merge 'staging' into modular-stdenv

In 2c62a36b77 the messages in pkgs/stdenv/generic/default.nix were not merged correctly. Conflicts: pkgs/stdenv/generic/default.nix
2014-08-31 13:00:19 +02:00 · 2014-08-31 13:00:19 +02:00 · 1e389c976c
parent a8fc68a5c0 773595540b
commit 1e389c976c
1133 changed files with 11926 additions and 2831 deletions
--- a/.gitignore
+++ b/.gitignore
@ -9,3 +9,5 @@ result-*
 /doc/manual.html
 /doc/manual.pdf
 .version-suffix
+
+.DS_Store
--- a/doc/meta.xml
+++ b/doc/meta.xml
@ -121,10 +121,11 @@ interpretation:</para>
  <varlistentry>
    <term><varname>license</varname></term>
    <listitem><para>The license for the package. One from attribute set defined in
-      <link xlink:href="https://github.com/NixOS/nixpkgs/blob/master/pkgs/lib/licenses.nix">
+      <link xlink:href="https://github.com/NixOS/nixpkgs/blob/master/lib/licenses.nix">
      <filename>nixpkgs/lib/licenses.nix</filename></link>.
      Example:
      <literal>stdenv.lib.licenses.gpl3</literal>.</para></listitem>
+      See details in <xref linkend='sec-meta-license'/>,
  </varlistentry>

  <varlistentry>
@ -133,7 +134,7 @@ interpretation:</para>
    maintainers of this Nix expression. If
    you would like to be a maintainer of a package, you may want to add
    yourself to <link
-    xlink:href="https://github.com/NixOS/nixpkgs/blob/master/pkgs/lib/maintainers.nix"><filename>nixpkgs/lib/maintainers.nix</filename></link>
+    xlink:href="https://github.com/NixOS/nixpkgs/blob/master/lib/maintainers.nix"><filename>nixpkgs/lib/maintainers.nix</filename></link>
    and write something like <literal>[ stdenv.lib.maintainers.alice
    stdenv.lib.maintainers.bob ]</literal>.</para></listitem>
  </varlistentry>
@ -159,8 +160,8 @@ interpretation:</para>
 meta.platforms = stdenv.lib.platforms.linux;
 </programlisting>

-    Attribute Set <varname>stdenv.lib.platforms</varname> in 
-    <link xlink:href="https://github.com/NixOS/nixpkgs/blob/master/pkgs/lib/platforms.nix">
+    Attribute Set <varname>stdenv.lib.platforms</varname> in
+    <link xlink:href="https://github.com/NixOS/nixpkgs/blob/master/lib/platforms.nix">
    <filename>nixpkgs/lib/platforms.nix</filename></link> defines various common
    lists of platforms types.
    </para></listitem>
@ -202,9 +203,15 @@ meta.hydraPlatforms = [];

 <section xml:id="sec-meta-license"><title>Licenses</title>

-<para>The <varname>meta.license</varname> attribute could be one of the
-following:
+<para>The <varname>meta.license</varname> attribute should preferrably contain
+a value from <varname>stdenv.lib.licenses</varname> defined in
+<link xlink:href="https://github.com/NixOS/nixpkgs/blob/master/lib/licenses.nix">
+<filename>nixpkgs/lib/licenses.nix</filename></link>,
+or in-place license description of the same format if the license is
+unlikely to be useful in another expression.

+A few generic options are available, although it's typically better
+to indicate the specific license:
 <variablelist>

  <varlistentry>
--- a/lib/licenses.nix
+++ b/lib/licenses.nix
@ -1,25 +1,24 @@
-{
-  /* License identifiers loosely based on: http://fedoraproject.org/wiki/Licensing
+let
+  spdx = lic: lic // {
+      url = "http://spdx.org/licenses/${lic.shortName}";
+    };
+in
+
+rec {
+  /* License identifiers from spdx.org where possible.
   * If you cannot find your license here, then look for a similar license or
   * add it to this list. The URL mentioned above is a good source for inspiration.
   */

-  artistic2 = {
-    shortName = "Artistic 2.0";
-    fullName = "Artistic 2.0";
-    url = "http://opensource.org/licenses/artistic-license-2.0.php";
-  };
-
-  agpl3 = {
-    shortName = "AGPLv3";
-    fullName = "GNU Affero General Public License version 3 only";
-    url = https://www.gnu.org/licenses/agpl.html;
+  agpl3 = spdx {
+    shortName = "AGPL-3.0";
+    fullName = "GNU Affero General Public License v3.0";
  };

  agpl3Plus = {
-    shortName = "AGPLv3+";
-    fullName = "GNU Affero General Public License version 3 or later";
-    url = https://www.gnu.org/licenses/agpl.html;
+    shortName = "AGPL-3.0+";
+    fullName = "GNU Affero General Public License v3.0 or later";
+    inherit (agpl3) url;
  };

  amd = {
@ -28,126 +27,149 @@
    url = http://developer.amd.com/amd-license-agreement/;
  };#

-  apsl20 = {
-    shortName = "APSL 2.0";
+  apsl20 = spdx {
+    shortName = "APSL-2.0";
    fullName = "Apple Public Source License 2.0";
-    url = http://opensource.org/licenses/APSL-2.0;
  };

-  asl20 = {
-    shortName = "ASL2.0";
-    fullName = "Apache Software License 2.0";
-    url = http://www.apache.org/licenses/LICENSE-2.0;
+  artistic2 = spdx {
+    shortName = "Artistic-2.0";
+    fullName = "Artistic License 2.0";
  };

-  boost = {
-    shortName = "boost";
-    fullName = "Boost Software License";
-    url = http://www.boost.org/LICENSE_1_0.txt;
+  asl20 = spdx {
+    shortName = "Apache-2.0";
+    fullName = "Apache License 2.0";
  };

-  bsd2 = {
-    shortName = "BSD-2";
-    fullName = "BSD license (2 clause)";
-    url = http://opensource.org/licenses/BSD-2-Clause;
+  boost = spdx {
+    shortName = "BSL-1.0";
+    fullName = "Boost Software License 1.0";
  };

-  bsd3 = {
-    shortName = "BSD-3";
-    fullName = "BSD license (3 clause)";
-    url = http://opensource.org/licenses/BSD-3-Clause;
+  bsd2 = spdx {
+    shortName = "BSD-2-Clause";
+    fullName = ''BSD 2-clause "Simplified" License'';
  };

-  bsdOriginal = {
-    shortName = "BSD-original";
-    fullName = "Original BSD license with advertising clause";
-    url = https://fedoraproject.org/wiki/Licensing/BSD;
+  bsd3 = spdx {
+    shortName = "BSD-3-Clause";
+    fullName = ''BSD 3-clause "New" or "Revised" License'';
  };

-  cc-by-30 = {
-    shortName = "CC BY 3.0";
+  bsdOriginal = spdx {
+    shortName = "BSD-4-Clause";
+    fullName = ''BSD 4-clause "Original" or "Old" License'';
+  };
+
+  cc-by-30 = spdx {
+    shortName = "CC-BY-3.0";
    fullName = "Creative Commons Attribution 3.0";
-    url = http://creativecommons.org/licenses/by/3.0;
  };

-  cddl = {
-    shortName = "CDDL";
-    fullName = "Common Development Distribution License ";
-    url = http://www.opensolaris.org/os/licensing/cddllicense.txt;
+  cddl = spdx {
+    shortName = "CDDL-1.0";
+    fullName = "Common Development and Distribution License 1.0";
  };

-  cpl10 = {
-    shortName = "CPL 1.0";
-    fullName = "Common Public License version 1.0";
-    url = http://www.eclipse.org/legal/cpl-v10.html;
+  cecill-c = spdx {
+    shortName = "CECILL-C";
+    fullName  = "CeCILL-C Free Software License Agreement";
  };

-  epl10 = {
-    shortName = "EPL 1.0";
-    fullName = "Eclipse Public License version 1.0";
-    url = http://www.eclipse.org/legal/epl-v10.html;
+  cpl10 = spdx {
+    shortName = "CPL-1.0";
+    fullName = "Common Public License 1.0";
+  };
+
+  epl10 = spdx {
+    shortName = "EPL-1.0";
+    fullName = "Eclipse Public License 1.0";
  };

  free = "free";

-  gpl2 = {
-    shortName = "GPLv2";
-    fullName = "GNU General Public License version 2";
-    url = http://www.gnu.org/licenses/old-licenses/gpl-2.0.html;
+  gpl2 = spdx {
+    shortName = "GPL-2.0";
+    fullName = "GNU General Public License v2.0 only";
  };

  gpl2Oss = {
-    shortName = "GPLv2+OSS";
+    shortName = "GPL-2.0-with-OSS";
    fullName = "GNU General Public License version 2 only (with OSI approved licenses linking exception)";
    url = http://www.mysql.com/about/legal/licensing/foss-exception;
  };

-  gpl2Plus = {
-    shortName = "GPLv2+";
-    fullName = "GNU General Public License version 2 or later";
-    url = http://www.gnu.org/licenses/old-licenses/gpl-2.0.html;
+  gpl2Plus = spdx {
+    shortName = "GPL-2.0+";
+    fullName = "GNU General Public License v2.0 or later";
  };

-  gpl3 = {
-    shortName = "GPLv3";
-    fullName = "GNU General Public License version 3 only";
-    url = http://www.fsf.org/licensing/licenses/gpl.html;
+  gpl3 = spdx {
+    shortName = "GPL-3.0";
+    fullName = "GNU General Public License v3.0 only";
  };

-  gpl3Plus = {
-    shortName = "GPLv3+";
-    fullName = "GNU General Public License version 3 or later";
-    url = http://www.fsf.org/licensing/licenses/gpl.html;
+  gpl3Plus = spdx {
+    shortName = "GPL-3.0+";
+    fullName = "GNU General Public License v3.0 or later";
  };

  gpl3ClasspathPlus = {
-    shortName = "GPLv3+classpath+";
-    fullName = "GNU General Public License version 3 or later (with Classpath exception)";
+    shortName = "GPL-3.0+-with-classpath-exception";
+    fullName = "GNU General Public License v3.0 or later (with Classpath exception)";
    url = https://fedoraproject.org/wiki/Licensing/GPL_Classpath_Exception;
  };

-  isc = {
+  inria = {
+    shortName = "INRIA-NCLA";
+    fullName  = "INRIA Non-Commercial License Agreement";
+    url       = "http://compcert.inria.fr/doc/LICENSE";
+  };
+
+  ipa = spdx {
+    shortName = "IPA";
+    fullName = "IPA Font License";
+  };
+
+  ipl10 = spdx {
+    shortName = "IPL-1.0";
+    fullName = "IBM Public License v1.0";
+  };
+
+  isc = spdx {
    shortName = "ISC";
-    fullName = "Internet Systems Consortium License";
-    url = http://www.opensource.org/licenses/ISC;
+    fullName = "ISC License";
  };

-  ipa = {
-    shortName = "IPA 1.0";
-    fullName = "IPA Font License v1.0";
-    url = http://ipafont.ipa.go.jp/ipafont/;
+  lgpl2 = spdx {
+    shortName = "LGPL-2.0";
+    fullName = "GNU Library General Public License v2 only";
  };

-  ipl10 = {
-    shortName = "IPL 1.0";
-    fullName = "IBM Public License Version 1.0";
-    url = http://www.ibm.com/developerworks/opensource/library/os-i18n2/os-ipl.html;
+  lgpl2Plus = spdx {
+    shortName = "LGPL-2.0+";
+    fullName = "GNU Library General Public License v2 or later";
  };

-  ijg = {
-    shortName = "IJG";
-    fullName = "Independent JPEG Group License";
-    url = https://fedoraproject.org/wiki/Licensing/IJG;
+  lgpl21 = spdx {
+    shortName = "LGPL-2.1";
+    fullName = "GNU Library General Public License v2.1 only";
+  };
+
+  lgpl21Plus = spdx {
+    shortName = "LGPL-2.1+";
+    fullName = "GNU Library General Public License v2.1 or later";
+  };
+
+  lgpl3 = spdx {
+    shortName = "LGPL-3.0";
+    fullName = "GNU Lesser General Public License v3.0 only";
+  };
+
+  lgpl3Plus = spdx {
+    shortName = "LGPL-3.0+";
+    fullName = "GNU Lesser General Public License v3.0 or later";
  };

  libtiff = {
@ -156,76 +178,52 @@
    url = https://fedoraproject.org/wiki/Licensing/libtiff;
  };

-  lgpl2 = {
-    shortName = "LGPLv2";
-    fullName = "GNU Library General Public License version 2";
-    url = http://www.gnu.org/licenses/old-licenses/lgpl-2.0.html;
-  };
-
-  lgpl2Plus = {
-    shortName = "LGPLv2+";
-    fullName = "GNU Library General Public License version 2 or later";
-    url = http://www.gnu.org/licenses/old-licenses/lgpl-2.0.html;
-  };
-
-  lgpl21 = {
-    shortName = "LGPLv2.1";
-    fullName = "GNU Lesser General Public License version 2.1";
-    url = http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html;
-  };
-
-  lgpl21Plus = {
-    shortName = "LGPLv2.1+";
-    fullName = "GNU Lesser General Public License version 2.1 or later";
-    url = http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html;
-  };
-
  llgpl21 = {
-    shortName = "LLGPLv2.1";
+    shortName = "LLGPL-2.1";
    fullName = "Lisp LGPL; GNU Lesser General Public License version 2.1 with Franz Inc. preamble for clarification of LGPL terms in context of Lisp";
    url = http://opensource.franz.com/preamble.html;
  };

-  lgpl3 = {
-    shortName = "LGPLv3";
-    fullName = "GNU Lesser General Public License version 3 only";
-    url = http://www.fsf.org/licensing/licenses/lgpl.html;
+  lpl-102 = spdx {
+    shortName = "LPL-1.02";
+    fullName = "Lucent Public License v1.02";
  };

-  lgpl3Plus = {
-    shortName = "LGPLv3+";
-    fullName = "GNU Lesser General Public License version 3 or later";
-    url = http://www.fsf.org/licensing/licenses/lgpl.html;
-  };
-
-  mit = {
+  mit = spdx {
    shortName = "MIT";
-    fullName = "MIT/X11 license";
-    url = http://www.opensource.org/licenses/mit-license.php;
+    fullName = "MIT License";
  };

-  mpl11 = {
-    shortName = "MPL1.1";
-    fullName = "Mozilla Public License version 1.1";
-    url = http://www.mozilla.org/MPL/MPL-1.1.html;
+  mpl11 = spdx {
+    shortName = "MPL-1.1";
+    fullName = "Mozilla Public License 1.1";
  };

-  mpl20 = {
-    shortName = "MPL2.0";
-    fullName = "Mozilla Public License version 2.0";
-    url = https://www.mozilla.org/MPL/2.0;
+  mpl20 = spdx {
+    shortName = "MPL-2.0";
+    fullName = "Mozilla Public License 2.0";
  };

-  ofl = {
-    shortName = "OFL";
-    fullName = "SIL Open Font License";
-    url = "http://scripts.sil.org/cms/scripts/page.php?site_id=nrsi&id=OFL_web";
+  msrla = {
+    shortName = "MSR-LA";
+    fullName  = "Microsoft Research License Agreement";
+    url       = "http://research.microsoft.com/en-us/projects/pex/msr-la.txt";
  };

-  openssl = {
-    shortName = "openssl";
-    fullName = "OpenSSL license";
-    url = http://www.openssl.org/source/license.html;
+  ofl = spdx {
+    shortName = "OFL-1.1";
+    fullName = "SIL Open Font License 1.1";
+  };
+
+  openssl = spdx {
+    shortName = "OpenSSL";
+    fullName = "OpenSSL License";
+  };
+
+  psfl = spdx {
+    shortName = "Python-2.0";
+    fullName = "Python Software Foundation License version 2";
+    #url = http://docs.python.org/license.html;
  };

  publicDomain = {
@ -233,10 +231,9 @@
    fullname = "Public Domain";
  };

-  psfl = {
-    shortName = "PSFL";
-    fullName = "Python Software Foundation License";
-    url = http://docs.python.org/license.html;
+  sleepycat = spdx {
+    shortName = "Sleepycat";
+    fullName  = "Sleepycat License";
  };

  tcltk = {
@ -257,45 +254,20 @@
    url = https://fedoraproject.org/wiki/Licensing:Wadalab?rd=Licensing/Wadalab;
  };

-  zlib = {
-    shortName = "zlib";
-    fullName = "zlib license";
-    url = http://www.gzip.org/zlib/zlib_license.html;
+  zlib = spdx {
+    shortName = "Zlib";
+    fullName = "zlib License";
  };

-  zpt20 = {
-    shortName = "ZPT2.0";
+  zpt20 = spdx { # FIXME: why zpt* instead of zpl*
+    shortName = "ZPL-2.0";
    fullName = "Zope Public License 2.0";
-    url = "http://old.zope.org/Resources/License/ZPL-2.0";
  };

-  zpt21 = {
-    shortName = "ZPT2.1";
+  zpt21 = spdx {
+    shortName = "ZPL-2.1";
    fullName = "Zope Public License 2.1";
-    url = "http://old.zope.org/Resources/License/ZPL-2.1";
  };

-  sleepycat = {
-    shortName = "Sleepycat";
-    fullName  = "Sleepycat Public License";
-    url       = "https://en.wikipedia.org/wiki/Sleepycat_License";
-  };
-
-  cecill-c = {
-    shortName = "CeCILL-C";
-    fullName  = "CEA CNRS INRIA Logiciel Libre";
-    url       = "http://www.cecill.info/licences.en.html";
-  };
-
-  msrla = {
-    shortName = "MSR-LA";
-    fullName  = "Microsoft Research License Agreement";
-    url       = "http://research.microsoft.com/en-us/projects/pex/msr-la.txt";
-  };
-
-  inria = {
-    shortName = "INRIA-NCLA";
-    fullName  = "INRIA Non-Commercial License Agreement";
-    url       = "http://compcert.inria.fr/doc/LICENSE";
-  };
 }
+
--- a/lib/maintainers.nix
+++ b/lib/maintainers.nix
@ -33,6 +33,7 @@
  coconnor = "Corey O'Connor <coreyoconnor@gmail.com>";
  coroa = "Jonas Hörsch <jonas@chaoflow.net>";
  cstrahan = "Charles Strahan <charles.c.strahan@gmail.com>";
+  DamienCassou = "Damien Cassou <damien.cassou@gmail.com>";
  ederoyd46 = "Matthew Brown <matt@ederoyd.co.uk>";
  edwtjo = "Edward Tjörnhammar <ed@cflags.cc>";
  eelco = "Eelco Dolstra <eelco.dolstra@logicblox.com>";
@ -45,6 +46,7 @@
  goibhniu = "Cillian de Róiste <cillian.deroiste@gmail.com>";
  guibert = "David Guibert <david.guibert@gmail.com>";
  hinton = "Tom Hinton <t@larkery.com>";
+  hrdinka = "Christoph Hrdinka <c.nix@hrdinka.at>";
  ianwookim = "Ian-Woo Kim <ianwookim@gmail.com>";
  iElectric = "Domen Kozar <domen@dev.si>";
  iyzsong = "Song Wenwu <iyzsong@gmail.com>";
@ -62,6 +64,7 @@
  madjar = "Georges Dubus <georges.dubus@compiletoi.net>";
  marcweber = "Marc Weber <marco-oweber@gmx.de>";
  matejc = "Matej Cotman <cotman.matej@gmail.com>";
+  meisternu = "Matt Miemiec <meister@krutt.org>";
  modulistic = "Pablo Costa <modulistic@gmail.com>";
  mornfall = "Petr Ročkai <me@mornfall.net>";
  msackman = "Matthew Sackman <matthew@wellquite.org>";
--- a/lib/platforms.nix
+++ b/lib/platforms.nix
@ -7,10 +7,10 @@ rec {
  freebsd = ["i686-freebsd" "x86_64-freebsd"];
  openbsd = ["i686-openbsd" "x86_64-openbsd"];
  netbsd = ["i686-netbsd" "x86_64-netbsd"];
-  cygwin = ["i686-cygwin"];
+  cygwin = ["i686-cygwin" "x86_64-cygwin"];
  unix = linux ++ darwin ++ freebsd ++ openbsd;
  all = linux ++ darwin ++ cygwin ++ freebsd ++ openbsd;
  none = [];
-  allBut = platform: lists.filter (x: platform != x) all;
+  allBut = platforms: lists.filter (x: !(builtins.elem x platforms)) all;
  mesaPlatforms = ["i686-linux" "x86_64-linux" "x86_64-darwin" "armv5tel-linux" "armv6l-linux"];
 }
--- a/nixos/doc/manual/configuration.xml
+++ b/nixos/doc/manual/configuration.xml
@ -1033,11 +1033,9 @@ states that a user account named <literal>alice</literal> shall exist:

 <programlisting>
 users.extraUsers.alice =
-  { createHome = true;
-    home = "/home/alice";
+  { isNormalUser = true;
    description = "Alice Foobar";
    extraGroups = [ "wheel" "networkmanager" ];
-    useDefaultShell = true;
    openssh.authorizedKeys.keys = [ "ssh-dss AAAAB3Nza... alice@foobar" ];
  };
 </programlisting>
@ -1072,11 +1070,6 @@ users.extraGroups.students.gid = 1000;
 As with users, the group ID (gid) is optional and will be assigned
 automatically if it’s missing.</para>

-<warning><para>Currently declarative user management is not perfect:
-<command>nixos-rebuild</command> does not know how to realise certain
-configuration changes.  This includes removing a user or group, and
-removing group membership from a user.</para></warning>
-
 <para>In the imperative style, users and groups are managed by
 commands such as <command>useradd</command>,
 <command>groupmod</command> and so on.  For instance, to create a user
--- a/nixos/doc/manual/default.nix
+++ b/nixos/doc/manual/default.nix
@ -1,5 +1,6 @@
 { pkgs, options, version, revision }:

+with pkgs;
 with pkgs.lib;

 let
@ -22,7 +23,7 @@ let

  optionsXML = builtins.toFile "options.xml" (builtins.unsafeDiscardStringContext (builtins.toXML options''));

-  optionsDocBook = pkgs.runCommand "options-db.xml" {} ''
+  optionsDocBook = runCommand "options-db.xml" {} ''
    if grep /nixpkgs/nixos/modules ${optionsXML}; then
      echo "The manual appears to depend on the location of Nixpkgs, which is bad"
      echo "since this prevents sharing via the NixOS channel.  This is typically"
@ -30,7 +31,7 @@ let
      echo "for hints about the offending path)."
      exit 1
    fi
-    ${pkgs.libxslt}/bin/xsltproc \
+    ${libxslt}/bin/xsltproc \
      --stringparam revision '${revision}' \
      -o $out ${./options-to-docbook.xsl} ${optionsXML}
  '';
@ -38,12 +39,12 @@ let
 in rec {

  # Generate the NixOS manual.
-  manual = pkgs.stdenv.mkDerivation {
+  manual = stdenv.mkDerivation {
    name = "nixos-manual";

    sources = sourceFilesBySuffices ./. [".xml"];

-    buildInputs = [ pkgs.libxml2 pkgs.libxslt ];
+    buildInputs = [ libxml2 libxslt ];

    xsltFlags = ''
      --param section.autolabel 1
@ -62,7 +63,7 @@ in rec {

      # Check the validity of the manual sources.
      xmllint --noout --nonet --xinclude --noxincludenode \
-        --relaxng ${pkgs.docbook5}/xml/rng/docbook/docbook.rng \
+        --relaxng ${docbook5}/xml/rng/docbook/docbook.rng \
        manual.xml

      # Generate the HTML manual.
@ -70,11 +71,11 @@ in rec {
      mkdir -p $dst
      xsltproc $xsltFlags --nonet --xinclude \
        --output $dst/manual.html \
-        ${pkgs.docbook5_xsl}/xml/xsl/docbook/xhtml/docbook.xsl \
+        ${docbook5_xsl}/xml/xsl/docbook/xhtml/docbook.xsl \
        ./manual.xml

      mkdir -p $dst/images/callouts
-      cp ${pkgs.docbook5_xsl}/xml/xsl/docbook/images/callouts/*.gif $dst/images/callouts/
+      cp ${docbook5_xsl}/xml/xsl/docbook/images/callouts/*.gif $dst/images/callouts/

      cp ${./style.css} $dst/style.css

@ -86,13 +87,39 @@ in rec {
    meta.description = "The NixOS manual in HTML format";
  };

+  manualPDF = stdenv.mkDerivation {
+    name = "nixos-manual-pdf";
+
+    sources = sourceFilesBySuffices ./. [".xml"];
+
+    buildInputs = [ libxml2 libxslt dblatex tetex ];
+
+    buildCommand = ''
+      # TeX needs a writable font cache.
+      export VARTEXFONTS=$TMPDIR/texfonts
+
+      ln -s $sources/*.xml . # */
+      ln -s ${optionsDocBook} options-db.xml
+      echo "${version}" > version
+
+      dst=$out/share/doc/nixos
+      mkdir -p $dst
+      xmllint --xinclude manual.xml | dblatex -o $dst/manual.pdf - \
+        -P doc.collab.show=0 \
+        -P latex.output.revhistory=0
+
+      mkdir -p $out/nix-support
+      echo "doc-pdf manual $dst/manual.pdf" >> $out/nix-support/hydra-build-products
+    ''; # */
+  };
+
  # Generate the NixOS manpages.
-  manpages = pkgs.stdenv.mkDerivation {
+  manpages = stdenv.mkDerivation {
    name = "nixos-manpages";

    sources = sourceFilesBySuffices ./. [".xml"];

-    buildInputs = [ pkgs.libxml2 pkgs.libxslt ];
+    buildInputs = [ libxml2 libxslt ];

    buildCommand = ''
      ln -s $sources/*.xml . # */
@ -100,7 +127,7 @@ in rec {

      # Check the validity of the manual sources.
      xmllint --noout --nonet --xinclude --noxincludenode \
-        --relaxng ${pkgs.docbook5}/xml/rng/docbook/docbook.rng \
+        --relaxng ${docbook5}/xml/rng/docbook/docbook.rng \
        ./man-pages.xml

      # Generate manpages.
@ -109,7 +136,7 @@ in rec {
        --param man.output.in.separate.dir 1 \
        --param man.output.base.dir "'$out/share/man/'" \
        --param man.endnotes.are.numbered 0 \
-        ${pkgs.docbook5_xsl}/xml/xsl/docbook/manpages/docbook.xsl \
+        ${docbook5_xsl}/xml/xsl/docbook/manpages/docbook.xsl \
        ./man-pages.xml
    '';
  };
--- a/nixos/doc/manual/manual.xml
+++ b/nixos/doc/manual/manual.xml
@ -7,25 +7,6 @@
    <title>NixOS Manual</title>
    <subtitle>Version <xi:include href="version" parse="text" /></subtitle>

-    <author>
-      <personname>
-        <firstname>Eelco</firstname>
-        <surname>Dolstra</surname>
-      </personname>
-    </author>
-
-    <author>
-      <personname>
-        <firstname>Nicolas</firstname>
-        <surname>Pierron</surname>
-      </personname>
-    </author>
-
-    <copyright>
-      <year>2007-2013</year>
-      <holder>Eelco Dolstra</holder>
-    </copyright>
-
  </info>


--- a/nixos/doc/manual/options-to-docbook.xsl
+++ b/nixos/doc/manual/options-to-docbook.xsl
@ -202,4 +202,10 @@
    </simplelist>
  </xsl:template>

+
+  <xsl:template match="function">
+    <xsl:text>λ</xsl:text>
+  </xsl:template>
+
+
 </xsl:stylesheet>
--- a/nixos/modules/config/pulseaudio.nix
+++ b/nixos/modules/config/pulseaudio.nix
@ -80,12 +80,12 @@ in {

      package = mkOption {
        type = types.package;
-        default = pulseaudio;
-        example = literalExample "pulseaudio.override { jackaudioSupport = true; }";
+        default = pulseaudioFull;
+        example = literalExample "pulseaudioFull";
        description = ''
-          The PulseAudio derivation to use.  This can be used to enable
-          features (such as JACK support) that are not enabled in the
-          default PulseAudio in Nixpkgs.
+          The PulseAudio derivation to use.  This can be used to disable
+          features (such as JACK support, Bluetooth) that are enabled in the
+          pulseaudioFull package in Nixpkgs.
        '';
      };

--- a/nixos/modules/config/update-users-groups.pl
+++ b/nixos/modules/config/update-users-groups.pl
@ -0,0 +1,239 @@
+use strict;
+use File::Path qw(make_path);
+use File::Slurp;
+use JSON;
+
+make_path("/var/lib/nixos", { mode => 0755 });
+
+
+# Functions for allocating free GIDs/UIDs. FIXME: respect ID ranges in
+# /etc/login.defs.
+sub allocId {
+    my ($used, $idMin, $idMax, $up, $getid) = @_;
+    my $id = $up ? $idMin : $idMax;
+    while ($id >= $idMin && $id <= $idMax) {
+        if (!$used->{$id} && !defined &$getid($id)) {
+            $used->{$id} = 1;
+            return $id;
+        }
+        $used->{$id} = 1;
+        if ($up) { $id++; } else { $id--; }
+    }
+    die "$0: out of free UIDs or GIDs\n";
+}
+
+my (%gidsUsed, %uidsUsed);
+
+sub allocGid {
+    return allocId(\%gidsUsed, 400, 499, 0, sub { my ($gid) = @_; getgrgid($gid) });
+}
+
+sub allocUid {
+    my ($isSystemUser) = @_;
+    my ($min, $max, $up) = $isSystemUser ? (400, 499, 0) : (1000, 29999, 1);
+    return allocId(\%uidsUsed, $min, $max, $up, sub { my ($uid) = @_; getpwuid($uid) });
+}
+
+
+# Read the declared users/groups.
+my $spec = decode_json(read_file($ARGV[0]));
+
+# Don't allocate UIDs/GIDs that are already in use.
+foreach my $g (@{$spec->{groups}}) {
+    $gidsUsed{$g->{gid}} = 1 if defined $g->{gid};
+}
+
+foreach my $u (@{$spec->{groups}}) {
+    $uidsUsed{$u->{u}} = 1 if defined $u->{uid};
+}
+
+# Read the current /etc/group.
+sub parseGroup {
+    chomp;
+    my @f = split(':', $_, -4);
+    my $gid = $f[2] eq "" ? undef : int($f[2]);
+    $gidsUsed{$gid} = 1 if defined $gid;
+    return ($f[0], { name => $f[0], password => $f[1], gid => $gid, members => $f[3] });
+}
+
+my %groupsCur = -f "/etc/group" ? map { parseGroup } read_file("/etc/group") : ();
+
+# Read the current /etc/passwd.
+sub parseUser {
+    chomp;
+    my @f = split(':', $_, -7);
+    my $uid = $f[2] eq "" ? undef : int($f[2]);
+    $uidsUsed{$uid} = 1 if defined $uid;
+    return ($f[0], { name => $f[0], fakePassword => $f[1], uid => $uid,
+        gid => $f[3], description => $f[4], home => $f[5], shell => $f[6] });
+}
+
+my %usersCur = -f "/etc/passwd" ? map { parseUser } read_file("/etc/passwd") : ();
+
+# Read the groups that were created declaratively (i.e. not by groups)
+# in the past. These must be removed if they are no longer in the
+# current spec.
+my $declGroupsFile = "/var/lib/nixos/declarative-groups";
+my %declGroups;
+$declGroups{$_} = 1 foreach split / /, -e $declGroupsFile ? read_file($declGroupsFile) : "";
+
+# Idem for the users.
+my $declUsersFile = "/var/lib/nixos/declarative-users";
+my %declUsers;
+$declUsers{$_} = 1 foreach split / /, -e $declUsersFile ? read_file($declUsersFile) : "";
+
+
+# Generate a new /etc/group containing the declared groups.
+my %groupsOut;
+foreach my $g (@{$spec->{groups}}) {
+    my $name = $g->{name};
+    my $existing = $groupsCur{$name};
+
+    my %members = map { ($_, 1) } @{$g->{members}};
+
+    if (defined $existing) {
+        $g->{gid} = $existing->{gid} if !defined $g->{gid};
+        if ($g->{gid} != $existing->{gid}) {
+            warn "warning: not applying GID change of group ‘$name’\n";
+            $g->{gid} = $existing->{gid};
+        }
+        $g->{password} = $existing->{password}; # do we want this?
+        if ($spec->{mutableUsers}) {
+            # Merge in non-declarative group members.
+            foreach my $uname (split /,/, $existing->{members} // "") {
+                $members{$uname} = 1 if !defined $declUsers{$uname};
+            }
+        }
+    } else {
+        $g->{gid} = allocGid if !defined $g->{gid};
+        $g->{password} = "x";
+    }
+
+    $g->{members} = join ",", sort(keys(%members));
+    $groupsOut{$name} = $g;
+}
+
+# Update the persistent list of declarative groups.
+write_file($declGroupsFile, join(" ", sort(keys %groupsOut)));
+
+# Merge in the existing /etc/group.
+foreach my $name (keys %groupsCur) {
+    my $g = $groupsCur{$name};
+    next if defined $groupsOut{$name};
+    if (!$spec->{mutableUsers} || defined $declGroups{$name}) {
+        print STDERR "removing group ‘$name’\n";
+    } else {
+        $groupsOut{$name} = $g;
+    }
+}
+
+
+# Rewrite /etc/group. FIXME: acquire lock.
+my @lines = map { join(":", $_->{name}, $_->{password}, $_->{gid}, $_->{members}) . "\n" }
+    (sort { $a->{gid} <=> $b->{gid} } values(%groupsOut));
+write_file("/etc/group.tmp", @lines);
+rename("/etc/group.tmp", "/etc/group") or die;
+system("nscd --invalidate group");
+
+# Generate a new /etc/passwd containing the declared users.
+my %usersOut;
+foreach my $u (@{$spec->{users}}) {
+    my $name = $u->{name};
+
+    # Resolve the gid of the user.
+    if ($u->{group} =~ /^[0-9]$/) {
+        $u->{gid} = $u->{group};
+    } elsif (defined $groupsOut{$u->{group}}) {
+        $u->{gid} = $groupsOut{$u->{group}}->{gid} // die;
+    } else {
+        warn "warning: user ‘$name’ has unknown group ‘$u->{group}’\n";
+        $u->{gid} = 65534;
+    }
+
+    my $existing = $usersCur{$name};
+    if (defined $existing) {
+        $u->{uid} = $existing->{uid} if !defined $u->{uid};
+        if ($u->{uid} != $existing->{uid}) {
+            warn "warning: not applying UID change of user ‘$name’\n";
+            $u->{uid} = $existing->{uid};
+        }
+    } else {
+        $u->{uid} = allocUid($u->{isSystemUser}) if !defined $u->{uid};
+
+        # Create a home directory.
+        if ($u->{createHome}) {
+            make_path($u->{home}, { mode => 0700 }) if ! -e $u->{home};
+            chown $u->{uid}, $u->{gid}, $u->{home};
+        }
+    }
+
+    if (defined $u->{passwordFile}) {
+        if (-e $u->{passwordFile}) {
+            $u->{hashedPassword} = read_file($u->{passwordFile});
+            chomp $u->{hashedPassword};
+        } else {
+            warn "warning: password file ‘$u->{passwordFile}’ does not exist\n";
+        }
+    }
+
+    $u->{fakePassword} = $existing->{fakePassword} // "x";
+    $usersOut{$name} = $u;
+}
+
+# Update the persistent list of declarative users.
+write_file($declUsersFile, join(" ", sort(keys %usersOut)));
+
+# Merge in the existing /etc/passwd.
+foreach my $name (keys %usersCur) {
+    my $u = $usersCur{$name};
+    next if defined $usersOut{$name};
+    if (!$spec->{mutableUsers} || defined $declUsers{$name}) {
+        print STDERR "removing user ‘$name’\n";
+    } else {
+        $usersOut{$name} = $u;
+    }
+}
+
+# Rewrite /etc/passwd. FIXME: acquire lock.
+@lines = map { join(":", $_->{name}, $_->{fakePassword}, $_->{uid}, $_->{gid}, $_->{description}, $_->{home}, $_->{shell}) . "\n" }
+    (sort { $a->{uid} <=> $b->{uid} } (values %usersOut));
+write_file("/etc/passwd.tmp", @lines);
+rename("/etc/passwd.tmp", "/etc/passwd") or die;
+system("nscd --invalidate passwd");
+
+
+# Rewrite /etc/shadow to add new accounts or remove dead ones.
+my @shadowNew;
+my %shadowSeen;
+
+foreach my $line (-f "/etc/shadow" ? read_file("/etc/shadow") : ()) {
+    chomp $line;
+    my ($name, $password, @rest) = split(':', $line, -9);
+    my $u = $usersOut{$name};;
+    next if !defined $u;
+    $password = $u->{hashedPassword} if $u->{hashedPassword} && !$spec->{mutableUsers}; # FIXME
+    push @shadowNew, join(":", $name, $password, @rest) . "\n";
+    $shadowSeen{$name} = 1;
+}
+
+foreach my $u (values %usersOut) {
+    next if defined $shadowSeen{$u->{name}};
+    my $password = "!";
+    $password = $u->{hashedPassword} if $u->{hashedPassword};
+    # FIXME: set correct value for sp_lstchg.
+    push @shadowNew, join(":", $u->{name}, $password, "1::::::") . "\n";
+}
+
+write_file("/etc/shadow.tmp", { perms => 0600 }, @shadowNew);
+rename("/etc/shadow.tmp", "/etc/shadow") or die;
+
+
+# Call chpasswd to apply password. FIXME: generate the hashes directly
+# and merge into the /etc/shadow updating above.
+foreach my $u (@{$spec->{users}}) {
+    if (defined $u->{password}) {
+        my $pid = open(PW, "| chpasswd") or die;
+        print PW "$u->{name}:$u->{password}\n";
+        close PW or die "unable to change password of user ‘$u->{name}’: $?\n";
+    }
+}
--- a/nixos/modules/config/users-groups.nix
+++ b/nixos/modules/config/users-groups.nix
@ -7,9 +7,6 @@ let
  ids = config.ids;
  cfg = config.users;

-  nonUidUsers = filterAttrs (n: u: u.createUser && u.uid == null) cfg.extraUsers;
-  nonGidGroups = filterAttrs (n: g: g.gid == null) cfg.extraGroups;
-
  passwordDescription = ''
    The options <literal>hashedPassword</literal>,
    <literal>password</literal> and <literal>passwordFile</literal>
@ -55,10 +52,8 @@ let
        type = with types; nullOr int;
        default = null;
        description = ''
-          The account UID. If the <option>mutableUsers</option> option
-          is false, the UID cannot be null. Otherwise, the UID might be
-          null, in which case a free UID is picked on activation (by the
-          useradd command).
+          The account UID. If the UID is null, a free UID is picked on
+          activation.
        '';
      };

@ -67,8 +62,7 @@ let
        default = false;
        description = ''
          Indicates if the user is a system user or not. This option
-          only has an effect if <option>mutableUsers</option> is
-          <literal>true</literal> and <option>uid</option> is
+          only has an effect if <option>uid</option> is
          <option>null</option>, in which case it determines whether
          the user's UID is allocated in the range for system users
          (below 500) or in the range for normal users (starting at
@ -76,6 +70,21 @@ let
        '';
      };

+      isNormalUser = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Indicates whether this is an account for a “real” user. This
+          automatically sets <option>group</option> to
+          <literal>users</literal>, <option>createHome</option> to
+          <literal>true</literal>, <option>home</option> to
+          <filename>/home/<replaceable>username</replaceable></filename>,
+          <option>useDefaultShell</option> to <literal>true</literal>,
+          and <option>isSystemUser</option> to
+          <literal>false</literal>.
+        '';
+      };
+
      group = mkOption {
        type = types.str;
        default = "nogroup";
@ -152,22 +161,20 @@ let
          ${passwordDescription}
        '';
      };
-
-      createUser = mkOption {
-        type = types.bool;
-        default = true;
-        description = ''
-          Indicates if the user should be created automatically as a local user.
-          Set this to false if the user for instance is an LDAP user. NixOS will
-          then not modify any of the basic properties for the user account.
-        '';
-      };
    };

-    config = {
-      name = mkDefault name;
-      shell = mkIf config.useDefaultShell (mkDefault cfg.defaultUserShell);
-    };
+    config = mkMerge
+      [ { name = mkDefault name;
+          shell = mkIf config.useDefaultShell (mkDefault cfg.defaultUserShell);
+        }
+        (mkIf config.isNormalUser {
+          group = mkDefault "users";
+          createHome = mkDefault true;
+          home = mkDefault "/home/${name}";
+          useDefaultShell = mkDefault true;
+          isSystemUser = mkDefault false;
+        })
+      ];

  };

@ -187,10 +194,8 @@ let
        type = with types; nullOr int;
        default = null;
        description = ''
-          The group GID. If the <literal>mutableUsers</literal> option
-          is false, the GID cannot be null. Otherwise, the GID might be
-          null, in which case a free GID is picked on activation (by the
-          groupadd command).
+          The group GID. If the GID is null, a free GID is picked on
+          activation.
        '';
      };

@ -211,84 +216,6 @@ let

  };

-  getGroup = gname:
-    let
-      groups = mapAttrsToList (n: g: g) (
-        filterAttrs (n: g: g.name == gname) cfg.extraGroups
-      );
-    in
-      if length groups == 1 then head groups
-      else if groups == [] then throw "Group ${gname} not defined"
-      else throw "Group ${gname} has multiple definitions";
-
-  getUser = uname:
-    let
-      users = mapAttrsToList (n: u: u) (
-        filterAttrs (n: u: u.name == uname) cfg.extraUsers
-      );
-    in
-      if length users == 1 then head users
-      else if users == [] then throw "User ${uname} not defined"
-      else throw "User ${uname} has multiple definitions";
-
-  mkGroupEntry = gname:
-    let
-      g = getGroup gname;
-      users = mapAttrsToList (n: u: u.name) (
-        filterAttrs (n: u: elem g.name u.extraGroups) cfg.extraUsers
-      );
-    in concatStringsSep ":" [
-      g.name "x" (toString g.gid)
-      (concatStringsSep "," (users ++ (filter (u: !(elem u users)) g.members)))
-    ];
-
-  mkPasswdEntry = uname: let u = getUser uname; in
-    concatStringsSep ":" [
-      u.name "x" (toString u.uid)
-      (toString (getGroup u.group).gid)
-      u.description u.home u.shell
-    ];
-
-  sortOn = a: sort (as1: as2: lessThan (getAttr a as1) (getAttr a as2));
-
-  groupFile = pkgs.writeText "group" (
-    concatStringsSep "\n" (map (g: mkGroupEntry g.name) (
-      let f = g: g.gid != null; in
-        sortOn "gid" (filter f (attrValues cfg.extraGroups))
-    ))
-  );
-
-  passwdFile = pkgs.writeText "passwd" (
-    concatStringsSep "\n" (map (u: mkPasswdEntry u.name) (
-      let f = u: u.createUser && (u.uid != null); in
-        sortOn "uid" (filter f (attrValues cfg.extraUsers))
-    ))
-  );
-
-  # If mutableUsers is true, this script adds all users/groups defined in
-  # users.extra{Users,Groups} to /etc/{passwd,group} iff there isn't any
-  # existing user/group with the same name in those files.
-  # If mutableUsers is false, the /etc/{passwd,group} files will simply be
-  # replaced with the users/groups defined in the NixOS configuration.
-  # The merging procedure could certainly be improved, and instead of just
-  # keeping the lines as-is from /etc/{passwd,group} they could be combined
-  # in some way with the generated content from the NixOS configuration.
-  merger = src: pkgs.writeScript "merger" ''
-    #!${pkgs.bash}/bin/bash
-
-    PATH=${pkgs.gawk}/bin:${pkgs.gnugrep}/bin:$PATH
-
-    ${if !cfg.mutableUsers
-      then ''cp ${src} $1.tmp''
-      else ''awk -F: '{ print "^"$1":.*" }' $1 | egrep -vf - ${src} | cat $1 - > $1.tmp''
-    }
-
-    # set mtime to +1, otherwise change might go unnoticed (vipw/vigr only looks at mtime)
-    touch -m -t $(date -d @$(($(stat -c %Y $1)+1)) +%Y%m%d%H%M.%S) $1.tmp
-
-    mv -f $1.tmp $1
-  '';
-
  idsAreUnique = set: idAttr: !(fold (name: args@{ dup, acc }:
    let
      id = builtins.toString (builtins.getAttr idAttr (builtins.getAttr name set));
@ -302,6 +229,21 @@ let
  uidsAreUnique = idsAreUnique (filterAttrs (n: u: u.uid != null) cfg.extraUsers) "uid";
  gidsAreUnique = idsAreUnique (filterAttrs (n: g: g.gid != null) cfg.extraGroups) "gid";

+  spec = builtins.toFile "users-groups.json" (builtins.toJSON {
+    inherit (cfg) mutableUsers;
+    users = mapAttrsToList (n: u:
+      { inherit (u)
+          name uid group description home shell createHome isSystemUser
+          password passwordFile hashedPassword;
+      }) cfg.extraUsers;
+    groups = mapAttrsToList (n: g:
+      { inherit (g) name gid;
+        members = mapAttrsToList (n: u: u.name) (
+          filterAttrs (n: u: elem g.name u.extraGroups) cfg.extraUsers
+        );
+      }) cfg.extraGroups;
+  });
+
 in {

  ###### interface
@ -438,67 +380,12 @@ in {
      grsecurity.gid = ids.gids.grsecurity;
    };

-    system.activationScripts.users =
-      let
-        mkhomeUsers = filterAttrs (n: u: u.createHome) cfg.extraUsers;
-        setpwUsers = filterAttrs (n: u: u.createUser) cfg.extraUsers;
-        pwFile = u: if !(isNull u.hashedPassword)
-          then pkgs.writeTextFile { name = "password-file"; text = u.hashedPassword; }
-          else if !(isNull u.password)
-          then pkgs.runCommand "password-file" { pw = u.password; } ''
-            echo -n "$pw" | ${pkgs.mkpasswd}/bin/mkpasswd -s > $out
-          '' else u.passwordFile;
-        setpw = n: u: ''
-          setpw=yes
-          ${optionalString cfg.mutableUsers ''
-            test "$(getent shadow '${u.name}' | cut -d: -f2)" != "x" && setpw=no
-          ''}
-          if [ "$setpw" == "yes" ]; then
-            ${if !(isNull (pwFile u))
-              then ''
-                echo -n "${u.name}:" | cat - "${pwFile u}" | \
-                  ${pkgs.shadow}/sbin/chpasswd -e
-              ''
-              else "passwd -l '${u.name}' &>/dev/null"
-            }
-          fi
-        '';
-        mkhome = n: u: ''
-          uid="$(id -u ${u.name})"
-          gid="$(id -g ${u.name})"
-          h="${u.home}"
-          test -a "$h" || mkdir -p "$h" || true
-          test "$(stat -c %u "$h")" = $uid || chown $uid "$h" || true
-          test "$(stat -c %g "$h")" = $gid || chgrp $gid "$h" || true
-        '';
-        groupadd = n: g: ''
-          if [ -z "$(getent group "${g.name}")" ]; then
-            ${pkgs.shadow}/sbin/groupadd "${g.name}"
-          fi
-        '';
-        useradd = n: u: ''
-          if ! id "${u.name}" &>/dev/null; then
-            ${pkgs.shadow}/sbin/useradd \
-              -g "${u.group}" \
-              -G "${concatStringsSep "," u.extraGroups}" \
-              -s "${u.shell}" \
-              -d "${u.home}" \
-              ${optionalString u.isSystemUser "--system"} \
-              "${u.name}"
-            echo "${u.name}:x" | ${pkgs.shadow}/sbin/chpasswd -e
-          fi
-        '';
-      in stringAfter [ "etc" ] ''
-        touch /etc/group
-        touch /etc/passwd
-        VISUAL=${merger groupFile} ${pkgs.shadow}/sbin/vigr &>/dev/null
-        VISUAL=${merger passwdFile} ${pkgs.shadow}/sbin/vipw &>/dev/null
-        ${pkgs.shadow}/sbin/grpconv
-        ${pkgs.shadow}/sbin/pwconv
-        ${concatStrings (mapAttrsToList groupadd nonGidGroups)}
-        ${concatStrings (mapAttrsToList useradd nonUidUsers)}
-        ${concatStrings (mapAttrsToList mkhome mkhomeUsers)}
-        ${concatStrings (mapAttrsToList setpw setpwUsers)}
+    system.activationScripts.users = stringAfter [ "etc" ]
+      ''
+        ${pkgs.perl}/bin/perl -w \
+          -I${pkgs.perlPackages.FileSlurp}/lib/perl5/site_perl \
+          -I${pkgs.perlPackages.JSON}/lib/perl5/site_perl \
+          ${./update-users-groups.pl} ${spec}
      '';

    # for backwards compatibility
@ -506,13 +393,7 @@ in {

    assertions = [
      { assertion = !cfg.enforceIdUniqueness || (uidsAreUnique && gidsAreUnique);
-        message = "uids and gids must be unique!";
-      }
-      { assertion = cfg.mutableUsers || (nonUidUsers == {});
-        message = "When mutableUsers is false, no uid can be null: ${toString (attrNames nonUidUsers)}";
-      }
-      { assertion = cfg.mutableUsers || (nonGidGroups == {});
-        message = "When mutableUsers is false, no gid can be null";
+        message = "UIDs and GIDs must be unique!";
      }
    ];

--- a/nixos/modules/installer/tools/nixos-generate-config.pl
+++ b/nixos/modules/installer/tools/nixos-generate-config.pl
@ -490,12 +490,8 @@ $bootLoaderConfig

  # Define a user account. Don't forget to set a password with ‘passwd’.
  # users.extraUsers.guest = {
-  #   name = "guest";
-  #   group = "users";
+  #   isNormalUser = true;
  #   uid = 1000;
-  #   createHome = true;
-  #   home = "/home/guest";
-  #   shell = "/run/current-system/sw/bin/bash";
  # };

 }
--- a/nixos/modules/installer/tools/nixos-rebuild.sh
+++ b/nixos/modules/installer/tools/nixos-rebuild.sh
@ -225,7 +225,10 @@ fi
 # If we're not just building, then make the new configuration the boot
 # default and/or activate it now.
 if [ "$action" = switch -o "$action" = boot -o "$action" = test ]; then
-    $pathToConfig/bin/switch-to-configuration "$action"
+    if ! $pathToConfig/bin/switch-to-configuration "$action"; then
+        echo "warning: there were error switching to the new configuration" >&2
+        exit 1
+    fi
 fi


--- a/nixos/modules/misc/ids.nix
+++ b/nixos/modules/misc/ids.nix
@ -139,6 +139,8 @@
      polipo = 129;
      mopidy = 130;
      unifi = 131;
+      gdm = 132;
+      dhcpd = 133;

      # When adding a uid, make sure it doesn't match an existing gid. And don't use uids above 399!

@ -252,6 +254,8 @@
      polipo = 129;
      mopidy = 130;
      docker = 131;
+      gdm = 132;
+      tss = 133;

      # When adding a gid, make sure it doesn't match an existing uid. And don't use gids above 399!

--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -50,8 +50,10 @@
  ./programs/bash/bash.nix
  ./programs/bash/command-not-found.nix
  ./programs/blcr.nix
+  ./programs/dconf.nix
  ./programs/environment.nix
  ./programs/info.nix
+  ./programs/nano.nix
  ./programs/screen.nix
  ./programs/shadow.nix
  ./programs/shell.nix
@ -125,6 +127,7 @@
  ./services/hardware/pcscd.nix
  ./services/hardware/pommed.nix
  ./services/hardware/sane.nix
+  ./services/hardware/tcsd.nix
  ./services/hardware/thinkfan.nix
  ./services/hardware/udev.nix
  ./services/hardware/udisks2.nix
@ -135,6 +138,7 @@
  ./services/logging/logstash.nix
  ./services/logging/rsyslogd.nix
  ./services/logging/syslogd.nix
+  ./services/logging/syslog-ng.nix
  ./services/mail/dovecot.nix
  ./services/mail/freepops.nix
  ./services/mail/mail.nix
@ -278,6 +282,7 @@
  ./services/x11/desktop-managers/default.nix
  ./services/x11/display-managers/auto.nix
  ./services/x11/display-managers/default.nix
+  ./services/x11/display-managers/gdm.nix
  ./services/x11/display-managers/kdm.nix
  ./services/x11/display-managers/lightdm.nix
  ./services/x11/display-managers/slim.nix
@ -289,6 +294,7 @@
  #./services/x11/window-managers/compiz.nix
  ./services/x11/window-managers/default.nix
  ./services/x11/window-managers/icewm.nix
+  ./services/x11/window-managers/bspwm.nix
  ./services/x11/window-managers/metacity.nix
  ./services/x11/window-managers/none.nix
  ./services/x11/window-managers/twm.nix
--- a/nixos/modules/profiles/demo.nix
+++ b/nixos/modules/profiles/demo.nix
@ -4,12 +4,9 @@
  imports = [ ./graphical.nix ];

  users.extraUsers.demo =
-    { description = "Demo user account";
-      group = "users";
+    { isNormalUser = true;
+      description = "Demo user account";
      extraGroups = [ "wheel" ];
-      home = "/home/demo";
-      createHome = true;
-      useDefaultShell = true;
      password = "demo";
      uid = 1000;
    };
--- a/nixos/modules/programs/dconf.nix
+++ b/nixos/modules/programs/dconf.nix
@ -0,0 +1,34 @@
+{ config, lib, ... }:
+
+let
+  inherit (lib) mkOption mkIf types mapAttrsToList;
+  cfg = config.programs.dconf;
+
+  mkDconfProfile = name: path:
+    { source = path; target = "dconf/profile/${name}"; };
+
+in
+{
+  ###### interface
+
+  options = {
+    programs.dconf = {
+
+      profiles = mkOption {
+        type = types.attrsOf types.path;
+        default = {};
+        description = "Set of dconf profile files.";
+        internal = true;
+      };
+
+    };
+  };
+
+  ###### implementation
+
+  config = mkIf (cfg.profiles != {}) {
+    environment.etc =
+      (mapAttrsToList mkDconfProfile cfg.profiles);
+  };
+
+}
--- a/nixos/modules/programs/nano.nix
+++ b/nixos/modules/programs/nano.nix
@ -0,0 +1,35 @@
+{ config, lib, ... }:
+
+let
+  cfg = config.programs.nano;
+in
+
+{
+  ###### interface
+
+  options = {
+    programs.nano = {
+
+      nanorc = lib.mkOption {
+        type = lib.types.lines;
+        default = "";
+        description = ''
+          The system-wide nano configuration.
+          See <citerefentry><refentrytitle>nanorc</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
+        '';
+        example = ''
+          set nowrap
+          set tabstospaces
+          set tabsize 4
+        '';
+      };
+    };
+  };
+
+  ###### implementation
+
+  config = lib.mkIf (cfg.nanorc != "") {
+    environment.etc."nanorc".text = cfg.nanorc;
+  };
+
+}
--- a/nixos/modules/security/rngd.nix
+++ b/nixos/modules/security/rngd.nix
@ -30,7 +30,8 @@ with lib;

      description = "Hardware RNG Entropy Gatherer Daemon";

-      serviceConfig.ExecStart = "${pkgs.rng_tools}/sbin/rngd -f";
+      serviceConfig.ExecStart = "${pkgs.rng_tools}/sbin/rngd -f -v" +
+        (if config.services.tcsd.enable then " --no-tpm=1" else "");

      restartTriggers = [ pkgs.rng_tools ];
    };
--- a/nixos/modules/security/setuid-wrappers.nix
+++ b/nixos/modules/security/setuid-wrappers.nix
@ -97,8 +97,7 @@ in
          }:

          ''
-            source=${if source != "" then source else "$(PATH=$SETUID_PATH type -tP ${program})"}
-            if test -z "$source"; then
+            if ! source=${if source != "" then source else "$(PATH=$SETUID_PATH type -tP ${program})"}; then
                # If we can't find the program, fall back to the
                # system profile.
                source=/nix/var/nix/profiles/default/bin/${program}
--- a/nixos/modules/services/audio/mopidy.nix
+++ b/nixos/modules/services/audio/mopidy.nix
@ -92,6 +92,17 @@ in {
      };
    };

+    systemd.services.mopidy-scan = {
+      description = "mopidy local files scanner";
+      preStart = "mkdir -p ${cfg.dataDir} && chown -R mopidy:mopidy  ${cfg.dataDir}";
+      serviceConfig = {
+        ExecStart = "${mopidyLauncher}/bin/mopidy --config ${concatStringsSep ":" ([mopidyConf] ++ cfg.extraConfigFiles)} local scan";
+        User = "mopidy";
+        PermissionsStartOnly = true;
+        Type = "oneshot";
+      };
+    };
+
    users.extraUsers.mopidy = {
      inherit uid;
      group = "mopidy";
--- a/nixos/modules/services/hardware/tcsd.nix
+++ b/nixos/modules/services/hardware/tcsd.nix
@ -0,0 +1,139 @@
+# tcsd daemon.
+
+{ config, pkgs, ... }:
+
+with pkgs.lib;
+let
+
+  cfg = config.services.tcsd;
+
+  tcsdConf = pkgs.writeText "tcsd.conf" ''
+    port = 30003
+    num_threads = 10
+    system_ps_file = ${cfg.stateDir}/system.data
+    # This is the log of each individual measurement done by the system.
+    # By re-calculating the PCR registers based on this information, even
+    # finer details about the measured environment can be inferred than
+    # what is available directly from the PCR registers.
+    firmware_log_file = /sys/kernel/security/tpm0/binary_bios_measurements
+    kernel_log_file = /sys/kernel/security/ima/binary_runtime_measurements
+    #firmware_pcrs = 0,1,2,3,4,5,6,7
+    #kernel_pcrs = 10,11
+    platform_cred = ${cfg.platformCred}
+    conformance_cred = ${cfg.conformanceCred}
+    endorsement_cred = ${cfg.endorsementCred}
+    #remote_ops = create_key,random
+    #host_platform_class = server_12
+    #all_platform_classes = pc_11,pc_12,mobile_12
+  '';
+
+in
+{
+
+  ###### interface
+
+  options = {
+
+    services.tcsd = {
+
+      enable = mkOption {
+        default = false;
+        type = types.bool;
+        description = ''
+          Whether to enable tcsd, a Trusted Computing management service
+          that provides TCG Software Stack (TSS).  The tcsd daemon is
+          the only portal to the Trusted Platform Module (TPM), a hardware
+          chip on the motherboard.
+        '';
+      };
+
+      user = mkOption {
+        default = "tss";
+        type = types.string;
+        description = "User account under which tcsd runs.";
+      };
+
+      group = mkOption {
+        default = "tss";
+        type = types.string;
+        description = "Group account under which tcsd runs.";
+      };
+
+      stateDir = mkOption {
+	default = "/var/lib/tpm";
+        type = types.path;
+	description = ''
+          The location of the system persistent storage file.
+          The system persistent storage file holds keys and data across
+          restarts of the TCSD and system reboots. 
+	'';
+      };
+
+      platformCred = mkOption {
+        default = "${cfg.stateDir}/platform.cert";
+        type = types.path;
+        description = ''
+	  Path to the platform credential for your TPM. Your TPM
+          manufacturer may have provided you with a set of credentials
+          (certificates) that should be used when creating identities
+          using your TPM. When a user of your TPM makes an identity,
+          this credential will be encrypted as part of that process.
+          See the 1.1b TPM Main specification section 9.3 for information
+          on this process. '';
+      };
+
+      conformanceCred = mkOption {
+        default = "${cfg.stateDir}/conformance.cert";
+        type = types.path;
+        description = ''
+          Path to the conformance credential for your TPM.
+          See also the platformCred option'';
+      };
+
+      endorsementCred = mkOption {
+        default = "${cfg.stateDir}/endorsement.cert";
+        type = types.path;
+        description = ''
+          Path to the endorsement credential for your TPM.
+          See also the platformCred option'';
+      };
+    };
+
+  };
+
+  ###### implementation
+
+  config = mkIf cfg.enable {
+
+    environment.systemPackages = [ pkgs.trousers ];
+
+#    system.activationScripts.tcsd =
+#      ''
+#        chown ${cfg.user}:${cfg.group} ${tcsdConf}
+#      '';
+
+    systemd.services.tcsd = {
+      description = "TCSD";
+      after = [ "systemd-udev-settle.service" ];
+      wantedBy = [ "multi-user.target" ];
+      path = [ pkgs.trousers ];
+      preStart =
+        ''
+        mkdir -m 0700 -p ${cfg.stateDir}
+        chown -R ${cfg.user}:${cfg.group} ${cfg.stateDir}
+        '';
+      serviceConfig.ExecStart = "${pkgs.trousers}/sbin/tcsd -f -c ${tcsdConf}";
+    };
+
+    users.extraUsers = optionalAttrs (cfg.user == "tss") (singleton
+      { name = "tss";
+        group = "tss";
+        uid = config.ids.uids.nginx;
+      });
+
+    users.extraGroups = optionalAttrs (cfg.group == "tss") (singleton
+      { name = "tss";
+        gid = config.ids.gids.nginx;
+      });
+  };
+}
--- a/nixos/modules/services/logging/syslog-ng.nix
+++ b/nixos/modules/services/logging/syslog-ng.nix
@ -0,0 +1,83 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+
+  cfg = config.services.syslog-ng;
+
+  syslogngConfig = pkgs.writeText "syslog-ng.conf" ''
+    @version: 3.5
+    @include "scl.conf"
+    ${cfg.extraConfig}
+  '';
+
+  ctrlSocket = "/run/syslog-ng/syslog-ng.ctl";
+  pidFile = "/run/syslog-ng/syslog-ng.pid";
+  persistFile = "/var/syslog-ng/syslog-ng.persist";
+
+  syslogngOptions = [
+    "--foreground"
+    "--module-path=${concatStringsSep ":" (["${pkgs.syslogng}/lib/syslog-ng"] ++ cfg.extraModulePaths)}"
+    "--cfgfile=${syslogngConfig}"
+    "--control=${ctrlSocket}"
+    "--persist-file=${persistFile}"
+    "--pidfile=${pidFile}"
+  ];
+
+in {
+
+  options = {
+
+    services.syslog-ng = {
+      enable = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to enable the syslog-ng daemon.
+        '';
+      };
+      serviceName = mkOption {
+        type = types.str;
+        default = "syslog-ng";
+        description = ''
+          The name of the systemd service that runs syslog-ng. Set this to
+          <literal>syslog</literal> if you want journald to automatically
+          forward all logs to syslog-ng.
+        '';
+      };
+      extraModulePaths = mkOption {
+        type = types.listOf types.str;
+        default = [];
+        example = [ "${pkgs.syslogng_incubator}/lib/syslog-ng" ];
+        description = ''
+          A list of paths that should be included in syslog-ng's
+          <literal>--module-path</literal> option. They should usually
+          end in <literal>/lib/syslog-ng</literal>
+        '';
+      };
+      extraConfig = mkOption {
+        type = types.lines;
+        default = "";
+        description = ''
+          Configuration added to the end of <literal>syslog-ng.conf</literal>.
+        '';
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services."${cfg.serviceName}" = {
+      wantedBy = [ "multi-user.target" ];
+      preStart = "mkdir -p /{var,run}/syslog-ng";
+      serviceConfig = {
+        Type = "notify";
+        Sockets = "syslog.socket";
+        StandardOutput = "null";
+        Restart = "on-failure";
+        ExecStart = "${pkgs.syslogng}/sbin/syslog-ng ${concatStringsSep " " syslogngOptions}";
+      };
+    };
+  };
+
+}
--- a/nixos/modules/services/networking/dhcpd.nix
+++ b/nixos/modules/services/networking/dhcpd.nix
@ -13,7 +13,7 @@ let
      default-lease-time 600;
      max-lease-time 7200;
      authoritative;
-      ddns-update-style ad-hoc;
+      ddns-update-style interim;
      log-facility local1; # see dhcpd.nix

      ${cfg.extraConfig}
@ -108,22 +108,41 @@ in

  config = mkIf config.services.dhcpd.enable {

-    jobs.dhcpd =
+    users = {
+      extraUsers.dhcpd = {
+        uid = config.ids.uids.dhcpd;
+        description = "DHCP daemon user";
+      };
+    };
+
+    systemd.services.dhcpd =
      { description = "DHCP server";

-        startOn = "started network-interfaces";
-        stopOn = "stopping network-interfaces";
+        wantedBy = [ "multi-user.target" ];

-        script =
+        after = [ "network.target" ];
+
+        path = [ pkgs.dhcp ];
+
+        preStart =
          ''
            mkdir -m 755 -p ${stateDir}

            touch ${stateDir}/dhcpd.leases

-            exec ${pkgs.dhcp}/sbin/dhcpd -f -cf ${configFile} \
-                -lf ${stateDir}/dhcpd.leases \
-                ${toString cfg.interfaces}
+            mkdir -m 755 -p /run/dhcpd
+            chown dhcpd /run/dhcpd
          '';
+
+        serviceConfig =
+          { ExecStart = "@${pkgs.dhcp}/sbin/dhcpd dhcpd"
+              + " -pf /run/dhcpd/dhcpd.pid -cf ${configFile}"
+              + " -lf ${stateDir}/dhcpd.leases -user dhcpd -group nogroup"
+              + " ${toString cfg.interfaces}";
+            Restart = "always";
+            Type = "forking";
+            PIDFile = "/run/dhcpd/dhcpd.pid";
+          };
      };

  };
--- a/nixos/modules/services/networking/ssh/lshd.nix
+++ b/nixos/modules/services/networking/ssh/lshd.nix
@ -99,7 +99,6 @@ in
      };

      subsystems = mkOption {
-        default = [ ["sftp" "${pkgs.lsh}/sbin/sftp-server"] ];
        description = ''
          List of subsystem-path pairs, where the head of the pair
          denotes the subsystem name, and the tail denotes the path to
@ -116,6 +115,8 @@ in

  config = mkIf cfg.enable {

+    services.lshd.subsystems = [ ["sftp" "${pkgs.lsh}/sbin/sftp-server"] ];
+
    jobs.lshd =
      { description = "GNU lshd SSH2 daemon";

--- a/nixos/modules/services/networking/znc.nix
+++ b/nixos/modules/services/networking/znc.nix
@ -20,10 +20,15 @@ let
        </Pass>
  ";

+  modules = pkgs.buildEnv {
+    name = "znc-modules";
+    paths = cfg.modulePackages;
+  };
+
  confOptions = { ... }: {
    options = {
      modules = mkOption {
-        type = types.listOf types.str;
+        type = types.listOf types.string;
        default = [ "partyline" "webadmin" "adminlog" "log" ];
        example = [ "partyline" "webadmin" "adminlog" "log" ];
        description = ''
@ -31,10 +36,19 @@ let
        '';
      };

+      userModules = mkOption {
+        type = types.listOf types.string;
+        default = [ ];
+        example = [ "fish" "push" ];
+        description = ''
+          A list of user modules to include in the `znc.conf` file.
+        '';
+      };
+
      userName = mkOption {
        default = defaultUserName;
        example = "johntron";
-        type = types.str;
+        type = types.string;
        description = ''
          The user name to use when generating the `znc.conf` file.
          This is the user name used by the user logging into the ZNC web admin. 
@ -44,7 +58,7 @@ let
      nick = mkOption {
        default = "znc-user";
        example = "john";
-        type = types.str;
+        type = types.string;
        description = ''
          The IRC nick to use when generating the `znc.conf` file.
        '';
@ -53,7 +67,7 @@ let
      passBlock = mkOption {
        default = defaultPassBlock;
        example = "Must be the block generated by the `znc --makepass` command.";
-        type = types.str;
+        type = types.string;
        description = ''
          The pass block to use when generating the `znc.conf` file.
          This is the password used by the user logging into the ZNC web admin.
@ -80,6 +94,13 @@ let
        '';
      };

+      extraZncConf = mkOption {
+        default = "";
+        type = types.lines;
+        description = ''
+          Extra config to `znc.conf` file
+        '';
+      };
    };
  };

@ -128,9 +149,11 @@ let
            QuitMsg = Quit
            RealName = ${confOpts.nick}
            TimestampFormat = [%H:%M:%S]
+            ${concatMapStrings (n: "LoadModule = ${n}\n") confOpts.userModules}
            
            ${confOpts.passBlock}
    </User>
+    ${confOpts.extraZncConf}
  '';

  zncConfFile = pkgs.writeTextFile {
@ -160,7 +183,7 @@ in
      user = mkOption {
        default = "znc";
        example = "john";
-        type = types.str;
+        type = types.string;
        description = ''
          The name of an existing user account to use to own the ZNC server process.
          If not specified, a default user will be created to own the process.
@ -168,8 +191,8 @@ in
      };

      dataDir = mkOption {
-        default = "/home/${cfg.user}/.znc";
-        example = "/home/john/.znc";
+        default = "/var/lib/znc/";
+        example = "/home/john/.znc/";
        type = types.path;
        description = ''
          The data directory. Used for configuration files and modules.
@ -201,6 +224,15 @@ in
        '';
        options = confOptions; 
      };
+
+      modulePackages = mkOption {
+        type = types.listOf types.package;
+        default = [ ];
+        example = [ pkgs.zncModules.fish pkgs.zncModules.push ];
+        description = ''
+          A list of global znc module packages to add to znc.
+        '';
+      };
 
      mutable = mkOption {
        default = false;
@ -233,25 +265,22 @@ in

  config = mkIf cfg.enable {

-    systemd.services."znc-${cfg.user}" = {
-      description = "ZNC Server of ${cfg.user}.";
+    systemd.services.znc = {
+      description = "ZNC Server";
      wantedBy = [ "multi-user.target" ];
      after = [ "network.service" ];
-      path = [ pkgs.znc ];
      serviceConfig = {
-        User = "${cfg.user}";
+        User = cfg.user;
        Restart = "always";
        ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
        ExecStop   = "${pkgs.coreutils}/bin/kill -INT $MAINPID";
      };
      preStart = ''
-        ${pkgs.coreutils}/bin/mkdir -p ${cfg.dataDir}
-        ${pkgs.coreutils}/bin/chown ${cfg.user} ${cfg.dataDir} -R
        ${pkgs.coreutils}/bin/mkdir -p ${cfg.dataDir}/configs

        # If mutable, regenerate conf file every time.
        ${optionalString (!cfg.mutable) ''
-          ${pkgs.coreutils}/echo "znc-${cfg.user} is set to be system-managed. Now deleting old znc.conf file to be regenerated."
+          ${pkgs.coreutils}/echo "znc is set to be system-managed. Now deleting old znc.conf file to be regenerated."
          ${pkgs.coreutils}/rm -f ${cfg.dataDir}/configs/znc.conf
        ''}

@ -259,7 +288,7 @@ in
        if [[ ! -f ${cfg.dataDir}/configs/znc.conf ]]; then
          ${pkgs.coreutils}/bin/echo "No znc.conf file found in ${cfg.dataDir}. Creating one now."
          ${if (!cfg.mutable)
-            then "${pkgs.coreutils}/bin/ln --force -s ${zncConfFile} ${cfg.dataDir}/configs/znc.conf"
+            then "${pkgs.coreutils}/bin/ln --force -s ${zncConfFile} ${cfg.dataDir}/.znc/configs/znc.conf"
            else ''
              ${pkgs.coreutils}/bin/cp --no-clobber ${zncConfFile} ${cfg.dataDir}/configs/znc.conf
              ${pkgs.coreutils}/bin/chmod u+rw ${cfg.dataDir}/configs/znc.conf
@ -269,8 +298,12 @@ in

        if [[ ! -f ${cfg.dataDir}/znc.pem ]]; then
          ${pkgs.coreutils}/bin/echo "No znc.pem file found in ${cfg.dataDir}. Creating one now."
-          ${pkgs.znc}/bin/znc --makepem
+          ${pkgs.znc}/bin/znc --makepem --datadir ${cfg.dataDir} 
        fi
+
+        # Symlink modules
+        rm ${cfg.dataDir}/modules || true
+        ln -fs ${modules}/lib/znc ${cfg.dataDir}/modules
      '';
      script = "${pkgs.znc}/bin/znc --foreground --datadir ${cfg.dataDir} ${toString cfg.extraFlags}";
    };
@ -280,6 +313,7 @@ in
        description = "ZNC server daemon owner";
        group = defaultUser;
        uid = config.ids.uids.znc;
+        home = cfg.dataDir;
        createHome = true;
        createUser = true;
      };
--- a/nixos/modules/services/web-servers/lighttpd/default.nix
+++ b/nixos/modules/services/web-servers/lighttpd/default.nix
@ -9,9 +9,9 @@ let
  cfg = config.services.lighttpd;

  needModRedirect = cfg.gitweb.enable;
-  needModAlias = cfg.cgit.enable or cfg.gitweb.enable;
-  needModSetenv = cfg.cgit.enable or cfg.gitweb.enable;
-  needModCgi = cfg.cgit.enable or cfg.gitweb.enable;
+  needModAlias = cfg.cgit.enable || cfg.gitweb.enable;
+  needModSetenv = cfg.cgit.enable || cfg.gitweb.enable;
+  needModCgi = cfg.cgit.enable || cfg.gitweb.enable;
  needModStatus = cfg.mod_status;
  needModUserdir = cfg.mod_userdir;

--- a/nixos/modules/services/x11/desktop-managers/gnome3.nix
+++ b/nixos/modules/services/x11/desktop-managers/gnome3.nix
@ -35,6 +35,14 @@ in {
      description = "Enable Gnome 3 desktop manager.";
    };

+    services.xserver.desktopManager.gnome3.sessionPath = mkOption {
+      default = [];
+      example = "[ pkgs.gnome3.gpaste ]";
+      description = "Additional list of packages to be added to the session search path.
+                     Useful for gnome shell extensions or gsettings-conditionated autostart.";
+      apply = list: list ++ [ gnome3.gnome_shell ]; 
+    };
+
    environment.gnome3.packageSet = mkOption {
      default = pkgs.gnome3;
      example = literalExample "pkgs.gnome3_12";
@ -86,10 +94,19 @@ in {

          export XDG_MENU_PREFIX=gnome

-          # Don't let epiphany depend upon gnome-shell
-          # Don't let gnome-session depend upon vino (for .desktop autostart condition)
+          ${concatMapStrings (p: ''
+            if [ -d "${p}/share/gsettings-schemas/${p.name}" ]; then
+              export XDG_DATA_DIRS=$XDG_DATA_DIRS''${XDG_DATA_DIRS:+:}${p}/share/gsettings-schemas/${p.name}
+            fi
+
+            if [ -d "${p}/lib/girepository-1.0" ]; then
+              export GI_TYPELIB_PATH=$GI_TYPELIB_PATH''${GI_TYPELIB_PATH:+:}${p}/lib/girepository-1.0
+              export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}${p}/lib
+            fi
+          '') cfg.sessionPath}
+
          # Override default mimeapps
-          export XDG_DATA_DIRS=$XDG_DATA_DIRS''${XDG_DATA_DIRS:+:}${gnome3.gnome_shell}/share/gsettings-schemas/${gnome3.gnome_shell.name}:${gnome3.vino}/share/gsettings-schemas/${gnome3.vino.name}:${mimeAppsList}/share
+          export XDG_DATA_DIRS=$XDG_DATA_DIRS''${XDG_DATA_DIRS:+:}${mimeAppsList}/share

          # Let gnome-control-center find gnome-shell search providers
          export GNOME_SEARCH_PROVIDERS_DIR=${config.system.path}/share/gnome-shell/search-providers/
@ -123,7 +140,7 @@ in {
        gnome3.gnome_settings_daemon
        gnome3.gnome_shell
        gnome3.gnome_themes_standard
-      ] ++ (removePackagesByName [
+      ] ++ cfg.sessionPath ++ (removePackagesByName [
        gnome3.baobab
        gnome3.empathy
        gnome3.eog
--- a/nixos/modules/services/x11/display-managers/gdm.nix
+++ b/nixos/modules/services/x11/display-managers/gdm.nix
@ -0,0 +1,151 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+
+  cfg = config.services.xserver.displayManager;
+  gdm = pkgs.gnome3_12.gdm; # gdm 3.10 not supported
+  gnome3 = config.environment.gnome3.packageSet;
+
+in
+
+{
+
+  ###### interface
+
+  options = {
+
+    services.xserver.displayManager.gdm = {
+
+      enable = mkOption {
+        type = types.bool;
+        default = false;
+        example = true;
+        description = ''
+          Whether to enable GDM as the display manager.
+          <emphasis>GDM is very experimental and may render system unusable.</emphasis>
+        '';
+      };
+
+    };
+
+  };
+
+
+  ###### implementation
+
+  config = mkIf cfg.gdm.enable {
+
+    services.xserver.displayManager.slim.enable = false;
+
+    users.extraUsers.gdm =
+      { name = "gdm";
+        uid = config.ids.uids.gdm;
+        group = "gdm";
+        home = "/run/gdm";
+        description = "GDM user";
+      };
+
+    users.extraGroups.gdm.gid = config.ids.gids.gdm;
+
+    services.xserver.displayManager.job =
+      { 
+        environment = {
+          GDM_X_SERVER = "${cfg.xserverBin} ${cfg.xserverArgs}";
+          GDM_SESSIONS_DIR = "${cfg.session.desktops}";
+          XDG_CONFIG_DIRS = "${gnome3.gnome_settings_daemon}/etc/xdg";
+        };
+        execCmd = "exec ${gdm}/sbin/gdm";
+      };
+
+    # Because sd_login_monitor_new requires /run/systemd/machines
+    systemd.services.display-manager.wants = [ "systemd-machined.service" ];
+    systemd.services.display-manager.after = [ "systemd-machined.service" ];
+
+    systemd.services.display-manager.path = [ gnome3.gnome_shell gnome3.caribou ];
+
+    services.dbus.packages = [ gdm ];
+
+    programs.dconf.profiles.gdm = "${gdm}/share/dconf/profile/gdm";
+
+    # GDM LFS PAM modules, adapted somehow to NixOS
+    security.pam.services = {
+      gdm-launch-environment.text = ''
+        auth     required       pam_succeed_if.so audit quiet_success user = gdm
+        auth     optional       pam_permit.so
+
+        account  required       pam_succeed_if.so audit quiet_success user = gdm
+        account  sufficient     pam_unix.so
+
+        password required       pam_deny.so
+
+        session  required       pam_succeed_if.so audit quiet_success user = gdm
+        session  required       pam_env.so envfile=${config.system.build.pamEnvironment}
+        session  optional       ${pkgs.systemd}/lib/security/pam_systemd.so
+        session  optional       pam_keyinit.so force revoke
+        session  optional       pam_permit.so
+      '';
+
+     gdm.text = ''
+        auth     requisite      pam_nologin.so
+        auth     required       pam_env.so
+
+        auth     required       pam_succeed_if.so uid >= 1000 quiet
+        auth     optional       ${gnome3.gnome_keyring}/lib/security/pam_gnome_keyring.so
+        auth     sufficient     pam_unix.so nullok likeauth
+        auth     required       pam_deny.so
+
+        account  sufficient     pam_unix.so
+
+        password requisite      pam_unix.so nullok sha512
+
+        session  required       pam_env.so envfile=${config.system.build.pamEnvironment}
+        session  required       pam_unix.so
+        session  required       pam_loginuid.so
+        session  optional       ${pkgs.systemd}/lib/security/pam_systemd.so
+        session  optional       ${gnome3.gnome_keyring}/lib/security/pam_gnome_keyring.so auto_start
+      '';
+
+      gdm-password.text = ''
+        auth     requisite      pam_nologin.so
+        auth     required       pam_env.so envfile=${config.system.build.pamEnvironment}
+
+        auth     required       pam_succeed_if.so uid >= 1000 quiet
+        auth     optional       ${gnome3.gnome_keyring}/lib/security/pam_gnome_keyring.so
+        auth     sufficient     pam_unix.so nullok likeauth
+        auth     required       pam_deny.so 
+
+        account  sufficient     pam_unix.so
+        
+        password requisite      pam_unix.so nullok sha512
+
+        session  required       pam_env.so envfile=${config.system.build.pamEnvironment}
+        session  required       pam_unix.so
+        session  required       pam_loginuid.so
+        session  optional       ${pkgs.systemd}/lib/security/pam_systemd.so
+        session  optional       ${gnome3.gnome_keyring}/lib/security/pam_gnome_keyring.so auto_start
+      '';
+
+      gdm-autologin.text = ''
+        auth     requisite      pam_nologin.so
+
+        auth     required       pam_succeed_if.so uid >= 1000 quiet
+        auth     required       pam_permit.so
+
+        account  sufficient     pam_unix.so
+
+        password requisite      pam_unix.so nullok sha512
+
+        session  optional       pam_keyinit.so revoke
+        session  required       pam_env.so envfile=${config.system.build.pamEnvironment}
+        session  required       pam_unix.so
+        session  required       pam_loginuid.so
+        session  optional       ${pkgs.systemd}/lib/security/pam_systemd.so
+      '';
+
+    };
+
+  };
+
+}
--- a/nixos/modules/services/x11/window-managers/bspwm.nix
+++ b/nixos/modules/services/x11/window-managers/bspwm.nix
@ -0,0 +1,29 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.xserver.windowManager.bspwm;
+in
+
+{
+  options = {
+    services.xserver.windowManager.bspwm.enable = mkOption {
+      type = types.bool;
+      default = false;
+      example = true;
+      description = "Enable the bspwm window manager.";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    services.xserver.windowManager.session = singleton {
+      name = "bspwm";
+      start = "
+        ${pkgs.sxhkd}/bin/sxhkd &
+        ${pkgs.bspwm}/bin/bspwm
+      ";
+    };
+    environment.systemPackages = [ pkgs.bspwm ];
+  };
+}
--- a/nixos/modules/services/x11/window-managers/default.nix
+++ b/nixos/modules/services/x11/window-managers/default.nix
@ -17,6 +17,7 @@ in
      ./xmonad.nix
      ./i3.nix
      ./herbstluftwm.nix
+      ./bspwm.nix
    ];

  options = {
--- a/nixos/modules/system/activation/activation-script.nix
+++ b/nixos/modules/system/activation/activation-script.nix
@ -66,6 +66,9 @@ in
                PATH=$PATH:$i/bin:$i/sbin
            done

+            _status=0
+            trap "_status=1" ERR
+
            # Ensure a consistent umask.
            umask 0022

@ -84,6 +87,8 @@ in

            # Prevent the current configuration from being garbage-collected.
            ln -sfn /run/current-system /nix/var/nix/gcroots/current-system
+
+            exit $_status
          '';
      };

--- a/nixos/modules/system/boot/stage-2-init.sh
+++ b/nixos/modules/system/boot/stage-2-init.sh
@ -29,7 +29,9 @@ setPath "@path@"
 # Normally, stage 1 mounts the root filesystem read/writable.
 # However, in some environments, stage 2 is executed directly, and the
 # root is read-only.  So make it writable here.
-mount -n -o remount,rw none /
+if [ "$container" != systemd-nspawn ]; then
+    mount -n -o remount,rw none /
+fi


 # Likewise, stage 1 mounts /proc, /dev and /sys, so if we don't have a
--- a/nixos/modules/virtualisation/container-config.nix
+++ b/nixos/modules/virtualisation/container-config.nix
@ -89,6 +89,8 @@ with lib;
        restartIfChanged = false;
      };

+    systemd.services.systemd-remount-fs.enable = false;
+
  };

 }
--- a/nixos/modules/virtualisation/containers.nix
+++ b/nixos/modules/virtualisation/containers.nix
@ -168,6 +168,13 @@ in

        preStart =
          ''
+            # Clean up existing machined registration and interfaces.
+            machinectl terminate "$INSTANCE" 2> /dev/null || true
+
+            if [ "$PRIVATE_NETWORK" = 1 ]; then
+              ip link del dev "ve-$INSTANCE" 2> /dev/null || true
+            fi
+
            mkdir -p -m 0755 $root/var/lib

            # Create a named pipe to get a signal when the container
@ -203,6 +210,7 @@ in
              fi
            ''}

+            EXIT_ON_REBOOT=1 \
            exec ${config.systemd.package}/bin/systemd-nspawn \
              --keep-unit \
              -M "$INSTANCE" -D "$root" $extraFlags \
@ -220,12 +228,6 @@ in

        postStart =
          ''
-            # This blocks until the container-startup-done service
-            # writes something to this pipe.  FIXME: it also hangs
-            # until the start timeout expires if systemd-nspawn exits.
-            read x < $root/var/lib/startup-done
-            rm -f $root/var/lib/startup-done
-
            if [ "$PRIVATE_NETWORK" = 1 ]; then
              ifaceHost=ve-$INSTANCE
              ip link set dev $ifaceHost up
@ -236,27 +238,50 @@ in
                ip route add $LOCAL_ADDRESS dev $ifaceHost
              fi
            fi
+
+            # This blocks until the container-startup-done service
+            # writes something to this pipe.  FIXME: it also hangs
+            # until the start timeout expires if systemd-nspawn exits.
+            read x < $root/var/lib/startup-done
+            rm -f $root/var/lib/startup-done
          '';

        preStop =
          ''
-            machinectl poweroff "$INSTANCE"
+            machinectl poweroff "$INSTANCE" || true
          '';

        restartIfChanged = false;
        #reloadIfChanged = true; # FIXME

-        serviceConfig.ExecReload = pkgs.writeScript "reload-container"
-          ''
-            #! ${pkgs.stdenv.shell} -e
-            SYSTEM_PATH=/nix/var/nix/profiles/system
-            echo $SYSTEM_PATH/bin/switch-to-configuration test | \
-              ${pkgs.socat}/bin/socat unix:$root/var/lib/run-command.socket -
-          '';
+        serviceConfig = {
+          ExecReload = pkgs.writeScript "reload-container"
+            ''
+              #! ${pkgs.stdenv.shell} -e
+              SYSTEM_PATH=/nix/var/nix/profiles/system
+              echo $SYSTEM_PATH/bin/switch-to-configuration test | \
+                ${pkgs.socat}/bin/socat unix:$root/var/lib/run-command.socket -
+            '';

-        serviceConfig.SyslogIdentifier = "container %i";
+          SyslogIdentifier = "container %i";

-        serviceConfig.EnvironmentFile = "-/etc/containers/%i.conf";
+          EnvironmentFile = "-/etc/containers/%i.conf";
+
+          Type = "notify";
+
+          # Note that on reboot, systemd-nspawn returns 10, so this
+          # unit will be restarted. On poweroff, it returns 0, so the
+          # unit won't be restarted.
+          Restart = "on-failure";
+
+          # Hack: we don't want to kill systemd-nspawn, since we call
+          # "machinectl poweroff" in preStop to shut down the
+          # container cleanly. But systemd requires sending a signal
+          # (at least if we want remaining processes to be killed
+          # after the timeout). So send an ignored signal.
+          KillMode = "mixed";
+          KillSignal = "WINCH";
+        };
      };

    # Generate a configuration file in /etc/containers for each
--- a/nixos/modules/virtualisation/nixos-container.pl
+++ b/nixos/modules/virtualisation/nixos-container.pl
@ -152,6 +152,7 @@ if ($action eq "create") {

 my $root = "/var/lib/containers/$containerName";
 my $profileDir = "/nix/var/nix/profiles/per-container/$containerName";
+my $gcRootsDir = "/nix/var/nix/gcroots/per-container/$containerName";
 my $confFile = "/etc/containers/$containerName.conf";
 die "$0: container ‘$containerName’ does not exist\n" if !-e $confFile;

@ -172,6 +173,7 @@ if ($action eq "destroy") {
    stopContainer if isContainerRunning;

    rmtree($profileDir) if -e $profileDir;
+    rmtree($gcRootsDir) if -e $gcRootsDir;
    rmtree($root) if -e $root;
    unlink($confFile) or die;
 }
--- a/nixos/release.nix
+++ b/nixos/release.nix
@ -113,6 +113,7 @@ in rec {


  manual = forAllSystems (system: (builtins.getAttr system iso_minimal).config.system.build.manual.manual);
+  manualPDF = iso_minimal.x86_64-linux.config.system.build.manual.manualPDF;
  manpages = forAllSystems (system: (builtins.getAttr system iso_minimal).config.system.build.manual.manpages);


--- a/nixos/tests/common/user-account.nix
+++ b/nixos/tests/common/user-account.nix
@ -1,11 +1,9 @@
 { pkgs, ... }:

 { users.extraUsers = pkgs.lib.singleton
-    { name = "alice";
+    { isNormalUser = true;
+      name = "alice";
      description = "Alice Foobar";
-      home = "/home/alice";
-      createHome = true;
-      useDefaultShell = true;
      password = "foobar";
      uid = 1000;
    };
--- a/nixos/tests/ipv6.nix
+++ b/nixos/tests/ipv6.nix
@ -37,6 +37,7 @@ import ./make-test.nix {

      $client->waitForUnit("network.target");
      $server->waitForUnit("network.target");
+      $server->waitForUnit("httpd.service");

      # Wait until the given interface has a non-tentative address of
      # the desired scope (i.e. has completed Duplicate Address
--- a/pkgs/applications/audio/clementine/default.nix
+++ b/pkgs/applications/audio/clementine/default.nix
@ -6,11 +6,11 @@
 let withSpotify = config.clementine.spotify or false;
 in
 stdenv.mkDerivation {
-  name = "clementine-1.2.1";
+  name = "clementine-1.2.3";

  src = fetchurl {
-    url = http://clementine-player.googlecode.com/files/clementine-1.2.1.tar.gz;
-    sha256 = "0kk5cjmb8nirx0im3c0z91af2k72zxi6lwzm6rb57qihya5nwmfv";
+    url = https://github.com/clementine-player/Clementine/archive/1.2.3.tar.gz;
+    sha256 = "1gx1109i4pylz6x7gvp4rdzc6dvh0w6in6hfbygw01d08l26bxbx";
  };

  patches = [ ./clementine-1.2.1-include-paths.patch ];
@ -40,6 +40,8 @@ stdenv.mkDerivation {
    usbmuxd
  ] ++ stdenv.lib.optional withSpotify libspotify;

+  enableParallelBuilding = true;
+
  meta = with stdenv.lib; {
    homepage = "http://www.clementine-player.org";
    description = "A multiplatform music player";
@ -47,6 +49,6 @@ stdenv.mkDerivation {
    platforms = platforms.linux;
    maintainers = [ maintainers.ttuegel ];
    # libspotify is unfree
-    hydraPlatforms = optional (!withSpotify) platforms.linux;
+    hydraPlatforms = optionals (!withSpotify) platforms.linux;
  };
 }
--- a/pkgs/applications/audio/lastwatch/default.nix
+++ b/pkgs/applications/audio/lastwatch/default.nix
@ -23,5 +23,6 @@ pythonPackages.buildPythonPackage rec {
    homepage = "https://github.com/aszlig/LastWatch";
    description = "An inotify-based last.fm audio scrobbler";
    license = stdenv.lib.licenses.gpl2;
+    platforms = stdenv.lib.platforms.linux;
  };
 }
--- a/pkgs/applications/audio/mopidy-moped/default.nix
+++ b/pkgs/applications/audio/mopidy-moped/default.nix
@ -3,11 +3,11 @@
 pythonPackages.buildPythonPackage rec {
  name = "mopidy-moped-${version}";

-  version = "0.3.1";
+  version = "0.3.3";

  src = fetchurl {
    url = "https://github.com/martijnboland/moped/archive/v${version}.tar.gz";
-    sha256 = "0sjp8vr4yfyjx233gamhg0p67zjnlpc9yq3szbw897igsh23j2yr";
+    sha256 = "19f3asqx7wmla53nhrxzdwj6qlkjv2rcwh34jxp27bz7nkhn0ihv";
  };

  propagatedBuildInputs = [ mopidy ];
--- a/pkgs/applications/audio/mopidy/default.nix
+++ b/pkgs/applications/audio/mopidy/default.nix
@ -5,11 +5,11 @@
 pythonPackages.buildPythonPackage rec {
  name = "mopidy-${version}";

-  version = "0.19.0";
+  version = "0.19.3";

  src = fetchurl {
    url = "https://github.com/mopidy/mopidy/archive/v${version}.tar.gz";
-    sha256 = "10cnc1bipr0brk7478201cgm71lp5bci3qiaadyxv9hhcn0nmn9b";
+    sha256 = "0rjq69vqak1d6fhvih259wmwp50xgr6x0x5nd0hl6hlkbbysc8dp";
  };

  propagatedBuildInputs = with pythonPackages; [
--- a/pkgs/applications/editors/emacs-24/darwin-new-sections.patch
+++ b/pkgs/applications/editors/emacs-24/darwin-new-sections.patch
@ -0,0 +1,50 @@
+http://bazaar.launchpad.net/~naesten/emacs/nextstep-stuff/revision/108961
+
+diff -ru emacs-24.3-orig/src/unexmacosx.c emacs-24.3/src/unexmacosx.c
+--- emacs-24.3-orig/src/unexmacosx.c	2013-01-01 21:37:17.000000000 +0100
+++ emacs-24.3/src/unexmacosx.c	2014-08-09 18:39:52.000000000 +0200
+@@ -838,7 +838,7 @@
+ 	  if (!(sectp->addr <= (unsigned long)my_edata
+ 		&& my_size <= sectp->size))
+ 	    unexec_error ("my_edata is not in section %s", SECT_DATA);
+-	  if (!unexec_write (sectp->offset, (void *) sectp->addr, my_size))
+          if (!unexec_write (sectp->offset, (void *) sectp->addr, sectp->size))
+ 	    unexec_error ("cannot write section %s", SECT_DATA);
+ 	  if (!unexec_copy (sectp->offset + my_size, old_file_offset + my_size,
+ 			    sectp->size - my_size))
+@@ -880,6 +880,27 @@
+ 	  if (!unexec_write (header_offset, sectp, sizeof (struct section)))
+ 	    unexec_error ("cannot write section %.16s's header", sectp->sectname);
+ 	}
+      else if (strncmp (sectp->sectname, "__bss", 5) == 0
+	       || strncmp (sectp->sectname, "__pu_bss", 8) == 0)
+	{
+	  sectp->flags = S_REGULAR;
+	  
+	  /* These sections are produced by GCC 4.6+.
+
+	     FIXME: We possibly ought to clear uninitialized local
+	     variables in statically linked libraries like for
+	     SECT_BSS (__bss) above, but setting up the markers we
+	     need in lastfile.c would be rather messy.  See
+	     darwin_output_aligned_bss () in gcc/config/darwin.c for
+	     the root of the problem, keeping in mind that the
+	     sections are numbered by their alignment in GCC 4.6, but
+	     by log2(alignment) in GCC 4.7.  */
+
+	  if (!unexec_write (sectp->offset, (void *) sectp->addr, sectp->size))
+	    unexec_error ("cannot copy section %.16s", sectp->sectname);
+	  if (!unexec_write (header_offset, sectp, sizeof (struct section)))
+	    unexec_error ("cannot write section %.16s's header", sectp->sectname);
+	}
+       else if (strncmp (sectp->sectname, "__la_symbol_ptr", 16) == 0
+ 	       || strncmp (sectp->sectname, "__nl_symbol_ptr", 16) == 0
+ 	       || strncmp (sectp->sectname, "__got", 16) == 0
+@@ -891,6 +912,7 @@
+ 	       || strncmp (sectp->sectname, "__program_vars", 16) == 0
+ 	       || strncmp (sectp->sectname, "__mod_init_func", 16) == 0
+ 	       || strncmp (sectp->sectname, "__mod_term_func", 16) == 0
+	       || strncmp (sectp->sectname, "__static_data", 16) == 0
+ 	       || strncmp (sectp->sectname, "__objc_", 7) == 0)
+ 	{
+ 	  if (!unexec_copy (sectp->offset, old_file_offset, sectp->size))
--- a/pkgs/applications/editors/emacs-24/default.nix
+++ b/pkgs/applications/editors/emacs-24/default.nix
@ -1,6 +1,6 @@
 { stdenv, fetchurl, ncurses, x11, libXaw, libXpm, Xaw3d
 , pkgconfig, gtk, libXft, dbus, libpng, libjpeg, libungif
-, libtiff, librsvg, texinfo, gconf, libxml2, imagemagick, gnutls
+, libtiff, librsvg, texinfo, gconf, libxml2, imagemagick, openssl
 , alsaLib, cairo
 , withX ? !stdenv.isDarwin, withGTK ? true
 }:
@ -18,13 +18,15 @@ stdenv.mkDerivation rec {
    sha256 = "1385qzs3bsa52s5rcncbrkxlydkw0ajzrvfxgv8rws5fx512kakh";
  };

+  patches = [ ./darwin-new-sections.patch ];
+
  buildInputs =
-    [ ncurses gconf libxml2 gnutls alsaLib pkgconfig texinfo ]
+    [ ncurses gconf libxml2 openssl alsaLib pkgconfig texinfo ]
    ++ stdenv.lib.optional stdenv.isLinux dbus
    ++ stdenv.lib.optionals withX
      [ x11 libXaw Xaw3d libXpm libpng libjpeg libungif libtiff librsvg libXft
-        imagemagick gtk ]
-    ++ stdenv.lib.optional stdenv.isDarwin cairo;
+        imagemagick gtk gconf ]
+    ++ stdenv.lib.optional (stdenv.isDarwin && withX) cairo;

  configureFlags =
    ( if withX && withGTK then
--- a/pkgs/applications/editors/emacs-24/macport.nix
+++ b/pkgs/applications/editors/emacs-24/macport.nix
@ -17,6 +17,8 @@ stdenv.mkDerivation rec {
    sha256 = "194y341zrpjp75mc3099kjc0inr1d379wwsnav257bwsc967h8yx";
  };

+  patches = [ ./darwin-new-sections.patch ];
+
  buildInputs = [ ncurses pkgconfig texinfo libxml2 gnutls ];

  postUnpack = ''
@ -53,16 +55,13 @@ stdenv.mkDerivation rec {
  postInstall = ''
    cat >$out/share/emacs/site-lisp/site-start.el <<EOF
    ;; nixos specific load-path
-    (when (getenv "NIX_PROFILES")
-      (setq load-path
-            (append (reverse
-                     (mapcar (lambda (x) (concat x "/share/emacs/site-lisp/"))
+    (when (getenv "NIX_PROFILES") (setq load-path
+                          (append (reverse (mapcar (lambda (x) (concat x "/share/emacs/site-lisp/"))
                             (split-string (getenv "NIX_PROFILES"))))
                    load-path)))

    ;; make tramp work for NixOS machines
-    (eval-after-load 'tramp
-      '(add-to-list 'tramp-remote-path "/run/current-system/sw/bin"))
+    (eval-after-load 'tramp '(add-to-list 'tramp-remote-path "/run/current-system/sw/bin"))
    EOF
  '';

--- a/pkgs/applications/editors/idea/pycharm.nix
+++ b/pkgs/applications/editors/idea/pycharm.nix
@ -16,6 +16,7 @@ let
      desktopName = "PyCharm";
      genericName = "Powerful Python and Django IDE";
      categories = "Application;Development;";
+      icon = "pycharm";
    };

    buildInputs = [ makeWrapper patchelf p7zip ];
@ -39,8 +40,9 @@ let
    '';

    installPhase = ''
-      mkdir -vp "$out/bin" "$out/$name"
+      mkdir -vp "$out/bin" "$out/$name" "$out/share/pixmaps"
      cp -va . "$out/$name"
+      ln -s "$out/$name/bin/pycharm.png" "$out/share/pixmaps/"

      jdk="${jdk}/lib/openjdk"
      makeWrapper "$out/$name/bin/pycharm.sh" "$out/bin/pycharm" \
@ -52,12 +54,12 @@ let
      cp -a "${desktopItem}"/* "$out"
    '';

-    meta = {
+    meta = with stdenv.lib; {
      homepage = "https://www.jetbrains.com/pycharm/";
      inherit description;
      inherit license;
-      maintainers = [ stdenv.lib.maintainers.jgeerds ];
-      platforms = stdenv.lib.platforms.linux;
+      maintainers = [ maintainers.jgeerds ];
+      platforms = platforms.linux;
    };
  };

--- a/pkgs/applications/editors/nano/default.nix
+++ b/pkgs/applications/editors/nano/default.nix
@ -2,17 +2,19 @@

 stdenv.mkDerivation (rec {
  pname = "nano";
-  version = "2.3.2";
+  version = "2.3.6";

  name = "${pname}-${version}";

  src = fetchurl {
    url = "mirror://gnu/nano/${name}.tar.gz";
-    sha256 = "1s3b21h5p7r8xafw0gahswj16ai6k2vnjhmd15b491hl0x494c7z";
+    sha256 = "a74bf3f18b12c1c777ae737c0e463152439e381aba8720b4bc67449f36a09534";
  };

  buildInputs = [ ncurses gettext ];

+  configureFlags = "sysconfdir=/etc";
+
  meta = {
    homepage = http://www.nano-editor.org/;
    description = "A small, user-friendly console text editor";
--- a/pkgs/applications/editors/yi/yi-contrib.nix
+++ b/pkgs/applications/editors/yi/yi-contrib.nix
@ -4,8 +4,8 @@

 cabal.mkDerivation (self: {
  pname = "yi-contrib";
-  version = "0.8.1";
-  sha256 = "0jsbga30x302mr708vj5y7cpc961vh85dshpq2zlrf44dh0kmpvf";
+  version = "0.8.2";
+  sha256 = "17rbgrra1ghlywiraadf16n7igxp1k8jqqmb0iw8sc15y7825qqm";
  buildDepends = [
    filepath lens mtl split time transformersBase yi
  ];
@ -14,5 +14,6 @@ cabal.mkDerivation (self: {
    description = "Add-ons to Yi, the Haskell-Scriptable Editor";
    license = "GPL";
    platforms = self.ghc.meta.platforms;
+    maintainers = with self.stdenv.lib.maintainers; [ fuuzetsu ];
  };
 })
--- a/pkgs/applications/editors/yi/yi.nix
+++ b/pkgs/applications/editors/yi/yi.nix
@ -15,8 +15,8 @@

 cabal.mkDerivation (self: {
  pname = "yi";
-  version = "0.8.1";
-  sha256 = "1hyqlydc0na9pkb3fkbp13c6vnp4f80z8237bvrv12wkk5syyn23";
+  version = "0.8.2";
+  sha256 = "18rnyswsdzkh0jdcqfg8pr90mpm6xf11siv598svqkxg12d2qql9";
  isLibrary = true;
  isExecutable = true;
  buildDepends = [
--- a/pkgs/applications/graphics/hoodle/default.nix
+++ b/pkgs/applications/graphics/hoodle/default.nix
@ -16,6 +16,6 @@ cabal.mkDerivation (self: {
    description = "Executable for hoodle";
    license = self.stdenv.lib.licenses.gpl3;
    platforms = self.ghc.meta.platforms;
-    maintainers = [ self.stdenv.lib.maintainers.ianwookim ];
+    maintainers = with self.stdenv.lib.maintainers; [ ianwookim ];
  };
 })
--- a/pkgs/applications/graphics/hugin/default.nix
+++ b/pkgs/applications/graphics/hugin/default.nix
@ -1,25 +1,37 @@
-{stdenv, fetchurl, panotools, cmake, wxGTK, libtiff, libpng, openexr, boost
-, pkgconfig, exiv2, gettext, ilmbase, enblendenfuse, autopanosiftc, mesa
-, freeglut, glew, libXmu, libXi, tclap }:
+{ stdenv, cmake, fetchurl, gnumake, pkgconfig
+, boost, gettext, tclap, wxGTK
+, freeglut, glew, libXi, libXmu, mesa
+, autopanosiftc, enblendenfuse, exiv2, ilmbase, lensfun, libpng, libtiff
+, openexr, panotools, perlPackages
+}:

 stdenv.mkDerivation rec {
-  name = "hugin-2011.4.0";
+  name = "hugin-2013.0.0";

  src = fetchurl {
    url = "mirror://sourceforge/hugin/${name}.tar.bz2";
-    sha256 = "1bnxljgqxzfdz14l7y29wzi52x1a38mghsjavnr28fr4vfmqwjrf";
+    sha256 = "1mgbvg09xvf0zcm9jfv5lb65nd292l86ffa23yp4pzm6izaiwkj8";
  };

  NIX_CFLAGS_COMPILE = "-I${ilmbase}/include/OpenEXR";

-#NIX_LDFLAGS = "-lrt";
+  buildInputs = [ boost gettext tclap wxGTK
+                  freeglut glew libXi libXmu mesa
+                  exiv2 ilmbase lensfun libtiff libpng openexr panotools
+                ];

-  buildInputs = [ panotools wxGTK libtiff libpng openexr boost tclap
-    exiv2 gettext ilmbase mesa freeglut glew libXmu libXi ];
+  # disable installation of the python scripting interface
+  cmakeFlags = [ "-DBUILD_HSI:BOOl=OFF" ];

  nativeBuildInputs = [ cmake pkgconfig ];

-  propagatedUserEnvPackages = [ enblendenfuse autopanosiftc ];
+  enableParallelBuilding = true;
+
+  # commandline tools needed by the hugin batch processor
+  # you may have to tell hugin (in the preferences) where these binaries reside
+  propagatedUserEnvPackages = [ autopanosiftc enblendenfuse gnumake
+                                perlPackages.ImageExifTool
+                              ];

  postInstall = ''
    mkdir -p "$out/nix-support"
@ -32,6 +44,5 @@ stdenv.mkDerivation rec {
    license = stdenv.lib.licenses.gpl2Plus;
    maintainers = with stdenv.lib.maintainers; [viric];
    platforms = with stdenv.lib.platforms; linux;
-    broken = true;
  };
 }
--- a/pkgs/applications/graphics/inkscape/default.nix
+++ b/pkgs/applications/graphics/inkscape/default.nix
@ -39,7 +39,8 @@ stdenv.mkDerivation rec {
    for i in "$out/bin/"*
    do
      wrapProgram "$i" --prefix PYTHONPATH :      \
-       "$(toPythonPath ${pyxml}):$(toPythonPath ${lxml})" ||  \
+       "$(toPythonPath ${pyxml}):$(toPythonPath ${lxml})"  \
+       --prefix PATH : ${python}/bin ||  \
        exit 2
    done
    rm $out/share/icons/hicolor/icon-theme.cache
--- a/pkgs/applications/graphics/kipi-plugins/default.nix
+++ b/pkgs/applications/graphics/kipi-plugins/default.nix
@ -25,5 +25,6 @@ stdenv.mkDerivation rec {
    homepage = http://www.kipi-plugins.org;
    inherit (kdelibs.meta) platforms;
    maintainers = with stdenv.lib.maintainers; [ viric urkud ];
+    broken = true; # it should be build from digikam sources, perhaps together
  };
 }
--- a/pkgs/applications/graphics/luminance-hdr/default.nix
+++ b/pkgs/applications/graphics/luminance-hdr/default.nix
@ -0,0 +1,26 @@
+{ stdenv, cmake, fetchurl, pkgconfig, qt5, boost, exiv2, fftwFloat, gsl
+, ilmbase, lcms2, libraw, libtiff, openexr
+}:
+
+stdenv.mkDerivation rec {
+  name = "luminance-hdr-2.4.0";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/qtpfsgui/${name}.tar.bz2";
+    sha256 = "00fldbcizrx8jcnjgq74n3zmbm27dxzl96fxa7q49689mfnlw08l";
+  };
+
+  NIX_CFLAGS_COMPILE = "-I${ilmbase}/include/OpenEXR";
+
+  buildInputs = [ qt5 boost exiv2 fftwFloat gsl ilmbase lcms2 libraw libtiff openexr ];
+
+  nativeBuildInputs = [ cmake pkgconfig ];
+
+  meta = with stdenv.lib; {
+    homepage = http://qtpfsgui.sourceforge.net/;
+    description = "A complete open source solution for HDR photography";
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.hrdinka ];
+  };
+}
--- a/pkgs/applications/graphics/openimageio/default.nix
+++ b/pkgs/applications/graphics/openimageio/default.nix
@ -4,26 +4,26 @@

 stdenv.mkDerivation rec {
  name = "oiio-${version}";
-  version = "1.3.12";
+  version = "1.4";

  src = fetchurl {
-    url = "https://github.com/OpenImageIO/oiio/archive/Release-${version}.zip";
-    sha256 = "114jx4pcqhzdchzpxbwrfzqmnxr2bm8cw13g4akz1hg8pvr1dhsb";
+    url = "https://github.com/OpenImageIO/oiio/archive/RB-${version}.zip";
+    sha256 = "0ldj3hwpz363l1zyzf6c62wc5d2cpbiszlpjvv5w6rrsx2ddbbn1";
  };

  buildInputs = [
    boost cmake ilmbase libjpeg libpng libtiff opencolorio openexr unzip
  ];

-  configurePhase = "";
+  cmakeFlags = [
+    "-DUSE_PYTHON=OFF"
+  ];

  buildPhase = ''
    make ILMBASE_HOME=${ilmbase} OPENEXR_HOME=${openexr} USE_PYTHON=0 \
      INSTALLDIR=$out dist_dir=
  '';

-  installPhase = ":";
-
  meta = with stdenv.lib; {
    homepage = http://www.openimageio.org;
    description = "A library and tools for reading and writing images";
--- a/pkgs/applications/misc/bitcoin/default.nix
+++ b/pkgs/applications/misc/bitcoin/default.nix
@ -2,12 +2,12 @@
 , pkgconfig, protobuf, qrencode }:

 stdenv.mkDerivation rec {
-  version = "0.9.1";
+  version = "0.9.2.1";
  name = "bitcoin-${version}";

  src = fetchurl {
    url = "https://bitcoin.org/bin/${version}/${name}-linux.tar.gz";
-    sha256 = "3fabc1c629007b465a278525883663d41a2ba62699f2773536a8bf59ca210425";
+    sha256 = "0060f7d38b98113ab912d4c184000291d7f026eaf77ca5830deec15059678f54";
  };

  # hexdump from utillinux is required for tests
--- a/pkgs/applications/misc/blender/default.nix
+++ b/pkgs/applications/misc/blender/default.nix
@ -29,13 +29,6 @@ stdenv.mkDerivation rec {
      substituteInPlace */doc/manpage/blender.1.py --replace /usr/bin/python ${python}/bin/python3
    '';

-  patches = [(fetchpatch { # fix parallel builds
-    url = "https://developer.blender.org/D619?download=true";
-    sha256 = "18h4fqsbpwxzqz7qby18lrrbzqnyd5xnann3xcac5wddwv5wjb0f";
-    name = "D619.diff";
-  })];
-  patchFlags = "-p0";
-
  cmakeFlags =
    [ "-DOPENEXR_INC=${openexr}/include/OpenEXR"
      "-DWITH_OPENCOLLADA=OFF"
--- a/pkgs/applications/misc/dunst/default.nix
+++ b/pkgs/applications/misc/dunst/default.nix
@ -1,18 +1,15 @@
-{ stdenv, fetchgit, coreutils , unzip, which, pkgconfig , dbus
+{ stdenv, fetchurl, coreutils , unzip, which, pkgconfig , dbus
 , freetype, xdg_utils , libXext, glib, pango , cairo, libX11, libnotify
 , libxdg_basedir , libXScrnSaver, xproto, libXinerama , perl, gdk_pixbuf
 }:

 stdenv.mkDerivation rec {
-  rev = "6a3a855b48a3db64821d1cf8a91c5ee2815a2b2d";
-  name = "dunst-0-${stdenv.lib.strings.substring 0 7 rev}";
+  name = "dunst-1.1.0";
+  version = "1.1.0";

-  # 1.0.0 release doesn't include 100% CPU fix
-  # https://github.com/knopwob/dunst/issues/98
-  src = fetchgit {
-    inherit rev;
-    url = "https://github.com/knopwob/dunst.git";
-    sha256 = "0m7yki16d72xm9n2m2fjszd8phqpn5b95q894cz75pmd0sv1j6bj";
+  src = fetchurl {
+    url = "https://github.com/knopwob/dunst/archive/v${version}.tar.gz";
+    sha256 = "0x95f57s0a96c4lifxdpf73v706iggwmdw8742mabbjnxq55l1qs";
  };

  patchPhase = ''
@ -26,7 +23,7 @@ stdenv.mkDerivation rec {
    libXScrnSaver xproto libXinerama perl];

  buildPhase = ''
-    export VERSION=${rev};
+    export VERSION=${version};
    export PREFIX=$out;
    make dunst;
  '';
--- a/pkgs/applications/misc/lyx/default.nix
+++ b/pkgs/applications/misc/lyx/default.nix
@ -1,14 +1,14 @@
-{ fetchurl, stdenv, texLive, python, makeWrapper, pkgconfig
-, libX11, qt4, enchant #, mythes, boost
+{ fetchurl, stdenv, pkgconfig, python, file, bc
+, qt4, hunspell, makeWrapper #, mythes, boost
 }:

 stdenv.mkDerivation rec {
-  version = "2.0.7";
+  version = "2.1.1";
  name = "lyx-${version}";

  src = fetchurl {
-    url = "ftp://ftp.lyx.org/pub/lyx/stable/2.0.x/${name}.tar.xz";
-    sha256 = "0qp8xqmlafib4hispjgl1friln0w3s05mi20sjfzaxnl6jkvv5q5";
+    url = "ftp://ftp.lyx.org/pub/lyx/stable/2.1.x/${name}.tar.xz";
+    sha256 = "1fir1dzzy7c92jf3a3psnd10c6widslk0852xk4svpl6phcg4nya";
  };

  configureFlags = [
@ -18,18 +18,29 @@ stdenv.mkDerivation rec {
    #"--without-included-mythes" # such a small library isn't worth a separate package
  ];

+  # LaTeX is used from $PATH, as people often want to have it with extra pkgs
  buildInputs = [
-    texLive qt4 python makeWrapper pkgconfig
-    enchant # mythes boost
+    pkgconfig qt4 python file/*for libmagic*/ bc
+    hunspell makeWrapper # enchant
  ];

+  enableParallelBuilding = true;
  doCheck = true;

-  meta = {
+  # python is run during runtime to do various tasks
+  postFixup = ''
+    sed '1s:/usr/bin/python:${python}/bin/python:'
+
+    wrapProgram "$out/bin/lyx" \
+      --prefix PATH : '${python}/bin'
+  '';
+
+  meta = with stdenv.lib; {
    description = "WYSIWYM frontend for LaTeX, DocBook";
    homepage = "http://www.lyx.org";
-    license = stdenv.lib.licenses.gpl2;
-    maintainers = [ stdenv.lib.maintainers.vcunat ];
-    platforms = stdenv.lib.platforms.linux;
+    license = licenses.gpl2Plus;
+    maintainers = [ maintainers.vcunat ];
+    platforms = platforms.linux;
  };
 }
+
--- a/pkgs/applications/misc/xfontsel/default.nix
+++ b/pkgs/applications/misc/xfontsel/default.nix
@ -28,8 +28,8 @@ stdenv.mkDerivation rec {
  meta = {
    homepage = http://www.x.org/;
    description = "Allows testing the fonts available in an X server";
-    licesnse = "free";
+    license = "free";
    maintainers = with stdenv.lib.maintainers; [viric];
-    platforms = with stdenv.lib.platforms; linux;
+    platforms = with stdenv.lib.platforms; linux ++ darwin;
  };
 }
--- a/pkgs/applications/misc/xlsfonts/default.nix
+++ b/pkgs/applications/misc/xlsfonts/default.nix
@ -16,8 +16,8 @@ stdenv.mkDerivation rec {
  meta = {
    homepage = http://www.x.org/;
    description = "Lists the fonts available in the X server";
-    licesnse = "free";
+    license = "free";
    maintainers = with stdenv.lib.maintainers; [viric];
-    platforms = with stdenv.lib.platforms; linux;
+    platforms = with stdenv.lib.platforms; linux ++ darwin;
  };
 }
--- a/pkgs/applications/misc/xmobar/default.nix
+++ b/pkgs/applications/misc/xmobar/default.nix
@ -23,7 +23,6 @@ cabal.mkDerivation (self: {
    homepage = "http://xmobar.org";
    description = "A Minimalistic Text Based Status Bar";
    license = self.stdenv.lib.licenses.bsd3;
-    platforms = self.ghc.meta.platforms;
-    maintainers = [ self.stdenv.lib.maintainers.andres ];
+    platforms = self.stdenv.lib.platforms.linux;
  };
 })
--- a/pkgs/applications/misc/xterm/default.nix
+++ b/pkgs/applications/misc/xterm/default.nix
@ -36,6 +36,6 @@ stdenv.mkDerivation rec {
    homepage = http://invisible-island.net/xterm;
    license = "BSD";
    maintainers = with stdenv.lib.maintainers; [viric];
-    platforms = with stdenv.lib.platforms; linux;
+    platforms = with stdenv.lib.platforms; linux ++ darwin;
  };
 }
--- a/pkgs/applications/networking/browsers/dwb/default.nix
+++ b/pkgs/applications/networking/browsers/dwb/default.nix
@ -23,11 +23,11 @@ stdenv.mkDerivation {
     --prefix GIO_EXTRA_MODULES : "${glib_networking}/lib/gio/modules"
  '';

-  meta = {
+  meta = with stdenv.lib; {
    homepage = http://portix.bitbucket.org/dwb/;
    description = "A lightweight web browser based on the webkit web browser engine and the gtk toolkit";
-    platforms = stdenv.lib.platforms.mesaPlatforms;
-    maintainers = [ stdenv.lib.maintainers.pSub ];
-    license = "GPL";
+    platforms = platforms.mesaPlatforms;
+    maintainers = with maintainers;[ pSub ];
+    license = licenses.gpl3;
  };
 }
--- a/pkgs/applications/networking/browsers/firefox/30.nix
+++ b/pkgs/applications/networking/browsers/firefox/30.nix
@ -0,0 +1,211 @@
+{ stdenv, fetchurl, pkgconfig, gtk, pango, perl, python, zip, libIDL
+, libjpeg, libpng, zlib, dbus, dbus_glib, bzip2, xlibs
+, freetype, fontconfig, file, alsaLib, nspr, nss, libnotify
+, yasm, mesa, sqlite, unzip, makeWrapper, pysqlite
+, hunspell, libevent, libstartup_notification, libvpx
+, cairo, gstreamer, gst_plugins_base, icu
+, debugBuild ? false
+, # If you want the resulting program to call itself "Firefox" instead
+  # of "Shiretoko" or whatever, enable this option.  However, those
+  # binaries may not be distributed without permission from the
+  # Mozilla Foundation, see
+  # http://www.mozilla.org/foundation/trademarks/.
+  enableOfficialBranding ? false
+}:
+
+assert stdenv.gcc ? libc && stdenv.gcc.libc != null;
+
+rec {
+
+  firefoxVersion = "30.0";
+
+  xulVersion = "30.0"; # this attribute is used by other packages
+
+
+  src = fetchurl {
+    url = "http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/${firefoxVersion}/source/firefox-${firefoxVersion}.source.tar.bz2";
+    sha1 = "bll9hxf31gvg9db6gxgmq25qsjif3p11";
+  };
+
+  commonConfigureFlags =
+    [ "--with-system-jpeg"
+      "--with-system-zlib"
+      "--with-system-bz2"
+      "--with-system-nspr"
+      "--with-system-nss"
+      "--with-system-libevent"
+      "--with-system-libvpx"
+      "--with-system-png"
+      # "--with-system-icu" # causes ‘ar: invalid option -- 'L'’ in Firefox 28.0
+      "--enable-system-ffi"
+      "--enable-system-hunspell"
+      "--enable-system-pixman"
+      "--enable-system-sqlite"
+      "--enable-system-cairo"
+      "--enable-gstreamer"
+      "--enable-startup-notification"
+      # "--enable-content-sandbox"            # available since 26.0, but not much info available
+      # "--enable-content-sandbox-reporter"   # keeping disabled for now
+      "--disable-crashreporter"
+      "--disable-tests"
+      "--disable-necko-wifi" # maybe we want to enable this at some point
+      "--disable-installer"
+      "--disable-updater"
+      "--disable-pulseaudio"
+    ] ++ (if debugBuild then [ "--enable-debug" "--enable-profiling"]
+                        else [ "--disable-debug" "--enable-release"
+                               "--enable-optimize" "--enable-strip" ]);
+
+
+  xulrunner = stdenv.mkDerivation rec {
+    name = "xulrunner-${xulVersion}";
+
+    inherit src;
+
+    buildInputs =
+      [ pkgconfig libpng gtk perl zip libIDL libjpeg zlib bzip2
+        python dbus dbus_glib pango freetype fontconfig xlibs.libXi
+        xlibs.libX11 xlibs.libXrender xlibs.libXft xlibs.libXt file
+        alsaLib nspr nss libnotify xlibs.pixman yasm mesa
+        xlibs.libXScrnSaver xlibs.scrnsaverproto pysqlite
+        xlibs.libXext xlibs.xextproto sqlite unzip makeWrapper
+        hunspell libevent libstartup_notification libvpx cairo
+        gstreamer gst_plugins_base icu
+      ];
+
+    configureFlags =
+      [ "--enable-application=xulrunner"
+        "--disable-javaxpcom"
+      ] ++ commonConfigureFlags;
+
+    #enableParallelBuilding = true; # cf. https://github.com/NixOS/nixpkgs/pull/1699#issuecomment-35196282
+
+    preConfigure =
+      ''
+        export NIX_LDFLAGS="$NIX_LDFLAGS -L$out/lib/xulrunner-${xulVersion}"
+
+        mkdir ../objdir
+        cd ../objdir
+        configureScript=../mozilla-release/configure
+      ''; # */
+
+    #installFlags = "SKIP_GRE_REGISTRATION=1";
+
+    preInstall = ''
+      # The following is needed for startup cache creation on grsecurity kernels
+      paxmark m ../objdir/dist/bin/xpcshell
+    '';
+
+    postInstall = ''
+      # Fix run-mozilla.sh search
+      libDir=$(cd $out/lib && ls -d xulrunner-[0-9]*)
+      echo libDir: $libDir
+      test -n "$libDir"
+      cd $out/bin
+      rm xulrunner
+
+      for i in $out/lib/$libDir/*; do
+          file $i;
+          if file $i | grep executable &>/dev/null; then
+              echo -e '#! /bin/sh\nexec "'"$i"'" "$@"' > "$out/bin/$(basename "$i")";
+              chmod a+x "$out/bin/$(basename "$i")";
+          fi;
+      done
+      for i in $out/lib/$libDir/*.so; do
+          patchelf --set-rpath "$(patchelf --print-rpath "$i"):$out/lib/$libDir" $i || true
+      done
+
+      # For grsecurity kernels
+      paxmark m $out/lib/$libDir/{plugin-container,xulrunner}
+
+      for i in $out/lib/$libDir/{plugin-container,xulrunner,xulrunner-stub}; do
+          wrapProgram $i --prefix LD_LIBRARY_PATH ':' "$out/lib/$libDir"
+      done
+
+      rm -f $out/bin/run-mozilla.sh
+    ''; # */
+
+    meta = {
+      description = "Mozilla Firefox XUL runner";
+      homepage = http://www.mozilla.com/en-US/firefox/;
+    };
+
+    passthru = { inherit gtk; version = xulVersion; };
+  };
+
+
+  firefox = stdenv.mkDerivation rec {
+    name = "firefox-${firefoxVersion}";
+
+    inherit src;
+
+    enableParallelBuilding = true;
+
+    buildInputs =
+      [ pkgconfig libpng gtk perl zip libIDL libjpeg zlib bzip2 python
+        dbus dbus_glib pango freetype fontconfig alsaLib nspr nss libnotify
+        xlibs.pixman yasm mesa sqlite file unzip pysqlite
+        hunspell libevent libstartup_notification libvpx cairo
+        gstreamer gst_plugins_base icu
+      ];
+
+    patches = [
+      ./disable-reporter.patch # fixes "search box not working when built on xulrunner"
+      ./xpidl.patch
+    ];
+
+    propagatedBuildInputs = [xulrunner];
+
+    configureFlags =
+      [ "--enable-application=browser"
+        "--with-libxul-sdk=${xulrunner}/lib/xulrunner-devel-${xulrunner.version}"
+        "--enable-chrome-format=jar"
+      ]
+      ++ commonConfigureFlags
+      ++ stdenv.lib.optional enableOfficialBranding "--enable-official-branding";
+
+    makeFlags = [
+      "SYSTEM_LIBXUL=1"
+    ];
+
+    # Because preConfigure runs configure from a subdirectory.
+    configureScript = "../configure";
+
+    preConfigure =
+      ''
+        # Hack to work around make's idea of -lbz2 dependency
+        find . -name Makefile.in -execdir sed -i '{}' -e '1ivpath %.so ${
+          stdenv.lib.concatStringsSep ":"
+            (map (s : s + "/lib") (buildInputs ++ [stdenv.gcc.libc]))
+        }' ';'
+
+        # Building directly in the main source directory is not allowed.
+        mkdir obj_dir
+        cd obj_dir
+      '';
+
+    postInstall =
+      ''
+        ln -s ${xulrunner}/lib/xulrunner-${xulrunner.version} $(echo $out/lib/firefox-*)/xulrunner
+        cd "$out/lib/"firefox-*
+        rm firefox
+        echo -e '#!${stdenv.shell}\nexec ${xulrunner}/bin/xulrunner "'"$PWD"'/application.ini" "$@"' > firefox
+        chmod a+x firefox
+
+        # Put chrome.manifest etc. in the right place.
+        mv browser/* .
+        rmdir browser
+      ''; # */
+
+    meta = {
+      description = "Mozilla Firefox - the browser, reloaded";
+      homepage = http://www.mozilla.com/en-US/firefox/;
+      maintainers = with stdenv.lib.maintainers; [ eelco wizeman ];
+    };
+
+    passthru = {
+      inherit gtk xulrunner nspr;
+      isFirefox3Like = true;
+    };
+  };
+}
--- a/pkgs/applications/networking/browsers/vimb/default.nix
+++ b/pkgs/applications/networking/browsers/vimb/default.nix
@ -4,11 +4,11 @@

 stdenv.mkDerivation rec {
  name = "vimb-${version}";
-  version = "2.4";
+  version = "2.6";

  src = fetchurl {
    url = "https://github.com/fanglingsu/vimb/archive/${version}.tar.gz";
-    sha256 = "167ilbsd4y4zl493k6g4j5v85y784qz8z7qflzd1ccsjjznv7fm8";
+    sha256 = "1g6zm5fk3k52jk3vbbzj7rm0kanykd4zgxrqhlvj3qzj2nsn4a21";
  };

  # Nixos default ca bundle
--- a/pkgs/applications/networking/dropbox/default.nix
+++ b/pkgs/applications/networking/dropbox/default.nix
@ -25,9 +25,9 @@ let
    else if stdenv.system == "i686-linux" then "ld-linux.so.2"
    else throw "Dropbox client for: ${stdenv.system} not supported!";

-  version = "2.6.2";
-  sha256 = if stdenv.system == "x86_64-linux" then "0j511nglqg2xngyl78ww7xk09v8yzhghk5cnj6slr9sldy83n7g9"
-    else if stdenv.system == "i686-linux" then "0n0y0wf313yjas4b89ag613jb80skby1qmfkyy1aazgjancf7v5i"
+  version = "2.10.27";
+  sha256 = if stdenv.system == "x86_64-linux" then "0l5fkmcr5jc0sm9xm4gshhdn3a7c9ff8qf60vjbiz3gn3n7asjvv"
+    else if stdenv.system == "i686-linux" then "0gn1lx97z4wr1clyjd3y8r6bvwni47rc84zl20s3lsalmm25srh7"
    else throw "Dropbox client for: ${stdenv.system} not supported!";

  # relative location where the dropbox libraries are stored
@ -56,10 +56,9 @@ in stdenv.mkDerivation {
  name = "dropbox-${version}-bin";
  src = fetchurl {
    name = "dropbox-${version}.tar.gz";
-    # using version-specific URL so if the version is no longer available,
-    # build will fail without having to finish downloading first
-    # url = "http://www.dropbox.com/download?plat=lnx.${arch}";
-    url = "http://dl-web.dropbox.com/u/17/dropbox-lnx.${arch}-${version}.tar.gz";
+    
+    # I found the URLs here: https://forums.dropbox.com/topic.php?id=118678
+    url = "https://d1ilhw0800yew8.cloudfront.net/client/dropbox-lnx.${arch}-${version}.tar.gz";
    inherit sha256;
  };

@ -71,13 +70,13 @@ in stdenv.mkDerivation {

  installPhase = ''
    mkdir -p "$out/${appdir}"
-    cp -r ".dropbox-dist/"* "$out/${appdir}/"
+    cp -r ".dropbox-dist/dropbox-lnx.${arch}-${version}"/* "$out/${appdir}/"
    mkdir -p "$out/bin"
    ln -s "$out/${appdir}/dropbox" "$out/bin/dropbox"

    patchelf --set-interpreter ${stdenv.glibc}/lib/${interpreter} \
      "$out/${appdir}/dropbox"
-
+    
    RPATH=${ldpath}:${gcc.gcc}/lib:$out/${appdir}
    echo "updating rpaths to: $RPATH"
    find "$out/${appdir}" -type f -a -perm +0100 \
@ -87,8 +86,6 @@ in stdenv.mkDerivation {
    cp "${desktopItem}/share/applications/"* $out/share/applications
  '';

-  buildInputs = [ patchelf ];
-
  meta = {
    homepage = "http://www.dropbox.com";
    description = "Online stored folders (daemon version)";
--- a/pkgs/applications/networking/instant-messengers/ekiga/default.nix
+++ b/pkgs/applications/networking/instant-messengers/ekiga/default.nix
@ -2,7 +2,7 @@
 , perl, perlXMLParser, evolution_data_server, gnome_doc_utils, avahi, autoreconfHook
 , libsigcxx, gtk, dbus_glib, libnotify, libXext, xextproto, gnome3, boost, libsecret
 , pkgconfig, libxml2, videoproto, unixODBC, db, nspr, nss, zlib, hicolor_icon_theme
-, libXrandr, randrproto, which, libxslt, libtasn1, gmp, nettle, sqlite }:
+, libXrandr, randrproto, which, libxslt, libtasn1, gmp, nettle, sqlite, makeWrapper }:

 stdenv.mkDerivation rec {
  name = "ekiga-4.0.1";
@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
                  gnome3.libsoup
                  hicolor_icon_theme gnome3.gnome_icon_theme boost autoreconfHook
                  pkgconfig libxml2 videoproto unixODBC db nspr nss zlib libsecret
-                  libXrandr randrproto which libxslt libtasn1 gmp nettle ];
+                  libXrandr randrproto which libxslt libtasn1 gmp nettle makeWrapper ];

  preAutoreconf = ''
    substituteInPlace configure.ac --replace AM_GCONF_SOURCE_2 ""
@ -35,6 +35,11 @@ stdenv.mkDerivation rec {

  patches = [ ./autofoo.patch ./boost.patch ];

+  postInstall = ''
+    wrapProgram "$out"/bin/ekiga \
+      --prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH"
+  '';
+
  meta = with stdenv.lib; {
    description = "Ekiga SIP client";
    maintainers = [ maintainers.raskin ];
--- a/pkgs/applications/networking/instant-messengers/kadu/default.nix
+++ b/pkgs/applications/networking/instant-messengers/kadu/default.nix
@ -15,6 +15,10 @@ stdenv.mkDerivation {

  configureFlags = "CPPFLAGS=-DQT_NO_DEBUG";

+  preConfigure = ''
+    export PKG_CONFIG_PATH="$PKG_CONFIG_PATH:${phonon}/lib64/pkgconfig:${phonon}/lib32/pkgconfig"
+  '';
+
  cmakeFlags = "-DENABLE_AUTODOWNLOAD=OFF -DBUILD_DESCRIPTION='NixOS' -DCMAKE_BUILD_TYPE=Release";

  prePatch = ''
--- a/pkgs/applications/networking/instant-messengers/pidgin-plugins/pidgin-latex/pidgin-latex-sf.nix
+++ b/pkgs/applications/networking/instant-messengers/pidgin-plugins/pidgin-latex/pidgin-latex-sf.nix
@ -1,8 +1,10 @@
-args : with args; 
+args : with args;
+let version = "1.5.0";
+in
 rec {
  src = fetchurl {
-    url = mirror://sourceforge/pidgin-latex/pidgin-latex-1.2.1.tar.bz2;
-    sha256 = "19h76fwsx5y30l5wda2930k10r385aipngfljz5bdi7b9y52lii7";
+    url = "mirror://sourceforge/pidgin-latex/pidgin-latex_${version}.tar.bz2";
+    sha256 = "9c850aee90d7e59de834f83e09fa6e3e51b123f06e265ead70957608ada95441";
  };

  buildInputs = [texLive pkgconfig gtk imagemagick glib pidgin which];
@ -33,8 +35,8 @@ rec {

  /* doConfigure should be specified separately */
  phaseNames = [ "preBuild" "doMakeInstall" "postInstall"];
-      
-  name = "pidgin-latex-1.2.1";
+
+  name = "pidgin-latex-${version}";
  meta = {
    description = "LaTeX rendering plugin for Pidgin IM";
    priority = "10";
--- a/pkgs/applications/networking/newsreaders/liferea/default.nix
+++ b/pkgs/applications/networking/newsreaders/liferea/default.nix
@ -33,7 +33,6 @@ stdenv.mkDerivation rec {
    for f in "$out"/bin/*; do
      wrapProgram "$f" \
        --prefix PYTHONPATH : "$(toPythonPath $out):$(toPythonPath ${pygobject3})" \
-        --prefix LD_LIBRARY_PATH : "${gnome3.libgnome_keyring}/lib" \
        --prefix GI_TYPELIB_PATH : "$GI_TYPELIB_PATH" \
        --prefix GIO_EXTRA_MODULES : "${gnome3.dconf}/lib/gio/modules:${glib_networking}/lib/gio/modules" \
        --prefix XDG_DATA_DIRS : "$XDG_ICON_DIRS:${gnome3.gnome_icon_theme}/share:${gnome3.gtk}/share:$out/share:$GSETTINGS_SCHEMAS_PATH"
--- a/pkgs/applications/networking/p2p/eiskaltdcpp/default.nix
+++ b/pkgs/applications/networking/p2p/eiskaltdcpp/default.nix
@ -0,0 +1,35 @@
+{ stdenv, fetchurl, cmake, pkgconfig, qt4, boost, bzip2, libX11, pcre, libidn, lua5, miniupnpc, aspell, gettext }:
+
+stdenv.mkDerivation rec {
+  name = "eiskaltdcpp-2.2.9";
+
+  src = fetchurl {
+    url = "https://eiskaltdc.googlecode.com/files/${name}.tar.xz";
+    sha256 = "3d9170645450f9cb0a605278b8646fec2110b9637910d86fd27cf245cbe24eaf";
+  };
+
+  buildInputs = [ cmake pkgconfig qt4 boost bzip2 libX11 pcre libidn lua5 miniupnpc aspell gettext ];
+
+  cmakeFlags = ''
+    -DUSE_ASPELL=ON
+    -DUSE_QT_QML=ON
+    -DFREE_SPACE_BAR_C=ON
+    -DUSE_MINIUPNP=ON
+    -DDBUS_NOTIFY=ON
+    -DUSE_JS=ON
+    -DPERL_REGEX=ON
+    -DUSE_CLI_XMLRPC=ON
+    -DWITH_SOUNDS=ON
+    -DLUA_SCRIPT=ON
+    -DWITH_LUASCRIPTS=ON
+  '';
+
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
+    description = "A cross-platform program that uses the Direct Connect and ADC protocols";
+    homepage = https://code.google.com/p/eiskaltdc/;
+    license = licenses.gpl3Plus;
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/applications/office/hledger-interest/default.nix
+++ b/pkgs/applications/office/hledger-interest/default.nix
@ -14,9 +14,6 @@ cabal.mkDerivation (self: {
    description = "computes interest for a given account";
    license = self.stdenv.lib.licenses.bsd3;
    platforms = self.ghc.meta.platforms;
-    maintainers = [
-      self.stdenv.lib.maintainers.andres
-      self.stdenv.lib.maintainers.simons
-    ];
+    maintainers = with self.stdenv.lib.maintainers; [ simons ];
  };
 })
--- a/pkgs/applications/office/hledger-irr/default.nix
+++ b/pkgs/applications/office/hledger-irr/default.nix
@ -13,6 +13,6 @@ cabal.mkDerivation (self: {
    description = "computes the internal rate of return of an investment";
    license = self.stdenv.lib.licenses.bsd3;
    platforms = self.ghc.meta.platforms;
-    maintainers = [ self.stdenv.lib.maintainers.simons ];
+    maintainers = with self.stdenv.lib.maintainers; [ simons ];
  };
 })
--- a/pkgs/applications/office/libreoffice/default.nix
+++ b/pkgs/applications/office/libreoffice/default.nix
@ -14,28 +14,30 @@
 , autoconf, automake, openldap, bash, hunspell, librdf_redland, nss, nspr
 , libwpg, dbus_glib, glibc, qt4, kde4, clucene_core, libcdr, lcms, vigra
 , unixODBC, mdds, saneBackends, mythes, libexttextcat, libvisio
-, fontsConf, pkgconfig, libzip, bluez5, libtool, maven, libe-book_00
-, libmwaw_02, libatomic_ops, graphite2, harfbuzz
+, fontsConf, pkgconfig, libzip, bluez5, libtool, maven
+, libatomic_ops, graphite2, harfbuzz
+, librevenge, libe-book, libmwaw, glm, glew
 , langs ? [ "en-US" "en-GB" "ca" "ru" "eo" "fr" "nl" "de" "sl" ]
 }:

 let
  langsSpaces = stdenv.lib.concatStringsSep " " langs;
  major = "4";
-  minor = "2";
-  patch = "5";
-  tweak = "2";
+  minor = "3";
+  patch = "0";
+  tweak = "4";
  subdir = "${major}.${minor}.${patch}";
  version = "${subdir}${if tweak == "" then "" else "."}${tweak}";

  # doesn't exist in srcs
+  # 0.8 version is in 0.7.0 tarball
  libixion = stdenv.mkDerivation rec {
-     version = "0.5.0";
+     version = "0.7.0";
     name = "libixion-${version}";

     src = fetchurl {
       url = "http://kohei.us/files/ixion/src/${name}.tar.bz2";
-       sha256 = "010k33bfkckx28r4rdk5mkd0mmayy5ng9ja0j0zg0z237gcfgrzb";
+       sha256 = "10amvz7fzr1kcy3svfspkdykmspqgpjdmk44cyr406wi7v4lwnf9";
     };

     configureFlags = "--with-boost=${boost}";
@ -43,12 +45,24 @@ let
     buildInputs = [ boost mdds pkgconfig ];
  };

-  fetchThirdParty = {name, md5, brief}: fetchurl {
+  fetchThirdParty = {name, md5, brief, subDir ? ""}: fetchurl {
    inherit name md5;
    url = if brief then
-            "http://dev-www.libreoffice.org/src/${name}"
+            "http://dev-www.libreoffice.org/src/${subDir}${name}"
          else
-            "http://dev-www.libreoffice.org/src/${md5}-${name}";
+            "http://dev-www.libreoffice.org/src/${subDir}${md5}-${name}";
+  };
+
+  # Can't find Boost inside LO build
+  liborcus = stdenv.mkDerivation rec {
+    name = "liborcus-0.7.0";
+    src = fetchThirdParty (stdenv.lib.findFirst 
+      (x: x.name == "${name}.tar.bz2")
+      ("Error: update liborcus version inside LO expression")
+      (import ./libreoffice-srcs.nix));
+    configureFlags = "--with-boost=${boost}";
+
+    buildInputs = [ boost mdds pkgconfig zlib libixion ];
  };

  fetchSrc = {name, sha256}: fetchurl {
@ -65,14 +79,14 @@ let

    translations = fetchSrc {
      name = "translations";
-      sha256 = "0nv47r043w151687ks06w786h8azi8gylxma9c7qyjbdj6cdb2ly";
+      sha256 = "1l445284mih0c7d6v3ps1piy5pbjvisyrjjvlrqizvwxqm7bxpr1";
    };

    # TODO: dictionaries

    help = fetchSrc {
      name = "help";
-      sha256 = "1kbkdngq39gfq2804v6vnllax4gqs25zlfk6y561iiipld1ncc5v";
+      sha256 = "0avsc11d4nmycsxvadr0xcd8z9506sjcc89hgmliqlmhmw48ax7y";
    };

  };
@ -82,7 +96,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "http://download.documentfoundation.org/libreoffice/src/${subdir}/libreoffice-${version}.tar.xz";
-    sha256 = "4bf7898d7d0ba918a8f6668eff0904a549e5a2de837854716e6d996f121817d5";
+    sha256 = "1r605nwjdq20qd96chqic1bjkw7y36wmpg2lzzvv5sz6gw12rzi8";
  };

  # Openoffice will open libcups dynamically, so we link it directly
@ -111,7 +125,6 @@ stdenv.mkDerivation rec {
      -e 's,! */usr/bin/python,!${python3}/bin/${python3.executable},' -e 's,! */usr/bin/env python,!${python3}/bin/${python3.executable},'
    #sed -i 's,ANT_OPTS+="\(.*\)",ANT_OPTS+=\1,' apache-commons/java/*/makefile.mk

-    patch -Np1 -i ${./ooxmlexport.diff};
  '';

  QT4DIR = qt4;
@ -131,6 +144,13 @@ stdenv.mkDerivation rec {
    touch solenv/inc/target.mk
  '';

+  # fetch_Download_item tries to interpret the name as a variable name
+  # Let it do so…
+  postConfigure = ''
+    sed -e '1ilibreoffice-translations-${version}.tar.xz=libreoffice-translations-${version}.tar.xz' -i Makefile
+    sed -e '1ilibreoffice-help-${version}.tar.xz=libreoffice-help-${version}.tar.xz' -i Makefile
+  '';
+
  makeFlags = "SHELL=${bash}/bin/bash";

  enableParallelBuilding = true;
@ -190,7 +210,6 @@ stdenv.mkDerivation rec {
    "--enable-epm"
    "--with-jdk-home=${jdk}/lib/openjdk"
    "--with-ant-home=${ant}/lib/ant"
-    "--without-afms"
    "--without-fonts"
    "--without-myspell-dicts"
    "--without-ppds"
@ -207,7 +226,6 @@ stdenv.mkDerivation rec {
    "--without-system-libodfgen"
    "--without-system-libabw"
    "--without-system-firebird"
-    "--without-system-orcus"
    "--without-system-liblangtag"
    "--without-system-libmspub"
  ];
@ -228,14 +246,16 @@ stdenv.mkDerivation rec {
      neon nspr nss openldap openssl ORBit2 pam perl pkgconfigUpstream poppler
      python3 sablotron saneBackends tcsh unzip vigra which zip zlib
      mdds bluez5 glibc libixion
-      libxshmfence libe-book_00 libmwaw_02 libatomic_ops graphite2 harfbuzz
+      libxshmfence libatomic_ops graphite2 harfbuzz
+      librevenge libe-book libmwaw glm glew
+      liborcus
    ];

  meta = with stdenv.lib; {
    description = "LibreOffice is a comprehensive, professional-quality productivity suite, a variant of openoffice.org";
    homepage = http://libreoffice.org/;
    license = licenses.lgpl3;
-    maintainers = [ maintainers.viric ];
+    maintainers = [ maintainers.viric maintainers.raskin ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/office/libreoffice/libreoffice-srcs.nix
+++ b/pkgs/applications/office/libreoffice/libreoffice-srcs.nix
@ -1,84 +1,19 @@
 [
 {
-  name = "libabw-0.0.2.tar.bz2";
-  md5 = "40fa48e03b1e28ae0325cc34b35bc46d";
+  name = "libabw-0.1.0.tar.bz2";
+  md5 = "9317e967c8fa8ff50e049744c4b33c87";
  brief = true;
 }
-{
-  name = "libcdr-0.0.15.tar.bz2";
-  md5 = "fbcd8619fc6646f41d527c1329102998";
-  brief = true;
-}
-{
-  name = "libe-book-0.0.3.tar.bz2";
-  md5 = "2f1ceaf2ac8752ed278e175447d9b978";
-  brief = true;
-}
-{
-  name = "libetonyek-0.0.4.tar.bz2";
-  md5 = "3c50bc60394d1f2675fbf9bd22581363";
-  brief = true;
-}
-{
-  name = "libfreehand-0.0.0.tar.bz2";
-  md5 = "496dd00028afcc19f896b01394769043";
-  brief = true;
-}
-{
-  name = "libmspub-0.0.6.tar.bz2";
-  md5 = "1120705cd0f0d9bd5506360bf57b6c2e";
-  brief = true;
-}
-{
-  name = "libmwaw-0.2.0.tar.bz2";
-  md5 = "d794625f156a9fb1c53b3f8a8aa13b5e";
-  brief = true;
-}
-{
-  name = "libodfgen-0.0.4.tar.bz2";
-  md5 = "e5483d1f0b71e64c367c1194b54b0f53";
-  brief = true;
-}
-{
-  name = "libvisio-0.0.31.tar.bz2";
-  md5 = "82628333418f101a20cd21f980cf9f40";
-  brief = true;
-}
-{
-  name = "Firebird-2.5.2.26540-0.tar.bz2";
-  md5 = "21154d2004e025c8a3666625b0357bb5";
-  brief = true;
-}
-{
-  name = "harfbuzz-0.9.23.tar.bz2";
-  md5 = "a4a9b548577e2ee22f0887937da5fd6c";
-  brief = true;
-}
-{
-  name = "libatomic_ops-7_2d.zip";
-  md5 = "c0b86562d5aa40761a87134f83e6adcf";
-  brief = true;
-}
-{
-  name = "libeot-0.01.tar.bz2";
-  md5 = "aa24f5dd2a2992f4a116aa72af817548";
-  brief = true;
-}
-{
-  name = "language-subtag-registry-2014-03-27.tar.bz2";
-  md5 = "504af523f5d1a5590bbeb6a4b55e8a97";
-  brief = true;
-}
-{
-  name = "Adobe-Core35_AFMs-314.tar.gz";
-  md5 = "1756c4fa6c616ae15973c104cd8cb256";
-  brief = false;
-}
 {
  name = "commons-codec-1.6-src.tar.gz";
  md5 = "2e482c7567908d334785ce7d69ddfff7";
  brief = false;
 }
+{
+  name = "commons-codec-1.9-src.zip";
+  md5 = "048751f3271906db5126ab76870444c4";
+  brief = false;
+}
 {
  name = "commons-httpclient-3.1-src.tar.gz";
  md5 = "2c9b0f83ed5890af02c0df1c1776f39b";
@ -90,13 +25,28 @@
  brief = false;
 }
 {
-  name = "commons-logging-1.1.1-src.tar.gz";
-  md5 = "3c219630e4302863a9a83d0efde889db";
+  name = "commons-lang3-3.3.1-src.tar.gz";
+  md5 = "8ab049135b2d15313da5d9f0656894a1";
  brief = false;
 }
 {
-  name = "boost_1_54_0.tar.bz2";
-  md5 = "15cb8c0803064faef0c4ddf5bc5ca279";
+  name = "commons-logging-1.1.3-src.tar.gz";
+  md5 = "e8e197d628436490886d17cffa108fe3";
+  brief = false;
+}
+{
+  name = "apr-1.4.8.tar.gz";
+  md5 = "eff9d741b0999a9bbab96862dd2a2a3d";
+  brief = true;
+}
+{
+  name = "apr-util-1.5.3.tar.gz";
+  md5 = "71a11d037240b292f824ba1eb537b4e3";
+  brief = true;
+}
+{
+  name = "boost_1_55_0.tar.bz2";
+  md5 = "d6eef4b4cacb2183f2bf265a5a03a354";
  brief = false;
 }
 {
@ -109,6 +59,11 @@
  md5 = "f101a9e88b783337b20b2e26dfd26d5f";
  brief = false;
 }
+{
+  name = "libcdr-0.1.0.tar.bz2";
+  md5 = "0e2f56934c8872ec4a254cd4bb1d7cf6";
+  brief = true;
+}
 {
  name = "clucene-core-2.3.3.4.tar.gz";
  md5 = "48d647fbd8ef8889e5a7f422c1bfda94";
@ -119,6 +74,16 @@
  md5 = "22f8a85daf4a012180322e1f52a7563b";
  brief = false;
 }
+{
+  name = "CoinMP-1.7.6.tgz";
+  md5 = "1cce53bf4b40ae29790d2c5c9f8b1129";
+  brief = true;
+}
+{
+  name = "collada2gltf-master-cb1d97788a.tar.bz2";
+  md5 = "4b87018f7fff1d054939d19920b751a0";
+  brief = false;
+}
 {
  name = "cppunit-1.13.1.tar.gz";
  md5 = "ac4781e01619be13461bb2d562b94a7b";
@ -130,20 +95,35 @@
  brief = false;
 }
 {
-  name = "curl-7.33.0.tar.bz2";
-  md5 = "57409d6bf0bd97053b8378dbe0cadcef";
-  brief = false;
+  name = "curl-7.36.0.tar.bz2";
+  md5 = "e6d1f9d1b59da5062109ffe14e0569a4";
+  brief = true;
+}
+{
+  name = "libe-book-0.1.1.tar.bz2";
+  md5 = "c25a881d21abc5b4da19205db513cc22";
+  brief = true;
 }
 {
  name = "epm-3.7.tar.gz";
  md5 = "3ade8cfe7e59ca8e65052644fed9fca4";
  brief = false;
 }
+{
+  name = "libetonyek-0.1.1.tar.bz2";
+  md5 = "805f941b06448212a988cb65f0691a7a";
+  brief = true;
+}
 {
  name = "expat-2.1.0.tar.gz";
  md5 = "dd7dab7a5fea97d2a6a43f511449b7cd";
  brief = false;
 }
+{
+  name = "Firebird-2.5.2.26540-0.tar.bz2";
+  md5 = "21154d2004e025c8a3666625b0357bb5";
+  brief = true;
+}
 {
  name = "fontconfig-2.8.0.tar.gz";
  md5 = "77e15a92006ddc2adbb06f840d591c0e";
@ -160,8 +140,8 @@
  brief = false;
 }
 {
-  name = "dejavu-fonts-ttf-2.33.zip";
-  md5 = "f872f4ac066433d8ff92f5e316b36ff9";
+  name = "dejavu-fonts-ttf-2.34.zip";
+  md5 = "a4e565e220b5de082c23995e256e3c12";
  brief = false;
 }
 {
@ -170,8 +150,8 @@
  brief = false;
 }
 {
-  name = "liberation-fonts-ttf-1.07.3.tar.gz";
-  md5 = "b3174b11c2b6a341f5c99b31088bd67b";
+  name = "liberation-fonts-ttf-1.07.4.tar.gz";
+  md5 = "134d8262145fc793c6af494dcace3e71";
  brief = false;
 }
 {
@ -204,16 +184,36 @@
  md5 = "1e9ddfe25ac9577da709d7b2ea36f939";
  brief = false;
 }
+{
+  name = "libfreehand-0.1.0.tar.bz2";
+  md5 = "5f029fef73e42a2c2ae4524a7513f97d";
+  brief = true;
+}
 {
  name = "freetype-2.4.8.tar.bz2";
  md5 = "dbf2caca1d3afd410a29217a9809d397";
  brief = false;
 }
 {
-  name = "graphite2-1.2.3.tgz";
-  md5 = "7042305e4208af4c2d5249d814ccce58";
+  name = "glew-1.10.0.zip";
+  md5 = "594eb47b4b1210e25438d51825404d5a";
  brief = false;
 }
+{
+  name = "glm-0.9.4.6-libreoffice.zip";
+  md5 = "bae83fa5dc7f081768daace6e199adc3";
+  brief = false;
+}
+{
+  name = "graphite2-1.2.4.tgz";
+  md5 = "2ef839348fe28e3b923bf8cced440227";
+  brief = true;
+}
+{
+  name = "harfbuzz-0.9.23.tar.bz2";
+  md5 = "a4a9b548577e2ee22f0887937da5fd6c";
+  brief = true;
+}
 {
  name = "hsqldb_1_8_0.zip";
  md5 = "17410483b5b5f267aa18b7e00b65e6e0";
@ -230,8 +230,8 @@
  brief = false;
 }
 {
-  name = "icu4c-52_1-src.tgz";
-  md5 = "9e96ed4c1d99c0d14ac03c140f9f346c";
+  name = "icu4c-53_1-src.tgz";
+  md5 = "b73baa6fbdfef197608d1f69300919b9";
  brief = false;
 }
 {
@ -290,9 +290,14 @@
  brief = false;
 }
 {
-  name = "jpegsrc.v8d.tar.gz";
-  md5 = "52654eb3b2e60c35731ea8fc87f1bd29";
-  brief = false;
+  name = "jpegsrc.v9a.tar.gz";
+  md5 = "3353992aecaee1805ef4109aadd433e7";
+  brief = true;
+}
+{
+  name = "language-subtag-registry-2014-04-10.tar.bz2";
+  md5 = "49c94710f7858b1969d74ff72e6aac84";
+  brief = true;
 }
 {
  name = "JLanguageTool-1.7.0.tar.bz2";
@ -300,15 +305,31 @@
  brief = false;
 }
 {
-  name = "lcms2-2.4.tar.gz";
-  md5 = "861ef15fa0bc018f9ddc932c4ad8b6dd";
-  brief = false;
+  name = "lcms2-2.6.tar.gz";
+  md5 = "f4c08d38ceade4a664ebff7228910a33";
+  brief = true;
+}
+{
+  name = "libatomic_ops-7_2d.zip";
+  md5 = "c0b86562d5aa40761a87134f83e6adcf";
+  brief = true;
+}
+{
+  name = "libeot-0.01.tar.bz2";
+  md5 = "aa24f5dd2a2992f4a116aa72af817548";
+  brief = true;
 }
 {
  name = "libexttextcat-3.4.3.tar.bz2";
  md5 = "ae330b9493bd4503ac390106ff6060d7";
  brief = false;
 }
+{
+  name = "libgltf-0.0.0.tar.bz2";
+  md5 = "3d9ea1f2828c46f8ba94b88a87b3326d";
+  brief = false;
+  subDir = "libgltf/";
+}
 {
  name = "liblangtag-0.5.1.tar.bz2";
  md5 = "36271d3fa0d9dec1632029b6d7aac925";
@ -344,6 +365,16 @@
  md5 = "aa5ca9d1ed1082890835afab26400a39";
  brief = false;
 }
+{
+  name = "libmspub-0.1.1.tar.bz2";
+  md5 = "1d489c4932109e72495b1df8b69e5f11";
+  brief = true;
+}
+{
+  name = "libmwaw-0.3.1.tar.bz2";
+  md5 = "6f1ac4a0e24131c422e1e91f07718fb6";
+  brief = true;
+}
 {
  name = "mysql-connector-c++-1.1.0.tar.gz";
  md5 = "0981bda6548a8c8233ffce2b6e4b2a23";
@ -364,19 +395,29 @@
  md5 = "06beb053e257d9e22641339c905c6eba";
  brief = false;
 }
+{
+  name = "libodfgen-0.1.1.tar.bz2";
+  md5 = "c22c83c17cda0754382ada4e116594b7";
+  brief = true;
+}
+{
+  name = "OpenCOLLADA-master-6509aa13af.tar.bz2";
+  md5 = "4ca8a6ef0afeefc864e9ef21b9f14bd6";
+  brief = true;
+}
 {
  name = "openldap-2.4.31.tgz";
  md5 = "804c6cb5698db30b75ad0ff1c25baefd";
  brief = false;
 }
 {
-  name = "openssl-1.0.1e.tar.gz";
-  md5 = "66bf6f10f060d561929de96f9dfe5b8c";
+  name = "openssl-1.0.1h.tar.gz";
+  md5 = "8d6d684a9430d5cc98a62a5d8fbda8cf";
  brief = false;
 }
 {
-  name = "liborcus-0.5.1.tar.bz2";
-  md5 = "ea2acaf140ae40a87a952caa75184f4d";
+  name = "liborcus-0.7.0.tar.bz2";
+  md5 = "7681383be6ce489d84c1c74f4e7f9643";
  brief = false;
 }
 {
@ -385,9 +426,9 @@
  brief = false;
 }
 {
-  name = "libpng-1.5.10.tar.gz";
-  md5 = "9e5d864bce8f06751bbd99962ecf4aad";
-  brief = false;
+  name = "libpng-1.5.18.tar.gz";
+  md5 = "5266905cef49d1224437465ad4d67fd9";
+  brief = true;
 }
 {
  name = "poppler-0.22.5.tar.gz";
@ -400,9 +441,9 @@
  brief = false;
 }
 {
-  name = "Python-3.3.3.tar.bz2";
-  md5 = "f3ebe34d4d8695bf889279b54673e10c";
-  brief = false;
+  name = "Python-3.3.5.tgz";
+  md5 = "803a75927f8f241ca78633890c798021";
+  brief = true;
 }
 {
  name = "raptor2-2.0.9.tar.gz";
@ -419,11 +460,21 @@
  md5 = "32f8e1417a64d3c6f2c727f9053f55ea";
  brief = false;
 }
+{
+  name = "librevenge-0.0.1.tar.bz2";
+  md5 = "69c367c6b0a360411965a1c409a0b6c1";
+  brief = true;
+}
 {
  name = "rhino1_5R5.zip";
  md5 = "798b2ffdc8bcfe7bca2cf92b62caf685";
  brief = false;
 }
+{
+  name = "serf-1.2.1.tar.bz2";
+  md5 = "4f8e76c9c6567aee1d66aba49f76a58b";
+  brief = true;
+}
 {
  name = "swingExSrc.zip";
  md5 = "35c94d2df8893241173de1d16b6034c0";
@ -440,19 +491,24 @@
  brief = false;
 }
 {
-  name = "libwpd-0.9.9.tar.bz2";
-  md5 = "a3dcac551fae5ebbec16e844810828c4";
-  brief = false;
+  name = "libvisio-0.1.0.tar.bz2";
+  md5 = "931588332ba44682c9cd5eefbd358ab4";
+  brief = true;
 }
 {
-  name = "libwpg-0.2.2.tar.bz2";
-  md5 = "b85436266b2ac91d351ab5684b181151";
-  brief = false;
+  name = "libwpd-0.10.0.tar.bz2";
+  md5 = "0773d79a1f240ef9f4f20242b13c5bb7";
+  brief = true;
 }
 {
-  name = "libwps-0.2.9.tar.bz2";
-  md5 = "46eb0e7f213ad61bd5dee0c494132cb0";
-  brief = false;
+  name = "libwpg-0.3.0.tar.bz2";
+  md5 = "17da9770cb8b317b7633f9807b32b71a";
+  brief = true;
+}
+{
+  name = "libwps-0.3.0.tar.bz2";
+  md5 = "d4d77d08b9048bae3b8ec8df11f80efd";
+  brief = true;
 }
 {
  name = "xsltml_2.1.2.zip";
@ -460,8 +516,8 @@
  brief = false;
 }
 {
-  name = "zlib-1.2.7.tar.bz2";
-  md5 = "2ab442d169156f34c379c968f3f482dd";
-  brief = false;
+  name = "zlib-1.2.8.tar.gz";
+  md5 = "44d667c142d7cda120332623eab69f40";
+  brief = true;
 }
 ]
--- a/pkgs/applications/office/libreoffice/ooxmlexport.diff
+++ b/pkgs/applications/office/libreoffice/ooxmlexport.diff
@ -1,31 +0,0 @@
--- a/sw/qa/extras/ooxmlexport/ooxmlexport.cxx	2014-06-12 12:25:19.000000000 +0400
-+++ b/sw/qa/extras/ooxmlexport/ooxmlexport.cxx	2014-06-12 12:25:20.000000000 +0400
-@@ -547,17 +547,17 @@
-     getRun(xParagraph, 5, " After.");
- }
- 
-DECLARE_OOXMLEXPORT_TEST(test1Table1Page, "1-table-1-page.docx")
-{
-    // 2 problem for this document after export:
-    //   - invalid sectPr inserted at the beginning of the page
-    //   - font of empty cell is not preserved, leading to change in rows height
-    uno::Reference<frame::XModel> xModel(mxComponent, uno::UNO_QUERY);
-    uno::Reference<text::XTextViewCursorSupplier> xTextViewCursorSupplier(xModel->getCurrentController(), uno::UNO_QUERY);
-    uno::Reference<text::XPageCursor> xCursor(xTextViewCursorSupplier->getViewCursor(), uno::UNO_QUERY);
-    xCursor->jumpToLastPage();
-    CPPUNIT_ASSERT_EQUAL(sal_Int16(1), xCursor->getPage());
-}
-+///   DECLARE_OOXMLEXPORT_TEST(test1Table1Page, "1-table-1-page.docx")
-+///   {
-+///       // 2 problem for this document after export:
-+///       //   - invalid sectPr inserted at the beginning of the page
-+///       //   - font of empty cell is not preserved, leading to change in rows height
-+///       uno::Reference<frame::XModel> xModel(mxComponent, uno::UNO_QUERY);
-+///       uno::Reference<text::XTextViewCursorSupplier> xTextViewCursorSupplier(xModel->getCurrentController(), uno::UNO_QUERY);
-+///       uno::Reference<text::XPageCursor> xCursor(xTextViewCursorSupplier->getViewCursor(), uno::UNO_QUERY);
-+///       xCursor->jumpToLastPage();
-+///       CPPUNIT_ASSERT_EQUAL(sal_Int16(1), xCursor->getPage());
-+///   }
- 
- DECLARE_OOXMLEXPORT_TEST(testTextFrames, "textframes.odt")
- {
--- a/pkgs/applications/office/zotero/default.nix
+++ b/pkgs/applications/office/zotero/default.nix
@ -3,7 +3,7 @@
 assert (stdenv.system == "x86_64-linux" || stdenv.system == "i686-linux");

 let
-  version = "4.0.21.1";
+  version = "4.0.21.2";
  arch = if stdenv.system == "x86_64-linux"
           then "linux-x86_64"
           else "linux-i686";
@ -14,8 +14,8 @@ stdenv.mkDerivation {
  src = fetchurl {
    url = "https://download.zotero.org/standalone/${version}/Zotero-${version}_${arch}.tar.bz2";
    sha256 = if stdenv.system == "x86_64-linux"
-               then "1d6ih9q0daxxqqbr134la5y39648hpd53srf43lljjs8wr71wbn8"
-               else "121myzwxw3frps77lpzza82glyz9qgwbl5bh3zngfx9vwx3n8q0v";
+               then "1df101j2qwdp001m8x3ihbzz2j23x43804k8ww749y09d1ydb4dx"
+               else "1bcrpl6gdxlygd5ppyrhw42q24kjcakma3qv6mpzgp91phkf6g30";
  };

  # Strip the bundled xulrunner
@ -31,6 +31,9 @@ stdenv.mkDerivation {
    chmod +x "$out/bin/zotero"
  '';

+  doInstallCheck = true;
+  installCheckPhase = "$out/bin/zotero --version";
+
  meta = with stdenv.lib; {
    homepage = "https://www.zotero.org";
    description = "Collect, organize, cite, and share your research sources";
--- a/pkgs/applications/science/logic/leo2/default.nix
+++ b/pkgs/applications/science/logic/leo2/default.nix
@ -1,5 +1,5 @@
 x@{builderDefsPackage
-  , ocaml, eprover
+  , ocaml, eprover, zlib
  , ...}:
 builderDefsPackage
 (a :  
@ -11,16 +11,16 @@ let
    (builtins.attrNames (builtins.removeAttrs x helperArgNames));
  sourceInfo = rec {
    baseName="leo2";
-    version="1.2.8";
+    version = "1.6.2";
    name="${baseName}_v${version}";
-    url="http://www.ags.uni-sb.de/~leo/${name}.tgz";
-    hash="d46a94f5991623386eb9061cfb0d748e258359a8c690fded173d45303e0e9e3a";
+    url="page.mi.fu-berlin.de/cbenzmueller/leo/leo2_v${version}.tgz";
+    hash="d46a94f5991623386eb9061cfb0d748e258359a8c690fded173d35303e0e9e3a";
  };
 in
 rec {
  src = a.fetchurl {
    url = sourceInfo.url;
-    sha256 = sourceInfo.hash;
+    sha256 = "1wjpmizb181iygnd18lx7p77fwaci2clgzs5ix5j51cc8f3pazmv";
  };

  name = "${sourceInfo.baseName}-${sourceInfo.version}";
@ -43,6 +43,10 @@ rec {
    echo -e "e = ${eprover}/bin/eprover\\nepclextract = ${eprover}/bin/epclextract" > "$out/etc/leoatprc"
  '') ["minInit" "doMake" "defEnsureDir"];

+  makeFlags = [
+    "SHELL=${a.stdenv.shell}"
+  ];
+
  meta = {
    description = "A high-performance typed higher order prover";
    maintainers = with a.lib.maintainers;
@ -52,11 +56,9 @@ rec {
    platforms = with a.lib.platforms;
      linux;
    license = "BSD";
-  };
-  passthru = {
-    updateInfo = {
-      downloadPage = "http://www.ags.uni-sb.de/~leo/download.html";
-    };
+    inherit (sourceInfo) version;
+    homepage = "http://page.mi.fu-berlin.de/cbenzmueller/leo/";
+    downloadPage = "http://page.mi.fu-berlin.de/cbenzmueller/leo/download.html";
  };
 }) x

--- a/pkgs/applications/science/logic/leo2/default.upstream
+++ b/pkgs/applications/science/logic/leo2/default.upstream
@ -0,0 +1,6 @@
+url http://page.mi.fu-berlin.de/cbenzmueller/leo/download.html
+version_link '[.]tgz'
+version '.*_v([0-9.]+)[.][a-z0-9]+$' '\1'
+do_overwrite () {
+  do_overwrite_just_version
+}
--- a/pkgs/applications/science/misc/fityk/default.nix
+++ b/pkgs/applications/science/misc/fityk/default.nix
@ -0,0 +1,23 @@
+{ stdenv, fetchurl, wxGTK30, boost, lua, zlib, bzip2, xylib, readline, gnuplot }:
+
+let
+  name    = "fityk";
+  version = "1.2.9";
+in
+stdenv.mkDerivation {
+  name = "${name}-${version}";
+
+  src = fetchurl {
+    url = "https://github.com/wojdyr/fityk/releases/download/v${version}/${name}-${version}.tar.bz2";
+    sha256 = "1gl938nd2jyya8b3gzbagm1jab2mkc9zvr6zsg5d0vkfdqlk0pv1";
+  };
+
+  buildInputs = [wxGTK30 boost lua zlib bzip2 xylib readline gnuplot ];
+
+  meta = {
+    description = "Fityk -- curve fitting and peak fitting software";
+    license = "GPL2";
+    homepage = http://fityk.nieto.pl/;
+    platforms = stdenv.lib.platforms.linux;
+  };
+}
--- a/pkgs/applications/science/misc/simgrid/default.nix
+++ b/pkgs/applications/science/misc/simgrid/default.nix
@ -1,20 +1,19 @@
-{ fetchurl, stdenv, cmake, perl, ruby }:
+{ fetchurl, stdenv, cmake, perl, ruby, boost, lua5_1, graphviz, libsigcxx
+, libunwind, elfutils
+}:

 stdenv.mkDerivation rec {
-  name = "simgrid-3.5";
+  version = "3.11.1";
+  name = "simgrid-${version}";

  src = fetchurl {
-    url = "https://gforge.inria.fr/frs/download.php/28017/${name}.tar.gz";
-    sha256 = "1vd4pvrcyii1nfwyca3kpbwshbc965lfpn083zd8rigg6ydchq8y";
+    url = "https://gforge.inria.fr/frs/download.php/33686/${name}.tar.gz";
+    sha256 = "0mkrzxpf42lmn96khfl1791vram67r2nqsgmppd2yil889nyz5kp";
  };

-  /* FIXME: Ruby currently disabled because of this:
-
-     Linking C shared library ../src/.libs/libsimgrid.so
-     ld: cannot find -lruby-1.8.7-p72
-
-   */
-  buildInputs = [ cmake perl /* ruby */ ];
+  buildInputs = [ cmake perl ruby boost lua5_1 graphviz libsigcxx libunwind
+    elfutils
+    ];

  preConfigure =
    # Make it so that libsimgrid.so will be found when running programs from
@ -22,8 +21,17 @@ stdenv.mkDerivation rec {
    '' export LD_LIBRARY_PATH="$PWD/src/.libs"
       export cmakeFlags="-Dprefix=$out"

-       # Enable tracing.
-       export cmakeFlags="$cmakeFlags -Denable_tracing=on"
+       export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE
+         -isystem $(echo "${libsigcxx}/lib/"sigc++*/include)
+	 -isystem $(echo "${libsigcxx}/include"/sigc++* )
+	 "
+       export CMAKE_PREFIX_PATH="$CMAKE_PREFIX_PATH:$(echo "${libsigcxx}/lib/"sigc++*)"
+
+       # Enable more functionality.
+       export cmakeFlags="$cmakeFlags -Denable_tracing=on -Denable_jedule=on
+         -Denable_latency_bound_tracking=on -Denable_lua=on
+	 -Denable_ns3=on -Denable_gtnets=on
+	 "
    '';

  makeFlags = "VERBOSE=1";
@ -45,6 +53,7 @@ stdenv.mkDerivation rec {
  patchPhase =
    '' for i in "src/smpi/"*
       do
+         test -f "$i" &&
         sed -i "$i" -e's|/bin/bash|/bin/sh|g'
       done

--- a/pkgs/applications/version-management/git-and-tools/github-backup/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/github-backup/default.nix
@ -21,5 +21,7 @@ cabal.mkDerivation (self: {
    description = "backs up everything github knows about a repository, to the repository";
    license = "GPL";
    platforms = self.ghc.meta.platforms;
+    hydraPlatforms = self.stdenv.lib.platforms.none;
+    broken = true;
  };
 })
--- a/pkgs/applications/version-management/mercurial/default.nix
+++ b/pkgs/applications/version-management/mercurial/default.nix
@ -2,7 +2,8 @@
 , guiSupport ? false, tk ? null, curses }:

 let
-  name = "mercurial-2.9.2";
+  version = "3.1";
+  name = "mercurial-${version}";
 in

 stdenv.mkDerivation {
@ -10,7 +11,7 @@ stdenv.mkDerivation {

  src = fetchurl {
    url = "http://mercurial.selenic.com/release/${name}.tar.gz";
-    sha256 = "0lwgncim4cy91ly8389h2bbhl4nbi8xjgp0kx37kgq8q2lx2nil6";
+    sha256 = "1r6hdxka867lpsq2jq3vz662m3ywflg4yylayc9g0s9gmiww5pgi";
  };

  inherit python; # pass it so that the same version can be used in hg2git
@ -53,8 +54,10 @@ stdenv.mkDerivation {
    '';

  meta = {
+    inherit version;
    description = "A fast, lightweight SCM system for very large distributed projects";
-    homepage = "http://www.selenic.com/mercurial/";
+    homepage = "http://mercurial.selenic.com/";
+    downloadPage = "http://mercurial.selenic.com/release/";
    license = stdenv.lib.licenses.gpl2;
    maintainers = [ stdenv.lib.maintainers.eelco ];
  };
--- a/pkgs/applications/version-management/subversion/default.nix
+++ b/pkgs/applications/version-management/subversion/default.nix
@ -73,6 +73,10 @@ stdenv.mkDerivation rec {

  enableParallelBuilding = true;

+  # Hack to build on Mac OS X. The system header files use C99-style
+  # comments, but Subversion passes -std=c90.
+  NIX_CFLAGS_COMPILE = "-std=c99";
+
  meta = {
    description = "A version control system intended to be a compelling replacement for CVS in the open source community";
    homepage = http://subversion.apache.org/;
--- a/pkgs/applications/video/aegisub/default.nix
+++ b/pkgs/applications/video/aegisub/default.nix
@ -22,11 +22,11 @@ assert portaudioSupport -> (portaudio != null);

 stdenv.mkDerivation rec {
  name = "aegisub-${version}";
-  version = "3.1.3";
+  version = "3.2.0";

  src = fetchurl {
    url = "http://ftp.aegisub.org/pub/releases/${name}.tar.xz";
-    sha256 = "0n2y5cggayr8246p2cvrz0ajlhhvmzcgsp7nljnm21jypk15pspg";
+    sha256 = "0nciw5p1aq94qwz5j4vbc06fywdjhazgh4qs6qr9iqj3n94gvrfr";
  };

  nativeBuildInputs = [ intltool ];
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
      # Add a ‘qemu-kvm’ wrapper for compatibility/convenience.
      p="$out/bin/qemu-system-${if stdenv.system == "x86_64-linux" then "x86_64" else "i386"}"
      if [ -e "$p" ]; then
-        makeWrapper "$p" $out/bin/qemu-kvm --add-flags "-enable-kvm"
+        makeWrapper "$p" $out/bin/qemu-kvm --add-flags "\$([ -e /dev/kvm ] && echo -enable-kvm)"
      fi
    '';

--- a/pkgs/applications/virtualization/virt-manager/default.nix
+++ b/pkgs/applications/virtualization/virt-manager/default.nix
@ -51,7 +51,6 @@ buildPythonPackage rec {
            --prefix GI_TYPELIB_PATH : $GI_TYPELIB_PATH \
            --prefix GIO_EXTRA_MODULES : "${dconf}/lib/gio/modules" \
            --prefix GSETTINGS_SCHEMA_DIR : $out/share/glib-2.0/schemas \
-            --prefix LD_LIBRARY_PATH : ${gtk3}/lib/:${libvirt-glib}/lib/:${vte}/lib:${gtkvnc}/lib${optionalString spiceSupport ":${spice_gtk}/lib"} \
            --prefix XDG_DATA_DIRS : "$out/share:${gsettings_desktop_schemas}/share:${gtk3}/share:$GSETTINGS_SCHEMAS_PATH:\$XDG_DATA_DIRS"
    done

--- a/pkgs/applications/window-managers/bar/default.nix
+++ b/pkgs/applications/window-managers/bar/default.nix
@ -0,0 +1,23 @@
+{ stdenv, fetchurl, git, perl, libxcb, libXinerama, xcbutil, xcbutilwm, xcbutilkeysyms }:
+
+stdenv.mkDerivation rec {
+  name = "bar-1.0";
+
+  
+  src = fetchurl {
+    url = "https://github.com/LemonBoy/bar/archive/v1.0.tar.gz";
+    sha256 = "1n2vak2acs37sslxl250cnz9c3irif5z4s54wi9qjyxbfzr2h2nc";
+  };
+
+  buildInputs = [ libxcb git perl libXinerama xcbutil xcbutilkeysyms xcbutilwm ];
+
+  prePatch = ''sed -i "s@/usr@$out@" Makefile'';
+
+  meta = {
+    description = "A lightweight xcb based bar";
+    homepage = "https://github.com/LemonBoy/bar";
+    maintainers = stdenv.lib.maintainers.meisternu;
+    license = "Custom";   
+    platforms = stdenv.lib.platforms.linux;
+  };
+}
--- a/pkgs/applications/window-managers/bspwm/default.nix
+++ b/pkgs/applications/window-managers/bspwm/default.nix
@ -0,0 +1,29 @@
+{ stdenv, fetchurl, libxcb, libXinerama, sxhkd, xcbutil, xcbutilkeysyms, xcbutilwm }:
+
+stdenv.mkDerivation rec {
+  name = "bspwm-0.8.9";
+  
+
+  src = fetchurl {
+    url = "https://github.com/baskerville/bspwm/archive/0.8.9.tar.gz";
+    sha256 = "750c76132914661d8d5edf7809e9b601977215d31e747dd780c60fd562913d55";
+  };
+
+  buildInputs = [ libxcb libXinerama xcbutil xcbutilkeysyms xcbutilwm ];
+
+  buildPhase = ''
+    make PREFIX=$out
+  '';
+ 
+  installPhase = ''
+    make PREFIX=$out install
+  '';
+
+  meta = {
+    description = "A tiling window manager based on binary space partitioning";
+    homepage = "http://github.com/baskerville/bspwm";
+    maintainers = stdenv.lib.maintainers.meisternu;
+    license = "BSD";
+    platforms = stdenv.lib.platforms.linux;
+  };
+}
--- a/pkgs/applications/window-managers/sxhkd/default.nix
+++ b/pkgs/applications/window-managers/sxhkd/default.nix
@ -0,0 +1,27 @@
+{ stdenv, fetchurl, asciidoc, libxcb, xcbutil, xcbutilkeysyms, xcbutilwm }:
+
+stdenv.mkDerivation rec {
+  name = "sxhkd-0.5.4";
+ 
+  src = fetchurl {
+    url = "https://github.com/baskerville/sxhkd/archive/0.5.4.tar.gz";
+    sha256 = "de95f97155319ded41ece9403ac9e9f18bfdd914a09f553ab09b331bbfe5d332";
+  };
+  
+  buildInputs = [ asciidoc libxcb xcbutil xcbutilkeysyms xcbutilwm ];
+
+  buildPhase = ''
+     make PREFIX=$out
+  '';
+
+  installPhase = ''
+     make PREFIX=$out install
+  '';
+
+  meta = {
+    description = "Simple X hotkey daemon";
+    homepage = "http://github.com/baskerville/sxhkd";
+    license = "BSD";
+    platforms = stdenv.lib.platforms.linux;
+  };
+}
--- a/pkgs/applications/window-managers/xmonad/xmonad-contrib.nix
+++ b/pkgs/applications/window-managers/xmonad/xmonad-contrib.nix
@ -16,9 +16,6 @@ cabal.mkDerivation (self: {
    description = "Third party extensions for xmonad";
    license = self.stdenv.lib.licenses.bsd3;
    platforms = self.ghc.meta.platforms;
-    maintainers = [
-      self.stdenv.lib.maintainers.andres
-      self.stdenv.lib.maintainers.simons
-    ];
+    maintainers = with self.stdenv.lib.maintainers; [ simons ];
  };
 })
--- a/pkgs/applications/window-managers/xmonad/xmonad-extras.nix
+++ b/pkgs/applications/window-managers/xmonad/xmonad-extras.nix
@ -19,9 +19,6 @@ cabal.mkDerivation (self: {
    description = "Third party extensions for xmonad with wacky dependencies";
    license = self.stdenv.lib.licenses.bsd3;
    platforms = self.ghc.meta.platforms;
-    maintainers = [
-      self.stdenv.lib.maintainers.andres
-      self.stdenv.lib.maintainers.simons
-    ];
+    maintainers = with self.stdenv.lib.maintainers; [ simons ];
  };
 })
--- a/pkgs/build-support/fetchgit/nix-prefetch-git
+++ b/pkgs/build-support/fetchgit/nix-prefetch-git
@ -227,8 +227,9 @@ clone_user_rev() {
 	echo "removing \`.git'..." >&2
        find $dir -name .git\* | xargs rm -rf
    else
-        # The logs and index contain timestamps
-        find $dir -name .git | xargs -I {} rm -rf {}/logs {}/index
+        # The logs and index contain timestamps, and the hooks contain
+        # the nix path of git's bash
+        find $dir -name .git | xargs -I {} rm -rf {}/logs {}/index {}/hooks
    fi
 }

--- a/pkgs/build-support/fetchurl/mirrors.nix
+++ b/pkgs/build-support/fetchurl/mirrors.nix
@ -275,6 +275,7 @@ rec {
  postgresql = [
    ftp://ftp.postgresql.org/pub/
    ftp://ftp-archives.postgresql.org/pub/
+    http://ftp.postgresql.org/pub/
  ];

  metalab = [
--- a/pkgs/build-support/release/ant-build.nix
+++ b/pkgs/build-support/release/ant-build.nix
@ -11,6 +11,8 @@
 , ant ? pkgs.ant
 , jre ? pkgs.openjdk
 , hydraAntLogger ? pkgs.hydraAntLogger
+, zip ? pkgs.zip
+, unzip ? pkgs.unzip
 , ... } @ args:

 let
@ -45,7 +47,10 @@ stdenv.mkDerivation (
         '' else stdenv.lib.concatMapStrings (j: ''
           cp -v ${j} $out/share/java
         '') jars }
+
+      . ${./functions.sh}
      for j in $out/share/java/*.jar ; do
+        canonicalizeJar $j
        echo file jar $j >> $out/nix-support/hydra-build-products
      done
    '';
@ -95,7 +100,7 @@ stdenv.mkDerivation (
  {
    name = name + (if src ? version then "-" + src.version else "");
  
-    buildInputs = [ant jre] ++ stdenv.lib.optional (args ? buildInputs) args.buildInputs ;
+    buildInputs = [ant jre zip unzip] ++ stdenv.lib.optional (args ? buildInputs) args.buildInputs ;

    postHook = ''
      mkdir -p $out/nix-support
--- a/pkgs/build-support/release/functions.sh
+++ b/pkgs/build-support/release/functions.sh
@ -8,6 +8,29 @@ findTarballs() {
    echo "$1"
 }

+canonicalizeJarManifest() {
+	local input=$1
+	# http://docs.oracle.com/javase/7/docs/technotes/guides/jar/jar.html#Notes_on_Manifest_and_Signature_Files
+	(head -n 1 $input && tail -n +2 $input | sort | grep -v '^\s*$') > $input-tmp
+	mv $input-tmp $input
+}
+
+# Post-process a jar file to contain canonical timestamps and metadata ordering
+canonicalizeJar() {
+	local input=$1
+	local outer=$(pwd)
+	unzip -qq $input -d $input-tmp
+	canonicalizeJarManifest $input-tmp/META-INF/MANIFEST.MF
+	# Set all timestamps to Jan 1 1980, which is the earliest date the zip format supports...
+	find $input-tmp -exec touch -t 198001010000.00 {} +
+	rm $input
+	pushd $input-tmp
+	zip -q -r -o -X $outer/tmp-out.jar . 2> /dev/null
+	popd
+	rm -rf $input-tmp
+	mv $outer/tmp-out.jar $input
+}
+
 propagateImageName() {
    mkdir -p $out/nix-support
    cat "$diskImage"/nix-support/full-name > $out/nix-support/full-name
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@ -1556,22 +1556,22 @@ rec {
    };

    debian60i386 = {
-      name = "debian-6.0.9-squeeze-i386";
-      fullName = "Debian 6.0.9 Squeeze (i386)";
+      name = "debian-6.0.10-squeeze-i386";
+      fullName = "Debian 6.0.10 Squeeze (i386)";
      packagesList = fetchurl {
        url = mirror://debian/dists/squeeze/main/binary-i386/Packages.bz2;
-        sha256 = "1fb9afa9b2d007939e066c031fc60f6626b78105ce42fe8cdeab7124a0dbf477";
+        sha256 = "c08899011a7a2b0df4da08f91eef3a80d112a247df988b1c966c9fb64c812392";
      };
      urlPrefix = mirror://debian;
      packages = commonDebianPackages;
    };

    debian60x86_64 = {
-      name = "debian-6.0.9-squeeze-amd64";
-      fullName = "Debian 6.0.9 Squeeze (amd64)";
+      name = "debian-6.0.10-squeeze-amd64";
+      fullName = "Debian 6.0.10 Squeeze (amd64)";
      packagesList = fetchurl {
        url = mirror://debian/dists/squeeze/main/binary-amd64/Packages.bz2;
-        sha256 = "cee46e56f35342c17795d1923b6c7e545f626e8d568fd48f91d5e0eb92ea329e";
+        sha256 = "3f2ebd5221b9a4bdf7224acf728a51a987c63d32df1bbc20a97f177d2f184045";
      };
      urlPrefix = mirror://debian;
      packages = commonDebianPackages;
--- a/Show more
+++ b/Show more