Merge branch 'master' into staging

* master: (271 commits)
  pysmbc: clarify license
  pysmbc: fix license
  bazel: 0.5.4 -> 0.6.0 (#29990)
  googler: init at 3.3
  go: declare support for aarch64
  firefox-beta-bin: 56.0b5 -> 57.0b4
  spotify: 1.0.64.401.g9d720389-21 -> 1.0.64.407.g9bd02c2d-26
  gogs: 0.11.19 -> 0.11.29
  grafana: 4.5.1 -> 4.5.2
  mopidy-iris: 3.4.1 -> 3.4.9
  nextcloud: 12.0.2 -> 12.0.3
  haskell-json-autotype: jailbreak to fix build within LTS 9.x
  kore: fix up
  kore: init at 2.0.0
  glusterfs service: fix issues with useRpcbind
  tig: 2.2.2 -> 2.3.0
  haskell-hspec-core: enable test suite again
  hackage-packages.nix: automatic Haskell package set update
  librsvg: fix thumbnailer path
  awscli: 1.11.108 -> 1.11.162
  ...

lib/maintainers.nix

@@ -287,6 +287,7 @@
   joelmo = "Joel Moberg <joel.moberg@gmail.com>";
   joelteon = "Joel Taylor <me@joelt.io>";
   johbo = "Johannes Bornhold <johannes@bornhold.name>";
+  johnmh = "John M. Harris, Jr. <johnmh@openblox.org>";
   johnramsden = "John Ramsden <johnramsden@riseup.net>";
   joko = "Ioannis Koutras <ioannis.koutras@gmail.com>";
   jonafato = "Jon Banafato <jon@jonafato.com>";
@@ -373,6 +374,7 @@
   meditans = "Carlo Nucera <meditans@gmail.com>";
   meisternu = "Matt Miemiec <meister@krutt.org>";
   metabar = "Celine Mercier <softs@metabarcoding.org>";
+  mgdelacroix = "Miguel de la Cruz <mgdelacroix@gmail.com>";
   mguentner = "Maximilian Güntner <code@klandest.in>";
   mic92 = "Jörg Thalheim <joerg@thalheim.io>";
   michaelpj = "Michael Peyton Jones <michaelpj@gmail.com>";
@@ -550,6 +552,7 @@
   siddharthist = "Langston Barrett <langston.barrett@gmail.com>";
   sigma = "Yann Hodique <yann.hodique@gmail.com>";
   simonvandel = "Simon Vandel Sillesen <simon.vandel@gmail.com>";
+  sivteck = "Sivaram Balakrishnan <sivaram1992@gmail.com>";
   sjagoe = "Simon Jagoe <simon@simonjagoe.com>";
   sjmackenzie = "Stewart Mackenzie <setori88@gmail.com>";
   sjourdois = "Stéphane ‘kwisatz’ Jourdois <sjourdois@gmail.com>";
@@ -575,6 +578,7 @@
   swarren83 = "Shawn Warren <shawn.w.warren@gmail.com>";
   swflint = "Samuel W. Flint <swflint@flintfam.org>";
   swistak35 = "Rafał Łasocha <me@swistak35.com>";
+  symphorien = "Guillaume Girol <symphorien_nixpkgs@xlumurb.eu>";
   szczyp = "Szczyp <qb@szczyp.com>";
   sztupi = "Attila Sztupak <attila.sztupak@gmail.com>";
   taeer = "Taeer Bar-Yam <taeer@necsi.edu>";

maintainers/scripts/gnome.sh

@@ -6,7 +6,7 @@ GNOME_FTP=ftp.gnome.org/pub/GNOME/sources
 
 # projects that don't follow the GNOME major versioning, or that we don't want to
 # programmatically update
-NO_GNOME_MAJOR="ghex gtkhtml gdm"
+NO_GNOME_MAJOR="ghex gtkhtml gdm gucharmap"
 
 usage() {
   echo "Usage: $0 <show project>|<update project>|<update-all> [major.minor]" >&2

nixos/doc/manual/release-notes/rl-1709.xml

@@ -6,13 +6,22 @@
 
 <title>Release 17.09 (“Hummingbird”, 2017/09/??)</title>
 
+<section xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xmlns:xi="http://www.w3.org/2001/XInclude"
+         version="5.0"
+         xml:id="sec-release-17.09-highlights">
+
+<title>Highlights</title>
+
 <para>In addition to numerous new and upgraded packages, this release
 has the following highlights: </para>
 
 <itemizedlist>
   <listitem>
     <para>
-      The GNOME version is now 3.24.
+      The GNOME version is now 3.24. KDE Plasma was upgraded to 5.10,
+      KDE Applications to 17.08.1 and KDE Frameworks to 5.37.
     </para>
   </listitem>
   <listitem>
@@ -47,22 +56,23 @@ has the following highlights: </para>
   </listitem>
   <listitem>
     <para>
-      The handling of SSL in the nginx module has been cleaned up, renaming
-      the misnomed <literal>enableSSL</literal> to <literal>onlySSL</literal>
-      which reflects its original intention. This is not to be used with the
-      already existing <literal>forceSSL</literal> which creates a second
-      non-SSL virtual host redirecting to the SSL virtual host. This by
-      chance had worked earlier due to specific implementation details. In
-      case you had specified both please remove the <literal>enableSSL</literal>
-      option to keep the previous behaviour.
+      The handling of SSL in the <literal>services.nginx</literal> module has
+      been cleaned up, renaming the misnamed <literal>enableSSL</literal> to
+      <literal>onlySSL</literal> which reflects its original intention. This
+      is not to be used with the already existing <literal>forceSSL</literal>
+      which creates a second non-SSL virtual host redirecting to the SSL
+      virtual host. This by chance had worked earlier due to specific
+      implementation details. In case you had specified both please remove
+      the <literal>enableSSL</literal> option to keep the previous behaviour.
     </para>
     <para>
       Another <literal>addSSL</literal> option has been introduced to configure
-      both a non-SSL virtual host and an SSL virtual host.
+      both a non-SSL virtual host and an SSL virtual host with the same
+      configuration.
     </para>
     <para>
-      Options to configure <literal>resolver</literal>s and
-      <literal>upstream</literal>s have been introduced. See their information
+      Options to configure <literal>resolver</literal> options and
+      <literal>upstream</literal> blocks have been introduced. See their information
       for further details.
     </para>
     <para>
@@ -74,19 +84,185 @@ has the following highlights: </para>
   </listitem>
 </itemizedlist>
 
+</section>
+<section xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xmlns:xi="http://www.w3.org/2001/XInclude"
+         version="5.0"
+         xml:id="sec-release-17.09-new-services">
+
+<title>New Services</title>
+
 <para>The following new services were added since the last release:</para>
 
 <itemizedlist>
-  <listitem>
-    <para></para>
-  </listitem>
+  <listitem><para><literal>config/fonts/fontconfig-penultimate.nix</literal></para></listitem>
+  <listitem><para><literal>config/fonts/fontconfig-ultimate.nix</literal></para></listitem>
+  <listitem><para><literal>config/terminfo.nix</literal></para></listitem>
+  <listitem><para><literal>hardware/sensor/iio.nix</literal></para></listitem>
+  <listitem><para><literal>hardware/nitrokey.nix</literal></para></listitem>
+  <listitem><para><literal>hardware/raid/hpsa.nix</literal></para></listitem>
+  <listitem><para><literal>programs/browserpass.nix</literal></para></listitem>
+  <listitem><para><literal>programs/gnupg.nix</literal></para></listitem>
+  <listitem><para><literal>programs/qt5ct.nix</literal></para></listitem>
+  <listitem><para><literal>programs/slock.nix</literal></para></listitem>
+  <listitem><para><literal>programs/thefuck.nix</literal></para></listitem>
+  <listitem><para><literal>security/auditd.nix</literal></para></listitem>
+  <listitem><para><literal>security/lock-kernel-modules.nix</literal></para></listitem>
+  <listitem><para><literal>service-managers/docker.nix</literal></para></listitem>
+  <listitem><para><literal>service-managers/trivial.nix</literal></para></listitem>
+  <listitem><para><literal>services/admin/salt/master.nix</literal></para></listitem>
+  <listitem><para><literal>services/admin/salt/minion.nix</literal></para></listitem>
+  <listitem><para><literal>services/audio/slimserver.nix</literal></para></listitem>
+  <listitem><para><literal>services/cluster/kubernetes/default.nix</literal></para></listitem>
+  <listitem><para><literal>services/cluster/kubernetes/dns.nix</literal></para></listitem>
+  <listitem><para><literal>services/cluster/kubernetes/dashboard.nix</literal></para></listitem>
+  <listitem><para><literal>services/continuous-integration/hail.nix</literal></para></listitem>
+  <listitem><para><literal>services/databases/clickhouse.nix</literal></para></listitem>
+  <listitem><para><literal>services/databases/postage.nix</literal></para></listitem>
+  <listitem><para><literal>services/desktops/gnome3/gnome-disks.nix</literal></para></listitem>
+  <listitem><para><literal>services/desktops/gnome3/gpaste.nix</literal></para></listitem>
+  <listitem><para><literal>services/logging/SystemdJournal2Gelf.nix</literal></para></listitem>
+  <listitem><para><literal>services/logging/heartbeat.nix</literal></para></listitem>
+  <listitem><para><literal>services/logging/journalwatch.nix</literal></para></listitem>
+  <listitem><para><literal>services/logging/syslogd.nix</literal></para></listitem>
+  <listitem><para><literal>services/mail/mailhog.nix</literal></para></listitem>
+  <listitem><para><literal>services/mail/nullmailer.nix</literal></para></listitem>
+  <listitem><para><literal>services/misc/airsonic.nix</literal></para></listitem>
+  <listitem><para><literal>services/misc/autorandr.nix</literal></para></listitem>
+  <listitem><para><literal>services/misc/exhibitor.nix</literal></para></listitem>
+  <listitem><para><literal>services/misc/fstrim.nix</literal></para></listitem>
+  <listitem><para><literal>services/misc/gollum.nix</literal></para></listitem>
+  <listitem><para><literal>services/misc/irkerd.nix</literal></para></listitem>
+  <listitem><para><literal>services/misc/jackett.nix</literal></para></listitem>
+  <listitem><para><literal>services/misc/radarr.nix</literal></para></listitem>
+  <listitem><para><literal>services/misc/snapper.nix</literal></para></listitem>
+  <listitem><para><literal>services/monitoring/osquery.nix</literal></para></listitem>
+  <listitem><para><literal>services/monitoring/prometheus/collectd-exporter.nix</literal></para></listitem>
+  <listitem><para><literal>services/monitoring/prometheus/fritzbox-exporter.nix</literal></para></listitem>
+  <listitem><para><literal>services/network-filesystems/kbfs.nix</literal></para></listitem>
+  <listitem><para><literal>services/networking/dnscache.nix</literal></para></listitem>
+  <listitem><para><literal>services/networking/fireqos.nix</literal></para></listitem>
+  <listitem><para><literal>services/networking/iwd.nix</literal></para></listitem>
+  <listitem><para><literal>services/networking/keepalived/default.nix</literal></para></listitem>
+  <listitem><para><literal>services/networking/keybase.nix</literal></para></listitem>
+  <listitem><para><literal>services/networking/lldpd.nix</literal></para></listitem>
+  <listitem><para><literal>services/networking/matterbridge.nix</literal></para></listitem>
+  <listitem><para><literal>services/networking/squid.nix</literal></para></listitem>
+  <listitem><para><literal>services/networking/tinydns.nix</literal></para></listitem>
+  <listitem><para><literal>services/networking/xrdp.nix</literal></para></listitem>
+  <listitem><para><literal>services/security/shibboleth-sp.nix</literal></para></listitem>
+  <listitem><para><literal>services/security/sks.nix</literal></para></listitem>
+  <listitem><para><literal>services/security/sshguard.nix</literal></para></listitem>
+  <listitem><para><literal>services/security/torify.nix</literal></para></listitem>
+  <listitem><para><literal>services/security/usbguard.nix</literal></para></listitem>
+  <listitem><para><literal>services/security/vault.nix</literal></para></listitem>
+  <listitem><para><literal>services/system/earlyoom.nix</literal></para></listitem>
+  <listitem><para><literal>services/system/saslauthd.nix</literal></para></listitem>
+  <listitem><para><literal>services/web-apps/nexus.nix</literal></para></listitem>
+  <listitem><para><literal>services/web-apps/pgpkeyserver-lite.nix</literal></para></listitem>
+  <listitem><para><literal>services/web-apps/piwik.nix</literal></para></listitem>
+  <listitem><para><literal>services/web-servers/lighttpd/collectd.nix</literal></para></listitem>
+  <listitem><para><literal>services/web-servers/minio.nix</literal></para></listitem>
+  <listitem><para><literal>services/x11/display-managers/xpra.nix</literal></para></listitem>
+  <listitem><para><literal>services/x11/xautolock.nix</literal></para></listitem>
+  <listitem><para><literal>tasks/filesystems/bcachefs.nix</literal></para></listitem>
+  <listitem><para><literal>tasks/powertop.nix</literal></para></listitem>
 </itemizedlist>
 
+</section>
+<section xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xmlns:xi="http://www.w3.org/2001/XInclude"
+         version="5.0"
+         xml:id="sec-release-17.09-incompatibilities">
+
+<title>Backward Incompatibilities</title>
 
 <para>When upgrading from a previous release, please be aware of the
 following incompatible changes:</para>
 
 <itemizedlist>
+  <listitem>
+    <para>
+        <emphasis role="strong">
+            In an Qemu-based virtualization environment, the network interface
+            names changed from i.e. <literal>enp0s3</literal> to
+            <literal>ens3</literal>.
+        </emphasis>
+    </para>
+    <para>
+        This is due to a kernel configuration change. The new naming
+        is consistent with those of other Linux distributions with
+        systemd. See
+        <link xlink:href="https://github.com/NixOS/nixpkgs/issues/29197">#29197</link>
+        for more information.
+    </para>
+    <para>
+        A machine is affected if the <literal>virt-what</literal> tool
+        either returns <literal>qemu</literal> or
+        <literal>kvm</literal> <emphasis>and</emphasis> has
+        interface names used in any part of its NixOS configuration,
+        in particular if a static network configuration with
+        <literal>networking.interfaces</literal> is used.
+    </para>
+    <para>
+        Before rebooting affected machines, please ensure:
+        <itemizedlist>
+          <listitem>
+            <para>
+              Change the interface names in your NixOS configuration.
+              The first interface will be called <literal>ens3</literal>,
+              the second one <literal>ens8</literal> and starting from there
+              incremented by 1.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              After changing the interface names, rebuild your system with
+              <literal>nixos-rebuild boot</literal> to activate the new
+              configuration after a reboot. If you switch to the new
+              configuration right away you might lose network connectivity!
+              If using <literal>nixops</literal>, deploy with
+              <literal>nixops deploy --force-reboot</literal>.
+            </para>
+          </listitem>
+        </itemizedlist>
+    </para>
+  </listitem>
+  <listitem>
+    <para>
+      The following changes apply if the <literal>stateVersion</literal> is changed to 17.09 or higher.
+      For <literal>stateVersion = "17.03"</literal> or lower the old behavior is preserved.
+    </para>
+    <itemizedlist>
+      <listitem>
+        <para>
+          The <literal>postgres</literal> default version was changed from 9.5 to 9.6.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>postgres</literal> superuser name has changed from <literal>root</literal> to <literal>postgres</literal> to more closely follow what other Linux distributions are doing.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>postgres</literal> default <literal>dataDir</literal> has changed from <literal>/var/db/postgres</literal> to <literal>/var/lib/postgresql/$psqlSchema</literal> where $psqlSchema is 9.6 for example.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>mysql</literal> default <literal>dataDir</literal> has changed from <literal>/var/mysql</literal> to <literal>/var/lib/mysql</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Radicale's default package has changed from 1.x to 2.x. Instructions to migrate can be found <link xlink:href="http://radicale.org/1to2/"> here </link>. It is also possible to use the newer version by setting the <literal>package</literal> to <literal>radicale2</literal>, which is done automatically when <literal>stateVersion</literal> is 17.09 or higher. The <literal>extraArgs</literal> option has been added to allow passing the data migration arguments specified in the instructions; see the <filename xlink:href="https://github.com/NixOS/nixpkgs/blob/master/nixos/tests/radicale.nix">radicale.nix</filename> NixOS test for an example migration.
+        </para>
+      </listitem>
+    </itemizedlist>
+  </listitem>
   <listitem>
     <para>
       The <literal>aiccu</literal> package was removed. This is due to SixXS
@@ -115,7 +291,7 @@ following incompatible changes:</para>
   </listitem>
   <listitem>
     <para>
-      The ipfs package now doesn't ignore the <literal>dataDir</literal> option anymore. If you've ever set this option to anything other than the default you'll have to either unset it (so the default gets used) or migrate the old data manually with
+      The <literal>ipfs</literal> service now doesn't ignore the <literal>dataDir</literal> option anymore. If you've ever set this option to anything other than the default you'll have to either unset it (so the default gets used) or migrate the old data manually with
 <programlisting>
 dataDir=&lt;valueOfDataDir&gt;
 mv /var/lib/ipfs/.ipfs/* $dataDir
@@ -123,32 +299,11 @@ rmdir /var/lib/ipfs/.ipfs
 </programlisting>
     </para>
   </listitem>
-  <listitem>
-    <para>
-      The following changes apply if the <literal>stateVersion</literal> is changed to 17.09 or higher.
-      For <literal>stateVersion = "17.03</literal> or lower the old behavior is preserved.
-    </para>
-    <para>
-      The <literal>postgres</literal> default version was changed from 9.5 to 9.6.
-    </para>
-    <para>
-      The <literal>postgres</literal> superuser name has changed from <literal>root</literal> to <literal>postgres</literal> to more closely follow what other Linux distributions are doing.
-    </para>
-    <para>
-      The <literal>postgres</literal> default <literal>dataDir</literal> has changed from <literal>/var/db/postgres</literal> to <literal>/var/lib/postgresql/$psqlSchema</literal> where $psqlSchema is 9.6 for example.
-    </para>
-    <para>
-      The <literal>mysql</literal> default <literal>dataDir</literal> has changed from <literal>/var/mysql</literal> to <literal>/var/lib/mysql</literal>.
-    </para>
-    <para>
-            Radicale's default package has changed from 1.x to 2.x. Instructions to migrate can be found <link xlink:href="http://radicale.org/1to2/"> here </link>. It is also possible to use the newer version by setting the <literal>package</literal> to <literal>radicale2</literal>, which is done automatically when <literal>stateVersion</literal> is 17.09 or higher. The <literal>extraArgs</literal> option has been added to allow passing the data migration arguments specified in the instructions; see the <filename xlink:href="https://github.com/NixOS/nixpkgs/blob/master/nixos/tests/radicale.nix">radicale.nix</filename> NixOS test for an example migration.
-    </para>
-  </listitem>
   <listitem>
     <para>
       The <literal>caddy</literal> service was previously using an extra
-      <literal>.caddy</literal> in the data directory specified with the
-      <literal>dataDir</literal> option. The contents of the
+      <literal>.caddy</literal> directory in the data directory specified
+      with the <literal>dataDir</literal> option. The contents of the
       <literal>.caddy</literal> directory are now expected to be in the
       <literal>dataDir</literal>.
     </para>
@@ -226,15 +381,6 @@ rmdir /var/lib/ipfs/.ipfs
       upstream's announcement</link> for more information.
       No complete replacement for grsecurity/PaX is available presently.
     </para>
-  </listitem>
-    <listitem>
-    <para>
-      The <literal>gnupg</literal> package used to suffix its programs
-      with <literal>2</literal>, like <command>gpg2</command> and
-      <command>gpgv2</command>. This suffix has since been dropped,
-      and the programs are now simply <command>gpg</command>,
-      <command>gpgv</command>, etc.
-    </para>
   </listitem>
   <listitem>
     <para>
@@ -273,22 +419,6 @@ FLUSH PRIVILEGES;
 </programlisting>
     </para>
   </listitem>
-  <listitem>
-    <para>
-      <literal>sha256</literal> argument value of
-      <literal>dockerTools.pullImage</literal> expression must be
-      updated since the mechanism to download the image has been
-      changed. Skopeo is now used to pull the image instead of the
-      Docker daemon.
-    </para>
-  </listitem>
-  <listitem>
-    <para>
-      Templated systemd services e.g <literal>container@name</literal> are
-      now handled currectly when switching to a new configuration, resulting
-      in them being reloaded.
-    </para>
-  </listitem>
 
   <listitem>
     <para>
@@ -330,6 +460,14 @@ FLUSH PRIVILEGES;
     </para>
   </listitem>
 
+  <listitem>
+    <para>
+      Templated systemd services e.g <literal>container@name</literal> are
+      now handled currectly when switching to a new configuration, resulting
+      in them being reloaded.
+    </para>
+  </listitem>
+
   <listitem>
     <para>Steam: the <literal>newStdcpp</literal> parameter
     was removed and should not be needed anymore.</para>
@@ -344,7 +482,14 @@ FLUSH PRIVILEGES;
   </listitem>
 </itemizedlist>
 
-<para>Other notable improvements:</para>
+</section>
+<section xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xmlns:xi="http://www.w3.org/2001/XInclude"
+         version="5.0"
+         xml:id="sec-release-17.09-notable-changes">
+
+<title>Other Notable Changes</title>
 
 <itemizedlist>
 
@@ -389,7 +534,7 @@ FLUSH PRIVILEGES;
       Nixpkgs overlays may now be specified with a file as well as a directory. The
       value of <literal>&lt;nixpkgs-overlays></literal> may be a file, and
       <filename>~/.config/nixpkgs/overlays.nix</filename> can be used instead of the
-      <filename>~/.config/nixpkgs/overalys</filename> directory.
+      <filename>~/.config/nixpkgs/overlays</filename> directory.
     </para>
     <para>
       See the overlays chapter of the Nixpkgs manual for more details.
@@ -418,22 +563,33 @@ FLUSH PRIVILEGES;
       which makes it possible to remove the install medium after booting.
       This allows tethering from your phone after booting from it.
     </para>
+  </listitem>
+  <listitem>
     <para>
       <literal>services.gitlab-runner.configOptions</literal> has been added
       to specify the configuration of gitlab-runners declaratively.
     </para>
+  </listitem>
+  <listitem>
     <para>
       <literal>services.jenkins.plugins</literal> has been added
       to install plugins easily, this can be generated with jenkinsPlugins2nix.
     </para>
+  </listitem>
+  <listitem>
     <para>
       <literal>services.postfix.config</literal> has been added
       to specify the main.cf with NixOS options. Additionally other options
       have been added to the postfix module and has been improved further.
     </para>
+  </listitem>
+  <listitem>
     <para>
-        The GitLab package and module have been updated to the latest 9.5 release.
+      The GitLab package and module have been updated to the latest 10.0
+      release.
     </para>
+  </listitem>
+  <listitem>
     <para>
       The <literal>systemd-boot</literal> boot loader now lists the NixOS
       version, kernel version and build date of all bootable generations.
@@ -452,3 +608,4 @@ FLUSH PRIVILEGES;
 </itemizedlist>
 
 </section>
+</section>

nixos/doc/manual/release-notes/rl-1803.xml

@@ -6,6 +6,14 @@
 
 <title>Release 18.03 (“Impala”, 2018/03/??)</title>
 
+<section xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xmlns:xi="http://www.w3.org/2001/XInclude"
+         version="5.0"
+         xml:id="sec-release-18.03-highlights">
+
+<title>Highlights</title>
+
 <para>In addition to numerous new and upgraded packages, this release
 has the following highlights: </para>
 
@@ -16,6 +24,15 @@ has the following highlights: </para>
   </listitem>
 </itemizedlist>
 
+</section>
+<section xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xmlns:xi="http://www.w3.org/2001/XInclude"
+         version="5.0"
+         xml:id="sec-release-18.03-new-services">
+
+<title>New Services</title>
+
 <para>The following new services were added since the last release:</para>
 
 <itemizedlist>
@@ -24,6 +41,15 @@ has the following highlights: </para>
   </listitem>
 </itemizedlist>
 
+</section>
+<section xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xmlns:xi="http://www.w3.org/2001/XInclude"
+         version="5.0"
+         xml:id="sec-release-18.03-incompatibilities">
+
+<title>Backward Incompatibilities</title>
+
 <para>When upgrading from a previous release, please be aware of the
 following incompatible changes:</para>
 
@@ -33,7 +59,14 @@ following incompatible changes:</para>
   </listitem>
 </itemizedlist>
 
-<para>Other notable improvements:</para>
+</section>
+<section xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xmlns:xi="http://www.w3.org/2001/XInclude"
+         version="5.0"
+         xml:id="sec-release-18.03-notable-changes">
+
+<title>Other Notable Changes</title>
 
 <itemizedlist>
   <listitem>
@@ -43,3 +76,4 @@ following incompatible changes:</para>
 </itemizedlist>
 
 </section>
+</section>

nixos/maintainers/scripts/ec2/create-amis.sh

@@ -17,7 +17,7 @@ mkdir -p $stateDir
 rm -f ec2-amis.nix
 
 types="hvm"
-stores="ebs s3"
+stores="ebs"
 regions="eu-west-1 eu-west-2 eu-central-1 us-east-1 us-east-2 us-west-1 us-west-2 ca-central-1 ap-southeast-1 ap-southeast-2 ap-northeast-1 ap-northeast-2 sa-east-1 ap-south-1"
 
 for type in $types; do

nixos/modules/hardware/video/nvidia.nix

@@ -42,7 +42,7 @@ in
   config = mkIf enabled {
     assertions = [
       {
-        assertion = services.xserver.displayManager.gdm.wayland;
+        assertion = config.services.xserver.displayManager.gdm.wayland;
         message = "NVidia drivers don't support wayland";
       }
     ];

nixos/modules/module-list.nix

@@ -73,6 +73,7 @@
   ./programs/adb.nix
   ./programs/atop.nix
   ./programs/bash/bash.nix
+  ./programs/bcc.nix
   ./programs/blcr.nix
   ./programs/browserpass.nix
   ./programs/cdemu.nix
@@ -102,6 +103,7 @@
   ./programs/spacefm.nix
   ./programs/ssh.nix
   ./programs/ssmtp.nix
+  ./programs/sysdig.nix
   ./programs/thefuck.nix
   ./programs/tmux.nix
   ./programs/venus.nix

nixos/modules/programs/bcc.nix

@@ -0,0 +1,9 @@
+{ config, lib, pkgs, ... }:
+{
+  options.programs.bcc.enable = lib.mkEnableOption "bcc";
+
+  config = lib.mkIf config.programs.bcc.enable {
+    environment.systemPackages = [ config.boot.kernelPackages.bcc ];
+    boot.extraModulePackages = [ config.boot.kernelPackages.bcc ];
+  };
+}

nixos/modules/programs/sysdig.nix

@@ -0,0 +1,14 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.programs.sysdig;
+in {
+  options.programs.sysdig.enable = mkEnableOption "sysdig";
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = [ pkgs.sysdig ];
+    boot.extraModulePackages = [ config.boot.kernelPackages.sysdig ];
+  };
+}

nixos/modules/security/pam_usb.nix

@@ -22,7 +22,7 @@ in
         description = ''
           Enable USB login for all login systems that support it.  For
           more information, visit <link
-          xlink:href="http://pamusb.org/doc/quickstart#setting_up" />.
+          xlink:href="https://github.com/aluzzardi/pam_usb/wiki/Getting-Started#setting-up-devices-and-users" />.
         '';
       };
 

nixos/modules/services/cluster/kubernetes/dashboard.nix

@@ -11,7 +11,7 @@ let
   image = pkgs.dockerTools.pullImage {
     imageName = name;
     imageTag = version;
-    sha256 = "0b5v7xa3s91yi9yfsw2b8wijiprnicbb02f5kqa579h4yndb3gfz";
+    sha256 = "1sf54d96nkgic9hir9c6p14gw24ns1k5d5a0r1sg414kjrvic0b4";
   };
 in {
   options.services.kubernetes.addons.dashboard = {

nixos/modules/services/cluster/kubernetes/dns.nix

@@ -8,19 +8,19 @@ let
   k8s-dns-kube-dns = pkgs.dockerTools.pullImage {
     imageName = "gcr.io/google_containers/k8s-dns-kube-dns-amd64";
     imageTag = version;
-    sha256 = "0g64jc2076ng28xl4w3w9svf7hc6s9h8rq9mhvvwpfy2p6lgj6gy";
+    sha256 = "0q97xfqrigrfjl2a9cxl5in619py0zv44gch09jm8gqjkxl80imp";
   };
 
   k8s-dns-dnsmasq-nanny = pkgs.dockerTools.pullImage {
     imageName = "gcr.io/google_containers/k8s-dns-dnsmasq-nanny-amd64";
     imageTag = version;
-    sha256 = "0sdpsbj1vismihy7ass1cn96nwmav6sf3r5h6i4k2dxha0y0jsh5";
+    sha256 = "051w5ca4qb88mwva4hbnh9xzlsvv7k1mbk3wz50lmig2mqrqqx6c";
   };
 
   k8s-dns-sidecar = pkgs.dockerTools.pullImage {
     imageName = "gcr.io/google_containers/k8s-dns-sidecar-amd64";
     imageTag = version;
-    sha256 = "01zpi189hpy2z62awl38fap908s8rrhc3v5gb6m90y2pycl4ad6q";
+    sha256 = "1z0d129bcm8i2cqq36x5jhnrv9hirj8c6kjrmdav8vgf7py78vsm";
   };
 
   cfg = config.services.kubernetes.addons.dns;

nixos/modules/services/mail/nullmailer.nix

@@ -35,6 +35,18 @@ with lib;
         description = "Whether to set the system sendmail to nullmailer's.";
       };
 
+      remotesFile = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        description = ''
+          Path to the <code>remotes</code> control file. This file contains a
+          list of remote servers to which to send each message.
+
+          See <code>man 8 nullmailer-send</code> for syntax and available
+          options.
+        '';
+      };
+
       config = {
         adminaddr = mkOption {
           type = types.nullOr types.str;
@@ -142,7 +154,16 @@ with lib;
           type = types.nullOr types.str;
           default = null;
           description = ''
-            If set, content will override the envelope sender on all messages.
+            A list of remote servers to which to send each message. Each line
+            contains a remote host name or address followed by an optional
+            protocol string, separated by white space.
+
+            See <code>man 8 nullmailer-send</code> for syntax and available
+            options.
+
+            WARNING: This is stored world-readable in the nix store. If you need
+            to specify any secret credentials here, consider using the
+            <code>remotesFile</code> option instead.
           '';
         };
 
@@ -164,13 +185,19 @@ with lib;
     cfg = config.services.nullmailer;
   in mkIf cfg.enable {
 
+    assertions = [
+      { assertion = cfg.config.remotes == null || cfg.remotesFile == null;
+        message = "Only one of `remotesFile` or `config.remotes` may be used at a time.";
+      }
+    ];
+
     environment = {
       systemPackages = [ pkgs.nullmailer ];
       etc = let
-        getval  = attr: builtins.getAttr attr cfg.config;
-        attrs   = builtins.attrNames cfg.config;
-        attrs'  = builtins.filter (attr: ! isNull (getval attr)) attrs;
-      in foldl' (as: attr: as // { "nullmailer/${attr}".text = getval attr; }) {} attrs';
+        validAttrs = filterAttrs (name: value: value != null) cfg.config;
+      in
+        (foldl' (as: name: as // { "nullmailer/${name}".text = validAttrs.${name}; }) {} (attrNames validAttrs))
+          // optionalAttrs (cfg.remotesFile != null) { "nullmailer/remotes".source = cfg.remotesFile; };
     };
 
     users = {
@@ -192,7 +219,7 @@ with lib;
 
       preStart = ''
         mkdir -p /var/spool/nullmailer/{queue,tmp}
-        rm -f var/spool/nullmailer/trigger && mkfifo -m 660 /var/spool/nullmailer/trigger
+        rm -f /var/spool/nullmailer/trigger && mkfifo -m 660 /var/spool/nullmailer/trigger
         chown ${cfg.user} /var/spool/nullmailer/*
       '';
 

nixos/modules/services/misc/gitlab.nix

@@ -635,6 +635,13 @@ in {
         chown -R ${cfg.user}:${cfg.group} ${cfg.statePath}
         chmod -R ug+rwX,o-rwx+X ${cfg.statePath}
         chmod -R u+rwX,go-rwx+X ${gitlabEnv.HOME}
+        chmod -R ug+rwX,o-rwx ${cfg.statePath}/repositories
+        chmod -R ug-s ${cfg.statePath}/repositories
+        find ${cfg.statePath}/repositories -type d -print0 | xargs -0 chmod g+s
+        chmod 700 ${cfg.statePath}/uploads
+        chown -R git ${cfg.statePath}/uploads
+        find ${cfg.statePath}/uploads -type f -exec chmod 0644 {} \;
+        find ${cfg.statePath}/uploads -type d -not -path ${cfg.statePath}/uploads -exec chmod 0700 {} \;
       '';
 
       serviceConfig = {

nixos/modules/services/network-filesystems/glusterfs.nix

@@ -41,6 +41,57 @@ in
         default = "INFO";
       };
 
+      useRpcbind = mkOption {
+        type = types.bool;
+        description = ''
+          Enable use of rpcbind. This is required for Gluster's NFS functionality.
+
+          You may want to turn it off to reduce the attack surface for DDoS reflection attacks.
+
+          See https://davelozier.com/glusterfs-and-rpcbind-portmap-ddos-reflection-attacks/
+          and https://bugzilla.redhat.com/show_bug.cgi?id=1426842 for details.
+        '';
+        default = true;
+      };
+
+      enableGlustereventsd = mkOption {
+        type = types.bool;
+        description = "Whether to enable the GlusterFS Events Daemon";
+        default = true;
+      };
+
+      killMode = mkOption {
+        type = types.enum ["control-group" "process" "mixed" "none"];
+        description = ''
+          The systemd KillMode to use for glusterd.
+
+          glusterd spawns other daemons like gsyncd.
+          If you want these to stop when glusterd is stopped (e.g. to ensure
+          that NixOS config changes are reflected even for these sub-daemons),
+          set this to 'control-group'.
+          If however you want running volume processes (glusterfsd) and thus
+          gluster mounts not be interrupted when glusterd is restarted
+          (for example, when you want to restart them manually at a later time),
+          set this to 'process'.
+        '';
+        default = "control-group";
+      };
+
+      stopKillTimeout = mkOption {
+        type = types.str;
+        description = ''
+          The systemd TimeoutStopSec to use.
+
+          After this time after having been asked to shut down, glusterd
+          (and depending on the killMode setting also its child processes)
+          are killed by systemd.
+
+          The default is set low because GlusterFS (as of 3.10) is known to
+          not tell its children (like gsyncd) to terminate at all.
+        '';
+        default = "5s";
+      };
+
       extraFlags = mkOption {
         type = types.listOf types.str;
         description = "Extra flags passed to the GlusterFS daemon";
@@ -89,7 +140,7 @@ in
   config = mkIf cfg.enable {
     environment.systemPackages = [ pkgs.glusterfs ];
 
-    services.rpcbind.enable = true;
+    services.rpcbind.enable = cfg.useRpcbind;
 
     environment.etc = mkIf (cfg.tlsSettings != null) {
       "ssl/glusterfs.pem".source = cfg.tlsSettings.tlsPem;
@@ -104,9 +155,8 @@ in
 
       wantedBy = [ "multi-user.target" ];
 
-      requires = [ "rpcbind.service" ];
-      after = [ "rpcbind.service" "network.target" "local-fs.target" ];
-      before = [ "network-online.target" ];
+      requires = lib.optional cfg.useRpcbind "rpcbind.service";
+      after = [ "network.target" "local-fs.target" ] ++ lib.optional cfg.useRpcbind "rpcbind.service";
 
       preStart = ''
         install -m 0755 -d /var/log/glusterfs
@@ -130,11 +180,12 @@ in
         PIDFile="/run/glusterd.pid";
         LimitNOFILE=65536;
         ExecStart="${glusterfs}/sbin/glusterd -p /run/glusterd.pid --log-level=${cfg.logLevel} ${toString cfg.extraFlags}";
-        KillMode="process";
+        KillMode=cfg.killMode;
+        TimeoutStopSec=cfg.stopKillTimeout;
       };
     };
 
-    systemd.services.glustereventsd = {
+    systemd.services.glustereventsd = mkIf cfg.enableGlustereventsd {
       inherit restartTriggers;
 
       description = "Gluster Events Notifier";
@@ -143,6 +194,10 @@ in
 
       after = [ "syslog.target" "network.target" ];
 
+      preStart = ''
+        install -m 0755 -d /var/log/glusterfs
+      '';
+
       serviceConfig = {
         Type="simple";
         Environment="PYTHONPATH=${glusterfs}/usr/lib/python2.7/site-packages";

nixos/modules/tasks/encrypted-devices.nix

@@ -57,7 +57,7 @@ in
 
   config = mkIf anyEncrypted {
     assertions = map (dev: {
-      assertion = dev.label != null;
+      assertion = dev.encrypted.label != null;
       message = ''
         The filesystem for ${dev.mountPoint} has encrypted.enable set to true, but no encrypted.label set
       '';

nixos/release.nix

@@ -278,6 +278,7 @@ in rec {
   tests.login = callTest tests/login.nix {};
   #tests.logstash = callTest tests/logstash.nix {};
   tests.mathics = callTest tests/mathics.nix {};
+  tests.mesos = callTest tests/mesos.nix {};
   tests.misc = callTest tests/misc.nix {};
   tests.mongodb = callTest tests/mongodb.nix {};
   tests.mumble = callTest tests/mumble.nix {};
@@ -302,7 +303,7 @@ in rec {
   #tests.panamax = hydraJob (import tests/panamax.nix { system = "x86_64-linux"; });
   tests.peerflix = callTest tests/peerflix.nix {};
   tests.postgresql = callSubTests tests/postgresql.nix {};
-  tests.pgjwt = callTest tests/pgjwt.nix {};
+  #tests.pgjwt = callTest tests/pgjwt.nix {};
   tests.printing = callTest tests/printing.nix {};
   tests.proxy = callTest tests/proxy.nix {};
   tests.pumpio = callTest tests/pump.io.nix {};

nixos/tests/gnome3-gdm.nix

@@ -21,7 +21,7 @@ import ./make-test.nix ({ pkgs, ...} : {
       };
       services.xserver.desktopManager.gnome3.enable = true;
 
-      virtualisation.memorySize = 512;
+      virtualisation.memorySize = 1024;
     };
 
   testScript =

pkgs/applications/altcoins/dapp.nix

@@ -1,15 +1,15 @@
 { lib, stdenv, fetchFromGitHub, makeWrapper
-, seth, git, solc, shellcheck, nodejs, hsevm }:
+, seth, git, solc, shellcheck, nodejs, hevm }:
 
 stdenv.mkDerivation rec {
   name = "dapp";
-  version = "0.5.3";
+  version = "0.5.7";
 
   src = fetchFromGitHub {
     owner = "dapphub";
     repo = "dapp";
     rev = "v${version}";
-    sha256 = "13b2krd02py8jnzjis44lay5i31d95z0myrsy5afzw7fa25giird";
+    sha256 = "128f35hczarihb263as391wr9zbyc1q1p49qbxh30via23r1brb0";
   };
 
   nativeBuildInputs = [makeWrapper shellcheck];
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   checkPhase = "make test";
   makeFlags = ["prefix=$(out)"];
   postInstall = let path = lib.makeBinPath [
-    nodejs solc git seth hsevm
+    nodejs solc git seth hevm
   ]; in ''
     wrapProgram "$out/bin/dapp" --prefix PATH : "${path}"
   '';

pkgs/applications/altcoins/default.nix

@@ -46,7 +46,7 @@ rec {
   seth = callPackage ./seth.nix { };
   dapp = callPackage ./dapp.nix { };
 
-  hsevm = (haskellPackages.callPackage ./hsevm.nix {});
+  hevm = (haskellPackages.callPackage ./hevm.nix {});
 
   primecoin  = callPackage ./primecoin.nix { withGui = true; };
   primecoind = callPackage ./primecoin.nix { withGui = false; };

pkgs/applications/altcoins/hevm.nix

@@ -1,24 +1,28 @@
-{ mkDerivation, abstract-par, aeson, ansi-wl-pprint, base
+{ mkDerivation, abstract-par, aeson, ansi-wl-pprint, async, base
 , base16-bytestring, base64-bytestring, binary, brick, bytestring
 , cereal, containers, cryptonite, data-dword, deepseq, directory
-, filepath, ghci-pretty, here, HUnit, lens, lens-aeson, memory
-, monad-par, mtl, optparse-generic, process, QuickCheck
-, quickcheck-text, readline, rosezipper, scientific, stdenv, tasty, tasty-hunit
-, tasty-quickcheck, temporary, text, text-format
-, unordered-containers, vector, vty
+, filepath, ghci-pretty, here, HUnit, lens
+, lens-aeson, memory, monad-par, mtl, optparse-generic, process
+, QuickCheck, quickcheck-text, readline, rosezipper, scientific
+, stdenv, tasty, tasty-hunit, tasty-quickcheck, temporary, text
+, text-format, time, unordered-containers, vector, vty
+
+, restless-git
+
 , fetchFromGitHub, lib, makeWrapper
 , ncurses, zlib, bzip2, solc, coreutils
+, bash
 }:
 
 lib.overrideDerivation (mkDerivation rec {
-  pname = "hsevm";
-  version = "0.6.4";
+  pname = "hevm";
+  version = "0.8.5";
 
   src = fetchFromGitHub {
     owner = "dapphub";
-    repo = "hsevm";
+    repo = "hevm";
     rev = "v${version}";
-    sha256 = "01b67k9cam4gvsi07q3vx527m1w6p6xll64k1nl27bc8ik6jh8l9";
+    sha256 = "1a27bh0azf2hdg5hp6s9azv2rhzy7vrlq1kmg688g9nfwwwhgkp0";
   };
 
   isLibrary = false;
@@ -26,8 +30,9 @@ lib.overrideDerivation (mkDerivation rec {
   enableSharedExecutables = false;
 
   postInstall = ''
-    rm -rf $out/{lib,share}
-    wrapProgram $out/bin/hsevm --add-flags '+RTS -N$((`${coreutils}/bin/nproc` - 1)) -RTS'
+    wrapProgram $out/bin/hevm \
+       --add-flags '+RTS -N$((`${coreutils}/bin/nproc` - 1)) -RTS' \
+       --suffix PATH : "${lib.makeBinPath [bash coreutils]}"
   '';
 
   extraLibraries = [
@@ -36,17 +41,17 @@ lib.overrideDerivation (mkDerivation rec {
     cryptonite data-dword deepseq directory filepath ghci-pretty lens
     lens-aeson memory monad-par mtl optparse-generic process QuickCheck
     quickcheck-text readline rosezipper scientific temporary text text-format
-    unordered-containers vector vty
+    unordered-containers vector vty restless-git
   ];
   executableHaskellDepends = [
-    readline zlib bzip2
+    async readline zlib bzip2
   ];
   testHaskellDepends = [
     base binary bytestring ghci-pretty here HUnit lens mtl QuickCheck
     tasty tasty-hunit tasty-quickcheck text vector
   ];
 
-  homepage = https://github.com/dapphub/hsevm;
+  homepage = https://github.com/dapphub/hevm;
   description = "Ethereum virtual machine evaluator";
   license = stdenv.lib.licenses.agpl3;
   maintainers = [stdenv.lib.maintainers.dbrock];

pkgs/applications/altcoins/zcash/default.nix

@@ -9,13 +9,13 @@ with stdenv.lib;
 stdenv.mkDerivation rec {
 
   name = "zcash" + (toString (optional (!withGui) "d")) + "-" + version;
-  version = "1.0.11";
+  version = "1.0.12";
 
   src = fetchFromGitHub {
     owner = "zcash";
     repo  = "zcash";
     rev = "v${version}";
-    sha256 = "09474jdhsg30maqrwfxigbw3llqi8axhh82lz3a23ii2gj68ni55";
+    sha256 = "19bxhdnkvgncgl9x6nbaf5nwgrdfw99icvdbi9adfh646pd5z64s";
   };
 
   enableParallelBuilding = true;

pkgs/applications/audio/gnaural/default.nix

@@ -14,5 +14,6 @@ stdenv.mkDerivation rec {
       license = licenses.gpl2;
       maintainers = [ maintainers.ehmry ];
       platforms = platforms.linux;
+      broken = true;
     };
 }

pkgs/applications/audio/mopidy-iris/default.nix

@@ -2,12 +2,12 @@
 
 pythonPackages.buildPythonApplication rec {
   name = "mopidy-iris-${version}";
-  version = "3.4.1";
+  version = "3.4.9";
 
   src = pythonPackages.fetchPypi {
     inherit version;
     pname = "Mopidy-Iris";
-    sha256 = "04fjj2n5v53ykxnjgna1y8bvk7g3x0yiqisvzrdva693lfz9cbgx";
+    sha256 = "0acr8ss5d0jgcy1qsjb12h0n6kr6qdp9zrbbk9vv3m3s6kcm8vgb";
   };
 
   propagatedBuildInputs = [
@@ -16,6 +16,7 @@ pythonPackages.buildPythonApplication rec {
     pythonPackages.configobj
     pythonPackages.pylast
     pythonPackages.spotipy
+    pythonPackages.raven
   ];
 
   meta = with stdenv.lib; {

pkgs/applications/audio/mpg123/default.nix

@@ -4,11 +4,11 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "mpg123-1.25.4";
+  name = "mpg123-1.25.7";
 
   src = fetchurl {
     url = "mirror://sourceforge/mpg123/${name}.tar.bz2";
-    sha256 = "1rxknrnl3ji5hi5rbckpzhbl1k5r8i53kcys4xdgg0xbi8765dfd";
+    sha256 = "1ws40fglyyk51jvmz8gfapjkw1g51pkch1rffdsbh4b1yay5xc9i";
   };
 
   buildInputs = stdenv.lib.optional (!stdenv.isDarwin) alsaLib;

pkgs/applications/audio/rosegarden/default.nix

@@ -1,24 +1,36 @@
-{ stdenv, fetchurl, cmake, qt4, pkgconfig, ladspaPlugins, ladspaH,
-  dssi, liblo, liblrdf, fftwSinglePrec, libsndfile,
-  libsamplerate, perl, makedepend, libjack2,
-  withLirc ? false, lirc ? null } :
+{ stdenv, fetchurl, cmake, makedepend, perl, pkgconfig, qttools
+, dssi, fftwSinglePrec, ladspaH, ladspaPlugins, libjack2
+, liblo, liblrdf, libsamplerate, libsndfile, lirc ? null, qtbase }:
 
 stdenv.mkDerivation (rec {
   version = "17.04";
   name = "rosegarden-${version}";
 
   src = fetchurl {
-    url  = "mirror://sourceforge/rosegarden/${name}.tar.bz2";
+    url = "mirror://sourceforge/rosegarden/${name}.tar.bz2";
     sha256 = "1khfcj22asdhjh0jvhkqsz200wgmigkhsrcz09ffia5hqm0n32lq";
   };
 
-  QTDIR = qt4;
+  patchPhase = ''
+    substituteInPlace src/CMakeLists.txt --replace svnheader svnversion
+  '';
+
+  nativeBuildInputs = [ cmake makedepend perl pkgconfig qttools ];
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    cmake qt4 ladspaPlugins ladspaH dssi liblo liblrdf fftwSinglePrec
-    libsndfile libsamplerate perl makedepend libjack2
-  ] ++ stdenv.lib.optional withLirc [ lirc ];
+    dssi
+    fftwSinglePrec
+    ladspaH
+    ladspaPlugins
+    libjack2
+    liblo
+    liblrdf
+    libsamplerate
+    libsndfile
+    lirc
+    qtbase
+  ];
 
   enableParallelBuilding = true;
 
@@ -26,11 +38,15 @@ stdenv.mkDerivation (rec {
     homepage = http://www.rosegardenmusic.com/;
     description = "Music composition and editing environment";
     longDescription = ''
-      Rosegarden is a music composition and editing environment based around a MIDI sequencer that features a rich understanding of music notation and includes basic support for digital audio.
-      Rosegarden is an easy-to-learn, attractive application that runs on Linux, ideal for composers, musicians, music students, and small studio or home recording environments.
-      '';
+      Rosegarden is a music composition and editing environment based around
+      a MIDI sequencer that features a rich understanding of music notation
+      and includes basic support for digital audio.
 
-    maintainers = [ maintainers.lebastr ];
+      Rosegarden is an easy-to-learn, attractive application that runs on Linux,
+      ideal for composers, musicians, music students, and small studio or home
+      recording environments.
+    '';
+    maintainers = with maintainers; [ lebastr ];
     license = licenses.lgpl2Plus;
     platforms = platforms.linux;
   };

pkgs/applications/audio/spotify/default.nix

@@ -9,7 +9,7 @@ let
   # Latest version number can be found at:
   # http://repository-origin.spotify.com/pool/non-free/s/spotify-client/
   # Be careful not to pick the testing version.
-  version = "1.0.49.125.g72ee7853-111";
+  version = "1.0.64.407.g9bd02c2d-26";
 
   deps = [
     alsaLib
@@ -54,7 +54,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://repository-origin.spotify.com/pool/non-free/s/spotify-client/spotify-client_${version}_amd64.deb";
-    sha256 = "0l008x06d257vcw6gq3q90hvv93cq6mxpj11by1np6bzzg61qv8x";
+    sha256 = "0zc8vclf1wx60yllc1jgzhqyv5lkwz95qmmy5f79zkj6vrdak5wc";
   };
 
   buildInputs = [ dpkg makeWrapper ];

pkgs/applications/audio/streamripper/default.nix

@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     homepage = http://streamripper.sourceforge.net/;
     description = "Application that lets you record streaming mp3 to your hard drive";
     license = licenses.gpl2;
-    platforms = platforms.unix;
+    platforms = platforms.linux;
     maintainers = with maintainers; [ the-kenny ];
   };
 }

pkgs/applications/editors/aseprite/default.nix

@@ -11,7 +11,7 @@
 
 stdenv.mkDerivation rec {
   name = "aseprite-${version}";
-  version = if unfree then "1.2-beta12" else "1.1.7";
+  version = if unfree then "1.2.2" else "1.1.7";
 
   src = fetchFromGitHub {
     owner = "aseprite";
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     rev = "v${version}";
     fetchSubmodules = true;
     sha256 = if unfree
-      then "1zgsr03d4vwdj2qyiwfwfqsbqngp85n13i3xwbkfkbja036c5yhc"
+      then "1ldi7zikl1g6rq3g9lkypx5wqzza5j0054j1r8bh7lyvb0szicig"
       else "0gd49lns2bpzbkwax5jf9x1xmg1j8ij997kcxr2596cwiswnw4di";
   };
 
@@ -30,6 +30,10 @@ stdenv.mkDerivation rec {
     libX11 libXext libXcursor libXxf86vm
   ] ++ lib.optionals unfree [ cmark ];
 
+  postPatch = ''
+    sed -i src/config.h -e "s-\\(#define VERSION\\) .*-\\1 \"$version\"-"
+  '';
+
   cmakeFlags = [
     "-DENABLE_UPDATER=OFF"
     "-DUSE_SHARED_CURL=ON"

pkgs/applications/editors/atom/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "atom-${version}";
-  version = "1.20.0";
+  version = "1.20.1";
 
   src = fetchurl {
     url = "https://github.com/atom/atom/releases/download/v${version}/atom-amd64.deb";
-    sha256 = "1jzpa44ny78djdxc8d2w4jz1m68xmi8bzq87q3wmdffa4g9z4aa0";
+    sha256 = "0mr82m3yv18ljai3r4ncr65bqhjwxyf1si77iza4ijk5zv1llp7i";
     name = "${name}.deb";
   };
 

pkgs/applications/editors/focuswriter/default.nix

@@ -1,26 +1,27 @@
-{ stdenv, fetchurl, qt4, qmake4Hook, pkgconfig, hunspell }:
+{ stdenv, fetchurl, pkgconfig, qmake, qttools, hunspell, qtbase, qtmultimedia }:
 
 stdenv.mkDerivation rec {
   name = "focuswriter-${version}";
-  version = "1.5.3";
+  version = "1.6.7";
 
   src = fetchurl {
-    url = http://gottcode.org/focuswriter/focuswriter-1.5.3-src.tar.bz2;
-    sha256 = "1i58jxbiy95ijf81g8c3gwxhcg3irzssna3wv7vhrd57g4lcfj0w";
+    url = "https://gottcode.org/focuswriter/focuswriter-${version}-src.tar.bz2";
+    sha256 = "10rqzinr6yd6ca06rklg34kdc08a3xgygfzmprsfg7gdsybfay5z";
   };
 
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ qt4 qmake4Hook hunspell ];
-  
-  qmakeFlags = [ "PREFIX=/" ];
+  nativeBuildInputs = [ pkgconfig qmake qttools ];
+  buildInputs = [ hunspell qtbase qtmultimedia ];
 
+  enableParallelBuilding = true;
+
+  qmakeFlags = [ "PREFIX=/" ];
   installFlags = [ "INSTALL_ROOT=$(out)" ];
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "Simple, distraction-free writing environment";
-    license = stdenv.lib.licenses.gpl2;
-    maintainers = [ stdenv.lib.maintainers.madjar ];
-    platforms = stdenv.lib.platforms.all;
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ madjar ];
+    platforms = platforms.all;
     homepage = https://gottcode.org/focuswriter/;
   };
 }

pkgs/applications/gis/grass/default.nix

@@ -72,5 +72,6 @@ stdenv.mkDerivation {
     description = "GIS software suite used for geospatial data management and analysis, image processing, graphics and maps production, spatial modeling, and visualization";
     license = stdenv.lib.licenses.gpl2Plus;
     platforms = stdenv.lib.platforms.all;
+    broken = true;
   };
 }

pkgs/applications/graphics/kgraphviewer/default.nix

@@ -1,24 +1,38 @@
-{ stdenv, fetchurl, automoc4, cmake, gettext, perl, pkgconfig
-, kdelibs4, boost, graphviz
+{ stdenv, mkDerivation, fetchurl, cmake, extra-cmake-modules, pkgconfig, wrapGAppsHook
+, kconfig, kcrash, kinit, kdoctools, kiconthemes, kio, kparts, kwidgetsaddons
+, qtbase, qtsvg
+, boost, graphviz
 }:
 
-stdenv.mkDerivation rec {
+mkDerivation rec {
   name = "kgraphviewer-${version}";
-  version = "2.2.0";
+  version = "2.4.2";
 
   src = fetchurl {
-    url = "mirror://kde/stable/kgraphviewer/${version}/src/${name}.tar.xz";
-    sha256 = "1vs5x539mx26xqdljwzkh2bj7s3ydw4cb1wm9nlhgs18siw4gjl5";
+    url = "mirror://kde/stable/kgraphviewer/${version}/${name}.tar.xz";
+    sha256 = "1jc5zfgy4narwgn7rscfwz7l5pjy0jghal6yb3kd4sfadi78nhs9";
   };
 
-  buildInputs = [ kdelibs4 boost graphviz ];
-  nativeBuildInputs = [ automoc4 cmake gettext perl pkgconfig ];
+  buildInputs = [
+    qtbase qtsvg
+    boost graphviz
+  ];
+
+  nativeBuildInputs = [
+    cmake extra-cmake-modules pkgconfig wrapGAppsHook
+    kdoctools
+  ];
+
+  propagatedBuildInputs = [
+    kconfig kinit kio kparts kwidgetsaddons
+  ];
+
+  enableParallelBuilding = true;
 
   meta = with stdenv.lib; {
     description = "A Graphviz dot graph viewer for KDE";
-    license = licenses.gpl2;
-    platforms = platforms.linux;
-    maintainers = [ maintainers.lethalman ];
+    license     = licenses.gpl2;
+    maintainers = with maintainers; [ lethalman ];
+    platforms   = platforms.linux;
   };
 }
-

pkgs/applications/graphics/meshlab/default.nix

@@ -46,6 +46,6 @@ stdenv.mkDerivation rec {
     license = stdenv.lib.licenses.gpl2Plus;
     maintainers = with stdenv.lib.maintainers; [viric];
     platforms = with stdenv.lib.platforms; linux;
-    broken = stdenv.isLinux && stdenv.isi686;
+    broken = true;
   };
 }

pkgs/applications/graphics/synfigstudio/default.nix

@@ -42,6 +42,8 @@ let
     buildInputs = [
       ETL boost cairo glibmm mlt-qt5 libsigcxx libxmlxx pango
     ];
+
+    meta.broken = true;
   };
 in
 stdenv.mkDerivation rec {

pkgs/applications/misc/electron-cash/default.nix

@@ -0,0 +1,66 @@
+{ stdenv, fetchFromGitHub, python2Packages }:
+
+python2Packages.buildPythonApplication rec {
+  version = "2.9.3";
+  name = "electron-cash-${version}";
+
+  src = fetchFromGitHub {
+    owner = "fyookball";
+    repo = "electrum";
+    rev = version;
+    sha256 = "1r39b5ag5fipzgr84pzb53cfm8a4dy53257608754dwr1gfpma3v";
+  };
+
+  propagatedBuildInputs = with python2Packages; [
+    dns
+    ecdsa
+    jsonrpclib
+    pbkdf2
+    pyaes
+    pycrypto
+    pyqt4
+    pysocks
+    qrcode
+    requests
+    tlslite
+
+    # plugins
+    keepkey
+    trezor
+  ];
+
+  preBuild = ''
+    sed -i 's,usr_share = .*,usr_share = "'$out'/share",g' setup.py
+    pyrcc4 icons.qrc -o gui/qt/icons_rc.py
+    # Recording the creation timestamps introduces indeterminism to the build
+    sed -i '/Created: .*/d' gui/qt/icons_rc.py
+  '';
+
+  postInstall = ''
+    # Despite setting usr_share above, these files are installed under
+    # $out/nix ...
+    mv $out/lib/python2.7/site-packages/nix/store"/"*/share $out
+    rm -rf $out/lib/python2.7/site-packages/nix
+
+    substituteInPlace $out/share/applications/electron.desktop \
+      --replace "Exec=electrum %u" "Exec=$out/bin/electrum %u"
+  '';
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    $out/bin/electrum help >/dev/null
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A lightweight Bitcoin wallet";
+    longDescription = ''
+      An easy-to-use Bitcoin client featuring wallets generated from
+      mnemonic seeds (in addition to other, more advanced, wallet options)
+      and the ability to perform transactions without downloading a copy
+      of the blockchain.
+    '';
+    homepage = https://www.electroncash.org/;
+    maintainers = with maintainers; [ lassulus ];
+    license = licenses.mit;
+  };
+}

pkgs/applications/misc/googler/default.nix

@@ -0,0 +1,25 @@
+{stdenv, fetchFromGitHub, python}:
+
+stdenv.mkDerivation rec {
+  version = "3.3";
+  name = "googler-${version}";
+
+  src = fetchFromGitHub {
+    owner = "jarun";
+    repo = "googler";
+    rev = "v${version}";
+    sha256 = "0gkzgcf0qss7fskgswryk835vivlv1f99ym1pbxy3vv9wcwx6a43";
+  };
+
+  propagatedBuildInputs = [ python ];
+
+  makeFlags = "PREFIX=$(out)";
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/jarun/googler;
+    description = "Google Search, Google Site Search, Google News from the terminal";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ koral ];
+    platforms = platforms.unix;
+  };
+}

pkgs/applications/misc/hamster-time-tracker/default.nix

@@ -31,6 +31,10 @@ pythonPackages.buildPythonApplication rec {
     python waf build
   '';
 
+  postFixup = ''
+    wrapPythonProgramsIn $out/lib/hamster-time-tracker "$out $pythonPath"
+  '';
+
   installPhase = ''
     python waf install
   '';

pkgs/applications/misc/hugo/default.nix

@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   name = "hugo-${version}";
-  version = "0.27.1";
+  version = "0.29";
 
   goPackagePath = "github.com/gohugoio/hugo";
 
@@ -10,7 +10,7 @@ buildGoPackage rec {
     owner = "gohugoio";
     repo = "hugo";
     rev = "v${version}";
-    sha256 = "0vxzjwm9dsan314cz0gnj4spssg4w8y6ywsak8n9c6w0l45xf07p";
+    sha256 = "1vklws05534ig9rj55cqnxpqfsvns64kfdg6zjyrcpz7l0z07a33";
   };
 
   goDeps = ./deps.nix;

pkgs/applications/misc/hugo/deps.nix

@@ -26,6 +26,15 @@
       sha256 = "13r896yy71i6jj1cwv2pjp53wjfxkg7bh884fggv6y79ly0qr63j";
     };
   }
+  {
+    goPackagePath = "github.com/alecthomas/chroma";
+    fetch = {
+      type = "git";
+      url = "https://github.com/alecthomas/chroma";
+      rev = "b0295f66bdb7c61d54906003d7649185794e21b4";
+      sha256 = "1hnvv13nphbzr9xm21fys7lgm0kd6qlbk58vc8fi802lxzsfmdis";
+    };
+  }
   {
     goPackagePath = "github.com/bep/gitmap";
     fetch = {
@@ -40,8 +49,8 @@
     fetch = {
       type = "git";
       url = "https://github.com/chaseadamsio/goorgeous";
-      rev = "677defd0e024333503d8c946dd4ba3f32ad3e5d2";
-      sha256 = "1mcncs3qdb62m9xwhkxy743ddvgsjfbmbl2djnhqmz1va05njna1";
+      rev = "098da33fde5f9220736531b3cb26a2dec86a8367";
+      sha256 = "1cwag5vzgrzy22rvcp12whzgqbgrmdmaxar0fl4nwqxdhy90s67k";
     };
   }
   {
@@ -53,6 +62,15 @@
       sha256 = "1a87v4cnd5y5whcdkjcqjpg1s5pxqhrspdxrsk2af49zsw9fsj9f";
     };
   }
+  {
+    goPackagePath = "github.com/danwakefield/fnmatch";
+    fetch = {
+      type = "git";
+      url = "https://github.com/danwakefield/fnmatch";
+      rev = "cbb64ac3d964b81592e64f957ad53df015803288";
+      sha256 = "0cbf511ppsa6hf59mdl7nbyn2b2n71y0bpkzbmfkdqjhanqh1lqz";
+    };
+  }
   {
     goPackagePath = "github.com/dchest/cssmin";
     fetch = {
@@ -62,6 +80,15 @@
       sha256 = "09sdijfx5d05z4cd5k6lhl7k3kbpdf2amzlngv15h5v0fff9qw4s";
     };
   }
+  {
+    goPackagePath = "github.com/dlclark/regexp2";
+    fetch = {
+      type = "git";
+      url = "https://github.com/dlclark/regexp2";
+      rev = "487489b64fb796de2e55f4e8a4ad1e145f80e957";
+      sha256 = "144s81ndviwhyy20ipxvvfvap8phv5p762glxrz6aqxprkxfarj5";
+    };
+  }
   {
     goPackagePath = "github.com/eknkc/amber";
     fetch = {
@@ -206,15 +233,6 @@
       sha256 = "0fxjgmwn9927wckl2xx8byv64cxgc0yxdwpfzval5n3wm5l5ij1i";
     };
   }
-  {
-    goPackagePath = "github.com/pelletier/go-buffruneio";
-    fetch = {
-      type = "git";
-      url = "https://github.com/pelletier/go-buffruneio";
-      rev = "c37440a7cf42ac63b919c752ca73a85067e05992";
-      sha256 = "0l83p1gg6g5mmhmxjisrhfimhbm71lwn1r2w7d6siwwqm9q08sd2";
-    };
-  }
   {
     goPackagePath = "github.com/pelletier/go-toml";
     fetch = {

pkgs/applications/misc/merkaartor/default.nix

@@ -1,25 +1,27 @@
-{ stdenv, fetchFromGitHub, qt4, qmake4Hook, boost, proj, gdal, sqlite, pkgconfig }:
+{ stdenv, fetchFromGitHub, qmake, pkgconfig, boost, gdal, proj
+, qtbase, qtsvg, qtwebkit }:
 
 stdenv.mkDerivation rec {
   name = "merkaartor-${version}";
-  version = "0.18.2";
+  version = "0.18.3";
 
   src = fetchFromGitHub {
     owner = "openstreetmap";
     repo = "merkaartor";
     rev = version;
-    sha256 = "1a8kzrc9w0b2a2zgw9dbbi15jy9ynv6nf2sg3k4dbh7f1s2ajx9l";
+    sha256 = "0ls3q8m1hxiwyrypy6qca8wczhl4969ncl0sszfdwfv70rzxjk88";
   };
 
-  buildInputs = [ qt4 boost proj gdal sqlite ];
+  nativeBuildInputs = [ qmake pkgconfig ];
 
-  nativeBuildInputs = [ qmake4Hook pkgconfig ];
+  buildInputs = [ boost gdal proj qtbase qtsvg qtwebkit ];
 
-  meta = {
-    description = "An openstreetmap editor";
-    homepage = http://merkaartor.org/;
-    license = stdenv.lib.licenses.gpl2Plus;
-    maintainers = with stdenv.lib.maintainers; [viric];
-    inherit (qt4.meta) platforms;
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
+    description = "OpenStreetMap editor";
+    homepage = http://merkaartor.be/;
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ viric ];
   };
 }

pkgs/applications/misc/pytrainer/default.nix

@@ -1,38 +1,45 @@
-{ stdenv, fetchurl, pythonPackages, sqlite, gpsbabel }:
+{ stdenv, fetchFromGitHub, perl, python2Packages, sqlite, gpsbabel
+, withWebKit ? false }:
 
 let
 
   # Pytrainer needs a matplotlib with GTK backend. Also ensure we are
   # using the pygtk with glade support as needed by pytrainer.
-  matplotlibGtk = pythonPackages.matplotlib.override {
+  matplotlibGtk = python2Packages.matplotlib.override {
     enableGtk2 = true;
-    pygtk = pythonPackages.pyGtkGlade;
+    pygtk = python2Packages.pyGtkGlade;
   };
 
 in
 
-pythonPackages.buildPythonApplication rec {
+python2Packages.buildPythonApplication rec {
   name = "pytrainer-${version}";
-  version = "1.10.0";
+  version = "1.11.0";
 
-  src = fetchurl {
-    url = "https://github.com/pytrainer/pytrainer/archive/v${version}.tar.gz";
-    sha256 = "0l42p630qhymgrcvxgry8chrpzcp6nr3d1vd7vhifh2npfq9l09y";
+  src = fetchFromGitHub {
+    owner = "pytrainer";
+    repo = "pytrainer";
+    rev = "v${version}";
+    sha256 = "1x4f1ydjql0aisvxs5kyi9lx35b4q3768dx42fyzq1nxdwzaqyvy";
   };
 
   namePrefix = "";
 
-  # The existing use of pywebkitgtk shows raw HTML text instead of
-  # map. This patch solves the problems by showing the file from a
-  # string, which allows setting an explicit MIME type.
-  patches = [ ./pytrainer-webkit.patch ];
+  patches = [
+    # The test fails in the UTC timezone and C locale.
+    ./fix-test-tz.patch
 
-  propagatedBuildInputs = with pythonPackages; [
-    dateutil lxml matplotlibGtk pyGtkGlade pywebkitgtk
-    sqlalchemy_migrate
+    # The existing use of pywebkitgtk shows raw HTML text instead of
+    # map. This patch solves the problems by showing the file from a
+    # string, which allows setting an explicit MIME type.
+    ./pytrainer-webkit.patch
   ];
 
-  buildInputs = [ gpsbabel sqlite ];
+  propagatedBuildInputs = with python2Packages; [
+    dateutil lxml matplotlibGtk pyGtkGlade sqlalchemy_migrate
+  ] ++ stdenv.lib.optional withWebKit [ pywebkitgtk ];
+
+  buildInputs = [ perl gpsbabel sqlite ];
 
   # This package contains no binaries to patch or strip.
   dontPatchELF = true;

pkgs/applications/misc/pytrainer/fix-test-tz.patch

@@ -0,0 +1,33 @@
+diff -Nurp pytrainer-v1.11.0-a/pytrainer/test/core/test_activity.py pytrainer-v1.11.0-b/pytrainer/test/core/test_activity.py
+--- pytrainer-v1.11.0-a/pytrainer/test/core/test_activity.py	1980-01-02 00:00:00.000000000 +0100
++++ pytrainer-v1.11.0-b/pytrainer/test/core/test_activity.py	2017-09-30 18:56:43.127016847 +0200
+@@ -69,7 +69,7 @@ class ActivityTest(unittest.TestCase):
+         self.assertEquals(self.activity.time, self.activity.duration)
+ 
+     def test_activity_starttime(self):
+-        self.assertEquals(self.activity.starttime, '12:58:23 PM')
++        self.assertEquals(self.activity.starttime, '12:58:23')
+ 
+     def test_activity_time_tuple(self):
+         self.assertEquals(self.activity.time_tuple, (2, 3, 46))
+diff -Nurp pytrainer-v1.11.0-a/pytrainer/test/imports/test_garmintcxv2.py pytrainer-v1.11.0-b/pytrainer/test/imports/test_garmintcxv2.py
+--- pytrainer-v1.11.0-a/pytrainer/test/imports/test_garmintcxv2.py	1980-01-02 00:00:00.000000000 +0100
++++ pytrainer-v1.11.0-b/pytrainer/test/imports/test_garmintcxv2.py	2017-09-30 18:55:45.078128980 +0200
+@@ -23,7 +23,7 @@ class GarminTCXv2Test(unittest.TestCase)
+             self.fail()
+ 
+     def test_workout_summary(self):
+-        summary = [(0, False, '2012-10-14T12:02:42', '10.12', '00:39:51', 'Running')]
++        summary = [(0, False, '2012-10-14T10:02:42', '10.12', '00:39:51', 'Running')]
+         try:
+             current_path = os.path.dirname(os.path.abspath(__file__))
+             data_path = os.path.dirname(os.path.dirname(os.path.dirname(current_path))) + "/"
+diff -Nurp pytrainer-v1.11.0-a/pytrainer/test/lib/test_date.py pytrainer-v1.11.0-b/pytrainer/test/lib/test_date.py
+--- pytrainer-v1.11.0-a/pytrainer/test/lib/test_date.py	1980-01-02 00:00:00.000000000 +0100
++++ pytrainer-v1.11.0-b/pytrainer/test/lib/test_date.py	2017-09-30 18:56:23.448720166 +0200
+@@ -45,4 +45,4 @@ class DateFunctionTest(unittest.TestCase
+     def test_getDateTime(self):
+         utctime, localtime = getDateTime('Tue Nov 24 17:29:05 UTC 2015')
+         self.assertEqual(datetime.datetime(2015, 11, 24, 17, 29, 5, tzinfo=tzutc()), utctime)
+-        self.assertEqual(datetime.datetime(2015, 11, 24, 19, 29, 5, tzinfo=tzlocal()), localtime)
++        self.assertEqual(datetime.datetime(2015, 11, 24, 17, 29, 5, tzinfo=tzlocal()), localtime)

pkgs/applications/misc/qmapshack/default.nix

@@ -0,0 +1,33 @@
+{ stdenv, fetchFromBitbucket, cmake, qtscript, qtwebkit, gdal, proj, routino, quazip }:
+
+stdenv.mkDerivation rec {
+  name = "qmapshack-${version}";
+  version = "1.9.1";
+
+  src = fetchFromBitbucket {
+    owner = "maproom";
+    repo = "qmapshack";
+    rev = "V%20${version}";
+    sha256 = "1yswdq1s9jjhwb3wfiy3kkiiaqzagw28vjqvl13jxcnmq7y763sr";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  buildInputs = [ qtscript qtwebkit gdal proj routino quazip ];
+
+  cmakeFlags = [
+    "-DROUTINO_XML_PATH=${routino}/share/routino"
+    "-DQUAZIP_INCLUDE_DIR=${quazip}/include/quazip"
+    "-DLIBQUAZIP_LIBRARY=${quazip}/lib/libquazip.so"
+  ];
+
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
+    homepage = https://bitbucket.org/maproom/qmapshack/wiki/Home;
+    description = "Plan your next outdoor trip";
+    license = licenses.gpl3;
+    maintainter = with maintainers; [ dotlambda ];
+    platforms = with platforms; linux;
+  };
+}

pkgs/applications/misc/robo3t/default.nix

@@ -0,0 +1,77 @@
+{ stdenv, fetchurl, zlib, glib, xorg, dbus, fontconfig,
+  freetype, xkeyboard_config, makeDesktopItem, makeWrapper }:
+
+stdenv.mkDerivation rec {
+  name = "robo3t-${version}";
+  version = "1.1.1";
+
+  src = fetchurl {
+    url = "https://download.robomongo.org/1.1.1/linux/robo3t-${version}-linux-x86_64-c93c6b0.tar.gz";
+    sha256 = "140cn80vg7c8vpdjasqi4b3kyqj4n033lcm3ikz5674x3jr7r5zs";
+  };
+
+  icon = fetchurl {
+    url = "https://github.com/Studio3T/robomongo/raw/${version}/trash/install/linux/robomongo.png";
+    sha256 = "15li8536x600kkfkb3h6mw7y0f2ljkv951pc45dpiw036vldibv2";
+  };
+
+  desktopItem = makeDesktopItem {
+    name = "Robo3T";
+    exec = "robo3t";
+    icon = icon;
+    comment = "Query GUI for mongodb";
+    desktopName = "Robo3T";
+    genericName = "MongoDB management tool";
+    categories = "Development;IDE;mongodb;";
+  };
+
+  nativeBuildInputs = [makeWrapper];
+
+  ldLibraryPath = stdenv.lib.makeLibraryPath [
+    stdenv.cc.cc
+    zlib
+    glib
+    xorg.libXi
+    xorg.libxcb
+    xorg.libXrender
+    xorg.libX11
+    xorg.libSM
+    xorg.libICE
+    xorg.libXext
+    dbus
+    fontconfig
+    freetype
+  ];
+
+  installPhase = ''
+    BASEDIR=$out/lib/robo3t
+
+    mkdir -p $BASEDIR/bin
+    cp bin/* $BASEDIR/bin
+
+    mkdir -p $BASEDIR/lib
+    cp -r lib/* $BASEDIR/lib
+
+    mkdir -p $out/share/applications
+    cp $desktopItem/share/applications/* $out/share/applications
+
+    mkdir -p $out/share/icons
+    cp ${icon} $out/share/icons/robomongo.png
+
+    patchelf --set-interpreter ${stdenv.glibc}/lib/ld-linux-x86-64.so.2 $BASEDIR/bin/robo3t
+
+    mkdir $out/bin
+
+    makeWrapper $BASEDIR/bin/robo3t $out/bin/robo3t \
+      --suffix LD_LIBRARY_PATH : ${ldLibraryPath} \
+      --suffix QT_XKB_CONFIG_ROOT : ${xkeyboard_config}/share/X11/xkb
+  '';
+
+  meta = {
+    homepage = https://robomongo.org/;
+    description = "Query GUI for mongodb";
+    platforms = stdenv.lib.intersectLists stdenv.lib.platforms.linux stdenv.lib.platforms.x86_64;
+    license = stdenv.lib.licenses.gpl3;
+    maintainers = [ stdenv.lib.maintainers.eperuffo ];
+  };
+}

pkgs/applications/networking/browsers/chromium/common.nix

@@ -90,6 +90,15 @@ let
     sha256 = "1vhslc4xg0d6wzlsi99zpah2xzjziglccrxn55k7qna634wyxg77";
   };
 
+  versionRange = min-version: upto-version:
+    let inherit (upstream-info) version;
+        result = versionAtLeast version min-version && versionOlder version upto-version;
+        stable-version = (import ./upstream-info.nix).stable.version;
+    in if versionAtLeast stable-version upto-version
+       then warn "chromium: stable version ${stable-version} is newer than a patchset bounded at ${upto-version}. You can safely delete it."
+            result
+       else result;
+
   base = rec {
     name = "${packageName}-${version}";
     inherit (upstream-info) version;
@@ -117,15 +126,31 @@ let
 
     patches = [
       ./patches/nix_plugin_paths_52.patch
+      # To enable ChromeCast, go to chrome://flags and set "Load Media Router Component Extension" to Enabled
+      # Fixes Chromecast: https://bugs.chromium.org/p/chromium/issues/detail?id=734325
+      ./patches/fix_network_api_crash.patch
+    ] # As major versions are added, you can trawl the gentoo and arch repos at
+      # https://gitweb.gentoo.org/repo/gentoo.git/plain/www-client/chromium/
+      # https://git.archlinux.org/svntogit/packages.git/tree/trunk?h=packages/chromium
+      # for updated patches and hints about build flags
+      ++ optionals (versionRange "61" "62") [
       ./patches/chromium-gn-bootstrap-r14.patch
       ./patches/chromium-gcc-r1.patch
       ./patches/chromium-atk-r1.patch
       ./patches/chromium-gcc5-r1.patch
-      # To enable ChromeCast, go to chrome://flags and set "Load Media Router Component Extension" to Enabled
-      # Fixes Chromecast: https://bugs.chromium.org/p/chromium/issues/detail?id=734325
-      ./patches/fix_network_api_crash.patch
-
-    ] ++ optional enableWideVine ./patches/widevine.patch;
+    ]
+      ++ optionals (versionRange "62" "63") [
+      ./patches/chromium-gn-bootstrap-r17.patch
+      ./patches/chromium-gcc5-r2.patch
+      ./patches/chromium-glibc2.26-r1.patch
+    ]
+      ++ optionals (versionAtLeast version "63") [
+      ./patches/chromium-gn-bootstrap-r19.patch
+      ./patches/chromium-gcc5-r2.patch
+      ./patches/chromium-glibc2.26-r1.patch
+      ./patches/chromium-sysroot-r1.patch
+    ]
+      ++ optional enableWideVine ./patches/widevine.patch;
 
     postPatch = ''
       # We want to be able to specify where the sandbox is via CHROME_DEVEL_SANDBOX

pkgs/applications/networking/browsers/chromium/patches/chromium-gcc5-r2.patch

@@ -0,0 +1,36 @@
+--- a/third_party/WebKit/Source/platform/wtf/typed_arrays/ArrayBufferContents.h
++++ b/third_party/WebKit/Source/platform/wtf/typed_arrays/ArrayBufferContents.h
+@@ -63,7 +63,7 @@ class WTF_EXPORT ArrayBufferContents {
+           allocation_length_(0),
+           data_(data),
+           data_length_(0),
+-          kind_(AllocationKind::kNormal),
++          kind_(WTF::ArrayBufferContents::AllocationKind::kNormal),
+           deleter_(deleter) {}
+     DataHandle(void* allocation_base,
+                size_t allocation_length,
+@@ -94,11 +94,11 @@ class WTF_EXPORT ArrayBufferContents {
+              reinterpret_cast<uintptr_t>(allocation_base_) +
+                  allocation_length_);
+       switch (kind_) {
+-        case AllocationKind::kNormal:
++        case WTF::ArrayBufferContents::AllocationKind::kNormal:
+           DCHECK(deleter_);
+           deleter_(data_);
+           return;
+-        case AllocationKind::kReservation:
++        case WTF::ArrayBufferContents::AllocationKind::kReservation:
+           ReleaseReservedMemory(allocation_base_, allocation_length_);
+           return;
+       }
+--- a/third_party/webrtc/modules/audio_processing/aec3/aec_state.cc.orig	2017-08-15 12:45:59.433532111 +0000
++++ b/third_party/webrtc/modules/audio_processing/aec3/aec_state.cc	2017-08-15 17:52:59.691328825 +0000
+@@ -10,7 +10,7 @@
+ 
+ #include "webrtc/modules/audio_processing/aec3/aec_state.h"
+ 
+-#include <math.h>
++#include <cmath>
+ #include <numeric>
+ #include <vector>
+ 

pkgs/applications/networking/browsers/chromium/patches/chromium-glibc2.26-r1.patch

@@ -0,0 +1,220 @@
+diff --git a/breakpad/src/client/linux/dump_writer_common/ucontext_reader.cc b/breakpad/src/client/linux/dump_writer_common/ucontext_reader.cc
+index c80724d..052ce37 100644
+--- a/breakpad/src/client/linux/dump_writer_common/ucontext_reader.cc
++++ b/breakpad/src/client/linux/dump_writer_common/ucontext_reader.cc
+@@ -36,19 +36,19 @@ namespace google_breakpad {
+ 
+ // Minidump defines register structures which are different from the raw
+ // structures which we get from the kernel. These are platform specific
+-// functions to juggle the ucontext and user structures into minidump format.
++// functions to juggle the ucontext_t and user structures into minidump format.
+ 
+ #if defined(__i386__)
+ 
+-uintptr_t UContextReader::GetStackPointer(const struct ucontext* uc) {
++uintptr_t UContextReader::GetStackPointer(const ucontext_t* uc) {
+   return uc->uc_mcontext.gregs[REG_ESP];
+ }
+ 
+-uintptr_t UContextReader::GetInstructionPointer(const struct ucontext* uc) {
++uintptr_t UContextReader::GetInstructionPointer(const ucontext_t* uc) {
+   return uc->uc_mcontext.gregs[REG_EIP];
+ }
+ 
+-void UContextReader::FillCPUContext(RawContextCPU *out, const ucontext *uc,
++void UContextReader::FillCPUContext(RawContextCPU *out, const ucontext_t *uc,
+                                     const struct _libc_fpstate* fp) {
+   const greg_t* regs = uc->uc_mcontext.gregs;
+ 
+@@ -88,15 +88,15 @@ void UContextReader::FillCPUContext(RawContextCPU *out, const ucontext *uc,
+ 
+ #elif defined(__x86_64)
+ 
+-uintptr_t UContextReader::GetStackPointer(const struct ucontext* uc) {
++uintptr_t UContextReader::GetStackPointer(const ucontext_t* uc) {
+   return uc->uc_mcontext.gregs[REG_RSP];
+ }
+ 
+-uintptr_t UContextReader::GetInstructionPointer(const struct ucontext* uc) {
++uintptr_t UContextReader::GetInstructionPointer(const ucontext_t* uc) {
+   return uc->uc_mcontext.gregs[REG_RIP];
+ }
+ 
+-void UContextReader::FillCPUContext(RawContextCPU *out, const ucontext *uc,
++void UContextReader::FillCPUContext(RawContextCPU *out, const ucontext_t *uc,
+                                     const struct _libc_fpstate* fpregs) {
+   const greg_t* regs = uc->uc_mcontext.gregs;
+ 
+@@ -145,15 +145,15 @@ void UContextReader::FillCPUContext(RawContextCPU *out, const ucontext *uc,
+ 
+ #elif defined(__ARM_EABI__)
+ 
+-uintptr_t UContextReader::GetStackPointer(const struct ucontext* uc) {
++uintptr_t UContextReader::GetStackPointer(const ucontext_t* uc) {
+   return uc->uc_mcontext.arm_sp;
+ }
+ 
+-uintptr_t UContextReader::GetInstructionPointer(const struct ucontext* uc) {
++uintptr_t UContextReader::GetInstructionPointer(const ucontext_t* uc) {
+   return uc->uc_mcontext.arm_pc;
+ }
+ 
+-void UContextReader::FillCPUContext(RawContextCPU *out, const ucontext *uc) {
++void UContextReader::FillCPUContext(RawContextCPU *out, const ucontext_t *uc) {
+   out->context_flags = MD_CONTEXT_ARM_FULL;
+ 
+   out->iregs[0] = uc->uc_mcontext.arm_r0;
+@@ -184,15 +184,15 @@ void UContextReader::FillCPUContext(RawContextCPU *out, const ucontext *uc) {
+ 
+ #elif defined(__aarch64__)
+ 
+-uintptr_t UContextReader::GetStackPointer(const struct ucontext* uc) {
++uintptr_t UContextReader::GetStackPointer(const ucontext_t* uc) {
+   return uc->uc_mcontext.sp;
+ }
+ 
+-uintptr_t UContextReader::GetInstructionPointer(const struct ucontext* uc) {
++uintptr_t UContextReader::GetInstructionPointer(const ucontext_t* uc) {
+   return uc->uc_mcontext.pc;
+ }
+ 
+-void UContextReader::FillCPUContext(RawContextCPU *out, const ucontext *uc,
++void UContextReader::FillCPUContext(RawContextCPU *out, const ucontext_t *uc,
+                                     const struct fpsimd_context* fpregs) {
+   out->context_flags = MD_CONTEXT_ARM64_FULL;
+ 
+@@ -210,15 +210,15 @@ void UContextReader::FillCPUContext(RawContextCPU *out, const ucontext *uc,
+ 
+ #elif defined(__mips__)
+ 
+-uintptr_t UContextReader::GetStackPointer(const struct ucontext* uc) {
++uintptr_t UContextReader::GetStackPointer(const ucontext_t* uc) {
+   return uc->uc_mcontext.gregs[MD_CONTEXT_MIPS_REG_SP];
+ }
+ 
+-uintptr_t UContextReader::GetInstructionPointer(const struct ucontext* uc) {
++uintptr_t UContextReader::GetInstructionPointer(const ucontext_t* uc) {
+   return uc->uc_mcontext.pc;
+ }
+ 
+-void UContextReader::FillCPUContext(RawContextCPU *out, const ucontext *uc) {
++void UContextReader::FillCPUContext(RawContextCPU *out, const ucontext_t *uc) {
+ #if _MIPS_SIM == _ABI64
+   out->context_flags = MD_CONTEXT_MIPS64_FULL;
+ #elif _MIPS_SIM == _ABIO32
+diff --git a/breakpad/src/client/linux/dump_writer_common/ucontext_reader.h b/breakpad/src/client/linux/dump_writer_common/ucontext_reader.h
+index b6e77b4..2de80b7 100644
+--- a/breakpad/src/client/linux/dump_writer_common/ucontext_reader.h
++++ b/breakpad/src/client/linux/dump_writer_common/ucontext_reader.h
+@@ -39,23 +39,23 @@
+ 
+ namespace google_breakpad {
+ 
+-// Wraps platform-dependent implementations of accessors to ucontext structs.
++// Wraps platform-dependent implementations of accessors to ucontext_t structs.
+ struct UContextReader {
+-  static uintptr_t GetStackPointer(const struct ucontext* uc);
++  static uintptr_t GetStackPointer(const ucontext_t* uc);
+ 
+-  static uintptr_t GetInstructionPointer(const struct ucontext* uc);
++  static uintptr_t GetInstructionPointer(const ucontext_t* uc);
+ 
+-  // Juggle a arch-specific ucontext into a minidump format
++  // Juggle a arch-specific ucontext_t into a minidump format
+   //   out: the minidump structure
+   //   info: the collection of register structures.
+ #if defined(__i386__) || defined(__x86_64)
+-  static void FillCPUContext(RawContextCPU *out, const ucontext *uc,
++  static void FillCPUContext(RawContextCPU *out, const ucontext_t *uc,
+                              const struct _libc_fpstate* fp);
+ #elif defined(__aarch64__)
+-  static void FillCPUContext(RawContextCPU *out, const ucontext *uc,
++  static void FillCPUContext(RawContextCPU *out, const ucontext_t *uc,
+                              const struct fpsimd_context* fpregs);
+ #else
+-  static void FillCPUContext(RawContextCPU *out, const ucontext *uc);
++  static void FillCPUContext(RawContextCPU *out, const ucontext_t *uc);
+ #endif
+ };
+ 
+diff --git a/breakpad/src/client/linux/handler/exception_handler.cc b/breakpad/src/client/linux/handler/exception_handler.cc
+index 586d84e..05936d2 100644
+--- a/breakpad/src/client/linux/handler/exception_handler.cc
++++ b/breakpad/src/client/linux/handler/exception_handler.cc
+@@ -457,9 +457,9 @@ bool ExceptionHandler::HandleSignal(int /*sig*/, siginfo_t* info, void* uc) {
+   // Fill in all the holes in the struct to make Valgrind happy.
+   memset(&g_crash_context_, 0, sizeof(g_crash_context_));
+   memcpy(&g_crash_context_.siginfo, info, sizeof(siginfo_t));
+-  memcpy(&g_crash_context_.context, uc, sizeof(struct ucontext));
++  memcpy(&g_crash_context_.context, uc, sizeof(ucontext_t));
+ #if defined(__aarch64__)
+-  struct ucontext* uc_ptr = (struct ucontext*)uc;
++  ucontext_t* uc_ptr = (ucontext_t*)uc;
+   struct fpsimd_context* fp_ptr =
+       (struct fpsimd_context*)&uc_ptr->uc_mcontext.__reserved;
+   if (fp_ptr->head.magic == FPSIMD_MAGIC) {
+@@ -468,9 +468,9 @@ bool ExceptionHandler::HandleSignal(int /*sig*/, siginfo_t* info, void* uc) {
+   }
+ #elif !defined(__ARM_EABI__) && !defined(__mips__)
+   // FP state is not part of user ABI on ARM Linux.
+-  // In case of MIPS Linux FP state is already part of struct ucontext
++  // In case of MIPS Linux FP state is already part of ucontext_t
+   // and 'float_state' is not a member of CrashContext.
+-  struct ucontext* uc_ptr = (struct ucontext*)uc;
++  ucontext_t* uc_ptr = (ucontext_t*)uc;
+   if (uc_ptr->uc_mcontext.fpregs) {
+     memcpy(&g_crash_context_.float_state, uc_ptr->uc_mcontext.fpregs,
+            sizeof(g_crash_context_.float_state));
+@@ -494,7 +494,7 @@ bool ExceptionHandler::SimulateSignalDelivery(int sig) {
+   // ExceptionHandler::HandleSignal().
+   siginfo.si_code = SI_USER;
+   siginfo.si_pid = getpid();
+-  struct ucontext context;
++  ucontext_t context;
+   getcontext(&context);
+   return HandleSignal(sig, &siginfo, &context);
+ }
+diff --git a/breakpad/src/client/linux/handler/exception_handler.h b/breakpad/src/client/linux/handler/exception_handler.h
+index daba57e..25598a2 100644
+--- a/breakpad/src/client/linux/handler/exception_handler.h
++++ b/breakpad/src/client/linux/handler/exception_handler.h
+@@ -191,11 +191,11 @@ class ExceptionHandler {
+   struct CrashContext {
+     siginfo_t siginfo;
+     pid_t tid;  // the crashing thread.
+-    struct ucontext context;
++    ucontext_t context;
+ #if !defined(__ARM_EABI__) && !defined(__mips__)
+     // #ifdef this out because FP state is not part of user ABI for Linux ARM.
+     // In case of MIPS Linux FP state is already part of struct
+-    // ucontext so 'float_state' is not required.
++    // ucontext_t so 'float_state' is not required.
+     fpstate_t float_state;
+ #endif
+   };
+diff --git a/breakpad/src/client/linux/microdump_writer/microdump_writer.cc b/breakpad/src/client/linux/microdump_writer/microdump_writer.cc
+index 3764eec..80ad5c4 100644
+--- a/breakpad/src/client/linux/microdump_writer/microdump_writer.cc
++++ b/breakpad/src/client/linux/microdump_writer/microdump_writer.cc
+@@ -593,7 +593,7 @@ class MicrodumpWriter {
+ 
+   void* Alloc(unsigned bytes) { return dumper_->allocator()->Alloc(bytes); }
+ 
+-  const struct ucontext* const ucontext_;
++  const ucontext_t* const ucontext_;
+ #if !defined(__ARM_EABI__) && !defined(__mips__)
+   const google_breakpad::fpstate_t* const float_state_;
+ #endif
+diff --git a/breakpad/src/client/linux/minidump_writer/minidump_writer.cc b/breakpad/src/client/linux/minidump_writer/minidump_writer.cc
+index d11ba6e..c716143 100644
+--- a/breakpad/src/client/linux/minidump_writer/minidump_writer.cc
++++ b/breakpad/src/client/linux/minidump_writer/minidump_writer.cc
+@@ -1323,7 +1323,7 @@ class MinidumpWriter {
+   const int fd_;  // File descriptor where the minidum should be written.
+   const char* path_;  // Path to the file where the minidum should be written.
+ 
+-  const struct ucontext* const ucontext_;  // also from the signal handler
++  const ucontext_t* const ucontext_;  // also from the signal handler
+ #if !defined(__ARM_EABI__) && !defined(__mips__)
+   const google_breakpad::fpstate_t* const float_state_;  // ditto
+ #endif

pkgs/applications/networking/browsers/chromium/patches/chromium-gn-bootstrap-r17.patch

@@ -0,0 +1,68 @@
+--- a/tools/gn/bootstrap/bootstrap.py
++++ b/tools/gn/bootstrap/bootstrap.py
+@@ -179,6 +179,7 @@ def build_gn_with_ninja_manually(tempdir, options):
+ 
+   write_buildflag_header_manually(root_gen_dir, 'base/debug/debugging_flags.h',
+       {
++          'ENABLE_LOCATION_SOURCE': 'false',
+           'ENABLE_PROFILING': 'false',
+           'CAN_UNWIND_WITH_FRAME_POINTERS': 'false'
+       })
+@@ -204,7 +205,7 @@ def build_gn_with_ninja_manually(tempdir, options):
+ 
+   write_gn_ninja(os.path.join(tempdir, 'build.ninja'),
+                  root_gen_dir, options)
+-  cmd = ['ninja', '-C', tempdir]
++  cmd = ['ninja', '-C', tempdir, '-w', 'dupbuild=err']
+   if options.verbose:
+     cmd.append('-v')
+ 
+@@ -458,6 +459,7 @@ def write_gn_ninja(path, root_gen_dir, options):
+       'base/metrics/bucket_ranges.cc',
+       'base/metrics/field_trial.cc',
+       'base/metrics/field_trial_param_associator.cc',
++      'base/metrics/field_trial_params.cc',
+       'base/metrics/histogram.cc',
+       'base/metrics/histogram_base.cc',
+       'base/metrics/histogram_functions.cc',
+@@ -507,6 +509,7 @@ def write_gn_ninja(path, root_gen_dir, options):
+       'base/task_scheduler/scheduler_lock_impl.cc',
+       'base/task_scheduler/scheduler_single_thread_task_runner_manager.cc',
+       'base/task_scheduler/scheduler_worker.cc',
++      'base/task_scheduler/scheduler_worker_pool.cc',
+       'base/task_scheduler/scheduler_worker_pool_impl.cc',
+       'base/task_scheduler/scheduler_worker_pool_params.cc',
+       'base/task_scheduler/scheduler_worker_stack.cc',
+@@ -523,6 +526,7 @@ def write_gn_ninja(path, root_gen_dir, options):
+       'base/third_party/icu/icu_utf.cc',
+       'base/third_party/nspr/prtime.cc',
+       'base/threading/post_task_and_reply_impl.cc',
++      'base/threading/scoped_blocking_call.cc',
+       'base/threading/sequence_local_storage_map.cc',
+       'base/threading/sequenced_task_runner_handle.cc',
+       'base/threading/sequenced_worker_pool.cc',
+@@ -579,7 +583,6 @@ def write_gn_ninja(path, root_gen_dir, options):
+       'base/unguessable_token.cc',
+       'base/value_iterators.cc',
+       'base/values.cc',
+-      'base/value_iterators.cc',
+       'base/vlog.cc',
+   ])
+ 
+@@ -652,7 +655,6 @@ def write_gn_ninja(path, root_gen_dir, options):
+     static_libraries['base']['sources'].extend([
+         'base/memory/shared_memory_handle_posix.cc',
+         'base/memory/shared_memory_posix.cc',
+-        'base/memory/shared_memory_tracker.cc',
+         'base/nix/xdg_util.cc',
+         'base/process/internal_linux.cc',
+         'base/process/memory_linux.cc',
+@@ -827,7 +829,7 @@ def build_gn_with_gn(temp_gn, build_dir, options):
+   cmd = [temp_gn, 'gen', build_dir, '--args=%s' % gn_gen_args]
+   check_call(cmd)
+ 
+-  cmd = ['ninja', '-C', build_dir]
++  cmd = ['ninja', '-C', build_dir, '-w', 'dupbuild=err']
+   if options.verbose:
+     cmd.append('-v')
+   cmd.append('gn')

pkgs/applications/networking/browsers/chromium/patches/chromium-gn-bootstrap-r19.patch

@@ -0,0 +1,10 @@
+--- a/tools/gn/bootstrap/bootstrap.py
++++ b/tools/gn/bootstrap/bootstrap.py
+@@ -576,7 +576,6 @@ def write_gn_ninja(path, root_gen_dir, options):
+       'base/trace_event/trace_log.cc',
+       'base/trace_event/trace_log_constants.cc',
+       'base/trace_event/tracing_agent.cc',
+-      'base/tracked_objects.cc',
+       'base/unguessable_token.cc',
+       'base/value_iterators.cc',
+       'base/values.cc',

pkgs/applications/networking/browsers/chromium/patches/chromium-sysroot-r1.patch

@@ -0,0 +1,14 @@
+--- a/chrome/installer/BUILD.gn
++++ b/chrome/installer/BUILD.gn
+@@ -3,9 +3,10 @@
+ # found in the LICENSE file.
+ 
+ import("//build/config/chrome_build.gni")
++import("//build/config/sysroot.gni")
+ 
+ declare_args() {
+-  enable_linux_installer = is_linux && !is_component_build
++  enable_linux_installer = is_linux && !is_component_build && use_sysroot
+ }
+ 
+ # Meta-target that forwards to the installer of the correct type (if any).

pkgs/applications/networking/browsers/chromium/upstream-info.nix

@@ -1,18 +1,18 @@
 # This file is autogenerated from update.sh in the same directory.
 {
   beta = {
-    sha256 = "09q7s5x22vnmvqyz0f1l6qnaryglmsp0rc63qcg5sfvgv2g17g5x";
-    sha256bin64 = "12z6z8gjxl4mx8j6db8nnlzrj03rh4qwyrvcf4hqcsv7b1armg6j";
-    version = "61.0.3163.79";
+    sha256 = "0c8qn2i7iygl3kgrdwwd8h3l5j8hg66dw99qgr618cgca1b4im68";
+    sha256bin64 = "04mfg18zpx19ha0mrlwx2aabn0vhl08n9c60hazivmw99pzlg8dn";
+    version = "62.0.3202.29";
   };
   dev = {
-    sha256 = "168i6dcdl13an3vlr2m83q8fcprgckmclkmzwj70jdkp84qx80fq";
-    sha256bin64 = "116vddp01m2ls337zj6r4h1nvybphvldlk9bs8czypx5skn29vbz";
-    version = "62.0.3202.9";
+    sha256 = "1zd7rid626fglbyrp7c6517jldhgfk3vjn357vhlhy6pgj1ydrrn";
+    sha256bin64 = "0hqb5prf0ags4bnla6skyi5vmkrazhd8n3ri4ijhbqjbb536bfpb";
+    version = "63.0.3218.0";
   };
   stable = {
-    sha256 = "09q7s5x22vnmvqyz0f1l6qnaryglmsp0rc63qcg5sfvgv2g17g5x";
-    sha256bin64 = "0a0wd06c0v061lnmb8x20gqgsg9zqafp2kq1fl3cjm0ldg9rwayw";
-    version = "61.0.3163.79";
+    sha256 = "06r89jim9cq87668ya8wwk69hh17rl04cj94nb9c28v6mj69cda1";
+    sha256bin64 = "1cm9snw29nkzq4bafqgi6fd0gqcc3jp60y6vfsrf9k4dvdard2sv";
+    version = "61.0.3163.100";
   };
 }

pkgs/applications/networking/browsers/falkon/default.nix

@@ -0,0 +1,43 @@
+{ stdenv, lib, fetchFromGitHub, cmake, extra-cmake-modules, pkgconfig, qmake
+, libpthreadstubs, libxcb, libXdmcp, qtsvg, qttools, qtwebengine, qtx11extras, kwallet, openssl }:
+
+stdenv.mkDerivation rec {
+  # Last qupvilla release is 2.1.2 so we add the .1 although it isn't actually a
+  # release but it is basically 2.1.2 with the falkon name
+  name = "falkon-${version}.1";
+  version = "2.1.2";
+
+  src = fetchFromGitHub {
+    owner  = "KDE";
+    repo   = "falkon";
+    rev    = "eecaf2e9d6b572a7f7d2e6dc324e3d79b61c31db";
+    sha256 = "01r5aw10jd0qz7xvad0cqzjbnsj7vwblh54wbq4x1m6xbkp6xcgy";
+  };
+
+  preConfigure = ''
+    export NONBLOCK_JS_DIALOGS=true
+    export KDE_INTEGRATION=true
+    export GNOME_INTEGRATION=false
+    export FALKON_PREFIX=$out
+  '';
+
+  dontUseCmakeConfigure = true;
+
+  buildInputs = [
+    libpthreadstubs libxcb libXdmcp
+    kwallet
+    qtsvg qtwebengine qtx11extras
+  ];
+
+  nativeBuildInputs = [ cmake extra-cmake-modules pkgconfig qmake qttools ];
+
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
+    description = "QtWebEngine based cross-platform web browser";
+    homepage    = https://community.kde.org/Incubator/Projects/Falkon;
+    license     = licenses.gpl3;
+    maintainers = with maintainers; [ peterhoeg ];
+    platforms   = platforms.unix;
+  };
+}

pkgs/applications/networking/browsers/tor-browser-bundle/default.nix

@@ -1,7 +1,6 @@
 { stdenv
-, lib
-, fetchurl
 , fetchgit
+, fetchurl
 , symlinkJoin
 
 , tor
@@ -14,6 +13,19 @@
 , noto-fonts
 , noto-fonts-emoji
 
+# Audio support
+, audioSupport ? mediaSupport
+, apulse
+
+# Media support (implies audio support)
+, mediaSupport ? false
+, gstreamer
+, gst-plugins-base
+, gst-plugins-good
+, gst-ffmpeg
+, gmp
+, ffmpeg
+
 # Extensions, common
 , zip
 
@@ -29,6 +41,8 @@
 , extraExtensions ? [ ]
 }:
 
+with stdenv.lib;
+
 let
   tor-browser-build_src = fetchgit {
     url = "https://git.torproject.org/builders/tor-browser-build.git";
@@ -41,15 +55,12 @@ let
       git libxml2 python27 python27Packages rsync;
   };
 
-  extensionsEnv = symlinkJoin {
-    name = "tor-browser-extensions";
-    paths = with firefoxExtensions; [
-      https-everywhere
-      noscript
-      torbutton
-      tor-launcher
-    ] ++ extraExtensions;
-  };
+  bundledExtensions = with firefoxExtensions; [
+    https-everywhere
+    noscript
+    torbutton
+    tor-launcher
+  ] ++ extraExtensions;
 
   fontsEnv = symlinkJoin {
     name = "tor-browser-fonts";
@@ -57,6 +68,21 @@ let
   };
 
   fontsDir = "${fontsEnv}/share/fonts";
+
+  gstPluginsPath = concatMapStringsSep ":" (x:
+    "${x}/lib/gstreamer-0.10") [
+      gstreamer
+      gst-plugins-base
+      gst-plugins-good
+      gst-ffmpeg
+    ];
+
+  gstLibPath = makeLibraryPath [
+    gstreamer
+    gst-plugins-base
+    gmp
+    ffmpeg
+  ];
 in
 stdenv.mkDerivation rec {
   name = "tor-browser-bundle-${version}";
@@ -68,6 +94,11 @@ stdenv.mkDerivation rec {
 
   buildPhase = ":";
 
+  # The following creates a customized firefox distribution.  For
+  # simplicity, we copy the entire base firefox runtime, to work around
+  # firefox's annoying insistence on resolving the installation directory
+  # relative to the real firefox executable.  A little tacky and
+  # inefficient but it works.
   installPhase = ''
     TBBUILD=${tor-browser-build_src}/projects/tor-browser
     TBDATA_PATH=TorBrowser-Data
@@ -95,6 +126,7 @@ stdenv.mkDerivation rec {
     lockPref("app.update.enabled", false);
     lockPref("extensions.update.autoUpdateDefault", false);
     lockPref("extensions.update.enabled", false);
+    lockPref("extensions.torbutton.updateNeeded", false);
     lockPref("extensions.torbutton.versioncheck_enabled", false);
 
     // Where to find the Nixpkgs tor executable & config
@@ -109,13 +141,19 @@ stdenv.mkDerivation rec {
     lockPref("extensions.torlauncher.control_port_use_ipc", true);
     lockPref("extensions.torlauncher.socks_port_use_ipc", true);
 
+    // Allow sandbox access to sound devices if using ALSA directly
+    ${if audioSupport then ''
+      pref("security.sandbox.content.write_path_whitelist", "/dev/snd/");
+    '' else ''
+      clearPref("security.sandbox.content.write_path_whitelist");
+    ''}
+
     // User customization
     ${extraPrefs}
     EOF
 
     # Preload extensions
-    # XXX: the fact that ln -s env browser/extensions fails, symlinkJoin seems a little redundant ...
-    ln -s -t browser/extensions ${extensionsEnv}"/"*
+    find ${toString bundledExtensions} -name '*.xpi' -exec ln -s -t browser/extensions '{}' '+'
 
     # Copy bundle data
     bundlePlatform=linux
@@ -135,20 +173,31 @@ stdenv.mkDerivation rec {
         > $TBDATA_PATH/fonts.conf
 
     # Generate a suitable wrapper
-    wrapper_PATH=${lib.makeBinPath [ coreutils ]}
-    wrapper_XDG_DATA_DIRS=${lib.concatMapStringsSep ":" (x: "${x}/share") [
+    wrapper_PATH=${makeBinPath [ coreutils ]}
+    wrapper_XDG_DATA_DIRS=${concatMapStringsSep ":" (x: "${x}/share") [
       hicolor_icon_theme
       shared_mime_info
     ]}
 
+    ${optionalString audioSupport ''
+      # apulse uses a non-standard library path ...
+      wrapper_LD_LIBRARY_PATH=${apulse}/lib/apulse''${wrapper_LD_LIBRARY_PATH:+:$wrapper_LD_LIBRARY_PATH}
+    ''}
+
+    ${optionalString mediaSupport ''
+      wrapper_LD_LIBRARY_PATH=${gstLibPath}''${wrapper_LD_LIBRARY_PATH:+:$wrapper_LD_LIBRARY_PATH}
+    ''}
+
     mkdir -p $out/bin
     cat >$out/bin/tor-browser <<EOF
     #! ${stdenv.shell} -eu
 
+    umask 077
+
     PATH=$wrapper_PATH
 
     readonly THE_HOME=\$HOME
-    TBB_HOME=\''${TBB_HOME:-\''${XDG_DATA_HOME:-$HOME/.local/share}/tor-browser}
+    TBB_HOME=\''${TBB_HOME:-\''${XDG_DATA_HOME:-\$HOME/.local/share}/tor-browser}
     if [[ \''${TBB_HOME:0:1} != / ]] ; then
       TBB_HOME=\$PWD/\$TBB_HOME
     fi
@@ -209,9 +258,21 @@ stdenv.mkDerivation rec {
     # XDG_DATA_DIRS is set to prevent searching system directories for
     # mime and icon data.
     #
+    # PULSE_{SERVER,COOKIE} is necessary for audio playback w/pulseaudio
+    #
+    # APULSE_PLAYBACK_DEVICE is for audio playback w/o pulseaudio (no capture yet)
+    #
+    # GST_PLUGIN_SYSTEM_PATH is for HD video playback
+    #
+    # GST_REGISTRY is set to devnull to minimize disk writes
+    #
+    # TOR_* is for using an external tor instance
+    #
     # Parameters lacking a default value below are *required* (enforced by
     # -o nounset).
     exec env -i \
+      LD_LIBRARY_PATH=$wrapper_LD_LIBRARY_PATH \
+      \
       TZ=":" \
       \
       DISPLAY="\$DISPLAY" \
@@ -223,11 +284,22 @@ stdenv.mkDerivation rec {
       XDG_CONFIG_HOME="\$XDG_CONFIG_HOME" \
       XDG_DATA_HOME="\$XDG_DATA_HOME" \
       XDG_CACHE_HOME="\$XDG_CACHE_HOME" \
+      XDG_RUNTIME_DIR="\$HOME/run" \
       \
       XDG_DATA_DIRS="$wrapper_XDG_DATA_DIRS" \
       \
       FONTCONFIG_FILE="$TBDATA_IN_STORE/fonts.conf" \
       \
+      APULSE_PLAYBACK_DEVICE="\''${APULSE_PLAYBACK_DEVICE:-plug:dmix}" \
+      \
+      GST_PLUGIN_SYSTEM_PATH="${optionalString mediaSupport gstPluginsPath}" \
+      GST_REGISTRY="/dev/null" \
+      GST_REGISTRY_UPDATE="no" \
+      \
+      TOR_SKIP_LAUNCH="\''${TOR_SKIP_LAUNCH:-}" \
+      TOR_CONTROL_PORT="\''${TOR_CONTROL_PORT:-}" \
+      TOR_SOCKS_PORT="\''${TOR_SOCKS_PORT:-}" \
+      \
       $self/firefox \
         -no-remote \
         -profile "\$HOME/TorBrowser/Data/Browser/profile.default" \
@@ -239,7 +311,7 @@ stdenv.mkDerivation rec {
     bash -n $out/bin/tor-browser
 
     echo "Checking wrapper ..."
-    DISPLAY="" XAUTHORITY="" DBUS_SESSION_BUS_ADDRESS="" TBB_HOME=$TMPDIR/tbb \
+    DISPLAY="" XAUTHORITY="" DBUS_SESSION_BUS_ADDRESS="" TBB_HOME=$(mktemp -d) \
     $out/bin/tor-browser -version >/dev/null
   '';
 

pkgs/applications/networking/browsers/tor-browser-bundle/extensions.nix

@@ -24,6 +24,7 @@
       url = "https://git.torproject.org/https-everywhere.git";
       rev = "refs/tags/${version}";
       sha256 = "0z9madihh4b4z4blvfmh6w1hsv8afyi0x7b243nciq9r4w55xgfa";
+      fetchSubmodules = true;
     };
 
     nativeBuildInputs = [
@@ -35,10 +36,6 @@
       zip
     ];
 
-    unpackPhase = ''
-      cp -dR --no-preserve=mode "$src" src && cd src
-    '';
-
     buildPhase = ''
       $shell ./makexpi.sh ${version} --no-recurse
     '';
@@ -80,10 +77,6 @@
 
     nativeBuildInputs = [ zip ];
 
-    unpackPhase = ''
-      cp -dR --no-preserve=mode "$src" src && cd src
-    '';
-
     buildPhase = ''
       $shell ./makexpi.sh
     '';
@@ -107,10 +100,6 @@
 
     nativeBuildInputs = [ zip ];
 
-    unpackPhase = ''
-      cp -dR --no-preserve=mode "$src" src && cd src
-    '';
-
     buildPhase = ''
       make package
     '';

pkgs/applications/networking/browsers/vivaldi/chromium-gcc-r1.patch

@@ -0,0 +1,14 @@
+diff --git a/base/numerics/safe_math_shared_impl.h b/base/numerics/safe_math_shared_impl.h
+index 99f230ce7e9a..de2415d402f5 100644
+--- a/base/numerics/safe_math_shared_impl.h
++++ b/base/numerics/safe_math_shared_impl.h
+@@ -21,8 +21,7 @@
+ #if !defined(__native_client__) &&                         \
+     ((defined(__clang__) &&                                \
+       ((__clang_major__ > 3) ||                            \
+-       (__clang_major__ == 3 && __clang_minor__ >= 4))) || \
+-     (defined(__GNUC__) && __GNUC__ >= 5))
++       (__clang_major__ == 3 && __clang_minor__ >= 4))))
+ #include "base/numerics/safe_math_clang_gcc_impl.h"
+ #define BASE_HAS_OPTIMIZED_SAFE_MATH (1)
+ #else

pkgs/applications/networking/browsers/vivaldi/chromium-gcc5-r1.patch

@@ -0,0 +1,66 @@
+--- a/chrome/browser/devtools/devtools_file_system_indexer.cc
++++ b/chrome/browser/devtools/devtools_file_system_indexer.cc
+@@ -34,7 +34,6 @@ using base::TimeDelta;
+ using base::TimeTicks;
+ using content::BrowserThread;
+ using std::map;
+-using std::set;
+ using std::string;
+ using std::vector;
+ 
+@@ -191,7 +190,7 @@ vector<FilePath> Index::Search(const string& query) {
+     if (trigram != kUndefinedTrigram)
+       trigrams.push_back(trigram);
+   }
+-  set<FileId> file_ids;
++  std::set<FileId> file_ids;
+   bool first = true;
+   vector<Trigram>::const_iterator it = trigrams.begin();
+   for (; it != trigrams.end(); ++it) {
+@@ -203,7 +202,7 @@ vector<FilePath> Index::Search(const string& query) {
+       first = false;
+       continue;
+     }
+-    set<FileId> intersection = base::STLSetIntersection<set<FileId> >(
++    std::set<FileId> intersection = base::STLSetIntersection<std::set<FileId> >(
+         file_ids, index_[trigram]);
+     file_ids.swap(intersection);
+   }
+diff --git a/third_party/WebKit/Source/platform/wtf/typed_arrays/ArrayBufferContents.h b/third_party/WebKit/Source/platform/wtf/typed_arrays/ArrayBufferContents.h
+index 94bb9161ec85..e40c6387f72e 100644
+--- a/third_party/WebKit/Source/platform/wtf/typed_arrays/ArrayBufferContents.h
++++ b/third_party/WebKit/Source/platform/wtf/typed_arrays/ArrayBufferContents.h
+@@ -63,7 +63,7 @@ class WTF_EXPORT ArrayBufferContents {
+           allocation_length_(0),
+           data_(data),
+           data_length_(0),
+-          kind_(AllocationKind::kNormal),
++          kind_(WTF::ArrayBufferContents::AllocationKind::kNormal),
+           deleter_(deleter) {}
+     DataHandle(void* allocation_base,
+                size_t allocation_length,
+@@ -94,11 +94,11 @@ class WTF_EXPORT ArrayBufferContents {
+              reinterpret_cast<uintptr_t>(allocation_base_) +
+                  allocation_length_);
+       switch (kind_) {
+-        case AllocationKind::kNormal:
++        case WTF::ArrayBufferContents::AllocationKind::kNormal:
+           DCHECK(deleter_);
+           deleter_(data_);
+           return;
+-        case AllocationKind::kReservation:
++        case WTF::ArrayBufferContents::AllocationKind::kReservation:
+           ReleaseReservedMemory(allocation_base_, allocation_length_);
+           return;
+       }
+--- a/third_party/webrtc/modules/audio_processing/aec3/aec_state.cc.orig	2017-08-15 12:45:59.433532111 +0000
++++ b/third_party/webrtc/modules/audio_processing/aec3/aec_state.cc	2017-08-15 17:52:59.691328825 +0000
+@@ -10,7 +10,7 @@
+ 
+ #include "webrtc/modules/audio_processing/aec3/aec_state.h"
+ 
+-#include <math.h>
++#include <cmath>
+ #include <numeric>
+ #include <vector>
+ 

pkgs/applications/networking/browsers/vivaldi/chromium-gn-bootstrap-r14.patch

@@ -0,0 +1,27 @@
+commit 96c271f8ab2be7ea4199078ea65ac50c6ada4685
+Author: Pawel Hajdan, Jr <phajdan.jr@chromium.org>
+Date:   Wed Jul 26 21:51:54 2017 +0000
+
+    wip
+
+diff --git a/tools/gn/bootstrap/bootstrap.py b/tools/gn/bootstrap/bootstrap.py
+index 1390560f8e37..ff2ae57c46b0 100755
+--- a/tools/gn/bootstrap/bootstrap.py
++++ b/tools/gn/bootstrap/bootstrap.py
+@@ -449,6 +449,7 @@ def write_gn_ninja(path, root_gen_dir, options):
+       'base/metrics/histogram_base.cc',
+       'base/metrics/histogram_functions.cc',
+       'base/metrics/histogram_samples.cc',
++      'base/metrics/histogram_snapshot_manager.cc',
+       'base/metrics/metrics_hashes.cc',
+       'base/metrics/persistent_histogram_allocator.cc',
+       'base/metrics/persistent_memory_allocator.cc',
+@@ -534,7 +535,7 @@ def write_gn_ninja(path, root_gen_dir, options):
+       'base/trace_event/heap_profiler_allocation_context_tracker.cc',
+       'base/trace_event/heap_profiler_allocation_register.cc',
+       'base/trace_event/heap_profiler_event_filter.cc',
+-      'base/trace_event/heap_profiler_event_writer.cc',
++      'base/trace_event/heap_profiler_heap_dump_writer.cc',
+       'base/trace_event/heap_profiler_serialization_state.cc',
+       'base/trace_event/heap_profiler_stack_frame_deduplicator.cc',
+       'base/trace_event/heap_profiler_type_name_deduplicator.cc',

pkgs/applications/networking/browsers/vivaldi/chromium-gn-bootstrap-r8.patch

@@ -1,13 +0,0 @@
-Index: tools/gn/bootstrap/bootstrap.py
-diff --git a/tools/gn/bootstrap/bootstrap.py b/tools/gn/bootstrap/bootstrap.py
-index 6f2f5b1264519ea38cc36fb0b7e2cc24c378ca7a..0b03d2626b358fb90ab39d737679ee47bd60303b 100755
---- a/tools/gn/bootstrap/bootstrap.py
-+++ b/tools/gn/bootstrap/bootstrap.py
-@@ -487,6 +487,7 @@ def write_gn_ninja(path, root_gen_dir, options):
-       'base/sys_info.cc',
-       'base/task_runner.cc',
-       'base/task_scheduler/delayed_task_manager.cc',
-+      'base/task_scheduler/environment_config.cc',
-       'base/task_scheduler/post_task.cc',
-       'base/task_scheduler/priority_queue.cc',
-       'base/task_scheduler/scheduler_lock_impl.cc',

pkgs/applications/networking/browsers/vivaldi/default.nix

@@ -13,11 +13,11 @@
 stdenv.mkDerivation rec {
   name = "${product}-${version}";
   product = "vivaldi";
-  version = "1.11.917.39-1";
+  version = "1.12.955.36-1";
 
   src = fetchurl {
     url = "https://downloads.vivaldi.com/stable/${product}-stable_${version}_amd64.deb";
-    sha256 = "0rsggp4ayj462g217zb9y9grhvbrcxa51a77l8l4qzhd9lg7zvx6";
+    sha256 = "0fh6v4byqvyywlf9xsxn78kfypcqsmf4vypv5mwxh5nrpwim4xqj";
   };
 
   unpackPhase = ''

pkgs/applications/networking/browsers/vivaldi/ffmpeg-codecs.nix

@@ -6,11 +6,11 @@
 stdenv.mkDerivation rec {
   name = "${product}-${version}";
   product = "vivaldi-ffmpeg-codecs";
-  version = "60.0.3112.90";
+  version = "61.0.3163.91";
 
   src = fetchurl {
     url = "https://commondatastorage.googleapis.com/chromium-browser-official/chromium-${version}.tar.xz";
-    sha512 = "2p7pjjsxpglxjmh0asyykagqh33ccrjwj4b2aski4h31wkxv9b9najy8aqk6j1bi06n9wd35vis4hz4fr6kvgckllg1pjqrb3bpwmq5";
+    sha512 = "3f07vwbxllrwy3agqxa6ndcix23vai18i178zscmk0y68flhzffyjdvrwlg7dzlwgiqypj2cyl21qb4qmcay2ilgw9vnr9fql2x0w7p";
   };
 
   buildInputs = [ ];
@@ -21,7 +21,9 @@ stdenv.mkDerivation rec {
   ];
 
   patches = [
-    ./chromium-gn-bootstrap-r8.patch
+    ./chromium-gn-bootstrap-r14.patch
+    ./chromium-gcc-r1.patch
+    ./chromium-gcc5-r1.patch
   ];
 
   configurePhase = ''
@@ -51,5 +53,6 @@ stdenv.mkDerivation rec {
     license     = licenses.lgpl21;
     maintainers = with maintainers; [ lluchs ];
     platforms   = [ "x86_64-linux" ];
+    broken = true;
   };
 }

pkgs/applications/networking/cluster/mesos/default.nix

@@ -68,6 +68,8 @@ in stdenv.mkDerivation rec {
       --subst-var-by chown ${coreutils}/bin/chown
 
     substituteInPlace 3rdparty/stout/Makefile.am \
+      --replace "-lprotobuf" \
+                "${pythonProtobuf.protobuf}/lib/libprotobuf.a"
 
     substituteInPlace 3rdparty/stout/include/stout/os/posix/fork.hpp \
       --subst-var-by sh ${bash}/bin/bash
@@ -94,6 +96,8 @@ in stdenv.mkDerivation rec {
       --subst-var-by mesos-resolve $out/bin/mesos-resolve
 
     substituteInPlace src/python/native_common/ext_modules.py.in \
+      --replace "-lprotobuf" \
+                "${pythonProtobuf.protobuf}/lib/libprotobuf.a"
 
     substituteInPlace src/slave/containerizer/mesos/isolators/gpu/volume.cpp \
       --subst-var-by cp    ${coreutils}/bin/cp \
@@ -117,6 +121,8 @@ in stdenv.mkDerivation rec {
 
     substituteInPlace src/Makefile.am \
       --subst-var-by mavenRepo ${mavenRepo} \
+      --replace "-lprotobuf" \
+                "${pythonProtobuf.protobuf}/lib/libprotobuf.a"
 
   '' + lib.optionalString stdenv.isLinux ''
 

pkgs/applications/networking/instant-messengers/scudcloud/default.nix

@@ -1,12 +1,12 @@
 { stdenv, fetchurl, python3Packages }:
 
-let version = "1.58";
+let version = "1.63";
 in python3Packages.buildPythonPackage {
   name = "scudcloud-${version}";
 
   src = fetchurl {
     url = "https://github.com/raelgc/scudcloud/archive/v${version}.tar.gz";
-    sha256 = "1j84qdc2j3dvl1nhrjqm0blc8ww723p9a6hqprkkp8alw77myq1l";
+    sha256 = "e0d1cb72115d0fda17db92d28be51558ad8fe250972683fac3086dbe8d350d22";
   };
 
   propagatedBuildInputs = with python3Packages; [ pyqt5 dbus-python ];

pkgs/applications/networking/irc/quassel/default.nix

@@ -65,6 +65,9 @@ in with stdenv; mkDerivation rec {
     ++ edf withKDE "WITH_KDE";
 
   preFixup =
+    lib.optionalString daemon ''
+        wrapProgram "$out/bin/quasselcore" --suffix PATH : "${qtbase.bin}/bin"
+    '' +
     lib.optionalString buildClient ''
         wrapProgram "$out/bin/quassel${lib.optionalString client "client"}" \
           --prefix GIO_EXTRA_MODULES : "${dconf}/lib/gio/modules"

pkgs/applications/networking/irc/weechat/default.nix

@@ -21,12 +21,12 @@ let
 in
 
 stdenv.mkDerivation rec {
-  version = "1.9";
+  version = "1.9.1";
   name = "weechat-${version}";
 
   src = fetchurl {
     url = "http://weechat.org/files/src/weechat-${version}.tar.bz2";
-    sha256 = "0xfnhaxmvxdxs3ic0qs5lwq3yl4pi5ib99p0p5lv3v2vldqlm4lc";
+    sha256 = "1kgi079bq4n0wb7hc7mz8p7ay1b2m0a4wpvb92sfsxrnh10qr5m1";
   };
 
   outputs = [ "out" "man" ];

pkgs/applications/networking/p2p/qbittorrent/default.nix

@@ -6,15 +6,15 @@
 }:
 
 assert guiSupport -> (dbus_libs != null);
-
 with stdenv.lib;
+
 stdenv.mkDerivation rec {
   name = "qbittorrent-${version}";
-  version = "3.3.15";
+  version = "3.3.16";
 
   src = fetchurl {
     url = "mirror://sourceforge/qbittorrent/${name}.tar.xz";
-    sha256 = "1bnfnbkdg0088h25zzhlpcdh30y0k1m76bkhjsj1aali765c1fx7";
+    sha256 = "0mxyn2pajvb55bhcaz55v64p2xzy15p0yy174s62b5y3f8cac27a";
   };
 
   nativeBuildInputs = [ pkgconfig which ];
@@ -33,11 +33,7 @@ stdenv.mkDerivation rec {
     (if webuiSupport then "" else "--disable-webui")
   ] ++ optional debugSupport "--enable-debug";
 
-  # The lrelease binary is named lrelease instead of lrelease-qt4
-  patches = [ ./fix-lrelease.patch ];
-
-  # https://github.com/qbittorrent/qBittorrent/issues/1992
-  enableParallelBuilding = false;
+  enableParallelBuilding = true;
 
   meta = {
     description = "Free Software alternative to µtorrent";

pkgs/applications/networking/p2p/qbittorrent/fix-lrelease.patch

@@ -1,18 +0,0 @@
-diff --git a/qm_gen.pri b/qm_gen.pri
-index 5454440..2d5990c 100644
---- a/qm_gen.pri
-+++ b/qm_gen.pri
-@@ -5,12 +5,7 @@ isEmpty(QMAKE_LRELEASE) {
-     win32|os2:QMAKE_LRELEASE = $$[QT_INSTALL_BINS]\\lrelease.exe
-     else:QMAKE_LRELEASE = $$[QT_INSTALL_BINS]/lrelease
-     unix {
--      equals(QT_MAJOR_VERSION, 4) {
--        !exists($$QMAKE_LRELEASE) { QMAKE_LRELEASE = lrelease-qt4 }
--      } 
--      equals(QT_MAJOR_VERSION, 5) {
--        !exists($$QMAKE_LRELEASE) { QMAKE_LRELEASE = lrelease-qt5 }
--      }
-+        !exists($$QMAKE_LRELEASE) { QMAKE_LRELEASE = lrelease }
-     } else {
-         !exists($$QMAKE_LRELEASE) { QMAKE_LRELEASE = lrelease }
-     }

pkgs/applications/networking/sniffers/ettercap/default.nix

@@ -1,5 +1,6 @@
-{ stdenv, fetchFromGitHub, cmake, libpcap, libnet, zlib, curl, pcre,
-  openssl, ncurses, glib, gtk2, atk, pango, flex, bison }:
+{ stdenv, fetchFromGitHub, cmake, libpcap, libnet, zlib, curl, pcre
+, openssl, ncurses, glib, gtk2, atk, pango, flex, bison
+, fetchpatch }:
 
 stdenv.mkDerivation rec {
   name = "ettercap-${version}";
@@ -12,6 +13,19 @@ stdenv.mkDerivation rec {
     sha256 = "1kvrzv2f8kxy7pndfadkzv10cs5wsyfkaa1ski20r2mq4wrvd0cd";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2017-8366.patch";
+      url = "https://github.com/Ettercap/ettercap/commit/1083d604930ebb9f350126b83802ecd2cbc17f90.patch";
+      sha256 = "1ff6fp8fxisvd3fkkd01y4fjykgcj414kczzpfscdmi52ridwg8m";
+    })
+    (fetchpatch {
+      name = "CVE-2017-6430.patch";
+      url = "https://github.com/Ettercap/ettercap/commit/7f50c57b2101fe75592c8dc9960883bbd1878bce.patch";
+      sha256 = "0s13nc9yzxzp611rixsd1c8aw1b57q2lnvfq8wawxyrw07h7b2j4";
+    })
+  ];
+
   buildInputs = [
     cmake libpcap libnet zlib curl pcre openssl ncurses
     glib gtk2 atk pango flex bison

pkgs/applications/networking/sync/rclone/default.nix

@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   name = "rclone-${version}";
-  version = "1.37";
+  version = "1.38";
 
   goPackagePath = "github.com/ncw/rclone";
 
@@ -10,7 +10,7 @@ buildGoPackage rec {
     owner = "ncw";
     repo = "rclone";
     rev = "v${version}";
-    sha256 = "0krmdwzl4c68vxpbycqy2xba8vvqbka7xh3k2q6ldxsd8y2rypym";
+    sha256 = "0f56qm4lz55anzqf6dmjfywmvqy10zi5cl69zz8lda8lmvrpjm1d";
   };
 
   outputs = [ "bin" "out" "man" ];

pkgs/applications/networking/syncthing012/default.nix

@@ -5,8 +5,6 @@ buildGoPackage rec {
   version = "0.12.15";
   rev = "v${version}";
 
-  buildFlags = "--tags noupgrade,release";
-  
   goPackagePath = "github.com/syncthing/syncthing";
 
   src = fetchFromGitHub {
@@ -22,4 +20,8 @@ buildGoPackage rec {
     # Mostly a cosmetic change
     sed -i 's,unknown-dev,${version},g' cmd/syncthing/main.go
   '';
+
+  preBuild = ''
+    export buildFlagsArray+=("-tags" "noupgrade release")
+  '';
 }

pkgs/applications/science/electronics/kicad/default.nix

@@ -67,5 +67,6 @@ stdenv.mkDerivation rec {
     license = stdenv.lib.licenses.gpl2;
     maintainers = with stdenv.lib.maintainers; [viric];
     platforms = with stdenv.lib.platforms; linux;
+    hydraPlatforms = []; # 'output limit exceeded' error on hydra
   };
 }

pkgs/applications/science/machine-learning/torch/torch-distro.nix

@@ -105,6 +105,7 @@ let
       installPhase = ''
         make install-extra $makeFlags
       '';
+      meta.broken = true;
     };
 
     luafilesystem = buildLuaRocks {
@@ -123,6 +124,7 @@ let
     luaffifb = buildLuaRocks {
       name = "luaffifb";
       src = "${distro_src}/extra/luaffifb";
+      meta.broken = true;
     };
 
     sundown = buildLuaRocks rec {
@@ -267,6 +269,7 @@ let
       preBuild = ''
         export Torch_DIR=${torch}/share/cmake/torch
       '';
+      meta.broken = true;
     };
 
     trepl = buildLuaRocks rec {

pkgs/applications/science/math/R/default.nix

@@ -7,11 +7,11 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "R-3.4.1";
+  name = "R-3.4.2";
 
   src = fetchurl {
     url = "http://cran.r-project.org/src/base/R-3/${name}.tar.gz";
-    sha256 = "0y7wlfk3cn1dxn2mpnxwvsk31s0599crbsyah8srm5pa2mfi7c82";
+    sha256 = "0r0cv2kc3x5z9xycpnxx6fbvv22psw2m342jhpslbxkc8g1307lp";
   };
 
   buildInputs = [

pkgs/applications/science/math/clp/default.nix

@@ -0,0 +1,24 @@
+{ stdenv, fetchurl, zlib }:
+
+stdenv.mkDerivation rec {
+	version = "1.16.11";
+	name = "clp-${version}";
+	src = fetchurl {
+		url = "https://www.coin-or.org/download/source/Clp/Clp-${version}.tgz";
+		sha256 = "0fazlqpp845186nmixa9f1xfxqqkdr1xj4va7q29m8594ca4a9dm";
+	};
+
+	propagatedBuildInputs = [ zlib ];
+
+	doCheck = true;
+
+	checkTarget = "test";
+
+	meta = {
+		license = stdenv.lib.licenses.epl10;
+		homepage = https://projects.coin-or.org/Clp;
+		description = "An open-source linear programming solver written in C++";
+		platforms = stdenv.lib.platforms.all;
+		maintainers = [ stdenv.lib.maintainers.vbgl ];
+	};
+}

pkgs/applications/science/math/giac/default.nix

@@ -0,0 +1,68 @@
+{ stdenv, fetchurl, texlive, bison, flex
+, gmp, mpfr, pari, ntl, gsl, blas, mpfi, liblapackWithAtlas
+, readline, gettext, libpng, libao, gfortran, perl
+, enableGUI ? false, mesa ? null, xorg ? null, fltk ? null
+}:
+
+assert enableGUI -> mesa != null && xorg != null && fltk != null;
+
+stdenv.mkDerivation rec {
+  name = "${attr}-${version}";
+  attr = if enableGUI then "giac-with-xcas" else "giac";
+  version = "1.4.9";
+
+  src = fetchurl {
+    url = "https://www-fourier.ujf-grenoble.fr/~parisse/giac/giac-${version}.tar.bz2";
+    sha256 = "1n7xxgpqrsq7cv5wgcmgag6jvxw5wijkf1yv1r5aizlf1rc7dhai";
+  };
+
+  postPatch = ''
+    for i in doc/*/Makefile*; do
+      substituteInPlace "$i" --replace "/bin/cp" "cp";
+    done;
+  '';
+
+  nativeBuildInputs = [
+    texlive.combined.scheme-small bison flex
+  ];
+
+  # perl is only needed for patchShebangs fixup.
+  buildInputs = [
+    gmp mpfr pari ntl gsl blas mpfi liblapackWithAtlas
+    readline gettext libpng libao gfortran perl
+  ] ++ stdenv.lib.optionals enableGUI [
+    mesa fltk xorg.libX11
+  ];
+
+  outputs = [ "out" ];
+
+  enableParallelBuilding = true;
+  hardeningDisable = [ "format" "bindnow" "relro" ];
+
+  configureFlags = [
+    "--enable-gc" "--enable-png" "--enable-gsl" "--enable-lapack"
+    "--enable-pari" "--enable-ntl" "--enable-gmpxx" # "--enable-cocoa"
+    "--enable-ao"
+  ] ++ stdenv.lib.optionals enableGUI [
+    "--enable-gui" "--with-x"
+  ];
+
+  postInstall = ''
+    # example Makefiles contain the full path to some commands
+    # notably texlive, and we don't want texlive to become a runtime
+    # dependency
+    for file in $(find $out -name Makefile) ; do
+      sed -i "s@/nix/store/[^/]*/bin/@@" "$file" ;
+    done;
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A free computer algebra system (CAS)";
+    homepage = "https://www-fourier.ujf-grenoble.fr/~parisse/giac.html";
+    license = licenses.gpl3Plus;
+    ## xcas is buildable on darwin but there are specific instructions I could
+    ## not test
+    platforms = platforms.linux;
+    maintainers = [ maintainers.symphorien ];
+  };
+}

pkgs/applications/science/math/gmsh/default.nix

@@ -1,25 +1,27 @@
-{ stdenv, fetchurl, cmake, blas, liblapack, gfortran, fltk, libjpeg
+{ stdenv, fetchurl, cmake, blas, liblapack, gfortran, gmm, fltk, libjpeg
 , zlib, mesa, mesa_glu, xorg }:
 
-let version = "2.12.0"; in
+let version = "3.0.5"; in
 
 stdenv.mkDerivation {
   name = "gmsh-${version}";
 
   src = fetchurl {
     url = "http://gmsh.info/src/gmsh-${version}-source.tgz";
-    sha256 = "02cx2mfbxx6m18s54z4yzbk4ybch3v9489z7cr974y8y0z42xgbz";
+    sha256 = "ae39ed81178d94b76990b8c89b69a5ded8910fd8f7426b800044d00373d12a93";
   };
 
   # The original CMakeLists tries to use some version of the Lapack lib
   # that is supposed to work without Fortran but didn't for me.
   patches = [ ./CMakeLists.txt.patch ];
 
-  buildInputs = [ cmake blas liblapack gfortran fltk libjpeg zlib mesa
+  buildInputs = [ cmake blas liblapack gfortran gmm fltk libjpeg zlib mesa
     mesa_glu xorg.libXrender xorg.libXcursor xorg.libXfixes xorg.libXext
     xorg.libXft xorg.libXinerama xorg.libX11 xorg.libSM xorg.libICE
   ];
 
+  enableParallelBuilding = true;
+
   meta = {
     description = "A three-dimensional finite element mesh generator";
     homepage = http://gmsh.info/;

pkgs/applications/science/misc/gplates/default.nix

@@ -24,5 +24,6 @@ stdenv.mkDerivation rec {
     homepage = https://www.gplates.org;
     license = licenses.gpl2;
     platforms = platforms.all;
+    broken = true;
   };
 }

pkgs/applications/science/misc/openmodelica/default.nix

@@ -50,6 +50,7 @@ stdenv.mkDerivation {
     license     = licenses.gpl3;
     maintainers = with maintainers; [ smironov ];
     platforms   = platforms.linux;
+    broken      = true;
   };
 }
 

pkgs/applications/version-management/fossil/default.nix

@@ -2,15 +2,16 @@
 , tcllib, withJson ? true}:
 
 stdenv.mkDerivation rec {
-  name = "fossil-2.2";
+  name = "fossil-${version}";
+  version = "2.3";
 
   src = fetchurl {
-    urls = 
+    urls =
       [
-        https://www.fossil-scm.org/index.html/uv/fossil-src-2.2.tar.gz
+        "https://www.fossil-scm.org/index.html/uv/fossil-src-${version}.tar.gz"
       ];
     name = "${name}.tar.gz";
-    sha256 = "0wfgacfg29dkl0c3l1rp5ji0kraa64gcbg5lh8p4m7mqdqcq53wv";
+    sha256 = "0paalvb4rdyr79v6rwspaha5n4dqb92df9irijha13m3apsanwzh";
   };
 
   buildInputs = [ zlib openssl readline sqlite which ed ]

pkgs/applications/version-management/git-and-tools/tig/default.nix

@@ -4,14 +4,14 @@
 
 stdenv.mkDerivation rec {
   pname = "tig";
-  version = "2.2.2";
+  version = "2.3.0";
   name = "${pname}-${version}";
 
   src = fetchFromGitHub {
     owner = "jonas";
     repo = pname;
     rev = name;
-    sha256 = "1zbj4pfcnj1d0zfhx5jw9x7f2hz99mry20bgyyvrij2vj8gf5vk4";
+    sha256 = "04qw3fyamm1lka9vh7adrkr2mcnwcch9ya5sph51jx6d4jz1lih5";
   };
 
   nativeBuildInputs = [ makeWrapper autoreconfHook asciidoc xmlto docbook_xsl docbook_xml_dtd_45 findXMLCatalogs pkgconfig ];

pkgs/applications/version-management/gitaly/Gemfile

@@ -1,5 +1,5 @@
 source 'https://rubygems.org'
 
 gem 'github-linguist', '~> 4.7.0', require: 'linguist'
-gem 'gitaly-proto', '~> 0.31.0', require: 'gitaly'
+gem 'gitaly-proto', '~> 0.37.0', require: 'gitaly'
 gem 'activesupport'

pkgs/applications/version-management/gitaly/Gemfile.lock

@@ -13,7 +13,7 @@ GEM
     escape_utils (1.1.1)
     faraday (0.12.2)
       multipart-post (>= 1.2, < 3)
-    gitaly-proto (0.31.0)
+    gitaly-proto (0.37.0)
       google-protobuf (~> 3.1)
       grpc (~> 1.0)
     github-linguist (4.7.6)
@@ -21,7 +21,7 @@ GEM
       escape_utils (~> 1.1.0)
       mime-types (>= 1.19)
       rugged (>= 0.23.0b)
-    google-protobuf (3.3.0)
+    google-protobuf (3.4.0.2)
     googleauth (0.5.3)
       faraday (~> 0.12)
       jwt (~> 1.4)
@@ -30,7 +30,7 @@ GEM
       multi_json (~> 1.11)
       os (~> 0.9)
       signet (~> 0.7)
-    grpc (1.4.5)
+    grpc (1.6.0)
       google-protobuf (~> 3.1)
       googleauth (~> 0.5.1)
     i18n (0.8.1)
@@ -63,8 +63,8 @@ PLATFORMS
 
 DEPENDENCIES
   activesupport
-  gitaly-proto (~> 0.31.0)
+  gitaly-proto (~> 0.37.0)
   github-linguist (~> 4.7.0)
 
 BUNDLED WITH
-   1.15.3
+   1.15.4

pkgs/applications/version-management/gitaly/default.nix

@@ -7,14 +7,14 @@ let
     gemdir = ./.;
   };
 in buildGoPackage rec {
-  version = "0.35.0";
+  version = "0.38.0";
   name = "gitaly-${version}";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitaly";
     rev = "v${version}";
-    sha256 = "0h3gh4y571wrnnsg5wpi67psih8yssaw24v3vrcpqpkz5linj7pl";
+    sha256 = "02s5gjxbjvm990n4h5zkyqj71a9mp4yj83hfl8mma0g7gx00icsf";
   };
 
   goPackagePath = "gitlab.com/gitlab-org/gitaly";

pkgs/applications/version-management/gitaly/gemset.nix

@@ -54,10 +54,10 @@
     dependencies = ["google-protobuf" "grpc"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1n5bpclizxc42m5kbrhdgsb0ddkl47d0rgmcya5b6sv8qbclkkds";
+      sha256 = "1nqp9ib00q55ig8zf1r6ldf3xkqw0874ra1mbcsm8sl46l84lx11";
       type = "gem";
     };
-    version = "0.31.0";
+    version = "0.37.0";
   };
   github-linguist = {
     dependencies = ["charlock_holmes" "escape_utils" "mime-types" "rugged"];
@@ -71,10 +71,10 @@
   google-protobuf = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1q0ka7x53b9vx4wdb2jdvwxxpb5i5ns7fhqb9zgbrp8yy1bg9m9p";
+      sha256 = "1jh8axm5m75rvdf2i3s24pmi7p613armh9vk3p1d0ryfx159mqkl";
       type = "gem";
     };
-    version = "3.3.0";
+    version = "3.4.0.2";
   };
   googleauth = {
     dependencies = ["faraday" "jwt" "logging" "memoist" "multi_json" "os" "signet"];
@@ -89,10 +89,10 @@
     dependencies = ["google-protobuf" "googleauth"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1zhci260088zlghpaz6ania1blz1dd7lgklsjnqk1vcymhpr6b38";
+      sha256 = "056ipqai887x5jpbgcc215kdi0lfqjzcjbx3hx11cjrfww01zc52";
       type = "gem";
     };
-    version = "1.4.5";
+    version = "1.6.0";
   };
   i18n = {
     source = {

pkgs/applications/version-management/gitlab-shell/default.nix

@@ -1,14 +1,14 @@
 { stdenv, ruby, bundler, fetchFromGitLab, go }:
 
 stdenv.mkDerivation rec {
-  version = "5.8.0";
+  version = "5.9.0";
   name = "gitlab-shell-${version}";
 
   srcs = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-shell";
     rev = "v${version}";
-    sha256 = "1zqd7lys309ylbg45vm1apyx9r82kq1drwinr3di2ybb64v3z2q8";
+    sha256 = "1zjlwivksaqlfxxhxjgpqa3293nhijw76fj7nv0l11820wplc7yf";
   };
 
   buildInputs = [

pkgs/applications/version-management/gitlab/Gemfile

@@ -16,7 +16,7 @@ gem 'mysql2', '~> 0.4.5', group: :mysql
 gem 'pg', '~> 0.18.2', group: :postgres
 
 gem 'rugged', '~> 0.26.0'
-gem 'grape-route-helpers', '~> 2.0.0'
+gem 'grape-route-helpers', '~> 2.1.0'
 
 gem 'faraday', '~> 0.12'
 
@@ -31,7 +31,7 @@ gem 'omniauth-cas3', '~> 1.1.4'
 gem 'omniauth-facebook', '~> 4.0.0'
 gem 'omniauth-github', '~> 1.1.1'
 gem 'omniauth-gitlab', '~> 1.0.2'
-gem 'omniauth-google-oauth2', '~> 0.4.1'
+gem 'omniauth-google-oauth2', '~> 0.5.2'
 gem 'omniauth-kerberos', '~> 0.3.0', group: :kerberos
 gem 'omniauth-oauth2-generic', '~> 0.2.2'
 gem 'omniauth-saml', '~> 1.7.0'
@@ -64,7 +64,7 @@ gem 'gpgme'
 # LDAP Auth
 # GitLab fork with several improvements to original library. For full list of changes
 # see https://github.com/intridea/omniauth-ldap/compare/master...gitlabhq:master
-gem 'gitlab_omniauth-ldap', '~> 2.0.3', require: 'omniauth-ldap'
+gem 'gitlab_omniauth-ldap', '~> 2.0.4', require: 'omniauth-ldap'
 gem 'net-ldap'
 
 # Git Wiki
@@ -76,7 +76,7 @@ gem 'gollum-rugged_adapter', '~> 0.4.4', require: false
 gem 'github-linguist', '~> 4.7.0', require: 'linguist'
 
 # API
-gem 'grape', '~> 0.19.2'
+gem 'grape', '~> 1.0'
 gem 'grape-entity', '~> 0.6.0'
 gem 'rack-cors', '~> 0.4.0', require: 'rack/cors'
 
@@ -128,7 +128,7 @@ gem 'asciidoctor-plantuml', '0.0.7'
 gem 'rouge', '~> 2.0'
 gem 'truncato', '~> 0.7.9'
 gem 'bootstrap_form', '~> 2.7.0'
-gem 'nokogiri', '~> 1.8.0'
+gem 'nokogiri', '~> 1.8.1'
 
 # Diffs
 gem 'diffy', '~> 3.1.0'
@@ -141,8 +141,6 @@ end
 
 # State machine
 gem 'state_machines-activerecord', '~> 0.4.0'
-# Run events after state machine commits
-gem 'after_commit_queue', '~> 1.3.0'
 
 # Issue tags
 gem 'acts-as-taggable-on', '~> 4.0'
@@ -183,7 +181,7 @@ gem 'connection_pool', '~> 2.0'
 gem 'hipchat', '~> 1.5.0'
 
 # JIRA integration
-gem 'jira-ruby', '~> 1.1.2'
+gem 'jira-ruby', '~> 1.4'
 
 # Flowdock integration
 gem 'gitlab-flowdock-git-hook', '~> 1.0.1'
@@ -206,9 +204,6 @@ gem 'kubeclient', '~> 2.2.0'
 # d3
 gem 'd3_rails', '~> 3.5.0'
 
-# underscore-rails
-gem 'underscore-rails', '~> 1.8.0'
-
 # Sanitize user input
 gem 'sanitize', '~> 2.0'
 gem 'babosa', '~> 1.0.2'
@@ -229,7 +224,7 @@ gem 'ace-rails-ap', '~> 4.1.0'
 gem 'mousetrap-rails', '~> 1.4.6'
 
 # Detect and convert string character encoding
-gem 'charlock_holmes', '~> 0.7.3'
+gem 'charlock_holmes', '~> 0.7.5'
 
 # Faster JSON
 gem 'oj', '~> 2.17.4'
@@ -329,7 +324,7 @@ group :development, :test do
   # Generate Fake data
   gem 'ffaker', '~> 2.4'
 
-  gem 'capybara', '~> 2.6.2'
+  gem 'capybara', '~> 2.15.0'
   gem 'capybara-screenshot', '~> 1.0.0'
   gem 'poltergeist', '~> 1.9.0'
 
@@ -339,6 +334,7 @@ group :development, :test do
 
   gem 'rubocop', '~> 0.49.1', require: false
   gem 'rubocop-rspec', '~> 1.15.1', require: false
+  gem 'rubocop-gitlab-security', '~> 0.1.0', require: false
   gem 'scss_lint', '~> 0.54.0', require: false
   gem 'haml_lint', '~> 0.26.0', require: false
   gem 'simplecov', '~> 0.14.0', require: false
@@ -352,7 +348,9 @@ group :development, :test do
 
   gem 'activerecord_sane_schema_dumper', '0.2'
 
-  gem 'stackprof', '~> 0.2.10'
+  gem 'stackprof', '~> 0.2.10', require: false
+
+  gem 'simple_po_parser', '~> 1.1.2', require: false
 end
 
 group :test do
@@ -394,12 +392,12 @@ gem 'net-ssh', '~> 4.1.0'
 # Required for ED25519 SSH host key support
 group :ed25519 do
   gem 'rbnacl-libsodium'
-  gem 'rbnacl', '~> 3.2'
+  gem 'rbnacl', '~> 4.0'
   gem 'bcrypt_pbkdf', '~> 1.0'
 end
 
 # Gitaly GRPC client
-gem 'gitaly', '~> 0.26.0'
+gem 'gitaly-proto', '~> 0.33.0', require: 'gitaly'
 
 gem 'toml-rb', '~> 0.3.15', require: false
 
@@ -409,5 +407,6 @@ gem 'flipper-active_record', '~> 0.10.2'
 
 # Structured logging
 gem 'lograge', '~> 0.5'
+gem 'grape_logging', '~> 1.7'
 
 gem 'activerecord-nulldb-adapter'

pkgs/applications/version-management/gitlab/Gemfile.lock

@@ -48,8 +48,6 @@ GEM
       ice_nine (~> 0.11.0)
       memoizable (~> 0.4.0)
     addressable (2.3.8)
-    after_commit_queue (1.3.0)
-      activerecord (>= 3.0)
     akismet (2.0.0)
     allocations (1.0.5)
     arel (6.0.4)
@@ -104,9 +102,9 @@ GEM
       bundler (~> 1.2)
       thor (~> 0.18)
     byebug (9.0.6)
-    capybara (2.6.2)
+    capybara (2.15.1)
       addressable
-      mime-types (>= 1.16)
+      mini_mime (>= 0.1.3)
       nokogiri (>= 1.3.3)
       rack (>= 1.0.0)
       rack-test (>= 0.5.4)
@@ -119,7 +117,7 @@ GEM
       activesupport (>= 4.0.0)
       mime-types (>= 1.16)
     cause (0.1)
-    charlock_holmes (0.7.3)
+    charlock_holmes (0.7.5)
     chronic (0.10.2)
     chronic_duration (0.10.6)
       numerizer (~> 0.1.1)
@@ -207,7 +205,7 @@ GEM
       multi_json
     fast_gettext (1.4.0)
     ffaker (2.4.0)
-    ffi (1.9.10)
+    ffi (1.9.18)
     flay (2.8.1)
       erubis (~> 2.7.0)
       path_expander (~> 1.0)
@@ -279,7 +277,7 @@ GEM
       po_to_json (>= 1.0.0)
       rails (>= 3.2.0)
     gherkin-ruby (0.3.2)
-    gitaly (0.26.0)
+    gitaly-proto (0.33.0)
       google-protobuf (~> 3.1)
       grpc (~> 1.0)
     github-linguist (4.7.6)
@@ -298,7 +296,7 @@ GEM
       mime-types (>= 1.16, < 3)
       posix-spawn (~> 0.3)
     gitlab-markup (1.5.1)
-    gitlab_omniauth-ldap (2.0.3)
+    gitlab_omniauth-ldap (2.0.4)
       net-ldap (~> 0.16)
       omniauth (~> 1.3)
       pyu-ruby-sasl (>= 0.0.3.3, < 0.1)
@@ -334,7 +332,7 @@ GEM
       multi_json (~> 1.10)
       retriable (~> 1.4)
       signet (~> 0.6)
-    google-protobuf (3.3.0)
+    google-protobuf (3.4.0.2)
     googleauth (0.5.1)
       faraday (~> 0.9)
       jwt (~> 1.4)
@@ -345,12 +343,9 @@ GEM
       signet (~> 0.7)
     gpgme (2.0.13)
       mini_portile2 (~> 2.1)
-    grape (0.19.2)
+    grape (1.0.0)
       activesupport
       builder
-      hashie (>= 2.1.0)
-      multi_json (>= 1.3.2)
-      multi_xml (>= 0.5.2)
       mustermann-grape (~> 1.0.0)
       rack (>= 1.3.0)
       rack-accept
@@ -358,11 +353,13 @@ GEM
     grape-entity (0.6.0)
       activesupport
       multi_json (>= 1.3.2)
-    grape-route-helpers (2.0.0)
+    grape-route-helpers (2.1.0)
       activesupport
-      grape (~> 0.16, >= 0.16.0)
+      grape (>= 0.16.0)
       rake
-    grpc (1.4.0)
+    grape_logging (1.7.0)
+      grape
+    grpc (1.4.5)
       google-protobuf (~> 3.1)
       googleauth (~> 0.5.1)
     haml (4.0.7)
@@ -378,7 +375,7 @@ GEM
       thor
       tilt
     hashdiff (0.3.4)
-    hashie (3.5.5)
+    hashie (3.5.6)
     hashie-forbidden_attributes (0.1.1)
       hashie (>= 3.0)
     health_check (2.6.0)
@@ -411,8 +408,9 @@ GEM
       cause
       json
     ipaddress (0.8.3)
-    jira-ruby (1.1.2)
+    jira-ruby (1.4.1)
       activesupport
+      multipart-post
       oauth (~> 0.5, >= 0.5.0)
     jquery-atwho-rails (1.3.2)
     jquery-rails (4.1.1)
@@ -485,7 +483,8 @@ GEM
     method_source (0.8.2)
     mime-types (2.99.3)
     mimemagic (0.3.0)
-    mini_portile2 (2.2.0)
+    mini_mime (0.1.4)
+    mini_portile2 (2.3.0)
     minitest (5.7.0)
     mmap2 (2.2.7)
     mousetrap-rails (1.4.6)
@@ -499,8 +498,8 @@ GEM
     net-ldap (0.16.0)
     net-ssh (4.1.0)
     netrc (0.11.0)
-    nokogiri (1.8.0)
-      mini_portile2 (~> 2.2.0)
+    nokogiri (1.8.1)
+      mini_portile2 (~> 2.3.0)
     numerizer (0.1.1)
     oauth (0.5.1)
     oauth2 (1.4.0)
@@ -535,8 +534,8 @@ GEM
     omniauth-gitlab (1.0.2)
       omniauth (~> 1.0)
       omniauth-oauth2 (~> 1.0)
-    omniauth-google-oauth2 (0.4.1)
-      jwt (~> 1.5.2)
+    omniauth-google-oauth2 (0.5.2)
+      jwt (~> 1.5)
       multi_json (~> 1.3)
       omniauth (>= 1.1.1)
       omniauth-oauth2 (>= 1.3.1)
@@ -569,7 +568,7 @@ GEM
       rubypants (~> 0.2)
     orm_adapter (0.5.0)
     os (0.9.6)
-    parallel (1.11.2)
+    parallel (1.12.0)
     paranoia (2.3.1)
       activerecord (>= 4.0, < 5.2)
     parser (2.4.0.0)
@@ -690,7 +689,7 @@ GEM
     rake (12.0.0)
     rblineprof (0.3.6)
       debugger-ruby_core_source (~> 1.3)
-    rbnacl (3.4.0)
+    rbnacl (4.0.2)
       ffi
     rbnacl-libsodium (1.0.11)
       rbnacl (>= 3.0.1)
@@ -730,7 +729,7 @@ GEM
     retriable (1.4.1)
     rinku (2.0.0)
     rotp (2.1.2)
-    rouge (2.1.0)
+    rouge (2.2.1)
     rqrcode (0.7.0)
       chunky_png
     rqrcode-rails3 (0.1.7)
@@ -777,6 +776,8 @@ GEM
       rainbow (>= 1.99.1, < 3.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (~> 1.0, >= 1.0.1)
+    rubocop-gitlab-security (0.1.0)
+      rubocop (>= 0.47.1)
     rubocop-rspec (1.15.1)
       rubocop (>= 0.42.0)
     ruby-fogbugz (0.2.1)
@@ -838,6 +839,7 @@ GEM
       faraday (~> 0.9)
       jwt (~> 1.5)
       multi_json (~> 1.10)
+    simple_po_parser (1.1.2)
     simplecov (0.14.1)
       docile (~> 1.1.0)
       json (>= 1.8, < 3)
@@ -905,7 +907,6 @@ GEM
     uglifier (2.7.2)
       execjs (>= 0.3.0)
       json (>= 1.8.0)
-    underscore-rails (1.8.3)
     unf (0.1.4)
       unf_ext
     unf_ext (0.0.7.2)
@@ -952,7 +953,7 @@ GEM
       expression_parser
       rinku
     xml-simple (1.1.5)
-    xpath (2.0.0)
+    xpath (2.1.0)
       nokogiri (~> 1.3)
 
 PLATFORMS
@@ -965,7 +966,6 @@ DEPENDENCIES
   activerecord_sane_schema_dumper (= 0.2)
   acts-as-taggable-on (~> 4.0)
   addressable (~> 2.3.8)
-  after_commit_queue (~> 1.3.0)
   akismet (~> 2.0)
   allocations (~> 1.0)
   asana (~> 0.6.0)
@@ -985,10 +985,10 @@ DEPENDENCIES
   browser (~> 2.2)
   bullet (~> 5.5.0)
   bundler-audit (~> 0.5.0)
-  capybara (~> 2.6.2)
+  capybara (~> 2.15.0)
   capybara-screenshot (~> 1.0.0)
   carrierwave (~> 1.1)
-  charlock_holmes (~> 0.7.3)
+  charlock_holmes (~> 0.7.5)
   chronic (~> 0.10.2)
   chronic_duration (~> 0.10.6)
   concurrent-ruby (~> 1.0.5)
@@ -1027,19 +1027,20 @@ DEPENDENCIES
   gettext (~> 3.2.2)
   gettext_i18n_rails (~> 1.8.0)
   gettext_i18n_rails_js (~> 1.2.0)
-  gitaly (~> 0.26.0)
+  gitaly-proto (~> 0.33.0)
   github-linguist (~> 4.7.0)
   gitlab-flowdock-git-hook (~> 1.0.1)
   gitlab-markup (~> 1.5.1)
-  gitlab_omniauth-ldap (~> 2.0.3)
+  gitlab_omniauth-ldap (~> 2.0.4)
   gollum-lib (~> 4.2)
   gollum-rugged_adapter (~> 0.4.4)
   gon (~> 6.1.0)
   google-api-client (~> 0.8.6)
   gpgme
-  grape (~> 0.19.2)
+  grape (~> 1.0)
   grape-entity (~> 0.6.0)
-  grape-route-helpers (~> 2.0.0)
+  grape-route-helpers (~> 2.1.0)
+  grape_logging (~> 1.7)
   haml_lint (~> 0.26.0)
   hamlit (~> 2.6.1)
   hashie-forbidden_attributes
@@ -1049,7 +1050,7 @@ DEPENDENCIES
   html2text
   httparty (~> 0.13.3)
   influxdb (~> 0.2)
-  jira-ruby (~> 1.1.2)
+  jira-ruby (~> 1.4)
   jquery-atwho-rails (~> 1.3.2)
   jquery-rails (~> 4.1.0)
   json-schema (~> 2.6.2)
@@ -1069,7 +1070,7 @@ DEPENDENCIES
   mysql2 (~> 0.4.5)
   net-ldap
   net-ssh (~> 4.1.0)
-  nokogiri (~> 1.8.0)
+  nokogiri (~> 1.8.1)
   oauth2 (~> 1.4)
   octokit (~> 4.6.2)
   oj (~> 2.17.4)
@@ -1081,7 +1082,7 @@ DEPENDENCIES
   omniauth-facebook (~> 4.0.0)
   omniauth-github (~> 1.1.1)
   omniauth-gitlab (~> 1.0.2)
-  omniauth-google-oauth2 (~> 0.4.1)
+  omniauth-google-oauth2 (~> 0.5.2)
   omniauth-kerberos (~> 0.3.0)
   omniauth-oauth2-generic (~> 0.2.2)
   omniauth-saml (~> 1.7.0)
@@ -1115,7 +1116,7 @@ DEPENDENCIES
   rainbow (~> 2.2)
   raindrops (~> 0.18)
   rblineprof (~> 0.3.6)
-  rbnacl (~> 3.2)
+  rbnacl (~> 4.0)
   rbnacl-libsodium
   rdoc (~> 4.2)
   re2 (~> 1.1.1)
@@ -1134,6 +1135,7 @@ DEPENDENCIES
   rspec-set (~> 0.1.3)
   rspec_profiling (~> 0.0.5)
   rubocop (~> 0.49.1)
+  rubocop-gitlab-security (~> 0.1.0)
   rubocop-rspec (~> 1.15.1)
   ruby-fogbugz (~> 0.2.1)
   ruby-prof (~> 0.16.2)
@@ -1152,6 +1154,7 @@ DEPENDENCIES
   sidekiq (~> 5.0)
   sidekiq-cron (~> 0.6.0)
   sidekiq-limit_fetch (~> 3.4)
+  simple_po_parser (~> 1.1.2)
   simplecov (~> 0.14.0)
   slack-notifier (~> 1.5.1)
   spinach-rails (~> 0.2.1)
@@ -1170,7 +1173,6 @@ DEPENDENCIES
   truncato (~> 0.7.9)
   u2f (~> 0.2.1)
   uglifier (~> 2.7.2)
-  underscore-rails (~> 1.8.0)
   unf (~> 0.1.4)
   unicorn (~> 5.1.0)
   unicorn-worker-killer (~> 0.4.4)
@@ -1183,4 +1185,4 @@ DEPENDENCIES
   wikicloth (= 0.8.1)
 
 BUNDLED WITH
-   1.15.3
+   1.15.4

pkgs/applications/version-management/gitlab/default.nix

@@ -18,11 +18,11 @@ let
     };
   };
 
-  version = "9.5.5";
+  version = "10.0.2";
 
   gitlabDeb = fetchurl {
     url = "https://packages.gitlab.com/gitlab/gitlab-ce/packages/debian/jessie/gitlab-ce_${version}-ce.0_amd64.deb/download";
-    sha256 = "1wrwxksfqkha7qm2hbgs0z7lmgisdvdqa4wcll0qfzq1c3d286zz";
+    sha256 = "0jsqjarvjzbxv1yiddzp5xwsqqrq5cvam0xn749p1vzqhcp8pahc";
   };
 
 in
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
     owner = "gitlabhq";
     repo = "gitlabhq";
     rev = "v${version}";
-    sha256 = "0qi21lkq69ah977vssbkllb7q5jwb0vf2ws5s3bzpvp2mj3iab5m";
+    sha256 = "1602d6nkb41gg80n6p0wqxrjsn79s0z3817461d8dw2ha2dmbl34";
   };
 
   patches = [

pkgs/applications/version-management/gitlab/gemset.nix

@@ -122,15 +122,6 @@
     };
     version = "2.3.8";
   };
-  after_commit_queue = {
-    dependencies = ["activerecord"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1jrhvj4335dsrj0xndbf7a7m2inbwbx1knc0bwgvmkk1w47l43s0";
-      type = "gem";
-    };
-    version = "1.3.0";
-  };
   akismet = {
     source = {
       remotes = ["https://rubygems.org"];
@@ -383,13 +374,13 @@
     version = "9.0.6";
   };
   capybara = {
-    dependencies = ["addressable" "mime-types" "nokogiri" "rack" "rack-test" "xpath"];
+    dependencies = ["addressable" "mini_mime" "nokogiri" "rack" "rack-test" "xpath"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0ln77a5wwhd5sbxsh3v26xrwjnza0rgx2hn23yjggdlha03b00yw";
+      sha256 = "0bahhwrd1rpfhci1x57yz0df9plziipljbw3p4k6mlash4wq6w92";
       type = "gem";
     };
-    version = "2.6.2";
+    version = "2.15.1";
   };
   capybara-screenshot = {
     dependencies = ["capybara" "launchy"];
@@ -420,10 +411,10 @@
   charlock_holmes = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0jsl6k27wjmssxbwv9wpf7hgp9r0nvizcf6qpjnr7qs2nia53lf7";
+      sha256 = "09dn56sx0kcw0k8ypiynhnhhiq7ff9m7b57l8wvnxj82wxsjb54y";
       type = "gem";
     };
-    version = "0.7.3";
+    version = "0.7.5";
   };
   chronic = {
     source = {
@@ -859,10 +850,10 @@
   ffi = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1m5mprppw0xcrv2mkim5zsk70v089ajzqiq5hpyb0xg96fcyzyxj";
+      sha256 = "034f52xf7zcqgbvwbl20jwdyjwznvqnwpbaps9nk18v9lgb1dpx0";
       type = "gem";
     };
-    version = "1.9.10";
+    version = "1.9.18";
   };
   flay = {
     dependencies = ["erubis" "path_expander" "ruby_parser" "sexp_processor"];
@@ -1076,14 +1067,14 @@
     };
     version = "0.3.2";
   };
-  gitaly = {
+  gitaly-proto = {
     dependencies = ["google-protobuf" "grpc"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1vm3kp2qrlkrdd1r386fg97av73y2k3xxw4xl9wfjdqqhisyi6hw";
+      sha256 = "0f15idw1850kwi0na6x3xlk13ljwx3mpfnxfv58631cmb3ac7wf8";
       type = "gem";
     };
-    version = "0.26.0";
+    version = "0.33.0";
   };
   github-linguist = {
     dependencies = ["charlock_holmes" "escape_utils" "mime-types" "rugged"];
@@ -1132,10 +1123,10 @@
     dependencies = ["net-ldap" "omniauth" "pyu-ruby-sasl" "rubyntlm"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1lx5ayb8m2avw6iy9fq0d847z78npg2aax4pbcbprwwmpbnvzz4b";
+      sha256 = "1cpjadx852vw1gv5cm1qiqq6mclglzqajw7q572zncw4q3ji2fkv";
       type = "gem";
     };
-    version = "2.0.3";
+    version = "2.0.4";
   };
   globalid = {
     dependencies = ["activesupport"];
@@ -1194,10 +1185,10 @@
   google-protobuf = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1q0ka7x53b9vx4wdb2jdvwxxpb5i5ns7fhqb9zgbrp8yy1bg9m9p";
+      sha256 = "1jh8axm5m75rvdf2i3s24pmi7p613armh9vk3p1d0ryfx159mqkl";
       type = "gem";
     };
-    version = "3.3.0";
+    version = "3.4.0.2";
   };
   googleauth = {
     dependencies = ["faraday" "jwt" "logging" "memoist" "multi_json" "os" "signet"];
@@ -1218,13 +1209,13 @@
     version = "2.0.13";
   };
   grape = {
-    dependencies = ["activesupport" "builder" "hashie" "multi_json" "multi_xml" "mustermann-grape" "rack" "rack-accept" "virtus"];
+    dependencies = ["activesupport" "builder" "mustermann-grape" "rack" "rack-accept" "virtus"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0ida2agz4f6hfxc4nvmls15f9cl1xg2pra04d388x40r5dmjp04x";
+      sha256 = "1vz5lx56z9hwx6ifyc7qpdwd020xb3ynv3vahvlcgm01qi7ykdhv";
       type = "gem";
     };
-    version = "0.19.2";
+    version = "1.0.0";
   };
   grape-entity = {
     dependencies = ["activesupport" "multi_json"];
@@ -1239,19 +1230,28 @@
     dependencies = ["activesupport" "grape" "rake"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1qkaf2l56rxhacviqpzgqiwiv1fpbpxg5xgyp18x66mgxp9bpram";
+      sha256 = "0ja4dlakk6r8p2cx113kymz9sbhdybjsiynnqpfs71lv0r6mmghj";
       type = "gem";
     };
-    version = "2.0.0";
+    version = "2.1.0";
+  };
+  grape_logging = {
+    dependencies = ["grape"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0lg2vhk0dlnyqs2rz8wilfm039q5mbsp5nvf51asir48a1rf9yza";
+      type = "gem";
+    };
+    version = "1.7.0";
   };
   grpc = {
     dependencies = ["google-protobuf" "googleauth"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1siq5v4bmqlsb6122394dpk35fd2lxvjp4xnrabsb3vd90xqszcj";
+      sha256 = "1zhci260088zlghpaz6ania1blz1dd7lgklsjnqk1vcymhpr6b38";
       type = "gem";
     };
-    version = "1.4.0";
+    version = "1.4.5";
   };
   haml = {
     dependencies = ["tilt"];
@@ -1291,10 +1291,10 @@
   hashie = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0lfmbh98ng141m7yc8s4v56v49ppam416pzvd2d7pg85wmm44ljw";
+      sha256 = "120mkd2hkwhcfj7avi1dphb0lm7wx364d1cjm9yr4fibqpvsgqi7";
       type = "gem";
     };
-    version = "3.5.5";
+    version = "3.5.6";
   };
   hashie-forbidden_attributes = {
     dependencies = ["hashie"];
@@ -1434,13 +1434,13 @@
     version = "0.8.3";
   };
   jira-ruby = {
-    dependencies = ["activesupport" "oauth"];
+    dependencies = ["activesupport" "multipart-post" "oauth"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "03n76a8m2d352q29j3yna1f9g3xg9dc9p3fvvx77w67h19ks7zrf";
+      sha256 = "14019mliqwcppj6qp2wdhh5gbvs2yh2idibag13m9a18ag965bhw";
       type = "gem";
     };
-    version = "1.1.2";
+    version = "1.4.1";
   };
   jquery-atwho-rails = {
     source = {
@@ -1700,13 +1700,21 @@
     };
     version = "0.3.0";
   };
+  mini_mime = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0kzf2zx1arhjhw9c6mns0jqbmzdkd1vw25v940lvw63fzkbfv6dg";
+      type = "gem";
+    };
+    version = "0.1.4";
+  };
   mini_portile2 = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0g5bpgy08q0nc0anisg3yvwc1gc3inl854fcrg48wvg7glqd6dpm";
+      sha256 = "13d32jjadpjj6d2wdhkfpsmy68zjx90p49bgf8f7nkpz86r1fr11";
       type = "gem";
     };
-    version = "2.2.0";
+    version = "2.3.0";
   };
   minitest = {
     source = {
@@ -1809,10 +1817,10 @@
     dependencies = ["mini_portile2"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1nffsyx1xjg6v5n9rrbi8y1arrcx2i5f21cp6clgh9iwiqkr7rnn";
+      sha256 = "105xh2zkr8nsyfaj2izaisarpnkrrl9000y3nyflg9cbzrfxv021";
       type = "gem";
     };
-    version = "1.8.0";
+    version = "1.8.1";
   };
   numerizer = {
     source = {
@@ -1932,10 +1940,10 @@
     dependencies = ["jwt" "multi_json" "omniauth" "omniauth-oauth2"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1m6v2vm3h21ychd10wzkdhyhnrk9zhc1bgi4ahp5gwy00pggrppw";
+      sha256 = "1sri7pn9pm7nr93zj7j1g4gqd3rpibqw7v09s1c6fihh5cmjz3fz";
       type = "gem";
     };
-    version = "0.4.1";
+    version = "0.5.2";
   };
   omniauth-kerberos = {
     dependencies = ["omniauth-multipassword" "timfel-krb5-auth"];
@@ -2046,10 +2054,10 @@
   parallel = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1yxhk64sfkm84v509m3mzmp0b7ra9lc7s8k6113yk9faih3g7w7v";
+      sha256 = "0qv2yj4sxr36ga6xdxvbq9h05hn10bwcbkqv6j6q1fiixhsdnnzd";
       type = "gem";
     };
-    version = "1.11.2";
+    version = "1.12.0";
   };
   paranoia = {
     dependencies = ["activerecord"];
@@ -2441,10 +2449,10 @@
     dependencies = ["ffi"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "06xb4khgjblrmp1xgkjbmca0wl97i0nazf9pgx69vwr1ac03j920";
+      sha256 = "08dkigw8wdx53hviw1zqrs7rcrzqcwh9jd3dvwr72013z9fmyp48";
       type = "gem";
     };
-    version = "3.4.0";
+    version = "4.0.2";
   };
   rbnacl-libsodium = {
     dependencies = ["rbnacl"];
@@ -2620,10 +2628,10 @@
   rouge = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1932gvvzfdky2z01sjri354ak7wq3nk9jmh7fiydfgjchfwk7sr4";
+      sha256 = "02kpahk5nkc33yxnn75649kzxaz073wvazr2zyg491nndykgnvcs";
       type = "gem";
     };
-    version = "2.1.0";
+    version = "2.2.1";
   };
   rqrcode = {
     dependencies = ["chunky_png"];
@@ -2740,6 +2748,15 @@
     };
     version = "0.49.1";
   };
+  rubocop-gitlab-security = {
+    dependencies = ["rubocop"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0aw9qmyc6xj6fi0jxp8m4apk358rd91z492ragn6jp4rghkqj5cy";
+      type = "gem";
+    };
+    version = "0.1.0";
+  };
   rubocop-rspec = {
     dependencies = ["rubocop"];
     source = {
@@ -2990,6 +3007,14 @@
     };
     version = "0.7.3";
   };
+  simple_po_parser = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "08wkp4gcrd89k5yari9j94if9ffkj3rka4llcwrhdgsi3l15p5f3";
+      type = "gem";
+    };
+    version = "1.1.2";
+  };
   simplecov = {
     dependencies = ["docile" "json" "simplecov-html"];
     source = {
@@ -3280,14 +3305,6 @@
     };
     version = "2.7.2";
   };
-  underscore-rails = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0iyspb7s49wpi9cc314gvlkyn45iyfivzxhdw0kql1zrgllhlzfk";
-      type = "gem";
-    };
-    version = "1.8.3";
-  };
   unf = {
     dependencies = ["unf_ext"];
     source = {
@@ -3455,9 +3472,9 @@
     dependencies = ["nokogiri"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "04kcr127l34p7221z13blyl0dvh0bmxwx326j72idayri36a394w";
+      sha256 = "1ha626m6fh50fpilb9pdnmq9xl586w7c0zyidg895c3iq13rqgyw";
       type = "gem";
     };
-    version = "2.0.0";
+    version = "2.1.0";
   };
 }

pkgs/applications/version-management/gitlab/remove-hardcoded-locations.patch

@@ -62,22 +62,16 @@ diff --git a/lib/gitlab/logger.rb b/lib/gitlab/logger.rb
 index 59b21149a9..4f4a39a06c 100644
 --- a/lib/gitlab/logger.rb
 +++ b/lib/gitlab/logger.rb
-@@ -13,20 +13,20 @@ module Gitlab
+@@ -13,7 +13,7 @@
      end
  
      def self.read_latest
 -      path = Rails.root.join("log", file_name)
 +      path = File.join(ENV["GITLAB_LOG_PATH"], file_name)
-       self.build unless File.exist?(path)
-       tail_output, _ = Gitlab::Popen.popen(%W(tail -n 2000 #{path}))
-       tail_output.split("\n")
-     end
  
-     def self.read_latest_for(filename)
--      path = Rails.root.join("log", filename)
-+      path = File.join(ENV["GITLAB_LOG_PATH"], filename)
-       tail_output, _ = Gitlab::Popen.popen(%W(tail -n 2000 #{path}))
-       tail_output.split("\n")
+       return [] unless File.readable?(path)
+ 
+@@ -22,7 +22,7 @@
      end
  
      def self.build
@@ -158,3 +152,14 @@ index b276a81eac..070e3ebd81 100644
        end
      end
    end
+--- a/lib/api/api.rb	1970-01-01 01:00:01.000000000 +0100
++++ b/lib/api/api.rb	2017-09-28 19:37:24.953605705 +0200
+@@ -2,7 +2,7 @@
+   class API < Grape::API
+     include APIGuard
+ 
+-    LOG_FILENAME = Rails.root.join("log", "api_json.log")
++    LOG_FILENAME = File.join(ENV["GITLAB_LOG_PATH"], "api_json.log")
+ 
+     use GrapeLogging::Middleware::RequestLogger,
+         logger: Logger.new(LOG_FILENAME),

pkgs/applications/version-management/gogs/default.nix

@@ -7,13 +7,13 @@ with stdenv.lib;
 
 buildGoPackage rec {
   name = "gogs-${version}";
-  version = "0.11.19";
+  version = "0.11.29";
 
   src = fetchFromGitHub {
     owner = "gogits";
     repo = "gogs";
     rev = "v${version}";
-    sha256 = "0smzklhpfv3smqgzd0cnjdif3zi5q7b02grrnb5zssmdi1b2dlsd";
+    sha256 = "1xn1b4dxf7r8kagps3yvp31zskfxn50k1gfic9abl4kjwpwk78c0";
   };
 
   patchPhase = ''

pkgs/applications/video/gpac/default.nix

@@ -1,19 +1,25 @@
-{ stdenv, fetchsvn, pkgconfig, zlib }:
+{ stdenv, fetchFromGitHub, pkgconfig, zlib }:
 
 stdenv.mkDerivation rec {
-  name = "gpac-0.5.0-svn";
+  version = "0.7.1";
+  name = "gpac-${version}";
 
-  src = fetchsvn {
-    url = "http://svn.code.sf.net/p/gpac/code/trunk/gpac";
-    rev = "4749";
-    sha256 = "0y38pmp64a2l70y1yby90qzxfzx8y7r0cdmgjxzw86jh6si5ndhp";
+  src = fetchFromGitHub {
+    owner = "gpac";
+    repo = "gpac";
+    rev = "v${version}";
+    sha256 = "197c5968p5bzvk0ga347fwgkqh4j1v3z65wlx65c5m9gwfxz2k2q";
   };
 
   # this is the bare minimum configuration, as I'm only interested in MP4Box
   # For most other functionality, this should probably be extended
-  nativeBuildInputs = [ pkgconfig zlib ];
+  nativeBuildInputs = [ pkgconfig ];
 
-  meta = {
+  buildInputs = [ zlib ];
+
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
     description = "Open Source multimedia framework for research and academic purposes";
     longDescription = ''
       GPAC is an Open Source multimedia framework for research and academic purposes.
@@ -27,10 +33,9 @@ stdenv.mkDerivation rec {
       A multimedia packager, called MP4Box,
       And some server tools included in MP4Box and MP42TS applications.
     '';
-    homepage = http://gpac.wp.mines-telecom.fr;
-    license = stdenv.lib.licenses.lgpl21;
-
-    maintainers = [ stdenv.lib.maintainers.bluescreen303 ];
-    platforms = stdenv.lib.platforms.linux;
+    homepage = https://gpac.wp.imt.fr;
+    license = licenses.lgpl21;
+    maintainers = with maintainers; [ bluescreen303 mgdelacroix ];
+    platforms = platforms.linux;
   };
 }

pkgs/applications/video/natron/default.nix

@@ -124,5 +124,6 @@ stdenv.mkDerivation {
     license = stdenv.lib.licenses.gpl2;
     maintainers = [ maintainers.puffnfresh ];
     platforms = platforms.linux;
+    broken = true;
   };
 }

pkgs/applications/video/shotcut/default.nix

@@ -52,9 +52,5 @@ stdenv.mkDerivation rec {
     license = licenses.gpl3;
     maintainers = [ maintainers.goibhniu ];
     platforms = platforms.linux;
-
-    # after qt5 bump it probably needs to be updated,
-    # but newer versions seem to need newer than the latest stable mlt
-    # broken = true;
   };
 }

pkgs/applications/virtualization/docker/default.nix

@@ -46,11 +46,10 @@ rec {
       };
 
       # This should go into the containerd derivation once 1.0.0 is out
-      preBuild = ''
+      preBuild = (optionalString (version == "17.09.0-ce") ''
         mkdir $(pwd)/vendor/src
         mv $(pwd)/vendor/{github.com,golang.org,google.golang.org} $(pwd)/vendor/src/
-        ln -s $(pwd) vendor/src/github.com/containerd/containerd
-      '';
+      '') + oldAttrs.preBuild;
     });
     docker-tini = tini.overrideAttrs  (oldAttrs: rec {
       name = "docker-init";

pkgs/applications/virtualization/qemu/default.nix

@@ -18,7 +18,7 @@
 
 with stdenv.lib;
 let
-  version = "2.9.0";
+  version = "2.9.1";
   audio = optionalString (hasSuffix "linux" stdenv.system) "alsa,"
     + optionalString pulseSupport "pa,"
     + optionalString sdlSupport "sdl,";
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "http://wiki.qemu.org/download/qemu-${version}.tar.bz2";
-    sha256 = "053c7ivp3li7cdagzkp2wdc5myybzjf826r6qfkcf0xvn4bv5gq0";
+    sha256 = "1340hh4jvhvi97yqck408wi8aagnhzq1311ih0fq9bp4ddlk03sd";
   };
 
   buildInputs =

pkgs/applications/virtualization/virt-what/default.nix

@@ -0,0 +1,19 @@
+{ stdenv, lib, fetchurl }:
+
+stdenv.mkDerivation rec {
+  name = "virt-what-${version}";
+  version = "1.18";
+
+  src = fetchurl {
+    url = "https://people.redhat.com/~rjones/virt-what/files/${name}.tar.gz";
+    sha256 = "1x32h7i6lh823wj97r5rr2hg1v215kqzly14dwg0mwx62j1dshmw";
+  };
+
+  meta = with lib; {
+    description = "Detect if running in a virtual machine and prints its type";
+    homepage = "https://people.redhat.com/~rjones/virt-what/";
+    maintainers = with maintainers; [ fpletz ];
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+  };
+}