Merge remote-tracking branch 'upstream/master' into staging

39 files changed, 184 insertions, 657 deletions

diff --git a/nixos/doc/manual/default.nix b/nixos/doc/manual/default.nix
index 2c6309474b37..fef6b2f86c85 100644
--- a/nixos/doc/manual/default.nix
+++ b/nixos/doc/manual/default.nix
@@ -31,11 +31,12 @@ let
                   else p;
       describe = args:
         let
+          title = args.title or null;
           name = args.name or (lib.concatStringsSep "." args.path);
           path = args.path or [ args.name ];
           package = args.package or (lib.attrByPath path (throw "Invalid package attribute path `${toString path}'") pkgs);
         in "<listitem>"
-        + "<para><literal>pkgs.${name} (${package.meta.name})</literal>"
+        + "<para><literal>${lib.optionalString (title != null) "${title} aka "}pkgs.${name} (${package.meta.name})</literal>"
         + lib.optionalString (!package.meta.available) " <emphasis>[UNAVAILABLE]</emphasis>"
         + ": ${package.meta.description or "???"}.</para>"
         + lib.optionalString (args ? comment) "\n<para>${args.comment}</para>"
@@ -51,7 +52,7 @@ let
   // lib.optionalAttrs (opt ? example) { example = substFunction opt.example; }
   // lib.optionalAttrs (opt ? default) { default = substFunction opt.default; }
   // lib.optionalAttrs (opt ? type) { type = substFunction opt.type; }
-  // lib.optionalAttrs (opt ? relatedPackages) { relatedPackages = genRelatedPackages opt.relatedPackages; });
+  // lib.optionalAttrs (opt ? relatedPackages && opt.relatedPackages != []) { relatedPackages = genRelatedPackages opt.relatedPackages; });
 
   # We need to strip references to /nix/store/* from options,
   # including any `extraSources` if some modules came from elsewhere,
diff --git a/nixos/modules/services/security/tor.nix b/nixos/modules/services/security/tor.nix
index 806252f49b8d..c2de1c45a397 100644
--- a/nixos/modules/services/security/tor.nix
+++ b/nixos/modules/services/security/tor.nix
@@ -39,7 +39,7 @@ let
     ''}
 
     ${optint "ControlPort" cfg.controlPort}
-    ${optionalString cfg.controlSocket.enable "ControlSocket ${torRunDirectory}/control GroupWritable RelaxDirModeCheck"}
+    ${optionalString cfg.controlSocket.enable "ControlPort unix:${torRunDirectory}/control GroupWritable RelaxDirModeCheck"}
   ''
   # Client connection config
   + optionalString cfg.client.enable ''
@@ -695,19 +695,38 @@ in
         uid         = config.ids.uids.tor;
       };
 
+    # We have to do this instead of using RuntimeDirectory option in
+    # the service below because systemd has no way to set owners of
+    # RuntimeDirectory and putting this into the service below
+    # requires that service to relax it's sandbox since this needs
+    # writable /run
+    systemd.services.tor-init =
+      { description = "Tor Daemon Init";
+        wantedBy = [ "tor.service" ];
+        after = [ "local-fs.target" ];
+        script = ''
+          install -m 0700 -o tor -g tor -d ${torDirectory} ${torDirectory}/onion
+          install -m 0750 -o tor -g tor -d ${torRunDirectory}
+        '';
+        serviceConfig = {
+          Type = "oneshot";
+          RemainAfterExit = true;
+        };
+      };
+
     systemd.services.tor =
       { description = "Tor Daemon";
         path = [ pkgs.tor ];
 
         wantedBy = [ "multi-user.target" ];
-        after    = [ "network.target" ];
+        after    = [ "tor-init.service" "network.target" ];
         restartTriggers = [ torRcFile ];
 
         serviceConfig =
           { Type         = "simple";
             # Translated from the upstream contrib/dist/tor.service.in
             ExecStartPre = "${pkgs.tor}/bin/tor -f ${torRcFile} --verify-config";
-            ExecStart    = "${pkgs.tor}/bin/tor -f ${torRcFile} --RunAsDaemon 0";
+            ExecStart    = "${pkgs.tor}/bin/tor -f ${torRcFile}";
             ExecReload   = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
             KillSignal   = "SIGINT";
             TimeoutSec   = 30;
@@ -715,20 +734,18 @@ in
             LimitNOFILE  = 32768;
 
             # Hardening
-            # Note: DevicePolicy is set to 'closed', although the
-            # minimal permissions are really:
-            #   DeviceAllow /dev/null rw
-            #   DeviceAllow /dev/urandom r
-            # .. but we can't specify DeviceAllow multiple times. 'closed'
-            # is close enough.
-            RuntimeDirectory        = "tor";
-            StateDirectory          = [ "tor" "tor/onion" ];
-            PrivateTmp              = "yes";
-            DevicePolicy            = "closed";
-            InaccessibleDirectories = "/home";
-            ReadOnlyDirectories     = "/";
-            ReadWriteDirectories    = [torDirectory torRunDirectory];
+            # this seems to unshare /run despite what systemd.exec(5) says
+            PrivateTmp              = mkIf (!cfg.controlSocket.enable) "yes";
+            PrivateDevices          = "yes";
+            ProtectHome             = "yes";
+            ProtectSystem           = "strict";
+            InaccessiblePaths       = "/home";
+            ReadOnlyPaths           = "/";
+            ReadWritePaths          = [ torDirectory torRunDirectory ];
             NoNewPrivileges         = "yes";
+
+            # tor.service.in has this in, but this line it fails to spawn a namespace when using hidden services
+            #CapabilityBoundingSet   = "CAP_SETUID CAP_SETGID CAP_NET_BIND_SERVICE";
           };
       };
 
diff --git a/nixos/modules/services/x11/window-managers/awesome.nix b/nixos/modules/services/x11/window-managers/awesome.nix
index 71eb02ec5954..089e9f769f0a 100644
--- a/nixos/modules/services/x11/window-managers/awesome.nix
+++ b/nixos/modules/services/x11/window-managers/awesome.nix
@@ -37,6 +37,11 @@ in
         apply = pkg: if pkg == null then pkgs.awesome else pkg;
       };
 
+      noArgb = mkOption {
+        default = false;
+        type = types.bool;
+        description = "Disable client transparency support, which can be greatly detrimental to performance in some setups";
+      };
     };
 
   };
@@ -50,7 +55,7 @@ in
       { name = "awesome";
         start =
           ''
-            ${awesome}/bin/awesome ${makeSearchPath cfg.luaModules} &
+            ${awesome}/bin/awesome ${lib.optionalString cfg.noArgb "--no-argb"} ${makeSearchPath cfg.luaModules} &
             waitPID=$!
           '';
       };
diff --git a/nixos/modules/services/x11/xserver.nix b/nixos/modules/services/x11/xserver.nix
index 1404231f837e..3048cd02683f 100644
--- a/nixos/modules/services/x11/xserver.nix
+++ b/nixos/modules/services/x11/xserver.nix
@@ -244,6 +244,13 @@ in
           "ati_unfree" "amdgpu" "amdgpu-pro"
           "nv" "nvidia" "nvidiaLegacy340" "nvidiaLegacy304"
         ];
+        # TODO(@oxij): think how to easily add the rest, like those nvidia things
+        relatedPackages = concatLists
+          (mapAttrsToList (n: v:
+            optional (hasPrefix "xf86video" n) {
+              path  = [ "xorg" n ];
+              title = removePrefix "xf86video" n;
+            }) pkgs.xorg);
         description = ''
           The names of the video drivers the configuration
           supports. They will be tried in order until one that
diff --git a/nixos/modules/tasks/filesystems/zfs.nix b/nixos/modules/tasks/filesystems/zfs.nix
index de735e9ba11b..c54cfd4e1aa6 100644
--- a/nixos/modules/tasks/filesystems/zfs.nix
+++ b/nixos/modules/tasks/filesystems/zfs.nix
@@ -414,12 +414,15 @@ in
               ${packages.zfsUser}/sbin/zfs set nixos:shutdown-time="$(date)" "${pool}"
             '';
           };
+        createZfsService = serv:
+          nameValuePair serv {
+            after = [ "systemd-modules-load.service" ];
+            wantedBy = [ "zfs.target" ];
+          };
 
-      in listToAttrs (map createImportService dataPools ++ map createSyncService allPools) // {
-        "zfs-mount" = { after = [ "systemd-modules-load.service" ]; };
-        "zfs-share" = { after = [ "systemd-modules-load.service" ]; };
-        "zfs-zed" = { after = [ "systemd-modules-load.service" ]; };
-      };
+      in listToAttrs (map createImportService dataPools ++
+                      map createSyncService allPools ++
+                      map createZfsService [ "zfs-mount" "zfs-share" "zfs-zed" ]);
 
       systemd.targets."zfs-import" =
         let
diff --git a/nixos/modules/tasks/network-interfaces.nix b/nixos/modules/tasks/network-interfaces.nix
index 14f9b9567515..a3534e10bb17 100644
--- a/nixos/modules/tasks/network-interfaces.nix
+++ b/nixos/modules/tasks/network-interfaces.nix
@@ -46,22 +46,6 @@ let
     '';
   });
 
-  # Collect all interfaces that are defined for a device
-  # as device:interface key:value pairs.
-  wlanDeviceInterfaces =
-    let
-      allDevices = unique (mapAttrsToList (_: v: v.device) cfg.wlanInterfaces);
-      interfacesOfDevice = d: filterAttrs (_: v: v.device == d) cfg.wlanInterfaces;
-    in
-      genAttrs allDevices (d: interfacesOfDevice d);
-
-  # Convert device:interface key:value pairs into a list, and if it exists,
-  # place the interface which is named after the device at the beginning.
-  wlanListDeviceFirst = device: interfaces:
-    if hasAttr device interfaces
-    then mapAttrsToList (n: v: v//{_iName=n;}) (filterAttrs (n: _: n==device) interfaces) ++ mapAttrsToList (n: v: v//{_iName=n;}) (filterAttrs (n: _: n!=device) interfaces)
-    else mapAttrsToList (n: v: v // {_iName = n;}) interfaces;
-
   # We must escape interfaces due to the systemd interpretation
   subsystemDevice = interface:
     "sys-subsystem-net-devices-${escapeSystemdPath interface}.device";
diff --git a/pkgs/applications/graphics/avocode/default.nix b/pkgs/applications/graphics/avocode/default.nix
index 89a728f1a997..9f9e965c6a91 100644
--- a/pkgs/applications/graphics/avocode/default.nix
+++ b/pkgs/applications/graphics/avocode/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   name = "avocode-${version}";
-  version = "2.26.4";
+  version = "3.0.0";
 
   src = fetchurl {
     url = "https://media.avocode.com/download/avocode-app/${version}/avocode-${version}-linux.zip";
-    sha256 = "0qbir023zyd53ly6y8zcm3kbhbhjjpclcgp9d0mqb5lc9zajxv12";
+    sha256 = "1lm0zzqhnk5gm68l8fkmlkh3gl71f1xw0amy23460a7hm9wcwjr7";
   };
 
   libPath = stdenv.lib.makeLibraryPath (with xorg; with gnome2; [
diff --git a/pkgs/applications/misc/xmr-stak/default.nix b/pkgs/applications/misc/xmr-stak/default.nix
index 5dcaeb1226e5..05530af12547 100644
--- a/pkgs/applications/misc/xmr-stak/default.nix
+++ b/pkgs/applications/misc/xmr-stak/default.nix
@@ -12,13 +12,13 @@ in
 
 stdenv'.mkDerivation rec {
   name = "xmr-stak-${version}";
-  version = "2.4.4";
+  version = "2.4.5";
 
   src = fetchFromGitHub {
     owner = "fireice-uk";
     repo = "xmr-stak";
     rev = "${version}";
-    sha256 = "1j75466hfs18w05k64yb60pw865ah226vjib46qr1wb1mcd82i5s";
+    sha256 = "0ix4vqhcm4x9j5p6pwdfwkm2ml6wmwsyn3ppzvxllhp4dj8blzwf";
   };
 
   NIX_CFLAGS_COMPILE = "-O3";
diff --git a/pkgs/applications/networking/cluster/terraform-provider-ibm/default.nix b/pkgs/applications/networking/cluster/terraform-provider-ibm/default.nix
index 304df0947acf..66bf20c2b843 100644
--- a/pkgs/applications/networking/cluster/terraform-provider-ibm/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-provider-ibm/default.nix
@@ -12,7 +12,7 @@
 
 buildGoPackage rec {
   name = "terraform-provider-ibm-${version}";
-  version = "0.9.1";
+  version = "0.10.0";
 
   goPackagePath = "github.com/terraform-providers/terraform-provider-ibm";
   subPackages = [ "./" ];
@@ -20,7 +20,7 @@ buildGoPackage rec {
   src = fetchFromGitHub {
     owner = "IBM-Cloud";
     repo = "terraform-provider-ibm";
-    sha256 = "1j8v7r5lsvrg1afdbwxi8vq665qr47a9pddqgmpkirh99pzixgr6";
+    sha256 = "03drvhhh6pkk8yzzp8iiq478kcky9swxvxadxzxh0v4jzdprg9lr";
     rev = "v${version}";
   };
 
diff --git a/pkgs/desktops/gnome-3/apps/gnome-documents/default.nix b/pkgs/desktops/gnome-3/apps/gnome-documents/default.nix
index 3bd3222dc0c2..7db21d9e7483 100644
--- a/pkgs/desktops/gnome-3/apps/gnome-documents/default.nix
+++ b/pkgs/desktops/gnome-3/apps/gnome-documents/default.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation rec {
   name = "gnome-documents-${version}";
-  version = "3.28.0";
+  version = "3.28.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-documents/${gnome3.versionBranch version}/${name}.tar.xz";
-    sha256 = "174q59gk9j0083bvv8sd2k66xrd4lydy2rcqbwsbzsy22fbhwcha";
+    sha256 = "1i0s246bg9xcjxgbajph744pn65bq5gk6r9kkl3f5iwdq3rjc0pm";
   };
 
   doCheck = true;
diff --git a/pkgs/desktops/gnome-3/core/epiphany/default.nix b/pkgs/desktops/gnome-3/core/epiphany/default.nix
index f55be458addf..9613606f777a 100644
--- a/pkgs/desktops/gnome-3/core/epiphany/default.nix
+++ b/pkgs/desktops/gnome-3/core/epiphany/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   name = "epiphany-${version}";
-  version = "3.28.2.1";
+  version = "3.28.3.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/epiphany/${gnome3.versionBranch version}/${name}.tar.xz";
-    sha256 = "0ba0qqsbg3cv1k1pcj971y7l8kqib5l7kbr743x9a7hbmkqfk95s";
+    sha256 = "1xz6xl6b0iihvczyr0cs1z5ifvpai6anb4m0ng1caiph06klc1b9";
   };
 
   # Tests need an X display
diff --git a/pkgs/development/compilers/ghcjs-ng/default.nix b/pkgs/development/compilers/ghcjs-ng/default.nix
index 6e883aeafe83..dda414620e0b 100644
--- a/pkgs/development/compilers/ghcjs-ng/default.nix
+++ b/pkgs/development/compilers/ghcjs-ng/default.nix
@@ -47,6 +47,8 @@ let
     # Relics of the old GHCJS build system
     stage1Packages = [];
     mkStage2 = _: {};
+
+    haskellCompilerName = "ghcjs";
   };
 
   bootGhcjs = haskellLib.justStaticExecutables passthru.bootPkgs.ghcjs;
diff --git a/pkgs/development/compilers/llvm/3.7/libc++abi.nix b/pkgs/development/compilers/llvm/3.7/libc++abi.nix
index d2be57b1a5fa..2c79d7b3b1b5 100644
--- a/pkgs/development/compilers/llvm/3.7/libc++abi.nix
+++ b/pkgs/development/compilers/llvm/3.7/libc++abi.nix
@@ -11,7 +11,8 @@ in stdenv.mkDerivation {
 
   src = fetch "libcxxabi" "0ambfcmr2nh88hx000xb7yjm9lsqjjz49w5mlf6dlxzmj3nslzx4";
 
-  buildInputs = [ cmake ] ++ stdenv.lib.optional (!stdenv.isDarwin && !stdenv.isFreeBSD) libunwind;
+  nativeBuildInputs = [ cmake ];
+  buildInputs = stdenv.lib.optional (!stdenv.isDarwin && !stdenv.isFreeBSD) libunwind;
 
   postUnpack = ''
     unpackFile ${libcxx.src}
diff --git a/pkgs/development/compilers/llvm/3.8/default.nix b/pkgs/development/compilers/llvm/3.8/default.nix
index 6fa1a0cf2e26..3f0cd7d0a763 100644
--- a/pkgs/development/compilers/llvm/3.8/default.nix
+++ b/pkgs/development/compilers/llvm/3.8/default.nix
@@ -20,7 +20,6 @@ let
  in {
     llvm = callPackage ./llvm.nix {
       inherit compiler-rt_src;
-      inherit (targetLlvmLibraries) libcxxabi;
     };
 
     clang-unwrapped = callPackage ./clang {
diff --git a/pkgs/development/compilers/llvm/3.8/libc++abi.nix b/pkgs/development/compilers/llvm/3.8/libc++abi.nix
index 6b98a5726cf6..45fb7b5be4f6 100644
--- a/pkgs/development/compilers/llvm/3.8/libc++abi.nix
+++ b/pkgs/development/compilers/llvm/3.8/libc++abi.nix
@@ -5,7 +5,8 @@ stdenv.mkDerivation {
 
   src = fetch "libcxxabi" "1qfs2iis1i0ppv11jndc98cvd7s25pj46pq2sfyldmzswdxmzdg1";
 
-  buildInputs = [ cmake ] ++ stdenv.lib.optional (!stdenv.isDarwin && !stdenv.isFreeBSD) libunwind;
+  nativeBuildInputs = [ cmake ];
+  buildInputs = stdenv.lib.optional (!stdenv.isDarwin && !stdenv.isFreeBSD) libunwind;
 
   postUnpack = ''
     unpackFile ${libcxx.src}
diff --git a/pkgs/development/compilers/llvm/3.8/llvm.nix b/pkgs/development/compilers/llvm/3.8/llvm.nix
index 0f259977f702..2c65234b6a47 100644
--- a/pkgs/development/compilers/llvm/3.8/llvm.nix
+++ b/pkgs/development/compilers/llvm/3.8/llvm.nix
@@ -13,7 +13,6 @@
 , version
 , zlib
 , compiler-rt_src
-, libcxxabi
 , debugVersion ? false
 , enableSharedLibraries ? true
 }:
@@ -31,8 +30,7 @@ in stdenv.mkDerivation rec {
     mv compiler-rt-* $sourceRoot/projects/compiler-rt
   '';
 
-  buildInputs = [ perl groff cmake libxml2 python libffi ]
-    ++ stdenv.lib.optional stdenv.isDarwin libcxxabi;
+  buildInputs = [ perl groff cmake libxml2 python libffi ];
 
   propagatedBuildInputs = [ ncurses zlib ];
 
diff --git a/pkgs/development/compilers/llvm/3.9/default.nix b/pkgs/development/compilers/llvm/3.9/default.nix
index c3bf0b48d649..3735fb6a02c0 100644
--- a/pkgs/development/compilers/llvm/3.9/default.nix
+++ b/pkgs/development/compilers/llvm/3.9/default.nix
@@ -20,7 +20,6 @@ let
   in {
     llvm = callPackage ./llvm.nix {
       inherit compiler-rt_src;
-      inherit (targetLlvmLibraries) libcxxabi;
     };
 
     clang-unwrapped = callPackage ./clang {
diff --git a/pkgs/development/compilers/llvm/3.9/libc++abi.nix b/pkgs/development/compilers/llvm/3.9/libc++abi.nix
index 65345ca69925..dc508757ab6d 100644
--- a/pkgs/development/compilers/llvm/3.9/libc++abi.nix
+++ b/pkgs/development/compilers/llvm/3.9/libc++abi.nix
@@ -6,7 +6,6 @@ stdenv.mkDerivation {
   src = fetch "libcxxabi" "1qi9q06zanqm8awzq83810avmvi52air6gr9zfip8mbg5viqn3cj";
 
   nativeBuildInputs = [ cmake ];
-
   buildInputs = stdenv.lib.optional (!stdenv.isDarwin && !stdenv.isFreeBSD) libunwind;
 
   postUnpack = ''
diff --git a/pkgs/development/compilers/llvm/3.9/llvm.nix b/pkgs/development/compilers/llvm/3.9/llvm.nix
index f80201167505..71b67aa7dc57 100644
--- a/pkgs/development/compilers/llvm/3.9/llvm.nix
+++ b/pkgs/development/compilers/llvm/3.9/llvm.nix
@@ -13,7 +13,6 @@
 , version
 , zlib
 , compiler-rt_src
-, libcxxabi
 , debugVersion ? false
 , enableSharedLibraries ? (buildPlatform == hostPlatform)
 , darwin
@@ -53,7 +52,7 @@ in stdenv.mkDerivation rec {
     groff
     libxml2
     libffi
-  ] ++ stdenv.lib.optionals stdenv.isDarwin [ libcxxabi ];
+  ];
 
   propagatedBuildInputs = [ ncurses zlib ];
 
diff --git a/pkgs/development/compilers/llvm/4/default.nix b/pkgs/development/compilers/llvm/4/default.nix
index fecf65136bcd..c46e520a33df 100644
--- a/pkgs/development/compilers/llvm/4/default.nix
+++ b/pkgs/development/compilers/llvm/4/default.nix
@@ -28,7 +28,6 @@ let
 
     llvm = overrideManOutput (callPackage ./llvm.nix {
       inherit compiler-rt_src;
-      inherit (targetLlvmLibraries) libcxxabi;
     });
     clang-unwrapped = overrideManOutput (callPackage ./clang {
       inherit clang-tools-extra_src;
diff --git a/pkgs/development/compilers/llvm/4/llvm.nix b/pkgs/development/compilers/llvm/4/llvm.nix
index bc8453f743ad..a371296db326 100644
--- a/pkgs/development/compilers/llvm/4/llvm.nix
+++ b/pkgs/development/compilers/llvm/4/llvm.nix
@@ -12,7 +12,6 @@
 , release_version
 , zlib
 , compiler-rt_src
-, libcxxabi
 , debugVersion ? false
 , enableManpages ? false
 , enableSharedLibraries ? true
@@ -42,8 +41,7 @@ in stdenv.mkDerivation (rec {
   nativeBuildInputs = [ cmake python ]
     ++ stdenv.lib.optional enableManpages python.pkgs.sphinx;
 
-  buildInputs = [ libxml2 libffi ]
-    ++ stdenv.lib.optionals stdenv.isDarwin [ libcxxabi ];
+  buildInputs = [ libxml2 libffi ];
 
   propagatedBuildInputs = [ ncurses zlib ];
 
diff --git a/pkgs/development/compilers/llvm/5/llvm.nix b/pkgs/development/compilers/llvm/5/llvm.nix
index 66985861e386..5070de1f48b1 100644
--- a/pkgs/development/compilers/llvm/5/llvm.nix
+++ b/pkgs/development/compilers/llvm/5/llvm.nix
@@ -43,7 +43,8 @@ in stdenv.mkDerivation (rec {
     ++ stdenv.lib.optional enableManpages python.pkgs.sphinx;
 
   buildInputs = [ libxml2 libffi ]
-    ++ stdenv.lib.optionals stdenv.isDarwin [ libcxxabi ];
+    # TODO(@Ericson2314): Remove next mass rebuild
+    ++ stdenv.lib.optionals (stdenv.isDarwin && stdenv.hostPlatform == stdenv.buildPlatform) [ libcxxabi ];
 
   propagatedBuildInputs = [ ncurses zlib ];
 
diff --git a/pkgs/development/compilers/llvm/6/default.nix b/pkgs/development/compilers/llvm/6/default.nix
index 17c743c04082..bbac21ef6796 100644
--- a/pkgs/development/compilers/llvm/6/default.nix
+++ b/pkgs/development/compilers/llvm/6/default.nix
@@ -25,9 +25,7 @@ let
     callPackage = newScope (tools // { inherit stdenv cmake libxml2 python2 isl release_version version fetch; });
   in {
 
-    llvm = overrideManOutput (callPackage ./llvm.nix {
-      inherit (targetLlvmLibraries) libcxxabi;
-    });
+    llvm = overrideManOutput (callPackage ./llvm.nix { });
     clang-unwrapped = overrideManOutput (callPackage ./clang {
       inherit clang-tools-extra_src;
     });
diff --git a/pkgs/development/compilers/llvm/6/llvm.nix b/pkgs/development/compilers/llvm/6/llvm.nix
index 8877ccd11621..9cae65ef1030 100644
--- a/pkgs/development/compilers/llvm/6/llvm.nix
+++ b/pkgs/development/compilers/llvm/6/llvm.nix
@@ -11,7 +11,6 @@
 , version
 , release_version
 , zlib
-, libcxxabi
 , debugVersion ? false
 , enableManpages ? false
 , enableSharedLibraries ? true
@@ -40,8 +39,7 @@ in stdenv.mkDerivation (rec {
   nativeBuildInputs = [ cmake python ]
     ++ stdenv.lib.optional enableManpages python.pkgs.sphinx;
 
-  buildInputs = [ libxml2 libffi ]
-    ++ stdenv.lib.optionals stdenv.isDarwin [ libcxxabi ];
+  buildInputs = [ libxml2 libffi ];
 
   propagatedBuildInputs = [ ncurses zlib ];
 
diff --git a/pkgs/development/libraries/flatpak/default.nix b/pkgs/development/libraries/flatpak/default.nix
index f26dad3ce15e..eeaa1e324961 100644
--- a/pkgs/development/libraries/flatpak/default.nix
+++ b/pkgs/development/libraries/flatpak/default.nix
@@ -4,7 +4,7 @@
 , libsoup, lzma, ostree, polkit, python3, systemd, xlibs, valgrind, glib_networking, makeWrapper, gnome3 }:
 
 let
-  version = "0.11.7";
+  version = "0.11.8.2";
   desktop_schemas = gnome3.gsettings_desktop_schemas;
 in stdenv.mkDerivation rec {
   name = "flatpak-${version}";
@@ -13,7 +13,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://github.com/flatpak/flatpak/releases/download/${version}/${name}.tar.xz";
-    sha256 = "1vq4j7v68lp4fsvpas1bcsx1z4snpj0mkbq2mi00kx3jb48z768h";
+    sha256 = "03c2fx0y7irvws25858x217xmbacn2vfdypf8vc32hkrbh9i6df7";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/flatpak/fix-test-paths.patch b/pkgs/development/libraries/flatpak/fix-test-paths.patch
index a548f3882864..0c2b7da79eb3 100644
--- a/pkgs/development/libraries/flatpak/fix-test-paths.patch
+++ b/pkgs/development/libraries/flatpak/fix-test-paths.patch
@@ -1,6 +1,6 @@
 --- a/tests/libtest.sh
 +++ b/tests/libtest.sh
-@@ -322,7 +322,7 @@
+@@ -324,7 +324,7 @@
          # running installed-tests: assume we know what we're doing
          :
      elif ! "$FLATPAK_BWRAP" --unshare-ipc --unshare-net --unshare-pid \
@@ -9,7 +9,7 @@
          sed -e 's/^/# /' < bwrap-result
          echo "1..0 # SKIP Cannot run bwrap"
          exit 0
-@@ -330,7 +330,7 @@
+@@ -332,7 +332,7 @@
  }
  
  skip_without_python2 () {
@@ -18,7 +18,7 @@
          echo "1..0 # SKIP this test requires /usr/bin/python2 (2.7) support"
          exit 0
      fi
-@@ -350,12 +350,12 @@
+@@ -352,12 +352,12 @@
  export DBUS_SESSION_BUS_ADDRESS="$(cat dbus-session-bus-address)"
  DBUS_SESSION_BUS_PID="$(cat dbus-session-bus-pid)"
  
@@ -28,30 +28,51 @@
  fi
  
  cleanup () {
--    /bin/kill $DBUS_SESSION_BUS_PID ${FLATPAK_HTTP_PID:-}
-+    @coreutils@/bin/kill $DBUS_SESSION_BUS_PID ${FLATPAK_HTTP_PID:-}
+-    /bin/kill -9 $DBUS_SESSION_BUS_PID ${FLATPAK_HTTP_PID:-}
++    @coreutils@/bin/kill -9 $DBUS_SESSION_BUS_PID ${FLATPAK_HTTP_PID:-}
      gpg-connect-agent --homedir "${FL_GPG_HOMEDIR}" killagent /bye || true
      fusermount -u $XDG_RUNTIME_DIR/doc || :
      if test -n "${TEST_SKIP_CLEANUP:-}"; then
 --- a/tests/make-test-runtime.sh
 +++ b/tests/make-test-runtime.sh
-@@ -21,6 +21,7 @@
- cat ${DIR}/metadata
+@@ -26,6 +26,7 @@
+ PATH="$PATH:/usr/sbin:/sbin"
  
  # Add bash and dependencies
 +mkdir -p ${DIR}/nix/store
  mkdir -p ${DIR}/usr/bin
  mkdir -p ${DIR}/usr/lib
  ln -s ../lib ${DIR}/usr/lib64
-@@ -30,47 +31,27 @@
+@@ -35,73 +36,27 @@
  else
      cp `which ldconfig` ${DIR}/usr/bin
  fi
--T=`mktemp`
--for i in $@; do
+-LIBS=`mktemp`
+-BINS=`mktemp`
+-
+-add_bin() {
+-    local f=$1
+-    shift
+-
+-    if grep -qFe "${f}" $BINS; then
+-        # Already handled
+-        return 0
+-    fi
+-
+-    echo $f >> $BINS
+-
+-    # Add library dependencies
+-    (ldd "${f}" | sed "s/.* => //"  | awk '{ print $1}' | grep ^/ | sort -u -o $LIBS $LIBS -)  || true
+-
+-    local shebang=$(sed -n '1s/^#!\([^ ]*\).*/\1/p' "${f}")
+-    if [ x$shebang != x ]; then
+-        add_bin "$shebang"
+-    fi
+-}
+-
+ for i in $@; do
 -    I=`which $i`
--    cp $I ${DIR}/usr/bin
--    ldd $I | sed "s/.* => //"  | awk '{ print $1}' | grep ^/ | grep ^/ >> $T
+-    add_bin $I
 -    if test $i == python2; then
 -        mkdir -p ${DIR}/usr/lib/python2.7/lib-dynload
 -        # This is a hardcoded minimal set of modules we need in the current tests.
@@ -78,10 +99,13 @@
 -        done
 -    fi
 -done
- ln -s bash ${DIR}/usr/bin/sh
--for i in `sort -u $T`; do
+-for i in `cat $BINS`; do
+-    echo Adding binary $i 1>&2
+-    cp "$i" ${DIR}/usr/bin/
+-done
+-for i in `cat $LIBS`; do
+-    echo Adding library $i 1>&2
 -    cp "$i" ${DIR}/usr/lib/
-+for i in $@; do
 +    I=$(readlink -f $(which $i))
 +    requisites=$(nix-store --query --requisites "$I")
 +    for r in $requisites; do
@@ -92,6 +116,7 @@
 +    done
 +    ln -s $I ${DIR}/usr/bin/$i
  done
+ ln -s bash ${DIR}/usr/bin/sh
  
 -# We copy the C.UTF8 locale and call it en_US. Its a bit of a lie, but
 -# the real en_US locale is often not available, because its in the
@@ -110,7 +135,7 @@
      collection_args=--collection-id=${COLLECTION_ID}
 --- a/tests/testlibrary.c
 +++ b/tests/testlibrary.c
-@@ -378,7 +378,7 @@
+@@ -610,7 +610,7 @@
      {
        gint exit_code = 0;
        char *argv[] = { (char *)bwrap, "--unshare-ipc", "--unshare-net",
diff --git a/pkgs/development/mobile/androidenv/androidndk-pkgs.nix b/pkgs/development/mobile/androidenv/androidndk-pkgs.nix
index 1323466ea865..9541d62e1601 100644
--- a/pkgs/development/mobile/androidenv/androidndk-pkgs.nix
+++ b/pkgs/development/mobile/androidenv/androidndk-pkgs.nix
@@ -110,7 +110,8 @@ rec {
       mkdir -p $out
       cp -r ${includePath} $out/include
       chmod +w $out/include
-      ${lib.optionalString (lib.versionOlder buildAndroidndk.version "10e") "ln -s $out/include/${targetInfo.triple}/asm $out/include/asm"}
+      ${lib.optionalString (lib.versionOlder "10e" buildAndroidndk.version)
+        "ln -s $out/include/${hostInfo.triple}/asm $out/include/asm"}
       ln -s ${libPath} $out/lib
     '';
 }
diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix
index ecef71fd604f..999952dba699 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.4.136";
+  version = "4.4.137";
   extraMeta.branch = "4.4";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0svb6qbhc376jk26r67qssh7lradx63s60qlm1q2kd4xjhxyj5a3";
+    sha256 = "01hjnwfrx0fr9zbd6qcqfxsp0xm34ai7k49i7ndxwcrhzdipkl9i";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
index bcc4aad7fccb..d9b821b8f15f 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.9.107";
+  version = "4.9.108";
   extraMeta.branch = "4.9";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1lya48grdgjjbzw8x5kvvblanfas23dcmchysnhwv5p0rq7g9rrw";
+    sha256 = "0ha0bvjfxz6nx3nrcrpciqlrphy318xi04lv4k7jr5hpialjpzkk";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/zfs/default.nix b/pkgs/os-specific/linux/zfs/default.nix
index 232d647e1220..c44d64b8fa81 100644
--- a/pkgs/os-specific/linux/zfs/default.nix
+++ b/pkgs/os-specific/linux/zfs/default.nix
@@ -77,7 +77,7 @@ let
         substituteInPlace ./cmd/zed/Makefile.am       --replace "\$(sysconfdir)"          "$out/etc"
         substituteInPlace ./module/Makefile.in        --replace "/bin/cp"                 "cp"
         substituteInPlace ./etc/systemd/system/zfs-share.service.in \
-          --replace "@bindir@/rm " "${coreutils}/bin/rm "
+          --replace "/bin/rm " "${coreutils}/bin/rm "
 
         for f in ./udev/rules.d/*
         do
diff --git a/pkgs/shells/powershell/default.nix b/pkgs/shells/powershell/default.nix
index 937494916112..a053884bb885 100644
--- a/pkgs/shells/powershell/default.nix
+++ b/pkgs/shells/powershell/default.nix
@@ -1,5 +1,5 @@
-{ stdenv, fetchgit, autoPatchelfHook, fetchzip, libunwind, libuuid, icu, curl, cacert,
-  makeWrapper, less, openssl }:
+{ stdenv, fetchgit, autoPatchelfHook, fetchzip, libunwind, libuuid, icu, curl,
+  makeWrapper, less, openssl, pam, lttng-ust }:
 
 let platformString = if stdenv.isDarwin then "osx"
                      else if stdenv.isLinux then "linux"
@@ -10,6 +10,7 @@ let platformString = if stdenv.isDarwin then "osx"
     platformLdLibraryPath = if stdenv.isDarwin then "DYLD_FALLBACK_LIBRARY_PATH"
                      else if stdenv.isLinux then "LD_LIBRARY_PATH"
                      else throw "unsupported platform";
+    libraries = [ libunwind libuuid icu curl openssl lttng-ust ] ++ (if stdenv.isLinux then [ pam ] else []);
 in
 stdenv.mkDerivation rec {
   name = "powershell-${version}";
@@ -21,8 +22,8 @@ stdenv.mkDerivation rec {
     stripRoot = false;
   };
 
-  buildInputs = [ autoPatchelfHook makeWrapper ];
-  propagatedBuildInputs = [ libunwind libuuid icu curl cacert less openssl ];
+  buildInputs = [ less ] ++ libraries;
+  nativeBuildInputs = [ autoPatchelfHook makeWrapper ];
 
   # TODO: remove PAGER after upgrading to v6.1.0-preview.1 or later as it has been addressed in
   # https://github.com/PowerShell/PowerShell/pull/6144
@@ -31,7 +32,7 @@ stdenv.mkDerivation rec {
     mkdir -p $out/share/powershell
     cp -r * $out/share/powershell
     rm $out/share/powershell/DELETE_ME_TO_DISABLE_CONSOLEHOST_TELEMETRY
-    makeWrapper $out/share/powershell/pwsh $out/bin/pwsh --prefix ${platformLdLibraryPath} : "${stdenv.lib.makeLibraryPath [ libunwind libuuid icu openssl curl ]}" \
+    makeWrapper $out/share/powershell/pwsh $out/bin/pwsh --prefix ${platformLdLibraryPath} : "${stdenv.lib.makeLibraryPath libraries}" \
                                            --set PAGER ${less}/bin/less --set TERM xterm
   '';
 
diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index 951c96877f96..57b59f26204c 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -275,10 +275,9 @@ in rec {
         libcxxabi libcxx ncurses libffi zlib gmp pcre gnugrep
         coreutils findutils diffutils patchutils;
 
-       llvmPackages = let llvmOverride = llvmPackages.llvm.override { inherit libcxxabi; };
-       in super.llvmPackages // {
-         llvm = llvmOverride;
-         clang-unwrapped = llvmPackages.clang-unwrapped.override { llvm = llvmOverride; };
+       llvmPackages_5 = super.llvmPackages_5 // {
+         llvm = llvmPackages_5.llvm.override { inherit libcxxabi; };
+         clang-unwrapped = llvmPackages_5.clang-unwrapped.override { llvm = self.llvmPackages_5.llvm; };
        };
 
       darwin = super.darwin // {
@@ -314,8 +313,8 @@ in rec {
         libcxxabi libcxx ncurses libffi zlib llvm gmp pcre gnugrep
         coreutils findutils diffutils patchutils;
 
-      llvmPackages = super.llvmPackages // {
-        inherit (llvmPackages) llvm clang-unwrapped;
+      llvmPackages_5 = super.llvmPackages_5 // {
+        inherit (llvmPackages_5) llvm clang-unwrapped;
       };
 
       darwin = super.darwin // {
diff --git a/pkgs/tools/misc/fzf/default.nix b/pkgs/tools/misc/fzf/default.nix
index d9da04c1fa1b..ba85c5376db1 100644
--- a/pkgs/tools/misc/fzf/default.nix
+++ b/pkgs/tools/misc/fzf/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   name = "fzf-${version}";
-  version = "0.17.3";
+  version = "0.17.4";
   rev = "${version}";
 
   goPackagePath = "github.com/junegunn/fzf";
@@ -11,7 +11,7 @@ buildGoPackage rec {
     inherit rev;
     owner = "junegunn";
     repo = "fzf";
-    sha256 = "1wsyykvnss5r0sx344kjbprnb87849462p9rg9xj37cp7qzciwdn";
+    sha256 = "10k21v9x82imly36lgra8a7rlvz5a1jd49db16g9xc11wx7cdg8g";
   };
 
   outputs = [ "bin" "out" "man" ];
diff --git a/pkgs/tools/misc/riemann-tools/Gemfile b/pkgs/tools/misc/riemann-tools/Gemfile
index 3d56cd85c617..ac6abd42c895 100644
--- a/pkgs/tools/misc/riemann-tools/Gemfile
+++ b/pkgs/tools/misc/riemann-tools/Gemfile
@@ -1,3 +1,3 @@
 source 'https://rubygems.org'
 
-gem "riemann-tools", "0.2.6"
+gem "riemann-tools", "0.2.13"
diff --git a/pkgs/tools/misc/riemann-tools/Gemfile.lock b/pkgs/tools/misc/riemann-tools/Gemfile.lock
index 58c12fd51516..9fc17ccea56a 100644
--- a/pkgs/tools/misc/riemann-tools/Gemfile.lock
+++ b/pkgs/tools/misc/riemann-tools/Gemfile.lock
@@ -1,142 +1,24 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    CFPropertyList (2.3.1)
-    beefcake (1.1.0)
-    builder (3.2.2)
-    excon (0.45.3)
-    faraday (0.9.1)
-      multipart-post (>= 1.2, < 3)
-    fission (0.5.0)
-      CFPropertyList (~> 2.2)
-    fog (1.31.0)
-      fog-atmos
-      fog-aws (~> 0.0)
-      fog-brightbox (~> 0.4)
-      fog-core (~> 1.30)
-      fog-ecloud
-      fog-google (>= 0.0.2)
-      fog-json
-      fog-local
-      fog-powerdns (>= 0.1.1)
-      fog-profitbricks
-      fog-radosgw (>= 0.0.2)
-      fog-riakcs
-      fog-sakuracloud (>= 0.0.4)
-      fog-serverlove
-      fog-softlayer
-      fog-storm_on_demand
-      fog-terremark
-      fog-vmfusion
-      fog-voxel
-      fog-xml (~> 0.1.1)
-      ipaddress (~> 0.5)
-      nokogiri (~> 1.5, >= 1.5.11)
-    fog-atmos (0.1.0)
-      fog-core
-      fog-xml
-    fog-aws (0.6.0)
-      fog-core (~> 1.27)
-      fog-json (~> 1.0)
-      fog-xml (~> 0.1)
-      ipaddress (~> 0.8)
-    fog-brightbox (0.7.2)
-      fog-core (~> 1.22)
-      fog-json
-      inflecto (~> 0.0.2)
-    fog-core (1.31.1)
-      builder
-      excon (~> 0.45)
-      formatador (~> 0.2)
-      mime-types
-      net-scp (~> 1.1)
-      net-ssh (>= 2.1.3)
-    fog-ecloud (0.3.0)
-      fog-core
-      fog-xml
-    fog-google (0.0.6)
-      fog-core
-      fog-json
-      fog-xml
-    fog-json (1.0.2)
-      fog-core (~> 1.0)
-      multi_json (~> 1.10)
-    fog-local (0.2.1)
-      fog-core (~> 1.27)
-    fog-powerdns (0.1.1)
-      fog-core (~> 1.27)
-      fog-json (~> 1.0)
-      fog-xml (~> 0.1)
-    fog-profitbricks (0.0.3)
-      fog-core
-      fog-xml
-      nokogiri
-    fog-radosgw (0.0.4)
-      fog-core (>= 1.21.0)
-      fog-json
-      fog-xml (>= 0.0.1)
-    fog-riakcs (0.1.0)
-      fog-core
-      fog-json
-      fog-xml
-    fog-sakuracloud (1.0.1)
-      fog-core
-      fog-json
-    fog-serverlove (0.1.2)
-      fog-core
-      fog-json
-    fog-softlayer (0.4.7)
-      fog-core
-      fog-json
-    fog-storm_on_demand (0.1.1)
-      fog-core
-      fog-json
-    fog-terremark (0.1.0)
-      fog-core
-      fog-xml
-    fog-vmfusion (0.1.0)
-      fission
-      fog-core
-    fog-voxel (0.1.0)
-      fog-core
-      fog-xml
-    fog-xml (0.1.2)
-      fog-core
-      nokogiri (~> 1.5, >= 1.5.11)
-    formatador (0.2.5)
-    inflecto (0.0.2)
-    ipaddress (0.8.0)
-    mime-types (2.6.1)
-    mini_portile (0.6.2)
+    beefcake (1.0.0)
+    json (1.8.6)
     mtrc (0.0.4)
-    multi_json (1.11.1)
-    multipart-post (2.0.0)
-    munin-ruby (0.2.5)
-    net-scp (1.2.1)
-      net-ssh (>= 2.6.5)
-    net-ssh (2.9.2)
-    nokogiri (1.6.6.2)
-      mini_portile (~> 0.6.0)
-    riemann-client (0.2.5)
-      beefcake (>= 0.3.5)
+    riemann-client (0.2.6)
+      beefcake (>= 0.3.5, <= 1.0.0)
       mtrc (>= 0.0.4)
       trollop (>= 1.16.2)
-    riemann-tools (0.2.6)
-      faraday (>= 0.8.5)
-      fog (>= 1.4.0)
-      munin-ruby (>= 0.2.1)
-      nokogiri (>= 1.5.6)
-      riemann-client (>= 0.2.2)
+    riemann-tools (0.2.13)
+      json (~> 1.8)
+      riemann-client (>= 0.2.6)
       trollop (>= 1.16.2)
-      yajl-ruby (>= 1.1.0)
     trollop (2.1.2)
-    yajl-ruby (1.2.1)
 
 PLATFORMS
   ruby
 
 DEPENDENCIES
-  riemann-tools (= 0.2.6)
+  riemann-tools (= 0.2.13)
 
 BUNDLED WITH
-   1.10.2
+   1.14.6
diff --git a/pkgs/tools/misc/riemann-tools/gemset.nix b/pkgs/tools/misc/riemann-tools/gemset.nix
index 07818fc76bcd..a57139d2f7ca 100644
--- a/pkgs/tools/misc/riemann-tools/gemset.nix
+++ b/pkgs/tools/misc/riemann-tools/gemset.nix
@@ -1,444 +1,52 @@
 {
-  "CFPropertyList" = {
-    version = "2.3.1";
+  beefcake = {
     source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "10gid0a7pdllh3qmjiqkqxgfqvd7m1f2dmcm4gcd19s63pv620gv";
       type = "gem";
-      sha256 = "1wnk3gxnhfafbhgp0ic7qhzlx3lhv04v8nws2s31ii5s8135hs6k";
     };
+    version = "1.0.0";
   };
-  "beefcake" = {
-    version = "1.1.0";
+  json = {
     source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0qmj7fypgb9vag723w1a49qihxrcf5shzars106ynw2zk352gbv5";
       type = "gem";
-      sha256 = "009gzy9jp81lsnxnwisinhc58cd0qljdiipj2701lzzrha5d826z";
     };
+    version = "1.8.6";
   };
-  "builder" = {
-    version = "3.2.2";
+  mtrc = {
     source = {
-      type = "gem";
-      sha256 = "14fii7ab8qszrvsvhz6z2z3i4dw0h41a62fjr2h1j8m41vbrmyv2";
-    };
-  };
-  "excon" = {
-    version = "0.45.3";
-    source = {
-      type = "gem";
-      sha256 = "183kfxfjjlc97w4rxkrxjw3kis4lxm65vppmvl4bkblvlw4nq94j";
-    };
-  };
-  "faraday" = {
-    version = "0.9.1";
-    source = {
-      type = "gem";
-      sha256 = "1h33znnfzxpscgpq28i9fcqijd61h61zgs3gabpdgqfa1043axsn";
-    };
-    dependencies = [
-      "multipart-post"
-    ];
-  };
-  "fission" = {
-    version = "0.5.0";
-    source = {
-      type = "gem";
-      sha256 = "09pmp1j1rr8r3pcmbn2na2ls7s1j9ijbxj99xi3a8r6v5xhjdjzh";
-    };
-    dependencies = [
-      "CFPropertyList"
-    ];
-  };
-  "fog" = {
-    version = "1.31.0";
-    source = {
-      type = "gem";
-      sha256 = "0xr8xyrrkljm2hxi420x4qr5v6wqcj8d63v0qy1g6rkb3b1yhl9i";
-    };
-    dependencies = [
-      "fog-atmos"
-      "fog-aws"
-      "fog-brightbox"
-      "fog-core"
-      "fog-ecloud"
-      "fog-google"
-      "fog-json"
-      "fog-local"
-      "fog-powerdns"
-      "fog-profitbricks"
-      "fog-radosgw"
-      "fog-riakcs"
-      "fog-sakuracloud"
-      "fog-serverlove"
-      "fog-softlayer"
-      "fog-storm_on_demand"
-      "fog-terremark"
-      "fog-vmfusion"
-      "fog-voxel"
-      "fog-xml"
-      "ipaddress"
-      "nokogiri"
-    ];
-  };
-  "fog-atmos" = {
-    version = "0.1.0";
-    source = {
-      type = "gem";
-      sha256 = "1aaxgnw9zy96gsh4h73kszypc32sx497s6bslvhfqh32q9d1y8c9";
-    };
-    dependencies = [
-      "fog-core"
-      "fog-xml"
-    ];
-  };
-  "fog-aws" = {
-    version = "0.6.0";
-    source = {
-      type = "gem";
-      sha256 = "1m79s5ha6qq60pxqqxr9qs9fg8fwaz79sfxckidyhxdydcsjwx6z";
-    };
-    dependencies = [
-      "fog-core"
-      "fog-json"
-      "fog-xml"
-      "ipaddress"
-    ];
-  };
-  "fog-brightbox" = {
-    version = "0.7.2";
-    source = {
-      type = "gem";
-      sha256 = "0636sqaf2w1rh4i2hxfgs24374l4ai8dgch8a7nycqhvjk2dm0aq";
-    };
-    dependencies = [
-      "fog-core"
-      "fog-json"
-      "inflecto"
-    ];
-  };
-  "fog-core" = {
-    version = "1.31.1";
-    source = {
-      type = "gem";
-      sha256 = "1bcsy4cq7vyjmdf3h2v7q6hfj64v6phn0rfvwgj5wfza7yaxnhk7";
-    };
-    dependencies = [
-      "builder"
-      "excon"
-      "formatador"
-      "mime-types"
-      "net-scp"
-      "net-ssh"
-    ];
-  };
-  "fog-ecloud" = {
-    version = "0.3.0";
-    source = {
-      type = "gem";
-      sha256 = "18rb4qjad9xwwqvvpj8r2h0hi9svy71pm4d3fc28cdcnfarmdi06";
-    };
-    dependencies = [
-      "fog-core"
-      "fog-xml"
-    ];
-  };
-  "fog-google" = {
-    version = "0.0.6";
-    source = {
-      type = "gem";
-      sha256 = "1g3ykk239nxpdsr5anhprkp8vzk106gi4q6aqjh4z8q4bii0dflm";
-    };
-    dependencies = [
-      "fog-core"
-      "fog-json"
-      "fog-xml"
-    ];
-  };
-  "fog-json" = {
-    version = "1.0.2";
-    source = {
-      type = "gem";
-      sha256 = "0advkkdjajkym77r3c0bg2rlahl2akj0vl4p5r273k2qmi16n00r";
-    };
-    dependencies = [
-      "fog-core"
-      "multi_json"
-    ];
-  };
-  "fog-local" = {
-    version = "0.2.1";
-    source = {
-      type = "gem";
-      sha256 = "0i5hxwzmc2ag3z9nlligsaf679kp2pz39cd8n2s9cmxaamnlh2s3";
-    };
-    dependencies = [
-      "fog-core"
-    ];
-  };
-  "fog-powerdns" = {
-    version = "0.1.1";
-    source = {
-      type = "gem";
-      sha256 = "08zavzwfkk344gz83phz4sy9nsjznsdjsmn1ifp6ja17bvydlhh7";
-    };
-    dependencies = [
-      "fog-core"
-      "fog-json"
-      "fog-xml"
-    ];
-  };
-  "fog-profitbricks" = {
-    version = "0.0.3";
-    source = {
-      type = "gem";
-      sha256 = "01a3ylfkjkyagf4b4xg9x2v20pzapr3ivn9ydd92v402bjsm1nmr";
-    };
-    dependencies = [
-      "fog-core"
-      "fog-xml"
-      "nokogiri"
-    ];
-  };
-  "fog-radosgw" = {
-    version = "0.0.4";
-    source = {
-      type = "gem";
-      sha256 = "1pxbvmr4dsqx4x2klwnciyhki4r5ryr9y0hi6xmm3n6fdv4ii7k3";
-    };
-    dependencies = [
-      "fog-core"
-      "fog-json"
-      "fog-xml"
-    ];
-  };
-  "fog-riakcs" = {
-    version = "0.1.0";
-    source = {
-      type = "gem";
-      sha256 = "1nbxc4dky3agfwrmgm1aqmi59p6vnvfnfbhhg7xpg4c2cf41whxm";
-    };
-    dependencies = [
-      "fog-core"
-      "fog-json"
-      "fog-xml"
-    ];
-  };
-  "fog-sakuracloud" = {
-    version = "1.0.1";
-    source = {
-      type = "gem";
-      sha256 = "1s16b48kh7y03hjv74ccmlfwhqqq7j7m4k6cywrgbyip8n3258n8";
-    };
-    dependencies = [
-      "fog-core"
-      "fog-json"
-    ];
-  };
-  "fog-serverlove" = {
-    version = "0.1.2";
-    source = {
-      type = "gem";
-      sha256 = "0hxgmwzygrw25rbsy05i6nzsyr0xl7xj5j2sjpkb9n9wli5sagci";
-    };
-    dependencies = [
-      "fog-core"
-      "fog-json"
-    ];
-  };
-  "fog-softlayer" = {
-    version = "0.4.7";
-    source = {
-      type = "gem";
-      sha256 = "0fgfbhqnyp8ywymvflflhvbns54d1432x57pgpnfy8k1cxvhv9b8";
-    };
-    dependencies = [
-      "fog-core"
-      "fog-json"
-    ];
-  };
-  "fog-storm_on_demand" = {
-    version = "0.1.1";
-    source = {
-      type = "gem";
-      sha256 = "0fif1x8ci095b2yyilf65n7x6iyvn448azrsnmwsdkriy8vxxv3y";
-    };
-    dependencies = [
-      "fog-core"
-      "fog-json"
-    ];
-  };
-  "fog-terremark" = {
-    version = "0.1.0";
-    source = {
-      type = "gem";
-      sha256 = "01lfkh9jppj0iknlklmwyb7ym3bfhkq58m3absb6rf5a5mcwi3lf";
-    };
-    dependencies = [
-      "fog-core"
-      "fog-xml"
-    ];
-  };
-  "fog-vmfusion" = {
-    version = "0.1.0";
-    source = {
-      type = "gem";
-      sha256 = "0g0l0k9ylxk1h9pzqr6h2ba98fl47lpp3j19lqv4jxw0iw1rqxn4";
-    };
-    dependencies = [
-      "fission"
-      "fog-core"
-    ];
-  };
-  "fog-voxel" = {
-    version = "0.1.0";
-    source = {
-      type = "gem";
-      sha256 = "10skdnj59yf4jpvq769njjrvh2l0wzaa7liva8n78qq003mvmfgx";
-    };
-    dependencies = [
-      "fog-core"
-      "fog-xml"
-    ];
-  };
-  "fog-xml" = {
-    version = "0.1.2";
-    source = {
-      type = "gem";
-      sha256 = "1576sbzza47z48p0k9h1wg3rhgcvcvdd1dfz3xx1cgahwr564fqa";
-    };
-    dependencies = [
-      "fog-core"
-      "nokogiri"
-    ];
-  };
-  "formatador" = {
-    version = "0.2.5";
-    source = {
-      type = "gem";
-      sha256 = "1gc26phrwlmlqrmz4bagq1wd5b7g64avpx0ghxr9xdxcvmlii0l0";
-    };
-  };
-  "inflecto" = {
-    version = "0.0.2";
-    source = {
-      type = "gem";
-      sha256 = "085l5axmvqw59mw5jg454a3m3gr67ckq9405a075isdsn7bm3sp4";
-    };
-  };
-  "ipaddress" = {
-    version = "0.8.0";
-    source = {
-      type = "gem";
-      sha256 = "0cwy4pyd9nl2y2apazp3hvi12gccj5a3ify8mi8k3knvxi5wk2ir";
-    };
-  };
-  "mime-types" = {
-    version = "2.6.1";
-    source = {
-      type = "gem";
-      sha256 = "1vnrvf245ijfyxzjbj9dr6i1hkjbyrh4yj88865wv9bs75axc5jv";
-    };
-  };
-  "mini_portile" = {
-    version = "0.6.2";
-    source = {
-      type = "gem";
-      sha256 = "0h3xinmacscrnkczq44s6pnhrp4nqma7k056x5wv5xixvf2wsq2w";
-    };
-  };
-  "mtrc" = {
-    version = "0.0.4";
-    source = {
-      type = "gem";
+      remotes = ["https://rubygems.org"];
       sha256 = "0xj2pv4cpn0ad1xw38sinsxfzwhgqs6ff18hw0cwz5xmsf3zqmiz";
-    };
-  };
-  "multi_json" = {
-    version = "1.11.1";
-    source = {
-      type = "gem";
-      sha256 = "0lrmadw2scqwz7nw3j5pfdnmzqimlbaxlxi37xsydrpbbr78qf6g";
-    };
-  };
-  "multipart-post" = {
-    version = "2.0.0";
-    source = {
-      type = "gem";
-      sha256 = "09k0b3cybqilk1gwrwwain95rdypixb2q9w65gd44gfzsd84xi1x";
-    };
-  };
-  "munin-ruby" = {
-    version = "0.2.5";
-    source = {
-      type = "gem";
-      sha256 = "0378jyf0hdbfs2vvk7v8k7hqilzi1rfkpn271dyrqqal7g2lnjl2";
-    };
-  };
-  "net-scp" = {
-    version = "1.2.1";
-    source = {
-      type = "gem";
-      sha256 = "0b0jqrcsp4bbi4n4mzyf70cp2ysyp6x07j8k8cqgxnvb4i3a134j";
-    };
-    dependencies = [
-      "net-ssh"
-    ];
-  };
-  "net-ssh" = {
-    version = "2.9.2";
-    source = {
-      type = "gem";
-      sha256 = "1p0bj41zrmw5lhnxlm1pqb55zfz9y4p9fkrr9a79nrdmzrk1ph8r";
-    };
-  };
-  "nokogiri" = {
-    version = "1.6.6.2";
-    source = {
       type = "gem";
-      sha256 = "1j4qv32qjh67dcrc1yy1h8sqjnny8siyy4s44awla8d6jk361h30";
     };
-    dependencies = [
-      "mini_portile"
-    ];
+    version = "0.0.4";
   };
-  "riemann-client" = {
-    version = "0.2.5";
+  riemann-client = {
+    dependencies = ["beefcake" "mtrc" "trollop"];
     source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "02rp8x2y8h61x8mx9c8kwgm2yyvgg63g8km93zmwmkpp5fyi3fi8";
       type = "gem";
-      sha256 = "1myhyh31f290jm1wlhhjvf331n5l8qdm7axkxyacdgjsfg4szsjc";
     };
-    dependencies = [
-      "beefcake"
-      "mtrc"
-      "trollop"
-    ];
-  };
-  "riemann-tools" = {
     version = "0.2.6";
-    source = {
-      type = "gem";
-      sha256 = "0qjm7p55h70l5bs876hhvz3isr204663f97py9g0ajxz2z8jkzpi";
-    };
-    dependencies = [
-      "faraday"
-      "fog"
-      "munin-ruby"
-      "nokogiri"
-      "riemann-client"
-      "trollop"
-      "yajl-ruby"
-    ];
   };
-  "trollop" = {
-    version = "2.1.2";
+  riemann-tools = {
+    dependencies = ["json" "riemann-client" "trollop"];
     source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0brf44cq4xz0nqhs189zlg76527bfv3jr453yc00410qdzz8fpxa";
       type = "gem";
-      sha256 = "0415y63df86sqj43c0l82and65ia5h64if7n0znkbrmi6y0jwhl8";
     };
+    version = "0.2.13";
   };
-  "yajl-ruby" = {
-    version = "1.2.1";
+  trollop = {
     source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0415y63df86sqj43c0l82and65ia5h64if7n0znkbrmi6y0jwhl8";
       type = "gem";
-      sha256 = "0zvvb7i1bl98k3zkdrnx9vasq0rp2cyy5n7p9804dqs4fz9xh9vf";
     };
+    version = "2.1.2";
   };
 }
\ No newline at end of file
diff --git a/pkgs/tools/misc/skim/default.nix b/pkgs/tools/misc/skim/default.nix
index 169389928d06..31303dcdd4d7 100644
--- a/pkgs/tools/misc/skim/default.nix
+++ b/pkgs/tools/misc/skim/default.nix
@@ -2,13 +2,13 @@
 
 rustPlatform.buildRustPackage rec {
   name = "skim-${version}";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "lotabout";
     repo = "skim";
     rev = "v${version}";
-    sha256 = "067ds1sdi9ya1yqz9saczj1vml8arwzd46w35gmvdxgmxx4wmihs";
+    sha256 = "0hk19mqfmrsyx28lb8h1hixivl6zrc8dg3imygk1ppgn66c0zf00";
   };
 
   outputs = [ "out" "vim" ];
@@ -17,6 +17,8 @@ rustPlatform.buildRustPackage rec {
 
   patchPhase = ''
     sed -i -e "s|expand('<sfile>:h:h')|'$out'|" plugin/skim.vim
+    # fix Cargo.lock version
+    sed -i -e '168s|0.4.0|0.5.0|' Cargo.lock
   '';
 
   postInstall = ''
diff --git a/pkgs/tools/text/ispell/default.nix b/pkgs/tools/text/ispell/default.nix
index b2219d1e66d6..dbec8d353d94 100644
--- a/pkgs/tools/text/ispell/default.nix
+++ b/pkgs/tools/text/ispell/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
   ];
   postPatch = ''
     cat >> local.h <<EOF
-    #define USG
+    ${stdenv.lib.optionalString (!stdenv.isDarwin) "#define USG"}
     #define TERMLIB "-lncurses"
     #define LANGUAGES "{american,MASTERDICTS=american.med,HASHFILES=americanmed.hash}"
     #define MASTERHASH "americanmed.hash"
diff --git a/pkgs/top-level/php-packages.nix b/pkgs/top-level/php-packages.nix
index 0aa78e3178d9..a1015c780241 100644
--- a/pkgs/top-level/php-packages.nix
+++ b/pkgs/top-level/php-packages.nix
@@ -383,11 +383,11 @@ let
 
   php-cs-fixer = pkgs.stdenv.mkDerivation rec {
     name = "php-cs-fixer-${version}";
-    version = "2.12.0";
+    version = "2.12.1";
 
     src = pkgs.fetchurl {
       url = "https://github.com/FriendsOfPHP/PHP-CS-Fixer/releases/download/v${version}/php-cs-fixer.phar";
-      sha256 = "1vz3s0hbqp1rzgrqfnr0jj5qds1jnw7kyhpl4qjlpd4s40x0n4b1";
+      sha256 = "1ifwb30wddp5blqnrkdmf0x11dk7nbxj4z2v5403fn7wfhgvibd2";
     };
 
     phases = [ "installPhase" ];