Merge branch 'master' into staging

Let's drop i686-linux here as well.
2024-11-01 23:22:37 +00:00 · 2017-08-06 10:03:25 +02:00 · 2017-08-06 10:03:25 +02:00 · f779df87b1
commit f779df87b1
parent 8fcb070363 e619ace733
215 changed files with 7009 additions and 2160 deletions
--- a/doc/functions.xml
+++ b/doc/functions.xml
@ -358,8 +358,8 @@
 <para>
  <varname>pkgs.dockerTools</varname> is a set of functions for creating and
  manipulating Docker images according to the
-  <link xlink:href="https://github.com/docker/docker/blob/master/image/spec/v1.md#docker-image-specification-v100">
-  Docker Image Specification v1.0.0
+  <link xlink:href="https://github.com/moby/moby/blob/master/image/spec/v1.2.md#docker-image-specification-v120">
+  Docker Image Specification v1.2.0
  </link>. Docker itself is not used to perform any of the operations done by these
  functions.
 </para>
@ -493,8 +493,8 @@
    <varname>config</varname> is used to specify the configuration of the
    containers that will be started off the built image in Docker.
    The available options are listed in the
-    <link xlink:href="https://github.com/docker/docker/blob/master/image/spec/v1.md#container-runconfig-field-descriptions">
-      Docker Image Specification v1.0.0
+    <link xlink:href="https://github.com/moby/moby/blob/master/image/spec/v1.2.md#image-json-field-descriptions">
+      Docker Image Specification v1.2.0
    </link>.
    </para>
  </callout>
--- a/lib/maintainers.nix
+++ b/lib/maintainers.nix
@ -215,6 +215,7 @@
  gilligan = "Tobias Pflug <tobias.pflug@gmail.com>";
  giogadi = "Luis G. Torres <lgtorres42@gmail.com>";
  gleber = "Gleb Peregud <gleber.p@gmail.com>";
+  glenns = "Glenn Searby <glenn.searby@gmail.com>";
  globin = "Robin Gloster <mail@glob.in>";
  gnidorah = "Alex Ivanov <yourbestfriend@opmbx.org>";
  goibhniu = "Cillian de Róiste <cillian.deroiste@gmail.com>";
@ -314,6 +315,7 @@
  lihop = "Leroy Hopson <nixos@leroy.geek.nz>";
  linquize = "Linquize <linquize@yahoo.com.hk>";
  linus = "Linus Arver <linusarver@gmail.com>";
+  lluchs = "Lukas Werling <lukas.werling@gmail.com>";
  lnl7 = "Daiderd Jordan <daiderd@gmail.com>";
  loskutov = "Ignat Loskutov <ignat.loskutov@gmail.com>";
  lovek323 = "Jason O'Conal <jason@oconal.id.au>";
@ -377,6 +379,7 @@
  MostAwesomeDude = "Corbin Simpson <cds@corbinsimpson.com>";
  mounium = "Katona László <muoniurn@gmail.com>";
  MP2E = "Cray Elliott <MP2E@archlinux.us>";
+  mpcsh = "Mark Cohen <m@mpc.sh>";
  mpscholten = "Marc Scholten <marc@mpscholten.de>";
  mpsyco = "Francis St-Amour <fr.st-amour@gmail.com>";
  msackman = "Matthew Sackman <matthew@wellquite.org>";
@ -510,6 +513,7 @@
  samuelrivas = "Samuel Rivas <samuelrivas@gmail.com>";
  sander = "Sander van der Burg <s.vanderburg@tudelft.nl>";
  sargon = "Daniel Ehlers <danielehlers@mindeye.net>";
+  sauyon = "Sauyon Lee <s@uyon.co>";
  schmitthenner = "Fabian Schmitthenner <development@schmitthenner.eu>";
  schneefux = "schneefux <schneefux+nixos_pkg@schneefux.xyz>";
  schristo = "Scott Christopher <schristopher@konputa.com>";
@ -631,6 +635,7 @@
  zauberpony = "Elmar Athmer <elmar@athmer.org>";
  zef = "Zef Hemel <zef@zef.me>";
  zimbatm = "zimbatm <zimbatm@zimbatm.com>";
+  Zimmi48 = "Théo Zimmermann <theo.zimmermann@univ-paris-diderot.fr>";
  zohl = "Al Zohali <zohl@fmap.me>";
  zoomulator = "Kim Simmons <zoomulator@gmail.com>";
  zraexy = "David Mell <zraexy@gmail.com>";
--- a/nixos/doc/manual/man-nixos-option.xml
+++ b/nixos/doc/manual/man-nixos-option.xml
@ -17,11 +17,16 @@
 <refsynopsisdiv>
  <cmdsynopsis>
    <command>nixos-option</command>
-    <arg choice='plain'><replaceable>option.name</replaceable></arg>
+    <arg>
+      <option>-I</option>
+      <replaceable>path</replaceable>
+    </arg>
+    <arg><option>--verbose</option></arg>
+    <arg><option>--xml</option></arg>
+    <arg choice="plain"><replaceable>option.name</replaceable></arg>
  </cmdsynopsis>
 </refsynopsisdiv>

-
 <refsection><title>Description</title>

 <para>This command evaluates the configuration specified in
@ -33,6 +38,45 @@ attributes contained in the attribute set.</para>

 </refsection>

+<refsection><title>Options</title>
+
+<para>This command accepts the following options:</para>
+
+<variablelist>
+
+  <varlistentry>
+    <term><option>-I</option> <replaceable>path</replaceable></term>
+    <listitem>
+      <para>
+        This option is passed to the underlying
+        <command>nix-instantiate</command> invocation.
+      </para>
+    </listitem>
+  </varlistentry>
+
+  <varlistentry>
+    <term><option>--verbose</option></term>
+    <listitem>
+      <para>
+        This option enables verbose mode, which currently is just
+        the Bash <command>set</command> <option>-x</option> debug mode.
+      </para>
+    </listitem>
+  </varlistentry>
+
+  <varlistentry>
+    <term><option>--xml</option></term>
+    <listitem>
+      <para>
+        This option causes the output to be rendered as XML.
+      </para>
+    </listitem>
+  </varlistentry>
+
+</variablelist>
+
+</refsection>
+
 <refsection><title>Environment</title>

 <variablelist>
--- a/nixos/doc/manual/release-notes/rl-1709.xml
+++ b/nixos/doc/manual/release-notes/rl-1709.xml
@ -130,6 +130,30 @@ rmdir /var/lib/ipfs/.ipfs
      instead. Refer to the description of the options for more details.
    </para>
  </listitem>
+  <listitem>
+    <para>
+      <literal>tlsdate</literal> package and module were removed. This is due to the project
+      being dead and not building with openssl 1.1.
+    </para>
+  </listitem>
+  <listitem>
+    <para>
+      <literal>wvdial</literal> package and module were removed. This is due to the project
+      being dead and not building with openssl 1.1.
+    </para>
+  </listitem>
+  <listitem>
+    <para>
+      <literal>cc-wrapper</literal>'s setup-hook now exports a number of
+      environment variables corresponding to binutils binaries,
+      (e.g. <envar>LD</envar>, <envar>STRIP</envar>, <envar>RANLIB</envar>,
+      etc). This is done to prevent packages' build systems guessing, which is
+      harder to predict, especially when cross-compiling. However, some packages
+      have broken due to this—their build systems either not supporting, or
+      claiming to support without adequate testing, taking such environment
+      variables as parameters.
+    </para>
+  </listitem>
 </itemizedlist>

 <para>Other notable improvements:</para>
--- a/nixos/modules/config/nsswitch.nix
+++ b/nixos/modules/config/nsswitch.nix
@ -28,7 +28,8 @@ let
  passwdArray = [ "files" ]
    ++ optional sssd "sss"
    ++ optionals ldap [ "ldap" ]
-    ++ optionals mymachines [ "mymachines" ];
+    ++ optionals mymachines [ "mymachines" ]
+    ++ [ "systemd" ];

  shadowArray = [ "files" ]
    ++ optional sssd "sss"
--- a/nixos/modules/config/pulseaudio.nix
+++ b/nixos/modules/config/pulseaudio.nix
@ -224,7 +224,7 @@ in {
      # Allow PulseAudio to get realtime priority using rtkit.
      security.rtkit.enable = true;

-      systemd.packages = [ cfg.package ];
+      systemd.packages = [ overriddenPackage ];
    })

    (mkIf hasZeroconf {
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -105,7 +105,6 @@
  ./programs/venus.nix
  ./programs/vim.nix
  ./programs/wireshark.nix
-  ./programs/wvdial.nix
  ./programs/xfs_quota.nix
  ./programs/xonsh.nix
  ./programs/zsh/oh-my-zsh.nix
@ -517,7 +516,6 @@
  ./services/networking/teamspeak3.nix
  ./services/networking/tinc.nix
  ./services/networking/tftpd.nix
-  ./services/networking/tlsdated.nix
  ./services/networking/tox-bootstrapd.nix
  ./services/networking/toxvpn.nix
  ./services/networking/tvheadend.nix
--- a/nixos/modules/programs/gnupg.nix
+++ b/nixos/modules/programs/gnupg.nix
@ -92,7 +92,7 @@ in
    '');

    assertions = [
-      { assertion = cfg.agent.enableSSHSupport && !config.programs.ssh.startAgent;
+      { assertion = cfg.agent.enableSSHSupport -> !config.programs.ssh.startAgent;
        message = "You can't use ssh-agent and GnuPG agent with SSH support enabled at the same time!";
      }
    ];
--- a/nixos/modules/programs/wvdial.nix
+++ b/nixos/modules/programs/wvdial.nix
@ -1,71 +0,0 @@
-# Global configuration for wvdial.
-
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let
-
-  configFile = ''
-    [Dialer Defaults]
-    PPPD PATH = ${pkgs.ppp}/sbin/pppd
-    ${config.environment.wvdial.dialerDefaults}
-  '';
-
-  cfg = config.environment.wvdial;
-
-in
-{
-  ###### interface
-
-  options = {
-
-    environment.wvdial = {
-
-      dialerDefaults = mkOption {
-        default = "";
-        type = types.str;
-        example = ''Init1 = AT+CGDCONT=1,"IP","internet.t-mobile"'';
-        description = ''
-          Contents of the "Dialer Defaults" section of
-          <filename>/etc/wvdial.conf</filename>.
-        '';
-      };
-
-      pppDefaults = mkOption {
-        default = ''
-          noipdefault
-          usepeerdns
-          defaultroute
-          persist
-          noauth
-        '';
-        type = types.str;
-        description = "Default ppp settings for wvdial.";
-      };
-
-    };
-
-  };
-
-  ###### implementation
-
-  config = mkIf (cfg.dialerDefaults != "") {
-
-    environment = {
-
-      etc =
-      [
-        { source = pkgs.writeText "wvdial.conf" configFile;
-          target = "wvdial.conf";
-        }
-        { source = pkgs.writeText "wvdial" cfg.pppDefaults;
-          target = "ppp/peers/wvdial";
-        }
-      ];
-
-    };
-
-  };
-
-}
--- a/nixos/modules/services/networking/avahi-daemon.nix
+++ b/nixos/modules/services/networking/avahi-daemon.nix
@ -22,6 +22,7 @@ let
    ${optionalString (interfaces!=null) "allow-interfaces=${concatStringsSep "," interfaces}"}
    ${optionalString (domainName!=null) "domain-name=${domainName}"}
    allow-point-to-point=${yesNo allowPointToPoint}
+    ${optionalString (cacheEntriesMax!=null) "cache-entries-max=${toString cacheEntriesMax}"}

    [wide-area]
    enable-wide-area=${yesNo wideArea}
@ -166,6 +167,15 @@ in
        '';
      };

+      cacheEntriesMax = mkOption {
+        default = null;
+        type = types.nullOr types.int;
+        description = ''
+          Number of resource records to be cached per interface. Use 0 to
+          disable caching. Avahi daemon defaults to 4096 if not set.
+        '';
+      };
+
    };

  };
--- a/nixos/modules/services/networking/nat.nix
+++ b/nixos/modules/services/networking/nat.nix
@ -48,7 +48,7 @@ let
    # NAT from external ports to internal ports.
    ${concatMapStrings (fwd: ''
      iptables -w -t nat -A nixos-nat-pre \
-        -i ${cfg.externalInterface} -p tcp \
+        -i ${cfg.externalInterface} -p ${fwd.proto} \
        --dport ${builtins.toString fwd.sourcePort} \
        -j DNAT --to-destination ${fwd.destination}
    '') cfg.forwardPorts}
@ -133,12 +133,19 @@ in
          destination = mkOption {
            type = types.str;
            example = "10.0.0.1:80";
-            description = "Forward tcp connection to destination ip:port";
+            description = "Forward connection to destination ip:port";
+          };
+
+          proto = mkOption {
+            type = types.str;
+            default = "tcp";
+            example = "udp";
+            description = "Protocol of forwarded connection";
          };
        };
      });
      default = [];
-      example = [ { sourcePort = 8080; destination = "10.0.0.1:80"; } ];
+      example = [ { sourcePort = 8080; destination = "10.0.0.1:80"; proto = "tcp"; } ];
      description =
        ''
          List of forwarded ports from the external interface to
@ -151,38 +158,41 @@ in

  ###### implementation

-  config = mkIf config.networking.nat.enable {
+  config = mkMerge [
+    { networking.firewall.extraCommands = mkBefore flushNat; }
+    (mkIf config.networking.nat.enable {

-    environment.systemPackages = [ pkgs.iptables ];
+      environment.systemPackages = [ pkgs.iptables ];

-    boot = {
-      kernelModules = [ "nf_nat_ftp" ];
-      kernel.sysctl = {
-        "net.ipv4.conf.all.forwarding" = mkOverride 99 true;
-        "net.ipv4.conf.default.forwarding" = mkOverride 99 true;
-      };
-    };
-
-    networking.firewall = mkIf config.networking.firewall.enable {
-      extraCommands = mkMerge [ (mkBefore flushNat) setupNat ];
-      extraStopCommands = flushNat;
-    };
-
-    systemd.services = mkIf (!config.networking.firewall.enable) { nat = {
-      description = "Network Address Translation";
-      wantedBy = [ "network.target" ];
-      after = [ "network-pre.target" "systemd-modules-load.service" ];
-      path = [ pkgs.iptables ];
-      unitConfig.ConditionCapability = "CAP_NET_ADMIN";
-
-      serviceConfig = {
-        Type = "oneshot";
-        RemainAfterExit = true;
+      boot = {
+        kernelModules = [ "nf_nat_ftp" ];
+        kernel.sysctl = {
+          "net.ipv4.conf.all.forwarding" = mkOverride 99 true;
+          "net.ipv4.conf.default.forwarding" = mkOverride 99 true;
+        };
      };

-      script = flushNat + setupNat;
+      networking.firewall = mkIf config.networking.firewall.enable {
+        extraCommands = setupNat;
+        extraStopCommands = flushNat;
+      };

-      postStop = flushNat;
-    }; };
-  };
+      systemd.services = mkIf (!config.networking.firewall.enable) { nat = {
+        description = "Network Address Translation";
+        wantedBy = [ "network.target" ];
+        after = [ "network-pre.target" "systemd-modules-load.service" ];
+        path = [ pkgs.iptables ];
+        unitConfig.ConditionCapability = "CAP_NET_ADMIN";
+
+        serviceConfig = {
+          Type = "oneshot";
+          RemainAfterExit = true;
+        };
+
+        script = flushNat + setupNat;
+
+        postStop = flushNat;
+      }; };
+    })
+  ];
 }
--- a/nixos/modules/services/networking/tlsdated.nix
+++ b/nixos/modules/services/networking/tlsdated.nix
@ -1,111 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let
-  inherit (pkgs) coreutils tlsdate;
-
-  cfg = config.services.tlsdated;
-in
-
-{
-
-  ###### interface
-
-  options = {
-
-    services.tlsdated = {
-
-      enable = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          Enable tlsdated daemon.
-        '';
-      };
-
-      extraOptions = mkOption {
-        type = types.string;
-        default = "";
-        description = ''
-          Additional command line arguments to pass to tlsdated.
-        '';
-      };
-
-      sources = mkOption {
-        type = types.listOf (types.submodule {
-          options = {
-            host = mkOption {
-              type = types.string;
-              description = ''
-                Remote hostname.
-              '';
-            };
-            port = mkOption {
-              type = types.int;
-              description = ''
-                Remote port.
-              '';
-            };
-            proxy = mkOption {
-              type = types.nullOr types.string;
-              default = null;
-              description = ''
-                The proxy argument expects HTTP, SOCKS4A or SOCKS5 formatted as followed:
-
-                 http://127.0.0.1:8118
-                 socks4a://127.0.0.1:9050
-                 socks5://127.0.0.1:9050
-
-                The proxy support should not leak DNS requests and is suitable for use with Tor.
-              '';
-            };
-          };
-        });
-        default = [
-          {
-            host = "encrypted.google.com";
-            port = 443;
-            proxy = null;
-          }
-        ];
-        description = ''
-          You can list one or more sources to fetch time from.
-        '';
-      };
-
-    };
-
-  };
-
-  ###### implementation
-
-  config = mkIf cfg.enable {
-
-    # Make tools such as tlsdate available in the system path
-    environment.systemPackages = [ tlsdate ];
-
-    systemd.services.tlsdated = {
-      description = "tlsdated daemon";
-      wantedBy = [ "multi-user.target" ];
-      serviceConfig = {
-        # XXX because pkgs.tlsdate is compiled to run as nobody:nogroup, we
-        # hard-code base-path to /tmp and use PrivateTmp.
-        ExecStart = "${tlsdate}/bin/tlsdated -f ${pkgs.writeText "tlsdated.confg" ''
-          base-path /tmp
-
-          ${concatMapStrings (src: ''
-          source
-              host    ${src.host}
-              port    ${toString src.port}
-              proxy   ${if src.proxy == null then "none" else src.proxy}
-          end
-          '') cfg.sources}
-        ''} ${cfg.extraOptions}";
-        PrivateTmp = "yes";
-      };
-    };
-
-  };
-
-}
--- a/nixos/modules/services/networking/unifi.nix
+++ b/nixos/modules/services/networking/unifi.nix
@ -3,7 +3,12 @@ with lib;
 let
  cfg = config.services.unifi;
  stateDir = "/var/lib/unifi";
-  cmd = "@${pkgs.jre}/bin/java java -jar ${stateDir}/lib/ace.jar";
+  cmd = ''
+    @${pkgs.jre}/bin/java java \
+        ${optionalString (cfg.initialJavaHeapSize != null) "-Xms${(toString cfg.initialJavaHeapSize)}m"} \
+        ${optionalString (cfg.maximumJavaHeapSize != null) "-Xmx${(toString cfg.maximumJavaHeapSize)}m"} \
+        -jar ${stateDir}/lib/ace.jar
+  '';
  mountPoints = [
    {
      what = "${pkgs.unifi}/dl";
@ -58,6 +63,26 @@ in
      '';
    };

+    services.unifi.initialJavaHeapSize = mkOption {
+      type = types.nullOr types.int;
+      default = null;
+      example = 1024;
+      description = ''
+        Set the initial heap size for the JVM in MB. If this option isn't set, the
+        JVM will decide this value at runtime.
+      '';
+    };
+
+    services.unifi.maximumJavaHeapSize = mkOption {
+      type = types.nullOr types.int;
+      default = null;
+      example = 4096;
+      description = ''
+        Set the maximimum heap size for the JVM in MB. If this option isn't set, the
+        JVM will decide this value at runtime.
+      '';
+    };
+
  };

  config = mkIf cfg.enable {
@ -121,8 +146,8 @@ in

      serviceConfig = {
        Type = "simple";
-        ExecStart = "${cmd} start";
-        ExecStop = "${cmd} stop";
+        ExecStart = "${(removeSuffix "\n" cmd)} start";
+        ExecStop = "${(removeSuffix "\n" cmd)} stop";
        User = "unifi";
        PermissionsStartOnly = true;
        UMask = "0077";
--- a/nixos/modules/services/web-apps/atlassian/confluence.nix
+++ b/nixos/modules/services/web-apps/atlassian/confluence.nix
@ -6,7 +6,22 @@ let

  cfg = config.services.confluence;

-  pkg = pkgs.atlassian-confluence;
+  pkg = pkgs.atlassian-confluence.override (optionalAttrs cfg.sso.enable {
+    enableSSO = cfg.sso.enable;
+    crowdProperties = ''
+      application.name                        ${cfg.sso.applicationName}
+      application.password                    ${cfg.sso.applicationPassword}
+      application.login.url                   ${cfg.sso.crowd}/console/
+
+      crowd.server.url                        ${cfg.sso.crowd}/services/
+      crowd.base.url                          ${cfg.sso.crowd}/
+
+      session.isauthenticated                 session.isauthenticated
+      session.tokenkey                        session.tokenkey
+      session.validationinterval              ${toString cfg.sso.validationInterval}
+      session.lastvalidation                  session.lastvalidation
+    '';
+  });

 in

@ -76,6 +91,42 @@ in
        };
      };

+      sso = {
+        enable = mkEnableOption "SSO with Atlassian Crowd";
+
+        crowd = mkOption {
+          type = types.str;
+          example = "http://localhost:8095/crowd";
+          description = "Crowd Base URL without trailing slash";
+        };
+
+        applicationName = mkOption {
+          type = types.str;
+          example = "jira";
+          description = "Exact name of this Confluence instance in Crowd";
+        };
+
+        applicationPassword = mkOption {
+          type = types.str;
+          description = "Application password of this Confluence instance in Crowd";
+        };
+
+        validationInterval = mkOption {
+          type = types.int;
+          default = 2;
+          example = 0;
+          description = ''
+            Set to 0, if you want authentication checks to occur on each
+            request. Otherwise set to the number of minutes between request
+            to validate if the user is logged in or out of the Crowd SSO
+            server. Setting this value to 1 or higher will increase the
+            performance of Crowd's integration.
+          '';
+        };
+      };
+
+
+
      jrePackage = let
        jreSwitch = unfree: free: if config.nixpkgs.config.allowUnfree or false then unfree else free;
      in mkOption {
--- a/nixos/modules/services/web-apps/atlassian/jira.nix
+++ b/nixos/modules/services/web-apps/atlassian/jira.nix
@ -6,7 +6,22 @@ let

  cfg = config.services.jira;

-  pkg = pkgs.atlassian-jira;
+  pkg = pkgs.atlassian-jira.override {
+    enableSSO = cfg.sso.enable;
+    crowdProperties = ''
+      application.name                        ${cfg.sso.applicationName}
+      application.password                    ${cfg.sso.applicationPassword}
+      application.login.url                   ${cfg.sso.crowd}/console/
+
+      crowd.server.url                        ${cfg.sso.crowd}/services/
+      crowd.base.url                          ${cfg.sso.crowd}/
+
+      session.isauthenticated                 session.isauthenticated
+      session.tokenkey                        session.tokenkey
+      session.validationinterval              ${toString cfg.sso.validationInterval}
+      session.lastvalidation                  session.lastvalidation
+    '';
+  };

 in

@ -82,6 +97,40 @@ in
        };
      };

+      sso = {
+        enable = mkEnableOption "SSO with Atlassian Crowd";
+
+        crowd = mkOption {
+          type = types.str;
+          example = "http://localhost:8095/crowd";
+          description = "Crowd Base URL without trailing slash";
+        };
+
+        applicationName = mkOption {
+          type = types.str;
+          example = "jira";
+          description = "Exact name of this JIRA instance in Crowd";
+        };
+
+        applicationPassword = mkOption {
+          type = types.str;
+          description = "Application password of this JIRA instance in Crowd";
+        };
+
+        validationInterval = mkOption {
+          type = types.int;
+          default = 2;
+          example = 0;
+          description = ''
+            Set to 0, if you want authentication checks to occur on each
+            request. Otherwise set to the number of minutes between request
+            to validate if the user is logged in or out of the Crowd SSO
+            server. Setting this value to 1 or higher will increase the
+            performance of Crowd's integration.
+          '';
+        };
+      };
+
      jrePackage = let
        jreSwitch = unfree: free: if config.nixpkgs.config.allowUnfree or false then unfree else free;
      in mkOption {
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@ -36,6 +36,11 @@ let
    http {
      include ${cfg.package}/conf/mime.types;
      include ${cfg.package}/conf/fastcgi.conf;
+      include ${cfg.package}/conf/uwsgi_params;
+
+      ${optionalString (cfg.resolver.addresses != []) ''
+        resolver ${toString cfg.resolver.addresses} ${optionalString (cfg.resolver.valid != "") "valid=${cfg.resolver.valid}"};
+      ''}

      ${optionalString (cfg.recommendedOptimisation) ''
        # optimisation
@ -116,6 +121,7 @@ let
    http {
      include ${cfg.package}/conf/mime.types;
      include ${cfg.package}/conf/fastcgi.conf;
+      include ${cfg.package}/conf/uwsgi_params;
      ${cfg.httpConfig}
    }''}

@ -383,6 +389,32 @@ in
        description = "Path to DH parameters file.";
      };

+      resolver = mkOption {
+        type = types.submodule {
+          options = {
+            addresses = mkOption {
+              type = types.listOf types.str;
+              default = [];
+              example = literalExample ''[ "[::1]" "127.0.0.1:5353" ]'';
+              description = "List of resolvers to use";
+            };
+            valid = mkOption {
+              type = types.str;
+              default = "";
+              example = "30s";
+              description = ''
+                By default, nginx caches answers using the TTL value of a response.
+                An optional valid parameter allows overriding it
+              '';
+            };
+          };
+        };
+        description = ''
+          Configures name servers used to resolve names of upstream servers into addresses
+        '';
+        default = {};
+      };
+
      virtualHosts = mkOption {
        type = types.attrsOf (types.submodule (import ./vhost-options.nix {
          inherit config lib;
--- a/nixos/modules/services/x11/desktop-managers/gnome3.nix
+++ b/nixos/modules/services/x11/desktop-managers/gnome3.nix
@ -176,7 +176,7 @@ in {

    services.xserver.updateDbusEnvironment = true;

-    environment.variables.GIO_EXTRA_MODULES = [ "${gnome3.dconf}/lib/gio/modules"
+    environment.variables.GIO_EXTRA_MODULES = [ "${lib.getLib gnome3.dconf}/lib/gio/modules"
                                                "${gnome3.glib_networking.out}/lib/gio/modules"
                                                "${gnome3.gvfs}/lib/gio/modules" ];
    environment.systemPackages = gnome3.corePackages ++ cfg.sessionPath
--- a/nixos/modules/system/activation/top-level.nix
+++ b/nixos/modules/system/activation/top-level.nix
@ -141,6 +141,7 @@ in
    system.build = mkOption {
      internal = true;
      default = {};
+      type = types.attrs;
      description = ''
        Attribute set of derivations used to setup the system.
      '';
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@ -593,7 +593,7 @@ in
    services.logind.extraConfig = mkOption {
      default = "";
      type = types.lines;
-      example = "HandleLidSwitch=ignore";
+      example = "IdleAction=lock";
      description = ''
        Extra config options for systemd-logind. See man logind.conf for
        available options.
--- a/nixos/modules/virtualisation/xen-dom0.nix
+++ b/nixos/modules/virtualisation/xen-dom0.nix
@ -16,6 +16,7 @@ in
    virtualisation.xen.enable =
      mkOption {
        default = false;
+        type = types.bool;
        description =
          ''
            Setting this option enables the Xen hypervisor, a
--- a/nixos/release-combined.nix
+++ b/nixos/release-combined.nix
@ -4,7 +4,8 @@

 { nixpkgs ? { outPath = ./..; revCount = 56789; shortRev = "gfedcba"; }
 , stableBranch ? false
-, supportedSystems ? [ "x86_64-linux" "i686-linux" ]
+, supportedSystems ? [ "x86_64-linux" ]
+, limitedSupportedSystems ? [ "i686-linux" ]
 }:

 let
@ -19,10 +20,16 @@ let
      else pkgs.lib.mapAttrs (n: v: removeMaintainers v) set
    else set;

+  allSupportedNixpkgs = builtins.removeAttrs (removeMaintainers (import ../pkgs/top-level/release.nix {
+    supportedSystems = supportedSystems ++ limitedSupportedSystems;
+    nixpkgs = nixpkgsSrc;
+  })) [ "unstable" ];
+
 in rec {

  nixos = removeMaintainers (import ./release.nix {
-    inherit stableBranch supportedSystems;
+    inherit stableBranch;
+    supportedSystems = supportedSystems ++ limitedSupportedSystems;
    nixpkgs = nixpkgsSrc;
  });

@ -38,8 +45,11 @@ in rec {
      maintainers = [ pkgs.lib.maintainers.eelco ];
    };
    constituents =
-      let all = x: map (system: x.${system}) supportedSystems; in
-      [ nixos.channel
+      let
+        all = x: map (system: x.${system})
+          (supportedSystems ++ limitedSupportedSystems);
+      in [
+        nixos.channel
        (all nixos.dummy)
        (all nixos.manual)

@ -106,8 +116,8 @@ in rec {
        (all nixos.tests.xfce)

        nixpkgs.tarball
-        (all nixpkgs.emacs)
-        (all nixpkgs.jdk)
+        (all allSupportedNixpkgs.emacs)
+        (all allSupportedNixpkgs.jdk)
      ];
  });

--- a/nixos/release.nix
+++ b/nixos/release.nix
@ -1,6 +1,6 @@
 { nixpkgs ? { outPath = ./..; revCount = 56789; shortRev = "gfedcba"; }
 , stableBranch ? false
-, supportedSystems ? [ "x86_64-linux" "i686-linux" ]
+, supportedSystems ? [ "x86_64-linux" ]
 }:

 with import ../lib;
--- a/nixos/tests/nat.nix
+++ b/nixos/tests/nat.nix
@ -6,6 +6,20 @@
 import ./make-test.nix ({ pkgs, lib, withFirewall, withConntrackHelpers ? false, ... }:
  let
    unit = if withFirewall then "firewall" else "nat";
+
+    routerBase =
+      lib.mkMerge [
+        { virtualisation.vlans = [ 2 1 ];
+          networking.firewall.enable = withFirewall;
+          networking.firewall.allowPing = true;
+          networking.nat.internalIPs = [ "192.168.1.0/24" ];
+          networking.nat.externalInterface = "eth1";
+        }
+        (lib.optionalAttrs withConntrackHelpers {
+          networking.firewall.connectionTrackingModules = [ "ftp" ];
+          networking.firewall.autoLoadConntrackHelpers = true;
+        })
+      ];
  in
  {
    name = "nat" + (if withFirewall then "WithFirewall" else "Standalone")
@ -30,20 +44,16 @@ import ./make-test.nix ({ pkgs, lib, withFirewall, withConntrackHelpers ? false,
          ];

        router =
-          { config, pkgs, ... }:
-          lib.mkMerge [
-            { virtualisation.vlans = [ 2 1 ];
-              networking.firewall.enable = withFirewall;
-              networking.firewall.allowPing = true;
-              networking.nat.enable = true;
-              networking.nat.internalIPs = [ "192.168.1.0/24" ];
-              networking.nat.externalInterface = "eth1";
-            }
-            (lib.optionalAttrs withConntrackHelpers {
-              networking.firewall.connectionTrackingModules = [ "ftp" ];
-              networking.firewall.autoLoadConntrackHelpers = true;
-            })
-          ];
+        { config, pkgs, ... }: lib.mkMerge [
+          routerBase
+          { networking.nat.enable = true; }
+        ];
+
+        routerDummyNoNat =
+        { config, pkgs, ... }: lib.mkMerge [
+          routerBase
+          { networking.nat.enable = false; }
+        ];

        server =
          { config, pkgs, ... }:
@ -57,9 +67,13 @@ import ./make-test.nix ({ pkgs, lib, withFirewall, withConntrackHelpers ? false,
      };

    testScript =
-      { nodes, ... }:
-      ''
-        startAll;
+      { nodes, ... }: let
+        routerDummyNoNatClosure = nodes.routerDummyNoNat.config.system.build.toplevel;
+        routerClosure = nodes.router.config.system.build.toplevel;
+      in ''
+        $client->start;
+        $router->start;
+        $server->start;

        # The router should have access to the server.
        $server->waitForUnit("network.target");
@ -87,13 +101,18 @@ import ./make-test.nix ({ pkgs, lib, withFirewall, withConntrackHelpers ? false,
        $router->succeed("ping -c 1 client >&2");

        # If we turn off NAT, the client shouldn't be able to reach the server.
-        $router->succeed("iptables -t nat -D PREROUTING -j nixos-nat-pre");
-        $router->succeed("iptables -t nat -D POSTROUTING -j nixos-nat-post");
+        $router->succeed("${routerDummyNoNatClosure}/bin/switch-to-configuration test 2>&1");
        $client->fail("curl --fail --connect-timeout 5 http://server/ >&2");
        $client->fail("ping -c 1 server >&2");

        # And make sure that reloading the NAT job works.
-        $router->succeed("systemctl restart ${unit}");
+        $router->succeed("${routerClosure}/bin/switch-to-configuration test 2>&1");
+        # FIXME: this should not be necessary, but nat.service is not started because
+        #        network.target is not triggered
+        #        (https://github.com/NixOS/nixpkgs/issues/16230#issuecomment-226408359)
+        ${lib.optionalString (!withFirewall) ''
+          $router->succeed("systemctl start nat.service");
+        ''}
        $client->succeed("curl --fail http://server/ >&2");
        $client->succeed("ping -c 1 server >&2");
      '';
--- a/pkgs/applications/audio/a2jmidid/default.nix
+++ b/pkgs/applications/audio/a2jmidid/default.nix
@ -8,8 +8,8 @@ in stdenv.mkDerivation rec {
  version = "8";

  src = fetchurl {
-    url = "http://download.gna.org/a2jmidid/${name}.tar.bz2";
-    sha256 = "0pzm0qk5ilqhwz74pydg1jwrds27vm47185dakdrxidb5bv3b5ia";
+    url = "http://repo.or.cz/a2jmidid.git/snapshot/7383d268c4bfe85df9f10df6351677659211d1ca.tar.gz";
+    sha256 = "06dgf5655znbvrd7fhrv8msv6zw8vk0hjqglcqkh90960mnnmwz7";
  };

  buildInputs = [ makeWrapper pkgconfig alsaLib dbus libjack2 python dbus-python ];
@ -24,7 +24,6 @@ in stdenv.mkDerivation rec {
  '';

  meta = with stdenv.lib; {
-    homepage = http://home.gna.org/a2jmidid;
    description = "Daemon for exposing legacy ALSA sequencer applications in JACK MIDI system";
    license = licenses.gpl2;
    maintainers = [ maintainers.goibhniu ];
--- a/pkgs/applications/audio/audio-recorder/default.nix
+++ b/pkgs/applications/audio/audio-recorder/default.nix
@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
  patches = [ ./icon-names.diff ];

  buildInputs = with gst_all_1; [
-    glib dbus gtk3 librsvg libdbusmenu-gtk3 libappindicator-gtk3 gnome3.dconf
+    glib dbus gtk3 librsvg libdbusmenu-gtk3 libappindicator-gtk3 (stdenv.lib.getLib gnome3.dconf)
    gstreamer gst-plugins-base gst-plugins-good gst-plugins-bad gst-plugins-ugly gst-libav
  ] ++ optional pulseaudioSupport libpulseaudio;

@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
  preFixup = ''
    gappsWrapperArgs+=('--prefix XDG_DATA_DIRS : "$out/share:$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH"'
      '--prefix GST_PLUGIN_SYSTEM_PATH_1_0 : "$GST_PLUGIN_SYSTEM_PATH_1_0"'
-      '--prefix GIO_EXTRA_MODULES : "${gnome3.dconf}/lib/gio/modules"')
+      '--prefix GIO_EXTRA_MODULES : "${stdenv.lib.getLib gnome3.dconf}/lib/gio/modules"')
  '';

  meta = with stdenv.lib; {
--- a/pkgs/applications/audio/bitwig-studio/default.nix
+++ b/pkgs/applications/audio/bitwig-studio/default.nix
@ -6,11 +6,11 @@

 stdenv.mkDerivation rec {
  name = "bitwig-studio-${version}";
-  version = "2.0";
+  version = "2.1.3";

  src = fetchurl {
    url = "https://downloads.bitwig.com/stable/${version}/bitwig-studio-${version}.deb";
-    sha256 = "1m7wdr0f9xi9s7q8vd66hy7fj1k0j3y5ln2yqbjwr76r9g6gkzas";
+    sha256 = "0blfw7dayl1wzys11mdixlkbr1p1d5rnwrvim1hblfpnw2zmlslb";
  };

  nativeBuildInputs = [ dpkg makeWrapper ];
@ -80,6 +80,9 @@ stdenv.mkDerivation rec {
    ln -s $out/libexec/bitwig-studio $out/bin/bitwig-studio

    cp -r usr/share $out/share
+    substitute usr/share/applications/bitwig-studio.desktop \
+      $out/share/applications/bitwig-studio.desktop \
+      --replace /usr/bin/bitwig-studio $out/bin/bitwig-studio
  '';

  meta = with stdenv.lib; {
--- a/pkgs/applications/audio/clementine/clementine-1.2.1-include-paths.patch
+++ b/pkgs/applications/audio/clementine/clementine-1.2.1-include-paths.patch
@ -1,14 +0,0 @@
-diff -ur clementine-1.2.1-a/CMakeLists.txt clementine-1.2.1-b/CMakeLists.txt
--- clementine-1.2.1-a/CMakeLists.txt	2013-11-25 15:16:24.000000000 -0600
-+++ clementine-1.2.1-b/CMakeLists.txt	2013-12-30 17:01:48.470011058 -0600
-@@ -158,6 +158,10 @@
- include_directories(${TAGLIB_INCLUDE_DIRS})
- include_directories(${QJSON_INCLUDE_DIRS})
- include_directories(${GSTREAMER_INCLUDE_DIRS})
-+include_directories(${GSTREAMER_APP_INCLUDE_DIRS})
-+include_directories(${GSTREAMER_BASE_INCLUDE_DIRS})
-+include_directories(${GSTREAMER_CDDA_INCLUDE_DIRS})
-+include_directories(${GSTREAMER_TAG_INCLUDE_DIRS})
- include_directories(${GLIB_INCLUDE_DIRS})
- include_directories(${GLIBCONFIG_INCLUDE_DIRS})
- include_directories(${LIBXML_INCLUDE_DIRS})
--- a/pkgs/applications/audio/clementine/clementine-dbus-namespace.patch
+++ b/pkgs/applications/audio/clementine/clementine-dbus-namespace.patch
@ -1,36 +0,0 @@
-From ec580cb815c16ec1ab43a469d5af7d51d8d03082 Mon Sep 17 00:00:00 2001
-From: Chocobozzz <florian.chocobo@gmail.com>
-Date: Wed, 16 Jul 2014 15:57:25 +0200
-Subject: [PATCH] No namespaces for DBus interfaces. Fixes #4401
-
---
- src/CMakeLists.txt | 9 ++++-----
- 1 file changed, 4 insertions(+), 5 deletions(-)
-
-diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
-index 650fa74..775b0a5 100644
--- a/src/CMakeLists.txt
-+++ b/src/CMakeLists.txt
-@@ -892,11 +892,6 @@ optional_source(LINUX SOURCES widgets/osd_x11.cpp)
- if(HAVE_DBUS)
-   file(MAKE_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}/dbus)
- 
-  # Hack to get it to generate interfaces without namespaces - required
-  # because otherwise org::freedesktop::UDisks and
-  # org::freedesktop::UDisks::Device conflict.
-  list(APPEND QT_DBUSXML2CPP_EXECUTABLE -N)
-
-   # MPRIS DBUS interfaces
-   qt4_add_dbus_adaptor(SOURCES
-       dbus/org.freedesktop.MediaPlayer.player.xml
-@@ -964,6 +959,10 @@ if(HAVE_DBUS)
- 
-   # DeviceKit DBUS interfaces
-   if(HAVE_DEVICEKIT)
-+    set_source_files_properties(dbus/org.freedesktop.UDisks.xml
-+        PROPERTIES NO_NAMESPACE dbus/udisks)
-+    set_source_files_properties(dbus/org.freedesktop.UDisks.Device.xml
-+        PROPERTIES NO_NAMESPACE dbus/udisksdevice)
-     qt4_add_dbus_interface(SOURCES
-         dbus/org.freedesktop.UDisks.xml
-         dbus/udisks)
--- a/pkgs/applications/audio/clementine/clementine-spotify-blob-remove-from-build.patch
+++ b/pkgs/applications/audio/clementine/clementine-spotify-blob-remove-from-build.patch
@ -0,0 +1,21 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 23070d9..83b6772 100644
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -275,8 +275,6 @@ optional_component(LIBPULSE ON "Pulse audio integration"
+ optional_component(VISUALISATIONS ON "Visualisations")
+ 
+ if(NOT HAVE_SPOTIFY_BLOB AND NOT CRYPTOPP_FOUND)
+-  message(FATAL_ERROR "Either crypto++ must be available or the non-GPL Spotify "
+-          "code must be compiled in")
+ elseif(CRYPTOPP_FOUND)
+   set(HAVE_CRYPTOPP ON)
+   set(HAVE_SPOTIFY_DOWNLOADER ON)
+@@ -434,7 +432,6 @@ if(HAVE_BREAKPAD)
+ endif(HAVE_BREAKPAD)
+ 
+ if(HAVE_SPOTIFY_BLOB)
+-  add_subdirectory(ext/clementine-spotifyblob)
+ endif(HAVE_SPOTIFY_BLOB)
+ 
+ if(HAVE_MOODBAR)
--- a/pkgs/applications/audio/clementine/clementine-spotify-blob.patch
+++ b/pkgs/applications/audio/clementine/clementine-spotify-blob.patch
@ -1,25 +1,13 @@
-From d9ebe7ec09a48b1ea505ccc33686b72642f083f4 Mon Sep 17 00:00:00 2001
-From: Thomas Tuegel <ttuegel@gmail.com>
-Date: Mon, 4 May 2015 19:59:38 -0500
-Subject: [PATCH] Runtime selection of Spotify blob
-
---
- src/internet/spotifyservice.cpp | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/internet/spotifyservice.cpp b/src/internet/spotifyservice.cpp
-index 543744e..d987a36 100644
--- a/src/internet/spotifyservice.cpp
-+++ b/src/internet/spotifyservice.cpp
-@@ -65,7 +65,7 @@ SpotifyService::SpotifyService(Application* app, InternetModel* parent)
+diff --git a/src/internet/spotify/spotifyservice.cpp b/src/internet/spotify/spotifyservice.cpp
+index 88c7383..6e0893c 100644
+--- a/src/internet/spotify/spotifyservice.cpp
+++ b/src/internet/spotify/spotifyservice.cpp
+@@ -94,7 +94,7 @@ SpotifyService::SpotifyService(Application* app, InternetModel* parent)
   system_blob_path_ = QCoreApplication::applicationDirPath() +
-       "/../PlugIns/clementine-spotifyblob";
+                       "/../PlugIns/clementine-spotifyblob";
 #else
 -  system_blob_path_ = QCoreApplication::applicationDirPath() +
 +  system_blob_path_ = qgetenv("CLEMENTINE_SPOTIFYBLOB") +
-       "/clementine-spotifyblob" CMAKE_EXECUTABLE_SUFFIX;
+                       "/clementine-spotifyblob" CMAKE_EXECUTABLE_SUFFIX;
 #endif
 
-- 
-2.3.6
-
--- a/pkgs/applications/audio/clementine/default.nix
+++ b/pkgs/applications/audio/clementine/default.nix
@ -1,7 +1,7 @@
-{ stdenv, fetchurl, boost, cmake, gettext, gstreamer, gst-plugins-base
-, liblastfm, qt4, taglib, fftw, glew, qjson, sqlite, libgpod, libplist
-, usbmuxd, libmtp, gvfs, libcdio, libspotify, protobuf, qca2, pkgconfig
-, sparsehash, config, makeWrapper, runCommand, gst_plugins }:
+{ stdenv, fetchurl, boost, cmake, chromaprint, gettext, gst_all_1, liblastfm
+, qt4, taglib, fftw, glew, qjson, sqlite, libgpod, libplist, usbmuxd, libmtp
+, libpulseaudio, gvfs, libcdio, libechonest, libspotify, pcre, protobuf
+, qca2, pkgconfig, sparsehash, config, makeWrapper, runCommand, gst_plugins }:

 let
  withSpotify = config.clementine.spotify or false;
@ -10,31 +10,36 @@ let
  withCD = config.clementine.cd or true;
  withCloud = config.clementine.cloud or true;

-  version = "1.2.3";
+  version = "1.3.1";

  exeName = "clementine";

  src = fetchurl {
-    url = https://github.com/clementine-player/Clementine/archive/1.2.3.tar.gz;
-    sha256 = "1gx1109i4pylz6x7gvp4rdzc6dvh0w6in6hfbygw01d08l26bxbx";
+    url = https://github.com/clementine-player/Clementine/archive/1.3.1.tar.gz;
+    sha256 = "0z7k73wyz54c3020lb6x2dgw0vz4ri7wcl3vs03qdj5pk8d971gq";
  };

  patches = [
-    ./clementine-1.2.1-include-paths.patch
-    ./clementine-dbus-namespace.patch
    ./clementine-spotify-blob.patch
+    # Required so as to avoid adding libspotify as a build dependency (as it is 
+    # unfree and thus would prevent us from having a free package).
+    ./clementine-spotify-blob-remove-from-build.patch
  ];

  buildInputs = [
    boost
    cmake
+    chromaprint
    fftw
    gettext
    glew
-    gst-plugins-base
-    gstreamer
+    gst_all_1.gst-plugins-base
+    gst_all_1.gstreamer
    gvfs
+    libechonest
    liblastfm
+    libpulseaudio
+    pcre
    pkgconfig
    protobuf
    qca2
@ -71,7 +76,12 @@ let
  blob = stdenv.mkDerivation {
    name = "clementine-blob-${version}";
    # Use the same patches and sources as Clementine
-    inherit patches src;
+    inherit src;
+
+    patches = [
+      ./clementine-spotify-blob.patch
+    ];
+
    buildInputs = buildInputs ++ [ libspotify ];
    # Only build and install the Spotify blob
    preBuild = ''
@ -119,7 +129,7 @@ runCommand "clementine-${version}"
  mkdir -p $out/bin
  makeWrapper "$free/bin/${exeName}" "$out/bin/${exeName}" \
      ${optionalString withSpotify "--set CLEMENTINE_SPOTIFYBLOB \"$blob/libexec/clementine\""} \
-      --prefix GST_PLUGIN_SYSTEM_PATH : "$GST_PLUGIN_SYSTEM_PATH"
+      --prefix GST_PLUGIN_SYSTEM_PATH_1_0 : "$GST_PLUGIN_SYSTEM_PATH_1_0"

  mkdir -p $out/share
  for dir in applications icons kde4; do
--- a/pkgs/applications/audio/drumgizmo/default.nix
+++ b/pkgs/applications/audio/drumgizmo/default.nix
@ -20,7 +20,7 @@ stdenv.mkDerivation rec {

  meta = with stdenv.lib; {
    description = "An LV2 sample based drum plugin";
-    homepage = http://www.drumgizmo.org;
+    homepage = https://www.drumgizmo.org;
    license = licenses.lgpl3;
    platforms = platforms.linux;
    maintainers = [ maintainers.goibhniu maintainers.nico202 ];
--- a/pkgs/applications/audio/easytag/default.nix
+++ b/pkgs/applications/audio/easytag/default.nix
@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
  preFixup = ''
    wrapProgram $out/bin/easytag \
      --prefix XDG_DATA_DIRS : "$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH:$out/share" \
-      --prefix GIO_EXTRA_MODULES : "${gnome3.dconf}/lib/gio/modules"
+      --prefix GIO_EXTRA_MODULES : "${stdenv.lib.getLib gnome3.dconf}/lib/gio/modules"
  '';

  NIX_LDFLAGS = "-lid3tag -lz";
@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [ makeWrapper pkgconfig intltool ];
  buildInputs = [
    gtk3 glib libid3tag id3lib taglib libvorbis libogg flac
-    itstool libxml2 gsettings_desktop_schemas gnome3.defaultIconTheme gnome3.dconf
+    itstool libxml2 gsettings_desktop_schemas gnome3.defaultIconTheme (stdenv.lib.getLib gnome3.dconf)
  ];

  meta = with stdenv.lib; {
--- a/pkgs/applications/audio/mixxx/default.nix
+++ b/pkgs/applications/audio/mixxx/default.nix
@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
  '';

  meta = with stdenv.lib; {
-    homepage = http://mixxx.org;
+    homepage = https://mixxx.org;
    description = "Digital DJ mixing software";
    license = licenses.gpl2Plus;
    maintainers = [ maintainers.aszlig maintainers.goibhniu ];
--- a/pkgs/applications/audio/sound-juicer/default.nix
+++ b/pkgs/applications/audio/sound-juicer/default.nix
@ -17,7 +17,7 @@ in stdenv.mkDerivation rec {

  buildInputs = [ pkgconfig gtk3 intltool itstool libxml2 brasero libcanberra_gtk3
                  gnome3.gsettings_desktop_schemas libmusicbrainz5 libdiscid isocodes
-                  makeWrapper gnome3.dconf
+                  makeWrapper (stdenv.lib.getLib gnome3.dconf)
                  gst_all_1.gstreamer gst_all_1.gst-plugins-base
                  gst_all_1.gst-plugins-good gst_all_1.gst-plugins-bad
                  gst_all_1.gst-libav
@ -28,7 +28,7 @@ in stdenv.mkDerivation rec {
      wrapProgram "$f" \
        --prefix XDG_DATA_DIRS : "${gnome3.gnome_themes_standard}/share:$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH" \
        --prefix GST_PLUGIN_SYSTEM_PATH_1_0 : "$GST_PLUGIN_SYSTEM_PATH_1_0" \
-        --prefix GIO_EXTRA_MODULES : "${gnome3.dconf}/lib/gio/modules"
+        --prefix GIO_EXTRA_MODULES : "${stdenv.lib.getLib gnome3.dconf}/lib/gio/modules"
    done
  '';

--- a/pkgs/applications/editors/jetbrains/default.nix
+++ b/pkgs/applications/editors/jetbrains/default.nix
@ -268,12 +268,12 @@ in

  idea-community = buildIdea rec {
    name = "idea-community-${version}";
-    version = "2017.2";
+    version = "2017.2.1";
    description = "Integrated Development Environment (IDE) by Jetbrains, community edition";
    license = stdenv.lib.licenses.asl20;
    src = fetchurl {
      url = "https://download.jetbrains.com/idea/ideaIC-${version}.tar.gz";
-      sha256 = "0z5abj41f5l9ilznr34lm4fsivrl2yjdxb2kdcis5abij6zl0g3f";
+      sha256 = "1z8gp209jpjzvllnrpxzmbhgaxkklxw8nkm3g2drb7nal2hhs113";
    };
    wmClass = "jetbrains-idea-ce";
    update-channel = "IDEA_Release";
--- a/pkgs/applications/graphics/processing/default.nix
+++ b/pkgs/applications/graphics/processing/default.nix
@ -31,7 +31,7 @@ stdenv.mkDerivation rec {

  meta = with stdenv.lib; {
    description = "A language and IDE for electronic arts";
-    homepage = http://processing.org;
+    homepage = https://processing.org;
    license = licenses.gpl2Plus;
    maintainers = [ maintainers.goibhniu ];
    platforms = platforms.linux;
--- a/pkgs/applications/misc/bashSnippets/default.nix
+++ b/pkgs/applications/misc/bashSnippets/default.nix
@ -1,10 +1,9 @@
 { stdenv, lib, fetchFromGitHub, makeWrapper
-, curl, netcat, mpv, python, bind, iproute, bc, gitMinimal }:
+, curl, netcat, python, bind, iproute, bc, gitMinimal }:
 let
-  version = "1.12.0";
+  version = "1.17.3";
  deps = lib.makeBinPath [
    curl
-    mpv
    python
    bind.dnsutils
    iproute
@ -19,7 +18,7 @@ stdenv.mkDerivation {
    owner = "alexanderepstein";
    repo = "Bash-Snippets";
    rev = "v${version}";
-    sha256 = "0kx2a8z3jbmmardw9z8fpghbw5mrbz4knb3wdihq35iarcbrddrg";
+    sha256 = "1xdjk8bjh7l6h7gdqrra1dh4wdq89wmd0jsirsvqa3bmcsb2wz1r";
  };

  buildInputs = [ makeWrapper ];
@ -32,7 +31,7 @@ stdenv.mkDerivation {
  dontBuild = true;

  installPhase = ''
-    mkdir -p "$out"/bin "$out"/man/man1
+    mkdir -p "$out"/bin "$out"/share/man/man1
    ./install.sh all
    for file in "$out"/bin/*; do
      wrapProgram "$file" --prefix PATH : "${deps}"
--- a/pkgs/applications/misc/blender/default.nix
+++ b/pkgs/applications/misc/blender/default.nix
@ -69,7 +69,7 @@ stdenv.mkDerivation rec {

  meta = with stdenv.lib; {
    description = "3D Creation/Animation/Publishing System";
-    homepage = http://www.blender.org;
+    homepage = https://www.blender.org;
    # They comment two licenses: GPLv2 and Blender License, but they
    # say: "We've decided to cancel the BL offering for an indefinite period."
    license = licenses.gpl2Plus;
--- a/pkgs/applications/misc/finalterm/default.nix
+++ b/pkgs/applications/misc/finalterm/default.nix
@ -42,7 +42,7 @@ stdenv.mkDerivation {
  postFixup = ''
    wrapProgram "$out/bin/finalterm" \
      --prefix GI_TYPELIB_PATH : "$GI_TYPELIB_PATH" \
-      --prefix GIO_EXTRA_MODULES : "${gnome3.dconf}/lib/gio/modules" \
+      --prefix GIO_EXTRA_MODULES : "${getLib gnome3.dconf}/lib/gio/modules" \
      --prefix XDG_DATA_DIRS : "${gnome3.defaultIconTheme}/share:${gnome3.gtk.out}/share:$out/share:$GSETTINGS_SCHEMAS_PATH"
  '';

--- a/pkgs/applications/misc/hackrf/default.nix
+++ b/pkgs/applications/misc/hackrf/default.nix
@ -1,23 +1,25 @@
-{ stdenv, fetchgit, cmake, pkgconfig, libusb }:
+{ stdenv, fetchgit, cmake, pkgconfig, libusb, fftwSinglePrec }:

 stdenv.mkDerivation rec {
  name = "hackrf-${version}";
-  version = "2015.07.2";
+  version = "2017.02.1";

  src = fetchgit {
    url = "git://github.com/mossmann/hackrf";
    rev = "refs/tags/v${version}";
-    sha256 = "1mn11yz6hbkmvrbxj5vnp78m5dsny96821a9ffpvbdcwx3s2p23m";
+    sha256 = "16hd61icvzaciv7s9jpgm9c8q6m4mwvj97gxrb20sc65p5gjb7hv";
  };

  buildInputs = [
-    cmake pkgconfig libusb
+    cmake pkgconfig libusb fftwSinglePrec
  ];
-  
+
+  cmakeFlags = [ "-DUDEV_RULES_GROUP=plugdev" "-DUDEV_RULES_PATH=lib/udev/rules.d" ];
+
  preConfigure = ''
-    cd host  
+    cd host
  '';
-  
+
  meta = with stdenv.lib; {
    description = "An open source SDR platform";
    homepage = http://greatscottgadgets.com/hackrf/;
--- a/pkgs/applications/misc/mupdf/default.nix
+++ b/pkgs/applications/misc/mupdf/default.nix
@ -33,7 +33,7 @@ stdenv.mkDerivation rec {

  preConfigure = ''
    # Don't remove mujs because upstream version is incompatible
-    rm -rf thirdparty/{curl,freetype,glfw,harfbuzz,jbig2dec,jpeg,openjpeg,zlib}
+    rm -rf thirdparty/{curl,freetype,glfw,harfbuzz,jbig2dec,libjpeg,openjpeg,zlib}
  '';

  postInstall = ''
--- a/pkgs/applications/misc/ola/default.nix
+++ b/pkgs/applications/misc/ola/default.nix
@ -0,0 +1,29 @@
+{ stdenv, fetchFromGitHub, autoreconfHook, bison, flex, pkgconfig
+, libuuid, cppunit, protobuf, zlib, avahi, libmicrohttpd
+, perl, python3, python3Packages
+}:
+
+stdenv.mkDerivation rec {
+  name = "ola-${version}";
+  version = "0.10.4";
+
+  src = fetchFromGitHub {
+    owner = "OpenLightingProject";
+    repo = "ola";
+    rev = version;
+    sha256 = "1skb3dwpmsfdr8mp3rs80jmsr1bf78270d9bnd8h0pv8bkb8zvim";
+  };
+
+  nativeBuildInputs = [ autoreconfHook bison flex pkgconfig perl ];
+  buildInputs = [ libuuid cppunit protobuf zlib avahi libmicrohttpd python3 ];
+  propagatedBuildInputs = with python3Packages; [ protobuf3_2 numpy ];
+
+  configureFlags = [ "--enable-python-libs" ];
+
+  meta = with stdenv.lib; {
+    description = "A framework for controlling entertainment lighting equipment.";
+    maintainers = [ maintainers.globin ];
+    licenses = with licenses; [ lgpl21 gpl2Plus ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/applications/misc/qlcplus/default.nix
+++ b/pkgs/applications/misc/qlcplus/default.nix
@ -0,0 +1,38 @@
+{ stdenv, mkDerivation, fetchFromGitHub, qmake, pkgconfig, udev
+, qtmultimedia, qtscript, alsaLib, ola, libftdi1, libusb
+, libsndfile, libmad
+}:
+
+mkDerivation rec {
+  name = "qlcplus-${version}";
+  version = "4.11.0";
+
+  src = fetchFromGitHub {
+    owner = "mcallegari";
+    repo = "qlcplus";
+    rev = "QLC+_${version}";
+    sha256 = "0a45ww341yjx9k54j5s8b5wj83rgbwxkdvgy0v5jbbdf9m78ifrg";
+  };
+
+  nativeBuildInputs = [ qmake pkgconfig ];
+  buildInputs = [
+    udev qtmultimedia qtscript alsaLib ola libftdi1 libusb libsndfile libmad
+  ];
+
+  qmakeFlags = [ "INSTALLROOT=$(out)" ];
+
+  postPatch = ''
+    patchShebangs .
+    sed -i -e '/unix:!macx:INSTALLROOT += \/usr/d' \
+            -e "s@\$\$LIBSDIR/qt4/plugins@''${qtPluginPrefix}@" \
+            -e "s@/etc/udev/rules.d@''${out}/lib/udev@" \
+      variables.pri
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A free and cross-platform software to control DMX or analog lighting systems like moving heads, dimmers, scanners etc.";
+    maintainers = [ maintainers.globin ];
+    license = licenses.asl20;
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/applications/misc/synergy/default.nix
+++ b/pkgs/applications/misc/synergy/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, cmake, xlibsWrapper, libX11, libXi, libXtst, libXrandr
+{ stdenv, fetchFromGitHub, fetchpatch, cmake, xlibsWrapper, libX11, libXi, libXtst, libXrandr
 , xinput, curl, openssl, unzip }:

 with stdenv.lib;
@ -14,6 +14,8 @@ stdenv.mkDerivation rec {
    sha256 = "0ksgr9hkf09h54572p7k7b9zkfhcdb2g2d5x7ixxn028y8i3jyp3";
  };

+  patches = [ ./openssl-1.1.patch ];
+
  postPatch = ''
    ${unzip}/bin/unzip -d ext/gmock-1.6.0 ext/gmock-1.6.0.zip
    ${unzip}/bin/unzip -d ext/gtest-1.6.0 ext/gtest-1.6.0.zip
--- a/pkgs/applications/misc/synergy/openssl-1.1.patch
+++ b/pkgs/applications/misc/synergy/openssl-1.1.patch
@ -0,0 +1,18 @@
+--- a/src/lib/net/SecureSocket.cpp	2017-07-22 19:33:22.442645291 +0200
+++ b/src/lib/net/SecureSocket.cpp	2017-07-22 19:36:25.632595581 +0200
+@@ -805,9 +805,14 @@
+ 		showCipherStackDesc(sStack);
+ 	}
+ 
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
+ 	// m_ssl->m_ssl->session->ciphers is not forward compatable, In future release
+-	// of OpenSSL, it's not visible, need to use SSL_get_client_ciphers() instead
+	// of OpenSSL, it's not visible
+ 	STACK_OF(SSL_CIPHER) * cStack = m_ssl->m_ssl->session->ciphers;
+#else
+	// Use SSL_get_client_ciphers() for newer versions
+	STACK_OF(SSL_CIPHER) * cStack = SSL_get_client_ciphers(m_ssl->m_ssl);
+#endif
+ 		if (cStack == NULL) {
+ 		LOG((CLOG_DEBUG1 "remote cipher list not available"));
+ 	}
--- a/pkgs/applications/misc/vanitygen/default.nix
+++ b/pkgs/applications/misc/vanitygen/default.nix
@ -1,39 +0,0 @@
-{ fetchgit, stdenv, openssl, pcre }:
-
-stdenv.mkDerivation rec {
-  version = "0.21";
-  name = "vanitygen-${version}";
-
-  src = fetchgit {
-    url = "https://github.com/samr7/vanitygen";
-    rev = "refs/tags/${version}";
-    sha256  = "1vzfv74hhiyrrpvjca8paydx1ashgbgn5plzrx4swyzxy1xkamah";
-  };
-
-  buildInputs = [ openssl pcre ];
-
-  installPhase = ''
-    mkdir -p $out/bin
-    cp vanitygen $out/bin
-    cp keyconv $out/bin/vanitygen-keyconv
-  '';
-
-  meta = {
-      description = "Bitcoin vanity address generator";
-      longDescription= ''
-        Vanitygen can search for exact prefixes or regular expression
-        matches, so you can generate Bitcoin addresses that starts
-        with the needed mnemonic.
-
-        Vanitygen can generate regular bitcoin addresses, namecoin
-        addresses, and testnet addresses.
-
-        When searching for exact prefixes, vanitygen will ensure that
-        the prefix is possible, will provide a difficulty estimate,
-        and will run about 30% faster.
-      '';
-      homepage = https://github.com/samr7/vanitygen;
-      license = stdenv.lib.licenses.agpl3;
-      platforms = stdenv.lib.platforms.all;
-  };
-}
--- a/pkgs/applications/networking/browsers/dwb/default.nix
+++ b/pkgs/applications/networking/browsers/dwb/default.nix
@ -18,7 +18,7 @@ stdenv.mkDerivation {

  preFixup=''
    wrapProgram "$out/bin/dwb" \
-     --prefix GIO_EXTRA_MODULES : "${glib_networking.out}/lib/gio/modules:${dconf}/lib/gio/modules" \
+     --prefix GIO_EXTRA_MODULES : "${glib_networking.out}/lib/gio/modules:${stdenv.lib.getLib dconf}/lib/gio/modules" \
     --prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH:$out/share"
    wrapProgram "$out/bin/dwbem" \
     --prefix GIO_EXTRA_MODULES : "${glib_networking.out}/lib/gio/modules"
--- a/pkgs/applications/networking/browsers/vivaldi/default.nix
+++ b/pkgs/applications/networking/browsers/vivaldi/default.nix
@ -6,17 +6,18 @@
 , gstreamer, gst-plugins-base, libxml2
 , glib, gtk3, pango, gdk_pixbuf, cairo, atk, gnome3
 , nss, nspr
-, patchelf
+, patchelf, makeWrapper
+, proprietaryCodecs ? true, vivaldi-ffmpeg-codecs ? null
 }:

 stdenv.mkDerivation rec {
  name = "${product}-${version}";
  product = "vivaldi";
-  version = "1.10.867.38-1";
+  version = "1.10.867.48-1";

  src = fetchurl {
    url = "https://downloads.vivaldi.com/stable/${product}-stable_${version}_amd64.deb";
-    sha256 = "1h3iygzvw3rb5kmn0pam6gqy9baq6l630yllff1vnvychdg8d9vi";
+    sha256 = "1han45swvv0y2i2kg7xhml1wj5zyrf2c2hc5b07kqsjkfg9iz1lc";
  };

  unpackPhase = ''
@ -24,7 +25,7 @@ stdenv.mkDerivation rec {
    tar -xvf data.tar.xz
  '';

-  nativeBuildInputs = [ patchelf ];
+  nativeBuildInputs = [ patchelf makeWrapper ];

  buildInputs = [
    stdenv.cc.cc stdenv.cc.libc zlib libX11 libXt libXext libSM libICE libxcb
@ -32,7 +33,7 @@ stdenv.mkDerivation rec {
    atk alsaLib dbus_libs cups gtk3 gdk_pixbuf libexif ffmpeg systemd
    freetype fontconfig libXrender libuuid expat glib nss nspr
    gstreamer libxml2 gst-plugins-base pango cairo gnome3.gconf
-  ];
+  ] ++ stdenv.lib.optional proprietaryCodecs vivaldi-ffmpeg-codecs;

  libPath = stdenv.lib.makeLibraryPath buildInputs
    + stdenv.lib.optionalString (stdenv.is64bit)
@ -45,6 +46,10 @@ stdenv.mkDerivation rec {
      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
      --set-rpath "${libPath}" \
      opt/vivaldi/vivaldi-bin
+  '' + stdenv.lib.optionalString proprietaryCodecs ''
+    sed -i '/^VIVALDI_FFMPEG_FOUND/ a \
+    checkffmpeg "${vivaldi-ffmpeg-codecs}/lib/libffmpeg.so"' opt/vivaldi/vivaldi
+  '' + ''
    echo "Finished patching Vivaldi binaries"
  '';

@ -67,6 +72,8 @@ stdenv.mkDerivation rec {
        "$out"/opt/vivaldi/product_logo_''${d}.png \
        "$out"/share/icons/hicolor/''${d}x''${d}/apps/vivaldi.png
    done
+    wrapProgram "$out/bin/vivaldi" \
+      --suffix XDG_DATA_DIRS : ${gtk3}/share/gsettings-schemas/${gtk3.name}/
  '';

  meta = with stdenv.lib; {
--- a/pkgs/applications/networking/browsers/vivaldi/ffmpeg-codecs.nix
+++ b/pkgs/applications/networking/browsers/vivaldi/ffmpeg-codecs.nix
@ -0,0 +1,51 @@
+{ stdenv, fetchurl, fetchpatch
+, dbus_glib, gtk2, gtk3, libexif, libpulseaudio, libXScrnSaver, ninja, nss
+, pciutils, pkgconfig, python2, xdg_utils
+}:
+
+stdenv.mkDerivation rec {
+  name = "${product}-${version}";
+  product = "vivaldi-ffmpeg-codecs";
+  version = "59.0.3071.104";
+
+  src = fetchurl {
+    url = "https://commondatastorage.googleapis.com/chromium-browser-official/chromium-${version}.tar.xz";
+    sha512 = "419cf5bafa80f190cd301c2933502351929c1ef1d5cfedc720ce6762674a0e6af3b4246a8f92e0c29743420338b056061d4e7f9f4a4066a5bdd4d2ee8db3ddbf";
+  };
+
+  buildInputs = [ ];
+
+  nativeBuildInputs = [
+    dbus_glib gtk2 gtk3 libexif libpulseaudio libXScrnSaver ninja nss pciutils pkgconfig
+    python2 xdg_utils
+  ];
+
+  configurePhase = ''
+    runHook preConfigure
+
+    local args="ffmpeg_branding=\"ChromeOS\" proprietary_codecs=true enable_hevc_demuxing=true use_gconf=false use_gio=false use_gnome_keyring=false use_kerberos=false use_cups=false use_sysroot=false use_gold=false linux_use_bundled_binutils=false fatal_linker_warnings=false treat_warnings_as_errors=false is_clang=false is_component_build=true is_debug=false symbol_level=0"
+    python tools/gn/bootstrap/bootstrap.py -v -s --no-clean --gn-gen-args "$args"
+    out/Release/gn gen out/Release -v --args="$args"
+
+    runHook postConfigure
+  '';
+
+  buildPhase = ''
+    ninja -C out/Release -v libffmpeg.so
+  '';
+
+  dontStrip = true;
+
+  installPhase = ''
+    mkdir -p "$out/lib"
+    cp out/Release/libffmpeg.so "$out/lib/libffmpeg.so"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Additional support for proprietary codecs for Vivaldi";
+    homepage    = "https://ffmpeg.org/";
+    license     = licenses.lgpl21;
+    maintainers = with maintainers; [ lluchs ];
+    platforms   = [ "x86_64-linux" ];
+  };
+}
--- a/pkgs/applications/networking/browsers/vivaldi/update.sh
+++ b/pkgs/applications/networking/browsers/vivaldi/update.sh
@ -0,0 +1,38 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p libarchive curl common-updater-scripts
+
+set -eu -o pipefail
+
+cd "$(dirname "${BASH_SOURCE[0]}")"
+root=../../../../..
+export NIXPKGS_ALLOW_UNFREE=1
+
+version() {
+	(cd "$root" && nix-instantiate --eval --strict -A "$1.version" | tr -d '"')
+}
+
+vivaldi_version_old=$(version vivaldi)
+vivaldi_version=$(curl -sS https://vivaldi.com/download/ | sed -rne 's/.*vivaldi-stable_([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+-[0-9]+)_amd64\.deb.*/\1/p')
+
+if [[ "$vivaldi_version" = "$vivaldi_version_old" ]]; then
+	echo "nothing to do, vivaldi $vivaldi_version is current"
+	exit
+fi
+
+# Download vivaldi and save hash and file path.
+url="https://downloads.vivaldi.com/stable/vivaldi-stable_${vivaldi_version}_amd64.deb"
+mapfile -t prefetch < <(nix-prefetch-url --print-path "$url")
+hash=${prefetch[0]}
+path=${prefetch[1]}
+
+echo "vivaldi: $vivaldi_version_old -> $vivaldi_version"
+(cd "$root" && update-source-version vivaldi "$vivaldi_version" "$hash")
+
+# Check vivaldi-ffmpeg-codecs version.
+chromium_version_old=$(version vivaldi-ffmpeg-codecs)
+chromium_version=$(bsdtar xOf "$path" data.tar.xz | bsdtar xOf - ./opt/vivaldi/vivaldi-bin | strings | grep -A2 -i '^chrome\/' | grep '^[0-9]\+\.[0-9]\+\.[1-9][0-9]\+\.[0-9]\+')
+
+if [[ "$chromium_version" != "$chromium_version_old" ]]; then
+	echo "vivaldi-ffmpeg-codecs: $chromium_version_old -> $chromium_version"
+	(cd "$root" && update-source-version vivaldi-ffmpeg-codecs "$chromium_version")
+fi
--- a/pkgs/applications/networking/cluster/terraform/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/default.nix
@ -54,4 +54,16 @@ in {
    # checks are failing again
    doCheck = false;
  };
+
+  terraform_0_10_0 = generic {
+    version = "0.10.0";
+    sha256 = "1z6pmyfh4z5w8k2j46ancc0m9lsiq6d0m56nxj1kawb3n5q9dgds";
+    # remove debugging and the -dev postfix in the version
+    preBuild = ''
+      buildFlagsArray=(
+        -ldflags
+        "-X github.com/hashicorp/terraform/terraform.VersionPrerelease= -s -w"
+      )
+    '';
+  };
 }
--- a/pkgs/applications/networking/dropbox/default.nix
+++ b/pkgs/applications/networking/dropbox/default.nix
@ -24,11 +24,11 @@
 let
  # NOTE: When updating, please also update in current stable,
  # as older versions stop working
-  version = "30.4.22";
+  version = "31.4.25";
  sha256 =
    {
-      "x86_64-linux" = "0qc99j6hpd1k5bmvcll3rjglksrjw0mw2nrwj3s3kh55j6fy8a0r";
-      "i686-linux"   = "0zyl1q76cpwly4k7h4klnyrv50nyxi2wpz5sii1a00jbmr7snhab";
+      "x86_64-linux" = "02qla89gf7zawfk0kxd3xzr7vb91khj3p83bvh456ap51h0z5wzv";
+      "i686-linux"   = "0sfh24qyc91q6ssn8lrzfdsv4jjy0hvgizcq3y3fk46zaa7jjxr2";
    }."${stdenv.system}" or (throw "system ${stdenv.system} not supported");

  arch =
--- a/pkgs/applications/networking/gns3/gui.nix
+++ b/pkgs/applications/networking/gns3/gui.nix
@ -0,0 +1,34 @@
+{ stdenv, python34Packages, fetchFromGitHub }:
+
+# TODO: Python 3.6 was failing
+python34Packages.buildPythonPackage rec {
+  name = "${pname}-${version}";
+  pname = "gns3-gui";
+  version = "2.0.3";
+
+  src = fetchFromGitHub {
+    owner = "GNS3";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "10qp6430md8d0h2wamgfaq7pai59mqmcw6sw3i1gvb20m0avvsvb";
+  };
+
+  propagatedBuildInputs = with python34Packages; [
+    raven psutil jsonschema # tox for check
+    # Runtime dependencies
+    sip pyqt5
+  ];
+
+  doCheck = false; # Failing
+
+  meta = with stdenv.lib; {
+    description = "Graphical Network Simulator";
+    #longDescription = ''
+    #  ...
+    #'';
+    homepage = "https://www.gns3.com/";
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ primeos ];
+  };
+}
--- a/pkgs/applications/networking/instant-messengers/gale/default.nix
+++ b/pkgs/applications/networking/instant-messengers/gale/default.nix
@ -1,31 +0,0 @@
-{ stdenv, fetchFromGitHub, adns, boehmgc, openssl, automake, m4, autoconf
-, libtool, pkgconfig }:
-
-stdenv.mkDerivation {
-  name = "gale-1.1happy";
-
-  src = fetchFromGitHub {
-    owner = "grawity";
-    repo = "gale";
-    rev = "b34a67288e8bd6f0b51b60abb704858172a3665c";
-    sha256 = "19mcisxxqx70m059rqwv7wpmp94fgyckzjwywpmdqd7iwvppnsqf";
-  };
-
-  nativeBuildInputs = [ m4 libtool automake autoconf ];
-  buildInputs = [ boehmgc openssl adns pkgconfig ];
-
-  patches = [ ./gale-install.in.patch ];
-
-  preConfigure = ''
-    substituteInPlace configure.ac --replace \$\{sysconfdir\} /etc
-    ./bootstrap
-  '';
-  configureArgs = [ "--sysconfdir=/etc" ];
-
-  meta = with stdenv.lib; {
-    homepage = http://gale.org/;
-    description = "Chat/messaging system (server and client)";
-    platforms = platforms.all;
-    license = licenses.gpl2Plus;
-  };
-}
--- a/pkgs/applications/networking/instant-messengers/gale/gale-install.in.patch
+++ b/pkgs/applications/networking/instant-messengers/gale/gale-install.in.patch
@ -1,339 +0,0 @@
-diff --git a/gale-install.in b/gale-install.in
-index 50e8ad8..eec0ed2 100644
--- a/gale-install.in
-+++ b/gale-install.in
-@@ -29,22 +29,78 @@ testkey_stdin() {
- 	gkinfo -x 2>/dev/null | qgrep "^Public key: <$1>"
- }
- 
-if [ -n "$GALE_SYS_DIR" ]; then
-	SYS_DIR="$GALE_SYS_DIR"
-elif [ -n "$sysconfdir" ]; then
-	SYS_DIR="$sysconfdir/gale"
-+INST_SYS_DIR="$sysconfdir/gale"
-+
-+if [ `id -u` -eq 0 ]; then
-+	is_root=yes
-+	SYS_DIR=/etc/gale
-+else
-+	is_root=no
-+	SYS_DIR="$HOME/.gale"
-+fi
-+
-+if [ -f /etc/NIXOS ]; then
-+	is_nixos=yes
-+else
-+	is_nixos=no
-+fi
-+
-+if [ -u /run/wrappers/bin/gksign ]; then
-+	cat <<EOM
-+
-+Gale appears to have already been set up via the NixOS module system (check
-+/etc/nixos/configuration.nix).
-+
-+EOM
-+
-+	exit 0
-+fi
-+
-+if [ $is_root = yes ]; then
-+	cat <<EOM
-+
-+You are running gale-install as root, so I'm going to assume you want to set up
-+Gale for system-wide use.  Unfortunately, Gale expects to be able to run the
-+"gksign" program via setuid, and we can't change gksign's permissions once it's
-+already been installed because the Nix store is immutable by design.
-+
-+EOM
-+
-+	if [ $is_nixos = no ]; then
-+		cat <<EOM
-+
-+This isn't a NixOS system.  Gale can only be installed for a single user on
-+non-NixOS systems.  If you want a system-wide installation, you'll have to
-+install Gale the old-fashioned way.  Sorry.
-+
-+EOM
-+
-+		exit 1
-+	fi
-+	cat <<EOM
-+
-+This script will generate a domain key for you, and after you get it signed, you
-+can finish the setup process by configuring Gale via the NixOS module system
-+(i.e. /etc/nixos/configuration.nix).
-+
-+EOM
-+
- else
-	echo "Error: cannot locate Gale system configuration directory."
-	exit 1
-+	cat <<EOM
-+
-+Hi.  You are running gale-install as a normal user, so I'm going to assume you
-+want to set up Gale for your own (i.e. non-system-wide) use.
-+
-+EOM
-+
- fi
- 
-CONF="$SYS_DIR/conf"
- umask 022
-PATH="$bindir:$sbindir:$PATH:/usr/ucb"
-+PATH="$bindir:$sbindir:$PATH"
- export PATH
- 
-if [ -f "$CONF" ]; then
-	exec 3<"$CONF"
-+if [ -n "$SYS_DIR" ] && [ -f "$SYS_DIR/conf" ]; then
-+	exec 3<"$SYS_DIR/conf"
- 
- 	while read var value <&3 ; do
- 		case "$var" in
-@@ -58,52 +114,14 @@ if [ -f "$CONF" ]; then
- 	exec 3<&-
- fi
- 
-USER="`whoami`"
-if [ -z "$USER" ]; then
-	echo "Error: cannot determine your username."
-	exit 1
-fi
-
-# -----------------------------------------------------------------------------
-# check directory structure
-
-if [ ! -d "$SYS_DIR" ]; then
-	echo "Error: Invalid SYS_DIR: \"$SYS_DIR\"."
-	exit 1
-fi
-
- # -----------------------------------------------------------------------------
-# get settings for important variables: user, domain, server
-+# get settings for important variables: domain, server
- 
-[ -n "$CONF_GALE_USER" ] && GALE_USER="$CONF_GALE_USER"
- [ -n "$CONF_GALE_DOMAIN" ] && GALE_DOMAIN="$CONF_GALE_DOMAIN"
- [ -n "$CONF_GALE_SERVER" ] && GALE_SERVER="$CONF_GALE_SERVER"
- 
-if [ -z "$GALE_USER" ]; then
-cat << EOM
-
-Hi.  You need to denote a user to own the Gale domain secret key.  You must
-trust this user with Gale authentication for your domain; the "gksign" program
-will run as this user.  I recommend using a special "gale" user; if you don't
-have administrative privileges here, you'll probably have to use your own
-account.  I do not recommend the use of "root".
-
-No harm done if you stop this script now to set up such a user.
-
-EOM
-
-	printf "Enter the Gale username: "
-	read GALE_USER
-	if [ -z "$GALE_USER" ]; then
-		echo "Error: Invalid username or no home dir: \"$GALE_USER\"."
-		exit 1
-	fi
-else
-	echo "Using \"$GALE_USER\" as the Gale owner."
-fi
-
- if [ -z "$GALE_DOMAIN" ] ; then
-cat << EOM
-+	cat << EOM
- 
- You need to identify the name of your Gale domain for two purposes:
- 
-@@ -140,97 +158,56 @@ else
- fi
- 
- # -----------------------------------------------------------------------------
-# create configuration file
-
-if [ ! -f "$CONF" ]; then
-cat > "$CONF" <<EOM
-# $CONF -- created by Gale installer; edit to suit.
-EOM
-+# create configuration file (if this is a single-user setup)
-+
-+if [ $is_root = no ]; then
-+	CONF="$SYS_DIR/conf"
-+
-+	if [ ! -d "$SYS_DIR" ]; then
-+		run mkdir -m 0700 -p "$SYS_DIR"
-+		run mkdir -m 0700 -p "$SYS_DIR/auth"
-+		run mkdir -m 0755 -p "$SYS_DIR/auth/trusted"
-+		run cp -f "$INST_SYS_DIR/auth/trusted/ROOT" "$SYS_DIR/auth/trusted"
-+		run mkdir -m 0700 -p "$SYS_DIR/auth/private"
-+		run mkdir -p "$SYS_DIR/auth/local" "$SYS_DIR/auth/cache"
-+	fi
- 
-cat <<EOM
-+	if [ ! -f "$CONF" ]; then
-+		cat <<EOM
- 
- *** Creating "$CONF".
- Examine and edit this file to your taste and local needs.
- If you want to recreate it from scratch, remove it and re-run this.
-EOM
-fi
-
-[ -n "$CONF_GALE_USER" ] || cat >> "$CONF" <<EOM
- 
-# The user who owns the domain secret key.  (Used in installation and upgrade)
-GALE_USER $GALE_USER
- EOM
- 
-[ -n "$CONF_GALE_DOMAIN" ] || cat >> "$CONF" << EOM
-+		cat > "$CONF" <<EOF
-+# $CONF -- created by Gale installer; edit to suit.
- 
- # The authentication domain to use.  (Mandatory)
- GALE_DOMAIN $GALE_DOMAIN
-EOM
-
-# -----------------------------------------------------------------------------
-# make gksign setuid
-+EOF
- 
-gksign="$sbindir/gksign"
-readlink="`which readlink 2>/dev/null`"
-[ -x "$readlink" ] && gksignlink="`"$readlink" "$gksign" 2>/dev/null`"
-[ -f "$gksignlink" ] && gksign="$gksignlink"
-
-echo ""
-if copy chown "$GALE_USER" "$gksign" ; then
-	:
-else
-	echo "*** We need to chown $GALE_USER '$gksign'."
-	echo "    Please run this script as a user that can do so,"
-	echo "    or do so yourself and re-run this script."
-	exit 1
-+	fi
- fi
-run chmod 4755 "$gksign"
- 
-# -----------------------------------------------------------------------------
-# create a domain, if necessary
-+if [ $is_root = no ]; then
-+	GALE_SYS_DIR="$SYS_DIR"
-+	export GALE_SYS_DIR
- 
-echo ""
-if test -u "$gksign" || copy chmod u+s "$gksign" ; then
-	:
-+	testkey "$GALE_DOMAIN" && exit 0
-+	echo "*** You lack a signed key for your domain, \"$GALE_DOMAIN\"."
-+	GALE="$SYS_DIR"
- else
-	echo "*** We need to chmod u+s '$gksign'."
-	echo "    Please run this script as a user that can do so,"
-	echo "    or do so yourself and re-run this script."
-	exit 1
-fi
-
-testkey "$GALE_DOMAIN" && exit 0
-echo "*** You lack a signed key for your domain, \"$GALE_DOMAIN\"."
-
-if [ "x$GALE_USER" != "x$USER" ]; then
-cat <<EOM
-Become user "$GALE_USER" (you are now "$USER") and run this script again
-to create a new domain; contact your domain administrator if you wish to 
-become part of an existing domain.
-EOM
-	exit 1
-fi
-
-if [ -z "$HOME" ]; then
-	cd
-	HOME="`pwd`"
-	echo "Warning: \$HOME not set, assuming \"$HOME\"."
-fi
-
-GALE="$HOME/.gale"
-mkdir -p "$GALE"
-if [ ! -w "$GALE" ]; then
-	echo "Error: Cannot create \"$GALE\"."
-	exit 1
-+	GALE="`pwd`"
- fi
- 
- unsigned="$GALE/$GALE_DOMAIN.unsigned"
- signer="`echo "$GALE_DOMAIN" | sed 's%^[^.@:/]*[.@:/]%%'`"
- [ -z "$signer" ] && signer="ROOT"
- 
-if [ -f "$unsigned" ]; then
-
-cat << EOM
-+if [ $is_root = no ] && [ -f "$unsigned" ]; then
-+	cat << EOM
- 
- Okay, so we've already been here.  Last time, I created the file
- "$unsigned" for you to have signed.
-@@ -275,16 +252,12 @@ EOM
- 		exit 1
- 	fi
- 
-cat << EOM
-
-The domain should be properly configured now.  Assuming users can access a
-version of "gksign" setuid to "$GALE_USER" (this user), they should be
-able to start running clients and generating IDs for themselves.
-+	cat << EOM
- 
-The installation process is complete!
-+The domain should be properly configured now.  The installation process is
-+complete!
- 
- EOM
-
- 	exit 0
- fi
- 
-@@ -300,7 +273,10 @@ printf "Enter the description: "
- read descr
- 
- echo "We will generate the key now.  Have patience."
-gkgen -r "$GALE/auth/private/$GALE_DOMAIN.gpri" \
-+if [ $is_root = no ]; then
-+	install_gpri=auth/private/
-+fi
-+gkgen -r "$GALE/${install_gpri}$GALE_DOMAIN.gpri" \
-       -u "$unsigned" "$GALE_DOMAIN" /"$descr" || exit 1
- 
- cat << EOM
-@@ -311,8 +284,29 @@ the owner of the "$signer" domain through appropriate means.
- Take care to preseve the file's binary data; you may need to uuencode it.
- 
- Assuming they trust you with your subdomain, they should pass the key through
-"gksign" as a filter, returning the signed output to you.  When you have this
-signed key file available, re-run this script, and we will move on to the
-next step.
-+"gksign" as a filter, returning the signed output to you.
-+
-+EOM
-+
-+if [ $is_nixos = yes ]; then
-+	cat <<EOM
-+
-+When you have this signed key file available, you can finish the setup process
-+by placing the private key and signed public key in a directory (they will be
-+copied) and setting "services.gale.keyPath" in /etc/nixos/configuration.nix.
- 
- EOM
-+else
-+	cat <<EOM
-+
-+When you have this signed key file available, re-run this script, and we will
-+move on to the next step.
-+
-+*** IMPORTANT ***
-+You must set GALE_SYS_DIR="$GALE_SYS_DIR" in your environment before re-running
-+this script and before running any Gale programs once setup is finished!  Make
-+sure to set it now, and consider setting it via your shell initialization files
-+so that you don't forget to do it next login.
-+
-+EOM
-+fi
--- a/pkgs/applications/networking/instant-messengers/telepathy/idle/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telepathy/idle/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchurl, glib, pkgconfig, dbus_glib, telepathy_glib, libxslt }:
+{ stdenv, fetchurl, glib, gnome3, pkgconfig, dbus_glib, telepathy_glib, libxslt, makeWrapper }:

 stdenv.mkDerivation rec {
  pname = "telepathy-idle";
@ -10,7 +10,12 @@ stdenv.mkDerivation rec {
    sha256 = "1argdzbif1vdmwp5vqbgkadq9ancjmgdm2ncp0qfckni715ss4rh";
  };

-  buildInputs = [ pkgconfig glib telepathy_glib dbus_glib libxslt telepathy_glib.python ];
+  buildInputs = [ pkgconfig glib telepathy_glib dbus_glib libxslt telepathy_glib.python (stdenv.lib.getLib gnome3.dconf) makeWrapper ];
+
+  preFixup = ''
+    wrapProgram "$out/libexec/telepathy-idle" \
+      --prefix GIO_EXTRA_MODULES : "${stdenv.lib.getLib gnome3.dconf}/lib/gio/modules"
+  '';

  meta = {
    description = "IRC connection manager for the Telepathy framework";
--- a/pkgs/applications/networking/instant-messengers/telepathy/logger/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telepathy/logger/default.nix
@ -1,5 +1,5 @@
 { stdenv, fetchurl, dbus_glib, libxml2, sqlite, telepathy_glib, pkgconfig
-, intltool, libxslt, gobjectIntrospection, dbus_libs }:
+, gnome3, makeWrapper, intltool, libxslt, gobjectIntrospection, dbus_libs }:

 stdenv.mkDerivation rec {
  project = "telepathy-logger";
@ -12,13 +12,19 @@ stdenv.mkDerivation rec {

  NIX_CFLAGS_COMPILE = "-I${dbus_glib.dev}/include/dbus-1.0 -I${dbus_libs.dev}/include/dbus-1.0";

-  buildInputs = [ dbus_glib libxml2 sqlite telepathy_glib pkgconfig intltool
-                  gobjectIntrospection dbus_libs telepathy_glib.python ];
+  buildInputs = [ dbus_glib libxml2 sqlite telepathy_glib pkgconfig intltool makeWrapper
+                  gobjectIntrospection dbus_libs telepathy_glib.python (stdenv.lib.getLib gnome3.dconf) ];

  nativeBuildInputs = [ libxslt ];

  configureFlags = "--enable-call";

+  preFixup = ''
+    wrapProgram "$out/libexec/telepathy-logger" \
+      --prefix GIO_EXTRA_MODULES : "${stdenv.lib.getLib gnome3.dconf}/lib/gio/modules" \
+      --prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH"
+  '';
+
  meta = {
    description = "Logger service for Telepathy framework";
    homepage = http://telepathy.freedesktop.org/wiki/Logger ;
--- a/pkgs/applications/networking/instant-messengers/telepathy/mission-control/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telepathy/mission-control/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, telepathy_glib, libxslt, makeWrapper, upower }:
+{ stdenv, fetchurl, pkgconfig, gnome3, telepathy_glib, libxslt, makeWrapper, upower }:

 stdenv.mkDerivation rec {
  name = "${pname}-5.16.3";
@ -18,6 +18,7 @@ stdenv.mkDerivation rec {

  preFixup = ''
    wrapProgram "$out/libexec/mission-control-5" \
+      --prefix GIO_EXTRA_MODULES : "${stdenv.lib.getLib gnome3.dconf}/lib/gio/modules" \
      --prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH"
  '';

--- a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
+++ b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
@ -4,11 +4,11 @@

 let

-  version = "2.0.91373.0502";
+  version = "2.0.98253.0707";
  srcs = {
    x86_64-linux = fetchurl {
      url = "https://zoom.us/client/${version}/zoom_x86_64.tar.xz";
-      sha256 = "0gcbfsvybkvnyklm82irgz19x3jl0hz9bwf2l9jga188057pfj7a";
+      sha256 = "1znw7459pzfl2jzmj9akfwq3z10sndfb1swdr1p3rrjpiwqh3p7r";
    };
  };

@ -75,13 +75,12 @@ in stdenv.mkDerivation {
    #paxmark m $packagePath/QtWebEngineProcess # is this what dtzWill talked about?

    # RUNPATH set via patchelf is used only for half of libraries (why?), so wrap it
-    wrapProgram $packagePath/zoom \
+    makeWrapper $packagePath/zoom $out/bin/zoom-us \
        --prefix LD_LIBRARY_PATH : "$packagePath:$libPath" \
        --prefix LD_PRELOAD : "${libv4l}/lib/v4l1compat.so" \
        --set QT_PLUGIN_PATH "$packagePath/platforms" \
        --set QT_XKB_CONFIG_ROOT "${xorg.xkeyboardconfig}/share/X11/xkb" \
        --set QTCOMPOSE "${xorg.libX11.out}/share/X11/locale"
-    ln -s "$packagePath/zoom" "$out/bin/zoom-us"

    cat > $packagePath/qt.conf <<EOF
    [Paths]
@ -92,10 +91,10 @@ in stdenv.mkDerivation {
  '';

  meta = {
-    homepage = http://zoom.us;
+    homepage = https://zoom.us/;
    description = "zoom.us video conferencing application";
    license = stdenv.lib.licenses.unfree;
-    platforms = stdenv.lib.platforms.linux;
+    platforms = builtins.attrNames srcs;
    maintainers = with stdenv.lib.maintainers; [ danbst ];
  };

--- a/pkgs/applications/networking/irc/bip/default.nix
+++ b/pkgs/applications/networking/irc/bip/default.nix
@ -1,45 +1,37 @@
-{ stdenv, fetchurl, bison, flex, autoconf, automake, openssl }:
+{ stdenv, fetchurl, fetchpatch, bison, flex, autoconf, automake, openssl }:

-let
-
-  version = "0.8.9";
-  sha256 = "0q942g9lyd8pjvqimv547n6vik5759r9npw3ws3bdj4ixxqhz59w";
-
-  # fetches patches from a gentoo mirror
-  fetchPatch =
-    { file, sha256 }:
-    fetchurl {
-      url = "mirror://gentoo/../gentoo-portage/net-irc/bip/files/${file}";
-      inherit sha256;
-    };
-
-in stdenv.mkDerivation {
+stdenv.mkDerivation rec {
  name = "bip-${version}";
+  version = "0.8.9";

  # fetch sources from debian, because the creator's website provides
  # the files only via https but with an untrusted certificate.
  src = fetchurl {
    url = "mirror://debian/pool/main/b/bip/bip_${version}.orig.tar.gz";
-    inherit sha256;
+    sha256 = "0q942g9lyd8pjvqimv547n6vik5759r9npw3ws3bdj4ixxqhz59w";
  };

+  buildInputs = [ bison flex autoconf automake openssl ];
+
  # includes an important security patch
-  patches = map fetchPatch [
-    { file = "bip-freenode.patch";
-      sha256 = "a67e582f89cc6a32d5bb48c7e8ceb647b889808c2c8798ae3eb27d88869b892f";
-    }
+  patches = [
+    (fetchpatch {
+      url = "mirror://gentoo/../gentoo-portage/net-irc/bip/files/bip-freenode.patch";
+      sha256 = "05qy7a62p16f5knrsdv2lkhc07al18qq32ciq3k4r0lq1wbahj2y";
+    })
+    (fetchpatch {
+      url = "https://projects.duckcorp.org/projects/bip/repository/revisions/39414f8ff9df63c8bc2e4eee34f09f829a5bf8f5/diff/src/connection.c?format=diff";
+      sha256 = "1hvg58vci6invh0z19wf04jjvnm8w6f6v4c4nk1j5hc3ymxdp1rb";
+    })
  ];

  NIX_CFLAGS_COMPILE = "-Wno-error=unused-result";

-  buildInputs = [ bison flex autoconf automake openssl ];
-
  meta = {
    description = "An IRC proxy (bouncer)";
    homepage = http://bip.milkypond.org/;
    license = stdenv.lib.licenses.gpl2;
-    downloadPage= "https://projects.duckcorp.org/projects/bip/files";
-    inherit version;
+    downloadPage = "https://projects.duckcorp.org/projects/bip/files";
    platforms = stdenv.lib.platforms.linux;
  };
 }
--- a/pkgs/applications/networking/irc/epic5/default.nix
+++ b/pkgs/applications/networking/irc/epic5/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchurl, openssl, ncurses, libiconv, tcl, coreutils }:
+{ stdenv, fetchurl, openssl, ncurses, libiconv, tcl, coreutils, fetchpatch }:

 stdenv.mkDerivation rec {
  name = "epic5-${version}";
@ -13,6 +13,13 @@ stdenv.mkDerivation rec {
  buildInputs = [ openssl ncurses ]
    ++ stdenv.lib.optionals stdenv.isDarwin [ libiconv tcl ];

+  patches = [
+    (fetchpatch {
+      url = "https://sources.debian.net/data/main/e/epic5/2.0.1-1/debian/patches/openssl-1.1.patch";
+      sha256 = "03bpsyv1sr5icajs2qkdvv8nnn6rz6yvvj7pgiq8gz9sbp6siyfv";
+    })
+  ];
+
  configureFlags = [ "--disable-debug" "--with-ipv6" ];

  postConfigure = ''
--- a/pkgs/applications/networking/p2p/eiskaltdcpp/default.nix
+++ b/pkgs/applications/networking/p2p/eiskaltdcpp/default.nix
@ -1,15 +1,42 @@
-{ stdenv, fetchurl, cmake, pkgconfig, qt4, boost, bzip2, libX11, pcre-cpp, libidn, lua5, miniupnpc, aspell, gettext }:
+{ stdenv, fetchFromGitHub, cmake, pkgconfig, qt4, boost, bzip2, libX11
+, fetchpatch, pcre-cpp, libidn, lua5, miniupnpc, aspell, gettext }:

 stdenv.mkDerivation rec {
-  name = "eiskaltdcpp-2.2.9";
+  name = "eiskaltdcpp-${version}";
+  version = "2.2.10";

-  src = fetchurl {
-    url = "https://eiskaltdc.googlecode.com/files/${name}.tar.xz";
-    sha256 = "3d9170645450f9cb0a605278b8646fec2110b9637910d86fd27cf245cbe24eaf";
+  src = fetchFromGitHub {
+    owner = "eiskaltdcpp";
+    repo = "eiskaltdcpp";
+    rev = "v${version}";
+    sha256 = "1mqz0g69njmlghcra3izarjxbxi1jrhiwn4ww94b8jv8xb9cv682";
  };

  buildInputs = [ cmake pkgconfig qt4 boost bzip2 libX11 pcre-cpp libidn lua5 miniupnpc aspell gettext ];

+  patches = [
+    (fetchpatch {
+      url = "https://github.com/eiskaltdcpp/eiskaltdcpp/commit/3b7b56bd7060b426b1f1bfded392ae6853644e2e.patch";
+      sha256 = "1rqjdsvirn3ks9w9qn893fb73mz84xm04wl13fvsvj8p42i5cjas";
+    })
+    (fetchpatch {
+      url = "https://github.com/eiskaltdcpp/eiskaltdcpp/commit/bb9eb364a943fe2a67b3ea52ec6a3f9e911f07dc.patch";
+      sha256 = "1hjhf9a9j4z8v24g5qh5mcg3n0540lbn85y7kvxsh3khc5v3cywx";
+    })
+    (fetchpatch {
+      url = "https://github.com/eiskaltdcpp/eiskaltdcpp/commit/ef4426f1f9a8255e335b0862234e6cc28befef5e.patch";
+      sha256 = "13j018c499n4b5as2n39ws64yj0cf4fskxbqab309vmnjkirxv6x";
+    })
+    (fetchpatch {
+      url = "https://github.com/eiskaltdcpp/eiskaltdcpp/commit/a9c136c8707280d0eeb66be6b289d9718287c55c.patch";
+      sha256 = "0w8v4mbrzk7pmzc475ff96mzzwlh8a0p62kk7p829m5yqdwj4sc9";
+    })
+    (fetchpatch {
+      url = "https://github.com/eiskaltdcpp/eiskaltdcpp/commit/3b9c502ff5c98856d4f8fdb7ed3c6ef34448bfb7.patch";
+      sha256 = "0fjwaq0wd9a164k5ysdjy89hx0ixnxc6q7cvyn1ba28snm0pgxb8";
+    })
+  ];
+
  cmakeFlags = ''
    -DUSE_ASPELL=ON
    -DUSE_QT_QML=ON
--- a/pkgs/applications/networking/p2p/ldcpp/default.nix
+++ b/pkgs/applications/networking/p2p/ldcpp/default.nix
@ -1,29 +0,0 @@
-{ stdenv, fetchurl, scons, pkgconfig, gtk2, bzip2, libglade, openssl
-, libX11, boost, zlib, libnotify }:
-
-stdenv.mkDerivation rec {
-  name = "ldcpp-1.1.0";
-  src = fetchurl {
-    url = http://launchpad.net/linuxdcpp/1.1/1.1.0/+download/linuxdcpp-1.1.0.tar.bz2;
-    sha256 = "12i92hirmwryl1qy0n3jfrpziwzb82f61xca9jcjwyilx502f0b6";
-  };
-  buildInputs = [ scons pkgconfig gtk2 bzip2 libglade openssl libX11 boost libnotify ];
-
-  installPhase = ''
-    export NIX_LDFLAGS="$NIX_LDFLAGS -lX11";
-
-    touch gettext xgettext msgfmt msgcat
-    chmod +x gettext xgettext msgfmt msgcat
-    export PATH=$PATH:$PWD
-
-    mkdir -p $out
-    scons PREFIX=$out
-    scons PREFIX=$out install
-  '';
-
-  meta = {
-    description = "Direct Connect client";
-    license = stdenv.lib.licenses.gpl2;
-    platforms = stdenv.lib.platforms.linux;
-  };
-}
--- a/pkgs/applications/networking/p2p/retroshare/0.6.nix
+++ b/pkgs/applications/networking/p2p/retroshare/0.6.nix
@ -1,62 +0,0 @@
-{ stdenv, fetchFromGitHub, cmake, qt4, qmake4Hook, libupnp, gpgme, gnome3, glib, libssh, pkgconfig, protobuf, bzip2
-, libXScrnSaver, speex, curl, libxml2, libxslt, sqlcipher, libmicrohttpd, opencv }:
-
-stdenv.mkDerivation {
-  name = "retroshare-0.6-git-fabc3a3";
-
-  src = fetchFromGitHub {
-    owner = "RetroShare";
-    repo = "RetroShare";
-    rev = "fabc3a398536565efe77fb1b1ef37bd484dc7d4a";
-    sha256 = "189qndkfq9kgv3qi3wx8ivla4j8fxr4iv7c8y9rjrjaz8jwdkn5x";
-  };
-
-  NIX_CFLAGS_COMPILE = [ "-I${glib.dev}/include/glib-2.0" "-I${glib.dev}/lib/glib-2.0/include" "-I${libxml2.dev}/include/libxml2" "-I${sqlcipher}/include/sqlcipher" ];
-
-  patchPhase = ''
-    # Fix build error
-    sed -i 's/UpnpString_get_String(es_event->PublisherUrl)/es_event->PublisherUrl/' \
-      libretroshare/src/upnp/UPnPBase.cpp
-    # Extensions get installed 
-    sed -i "s,/usr/lib/retroshare/extensions6/,$out/share/retroshare," \
-      libretroshare/src/rsserver/rsinit.cc
-    # Where to find the bootstrap DHT bdboot.txt
-    sed -i "s,/usr/share/RetroShare,$out/share/retroshare," \
-      libretroshare/src/rsserver/rsaccounts.cc
-  '';
-
-  #  sed -i "s,LIBS +=.*sqlcipher.*,LIBS += -lsqlcipher," \
-  #    retroshare-gui/src/retroshare-gui.pro \
-  #    retroshare-nogui/src/retroshare-nogui.pro
-
-  buildInputs = [ speex qt4 libupnp gpgme gnome3.libgnome_keyring glib libssh pkgconfig qmake4Hook
-                  protobuf bzip2 libXScrnSaver curl libxml2 libxslt sqlcipher libmicrohttpd opencv ];
-
-  preConfigure = ''
-    qmakeFlags="$qmakeFlags DESTDIR=$out"
-  '';
-
-  # gui/settings/PluginsPage.h:25:28: fatal error: ui_PluginsPage.h: No such file or directory
-  enableParallelBuilding = false;
-
-  postInstall = ''
-    mkdir -p $out/bin
-    mv $out/retroshare-nogui $out/bin
-    mv $out/RetroShare $out/bin
-
-    # plugins
-    mkdir -p $out/share/retroshare
-    mv $out/lib* $out/share/retroshare
-
-    # BT DHT bootstrap
-    cp libbitdht/src/bitdht/bdboot.txt $out/share/retroshare
-  '';
-
-  meta = with stdenv.lib; {
-    description = "";
-    homepage = http://retroshare.sourceforge.net/;
-    #license = licenses.bsd2;
-    platforms = platforms.linux;
-    maintainers = [ maintainers.domenkozar ];
-  };
-}
--- a/pkgs/applications/networking/p2p/retroshare/default.nix
+++ b/pkgs/applications/networking/p2p/retroshare/default.nix
@ -1,40 +1,44 @@
-{ stdenv, fetchurl, cmake, qt4, qmake4Hook, libupnp, gpgme, gnome3, glib, libssh, pkgconfig, protobuf, bzip2
-, libXScrnSaver, speex, curl, libxml2, libxslt }:
+{ stdenv, fetchFromGitHub, cmake, libupnp, gpgme, gnome3, glib, libssh, pkgconfig, protobuf, bzip2
+, libXScrnSaver, speex, curl, libxml2, libxslt, sqlcipher, libmicrohttpd, opencv, qmake, ffmpeg
+, qtmultimedia, qtx11extras, qttools }:

-stdenv.mkDerivation {
-  name = "retroshare-0.5.5c";
+stdenv.mkDerivation rec {
+  name = "retroshare-${version}";
+  version = "0.6.2";

-  src = fetchurl {
-    url = mirror://sourceforge/project/retroshare/RetroShare/0.5.5c/retroshare_0.5.5-0.7068.tar.gz;
-    sha256 = "0l2n4pr1hq66q6qa073hrdx3s3d7iw54z8ay1zy82zhk2rwhsavp";
+  src = fetchFromGitHub {
+    owner = "RetroShare";
+    repo = "RetroShare";
+    rev = "v${version}";
+    sha256 = "0hly2x87wdvqzzwf3wjzi7092bj8fk4xs6302rkm8gp9bkkmiiw8";
  };

-  NIX_CFLAGS_COMPILE = [ "-I${glib.dev}/include/glib-2.0" "-I${glib.dev}/lib/glib-2.0/include" "-I${libxml2.dev}/include/libxml2" ];
+  # NIX_CFLAGS_COMPILE = [ "-I${glib.dev}/include/glib-2.0" "-I${glib.dev}/lib/glib-2.0/include" "-I${libxml2.dev}/include/libxml2" "-I${sqlcipher}/include/sqlcipher" ];

  patchPhase = ''
+    # Fix build error
    sed -i 's/UpnpString_get_String(es_event->PublisherUrl)/es_event->PublisherUrl/' \
      libretroshare/src/upnp/UPnPBase.cpp
-    # Extensions get installed 
-    sed -i "s,/usr/lib/retroshare/extensions/,$out/share/retroshare," \
-      libretroshare/src/rsserver/rsinit.cc
-    # For bdboot.txt
-    sed -i "s,/usr/share/RetroShare,$out/share/retroshare," \
-      libretroshare/src/rsserver/rsinit.cc
  '';

-  buildInputs = [ speex qt4 qmake4Hook libupnp gpgme gnome3.libgnome_keyring glib libssh pkgconfig
-                  protobuf bzip2 libXScrnSaver curl libxml2 libxslt ];
-
-  sourceRoot = "retroshare-0.5.5/src";
+  nativeBuildInputs = [ pkgconfig qmake ];
+  buildInputs = [
+    speex libupnp gpgme gnome3.libgnome_keyring glib libssh qtmultimedia qtx11extras qttools
+    protobuf bzip2 libXScrnSaver curl libxml2 libxslt sqlcipher libmicrohttpd opencv ffmpeg
+  ];

  preConfigure = ''
    qmakeFlags="$qmakeFlags DESTDIR=$out"
  '';

+  # gui/settings/PluginsPage.h:25:28: fatal error: ui_PluginsPage.h: No such file or directory
+  enableParallelBuilding = false;
+
  postInstall = ''
    mkdir -p $out/bin
-    mv $out/retroshare-nogui $out/bin
-    mv $out/RetroShare $out/bin
+    mv $out/RetroShare06-nogui $out/bin/RetroShare-nogui
+    mv $out/RetroShare06 $out/bin/Retroshare
+    ln -s $out/bin/RetroShare-nogui $out/bin/retroshare-nogui

    # plugins
    mkdir -p $out/share/retroshare
@ -47,7 +51,7 @@ stdenv.mkDerivation {
  meta = with stdenv.lib; {
    description = "";
    homepage = http://retroshare.sourceforge.net/;
-    #license = licenses.bsd2;
+    license = licenses.gpl2Plus;
    platforms = platforms.linux;
    maintainers = [ maintainers.domenkozar ];
  };
--- a/pkgs/applications/networking/umurmur/default.nix
+++ b/pkgs/applications/networking/umurmur/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  name = "umurmur-${version}";
-  version = "0.2.16a";
+  version = "0.2.17";

  src = fetchFromGitHub {
-    owner = "fatbob313";
+    owner = "umurmur";
    repo = "umurmur";
    rev = version;
-    sha256 = "1xv1knrivy2i0ggwrczw60y0ayww9df9k6sif7klgzq556xk47d1";
+    sha256 = "074px4ygmv4ydy2pqwxwnz17f0hfswqkz5kc9qfz0iby3h5i3fyl";
  };

  buildInputs = [ autoreconfHook openssl protobufc libconfig ];
@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
  meta = with stdenv.lib; {
    description = "Minimalistic Murmur (Mumble server)";
    license = licenses.bsd3;
-    homepage = http://code.google.com/p/umurmur/;
+    homepage = https://github.com/umurmur/umurmur;
    platforms = platforms.all;
  };
 }
--- a/pkgs/applications/office/gnucash/2.6.nix
+++ b/pkgs/applications/office/gnucash/2.6.nix
@ -71,7 +71,7 @@ stdenv.mkDerivation rec {
        --prefix PERL5LIB ":" "$PERL5LIB"                               \
        --set GCONF_CONFIG_SOURCE 'xml::~/.gconf'                       \
        --prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH:$out/share/gsettings-schemas/${name}" \
-        --prefix GIO_EXTRA_MODULES : "${dconf}/lib/gio/modules"  \
+        --prefix GIO_EXTRA_MODULES : "${stdenv.lib.getLib dconf}/lib/gio/modules"  \
        --prefix PATH ":" "$out/bin:${stdenv.lib.makeBinPath [ perl gconf ]}"
    done

--- a/pkgs/applications/science/logic/coq/default.nix
+++ b/pkgs/applications/science/logic/coq/default.nix
@ -9,7 +9,7 @@
 , ocamlPackages, ncurses
 , buildIde ? true
 , csdp ? null
-, version ? "8.6"
+, version ? "8.6.1"
 }:

 let
@ -18,9 +18,10 @@ let
   "8.5pl2"	= "0wyywia0darak2zmc5v0ra9rn0b9whwdfiahralm8v5za499s8w3";
   "8.5pl3"	= "0fyk2a4fpifibq8y8jhx1891k55qnsnlygglch64sva0bph94nrh";
   "8.6"	= "1pw1xvy1657l1k69wrb911iqqflzhhp8wwsjvihbgc72r3skqg3f";
+   "8.6.1"      = "17cg2c40y9lskkiqfhngavp8yw3shpqgkpihh30xx0rlhn9amy1j";
  }."${version}";
  coq-version = builtins.substring 0 3 version;
-  camlp5 = ocamlPackages.camlp5_transitional;
+  camlp5 = ocamlPackages.camlp5_strict;
  ideFlags = if buildIde then "-lablgtkdir ${ocamlPackages.lablgtk}/lib/ocaml/*/site-lib/lablgtk2 -coqide opt" else "";
  csdpPatch = if csdp != null then ''
    substituteInPlace plugins/micromega/sos.ml --replace "; csdp" "; ${csdp}/bin/csdp"
@ -132,7 +133,7 @@ self = stdenv.mkDerivation {
    homepage = http://coq.inria.fr;
    license = licenses.lgpl21;
    branch = coq-version;
-    maintainers = with maintainers; [ roconnor thoughtpolice vbgl ];
+    maintainers = with maintainers; [ roconnor thoughtpolice vbgl Zimmi48 ];
    platforms = platforms.unix;
  };
 }; in self
--- a/pkgs/applications/science/math/maxima/default.nix
+++ b/pkgs/applications/science/math/maxima/default.nix
@ -4,7 +4,7 @@ tk ? null, gnuplot ? null, ecl ? null, ecl-fasl ? false

 let
  name    = "maxima";
-  version = "5.39.0";
+  version = "5.40.0";

  searchPath =
    stdenv.lib.makeBinPath
@ -15,7 +15,7 @@ stdenv.mkDerivation ({

  src = fetchurl {
    url = "mirror://sourceforge/${name}/${name}-${version}.tar.gz";
-    sha256 = "1cvignn5y6qzrby6qb885yc8zdcdqdr1d50vcvc3gapw2f0gk3zm";
+    sha256 = "15pp35ayglv723bjbqc60gcdv2bm54s6pywsm4i4cwbjsf64dzkl";
  };

  buildInputs = stdenv.lib.filter (x: x != null)
--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@ -12,7 +12,7 @@
 }:

 let
-  version = "2.13.4";
+  version = "2.14.0";
  svn = subversionClient.override { perlBindings = true; };
 in

@ -21,7 +21,7 @@ stdenv.mkDerivation {

  src = fetchurl {
    url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    sha256 = "1nmg0n9l5ix876iqhcyhdnmiy7ihv0ybdijf1lssch6ja8m5j6ip";
+    sha256 = "0xarcp0m7jbncic0g3ahz8l2d6b27h0g9ndgrhy9abkx61m6wgpr";
  };

  hardeningDisable = [ "format" ];
--- a/pkgs/applications/version-management/git-lfs/default.nix
+++ b/pkgs/applications/version-management/git-lfs/default.nix
@ -2,8 +2,8 @@

 buildGoPackage rec {
  name = "git-lfs-${version}";
-  version = "2.0.2";
-  rev = "85e2aec4d949517b4a7a53e4f745689331952b6c";
+  version = "2.2.1";
+  rev = "621d1f821f73efcedc829dda43fd9c1fcf07c6ab";

  goPackagePath = "github.com/git-lfs/git-lfs";

@ -11,7 +11,7 @@ buildGoPackage rec {
    inherit rev;
    owner = "git-lfs";
    repo = "git-lfs";
-    sha256 = "0cvs17rd4qgaqj9vz6pwx9y3ni8c99gzykc3as92x37962nmq5cy";
+    sha256 = "00wc4gjs4yy2qld1m4yar37jkw9fdi2h8xp25hy2y80cnyiafn7s";
  };

  preBuild = ''
--- a/pkgs/applications/video/key-mon/default.nix
+++ b/pkgs/applications/video/key-mon/default.nix
@ -6,7 +6,7 @@ pythonPackages.buildPythonApplication rec {
  namePrefix = "";

  src = fetchurl {
-    url = "http://key-mon.googlecode.com/files/${name}.tar.gz";
+    url = "https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/key-mon/${name}.tar.gz";
    sha256 = "1liz0dxcqmchbnl1xhlxkqm3gh76wz9jxdxn9pa7dy77fnrjkl5q";
  };

@ -20,7 +20,7 @@ pythonPackages.buildPythonApplication rec {
  '';

  meta = with stdenv.lib; {
-    homepage = http://code.google.com/p/key-mon;
+    homepage = https://code.google.com/archive/p/key-mon;
    description = "Utility to show live keyboard and mouse status for teaching and screencasts";
    license = licenses.asl20;
    maintainers = [ maintainers.goibhniu ];
--- a/pkgs/applications/video/mpv/default.nix
+++ b/pkgs/applications/video/mpv/default.nix
@ -73,11 +73,11 @@ assert drmSupport         -> available libdrm;
 let
  # Purity: Waf is normally downloaded by bootstrap.py, but
  # for purity reasons this behavior should be avoided.
-  wafVersion = "1.8.12";
+  wafVersion = "1.9.8";
  waf = fetchurl {
    urls = [ "http://waf.io/waf-${wafVersion}"
             "http://www.freehackers.org/~tnagy/release/waf-${wafVersion}" ];
-    sha256 = "12y9c352zwliw0zk9jm2lhynsjcf5jy0k1qch1c1av8hnbm2pgq1";
+    sha256 = "1gsd3zza1wixv2vhvq3inp4vb71i41a1kbwqnwixhnvdmcmw8z8n";
  };
 in stdenv.mkDerivation rec {
  name = "mpv-${version}";
--- a/pkgs/applications/video/shotcut/default.nix
+++ b/pkgs/applications/video/shotcut/default.nix
@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
      nixpkgs maintainer(s). If you wish to report any bugs upstream,
      please use the official build from shotcut.org instead.
    '';
-    homepage = http://shotcut.org;
+    homepage = https://shotcut.org;
    license = licenses.gpl3;
    maintainers = [ maintainers.goibhniu ];
    platforms = platforms.linux;
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@ -173,8 +173,8 @@ rec {
    version = "17.06.0-ce";
    rev = "02c1d876176546b5f069dae758d6a7d2ead6bd48"; # git commit
    sha256 = "0wrg4ygcq4c7f2bwa7pgc7y33idg0hijavx40588jaglz4k8sqpm";
-    runcRev = "992a5be178a62e026f4069f443c6164912adbf09";
-    runcSha256 = "0ylkbn5rprw5cgxazvrwj7balikpfm8vlybwdbfpwnsqk3gc6p8k";
+    runcRev = "2d41c047c83e09a6d61d464906feb2a2f3c52aa4";
+    runcSha256 = "0v5iv29ck6lkxvxh7a56gfrlgfs0bjvjhrq3p6qqv9qjzv825byq";
    containerdRev = "cfb82a876ecc11b5ca0977d1733adbe58599088a";
    containerdSha256 = "0rix0mv203fn3rcxmpqdpb54l1a0paqplg2xgldpd943qi1rm552";
    tiniRev = "949e6facb77383876aeff8a6944dde66b3089574";
--- a/pkgs/applications/virtualization/rkt/default.nix
+++ b/pkgs/applications/virtualization/rkt/default.nix
@ -12,7 +12,7 @@ let
  stage1Dir = "lib/rkt/stage1-images";

 in stdenv.mkDerivation rec {
-  version = "1.28.0";
+  version = "1.28.1";
  name = "rkt-${version}";
  BUILDDIR="build-${name}";

@ -20,7 +20,7 @@ in stdenv.mkDerivation rec {
    owner = "coreos";
    repo = "rkt";
    rev = "v${version}";
-    sha256 = "08bzi44rs4g8cxb44pxh7ln85zhkhmi40r8mb73kibnnzd008vg3";
+    sha256 = "1xn2cz30gq0500gmp5aml03hmk066fq9i04jizb5sc0j41fmsgja";
  };

  stage1BaseImage = fetchurl {
--- a/pkgs/applications/window-managers/jwm/default.nix
+++ b/pkgs/applications/window-managers/jwm/default.nix
@ -5,13 +5,13 @@

 stdenv.mkDerivation rec {
  name = "jwm-${version}";
-  version = "1600";
+  version = "1621";
  
  src = fetchFromGitHub {
    owner = "joewing";
    repo = "jwm";
    rev = "s${version}";
-    sha256 = "0rfb67r6g873alvcbn9531415qlfmvfrdfm4xrsyhdgdwj7dv5kv";
+    sha256 = "1cxi9yd3wwzhh06f6myk15cav7ayvzxdaxhvqb3570nwj21zlnsm";
  };

  nativeBuildInputs = [ pkgconfig automake autoconf libtool gettext which ];
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@ -12,6 +12,7 @@
 , isGNU ? false, isClang ? cc.isClang or false, gnugrep ? null
 , buildPackages ? {}, hostPlatform, targetPlatform
 , runCommand ? null
+, useMacosReexportHack ? false
 }:

 with stdenv.lib;
@ -278,7 +279,15 @@ stdenv.mkDerivation {
        ln -s $ldPath/${prefix}as $out/bin/${prefix}as
      fi

-      wrap ${prefix}ld ${preWrap ./ld-wrapper.sh} ''${ld:-$ldPath/${prefix}ld}
+    '' + (if !useMacosReexportHack then ''
+      wrap ${prefix}ld ${./ld-wrapper.sh} ''${ld:-$ldPath/${prefix}ld}
+    '' else ''
+      export binPrefix=${prefix}
+      ldInner="${prefix}ld-reexport-delegate"
+      wrap "$ldInner" ${./macos-sierra-reexport-hack.bash} ''${ld:-$ldPath/${prefix}ld}
+      wrap "${prefix}ld" ${./ld-wrapper.sh} "$out/bin/$ldInner"
+      unset ldInner
+    '') + ''

      if [ -e ${binutils_bin}/bin/${prefix}ld.gold ]; then
        wrap ${prefix}ld.gold ${preWrap ./ld-wrapper.sh} ${binutils_bin}/bin/${prefix}ld.gold
@ -386,5 +395,7 @@ stdenv.mkDerivation {
    { description =
        stdenv.lib.attrByPath ["meta" "description"] "System C compiler" cc_
        + " (wrapper script)";
-    };
+  } // optionalAttrs useMacosReexportHack {
+    platforms = stdenv.lib.platforms.darwin;
+  };
 }
--- a/pkgs/build-support/cc-wrapper/macos-sierra-reexport-hack.bash
+++ b/pkgs/build-support/cc-wrapper/macos-sierra-reexport-hack.bash
@ -0,0 +1,106 @@
+#! @shell@
+
+set -eu -o pipefail
+
+path_backup="$PATH"
+if [ -n "@coreutils_bin@" ]; then
+  PATH="@coreutils_bin@/bin"
+fi
+
+declare -r recurThreshold=300
+
+declare overflowCount=0
+for ((n=0; n < $#; ++n)); do
+    case "${!n}" in
+        -l*) let overflowCount+=1 ;;
+        -reexport-l*) let overflowCount+=1 ;;
+        *) ;;
+    esac
+done
+
+declare -a allArgs=()
+
+if (( "$overflowCount" <= "$recurThreshold" )); then
+    allArgs=("$@")
+else
+    declare -a childrenLookup=() childrenLink=()
+
+    while (( $# )); do
+        case "$1" in
+            -L/*)
+                childrenLookup+=("$1")
+                allArgs+=("$1")
+                ;;
+            -L)
+                echo "cctools LD does not support '-L foo' or '-l foo'" >&2
+                exit 1
+                ;;
+            -l)
+                echo "cctools LD does not support '-L foo' or '-l foo'" >&2
+                exit 1
+                ;;
+            -lazy_library | -lazy_framework | -lto_library)
+                # We aren't linking any "azy_library", "to_library", etc.
+                allArgs+=("$1")
+                ;;
+            -lazy-l | -weak-l)    allArgs+=("$1") ;;
+                # We can't so easily prevent header issues from these.
+            -lSystem)             allArgs+=("$1") ;;
+                # Special case as indirection seems like a bad idea for something
+                # so fundamental. Can be removed for simplicity.
+            -l?* | -reexport-l?*) childrenLink+=("$1") ;;
+            *)                    allArgs+=("$1") ;;
+        esac
+
+        shift
+    done
+
+    declare n=0
+    while (( $n < "${#childrenLink[@]}" )); do
+        if [[ "${childrenLink[n]}" = -l* ]]; then
+            childrenLink[n]="-reexport${childrenLink[n]}"
+        fi
+        let ++n
+    done
+    unset n
+
+    declare -r outputNameLibless=$(basename $( \
+        if [[ -z "${outputName:+isUndefined}" ]]; then
+            echo unnamed
+        elif [[ "${outputName:0:3}" = lib ]]; then
+            echo "${outputName:3}"
+        else
+            echo "${outputName}"
+        fi))
+    declare -ra children=("$outputNameLibless-reexport-delegate-0" \
+                          "$outputNameLibless-reexport-delegate-1")
+
+    mkdir -p "$out/lib"
+
+    PATH="$PATH:@out@/bin"
+
+    symbolBloatObject=$outputNameLibless-symbol-hack.o
+    if [[ ! -e $symbolBloatObject ]]; then
+        printf '.private_extern _______child_hack_foo\nchild_hack_foo:\n' \
+            | @binPrefix@as -- -o $symbolBloatObject
+    fi
+
+    # first half of libs
+    @binPrefix@ld -macosx_version_min $MACOSX_DEPLOYMENT_TARGET -arch x86_64 -dylib \
+      -o "$out/lib/lib${children[0]}.dylib" \
+      -install_name "$out/lib/lib${children[0]}.dylib" \
+      "${childrenLookup[@]}" "$symbolBloatObject" \
+      "${childrenLink[@]:0:$((${#childrenLink[@]} / 2 ))}"
+
+    # second half of libs
+    @binPrefix@ld -macosx_version_min $MACOSX_DEPLOYMENT_TARGET -arch x86_64 -dylib \
+      -o "$out/lib/lib${children[1]}.dylib" \
+      -install_name "$out/lib/lib${children[1]}.dylib" \
+      "${childrenLookup[@]}" "$symbolBloatObject" \
+      "${childrenLink[@]:$((${#childrenLink[@]} / 2 ))}"
+
+    allArgs+=("-L$out/lib" "-l${children[0]}" "-l${children[1]}")
+fi
+
+PATH="$path_backup"
+exec @prog@ "${allArgs[@]}"
--- a/pkgs/build-support/docker/default.nix
+++ b/pkgs/build-support/docker/default.nix
@ -497,16 +497,23 @@ rec {
        # Use the temp folder we've been working on to create a new image.
        mv temp image/$layerID

-        # Create image configuration file (used by registry v2) by using
-        # the configuration of the last layer
-        SHA_ARRAY=$(find ./ -name layer.tar | xargs sha256sum | cut -d" " -f1 | xargs -I{} echo -n '"sha256:{}" ' | sed 's/" "/","/g' | awk '{ print "["$1"]" }')
-        jq ". + {\"rootfs\": {\"diff_ids\": $SHA_ARRAY, \"type\": \"layers\"}}" image/$layerID/json > config.json
-        CONFIG_SHA=$(sha256sum config.json | cut -d ' ' -f1)
-        mv config.json image/$CONFIG_SHA.json
+        # Create image json and image manifest
+        imageJson=$(cat ${baseJson} | jq ". + {\"rootfs\": {\"diff_ids\": [], \"type\": \"layers\"}}")
+        manifestJson=$(jq -n "[{\"RepoTags\":[\"$imageName:$imageTag\"]}]")
+        currentID=$layerID
+        while [[ -n "$currentID" ]]; do
+          layerChecksum=$(sha256sum image/$currentID/layer.tar | cut -d ' ' -f1)
+          imageJson=$(echo "$imageJson" | jq ".history |= [{\"created\": \"${created}\"}] + .")
+          imageJson=$(echo "$imageJson" | jq ".rootfs.diff_ids |= [\"sha256:$layerChecksum\"] + .")
+          manifestJson=$(echo "$manifestJson" | jq ".[0].Layers |= [\"$currentID/layer.tar\"] + .")

-        # Create image manifest
-        LAYER_PATHS=$(find image/ -name layer.tar -printf '"%P" ' | sed 's/" "/","/g')
-        jq -n "[{\"Config\":\"$CONFIG_SHA.json\",\"RepoTags\":[\"$imageName:$imageTag\"],\"Layers\":[$LAYER_PATHS]}]" > image/manifest.json
+          currentID=$(cat image/$currentID/json | (jshon -e parent -u 2>/dev/null || true))
+        done
+
+        imageJsonChecksum=$(echo "$imageJson" | sha256sum | cut -d ' ' -f1)
+        echo "$imageJson" > "image/$imageJsonChecksum.json"
+        manifestJson=$(echo "$manifestJson" | jq ".[0].Config = \"$imageJsonChecksum.json\"")
+        echo "$manifestJson" > image/manifest.json

        # Store the json under the name image/repositories.
        jshon -n object \
--- a/pkgs/build-support/emacs/wrapper.nix
+++ b/pkgs/build-support/emacs/wrapper.nix
@ -80,7 +80,8 @@ stdenv.mkDerivation {
       linkPath "$1" "share/emacs/site-lisp" "share/emacs/site-lisp"
     }

-     for pkg in $requires; do
+     # Iterate over the array of inputs (avoiding nix's own interpolation)
+     for pkg in "''${requires[@]}"; do
       linkEmacsPackage $pkg
     done

--- a/pkgs/data/fonts/junicode/default.nix
+++ b/pkgs/data/fonts/junicode/default.nix
@ -18,7 +18,7 @@ stdenv.mkDerivation {

  meta = {
    homepage = http://junicode.sourceforge.net/;
-    description = "A Unicode font";
+    description = "A Unicode font for medievalists";
    platforms = stdenv.lib.platforms.unix;
  };
 }
--- a/pkgs/data/fonts/lohit-fonts/default.nix
+++ b/pkgs/data/fonts/lohit-fonts/default.nix
@ -1,28 +1,28 @@
 { stdenv, fetchurl, lib }:
 let
  fonts = {
-    assamese = { version = "2.91.3" ; sha256 = "0kbdvi8f7vbvsain9zmnj9h43a6bmdkhk5c2wzg15100w7wf6lpq"; };
-    bengali = { version = "2.91.3" ; sha256 = "1wdd2dkqaflf6nm5yc7llkfxin6g0zb2sbcd5g2xbrl0gwwcmkij"; };
-    devanagari = { version = "2.95.2" ; sha256 = "1ss0j0pcfrg1vsypnm0042y4bn7b84mi6lbfsvr6rs89lb5swvn2"; };
-    gujarati = { version = "2.92.2-and-4.2.2" ; sha256 = "1i27yjhn3x31a89x1hjs6rskdwp2kh0hibq1xiz3rgqil2m0jar6"; };
-    gurmukhi = { version = "2.91.0" ; sha256 = "0z8a30mnyhlfvqhnggfk0369hqg779ihqyhcmpxj0sf9dmb1i0mj"; }; # renamed from Punjabi
-    kannada = { version = "2.5.3" ; sha256 = "1x9fb5z1bwmfi0y1fdnzizzjxhbxp272wxznx36063kjf25bb9pi"; };
-    malayalam = { version = "2.92.0" ; sha256 = "1syv1irxh5xl0z0d5kwankhlmi7s2dg4wpp58nq0mkd3rhm5q8qw"; };
-    marathi = { version = "2.94.0" ; sha256 = "0y9sca6gbfbafv52v0n2r1xfs8rg6zmqs4vp9sjfc1c6yqhzagl4"; };
-    nepali = { version = "2.94.0" ; sha256 = "0c56141rpxc30581i3gisg8kfaadxhqjhgshni6g7a7rn6l4dx17"; };
-    odia = { version = "2.91.0" ; sha256 = "15iz9kdf9k5m8wcn2iqlqjm758ac3hvnk93va6kac06frxnhw9lp"; }; # renamed from Oriya
-    tamil-classical = { version = "2.5.3" ; sha256 = "0ci4gk8qhhysjza69nncgmqmal8s4n8829icamvlzbmjdd4s2pij"; };
-    tamil = { version = "2.91.1" ; sha256 = "1ir6kjl48apwk41xbpj0x458k108s7i61yzpkfhqcy1fkcr7cngj"; };
-    telugu = { version = "2.5.4" ; sha256 = "06gdba7690y20l7nsi8fnnimim5hlq7hik0mpk2fzw4w39hjybk9"; };
+    assamese = { label = "Assamese"; version = "2.91.3" ; sha256 = "0kbdvi8f7vbvsain9zmnj9h43a6bmdkhk5c2wzg15100w7wf6lpq"; };
+    bengali = { label = "Bengali"; version = "2.91.3" ; sha256 = "1wdd2dkqaflf6nm5yc7llkfxin6g0zb2sbcd5g2xbrl0gwwcmkij"; };
+    devanagari = { label = "Devanagari script"; version = "2.95.2" ; sha256 = "1ss0j0pcfrg1vsypnm0042y4bn7b84mi6lbfsvr6rs89lb5swvn2"; };
+    gujarati = { label = "Gujarati"; version = "2.92.2-and-4.2.2" ; sha256 = "1i27yjhn3x31a89x1hjs6rskdwp2kh0hibq1xiz3rgqil2m0jar6"; };
+    gurmukhi = { label = "Gurmukhi script"; version = "2.91.0" ; sha256 = "0z8a30mnyhlfvqhnggfk0369hqg779ihqyhcmpxj0sf9dmb1i0mj"; }; # renamed from Punjabi
+    kannada = { label = "Kannada"; version = "2.5.3" ; sha256 = "1x9fb5z1bwmfi0y1fdnzizzjxhbxp272wxznx36063kjf25bb9pi"; };
+    malayalam = { label = "Malayalam"; version = "2.92.0" ; sha256 = "1syv1irxh5xl0z0d5kwankhlmi7s2dg4wpp58nq0mkd3rhm5q8qw"; };
+    marathi = { label = "Marathi"; version = "2.94.0" ; sha256 = "0y9sca6gbfbafv52v0n2r1xfs8rg6zmqs4vp9sjfc1c6yqhzagl4"; };
+    nepali = { label = "Nepali"; version = "2.94.0" ; sha256 = "0c56141rpxc30581i3gisg8kfaadxhqjhgshni6g7a7rn6l4dx17"; };
+    odia = { label = "Odia"; version = "2.91.0" ; sha256 = "15iz9kdf9k5m8wcn2iqlqjm758ac3hvnk93va6kac06frxnhw9lp"; }; # renamed from Oriya
+    tamil-classical = { label = "Classical Tamil"; version = "2.5.3" ; sha256 = "0ci4gk8qhhysjza69nncgmqmal8s4n8829icamvlzbmjdd4s2pij"; };
+    tamil = { label = "Tamil"; version = "2.91.1" ; sha256 = "1ir6kjl48apwk41xbpj0x458k108s7i61yzpkfhqcy1fkcr7cngj"; };
+    telugu = { label = "Telugu"; version = "2.5.4" ; sha256 = "06gdba7690y20l7nsi8fnnimim5hlq7hik0mpk2fzw4w39hjybk9"; };
  };
  gplfonts = {
    # GPL fonts removed from later releases
-    kashmiri = { version = "2.4.3" ; sha256 = "0ax8xzv4pz17jnsjdklawncsm2qn7176wbxykswygpzdd5lr0gg9"; };
-    konkani = { version = "2.4.3" ; sha256 = "03zc27z26a60aaggrqx4d6l0jgggciq8p83v6vgg0k6l3apvcp45"; };
-    maithili = { version = "2.4.3" ; sha256 = "0aqwnhq1namvvb77f2vssahixqf4xay7ja4q8qc312wxkajdqh4a"; };
-    sindhi = { version = "2.4.3" ; sha256 = "00imfbn01yc2g5zdyydks9w3ndkawr66l9qk2idlvw3yz3sw2kf1"; };
+    kashmiri = { label = "Kashmiri"; version = "2.4.3" ; sha256 = "0ax8xzv4pz17jnsjdklawncsm2qn7176wbxykswygpzdd5lr0gg9"; };
+    konkani = { label = "Konkani"; version = "2.4.3" ; sha256 = "03zc27z26a60aaggrqx4d6l0jgggciq8p83v6vgg0k6l3apvcp45"; };
+    maithili = { label = "Maithili"; version = "2.4.3" ; sha256 = "0aqwnhq1namvvb77f2vssahixqf4xay7ja4q8qc312wxkajdqh4a"; };
+    sindhi = { label = "Sindhi"; version = "2.4.3" ; sha256 = "00imfbn01yc2g5zdyydks9w3ndkawr66l9qk2idlvw3yz3sw2kf1"; };
  };
-  mkpkg = license: name: {version, sha256}:
+  mkpkg = license: name: {label, version, sha256}:
    stdenv.mkDerivation {
      name = "lohit-${name}-${version}";

@ -44,6 +44,7 @@ let

      meta = {
        inherit license;
+        description = "Free and open source fonts for Indian languages (" + label + ")";
        homepage = https://fedorahosted.org/lohit/;
        maintainers = [ lib.maintainers.mathnerd314 lib.maintainers.ttuegel ];
        # Set a non-zero priority to allow easy overriding of the
--- a/pkgs/data/fonts/material-icons/default.nix
+++ b/pkgs/data/fonts/material-icons/default.nix
@ -0,0 +1,26 @@
+{ stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  name = "material-icons-${version}";
+  version = "3.0.1";
+
+  src = fetchFromGitHub {
+    owner  = "google";
+    repo   = "material-design-icons";
+    rev    = "${version}";
+    sha256 = "17q5brcqyyc8gbjdgpv38p89s60cwxjlwy2ljnrvas5cj0s62np0";
+  };
+
+  buildCommand = ''
+    mkdir -p $out/share/fonts/truetype
+    cp $src/iconfont/*.ttf $out/share/fonts/truetype
+  '';
+
+  meta = with stdenv.lib; {
+    description = "System status icons by Google, featuring material design";
+    homepage = https://material.io/icons;
+    license = licenses.asl20;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ mpcsh ];
+  };
+}
--- a/pkgs/desktops/gnome-3/3.22/apps/evolution/default.nix
+++ b/pkgs/desktops/gnome-3/3.22/apps/evolution/default.nix
@ -2,7 +2,7 @@
 , pkgconfig, gtk3, glib, libnotify, gtkspell3
 , wrapGAppsHook, itstool, shared_mime_info, libical, db, gcr, sqlite
 , gnome3, librsvg, gdk_pixbuf, libsecret, nss, nspr, icu, libtool
-, libcanberra_gtk3, bogofilter, gst_all_1, procps, p11_kit, dconf, openldap}:
+, libcanberra_gtk3, bogofilter, gst_all_1, procps, p11_kit, openldap}:

 let
  majVer = gnome3.version;
@ -23,7 +23,7 @@ in stdenv.mkDerivation rec {
                  libcanberra_gtk3 bogofilter gnome3.libgdata sqlite
                  gst_all_1.gstreamer gst_all_1.gst-plugins-base p11_kit
                  nss nspr libnotify procps highlight gnome3.libgweather
-                  gnome3.gsettings_desktop_schemas dconf
+                  gnome3.gsettings_desktop_schemas
                  gnome3.libgnome_keyring gnome3.glib_networking openldap ];

  nativeBuildInputs = [ pkgconfig wrapGAppsHook ];
--- a/pkgs/desktops/gnome-3/3.22/apps/seahorse/default.nix
+++ b/pkgs/desktops/gnome-3/3.22/apps/seahorse/default.nix
@ -1,6 +1,6 @@
 { stdenv, intltool, fetchurl, vala_0_32
 , pkgconfig, gtk3, glib
-, makeWrapper, itstool, gnupg, libsoup
+, wrapGAppsHook, itstool, gnupg, libsoup
 , gnome3, librsvg, gdk_pixbuf, gpgme
 , libsecret, avahi, p11_kit, openssh }:

@ -14,15 +14,15 @@ stdenv.mkDerivation rec {
  NIX_CFLAGS_COMPILE = "-I${gnome3.glib.dev}/include/gio-unix-2.0";

  buildInputs = [ pkgconfig gtk3 glib intltool itstool gnome3.gcr
-                  gnome3.gsettings_desktop_schemas makeWrapper gnupg
+                  gnome3.gsettings_desktop_schemas wrapGAppsHook gnupg
                  gdk_pixbuf gnome3.defaultIconTheme librsvg gpgme
-                  libsecret avahi libsoup p11_kit vala_0_32 gnome3.gcr
+                  libsecret avahi libsoup p11_kit vala_0_32
                  openssh ];

  preFixup = ''
-    wrapProgram "$out/bin/seahorse" \
-      --set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE" \
-      --prefix XDG_DATA_DIRS : "${gnome3.gnome_themes_standard}/share:$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH"
+    gappsWrapperArgs+=(
+      --prefix XDG_DATA_DIRS : "${gnome3.gnome_themes_standard}/share"
+    )
  '';

  meta = with stdenv.lib; {
--- a/pkgs/desktops/gnome-3/3.22/core/evolution-data-server/default.nix
+++ b/pkgs/desktops/gnome-3/3.22/core/evolution-data-server/default.nix
@ -1,4 +1,4 @@
-{ fetchurl, stdenv, pkgconfig, gnome3, python
+{ fetchurl, stdenv, pkgconfig, gnome3, python, dconf
 , intltool, libsoup, libxml2, libsecret, icu, sqlite
 , p11_kit, db, nspr, nss, libical, gperf, makeWrapper, valaSupport ? true, vala_0_32 }:

@ -6,7 +6,7 @@ stdenv.mkDerivation rec {
  inherit (import ./src.nix fetchurl) name src;

  buildInputs = with gnome3;
-    [ pkgconfig glib python intltool libsoup libxml2 gtk gnome_online_accounts
+    [ pkgconfig glib python intltool libsoup libxml2 gtk gnome_online_accounts (stdenv.lib.getLib dconf)
      gcr p11_kit libgweather libgdata gperf makeWrapper icu sqlite gsettings_desktop_schemas ]
    ++ stdenv.lib.optional valaSupport vala_0_32;

@ -20,7 +20,9 @@ stdenv.mkDerivation rec {

  preFixup = ''
    for f in "$out/libexec/"*; do
-      wrapProgram "$f" --prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH"
+      wrapProgram "$f" \
+        --prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH" \
+        --prefix GIO_EXTRA_MODULES : "${stdenv.lib.getLib dconf}/lib/gio/modules"
    done
  '';

--- a/pkgs/desktops/gnome-3/3.22/core/gnome-contacts/default.nix
+++ b/pkgs/desktops/gnome-3/3.22/core/gnome-contacts/default.nix
@ -1,7 +1,7 @@
 { stdenv, intltool, fetchurl, evolution_data_server, db
 , pkgconfig, gtk3, glib, libsecret
 , libchamplain, clutter_gtk, geocode_glib
-, bash, makeWrapper, itstool, folks, libnotify, libxml2
+, bash, wrapGAppsHook, itstool, folks, libnotify, libxml2
 , gnome3, librsvg, gdk_pixbuf, file, telepathy_glib, nspr, nss
 , libsoup, vala_0_32, dbus_glib, automake115x, autoconf }:

@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
  '';

  buildInputs = [ pkgconfig gtk3 glib intltool itstool evolution_data_server
-                  gnome3.gsettings_desktop_schemas makeWrapper file libnotify
+                  gnome3.gsettings_desktop_schemas wrapGAppsHook file libnotify
                  folks gnome3.gnome_desktop telepathy_glib libsecret dbus_glib
                  libxml2 libsoup gnome3.gnome_online_accounts nspr nss
                  gdk_pixbuf gnome3.defaultIconTheme librsvg
@ -26,11 +26,9 @@ stdenv.mkDerivation rec {
                  vala_0_32 automake115x autoconf db ];

  preFixup = ''
-    for f in "$out/bin/gnome-contacts" "$out/libexec/gnome-contacts-search-provider"; do
-      wrapProgram $f \
-        --set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE" \
-        --prefix XDG_DATA_DIRS : "${gnome3.gnome_themes_standard}/share:$out/share:$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH"
-    done
+    gappsWrapperArgs+=(
+      --prefix XDG_DATA_DIRS : "${gnome3.gnome_themes_standard}/share"
+    )
  '';

  patches = [ ./gio_unix.patch ];
--- a/pkgs/desktops/gnome-3/3.22/core/gnome-control-center/default.nix
+++ b/pkgs/desktops/gnome-3/3.22/core/gnome-control-center/default.nix
@ -39,6 +39,9 @@ stdenv.mkDerivation rec {
  '';

  preFixup = with gnome3; ''
+    gappsWrapperArgs+=(
+      --prefix XDG_DATA_DIRS : "${gnome3.gnome_themes_standard}/share:${sound-theme-freedesktop}/share"
+    )
    for i in $out/share/applications/*; do
      substituteInPlace $i --replace "gnome-control-center" "$out/bin/gnome-control-center"
    done
--- a/pkgs/desktops/gnome-3/3.22/core/gnome-font-viewer/default.nix
+++ b/pkgs/desktops/gnome-3/3.22/core/gnome-font-viewer/default.nix
@ -1,6 +1,6 @@
 { stdenv, intltool, fetchurl
 , pkgconfig, gtk3, glib
-, bash, makeWrapper, itstool
+, bash, wrapGAppsHook, itstool
 , gnome3, librsvg, gdk_pixbuf }:

 stdenv.mkDerivation rec {
@ -14,12 +14,12 @@ stdenv.mkDerivation rec {

  buildInputs = [ pkgconfig gtk3 glib intltool itstool gnome3.gnome_desktop
                  gdk_pixbuf gnome3.defaultIconTheme librsvg
-                  gnome3.gsettings_desktop_schemas makeWrapper ];
+                  gnome3.gsettings_desktop_schemas wrapGAppsHook ];

  preFixup = ''
-    wrapProgram "$out/bin/gnome-font-viewer" \
-      --set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE" \
-      --prefix XDG_DATA_DIRS : "${gnome3.gnome_themes_standard}/share:$out/share:$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH"
+    gappsWrapperArgs+=(
+      --prefix XDG_DATA_DIRS : "${gnome3.gnome_themes_standard}/share"
+    )
  '';

  meta = with stdenv.lib; {
--- a/pkgs/desktops/gnome-3/3.22/core/gnome-screenshot/default.nix
+++ b/pkgs/desktops/gnome-3/3.22/core/gnome-screenshot/default.nix
@ -1,5 +1,5 @@
 { stdenv, intltool, fetchurl, pkgconfig, libcanberra_gtk3
-, bash, gtk3, glib, makeWrapper
+, bash, gtk3, glib, wrapGAppsHook
 , itstool, gnome3, librsvg, gdk_pixbuf }:

 stdenv.mkDerivation rec {
@ -13,12 +13,12 @@ stdenv.mkDerivation rec {
  propagatedBuildInputs = [ gdk_pixbuf gnome3.defaultIconTheme librsvg ];

  buildInputs = [ bash pkgconfig gtk3 glib intltool itstool libcanberra_gtk3
-                  gnome3.gsettings_desktop_schemas makeWrapper ];
+                  gnome3.gsettings_desktop_schemas wrapGAppsHook ];

  preFixup = ''
-    wrapProgram "$out/bin/gnome-screenshot" \
-      --set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE" \
-      --prefix XDG_DATA_DIRS : "${gtk3.out}/share:${gnome3.gnome_themes_standard}/share:$out/share:$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH"
+    gappsWrapperArgs+=(
+      --prefix XDG_DATA_DIRS : "${gtk3.out}/share:${gnome3.gnome_themes_standard}/share"
+    )
  '';

  meta = with stdenv.lib; {
--- a/pkgs/desktops/gnome-3/3.22/core/gnome-shell/default.nix
+++ b/pkgs/desktops/gnome-3/3.22/core/gnome-shell/default.nix
@ -26,7 +26,7 @@ in stdenv.mkDerivation rec {
      libgweather # not declared at build time, but typelib is needed at runtime
      gnome3.gnome-clocks # schemas needed
      at_spi2_core upower ibus gnome_desktop telepathy_logger gnome3.gnome_settings_daemon
-      pythonEnv gobjectIntrospection ];
+      pythonEnv gobjectIntrospection (stdenv.lib.getLib dconf) ];

  installFlags = [ "keysdir=$(out)/share/gnome-control-center/keybindings" ];

@ -39,11 +39,13 @@ in stdenv.mkDerivation rec {
    wrapProgram "$out/bin/gnome-shell" \
      --prefix PATH : "${unzip}/bin" \
      --prefix GI_TYPELIB_PATH : "$GI_TYPELIB_PATH" \
+      --prefix GIO_EXTRA_MODULES : "${stdenv.lib.getLib dconf}/lib/gio/modules" \
      --set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE" \
      --prefix XDG_DATA_DIRS : "${gnome_themes_standard}/share:$out/share:$XDG_ICON_DIRS" \
      --suffix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH"

    wrapProgram "$out/libexec/gnome-shell-calendar-server" \
+      --prefix GIO_EXTRA_MODULES : "${stdenv.lib.getLib dconf}/lib/gio/modules" \
      --prefix XDG_DATA_DIRS : "${evolution_data_server}/share:$out/share:$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH"

    echo "${unzip}/bin" > $out/${passthru.mozillaPlugin}/extra-bin-path
--- a/pkgs/desktops/gnome-3/3.22/core/gnome-system-log/default.nix
+++ b/pkgs/desktops/gnome-3/3.22/core/gnome-system-log/default.nix
@ -1,5 +1,5 @@
 { stdenv, intltool, fetchurl, pkgconfig
-, bash, gtk3, glib, makeWrapper
+, bash, gtk3, glib, wrapGAppsHook
 , itstool, gnome3, librsvg, gdk_pixbuf, libxml2 }:

 stdenv.mkDerivation rec {
@ -18,12 +18,12 @@ stdenv.mkDerivation rec {
  propagatedBuildInputs = [ gdk_pixbuf gnome3.defaultIconTheme librsvg ];

  buildInputs = [ bash pkgconfig gtk3 glib intltool itstool
-                  gnome3.gsettings_desktop_schemas makeWrapper libxml2 ];
+                  gnome3.gsettings_desktop_schemas wrapGAppsHook libxml2 ];

  preFixup = ''
-    wrapProgram "$out/bin/gnome-system-log" \
-      --set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE" \
-      --prefix XDG_DATA_DIRS : "${gtk3.out}/share:${gnome3.gnome_themes_standard}/share:$out/share:$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH"
+    gappsWrapperArgs+=(
+      --prefix XDG_DATA_DIRS : "${gtk3.out}/share:${gnome3.gnome_themes_standard}/share"
+    )
  '';

  meta = with stdenv.lib; {
--- a/pkgs/desktops/gnome-3/3.22/core/gnome-system-monitor/default.nix
+++ b/pkgs/desktops/gnome-3/3.22/core/gnome-system-monitor/default.nix
@ -1,5 +1,5 @@
 { stdenv, intltool, fetchurl, pkgconfig, gtkmm3, libxml2
-, bash, gtk3, glib, makeWrapper
+, bash, gtk3, glib, wrapGAppsHook
 , itstool, gnome3, librsvg, gdk_pixbuf, libgtop }:

 stdenv.mkDerivation rec {
@ -10,14 +10,14 @@ stdenv.mkDerivation rec {
  propagatedUserEnvPkgs = [ gnome3.gnome_themes_standard ];

  buildInputs = [ bash pkgconfig gtk3 glib intltool itstool libxml2
-                  gtkmm3 libgtop makeWrapper
+                  gtkmm3 libgtop wrapGAppsHook
                  gdk_pixbuf gnome3.defaultIconTheme librsvg
                  gnome3.gsettings_desktop_schemas ];

  preFixup = ''
-    wrapProgram "$out/bin/gnome-system-monitor" \
-      --set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE" \
-      --prefix XDG_DATA_DIRS : "${gnome3.gnome_themes_standard}/share:$out/share:$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH"
+    gappsWrapperArgs+=(
+      --prefix XDG_DATA_DIRS : "${gtk3.out}/share:${gnome3.gnome_themes_standard}/share"
+    )
  '';

  enableParallelBuilding = true;
--- a/pkgs/desktops/gnome-3/3.22/core/tracker/default.nix
+++ b/pkgs/desktops/gnome-3/3.22/core/tracker/default.nix
@ -1,6 +1,6 @@
 { stdenv, intltool, fetchurl, libxml2, upower
 , pkgconfig, gtk3, glib
-, bash, makeWrapper, itstool, vala_0_32, sqlite, libxslt
+, bash, wrapGAppsHook, itstool, vala_0_32, sqlite, libxslt
 , gnome3, librsvg, gdk_pixbuf, file, libnotify
 , evolution_data_server, gst_all_1, poppler
 , icu, taglib, libjpeg, libtiff, giflib, libcue
@ -19,8 +19,8 @@ stdenv.mkDerivation rec {

  buildInputs = [ vala_0_32 pkgconfig gtk3 glib intltool itstool libxml2
                  bzip2 gnome3.totem-pl-parser libxslt
-                  gnome3.gsettings_desktop_schemas makeWrapper file
-                  gdk_pixbuf gnome3.defaultIconTheme librsvg sqlite
+                  gnome3.gsettings_desktop_schemas wrapGAppsHook
+                  file gdk_pixbuf gnome3.defaultIconTheme librsvg sqlite
                  upower libnotify evolution_data_server gnome3.libgee
                  gst_all_1.gstreamer gst_all_1.gst-plugins-base flac
                  poppler icu taglib libjpeg libtiff giflib libvorbis
@ -31,11 +31,9 @@ stdenv.mkDerivation rec {
  '';

  preFixup = ''
-    for f in $out/bin/* $out/libexec/*; do
-      wrapProgram $f \
-        --set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE" \
-        --prefix XDG_DATA_DIRS : "${gnome3.gnome_themes_standard}/share:$out/share:$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH"
-    done
+    gappsWrapperArgs+=(
+      --prefix XDG_DATA_DIRS : "${gnome3.gnome_themes_standard}/share"
+    )
  '';

  meta = with stdenv.lib; {
--- a/pkgs/desktops/gnome-3/3.22/default.nix
+++ b/pkgs/desktops/gnome-3/3.22/default.nix
@ -14,7 +14,7 @@ let
  callPackage = pkgs.newScope self;

  version = "3.22";
-  maintainers = with pkgs.lib.maintainers; [ lethalman jgeerds ];
+  maintainers = with pkgs.lib.maintainers; [ lethalman ];

  corePackages = with gnome3; [
    pkgs.desktop_file_utils pkgs.ibus
--- a/pkgs/desktops/xfce/applications/mousepad.nix
+++ b/pkgs/desktops/xfce/applications/mousepad.nix
@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
  preFixup = ''
    wrapProgram "$out/bin/mousepad" \
      --prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH:${gtksourceview}/share" \
-      --prefix GIO_EXTRA_MODULES : "${dconf}/lib/gio/modules"
+      --prefix GIO_EXTRA_MODULES : "${stdenv.lib.getLib dconf}/lib/gio/modules"
  '';

  meta = {
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@ -9,9 +9,9 @@
 #
 # See comment at the top of configuration-nix.nix for more information about this
 # distinction.
-{ pkgs }:
+{ pkgs, haskellLib }:

-with import ./lib.nix { inherit pkgs; };
+with haskellLib;

 self: super: {

@ -720,7 +720,7 @@ self: super: {
          owner = "haskell-servant";
          repo = "servant";
          rev = "v${ver}";
-          sha256 = "09kjinnarf9q9l8irs46gcrai8bprq39n8pj43bmdv47hl38csa0";
+          sha256 = "0bwd5dy3crn08dijn06dr3mdsww98kqxfp8v5mvrdws5glvcxdsg";
        }}/doc";
        buildInputs = with pkgs.pythonPackages; [ sphinx recommonmark sphinx_rtd_theme ];
        makeFlags = "html";
--- a/pkgs/development/haskell-modules/configuration-ghc-6.12.x.nix
+++ b/pkgs/development/haskell-modules/configuration-ghc-6.12.x.nix
@ -1,6 +1,6 @@
-{ pkgs }:
+{ pkgs, haskellLib }:

-with import ./lib.nix { inherit pkgs; };
+with haskellLib;

 self: super: {

--- a/Show More
+++ b/Show More