Merge remote-tracking branch 'upstream/master' into staging

Conflicts: pkgs/build-support/fetchbower/default.nix pkgs/build-support/fetchdarcs/default.nix pkgs/build-support/fetchgx/default.nix pkgs/development/python-modules/botocore/default.nix pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix pkgs/tools/admin/awscli/default.nix
2018-01-14 21:18:27 +02:00 · 2018-01-14 21:18:27 +02:00 · 6ed0fe7e45
commit 6ed0fe7e45
parent c08042ba4b b986078593
410 changed files with 50480 additions and 46866 deletions
--- a/doc/cross-compilation.xml
+++ b/doc/cross-compilation.xml
@ -61,7 +61,7 @@
        <listitem>
          <para>
            The "target platform" attribute is, unlike the other two attributes, not actually fundamental to the process of building software.
-            Instead, it is only relevant for compatability with building certain specific compilers and build tools.
+            Instead, it is only relevant for compatibility with building certain specific compilers and build tools.
            It can be safely ignored for all other packages.
          </para>
          <para>
@ -162,7 +162,7 @@
    <para>
      A runtime dependency between 2 packages implies that between them both the host and target platforms match.
      This is directly implied by the meaning of "host platform" and "runtime dependency":
-      The package dependency exists while both packages are runnign on a single host platform.
+      The package dependency exists while both packages are running on a single host platform.
    </para>
    <para>
      A build time dependency, however, implies a shift in platforms between the depending package and the depended-on package.
--- a/doc/stdenv.xml
+++ b/doc/stdenv.xml
@ -995,13 +995,14 @@ but only if the <varname>doCheck</varname> variable is enabled.</para>

  <varlistentry>
    <term><varname>doCheck</varname></term>
-    <listitem><para>If set to a non-empty string, the check phase is
-    executed, otherwise it is skipped (default).  Thus you should set
-
-    <programlisting>
-doCheck = true;</programlisting>
-
-    in the derivation to enable checks.</para></listitem>
+    <listitem><para>
+      Controls whether the check phase is executed.
+      By default it is skipped, but if <varname>doCheck</varname> is set to true, the check phase is usually executed.
+      Thus you should set <programlisting>doCheck = true;</programlisting> in the derivation to enable checks.
+      The exception is cross compilation.
+      Cross compiled builds never run tests, no matter how <varname>doCheck</varname> is set,
+      as the newly-built program won't run on the platform used to build it.
+    </para></listitem>
  </varlistentry>

  <varlistentry>
@ -1280,12 +1281,14 @@ installcheck</command>.</para>

  <varlistentry>
    <term><varname>doInstallCheck</varname></term>
-    <listitem><para>If set to a non-empty string, the installCheck phase is
-    executed, otherwise it is skipped (default).  Thus you should set
-
-    <programlisting>doInstallCheck = true;</programlisting>
-
-    in the derivation to enable install checks.</para></listitem>
+    <listitem><para>
+      Controls whether the installCheck phase is executed.
+      By default it is skipped, but if <varname>doInstallCheck</varname> is set to true, the installCheck phase is usually executed.
+      Thus you should set <programlisting>doInstallCheck = true;</programlisting> in the derivation to enable install checks.
+      The exception is cross compilation.
+      Cross compiled builds never run tests, no matter how <varname>doInstallCheck</varname> is set,
+      as the newly-built program won't run on the platform used to build it.
+    </para></listitem>
  </varlistentry>

  <varlistentry>
--- a/lib/default.nix
+++ b/lib/default.nix
@ -93,7 +93,7 @@ let
      hiPrioSet;
    inherit (sources) pathType pathIsDirectory cleanSourceFilter
      cleanSource sourceByRegex sourceFilesBySuffices
-      commitIdFromGitRepo;
+      commitIdFromGitRepo cleanSourceWith pathHasContext canCleanSource;
    inherit (modules) evalModules closeModules unifyModuleSyntax
      applyIfFunction unpackSubmodule packSubmodule mergeModules
      mergeModules' mergeOptionDecls evalOptionValue mergeDefinitions
--- a/lib/maintainers.nix
+++ b/lib/maintainers.nix
@ -127,7 +127,7 @@
  ciil = "Simon Lackerbauer <simon@lackerbauer.com>";
  ck3d = "Christian Kögler <ck3d@gmx.de>";
  ckampka = "Christian Kampka <christian@kampka.net>";
-  ckauhaus = "Christian Kauhaus <christian@kauhaus.de>";
+  ckauhaus = "Christian Kauhaus <kc@flyingcircus.io>";
  cko = "Christine Koppelt <christine.koppelt@gmail.com>";
  cleverca22 = "Michael Bishop <cleverca22@gmail.com>";
  cmcdragonkai = "Roger Qiu <roger.qiu@matrix.ai>";
@ -389,6 +389,7 @@
  lufia = "Kyohei Kadota <lufia@lufia.org>";
  luispedro = "Luis Pedro Coelho <luis@luispedro.org>";
  lukego = "Luke Gorrie <luke@snabb.co>";
+  luz = "Luz <luz666@daum.net>";
  lw = "Sergey Sofeychuk <lw@fmap.me>";
  lyt = "Tim Liou <wheatdoge@gmail.com>";
  m3tti = "Mathaeus Sander <mathaeus.peter.sander@gmail.com>";
@ -505,6 +506,7 @@
  pakhfn = "Fedor Pakhomov <pakhfn@gmail.com>";
  panaeon = "Vitalii Voloshyn <vitalii.voloshyn@gmail.com";
  paperdigits = "Mica Semrick <mica@silentumbrella.com>";
+  paraseba = "Sebastian Galkin <paraseba@gmail.com>";
  pashev = "Igor Pashev <pashev.igor@gmail.com>";
  patternspandemic = "Brad Christensen <patternspandemic@live.com>";
  pawelpacana = "Paweł Pacana <pawel.pacana@gmail.com>";
@ -593,6 +595,7 @@
  rzetterberg = "Richard Zetterberg <richard.zetterberg@gmail.com>";
  s1lvester = "Markus Silvester <s1lvester@bockhacker.me>";
  samdroid-apps = "Sam Parkinson <sam@sam.today>";
+  samueldr = "Samuel Dionne-Riel <samuel@dionne-riel.com>";
  samuelrivas = "Samuel Rivas <samuelrivas@gmail.com>";
  sander = "Sander van der Burg <s.vanderburg@tudelft.nl>";
  sargon = "Daniel Ehlers <danielehlers@mindeye.net>";
@ -603,6 +606,7 @@
  scolobb = "Sergiu Ivanov <sivanov@colimite.fr>";
  sdll = "Sasha Illarionov <sasha.delly@gmail.com>";
  SeanZicari = "Sean Zicari <sean.zicari@gmail.com>";
+  sellout = "Greg Pfeil <greg@technomadic.org>";
  sepi = "Raffael Mancini <raffael@mancini.lu>";
  seppeljordan = "Sebastian Jordan <sebastian.jordan.mail@googlemail.com>";
  shanemikel = "Shane Pearlman <shanemikel1@gmail.com>";
@ -638,6 +642,7 @@
  sternenseemann = "Lukas Epple <post@lukasepple.de>";
  stesie = "Stefan Siegl <stesie@brokenpipe.de>";
  steveej = "Stefan Junker <mail@stefanjunker.de>";
+  StillerHarpo = "Florian Engel <florianengel39@gmail.com>";
  stumoss = "Stuart Moss <samoss@gmail.com>";
  SuprDewd = "Bjarki Ágúst Guðmundsson <suprdewd@gmail.com>";
  swarren83 = "Shawn Warren <shawn.w.warren@gmail.com>";
@ -729,6 +734,7 @@
  wyvie = "Elijah Rum <elijahrum@gmail.com>";
  xaverdh = "Dominik Xaver Hörl <hoe.dom@gmx.de>";
  xnwdd = "Guillermo NWDD <nwdd+nixos@no.team>";
+  xurei = "Olivier Bourdoux <olivier.bourdoux@gmail.com>";
  xvapx = "Marti Serra <marti.serra.coscollano@gmail.com>";
  xwvvvvwx = "David Terry <davidterry@posteo.de>";
  xzfc = "Albert Safin <xzfcpw@gmail.com>";
--- a/lib/sources.nix
+++ b/lib/sources.nix
@ -26,14 +26,35 @@ rec {
    (type == "symlink" && lib.hasPrefix "result" baseName)
  );

-  cleanSource = builtins.filterSource cleanSourceFilter;
+  cleanSource = src: cleanSourceWith { filter = cleanSourceFilter; inherit src; };
+
+  # Like `builtins.filterSource`, except it will compose with itself,
+  # allowing you to chain multiple calls together without any
+  # intermediate copies being put in the nix store.
+  #
+  #     lib.cleanSourceWith f (lib.cleanSourceWith g ./.)     # Succeeds!
+  #     builtins.filterSource f (builtins.filterSource g ./.) # Fails!
+  cleanSourceWith = { filter, src }:
+    let
+      isFiltered = src ? _isLibCleanSourceWith;
+      origSrc = if isFiltered then src.origSrc else src;
+      filter' = if isFiltered then name: type: filter name type && src.filter name type else filter;
+    in {
+      inherit origSrc;
+      filter = filter';
+      outPath = builtins.filterSource filter' origSrc;
+      _isLibCleanSourceWith = true;
+    };

  # Filter sources by a list of regular expressions.
  #
  # E.g. `src = sourceByRegex ./my-subproject [".*\.py$" "^database.sql$"]`
-  sourceByRegex = src: regexes: builtins.filterSource (path: type:
-    let relPath = lib.removePrefix (toString src + "/") (toString path);
-    in lib.any (re: builtins.match re relPath != null) regexes) src;
+  sourceByRegex = src: regexes: cleanSourceWith {
+    filter = (path: type:
+      let relPath = lib.removePrefix (toString src + "/") (toString path);
+      in lib.any (re: builtins.match re relPath != null) regexes);
+    inherit src;
+  };

  # Get all files ending with the specified suffices from the given
  # directory or its descendants.  E.g. `sourceFilesBySuffices ./dir
@ -42,7 +63,7 @@ rec {
    let filter = name: type:
      let base = baseNameOf (toString name);
      in type == "directory" || lib.any (ext: lib.hasSuffix ext base) exts;
-    in builtins.filterSource filter path;
+    in cleanSourceWith { inherit filter; src = path; };


  # Get the commit id of a git repo
@ -72,4 +93,8 @@ rec {
                else lib.head matchRef
           else throw ("Not a .git directory: " + path);
    in lib.flip readCommitFromFile "HEAD";
+
+  pathHasContext = builtins.hasContext or (lib.hasPrefix builtins.storeDir);
+
+  canCleanSource = src: src ? _isLibCleanSourceWith || !(pathHasContext (toString src));
 }
--- a/nixos/doc/manual/release-notes/rl-1803.xml
+++ b/nixos/doc/manual/release-notes/rl-1803.xml
@ -139,12 +139,6 @@ following incompatible changes:</para>
      will be accessible at <literal>/run/memcached/memcached.sock</literal>.
    </para>
  </listitem>
-  <listitem>
-    <para>
-      The DNSCrypt proxy module has been removed, the upstream project
-      is no longer maintained.
-    </para>
-  </listitem>
 </itemizedlist>

 </section>
--- a/nixos/lib/make-ext4-fs.nix
+++ b/nixos/lib/make-ext4-fs.nix
@ -10,7 +10,7 @@
 pkgs.stdenv.mkDerivation {
  name = "ext4-fs.img";

-  buildInputs = with pkgs; [e2fsprogs libfaketime perl];
+  nativeBuildInputs = with pkgs; [e2fsprogs libfaketime perl];

  # For obtaining the closure of `storePaths'.
  exportReferencesGraph =
--- a/nixos/lib/make-squashfs.nix
+++ b/nixos/lib/make-squashfs.nix
@ -8,7 +8,7 @@
 stdenv.mkDerivation {
  name = "squashfs.img";

-  buildInputs = [perl squashfsTools];
+  nativeBuildInputs = [perl squashfsTools];

  # For obtaining the closure of `storeContents'.
  exportReferencesGraph =
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -446,6 +446,7 @@
  ./services/networking/dhcpd.nix
  ./services/networking/dnscache.nix
  ./services/networking/dnschain.nix
+  ./services/networking/dnscrypt-proxy.nix
  ./services/networking/dnscrypt-wrapper.nix
  ./services/networking/dnsmasq.nix
  ./services/networking/ejabberd.nix
--- a/nixos/modules/rename.nix
+++ b/nixos/modules/rename.nix
@ -89,9 +89,6 @@ with lib;
    # Tarsnap
    (mkRenamedOptionModule [ "services" "tarsnap" "config" ] [ "services" "tarsnap" "archives" ])

-    # dnscrypt-proxy
-    (mkRemovedOptionModule [ "services" "dnscrypt-proxy" "enable" ] "")
-
    # ibus
    (mkRenamedOptionModule [ "programs" "ibus" "plugins" ] [ "i18n" "inputMethod" "ibus" "engines" ])

--- a/nixos/modules/security/acme.nix
+++ b/nixos/modules/security/acme.nix
@ -139,6 +139,14 @@ in
        '';
      };

+      tosHash = mkOption {
+        type = types.string;
+        default = "cc88d8d9517f490191401e7b54e9ffd12a2b9082ec7a1d4cec6101f9f1647e7b";
+        description = ''
+          SHA256 of the Terms of Services document. This changes once in a while.
+        '';
+      };
+
      production = mkOption {
        type = types.bool;
        default = true;
@ -188,7 +196,7 @@ in
                domain = if data.domain != null then data.domain else cert;
                cpath = "${cfg.directory}/${cert}";
                rights = if data.allowKeysForGroup then "750" else "700";
-                cmdline = [ "-v" "-d" domain "--default_root" data.webroot "--valid_min" cfg.validMin ]
+                cmdline = [ "-v" "-d" domain "--default_root" data.webroot "--valid_min" cfg.validMin "--tos_sha256" cfg.tosHash ]
                          ++ optionals (data.email != null) [ "--email" data.email ]
                          ++ concatMap (p: [ "-f" p ]) data.plugins
                          ++ concatLists (mapAttrsToList (name: root: [ "-d" (if root == null then name else "${name}:${root}")]) data.extraDomains)
--- a/nixos/modules/security/wrappers/default.nix
+++ b/nixos/modules/security/wrappers/default.nix
@ -17,7 +17,7 @@ let
    hardeningEnable = [ "pie" ];
    installPhase = ''
      mkdir -p $out/bin
-      gcc -Wall -O2 -DWRAPPER_DIR=\"${parentWrapperDir}\" \
+      $CC -Wall -O2 -DWRAPPER_DIR=\"${parentWrapperDir}\" \
          -lcap-ng -lcap ${./wrapper.c} -o $out/bin/security-wrapper
    '';
  };
@ -79,7 +79,7 @@ let
                 ({ owner = "root";
                    group = "root";
                  } // s)
-          else if 
+          else if
             (s ? "setuid" && s.setuid) ||
             (s ? "setgid" && s.setgid) ||
             (s ? "permissions")
--- a/nixos/modules/services/networking/dnscrypt-proxy.nix
+++ b/nixos/modules/services/networking/dnscrypt-proxy.nix
@ -0,0 +1,321 @@
+{ config, lib, pkgs, ... }:
+with lib;
+
+let
+  cfg = config.services.dnscrypt-proxy;
+
+  stateDirectory = "/var/lib/dnscrypt-proxy";
+
+  # The minisign public key used to sign the upstream resolver list.
+  # This is somewhat more flexible than preloading the key as an
+  # embedded string.
+  upstreamResolverListPubKey = pkgs.fetchurl {
+    url = https://raw.githubusercontent.com/dyne/dnscrypt-proxy/master/minisign.pub;
+    sha256 = "18lnp8qr6ghfc2sd46nn1rhcpr324fqlvgsp4zaigw396cd7vnnh";
+  };
+
+  # Internal flag indicating whether the upstream resolver list is used.
+  useUpstreamResolverList = cfg.customResolver == null;
+
+  # The final local address.
+  localAddress = "${cfg.localAddress}:${toString cfg.localPort}";
+
+  # The final resolvers list path.
+  resolverList = "${stateDirectory}/dnscrypt-resolvers.csv";
+
+  # Build daemon command line
+
+  resolverArgs =
+    if (cfg.customResolver == null)
+      then
+        [ "-L ${resolverList}"
+          "-R ${cfg.resolverName}"
+        ]
+      else with cfg.customResolver;
+        [ "-N ${name}"
+          "-k ${key}"
+          "-r ${address}:${toString port}"
+        ];
+
+  daemonArgs =
+       [ "-a ${localAddress}" ]
+    ++ resolverArgs
+    ++ cfg.extraArgs;
+in
+
+{
+  meta = {
+    maintainers = with maintainers; [ joachifm ];
+    doc = ./dnscrypt-proxy.xml;
+  };
+
+  options = {
+    # Before adding another option, consider whether it could
+    # equally well be passed via extraArgs.
+
+    services.dnscrypt-proxy = {
+      enable = mkOption {
+        default = false;
+        type = types.bool;
+        description = "Whether to enable the DNSCrypt client proxy";
+      };
+
+      localAddress = mkOption {
+        default = "127.0.0.1";
+        type = types.str;
+        description = ''
+          Listen for DNS queries to relay on this address. The only reason to
+          change this from its default value is to proxy queries on behalf
+          of other machines (typically on the local network).
+        '';
+      };
+
+      localPort = mkOption {
+        default = 53;
+        type = types.int;
+        description = ''
+          Listen for DNS queries to relay on this port. The default value
+          assumes that the DNSCrypt proxy should relay DNS queries directly.
+          When running as a forwarder for another DNS client, set this option
+          to a different value; otherwise leave the default.
+        '';
+      };
+
+      resolverName = mkOption {
+        default = "random";
+        example = "dnscrypt.eu-nl";
+        type = types.nullOr types.str;
+        description = ''
+          The name of the DNSCrypt resolver to use, taken from
+          <filename>${resolverList}</filename>.  The default is to
+          pick a random non-logging resolver that supports DNSSEC.
+        '';
+      };
+
+      customResolver = mkOption {
+        default = null;
+        description = ''
+          Use an unlisted resolver (e.g., a private DNSCrypt provider). For
+          advanced users only. If specified, this option takes precedence.
+        '';
+        type = types.nullOr (types.submodule ({ ... }: { options = {
+          address = mkOption {
+            type = types.str;
+            description = "IP address";
+            example = "208.67.220.220";
+          };
+
+          port = mkOption {
+            type = types.int;
+            description = "Port";
+            default = 443;
+          };
+
+          name = mkOption {
+            type = types.str;
+            description = "Fully qualified domain name";
+            example = "2.dnscrypt-cert.example.com";
+          };
+
+          key = mkOption {
+            type = types.str;
+            description = "Public key";
+            example = "B735:1140:206F:225D:3E2B:D822:D7FD:691E:A1C3:3CC8:D666:8D0C:BE04:BFAB:CA43:FB79";
+          };
+        }; }));
+      };
+
+      extraArgs = mkOption {
+        default = [];
+        type = types.listOf types.str;
+        description = ''
+          Additional command-line arguments passed verbatim to the daemon.
+          See <citerefentry><refentrytitle>dnscrypt-proxy</refentrytitle>
+          <manvolnum>8</manvolnum></citerefentry> for details.
+        '';
+        example = [ "-X libdcplugin_example_cache.so,--min-ttl=60" ];
+      };
+    };
+  };
+
+  config = mkIf cfg.enable (mkMerge [{
+    assertions = [
+      { assertion = (cfg.customResolver != null) || (cfg.resolverName != null);
+        message   = "please configure upstream DNSCrypt resolver";
+      }
+    ];
+
+    users.users.dnscrypt-proxy = {
+      description = "dnscrypt-proxy daemon user";
+      isSystemUser = true;
+      group = "dnscrypt-proxy";
+    };
+    users.groups.dnscrypt-proxy = {};
+
+    systemd.sockets.dnscrypt-proxy = {
+      description = "dnscrypt-proxy listening socket";
+      documentation = [ "man:dnscrypt-proxy(8)" ];
+
+      wantedBy = [ "sockets.target" ];
+
+      socketConfig = {
+        ListenStream = localAddress;
+        ListenDatagram = localAddress;
+      };
+    };
+
+    systemd.services.dnscrypt-proxy = {
+      description = "dnscrypt-proxy daemon";
+      documentation = [ "man:dnscrypt-proxy(8)" ];
+
+      before = [ "nss-lookup.target" ];
+      after = [ "network.target" ];
+      requires = [ "dnscrypt-proxy.socket "];
+
+      serviceConfig = {
+        NonBlocking = "true";
+        ExecStart = "${pkgs.dnscrypt-proxy}/bin/dnscrypt-proxy ${toString daemonArgs}";
+        ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+
+        User = "dnscrypt-proxy";
+
+        PrivateTmp = true;
+        PrivateDevices = true;
+        ProtectHome = true;
+      };
+    };
+    }
+
+    (mkIf config.security.apparmor.enable {
+    systemd.services.dnscrypt-proxy.after = [ "apparmor.service" ];
+
+    security.apparmor.profiles = singleton (pkgs.writeText "apparmor-dnscrypt-proxy" ''
+      ${pkgs.dnscrypt-proxy}/bin/dnscrypt-proxy {
+        /dev/null rw,
+        /dev/urandom r,
+
+        /etc/passwd r,
+        /etc/group r,
+        ${config.environment.etc."nsswitch.conf".source} r,
+
+        ${getLib pkgs.glibc}/lib/*.so mr,
+        ${pkgs.tzdata}/share/zoneinfo/** r,
+
+        network inet stream,
+        network inet6 stream,
+        network inet dgram,
+        network inet6 dgram,
+
+        ${getLib pkgs.dnscrypt-proxy}/lib/dnscrypt-proxy/libdcplugin*.so mr,
+
+        ${getLib pkgs.gcc.cc}/lib/libssp.so.* mr,
+        ${getLib pkgs.libsodium}/lib/libsodium.so.* mr,
+        ${getLib pkgs.systemd}/lib/libsystemd.so.* mr,
+        ${getLib pkgs.xz}/lib/liblzma.so.* mr,
+        ${getLib pkgs.libgcrypt}/lib/libgcrypt.so.* mr,
+        ${getLib pkgs.libgpgerror}/lib/libgpg-error.so.* mr,
+        ${getLib pkgs.libcap}/lib/libcap.so.* mr,
+        ${getLib pkgs.lz4}/lib/liblz4.so.* mr,
+        ${getLib pkgs.attr}/lib/libattr.so.* mr, # */
+
+        ${resolverList} r,
+
+        /run/systemd/notify rw,
+      }
+    '');
+    })
+
+    (mkIf useUpstreamResolverList {
+    systemd.services.init-dnscrypt-proxy-statedir = {
+      description = "Initialize dnscrypt-proxy state directory";
+
+      wantedBy = [ "dnscrypt-proxy.service" ];
+      before = [ "dnscrypt-proxy.service" ];
+
+      script = ''
+        mkdir -pv ${stateDirectory}
+        chown -c dnscrypt-proxy:dnscrypt-proxy ${stateDirectory}
+        cp -uv \
+          ${pkgs.dnscrypt-proxy}/share/dnscrypt-proxy/dnscrypt-resolvers.csv \
+          ${stateDirectory}
+      '';
+
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+      };
+    };
+
+    systemd.services.update-dnscrypt-resolvers = {
+      description = "Update list of DNSCrypt resolvers";
+
+      requires = [ "init-dnscrypt-proxy-statedir.service" ];
+      after = [ "init-dnscrypt-proxy-statedir.service" ];
+
+      path = with pkgs; [ curl diffutils dnscrypt-proxy minisign ];
+      script = ''
+        cd ${stateDirectory}
+        domain=raw.githubusercontent.com
+        get="curl -fSs --resolve $domain:443:$(hostip -r 8.8.8.8 $domain | head -1)"
+        $get -o dnscrypt-resolvers.csv.tmp \
+          https://$domain/dyne/dnscrypt-proxy/master/dnscrypt-resolvers.csv
+        $get -o dnscrypt-resolvers.csv.minisig.tmp \
+          https://$domain/dyne/dnscrypt-proxy/master/dnscrypt-resolvers.csv.minisig
+        mv dnscrypt-resolvers.csv.minisig{.tmp,}
+        if ! minisign -q -V -p ${upstreamResolverListPubKey} \
+          -m dnscrypt-resolvers.csv.tmp -x dnscrypt-resolvers.csv.minisig ; then
+          echo "failed to verify resolver list!" >&2
+          exit 1
+        fi
+        [[ -f dnscrypt-resolvers.csv ]] && mv dnscrypt-resolvers.csv{,.old}
+        mv dnscrypt-resolvers.csv{.tmp,}
+        if cmp dnscrypt-resolvers.csv{,.old} ; then
+          echo "no change"
+        else
+          echo "resolver list updated"
+        fi
+      '';
+
+      serviceConfig = {
+        PrivateTmp = true;
+        PrivateDevices = true;
+        ProtectHome = true;
+        ProtectSystem = "strict";
+        ReadWritePaths = "${dirOf stateDirectory} ${stateDirectory}";
+        SystemCallFilter = "~@mount";
+      };
+    };
+
+    systemd.timers.update-dnscrypt-resolvers = {
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        OnBootSec = "5min";
+        OnUnitActiveSec = "6h";
+      };
+    };
+    })
+    ]);
+
+  imports = [
+    (mkRenamedOptionModule [ "services" "dnscrypt-proxy" "port" ] [ "services" "dnscrypt-proxy" "localPort" ])
+
+    (mkChangedOptionModule
+      [ "services" "dnscrypt-proxy" "tcpOnly" ]
+      [ "services" "dnscrypt-proxy" "extraArgs" ]
+      (config:
+        let val = getAttrFromPath [ "services" "dnscrypt-proxy" "tcpOnly" ] config; in
+        optional val "-T"))
+
+    (mkChangedOptionModule
+      [ "services" "dnscrypt-proxy" "ephemeralKeys" ]
+      [ "services" "dnscrypt-proxy" "extraArgs" ]
+      (config:
+        let val = getAttrFromPath [ "services" "dnscrypt-proxy" "ephemeralKeys" ] config; in
+        optional val "-E"))
+
+    (mkRemovedOptionModule [ "services" "dnscrypt-proxy" "resolverList" ] ''
+      The current resolver listing from upstream is always used
+      unless a custom resolver is specified.
+    '')
+  ];
+}
--- a/nixos/modules/services/networking/dnscrypt-proxy.xml
+++ b/nixos/modules/services/networking/dnscrypt-proxy.xml
@ -0,0 +1,69 @@
+<chapter xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xmlns:xi="http://www.w3.org/2001/XInclude"
+         version="5.0"
+         xml:id="sec-dnscrypt-proxy">
+
+  <title>DNSCrypt client proxy</title>
+
+  <para>
+    The DNSCrypt client proxy relays DNS queries to a DNSCrypt enabled
+    upstream resolver. The traffic between the client and the upstream
+    resolver is encrypted and authenticated, mitigating the risk of MITM
+    attacks, DNS poisoning attacks, and third-party snooping (assuming the
+    upstream is trustworthy).
+  </para>
+
+  <sect1><title>Basic configuration</title>
+
+  <para>
+    To enable the client proxy, set
+    <programlisting>
+      services.dnscrypt-proxy.enable = true;
+    </programlisting>
+  </para>
+
+  <para>
+    Enabling the client proxy does not alter the system nameserver; to
+    relay local queries, prepend <literal>127.0.0.1</literal> to
+    <option>networking.nameservers</option>.
+  </para>
+
+  </sect1>
+
+  <sect1><title>As a forwarder for another DNS client</title>
+
+  <para>
+    To run the DNSCrypt proxy client as a forwarder for another
+    DNS client, change the default proxy listening port to a
+    non-standard value and point the other client to it:
+    <programlisting>
+      services.dnscrypt-proxy.localPort = 43;
+    </programlisting>
+  </para>
+
+  <sect2><title>dnsmasq</title>
+  <para>
+    <programlisting>
+      {
+        services.dnsmasq.enable = true;
+        services.dnsmasq.servers = [ "127.0.0.1#43" ];
+      }
+    </programlisting>
+  </para>
+  </sect2>
+
+  <sect2><title>unbound</title>
+  <para>
+    <programlisting>
+      {
+        services.unbound.enable = true;
+        services.unbound.forwardAddresses = [ "127.0.0.1@43" ];
+      }
+    </programlisting>
+  </para>
+  </sect2>
+
+  </sect1>
+
+</chapter>
--- a/nixos/modules/services/networking/dnscrypt-wrapper.nix
+++ b/nixos/modules/services/networking/dnscrypt-wrapper.nix
@ -145,6 +145,16 @@ in {
    };
    users.groups.dnscrypt-wrapper = { };

+    security.polkit.extraConfig = ''
+      // Allow dnscrypt-wrapper user to restart dnscrypt-wrapper.service
+      polkit.addRule(function(action, subject) {
+          if (action.id == "org.freedesktop.systemd1.manage-units" &&
+              action.lookup("unit") == "dnscrypt-wrapper.service" &&
+              subject.user == "dnscrypt-wrapper") {
+              return polkit.Result.YES;
+          }
+        });
+    '';

    systemd.services.dnscrypt-wrapper = {
      description = "dnscrypt-wrapper daemon";
--- a/nixos/modules/services/networking/kresd.nix
+++ b/nixos/modules/services/networking/kresd.nix
@ -72,6 +72,7 @@ in
        (iface: if elem ":" (stringToCharacters iface) then "[${iface}]:53" else "${iface}:53")
        cfg.interfaces;
      socketConfig.ListenDatagram = listenStreams;
+      socketConfig.FreeBind = true;
    };

    systemd.sockets.kresd-control = rec {
@ -82,20 +83,11 @@ in
      socketConfig = {
        FileDescriptorName = "control";
        Service = "kresd.service";
-        SocketMode = "0660"; # only root user/group may connect
+        SocketMode = "0660"; # only root user/group may connect and control kresd
      };
    };

-    # Create the cacheDir; tmpfiles don't work on nixos-rebuild switch.
-    systemd.services.kresd-cachedir = {
-      serviceConfig.Type = "oneshot";
-      script = ''
-        if [ ! -d '${cfg.cacheDir}' ]; then
-          mkdir -p '${cfg.cacheDir}'
-          chown kresd:kresd '${cfg.cacheDir}'
-        fi
-      '';
-    };
+    systemd.tmpfiles.rules = [ "d '${cfg.cacheDir}' 0770 kresd kresd - -" ];

    systemd.services.kresd = {
      description = "Knot-resolver daemon";
@ -104,16 +96,15 @@ in
        User = "kresd";
        Type = "notify";
        WorkingDirectory = cfg.cacheDir;
+        Restart = "on-failure";
      };

      script = ''
        exec '${package}/bin/kresd' --config '${configFile}' \
-          -k '${cfg.cacheDir}/root.key'
+          -k '${pkgs.dns-root-data}/root.key'
      '';

-      after = [ "kresd-cachedir.service" ];
-      requires = [ "kresd.socket" "kresd-cachedir.service" ];
-      wantedBy = [ "sockets.target" ];
+      requires = [ "kresd.socket" ];
    };
  };
 }
--- a/nixos/modules/services/networking/mosquitto.nix
+++ b/nixos/modules/services/networking/mosquitto.nix
@ -12,6 +12,10 @@ let
    keyfile ${cfg.ssl.keyfile}
  '';

+  passwordConf = optionalString cfg.checkPasswords ''
+    password_file ${cfg.dataDir}/passwd
+  '';
+
  mosquittoConf = pkgs.writeText "mosquitto.conf" ''
    pid_file /run/mosquitto/pid
    acl_file ${aclFile}
@ -19,6 +23,7 @@ let
    allow_anonymous ${boolToString cfg.allowAnonymous}
    bind_address ${cfg.host}
    port ${toString cfg.port}
+    ${passwordConf}
    ${listenerConf}
    ${cfg.extraConf}
  '';
@ -153,6 +158,15 @@ in
        '';
      };

+      checkPasswords = mkOption {
+        default = false;
+        example = true;
+        type = types.bool;
+        description = ''
+          Refuse connection when clients provide incorrect passwords.
+        '';
+      };
+
      extraConf = mkOption {
        default = "";
        type = types.lines;
--- a/nixos/modules/services/search/elasticsearch.nix
+++ b/nixos/modules/services/search/elasticsearch.nix
@ -6,6 +6,7 @@ let
  cfg = config.services.elasticsearch;

  es5 = builtins.compareVersions (builtins.parseDrvName cfg.package.name).version "5" >= 0;
+  es6 = builtins.compareVersions (builtins.parseDrvName cfg.package.name).version "6" >= 0;

  esConfig = ''
    network.host: ${cfg.listenAddress}
@ -92,8 +93,6 @@ in {
        node.name: "elasticsearch"
        node.master: true
        node.data: false
-        index.number_of_shards: 5
-        index.number_of_replicas: 1
      '';
    };

@ -165,7 +164,10 @@ in {
      path = [ pkgs.inetutils ];
      environment = {
        ES_HOME = cfg.dataDir;
-        ES_JAVA_OPTS = toString ([ "-Des.path.conf=${configDir}" ] ++ cfg.extraJavaOptions);
+        ES_JAVA_OPTS = toString ( optional (!es6) [ "-Des.path.conf=${configDir}" ]
+                                  ++ cfg.extraJavaOptions);
+      } // optionalAttrs es6 {
+        ES_PATH_CONF = configDir;
      };
      serviceConfig = {
        ExecStart = "${cfg.package}/bin/elasticsearch ${toString cfg.extraCmdLineOptions}";
--- a/nixos/modules/services/web-servers/tomcat.nix
+++ b/nixos/modules/services/web-servers/tomcat.nix
@ -29,7 +29,7 @@ in
        type = types.package;
        default = pkgs.tomcat85;
        defaultText = "pkgs.tomcat85";
-        example = lib.literalExample "pkgs.tomcatUnstable";
+        example = lib.literalExample "pkgs.tomcat9";
        description = ''
          Which tomcat package to use.
        '';
--- a/nixos/modules/services/x11/desktop-managers/mate.nix
+++ b/nixos/modules/services/x11/desktop-managers/mate.nix
@ -12,6 +12,17 @@ let
    in
      filter (x: !(builtins.elem (pkgName x) ysNames)) xs;

+  addToXDGDirs = p: ''
+    if [ -d "${p}/share/gsettings-schemas/${p.name}" ]; then
+      export XDG_DATA_DIRS=$XDG_DATA_DIRS''${XDG_DATA_DIRS:+:}${p}/share/gsettings-schemas/${p.name}
+    fi
+
+    if [ -d "${p}/lib/girepository-1.0" ]; then
+      export GI_TYPELIB_PATH=$GI_TYPELIB_PATH''${GI_TYPELIB_PATH:+:}${p}/lib/girepository-1.0
+      export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}${p}/lib
+    fi
+  '';
+
  xcfg = config.services.xserver;
  cfg = xcfg.desktopManager.mate;

@ -20,10 +31,14 @@ in
 {
  options = {

-    services.xserver.desktopManager.mate.enable = mkOption {
-      type = types.bool;
-      default = false;
-      description = "Enable the MATE desktop environment";
+    services.xserver.desktopManager.mate = {
+      enable = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Enable the MATE desktop environment";
+      };
+
+      debug = mkEnableOption "mate-session debug messages";
    };

    environment.mate.excludePackages = mkOption {
@ -52,10 +67,29 @@ in
        # Find the mouse
        export XCURSOR_PATH=~/.icons:${config.system.path}/share/icons

+        # Let caja find extensions
+        export CAJA_EXTENSION_DIRS=$CAJA_EXTENSION_DIRS''${CAJA_EXTENSION_DIRS:+:}${config.system.path}/lib/caja/extensions-2.0
+
+        # Let caja extensions find gsettings schemas
+        ${concatMapStrings (p: ''
+          if [ -d "${p}/lib/caja/extensions-2.0" ]; then
+            ${addToXDGDirs p}
+          fi
+          '')
+          config.environment.systemPackages
+        }
+
+        # Let mate-panel find applets
+        export MATE_PANEL_APPLETS_DIR=$MATE_PANEL_APPLETS_DIR''${MATE_PANEL_APPLETS_DIR:+:}${config.system.path}/share/mate-panel/applets
+        export MATE_PANEL_EXTRA_MODULES=$MATE_PANEL_EXTRA_MODULES''${MATE_PANEL_EXTRA_MODULES:+:}${config.system.path}/lib/mate-panel/applets
+
+        # Add mate-control-center paths to some XDG variables because its schemas are needed by mate-settings-daemon, and mate-settings-daemon is a dependency for mate-control-center (that is, they are mutually recursive)
+        ${addToXDGDirs pkgs.mate.mate-control-center}
+
        # Update user dirs as described in http://freedesktop.org/wiki/Software/xdg-user-dirs/
        ${pkgs.xdg-user-dirs}/bin/xdg-user-dirs-update

-        ${pkgs.mate.mate-session-manager}/bin/mate-session &
+        ${pkgs.mate.mate-session-manager}/bin/mate-session ${optionalString cfg.debug "--debug"} &
        waitPID=$!
      '';
    };
--- a/nixos/modules/services/x11/xserver.nix
+++ b/nixos/modules/services/x11/xserver.nix
@ -548,7 +548,7 @@ in
          knownVideoDrivers;
      in optional (driver != null) ({ inherit name; modules = []; driverName = name; } // driver));

-    nixpkgs.config.xorg = optionalAttrs (elem "vboxvideo" cfg.videoDrivers) { abiCompat = "1.18"; };
+    nixpkgs.config = optionalAttrs (elem "vboxvideo" cfg.videoDrivers) { xorg.abiCompat = "1.18"; };

    assertions = [
      { assertion = config.security.polkit.enable;
--- a/nixos/modules/virtualisation/ec2-amis.nix
+++ b/nixos/modules/virtualisation/ec2-amis.nix
@ -223,22 +223,22 @@ let self = {
  "17.03".us-west-2.hvm-ebs = "ami-a93daac9";
  "17.03".us-west-2.hvm-s3 = "ami-5139ae31";

-  # 17.09.2356.cb751f9b1c3
-  "17.09".eu-west-1.hvm-ebs = "ami-d40185ad";
-  "17.09".eu-west-2.hvm-ebs = "ami-c5445da1";
-  "17.09".eu-west-3.hvm-ebs = "ami-2636815b";
-  "17.09".eu-central-1.hvm-ebs = "ami-e758d388";
-  "17.09".us-east-1.hvm-ebs = "ami-865327fc";
-  "17.09".us-east-2.hvm-ebs = "ami-074d6562";
-  "17.09".us-west-1.hvm-ebs = "ami-992c28f9";
-  "17.09".us-west-2.hvm-ebs = "ami-2bd87953";
-  "17.09".ca-central-1.hvm-ebs = "ami-c4bb01a0";
-  "17.09".ap-southeast-1.hvm-ebs = "ami-5ff79723";
-  "17.09".ap-southeast-2.hvm-ebs = "ami-57e71135";
-  "17.09".ap-northeast-1.hvm-ebs = "ami-5249c434";
-  "17.09".ap-northeast-2.hvm-ebs = "ami-f1288e9f";
-  "17.09".sa-east-1.hvm-ebs = "ami-5492d438";
-  "17.09".ap-south-1.hvm-ebs = "ami-c4fab2ab";
+  # 17.09.2681.59661f21be6
+  "17.09".eu-west-1.hvm-ebs = "ami-a30192da";
+  "17.09".eu-west-2.hvm-ebs = "ami-295a414d";
+  "17.09".eu-west-3.hvm-ebs = "ami-8c0eb9f1";
+  "17.09".eu-central-1.hvm-ebs = "ami-266cfe49";
+  "17.09".us-east-1.hvm-ebs = "ami-40bee63a";
+  "17.09".us-east-2.hvm-ebs = "ami-9d84aff8";
+  "17.09".us-west-1.hvm-ebs = "ami-d14142b1";
+  "17.09".us-west-2.hvm-ebs = "ami-3eb40346";
+  "17.09".ca-central-1.hvm-ebs = "ami-ca8207ae";
+  "17.09".ap-southeast-1.hvm-ebs = "ami-84bccff8";
+  "17.09".ap-southeast-2.hvm-ebs = "ami-0dc5386f";
+  "17.09".ap-northeast-1.hvm-ebs = "ami-89b921ef";
+  "17.09".ap-northeast-2.hvm-ebs = "ami-179b3b79";
+  "17.09".sa-east-1.hvm-ebs = "ami-4762202b";
+  "17.09".ap-south-1.hvm-ebs = "ami-4e376021";

  latest = self."17.09";
 }; in self
--- a/nixos/release.nix
+++ b/nixos/release.nix
@ -255,11 +255,12 @@ in rec {
  tests.docker = hydraJob (import tests/docker.nix { system = "x86_64-linux"; });
  tests.docker-edge = hydraJob (import tests/docker-edge.nix { system = "x86_64-linux"; });
  tests.dovecot = callTest tests/dovecot.nix {};
+  tests.dnscrypt-proxy = callTest tests/dnscrypt-proxy.nix { system = "x86_64-linux"; };
  tests.ecryptfs = callTest tests/ecryptfs.nix {};
  tests.etcd = hydraJob (import tests/etcd.nix { system = "x86_64-linux"; });
  tests.ec2-nixops = hydraJob (import tests/ec2.nix { system = "x86_64-linux"; }).boot-ec2-nixops;
  tests.ec2-config = hydraJob (import tests/ec2.nix { system = "x86_64-linux"; }).boot-ec2-config;
-  tests.elk = hydraJob (import tests/elk.nix { system = "x86_64-linux"; });
+  tests.elk = callSubTests tests/elk.nix { system = "x86_64-linux"; };
  tests.env = callTest tests/env.nix {};
  tests.ferm = callTest tests/ferm.nix {};
  tests.firefox = callTest tests/firefox.nix {};
--- a/nixos/tests/dnscrypt-proxy.nix
+++ b/nixos/tests/dnscrypt-proxy.nix
@ -0,0 +1,32 @@
+import ./make-test.nix ({ pkgs, ... }: {
+  name = "dnscrypt-proxy";
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ joachifm ];
+  };
+
+  nodes = {
+    # A client running the recommended setup: DNSCrypt proxy as a forwarder
+    # for a caching DNS client.
+    client =
+    { config, pkgs, ... }:
+    let localProxyPort = 43; in
+    {
+      security.apparmor.enable = true;
+
+      services.dnscrypt-proxy.enable = true;
+      services.dnscrypt-proxy.localPort = localProxyPort;
+      services.dnscrypt-proxy.extraArgs = [ "-X libdcplugin_example.so" ];
+
+      services.dnsmasq.enable = true;
+      services.dnsmasq.servers = [ "127.0.0.1#${toString localProxyPort}" ];
+    };
+  };
+
+  testScript = ''
+    $client->waitForUnit("dnsmasq");
+
+    # The daemon is socket activated; sending a single ping should activate it.
+    $client->execute("${pkgs.iputils}/bin/ping -c1 example.com");
+    $client->succeed("systemctl is-active dnscrypt-proxy");
+  '';
+})
--- a/nixos/tests/elk.nix
+++ b/nixos/tests/elk.nix
@ -1,95 +1,107 @@
-# Test the ELK stack: Elasticsearch, Logstash and Kibana.
-
-import ./make-test.nix ({ pkgs, ...} :
+{ system ? builtins.currentSystem }:
+with import ../lib/testing.nix { inherit system; };
+with pkgs.lib;
 let
  esUrl = "http://localhost:9200";
-in {
-  name = "ELK";
-  meta = with pkgs.stdenv.lib.maintainers; {
-    maintainers = [ eelco chaoflow offline basvandijk ];
-  };

-  nodes = {
-    one =
-      { config, pkgs, ... }: {
-          # Not giving the machine at least 2060MB results in elasticsearch failing with the following error:
-          #
-          #   OpenJDK 64-Bit Server VM warning:
-          #     INFO: os::commit_memory(0x0000000085330000, 2060255232, 0)
-          #     failed; error='Cannot allocate memory' (errno=12)
-          #
-          #   There is insufficient memory for the Java Runtime Environment to continue.
-          #   Native memory allocation (mmap) failed to map 2060255232 bytes for committing reserved memory.
-          #
-          # When setting this to 2500 I got "Kernel panic - not syncing: Out of
-          # memory: compulsory panic_on_oom is enabled" so lets give it even a
-          # bit more room:
-          virtualisation.memorySize = 3000;
+  mkElkTest = name : elk : makeTest {
+    inherit name;
+    meta = with pkgs.stdenv.lib.maintainers; {
+      maintainers = [ eelco chaoflow offline basvandijk ];
+    };
+    nodes = {
+      one =
+        { config, pkgs, ... }: {
+            # Not giving the machine at least 2060MB results in elasticsearch failing with the following error:
+            #
+            #   OpenJDK 64-Bit Server VM warning:
+            #     INFO: os::commit_memory(0x0000000085330000, 2060255232, 0)
+            #     failed; error='Cannot allocate memory' (errno=12)
+            #
+            #   There is insufficient memory for the Java Runtime Environment to continue.
+            #   Native memory allocation (mmap) failed to map 2060255232 bytes for committing reserved memory.
+            #
+            # When setting this to 2500 I got "Kernel panic - not syncing: Out of
+            # memory: compulsory panic_on_oom is enabled" so lets give it even a
+            # bit more room:
+            virtualisation.memorySize = 3000;

-          # For querying JSON objects returned from elasticsearch and kibana.
-          environment.systemPackages = [ pkgs.jq ];
+            # For querying JSON objects returned from elasticsearch and kibana.
+            environment.systemPackages = [ pkgs.jq ];

-          services = {
-            logstash = {
-              enable = true;
-              package = pkgs.logstash5;
-              inputConfig = ''
-                exec { command => "echo -n flowers" interval => 1 type => "test" }
-                exec { command => "echo -n dragons" interval => 1 type => "test" }
-              '';
-              filterConfig = ''
-                if [message] =~ /dragons/ {
-                  drop {}
-                }
-              '';
-              outputConfig = ''
-                file {
-                  path => "/tmp/logstash.out"
-                  codec => line { format => "%{message}" }
-                }
-                elasticsearch {
-                  hosts => [ "${esUrl}" ]
-                }
-              '';
-            };
+            services = {
+              logstash = {
+                enable = true;
+                package = elk.logstash;
+                inputConfig = ''
+                  exec { command => "echo -n flowers" interval => 1 type => "test" }
+                  exec { command => "echo -n dragons" interval => 1 type => "test" }
+                '';
+                filterConfig = ''
+                  if [message] =~ /dragons/ {
+                    drop {}
+                  }
+                '';
+                outputConfig = ''
+                  file {
+                    path => "/tmp/logstash.out"
+                    codec => line { format => "%{message}" }
+                  }
+                  elasticsearch {
+                    hosts => [ "${esUrl}" ]
+                  }
+                '';
+              };

-            elasticsearch = {
-              enable = true;
-              package = pkgs.elasticsearch5;
-            };
+              elasticsearch = {
+                enable = true;
+                package = elk.elasticsearch;
+              };

-            kibana = {
-              enable = true;
-              package = pkgs.kibana5;
-              elasticsearch.url = esUrl;
+              kibana = {
+                enable = true;
+                package = elk.kibana;
+                elasticsearch.url = esUrl;
+              };
            };
          };
-        };
-    };
+      };

-  testScript = ''
-    startAll;
+    testScript = ''
+      startAll;

-    $one->waitForUnit("elasticsearch.service");
+      $one->waitForUnit("elasticsearch.service");

-    # Continue as long as the status is not "red". The status is probably
-    # "yellow" instead of "green" because we are using a single elasticsearch
-    # node which elasticsearch considers risky.
-    #
-    # TODO: extend this test with multiple elasticsearch nodes and see if the status turns "green".
-    $one->waitUntilSucceeds("curl --silent --show-error '${esUrl}/_cluster/health' | jq .status | grep -v red");
+      # Continue as long as the status is not "red". The status is probably
+      # "yellow" instead of "green" because we are using a single elasticsearch
+      # node which elasticsearch considers risky.
+      #
+      # TODO: extend this test with multiple elasticsearch nodes and see if the status turns "green".
+      $one->waitUntilSucceeds("curl --silent --show-error '${esUrl}/_cluster/health' | jq .status | grep -v red");

-    # Perform some simple logstash tests.
-    $one->waitForUnit("logstash.service");
-    $one->waitUntilSucceeds("cat /tmp/logstash.out | grep flowers");
-    $one->waitUntilSucceeds("cat /tmp/logstash.out | grep -v dragons");
+      # Perform some simple logstash tests.
+      $one->waitForUnit("logstash.service");
+      $one->waitUntilSucceeds("cat /tmp/logstash.out | grep flowers");
+      $one->waitUntilSucceeds("cat /tmp/logstash.out | grep -v dragons");

-    # See if kibana is healthy.
-    $one->waitForUnit("kibana.service");
-    $one->waitUntilSucceeds("curl --silent --show-error 'http://localhost:5601/api/status' | jq .status.overall.state | grep green");
+      # See if kibana is healthy.
+      $one->waitForUnit("kibana.service");
+      $one->waitUntilSucceeds("curl --silent --show-error 'http://localhost:5601/api/status' | jq .status.overall.state | grep green");

-    # See if logstash messages arive in elasticsearch.
-    $one->waitUntilSucceeds("curl --silent --show-error '${esUrl}/_search' -H 'Content-Type: application/json' -d '{\"query\" : { \"match\" : { \"message\" : \"flowers\"}}}' | jq .hits.total | grep -v 0");
-    $one->waitUntilSucceeds("curl --silent --show-error '${esUrl}/_search' -H 'Content-Type: application/json' -d '{\"query\" : { \"match\" : { \"message\" : \"dragons\"}}}' | jq .hits.total | grep 0");
-  '';
-})
+      # See if logstash messages arive in elasticsearch.
+      $one->waitUntilSucceeds("curl --silent --show-error '${esUrl}/_search' -H 'Content-Type: application/json' -d '{\"query\" : { \"match\" : { \"message\" : \"flowers\"}}}' | jq .hits.total | grep -v 0");
+      $one->waitUntilSucceeds("curl --silent --show-error '${esUrl}/_search' -H 'Content-Type: application/json' -d '{\"query\" : { \"match\" : { \"message\" : \"dragons\"}}}' | jq .hits.total | grep 0");
+    '';
+  };
+in mapAttrs mkElkTest {
+  "ELK-5" = {
+    elasticsearch = pkgs.elasticsearch5;
+    logstash      = pkgs.logstash5;
+    kibana        = pkgs.kibana5;
+  };
+  "ELK-6" = {
+    elasticsearch = pkgs.elasticsearch6;
+    logstash      = pkgs.logstash6;
+    kibana        = pkgs.kibana6;
+  };
+}
--- a/nixos/tests/keymap.nix
+++ b/nixos/tests/keymap.nix
@ -46,6 +46,7 @@ let
  in makeTest {
    name = "keymap-${layout}";

+    machine.services.xserver.desktopManager.xterm.enable = false;
    machine.i18n.consoleKeyMap = mkOverride 900 layout;
    machine.services.xserver.layout = mkOverride 900 layout;
    machine.imports = [ ./common/x11.nix extraConfig ];
--- a/pkgs/applications/altcoins/default.nix
+++ b/pkgs/applications/altcoins/default.nix
@ -1,11 +1,11 @@
-{ callPackage, boost155, boost162, openssl_1_1_0, haskellPackages, darwin, libsForQt5, miniupnpc_2, python3 }:
+{ callPackage, boost155, boost164, openssl_1_1_0, haskellPackages, darwin, libsForQt5, miniupnpc_2, python3 }:

 rec {

  aeon = callPackage ./aeon { };

-  bitcoin  = libsForQt5.callPackage ./bitcoin.nix { miniupnpc = miniupnpc_2; withGui = true; };
-  bitcoind = callPackage ./bitcoin.nix { miniupnpc = miniupnpc_2; withGui = false; };
+  bitcoin  = libsForQt5.callPackage ./bitcoin.nix { boost = boost164; miniupnpc = miniupnpc_2; withGui = true; };
+  bitcoind = callPackage ./bitcoin.nix { boost = boost164; miniupnpc = miniupnpc_2; withGui = false; };

  bitcoin-abc  = libsForQt5.callPackage ./bitcoin-abc.nix { withGui = true; };
  bitcoind-abc = callPackage ./bitcoin-abc.nix { withGui = false; };
--- a/pkgs/applications/audio/mixxx/default.nix
+++ b/pkgs/applications/audio/mixxx/default.nix
@ -1,6 +1,6 @@
-{ stdenv, fetchurl, chromaprint, fetchpatch, fftw, flac, libid3tag, libmad
-, libopus, libshout, libsndfile, libusb1, libvorbis, pkgconfig
-, portaudio, portmidi, protobuf, qt4, rubberband, scons, sqlite
+{ stdenv, fetchurl, chromaprint, fetchpatch, fftw, flac, faad2, mp4v2
+, libid3tag, libmad, libopus, libshout, libsndfile, libusb1, libvorbis
+, pkgconfig, portaudio, portmidi, protobuf, qt4, rubberband, scons, sqlite
 , taglib, vampSDK
 }:

@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
 ];

  buildInputs = [
-    chromaprint fftw flac libid3tag libmad libopus libshout libsndfile
+    chromaprint fftw flac faad2 mp4v2 libid3tag libmad libopus libshout libsndfile
    libusb1 libvorbis pkgconfig portaudio portmidi protobuf qt4
    rubberband scons sqlite taglib vampSDK
  ];
@ -34,6 +34,7 @@ stdenv.mkDerivation rec {
  sconsFlags = [
    "build=release"
    "qtdir=${qt4}"
+    "faad=1"
  ];

  buildPhase = ''
--- a/pkgs/applications/audio/mopidy-iris/default.nix
+++ b/pkgs/applications/audio/mopidy-iris/default.nix
@ -2,12 +2,12 @@

 pythonPackages.buildPythonApplication rec {
  name = "mopidy-iris-${version}";
-  version = "3.8.2";
+  version = "3.11.0";

  src = pythonPackages.fetchPypi {
    inherit version;
    pname = "Mopidy-Iris";
-    sha256 = "051bzs8p2zz960mi9cmv51q1fmmm15nnb9apph9icicr0p8g7lif";
+    sha256 = "1a9pn35vv1b9v0s30ajjg7gjjvcfjwgfyp7z61m567nv6cr37vhq";
  };

  propagatedBuildInputs = [
--- a/pkgs/applications/audio/mopidy-local-images/default.nix
+++ b/pkgs/applications/audio/mopidy-local-images/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, pythonPackages, mopidy }:
+{ stdenv, fetchFromGitHub, pythonPackages, mopidy, gobjectIntrospection }:

 pythonPackages.buildPythonApplication rec {
  name = "mopidy-local-images-${version}";
@ -12,6 +12,12 @@ pythonPackages.buildPythonApplication rec {
    sha256 = "0gdqxws0jish50mmi57mlqcs659wrllzv00czl18niz94vzvyc0d";
  };

+  buildInputs = [ gobjectIntrospection ];
+
+  checkInputs = [
+    pythonPackages.mock
+  ];
+
  propagatedBuildInputs = [
    mopidy
    pythonPackages.pykka
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@ -27,9 +27,9 @@ in rec {

  preview = mkStudio {
    pname = "android-studio-preview";
-    version = "3.1.0.6"; # "Android Studio 3.1 Canary 7"
-    build = "173.4524538";
-    sha256Hash = "0rj7swychriznylrr09g0rnj12rymms925xbry85ba72hj1jjf6w";
+    version = "3.1.0.7"; # "Android Studio 3.1 Canary 8"
+    build = "173.4529993";
+    sha256Hash = "0mfkzdxbrdqlfqqx83dr9ibkpjwjf54kka9qra9j31zqcmy8rd53";

    meta = stable.meta // {
      description = "The Official IDE for Android (preview version)";
--- a/pkgs/applications/editors/atom/beta.nix
+++ b/pkgs/applications/editors/atom/beta.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name = "atom-beta-${version}";
-  version = "1.24.0-beta1";
+  version = "1.24.0-beta2";

  src = fetchurl {
    url = "https://github.com/atom/atom/releases/download/v${version}/atom-amd64.deb";
-    sha256 = "04cyxmk2h8qg9rzs8rm28xsahkkq9d8j14afmp5yx4p26qycdbg5";
+    sha256 = "1s5zfccpiyg3nqq3a93dg5sr6pk8gvwf8assq9g78l7qkryqr4ac";
    name = "${name}.deb";
  };

--- a/pkgs/applications/editors/atom/default.nix
+++ b/pkgs/applications/editors/atom/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name = "atom-${version}";
-  version = "1.23.1";
+  version = "1.23.2";

  src = fetchurl {
    url = "https://github.com/atom/atom/releases/download/v${version}/atom-amd64.deb";
-    sha256 = "14cwg48cxrhkcj8ahfznqr1ym316437xds7aw5011dqbmswb0v4f";
+    sha256 = "04shnmy80ixjrc8d57i5w23xfxw1dmxj7kbygsal9l8kxgd76k7h";
    name = "${name}.deb";
  };

--- a/pkgs/applications/editors/ed/default.nix
+++ b/pkgs/applications/editors/ed/default.nix
@ -2,7 +2,7 @@
 , buildPlatform, hostPlatform
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (rec {
  name = "ed-${version}";
  version = "1.14.2";

@ -13,7 +13,7 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ lzip ];

-  doCheck = hostPlatform == buildPlatform;
+  doCheck = true; # not cross;

  meta = {
    description = "An implementation of the standard Unix editor";
@ -36,4 +36,9 @@ stdenv.mkDerivation rec {
    maintainers = [ ];
    platforms = stdenv.lib.platforms.unix;
  };
-}
+} // stdenv.lib.optionalAttrs (hostPlatform != buildPlatform) {
+  # This may be moved above during a stdenv rebuild.
+  preConfigure = ''
+    configureFlagsArray+=("CC=$CC")
+  '';
+})
--- a/pkgs/applications/editors/emacs-modes/elpa-generated.nix
+++ b/pkgs/applications/editors/emacs-modes/elpa-generated.nix
@ -768,10 +768,10 @@
    el-search = callPackage ({ elpaBuild, emacs, fetchurl, lib, stream }:
    elpaBuild {
        pname = "el-search";
-        version = "1.4.0.12";
+        version = "1.4.0.14";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/el-search-1.4.0.12.tar";
-          sha256 = "140p1ian8dwip6305spg4rvm3rqxhznlq0w5msixw6ykwm735a8z";
+          url = "https://elpa.gnu.org/packages/el-search-1.4.0.14.tar";
+          sha256 = "1qc30dia59i2bklhivfhmsghirnpgz5mvcjdc78n0r8nizb68jfp";
        };
        packageRequires = [ emacs stream ];
        meta = {
@ -1595,19 +1595,6 @@
          license = lib.licenses.free;
        };
      }) {};
-    org = callPackage ({ elpaBuild, fetchurl, lib }: elpaBuild {
-        pname = "org";
-        version = "20171225";
-        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/org-20171225.tar";
-          sha256 = "0jq410l1d4gz8qz01kmpgf9n77hghnknbcmhhznnq4dxiypgigc2";
-        };
-        packageRequires = [];
-        meta = {
-          homepage = "https://elpa.gnu.org/packages/org.html";
-          license = lib.licenses.free;
-        };
-      }) {};
    osc = callPackage ({ elpaBuild, fetchurl, lib }: elpaBuild {
        pname = "osc";
        version = "0.1";
--- a/pkgs/applications/editors/emacs-modes/melpa-generated.nix
+++ b/pkgs/applications/editors/emacs-modes/melpa-generated.nix
--- a/pkgs/applications/editors/emacs-modes/melpa-stable-generated.nix
+++ b/pkgs/applications/editors/emacs-modes/melpa-stable-generated.nix
@ -6077,6 +6077,27 @@
          license = lib.licenses.free;
        };
      }) {};
+    counsel-projectile = callPackage ({ counsel, fetchFromGitHub, fetchurl, lib, melpaBuild, projectile }:
+    melpaBuild {
+        pname = "counsel-projectile";
+        version = "0.2.0";
+        src = fetchFromGitHub {
+          owner = "ericdanan";
+          repo = "counsel-projectile";
+          rev = "536872f022f449548bdb97faa1776d1d44499d73";
+          sha256 = "0pm5sqhr24n2ffycazxgl3d3dl7gai8svwz01vc0pgx9c0x75kl8";
+        };
+        recipeFile = fetchurl {
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/389f16f886a385b02f466540f042a16eea8ba792/recipes/counsel-projectile";
+          sha256 = "1gshphxaa902kq878rnizn3k1zycakwqkciz92z3xxb3bdyy0hnl";
+          name = "counsel-projectile";
+        };
+        packageRequires = [ counsel projectile ];
+        meta = {
+          homepage = "https://melpa.org/#/counsel-projectile";
+          license = lib.licenses.free;
+        };
+      }) {};
    counsel-tramp = callPackage ({ counsel, emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "counsel-tramp";
@ -6287,6 +6308,27 @@
          license = lib.licenses.free;
        };
      }) {};
+    crystal-mode = callPackage ({ emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
+    melpaBuild {
+        pname = "crystal-mode";
+        version = "0.1.0";
+        src = fetchFromGitHub {
+          owner = "crystal-lang-tools";
+          repo = "emacs-crystal-mode";
+          rev = "0fe6815201bebe4c5ff6857bd541d95b05132b10";
+          sha256 = "0r75dvc0jqcqi1qjns8zj132dnm0s6mvqlqynkis16nigbawix8m";
+        };
+        recipeFile = fetchurl {
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/d4b9b47d7deecf0cf24a42b26d50021cb1219a69/recipes/crystal-mode";
+          sha256 = "1fgpz7zab6nc6kvjzjsbvrbg8shf4by0f20cvjvyky8kym72q0hk";
+          name = "crystal-mode";
+        };
+        packageRequires = [ emacs ];
+        meta = {
+          homepage = "https://melpa.org/#/crystal-mode";
+          license = lib.licenses.free;
+        };
+      }) {};
    csharp-mode = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "csharp-mode";
@ -8291,12 +8333,12 @@
    easy-hugo = callPackage ({ emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "easy-hugo";
-        version = "2.8.20";
+        version = "2.8.21";
        src = fetchFromGitHub {
          owner = "masasam";
          repo = "emacs-easy-hugo";
-          rev = "253d91cda8722fa69b8ee67b1802137863bc3d9a";
-          sha256 = "1i5hdm9xwajid7kzx6gq8lhx5w2aihvb0ka5h2s88zb1xnnxss46";
+          rev = "61a504616705feae8c3fd8b01bf315e2cb89f699";
+          sha256 = "1lr2hbz4gxcn2r5m3hx4izk8aawgy0fls0isp6cvcgs1s54s2kxi";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/855ea20024b606314f8590129259747cac0bcc97/recipes/easy-hugo";
@ -8312,12 +8354,12 @@
    easy-jekyll = callPackage ({ emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "easy-jekyll";
-        version = "1.5.11";
+        version = "1.5.12";
        src = fetchFromGitHub {
          owner = "masasam";
          repo = "emacs-easy-jekyll";
-          rev = "4eac3993d9bbec9ddfe38b128fd3ed6670f526e2";
-          sha256 = "0ffspw6xavfbk0klqjp8va7ybvsdcxlw1qmqhi6paqam90m6vazz";
+          rev = "9a66d5c5dddac7d5b924df0c3bb414d3f797d8a5";
+          sha256 = "0qx6lgpg2szjgy1a3a856klm7vh544braq8v2s7f81lq0ks2bjhj";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/c3f281145bad12c27bdbef32ccc07b6a5f13b577/recipes/easy-jekyll";
@ -11974,12 +12016,12 @@
    f = callPackage ({ dash, fetchFromGitHub, fetchurl, lib, melpaBuild, s }:
    melpaBuild {
        pname = "f";
-        version = "0.19.0";
+        version = "0.20.0";
        src = fetchFromGitHub {
          owner = "rejeep";
          repo = "f.el";
-          rev = "541cb518afa5010029492847292c248f88b3ea42";
-          sha256 = "1j6gc2pp5w3iwyjm4h3d0ahzs0ac3pah8lzfhpg4nkibl0nc1bcg";
+          rev = "de6d4d40ddc844eee643e92d47b9d6a63fbebb48";
+          sha256 = "1a47xk3yp1rp17fqg7ldl3d3fb888h0fz3sysqfdz1bfdgs8a9bk";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/855ea20024b606314f8590129259747cac0bcc97/recipes/f";
@ -12565,22 +12607,22 @@
          license = lib.licenses.free;
        };
      }) {};
-    flow-minor-mode = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
+    flow-minor-mode = callPackage ({ emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "flow-minor-mode";
-        version = "0.1";
+        version = "0.3";
        src = fetchFromGitHub {
          owner = "an-sh";
          repo = "flow-minor-mode";
-          rev = "eb2372b0acf740ed3c5f9c048addbb8048e04458";
-          sha256 = "0ajdzpjghm7iscv2c6nwwx4v1639map104ldsi978iw8hy7m1mmp";
+          rev = "50dded94ad201fdc9453656a8b15179981cd5acd";
+          sha256 = "1vaqml0ypbc14mnwycgm9slkds3bgg6x5qz99kck98acbcfijxk6";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/66504f789069922ea56f268f4da90fac52b601ff/recipes/flow-minor-mode";
          sha256 = "190dv225sb37jawzrasd7qkbznrmkrdnb90l44il63vrlmjv3r1s";
          name = "flow-minor-mode";
        };
-        packageRequires = [];
+        packageRequires = [ emacs ];
        meta = {
          homepage = "https://melpa.org/#/flow-minor-mode";
          license = lib.licenses.free;
@ -12775,6 +12817,27 @@
          license = lib.licenses.free;
        };
      }) {};
+    flycheck-crystal = callPackage ({ fetchFromGitHub, fetchurl, flycheck, lib, melpaBuild }:
+    melpaBuild {
+        pname = "flycheck-crystal";
+        version = "0.1.0";
+        src = fetchFromGitHub {
+          owner = "crystal-lang-tools";
+          repo = "emacs-crystal-mode";
+          rev = "0fe6815201bebe4c5ff6857bd541d95b05132b10";
+          sha256 = "0r75dvc0jqcqi1qjns8zj132dnm0s6mvqlqynkis16nigbawix8m";
+        };
+        recipeFile = fetchurl {
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/c718f809af30226611358f9aaed7519e52923fd3/recipes/flycheck-crystal";
+          sha256 = "04avxav2rayprm09xkphs1ni10j1kk10j7m77afcac0gnma5rwyn";
+          name = "flycheck-crystal";
+        };
+        packageRequires = [ flycheck ];
+        meta = {
+          homepage = "https://melpa.org/#/flycheck-crystal";
+          license = lib.licenses.free;
+        };
+      }) {};
    flycheck-dmd-dub = callPackage ({ fetchFromGitHub, fetchurl, flycheck, lib, melpaBuild }:
    melpaBuild {
        pname = "flycheck-dmd-dub";
@ -14059,12 +14122,12 @@
    fountain-mode = callPackage ({ emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "fountain-mode";
-        version = "2.4.0";
+        version = "2.4.1";
        src = fetchFromGitHub {
          owner = "rnkn";
          repo = "fountain-mode";
-          rev = "3f953ae30ad55bbbbb80aa0350992e79f4b00f56";
-          sha256 = "1zksjvpvhbr79fg281yhx8k419q9kd4jpi47i9943cs0m088ykyn";
+          rev = "f1dc9dff6779c0ce6ab0a1c0ae349df1194a314f";
+          sha256 = "0j1s6qws773aq3si7pnc1xmlrh9x3v3sfdni6pnlsirv2sc7c4g9";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/913386ac8d5049d37154da3ab32bde408a226511/recipes/fountain-mode";
@ -15789,12 +15852,12 @@
    go-tag = callPackage ({ emacs, fetchFromGitHub, fetchurl, go-mode, lib, melpaBuild }:
    melpaBuild {
        pname = "go-tag";
-        version = "1.0.0";
+        version = "1.0.1";
        src = fetchFromGitHub {
          owner = "brantou";
          repo = "emacs-go-tag";
-          rev = "51b032465405a62f84d9181168a570610ba04085";
-          sha256 = "0158c3yjw21skwa03qmh3xpg9wg7rnk6xbxqx5vxi24205zsz0kd";
+          rev = "a239f58bbef2629086d9e2cf90a64ba3d389a8a3";
+          sha256 = "1w1m05ypl94xn2qvypbgvjhq7gysi13g42pqwlmppgsdh1kphwha";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/fc4cd3fd8fb0707912e205b9d71789ea8126c442/recipes/go-tag";
@ -15978,12 +16041,12 @@
    goto-chg = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "goto-chg";
-        version = "1.7.1";
+        version = "1.7.2";
        src = fetchFromGitHub {
          owner = "emacs-evil";
          repo = "goto-chg";
-          rev = "6cb244922b733358fd6985b36c4b87ef2e177293";
-          sha256 = "0miscmk5gg7mqqwjb5mlrkbpsx4pny2w3rpr90f7yiv30rf83b5j";
+          rev = "e5b38e4e1378f6ea48fa9e8439f49c2998654aa4";
+          sha256 = "1fxdvgdafavc4sad5i8g0wvpdqzlgzmvfi07yrah1c5vwkrslbvj";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/cf1fc176430fe3ab55ce537a0efc59780bb812be/recipes/goto-chg";
@ -18821,12 +18884,12 @@
    hindent = callPackage ({ cl-lib ? null, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "hindent";
-        version = "5.2.4";
+        version = "5.2.5";
        src = fetchFromGitHub {
          owner = "chrisdone";
          repo = "hindent";
-          rev = "e18ec3f55e288883f8042065190572e91651733d";
-          sha256 = "0iq4hs2r56rnsxfjda5acd0s2wrza7jd5jsawnzbyix1vnbgp98z";
+          rev = "cba1110ca413a41a443b8368d63d295d7d36de7a";
+          sha256 = "020dj6q483b7fabspgvnjqw0rhrgj3q1ncdcpafmyn1fgip5y0zq";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/dbae71a47446095f768be35e689025aed57f462f/recipes/hindent";
@ -19343,6 +19406,27 @@
          license = lib.licenses.free;
        };
      }) {};
+    ialign = callPackage ({ emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
+    melpaBuild {
+        pname = "ialign";
+        version = "0.2.0";
+        src = fetchFromGitHub {
+          owner = "mkcms";
+          repo = "interactive-align";
+          rev = "df591e452f9a56c69fb69de961baa75751bae3d8";
+          sha256 = "1k3c0wxbn6yrd75275ny66avp70qpd3glnmagsgq3x8mbyxh233d";
+        };
+        recipeFile = fetchurl {
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/072f1f7ce17e2972863bce10af9c52b3c6502eab/recipes/ialign";
+          sha256 = "070a0fa2vbdfvbnpbzv4z0c7311lf8sy2zw2ifn9k548n4l8k62j";
+          name = "ialign";
+        };
+        packageRequires = [ emacs ];
+        meta = {
+          homepage = "https://melpa.org/#/ialign";
+          license = lib.licenses.free;
+        };
+      }) {};
    ibuffer-projectile = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild, projectile }:
    melpaBuild {
        pname = "ibuffer-projectile";
@ -20039,12 +20123,12 @@
    inf-clojure = callPackage ({ clojure-mode, emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "inf-clojure";
-        version = "2.0.1";
+        version = "2.1.0";
        src = fetchFromGitHub {
          owner = "clojure-emacs";
          repo = "inf-clojure";
-          rev = "956b22e7941d71216799ca4e8d5244e94fad9558";
-          sha256 = "1wakfwmb43na3g2yqign764kwi791x7ikzmf76pkdpky70a5dkhz";
+          rev = "247ca70f8ba5104be292aea20fbde6adb37e359f";
+          sha256 = "11hyva006bc4hbhzjwb4brilm6fb7qfm5h66nl0gmmyva40y6412";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/5d6112e06d1efcb7cb5652b0bec8d282d7f67bd9/recipes/inf-clojure";
@ -21044,12 +21128,12 @@
    js-auto-format-mode = callPackage ({ emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "js-auto-format-mode";
-        version = "1.0.5";
+        version = "1.0.6";
        src = fetchFromGitHub {
          owner = "ybiquitous";
          repo = "js-auto-format-mode";
-          rev = "7872e6f1d8280830c70cae8f1e3edb8049aba295";
-          sha256 = "0a9rbs0pjx953rbblmia9jznxykz5qa9q5wzkj341z6vfq9rq3rf";
+          rev = "37e83641fd5eab45e813e4bc74a835fe7229c160";
+          sha256 = "0hmrhp3lijd77kl0b98nbl1p8fmgjfry2hhvh5vickx3315w7qgw";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/2d3be16771b5b5fde639da3ee97890620354ee7a/recipes/js-auto-format-mode";
@ -22479,12 +22563,12 @@
    live-py-mode = callPackage ({ emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "live-py-mode";
-        version = "2.20.0";
+        version = "2.20.1";
        src = fetchFromGitHub {
          owner = "donkirkby";
          repo = "live-py-plugin";
-          rev = "056a021b082fbe9d3f85e0b3cb493c70318ee2f2";
-          sha256 = "0bi7hxri7rn2rsiqmq82q3bdygirrpk8knjx3kxiw6hgmp3g1gr5";
+          rev = "eed38dc66430802e754c48bb44aaf524d7b1596c";
+          sha256 = "1rl279h18z9fka4zdaqm2h4jxpq3wykja3x7jyhj4bnrqvkw66gh";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/c7615237e80b46b5c50cb51a3ed5b07d92566fb7/recipes/live-py-mode";
@ -23500,12 +23584,12 @@
    mastodon = callPackage ({ emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "mastodon";
-        version = "0.7.0";
+        version = "0.7.1";
        src = fetchFromGitHub {
          owner = "jdenen";
          repo = "mastodon.el";
-          rev = "a9e595142eee69fe84f0ab06f7fde76cef27cdac";
-          sha256 = "1wgx8i6ww9w99f0f62p7v626bb6pvdg04hnhqyjgsmb99wzwlpk7";
+          rev = "e08bb5794762d22f90e85fd65cef7c143e6b9318";
+          sha256 = "0bil0xxava04pd4acjqm3bfqm1kjdk4g0czd4zqvacsp5c9sl2qp";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/809d963b69b154325faaf61e54ca87b94c1c9a90/recipes/mastodon";
@ -24318,12 +24402,12 @@
    monokai-theme = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "monokai-theme";
-        version = "3.4.0";
+        version = "3.5.0";
        src = fetchFromGitHub {
          owner = "oneKelvinSmith";
          repo = "monokai-emacs";
-          rev = "019e07947426f0192fc3458f3f72c19031b607de";
-          sha256 = "0id35345zp0fchbcz8qk2lg71jyln91k56vfama27ss3nzy3f9kz";
+          rev = "bb5cbbd5895b8b3fbc6af572b1fd0aacd4988a8a";
+          sha256 = "1f0jl4a3b6i9skbcym0qzpszy620385m947l2ba2wxf1na7rc626";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/2bc9ce95a02fc4bcf7bc7547849c1c15d6db5089/recipes/monokai-theme";
@ -25406,11 +25490,11 @@
      }) {};
    notmuch = callPackage ({ fetchgit, fetchurl, lib, melpaBuild }: melpaBuild {
        pname = "notmuch";
-        version = "0.26pre1";
+        version = "0.26pre2";
        src = fetchgit {
          url = "git://git.notmuchmail.org/git/notmuch";
-          rev = "1ed211d042d5f413731f812b5af7e82819a6e8ae";
-          sha256 = "140c3bhh24dy2cfsvgf9y7h02sjp6cjv8qam6kd8wjlrd3y9zd80";
+          rev = "4cb1eeba83416a12c616aca6469c027b8b8a303d";
+          sha256 = "0brcdwblfj3nb2ca0izvhlm3x1pf0r72wsa9f2hf0ssnh9w2z40s";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/b19f21ed7485036e799ccd88edbf7896a379d759/recipes/notmuch";
@ -26631,22 +26715,22 @@
          license = lib.licenses.free;
        };
      }) {};
-    org-jira = callPackage ({ cl-lib ? null, emacs, fetchFromGitHub, fetchurl, lib, melpaBuild, request }:
+    org-jira = callPackage ({ cl-lib ? null, emacs, fetchFromGitHub, fetchurl, lib, melpaBuild, request, s }:
    melpaBuild {
        pname = "org-jira";
-        version = "2.8.0";
+        version = "3.0.0";
        src = fetchFromGitHub {
          owner = "ahungry";
          repo = "org-jira";
-          rev = "9315d871556ebe92e766544ff5210dc85ad1ef33";
-          sha256 = "03ddwdzby0s3km0a3dmn6mfdp2zsiqyrddvpp8mgj77rb039g08k";
+          rev = "51a1b2248ec421aecdd38aaf5c2876a036b08bb7";
+          sha256 = "0zyh5nn9hgiz0ic67ypahaah5f3vjmall7z0ffn4gl0fy22sar6h";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/730a585e5c9216a2428a134c09abcc20bc7c631d/recipes/org-jira";
          sha256 = "0dvh9k0i75jxyy3v01c4cfyws8ij6718hsivi2xyrgig7pwp16ib";
          name = "org-jira";
        };
-        packageRequires = [ cl-lib emacs request ];
+        packageRequires = [ cl-lib emacs request s ];
        meta = {
          homepage = "https://melpa.org/#/org-jira";
          license = lib.licenses.free;
@ -30015,12 +30099,12 @@
    protobuf-mode = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "protobuf-mode";
-        version = "3.5.1";
+        version = "3.5.1.1";
        src = fetchFromGitHub {
          owner = "google";
          repo = "protobuf";
-          rev = "106ffc04be1abf3ff3399f54ccf149815b287dd9";
-          sha256 = "17cwwp2ja8rv7nrvaxrxsdb4a2f5gg7zdx85qn2vb92az1fc2lzn";
+          rev = "860bd12fec5c69e6529565165532b3d5108a7d97";
+          sha256 = "1h4xydr5j2zg1888ncn8a1jvqq8fgpgckrmjg6lqzy9jpkvqvfdk";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/b4e7f5f641251e17add561991d3bcf1fde23467b/recipes/protobuf-mode";
@ -36085,12 +36169,12 @@
    treemacs = callPackage ({ ace-window, cl-lib ? null, dash, emacs, f, fetchFromGitHub, fetchurl, hydra, lib, melpaBuild, pfuture, s }:
    melpaBuild {
        pname = "treemacs";
-        version = "1.14";
+        version = "1.15.3";
        src = fetchFromGitHub {
          owner = "Alexander-Miller";
          repo = "treemacs";
-          rev = "f62a946f0fc5db79d37fb748ab49334c4e3cbbfd";
-          sha256 = "12i2q692zczlq62aij2pih4m7bm36dii4y2jq6dxcwb54i96kdr0";
+          rev = "2dabf88d5948a04d0313b0195be397761fc22b58";
+          sha256 = "0j1ampw5i3m0q69cp2nf9xr9qqxiyasjk7wmsg9nwnx7sibhfddk";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/7a680ee3b4a0ab286ac04d84b3fba7606b40c65b/recipes/treemacs";
@ -36106,12 +36190,12 @@
    treemacs-evil = callPackage ({ evil, fetchFromGitHub, fetchurl, lib, melpaBuild, treemacs }:
    melpaBuild {
        pname = "treemacs-evil";
-        version = "1.14";
+        version = "1.15.3";
        src = fetchFromGitHub {
          owner = "Alexander-Miller";
          repo = "treemacs";
-          rev = "f62a946f0fc5db79d37fb748ab49334c4e3cbbfd";
-          sha256 = "12i2q692zczlq62aij2pih4m7bm36dii4y2jq6dxcwb54i96kdr0";
+          rev = "2dabf88d5948a04d0313b0195be397761fc22b58";
+          sha256 = "0j1ampw5i3m0q69cp2nf9xr9qqxiyasjk7wmsg9nwnx7sibhfddk";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/7a680ee3b4a0ab286ac04d84b3fba7606b40c65b/recipes/treemacs-evil";
@ -36127,12 +36211,12 @@
    treemacs-projectile = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild, projectile, treemacs }:
    melpaBuild {
        pname = "treemacs-projectile";
-        version = "1.14";
+        version = "1.15.3";
        src = fetchFromGitHub {
          owner = "Alexander-Miller";
          repo = "treemacs";
-          rev = "f62a946f0fc5db79d37fb748ab49334c4e3cbbfd";
-          sha256 = "12i2q692zczlq62aij2pih4m7bm36dii4y2jq6dxcwb54i96kdr0";
+          rev = "2dabf88d5948a04d0313b0195be397761fc22b58";
+          sha256 = "0j1ampw5i3m0q69cp2nf9xr9qqxiyasjk7wmsg9nwnx7sibhfddk";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/7a680ee3b4a0ab286ac04d84b3fba7606b40c65b/recipes/treemacs-projectile";
@ -38780,8 +38864,8 @@
        version = "1.80";
        src = fetchhg {
          url = "https://www.yatex.org/hgrepos/yatex/";
-          rev = "feef2aa1f50f";
-          sha256 = "0453y7a9lq28bmbrrcbsnsrwnhjphq4s4vcr9ncb5252m6fnwdyl";
+          rev = "668632d9392e";
+          sha256 = "1d37yr7yqqg1gavi3406rv9rfvcm5ic365jhs6pispfx1kr77k6n";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/e28710244a1bef8f56156fe1c271520896a9c694/recipes/yatex";
--- a/pkgs/applications/editors/emacs-modes/org-generated.nix
+++ b/pkgs/applications/editors/emacs-modes/org-generated.nix
@ -1,10 +1,10 @@
 { callPackage }: {
    org = callPackage ({ elpaBuild, fetchurl, lib }: elpaBuild {
        pname = "org";
-        version = "20180102";
+        version = "20180108";
        src = fetchurl {
-          url = "https://orgmode.org/elpa/org-20180102.tar";
-          sha256 = "1jz92wv637x1kp726kgcc29s4s4rscfhb7rhhnr69ny83r1hlczi";
+          url = "https://orgmode.org/elpa/org-20180108.tar";
+          sha256 = "02rs7zi3dzps0mlyfbgiywd2smnlw0pk8ps1nqk0d5hx3n6d15yv";
        };
        packageRequires = [];
        meta = {
@ -14,10 +14,10 @@
      }) {};
    org-plus-contrib = callPackage ({ elpaBuild, fetchurl, lib }: elpaBuild {
        pname = "org-plus-contrib";
-        version = "20180102";
+        version = "20180108";
        src = fetchurl {
-          url = "https://orgmode.org/elpa/org-plus-contrib-20180102.tar";
-          sha256 = "02ajqc8k44w2gskjazkglmn2v0jsxfns0wq3pgslhb7ychs3yrlv";
+          url = "https://orgmode.org/elpa/org-plus-contrib-20180108.tar";
+          sha256 = "10mhiqsrxxmhsy8dl88r456shx6ajm4w19pz259b960551r596iz";
        };
        packageRequires = [];
        meta = {
--- a/pkgs/applications/editors/neovim/default.nix
+++ b/pkgs/applications/editors/neovim/default.nix
@ -83,7 +83,7 @@ let
                       (optionalString withPython3 python3Wrapper) +
                       (optionalString withRuby rubyWrapper)}" --unset PYTHONPATH '' +
    optionalString (withRuby)
-      ''--suffix PATH : \"${rubyEnv}/bin\" --set GEM_HOME \"${rubyEnv}/${rubyEnv.ruby.gemPath}\" '';
+      ''--suffix PATH : ${rubyEnv}/bin --set GEM_HOME ${rubyEnv}/${rubyEnv.ruby.gemPath} '';

  neovim = stdenv.mkDerivation rec {
    name = "neovim-${version}";
--- a/pkgs/applications/editors/sigil/default.nix
+++ b/pkgs/applications/editors/sigil/default.nix
@ -6,10 +6,10 @@

 stdenv.mkDerivation rec {
  name = "sigil-${version}";
-  version = "0.9.7";
+  version = "0.9.9";

  src = fetchFromGitHub {
-    sha256 = "17m2f7pj2sx5rxrbry6wk1lvviy8fi2m270h47sisywnrhddarh7";
+    sha256 = "01pvc7k54mx5c7h1qiw92d4j459psv7n9xg94qbinf8vmpvkrcbw";
    rev = version;
    repo = "Sigil";
    owner = "Sigil-Ebook";
--- a/pkgs/applications/editors/typora/default.nix
+++ b/pkgs/applications/editors/typora/default.nix
@ -3,18 +3,18 @@

 stdenv.mkDerivation rec {
  name = "typora-${version}";
-  version = "0.9.38";
+  version = "0.9.41";

  src =
    if stdenv.system == "x86_64-linux" then
      fetchurl {
        url = "https://www.typora.io/linux/typora_${version}_amd64.deb";
-        sha256 = "bf6a069c5da4a7dc289bdb3c8d27e7a81daeaee99488d4d3b512c6b673780557";
+        sha256 = "e4916f86c7c12aec8fd59b3ef79c2a4d3f77b02a0a9e962916c688871c9fda1d";
      }
    else
      fetchurl {
        url = "https://www.typora.io/linux/typora_${version}_i386.deb";
-        sha256 = "edd092e96ebf69503cf6b39b77a61ec5e3185f8a1447da0bed063fa11861c1b9";
+        sha256 = "18960fb4b2cd6cf9cb77025a4035a3258f1599b1d225fb673b49c1588fa272d6";
      }
    ;

--- a/pkgs/applications/graphics/ImageMagick/7.0.nix
+++ b/pkgs/applications/graphics/ImageMagick/7.0.nix
@ -14,8 +14,8 @@ let
    else throw "ImageMagick is not supported on this platform.";

  cfg = {
-    version = "7.0.7-19";
-    sha256 = "1naib6hspmq7d4gfpsksx78gc1lq3p2v3i9pxkkdvr9p9j15c4az";
+    version = "7.0.7-21";
+    sha256 = "0680dbg77gcyb3g4n22z5mp7c8mg0jpkqb0g4nj7d7r78nl869rv";
    patches = [];
  };
 in
--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@ -14,8 +14,8 @@ let
    else throw "ImageMagick is not supported on this platform.";

  cfg = {
-    version = "6.9.9-28";
-    sha256 = "132kdl7jlkghfg3smdab14c29cpvrx65ibipxkmwg1nc88ycqivh";
+    version = "6.9.9-33";
+    sha256 = "05931wfhllrb1c2g2nwnwaf1wazn60y5f70gd11qcqp46rif7z21";
    patches = [];
  }
    # Freeze version on mingw so we don't need to port the patch too often.
--- a/pkgs/applications/graphics/digikam/default.nix
+++ b/pkgs/applications/graphics/digikam/default.nix
@ -1,4 +1,4 @@
-{ mkDerivation, lib, fetchurl, cmake, doxygen, extra-cmake-modules, wrapGAppsHook, fetchpatch
+{ mkDerivation, lib, fetchFromGitHub, cmake, doxygen, extra-cmake-modules, wrapGAppsHook, fetchpatch

 # For `digitaglinktree`
 , perl, sqlite
@ -50,11 +50,13 @@

 mkDerivation rec {
  name    = "digikam-${version}";
-  version = "5.7.0";
+  version = "5.8.0";

-  src = fetchurl {
-    url = "mirror://kde/stable/digikam/${name}.tar.xz";
-    sha256 = "1xah079g47fih8l9qy1ifppfvmq5yms5y1z54nvxdyz8nsszy19n";
+  src = fetchFromGitHub {
+    owner  = "KDE";
+    repo   = "digikam";
+    rev    = "v${version}";
+    sha256 = "1bvidg0fn92xvw5brhb34lm7m4iy4jb5xpvnhbgh8vik2m4n41w1";
  };

  nativeBuildInputs = [ cmake doxygen extra-cmake-modules kdoctools wrapGAppsHook ];
@ -83,8 +85,7 @@ mkDerivation rec {
    qtsvg
    qtwebkit

-    # https://bugs.kde.org/show_bug.cgi?id=387960
-    #kcalcore
+    kcalcore
    kconfigwidgets
    kcoreaddons
    kfilemetadata
@ -112,20 +113,6 @@ mkDerivation rec {
      --replace "/usr/bin/sqlite3" "${sqlite}/bin/sqlite3"
  '';

-  patches = [
-    # fix Qt-5.9.3 empty album problem
-    (fetchpatch {
-      url = "https://cgit.kde.org/digikam.git/patch/?id=855ba5b7d4bc6337234720a72ea824ddd3b32e5b";
-      sha256 = "0zk8p182piy6xn9v0mhwawya9ciq596vql1qc3lgnx371a97mmni";
-    })
-  ];
-
-  patchFlags = "-d core -p1";
-
-  # `en make -f core/utilities/assistants/expoblending/CMakeFiles/expoblending_src.dir/build.make core/utilities/assistants/expoblending/CMakeFiles/expoblending_src.dir/manager/expoblendingthread.cpp.o`:
-  # digikam_version.h:37:24: fatal error: gitversion.h: No such file or directory
-  enableParallelBuilding = false;
-
  meta = with lib; {
    description = "Photo Management Program";
    license = licenses.gpl2;
--- a/pkgs/applications/graphics/luminance-hdr/default.nix
+++ b/pkgs/applications/graphics/luminance-hdr/default.nix
@ -1,28 +1,21 @@
-{ stdenv, cmake, fetchurl, fetchpatch, pkgconfig, boost, exiv2, fftwFloat, gsl
+{ stdenv, cmake, fetchurl, pkgconfig, boost, exiv2, fftwFloat, gsl
 , ilmbase, lcms2, libraw, libtiff, openexr
-, qtbase, qtdeclarative, qttools, qtwebkit
+, qtbase, qtdeclarative, qttools, qtwebengine
 }:

 stdenv.mkDerivation rec {
-  name = "luminance-hdr-2.4.0";
+  name = "luminance-hdr-2.5.1";

  src = fetchurl {
    url = "mirror://sourceforge/qtpfsgui/${name}.tar.bz2";
-    sha256 = "00fldbcizrx8jcnjgq74n3zmbm27dxzl96fxa7q49689mfnlw08l";
+    sha256 = "15hnyk9yjkkc97dmnrg2ipfgwqxprlcyv2kyvbls4d54zc56x658";
  };

-  patches = [(fetchpatch {
-    name = "fix-qt53-build.diff";
-    url = "http://anonscm.debian.org/cgit/pkg-phototools/luminance-hdr.git/"
-      + "plain/debian/patches/51_qt5_printsupport.diff?id=00c869a860062dac181303f2c03a3513c0e210bc";
-    sha256 = "0nzvfxd3ybxx61rj6vxcaaxfrsxrl9af3h8jj7pr3rncisnl9gkl";
-  })];
-
  NIX_CFLAGS_COMPILE = "-I${ilmbase.dev}/include/OpenEXR";

  buildInputs =
    [
-      qtbase qtdeclarative qttools qtwebkit
+      qtbase qtdeclarative qttools qtwebengine
      boost exiv2 fftwFloat gsl ilmbase lcms2 libraw libtiff openexr
    ];

--- a/pkgs/applications/kde/fetch.sh
+++ b/pkgs/applications/kde/fetch.sh
@ -1 +1 @@
-WGET_ARGS=( https://download.kde.org/stable/applications/17.12.0/ -A '*.tar.xz' )
+WGET_ARGS=( https://download.kde.org/stable/applications/17.12.1/ -A '*.tar.xz' )
--- a/pkgs/applications/kde/minuet.nix
+++ b/pkgs/applications/kde/minuet.nix
@ -1,5 +1,5 @@
 { mkDerivation
-, lib, extra-cmake-modules
+, lib, extra-cmake-modules, gettext, python
 , drumstick, fluidsynth
 , kcoreaddons, kcrash, kdoctools
 , qtquickcontrols2, qtsvg, qttools
@ -12,11 +12,13 @@ mkDerivation {
    maintainers = with maintainers; [ peterhoeg ];
  };

-  nativeBuildInputs = [ extra-cmake-modules kdoctools ];
+  nativeBuildInputs = [ extra-cmake-modules gettext kdoctools python ];
+
  propagatedBuildInputs = [
    drumstick fluidsynth
    kcoreaddons kcrash
    qtquickcontrols2 qtsvg qttools
  ];
+
  enableParallelBuilding = true;
 }
--- a/pkgs/applications/kde/srcs.nix
+++ b/pkgs/applications/kde/srcs.nix
--- a/pkgs/applications/misc/calibre/default.nix
+++ b/pkgs/applications/misc/calibre/default.nix
@ -5,12 +5,12 @@
 }:

 stdenv.mkDerivation rec {
-  version = "3.14.0";
+  version = "3.15.0";
  name = "calibre-${version}";

  src = fetchurl {
    url = "https://download.calibre-ebook.com/${version}/${name}.tar.xz";
-    sha256 = "1367jh82mhjjlvyd30mfz3qwscg60l0gimakvzpbkrah918kfk51";
+    sha256 = "1zvk499g3ddl82f6655ddqzl7r62hj1fq3qjsxpn07an2lizail7";
  };

  patches = [
--- a/pkgs/applications/misc/cool-retro-term/default.nix
+++ b/pkgs/applications/misc/cool-retro-term/default.nix
@ -1,15 +1,15 @@
-{ stdenv, fetchgit, qtbase, qtquick1, qmltermwidget,
+{ stdenv, fetchFromGitHub, qtbase, qtquick1, qmltermwidget,
 qtquickcontrols, qtgraphicaleffects, qmake }:

 stdenv.mkDerivation rec {
-  version = "1.0.0";
+  version = "1.0.1";
  name = "cool-retro-term-${version}";

-  src = fetchgit {
-    url = "https://github.com/Swordfish90/cool-retro-term.git";
-    rev = "refs/tags/v${version}";
-    sha256 = "19sf9ppp2xzwfjwmdqgq9pils4yafsz662n1h65sv5aq04c7gmxs";
-    fetchSubmodules = false;
+  src = fetchFromGitHub {
+    owner = "Swordfish90";
+    repo = "cool-retro-term";
+    rev = version;
+    sha256 = "1ah54crqv13xsg9cvlwmgyhz90xjjy3vy8pbn9i0vc0ljmpgkqd5";
  };

  patchPhase = ''
--- a/pkgs/applications/misc/cura/default.nix
+++ b/pkgs/applications/misc/cura/default.nix
@ -2,13 +2,13 @@

 mkDerivation rec {
  name = "cura-${version}";
-  version = "3.0.3";
+  version = "3.1.0";

  src = fetchFromGitHub {
    owner = "Ultimaker";
    repo = "Cura";
    rev = version;
-    sha256 = "0ks8bb3mif6kyvb01ddhpn1c2l31s8fxivi70kmpm743sqv4kjaa";
+    sha256 = "1x732bzxdxnz1av8jlv5kzs08jpmsg6bz9i88jr63kw32d901xsm";
  };

  buildInputs = [ qtbase qtquickcontrols ];
--- a/pkgs/applications/misc/dbeaver/default.nix
+++ b/pkgs/applications/misc/dbeaver/default.nix
@ -0,0 +1,70 @@
+{ stdenv, fetchurl, makeDesktopItem, makeWrapper
+, fontconfig, freetype, glib, gtk2
+, jdk, libX11, libXrender, libXtst, zlib }:
+
+# The build process is almost like eclipse's.
+# See `pkgs/applications/editors/eclipse/*.nix`
+
+stdenv.mkDerivation rec {
+  name = "dbeaver-ce-${version}";
+  version = "4.3.2";
+
+  desktopItem = makeDesktopItem {
+    name = "dbeaver";
+    exec = "dbeaver";
+    icon = "dbeaver";
+    desktopName = "dbeaver";
+    comment = "SQL Integrated Development Environment";
+    genericName = "SQL Integrated Development Environment";
+    categories = "Application;Development;";
+  };
+
+  buildInputs = [
+    fontconfig freetype glib gtk2
+    jdk libX11 libXrender libXtst zlib
+  ];
+
+  nativeBuildInputs = [
+    makeWrapper
+  ];
+
+  src = fetchurl {
+    url = "https://dbeaver.jkiss.org/files/${version}/dbeaver-ce-${version}-linux.gtk.x86_64.tar.gz";
+    sha256 = "0spiwx5dxchpl2qq10rinj9db723w2hf7inqmg4m7fjaj75bpl3s";
+  };
+
+  installPhase = ''
+    mkdir -p $out/
+    cp -r . $out/dbeaver
+
+    # Patch binaries.
+    interpreter=$(cat $NIX_CC/nix-support/dynamic-linker)
+    patchelf --set-interpreter $interpreter $out/dbeaver/dbeaver
+
+    makeWrapper $out/dbeaver/dbeaver $out/bin/dbeaver \
+      --prefix PATH : ${jdk}/bin \
+      --prefix LD_LIBRARY_PATH : ${stdenv.lib.makeLibraryPath ([ glib gtk2 libXtst ])} \
+      --prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH"
+
+    # Create desktop item.
+    mkdir -p $out/share/applications
+    cp ${desktopItem}/share/applications/* $out/share/applications
+
+    mkdir -p $out/share/pixmaps
+    ln -s $out/dbeaver/icon.xpm $out/share/pixmaps/dbeaver.xpm
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = https://dbeaver.jkiss.org;
+    description = "Universal SQL Client for developers, DBA and analysts. Supports MySQL, PostgreSQL, MariaDB, SQLite, and more";
+    longDescription = ''
+      Free multi-platform database tool for developers, SQL programmers, database
+      administrators and analysts. Supports all popular databases: MySQL,
+      PostgreSQL, MariaDB, SQLite, Oracle, DB2, SQL Server, Sybase, MS Access,
+      Teradata, Firebird, Derby, etc.
+    '';
+    license = licenses.asl20;
+    platforms = [ "x86_64-linux" ];
+    maintainers = [ maintainers.samueldr ];
+  };
+}
--- a/pkgs/applications/misc/electron-cash/default.nix
+++ b/pkgs/applications/misc/electron-cash/default.nix
@ -7,14 +7,14 @@ let
 in

 python3Packages.buildPythonApplication rec {
-  version = "3.1.1";
+  version = "3.1.2";
  name = "electron-cash-${version}";

  src = fetchurl {
    url = "https://electroncash.org/downloads/${version}/win-linux/ElectronCash-${version}.tar.gz";
    # Verified using official SHA-1 and signature from
    # https://github.com/fyookball/keys-n-hashes
-    sha256 = "cd42a0a0075787125f195508834d8c34d651896c0986d0b2066763add59bad2b";
+    sha256 = "18h44jfbc2ksj34hdzgszvvq82xi28schl3wp3lkq9fjp7ny0mf3";
  };

  propagatedBuildInputs = with python3Packages; [
@ -74,6 +74,7 @@ python3Packages.buildPythonApplication rec {
      of the blockchain.
    '';
    homepage = https://www.electroncash.org/;
+    platforms = platforms.linux;
    maintainers = with maintainers; [ lassulus ];
    license = licenses.mit;
  };
--- a/pkgs/applications/misc/electrum-ltc/default.nix
+++ b/pkgs/applications/misc/electrum-ltc/default.nix
@ -1,34 +1,34 @@
 { stdenv
 , fetchurl
-, python2Packages
+, python3Packages
 }:

-python2Packages.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
  name = "electrum-ltc-${version}";
-  version = "2.9.3.1";
+  version = "3.0.5.1";

  src = fetchurl {
    url = "https://electrum-ltc.org/download/Electrum-LTC-${version}.tar.gz";
-    sha256 = "d931a5376b7f38fba7221b01b1010f172c4d662668adae5c38885a646d5ee530";
+    sha256 = "1acsgzmd83cz6ha5fw63mi7123fr6gbiq537p5lxxfs2i8zrl63r";
  };

-  propagatedBuildInputs = with python2Packages; [
-    pyqt4
+  propagatedBuildInputs = with python3Packages; [
+    pyaes
    ecdsa
    pbkdf2
    requests
    qrcode
-    ltc_scrypt
+    py_scrypt
+    pyqt5
    protobuf
    dnspython
-    jsonrpclib
-    pyaes
+    jsonrpclib-pelix
    pysocks
  ];

  preBuild = ''
    sed -i 's,usr_share = .*,usr_share = "'$out'/share",g' setup.py
-    pyrcc4 icons.qrc -o gui/qt/icons_rc.py
+    pyrcc5 icons.qrc -o gui/qt/icons_rc.py
    # Recording the creation timestamps introduces indeterminism to the build
    sed -i '/Created: .*/d' gui/qt/icons_rc.py
  '';
@ -48,7 +48,7 @@ python2Packages.buildPythonApplication rec {
    '';
    homepage = https://electrum-ltc.org/;
    license = licenses.mit;
-    platforms = platforms.all;
+    platforms = platforms.linux;
    maintainers = with maintainers; [ asymmetric ];
  };
 }
--- a/pkgs/applications/misc/jgmenu/default.nix
+++ b/pkgs/applications/misc/jgmenu/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  name = "jgmenu-${version}";
-  version = "0.7.6";
+  version = "0.8";

  src = fetchFromGitHub {
    owner = "johanmalm";
    repo = "jgmenu";
    rev = "v${version}";
-    sha256 = "13bmvg9kqjng8jqc3xiif587l05ygk5b3k9xn2lq8yxcwxi9p30v";
+    sha256 = "042nvix85a37aalc2rwg4yc2g3wyy6lym3c2ljj2xkl6c1b0c1r7";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/kdeconnect/default.nix
+++ b/pkgs/applications/misc/kdeconnect/default.nix
@ -13,6 +13,8 @@
 , libfakekey
 , libXtst
 , qtx11extras
+, sshfs
+, makeWrapper
 }:

 stdenv.mkDerivation rec {
@ -28,11 +30,15 @@ stdenv.mkDerivation rec {
  buildInputs = [
    libfakekey libXtst
    ki18n kiconthemes kcmutils kconfigwidgets kdbusaddons knotifications
-    qca-qt5 qtx11extras
+    qca-qt5 qtx11extras makeWrapper
  ];

  nativeBuildInputs = [ extra-cmake-modules kdoctools ];

+  postInstall = ''
+    wrapProgram $out/lib/libexec/kdeconnectd --prefix PATH : ${lib.makeBinPath [ sshfs ]}
+  '';
+
  enableParallelBuilding = true;

  meta = with lib; {
--- a/pkgs/applications/misc/pgmanage/default.nix
+++ b/pkgs/applications/misc/pgmanage/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  name = "pgmanage-${version}";
-  version = "10.0.2";
+  version = "10.1.0";

  src = fetchFromGitHub {
    owner  = "pgManage";
    repo   = "pgManage";
    rev    = "v${version}";
-    sha256 = "0g9kvhs9b6kc1s7j90fqv71amiy9v0w5p906yfvl0j7pf3ayq35a";
+    sha256 = "0kzdq3xl6wyclngq307544yk57vpm10wyklkbgzx649z3pls3kyw";
  };

  buildInputs = [ postgresql openssl ];
--- a/pkgs/applications/misc/pmenu/default.nix
+++ b/pkgs/applications/misc/pmenu/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  name = "pmenu-${version}";
-  version = "2017-04-10";
+  version = "2018-01-01";

  src = fetchFromGitLab {
    owner = "o9000";
    repo = "pmenu";
-    rev = "87fec9ddf594f1046d03348de2bafcfa6e94cfd1";
-    sha256 = "0ynhml46bi5k52v7fw2pjpcac9dswkmlvh6gynvnyqjp4p153fl4";
+    rev = "f98a5bdf20deb0b7f0543e5ce6a8f5574f695e07";
+    sha256 = "131nqafbmbfpgsgss27pz4cyb9fb29m5h1ai1fyvcn286rr9dnp2";
  };

  nativeBuildInputs = [ python2Packages.wrapPython ];
--- a/pkgs/applications/misc/sigal/default.nix
+++ b/pkgs/applications/misc/sigal/default.nix
@ -0,0 +1,33 @@
+{ lib, buildPythonApplication, fetchPypi, pythonPackages }:
+
+buildPythonApplication rec {
+  version = "1.3.0";
+  pname   = "sigal";
+
+  src = fetchPypi {
+    inherit version pname;
+    sha256 = "0ycyrap4rc0yrjagi5c5fs5gpw9whvkli656syfpj99dq1q9q1d0";
+  };
+
+  buildInputs = with pythonPackages; [ pytest ];
+  propagatedBuildInputs = with pythonPackages; [
+    jinja2
+    markdown
+    pillow
+    pilkit
+    clint
+    click
+    blinker
+  ];
+
+  # No tests included
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Yet another simple static gallery generator";
+    homepage    = http://sigal.saimon.org/en/latest/index.html;
+    license     = licenses.mit;
+    maintainers = with maintainers; [ domenkozar matthiasbeyer ];
+  };
+}
+
--- a/pkgs/applications/misc/timewarrior/default.nix
+++ b/pkgs/applications/misc/timewarrior/default.nix
@ -2,19 +2,17 @@

 stdenv.mkDerivation rec {
  name = "timewarrior-${version}";
-  version = "1.0.0";
+  version = "1.1.0";

  enableParallelBuilding = true;

  src = fetchurl {
    url = "https://taskwarrior.org/download/timew-${version}.tar.gz";
-    sha256 = "1d8b9sjdbdld81n535iwip9igl16kcw452wa47fmndp8w487j0mc";
+    sha256 = "0jnwj8lflr6nlch2j2hkmgpdqq3zbdd2sfpi5iwiabljk25v9iq9";
  };

  nativeBuildInputs = [ cmake ];

-  patches = [ ./install-all-themes.patch ];
-
  meta = with stdenv.lib; {
    description = "A command-line time tracker";
    homepage = https://tasktools.org/projects/timewarrior.html;
--- a/pkgs/applications/misc/timewarrior/install-all-themes.patch
+++ b/pkgs/applications/misc/timewarrior/install-all-themes.patch
@ -1,27 +0,0 @@
-From e4a14c61bff3a55de42718dc11b282c4d5342995 Mon Sep 17 00:00:00 2001
-From: Will Dietz <w@wdtz.org>
-Date: Tue, 14 Mar 2017 07:51:02 -0500
-Subject: [PATCH] doc/themes: install all themes, not just 'dark.theme'.
-
---
- doc/themes/CMakeLists.txt | 7 +++++--
- 1 file changed, 5 insertions(+), 2 deletions(-)
-
-diff --git a/doc/themes/CMakeLists.txt b/doc/themes/CMakeLists.txt
-index a954576..3a3b453 100644
--- a/doc/themes/CMakeLists.txt
-+++ b/doc/themes/CMakeLists.txt
-@@ -2,5 +2,8 @@ cmake_minimum_required (VERSION 2.8)
- 
- message ("-- Configuring theme documentation")
- 
-install (FILES README     DESTINATION ${TIMEW_DOCDIR}/doc/themes)
-install (FILES dark.theme DESTINATION ${TIMEW_DOCDIR}/doc/themes)
-+install (FILES README           DESTINATION ${TIMEW_DOCDIR}/doc/themes)
-+install (FILES dark.theme       DESTINATION ${TIMEW_DOCDIR}/doc/themes)
-+install (FILES dark_blue.theme  DESTINATION ${TIMEW_DOCDIR}/doc/themes)
-+install (FILES dark_green.theme DESTINATION ${TIMEW_DOCDIR}/doc/themes)
-+install (FILES dark_red.theme   DESTINATION ${TIMEW_DOCDIR}/doc/themes)
-- 
-2.12.0
-
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@ -44,6 +44,11 @@ let
  # source tree.
  extraAttrs = buildFun base;

+  gentooPatch = name: sha256: fetchurl {
+    url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/www-client/chromium/files/${name}";
+    inherit sha256;
+  };
+
  mkGnFlags =
    let
      # Serialize Nix types into GN types according to this document:
@ -139,9 +144,15 @@ let
      # for updated patches and hints about build flags
      ++ optionals (versionRange "63" "64") [
      ./patches/chromium-gcc5-r4.patch
+      (gentooPatch "chromium-gcc5-r5.patch" "0z7rggizzg85wfr8zhw0yfwd3q69lsh3yp297s939jgzp66cwwkw")
      ./patches/include-math-for-round.patch
-    ]
-      ++ optional enableWideVine ./patches/widevine.patch;
+    ] ++ optionals (versionRange "64" "65") [
+      ## This is a first guess on what patches are needed for 64
+      # (gentooPatch "chromium-memcpy-r0.patch" "1d3vra59wjg2lva7ddv55ff6l57mk9k50llsplr0b7vxk0lh0ps5")
+      (gentooPatch "chromium-cups-r0.patch" "0hyjlfh062c8h54j4b27y4dq5yzd4w6mxzywk3s02yf6cj3cbkrl")
+      # (gentooPatch "chromium-clang-r2.patch" "1lsqr7cbjsad5pyyp6kyrfmcgcqy2z2yzgp4zxwjq95fknrfi5a4")
+      (gentooPatch "chromium-angle-r0.patch" "0izdrqwsyr48117dhvwdsk8c6dkrnq2njida1q4mb1lagvwbz7gc")
+    ]  ++ optional enableWideVine ./patches/widevine.patch;

    postPatch = ''
      # We want to be able to specify where the sandbox is via CHROME_DEVEL_SANDBOX
--- a/pkgs/applications/networking/browsers/chromium/plugins.nix
+++ b/pkgs/applications/networking/browsers/chromium/plugins.nix
@ -94,12 +94,12 @@ let

  flash = stdenv.mkDerivation rec {
    name = "flashplayer-ppapi-${version}";
-    version = "28.0.0.126";
+    version = "28.0.0.137";

    src = fetchzip {
      url = "https://fpdownload.adobe.com/pub/flashplayer/pdc/"
          + "${version}/flash_player_ppapi_linux.x86_64.tar.gz";
-      sha256 = "10q005jp5vcfqx35jzwp138djv9g7jp83jqbyism40k67ah33i1z";
+      sha256 = "1776jjv2abzrwhgff8c75wm9dh3gfsihv9c5vzllhdys21zvravy";
      stripRoot = false;
    };

--- a/pkgs/applications/networking/browsers/chromium/update.nix
+++ b/pkgs/applications/networking/browsers/chromium/update.nix
@ -145,7 +145,7 @@ in rec {
        outputHashMode = "flat";
        outputHashAlgo = "md5";

-        buildInputs = [ curl ];
+        nativeBuildInputs = [ curl ];
        preferLocalBuild = true;

        buildCommand = ''
@ -178,7 +178,7 @@ in rec {

    getHash = path: import (runCommand "gethash.nix" {
      inherit path;
-      buildInputs = [ nix ];
+      nativeBuildInputs = [ nix ];
    } ''
      sha256="$(nix-hash --flat --base32 --type sha256 "$path")"
      echo "\"$sha256\"" > "$out"
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@ -1,18 +1,18 @@
 # This file is autogenerated from update.sh in the same directory.
 {
  beta = {
-    sha256 = "1mv01q6sdvkmfyk9q834zcaq1z4s07sgfp5i107vgcbwnmwmhpgi";
-    sha256bin64 = "0x176ijcmn25xhn4apn3yal1xb14rz0xaiy2mjbknm011s4ysvby";
-    version = "64.0.3282.24";
+    sha256 = "1mkschqjdn3n3709qkxha1zs626vhh33dp80gi3h6hhk8w0gx4sb";
+    sha256bin64 = "05hyfm9j127mprj2wjrq3m9qm4zp3bny40164vscr6vkfxvmjh03";
+    version = "64.0.3282.71";
  };
  dev = {
-    sha256 = "1mv01q6sdvkmfyk9q834zcaq1z4s07sgfp5i107vgcbwnmwmhpgi";
-    sha256bin64 = "15zmh4ix6822kzqcapkpjzsjkd4yaw45jgddh5gdv65j65a6fhlq";
-    version = "64.0.3282.24";
+    sha256 = "1b7f1bs9i7dhrccssn5zk4s62sfpmkj8b4w6aq8g4jbyg7hw9pql";
+    sha256bin64 = "0lp8m62p8h60hi8h5nskcjdh6k8vq4g00xbq5limg7d6pgc0vyyz";
+    version = "65.0.3311.3";
  };
  stable = {
-    sha256 = "0aqsqd2s4hj3lci7wa7bss4wy4sv889f0z4va7fqp9sd36c0gn27";
-    sha256bin64 = "188wxkagihq77aaikkdiq923bbx7a0np73skhrfd4y38lygirry9";
-    version = "63.0.3239.108";
+    sha256 = "139x3cbc5pa14x69493ic8i2ank12c9fwiq6pqm11aps88n6ri44";
+    sha256bin64 = "03r97jg1fcb23k1xg5qnw5hp5p9m8anyx346nchbas63rfn439km";
+    version = "63.0.3239.132";
  };
 }
--- a/pkgs/applications/networking/browsers/firefox-bin/beta_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/beta_sources.nix
--- a/pkgs/applications/networking/browsers/firefox-bin/devedition_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/devedition_sources.nix
--- a/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix
+++ b/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix
@ -73,7 +73,7 @@ let
 in
 stdenv.mkDerivation rec {
  name = "flashplayer-${version}";
-  version = "28.0.0.126";
+  version = "28.0.0.137";

  src = fetchurl {
    url =
@ -84,14 +84,14 @@ stdenv.mkDerivation rec {
    sha256 =
      if debug then
        if arch == "x86_64" then
-          "16ivf0j7kr7hak2pxs4mbhw5g0i8ky72mvdkaxpfq42g4mr7qf62"
+          "1hj3sfrspdkhq967fmnpgamgiq90k263cqfas94gp3dzslmkingw"
        else
-          "09dn1zr5bcfvkb46z86p7gr2g9p0a3nj9vvw1qw2fblvbajmznk0"
+          "1v4k6hzngm23xwxnh6ngplp2m0ga480sbcm668bpcj61krmi6xy4"
      else
        if arch == "x86_64" then
-          "0z5p3zimvx8zas649gn2nzp4gfvwc69hklza3d2hpmzb35ckfqbc"
+          "0ijmrk6262a1xcf98g94vdlqxnik9f7igjy08j3a2i4b5bikq479"
        else
-          "0kyyjqim7qq0am2hr9ldcbm4sx8dsbgf3916km9gbgg8vjddgxwy";
+          "10a17dba4zy29padvi3fnv2s8v71q698ffqjp8ggsla42pjyhvkh";
  };

  nativeBuildInputs = [ unzip ];
--- a/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix
+++ b/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix
@ -55,7 +55,7 @@ let
 in
 stdenv.mkDerivation rec {
  name = "flashplayer-standalone-${version}";
-  version = "28.0.0.126";
+  version = "28.0.0.137";

  src = fetchurl {
    url =
@ -65,9 +65,9 @@ stdenv.mkDerivation rec {
        "https://fpdownload.macromedia.com/pub/flashplayer/updaters/28/flash_player_sa_linux.x86_64.tar.gz";
    sha256 =
      if debug then
-        "07692qivf09zh36vlaczwwq93f8p7v1afnsgkry7m9yybxh1753d"
+        "0xr3hf828sm0xdnmk2kavxmvzc6m0mw369khrxyfwrbxvdsibwn8"
      else
-        "14xj55wjp9jvm01n8bwrbwmkhpcrxc44yfqi3jq8f8pzrqi7smck";
+        "1wr0avjpshrj51svb1sfnshz39xxla1brqs8pbcgfgyqjh350rgn";
  };

  nativeBuildInputs = [ unzip ];
--- a/pkgs/applications/networking/browsers/palemoon/default.nix
+++ b/pkgs/applications/networking/browsers/palemoon/default.nix
@ -23,6 +23,7 @@ stdenv.mkDerivation rec {
  desktopItem = makeDesktopItem {
    name = "palemoon";
    exec = "palemoon %U";
+    icon = "palemoon";
    desktopName = "Pale Moon";
    genericName = "Web Browser";
    categories = "Application;Network;WebBrowser;";
@ -76,7 +77,6 @@ stdenv.mkDerivation rec {

  patchPhase = ''
    chmod u+w .
-    sed -i /status4evar/d browser/installer/package-manifest.in
  '';

  buildPhase = ''
@ -87,6 +87,14 @@ stdenv.mkDerivation rec {
  installPhase = ''
    mkdir -p $out/share/applications
    cp ${desktopItem}/share/applications/* $out/share/applications
+
+    for n in 16 22 24 32 48 256; do
+      size=$n"x"$n
+      mkdir -p $out/share/icons/hicolor/$size/apps
+      cp $src/browser/branding/official/default$n.png \
+         $out/share/icons/hicolor/$size/apps/palemoon.png
+    done
+
    cd $builddir
    $src/mach install
  '';
--- a/pkgs/applications/networking/cluster/chronos/chronos-deps.nix
+++ b/pkgs/applications/networking/cluster/chronos/chronos-deps.nix
@ -8,7 +8,7 @@ stdenv.mkDerivation {
  outputHashMode = "recursive";
  outputHash = "0mm2sb1p5zz6b0z2s4zhdlix6fafydsxmqjy8zbkwzw4f6lazzyl";

-  buildInputs = [ curl ];
+  nativeBuildInputs = [ curl ];

  impureEnvVars = stdenv.lib.fetchers.proxyImpureEnvVars;
 }
--- a/pkgs/applications/networking/cluster/mesos/mesos-deps.nix
+++ b/pkgs/applications/networking/cluster/mesos/mesos-deps.nix
@ -8,7 +8,7 @@ stdenv.mkDerivation {
  outputHashMode = "recursive";
  outputHash = "10h0qs7svw0cqjkyxs8z6s3qraa8ga920zfrr59rdlanbwg4klly";

-  buildInputs = [ curl ];
+  nativeBuildInputs = [ curl ];

  impureEnvVars = stdenv.lib.fetchers.proxyImpureEnvVars;
 }
--- a/pkgs/applications/networking/cluster/spark/default.nix
+++ b/pkgs/applications/networking/cluster/spark/default.nix
@ -6,13 +6,9 @@

 let
  versionMap = {
-    "1.6.3" = {
-                hadoopVersion = "cdh4";
-                sparkSha256 = "00il083cjb9xqzsma2ifphq9ggichwndrj6skh2z5z9jk3z0lgyn";
-              };
-    "2.2.0" = {
+    "2.2.1" = {
                hadoopVersion = "hadoop2.7";
-                sparkSha256 = "0wjjn2pgalrcji8avhj5d48kl1mf7rhrdxhzf29dbiszq4fkx0s6";
+                sparkSha256 = "10nxsf9a6hj1263sxv0cbdqxdb8mb4cl6iqq32ljq9ydvk32s99c";
              };
  };
 in
--- a/pkgs/applications/networking/cluster/terraform/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/default.nix
@ -72,7 +72,7 @@ let
    in withPlugins (_: []);

  plugins = import ./providers { inherit stdenv lib buildGoPackage fetchFromGitHub; };
-in {
+in rec {
  terraform_0_8_5 = generic {
    version = "0.8.5";
    sha256 = "1cxwv3652fpsbm2zk1akw356cd7w7vhny1623ighgbz9ha8gvg09";
@ -97,10 +97,14 @@ in {
    passthru = { inherit plugins; };
  });

+  terraform_0_10-full = terraform_0_10.withPlugins lib.attrValues;
+
  terraform_0_11 = pluggable (generic {
    version = "0.11.1";
    sha256 = "04qyhlif3b3kjs3m6c3mx45sgr5r13x55aic638zzlrhbpmqiih1";
    patches = [ ./provider-path.patch ];
    passthru = { inherit plugins; };
  });
+
+  terraform_0_11-full = terraform_0_11.withPlugins lib.attrValues;
 }
--- a/pkgs/applications/networking/cluster/terraform/providers/data.nix
+++ b/pkgs/applications/networking/cluster/terraform/providers/data.nix
@ -4,8 +4,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-alicloud";
-      version = "1.2.0";
-      sha256  = "0v3ji83igjf3b7lp8525j42jxwlvbxws1d7q72v20xlnbyz03h3x";
+      version = "1.5.0";
+      sha256  = "14wrp6szg9mh8bxqqjbx0i654lciw09wghm8h3c6x79ayxan5n8x";
    };
  archive =
    {
@ -32,13 +32,13 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-aws";
-      version = "1.5.0";
-      sha256  = "1c1mkb3299ahf3w58zkk7ilkasflwj2n1kqgddaylqqfcjykblyj";
+      version = "1.6.0";
+      sha256  = "0x4lrpq00z5ww8awym7p6kwrf17ghai36zj8hr10n4qraf8a9ma6";
    };
-  azure =
+  azure-classic =
    {
      owner   = "terraform-providers";
-      repo    = "terraform-provider-azure";
+      repo    = "terraform-provider-azure-classic";
      version = "0.1.1";
      sha256  = "11myqq3wnxvpysjycvwg7b14ll8d9vkn06xb3r26kmc42fkl5xv1";
    };
@ -95,8 +95,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-cloudstack";
-      version = "0.1.1";
-      sha256  = "09iqxpc5a6938qj1js2y9s4dcgk7hw69xga56ixpbbknms2yrhnb";
+      version = "0.1.4";
+      sha256  = "1dj6zkwv0bix31b8sjad9gil43m8c2c5d1dr10qza40f9z4agaxa";
    };
  cobbler =
    {
@ -116,8 +116,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-datadog";
-      version = "1.0.1";
-      sha256  = "1a5acwxqwasckkyj9h33kgn1cmnmn14x4fg19kz742zwfyjmncwj";
+      version = "1.0.3";
+      sha256  = "0nh2dww3hx6jrkcd9lq5hpnqr3grp9cmqi4nwmxlrc5azf8x0mii";
    };
  digitalocean =
    {
@ -172,8 +172,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-fastly";
-      version = "0.1.2";
-      sha256  = "1z7nsgqqzvily9rxr79yjv6jfx56896c9lxb8flmzwjz6b6mvnz7";
+      version = "0.1.3";
+      sha256  = "0q331j91c1kns01yhvbxrq0vf21653ch6fvkzlx61337az7jhky8";
    };
  github =
    {
@ -207,15 +207,15 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-heroku";
-      version = "0.1.1";
-      sha256  = "0i5pdb05qkd6h9zyr88ppsiii6g6zjc5096xblizvmiww7mp81gn";
+      version = "0.1.2";
+      sha256  = "0dmq5v4bwzndy6l6vx29m5ykn2zhnnbmnla00ad8i7djm1sj1fbg";
    };
  http =
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-http";
-      version = "1.0.0";
-      sha256  = "1lks997sxfydm6a9s6vfyljs3j1r7qpg1k1s5ilpg5ckv77nad6g";
+      version = "1.0.1";
+      sha256  = "1bnqrx4xya3lm5wp4byy6npazll6w1g6bv4rawgncswsgx08zqng";
    };
  icinga2 =
    {
@ -256,8 +256,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-local";
-      version = "1.0.0";
-      sha256  = "1dxdpmai8f0g1gj6khgv769lhg6ssfmgqskg4c5qf1jnv8yn8mkd";
+      version = "1.1.0";
+      sha256  = "1qxfyyg8k43rw0gny4dadamc2a9hk3x6ybdivifjc17m7il0janc";
    };
  logentries =
    {
@ -284,8 +284,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-mysql";
-      version = "1.0.0";
-      sha256  = "1vkr1gg9adrkzlbdy0w0wn1ap5zla1k54kxfmd5jndw4hzgysi82";
+      version = "1.0.1";
+      sha256  = "07lm1la9llp52gfs5wf6kq5rjys9lmd3hl7x5821vz54rakzic6n";
    };
  newrelic =
    {
@ -319,15 +319,15 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-oneandone";
-      version = "0.1.0";
-      sha256  = "18bbpcprjib4d4skjdr76xjxi9091h5b3dls68y6bxkk6sh6av1i";
+      version = "1.0.0";
+      sha256  = "0q14r36iyn1c1wfky42imkzvkys5znj1yzq27iaxnrsqp4hh7pl2";
    };
  opc =
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-opc";
-      version = "0.1.3";
-      sha256  = "00h531pikjrmra2sr24lnx2z0dvycshd0qpz3wa733mkvvm47p07";
+      version = "1.0.1";
+      sha256  = "0r8xczb1vy1h6ka97x7x025d030m7d01r52bbmf2z9sh81hhsa1x";
    };
  openstack =
    {
@ -354,8 +354,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-ovh";
-      version = "0.1.0";
-      sha256  = "052bnfw146h9nh3cw77clwwxbmw1gvaich2yw39v4b1ca8brm5dr";
+      version = "0.2.0";
+      sha256  = "12dpgx0fpmqw64v5a70fihbgixyw71bdjbdi17gal7s2pj1xw159";
    };
  packet =
    {
@ -389,8 +389,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-profitbricks";
-      version = "1.0.0";
-      sha256  = "15j66mm7mkwblwncb5s0xbcz7jz99mzswhppzxchwkbk3325syyx";
+      version = "1.0.1";
+      sha256  = "02blr487pbp7myw2l6nib9g1a8vplk9khakxaj9wbg779vp8wvcg";
    };
  rabbitmq =
    {
@ -403,8 +403,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-rancher";
-      version = "1.1.1";
-      sha256  = "1gs62yd31kywg2yhnikli1khai1n0lwy8pb3g7k5ad8ibffjskmz";
+      version = "1.2.0";
+      sha256  = "0xxff4mh4cv27mignvanhsz5sf5476ljk7q4h67fy4y0gzyxwpzw";
    };
  random =
    {
@ -473,8 +473,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-triton";
-      version = "0.3.0";
-      sha256  = "0x8cws41mpxcwd4hf380gizhdnnfs2df5pwcc417sbp2706cai1h";
+      version = "0.4.1";
+      sha256  = "09zljia422afm565d3qm57j5y1n12h52bgyqz6s1s8dmcdygd75g";
    };
  ultradns =
    {
--- a/pkgs/applications/networking/cluster/terraform/providers/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/providers/default.nix
@ -14,8 +14,8 @@ let
    };

  maybeDrv = name: data:
-    # vsphere is currently broken
-    if name == "vsphere" then null
+    # azure-classic is an archived repo
+    if name == "azure-classic" then null
    else toDrv data;
 in
  lib.mapAttrs maybeDrv list
--- a/pkgs/applications/networking/dropbox/default.nix
+++ b/pkgs/applications/networking/dropbox/default.nix
@ -7,7 +7,7 @@ assert lib.elem stdenv.system platforms;
 # Dropbox client to bootstrap installation.
 # The client is self-updating, so the actual version may be newer.
 let
-  version = "38.4.27";
+  version = "40.4.46";

  arch = {
    "x86_64-linux" = "x86_64";
--- a/pkgs/applications/networking/gns3/default.nix
+++ b/pkgs/applications/networking/gns3/default.nix
@ -1,8 +1,8 @@
 { callPackage, stdenv }:

 let
-  stableVersion = "2.1.1";
-  previewVersion = "2.1.1";
+  stableVersion = "2.1.2";
+  previewVersion = "2.1.2";
  addVersion = args:
    let version = if args.stable then stableVersion else previewVersion;
        branch = if args.stable then "stable" else "preview";
@ -12,19 +12,19 @@ let
 in {
  guiStable = mkGui {
    stable = true;
-    sha256Hash = "1iyp5k8z3y32rv8wq268dk92vms5vhhhijxphwvfndh743jaynyk";
+    sha256Hash = "1p3z1dlank0nzj5yyap2n2gv1xa66x9iqi4q7vvy0xcxbqzmqszk";
  };
  guiPreview = mkGui {
    stable = false;
-    sha256Hash = "1iyp5k8z3y32rv8wq268dk92vms5vhhhijxphwvfndh743jaynyk";
+    sha256Hash = "1p3z1dlank0nzj5yyap2n2gv1xa66x9iqi4q7vvy0xcxbqzmqszk";
  };

  serverStable = mkServer {
    stable = true;
-    sha256Hash = "0d427p1g7misbryrn3yagpgxcjwiim39g11zzisw2744l116p7pv";
+    sha256Hash = "0nd7j33ns94hh65b9j0m177b7h25slpny74ga8qppghvv2iqsbp8";
  };
  serverPreview = mkServer {
    stable = false;
-    sha256Hash = "0d427p1g7misbryrn3yagpgxcjwiim39g11zzisw2744l116p7pv";
+    sha256Hash = "0nd7j33ns94hh65b9j0m177b7h25slpny74ga8qppghvv2iqsbp8";
  };
 }
--- a/pkgs/applications/networking/instant-messengers/bitlbee-discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/bitlbee-discord/default.nix
@ -0,0 +1,30 @@
+{ fetchFromGitHub, stdenv, bitlbee, autoreconfHook, pkgconfig, glib }:
+
+with stdenv.lib;
+stdenv.mkDerivation rec {
+  name = "bitlbee-discord-2017-12-27";
+
+  src = fetchFromGitHub {
+    rev = "6a03db169ad44fee55609ecd16e19f3c0f99a182";
+    owner = "sm00th";
+    repo = "bitlbee-discord";
+    sha256 = "1ci9a12c6zg8d6i9f95pq6dal79cp4klmmsyj8ag2gin90kl3x95";
+  };
+
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  buildInputs = [ bitlbee glib ];
+
+  preConfigure = ''
+    export BITLBEE_PLUGINDIR=$out/lib/bitlbee
+    ./autogen.sh
+  '';
+
+  meta = {
+    description = "Bitlbee plugin for Discord";
+
+    homepage = https://github.com/sm00th/bitlbee-discord;
+    license = licenses.gpl2Plus;
+    maintainers = [ maintainers.lassulus ];
+    platforms = stdenv.lib.platforms.linux;
+  };
+}
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@ -7,17 +7,18 @@
 stdenv.mkDerivation rec {

    pname = "discord";
-    version = "0.0.3";
+    version = "0.0.4";
    name = "${pname}-${version}";

    src = fetchurl {
        url = "https://cdn.discordapp.com/apps/linux/${version}/${pname}-${version}.tar.gz";
-        sha256 = "1yxxy9q75zlgk1b4winw4zy9yxk5pn8x4camh52n6v3mw6gq0bfh";
+        sha256 = "1alw9rkv1vv0s1w33hd9ab1cgj7iqd7ad9kvn1d55gyki28f8qlb";
    };

    nativeBuildInputs = [ makeWrapper ];

    libPath = stdenv.lib.makeLibraryPath [
+        libcxx systemd libpulseaudio
        stdenv.cc.cc alsaLib atk cairo cups dbus expat fontconfig freetype
        gdk_pixbuf glib gnome2.GConf gtk2 libnotify libX11 libXcomposite
        libXcursor libXdamage libXext libXfixes libXi libXrandr libXrender
@ -28,15 +29,12 @@ stdenv.mkDerivation rec {
        mkdir -p $out/{bin,opt/discord,share/pixmaps}
        mv * $out/opt/discord

-        # Copying how adobe-reader does it,
-        # see pkgs/applications/misc/adobe-reader/builder.sh
-        patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-                 --set-rpath "$out/opt/discord:$libPath"                                   \
+        patchelf --set-interpreter ${stdenv.cc.bintools.dynamicLinker} \
                 $out/opt/discord/Discord

        paxmark m $out/opt/discord/Discord

-        wrapProgram $out/opt/discord/Discord --prefix LD_LIBRARY_PATH : "$LD_LIBRARY_PATH:${libcxx}/lib:${systemd.lib}/lib:${libpulseaudio}/lib"
+        wrapProgram $out/opt/discord/Discord --prefix LD_LIBRARY_PATH : ${libPath}

        ln -s $out/opt/discord/Discord $out/bin/
        ln -s $out/opt/discord/discord.png $out/share/pixmaps
--- a/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
+++ b/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
@ -6,7 +6,7 @@ let

  # Please keep the version x.y.0.z and do not update to x.y.76.z because the
  # source of the latter disappears much faster.
-  version = "8.11.0.4";
+  version = "8.13.0.2";

  rpath = stdenv.lib.makeLibraryPath [
    alsaLib
@ -57,7 +57,7 @@ let
    if stdenv.system == "x86_64-linux" then
      fetchurl {
        url = "https://repo.skype.com/deb/pool/main/s/skypeforlinux/skypeforlinux_${version}_amd64.deb";
-        sha256 = "1chwc4rqcwwim03n6nski5dar33bb1gnadbvcjg6gln3xqr0ipib";
+        sha256 = "15p1v6y8fwx9qj3ag645bvrcw7c1j20v63iy75s4xwsv1siz8cf9";
      }
    else
      throw "Skype for linux is not supported on ${stdenv.system}";
--- a/pkgs/applications/networking/mailreaders/inboxer/default.nix
+++ b/pkgs/applications/networking/mailreaders/inboxer/default.nix
@ -0,0 +1,84 @@
+{ stdenv, fetchurl, binutils, patchelf, makeWrapper, expat, xorg, gdk_pixbuf, glib, gnome2, cairo, atk, freetype, fontconfig, dbus, nss, nspr, gtk2-x11, alsaLib, cups, libpulseaudio, libudev }:
+
+stdenv.mkDerivation rec {
+  name = "inboxer-${version}";
+  version = "1.0.0";
+
+  meta = with stdenv.lib; {
+    description = "Unofficial, free and open-source Google Inbox Desktop App";
+    homepage    = "https://denysdovhan.com/inboxer";
+    maintainers = [ maintainers.mgttlinger ];
+    license     = licenses.mit;
+    platforms   = [ "x86_64-linux" ];
+  };
+
+  src = fetchurl {
+    url = "https://github.com/denysdovhan/inboxer/releases/download/v${version}/inboxer_${version}_amd64.deb";
+    sha256 = "01384fi5vrfqpznk9389nf3bwpi2zjbnkg84g6z1css8f3gp5i1c";
+  };
+
+  unpackPhase = ''
+    ar p $src data.tar.xz | tar xJ
+  '';
+  buildInputs = [ binutils patchelf makeWrapper ];
+
+  preFixup = with stdenv.lib; let
+    lpath = makeLibraryPath [
+      alsaLib
+      atk
+      cairo
+      cups
+      dbus
+      nss
+      nspr
+      freetype
+      fontconfig
+      gtk2-x11
+      xorg.libX11
+      xorg.libXcursor
+      xorg.libXdamage
+      xorg.libXi
+      xorg.libXext
+      xorg.libXfixes
+      xorg.libXrandr
+      xorg.libXrender
+      xorg.libXcomposite
+      xorg.libXtst
+      xorg.libXScrnSaver
+      xorg.libxcb
+      gdk_pixbuf
+      glib
+      gnome2.pango
+      gnome2.GConf
+      expat
+      stdenv.cc.cc.lib
+      libpulseaudio
+      libudev
+    ];
+  in ''
+    patchelf \
+      --set-rpath "$out/opt/Inboxer:${lpath}" \
+      $out/opt/Inboxer/libnode.so
+    patchelf \
+      --set-rpath "$out/opt/Inboxer:${lpath}" \
+      $out/opt/Inboxer/libffmpeg.so
+   
+    patchelf \
+      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      --set-rpath "$out/opt/Inboxer:${lpath}" \
+      $out/opt/Inboxer/inboxer
+
+    wrapProgram $out/opt/Inboxer/inboxer --set LD_LIBRARY_PATH "${xorg.libxkbfile}/lib:${lpath}"
+  '';
+  
+  installPhase = ''
+    mkdir -p $out/bin
+    cp -R usr/share opt $out/
+    # fix the path in the desktop file
+    substituteInPlace \
+      $out/share/applications/inboxer.desktop \
+      --replace /opt/ $out/opt/
+    # symlink the binary to bin/
+    ln -s $out/opt/Inboxer/inboxer $out/bin/inboxer
+  '';
+}
--- a/pkgs/applications/networking/mailreaders/mblaze/default.nix
+++ b/pkgs/applications/networking/mailreaders/mblaze/default.nix
@ -1,14 +1,16 @@
-{ stdenv, fetchFromGitHub }:
+{ stdenv, fetchFromGitHub, libiconv }:

 stdenv.mkDerivation rec {
  name = "mblaze-${version}";
-  version = "0.2";
+  version = "0.3";
+
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ libiconv ];

  src = fetchFromGitHub {
    owner = "chneukirchen";
    repo = "mblaze";
    rev = "v${version}";
-    sha256 = "0p97zfl35ilrnrx9ynj82igsb698m9klikfaicw5jhjpf6qp2n3y";
+    sha256 = "1jrn81rvw6qanlfppc12dkvpbmidzrq1lx3rfhvcsna55k3gjyw9";
  };

  makeFlags = "PREFIX=$(out)";
--- a/pkgs/applications/networking/mailreaders/notbit/default.nix
+++ b/pkgs/applications/networking/mailreaders/notbit/default.nix
@ -0,0 +1,29 @@
+{ stdenv, fetchFromGitHub, autoreconfHook, pkgconfig,
+  gettext, openssl
+}:
+
+with stdenv.lib;
+
+stdenv.mkDerivation rec {
+  name = "notbit-${version}";
+  version = "2018-01-09";
+
+  src = fetchFromGitHub {
+    owner  = "bpeel";
+    repo   = "notbit";
+    rev    = "8b5d3d2da8ce54abae2536b4d97641d2c798cff3";
+    sha256 = "1623n0lvx42mamvb2vwin5i38hh0nxpxzmkr5188ss2x7m20lmii";
+  };
+
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+
+  buildInputs = [ openssl gettext ];
+
+  meta = {
+    description = "A minimal Bitmessage client";
+    homepage = https://github.com/bpeel/notbit;
+    license = licenses.mit;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ mog ];
+  };
+}
--- a/pkgs/applications/networking/mailreaders/notmuch/default.nix
+++ b/pkgs/applications/networking/mailreaders/notmuch/default.nix
@ -12,7 +12,7 @@
 with stdenv.lib;

 stdenv.mkDerivation rec {
-  version = "0.25.3";
+  version = "0.26";
  name = "notmuch-${version}";

  passthru = {
@ -22,7 +22,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "http://notmuchmail.org/releases/${name}.tar.gz";
-    sha256 = "1fyx20rjpwbf2j1v5fpa5s0rjnwhcgvijzh2qyinp8rlbh1qxmab";
+    sha256 = "1pvn1n7giv8n3xlazi3wpscdqhd2yak0fgv68aj23myr5bnr9s6k";
  };

  nativeBuildInputs = [ pkgconfig ];
@ -46,9 +46,8 @@ stdenv.mkDerivation rec {
        "{}" ";"

    for src in \
-      crypto.c \
-      notmuch-config.c \
-      emacs/notmuch-crypto.el
+      util/crypto.c \
+      notmuch-config.c
    do
      substituteInPlace "$src" \
        --replace \"gpg\" \"${gnupg}/bin/gpg\"
@ -97,7 +96,7 @@ stdenv.mkDerivation rec {
    description = "Mail indexer";
    homepage    = https://notmuchmail.org/;
    license     = licenses.gpl3;
-    maintainers = with maintainers; [ chaoflow garbas the-kenny ];
+    maintainers = with maintainers; [ chaoflow flokli garbas the-kenny ];
    platforms   = platforms.unix;
  };
 }
--- a/pkgs/applications/networking/mailreaders/sylpheed/default.nix
+++ b/pkgs/applications/networking/mailreaders/sylpheed/default.nix
@ -1,38 +1,36 @@
-{ stdenv, fetchurl, pkgconfig, gtk2
-, openssl ? null
-, gpgme ? null
-, sslSupport ? true
-, gpgSupport ? true
-}:
+{ stdenv, fetchurl, pkgconfig, gtk2, openssl ? null, gpgme ? null
+, gpgSupport ? true, sslSupport ? true }:
+
+assert gpgSupport -> gpgme != null;
+assert sslSupport -> openssl != null;

 with stdenv.lib;

-assert sslSupport -> openssl != null;
-assert gpgSupport -> gpgme != null;
-
 stdenv.mkDerivation rec {
  name = "sylpheed-${version}";
-  version = "3.5.1";
+  version = "3.6.0";

  src = fetchurl {
-    url = "http://sylpheed.sraoss.jp/sylpheed/v3.5/${name}.tar.bz2";
-    sha256 = "11qhbfyvi5hxv1f448zgbzgrdjj3a4mxj2bfpk6k4bqf7ahh8nis";
+    url = "http://sylpheed.sraoss.jp/sylpheed/v3.6/${name}.tar.bz2";
+    sha256 = "0idk9nz3d200l2bxc38vnxlx0wcslrvncy9lk50vz7dl8c5sg97b";
  };

  nativeBuildInputs = [ pkgconfig ];
-  buildInputs =
-    [ gtk2 ]
-    ++ optional sslSupport openssl
-    ++ optional gpgSupport gpgme;

-  configureFlags = optional sslSupport "--enable-ssl"
-                ++ optional gpgSupport "--enable-gpgme";
+  buildInputs = [ gtk2 ]
+    ++ optionals gpgSupport [ gpgme ]
+    ++ optionals sslSupport [ openssl ];
+
+  configureFlags = [
+    (optional gpgSupport "--enable-gpgme")
+    (optional sslSupport "--enable-ssl")
+  ];

  meta = {
    homepage = http://sylpheed.sraoss.jp/en/;
-    description = "A lightweight and user-friendly e-mail client";
-    maintainers = [ maintainers.eelco ];
+    description = "Lightweight and user-friendly e-mail client";
+    maintainers = with maintainers; [ eelco ];
    platforms = platforms.linux ++ platforms.darwin;
-    license = "GPL";
+    license = licenses.gpl2;
  };
 }
--- a/pkgs/applications/networking/mumble/default.nix
+++ b/pkgs/applications/networking/mumble/default.nix
@ -119,14 +119,14 @@ let
  };

  gitSource = rec {
-    version = "2017-05-25";
+    version = "2018-01-12";
    qtVersion = 5;

    # Needs submodules
    src = fetchgit {
      url = "https://github.com/mumble-voip/mumble";
-      rev = "3754898ac94ed3f1e86408114917d1b4c06f17b3";
-      sha256 = "1qh49x3y7m0c0h0gcs6amkf8nb75p6g611zwn19mbplwmi7h9y8f";
+      rev = "e348e47f4af68eaa8e0f87d1d9fc28c5583e421e";
+      sha256 = "12z41qfaq6w3i4wcw8pvyb8wwwa8gs3ar5zx6aqx6yssc6513lr3";
    };
  };
 in {
--- a/pkgs/applications/networking/owncloud-client/default.nix
+++ b/pkgs/applications/networking/owncloud-client/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name = "owncloud-client-${version}";
-  version = "2.3.3";
+  version = "2.3.4";

  src = fetchurl {
    url = "https://download.owncloud.com/desktop/stable/owncloudclient-${version}.tar.xz";
-    sha256 = "1r5ddln1wc9iyjizgqb104i0r6qhzsmm2wdnxfaif119cv0vphda";
+    sha256 = "1fpi1mlp2b8sx2993b4mava5c6qw794dmlayih430299z1l9wh49";
  };

  patches = [ ../nextcloud-client/find-sql.patch ];
--- a/pkgs/applications/networking/syncthing/default.nix
+++ b/pkgs/applications/networking/syncthing/default.nix
@ -1,14 +1,14 @@
 { stdenv, lib, fetchFromGitHub, go, procps, removeReferencesTo }:

 stdenv.mkDerivation rec {
-  version = "0.14.42";
+  version = "0.14.43";
  name = "syncthing-${version}";

  src = fetchFromGitHub {
    owner  = "syncthing";
    repo   = "syncthing";
    rev    = "v${version}";
-    sha256 = "1n3favv94wj1fr7x9av523fgm12b0kjlrmifa25wg2p6z10vwbqf";
+    sha256 = "1n09zmp9dqrl3y0fa0l1gx6f09j9mm3xdf7b58y03znspsg7mxhi";
  };

  buildInputs = [ go removeReferencesTo ];
--- a/pkgs/applications/science/electronics/bitscope/common.nix
+++ b/pkgs/applications/science/electronics/bitscope/common.nix
@ -9,7 +9,7 @@
 , makeWrapper
 , pango
 , stdenv
-, writeScriptBin
+, writeTextFile
 , xorg
 }:

@ -60,8 +60,11 @@ let
      ${(wrapBinary libs) attrs.toolName}
    '';
  });
+  fhs = target: buildFHSUserEnv {
+    inherit (pkg) name;
+    runScript = target;
+  };
 in buildFHSUserEnv {
  name = attrs.toolName;
-  meta = pkg.meta;
  runScript = "${pkg.outPath}/bin/${attrs.toolName}";
-}
+} // { inherit (pkg) meta name; }
--- a/pkgs/applications/science/electronics/bitscope/packages.nix
+++ b/pkgs/applications/science/electronics/bitscope/packages.nix
@ -88,7 +88,7 @@ in {

    meta = {
      description = "Mixed signal logic timing and serial protocol analysis software for BitScope";
-      home = "http://bitscope.com/software/logic/";
+      homepage = "http://bitscope.com/software/logic/";
    };

    src = fetchurl {
--- a/pkgs/applications/science/electronics/librepcb/default.nix
+++ b/pkgs/applications/science/electronics/librepcb/default.nix
@ -0,0 +1,33 @@
+{ stdenv, fetchFromGitHub, qtbase, qttools, qmake, mesa, openssl, zlib }:
+
+stdenv.mkDerivation rec {
+  name = "librepcb-${version}";
+  version = "20171229";
+
+  src = fetchFromGitHub {
+    owner = "LibrePCB";
+    repo = "LibrePCB";
+    fetchSubmodules = true;
+    rev = "4efb06fa42755abc5e606da4669cc17e8de2f8c6";
+    sha256 = "0r33fm1djqpy0dzvnf5gv2dfh5nj2acaxb7w4cn8yxdgrazjf7ak";
+  };
+
+  enableParallelBuilding = true;
+
+  nativeBuildInputs = [ qmake qttools ];
+
+  buildInputs = [ qtbase ];
+
+	# LibrePCB still supports QT below 5.9. But some code lines break the build, so they are removed by this patch so that the software builds.
+  patches = [ ./fix-2017-12.patch ];
+
+  qmakeFlags = ["-r"];
+
+  meta = with stdenv.lib; {
+    description = "A free EDA software to develop printed circuit boards";
+    homepage = http://librepcb.org/;
+    maintainers = with maintainers; [ luz ];
+    license = licenses.gpl3;
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/science/electronics/librepcb/fix-2017-12.patch
+++ b/pkgs/applications/science/electronics/librepcb/fix-2017-12.patch
@ -0,0 +1,29 @@
+--- a/libs/librepcb/common/fileio/serializableobjectlist.h
+++ b/libs/librepcb/common/fileio/serializableobjectlist.h
+@@ -374,26 +374,6 @@
+ } // namespace librepcb
+
+ /*****************************************************************************************
+- * Prevent from using SerializableObjectList in a foreach loop because it always would
+- * create a deep copy of the list! You should use C++11 range based for loops instead.
+- ****************************************************************************************/
+-
+-#if (QT_VERSION > QT_VERSION_CHECK(5, 9, 0))
+-#define QFOREACHCONTAINER_TEMPLATE QtPrivate::QForeachContainer
+-#else
+-#define QFOREACHCONTAINER_TEMPLATE QForeachContainer
+-#endif
+-
+-template <typename T, typename P>
+-class QFOREACHCONTAINER_TEMPLATE<librepcb::SerializableObjectList<T, P>> { public:
+-    ~QForeachContainer() = delete;
+-};
+-template <typename T, typename P>
+-class QFOREACHCONTAINER_TEMPLATE<const librepcb::SerializableObjectList<T, P>> { public:
+-    ~QForeachContainer() = delete;
+-};
+-
+-/*****************************************************************************************
+  *  End of File
+  ****************************************************************************************/
+
--- a/pkgs/applications/science/logic/symbiyosys/default.nix
+++ b/pkgs/applications/science/logic/symbiyosys/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  name = "symbiyosys-${version}";
-  version = "2017.12.06";
+  version = "2018.01.10";

  src = fetchFromGitHub {
    owner  = "cliffordwolf";
    repo   = "symbiyosys";
-    rev    = "82f394260a74b07892d7f5bdec10ae0a8cad6caa";
-    sha256 = "0cniqxaf2m5xh7hqwcpdvwcxg7vqargzahbkzdfwafkdsqpb0ly3";
+    rev    = "25936009bbc2cffd289c607ddf42a578527aa59c";
+    sha256 = "06idd8vbn4s2k6bja4f6lxjc4qwgbak2fhfxj8f18ki1xb3yqfh6";
  };

  buildInputs = [ python3 yosys ];
--- a/pkgs/applications/science/logic/why3/default.nix
+++ b/pkgs/applications/science/logic/why3/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name    = "why3-${version}";
-  version = "0.88.1";
+  version = "0.88.3";

  src = fetchurl {
-    url    = https://gforge.inria.fr/frs/download.php/file/37185/why3-0.88.1.tar.gz;
-    sha256 = "1qj00963si0vdrqjp79ai27g9rr8sqvly6n6nwpga6bnss98xqkw";
+    url    = https://gforge.inria.fr/frs/download.php/file/37313/why3-0.88.3.tar.gz;
+    sha256 = "0limdqy9l5bjzwhdalcfdyh0b6laxgiphhvr4bby9p0030agssiy";
  };

  buildInputs = (with ocamlPackages; [
--- a/pkgs/applications/science/math/giac/default.nix
+++ b/pkgs/applications/science/math/giac/default.nix
@ -29,7 +29,10 @@ stdenv.mkDerivation rec {
  # perl is only needed for patchShebangs fixup.
  buildInputs = [
    gmp mpfr pari ntl gsl blas mpfi liblapackWithAtlas
-    readline gettext libpng libao gfortran perl
+    readline gettext libpng libao perl
+    # gfortran.cc default output contains static libraries compiled without -fPIC
+    # we want libgfortran.so.3 instead
+    (stdenv.lib.getLib gfortran.cc)
  ] ++ stdenv.lib.optionals enableGUI [
    mesa fltk xorg.libX11
  ];
--- a/pkgs/applications/science/misc/cytoscape/default.nix
+++ b/pkgs/applications/science/misc/cytoscape/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name = "cytoscape-${version}";
-  version = "3.5.1";
+  version = "3.6.0";

  src = fetchurl {
    url = "http://chianti.ucsd.edu/${name}/${name}.tar.gz";
-    sha256 = "1dvv0f7sc7q7lwmpd7xkcx86dd8lxh2il3wiwkij44gh7ni1qkfm";
+    sha256 = "13q8caksbzi6j7xy8v5f0pi6766yfawys6jcm50ng78mnhrv2v97";
  };

  buildInputs = [jre makeWrapper];
--- a/pkgs/applications/science/misc/gephi/default.nix
+++ b/pkgs/applications/science/misc/gephi/default.nix
@ -2,13 +2,13 @@

 with stdenv.lib;

-let version = "0.9.1"; in
+let version = "0.9.2"; in
 stdenv.mkDerivation {
  name = "gephi-${version}";

  src = fetchurl {
    url = "https://github.com/gephi/gephi/releases/download/v${version}/gephi-${version}-linux.tar.gz";
-    sha256 = "f1d54157302df05a53b94e1518880c949c43ba4ab21e52d57f3edcbdaa06c7ee";
+    sha256 = "1wr3rka8j2y10nnwbg27iaxkbrp4d7d07ccs9n94yqv6wqawj5z8";
  };

  meta = {
--- a/pkgs/applications/science/robotics/qgroundcontrol/default.nix
+++ b/pkgs/applications/science/robotics/qgroundcontrol/default.nix
@ -1,13 +1,13 @@
-{ stdenv, fetchgit, git,  espeak, SDL, udev, doxygen, cmake
+{ stdenv, fetchgit, git,  espeak, SDL2, udev, doxygen, cmake
 , qtbase, qtlocation, qtserialport, qtdeclarative, qtconnectivity, qtxmlpatterns
 , qtsvg, qtquick1, qtquickcontrols, qtgraphicaleffects, qmake
 , makeWrapper, lndir
 , gst_all_1, qt-gstreamer1, pkgconfig, glibc
-, version ? "2.9.4"
 }:

 stdenv.mkDerivation rec {
  name = "qgroundcontrol-${version}";
+  version = "3.2.7";

  qtInputs = [
    qtbase qtlocation qtserialport qtdeclarative qtconnectivity qtxmlpatterns qtsvg
@ -19,72 +19,54 @@ stdenv.mkDerivation rec {
  ];

  enableParallelBuilding = true;
-  buildInputs = [ SDL udev doxygen git ] ++ gstInputs ++ qtInputs;
+  buildInputs = [ SDL2 udev doxygen git ] ++ gstInputs ++ qtInputs;
  nativeBuildInputs = [ pkgconfig makeWrapper qmake ];

-  patches = [ ./0001-fix-gcc-cmath-namespace-issues.patch ];
-  postPatch = ''
-    sed '1i#include <cmath>' -i src/Vehicle/Vehicle.cc \
-      -i src/comm/{QGCFlightGearLink,QGCJSBSimLink}.cc \
-      -i src/{uas/UAS,ui/QGCDataPlot2D}.cc
-  '';
-
  preConfigure = ''
    mkdir build
    cd build
  '';

-  qmakeFlags = [ "../qgroundcontrol.pro" ];
+  qmakeFlags = [
+    # Default install tries to copy Qt files into package
+    "CONFIG+=QGC_DISABLE_BUILD_SETUP"
+    "../qgroundcontrol.pro"
+  ];

  installPhase = ''
    cd ..
+
    mkdir -p $out/share/applications
-    cp -v qgroundcontrol.desktop $out/share/applications
-    
+    cp -v deploy/qgroundcontrol.desktop $out/share/applications
+
    mkdir -p $out/bin
-    cp -v build/release/qgroundcontrol "$out/bin/"
-    
+    cp -v build/release/QGroundControl "$out/bin/"
+
    mkdir -p $out/share/qgroundcontrol
    cp -rv resources/ $out/share/qgroundcontrol
-    
+
    mkdir -p $out/share/pixmaps
    cp -v resources/icons/qgroundcontrol.png $out/share/pixmaps
-
-    # we need to link to our Qt deps in our own output if we want
-    # this package to work without being installed as a system pkg
-    mkdir -p $out/lib/qt-$qtCompatVersion $out/etc/xdg
-    for pkg in $qtInputs; do
-      if [[ -d $pkg/lib/qt-$qtCompatVersion ]]; then
-        for dir in lib/qt-$qtCompatVersion share etc/xdg; do
-          if [[ -d $pkg/$dir ]]; then
-            ${lndir}/bin/lndir "$pkg/$dir" "$out/$dir"
-          fi
-        done
-      fi
-    done
  '';

-
  postInstall = ''
    wrapProgram "$out/bin/qgroundcontrol" \
      --prefix GST_PLUGIN_SYSTEM_PATH : "$GST_PLUGIN_SYSTEM_PATH"
  '';
-  

  # TODO: package mavlink so we can build from a normal source tarball
  src = fetchgit {
    url = "https://github.com/mavlink/qgroundcontrol.git";
    rev = "refs/tags/v${version}";
-    sha256 = "0isr0zamhvr853c94lblazkilil6zzmvf7afs3mxgn07jn9wrqz3";
+    sha256 = "1sla3sgj2p3h87d7kcaj53f8z5xzyadvsqlqzgh4d2n1f7sikdc5";
    fetchSubmodules = true;
  };

-  meta = {
+  meta = with stdenv.lib; {
    description = "Provides full ground station support and configuration for the PX4 and APM Flight Stacks";
    homepage = http://qgroundcontrol.org/;
-    license = stdenv.lib.licenses.gpl3Plus;
-    platforms = with stdenv.lib.platforms; linux;
-    maintainers = with stdenv.lib.maintainers; [ pxc ];
-    broken = true; # relies improperly on private Qt 5.5 headers
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ pxc ];
  };
 }
--- a/pkgs/applications/version-management/mercurial/default.nix
+++ b/pkgs/applications/version-management/mercurial/default.nix
@ -34,9 +34,9 @@ in python2Packages.buildPythonApplication {
      hgk=$out/lib/${python.libPrefix}/site-packages/hgext/hgk.py
      EOF
      # setting HG so that hgk can be run itself as well (not only hg view)
-      WRAP_TK=" --set TK_LIBRARY \"${tk}/lib/${tk.libPrefix}\"
-                --set HG \"$out/bin/hg\"
-                --prefix PATH : \"${tk}/bin\" "
+      WRAP_TK=" --set TK_LIBRARY ${tk}/lib/${tk.libPrefix}
+                --set HG $out/bin/hg
+                --prefix PATH : ${tk}/bin "
    '') +
    ''
      for i in $(cd $out/bin && ls); do
--- a/Show More
+++ b/Show More