPHONE
+#if !HAVE_APPLICATIONSERVICES_APPLICATIONSERVICES_H
+   return uv__pthread_setname_np(title);
+ #else
+   CFStringRef (*pCFStringCreateWithCString)(CFAllocatorRef,
+@@ -205,5 +203,5 @@
+     dlclose(application_services_handle);
+ 
+   return err;
+-#endif  /* !TARGET_OS_IPHONE */
+#endif  /* HAVE_APPLICATIONSERVICES_APPLICATIONSERVICES_H */
+ }
+diff -ur cmake-3.12.1/Utilities/cmlibuv/src/unix/fsevents.c cmake-3.12.1-patched/Utilities/cmlibuv/src/unix/fsevents.c
+--- cmake-3.12.1/Utilities/cmlibuv/src/unix/fsevents.c	2018-08-09 21:14:08.000000000 +0900
+++ cmake-3.12.1-patched/Utilities/cmlibuv/src/unix/fsevents.c	2018-08-13 10:01:29.000000000 +0900
+@@ -21,7 +21,7 @@
+ #include "uv.h"
+ #include "internal.h"
+ 
+-#if TARGET_OS_IPHONE
+#if !HAVE_CORESERVICES_CORESERVICES_H
+ 
+ /* iOS (currently) doesn't provide the FSEvents-API (nor CoreServices) */
+ 
+@@ -38,7 +38,7 @@
+ void uv__fsevents_loop_delete(uv_loop_t* loop) {
+ }
+ 
+-#else /* TARGET_OS_IPHONE */
+#else /* !HAVE_CORESERVICES_CORESERVICES_H */
+ 
+ #include <dlfcn.h>
+ #include <assert.h>
+@@ -916,4 +916,4 @@
+   return 0;
+ }
+ 
+-#endif /* TARGET_OS_IPHONE */
+#endif /* !HAVE_CORESERVICES_CORESERVICES_H */
--- a/pkgs/development/tools/build-managers/cmake/search-path-2.8.patch
+++ b/pkgs/development/tools/build-managers/cmake/search-path-2.8.patch
@ -0,0 +1,92 @@
+diff -ru3 cmake-2.8.12.2/Modules/Platform/Linux.cmake cmake-2.8.12.2-new/Modules/Platform/Linux.cmake
+--- cmake-2.8.12.2/Modules/Platform/Linux.cmake	2014-01-16 21:15:08.000000000 +0400
+++ cmake-2.8.12.2-new/Modules/Platform/Linux.cmake	2016-04-13 22:00:32.928575740 +0300
+@@ -36,22 +36,11 @@
+   # checking the platform every time.  This option is advanced enough
+   # that only package maintainers should need to adjust it.  They are
+   # capable of providing a setting on the command line.
+-  if(EXISTS "/etc/debian_version")
+-    set(CMAKE_INSTALL_SO_NO_EXE 1 CACHE INTERNAL
+-      "Install .so files without execute permission.")
+-  else()
+-    set(CMAKE_INSTALL_SO_NO_EXE 0 CACHE INTERNAL
+-      "Install .so files without execute permission.")
+-  endif()
+  set(CMAKE_INSTALL_SO_NO_EXE 0 CACHE INTERNAL
+    "Install .so files without execute permission.")
+ endif()
+ 
+ # Match multiarch library directory names.
+ set(CMAKE_LIBRARY_ARCHITECTURE_REGEX "[a-z0-9_]+(-[a-z0-9_]+)?-linux-gnu[a-z0-9_]*")
+ 
+ include(Platform/UnixPaths)
+-
+-# Debian has lib64 paths only for compatibility so they should not be
+-# searched.
+-if(EXISTS "/etc/debian_version")
+-  set_property(GLOBAL PROPERTY FIND_LIBRARY_USE_LIB64_PATHS FALSE)
+-endif()
+diff -ru3 cmake-2.8.12.2/Modules/Platform/UnixPaths.cmake cmake-2.8.12.2-new/Modules/Platform/UnixPaths.cmake
+--- cmake-2.8.12.2/Modules/Platform/UnixPaths.cmake	2014-01-16 21:15:08.000000000 +0400
+++ cmake-2.8.12.2-new/Modules/Platform/UnixPaths.cmake	2016-04-14 00:09:10.106362636 +0300
+@@ -32,9 +32,6 @@
+ # List common installation prefixes.  These will be used for all
+ # search types.
+ list(APPEND CMAKE_SYSTEM_PREFIX_PATH
+-  # Standard
+-  /usr/local /usr /
+-
+   # CMake install location
+   "${_CMAKE_INSTALL_DIR}"
+ 
+@@ -44,44 +41,26 @@
+ 
+ # List common include file locations not under the common prefixes.
+ list(APPEND CMAKE_SYSTEM_INCLUDE_PATH
+-  # Windows API on Cygwin
+-  /usr/include/w32api
+-
+-  # X11
+-  /usr/X11R6/include /usr/include/X11
+-
+-  # Other
+-  /usr/pkg/include
+-  /opt/csw/include /opt/include
+-  /usr/openwin/include
+  @libc_dev@/include
+   )
+ 
+ list(APPEND CMAKE_SYSTEM_LIBRARY_PATH
+-  # Windows API on Cygwin
+-  /usr/lib/w32api
+-
+-  # X11
+-  /usr/X11R6/lib /usr/lib/X11
+-
+-  # Other
+-  /usr/pkg/lib
+-  /opt/csw/lib /opt/lib
+-  /usr/openwin/lib
+  @libc_lib@/lib
+   )
+ 
+ list(APPEND CMAKE_SYSTEM_PROGRAM_PATH
+-  /usr/pkg/bin
+  @libc_bin@/bin
+   )
+ 
+ list(APPEND CMAKE_PLATFORM_IMPLICIT_LINK_DIRECTORIES
+-  /lib /usr/lib /usr/lib32 /usr/lib64
+  @libc_lib@/lib
+   )
+ 
+ list(APPEND CMAKE_C_IMPLICIT_INCLUDE_DIRECTORIES
+-  /usr/include
+  @libc_dev@/include
+   )
+ list(APPEND CMAKE_CXX_IMPLICIT_INCLUDE_DIRECTORIES
+-  /usr/include
+  @libc_dev@/include
+   )
+ 
+ # Enable use of lib64 search path variants by default.
--- a/pkgs/development/tools/build-managers/cmake/search-path-3.9.patch
+++ b/pkgs/development/tools/build-managers/cmake/search-path-3.9.patch
@ -1,62 +0,0 @@
-diff -ur cmake-3.9.1/Modules/Platform/UnixPaths.cmake cmake-3.9.1-mod/Modules/Platform/UnixPaths.cmake
--- cmake-3.9.1/Modules/Platform/UnixPaths.cmake	2017-08-10 13:36:32.000000000 +0000
-+++ cmake-3.9.1-mod/Modules/Platform/UnixPaths.cmake	2017-09-03 01:24:31.901473539 +0000
-@@ -22,9 +22,6 @@
- # List common installation prefixes.  These will be used for all
- # search types.
- list(APPEND CMAKE_SYSTEM_PREFIX_PATH
-  # Standard
-  /usr/local /usr /
-
-   # CMake install location
-   "${_CMAKE_INSTALL_DIR}"
-   )
-@@ -43,31 +40,26 @@
- 
- # Non "standard" but common install prefixes
- list(APPEND CMAKE_SYSTEM_PREFIX_PATH
-  /usr/X11R6
-  /usr/pkg
-  /opt
-   )
- 
- # List common include file locations not under the common prefixes.
- list(APPEND CMAKE_SYSTEM_INCLUDE_PATH
-  # X11
-  /usr/include/X11
-+  @libc_dev@/include
-   )
- 
- list(APPEND CMAKE_SYSTEM_LIBRARY_PATH
-  # X11
-  /usr/lib/X11
-+  @libc_lib@/lib
-   )
- 
- list(APPEND CMAKE_PLATFORM_IMPLICIT_LINK_DIRECTORIES
-  /lib /lib32 /lib64 /usr/lib /usr/lib32 /usr/lib64
-+  @libc_lib@/lib
-   )
- 
- list(APPEND CMAKE_C_IMPLICIT_INCLUDE_DIRECTORIES
-  /usr/include
-+  @libc_dev@/include
-   )
- list(APPEND CMAKE_CXX_IMPLICIT_INCLUDE_DIRECTORIES
-  /usr/include
-+  @libc_dev@/include
-   )
- 
- # Enable use of lib32 and lib64 search path variants by default.
-diff -ur cmake-3.9.1/Modules/Platform/WindowsPaths.cmake cmake-3.9.1-mod/Modules/Platform/WindowsPaths.cmake
--- cmake-3.9.1/Modules/Platform/WindowsPaths.cmake	2017-08-10 13:36:32.000000000 +0000
-+++ cmake-3.9.1-mod/Modules/Platform/WindowsPaths.cmake	2017-09-03 01:19:32.808355986 +0000
-@@ -66,7 +66,7 @@
- 
- if(CMAKE_CROSSCOMPILING AND NOT CMAKE_HOST_SYSTEM_NAME MATCHES "Windows")
-   # MinGW (useful when cross compiling from linux with CMAKE_FIND_ROOT_PATH set)
-  list(APPEND CMAKE_SYSTEM_PREFIX_PATH /)
-+  # list(APPEND CMAKE_SYSTEM_PREFIX_PATH /)
- endif()
- 
- list(APPEND CMAKE_SYSTEM_INCLUDE_PATH
--- a/pkgs/development/tools/build-managers/cmake/search-path.patch
+++ b/pkgs/development/tools/build-managers/cmake/search-path.patch
@ -1,35 +1,7 @@
-diff -ru3 cmake-2.8.12.2/Modules/Platform/Linux.cmake cmake-2.8.12.2-new/Modules/Platform/Linux.cmake
--- cmake-2.8.12.2/Modules/Platform/Linux.cmake	2014-01-16 21:15:08.000000000 +0400
-+++ cmake-2.8.12.2-new/Modules/Platform/Linux.cmake	2016-04-13 22:00:32.928575740 +0300
-@@ -36,22 +36,11 @@
-   # checking the platform every time.  This option is advanced enough
-   # that only package maintainers should need to adjust it.  They are
-   # capable of providing a setting on the command line.
-  if(EXISTS "/etc/debian_version")
-    set(CMAKE_INSTALL_SO_NO_EXE 1 CACHE INTERNAL
-      "Install .so files without execute permission.")
-  else()
-    set(CMAKE_INSTALL_SO_NO_EXE 0 CACHE INTERNAL
-      "Install .so files without execute permission.")
-  endif()
-+  set(CMAKE_INSTALL_SO_NO_EXE 0 CACHE INTERNAL
-+    "Install .so files without execute permission.")
- endif()
- 
- # Match multiarch library directory names.
- set(CMAKE_LIBRARY_ARCHITECTURE_REGEX "[a-z0-9_]+(-[a-z0-9_]+)?-linux-gnu[a-z0-9_]*")
- 
- include(Platform/UnixPaths)
-
-# Debian has lib64 paths only for compatibility so they should not be
-# searched.
-if(EXISTS "/etc/debian_version")
-  set_property(GLOBAL PROPERTY FIND_LIBRARY_USE_LIB64_PATHS FALSE)
-endif()
-diff -ru3 cmake-2.8.12.2/Modules/Platform/UnixPaths.cmake cmake-2.8.12.2-new/Modules/Platform/UnixPaths.cmake
--- cmake-2.8.12.2/Modules/Platform/UnixPaths.cmake	2014-01-16 21:15:08.000000000 +0400
-+++ cmake-2.8.12.2-new/Modules/Platform/UnixPaths.cmake	2016-04-14 00:09:10.106362636 +0300
-@@ -32,9 +32,6 @@
+diff -ur cmake-3.9.1/Modules/Platform/UnixPaths.cmake cmake-3.9.1-mod/Modules/Platform/UnixPaths.cmake
+--- cmake-3.9.1/Modules/Platform/UnixPaths.cmake	2017-08-10 13:36:32.000000000 +0000
+++ cmake-3.9.1-mod/Modules/Platform/UnixPaths.cmake	2017-09-03 01:24:31.901473539 +0000
+@@ -22,9 +22,6 @@
 # List common installation prefixes.  These will be used for all
 # search types.
 list(APPEND CMAKE_SYSTEM_PREFIX_PATH
@ -38,45 +10,31 @@ diff -ru3 cmake-2.8.12.2/Modules/Platform/UnixPaths.cmake cmake-2.8.12.2-new/Mod
 -
   # CMake install location
   "${_CMAKE_INSTALL_DIR}"
+   )
+@@ -43,31 +40,26 @@
 
-@@ -44,44 +41,26 @@
+ # Non "standard" but common install prefixes
+ list(APPEND CMAKE_SYSTEM_PREFIX_PATH
+-  /usr/X11R6
+-  /usr/pkg
+-  /opt
+   )
 
 # List common include file locations not under the common prefixes.
 list(APPEND CMAKE_SYSTEM_INCLUDE_PATH
-  # Windows API on Cygwin
-  /usr/include/w32api
-
 -  # X11
-  /usr/X11R6/include /usr/include/X11
-
-  # Other
-  /usr/pkg/include
-  /opt/csw/include /opt/include
-  /usr/openwin/include
+-  /usr/include/X11
 +  @libc_dev@/include
   )
 
 list(APPEND CMAKE_SYSTEM_LIBRARY_PATH
-  # Windows API on Cygwin
-  /usr/lib/w32api
-
 -  # X11
-  /usr/X11R6/lib /usr/lib/X11
-
-  # Other
-  /usr/pkg/lib
-  /opt/csw/lib /opt/lib
-  /usr/openwin/lib
+-  /usr/lib/X11
 +  @libc_lib@/lib
   )
 
- list(APPEND CMAKE_SYSTEM_PROGRAM_PATH
-  /usr/pkg/bin
-+  @libc_bin@/bin
-   )
- 
 list(APPEND CMAKE_PLATFORM_IMPLICIT_LINK_DIRECTORIES
-  /lib /usr/lib /usr/lib32 /usr/lib64
+-  /lib /lib32 /lib64 /usr/lib /usr/lib32 /usr/lib64
 +  @libc_lib@/lib
   )
 
@ -89,4 +47,16 @@ diff -ru3 cmake-2.8.12.2/Modules/Platform/UnixPaths.cmake cmake-2.8.12.2-new/Mod
 +  @libc_dev@/include
   )
 
- # Enable use of lib64 search path variants by default.
+ # Enable use of lib32 and lib64 search path variants by default.
+diff -ur cmake-3.9.1/Modules/Platform/WindowsPaths.cmake cmake-3.9.1-mod/Modules/Platform/WindowsPaths.cmake
+--- cmake-3.9.1/Modules/Platform/WindowsPaths.cmake	2017-08-10 13:36:32.000000000 +0000
+++ cmake-3.9.1-mod/Modules/Platform/WindowsPaths.cmake	2017-09-03 01:19:32.808355986 +0000
+@@ -66,7 +66,7 @@
+ 
+ if(CMAKE_CROSSCOMPILING AND NOT CMAKE_HOST_SYSTEM_NAME MATCHES "Windows")
+   # MinGW (useful when cross compiling from linux with CMAKE_FIND_ROOT_PATH set)
+-  list(APPEND CMAKE_SYSTEM_PREFIX_PATH /)
+  # list(APPEND CMAKE_SYSTEM_PREFIX_PATH /)
+ endif()
+ 
+ list(APPEND CMAKE_SYSTEM_INCLUDE_PATH
--- a/pkgs/os-specific/linux/iproute/default.nix
+++ b/pkgs/os-specific/linux/iproute/default.nix
@ -1,6 +1,4 @@
-{ fetchurl, stdenv, config, flex, bash, bison, db, iptables, pkgconfig
-, libelf
-}:
+{ fetchurl, stdenv, flex, bash, bison, db, iptables, pkgconfig, libelf }:

 stdenv.mkDerivation rec {
  name = "iproute2-${version}";
@ -28,9 +26,8 @@ stdenv.mkDerivation rec {
    "HDRDIR=$(TMPDIR)/include/iproute2" # Don't install headers
  ];

-  # enable iproute2 module if you want this folder to be created
  buildFlags = [
-    "CONFDIR=${config.iproute2.confDir or "/run/iproute2"}"
+    "CONFDIR=/etc/iproute2"
  ];

  installFlags = [
--- a/pkgs/os-specific/linux/procps-ng/default.nix
+++ b/pkgs/os-specific/linux/procps-ng/default.nix
@ -1,10 +1,16 @@
 { lib, stdenv, fetchurl, ncurses, pkgconfig

+# `ps` with systemd support is able to properly report different
+# attributes like unit name, so we want to have it on linux.
+, withSystemd ? stdenv.isLinux
+, systemd ? null
+
 # procps is mostly Linux-only. Most commands require a running Linux
 # system (or very similar like that found in Cygwin). The one
 # exception is ‘watch’ which is portable enough to run on pretty much
 # any UNIX-compatible system.
-, watchOnly ? !(stdenv.isLinux || stdenv.isCygwin) }:
+, watchOnly ? !(stdenv.isLinux || stdenv.isCygwin)
+}:

 stdenv.mkDerivation rec {
  name = "procps-${version}";
@ -16,7 +22,8 @@ stdenv.mkDerivation rec {
    sha256 = "0r84kwa5fl0sjdashcn4vh7hgfm7ahdcysig3mcjvpmkzi7p9g8h";
  };

-  buildInputs = [ ncurses ];
+  buildInputs = [ ncurses ]
+    ++ lib.optional withSystemd systemd;
  nativeBuildInputs = [ pkgconfig ];

  makeFlags = [ "usrbin_execdir=$(out)/bin" ]
@ -26,6 +33,7 @@ stdenv.mkDerivation rec {

  # Too red
  configureFlags = [ "--disable-modern-top" ]
+    ++ lib.optional withSystemd "--with-systemd"
    ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform)
    [ "ac_cv_func_malloc_0_nonnull=yes"
      "ac_cv_func_realloc_0_nonnull=yes" ];
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@ -26,8 +26,8 @@ in stdenv.mkDerivation rec {
  src = fetchFromGitHub {
    owner = "NixOS";
    repo = "systemd";
-    rev = "67c553805a9ebee2dce7c3a350b4abd4d7a489c2";
-    sha256 = "114vq71gcddi4qm2hyrj5jsas9599s0h5mg65jfpvxhfyaw54cpv";
+    rev = "21efe60844fda21039c052442076dabcf8643a90";
+    sha256 = "0aqifjsb0kaxnqy5nlmzvyzgfd99lm60k1494lbnnk8ahdh8ab07";
  };

  outputs = [ "out" "lib" "man" "dev" ];
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@ -190,7 +190,6 @@ in rec {
  stage1 = prevStage: let
    persistent = self: super: with prevStage; {
      cmake = super.cmake.override {
-        majorVersion = "3.9";  # FIXME: update ApplicationServices patch
        isBootstrap = true;
        useSharedLibraries = false;
      };
--- a/pkgs/tools/filesystems/e2fsprogs/default.nix
+++ b/pkgs/tools/filesystems/e2fsprogs/default.nix
@ -14,6 +14,10 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [ pkgconfig texinfo ];
  buildInputs = [ libuuid gettext ];

+  # Only use glibc's __GNUC_PREREQ(X,Y) (checks if compiler is gcc version >= X.Y) when using glibc
+  NIX_CFLAGS_COMPILE = stdenv.lib.optional (stdenv.hostPlatform.libc != "glibc")
+    "-D__GNUC_PREREQ(maj,min)=0";
+
  configureFlags =
    if stdenv.isLinux then [
      "--enable-elf-shlibs" "--enable-symlink-install" "--enable-relative-symlinks"
--- a/pkgs/tools/misc/coreutils/default.nix
+++ b/pkgs/tools/misc/coreutils/default.nix
@ -1,8 +1,11 @@
 { stdenv, lib, buildPackages
 , autoreconfHook, texinfo, fetchurl, perl, xz, libiconv, gmp ? null
-, aclSupport ? false, acl ? null
-, attrSupport ? false, attr ? null
+, aclSupport ? stdenv.isLinux, acl ? null
+, attrSupport ? stdenv.isLinux, attr ? null
 , selinuxSupport? false, libselinux ? null, libsepol ? null
+# No openssl in default version, so openssl-induced rebuilds aren't too big.
+# It makes *sum functions significantly faster.
+, minimal ? true, withOpenssl ? !minimal, openssl ? null
 , withPrefix ? false
 , singleBinary ? "symlinks" # you can also pass "shebangs" or false
 }:
@ -36,9 +39,10 @@ stdenv.mkDerivation rec {
  outputs = [ "out" "info" ];

  nativeBuildInputs = [ perl xz.bin ];
-  configureFlags =
-    optional (singleBinary != false)
+  configureFlags = [ "--with-packager=https://NixOS.org" ]
+    ++ optional (singleBinary != false)
      ("--enable-single-binary" + optionalString (isString singleBinary) "=${singleBinary}")
+    ++ optional withOpenssl "--with-openssl"
    ++ optional stdenv.hostPlatform.isSunOS "ac_cv_func_inotify_init=no"
    ++ optional withPrefix "--program-prefix=g"
    ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform && stdenv.hostPlatform.libc == "glibc") [
@ -51,6 +55,7 @@ stdenv.mkDerivation rec {
  buildInputs = [ gmp ]
    ++ optional aclSupport acl
    ++ optional attrSupport attr
+    ++ optional withOpenssl openssl
    ++ optionals stdenv.hostPlatform.isCygwin [ autoreconfHook texinfo ]   # due to patch
    ++ optionals selinuxSupport [ libselinux libsepol ]
       # TODO(@Ericson2314): Investigate whether Darwin could benefit too
@ -81,9 +86,13 @@ stdenv.mkDerivation rec {
    sed -i Makefile -e 's|^INSTALL =.*|INSTALL = ${buildPackages.coreutils}/bin/install -c|'
  '';

-  postInstall = optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
+  postInstall = optionalString (stdenv.hostPlatform != stdenv.buildPlatform && !minimal) ''
    rm $out/share/man/man1/*
    cp ${buildPackages.coreutils}/share/man/man1/* $out/share/man/man1
+  ''
+  # du: 8.7 M locale + 0.4 M man pages
+  + optionalString minimal ''
+    rm -r "$out/share"
  '';

  meta = {
--- a/pkgs/tools/misc/ethtool/default.nix
+++ b/pkgs/tools/misc/ethtool/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name = "ethtool-${version}";
-  version = "4.17";
+  version = "4.18";

  src = fetchurl {
    url = "mirror://kernel/software/network/ethtool/${name}.tar.xz";
-    sha256 = "11f5503mgcwjn1q4dvhjiqwnw3zmp2gbhirjvgfr71y72ys1wsy4";
+    sha256 = "0461nwqp1z9a89nmxf7kq0r4jfl9c7fg55c71lfmc5y0siaqb54h";
  };

  meta = with stdenv.lib; {
--- a/pkgs/tools/security/gnupg/22.nix
+++ b/pkgs/tools/security/gnupg/22.nix
@ -15,11 +15,11 @@ assert guiSupport -> pinentry != null;
 stdenv.mkDerivation rec {
  name = "gnupg-${version}";

-  version = "2.2.9";
+  version = "2.2.10";

  src = fetchurl {
    url = "mirror://gnupg/gnupg/${name}.tar.bz2";
-    sha256 = "0r11mx8nkh7ysrnshs560amha5csx8zcaggb5kxcksx1zymyly32";
+    sha256 = "05f9804g72pffdxgvxjmjzkfcpjg1x221g9rwcr8fi51hrxd77br";
  };

  nativeBuildInputs = [ pkgconfig ];
--- a/pkgs/tools/typesetting/biber/default.nix
+++ b/pkgs/tools/typesetting/biber/default.nix
@ -5,13 +5,13 @@

 perlPackages.buildPerlModule rec {
  name = "biber-${version}";
-  version = "2.10";
+  version = "2.11";

  src = fetchFromGitHub {
    owner = "plk";
    repo = "biber";
    rev = "v${version}";
-    sha256 = "0f6bb1iprl92iamxqlr8fc99mxr9n3722frd1ak9pbzh3m6c2ny6";
+    sha256 = "0qgkc1k9n36yfmndwz879pak6mjphld0p85lzn9g2ng0vhxsifzz";
  };

  buildInputs = with perlPackages; [
--- a/pkgs/tools/typesetting/tex/texlive/UPGRADING.md
+++ b/pkgs/tools/typesetting/tex/texlive/UPGRADING.md
@ -0,0 +1,68 @@
+# Notes on maintaining/upgrading
+
+## Upgrading texlive.bin
+
+texlive contains a few binaries, defined in bin.nix and released once a year.
+
+In order to reduce closure size for users who just need a few of them, we split it into
+packages such as core, core-big, xvdi, etc. This requires making assumptions
+about dependencies between the projects that may change between releases; if
+you upgrade you may have to do some work here.
+
+
+## Updating the package set
+
+texlive contains several thousand packages from CTAN, defined in pkgs.nix.
+
+The CTAN mirrors are not version-controlled and continuously moving,
+with more than 100 updates per month.
+
+To create a consistent and reproducible package set in nixpkgs, we snapshot CTAN
+and generate nix expressions for all packages in texlive at that point.
+
+We mirror CTAN sources of this snapshot on community-operated servers and on IPFS.
+
+To upgrade the package snapshot, follow this process:
+
+
+### Snapshot sources and texlive package database
+
+Mirror the current CTAN archive to our mirror(s) and IPFS (URLs in `default.nix`).
+See <https://tug.org/texlive/acquire-mirror.html> for instructions.
+
+
+### Upgrade package information from texlive package database
+
+
+```
+$ curl http://mirror.ctan.org/tex-archive/systems/texlive/tlnet/tlpkg/texlive.tlpdb.xz \
+           | xzcat | uniq -u | sed -rn -f ./tl2nix.sed > ./pkgs.nix
+```
+
+This will download a current snapshot of the CTAN package database `texlive.tlpdb.xz`
+and regenerate all of the sha512 hashes for the current upstream distribution in `pkgs.nix`.
+
+
+### Build packages locally and generate fix hashes
+
+To save disk space and prevent unnecessary rebuilds, texlive packages are built
+as fixed-output derivations whose hashes are contained in `fixedHashes.nix`.
+
+Updating the list of fixed hashes requires a local build of *all* packages,
+which is a resource-intensive process:
+
+
+```
+# move fixedHashes away, otherwise build will fail on updated packages
+$ mv fixedHashes.nix fixedHashes-old.nix
+# start with empty fixedHashes
+$ echo '{}' > fixedHashes.nix
+$ nix-build ../../../../.. -Q --no-out-link -A texlive.scheme-full.pkgs | ./fixHashes.sh > ./fixedHashes-new.nix
+# The script wrongly includes the nix store path to `biber`, which is a separate nixpkgs package
+$ grep -v -F '/nix/store/' fixedHashes-new.nix > fixedHashes.nix 
+```
+
+### Commit changes
+
+Commit the updated `pkgs.nix` and `fixedHashes.nix` to the repository.
+
--- a/pkgs/tools/typesetting/tex/texlive/bin.nix
+++ b/pkgs/tools/typesetting/tex/texlive/bin.nix
@ -14,25 +14,23 @@
 let
  withSystemLibs = map (libname: "--with-system-${libname}");

-  year = "2017";
+  year = "2018";
  version = year; # keep names simple for now

  common = rec {
    src = fetchurl {
-      url = # "ftp://tug.org/historic/systems/texlive/${year}/"
-      #"http://lipa.ms.mff.cuni.cz/~cunav5am/nix/texlive-2016"
-      # FIXME: a proper mirror, though tarballs.nixos.org saves this case ATM
-      # http://146.185.144.154/texlive-2016
-      # + "/texlive-${year}0523b-source.tar.xz";
-        "http://ftp.math.utah.edu/pub/tex/historic/systems/texlive/${year}/texlive-${year}0524-source.tar.xz";
-      sha256 = "1amjrxyasplv4alfwcxwnw4nrx7dz2ydmddkq16k6hg90i9njq81";
+      urls = [
+        "http://ftp.math.utah.edu/pub/tex/historic/systems/texlive/${year}/texlive-${year}0414-source.tar.xz"
+              "ftp://tug.ctan.org/pub/tex/historic/systems/texlive/${year}/texlive-${year}0414-source.tar.xz"
+      ];
+      sha256 = "0khyi6h015r2zfqgg0a44a2j7vmr1cy42knw7jbss237yvakc07y";
    };

    patches = [
      (fetchurl {
-        name = "texlive-poppler-0.59.patch";
-        url = https://git.archlinux.org/svntogit/packages.git/plain/trunk/texlive-poppler-0.59.patch?h=packages/texlive-bin&id=6308ec39bce2a4d735f6ff8a4e94473748d7b450;
-        sha256 = "1c4ikq4kxw48bi3i33bzpabrjvbk01fwjr2lz20gkc9kv8l0bg3n";
+        name = "texlive-poppler-0.64.patch";
+        url = https://git.archlinux.org/svntogit/packages.git/plain/trunk/texlive-poppler-0.64.patch?h=packages/texlive-bin;
+        sha256 = "0443d074zl3c5raba8jyhavish706arjcd80ibb84zwnwck4ai0w";
      })
    ];

@ -83,6 +81,8 @@ core = stdenv.mkDerivation rec {
    for i in texk/kpathsea/mktex*; do
      sed -i '/^mydir=/d' "$i"
    done
+    cp -pv texk/web2c/pdftexdir/pdftoepdf{-newpoppler.cc,.cc}
+    cp -pv texk/web2c/pdftexdir/pdftosrc{-newpoppler.cc,.cc}
  '';

  preConfigure = ''
@ -165,7 +165,7 @@ inherit (core-big) metafont metapost luatex xetex;
 core-big = stdenv.mkDerivation { #TODO: upmendex
  name = "texlive-core-big.bin-${version}";

-  inherit (common) src;
+  inherit (common) src patches;

  hardeningDisable = [ "format" ];

@ -176,20 +176,23 @@ core-big = stdenv.mkDerivation { #TODO: upmendex
    ++ withSystemLibs [ "kpathsea" "ptexenc" "cairo" "harfbuzz" "icu" "graphite2" ]
    ++ map (prog: "--disable-${prog}") # don't build things we already have
      [ "tex" "ptex" "eptex" "uptex" "euptex" "aleph" "pdftex"
-        "web-progs" "synctex" "luajittex" "mfluajit" # luajittex is mostly not needed, see:
+        "web-progs" "synctex"
+        # build fails on Darwin with luatex53
+        "luatex53" # TODO probably can be removed when TexLive 2019 is out
+        # luajittex is mostly not needed, see:
        # http://tex.stackexchange.com/questions/97999/when-to-use-luajittex-in-favour-of-luatex
+        "luajittex" "mfluajit"
      ];

-  patches = common.patches ++ [ ./luatex-gcc7.patch ];
-
  configureScript = ":";

  # we use static libtexlua, because it's only used by a single binary
  postConfigure = ''
    mkdir ./WorkDir && cd ./WorkDir
+    # TODO add lua53 here when luatex53 is enabled again
    for path in libs/{teckit,lua52} texk/web2c; do
      (
-        if [[ "$path" == "libs/lua52" ]]; then
+        if [[ "$path" =~ "libs/lua5" ]]; then
          extraConfig="--enable-static --disable-shared"
        else
          extraConfig=""
@ -202,7 +205,6 @@ core-big = stdenv.mkDerivation { #TODO: upmendex
  '';

  preBuild = "cd texk/web2c";
-  CXXFLAGS = "-std=c++11 -Wno-reserved-user-defined-literal"; # TODO: remove once texlive 2018 is out?
  enableParallelBuilding = true;

  doCheck = false; # fails
--- a/pkgs/tools/typesetting/tex/texlive/default.nix
+++ b/pkgs/tools/typesetting/tex/texlive/default.nix
@ -1,34 +1,11 @@
 /* TeX Live user docs
  - source: ../../../../../doc/languages-frameworks/texlive.xml
  - current html: http://nixos.org/nixpkgs/manual/#sec-language-texlive
-
-  Note on upgrading: The texlive package contains a few binaries, defined in
-  bin.nix and released once a year, and several thousand packages from CTAN,
-  defined in pkgs.nix.
-
-  The CTAN mirrors are continuously moving, with more than 100 updates per
-  month. Due to the size of the distribution, we snapshot it and generate nix
-  expressions for all packages in texlive at that point.
-
-  To upgrade this snapshot, run the following:
-  $ curl http://mirror.ctan.org/tex-archive/systems/texlive/tlnet/tlpkg/texlive.tlpdb.xz \
-             | xzcat | uniq -u | sed -rn -f ./tl2nix.sed > ./pkgs.nix
-
-  This will regenerate all of the sha512 hashes for the current upstream
-  distribution. You may want to find a more stable mirror, put the distribution
-  on IPFS, or contact a maintainer to get the tarballs from that point in time
-  into a more stable location, so that nix users who are building from source
-  can reproduce your work.
-
-  Upgrading the bin: texlive itself is a large collection of binaries. In order
-  to reduce closure size for users who just need a few of them, we split it into
-  packages such as core, core-big, xvdi, etc. This requires making assumptions
-  about dependencies between the projects that may change between releases; if
-  you upgrade you may have to do some work here.
 */
 { stdenv, lib, fetchurl, runCommand, writeText, buildEnv
 , callPackage, ghostscriptX, harfbuzz, poppler_min
 , makeWrapper, python, ruby, perl
+, useFixedHashes ? true
 , recurseIntoAttrs
 }:
 let
@ -41,6 +18,10 @@ let
    };
  };

+  # map: name -> fixed-output hash
+  # sha1 in base32 was chosen as a compromise between security and length
+  fixedHashes = lib.optionalAttrs useFixedHashes (import ./fixedHashes.nix);
+
  # function for creating a working environment from a set of TL packages
  combine = import ./combine.nix {
    inherit bin combinePkgs buildEnv fastUnique lib makeWrapper writeText
@ -116,23 +97,34 @@ let
      # the basename used by upstream (without ".tar.xz" suffix)
      urlName = pname + lib.optionalString (tlType != "run") ".${tlType}";
      tlName = urlName + "-${version}";
+      fixedHash = fixedHashes.${tlName} or null; # be graceful about missing hashes

      urls = args.urls or (if args ? url then [ args.url ] else
              map (up: "${up}/${urlName}.tar.xz") urlPrefixes
            );

-      # Upstream refuses to distribute stable tarballs, so we host snapshots on IPFS.
+      # Upstream refuses to distribute stable tarballs,
+      # so we host snapshots on IPFS or on our own servers.
      # Common packages should get served from the binary cache anyway.
      # See discussions, e.g. https://github.com/NixOS/nixpkgs/issues/24683
      urlPrefixes = args.urlPrefixes or [
-        # Should be stable for historic, archived releases
-        http://ftp.math.utah.edu/pub/tex/historic/systems/texlive/2017/tlnet-final/archive
+        # A snapshot temporarily hosted by @xeji.
+        # TODO: remove when there is a reliable long-term solution
+        https://cat3.de/texlive-2018/tlnet/archive

-        # TODO: Add IPFS and see if @veprbl is willing to add a texlive-2017-final mirror,
-        # or if we should just dump it and go to 2018.
+        # TODO: Add second, faster and more reliable snapshot mirror,
+        # maybe on one of our project's servers
+
+        # IPFS seeded by the mirror above - this may be quite slow
+        https://ipfs.io/ipfs/QmT4Z67wXin1Z9DhvqwSSkSZSuu8hT6LgDyMu6CBm9Tb7t/tlnet/archive

        # The canonical source moves quickly and will be broken almost immediately
-        # http://mirror.ctan.org/tex-archive/systems/texlive/tlnet/archive
+        http://mirror.ctan.org/tex-archive/systems/texlive/tlnet/archive
+
+        # Should be stable for historic, archived releases
+        # http://ftp.math.utah.edu/pub/tex/historic/systems/texlive/2018/tlnet-final/archive
+        # TODO: use this later when 2018 is archived
+
      ];

      src = fetchurl { inherit urls sha512; };
@ -146,11 +138,30 @@ let
          -C "$out" --anchored --exclude=tlpkg --keep-old-files
      '' + postUnpack;

-    in runCommand "texlive-${tlName}" {
-        # lots of derivations, not meant to be cached
-        preferLocalBuild = true; allowSubstitutes = false;
-        inherit passthru;
-      }
+    in if sha512 == "" then
+      # hash stripped from pkgs.nix to save space -> fetch&unpack in a single step
+      fetchurl {
+        inherit urls;
+        sha1 = if fixedHash == null then throw "TeX Live package ${tlName} is missing hash!"
+          else fixedHash;
+        name = tlName;
+        recursiveHash = true;
+        downloadToTemp = true;
+        postFetch = ''mkdir "$out";'' + unpackCmd "$downloadedFile";
+        # TODO: perhaps override preferHashedMirrors and allowSubstitutes
+     }
+        // passthru
+
+    else runCommand "texlive-${tlName}"
+      ( { # lots of derivations, not meant to be cached
+          preferLocalBuild = true; allowSubstitutes = false;
+          inherit passthru;
+        } // lib.optionalAttrs (fixedHash != null) {
+          outputHash = fixedHash;
+          outputHashAlgo = "sha1";
+          outputHashMode = "recursive";
+        }
+      )
      ( ''
          mkdir "$out"
        '' + unpackCmd "'${src}'"
--- a/pkgs/tools/typesetting/tex/texlive/fixHashes.sh
+++ b/pkgs/tools/typesetting/tex/texlive/fixHashes.sh
@ -0,0 +1,10 @@
+#!/bin/sh
+
+echo "{"
+grep -v -F '.bin-' | while read path; do
+    hash=`nix-hash --type sha1 --base32 "$path"`
+    echo -n "$path" | sed -E 's/[^-]*-texlive-(.*)/"\1"/'
+    echo "=\"$hash\";"
+done
+echo "}"
+
--- a/pkgs/tools/typesetting/tex/texlive/fixedHashes.nix
+++ b/pkgs/tools/typesetting/tex/texlive/fixedHashes.nix
--- a/pkgs/tools/typesetting/tex/texlive/luatex-gcc7.patch
+++ b/pkgs/tools/typesetting/tex/texlive/luatex-gcc7.patch
@ -1,30 +0,0 @@
-https://www.tug.org/pipermail/tex-live/2017-June/040192.html
---
- texk/web2c/luatexdir/luaffi/ctype.c |    4 ++++
- texk/web2c/luatexdir/luaffi/ffi.h   |    2 +-
- 2 files changed, 5 insertions(+), 1 deletion(-)
-
--- a/texk/web2c/luatexdir/luaffi/ctype.c
-+++ b/texk/web2c/luatexdir/luaffi/ctype.c       2017-05-31 13:08:25.421741873 +0000
-@@ -245,6 +245,10 @@ void* to_cdata(lua_State* L, int idx, st
- 
-     lua_pop(L, 1); /* mt */
-     cd = (struct cdata*) lua_touserdata(L, idx);
-+    if (!cd) {
-+        lua_pushnil(L);
-+        return NULL;
-+    }
-     *ct = cd->type;
-     lua_getuservalue(L, idx);
- 
--- a/texk/web2c/luatexdir/luaffi/ffi.h
-+++ b/texk/web2c/luatexdir/luaffi/ffi.h 2017-06-01 09:12:45.128442092 +0000
-@@ -370,7 +370,7 @@ __declspec(align(16))
- #endif
- struct cdata {
-     const struct ctype type
-#ifdef __GNUC__
-+#if 0 /* def __GNUC__ */
-       __attribute__ ((aligned(16)))
- #endif
-       ;
--- a/pkgs/tools/typesetting/tex/texlive/pkgs.nix
+++ b/pkgs/tools/typesetting/tex/texlive/pkgs.nix
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -1980,11 +1980,8 @@ with pkgs;

  cool-retro-term = libsForQt5.callPackage ../applications/misc/cool-retro-term { };

-  coreutils = callPackage ../tools/misc/coreutils {
-    aclSupport = stdenv.isLinux;
-    attrSupport = stdenv.isLinux;
-  };
-
+  coreutils = callPackage ../tools/misc/coreutils { };
+  coreutils-full = coreutils.override { minimal = false; };
  coreutils-prefixed = coreutils.override { withPrefix = true; singleBinary = false; };

  corkscrew = callPackage ../tools/networking/corkscrew { };
@ -11595,10 +11592,8 @@ with pkgs;
    introspectionSupport = true;
  });

-  poppler_min = poppler_0_61.override { # TODO: maybe reduce even more
+  poppler_min = poppler.override { # TODO: maybe reduce even more
    # this is currently only used by texlive.bin.
-    # pinned to 0.61 because texlive 2017 doesn't build w/poppler 0.64
-    # TODO: review poppler version for texlive 2018
    minimal = true;
    suffix = "min";
  };