Merge remote-tracking branch 'upstream/master' into hardened-stdenv

2016-07-31 20:51:34 +00:00 · 2016-07-31 20:51:34 +00:00 · 63c7b4f9a7
commit 63c7b4f9a7
parent 43ba8d295f a629cd3f02
701 changed files with 12952 additions and 15151 deletions
--- a/doc/coding-conventions.xml
+++ b/doc/coding-conventions.xml
@ -251,16 +251,13 @@ bound to the variable name <varname>e2fsprogs</varname> in

  <listitem><para>The version part of the <literal>name</literal>
  attribute <emphasis>must</emphasis> start with a digit (following a
-  dash) — e.g., <literal>"hello-0.3-pre-r3910"</literal> instead of
-  <literal>"hello-svn-r3910"</literal>, as the latter would be seen as
-  a package named <literal>hello-svn</literal> by
-  <command>nix-env</command>.</para></listitem>
+  dash) — e.g., <literal>"hello-0.3.1rc2"</literal>.</para></listitem>

-  <listitem><para>If package is fetched from git's commit then
+  <listitem><para>If a package is not a release but a commit from a repository, then
  the version part of the name <emphasis>must</emphasis> be the date of that 
  (fetched) commit. The date must be in <literal>"YYYY-MM-DD"</literal> format.
-  Also add <literal>"git"</literal> to the name - e.g.,
-  <literal>"pkgname-git-2014-09-23"</literal>.</para></listitem>
+  Also append <literal>"unstable"</literal> to the name - e.g.,
+  <literal>"pkgname-unstable-2014-09-23"</literal>.</para></listitem>

  <listitem><para>Dashes in the package name should be preserved
  in new variable names, rather than converted to underscores
--- a/lib/licenses.nix
+++ b/lib/licenses.nix
@ -195,6 +195,11 @@ lib.mapAttrs (n: v: v // { shortName = n; }) rec {
    fullName = "Unspecified free software license";
  };

+  g4sl = {
+    fullName = "Geant4 Software License";
+    url = https://geant4.web.cern.ch/geant4/license/LICENSE.html;
+  };
+
  gpl1 = spdx {
    spdxId = "GPL-1.0";
    fullName = "GNU General Public License v1.0 only";
--- a/lib/maintainers.nix
+++ b/lib/maintainers.nix
@ -338,6 +338,7 @@
  robberer = "Longrin Wischnewski <robberer@freakmail.de>";
  robbinch = "Robbin C. <robbinch33@gmail.com>";
  robgssp = "Rob Glossop <robgssp@gmail.com>";
+  roblabla = "Robin Lambertz <robinlambertz+dev@gmail.com>";
  roconnor = "Russell O'Connor <roconnor@theorem.ca>";
  romildo = "José Romildo Malaquias <malaquias@gmail.com>";
  rszibele = "Richard Szibele <richard_szibele@hotmail.com>";
--- a/lib/sources.nix
+++ b/lib/sources.nix
@ -55,10 +55,11 @@ rec {
           # packed-refs file, so we have to grep through it:
           else if lib.pathExists packedRefsName
           then
-             let packedRefs  = lib.splitString "\n" (readFile packedRefsName);
-                 matchRule   = match ("^(.*) " + file + "$");
-                 matchedRefs = lib.flatten (lib.filter (m: ! (isNull m)) (map matchRule packedRefs));
-             in lib.head matchedRefs
+             let fileContent = readFile packedRefsName;
+                 matchRef    = match ".*\n([^\n ]*) " + file + "\n.*" fileContent;
+             in if   isNull matchRef
+                then throw ("Could not find " + file + " in " + packedRefsName)
+                else lib.head matchRef
           else throw ("Not a .git directory: " + path);
    in lib.flip readCommitFromFile "HEAD";
 }
--- a/maintainers/scripts/generate-kde-plasma.sh
+++ b/maintainers/scripts/generate-kde-plasma.sh
@ -1,5 +1,5 @@
 #!/bin/sh

 ./maintainers/scripts/fetch-kde-qt.sh \
-    http://download.kde.org/stable/plasma/5.7.1/ -A '*.tar.xz' \
+    http://download.kde.org/stable/plasma/5.7.2/ -A '*.tar.xz' \
    >pkgs/desktops/kde-5/plasma/srcs.nix
--- a/maintainers/scripts/generate-qt.sh
+++ b/maintainers/scripts/generate-qt.sh
@ -1,3 +1,6 @@
 #!/bin/sh

-./fetch-kde-qt.sh http://download.qt.io/official_releases/qt/5.6/5.6.1/submodules/ -A '*.tar.xz'
+./maintainers/scripts/fetch-kde-qt.sh \
+    http://download.qt.io/official_releases/qt/5.7/5.7.0/submodules/ \
+    -A '*.tar.xz' \
+    >pkgs/development/libraries/qt-5/5.7/srcs.nix
--- a/nixos/doc/manual/default.nix
+++ b/nixos/doc/manual/default.nix
@ -1,27 +1,27 @@
 { pkgs, options, version, revision, extraSources ? [] }:

 with pkgs;
-with pkgs.lib;

 let
+  lib = pkgs.lib;

  # Remove invisible and internal options.
-  optionsList = filter (opt: opt.visible && !opt.internal) (optionAttrSetToDocList options);
+  optionsList = lib.filter (opt: opt.visible && !opt.internal) (lib.optionAttrSetToDocList options);

  # Replace functions by the string <function>
  substFunction = x:
-    if builtins.isAttrs x then mapAttrs (name: substFunction) x
+    if builtins.isAttrs x then lib.mapAttrs (name: substFunction) x
    else if builtins.isList x then map substFunction x
    else if builtins.isFunction x then "<function>"
    else x;

  # Clean up declaration sites to not refer to the NixOS source tree.
-  optionsList' = flip map optionsList (opt: opt // {
+  optionsList' = lib.flip map optionsList (opt: opt // {
    declarations = map stripAnyPrefixes opt.declarations;
  }
-  // optionalAttrs (opt ? example) { example = substFunction opt.example; }
-  // optionalAttrs (opt ? default) { default = substFunction opt.default; }
-  // optionalAttrs (opt ? type) { type = substFunction opt.type; });
+  // lib.optionalAttrs (opt ? example) { example = substFunction opt.example; }
+  // lib.optionalAttrs (opt ? default) { default = substFunction opt.default; }
+  // lib.optionalAttrs (opt ? type) { type = substFunction opt.type; });

  # We need to strip references to /nix/store/* from options,
  # including any `extraSources` if some modules came from elsewhere,
@ -30,7 +30,7 @@ let
  # E.g. if some `options` came from modules in ${pkgs.customModules}/nix,
  # you'd need to include `extraSources = [ pkgs.customModules ]`
  prefixesToStrip = map (p: "${toString p}/") ([ ../../.. ] ++ extraSources);
-  stripAnyPrefixes = flip (fold removePrefix) prefixesToStrip;
+  stripAnyPrefixes = lib.flip (lib.fold lib.removePrefix) prefixesToStrip;

  # Convert the list of options into an XML file.
  optionsXML = builtins.toFile "options.xml" (builtins.toXML optionsList');
@ -49,7 +49,7 @@ let
      -o $out ${./options-to-docbook.xsl} $optionsXML
  '';

-  sources = sourceFilesBySuffices ./. [".xml"];
+  sources = lib.sourceFilesBySuffices ./. [".xml"];

  copySources =
    ''
@ -143,7 +143,7 @@ in rec {
      mkdir -p $dst

      cp ${builtins.toFile "options.json" (builtins.unsafeDiscardStringContext (builtins.toJSON
-        (listToAttrs (map (o: { name = o.name; value = removeAttrs o ["name" "visible" "internal"]; }) optionsList'))))
+        (builtins.listToAttrs (map (o: { name = o.name; value = removeAttrs o ["name" "visible" "internal"]; }) optionsList'))))
      } $dst/options.json

      mkdir -p $out/nix-support
@ -193,6 +193,43 @@ in rec {
    allowedReferences = ["out"];
  };

+
+  manualEpub = stdenv.mkDerivation {
+    name = "nixos-manual-epub";
+
+    inherit sources;
+
+    buildInputs = [ libxml2 libxslt zip ];
+
+    buildCommand = ''
+      ${copySources}
+
+      # Check the validity of the manual sources.
+      xmllint --noout --nonet --xinclude --noxincludenode \
+        --relaxng ${docbook5}/xml/rng/docbook/docbook.rng \
+        manual.xml
+
+      # Generate the epub manual.
+      dst=$out/share/doc/nixos
+
+      xsltproc \
+        ${manualXsltprocOptions} \
+        --stringparam target.database.document "${olinkDB}/olinkdb.xml" \
+        --nonet --xinclude --output $dst/epub/ \
+        ${docbook5_xsl}/xml/xsl/docbook/epub/docbook.xsl ./manual.xml
+
+      mkdir -p $dst/epub/OEBPS/images/callouts
+      cp -r ${docbook5_xsl}/xml/xsl/docbook/images/callouts/*.gif $dst/epub/OEBPS/images/callouts
+      echo "application/epub+zip" > mimetype
+      zip -0Xq  "$dst/NixOS Manual - NixOS community.epub" mimetype
+      zip -Xr9D "$dst/NixOS Manual - NixOS community.epub" $dst/epub/*
+
+      mkdir -p $out/nix-support
+      echo "doc-epub manual $dst/NixOS Manual - NixOS community.epub" >> $out/nix-support/hydra-build-products
+    '';
+  };
+
+
  manualPDF = stdenv.mkDerivation {
    name = "nixos-manual-pdf";

--- a/nixos/modules/config/pulseaudio.nix
+++ b/nixos/modules/config/pulseaudio.nix
@ -9,11 +9,36 @@ let

  systemWide = cfg.enable && cfg.systemWide;
  nonSystemWide = cfg.enable && !cfg.systemWide;
+  hasZeroconf = let z = cfg.zeroconf; in z.publish.enable || z.discovery.enable;
+
+  overriddenPackage = cfg.package.override
+    (optionalAttrs hasZeroconf { zeroconfSupport = true; });
+  binary = "${getBin overriddenPackage}/bin/pulseaudio";
+  binaryNoDaemon = "${binary} --daemonize=no";

  # Forces 32bit pulseaudio and alsaPlugins to be built/supported for apps
  # using 32bit alsa on 64bit linux.
  enable32BitAlsaPlugins = cfg.support32Bit && stdenv.isx86_64 && (pkgs_i686.alsaLib != null && pkgs_i686.libpulseaudio != null);

+
+  myConfigFile =
+    let
+      addModuleIf = cond: mod: optionalString cond "load-module ${mod}";
+      allAnon = optional cfg.tcp.anonymousClients.allowAll "auth-anonymous=1";
+      ipAnon =  let a = cfg.tcp.anonymousClients.allowedIpRanges;
+                in optional (a != []) ''auth-ip-acl=${concatStringsSep ";" a}'';
+    in writeTextFile {
+      name = "default.pa";
+        text = ''
+        .include ${cfg.configFile}
+        ${addModuleIf cfg.zeroconf.publish.enable "module-zeroconf-publish"}
+        ${addModuleIf cfg.zeroconf.discovery.enable "module-zeroconf-discover"}
+        ${addModuleIf cfg.tcp.enable (concatStringsSep " "
+           ([ "load-module module-native-protocol-tcp" ] ++ allAnon ++ ipAnon))}
+        ${cfg.extraConfig}
+      '';
+    };
+
  ids = config.ids;

  uid = ids.uids.pulseaudio;
@ -26,7 +51,7 @@ let
  # are built with PulseAudio support (like KDE).
  clientConf = writeText "client.conf" ''
    autospawn=${if nonSystemWide then "yes" else "no"}
-    ${optionalString nonSystemWide "daemon-binary=${cfg.package.out}/bin/pulseaudio"}
+    ${optionalString nonSystemWide "daemon-binary=${binary}"}
    ${cfg.extraClientConf}
  '';

@ -44,7 +69,7 @@ let
      hint.description "Default Audio Device (via PulseAudio)"
    }
    ctl_type.pulse {
-      libs.native = ${alsaPlugins}/lib/alsa-lib/libasound_module_ctl_pulse.so ;
+      libs.native = ${pkgs.alsaPlugins}/lib/alsa-lib/libasound_module_ctl_pulse.so ;
      ${lib.optionalString enable32BitAlsaPlugins
     "libs.32Bit = ${pkgs_i686.alsaPlugins}/lib/alsa-lib/libasound_module_ctl_pulse.so ;"}
    }
@ -89,16 +114,25 @@ in {
      };

      configFile = mkOption {
-        type = types.path;
+        type = types.nullOr types.path;
        description = ''
-          The path to the configuration the PulseAudio server
+          The path to the default configuration options the PulseAudio server
          should use. By default, the "default.pa" configuration
          from the PulseAudio distribution is used.
        '';
      };

+      extraConfig = mkOption {
+        type = types.lines;
+        default = "";
+        description = ''
+          Literal string to append to <literal>configFile</literal>
+          and the config file generated by the pulseaudio module.
+        '';
+      };
+
      extraClientConf = mkOption {
-        type = types.str;
+        type = types.lines;
        default = "";
        description = ''
          Extra configuration appended to pulse/client.conf file.
@ -127,6 +161,31 @@ in {
          '';
        };
      };
+
+      zeroconf = {
+        discovery.enable =
+          mkEnableOption "discovery of pulseaudio sinks in the local network";
+        publish.enable =
+          mkEnableOption "publishing the pulseaudio sink in the local network";
+      };
+
+      # TODO: enable by default?
+      tcp = {
+        enable = mkEnableOption "tcp streaming support";
+
+        anonymousClients = {
+          allowAll = mkEnableOption "all anonymous clients to stream to the server";
+          allowedIpRanges = mkOption {
+            type = types.listOf types.str;
+            default = [];
+            example = literalExample ''[ "127.0.0.1" "192.168.1.0/24" ]'';
+            description = ''
+              A list of IP subnets that are allowed to stream to the server.
+            '';
+          };
+        };
+      };
+
    };

  };
@ -139,11 +198,11 @@ in {
        source = clientConf;
      };

-      hardware.pulseaudio.configFile = mkDefault "${getBin cfg.package}/etc/pulse/default.pa";
+      hardware.pulseaudio.configFile = mkDefault "${getBin overriddenPackage}/etc/pulse/default.pa";
    }

    (mkIf cfg.enable {
-      environment.systemPackages = [ cfg.package ];
+      environment.systemPackages = [ overriddenPackage ];

      environment.etc = singleton {
        target = "asound.conf";
@ -152,12 +211,21 @@ in {

      # Allow PulseAudio to get realtime priority using rtkit.
      security.rtkit.enable = true;
+
+    })
+
+    (mkIf hasZeroconf {
+      services.avahi.enable = true;
+    })
+    (mkIf cfg.zeroconf.publish.enable {
+      services.avahi.publish.enable = true;
+      services.avahi.publish.userServices = true;
    })

    (mkIf nonSystemWide {
      environment.etc = singleton {
        target = "pulse/default.pa";
-        source = cfg.configFile;
+        source = myConfigFile;
      };

      systemd.user = {
@ -167,10 +235,12 @@ in {
          wantedBy = [ "default.target" ];
          serviceConfig = {
            Type = "notify";
-            ExecStart = "${getBin cfg.package}/bin/pulseaudio --daemonize=no";
+            ExecStart = binaryNoDaemon;
            Restart = "on-failure";
+            RestartSec = "500ms";
          };
          environment = { DISPLAY = ":${toString config.services.xserver.display}"; };
+          restartIfChanged = true;
        };

        sockets.pulseaudio = {
@ -205,8 +275,9 @@ in {
        environment.PULSE_RUNTIME_PATH = stateDir;
        serviceConfig = {
          Type = "notify";
-          ExecStart = "${getBin cfg.package}/bin/pulseaudio --daemonize=no --log-level=${cfg.daemon.logLevel} --system -n --file=${cfg.configFile}";
+          ExecStart = "${binaryNoDaemon} --log-level=${cfg.daemon.logLevel} --system -n --file=${myConfigFile}";
          Restart = "on-failure";
+          RestartSec = "500ms";
        };
      };
    })
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -473,7 +473,7 @@
  ./services/web-servers/lighttpd/gitweb.nix
  ./services/web-servers/lighttpd/inginious.nix
  ./services/web-servers/nginx/default.nix
-  ./services/web-servers/phpfpm/default.nix
+  ./services/web-servers/phpfpm.nix
  ./services/web-servers/shellinabox.nix
  ./services/web-servers/tomcat.nix
  ./services/web-servers/uwsgi.nix
--- a/nixos/modules/programs/ssmtp.nix
+++ b/nixos/modules/programs/ssmtp.nix
@ -100,6 +100,12 @@ in
          Password used for SMTP auth. (STORED PLAIN TEXT, WORLD-READABLE IN NIX STORE)
        '';
      };
+      
+      setSendmail = mkOption {
+        type = types.bool;
+        default = true;
+        description = "Whether to set the system sendmail to ssmtp's.";
+      };

    };

@ -122,6 +128,13 @@ in
      '';

    environment.systemPackages = [pkgs.ssmtp];
+    
+    services.mail.sendmailSetuidWrapper = mkIf cfg.setSendmail {
+      program = "sendmail";
+      source = "${pkgs.ssmtp}/bin/sendmail";
+      setuid = false;
+      setgid = false;
+    };

  };

--- a/nixos/modules/programs/tmux.nix
+++ b/nixos/modules/programs/tmux.nix
@ -27,7 +27,7 @@ let
    set -g status-keys ${cfg.keyMode}
    set -g mode-keys   ${cfg.keyMode}

-    ${if cfg.keyMode == "vi" then ''
+    ${if cfg.keyMode == "vi" && cfg.customPaneNavigationAndResize then ''
    bind h select-pane -L
    bind j select-pane -D
    bind k select-pane -U
@ -86,6 +86,13 @@ in {
        description = "Use 24 hour clock.";
      };

+      customPaneNavigationAndResize = mkOption {
+        default = false;
+        example = true;
+        type = types.bool;
+        description = "Override the hjkl and HJKL bindings for pane navigation and resizing in VI mode.";
+      };
+
      escapeTime = mkOption {
        default = 500;
        example = 0;
--- a/nixos/modules/services/audio/mopidy.nix
+++ b/nixos/modules/services/audio/mopidy.nix
@ -47,6 +47,7 @@ in {
      };

      configuration = mkOption {
+        default = "";
        type = types.lines;
        description = ''
          The configuration that Mopidy should use.
--- a/nixos/modules/services/continuous-integration/gocd-server/default.nix
+++ b/nixos/modules/services/continuous-integration/gocd-server/default.nix
@ -67,33 +67,33 @@ in {
      };

      packages = mkOption {
-        default = [ pkgs.stdenv pkgs.jre config.programs.ssh.package pkgs.nix ];
+        default = [ pkgs.stdenv pkgs.jre pkgs.git config.programs.ssh.package pkgs.nix ];
        type = types.listOf types.package;
        description = ''
          Packages to add to PATH for the Go.CD server's process.
        '';
      };

-      heapSize = mkOption {
+      initialJavaHeapSize = mkOption {
        default = "512m";
        type = types.str;
        description = ''
-          Specifies the java heap memory size for the Go.CD server's java process.
+          Specifies the initial java heap memory size for the Go.CD server's java process.
        '';
      };

-      maxMemory = mkOption {
+      maxJavaHeapMemory = mkOption {
        default = "1024m";
        type = types.str;
        description = ''
-          Specifies the java maximum memory size for the Go.CD server's java process.
+          Specifies the java maximum heap memory size for the Go.CD server's java process.
        '';
      };

      extraOptions = mkOption {
        default = [
-          "-Xms${cfg.heapSize}"
-          "-Xmx${cfg.maxMemory}"
+          "-Xms${cfg.initialJavaHeapSize}"
+          "-Xmx${cfg.maxJavaHeapMemory}"
          "-Dcruise.listen.host=${cfg.listenAddress}"
          "-Duser.language=en"
          "-Djruby.rack.request.size.threshold.bytes=30000000"
--- a/nixos/modules/services/logging/logstash.nix
+++ b/nixos/modules/services/logging/logstash.nix
@ -51,12 +51,6 @@ in
        description = "Logging verbosity level.";
      };

-      watchdogTimeout = mkOption {
-        type = types.int;
-        default = 10;
-        description = "Set watchdog timeout value in seconds.";
-      };
-
      filterWorkers = mkOption {
        type = types.int;
        default = 1;
@ -140,7 +134,6 @@ in
          "-w ${toString cfg.filterWorkers} " +
          ops havePluginPath "--pluginpath ${pluginPath} " +
          "${verbosityFlag} " +
-          "--watchdog-timeout ${toString cfg.watchdogTimeout} " +
          "-f ${writeText "logstash.conf" ''
            input {
              ${cfg.inputConfig}
--- a/nixos/modules/services/mail/rmilter.nix
+++ b/nixos/modules/services/mail/rmilter.nix
@ -75,7 +75,7 @@ in

      bindUnixSockets =  mkOption {
        type = types.listOf types.str;
-        default = ["/run/rmilter.sock"];
+        default = ["/run/rmilter/rmilter.sock"];
        description = ''
          Unix domain sockets to listen for MTA requests.
        '';
@ -114,7 +114,7 @@ in

        servers = mkOption {
          type = types.listOf types.str;
-          default = ["r:/run/rspamd.sock"];
+          default = ["r:/run/rspamd/rspamd.sock"];
          description = ''
            Spamd socket definitions.
            Is server name is prefixed with r: it is rspamd server.
@ -197,7 +197,7 @@ milter_default_action = accept

      serviceConfig = {
        ExecStart = "${pkgs.rmilter}/bin/rmilter ${optionalString cfg.debug "-d"} -n -c ${rmilterConfigFile}";
-        ExecReload = "/bin/kill -USR1 $MAINPID";
+        ExecReload = "${pkgs.coreutils}/bin/kill -USR1 $MAINPID";
        User = cfg.user;
        Group = cfg.group;
        PermissionsStartOnly = true;
@ -212,10 +212,10 @@ milter_default_action = accept
      description = "Rmilter service socket";
      wantedBy = [ "sockets.target" ];
      socketConfig = {
-          ListenStream = cfg.bindUnixSockets ++ cfg.bindInetSockets;
-          SocketUser = cfg.user;
-          SocketGroup = cfg.group;
-          SocketMode = "0660";
+        ListenStream = cfg.bindUnixSockets ++ cfg.bindInetSockets;
+        SocketUser = cfg.user;
+        SocketGroup = cfg.group;
+        SocketMode = "0666";
      };
    };

--- a/nixos/modules/services/mail/rspamd.nix
+++ b/nixos/modules/services/mail/rspamd.nix
@ -8,7 +8,7 @@ let

  mkBindSockets = socks: concatStringsSep "\n" (map (each: "  bind_socket = \"${each}\"") socks);

-  rspamdConf =
+   rspamdConfFile = pkgs.writeText "rspamd.conf"
    ''
      .include "$CONFDIR/common.conf"

@ -18,8 +18,7 @@ let
      }

      logging {
-        type = "file";
-        filename = "$LOGDIR/rspamd.log";
+        type = "syslog";
        .include "$CONFDIR/logging.inc"
      }

@ -33,7 +32,6 @@ let
        .include "$CONFDIR/worker-controller.inc"
      }
   '';
-   rspamdConfFile = pkgs.writeText "rspamd.conf" rspamdConf;

 in

@ -45,10 +43,7 @@ in

    services.rspamd = {

-      enable = mkOption {
-        default = false;
-        description = "Whether to run the rspamd daemon.";
-      };
+      enable = mkEnableOption "Whether to run the rspamd daemon.";

      debug = mkOption {
        default = false;
@ -58,7 +53,7 @@ in
      bindSocket = mkOption {
        type = types.listOf types.str;
        default = [
-          "/run/rspamd.sock mode=0666 owner=${cfg.user}"
+          "/run/rspamd/rspamd.sock mode=0666 owner=${cfg.user}"
        ];
        description = ''
          List of sockets to listen, in format acceptable by rspamd
@ -97,7 +92,6 @@ in
        '';
       };
    };
-
  };


@ -128,18 +122,15 @@ in

      serviceConfig = {
        ExecStart = "${pkgs.rspamd}/bin/rspamd ${optionalString cfg.debug "-d"} --user=${cfg.user} --group=${cfg.group} --pid=/run/rspamd.pid -c ${rspamdConfFile} -f";
-        RuntimeDirectory = "/var/lib/rspamd";
-        PermissionsStartOnly = true;
        Restart = "always";
+        RuntimeDirectory = "rspamd";
+        PrivateTmp = true;
      };

      preStart = ''
-        ${pkgs.coreutils}/bin/mkdir -p /var/{lib,log}/rspamd
+        ${pkgs.coreutils}/bin/mkdir -p /var/lib/rspamd
        ${pkgs.coreutils}/bin/chown ${cfg.user}:${cfg.group} /var/lib/rspamd
      '';
-
    };
-
  };
-
 }
--- a/nixos/modules/services/misc/matrix-synapse.nix
+++ b/nixos/modules/services/misc/matrix-synapse.nix
@ -522,10 +522,12 @@ in {
      after = [ "network.target" ];
      wantedBy = [ "multi-user.target" ];
      preStart = ''
-        mkdir -p /var/lib/matrix-synapse
-        chmod 700 /var/lib/matrix-synapse
-        chown -R matrix-synapse:matrix-synapse /var/lib/matrix-synapse
-        ${cfg.package}/bin/homeserver --config-path ${configFile} --keys-directory /var/lib/matrix-synapse/ --generate-keys
+        if ! test -e /var/lib/matrix-synapse; then
+          mkdir -p /var/lib/matrix-synapse
+          chmod 700 /var/lib/matrix-synapse
+          chown -R matrix-synapse:matrix-synapse /var/lib/matrix-synapse
+          ${cfg.package}/bin/homeserver --config-path ${configFile} --keys-directory /var/lib/matrix-synapse/ --generate-keys
+        fi
      '';
      serviceConfig = {
        Type = "simple";
--- a/nixos/modules/services/monitoring/dd-agent.nix
+++ b/nixos/modules/services/monitoring/dd-agent.nix
@ -72,6 +72,7 @@ let
  postgresqlConfig = pkgs.writeText "postgres.yaml" cfg.postgresqlConfig;
  nginxConfig = pkgs.writeText "nginx.yaml" cfg.nginxConfig;
  mongoConfig = pkgs.writeText "mongo.yaml" cfg.mongoConfig;
+  jmxConfig = pkgs.writeText "jmx.yaml" cfg.jmxConfig;
  
  etcfiles =
    [ { source = ddConf;
@ -94,6 +95,10 @@ let
    (optional (cfg.mongoConfig != null)
      { source = mongoConfig;
        target = "dd-agent/conf.d/mongo.yaml";
+      }) ++
+    (optional (cfg.jmxConfig != null)
+      { source = jmxConfig;
+        target = "dd-agent/conf.d/jmx.yaml";
      });

 in {
@ -141,6 +146,13 @@ in {
      default = null;
      type = types.uniq (types.nullOr types.string);
    };
+
+    jmxConfig = mkOption {
+      description = "JMX integration configuration";
+      default = null;
+      type = types.uniq (types.nullOr types.string);
+    };
+
  };

  config = mkIf cfg.enable {
@ -167,7 +179,7 @@ in {
        Restart = "always";
        RestartSec = 2;
      };
-      restartTriggers = [ pkgs.dd-agent ddConf diskConfig networkConfig postgresqlConfig nginxConfig mongoConfig ];
+      restartTriggers = [ pkgs.dd-agent ddConf diskConfig networkConfig postgresqlConfig nginxConfig mongoConfig jmxConfig ];
    };

    systemd.services.dogstatsd = {
@ -183,7 +195,21 @@ in {
        Restart = "always";
        RestartSec = 2;
      };
-      restartTriggers = [ pkgs.dd-agent ddConf diskConfig networkConfig postgresqlConfig nginxConfig mongoConfig ];
+      restartTriggers = [ pkgs.dd-agent ddConf diskConfig networkConfig postgresqlConfig nginxConfig mongoConfig jmxConfig ];
+    };
+
+    systemd.services.dd-jmxfetch = lib.mkIf (cfg.jmxConfig != null) {
+      description = "Datadog JMX Fetcher";
+      path = [ pkgs."dd-agent" pkgs.python pkgs.sysstat pkgs.procps pkgs.jdk ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        ExecStart = "${pkgs.dd-agent}/bin/dd-jmxfetch";
+        User = "datadog";
+        Group = "datadog";
+        Restart = "always";
+        RestartSec = 2;
+      };
+      restartTriggers = [ pkgs.dd-agent ddConf diskConfig networkConfig postgresqlConfig nginxConfig mongoConfig jmxConfig ];
    };

    environment.etc = etcfiles;
--- a/nixos/modules/services/networking/firewall.nix
+++ b/nixos/modules/services/networking/firewall.nix
@ -101,9 +101,22 @@ let
    # Perform a reverse-path test to refuse spoofers
    # For now, we just drop, as the raw table doesn't have a log-refuse yet
    ${optionalString (kernelHasRPFilter && cfg.checkReversePath) ''
-      if ! ip46tables -A PREROUTING -t raw -m rpfilter --invert -j DROP; then
-        echo "<2>failed to initialise rpfilter support" >&2
-      fi
+      # Clean up rpfilter rules
+      ip46tables -t raw -D PREROUTING -j nixos-fw-rpfilter 2> /dev/null || true
+      ip46tables -t raw -F nixos-fw-rpfilter 2> /dev/null || true
+      ip46tables -t raw -N nixos-fw-rpfilter 2> /dev/null || true
+
+      ip46tables -t raw -A nixos-fw-rpfilter -m rpfilter -j RETURN
+
+      # Allows this host to act as a DHCPv4 server
+      iptables -t raw -A nixos-fw-rpfilter -s 0.0.0.0 -d 255.255.255.255 -p udp --sport 68 --dport 67 -j RETURN
+
+      ${optionalString cfg.logReversePathDrops ''
+        ip46tables -t raw -A nixos-fw-rpfilter -j LOG --log-level info --log-prefix "rpfilter drop: "
+      ''}
+      ip46tables -t raw -A nixos-fw-rpfilter -j DROP
+
+      ip46tables -t raw -A PREROUTING -j nixos-fw-rpfilter
    ''}

    # Accept all traffic on the trusted interfaces.
@ -188,9 +201,7 @@ let
    ip46tables -D INPUT -j nixos-fw 2>/dev/null || true

    ${optionalString (kernelHasRPFilter && cfg.checkReversePath) ''
-      if ! ip46tables -D PREROUTING -t raw -m rpfilter --invert -j DROP; then
-        echo "<2>failed to stop rpfilter support" >&2
-      fi
+      ip46tables -t raw -D PREROUTING -j nixos-fw-rpfilter 2>/dev/null || true
    ''}

    ${cfg.extraStopCommands}
@ -376,6 +387,16 @@ in
        '';
    };

+    networking.firewall.logReversePathDrops = mkOption {
+      default = false;
+      type = types.bool;
+      description =
+        ''
+          Logs dropped packets failing the reverse path filter test if
+          the option networking.firewall.checkReversePath is enabled.
+        '';
+    };
+
    networking.firewall.connectionTrackingModules = mkOption {
      default = [ "ftp" ];
      example = [ "ftp" "irc" "sane" "sip" "tftp" "amanda" "h323" "netbios_sn" "pptp" "snmp" ];
--- a/nixos/modules/services/networking/syncthing.nix
+++ b/nixos/modules/services/networking/syncthing.nix
@ -114,8 +114,8 @@ in

    environment.systemPackages = [ cfg.package ];

-    systemd.services.syncthing = mkIf cfg.systemService
-      header // {
+    systemd.services = mkIf cfg.systemService {
+      syncthing = header // {
        wantedBy = [ "multi-user.target" ];
        serviceConfig = service // {
          User = cfg.user;
@ -124,6 +124,7 @@ in
          ExecStart = "${cfg.package}/bin/syncthing -no-browser -home=${cfg.dataDir}";
        };
      };
+    };

    systemd.user.services.syncthing =
      header // {
--- a/nixos/modules/services/networking/tinc.nix
+++ b/nixos/modules/services/networking/tinc.nix
@ -157,6 +157,7 @@ in
        serviceConfig = {
          Type = "simple";
          PIDFile = "/run/tinc.${network}.pid";
+          Restart = "on-failure";
        };
        preStart = ''
          mkdir -p /etc/tinc/${network}/hosts
--- a/nixos/modules/services/web-apps/tt-rss.nix
+++ b/nixos/modules/services/web-apps/tt-rss.nix
@ -17,6 +17,7 @@ let
    else cfg.database.port;

  poolName = "tt-rss";
+  phpfpmSocketName = "/var/run/phpfpm/${poolName}.sock";
  virtualHostName = "tt-rss";

  tt-rss-config = pkgs.writeText "config.php" ''
@ -448,23 +449,21 @@ let
    root = "/var/lib/tt-rss";
  in mkIf cfg.enable {

-    services.phpfpm.pools = if cfg.pool == "${poolName}" then {
-      "${poolName}" =  {
-        listen = "/var/run/phpfpm/${poolName}.sock";
-        extraConfig = ''
-          listen.owner = nginx
-          listen.group = nginx
-          listen.mode = 0600
-          user = nginx
-          pm = dynamic
-          pm.max_children = 75
-          pm.start_servers = 10
-          pm.min_spare_servers = 5
-          pm.max_spare_servers = 20
-          pm.max_requests = 500
-          catch_workers_output = 1
-        '';
-      };
+    services.phpfpm.poolConfigs = if cfg.pool == "${poolName}" then {
+      "${poolName}" = ''
+        listen = "${phpfpmSocketName}";
+        listen.owner = nginx
+        listen.group = nginx
+        listen.mode = 0600
+        user = nginx
+        pm = dynamic
+        pm.max_children = 75
+        pm.start_servers = 10
+        pm.min_spare_servers = 5
+        pm.max_spare_servers = 20
+        pm.max_requests = 500
+        catch_workers_output = 1
+      '';
    } else {};

    # TODO: Re-enable after https://github.com/NixOS/nixpkgs/pull/15862 is merged
@ -486,7 +485,7 @@ let
    #     locations."~ \.php$" = {
    #       extraConfig = ''
    #         fastcgi_split_path_info ^(.+\.php)(/.+)$;
-    #         fastcgi_pass unix:${config.services.phpfpm.pools."${cfg.pool}".listen};
+    #         fastcgi_pass unix:${phpfpmSocketName};
    #         fastcgi_index index.php;
    #         fastcgi_param SCRIPT_FILENAME ${root}/$fastcgi_script_name;

--- a/nixos/modules/services/web-servers/lighttpd/cgit.nix
+++ b/nixos/modules/services/web-servers/lighttpd/cgit.nix
@ -63,6 +63,11 @@ in
      }
    '';

+    systemd.services.lighttpd.preStart = ''
+      mkdir -p /var/cache/cgit
+      chown lighttpd:lighttpd /var/cache/cgit
+    '';
+
  };

 }
--- a/nixos/modules/services/web-servers/lighttpd/default.nix
+++ b/nixos/modules/services/web-servers/lighttpd/default.nix
@ -224,12 +224,6 @@ in
      description = "Lighttpd Web Server";
      after = [ "network.target" ];
      wantedBy = [ "multi-user.target" ];
-      preStart = ''
-        ${if cfg.cgit.enable then ''
-          mkdir -p /var/cache/cgit
-          chown lighttpd:lighttpd /var/cache/cgit
-        '' else ""}
-      '';
      serviceConfig.ExecStart = "${pkgs.lighttpd}/sbin/lighttpd -D -f ${configFile}";
      # SIGINT => graceful shutdown
      serviceConfig.KillSignal = "SIGINT";
--- a/nixos/modules/services/web-servers/phpfpm/default.nix
+++ b/nixos/modules/services/web-servers/phpfpm/default.nix
@ -9,12 +9,6 @@ let

  pidFile = "${stateDir}/phpfpm.pid";

-  mkPool = n: p: ''
-    [${n}]
-    listen = ${p.listen}
-    ${p.extraConfig}
-  '';
-
  cfgFile = pkgs.writeText "phpfpm.conf" ''
    [global]
    pid = ${pidFile}
@ -22,7 +16,7 @@ let
    daemonize = yes
    ${cfg.extraConfig}

-    ${concatStringsSep "\n" (mapAttrsToList mkPool cfg.pools)}
+    ${concatStringsSep "\n" (mapAttrsToList (n: v: "[${n}]\n${v}") cfg.poolConfigs)}
  '';

  phpIni = pkgs.writeText "php.ini" ''
@ -67,19 +61,33 @@ in {
          "Options appended to the PHP configuration file <filename>php.ini</filename>.";
      };

-      pools = mkOption {
-        type = types.attrsOf (types.submodule (import ./pool-options.nix {
-          inherit lib;
-        }));
+      poolConfigs = mkOption {
+        type = types.attrsOf types.lines;
        default = {};
+        example = literalExample ''
+          { mypool = '''
+              listen = /run/phpfpm/mypool
+              user = nobody
+              pm = dynamic
+              pm.max_children = 75
+              pm.start_servers = 10
+              pm.min_spare_servers = 5
+              pm.max_spare_servers = 20
+              pm.max_requests = 500
+            ''';
+          }
+        '';
        description = ''
-          If no pools are defined, the phpfpm service is disabled.
+          A mapping between PHP FPM pool names and their configurations.
+          See the documentation on <literal>php-fpm.conf</literal> for
+          details on configuration directives. If no pools are defined,
+          the phpfpm service is disabled.
        '';
      };
    };
  };

-  config = mkIf (cfg.pools != {}) {
+  config = mkIf (cfg.poolConfigs != {}) {

    systemd.services.phpfpm = {
      wantedBy = [ "multi-user.target" ];
--- a/nixos/modules/services/web-servers/phpfpm/pool-options.nix
+++ b/nixos/modules/services/web-servers/phpfpm/pool-options.nix
@ -1,35 +0,0 @@
-{ lib }:
-
-with lib; {
-
-  options = {
-
-    listen = mkOption {
-      type = types.str;
-      example = "/path/to/unix/socket";
-      description = ''
-        The address on which to accept FastCGI requests.
-      '';
-    };
-
-    extraConfig = mkOption {
-      type = types.lines;
-      example = ''
-        user = nobody
-        pm = dynamic
-        pm.max_children = 75
-        pm.start_servers = 10
-        pm.min_spare_servers = 5
-        pm.max_spare_servers = 20
-        pm.max_requests = 500
-      '';
-
-      description = ''
-        Extra lines that go into the pool configuration.
-        See the documentation on <literal>php-fpm.conf</literal> for
-        details on configuration directives.
-      '';
-    };
-  };
-}
-
--- a/nixos/modules/services/x11/desktop-managers/gnome3.nix
+++ b/nixos/modules/services/x11/desktop-managers/gnome3.nix
@ -84,7 +84,7 @@ in {

    environment.gnome3.packageSet = mkOption {
      default = null;
-      example = literalExample "pkgs.gnome3_18";
+      example = literalExample "pkgs.gnome3_20";
      description = "Which GNOME 3 package set to use.";
      apply = p: if p == null then pkgs.gnome3 else p;
    };
--- a/nixos/modules/services/x11/desktop-managers/kde5.nix
+++ b/nixos/modules/services/x11/desktop-managers/kde5.nix
@ -148,7 +148,7 @@ in
        kde5.kde-gtk-config

        pkgs.phonon-backend-gstreamer
-        pkgs.kde5.phonon-backend-gstreamer
+        pkgs.qt5.phonon-backend-gstreamer
      ]

      # Plasma 5.5 and later has a Breeze GTK theme.
@ -214,7 +214,7 @@ in
    services.xserver.displayManager.sddm = {
      theme = "breeze";
      themes = [
-        kde5.extra-cmake-modules # for the setup-hook
+        kde5.ecm # for the setup-hook
        kde5.plasma-workspace
        kde5.breeze-icons
        (kde5.oxygen-icons or kde5.oxygen-icons5)
--- a/nixos/modules/services/x11/window-managers/default.nix
+++ b/nixos/modules/services/x11/window-managers/default.nix
@ -18,6 +18,7 @@ in
    ./i3.nix
    ./jwm.nix
    ./metacity.nix
+    ./mwm.nix
    ./openbox.nix
    ./pekwm.nix
    ./notion.nix
--- a/nixos/modules/services/x11/window-managers/mwm.nix
+++ b/nixos/modules/services/x11/window-managers/mwm.nix
@ -0,0 +1,25 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.xserver.windowManager.mwm;
+in
+{
+  ###### interface
+  options = {
+    services.xserver.windowManager.mwm.enable = mkEnableOption "mwm";
+  };
+
+  ###### implementation
+  config = mkIf cfg.enable {
+    services.xserver.windowManager.session = singleton {
+      name = "mwm";
+      start = ''
+        ${pkgs.motif}/bin/mwm &
+        waitPID=$!
+      '';
+    };
+    environment.systemPackages = [ pkgs.motif ];
+  };
+}
--- a/nixos/modules/services/x11/xserver.nix
+++ b/nixos/modules/services/x11/xserver.nix
@ -14,9 +14,6 @@ let
  # Map video driver names to driver packages. FIXME: move into card-specific modules.
  knownVideoDrivers = {
    virtualbox = { modules = [ kernelPackages.virtualboxGuestAdditions ]; driverName = "vboxvideo"; };
-    ati = { modules = with pkgs.xorg; [ xf86videoati glamoregl ]; };
-    intel = { modules = with pkgs.xorg; [ xf86videointel glamoregl ]; };
-    modesetting = { modules = []; };
  };

  fontsForXServer =
@ -512,7 +509,7 @@ in
            XKB_BINDIR = "${xorg.xkbcomp}/bin"; # Needed for the Xkb extension.
            XORG_DRI_DRIVER_PATH = "/run/opengl-driver/lib/dri"; # !!! Depends on the driver selected at runtime.
            LD_LIBRARY_PATH = concatStringsSep ":" (
-              [ "${xorg.libX11.out}/lib" "${xorg.libXext.out}/lib" ]
+              [ "${xorg.libX11.out}/lib" "${xorg.libXext.out}/lib" "/run/opengl-driver/lib" ]
              ++ concatLists (catAttrs "libPath" cfg.drivers));
          } // cfg.displayManager.job.environment;

--- a/nixos/modules/system/etc/setup-etc.pl
+++ b/nixos/modules/system/etc/setup-etc.pl
@ -22,6 +22,33 @@ sub atomicSymlink {
 # current configuration.
 atomicSymlink $etc, $static or die;

+# Returns 1 if the argument points to the files in /etc/static.  That
+# means either argument is a symlink to a file in /etc/static or a
+# directory with all children being static.
+sub isStatic {
+    my $path = shift;
+
+    if (-l $path) {
+        my $target = readlink $path;
+        return substr($target, 0, length "/etc/static/") eq "/etc/static/";
+    }
+
+    if (-d $path) {
+        opendir DIR, "$path" or return 0;
+        my @names = readdir DIR or die;
+        closedir DIR;
+
+        foreach my $name (@names) {
+            next if $name eq "." || $name eq "..";
+            unless (isStatic("$path/$name")) {
+                return 0;
+            }
+        }
+        return 1;
+    }
+
+    return 0;
+}

 # Remove dangling symlinks that point to /etc/static.  These are
 # configuration files that existed in a previous configuration but not
@ -63,6 +90,16 @@ sub link {
    my $target = "/etc/$fn";
    File::Path::make_path(dirname $target);
    $created{$fn} = 1;
+
+    # Rename doesn't work if target is directory.
+    if (-l $_ && -d $target) {
+        if (isStatic $target) {
+            rmtree $target or warn;
+        } else {
+            warn "$target directory contains user files. Symlinking may fail.";
+        }
+    }
+
    if (-e "$_.mode") {
        my $mode = read_file("$_.mode"); chomp $mode;
        if ($mode eq "direct-symlink") {
--- a/nixos/modules/virtualisation/containers.nix
+++ b/nixos/modules/virtualisation/containers.nix
@ -6,37 +6,212 @@ let

  # The container's init script, a small wrapper around the regular
  # NixOS stage-2 init script.
-  containerInit = pkgs.writeScript "container-init"
+  containerInit = (cfg:
+    let
+      renderExtraVeth = (name: cfg:
+        ''
+        echo "Bringing ${name} up"
+        ip link set dev ${name} up
+        ${optionalString (cfg . "localAddress" or null != null) ''
+          echo "Setting ip for ${name}"
+          ip addr add ${cfg . "localAddress"} dev ${name}
+        ''}
+        ${optionalString (cfg . "localAddress6" or null != null) ''
+          echo "Setting ip6 for ${name}"
+          ip -6 addr add ${cfg . "localAddress6"} dev ${name}
+        ''}
+        ${optionalString (cfg . "hostAddress" or null != null) ''
+          echo "Setting route to host for ${name}"
+          ip route add ${cfg . "hostAddress"} dev ${name}
+        ''}
+        ${optionalString (cfg . "hostAddress6" or null != null) ''
+          echo "Setting route6 to host for ${name}"
+          ip -6 route add ${cfg . "hostAddress6"} dev ${name}
+        ''}
+        ''
+        );
+    in
+      pkgs.writeScript "container-init"
+      ''
+        #! ${pkgs.stdenv.shell} -e
+
+        # Initialise the container side of the veth pair.
+        if [ "$PRIVATE_NETWORK" = 1 ]; then
+
+          ip link set host0 name eth0
+          ip link set dev eth0 up
+
+          if [ -n "$LOCAL_ADDRESS" ]; then
+            ip addr add $LOCAL_ADDRESS dev eth0
+          fi
+          if [ -n "$LOCAL_ADDRESS6" ]; then
+            ip -6 addr add $LOCAL_ADDRESS6 dev eth0
+          fi
+          if [ -n "$HOST_ADDRESS" ]; then
+            ip route add $HOST_ADDRESS dev eth0
+            ip route add default via $HOST_ADDRESS
+          fi
+          if [ -n "$HOST_ADDRESS6" ]; then
+            ip -6 route add $HOST_ADDRESS6 dev eth0
+            ip -6 route add default via $HOST_ADDRESS6
+          fi
+
+          ${concatStringsSep "\n" (mapAttrsToList renderExtraVeth cfg . "extraVeths" or {})}
+          ip a
+          ip r
+        fi
+
+        # Start the regular stage 1 script.
+        exec "$1"
+      ''
+    );
+
+  nspawnExtraVethArgs = (name: cfg: "--network-veth-extra=${name}");
+  startScript = (cfg:
    ''
-      #! ${pkgs.stdenv.shell} -e
+      mkdir -p -m 0755 "$root/etc" "$root/var/lib"
+      mkdir -p -m 0700 "$root/var/lib/private" "$root/root" /run/containers
+      if ! [ -e "$root/etc/os-release" ]; then
+        touch "$root/etc/os-release"
+      fi
+
+      if ! [ -e "$root/etc/machine-id" ]; then
+        touch "$root/etc/machine-id"
+      fi
+
+      mkdir -p -m 0755 \
+        "/nix/var/nix/profiles/per-container/$INSTANCE" \
+        "/nix/var/nix/gcroots/per-container/$INSTANCE"
+
+      cp --remove-destination /etc/resolv.conf "$root/etc/resolv.conf"

-      # Initialise the container side of the veth pair.
      if [ "$PRIVATE_NETWORK" = 1 ]; then
-
-        ip link set host0 name eth0
-        ip link set dev eth0 up
-
-        if [ -n "$LOCAL_ADDRESS" ]; then
-          ip addr add $LOCAL_ADDRESS dev eth0
-        fi
-        if [ -n "$LOCAL_ADDRESS6" ]; then
-          ip -6 addr add $LOCAL_ADDRESS6 dev eth0
-        fi
-        if [ -n "$HOST_ADDRESS" ]; then
-          ip route add $HOST_ADDRESS dev eth0
-          ip route add default via $HOST_ADDRESS
-        fi
-        if [ -n "$HOST_ADDRESS6" ]; then
-          ip -6 route add $HOST_ADDRESS6 dev eth0
-          ip -6 route add default via $HOST_ADDRESS6
+        extraFlags+=" --network-veth"
+        if [ -n "$HOST_BRIDGE" ]; then
+          extraFlags+=" --network-bridge=$HOST_BRIDGE"
        fi
      fi

-      # Start the regular stage 1 script, passing the bind-mounted
-      # notification socket from the host to allow the container
-      # systemd to signal readiness to the host systemd.
-      NOTIFY_SOCKET=/var/lib/private/host-notify exec "$1"
-    '';
+      ${if cfg . "extraVeths" or null != null then
+        ''extraFlags+=" ${concatStringsSep " " (mapAttrsToList nspawnExtraVethArgs cfg . "extraVeths" or {})}"''
+        else
+          ''# No extra veth pairs to create''
+      }
+
+      for iface in $INTERFACES; do
+        extraFlags+=" --network-interface=$iface"
+      done
+
+      for iface in $MACVLANS; do
+        extraFlags+=" --network-macvlan=$iface"
+      done
+
+      # If the host is 64-bit and the container is 32-bit, add a
+      # --personality flag.
+      ${optionalString (config.nixpkgs.system == "x86_64-linux") ''
+        if [ "$(< ''${SYSTEM_PATH:-/nix/var/nix/profiles/per-container/$INSTANCE/system}/system)" = i686-linux ]; then
+          extraFlags+=" --personality=x86"
+        fi
+      ''}
+
+      # Run systemd-nspawn without startup notification (we'll
+      # wait for the container systemd to signal readiness).
+      EXIT_ON_REBOOT=1 \
+      exec ${config.systemd.package}/bin/systemd-nspawn \
+        --keep-unit \
+        -M "$INSTANCE" -D "$root" $extraFlags \
+        $EXTRA_NSPAWN_FLAGS \
+        --notify-ready=yes \
+        --bind-ro=/nix/store \
+        --bind-ro=/nix/var/nix/db \
+        --bind-ro=/nix/var/nix/daemon-socket \
+        --bind="/nix/var/nix/profiles/per-container/$INSTANCE:/nix/var/nix/profiles" \
+        --bind="/nix/var/nix/gcroots/per-container/$INSTANCE:/nix/var/nix/gcroots" \
+        --setenv PRIVATE_NETWORK="$PRIVATE_NETWORK" \
+        --setenv HOST_BRIDGE="$HOST_BRIDGE" \
+        --setenv HOST_ADDRESS="$HOST_ADDRESS" \
+        --setenv LOCAL_ADDRESS="$LOCAL_ADDRESS" \
+        --setenv HOST_ADDRESS6="$HOST_ADDRESS6" \
+        --setenv LOCAL_ADDRESS6="$LOCAL_ADDRESS6" \
+        --setenv PATH="$PATH" \
+        ${containerInit cfg} "''${SYSTEM_PATH:-/nix/var/nix/profiles/system}/init"
+    ''
+    );
+
+  preStartScript = (cfg:
+    ''
+      # Clean up existing machined registration and interfaces.
+      machinectl terminate "$INSTANCE" 2> /dev/null || true
+
+      if [ "$PRIVATE_NETWORK" = 1 ]; then
+        ip link del dev "ve-$INSTANCE" 2> /dev/null || true
+        ip link del dev "vb-$INSTANCE" 2> /dev/null || true
+      fi
+
+      ${concatStringsSep "\n" (
+        mapAttrsToList (name: cfg:
+          ''ip link del dev ${name} 2> /dev/null || true ''
+        ) cfg . "extraVeths" or {}
+      )}
+   ''
+    );
+  postStartScript = (cfg:
+    let
+      ipcall = (cfg: ipcmd: variable: attribute:
+        if cfg . attribute or null == null then
+          ''
+            if [ -n "${variable}" ]; then
+              ${ipcmd} add ${variable} dev $ifaceHost
+            fi
+          ''
+        else
+          ''${ipcmd} add ${cfg . attribute} dev $ifaceHost''
+        );
+      renderExtraVeth = (name: cfg:
+        if cfg . "hostBridge" or null != null then
+          ''
+            # Add ${name} to bridge ${cfg.hostBridge}
+            ip link set dev ${name} master ${cfg.hostBridge} up
+          ''
+        else
+          ''
+          # Set IPs and routes for ${name}
+          ${optionalString (cfg . "hostAddress" or null != null) ''
+            ip addr add ${cfg . "hostAddress"} dev ${name}
+          ''}
+          ${optionalString (cfg . "hostAddress6" or null != null) ''
+            ip -6 addr add ${cfg . "hostAddress6"} dev ${name}
+          ''}
+          ${optionalString (cfg . "localAddress" or null != null) ''
+            ip route add ${cfg . "localAddress"} dev ${name}
+          ''}
+          ${optionalString (cfg . "localAddress6" or null != null) ''
+            ip -6 route add ${cfg . "localAddress6"} dev ${name}
+          ''}
+          ''
+        );
+    in
+      ''
+        if [ "$PRIVATE_NETWORK" = 1 ]; then
+          if [ -z "$HOST_BRIDGE" ]; then
+            ifaceHost=ve-$INSTANCE
+            ip link set dev $ifaceHost up
+
+            ${ipcall cfg "ip addr" "$HOST_ADDRESS" "hostAddress"}
+            ${ipcall cfg "ip -6 addr" "$HOST_ADDRESS6" "hostAddress6"}
+            ${ipcall cfg "ip route" "$LOCAL_ADDRESS" "localAddress"}
+            ${ipcall cfg "ip -6 route" "$LOCAL_ADDRESS6" "localAddress6"}
+          fi
+          ${concatStringsSep "\n" (mapAttrsToList renderExtraVeth cfg . "extraVeths" or {})}
+        fi
+
+        # Get the leader PID so that we can signal it in
+        # preStop. We can't use machinectl there because D-Bus
+        # might be shutting down. FIXME: in systemd 219 we can
+        # just signal systemd-nspawn to do a clean shutdown.
+        machinectl show "$INSTANCE" | sed 's/Leader=\(.*\)/\1/;t;d' > "/run/containers/$INSTANCE.pid"
+      ''
+  );

  system = config.nixpkgs.system;

@ -75,6 +250,63 @@ let

  mkBindFlags = bs: concatMapStrings mkBindFlag (lib.attrValues bs);

+  networkOptions = {
+    hostBridge = mkOption {
+      type = types.nullOr types.string;
+      default = null;
+      example = "br0";
+      description = ''
+        Put the host-side of the veth-pair into the named bridge.
+        Only one of hostAddress* or hostBridge can be given.
+      '';
+    };
+
+    hostAddress = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      example = "10.231.136.1";
+      description = ''
+        The IPv4 address assigned to the host interface.
+        (Not used when hostBridge is set.)
+      '';
+    };
+
+    hostAddress6 = mkOption {
+      type = types.nullOr types.string;
+      default = null;
+      example = "fc00::1";
+      description = ''
+        The IPv6 address assigned to the host interface.
+        (Not used when hostBridge is set.)
+      '';
+    };
+
+    localAddress = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      example = "10.231.136.2";
+      description = ''
+        The IPv4 address assigned to the interface in the container.
+        If a hostBridge is used, this should be given with netmask to access
+        the whole network. Otherwise the default netmask is /32 and routing is
+        set up from localAddress to hostAddress and back.
+      '';
+    };
+
+    localAddress6 = mkOption {
+      type = types.nullOr types.string;
+      default = null;
+      example = "fc00::2";
+      description = ''
+        The IPv6 address assigned to the interface in the container.
+        If a hostBridge is used, this should be given with netmask to access
+        the whole network. Otherwise the default netmask is /128 and routing is
+        set up from localAddress6 to hostAddress6 and back.
+      '';
+    };
+
+  };
+
 in

 {
@ -135,56 +367,6 @@ in
              '';
            };

-            hostBridge = mkOption {
-              type = types.nullOr types.string;
-              default = null;
-              example = "br0";
-              description = ''
-                Put the host-side of the veth-pair into the named bridge.
-                Only one of hostAddress* or hostBridge can be given.
-              '';
-            };
-
-            hostAddress = mkOption {
-              type = types.nullOr types.str;
-              default = null;
-              example = "10.231.136.1";
-              description = ''
-                The IPv4 address assigned to the host interface.
-                (Not used when hostBridge is set.)
-              '';
-            };
-
-            hostAddress6 = mkOption {
-              type = types.nullOr types.string;
-              default = null;
-              example = "fc00::1";
-              description = ''
-                The IPv6 address assigned to the host interface.
-                (Not used when hostBridge is set.)
-              '';
-            };
-
-            localAddress = mkOption {
-              type = types.nullOr types.str;
-              default = null;
-              example = "10.231.136.2";
-              description = ''
-                The IPv4 address assigned to <literal>eth0</literal>
-                in the container.
-              '';
-            };
-
-            localAddress6 = mkOption {
-              type = types.nullOr types.string;
-              default = null;
-              example = "fc00::2";
-              description = ''
-                The IPv6 address assigned to <literal>eth0</literal>
-                in the container.
-              '';
-            };
-
            interfaces = mkOption {
              type = types.listOf types.string;
              default = [];
@ -194,6 +376,15 @@ in
              '';
            };

+            extraVeths = mkOption {
+              type = types.attrsOf types.optionSet;
+              default = {};
+              options = networkOptions;
+              description = ''
+                Extra veth-pairs to be created for the container
+              '';
+            };
+
            autoStart = mkOption {
              type = types.bool;
              default = false;
@ -216,7 +407,7 @@ in
                '';
            };

-          };
+          } // networkOptions;

          config = mkMerge
            [ (mkIf options.config.isDefined {
@ -274,110 +465,11 @@ in
      environment.INSTANCE = "%i";
      environment.root = "/var/lib/containers/%i";

-      preStart =
-        ''
-          # Clean up existing machined registration and interfaces.
-          machinectl terminate "$INSTANCE" 2> /dev/null || true
+      preStart = preStartScript {};

-          if [ "$PRIVATE_NETWORK" = 1 ]; then
-            ip link del dev "ve-$INSTANCE" 2> /dev/null || true
-            ip link del dev "vb-$INSTANCE" 2> /dev/null || true
-          fi
-       '';
+      script = startScript {};

-      script =
-        ''
-          mkdir -p -m 0755 "$root/etc" "$root/var/lib"
-          mkdir -p -m 0700 "$root/var/lib/private" "$root/root" /run/containers
-          if ! [ -e "$root/etc/os-release" ]; then
-            touch "$root/etc/os-release"
-          fi
-
-          if ! [ -e "$root/etc/machine-id" ]; then
-            touch "$root/etc/machine-id"
-          fi
-
-          mkdir -p -m 0755 \
-            "/nix/var/nix/profiles/per-container/$INSTANCE" \
-            "/nix/var/nix/gcroots/per-container/$INSTANCE"
-
-          cp --remove-destination /etc/resolv.conf "$root/etc/resolv.conf"
-
-          if [ "$PRIVATE_NETWORK" = 1 ]; then
-            extraFlags+=" --network-veth"
-            if [ -n "$HOST_BRIDGE" ]; then
-              extraFlags+=" --network-bridge=$HOST_BRIDGE"
-            fi
-          fi
-
-          for iface in $INTERFACES; do
-            extraFlags+=" --network-interface=$iface"
-          done
-
-          for iface in $MACVLANS; do
-            extraFlags+=" --network-macvlan=$iface"
-          done
-
-          # If the host is 64-bit and the container is 32-bit, add a
-          # --personality flag.
-          ${optionalString (config.nixpkgs.system == "x86_64-linux") ''
-            if [ "$(< ''${SYSTEM_PATH:-/nix/var/nix/profiles/per-container/$INSTANCE/system}/system)" = i686-linux ]; then
-              extraFlags+=" --personality=x86"
-            fi
-          ''}
-
-          rm -f $root/var/lib/private/host-notify
-
-          # Run systemd-nspawn without startup notification (we'll
-          # wait for the container systemd to signal readiness).
-          EXIT_ON_REBOOT=1 NOTIFY_SOCKET= \
-          exec ${config.systemd.package}/bin/systemd-nspawn \
-            --keep-unit \
-            -M "$INSTANCE" -D "$root" $extraFlags \
-            $EXTRA_NSPAWN_FLAGS \
-            --bind-ro=/nix/store \
-            --bind-ro=/nix/var/nix/db \
-            --bind-ro=/nix/var/nix/daemon-socket \
-            --bind=/run/systemd/notify:/var/lib/private/host-notify \
-            --bind="/nix/var/nix/profiles/per-container/$INSTANCE:/nix/var/nix/profiles" \
-            --bind="/nix/var/nix/gcroots/per-container/$INSTANCE:/nix/var/nix/gcroots" \
-            --setenv PRIVATE_NETWORK="$PRIVATE_NETWORK" \
-            --setenv HOST_BRIDGE="$HOST_BRIDGE" \
-            --setenv HOST_ADDRESS="$HOST_ADDRESS" \
-            --setenv LOCAL_ADDRESS="$LOCAL_ADDRESS" \
-            --setenv HOST_ADDRESS6="$HOST_ADDRESS6" \
-            --setenv LOCAL_ADDRESS6="$LOCAL_ADDRESS6" \
-            --setenv PATH="$PATH" \
-            ${containerInit} "''${SYSTEM_PATH:-/nix/var/nix/profiles/system}/init"
-        '';
-
-      postStart =
-        ''
-          if [ "$PRIVATE_NETWORK" = 1 ]; then
-            if [ -z "$HOST_BRIDGE" ]; then
-              ifaceHost=ve-$INSTANCE
-              ip link set dev $ifaceHost up
-              if [ -n "$HOST_ADDRESS" ]; then
-                ip addr add $HOST_ADDRESS dev $ifaceHost
-              fi
-              if [ -n "$HOST_ADDRESS6" ]; then
-                ip -6 addr add $HOST_ADDRESS6 dev $ifaceHost
-              fi
-              if [ -n "$LOCAL_ADDRESS" ]; then
-                ip route add $LOCAL_ADDRESS dev $ifaceHost
-              fi
-              if [ -n "$LOCAL_ADDRESS6" ]; then
-                ip -6 route add $LOCAL_ADDRESS6 dev $ifaceHost
-              fi
-            fi
-          fi
-
-          # Get the leader PID so that we can signal it in
-          # preStop. We can't use machinectl there because D-Bus
-          # might be shutting down. FIXME: in systemd 219 we can
-          # just signal systemd-nspawn to do a clean shutdown.
-          machinectl show "$INSTANCE" | sed 's/Leader=\(.*\)/\1/;t;d' > "/run/containers/$INSTANCE.pid"
-        '';
+      postStart = postStartScript {};

      preStop =
        ''
@ -404,8 +496,6 @@ in

        Type = "notify";

-        NotifyAccess = "all";
-
        # Note that on reboot, systemd-nspawn returns 133, so this
        # unit will be restarted. On poweroff, it returns 0, so the
        # unit won't be restarted.
@ -421,6 +511,8 @@ in
        # after the timeout). So send an ignored signal.
        KillMode = "mixed";
        KillSignal = "WINCH";
+
+        DevicePolicy = "closed";
      };
    };
  in {
@ -429,15 +521,20 @@ in
      [{ name = "container@"; value = unit; }]
      # declarative containers
      ++ (mapAttrsToList (name: cfg: nameValuePair "container@${name}" (
+        unit // {
+          preStart = preStartScript cfg;
+          script = startScript cfg;
+          postStart = postStartScript cfg;
+        } // (
        if cfg.autoStart then
-          unit // {
+          {
            wantedBy = [ "multi-user.target" ];
            wants = [ "network.target" ];
            after = [ "network.target" ];
            restartTriggers = [ cfg.path ];
            reloadIfChanged = true;
          }
-        else null
+        else {})
      )) config.containers)
    ));

@ -466,11 +563,11 @@ in
                LOCAL_ADDRESS6=${cfg.localAddress6}
              ''}
            ''}
-             INTERFACES="${toString cfg.interfaces}"
-           ${optionalString cfg.autoStart ''
-             AUTO_START=1
-           ''}
-           EXTRA_NSPAWN_FLAGS="${mkBindFlags cfg.bindMounts}"
+            INTERFACES="${toString cfg.interfaces}"
+            ${optionalString cfg.autoStart ''
+              AUTO_START=1
+            ''}
+            EXTRA_NSPAWN_FLAGS="${mkBindFlags cfg.bindMounts}"
          '';
      }) config.containers;

--- a/nixos/release.nix
+++ b/nixos/release.nix
@ -95,6 +95,7 @@ in rec {
  channel = import lib/make-channel.nix { inherit pkgs nixpkgs version versionSuffix; };

  manual = buildFromConfig ({ pkgs, ... }: { }) (config: config.system.build.manual.manual);
+  manualEpub = (buildFromConfig ({ pkgs, ... }: { }) (config: config.system.build.manual.manualEpub));
  manualPDF = (buildFromConfig ({ pkgs, ... }: { }) (config: config.system.build.manual.manualPDF)).x86_64-linux;
  manpages = buildFromConfig ({ pkgs, ... }: { }) (config: config.system.build.manual.manpages);
  options = (buildFromConfig ({ pkgs, ... }: { }) (config: config.system.build.manual.optionsJSON)).x86_64-linux;
@ -217,6 +218,7 @@ in rec {
  tests.containers-ipv6 = callTest tests/containers-ipv6.nix {};
  tests.containers-bridge = callTest tests/containers-bridge.nix {};
  tests.containers-imperative = callTest tests/containers-imperative.nix {};
+  tests.containers-extra_veth = callTest tests/containers-extra_veth.nix {};
  tests.docker = hydraJob (import tests/docker.nix { system = "x86_64-linux"; });
  tests.dockerRegistry = hydraJob (import tests/docker-registry.nix { system = "x86_64-linux"; });
  tests.dnscrypt-proxy = callTest tests/dnscrypt-proxy.nix { system = "x86_64-linux"; };
--- a/nixos/tests/containers-bridge.nix
+++ b/nixos/tests/containers-bridge.nix
@ -10,7 +10,7 @@ in
 import ./make-test.nix ({ pkgs, ...} : {
  name = "containers-bridge";
  meta = with pkgs.stdenv.lib.maintainers; {
-    maintainers = [ aristid aszlig eelco chaoflow ];
+    maintainers = [ aristid aszlig eelco chaoflow kampfschlaefer ];
  };

  machine =
--- a/nixos/tests/containers-extra_veth.nix
+++ b/nixos/tests/containers-extra_veth.nix
@ -0,0 +1,103 @@
+# Test for NixOS' container support.
+
+import ./make-test.nix ({ pkgs, ...} : {
+  name = "containers-bridge";
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ kampfschlaefer ];
+  };
+
+  machine =
+    { config, pkgs, ... }:
+    { imports = [ ../modules/installer/cd-dvd/channel.nix ];
+      virtualisation.writableStore = true;
+      virtualisation.memorySize = 768;
+      virtualisation.vlans = [];
+
+      networking.bridges = {
+        br0 = {
+          interfaces = [];
+        };
+        br1 = { interfaces = []; };
+      };
+      networking.interfaces = {
+        br0 = {
+          ip4 = [{ address = "192.168.0.1"; prefixLength = 24; }];
+          ip6 = [{ address = "fc00::1"; prefixLength = 7; }];
+        };
+        br1 = {
+          ip4 = [{ address = "192.168.1.1"; prefixLength = 24; }];
+        };
+      };
+
+      containers.webserver =
+        {
+          autoStart = true;
+          privateNetwork = true;
+          hostBridge = "br0";
+          localAddress = "192.168.0.100/24";
+          localAddress6 = "fc00::2/7";
+          extraVeths = {
+            veth1 = { hostBridge = "br1"; localAddress = "192.168.1.100/24"; };
+            veth2 = { hostAddress = "192.168.2.1"; localAddress = "192.168.2.100"; };
+          };
+          config =
+            {
+              networking.firewall.allowedTCPPorts = [ 80 ];
+              networking.firewall.allowPing = true;
+            };
+        };
+
+      virtualisation.pathsInNixDB = [ pkgs.stdenv ];
+    };
+
+  testScript =
+    ''
+      $machine->waitForUnit("default.target");
+      $machine->succeed("nixos-container list") =~ /webserver/ or die;
+
+      # Status of the webserver container.
+      $machine->succeed("nixos-container status webserver") =~ /up/ or die;
+
+      # Debug
+      #$machine->succeed("nixos-container run webserver -- ip link >&2");
+
+      # Ensure that the veths are inside the container
+      $machine->succeed("nixos-container run webserver -- ip link show veth1") =~ /state UP/ or die;
+      $machine->succeed("nixos-container run webserver -- ip link show veth2") =~ /state UP/ or die;
+
+      # Debug
+      #$machine->succeed("ip link >&2");
+
+      # Ensure the presence of the extra veths
+      $machine->succeed("ip link show veth1") =~ /state UP/ or die;
+      $machine->succeed("ip link show veth2") =~ /state UP/ or die;
+
+      # Ensure the veth1 is part of br1 on the host
+      $machine->succeed("ip link show veth1") =~ /master br1/ or die;
+
+      # Debug
+      #$machine->succeed("ip -4 a >&2");
+      #$machine->succeed("ip -4 r >&2");
+      #$machine->succeed("nixos-container run webserver -- ip link >&2");
+      #$machine->succeed("nixos-container run webserver -- ip -4 a >&2");
+      #$machine->succeed("nixos-container run webserver -- ip -4 r >&2");
+
+      # Ping on main veth
+      $machine->succeed("ping -n -c 1 192.168.0.100");
+      $machine->succeed("ping6 -n -c 1 fc00::2");
+
+      # Ping on the first extra veth
+      $machine->succeed("ping -n -c 1 192.168.1.100 >&2");
+
+      # Ping on the second extra veth
+      $machine->succeed("ping -n -c 1 192.168.2.100 >&2");
+
+      # Stop the container.
+      $machine->succeed("nixos-container stop webserver");
+      $machine->fail("ping -n -c 1 192.168.1.100 >&2");
+      $machine->fail("ping -n -c 1 192.168.2.100 >&2");
+
+      # Destroying a declarative container should fail.
+      $machine->fail("nixos-container destroy webserver");
+    '';
+})
--- a/nixos/tests/containers-imperative.nix
+++ b/nixos/tests/containers-imperative.nix
@ -3,7 +3,7 @@
 import ./make-test.nix ({ pkgs, ...} : {
  name = "containers-imperative";
  meta = with pkgs.stdenv.lib.maintainers; {
-    maintainers = [ aristid aszlig eelco chaoflow ];
+    maintainers = [ aristid aszlig eelco chaoflow kampfschlaefer ];
  };

  machine =
--- a/nixos/tests/containers-ipv4.nix
+++ b/nixos/tests/containers-ipv4.nix
@ -3,7 +3,7 @@
 import ./make-test.nix ({ pkgs, ...} : {
  name = "containers-ipv4";
  meta = with pkgs.stdenv.lib.maintainers; {
-    maintainers = [ aristid aszlig eelco chaoflow ];
+    maintainers = [ aristid aszlig eelco chaoflow kampfschlaefer ];
  };

  machine =
--- a/nixos/tests/containers-ipv6.nix
+++ b/nixos/tests/containers-ipv6.nix
@ -8,7 +8,7 @@ in
 import ./make-test.nix ({ pkgs, ...} : {
  name = "containers-ipv6";
  meta = with pkgs.stdenv.lib.maintainers; {
-    maintainers = [ aristid aszlig eelco chaoflow ];
+    maintainers = [ aristid aszlig eelco chaoflow kampfschlaefer ];
  };

  machine =
--- a/nixos/tests/gnome3_18-gdm.nix
+++ b/nixos/tests/gnome3_18-gdm.nix
@ -1,41 +0,0 @@
-import ./make-test.nix ({ pkgs, ...} : {
-  name = "gnome3-gdm";
-  meta = with pkgs.stdenv.lib.maintainers; {
-    maintainers = [ lethalman ];
-  };
-
-  machine =
-    { config, pkgs, ... }:
-
-    { imports = [ ./common/user-account.nix ];
-
-      services.xserver.enable = true;
-
-      services.xserver.displayManager.gdm = {
-        enable = true;
-        autoLogin = {
-          enable = true;
-          user = "alice";
-        };
-      };
-      services.xserver.desktopManager.gnome3.enable = true;
-      environment.gnome3.packageSet = pkgs.gnome3_20;
-
-      virtualisation.memorySize = 512;
-    };
-
-  testScript =
-    ''
-      $machine->waitForX;
-      $machine->sleep(15);
-
-      # Check that logging in has given the user ownership of devices.
-      $machine->succeed("getfacl /dev/snd/timer | grep -q alice");
-
-      $machine->succeed("su - alice -c 'DISPLAY=:0.0 gnome-terminal &'");
-      $machine->succeed("xauth merge ~alice/.Xauthority");
-      $machine->waitForWindow(qr/Terminal/);
-      $machine->sleep(20);
-      $machine->screenshot("screen");
-    '';
-})
--- a/nixos/tests/gnome3_18.nix
+++ b/nixos/tests/gnome3_18.nix
@ -1,38 +0,0 @@
-import ./make-test.nix ({ pkgs, ...} : {
-  name = "gnome3";
-  meta = with pkgs.stdenv.lib.maintainers; {
-    maintainers = [ domenkozar eelco chaoflow lethalman ];
-  };
-
-  machine =
-    { config, pkgs, ... }:
-
-    { imports = [ ./common/user-account.nix ];
-
-      services.xserver.enable = true;
-
-      services.xserver.displayManager.auto.enable = true;
-      services.xserver.displayManager.auto.user = "alice";
-      services.xserver.desktopManager.gnome3.enable = true;
-
-      environment.gnome3.packageSet = pkgs.gnome3_18;
-
-      virtualisation.memorySize = 512;
-    };
-
-  testScript =
-    ''
-      $machine->waitForX;
-      $machine->sleep(15);
-
-      # Check that logging in has given the user ownership of devices.
-      $machine->succeed("getfacl /dev/snd/timer | grep -q alice");
-
-      $machine->succeed("su - alice -c 'DISPLAY=:0.0 gnome-terminal &'");
-      $machine->succeed("xauth merge ~alice/.Xauthority");
-      $machine->waitForWindow(qr/Terminal/);
-      $machine->mustSucceed("timeout 900 bash -c 'journalctl -f|grep -m 1 \"GNOME Shell started\"'");
-      $machine->sleep(10);
-      $machine->screenshot("screen");
-    '';
-})
--- a/pkgs/applications/audio/CharacterCompressor/default.nix
+++ b/pkgs/applications/audio/CharacterCompressor/default.nix
@ -1,27 +1,31 @@
 { stdenv, fetchFromGitHub, faust2jaqt, faust2lv2gui }:
 stdenv.mkDerivation rec {
  name = "CharacterCompressor-${version}";
-  version = "0.2";
+  version = "0.3.1";

  src = fetchFromGitHub {
    owner = "magnetophon";
    repo = "CharacterCompressor";
-    rev = "v${version}";
-    sha256 = "0fvi8m4nshcxypn4jgxhnh7pxp68wshhav3k8wn3il7qpw71pdxi";
+    rev = "V${version}";
+    sha256 = "0ci27v5k10prsmcd0g6q5vhr31mz8hsmrsdk436vfbcv3s108rcc";
  };

  buildInputs = [ faust2jaqt faust2lv2gui ];

  buildPhase = ''
-    faust2jaqt -t 99999 CharacterCompressor.dsp
-    faust2lv2 -gui -t 99999 CharacterCompressor.dsp
+    faust2jaqt -vec -time -t 99999 CharacterCompressor.dsp
+    faust2lv2 -vec -time -gui -t 99999 CharacterCompressor.dsp
+    faust2jaqt -vec -time -t 99999 CharacterCompressorMono.dsp
+    faust2lv2 -vec -time -gui -t 99999 CharacterCompressorMono.dsp
  '';

  installPhase = ''
    mkdir -p $out/bin
    cp CharacterCompressor $out/bin/
+    cp CharacterCompressorMono $out/bin/
    mkdir -p $out/lib/lv2
    cp -r CharacterCompressor.lv2/ $out/lib/lv2
+    cp -r CharacterCompressorMono.lv2/ $out/lib/lv2
  '';

  meta = {
--- a/pkgs/applications/audio/faust/faust1.nix
+++ b/pkgs/applications/audio/faust/faust1.nix
@ -170,8 +170,8 @@ let
            --set FAUST_LIB_PATH "${faust}/lib/faust" \
            --prefix PATH : "$PATH" \
            --prefix PKG_CONFIG_PATH : "$PKG_CONFIG_PATH" \
-            --set NIX_CFLAGS_COMPILE "\"$NIX_CFLAGS_COMPILE\"" \
-            --set NIX_LDFLAGS "\"$NIX_LDFLAGS\""
+            --set NIX_CFLAGS_COMPILE "$NIX_CFLAGS_COMPILE" \
+            --set NIX_LDFLAGS "$NIX_LDFLAGS"
        done
      '';
    });
--- a/pkgs/applications/audio/faust/faust1git.nix
+++ b/pkgs/applications/audio/faust/faust1git.nix
@ -9,12 +9,12 @@ with stdenv.lib.strings;

 let

-  version = "2016-04-27";
+  version = "2016-07-19";

  src = fetchgit {
    url = "git://git.code.sf.net/p/faudiostream/code";
-    rev = "931fca3e649f99ef09025d37bd6a7dc70a03e6f6";
-    sha256 = "1h2qfwxqf9406v0w6kqyxlzn88zw3xmwgxg9f01n4jvd72zxll78";
+    rev = "16c22dc0193c10521b1dc16f98443d9c206bb5dd";
+    sha256 = "01rbcjfhpd5casi72ffi1j95f65ji60l629sgav93pvs0kpdacz5";
  };

  meta = with stdenv.lib; {
@ -175,8 +175,8 @@ let
            --set FAUSTINC "${faust}/include/faust" \
            --prefix PATH : "$PATH" \
            --prefix PKG_CONFIG_PATH : "$PKG_CONFIG_PATH" \
-            --set NIX_CFLAGS_COMPILE "\"$NIX_CFLAGS_COMPILE\"" \
-            --set NIX_LDFLAGS "\"$NIX_LDFLAGS\""
+            --set NIX_CFLAGS_COMPILE "$NIX_CFLAGS_COMPILE" \
+            --set NIX_LDFLAGS "$NIX_LDFLAGS"
        done
      '';
    });
--- a/pkgs/applications/audio/faust/faust2.nix
+++ b/pkgs/applications/audio/faust/faust2.nix
@ -196,8 +196,8 @@ let
            --set FAUST_LIB_PATH "${faust}/lib/faust" \
            --prefix PATH : "$PATH" \
            --prefix PKG_CONFIG_PATH : "$PKG_CONFIG_PATH" \
-            --set NIX_CFLAGS_COMPILE "\"$NIX_CFLAGS_COMPILE\"" \
-            --set NIX_LDFLAGS "\"$NIX_LDFLAGS\""
+            --set NIX_CFLAGS_COMPILE "$NIX_CFLAGS_COMPILE" \
+            --set NIX_LDFLAGS "$NIX_LDFLAGS"
        done
      '';
    });
--- a/pkgs/applications/audio/mopidy-musicbox-webclient/default.nix
+++ b/pkgs/applications/audio/mopidy-musicbox-webclient/default.nix
@ -3,13 +3,13 @@
 pythonPackages.buildPythonApplication rec {
  name = "mopidy-musicbox-webclient-${version}";

-  version = "2.2.0";
+  version = "2.3.0";

  src = fetchFromGitHub {
    owner = "pimusicbox";
    repo = "mopidy-musicbox-webclient";
    rev = "v${version}";
-    sha256 = "0v09wy40ipl0b0dpgmcdl15c5g732c9jl7zipm4sy4pr8xiy6baa";
+    sha256 = "1jcfrwsi7axiph3jplqzmcqia9pc46xb2yf13d8h6lnh3h49rwvz";
  };

  propagatedBuildInputs = [ mopidy ];
--- a/pkgs/applications/audio/plugin-torture/default.nix
+++ b/pkgs/applications/audio/plugin-torture/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  name = "plugin-torture-${version}";
-  version = "5";
+  version = "2016-07-25";

  src = fetchFromGitHub {
    owner = "cth103";
    repo = "plugin-torture";
-    rev = "v${version}";
-    sha256 = "1mlgxjsyaz86wm4k32ll2w5nghjffnsdqlm6kjv02a4dpb2bfrih";
+    rev = "8b9c43197dca372da6b9c8212224ec86b5f16b4a";
+    sha256 = "1xyhvhm85d9z0kw716cjllrrzksn4s4bw34layg8hf4m5m31sp2p";
  };

  buildInputs = [ boost ladspaH lilv lv2 pkgconfig serd sord sratom ];
--- a/pkgs/applications/audio/rhythmbox/default.nix
+++ b/pkgs/applications/audio/rhythmbox/default.nix
@ -0,0 +1,62 @@
+{ stdenv, fetchurl, pkgconfig
+, python3
+, perl
+, perlPackages
+, gtk3
+, intltool
+, libsoup
+, gnome3
+, tdb
+, json_glib
+, itstool
+, wrapGAppsHook
+, gst_all_1
+, gst_plugins ? with gst_all_1; [ gst-plugins-good gst-plugins-ugly ]
+}:
+let
+  version = "${major}.${minor}";
+  major = "3.2";
+  minor = "1";
+
+in stdenv.mkDerivation rec {
+  name = "rhythmbox-${version}";
+
+  src = fetchurl {
+    url = "mirror://gnome/sources/rhythmbox/${major}/${name}.tar.xz";
+    sha256 = "0f3radhlji7rxl760yl2vm49fvfslympxrpm8497acbmbd7wlhxz";
+  };
+
+  buildInputs = [
+    pkgconfig
+
+    python3
+    perl
+    perlPackages.XMLParser
+
+    intltool
+    libsoup
+    tdb
+    json_glib
+    itstool
+
+    gtk3
+    gnome3.libpeas
+    gnome3.totem-pl-parser
+    gnome3.defaultIconTheme
+
+    gst_all_1.gstreamer
+    gst_all_1.gst-plugins-base
+
+    wrapGAppsHook
+  ] ++ gst_plugins;
+
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
+    homepage = https://wiki.gnome.org/Apps/Rhythmbox;
+    description = "A music playing application for GNOME";
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.rasendubi ];
+  };
+}
--- a/pkgs/applications/backup/crashplan/default.nix
+++ b/pkgs/applications/backup/crashplan/default.nix
@ -2,14 +2,14 @@

 let
  version = "4.7.0";
-  rev = "1"; #tracks unversioned changes that occur on download.code42.com from time to time
+  rev = "2"; #tracks unversioned changes that occur on download.code42.com from time to time

 in stdenv.mkDerivation rec {
  name = "crashplan-${version}-r${rev}";

  crashPlanArchive = fetchurl {
    url = "https://download.code42.com/installs/linux/install/CrashPlan/CrashPlan_${version}_Linux.tgz";
-    sha256 = "1r50fyswvqjxsdslbyibbxwz2fs8iim15hxr0k05jrzmkhjm4g5v";
+    sha256 = "1vi6dqf8kc90axrgdcf6rwnhynxgxkc0qn6pbdp2gvkxdqxrprn8";
  };

  srcs = [ crashPlanArchive ];
--- a/pkgs/applications/editors/eclipse/plugins.nix
+++ b/pkgs/applications/editors/eclipse/plugins.nix
@ -171,12 +171,12 @@ rec {

  checkstyle = buildEclipseUpdateSite rec {
    name = "checkstyle-${version}";
-    version = "6.19.0.201606092149";
+    version = "6.19.1.201607051943";

    src = fetchzip {
      stripRoot = false;
-      url = "mirror://sourceforge/project/eclipse-cs/Eclipse%20Checkstyle%20Plug-in/6.19.0/net.sf.eclipsecs-updatesite_${version}.zip";
-      sha256 = "0d066fihvdkisic0lsdvh947yd2v20xc8h4aknfcyg2mq3xzi0x7";
+      url = "mirror://sourceforge/project/eclipse-cs/Eclipse%20Checkstyle%20Plug-in/6.19.1/net.sf.eclipsecs-updatesite_${version}.zip";
+      sha256 = "03aah57g0cgxym95p1wcj2h69xy3r9c0vv7js3gpmw1hx8w9sjsf";
    };

    meta = with stdenv.lib; {
@ -341,12 +341,12 @@ rec {

  jdt = buildEclipseUpdateSite rec {
    name = "jdt-${version}";
-    version = "4.5.2";
+    version = "4.6";

    src = fetchzip {
      stripRoot = false;
-      url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops4/R-4.5.2-201602121500/org.eclipse.jdt-4.5.2.zip";
-      sha256 = "0v4cfq4z62k60l8l014wqgbjnd6a93dwcp6qvr5y7q1v9jr2na5g";
+      url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops4/R-4.6-201606061100/org.eclipse.jdt-4.6.zip";
+      sha256 = "0raz8d09fnnx19l012l5frca97qavfivvygn3mvsllcyskhqc5hg";
    };

    meta = with stdenv.lib; {
--- a/pkgs/applications/editors/emacs-25/default.nix
+++ b/pkgs/applications/editors/emacs-25/default.nix
@ -25,13 +25,13 @@ let
 in

 stdenv.mkDerivation rec {
-  name = "emacs-25.0.95";
+  name = "emacs-25.1-rc1";

  builder = ./builder.sh;

  src = fetchurl {
    url = "ftp://alpha.gnu.org/gnu/emacs/pretest/${name}.tar.xz";
-    sha256 = "0bmvg7cbrwfa9rbryjrqv2qcllgwja92sx9ikirl80r5d09caf0l";
+    sha256 = "0cv1hars9zxlv040h7f3zz50fhn67dqa18ms4hg9sdblckk50360";
  };

  patches = lib.optionals stdenv.isDarwin [
--- a/pkgs/applications/editors/emacs-modes/elpa-generated.nix
+++ b/pkgs/applications/editors/emacs-modes/elpa-generated.nix
@ -95,10 +95,10 @@
    ahungry-theme = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
    elpaBuild {
        pname = "ahungry-theme";
-        version = "1.2.0";
+        version = "1.3.0";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/ahungry-theme-1.2.0.tar";
-          sha256 = "04z9d8xszgsl6p02gf3yixgj8kwwb6rfc6bq1b3sz95n3v9wmg9d";
+          url = "https://elpa.gnu.org/packages/ahungry-theme-1.3.0.tar";
+          sha256 = "1p2zaq0s4bbl5cx6wyab24wamw7m0mysb0v47dqjmnvfc25z84rq";
        };
        packageRequires = [ emacs ];
        meta = {
@ -175,10 +175,10 @@
      }) {};
    auctex = callPackage ({ elpaBuild, fetchurl, lib }: elpaBuild {
        pname = "auctex";
-        version = "11.89.3";
+        version = "11.89.4";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/auctex-11.89.3.tar";
-          sha256 = "16yjalh8qf1m3zgwxf1h3dkjq7hkb9895g2lb6ajwjfn02yiav80";
+          url = "https://elpa.gnu.org/packages/auctex-11.89.4.tar";
+          sha256 = "06dxj9wflwgzy88vk47pdk6xln4f63cab7s73ynwp2bdqjs99f5b";
        };
        packageRequires = [];
        meta = {
@ -228,10 +228,10 @@
      }) {};
    beacon = callPackage ({ elpaBuild, fetchurl, lib, seq }: elpaBuild {
        pname = "beacon";
-        version = "1.3.0";
+        version = "1.3.1";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/beacon-1.3.0.el";
-          sha256 = "00hab8w01p43iscpr0hh1s2w80ara2y8d5ccz37i2nl54gj8lpw3";
+          url = "https://elpa.gnu.org/packages/beacon-1.3.1.el";
+          sha256 = "19dw9650kk4rch2qpp42wdq9687m3svj1addbp3yz4dijy7lx2mj";
        };
        packageRequires = [ seq ];
        meta = {
@ -282,10 +282,10 @@
      }) {};
    cl-generic = callPackage ({ elpaBuild, fetchurl, lib }: elpaBuild {
        pname = "cl-generic";
-        version = "0.2";
+        version = "0.3";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/cl-generic-0.2.el";
-          sha256 = "0b2y114f14fdlk5hkb0fvdbv6pqm9ifw0vwzri1vqp1xq1l1f9p3";
+          url = "https://elpa.gnu.org/packages/cl-generic-0.3.el";
+          sha256 = "0vb338bhjpsnrf60qgxny4z5rjrnifahnrv9axd4shay89d894zq";
        };
        packageRequires = [];
        meta = {
@ -319,13 +319,26 @@
          license = lib.licenses.free;
        };
      }) {};
+    compact-docstrings = callPackage ({ elpaBuild, fetchurl, lib }: elpaBuild {
+        pname = "compact-docstrings";
+        version = "0.1";
+        src = fetchurl {
+          url = "https://elpa.gnu.org/packages/compact-docstrings-0.1.el";
+          sha256 = "1qmxn1i07nnzfckl06lg3xpvccx2hjgpypgc9v4pdihjfdwnifm5";
+        };
+        packageRequires = [];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/compact-docstrings.html";
+          license = lib.licenses.free;
+        };
+      }) {};
    company = callPackage ({ cl-lib ? null, elpaBuild, emacs, fetchurl, lib }:
    elpaBuild {
        pname = "company";
-        version = "0.8.12";
+        version = "0.9.0";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/company-0.8.12.tar";
-          sha256 = "1r7q813rjs4dgknsfqi354ahsvk8k4ld4xh1fkp8lbxb13da6gqx";
+          url = "https://elpa.gnu.org/packages/company-0.9.0.tar";
+          sha256 = "1d090j1xv97nbxzz0iq4gmzjijggm8wsd0y1zfsa8syrq8qa0ajs";
        };
        packageRequires = [ cl-lib emacs ];
        meta = {
@ -361,15 +374,15 @@
          license = lib.licenses.free;
        };
      }) {};
-    context-coloring = callPackage ({ elpaBuild, emacs, fetchurl, js2-mode, lib }:
+    context-coloring = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
    elpaBuild {
        pname = "context-coloring";
-        version = "7.2.1";
+        version = "8.0.1";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/context-coloring-7.2.1.el";
-          sha256 = "1lh2p3fsym73h0dcj1gqg1xsw3lcikmcskbx8y3j0ds30l4xs13d";
+          url = "https://elpa.gnu.org/packages/context-coloring-8.0.1.tar";
+          sha256 = "0c7sb8dzx6f40hz2l6zicc0shpxj3vzsmvdxzx65c4vgvr462js2";
        };
-        packageRequires = [ emacs js2-mode ];
+        packageRequires = [ emacs ];
        meta = {
          homepage = "https://elpa.gnu.org/packages/context-coloring.html";
          license = lib.licenses.free;
@ -401,6 +414,19 @@
          license = lib.licenses.free;
        };
      }) {};
+    cycle-quotes = callPackage ({ elpaBuild, fetchurl, lib }: elpaBuild {
+        pname = "cycle-quotes";
+        version = "0.1";
+        src = fetchurl {
+          url = "https://elpa.gnu.org/packages/cycle-quotes-0.1.tar";
+          sha256 = "0aa6ykblgb6anqmi4qxakbvyrq9v02skgayhfb2qddffiww404ka";
+        };
+        packageRequires = [];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/cycle-quotes.html";
+          license = lib.licenses.free;
+        };
+      }) {};
    darkroom = callPackage ({ cl-lib ? null, elpaBuild, fetchurl, lib }:
    elpaBuild {
        pname = "darkroom";
@ -445,10 +471,10 @@
    debbugs = callPackage ({ cl-lib ? null, elpaBuild, fetchurl, lib, soap-client }:
    elpaBuild {
        pname = "debbugs";
-        version = "0.9.5";
+        version = "0.9.7";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/debbugs-0.9.5.tar";
-          sha256 = "1m23rghdykx1fvji6in0xp0bxhjcf7ynm14nl4fhiki2nhhwczxh";
+          url = "https://elpa.gnu.org/packages/debbugs-0.9.7.tar";
+          sha256 = "07w73if4lmh23ih2v3p0197f781002dywd5fzdbmr4hcqvvi97qq";
        };
        packageRequires = [ cl-lib soap-client ];
        meta = {
@ -456,6 +482,19 @@
          license = lib.licenses.free;
        };
      }) {};
+    delight = callPackage ({ elpaBuild, fetchurl, lib }: elpaBuild {
+        pname = "delight";
+        version = "1.5";
+        src = fetchurl {
+          url = "https://elpa.gnu.org/packages/delight-1.5.el";
+          sha256 = "0kzlvzwmn6zj0874086q2xw0pclyi7wlkq48zh2lkd2796xm8vw7";
+        };
+        packageRequires = [];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/delight.html";
+          license = lib.licenses.free;
+        };
+      }) {};
    dict-tree = callPackage ({ elpaBuild, fetchurl, heap, lib, tNFA, trie }:
    elpaBuild {
        pname = "dict-tree";
@ -473,10 +512,10 @@
    diff-hl = callPackage ({ cl-lib ? null, elpaBuild, fetchurl, lib }:
    elpaBuild {
        pname = "diff-hl";
-        version = "1.8.3";
+        version = "1.8.4";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/diff-hl-1.8.3.tar";
-          sha256 = "1i3ngx5gmjl1a15y6d0xmcgdimn7ghrqkbzqisz4ra3dgwbbb3f9";
+          url = "https://elpa.gnu.org/packages/diff-hl-1.8.4.tar";
+          sha256 = "0axhidc3cym7a2x4rpxf4745qss9s9ajyg4s9h5b4zn7v7fyp71n";
        };
        packageRequires = [ cl-lib ];
        meta = {
@ -566,10 +605,10 @@
      }) {};
    el-search = callPackage ({ elpaBuild, emacs, fetchurl, lib }: elpaBuild {
        pname = "el-search";
-        version = "0.2";
+        version = "0.2.1";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/el-search-0.2.el";
-          sha256 = "1ps4p79xrvsdys9yh1wyk4zdly6c55agbqa6f8q3xkwc9sva9lw9";
+          url = "https://elpa.gnu.org/packages/el-search-0.2.1.el";
+          sha256 = "1ralag6a4752mqbsz92prd1f75380q5f7j4k3ajhv66krhd1w0k6";
        };
        packageRequires = [ emacs ];
        meta = {
@ -646,10 +685,10 @@
    excorporate = callPackage ({ elpaBuild, emacs, fetchurl, fsm, lib, soap-client, url-http-ntlm }:
    elpaBuild {
        pname = "excorporate";
-        version = "0.7.3";
+        version = "0.7.5";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/excorporate-0.7.3.tar";
-          sha256 = "053pcqv5gcwnl57kcxsm3v60nmi5sm4myjca2xqraldp27k6qd1q";
+          url = "https://elpa.gnu.org/packages/excorporate-0.7.5.tar";
+          sha256 = "0w828zv8968ryphhi1zaizrs6fnxkgxdwjlhpriyc9129qnwx0cg";
        };
        packageRequires = [ emacs fsm soap-client url-http-ntlm ];
        meta = {
@ -659,10 +698,10 @@
      }) {};
    exwm = callPackage ({ elpaBuild, fetchurl, lib, xelb }: elpaBuild {
        pname = "exwm";
-        version = "0.4";
+        version = "0.6";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/exwm-0.4.tar";
-          sha256 = "1qlplx88mk8c5sahlymxxh46bzf6bxnsqk92wliv5ji4ai5373fb";
+          url = "https://elpa.gnu.org/packages/exwm-0.6.tar";
+          sha256 = "0fxkhpc87wd7crzwwj9r5r3s07pznsphk4hi8jinx91641szi1px";
        };
        packageRequires = [ xelb ];
        meta = {
@ -701,10 +740,10 @@
    fsm = callPackage ({ cl-lib ? null, elpaBuild, emacs, fetchurl, lib }:
    elpaBuild {
        pname = "fsm";
-        version = "0.2";
+        version = "0.2.1";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/fsm-0.2.el";
-          sha256 = "1kh1r5by1q2x8bbg0z2jzmb5i6blvlf105mavrnbcxa6ghbiz6iy";
+          url = "https://elpa.gnu.org/packages/fsm-0.2.1.el";
+          sha256 = "1jyxyqdbfl8nv7c50q0sg3w5p7whp1sqgi7w921k5hfar4d11qqp";
        };
        packageRequires = [ cl-lib emacs ];
        meta = {
@ -876,10 +915,10 @@
    js2-mode = callPackage ({ cl-lib ? null, elpaBuild, emacs, fetchurl, lib }:
    elpaBuild {
        pname = "js2-mode";
-        version = "20150909";
+        version = "20160623";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/js2-mode-20150909.tar";
-          sha256 = "1ha696jl9k1325r3xlr11rx6lmd545p42f8biw4hb0q1zsr2306h";
+          url = "https://elpa.gnu.org/packages/js2-mode-20160623.tar";
+          sha256 = "057djy6amda8kyprkb3v733d21nlmq5fgfazi65fywlfwyq1adxs";
        };
        packageRequires = [ cl-lib emacs ];
        meta = {
@ -1123,6 +1162,19 @@
          license = lib.licenses.free;
        };
      }) {};
+    myers = callPackage ({ elpaBuild, emacs, fetchurl, lib }: elpaBuild {
+        pname = "myers";
+        version = "0.1";
+        src = fetchurl {
+          url = "https://elpa.gnu.org/packages/myers-0.1.el";
+          sha256 = "0yrxklkksj16cfbvwmdxjj43vngjd6q0fivib1xim3c9g3c9b670";
+        };
+        packageRequires = [ emacs ];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/myers.html";
+          license = lib.licenses.free;
+        };
+      }) {};
    nameless = callPackage ({ elpaBuild, emacs, fetchurl, lib }: elpaBuild {
        pname = "nameless";
        version = "1.0.1";
@ -1217,10 +1269,10 @@
      }) {};
    oauth2 = callPackage ({ elpaBuild, fetchurl, lib }: elpaBuild {
        pname = "oauth2";
-        version = "0.10";
+        version = "0.11";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/oauth2-0.10.el";
-          sha256 = "0rlxmbb88dp0yqw9d5mdx0nxv5l5618scmg5872scbnc735f2yna";
+          url = "https://elpa.gnu.org/packages/oauth2-0.11.el";
+          sha256 = "0ydkc9jazsnbbvfhd47mql52y7k06n3z7r0naqxkwb99j9blqsmp";
        };
        packageRequires = [];
        meta = {
@ -1257,10 +1309,10 @@
      }) {};
    org = callPackage ({ elpaBuild, fetchurl, lib }: elpaBuild {
        pname = "org";
-        version = "20160516";
+        version = "20160725";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/org-20160516.tar";
-          sha256 = "164v1zddgyfy9v1qhl1fqz2vcgm5w4dhfmra5ngpgnjh1402l0pm";
+          url = "https://elpa.gnu.org/packages/org-20160725.tar";
+          sha256 = "05ky7hlsjqlml14ss9hcj2756clvsi1f26gv7a01d923m3drkqjc";
        };
        packageRequires = [];
        meta = {
@ -1337,10 +1389,10 @@
    python = callPackage ({ cl-lib ? null, elpaBuild, emacs, fetchurl, lib }:
    elpaBuild {
        pname = "python";
-        version = "0.25.1";
+        version = "0.25.2";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/python-0.25.1.el";
-          sha256 = "16r1sjq5fagrvlnrnbxmf6h2yxrcbhqlaa3ppqsa14vqrj09gisd";
+          url = "https://elpa.gnu.org/packages/python-0.25.2.el";
+          sha256 = "1ac2ipyg49sb0lz3n0ykj2s6592abd38l5d1cpbmv73j13l8zq5i";
        };
        packageRequires = [ cl-lib emacs ];
        meta = {
@ -1427,14 +1479,15 @@
          license = lib.licenses.free;
        };
      }) {};
-    rudel = callPackage ({ elpaBuild, fetchurl, lib }: elpaBuild {
+    rudel = callPackage ({ cl-generic, cl-lib ? null, elpaBuild, emacs, fetchurl, lib }:
+    elpaBuild {
        pname = "rudel";
        version = "0.3";
        src = fetchurl {
          url = "https://elpa.gnu.org/packages/rudel-0.3.tar";
          sha256 = "041yac9a7hbz1fpmjlmc31ggcgg90fmw08z6bkzly2141yky8yh1";
        };
-        packageRequires = [];
+        packageRequires = [ cl-generic cl-lib emacs ];
        meta = {
          homepage = "https://elpa.gnu.org/packages/rudel.html";
          license = lib.licenses.free;
@ -1468,10 +1521,10 @@
      }) {};
    seq = callPackage ({ elpaBuild, fetchurl, lib }: elpaBuild {
        pname = "seq";
-        version = "2.15";
+        version = "2.16";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/seq-2.15.tar";
-          sha256 = "09wi1765bmn7i8fg6ajjfaxgs4ipc42d58zx2fdqpidrdg9c7q73";
+          url = "https://elpa.gnu.org/packages/seq-2.16.tar";
+          sha256 = "1fc1cjbb3lrxgkhzvg4bkpxr408hhg8kqa07n0jfalrdzaa3bika";
        };
        packageRequires = [];
        meta = {
@ -1918,10 +1971,10 @@
    xelb = callPackage ({ cl-generic, elpaBuild, emacs, fetchurl, lib }:
    elpaBuild {
        pname = "xelb";
-        version = "0.7";
+        version = "0.9";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/xelb-0.7.tar";
-          sha256 = "0i4336a8xns6zp82dj77w5gjgv3mfngcjsw7ghyf7bb7flh8ipw1";
+          url = "https://elpa.gnu.org/packages/xelb-0.9.tar";
+          sha256 = "19gv08wxs2s337y1wv2i19a0vk8w6733l9mryn334yy2m5031vxh";
        };
        packageRequires = [ cl-generic emacs ];
        meta = {
@ -1945,10 +1998,10 @@
    yasnippet = callPackage ({ cl-lib ? null, elpaBuild, fetchurl, lib }:
    elpaBuild {
        pname = "yasnippet";
-        version = "0.9.1";
+        version = "0.10.0";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/yasnippet-0.9.1.tar";
-          sha256 = "0b88q10dxa13afjzpkwgjlrzzvwiiqsi9jr73pxnsy4q1n1n2vml";
+          url = "https://elpa.gnu.org/packages/yasnippet-0.10.0.tar";
+          sha256 = "0vh70i73rknaxzglr4nragassgpjy2lj5mca2x6wqiqmv7mc8xdv";
        };
        packageRequires = [ cl-lib ];
        meta = {
--- a/pkgs/applications/editors/emacs-modes/melpa-generated.nix
+++ b/pkgs/applications/editors/emacs-modes/melpa-generated.nix
--- a/pkgs/applications/editors/emacs-modes/melpa-stable-generated.nix
+++ b/pkgs/applications/editors/emacs-modes/melpa-stable-generated.nix
--- a/pkgs/applications/editors/emacs-modes/melpa-stable-packages.nix
+++ b/pkgs/applications/editors/emacs-modes/melpa-stable-packages.nix
@ -56,9 +56,6 @@ self:
      # upstream issue: missing file header
      connection = markBroken super.connection;

-      # upstream issue: missing file header
-      crux = markBroken super.crux;
-
      # upstream issue: missing file header
      dictionary = markBroken super.dictionary;

@ -135,10 +132,6 @@ self:
      # upstream issue: missing file header
      qiita = markBroken super.qiita;

-      spaceline = super.spaceline.override {
-        inherit (self.melpaPackages) powerline;
-      };
-
      # upstream issue: missing file header
      speech-tagger = markBroken super.speech-tagger;

--- a/pkgs/applications/editors/emacs-modes/org-generated.nix
+++ b/pkgs/applications/editors/emacs-modes/org-generated.nix
@ -1,10 +1,10 @@
 { callPackage }: {
    org = callPackage ({ elpaBuild, fetchurl, lib }: elpaBuild {
        pname = "org";
-        version = "20160516";
+        version = "20160725";
        src = fetchurl {
-          url = "http://orgmode.org/elpa/org-20160516.tar";
-          sha256 = "0zr87i55l92n1m8fgzvpdm40gh4fjwzsvgq47cmviqjr38kzdxv0";
+          url = "http://orgmode.org/elpa/org-20160725.tar";
+          sha256 = "1d2v6w93z543jnmz6a1kmp61rmznjnw6pvd9ia2pm42rzhsgydy5";
        };
        packageRequires = [];
        meta = {
@ -14,10 +14,10 @@
      }) {};
    org-plus-contrib = callPackage ({ elpaBuild, fetchurl, lib }: elpaBuild {
        pname = "org-plus-contrib";
-        version = "20160516";
+        version = "20160725";
        src = fetchurl {
-          url = "http://orgmode.org/elpa/org-plus-contrib-20160516.tar";
-          sha256 = "1g1a9qsn1i1fh5ppa2jimfqvzkd7rhq5a7xz73lkaw8j3niqy62s";
+          url = "http://orgmode.org/elpa/org-plus-contrib-20160725.tar";
+          sha256 = "0bxxbcln7npffvd947052sjp59ypxdfwkp2ja7mbs28pzzb25xxi";
        };
        packageRequires = [];
        meta = {
--- a/pkgs/applications/editors/idea/default.nix
+++ b/pkgs/applications/editors/idea/default.nix
@ -31,7 +31,7 @@ let
      buildInputs = x.buildInputs ++ [ makeWrapper ];
      installPhase = x.installPhase +  ''
        wrapProgram "$out/bin/android-studio" \
-          --set ANDROID_HOME "${androidsdk}/libexec/android-sdk-linux/" \
+          --set ANDROID_HOME "${androidsdk}/libexec/" \
          --set LD_LIBRARY_PATH "${stdenv.cc.cc.lib}/lib" # Gradle installs libnative-platform.so in ~/.gradle, that requires libstdc++.so.6
      '';
    });
--- a/pkgs/applications/editors/kakoune/default.nix
+++ b/pkgs/applications/editors/kakoune/default.nix
@ -0,0 +1,33 @@
+{ stdenv, fetchFromGitHub, ncurses, boost, asciidoc, docbook_xsl, libxslt }:
+
+with stdenv.lib;
+
+stdenv.mkDerivation rec {
+  name = "kakoune-nightly-${version}";
+  version = "2016-07-26";
+  src = fetchFromGitHub {
+    repo = "kakoune";
+    owner = "mawww";
+    rev = "0d2c5072b083a893843e4fa87f9f702979069e14";
+    sha256 = "01qqs5yr9xvvklg3gg45lgnyh6gji28m854mi1snzvjd7fksf50n";
+  };
+  buildInputs = [ ncurses boost asciidoc docbook_xsl libxslt ];
+
+  buildPhase = ''
+    sed -ie 's#--no-xmllint#--no-xmllint --xsltproc-opts="--nonet"#g' src/Makefile
+    export PREFIX=$out
+    (cd src && make )
+  '';
+
+  installPhase = ''
+    (cd src && make install)
+  '';
+
+  meta = {
+    homepage = http://kakoune.org/;
+    description = "A vim inspired text editor";
+    license = licenses.publicDomain;
+    maintainers = with maintainers; [ vrthra ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/editors/nano/default.nix
+++ b/pkgs/applications/editors/nano/default.nix
@ -12,10 +12,10 @@ with stdenv.lib;

 stdenv.mkDerivation rec {
  name = "nano-${version}";
-  version = "2.6.1";
+  version = "2.6.2";
  src = fetchurl {
    url = "https://nano-editor.org/dist/v2.6/${name}.tar.gz";
-    sha256 = "56f2ba1c532647bee36abd5f87a714400af0be084cf857a65bc8f41a0dc28fe5";
+    sha256 = "11c9iqiah4q7q3ndn7z9192a796vp4fffkg27s6q1dn8avp06dj5";
  };
  nativeBuildInputs = [ texinfo ] ++ optional enableNls gettext;
  buildInputs = [ ncurses ];
--- a/pkgs/applications/editors/nedit/default.nix
+++ b/pkgs/applications/editors/nedit/default.nix
@ -3,11 +3,11 @@
 assert stdenv.isLinux;

 stdenv.mkDerivation rec {
-  name = "nedit-5.6";
+  name = "nedit-5.6a";
  
  src = fetchurl {
    url = "mirror://sourceforge/nedit/nedit-source/${name}-src.tar.gz";
-    sha256 = "023hwpqc57mnzvg6p7jda6193afgjzxzajlhwhqvk3jq2kdv6zna";
+    sha256 = "1v8y8vwj3kn91crsddqkz843y6csgw7wkjnd3zdcb4bcrf1pjrsk";
  };

  buildInputs = [ xlibsWrapper motif libXpm ];
--- a/pkgs/applications/misc/catclock/default.nix
+++ b/pkgs/applications/misc/catclock/default.nix
@ -0,0 +1,31 @@
+{ stdenv, fetchFromGitHub, xlibsWrapper, motif }:
+
+stdenv.mkDerivation rec {
+  name = "catclock-2015-10-04";
+
+  src = fetchFromGitHub {
+    owner = "BarkyTheDog";
+    repo = "catclock";
+    rev = "d20b8825b38477a144e8a2a4bbd4779adb3620ac";
+    sha256 = "0fiv9rj8p8mifv24cxljdrrmh357q70zmzdci9bpbxnhs1gdpr63";
+  };
+
+  preInstall = ''
+    mkdir -p $out/bin
+    mkdir -p $out/share/man/man1
+    cp xclock.man $out/share/man/man1/xclock.1
+  '';
+
+  makeFlags = [
+    "DESTINATION=$(out)/bin/"
+  ];
+
+  buildInputs = [ xlibsWrapper motif ];
+
+  meta = with stdenv.lib; {
+    homepage = http://codefromabove.com/2014/05/catclock/;
+    license = with licenses; mit;
+    maintainers = with maintainers; [ ramkromberg ];
+    platforms = with platforms; linux;
+  };
+}
--- a/pkgs/applications/misc/khard/default.nix
+++ b/pkgs/applications/misc/khard/default.nix
@ -1,16 +1,20 @@
-{ stdenv, fetchurl, pkgs, python2Packages }:
+{ stdenv, fetchurl, glibcLocales, python3Packages }:

-python2Packages.buildPythonApplication rec {
-  version = "0.9.0";
+python3Packages.buildPythonApplication rec {
+  version = "0.11.1";
  name = "khard-${version}";
  namePrefix = "";

  src = fetchurl {
    url = "https://github.com/scheibler/khard/archive/v${version}.tar.gz";
-    sha256 = "1cj6rlvbk05cfjkl1lnyvq12sb847jjwqy5j8906p2b2x4wq72qi";
+    sha256 = "0055xx9icmsr6l7v0iqrndmygygdpdv10550w6pyrb96svzhry27";
  };

-  propagatedBuildInputs = with python2Packages; [
+  # setup.py reads the UTF-8 encoded readme.
+  LC_ALL = "en_US.UTF-8";
+  buildInputs = [ glibcLocales ];
+
+  propagatedBuildInputs = with python3Packages; [
    atomicwrites
    configobj
    vobject
@ -18,6 +22,9 @@ python2Packages.buildPythonApplication rec {
    pyyaml
  ];

+  # Fails; but there are no tests anyway.
+  doCheck = false;
+
  meta = {
    homepage = https://github.com/scheibler/khard;
    description = "Console carddav client";
--- a/pkgs/applications/misc/lenmus/default.nix
+++ b/pkgs/applications/misc/lenmus/default.nix
@ -7,20 +7,15 @@

 stdenv.mkDerivation rec {
  name = "lenmus-${version}";
-  version = "5.4.1";
+  version = "5.4.2";

  src = fetchFromGitHub {
    owner = "lenmus";
    repo = "lenmus";
    rev = "Release_${version}";
-    sha256 = "03xar8x38x20cns2gnv34jp0hw0k16sa62kkfhka9iiiw90wfyrp";
+    sha256 = "1n639xr1qxx6rhqs0c6sjxp3bv8cwkmw1vfk1cji7514gj2a9v3p";
  };

-  postPatch = ''
-    substituteInPlace CMakeLists.txt \
-      --replace "DESTINATION \"/usr/share" "DESTINATION \"$out/share"
-  '';
-
  cmakeFlags = [
    "-DCMAKE_INSALL_PREFIX=$out"
  ];
--- a/pkgs/applications/misc/monero/default.nix
+++ b/pkgs/applications/misc/monero/default.nix
@ -1,17 +1,21 @@
-{ stdenv, fetchurl, cmake, boost }:
+{ stdenv, fetchFromGitHub, cmake, boost, miniupnpc, pkgconfig, unbound }:

 let
-  version = "0.8.8.4";
+  version = "0.9.4";
 in
 stdenv.mkDerivation {
  name = "monero-${version}";

-  src = fetchurl {
-    url = "https://github.com/monero-project/bitmonero/archive/v${version}.tar.gz";
-    sha256 = "0bbhqjjzh922aymjqrnl2hd3r8x6p7x5aa5jidv3l4d77drhlgzy";
+  src = fetchFromGitHub {
+    owner = "monero-project";
+    repo = "bitmonero";
+    rev = "v${version}";
+    sha256 = "1qzpy1mxz0ky6hfk1gf67ybbr9xy6p6irh6zwri35h1gb97sbc3c";
  };

-  buildInputs = [ cmake boost ];
+  nativeBuildInputs = [ cmake pkgconfig ];
+
+  buildInputs = [ boost miniupnpc unbound ];

  # these tests take a long time and don't
  # always complete in the build environment
@ -20,14 +24,17 @@ stdenv.mkDerivation {
  NIX_CFLAGS_COMPILE = "-Wno-error=cpp";

  doCheck = false;
-  checkTarget = "test-release"; # this would be the target

  installPhase = ''
    install -Dt "$out/bin/" \
-        src/bitmonerod \
-        src/connectivity_tool \
-        src/simpleminer \
-        src/simplewallet
+        bin/bitmonerod \
+        bin/blockchain_converter \
+        bin/blockchain_dump \
+        bin/blockchain_export \
+        bin/blockchain_import \
+        bin/cn_deserialize \
+        bin/simpleminer \
+        bin/simplewallet
  '';

  meta = with stdenv.lib; {
--- a/pkgs/applications/misc/qtbitcointrader/default.nix
+++ b/pkgs/applications/misc/qtbitcointrader/default.nix
@ -16,11 +16,13 @@ stdenv.mkDerivation {
  postUnpack = "sourceRoot=\${sourceRoot}/src";

  configurePhase = ''
+    runHook preConfigure
    qmake $qmakeFlags \
      PREFIX=$out \
      DESKTOPDIR=$out/share/applications \
      ICONDIR=$out/share/pixmaps \
      QtBitcoinTrader_Desktop.pro
+    runHook postConfigure
  '';

  meta = with stdenv.lib;
--- a/pkgs/applications/misc/rtv/default.nix
+++ b/pkgs/applications/misc/rtv/default.nix
@ -1,14 +1,14 @@
 { stdenv, fetchFromGitHub, pkgs, lib, python, pythonPackages }:

 pythonPackages.buildPythonApplication rec {
-  version = "1.9.0";
+  version = "1.10.0";
  name = "rtv-${version}";

  src = fetchFromGitHub {
    owner = "michael-lazar";
    repo = "rtv";
    rev = "v${version}";
-    sha256 = "18r3i2zlcprj6d4nzhhbd6sm1fs2x28924xsm6lcxa1643gkyb7i";
+    sha256 = "1gm5jyqqssf69lfx0svhzsb9m0dffm6zsf9jqnwh6gjihfz25a45";
  };

  propagatedBuildInputs = with pythonPackages; [
@ -18,6 +18,7 @@ pythonPackages.buildPythonApplication rec {
    praw
    kitchen
    python.modules.curses
+    praw
  ] ++ lib.optional (!pythonPackages.isPy3k) futures;

  meta = with lib; {
--- a/pkgs/applications/misc/timewarrior/default.nix
+++ b/pkgs/applications/misc/timewarrior/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  name = "timewarrior-${version}";
-  version = "0.9.5.alpha";
+  version = "1.0.0.beta1";

  enableParallelBuilding = true;

  src = fetchurl {
    url = "https://taskwarrior.org/download/timew-${version}.tar.gz";
-    sha256 = "154d5sgxcmz1b7g401c7s6sf7pkk0hh74dx6rss3vkamsjc4wgl8";
+    sha256 = "1gkh07mw8hiqslw8ps35r9lp5jbdy93s0sdrcbp34dd5h99qx587";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/misc/xterm/default.nix
+++ b/pkgs/applications/misc/xterm/default.nix
@ -1,4 +1,6 @@
-{ stdenv, fetchurl, xorg, ncurses, freetype, fontconfig, pkgconfig }:
+{ stdenv, fetchurl, xorg, ncurses, freetype, fontconfig, pkgconfig
+, enableDecLocator ? true
+}:

 stdenv.mkDerivation rec {
  name = "xterm-325";
@ -27,9 +29,8 @@ stdenv.mkDerivation rec {
    "--enable-doublechars"
    "--enable-luit"
    "--enable-mini-luit"
-    "--enable-dec-locator"
    "--with-tty-group=tty"
-  ];
+  ] ++ stdenv.lib.optional enableDecLocator "--enable-dec-locator";

  # Work around broken "plink.sh".
  NIX_LDFLAGS = "-lXmu -lXt -lICE -lX11 -lfontconfig";
--- a/pkgs/applications/networking/browsers/midori/default.nix
+++ b/pkgs/applications/networking/browsers/midori/default.nix
@ -1,20 +1,20 @@
 { stdenv, fetchurl, cmake, pkgconfig, intltool, vala, makeWrapper
 , gtk3, webkitgtk, librsvg, libnotify, sqlite
-, glib_networking, gsettings_desktop_schemas, libsoup
+, glib_networking, gsettings_desktop_schemas, libsoup, pcre, gnome3
 }:

 let
-  version = "0.5.8";
+  version = "0.5.11";
 in
 stdenv.mkDerivation rec {
  name = "midori-${version}";

-  meta = {
+  meta = with stdenv.lib; {
    description = "Lightweight WebKitGTK+ web browser";
    homepage = "http://midori-browser.org";
-    license = stdenv.lib.licenses.lgpl21Plus;
-    platforms = stdenv.lib.platforms.linux;
-    maintainers = with stdenv.lib.maintainers; [ raskin ];
+    license = licenses.lgpl21Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ raskin ramkromberg ];
  };

  src = fetchurl {
@ -23,21 +23,21 @@ stdenv.mkDerivation rec {
      "http://mirrors-ru.go-parts.com/blfs/conglomeration/midori/midori_${version}_all_.tar.bz2"
    ];
    name = "midori_${version}_all_.tar.bz2";
-    sha256 = "10ckm98rfqfbwr84b8mc1ssgj84wjgkr4dadvx2l7c64sigi66dg";
+    sha256 = "0gcwqkcyliqz10i33ww3wl02mmfnl7jzl2d493l4l53ipsb1l6cn";
  };

-  sourceRoot = ".";
-
  buildInputs = [
    cmake pkgconfig intltool vala makeWrapper
-    webkitgtk librsvg libnotify sqlite gsettings_desktop_schemas
-    (libsoup.override {gnomeSupport = true;})
+    webkitgtk librsvg libnotify sqlite gsettings_desktop_schemas pcre gnome3.gcr
+    (libsoup.override {gnomeSupport = true; valaSupport = true;})
  ];

-  cmakeFlags = ''
-    -DHALF_BRO_INCOM_WEBKIT2=ON
-    -DUSE_ZEITGEIST=OFF
-  '';
+  cmakeFlags = [ 
+    "-DCMAKE_BUILD_TYPE=Release"
+    "-DUSE_ZEITGEIST=OFF"
+    "-DHALF_BRO_INCOM_WEBKIT2=OFF"
+    "-DUSE_GTK3=1"
+  ];

  NIX_LDFLAGS="-lX11";

--- a/pkgs/applications/networking/browsers/mozilla-plugins/bluejeans/default.nix
+++ b/pkgs/applications/networking/browsers/mozilla-plugins/bluejeans/default.nix
@ -17,11 +17,11 @@ in
 stdenv.mkDerivation rec {
  name = "bluejeans-${version}";

-  version = "2.160.63.8";
+  version = "2.160.66.8";

  src = fetchurl {
    url = "https://swdl.bluejeans.com/skinny/bjnplugin_${version}-1_amd64.deb";
-    sha256 = "1sfz9xvvrbw7gg7fxxwg9wmgbxgv3fa14p7i4m85mg10l3qxaqfc";
+    sha256 = "1wf9jgd2717gfzm2wb0hxj4i76kczhgnwfhhpiy15zkqdcsmczsr";
  };

  phases = [ "unpackPhase" "installPhase" "fixupPhase" ];
--- a/pkgs/applications/networking/browsers/qutebrowser/default.nix
+++ b/pkgs/applications/networking/browsers/qutebrowser/default.nix
@ -2,7 +2,7 @@
 , jinja2, pygments, pyyaml, pypeg2, gst-plugins-base, gst-plugins-good
 , gst-plugins-bad, gst-libav, wrapGAppsHook, glib_networking, makeQtWrapper }:

-let version = "0.7.0"; in
+let version = "0.8.1"; in

 buildPythonApplication rec {
  name = "qutebrowser-${version}";
@ -10,7 +10,7 @@ buildPythonApplication rec {

  src = fetchurl {
    url = "https://github.com/The-Compiler/qutebrowser/releases/download/v${version}/${name}.tar.gz";
-    sha256 = "17xvv4h86frcn7zmi0y9gjsz2cazlb59v3dqi9mdc11w00b1cqbn";
+    sha256 = "18hj95pgybpavwwnyczh6s94spljfngz684y1jlhqnpbp14pkflh";
  };

  # Needs tox
--- a/pkgs/applications/networking/cluster/mesos/default.nix
+++ b/pkgs/applications/networking/cluster/mesos/default.nix
@ -48,6 +48,9 @@ in stdenv.mkDerivation rec {
    substituteInPlace 3rdparty/libprocess/3rdparty/stout/include/stout/posix/os.hpp \
      --replace '"sh"' '"${bash}/bin/bash"'

+    substituteInPlace 3rdparty/libprocess/3rdparty/stout/include/stout/os/posix/shell.hpp \
+      --replace '"sh"' '"${bash}/bin/bash"'
+
    substituteInPlace 3rdparty/libprocess/3rdparty/stout/include/stout/os/posix/fork.hpp \
      --replace '"sh"' '"${bash}/bin/bash"'

--- a/pkgs/applications/networking/ftp/filezilla/default.nix
+++ b/pkgs/applications/networking/ftp/filezilla/default.nix
@ -1,13 +1,13 @@
 { stdenv, fetchurl, dbus, gnutls, wxGTK30, libidn, tinyxml, gettext
 , pkgconfig, xdg_utils, gtk2, sqlite, pugixml, libfilezilla, nettle }:

-let version = "3.19.0"; in
+let version = "3.20.0"; in
 stdenv.mkDerivation {
  name = "filezilla-${version}";

  src = fetchurl {
    url = "mirror://sourceforge/project/filezilla/FileZilla_Client/${version}/FileZilla_${version}_src.tar.bz2";
-    sha256 = "0827z1jmn8pkzrcpjgh5yh2r23vgv73yb4rikraxa9i7l118g9l2";
+    sha256 = "0clfw266c980w2kjl4xm56d80ixpv8lj675p58hv2bz70ihxpwaa";
  };

  configureFlags = [
--- a/pkgs/applications/networking/mailreaders/neomutt/default.nix
+++ b/pkgs/applications/networking/mailreaders/neomutt/default.nix
@ -2,14 +2,14 @@
 , cyrus_sasl, gdbm, gpgme, kerberos, libidn, notmuch, openssl }:

 stdenv.mkDerivation rec {
-  version = "20160611";
+  version = "20160723";
  name = "neomutt-${version}";

  src = fetchFromGitHub {
    owner = "neomutt";
    repo = "neomutt";
    rev = "neomutt-${version}";
-    sha256 = "12487hydn9x1yyxzc0x7hssgjwji3i64glmbi7synjc8arfqc5zs";
+    sha256 = "16xjyad435n03qvmqysgsf4k36cfcv2k4irg92ajhm4dbz9d9l3j";
  };

  buildInputs =
--- a/pkgs/applications/networking/sniffers/wireshark/default.nix
+++ b/pkgs/applications/networking/sniffers/wireshark/default.nix
@ -11,7 +11,7 @@ assert withQt -> !withGtk && qt4 != null;
 with stdenv.lib;

 let
-  version = "2.0.4";
+  version = "2.0.5";
  variant = if withGtk then "gtk" else if withQt then "qt" else "cli";
 in

@ -20,7 +20,7 @@ stdenv.mkDerivation {

  src = fetchurl {
    url = "http://www.wireshark.org/download/src/all-versions/wireshark-${version}.tar.bz2";
-    sha256 = "19g11m8m8qd7dkcvcb27lyppklg608d9ap7wr3mr88clm4nwiacy";
+    sha256 = "02xi3fz8blcz9cf75rs11g7bijk06wm45vpgnksp72c2609j9q0c";
  };

  buildInputs = [
--- a/pkgs/applications/networking/sync/unison/default.nix
+++ b/pkgs/applications/networking/sync/unison/default.nix
@ -3,10 +3,10 @@

 stdenv.mkDerivation (rec {

-  name = "unison-2.48.3";
+  name = "unison-2.48.4";
  src = fetchurl {
    url = "http://www.seas.upenn.edu/~bcpierce/unison/download/releases/stable/${name}.tar.gz";
-    sha256 = "10sln52rnnsj213jy3166m0q97qpwnrwl6mm529xfy10x3xkq3gl";
+    sha256 = "30aa53cd671d673580104f04be3cf81ac1e20a2e8baaf7274498739d59e99de8";
  };

  buildInputs = [ ocaml makeWrapper ncurses ];
--- a/pkgs/applications/networking/syncthing/default.nix
+++ b/pkgs/applications/networking/syncthing/default.nix
@ -1,13 +1,14 @@
-{ stdenv, fetchgit, go }:
+{ stdenv, fetchFromGitHub, go }:

 stdenv.mkDerivation rec {
-  version = "0.14.0";
+  version = "0.14.3";
  name = "syncthing-${version}";

-  src = fetchgit {
-    url = https://github.com/syncthing/syncthing;
-    rev = "refs/tags/v${version}";
-    sha256 = "15l3q3r6i3q95i474winswx4y149b5ic7xhpnj52s78fxd4va2q2";
+  src = fetchFromGitHub {
+    owner = "syncthing";
+    repo = "syncthing";
+    rev = "v${version}";
+    sha256 = "114i0911h3q6dn3j9x2qcm5lzpqclvrpf5vk87qpqp9qy62jp3az";
  };

  buildInputs = [ go ];
@ -32,7 +33,7 @@ stdenv.mkDerivation rec {
    homepage = https://www.syncthing.net/;
    description = "Open Source Continuous File Synchronization";
    license = stdenv.lib.licenses.mpl20;
-    maintainers = with stdenv.lib.maintainers; [pshendry];
+    maintainers = with stdenv.lib.maintainers; [ pshendry joko peterhoeg ];
    platforms = with stdenv.lib.platforms; linux ++ freebsd ++ openbsd ++ netbsd;
  };
 }
--- a/pkgs/applications/networking/syncthing/inotify-deps.json
+++ b/pkgs/applications/networking/syncthing/inotify-deps.json
@ -0,0 +1,38 @@
+[
+  {
+    "goPackagePath": "github.com/cenkalti/backoff",
+    "fetch": {
+      "type": "git",
+      "url": "https://github.com/cenkalti/backoff",
+      "rev": "cdf48bbc1eb78d1349cbda326a4a037f7ba565c6",
+      "sha256": "0dg7hvpv0a1db8qriygz1jqgp16v8k505b197x9902z7z6lldgbh"
+    }
+  },
+  {
+    "goPackagePath": "github.com/gobwas/glob",
+    "fetch": {
+      "type": "git",
+      "url": "https://github.com/gobwas/glob",
+      "rev": "ce6abff51712df5da11095fb41dd4b0353559797",
+      "sha256": "1gxv4nnn3f9hw1ncdmhsr8fbfdma2h713ima7b4k28gxydfa8i9m"
+    }
+  },
+  {
+    "goPackagePath": "github.com/syncthing/syncthing",
+    "fetch": {
+      "type": "git",
+      "url": "https://github.com/syncthing/syncthing",
+      "rev": "66a506e72b9dcc749d09a03cb120ba86bbf3d7f8",
+      "sha256": "0is4f1r3im2bbmbca9fafzxffikxaf86vd6f851831fk5wi4pzw9"
+    }
+  },
+  {
+    "goPackagePath": "github.com/zillode/notify",
+    "fetch": {
+      "type": "git",
+      "url": "https://github.com/zillode/notify",
+      "rev": "2da5cc9881e8f16bab76b63129c7781898f97d16",
+      "sha256": "0qwsj730p5mivp2xw9zr5vq8xr7rr9cxjmi564wgmsn7dcvqnr40"
+    }
+  }
+]
--- a/pkgs/applications/networking/syncthing/inotify.nix
+++ b/pkgs/applications/networking/syncthing/inotify.nix
@ -0,0 +1,26 @@
+{ stdenv, buildGoPackage, fetchFromGitHub }:
+
+buildGoPackage rec {
+  name = "syncthing-inotify-${version}";
+  version = "0.8.3";
+
+  goPackagePath = "github.com/syncthing/syncthing-inotify";
+
+  src = fetchFromGitHub {
+    owner = "syncthing";
+    repo = "syncthing-inotify";
+    rev = "v${version}";
+    sha256 = "194pbz9zzxaz0vri93czpbsxl85znlba2gy61mjgyr0dm2h4s6yw";
+  };
+
+  goDeps = ./inotify-deps.json;
+
+  meta = {
+    homepage = https://github.com/syncthing/syncthing-inotify;
+    description = "File watcher intended for use with Syncthing";
+    license = stdenv.lib.licenses.mpl20;
+    maintainers = with stdenv.lib.maintainers; [ joko ];
+    platforms = with stdenv.lib.platforms; linux ++ freebsd ++ openbsd ++ netbsd;
+  };
+
+}
--- a/pkgs/applications/science/electronics/alliance/default.nix
+++ b/pkgs/applications/science/electronics/alliance/default.nix
@ -1,23 +1,74 @@
-{stdenv, fetchurl, xproto, motif, libX11, libXt, libXpm, bison, flex}:
+{ stdenv, fetchurl
+, xproto, motif, libX11, libXt, libXpm, bison
+, flex, automake, autoconf, libtool
+}:

-stdenv.mkDerivation {
-  name = "alliance-5.0-20070718";
+stdenv.mkDerivation rec {
+  name = "alliance-${version}";
+  version = "5.1.1";

  src = fetchurl {
-    url = http://www-asim.lip6.fr/pub/alliance/distribution/5.0/alliance-5.0-20070718.tar.gz;
-    sha256 = "4e17c8f9f4d344061166856d47e58527c6ae870fda0c73b5ba0200967d23af9f";
+    url = "http://www-asim.lip6.fr/pub/alliance/distribution/5.0/${name}.tar.bz2";
+    sha256 = "046c9qwl1vbww0ljm4xyxf5jpz9nq62b2q0wdz9xjimgh4c207w1";
  };

-  buildInputs = [ xproto motif xproto libX11 libXt libXpm bison flex];

-  patchPhase = ''
-    sed -i -e \
-      "s/private: static void  operator delete/public: static void  operator delete/" \
-      nero/src/ADefs.h
+  nativeBuildInputs = [ libtool automake autoconf flex ];
+  buildInputs = [ xproto motif xproto libX11 libXt libXpm bison ];
+
+  sourceRoot = "alliance/src/";
+
+  configureFlags = [
+    "--prefix=$(out)"
+    "--disable-static"
+  ];
+
+  preConfigure = ''
+    mkdir -p $out/etc
+
+    #texlive for docs seems extreme
+    mkdir -p $out/share/alliance
+    mv ./documentation $out/share/alliance
+    substituteInPlace autostuff \
+      --replace "$newdirs documentation" "$newdirs" \
+      --replace documentation Solaris
+
+    substituteInPlace sea/src/DEF_grammar_lex.l \
+      --replace "ifndef FLEX_BETA" "if (YY_FLEX_MAJOR_VERSION <= 2) && (YY_FLEX_MINOR_VERSION < 6)"
+    ./autostuff
  '';

-  meta = {
-      description = "Complete set of free CAD tools and portable libraries for VLSI design";
-      homepage = http://www-asim.lip6.fr/recherche/alliance/;
+  allianceInstaller = ''
+    #!${stdenv.shell}
+    cp -v -r -n --no-preserve=mode  $out/etc/* /etc/ > /etc/alliance-install.log
+  '';
+
+  allianceUnInstaller = ''
+    #!${stdenv.shell}
+    awk '{print \$3}' /etc/alliance-install.log | xargs rm
+    awk '{print \$3}' /etc/alliance-install.log | xargs rmdir
+    rm /etc/alliance-install.log
+  '';
+
+  postInstall = ''
+    sed -i "s|ALLIANCE_TOP|$out|" distrib/*.desktop
+    mkdir -p $out/share/applications
+    cp -p distrib/*.desktop $out/share/applications/
+    mkdir -p $out/icons/hicolor/48x48/apps/
+    cp -p distrib/*.png $out/icons/hicolor/48x48/apps/
+
+    echo "${allianceInstaller}" > $out/bin/alliance-install
+    chmod +x $out/bin/alliance-install
+
+    echo "${allianceUnInstaller}" > $out/bin/alliance-uninstall
+    chmod +x $out/bin/alliance-uninstall
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Complete set of free CAD tools and portable libraries for VLSI design";
+    homepage = http://www-asim.lip6.fr/recherche/alliance/;
+    license = with licenses; gpl2Plus;
+    maintainers = with maintainers; [ ];
+    platforms = with platforms; linux;
  };
 }
--- a/pkgs/applications/science/logic/hol_light/default.nix
+++ b/pkgs/applications/science/logic/hol_light/default.nix
@ -9,19 +9,17 @@ let
 in

 stdenv.mkDerivation {
-  name     = "hol_light-2015-11-02";
+  name     = "hol_light-2016-07-23";

  src = fetchFromGitHub {
    owner  = "jrh13";
    repo   = "hol-light";
-    rev    = "10265313397476ddff4ce13e7bbb588025e7272c";
-    sha256 = "17b6a7vk9fhppl0h366y7pw6a9sknq1a8gxqg67dzqpb47vda1n0";
+    rev    = "67cff936dda719f0e0ee57ab9d07c779ff664660";
+    sha256 = "0r85ifdvsvk2cdv7s4a0kf9ha6jdznqmz7swvp577f8r182klr28";
  };

  buildInputs = [ ocaml camlp5 ];

-  patches = [ ./Makefile.patch ];
-
  installPhase = ''
    mkdir -p "$out/lib/hol_light" "$out/bin"
    cp -a  . $out/lib/hol_light
--- a/pkgs/applications/science/logic/lean/default.nix
+++ b/pkgs/applications/science/logic/lean/default.nix
@ -1,18 +1,18 @@
-{ stdenv, fetchFromGitHub, cmake, gmp, mpfr, luajit, boost, python
+{ stdenv, fetchFromGitHub, cmake, gmp, mpfr, boost, python
 , gperftools, ninja, makeWrapper }:

 stdenv.mkDerivation rec {
  name = "lean-${version}";
-  version = "20160117";
+  version = "2016-07-05";

  src = fetchFromGitHub {
    owner  = "leanprover";
    repo   = "lean";
-    rev    = "b2554dcb8f45899ccce84f226cd67b6460442930";
-    sha256 = "1gr024bly92kdjky5qvcm96gn86ijakziiyrsz91h643n1iyxhms";
+    rev    = "cc70845332e63a1f1be21dc1f96d17269fc85909";
+    sha256 = "09qz2vjw7whiggvw0cdaa4i2f49wnch2sd4r43glq181ssln27d6";
  };

-  buildInputs = [ gmp mpfr luajit boost cmake python gperftools ninja makeWrapper ];
+  buildInputs = [ gmp mpfr boost cmake python gperftools ninja makeWrapper ];
  enableParallelBuilding = true;

  preConfigure = ''
@ -26,11 +26,11 @@ stdenv.mkDerivation rec {
    wrapProgram $out/bin/linja --prefix PATH : $out/bin:${ninja}/bin
  '';

-  meta = {
+  meta = with stdenv.lib; {
    description = "Automatic and interactive theorem prover";
    homepage    = "http://leanprover.github.io";
-    license     = stdenv.lib.licenses.asl20;
-    platforms   = stdenv.lib.platforms.unix;
-    maintainers = [ stdenv.lib.maintainers.thoughtpolice ];
+    license     = licenses.asl20;
+    platforms   = platforms.unix;
+    maintainers = with maintainers; [ thoughtpolice gebner ];
  };
 }
--- a/pkgs/applications/science/logic/leo2/default.nix
+++ b/pkgs/applications/science/logic/leo2/default.nix
@ -1,64 +1,37 @@
-x@{builderDefsPackage
-  , ocaml, eprover, zlib
-  , ...}:
-builderDefsPackage
-(a :  
-let 
-  helperArgNames = ["stdenv" "fetchurl" "builderDefsPackage"] ++ 
-    ["eprover"];
+{ stdenv, fetchurl, makeWrapper, eprover, ocaml, perl, zlib }:

-  buildInputs = map (n: builtins.getAttr n x)
-    (builtins.attrNames (builtins.removeAttrs x helperArgNames));
-  sourceInfo = rec {
-    baseName="leo2";
-    version = "1.6.2";
-    name="${baseName}_v${version}";
+stdenv.mkDerivation rec {
+  name = "leo2-${version}";
+  version = "1.6.2";
+
+  src = fetchurl {
    url = "http://page.mi.fu-berlin.de/cbenzmueller/leo/leo2_v${version}.tgz";
-    hash="d46a94f5991623386eb9061cfb0d748e258359a8c690fded173d35303e0e9e3a";
-  };
-in
-rec {
-  src = a.fetchurl {
-    url = sourceInfo.url;
    sha256 = "1wjpmizb181iygnd18lx7p77fwaci2clgzs5ix5j51cc8f3pazmv";
  };

-  name = "${sourceInfo.baseName}-${sourceInfo.version}";
-  inherit buildInputs;
+  buildInputs = [ makeWrapper eprover ocaml perl zlib ];

-  phaseNames = ["makeInstallationDir" "doUnpack" "doMake" "doFinalize"];
+  sourceRoot = "leo2/src";

-  makeInstallationDir = a.fullDepEntry (''
-    mkdir -p "$out/share/leo2/build-dir"
-    cd "$out/share/leo2/build-dir"
-  '') ["minInit" "defEnsureDir"];
+  preConfigure = "patchShebangs configure";

-  goSrcDir = "cd src/";
+  buildFlags = [ "opt" ];

-  doFinalize = a.fullDepEntry (''
-    mkdir -p "$out/bin"
-    echo -e "#! /bin/sh\\n$PWD/../bin/leo --atprc $out/etc/leoatprc \"\$@\"\\n" > "$out/bin/leo"
-    chmod a+x "$out/bin/leo"
+  preInstall = "mkdir -p $out/bin";
+
+  postInstall = ''
    mkdir -p "$out/etc"
    echo -e "e = ${eprover}/bin/eprover\\nepclextract = ${eprover}/bin/epclextract" > "$out/etc/leoatprc"
-  '') ["minInit" "doMake" "defEnsureDir"];

-  makeFlags = [
-    "SHELL=${a.stdenv.shell}"
-  ];
+    wrapProgram $out/bin/leo \
+      --add-flags "--atprc $out/etc/leoatprc"
+  '';

-  meta = {
+  meta = with stdenv.lib; {
    description = "A high-performance typed higher order prover";
-    maintainers = with a.lib.maintainers;
-    [
-      raskin
-    ];
-    platforms = with a.lib.platforms;
-      linux;
-    license = a.lib.licenses.bsd3;
-    inherit (sourceInfo) version;
-    homepage = "http://page.mi.fu-berlin.de/cbenzmueller/leo/";
-    downloadPage = "http://page.mi.fu-berlin.de/cbenzmueller/leo/download.html";
+    maintainers = [ maintainers.raskin ];
+    platforms = platforms.linux;
+    license = licenses.bsd3;
+    homepage = http://www.leoprover.org/;
  };
-}) x
-
+}
--- a/pkgs/applications/science/math/scilab-bin/default.nix
+++ b/pkgs/applications/science/math/scilab-bin/default.nix
@ -0,0 +1,75 @@
+{ stdenv, fetchurl, lib, xlibs }:
+
+let
+  name = "scilab-bin-${ver}";
+
+  ver = "5.5.2";
+
+  majorVer = builtins.elemAt (lib.splitString "." ver) 0;
+
+  badArch = throw "${name} requires i686-linux or x86_64-linux";
+
+  architecture =
+    if stdenv.system == "i686-linux" then
+      "i686"
+    else if stdenv.system == "x86_64-linux" then
+      "x86_64"
+    else
+      badArch;
+in
+stdenv.mkDerivation rec {
+  inherit name;
+
+  src = fetchurl {
+    url = "http://www.scilab.org/download/${ver}/scilab-${ver}.bin.linux-${architecture}.tar.gz";
+    sha256 =
+      if stdenv.system == "i686-linux" then
+        "6143a95ded40411a35630a89b365875a6526cd4db1e2865ac5612929a7db937a"
+      else if stdenv.system == "x86_64-linux" then
+        "c0dd7a5f06ec7a1df7a6b1b8b14407ff7f45e56821dff9b3c46bd09d4df8d350"
+      else
+        badArch;
+  };
+
+  libPath = lib.makeLibraryPath [
+    stdenv.cc.cc
+    xlibs.libX11
+    xlibs.libXext
+    xlibs.libXi
+    xlibs.libXrender
+    xlibs.libXtst
+    xlibs.libXxf86vm
+  ];
+
+  phases = [ "unpackPhase" "fixupPhase" "installPhase" ];
+
+  fixupPhase = ''
+    sed -i 's|\$(/bin/|$(|g' bin/scilab
+    sed -i 's|/usr/bin/||g' bin/scilab
+
+    sci="$out/opt/scilab-${ver}"
+    fullLibPath="$sci/lib/scilab:$sci/lib/thirdparty:$libPath"
+    fullLibPath="$fullLibPath:$sci/lib/thirdparty/redist"
+
+    patchelf --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
+             --set-rpath "$fullLibPath" bin/scilab-bin
+    find . -name '*.so' -type f | while read file; do
+      patchelf --set-rpath "$fullLibPath" "$file" 2>/dev/null
+    done
+  '';
+
+  installPhase = ''
+    mkdir -p "$out/opt/scilab-${ver}"
+    cp -r . "$out/opt/scilab-${ver}/"
+    mkdir "$out/bin"
+    ln -s "$out/opt/scilab-${ver}/bin/scilab" "$out/bin/scilab-${ver}"
+    ln -s "scilab-${ver}" "$out/bin/scilab-${majorVer}"
+  '';
+
+  meta = {
+    homepage = http://www.scilab.org/;
+    description = "Scientific software package for numerical computations (Matlab lookalike)";
+    # see http://www.scilab.org/legal_notice
+    license = "Scilab";
+  };
+}
--- a/pkgs/applications/science/misc/root/default.nix
+++ b/pkgs/applications/science/misc/root/default.nix
@ -1,16 +1,23 @@
 { stdenv, fetchurl, fetchpatch, cmake, pkgconfig, python
-, libX11, libXpm, libXft, libXext, zlib, lzma }:
+, libX11, libXpm, libXft, libXext, zlib, lzma, gsl }:

 stdenv.mkDerivation rec {
  name = "root-${version}";
-  version = "6.04.16";
+  version = "6.04.18";

  src = fetchurl {
    url = "https://root.cern.ch/download/root_v${version}.source.tar.gz";
-    sha256 = "0f58dg83aqhggkxmimsfkd1qyni2vhmykq4qa89cz6jr9p73i1vm";
+    sha256 = "00f3v3l8nimfkcxpn9qpyh3h23na0mi4wkds2y5gwqh8wh3jryq9";
  };

-  buildInputs = [ cmake pkgconfig python libX11 libXpm libXft libXext zlib lzma ];
+  buildInputs = [ cmake pkgconfig python libX11 libXpm libXft libXext zlib lzma gsl ];
+
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/root-mirror/root/commit/ee9964210c56e7c1868618a4434c5340fef38fe4.patch";
+      sha256 = "186i7ni75yvjydy6lpmaplqxfb5z2019bgpbhff1n6zn2qlrff2r";
+    })
+  ];

  preConfigure = ''
    patchShebangs build/unix/
@ -23,6 +30,8 @@ stdenv.mkDerivation rec {
  ]
  ++ stdenv.lib.optional (stdenv.cc.libc != null) "-DC_INCLUDE_DIRS=${stdenv.cc.libc}/include";

+  enableParallelBuilding = true;
+
  meta = {
    homepage = "https://root.cern.ch/";
    description = "A data analysis framework";
--- a/pkgs/applications/version-management/git-and-tools/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/default.nix
@ -15,6 +15,7 @@ let
      perlPackages.MIMEBase64 perlPackages.AuthenSASL
      perlPackages.DigestHMAC
    ];
+    gitwebPerlLibs = with perlPackages; [ CGI HTMLParser ];
  };

 in
--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@ -2,7 +2,7 @@
 , gnugrep, gzip, openssh
 , asciidoc, texinfo, xmlto, docbook2x, docbook_xsl, docbook_xml_dtd_45
 , libxslt, tcl, tk, makeWrapper, libiconv
-, svnSupport, subversionClient, perlLibs, smtpPerlLibs
+, svnSupport, subversionClient, perlLibs, smtpPerlLibs, gitwebPerlLibs
 , guiSupport
 , withManual ? true
 , pythonSupport ? true
@ -10,7 +10,7 @@
 }:

 let
-  version = "2.9.1";
+  version = "2.9.2";
  svn = subversionClient.override { perlBindings = true; };
 in

@ -19,7 +19,7 @@ stdenv.mkDerivation {

  src = fetchurl {
    url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    sha256 = "18l2jb4bkp9ljz6p2aviwzxqyzza9z3v6h1pnkz7kjf1fay61zp8";
+    sha256 = "1d9dmhgzcnwc2jbib4q23ypjbnw1gh1w8gif63qldwkpixj4dxgq";
  };

  hardeningDisable = [ "format" ];
@ -104,6 +104,11 @@ stdenv.mkDerivation {
      # gitweb.cgi, need to patch so that it's found
      sed -i -e "s|'compressor' => \['gzip'|'compressor' => ['${gzip}/bin/gzip'|" \
          $out/share/gitweb/gitweb.cgi
+      # Give access to CGI.pm and friends (was removed from perl core in 5.22)
+      for p in ${stdenv.lib.concatStringsSep " " gitwebPerlLibs}; do
+          sed -i -e "/use CGI /i use lib \"$p/lib/perl5/site_perl\";" \
+              "$out/share/gitweb/gitweb.cgi"
+      done

      # Also put git-http-backend into $PATH, so that we can use smart
      # HTTP(s) transports for pushing
--- a/pkgs/applications/version-management/meld/default.nix
+++ b/pkgs/applications/version-management/meld/default.nix
@ -1,11 +1,11 @@
-{ stdenv, fetchurl, itstool, buildPythonApplication, python27, intltool, makeWrapper
-, libxml2, pygobject3, gobjectIntrospection, gtk3, gnome3, pycairo, cairo
+{ stdenv, fetchurl, itstool, buildPythonApplication, python27, intltool, wrapGAppsHook
+, libxml2, pygobject3, gobjectIntrospection, gtk3, gnome3, pycairo, cairo, file
 }:


 let
  minor = "3.16";
-  version = "${minor}.1";
+  version = "${minor}.2";
 in

 buildPythonApplication rec {
@ -14,13 +14,13 @@ buildPythonApplication rec {

  src = fetchurl {
    url = "mirror://gnome/sources/meld/${minor}/meld-${version}.tar.xz";
-    sha256 = "1bec697aa1ababa315ca8241ade65dc68ea87f0d316632f590975afcf967cfab";
+    sha256 = "2dd3f58b95444bf721e0c912668c29cf8f47a402440b772ea12c4b9a0c94966f";
  };

  buildInputs = [
-    python27 intltool makeWrapper itstool libxml2
+    python27 intltool wrapGAppsHook itstool libxml2
    gnome3.gtksourceview gnome3.gsettings_desktop_schemas pycairo cairo
-    gnome3.defaultIconTheme
+    gnome3.defaultIconTheme gnome3.dconf file
  ];
  propagatedBuildInputs = [ gobjectIntrospection pygobject3 gtk3 ];

@ -37,13 +37,6 @@ buildPythonApplication rec {
    mv $out/share/glib-2.0 $out/share/gsettings-schemas/$name/
  '';

-  preFixup = ''
-    wrapProgram $out/bin/meld \
-      --prefix GI_TYPELIB_PATH : "$GI_TYPELIB_PATH" \
-      --prefix XDG_DATA_DIRS : "$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH:$out/share" \
-      --prefix GIO_EXTRA_MODULES : "${gnome3.dconf}/lib/gio/modules"
-  '';
-
  patchPhase = ''
    patchShebangs bin/meld
  '';
--- a/pkgs/applications/video/mkvtoolnix/default.nix
+++ b/pkgs/applications/video/mkvtoolnix/default.nix
@ -10,13 +10,13 @@ with stdenv.lib;

 stdenv.mkDerivation rec {
  name = "mkvtoolnix-${version}";
-  version = "9.2.0";
+  version = "9.3.1";

  src = fetchFromGitHub {
    owner = "mbunkus";
    repo = "mkvtoolnix";
    rev = "release-${version}";
-    sha256 = "02w3161iqaijs3bz5w2wily9nz55xnhq1bdm2s5qi8v3sbcqd6df";
+    sha256 = "1vipznja07nr7gmzdbv93dv2ggmw4x1bh6xxnn13k3fk6ysqh163";
  };

  nativeBuildInputs = [ pkgconfig autoconf automake gettext ruby ];
--- a/pkgs/build-support/fetchpatch/default.nix
+++ b/pkgs/build-support/fetchpatch/default.nix
@ -4,8 +4,8 @@
 # often change with updating of git or cgit.
 # stripLen acts as the -p parameter when applying a patch.

-{ fetchurl, patchutils }:
-{ stripLen ? 0, ... }@args:
+{ lib, fetchurl, patchutils }:
+{ stripLen ? 0, addPrefixes ? false, ... }@args:

 fetchurl ({
  postFetch = ''
@ -16,8 +16,12 @@ fetchurl ({
        "${patchutils}/bin/filterdiff" \
        --include={} \
        --strip=${toString stripLen} \
+        ${lib.optionalString addPrefixes ''
+           --addoldprefix=a/ \
+           --addnewprefix=b/ \
+        ''} \
        --clean "$out" > "$tmpfile"
    mv "$tmpfile" "$out"
    ${args.postFetch or ""}
  '';
-} // builtins.removeAttrs args ["stripLen"])
+} // builtins.removeAttrs args ["stripLen" "addPrefixes"])
--- a/pkgs/build-support/release/ant-build.nix
+++ b/pkgs/build-support/release/ant-build.nix
@ -28,7 +28,7 @@ stdenv.mkDerivation (
    postPhases =
      ["generateWrappersPhase" "finalPhase"];

-    prePhases = 
+    prePhases =
      ["antSetupPhase"];

    antSetupPhase = with stdenv.lib; ''
@ -41,8 +41,10 @@ stdenv.mkDerivation (
    '';

    installPhase = ''
+      runHook preInstall
+
      mkdir -p $out/share/java
-      ${ if jars == [] then '' 
+      ${ if jars == [] then ''
           find . -name "*.jar" | xargs -I{} cp -v {} $out/share/java
         '' else stdenv.lib.concatMapStrings (j: ''
           cp -v ${j} $out/share/java
@ -53,13 +55,15 @@ stdenv.mkDerivation (
        canonicalizeJar $j
        echo file jar $j >> $out/nix-support/hydra-build-products
      done
+
+      runHook postInstall
    '';

-    generateWrappersPhase = 
-      let 
+    generateWrappersPhase =
+      let
        cp = w: "-cp '${lib.optionalString (w ? classPath) w.classPath}${lib.optionalString (w ? mainClass) ":$out/share/java/*"}'";
      in
-      '' 
+      ''
      header "Generating jar wrappers"
    '' + (stdenv.lib.concatMapStrings (w: ''

@ -75,15 +79,19 @@ stdenv.mkDerivation (
      closeNest
    '';

-    buildPhase = if antTargets == [] then ''
+    buildPhase = ''
+      runHook preBuild
+    '' + (if antTargets == [] then ''
      header "Building default ant target"
      ant ${antFlags}
      closeNest
    '' else stdenv.lib.concatMapStrings (t: ''
      header "Building '${t}' target"
-      ant ${antFlags} ${t} 
+      ant ${antFlags} ${t}
      closeNest
-    '') antTargets;
+    '') antTargets) + ''
+      runHook postBuild
+    '';

    finalPhase =
      ''
@ -95,11 +103,11 @@ stdenv.mkDerivation (
      '';
  }

-  // removeAttrs args ["antProperties" "buildInputs" "pkgs" "jarWrappers"] // 
+  // removeAttrs args ["antProperties" "buildInputs" "pkgs" "jarWrappers"] //

  {
    name = name + (if src ? version then "-" + src.version else "");
-  
+
    buildInputs = [ant jre zip unzip] ++ stdenv.lib.optional (args ? buildInputs) args.buildInputs ;

    postHook = ''
@ -109,6 +117,6 @@ stdenv.mkDerivation (

      origSrc=$src
      src=$(findTarball $src)
-    ''; 
+    '';
  }
 )
--- a/pkgs/data/fonts/hasklig/default.nix
+++ b/pkgs/data/fonts/hasklig/default.nix
@ -1,11 +1,12 @@
 {stdenv, fetchurl, unzip}:

-stdenv.mkDerivation {
-  name = "hasklig-0.4";
+stdenv.mkDerivation rec {
+  name = "hasklig-${version}";
+  version = "0.9";

  src = fetchurl {
-    url = "https://github.com/i-tu/Hasklig/releases/download/0.4/Hasklig-0.4.zip";
-    sha256 = "14j0zfapw6s6x5psp1rvx2i59rxdwb1jgwfgfhzhypr22qy40xi8";
+    url = "https://github.com/i-tu/Hasklig/releases/download/${version}/Hasklig-${version}.zip";
+    sha256 = "0rav55f6j1b8pqjgwvw52b92j2m630ampamlsiiym2xf684wnw2d";
  };

  buildInputs = [ unzip ];
@ -24,6 +25,6 @@ stdenv.mkDerivation {
    description = "A font with ligatures for Haskell code based off Source Code Pro";
    license = licenses.ofl;
    platforms = platforms.all;
-    maintainers = with maintainers; [ davidrusu ];
+    maintainers = with maintainers; [ davidrusu profpatsch ];
  };
 }
--- a/pkgs/desktops/gnome-3/3.18/apps/accerciser/default.nix
+++ b/pkgs/desktops/gnome-3/3.18/apps/accerciser/default.nix
@ -1,28 +0,0 @@
-{ stdenv, fetchurl, pkgconfig, gnome3, gtk3, wrapGAppsHook
-, itstool, libxml2, python3, python3Packages, pyatspi, at_spi2_core
-, dbus, intltool, libwnck3 }:
-
-stdenv.mkDerivation rec {
-  name = "accerciser-3.14.0";
-
-  src = fetchurl {
-    url = "mirror://gnome/sources/accerciser/3.14/${name}.tar.xz";
-    sha256 = "0x05gpajpcs01g7m34g6fxz8122cf9kx3k0lchwl34jy8xfr39gm";
-  };
-
-  buildInputs = [
-    pkgconfig gtk3 wrapGAppsHook itstool libxml2 python3 pyatspi
-    python3Packages.pygobject3 python3Packages.ipython
-    at_spi2_core dbus intltool libwnck3 gnome3.defaultIconTheme
-  ];
-
-  wrapPrefixVariables = [ "PYTHONPATH" ];
-
-  meta = with stdenv.lib; {
-    homepage = https://wiki.gnome.org/Apps/Accerciser;
-    description = "Interactive Python accessibility explorer";
-    maintainers = gnome3.maintainers;
-    license = licenses.bsd3;
-    platforms = platforms.linux;
-  };
-}
--- a/pkgs/desktops/gnome-3/3.18/apps/bijiben/default.nix
+++ b/pkgs/desktops/gnome-3/3.18/apps/bijiben/default.nix
@ -1,36 +0,0 @@
-{ stdenv, intltool, fetchurl, pkgconfig, glib
-, evolution_data_server, evolution, sqlite
-, makeWrapper, itstool, desktop_file_utils
-, clutter_gtk, libuuid, webkitgtk, zeitgeist
-, gnome3, librsvg, gdk_pixbuf, libxml2 }:
-
-stdenv.mkDerivation rec {
-  inherit (import ./src.nix fetchurl) name src;
-
-  doCheck = true;
-
-  propagatedUserEnvPkgs = [ gnome3.gnome_themes_standard ];
-
-  buildInputs = [ pkgconfig glib intltool itstool libxml2
-                  clutter_gtk libuuid webkitgtk gnome3.tracker
-                  gnome3.gnome_online_accounts zeitgeist desktop_file_utils
-                  gnome3.gsettings_desktop_schemas makeWrapper
-                  gdk_pixbuf gnome3.defaultIconTheme librsvg
-                  evolution_data_server evolution sqlite ];
-
-  enableParallelBuilding = true;
-
-  preFixup = ''
-    wrapProgram "$out/bin/bijiben" \
-      --set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE" \
-      --prefix XDG_DATA_DIRS : "${gnome3.gnome_themes_standard}/share:$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH"
-  '';
-
-  meta = with stdenv.lib; {
-    homepage = https://wiki.gnome.org/Apps/Bijiben;
-    description = "Note editor designed to remain simple to use";
-    maintainers = gnome3.maintainers;
-    license = licenses.gpl3;
-    platforms = platforms.linux;
-  };
-}
--- a/pkgs/desktops/gnome-3/3.18/apps/bijiben/src.nix
+++ b/pkgs/desktops/gnome-3/3.18/apps/bijiben/src.nix
@ -1,10 +0,0 @@
-# Autogenerated by maintainers/scripts/gnome.sh update
-
-fetchurl: {
-  name = "bijiben-3.18.2";
-
-  src = fetchurl {
-    url = mirror://gnome/sources/bijiben/3.18/bijiben-3.18.2.tar.xz;
-    sha256 = "45fed3242ba092138760b99e725f0a4d3c8d749ef37c607d43c8f010e11a645d";
-  };
-}
--- a/pkgs/desktops/gnome-3/3.18/apps/cheese/default.nix
+++ b/pkgs/desktops/gnome-3/3.18/apps/cheese/default.nix
@ -1,26 +0,0 @@
-{ stdenv, intltool, fetchurl, wrapGAppsHook, gnome-video-effects, libcanberra_gtk3
-, pkgconfig, gtk3, glib, clutter_gtk, clutter-gst, udev, gst_all_1, itstool
-, libgudev
-, adwaita-icon-theme, librsvg, gdk_pixbuf, gnome3, gnome_desktop, libxml2 }:
-
-stdenv.mkDerivation rec {
-  inherit (import ./src.nix fetchurl) name src;
-
-  buildInputs = [ pkgconfig gtk3 glib intltool wrapGAppsHook gnome-video-effects itstool
-                  gdk_pixbuf adwaita-icon-theme librsvg udev gst_all_1.gstreamer libxml2
-                  gst_all_1.gst-plugins-base gst_all_1.gst-plugins-good gnome_desktop
-                  gst_all_1.gst-plugins-bad clutter_gtk clutter-gst
-                  libcanberra_gtk3 libgudev ];
-
-  enableParallelBuilding = true;
-
-  NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
-
-  meta = with stdenv.lib; {
-    homepage = https://wiki.gnome.org/Apps/Cheese;
-    description = "Take photos and videos with your webcam, with fun graphical effects";
-    maintainers = gnome3.maintainers;
-    license = licenses.gpl3;
-    platforms = platforms.linux;
-  };
-}
--- a/pkgs/desktops/gnome-3/3.18/apps/cheese/src.nix
+++ b/pkgs/desktops/gnome-3/3.18/apps/cheese/src.nix
@ -1,10 +0,0 @@
-# Autogenerated by maintainers/scripts/gnome.sh update
-
-fetchurl: {
-  name = "cheese-3.18.1";
-
-  src = fetchurl {
-    url = mirror://gnome/sources/cheese/3.18/cheese-3.18.1.tar.xz;
-    sha256 = "fc9d8798b1f0c6b35731f063869a32c6910bab6d0386b9ea36386ebda0d57177";
-  };
-}
--- a/pkgs/desktops/gnome-3/3.18/apps/evolution/default.nix
+++ b/pkgs/desktops/gnome-3/3.18/apps/evolution/default.nix
@ -1,49 +0,0 @@
-{ stdenv, intltool, fetchurl, libxml2, webkitgtk, highlight
-, pkgconfig, gtk3, glib, libnotify, gtkspell3
-, makeWrapper, itstool, shared_mime_info, libical, db, gcr, sqlite
-, gnome3, librsvg, gdk_pixbuf, libsecret, nss, nspr, icu, libtool
-, libcanberra_gtk3, bogofilter, gst_all_1, procps, p11_kit }:
-
-let
-  majVer = gnome3.version;
-in stdenv.mkDerivation rec {
-  inherit (import ./src.nix fetchurl) name src;
-
-  doCheck = true;
-
-  propagatedUserEnvPkgs = [ gnome3.gnome_themes_standard ];
-
-  propagatedBuildInputs = [ gnome3.gtkhtml ];
-
-  buildInputs = [ pkgconfig gtk3 glib intltool itstool libxml2 libtool
-                  gdk_pixbuf gnome3.defaultIconTheme librsvg db icu
-                  gnome3.evolution_data_server libsecret libical gcr
-                  webkitgtk shared_mime_info gnome3.gnome_desktop gtkspell3
-                  libcanberra_gtk3 bogofilter gnome3.libgdata sqlite
-                  gst_all_1.gstreamer gst_all_1.gst-plugins-base p11_kit
-                  nss nspr libnotify procps highlight gnome3.libgweather
-                  gnome3.gsettings_desktop_schemas makeWrapper ];
-
-  configureFlags = [ "--disable-spamassassin" "--disable-pst-import" "--disable-autoar"
-                     "--disable-libcryptui" ];
-
-  NIX_CFLAGS_COMPILE = "-I${nspr.dev}/include/nspr -I${nss.dev}/include/nss -I${glib.dev}/include/gio-unix-2.0";
-
-  enableParallelBuilding = true;
-
-  preFixup = ''
-    for f in $out/bin/* $out/libexec/*; do
-      wrapProgram "$f" \
-        --set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE" \
-        --prefix XDG_DATA_DIRS : "${gnome3.gnome_themes_standard}/share:$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH"
-    done
-  '';
-
-  meta = with stdenv.lib; {
-    homepage = https://wiki.gnome.org/Apps/Evolution;
-    description = "Personal information management application that provides integrated mail, calendaring and address book functionality";
-    maintainers = gnome3.maintainers;
-    license = licenses.lgpl2Plus;
-    platforms = platforms.linux;
-  };
-}
--- a/pkgs/desktops/gnome-3/3.18/apps/evolution/src.nix
+++ b/pkgs/desktops/gnome-3/3.18/apps/evolution/src.nix
@ -1,10 +0,0 @@
-# Autogenerated by maintainers/scripts/gnome.sh update
-
-fetchurl: {
-  name = "evolution-3.18.4";
-
-  src = fetchurl {
-    url = mirror://gnome/sources/evolution/3.18/evolution-3.18.4.tar.xz;
-    sha256 = "8161a0ebc77e61904dfaca9745595fefbf84d834a07ee1132d1f8d030dabfefb";
-  };
-}
--- a/pkgs/desktops/gnome-3/3.18/apps/file-roller/default.nix
+++ b/pkgs/desktops/gnome-3/3.18/apps/file-roller/default.nix
@ -1,21 +0,0 @@
-{ stdenv, fetchurl, glib, pkgconfig, gnome3, intltool, itstool, libxml2, libarchive
-, attr, bzip2, acl, wrapGAppsHook, librsvg, libnotify, gdk_pixbuf }:
-
-stdenv.mkDerivation rec {
-  inherit (import ./src.nix fetchurl) name src;
-
-  nativeBuildInputs = [ pkgconfig wrapGAppsHook ];
-
-  buildInputs = [ glib gnome3.gtk intltool itstool libxml2 libarchive libnotify
-                  gnome3.defaultIconTheme attr bzip2 acl gdk_pixbuf librsvg
-                  gnome3.dconf ];
-
-  installFlags = [ "nautilus_extensiondir=$(out)/lib/nautilus/extensions-3.0" ];
-
-  meta = with stdenv.lib; {
-    homepage = https://wiki.gnome.org/Apps/FileRoller;
-    description = "Archive manager for the GNOME desktop environment";
-    platforms = platforms.linux;
-    maintainers = gnome3.maintainers;
-  };
-}
--- a/Show More
+++ b/Show More