From edb59ee7bdd0e419d35ea9202feba251692f821e Mon Sep 17 00:00:00 2001
From: Yegor Timoshenko <yegortimoshenko@gmail.com>
Date: Fri, 3 Nov 2017 12:07:45 +0000
Subject: [PATCH 01/39] chroot-user: rewrite in C, drop CHROOTENV_EXTRA_BINDS

Formatted via clang-format.
---
 .../build-fhs-userenv/chroot-user.rb          | 169 ----------------
 .../build-fhs-userenv/chrootenv.c             | 182 ++++++++++++++++++
 .../build-fhs-userenv/default.nix             |  23 +--
 3 files changed, 194 insertions(+), 180 deletions(-)
 delete mode 100755 pkgs/build-support/build-fhs-userenv/chroot-user.rb
 create mode 100644 pkgs/build-support/build-fhs-userenv/chrootenv.c

diff --git a/pkgs/build-support/build-fhs-userenv/chroot-user.rb b/pkgs/build-support/build-fhs-userenv/chroot-user.rb
deleted file mode 100755
index 833aab16ceb1..000000000000
--- a/pkgs/build-support/build-fhs-userenv/chroot-user.rb
+++ /dev/null
@@ -1,169 +0,0 @@
-#!/usr/bin/env ruby
-
-# Bind mounts hierarchy: from => to (relative)
-# If 'to' is nil, path will be the same
-mounts = { '/' => 'host',
-           '/proc' => nil,
-           '/sys' => nil,
-           '/nix' => nil,
-           '/tmp' => nil,
-           '/var' => nil,
-           '/run' => nil,
-           '/dev' => nil,
-           '/home' => nil,
-         }
-
-# Propagate environment variables
-envvars = [ 'TERM',
-            'DISPLAY',
-            'XAUTHORITY',
-            'HOME',
-            'XDG_RUNTIME_DIR',
-            'LANG',
-            'SSL_CERT_FILE',
-            'DBUS_SESSION_BUS_ADDRESS',
-          ]
-
-require 'tmpdir'
-require 'fileutils'
-require 'pathname'
-require 'set'
-require 'fiddle'
-
-def write_file(path, str)
-  File.open(path, 'w') { |file| file.write str }
-end
-
-# Import C standard library and several needed calls
-$libc = Fiddle.dlopen nil
-
-def make_fcall(name, args, output)
-  c = Fiddle::Function.new $libc[name], args, output
-  lambda do |*args|
-    ret = c.call *args
-    raise SystemCallError.new Fiddle.last_error if ret < 0
-    return ret
-  end
-end
-
-$fork = make_fcall 'fork', [], Fiddle::TYPE_INT
-
-CLONE_NEWNS   = 0x00020000
-CLONE_NEWUSER = 0x10000000
-$unshare = make_fcall 'unshare', [Fiddle::TYPE_INT], Fiddle::TYPE_INT
-
-MS_BIND = 0x1000
-MS_REC  = 0x4000
-MS_SLAVE  = 0x80000
-$mount = make_fcall 'mount', [Fiddle::TYPE_VOIDP,
-                              Fiddle::TYPE_VOIDP,
-                              Fiddle::TYPE_VOIDP,
-                              Fiddle::TYPE_LONG,
-                              Fiddle::TYPE_VOIDP],
-                    Fiddle::TYPE_INT
-
-# Read command line args
-abort "Usage: chrootenv program args..." unless ARGV.length >= 1
-execp = ARGV
-
-# Populate extra mounts
-if not ENV["CHROOTENV_EXTRA_BINDS"].nil?
-  $stderr.puts "CHROOTENV_EXTRA_BINDS is discussed for deprecation."
-  $stderr.puts "If you have a usecase, please drop a note in issue #16030."
-  $stderr.puts "Notice that we now bind-mount host FS to '/host' and symlink all directories from it to '/' by default."
-
-  for extra in ENV["CHROOTENV_EXTRA_BINDS"].split(':')
-    paths = extra.split('=')
-    if not paths.empty?
-      if paths.size <= 2
-        mounts[paths[0]] = paths[1]
-      else
-        $stderr.puts "Ignoring invalid entry in CHROOTENV_EXTRA_BINDS: #{extra}"
-      end
-    end
-  end
-end
-
-# Set destination paths for mounts
-mounts = mounts.map { |k, v| [k, v.nil? ? k.sub(/^\/*/, '') : v] }.to_h
-
-# Create temporary directory for root and chdir
-root = Dir.mktmpdir 'chrootenv'
-
-# Fork process; we need this to do a proper cleanup because
-# child process will chroot into temporary directory.
-# We use imported 'fork' instead of native to overcome
-# CRuby's meddling with threads; this should be safe because
-# we don't use threads at all.
-$cpid = $fork.call
-if $cpid == 0
-  # If we are root, no need to create new user namespace.
-  if Process.uid == 0
-    $unshare.call CLONE_NEWNS
-    # Mark all mounted filesystems as slave so changes
-    # don't propagate to the parent mount namespace.
-    $mount.call nil, '/', nil, MS_REC | MS_SLAVE, nil
-  else
-    # Save user UID and GID
-    uid = Process.uid
-    gid = Process.gid
-
-    # Create new mount and user namespaces
-    # CLONE_NEWUSER requires a program to be non-threaded, hence
-    # native fork above.
-    $unshare.call CLONE_NEWNS | CLONE_NEWUSER
-
-    # Map users and groups to the parent namespace
-    begin
-      # setgroups is only available since Linux 3.19
-      write_file '/proc/self/setgroups', 'deny'
-    rescue
-    end
-    write_file '/proc/self/uid_map', "#{uid} #{uid} 1"
-    write_file '/proc/self/gid_map', "#{gid} #{gid} 1"
-  end
-
-  # Do rbind mounts.
-  mounts.each do |from, rto|
-    to = "#{root}/#{rto}"
-    FileUtils.mkdir_p to
-    $mount.call from, to, nil, MS_BIND | MS_REC, nil
-  end
-
-  # Don't make root private so privilege drops inside chroot are possible
-  File.chmod(0755, root)
-  # Chroot!
-  Dir.chroot root
-  Dir.chdir '/'
-
-  # New environment
-  new_env = Hash[ envvars.map { |x| [x, ENV[x]] } ]
-
-  # Finally, exec!
-  exec(new_env, *execp, close_others: true, unsetenv_others: true)
-end
-
-# Wait for a child. If we catch a signal, resend it to child and continue
-# waiting.
-def wait_child
-  begin
-    Process.wait
-
-    # Return child's exit code
-    if $?.exited?
-      exit $?.exitstatus
-      else
-      exit 1
-    end
-  rescue SignalException => e
-    Process.kill e.signo, $cpid
-    wait_child
-  end
-end
-
-begin
-  wait_child
-ensure
-  # Cleanup
-  FileUtils.rm_rf root, secure: true
-end
diff --git a/pkgs/build-support/build-fhs-userenv/chrootenv.c b/pkgs/build-support/build-fhs-userenv/chrootenv.c
new file mode 100644
index 000000000000..edead5d3ab69
--- /dev/null
+++ b/pkgs/build-support/build-fhs-userenv/chrootenv.c
@@ -0,0 +1,182 @@
+#define _GNU_SOURCE
+
+#include <errno.h>
+#include <error.h>
+
+#define errorf(status, fmt, ...)                                               \
+  error_at_line(status, errno, __FILE__, __LINE__, fmt, ##__VA_ARGS__)
+
+#include <dirent.h>
+#include <ftw.h>
+#include <sched.h>
+#include <stdarg.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sysexits.h>
+#include <unistd.h>
+
+#include <sys/mount.h>
+#include <sys/stat.h>
+#include <sys/wait.h>
+
+char *env_whitelist[] = {"TERM",
+                         "DISPLAY",
+                         "XAUTHORITY",
+                         "HOME",
+                         "XDG_RUNTIME_DIR",
+                         "LANG",
+                         "SSL_CERT_FILE",
+                         "DBUS_SESSION_BUS_ADDRESS"};
+
+char **env_build(char *names[], size_t len) {
+  char *env, **ret = malloc((len + 1) * sizeof(char *)), **ptr = ret;
+
+  for (size_t i = 0; i < len; i++) {
+    if ((env = getenv(names[i]))) {
+      if (asprintf(ptr++, "%s=%s", names[i], env) < 0)
+        errorf(EX_OSERR, "asprintf");
+    }
+  }
+
+  *ptr = NULL;
+  return ret;
+}
+
+struct bind {
+  char *from;
+  char *to;
+};
+
+struct bind binds[] = {{"/", "host"},   {"/proc", "proc"}, {"/sys", "sys"},
+                       {"/nix", "nix"}, {"/tmp", "tmp"},   {"/var", "var"},
+                       {"/run", "run"}, {"/dev", "dev"},   {"/home", "home"}};
+
+void bind(struct bind *bind) {
+  DIR *src = opendir(bind->from);
+
+  if (src) {
+    if (closedir(src) < 0)
+      errorf(EX_IOERR, "closedir");
+
+    if (mkdir(bind->to, 0755) < 0)
+      errorf(EX_IOERR, "mkdir");
+
+    if (mount(bind->from, bind->to, "bind", MS_BIND | MS_REC, NULL) < 0)
+      errorf(EX_OSERR, "mount");
+
+  } else {
+    // https://github.com/NixOS/nixpkgs/issues/31104
+    if (errno != ENOENT)
+      errorf(EX_OSERR, "opendir");
+  }
+}
+
+void spitf(char *path, char *fmt, ...) {
+  va_list args;
+  va_start(args, fmt);
+
+  FILE *f = fopen(path, "w");
+
+  if (f == NULL)
+    errorf(EX_IOERR, "spitf(%s): fopen", path);
+
+  if (vfprintf(f, fmt, args) < 0)
+    errorf(EX_IOERR, "spitf(%s): vfprintf", path);
+
+  if (fclose(f) < 0)
+    errorf(EX_IOERR, "spitf(%s): fclose", path);
+}
+
+int nftw_rm(const char *path, const struct stat *sb, int type,
+            struct FTW *ftw) {
+  if (remove(path) < 0)
+    errorf(EX_IOERR, "nftw_rm");
+
+  return 0;
+}
+
+#define LEN(x) sizeof(x) / sizeof(*x)
+
+int main(int argc, char *argv[]) {
+  if (argc < 2) {
+    fprintf(stderr, "Usage: %s command [arguments...]\n"
+                    "Requires Linux kernel >= 3.19 with CONFIG_USER_NS.\n",
+            argv[0]);
+    exit(EX_USAGE);
+  }
+
+  char tmpl[] = "/tmp/chrootenvXXXXXX";
+  char *root = mkdtemp(tmpl);
+
+  if (root == NULL)
+    errorf(EX_IOERR, "mkdtemp");
+
+  // Don't make root private so that privilege drops inside chroot are possible:
+  if (chmod(root, 0755) < 0)
+    errorf(EX_IOERR, "chmod");
+
+  pid_t cpid = fork();
+
+  if (cpid < 0)
+    errorf(EX_OSERR, "fork");
+
+  if (cpid == 0) {
+    uid_t uid = getuid();
+    gid_t gid = getgid();
+
+    // If we are root, no need to create new user namespace.
+    if (uid == 0) {
+      if (unshare(CLONE_NEWNS) < 0)
+        errorf(EX_OSERR, "unshare");
+      // Mark all mounted filesystems as slave so changes
+      // don't propagate to the parent mount namespace.
+      if (mount(NULL, "/", NULL, MS_REC | MS_SLAVE, NULL) < 0)
+        errorf(EX_OSERR, "mount");
+    } else {
+      // Create new mount and user namespaces. CLONE_NEWUSER
+      // requires a program to be non-threaded.
+      if (unshare(CLONE_NEWNS | CLONE_NEWUSER) < 0)
+        errorf(EX_OSERR, "unshare");
+
+      // Map users and groups to the parent namespace.
+      // setgroups is only available since Linux 3.19:
+      spitf("/proc/self/setgroups", "deny");
+
+      spitf("/proc/self/uid_map", "%d %d 1", uid, uid);
+      spitf("/proc/self/gid_map", "%d %d 1", gid, gid);
+    }
+
+    if (chdir(root) < 0)
+      errorf(EX_IOERR, "chdir");
+
+    for (size_t i = 0; i < LEN(binds); i++)
+      bind(&binds[i]);
+
+    if (chroot(root) < 0)
+      errorf(EX_OSERR, "chroot");
+
+    if (chdir("/") < 0)
+      errorf(EX_OSERR, "chdir");
+
+    argv++;
+
+    if (execvpe(*argv, argv, env_build(env_whitelist, LEN(env_whitelist))) < 0)
+      errorf(EX_OSERR, "execvpe");
+  }
+
+  int status;
+
+  if (waitpid(cpid, &status, 0) < 0)
+    errorf(EX_OSERR, "waitpid");
+
+  if (nftw(root, nftw_rm, getdtablesize(), FTW_DEPTH | FTW_MOUNT | FTW_PHYS) < 0)
+    errorf(EX_IOERR, "nftw");
+
+  if (WIFEXITED(status))
+    return WEXITSTATUS(status);
+  else if (WIFSIGNALED(status))
+    kill(getpid(), WTERMSIG(status));
+
+  return EX_OSERR;
+}
diff --git a/pkgs/build-support/build-fhs-userenv/default.nix b/pkgs/build-support/build-fhs-userenv/default.nix
index d91cdffcf392..5f3ec4dc8eaf 100644
--- a/pkgs/build-support/build-fhs-userenv/default.nix
+++ b/pkgs/build-support/build-fhs-userenv/default.nix
@@ -2,16 +2,19 @@
 
 let buildFHSEnv = callPackage ./env.nix { }; in
 
-args@{ name, runScript ? "bash", extraBindMounts ? [], extraInstallCommands ? "", meta ? {}, passthru ? {}, ... }:
+args@{ name, runScript ? "bash", extraInstallCommands ? "", meta ? {}, passthru ? {}, ... }:
 
 let
-  env = buildFHSEnv (removeAttrs args [ "runScript" "extraBindMounts" "extraInstallCommands" "meta" "passthru" ]);
+  env = buildFHSEnv (removeAttrs args [ "runScript" "extraInstallCommands" "meta" "passthru" ]);
 
-  # Sandboxing script
-  chroot-user = writeScript "chroot-user" ''
-    #! ${ruby}/bin/ruby
-    ${builtins.readFile ./chroot-user.rb}
-  '';
+  chrootenv = stdenv.mkDerivation {
+    name = "chrootenv";
+
+    unpackPhase = "cp ${./chrootenv.c} chrootenv.c";
+    installPhase = "cp chrootenv $out";
+
+    makeFlags = [ "chrootenv" ];
+  };
 
   init = run: writeScript "${name}-init" ''
     #! ${stdenv.shell}
@@ -32,8 +35,7 @@ in runCommand name {
   passthru = passthru // {
     env = runCommand "${name}-shell-env" {
       shellHook = ''
-        ${lib.optionalString (extraBindMounts != []) ''export CHROOTENV_EXTRA_BINDS="${lib.concatStringsSep ":" extraBindMounts}:$CHROOTENV_EXTRA_BINDS"''}
-        exec ${chroot-user} ${init "bash"} "$(pwd)"
+        exec ${chrootenv} ${init "bash"} "$(pwd)"
       '';
     } ''
       echo >&2 ""
@@ -46,8 +48,7 @@ in runCommand name {
   mkdir -p $out/bin
   cat <<EOF >$out/bin/${name}
   #! ${stdenv.shell}
-  ${lib.optionalString (extraBindMounts != []) ''export CHROOTENV_EXTRA_BINDS="${lib.concatStringsSep ":" extraBindMounts}:$CHROOTENV_EXTRA_BINDS"''}
-  exec ${chroot-user} ${init runScript} "\$(pwd)" "\$@"
+  exec ${chrootenv} ${init runScript} "\$(pwd)" "\$@"
   EOF
   chmod +x $out/bin/${name}
   ${extraInstallCommands}

From 438fb59e6f98366bde12b3ff94e8f8326201dc26 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Sat, 9 Dec 2017 09:14:56 +0000
Subject: [PATCH 02/39] chroot-user: better error message, if unshare is not
 allowed

---
 pkgs/build-support/build-fhs-userenv/chrootenv.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/build-support/build-fhs-userenv/chrootenv.c b/pkgs/build-support/build-fhs-userenv/chrootenv.c
index edead5d3ab69..8d6c98959cc9 100644
--- a/pkgs/build-support/build-fhs-userenv/chrootenv.c
+++ b/pkgs/build-support/build-fhs-userenv/chrootenv.c
@@ -128,7 +128,7 @@ int main(int argc, char *argv[]) {
     // If we are root, no need to create new user namespace.
     if (uid == 0) {
       if (unshare(CLONE_NEWNS) < 0)
-        errorf(EX_OSERR, "unshare");
+        errorf(EX_OSERR, "unshare() failed: You may have an old kernel or have CLONE_NEWUSER disabled by your distribution security settings.");
       // Mark all mounted filesystems as slave so changes
       // don't propagate to the parent mount namespace.
       if (mount(NULL, "/", NULL, MS_REC | MS_SLAVE, NULL) < 0)

From 08dfb9567320a64a082408fc157e62a09ae2df14 Mon Sep 17 00:00:00 2001
From: Matthew Pickering <matthewtpickering@gmail.com>
Date: Fri, 8 Dec 2017 23:35:22 +0000
Subject: [PATCH 03/39] ber_metaocaml: (re)init at 104

---
 .../compilers/ocaml/ber-metaocaml-104.nix     | 84 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  2 +
 2 files changed, 86 insertions(+)
 create mode 100644 pkgs/development/compilers/ocaml/ber-metaocaml-104.nix

diff --git a/pkgs/development/compilers/ocaml/ber-metaocaml-104.nix b/pkgs/development/compilers/ocaml/ber-metaocaml-104.nix
new file mode 100644
index 000000000000..81c8cd534025
--- /dev/null
+++ b/pkgs/development/compilers/ocaml/ber-metaocaml-104.nix
@@ -0,0 +1,84 @@
+{ stdenv, fetchurl, ncurses, libX11, xproto, buildEnv }:
+
+let
+   useX11 = stdenv.isi686 || stdenv.isx86_64;
+   useNativeCompilers = stdenv.isi686 || stdenv.isx86_64 || stdenv.isMips;
+   inherit (stdenv.lib) optionals optionalString;
+in
+
+stdenv.mkDerivation rec {
+
+  name = "ber-metaocaml-${version}";
+  version = "104";
+
+  src = fetchurl {
+    url = "http://caml.inria.fr/pub/distrib/ocaml-4.04/ocaml-4.04.0.tar.gz";
+    sha256 = "1pi2hdm9lxhn45qvfqfss1hpa4jijm14qgmrgajsadxqdiplhqyb";
+  };
+
+  metaocaml = fetchurl {
+    url = "http://okmij.org/ftp/ML/ber-metaocaml-104.tar.gz";
+    sha256 = "1gmwlxairxqcmqa2r6kbf8b4dxc7pfhfbh48g1s14d3z20rj8nib";
+  };
+
+  # Needed to avoid a SIGBUS on the final executable on mips
+  NIX_CFLAGS_COMPILE = if stdenv.isMips then "-fPIC" else "";
+
+  x11env = buildEnv { name = "x11env"; paths = [libX11 xproto];};
+  x11lib = x11env + "/lib";
+  x11inc = x11env + "/include";
+
+  prefixKey = "-prefix ";
+  configureFlags = optionals useX11 [ "-x11lib" x11lib
+                                      "-x11include" x11inc ];
+
+  dontStrip = true;
+  buildInputs = [ncurses] ++ optionals useX11 [ libX11 xproto ];
+  installFlags = "-i";
+  installTargets = "install"; # + optionalString useNativeCompilers " installopt";
+
+  postConfigure = ''
+    tar -xvzf $metaocaml
+    cd ${name}
+    make patch
+    cd ..
+  '';
+  buildPhase = ''
+    make world
+    make -i install
+
+    make bootstrap
+    make opt.opt
+    make installopt
+    mkdir -p $out/include
+    ln -sv $out/lib/ocaml/caml $out/include/caml
+    cd ${name}
+    make all
+    make install
+    make install.opt
+    cd ..
+ '';
+  installPhase = "";
+  postBuild = ''
+  '';
+  checkPhase = ''
+    cd ${name}
+    make test
+    make test-compile
+    make test-native
+    cd ..
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = "http://okmij.org/ftp/ML/index.html#ber-metaocaml";
+    license = with licenses; [
+      qpl /* compiler */
+      lgpl2 /* library */
+    ];
+    description = "Conservative extension of OCaml";
+    longDescription = ''
+      A conservative extension of OCaml with the primitive type of code values,
+      and three basic multi-stage expression forms: Brackets, Escape, and Run
+    '';
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 301bcfd193d8..f0c4b6e7c571 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -6260,6 +6260,8 @@ with pkgs;
 
   ber_metaocaml_003 = callPackage ../development/compilers/ocaml/ber-metaocaml-003.nix { };
 
+  ber_metaocaml = callPackage ../development/compilers/ocaml/ber-metaocaml-104.nix { };
+
   ocaml_make = callPackage ../development/ocaml-modules/ocamlmake { };
 
   ocaml-top = callPackage ../development/tools/ocaml/ocaml-top { };

From 9a072a466cd7f4aaba91c1302a2c895425cb8491 Mon Sep 17 00:00:00 2001
From: Matthew Pickering <matthewtpickering@gmail.com>
Date: Fri, 8 Dec 2017 23:39:51 +0000
Subject: [PATCH 04/39] Remove broken ber-metaocaml-003 attribute

---
 .../compilers/ocaml/ber-metaocaml-003.nix     | 72 -------------------
 pkgs/top-level/all-packages.nix               |  2 -
 2 files changed, 74 deletions(-)
 delete mode 100644 pkgs/development/compilers/ocaml/ber-metaocaml-003.nix

diff --git a/pkgs/development/compilers/ocaml/ber-metaocaml-003.nix b/pkgs/development/compilers/ocaml/ber-metaocaml-003.nix
deleted file mode 100644
index c95d29326a4e..000000000000
--- a/pkgs/development/compilers/ocaml/ber-metaocaml-003.nix
+++ /dev/null
@@ -1,72 +0,0 @@
-{ stdenv, fetchurl, ncurses, xlibsWrapper }:
-
-let
-   useX11 = stdenv.isi686 || stdenv.isx86_64;
-   useNativeCompilers = stdenv.isi686 || stdenv.isx86_64 || stdenv.isMips;
-   inherit (stdenv.lib) optionals optionalString;
-in
-
-stdenv.mkDerivation rec {
-  
-  name = "ber-metaocaml-${version}";
-  version = "003";
-  
-  src = fetchurl {
-    url = "http://caml.inria.fr/pub/distrib/ocaml-3.11/ocaml-3.11.2.tar.bz2";
-    sha256 = "0hw1yp1mmfyn1pmda232d0ry69m7ln1z0fn5lgi8nz3y1mx3iww6";
-  };
-
-  metaocaml = fetchurl {
-    url = "http://okmij.org/ftp/ML/ber-metaocaml.tar.gz";
-    sha256 = "1kq1if25c1wvcdiy4g46xk05dkc1am2gc4qvmg4x19wvvaz09gzf";
-  };
-
-  # Needed to avoid a SIGBUS on the final executable on mips
-  NIX_CFLAGS_COMPILE = if stdenv.isMips then "-fPIC" else "";
-
-  patches = optionals stdenv.isDarwin [ ./gnused-on-osx-fix.patch ];
-
-  prefixKey = "-prefix ";
-  configureFlags = ["-no-tk"] ++ optionals useX11 [ "-x11lib" xlibsWrapper ];
-  buildFlags = "core coreboot all"; # "world" + optionalString useNativeCompilers " bootstrap world.opt";
-  buildInputs = [ncurses] ++ optionals useX11 [ xlibsWrapper ];
-  installFlags = "-i";
-  installTargets = "install"; # + optionalString useNativeCompilers " installopt";
-  prePatch = ''
-    CAT=$(type -tp cat)
-    sed -e "s@/bin/cat@$CAT@" -i config/auto-aux/sharpbang
-    patch -p0 < ${./mips64.patch}
-  '';
-  postConfigure = ''
-    tar -xvzf $metaocaml
-    cd ${name}
-    make patch
-    cd ..
-  '';
-  postBuild = ''
-    mkdir -p $out/include
-    ln -sv $out/lib/ocaml/caml $out/include/caml
-  '';
-  postInstall = ''
-    cd ${name}
-    make all
-    make install
-    make test
-    make test-compile
-    cd ..
-  '';
-
-  meta = with stdenv.lib; {
-    homepage = "http://okmij.org/ftp/ML/index.html#ber-metaocaml";
-    license = with licenses; [
-      qpl /* compiler */
-      lgpl2 /* library */
-    ];
-    description = "Conservative extension of OCaml";
-    longDescription = ''
-      A conservative extension of OCaml with the primitive type of code values,
-      and three basic multi-stage expression forms: Brackets, Escape, and Run
-    '';
-    broken = true;
-  };
-}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index f0c4b6e7c571..5c198eaa8f23 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -6258,8 +6258,6 @@ with pkgs;
 
   metaocaml_3_09 = callPackage ../development/compilers/ocaml/metaocaml-3.09.nix { };
 
-  ber_metaocaml_003 = callPackage ../development/compilers/ocaml/ber-metaocaml-003.nix { };
-
   ber_metaocaml = callPackage ../development/compilers/ocaml/ber-metaocaml-104.nix { };
 
   ocaml_make = callPackage ../development/ocaml-modules/ocamlmake { };

From 6e810a48ccacb2404e6e8ed23eac553f5e2882cb Mon Sep 17 00:00:00 2001
From: Kai Harries <kai.harries@gmail.com>
Date: Sat, 9 Dec 2017 18:46:38 +0100
Subject: [PATCH 05/39] gmailieer: 0.4 -> 0.5

---
 pkgs/applications/networking/gmailieer/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/gmailieer/default.nix b/pkgs/applications/networking/gmailieer/default.nix
index 26a05151d1cf..e56dbe0817e7 100644
--- a/pkgs/applications/networking/gmailieer/default.nix
+++ b/pkgs/applications/networking/gmailieer/default.nix
@@ -2,13 +2,13 @@
 
 python3Packages.buildPythonApplication rec {
   name = "gmailieer";
-  version = "0.4";
+  version = "0.5";
 
   src = fetchFromGitHub {
     owner = "gauteh";
     repo = "gmailieer";
     rev = "v${version}";
-    sha256 = "0vpc8nrh3cx91pcw45jjr2jllkqbx6w2khq7nyqv59gc4q5mz0p2";
+    sha256 = "152ky06k1wc3jffb48c6zh7c7pr732m9f4g1i316zaa4nx2ynfsa";
   };
 
   propagatedBuildInputs = with python3Packages; [

From 473c295dbb7b145a3e435fbfc92b995537879d79 Mon Sep 17 00:00:00 2001
From: Maximilian Bode <maximilian.bode@tngtech.com>
Date: Sat, 9 Dec 2017 20:10:05 +0100
Subject: [PATCH 06/39] kontemplate: init at 1.3.0

---
 .../cluster/kontemplate/default.nix           |  26 ++++
 .../networking/cluster/kontemplate/deps.nix   | 120 ++++++++++++++++++
 pkgs/top-level/all-packages.nix               |   2 +
 3 files changed, 148 insertions(+)
 create mode 100644 pkgs/applications/networking/cluster/kontemplate/default.nix
 create mode 100644 pkgs/applications/networking/cluster/kontemplate/deps.nix

diff --git a/pkgs/applications/networking/cluster/kontemplate/default.nix b/pkgs/applications/networking/cluster/kontemplate/default.nix
new file mode 100644
index 000000000000..aa5f86633318
--- /dev/null
+++ b/pkgs/applications/networking/cluster/kontemplate/default.nix
@@ -0,0 +1,26 @@
+{ stdenv, buildGoPackage, fetchFromGitHub }:
+
+buildGoPackage rec {
+  name = "kontemplate-${version}";
+  version = "1.3.0";
+
+  goPackagePath = "github.com/tazjin/kontemplate";
+
+  src = fetchFromGitHub {
+    rev = "v${version}";
+    owner = "tazjin";
+    repo = "kontemplate";
+    sha256 = "0g9hs9gwwkng9vbnv07ibhll0kggdprffpmhlbz9nmv81w2z3myi";
+  };
+
+  goDeps = ./deps.nix;
+
+  meta = with stdenv.lib; {
+    description = "Extremely simple Kubernetes resource templates";
+    homepage = http://kontemplate.works;
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ mbode ];
+    platforms = platforms.unix;
+    repositories.git = git://github.com/tazjin/kontemplate.git;
+  };
+}
diff --git a/pkgs/applications/networking/cluster/kontemplate/deps.nix b/pkgs/applications/networking/cluster/kontemplate/deps.nix
new file mode 100644
index 000000000000..1d6dfb3e64f5
--- /dev/null
+++ b/pkgs/applications/networking/cluster/kontemplate/deps.nix
@@ -0,0 +1,120 @@
+# This file was generated by https://github.com/kamilchm/go2nix v1.2.1
+[
+  {
+    goPackagePath = "github.com/Masterminds/semver";
+    fetch = {
+      type = "git";
+      url = "https://github.com/Masterminds/semver";
+      rev = "15d8430ab86497c5c0da827b748823945e1cf1e1";
+      sha256 = "0q5w6mjr1zws04z7x1ax1hp1zxdc4mbm9zsikgd6fv0c9ndnjr3q";
+    };
+  }
+  {
+    goPackagePath = "github.com/Masterminds/sprig";
+    fetch = {
+      type = "git";
+      url = "https://github.com/Masterminds/sprig";
+      rev = "b217b9c388de2cacde4354c536e520c52c055563";
+      sha256 = "1f41v3c8c7zagc4qjhcb6nwkvi8nzvf70f89a7ss2m6krkxz0m2a";
+    };
+  }
+  {
+    goPackagePath = "github.com/alecthomas/template";
+    fetch = {
+      type = "git";
+      url = "https://github.com/alecthomas/template";
+      rev = "a0175ee3bccc567396460bf5acd36800cb10c49c";
+      sha256 = "0qjgvvh26vk1cyfq9fadyhfgdj36f1iapbmr5xp6zqipldz8ffxj";
+    };
+  }
+  {
+    goPackagePath = "github.com/alecthomas/units";
+    fetch = {
+      type = "git";
+      url = "https://github.com/alecthomas/units";
+      rev = "2efee857e7cfd4f3d0138cc3cbb1b4966962b93a";
+      sha256 = "1j65b91qb9sbrml9cpabfrcf07wmgzzghrl7809hjjhrmbzri5bl";
+    };
+  }
+  {
+    goPackagePath = "github.com/aokoli/goutils";
+    fetch = {
+      type = "git";
+      url = "https://github.com/aokoli/goutils";
+      rev = "3391d3790d23d03408670993e957e8f408993c34";
+      sha256 = "1yj4yjfwylica31sgj69ygb04p9xxi22kgfxd0j5f58zr8vwww2n";
+    };
+  }
+  {
+    goPackagePath = "github.com/ghodss/yaml";
+    fetch = {
+      type = "git";
+      url = "https://github.com/ghodss/yaml";
+      rev = "0ca9ea5df5451ffdf184b4428c902747c2c11cd7";
+      sha256 = "0skwmimpy7hlh7pva2slpcplnm912rp3igs98xnqmn859kwa5v8g";
+    };
+  }
+  {
+    goPackagePath = "github.com/huandu/xstrings";
+    fetch = {
+      type = "git";
+      url = "https://github.com/huandu/xstrings";
+      rev = "37469d0c81a7910b49d64a0d308ded4823e90937";
+      sha256 = "18c2b4h7phdm71mn66x8bsmghjr1b2lpg07zcbgmab37y36bjl20";
+    };
+  }
+  {
+    goPackagePath = "github.com/imdario/mergo";
+    fetch = {
+      type = "git";
+      url = "https://github.com/imdario/mergo";
+      rev = "7fe0c75c13abdee74b09fcacef5ea1c6bba6a874";
+      sha256 = "1hclh5kpg25s2llpk7j7sm3vf66xci5jchn8wzdcr5fj372ghsbd";
+    };
+  }
+  {
+    goPackagePath = "github.com/polydawn/meep";
+    fetch = {
+      type = "git";
+      url = "https://github.com/polydawn/meep";
+      rev = "eaf1db2168fe380b4da17a35f0adddb5ae15a651";
+      sha256 = "12n134fb2imnj67xkbznzm0gqkg36hdxwr960y91qb5s2q2krxir";
+    };
+  }
+  {
+    goPackagePath = "github.com/satori/go.uuid";
+    fetch = {
+      type = "git";
+      url = "https://github.com/satori/go.uuid";
+      rev = "5bf94b69c6b68ee1b541973bb8e1144db23a194b";
+      sha256 = "0l782l4srv36pj8pfgn61996d0vjifld4a569rbjwq5h14pd0c07";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/crypto";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/crypto";
+      rev = "94eea52f7b742c7cbe0b03b22f0c4c8631ece122";
+      sha256 = "095zyvjb0m2pz382500miqadhk7w3nis8z3j941z8cq4rdafijvi";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/alecthomas/kingpin.v2";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/alecthomas/kingpin.v2";
+      rev = "1087e65c9441605df944fb12c33f0fe7072d18ca";
+      sha256 = "18llqzkdqf62qbqcv2fd3j0igl6cwwn4dissf5skkvxrcxjcmmj0";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/yaml.v2";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/yaml.v2";
+      rev = "287cf08546ab5e7e37d55a84f7ed3fd1db036de5";
+      sha256 = "15502klds9wwv567vclb9kx95gs8lnyzn4ybsk6l9fc7a67lk831";
+    };
+  }
+]
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index d49e014f8a74..4bce099733f5 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -19432,6 +19432,8 @@ with pkgs;
 
   kompose = callPackage ../applications/networking/cluster/kompose { };
 
+  kontemplate = callPackage ../applications/networking/cluster/kontemplate { };
+
   kops = callPackage ../applications/networking/cluster/kops { };
 
   lilypond = callPackage ../misc/lilypond { guile = guile_1_8; };

From 7e1c7fe79829167437fa1c5785730ab971636462 Mon Sep 17 00:00:00 2001
From: Kai Harries <kai.harries@gmail.com>
Date: Sat, 9 Dec 2017 19:29:42 +0100
Subject: [PATCH 07/39] gmime: 3.0.1 -> 3.0.5

---
 pkgs/development/libraries/gmime/3.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/gmime/3.nix b/pkgs/development/libraries/gmime/3.nix
index d6877e72a1f9..66d0cf88bd02 100644
--- a/pkgs/development/libraries/gmime/3.nix
+++ b/pkgs/development/libraries/gmime/3.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, pkgconfig, glib, zlib, gpgme, libidn, gobjectIntrospection }:
 
 stdenv.mkDerivation rec {
-  version = "3.0.1";
+  version = "3.0.5";
   name = "gmime-${version}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gmime/3.0/${name}.tar.xz";
-    sha256 = "001y93b8mq9alzkvli6vfh3pzdcn5c5iy206ml23lzhhhvm5k162";
+    sha256 = "1q45gd1ahnz9q1milc2lqqwl7j3q0wd6kiswhp25iak222n56lrg";
   };
 
   outputs = [ "out" "dev" ];

From 146355628be1ac3663b4aecffeaa3b7b23ff3d68 Mon Sep 17 00:00:00 2001
From: Tim Steinbach <tim@nequissimus.com>
Date: Sat, 9 Dec 2017 14:54:16 -0500
Subject: [PATCH 08/39] linux-copperhead: 4.14.3.a -> 4.14.4.a

---
 pkgs/os-specific/linux/kernel/linux-hardened-copperhead.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-hardened-copperhead.nix b/pkgs/os-specific/linux/kernel/linux-hardened-copperhead.nix
index 707ed10ea0c3..365f6ce54a07 100644
--- a/pkgs/os-specific/linux/kernel/linux-hardened-copperhead.nix
+++ b/pkgs/os-specific/linux/kernel/linux-hardened-copperhead.nix
@@ -3,9 +3,9 @@
 with stdenv.lib;
 
 let
-  version = "4.14.3";
+  version = "4.14.4";
   revision = "a";
-  sha256 = "18pcmi927gw4a0ih09fq1wv0jbzp1z42a8kga8ralcac828i6gi3";
+  sha256 = "1h99nhm3yd528gj0wg71lzi8v314r6r00m8zh2cw2sz82k7fds4w";
 
   # modVersion needs to be x.y.z, will automatically add .0 if needed
   modVersion = concatStrings (intersperse "." (take 3 (splitString "." "${version}.0")));

From 48b0e5ddbc3c5fd72e2d126dccb7491fa82fa838 Mon Sep 17 00:00:00 2001
From: Tim Steinbach <tim@nequissimus.com>
Date: Sat, 9 Dec 2017 14:57:59 -0500
Subject: [PATCH 09/39] linux: 4.4.104 -> 4.4.105

---
 pkgs/os-specific/linux/kernel/linux-4.4.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix
index e247392e6c70..04fc40638d78 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,11 +1,11 @@
 { stdenv, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "4.4.104";
+  version = "4.4.105";
   extraMeta.branch = "4.4";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0bhc4ay8ikvhqxj191mbm5kshh2zj46n5snwfa1d6bqzdkgg5s5h";
+    sha256 = "0h0ivdw74m3s2j9llh0hnigv790jgy6lhcf6jn2csxmvg3ai5sfn";
   };
 } // (args.argsOverride or {}))

From ef6e39fcedc6a51e380ff0aec599f4bcb849917a Mon Sep 17 00:00:00 2001
From: Benjamin Hipple <bhipple@protonmail.com>
Date: Sat, 9 Dec 2017 14:54:27 -0500
Subject: [PATCH 10/39] cryptop: 0.1 -> 0.2

Upgrade to new version. According to the upstream documentation, this project is
only tested on python3, so I've upgraded the pkg's interpreter as well.

Tested with nix-build and ./result/bin/cryptop
---
 pkgs/applications/altcoins/cryptop/default.nix | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/applications/altcoins/cryptop/default.nix b/pkgs/applications/altcoins/cryptop/default.nix
index 0136ab18ceac..05d5d8ee3625 100644
--- a/pkgs/applications/altcoins/cryptop/default.nix
+++ b/pkgs/applications/altcoins/cryptop/default.nix
@@ -1,16 +1,16 @@
-{ lib, python2}:
+{ lib, python3 }:
 
-python2.pkgs.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
   pname = "cryptop";
-  version = "0.1.0";
+  version = "0.2.0";
   name = "${pname}-${version}";
 
-  src = python2.pkgs.fetchPypi {
+  src = python3.pkgs.fetchPypi {
     inherit pname version;
-    sha256 = "00glnlyig1aajh30knc5rnfbamwfxpg29js2db6mymjmfka8lbhh";
+    sha256 = "0akrrz735vjfrm78plwyg84vabj0x3qficq9xxmy9kr40fhdkzpb";
   };
 
-  propagatedBuildInputs = [ python2.pkgs.requests ];
+  propagatedBuildInputs = [ python3.pkgs.requests python3.pkgs.requests-cache ];
 
   # No tests in archive
   doCheck = false;

From 3dfbf51a251adadd6343a699ae9d716e4bce6753 Mon Sep 17 00:00:00 2001
From: Shea Levy <shea.levy@target.com>
Date: Sat, 9 Dec 2017 15:00:43 -0500
Subject: [PATCH 11/39] Add gurobipy for python2.7 on darwin.

---
 .../python/cpython/2.7/default.nix            |  2 +-
 .../python-modules/gurobipy/darwin.nix        | 34 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  6 ++++
 3 files changed, 41 insertions(+), 1 deletion(-)
 create mode 100644 pkgs/development/python-modules/gurobipy/darwin.nix

diff --git a/pkgs/development/interpreters/python/cpython/2.7/default.nix b/pkgs/development/interpreters/python/cpython/2.7/default.nix
index b28df2501aac..9352bb4d52e0 100644
--- a/pkgs/development/interpreters/python/cpython/2.7/default.nix
+++ b/pkgs/development/interpreters/python/cpython/2.7/default.nix
@@ -201,7 +201,7 @@ in stdenv.mkDerivation {
     passthru = let
       pythonPackages = callPackage ../../../../../top-level/python-packages.nix {python=self; overrides=packageOverrides;};
     in rec {
-      inherit libPrefix sitePackages x11Support hasDistutilsCxxPatch;
+      inherit libPrefix sitePackages x11Support hasDistutilsCxxPatch ucsEncoding;
       executable = libPrefix;
       buildEnv = callPackage ../../wrapper.nix { python = self; inherit (pythonPackages) requiredPythonModules; };
       withPackages = import ../../with-packages.nix { inherit buildEnv pythonPackages;};
diff --git a/pkgs/development/python-modules/gurobipy/darwin.nix b/pkgs/development/python-modules/gurobipy/darwin.nix
new file mode 100644
index 000000000000..95a59bf44c7c
--- /dev/null
+++ b/pkgs/development/python-modules/gurobipy/darwin.nix
@@ -0,0 +1,34 @@
+{ stdenv, fetchurl, python, xar, cpio, cctools, insert_dylib }:
+assert python.isPy27 && python.ucsEncoding == 2;
+stdenv.mkDerivation
+  { name = "gurobipy-7.0.2";
+    src = fetchurl
+      { url = "http://packages.gurobi.com/7.0/gurobi7.0.2_mac64.pkg";
+        sha256 = "14dpxas6gx02kfb28i0fh68p1z4sbjmwg8hp8h5ch6c701h260mg";
+      };
+    buildInputs = [ xar cpio cctools insert_dylib ];
+    buildCommand =
+      ''
+        # Unpack
+        xar -xf $src
+        zcat gurobi*mac64tar.pkg/Payload | cpio -i
+        tar xf gurobi*_mac64.tar.gz
+
+        # Install
+        cd gurobi*/mac64
+        mkdir -p $out/lib/python2.7/site-packages
+        mv lib/python2.7/gurobipy $out/lib/python2.7/site-packages
+        mv lib/lib*.so $out/lib
+
+        # Fixup
+        install_name_tool -change \
+          /System/Library/Frameworks/Python.framework/Versions/2.7/Python \
+          ${python}/lib/libpython2.7.dylib \
+          $out/lib/python2.7/site-packages/gurobipy/gurobipy.so
+        install_name_tool -change libgurobi70.so \
+          $out/lib/libgurobi70.so \
+          $out/lib/python2.7/site-packages/gurobipy/gurobipy.so
+        insert_dylib --inplace $out/lib/libaes70.so \
+          $out/lib/python2.7/site-packages/gurobipy/gurobipy.so
+      '';
+  }
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index d677520468ce..490e8a581224 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5630,6 +5630,12 @@ in {
     };
   };
 
+  gurobipy = if stdenv.system == "x86_64-darwin"
+    then callPackage ../development/python-modules/gurobipy/darwin.nix
+           { inherit (pkgs.darwin) cctools insert_dylib;
+           }
+  else throw "gurobipy not yet supported on ${stdenv.system}";
+
   helper = buildPythonPackage rec {
     pname = "helper";
     version = "2.4.1";

From 094c9ac655e22483486a5a9f69b6f44d79007e1b Mon Sep 17 00:00:00 2001
From: Maximilian Bode <maximilian.bode@tngtech.com>
Date: Sat, 9 Dec 2017 21:02:00 +0100
Subject: [PATCH 12/39] kops: 1.7.1 -> 1.8.0

---
 pkgs/applications/networking/cluster/kops/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/cluster/kops/default.nix b/pkgs/applications/networking/cluster/kops/default.nix
index ff7cb245ae2a..41099192176c 100644
--- a/pkgs/applications/networking/cluster/kops/default.nix
+++ b/pkgs/applications/networking/cluster/kops/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   name = "kops-${version}";
-  version = "1.7.1";
+  version = "1.8.0";
 
   goPackagePath = "k8s.io/kops";
 
@@ -10,7 +10,7 @@ buildGoPackage rec {
     rev = version;
     owner = "kubernetes";
     repo = "kops";
-    sha256 = "0wii6w6hs9hjz3vvgqwa5ilwdi8a3qknmqsg3izazmgmnhl712wd";
+    sha256 = "0vaa18vhwk132fv7i896513isp66wnz9gn0b5613n3x28q0gvkmg";
   };
 
   buildInputs = [go-bindata];

From 377cd99e4b26bad4e38bd03e7da60920b60a50a0 Mon Sep 17 00:00:00 2001
From: Maximilian Bode <maximilian.bode@tngtech.com>
Date: Sat, 9 Dec 2017 21:08:41 +0100
Subject: [PATCH 13/39] gradle: 4.3.1 -> 4.4

---
 pkgs/development/tools/build-managers/gradle/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/build-managers/gradle/default.nix b/pkgs/development/tools/build-managers/gradle/default.nix
index 8568b218f37e..77f2e561317b 100644
--- a/pkgs/development/tools/build-managers/gradle/default.nix
+++ b/pkgs/development/tools/build-managers/gradle/default.nix
@@ -52,12 +52,12 @@ rec {
   };
 
   gradle_latest = gradleGen rec {
-    name = "gradle-4.3.1";
+    name = "gradle-4.4";
     nativeVersion = "0.14";
 
     src = fetchurl {
       url = "http://services.gradle.org/distributions/${name}-bin.zip";
-      sha256 = "1irsv5c4g0c8iln5hiikjr78rj1w2hjgyar5dp8a54h3rscf1sqm";
+      sha256 = "0bqaksrxrshqjwba0wj72gbcxvcchjavlj39xh18qpkz5jp76j7s";
     };
   };
 

From 286eadc1475d9f30177222e215c12d1463b73d6e Mon Sep 17 00:00:00 2001
From: Shea Levy <shea@shealevy.com>
Date: Sat, 9 Dec 2017 15:28:39 -0500
Subject: [PATCH 14/39] Add gurobipy for python2.7 on Linux

---
 .../python-modules/gurobipy/linux.nix         | 35 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 ++
 2 files changed, 37 insertions(+)
 create mode 100644 pkgs/development/python-modules/gurobipy/linux.nix

diff --git a/pkgs/development/python-modules/gurobipy/linux.nix b/pkgs/development/python-modules/gurobipy/linux.nix
new file mode 100644
index 000000000000..fa4d58c77b76
--- /dev/null
+++ b/pkgs/development/python-modules/gurobipy/linux.nix
@@ -0,0 +1,35 @@
+{ stdenv, fetchurl, python }:
+assert python.isPy27;
+let utf = if python.ucsEncoding == 2
+            then "16"
+          else if python.ucsEncoding == 4
+            then "32"
+          else throw "Unsupported python UCS encoding UCS${toString python.ucsEncoding}";
+in
+stdenv.mkDerivation
+  { name = "gurobipy-7.0.2";
+    src = fetchurl
+      { url = "http://packages.gurobi.com/7.0/gurobi7.0.2_linux64.tar.gz";
+        sha256 = "1lgdj4cncjvnnw8dppiax7q2j8121pxyg9iryj8v26mrk778dnmn";
+      };
+    buildCommand =
+      ''
+        # Unpack
+        tar xf $src
+
+        # Install
+        cd gurobi*/linux64
+        mkdir -p $out/lib/python2.7/site-packages
+        mv lib/python2.7_utf${utf}/gurobipy \
+          $out/lib/python2.7/site-packages
+        mv lib/python2.7_utf${utf}/gurobipy.so \
+          $out/lib/python2.7/site-packages/gurobipy
+        mv lib/libaes*.so* lib/libgurobi*.so* $out/lib
+
+        # Fixup
+        patchelf --set-rpath $out/lib \
+          $out/lib/python2.7/site-packages/gurobipy/gurobipy.so
+        patchelf --add-needed libaes70.so \
+          $out/lib/python2.7/site-packages/gurobipy/gurobipy.so
+      '';
+  }
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 490e8a581224..d99a7168a11d 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5634,6 +5634,8 @@ in {
     then callPackage ../development/python-modules/gurobipy/darwin.nix
            { inherit (pkgs.darwin) cctools insert_dylib;
            }
+  else if stdenv.system == "x86_64-linux"
+    then callPackage ../development/python-modules/gurobipy/linux.nix {}
   else throw "gurobipy not yet supported on ${stdenv.system}";
 
   helper = buildPythonPackage rec {

From db7bee240ec974ea83fdefddfa34fd64c93559d4 Mon Sep 17 00:00:00 2001
From: Will Dietz <w@wdtz.org>
Date: Sat, 9 Dec 2017 14:36:48 -0600
Subject: [PATCH 15/39] stdenv: fix use of config-specified
 allowInsecurePredicate

for some reason we were checking allowUnfreePredicate instead
---
 pkgs/stdenv/generic/check-meta.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/stdenv/generic/check-meta.nix b/pkgs/stdenv/generic/check-meta.nix
index 03a85633ed61..b9d77d980a12 100644
--- a/pkgs/stdenv/generic/check-meta.nix
+++ b/pkgs/stdenv/generic/check-meta.nix
@@ -64,7 +64,7 @@ let
     !allowUnfreePredicate attrs;
 
   allowInsecureDefaultPredicate = x: builtins.elem x.name (config.permittedInsecurePackages or []);
-  allowInsecurePredicate = x: (config.allowUnfreePredicate or allowInsecureDefaultPredicate) x;
+  allowInsecurePredicate = x: (config.allowInsecurePredicate or allowInsecureDefaultPredicate) x;
 
   hasAllowedInsecure = attrs:
     (attrs.meta.knownVulnerabilities or []) == [] ||

From d1e3e83d6759ffc9a894756fafe9fa08f63f5101 Mon Sep 17 00:00:00 2001
From: Orivej Desh <orivej@gmx.fr>
Date: Sat, 9 Dec 2017 20:53:04 +0000
Subject: [PATCH 16/39] cryptop: alias to altcoins.cryptop

---
 pkgs/applications/altcoins/cryptop/default.nix | 9 ++++-----
 pkgs/applications/altcoins/default.nix         | 4 +++-
 pkgs/top-level/all-packages.nix                | 3 +--
 3 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/pkgs/applications/altcoins/cryptop/default.nix b/pkgs/applications/altcoins/cryptop/default.nix
index 05d5d8ee3625..01c47b320de5 100644
--- a/pkgs/applications/altcoins/cryptop/default.nix
+++ b/pkgs/applications/altcoins/cryptop/default.nix
@@ -1,16 +1,15 @@
-{ lib, python3 }:
+{ lib, buildPythonApplication, fetchPypi, requests, requests-cache }:
 
-python3.pkgs.buildPythonApplication rec {
+buildPythonApplication rec {
   pname = "cryptop";
   version = "0.2.0";
-  name = "${pname}-${version}";
 
-  src = python3.pkgs.fetchPypi {
+  src = fetchPypi {
     inherit pname version;
     sha256 = "0akrrz735vjfrm78plwyg84vabj0x3qficq9xxmy9kr40fhdkzpb";
   };
 
-  propagatedBuildInputs = [ python3.pkgs.requests python3.pkgs.requests-cache ];
+  propagatedBuildInputs = [ requests requests-cache ];
 
   # No tests in archive
   doCheck = false;
diff --git a/pkgs/applications/altcoins/default.nix b/pkgs/applications/altcoins/default.nix
index aeab29534691..0e5ffab01f44 100644
--- a/pkgs/applications/altcoins/default.nix
+++ b/pkgs/applications/altcoins/default.nix
@@ -1,4 +1,4 @@
-{ callPackage, boost155, boost162, openssl_1_1_0, haskellPackages, darwin, libsForQt5, miniupnpc_2 }:
+{ callPackage, boost155, boost162, openssl_1_1_0, haskellPackages, darwin, libsForQt5, miniupnpc_2, python3 }:
 
 rec {
 
@@ -20,6 +20,8 @@ rec {
   btc1 = callPackage ./btc1.nix { withGui = true; };
   btc1d = callPackage ./btc1.nix { withGui = false; };
 
+  cryptop = python3.pkgs.callPackage ./cryptop { };
+
   dashpay = callPackage ./dashpay.nix { };
 
   dogecoin  = callPackage ./dogecoin.nix { withGui = true; };
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2d5a4ec25127..82027769b7de 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -13910,8 +13910,7 @@ with pkgs;
   altcoins = recurseIntoAttrs ( callPackage ../applications/altcoins { } );
   bitcoin = altcoins.bitcoin;
   bitcoin-xt = altcoins.bitcoin-xt;
-
-  cryptop = callPackage ../applications/altcoins/cryptop { };
+  cryptop = altcoins.cryptop;
 
   libbitcoin = callPackage ../tools/misc/libbitcoin/libbitcoin.nix {
     secp256k1 = secp256k1.override { enableECDH = true; };

From 241f3bb6731e5b8583ae4a6667f83685aa89fea5 Mon Sep 17 00:00:00 2001
From: Andreas Rammhold <andreas@rammhold.de>
Date: Sat, 9 Dec 2017 22:01:24 +0100
Subject: [PATCH 17/39] rawtherapee-git: remove `-git` version

As discussed in #32337 the `-git` version is outdated since a while and
doesn't compile with modern compilers anymore.

closes #32337
---
 .../applications/graphics/rawtherapee/dev.nix | 37 -------------------
 pkgs/top-level/all-packages.nix               |  5 ---
 2 files changed, 42 deletions(-)
 delete mode 100644 pkgs/applications/graphics/rawtherapee/dev.nix

diff --git a/pkgs/applications/graphics/rawtherapee/dev.nix b/pkgs/applications/graphics/rawtherapee/dev.nix
deleted file mode 100644
index fb73feb4a099..000000000000
--- a/pkgs/applications/graphics/rawtherapee/dev.nix
+++ /dev/null
@@ -1,37 +0,0 @@
-{ stdenv, fetchFromGitHub, pkgconfig, cmake, pixman, libpthreadstubs, gtkmm2, libXau
-, libXdmcp, lcms2, libiptcdata, libcanberra_gtk2, fftw, expat, pcre, libsigcxx
-}:
-
-stdenv.mkDerivation rec {
-  name = "rawtherapee-git-2016-10-10";
-
-  src = fetchFromGitHub {
-    owner = "Beep6581";
-    repo = "RawTherapee";
-    rev = "0821eea7b6a4ac2fce1fcf644e06078e161e41e3";
-    sha256 = "1nwb6b1qrpdyigwig7bvr42lf7na1ngm0q2cislcvb2v1nmk6nlz";
-  };
-
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ cmake pixman libpthreadstubs gtkmm2 libXau libXdmcp
-    lcms2 libiptcdata libcanberra_gtk2 fftw expat pcre libsigcxx ];
-
-  NIX_CFLAGS_COMPILE = "-std=gnu++11 -Wno-deprecated-declarations -Wno-unused-result";
-
-  # Copy generated ReleaseInfo.cmake so we don't need git. File was
-  # generated manually using `./tools/generateReleaseInfo` in the
-  # source folder. Make sure to regenerate it when updating.
-  preConfigure = ''
-    cp ${./ReleaseInfo.cmake} ./ReleaseInfo.cmake
-  '';
-
-  enableParallelBuilding = true;
-
-  meta = {
-    description = "RAW converter and digital photo processing software";
-    homepage = http://www.rawtherapee.com/;
-    license = stdenv.lib.licenses.gpl3Plus;
-    maintainers = with stdenv.lib.maintainers; [ viric jcumming mahe the-kenny ];
-    platforms = with stdenv.lib.platforms; linux;
-  };
-}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2d5a4ec25127..1691d6e51048 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -16517,11 +16517,6 @@ with pkgs;
     cmake = cmake_2_8; # problems after 3.4 -> 3.6.0
   };
 
-  rawtherapee-git = lowPrio (callPackage ../applications/graphics/rawtherapee/dev.nix {
-    fftw = fftwSinglePrec;
-    cmake = cmake_2_8; # problems after 3.4 -> 3.6.0
-  });
-
   rclone = callPackage ../applications/networking/sync/rclone { };
 
   rcs = callPackage ../applications/version-management/rcs { };

From 5c814534778052061c6168c3b19a23bf2498759a Mon Sep 17 00:00:00 2001
From: Will Dietz <w@wdtz.org>
Date: Sat, 9 Dec 2017 15:46:13 -0600
Subject: [PATCH 18/39] tetex: patch off-by-one to fix segfault

Fixes #32264.

Patch based on one from Fedora texlive-2007-66 source rpm.

References:
https://bugzilla.redhat.com/show_bug.cgi?id=754517
http://tug.org/pipermail/tex-k/2011-July/002317.html
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=633011
https://www.mail-archive.com/tetex@dbs.uni-hannover.de/msg00968.html

Redhat discussion suggests this happens when using -Wl,-z,relro
(or other linker flags) that change the default memory layout.
---
 pkgs/tools/typesetting/tex/tetex/default.nix       |  2 +-
 pkgs/tools/typesetting/tex/tetex/extramembot.patch | 12 ++++++++++++
 2 files changed, 13 insertions(+), 1 deletion(-)
 create mode 100644 pkgs/tools/typesetting/tex/tetex/extramembot.patch

diff --git a/pkgs/tools/typesetting/tex/tetex/default.nix b/pkgs/tools/typesetting/tex/tetex/default.nix
index 313474745d10..ac317fd51dcb 100644
--- a/pkgs/tools/typesetting/tex/tetex/default.nix
+++ b/pkgs/tools/typesetting/tex/tetex/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation {
     find ./ -name "config.guess" -exec rm {} \; -exec ln -s ${automake}/share/automake-*/config.guess {} \;
   '' else null;
 
-  patches = [ ./environment.patch ./getline.patch ./clang.patch ];
+  patches = [ ./environment.patch ./getline.patch ./clang.patch ./extramembot.patch ];
 
   setupHook = ./setup-hook.sh;
 
diff --git a/pkgs/tools/typesetting/tex/tetex/extramembot.patch b/pkgs/tools/typesetting/tex/tetex/extramembot.patch
new file mode 100644
index 000000000000..f6c954fcfa5c
--- /dev/null
+++ b/pkgs/tools/typesetting/tex/tetex/extramembot.patch
@@ -0,0 +1,12 @@
+diff -up texlive-2007/texk/web2c/tex.ch.extramembot texlive-2007/texk/web2c/tex.ch
+--- texlive-2007/texk/web2c/tex.ch.extramembot	2006-12-19 02:11:11.000000000 +0100
++++ texlive-2007/texk/web2c/tex.ch	2011-11-30 12:03:32.052795763 +0100
+@@ -365,7 +365,7 @@ for i:=@'177 to @'377 do xchr[i]:=i;
+ {Initialize enc\TeX\ data.}
+ for i:=0 to 255 do mubyte_read[i]:=null;
+ for i:=0 to 255 do mubyte_write[i]:=0;
+-for i:=0 to 128 do mubyte_cswrite[i]:=null;
++for i:=0 to 127 do mubyte_cswrite[i]:=null;
+ mubyte_keep := 0; mubyte_start := false; 
+ write_noexpanding := false; cs_converting := false;
+ special_printing := false; message_printing := false;

From b687ffa0d246b913699b8e2b2f0e1ffb370ada17 Mon Sep 17 00:00:00 2001
From: Orivej Desh <orivej@gmx.fr>
Date: Sat, 9 Dec 2017 22:41:18 +0000
Subject: [PATCH 19/39] gurobipy: fix eval

---
 .../development/python-modules/gurobipy/darwin.nix |  2 +-
 pkgs/development/python-modules/gurobipy/linux.nix | 14 ++++++--------
 pkgs/top-level/python-packages.nix                 |  8 ++++----
 3 files changed, 11 insertions(+), 13 deletions(-)

diff --git a/pkgs/development/python-modules/gurobipy/darwin.nix b/pkgs/development/python-modules/gurobipy/darwin.nix
index 95a59bf44c7c..9d7374bd5bd4 100644
--- a/pkgs/development/python-modules/gurobipy/darwin.nix
+++ b/pkgs/development/python-modules/gurobipy/darwin.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, python, xar, cpio, cctools, insert_dylib }:
-assert python.isPy27 && python.ucsEncoding == 2;
+assert python.pkgs.isPy27 && python.ucsEncoding == 2;
 stdenv.mkDerivation
   { name = "gurobipy-7.0.2";
     src = fetchurl
diff --git a/pkgs/development/python-modules/gurobipy/linux.nix b/pkgs/development/python-modules/gurobipy/linux.nix
index fa4d58c77b76..f65ae4a2ed2e 100644
--- a/pkgs/development/python-modules/gurobipy/linux.nix
+++ b/pkgs/development/python-modules/gurobipy/linux.nix
@@ -1,12 +1,10 @@
 { stdenv, fetchurl, python }:
-assert python.isPy27;
-let utf = if python.ucsEncoding == 2
-            then "16"
-          else if python.ucsEncoding == 4
-            then "32"
-          else throw "Unsupported python UCS encoding UCS${toString python.ucsEncoding}";
-in
-stdenv.mkDerivation
+assert python.pkgs.isPy27;
+let utf =
+  if python.ucsEncoding == 2 then "16"
+  else if python.ucsEncoding == 4 then "32"
+  else throw "Unsupported python UCS encoding UCS${toString python.ucsEncoding}";
+in stdenv.mkDerivation
   { name = "gurobipy-7.0.2";
     src = fetchurl
       { url = "http://packages.gurobi.com/7.0/gurobi7.0.2_linux64.tar.gz";
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index d99a7168a11d..075b33cd087e 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5631,11 +5631,11 @@ in {
   };
 
   gurobipy = if stdenv.system == "x86_64-darwin"
-    then callPackage ../development/python-modules/gurobipy/darwin.nix
-           { inherit (pkgs.darwin) cctools insert_dylib;
-           }
+  then callPackage ../development/python-modules/gurobipy/darwin.nix {
+    inherit (pkgs.darwin) cctools insert_dylib;
+  }
   else if stdenv.system == "x86_64-linux"
-    then callPackage ../development/python-modules/gurobipy/linux.nix {}
+  then callPackage ../development/python-modules/gurobipy/linux.nix {}
   else throw "gurobipy not yet supported on ${stdenv.system}";
 
   helper = buildPythonPackage rec {

From 104de603cba1b499984ec268bb782c7147e91d7a Mon Sep 17 00:00:00 2001
From: Andreas Rammhold <andreas@rammhold.de>
Date: Fri, 1 Dec 2017 14:58:06 +0100
Subject: [PATCH 20/39] networkmanager: remove restart after suspend from
 resume
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In commit ec9dc73 restarting NetworkManager after resume from
suspend/hibernate was introduced.

When I initially switch to NixOS I started noticing a high delay between
wakeup and re-connecting to WiFi & wired networks. The delay increased
from a few seconds (on my previous distro, same software stack) to
almost half a minute with NixOS.

I (locally) applied the change in this commit a few weeks ago and tested
since then. The notebook/mobile device experience has improved a lot.
Reconnects are as before switching to NixOS.

Issue #24401 could be related to this. Since I am not using KDE/plasma5
I can only guess…
---
 nixos/modules/services/networking/networkmanager.nix | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/nixos/modules/services/networking/networkmanager.nix b/nixos/modules/services/networking/networkmanager.nix
index 6bdae32f72bb..d9ac4b0f274e 100644
--- a/nixos/modules/services/networking/networkmanager.nix
+++ b/nixos/modules/services/networking/networkmanager.nix
@@ -333,10 +333,6 @@ in {
       wireless.enable = lib.mkDefault false;
     };
 
-    powerManagement.resumeCommands = ''
-      ${config.systemd.package}/bin/systemctl restart network-manager
-    '';
-
     security.polkit.extraConfig = polkitConf;
 
     services.dbus.packages = cfg.packages;

From eae2aa7eaec9d197aefd61b4bf35bdc334b5104c Mon Sep 17 00:00:00 2001
From: Joachim Fasting <joachifm@fastmail.fm>
Date: Sat, 9 Dec 2017 23:48:48 +0100
Subject: [PATCH 21/39] tor-browser-bundle-bin: 7.0.10 -> 7.0.11

---
 .../networking/browsers/tor-browser-bundle-bin/default.nix  | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
index 1b6bf2ac3002..8f22045578d7 100644
--- a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
+++ b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
@@ -98,7 +98,7 @@ let
   fteLibPath = makeLibraryPath [ stdenv.cc.cc gmp ];
 
   # Upstream source
-  version = "7.0.10";
+  version = "7.0.11";
 
   lang = "en-US";
 
@@ -108,7 +108,7 @@ let
         "https://github.com/TheTorProject/gettorbrowser/releases/download/v${version}/tor-browser-linux64-${version}_${lang}.tar.xz"
         "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz"
       ];
-      sha256 = "0d1yvb1gmswlzyivr53xxfbd58bvr7nyangd85j36kar4bzbzvhh";
+      sha256 = "0i42jxdka0sq8fp6lj64n0az6m4g72il9qhdn63p0h7y4204i2v4";
     };
 
     "i686-linux" = fetchurl {
@@ -116,7 +116,7 @@ let
         "https://github.com/TheTorProject/gettorbrowser/releases/download/v${version}/tor-browser-linux32-${version}_${lang}.tar.xz"
         "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux32-${version}_${lang}.tar.xz"
       ];
-      sha256 = "0mjw8z76pbm1hshz875shkmjmxqhpan5la52r3y20v6rc0gfd9p5";
+      sha256 = "1p9s6wqghpkml662vnp5194i8gb9bkqxdr96fmw0fh305cyk25k0";
     };
   };
 in

From 5ae883b8c3b04e0c4a9c92a5ab3c7c84b9942943 Mon Sep 17 00:00:00 2001
From: Austin Seipp <aseipp@pobox.com>
Date: Sat, 9 Dec 2017 19:40:07 -0600
Subject: [PATCH 22/39] nixpkgs: remove sqlite/kyotocabinet deps for leveldb

These are only needed for some benchmarking utilities but they aren't
going to be generally useful to most people, I imagine.

Signed-off-by: Austin Seipp <aseipp@pobox.com>
---
 pkgs/development/libraries/leveldb/default.nix | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/libraries/leveldb/default.nix b/pkgs/development/libraries/leveldb/default.nix
index 2a109e0366fd..3ff2ca0b0ee4 100644
--- a/pkgs/development/libraries/leveldb/default.nix
+++ b/pkgs/development/libraries/leveldb/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, sqlite, kyotocabinet }:
+{ stdenv, fetchFromGitHub }:
 
 stdenv.mkDerivation rec {
   name = "leveldb-${version}";
@@ -11,19 +11,20 @@ stdenv.mkDerivation rec {
     sha256 = "1bnsii47vbyqnbah42qgq6pbmmcg4k3fynjnw7whqfv6lpdgmb8d";
   };
 
-  buildInputs = [ sqlite kyotocabinet ];
-
   buildPhase = ''
-    make all db_bench{,_sqlite3,_tree_db} leveldbutil libmemenv.a
+    make all leveldbutil libmemenv.a
   '';
 
   installPhase = "
     mkdir -p $out/{bin,lib,include}
+
     cp -r include $out
-    cp lib* $out/lib
-    cp db_bench{,_sqlite3,_tree_db} leveldbutil $out/bin
     mkdir -p $out/include/leveldb/helpers
     cp helpers/memenv/memenv.h $out/include/leveldb/helpers
+
+    cp lib* $out/lib
+
+    cp leveldbutil $out/bin
   ";
 
   meta = with stdenv.lib; {

From b56d92a53b7af943566474ec30fb2a22f228e8c2 Mon Sep 17 00:00:00 2001
From: rnhmjoj <rnhmjoj@inventati.org>
Date: Sun, 10 Dec 2017 03:15:45 +0100
Subject: [PATCH 23/39] pythonPackages: rename dns -> dnspython

---
 pkgs/development/python-modules/FormEncode/default.nix   | 4 ++--
 pkgs/development/python-modules/dkimpy/default.nix       | 4 ++--
 .../python-modules/{dns => dnspython}/default.nix        | 0
 .../python-modules/email-validator/default.nix           | 4 ++--
 pkgs/top-level/python-packages.nix                       | 9 +++++----
 5 files changed, 11 insertions(+), 10 deletions(-)
 rename pkgs/development/python-modules/{dns => dnspython}/default.nix (100%)

diff --git a/pkgs/development/python-modules/FormEncode/default.nix b/pkgs/development/python-modules/FormEncode/default.nix
index 2f72f7c16a7a..cd9d8ee46d8a 100644
--- a/pkgs/development/python-modules/FormEncode/default.nix
+++ b/pkgs/development/python-modules/FormEncode/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildPythonPackage, fetchPypi, dns, pycountry, nose }:
+{ stdenv, buildPythonPackage, fetchPypi, dnspython, pycountry, nose }:
 
 buildPythonPackage rec {
   pname = "FormEncode";
@@ -10,7 +10,7 @@ buildPythonPackage rec {
     sha256 = "1xm77h2mds2prlaz0z4nzkx13g61rx5c2v3vpgjq9d5ij8bzb8md";
   };
 
-  buildInputs = [ dns pycountry nose ];
+  buildInputs = [ dnspython pycountry nose ];
 
   patchPhase = ''
     # dnspython3 has been superseded, see its PyPI page
diff --git a/pkgs/development/python-modules/dkimpy/default.nix b/pkgs/development/python-modules/dkimpy/default.nix
index 91d5a17960d8..177e697aab9f 100644
--- a/pkgs/development/python-modules/dkimpy/default.nix
+++ b/pkgs/development/python-modules/dkimpy/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, openssl, makeWrapper, buildPythonApplication
-, pytest, dns }:
+, pytest, dnspython }:
 
 buildPythonApplication rec {
   name = "${pname}-${version}";
@@ -14,7 +14,7 @@ buildPythonApplication rec {
   };
 
   buildInputs = [ pytest ];
-  propagatedBuildInputs =  [ openssl dns ];
+  propagatedBuildInputs =  [ openssl dnspython ];
 
   patchPhase = ''
     substituteInPlace dknewkey.py --replace \
diff --git a/pkgs/development/python-modules/dns/default.nix b/pkgs/development/python-modules/dnspython/default.nix
similarity index 100%
rename from pkgs/development/python-modules/dns/default.nix
rename to pkgs/development/python-modules/dnspython/default.nix
diff --git a/pkgs/development/python-modules/email-validator/default.nix b/pkgs/development/python-modules/email-validator/default.nix
index 4fc78d8bd1e1..cf03a02129d4 100644
--- a/pkgs/development/python-modules/email-validator/default.nix
+++ b/pkgs/development/python-modules/email-validator/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, buildPythonPackage, fetchPypi, isPy3k, dns, idna, ipaddress }:
+{ stdenv, lib, buildPythonPackage, fetchPypi, isPy3k, dnspython, idna, ipaddress }:
 
 buildPythonPackage rec {
   pname = "email_validator";
@@ -13,7 +13,7 @@ buildPythonPackage rec {
   doCheck = false;
 
   propagatedBuildInputs = [
-    dns
+    dnspython
     idna
   ] ++ (if isPy3k then [ ] else [ ipaddress ]);
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 52fab78be89c..ce35f99d8d25 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4545,7 +4545,8 @@ in {
 
   discogs_client = callPackage ../development/python-modules/discogs_client { };
 
-  dns = callPackage ../development/python-modules/dns { };
+  dnspython = callPackage ../development/python-modules/dnspython { };
+  dns = self.dnspython; # Alias for compatibility, 2017-12-10
 
   docker = callPackage ../development/python-modules/docker {};
 
@@ -11851,7 +11852,7 @@ in {
     name = "sleekxmpp-${version}";
     version = "1.3.1";
 
-    propagatedBuildInputs = with self ; [ dns pyasn1 ];
+    propagatedBuildInputs = with self ; [ dnspython pyasn1 ];
 
     src = pkgs.fetchurl {
       url = "mirror://pypi/s/sleekxmpp/${name}.tar.gz";
@@ -16712,7 +16713,7 @@ in {
 
     buildInputs = with self; [ nose mock pyopenssl ];
 
-    propagatedBuildInputs = with self; [ urllib3 dns];
+    propagatedBuildInputs = with self; [ urllib3 dnspython ];
 
     postPatch = ''
       sed -i '19s/dns/"dnspython"/' setup.py
@@ -18582,7 +18583,7 @@ in {
 
     nativeBuildInputs = [ pkgs.pkgconfig ];
     buildInputs = with pkgs; [ alsaLib ffmpeg libv4l sqlite libvpx ];
-    propagatedBuildInputs = with self; [ cython pkgs.openssl dns dateutil xcaplib msrplib lxml python-otr ];
+    propagatedBuildInputs = with self; [ cython pkgs.openssl dnspython dateutil xcaplib msrplib lxml python-otr ];
   };
 
 

From fc930e055a11b88b9c9ab1d2c26dcda5ff5fc93f Mon Sep 17 00:00:00 2001
From: Orivej Desh <orivej@gmx.fr>
Date: Sun, 10 Dec 2017 08:43:26 +0000
Subject: [PATCH 24/39] rawtherapee: delete unused files

---
 .../graphics/rawtherapee/ReleaseInfo.cmake    |  4 ----
 .../graphics/rawtherapee/default.nix          |  4 ++--
 .../rawtherapee/fix-glibmm-output.patch       | 23 -------------------
 pkgs/top-level/all-packages.nix               |  1 -
 4 files changed, 2 insertions(+), 30 deletions(-)
 delete mode 100644 pkgs/applications/graphics/rawtherapee/ReleaseInfo.cmake
 delete mode 100644 pkgs/applications/graphics/rawtherapee/fix-glibmm-output.patch

diff --git a/pkgs/applications/graphics/rawtherapee/ReleaseInfo.cmake b/pkgs/applications/graphics/rawtherapee/ReleaseInfo.cmake
deleted file mode 100644
index 7be7cb63f701..000000000000
--- a/pkgs/applications/graphics/rawtherapee/ReleaseInfo.cmake
+++ /dev/null
@@ -1,4 +0,0 @@
-set(GIT_BRANCH master)
-set(GIT_VERSION 4.2.1115)
-set(GIT_CHANGESET 0821eea7b6a4ac2fce1fcf644e06078e161e41e3)
-set(GIT_TAGDISTANCE 1115)
diff --git a/pkgs/applications/graphics/rawtherapee/default.nix b/pkgs/applications/graphics/rawtherapee/default.nix
index 91a34a505f2f..5743f0c1bcb6 100644
--- a/pkgs/applications/graphics/rawtherapee/default.nix
+++ b/pkgs/applications/graphics/rawtherapee/default.nix
@@ -14,10 +14,10 @@ stdenv.mkDerivation rec {
     sha256 = "1r6sx9zl1wkykgfx6k26268xadair6hzl15v5hmiri9sdhrn33q7";
   };
 
-  nativeBuildInputs = [ pkgconfig wrapGAppsHook ];
+  nativeBuildInputs = [ cmake pkgconfig wrapGAppsHook ];
 
   buildInputs = [
-    cmake pixman libpthreadstubs gtkmm3 libXau libXdmcp
+    pixman libpthreadstubs gtkmm3 libXau libXdmcp
     lcms2 libiptcdata libcanberra_gtk3 fftw expat pcre libsigcxx lensfun
   ];
 
diff --git a/pkgs/applications/graphics/rawtherapee/fix-glibmm-output.patch b/pkgs/applications/graphics/rawtherapee/fix-glibmm-output.patch
deleted file mode 100644
index 3c87ce64e26b..000000000000
--- a/pkgs/applications/graphics/rawtherapee/fix-glibmm-output.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-From ca0afa8d5f3cc7d09b6bab32d155a87c550f0d7b Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Fl=C3=B6ssie?= <floessie.mail@gmail.com>
-Date: Sat, 1 Oct 2016 12:38:24 +0200
-Subject: [PATCH] Fix incompatibility with glibmm 2.50 (#3440)
-
-Kudos to @Hombre57 for the suggestion.
----
- rtgui/dirbrowser.cc | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/rtgui/dirbrowser.cc b/rtgui/dirbrowser.cc
-index d3fc8bf..6f25f0f 100644
---- a/rtgui/dirbrowser.cc
-+++ b/rtgui/dirbrowser.cc
-@@ -59,7 +59,7 @@ std::vector<Glib::ustring> listSubDirs (const Glib::RefPtr<Gio::File>& dir, bool
-     } catch (const Glib::Exception& exception) {
- 
-         if (options.rtSettings.verbose) {
--            std::cerr << "Failed to list subdirectories of \"" << dir << "\": " << exception.what () << std::endl;
-+            std::cerr << "Failed to list subdirectories of \"" << dir->get_basename() << "\": " << exception.what () << std::endl;
-         }
- 
-     }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 35d24fb185b9..3b731a8e8513 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -16513,7 +16513,6 @@ with pkgs;
 
   rawtherapee = callPackage ../applications/graphics/rawtherapee {
     fftw = fftwSinglePrec;
-    cmake = cmake_2_8; # problems after 3.4 -> 3.6.0
   };
 
   rclone = callPackage ../applications/networking/sync/rclone { };

From b6bf8db29fbb34f9eb582325fb33f854baa7e857 Mon Sep 17 00:00:00 2001
From: Orivej Desh <orivej@gmx.fr>
Date: Sun, 10 Dec 2017 09:07:04 +0000
Subject: [PATCH 25/39] Revert "gmime: 3.0.1 -> 3.0.5"

It breaks notmuch 0.25.2 tests, and updating notmuch to 0.25.3 does not fix them.
---
 pkgs/development/libraries/gmime/3.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/gmime/3.nix b/pkgs/development/libraries/gmime/3.nix
index 66d0cf88bd02..d6877e72a1f9 100644
--- a/pkgs/development/libraries/gmime/3.nix
+++ b/pkgs/development/libraries/gmime/3.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, pkgconfig, glib, zlib, gpgme, libidn, gobjectIntrospection }:
 
 stdenv.mkDerivation rec {
-  version = "3.0.5";
+  version = "3.0.1";
   name = "gmime-${version}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gmime/3.0/${name}.tar.xz";
-    sha256 = "1q45gd1ahnz9q1milc2lqqwl7j3q0wd6kiswhp25iak222n56lrg";
+    sha256 = "001y93b8mq9alzkvli6vfh3pzdcn5c5iy206ml23lzhhhvm5k162";
   };
 
   outputs = [ "out" "dev" ];

From 9988224c2a1632ae9ee9ab0ba19b79e014d4f681 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tor=20Hedin=20Br=C3=B8nner?= <torhedinbronner@gmail.com>
Date: Sun, 10 Dec 2017 09:54:00 +0100
Subject: [PATCH 26/39] nixos/programs/bash: Let bash-completion lazy load
 scripts

As described in detail here: https://github.com/NixOS/nixpkgs/issues/32533
bash will load completion scripts in $p/share/bash-completion/completions/ on
startup instead of letting bash-completion do it's lazy loading. Bash startup
will then slow down (very noticeable when bash-completion is installed in a
profile).

This commit leaves loading of scripts in the hands of bash-completion,
improving startup time for everyone using `enableCompletion`.

fixes #32533
---
 nixos/modules/programs/bash/bash.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/programs/bash/bash.nix b/nixos/modules/programs/bash/bash.nix
index ef1acdfe66e6..52d3780e045c 100644
--- a/nixos/modules/programs/bash/bash.nix
+++ b/nixos/modules/programs/bash/bash.nix
@@ -20,7 +20,7 @@ let
       nullglobStatus=$(shopt -p nullglob)
       shopt -s nullglob
       for p in $NIX_PROFILES; do
-        for m in "$p/etc/bash_completion.d/"* "$p/share/bash-completion/completions/"*; do
+        for m in "$p/etc/bash_completion.d/"*; do
           . $m
         done
       done

From 5b53774f89ee4288554d5f45cf58c74787e421fb Mon Sep 17 00:00:00 2001
From: Orivej Desh <orivej@gmx.fr>
Date: Sun, 10 Dec 2017 10:22:08 +0000
Subject: [PATCH 27/39] qt4: fix darwin install phase

by creating $out before copying lib to $out
---
 .../libraries/qt-4.x/4.8/default.nix          | 19 ++++++++-----------
 1 file changed, 8 insertions(+), 11 deletions(-)

diff --git a/pkgs/development/libraries/qt-4.x/4.8/default.nix b/pkgs/development/libraries/qt-4.x/4.8/default.nix
index 369f328666da..6c257e95436c 100644
--- a/pkgs/development/libraries/qt-4.x/4.8/default.nix
+++ b/pkgs/development/libraries/qt-4.x/4.8/default.nix
@@ -187,30 +187,27 @@ stdenv.mkDerivation rec {
 
   installPhase = optionalString stdenv.isDarwin ''
     runHook preInstall
+
+    mkdir -p $out
     cp -r lib $out
 
     mkdir -p $out/Applications
     mv bin/*.app $out/Applications
-    rm -rf bin/*.app
-
     cp -r bin $out
 
     mkdir -p $out/share/doc/${name}
-    mkdir -p $out/lib
-    mkdir -p $out/lib/qt4/plugins
-    mkdir -p $out/lib/qt4/imports
-    mkdir -p $out/bin
-    mkdir -p $out/include
-    mkdir -p $out/share/${name}
+    cp -r doc/* $out/share/doc/${name}
 
+    mkdir -p $out/lib/qt4
+    cp -r plugins $out/lib/qt4
+    cp -r imports $out/lib/qt4
+
+    mkdir -p $out/share/${name}
     cp -r mkspecs $out/share/${name}
     cp -r translations $out/share/${name}
     cp -r tools/linguist/phrasebooks $out/share/${name}
     cp tools/porting/src/q3porting.xml $out/share/${name}
 
-    cp -r plugins $out/lib/qt4
-    cp -r imports $out/lib/qt4
-    cp -r doc/* $out/share/doc/${name}
     runHook postInstall
   '';
 

From 7df7739888092f177f7079fc78737e6dbbe90cbb Mon Sep 17 00:00:00 2001
From: Moritz Ulrich <moritz@tarn-vedra.de>
Date: Sat, 9 Dec 2017 14:00:31 +0100
Subject: [PATCH 28/39] gmime3: 3.0.1 -> 3.0.5

---
 pkgs/development/libraries/gmime/3.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/gmime/3.nix b/pkgs/development/libraries/gmime/3.nix
index d6877e72a1f9..66d0cf88bd02 100644
--- a/pkgs/development/libraries/gmime/3.nix
+++ b/pkgs/development/libraries/gmime/3.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, pkgconfig, glib, zlib, gpgme, libidn, gobjectIntrospection }:
 
 stdenv.mkDerivation rec {
-  version = "3.0.1";
+  version = "3.0.5";
   name = "gmime-${version}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gmime/3.0/${name}.tar.xz";
-    sha256 = "001y93b8mq9alzkvli6vfh3pzdcn5c5iy206ml23lzhhhvm5k162";
+    sha256 = "1q45gd1ahnz9q1milc2lqqwl7j3q0wd6kiswhp25iak222n56lrg";
   };
 
   outputs = [ "out" "dev" ];

From 8974a9bf9adaa56621d1c48a921a6dfd5541dc40 Mon Sep 17 00:00:00 2001
From: Moritz Ulrich <moritz@tarn-vedra.de>
Date: Sat, 9 Dec 2017 14:01:15 +0100
Subject: [PATCH 29/39] notmuch: 0.25.2 -> 0.25.3

---
 .../networking/mailreaders/notmuch/default.nix        | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

diff --git a/pkgs/applications/networking/mailreaders/notmuch/default.nix b/pkgs/applications/networking/mailreaders/notmuch/default.nix
index 6d268f69a7ce..15292ab768ac 100644
--- a/pkgs/applications/networking/mailreaders/notmuch/default.nix
+++ b/pkgs/applications/networking/mailreaders/notmuch/default.nix
@@ -12,7 +12,7 @@
 with stdenv.lib;
 
 stdenv.mkDerivation rec {
-  version = "0.25.2";
+  version = "0.25.3";
   name = "notmuch-${version}";
 
   passthru = {
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "http://notmuchmail.org/releases/${name}.tar.gz";
-    sha256 = "0ai6vbs9wzwfz7jcphgqsqpcbq137l34xhmcli4h5c8n82fvmdp4";
+    sha256 = "1fyx20rjpwbf2j1v5fpa5s0rjnwhcgvijzh2qyinp8rlbh1qxmab";
   };
 
   nativeBuildInputs = [ pkgconfig ];
@@ -40,14 +40,9 @@ stdenv.mkDerivation rec {
   ++ optionals (!stdenv.isDarwin) [ gdb man ]; # test dependencies
 
   postPatch = ''
-    find test -type f -exec \
+    find test/ -type f -exec \
       sed -i \
         -e "1s|#!/usr/bin/env bash|#!${bash}/bin/bash|" \
-        -e "s|gpg |${gnupg}/bin/gpg |" \
-        -e "s| gpg| ${gnupg}/bin/gpg|" \
-        -e "s|gpgsm |${gnupg}/bin/gpgsm |" \
-        -e "s| gpgsm| ${gnupg}/bin/gpgsm|" \
-        -e "s|crypto.gpg_path=gpg|crypto.gpg_path=${gnupg}/bin/gpg|" \
         "{}" ";"
 
     for src in \

From b1659c89c1603ee1d4128e5f38a8cf6b75e08ca8 Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Wed, 29 Nov 2017 18:58:56 +0000
Subject: [PATCH 30/39] ocamlPackages.ulex: 1.1 -> 1.2

---
 .../ocaml-modules/ulex/default.nix            | 24 +++++++++++++------
 1 file changed, 17 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/ocaml-modules/ulex/default.nix b/pkgs/development/ocaml-modules/ulex/default.nix
index fa26b305da2d..ed868c30a442 100644
--- a/pkgs/development/ocaml-modules/ulex/default.nix
+++ b/pkgs/development/ocaml-modules/ulex/default.nix
@@ -1,16 +1,26 @@
-{ stdenv, fetchurl, ocaml, findlib, ocamlbuild, camlp4 }:
+{ stdenv, fetchFromGitHub, ocaml, findlib, ocamlbuild, camlp4 }:
 
 let
   pname = "ulex";
+  param =
+    if stdenv.lib.versionAtLeast ocaml.version "4.02" then {
+      version = "1.2";
+      sha256 = "08yf2x9a52l2y4savjqfjd2xy4pjd1rpla2ylrr9qrz1drpfw4ic";
+    } else {
+      version = "1.1";
+      sha256 = "0cmscxcmcxhlshh4jd0lzw5ffzns12x3bj7h27smbc8waxkwffhl";
+    };
 in
 
 stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
-  version = "1.1";
+  name = "ocaml${ocaml.version}-${pname}-${version}";
+  inherit (param) version;
 
-  src = fetchurl {
-    url = "http://www.cduce.org/download/${pname}-${version}.tar.gz";
-    sha256 = "0fjlkwps14adfgxdrbb4yg65fhyimplvjjs1xqj5np197cig67x0";
+  src = fetchFromGitHub {
+    owner = "whitequark";
+    repo = pname;
+    rev = "v${version}";
+    inherit (param) sha256;
   };
 
   createFindlibDestdir = true;
@@ -21,7 +31,7 @@ stdenv.mkDerivation rec {
   buildFlags = "all all.opt";
 
   meta = {
-    homepage = http://www.cduce.org/download.html;
+    inherit (src.meta) homepage;
     description = "A lexer generator for Unicode and OCaml";
     license = stdenv.lib.licenses.mit;
     platforms = ocaml.meta.platforms or [];

From d5d7220770dd85b69eeacc97c29020e49a100987 Mon Sep 17 00:00:00 2001
From: Tobias Happ <tobias.happ@gmx.de>
Date: Sun, 10 Dec 2017 10:14:39 +0100
Subject: [PATCH 31/39] hhvm: 3.21 -> 3.23.2

---
 pkgs/development/compilers/hhvm/default.nix | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/compilers/hhvm/default.nix b/pkgs/development/compilers/hhvm/default.nix
index 4159b7bd52b7..2f84387a8888 100644
--- a/pkgs/development/compilers/hhvm/default.nix
+++ b/pkgs/development/compilers/hhvm/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchgit, fetchurl, cmake, pkgconfig, boost, libunwind, libmemcached
+{ stdenv, fetchgit, cmake, pkgconfig, boost, libunwind, libmemcached
 , pcre, libevent, gd, curl, libxml2, icu, flex, bison, openssl, zlib, php
 , expat, libcap, oniguruma, libdwarf, libmcrypt, tbb, gperftools, glog, libkrb5
 , bzip2, openldap, readline, libelf, uwimap, binutils, cyrus_sasl, pam, libpng
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   name    = "hhvm-${version}";
-  version = "3.21";
+  version = "3.23.2";
 
   # use git version since we need submodules
   src = fetchgit {
     url    = "https://github.com/facebook/hhvm.git";
-    rev    = "56483773e2edd9e61782f1901ce40e47959e71b8";
-    sha256 = "0dmdk98nv04m0fv6909gfbsxqlkckn369yi7kadhir0r7vxsj7wa";
+    rev    = "HHVM-${version}";
+    sha256 = "1nic49j8nghx82lgvz0b95r78sqz46qaaqv4nx48p8yrj9ysnd7i";
     fetchSubmodules = true;
   };
 
@@ -29,10 +29,6 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./flexible-array-members-gcc6.patch
-    (fetchurl {
-      url = https://github.com/facebook/hhvm/commit/b506902af2b7c53de6d6c92491c2086472292004.patch;
-      sha256 = "1br7diczqks6b1xjrdsac599fc62m9l17gcx7dvkc0qj54lq7ys4";
-    })
   ];
 
   enableParallelBuilding = true;

From 746d9d1b7bc23e51a57eb43669d21a5e20b6c513 Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Sat, 9 Dec 2017 09:33:32 +0000
Subject: [PATCH 32/39] ocamlPackages.markup: 0.7.4 -> 0.7.5

---
 pkgs/development/ocaml-modules/markup/default.nix | 10 +++++-----
 pkgs/top-level/ocaml-packages.nix                 |  2 +-
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/ocaml-modules/markup/default.nix b/pkgs/development/ocaml-modules/markup/default.nix
index 3ee84d0d1b1c..eb3944db88e9 100644
--- a/pkgs/development/ocaml-modules/markup/default.nix
+++ b/pkgs/development/ocaml-modules/markup/default.nix
@@ -2,19 +2,19 @@
 
 stdenv.mkDerivation rec {
   pname = "markup";
-  version = "0.7.4";
+  version = "0.7.5";
   name = "ocaml${ocaml.version}-${pname}-${version}";
 
   src = fetchzip {
     url = "http://github.com/aantron/markup.ml/archive/${version}.tar.gz";
-    sha256 = "1hchlqzsy9pax91gcdmxzakfm22fbvhxzwyzpvz8fqkx4372zs37";
+    sha256 = "09qm73m6c6wjh51w61vnfsnis37m28cf1r6hnkr3bbg903ahwbp5";
     };
 
-  buildInputs = [ ocaml findlib ocamlbuild ];
+  buildInputs = [ ocaml findlib ocamlbuild lwt ];
 
   installPhase = "make ocamlfind-install";
-  
-  propagatedBuildInputs = [uutf lwt];
+
+  propagatedBuildInputs = [ uutf ];
 
   createFindlibDestdir = true;
 
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 2003f30ef2e2..52a921dcc0ed 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -369,7 +369,7 @@ let
 
     magick = callPackage ../development/ocaml-modules/magick { };
 
-    markup = callPackage ../development/ocaml-modules/markup { lwt = lwt2; };
+    markup = callPackage ../development/ocaml-modules/markup { lwt = ocaml_lwt; };
 
     menhir = callPackage ../development/ocaml-modules/menhir { };
 

From 42973bef3fdd3c8aae8e9ade8db4c34f7308561a Mon Sep 17 00:00:00 2001
From: Orivej Desh <orivej@gmx.fr>
Date: Sun, 10 Dec 2017 12:09:55 +0000
Subject: [PATCH 33/39] nixos/programs/bash: document that
 /etc/bash_completion.d is obsolete

https://github.com/scop/bash-completion/blob/fbd52a5e31747beb4974da97b9d3ed4f6ceb7a61/bash_completion#L2070-L2078
---
 nixos/modules/programs/bash/bash.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/programs/bash/bash.nix b/nixos/modules/programs/bash/bash.nix
index 52d3780e045c..1abdb4973a44 100644
--- a/nixos/modules/programs/bash/bash.nix
+++ b/nixos/modules/programs/bash/bash.nix
@@ -14,7 +14,10 @@ let
   bashCompletion = optionalString cfg.enableCompletion ''
     # Check whether we're running a version of Bash that has support for
     # programmable completion. If we do, enable all modules installed in
-    # the system (and user profile).
+    # the system and user profile in obsolete /etc/bash_completion.d/
+    # directories. Bash loads completions in all
+    # $XDG_DATA_DIRS/share/bash-completion/completions/
+    # on demand, so they do not need to be sourced here.
     if shopt -q progcomp &>/dev/null; then
       . "${pkgs.bash-completion}/etc/profile.d/bash_completion.sh"
       nullglobStatus=$(shopt -p nullglob)

From c4a5ab728b68799599ab21cdb981dfcd587306ac Mon Sep 17 00:00:00 2001
From: Aristid Breitkreuz <aristidb@gmail.com>
Date: Sun, 10 Dec 2017 14:26:03 +0100
Subject: [PATCH 34/39] borg: 1.1.1 -> 1.1.3

---
 pkgs/tools/backup/borg/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/backup/borg/default.nix b/pkgs/tools/backup/borg/default.nix
index 867d2cf903a0..2dc84069d629 100644
--- a/pkgs/tools/backup/borg/default.nix
+++ b/pkgs/tools/backup/borg/default.nix
@@ -2,13 +2,13 @@
 
 python3Packages.buildPythonApplication rec {
   name = "borgbackup-${version}";
-  version = "1.1.1";
+  version = "1.1.3";
   namePrefix = "";
 
   src = fetchurl {
     url = "https://github.com/borgbackup/borg/releases/download/"
       + "${version}/${name}.tar.gz";
-    sha256 = "0iik5lq349cl87imlwra2pp0j36wjhpn8r1d3778azvvqpyjq2d5";
+    sha256 = "1rvn8b6clzd1r317r9jkvk34r31risi0dxfjc7jffhnwasck4anc";
   };
 
   nativeBuildInputs = with python3Packages; [

From f79d69113e4231596335c68c934c7404c172ec0e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tor=20Hedin=20Br=C3=B8nner?= <torhedinbronner@gmail.com>
Date: Sun, 10 Dec 2017 12:41:24 +0100
Subject: [PATCH 35/39] nix-bash-completions: lazy load aware install

`bash-completion` lazy loads completion scripts by looking up the command name
in the completion directory. As such we need to create a symlink for every
nix command.

The problem had been masked by nixos sourcing all completion scripts on startup.
---
 pkgs/shells/nix-bash-completions/default.nix | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/pkgs/shells/nix-bash-completions/default.nix b/pkgs/shells/nix-bash-completions/default.nix
index 7de8be10c9b7..f9cd97e97354 100644
--- a/pkgs/shells/nix-bash-completions/default.nix
+++ b/pkgs/shells/nix-bash-completions/default.nix
@@ -1,19 +1,29 @@
 { stdenv, fetchFromGitHub }:
 
 stdenv.mkDerivation rec {
-  version = "0.6";
+  version = "0.6.1";
   name = "nix-bash-completions-${version}";
 
   src = fetchFromGitHub {
     owner = "hedning";
     repo = "nix-bash-completions";
     rev = "v${version}";
-    sha256 = "093rla6wwx51fclh7xm8qlssx70hj0fj23r59qalaaxf7fdzg2hf";
+    sha256 = "10nzdn249f0cw6adgpbpg4x90ysvxm7vs9jjbbwynfh9kngijp64";
   };
 
+  # To enable lazy loading via. bash-completion we need a symlink to the script
+  # from every command name.
   installPhase = ''
-    mkdir -p $out/share/bash-completion/completions
-    cp _nix $out/share/bash-completion/completions
+    commands=$(
+      function complete() { shift 2; echo "$@"; }
+      shopt -s extglob
+      source _nix
+    )
+    install -Dm444 -t $out/share/bash-completion/completions _nix
+    cd $out/share/bash-completion/completions
+    for c in $commands; do
+      ln -s _nix $c
+    done
   '';
 
   meta = with stdenv.lib; {

From 163ba091171b364fc03a303b6b41c55298ca31d2 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 10 Dec 2017 15:21:02 +0100
Subject: [PATCH 36/39] python.buildEnv: always include the $out output

28299f669adc41e5278372cad952fb1e1165b44b introduced the first Python
packages having multiple outputs. The required outputs were not picked
up by `python.buildEnv` (#31857).

This commit modifies `python.buildEnv` so that it always includes the
$out output and thus fixes #31857.
---
 pkgs/development/interpreters/python/wrapper.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/interpreters/python/wrapper.nix b/pkgs/development/interpreters/python/wrapper.nix
index fc521828ffc4..8d4e68bf57ca 100644
--- a/pkgs/development/interpreters/python/wrapper.nix
+++ b/pkgs/development/interpreters/python/wrapper.nix
@@ -14,7 +14,8 @@ let
     name = "${python.name}-env";
 
     inherit paths;
-    inherit ignoreCollisions extraOutputsToInstall;
+    inherit ignoreCollisions;
+    extraOutputsToInstall = [ "out" ] ++ extraOutputsToInstall;
 
     postBuild = ''
       . "${makeWrapper}/nix-support/setup-hook"

From f601ecfb215195c2491ce49d8f8a637960ca494e Mon Sep 17 00:00:00 2001
From: Orivej Desh <orivej@gmx.fr>
Date: Sun, 10 Dec 2017 13:43:12 +0000
Subject: [PATCH 37/39] qt4: fix qmake on darwin and delete custom install
 phase

Since keeping `installPhase = ""` to signify "use the default installPhase" will
be surprising, this deletes the installPhase and rebuilds qt4 on all platforms.

Fixes #30238
---
 .../libraries/qt-4.x/4.8/default.nix          | 60 ++++++-------------
 .../qt-4.x/4.8/qt-4.8.7-unixmake-darwin.patch | 11 ++++
 2 files changed, 28 insertions(+), 43 deletions(-)
 create mode 100644 pkgs/development/libraries/qt-4.x/4.8/qt-4.8.7-unixmake-darwin.patch

diff --git a/pkgs/development/libraries/qt-4.x/4.8/default.nix b/pkgs/development/libraries/qt-4.x/4.8/default.nix
index 6c257e95436c..32691faa6893 100644
--- a/pkgs/development/libraries/qt-4.x/4.8/default.nix
+++ b/pkgs/development/libraries/qt-4.x/4.8/default.nix
@@ -68,6 +68,7 @@ stdenv.mkDerivation rec {
     [ ./glib-2.32.patch
       ./libressl.patch
       ./parallel-configure.patch
+      ./qt-4.8.7-unixmake-darwin.patch
       (substituteAll {
         src = ./dlopen-absolute-paths.diff;
         cups = if cups != null then stdenv.lib.getLib cups else null;
@@ -76,7 +77,19 @@ stdenv.mkDerivation rec {
         glibc = stdenv.cc.libc.out;
         openglDriver = if mesaSupported then mesa.driverLink else "/no-such-path";
       })
-    ] ++ stdenv.lib.optional gtkStyle (substituteAll ({
+      (fetchpatch {
+        name = "fix-medium-font.patch";
+        url = "http://anonscm.debian.org/cgit/pkg-kde/qt/qt4-x11.git/plain/debian/patches/"
+          + "kubuntu_39_fix_medium_font.diff?id=21b342d71c19e6d68b649947f913410fe6129ea4";
+        sha256 = "0bli44chn03c2y70w1n8l7ss4ya0b40jqqav8yxrykayi01yf95j";
+      })
+      (fetchpatch {
+        name = "qt4-gcc6.patch";
+        url = "https://git.archlinux.org/svntogit/packages.git/plain/trunk/qt4-gcc6.patch?h=packages/qt4&id=ca773a144f5abb244ac4f2749eeee9333cac001f";
+        sha256 = "07lrva7bjh6i40p7b3ml26a2jlznri8bh7y7iyx5zmvb1gfxmj34";
+      })
+    ]
+    ++ stdenv.lib.optional gtkStyle (substituteAll ({
         src = ./dlopen-gtkstyle.diff;
         # substituteAll ignores env vars starting with capital letter
         gtk = gtk2.out;
@@ -93,20 +106,7 @@ stdenv.mkDerivation rec {
     ++ stdenv.lib.optional stdenv.isAarch64 (fetchpatch {
         url = "https://src.fedoraproject.org/rpms/qt/raw/ecf530486e0fb7fe31bad26805cde61115562b2b/f/qt-aarch64.patch";
         sha256 = "1fbjh78nmafqmj7yk67qwjbhl3f6ylkp6x33b1dqxfw9gld8b3gl";
-      })
-    ++ [
-      (fetchpatch {
-        name = "fix-medium-font.patch";
-        url = "http://anonscm.debian.org/cgit/pkg-kde/qt/qt4-x11.git/plain/debian/patches/"
-          + "kubuntu_39_fix_medium_font.diff?id=21b342d71c19e6d68b649947f913410fe6129ea4";
-        sha256 = "0bli44chn03c2y70w1n8l7ss4ya0b40jqqav8yxrykayi01yf95j";
-      })
-      (fetchpatch {
-        name = "qt4-gcc6.patch";
-        url = "https://git.archlinux.org/svntogit/packages.git/plain/trunk/qt4-gcc6.patch?h=packages/qt4&id=ca773a144f5abb244ac4f2749eeee9333cac001f";
-        sha256 = "07lrva7bjh6i40p7b3ml26a2jlznri8bh7y7iyx5zmvb1gfxmj34";
-      })
-    ];
+      });
 
   preConfigure = ''
     export LD_LIBRARY_PATH="`pwd`/lib:$LD_LIBRARY_PATH"
@@ -185,34 +185,8 @@ stdenv.mkDerivation rec {
     sed -i 's/^\(LIBS[[:space:]]*=.*$\)/\1 -lobjc/' ./src/corelib/Makefile.Release
   '';
 
-  installPhase = optionalString stdenv.isDarwin ''
-    runHook preInstall
-
-    mkdir -p $out
-    cp -r lib $out
-
-    mkdir -p $out/Applications
-    mv bin/*.app $out/Applications
-    cp -r bin $out
-
-    mkdir -p $out/share/doc/${name}
-    cp -r doc/* $out/share/doc/${name}
-
-    mkdir -p $out/lib/qt4
-    cp -r plugins $out/lib/qt4
-    cp -r imports $out/lib/qt4
-
-    mkdir -p $out/share/${name}
-    cp -r mkspecs $out/share/${name}
-    cp -r translations $out/share/${name}
-    cp -r tools/linguist/phrasebooks $out/share/${name}
-    cp tools/porting/src/q3porting.xml $out/share/${name}
-
-    runHook postInstall
-  '';
-
-  postInstall = optionalString (!stdenv.isDarwin) ''
-      rm -rf $out/tests
+  postInstall = ''
+    rm -rf $out/tests
   '';
 
   crossAttrs = {
diff --git a/pkgs/development/libraries/qt-4.x/4.8/qt-4.8.7-unixmake-darwin.patch b/pkgs/development/libraries/qt-4.x/4.8/qt-4.8.7-unixmake-darwin.patch
new file mode 100644
index 000000000000..99a36a24fe43
--- /dev/null
+++ b/pkgs/development/libraries/qt-4.x/4.8/qt-4.8.7-unixmake-darwin.patch
@@ -0,0 +1,11 @@
+--- a/qmake/generators/unix/unixmake.cpp
++++ b/qmake/generators/unix/unixmake.cpp
+@@ -831,7 +831,7 @@ UnixMakefileGenerator::defaultInstall(const QString &t)
+             else if(project->first("TEMPLATE") == "app" && !project->isEmpty("QMAKE_STRIPFLAGS_APP"))
+                 ret += " " + var("QMAKE_STRIPFLAGS_APP");
+             if(bundle)
+-                ret = " \"" + dst_targ + "/Contents/MacOS/$(QMAKE_TARGET)\"";
++                ret += " \"" + dst_targ + "/Contents/MacOS/$(QMAKE_TARGET)\"";
+             else
+                 ret += " \"" + dst_targ + "\"";
+         }

From 5f4e80a86fae107cbd9431eca83bd8886abdad06 Mon Sep 17 00:00:00 2001
From: Aristid Breitkreuz <aristidb@gmail.com>
Date: Sun, 10 Dec 2017 15:23:23 +0100
Subject: [PATCH 38/39] awesome: fix LUA_PATH/LUA_CPATH to lgi [now for version
 3.5]

---
 pkgs/applications/window-managers/awesome/3.5.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/window-managers/awesome/3.5.nix b/pkgs/applications/window-managers/awesome/3.5.nix
index 3a2a030b8a4d..f3d43d15efba 100644
--- a/pkgs/applications/window-managers/awesome/3.5.nix
+++ b/pkgs/applications/window-managers/awesome/3.5.nix
@@ -70,8 +70,8 @@ stdenv.mkDerivation rec {
 
   postInstall = ''
     wrapProgram $out/bin/awesome \
-      --prefix LUA_CPATH ";" '"${lgi}/lib/lua/${lua.luaversion}/?.so"' \
-      --prefix LUA_PATH ";" '"${lgi}/share/lua/${lua.luaversion}/?.lua;${lgi}/share/lua/${lua.luaversion}/lgi/?.lua"' \
+      --prefix LUA_CPATH ";" "${lgi}/lib/lua/${lua.luaversion}/?.so" \
+      --prefix LUA_PATH ";" "${lgi}/share/lua/${lua.luaversion}/?.lua;${lgi}/share/lua/${lua.luaversion}/lgi/?.lua" \
       --prefix GI_TYPELIB_PATH : "$GI_TYPELIB_PATH" \
       --prefix LD_LIBRARY_PATH : "$LD_LIBRARY_PATH" \
       --prefix PATH : "${stdenv.lib.makeBinPath [ compton unclutter procps iproute coreutils curl alsaUtils findutils xterm ]}"

From 491bc4cfedfdbbced12f01d0f722e04393b72854 Mon Sep 17 00:00:00 2001
From: rnhmjoj <rnhmjoj@inventati.org>
Date: Sun, 10 Dec 2017 15:27:06 +0100
Subject: [PATCH 39/39] pythonPackages: rename dns -> dnspython

---
 pkgs/applications/misc/calibre/default.nix         | 2 +-
 pkgs/applications/misc/electron-cash/default.nix   | 2 +-
 pkgs/applications/misc/electrum-dash/default.nix   | 2 +-
 pkgs/applications/misc/electrum-ltc/default.nix    | 2 +-
 pkgs/applications/misc/electrum/default.nix        | 2 +-
 pkgs/applications/networking/errbot/default.nix    | 2 +-
 pkgs/development/python-modules/salmon/default.nix | 4 ++--
 pkgs/servers/mail/mailman/default.nix              | 2 +-
 pkgs/tools/admin/ansible/2.1.nix                   | 2 +-
 pkgs/tools/admin/ansible/2.2.nix                   | 2 +-
 pkgs/tools/admin/ansible/2.3.nix                   | 2 +-
 pkgs/tools/admin/ansible/2.4.nix                   | 2 +-
 pkgs/tools/admin/cli53/default.nix                 | 2 +-
 pkgs/tools/security/hash-slinger/default.nix       | 2 +-
 14 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/pkgs/applications/misc/calibre/default.nix b/pkgs/applications/misc/calibre/default.nix
index e548b944a8d4..b406f38613d5 100644
--- a/pkgs/applications/misc/calibre/default.nix
+++ b/pkgs/applications/misc/calibre/default.nix
@@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
     poppler_utils libpng imagemagick libjpeg
     fontconfig podofo qtbase chmlib icu sqlite libusb1 libmtp xdg_utils wrapGAppsHook
   ] ++ (with python2Packages; [
-    apsw cssselect cssutils dateutil dns html5-parser lxml mechanize netifaces pillow
+    apsw cssselect cssutils dateutil dnspython html5-parser lxml mechanize netifaces pillow
     python pyqt5 sip
     regex msgpack
     # the following are distributed with calibre, but we use upstream instead
diff --git a/pkgs/applications/misc/electron-cash/default.nix b/pkgs/applications/misc/electron-cash/default.nix
index 56c1a8168a82..5b4cb82277a7 100644
--- a/pkgs/applications/misc/electron-cash/default.nix
+++ b/pkgs/applications/misc/electron-cash/default.nix
@@ -12,7 +12,7 @@ python2Packages.buildPythonApplication rec {
   };
 
   propagatedBuildInputs = with python2Packages; [
-    dns
+    dnspython
     ecdsa
     jsonrpclib
     pbkdf2
diff --git a/pkgs/applications/misc/electrum-dash/default.nix b/pkgs/applications/misc/electrum-dash/default.nix
index e7a5a1be1979..bde8d5b81e3e 100644
--- a/pkgs/applications/misc/electrum-dash/default.nix
+++ b/pkgs/applications/misc/electrum-dash/default.nix
@@ -10,7 +10,7 @@ python2Packages.buildPythonApplication rec {
   };
 
   propagatedBuildInputs = with python2Packages; [
-    dns
+    dnspython
     ecdsa
     pbkdf2
     protobuf
diff --git a/pkgs/applications/misc/electrum-ltc/default.nix b/pkgs/applications/misc/electrum-ltc/default.nix
index bb41f8665e57..58844500195e 100644
--- a/pkgs/applications/misc/electrum-ltc/default.nix
+++ b/pkgs/applications/misc/electrum-ltc/default.nix
@@ -21,7 +21,7 @@ python2Packages.buildPythonApplication rec {
     qrcode
     ltc_scrypt
     protobuf
-    dns
+    dnspython
     jsonrpclib
   ];
 
diff --git a/pkgs/applications/misc/electrum/default.nix b/pkgs/applications/misc/electrum/default.nix
index abe8d0dde84b..8de837991aab 100644
--- a/pkgs/applications/misc/electrum/default.nix
+++ b/pkgs/applications/misc/electrum/default.nix
@@ -10,7 +10,7 @@ python2Packages.buildPythonApplication rec {
   };
 
   propagatedBuildInputs = with python2Packages; [
-    dns
+    dnspython
     ecdsa
     jsonrpclib
     matplotlib
diff --git a/pkgs/applications/networking/errbot/default.nix b/pkgs/applications/networking/errbot/default.nix
index 7d815c8fad08..611d7904991a 100644
--- a/pkgs/applications/networking/errbot/default.nix
+++ b/pkgs/applications/networking/errbot/default.nix
@@ -24,7 +24,7 @@ pythonPackages.buildPythonApplication rec {
   buildInputs = [ glibcLocales ];
   propagatedBuildInputs = with pythonPackages; [
     webtest bottle threadpool rocket-errbot requests jinja2
-    pyopenssl colorlog Yapsy markdown ansi pygments dns pep8
+    pyopenssl colorlog Yapsy markdown ansi pygments dnspython pep8
     daemonize pygments-markdown-lexer telegram irc slackclient
     sleekxmpp hypchat pytest
   ];
diff --git a/pkgs/development/python-modules/salmon/default.nix b/pkgs/development/python-modules/salmon/default.nix
index 2169689f3d47..f9d7f79164ac 100644
--- a/pkgs/development/python-modules/salmon/default.nix
+++ b/pkgs/development/python-modules/salmon/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildPythonPackage, fetchFromGitHub, pythonOlder, nose, dns
+{ stdenv, buildPythonPackage, fetchFromGitHub, pythonOlder, nose, dnspython
 ,  chardet, lmtpd, pythondaemon, six, jinja2, mock }:
 
 buildPythonPackage rec {
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   };
 
   checkInputs = [ nose jinja2 mock ];
-  propagatedBuildInputs = [ chardet dns lmtpd pythondaemon six ];
+  propagatedBuildInputs = [ chardet dnspython lmtpd pythondaemon six ];
 
   meta = with stdenv.lib; {
     homepage = http://salmon-mail.readthedocs.org/;
diff --git a/pkgs/servers/mail/mailman/default.nix b/pkgs/servers/mail/mailman/default.nix
index d64e41f30071..8ff20869b94e 100644
--- a/pkgs/servers/mail/mailman/default.nix
+++ b/pkgs/servers/mail/mailman/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "1r6sjapjmbav45xibjzc2a8y1xf4ikz09470ma1kw7iz174wn8z7";
   };
 
-  buildInputs = [ python pythonPackages.dns ];
+  buildInputs = [ python pythonPackages.dnspython ];
 
   patches = [ ./fix-var-prefix.patch ];
 
diff --git a/pkgs/tools/admin/ansible/2.1.nix b/pkgs/tools/admin/ansible/2.1.nix
index 6232e4ad95ba..d4a349c5e47d 100644
--- a/pkgs/tools/admin/ansible/2.1.nix
+++ b/pkgs/tools/admin/ansible/2.1.nix
@@ -36,7 +36,7 @@ in buildPythonPackage rec {
   dontPatchShebangs = false;
 
   propagatedBuildInputs = [
-    pycrypto paramiko jinja pyyaml httplib2 boto six netaddr dns
+    pycrypto paramiko jinja pyyaml httplib2 boto six netaddr dnspython
   ] ++ stdenv.lib.optional windowsSupport pywinrm;
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/admin/ansible/2.2.nix b/pkgs/tools/admin/ansible/2.2.nix
index 02392d7ac89f..4ef35fa5d9eb 100644
--- a/pkgs/tools/admin/ansible/2.2.nix
+++ b/pkgs/tools/admin/ansible/2.2.nix
@@ -38,7 +38,7 @@ in buildPythonPackage rec {
   dontPatchShebangs = false;
 
   propagatedBuildInputs = [
-    pycrypto paramiko jinja pyyaml httplib2 boto six netaddr dns
+    pycrypto paramiko jinja pyyaml httplib2 boto six netaddr dnspython
   ] ++ stdenv.lib.optional windowsSupport pywinrm;
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/admin/ansible/2.3.nix b/pkgs/tools/admin/ansible/2.3.nix
index 7330b7d0858b..b827bdcc9c31 100644
--- a/pkgs/tools/admin/ansible/2.3.nix
+++ b/pkgs/tools/admin/ansible/2.3.nix
@@ -24,7 +24,7 @@ pythonPackages.buildPythonPackage rec {
   dontPatchShebangs = false;
 
   propagatedBuildInputs = with pythonPackages; [
-    pycrypto paramiko jinja2 pyyaml httplib2 boto six netaddr dns
+    pycrypto paramiko jinja2 pyyaml httplib2 boto six netaddr dnspython
   ] ++ stdenv.lib.optional windowsSupport pywinrm;
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/admin/ansible/2.4.nix b/pkgs/tools/admin/ansible/2.4.nix
index 9c8df647e593..4f90e80202e4 100644
--- a/pkgs/tools/admin/ansible/2.4.nix
+++ b/pkgs/tools/admin/ansible/2.4.nix
@@ -24,7 +24,7 @@ pythonPackages.buildPythonPackage rec {
   dontPatchShebangs = false;
 
   propagatedBuildInputs = with pythonPackages; [
-    pycrypto paramiko jinja2 pyyaml httplib2 boto six netaddr dns
+    pycrypto paramiko jinja2 pyyaml httplib2 boto six netaddr dnspython
   ] ++ stdenv.lib.optional windowsSupport pywinrm;
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/admin/cli53/default.nix b/pkgs/tools/admin/cli53/default.nix
index b9852ed587c5..e70a7ba9b50c 100644
--- a/pkgs/tools/admin/cli53/default.nix
+++ b/pkgs/tools/admin/cli53/default.nix
@@ -23,7 +23,7 @@ python2.pkgs.buildPythonApplication rec {
   propagatedBuildInputs = with python2.pkgs; [
     argparse
     boto
-    dns
+    dnspython
   ];
 
   meta = with lib; {
diff --git a/pkgs/tools/security/hash-slinger/default.nix b/pkgs/tools/security/hash-slinger/default.nix
index 4d60b11f977c..fd78d9b2efbf 100644
--- a/pkgs/tools/security/hash-slinger/default.nix
+++ b/pkgs/tools/security/hash-slinger/default.nix
@@ -14,7 +14,7 @@ in stdenv.mkDerivation rec {
     sha256 = "05wn744ydclpnpyah6yfjqlfjlasrrhzj48lqmm5a91nyps5yqyn";
   };
 
-  pythonPath = with pythonPackages; [ dns m2crypto ipaddr python-gnupg
+  pythonPath = with pythonPackages; [ dnspython m2crypto ipaddr python-gnupg
                                       pyunbound ];
 
   buildInputs = [ pythonPackages.wrapPython ];