Merge branch 'master' into staging

* master: (81 commits) Add NixOS 17.09 AMIs gradle: 4.2 -> 4.2.1 maintainers.nix: use my GitHub handle as maintainer name fcitx-engines.rime: init at 0.3.2 brise: init at 2017-09-16 librime: init at 1.2.9 marisa: init at 0.2.4 opencc: build shared library and programs josm: 12712 -> 12914 exa: 0.7.0 -> 0.8.0 krb5: add deprecation date for old configuration rustRegistry: 2017-09-10 -> 2017-10-03 go-ethereum: Fix libusb segmentation faults on Darwin tor-browser-bundle-bin: 7.0.5 -> 7.0.6 libsodium: 1.0.13 -> 1.0.15 tor-browser-bundle: geoip support tor-browser-bundle: support transports obfs2,obfs3 tor-browser-bundle: bump https-everywhere to 2017.9.12 tint2: limit platforms to Linux since macOS is not supported and fails the tests eclipse-plugin-vrapper: init at 0.72.0 ...
2024-11-21 05:00:16 +00:00 · 2017-10-03 17:46:39 +00:00 · 2017-10-03 17:46:39 +00:00 · f137004179
parent 3c3d8710b5 b465d9c1ff
commit f137004179
88 changed files with 1417 additions and 656 deletions
--- a/lib/maintainers.nix
+++ b/lib/maintainers.nix
@ -384,7 +384,6 @@
  mikefaille = "Michaël Faille <michael@faille.io>";
  miltador = "Vasiliy Solovey <miltador@yandex.ua>";
  mimadrid = "Miguel Madrid <mimadrid@ucm.es>";
-  mingchuan = "Ming Chuan <ming@culpring.com>";
  mirdhyn = "Merlin Gaillard <mirdhyn@gmail.com>";
  mirrexagon = "Andrew Abbott <mirrexagon@mirrexagon.com>";
  mjanczyk = "Marcin Janczyk <m@dragonvr.pl>";
@ -550,6 +549,7 @@
  shell = "Shell Turner <cam.turn@gmail.com>";
  shlevy = "Shea Levy <shea@shealevy.com>";
  siddharthist = "Langston Barrett <langston.barrett@gmail.com>";
+  sifmelcara = "Ming Chuan <ming@culpring.com>";
  sigma = "Yann Hodique <yann.hodique@gmail.com>";
  simonvandel = "Simon Vandel Sillesen <simon.vandel@gmail.com>";
  sivteck = "Sivaram Balakrishnan <sivaram1992@gmail.com>";
@ -574,6 +574,7 @@
  sternenseemann = "Lukas Epple <post@lukasepple.de>";
  stesie = "Stefan Siegl <stesie@brokenpipe.de>";
  steveej = "Stefan Junker <mail@stefanjunker.de>";
+  stumoss = "Stuart Moss <samoss@gmail.com>";
  SuprDewd = "Bjarki Ágúst Guðmundsson <suprdewd@gmail.com>";
  swarren83 = "Shawn Warren <shawn.w.warren@gmail.com>";
  swflint = "Samuel W. Flint <swflint@flintfam.org>";
--- a/nixos/modules/config/krb5.nix
+++ b/nixos/modules/config/krb5.nix
@ -1,206 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let
-
-  cfg = config.krb5;
-
-in
-
-{
-  ###### interface
-
-  options = {
-
-    krb5 = {
-
-      enable = mkOption {
-        default = false;
-        description = "Whether to enable Kerberos V.";
-      };
-
-      defaultRealm = mkOption {
-        default = "ATENA.MIT.EDU";
-        description = "Default realm.";
-      };
-
-      domainRealm = mkOption {
-        default = "atena.mit.edu";
-        description = "Default domain realm.";
-      };
-
-      kdc = mkOption {
-        default = "kerberos.mit.edu";
-        description = "Key Distribution Center";
-      };
-
-      kerberosAdminServer = mkOption {
-        default = "kerberos.mit.edu";
-        description = "Kerberos Admin Server.";
-      };
-
-    };
-
-  };
-
-  ###### implementation
-
-  config = mkIf config.krb5.enable {
-
-    environment.systemPackages = [ pkgs.krb5Full ];
-
-    environment.etc."krb5.conf".text =
-      ''
-        [libdefaults]
-            default_realm = ${cfg.defaultRealm}
-            encrypt = true
-
-        # The following krb5.conf variables are only for MIT Kerberos.
-            krb4_config = /etc/krb.conf
-            krb4_realms = /etc/krb.realms
-            kdc_timesync = 1
-            ccache_type = 4
-            forwardable = true
-            proxiable = true
-
-        # The following encryption type specification will be used by MIT Kerberos
-        # if uncommented.  In general, the defaults in the MIT Kerberos code are
-        # correct and overriding these specifications only serves to disable new
-        # encryption types as they are added, creating interoperability problems.
-
-        #   default_tgs_enctypes = aes256-cts arcfour-hmac-md5 des3-hmac-sha1 des-cbc-crc des-cbc-md5
-        #   default_tkt_enctypes = aes256-cts arcfour-hmac-md5 des3-hmac-sha1 des-cbc-crc des-cbc-md5
-        #   permitted_enctypes = aes256-cts arcfour-hmac-md5 des3-hmac-sha1 des-cbc-crc des-cbc-md5
-
-        # The following libdefaults parameters are only for Heimdal Kerberos.
-            v4_instance_resolve = false
-            v4_name_convert = {
-                host = {
-                    rcmd = host
-                    ftp = ftp
-                }
-                plain = {
-                    something = something-else
-                }
-            }
-            fcc-mit-ticketflags = true
-
-        [realms]
-            ${cfg.defaultRealm} = {
-                kdc = ${cfg.kdc}
-                admin_server = ${cfg.kerberosAdminServer}
-                #kpasswd_server = ${cfg.kerberosAdminServer}
-            }
-            ATHENA.MIT.EDU = {
-                kdc = kerberos.mit.edu:88
-                kdc = kerberos-1.mit.edu:88
-                kdc = kerberos-2.mit.edu:88
-                admin_server = kerberos.mit.edu
-                default_domain = mit.edu
-            }
-            MEDIA-LAB.MIT.EDU = {
-                kdc = kerberos.media.mit.edu
-                admin_server = kerberos.media.mit.edu
-            }
-            ZONE.MIT.EDU = {
-                kdc = casio.mit.edu
-                kdc = seiko.mit.edu
-                admin_server = casio.mit.edu
-            }
-            MOOF.MIT.EDU = {
-                kdc = three-headed-dogcow.mit.edu:88
-                kdc = three-headed-dogcow-1.mit.edu:88
-                admin_server = three-headed-dogcow.mit.edu
-            }
-            CSAIL.MIT.EDU = {
-                kdc = kerberos-1.csail.mit.edu
-                kdc = kerberos-2.csail.mit.edu
-                admin_server = kerberos.csail.mit.edu
-                default_domain = csail.mit.edu
-                krb524_server = krb524.csail.mit.edu
-            }
-            IHTFP.ORG = {
-                kdc = kerberos.ihtfp.org
-                admin_server = kerberos.ihtfp.org
-            }
-            GNU.ORG = {
-                kdc = kerberos.gnu.org
-                kdc = kerberos-2.gnu.org
-                kdc = kerberos-3.gnu.org
-                admin_server = kerberos.gnu.org
-            }
-            1TS.ORG = {
-                kdc = kerberos.1ts.org
-                admin_server = kerberos.1ts.org
-            }
-            GRATUITOUS.ORG = {
-                kdc = kerberos.gratuitous.org
-                admin_server = kerberos.gratuitous.org
-            }
-            DOOMCOM.ORG = {
-                kdc = kerberos.doomcom.org
-                admin_server = kerberos.doomcom.org
-            }
-            ANDREW.CMU.EDU = {
-                kdc = vice28.fs.andrew.cmu.edu
-                kdc = vice2.fs.andrew.cmu.edu
-                kdc = vice11.fs.andrew.cmu.edu
-                kdc = vice12.fs.andrew.cmu.edu
-                admin_server = vice28.fs.andrew.cmu.edu
-                default_domain = andrew.cmu.edu
-            }
-            CS.CMU.EDU = {
-                kdc = kerberos.cs.cmu.edu
-                kdc = kerberos-2.srv.cs.cmu.edu
-                admin_server = kerberos.cs.cmu.edu
-            }
-            DEMENTIA.ORG = {
-                kdc = kerberos.dementia.org
-                kdc = kerberos2.dementia.org
-                admin_server = kerberos.dementia.org
-            }
-            stanford.edu = {
-                kdc = krb5auth1.stanford.edu
-                kdc = krb5auth2.stanford.edu
-                kdc = krb5auth3.stanford.edu
-                admin_server = krb5-admin.stanford.edu
-                default_domain = stanford.edu
-            }
-
-        [domain_realm]
-            .${cfg.domainRealm} = ${cfg.defaultRealm}
-            ${cfg.domainRealm} = ${cfg.defaultRealm}
-            .mit.edu = ATHENA.MIT.EDU
-            mit.edu = ATHENA.MIT.EDU
-            .exchange.mit.edu = EXCHANGE.MIT.EDU
-            exchange.mit.edu = EXCHANGE.MIT.EDU
-            .media.mit.edu = MEDIA-LAB.MIT.EDU
-            media.mit.edu = MEDIA-LAB.MIT.EDU
-            .csail.mit.edu = CSAIL.MIT.EDU
-            csail.mit.edu = CSAIL.MIT.EDU
-            .whoi.edu = ATHENA.MIT.EDU
-            whoi.edu = ATHENA.MIT.EDU
-            .stanford.edu = stanford.edu
-
-        [logging]
-            kdc = SYSLOG:INFO:DAEMON
-            admin_server = SYSLOG:INFO:DAEMON
-            default = SYSLOG:INFO:DAEMON
-            krb4_convert = true
-            krb4_get_tickets = false
-
-        [appdefaults]
-            pam = {
-                debug = false
-                ticket_lifetime = 36000
-                renew_lifetime = 36000
-                max_timeout = 30
-                timeout_shift = 2
-                initial_timeout = 1
-            }
-      '';
-
-  };
-
-}
--- a/nixos/modules/config/krb5/default.nix
+++ b/nixos/modules/config/krb5/default.nix
@ -0,0 +1,367 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+
+  cfg = config.krb5;
+
+  # This is to provide support for old configuration options (as much as is
+  # reasonable). This can be removed after 18.03 was released.
+  defaultConfig = {
+    libdefaults = optionalAttrs (cfg.defaultRealm != null)
+      { default_realm = cfg.defaultRealm; };
+
+    realms = optionalAttrs (lib.all (value: value != null) [
+      cfg.defaultRealm cfg.kdc cfg.kerberosAdminServer
+    ]) {
+      "${cfg.defaultRealm}" = {
+        kdc = cfg.kdc;
+        admin_server = cfg.kerberosAdminServer;
+      };
+    };
+
+    domain_realm = optionalAttrs (lib.all (value: value != null) [
+      cfg.domainRealm cfg.defaultRealm
+    ]) {
+      ".${cfg.domainRealm}" = cfg.defaultRealm;
+      "${cfg.domainRealm}" = cfg.defaultRealm;
+    };
+  };
+
+  mergedConfig = (recursiveUpdate defaultConfig {
+    inherit (config.krb5)
+      kerberos libdefaults realms domain_realm capaths appdefaults plugins
+      extraConfig config;
+  });
+
+  filterEmbeddedMetadata = value: if isAttrs value then
+    (filterAttrs
+      (attrName: attrValue: attrName != "_module" && attrValue != null)
+        value)
+    else value;
+
+  mkIndent = depth: concatStrings (builtins.genList (_:  " ") (2 * depth));
+
+  mkRelation = name: value: "${name} = ${mkVal { inherit value; }}";
+
+  mkVal = { value, depth ? 0 }:
+    if (value == true) then "true"
+    else if (value == false) then "false"
+    else if (isInt value) then (toString value)
+    else if (isList value) then
+      concatMapStringsSep " " mkVal { inherit value depth; }
+    else if (isAttrs value) then
+      (concatStringsSep "\n${mkIndent (depth + 1)}"
+        ([ "{" ] ++ (mapAttrsToList
+          (attrName: attrValue: let
+            mappedAttrValue = mkVal {
+              value = attrValue;
+              depth = depth + 1;
+            };
+          in "${attrName} = ${mappedAttrValue}")
+        value))) + "\n${mkIndent depth}}"
+    else value;
+
+  mkMappedAttrsOrString = value: concatMapStringsSep "\n"
+    (line: if builtins.stringLength line > 0
+      then "${mkIndent 1}${line}"
+      else line)
+    (splitString "\n"
+      (if isAttrs value then
+        concatStringsSep "\n"
+            (mapAttrsToList mkRelation value)
+        else value));
+
+in {
+
+  ###### interface
+
+  options = {
+    krb5 = {
+      enable = mkEnableOption "Whether to enable Kerberos V.";
+
+      kerberos = mkOption {
+        type = types.package;
+        default = pkgs.krb5Full;
+        defaultText = "pkgs.krb5Full";
+        example = literalExample "pkgs.heimdalFull";
+        description = ''
+          The Kerberos implementation that will be present in
+          <literal>environment.systemPackages</literal> after enabling this
+          service.
+        '';
+      };
+
+      libdefaults = mkOption {
+        type = with types; either attrs lines;
+        default = {};
+        apply = attrs: filterEmbeddedMetadata attrs;
+        example = literalExample ''
+          {
+            default_realm = "ATHENA.MIT.EDU";
+          };
+        '';
+        description = ''
+          Settings used by the Kerberos V5 library.
+        '';
+      };
+
+      realms = mkOption {
+        type = with types; either attrs lines;
+        default = {};
+        example = literalExample ''
+          {
+            "ATHENA.MIT.EDU" = {
+              admin_server = "athena.mit.edu";
+              kdc = "athena.mit.edu";
+            };
+          };
+        '';
+        apply = attrs: filterEmbeddedMetadata attrs;
+        description = "Realm-specific contact information and settings.";
+      };
+
+      domain_realm = mkOption {
+        type = with types; either attrs lines;
+        default = {};
+        example = literalExample ''
+          {
+            "example.com" = "EXAMPLE.COM";
+            ".example.com" = "EXAMPLE.COM";
+          };
+        '';
+        apply = attrs: filterEmbeddedMetadata attrs;
+        description = ''
+          Map of server hostnames to Kerberos realms.
+        '';
+      };
+
+      capaths = mkOption {
+        type = with types; either attrs lines;
+        default = {};
+        example = literalExample ''
+          {
+            "ATHENA.MIT.EDU" = {
+              "EXAMPLE.COM" = ".";
+            };
+            "EXAMPLE.COM" = {
+              "ATHENA.MIT.EDU" = ".";
+            };
+          };
+        '';
+        apply = attrs: filterEmbeddedMetadata attrs;
+        description = ''
+          Authentication paths for non-hierarchical cross-realm authentication.
+        '';
+      };
+
+      appdefaults = mkOption {
+        type = with types; either attrs lines;
+        default = {};
+        example = literalExample ''
+          {
+            pam = {
+              debug = false;
+              ticket_lifetime = 36000;
+              renew_lifetime = 36000;
+              max_timeout = 30;
+              timeout_shift = 2;
+              initial_timeout = 1;
+            };
+          };
+        '';
+        apply = attrs: filterEmbeddedMetadata attrs;
+        description = ''
+          Settings used by some Kerberos V5 applications.
+        '';
+      };
+
+      plugins = mkOption {
+        type = with types; either attrs lines;
+        default = {};
+        example = literalExample ''
+          {
+            ccselect = {
+              disable = "k5identity";
+            };
+          };
+        '';
+        apply = attrs: filterEmbeddedMetadata attrs;
+        description = ''
+          Controls plugin module registration.
+        '';
+      };
+
+      extraConfig = mkOption {
+        type = with types; nullOr lines;
+        default = null;
+        example = ''
+          [logging]
+            kdc          = SYSLOG:NOTICE
+            admin_server = SYSLOG:NOTICE
+            default      = SYSLOG:NOTICE
+        '';
+        description = ''
+          These lines go to the end of <literal>krb5.conf</literal> verbatim.
+          <literal>krb5.conf</literal> may include any of the relations that are
+          valid for <literal>kdc.conf</literal> (see <literal>man
+          kdc.conf</literal>), but it is not a recommended practice.
+        '';
+      };
+
+      config = mkOption {
+        type = with types; nullOr lines;
+        default = null;
+        example = ''
+          [libdefaults]
+            default_realm = EXAMPLE.COM
+
+          [realms]
+            EXAMPLE.COM = {
+              admin_server = kerberos.example.com
+              kdc = kerberos.example.com
+              default_principal_flags = +preauth
+            }
+
+          [domain_realm]
+            example.com  = EXAMPLE.COM
+            .example.com = EXAMPLE.COM
+
+          [logging]
+            kdc          = SYSLOG:NOTICE
+            admin_server = SYSLOG:NOTICE
+            default      = SYSLOG:NOTICE
+        '';
+        description = ''
+          Verbatim <literal>krb5.conf</literal> configuration.  Note that this
+          is mutually exclusive with configuration via
+          <literal>libdefaults</literal>, <literal>realms</literal>,
+          <literal>domain_realm</literal>, <literal>capaths</literal>,
+          <literal>appdefaults</literal>, <literal>plugins</literal> and
+          <literal>extraConfig</literal> configuration options.  Consult
+          <literal>man krb5.conf</literal> for documentation.
+        '';
+      };
+
+      defaultRealm = mkOption {
+        type = with types; nullOr str;
+        default = null;
+        example = "ATHENA.MIT.EDU";
+        description = ''
+          DEPRECATED, please use
+          <literal>krb5.libdefaults.default_realm</literal>.
+        '';
+      };
+
+      domainRealm = mkOption {
+        type = with types; nullOr str;
+        default = null;
+        example = "athena.mit.edu";
+        description = ''
+          DEPRECATED, please create a map of server hostnames to Kerberos realms
+          in <literal>krb5.domain_realm</literal>.
+        '';
+      };
+
+      kdc = mkOption {
+        type = with types; nullOr str;
+        default = null;
+        example = "kerberos.mit.edu";
+        description = ''
+          DEPRECATED, please pass a <literal>kdc</literal> attribute to a realm
+          in <literal>krb5.realms</literal>.
+        '';
+      };
+
+      kerberosAdminServer = mkOption {
+        type = with types; nullOr str;
+        default = null;
+        example = "kerberos.mit.edu";
+        description = ''
+          DEPRECATED, please pass an <literal>admin_server</literal> attribute
+          to a realm in <literal>krb5.realms</literal>.
+        '';
+      };
+    };
+  };
+
+  ###### implementation
+
+  config = mkIf cfg.enable {
+
+    environment.systemPackages = [ cfg.kerberos ];
+
+    environment.etc."krb5.conf".text = if isString cfg.config
+      then cfg.config
+      else (''
+        [libdefaults]
+        ${mkMappedAttrsOrString mergedConfig.libdefaults}
+
+        [realms]
+        ${mkMappedAttrsOrString mergedConfig.realms}
+
+        [domain_realm]
+        ${mkMappedAttrsOrString mergedConfig.domain_realm}
+
+        [capaths]
+        ${mkMappedAttrsOrString mergedConfig.capaths}
+
+        [appdefaults]
+        ${mkMappedAttrsOrString mergedConfig.appdefaults}
+
+        [plugins]
+        ${mkMappedAttrsOrString mergedConfig.plugins}
+      '' + optionalString (mergedConfig.extraConfig != null)
+          ("\n" + mergedConfig.extraConfig));
+
+    warnings = flatten [
+      (optional (cfg.defaultRealm != null) ''
+        The option krb5.defaultRealm is deprecated, please use
+        krb5.libdefaults.default_realm.
+      '')
+      (optional (cfg.domainRealm != null) ''
+        The option krb5.domainRealm is deprecated, please use krb5.domain_realm.
+      '')
+      (optional (cfg.kdc != null) ''
+        The option krb5.kdc is deprecated, please pass a kdc attribute to a
+        realm in krb5.realms.
+      '')
+      (optional (cfg.kerberosAdminServer != null) ''
+        The option krb5.kerberosAdminServer is deprecated, please pass an
+        admin_server attribute to a realm in krb5.realms.
+      '')
+    ];
+
+    assertions = [
+      { assertion = !((builtins.any (value: value != null) [
+            cfg.defaultRealm cfg.domainRealm cfg.kdc cfg.kerberosAdminServer
+          ]) && ((builtins.any (value: value != {}) [
+              cfg.libdefaults cfg.realms cfg.domain_realm cfg.capaths
+              cfg.appdefaults cfg.plugins
+            ]) || (builtins.any (value: value != null) [
+              cfg.config cfg.extraConfig
+            ])));
+        message = ''
+          Configuration of krb5.conf by deprecated options is mutually exclusive
+          with configuration by section.  Please migrate your config using the
+          attributes suggested in the warnings.
+        '';
+      }
+      { assertion = !(cfg.config != null
+          && ((builtins.any (value: value != {}) [
+              cfg.libdefaults cfg.realms cfg.domain_realm cfg.capaths
+              cfg.appdefaults cfg.plugins
+            ]) || (builtins.any (value: value != null) [
+              cfg.extraConfig cfg.defaultRealm cfg.domainRealm cfg.kdc
+              cfg.kerberosAdminServer
+            ])));
+        message = ''
+          Configuration of krb5.conf using krb.config is mutually exclusive with
+          configuration by section.  If you want to mix the two, you can pass
+          lines to any configuration section or lines to krb5.extraConfig.
+        '';
+      }
+    ];
+  };
+}
--- a/nixos/modules/config/no-x-libs.nix
+++ b/nixos/modules/config/no-x-libs.nix
@ -35,7 +35,7 @@ with lib;
      networkmanager_pptp = pkgs.networkmanager_pptp.override { withGnome = false; };
      networkmanager_vpnc = pkgs.networkmanager_vpnc.override { withGnome = false; };
      networkmanager_iodine = pkgs.networkmanager_iodine.override { withGnome = false; };
-      pinentry = pkgs.pinentry.override { gtk2 = null; qt4 = null; };
+      pinentry = pkgs.pinentry.override { gcr = null; gtk2 = null; qt4 = null; };
    };
  };
 }
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -9,7 +9,7 @@
  ./config/fonts/ghostscript.nix
  ./config/gnu.nix
  ./config/i18n.nix
-  ./config/krb5.nix
+  ./config/krb5/default.nix
  ./config/ldap.nix
  ./config/networking.nix
  ./config/no-x-libs.nix
@ -269,6 +269,7 @@
  ./services/mail/offlineimap.nix
  ./services/mail/opendkim.nix
  ./services/mail/opensmtpd.nix
+  ./services/mail/pfix-srsd.nix
  ./services/mail/postfix.nix
  ./services/mail/postsrsd.nix
  ./services/mail/postgrey.nix
--- a/nixos/modules/services/mail/pfix-srsd.nix
+++ b/nixos/modules/services/mail/pfix-srsd.nix
@ -0,0 +1,56 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+{
+
+  ###### interface
+
+  options = {
+
+    services.pfix-srsd = {
+      enable = mkOption {
+        default = false;
+        type = types.bool;
+        description = "Whether to run the postfix sender rewriting scheme daemon.";
+      };
+
+      domain = mkOption {
+        description = "The domain for which to enable srs";
+        type = types.str;
+        example = "example.com";
+      };
+
+      secretsFile = mkOption {
+        description = ''
+          The secret data used to encode the SRS address.
+          to generate, use a command like:
+          <literal>for n in $(seq 5); do dd if=/dev/urandom count=1 bs=1024 status=none | sha256sum | sed 's/  -$//' | sed 's/^/          /'; done</literal>
+        '';
+        type = types.path;
+        default = "/var/lib/pfix-srsd/secrets";
+      };
+    };
+  };
+
+  ###### implementation
+
+  config = mkIf config.services.pfix-srsd.enable {
+    environment = {
+      systemPackages = [ pkgs.pfixtools ];
+    };
+
+    systemd.services."pfix-srsd" = {
+      description = "Postfix sender rewriting scheme daemon";
+      before = [ "postfix.service" ];
+      #note that we use requires rather than wants because postfix
+      #is unable to process (almost) all mail without srsd
+      requiredBy = [ "postfix.service" ];
+      serviceConfig = {
+        Type = "forking";
+        PIDFile = "/var/run/pfix-srsd.pid";
+        ExecStart = "${pkgs.pfixtools}/bin/pfix-srsd -p /var/run/pfix-srsd.pid -I ${config.services.pfix-srsd.domain} ${config.services.pfix-srsd.secretsFile}";
+      };
+    };
+  };
+}
--- a/nixos/modules/services/mail/postfix.nix
+++ b/nixos/modules/services/mail/postfix.nix
@ -79,6 +79,12 @@ let
  // optionalAttrs haveTransport { transport_maps = "hash:/etc/postfix/transport"; }
  // optionalAttrs haveVirtual { virtual_alias_maps = "${cfg.virtualMapType}:/etc/postfix/virtual"; }
  // optionalAttrs (cfg.dnsBlacklists != []) { smtpd_client_restrictions = clientRestrictions; }
+  // optionalAttrs cfg.useSrs {
+    sender_canonical_maps = "tcp:127.0.0.1:10001";
+    sender_canonical_classes = "envelope_sender";
+    recipient_canonical_maps = "tcp:127.0.0.1:10002";
+    recipient_canonical_classes= "envelope_recipient";
+  }
  // optionalAttrs cfg.enableHeaderChecks { header_checks = "regexp:/etc/postfix/header_checks"; }
  // optionalAttrs (cfg.sslCert != "") {
    smtp_tls_CAfile = cfg.sslCACert;
@ -626,6 +632,12 @@ in
        description = "Maps to be compiled and placed into /var/lib/postfix/conf.";
      };

+      useSrs = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Whether to enable sender rewriting scheme";
+      };
+
    };

  };
@ -646,6 +658,8 @@ in
        systemPackages = [ pkgs.postfix ];
      };

+      services.pfix-srsd.enable = config.services.postfix.useSrs;
+
      services.mail.sendmailSetuidWrapper = mkIf config.services.postfix.setSendmail {
        program = "sendmail";
        source = "${pkgs.postfix}/bin/sendmail";
--- a/nixos/modules/services/misc/gogs.nix
+++ b/nixos/modules/services/misc/gogs.nix
@ -25,6 +25,7 @@ let
    HTTP_ADDR = ${cfg.httpAddress}
    HTTP_PORT = ${toString cfg.httpPort}
    ROOT_URL = ${cfg.rootUrl}
+    STATIC_ROOT_PATH = ${cfg.staticRootPath}

    [session]
    COOKIE_NAME = session
@ -175,6 +176,13 @@ in
        '';
      };

+      staticRootPath = mkOption {
+        type = types.str;
+        default = "${pkgs.gogs.data}";
+        example = "/var/lib/gogs/data";
+        description = "Upper level of template and static files path.";
+      };
+
      extraConfig = mkOption {
        type = types.str;
        default = "";
@ -195,6 +203,8 @@ in
        runConfig = "${cfg.stateDir}/custom/conf/app.ini";
        secretKey = "${cfg.stateDir}/custom/conf/secret_key";
      in ''
+        mkdir -p ${cfg.stateDir}
+
        # copy custom configuration and generate a random secret key if needed
        ${optionalString (cfg.useWizard == false) ''
          mkdir -p ${cfg.stateDir}/custom/conf
@ -240,7 +250,7 @@ in
      };
    };

-    users = {
+    users = mkIf (cfg.user == "gogs") {
      extraUsers.gogs = {
        description = "Go Git Service";
        uid = config.ids.uids.gogs;
--- a/nixos/modules/virtualisation/ec2-amis.nix
+++ b/nixos/modules/virtualisation/ec2-amis.nix
@ -223,5 +223,21 @@ let self = {
  "17.03".us-west-2.hvm-ebs = "ami-a93daac9";
  "17.03".us-west-2.hvm-s3 = "ami-5139ae31";

-  latest = self."17.03";
+  # 17.09.1483.d0f0657ca0
+  "17.09".eu-west-1.hvm-ebs = "ami-cf33e7b6";
+  "17.09".eu-west-2.hvm-ebs = "ami-7d061419";
+  "17.09".eu-central-1.hvm-ebs = "ami-7548fa1a";
+  "17.09".us-east-1.hvm-ebs = "ami-6f669d15";
+  "17.09".us-east-2.hvm-ebs = "ami-cbe1ccae";
+  "17.09".us-west-1.hvm-ebs = "ami-9d95a5fd";
+  "17.09".us-west-2.hvm-ebs = "ami-d3956fab";
+  "17.09".ca-central-1.hvm-ebs = "ami-ee4ef78a";
+  "17.09".ap-southeast-1.hvm-ebs = "ami-1dfc807e";
+  "17.09".ap-southeast-2.hvm-ebs = "ami-dcb350be";
+  "17.09".ap-northeast-1.hvm-ebs = "ami-00ec3d66";
+  "17.09".ap-northeast-2.hvm-ebs = "ami-1107dd7f";
+  "17.09".sa-east-1.hvm-ebs = "ami-0377086f";
+  "17.09".ap-south-1.hvm-ebs = "ami-4a064625";
+
+  latest = self."17.09";
 }; in self
--- a/nixos/modules/virtualisation/grow-partition.nix
+++ b/nixos/modules/virtualisation/grow-partition.nix
@ -24,7 +24,12 @@ with lib;
      copy_bin_and_libs ${pkgs.gnused}/bin/sed
      copy_bin_and_libs ${pkgs.utillinux}/sbin/sfdisk
      copy_bin_and_libs ${pkgs.utillinux}/sbin/lsblk
-      cp -v ${pkgs.cloud-utils}/bin/.growpart-wrapped $out/bin/growpart
+
+      substitute "${pkgs.cloud-utils}/bin/.growpart-wrapped" "$out/bin/growpart" \
+        --replace "${pkgs.bash}/bin/sh" "/bin/sh" \
+        --replace "awk" "gawk" \
+        --replace "sed" "gnused"
+
      ln -s sed $out/bin/gnused
    '';

--- a/nixos/tests/krb5/default.nix
+++ b/nixos/tests/krb5/default.nix
@ -0,0 +1,5 @@
+{ system ? builtins.currentSystem }:
+{
+  example-config = import ./example-config.nix { inherit system; };
+  deprecated-config = import ./deprecated-config.nix { inherit system; };
+}
--- a/nixos/tests/krb5/deprecated-config.nix
+++ b/nixos/tests/krb5/deprecated-config.nix
@ -0,0 +1,48 @@
+# Verifies that the configuration suggested in deprecated example values
+# will result in the expected output.
+
+import ../make-test.nix ({ pkgs, ...} : {
+  name = "krb5-with-deprecated-config";
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ eqyiel ];
+  };
+
+  machine =
+    { config, pkgs, ... }: {
+      krb5 = {
+        enable = true;
+        defaultRealm = "ATHENA.MIT.EDU";
+        domainRealm = "athena.mit.edu";
+        kdc = "kerberos.mit.edu";
+        kerberosAdminServer = "kerberos.mit.edu";
+      };
+    };
+
+  testScript =
+    let snapshot = pkgs.writeText "krb5-with-deprecated-config.conf" ''
+      [libdefaults]
+        default_realm = ATHENA.MIT.EDU
+
+      [realms]
+        ATHENA.MIT.EDU = {
+          admin_server = kerberos.mit.edu
+          kdc = kerberos.mit.edu
+        }
+
+      [domain_realm]
+        .athena.mit.edu = ATHENA.MIT.EDU
+        athena.mit.edu = ATHENA.MIT.EDU
+
+      [capaths]
+
+
+      [appdefaults]
+
+
+      [plugins]
+
+    '';
+  in ''
+    $machine->succeed("diff /etc/krb5.conf ${snapshot}");
+  '';
+})
--- a/nixos/tests/krb5/example-config.nix
+++ b/nixos/tests/krb5/example-config.nix
@ -0,0 +1,106 @@
+# Verifies that the configuration suggested in (non-deprecated) example values
+# will result in the expected output.
+
+import ../make-test.nix ({ pkgs, ...} : {
+  name = "krb5-with-example-config";
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ eqyiel ];
+  };
+
+  machine =
+    { config, pkgs, ... }: {
+      krb5 = {
+        enable = true;
+        kerberos = pkgs.krb5Full;
+        libdefaults = {
+          default_realm = "ATHENA.MIT.EDU";
+        };
+        realms = {
+          "ATHENA.MIT.EDU" = {
+            admin_server = "athena.mit.edu";
+            kdc = "athena.mit.edu";
+          };
+        };
+        domain_realm = {
+          "example.com" = "EXAMPLE.COM";
+          ".example.com" = "EXAMPLE.COM";
+        };
+        capaths = {
+          "ATHENA.MIT.EDU" = {
+            "EXAMPLE.COM" = ".";
+          };
+          "EXAMPLE.COM" = {
+            "ATHENA.MIT.EDU" = ".";
+          };
+        };
+        appdefaults = {
+          pam = {
+            debug = false;
+            ticket_lifetime = 36000;
+            renew_lifetime = 36000;
+            max_timeout = 30;
+            timeout_shift = 2;
+            initial_timeout = 1;
+          };
+        };
+        plugins = {
+          ccselect = {
+            disable = "k5identity";
+          };
+        };
+        extraConfig = ''
+          [logging]
+            kdc          = SYSLOG:NOTICE
+            admin_server = SYSLOG:NOTICE
+            default      = SYSLOG:NOTICE
+        '';
+      };
+    };
+
+  testScript =
+    let snapshot = pkgs.writeText "krb5-with-example-config.conf" ''
+      [libdefaults]
+        default_realm = ATHENA.MIT.EDU
+
+      [realms]
+        ATHENA.MIT.EDU = {
+          admin_server = athena.mit.edu
+          kdc = athena.mit.edu
+        }
+
+      [domain_realm]
+        .example.com = EXAMPLE.COM
+        example.com = EXAMPLE.COM
+
+      [capaths]
+        ATHENA.MIT.EDU = {
+          EXAMPLE.COM = .
+        }
+        EXAMPLE.COM = {
+          ATHENA.MIT.EDU = .
+        }
+
+      [appdefaults]
+        pam = {
+          debug = false
+          initial_timeout = 1
+          max_timeout = 30
+          renew_lifetime = 36000
+          ticket_lifetime = 36000
+          timeout_shift = 2
+        }
+
+      [plugins]
+        ccselect = {
+          disable = k5identity
+        }
+
+      [logging]
+        kdc          = SYSLOG:NOTICE
+        admin_server = SYSLOG:NOTICE
+        default      = SYSLOG:NOTICE
+    '';
+  in ''
+    $machine->succeed("diff /etc/krb5.conf ${snapshot}");
+  '';
+})
--- a/pkgs/applications/altcoins/default.nix
+++ b/pkgs/applications/altcoins/default.nix
@ -1,4 +1,4 @@
-{ callPackage, boost155, boost162, boost163, openssl_1_1_0, haskellPackages }:
+{ callPackage, boost155, boost162, boost163, openssl_1_1_0, haskellPackages, darwin }:

 rec {

@ -26,7 +26,10 @@ rec {
  dogecoind = callPackage ./dogecoin.nix { withGui = false; };

  freicoin = callPackage ./freicoin.nix { boost = boost155; };
-  go-ethereum = callPackage ./go-ethereum.nix { };
+  go-ethereum = callPackage ./go-ethereum.nix {
+    inherit (darwin) libobjc;
+    inherit (darwin.apple_sdk.frameworks) IOKit;
+  };
  go-ethereum-classic = callPackage ./go-ethereum-classic { };

  hivemind = callPackage ./hivemind.nix { withGui = true; };
--- a/pkgs/applications/altcoins/go-ethereum.nix
+++ b/pkgs/applications/altcoins/go-ethereum.nix
@ -1,10 +1,14 @@
-{ stdenv, lib, buildGoPackage, fetchFromGitHub }:
+{ stdenv, lib, buildGoPackage, fetchFromGitHub, libobjc, IOKit }:

 buildGoPackage rec {
  name = "go-ethereum-${version}";
  version = "1.7.0";
  goPackagePath = "github.com/ethereum/go-ethereum";

+  # Fix for usb-related segmentation faults on darwin
+  propagatedBuildInputs =
+    stdenv.lib.optionals stdenv.isDarwin [ libobjc IOKit ];
+
  # Fixes Cgo related build failures (see https://github.com/NixOS/nixpkgs/issues/25959 )
  hardeningDisable = [ "fortify" ];

--- a/pkgs/applications/audio/mpc/default.nix
+++ b/pkgs/applications/audio/mpc/default.nix
@ -17,11 +17,6 @@ stdenv.mkDerivation rec {

  enableParallelBuilding = true;

-  preConfigure = ''
-    export LIBMPDCLIENT_LIBS=${mpd_clientlib}/lib/libmpdclient.${if stdenv.isDarwin then mpd_clientlib.majorVersion + ".dylib" else "so." + mpd_clientlib.majorVersion + ".0." + mpd_clientlib.minorVersion}
-    export LIBMPDCLIENT_CFLAGS=${mpd_clientlib}
-  '';
-
  meta = with stdenv.lib; {
    description = "A minimalist command line interface to MPD";
    homepage = http://www.musicpd.org/clients/mpc/;
--- a/pkgs/applications/audio/ncmpc/default.nix
+++ b/pkgs/applications/audio/ncmpc/default.nix
@ -1,36 +1,35 @@
-{ stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, glib, ncurses, mpd_clientlib, libintlOrEmpty }:
+{ stdenv, fetchFromGitHub, meson, ninja, pkgconfig, glib, ncurses
+, mpd_clientlib, gettext }:

-stdenv.mkDerivation rec {
+let
+  rpath = stdenv.lib.makeLibraryPath [
+    glib ncurses mpd_clientlib
+  ];
+in stdenv.mkDerivation rec {
  name = "ncmpc-${version}";
-  version = "0.27";
+  version = "0.28";

  src = fetchFromGitHub {
    owner  = "MusicPlayerDaemon";
    repo   = "ncmpc";
    rev    = "v${version}";
-    sha256 = "0sfal3wadqvy6yas4xzhw35awdylikci8kbdcmgm4l2afpmc1lrr";
+    sha256 = "1z0bdkqsdb3f5k2lsws3qzav4r30fzk8fhxj9l0p738flcka6k4n";
  };

  buildInputs = [ glib ncurses mpd_clientlib ];
-    # ++ libintlOrEmpty;
-  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  nativeBuildInputs = [ meson ninja pkgconfig gettext ];

-  NIX_LDFLAGS = stdenv.lib.optionalString stdenv.isDarwin "-lintl";
-
-  # without this, po/Makefile.in.in is not being created
-  preAutoreconf = ''
-    ./autogen.sh
+  postFixup = ''
+    for elf in "$out"/bin/*; do
+      patchelf --set-rpath '${rpath}':"$out/lib" "$elf"
+    done
  '';

-  configureFlags = [
-    "--enable-colors"
-    "--enable-lyrics-screen"
-  ];
-
  meta = with stdenv.lib; {
    description = "Curses-based interface for MPD (music player daemon)";
    homepage    = http://www.musicpd.org/clients/ncmpc/;
    license     = licenses.gpl2Plus;
    platforms   = platforms.all;
+    maintainers = with maintainers; [ fpletz ];
  };
 }
--- a/pkgs/applications/editors/eclipse/plugins.nix
+++ b/pkgs/applications/editors/eclipse/plugins.nix
@ -447,6 +447,28 @@ rec {
    };
  };

+  vrapper = buildEclipseUpdateSite rec {
+    name = "vrapper-${version}";
+    version = "0.72.0";
+    owner = "vrapper";
+    repo = "vrapper";
+    date = "20170311";
+
+    src = fetchzip {
+      stripRoot = false;
+      url = "https://github.com/${owner}/${repo}/releases/download/${version}/vrapper_${version}_${date}.zip";
+      sha256 = "0nyirf6km97q211cxfy01kidxac20m8ba3kk9xj73ykrhsk3cxjp";
+    };
+
+    meta = with stdenv.lib; {
+      homepage = "https://github.com/vrapper/vrapper";
+      description = "A wrapper to provide a Vim-like input scheme for moving around and editing text";
+      license = licenses.gpl3;
+      platforms = platforms.all;
+      maintainers = [ maintainers.stumoss ];
+    };
+  };
+
  yedit = buildEclipsePlugin rec {
    name = "yedit-${version}";
    version = "1.0.20.201509041456";
--- a/pkgs/applications/misc/far2l/default.nix
+++ b/pkgs/applications/misc/far2l/default.nix
@ -1,29 +1,34 @@
 { stdenv, fetchFromGitHub, makeWrapper, cmake, pkgconfig, wxGTK30, glib, pcre, m4, bash,
-  xdg_utils, gvfs, zip, unzip, gzip, bzip2, gnutar, p7zip, xz, imagemagick }:
+  xdg_utils, gvfs, zip, unzip, gzip, bzip2, gnutar, p7zip, xz, imagemagick, darwin }:

+with stdenv.lib;
 stdenv.mkDerivation rec {
-  rev = "de5554dbc0ec69329b75777d4a3b2f01851fc5ed";
-  build = "unstable-2017-07-13.git${builtins.substring 0 7 rev}";
+  rev = "1ecd3a37c7b866a4599c547ea332541de2a2af26";
+  build = "unstable-2017-09-30.git${builtins.substring 0 7 rev}";
  name = "far2l-2.1.${build}";

  src = fetchFromGitHub {
    owner = "elfmz";
    repo = "far2l";
    rev = rev;
-    sha256 = "07l8w9p6zxm9qgh9wlci584lgv8gd4aw742jaqh9acgkxy9caih8";
+    sha256 = "0mavg9z1n81b1hbkj320m36r8lpw28j07rl1d2hpg69y768yyq05";
  };

  nativeBuildInputs = [ cmake pkgconfig m4 makeWrapper imagemagick ];

-  buildInputs = [ wxGTK30 glib pcre ];
+  buildInputs = [ wxGTK30 glib pcre ]
+    ++ optional stdenv.isDarwin darwin.apple_sdk.frameworks.Cocoa;

  patches = [ ./add-nix-syntax-highlighting.patch ];

-  postPatch = ''
-    echo 'echo ${build}' > far2l/bootstrap/scripts/vbuild.sh
-
-    substituteInPlace far2l/bootstrap/open.sh              \
+  postPatch = optionalString stdenv.isLinux ''
+    substituteInPlace far2l/bootstrap/open.sh \
      --replace 'gvfs-trash'  '${gvfs}/bin/gvfs-trash'
+  '' + optionalString stdenv.isDarwin ''
+    substituteInPlace far2l/CMakeLists.txt \
+      --replace "-framework System" -lSystem
+  '' + ''
+    echo 'echo ${build}' > far2l/bootstrap/scripts/vbuild.sh
    substituteInPlace far2l/bootstrap/open.sh              \
      --replace 'xdg-open'    '${xdg_utils}/bin/xdg-open'
    substituteInPlace far2l/vtcompletor.cpp                \
@ -62,7 +67,7 @@ stdenv.mkDerivation rec {

  enableParallelBuilding = true;

-  meta = with stdenv.lib; {
+  meta = {
    description = "An orthodox file manager";
    homepage = https://github.com/elfmz/far2l;
    license = licenses.gpl2;
--- a/pkgs/applications/misc/gqrx/default.nix
+++ b/pkgs/applications/misc/gqrx/default.nix
@ -8,13 +8,13 @@ assert pulseaudioSupport -> libpulseaudio != null;

 stdenv.mkDerivation rec {
  name = "gqrx-${version}";
-  version = "2.7";
+  version = "2.8";

  src = fetchFromGitHub {
    owner = "csete";
    repo = "gqrx";
    rev = "v${version}";
-    sha256 = "1dslb8l8ggj6vf9257c2bj0z8z1wy9c6sr2zksp5jdgf8m4j71im";
+    sha256 = "0niy4c05886mhbfmix93j2bnj4kzdh9bvrmymawl6z28glyz5d3c";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/misc/josm/default.nix
+++ b/pkgs/applications/misc/josm/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name = "josm-${version}";
-  version = "12712";
+  version = "12914";

  src = fetchurl {
    url = "https://josm.openstreetmap.de/download/josm-snapshot-${version}.jar";
-    sha256 = "0lpz4yzkvjpn5g36nibrkh773jnlkiqj6lghsx69i86h0xfb7gqf";
+    sha256 = "104yih9xfgkpcqg8sqgwkpij2l6pwm12jx6kif45j11sg7hxlh8x";
  };

  buildInputs = [ jre8 makeWrapper ];
--- a/pkgs/applications/misc/octoprint/default.nix
+++ b/pkgs/applications/misc/octoprint/default.nix
@ -91,6 +91,8 @@ in pythonPackages.buildPythonApplication rec {
      -e 's,psutil>=[^"]*,psutil,g' \
      -e 's,requests>=[^"]*,requests,g' \
      -e 's,future>=[^"]*,future,g' \
+      -e 's,pyserial>=[^"]*,pyserial,g' \
+      -e 's,semantic_version>=[^"]*,semantic_version,g' \
      setup.py
  '';

--- a/pkgs/applications/misc/pcmanx-gtk2/default.nix
+++ b/pkgs/applications/misc/pcmanx-gtk2/default.nix
@ -18,7 +18,7 @@ stdenv.mkDerivation {
    homepage = http://pcman.ptt.cc;
    license = licenses.gpl2;
    description = "Telnet BBS browser with GTK+ interface";
-    maintainers = [ maintainers.mingchuan ];
+    maintainers = [ maintainers.sifmelcara ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/misc/rescuetime/default.nix
+++ b/pkgs/applications/misc/rescuetime/default.nix
@ -9,14 +9,14 @@ let
    } else fetchurl {
      name = "rescuetime-installer.deb";
      url = "https://www.rescuetime.com/installers/rescuetime_current_amd64.deb";
-      sha256 = "161f71kvcrilv9qxldwn8xsqs2g9c2f2g9wb5brbfc0lqbbc8n89";
+      sha256 = "1xjwaqz0gs12ndgw7c2f1nkvj0nqcl0bxhd54pwk0dwrx9pn9avz";
    };

 in

 stdenv.mkDerivation {
  # https://www.rescuetime.com/updates/linux_release_notes.html
-  name = "rescuetime-2.9.11.1285";
+  name = "rescuetime-2.9.11.1300";
  inherit src;
  buildInputs = [ dpkg makeWrapper ];
  unpackPhase = ''
--- a/pkgs/applications/misc/tint2/default.nix
+++ b/pkgs/applications/misc/tint2/default.nix
@ -6,13 +6,13 @@

 stdenv.mkDerivation rec {
  name = "tint2-${version}";
-  version = "15.1";
+  version = "15.2";

  src = fetchFromGitLab {
    owner = "o9000";
    repo = "tint2";
    rev = version;
-    sha256 = "16mpvknibbqy0vjgkwig7g8i6rivm14ipd7ixvqydgcj7wibn0b7";
+    sha256 = "1lfk3zcgmmlby353gs70gpi0m28nx2c20wxqgaw7268a69r5cz7a";
  };

  enableParallelBuilding = true;
@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
    homepage = https://gitlab.com/o9000/tint2;
    description = "Simple panel/taskbar unintrusive and light (memory, cpu, aestetic)";
    license = stdenv.lib.licenses.gpl2;
-    platforms = stdenv.lib.platforms.unix;
+    platforms = stdenv.lib.platforms.linux;
    maintainers = [ stdenv.lib.maintainers.romildo ];
  };
 }
--- a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
+++ b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
@ -98,7 +98,7 @@ let
  fteLibPath = makeLibraryPath [ stdenv.cc.cc gmp ];

  # Upstream source
-  version = "7.0.5";
+  version = "7.0.6";

  lang = "en-US";

@ -108,7 +108,7 @@ let
        "https://github.com/TheTorProject/gettorbrowser/releases/download/v${version}/tor-browser-linux64-${version}_${lang}.tar.xz"
        "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz"
      ];
-      sha256 = "1ixa1pmh3fm82gwzkm7r3gbly1lrihpvk1irmpc8b8zsi2s49ghd";
+      sha256 = "11z3r0577p78ifi9lk4lrh9wb46k77wy77g5p9l8il02760bgq6m";
    };

    "i686-linux" = fetchurl {
@ -116,7 +116,7 @@ let
        "https://github.com/TheTorProject/gettorbrowser/releases/download/v${version}/tor-browser-linux32-${version}_${lang}.tar.xz"
        "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux32-${version}_${lang}.tar.xz"
      ];
-      sha256 = "1kb0m4xikxcgj03h6l0ch5d53i8hxdacwm7q745a377g44q84nzb";
+      sha256 = "1r8v5w66clmm76kzpkf0f5jcxs76whb5xrl20rkirp79fybqn4hx";
    };
  };
 in
--- a/pkgs/applications/networking/browsers/tor-browser-bundle/default.nix
+++ b/pkgs/applications/networking/browsers/tor-browser-bundle/default.nix
@ -36,6 +36,9 @@
 , python27Packages
 , rsync

+# Pluggable transports
+, obfsproxy
+
 # Customization
 , extraPrefs ? ""
 , extraExtensions ? [ ]
@ -165,8 +168,27 @@ stdenv.mkDerivation rec {
      >> $TBDATA_PATH/torrc-defaults
    cat \
      $bundleData/$bundlePlatform/Data/Browser/profile.default/preferences/extension-overrides.js \
+      $bundleData/PTConfigs/bridge_prefs.js \
      >> defaults/pref/extension-overrides.js

+    # Configure geoip
+    #
+    # tor-launcher insists on resolving geoip data relative to torrc-defaults
+    # (and passes them directly on the tor command-line).
+    #
+    # Write the paths into torrc-defaults anyway, otherwise they'll be
+    # captured in the runtime torrc.
+    ln -s -t $TBDATA_PATH ${tor.geoip}/share/tor/geoip{,6}
+    cat >>$TBDATA_PATH/torrc-defaults <<EOF
+    GeoIPFile $TBDATA_IN_STORE/geoip
+    GeoIPv6File $TBDATA_IN_STORE/geoip6
+    EOF
+
+    # Configure pluggable transports
+    cat >>$TBDATA_PATH/torrc-defaults <<EOF
+    ClientTransportPlugin obfs2,obfs3 exec ${obfsproxy}/bin/obfsproxy managed
+    EOF
+
    # Hard-code path to TBB fonts; xref: FONTCONFIG_FILE in the wrapper below
    sed $bundleData/$bundlePlatform/Data/fontconfig/fonts.conf \
        -e "s,<dir>fonts</dir>,<dir>${fontsDir}</dir>," \
--- a/pkgs/applications/networking/browsers/tor-browser-bundle/extensions.nix
+++ b/pkgs/applications/networking/browsers/tor-browser-bundle/extensions.nix
@ -16,15 +16,15 @@
 {
  https-everywhere = stdenv.mkDerivation rec {
    name = "https-everywhere-${version}";
-    version = "5.2.21";
+    version = "2017.9.12";

    extid = "https-everywhere-eff@eff.org";

    src = fetchgit {
      url = "https://git.torproject.org/https-everywhere.git";
      rev = "refs/tags/${version}";
-      sha256 = "0z9madihh4b4z4blvfmh6w1hsv8afyi0x7b243nciq9r4w55xgfa";
-      fetchSubmodules = true;
+      sha256 = "179429pngyksp9xkr86nf2m5q6zmg19c7ng1dhqjfb1vsncwgw66";
+      fetchSubmodules = true; # for translations, TODO: remove
    };

    nativeBuildInputs = [
--- a/pkgs/applications/networking/ipfs/default.nix
+++ b/pkgs/applications/networking/ipfs/default.nix
@ -2,15 +2,15 @@

 buildGoPackage rec {
  name = "ipfs-${version}";
-  version = "0.4.10";
-  rev = "4679f806bd00c0a5299c22c82d1fbfdbad928e6d";
+  version = "0.4.11";
+  rev = "v${version}";

  goPackagePath = "github.com/ipfs/go-ipfs";

  extraSrcPaths = [
    (fetchgx {
      inherit name src;
-      sha256 = "1khlsahv9vqx3h2smif5wdyb56jrza415hqid7883pqimfi66g3x";
+      sha256 = "1n8xr9xg23wm255zjm7nxd761xapmsv11a0giks2gaibh4nps1jl";
    })
  ];

@ -18,7 +18,7 @@ buildGoPackage rec {
    owner = "ipfs";
    repo = "go-ipfs";
    inherit rev;
-    sha256 = "1j3az0nhjisb5dxp1a4g8w17y17xjikvcsy4qrg0fm43ybpkhhvw";
+    sha256 = "1qi87sq490xpj4mip1d30x4v77gkacnw4idm0mwla92pg44v6wh9";
  };

  meta = with stdenv.lib; {
--- a/pkgs/applications/science/biology/bcftools/default.nix
+++ b/pkgs/applications/science/biology/bcftools/default.nix
@ -1,17 +1,18 @@
-{ stdenv, fetchurl, htslib, zlib, bzip2, lzma, perl }:
+{ stdenv, fetchurl, htslib, zlib, bzip2, lzma, curl, perl, bash }:

 stdenv.mkDerivation rec {
  name = "${pname}-${version}";
  pname = "bcftools";
-  major = "1.5";
-  version = "${major}.0";
+  version = "1.6";

  src = fetchurl {
-    url = "https://github.com/samtools/bcftools/releases/download/${major}/bcftools-${major}.tar.bz2";
-    sha256 = "0093hkkvxmbwfaa7905s6185jymynvg42kq6sxv7fili11l5mxwz";
+    url = "https://github.com/samtools/bcftools/releases/download/${version}/${name}.tar.bz2";
+    sha256 = "10prgmf09a13mk18840938ijqgfc9y92hfc7sa2gcv07ddri0c19";
  };

-  buildInputs = [ zlib bzip2 lzma perl ];
+  nativeBuildInputs = [ perl ];
+
+  buildInputs = [ htslib zlib bzip2 lzma curl ];

  makeFlags = [
    "HSTDIR=${htslib}"
@ -19,6 +20,16 @@ stdenv.mkDerivation rec {
    "CC=cc"
  ];

+  preCheck = ''
+    patchShebangs misc/
+    patchShebangs test/
+    sed -ie 's|/bin/bash|${bash}/bin/bash|' test/test.pl
+  '';
+
+  enableParallelBuilding = true;
+
+  doCheck = true;
+
  meta = with stdenv.lib; {
    description = "Tools for manipulating BCF2/VCF/gVCF format, SNP and short indel sequence variants";
    license = licenses.mit;
--- a/pkgs/applications/science/biology/samtools/default.nix
+++ b/pkgs/applications/science/biology/samtools/default.nix
@ -1,21 +1,30 @@
-{ stdenv, fetchurl, zlib, htslib,  ncurses ? null }:
+{ stdenv, fetchurl, zlib, htslib, perl, ncurses ? null }:

 stdenv.mkDerivation rec {
  name = "${pname}-${version}";
  pname = "samtools";
-  major = "1.5";
-  version = "${major}.0";
+  version = "1.6";

  src = fetchurl {
-    url = "https://github.com/samtools/samtools/releases/download/${major}/samtools-${major}.tar.bz2";
-    sha256 = "1xidmv0jmfy7l0kb32hdnlshcxgzi1hmygvig0cqrq1fhckdlhl5";
+    url = "https://github.com/samtools/samtools/releases/download/${version}/${name}.tar.bz2";
+    sha256 = "17p4vdj2j2qr3b2c0v4100h6cg4jj3zrb4dmdnd9d9aqs74d4p7f";
  };

-  buildInputs = [ zlib ncurses ];
+  nativeBuildInputs = [ perl ];
+
+  buildInputs = [ zlib ncurses htslib ];

  configureFlags = [ "--with-htslib=${htslib}" ]
    ++ stdenv.lib.optional (ncurses == null) "--without-curses";

+  preCheck = ''
+    patchShebangs test/
+  '';
+
+  enableParallelBuilding = true;
+
+  doCheck = true;
+
  meta = with stdenv.lib; {
    description = "Tools for manipulating SAM/BAM/CRAM format";
    license = licenses.mit;
--- a/pkgs/applications/science/logic/tptp/default.nix
+++ b/pkgs/applications/science/logic/tptp/default.nix
@ -2,14 +2,14 @@

 stdenv.mkDerivation rec {
  name = "TPTP-${version}";
-  version = "6.4.0";
+  version = "7.0.0";

  src = fetchurl {
    url = [
      "http://www.cs.miami.edu/~tptp/TPTP/Distribution/TPTP-v${version}.tgz"
-      "http://www.cs.miami.edu/~tptp/TPTP/Archive/TPTP-v${version}/TPTP-v${version}.tgz"
+      "http://www.cs.miami.edu/~tptp/TPTP/Archive/TPTP-v${version}.tgz"
    ];
-    sha256 = "17mnqxnyibmzf5vvbnyhsd010zykqw8ikx4pvyj0x9sfyhpvgfix";
+    sha256 = "13rm76lqlgbv15p8as0dpc74z2dfv5xydkhnd0hm3hhi3mn39dk9";
  };

  buildInputs = [ tcsh yap perl patchelf ];
--- a/pkgs/applications/version-management/gogs/default.nix
+++ b/pkgs/applications/version-management/gogs/default.nix
@ -16,9 +16,12 @@ buildGoPackage rec {
    sha256 = "1xn1b4dxf7r8kagps3yvp31zskfxn50k1gfic9abl4kjwpwk78c0";
  };

-  patchPhase = ''
+  patches = [ ./static-root-path.patch ];
+
+  postPatch = ''
    patchShebangs .
-    '';
+    substituteInPlace pkg/setting/setting.go --subst-var data
+  '';

  nativeBuildInputs = [ makeWrapper ];

@ -33,10 +36,7 @@ buildGoPackage rec {
    cp -R $src/{public,templates} $data

    wrapProgram $bin/bin/gogs \
-      --prefix PATH : ${makeBinPath [ bash git gzip openssh ]} \
-      --run 'export GOGS_WORK_DIR=''${GOGS_WORK_DIR:-$PWD}' \
-      --run 'mkdir -p "$GOGS_WORK_DIR" && cd "$GOGS_WORK_DIR"' \
-      --run "ln -fs $data/{public,templates} ."
+      --prefix PATH : ${makeBinPath [ bash git gzip openssh ]}
  '';

  goPackagePath = "github.com/gogits/gogs";
--- a/pkgs/applications/version-management/gogs/static-root-path.patch
+++ b/pkgs/applications/version-management/gogs/static-root-path.patch
@ -0,0 +1,13 @@
+diff --git a/pkg/setting/setting.go b/pkg/setting/setting.go
+index f206592d..796da6ef 100644
+--- a/pkg/setting/setting.go
+++ b/pkg/setting/setting.go
+@@ -474,7 +474,7 @@ func NewContext() {
+ 	LocalURL = sec.Key("LOCAL_ROOT_URL").MustString(string(Protocol) + "://localhost:" + HTTPPort + "/")
+ 	OfflineMode = sec.Key("OFFLINE_MODE").MustBool()
+ 	DisableRouterLog = sec.Key("DISABLE_ROUTER_LOG").MustBool()
+-	StaticRootPath = sec.Key("STATIC_ROOT_PATH").MustString(workDir)
+	StaticRootPath = sec.Key("STATIC_ROOT_PATH").MustString("@data@")
+ 	AppDataPath = sec.Key("APP_DATA_PATH").MustString("data")
+ 	EnableGzip = sec.Key("ENABLE_GZIP").MustBool()
+ 
--- a/pkgs/applications/video/vlc/default.nix
+++ b/pkgs/applications/video/vlc/default.nix
@ -11,6 +11,7 @@
 , qt4 ? null
 , withQt5 ? false, qtbase ? null, qtx11extras ? null
 , jackSupport ? false
+, fetchpatch
 }:

 with stdenv.lib;
@ -27,6 +28,14 @@ stdenv.mkDerivation rec {
    sha256 = "1a22b913p2227ljz89c4fgjlyln5gcz8z58w32r0wh4srnnd60y4";
  };

+  patches = [
+    (fetchpatch {
+      name = "CVE-2017-9300.patch";
+      url = "https://git.videolan.org/?p=vlc/vlc-2.2.git;a=patch;h=55a82442cfea9dab8b853f3a4610f2880c5fadf3;hp=dbe888f9ca9c3b102478b4a16a3d1d985c267899";
+      sha256 = "0l0fwqkn31lggwc5dkhb58gkv8pc6ng51y0izjigqvfqvhwdnzxn";
+    })
+  ];
+
  # Comment-out the Qt 5.5 version check, as we do apply the relevant patch.
  # https://trac.videolan.org/vlc/ticket/16497
  postPatch = if (!withQt5) then null else
--- a/pkgs/data/misc/brise/default.nix
+++ b/pkgs/data/misc/brise/default.nix
@ -0,0 +1,41 @@
+{ stdenv, fetchFromGitHub, librime }:
+
+stdenv.mkDerivation rec {
+  name = "brise-unstable-2017-09-16";
+
+  src = fetchFromGitHub {
+    owner = "rime";
+    repo = "brise";
+    rev = "1cfb0fe1d3a4190ce5d034f141941156dd271e80";
+    sha256 = "1l13j3cfwida0ycl874fizz2jwjvlxid589a1iciqa9y25k21ql7";
+  };
+
+  buildInputs = [ librime ];
+
+  postPatch = ''
+    patchShebangs scripts/*
+  '';
+
+  # we need to use fetchFromGitHub to fetch sub-packages before we 'make',
+  # since nix won't allow networking during 'make'
+  preBuild = import ./fetchPackages.nix fetchFromGitHub;
+
+  makeFlags = [ "BRISE_BUILD_BINARIES=yes" "PREFIX=$(out)" ];
+
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
+    description = "Rime Schema Repository";
+    longDescription = ''
+      This software is a collection of data packages used by Rime
+      to support various Chinese input methods, including those based on
+      modern dialects or historical diasystems of the Chinese language.
+    '';
+    homepage = http://rime.im;
+    # Note that individual packages in this collection
+    # may be released under different licenses
+    license = licenses.gpl3;
+    platforms = platforms.all;
+    maintainers = [ maintainers.sifmelcara ];
+  };
+}
--- a/pkgs/data/misc/brise/fetchPackages.nix
+++ b/pkgs/data/misc/brise/fetchPackages.nix
@ -0,0 +1,130 @@
+fetchFromGitHub:
+# generated using https://gist.github.com/sifmelcara/895c71f99500b9d56d68e9a866b58821
+''
+ln -sv ${fetchFromGitHub {
+  owner = "rime";
+  repo = "rime-array";
+  rev = "9ca2b725ae52c9b3185213e3555df1f9d4f1c53f";
+  sha256 = "0x3sifdpdivr8ssynjhc4g1zfl6h9hm9nh9p9zb9wkh1ky9z7kha";
+}} array
+ln -sv ${fetchFromGitHub {
+  owner = "rime";
+  repo = "rime-bopomofo";
+  rev = "7046ffe42b46915947117f80d901fb9a6e19c1a7";
+  sha256 = "09w8jl2dlgp72k49x0l2jiaqb359v576kai4xww6cljgr24ng8pl";
+}} bopomofo
+ln -sv ${fetchFromGitHub {
+  owner = "rime";
+  repo = "rime-cangjie";
+  rev = "64242be99c1e6793c9f40fef296a81d07a84e976";
+  sha256 = "0v5sk8zrm5p5gg8lszqm0imj9jswjlnfq87nw6m9pg5h5al230ja";
+}} cangjie
+ln -sv ${fetchFromGitHub {
+  owner = "rime";
+  repo = "rime-combo-pinyin";
+  rev = "97a7dc4670e0f90ad28e7d67c1543f4f0adc531d";
+  sha256 = "0y8iyvq7z6xj3lk2ppk4ggz297wn1r2xxbv53f2710jc7gyzf04q";
+}} combo-pinyin
+ln -sv ${fetchFromGitHub {
+  owner = "rime";
+  repo = "rime-double-pinyin";
+  rev = "1b75af4239897fd1e4c99d625b62093e66baff14";
+  sha256 = "0p54qx5a6rr55hl997kdcfxjczd9lcddrc5xsy7nhlfyc6108s2v";
+}} double-pinyin
+ln -sv ${fetchFromGitHub {
+  owner = "rime";
+  repo = "rime-emoji";
+  rev = "7e527056fe055237fee59463e0d445f3909aaf0c";
+  sha256 = "04d35n254viw29yyjf3ml7xljmi63sqgg870swlbi5bikcx7n9jf";
+}} emoji
+ln -sv ${fetchFromGitHub {
+  owner = "rime";
+  repo = "rime-essay";
+  rev = "595e35756d16d57d09405e243302b65b4384b5b4";
+  sha256 = "10kqhvrz8x17b2pf6x2x2znz5y6cj05c4rgwi1f0xhxiyrgjw9gm";
+}} essay
+ln -sv ${fetchFromGitHub {
+  owner = "rime";
+  repo = "rime-ipa";
+  rev = "9e02f8a02e9febb7b2df25f6906881a1df934811";
+  sha256 = "1g4v4j1gnv1qspfz88liwj1aa4gaa3aax0x2cif4vxicsm7w372m";
+}} ipa
+ln -sv ${fetchFromGitHub {
+  owner = "rime";
+  repo = "rime-jyutping";
+  rev = "3cc76e6e15cc05f1f94b89e750c21f87ce8fc0e4";
+  sha256 = "1yggz0yb84z8810s2gmsxkm9lh57fdzddx5v2rb5mqcwnimsd6ap";
+}} jyutping
+ln -sv ${fetchFromGitHub {
+  owner = "rime";
+  repo = "rime-luna-pinyin";
+  rev = "da00c3a6f932f094666e98a09f6ce9c7d74c334c";
+  sha256 = "0q3g1hj9bay5865h3pz7gv46d7wfka1jdxnddxcbp4zn7gjpsd48";
+}} luna-pinyin
+ln -sv ${fetchFromGitHub {
+  owner = "rime";
+  repo = "rime-middle-chinese";
+  rev = "6f9731bac8f289f77d35f1090159f1937e38c1f7";
+  sha256 = "0xd9iwk4j5043gfmp7rb57hbarfm6sxr32wiasi6p3c5g355zn89";
+}} middle-chinese
+ln -sv ${fetchFromGitHub {
+  owner = "rime";
+  repo = "rime-pinyin-simp";
+  rev = "38c08403c22845f7e2965c1d7a1514b41755d7dc";
+  sha256 = "1c0cqljx3d93w27y2flxyqcfd3rd9fvixbw6mxgfjzdb3s42bn8h";
+}} pinyin-simp
+ln -sv ${fetchFromGitHub {
+  owner = "rime";
+  repo = "rime-prelude";
+  rev = "120c2aa73b1b5e1bce904901bf13f506295004a5";
+  sha256 = "1aah9z58gkqrc18zadsq598ybj8ra22bgka3gma2jmi3rls2znq4";
+}} prelude
+ln -sv ${fetchFromGitHub {
+  owner = "rime";
+  repo = "rime-quick";
+  rev = "638abf270e121bc2bfc6029a14ee85a3f4c2188b";
+  sha256 = "0l1pma0yxrypnb5cq7jiczy0wa42kdqsc1brqkkccdnp08pa1p1m";
+}} quick
+ln -sv ${fetchFromGitHub {
+  owner = "rime";
+  repo = "rime-scj";
+  rev = "6b74ce14be0464bf076d7adc40aea4b120f233ec";
+  sha256 = "0lr92knr41mlqd1s0g2lh2h2qr8xka1s46x7iv4d6ghjf0id4gz6";
+}} scj
+ln -sv ${fetchFromGitHub {
+  owner = "rime";
+  repo = "rime-soutzoe";
+  rev = "3ab93d1b9ca9ca7cf17ff32bb4418b7a095afc3c";
+  sha256 = "1glbvgzx4psasq23511k8ymd7mf1pqvm3z18nzszhs00iif66s3m";
+}} soutzoe
+ln -sv ${fetchFromGitHub {
+  owner = "rime";
+  repo = "rime-stenotype";
+  rev = "766f22565f83f5c63c0ea195c936779ec6ae824d";
+  sha256 = "0jsvfq7xim99zs5imyk7rpknlaimk6nlxy38fmfxa1r843781mfd";
+}} stenotype
+ln -sv ${fetchFromGitHub {
+  owner = "rime";
+  repo = "rime-stroke";
+  rev = "e048967a4c1b956575828f1a20e565efed4b1137";
+  sha256 = "10asdz5bj12pnji7afzls6jd9dn2v90l2dgdjf0jfp2kfzd6pxnl";
+}} stroke
+ln -sv ${fetchFromGitHub {
+  owner = "rime";
+  repo = "rime-terra-pinyin";
+  rev = "e303507e728def38739f5761c50722eae1f06dd5";
+  sha256 = "1krbmx2iq3zw4q1x4aa9c72b9xgrnjrhyxa4h5hnq5l29p9qms4d";
+}} terra-pinyin
+ln -sv ${fetchFromGitHub {
+  owner = "rime";
+  repo = "rime-wubi";
+  rev = "97b7d9f93378e98fd11167bd80d54c40e67076aa";
+  sha256 = "1cdpbqqkqjbizja0w3f7a826a5bxb39nlf9qf2130x9havmkc89z";
+}} wubi
+ln -sv ${fetchFromGitHub {
+  owner = "rime";
+  repo = "rime-wugniu";
+  rev = "de40b29f8218cc852bf82b315c7070f1d50bda02";
+  sha256 = "1m7miwsqpy49cgqd1bl7z5lkkirj3lc2bdwd1zqfg5zbgfwn0rp8";
+}} wugniu
+''
--- a/pkgs/desktops/gnome-3/core/gcr/default.nix
+++ b/pkgs/desktops/gnome-3/core/gcr/default.nix
@ -9,12 +9,14 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ pkgconfig ];

-  buildInputs = [
-    intltool gnupg glib gobjectIntrospection libxslt
-    libgcrypt libtasn1 dbus_glib gtk pango gdk_pixbuf atk makeWrapper vala_0_32
+  buildInputs = let
+    gpg = gnupg.override { guiSupport = false; }; # prevent build cycle with pinentry_gnome
+  in [
+    intltool gpg gobjectIntrospection libxslt
+    libgcrypt libtasn1 dbus_glib pango gdk_pixbuf atk makeWrapper vala_0_32
  ];

-  propagatedBuildInputs = [ p11_kit ];
+  propagatedBuildInputs = [ glib gtk p11_kit ];

  #doCheck = true;

--- a/pkgs/development/compilers/crystal/default.nix
+++ b/pkgs/development/compilers/crystal/default.nix
@ -97,7 +97,7 @@ stdenv.mkDerivation rec {
    description = "A compiled language with Ruby like syntax and type inference";
    homepage = https://crystal-lang.org/;
    license = stdenv.lib.licenses.asl20;
-    maintainers = with stdenv.lib.maintainers; [ mingchuan ];
+    maintainers = with stdenv.lib.maintainers; [ sifmelcara ];
    platforms = [ "x86_64-linux" "i686-linux" "x86_64-darwin" ];
  };
 }
--- a/pkgs/development/compilers/fstar/default.nix
+++ b/pkgs/development/compilers/fstar/default.nix
@ -1,78 +1,30 @@
-{ stdenv, fetchFromGitHub, mono, fsharp, dotnetPackages, z3, ocamlPackages, openssl, makeWrapper, pkgconfig, file }:
+{ stdenv, fetchFromGitHub, z3, ocamlPackages, makeWrapper }:

 stdenv.mkDerivation rec {
  name = "fstar-${version}";
-  version = "0.9.4.0";
+  version = "0.9.5.0";

  src = fetchFromGitHub {
    owner = "FStarLang";
    repo = "FStar";
    rev = "v${version}";
-    sha256 = "130779p5plsgvz0dkcqycns3vwrvyfl138nq2xdhd3rkdsbyyvb7";
+    sha256 = "1pi2ny3kpmvm85x8w98anhjf0hp0wccc51m7v697qypn5cl4ydqk";
  };

  nativeBuildInputs = [ makeWrapper ];

  buildInputs = with ocamlPackages; [
-    mono fsharp z3 dotnetPackages.FsLexYacc ocaml findlib ocaml_batteries
-    zarith camlp4 yojson pprint openssl pkgconfig file
+    z3 ocaml findlib ocaml_batteries menhir stdint
+    zarith camlp4 yojson pprint
  ];

+  makeFlags = [ "PREFIX=$(out)" ];
+
  preBuild = ''
-    substituteInPlace src/Makefile --replace "\$(RUNTIME) VS/.nuget/NuGet.exe" "true" \
-      --replace Darwin xyz
-    substituteInPlace src/VS/.nuget/NuGet.targets --replace "mono" "true"
-
-    # Fails with bad interpreter otherwise
    patchShebangs src/tools
    patchShebangs bin
-
-    export FSharpTargetsPath="$(dirname $(pkg-config FSharp.Core --variable=Libraries))/Microsoft.FSharp.Targets"
-    # remove hardcoded windows paths
-    sed -i '/<FSharpTargetsPath/d' src/*/*.fsproj
-
-    mkdir -p src/VS/packages/FsLexYacc.6.1.0
-    ln -s ${dotnetPackages.FsLexYacc}/lib/dotnet/FsLexYacc src/VS/packages/FsLexYacc.6.1.0/build
  '';
-
-  makeFlags = [
-    "FSYACC=${dotnetPackages.FsLexYacc}/bin/fsyacc"
-    "FSLEX=${dotnetPackages.FsLexYacc}/bin/fslex"
-    "NUGET=true"
-    "PREFIX=$(out)"
-  ];
-
-  buildFlags = "-C src";
-
-  # Now that the .NET fstar.exe is built, use it to build the native OCaml binary
-  postBuild = ''
-    patchShebangs bin/fstar.exe
-
-    # Workaround for fsharp/fsharp#419
-    cp ${fsharp}/lib/mono/4.5/FSharp.Core.dll bin/
-
-    # Use the built .NET binary to extract the sources of itself from F* to OCaml
-    make ''${enableParallelBuilding:+-j''${NIX_BUILD_CORES} -l''${NIX_BUILD_CORES}} \
-        $makeFlags "''${makeFlagsArray[@]}" \
-        ocaml -C src
-
-    # Build the extracted OCaml sources
-    make ''${enableParallelBuilding:+-j''${NIX_BUILD_CORES} -l''${NIX_BUILD_CORES}} \
-        $makeFlags "''${makeFlagsArray[@]}" \
-        -C src/ocaml-output
-  '';
-
-  # https://github.com/FStarLang/FStar/issues/676
-  doCheck = false;
-
-  preCheck = "ulimit -s unlimited";
-
-  # Basic test suite:
-  #checkFlags = "VERBOSE=y -C examples";
-
-  # Complete, but heavyweight test suite:
-  checkTarget = "regressions";
-  checkFlags = "VERBOSE=y -C src";
+  buildFlags = "-C src/ocaml-output";

  installFlags = "-C src/ocaml-output";

@ -85,5 +37,6 @@ stdenv.mkDerivation rec {
    homepage = https://www.fstar-lang.org;
    license = licenses.asl20;
    platforms = with platforms; darwin ++ linux;
+    maintainers = with maintainers; [ gebner ];
  };
 }
--- a/pkgs/development/libraries/agda/agda-stdlib/default.nix
+++ b/pkgs/development/libraries/agda/agda-stdlib/default.nix
@ -1,14 +1,14 @@
 { stdenv, agda, fetchFromGitHub, ghcWithPackages }:

 agda.mkDerivation (self: rec {
-  version = "0.13";
+  version = "0.14";
  name = "agda-stdlib-${version}";

  src = fetchFromGitHub {
    repo = "agda-stdlib";
    owner = "agda";
    rev = "v${version}";
-    sha256 = "156xbqvqjck9izz613v52ppwk8s1y0kv7xkjpcm16vys2c3bh0x5";
+    sha256 = "0qx72w6lwskp18q608f95j5dcxb9xr4q4mzdkxp01sgib8v2v56l";
  };

  nativeBuildInputs = [ (ghcWithPackages (self : [ self.filemanip ])) ];
--- a/pkgs/development/libraries/libidn2/default.nix
+++ b/pkgs/development/libraries/libidn2/default.nix
@ -4,11 +4,11 @@ with stdenv.lib;

 stdenv.mkDerivation rec {
  name = "libidn2-${version}";
-  version = "2.0.3";
+  version = "2.0.4";

  src = fetchurl {
    url = "mirror://gnu/gnu/libidn/${name}.tar.gz";
-    sha256 = "1k88acdf242a6lbznr0h6f02frsqyqw4smw1nznibim5wyf18da3";
+    sha256 = "1w6jycr5bbawimhb72wxf9ic92yrhfadahfj0b70myw5n81nnjv4";
  };

  outputs = [ "bin" "dev" "out" "info" "devdoc" ];
--- a/pkgs/development/libraries/librime/default.nix
+++ b/pkgs/development/libraries/librime/default.nix
@ -0,0 +1,28 @@
+{ stdenv, fetchFromGitHub, cmake, boost, glog, leveldb, marisa, opencc,
+  libyamlcpp, gmock }:
+
+stdenv.mkDerivation rec {
+  name = "librime-${version}";
+  version = "1.2.9";
+
+  src = fetchFromGitHub {
+    owner = "rime";
+    repo = "librime";
+    rev = "rime-${version}";
+    sha256 = "14jgnfm61ynm086x9v7wfmv2p14h0qp8lq4d2jqm21n821jsraj6";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  buildInputs = [ boost glog leveldb marisa opencc libyamlcpp gmock ];
+
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
+    homepage    = http://rime.im/;
+    description = "Rime Input Method Engine, the core library";
+    license     = licenses.bsd3;
+    maintainers = with maintainers; [ sifmelcara ];
+    platforms   = platforms.all;
+  };
+}
--- a/pkgs/development/libraries/libsodium/default.nix
+++ b/pkgs/development/libraries/libsodium/default.nix
@ -1,11 +1,11 @@
 { stdenv, fetchurl }:

 stdenv.mkDerivation rec {
-  name = "libsodium-1.0.13";
+  name = "libsodium-1.0.15";

  src = fetchurl {
    url = "https://download.libsodium.org/libsodium/releases/${name}.tar.gz";
-    sha256 = "1z93wfg4k5svg8yck6cgdr6ysj91kbpn03nyzwxanncy3b5sq4ww";
+    sha256 = "1x3qw7lsz44vcxpcn1dvwig410phg6gmv31jwj94arrgka3rwspv";
  };

  outputs = [ "out" "dev" ];
--- a/pkgs/development/libraries/libubox/default.nix
+++ b/pkgs/development/libraries/libubox/default.nix
@ -0,0 +1,24 @@
+{ stdenv, lib, fetchgit, cmake, pkgconfig, json_c }:
+
+stdenv.mkDerivation {
+  name = "libubox-2017-09-29";
+
+  src = fetchgit {
+    url = "https://git.openwrt.org/project/libubox.git";
+    rev = "632688e8d6cde32781e4ec685d59afb0938300ad";
+    sha256 = "1rkwn287k7p802hbd9ap13xxrxsghq6827r86ymqbbcmbcrna13c";
+  };
+
+  cmakeFlags = [ "-DBUILD_LUA=OFF" "-DBUILD_EXAMPLES=OFF" ];
+
+  nativeBuildInputs = [ cmake pkgconfig ];
+  buildInputs = [ json_c ];
+
+  meta = with lib; {
+    description = "C utility functions for OpenWrt";
+    homepage = "https://git.openwrt.org/?p=project/libubox.git;a=summary";
+    license = licenses.isc;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ fpletz ];
+  };
+}
--- a/pkgs/development/libraries/marisa/default.nix
+++ b/pkgs/development/libraries/marisa/default.nix
@ -0,0 +1,21 @@
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  name = "marisa-${version}";
+  version = "0.2.4";
+
+  src = fetchurl {
+    url = "https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/marisa-trie/marisa-${version}.tar.gz";
+    sha256 = "1cwzf8hr348zihkiy0qckx0n6rxg7sy113xhbslb1irw1pvs99v7";
+  };
+
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
+    homepage    = https://code.google.com/p/marisa-trie/;
+    description = "Static and space-efficient trie data structure library";
+    license     = licenses.bsd3;
+    maintainers = with maintainers; [ sifmelcara ];
+    platforms   = platforms.all;
+  };
+}
--- a/pkgs/development/libraries/oniguruma/default.nix
+++ b/pkgs/development/libraries/oniguruma/default.nix
@ -13,6 +13,11 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ cmake ];

+  prePatch = stdenv.lib.optional stdenv.isDarwin ''
+    substituteInPlace cmake/dist.cmake \
+      --replace '@executable_path/''${UP_DIR}/''${INSTALL_LIB}' $out'/''${INSTALL_LIB}'
+  '';
+
  meta = {
    homepage = https://github.com/kkos/oniguruma;
    description = "Regular expressions library";
--- a/pkgs/development/libraries/science/biology/htslib/default.nix
+++ b/pkgs/development/libraries/science/biology/htslib/default.nix
@ -1,22 +1,32 @@
-{ stdenv, fetchurl, zlib, bzip2, lzma, curl }:
+{ stdenv, fetchurl, zlib, bzip2, lzma, curl, perl }:

 stdenv.mkDerivation rec {
  name = "${pname}-${version}";
-  version = "${major}.0";
  pname = "htslib";
-  major = "1.5";
+  version = "1.6";

  src = fetchurl {
-    url = "https://github.com/samtools/htslib/releases/download/${major}/htslib-${major}.tar.bz2";
-    sha256 = "0bcjmnbwp2bib1z1bkrp95w9v2syzdwdfqww10mkb1hxlmg52ax0";
+    url = "https://github.com/samtools/htslib/releases/download/${version}/${name}.tar.bz2";
+    sha256 = "1jsca3hg4rbr6iqq6imkj4lsvgl8g9768bcmny3hlff2w25vx24m";
  };

+  # perl is only used during the check phase.
+  nativeBuildInputs = [ perl ];
+
  buildInputs = [ zlib bzip2 lzma curl ];

  configureFlags = "--enable-libcurl"; # optional but strongly recommended

  installFlags = "prefix=$(out)";

+  preCheck = ''
+    patchShebangs test/
+  '';
+
+  enableParallelBuilding = true;
+
+  doCheck = true;
+
  meta = with stdenv.lib; {
    description = "A C library for reading/writing high-throughput sequencing data";
    license = licenses.mit;
@ -25,4 +35,3 @@ stdenv.mkDerivation rec {
    maintainers = [ maintainers.mimadrid ];
  };
 }
-
--- a/pkgs/development/ocaml-modules/stdint/default.nix
+++ b/pkgs/development/ocaml-modules/stdint/default.nix
@ -0,0 +1,25 @@
+{ stdenv, fetchFromGitHub, ocaml, findlib, ocamlbuild }:
+
+stdenv.mkDerivation rec {
+  name = "ocaml${ocaml.version}-stdint-${version}";
+  version = "0.3.0";
+  src = fetchFromGitHub {
+    owner = "andrenth";
+    repo = "ocaml-stdint";
+    rev = version;
+    sha256 = "18nh23yx4ghgq7mjf4mdyq8kj1fdw5d0abw919s8n4mv21cmpwia";
+  };
+
+  buildInputs = [ ocaml findlib ocamlbuild ];
+  configurePhase = "ocaml setup.ml -configure --prefix $out";
+
+  createFindlibDestdir = true;
+
+  meta = {
+    description = "Various signed and unsigned integers for OCaml";
+    license = stdenv.lib.licenses.mit;
+    maintainers = [ stdenv.lib.maintainers.gebner ];
+    inherit (src.meta) homepage;
+    inherit (ocaml.meta) platforms;
+  };
+}
--- a/pkgs/development/python-modules/platformio/default.nix
+++ b/pkgs/development/python-modules/platformio/default.nix
@ -0,0 +1,32 @@
+{ stdenv, buildPythonPackage, fetchPypi
+, arrow, bottle, click_5, colorama
+, lockfile, pyserial, requests
+, semantic-version
+, isPy3k, isPyPy
+}:
+buildPythonPackage rec {
+  disabled = isPy3k || isPyPy;
+
+  pname = "platformio";
+  version="3.4.1";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1b4lba672l851sv1xwc320xbh46x7hx4ms6whc0k37hxkxj0nwm2";
+  };
+
+  propagatedBuildInputs =  [
+    arrow bottle click_5 colorama
+    lockfile pyserial requests semantic-version
+  ];
+
+  patches = [ ./fix-searchpath.patch ];
+
+  meta = with stdenv.lib; {
+    description = "An open source ecosystem for IoT development";
+    homepage = http://platformio.org;
+    maintainers = with maintainers; [ mog makefu ];
+    license = licenses.asl20;
+  };
+}
--- a/pkgs/development/python-modules/platformio/fix-searchpath.patch
+++ b/pkgs/development/python-modules/platformio/fix-searchpath.patch
@ -0,0 +1,11 @@
+--- ./platformio/util.py-old	2017-09-29 01:20:08.174548250 +0200
+++ ./platformio/util.py	2017-09-29 01:19:48.410485308 +0200
+@@ -395,7 +395,7 @@
+                 isdir(join(p, "click")) or isdir(join(p, "platformio")))
+         if all(conditions):
+             _PYTHONPATH.append(p)
+-    os.environ['PYTHONPATH'] = os.pathsep.join(_PYTHONPATH)
+    os.environ['PYTHONPATH'] = os.pathsep.join(sys.path)
+ 
+ 
+ def get_serialports(filter_hwid=False):
--- a/pkgs/development/python-modules/pyserial/default.nix
+++ b/pkgs/development/python-modules/pyserial/default.nix
@ -0,0 +1,21 @@
+{ lib, fetchPypi, buildPythonPackage }:
+
+buildPythonPackage rec {
+  pname = "pyserial";
+  version="3.4";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "09y68bczw324a4jb9a1cfwrbjhq179vnfkkkrybbksp0vqgl0bbf";
+  };
+
+  checkPhase = "python -m unittest discover -s test";
+
+  meta = with lib; {
+    homepage = "https://github.com/pyserial/pyserial";
+    license = licenses.psfl;
+    description = "Python serial port extension";
+    maintainers = with maintainers; [ makefu ];
+  };
+}
--- a/pkgs/development/python-modules/semantic-version/default.nix
+++ b/pkgs/development/python-modules/semantic-version/default.nix
@ -0,0 +1,21 @@
+{ lib, fetchPypi, buildPythonPackage }:
+
+buildPythonPackage rec {
+  pname = "semantic_version";
+  version = "2.6.0";
+  name = "${pname}${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1h2l9xyg1zzsda6kjcmfcgycbvrafwci283vcr1v5sbk01l2hhra";
+  };
+
+  # ModuleNotFoundError: No module named 'tests'
+  doCheck = false;
+
+  meta = with lib; {
+    description = "A library implementing the 'SemVer' scheme";
+    license = licenses.bsdOriginal;
+    maintainers = with maintainers; [ layus makefu ];
+  };
+}
--- a/pkgs/development/tools/build-managers/gradle/default.nix
+++ b/pkgs/development/tools/build-managers/gradle/default.nix
@ -52,12 +52,12 @@ rec {
  };

  gradle_latest = gradleGen rec {
-    name = "gradle-4.2";
+    name = "gradle-4.2.1";
    nativeVersion = "0.14";

    src = fetchurl {
      url = "http://services.gradle.org/distributions/${name}-bin.zip";
-      sha256 = "1bifb3smmdxkfk94li2l63g2jxcl1bjca2bqcq2rqnp568yxcpai";
+      sha256 = "1h7v133rm81jf0bgv9mgvydl7rgh4430dnsfs66wflfay82cqldm";
    };
  };

--- a/pkgs/development/tools/build-managers/shards/default.nix
+++ b/pkgs/development/tools/build-managers/shards/default.nix
@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
    homepage = https://crystal-lang.org/;
    license = licenses.asl20;
    description = "Dependency manager for the Crystal language";
-    maintainers = with maintainers; [ mingchuan ];
+    maintainers = with maintainers; [ sifmelcara ];
    platforms = [ "x86_64-linux" "i686-linux" "x86_64-darwin" ];
  };
 }
--- a/pkgs/development/tools/jq/default.nix
+++ b/pkgs/development/tools/jq/default.nix
@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, fetchpatch, oniguruma }:
+{ stdenv, fetchurl, fetchpatch, oniguruma }:

 stdenv.mkDerivation rec {
  name = "jq-${version}";
@ -26,15 +26,13 @@ stdenv.mkDerivation rec {
  patchFlags = [ "-p2" ]; # `src` subdir was introduced after v1.5 was released

  # jq is linked to libjq:
-  configureFlags = [
-    "LDFLAGS=-Wl,-rpath,\\\${libdir}"
-  ];
+  configureFlags = stdenv.lib.optional (!stdenv.isDarwin) "LDFLAGS=-Wl,-rpath,\\\${libdir}";

-  meta = {
+  meta = with stdenv.lib; {
    description = ''A lightweight and flexible command-line JSON processor'';
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ raskin ];
-    platforms = with lib.platforms; linux ++ darwin;
+    license = licenses.mit;
+    maintainers = with maintainers; [ raskin ];
+    platforms = with platforms; linux ++ darwin;
    downloadPage = "http://stedolan.github.io/jq/download/";
    updateWalker = true;
    inherit version;
--- a/pkgs/development/tools/misc/iozone/default.nix
+++ b/pkgs/development/tools/misc/iozone/default.nix
@ -7,6 +7,8 @@ let
    "linux-AMD64"
  else if stdenv.system == "x86_64-darwin" then
    "macosx"
+  else if stdenv.system == "aarch64-linux" then
+    "linux-arm"
  else abort "Platform ${stdenv.system} not yet supported.";
 in

@ -53,7 +55,7 @@ stdenv.mkDerivation rec {
    description = "IOzone Filesystem Benchmark";
    homepage    = http://www.iozone.org/;
    license     = stdenv.lib.licenses.unfreeRedistributable;
-    platforms   = ["i686-linux" "x86_64-linux" "x86_64-darwin"];
-    maintainers = [ stdenv.lib.maintainers.Baughn ];
+    platforms   = ["i686-linux" "x86_64-linux" "x86_64-darwin" "aarch64-linux" ];
+    maintainers = with stdenv.lib.maintainers; [ Baughn makefu ];
  };
 }
--- a/pkgs/development/tools/misc/universal-ctags/default.nix
+++ b/pkgs/development/tools/misc/universal-ctags/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, perl, pythonPackages }:
+{ stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, perl, pythonPackages, libiconv }:

 stdenv.mkDerivation rec {
  name = "universal-ctags-${version}";
@ -12,6 +12,7 @@ stdenv.mkDerivation rec {
  };

  nativeBuildInputs = [ autoreconfHook pkgconfig pythonPackages.docutils ];
+  buildInputs = stdenv.lib.optional stdenv.isDarwin libiconv;

  autoreconfPhase = ''
    ./autogen.sh --tmpdir
--- a/pkgs/development/tools/phantomjs2/default.nix
+++ b/pkgs/development/tools/phantomjs2/default.nix
@ -1,7 +1,7 @@
 { stdenv, fetchFromGitHub, fetchpatch
 , bison2, flex, fontconfig, freetype, gperf, icu, openssl, libjpeg
 , libpng, perl, python, ruby, sqlite, qtwebkit, qmake, qtbase
-, darwin, writeScriptBin, cups
+, darwin, writeScriptBin, cups, makeWrapper
 }:

 let
@ -47,6 +47,7 @@ in stdenv.mkDerivation rec {
  buildInputs = [
    bison2 flex fontconfig freetype gperf icu openssl
    libjpeg libpng perl python ruby sqlite qtwebkit qtbase
+    makeWrapper
  ] ++ stdenv.lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [
    AGL ApplicationServices AppKit Cocoa OpenGL
    darwin.libobjc fakeClang cups
@ -98,6 +99,9 @@ in stdenv.mkDerivation rec {
        ${darwin.configd}/Library/Frameworks/SystemConfiguration.framework/SystemConfiguration \
        /System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration \
    $out/bin/phantomjs
+  '' + ''
+    wrapProgram $out/bin/phantomjs \
+    --prefix PATH : ${stdenv.lib.makeBinPath [ qtbase ]}
  '';

  preFixup = ''
--- a/pkgs/development/tools/vagrant/default.nix
+++ b/pkgs/development/tools/vagrant/default.nix
@ -2,7 +2,7 @@
 , libxml2, libxslt, libffi, makeWrapper, p7zip, xar, gzip, cpio }:

 let
-  version = "1.9.5";
+  version = "2.0.0";
  rake = buildRubyGem {
    inherit ruby;
    gemName = "rake";
@ -17,9 +17,9 @@ let
      else "system ${stdenv.system} not supported";

  sha256 = {
-    "x86_64-linux"  = "16ijzaacfbqrgh561bf51747d2rv8kydgs14dfdr572qi0f88baw";
-    "i686-linux"    = "0lvkb4k0a34a8hzlsi0apf056rhyprh5w0gn16d0n2ijnaf9j2yk";
-    "x86_64-darwin" = "070mrczsx1j0jl9sx6963l3hrk9anqa13r008wk1d22d25xj25mc";
+    "x86_64-linux"  = "184amybyxqlxqr8fk6lyx2znmci1fazsiby90q7d1xx2ihz3hm5x";
+    "i686-linux"    = "19r1m5jila40x69m1qz2hslz7v1hdg8wwdhcq8d5qjnzwfmlw2qz";
+    "x86_64-darwin" = "154400iqs01235bclr8ic7g9jv01lfs766bmv7p8784r3xsblvsr";
  }."${stdenv.system}" or (throw "system ${stdenv.system} not supported");

  arch = builtins.replaceStrings ["-linux" "-darwin"] ["" ""] stdenv.system;
--- a/pkgs/misc/emulators/darcnes/default.nix
+++ b/pkgs/misc/emulators/darcnes/default.nix
@ -1,28 +1,24 @@
-{stdenv, fetchurl, libX11, libXt, libXext, libXaw }:
+{ stdenv, fetchurl, libX11, libXt, libXext, libXaw }:

-assert stdenv.system == "i686-linux";
+stdenv.mkDerivation rec {
+  name = "darcnes-${version}";
+  version = "9b0401";

-stdenv.mkDerivation {
-  name = "darcnes-9b0401";
  src = fetchurl {
-    url = http://www.dridus.com/~nyef/darcnes/download/dn9b0401.tgz;
+    url = "https://web.archive.org/web/20130511081532/http://www.dridus.com/~nyef/darcnes/download/dn${version}.tgz";
    sha256 = "05a7mh51rg7ydb414m3p5mm05p4nz2bgvspqzwm3bhbj7zz543k3";
  };

-  buildInputs = [ libX11 libXt libXext libXaw ];
-
-  installPhase = ''
-    mkdir -p $out/bin
-    cp darcnes $out/bin
-  '';
-
  patches = [ ./label.patch ];

-  meta = {
-    homepage = http://www.dridus.com/~nyef/darcnes/;
-    description = "Multi-System emulator, specially for NES";
-    /* Prohibited commercial use, credit required. */
-    license = stdenv.lib.licenses.free;
-  };
+  buildInputs = [ libX11 libXt libXext libXaw ];
+  installPhase = "install -Dt $out/bin darcnes";

+  meta = {
+    homepage = https://web.archive.org/web/20130502171725/http://www.dridus.com/~nyef/darcnes/;
+    description = "Sega Master System, Game Gear, SG-1000, NES, ColecoVision and Apple II emulator";
+    # Prohibited commercial use, credit required.
+    license = stdenv.lib.licenses.free;
+    platforms = [ "i686-linux" ];
+  };
 }
--- a/pkgs/os-specific/linux/batman-adv/alfred.nix
+++ b/pkgs/os-specific/linux/batman-adv/alfred.nix
@ -1,14 +1,14 @@
 { stdenv, fetchurl, pkgconfig, gpsd, libcap, libnl }:

 let
-  ver = "2017.2";
+  ver = "2017.3";
 in
 stdenv.mkDerivation rec {
  name = "alfred-${ver}";

  src = fetchurl {
    url = "http://downloads.open-mesh.org/batman/releases/batman-adv-${ver}/${name}.tar.gz";
-    sha256 = "00sagxzkx0gqdkvc84w4bjy833l7n10hqalxdwkfxxwqwammclix";
+    sha256 = "0202mxp7hwflkqnkkajx5lv1nxjng45q5gcvvdv68x46p8ikb5n2";
  };

  nativeBuildInputs = [ pkgconfig ];
--- a/pkgs/os-specific/linux/batman-adv/batctl.nix
+++ b/pkgs/os-specific/linux/batman-adv/batctl.nix
@ -1,14 +1,14 @@
 { stdenv, fetchurl, pkgconfig, libnl }:

 let
-  ver = "2017.2";
+  ver = "2017.3";
 in
 stdenv.mkDerivation rec {
  name = "batctl-${ver}";

  src = fetchurl {
    url = "http://downloads.open-mesh.org/batman/releases/batman-adv-${ver}/${name}.tar.gz";
-    sha256 = "0v2k9ylmk8i85p69dh6gh134f081gm1clq1vnhn6x4831n8x0q64";
+    sha256 = "1a48kc2v8cb1757pxlli96qf3d7x7k3qw04rjadfs0iy09sz1ir9";
  };

  nativeBuildInputs = [ pkgconfig ];
--- a/pkgs/os-specific/linux/batman-adv/default.nix
+++ b/pkgs/os-specific/linux/batman-adv/default.nix
@ -1,13 +1,13 @@
 { stdenv, fetchurl, kernel }:

-let base = "batman-adv-2017.2"; in
+let base = "batman-adv-2017.3"; in

 stdenv.mkDerivation rec {
  name = "${base}-${kernel.version}";

  src = fetchurl {
    url = "http://downloads.open-mesh.org/batman/releases/${base}/${base}.tar.gz";
-    sha256 = "0krr6waxkmms23cacfzngddxy1vq577s54wy2fgx6lyb4579g1yl";
+    sha256 = "1m541czjwgi4rfhjr6rg9r9c3cp2ncnif4ln7ri926zigwlxs3l3";
  };

  hardeningDisable = [ "pic" ];
--- a/pkgs/os-specific/linux/iproute/default.nix
+++ b/pkgs/os-specific/linux/iproute/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name = "iproute2-${version}";
-  version = "4.12.0";
+  version = "4.13.0";

  src = fetchurl {
    url = "mirror://kernel/linux/utils/net/iproute2/${name}.tar.xz";
-    sha256 = "0zdxdsxyaazl85xhwskvsmpyzwf5qp21cvjsi1lw3xnrc914q2if";
+    sha256 = "0l2w84cwr54gaw3cbxijf614l76hx8mgcz57v81rwl68z3nq3yww";
  };

  preConfigure = ''
--- a/pkgs/os-specific/linux/kernel/linux-testing.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing.nix
@ -1,13 +1,13 @@
 { stdenv, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:

 import ./generic.nix (args // rec {
-  version = "4.14-rc2";
-  modDirVersion = "4.14.0-rc2";
+  version = "4.14-rc3";
+  modDirVersion = "4.14.0-rc3";
  extraMeta.branch = "4.14";

  src = fetchurl {
    url = "https://git.kernel.org/torvalds/t/linux-${version}.tar.gz";
-    sha256 = "0ahcmr0y9i47lwjn140w436hg68apnh8rl66y56qdvdic8f61mj4";
+    sha256 = "049x4fpcj8d6577lhzrns7w36mj21pfr4ijw01r0l6n3w86z28b7";
  };

  # Should the testing kernels ever be built on Hydra?
--- a/pkgs/os-specific/linux/wireguard/default.nix
+++ b/pkgs/os-specific/linux/wireguard/default.nix
@ -6,11 +6,11 @@ assert kernel != null -> stdenv.lib.versionAtLeast kernel.version "3.10";
 let
  name = "wireguard-${version}";

-  version = "0.0.20170810";
+  version = "0.0.20171001";

  src = fetchurl {
    url    = "https://git.zx2c4.com/WireGuard/snapshot/WireGuard-${version}.tar.xz";
-    sha256 = "ab96230390625aad6f4816fa23aef6e9f7fee130f083d838919129ff12089bf7";
+    sha256 = "ecff9a184685b7dd2d81576eba5bd96bb59031c9e9b5eeee05d6dc298f30998e";
  };

  meta = with stdenv.lib; {
--- a/pkgs/servers/http/nginx/mainline.nix
+++ b/pkgs/servers/http/nginx/mainline.nix
@ -1,6 +1,6 @@
 { callPackage, ... }@args:

 callPackage ./generic.nix (args // {
-  version = "1.13.4";
-  sha256 = "1fpvy6738h951qks7wn6kdqwyprfsxirlxfq549n2p56kg2g68fy";
+  version = "1.13.5";
+  sha256 = "0blzna6h76xd7ddz37yb7yqg4yx7gpwsz8zbg8vlbxxk552bjx8f";
 })
--- a/pkgs/servers/monitoring/prometheus/blackbox-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/blackbox-exporter.nix
@ -2,7 +2,7 @@

 buildGoPackage rec {
  name = "blackbox_exporter-${version}";
-  version = "0.8.1";
+  version = "0.9.1";
  rev = version;

  goPackagePath = "github.com/prometheus/blackbox_exporter";
@ -11,7 +11,7 @@ buildGoPackage rec {
    rev = "v${version}";
    owner = "prometheus";
    repo = "blackbox_exporter";
-    sha256 = "1bnn1xa11593m66ihdnyka0ck8zmg4abvwdyy5fpnyx29g3ym4sd";
+    sha256 = "03sc1h8jfxaw7c5d6lkj6x653zhxhh0v29n6db3319nsfx00nrag";
  };

  meta = with stdenv.lib; {
--- a/pkgs/servers/monitoring/prometheus/default.nix
+++ b/pkgs/servers/monitoring/prometheus/default.nix
@ -2,7 +2,7 @@

 buildGoPackage rec {
  name = "prometheus-${version}";
-  version = "1.7.1";
+  version = "1.7.2";
  rev = "v${version}";

  goPackagePath = "github.com/prometheus/prometheus";
@ -11,7 +11,7 @@ buildGoPackage rec {
    inherit rev;
    owner = "prometheus";
    repo = "prometheus";
-    sha256 = "11acdwn2fw5qnyns5vdbxw18xnd2v4hb1y2cfjjxw478hhza4ni3";
+    sha256 = "0a2qlcx4p6mwgff9hc2h3sm1glh6syb38jfxabsx2clmj0gq2dq1";
  };

  docheck = true;
--- a/pkgs/servers/mpd/clientlib.nix
+++ b/pkgs/servers/mpd/clientlib.nix
@ -1,24 +1,17 @@
-{ stdenv, fetchFromGitHub, autoreconfHook, doxygen }:
+{ stdenv, fetchFromGitHub, meson, ninja }:

 stdenv.mkDerivation rec {
-  version = "${passthru.majorVersion}.${passthru.minorVersion}";
+  version = "2.13";
  name = "libmpdclient-${version}";

  src = fetchFromGitHub {
    owner  = "MusicPlayerDaemon";
    repo   = "libmpdclient";
    rev    = "v${version}";
-    sha256 = "06rv2j8rw9v9l4nwpvbh28nad8bbg368hzd8s58znbr5pgb8dihd";
+    sha256 = "1g1n6rk8kn87mbjqxxj0vi7haj8xx21xmqlzbrx2fvyp5357zvsq";
  };

-  nativeBuildInputs = [ autoreconfHook doxygen ];
-
-  enableParallelBuilding = true;
-
-  passthru = {
-    majorVersion = "2";
-    minorVersion = "11";
-  };
+  nativeBuildInputs = [ meson ninja ];

  meta = with stdenv.lib; {
    description = "Client library for MPD (music player daemon)";
--- a/pkgs/servers/mpd/default.nix
+++ b/pkgs/servers/mpd/default.nix
@ -34,7 +34,7 @@ let
  opt = stdenv.lib.optional;
  mkFlag = c: f: if c then "--enable-${f}" else "--disable-${f}";
  major = "0.20";
-  minor = "9";
+  minor = "10";

 in stdenv.mkDerivation rec {
  name = "mpd-${version}";
@ -44,7 +44,7 @@ in stdenv.mkDerivation rec {
    owner  = "MusicPlayerDaemon";
    repo   = "MPD";
    rev    = "v${version}";
-    sha256 = "17ly30syrlw5274washifr0nddll3g1zb4rr4f9sfnlxz9wz73p1";
+    sha256 = "0i170kfn68x683fsm5rba0zbpjfr1r7s6a8nvdbva2yl0aizfzhs";
  };

  patches = [ ./x86.patch ];
--- a/pkgs/servers/sql/mariadb/default.nix
+++ b/pkgs/servers/sql/mariadb/default.nix
@ -15,11 +15,11 @@ mariadb = everything // {
 };

 common = rec { # attributes common to both builds
-  version = "10.1.26";
+  version = "10.1.28";

  src = fetchurl {
    url    = "https://downloads.mariadb.org/f/mariadb-${version}/source/mariadb-${version}.tar.gz/from/http%3A//ftp.hosteurope.de/mirror/archive.mariadb.org/?serve";
-    sha256 = "0ggpdcal0if9y6h9hp1yv2q65cbkjfl4p8rqk68a5pk7k75v325s";
+    sha256 = "1g9b0c04qhgcgw6xw29bvdjjjacr7kn82crc7apvvi10ykzwhb99";
    name   = "mariadb-${version}.tar.gz";
  };

--- a/pkgs/tools/inputmethods/fcitx-engines/fcitx-rime/default.nix
+++ b/pkgs/tools/inputmethods/fcitx-engines/fcitx-rime/default.nix
@ -0,0 +1,35 @@
+{ stdenv, fetchurl, cmake, pkgconfig, fcitx, librime, brise, hicolor_icon_theme }:
+
+stdenv.mkDerivation rec {
+  name = "fcitx-rime-${version}";
+  version = "0.3.2";
+
+  src = fetchurl {
+    url = "https://download.fcitx-im.org/fcitx-rime/${name}.tar.xz";
+    sha256 = "0bd8snfa6jr8dhnm0s0z021iryh5pbaf7p15rhkgbigw2pssczpr";
+  };
+
+  buildInputs = [ cmake pkgconfig fcitx librime brise hicolor_icon_theme ];
+
+  # cmake cannont automatically find our nonstandard brise install location
+  cmakeFlags = [ "-DRIME_DATA_DIR=${brise}/share/rime-data" ];
+
+  preInstall = ''
+    substituteInPlace src/cmake_install.cmake \
+       --replace ${fcitx} $out
+    substituteInPlace data/cmake_install.cmake \
+       --replace ${fcitx} $out
+  '';
+
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
+    isFcitxEngine = true;
+    homepage      = https://github.com/fcitx/fcitx-rime;
+    downloadPage  = https://download.fcitx-im.org/fcitx-rime/;
+    description   = "Rime support for Fcitx";
+    license       = licenses.gpl2;
+    platforms     = platforms.linux;
+    maintainers   = with maintainers; [ sifmelcara ];
+  };
+}
--- a/pkgs/tools/misc/cloud-utils/default.nix
+++ b/pkgs/tools/misc/cloud-utils/default.nix
@ -1,27 +1,34 @@
-{ stdenv, fetchurl, makeWrapper, gawk, gnused, utillinux }:
+{ stdenv, fetchurl, makeWrapper
+, gawk, gnused, utillinux, file
+, wget, python3, qemu, euca2ools
+, e2fsprogs, cdrkit }:

-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
  # NOTICE: if you bump this, make sure to run
  # $ nix-build nixos/release-combined.nix -A nixos.tests.ec2-nixops
-  name = "cloud-utils-0.29";
+  # growpart is needed in initrd in nixos/modules/virtualisation/grow-partition.nix
+  name = "cloud-utils-${version}";
+  version = "0.30";
  src = fetchurl {
-    url = "https://launchpad.net/cloud-utils/trunk/0.29/+download/cloud-utils-0.29.tar.gz";
-    sha256 = "0z15gs8gmpy5gqxl7yiyjj7a6s8iw44djj6axvbci627b9pvd8cy";
+    url = "https://launchpad.net/cloud-utils/trunk/0.3/+download/cloud-utils-${version}.tar.gz";
+    sha256 = "19ca9ckwwsvlqrjz19bc93rq4gv3y4ak7551li2qk95caqyxsq3k";
  };
-  buildInputs = [ makeWrapper ];
-  buildPhase = ''
-    mkdir -p $out/bin
-    cp bin/growpart $out/bin/growpart
-    sed -i 's|awk|gawk|' $out/bin/growpart
-    sed -i 's|sed|gnused|' $out/bin/growpart
-    ln -s sed $out/bin/gnused
-    wrapProgram $out/bin/growpart --prefix PATH : "${stdenv.lib.makeBinPath [ gnused gawk utillinux ]}:$out/bin"
-  '';
-  dontInstall = true;
-  dontPatchShebangs = true;
-  dontStrip = true;
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ python3 ];
+  installFlags = [ "LIBDIR=$(out)/lib" "BINDIR=$(out)/bin" "MANDIR=$(out)/man/man1" "DOCDIR=$(out)/doc" ];

-  meta = {
-    platforms = stdenv.lib.platforms.unix;
-  };
+  # according to https://packages.ubuntu.com/source/zesty/cloud-utils
+  binDeps = [
+    wget e2fsprogs file gnused gawk utillinux qemu euca2ools cdrkit
+  ];
+
+  postFixup = ''
+    for i in $out/bin/*; do
+      wrapProgram $i --prefix PATH : "${stdenv.lib.makeBinPath binDeps}:$out/bin"
+    done
+  '';
+
+  dontBuild = true;
+
+  meta.platforms = stdenv.lib.platforms.unix;
 }
--- a/pkgs/tools/misc/cloud-utils/growpart-util-linux-2.26.patch
+++ b/pkgs/tools/misc/cloud-utils/growpart-util-linux-2.26.patch
@ -1,88 +0,0 @@
-From 1895d10a7539d055a4e0206af1e7a9e5ea32a4f7 Mon Sep 17 00:00:00 2001
-From: Juerg Haefliger <juerg.haefliger@hp.com>
-Date: Wed, 25 Mar 2015 13:59:20 +0100
-Subject: [PATCH] Support new sfdisk version 2.26
-
-The sfdisk usage with version 2.26 changed. Specifically, the option
--show-pt-geometry and functionality for CHS have been removed.
-Also, restoring a backup MBR now needs to be done using dd.
---
- bin/growpart | 28 ++++++++++------------------
- 1 file changed, 10 insertions(+), 18 deletions(-)
-
-diff --git a/bin/growpart b/bin/growpart
-index 595c40b..d4c995b 100755
--- a/bin/growpart
-+++ b/bin/growpart
-@@ -28,7 +28,6 @@ PART=""
- PT_UPDATE=false
- DRY_RUN=0
- 
-MBR_CHS=""
- MBR_BACKUP=""
- GPT_BACKUP=""
- _capture=""
-@@ -133,7 +132,8 @@ bad_Usage() {
- }
- 
- mbr_restore() {
-	sfdisk --no-reread "${DISK}" ${MBR_CHS} -I "${MBR_BACKUP}"
-+	dd if="${MBR_BACKUP}-${DISK#/dev/}-0x00000000.bak" of="${DISK}" bs=1 \
-+		conv=notrunc
- }
- 
- sfdisk_worked_but_blkrrpart_failed() {
-@@ -148,34 +148,26 @@ sfdisk_worked_but_blkrrpart_failed() {
- 
- mbr_resize() {
- 	RESTORE_HUMAN="${TEMP_D}/recovery"
-	MBR_BACKUP="${TEMP_D}/orig.save"
-+	MBR_BACKUP="${TEMP_D}/backup"
- 
- 	local change_out=${TEMP_D}/change.out
- 	local dump_out=${TEMP_D}/dump.out
- 	local new_out=${TEMP_D}/new.out
- 	local dump_mod=${TEMP_D}/dump.mod
-	local tmp="${TEMP_D}/tmp.out"
-	local err="${TEMP_D}/err.out"
- 
-	local _devc cyl _w1 heads _w2 sectors _w3 tot dpart
-+	local tot dpart
- 	local pt_start pt_size pt_end max_end new_size change_info
- 
-	# --show-pt-geometry outputs something like
-	#     /dev/sda: 164352 cylinders, 4 heads, 32 sectors/track
-	rqe sfd_geom sfdisk "${DISK}" --show-pt-geometry >"${tmp}" &&
-		read _devc cyl _w1 heads _w2 sectors _w3 <"${tmp}" &&
-		MBR_CHS="-C ${cyl} -H ${heads} -S ${sectors}" ||
-		fail "failed to get CHS from ${DISK}"
-+	tot=$(sfdisk --list "${DISK}" | awk '{ print $(NF-1) ; exit }') ||
-+		fail "failed to get total number of sectors from ${DISK}"
- 
-	tot=$((${cyl}*${heads}*${sectors}))
-+	debug 1 "total number of sectors of ${DISK} is ${tot}"
- 
-	debug 1 "geometry is ${MBR_CHS}. total size=${tot}"
-	rqe sfd_dump sfdisk ${MBR_CHS} --unit=S --dump "${DISK}" \
-+	rqe sfd_dump sfdisk --dump "${DISK}" \
- 		>"${dump_out}" ||
- 		fail "failed to dump sfdisk info for ${DISK}"
-
- 	{
-		echo "## sfdisk ${MBR_CHS} --unit=S --dump ${DISK}"
-+		echo "## sfdisk --dump ${DISK}"
- 		cat "${dump_out}"
- 	}  >"${RESTORE_HUMAN}"
- 	[ $? -eq 0 ] || fail "failed to save sfdisk -d output"
-@@ -237,7 +229,7 @@ mbr_resize() {
- 		exit 0
- 	fi
- 
-	LANG=C sfdisk --no-reread "${DISK}" ${MBR_CHS} --force \
-+	LANG=C sfdisk --no-reread "${DISK}" --force \
- 		-O "${MBR_BACKUP}" <"${new_out}" >"${change_out}" 2>&1
- 	ret=$?
- 	[ $ret -eq 0 ] || RESTORE_FUNC="mbr_restore"
-- 
-2.1.4
-
--- a/pkgs/tools/misc/exa/default.nix
+++ b/pkgs/tools/misc/exa/default.nix
@ -2,34 +2,17 @@

 with rustPlatform;

-let
-  # check for updates
-  zoneinfo_compiled = fetchFromGitHub {
-    owner = "rust-datetime";
-    repo = "zoneinfo-compiled";
-    rev = "f56921ea5e9f7cf065b1480ff270a1757c1f742f";
-    sha256 = "1xmw7c5f5n45lkxnyxp4llfv1bnqhc876w98165ccdbbiylfkw26";
-  };
-  cargoPatch = ''
-    # use non-git dependencies
-    patch Cargo.toml <<EOF
-    46c46
-    < git = "https://github.com/rust-datetime/zoneinfo-compiled.git"
-    ---
-    > path = "${zoneinfo_compiled}"
-    EOF
-  '';
-in buildRustPackage rec {
+buildRustPackage rec {
  name = "exa-${version}";
-  version = "0.7.0";
+  version = "0.8.0";

-  depsSha256 = "0j320hhf2vqaha137pjj4pyiw6d3p5h3nhy3pl9vna1g5mnl1sn7";
+  depsSha256 = "0yz41prkjs5rmvdhr9k58a52l7hvwy5mfg8rcpsq4ybgf601lja2";

  src = fetchFromGitHub {
    owner = "ogham";
    repo = "exa";
    rev = "v${version}";
-    sha256 = "0i9psgna2wwv9qyw9cif4qznqiyi16vl763hpm2yr195aj700339";
+    sha256 = "0jy11a3xfnfnmyw1kjmv4ffavhijs8c940kw24vafklnacx5n88m";
  };

  nativeBuildInputs = [ cmake pkgconfig perl ];
@ -38,15 +21,6 @@ in buildRustPackage rec {
  # Some tests fail, but Travis ensures a proper build
  doCheck = false;

-  cargoUpdateHook = ''
-    ${cargoPatch}
-  '';
-  cargoDepsHook = ''
-    pushd $sourceRoot
-    ${cargoPatch}
-    popd
-  '';
-
  meta = with stdenv.lib; {
    description = "Replacement for 'ls' written in Rust";
    longDescription = ''
@ -57,7 +31,7 @@ in buildRustPackage rec {
      for a directory, or recursing into directories with a tree view. exa is
      written in Rust, so it’s small, fast, and portable.
    '';
-    homepage = http://the.exa.website;
+    homepage = https://the.exa.website;
    license = licenses.mit;
    maintainer = [ maintainers.ehegnes ];
  };
--- a/pkgs/tools/misc/mpdscribble/default.nix
+++ b/pkgs/tools/misc/mpdscribble/default.nix
@ -13,11 +13,6 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [ pkgconfig ];
  buildInputs = [ mpd_clientlib curl glib ];

-  preConfigure = ''
-    export LIBMPDCLIENT_LIBS=${mpd_clientlib}/lib/libmpdclient.so.${mpd_clientlib.majorVersion}.0.${mpd_clientlib.minorVersion}
-    export LIBMPDCLIENT_CFLAGS=${mpd_clientlib}
-  '';
-
  meta = with stdenv.lib; {
    description = "A Music Player Daemon (MPD) client which submits information about tracks beeing played to a scrobbler (e.g. last.fm)";
    homepage = http://mpd.wikia.com/wiki/Client:mpdscribble;
--- a/pkgs/tools/misc/youtube-dl/default.nix
+++ b/pkgs/tools/misc/youtube-dl/default.nix
@ -15,11 +15,11 @@ with stdenv.lib;
 buildPythonApplication rec {

  name = "youtube-dl-${version}";
-  version = "2017.09.24";
+  version = "2017.10.01";

  src = fetchurl {
    url = "https://yt-dl.org/downloads/${version}/${name}.tar.gz";
-    sha256 = "0j2m75j0d1n83i7jzpkcj7ir0bkskj024j9b0yi88zipcg740wbx";
+    sha256 = "047zinsczn6c96fzkarlb29y7sjwyh84nxlpfpa6mi4rn090wkqb";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/tools/networking/chrony/default.nix
+++ b/pkgs/tools/networking/chrony/default.nix
@ -6,11 +6,11 @@ assert stdenv.isLinux -> libcap != null;
 stdenv.mkDerivation rec {
  name = "chrony-${version}";

-  version = "3.1";
+  version = "3.2";

  src = fetchurl {
    url = "http://download.tuxfamily.org/chrony/${name}.tar.gz";
-    sha256 = "0xb03dya1zhcn1gch2v2ynifxw95g8m3plr9q4ys0s3pvgf0g4cx";
+    sha256 = "05j17i1zlg19v8jkzlp710kbdgnb4541zgkqxqzcwglcvlc6g7rj";
  };

  buildInputs = [ readline texinfo nss nspr ]
--- a/pkgs/tools/networking/dnsmasq/default.nix
+++ b/pkgs/tools/networking/dnsmasq/default.nix
@ -11,11 +11,11 @@ let
  ]);
 in
 stdenv.mkDerivation rec {
-  name = "dnsmasq-2.77";
+  name = "dnsmasq-2.78";

  src = fetchurl {
    url = "http://www.thekelleys.org.uk/dnsmasq/${name}.tar.xz";
-    sha256 = "12lbbwpy1wxi6n5dngv30x8g8v13apdnvjgq7w71f9dfa0f3pb3f";
+    sha256 = "0ar5h5v3kas2qx2wgy5iqin15gc4jhqrqs067xacgc3lii1rz549";
  };

  preBuild = ''
--- a/pkgs/tools/networking/uqmi/default.nix
+++ b/pkgs/tools/networking/uqmi/default.nix
@ -0,0 +1,27 @@
+{ stdenv, lib, fetchgit, cmake, perl, libubox, json_c }:
+
+stdenv.mkDerivation {
+  name = "uqmi-2016-12-19";
+
+  src = fetchgit {
+    url = "https://git.openwrt.org/project/uqmi.git";
+    rev = "8ceeab690d8c6f1e3afbd4bcaee7bc2ba3fbe165";
+    sha256 = "1fw9r36d024iiq6bq2cikaq5pams5pnbc4z6pcmcny2k4l5cdb6m";
+  };
+
+  postPatch = ''
+    substituteInPlace data/gen-header.pl --replace /usr/bin/env ""
+    patchShebangs .
+  '';
+
+  nativeBuildInputs = [ cmake perl ];
+  buildInputs = [ libubox json_c ];
+
+  meta = with lib; {
+    description = "Tiny QMI command line utility";
+    homepage = "https://git.openwrt.org/?p=project/uqmi.git;a=summary";
+    license = licenses.gpl2Plus;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ fpletz ];
+  };
+}
--- a/pkgs/tools/security/pinentry/default.nix
+++ b/pkgs/tools/security/pinentry/default.nix
@ -1,12 +1,11 @@
 { fetchurl, fetchpatch, stdenv, lib, pkgconfig
-, libgpgerror, libassuan, libcap ? null, ncurses ? null, gtk2 ? null, qt4 ? null
+, libgpgerror, libassuan, libcap ? null, libsecret ? null, ncurses ? null, gtk2 ? null, gcr ? null, qt4 ? null
 }:

 let
  mkFlag = pfxTrue: pfxFalse: cond: name: "--${if cond then pfxTrue else pfxFalse}-${name}";
  mkEnable = mkFlag "enable" "disable";
  mkWith = mkFlag "with" "without";
-  hasX = gtk2 != null || qt4 != null;
 in
 with stdenv.lib;
 stdenv.mkDerivation rec {
@ -17,7 +16,7 @@ stdenv.mkDerivation rec {
    sha256 = "0ni7g4plq6x78p32al7m8h2zsakvg1rhfz0qbc3kdc7yq7nw4whn";
  };

-  buildInputs = [ libgpgerror libassuan libcap gtk2 ncurses qt4 ];
+  buildInputs = [ libgpgerror libassuan libcap libsecret gtk2 gcr ncurses qt4 ];

  prePatch = ''
    substituteInPlace pinentry/pinentry-curses.c --replace ncursesw ncurses
@ -39,12 +38,13 @@ stdenv.mkDerivation rec {
  '';

  configureFlags = [
-    (mkWith   (libcap != null)  "libcap")
-    (mkWith   (hasX)            "x")
-    (mkEnable (ncurses != null) "pinentry-curses")
-    (mkEnable true              "pinentry-tty")
-    (mkEnable (gtk2 != null)    "pinentry-gtk2")
-    (mkEnable (qt4 != null)     "pinentry-qt4")
+    (mkWith   (libcap != null)    "libcap")
+    (mkEnable (libsecret != null) "libsecret")
+    (mkEnable (ncurses != null)   "pinentry-curses")
+    (mkEnable true                "pinentry-tty")
+    (mkEnable (gtk2 != null)      "pinentry-gtk2")
+    (mkEnable (gcr != null)       "pinentry-gnome3")
+    (mkEnable (qt4 != null)       "pinentry-qt")
  ];

  nativeBuildInputs = [ pkgconfig ];
--- a/pkgs/tools/text/opencc/default.nix
+++ b/pkgs/tools/text/opencc/default.nix
@ -9,10 +9,14 @@ stdenv.mkDerivation {

  buildInputs = [ cmake python ];

-  cmakeFlags = [
-    "-DBUILD_SHARED_LIBS=OFF"
+  makeFlags = [
+    # let intermediate tools find intermediate library
+    "LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$(CURDIR)/src"
  ];

+  # Parallel building occasionaly fails with: Error copying file "/tmp/nix-build-opencc-1.0.5.drv-0/OpenCC-ver.1.0.5/build/src/libopencc.so.1.0.0" to "/tmp/nix-build-opencc-1.0.5.drv-0/OpenCC-ver.1.0.5/build/src/tools".
+  enableParallelBuilding = false;
+
  meta = with stdenv.lib; {
    homepage = https://github.com/BYVoid/OpenCC;
    license = licenses.asl20;
@ -23,7 +27,7 @@ stdenv.mkDerivation {
      phrase-level conversion, variant conversion and regional idioms among Mainland China,
      Taiwan and Hong kong.
    '';
-    maintainers = [ maintainers.mingchuan ];
+    maintainers = [ maintainers.sifmelcara ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -55,10 +55,10 @@ with pkgs;

  stringsWithDeps = lib.stringsWithDeps;

-  ### Evaluating the entire NixPkgs naively will fail, make failure fast
+  ### Evaluating the entire Nixpkgs naively will fail, make failure fast
  AAAAAASomeThingsFailToEvaluate = throw ''
    Please be informed that this pseudo-package is not the only part of
-    NixPkgs that fails to evaulate. You should not evaluate entire NixPkgs
+    Nixpkgs that fails to evaluate. You should not evaluate entire Nixpkgs
    without some special measures to handle failing packages, like those taken
    by Hydra.
  '';
@ -1953,6 +1953,8 @@ with pkgs;

    unikey = callPackage ../tools/inputmethods/fcitx-engines/fcitx-unikey { };

+    rime = callPackage ../tools/inputmethods/fcitx-engines/fcitx-rime { };
+
    m17n = callPackage ../tools/inputmethods/fcitx-engines/fcitx-m17n { };

    mozc = callPackage ../tools/inputmethods/fcitx-engines/fcitx-mozc rec {
@ -3869,10 +3871,16 @@ with pkgs;
  pinentry = callPackage ../tools/security/pinentry {
    libcap = if stdenv.isDarwin then null else libcap;
    qt4 = null;
+    gtk2 = null;
+    gcr = gnome3.gcr;
  };

  pinentry_ncurses = pinentry.override {
-    gtk2 = null;
+    gcr = null;
+  };
+
+  pinentry_gtk2 = pinentry_ncurses.override {
+    inherit gtk2;
  };

  pinentry_qt4 = pinentry_ncurses.override {
@ -4652,6 +4660,7 @@ with pkgs;
  tor-browser-bundle = callPackage ../applications/networking/browsers/tor-browser-bundle {
    stdenv = stdenvNoCC;
    tor-browser-unwrapped = firefoxPackages.tor-browser;
+    inherit (python27Packages) obfsproxy;
  };

  touchegg = callPackage ../tools/inputmethods/touchegg { };
@ -4755,6 +4764,8 @@ with pkgs;

  upx = callPackage ../tools/compression/upx { };

+  uqmi = callPackage ../tools/networking/uqmi { };
+
  uriparser = callPackage ../development/libraries/uriparser {};

  urlscan = callPackage ../applications/misc/urlscan { };
@ -7596,7 +7607,7 @@ with pkgs;
  universal-ctags = callPackage ../development/tools/misc/universal-ctags { };

  vagrant = callPackage ../development/tools/vagrant {
-    ruby = ruby_2_2;
+    ruby = ruby_2_3;
  };

  bashdb = callPackage ../development/tools/misc/bashdb { };
@ -9203,6 +9214,8 @@ with pkgs;

  librevisa = callPackage ../development/libraries/librevisa { };

+  librime = callPackage ../development/libraries/librime {};
+
  libsamplerate = callPackage ../development/libraries/libsamplerate {
    inherit (darwin.apple_sdk.frameworks) ApplicationServices Carbon CoreServices;
  };
@ -9529,6 +9542,8 @@ with pkgs;

  libu2f-server = callPackage ../development/libraries/libu2f-server { };

+  libubox = callPackage ../development/libraries/libubox { };
+
  libuecc = callPackage ../development/libraries/libuecc { };

  libui = callPackage ../development/libraries/libui { };
@ -9731,6 +9746,8 @@ with pkgs;

  mapnik = callPackage ../development/libraries/mapnik { };

+  marisa = callPackage ../development/libraries/marisa {};
+
  matio = callPackage ../development/libraries/matio { };

  mbedtls = callPackage ../development/libraries/mbedtls { };
@ -13061,6 +13078,8 @@ with pkgs;

  bgnet = callPackage ../data/documentation/bgnet { };

+  brise = callPackage ../data/misc/brise { };
+
  inherit (kdeFrameworks) breeze-icons;

  cacert = callPackage ../data/misc/cacert { };
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@ -625,6 +625,8 @@ let

    sawja = callPackage ../development/ocaml-modules/sawja { };

+    stdint = callPackage ../development/ocaml-modules/stdint { };
+
    uucd = callPackage ../development/ocaml-modules/uucd { };
    uucp = callPackage ../development/ocaml-modules/uucp { };
    uunf = callPackage ../development/ocaml-modules/uunf { };
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -14151,17 +14151,19 @@ in {

  cmd2 = buildPythonPackage rec {
    name = "cmd2-${version}";
-    version = "0.6.8";
+    version = "0.7.7";

    src = pkgs.fetchurl {
      url = "mirror://pypi/c/cmd2/${name}.tar.gz";
-      sha256 = "1a346zcd46c8gwbbp2cxsmvgfkyy26kwxjzdnkv7n47w6660sy5c";
+      sha256 = "0widbir8ay1fd4zm8l0rjq78j1cvbammbz8xs32crbanqsgzpqml";
    };

    # No tests included
    doCheck = false;

    propagatedBuildInputs = with self; [
+      pyperclip
+      six
      pyparsing
    ];

@ -15613,27 +15615,7 @@ in {
  };

  pika-pool = callPackage ../development/python-modules/pika-pool { };
-
-  platformio =  buildPythonPackage rec {
-    name = "platformio-${version}";
-    version="2.10.3";
-
-    disabled = isPy3k || isPyPy;
-
-    src = pkgs.fetchurl {
-      url = "https://pypi.python.org/packages/b7/a3/1d3a9d7bae91df1b607e0f31549ec3e0006f29484cc6a1431b3fe3c5b02e/platformio-2.10.3.tar.gz";
-      sha256 = "f3a646871f9baed05f336a32576edaab90abf0737d8adb54f2acb7bcad42a65f";
-     };
-
-     propagatedBuildInputs = with self; [ click_5 requests bottle pyserial lockfile colorama];
-
-     meta = with stdenv.lib; {
-     description = "An open source ecosystem for IoT development";
-     homepage = http://platformio.org;
-     maintainers = with maintainers; [ mog ];
-     license = licenses.asl20;
-     };
-  };
+  platformio = callPackage ../development/python-modules/platformio { };

  pylibconfig2 = buildPythonPackage rec {
    name = "pylibconfig2-${version}";
@ -16860,7 +16842,7 @@ in {
    };

    disabled = !isPy3k;
-    
+
    # No tests in archive
    doCheck = false;

@ -17879,22 +17861,7 @@ in {
    };
  };

-  pyserial = buildPythonPackage rec {
-    name = "pyserial-2.7";
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/p/pyserial/${name}.tar.gz";
-      sha256 = "3542ec0838793e61d6224e27ff05e8ce4ba5a5c5cc4ec5c6a3e8d49247985477";
-    };
-
-    doCheck = false;
-
-    meta = {
-      homepage = "http://pyserial.sourceforge.net/";
-      license = licenses.psfl;
-      description = "Python serial port extension";
-    };
-  };
+  pyserial = callPackage ../development/python-modules/pyserial {};

  pymongo = callPackage ../development/python-modules/pymongo {};

@ -20361,22 +20328,7 @@ in {
    };
  };

-  semantic-version = buildPythonPackage rec {
-    pname = "semantic_version";
-    version = "2.4.2";
-    name = "${pname}${version}";
-
-    src = self.fetchPypi {
-      inherit pname version;
-      sha256 = "7e8b7fa74a3bc9b6e90b15b83b9bc2377c78eaeae3447516425f475d5d6932d2";
-    };
-
-    meta = {
-      description = "A library implementing the 'SemVer' scheme";
-      license = licenses.bsdOriginal;
-      maintainers = with maintainers; [ layus ];
-    };
-  };
+  semantic-version = callPackage ../development/python-modules/semantic-version { };

  sexpdata = buildPythonPackage rec {
    name = "sexpdata-0.0.2";
--- a/pkgs/top-level/rust-packages.nix
+++ b/pkgs/top-level/rust-packages.nix
@ -7,13 +7,13 @@
 { stdenv, fetchFromGitHub, git }:

 stdenv.mkDerivation {
-  name = "rustRegistry-2017-09-10";
+  name = "rustRegistry-2017-10-03";

  src = fetchFromGitHub {
    owner = "rust-lang";
    repo = "crates.io-index";
-    rev = "2e573cbbb2db591ff9d46339910f21e35b21339f";
-    sha256 = "0sgpc2aygmvyjb3kinzh83bj4j92ny18159alqb1x8w26wqmisfq";
+    rev = "f9e21955350caf67db45c4a4a38dbab2f2250bfc";
+    sha256 = "1yk0l0r9idn7crnnw44sig69kvvyq3ycv417s88hd16m1fpl5y77";
  };
  phases = [ "unpackPhase" "installPhase" ];
  installPhase = ''