Merge branch 'origin/master' into staging.

Conflicts:
	pkgs/development/libraries/ffmpeg/2.x.nix
	pkgs/development/libraries/serf/default.nix

lib/licenses.nix

@@ -194,6 +194,8 @@ rec {
     fullName = "Lucent Public License v1.02";
   };
 
+  # spdx.org does not (yet) differentiate between the X11 and Expat versions
+  # for details see http://en.wikipedia.org/wiki/MIT_License#Various_versions
   mit = spdx {
     shortName = "MIT";
     fullName = "MIT License";

lib/maintainers.nix

@@ -34,6 +34,7 @@
   cfouche = "Chaddaï Fouché <chaddai.fouche@gmail.com>";
   chaoflow = "Florian Friesdorf <flo@chaoflow.net>";
   coconnor = "Corey O'Connor <coreyoconnor@gmail.com>";
+  copumpkin = "Dan Peebles <pumpkingod@gmail.com>";
   coroa = "Jonas Hörsch <jonas@chaoflow.net>";
   cstrahan = "Charles Strahan <charles.c.strahan@gmail.com>";
   DamienCassou = "Damien Cassou <damien.cassou@gmail.com>";
@@ -47,6 +48,7 @@
   flosse = "Markus Kohlhase <mail@markus-kohlhase.de>";
   funfunctor = "Edward O'Callaghan <eocallaghan@alterapraxis.com>";
   fuuzetsu = "Mateusz Kowalczyk <fuuzetsu@fuuzetsu.co.uk>";
+  gal_bolle = "Florent Becker <florent.becker@ens-lyon.org>";
   garbas = "Rok Garbas <rok@garbas.si>";
   goibhniu = "Cillian de Róiste <cillian.deroiste@gmail.com>";
   guibert = "David Guibert <david.guibert@gmail.com>";

lib/modules.nix

@@ -277,13 +277,14 @@ rec {
   fixupOptionType = loc: opt:
     let
       options' = opt.options or
-        (throw "Option `${showOption loc'}' has type optionSet but has no option attribute.");
+        (throw "Option `${showOption loc'}' has type optionSet but has no option attribute, in ${showFiles opt.declarations}.");
       coerce = x:
         if isFunction x then x
         else { config, ... }: { options = x; };
       options = map coerce (flatten options');
       f = tp:
-        if tp.name == "option set" then types.submodule options
+        if tp.name == "option set" || tp.name == "submodule" then
+          throw "The option ${showOption loc} uses submodules without a wrapping type, in ${showFiles opt.declarations}."
         else if tp.name == "attribute set of option sets" then types.attrsOf (types.submodule options)
         else if tp.name == "list or attribute set of option sets" then types.loaOf (types.submodule options)
         else if tp.name == "list of option sets" then types.listOf (types.submodule options)

nixos/doc/manual/configuration/ipv4-config.xml

@@ -12,12 +12,9 @@ interfaces.  However, you can configure an interface manually as
 follows:
 
 <programlisting>
-networking.interfaces.eth0 = { ipAddress = "192.168.1.2"; prefixLength = 24; };
+networking.interfaces.eth0.ip4 = [ { address = "192.168.1.2"; prefixLength = 24; } ];
 </programlisting>
 
-(The network prefix can also be specified using the option
-<literal>subnetMask</literal>,
-e.g. <literal>"255.255.255.0"</literal>, but this is deprecated.)
 Typically you’ll also want to set a default gateway and set of name
 servers:
 

nixos/lib/build-vms.nix

@@ -48,10 +48,11 @@ rec {
             let
               interfacesNumbered = zipTwoLists config.virtualisation.vlans (range 1 255);
               interfaces = flip map interfacesNumbered ({ first, second }:
-                nameValuePair "eth${toString second}"
-                  { ipAddress = "192.168.${toString first}.${toString m.second}";
-                    subnetMask = "255.255.255.0";
-                  });
+                nameValuePair "eth${toString second}" { ip4 =
+                  [ { address = "192.168.${toString first}.${toString m.second}";
+                      prefixLength = 24;
+                  } ];
+                });
             in
             { key = "ip-address";
               config =
@@ -60,7 +61,7 @@ rec {
                   networking.interfaces = listToAttrs interfaces;
 
                   networking.primaryIPAddress =
-                    optionalString (interfaces != []) (head interfaces).value.ipAddress;
+                    optionalString (interfaces != []) (head (head interfaces).value.ip4).address;
 
                   # Put the IP addresses of all VMs in this machine's
                   # /etc/hosts file.  If a machine has multiple

nixos/lib/make-system-tarball.nix

@@ -15,6 +15,9 @@
   # store path whose closure will be copied, and `symlink' is a
   # symlink to `object' that will be added to the tarball.
   storeContents ? []
+
+  # Extra tar arguments
+, extraArgs ? ""
 }:
 
 stdenv.mkDerivation {
@@ -22,7 +25,7 @@ stdenv.mkDerivation {
   builder = ./make-system-tarball.sh;
   buildInputs = [perl xz];
 
-  inherit fileName pathsFromGraph;
+  inherit fileName pathsFromGraph extraArgs;
 
   # !!! should use XML.
   sources = map (x: x.source) contents;

nixos/lib/make-system-tarball.sh

@@ -50,7 +50,7 @@ done
 
 mkdir -p $out/tarball
 
-tar cvJf $out/tarball/$fileName.tar.xz *
+tar cvJf $out/tarball/$fileName.tar.xz * $extraArgs
 
 mkdir -p $out/nix-support
 echo $system > $out/nix-support/system

nixos/maintainers/scripts/gce/create-gce.sh

@@ -1,5 +1,6 @@
 #! /bin/sh -e
 
+BUCKET_NAME=${BUCKET_NAME:-nixos}
 export NIX_PATH=nixpkgs=../../../..
 export NIXOS_CONFIG=$(dirname $(readlink -f $0))/../../../modules/virtualisation/google-compute-image.nix
 export TIMESTAMP=$(date +%Y%m%d%H%M)
@@ -8,7 +9,7 @@ nix-build '<nixpkgs/nixos>' \
    -A config.system.build.googleComputeImage --argstr system x86_64-linux -o gce --option extra-binary-caches http://hydra.nixos.org -j 10
 
 img=$(echo gce/*.tar.gz)
-if ! gsutil ls gs://nixos/$(basename $img); then
-  gsutil cp $img gs://nixos/$(basename $img)
+if ! gsutil ls gs://${BUCKET_NAME}/$(basename $img); then
+  gsutil cp $img gs://${BUCKET_NAME}/$(basename $img)
 fi
-gcutil addimage $(basename $img .raw.tar.gz | sed 's|\.|-|' | sed 's|_|-|') gs://nixos/$(basename $img)
+gcloud compute images create $(basename $img .raw.tar.gz | sed 's|\.|-|' | sed 's|_|-|') --source-uri gs://${BUCKET_NAME}/$(basename $img)

nixos/modules/config/vpnc.nix

@@ -0,0 +1,41 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.networking.vpnc;
+  mkServiceDef = name: value:
+    {
+      name = "vpnc/${name}.conf";
+      value = { text = value; };
+    };
+
+in
+{
+  options = {
+    networking.vpnc = {
+      services = mkOption {
+       type = types.attrsOf types.str;
+       default = {};
+       example = {
+         test = 
+          ''
+           IPSec gateway 192.168.1.1 
+           IPSec ID someID
+           IPSec secret secretKey
+           Xauth username name
+           Xauth password pass
+          '';
+       };
+       description = 
+         ''
+           The names of cisco VPNs and their associated definitions
+         '';
+      };
+    };
+  };
+
+  config.environment.etc = mapAttrs' mkServiceDef cfg.services;
+}
+
+

nixos/modules/installer/tools/nixos-generate-config.pl

@@ -20,13 +20,6 @@ sub uniq {
     return @res;
 }
 
-sub runCommand {
-    my ($cmd) = @_;
-    open FILE, "$cmd 2>/dev/null |" or die "Failed to execute: $cmd\n";
-    my @ret = <FILE>;
-    close FILE;
-    return ($?, @ret);
-}
 
 # Process the command line.
 my $outDir = "/etc/nixos";
@@ -344,20 +337,6 @@ EOF
         }
     }
 
-	# Is this a btrfs filesystem?
-	if ($fsType eq "btrfs") {
-		my ($status, @info) = runCommand("btrfs subvol show $rootDir$mountPoint");
-		if ($status != 0) {
-			die "Failed to retreive subvolume info for $mountPoint";
-		}
-		my @subvols = join("", @info) =~ m/Name:[ \t\n]*([^ \t\n]*)/;
-		if ($#subvols > 0) {
-			die "Btrfs subvol name for $mountPoint listed multiple times in mount\n"
-		} elsif ($#subvols == 0) {
-			push @extraOptions, "subvol=$subvols[0]";
-		}
-	}
-
     # Emit the filesystem.
     $fileSystems .= <<EOF;
   fileSystems.\"$mountPoint\" =

nixos/modules/installer/tools/tools.nix

@@ -38,7 +38,6 @@ let
   nixos-generate-config = makeProg {
     name = "nixos-generate-config";
     src = ./nixos-generate-config.pl;
-    path = [ pkgs.btrfsProgs ];
     perl = "${pkgs.perl}/bin/perl -I${pkgs.perlPackages.FileSlurp}/lib/perl5/site_perl";
   };
 

nixos/modules/installer/virtualbox-demo.nix

@@ -10,9 +10,6 @@ with lib;
       ../profiles/clone-config.nix
     ];
 
-  # FIXME: UUID detection is currently broken
-  boot.loader.grub.fsIdentifier = "provided";
-
   # Allow mounting of shared folders.
   users.extraUsers.demo.extraGroups = [ "vboxsf" ];
 

nixos/modules/misc/ids.nix

@@ -149,6 +149,7 @@
       radvd = 139;
       zookeeper = 140;
       dnsmasq = 141;
+      uhub = 142;
 
       # When adding a uid, make sure it doesn't match an existing gid. And don't use uids above 399!
 
@@ -268,6 +269,7 @@
       mlmmj = 135;
       riemann = 137;
       riemanndash = 138;
+      uhub = 142;
 
       # When adding a gid, make sure it doesn't match an existing uid. And don't use gids above 399!
 

nixos/modules/misc/meta.nix

@@ -0,0 +1,63 @@
+{ config, lib, ... }:
+
+with lib;
+
+let
+  maintainer = mkOptionType {
+    name = "maintainer";
+    check = email: elem email (attrValues lib.maintainers);
+    merge = loc: defs: listToAttrs (singleton (nameValuePair (last defs).file (last defs).value));
+  };
+
+  listOfMaintainers = types.listOf maintainer // {
+    # Returns list of
+    #   { "module-file" = [
+    #        "maintainer1 <first@nixos.org>"
+    #        "maintainer2 <second@nixos.org>" ];
+    #   }
+    merge = loc: defs:
+      zipAttrs
+        (flatten (imap (n: def: imap (m: def':
+          maintainer.merge (loc ++ ["[${toString n}-${toString m}]"])
+            [{ inherit (def) file; value = def'; }]) def.value) defs));
+  };
+
+  docFile = types.path // {
+    # Returns tuples of
+    #   { file = "module location"; value = <path/to/doc.xml>; }
+    merge = loc: defs: defs;
+  };
+in
+
+{
+  options = {
+    meta = {
+
+      maintainers = mkOption {
+        type = listOfMaintainers;
+        internal = true;
+        default = [];
+        example = [ lib.maintainers.all ];
+        description = ''
+	  List of maintainers of each module.  This option should be defined at
+          most once per module.
+        '';
+      };
+
+      doc = mkOption {
+        type = docFile;
+        internal = true;
+        example = "./meta.xml";
+        description = ''
+	  Documentation prologe for the set of options of each module.  This
+          option should be defined at most once per module.
+        '';
+      };
+
+    };
+  };
+
+  config = {
+    meta.maintainers = singleton lib.maintainers.pierron;
+  };
+}

nixos/modules/module-list.nix

@@ -21,6 +21,7 @@
   ./config/system-environment.nix
   ./config/system-path.nix
   ./config/timezone.nix
+  ./config/vpnc.nix
   ./config/unix-odbc-drivers.nix
   ./config/users-groups.nix
   ./config/zram.nix
@@ -45,6 +46,7 @@
   ./misc/ids.nix
   ./misc/lib.nix
   ./misc/locate.nix
+  ./misc/meta.nix
   ./misc/nixpkgs.nix
   ./misc/passthru.nix
   ./misc/version.nix
@@ -168,6 +170,7 @@
   ./services/misc/siproxd.nix
   ./services/misc/svnserve.nix
   ./services/misc/synergy.nix
+  ./services/misc/uhub.nix
   ./services/misc/zookeeper.nix
   ./services/monitoring/apcupsd.nix
   ./services/monitoring/dd-agent.nix
@@ -190,6 +193,7 @@
   ./services/network-filesystems/rsyncd.nix
   ./services/network-filesystems/samba.nix
   ./services/networking/amuled.nix
+  ./services/networking/atftpd.nix
   ./services/networking/avahi-daemon.nix
   ./services/networking/bind.nix
   ./services/networking/bitlbee.nix
@@ -227,6 +231,7 @@
   ./services/networking/ntpd.nix
   ./services/networking/oidentd.nix
   ./services/networking/openfire.nix
+  ./services/networking/openntpd.nix
   ./services/networking/openvpn.nix
   ./services/networking/polipo.nix
   ./services/networking/prayer.nix
@@ -360,6 +365,7 @@
   ./virtualisation/docker.nix
   ./virtualisation/libvirtd.nix
   #./virtualisation/nova.nix
+  ./virtualisation/openvswitch.nix
   ./virtualisation/virtualbox-guest.nix
   #./virtualisation/xen-dom0.nix
 ]

nixos/modules/programs/shadow.nix

@@ -83,7 +83,7 @@ in
     security.pam.services =
       { chsh = { rootOK = true; };
         chfn = { rootOK = true; };
-        su = { rootOK = true; forwardXAuth = true; };
+        su = { rootOK = true; forwardXAuth = true; logFailures = true; };
         passwd = {};
         # Note: useradd, groupadd etc. aren't setuid root, so it
         # doesn't really matter what the PAM config says as long as it

nixos/modules/programs/virtualbox.nix

@@ -44,5 +44,5 @@ let virtualbox = config.boot.kernelPackages.virtualbox; in
         '';
     };
 
-  networking.interfaces.vboxnet0 = { ipAddress = "192.168.56.1"; prefixLength = 24; };
+  networking.interfaces.vboxnet0.ip4 = [ { address = "192.168.56.1"; prefixLength = 24; } ];
 }

nixos/modules/security/pam.nix

@@ -126,12 +126,28 @@ let
         description = "Whether to show the message of the day.";
       };
 
+      makeHomeDir = mkOption {
+        default = false;
+        type = types.bool;
+        description = ''
+          Whether to try to create home directories for users
+          with <literal>$HOME</literal>s pointing to nonexistent
+          locations on session login.
+        '';
+      };
+
       updateWtmp = mkOption {
         default = false;
         type = types.bool;
         description = "Whether to update <filename>/var/log/wtmp</filename>.";
       };
 
+      logFailures = mkOption {
+        default = false;
+        type = types.bool;
+        description = "Whether to log authentication failures in <filename>/var/log/faillog</filename>.";
+      };
+
       text = mkOption {
         type = types.nullOr types.lines;
         description = "Contents of the PAM service file.";
@@ -159,6 +175,8 @@ let
           # Authentication management.
           ${optionalString cfg.rootOK
               "auth sufficient pam_rootok.so"}
+          ${optionalString cfg.logFailures
+              "auth required pam_tally.so"}
           ${optionalString (config.security.pam.enableSSHAgentAuth && cfg.sshAgentAuth)
               "auth sufficient ${pkgs.pam_ssh_agent_auth}/libexec/pam_ssh_agent_auth.so file=~/.ssh/authorized_keys:~/.ssh/authorized_keys2:/etc/ssh/authorized_keys.d/%u"}
           ${optionalString cfg.usbAuth
@@ -192,6 +210,8 @@ let
               "session ${
                 if config.boot.isContainer then "optional" else "required"
               } pam_loginuid.so"}
+          ${optionalString cfg.makeHomeDir
+              "session required ${pkgs.pam}/lib/security/pam_mkhomedir.so silent skel=/etc/skel umask=0022"}
           ${optionalString cfg.updateWtmp
               "session required ${pkgs.pam}/lib/security/pam_lastlog.so silent"}
           ${optionalString config.users.ldap.enable

nixos/modules/security/setuid-wrappers.nix

@@ -77,7 +77,9 @@ in
   config = {
 
     security.setuidPrograms =
-      [ "fusermount" "wodim" "cdrdao" "growisofs" ];
+      [ "mount.nfs" "mount.nfs4" "mount.cifs"
+        "fusermount" "umount"
+        "wodim" "cdrdao" "growisofs" ];
 
     system.activationScripts.setuid =
       let

nixos/modules/services/misc/uhub.nix

@@ -0,0 +1,186 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+
+  cfg = config.services.uhub;
+
+  uhubPkg = pkgs.uhub.override { tlsSupport = cfg.enableTLS; };
+
+  pluginConfig = ""
+  + optionalString cfg.plugins.authSqlite.enable ''
+    plugin ${uhubPkg.mod_auth_sqlite}/mod_auth_sqlite.so "file=${cfg.plugins.authSqlite.file}"
+  ''
+  + optionalString cfg.plugins.logging.enable ''
+    plugin ${uhubPkg.mod_logging}/mod_logging.so ${if cfg.plugins.logging.syslog then "syslog=true" else "file=${cfg.plugins.logging.file}"}
+  ''
+  + optionalString cfg.plugins.welcome.enable ''
+    plugin ${uhubPkg.mod_welcome}/mod_welcome.so "motd=${pkgs.writeText "motd.txt"  cfg.plugins.welcome.motd} rules=${pkgs.writeText "rules.txt" cfg.plugins.welcome.rules}"
+  ''
+  + optionalString cfg.plugins.history.enable ''
+    plugin ${uhubPkg.mod_chat_history}/mod_chat_history.so "history_max=${toString cfg.plugins.history.max} history_default=${toString cfg.plugins.history.default} history_connect=${toString cfg.plugins.history.connect}"
+  '';
+
+  uhubConfigFile = pkgs.writeText "uhub.conf" ''
+    file_acl=${pkgs.writeText "users.conf" cfg.aclConfig}
+    file_plugins=${pkgs.writeText "plugins.conf" pluginConfig}
+    server_bind_addr=${cfg.address}
+    server_port=${toString cfg.port}
+    ${lib.optionalString cfg.enableTLS "tls_enable=yes"}
+    ${cfg.hubConfig}
+  '';
+
+in
+
+{
+  options = {
+
+    services.uhub = {
+
+      enable = mkOption {
+        type = types.bool;
+        default = false;
+	description = "Whether to enable the uhub ADC hub.";
+      };
+
+      port = mkOption {
+        type = types.int;
+        default = 1511;
+	description = "TCP port to bind the hub to.";
+      };
+
+      address = mkOption {
+        type = types.string;
+        default = "any";
+	description = "Address to bind the hub to.";
+      };
+
+      enableTLS = mkOption {
+        type = types.bool;
+        default = false;
+	description = "Whether to enable TLS support.";
+      };
+
+      hubConfig = mkOption {
+        type = types.lines;
+        default = "";
+	description = "Contents of uhub configuration file.";
+      };
+
+      aclConfig = mkOption {
+        type = types.lines;
+        default = "";
+        description = "Contents of user ACL configuration file.";
+      };
+
+      plugins = {
+
+        authSqlite = {
+	  enable = mkOption {
+            type = types.bool;
+            default = false;
+            description = "Whether to enable the Sqlite authentication database plugin";
+	  };
+          file = mkOption {
+            type = types.string;
+            example = "/var/db/uhub-users";
+            description = "Path to user database. Use the uhub-passwd utility to create the database and add/remove users.";
+          };
+        };
+
+        logging = {
+          enable = mkOption {
+            type = types.bool;
+            default = false;
+            description = "Whether to enable the logging plugin.";
+          };
+          file = mkOption {
+            type = types.string;
+            default = "";
+            description = "Path of log file.";
+          };
+          syslog = mkOption {
+            type = types.bool;
+            default = false;
+            description = "If true then the system log is used instead of writing to file.";
+          };
+        };
+
+        welcome = {
+          enable = mkOption {
+            type = types.bool;
+            default = false;
+            description = "Whether to enable the welcome plugin.";
+          };
+          motd = mkOption {
+            default = "";
+            type = types.lines;
+            description = ''
+              Welcome message displayed to clients after connecting 
+              and with the <literal>!motd</literal> command.
+            '';
+          };
+          rules = mkOption {
+            default = "";
+            type = types.lines;
+            description = ''
+              Rules message, displayed to clients with the <literal>!rules</literal> command.
+            '';
+          };
+        };
+
+        history = {
+          enable = mkOption {
+            type = types.bool;
+            default = false;
+            description = "Whether to enable the history plugin.";
+          };
+          max = mkOption {
+            type = types.int;
+            default = 200;
+            description = "The maximum number of messages to keep in history";
+          };
+          default = mkOption {
+            type = types.int;
+            default = 10;
+            description = "When !history is provided without arguments, then this default number of messages are returned.";
+          };
+          connect = mkOption {
+            type = types.int;
+            default = 5;
+            description = "The number of chat history messages to send when users connect (0 = do not send any history).";
+          };
+        };
+
+      };
+    };
+
+  };
+
+  config = mkIf cfg.enable {
+
+    users = {
+      extraUsers = singleton {
+        name = "uhub";
+        uid = config.ids.uids.uhub;
+      };
+      extraGroups = singleton {
+        name = "uhub";
+        gid = config.ids.gids.uhub;
+      };
+    };
+
+    systemd.services.uhub = {
+      description = "high performance peer-to-peer hub for the ADC network";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        Type = "notify";
+        ExecStart  = "${uhubPkg}/bin/uhub -c ${uhubConfigFile} -u uhub -g uhub -L";
+        ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+      };
+    };
+  };
+
+}

nixos/modules/services/network-filesystems/nfsd.nix

@@ -56,6 +56,14 @@ in
           default = false;
           description = "Whether to create the mount points in the exports file at startup time.";
         };
+
+        mountdPort = mkOption {
+          default = null;
+          example = 4002;
+          description = ''
+            Use fixed port for rpc.mountd, usefull if server is behind firewall.
+          '';
+        };
       };
 
     };
@@ -138,7 +146,10 @@ in
         restartTriggers = [ exports ];
 
         serviceConfig.Type = "forking";
-        serviceConfig.ExecStart = "@${pkgs.nfsUtils}/sbin/rpc.mountd rpc.mountd";
+        serviceConfig.ExecStart = ''
+          @${pkgs.nfsUtils}/sbin/rpc.mountd rpc.mountd \
+              ${if cfg.mountdPort != null then "-p ${toString cfg.mountdPort}" else ""}
+        '';
         serviceConfig.Restart = "always";
       };
 

nixos/modules/services/networking/atftpd.nix

@@ -0,0 +1,51 @@
+# NixOS module for atftpd TFTP server
+
+{ config, pkgs, ... }:
+
+with pkgs.lib;
+
+let
+
+  cfg = config.services.atftpd;
+
+in
+
+{
+
+  options = {
+
+    services.atftpd = {
+
+      enable = mkOption {
+        default = false;
+        type = types.uniq types.bool;
+        description = ''
+          Whenever to enable the atftpd TFTP server.
+        '';
+      };
+
+      root = mkOption {
+        default = "/var/empty";
+        type = types.uniq types.string;
+        description = ''
+          Document root directory for the atftpd.
+        '';
+      };
+
+    };
+
+  };
+
+  config = mkIf cfg.enable {
+
+    systemd.services.atftpd = {
+      description = "atftpd TFTP server";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      # runs as nobody
+      serviceConfig.ExecStart = "${pkgs.atftp}/sbin/atftpd --daemon --no-fork --bind-address 0.0.0.0 ${cfg.root}";
+    };
+
+  };
+
+}

nixos/modules/services/networking/cjdns.nix

@@ -1,13 +1,3 @@
-# You may notice the commented out sections in this file,
-# it would be great to configure cjdns from nix, but cjdns 
-# reads its configuration from stdin, including the private
-# key and admin password, all nested in a JSON structure.
-#
-# Until a good method of storing the keys outside the nix 
-# store and mixing them back into a string is devised
-# (without too much shell hackery), a skeleton of the
-# configuration building lies commented out.
-
 { config, lib, pkgs, ... }:
 
 with lib;
@@ -16,41 +6,35 @@ let
 
   cfg = config.services.cjdns;
 
-  /*
-  # can't keep keys and passwords in the nix store,
-  # but don't want to deal with this stdin quagmire.
+  # would be nice to  merge 'cfg' with a //,
+  # but the json nesting is wacky.
+  cjdrouteConf = builtins.toJSON ( {
+    admin = {
+      bind = cfg.admin.bind;
+      password = "@CJDNS_ADMIN_PASSWORD@";
+    };
+    authorizedPasswords = map (p: { password = p; }) cfg.authorizedPasswords;
+    interfaces = {
+      ETHInterface = if (cfg.ETHInterface.bind != "") then [ cfg.ETHInterface ] else [ ];
+      UDPInterface = if (cfg.UDPInterface.bind != "") then [ cfg.UDPInterface ] else [ ];
+    };
 
-  cjdrouteConf = '' {
-    "admin": {"bind": "${cfg.admin.bind}", "password": "\${CJDNS_ADMIN}" },
-    "privateKey": "\${CJDNS_KEY}",
+    privateKey = "@CJDNS_PRIVATE_KEY@";
 
-    "interfaces": {
-    ''
+    resetAfterInactivitySeconds = 100;
 
-    + optionalString (cfg.interfaces.udp.bind.address != null) ''
-      "UDPInterface": [ {
-        "bind": "${cfg.interfaces.udp.bind.address}:"''
-	   ${if cfg.interfaces.upd.bind.port != null
-             then ${toString cfg.interfaces.udp.bind.port}
-	     else ${RANDOM}
-	   fi)
-      + '' } ]''
+    router = {
+      interface = { type = "TUNInterface"; };
+      ipTunnel = {
+        allowedConnections = [];
+        outgoingConnections = [];
+      };
+    };
 
-    + (if cfg.interfaces.eth.bind != null then ''
-      "ETHInterface": [ {
-        "bind": "${cfg.interfaces.eth.bind}",
-        "beacon": ${toString cfg.interfaces.eth.beacon}
-      } ]
-    '' fi )
-    + ''
-    },
-    "router": { "interface": { "type": "TUNInterface" }, },
-    "security": [ { "setuser": "nobody" } ]
-    }
-    '';   
+    security = [ { exemptAngel = 1; setuser = "nobody"; } ];
+
+  });
 
-    cjdrouteConfFile = pkgs.writeText "cjdroute.conf" cjdrouteConf
-    */
 in
 
 {
@@ -62,146 +46,180 @@ in
         type = types.bool;
 	default = false;
         description = ''
-          Enable this option to start a instance of the 
-          cjdns network encryption and and routing engine.
-          Configuration will be read from <literal>confFile</literal>.
+          Whether to enable the cjdns network encryption
+          and routing engine. A file at /etc/cjdns.keys will
+          be created if it does not exist to contain a random
+          secret key that your IPv6 address will be derived from.
         '';
       };
 
-      confFile = mkOption {
-	default = "/etc/cjdroute.conf";
-        description = ''
-          Configuration file to pipe to cjdroute.
+      authorizedPasswords = mkOption {
+        type = types.listOf types.str;
+	default = [ ];
+	example = [
+          "snyrfgkqsc98qh1y4s5hbu0j57xw5s0"
+	  "z9md3t4p45mfrjzdjurxn4wuj0d8swv"
+	  "49275fut6tmzu354pq70sr5b95qq0vj"
+        ];
+	description = ''
+	  Any remote cjdns nodes that offer these passwords on 
+	  connection will be allowed to route through this node.
         '';
       };
-
-      /*
+    
       admin = {
         bind = mkOption {
+          type = types.string;
 	  default = "127.0.0.1:11234";
 	  description = ''
             Bind the administration port to this address and port.
 	  '';
         };
+      };
 
-	passwordFile = mkOption {
-	  example = "/root/cjdns.adminPassword";
+      UDPInterface = {
+        bind = mkOption {
+          type = types.string;
+	  default = "";
+          example = "192.168.1.32:43211";
+          description = ''
+	    Address and port to bind UDP tunnels to.
+	  '';
+ 	};
+        connectTo = mkOption {
+          type = types.attrsOf ( types.submodule (
+	    { options, ... }:
+            { options = {
+                # TODO make host an option, and add it to networking.extraHosts
+                password = mkOption {
+                  type = types.str;
+                  description = "Authorized password to the opposite end of the tunnel.";
+                };
+                publicKey = mkOption {
+                  type = types.str;
+                  description = "Public key at the opposite end of the tunnel.";
+                };
+              };
+            }
+          ));
+	  default = { };
+          example = {
+            "192.168.1.1:27313" = {
+	      password = "5kG15EfpdcKNX3f2GSQ0H1HC7yIfxoCoImnO5FHM";
+              publicKey = "371zpkgs8ss387tmr81q04mp0hg1skb51hw34vk1cq644mjqhup0.k";
+            };
+          };
+          description = ''
+	    Credentials for making UDP tunnels.
+	  '';
+	};
+      };
+
+      ETHInterface = {
+        bind = mkOption {
+	  default = "";
+	  example = "eth0";
 	  description = ''
-	    File containing a password to the administration port.
+	    Bind to this device for native ethernet operation.
 	  '';
-	};
-      };
-
-      keyFile = mkOption {
-        type = types.str;
-	example = "/root/cjdns.key";
-	description = ''
-	  Path to a file containing a cjdns private key on a single line.
-	'';
-      };
-      
-      passwordsFile = mkOption {
-        type = types.str;
-	default = null;
-	example = "/root/cjdns.authorizedPasswords";
-	description = ''
-	  A file containing a list of json dictionaries with passwords.
-	  For example:
-	    {"password": "s8xf5z7znl4jt05g922n3wpk75wkypk"},
-	    { "name": "nice guy",
-	      "password": "xhthk1mglz8tpjrbbvdlhyc092rhpx5"},
-	    {"password": "3qfxyhmrht7uwzq29pmhbdm9w4bnc8w"}
-	  '';
-	};
-
-      interfaces = {
-        udp = {
-	  bind = { 
-            address = mkOption {
-	      default = "0.0.0.0";
-	      description = ''
-	        Address to bind UDP tunnels to; disable by setting to null;
-	      '';
- 	    };
-	    port = mkOption {
-	      type = types.int;
-	      default = null;
-	      description = ''
-	        Port to bind UDP tunnels to.
-	        A port will be choosen at random if this is not set.
-	        This option is required to act as the server end of 
-	        a tunnel.
-	      '';
- 	    };
-	  };
-	};
-
-	eth = {
-	  bind = mkOption {
-	    default = null;
-	    example = "eth0";
-	    description = ''
-	      Bind to this device and operate with native wire format.
-	    '';
-	  };
-
-	  beacon = mkOption {
-	    default = 2;
-	    description = ''
-	      Auto-connect to other cjdns nodes on the same network.
-	      Options:
-	        0 -- Disabled.
-
-                1 -- Accept beacons, this will cause cjdns to accept incoming
-		     beacon messages and try connecting to the sender.
-
-		2 -- Accept and send beacons, this will cause cjdns to broadcast
-		     messages on the local network which contain a randomly
-		     generated per-session password, other nodes which have this
-                     set to 1 or 2 will hear the beacon messages and connect
-                     automatically.
-            '';
-	  };
-	  
-	  connectTo = mkOption {
-	    type = types.listOf types.str;
-	    default = [];
-	    description = ''
-	      Credentials for connecting look similar to UDP credientials
-              except they begin with the mac address, for example:
-              "01:02:03:04:05:06":{"password":"a","publicKey":"b"}
-	    '';
-	  };
         };
+
+        beacon = mkOption {
+	  type = types.int;
+          default = 2;
+          description = ''
+            Auto-connect to other cjdns nodes on the same network.
+            Options:
+	      0: Disabled.
+              1: Accept beacons, this will cause cjdns to accept incoming
+                 beacon messages and try connecting to the sender.
+              2: Accept and send beacons, this will cause cjdns to broadcast
+                 messages on the local network which contain a randomly
+                 generated per-session password, other nodes which have this
+                 set to 1 or 2 will hear the beacon messages and connect
+                 automatically.
+          '';
+        };
+
+        connectTo = mkOption {
+          type = types.attrsOf ( types.submodule (
+	    { options, ... }:
+            { options = {
+                password = mkOption {
+                  type = types.str;
+                  description = "Authorized password to the opposite end of the tunnel.";
+                };
+                publicKey = mkOption {
+                  type = types.str;
+                  description = "Public key at the opposite end of the tunnel.";
+                };
+              };
+            }
+          ));
+	  default = { };
+          example = {
+            "01:02:03:04:05:06" = {
+	      password = "5kG15EfpdcKNX3f2GSQ0H1HC7yIfxoCoImnO5FHM";
+              publicKey = "371zpkgs8ss387tmr81q04mp0hg1skb51hw34vk1cq644mjqhup0.k";
+            };
+          };
+	  description = ''
+	    Credentials for connecting look similar to UDP credientials
+            except they begin with the mac address.
+	  '';
+	};
       };
-      */
+
     };
+
   };
 
   config = mkIf config.services.cjdns.enable {
 
     boot.kernelModules = [ "tun" ];
 
-    /*
-    networking.firewall.allowedUDPPorts = mkIf (cfg.udp.bind.port != null) [
-      cfg.udp.bind.port
-    ];
-    */
+    # networking.firewall.allowedUDPPorts = ...
 
     systemd.services.cjdns = {
       description = "encrypted networking for everybody";
       wantedBy = [ "multi-user.target" ];
-      wants = [ "network.target" ];
-      before = [ "network.target" ];
-      path = [ pkgs.cjdns ];
+      after = [ "network-interfaces.target" ];
+
+      script = ''
+        source /etc/cjdns.keys
+        echo '${cjdrouteConf}' | sed \
+	  -e "s/@CJDNS_ADMIN_PASSWORD@/$CJDNS_ADMIN_PASSWORD/g" \
+          -e "s/@CJDNS_PRIVATE_KEY@/$CJDNS_PRIVATE_KEY/g" \
+            | ${pkgs.cjdns}/sbin/cjdroute
+      '';
 
       serviceConfig = {
         Type = "forking";
-	ExecStart = ''
-          ${pkgs.stdenv.shell} -c "${pkgs.cjdns}/sbin/cjdroute < ${cfg.confFile}"
-	'';
 	Restart = "on-failure";
       };
     };
+
+    system.activationScripts.cjdns = ''
+      grep -q "CJDNS_PRIVATE_KEY=" /etc/cjdns.keys || \
+        echo "CJDNS_PRIVATE_KEY=$(${pkgs.cjdns}/sbin/makekey)" \
+	  >> /etc/cjdns.keys
+
+      grep -q "CJDNS_ADMIN_PASSWORD=" /etc/cjdns.keys || \
+        echo "CJDNS_ADMIN_PASSWORD=$(${pkgs.coreutils}/bin/head -c 96 /dev/urandom | ${pkgs.coreutils}/bin/tr -dc A-Za-z0-9)" \
+	  >> /etc/cjdns.keys
+
+      chmod 600 /etc/cjdns.keys
+    '';
+
+    assertions = [
+      { assertion = ( cfg.ETHInterface.bind != "" || cfg.UDPInterface.bind != "" );
+        message = "Neither cjdns.ETHInterface.bind nor cjdns.UDPInterface.bind defined.";
+      }
+      { assertion = config.networking.enableIPv6;
+        message = "networking.enableIPv6 must be enabled for CJDNS to work";
+      }
+    ];
+
   };
-}
+
+}

nixos/modules/services/networking/dhcpcd.nix

@@ -11,7 +11,7 @@ let
   # Don't start dhcpcd on explicitly configured interfaces or on
   # interfaces that are part of a bridge, bond or sit device.
   ignoredInterfaces =
-    map (i: i.name) (filter (i: i.ipAddress != null) (attrValues config.networking.interfaces))
+    map (i: i.name) (filter (i: i.ip4 != [ ] || i.ipAddress != null) (attrValues config.networking.interfaces))
     ++ mapAttrsToList (i: _: i) config.networking.sits
     ++ concatLists (attrValues (mapAttrs (n: v: v.interfaces) config.networking.bridges))
     ++ concatLists (attrValues (mapAttrs (n: v: v.interfaces) config.networking.bonds))
@@ -64,7 +64,7 @@ let
       #    ${config.systemd.package}/bin/systemctl start ip-down.target
       #fi
 
-      ${config.networking.dhcpcd.runHook}
+      ${cfg.runHook}
     '';
 
 in
@@ -75,6 +75,18 @@ in
 
   options = {
 
+    networking.dhcpcd.persistent = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+          Whenever to leave interfaces configured on dhcpcd daemon
+          shutdown. Set to true if you have your root or store mounted
+          over the network or this machine accepts SSH connections
+          through DHCP interfaces and clients should be notified when
+          it shuts down.
+      '';
+    };
+
     networking.dhcpcd.denyInterfaces = mkOption {
       type = types.listOf types.str;
       default = [];
@@ -139,7 +151,7 @@ in
         serviceConfig =
           { Type = "forking";
             PIDFile = "/run/dhcpcd.pid";
-            ExecStart = "@${dhcpcd}/sbin/dhcpcd dhcpcd --quiet --config ${dhcpcdConf}";
+            ExecStart = "@${dhcpcd}/sbin/dhcpcd dhcpcd --quiet ${optionalString cfg.persistent "--persistent"} --config ${dhcpcdConf}";
             ExecReload = "${dhcpcd}/sbin/dhcpcd --rebind";
             Restart = "always";
           };

nixos/modules/services/networking/nsd.nix

@@ -456,156 +456,131 @@ in
       };
 
 
-      ratelimit = mkOption {
-        type = types.submodule (
-          { options, ... }:
-          { options = {
-
-              enable = mkOption {
-                type        = types.bool;
-                default     = false;
-                description = ''
-                  Enable ratelimit capabilities.
-                '';
-              };
-
-              size = mkOption {
-                type        = types.int;
-                default     = 1000000;
-                description = ''
-                  Size of the hashtable. More buckets use more memory but lower
-                  the chance of hash hash collisions.
-                '';
-              };
-
-              ratelimit = mkOption {
-                type        = types.int;
-                default     = 200;
-                description = ''
-                  Max qps allowed from any query source.
-                  0 means unlimited. With an verbosity of 2 blocked and
-                  unblocked subnets will be logged.
-                '';
-              };
-
-              whitelistRatelimit = mkOption {
-                type        = types.int;
-                default     = 2000;
-                description = ''
-                  Max qps allowed from whitelisted sources.
-                  0 means unlimited. Set the rrl-whitelist option for specific
-                  queries to apply this limit instead of the default to them.
-                '';
-              };
-
-              slip = mkOption {
-                type        = types.nullOr types.int;
-                default     = null;
-                description = ''
-                  Number of packets that get discarded before replying a SLIP response.
-                  0 disables SLIP responses. 1 will make every response a SLIP response.
-                '';
-              };
-
-              ipv4PrefixLength = mkOption {
-                type        = types.nullOr types.int;
-                default     = null;
-                description = ''
-                  IPv4 prefix length. Addresses are grouped by netblock.
-                '';
-              };
-
-              ipv6PrefixLength = mkOption {
-                type        = types.nullOr types.int;
-                default     = null;
-                description = ''
-                  IPv6 prefix length. Addresses are grouped by netblock.
-                '';
-              };
-
-            };
-          });
-        default = {
+      ratelimit = {
+        enable = mkOption {
+          type        = types.bool;
+          default     = false;
+          description = ''
+            Enable ratelimit capabilities.
+          '';
+        };
+
+        size = mkOption {
+          type        = types.int;
+          default     = 1000000;
+          description = ''
+            Size of the hashtable. More buckets use more memory but lower
+            the chance of hash hash collisions.
+          '';
+        };
+
+        ratelimit = mkOption {
+          type        = types.int;
+          default     = 200;
+          description = ''
+            Max qps allowed from any query source.
+            0 means unlimited. With an verbosity of 2 blocked and
+            unblocked subnets will be logged.
+          '';
+        };
+
+        whitelistRatelimit = mkOption {
+          type        = types.int;
+          default     = 2000;
+          description = ''
+            Max qps allowed from whitelisted sources.
+            0 means unlimited. Set the rrl-whitelist option for specific
+            queries to apply this limit instead of the default to them.
+          '';
+        };
+
+        slip = mkOption {
+          type        = types.nullOr types.int;
+          default     = null;
+          description = ''
+            Number of packets that get discarded before replying a SLIP response.
+            0 disables SLIP responses. 1 will make every response a SLIP response.
+          '';
+        };
+
+        ipv4PrefixLength = mkOption {
+          type        = types.nullOr types.int;
+          default     = null;
+          description = ''
+            IPv4 prefix length. Addresses are grouped by netblock.
+          '';
+        };
+
+        ipv6PrefixLength = mkOption {
+          type        = types.nullOr types.int;
+          default     = null;
+          description = ''
+            IPv6 prefix length. Addresses are grouped by netblock.
+          '';
         };
-        example = {};
-        description = ''
-        '';
       };
 
 
-      remoteControl = mkOption {
-        type = types.submodule (
-          { config, options, ... }:
-          { options = {
-
-              enable = mkOption {
-                type        = types.bool;
-                default     = false;
-                description = ''
-                  Wheter to enable remote control via nsd-control(8).
-                '';
-              };
-
-              interfaces = mkOption {
-                type        = types.listOf types.str;
-                default     = [ "127.0.0.1" "::1" ];
-                description = ''
-                  Which interfaces NSD should bind to for remote control.
-                '';
-              };
-
-              port = mkOption {
-                type        = types.int;
-                default     = 8952;
-                description = ''
-                  Port number for remote control operations (uses TLS over TCP).
-                '';
-              };
-
-              serverKeyFile = mkOption {
-                type        = types.path;
-                default     = "/etc/nsd/nsd_server.key";
-                description = ''
-                  Path to the server private key, which is used by the server
-                  but not by nsd-control. This file is generated by nsd-control-setup.
-                '';
-              };
-
-              serverCertFile = mkOption {
-                type        = types.path;
-                default     = "/etc/nsd/nsd_server.pem";
-                description = ''
-                  Path to the server self signed certificate, which is used by the server
-                  but and by nsd-control. This file is generated by nsd-control-setup.
-                '';
-              };
-
-              controlKeyFile = mkOption {
-                type        = types.path;
-                default     = "/etc/nsd/nsd_control.key";
-                description = ''
-                  Path to the client private key, which is used by nsd-control
-                  but not by the server. This file is generated by nsd-control-setup.
-                '';
-              };
-
-              controlCertFile = mkOption {
-                type        = types.path;
-                default     = "/etc/nsd/nsd_control.pem";
-                description = ''
-                  Path to the client certificate signed with the server certificate.
-                  This file is used by nsd-control and generated by nsd-control-setup.
-                '';
-              };
-
-            };
-
-          });
-        default = {
+      remoteControl = {
+        enable = mkOption {
+          type        = types.bool;
+          default     = false;
+          description = ''
+            Wheter to enable remote control via nsd-control(8).
+          '';
+        };
+
+        interfaces = mkOption {
+          type        = types.listOf types.str;
+          default     = [ "127.0.0.1" "::1" ];
+          description = ''
+            Which interfaces NSD should bind to for remote control.
+          '';
+        };
+
+        port = mkOption {
+          type        = types.int;
+          default     = 8952;
+          description = ''
+            Port number for remote control operations (uses TLS over TCP).
+          '';
+        };
+
+        serverKeyFile = mkOption {
+          type        = types.path;
+          default     = "/etc/nsd/nsd_server.key";
+          description = ''
+            Path to the server private key, which is used by the server
+            but not by nsd-control. This file is generated by nsd-control-setup.
+          '';
+        };
+
+        serverCertFile = mkOption {
+          type        = types.path;
+          default     = "/etc/nsd/nsd_server.pem";
+          description = ''
+            Path to the server self signed certificate, which is used by the server
+            but and by nsd-control. This file is generated by nsd-control-setup.
+          '';
+        };
+
+        controlKeyFile = mkOption {
+          type        = types.path;
+          default     = "/etc/nsd/nsd_control.key";
+          description = ''
+            Path to the client private key, which is used by nsd-control
+            but not by the server. This file is generated by nsd-control-setup.
+          '';
+        };
+
+        controlCertFile = mkOption {
+          type        = types.path;
+          default     = "/etc/nsd/nsd_control.pem";
+          description = ''
+            Path to the client certificate signed with the server certificate.
+            This file is used by nsd-control and generated by nsd-control-setup.
+          '';
         };
-        example = {};
-        description = ''
-        '';
       };
 
 

nixos/modules/services/networking/openntpd.nix

@@ -0,0 +1,49 @@
+{ pkgs, lib, config, options, ... }:
+
+with lib;
+
+let
+  cfg = config.services.openntpd;
+
+  package = pkgs.openntpd.override {
+    privsepUser = "ntp";
+    privsepPath = "/var/empty";
+  };
+
+  cfgFile = pkgs.writeText "openntpd.conf" ''
+    ${concatStringsSep "\n" (map (s: "server ${s}") cfg.servers)}
+  '';
+in
+{
+  ###### interface
+
+  options.services.openntpd = {
+    enable = mkEnableOption "OpenNTP time synchronization server";
+
+    servers = mkOption {
+      default = config.services.ntp.servers;
+      type = types.listOf types.str;
+      inherit (options.services.ntp.servers) description;
+    };
+  };
+
+  ###### implementation
+
+  config = mkIf cfg.enable {
+    services.ntp.enable = mkForce false;
+
+    users.extraUsers = singleton {
+      name = "ntp";
+      uid = config.ids.uids.ntp;
+      description = "OpenNTP daemon user";
+      home = "/var/empty";
+    };
+
+    systemd.services.openntpd = {
+      description = "OpenNTP Server";
+      wantedBy = [ "ip-up.target" ];
+      partOf = [ "ip-up.target" ];
+      serviceConfig.ExecStart = "${package}/sbin/ntpd -d -f ${cfgFile}";
+    };
+  };
+}

nixos/modules/services/networking/privoxy.nix

@@ -6,19 +6,18 @@ let
 
   inherit (pkgs) privoxy;
 
-  stateDir = "/var/spool/privoxy";
-
   privoxyUser = "privoxy";
 
-  privoxyFlags = "--no-daemon --user ${privoxyUser} ${privoxyCfg}";
+  cfg = config.services.privoxy;
 
-  privoxyCfg = pkgs.writeText "privoxy.conf" ''
-    listen-address  ${config.services.privoxy.listenAddress}
-    logdir          ${config.services.privoxy.logDir}
-    confdir         ${privoxy}/etc
-    filterfile      default.filter
-
-    ${config.services.privoxy.extraConfig}
+  confFile = pkgs.writeText "privoxy.conf" ''
+    user-manual ${privoxy}/share/doc/privoxy/user-manual
+    confdir ${privoxy}/etc/
+    listen-address  ${cfg.listenAddress}
+    enable-edit-actions ${if (cfg.enableEditActions == true) then "1" else "0"}
+    ${concatMapStrings (f: "actionsfile ${f}\n") cfg.actionsFiles}
+    ${concatMapStrings (f: "filterfile ${f}\n") cfg.filterFiles}
+    ${cfg.extraConfig}
   '';
 
 in
@@ -32,27 +31,51 @@ in
     services.privoxy = {
 
       enable = mkOption {
+        type = types.bool;
         default = false;
         description = ''
-          Whether to run the machine as a HTTP proxy server.
+          Whether to enable the Privoxy non-caching filtering proxy.
         '';
       };
 
       listenAddress = mkOption {
+        type = types.str;
         default = "127.0.0.1:8118";
         description = ''
           Address the proxy server is listening to.
         '';
       };
 
-      logDir = mkOption {
-        default = "/var/log/privoxy" ;
+      actionsFiles = mkOption {
+        type = types.listOf types.str;
+        example = [ "match-all.action" "default.action" "/etc/privoxy/user.action" ];
+        default = [ "match-all.action" "default.action" ];
         description = ''
-          Location for privoxy log files.
+          List of paths to Privoxy action files.
+          These paths may either be absolute or relative to the privoxy configuration directory.
+        '';
+      };
+
+      filterFiles = mkOption {
+        type = types.listOf types.str;
+        example = [ "default.filter" "/etc/privoxy/user.filter" ];
+        default = [ "default.filter" ];
+        description = ''
+          List of paths to Privoxy filter files.
+          These paths may either be absolute or relative to the privoxy configuration directory.
+        '';
+      };
+
+      enableEditActions = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether or not the web-based actions file editor may be used.
         '';
       };
 
       extraConfig = mkOption {
+        type = types.lines;
         default = "" ;
         description = ''
           Extra configuration. Contents will be added verbatim to the configuration file.
@@ -62,33 +85,22 @@ in
 
   };
 
-
   ###### implementation
 
-  config = mkIf config.services.privoxy.enable {
+  config = mkIf cfg.enable {
   
-    environment.systemPackages = [ privoxy ];
-
     users.extraUsers = singleton
       { name = privoxyUser;
         uid = config.ids.uids.privoxy;
         description = "Privoxy daemon user";
-        home = stateDir;
       };
 
-    jobs.privoxy =
-      { name = "privoxy";
-
-        startOn = "startup";
-
-        preStart =
-          ''
-            mkdir -m 0755 -p ${stateDir}
-            chown ${privoxyUser} ${stateDir}
-          '';
-
-        exec = "${privoxy}/sbin/privoxy ${privoxyFlags}";
-      };
+    systemd.services.privoxy = {
+      description = "Filtering web proxy";
+      after = [ "network.target" "nss-lookup.target" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig.ExecStart = "${privoxy}/sbin/privoxy --no-daemon --user ${privoxyUser} ${confFile}";
+    };
 
   };
 

nixos/modules/services/networking/ssh/sshd.nix

@@ -144,6 +144,36 @@ in
         '';
       };
 
+      listenAddresses = mkOption {
+        type = types.listOf types.optionSet;
+        default = [];
+        example = [ { addr = "192.168.3.1"; port = 22; } { addr = "0.0.0.0"; port = 64022; } ];
+        description = ''
+          List of addresses and ports to listen on (ListenAddress directive
+          in config). If port is not specified for address sshd will listen
+          on all ports specified by <literal>ports</literal> option.
+          NOTE: this will override default listening on all local addresses and port 22.
+          NOTE: setting this option won't automatically enable given ports
+          in firewall configuration.
+        '';
+        options = {
+          addr = mkOption {
+            type = types.nullOr types.str;
+            default = null;
+            description = ''
+              Host, IPv4 or IPv6 address to listen to.
+            '';
+          };
+          port = mkOption {
+            type = types.nullOr types.int;
+            default = null;
+            description = ''
+              Port to listen to.
+            '';
+          };
+        };
+      };
+
       passwordAuthentication = mkOption {
         type = types.bool;
         default = true;
@@ -349,6 +379,10 @@ in
           Port ${toString port}
         '') cfg.ports}
 
+        ${concatMapStrings ({ port, addr }: ''
+          ListenAddress ${addr}${if port != null then ":" + toString port else ""}
+        '') cfg.listenAddresses}
+
         ${optionalString cfgc.setXAuthLocation ''
             XAuthLocation ${pkgs.xorg.xauth}/bin/xauth
         ''}
@@ -383,6 +417,10 @@ in
         assertion = (data.publicKey == null && data.publicKeyFile != null) ||
                     (data.publicKey != null && data.publicKeyFile == null);
         message = "knownHost ${name} must contain either a publicKey or publicKeyFile";
+      })
+      ++ flip map cfg.listenAddresses ({ addr, port }: {
+        assertion = addr != null;
+        message = "addr must be specified in each listenAddresses entry";
       });
 
   };

nixos/modules/services/networking/znc.nix

@@ -25,85 +25,6 @@ let
     paths = cfg.modulePackages;
   };
 
-  confOptions = { ... }: {
-    options = {
-      modules = mkOption {
-        type = types.listOf types.string;
-        default = [ "partyline" "webadmin" "adminlog" "log" ];
-        example = [ "partyline" "webadmin" "adminlog" "log" ];
-        description = ''
-          A list of modules to include in the `znc.conf` file.
-        '';
-      };
-
-      userModules = mkOption {
-        type = types.listOf types.string;
-        default = [ ];
-        example = [ "fish" "push" ];
-        description = ''
-          A list of user modules to include in the `znc.conf` file.
-        '';
-      };
-
-      userName = mkOption {
-        default = defaultUserName;
-        example = "johntron";
-        type = types.string;
-        description = ''
-          The user name to use when generating the `znc.conf` file.
-          This is the user name used by the user logging into the ZNC web admin. 
-        '';
-      };
-
-      nick = mkOption {
-        default = "znc-user";
-        example = "john";
-        type = types.string;
-        description = ''
-          The IRC nick to use when generating the `znc.conf` file.
-        '';
-      };
-
-      passBlock = mkOption {
-        default = defaultPassBlock;
-        example = "Must be the block generated by the `znc --makepass` command.";
-        type = types.string;
-        description = ''
-          The pass block to use when generating the `znc.conf` file.
-          This is the password used by the user logging into the ZNC web admin.
-          This is the block generated by the `znc --makepass` command.
-          !!! If not specified, please change this after starting the service. !!!
-        '';
-      };
-
-      port = mkOption {
-        default = 5000;
-        example = 5000;
-        type = types.int;
-        description = ''
-          Specifies the port on which to listen.
-        '';
-      };
- 
-      useSSL = mkOption {
-        default = true;
-        example = true;
-        type = types.bool;
-        description = ''
-          Indicates whether the ZNC server should use SSL when listening on the specified port.
-        '';
-      };
-
-      extraZncConf = mkOption {
-        default = "";
-        type = types.lines;
-        description = ''
-          Extra config to `znc.conf` file
-        '';
-      };
-    };
-  };
-
   # Keep znc.conf in nix store, then symlink or copy into `dataDir`, depending on `mutable`.
   mkZncConf = confOpts: ''
     // Also check http://en.znc.in/wiki/Configuration
@@ -211,18 +132,91 @@ in
         '';
       };
 
-      confOptions = mkOption {
-        default = {};
-        example = {
-          modules = [ "log" ];
-          userName = "john";
-          nick = "johntron";
+      /* TODO: add to the documentation of the current module:
+
+         Values to use when creating a `znc.conf` file.
+
+           confOptions = {
+             modules = [ "log" ];
+             userName = "john";
+             nick = "johntron";
+           };
+      */
+      confOptions = {
+        modules = mkOption {
+          type = types.listOf types.string;
+          default = [ "partyline" "webadmin" "adminlog" "log" ];
+          example = [ "partyline" "webadmin" "adminlog" "log" ];
+          description = ''
+            A list of modules to include in the `znc.conf` file.
+          '';
+        };
+
+        userModules = mkOption {
+          type = types.listOf types.string;
+          default = [ ];
+          example = [ "fish" "push" ];
+          description = ''
+            A list of user modules to include in the `znc.conf` file.
+          '';
+        };
+
+        userName = mkOption {
+          default = defaultUserName;
+          example = "johntron";
+          type = types.string;
+          description = ''
+            The user name to use when generating the `znc.conf` file.
+            This is the user name used by the user logging into the ZNC web admin.
+          '';
+        };
+
+        nick = mkOption {
+          default = "znc-user";
+          example = "john";
+          type = types.string;
+          description = ''
+            The IRC nick to use when generating the `znc.conf` file.
+          '';
+        };
+
+        passBlock = mkOption {
+          default = defaultPassBlock;
+          example = "Must be the block generated by the `znc --makepass` command.";
+          type = types.string;
+          description = ''
+            The pass block to use when generating the `znc.conf` file.
+            This is the password used by the user logging into the ZNC web admin.
+            This is the block generated by the `znc --makepass` command.
+            !!! If not specified, please change this after starting the service. !!!
+          '';
+        };
+
+        port = mkOption {
+          default = 5000;
+          example = 5000;
+          type = types.int;
+          description = ''
+            Specifies the port on which to listen.
+          '';
+        };
+
+        useSSL = mkOption {
+          default = true;
+          example = true;
+          type = types.bool;
+          description = ''
+            Indicates whether the ZNC server should use SSL when listening on the specified port.
+          '';
+        };
+
+        extraZncConf = mkOption {
+          default = "";
+          type = types.lines;
+          description = ''
+            Extra config to `znc.conf` file
+          '';
         };
-        type = types.optionSet;
-        description = ''
-          Values to use when creating a `znc.conf` file.
-        '';
-        options = confOptions; 
       };
 
       modulePackages = mkOption {
@@ -280,20 +274,16 @@ in
 
         # If mutable, regenerate conf file every time.
         ${optionalString (!cfg.mutable) ''
-          ${pkgs.coreutils}/echo "znc is set to be system-managed. Now deleting old znc.conf file to be regenerated."
-          ${pkgs.coreutils}/rm -f ${cfg.dataDir}/configs/znc.conf
+          ${pkgs.coreutils}/bin/echo "znc is set to be system-managed. Now deleting old znc.conf file to be regenerated."
+          ${pkgs.coreutils}/bin/rm -f ${cfg.dataDir}/configs/znc.conf
         ''}
 
         # Ensure essential files exist.
         if [[ ! -f ${cfg.dataDir}/configs/znc.conf ]]; then
-          ${pkgs.coreutils}/bin/echo "No znc.conf file found in ${cfg.dataDir}. Creating one now."
-          ${if (!cfg.mutable)
-            then "${pkgs.coreutils}/bin/ln --force -s ${zncConfFile} ${cfg.dataDir}/.znc/configs/znc.conf"
-            else ''
-              ${pkgs.coreutils}/bin/cp --no-clobber ${zncConfFile} ${cfg.dataDir}/configs/znc.conf
-              ${pkgs.coreutils}/bin/chmod u+rw ${cfg.dataDir}/configs/znc.conf
-              ${pkgs.coreutils}/bin/chown ${cfg.user} ${cfg.dataDir}/configs/znc.conf
-            ''}
+            ${pkgs.coreutils}/bin/echo "No znc.conf file found in ${cfg.dataDir}. Creating one now."
+            ${pkgs.coreutils}/bin/cp --no-clobber ${zncConfFile} ${cfg.dataDir}/configs/znc.conf
+            ${pkgs.coreutils}/bin/chmod u+rw ${cfg.dataDir}/configs/znc.conf
+            ${pkgs.coreutils}/bin/chown ${cfg.user} ${cfg.dataDir}/configs/znc.conf
         fi
 
         if [[ ! -f ${cfg.dataDir}/znc.pem ]]; then

nixos/modules/services/security/clamav.nix

@@ -71,10 +71,10 @@ in
             mkdir -m 0755 -p ${stateDir}
             chown ${clamavUser}:${clamavGroup} ${stateDir}
           '';
-          exec = "${pkgs.clamav}/bin/freshclam --config-file=${pkgs.writeText "freshclam.conf" cfg.updater.config}";
+          exec = "${pkgs.clamav}/bin/freshclam --daemon --config-file=${pkgs.writeText "freshclam.conf" cfg.updater.config}";
       }; 
     };
 
   };
 
-}
+}

nixos/modules/services/ttys/agetty.nix

@@ -66,6 +66,13 @@ with lib;
         restartIfChanged = false;
       };
 
+    systemd.services."console-getty" =
+      { serviceConfig.ExecStart = "@${pkgs.utillinux}/sbin/agetty agetty --noclear --login-program ${pkgs.shadow}/bin/login --keep-baud console 115200,38400,9600 $TERM";
+        serviceConfig.Restart = "always";
+        restartIfChanged = false;
+	enable = mkDefault config.boot.isContainer;
+      };
+
     environment.etc = singleton
       { # Friendly greeting on the virtual consoles.
         source = pkgs.writeText "issue" ''

nixos/modules/services/web-servers/apache-httpd/mediawiki.nix

@@ -133,7 +133,7 @@ in
         RewriteEngine On
         RewriteCond %{DOCUMENT_ROOT}%{REQUEST_URI} !-f
         RewriteCond %{DOCUMENT_ROOT}%{REQUEST_URI} !-d
-        ${concatMapStringsSep "\n" (u: "RewriteCond %{REQUEST_URI} !^${u.urlPath}") serverInfo.serverConfig.servedDirs}
+        ${concatMapStringsSep "\n" (u: "RewriteCond %{REQUEST_URI} !^${u.urlPath}") serverInfo.vhostConfig.servedDirs}
         RewriteRule ${if config.enableUploads
           then "!^/images"
           else "^.*\$"

nixos/modules/services/web-servers/tomcat.nix

@@ -5,7 +5,7 @@ with lib;
 let
 
   cfg = config.services.tomcat;
-  tomcat = pkgs.tomcat6;
+  tomcat = pkgs.tomcat7;
 in
 
 {

nixos/modules/services/x11/display-managers/slim.nix

@@ -19,6 +19,7 @@ let
       reboot_cmd ${config.systemd.package}/sbin/shutdown -r now
       ${optionalString (cfg.defaultUser != null) ("default_user " + cfg.defaultUser)}
       ${optionalString cfg.autoLogin "auto_login yes"}
+      ${cfg.extraConfig}
     '';
 
   # Unpack the SLiM theme, or use the default.
@@ -89,6 +90,15 @@ in
         '';
       };
 
+      extraConfig = mkOption {
+        type = types.lines;
+        default = "";
+        description = ''
+          Extra configuration options for SLiM login manager. Do not
+          add options that can be configured directly.
+        '';
+      };
+
     };
 
   };

nixos/modules/system/boot/loader/grub/grub.nix

@@ -6,8 +6,7 @@ let
 
   cfg = config.boot.loader.grub;
 
-  realGrub = if cfg.version == 1 then pkgs.grub
-    else pkgs.grub2.override { zfsSupport = cfg.zfsSupport; };
+  realGrub = if cfg.version == 1 then pkgs.grub else pkgs.grub2;
 
   grub =
     # Don't include GRUB if we're only generating a GRUB menu (e.g.,
@@ -26,12 +25,11 @@ let
       inherit (cfg)
         version extraConfig extraPerEntryConfig extraEntries
         extraEntriesBeforeNixOS extraPrepareConfig configurationLimit copyKernels timeout
-        default devices fsIdentifier;
+        default devices explicitBootRoot;
       path = (makeSearchPath "bin" [
-        pkgs.coreutils pkgs.gnused pkgs.gnugrep pkgs.findutils pkgs.diffutils pkgs.btrfsProgs
-        pkgs.utillinux
+        pkgs.coreutils pkgs.gnused pkgs.gnugrep pkgs.findutils pkgs.diffutils
       ]) + ":" + (makeSearchPath "sbin" [
-        pkgs.mdadm pkgs.utillinux
+        pkgs.mdadm
       ]);
     });
 
@@ -211,26 +209,12 @@ in
         '';
       };
 
-      fsIdentifier = mkOption {
-        default = "uuid";
-        type = types.addCheck types.str
-          (type: type == "uuid" || type == "label" || type == "provided");
+      explicitBootRoot = mkOption {
+        default = "";
+        type = types.str;
         description = ''
-          Determines how grub will identify devices when generating the
-          configuration file. A value of uuid / label signifies that grub
-          will always resolve the uuid or label of the device before using
-          it in the configuration. A value of provided means that grub will
-          use the device name as show in <command>df</command> or
-          <command>mount</command>. Note, zfs zpools / datasets are ignored
-          and will always be mounted using their labels.
-        '';
-      };
-
-      zfsSupport = mkOption {
-        default = false;
-        type = types.bool;
-        description = ''
-          Whether grub should be build against libzfs.
+          The relative path of /boot within the parent volume. Leave empty
+          if /boot is not a btrfs subvolume.
         '';
       };
 
@@ -276,9 +260,6 @@ in
           ${pkgs.coreutils}/bin/cp -pf "${v}" "/boot/${n}"
         '') config.boot.loader.grub.extraFiles);
 
-    assertions = [{ assertion = !cfg.zfsSupport || cfg.version == 2;
-                    message = "Only grub version 2 provides zfs support";}];
-
     })
 
   ];

nixos/modules/system/boot/loader/grub/install-grub.pl

@@ -1,6 +1,5 @@
 use strict;
 use warnings;
-use Class::Struct;
 use XML::LibXML;
 use File::Basename;
 use File::Path;
@@ -28,14 +27,6 @@ sub writeFile {
     close FILE or die;
 }
 
-sub runCommand {
-    my ($cmd) = @_;
-    open FILE, "$cmd 2>/dev/null |" or die "Failed to execute: $cmd\n";
-    my @ret = <FILE>;
-    close FILE;
-    return ($?, @ret);
-}
-
 my $grub = get("grub");
 my $grubVersion = int(get("version"));
 my $extraConfig = get("extraConfig");
@@ -48,7 +39,7 @@ my $configurationLimit = int(get("configurationLimit"));
 my $copyKernels = get("copyKernels") eq "true";
 my $timeout = int(get("timeout"));
 my $defaultEntry = int(get("default"));
-my $fsIdentifier = get("fsIdentifier");
+my $explicitBootRoot = get("explicitBootRoot");
 $ENV{'PATH'} = get("path");
 
 die "unsupported GRUB version\n" if $grubVersion != 1 && $grubVersion != 2;
@@ -57,108 +48,22 @@ print STDERR "updating GRUB $grubVersion menu...\n";
 
 mkpath("/boot/grub", 0, 0700);
 
+
 # Discover whether /boot is on the same filesystem as / and
 # /nix/store.  If not, then all kernels and initrds must be copied to
-# /boot.
-if (stat("/boot")->dev != stat("/nix/store")->dev) {
+# /boot, and all paths in the GRUB config file must be relative to the
+# root of the /boot filesystem.  `$bootRoot' is the path to be
+# prepended to paths under /boot.
+my $bootRoot = "/boot";
+if (stat("/")->dev != stat("/boot")->dev) {
+    $bootRoot = "";
+    $copyKernels = 1;
+} elsif (stat("/boot")->dev != stat("/nix/store")->dev) {
     $copyKernels = 1;
 }
 
-# Discover information about the location of /boot
-struct(Fs => {
-    device => '$',
-    type => '$',
-    mount => '$',
-});
-sub GetFs {
-    my ($dir) = @_;
-    my ($status, @dfOut) = runCommand("df -T $dir");
-    if ($status != 0 || $#dfOut != 1) {
-        die "Failed to retrieve output about $dir from `df`";
-    }
-    my @boot = split(/[ \n\t]+/, $dfOut[1]);
-    return Fs->new(device => $boot[0], type => $boot[1], mount => $boot[6]);
-}
-struct (Grub => {
-    path => '$',
-    search => '$',
-});
-my $driveid = 1;
-sub GrubFs {
-    my ($dir) = @_;
-    my $fs = GetFs($dir);
-    my $path = "/" . substr($dir, length($fs->mount));
-    my $search = "";
-
-    if ($grubVersion > 1) {
-        # ZFS is completely separate logic as zpools are always identified by a label
-        # or custom UUID
-        if ($fs->type eq 'zfs') {
-            my $sid = index($fs->device, '/');
-
-            if ($sid < 0) {
-                $search = '--label ' . $fs->device;
-                $path = '/@' . $path;
-            } else {
-                $search = '--label ' . substr($fs->device, 0, $sid);
-                $path = '/' . substr($fs->device, $sid) . '/@' . $path;
-            }
-        } else {
-            my %types = ('uuid' => '--fs-uuid', 'label' => '--label');
-
-            if ($fsIdentifier eq 'provided') {
-                # If the provided dev is identifying the partition using a label or uuid,
-                # we should get the label / uuid and do a proper search
-                my @matches = $fs->device =~ m/\/dev\/disk\/by-(label|uuid)\/(.*)/;
-                if ($#matches > 1) {
-                    die "Too many matched devices"
-                } elsif ($#matches == 1) {
-                    $search = "$types{$matches[0]} $matches[1]"
-                }
-            } else {
-                # Determine the identifying type
-                $search = $types{$fsIdentifier} . ' ';
-
-                # Based on the type pull in the identifier from the system
-                my ($status, @devInfo) = runCommand("blkid -o export @{[$fs->device]}");
-                if ($status != 0) {
-                    die "Failed to get blkid info for @{[$fs->device]}";
-                }
-                my @matches = join("", @devInfo) =~ m/@{[uc $fsIdentifier]}=([^\n]*)/;
-                if ($#matches != 0) {
-                    die "Couldn't find a $types{$fsIdentifier} for @{[$fs->device]}\n"
-                }
-                $search .= $matches[0];
-            }
-
-            # BTRFS is a special case in that we need to fix the referrenced path based on subvolumes
-            if ($fs->type eq 'btrfs') {
-                my ($status, @info) = runCommand("btrfs subvol show @{[$fs->mount]}");
-                if ($status != 0) {
-                    die "Failed to retreive subvolume info for @{[$fs->mount]}";
-                }
-                my @subvols = join("", @info) =~ m/Name:[ \t\n]*([^ \t\n]*)/;
-                if ($#subvols > 0) {
-                    die "Btrfs subvol name for @{[$fs->device]} listed multiple times in mount\n"
-                } elsif ($#subvols == 0) {
-                    $path = "/$subvols[0]$path";
-                }
-            }
-        }
-        if (not $search eq "") {
-            $search = "search --set=drive$driveid " . $search;
-            $path = "(\$drive$driveid)$path";
-            $driveid += 1;
-        }
-    }
-    return Grub->new(path => $path, search => $search);
-}
-my $grubBoot = GrubFs("/boot");
-my $grubStore = GrubFs("/nix");
-
-# We don't need to copy if we can read the kernels directly
-if ($grubStore->search ne "") {
-	$copyKernels = 0;
+if ($explicitBootRoot ne "") {
+    $bootRoot = $explicitBootRoot;
 }
 
 # Generate the header.
@@ -171,14 +76,12 @@ if ($grubVersion == 1) {
     ";
     if ($splashImage) {
         copy $splashImage, "/boot/background.xpm.gz" or die "cannot copy $splashImage to /boot\n";
-        $conf .= "splashimage " . $grubBoot->path . "/background.xpm.gz\n";
+        $conf .= "splashimage $bootRoot/background.xpm.gz\n";
     }
 }
 
 else {
     $conf .= "
-        " . $grubBoot->search . "
-        " . $grubStore->search . "
         if [ -s \$prefix/grubenv ]; then
           load_env
         fi
@@ -199,7 +102,7 @@ else {
           set timeout=$timeout
         fi
 
-        if loadfont " . $grubBoot->path . "/grub/fonts/unicode.pf2; then
+        if loadfont $bootRoot/grub/fonts/unicode.pf2; then
           set gfxmode=640x480
           insmod gfxterm
           insmod vbe
@@ -213,7 +116,7 @@ else {
         copy $splashImage, "/boot/background.png" or die "cannot copy $splashImage to /boot\n";
         $conf .= "
             insmod png
-            if background_image " . $grubBoot->path . "/background.png; then
+            if background_image $bootRoot/background.png; then
               set color_normal=white/black
               set color_highlight=black/white
             else
@@ -235,7 +138,7 @@ mkpath("/boot/kernels", 0, 0755) if $copyKernels;
 
 sub copyToKernelsDir {
     my ($path) = @_;
-    return $grubStore->path . substr($path, length("/nix")) unless $copyKernels;
+    return $path unless $copyKernels;
     $path =~ /\/nix\/store\/(.*)/ or die;
     my $name = $1; $name =~ s/\//-/g;
     my $dst = "/boot/kernels/$name";
@@ -248,7 +151,7 @@ sub copyToKernelsDir {
         rename $tmp, $dst or die "cannot rename $tmp to $dst\n";
     }
     $copied{$dst} = 1;
-    return $grubBoot->path . "/kernels/$name";
+    return "$bootRoot/kernels/$name";
 }
 
 sub addEntry {
@@ -275,8 +178,6 @@ sub addEntry {
         $conf .= "  " . ($xen ? "module" : "initrd") . " $initrd\n\n";
     } else {
         $conf .= "menuentry \"$name\" {\n";
-	$conf .= $grubBoot->search . "\n";
-	$conf .= $grubStore->search . "\n";
         $conf .= "  $extraPerEntryConfig\n" if $extraPerEntryConfig;
         $conf .= "  multiboot $xen $xenParams\n" if $xen;
         $conf .= "  " . ($xen ? "module" : "linux") . " $kernel $kernelParams\n";
@@ -294,7 +195,7 @@ addEntry("NixOS - Default", $defaultConfig);
 $conf .= "$extraEntries\n" unless $extraEntriesBeforeNixOS;
 
 # extraEntries could refer to @bootRoot@, which we have to substitute
-$conf =~ s/\@bootRoot\@/$grubBoot->path/g;
+$conf =~ s/\@bootRoot\@/$bootRoot/g;
 
 # Emit submenus for all system profiles.
 sub addProfile {

nixos/modules/system/boot/luksroot.nix

@@ -342,40 +342,39 @@ in
               description = "Path where the ramfs used to update the LUKS key will be mounted in stage-1";
             };
 
-            storage = mkOption {
-              type = types.optionSet;
-              description = "Options related to the storing the salt";
+            /* TODO: Add to the documentation of the current module:
 
-              options = {
-                device = mkOption {
-                  default = "/dev/sda1";
-                  type = types.path;
-                  description = ''
-                    An unencrypted device that will temporarily be mounted in stage-1.
-                    Must contain the current salt to create the challenge for this LUKS device.
-                  '';
-                };
+               Options related to the storing the salt.
+            */
+            storage = {
+              device = mkOption {
+                default = "/dev/sda1";
+                type = types.path;
+                description = ''
+                  An unencrypted device that will temporarily be mounted in stage-1.
+                  Must contain the current salt to create the challenge for this LUKS device.
+                '';
+              };
 
-                fsType = mkOption {
-                  default = "vfat";
-                  type = types.string;
-                  description = "The filesystem of the unencrypted device";
-                };
+              fsType = mkOption {
+                default = "vfat";
+                type = types.string;
+                description = "The filesystem of the unencrypted device";
+              };
 
-                mountPoint = mkOption {
-                  default = "/crypt-storage";
-                  type = types.string;
-                  description = "Path where the unencrypted device will be mounted in stage-1";
-                };
+              mountPoint = mkOption {
+                default = "/crypt-storage";
+                type = types.string;
+                description = "Path where the unencrypted device will be mounted in stage-1";
+              };
 
-                path = mkOption {
-                  default = "/crypt-storage/default";
-                  type = types.string;
-                  description = ''
-                    Absolute path of the salt on the unencrypted device with
-                    that device's root directory as "/".
-                  '';
-                };
+              path = mkOption {
+                default = "/crypt-storage/default";
+                type = types.string;
+                description = ''
+                  Absolute path of the salt on the unencrypted device with
+                  that device's root directory as "/".
+                '';
               };
             };
           };

nixos/modules/system/boot/modprobe.nix

@@ -77,6 +77,11 @@ with lib;
         '')}
         ${config.boot.extraModprobeConfig}
       '';
+    environment.etc."modprobe.d/usb-load-ehci-first.conf".text =
+      ''
+        softdep uhci_hcd pre: ehci_hcd
+        softdep ohci_hcd pre: ehci_hcd
+      '';
 
     environment.systemPackages = [ config.system.sbin.modprobe pkgs.kmod ];
 

nixos/modules/tasks/filesystems/nfs.nix

@@ -24,13 +24,37 @@ let
     Method = nsswitch
   '';
 
+  cfg = config.services.nfs;
+
 in
 
 {
+  ###### interface
+
+  options = {
+
+    services.nfs = {
+      statdPort = mkOption {
+        default = null;
+        example = 4000;
+        description = ''
+          Use fixed port for rpc.statd, usefull if NFS server is behind firewall.
+        '';
+      };
+      lockdPort = mkOption {
+        default = null;
+        example = 4001;
+        description = ''
+          Use fixed port for NFS lock manager kernel module (lockd/nlockmgr),
+          usefull if NFS server is behind firewall.
+        '';
+      };
+    };
+  };
 
   ###### implementation
 
-  config = mkIf (any (fs: fs == "nfs" || fs == "nfs4") config.boot.supportedFilesystems) {
+  config = mkIf (any (fs: fs == "nfs" || fs == "nfs4") config.boot.supportedFilesystems) ({
 
     services.rpcbind.enable = true;
 
@@ -60,7 +84,10 @@ in
           '';
 
         serviceConfig.Type = "forking";
-        serviceConfig.ExecStart = "@${pkgs.nfsUtils}/sbin/rpc.statd rpc.statd --no-notify";
+        serviceConfig.ExecStart = ''
+          @${pkgs.nfsUtils}/sbin/rpc.statd rpc.statd --no-notify \
+              ${if cfg.statdPort != null then "-p ${toString statdPort}" else ""}
+        '';
         serviceConfig.Restart = "always";
       };
 
@@ -90,5 +117,9 @@ in
         serviceConfig.Restart = "always";
       };
 
-  };
+  } // mkIf (cfg.lockdPort != null) {
+    boot.extraModprobeConfig = ''
+      options lockd nlm_udpport=${toString cfg.lockdPort} nlm_tcpport=${toString cfg.lockdPort}
+    '';
+  });
 }

nixos/modules/tasks/filesystems/zfs.nix

@@ -133,7 +133,7 @@ in
       };
 
       boot.initrd = mkIf inInitrd {
-        kernelModules = [ "spl" "zfs" ];
+        kernelModules = [ "spl" "zfs" ] ;
         extraUtilsCommands =
           ''
             cp -v ${zfsPkg}/sbin/zfs $out/bin
@@ -148,10 +148,6 @@ in
           '';
       };
 
-      boot.loader.grub = mkIf inInitrd {
-        zfsSupport = true;
-      };
-
       systemd.services."zpool-import" = {
         description = "Import zpools";
         after = [ "systemd-udev-settle.service" ];

nixos/modules/tasks/network-interfaces.nix

@@ -10,6 +10,26 @@ let
   hasSits = cfg.sits != { };
   hasBonds = cfg.bonds != { };
 
+  addrOpts = v:
+    assert v == 4 || v == 6;
+    {
+      address = mkOption {
+        type = types.str;
+        description = ''
+          IPv${toString v} address of the interface.  Leave empty to configure the
+          interface using DHCP.
+        '';
+      };
+
+      prefixLength = mkOption {
+        type = types.addCheck types.int (n: n >= 0 && n <= (if v == 4 then 32 else 128));
+        description = ''
+          Subnet mask of the interface, specified as the number of
+          bits in the prefix (<literal>${if v == 4 then "24" else "64"}</literal>).
+        '';
+      };
+    };
+
   interfaceOpts = { name, ... }: {
 
     options = {
@@ -20,10 +40,36 @@ let
         description = "Name of the interface.";
       };
 
+      ip4 = mkOption {
+        default = [ ];
+        example = [
+          { address = "10.0.0.1"; prefixLength = 16; }
+          { address = "192.168.1.1"; prefixLength = 24; }
+        ];
+        type = types.listOf types.optionSet;
+        options = addrOpts 4;
+        description = ''
+          List of IPv4 addresses that will be statically assigned to the interface.
+        '';
+      };
+
+      ip6 = mkOption {
+        default = [ ];
+        example = [
+          { address = "fdfd:b3f0:482::1"; prefixLength = 48; }
+          { address = "2001:1470:fffd:2098::e006"; prefixLength = 64; }
+        ];
+        type = types.listOf types.optionSet;
+        options = addrOpts 6;
+        description = ''
+          List of IPv6 addresses that will be statically assigned to the interface.
+        '';
+      };
+
       ipAddress = mkOption {
         default = null;
         example = "10.0.0.1";
-        type = types.nullOr (types.str);
+        type = types.nullOr types.str;
         description = ''
           IP address of the interface.  Leave empty to configure the
           interface using DHCP.
@@ -41,20 +87,16 @@ let
       };
 
       subnetMask = mkOption {
-        default = "";
-        example = "255.255.255.0";
-        type = types.str;
+        default = null;
         description = ''
-          Subnet mask of the interface, specified as a bitmask.
-          This is deprecated; use <option>prefixLength</option>
-          instead.
+          Defunct, supply the prefix length instead.
         '';
       };
 
       ipv6Address = mkOption {
         default = null;
         example = "2001:1470:fffd:2098::e006";
-        type = types.nullOr types.string;
+        type = types.nullOr types.str;
         description = ''
           IPv6 address of the interface.  Leave empty to configure the
           interface using NDP.
@@ -224,10 +266,10 @@ in
     networking.interfaces = mkOption {
       default = {};
       example =
-        { eth0 = {
-            ipAddress = "131.211.84.78";
-            subnetMask = "255.255.255.128";
-          };
+        { eth0.ip4 = [ {
+            address = "131.211.84.78";
+            prefixLength = 25;
+          } ];
         };
       description = ''
         The configuration for each network interface.  If
@@ -438,6 +480,12 @@ in
 
   config = {
 
+    assertions =
+      flip map interfaces (i: {
+        assertion = i.subnetMask == null;
+        message = "The networking.interfaces.${i.name}.subnetMask option is defunct. Use prefixLength instead.";
+      });
+
     boot.kernelModules = [ ]
       ++ optional cfg.enableIPv6 "ipv6"
       ++ optional hasVirtuals "tun"
@@ -534,12 +582,18 @@ in
         # network device, so it only gets started after the interface
         # has appeared, and it's stopped when the interface
         # disappears.
-        configureInterface = i: nameValuePair "${i.name}-cfg"
-          (let mask =
-                if i.prefixLength != null then toString i.prefixLength else
-                if i.subnetMask != "" then i.subnetMask else "32";
-               staticIPv6 = cfg.enableIPv6 && i.ipv6Address != null;
+        configureInterface = i:
+          let
+            ips = i.ip4 ++ optionals cfg.enableIPv6 i.ip6
+              ++ optional (i.ipAddress != null) {
+                address = i.ipAddress;
+                prefixLength = i.prefixLength;
+              } ++ optional (cfg.enableIPv6 && i.ipv6Address != null) {
+                address = i.ipv6Address;
+                prefixLength = i.ipv6PrefixLength;
+              };
           in
+          nameValuePair "${i.name}-cfg"
           { description = "Configuration of ${i.name}";
             wantedBy = [ "network-interfaces.target" ];
             bindsTo = [ "sys-subsystem-net-devices-${i.name}.device" ];
@@ -562,36 +616,32 @@ in
                   echo "setting MTU to ${toString i.mtu}..."
                   ip link set "${i.name}" mtu "${toString i.mtu}"
                 ''
-              + optionalString (i.ipAddress != null)
+
+              # Ip Setup
+              +
                 ''
-                  cur=$(ip -4 -o a show dev "${i.name}" | awk '{print $4}')
-                  # Only do a flush/add if it's necessary.  This is
+                  curIps=$(ip -o a show dev "${i.name}" | awk '{print $4}')
+                  # Only do an add if it's necessary.  This is
                   # useful when the Nix store is accessed via this
                   # interface (e.g. in a QEMU VM test).
-                  if [ "$cur" != "${i.ipAddress}/${mask}" ]; then
-                    echo "configuring interface..."
-                    ip -4 addr flush dev "${i.name}"
-                    ip -4 addr add "${i.ipAddress}/${mask}" dev "${i.name}"
-                    restart_network_setup=true
-                  else
-                    echo "skipping configuring interface"
+                ''
+              + flip concatMapStrings (ips) (ip:
+                let
+                  address = "${ip.address}/${toString ip.prefixLength}";
+                in
+                ''
+                  echo "checking ip ${address}..."
+                  if ! echo "$curIps" | grep "${address}" >/dev/null 2>&1; then
+                    if out=$(ip addr add "${address}" dev "${i.name}" 2>&1); then
+                      echo "added ip ${address}..."
+                      restart_network_setup=true
+                    elif ! echo "$out" | grep "File exists" >/dev/null 2>&1; then
+                      echo "failed to add ${address}"
+                      exit 1
+                    fi
                   fi
-                ''
-              + optionalString (staticIPv6)
-                ''
-                  # Only do a flush/add if it's necessary.  This is
-                  # useful when the Nix store is accessed via this
-                  # interface (e.g. in a QEMU VM test).
-                  if ! ip -6 -o a show dev "${i.name}" | grep "${i.ipv6Address}/${toString i.ipv6prefixLength}"; then
-                    echo "configuring interface..."
-                    ip -6 addr flush dev "${i.name}"
-                    ip -6 addr add "${i.ipv6Address}/${toString i.ipv6prefixLength}" dev "${i.name}"
-                    restart_network_setup=true
-                  else
-                    echo "skipping configuring interface"
-                  fi
-                ''
-              + optionalString (i.ipAddress != null || staticIPv6)
+                '')
+              + optionalString (ips != [ ])
                 ''
                   if [ restart_network_setup = true ]; then
                     # Ensure that the default gateway remains set.
@@ -608,7 +658,20 @@ in
                 ''
                   echo 1 > /proc/sys/net/ipv6/conf/${i.name}/proxy_ndp
                 '';
-          });
+            preStop =
+              ''
+                echo "releasing configured ip's..."
+              ''
+              + flip concatMapStrings (ips) (ip:
+                let
+                  address = "${ip.address}/${toString ip.prefixLength}";
+                in
+                ''
+                  echo -n "Deleting ${address}..."
+                  ip addr del "${address}" dev "${i.name}" >/dev/null 2>&1 || echo -n " Failed"
+                  echo ""
+                '');
+          };
 
         createTunDevice = i: nameValuePair "${i.name}"
           { description = "Virtual Network Interface ${i.name}";

nixos/modules/virtualisation/docker-image.nix

@@ -0,0 +1,67 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+ pkgs2storeContents = l : map (x: { object = x; symlink = "none"; }) l;
+
+in {
+  # Create the tarball
+  system.build.dockerImage = import ../../lib/make-system-tarball.nix {
+    inherit (pkgs) stdenv perl xz pathsFromGraph;
+
+    contents = [];
+    extraArgs = "--owner=0";
+    storeContents = [
+      { object = config.system.build.toplevel + "/init";
+        symlink = "/bin/init";
+      }
+    ] ++ (pkgs2storeContents [ pkgs.stdenv ]);
+  };
+
+  boot.postBootCommands =
+    ''
+      # After booting, register the contents of the Nix store in the Nix
+      # database.
+      if [ -f /nix-path-registration ]; then
+        ${config.nix.package}/bin/nix-store --load-db < /nix-path-registration &&
+        rm /nix-path-registration
+      fi
+
+      # nixos-rebuild also requires a "system" profile and an
+      # /etc/NIXOS tag.
+      touch /etc/NIXOS
+      ${config.nix.package}/bin/nix-env -p /nix/var/nix/profiles/system --set /run/current-system
+
+      # Set virtualisation to docker
+      echo "docker" > /run/systemd/container 
+    '';
+
+
+  # docker image config
+  require = [
+    ../installer/cd-dvd/channel.nix
+    ../profiles/minimal.nix
+    ../profiles/clone-config.nix
+  ];
+
+  boot.isContainer = true;
+
+  # Iptables do not work in docker
+  networking.firewall.enable = false;
+
+  services.openssh.enable = true;
+
+  # Socket activated ssh presents problem in docker
+  services.openssh.startWhenNeeded = false;
+
+  # Allow the user to login as root without password
+  security.initialRootPassword = "";
+
+  # Some more help text.
+  services.mingetty.helpLine =
+    ''
+
+      Log in as "root" with an empty password.
+    '';
+}

nixos/modules/virtualisation/libvirtd.nix

@@ -7,6 +7,7 @@ with lib;
 let
 
   cfg = config.virtualisation.libvirtd;
+  vswitch = config.virtualisation.vswitch;
   configFile = pkgs.writeText "libvirtd.conf" ''
     unix_sock_group = "libvirtd"
     unix_sock_rw_perms = "0770"
@@ -56,6 +57,20 @@ in
           '';
       };
 
+    virtualisation.libvirtd.onShutdown =
+      mkOption {
+        type = types.enum ["shutdown" "suspend" ];
+        default = "suspend";
+        description =
+          ''
+            When shutting down / restarting the host what method should
+            be used to gracefully halt the guests. Setting to "shutdown"
+            will cause an ACPI shutdown of each guest. "suspend" will
+            attempt to save the state of the guests ready to restore on boot.
+          '';
+      };
+
+
   };
 
 
@@ -73,12 +88,17 @@ in
       { description = "Libvirt Virtual Machine Management Daemon";
 
         wantedBy = [ "multi-user.target" ];
-        after = [ "systemd-udev-settle.service" ];
+        after = [ "systemd-udev-settle.service" ]
+                ++ optional vswitch.enable "vswitchd.service";
 
-        path =
-          [ pkgs.bridge_utils pkgs.dmidecode pkgs.dnsmasq
+        path = [ 
+            pkgs.bridge_utils 
+            pkgs.dmidecode 
+            pkgs.dnsmasq
             pkgs.ebtables
-          ] ++ optional cfg.enableKVM pkgs.qemu_kvm;
+          ] 
+          ++ optional cfg.enableKVM pkgs.qemu_kvm
+          ++ optional vswitch.enable vswitch.package;
 
         preStart =
           ''
@@ -152,7 +172,12 @@ in
             ${pkgs.libvirt}/etc/rc.d/init.d/libvirt-guests start || true
           '';
 
-        postStop = "${pkgs.libvirt}/etc/rc.d/init.d/libvirt-guests stop";
+        postStop = 
+            ''
+            export PATH=${pkgs.gettext}/bin:$PATH
+            export ON_SHUTDOWN=${cfg.onShutdown}
+            ${pkgs.libvirt}/etc/rc.d/init.d/libvirt-guests stop
+            '';
 
         serviceConfig.Type = "oneshot";
         serviceConfig.RemainAfterExit = true;

nixos/modules/virtualisation/openvswitch.nix

@@ -0,0 +1,117 @@
+# Systemd services for openvswitch
+
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.virtualisation.vswitch;
+
+in
+
+{
+
+  options = {
+
+    virtualisation.vswitch.enable = mkOption {
+      type = types.bool;
+      default = false;
+      description =
+        ''
+        Enable Open vSwitch. A configuration 
+        daemon (ovs-server) will be started.
+        '';
+    };
+
+
+    virtualisation.vswitch.package = mkOption {
+      type = types.package;
+      default = pkgs.openvswitch;
+      description =
+        ''
+        Open vSwitch package to use.
+        '';
+    };
+
+  };
+
+  config = mkIf cfg.enable (let 
+
+    # Where the communication sockets live
+    runDir = "/var/run/openvswitch";
+
+    # Where the config database live (can't be in nix-store)
+    stateDir = "/var/db/openvswitch";
+
+    # The path to the an initialized version of the database 
+    db = pkgs.stdenv.mkDerivation {
+      name = "vswitch.db";
+      unpackPhase = "true";
+      buildPhase = "true";
+      buildInputs = with pkgs; [
+        cfg.package
+      ];
+      installPhase = 
+        ''
+        ensureDir $out/
+        '';
+    };
+
+  in {
+
+    environment.systemPackages = [ cfg.package ]; 
+
+    boot.kernelModules = [ "tun" "openvswitch" ];
+
+    boot.extraModulePackages = [ cfg.package ];
+
+    systemd.services.ovsdb = {
+      description = "Open_vSwitch Database Server";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "systemd-udev-settle.service" ];
+      wants = [ "vswitchd.service" ];
+      path = [ cfg.package ];
+      restartTriggers = [ db cfg.package ];
+      # Create the config database
+      preStart = 
+        ''
+        mkdir -p ${runDir}
+        mkdir -p /var/db/openvswitch
+        chmod +w /var/db/openvswitch
+        if [[ ! -e /var/db/openvswitch/conf.db ]]; then
+          ${cfg.package}/bin/ovsdb-tool create \
+            "/var/db/openvswitch/conf.db" \
+            "${cfg.package}/share/openvswitch/vswitch.ovsschema"
+        fi
+        chmod -R +w /var/db/openvswitch
+        '';
+      serviceConfig.ExecStart = 
+        ''
+        ${cfg.package}/bin/ovsdb-server \
+          --remote=punix:${runDir}/db.sock \
+          --private-key=db:Open_vSwitch,SSL,private_key \
+          --certificate=db:Open_vSwitch,SSL,certificate \
+          --bootstrap-ca-cert=db:Open_vSwitch,SSL,ca_cert \
+          --unixctl=ovsdb.ctl.sock \
+          /var/db/openvswitch/conf.db
+        '';       
+      serviceConfig.Restart = "always";
+      serviceConfig.RestartSec = 3;
+      postStart =
+        ''
+        ${cfg.package}/bin/ovs-vsctl --timeout 3 --retry --no-wait init
+        '';
+
+    };
+
+    systemd.services.vswitchd = {
+      description = "Open_vSwitch Daemon";
+      bindsTo = [ "ovsdb.service" ];
+      after = [ "ovsdb.service" ];
+      path = [ cfg.package ];
+      serviceConfig.ExecStart = ''${cfg.package}/bin/ovs-vswitchd'';
+    };
+
+  });
+
+}

nixos/release-combined.nix

@@ -52,10 +52,6 @@ in rec {
         (all nixos.tests.installer.lvm)
         (all nixos.tests.installer.separateBoot)
         (all nixos.tests.installer.simple)
-        (all nixos.tests.installer.simpleLabels)
-        (all nixos.tests.installer.simpleProvided)
-        (all nixos.tests.installer.btrfsSimple)
-        (all nixos.tests.installer.btrfsSubvols)
         (all nixos.tests.ipv6)
         (all nixos.tests.kde4)
         (all nixos.tests.login)

nixos/release.nix

@@ -222,11 +222,16 @@ in rec {
   tests.firefox = callTest tests/firefox.nix {};
   tests.firewall = callTest tests/firewall.nix {};
   tests.gnome3 = callTest tests/gnome3.nix {};
-  tests.installer = with pkgs.lib;
-    let installer = import tests/installer.nix; in
-    flip mapAttrs (installer { }) (name: _:
-      forAllSystems (system: (installer { system = system; }).${name}.test)
-    );
+  tests.installer.efi = forAllSystems (system: (import tests/installer.nix { inherit system; }).efi.test);
+  tests.installer.grub1 = forAllSystems (system: (import tests/installer.nix { inherit system; }).grub1.test);
+  tests.installer.lvm = forAllSystems (system: (import tests/installer.nix { inherit system; }).lvm.test);
+  tests.installer.rebuildCD = forAllSystems (system: (import tests/installer.nix { inherit system; }).rebuildCD.test);
+  tests.installer.separateBoot = forAllSystems (system: (import tests/installer.nix { inherit system; }).separateBoot.test);
+  tests.installer.simple = forAllSystems (system: (import tests/installer.nix { inherit system; }).simple.test);
+  tests.installer.simpleLabels = forAllSystems (system: (import tests/installer.nix { inherit system; }).simpleLabels.test);
+  tests.installer.simpleProvided = forAllSystems (system: (import tests/installer.nix { inherit system; }).simpleProvided.test);
+  tests.installer.btrfsSimple = forAllSystems (system: (import tests/installer.nix { inherit system; }).btrfsSimple.test);
+  #tests.installer.btrfsSubvols = forAllSystems (system: (import tests/installer.nix { inherit system; }).btrfsSubvols.test);
   tests.influxdb = callTest tests/influxdb.nix {};
   tests.ipv6 = callTest tests/ipv6.nix {};
   tests.jenkins = callTest tests/jenkins.nix {};

nixos/tests/bittorrent.nix

@@ -16,7 +16,7 @@ let
   miniupnpdConf = nodes: pkgs.writeText "miniupnpd.conf"
     ''
       ext_ifname=eth1
-      listening_ip=${nodes.router.config.networking.interfaces.eth2.ipAddress}/24
+      listening_ip=${(pkgs.lib.head nodes.router.config.networking.interfaces.eth2.ip4).address}/24
       allow 1024-65535 192.168.2.0/24 1024-65535
     '';
 
@@ -53,7 +53,7 @@ in
         { environment.systemPackages = [ pkgs.transmission ];
           virtualisation.vlans = [ 2 ];
           networking.defaultGateway =
-            nodes.router.config.networking.interfaces.eth2.ipAddress;
+            (pkgs.lib.head nodes.router.config.networking.interfaces.eth2.ip4).address;
           networking.firewall.enable = false;
         };
 
@@ -81,7 +81,7 @@ in
       # Create the torrent.
       $tracker->succeed("mkdir /tmp/data");
       $tracker->succeed("cp ${file} /tmp/data/test.tar.bz2");
-      $tracker->succeed("transmission-create /tmp/data/test.tar.bz2 -t http://${nodes.tracker.config.networking.interfaces.eth1.ipAddress}:6969/announce -o /tmp/test.torrent");
+      $tracker->succeed("transmission-create /tmp/data/test.tar.bz2 -t http://${(pkgs.lib.head nodes.tracker.config.networking.interfaces.eth1.ip4).address}:6969/announce -o /tmp/test.torrent");
       $tracker->succeed("chmod 644 /tmp/test.torrent");
 
       # Start the tracker.  !!! use a less crappy tracker

nixos/tests/installer.nix

@@ -35,8 +35,8 @@ let
 
 
   # The configuration to install.
-  makeConfig = { testChannel, useEFI, grubVersion, grubDevice, grubIdentifier }:
-    pkgs.writeText "configuration.nix" ''
+  makeConfig = { testChannel, useEFI, grubVersion, grubDevice }: pkgs.writeText "configuration.nix"
+    ''
       { config, pkgs, modulesPath, ... }:
 
       { imports =
@@ -54,7 +54,6 @@ let
           ''}
           boot.loader.grub.device = "${grubDevice}";
           boot.loader.grub.extraConfig = "serial; terminal_output.serial";
-          boot.loader.grub.fsIdentifier = "${grubIdentifier}";
         ''}
 
         environment.systemPackages = [ ${optionalString testChannel "pkgs.rlwrap"} ];
@@ -94,7 +93,7 @@ let
   # disk, and then reboot from the hard disk.  It's parameterized with
   # a test script fragment `createPartitions', which must create
   # partitions and filesystems.
-  testScriptFun = { createPartitions, testChannel, useEFI, grubVersion, grubDevice, grubIdentifier }:
+  testScriptFun = { createPartitions, testChannel, useEFI, grubVersion, grubDevice }:
     let
       # FIXME: OVMF doesn't boot from virtio http://www.mail-archive.com/edk2-devel@lists.sourceforge.net/msg01501.html
       iface = if useEFI || grubVersion == 1 then "scsi" else "virtio";
@@ -162,7 +161,7 @@ let
       $machine->succeed("cat /mnt/etc/nixos/hardware-configuration.nix >&2");
 
       $machine->copyFileFromHost(
-          "${ makeConfig { inherit testChannel useEFI grubVersion grubDevice grubIdentifier; } }",
+          "${ makeConfig { inherit testChannel useEFI grubVersion grubDevice; } }",
           "/mnt/etc/nixos/configuration.nix");
 
       # Perform the installation.
@@ -217,13 +216,13 @@ let
 
 
   makeInstallerTest = name:
-    { createPartitions, testChannel ? false, useEFI ? false, grubVersion ? 2, grubDevice ? "/dev/vda", grubIdentifier ? "uuid" }:
+    { createPartitions, testChannel ? false, useEFI ? false, grubVersion ? 2, grubDevice ? "/dev/vda" }:
     makeTest {
       inherit iso;
       name = "installer-" + name;
       nodes = if testChannel then { inherit webserver; } else { };
       testScript = testScriptFun {
-        inherit createPartitions testChannel useEFI grubVersion grubDevice grubIdentifier;
+        inherit createPartitions testChannel useEFI grubVersion grubDevice;
       };
     };
 
@@ -397,7 +396,7 @@ in {
     };
 
   # Test using labels to identify volumes in grub
-  simpleLabels = makeInstallerTest {
+  simpleLabels = makeInstallerTest "simpleLabels" {
     createPartitions = ''
       $machine->succeed(
         "sgdisk -Z /dev/vda",
@@ -413,7 +412,7 @@ in {
 
   # Test using the provided disk name within grub
   # TODO: Fix udev so the symlinks are unneeded in /dev/disks
-  simpleProvided = makeInstallerTest {
+  simpleProvided = makeInstallerTest "simpleProvided" {
     createPartitions = ''
       my $UUID = "\$(blkid -s UUID -o value /dev/vda2)";
       $machine->succeed(
@@ -436,7 +435,7 @@ in {
   };
 
   # Simple btrfs grub testing
-  btrfsSimple = makeInstallerTest {
+  btrfsSimple = makeInstallerTest "btrfsSimple" {
     createPartitions = ''
       $machine->succeed(
         "sgdisk -Z /dev/vda",
@@ -450,7 +449,7 @@ in {
   };
 
   # Test to see if we can detect /boot and /nix on subvolumes
-  btrfsSubvols = makeInstallerTest {
+  btrfsSubvols = makeInstallerTest "btrfsSubvols" {
     createPartitions = ''
       $machine->succeed(
         "sgdisk -Z /dev/vda",

nixos/tests/nat.nix

@@ -13,7 +13,7 @@ import ./make-test.nix {
         { virtualisation.vlans = [ 1 ];
           networking.firewall.allowPing = true;
           networking.defaultGateway =
-            nodes.router.config.networking.interfaces.eth2.ipAddress;
+            (pkgs.lib.head nodes.router.config.networking.interfaces.eth2.ip4).address;
         };
 
       router =

pkgs/applications/audio/audacious/default.nix

@@ -1,28 +1,29 @@
 { stdenv, fetchurl, pkgconfig, glib, gtk3, libmowgli, libmcs
 , gettext, dbus_glib, libxml2, libmad, xlibs, alsaLib, libogg
 , libvorbis, libcdio, libcddb, flac, ffmpeg, makeWrapper
+, mpg123, neon, faad2
 }:
 
 let
-  version = "3.4.3";
+  version = "3.5.1";
 in
 stdenv.mkDerivation {
   name = "audacious-${version}";
 
   src = fetchurl {
     url = "http://distfiles.audacious-media-player.org/audacious-${version}.tar.bz2";
-    sha256 = "04lzwdr1lx6ghbfxzygvnbmdl420w6rm453ds5lyb0hlvzs58d0q";
+    sha256 = "01wmlvpp540gdjw759wif3byh98h3b3q6f5wawzp0b0ivqd0wf6z";
   };
 
   pluginsSrc = fetchurl {
     url = "http://distfiles.audacious-media-player.org/audacious-plugins-${version}.tar.bz2";
-    sha256 = "00r88q9fs9a0gicdmk2svcans7igcqgacrw303a5bn44is7pmrmy";
+    sha256 = "09lyvi15hbn3pvb2izyz2bm4021917mhcdrwxrn3q3sjvx337np6";
   };
 
   buildInputs =
     [ gettext pkgconfig glib gtk3 libmowgli libmcs libxml2 dbus_glib
       libmad xlibs.libXcomposite libogg libvorbis flac alsaLib libcdio
-      libcddb ffmpeg makeWrapper
+      libcddb ffmpeg makeWrapper mpg123 neon faad2
     ];
 
   # Here we build bouth audacious and audacious-plugins in one

pkgs/applications/audio/guitarix/default.nix

@@ -1,19 +1,19 @@
-{ stdenv, fetchurl, avahi, boost, fftw, gettext, glib, glibmm, gtk
-, gtkmm, intltool, jack2, ladspaH, librdf, libsndfile, lv2
-, pkgconfig, python }:
+{ stdenv, fetchurl, avahi, boost, eigen, fftw, gettext, glib, glibmm, gtk
+, gtkmm, intltool, jack2, ladspaH, librdf, libsndfile, lilv, lv2
+, pkgconfig, python, serd, sord, sratom }:
 
 stdenv.mkDerivation rec {
   name = "guitarix-${version}";
-  version = "0.28.3";
+  version = "0.30.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/guitarix/guitarix2-${version}.tar.bz2";
-    sha256 = "0ks5avylyicqfj9l1wf4gj62i8m6is2jmp0h11h5l2wbg3xiwxjd";
+    sha256 = "0fbapd1pcixzlqxgzb2s2q1c64g9z9lf4hz3vy73z55cnpk72vdx";
   };
 
   buildInputs = [
-    avahi boost fftw gettext glib glibmm gtk gtkmm intltool jack2
-    ladspaH librdf libsndfile lv2 pkgconfig python
+    avahi boost eigen fftw gettext glib glibmm gtk gtkmm intltool jack2
+    ladspaH librdf libsndfile lilv lv2 pkgconfig python serd sord sratom
   ];
 
   configurePhase = "python waf configure --prefix=$out";

pkgs/applications/audio/hydrogen/default.nix

@@ -1,35 +1,19 @@
-{ stdenv, fetchurl, alsaLib, boost, glib, jack2, ladspaPlugins
-, libarchive, liblrdf , libsndfile, pkgconfig, qt4, scons, subversion }:
+{ stdenv, fetchurl, alsaLib, boost, cmake, glib, jack2, libarchive
+, liblrdf, libsndfile, pkgconfig, qt4 }:
 
 stdenv.mkDerivation rec {
-  version = "0.9.5.1";
+  version = "0.9.6";
   name = "hydrogen-${version}";
 
   src = fetchurl {
-    url = "mirror://sourceforge/hydrogen/hydrogen-${version}.tar.gz";
-    sha256 = "1fvyp6gfzcqcc90dmaqbm11p272zczz5pfz1z4lj33nfr7z0bqgb";
+    url = "https://github.com/hydrogen-music/hydrogen/archive/${version}.tar.gz";
+    sha256 = "1z7j8aq158mp41iv78j0w6fyx98y1y51z592b4x5hkvicabgck5w";
   };
 
   buildInputs = [ 
-    alsaLib boost glib jack2 ladspaPlugins libarchive liblrdf
-    libsndfile pkgconfig qt4 scons subversion
+    alsaLib boost cmake glib jack2 libarchive liblrdf libsndfile pkgconfig qt4
   ];
 
-  patches = [ ./scons-env.patch ];
-
-  postPatch = ''
-    sed -e 's#/usr/lib/ladspa#${ladspaPlugins}/lib/ladspa#' -i libs/hydrogen/src/preferences.cpp
-    sed '/\/usr/d' -i libs/hydrogen/src/preferences.cpp
-    sed "s#pkg_ver.rstrip().split('.')#pkg_ver.rstrip().split('.')[:3]#" -i Sconstruct
-  '';
-
-  # why doesn't scons find librdf?
-  buildPhase = ''
-    scons prefix=$out libarchive=1 lrdf=0 install
-  '';
-
-  installPhase = ":";
-
   meta = with stdenv.lib; {
     description = "Advanced drum machine";
     homepage = http://www.hydrogen-music.org;

pkgs/applications/audio/hydrogen/scons-env.patch

@@ -1,28 +0,0 @@
---- hydrogen-0.9.5/Sconstruct	2011-03-15 13:22:35.000000000 +0100
-+++ hydrogen-0.9.5/Sconstruct	2011-04-17 16:06:54.000000000 +0200
-@@ -178,7 +178,7 @@
- 
- 	includes.append( "libs/hydrogen/include" )
- 	
--	env = Environment( options = opts ) 
-+	env = Environment( options = opts, ENV = os.environ ) 
- 
- 
- 	#location of qt4.py
-@@ -298,7 +298,6 @@
- 
-         for N in glob.glob('./data/i18n/hydrogen.*'):
-             env.Alias(target="install", source=env.Install(dir= env['DESTDIR'] + env['prefix'] + '/share/hydrogen/data/i18n', source=N))
--	env.Alias(target="install", source=env.Install(dir= env['DESTDIR'] + env['prefix'] + '/share/hydrogen/data', source="./data/img"))
- 
- 	#add every img in ./data/img to the install list. 
- 	os.path.walk("./data/img/",install_images,env) 
-@@ -379,7 +379,7 @@
- 
- includes, a , b = get_platform_flags( opts )
- 
--env = Environment(options = opts, CPPPATH = includes)
-+env = Environment(options = opts, ENV = os.environ)
- 
- 
- Help(opts.GenerateHelpText(env))

pkgs/applications/audio/jalv/default.nix

@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation  rec {
   name = "jalv-${version}";
-  version = "1.4.4";
+  version = "1.4.6";
 
   src = fetchurl {
     url = "http://download.drobilla.net/${name}.tar.bz2";
-    sha256 = "1iql1r52rmf87q6jkxhcxa3lpq7idzzg55ma91wphywyvh29q7lf";
+    sha256 = "1f1hcq74n3ziw8bk97mn5a1vgw028dxikv3fchaxd430pbbhqgl9";
   };
 
   buildInputs = [

pkgs/applications/audio/lmms/default.nix

@@ -1,24 +1,22 @@
-{ stdenv, fetchurl, SDL, alsaLib, cmake, fftwSinglePrec, jack2, libogg
-, libsamplerate, libsndfile, pkgconfig, pulseaudio, qt4, freetype
+{ stdenv, fetchurl, SDL, alsaLib, cmake, fftwSinglePrec, fluidsynth
+, fltk13, jack2, libvorbis , libsamplerate, libsndfile, pkgconfig
+, pulseaudio, qt4, freetype
 }:
 
 stdenv.mkDerivation  rec {
   name = "lmms-${version}";
-  version = "0.4.15";
+  version = "1.0.3";
 
   src = fetchurl {
-    url = "mirror://sourceforge/lmms/${name}.tar.bz2";
-    sha256 = "02q2gbsqwk3hf9kvzz58a5bxmlb4cfr2mzy41wdvbxxdm2pcl101";
+    url = "https://github.com/LMMS/lmms/archive/v${version}.tar.gz";
+    sha256 = "191mfld3gspnxlgwcszp9kls58kdwrplj0rfw4zqsz90zdbsjnx3";
   };
 
   buildInputs = [
-    SDL alsaLib cmake fftwSinglePrec jack2 libogg libsamplerate
-    libsndfile pkgconfig pulseaudio qt4
+    SDL alsaLib cmake fftwSinglePrec fltk13 fluidsynth jack2
+    libsamplerate libsndfile libvorbis pkgconfig pulseaudio qt4
   ];
 
-  # work around broken build system of 0.4.*
-  NIX_CFLAGS_COMPILE = "-I${freetype}/include/freetype2";
-
   enableParallelBuilding = true;
 
   meta = with stdenv.lib; {

pkgs/applications/audio/petrifoo/default.nix

@@ -1,14 +1,14 @@
-{ stdenv, fetchgit, alsaLib, cmake, gtk, jack2, libgnomecanvas
+{ stdenv, fetchurl, alsaLib, cmake, gtk, jack2, libgnomecanvas
 , libpthreadstubs, libsamplerate, libsndfile, libtool, libxml2
 , pkgconfig }:
 
 stdenv.mkDerivation  rec {
-  name = "petri-foo";
+  name = "petri-foo-${version}";
+  version = "0.1.87";
 
-  src = fetchgit {
-    url = https://github.com/licnep/Petri-Foo.git;
-    rev = "eef3b6efebe842d2fa18ed32b881fea4562b84e0";
-    sha256 = "a20c3f1a633500a65c099c528c7dc2405daa60738b64d881bb8f2036ae59913c";
+  src = fetchurl {
+    url =  "mirror://sourceforge/petri-foo/${name}.tar.bz2";
+    sha256 = "0b25iicgn8c42487fdw32ycfrll1pm2zjgy5djvgw6mfcaa4gizh";
   };
 
   buildInputs =
@@ -16,8 +16,6 @@ stdenv.mkDerivation  rec {
      libsamplerate libsndfile libtool libxml2 pkgconfig
    ];
 
-  dontUseCmakeBuildDir=true;
-
   meta = with stdenv.lib; {
     description = "MIDI controllable audio sampler";
     longDescription = "a fork of Specimen";

pkgs/applications/audio/pianobar/default.nix

@@ -21,6 +21,6 @@ stdenv.mkDerivation rec {
     description = "A console front-end for Pandora.com";
     homepage = "http://6xq.net/projects/pianobar/";
     platforms = stdenv.lib.platforms.linux;
-    license = stdenv.lib.licenses.unfree;
+    license = stdenv.lib.licenses.mit; # expat version
   };
 }

pkgs/applications/audio/zynaddsubfx/default.nix

@@ -1,17 +1,17 @@
-{ stdenv, fetchurl, alsaLib, cmake, jack2, fftw, fltk13, minixml
-, pkgconfig, zlib
+{ stdenv, fetchurl, alsaLib, cmake, jack2, fftw, fltk13, libjpeg
+, minixml, pkgconfig, zlib
 }:
 
 stdenv.mkDerivation  rec {
   name = "zynaddsubfx-${version}";
-  version = "2.4.3";
+  version = "2.4.4";
 
   src = fetchurl {
-    url = "mirror://sourceforge/zynaddsubfx/ZynAddSubFX-${version}.tar.bz2";
-    sha256 = "0kgmwyh4rhyqdfrdzhbzjjk2hzggkp9c4aac6sy3xv6cc1b5jjxq";
+    url = "mirror://sourceforge/zynaddsubfx/zynaddsubfx-${version}.tar.xz";
+    sha256 = "15byz08p5maf3v8l1zz11xan6s0qcfasjf1b81xc8rffh13x5f53";
   };
 
-  buildInputs = [ alsaLib jack2 fftw fltk13 minixml zlib ];
+  buildInputs = [ alsaLib jack2 fftw fltk13 libjpeg minixml zlib ];
   nativeBuildInputs = [ cmake pkgconfig ];
 
   meta = with stdenv.lib; {

pkgs/applications/editors/wxhexeditor/default.nix

@@ -0,0 +1,41 @@
+{ stdenv, fetchurl, wxGTK, autoconf, automake, libtool, python, gettext, bash }:
+
+stdenv.mkDerivation rec {
+  name = "wxHexEditor-${version}";
+  version = "v0.22";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/wxhexeditor/${name}-src.tar.bz2";
+    sha256 = "15ir038g4lyw1q5bsay974hvj0nkg2yd9kccwxz808cd45fp411w";
+  };
+
+  buildInputs = [ wxGTK autoconf automake libtool python gettext ];
+
+  patchPhase = ''
+    substituteInPlace Makefile --replace "/usr/local" "$out"
+    substituteInPlace Makefile --replace "mhash; ./configure" "mhash; ./configure --prefix=$out"
+    substituteInPlace udis86/autogen.sh --replace "/bin/bash" "${bash}/bin/bash"
+  '';
+
+  buildPhase = ''
+    make OPTFLAGS="-fopenmp"
+
+  '';
+
+  meta = {
+    description = "Hex Editor / Disk Editor for Huge Files or Devices";
+    longDescription = ''
+      This is not an ordinary hex editor, but could work as low level disk editor too.
+      If you have problems with your HDD or partition, you can recover your data from HDD or
+      from partition via editing sectors in raw hex.
+      You can edit your partition tables or you could recover files from File System by hand
+      with help of wxHexEditor.
+      Or you might want to analyze your big binary files, partitions, devices... If you need
+      a good reverse engineer tool like a good hex editor, you welcome.
+      wxHexEditor could edit HDD/SDD disk devices or partitions in raw up to exabyte sizes.
+    '';
+    homepage = "http://www.wxhexeditor.org/";
+    license = stdenv.lib.licenses.gpl2;
+    platforms = stdenv.lib.platforms.linux;
+  };
+}

pkgs/applications/graphics/k3d/default.nix

@@ -1,7 +1,7 @@
 {stdenv, fetchurl
 , cmake, mesa, zlib, python, expat, libxml2, libsigcxx, libuuid, freetype
 , libpng, boost, doxygen, cairomm, pkgconfig, imagemagick, libjpeg, libtiff
-, gettext, intltool, perl, gtkmm, glibmm, gtkglext
+, gettext, intltool, perl, gtkmm, glibmm, gtkglext, pangox_compat, libXmu
 }:
 
 stdenv.mkDerivation rec {
@@ -13,11 +13,8 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
-    # debian package source
-    ./disable_mutable_in_boost_gil.patch
     ./k3d_gtkmm224.patch
-    # http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/media-gfx/k3d/files/k3d-0.7.11.0-libpng14.patch
-    ./k3d-0.7.11.0-libpng14.patch
+    ./libpng-1.4.patch
   ];
 
   preConfigure = ''
@@ -29,10 +26,12 @@ stdenv.mkDerivation rec {
      cmake mesa zlib python expat libxml2 libsigcxx libuuid freetype libpng
      boost doxygen cairomm pkgconfig imagemagick libjpeg libtiff gettext
      intltool perl
-     gtkmm glibmm gtkglext
+     gtkmm glibmm gtkglext pangox_compat libXmu
     ];
 
-  doCheck = false;
+  #doCheck = false;
+
+  enableParallelBuilding = true;
 
   meta = {
     description = "A 3D editor with support for procedural editing";

pkgs/applications/graphics/k3d/disable_mutable_in_boost_gil.patch

@@ -1,20 +0,0 @@
---- a/k3dsdk/gil/boost/gil/extension/dynamic_image/apply_operation_base.hpp
-+++ b/k3dsdk/gil/boost/gil/extension/dynamic_image/apply_operation_base.hpp
-@@ -114,7 +114,7 @@
-     template <typename T2, typename Op>
-     struct reduce_bind1 {
-         const T2& _t2;
--        mutable Op&  _op;
-+        Op&  _op;
- 
-         typedef typename Op::result_type result_type;
- 
-@@ -127,7 +127,7 @@
-     struct reduce_bind2 {
-         const Bits1& _bits1;
-         std::size_t _index1;
--        mutable Op&  _op;
-+        Op&  _op;
- 
-         typedef typename Op::result_type result_type;
- 

pkgs/applications/graphics/k3d/libpng-1.4.patch

@@ -1,54 +1,53 @@
-diff -ur k3d-source-0.7.11.0.orig/k3dsdk/gil/boost/gil/extension/io/png_io_private.hpp k3d-source-0.7.11.0/k3dsdk/gil/boost/gil/extension/io/png_io_private.hpp
---- k3d-source-0.7.11.0.orig/k3dsdk/gil/boost/gil/extension/io/png_io_private.hpp	2009-03-19 22:28:53.000000000 +0200
-+++ k3d-source-0.7.11.0/k3dsdk/gil/boost/gil/extension/io/png_io_private.hpp	2010-05-12 12:21:50.000000000 +0300
+--- k3d-source-0.8.0.1/k3dsdk/gil/boost/gil/extension/io/png_io_private.hpp	2010-04-18 13:49:33.000000000 +0800
++++ k3d-source-0.8.0.1-patched/k3dsdk/gil/boost/gil/extension/io/png_io_private.hpp	2010-06-10 21:17:51.555920268 +0800
 @@ -148,12 +148,12 @@
-         // allocate/initialize the image information data
-         _info_ptr = png_create_info_struct(_png_ptr);
-         if (_info_ptr == NULL) {
--            png_destroy_read_struct(&_png_ptr,png_infopp_NULL,png_infopp_NULL);
-+            png_destroy_read_struct(&_png_ptr,NULL,NULL);
-             io_error("png_get_file_size: fail to call png_create_info_struct()");
-         }
-         if (setjmp(png_jmpbuf(_png_ptr))) {
-             //free all of the memory associated with the png_ptr and info_ptr
--            png_destroy_read_struct(&_png_ptr, &_info_ptr, png_infopp_NULL);
-+            png_destroy_read_struct(&_png_ptr, &_info_ptr, NULL);
-             io_error("png_get_file_size: fail to call setjmp()");
-         }
-         png_init_io(_png_ptr, get());
+         // allocate/initialize the image information data
+         _info_ptr = png_create_info_struct(_png_ptr);
+         if (_info_ptr == NULL) {
+-            png_destroy_read_struct(&_png_ptr,png_infopp_NULL,png_infopp_NULL);
++			png_destroy_read_struct(&_png_ptr,NULL,NULL);
+             io_error("png_get_file_size: fail to call png_create_info_struct()");
+         }
+         if (setjmp(png_jmpbuf(_png_ptr))) {
+             //free all of the memory associated with the png_ptr and info_ptr
+-            png_destroy_read_struct(&_png_ptr, &_info_ptr, png_infopp_NULL);
++			png_destroy_read_struct(&_png_ptr, &_info_ptr, NULL);
+             io_error("png_get_file_size: fail to call setjmp()");
+         }
+         png_init_io(_png_ptr, get());
 @@ -165,7 +165,7 @@
-     png_reader(const char* filename) : file_mgr(filename, "rb") { init(); }
- 
-     ~png_reader() {
--        png_destroy_read_struct(&_png_ptr,&_info_ptr,png_infopp_NULL);
-+        png_destroy_read_struct(&_png_ptr,&_info_ptr,NULL);
-     }
-     point2<std::ptrdiff_t> get_dimensions() {
-         return point2<std::ptrdiff_t>(png_get_image_width(_png_ptr,_info_ptr),
+     png_reader(const char* filename) : file_mgr(filename, "rb") { init(); }
+ 
+     ~png_reader() {
+-        png_destroy_read_struct(&_png_ptr,&_info_ptr,png_infopp_NULL);
++		png_destroy_read_struct(&_png_ptr,&_info_ptr,NULL); 
+     }
+     point2<std::ptrdiff_t> get_dimensions() {
+         return point2<std::ptrdiff_t>(png_get_image_width(_png_ptr,_info_ptr),
 @@ -177,7 +177,7 @@
-         int bit_depth, color_type, interlace_type;
-         png_get_IHDR(_png_ptr, _info_ptr,
-                      &width, &height,&bit_depth,&color_type,&interlace_type,
--                     int_p_NULL, int_p_NULL);
-+                     (int *) NULL, (int *) NULL);
-         io_error_if(((png_uint_32)view.width()!=width || (png_uint_32)view.height()!= height),
-                     "png_read_view: input view size does not match PNG file size");
-         
+         int bit_depth, color_type, interlace_type;
+         png_get_IHDR(_png_ptr, _info_ptr,
+                      &width, &height,&bit_depth,&color_type,&interlace_type,
+-                     int_p_NULL, int_p_NULL);
++					 (int *) NULL, (int *) NULL);
+         io_error_if(((png_uint_32)view.width()!=width || (png_uint_32)view.height()!= height),
+                     "png_read_view: input view size does not match PNG file size");
+         
 @@ -219,7 +219,7 @@
-         int bit_depth, color_type, interlace_type;
-         png_get_IHDR(_png_ptr, _info_ptr,
-                      &width, &height,&bit_depth,&color_type,&interlace_type,
--                     int_p_NULL, int_p_NULL);
-+                     (int *) NULL, (int *) NULL);
-         io_error_if(((png_uint_32)view.width()!=width || (png_uint_32)view.height()!= height),
-                     "png_reader_color_convert::apply(): input view size does not match PNG file size");
-         switch (color_type) {
+         int bit_depth, color_type, interlace_type;
+         png_get_IHDR(_png_ptr, _info_ptr,
+                      &width, &height,&bit_depth,&color_type,&interlace_type,
+-                     int_p_NULL, int_p_NULL);
++					 (int *) NULL, (int *) NULL);
+         io_error_if(((png_uint_32)view.width()!=width || (png_uint_32)view.height()!= height),
+                     "png_reader_color_convert::apply(): input view size does not match PNG file size");
+         switch (color_type) {
 @@ -308,7 +308,7 @@
-         io_error_if(!_png_ptr,"png_write_initialize: fail to call png_create_write_struct()");
-         _info_ptr = png_create_info_struct(_png_ptr);
-         if (!_info_ptr) {
--            png_destroy_write_struct(&_png_ptr,png_infopp_NULL);
-+            png_destroy_write_struct(&_png_ptr,NULL);
-             io_error("png_write_initialize: fail to call png_create_info_struct()");
-         }
-         if (setjmp(png_jmpbuf(_png_ptr))) {
+         io_error_if(!_png_ptr,"png_write_initialize: fail to call png_create_write_struct()");
+         _info_ptr = png_create_info_struct(_png_ptr);
+         if (!_info_ptr) {
+-            png_destroy_write_struct(&_png_ptr,png_infopp_NULL);
++			png_destroy_write_struct(&_png_ptr,NULL);
+             io_error("png_write_initialize: fail to call png_create_info_struct()");
+         }
+         if (setjmp(png_jmpbuf(_png_ptr))) {

pkgs/applications/graphics/mcomix/default.nix

@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
     namePrefix = "";
-    name = "mcomix-0.98";
+    name = "mcomix-1.00";
 
     src = fetchurl {
       url = "mirror://sourceforge/mcomix/${name}.tar.bz2";
-      sha256 = "93805b6c8540bd673ac4a6ef6e952f00f8fc10e59a63c7e163324a64db2a6b03";
+      sha256 = "1phcdx1agacdadz8bvbibdbps1apz8idi668zmkky5cpl84k2ifq";
     };
 
     doCheck = false;
@@ -28,7 +28,7 @@ buildPythonPackage rec {
       '';
 
       homepage = http://mcomix.sourceforge.net/;
-
       license = stdenv.lib.licenses.gpl2;
+      maintainers = with stdenv.lib.maintainers; [ fuuzetsu ];
     };
 }

pkgs/applications/graphics/processing/default.nix

@@ -0,0 +1,39 @@
+{ fetchurl, stdenv, ant, jre, makeWrapper, libXxf86vm, which }:
+
+stdenv.mkDerivation rec {
+  name = "processing-${version}";
+  version = "2.2.1";
+
+  src = fetchurl {
+    url = "https://github.com/processing/processing/archive/processing-0227-${version}.tar.gz";
+    sha256 = "1r8q5y0h4gpqap5jwkspc0li6566hzx5chr7hwrdn8mxlzsm50xk";
+  };
+
+  # Stop it trying to download its own version of java
+  patches = [ ./use-nixpkgs-jre.patch ];
+
+  buildInputs = [ ant jre makeWrapper libXxf86vm which ];
+
+  buildPhase = "cd build && ant build";
+
+  installPhase = ''
+    mkdir -p $out/${name}
+    mkdir -p $out/bin
+   cp -r linux/work/* $out/${name}/
+   makeWrapper $out/${name}/processing $out/bin/processing \
+     --prefix PATH : "${jre}/bin:${which}/bin" \
+     --prefix LD_LIBRARY_PATH : ${libXxf86vm}/lib
+   makeWrapper $out/${name}/processing-java $out/bin/processing-java \
+     --prefix PATH : "${jre}/bin:${which}/bin" \
+     --prefix LD_LIBRARY_PATH : ${libXxf86vm}/lib
+   ln -s ${jre} $out/${name}/java
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A language and IDE for electronic arts";
+    homepage = http://processing.org;
+    license = licenses.gpl2Plus;
+    maintainers = [ maintainers.goibhniu ];
+    platforms = platforms.linux;
+  };
+}

pkgs/applications/graphics/processing/use-nixpkgs-jre.patch

@@ -0,0 +1,88 @@
+From d1fb63255ff028ecc9cc66d5a6b21b24031b4b4a Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Cillian=20de=20R=C3=B3iste?= <cillian.deroiste@gmail.com>
+Date: Tue, 26 Aug 2014 00:07:58 +0200
+Subject: [PATCH] patch
+
+---
+ build/build.xml | 42 +++++++++++++++++++++---------------------
+ 1 file changed, 21 insertions(+), 21 deletions(-)
+
+diff --git a/build/build.xml b/build/build.xml
+index 4d0f0b2..c3f5c09 100755
+--- a/build/build.xml
++++ b/build/build.xml
+@@ -640,10 +640,11 @@
+ 	      value="jre-tools-6u37-linux${sun.arch.data.model}.tgz" />
+     -->
+ 
++    <!--
+     <get src="http://processing.googlecode.com/files/${jre.file}" 
+ 	 dest="linux/jre.tgz" 
+ 	 usetimestamp="true" />
+-
++    -->
+ <!--	   
+     Cannot use ant version of tar because it doesn't preserve properties.
+     <untar compression="gzip" 
+@@ -655,39 +656,38 @@
+ <!--
+     http://www.gnu.org/software/tar/manual/html_section/transform.html
+ -->
+-    <exec executable="tar" dir="linux">
++    <!-- <exec executable="tar" dir="linux"> -->
+       <!-- Change directory -->
+       <!--
+       <arg value="-C" /> 
+       <arg value="linux/work" />
+       <arg value="-xzpf" />
+       -->
+-      <arg value="xfz" />
+-      <arg value="jre.tgz"/>
+-    </exec>
++    <!--   <arg value="xfz" /> -->
++    <!--   <arg value="jre.tgz"/> -->
++    <!-- </exec> -->
+ 
+     <!--
+     We only want to move when the folder didn't exist before
+     <move file="linux/jre1.7.0_40" tofile="linux/work/java" />
+     -->
+-    <exec executable="rsync" dir="linux">
+-      <arg value="-a" />
+-      <arg value="--delete" />
+-      <arg value="jre1.7.0_40/" />
+-      <arg value="work/java" />
+-    </exec>
+-    <delete dir="linux/jre1.7.0_40" />
++    <!-- <exec executable="rsync" dir="linux"> -->
++    <!--   <arg value="-a" /> -->
++    <!--   <arg value="jre1.7.0_40/" /> -->
++    <!--   <arg value="work/java" /> -->
++    <!-- </exec> -->
++    <!-- <delete dir="linux/jre1.7.0_40" /> -->
+ 
+     <!-- Remove unused JRE bloat. -->
+-    <delete> 
+-      <fileset refid="javafx-basics" />
+-      <fileset refid="javafx-linux-${sun.arch.data.model}" />
+-      <fileset refid="jre-optional-linux" />
+-    </delete>
+-
+-    <copy todir="linux/work/java/lib/fonts">
+-      <fileset dir="shared/lib/fonts" includes="*" />
+-    </copy>
++    <!-- <delete>  -->
++    <!--   <fileset refid="javafx-basics" /> -->
++    <!--   <fileset refid="javafx-linux-${sun.arch.data.model}" /> -->
++    <!--   <fileset refid="jre-optional-linux" /> -->
++    <!-- </delete> -->
++
++    <!-- <copy todir="linux/work/java/lib/fonts"> -->
++    <!--   <fileset dir="shared/lib/fonts" includes="*" /> -->
++    <!-- </copy> -->
+ 
+   </target>
+   
+-- 
+2.1.0
+

pkgs/applications/misc/audio/sox/default.nix

@@ -4,6 +4,8 @@
 , enableLame ? false, lame ? null
 , enableLibmad ? true, libmad ? null
 , enableLibogg ? true, libogg ? null, libvorbis ? null
+, enableFLAC ? true, flac ? null
+, enablePNG ? true, libpng ? null
 }:
 
 with stdenv.lib;
@@ -21,7 +23,9 @@ stdenv.mkDerivation rec {
     optional enableLibao libao ++
     optional enableLame lame ++
     optional enableLibmad libmad ++
-    optionals enableLibogg [ libogg libvorbis ];
+    optionals enableLibogg [ libogg libvorbis ] ++
+    optional enableFLAC flac ++
+    optional enablePNG libpng;
 
   meta = {
     description = "Sample Rate Converter for audio";

pkgs/applications/misc/bitcoin/altcoins.nix

@@ -1,5 +1,6 @@
 { fetchurl, stdenv, pkgconfig
-, openssl, db48, boost, zlib, miniupnpc, qt4, qrencode, glib, protobuf, utillinux }:
+, openssl, db48, boost, zlib, miniupnpc, qt4, qrencode, glib, protobuf
+, utillinux, autogen, autoconf, autobuild, automake, db }:
 
 with stdenv.lib;
 
@@ -79,22 +80,51 @@ in rec {
     };
   };
 
-  dogecoin = buildAltcoin rec {
+  dogecoin = (buildAltcoin rec {
     walletName = "dogecoin";
-    version = "1.4";
+    version = "1.8.0";
 
     src = fetchurl {
-      url = "https://github.com/dogecoin/dogecoin/archive/1.4.tar.gz";
-      sha256 = "4af983f182976c98f0e32d525083979c9509b28b7d6faa0b90c5bd40b71009cc";
+      url = "https://github.com/dogecoin/dogecoin/archive/v${version}.tar.gz";
+      sha256 = "8a33958c04213cd621aa3c86910477813af22512f03b47c98995d20d31f3f935";
     };
 
+    extraBuildInputs = [ autogen autoconf automake pkgconfig db utillinux protobuf ];
+
     meta = {
       description = "Wow, such coin, much shiba, very rich";
       longDescription = "wow";
       homepage = http://www.dogecoin.com/;
       maintainers = [ maintainers.offline maintainers.edwtjo ];
     };
+  }).override rec {
+    patchPhase = ''
+      sed -i \
+        -e 's,BDB_CPPFLAGS=$,BDB_CPPFLAGS="-I${db}/include",g' \
+        -e 's,BDB_LIBS=$,BDB_LIBS="-L${db}/lib",g' \
+        -e 's,bdbdirlist=$,bdbdirlist="${db}/include",g' \
+        src/m4/dogecoin_find_bdb51.m4
+    '';
+    dogeConfigure = ''
+      ./autogen.sh \
+      && ./configure --prefix=$out \
+                     --with-incompatible-bdb \
+                     --with-boost-libdir=${boost}/lib \
+    '';
+    dogeInstall = ''
+      install -D "src/dogecoin-cli" "$out/bin/dogecoin-cli"
+      install -D "src/dogecoind" "$out/bin/dogecoind"
+    '';
+    configurePhase = dogeConfigure + "--with-gui";
+    installPhase = dogeInstall + "install -D src/qt/dogecoin-qt $out/bin/dogecoin-qt";
+  };
+
+  dogecoind = dogecoin.override rec {
+    gui = false;
+    makefile = "Makefile";
+    preBuild = "";
+    configurePhase = dogecoin.dogeConfigure + "--without-gui";
+    installPhase = dogecoin.dogeInstall;
   };
-  dogecoind = dogecoin.override { gui = false; };
 
 }

pkgs/applications/misc/calibre/default.nix

@@ -5,11 +5,11 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "calibre-2.0.0";
+  name = "calibre-2.1.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/calibre/${name}.tar.xz";
-    sha256 = "1fpn8icfyag2ybj2ywd81sva56ycsin56gyap5m9j5crx63p4c91";
+    sha256 = "1znwrmz740m08bihkmdijm193bvav4nm313xsagd5x9mjh2nffg7";
   };
 
   inherit python;

pkgs/applications/misc/namecoin/default.nix

@@ -0,0 +1,37 @@
+{ fetchgit, stdenv, db4, boost, openssl, unzip }:
+
+stdenv.mkDerivation rec {
+  version = "0.3.75";
+  name = "namecoin-${version}";
+
+  src = fetchgit {
+    url = "https://github.com/namecoin/namecoin";
+    rev = "31ea638d4ba7f0a3011cb25483f4c7d293134c7a";
+    sha256 = "c14a5663cba675b3508937a26a812316559938fd7b64659dd00749a9f5d7e9e0";
+  };
+
+  # Don't build with miniupnpc due to namecoin using a different verison that
+  # ships with NixOS and it is API incompatible.
+  buildInputs = [ db4 boost openssl unzip ];
+
+  patchPhase = ''
+    sed -e 's/-Wl,-Bstatic//g' -e 's/-l gthread-2.0//g' -e 's/-l z//g' -i src/Makefile
+  '';
+
+  buildPhase = ''
+    make -C src INCLUDEPATHS= LIBPATHS=
+  '';
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp src/namecoind $out/bin
+  '';
+
+  meta = {
+    description = "Decentralized open source information registration and transfer system based on the Bitcoin cryptocurrency";
+    homepage = "http://namecoin.info";
+    license = stdenv.lib.licenses.mit;
+    maintainers = [ stdenv.lib.maintainers.doublec ];
+    platforms = with stdenv.lib.platforms; linux;
+  };
+}

pkgs/applications/misc/namecoin/qt.nix

@@ -0,0 +1,33 @@
+{ fetchgit, stdenv, db4, boost, openssl, qt4, unzip, namecoin }:
+
+stdenv.mkDerivation rec {
+  version = "0.3.75";
+  name = "namecoin-qt-${version}";
+
+  src = namecoin.src;
+
+  # Don't build with miniupnpc due to namecoin using a different verison that
+  # ships with NixOS and it is API incompatible.
+  buildInputs = [ db4 boost openssl unzip qt4 ];
+
+  configurePhase = ''
+    qmake USE_UPNP=-
+  '';
+
+  buildPhase = ''
+    make
+  '';
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp namecoin-qt $out/bin
+  '';
+
+  meta = {
+    description = "Decentralized open source information registration and transfer system based on the Bitcoin cryptocurrency";
+    homepage = "http://namecoin.info";
+    license = stdenv.lib.licenses.mit;
+    maintainers = [ stdenv.lib.maintainers.doublec ];
+    platforms = with stdenv.lib.platforms; linux;
+  };
+}

pkgs/applications/misc/nanoblogger/default.nix

@@ -0,0 +1,29 @@
+{ fetchurl, stdenv, bash }:
+
+stdenv.mkDerivation rec {
+  version = "3.5-rc1";
+  name = "nanoblogger-${version}";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/nanoblogger/${name}.tar.gz";
+    sha256 = "09mv52a5f0h3das8x96irqyznm69arfskx472b7w3b9q4a2ipxbq";
+  };
+
+  buildInputs = [ ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp -r * $out
+    cat > $out/bin/nb << EOF 
+    #!${bash}/bin/bash
+    $out/nb "\$@"
+    EOF
+    chmod 755 $out/bin/nb
+  '';
+
+  meta = {
+    description = "Small weblog engine written in Bash for the command line";
+    homepage = http://nanoblogger.sourceforge.net/;
+    license = stdenv.lib.licenses.gpl2;
+  };
+}

pkgs/applications/misc/pinfo/default.nix

@@ -1,12 +1,23 @@
-{stdenv, fetchurl, ncurses, readline}:
+{ stdenv, fetchurl, autoreconfHook, gettext, texinfo, ncurses, readline }:
 
 stdenv.mkDerivation {
-  name = "pinfo-0.6.9";
-  src = fetchurl {
-    url = https://alioth.debian.org/frs/download.php/1498/pinfo-0.6.9.tar.bz2;
-    sha256 = "1rbsz1y7nyz6ax9xfkw5wk6pnrhvwz2xcm0wnfnk4sb2wwq760q3";
-  };
-  buildInputs = [ncurses readline];
+  name = "pinfo-0.6.10";
 
-  configureFlags = "--with-curses=${ncurses} --with-readline=${readline}";
+  src = fetchurl {
+    # homepage needed you to login to download the tarball
+    url = "http://pkgs.fedoraproject.org/repo/pkgs/pinfo/pinfo-0.6.10.tar.bz2"
+      + "/fe3d3da50371b1773dfe29bf870dbc5b/pinfo-0.6.10.tar.bz2";
+    sha256 = "0p8wyrpz9npjcbx6c973jspm4c3xz4zxx939nngbq49xqah8088j";
+  };
+
+  buildInputs = [ autoreconfHook gettext texinfo ncurses readline ];
+
+  configureFlags = [ "--with-curses=${ncurses}" "--with-readline=${readline}" ];
+
+  meta = with stdenv.lib; {
+    description = "A viewer for info files";
+    homepage = https://alioth.debian.org/projects/pinfo/;
+    license = licenses.gpl2Plus;
+  };
 }
+

pkgs/applications/misc/tilda/default.nix

@@ -0,0 +1,34 @@
+{ stdenv, fetchurl, pkgconfig
+, autoreconfHook, gettext, expat
+, confuse, vte, gtk
+, makeWrapper
+}:
+
+stdenv.mkDerivation rec {
+
+  name = "tilda-${version}";
+  version = "1.1.12";
+
+  src = fetchurl {
+    url = "https://github.com/lanoxx/tilda/archive/${name}.tar.gz";
+    sha256 = "10kjlcdaylkisb8i0cw4wfssg52mrz2lxr5zmw3q4fpnhh2xlaix";
+  };
+
+  buildInputs = [ pkgconfig autoreconfHook gettext confuse vte gtk makeWrapper ];
+
+  LD_LIBRARY_PATH = "${expat}/lib"; # ugly hack for xgettext to work during build
+
+  postInstall = ''
+    wrapProgram "$out/bin/tilda" \
+        --prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A Gtk based drop down terminal for Linux and Unix";
+    homepage = https://github.com/lanoxx/tilda/;
+    license = licenses.gpl3;
+    maintainers = [ maintainers.AndersonTorres ];
+    platforms = platforms.linux;
+  };
+}
+

pkgs/applications/networking/browsers/chromium/source/default.nix

@@ -22,7 +22,7 @@ stdenv.mkDerivation {
 
   prePatch = "patchShebangs .";
 
-  patches = singleton ./sandbox_userns_36.patch;
+  patches = [ ./sandbox_userns_36.patch ./missing_alg_import.patch ];
 
   postPatch = ''
     sed -i -r \

pkgs/applications/networking/browsers/chromium/source/missing_alg_import.patch

@@ -0,0 +1,11 @@
+diff -Naur chromium-37.0.2062.94.old/media/cast/logging/encoding_event_subscriber.cc chromium-37.0.2062.94/media/cast/logging/encoding_event_subscriber.cc
+--- chromium-37.0.2062.94.old/media/cast/logging/encoding_event_subscriber.cc	2014-08-29 02:05:15.149140733 -0700
++++ chromium-37.0.2062.94/media/cast/logging/encoding_event_subscriber.cc	2014-08-29 02:06:00.182853590 -0700
+@@ -4,6 +4,7 @@
+ 
+ #include "media/cast/logging/encoding_event_subscriber.h"
+ 
++#include <algorithm>
+ #include <cstring>
+ #include <utility>
+ 

pkgs/applications/networking/browsers/chromium/source/sources.nix

@@ -1,16 +1,16 @@
 # This file is autogenerated from update.sh in the parent directory.
 {
   dev = {
-    version = "38.0.2125.8";
-    sha256 = "1h3vkp0mgznqv48ksnsndlh7ywh3jby25x6dxxd7py445pg6y3c6";
-    sha256bin32 = "1ynqm5yp7m8j3mwgqaa2vvw835g9ifn3dfniqh9z9n0swha27a69";
-    sha256bin64 = "1vdm4wffkvj3jwrb2nihghxkxcvp81xcc5wygpd1w495vrhy4bpf";
+    version = "39.0.2138.3";
+    sha256 = "0adkzv4ydrg02prcacqx3gk8v0ivvs57qisf220wzzicgpzklm26";
+    sha256bin32 = "0rskbr55nhvpmmw6bl90iv2lr0f2chra3r5c92j3ica307y12f2q";
+    sha256bin64 = "0gdyyaxiaq50jpwhvai6d67ypgjxqn8kp9fqix6nbwj4fnmdfcjx";
   };
   beta = {
-    version = "37.0.2062.94";
-    sha256 = "0cz5kivimxcaiml6x5mysarjyfvvanbw02qz2d1y3jvl1dc1jz6j";
-    sha256bin32 = "0pa209sjdfb0y96kicvp4lnn1inwdcgj8kpmn28cmi8l1cr8yy3b";
-    sha256bin64 = "0kk2dm2gwvzvrrp03k7cw6zzp3197lrq2p1si3pr2wbgm8sb5dk5";
+    version = "38.0.2125.24";
+    sha256 = "07v4vk7sc54d2hzgfms0b71cc7z6h85v9d39j110kzk0w1bpk3gy";
+    sha256bin32 = "0l26ci7sqi755cm017qmbcqk74rqja5c08cbzf5v4chsa773qn0m";
+    sha256bin64 = "1ibx40ijjj8z0smpzh5v6y611c57qm5raldk48h5dd1flqbgz0nr";
   };
   stable = {
     version = "37.0.2062.94";

pkgs/applications/networking/browsers/mozilla-plugins/flashplayer-11/default.nix

@@ -36,7 +36,7 @@
 
 let
   # -> http://get.adobe.com/flashplayer/
-  version = "11.2.202.394";
+  version = "11.2.202.400";
 
   src =
     if stdenv.system == "x86_64-linux" then
@@ -47,7 +47,7 @@ let
       else rec {
         inherit version;
         url = "http://fpdownload.macromedia.com/get/flashplayer/pdc/${version}/install_flash_player_11_linux.x86_64.tar.gz";
-        sha256 = "1w82kmda91xdsrqpkrbcbrzswnbfszy0x9hvf9wf2h14isimdknx";
+        sha256 = "043bzjcqxjkjk68kba5nk77m59k6g71h32bypjpnwaigdgbhafyl";
       }
     else if stdenv.system == "i686-linux" then
       if debug then {
@@ -58,7 +58,7 @@ let
       } else rec {
         inherit version;
         url = "http://fpdownload.macromedia.com/get/flashplayer/pdc/${version}/install_flash_player_11_linux.i386.tar.gz";
-        sha256 = "0c8wp4qn6k224krihxb08g7727wlklk9bl4h7nqp3cpp85x9hg97";
+        sha256 = "1xvfzm926rj0l2mq2kybrvykrv7bjfl3m7p5mvhj1586a3x1gb6h";
       }
     else throw "Flash Player is not supported on this platform";
 

pkgs/applications/networking/cluster/mesos/default.nix

@@ -18,7 +18,7 @@ in stdenv.mkDerivation {
 
   buildInputs = [
     makeWrapper autoconf automake libtool curl sasl jdk maven
-    python wrapPython boto distutils-cfg
+    python wrapPython boto distutils-cfg setuptools
   ];
 
   propagatedBuildInputs = [

pkgs/applications/networking/ids/daq/default.nix

@@ -1,12 +1,12 @@
 {stdenv, fetchurl, flex, bison, libpcap}:
 
 stdenv.mkDerivation rec {
-  name = "daq-2.0.0";
+  name = "daq-2.0.2";
   
   src = fetchurl {
     name = "${name}.tar.gz";
-    url = http://www.snort.org/downloads/2311;
-    sha256 = "0f0w5jfmx0n2sms4f2mfg984a27r7qh927vkd7fclvx9cbiwibzv";
+    url = "http://www.snort.org/downloads/snort/${name}.tar.gz";
+    sha256 = "1a39qbm9nc05yr8llawl7mz0ny1fci4acj9c2k1h4klrqikiwpfn";
   };
   
   buildInputs = [ flex bison libpcap ];

pkgs/applications/networking/ids/snort/default.nix

@@ -1,12 +1,12 @@
 {stdenv, fetchurl, libpcap, pcre, libdnet, daq, zlib, flex, bison}:
 
 stdenv.mkDerivation rec {
-  name = "snort-2.9.4.6";
+  name = "snort-2.9.6.2";
   
   src = fetchurl {
     name = "${name}.tar.gz";
-    url = http://www.snort.org/downloads/2320;
-    sha256 = "1g5kn36l67a5m95h2shqwqbbjb6rgl3sf1bciakal2l4n6857ang";
+    url = "http://www.snort.org/downloads/snort/${name}.tar.gz";
+    sha256 = "0xsxbd5h701ncnhn9sf7zkmzravlqhn1182whinphfjjw72py7cf";
   };
   
   buildInputs = [ libpcap pcre libdnet daq zlib flex bison ];

pkgs/applications/networking/instant-messengers/mcabber/default.nix

@@ -1,19 +1,22 @@
 {stdenv, fetchurl, openssl, ncurses, pkgconfig, glib, loudmouth}:
 
-stdenv.mkDerivation {
-
-  name = "mcabber-0.10.1";
+stdenv.mkDerivation rec {
+  name = "mcabber-${version}";
+  version = "0.10.3";
 
   src = fetchurl {
-    url = "http://mcabber.com/files/mcabber-0.10.1.tar.bz2";
+    url = "http://mcabber.com/files/mcabber-${version}.tar.bz2";
     sha256 = "1248cgci1v2ypb90wfhyipwdyp1wskn3gzh78af5ai1a4w5rrjq0";
   };
 
-  meta = { homepage = "http://mcabber.com/";
-           description = "Small Jabber console client";
-         };
-
   buildInputs = [openssl ncurses pkgconfig glib loudmouth];
 
   configureFlags = "--with-openssl=${openssl}";
+  
+  meta = with stdenv.lib; {
+    homepage = http://mcabber.com/;
+    description = "Small Jabber console client";
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ pSub ];
+  };
 }

pkgs/applications/networking/mumble/murmur.nix

@@ -12,11 +12,11 @@ let
 in
 stdenv.mkDerivation rec {
   name = "murmur-" + version;
-  version = "1.2.6";
+  version = "1.2.8";
 
   src = fetchurl {
     url = "mirror://sourceforge/mumble/mumble-${version}.tar.gz";
-    sha256 = "1zxnbwbd81p7lvscghlpkad8kynh9gbf1nhc092sp64pp37xwv47";
+    sha256 = "0ng1xd7i0951kqnd9visf84y2dcwia79a1brjwfvr1wnykgw6bsc";
   };
 
   patchPhase = optional iceSupport ''

pkgs/applications/networking/remote/rdesktop/default.nix

@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation (rec {
   pname = "rdesktop";
-  version = "1.8.1";
+  version = "1.8.2";
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "mirror://sourceforge/${pname}/${name}.tar.gz";
-    sha256 = "0il248cdsxvwjsl4bswf27ld9r1a7d48jf6bycr86kf3i55q7k3n";
+    sha256 = "0y0s0qjfsflp4drcn75ykx6as7mn13092bcvlp2ibhilkpa27gzv";
   };
 
   buildInputs = [openssl libX11];
@@ -20,5 +20,8 @@ stdenv.mkDerivation (rec {
 
   meta = {
     description = "Open source client for Windows Terminal Services";
+    homepage = http://www.rdesktop.org/;
+    platforms = stdenv.lib.platforms.linux;
+    license     = stdenv.lib.licenses.gpl2;
   };
 })

pkgs/applications/networking/sync/backintime/common.nix

@@ -0,0 +1,46 @@
+{stdenv, fetchurl, makeWrapper, gettext, python2, python2Packages }:
+
+stdenv.mkDerivation rec {
+  version = "1.0.36";
+
+  name = "backintime-common-${version}";
+
+  src = fetchurl {
+    url = "https://launchpad.net/backintime/1.0/${version}/+download/backintime-${version}.tar.gz";
+    md5 = "28630bc7bd5f663ba8fcfb9ca6a742d8";
+  };
+
+  # because upstream tarball has no top-level directory.
+  # https://bugs.launchpad.net/backintime/+bug/1359076
+  sourceRoot = ".";
+
+  buildInputs = [ makeWrapper gettext python2 python2Packages.dbus ];
+
+  installFlags = [ "DEST=$(out)" ];
+
+  preConfigure = "cd common";
+
+  dontAddPrefix = true;
+
+  preFixup =
+    ''
+    substituteInPlace "$out/bin/backintime" \
+      --replace "=\"/usr/share" "=\"$prefix/share"
+    wrapProgram "$out/bin/backintime" \
+      --prefix PYTHONPATH : "$PYTHONPATH" \
+      --prefix PATH : "$prefix/bin:$PATH"
+    '';
+
+  meta = {
+    homepage = https://launchpad.net/backintime;
+    description = "Simple backup tool for Linux";
+    license = stdenv.lib.licenses.gpl2;
+    maintainers = [ stdenv.lib.maintainers.DamienCassou ];
+    platforms = stdenv.lib.platforms.all;
+    longDescription = ''
+      Back In Time is a simple backup tool (on top of rsync) for Linux
+      inspired from “flyback project” and “TimeVault”. The backup is
+      done by taking snapshots of a specified set of directories.
+    '';
+  };
+}

pkgs/applications/networking/sync/backintime/gnome.nix

@@ -0,0 +1,37 @@
+{stdenv, fetchurl, makeWrapper, gettext, python2, python2Packages, gnome2, pkgconfig, pygobject, glib, libtool, backintime-common }:
+
+stdenv.mkDerivation rec {
+  inherit (backintime-common) version src sourceRoot installFlags meta;
+
+  name = "backintime-gnome-${version}";
+
+  buildInputs = [ makeWrapper gettext python2 python2Packages.dbus backintime-common python2Packages.pygtk python2Packages.notify gnome2.gnome_python ];
+
+  preConfigure = "cd gnome";
+  configureFlags = [ "--no-check" ];
+
+  preFixup =
+      ''
+      # Make sure all Python files refer to $prefix/share/backintime
+      # instead of config.get_app_path() which returns the path of the
+      # 'common' module, not the path of the 'gnome' module.
+      filelist=$(mktemp)
+      find "$out/share/backintime/gnome" -name "*.py" -print0 > $filelist
+      while IFS="" read -r -d "" file <&9; do
+      substituteInPlace "$file" \
+         --replace "glade_file = os.path.join(config.get_app_path()," \
+                   "glade_file = os.path.join('$prefix/share/backintime'," \
+         --replace "glade_file = os.path.join(self.config.get_app_path()," \
+                   "glade_file = os.path.join('$prefix/share/backintime',"
+      done 9< "$filelist"
+      rm "$filelist"
+
+      substituteInPlace "$out/bin/backintime-gnome" \
+        --replace "=\"/usr/share" "=\"$prefix/share"
+
+      wrapProgram "$out/bin/backintime-gnome" \
+        --prefix PYTHONPATH : "${gnome2.gnome_python}/lib/python2.7/site-packages/gtk-2.0:${backintime-common}/share/backintime/common:$PYTHONPATH" \
+        --prefix PATH : "${backintime-common}/bin:$PATH"
+    '';
+
+}

pkgs/applications/office/homebank/default.nix

@@ -2,7 +2,7 @@
 
 let
    download_root = "http://homebank.free.fr/public/";
-   name = "homebank-4.5.5";
+   name = "homebank-4.6.3";
    lastrelease = download_root + name + ".tar.gz";
    oldrelease = download_root + "old/" + name + ".tar.gz";
 in
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     urls = [ lastrelease oldrelease ];
-    sha256 = "05k4497qsb6fzr662h9yxz1amsavd287wh0sabrpr9jdbh3jcfkg";
+    sha256 = "0j39788xz9m7ic277phffznbl35c1dm1g7dgq83va9nni6vipqzn";
   };
 
   buildInputs = [ pkgconfig gtk libofx intltool ];

pkgs/applications/office/libreoffice/default.nix

@@ -24,8 +24,8 @@ let
   langsSpaces = stdenv.lib.concatStringsSep " " langs;
   major = "4";
   minor = "3";
-  patch = "0";
-  tweak = "4";
+  patch = "1";
+  tweak = "2";
   subdir = "${major}.${minor}.${patch}";
   version = "${subdir}${if tweak == "" then "" else "."}${tweak}";
 
@@ -79,14 +79,14 @@ let
 
     translations = fetchSrc {
       name = "translations";
-      sha256 = "1l445284mih0c7d6v3ps1piy5pbjvisyrjjvlrqizvwxqm7bxpr1";
+      sha256 = "0vj1fpr99cb124hag0hijpp3pfbbi0gak56qiikxbwbq7mab6p9h";
     };
 
     # TODO: dictionaries
 
     help = fetchSrc {
       name = "help";
-      sha256 = "0avsc11d4nmycsxvadr0xcd8z9506sjcc89hgmliqlmhmw48ax7y";
+      sha256 = "1q0vzfla764zjz6xcx6r4nc8rikwb3pr2jsraj28hhwr5b26gdfz";
     };
 
   };
@@ -96,7 +96,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "http://download.documentfoundation.org/libreoffice/src/${subdir}/libreoffice-${version}.tar.xz";
-    sha256 = "1r605nwjdq20qd96chqic1bjkw7y36wmpg2lzzvv5sz6gw12rzi8";
+    sha256 = "0s1j5y1gfyf3r53bbqnzirx17p49i8ah07737nrzik0ggps3lgd5";
   };
 
   # Openoffice will open libcups dynamically, so we link it directly

pkgs/applications/office/libreoffice/libreoffice-srcs.nix

@@ -184,6 +184,11 @@
   md5 = "1e9ddfe25ac9577da709d7b2ea36f939";
   brief = false;
 }
+{
+  name = "source-sans-pro-2.010R-ro-1.065R-it.tar.gz";
+  md5 = "edc4d741888bc0d38e32dbaa17149596";
+  brief = false;
+}
 {
   name = "libfreehand-0.1.0.tar.bz2";
   md5 = "5f029fef73e42a2c2ae4524a7513f97d";
@@ -326,8 +331,8 @@
 }
 {
   name = "libgltf-0.0.0.tar.bz2";
-  md5 = "3d9ea1f2828c46f8ba94b88a87b3326d";
-  brief = false;
+  md5 = "ca5436e916bfe70694adfe2607782786";
+  brief = true;
   subDir = "libgltf/";
 }
 {

pkgs/applications/office/zim/default.nix

@@ -0,0 +1,82 @@
+{ stdenv, lib, fetchurl, buildPythonPackage, pythonPackages, pygtk, pygobject, python }:
+
+#
+# TODO: Declare configuration options for the following optional dependencies:
+#  -  File stores: hg, git, bzr
+#  -  Included plugins depenencies: dot, ditaa, dia, any other?
+#  -  pyxdg: Need to make it work first (see setupPyInstallFlags).
+#
+
+buildPythonPackage rec {
+  name = "zim-${version}";
+  version = "0.60";
+  namePrefix = "";
+  
+  src = fetchurl {
+    url = "http://zim-wiki.org/downloads/zim-0.61.tar.gz";
+    sha256 = "0jncxkf83bwra3022jbvjfwhk5w8az0jlwr8nsvm7wa1zfrajhsq";
+  };
+
+  propagatedBuildInputs = [ pythonPackages.sqlite3 pygtk /*pythonPackages.pyxdg*/ pygobject ];
+
+  preBuild = ''
+    mkdir -p $tmp/home
+    export HOME="$tmp/home"
+  '';
+  
+  setupPyInstallFlags = ["--skip-xdg-cmd"];
+  
+  #
+  # Exactly identical to buildPythonPackage's version but for the
+  # `--old-and-unmanagable`, which I removed. This was removed because
+  # this is a setuptools specific flag and as zim is overriding 
+  # the install step, setuptools could not perform its monkey
+  # patching trick for the command. Alternate solutions were to
+  #
+  #  -  Remove the custom install step (tested as working but
+  #	also remove the possibility of performing the xdg-cmd
+  #     stuff).
+  #  -  Explicitly replace distutils import(s) by their setuptools
+  #	equivalent (untested). 
+  #
+  # Both solutions were judged unsatisfactory as altering the code
+  # would be required.
+  #
+  # Note that a improved solution would be to expose the use of 
+  # the `--old-and-unmanagable` flag as an option of passed to the
+  # buildPythonPackage function.
+  #
+  # Also note that I stripped all comments.
+  #
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p "$out/lib/${python.libPrefix}/site-packages"
+
+    export PYTHONPATH="$out/lib/${python.libPrefix}/site-packages:$PYTHONPATH"
+
+    ${python}/bin/${python.executable} setup.py install \
+      --install-lib=$out/lib/${python.libPrefix}/site-packages \
+      --prefix="$out" ${lib.concatStringsSep " " setupPyInstallFlags}
+
+    eapth="$out/lib/${python.libPrefix}"/site-packages/easy-install.pth
+    if [ -e "$eapth" ]; then
+	# move colliding easy_install.pth to specifically named one
+	mv "$eapth" $(dirname "$eapth")/${name}.pth
+    fi
+
+    rm -f "$out/lib/${python.libPrefix}"/site-packages/site.py*
+
+    runHook postInstall
+  '';
+  
+  # Testing fails.
+  doCheck = false;
+
+  meta = {
+      description = "A desktop wiki";
+      homepage = http://zim-wiki.org;
+      license = stdenv.lib.licenses.gpl2Plus;
+  };
+}
+

pkgs/applications/science/logic/tptp/default.nix

@@ -11,14 +11,14 @@ let
     (builtins.attrNames (builtins.removeAttrs x helperArgNames));
   sourceInfo = rec {
     baseName="TPTP";
-    version="6.0.0";
+    version="6.1.0";
     name="${baseName}-${version}";
     urls=
     [
     "http://www.cs.miami.edu/~tptp/TPTP/Distribution/TPTP-v${version}.tgz"
     "http://www.cs.miami.edu/~tptp/TPTP/Archive/TPTP-v${version}/TPTP-v${version}.tgz"
     ];
-    hash="0jnjkqdz937c7mkxvh9wc3byw5h1k19jss058fbzdxxc2hkwq1af";
+    hash="054p0kx9qh619ixslxpb4qcwvcqr4kan154b3a87b546b78k7kv4";
   };
 in
 rec {

pkgs/applications/science/math/pari/default.nix

@@ -1,11 +1,12 @@
 { stdenv, fetchurl, gmp, readline }:
 
 stdenv.mkDerivation rec {
-  name = "pari-2.5.5";
+  version = "2.7.1";
+  name = "pari-${version}";
 
   src = fetchurl {
     url = "http://pari.math.u-bordeaux.fr/pub/pari/unix/${name}.tar.gz";
-    sha256 = "058nw1fhggy7idii4f124ami521lv3izvngs9idfz964aks8cvvn";
+    sha256 = "1gj1rddi22hinzwy7r6hljgbi252wwwyd6gapg4hvcn0ycc7jqyc";
   };
 
   buildInputs = [gmp readline];
@@ -21,5 +22,9 @@ stdenv.mkDerivation rec {
     license     = "GPLv2+";
     maintainers = with stdenv.lib.maintainers; [ertes raskin];
     platforms   = stdenv.lib.platforms.linux;
+
+    inherit version;
+    downloadPage = "http://pari.math.u-bordeaux.fr/download.html";
+    updateWalker = true;
   };
 }

pkgs/applications/science/misc/boinc/default.nix

@@ -3,12 +3,12 @@ mesa, libXmu, libXi, freeglut, libjpeg, libtool, wxGTK, xcbutil,
 sqlite, gtk, patchelf, libXScrnSaver, libnotify, libX11, libxcb }:
 
 stdenv.mkDerivation rec {
-  name = "boinc-7.2.42";
+  name = "boinc-7.4.14";
 
   src = fetchgit {
     url = "git://boinc.berkeley.edu/boinc-v2.git";
-    rev = "dd0d630882547c123ca0f8fda7a62e058d60f6a9";
-    sha256 = "1zifpi3mjgaj68fba6kammp3x7z8n2x164zz6fj91xfiapnan56j";
+    rev = "fb31ab18f94f3b5141bea03e8537d76c606cd276";
+    sha256 = "1465zl8l87fm1ps5f2may6mcc3pp40mpd6wphpxnwwk1lmv48x96";
   };
 
   buildInputs = [ libtool automake autoconf m4 pkgconfig curl mesa libXmu libXi

pkgs/applications/version-management/git-and-tools/git-annex/default.nix

@@ -17,8 +17,8 @@
 
 cabal.mkDerivation (self: {
   pname = "git-annex";
-  version = "5.20140817";
-  sha256 = "0cly19rd250qiikzszgad2r5xz570kr00vcb8ij6icbm53pw3hxc";
+  version = "5.20140831";
+  sha256 = "0s2pc8bm3c79dsbafwp2pc5yghzh6vdzs9sj0mfq6rxiv27wrrwq";
   isLibrary = false;
   isExecutable = true;
   buildDepends = [

pkgs/applications/version-management/gource/default.nix

@@ -3,11 +3,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "gource-0.40";
+  version = "0.42";
+  name = "gource-${version}";
 
   src = fetchurl {
-    url = "http://gource.googlecode.com/files/${name}.tar.gz";
-    sha256 = "04nirh07xjslqsph557as4s50nlf91bi6v2l7vmbifmkdf90m2cw";
+    url = "https://github.com/acaudwell/Gource/releases/download/${name}/${name}.tar.gz";
+    sha256 = "08ab57z44y8b5wxg1193j6hiy50njbpi6dwafjh6nb0apcq8ziz5";
   };
 
   buildInputs = [

pkgs/applications/version-management/guitone/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, fetchmtn, qt4 }:
+{ stdenv, fetchurl, fetchmtn, qt4, pkgconfig, graphviz }:
 
 let version = "1.0-mtn-head"; in
 stdenv.mkDerivation rec {
@@ -11,12 +11,12 @@ stdenv.mkDerivation rec {
 
   src = fetchmtn {
     dbs = ["mtn://code.monotone.ca/guitone"];
-    selector = "2777cdef424c65df93fa1ff181f02ee30d4901ab";
-    sha256 = "918d36a83060b84efa0ee0fe0fd058f1c871c91156d91366e2e979c886ff4271";
+    selector = "3a728afdbd3943b1d86c2a249b1e2ede7bf64c27";
+    sha256 = "01vs8m00phs5pl75mjkpdarynfpkqrg0qf4rsn95czi3q6nxiaq5";
     branch = "net.venge.monotone.guitone";
   };
 
-  buildInputs = [ qt4 ];
+  buildInputs = [ qt4 pkgconfig graphviz ];
 
   prefixKey="PREFIX=";
   configureScript = "qmake guitone.pro";

pkgs/applications/video/mkvtoolnix/default.nix

@@ -15,14 +15,18 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "mkvtoolnix-6.5.0";
+  version = "7.1.0";
+  name = "mkvtoolnix-${version}";
 
   src = fetchurl {
     url = "http://www.bunkus.org/videotools/mkvtoolnix/sources/${name}.tar.xz";
-    sha256 = "0a3h878bsjbpb2r7b528xzyqzl8r82yhrniry9bnhmw7rcl53bd8";
+    sha256 = "06xqy4f7gi1xj0yqb6y1wmxwvsxfxal2plfsbl33dkwd0srixj06";
   };
 
-  buildInputs = [ libmatroska flac libvorbis file boost xdg_utils expat wxGTK zlib ruby gettext pkgconfig curl ];
+  buildInputs = [
+    libmatroska flac libvorbis file boost xdg_utils
+    expat wxGTK zlib ruby gettext pkgconfig curl
+  ];
 
   configureFlags = "--with-boost-libdir=${boost}/lib";
   buildPhase = ''
@@ -36,5 +40,7 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Cross-platform tools for Matroska";
     homepage = http://www.bunkus.org/videotools/mkvtoolnix/;
+    license = stdenv.lib.licenses.gpl2;
+    maintainers = with stdenv.lib.maintainers; [ fuuzetsu ];
   };
 }

pkgs/build-support/setup-hooks/make-wrapper.sh

@@ -96,7 +96,10 @@ filterExisting() {
 # Syntax: wrapProgram <PROGRAM> <MAKE-WRAPPER FLAGS...>
 wrapProgram() {
     local prog="$1"
-    local hidden="$(dirname "$prog")/.$(basename "$prog")"-wrapped
+    local progBasename=$(basename $prog)
+    local hiddenDir="$(dirname $prog)/../wrapped-bin/.$progBasename-wrapped-bin"
+    mkdir -p $hiddenDir
+    local hidden="$(cd "$hiddenDir"; pwd)/$progBasename"
     mv $prog $hidden
     makeWrapper $hidden $prog "$@"
 }

pkgs/build-support/upstream-updater/update-walker-service-specific.sh

@@ -8,6 +8,10 @@ SF_version_dir () {
   version_link 'http://sourceforge.net/.+/'"$1"'[0-9.]+/$'
 }
 
+SF_version_tarball () {
+  version_link '[.]tar[.].*/download$'
+}
+
 GH_latest () {
   prefetch_command_rel ../fetchgit/nix-prefetch-git
   revision "$("$(dirname "$0")/urls-from-page.sh" "$CURRENT_URL/commits" | grep /commit/ | head -n 1 | xargs basename )"

pkgs/build-support/upstream-updater/update-walker.sh

@@ -280,6 +280,12 @@ do_overwrite_just_version () {
   set_var_value sha256 $CURRENT_HASH
 }
 
+minimize_overwrite() {
+  do_overwrite(){
+    do_overwrite_just_version
+  }
+}
+
 process_config () {
   CONFIG_DIR="$(directory_of "$1")"
   CONFIG_NAME="$(basename "$1")"
@@ -297,9 +303,7 @@ process_config () {
       exit 1;
     }
     [ -z "$(retrieve_meta fullRegenerate)" ] && eval "
-      do_overwrite(){
-        do_overwrite_just_version
-      }
+      minimize_overwrite
     "
   fi
   ensure_attribute_name

pkgs/data/fonts/cm-unicode/default.nix

@@ -9,17 +9,16 @@ let
   buildInputs = map (n: builtins.getAttr n x)
     (builtins.attrNames (builtins.removeAttrs x helperArgNames));
   sourceInfo = rec {
-    version="0.6.3a";
+    version = "0.7.0";
     baseName="cm-unicode";
     name="${baseName}-${version}";
-    url="ftp://canopus.iacp.dvo.ru/pub/Font/cm_unicode/${name}-otf.tar.gz";
-    hash="1018gmvh7wl7sm6f3fqd917syd1yy0gz3pxmrc9lkxckcr7wz0zp";
+    url="mirror://sourceforge/${baseName}/${baseName}/${version}/${name}-otf.tar.xz";
   };
 in
 rec {
   src = a.fetchurl {
     url = sourceInfo.url;
-    sha256 = sourceInfo.hash;
+    sha256 = "0a0w9qm9g8qz2xh3lr61bj1ymqslqsvk4w2ybc3v2qa89nz7x2jl";
   };
 
   inherit (sourceInfo) name version;
@@ -34,11 +33,8 @@ rec {
     ];
     platforms = with a.lib.platforms;
       all;
-  };
-  passthru = {
-    updateInfo = {
-      downloadPage = "http://canopus.iacp.dvo.ru/~panov/cm-unicode/download.html";
-    };
+    downloadPage = "http://sourceforge.net/projects/cm-unicode/files/cm-unicode/";
+    inherit version;
   };
 }) x