Merge branch 'master' into staging

Thousands of rebuilds from master :-/
2017-09-23 09:55:42 +02:00 · 2017-09-23 09:55:42 +02:00 · 73282c8cc2
commit 73282c8cc2
parent 1dd63de9a0 18ebc8dba9
103 changed files with 5566 additions and 3405 deletions
--- a/lib/maintainers.nix
+++ b/lib/maintainers.nix
@ -186,6 +186,7 @@
  ellis = "Ellis Whitehead <nixos@ellisw.net>";
  eperuffo = "Emanuele Peruffo <info@emanueleperuffo.com>";
  epitrochoid = "Mabry Cervin <mpcervin@uncg.edu>";
+  eqyiel = "Ruben Maher <r@rkm.id.au>";
  ericbmerritt = "Eric Merritt <eric@afiniate.com>";
  ericsagnes = "Eric Sagnes <eric.sagnes@gmail.com>";
  erikryb = "Erik Rybakken <erik.rybakken@math.ntnu.no>";
@ -663,4 +664,5 @@
  zoomulator = "Kim Simmons <zoomulator@gmail.com>";
  zraexy = "David Mell <zraexy@gmail.com>";
  zx2c4 = "Jason A. Donenfeld <Jason@zx2c4.com>";
+  zzamboni = "Diego Zamboni <diego@zzamboni.org>";
 }
--- a/nixos/modules/profiles/base.nix
+++ b/nixos/modules/profiles/base.nix
@ -20,6 +20,7 @@

    # Some networking tools.
    pkgs.fuse
+    pkgs.fuse3
    pkgs.sshfs-fuse
    pkgs.socat
    pkgs.screen
--- a/nixos/modules/security/lock-kernel-modules.nix
+++ b/nixos/modules/security/lock-kernel-modules.nix
@ -17,19 +17,27 @@ with lib;
  };

  config = mkIf config.security.lockKernelModules {
+    boot.kernelModules = concatMap (x:
+      if x.device != null
+        then
+          if x.fsType == "vfat"
+            then [ "vfat" "nls-cp437" "nls-iso8859-1" ]
+            else [ x.fsType ]
+        else []) config.system.build.fileSystems;
+
    systemd.services.disable-kernel-module-loading = rec {
      description = "Disable kernel module loading";

      wantedBy = [ config.systemd.defaultUnit ];
-      after = [ "systemd-udev-settle.service" "firewall.service" "systemd-modules-load.service" ] ++ wantedBy;

-      script = "echo -n 1 > /proc/sys/kernel/modules_disabled";
+      after = [ "systemd-udev-settle.service" "firewall.service" "systemd-modules-load.service" ] ++ wantedBy;

      unitConfig.ConditionPathIsReadWrite = "/proc/sys/kernel";

      serviceConfig = {
        Type = "oneshot";
        RemainAfterExit = true;
+        ExecStart = "/bin/sh -c 'echo -n 1 >/proc/sys/kernel/modules_disabled'";
      };
    };
  };
--- a/nixos/modules/security/wrappers/default.nix
+++ b/nixos/modules/security/wrappers/default.nix
@ -155,7 +155,10 @@ in
  ###### implementation
  config = {

-    security.wrappers.fusermount.source = "${pkgs.fuse}/bin/fusermount";
+    security.wrappers = {
+      fusermount.source = "${pkgs.fuse}/bin/fusermount";
+      fusermount3.source = "${pkgs.fuse3}/bin/fusermount3";
+    };

    boot.specialFileSystems.${parentWrapperDir} = {
      fsType = "tmpfs";
--- a/nixos/modules/services/misc/gitolite.nix
+++ b/nixos/modules/services/misc/gitolite.nix
@ -49,6 +49,35 @@ in
        '';
      };

+      extraGitoliteRc = mkOption {
+        type = types.lines;
+        default = "";
+        example = literalExample ''
+          $RC{UMASK} = 0027;
+          $RC{SITE_INFO} = 'This is our private repository host';
+          push( @{$RC{ENABLE}}, 'Kindergarten' ); # enable the command/feature
+          @{$RC{ENABLE}} = grep { $_ ne 'desc' } @{$RC{ENABLE}}; # disable the command/feature
+        '';
+        description = ''
+          Extra configuration to append to the default <literal>~/.gitolite.rc</literal>.
+
+          This should be Perl code that modifies the <literal>%RC</literal>
+          configuration variable. The default <literal>~/.gitolite.rc</literal>
+          content is generated by invoking <literal>gitolite print-default-rc</literal>,
+          and extra configuration from this option is appended to it. The result
+          is placed to Nix store, and the <literal>~/.gitolite.rc</literal> file
+          becomes a symlink to it.
+
+          If you already have a customized (or otherwise changed)
+          <literal>~/.gitolite.rc</literal> file, NixOS will refuse to replace
+          it with a symlink, and the `gitolite-init` initialization service
+          will fail. In this situation, in order to use this option, you
+          will need to take any customizations you may have in
+          <literal>~/.gitolite.rc</literal>, convert them to appropriate Perl
+          statements, add them to this option, and remove the file.
+        '';
+      };
+
      user = mkOption {
        type = types.str;
        default = "gitolite";
@ -59,7 +88,34 @@ in
    };
  };

-  config = mkIf cfg.enable {
+  config = mkIf cfg.enable (
+  let
+    manageGitoliteRc = cfg.extraGitoliteRc != "";
+    rcDir = pkgs.runCommand "gitolite-rc" { } rcDirScript;
+    rcDirScript =
+      ''
+        mkdir "$out"
+        export HOME=temp-home
+        mkdir -p "$HOME/.gitolite/logs" # gitolite can't run without it
+        '${pkgs.gitolite}'/bin/gitolite print-default-rc >>"$out/gitolite.rc.default"
+        cat <<END >>"$out/gitolite.rc"
+        # This file is managed by NixOS.
+        # Use services.gitolite options to control it.
+
+        END
+        cat "$out/gitolite.rc.default" >>"$out/gitolite.rc"
+      '' +
+      optionalString (cfg.extraGitoliteRc != "") ''
+        echo -n ${escapeShellArg ''
+
+          # Added by NixOS:
+          ${removeSuffix "\n" cfg.extraGitoliteRc}
+
+          # per perl rules, this should be the last line in such a file:
+          1;
+        ''} >>"$out/gitolite.rc"
+      '';
+  in {
    users.extraUsers.${cfg.user} = {
      description     = "Gitolite user";
      home            = cfg.dataDir;
@ -77,10 +133,50 @@ in
      serviceConfig.Type = "oneshot";
      serviceConfig.RemainAfterExit = true;

-      path = [ pkgs.gitolite pkgs.git pkgs.perl pkgs.bash config.programs.ssh.package ];
-      script = ''
+      path = [ pkgs.gitolite pkgs.git pkgs.perl pkgs.bash pkgs.diffutils config.programs.ssh.package ];
+      script =
+      let
+        rcSetupScriptIfCustomFile =
+          if manageGitoliteRc then ''
+            cat <<END
+            <3>ERROR: NixOS can't apply declarative configuration
+            <3>to your .gitolite.rc file, because it seems to be
+            <3>already customized manually.
+            <3>See the services.gitolite.extraGitoliteRc option
+            <3>in "man configuration.nix" for more information.
+            END
+            # Not sure if the line below addresses the issue directly or just
+            # adds a delay, but without it our error message often doesn't
+            # show up in `systemctl status gitolite-init`.
+            journalctl --flush
+            exit 1
+          '' else ''
+            :
+          '';
+        rcSetupScriptIfDefaultFileOrStoreSymlink =
+          if manageGitoliteRc then ''
+            ln -sf "${rcDir}/gitolite.rc" "$GITOLITE_RC"
+          '' else ''
+            [[ -L "$GITOLITE_RC" ]] && rm -f "$GITOLITE_RC"
+          '';
+      in
+        ''
          cd ${cfg.dataDir}
          mkdir -p .gitolite/logs
+
+          GITOLITE_RC=.gitolite.rc
+          GITOLITE_RC_DEFAULT=${rcDir}/gitolite.rc.default
+          if ( [[ ! -e "$GITOLITE_RC" ]] && [[ ! -L "$GITOLITE_RC" ]] ) ||
+             ( [[ -f "$GITOLITE_RC" ]] && diff -q "$GITOLITE_RC" "$GITOLITE_RC_DEFAULT" >/dev/null ) ||
+             ( [[ -L "$GITOLITE_RC" ]] && [[ "$(readlink "$GITOLITE_RC")" =~ ^/nix/store/ ]] )
+          then
+        '' + rcSetupScriptIfDefaultFileOrStoreSymlink +
+        ''
+          else
+        '' + rcSetupScriptIfCustomFile +
+        ''
+          fi
+
          if [ ! -d repositories ]; then
            gitolite setup -pk ${pubkeyFile}
          fi
@ -93,5 +189,5 @@ in
    };

    environment.systemPackages = [ pkgs.gitolite pkgs.git ];
-  };
+  });
 }
--- a/nixos/modules/services/monitoring/prometheus/node-exporter.nix
+++ b/nixos/modules/services/monitoring/prometheus/node-exporter.nix
@ -33,7 +33,7 @@ in {
        default = [];
        example = ''[ "systemd" ]'';
        description = ''
-          Collectors to enable, additionally to the defaults.
+          Collectors to enable. Only collectors explicitly listed here will be enabled.
        '';
      };

--- a/nixos/modules/services/network-filesystems/glusterfs.nix
+++ b/nixos/modules/services/network-filesystems/glusterfs.nix
@ -5,6 +5,22 @@ with lib;
 let
  inherit (pkgs) glusterfs rsync;

+  tlsCmd = if (cfg.tlsSettings != null) then
+  ''
+    mkdir -p /var/lib/glusterd
+    touch /var/lib/glusterd/secure-access
+  ''
+  else
+  ''
+    rm -f /var/lib/glusterd/secure-access
+  '';
+
+  restartTriggers = if (cfg.tlsSettings != null) then [
+    config.environment.etc."ssl/glusterfs.pem".source
+    config.environment.etc."ssl/glusterfs.key".source
+    config.environment.etc."ssl/glusterfs.ca".source
+  ] else [];
+
  cfg = config.services.glusterfs;

 in
@ -30,6 +46,41 @@ in
        description = "Extra flags passed to the GlusterFS daemon";
        default = [];
      };
+
+      tlsSettings = mkOption {
+        description = ''
+          Make the server communicate via TLS.
+          This means it will only connect to other gluster
+          servers having certificates signed by the same CA.
+
+          Enabling this will create a file <filename>/var/lib/glusterd/secure-access</filename>.
+          Disabling will delete this file again.
+
+          See also: https://gluster.readthedocs.io/en/latest/Administrator%20Guide/SSL/
+        '';
+        default = null;
+        type = types.nullOr (types.submodule {
+          options = {
+            tlsKeyPath = mkOption {
+              default = null;
+              type = types.str;
+              description = "Path to the private key used for TLS.";
+            };
+
+            tlsPem = mkOption {
+              default = null;
+              type = types.path;
+              description = "Path to the certificate used for TLS.";
+            };
+
+            caCert = mkOption {
+              default = null;
+              type = types.path;
+              description = "Path certificate authority used to sign the cluster certificates.";
+            };
+          };
+        });
+      };
    };
  };

@ -40,7 +91,14 @@ in

    services.rpcbind.enable = true;

+    environment.etc = mkIf (cfg.tlsSettings != null) {
+      "ssl/glusterfs.pem".source = cfg.tlsSettings.tlsPem;
+      "ssl/glusterfs.key".source = cfg.tlsSettings.tlsKeyPath;
+      "ssl/glusterfs.ca".source = cfg.tlsSettings.caCert;
+    };
+
    systemd.services.glusterd = {
+      inherit restartTriggers;

      description = "GlusterFS, a clustered file-system server";

@ -57,6 +115,8 @@ in
      + ''
        mkdir -p /var/lib/glusterd/hooks/
        ${rsync}/bin/rsync -a ${glusterfs}/var/lib/glusterd/hooks/ /var/lib/glusterd/hooks/
+
+        ${tlsCmd}
      ''
      # `glusterfind` needs dirs that upstream installs at `make install` phase
      # https://github.com/gluster/glusterfs/blob/v3.10.2/tools/glusterfind/Makefile.am#L16-L17
@ -75,6 +135,7 @@ in
    };

    systemd.services.glustereventsd = {
+      inherit restartTriggers;

      description = "Gluster Events Notifier";

--- a/nixos/modules/system/boot/luksroot.nix
+++ b/nixos/modules/system/boot/luksroot.nix
@ -235,6 +235,16 @@ in
      '';
    };

+    boot.initrd.luks.forceLuksSupportInInitrd = mkOption {
+      type = types.bool;
+      default = false;
+      internal = true;
+      description = ''
+        Whether to configure luks support in the initrd, when no luks
+        devices are configured.
+      '';
+    };
+
    boot.initrd.luks.devices = mkOption {
      default = { };
      example = { "luksroot".device = "/dev/disk/by-uuid/430e9eff-d852-4f68-aa3b-2fa3599ebe08"; };
@ -417,7 +427,7 @@ in
    };
  };

-  config = mkIf (luks.devices != {}) {
+  config = mkIf (luks.devices != {} || luks.forceLuksSupportInInitrd) {

    # actually, sbp2 driver is the one enabling the DMA attack, but this needs to be tested
    boot.blacklistedKernelModules = optionals luks.mitigateDMAAttacks
--- a/nixos/modules/tasks/encrypted-devices.nix
+++ b/nixos/modules/tasks/encrypted-devices.nix
@ -61,6 +61,7 @@ in
        devices =
          map (dev: { name = dev.encrypted.label; device = dev.encrypted.blkDev; } ) keylessEncDevs;
        cryptoModules = [ "aes" "sha256" "sha1" "xts" ];
+        forceLuksSupportInInitrd = true;
      };
      postMountCommands =
        concatMapStrings (dev: "cryptsetup luksOpen --key-file ${dev.encrypted.keyFile} ${dev.encrypted.blkDev} ${dev.encrypted.label};\n") keyedEncDevs;
--- a/nixos/modules/tasks/filesystems.nix
+++ b/nixos/modules/tasks/filesystems.nix
@ -217,7 +217,7 @@ in
    # Add the mount helpers to the system path so that `mount' can find them.
    system.fsPackages = [ pkgs.dosfstools ];

-    environment.systemPackages = [ pkgs.fuse ] ++ config.system.fsPackages;
+    environment.systemPackages = with pkgs; [ fuse3 fuse ] ++ config.system.fsPackages;

    environment.etc.fstab.text =
      let
--- a/nixos/modules/tasks/filesystems/nfs.nix
+++ b/nixos/modules/tasks/filesystems/nfs.nix
@ -85,8 +85,14 @@ in
        enable = mkDefault false;
      };

+    systemd.services.auth-rpcgss-module =
+      {
+        unitConfig.ConditionPathExists = [ "" "/etc/krb5.keytab" ];
+      };
+
    systemd.services.rpc-gssd =
      { restartTriggers = [ nfsConfFile ];
+        unitConfig.ConditionPathExists = [ "" "/etc/krb5.keytab" ];
      };

    systemd.services.rpc-statd =
--- a/nixos/tests/hardened.nix
+++ b/nixos/tests/hardened.nix
@ -10,6 +10,17 @@ import ./make-test.nix ({ pkgs, ...} : {
    { users.users.alice = { isNormalUser = true; extraGroups = [ "proc" ]; };
      users.users.sybil = { isNormalUser = true; group = "wheel"; };
      imports = [ ../modules/profiles/hardened.nix ];
+      virtualisation.emptyDiskImages = [ 4096 ];
+      boot.initrd.postDeviceCommands = ''
+        ${pkgs.dosfstools}/bin/mkfs.vfat -n EFISYS /dev/vdb
+      '';
+      fileSystems = lib.mkVMOverride {
+        "/efi" = {
+          device = "/dev/disk/by-label/EFISYS";
+          fsType = "vfat";
+          options = [ "noauto" ];
+        };
+      };
    };

  testScript =
@ -42,5 +53,13 @@ import ./make-test.nix ({ pkgs, ...} : {
      subtest "kcore", sub {
          $machine->fail("cat /proc/kcore");
      };
+
+      # Test deferred mount
+      subtest "mount", sub {
+        $machine->fail("mountpoint -q /efi"); # was deferred
+        $machine->execute("mkdir -p /efi");
+        $machine->succeed("mount /dev/disk/by-label/EFISYS /efi");
+        $machine->succeed("mountpoint -q /efi"); # now mounted
+      };
    '';
 })
--- a/pkgs/applications/altcoins/bitcoin.nix
+++ b/pkgs/applications/altcoins/bitcoin.nix
@ -5,13 +5,11 @@
 with stdenv.lib;
 stdenv.mkDerivation rec{
  name = "bitcoin" + (toString (optional (!withGui) "d")) + "-" + version;
-  version = "0.15.0";
+  version = "0.15.0.1";

  src = fetchurl {
-    urls = [ "https://bitcoin.org/bin/bitcoin-core-${version}/bitcoin-${version}.tar.gz"
-             "mirror://sourceforge/bitcoin/Bitcoin/bitcoin-${version}/bitcoin-${version}.tar.gz"
-           ];
-    sha256 = "18gj5gdscarv2a1hdgjps50czwi4hrmrrmhssaag55ysh94zbdjl";
+    url = "https://bitcoin.org/bin/bitcoin-core-${version}/bitcoin-${version}.tar.gz";
+    sha256 = "16si3skhm6jhw1pkniv2b9y1kkdhjmhj392palphir0qc1srwzmm";
  };

  nativeBuildInputs = [ pkgconfig autoreconfHook ];
--- a/pkgs/applications/audio/mp3info/default.nix
+++ b/pkgs/applications/audio/mp3info/default.nix
@ -39,6 +39,6 @@ stdenv.mkDerivation rec {
    license = stdenv.lib.licenses.gpl2Plus;

    maintainers = [ ];
-    platforms = stdenv.lib.platforms.unix;
+    platforms = stdenv.lib.platforms.linux;
  };
 }
--- a/pkgs/applications/editors/jetbrains/default.nix
+++ b/pkgs/applications/editors/jetbrains/default.nix
@ -53,6 +53,9 @@ let
          patchelf --set-interpreter $interp \
            --set-rpath "${lib.makeLibraryPath [ stdenv.cc.cc.lib zlib ]}:$lldbLibPath" \
            bin/clang/clang-tidy
+
+          wrapProgram $out/bin/clion \
+            --set CL_JDK "${jdk}"
        )
      '';
    });
@ -229,15 +232,15 @@ in

  datagrip = buildDataGrip rec {
    name = "datagrip-${version}";
-    version = "2017.1.5"; /* updated by script */
+    version = "2017.2.2"; /* updated by script */
    description = "Your Swiss Army Knife for Databases and SQL";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/datagrip/${name}.tar.gz";
-      sha256 = "8847c35761fcf6fc7a1d3f2bed0fa3971fbf28721c144f41d21feb473bb212dc"; /* updated by script */
+      sha256 = "1l8y65fw9g5ckzwpcgigm2qwy8fhpw2hil576rphsnx6qvnh4swn"; /* updated by script */
    };
    wmClass = "jetbrains-datagrip";
-    update-channel = "datagrip_2017_1";
+    update-channel = "datagrip_2017_2";
  };

  gogland = buildGogland rec {
--- a/pkgs/applications/editors/jetbrains/update.pl
+++ b/pkgs/applications/editors/jetbrains/update.pl
@ -27,10 +27,16 @@ sub get_latest_versions {
    next unless $latest_build;

    # version as in download url
+    my ($version) = $latest_build =~ /^<build [^>]*version="([^"]+)"/;
+    my ($fullNumber) = $latest_build =~ /^<build [^>]*fullNumber="([^"]+)"/;
+    my $latest_version_full1 = "$version-$fullNumber";
+    $latest_version_full1 =~ s/\s*EAP//;
+
    my ($latest_version) = $latest_build =~ /^<build [^>]*version="([^"]+)"/;
    ($latest_version) = $latest_build =~ /^<build [^>]*fullNumber="([^"]+)"/ if $latest_version =~ / /;

    $h{$id} = $latest_version;
+    $h{"full1_" . $id} = $latest_version_full1;
  }
  return %h;
 }
@ -44,7 +50,7 @@ sub update_nix_block {
  my ($block) = @_;
  my ($channel) = $block =~ /update-channel\s*=\s*"([^"]+)"/;
  if ($channel) {
-    die "unknown update-channel $channel" unless $latest_versions{$channel};
+    if ($latest_versions{$channel}) {
      my ($version) = $block =~ /version\s*=\s*"([^"]+)"/;
      die "no version in $block" unless $version;
      if ($version eq $latest_versions{$channel}) {
@ -58,16 +64,25 @@ sub update_nix_block {
        $url =~ s/\$\{name\}/$name/;
        $url =~ s/\$\{version\}/$latest_versions{$channel}/;
        die "$url still has some interpolation" if $url =~ /\$/;
-
        my ($sha256) = get("$url.sha256") =~ /^([0-9a-f]{64})/;
+        my $version_string = $latest_versions{$channel};
+        unless ( $sha256 ) {
+          my $full_version = $latest_versions{"full1_" . $channel};
+          $url =~ s/$version_string/$full_version/;
+          ($sha256) = get("$url.sha256") =~ /^([0-9a-f]{64})/;
+          $version_string = $full_version;
+        }
+        die "invalid sha256 in $url.sha256" unless $sha256;
        my ($sha256Base32) = readpipe("nix-hash --type sha256 --to-base32 $sha256");
        chomp $sha256Base32;
        print "Jetbrains published SHA256: $sha256\n";
-      print "Conversion into base32 yeilds: $sha256Base32\n";
-
-      $block =~ s#version\s*=\s*"([^"]+)".+$#version = "$latest_versions{$channel}"; /* updated by script */#m;
+        print "Conversion into base32 yields: $sha256Base32\n";
+        $block =~ s#version\s*=\s*"([^"]+)".+$#version = "$version_string"; /* updated by script */#m;
        $block =~ s#sha256\s*=\s*"([^"]+)".+$#sha256 = "$sha256Base32"; /* updated by script */#m;
      }
+    } else {
+      warn "unknown update-channel $channel";
+    }
  }
  return $block;
 }
--- a/pkgs/applications/editors/tecoc/default.nix
+++ b/pkgs/applications/editors/tecoc/default.nix
@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
 '';
    homepage = https://github.com/blakemcbride/TECOC;
    maintainers = [ maintainers.AndersonTorres ];
-    platforms = platforms.unix;
+    platforms = platforms.linux;
  };
 }
 # TODO: test in other platforms - especially Darwin
--- a/pkgs/applications/graphics/giv/build.patch
+++ b/pkgs/applications/graphics/giv/build.patch
@ -2,16 +2,21 @@ Get the environment propagated to scons forked childs, and correct the dicom plu
 a typedef of size_t that failed at least on x86_64-linux.

 diff --git a/SConstruct b/SConstruct
-index 16eccd9..603e931 100644
+index 9e752d6..f93f27f 100644
 --- a/SConstruct
 +++ b/SConstruct
-@@ -7,8 +7,7 @@ else:
-     cppflags = ['-O2']
-     variant = 'Release'
+@@ -9,13 +9,7 @@ else:
+ 
+ commit_id = os.popen('git rev-parse HEAD').read().replace('\n','')
 
 -env = Environment(LIBPATH=[],
-                  CPPFLAGS = cppflags)
+-                  CPPFLAGS = cppflags + ['-Wno-deprecated-declarations',
+-                                         '-Wno-reorder',
+-                                         '-Wno-unused-but-set-variable',
+-                                         '-Wno-unused-function'],
+-                  CXXFLAGS=['-std=c++1y']
+-                  )
 +env = Environment(ENV = os.environ)
 
 env['SBOX'] = False
- 
+ env['COMMITIDSHORT'] = commit_id[0:6]
--- a/pkgs/applications/graphics/giv/default.nix
+++ b/pkgs/applications/graphics/giv/default.nix
@ -2,13 +2,14 @@
  pcre, cfitsio, perl, gob2, vala_0_23, libtiff, json_glib }:

 stdenv.mkDerivation rec {
-  name = "giv-20150811-git";
+  name = "giv-${version}";
+  version = "0.9.26";

  src = fetchFromGitHub {
    owner = "dov";
    repo = "giv";
-    rev = "64648bfbbf10ec4a9adfbc939c96c7d1dbdce57a";
-    sha256 = "1sz2n7jbmg3g97bs613xxjpzqbsl5rvpg6v7g3x3ycyd35r8vsfp";
+    rev = "v${version}";
+    sha256 = "1sfm8j3hvqij6z3h8xz724d7hjqqbzljl2a6pp4yjpnnrxksnic2";
  };

  hardeningDisable = [ "format" ];
--- a/pkgs/applications/graphics/paraview/default.nix
+++ b/pkgs/applications/graphics/paraview/default.nix
@ -1,40 +1,46 @@
-{ fetchurl, stdenv, cmake, qt4
-, hdf5
-, mpich2
-, python
-, libxml2
-, mesa, libXt
-}:
+{stdenv, fetchFromGitHub, cmake
+,full, python, mesa, libXt }:

 stdenv.mkDerivation rec {
-  name = "paraview-4.0.1";
-  src = fetchurl {
-    url = "http://paraview.org/files/v4.0/ParaView-v4.0.1-source.tgz";
-    sha256 = "1qj8dq8gqpsw75sv4sdc7xm1xcpv0ilsddnrcfhha0zfhp0gq10y";
+  name = "paraview-${version}";
+  version = "5.4.0";
+
+  # fetching from GitHub instead of taking an "official" source
+  # tarball because of missing submodules there
+  src = fetchFromGitHub {
+    owner = "Kitware";
+    repo = "ParaView";
+    rev = "v${version}";
+    sha256 = "0h1vkgwm10mc5mnr3djp81lxr5pi0hyj776z77hiib6xm5596q9n";
+    fetchSubmodules = true;
  };

-  # [  5%] Generating vtkGLSLShaderLibrary.h
-  # ../../../bin/ProcessShader: error while loading shared libraries: libvtksys.so.pv3.10: cannot open shared object file: No such file or directory
-  preConfigure = ''
-    export NIX_LDFLAGS="$NIX_LDFLAGS -rpath $out/lib/paraview-3.98 -rpath ../../../../../../lib -rpath ../../../../../lib -rpath ../../../../lib -rpath ../../../lib -rpath ../../lib -rpath ../lib"
-  '';
   cmakeFlags = [
-    "-DPARAVIEW_USE_SYSTEM_HDF5:BOOL=ON"
-    "-DVTK_USE_SYSTEM_LIBXML2:BOOL=ON"
-    "-DPARAVIEW_ENABLE_PYTHON:BOOL=ON"
-#  use -DPARAVIEW_INSTALL_THIRD_PARTY_LIBRARIES:BOOL=OFF \ to fix make install error: http://www.cmake.org/pipermail/paraview/2011-February/020268.html
-    "-DPARAVIEW_INSTALL_THIRD_PARTY_LIBRARIES:BOOL=OFF"
-    "-DCMAKE_SKIP_BUILD_RPATH=ON"
-    "-DVTK_USE_RPATH:BOOL=ON"
-    "-DPARAVIEW_INSTALL_DEVELOPMENT=ON"
+     "-DPARAVIEW_ENABLE_PYTHON=ON"
+     "-DPARAVIEW_INSTALL_DEVELOPMENT_FILES=ON"
   ];

-  # https://bugzilla.redhat.com/show_bug.cgi?id=1138466
-  NIX_CFLAGS_COMPILE = "-DGLX_GLXEXT_LEGACY";
+  # During build, binaries are called that rely on freshly built
+  # libraries.  These reside in build/lib, and are not found by
+  # default.
+  preBuild = ''
+    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$PWD/lib
+  '';

  enableParallelBuilding = true;

-  buildInputs = [ cmake qt4 hdf5 mpich2 python libxml2 mesa libXt ];
+  buildInputs = [ cmake
+   python
+   mesa
+   libXt
+
+   # theoretically the following should be fine, but there is an error
+   # due to missing libqminimal when not using qt5.full
+
+   # qtbase qtx11extras qttools
+   full
+   ];
+

  meta = {
    homepage = http://www.paraview.org/;
--- a/pkgs/applications/graphics/pqiv/default.nix
+++ b/pkgs/applications/graphics/pqiv/default.nix
@ -21,6 +21,6 @@ stdenv.mkDerivation (rec {
    homepage = http://www.pberndt.com/Programme/Linux/pqiv;
    license = licenses.gpl3;
    maintainers = [ maintainers.ndowens ];
-    platforms = platforms.unix;
+    platforms = platforms.linux;
  };
 })
--- a/pkgs/applications/kde/default.nix
+++ b/pkgs/applications/kde/default.nix
@ -145,6 +145,7 @@ let
      okteta = callPackage ./okteta.nix {};
      okular = callPackage ./okular.nix {};
      pimcommon = callPackage ./pimcommon.nix {};
+      pim-data-exporter = callPackage ./pim-data-exporter.nix {};
      pim-sieve-editor = callPackage ./pim-sieve-editor.nix {};
      print-manager = callPackage ./print-manager.nix {};
      spectacle = callPackage ./spectacle.nix {};
--- a/pkgs/applications/kde/pim-data-exporter.nix
+++ b/pkgs/applications/kde/pim-data-exporter.nix
@ -0,0 +1,22 @@
+{
+  mkDerivation, lib, kdepimTeam,
+  extra-cmake-modules, kdoctools,
+  akonadi, kcmutils, kcrash, kdbusaddons, kidentitymanagement, kldap,
+  kmailtransport, knewstuff, knotifications, knotifyconfig, kparts, kross, ktexteditor,
+  kwallet, libkdepim, libkleo, pimcommon, qttools,
+  karchive, mailcommon, messagelib, pim-data-exporter
+}:
+
+mkDerivation {
+  name = "pim-data-exporter";
+  meta = {
+    license = with lib.licenses; [ gpl2 lgpl21 fdl12 ];
+    maintainers = kdepimTeam;
+  };
+  nativeBuildInputs = [ extra-cmake-modules kdoctools ];
+  buildInputs = [
+    akonadi kcmutils kcrash kdbusaddons kidentitymanagement kldap kmailtransport
+    knewstuff knotifications knotifyconfig kparts kross ktexteditor kwallet libkdepim
+    libkleo pimcommon qttools karchive mailcommon messagelib
+  ];
+}
--- a/pkgs/applications/misc/topydo/default.nix
+++ b/pkgs/applications/misc/topydo/default.nix
@ -0,0 +1,35 @@
+{ stdenv, python3Packages, fetchFromGitHub, glibcLocales }:
+
+with python3Packages;
+
+buildPythonApplication rec {
+  pname = "topydo";
+  version = "0.13";
+  name  = "${pname}-${version}";
+
+  src = fetchFromGitHub {
+    owner = "bram85";
+    repo = pname;
+    rev = version;
+    sha256 = "0b3dz137lpbvpjvfy42ibqvj3yk526x4bpn819fd11lagn77w69r";
+  };
+
+  propagatedBuildInputs = [
+    arrow
+    icalendar
+    glibcLocales
+    prompt_toolkit
+    urwid
+    watchdog
+  ];
+
+  checkInputs = [ mock freezegun coverage green pylint ];
+
+  LC_ALL="en_US.UTF-8";
+
+  meta = with stdenv.lib; {
+    description = "A cli todo application compatible with the todo.txt format";
+    homepage = "https://github.com/bram85/topydo";
+    license = licenses.gpl3;
+  };
+}
--- a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
+++ b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
@ -44,6 +44,10 @@
 , hicolor_icon_theme
 , shared_mime_info

+# Whether to disable multiprocess support to work around crashing tabs
+# TODO: fix the underlying problem instead of this terrible work-around
+, disableContentSandbox ? true
+
 # Extra preferences
 , extraPrefs ? ""
 }:
@ -210,6 +214,10 @@ stdenv.mkDerivation rec {
    lockPref("extensions.torlauncher.control_port_use_ipc", true);
    lockPref("extensions.torlauncher.socks_port_use_ipc", true);

+    // Optionally disable multiprocess support.  We always set this to ensure that
+    // toggling the pref takes effect.
+    lockPref("browser.tabs.remote.autostart.2", ${if disableContentSandbox then "false" else "true"});
+
    ${optionalString (extraPrefs != "") ''
      ${extraPrefs}
    ''}
--- a/pkgs/applications/networking/gns3/default.nix
+++ b/pkgs/applications/networking/gns3/default.nix
@ -0,0 +1,30 @@
+{ callPackage, stdenv }:
+
+let
+  stableVersion = "2.0.3";
+  previewVersion = "2.1.0rc1";
+  addVersion = args:
+    let version = if args.stable then stableVersion else previewVersion;
+        branch = if args.stable then "stable" else "preview";
+    in args // { inherit version branch; };
+  mkGui = args: callPackage (import ./gui.nix (addVersion args)) { };
+  mkServer = args: callPackage (import ./server.nix (addVersion args)) { };
+in {
+  guiStable = mkGui {
+    stable = true;
+    sha256Hash = "10qp6430md8d0h2wamgfaq7pai59mqmcw6sw3i1gvb20m0avvsvb";
+  };
+  guiPreview = mkGui {
+    stable = false;
+    sha256Hash = "0rmvanzc0fjw9giqwnf98yc49cxaz637w8b865dv08lcf1fg9j8l";
+  };
+
+  serverStable = mkServer {
+    stable = true;
+    sha256Hash = "1c7mzj1r2zh90a7vs3s17jakfp9s43b8nnj29rpamqxvl3qhbdy7";
+  };
+  serverPreview = mkServer {
+    stable = false;
+    sha256Hash = "181689fpjxq4hy2lyxk4zciqhgnhj5srvb4xsxdlbf68n89fj2zf";
+  };
+}
--- a/pkgs/applications/networking/gns3/gui.nix
+++ b/pkgs/applications/networking/gns3/gui.nix
@ -1,19 +1,22 @@
-{ stdenv, python34Packages, fetchFromGitHub }:
+{ stable, branch, version, sha256Hash }:

-# TODO: Python 3.6 was failing
-python34Packages.buildPythonPackage rec {
+{ stdenv, python3Packages, fetchFromGitHub }:
+
+let
+  pythonPackages = python3Packages;
+
+in pythonPackages.buildPythonPackage rec {
  name = "${pname}-${version}";
  pname = "gns3-gui";
-  version = "2.0.3";

  src = fetchFromGitHub {
    owner = "GNS3";
    repo = pname;
    rev = "v${version}";
-    sha256 = "10qp6430md8d0h2wamgfaq7pai59mqmcw6sw3i1gvb20m0avvsvb";
+    sha256 = sha256Hash;
  };

-  propagatedBuildInputs = with python34Packages; [
+  propagatedBuildInputs = with pythonPackages; [
    raven psutil jsonschema # tox for check
    # Runtime dependencies
    sip pyqt5
@ -22,11 +25,13 @@ python34Packages.buildPythonPackage rec {
  doCheck = false; # Failing

  meta = with stdenv.lib; {
-    description = "Graphical Network Simulator";
-    #longDescription = ''
-    #  ...
-    #'';
-    homepage = "https://www.gns3.com/";
+    description = "Graphical Network Simulator 3 GUI (${branch} release)";
+    longDescription = ''
+      Graphical user interface for controlling the GNS3 network simulator. This
+      requires access to a local or remote GNS3 server (it's recommended to
+      download the official GNS3 VM).
+    '';
+    homepage = https://www.gns3.com/;
    license = licenses.gpl3Plus;
    platforms = platforms.linux;
    maintainers = with maintainers; [ primeos ];
--- a/pkgs/applications/networking/gns3/server.nix
+++ b/pkgs/applications/networking/gns3/server.nix
@ -1,23 +1,63 @@
-{ stdenv, python3Packages, fetchFromGitHub }:
+{ stable, branch, version, sha256Hash }:

-python3Packages.buildPythonPackage rec {
+{ stdenv, python3Packages, fetchFromGitHub, fetchurl }:
+
+let
+  pythonPackages = python3Packages;
+  yarl = if (!stable) then pythonPackages.yarl
+    else (stdenv.lib.overrideDerivation pythonPackages.yarl (oldAttrs:
+      rec {
+        pname = "yarl";
+        version = "0.9.8";
+        name = "${pname}-${version}";
+        src = pythonPackages.fetchPypi {
+          inherit pname version;
+          sha256 = "1v2dsmr7bqp0yx51pwhbxyvzza8m2f88prsnbd926mi6ah38p0d7";
+        };
+      }));
+  aiohttp = if (!stable) then pythonPackages.aiohttp
+    else (stdenv.lib.overrideDerivation pythonPackages.aiohttp (oldAttrs:
+      rec {
+        pname = "aiohttp";
+        version = "1.3.5";
+        name = "${pname}-${version}";
+        src = pythonPackages.fetchPypi {
+          inherit pname version;
+          sha256 = "0hpqdiaifgyfqmxkyzwypwvrnvz5rqzgzylzhihfidc5ldfs856d";
+        };
+        propagatedBuildInputs = [ yarl ]
+          ++ (with pythonPackages; [ async-timeout chardet multidict ]);
+      }));
+  aiohttp-cors = if (!stable) then pythonPackages.aiohttp-cors
+    else (stdenv.lib.overrideDerivation pythonPackages.aiohttp-cors (oldAttrs:
+      rec {
+        pname = "aiohttp-cors";
+        version = "0.5.1";
+        name = "${pname}-${version}";
+        src = pythonPackages.fetchPypi {
+          inherit pname version;
+          sha256 = "0szma27ri25fq4nwwvs36myddggw3jz4pyzmq63yz4xpw0jjdxck";
+        };
+        propagatedBuildInputs = [ aiohttp ];
+      }));
+in pythonPackages.buildPythonPackage rec {
  name = "${pname}-${version}";
  pname = "gns3-server";
-  version = "2.1.0rc1";

  src = fetchFromGitHub {
    owner = "GNS3";
    repo = pname;
    rev = "v${version}";
-    sha256 = "181689fpjxq4hy2lyxk4zciqhgnhj5srvb4xsxdlbf68n89fj2zf";
+    sha256 = sha256Hash;
  };

-  propagatedBuildInputs = with python3Packages; [
-    aiohttp jinja2 psutil zipstream aiohttp-cors raven jsonschema yarl typing
+  propagatedBuildInputs = [ yarl aiohttp aiohttp-cors ]
+    ++ (with pythonPackages; [
+      jinja2 psutil zipstream raven jsonschema typing
      prompt_toolkit
-  ];
+    ]);

-  postPatch = ''
+  postPatch = stdenv.lib.optionalString (!stable) ''
    sed -i 's/yarl>=0.11,<0.12/yarl/g' requirements.txt
  '';

@ -28,13 +68,13 @@ python3Packages.buildPythonPackage rec {
    rm $out/bin/gns3loopback # For windows only
  '';
  meta = with stdenv.lib; {
-    description = "Graphical Network Simulator 3 server";
+    description = "Graphical Network Simulator 3 server (${branch} release)";
    longDescription = ''
      The GNS3 server manages emulators such as Dynamips, VirtualBox or
      Qemu/KVM. Clients like the GNS3 GUI control the server using a HTTP REST
      API.
    '';
-    homepage = "https://www.gns3.com/";
+    homepage = https://www.gns3.com/;
    license = licenses.gpl3Plus;
    platforms = platforms.linux;
    maintainers = with maintainers; [ primeos ];
--- a/pkgs/applications/networking/google-drive-ocamlfuse/default.nix
+++ b/pkgs/applications/networking/google-drive-ocamlfuse/default.nix
@ -1,16 +1,20 @@
-{ stdenv, fetchurl, zlib
+{ stdenv, fetchFromGitHub, zlib
 , ocaml, ocamlbuild, ocamlfuse, findlib, gapi_ocaml, ocaml_sqlite3, camlidl }:

 stdenv.mkDerivation rec {
  name = "google-drive-ocamlfuse-${version}";
-  version = "0.6.17";
+  version = "0.6.21";

-  src = fetchurl {
-    url = "https://forge.ocamlcore.org/frs/download.php/1674/${name}.tar.gz";
-    sha256 = "1ldja7080pnjaibrbdvfqwakp4mac8yw1lkb95f7lgldmy96lxas";
+  src = fetchFromGitHub {
+    owner = "astrada";
+    repo = "google-drive-ocamlfuse";
+    rev = "v${version}";
+    sha256 = "14qvhz18pzxdgxk5vcs024ajbkxccfwc9p3z5r6vfkc9mm851v59";
  };

-  buildInputs = [ zlib ocaml ocamlbuild ocamlfuse findlib gapi_ocaml ocaml_sqlite3 camlidl];
+  nativeBuildInputs = [ ocamlbuild ];
+
+  buildInputs = [ zlib ocaml ocamlfuse findlib gapi_ocaml ocaml_sqlite3 camlidl ];

  configurePhase = "ocaml setup.ml -configure --prefix \"$out\"";
  buildPhase = "ocaml setup.ml -build";
--- a/pkgs/applications/networking/instant-messengers/riot/riot-web.nix
+++ b/pkgs/applications/networking/instant-messengers/riot/riot-web.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name= "riot-web-${version}";
-  version = "0.12.3";
+  version = "0.12.5";

  src = fetchurl {
    url = "https://github.com/vector-im/riot-web/releases/download/v${version}/riot-v${version}.tar.gz";
-    sha256 = "1v9k9rna9rziis5ld4x4lw3rhgm504cnnafiwk175jpjbbd8h4b3";
+    sha256 = "1g30gl4b5fk1h13r2v4rspcqic9jg99717lxplk5birg3wi3b2d3";
  };

  installPhase = ''
--- a/pkgs/applications/networking/mailreaders/neomutt/default.nix
+++ b/pkgs/applications/networking/mailreaders/neomutt/default.nix
@ -42,6 +42,11 @@ stdenv.mkDerivation rec {
    "ac_cv_path_SENDMAIL=sendmail"
  ];

+  # Fix missing libidn in mutt;
+  # this fix is ugly since it links all binaries in mutt against libidn
+  # like pgpring, pgpewrap, ...
+  NIX_LDFLAGS = "-lidn";
+
  configureScript = "./prepare";

  enableParallelBuilding = true;
--- a/pkgs/applications/networking/sniffers/wireshark/default.nix
+++ b/pkgs/applications/networking/sniffers/wireshark/default.nix
@ -66,7 +66,7 @@ in stdenv.mkDerivation {
      experts. It runs on UNIX, macOS and Windows.
    '';

-    platforms = platforms.unix;
+    platforms = platforms.linux;
    maintainers = with maintainers; [ bjornfor fpletz ];
  };
 }
--- a/pkgs/applications/science/biology/ants/default.nix
+++ b/pkgs/applications/science/biology/ants/default.nix
@ -2,23 +2,26 @@

 stdenv.mkDerivation rec {
  _name    = "ANTs";
-  _version = "2.1.0";
+  _version = "2.2.0";
  name  = "${_name}-${_version}";

  src = fetchFromGitHub {
-    owner  = "stnava";
+    owner  = "ANTsX";
    repo   = "ANTs";
-    rev    = "4e02aa76621698e3513330dd9e863e22917e14b7";
-    sha256 = "0gyys1lf69bl3569cskxc8r5llwcr0dsyzvlby5skhfpsyw0dh8r";
+    rev    = "37ad4e20be3a5ecd26c2e4e41b49e778a0246c3d";
+    sha256 = "1hrdwv3m9xh3yf7l0rm2ggxc2xzckfb8srs88g485ibfszx7i03q";
  };

  nativeBuildInputs = [ cmake makeWrapper ];
  buildInputs = [ itk vtk ];

-  cmakeFlags = [ "-DANTS_SUPERBUILD=FALSE" "-DUSE_VTK=TRUE" ];
+  cmakeFlags = [ "-DANTS_SUPERBUILD=FALSE" "-DUSE_VTK=TRUE"
+                 # as cmake otherwise tries to download test data:
+                 "-DBUILD_TESTING=FALSE" ];
+
+  enableParallelBuilding = true;

  checkPhase = "ctest";
-  doCheck = false;

  postInstall = ''
    for file in $out/bin/*; do
@ -27,7 +30,7 @@ stdenv.mkDerivation rec {
  '';

  meta = with stdenv.lib; {
-    homepage = https://github.com/stnava/ANTs;
+    homepage = https://github.com/ANTxS/ANTs;
    description = "Advanced normalization toolkit for medical image registration and other processing";
    maintainers = with maintainers; [ bcdarwin ];
    platforms = platforms.unix;
--- a/pkgs/applications/science/biology/plink-ng/default.nix
+++ b/pkgs/applications/science/biology/plink-ng/default.nix
@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
    description = "A comprehensive update to the PLINK association analysis toolset";
    homepage = https://www.cog-genomics.org/plink2;
    license = stdenv.lib.licenses.gpl3;
-    platforms = stdenv.lib.platforms.all;
+    platforms = stdenv.lib.platforms.linux;
  };
 }

--- a/pkgs/applications/science/logic/abella/default.nix
+++ b/pkgs/applications/science/logic/abella/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchurl, rsync, ocaml }:
+{ stdenv, fetchurl, rsync, ocamlPackages }:

 stdenv.mkDerivation rec {
  name = "abella-${version}";
@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
    sha256 = "b56d865ebdb198111f1dcd5b6fbcc0d7fc6dd1294f7601903ba4e3c3322c099c";
  };

-  buildInputs = [ rsync ocaml ];
+  buildInputs = [ rsync ] ++ (with ocamlPackages; [ ocaml ocamlbuild ]);

  installPhase = ''
    mkdir -p $out/bin
--- a/pkgs/applications/science/logic/jonprl/default.nix
+++ b/pkgs/applications/science/logic/jonprl/default.nix
@ -29,6 +29,6 @@ stdenv.mkDerivation rec {
    homepage = http://www.jonprl.org/;
    license = stdenv.lib.licenses.mit;
    maintainers = with stdenv.lib.maintainers; [ puffnfresh ];
-    platforms = stdenv.lib.platforms.unix;
+    platforms = stdenv.lib.platforms.linux;
  };
 }
--- a/pkgs/applications/science/math/calc/default.nix
+++ b/pkgs/applications/science/math/calc/default.nix
@ -12,11 +12,11 @@ in
 stdenv.mkDerivation rec {

  name = "calc-${version}";
-  version = "2.12.6.1";
+  version = "2.12.6.3";

  src = fetchurl {
    url = "https://github.com/lcn2/calc/releases/download/${version}/${name}.tar.bz2";
-    sha256 = "1vy4jmhmpl3gzgpkpv0kqwjv8hn1cza8cn1g8c69gq3inqvr4fvd";
+    sha256 = "01m20s5zs74zyb23x6zg6i13gc30a2ay2iz1rdbkxram01cblzky";
  };

  buildInputs = [ makeWrapper readline ncurses utillinux ];
--- a/pkgs/applications/video/ogmtools/default.nix
+++ b/pkgs/applications/video/ogmtools/default.nix
@ -19,6 +19,6 @@ stdenv.mkDerivation rec {
    '';
    homepage = http://www.bunkus.org/videotools/ogmtools/;
    license = stdenv.lib.licenses.gpl2;
-    platforms = stdenv.lib.platforms.all;
+    platforms = stdenv.lib.platforms.linux;
  };
 }
--- a/pkgs/build-support/docker/default.nix
+++ b/pkgs/build-support/docker/default.nix
@ -10,6 +10,8 @@
  lib,
  pkgs,
  pigz,
+  nixUnstable,
+  perl,
  runCommand,
  rsync,
  shadow,
@ -27,7 +29,7 @@
 rec {

  examples = import ./examples.nix {
-    inherit pkgs buildImage pullImage shadowSetup;
+    inherit pkgs buildImage pullImage shadowSetup buildImageWithNixDb;
  };

  pullImage =
@ -239,6 +241,19 @@ rec {
      ${text}
    '';

+  nixRegistration = contents: runCommand "nix-registration" {
+    buildInputs = [ nixUnstable perl ];
+    # For obtaining the closure of `contents'.
+    exportReferencesGraph =
+      let contentsList = if builtins.isList contents then contents else [ contents ];
+      in map (x: [("closure-" + baseNameOf x) x]) contentsList;
+    }
+    ''
+      mkdir $out
+      printRegistration=1 perl ${pkgs.pathsFromGraph} closure-* > $out/db.dump
+      perl ${pkgs.pathsFromGraph} closure-* > $out/storePaths
+    '';
+
  # Create a "layer" (set of files).
  mkPureLayer = {
    # Name of the layer
@ -544,4 +559,37 @@ rec {

    in
    result;
+
+  # Build an image and populate its nix database with the provided
+  # contents. The main purpose is to be able to use nix commands in
+  # the container.
+  # Be careful since this doesn't work well with multilayer.
+  buildImageWithNixDb = args@{ contents ? null, extraCommands ? "", ... }:
+    buildImage (args // {
+      extraCommands = ''
+        echo "Generating the nix database..."
+        echo "Warning: only the database of the deepest Nix layer is loaded."
+        echo "         If you want to use nix commands in the container, it would"
+        echo "         be better to only have one layer that contains a nix store."
+        # This requires Nix 1.12 or higher
+        export NIX_REMOTE=local?root=$PWD
+        ${nixUnstable}/bin/nix-store --load-db < ${nixRegistration contents}/db.dump
+
+        # We fill the store in order to run the 'verify' command that
+        # generates hash and size of output paths.
+        # Note when Nix 1.12 is be the stable one, the database dump
+        # generated by the exportReferencesGraph function will
+        # contains sha and size. See
+        # https://github.com/NixOS/nix/commit/c2b0d8749f7e77afc1c4b3e8dd36b7ee9720af4a
+        storePaths=$(cat ${nixRegistration contents}/storePaths)
+        echo "Copying everything to /nix/store (will take a while)..."
+        cp -prd $storePaths nix/store/
+        ${nixUnstable}/bin/nix-store --verify --check-contents
+
+        mkdir -p nix/var/nix/gcroots/docker/
+        for i in ${lib.concatStringsSep " " contents}; do
+          ln -s $i nix/var/nix/gcroots/docker/$(basename $i)
+        done;
+      '' + extraCommands;
+    });
 }
--- a/pkgs/build-support/docker/examples.nix
+++ b/pkgs/build-support/docker/examples.nix
@ -7,7 +7,7 @@
 #  $ nix-build '<nixpkgs>' -A dockerTools.examples.redis
 #  $ docker load < result

-{ pkgs, buildImage, pullImage, shadowSetup }:
+{ pkgs, buildImage, pullImage, shadowSetup, buildImageWithNixDb }:

 rec {
  # 1. basic example
@ -83,7 +83,7 @@ rec {
  };

  # 4. example of pulling an image. could be used as a base for other images
-  nix = pullImage {
+  nixFromDockerHub = pullImage {
    imageName = "nixos/nix";
    imageTag = "1.11";
    # this hash will need change if the tag is updated at docker hub
@ -101,4 +101,17 @@ rec {
      pkgs.nano
    ];
  };
+
+  # 5. nix example to play with the container nix store
+  # docker run -it --rm nix nix-store -qR $(nix-build '<nixpkgs>' -A nix)
+  nix = buildImageWithNixDb {
+    name = "nix";
+    contents = [
+      # nix-store -qR uses the 'more' program which is not included in
+      # the pkgs.nix dependencies. We then have to manually get it
+      # from the 'eject' package:/
+      pkgs.eject
+      pkgs.nix
+    ];
+  };
 }
--- a/pkgs/desktops/lxde/core/lxappearance/default.nix
+++ b/pkgs/desktops/lxde/core/lxappearance/default.nix
@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
    description = "A lightweight program for configuring the theme and fonts of gtk applications";
    homepage = http://lxde.org/;
    maintainers = [ stdenv.lib.maintainers.hinton ];
-    platforms = stdenv.lib.platforms.all;
+    platforms = stdenv.lib.platforms.linux;
    license = stdenv.lib.licenses.gpl2;
  };
 }
--- a/pkgs/desktops/mate/libmatemixer/default.nix
+++ b/pkgs/desktops/mate/libmatemixer/default.nix
@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
    description = "Mixer library for MATE";
    homepage = https://github.com/mate-desktop/libmatemixer;
    license = with licenses; [ gpl2 lgpl2 ];
-    platforms = platforms.unix;
+    platforms = platforms.linux;
    maintainers = [ maintainers.romildo ];
  };
 }
--- a/pkgs/desktops/mate/mate-desktop/default.nix
+++ b/pkgs/desktops/mate/mate-desktop/default.nix
@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
    description = "Library with common API for various MATE modules";
    homepage = http://mate-desktop.org;
    license = licenses.gpl2;
-    platforms = platforms.unix;
+    platforms = platforms.linux;
    maintainers = [ maintainers.romildo ];
  };
 }
--- a/pkgs/development/compilers/dmd/2.067.1.nix
+++ b/pkgs/development/compilers/dmd/2.067.1.nix
@ -43,6 +43,7 @@ stdenv.mkDerivation rec {
  # Compile with PIC to prevent colliding modules with binutils 2.28.
  # https://issues.dlang.org/show_bug.cgi?id=17375
  usePIC = "-fPIC";
+  ROOT_HOME_DIR = "$(echo ~root)";

  postPatch = ''
      # Ugly hack so the dlopen call has a chance to succeed.
@ -70,6 +71,10 @@ stdenv.mkDerivation rec {
  + stdenv.lib.optionalString stdenv.hostPlatform.isLinux ''
      substituteInPlace dmd/src/root/port.c \
        --replace "#include <bits/mathdef.h>" "#include <complex.h>"
+
+      # See https://github.com/NixOS/nixpkgs/issues/29443
+      substituteInPlace phobos/std/path.d \
+          --replace "\"/root" "\"${ROOT_HOME_DIR}"
  ''

  + stdenv.lib.optionalString stdenv.hostPlatform.isDarwin ''
@ -96,7 +101,8 @@ stdenv.mkDerivation rec {
      cd ..
  '';

-  doCheck = true;
+  # disable check phase because some tests are not working with sandboxing
+  doCheck = false;

  checkPhase = ''
      cd dmd
--- a/pkgs/development/compilers/dmd/default.nix
+++ b/pkgs/development/compilers/dmd/default.nix
@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub
 , makeWrapper, unzip, which
-, curl, tzdata, gdb
+, curl, tzdata, gdb, darwin
 # Versions 2.070.2 and up require a working dmd compiler to build:
 , bootstrapDmd }:

@ -73,7 +73,12 @@ stdenv.mkDerivation rec {
            --replace MACOSX_DEPLOYMENT_TARGET MACOSX_DEPLOYMENT_TARGET_
    '';

-  nativeBuildInputs = [ bootstrapDmd makeWrapper unzip which gdb ];
+  nativeBuildInputs = [ bootstrapDmd makeWrapper unzip which gdb ]
+
+  ++ stdenv.lib.optional stdenv.hostPlatform.isDarwin (with darwin.apple_sdk.frameworks; [
+    Foundation
+  ]);
+
  buildInputs = [ curl tzdata ];

  # Buid and install are based on http://wiki.dlang.org/Building_DMD
@ -92,7 +97,8 @@ stdenv.mkDerivation rec {
      cd ..
  '';

-  doCheck = true;
+  # disable check phase because some tests are not working with sandboxing
+  doCheck = false;

  checkPhase = ''
      cd dmd
--- a/pkgs/development/compilers/ldc/default.nix
+++ b/pkgs/development/compilers/ldc/default.nix
@ -81,7 +81,8 @@ stdenv.mkDerivation rec {

  makeFlags = [ "DMD=$DMD" ];

-  doCheck = true;
+  # disable check phase because some tests are not working with sandboxing
+  doCheck = false;

  checkPhase = ''
      ctest -j $NIX_BUILD_CORES -V DMD=$DMD
--- a/pkgs/development/compilers/openjdk/8.nix
+++ b/pkgs/development/compilers/openjdk/8.nix
@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, cpio, pkgconfig, file, which, unzip, zip, cups, freetype
+{ stdenv, lib, fetchurl, bash, cpio, pkgconfig, file, which, unzip, zip, cups, freetype
 , alsaLib, bootjdk, cacert, perl, liberation_ttf, fontconfig, zlib, lndir
 , libX11, libICE, libXrender, libXext, libXt, libXtst, libXi, libXinerama, libXcursor
 , libjpeg, giflib
@ -75,11 +75,14 @@ let
      gtk2 gnome_vfs GConf glib
    ];

+    #move the seven other source dirs under the main jdk8u directory,
+    #with version suffixes removed, as the remainder of the build will expect
    prePatch = ''
-      ls | grep jdk | grep -v '^jdk8u' | awk -F- '{print $1}' | while read p; do
-        mv $p-* $(ls | grep '^jdk8u')/$p
+      mainDir=$(find . -maxdepth 1 -name jdk8u\*);
+      find . -maxdepth 1 -name \*jdk\* -not -name jdk8u\* | awk -F- '{print $1}' | while read p; do
+        mv $p-* $mainDir/$p
      done
-      cd $(ls | grep '^jdk8u')
+      cd $mainDir
    '';

    patches = [
@ -95,7 +98,7 @@ let

    preConfigure = ''
      chmod +x configure
-      substituteInPlace configure --replace /bin/bash "$shell"
+      substituteInPlace configure --replace /bin/bash "${bash}/bin/bash"
      substituteInPlace hotspot/make/linux/adlc_updater --replace /bin/sh "$shell"
      substituteInPlace hotspot/make/linux/makefiles/dtrace.make --replace /usr/include/sys/sdt.h "/no-such-path"
    ''
@ -188,10 +191,11 @@ let
      done

      # Generate certificates.
-      pushd $jre/lib/openjdk/jre/lib/security
+      (
+        cd $jre/lib/openjdk/jre/lib/security
        rm cacerts
        perl ${./generate-cacerts.pl} $jre/lib/openjdk/jre/bin/keytool ${cacert}/etc/ssl/certs/ca-bundle.crt
-      popd
+      )

      ln -s $out/lib/openjdk/bin $out/bin
      ln -s $jre/lib/openjdk/jre/bin $jre/bin
@ -221,13 +225,13 @@ let
      # Build the set of output library directories to rpath against
      LIBDIRS=""
      for output in $outputs; do
-        LIBDIRS="$(find $(eval echo \$$output) -name \*.so\* -exec dirname {} \; | sort | uniq | tr '\n' ':'):$LIBDIRS"
+        LIBDIRS="$(find $(eval echo \$$output) -name \*.so\* -exec dirname {} \+ | sort | uniq | tr '\n' ':'):$LIBDIRS"
      done

      # Add the local library paths to remove dependencies on the bootstrap
      for output in $outputs; do
-        OUTPUTDIR="$(eval echo \$$output)"
-        BINLIBS="$(find $OUTPUTDIR/bin/ -type f; find $OUTPUTDIR -name \*.so\*)"
+        OUTPUTDIR=$(eval echo \$$output)
+        BINLIBS=$(find $OUTPUTDIR/bin/ -type f; find $OUTPUTDIR -name \*.so\*)
        echo "$BINLIBS" | while read i; do
          patchelf --set-rpath "$LIBDIRS:$(patchelf --print-rpath "$i")" "$i" || true
          patchelf --shrink-rpath "$i" || true
--- a/pkgs/development/compilers/openjdk/9.nix
+++ b/pkgs/development/compilers/openjdk/9.nix
@ -0,0 +1,262 @@
+{ stdenv, lib, fetchurl, bash, cpio, pkgconfig, file, which, unzip, zip, cups, freetype
+, alsaLib, bootjdk, cacert, perl, liberation_ttf, fontconfig, zlib, lndir
+, libX11, libICE, libXrender, libXext, libXt, libXtst, libXi, libXinerama, libXcursor
+, libjpeg, giflib
+, setJavaClassPath
+, minimal ? false
+#, enableInfinality ? true # font rendering patch
+, enableGnome2 ? true, gtk2, gnome_vfs, glib, GConf
+}:
+
+let
+
+  /**
+   * The JRE libraries are in directories that depend on the CPU.
+   */
+  architecture =
+    if stdenv.system == "i686-linux" then
+      "i386"
+    else if stdenv.system == "x86_64-linux" then
+      "amd64"
+    else
+      throw "openjdk requires i686-linux or x86_64 linux";
+
+  update = "";
+  build = "181";
+  baseurl = "http://hg.openjdk.java.net/jdk9/jdk9";
+  repover = "jdk-9${update}+${build}";
+  paxflags = if stdenv.isi686 then "msp" else "m";
+  jdk9 = fetchurl {
+             url = "${baseurl}/archive/${repover}.tar.gz";
+             sha256 = "0c7jwz4qvl93brs6c2v4dfc2v3lsv6ic0y72lkh04bnxg9343z82";
+          };
+  langtools = fetchurl {
+             url = "${baseurl}/langtools/archive/${repover}.tar.gz";
+             sha256 = "1wa5rjan6lcs8nnxndbwpw6gkx3qbw013s6zisjjczkcaiq044pp";
+          };
+  hotspot = fetchurl {
+             url = "${baseurl}/hotspot/archive/${repover}.tar.gz";
+             sha256 = "00jnj19rim1gxpsxrpr8ifx1glwrbma3qjiy1ya7n5f08fb263hs";
+          };
+  corba = fetchurl {
+             url = "${baseurl}/corba/archive/${repover}.tar.gz";
+             sha256 = "1gvx6dblzj7rb8648iqwdiv36x97ibykgs323dd9044n3vbqihvj";
+          };
+  jdk = fetchurl {
+             url = "${baseurl}/jdk/archive/${repover}.tar.gz";
+             sha256 = "15pwdw6s03rfyw2gx06xg4f70bjl8j19ycssxiigj39h524xc9aw";
+          };
+  jaxws = fetchurl {
+             url = "${baseurl}/jaxws/archive/${repover}.tar.gz";
+             sha256 = "0jz32pjbgr77ybb2v1vwr1n9ljdrc3y0d5lrj072g3is1hmn2wbh";
+          };
+  jaxp = fetchurl {
+             url = "${baseurl}/jaxp/archive/${repover}.tar.gz";
+             sha256 = "1jdxr9hcqx6va56ll5s2x9bx9dnlrs7zyvhjk1zgr5hxg5yfcqzr";
+          };
+  nashorn = fetchurl {
+             url = "${baseurl}/nashorn/archive/${repover}.tar.gz";
+             sha256 = "12lihmw9ga6yhz0h26fvfablcjkkma0k3idjggmap97xha8zgd6n";
+          };
+  openjdk9 = stdenv.mkDerivation {
+    name = "openjdk-9${update}-b${build}";
+
+    srcs = [ jdk9 langtools hotspot corba jdk jaxws jaxp nashorn ];
+    sourceRoot = ".";
+
+    outputs = [ "out" "jre" ];
+
+    nativeBuildInputs = [ pkgconfig ];
+    buildInputs = [
+      cpio file which unzip zip perl bootjdk zlib cups freetype alsaLib
+      libjpeg giflib libX11 libICE libXext libXrender libXtst libXt libXtst
+      libXi libXinerama libXcursor lndir fontconfig
+    ] ++ lib.optionals (!minimal && enableGnome2) [
+      gtk2 gnome_vfs GConf glib
+    ];
+
+    #move the seven other source dirs under the main jdk8u directory,
+    #with version suffixes removed, as the remainder of the build will expect
+    prePatch = ''
+      mainDir=$(find . -maxdepth 1 -name jdk9\*);
+      find . -maxdepth 1 -name \*jdk\* -not -name jdk9\* | awk -F- '{print $1}' | while read p; do
+        mv $p-* $mainDir/$p
+      done
+      cd $mainDir
+    '';
+
+    patches = [
+      ./fix-java-home-jdk9.patch
+      ./read-truststore-from-env-jdk9.patch
+      ./currency-date-range-jdk8.patch
+    #] ++ lib.optionals (!minimal && enableInfinality) [
+    #  ./004_add-fontconfig.patch
+    #  ./005_enable-infinality.patch
+    ] ++ lib.optionals (!minimal && enableGnome2) [
+      ./swing-use-gtk-jdk9.patch
+    ];
+
+    preConfigure = ''
+      chmod +x configure
+      substituteInPlace configure --replace /bin/bash "${bash}/bin/bash"
+
+      configureFlagsArray=(
+        "--with-boot-jdk=${bootjdk.home}"
+        "--with-update-version=${update}"
+        "--with-build-number=${build}"
+        "--with-milestone=fcs"
+        "--enable-unlimited-crypto"
+        "--disable-debug-symbols"
+        "--disable-freetype-bundling"
+        "--with-zlib=system"
+        "--with-giflib=system"
+        "--with-stdc++lib=dynamic"
+
+        # glibc 2.24 deprecated readdir_r so we need this
+        # See https://www.mail-archive.com/openembedded-devel@lists.openembedded.org/msg49006.html
+        "--with-extra-cflags=-Wno-error=deprecated-declarations -Wno-error=format-contains-nul -Wno-error=unused-result"
+    ''
+    + lib.optionalString minimal "\"--enable-headless-only\""
+    + ");"
+    # https://bugzilla.redhat.com/show_bug.cgi?id=1306558
+    # https://github.com/JetBrains/jdk8u/commit/eaa5e0711a43d64874111254d74893fa299d5716
+    + stdenv.lib.optionalString stdenv.cc.isGNU ''
+      NIX_CFLAGS_COMPILE+=" -fno-lifetime-dse -fno-delete-null-pointer-checks -std=gnu++98 -Wno-error"
+    '';
+
+    NIX_LDFLAGS= lib.optionals (!minimal) [
+      "-lfontconfig" "-lcups" "-lXinerama" "-lXrandr" "-lmagic"
+    ] ++ lib.optionals (!minimal && enableGnome2) [
+      "-lgtk-x11-2.0" "-lgio-2.0" "-lgnomevfs-2" "-lgconf-2"
+    ];
+
+    buildFlags = [ "all" ];
+
+    installPhase = ''
+      mkdir -p $out/lib/openjdk $out/share $jre/lib/openjdk
+
+      cp -av build/*/images/jdk/* $out/lib/openjdk
+
+      # Remove some broken manpages.
+      rm -rf $out/lib/openjdk/man/ja*
+
+      # Mirror some stuff in top-level.
+      mkdir $out/include $out/share/man
+      ln -s $out/lib/openjdk/include/* $out/include/
+      ln -s $out/lib/openjdk/man/* $out/share/man/
+
+      # jni.h expects jni_md.h to be in the header search path.
+      ln -s $out/include/linux/*_md.h $out/include/
+
+      # Copy the JRE to a separate output and setup fallback fonts
+      cp -av build/*/images/jre $jre/lib/openjdk/
+      mkdir $out/lib/openjdk/jre
+      ${lib.optionalString (!minimal) ''
+        mkdir -p $jre/lib/openjdk/jre/lib/fonts/fallback
+        lndir ${liberation_ttf}/share/fonts/truetype $jre/lib/openjdk/jre/lib/fonts/fallback
+      ''}
+
+      # Remove crap from the installation.
+      rm -rf $out/lib/openjdk/demo
+      ${lib.optionalString minimal ''
+        for d in $out/lib/openjdk/lib $jre/lib/openjdk/jre/lib; do
+          rm ''${d}/{libjsound,libjsoundalsa,libawt*,libfontmanager}.so
+        done
+      ''}
+
+      lndir $jre/lib/openjdk/jre $out/lib/openjdk/jre
+
+      # Make sure cmm/*.pf are not symlinks:
+      # https://youtrack.jetbrains.com/issue/IDEA-147272
+      # in 9, it seems no *.pf files end up in $out ... ?
+      # rm -rf $out/lib/openjdk/jre/lib/cmm
+      # ln -s {$jre,$out}/lib/openjdk/jre/lib/cmm
+
+      # Set PaX markings
+      exes=$(file $out/lib/openjdk/bin/* $jre/lib/openjdk/jre/bin/* 2> /dev/null | grep -E 'ELF.*(executable|shared object)' | sed -e 's/: .*$//')
+      echo "to mark: *$exes*"
+      for file in $exes; do
+        echo "marking *$file*"
+        paxmark ${paxflags} "$file"
+      done
+
+      # Remove duplicate binaries.
+      for i in $(cd $out/lib/openjdk/bin && echo *); do
+        if [ "$i" = java ]; then continue; fi
+        if cmp -s $out/lib/openjdk/bin/$i $jre/lib/openjdk/jre/bin/$i; then
+          ln -sfn $jre/lib/openjdk/jre/bin/$i $out/lib/openjdk/bin/$i
+        fi
+      done
+
+      # Generate certificates.
+      (
+        cd $jre/lib/openjdk/jre/lib/security
+        rm cacerts
+        perl ${./generate-cacerts.pl} $jre/lib/openjdk/jre/bin/keytool ${cacert}/etc/ssl/certs/ca-bundle.crt
+      )
+
+      ln -s $out/lib/openjdk/bin $out/bin
+      ln -s $jre/lib/openjdk/jre/bin $jre/bin
+      ln -s $jre/lib/openjdk/jre $out/jre
+    '';
+
+    # FIXME: this is unnecessary once the multiple-outputs branch is merged.
+    preFixup = ''
+      prefix=$jre stripDirs "$stripDebugList" "''${stripDebugFlags:--S}"
+      patchELF $jre
+      propagatedNativeBuildInputs+=" $jre"
+
+      # Propagate the setJavaClassPath setup hook from the JRE so that
+      # any package that depends on the JRE has $CLASSPATH set up
+      # properly.
+      mkdir -p $jre/nix-support
+      #TODO or printWords?  cf https://github.com/NixOS/nixpkgs/pull/27427#issuecomment-317293040
+      echo -n "${setJavaClassPath}" > $jre/nix-support/propagated-native-build-inputs
+
+      # Set JAVA_HOME automatically.
+      mkdir -p $out/nix-support
+      cat <<EOF > $out/nix-support/setup-hook
+      if [ -z "\$JAVA_HOME" ]; then export JAVA_HOME=$out/lib/openjdk; fi
+      EOF
+    '';
+
+    postFixup = ''
+      # Build the set of output library directories to rpath against
+      LIBDIRS=""
+      for output in $outputs; do
+        LIBDIRS="$(find $(eval echo \$$output) -name \*.so\* -exec dirname {} \+ | sort | uniq | tr '\n' ':'):$LIBDIRS"
+      done
+
+      # Add the local library paths to remove dependencies on the bootstrap
+      for output in $outputs; do
+        OUTPUTDIR=$(eval echo \$$output)
+        BINLIBS=$(find $OUTPUTDIR/bin/ -type f; find $OUTPUTDIR -name \*.so\*)
+        echo "$BINLIBS" | while read i; do
+          patchelf --set-rpath "$LIBDIRS:$(patchelf --print-rpath "$i")" "$i" || true
+          patchelf --shrink-rpath "$i" || true
+        done
+      done
+
+      # Test to make sure that we don't depend on the bootstrap
+      for output in $outputs; do
+        if grep -q -r '${bootjdk}' $(eval echo \$$output); then
+          echo "Extraneous references to ${bootjdk} detected"
+          exit 1
+        fi
+      done
+    '';
+
+    meta = with stdenv.lib; {
+      homepage = http://openjdk.java.net/;
+      license = licenses.gpl2;
+      description = "The open-source Java Development Kit";
+      maintainers = with maintainers; [ edwtjo ];
+      platforms = platforms.linux;
+    };
+
+    passthru = {
+      inherit architecture;
+      home = "${openjdk9}/lib/openjdk";
+    };
+  };
+in openjdk9
--- a/pkgs/development/compilers/openjdk/fix-java-home-jdk9.patch
+++ b/pkgs/development/compilers/openjdk/fix-java-home-jdk9.patch
@ -0,0 +1,14 @@
+--- a/hotspot/src/os/linux/vm/os_linux.cpp	2017-07-04 23:09:02.533972226 -0400
+++ b/hotspot/src/os/linux/vm/os_linux.cpp	2017-07-04 23:07:52.118338845 -0400
+@@ -2318,10 +2318,7 @@
+   assert(ret, "cannot locate libjvm");
+   char *rp = NULL;
+   if (ret && dli_fname[0] != '\0') {
+-    rp = realpath(dli_fname, buf);
+-  }
+-  if (rp == NULL) {
+-    return;
+    snprintf(buf, buflen, "%s", dli_fname);
+   }
+ 
+   if (Arguments::sun_java_launcher_is_altjvm()) {
--- a/pkgs/development/compilers/openjdk/read-truststore-from-env-jdk9.patch
+++ b/pkgs/development/compilers/openjdk/read-truststore-from-env-jdk9.patch
@ -0,0 +1,20 @@
+--- a/jdk/src/java.base/share/classes/sun/security/ssl/TrustStoreManager.java	2017-06-26 21:48:25.000000000 -0400
+++ b/jdk/src/java.base/share/classes/sun/security/ssl/TrustStoreManager.java.new	2017-07-05 20:45:57.491295030 -0400
+@@ -71,6 +71,7 @@
+      *
+      * The preference of the default trusted KeyStore is:
+      *    javax.net.ssl.trustStore
+     *    system environment variable JAVAX_NET_SSL_TRUSTSTORE
+      *    jssecacerts
+      *    cacerts
+      */
+@@ -144,6 +145,9 @@
+                     String temporaryName = "";
+                     File temporaryFile = null;
+                     long temporaryTime = 0L;
+                    if (storePropName == null){
+                        storePropName = System.getenv("JAVAX_NET_SSL_TRUSTSTORE");
+                    }
+                     if (!"NONE".equals(storePropName)) {
+                         String[] fileNames =
+                                 new String[] {storePropName, defaultStore};
--- a/pkgs/development/compilers/openjdk/swing-use-gtk-jdk9.patch
+++ b/pkgs/development/compilers/openjdk/swing-use-gtk-jdk9.patch
@ -0,0 +1,26 @@
+diff -ru3 a/jdk/src/share/classes/javax/swing/UIManager.java b/jdk/src/share/classes/javax/swing/UIManager.java
+--- a/jdk/src/java.desktop/share/classes/javax/swing/UIManager.java	2016-07-26 00:41:37.000000000 +0300
+++ b/jdk/src/java.desktop/share/classes/javax/swing/UIManager.java	2016-10-02 22:46:01.890071761 +0300
+@@ -607,11 +607,9 @@
+         if (osType == OSInfo.OSType.WINDOWS) {
+             return "com.sun.java.swing.plaf.windows.WindowsLookAndFeel";
+         } else {
+-            String desktop = AccessController.doPrivileged(new GetPropertyAction("sun.desktop"));
+             Toolkit toolkit = Toolkit.getDefaultToolkit();
+-            if ("gnome".equals(desktop) &&
+-                    toolkit instanceof SunToolkit &&
+-                    ((SunToolkit) toolkit).isNativeGTKAvailable()) {
+            if (toolkit instanceof SunToolkit &&
+                    ((SunToolkit) toolkit).isNativeGTKAvailable()) {
+                 // May be set on Linux and Solaris boxs.
+                 return "com.sun.java.swing.plaf.gtk.GTKLookAndFeel";
+             }
+@@ -1341,7 +1339,7 @@
+             lafName = (String) lafData.remove("defaultlaf");
+         }
+         if (lafName == null) {
+-            lafName = getCrossPlatformLookAndFeelClassName();
+            lafName = getSystemLookAndFeelClassName();
+         }
+         lafName = swingProps.getProperty(defaultLAFKey, lafName);
+ 
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@ -720,6 +720,9 @@ self: super: {
  # It makes no sense to have intero-nix-shim in Hackage, so we publish it here only.
  intero-nix-shim = self.callPackage ../tools/haskell/intero-nix-shim {};

+  # vaultenv is not available from Hackage.
+  vaultenv = self.callPackage ../tools/haskell/vaultenv { };
+
  # https://github.com/Philonous/hs-stun/pull/1
  # Remove if a version > 0.1.0.1 ever gets released.
  stunclient = overrideCabal super.stunclient (drv: {
--- a/pkgs/development/libraries/dirac/default.nix
+++ b/pkgs/development/libraries/dirac/default.nix
@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
  meta = with stdenv.lib; {
    homepage = http://sourceforge.net/projects/dirac;
    description = "A general-purpose video codec based on wavelets";
-    platforms = platforms.all;
+    platforms = platforms.linux;
    license = with licenses; [ mpl11 gpl2 lgpl21 ];
    maintainer = maintainers.igsha;
  };
--- a/pkgs/development/libraries/idnkit/default.nix
+++ b/pkgs/development/libraries/idnkit/default.nix
@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
    homepage = https://www.nic.ad.jp/ja/idn/idnkit;
    description = "Provides functionalities about i18n domain name processing";
    license = "idnkit-2 license";
-    platforms = platforms.unix;
+    platforms = platforms.linux;
    maintainers = with maintainers; [ wkennington ];
  };
 }
--- a/pkgs/development/libraries/libuv/default.nix
+++ b/pkgs/development/libraries/libuv/default.nix
@ -2,14 +2,14 @@
 , ApplicationServices, CoreServices }:

 stdenv.mkDerivation rec {
-  version = "1.13.1";
+  version = "1.14.1";
  name = "libuv-${version}";

  src = fetchFromGitHub {
    owner = "libuv";
    repo = "libuv";
    rev = "v${version}";
-    sha256 = "0k348kgdphha1w4cw78zngq3gqcrhcn0az7k0k4w2bgmdf4ip8z8";
+    sha256 = "1121qvnvpcabq1bl2k41jq8r2hn2x123csiaf7s9vrq66bbxgfdx";
  };

  postPatch = let
--- a/pkgs/development/libraries/lmdb/default.nix
+++ b/pkgs/development/libraries/lmdb/default.nix
@ -1,7 +1,6 @@
 { stdenv, fetchFromGitHub }:

-let optional = stdenv.lib.optional;
-in stdenv.mkDerivation rec {
+stdenv.mkDerivation rec {
  name = "lmdb-${version}";
  version = "0.9.21";

@ -16,7 +15,8 @@ in stdenv.mkDerivation rec {

  outputs = [ "bin" "out" "dev" ];

-  makeFlags = [ "prefix=$(out)" "CC=cc" ];
+  makeFlags = [ "prefix=$(out)" "CC=cc" ]
+    ++ stdenv.lib.optional stdenv.isDarwin "LDFLAGS=-Wl,-install_name,$(out)/lib/liblmdb.so";

  doCheck = true;
  checkPhase = "make test";
@ -25,12 +25,6 @@ in stdenv.mkDerivation rec {
    moveToOutput bin "$bin"
    moveToOutput "lib/*.a" REMOVE # until someone needs it
  ''
-
-    # fix bogus library name
-    + stdenv.lib.optionalString stdenv.isDarwin ''
-    mv "$out"/lib/liblmdb.{so,dylib}
-    ''
-
    # add lmdb.pc (dynamic only)
    + ''
    mkdir -p "$dev/lib/pkgconfig"
--- a/pkgs/development/libraries/qt-5/qtbase-setup-hook.sh
+++ b/pkgs/development/libraries/qt-5/qtbase-setup-hook.sh
@ -123,7 +123,7 @@ if [ -z "$NIX_QT5_TMP" ]; then

    mkdir -p "$NIX_QT5_TMP/nix-support"
    for subdir in bin include lib mkspecs share; do
-        mkdir "$NIX_QT5_TMP/$subdir"
+        mkdir -p "$NIX_QT5_TMP/$subdir"
        echo "$subdir/" >> "$NIX_QT5_TMP/nix-support/qt-inputs"
    done

--- a/pkgs/development/libraries/resolv_wrapper/default.nix
+++ b/pkgs/development/libraries/resolv_wrapper/default.nix
@ -15,6 +15,6 @@ stdenv.mkDerivation rec {
    homepage = "https://git.samba.org/?p=uid_wrapper.git;a=summary;";
    license = licenses.bsd3;
    maintainers = with maintainers; [ wkennington ];
-    platforms = platforms.all;
+    platforms = platforms.linux;
  };
 }
--- a/pkgs/development/libraries/vapoursynth/default.nix
+++ b/pkgs/development/libraries/vapoursynth/default.nix
@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub, pkgconfig, autoreconfHook,
-  zimg, libass, yasm, python3,
+  zimg, libass, yasm, python3, libiconv, ApplicationServices,
  ocrSupport ?  false, tesseract,
  imwriSupport? true,  imagemagick7
 }:
@ -20,11 +20,12 @@ stdenv.mkDerivation rec {
    sha256 = "0nabl6949s7awy7rnr4ck52v50xr0hwr280fyzsqixgp8w369jn0";
  };

+  nativeBuildInputs = [ pkgconfig autoreconfHook ];
  buildInputs = [
-    pkgconfig autoreconfHook
    zimg libass tesseract yasm
    (python3.withPackages (ps: with ps; [ sphinx cython ]))
-  ] ++ optional ocrSupport   tesseract
+  ] ++ optionals stdenv.isDarwin [ libiconv ApplicationServices ]
+    ++ optional ocrSupport   tesseract
    ++ optional imwriSupport imagemagick7;

  configureFlags = [
--- a/pkgs/development/libraries/vmmlib/default.nix
+++ b/pkgs/development/libraries/vmmlib/default.nix
@ -1,9 +1,10 @@
-{ stdenv, fetchFromGitHub, cmake, pkgconfig, boost, blas }:
+{ stdenv, fetchFromGitHub, cmake, pkgconfig, boost, blas
+, Accelerate, CoreGraphics, CoreVideo
+}:

 stdenv.mkDerivation rec {
  version = "1.6.2";
  name = "vmmlib-${version}";
-  buildInputs = [ stdenv pkgconfig cmake boost blas ];

  src = fetchFromGitHub {
    owner = "VMML";
@ -16,9 +17,13 @@ stdenv.mkDerivation rec {
    ./disable-cpack.patch   #disable the need of cpack/rpm
  ];

+  nativeBuildInputs = [ pkgconfig cmake ];
+  buildInputs = [ boost blas ]
+    ++ stdenv.lib.optionals stdenv.isDarwin [ Accelerate CoreGraphics CoreVideo ];
+
  enableParallelBuilding = true;

-  doCheck = true;
+  doCheck = !stdenv.isDarwin;

  checkTarget = "test";

--- a/pkgs/development/libraries/vsqlite/default.nix
+++ b/pkgs/development/libraries/vsqlite/default.nix
@ -11,10 +11,17 @@ stdenv.mkDerivation rec {

  buildInputs = [ boost sqlite ];

-  meta = {
+  prePatch = stdenv.lib.optionalString stdenv.isDarwin ''
+    substituteInPlace Makefile.in \
+        --replace '-Wl,--as-needed' "" \
+        --replace '-Wl,-soname -Wl,libvsqlitepp.so.3' \
+                  "-Wl,-install_name,$out/lib/libvsqlitepp.3.dylib"
+  '';
+
+  meta = with stdenv.lib; {
    homepage = http://vsqlite.virtuosic-bytes.com/;
    description = "C++ wrapper library for sqlite.";
-    license = stdenv.lib.licenses.bsd3;
-    platforms = stdenv.lib.platforms.unix;
+    license = licenses.bsd3;
+    platforms = platforms.unix;
  };
 }
--- a/pkgs/development/node-packages/node-packages-v4.nix
+++ b/pkgs/development/node-packages/node-packages-v4.nix
--- a/pkgs/development/node-packages/node-packages-v6.json
+++ b/pkgs/development/node-packages/node-packages-v6.json
@ -65,6 +65,7 @@
 , "peerflix-server"
 , "phantomjs"
 , "prettier"
+, "pulp"
 , "react-tools"
 , "s3http"
 , "semver"
--- a/pkgs/development/node-packages/node-packages-v6.nix
+++ b/pkgs/development/node-packages/node-packages-v6.nix
--- a/pkgs/development/python-modules/blessed/default.nix
+++ b/pkgs/development/python-modules/blessed/default.nix
@ -0,0 +1,21 @@
+{ stdenv, buildPythonPackage, fetchPypi, six, wcwidth }:
+
+buildPythonPackage rec {
+  name = "${pname}-${version}";
+  pname = "blessed";
+  version = "1.14.2";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0fv9f0074kxy1849h0kwwxw12sifpq3bv63pcz900zzjsigi4hi3";
+  };
+
+  propagatedBuildInputs = [ wcwidth six ];
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/jquast/blessed;
+    description = "A thin, practical wrapper around terminal capabilities in Python.";
+    maintainers = with maintainers; [ eqyiel ];
+    license = licenses.mit;
+  };
+}
--- a/pkgs/development/python-modules/cement/default.nix
+++ b/pkgs/development/python-modules/cement/default.nix
@ -0,0 +1,23 @@
+{ stdenv, buildPythonPackage, fetchPypi }:
+
+buildPythonPackage rec {
+  pname = "cement";
+  name = "${pname}-${version}";
+  version = "2.8.2";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1li2whjzfhbpg6fjb6r1r92fb3967p1xv6hqs3j787865h2ysrc7";
+  };
+
+  # Disable test tests since they depend on a memcached server running on
+  # 127.0.0.1:11211.
+  doCheck = false;
+
+  meta = with stdenv.lib; {
+    homepage = http://builtoncement.com/;
+    description = "A CLI Application Framework for Python.";
+    maintainers = with maintainers; [ eqyiel ];
+    license = licenses.bsd3;
+  };
+}
--- a/pkgs/development/qtcreator/default.nix
+++ b/pkgs/development/qtcreator/default.nix
@ -6,8 +6,8 @@
 with stdenv.lib;

 let
-  baseVersion = "4.3";
-  revision = "1";
+  baseVersion = "4.4";
+  revision = "0";
 in

 stdenv.mkDerivation rec {
@ -16,7 +16,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "http://download.qt-project.org/official_releases/qtcreator/${baseVersion}/${version}/qt-creator-opensource-src-${version}.tar.xz";
-    sha256 = "1bd4wxvp8b5imsmrbnn8rkiln38g74g2545x07pmihc8z51qh2h6";
+    sha256 = "00k2bb2pamqlq0i619wz8chii8yp884qnrjngzzxrdffk05d95wc";
  };

  buildInputs = [ qtbase qtscript qtquickcontrols qtdeclarative ];
--- a/pkgs/development/tools/haskell/vaultenv/default.nix
+++ b/pkgs/development/tools/haskell/vaultenv/default.nix
@ -0,0 +1,26 @@
+{ mkDerivation, fetchurl, async, base, bytestring, http-conduit, lens
+, lens-aeson, optparse-applicative, retry, stdenv, text, unix
+, unordered-containers, utf8-string
+}:
+
+mkDerivation rec {
+  pname = "vaultenv";
+  version = "0.5.0";
+
+  src = fetchurl {
+    url = "https://github.com/channable/vaultenv/archive/v${version}.tar.gz";
+    sha256 = "0hdcxq88cf3ygnikkppyg3fcf7xmwm9zif7274j3n34p9vd8xci3";
+  };
+
+  isLibrary = false;
+  isExecutable = true;
+  executableHaskellDepends = [
+    async base bytestring http-conduit lens lens-aeson
+    optparse-applicative retry text unix unordered-containers
+    utf8-string
+  ];
+  homepage = "https://github.com/channable/vaultenv";
+  description = "Runs processes with secrets from HashiCorp Vault";
+  license = stdenv.lib.licenses.bsd3;
+  maintainers = with stdenv.lib.maintainers; [ lnl7 ];
+}
--- a/pkgs/development/tools/misc/hydra/default.nix
+++ b/pkgs/development/tools/misc/hydra/default.nix
@ -62,15 +62,15 @@ let
  };
 in releaseTools.nixBuild rec {
  name = "hydra-${version}";
-  version = "2017-07-27";
+  version = "2017-09-14";

  inherit stdenv;

  src = fetchFromGitHub {
    owner = "NixOS";
    repo = "hydra";
-    rev = "3fc320db320c9aa5180c54e77513f1bcb7407079";
-    sha256 = "0kml2rvy5pz8pzl23vfib5vrwxccff9j1jmyq926qv7f5kbzy61b";
+    rev = "b828224fee451ad26e87cfe4eeb9c0704ee1062b";
+    sha256 = "05xv10ldsa1rahxbbgh5kwvl1dv4yvc8idczpifgb55fgqj8zazm";
  };

  buildInputs =
--- a/pkgs/development/tools/misc/tokei/default.nix
+++ b/pkgs/development/tools/misc/tokei/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  name = "tokei-${version}";
-  version = "6.0.1";
+  version = "6.1.2";

  src = fetchFromGitHub {
    owner = "Aaronepower";
    repo = "tokei";
    rev = "v${version}";
-    sha256 = "1v9h45vspsqsy86fm78bc2g5byqa4cd9b9fbmv7imi87yjbm8i7x";
+    sha256 = "1bzs3mr6f9bna39b9ddwwq0raas07nbn106mnq3widxg59i0gxhd";
  };

-  depsSha256 = "0jqzk5qlrc7pm3s7jf8130vgnrcd54izw3mx84m9b5lhf3rz98hm";
+  depsSha256 = "1cz93mrpxmyrza0ipdyg2a6mynl66plpsb446wxnmmy7y7zd6xbf";

  installPhase = ''
    mkdir -p $out/bin
--- a/pkgs/development/tools/textql/default.nix
+++ b/pkgs/development/tools/textql/default.nix
@ -16,6 +16,10 @@ buildGoPackage rec {

  goDeps = ./deps.nix;

+  preFixup = stdenv.lib.optionalString stdenv.isDarwin ''
+    install_name_tool -delete_rpath $out/lib $bin/bin/textql
+  '';
+
  meta = with stdenv.lib; {
    description = "Execute SQL against structured text like CSV or TSV";
    homepage = https://github.com/dinedal/textql;
--- a/pkgs/development/web/nodejs/v8.nix
+++ b/pkgs/development/web/nodejs/v8.nix
@ -10,11 +10,11 @@ let
  baseName = if enableNpm then "nodejs" else "nodejs-slim";
 in
  stdenv.mkDerivation (nodejs // rec {
-    version = "8.4.0";
+    version = "8.5.0";
    name = "${baseName}-${version}";
    src = fetchurl {
      url = "https://nodejs.org/download/release/v${version}/node-v${version}.tar.xz";
-      sha256 = "0qgkccsldpdrjxwwq78z94hsqz6qivmi4n2738iiginw06hs4njx";
+      sha256 = "0g2wyy9zdjzm9c0vbjn8bn49s1b2c7r2iwdfc4dpx7h4wpcfbkg1";
    };

    patches = stdenv.lib.optionals stdenv.isDarwin [ ./no-xcode-v7.patch ];
--- a/pkgs/games/trackballs/default.nix
+++ b/pkgs/games/trackballs/default.nix
@ -1,35 +1,22 @@
-{ stdenv, fetchurl, SDL, mesa, SDL_ttf, gettext, zlib, SDL_mixer, SDL_image, guile
-, debug ? false }:
+{ stdenv, fetchFromGitHub, cmake, SDL2, SDL2_ttf, gettext, zlib, SDL2_mixer, SDL2_image, guile, mesa }:

 with stdenv.lib;

 stdenv.mkDerivation rec {
-  name = "trackballs-1.1.4";
+  name = "trackballs-${version}";
+  version = "1.2.3";

-  src = fetchurl {
-    url = mirror://sourceforge/trackballs/trackballs-1.1.4.tar.gz;
-    sha256 = "19ilnif59sxa8xmfisk90wngrd11pj8s86ixzypv8krm4znbm7a5";
+  src = fetchFromGitHub {
+    owner = "trackballs";
+    repo = "trackballs";
+    rev = "v${version}";
+    sha256 = "13f28frni7fkalxx4wqvmkzz7ba3d8pic9f9sd2z9wa6gbjs9zrf";
  };

-  buildInputs = [ zlib mesa SDL SDL_ttf SDL_mixer SDL_image guile gettext ];
-
-  hardeningDisable = [ "format" ];
-
-  CFLAGS = optionalString debug "-g -O0";
-  CXXFLAGS = CFLAGS;
-  dontStrip = debug;
-  postUnpack = optionalString debug
-    "mkdir -p $out/src; cp -R * $out/src ; cd $out/src";
-
-  NIX_CFLAGS_COMPILE = "-iquote ${SDL.dev}/include/SDL";
-  configureFlags = optionalString debug "--enable-debug";
-
-  patchPhase = ''
-    sed -i -e 's/images icons music/images music/' share/Makefile.in
-  '';
+  buildInputs = [ cmake zlib SDL2 SDL2_ttf SDL2_mixer SDL2_image guile gettext mesa ];

  meta = {
-    homepage = http://trackballs.sourceforge.net/;
+    homepage = https://trackballs.github.io/;
    description = "3D Marble Madness clone";
    platforms = stdenv.lib.platforms.linux;
  };
--- a/pkgs/misc/emulators/wine/sources.nix
+++ b/pkgs/misc/emulators/wine/sources.nix
@ -32,15 +32,15 @@ in rec {

  unstable = fetchurl rec {
    # NOTE: Don't forget to change the SHA256 for staging as well.
-    version = "2.16";
+    version = "2.17";
    url = "https://dl.winehq.org/wine/source/2.x/wine-${version}.tar.xz";
-    sha256 = "089cvb7gvhcq5kx1h114fmr09fmj84cz2bjvisa48v6dpv5fsqd5";
+    sha256 = "0sgazjn30ki2y3bjrd0xbpf870ii22wkyrmgaxcwbk23j1rrbp3y";
    inherit (stable) mono gecko32 gecko64;
  };

  staging = fetchFromGitHub rec {
    inherit (unstable) version;
-    sha256 = "1q9dnifz02l96s1bafb4w2z779k8ancl37zd7wxbkf0ks2vrnln0";
+    sha256 = "11jm39g1kc77fvn02j9g8syyc095b6w2jashyr28v4gi7g0fqv6h";
    owner = "wine-compholio";
    repo = "wine-staging";
    rev = "v${version}";
--- a/pkgs/misc/tw-rs/default.nix
+++ b/pkgs/misc/tw-rs/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, rustPlatform, perl, zlib, openssl }:
+{ stdenv, fetchFromGitHub, rustPlatform, perl, zlib, openssl, curl }:

 rustPlatform.buildRustPackage rec {
  name = "tw-rs-${version}";
@ -10,7 +10,9 @@ rustPlatform.buildRustPackage rec {
    rev = "${version}";
    sha256 = "1s1gk2wcs3792gdzrngksczz3gma5kv02ni2jqrhib8l6z8mg9ia";
    };
-  buildInputs = [ perl zlib openssl ];
+
+  buildInputs = [ perl zlib openssl ]
+    ++ stdenv.lib.optional stdenv.isDarwin curl;

  depsSha256 = "1lg1jh6f9w28i94vaj62r859g6raalxmxabvw7av6sqr0hr56p05";

--- a/pkgs/os-specific/linux/fuse/common.nix
+++ b/pkgs/os-specific/linux/fuse/common.nix
@ -0,0 +1,72 @@
+{ version, sha256Hash, maintainers }:
+
+{ stdenv, fetchFromGitHub, fetchpatch
+, utillinux, autoconf, automake, libtool, gettext
+, fusePackages }:
+
+let
+  isFuse3 = stdenv.lib.hasPrefix "3" version;
+in stdenv.mkDerivation rec {
+  name = "fuse-${version}";
+
+  src = fetchFromGitHub {
+    owner = "libfuse";
+    repo = "libfuse";
+    rev = name;
+    sha256 = sha256Hash;
+  };
+
+  patches = stdenv.lib.optional
+    (!isFuse3 && stdenv.isAarch64)
+    (fetchpatch {
+      url = "https://github.com/libfuse/libfuse/commit/914871b20a901e3e1e981c92bc42b1c93b7ab81b.patch";
+      sha256 = "1w4j6f1awjrycycpvmlv0x5v9gprllh4dnbjxl4dyl2jgbkaw6pa";
+  });
+
+  nativeBuildInputs = [ libtool autoconf automake ];
+  buildInputs = [ gettext utillinux ];
+
+  outputs = [ "out" ] ++ stdenv.lib.optional isFuse3 "common";
+
+  preConfigure = ''
+    export MOUNT_FUSE_PATH=$out/sbin
+    export INIT_D_PATH=$TMPDIR/etc/init.d
+    export UDEV_RULES_PATH=$out/etc/udev/rules.d
+
+    # Ensure that FUSE calls the setuid wrapper, not
+    # $out/bin/fusermount. It falls back to calling fusermount in
+    # $PATH, so it should also work on non-NixOS systems.
+    export NIX_CFLAGS_COMPILE="-DFUSERMOUNT_DIR=\"/run/wrappers/bin\""
+
+    sed -e 's@/bin/@${utillinux}/bin/@g' -i lib/mount_util.c
+    sed -e 's@CONFIG_RPATH=/usr/share/gettext/config.rpath@CONFIG_RPATH=${gettext}/share/gettext/config.rpath@' -i makeconf.sh
+
+    ./makeconf.sh
+  '';
+
+  postFixup = if isFuse3 then ''
+    cd $out
+
+    mv bin/mount.fuse3 bin/mount.fuse
+    mv etc/udev/rules.d/99-fuse3.rules etc/udev/rules.d/99-fuse.rules
+
+    install -D -m555 bin/mount.fuse $common/bin/mount.fuse
+    install -D -m444 etc/udev/rules.d/99-fuse.rules $common/etc/udev/rules.d/99-fuse.rules
+    install -D -m444 share/man/man8/mount.fuse.8.gz $common/share/man/man8/mount.fuse.8.gz
+  '' else ''
+    cd $out
+
+    cp ${fusePackages.fuse_3.common}/bin/mount.fuse bin/mount.fuse
+    cp ${fusePackages.fuse_3.common}/etc/udev/rules.d/99-fuse.rules etc/udev/rules.d/99-fuse.rules
+    cp ${fusePackages.fuse_3.common}/share/man/man8/mount.fuse.8.gz share/man/man8/mount.fuse.8.gz
+  '';
+
+  enableParallelBuilding = true;
+
+  meta = {
+    inherit (src.meta) homepage;
+    description = "Kernel module and library that allows filesystems to be implemented in user space";
+    platforms = stdenv.lib.platforms.linux;
+    inherit maintainers;
+  };
+}
--- a/pkgs/os-specific/linux/fuse/default.nix
+++ b/pkgs/os-specific/linux/fuse/default.nix
@ -1,47 +1,20 @@
-{ stdenv, fetchFromGitHub, fetchpatch, utillinux
-, autoconf, automake, libtool, gettext }:
+{ stdenv, callPackage, utillinux }:

-stdenv.mkDerivation rec {
-  name = "fuse-${version}";
-  version = "2.9.7";
-
-  src = fetchFromGitHub {
-    owner = "libfuse";
-    repo = "libfuse";
-    rev = name;
-    sha256 = "1wyjjfb7p4jrkk15zryzv33096a5fmsdyr2p4b00dd819wnly2n2";
+let
+  mkFuse = args: callPackage (import ./common.nix args) {
+    inherit utillinux;
  };
-
-  buildInputs = [ utillinux autoconf automake libtool gettext ];
-
-  patches = stdenv.lib.optional stdenv.isAarch64 (fetchpatch {
-    url = "https://github.com/libfuse/libfuse/commit/914871b20a901e3e1e981c92bc42b1c93b7ab81b.patch";
-    sha256 = "1w4j6f1awjrycycpvmlv0x5v9gprllh4dnbjxl4dyl2jgbkaw6pa";
-  });
-
-  preConfigure =
-    ''
-      export MOUNT_FUSE_PATH=$out/sbin
-      export INIT_D_PATH=$TMPDIR/etc/init.d
-      export UDEV_RULES_PATH=$out/etc/udev/rules.d
-
-      # Ensure that FUSE calls the setuid wrapper, not
-      # $out/bin/fusermount. It falls back to calling fusermount in
-      # $PATH, so it should also work on non-NixOS systems.
-      export NIX_CFLAGS_COMPILE="-DFUSERMOUNT_DIR=\"/run/wrappers/bin\""
-
-      sed -e 's@/bin/@${utillinux}/bin/@g' -i lib/mount_util.c
-      sed -e 's@CONFIG_RPATH=/usr/share/gettext/config.rpath@CONFIG_RPATH=${gettext}/share/gettext/config.rpath@' -i makeconf.sh
-
-      ./makeconf.sh
-    '';
-
-  enableParallelBuilding = true;
-
-  meta = with stdenv.lib; {
-    homepage = https://github.com/libfuse/libfuse;
-    description = "Kernel module and library that allows filesystems to be implemented in user space";
-    platforms = platforms.linux;
+  maintainers = stdenv.lib.maintainers;
+in {
+  fuse_2 = mkFuse {
+    version = "2.9.7";
+    sha256Hash = "1wyjjfb7p4jrkk15zryzv33096a5fmsdyr2p4b00dd819wnly2n2";
    maintainers = [ maintainers.mornfall ];
  };
+
+  fuse_3 = mkFuse {
+    version = "3.1.1";
+    sha256Hash = "14mazl2i55fp4vjphwgcmk3mp2x3mhqwh9nci0rd0jl5lhpdmpq6";
+    maintainers = [ maintainers.primeos ];
+  };
 }
--- a/pkgs/servers/dns/knot-resolver/default.nix
+++ b/pkgs/servers/dns/knot-resolver/default.nix
@ -1,20 +1,20 @@
 { stdenv, fetchurl, pkgconfig, hexdump, which
-, knot-dns, luajit, libuv, lmdb
-, cmocka, systemd, hiredis, libmemcached
-, gnutls, nettle
-, luajitPackages, makeWrapper
+, knot-dns, luajit, libuv, lmdb, gnutls, nettle
+, cmocka, systemd, dns-root-data, makeWrapper
+, extraFeatures ? false /* catch-all if defaults aren't enough */
+, hiredis, libmemcached, luajitPackages
 }:

 let
-  inherit (stdenv.lib) optional;
+  inherit (stdenv.lib) optional optionals optionalString;
 in
 stdenv.mkDerivation rec {
  name = "knot-resolver-${version}";
-  version = "1.3.3";
+  version = "1.4.0";

  src = fetchurl {
    url = "http://secure.nic.cz/files/knot-resolver/${name}.tar.xz";
-    sha256 = "c679238bea5744de8a99f4402a61e9e58502bc42b40ecfa370e53679ed5d5b80";
+    sha256 = "ac19c121fd687c7e4f5f907b46932d26f8f9d9e01626c4dadb3847e25ea31ceb";
  };

  outputs = [ "out" "dev" ];
@ -23,18 +23,17 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ pkgconfig which makeWrapper hexdump ];

-  buildInputs = [ knot-dns luajit libuv gnutls ]
-    ++ optional stdenv.isLinux lmdb # system lmdb causes some problems on Darwin
-    ## optional dependencies; TODO: libedit, dnstap?
-    ++ optional doInstallCheck cmocka
-    ++ optional stdenv.isLinux systemd # socket activation
-    ++ [
-      nettle # DNS cookies
-      hiredis libmemcached # additional cache backends
  # http://knot-resolver.readthedocs.io/en/latest/build.html#requirements
+  buildInputs = [ knot-dns luajit libuv gnutls nettle ]
+    ++ optional stdenv.isLinux lmdb # system lmdb causes some problems on Darwin
+    ++ optional doInstallCheck cmocka
+    ++ optional stdenv.isLinux systemd # sd_notify
+    ++ optionals extraFeatures [
+      hiredis libmemcached # additional cache backends
    ];
+    ## optional dependencies; TODO: libedit, dnstap, http2 module?

-  makeFlags = [ "PREFIX=$(out)" ];
+  makeFlags = [ "PREFIX=$(out)" "ROOTHINTS=${dns-root-data}/root.hints" ];
  CFLAGS = [ "-O2" "-DNDEBUG" ];

  enableParallelBuilding = true;
@ -45,8 +44,11 @@ stdenv.mkDerivation rec {
    export LD_LIBRARY_PATH="$out/lib"
  '';

+  postInstall = ''
+    rm "$out"/etc/kresd/root.hints # using system-wide instead
+  ''
  # optional: to allow auto-bootstrapping root trust anchor via https
-  postInstall = with luajitPackages; ''
+  + (with luajitPackages; ''
      wrapProgram "$out/sbin/kresd" \
        --set LUA_PATH '${
          stdenv.lib.concatStringsSep ";"
@ -56,7 +58,7 @@ stdenv.mkDerivation rec {
          stdenv.lib.concatStringsSep ";"
            (map getLuaCPath [ luasec luasocket ])
          }'
-  '';
+    '');

  meta = with stdenv.lib; {
    description = "Caching validating DNS resolver, from .cz domain registry";
--- a/pkgs/servers/web-apps/piwik/default.nix
+++ b/pkgs/servers/web-apps/piwik/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name = "piwik-${version}";
-  version = "3.1.0";
+  version = "3.1.1";

  src = fetchurl {
    url = "https://builds.piwik.org/${name}.tar.gz";
-    sha512 = "175300ibf0lg4xnyn5v47czi3vd6i7yqf1im3br4975f6k7w8q22m2mk2mi006795js5q52x48g4sc7wb47wac7wbla8wp98al48gfb";
+    sha512 = "2mqzk12959j9xqb9cqz8np35zcs1313zjx9pikbjw9z9mfcqgv0ccvrnl2ymmwll333drr9qaxs54n0mkk66xbhz04nmzmib0kp9k8h";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/tools/filesystems/sshfs-fuse/default.nix
+++ b/pkgs/tools/filesystems/sshfs-fuse/default.nix
@ -1,17 +1,21 @@
-{ stdenv, fetchFromGitHub, pkgconfig, glib, fuse, autoreconfHook }:
+{ stdenv, fetchFromGitHub, pkgconfig, glib, fuse3, autoreconfHook }:

 stdenv.mkDerivation rec {
-  version = "2.10"; # Temporary (need to add libfuse 3.x first)
+  version = "3.2.0";
  name = "sshfs-fuse-${version}";

  src = fetchFromGitHub {
    owner = "libfuse";
    repo = "sshfs";
    rev = "sshfs-${version}";
-    sha256 = "1dmw4kx6vyawcywiv8drrajnam0m29mxfswcp4209qafzx3mjlp1";
+    sha256 = "09pqdibhcj1p7m6vxkqiprvbcxp9iq2lm1hb6w7p8iarmvp80rlv";
  };

-  buildInputs = [ pkgconfig glib fuse autoreconfHook ];
+  buildInputs = [ pkgconfig glib fuse3 autoreconfHook ];
+
+  NIX_CFLAGS_COMPILE = stdenv.lib.optional
+    (stdenv.system == "i686-linux")
+    "-D_FILE_OFFSET_BITS=64";

  postInstall = ''
    mkdir -p $out/sbin
--- a/pkgs/tools/graphics/transfig/builder.sh
+++ b/pkgs/tools/graphics/transfig/builder.sh
@ -1,38 +0,0 @@
-source $stdenv/setup
-
-patchPhase() {
-    for i in $patches; do
-        header "applying patch $i" 3
-        patch -p0 < $i
-        stopNest
-    done
-
-    configureImakefiles "s:__PREFIX_PNG:$libpng:"
-    configureImakefiles "s:__PREFIX:$out:"
-}
-
-configureImakefiles() {
-    local sedcmd=$1
-
-    sed "${sedcmd}" fig2dev/Imakefile > tmpsed
-    cp tmpsed fig2dev/Imakefile
-
-    sed "${sedcmd}" fig2dev/dev/Imakefile > tmpsed
-    cp tmpsed fig2dev/dev/Imakefile
-
-    sed "${sedcmd}" transfig/Imakefile > tmpsed
-    cp tmpsed transfig/Imakefile
-}
-
-buildPhase() {
-    xmkmf
-    make Makefiles
-    make
-}
-
-preInstall() {
-    mkdir -p $out
-    mkdir -p $out/lib
-}
-
-genericBuild
--- a/pkgs/tools/graphics/transfig/default.nix
+++ b/pkgs/tools/graphics/transfig/default.nix
@ -2,34 +2,63 @@

 stdenv.mkDerivation rec {
  name = "transfig-3.2.4";
-  builder = ./builder.sh;
  src = fetchurl {
    url = ftp://ftp.tex.ac.uk/pub/archive/graphics/transfig/transfig.3.2.4.tar.gz;
    sha256 = "0429snhp5acbz61pvblwlrwv8nxr6gf12p37f9xxwrkqv4ir7dd4";
  };

  buildInputs = [zlib libjpeg libpng imake];
-  inherit libpng;
+
+  patches = [
+    ./patch-fig2dev-dev-Imakefile
+    ./patch-fig2dev-Imakefile
+    ./patch-transfig-Imakefile
+    ./patch-fig2dev-fig2dev.h
+    ./patch-fig2dev-dev-gensvg.c
+  ];
+
+  patchPhase = ''
+    runHook prePatch
+
+    configureImakefiles() {
+        local sedcmd=$1
+
+        sed "$sedcmd" fig2dev/Imakefile > tmpsed
+        cp tmpsed fig2dev/Imakefile
+
+        sed "$sedcmd" fig2dev/dev/Imakefile > tmpsed
+        cp tmpsed fig2dev/dev/Imakefile
+
+        sed "$sedcmd" transfig/Imakefile > tmpsed
+        cp tmpsed transfig/Imakefile
+    }
+
+    for i in $patches; do
+        header "applying patch $i" 3
+        patch -p0 < $i
+        stopNest
+    done
+
+    configureImakefiles "s:__PREFIX_PNG:${libpng}:"
+    configureImakefiles "s:__PREFIX:$out:"
+
+    runHook postPatch
+  '';
+
+  preBuild = ''
+    xmkmf
+    make Makefiles
+  '';
+
+  makeFlags = [ "CC=cc" ];
+
+  preInstall = ''
+    mkdir -p $out
+    mkdir -p $out/lib
+  '';

  hardeningDisable = [ "format" ];

-  patches = [prefixPatch1 prefixPatch2 prefixPatch3 varargsPatch gensvgPatch];
-
-  prefixPatch1 =
-    ./patch-fig2dev-dev-Imakefile;
-
-  prefixPatch2 =
-    ./patch-fig2dev-Imakefile;
-
-  prefixPatch3 =
-    ./patch-transfig-Imakefile;
-
-  varargsPatch =
-    ./patch-fig2dev-fig2dev.h;
-
-  gensvgPatch =
-    ./patch-fig2dev-dev-gensvg.c;
-
  meta = {
    platforms = stdenv.lib.platforms.unix;
  };
--- a/pkgs/tools/misc/osm2pgsql/default.nix
+++ b/pkgs/tools/misc/osm2pgsql/default.nix
@ -23,6 +23,6 @@ stdenv.mkDerivation rec {
    version = "0.92.1-unstable";
    homepage = https://github.com/openstreetmap/osm2pgsql;
    license = stdenv.lib.licenses.gpl2;
-    platforms = stdenv.lib.platforms.unix;
+    platforms = stdenv.lib.platforms.linux;
  };
 }
--- a/pkgs/tools/misc/shallot/default.nix
+++ b/pkgs/tools/misc/shallot/default.nix
@ -27,6 +27,6 @@ in stdenv.mkDerivation {

    license = stdenv.lib.licenses.mit;
    homepage = https://github.com/katmagic/Shallot;
-    platforms = stdenv.lib.platforms.unix;
+    platforms = stdenv.lib.platforms.linux;
  };
 }
--- a/pkgs/tools/misc/snapper/default.nix
+++ b/pkgs/tools/misc/snapper/default.nix
@ -5,13 +5,13 @@

 stdenv.mkDerivation rec {
  name = "snapper-${version}";
-  version = "0.3.3";
+  version = "0.5.0";

  src = fetchFromGitHub {
    owner = "openSUSE";
    repo = "snapper";
    rev = "v${version}";
-    sha256 = "12c2ygaanr4gny4ixnly4vpi0kv7snbg3khr3i5zwridhmdzz9hm";
+    sha256 = "14hrv23film4iihyclcvc2r2dgxl8w3as50r81xjjc85iyp6yxkm";
  };

  nativeBuildInputs = [
--- a/pkgs/tools/misc/ttwatch/default.nix
+++ b/pkgs/tools/misc/ttwatch/default.nix
@ -0,0 +1,28 @@
+{ stdenv, fetchFromGitHub, cmake, perl, openssl, curl, libusb1 }:
+
+stdenv.mkDerivation rec {
+  name = "ttwatch-${version}";
+  version = "2017-04-20";
+
+  src = fetchFromGitHub {
+    owner = "ryanbinns";
+    repo = "ttwatch";
+    rev = "f07a12712ed331f1530db3846828641eb0e2f5c5";
+    sha256 = "0y27bldmp6w02pjhr2cmy9g6n23vi0q26pil3rd7vbg4qjahxz27";
+  };
+
+  nativeBuildInputs = [ cmake perl ];
+  buildInputs = [ openssl curl libusb1 ];
+
+  preFixup = ''
+    chmod +x $out/bin/ttbin2mysports
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/ryanbinns/ttwatch;
+    description = "Linux TomTom GPS Watch Utilities";
+    maintainers = with maintainers; [ dotlambda ];
+    license = licenses.mit;
+    platforms = with platforms; linux;
+  };
+}
--- a/pkgs/tools/networking/assh/default.nix
+++ b/pkgs/tools/networking/assh/default.nix
@ -0,0 +1,33 @@
+{ stdenv, lib, buildGoPackage, fetchFromGitHub, openssh, makeWrapper }:
+
+buildGoPackage rec {
+  name = "assh-${version}";
+  version = "2.6.0";
+
+  goPackagePath = "github.com/moul/advanced-ssh-config";
+  subPackages = [ "cmd/assh" ];
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  postInstall = stdenv.lib.optionalString (stdenv.isDarwin) ''
+    install_name_tool -delete_rpath $out/lib $bin/bin/assh
+  '' + ''
+    wrapProgram "$bin/bin/assh" \
+      --prefix PATH : ${openssh}/bin
+  '';
+
+  src = fetchFromGitHub {
+    repo = "advanced-ssh-config";
+    owner = "moul";
+    rev = "v${version}";
+    sha256 = "1vv98dz5822k51xklnmky0lwfjw8nc6ryvn8lmv9n63ppwh9s2s6";
+  };
+
+  meta = with stdenv.lib; {
+    description = "Advanced SSH config - Regex, aliases, gateways, includes and dynamic hosts";
+    homepage = https://github.com/moul/advanced-ssh-config;
+    license = licenses.mit;
+    maintainers = with maintainers; [ zzamboni ];
+    platforms = with platforms; linux ++ darwin;
+  };
+}
--- a/pkgs/tools/networking/cjdns/default.nix
+++ b/pkgs/tools/networking/cjdns/default.nix
@ -31,6 +31,6 @@ stdenv.mkDerivation {
    description = "Encrypted networking for regular people";
    license = licenses.gpl3;
    maintainers = with maintainers; [ ehmry ];
-    platforms = platforms.unix;
+    platforms = platforms.linux;
  };
 }
--- a/pkgs/tools/networking/ferm/default.nix
+++ b/pkgs/tools/networking/ferm/default.nix
@ -1,12 +1,12 @@
 { stdenv, fetchurl, makeWrapper, perl, ebtables, ipset, iptables }:

 stdenv.mkDerivation rec {
-  version = "2.3.1";
+  version = "2.4.1";
  name = "ferm-${version}";

  src = fetchurl {
-    url = "http://ferm.foo-projects.org/download/2.3/ferm-${version}.tar.gz";
-    sha256 = "1scdnd2jk4787jyr6fxav2598g0x7hjic5b8bj77j8s0hki48m4a";
+    url = "http://ferm.foo-projects.org/download/2.4/ferm-${version}.tar.xz";
+    sha256 = "1fv8wk513yysp4q0i65rl2m0hg2lxwwgk9ppprsca1xcxrdpsvwa";
  };

  buildInputs = [ perl ipset ebtables iptables makeWrapper ];
--- a/pkgs/tools/networking/packetdrill/default.nix
+++ b/pkgs/tools/networking/packetdrill/default.nix
@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
    description = "Quick, precise tests for entire TCP/UDP/IPv4/IPv6 network stacks";
    homepage = https://github.com/google/packetdrill;
    license = stdenv.lib.licenses.gpl2;
-    platforms = stdenv.lib.platforms.unix;
+    platforms = stdenv.lib.platforms.linux;
    maintainers = with stdenv.lib.maintainers; [ dmjio cleverca22 ];
  };
 }
--- a/pkgs/tools/networking/redsocks/default.nix
+++ b/pkgs/tools/networking/redsocks/default.nix
@ -28,6 +28,6 @@ stdenv.mkDerivation rec {
    homepage = http://darkk.net.ru/redsocks/;
    license = stdenv.lib.licenses.asl20;
    maintainers = [ ];
-    platforms = stdenv.lib.platforms.all;
+    platforms = stdenv.lib.platforms.linux;
  };
 }
--- a/pkgs/tools/package-management/nox/default.nix
+++ b/pkgs/tools/package-management/nox/default.nix
@ -10,6 +10,8 @@ pythonPackages.buildPythonApplication rec {
    sha256 = "1qcbhdnhdhhv7q6cqdgv0q55ic8fk18526zn2yb12x9r1s0lfp9z";
  };

+  patches = [ ./nox-review-wip.patch ];
+
  buildInputs = [ pythonPackages.pbr git ];

  propagatedBuildInputs = with pythonPackages; [
--- a/pkgs/tools/package-management/nox/nox-review-wip.patch
+++ b/pkgs/tools/package-management/nox/nox-review-wip.patch
@ -0,0 +1,11 @@
+--- a/nox/review.py	2017-09-23 04:04:37.322484753 +0200
+++ a/nox/review.py	2017-09-23 04:18:31.582692181 +0200
+@@ -84,7 +84,7 @@
+     ctx.obj['dry_run'] = dry_run
+ 
+ 
+-@cli.command(short_help='difference between working tree and a commit')
+@cli.command('wip', short_help='difference between working tree and a commit')
+ @click.option('--against', default='HEAD')
+ @click.pass_context
+ @setup_nixpkgs_config
--- a/pkgs/tools/security/tor/default.nix
+++ b/pkgs/tools/security/tor/default.nix
@ -12,6 +12,8 @@ stdenv.mkDerivation rec {

  outputs = [ "out" "geoip" ];

+  enableParallelBuilding = true;
+
  nativeBuildInputs = [ pkgconfig ];
  buildInputs = [ libevent openssl zlib ] ++
    stdenv.lib.optionals stdenv.isLinux [ libseccomp systemd libcap ];
--- a/pkgs/tools/security/trousers/default.nix
+++ b/pkgs/tools/security/trousers/default.nix
@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
    homepage    = http://trousers.sourceforge.net/;
    license     = licenses.cpl10;
    maintainers = [ maintainers.ak ];
-    platforms   = platforms.unix;
+    platforms   = platforms.linux;
  };
 }

--- a/pkgs/tools/system/gdmap/default.nix
+++ b/pkgs/tools/system/gdmap/default.nix
@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
    homepage = http://gdmap.sourceforge.net;
    description = "Recursive rectangle map of disk usage";
    license = licenses.gpl2;
-    platforms = platforms.all;
+    platforms = platforms.linux;
    maintainers = [ maintainers.bjornfor ];
  };
 }
--- a/pkgs/tools/text/nawk/default.nix
+++ b/pkgs/tools/text/nawk/default.nix
@ -36,6 +36,6 @@ stdenv.mkDerivation rec {
    homepage = https://www.cs.princeton.edu/~bwk/btl.mirror/;
    license = stdenv.lib.licenses.mit;
    maintainers = [ stdenv.lib.maintainers.konimex ];
-    platforms = stdenv.lib.platforms.all;
+    platforms = stdenv.lib.platforms.linux;
  };
 }
--- a/pkgs/tools/virtualization/awsebcli/default.nix
+++ b/pkgs/tools/virtualization/awsebcli/default.nix
@ -0,0 +1,99 @@
+ { stdenv, python }:
+let
+
+  localPython = python.override {
+    packageOverrides = self: super: rec {
+      colorama = super.colorama.overridePythonAttrs (oldAttrs: rec {
+        version = "0.3.7";
+
+        src = super.fetchPypi {
+          inherit (oldAttrs) pname;
+          inherit version;
+          sha256 = "0avqkn6362v7k2kg3afb35g4sfdvixjgy890clip4q174p9whhz0";
+        };
+      });
+
+      docker = super.docker.overridePythonAttrs (oldAttrs: rec {
+          pname = "docker-py";
+          version = "1.7.2";
+          name = "${pname}-${version}";
+
+          src = super.fetchPypi {
+            inherit pname version;
+            sha256 = "0k6hm3vmqh1d3wr9rryyif5n4rzvcffdlb1k4jvzp7g4996d3ccm";
+          };
+        });
+
+      pathspec = super.pathspec.overridePythonAttrs (oldAttrs: rec {
+        version = "0.5.0";
+
+        src = super.fetchPypi {
+          inherit (oldAttrs) pname;
+          inherit version;
+          sha256 = "07yx1gxj9v1iyyiy5fhq2wsmh4qfbrx158wi7jb0nx6lah80ffma";
+        };
+      });
+
+      requests = super.requests.overridePythonAttrs (oldAttrs: rec {
+        version = "2.9.1";
+
+        src = super.fetchPypi {
+          inherit (oldAttrs) pname;
+          inherit version;
+          sha256 = "0zsqrzlybf25xscgi7ja4s48y2abf9wvjkn47wh984qgs1fq2xy5";
+        };
+      });
+
+      semantic-version = super.semantic-version.overridePythonAttrs (oldAttrs: rec {
+        version = "2.5.0";
+
+        src = super.fetchPypi {
+          inherit (oldAttrs) pname; inherit version;
+          sha256 = "0p5n3d6blgkncxdz00yxqav0cis87fisdkirjm0ljjh7rdfx7aiv";
+        };
+      });
+
+      tabulate = super.tabulate.overridePythonAttrs (oldAttrs: rec {
+        version = "0.7.5";
+
+        src = super.fetchPypi {
+          inherit (oldAttrs) pname;
+          inherit version;
+          sha256 = "03l1r7ddd1a0j2snv1yd0hlnghjad3fg1an1jr8936ksv75slwch";
+        };
+      });
+    };
+  };
+in with localPython.pkgs; buildPythonApplication rec {
+  name = "${pname}-${version}";
+  pname = "awsebcli";
+  version = "3.10.5";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1g53z2flhp3navdf8lw6rgh99akf3k0ng1zkkqswvh66zswkxnwn";
+  };
+
+  checkInputs = [
+    pytest mock nose pathspec colorama requests docutils
+  ];
+
+  doCheck = false;
+
+  propagatedBuildInputs = [
+    blessed botocore cement colorama docker dockerpty docopt pathspec pyyaml
+    requests semantic-version setuptools tabulate termcolor websocket_client
+  ];
+
+  postInstall = ''
+    mkdir -p $out/etc/bash_completion.d
+    mv $out/bin/eb_completion.bash $out/etc/bash_completion.d
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = http://aws.amazon.com/elasticbeanstalk/;
+    description = "A command line interface for Elastic Beanstalk.";
+    maintainers = with maintainers; [ eqyiel ];
+    license = licenses.asl20;
+  };
+}
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@ -135,6 +135,7 @@ mapAliases (rec {
  spaceOrbit = space-orbit; # addewd 2016-05-23
  speedtest_cli = speedtest-cli;  # added 2015-02-17
  sqliteInteractive = sqlite-interactive;  # added 2014-12-06
+  sshfs = sshfs-fuse; # added 2017-08-14
  sshfsFuse = sshfs-fuse; # added 2016-09
  surf-webkit2 = surf; # added 2017-04-02
  system_config_printer = system-config-printer;  # added 2016-01-03
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -511,6 +511,8 @@ with pkgs;

  awscli = pythonPackages.awscli; # Should be moved out of python-packages.nix

+  awsebcli = callPackage ../tools/virtualization/awsebcli {};
+
  awslogs = callPackage ../tools/admin/awslogs { };

  aws_shell = python2Packages.aws_shell; # Should be moved out of python-packages.nix
@ -1235,6 +1237,8 @@ with pkgs;

  autossh = callPackage ../tools/networking/autossh { };

+  assh = callPackage ../tools/networking/assh { };
+
  asynk = callPackage ../tools/networking/asynk { };

  bacula = callPackage ../tools/backup/bacula { };
@ -4894,6 +4898,8 @@ with pkgs;

  ttmkfdir = callPackage ../tools/misc/ttmkfdir { };

+  ttwatch = callPackage ../tools/misc/ttwatch { };
+
  udunits = callPackage ../development/libraries/udunits { };

  uemacs = callPackage ../applications/editors/uemacs { };
@ -5822,6 +5828,15 @@ with pkgs;
        inherit (gnome2) GConf gnome_vfs;
      };

+  openjdk9 =
+    # if stdenv.isDarwin then
+    #   callPackage ../development/compilers/openjdk-darwin/9.nix { }
+    # else
+      callPackage ../development/compilers/openjdk/9.nix {
+        bootjdk = openjdk8;
+        inherit (gnome2) GConf gnome_vfs;
+      };
+
  openjdk = openjdk8;

  jdk7 = openjdk7 // { outputs = [ "out" ]; };
@ -5839,6 +5854,16 @@ with pkgs;
        (lib.addMetaAttrs { outputsToInstall = [ "jre" ]; }
          ((openjdk8.override { minimal = true; }).jre // { outputs = [ "jre" ]; }));

+  jdk9 = openjdk9 // { outputs = [ "out" ]; };
+  jre9 = lib.setName "openjre-${lib.getVersion pkgs.openjdk9.jre}"
+    (lib.addMetaAttrs { outputsToInstall = [ "jre" ]; }
+      (openjdk9.jre // { outputs = [ "jre" ]; }));
+  jre9_headless =
+    if stdenv.isDarwin then jre9 else
+      lib.setName "openjre-${lib.getVersion pkgs.openjdk9.jre}-headless"
+        (lib.addMetaAttrs { outputsToInstall = [ "jre" ]; }
+          ((openjdk9.override { minimal = true; }).jre // { outputs = [ "jre" ]; }));
+
  jdk = jdk8;
  jre = jre8;
  jre_headless = jre8_headless;
@ -6292,15 +6317,10 @@ with pkgs;
  beam = callPackage ./beam-packages.nix { };

  inherit (beam.interpreters)
-    erlang erlang_odbc erlang_javac erlang_odbc_javac
+    erlang erlangR17 erlangR18 erlangR19 erlangR20
+    erlang_odbc erlang_javac erlang_odbc_javac erlang_nox erlang_basho_R16B02
    elixir elixir_1_5 elixir_1_4 elixir_1_3
-    lfe lfe_1_2
-    erlangR16 erlangR16_odbc
-    erlang_basho_R16B02 erlang_basho_R16B02_odbc
-    erlangR17 erlangR17_odbc erlangR17_javac erlangR17_odbc_javac
-    erlangR18 erlangR18_odbc erlangR18_javac erlangR18_odbc_javac
-    erlangR19 erlangR19_odbc erlangR19_javac erlangR19_odbc_javac
-    erlangR20 erlangR20_odbc erlangR20_javac erlangR20_odbc_javac;
+    lfe lfe_1_2;

  inherit (beam.packages.erlang)
    rebar rebar3-open rebar3
@ -7909,7 +7929,9 @@ with pkgs;

  eigen2 = callPackage ../development/libraries/eigen/2.0.nix {};

-  vmmlib = callPackage ../development/libraries/vmmlib {};
+  vmmlib = callPackage ../development/libraries/vmmlib {
+    inherit (darwin.apple_sdk.frameworks) Accelerate CoreGraphics CoreVideo;
+  };

  elastix = callPackage ../development/libraries/science/biology/elastix { };

@ -8236,8 +8258,9 @@ with pkgs;
  # A GMP fork
  mpir = callPackage ../development/libraries/mpir {};

-  gns3-gui = callPackage ../applications/networking/gns3/gui.nix { };
-  gns3-server = callPackage ../applications/networking/gns3/server.nix { };
+  gns3Packages = callPackage ../applications/networking/gns3 { };
+  gns3-gui = gns3Packages.guiStable;
+  gns3-server = gns3Packages.serverStable;

  gobjectIntrospection = callPackage ../development/libraries/gobject-introspection {
    nixStoreDir = config.nix.storeDir or builtins.storeDir;
@ -12057,9 +12080,12 @@ with pkgs;
    inherit (linuxPackages) kernel;
  };

-  fuse = callPackage ../os-specific/linux/fuse {
+  fusePackages = callPackage ../os-specific/linux/fuse {
    utillinux = utillinuxMinimal;
  };
+  fuse = lowPrio fusePackages.fuse_2;
+  fuse3 = fusePackages.fuse_3;
+  fuse-common = hiPrio fusePackages.fuse_3.common;

  fusionio-util = callPackage ../os-specific/linux/fusionio/util.nix { };

@ -15727,7 +15753,7 @@ with pkgs;

  pavucontrol = callPackage ../applications/audio/pavucontrol { };

-  paraview = callPackage ../applications/graphics/paraview { };
+  paraview = libsForQt5.callPackage ../applications/graphics/paraview { };

  packet = callPackage ../development/tools/packet { };

@ -16527,6 +16553,8 @@ with pkgs;
    quazip = quazip_qt4;
  };

+  topydo = callPackage ../applications/misc/topydo {};
+
  torchPackages = recurseIntoAttrs ( callPackage ../applications/science/machine-learning/torch {
    lua = luajit ;
  } );
@ -17765,10 +17793,7 @@ with pkgs;

  tome4 = callPackage ../games/tome4 { };

-  trackballs = callPackage ../games/trackballs {
-    debug = false;
-    guile = guile_1_8;
-  };
+  trackballs = callPackage ../games/trackballs { };

  tremulous = callPackage ../games/tremulous { };

@ -17812,7 +17837,9 @@ with pkgs;

  vapor = callPackage ../games/vapor { love = love_0_8; };

-  vapoursynth = callPackage ../development/libraries/vapoursynth { };
+  vapoursynth = callPackage ../development/libraries/vapoursynth {
+    inherit (darwin.apple_sdk.frameworks) ApplicationServices;
+  };

  vapoursynth-mvtools = callPackage ../development/libraries/vapoursynth-mvtools { };

@ -19160,6 +19187,8 @@ with pkgs;

  vault = callPackage ../tools/security/vault { };

+  vaultenv = haskellPackages.vaultenv;
+
  vbam = callPackage ../misc/emulators/vbam {
    ffmpeg = ffmpeg_2;
  };
--- a/Show More
+++ b/Show More