Merge branch 'master' into staging

* master: (71 commits)
  xen: enable parallel building
  spice: 0.13.3 -> 0.14.0
  powerline-rs: 0.1.7 -> 0.1.8 (#41736)
  xidlehook: 0.4.6 -> 0.4.8 (#41094)
  serf: update scons patch, enable kerberos on darwin
  firefox-bin: Add ffmpeg to lib path
  firefox-beta-bin: 61.0b10 -> 61.0b12
  firefox-devedition-bin: 61.0b10 -> 61.0b12
  wireguard-go: assign yegortimoshenko as maintainer
  wireguard-go: 0.0.20180519 -> 0.0.20180531
  zfs: Fix "zfs-sync" for modern systemd
  nixos/memcached: added simple set/get test
  jenkins: 2.89.4 -> 2.107.3 (#41618)
  focuswriter: 1.6.12 -> 1.6.13 (#41567)
  ne: 3.0.1 -> 3.1.1 (#41536)
  libpqxx: 6.2.3 -> 6.2.4 (#41547)
  mate.mate-applets: 1.20.1 -> 1.20.2 (#41546)
  mate.mate-themes: 3.22.16 -> 3.22.17 (#41541)
  nixos/munge: run munge as user munge instead of root. (#41509)
  pstoedit: 3.71 -> 3.73 (#41528)
  ...

33 files changed, 141 insertions, 182 deletions

diff --git a/pkgs/development/compilers/scala/dotty-bare.nix b/pkgs/development/compilers/scala/dotty-bare.nix
index bff73337e9e8..0c9625c04d5c 100644
--- a/pkgs/development/compilers/scala/dotty-bare.nix
+++ b/pkgs/development/compilers/scala/dotty-bare.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, makeWrapper, jre }:
 
 stdenv.mkDerivation rec {
-  version = "0.6.0-RC1";
+  version = "0.8.0-RC1";
   name = "dotty-bare-${version}";
 
   src = fetchurl {
     url = "https://github.com/lampepfl/dotty/releases/download/${version}/dotty-${version}.tar.gz";
-    sha256 = "de1f5e72fb0e0b4c377d6cec93f565eff49769698cd8be01b420705fe8475ca4";
+    sha256 = "e5b7a9bb6f1007146a440ddfff871cc312075e5d69b9ab7e279ad7c3514f7065";
   };
 
   propagatedBuildInputs = [ jre ] ;
diff --git a/pkgs/development/haskell-modules/configuration-common.nix b/pkgs/development/haskell-modules/configuration-common.nix
index 7120d15ade7c..ad07da83c4e3 100644
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@@ -250,7 +250,7 @@ self: super: {
   digit = doJailbreak super.digit;
 
   # https://github.com/jwiegley/hnix/issues/98 - tied to an older deriving-compat
-  hnix = doJailbreak (overrideCabal super.hnix (old: {
+  hnix = (overrideCabal super.hnix (old: {
     patches = old.patches or [] ++ [
       # should land in hnix-5.2
       (pkgs.fetchpatch {
diff --git a/pkgs/development/libraries/libpqxx/default.nix b/pkgs/development/libraries/libpqxx/default.nix
index f027b767db68..5c4699d26268 100644
--- a/pkgs/development/libraries/libpqxx/default.nix
+++ b/pkgs/development/libraries/libpqxx/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "libpqxx-${version}";
-  version = "6.2.3";
+  version = "6.2.4";
 
   src = fetchFromGitHub {
     owner = "jtv";
     repo = "libpqxx";
     rev = version;
-    sha256 = "130mkkq46l23aaxfc2bnlf9mi3qxfn5465ziz0048bxymbxa7b58";
+    sha256 = "18fkyfa3a917ljmarf3jy8ycdhqzpc47cj87542sjpxnpaj9hy59";
   };
 
   nativeBuildInputs = [ gnused python2 ];
diff --git a/pkgs/development/libraries/libutempter/default.nix b/pkgs/development/libraries/libutempter/default.nix
index d54c82ae7f21..f9703e3c5932 100644
--- a/pkgs/development/libraries/libutempter/default.nix
+++ b/pkgs/development/libraries/libutempter/default.nix
@@ -13,11 +13,13 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ glib ];
 
+  patches = [ ./exec_path.patch ];
+
   prePatch = ''
     substituteInPlace Makefile --replace 2711 0711
   '';
 
-  installFlags = [
+  makeFlags = [
     "libdir=\${out}/lib"
     "libexecdir=\${out}/lib"
     "includedir=\${out}/include"
@@ -26,6 +28,10 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Interface for terminal emulators such as screen and xterm to record user sessions to utmp and wtmp files";
+    longDescription = ''
+      The bundled utempter binary must be able to run as a user belonging to group utmp.
+      On NixOS systems, this can be achieved by creating a setguid wrapper.
+    '';
     license = licenses.lgpl21Plus;
     platforms = platforms.linux;
     maintainers = [ maintainers.msteen ];
diff --git a/pkgs/development/libraries/libutempter/exec_path.patch b/pkgs/development/libraries/libutempter/exec_path.patch
new file mode 100644
index 000000000000..bd5f56611ef9
--- /dev/null
+++ b/pkgs/development/libraries/libutempter/exec_path.patch
@@ -0,0 +1,25 @@
+diff -ur libutempter-1.1.6/iface.c libutempter-1.1.6.patched/iface.c
+--- libutempter-1.1.6/iface.c	2010-11-04 18:14:53.000000000 +0100
++++ libutempter-1.1.6.patched/iface.c	2018-06-06 15:09:11.417755549 +0200
+@@ -60,9 +60,9 @@
+ 		_exit(EXIT_FAILURE);
+ 	}
+ 
+-	execv(path, argv);
++	execvp(path, argv);
+ #ifdef	UTEMPTER_DEBUG
+-	fprintf(stderr, "libutempter: execv: %s\n", strerror(errno));
++	fprintf(stderr, "libutempter: execvp: %s\n", strerror(errno));
+ #endif
+ 
+ 	while (EACCES == errno)
+@@ -79,7 +79,7 @@
+ 		if (setgid(sgid))
+ 			break;
+ 
+-		(void) execv(path, argv);
++		(void) execvp(path, argv);
+ 		break;
+ 	}
+ 
+Only in libutempter-1.1.6.patched: result
diff --git a/pkgs/development/libraries/libvirt/default.nix b/pkgs/development/libraries/libvirt/default.nix
index 7262ca541f01..8456e395f468 100644
--- a/pkgs/development/libraries/libvirt/default.nix
+++ b/pkgs/development/libraries/libvirt/default.nix
@@ -14,19 +14,19 @@ let
   buildFromTarball = stdenv.isDarwin;
 in stdenv.mkDerivation rec {
   name = "libvirt-${version}";
-  version = "4.1.0";
+  version = "4.4.0";
 
   src =
     if buildFromTarball then
       fetchurl {
         url = "http://libvirt.org/sources/${name}.tar.xz";
-        sha256 = "0fb466mcma21hsxx3cckllbr9hhncpbwim5px1mr66iidy1a8bwa";
+        sha256 = "1djaz3b5n4ksyw6z4n4qs82g5zyxdl2gm4rsb5181bv1rdiisqs6";
       }
     else
       fetchgit {
         url = git://libvirt.org/libvirt.git;
         rev = "v${version}";
-        sha256 = "01021r7i71dw9w7ffp6ia8h70ns6bc0ps5np0hq9nipxs68finm6";
+        sha256 = "0rhas7hbisfh0aib75nsh9wspxj8pvcqagds1mp2jgfls7hfna0r";
         fetchSubmodules = true;
       };
 
diff --git a/pkgs/development/libraries/serf/default.nix b/pkgs/development/libraries/serf/default.nix
index 62d8bcccfe36..dfaf1c679dd7 100644
--- a/pkgs/development/libraries/serf/default.nix
+++ b/pkgs/development/libraries/serf/default.nix
@@ -13,31 +13,32 @@ stdenv.mkDerivation rec {
   buildInputs = [ apr scons openssl aprutil zlib libiconv ]
     ++ stdenv.lib.optional (!stdenv.isCygwin) kerberos;
 
-  postPatch = ''
-    sed -e '/^env[.]Append(BUILDERS/ienv.Append(ENV={"PATH":os.environ["PATH"]})' \
-        -e '/^env[.]Append(BUILDERS/ienv.Append(ENV={"NIX_CFLAGS_COMPILE":os.environ["NIX_CFLAGS_COMPILE"]})' \
-        -e '/^env[.]Append(BUILDERS/ienv.Append(ENV={"NIX_LDFLAGS":os.environ["NIX_LDFLAGS"]})' \
-      -i SConstruct
-  '';
+  patches = [ ./scons.patch ];
 
   buildPhase = ''
-    scons PREFIX="$out" OPENSSL="${openssl}" ZLIB="${zlib}" APR="$(echo "${apr.dev}"/bin/*-config)" CFLAGS="-I${zlib.dev}/include" \
-      LINKFLAGS="-L${zlib.out}/lib -L${openldap}/lib -L${libiconv}/lib" \
-        APU="$(echo "${aprutil.dev}"/bin/*-config)" CC=$CC ${
-          if (stdenv.isDarwin || stdenv.isCygwin) then "" else "GSSAPI=\"${kerberos.dev}\""
-        }
+    scons \
+      -j $NIX_BUILD_CORES \
+      APR="$(echo ${apr.dev}/bin/*-config)" \
+      APU="$(echo ${aprutil.dev}/bin/*-config)" \
+      CC=$CC \
+      OPENSSL=${openssl} \
+      PREFIX="$out" \
+      ZLIB=${zlib} \
+      ${
+        if stdenv.isCygwin then "" else "GSSAPI=${kerberos.dev}"
+      }
   '';
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isDarwin "-L/usr/lib";
-
   installPhase = ''
     scons install
   '';
 
-  meta = {
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
     description = "HTTP client library based on APR";
-    license = stdenv.lib.licenses.asl20;
-    maintainers = [stdenv.lib.maintainers.raskin];
-    platforms = stdenv.lib.platforms.linux ++ stdenv.lib.platforms.darwin;
+    license = licenses.asl20;
+    maintainers = with maintainers; [ orivej raskin ];
+    platforms = platforms.linux ++ platforms.darwin;
   };
 }
diff --git a/pkgs/development/libraries/serf/scons.patch b/pkgs/development/libraries/serf/scons.patch
new file mode 100644
index 000000000000..a7eefe7d5c1f
--- /dev/null
+++ b/pkgs/development/libraries/serf/scons.patch
@@ -0,0 +1,12 @@
+diff --git a/SConstruct b/SConstruct
+index 4358a23..0d862e7 100644
+--- a/SConstruct
++++ b/SConstruct
+@@ -155,6 +155,7 @@ if sys.platform == 'win32':
+ env = Environment(variables=opts,
+                   tools=('default', 'textfile',),
+                   CPPPATH=['.', ],
++                  ENV=os.environ,
+                   )
+ 
+ env.Append(BUILDERS = {
diff --git a/pkgs/development/libraries/spice/default.nix b/pkgs/development/libraries/spice/default.nix
index 1ab76340cc7c..ee54ad555537 100644
--- a/pkgs/development/libraries/spice/default.nix
+++ b/pkgs/development/libraries/spice/default.nix
@@ -6,32 +6,13 @@
 with stdenv.lib;
 
 stdenv.mkDerivation rec {
-  name = "spice-0.13.3";
+  name = "spice-0.14.0";
 
   src = fetchurl {
     url = "http://www.spice-space.org/download/releases/${name}.tar.bz2";
-    sha256 = "17mqgwamdhj8sx8vhahrjl5937x693kjnw6cp6v0akjrwz011xrh";
+    sha256 = "0j5q7cp5p95jk8fp48gz76rz96lifimdsx1wnpmfal0nnnar9nrs";
   };
 
-  patches = [
-    # the following three patches fix CVE-2016-9577 and CVE-2016-9578
-    (fetchpatch {
-      name = "0001-Prevent-possible-DoS-attempts-during-protocol-handsh.patch";
-      url = "http://src.fedoraproject.org/cgit/rpms/spice.git/plain/0001-Prevent-possible-DoS-attempts-during-protocol-handsh.patch?id=d919d639ae5f83a9735a04d843eed675f9357c0d";
-      sha256 = "11x5566lx5zyl7f39glwsgpzkxb7hpcshx8va5ab3imrns07130q";
-    })
-    (fetchpatch {
-      name = "0002-Prevent-integer-overflows-in-capability-checks.patch";
-      url = "http://src.fedoraproject.org/cgit/rpms/spice.git/plain/0002-Prevent-integer-overflows-in-capability-checks.patch?id=d919d639ae5f83a9735a04d843eed675f9357c0d";
-      sha256 = "1r1bhq98w93cvvrlrz6jwdfsy261xl3xqs0ppchaa2igyxvxv5z5";
-    })
-    (fetchpatch {
-      name = "0003-main-channel-Prevent-overflow-reading-messages-from.patch";
-      url = "https://cgit.freedesktop.org/spice/spice/patch/?id=1d3e26c0ee75712fa4bbbcfa09d8d5866b66c8af";
-      sha256 = "030mm551aipck99rqiz39vsvk071pn8715zynr5j6chwzgpflwm3";
-    })
-  ];
-
   buildInputs = [ pixman celt alsaLib openssl libjpeg zlib
                   libXrandr libXfixes libXrender libXext libXinerama
                   python pyparsing glib cyrus_sasl lz4 ];
diff --git a/pkgs/development/libraries/xmlsec/default.nix b/pkgs/development/libraries/xmlsec/default.nix
index 32ce856eddd3..e17ac6d15075 100644
--- a/pkgs/development/libraries/xmlsec/default.nix
+++ b/pkgs/development/libraries/xmlsec/default.nix
@@ -2,14 +2,14 @@
 , openssl, nss, makeWrapper }:
 
 let
-  version = "1.2.25";
+  version = "1.2.26";
 in
 stdenv.mkDerivation rec {
   name = "xmlsec-${version}";
 
   src = fetchurl {
     url = "http://www.aleksey.com/xmlsec/download/xmlsec1-${version}.tar.gz";
-    sha256 = "1lpwj8dxwhha54sby0v5axjk79h56jnhjjiwiasbbk15vwzahz4n";
+    sha256 = "0l1dk344rn3j2vnj13daz72xd8j1msvzhg82n2il5ji0qz4pd0ld";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/ocaml-modules/cmdliner/0.9.nix b/pkgs/development/ocaml-modules/cmdliner/0.9.nix
index e8824f318071..345d56d21707 100644
--- a/pkgs/development/ocaml-modules/cmdliner/0.9.nix
+++ b/pkgs/development/ocaml-modules/cmdliner/0.9.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, ocaml, findlib, ocamlbuild, opam }:
+{ stdenv, fetchurl, ocaml, findlib, ocamlbuild, opaline }:
 
 let
   pname = "cmdliner";
@@ -17,17 +17,12 @@ stdenv.mkDerivation rec {
   };
 
   unpackCmd = "tar xjf $src";
-  nativeBuildInputs = [ ocamlbuild opam ];
+  nativeBuildInputs = [ ocamlbuild opaline ];
   buildInputs = [ ocaml findlib ];
 
-  createFindlibDestdir = true;
-
   configurePhase = "ocaml pkg/git.ml";
   buildPhase     = "ocaml pkg/build.ml native=true native-dynlink=true";
-  installPhase   = ''
-    opam-installer --script --prefix=$out | sh
-    ln -s $out/lib/${pname} $out/lib/ocaml/${ocaml.version}/site-lib/
-  '';
+  installPhase   = "opaline -libdir $OCAMLFIND_DESTDIR";
 
   meta = with stdenv.lib; {
     homepage = http://erratique.ch/software/cmdliner;
diff --git a/pkgs/development/ocaml-modules/eliom/default.nix b/pkgs/development/ocaml-modules/eliom/default.nix
index da9383c4e95b..8b304aadd9ef 100644
--- a/pkgs/development/ocaml-modules/eliom/default.nix
+++ b/pkgs/development/ocaml-modules/eliom/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchurl, which, ocsigen_server, ocsigen_deriving, ocaml, camlp4,
   js_of_ocaml, lwt_react, cryptokit,
   ipaddr, ocamlnet, lwt_ssl, ocaml_pcre,
-  opam, ppx_tools, ppx_deriving, findlib
+  opaline, ppx_tools, ppx_deriving, findlib
 , js_of_ocaml-ocamlbuild, js_of_ocaml-ppx, js_of_ocaml-ppx_deriving_json
 , js_of_ocaml-lwt
 , js_of_ocaml-tyxml
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec
 
   patches = [ ./camlp4.patch ];
 
-  buildInputs = [ ocaml which findlib js_of_ocaml-ocamlbuild js_of_ocaml-ppx_deriving_json opam ppx_tools
+  buildInputs = [ ocaml which findlib js_of_ocaml-ocamlbuild js_of_ocaml-ppx_deriving_json opaline ppx_tools
     ocsigen_deriving
   ];
 
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec
     ppx_deriving
   ];
 
-  installPhase = "opam-installer -i --prefix=$out --libdir=$OCAMLFIND_DESTDIR";
+  installPhase = "opaline -prefix $out -libdir $OCAMLFIND_DESTDIR";
 
   setupHook = [ ./setup-hook.sh ];
 
diff --git a/pkgs/development/ocaml-modules/gg/default.nix b/pkgs/development/ocaml-modules/gg/default.nix
index 0839ff361aea..0c80f39d9d7d 100644
--- a/pkgs/development/ocaml-modules/gg/default.nix
+++ b/pkgs/development/ocaml-modules/gg/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, ocaml, findlib, ocamlbuild, opam }:
+{ stdenv, fetchurl, ocaml, findlib, ocamlbuild, opaline }:
 
 let
   inherit (stdenv.lib) getVersion versionAtLeast;
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     sha256 = "0czj41sr8jsivl3z8wyblf9k971j3kx2wc3s0c1nhzcc8allg9i2";
   };
 
-  buildInputs = [ ocaml findlib ocamlbuild opam ];
+  buildInputs = [ ocaml findlib ocamlbuild opaline ];
 
   createFindlibDestdir = true;
 
@@ -27,10 +27,7 @@ stdenv.mkDerivation rec {
 
   buildPhase = "ocaml pkg/build.ml native=true native-dynlink=true";
 
-  installPhase = ''
-    opam-installer --script --prefix=$out ${pname}.install | sh
-    ln -s $out/lib/${pname} $out/lib/ocaml/${getVersion ocaml}/site-lib/${pname}
-  '';
+  installPhase = "opaline -libdir $OCAMLFIND_DESTDIR";
 
   meta = with stdenv.lib; {
     description = "Basic types for computer graphics in OCaml";
diff --git a/pkgs/development/ocaml-modules/janestreet/buildOcamlJane.nix b/pkgs/development/ocaml-modules/janestreet/buildOcamlJane.nix
index 61b2038bfd29..fdb0d8034e69 100644
--- a/pkgs/development/ocaml-modules/janestreet/buildOcamlJane.nix
+++ b/pkgs/development/ocaml-modules/janestreet/buildOcamlJane.nix
@@ -1,4 +1,4 @@
-{ buildOcaml, opam, js_build_tools, ocaml_oasis, fetchurl } :
+{ buildOcaml, opaline, js_build_tools, ocaml_oasis, fetchurl } :
 
 { name, version ? "113.33.03", buildInputs ? [],
   hash ? "",
@@ -14,7 +14,7 @@ buildOcaml (args // {
 
   hasSharedObjects = true;
 
-  buildInputs = [ ocaml_oasis js_build_tools opam ] ++ buildInputs;
+  buildInputs = [ ocaml_oasis js_build_tools opaline ] ++ buildInputs;
 
   dontAddPrefix = true;
 
@@ -22,14 +22,6 @@ buildOcaml (args // {
 
   buildPhase = "OCAML_TOPLEVEL_PATH=`ocamlfind query findlib`/.. make";
 
-  installPhase = ''
-    opam-installer -i --prefix $prefix --libdir `ocamlfind printconf destdir` --stubsdir `ocamlfind printconf destdir`/${name} ${name}.install
-    if [ -d $out/lib/${name} ]
-      then if [ "$(ls -A $out/lib/${name})" ]
-        then mv $out/lib/${name}/* `ocamlfind printconf destdir`/${name}
-      fi
-      rmdir $out/lib/${name}
-    fi
-  '';
+  installPhase = "opaline -prefix $prefix -libdir $OCAMLFIND_DESTDIR ${name}.install";
 
 })
diff --git a/pkgs/development/ocaml-modules/janestreet/js-build-tools.nix b/pkgs/development/ocaml-modules/janestreet/js-build-tools.nix
index 2c314f3dbdea..f77b793bcaab 100644
--- a/pkgs/development/ocaml-modules/janestreet/js-build-tools.nix
+++ b/pkgs/development/ocaml-modules/janestreet/js-build-tools.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildOcaml, fetchurl, ocaml_oasis, opam }:
+{ stdenv, buildOcaml, fetchurl, ocaml_oasis, opaline }:
 
 buildOcaml rec {
   name = "js-build-tools";
@@ -13,11 +13,11 @@ buildOcaml rec {
 
   hasSharedObjects = true;
 
-  buildInputs = [ ocaml_oasis opam ];
+  buildInputs = [ ocaml_oasis opaline ];
 
   dontAddPrefix = true;
   configurePhase = "./configure --prefix $prefix";
-  installPhase = "opam-installer -i --prefix $prefix --libdir `ocamlfind printconf destdir` ${name}.install";
+  installPhase = "opaline -prefix $prefix -libdir $OCAMLFIND_DESTDIR ${name}.install";
 
   patches = [ ./js-build-tools-darwin.patch ];
 
diff --git a/pkgs/development/ocaml-modules/lambda-term/default.nix b/pkgs/development/ocaml-modules/lambda-term/default.nix
index 769b80ecddce..fdd30d28ed89 100644
--- a/pkgs/development/ocaml-modules/lambda-term/default.nix
+++ b/pkgs/development/ocaml-modules/lambda-term/default.nix
@@ -17,10 +17,7 @@ buildOcaml rec {
 
   buildPhase = "jbuilder build -p lambda-term";
 
-  installPhase = ''
-    ${jbuilder.installPhase}
-    mv $out/lib/ocaml/${ocaml.version}/site-lib/{stubslibs,lambda-term}/dlllambda_term_stubs.so
-  '';
+  inherit (jbuilder) installPhase;
 
   hasSharedObjects = true;
 
diff --git a/pkgs/development/ocaml-modules/mstruct/default.nix b/pkgs/development/ocaml-modules/mstruct/default.nix
index 5aa57ba8fbb8..5682b75d6a14 100644
--- a/pkgs/development/ocaml-modules/mstruct/default.nix
+++ b/pkgs/development/ocaml-modules/mstruct/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, ocaml, findlib, jbuilder, opam
+{ stdenv, fetchFromGitHub, ocaml, findlib, jbuilder
 , cstruct
 }:
 
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 		sha256 = "1p4ygwzs3n1fj4apfib0z0sabpph21bkq1dgjk4bsa59pq4prncm";
 	};
 
-	buildInputs = [ ocaml findlib jbuilder opam ];
+	buildInputs = [ ocaml findlib jbuilder ];
 
 	propagatedBuildInputs = [ cstruct ];
 
diff --git a/pkgs/development/ocaml-modules/nocrypto/default.nix b/pkgs/development/ocaml-modules/nocrypto/default.nix
index cfe3f37800de..6e68c87b5ff0 100644
--- a/pkgs/development/ocaml-modules/nocrypto/default.nix
+++ b/pkgs/development/ocaml-modules/nocrypto/default.nix
@@ -22,10 +22,7 @@ stdenv.mkDerivation rec {
     ppx_sexp_conv ];
   propagatedBuildInputs = [ cstruct zarith sexplib ] ++ optional withLwt cstruct-lwt;
 
-  buildPhase = ''
-    LD_LIBRARY_PATH=${cpuid}/lib/ocaml/${ocaml.version}/site-lib/stubslibs/ \
-    ${topkg.buildPhase} --with-lwt ${boolToString withLwt}
-  '';
+  buildPhase = "${topkg.buildPhase} --with-lwt ${boolToString withLwt}";
   inherit (topkg) installPhase;
 
   meta = {
diff --git a/pkgs/development/ocaml-modules/ocsigen-toolkit/default.nix b/pkgs/development/ocaml-modules/ocsigen-toolkit/default.nix
index 556c343241c3..37c8c8f76c95 100644
--- a/pkgs/development/ocaml-modules/ocsigen-toolkit/default.nix
+++ b/pkgs/development/ocaml-modules/ocsigen-toolkit/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, buildOcaml, ocaml, opam
+{ stdenv, fetchurl, buildOcaml, ocaml, opaline
 , calendar, eliom, js_of_ocaml-ppx_deriving_json
 }:
 
@@ -8,13 +8,13 @@ buildOcaml rec
  version = "1.1.0";
 
  propagatedBuildInputs = [ calendar eliom js_of_ocaml-ppx_deriving_json ];
- buildInputs = [ opam ];
+ buildInputs = [ opaline ];
 
  installPhase =
   ''
     export OCAMLPATH=$out/lib/ocaml/${ocaml.version}/site-lib/:$OCAMLPATH
     make install
-    opam-installer --prefix=$out
+    opaline -prefix $out
   '';
 
   src = fetchurl {
diff --git a/pkgs/development/ocaml-modules/ppx_import/default.nix b/pkgs/development/ocaml-modules/ppx_import/default.nix
index 991af1e41de1..3948cfce0e8e 100644
--- a/pkgs/development/ocaml-modules/ppx_import/default.nix
+++ b/pkgs/development/ocaml-modules/ppx_import/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchFromGitHub, buildOcaml, ocaml, opam,
+{stdenv, fetchFromGitHub, buildOcaml, ocaml, opaline,
  cppo, ppx_tools, ounit, ppx_deriving}:
 
 buildOcaml rec {
@@ -15,15 +15,12 @@ buildOcaml rec {
     sha256 = "14c2lp7r9080c4hsb1y1drbxxx3v44b7ib5wfh3kkh3f1jfsjwbk";
   };
 
-  buildInputs = [ cppo ounit ppx_deriving opam ];
+  buildInputs = [ cppo ounit ppx_deriving opaline ];
 
   doCheck = true;
   checkTarget = "test";
 
-  installPhase = ''
-    opam-installer --script --prefix=$out ppx_import.install | sh
-    ln -s $out/lib/ppx_import $out/lib/ocaml/${ocaml.version}/site-lib
-  '';
+  installPhase = "opaline -prefix $out -libdir $OCAMLFIND_DESTDIR";
 
   meta = with stdenv.lib; {
     description = "A syntax extension that allows to pull in types or signatures from other compiled interface files";
diff --git a/pkgs/development/ocaml-modules/reactivedata/default.nix b/pkgs/development/ocaml-modules/reactivedata/default.nix
index 1f1781f5a65b..fa85f2174688 100644
--- a/pkgs/development/ocaml-modules/reactivedata/default.nix
+++ b/pkgs/development/ocaml-modules/reactivedata/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, ocaml, findlib, ocamlbuild, react, opam }:
+{ stdenv, fetchurl, ocaml, findlib, ocamlbuild, react, opaline }:
 
 assert stdenv.lib.versionAtLeast ocaml.version "3.11";
 
@@ -9,12 +9,12 @@ stdenv.mkDerivation {
     sha256 = "0wcs0z50nia1cpk8mh6i5qbc6sff9cc8x7s7q1q89d7m73bnv4vf";
   };
 
-  buildInputs = [ ocaml findlib ocamlbuild opam ];
+  buildInputs = [ ocaml findlib ocamlbuild opaline ];
   propagatedBuildInputs = [ react ];
 
   buildPhase = "ocaml pkg/build.ml native=true native-dynlink=true";
 
-  installPhase = "opam-installer -i --prefix=$out --libdir=$OCAMLFIND_DESTDIR";
+  installPhase = "opaline -prefix $out -libdir $OCAMLFIND_DESTDIR";
 
   meta = with stdenv.lib; {
     description = "An OCaml module for functional reactive programming (FRP) based on React";
diff --git a/pkgs/development/ocaml-modules/topkg/default.nix b/pkgs/development/ocaml-modules/topkg/default.nix
index 9a655e055131..3ff641ff93e5 100644
--- a/pkgs/development/ocaml-modules/topkg/default.nix
+++ b/pkgs/development/ocaml-modules/topkg/default.nix
@@ -5,7 +5,7 @@ The `buildPhase` and `installPhase` attributes can be reused directly
 in many cases. When more fine-grained control on how to run the “topkg”
 build system is required, the attribute `run` can be used.
 */
-{ stdenv, fetchurl, ocaml, findlib, ocamlbuild, result, opam }:
+{ stdenv, fetchurl, ocaml, findlib, ocamlbuild, result, opaline }:
 
 if !stdenv.lib.versionAtLeast ocaml.version "4.01"
 then throw "topkg is not available for OCaml ${ocaml.version}"
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
   unpackCmd = "tar xjf ${src}";
   buildPhase = "${run} build";
   createFindlibDestdir = true;
-  installPhase = "${opam}/bin/opam-installer -i --prefix=$out --libdir=$OCAMLFIND_DESTDIR";
+  installPhase = "${opaline}/bin/opaline -prefix $out -libdir $OCAMLFIND_DESTDIR";
 
   passthru = { inherit run; };
 
diff --git a/pkgs/development/ocaml-modules/uchar/default.nix b/pkgs/development/ocaml-modules/uchar/default.nix
index 6b27f00fb150..8fddf883da5d 100644
--- a/pkgs/development/ocaml-modules/uchar/default.nix
+++ b/pkgs/development/ocaml-modules/uchar/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, ocaml, ocamlbuild, opam }:
+{ stdenv, fetchurl, ocaml, findlib, ocamlbuild, opaline }:
 
 stdenv.mkDerivation {
   name = "ocaml${ocaml.version}-uchar-0.0.2";
@@ -9,15 +9,9 @@ stdenv.mkDerivation {
   };
 
   unpackCmd = "tar xjf $src";
-  buildInputs = [ ocaml ocamlbuild opam ];
+  buildInputs = [ ocaml ocamlbuild findlib opaline ];
   buildPhase = "ocaml pkg/build.ml native=true native-dynlink=true";
-  installPhase = ''
-    opam-installer --script --prefix=$out uchar.install > install.sh
-    sh install.sh
-    mkdir -p $out/lib/ocaml/${ocaml.version}/site-lib/
-    ln -s $out/lib/uchar $out/lib/ocaml/${ocaml.version}/site-lib/
-  '';
-
+  installPhase = "opaline -libdir $OCAMLFIND_DESTDIR";
 
   meta = {
     description = "Compatibility library for OCaml’s Uchar module";
diff --git a/pkgs/development/ocaml-modules/xmlm/default.nix b/pkgs/development/ocaml-modules/xmlm/default.nix
index 9d3a0b1bb4d0..a1765296d57d 100644
--- a/pkgs/development/ocaml-modules/xmlm/default.nix
+++ b/pkgs/development/ocaml-modules/xmlm/default.nix
@@ -4,38 +4,24 @@ let
   webpage = "http://erratique.ch/software/${pname}";
 in
 
-assert stdenv.lib.versionAtLeast ocaml.version "3.12";
-
-let param =
-  if stdenv.lib.versionAtLeast ocaml.version "4.02"
-  then {
-    version = "1.3.0";
-    sha256 = "1rrdxg5kh9zaqmgapy9bhdqyxbbvxxib3bdfg1vhw4rrkp1z0x8n";
-    buildInputs = [ topkg ];
-    inherit (topkg) buildPhase;
-  } else {
-    version = "1.2.0";
-    sha256 = "1jywcrwn5z3gkgvicr004cxmdaqfmq8wh72f81jqz56iyn5024nh";
-    buildInputs = [];
-    buildPhase = "./pkg/build true";
-  };
-in
+if !stdenv.lib.versionAtLeast ocaml.version "4.02"
+then throw "xmlm is not available for OCaml ${ocaml.version}"
+else
 
 stdenv.mkDerivation rec {
-  name = "ocaml-${pname}-${version}";
-  inherit (param) version;
+  name = "ocaml${ocaml.version}-${pname}-${version}";
+  version = "1.3.0";
 
   src = fetchurl {
     url = "${webpage}/releases/${pname}-${version}.tbz";
-    inherit (param) sha256;
+    sha256 = "1rrdxg5kh9zaqmgapy9bhdqyxbbvxxib3bdfg1vhw4rrkp1z0x8n";
   };
 
-  buildInputs = [ ocaml findlib ocamlbuild ] ++ param.buildInputs;
+  buildInputs = [ ocaml findlib ocamlbuild topkg ];
 
   unpackCmd = "tar xjf $src";
 
-  inherit (param) buildPhase;
-  inherit (topkg) installPhase;
+  inherit (topkg) buildPhase installPhase;
 
   meta = with stdenv.lib; {
     description = "An OCaml streaming codec to decode and encode the XML data format";
diff --git a/pkgs/development/perl-modules/DBD-Pg/default.nix b/pkgs/development/perl-modules/DBD-Pg/default.nix
index b9d287b2bf3c..f69ce015ed1c 100644
--- a/pkgs/development/perl-modules/DBD-Pg/default.nix
+++ b/pkgs/development/perl-modules/DBD-Pg/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, buildPerlPackage, DBI, postgresql }:
 
 buildPerlPackage rec {
-  name = "DBD-Pg-3.5.3";
+  name = "DBD-Pg-3.7.4";
 
   src = fetchurl {
     url = "mirror://cpan/authors/id/T/TU/TURNSTEP/${name}.tar.gz";
-    sha256 = "03m9w1cd0yyrbqwkwcl92j1cpmasmm69f3hwvcrlfsi5fnwsk63y";
+    sha256 = "0gkqlvbmzbdm0g4k328nlkjdg3wrjm5i2n9jxj1i8sqxkm79rylz";
   };
 
   buildInputs = [ postgresql ];
diff --git a/pkgs/development/perl-modules/DBD-SQLite/default.nix b/pkgs/development/perl-modules/DBD-SQLite/default.nix
index 2737ad95d4b7..5b6990810b39 100644
--- a/pkgs/development/perl-modules/DBD-SQLite/default.nix
+++ b/pkgs/development/perl-modules/DBD-SQLite/default.nix
@@ -1,12 +1,11 @@
 { stdenv, fetchurl, buildPerlPackage, DBI, sqlite }:
 
 buildPerlPackage rec {
-  name = "DBD-SQLite-${version}";
-  version = "1.55_07";
+  name = "DBD-SQLite-1.58";
 
   src = fetchurl {
-    url = "https://github.com/DBD-SQLite/DBD-SQLite/archive/${version}.tar.gz";
-    sha256 = "0213a31eb7b5afc2d7b3775ca2d1717d07fc7e9ed21ae73b2513a8d54ca222d8";
+    url = mirror://cpan/authors/id/I/IS/ISHIGAKI/DBD-SQLite-1.58.tar.gz;
+    sha256 = "0fqx386jgs9mmrknr7smmzapf07izgivza7x08lfm39ks2cxs83i";
   };
 
   propagatedBuildInputs = [ DBI ];
@@ -19,23 +18,10 @@ buildPerlPackage rec {
 
   makeMakerFlags = "SQLITE_INC=${sqlite.dev}/include SQLITE_LIB=${sqlite.out}/lib";
 
-  preBuild =
-    ''
-      substituteInPlace Makefile --replace -L/usr/lib ""
-    '';
-
-  postInstall =
-    ''
-      # Prevent warnings from `strip'.
-      chmod -R u+w $out
-
-      # Get rid of a pointless copy of the SQLite sources.
-      rm -rf $out/lib/perl5/site_perl/*/*/auto/share
-    '';
-
-  # Disabled because the tests can randomly fail due to timeouts
-  # (e.g. "database is locked(5) at dbdimp.c line 402 at t/07busy.t").
-  #doCheck = false;
+  postInstall = ''
+    # Get rid of a pointless copy of the SQLite sources.
+    rm -rf $out/lib/perl5/site_perl/*/*/auto/share
+  '';
 
   meta = with stdenv.lib; {
     description = "Self Contained SQLite RDBMS in a DBI Driver";
diff --git a/pkgs/development/perl-modules/Unicode-String-perl-5-22.patch b/pkgs/development/perl-modules/Unicode-String-perl-5-22.patch
deleted file mode 100644
index 08d0d13b41f0..000000000000
--- a/pkgs/development/perl-modules/Unicode-String-perl-5-22.patch
+++ /dev/null
@@ -1,11 +0,0 @@
-diff -ru libunicode-string-perl-2.09.pristine/lib/Unicode/CharName.pm libunicode-string-perl-2.09/lib/Unicode/CharName.pm
---- libunicode-string-perl-2.09.pristine/lib/Unicode/CharName.pm	2005-10-25 19:11:00.000000000 +0100
-+++ libunicode-string-perl-2.09/lib/Unicode/CharName.pm	2012-01-24 12:56:59.730653088 +0000
-@@ -77,7 +77,7 @@
- 	    return join("", "HANGUL SYLLABLE ", @s)
- 	}
-     }
--    _init_names() unless defined %NAMES;
-+    _init_names() unless %NAMES;
-     $NAMES{sprintf("%04X",$code)}
- }
diff --git a/pkgs/development/python-modules/libvirt/default.nix b/pkgs/development/python-modules/libvirt/default.nix
index d120c38b02cb..65e8f3c7ba6c 100644
--- a/pkgs/development/python-modules/libvirt/default.nix
+++ b/pkgs/development/python-modules/libvirt/default.nix
@@ -2,12 +2,12 @@
 
 buildPythonPackage rec {
   pname = "libvirt";
-  version = "4.1.0";
+  version = "4.4.0";
 
   src = assert version == libvirt.version; fetchgit {
     url = git://libvirt.org/libvirt-python.git;
     rev = "v${version}";
-    sha256 = "0z87y6qr0ypdxfanphxl7yanisd7a0b0bwhg97kii68mig5dlw9r";
+    sha256 = "01kwwwacbq7kbsslb2ac3wwfs4r8nsv7jhn0df2mmff30izbhq34";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/development/python-modules/nbxmpp/default.nix b/pkgs/development/python-modules/nbxmpp/default.nix
index cb7635522621..e45c69aa3954 100644
--- a/pkgs/development/python-modules/nbxmpp/default.nix
+++ b/pkgs/development/python-modules/nbxmpp/default.nix
@@ -2,7 +2,7 @@
 
 buildPythonPackage rec {
   pname = "nbxmpp";
-  version = "0.6.5";
+  version = "0.6.6";
   name = "${pname}-${version}";
 
   # Tests aren't included in PyPI tarball.
@@ -10,7 +10,7 @@ buildPythonPackage rec {
     name = "${name}.tar.bz2";
     url = "https://dev.gajim.org/gajim/python-nbxmpp/repository/archive.tar.bz2?"
         + "ref=${name}";
-    sha256 = "0b7jw07s4mnp20gcg8raw4bhw2h1hxf75cbn4f2ynj69fbpfr38h";
+    sha256 = "10n7z613p00q15dplsvdrz11s9yq26jy2qack6nd8k7fivfhlcmz";
   };
 
   propagatedBuildInputs = [ pyopenssl ];
diff --git a/pkgs/development/tools/continuous-integration/jenkins/default.nix b/pkgs/development/tools/continuous-integration/jenkins/default.nix
index 2d534435b5f9..ebbf5023374f 100644
--- a/pkgs/development/tools/continuous-integration/jenkins/default.nix
+++ b/pkgs/development/tools/continuous-integration/jenkins/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "jenkins-${version}";
-  version = "2.89.4";
+  version = "2.107.3";
 
   src = fetchurl {
     url = "http://mirrors.jenkins.io/war-stable/${version}/jenkins.war";
-    sha256 = "0lwv3y12r36amkr70fap5g1zfd7vv92809lh9w7178s91sikm28x";
+    sha256 = "1f4sz1dqcfypdywdwcz4byjmir7ismcpzg2hbgg6pcf5pq4yba8p";
   };
 
   buildCommand = ''
diff --git a/pkgs/development/tools/ocaml/findlib/default.nix b/pkgs/development/tools/ocaml/findlib/default.nix
index e25b94714b68..18b84e2c961d 100644
--- a/pkgs/development/tools/ocaml/findlib/default.nix
+++ b/pkgs/development/tools/ocaml/findlib/default.nix
@@ -50,8 +50,8 @@ stdenv.mkDerivation rec {
         if test -d "''$1/lib/ocaml/${ocaml.version}/site-lib"; then
             export OCAMLPATH="''${OCAMLPATH}''${OCAMLPATH:+:}''$1/lib/ocaml/${ocaml.version}/site-lib/"
         fi
-        if test -d "''$1/lib/ocaml/${ocaml.version}/site-lib/stubslibs"; then
-            export CAML_LD_LIBRARY_PATH="''${CAML_LD_LIBRARY_PATH}''${CAML_LD_LIBRARY_PATH:+:}''$1/lib/ocaml/${ocaml.version}/site-lib/stubslibs"
+        if test -d "''$1/lib/ocaml/${ocaml.version}/site-lib/stublibs"; then
+            export CAML_LD_LIBRARY_PATH="''${CAML_LD_LIBRARY_PATH}''${CAML_LD_LIBRARY_PATH:+:}''$1/lib/ocaml/${ocaml.version}/site-lib/stublibs"
         fi
         export OCAMLFIND_DESTDIR="''$out/lib/ocaml/${ocaml.version}/site-lib/"
         if test -n "$createFindlibDestdir"; then
diff --git a/pkgs/development/tools/ocaml/jbuilder/default.nix b/pkgs/development/tools/ocaml/jbuilder/default.nix
index 38fd4323d5ca..abfcdb61c1e6 100644
--- a/pkgs/development/tools/ocaml/jbuilder/default.nix
+++ b/pkgs/development/tools/ocaml/jbuilder/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, ocaml, opam }:
+{ stdenv, fetchFromGitHub, ocamlPackages, opaline }:
 
 stdenv.mkDerivation rec {
   name = "jbuilder-${version}";
@@ -10,11 +10,11 @@ stdenv.mkDerivation rec {
     sha256 = "0571lzm8caq6wnia7imgy4a27x5l2bvxiflg0jrwwml0ylnii65f";
   };
 
-  buildInputs = [ ocaml ];
+  buildInputs = with ocamlPackages; [ ocaml findlib ];
 
   dontAddPrefix = true;
 
-  installPhase = "${opam}/bin/opam-installer -i --prefix=$out --libdir=$OCAMLFIND_DESTDIR";
+  installPhase = "${opaline}/bin/opaline -prefix $out -libdir $OCAMLFIND_DESTDIR";
 
   preFixup = "rm -rf $out/jbuilder";
 
@@ -23,6 +23,6 @@ stdenv.mkDerivation rec {
     description = "Fast, portable and opinionated build system";
     maintainers = [ stdenv.lib.maintainers.vbgl ];
     license = stdenv.lib.licenses.asl20;
-    inherit (ocaml.meta) platforms;
+    inherit (ocamlPackages.ocaml.meta) platforms;
   };
 }
diff --git a/pkgs/development/tools/ocaml/opam/default.nix b/pkgs/development/tools/ocaml/opam/default.nix
index 469e97e19de5..aa9feda985a3 100644
--- a/pkgs/development/tools/ocaml/opam/default.nix
+++ b/pkgs/development/tools/ocaml/opam/default.nix
@@ -71,8 +71,12 @@ in stdenv.mkDerivation rec {
   # Dirty, but apparently ocp-build requires a TERM
   makeFlags = ["TERM=screen"];
 
+  # change argv0 to "opam" as a workaround for
+  # https://github.com/ocaml/opam/issues/2142
   postInstall = ''
-    wrapProgram $out/bin/opam \
+    mv $out/bin/opam $out/bin/.opam-wrapped
+    makeWrapper $out/bin/.opam-wrapped $out/bin/opam \
+      --argv0 "opam" \
       --suffix PATH : ${aspcud}/bin:${unzip}/bin:${curl}/bin
   '';