Merge branch 'master' into staging

2024-12-04 12:53:05 +00:00 · 2017-10-20 18:12:41 +02:00 · 2017-10-20 18:12:41 +02:00 · eef0d0971c
commit eef0d0971c
parent 0e339ca7a5 6991438df9
60 changed files with 2103 additions and 981 deletions
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@ -35,9 +35,8 @@ pkgs/applications/science/math/R @peti
 pkgs/development/r-modules       @peti

 # Darwin-related
-pkgs/stdenv/darwin/*    @copumpkin @LnL7
-pkgs/os-specific/darwin/*       @LnL7
-pkgs/os-specific/darwin/apple-source-releases/* @copumpkin
+/pkgs/stdenv/darwin/             @org/darwin-maintainers
+/pkgs/os-specific/darwin/        @org/darwin-maintainers

 # Beam-related (Erlang, Elixir, LFE, etc)
 pkgs/development/beam-modules/*	@gleber
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -99,6 +99,7 @@
  ./programs/ssh.nix
  ./programs/ssmtp.nix
  ./programs/sysdig.nix
+  ./programs/sway.nix
  ./programs/thefuck.nix
  ./programs/tmux.nix
  ./programs/venus.nix
@ -296,6 +297,7 @@
  ./services/misc/fstrim.nix
  ./services/misc/gammu-smsd.nix
  ./services/misc/geoip-updater.nix
+  ./services/misc/gitea.nix
  #./services/misc/gitit.nix
  ./services/misc/gitlab.nix
  ./services/misc/gitolite.nix
@ -343,6 +345,7 @@
  ./services/misc/svnserve.nix
  ./services/misc/synergy.nix
  ./services/misc/taskserver
+  ./services/misc/tzupdate.nix
  ./services/misc/uhub.nix
  ./services/misc/zookeeper.nix
  ./services/monitoring/apcupsd.nix
--- a/nixos/modules/programs/sway.nix
+++ b/nixos/modules/programs/sway.nix
@ -0,0 +1,19 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+{
+  options.programs.sway.enable = mkEnableOption "sway";
+
+  config = mkIf config.programs.sway.enable {
+    environment.systemPackages = [ pkgs.sway pkgs.xwayland ];
+    security.wrappers.sway = {
+      source = "${pkgs.sway}/bin/sway";
+      capabilities = "cap_sys_ptrace,cap_sys_tty_config=eip";
+      owner = "root";
+      group = "sway";
+      permissions = "u+rx,g+rx";
+    };
+
+    users.extraGroups.sway = {};
+  };
+}
--- a/nixos/modules/services/continuous-integration/jenkins/default.nix
+++ b/nixos/modules/services/continuous-integration/jenkins/default.nix
@ -78,6 +78,13 @@ in {
        '';
      };

+      package = mkOption {
+        default = pkgs.jenkins;
+        defaultText = "pkgs.jenkins";
+        type = types.package;
+        description = "Jenkins package to use.";
+      };
+
      packages = mkOption {
        default = [ pkgs.stdenv pkgs.git pkgs.jdk config.programs.ssh.package pkgs.nix ];
        defaultText = "[ pkgs.stdenv pkgs.git pkgs.jdk config.programs.ssh.package pkgs.nix ]";
@ -194,7 +201,7 @@ in {
        '';

      script = ''
-        ${pkgs.jdk}/bin/java ${concatStringsSep " " cfg.extraJavaOptions} -jar ${pkgs.jenkins}/webapps/jenkins.war --httpListenAddress=${cfg.listenAddress} \
+        ${pkgs.jdk}/bin/java ${concatStringsSep " " cfg.extraJavaOptions} -jar ${cfg.package}/webapps/jenkins.war --httpListenAddress=${cfg.listenAddress} \
                                                  --httpPort=${toString cfg.port} \
                                                  --prefix=${cfg.prefix} \
                                                  ${concatStringsSep " " cfg.extraOptions}
--- a/nixos/modules/services/misc/gitea.nix
+++ b/nixos/modules/services/misc/gitea.nix
@ -0,0 +1,270 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.gitea;
+  configFile = pkgs.writeText "app.ini" ''
+    APP_NAME = ${cfg.appName}
+    RUN_USER = ${cfg.user}
+    RUN_MODE = prod
+
+    [database]
+    DB_TYPE = ${cfg.database.type}
+    HOST = ${cfg.database.host}:${toString cfg.database.port}
+    NAME = ${cfg.database.name}
+    USER = ${cfg.database.user}
+    PASSWD = #dbpass#
+    PATH = ${cfg.database.path}
+
+    [repository]
+    ROOT = ${cfg.repositoryRoot}
+
+    [server]
+    DOMAIN = ${cfg.domain}
+    HTTP_ADDR = ${cfg.httpAddress}
+    HTTP_PORT = ${toString cfg.httpPort}
+    ROOT_URL = ${cfg.rootUrl}
+    STATIC_ROOT_PATH = ${cfg.staticRootPath}
+
+    [session]
+    COOKIE_NAME = session
+    COOKIE_SECURE = ${boolToString cfg.cookieSecure}
+
+    [security]
+    SECRET_KEY = #secretkey#
+    INSTALL_LOCK = true
+
+    ${cfg.extraConfig}
+  '';
+in
+
+{
+  options = {
+    services.gitea = {
+      enable = mkOption {
+        default = false;
+        type = types.bool;
+        description = "Enable Gitea Service.";
+      };
+
+      useWizard = mkOption {
+        default = false;
+        type = types.bool;
+        description = "Do not generate a configuration and use gitea' installation wizard instead. The first registered user will be administrator.";
+      };
+
+      stateDir = mkOption {
+        default = "/var/lib/gitea";
+        type = types.str;
+        description = "gitea data directory.";
+      };
+
+      user = mkOption {
+        type = types.str;
+        default = "gitea";
+        description = "User account under which gitea runs.";
+      };
+
+      database = {
+        type = mkOption {
+          type = types.enum [ "sqlite3" "mysql" "postgres" ];
+          example = "mysql";
+          default = "sqlite3";
+          description = "Database engine to use.";
+        };
+
+        host = mkOption {
+          type = types.str;
+          default = "127.0.0.1";
+          description = "Database host address.";
+        };
+
+        port = mkOption {
+          type = types.int;
+          default = 3306;
+          description = "Database host port.";
+        };
+
+        name = mkOption {
+          type = types.str;
+          default = "gitea";
+          description = "Database name.";
+        };
+
+        user = mkOption {
+          type = types.str;
+          default = "gitea";
+          description = "Database user.";
+        };
+
+        password = mkOption {
+          type = types.str;
+          default = "";
+          description = ''
+            The password corresponding to <option>database.user</option>.
+            Warning: this is stored in cleartext in the Nix store!
+            Use <option>database.passwordFile</option> instead.
+          '';
+        };
+
+        passwordFile = mkOption {
+          type = types.nullOr types.path;
+          default = null;
+          example = "/run/keys/gitea-dbpassword";
+          description = ''
+            A file containing the password corresponding to
+            <option>database.user</option>.
+          '';
+        };
+
+        path = mkOption {
+          type = types.str;
+          default = "${cfg.stateDir}/data/gitea.db";
+          description = "Path to the sqlite3 database file.";
+        };
+      };
+
+      appName = mkOption {
+        type = types.str;
+        default = "gitea: Gitea Service";
+        description = "Application name.";
+      };
+
+      repositoryRoot = mkOption {
+        type = types.str;
+        default = "${cfg.stateDir}/repositories";
+        description = "Path to the git repositories.";
+      };
+
+      domain = mkOption {
+        type = types.str;
+        default = "localhost";
+        description = "Domain name of your server.";
+      };
+
+      rootUrl = mkOption {
+        type = types.str;
+        default = "http://localhost:3000/";
+        description = "Full public URL of gitea server.";
+      };
+
+      httpAddress = mkOption {
+        type = types.str;
+        default = "0.0.0.0";
+        description = "HTTP listen address.";
+      };
+
+      httpPort = mkOption {
+        type = types.int;
+        default = 3000;
+        description = "HTTP listen port.";
+      };
+
+      cookieSecure = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Marks session cookies as "secure" as a hint for browsers to only send
+          them via HTTPS. This option is recommend, if gitea is being served over HTTPS.
+        '';
+      };
+
+      staticRootPath = mkOption {
+        type = types.str;
+        default = "${pkgs.gitea.data}";
+        example = "/var/lib/gitea/data";
+        description = "Upper level of template and static files path.";
+      };
+
+      extraConfig = mkOption {
+        type = types.str;
+        default = "";
+        description = "Configuration lines appended to the generated gitea configuration file.";
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+
+    systemd.services.gitea = {
+      description = "gitea";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      path = [ pkgs.gitea.bin ];
+
+      preStart = let
+        runConfig = "${cfg.stateDir}/custom/conf/app.ini";
+        secretKey = "${cfg.stateDir}/custom/conf/secret_key";
+      in ''
+        mkdir -p ${cfg.stateDir}
+
+        # copy custom configuration and generate a random secret key if needed
+        ${optionalString (cfg.useWizard == false) ''
+          mkdir -p ${cfg.stateDir}/custom/conf
+          cp -f ${configFile} ${runConfig}
+
+          if [ ! -e ${secretKey} ]; then
+              head -c 16 /dev/urandom | base64 > ${secretKey}
+          fi
+
+          KEY=$(head -n1 ${secretKey})
+          DBPASS=$(head -n1 ${cfg.database.passwordFile})
+          sed -e "s,#secretkey#,$KEY,g" \
+              -e "s,#dbpass#,$DBPASS,g" \
+              -i ${runConfig}
+          chmod 640 ${runConfig} ${secretKey}
+        ''}
+
+        mkdir -p ${cfg.repositoryRoot}
+        # update all hooks' binary paths
+        HOOKS=$(find ${cfg.repositoryRoot} -mindepth 4 -maxdepth 4 -type f -wholename "*git/hooks/*")
+        if [ "$HOOKS" ]
+        then
+          sed -ri 's,/nix/store/[a-z0-9.-]+/bin/gitea,${pkgs.gitea.bin}/bin/gitea,g' $HOOKS
+          sed -ri 's,/nix/store/[a-z0-9.-]+/bin/env,${pkgs.coreutils}/bin/env,g' $HOOKS
+          sed -ri 's,/nix/store/[a-z0-9.-]+/bin/bash,${pkgs.bash}/bin/bash,g' $HOOKS
+          sed -ri 's,/nix/store/[a-z0-9.-]+/bin/perl,${pkgs.perl}/bin/perl,g' $HOOKS
+        fi
+        if [ ! -d ${cfg.stateDir}/conf/locale ]
+        then
+          mkdir -p ${cfg.stateDir}/conf
+          cp -r ${pkgs.gitea.out}/locale ${cfg.stateDir}/conf/locale
+        fi
+      '';
+
+      serviceConfig = {
+        Type = "simple";
+        User = cfg.user;
+        WorkingDirectory = cfg.stateDir;
+        ExecStart = "${pkgs.gitea.bin}/bin/gitea web";
+        Restart = "always";
+      };
+
+      environment = {
+        USER = cfg.user;
+        HOME = cfg.stateDir;
+        GITEA_WORK_DIR = cfg.stateDir;
+      };
+    };
+
+    users = mkIf (cfg.user == "gitea") {
+      extraUsers.gitea = {
+        description = "Gitea Service";
+        home = cfg.stateDir;
+        createHome = true;
+      };
+    };
+
+    warnings = optional (cfg.database.password != "")
+      ''config.services.gitea.database.password will be stored as plaintext
+        in the Nix store. Use database.passwordFile instead.'';
+
+    # Create database passwordFile default when password is configured.
+    services.gitea.database.passwordFile =
+      (mkDefault (toString (pkgs.writeTextFile {
+        name = "gitea-database-password";
+        text = cfg.database.password;
+      })));
+  };
+}
--- a/nixos/modules/services/misc/tzupdate.nix
+++ b/nixos/modules/services/misc/tzupdate.nix
@ -0,0 +1,45 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.tzupdate;
+in {
+  options.services.tzupdate = {
+    enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Enable the tzupdate timezone updating service. This provides
+        a one-shot service which can be activated with systemctl to 
+        update the timezone.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    # We need to have imperative time zone management for this to work.
+    # This will give users an error if they have set an explicit time
+    # zone, which is better than silently overriding it.
+    time.timeZone = null; 
+
+    # We provide a one-shot service which can be manually run. We could
+    # provide a service that runs on startup, but it's tricky to get
+    # a service to run after you have *internet* access.
+    systemd.services.tzupdate = {
+      description = "tzupdate timezone update service";
+      wants = [ "network-online.target" ];
+      after = [ "network-online.target" ];
+
+      serviceConfig = {
+        Type = "oneshot";
+        # We could link directly into pkgs.tzdata, but at least timedatectl seems
+        # to expect the symlink to point directly to a file in etc.
+        # Setting the "debian timezone file" to point at /dev/null stops it doing anything.
+        ExecStart = "${pkgs.tzupdate}/bin/tzupdate -z /etc/zoneinfo -d /dev/null";
+      };
+    };
+  };
+
+  meta.maintainers = [ maintainers.michaelpj ];
+}
--- a/nixos/modules/services/x11/compton.nix
+++ b/nixos/modules/services/x11/compton.nix
@ -7,12 +7,15 @@ let

  cfg = config.services.compton;

-  configFile = let
-    opacityRules = optionalString (length cfg.opacityRules != 0)
-      (concatStringsSep "\n"
-        (map (a: "opacity-rule = [ \"${a}\" ];") cfg.opacityRules)
-      );
-  in pkgs.writeText "compton.conf"
+  floatBetween = a: b: with lib; with types;
+    addCheck str (x: versionAtLeast x a && versionOlder x b);
+
+  pairOf = x: with types; addCheck (listOf x) (y: lib.length y == 2);
+
+  opacityRules = optionalString (length cfg.opacityRules != 0)
+    (concatMapStringsSep ",\n" (rule: ''"${rule}"'') cfg.opacityRules);
+
+  configFile = pkgs.writeText "compton.conf"
    (optionalString cfg.fade ''
      # fading
      fading = true;
@ -36,7 +39,9 @@ let
      inactive-opacity = ${cfg.inactiveOpacity};
      menu-opacity     = ${cfg.menuOpacity};

-      ${opacityRules}
+      opacity-rule = [
+        ${opacityRules}
+      ];

      # other options
      backend = ${toJSON cfg.backend};
@ -64,7 +69,7 @@ in {
    };

    fadeDelta = mkOption {
-      type = types.int;
+      type = types.addCheck types.int (x: x > 0);
      default = 10;
      example = 5;
      description = ''
@ -73,11 +78,12 @@ in {
    };

    fadeSteps = mkOption {
-      type = types.listOf types.str;
+      type = pairOf (floatBetween "0.01" "1.01");
      default = [ "0.028" "0.03" ];
      example = [ "0.04" "0.04" ];
      description = ''
        Opacity change between fade steps (in and out).
+        (numbers in range 0.01 - 1.0)
      '';
    };

@ -104,7 +110,7 @@ in {
    };

    shadowOffsets = mkOption {
-      type = types.listOf types.int;
+      type = pairOf types.int;
      default = [ (-15) (-15) ];
      example = [ (-10) (-15) ];
      description = ''
@ -113,11 +119,11 @@ in {
    };

    shadowOpacity = mkOption {
-      type = types.str;
+      type = floatBetween "0.0" "1.01";
      default = "0.75";
      example = "0.8";
      description = ''
-        Window shadows opacity (number in range 0 - 1).
+        Window shadows opacity (number in range 0.0 - 1.0).
      '';
    };

@ -136,60 +142,67 @@ in {
    };

    activeOpacity = mkOption {
-      type = types.str;
+      type = floatBetween "0.0" "1.01";
      default = "1.0";
      example = "0.8";
      description = ''
-        Opacity of active windows.
+        Opacity of active windows (number in range 0.0 - 1.0).
      '';
    };

    inactiveOpacity = mkOption {
-      type = types.str;
+      type = floatBetween "0.1" "1.01";
      default = "1.0";
      example = "0.8";
      description = ''
-        Opacity of inactive windows.
+        Opacity of inactive windows (number in range 0.1 - 1.0).
      '';
    };

    menuOpacity = mkOption {
-      type = types.str;
+      type = floatBetween "0.0" "1.01";
      default = "1.0";
      example = "0.8";
      description = ''
-        Opacity of dropdown and popup menu.
+        Opacity of dropdown and popup menu (number in range 0.0 - 1.0).
      '';
    };

    opacityRules = mkOption {
      type = types.listOf types.str;
      default = [];
+      example = [
+        "95:class_g = 'URxvt' && !_NET_WM_STATE@:32a"
+        "0:_NET_WM_STATE@:32a *= '_NET_WM_STATE_HIDDEN'"
+      ];
      description = ''
-        Opacity rules to be handled by compton.
+        Rules that control the opacity of windows, in format PERCENT:PATTERN.
      '';
    };

    backend = mkOption {
-      type = types.str;
-      default = "glx";
+      type = types.enum [ "glx" "xrender" ];
+      default = "xrender";
      description = ''
        Backend to use: <literal>glx</literal> or <literal>xrender</literal>.
      '';
    };

    vSync = mkOption {
-     type = types.str;
-     default = "none";
-     example = "opengl-swc";
-     description = ''
-       Enable vertical synchronization using the specified method.
-       See <literal>compton(1)</literal> man page available methods.
-     '';
+      type = types.enum [
+        "none" "drm" "opengl"
+        "opengl-oml" "opengl-swc" "opengl-mswc"
+      ];
+      default = "none";
+      example = "opengl-swc";
+      description = ''
+        Enable vertical synchronization using the specified method.
+        See <literal>compton(1)</literal> man page an explanation.
+      '';
    };

    refreshRate = mkOption {
-      type = types.int;
+      type = types.addCheck types.int (x: x >= 0);
      default = 0;
      example = 60;
      description = ''
--- a/nixos/modules/services/x11/desktop-managers/plasma5.nix
+++ b/nixos/modules/services/x11/desktop-managers/plasma5.nix
@ -47,7 +47,7 @@ in
            ${getBin config.hardware.pulseaudio.package}/bin/pactl load-module module-device-manager "do_routing=1"
          ''}

-          exec "${plasma5.startkde}"
+          exec "${getBin plasma5.plasma-workspace}/bin/startkde"
        '';
      };

--- a/pkgs/applications/editors/android-studio/packages.nix
+++ b/pkgs/applications/editors/android-studio/packages.nix
@ -27,9 +27,9 @@ in rec {

  preview = mkStudio rec {
    pname = "android-studio-preview";
-    version = "3.0.0.16"; # "Android Studio 3.0 RC 1"
-    build = "171.4392136";
-    sha256Hash = "13zaqbbl7bqhiwh0ybbxkfv0h90qsfpa7sim778n2j32jjvdcby5";
+    version = "3.0.0.17"; # "Android Studio 3.0 RC 2"
+    build = "171.4402976";
+    sha256Hash = "18f5cq1dcmyjxaq520kqjac332bpp35pis02yplh6gzp65i4bvvf";

    meta = stable.meta // {
      description = "The Official IDE for Android (preview version)";
--- a/pkgs/applications/misc/bitcoinarmory/default.nix
+++ b/pkgs/applications/misc/bitcoinarmory/default.nix
@ -7,9 +7,9 @@ let

  version = "0.96.1";
  sitePackages = pythonPackages.python.sitePackages;
-  inherit (pythonPackages) mkPythonDerivation pyqt4 psutil twisted;
+  inherit (pythonPackages) buildPythonApplication pyqt4 psutil twisted;

-in mkPythonDerivation {
+in buildPythonApplication {

  name = "bitcoinarmory-${version}";

@ -21,6 +21,8 @@ in mkPythonDerivation {
    sha256 = "0pjk5qx16n3kvs9py62666qkwp2awkgd87by4karbj7vk6p1l14h"; fetchSubmodules = true;
  };

+  format = "other";
+
  # FIXME bitcoind doesn't die on shutdown. Need some sort of patch to fix that.
  #patches = [ ./shutdown-fix.patch ];

--- a/pkgs/applications/misc/electrum/default.nix
+++ b/pkgs/applications/misc/electrum/default.nix
@ -13,6 +13,7 @@ python2Packages.buildPythonApplication rec {
    dns
    ecdsa
    jsonrpclib
+    matplotlib
    pbkdf2
    protobuf
    pyaes
@ -30,7 +31,6 @@ python2Packages.buildPythonApplication rec {
    # TODO plugins
    # amodem
    # btchip
-    # matplotlib
  ];

  preBuild = ''
--- a/pkgs/applications/misc/tzupdate/default.nix
+++ b/pkgs/applications/misc/tzupdate/default.nix
@ -0,0 +1,24 @@
+{ stdenv, python }:
+
+let
+  inherit (python.pkgs) buildPythonApplication fetchPypi requests;
+in
+buildPythonApplication rec {
+  name = "${pname}-${version}";
+  pname = "tzupdate";
+  version = "1.2.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1wj2r1wirnn5kllaasdldimvp3cc3w7w890iqrjksz5wwjbnj8pk";
+  };
+
+  propagatedBuildInputs = [ requests ];
+
+  meta = with stdenv.lib; {
+    description = "Update timezone information based on geoip.";
+    homepage = https://github.com/cdown/tzupdate;
+    maintainers = [ maintainers.michaelpj ];
+    license = licenses.unlicense;
+  };
+}
--- a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
+++ b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
@ -98,7 +98,7 @@ let
  fteLibPath = makeLibraryPath [ stdenv.cc.cc gmp ];

  # Upstream source
-  version = "7.0.6";
+  version = "7.0.7";

  lang = "en-US";

@ -108,7 +108,7 @@ let
        "https://github.com/TheTorProject/gettorbrowser/releases/download/v${version}/tor-browser-linux64-${version}_${lang}.tar.xz"
        "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz"
      ];
-      sha256 = "11z3r0577p78ifi9lk4lrh9wb46k77wy77g5p9l8il02760bgq6m";
+      sha256 = "1848j28majbb61r080g6dw0lmh7hbp515iidyjdrpgcwhazzg06j";
    };

    "i686-linux" = fetchurl {
@ -116,7 +116,7 @@ let
        "https://github.com/TheTorProject/gettorbrowser/releases/download/v${version}/tor-browser-linux32-${version}_${lang}.tar.xz"
        "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux32-${version}_${lang}.tar.xz"
      ];
-      sha256 = "1r8v5w66clmm76kzpkf0f5jcxs76whb5xrl20rkirp79fybqn4hx";
+      sha256 = "08wvpymmyg16ifz23awnjy0pbva8xh1fdx2i8c1n18x3k12d5r7h";
    };
  };
 in
@ -246,6 +246,11 @@ stdenv.mkDerivation rec {
    # having to synchronize between local state and store.
    mv TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js defaults/pref/torbrowser.js

+    # Preload extensions by moving into the runtime instead of storing under the
+    # user's profile directory.
+    mv "$TBB_IN_STORE/TorBrowser/Data/Browser/profile.default/extensions/"* \
+      "$TBB_IN_STORE/browser/extensions"
+
    # Hard-code paths to geoip data files.  TBB resolves the geoip files
    # relative to torrc-defaults_path but if we do not hard-code them
    # here, these paths end up being written to the torrc in the user's
@ -301,10 +306,6 @@ stdenv.mkDerivation rec {
    # easily generated by firefox at startup.
    rm -f "\$HOME/TorBrowser/Data/Browser/profile.default"/{compatibility.ini,extensions.ini,extensions.json}

-    # Ensure that we're always using the up-to-date extensions.
-    ln -snf "$TBB_IN_STORE/TorBrowser/Data/Browser/profile.default/extensions" \
-      "\$HOME/TorBrowser/Data/Browser/profile.default/extensions"
-
    ${optionalString pulseaudioSupport ''
      # Figure out some envvars for pulseaudio
      : "\''${XDG_RUNTIME_DIR:=/run/user/\$(id -u)}"
--- a/pkgs/applications/science/misc/root/ROOT-8728-extra.patch
+++ b/pkgs/applications/science/misc/root/ROOT-8728-extra.patch
@ -1,175 +0,0 @@
-diff --git a/core/metacling/src/TCling.cxx b/core/metacling/src/TCling.cxx
-index d71cb74..076facb 100644
--- a/core/metacling/src/TCling.cxx
-+++ b/core/metacling/src/TCling.cxx
-@@ -756,7 +756,7 @@ int TCling_GenerateDictionary(const std::vector<std::string> &classes,
-                gSystem->PrependPathName(dirbase, header);
-                dir = gSystem->DirName(dir);
-             }
-            fileContent += TString("#include \"") + header + "\"\n";
-+            fileContent += (TString("#include \"") + header + "\"\n").Data();
-          }
-       }
-       for (it = fwdDecls.begin(); it != fwdDecls.end(); ++it) {
-@@ -1061,7 +1061,7 @@ TCling::TCling(const char *name, const char *title)
-       ROOT::TMetaUtils::SetPathsForRelocatability(clingArgsStorage);
- 
-       // Add -I early so ASTReader can find the headers.
-      std::string interpInclude(TROOT::GetEtcDir());
-+      std::string interpInclude(TROOT::GetEtcDir().Data());
-       clingArgsStorage.push_back("-I" + interpInclude);
- 
-       // Add include path to etc/cling. FIXME: This is a short term solution. The
-@@ -1070,7 +1070,7 @@ TCling::TCling(const char *name, const char *title)
-       clingArgsStorage.push_back("-I" + interpInclude + "/cling");
- 
-       // Add the root include directory and etc/ to list searched by default.
-      clingArgsStorage.push_back(std::string("-I" + TROOT::GetIncludeDir()));
-+      clingArgsStorage.push_back(std::string(("-I" + TROOT::GetIncludeDir()).Data()));
- 
-       // Add the current path to the include path
-       // TCling::AddIncludePath(".");
-diff --git a/hist/hist/src/TFormula.cxx b/hist/hist/src/TFormula.cxx
-index abf3929..e7dad98 100644
--- a/hist/hist/src/TFormula.cxx
-+++ b/hist/hist/src/TFormula.cxx
-@@ -1677,7 +1677,7 @@ void TFormula::ProcessFormula(TString &formula)
-          if(fun.fName.Contains("::")) // add support for nested namespaces
-          {
-             // look for last occurence of "::"
-            std::string name(fun.fName);
-+            std::string name(fun.fName.Data());
-             size_t index = name.rfind("::");
-             assert(index != std::string::npos);
-             TString className = fun.fName(0,fun.fName(0,index).Length());
-@@ -1869,7 +1869,7 @@ void TFormula::ProcessFormula(TString &formula)
- 
-          // save copy of inputFormula in a std::strig for the unordered map
-          // and also formula is same as FClingInput typically and it will be modified
-         std::string inputFormula = std::string(formula);
-+         std::string inputFormula = std::string(formula.Data());
- 
- 
-          // valid input formula - try to put into Cling
-diff --git a/main/src/nbmain.cxx b/main/src/nbmain.cxx
-index 55d4f2f..8490149 100644
--- a/main/src/nbmain.cxx
-+++ b/main/src/nbmain.cxx
-@@ -173,9 +173,9 @@ static bool CreateStamp(string dest)
- 
- int main()
- {
-   string rootbin(TROOT::GetBinDir());
-   string rootlib(TROOT::GetLibDir());
-   string rootetc(TROOT::GetEtcDir());
-+   string rootbin(TROOT::GetBinDir().Data());
-+   string rootlib(TROOT::GetLibDir().Data());
-+   string rootetc(TROOT::GetEtcDir().Data());
- 
-    // If needed, install ROOT notebook files in the user's home directory
- #ifdef WIN32
-diff --git a/math/minuit/src/TMinuitMinimizer.cxx b/math/minuit/src/TMinuitMinimizer.cxx
-index 4e2082a..18215c0 100644
--- a/math/minuit/src/TMinuitMinimizer.cxx
-+++ b/math/minuit/src/TMinuitMinimizer.cxx
-@@ -454,7 +454,7 @@ std::string TMinuitMinimizer::VariableName(unsigned int ivar) const {
-    // return the variable name
-    if (!CheckMinuitInstance()) return std::string();
-    if (!CheckVarIndex(ivar)) return std::string();
-   return std::string(fMinuit->fCpnam[ivar]);
-+   return std::string(fMinuit->fCpnam[ivar].Data());
- }
- 
- int TMinuitMinimizer::VariableIndex(const std::string & ) const {
-diff --git a/tmva/tmva/src/Factory.cxx b/tmva/tmva/src/Factory.cxx
-index 36060ef..a1bbe34 100644
--- a/tmva/tmva/src/Factory.cxx
-+++ b/tmva/tmva/src/Factory.cxx
-@@ -390,7 +390,7 @@ TMVA::MethodBase* TMVA::Factory::BookMethod( TMVA::DataLoader *loader, TString t
-    // initialize methods
-    IMethod* im;
-    if (!boostNum) {
-      im = ClassifierFactory::Instance().Create( std::string(theMethodName),
-+      im = ClassifierFactory::Instance().Create( std::string(theMethodName.Data()),
-                                                  fJobName,
-                                                  methodTitle,
-                                                  loader->DefaultDataSetInfo(),
-@@ -933,7 +933,7 @@ void TMVA::Factory::TrainAllMethods()
- 
-        // recreate
-        m = dynamic_cast<MethodBase*>( ClassifierFactory::Instance()
-                   .Create( std::string(Types::Instance().GetMethodName(methodType)),
-+                   .Create( std::string(Types::Instance().GetMethodName(methodType).Data()),
-                       dataSetInfo, weightfile ) );
-        if( m->GetMethodType() == Types::kCategory ){
-       MethodCategory *methCat = (dynamic_cast<MethodCategory*>(m));
-diff --git a/tmva/tmva/src/MethodBoost.cxx b/tmva/tmva/src/MethodBoost.cxx
-index 1349e5d..2125ab3 100644
--- a/tmva/tmva/src/MethodBoost.cxx
-+++ b/tmva/tmva/src/MethodBoost.cxx
-@@ -389,7 +389,7 @@ void TMVA::MethodBoost::Train()
-       // the first classifier shows the option string output, the rest not
-       if (fCurrentMethodIdx>0) TMVA::MsgLogger::InhibitOutput();
- 
-      IMethod* method = ClassifierFactory::Instance().Create(std::string(fBoostedMethodName),
-+      IMethod* method = ClassifierFactory::Instance().Create(std::string(fBoostedMethodName.Data()),
-                                                              GetJobName(),
-                                                              Form("%s_B%04i", fBoostedMethodTitle.Data(),fCurrentMethodIdx),
-                                                              DataInfo(),
-diff --git a/tmva/tmva/src/MethodCategory.cxx b/tmva/tmva/src/MethodCategory.cxx
-index c2cbe80..d278cca 100644
--- a/tmva/tmva/src/MethodCategory.cxx
-+++ b/tmva/tmva/src/MethodCategory.cxx
-@@ -147,7 +147,7 @@ TMVA::IMethod* TMVA::MethodCategory::AddMethod( const TCut& theCut,
-                                                 const TString& theTitle,
-                                                 const TString& theOptions )
- {
-   std::string addedMethodName = std::string(Types::Instance().GetMethodName(theMethod));
-+   std::string addedMethodName = std::string(Types::Instance().GetMethodName(theMethod).Data());
- 
-    Log() << kINFO << "Adding sub-classifier: " << addedMethodName << "::" << theTitle << Endl;
- 
-diff --git a/tmva/tmva/src/MethodCompositeBase.cxx b/tmva/tmva/src/MethodCompositeBase.cxx
-index 98fa5da..96bd9a3 100644
--- a/tmva/tmva/src/MethodCompositeBase.cxx
-+++ b/tmva/tmva/src/MethodCompositeBase.cxx
-@@ -194,7 +194,7 @@ void TMVA::MethodCompositeBase::ReadWeightsFromXML( void* wghtnode )
-          ((TMVA::MethodBoost*)this)->BookMethod( Types::Instance().GetMethodType( methodTypeName), methodName,  optionString );
-       }
-       fMethods.push_back(ClassifierFactory::Instance().Create(
-                                                              std::string(methodTypeName),jobName, methodName,DataInfo(),optionString));
-+                                                              std::string(methodTypeName.Data()),jobName, methodName,DataInfo(),optionString));
- 
-       fMethodWeight.push_back(methodWeight);
-       MethodBase* meth = dynamic_cast<MethodBase*>(fMethods.back());
-@@ -259,7 +259,7 @@ void  TMVA::MethodCompositeBase::ReadWeightsFromStream( std::istream& istr )
-             ((TMVA::MethodBoost*)this)->BookMethod( Types::Instance().GetMethodType( methodName), methodTitle,  optionString );
-       }
-       else methodTitle=Form("%s (%04i)",GetMethodName().Data(),fCurrentMethodIdx);
-      fMethods.push_back(ClassifierFactory::Instance().Create( std::string(methodName), jobName,
-+      fMethods.push_back(ClassifierFactory::Instance().Create( std::string(methodName.Data()), jobName,
-                                                                methodTitle,DataInfo(), optionString) );
-       fMethodWeight.push_back( methodWeight );
-       if(MethodBase* m = dynamic_cast<MethodBase*>(fMethods.back()) )
-diff --git a/tmva/tmva/src/Reader.cxx b/tmva/tmva/src/Reader.cxx
-index 94a8b28..0b67867 100644
--- a/tmva/tmva/src/Reader.cxx
-+++ b/tmva/tmva/src/Reader.cxx
-@@ -401,7 +401,7 @@ TMVA::IMethod* TMVA::Reader::BookMVA( const TString& methodTag, const TString& w
- 
- TMVA::IMethod* TMVA::Reader::BookMVA( TMVA::Types::EMVA methodType, const TString& weightfile )
- {
-   IMethod* im = ClassifierFactory::Instance().Create(std::string(Types::Instance().GetMethodName( methodType )),
-+   IMethod* im = ClassifierFactory::Instance().Create(std::string(Types::Instance().GetMethodName( methodType ).Data()),
-                                                       DataInfo(), weightfile );
- 
-    MethodBase *method = (dynamic_cast<MethodBase*>(im));
-@@ -440,7 +440,7 @@ TMVA::IMethod* TMVA::Reader::BookMVA( TMVA::Types::EMVA methodType, const char*
- #if ROOT_VERSION_CODE >= ROOT_VERSION(5,26,00)
- 
-    // books MVA method from weightfile
-   IMethod* im = ClassifierFactory::Instance().Create(std::string(Types::Instance().GetMethodName( methodType )),
-+   IMethod* im = ClassifierFactory::Instance().Create(std::string(Types::Instance().GetMethodName( methodType ).Data()),
-                                                       DataInfo(), "" );
- 
-    MethodBase *method = (dynamic_cast<MethodBase*>(im));
--- a/pkgs/applications/science/misc/root/default.nix
+++ b/pkgs/applications/science/misc/root/default.nix
@ -1,30 +1,24 @@
 { stdenv, fetchurl, fetchpatch, cmake, pcre, pkgconfig, python2
-, libX11, libXpm, libXft, libXext, mesa, zlib, libxml2, lzma, gsl
+, libX11, libXpm, libXft, libXext, mesa, zlib, libxml2, lz4, lzma, gsl, xxHash
 , Cocoa, OpenGL, noSplash ? false }:

 stdenv.mkDerivation rec {
  name = "root-${version}";
-  version = "6.10.04";
+  version = "6.10.08";

  src = fetchurl {
    url = "https://root.cern.ch/download/root_v${version}.source.tar.gz";
-    sha256 = "0nwg4bw02v6vahm2rwfaj7fzp3ffhjg5jk7h20il4246swhxw6s6";
+    sha256 = "12mddl6pqwwc9nr4jqzp6h1jm4zycazd3v88dz306m1nmk97dlic";
  };

  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ cmake pcre python2 zlib libxml2 lzma gsl ]
+  buildInputs = [ cmake pcre python2 zlib libxml2 lz4 lzma gsl xxHash ]
    ++ stdenv.lib.optionals (!stdenv.isDarwin) [ libX11 libXpm libXft libXext mesa ]
    ++ stdenv.lib.optionals (stdenv.isDarwin) [ Cocoa OpenGL ]
    ;

  patches = [
    ./sw_vers.patch
-
-    # this prevents thisroot.sh from setting $p, which interferes with stdenv setup
-    ./thisroot.patch
-
-    # https://sft.its.cern.ch/jira/browse/ROOT-8728
-    ./ROOT-8728-extra.patch
  ];

  preConfigure = ''
--- a/pkgs/applications/science/misc/root/thisroot.patch
+++ b/pkgs/applications/science/misc/root/thisroot.patch
@ -1,15 +0,0 @@
-diff --git a/config/thisroot.sh b/config/thisroot.sh
-index 85dee20..532cb28 100644
--- a/config/thisroot.sh
-+++ b/config/thisroot.sh
-@@ -15,8 +15,8 @@ drop_from_path()
-       return 1
-    fi
- 
-   p=$1
-   drop=$2
-+   local p=$1
-+   local drop=$2
- 
-    newpath=`echo $p | sed -e "s;:${drop}:;:;g" \
-                           -e "s;:${drop};;g"   \
--- a/pkgs/applications/version-management/gitea/default.nix
+++ b/pkgs/applications/version-management/gitea/default.nix
@ -0,0 +1,50 @@
+{ stdenv, buildGoPackage, fetchFromGitHub, makeWrapper
+, git, coreutils, bash, gzip, openssh
+, sqliteSupport ? true
+}:
+
+with stdenv.lib;
+
+buildGoPackage rec {
+  name = "gitea-${version}";
+  version = "1.2.1";
+
+  src = fetchFromGitHub {
+    owner = "go-gitea";
+    repo = "gitea";
+    rev = "v${version}";
+    sha256 = "15zw4b6hnx4hmzn2xlsi4p7jvh6jx4g4smbdidnrzrykzyq4rmpp";
+  };
+
+  patches = [ ./static-root-path.patch ];
+
+  postPatch = ''
+    patchShebangs .
+    substituteInPlace modules/setting/setting.go --subst-var data
+  '';
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  buildFlags = optionalString sqliteSupport "-tags sqlite";
+
+  outputs = [ "bin" "out" "data" ];
+
+  postInstall = ''
+    mkdir $data
+    cp -R $src/{public,templates} $data
+    mkdir -p $out
+    cp -R $src/options/locale $out/locale
+
+    wrapProgram $bin/bin/gitea \
+      --prefix PATH : ${makeBinPath [ bash git gzip openssh ]}
+  '';
+
+  goPackagePath = "code.gitea.io/gitea";
+
+  meta = {
+    description = "Git with a cup of tea";
+    homepage = http://gitea.io;
+    license = licenses.mit;
+    maintainers = [ maintainers.disassembler ];
+  };
+}
--- a/pkgs/applications/version-management/gitea/static-root-path.patch
+++ b/pkgs/applications/version-management/gitea/static-root-path.patch
@ -0,0 +1,13 @@
+diff --git i/modules/setting/setting.go w/modules/setting/setting.go
+index aafe2d1b..1e4a8064 100644
+--- i/modules/setting/setting.go
+++ w/modules/setting/setting.go
+@@ -683,7 +683,7 @@ func NewContext() {
+ 	LocalURL = sec.Key("LOCAL_ROOT_URL").MustString(defaultLocalURL)
+ 	OfflineMode = sec.Key("OFFLINE_MODE").MustBool()
+ 	DisableRouterLog = sec.Key("DISABLE_ROUTER_LOG").MustBool()
+-	StaticRootPath = sec.Key("STATIC_ROOT_PATH").MustString(workDir)
+	StaticRootPath = sec.Key("STATIC_ROOT_PATH").MustString("@data@")
+ 	AppDataPath = sec.Key("APP_DATA_PATH").MustString("data")
+ 	EnableGzip = sec.Key("ENABLE_GZIP").MustBool()
+ 	EnablePprof = sec.Key("ENABLE_PPROF").MustBool(false)
--- a/pkgs/applications/virtualization/xen/4.5.nix
+++ b/pkgs/applications/virtualization/xen/4.5.nix
@ -1,4 +1,5 @@
 { stdenv, callPackage, fetchurl, fetchpatch, fetchgit
+, ocamlPackages_4_02
 , withInternalQemu ? true
 , withInternalTraditionalQemu ? true
 , withInternalSeabios ? true
@ -414,4 +415,4 @@ callPackage (import ./generic.nix (rec {
      -i tools/libxl/libxl_device.c
  '';

-})) args
+})) ({ ocamlPackages = ocamlPackages_4_02; } // args)
--- a/pkgs/applications/window-managers/sway/default.nix
+++ b/pkgs/applications/window-managers/sway/default.nix
@ -5,17 +5,15 @@
 , libXdmcp
 }:

-let
-  # TODO: Sway 0.14.0 with wlc 0.0.10 segfaults
-  version = "0.13.0";
-in stdenv.mkDerivation rec {
+stdenv.mkDerivation rec {
  name = "sway-${version}";
+  version = "0.14.0";

  src = fetchFromGitHub {
    owner = "Sircmpwn";
    repo = "sway";
    rev = "${version}";
-    sha256 = "1vgk4rl51nx66yzpwg4yhnbj7wc30k5q0hh5lf8y0i1nvpal0p3q";
+    sha256 = "1l8v9cdzd44bm4q71d47vqg6933b8j42q1a61r362vz2la1rcpq2";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/plasma-5/default.nix
+++ b/pkgs/desktops/plasma-5/default.nix
@ -139,7 +139,6 @@ let
      polkit-kde-agent = callPackage ./polkit-kde-agent.nix {};
      powerdevil = callPackage ./powerdevil.nix {};
      sddm-kcm = callPackage ./sddm-kcm.nix {};
-      startkde = callPackage ./startkde {};
      systemsettings = callPackage ./systemsettings.nix {};
    };
 in
--- a/pkgs/desktops/plasma-5/plasma-workspace/default.nix
+++ b/pkgs/desktops/plasma-5/plasma-workspace/default.nix
@ -1,19 +1,23 @@
 {
-  mkDerivation, lib, copyPathsToStore,
+  mkDerivation, lib,

  extra-cmake-modules, kdoctools,

-  isocodes, libdbusmenu, libSM, libXcursor, libXtst, pam, wayland,
+  coreutils, dbus, gnugrep, gnused, isocodes, libdbusmenu, libSM, libXcursor,
+  libXtst, pam, wayland, xmessage, xprop, xrdb, xsetroot,

  baloo, kactivities, kcmutils, kconfig, kcrash, kdbusaddons, kdeclarative,
-  kdelibs4support, kdesu, kglobalaccel, kidletime, kjsembed, knewstuff,
+  kdelibs4support, kdesu, kglobalaccel, kidletime, kinit, kjsembed, knewstuff,
  knotifyconfig, kpackage, krunner, kscreenlocker, ktexteditor, ktextwidgets,
  kwallet, kwayland, kwin, kxmlrpcclient, libkscreen, libksysguard,
  networkmanager-qt, phonon, plasma-framework, prison, solid,

-  qtgraphicaleffects, qtquickcontrols, qtquickcontrols2, qtscript, qtx11extras,
+  qtgraphicaleffects, qtquickcontrols, qtquickcontrols2, qtscript, qttools,
+  qtwayland, qtx11extras,
 }:

+let inherit (lib) getBin getLib; in
+
 mkDerivation {
  name = "plasma-workspace";

@ -27,21 +31,47 @@ mkDerivation {
    kwallet kwayland kwin kxmlrpcclient libkscreen libksysguard
    networkmanager-qt phonon plasma-framework prison solid

-    qtgraphicaleffects qtquickcontrols qtquickcontrols2 qtscript qtx11extras
+    qtgraphicaleffects qtquickcontrols qtquickcontrols2 qtscript qtwayland qtx11extras
  ];
  outputs = [ "out" "dev" "bin" ];

-  patches = copyPathsToStore (lib.readPathsFromFile ./. ./series);
+  cmakeFlags = [
+    "-DNIXPKGS_XMESSAGE=${getBin xmessage}/bin/xmessage"
+    "-DNIXPKGS_MKDIR=${getBin coreutils}/bin/mkdir"
+    "-DNIXPKGS_XRDB=${getBin xrdb}/bin/xrdb"
+    "-DNIXPKGS_QTPATHS=${getBin qttools}/bin/qtpaths"
+    "-DNIXPKGS_XSETROOT=${getBin xsetroot}/bin/xsetroot"
+    "-DNIXPKGS_XPROP=${getBin xprop}/bin/xprop"
+    "-DNIXPKGS_ID=${getBin coreutils}/bin/id"
+    "-DNIXPKGS_DBUS_UPDATE_ACTIVATION_ENVIRONMENT=${getBin dbus}/bin/dbus-update-activation-environment"
+    "-DNIXPKGS_START_KDEINIT_WRAPPER=${getLib kinit}/lib/libexec/kf5/start_kdeinit_wrapper"
+    "-DNIXPKGS_QDBUS=${getBin qttools}/bin/qdbus"
+    "-DNIXPKGS_KWRAPPER5=${getBin kinit}/bin/kwrapper5"
+    "-DNIXPKGS_KREADCONFIG5=${getBin kconfig}/bin/kreadconfig5"
+    "-DNIXPKGS_GREP=${getBin gnugrep}/bin/grep"
+    "-DNIXPKGS_KDEINIT5_SHUTDOWN=${getBin kinit}/bin/kdeinit5_shutdown"
+    "-DNIXPKGS_SED=${getBin gnused}/bin/sed"
+  ];

-  postPatch = ''
-    substituteInPlace startkde/kstartupconfig/kstartupconfig.cpp \
-        --replace kdostartupconfig5 ''${!outputBin}/bin/kdostartupconfig5
+  # To regenerate ./plasma-workspace.patch,
+  #
+  # > git clone https://github.com/ttuegel/plasma-workspace
+  # > cd plasma-workspace
+  # > git checkout nixpkgs/$x.$y  # where $x.$y.$z == $version
+  # ... make some commits ...
+  # > git diff v$x.$y.$z
+  #
+  # Add upstream patches to the list below. For new patchs, particularly if not
+  # submitted upstream, please make a pull request and add it to
+  # ./plasma-workspace.patch.
+  patches = [ ./plasma-workspace.patch ];
+
+  preConfigure = ''
+    NIX_CFLAGS_COMPILE+=" -DNIXPKGS_KDOSTARTUPCONFIG5=\"''${!outputBin}/bin/kdostartupconfig5\""
+    cmakeFlags+=" -DNIXPKGS_STARTPLASMA=''${!outputBin}/lib/libexec/startplasma"
  '';

  postInstall = ''
-    rm "''${!outputBin}/bin/startkde"
-    rm "''${!outputBin}/bin/startplasmacompositor"
-    rm "''${!outputLib}/lib/libexec/startplasma"
-    rm -r "''${!outputBin}/share/wayland-sessions"
+    moveToOutput lib/libexec/startplasma ''${!outputBin}
  '';
 }
--- a/pkgs/desktops/plasma-5/plasma-workspace/plasma-workspace.patch
+++ b/pkgs/desktops/plasma-5/plasma-workspace/plasma-workspace.patch
--- a/pkgs/desktops/plasma-5/plasma-workspace/qml-import-path.patch
+++ b/pkgs/desktops/plasma-5/plasma-workspace/qml-import-path.patch
@ -1,52 +0,0 @@
-Index: plasma-workspace-5.6.3/applets/batterymonitor/package/contents/ui/BatteryItem.qml
-===================================================================
--- plasma-workspace-5.6.3.orig/applets/batterymonitor/package/contents/ui/BatteryItem.qml
-+++ plasma-workspace-5.6.3/applets/batterymonitor/package/contents/ui/BatteryItem.qml
-@@ -26,7 +26,7 @@ import org.kde.plasma.components 2.0 as
- import org.kde.plasma.extras 2.0 as PlasmaExtras
- import org.kde.plasma.workspace.components 2.0
- import org.kde.kcoreaddons 1.0 as KCoreAddons
-import "logic.js" as Logic
-+import "../code/logic.js" as Logic
-
- Item {
-     id: batteryItem
-Index: plasma-workspace-5.6.3/applets/batterymonitor/package/contents/ui/batterymonitor.qml
-===================================================================
--- plasma-workspace-5.6.3.orig/applets/batterymonitor/package/contents/ui/batterymonitor.qml
-+++ plasma-workspace-5.6.3/applets/batterymonitor/package/contents/ui/batterymonitor.qml
-@@ -25,7 +25,7 @@ import org.kde.plasma.plasmoid 2.0
- import org.kde.plasma.core 2.0 as PlasmaCore
- import org.kde.kcoreaddons 1.0 as KCoreAddons
- import org.kde.kquickcontrolsaddons 2.0
-import "logic.js" as Logic
-+import "../code/logic.js" as Logic
-
- Item {
-     id: batterymonitor
-Index: plasma-workspace-5.6.3/applets/lock_logout/contents/ui/lockout.qml
-===================================================================
--- plasma-workspace-5.6.3.orig/applets/lock_logout/contents/ui/lockout.qml
-+++ plasma-workspace-5.6.3/applets/lock_logout/contents/ui/lockout.qml
-@@ -23,7 +23,7 @@ import org.kde.plasma.plasmoid 2.0
- import org.kde.plasma.core 2.0 as PlasmaCore
- import org.kde.plasma.components 2.0
- import org.kde.kquickcontrolsaddons 2.0
-import "data.js" as Data
-+import "../code/data.js" as Data
-
- Flow {
-     id: lockout
-Index: plasma-workspace-5.6.3/applets/notifications/package/contents/ui/main.qml
-===================================================================
--- plasma-workspace-5.6.3.orig/applets/notifications/package/contents/ui/main.qml
-+++ plasma-workspace-5.6.3/applets/notifications/package/contents/ui/main.qml
-@@ -28,7 +28,7 @@ import org.kde.plasma.extras 2.0 as Plas
-
- import org.kde.plasma.private.notifications 1.0
-
-import "uiproperties.js" as UiProperties
-+import "../code/uiproperties.js" as UiProperties
-
- MouseEventListener {
-     id: notificationsApplet
--- a/pkgs/desktops/plasma-5/plasma-workspace/series
+++ b/pkgs/desktops/plasma-5/plasma-workspace/series
@ -1 +0,0 @@
-qml-import-path.patch
--- a/pkgs/desktops/plasma-5/startkde/default.nix
+++ b/pkgs/desktops/plasma-5/startkde/default.nix
@ -1,41 +0,0 @@
-{
-  stdenv, lib, runCommand, substituteAll, dbus, gnugrep, gnused, kconfig,
-  kinit, kservice, plasma-desktop, plasma-workspace, xmessage, xprop, xrdb,
-  xsetroot, qttools,
-}:
-
-let
-
-  inherit (lib) getBin getLib;
-
-  script = substituteAll {
-    src = ./startkde.sh;
-    inherit (stdenv) shell;
-    kbuildsycoca5 = "${getBin kservice}/bin/kbuildsycoca5";
-    sed = "${getBin gnused}/bin/sed";
-    kcheckrunning = "${getBin plasma-workspace}/bin/kcheckrunning";
-    xmessage = "${getBin xmessage}/bin/xmessage";
-    kstartupconfig5 = "${getBin plasma-workspace}/bin/kstartupconfig5";
-    kapplymousetheme = "${getBin plasma-desktop}/bin/kapplymousetheme";
-    xsetroot = "${getBin xsetroot}/bin/xsetroot";
-    xrdb = "${getBin xrdb}/bin/xrdb";
-    ksplashqml = "${getBin plasma-workspace}/bin/ksplashqml";
-    qdbus = "${getBin qttools}/bin/qdbus";
-    xprop = "${getBin xprop}/bin/xprop";
-    qtpaths = "${getBin qttools}/bin/qtpaths";
-    dbus_update_activation_environment = "${getBin dbus}/bin/dbus-update-activation-environment";
-    start_kdeinit_wrapper = "${getLib kinit}/lib/libexec/kf5/start_kdeinit_wrapper";
-    kwrapper5 = "${getBin kinit}/bin/kwrapper5";
-    ksmserver = "${getBin plasma-workspace}/bin/ksmserver";
-    kreadconfig5 = "${getBin kconfig}/bin/kreadconfig5";
-    kdeinit5_shutdown = "${getBin kinit}/bin/kdeinit5_shutdown";
-  };
-
-in
-
-runCommand "startkde.sh"
-{ preferLocalBuild = true; allowSubstitutes = false; }
-''
-  cp ${script} $out
-  chmod +x $out
-''
--- a/pkgs/desktops/plasma-5/startkde/startkde.sh
+++ b/pkgs/desktops/plasma-5/startkde/startkde.sh
@ -1,384 +0,0 @@
-#!@shell@
-
-@kbuildsycoca5@
-
-# Set the default GTK 2 theme
-if ! [ -e $HOME/.gtkrc-2.0 ] \
-     && [ -e /run/current-system/sw/share/themes/Breeze/gtk-2.0/gtkrc ]; then
-    cat >$HOME/.gtkrc-2.0 <<EOF
-# Default GTK+ 2 config for NixOS KDE 5
-include "/run/current-system/sw/share/themes/Breeze/gtk-2.0/gtkrc"
-style "user-font"
-{
-  font_name="Sans Serif Regular"
-}
-widget_class "*" style "user-font"
-gtk-font-name="Sans Serif Regular 10"
-gtk-theme-name="Breeze"
-gtk-icon-theme-name="breeze"
-gtk-fallback-icon-theme="hicolor"
-gtk-cursor-theme-name="breeze_cursors"
-gtk-toolbar-style=GTK_TOOLBAR_ICONS
-gtk-menu-images=1
-gtk-button-images=1
-EOF
-fi
-
-if ! [ -e $HOME/.config/gtk-3.0/settings.ini ] \
-       && [ -e /run/current-system/sw/share/themes/Breeze/gtk-3.0 ]; then
-    mkdir -p $HOME/.config/gtk-3.0
-    cat >$HOME/.config/gtk-3.0/settings.ini <<EOF
-[Settings]
-gtk-font-name=Sans Serif Regular 10
-gtk-theme-name=Breeze
-gtk-icon-theme-name=breeze
-gtk-fallback-icon-theme=hicolor
-gtk-cursor-theme-name=breeze_cursors
-gtk-toolbar-style=GTK_TOOLBAR_ICONS
-gtk-menu-images=1
-gtk-button-images=1
-EOF
-fi
-
-# The KDE icon cache is supposed to update itself
-# automatically, but it uses the timestamp on the icon
-# theme directory as a trigger.  Since in Nix the
-# timestamp is always the same, this doesn't work.  So as
-# a workaround, nuke the icon cache on login.  This isn't
-# perfect, since it may require logging out after
-# installing new applications to update the cache.
-# See http://lists-archives.org/kde-devel/26175-what-when-will-icon-cache-refresh.html
-rm -fv $HOME/.cache/icon-cache.kcache
-
-# Qt writes a weird ‘libraryPath’ line to
-# ~/.config/Trolltech.conf that causes the KDE plugin
-# paths of previous KDE invocations to be searched.
-# Obviously using mismatching KDE libraries is potentially
-# disastrous, so here we nuke references to the Nix store
-# in Trolltech.conf.  A better solution would be to stop
-# Qt from doing this wackiness in the first place.
-if [ -e $HOME/.config/Trolltech.conf ]; then
-    @sed@ -e '/nix\\store\|nix\/store/ d' -i $HOME/.config/Trolltech.conf
-fi
-
-if test "x$1" = x--failsafe; then
-    KDE_FAILSAFE=1 # General failsafe flag
-    KWIN_COMPOSE=N # Disable KWin's compositing
-    QT_XCB_FORCE_SOFTWARE_OPENGL=1
-    export KWIN_COMPOSE KDE_FAILSAFE QT_XCB_FORCE_SOFTWARE_OPENGL
-fi
-
-# When the X server dies we get a HUP signal from xinit. We must ignore it
-# because we still need to do some cleanup.
-trap 'echo GOT SIGHUP' HUP
-
-# we have to unset this for Darwin since it will screw up KDE's dynamic-loading
-unset DYLD_FORCE_FLAT_NAMESPACE
-
-# Check if a KDE session already is running and whether it's possible to connect to X
-@kcheckrunning@
-kcheckrunning_result=$?
-if test $kcheckrunning_result -eq 0 ; then
-    echo "KDE seems to be already running on this display."
-    @xmessage@ -geometry 500x100 "KDE seems to be already running on this display."
-    exit 1
-elif test $kcheckrunning_result -eq 2 ; then
-    echo "\$DISPLAY is not set or cannot connect to the X server."
-    exit 1
-fi
-
-# Boot sequence:
-#
-# kdeinit is used to fork off processes which improves memory usage
-# and startup time.
-#
-# * kdeinit starts klauncher first.
-# * Then kded is started. kded is responsible for keeping the sycoca
-#   database up to date. When an up to date database is present it goes
-#   into the background and the startup continues.
-# * Then kdeinit starts kcminit. kcminit performs initialisation of
-#   certain devices according to the user's settings
-#
-# * Then ksmserver is started which takes control of the rest of the startup sequence
-
-# We need to create config folder so we can write startupconfigkeys
-configDir=$(@qtpaths@ --writable-path GenericConfigLocation)
-mkdir -p "$configDir"
-
-if ! [ -e $configDir/kcminputrc ]; then
-    cat >$configDir/kcminputrc <<EOF
-[Mouse]
-cursorTheme=breeze_cursors
-cursorSize=0
-EOF
-fi
-
-THEME=org.kde.breeze
-#This is basically setting defaults so we can use them with kstartupconfig5
-#We cannot set the equivilant of THEME here as it will generate an
-#invalid variable name (with dots)
-cat >$configDir/startupconfigkeys <<EOF
-kcminputrc Mouse cursorTheme 'breeze_cursors'
-kcminputrc Mouse cursorSize ''
-ksplashrc KSplash Theme ${THEME}.desktop
-ksplashrc KSplash Engine KSplashQML
-kdeglobals KScreen ScreenScaleFactors ''
-kcmfonts General forceFontDPI 0
-kcmfonts General dontChangeAASettings true
-EOF
-
-# preload the user's locale on first start
-plasmalocalerc=$configDir/plasma-localerc
-test -f $plasmalocalerc || {
-cat >$plasmalocalerc <<EOF
-[Formats]
-LANG=$LANG
-EOF
-}
-
-# export LC_* variables set by kcmshell5 formats into environment
-# so it can be picked up by QLocale and friends.
-exportformatssettings=$configDir/plasma-locale-settings.sh
-test -f $exportformatssettings && {
-    . $exportformatssettings
-}
-
-# Write a default kdeglobals file to set up the font
-kdeglobalsfile=$configDir/kdeglobals
-test -f $kdeglobalsfile || {
-cat >$kdeglobalsfile <<EOF
-[General]
-fixed=Monospace,10,-1,5,50,0,0,0,0,0,Regular
-font=Sans Serif,10,-1,5,50,0,0,0,0,0,Regular
-menuFont=Sans Serif,10,-1,5,50,0,0,0,0,0,Regular
-smallestReadableFont=Sans Serif,8,-1,5,50,0,0,0,0,0,Regular
-toolBarFont=Sans Serif,8,-1,5,50,0,0,0,0,0,Regular
-
-[WM]
-activeFont=Noto Sans,12,-1,5,50,0,0,0,0,0,Bold
-EOF
-}
-
-@kstartupconfig5@
-returncode=$?
-if test $returncode -ne 0; then
-    @xmessage@ -geometry 500x100 "kstartupconfig5 does not exist or fails. The error code is $returncode. Check your installation."
-    exit 1
-fi
-[ -r $configDir/startupconfig ] && . $configDir/startupconfig
-
-if [ "$kdeglobals_kscreen_screenscalefactors" ]; then
-    export QT_SCREEN_SCALE_FACTORS="$kdeglobals_kscreen_screenscalefactors"
-fi
-#Manually disable auto scaling because we are scaling above
-#otherwise apps that manually opt in for high DPI get auto scaled by the developer AND manually scaled by us
-export QT_AUTO_SCREEN_SCALE_FACTOR=0
-
-XCURSOR_PATH=~/.icons
-IFS=":" read -r -a xdgDirs <<< "$XDG_DATA_DIRS"
-for xdgDir in "${xdgDirs[@]}"; do
-    XCURSOR_PATH="$XCURSOR_PATH:$xdgDir/icons"
-done
-export XCURSOR_PATH
-
-# XCursor mouse theme needs to be applied here to work even for kded or ksmserver
-if test -n "$kcminputrc_mouse_cursortheme" -o -n "$kcminputrc_mouse_cursorsize" ; then
-
-    @kapplymousetheme@ "$kcminputrc_mouse_cursortheme" "$kcminputrc_mouse_cursorsize"
-    if test $? -eq 10; then
-        XCURSOR_THEME=breeze_cursors
-        export XCURSOR_THEME
-    elif test -n "$kcminputrc_mouse_cursortheme"; then
-        XCURSOR_THEME="$kcminputrc_mouse_cursortheme"
-        export XCURSOR_THEME
-    fi
-    if test -n "$kcminputrc_mouse_cursorsize"; then
-        XCURSOR_SIZE="$kcminputrc_mouse_cursorsize"
-        export XCURSOR_SIZE
-    fi
-fi
-
-unset THEME
-
-# Set a left cursor instead of the standard X11 "X" cursor, since I've heard
-# from some users that they're confused and don't know what to do. This is
-# especially necessary on slow machines, where starting KDE takes one or two
-# minutes until anything appears on the screen.
-#
-# If the user has overwritten fonts, the cursor font may be different now
-# so don't move this up.
-#
-@xsetroot@ -cursor_name left_ptr
-
-if test "$kcmfonts_general_forcefontdpi" -ne 0; then
-    @xrdb@ -quiet -merge -nocpp <<EOF
-Xft.dpi: $kcmfonts_general_forcefontdpi
-EOF
-fi
-
-dl=$DESKTOP_LOCKED
-unset DESKTOP_LOCKED # Don't want it in the environment
-
-ksplash_pid=
-if test -z "$dl"; then
-  # the splashscreen and progress indicator
-  case "$ksplashrc_ksplash_engine" in
-    KSplashQML)
-      ksplash_pid=$(@ksplashqml@ "${ksplashrc_ksplash_theme}" --pid)
-      ;;
-    None)
-      ;;
-    *)
-      ;;
-  esac
-fi
-
-echo 'startkde: Starting up...'  1>&2
-
-# Make sure that D-Bus is running
-if @qdbus@ >/dev/null 2>/dev/null; then
-    : # ok
-else
-    echo 'startkde: Could not start D-Bus. Can you call qdbus?'  1>&2
-    test -n "$ksplash_pid" && kill "$ksplash_pid" 2>/dev/null
-    @xmessage@ -geometry 500x100 "Could not start D-Bus. Can you call qdbus?"
-    exit 1
-fi
-
-# Mark that full KDE session is running (e.g. Konqueror preloading works only
-# with full KDE running). The KDE_FULL_SESSION property can be detected by
-# any X client connected to the same X session, even if not launched
-# directly from the KDE session but e.g. using "ssh -X", kdesu. $KDE_FULL_SESSION
-# however guarantees that the application is launched in the same environment
-# like the KDE session and that e.g. KDE utilities/libraries are available.
-# KDE_FULL_SESSION property is also only available since KDE 3.5.5.
-# The matching tests are:
-#   For $KDE_FULL_SESSION:
-#     if test -n "$KDE_FULL_SESSION"; then ... whatever
-#   For KDE_FULL_SESSION property:
-#     xprop -root | grep "^KDE_FULL_SESSION" >/dev/null 2>/dev/null
-#     if test $? -eq 0; then ... whatever
-#
-# Additionally there is (since KDE 3.5.7) $KDE_SESSION_UID with the uid
-# of the user running the KDE session. It should be rarely needed (e.g.
-# after sudo to prevent desktop-wide functionality in the new user's kded).
-#
-# Since KDE4 there is also KDE_SESSION_VERSION, containing the major version number.
-# Note that this didn't exist in KDE3, which can be detected by its absense and
-# the presence of KDE_FULL_SESSION.
-#
-KDE_FULL_SESSION=true
-export KDE_FULL_SESSION
-@xprop@ -root -f KDE_FULL_SESSION 8t -set KDE_FULL_SESSION true
-
-KDE_SESSION_VERSION=5
-export KDE_SESSION_VERSION
-@xprop@ -root -f KDE_SESSION_VERSION 32c -set KDE_SESSION_VERSION 5
-
-KDE_SESSION_UID=$(id -ru)
-export KDE_SESSION_UID
-
-XDG_CURRENT_DESKTOP=KDE
-export XDG_CURRENT_DESKTOP
-
-# Source scripts found in <config locations>/plasma-workspace/env/*.sh
-# (where <config locations> correspond to the system and user's configuration
-# directories, as identified by Qt's qtpaths,  e.g.  $HOME/.config
-# and /etc/xdg/ on Linux)
-#
-# This is where you can define environment variables that will be available to
-# all KDE programs, so this is where you can run agents using e.g. eval `ssh-agent`
-# or eval `gpg-agent --daemon`.
-# Note: if you do that, you should also put "ssh-agent -k" as a shutdown script
-#
-# (see end of this file).
-# For anything else (that doesn't set env vars, or that needs a window manager),
-# better use the Autostart folder.
-
-IFS=":" read -r -a scriptpath <<< $(@qtpaths@ --paths GenericConfigLocation)
-# Add /env/ to the directory to locate the scripts to be sourced
-for prefix in "${scriptpath[@]}"; do
-  for file in "$prefix"/plasma-workspace/env/*.sh; do
-    test -r "$file" && . "$file" || true
-  done
-done
-
-# At this point all environment variables are set, let's send it to the DBus session server to update the activation environment
-@dbus_update_activation_environment@ --systemd --all
-if test $? -ne 0; then
-  # Startup error
-  echo 'startkde: Could not sync environment to dbus.'  1>&2
-  test -n "$ksplash_pid" && kill "$ksplash_pid" 2>/dev/null
-  @xmessage@ -geometry 500x100 "Could not sync environment to dbus."
-  exit 1
-fi
-
-# We set LD_BIND_NOW to increase the efficiency of kdeinit.
-# kdeinit unsets this variable before loading applications.
-LD_BIND_NOW=true @start_kdeinit_wrapper@ --kded +kcminit_startup
-if test $? -ne 0; then
-  # Startup error
-  echo 'startkde: Could not start kdeinit5. Check your installation.'  1>&2
-  test -n "$ksplash_pid" && kill "$ksplash_pid" 2>/dev/null
-  @xmessage@ -geometry 500x100 "Could not start kdeinit5. Check your installation."
-  exit 1
-fi
-
-@qdbus@ org.kde.KSplash /KSplash org.kde.KSplash.setStage kinit
-
-# finally, give the session control to the session manager
-# see kdebase/ksmserver for the description of the rest of the startup sequence
-# if the KDEWM environment variable has been set, then it will be used as KDE's
-# window manager instead of kwin.
-# if KDEWM is not set, ksmserver will ensure kwin is started.
-# kwrapper5 is used to reduce startup time and memory usage
-# kwrapper5 does not return useful error codes such as the exit code of ksmserver.
-# We only check for 255 which means that the ksmserver process could not be
-# started, any problems thereafter, e.g. ksmserver failing to initialize,
-# will remain undetected.
-test -n "$KDEWM" && KDEWM="--windowmanager $KDEWM"
-# If the session should be locked from the start (locked autologin),
-# lock now and do the rest of the KDE startup underneath the locker.
-KSMSERVEROPTIONS=""
-test -n "$dl" && KSMSERVEROPTIONS=" --lockscreen"
-@kwrapper5@ @ksmserver@ $KDEWM $KSMSERVEROPTIONS
-if test $? -eq 255; then
-  # Startup error
-  echo 'startkde: Could not start ksmserver. Check your installation.'  1>&2
-  test -n "$ksplash_pid" && kill "$ksplash_pid" 2>/dev/null
-  @xmessage@ -geometry 500x100 "Could not start ksmserver. Check your installation."
-fi
-
-wait_drkonqi=$(@kreadconfig5@ --file startkderc --group WaitForDrKonqi --key Enabled --default true)
-
-if test x"$wait_drkonqi"x = x"true"x ; then
-    # wait for remaining drkonqi instances with timeout (in seconds)
-    wait_drkonqi_timeout=$(kreadconfig5 --file startkderc --group WaitForDrKonqi --key Timeout --default 900)
-    wait_drkonqi_counter=0
-    while qdbus | grep "^[^w]*org.kde.drkonqi" > /dev/null ; do
-        sleep 5
-        wait_drkonqi_counter=$((wait_drkonqi_counter+5))
-        if test "$wait_drkonqi_counter" -ge "$wait_drkonqi_timeout" ; then
-            # ask remaining drkonqis to die in a graceful way
-            @qdbus@ | grep 'org.kde.drkonqi-' | while read address ; do
-                @qdbus@ "$address" "/MainApplication" "quit"
-            done
-            break
-        fi
-    done
-fi
-
-echo 'startkde: Shutting down...'  1>&2
-# just in case
-test -n "$ksplash_pid" && kill "$ksplash_pid" 2>/dev/null
-
-# Clean up
-@kdeinit5_shutdown@
-
-unset KDE_FULL_SESSION
-@xprop@ -root -remove KDE_FULL_SESSION
-unset KDE_SESSION_VERSION
-@xprop@ -root -remove KDE_SESSION_VERSION
-unset KDE_SESSION_UID
-
-echo 'startkde: Done.'  1>&2
--- a/pkgs/development/compilers/ponyc/default.nix
+++ b/pkgs/development/compilers/ponyc/default.nix
@ -3,13 +3,13 @@

 stdenv.mkDerivation ( rec {
  name = "ponyc-${version}";
-  version = "0.19.3";
+  version = "0.20.0";

  src = fetchFromGitHub {
    owner = "ponylang";
    repo = "ponyc";
    rev = version;
-    sha256 = "0aishczaasp877z1a17iq0vk6pp369bv7yz5mvinr7wm44930qr3";
+    sha256 = "0shln9v0bp0q9qfipm3834vl284q5vwz9333yzgx46d0l2ivggyi";
  };

  buildInputs = [ llvm makeWrapper which ];
--- a/pkgs/development/compilers/scala/default.nix
+++ b/pkgs/development/compilers/scala/default.nix
@ -1,11 +1,11 @@
 { stdenv, fetchurl, makeWrapper, jre, gnugrep, coreutils }:

 stdenv.mkDerivation rec {
-  name = "scala-2.12.3";
+  name = "scala-2.12.4";

  src = fetchurl {
    url = "http://www.scala-lang.org/files/archive/${name}.tgz";
-    sha256 = "133w4r2214ci7r4sg2yyk9lhn62ldm4ad0d89drwrvgvffvnly9b";
+    sha256 = "089a54qj8psh4jxqbrrwk5zahw13fyqq24l87s3031xa675a0m4m";
  };

  propagatedBuildInputs = [ jre ] ;
--- a/pkgs/development/idris-modules/lightyear.nix
+++ b/pkgs/development/idris-modules/lightyear.nix
@ -8,7 +8,7 @@
 }:

 let
-  date = "2016-08-01";
+  date = "2017-09-10";
 in
 build-idris-package {
  name = "lightyear-${date}";
@ -16,8 +16,8 @@ build-idris-package {
  src = fetchFromGitHub {
    owner = "ziman";
    repo = "lightyear";
-    rev = "9420f9e892e23a7016dea1a61d8ce43a6d4ecf15";
-    sha256 = "0xbjwq7sk4x78mi2zcqxbx7wziijlr1ayxihb1vml33lqmsgl1dn";
+    rev = "f737e25a09c1fe7c5fff063c53bd7458be232cc8";
+    sha256 = "05x66abhpbdm6yr0afbwfk6w04ysdk78gylj5alhgwhy4jqakv29";
  };

  propagatedBuildInputs = [ prelude base effects ];
--- a/pkgs/development/libraries/qt-5/5.9/qtbase/default.nix
+++ b/pkgs/development/libraries/qt-5/5.9/qtbase/default.nix
@ -86,7 +86,7 @@ stdenv.mkDerivation {
    ''
      substituteInPlace configure --replace /bin/pwd pwd
      substituteInPlace src/corelib/global/global.pri --replace /bin/ls ${coreutils}/bin/ls
-      sed -e 's@/\(usr\|opt\)/@/var/empty/@g' -i config.tests/*/*.test -i mkspecs/*/*.conf
+      sed -e 's@/\(usr\|opt\)/@/var/empty/@g' -i mkspecs/*/*.conf

      sed -i '/PATHS.*NO_DEFAULT_PATH/ d' src/corelib/Qt5Config.cmake.in
      sed -i '/PATHS.*NO_DEFAULT_PATH/ d' src/corelib/Qt5CoreMacros.cmake
@ -105,6 +105,7 @@ stdenv.mkDerivation {
          -e 's|! /usr/bin/xcode-select --print-path >/dev/null 2>&1;|false;|' \
          -e 's|! /usr/bin/xcrun -find xcodebuild >/dev/null 2>&1;|false;|' \
          -e 's|sysroot=$(/usr/bin/xcodebuild -sdk $sdk -version Path 2>/dev/null)|sysroot=/nonsense|' \
+          -e 's|sysroot=$(/usr/bin/xcrun --sdk $sdk --show-sdk-path 2>/dev/null)|sysroot=/nonsense|' \
          -e 's|QMAKE_CONF_COMPILER=`getXQMakeConf QMAKE_CXX`|QMAKE_CXX="clang++"\nQMAKE_CONF_COMPILER="clang++"|' \
          -e 's|XCRUN=`/usr/bin/xcrun -sdk macosx clang -v 2>&1`|XCRUN="clang -v 2>&1"|' \
          -e 's#sdk_val=$(/usr/bin/xcrun -sdk $sdk -find $(echo $val | cut -d \x27 \x27 -f 1))##' \
@ -155,6 +156,7 @@ stdenv.mkDerivation {

    ++ lib.optionals stdenv.isDarwin
    [
+      "-Wno-missing-sysroot"
      "-D__MAC_OS_X_VERSION_MAX_ALLOWED=1090"
      "-D__AVAILABILITY_INTERNAL__MAC_10_10=__attribute__((availability(macosx,introduced=10.10)))"
      # Note that nixpkgs's objc4 is from macOS 10.11 while the SDK is
--- a/pkgs/development/libraries/qt-5/5.9/qtbase/mkspecs-features-mac.patch
+++ b/pkgs/development/libraries/qt-5/5.9/qtbase/mkspecs-features-mac.patch
@ -1,7 +1,7 @@
-diff -u qtbase-opensource-src-5.9.1.orig/mkspecs/features/mac/default_post.prf qtbase-opensource-src-5.9.1/mkspecs/features/mac/default_post.prf
--- qtbase-opensource-src-5.9.1.orig/mkspecs/features/mac/default_post.prf	2017-09-16 16:40:30.000000000 +0800
-+++ qtbase-opensource-src-5.9.1/mkspecs/features/mac/default_post.prf	2017-09-16 16:41:03.000000000 +0800
-@@ -24,165 +24,3 @@
+diff -u -r qtbase-opensource-src-5.9.2.orig/mkspecs/features/mac/default_post.prf qtbase-opensource-src-5.9.2/mkspecs/features/mac/default_post.prf
+--- qtbase-opensource-src-5.9.2.orig/mkspecs/features/mac/default_post.prf	2017-10-14 12:31:04.000000000 +0800
+++ qtbase-opensource-src-5.9.2/mkspecs/features/mac/default_post.prf	2017-10-14 12:42:02.000000000 +0800
+@@ -24,166 +24,3 @@
         }
     }
 }
@ -164,13 +164,14 @@ diff -u qtbase-opensource-src-5.9.1.orig/mkspecs/features/mac/default_post.prf q
 -}
 -
 -cache(QMAKE_XCODE_DEVELOPER_PATH, stash)
-cache(QMAKE_XCODE_VERSION, stash)
+-!isEmpty(QMAKE_XCODE_VERSION): \
+-    cache(QMAKE_XCODE_VERSION, stash)
 -
 -QMAKE_XCODE_LIBRARY_SUFFIX = $$qtPlatformTargetSuffix()
-diff -u qtbase-opensource-src-5.9.1.orig/mkspecs/features/mac/default_pre.prf qtbase-opensource-src-5.9.1/mkspecs/features/mac/default_pre.prf
--- qtbase-opensource-src-5.9.1.orig/mkspecs/features/mac/default_pre.prf	2017-09-16 16:40:30.000000000 +0800
-+++ qtbase-opensource-src-5.9.1/mkspecs/features/mac/default_pre.prf	2017-09-16 16:40:45.000000000 +0800
-@@ -1,51 +1,2 @@
+diff -u -r qtbase-opensource-src-5.9.2.orig/mkspecs/features/mac/default_pre.prf qtbase-opensource-src-5.9.2/mkspecs/features/mac/default_pre.prf
+--- qtbase-opensource-src-5.9.2.orig/mkspecs/features/mac/default_pre.prf	2017-10-14 12:31:04.000000000 +0800
+++ qtbase-opensource-src-5.9.2/mkspecs/features/mac/default_pre.prf	2017-10-14 12:42:02.000000000 +0800
+@@ -1,56 +1,2 @@
 CONFIG = asset_catalogs rez $$CONFIG
 load(default_pre)
 -
@ -183,18 +184,23 @@ diff -u qtbase-opensource-src-5.9.1.orig/mkspecs/features/mac/default_pre.prf qt
 -    # Make sure Xcode path is valid
 -    !exists($$QMAKE_XCODE_DEVELOPER_PATH): \
 -        error("Xcode is not installed in $${QMAKE_XCODE_DEVELOPER_PATH}. Please use xcode-select to choose Xcode installation path.")
-
-    # Make sure Xcode is set up properly
-    isEmpty($$list($$system("/usr/bin/xcrun -find xcodebuild 2>/dev/null"))): \
-        error("Xcode not set up properly. You may need to confirm the license agreement by running /usr/bin/xcodebuild.")
 -}
 -
-isEmpty(QMAKE_XCODE_VERSION) {
-    # Extract Xcode version using xcodebuild
-    xcode_version = $$system("/usr/bin/xcodebuild -version")
-    QMAKE_XCODE_VERSION = $$member(xcode_version, 1)
-    isEmpty(QMAKE_XCODE_VERSION): error("Could not resolve Xcode version.")
-    unset(xcode_version)
+-isEmpty(QMAKE_XCODEBUILD_PATH): \
+-    QMAKE_XCODEBUILD_PATH = $$system("/usr/bin/xcrun -find xcodebuild 2>/dev/null")
+-
+-!isEmpty(QMAKE_XCODEBUILD_PATH) {
+-    # Make sure Xcode is set up properly
+-    !system("/usr/bin/xcrun xcodebuild -license check 2>/dev/null"): \
+-        error("Xcode not set up properly. You need to confirm the license agreement by running 'sudo xcrun xcodebuild -license accept'.")
+-
+-    isEmpty(QMAKE_XCODE_VERSION) {
+-        # Extract Xcode version using xcodebuild
+-        xcode_version = $$system("/usr/bin/xcrun xcodebuild -version")
+-        QMAKE_XCODE_VERSION = $$member(xcode_version, 1)
+-        isEmpty(QMAKE_XCODE_VERSION): error("Could not resolve Xcode version.")
+-        unset(xcode_version)
+-    }
 -}
 -
 -isEmpty(QMAKE_TARGET_BUNDLE_PREFIX) {
@ -222,10 +228,10 @@ diff -u qtbase-opensource-src-5.9.1.orig/mkspecs/features/mac/default_pre.prf qt
 -# feature, which allows Xcode to choose the Qt libraries to link to
 -# at build time, depending on the current Xcode SDK and configuration.
 -QMAKE_XCODE_LIBRARY_SUFFIX_SETTING = QT_LIBRARY_SUFFIX
-diff -u qtbase-opensource-src-5.9.1.orig/mkspecs/features/mac/sdk.prf qtbase-opensource-src-5.9.1/mkspecs/features/mac/sdk.prf
--- qtbase-opensource-src-5.9.1.orig/mkspecs/features/mac/sdk.prf	2017-09-16 16:40:30.000000000 +0800
-+++ qtbase-opensource-src-5.9.1/mkspecs/features/mac/sdk.prf	2017-09-16 16:41:16.000000000 +0800
-@@ -1,49 +0,0 @@
+diff -u -r qtbase-opensource-src-5.9.2.orig/mkspecs/features/mac/sdk.prf qtbase-opensource-src-5.9.2/mkspecs/features/mac/sdk.prf
+--- qtbase-opensource-src-5.9.2.orig/mkspecs/features/mac/sdk.prf	2017-10-14 12:31:04.000000000 +0800
+++ qtbase-opensource-src-5.9.2/mkspecs/features/mac/sdk.prf	2017-10-14 12:42:10.000000000 +0800
+@@ -1,58 +0,0 @@
 -
 -isEmpty(QMAKE_MAC_SDK): \
 -    error("QMAKE_MAC_SDK must be set when using CONFIG += sdk.")
@ -235,13 +241,22 @@ diff -u qtbase-opensource-src-5.9.1.orig/mkspecs/features/mac/sdk.prf qtbase-ope
 -
 -defineReplace(xcodeSDKInfo) {
 -    info = $$1
+-    equals(info, "Path"): \
+-        info = --show-sdk-path
+-    equals(info, "PlatformPath"): \
+-        info = --show-sdk-platform-path
+-    equals(info, "SDKVersion"): \
+-        info = --show-sdk-version
 -    sdk = $$2
 -    isEmpty(sdk): \
 -        sdk = $$QMAKE_MAC_SDK
 -
 -    isEmpty(QMAKE_MAC_SDK.$${sdk}.$${info}) {
-        QMAKE_MAC_SDK.$${sdk}.$${info} = $$system("/usr/bin/xcodebuild -sdk $$sdk -version $$info 2>/dev/null")
-        isEmpty(QMAKE_MAC_SDK.$${sdk}.$${info}): error("Could not resolve SDK $$info for \'$$sdk\'")
+-        QMAKE_MAC_SDK.$${sdk}.$${info} = $$system("/usr/bin/xcrun --sdk $$sdk $$info 2>/dev/null")
+-        # --show-sdk-platform-path won't work for Command Line Tools; this is fine
+-        # only used by the XCTest backend to testlib
+-        isEmpty(QMAKE_MAC_SDK.$${sdk}.$${info}):if(!isEmpty(QMAKE_XCODEBUILD_PATH)|!equals(info, "--show-sdk-platform-path")): \
+-            error("Could not resolve SDK $$info for \'$$sdk\'")
 -        cache(QMAKE_MAC_SDK.$${sdk}.$${info}, set stash, QMAKE_MAC_SDK.$${sdk}.$${info})
 -    }
 -
@ -275,4 +290,3 @@ diff -u qtbase-opensource-src-5.9.1.orig/mkspecs/features/mac/sdk.prf qtbase-ope
 -    $$tool = $$sysrooted $$member(value, 1, -1)
 -    cache($$tool_variable, set stash, $$tool)
 -}
-Common subdirectories: qtbase-opensource-src-5.9.1.orig/mkspecs/features/mac/unsupported and qtbase-opensource-src-5.9.1/mkspecs/features/mac/unsupported
--- a/pkgs/development/libraries/qt-5/qtbase-setup-hook-darwin.sh
+++ b/pkgs/development/libraries/qt-5/qtbase-setup-hook-darwin.sh
@ -182,7 +182,8 @@ _qtFixCMakePaths() {
    find "${!outputLib}" -name "*.cmake" | while read file; do
        substituteInPlace "$file" \
            --subst-var-by NIX_OUT "${!outputLib}" \
-            --subst-var-by NIX_DEV "${!outputDev}"
+            --subst-var-by NIX_DEV "${!outputDev}" \
+            --subst-var-by NIX_BIN "${!outputBin}"
    done
 }

--- a/pkgs/development/libraries/wlc/default.nix
+++ b/pkgs/development/libraries/wlc/default.nix
@ -7,14 +7,14 @@

 stdenv.mkDerivation rec {
  name = "wlc-${version}";
-  version = "0.0.9"; # 0.0.10 currently causes segfaults
+  version = "0.0.10";

  src = fetchFromGitHub {
    owner = "Cloudef";
    repo = "wlc";
    rev = "v${version}";
    fetchSubmodules = true;
-    sha256 = "1r6jf64gs7n9a8129wsc0mdwhcv44p8k87kg0714rhx3g2w22asg";
+    sha256 = "09kvwhrpgkxlagn9lgqxc80jbg56djn29a6z0n6h0dsm90ysyb2k";
  };

  nativeBuildInputs = [ cmake pkgconfig ];
--- a/pkgs/development/libraries/wt/cmake.patch
+++ b/pkgs/development/libraries/wt/cmake.patch
@ -1,10 +0,0 @@
--- a/CMakeLists.txt	2016-07-13 14:27:26.000000000 +0200
-+++ b/CMakeLists.txt	2016-08-16 12:58:28.135652964 +0200
-@@ -6,6 +6,7 @@
-   CMAKE_POLICY(SET CMP0002 OLD)
-   CMAKE_POLICY(SET CMP0003 OLD)
-   CMAKE_POLICY(SET CMP0005 OLD)
-+  CMAKE_POLICY(SET CMP0037 OLD)
- ENDIF(COMMAND CMAKE_POLICY)
- 
- PROJECT(WT)
--- a/pkgs/development/libraries/wt/default.nix
+++ b/pkgs/development/libraries/wt/default.nix
@ -4,13 +4,13 @@

 stdenv.mkDerivation rec {
  name = "wt";
-  version = "3.3.6";
+  version = "4.0.0";

  src = fetchFromGitHub {
    owner = "kdeforche";
    repo = name;
    rev = version;
-    sha256 = "1pvykc969l9cpd0da8bgpi4gr8f6qczrbpprrxamyj1pn0ydzvq3";
+    sha256 = "1451xxvnx6mlvxg0jxlr1mfv5v18h2214kijk5kacilqashfc43i";
  };

  enableParallelBuilding = true;
@ -28,8 +28,6 @@ stdenv.mkDerivation rec {
    "--no-warn-unused-cli"
  ];

-  patches = [ ./cmake.patch ];  # fix a cmake warning; PR sent to upstream 
-
  meta = with stdenv.lib; {
    homepage = https://www.webtoolkit.eu/wt;
    description = "C++ library for developing web applications";
--- a/pkgs/development/libraries/xxHash/default.nix
+++ b/pkgs/development/libraries/xxHash/default.nix
@ -0,0 +1,31 @@
+{ stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  name = "xxHash-${version}";
+  version = "0.6.3.20171018";
+
+  src = fetchFromGitHub {
+    sha256 = "0061ivxpx0p24m4vg7kfx9fs9f0jxvv4g76bmyss5gp90p05hc18";
+    rev = "333804ccf0c0339451accac023deeab9e5f7c002";
+    repo = "xxHash";
+    owner = "Cyan4973";
+  };
+
+  outputs = [ "out" "dev" ];
+
+  makeFlags = [ "PREFIX=$(out)" "INCLUDEDIR=$(dev)/include" ];
+
+  meta = with stdenv.lib; {
+    description = "Extremely fast hash algorithm";
+    longDescription = ''
+      xxHash is an Extremely fast Hash algorithm, running at RAM speed limits.
+      It successfully completes the SMHasher test suite which evaluates
+      collision, dispersion and randomness qualities of hash functions. Code is
+      highly portable, and hashes are identical on all platforms (little / big
+      endian).
+    '';
+    homepage = https://github.com/Cyan4973/xxHash;
+    license = with licenses; [ bsd2 gpl2 ];
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/development/ocaml-modules/camomile/0.8.5.nix
+++ b/pkgs/development/ocaml-modules/camomile/0.8.5.nix
@ -0,0 +1,30 @@
+{stdenv, fetchurl, fetchpatch, ocaml, findlib, camlp4}:
+
+stdenv.mkDerivation rec {
+  name = "camomile-${version}";
+  version = "0.8.5";
+
+  src = fetchurl {
+    url = https://github.com/yoriyuki/Camomile/releases/download/rel-0.8.5/camomile-0.8.5.tar.bz2;
+    sha256 = "003ikpvpaliy5hblhckfmln34zqz0mk3y2m1fqvbjngh3h2np045";
+  };
+
+  patches = [ (fetchpatch {
+    url = https://raw.githubusercontent.com/ocaml/opam-repository/master/packages/camomile/camomile.0.8.5/files/4.05-typing-fix.patch;
+    sha256 = "167279lia6qx62mdcyc5rjsi4gf4yi52wn9mhgd9y1v3754z7fwb";
+  })];
+
+  buildInputs = [ocaml findlib camlp4];
+
+  createFindlibDestdir = true;
+
+  meta = {
+    homepage = https://github.com/yoriyuki/Camomile/tree/master/Camomile;
+    description = "A comprehensive Unicode library for OCaml";
+    license = stdenv.lib.licenses.lgpl21;
+    platforms = ocaml.meta.platforms or [];
+    maintainers = [
+      stdenv.lib.maintainers.z77z
+    ];
+  };
+}
--- a/pkgs/development/ocaml-modules/camomile/default.nix
+++ b/pkgs/development/ocaml-modules/camomile/default.nix
@ -1,30 +1,27 @@
-{stdenv, fetchurl, fetchpatch, ocaml, findlib, camlp4}:
+{ stdenv, fetchFromGitHub, ocaml, findlib, jbuilder, cppo }:

 stdenv.mkDerivation rec {
-  name = "camomile-${version}";
-  version = "0.8.5";
+	version = "0.8.6";
+	name = "ocaml${ocaml.version}-camomile-${version}";

-  src = fetchurl {
-    url = https://github.com/yoriyuki/Camomile/releases/download/rel-0.8.5/camomile-0.8.5.tar.bz2;
-    sha256 = "003ikpvpaliy5hblhckfmln34zqz0mk3y2m1fqvbjngh3h2np045";
-  };
+	src = fetchFromGitHub {
+		owner = "yoriyuki";
+		repo = "camomile";
+		rev = "rel-${version}";
+		sha256 = "1jq1xhaikczk6lbvas7c35aa04q0kjaqd8m54c4jivpj80yvg4x9";
+	};

-  patches = [ (fetchpatch {
-    url = https://raw.githubusercontent.com/ocaml/opam-repository/master/packages/camomile/camomile.0.8.5/files/4.05-typing-fix.patch;
-    sha256 = "167279lia6qx62mdcyc5rjsi4gf4yi52wn9mhgd9y1v3754z7fwb";
-  })];
+	buildInputs = [ ocaml findlib jbuilder cppo ];

-  buildInputs = [ocaml findlib camlp4];
+	configurePhase = "ocaml configure.ml --share $out/share/camomile";

-  createFindlibDestdir = true;
+	inherit (jbuilder) installPhase;

-  meta = {
-    homepage = https://github.com/yoriyuki/Camomile/tree/master/Camomile;
-    description = "A comprehensive Unicode library for OCaml";
-    license = stdenv.lib.licenses.lgpl21;
-    platforms = ocaml.meta.platforms or [];
-    maintainers = [
-      stdenv.lib.maintainers.z77z
-    ];
-  };
+	meta = {
+		inherit (ocaml.meta) platforms;
+		inherit (src.meta) homepage;
+		maintainers = [ stdenv.lib.maintainers.vbgl ];
+		license = stdenv.lib.licenses.lgpl21;
+		description = "A Unicode library for OCaml";
+	};
 }
--- a/pkgs/development/python-modules/colorlover/default.nix
+++ b/pkgs/development/python-modules/colorlover/default.nix
@ -0,0 +1,23 @@
+{ buildPythonPackage, fetchPypi, python, stdenv, nose
+}:
+
+buildPythonPackage rec {
+  pname = "colorlover";
+  version = "0.2.1";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1clwvssrj007r07prfvkqnpjy3f77dlp584lj879x8mwl8f0japi";
+  };
+
+  # no tests included in distributed archive
+  doCheck = false;
+
+  meta = {
+    homepage = https://github.com/jackparmer/colorlover;
+    description = "Color scales in Python for humans";
+    license = stdenv.lib.licenses.mit;
+    maintainers = with stdenv.lib.maintainers; [ globin ];
+  };
+}
--- a/pkgs/development/python-modules/cufflinks/default.nix
+++ b/pkgs/development/python-modules/cufflinks/default.nix
@ -0,0 +1,25 @@
+{ buildPythonPackage, stdenv, fetchPypi, pandas, plotly, colorlover
+}:
+
+buildPythonPackage rec {
+  pname = "cufflinks";
+  version = "0.12.0";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "04ninvwm6277n3hqc17ririss90cd832wza3q3vf115rrrds3xyy";
+  };
+
+  propagatedBuildInputs = [ pandas plotly colorlover ];
+
+  # tests not included in archive
+  doCheck = false;
+
+  meta = {
+    homepage = https://github.com/santosjorge/cufflinks;
+    description = "Productivity Tools for Plotly + Pandas";
+    license = stdenv.lib.licenses.mit;
+    maintainers = with stdenv.lib.maintainers; [ globin ];
+  };
+}
--- a/pkgs/development/python-modules/django/1_11.nix
+++ b/pkgs/development/python-modules/django/1_11.nix
@ -1,21 +1,22 @@
 { stdenv, buildPythonPackage, fetchurl, substituteAll,
  pythonOlder,
-  geos, gdal, pytz
+  geos, gdal, pytz,
+  withGdal ? false
 }:

 buildPythonPackage rec {
  pname = "Django";
  name = "${pname}-${version}";
-  version = "1.11.5";
+  version = "1.11.6";

  disabled = pythonOlder "2.7";

  src = fetchurl {
    url = "http://www.djangoproject.com/m/releases/1.11/${name}.tar.gz";
-    sha256 = "0a9bk1a0n0264lcr67fmwzqyhkhy6bqdzkxsj9a8dpyzca0qfdhq";
+    sha256 = "0q0cmwifa6c0k6kh8fpa3mjmqw7yqd616qz8m4ls3h51xyhjrd63";
  };

-  patches = [
+  patches = stdenv.lib.optionals withGdal [
    (substituteAll {
      src = ./1.10-gis-libs.template.patch;
      geos = geos;
--- a/pkgs/development/python-modules/python-fontconfig/default.nix
+++ b/pkgs/development/python-modules/python-fontconfig/default.nix
@ -0,0 +1,30 @@
+{ lib, buildPythonPackage, fetchPypi, fontconfig, python, freefont_ttf, makeFontsConf }:
+
+let
+  fontsConf = makeFontsConf {
+    fontDirectories = [ freefont_ttf ];
+  };
+in buildPythonPackage rec {
+  pname = "Python-fontconfig";
+  version = "0.5.1";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "154rfd0ygcbj9y8m32n537b457yijpfx9dvmf76vi0rg4ikf7kxp";
+  };
+
+  buildInputs = [ fontconfig ];
+
+  checkPhase = ''
+    export FONTCONFIG_FILE=${fontsConf};
+    echo y | ${python.interpreter} test/test.py
+  '';
+
+  meta = {
+    homepage = https://github.com/Vayn/python-fontconfig;
+    description = "Python binding for Fontconfig";
+    license = lib.licenses.gpl3;
+    maintainers = with lib.maintainers; [ gnidorah ];
+  };
+}
--- a/pkgs/development/tools/build-managers/scons/common.nix
+++ b/pkgs/development/tools/build-managers/scons/common.nix
@ -0,0 +1,32 @@
+{ version, sha256 }:
+
+{ stdenv, fetchurl, fetchpatch, python2Packages }:
+
+let name = "scons";
+in python2Packages.buildPythonApplication {
+  name = "${name}-${version}";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/scons/${name}-${version}.tar.gz";
+    inherit sha256;
+  };
+
+  # Fix a regression in 3.0.0 (causes build errors for some packages)
+  patches = stdenv.lib.optional (version == "3.0.0") ./print-statements.patch;
+
+  meta = with stdenv.lib; {
+    homepage = http://scons.org/;
+    description = "An improved, cross-platform substitute for Make";
+    license = licenses.mit;
+    longDescription = ''
+      SCons is an Open Source software construction tool. Think of
+      SCons as an improved, cross-platform substitute for the classic
+      Make utility with integrated functionality similar to
+      autoconf/automake and compiler caches such as ccache. In short,
+      SCons is an easier, more reliable and faster way to build
+      software.
+    '';
+    platforms = platforms.all;
+    maintainers = [ primeos ];
+  };
+}
--- a/pkgs/development/tools/build-managers/scons/default.nix
+++ b/pkgs/development/tools/build-managers/scons/default.nix
@ -1,30 +1,14 @@
-{stdenv, fetchurl, python2Packages}:
+{ callPackage, stdenv }:

 let
-  name = "scons";
-  version = "2.5.1";
-in python2Packages.buildPythonApplication {
-  name = "${name}-${version}";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/scons/${name}-${version}.tar.gz";
+  mkScons = args: callPackage (import ./common.nix args) { };
+in {
+  scons_2_5_1 = mkScons {
+    version = "2.5.1";
    sha256 = "1wji1z9jdkhnmm99apx6fhld9cs52rr56aigniyrcsmlwy52298b";
  };
-  # No tests
-  doCheck = false;
-
-  meta = {
-    homepage = http://scons.org/;
-    description = "An improved, cross-platform substitute for Make";
-    license = stdenv.lib.licenses.mit;
-    longDescription = ''
-      SCons is an Open Source software construction tool. Think of
-      SCons as an improved, cross-platform substitute for the classic
-      Make utility with integrated functionality similar to
-      autoconf/automake and compiler caches such as ccache. In short,
-      SCons is an easier, more reliable and faster way to build
-      software.
-    '';
-    platforms = stdenv.lib.platforms.all;
+  scons_3_0_0 = mkScons {
+    version = "3.0.0";
+    sha256 = "05jjykllk4icnq6gfrkgkbc4ggxm7983q6r33mrhpilqbd02ylqg";
  };
 }
--- a/pkgs/development/tools/build-managers/scons/default.upstream
+++ b/pkgs/development/tools/build-managers/scons/default.upstream
@ -1,10 +0,0 @@
-url http://sourceforge.net/projects/scons/files/scons/
-SF_version_dir
-version_link '[.]tar[.]gz/download$'
-SF_redirect
-ensure_hash
-
-do_overwrite() {
-  set_var_value version "$CURRENT_VERSION"
-  set_var_value sha256 "$CURRENT_HASH"
-}
--- a/pkgs/development/tools/build-managers/scons/print-statements.patch
+++ b/pkgs/development/tools/build-managers/scons/print-statements.patch
@ -0,0 +1,13 @@
+diff --git a/src/engine/SCons/Script/SConscript.py b/src/engine/SCons/Script/SConscript.py
+index 558e28f9..8fea9c4d 100644
+--- src/engine/SCons/Script/SConscript.py
+++ src/engine/SCons/Script/SConscript.py
+@@ -5,8 +5,6 @@
+ 
+ """
+ 
+-from __future__ import print_function
+-
+ #
+ # __COPYRIGHT__
+ #
--- a/pkgs/development/tools/continuous-integration/jenkins/default.nix
+++ b/pkgs/development/tools/continuous-integration/jenkins/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name = "jenkins-${version}";
-  version = "2.84";
+  version = "2.85";

  src = fetchurl {
    url = "http://mirrors.jenkins-ci.org/war/${version}/jenkins.war";
-    sha256 = "0pwmviaps4gbv9a3sdn17kqdv9jmh5fpbms1wm95jfj77m5dyyq6";
+    sha256 = "0z8rv6fxsvnw71f8s711n9s60r8jd43bigy9rqz5805k3xa68whr";
  };

  buildCommand = ''
--- a/pkgs/development/tools/scalafmt/default.nix
+++ b/pkgs/development/tools/scalafmt/default.nix
@ -30,7 +30,6 @@ stdenv.mkDerivation rec {
    description = "Opinionated code formatter for Scala";
    homepage = http://scalafmt.org;
    license = licenses.asl20;
-    platforms = platforms.linux;
    maintainers = [ maintainers.markus1189 ];
  };
 }
--- a/pkgs/games/openra/default.nix
+++ b/pkgs/games/openra/default.nix
@ -1,12 +1,11 @@
-{ stdenv, fetchurl, mono, makeWrapper, lua
+{ stdenv, fetchFromGitHub, mono, makeWrapper, lua
 , SDL2, freetype, openal, systemd, pkgconfig,
-  dotnetPackages, gnome3, curl, unzip
+  dotnetPackages, gnome3, curl, unzip, which
 }:

-let
-  version = "20161019";
-in stdenv.mkDerivation rec {
+stdenv.mkDerivation rec {
  name = "openra-${version}";
+  version = "20171014";

  meta = with stdenv.lib; {
    description = "Real Time Strategy game engine recreating the C&C titles";
@ -16,24 +15,33 @@ in stdenv.mkDerivation rec {
    platforms   = platforms.linux;
  };

-  src = fetchurl {
-    name = "${name}.tar.gz";
-    url = "https://github.com/OpenRA/OpenRA/archive/release-${version}.tar.gz";
-    sha256 = "1psmq3kb2whkavh5pm0xc4m5b4bihvrl8pfrk851iqg1cs22bg0w";
+  src = fetchFromGitHub {
+    owner = "OpenRA";
+    repo = "OpenRA";
+    rev = "release-${version}";
+    sha256 = "0nlwpmiwhjs3qc2lxwnrh4p874v5y6mf4avi6bqgr1wvzc43n8wr";
+
+    extraPostFetch = ''
+      sed -i 's,curl,curl --insecure,g' $out/thirdparty/{fetch-thirdparty-deps,noget}.sh
+      $out/thirdparty/fetch-thirdparty-deps.sh
+    '';
  };

  dontStrip = true;

-  buildInputs = with dotnetPackages;
-     [ NUnit3 NewtonsoftJson MonoNat FuzzyLogicLibrary SmartIrc4net SharpZipLib MaxMindGeoIP2 MaxMindDb SharpFont StyleCopMSBuild StyleCopPlusMSBuild RestSharp NUnitConsole OpenNAT ]
+  buildInputs = (with dotnetPackages;
+     [ NUnit3 NewtonsoftJson MonoNat FuzzyLogicLibrary SmartIrc4net SharpZipLib MaxMindGeoIP2 MaxMindDb SharpFont StyleCopMSBuild StyleCopPlusMSBuild RestSharp NUnitConsole OpenNAT ])
     ++ [ curl unzip lua gnome3.zenity ];
  nativeBuildInputs = [ curl unzip mono makeWrapper lua pkgconfig ];

-  patchPhase = ''
+  postPatch = ''
    mkdir Support
-    sed -i 's/^VERSION.*/VERSION = release-${version}/g' Makefile
+    sed -i \
+      -e 's/^VERSION.*/VERSION = release-${version}/g' \
+      -e '/GeoLite2-Country.mmdb.gz/d' \
+      -e '/fetch-geoip-db.sh/d' \
+      Makefile
    substituteInPlace thirdparty/configure-native-deps.sh --replace "locations=\"" "locations=\"${lua}/lib "
-    substituteInPlace Makefile --replace "@./thirdparty/fetch-geoip-db.sh" ""
  '';

  preConfigure = ''
@ -41,63 +49,6 @@ in stdenv.mkDerivation rec {
    make version
  '';

-  preBuild = let dotnetPackagesDlls = with dotnetPackages; [
-    "${OpenNAT}/lib/dotnet/Open.NAT/net45/Open.Nat.dll"
-    "${MonoNat}/lib/dotnet/Mono.Nat/net40/Mono.Nat.dll"
-    "${FuzzyLogicLibrary}/lib/dotnet/FuzzyLogicLibrary/Release/FuzzyLogicLibrary.dll"
-    "${SmartIrc4net}/lib/dotnet/SmartIrc4net/net40/SmarIrc4net*"
-    "${SharpZipLib}/lib/dotnet/SharpZipLib/20/ICSharpCode.SharpZipLib.dll"
-    "${MaxMindGeoIP2}/lib/dotnet/MaxMind.GeoIP2/net40/MaxMind.GeoIP2*"
-    "${MaxMindDb}/lib/dotnet/MaxMind.Db/net40/MaxMind.Db.*"
-    "${SharpFont}/lib/dotnet/SharpFont/net20/SharpFont.dll"
-    "${SharpFont}/lib/dotnet/SharpFont/SharpFont.dll.config"
-    "${StyleCopMSBuild}/lib/dotnet/StyleCop.MSBuild/StyleCop*.dll"
-    "${StyleCopPlusMSBuild}/lib/dotnet/StyleCopPlus.MSBuild/StyleCopPlus.dll"
-    "${RestSharp}/lib/dotnet/RestSharp/net4-client/RestSharp.dll"
-    "${NUnit}/lib/dotnet/NUnit/nunit.framework.*"
-    "${NUnitConsole}/lib/dotnet/NUnit.Console/*"
-    "${NewtonsoftJson}/lib/dotnet/Newtonsoft.Json/Newtonsoft.Json.dll"
-    ];
-    movePackages = [
-      ( let filename = "Eluant.dll"; in { origin = fetchurl {
-          url = "https://github.com/OpenRA/Eluant/releases/download/20160124/${filename}";
-          sha256 = "1c20whz7dzfhg3szd62rvb79745x5iwrd5pp62j3bbj1q9wpddmb";
-        }; target = filename; })
-
-      ( let filename = "SDL2-CS.dll"; in { origin = fetchurl {
-          url = "https://github.com/OpenRA/SDL2-CS/releases/download/20151227/${filename}";
-          sha256 = "0gqw2wg37cqhhlc2a9lfc4ndkyfi4m8bkv7ckxbawgydjlknq83n";
-        }; target = filename; })
-
-      ( let filename = "SDL2-CS.dll.config"; in { origin = fetchurl {
-          url = "https://github.com/OpenRA/SDL2-CS/releases/download/20151227/${filename}";
-          sha256 = "15709iscdg44wd33szw5y0fdxwvqfjw8v3xjq6a0mm46gr7mkw7g";
-        }; target = filename; })
-
-      ( let filename = "OpenAL-CS.dll"; in { origin = fetchurl {
-          url = "https://github.com/OpenRA/OpenAL-CS/releases/download/20151227/${filename}";
-          sha256 = "0lvyjkn7fqys97wym8rwlcp6ay2z059iabfvlcxhlrscjpyr2cyk";
-        }; target = filename; })
-
-      ( let filename = "OpenAL-CS.dll.config"; in { origin = fetchurl {
-          url = "https://github.com/OpenRA/OpenAL-CS/releases/download/20151227/${filename}";
-          sha256 = "0wcmk3dw26s93598ck5jism5609v0y233i0f1b76yilyfimg9sjq";
-        }; target = filename; })
-
-      ( let filename = "GeoLite2-Country.mmdb.gz"; in { origin = fetchurl {
-          url = "http://geolite.maxmind.com/download/geoip/database/${filename}";
-          sha256 = "0a82v0sj4zf5vigrn1pd6mnbqz6zl3rgk9nidqqzy836as2kxk9v";
-        }; target = filename; })
-    ];
-  in ''
-    mkdir thirdparty/download/
-
-    ${stdenv.lib.concatMapStringsSep "\n" (from: "cp -r ${from} thirdparty/download") dotnetPackagesDlls}
-    ${stdenv.lib.concatMapStringsSep "\n" ({origin, target}: "cp ${origin} thirdparty/download/${target}") movePackages}
-
-    make dependencies
-  '';
-
  buildFlags = [ "DEBUG=false" "default" "man-page" ];

  doCheck = true;
@ -109,14 +60,13 @@ in stdenv.mkDerivation rec {

  postInstall = with stdenv.lib; let
    runtime = makeLibraryPath [ SDL2 freetype openal systemd lua ];
+    binaries= makeBinPath [ which mono gnome3.zenity ];
  in ''
    wrapProgram $out/lib/openra/launch-game.sh \
-      --prefix PATH : "${mono}/bin" \
-      --set PWD $out/lib/openra/ \
+      --prefix PATH : "${binaries}" \
      --prefix LD_LIBRARY_PATH : "${runtime}"

    mkdir -p $out/bin
-    echo -e "#!${stdenv.shell}\ncd $out/lib/openra && $out/lib/openra/launch-game.sh" > $out/bin/openra
-    chmod +x $out/bin/openra
+    makeWrapper $out/lib/openra/launch-game.sh $out/bin/openra --run "cd $out/lib/openra"
  '';
 }
--- a/pkgs/os-specific/linux/musl/default.nix
+++ b/pkgs/os-specific/linux/musl/default.nix
@ -2,17 +2,17 @@

 stdenv.mkDerivation rec {
  name    = "musl-${version}";
-  version = "1.1.16";
+  version = "1.1.17";

  src = fetchurl {
    url    = "http://www.musl-libc.org/releases/${name}.tar.gz";
-    sha256 = "048h0w4yjyza4h05bkc6dpwg3hq6l03na46g0q1ha8fpwnjqawck";
+    sha256 = "0r0lyp2w6v2bvm8h1si7w3p2qx037szl14qnxm5p00568z3m3an8";
  };

  enableParallelBuilding = true;

-  # required to avoid busybox segfaulting on startup when invoking
-  # nix-build "<nixpkgs/pkgs/stdenv/linux/make-bootstrap-tools.nix>"
+  # Disable auto-adding stack protector flags,
+  # so musl can selectively disable as needed
  hardeningDisable = [ "stackprotector" ];

  preConfigure = ''
@ -22,6 +22,7 @@ stdenv.mkDerivation rec {
  configureFlags = [
    "--enable-shared"
    "--enable-static"
+    "CFLAGS=-fstack-protector-strong"
  ];

  patches = [];
--- a/pkgs/os-specific/linux/spl/default.nix
+++ b/pkgs/os-specific/linux/spl/default.nix
@ -68,8 +68,8 @@ in
    };

    splUnstable = common {
-      version = "2017-09-26";
-      rev = "e8474f9ad3b3d23c3277535c4f53f8fd1e6cbd74";
-      sha256 = "0251cnffgx98nckgz6imwa8dnvba44wc02aacmr1n430gmq72xra";
+      version = "2017-10-16";
+      rev = "28920ea3346c1c905c5f727ea3e54297e6257568";
+      sha256 = "0m42na009ivb9q9gz15ra94wqx5xdw18waanm56aqzrjxbqqa3ll";
    };
 }
--- a/pkgs/os-specific/linux/zfs/default.nix
+++ b/pkgs/os-specific/linux/zfs/default.nix
@ -2,7 +2,7 @@
 , configFile ? "all"

 # Userspace dependencies
-, zlib, libuuid, python, attr
+, zlib, libuuid, python, attr, openssl

 # Kernel dependencies
 , kernel ? null, spl ? null, splUnstable ? null
@ -41,7 +41,8 @@ let
      nativeBuildInputs = [ autoreconfHook nukeReferences ];
      buildInputs =
           optionals buildKernel [ spl ]
-        ++ optionals buildUser [ zlib libuuid python attr ];
+        ++ optionals buildUser [ zlib libuuid python attr ]
+        ++ optionals (buildUser && isUnstable) [ openssl ];

      # for zdb to get the rpath to libgcc_s, needed for pthread_cancel to work
      NIX_CFLAGS_LINK = "-lgcc_s";
@ -158,10 +159,10 @@ in {
    incompatibleKernelVersion = null;

    # this package should point to a version / git revision compatible with the latest kernel release
-    version = "2017-09-26";
+    version = "2017-10-16";

-    rev = "7e98073379353a05498ac5a2f1a5df2a2257d6b0";
-    sha256 = "1hydfhmngpq31gxkxipqxnin74l760d1ia202h12vsgix9sp32h7";
+    rev = "7670f721fc82e6cdcdd31f83760a79b6f2f2b998";
+    sha256 = "0ask9d9936s7mhs9q5wzvn6c8fd322i76hs2n7fajfk17b1a1lkj";
    isUnstable = true;

    extraPatches = [
--- a/pkgs/servers/uftp/default.nix
+++ b/pkgs/servers/uftp/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name = "uftp-${version}";
-  version = "4.9.3";
+  version = "4.9.4";

  src = fetchurl {
    url = "mirror://sourceforge/uftp-multicast/source-tar/uftp-${version}.tar.gz";
-    sha256 = "13y7k6g6jksnllw0mwgzw4dqczh5c5hvq3zlqin7q98m0fpib4ly";
+    sha256 = "1npfl7n1w2l0j6c6iizw1szzq0lz9wy6jb55qmwhfkzwj0zd7mqp";
  };

  buildInputs = [ openssl ];
--- a/pkgs/tools/audio/liquidsoap/full.nix
+++ b/pkgs/tools/audio/liquidsoap/full.nix
@ -1,5 +1,5 @@
 { stdenv, fetchurl, which, pkgconfig
-, ocaml, ocamlPackages
+, ocamlPackages
 , libao, portaudio, alsaLib, libpulseaudio, libjack2
 , libsamplerate, libmad, taglib, lame, libogg
 , libvorbis, speex, libtheora, libopus, fdk_aac
@ -26,7 +26,7 @@ stdenv.mkDerivation {
  configureFlags = [ "--localstatedir=/var" ];

  buildInputs =
-    [ which ocaml ocamlPackages.findlib pkgconfig
+    [ which ocamlPackages.ocaml ocamlPackages.findlib pkgconfig
      libao portaudio alsaLib libpulseaudio libjack2
      libsamplerate libmad taglib lame libogg
      libvorbis speex libtheora libopus fdk_aac
@ -40,6 +40,6 @@ stdenv.mkDerivation {
    homepage = http://liquidsoap.fm/;
    maintainers = with maintainers; [ ehmry ];
    license = licenses.gpl2;
-    platforms = ocaml.meta.platforms or [];
+    platforms = ocamlPackages.ocaml.meta.platforms or [];
  };
 }
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@ -161,12 +161,12 @@ in rec {

  nixUnstable = (lib.lowPrio (common rec {
    name = "nix-1.12${suffix}";
-    suffix = "pre5655_cbc21691";
+    suffix = "pre5663_c7af84ce";
    src = fetchFromGitHub {
      owner = "NixOS";
      repo = "nix";
-      rev = "cbc216911dbda23c3bc050c969bc725fe60760ef";
-      sha256 = "0ynnk2m2n5pjmhy5gry90dy5k2wwy29v2wnq6zz32ak9zwz36x8r";
+      rev = "c7af84ce846a9deefa5b4db1b1bce1c091ca2a1e";
+      sha256 = "1sc6rkx0500jz4fyfqm7443s1q24whmpx10mfs12wdk516f0q8qh";
    };
    fromGit = true;
  })) // { perl-bindings = perl-bindings { nix = nixUnstable; }; };
--- a/pkgs/tools/typesetting/tex/texlive/bin.nix
+++ b/pkgs/tools/typesetting/tex/texlive/bin.nix
@ -187,6 +187,7 @@ core-big = stdenv.mkDerivation { #TODO: upmendex
  '';

  preBuild = "cd texk/web2c";
+  CXXFLAGS = "-std=c++11 -Wno-reserved-user-defined-literal"; # TODO: remove once texlive 2017 is out?
  enableParallelBuilding = true;

  # now distribute stuff into outputs, roughly as upstream TL
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -1149,9 +1149,7 @@ with pkgs;

  nfdump = callPackage ../tools/networking/nfdump { };

-  patdiff = callPackage ../tools/misc/patdiff {
-    ocamlPackages = ocamlPackages_4_03;
-  };
+  patdiff = callPackage ../tools/misc/patdiff { };

  playerctl = callPackage ../tools/audio/playerctl { };

@ -2243,6 +2241,8 @@ with pkgs;

  git-latexdiff = callPackage ../tools/typesetting/git-latexdiff { };

+  gitea = callPackage ../applications/version-management/gitea { };
+
  glusterfs = callPackage ../tools/filesystems/glusterfs { };

  glmark2 = callPackage ../tools/graphics/glmark2 { };
@ -2893,6 +2893,7 @@ with pkgs;

  liquidsoap = callPackage ../tools/audio/liquidsoap/full.nix {
    ffmpeg = ffmpeg_2;
+    ocamlPackages = ocamlPackages_4_02;
  };

  lksctp-tools = callPackage ../os-specific/linux/lksctp-tools { };
@ -4379,7 +4380,7 @@ with pkgs;

  skippy-xd = callPackage ../tools/X11/skippy-xd {};

-  sks = callPackage ../servers/sks { inherit (ocamlPackages) ocaml camlp4; };
+  sks = callPackage ../servers/sks { inherit (ocamlPackages_4_02) ocaml camlp4; };

  skydns = callPackage ../servers/skydns { };

@ -4623,6 +4624,8 @@ with pkgs;

  timetrap = callPackage ../applications/office/timetrap { };

+  tzupdate = callPackage ../applications/misc/tzupdate { };
+
  tinc = callPackage ../tools/networking/tinc { };

  tie = callPackage ../development/tools/misc/tie { };
@ -6145,9 +6148,7 @@ with pkgs;

  ocaml-top = callPackage ../development/tools/ocaml/ocaml-top { };

-  ocsigen-i18n = callPackage ../development/tools/ocaml/ocsigen-i18n {
-    ocamlPackages = ocamlPackages_4_03;
-  };
+  ocsigen-i18n = callPackage ../development/tools/ocaml/ocsigen-i18n { };

  opa = callPackage ../development/compilers/opa {
    nodejs = nodejs-4_x;
@ -6286,6 +6287,7 @@ with pkgs;
  };

  teyjus = callPackage ../development/compilers/teyjus {
+    inherit (ocamlPackages_4_02) ocaml;
    omake = omake_rc1;
  };

@ -7187,10 +7189,12 @@ with pkgs;
  flow = callPackage ../development/tools/analysis/flow {
    inherit (darwin.apple_sdk.frameworks) CoreServices;
    inherit (darwin) cf-private;
-    inherit (ocamlPackages_4_03) ocaml findlib camlp4 sedlex ocamlbuild;
+    inherit (ocamlPackages) ocaml findlib camlp4 sedlex ocamlbuild;
  };

-  framac = callPackage ../development/tools/analysis/frama-c { };
+  framac = callPackage ../development/tools/analysis/frama-c {
+    ocamlPackages = ocamlPackages_4_03;
+  };

  frame = callPackage ../development/libraries/frame { };

@ -7412,9 +7416,7 @@ with pkgs;
  noweb = callPackage ../development/tools/literate-programming/noweb { };
  nuweb = callPackage ../development/tools/literate-programming/nuweb { tex = texlive.combined.scheme-small; };

-  obelisk = callPackage ../development/tools/ocaml/obelisk {
-    ocamlPackages = ocaml-ng.ocamlPackages_4_03;
-  };
+  obelisk = callPackage ../development/tools/ocaml/obelisk { };

  obuild = callPackage ../development/tools/ocaml/obuild { };

@ -7534,7 +7536,9 @@ with pkgs;

  selendroid = callPackage ../development/tools/selenium/selendroid { };

-  scons = callPackage ../development/tools/build-managers/scons { };
+  sconsPackages = callPackage ../development/tools/build-managers/scons { };
+  scons = sconsPackages.scons_3_0_0;
+  scons_2_5_1 = sconsPackages.scons_2_5_1;

  sbt = callPackage ../development/tools/build-managers/sbt { };
  sbt-with-scala-native = callPackage ../development/tools/build-managers/sbt/scala-native.nix { };
@ -11063,6 +11067,8 @@ with pkgs;

  xvidcore = callPackage ../development/libraries/xvidcore { };

+  xxHash = callPackage ../development/libraries/xxHash {};
+
  xylib = callPackage ../development/libraries/xylib { };

  yajl = callPackage ../development/libraries/yajl { };
@ -15422,7 +15428,7 @@ with pkgs;
    bison = bison2;
  };

-  llpp = ocaml-ng.ocamlPackages_4_04.callPackage ../applications/misc/llpp { };
+  llpp = ocaml-ng.ocamlPackages.callPackage ../applications/misc/llpp { };

  lmms = callPackage ../applications/audio/lmms {
    stdenv = overrideCC stdenv gcc5;
@ -15924,7 +15930,7 @@ with pkgs;

  opusTools = callPackage ../applications/audio/opus-tools { };

-  orpie = callPackage ../applications/misc/orpie { gsl = gsl_1; };
+  orpie = callPackage ../applications/misc/orpie { gsl = gsl_1; ocamlPackages = ocamlPackages_4_02; };

  osmo = callPackage ../applications/office/osmo { };

@ -16575,7 +16581,7 @@ with pkgs;

  stalonetray = callPackage ../applications/window-managers/stalonetray {};

-  inherit (ocamlPackages_4_03) stog;
+  inherit (ocamlPackages) stog;

  stp = callPackage ../applications/science/logic/stp {};

@ -18501,9 +18507,7 @@ with pkgs;

  abella = callPackage ../applications/science/logic/abella {};

-  acgtk = callPackage ../applications/science/logic/acgtk {
-    ocamlPackages = ocamlPackages_4_03;
-  };
+  acgtk = callPackage ../applications/science/logic/acgtk { };

  alt-ergo = callPackage ../applications/science/logic/alt-ergo {
    ocamlPackages = ocamlPackages_4_02;
@ -18604,7 +18608,9 @@ with pkgs;
  };
  cvc4 = callPackage ../applications/science/logic/cvc4 {};

-  ekrhyper = callPackage ../applications/science/logic/ekrhyper {};
+  ekrhyper = callPackage ../applications/science/logic/ekrhyper {
+    inherit (ocamlPackages_4_02) ocaml;
+  };

  eprover = callPackage ../applications/science/logic/eprover { };

@ -18635,7 +18641,9 @@ with pkgs;
    java = if stdenv.isLinux then jre else jdk;
  };

-  iprover = callPackage ../applications/science/logic/iprover {};
+  iprover = callPackage ../applications/science/logic/iprover {
+    inherit (ocamlPackages_4_02) ocaml;
+  };

  jonprl = callPackage ../applications/science/logic/jonprl {
    smlnj = if stdenv.isDarwin
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@ -98,7 +98,10 @@ let
    camlzip = callPackage ../development/ocaml-modules/camlzip { };

    camomile_0_8_2 = callPackage ../development/ocaml-modules/camomile/0.8.2.nix { };
-    camomile = callPackage ../development/ocaml-modules/camomile { };
+    camomile =
+      if lib.versionOlder "4.03" ocaml.version
+      then callPackage ../development/ocaml-modules/camomile { }
+      else callPackage ../development/ocaml-modules/camomile/0.8.5.nix { };

    camlimages_4_0 =
      if lib.versionOlder "4.02" ocaml.version
@ -986,5 +989,5 @@ in rec

  ocamlPackages_latest = ocamlPackages_4_05;

-  ocamlPackages = ocamlPackages_4_02;
+  ocamlPackages = ocamlPackages_4_04;
 }
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -535,6 +535,8 @@ in {
    };
  } else null;

+  python-fontconfig = callPackage ../development/python-modules/python-fontconfig { };
+
  funcsigs = callPackage ../development/python-modules/funcsigs { };

  APScheduler = callPackage ../development/python-modules/APScheduler { };
@ -1669,6 +1671,8 @@ in {

  csvkit =  callPackage ../development/python-modules/csvkit { };

+  cufflinks = callPackage ../development/python-modules/cufflinks { };
+
  cx_Freeze = callPackage ../development/python-modules/cx_freeze {};

  cvxopt = buildPythonPackage rec {
@ -2932,6 +2936,8 @@ in {

  colorama = callPackage ../development/python-modules/colorama { };

+  colorlover = callPackage ../development/python-modules/colorlover { };
+
  CommonMark = buildPythonPackage rec {
    name = "CommonMark-${version}";
    version = "0.6.3";
@ -6671,14 +6677,15 @@ in {
    };
  };

-  python-mapnik = buildPythonPackage {
-    name = "python-mapnik-git-2016-08-30";
+  python-mapnik = buildPythonPackage rec {
+    name = "python-mapnik-${version}";
+    version = "3.0.13";

    src = pkgs.fetchFromGitHub {
      owner = "mapnik";
      repo = "python-mapnik";
-      rev = "541fd962d4fc99d50ec472af6ddccfdbf98cff37";
-      sha256 = "1d93qjnzggdpbhnmxlmk5jh0zd2jnpfl4n4aip5ypd39ilqibhf3";
+      rev = "v${version}";
+      sha256 = "0biw9bfkbsgfyjihyvkj4abx9s9r3h81rk6dc1y32022rypsqhkp";
    };

    disabled = isPyPy;