summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--maintainers/maintainer-list.nix5
-rw-r--r--nixos/modules/config/zram.nix8
-rw-r--r--nixos/modules/misc/documentation.nix43
-rw-r--r--nixos/modules/module-list.nix2
-rw-r--r--nixos/modules/services/databases/foundationdb.nix360
-rw-r--r--nixos/modules/services/databases/foundationdb.xml279
-rw-r--r--nixos/modules/services/hardware/trezord.nix11
-rw-r--r--nixos/modules/services/networking/hans.nix145
-rw-r--r--nixos/modules/services/networking/iodine.nix22
-rw-r--r--pkgs/applications/altcoins/bitcoin-unlimited.nix10
-rw-r--r--pkgs/applications/altcoins/bitcoin-xt.nix8
-rw-r--r--pkgs/applications/altcoins/default.nix20
-rw-r--r--pkgs/applications/audio/cdparanoia/default.nix3
-rw-r--r--pkgs/applications/audio/cdparanoia/fix_private_keyword.patch468
-rw-r--r--pkgs/applications/misc/gphoto2/default.nix4
-rw-r--r--pkgs/applications/misc/urh/default.nix4
-rw-r--r--pkgs/applications/networking/browsers/firefox/wrapper.nix4
-rw-r--r--pkgs/applications/office/todo.txt-cli/default.nix4
-rw-r--r--pkgs/applications/science/math/calc/default.nix62
-rw-r--r--pkgs/applications/science/math/mathematica/default.nix23
-rw-r--r--pkgs/applications/science/math/mathematica/l10ns.nix33
-rw-r--r--pkgs/applications/video/handbrake/default.nix20
-rw-r--r--pkgs/build-support/vm/default.nix12
-rw-r--r--pkgs/development/interpreters/eff/default.nix23
-rw-r--r--pkgs/development/interpreters/supercollider/default.nix4
-rw-r--r--pkgs/development/libraries/fflas-ffpack/default.nix31
-rw-r--r--pkgs/development/libraries/gmime/3.nix6
-rw-r--r--pkgs/development/libraries/libgphoto2/default.nix6
-rw-r--r--pkgs/development/libraries/linbox/default.nix79
-rw-r--r--pkgs/development/libraries/openmpi/default.nix4
-rw-r--r--pkgs/development/libraries/rocksdb/default.nix4
-rw-r--r--pkgs/development/tools/build-managers/buildbot/default.nix4
-rw-r--r--pkgs/development/tools/misc/hydra/default.nix2
-rw-r--r--pkgs/servers/dns/knot-resolver/default.nix4
-rw-r--r--pkgs/servers/foundationdb/default.nix99
-rw-r--r--pkgs/servers/foundationdb/fix-scm-version.patch42
-rw-r--r--pkgs/servers/foundationdb/ldflags.patch90
-rw-r--r--pkgs/servers/ftp/bftpd/default.nix34
-rw-r--r--pkgs/servers/jackett/default.nix4
-rw-r--r--pkgs/shells/xonsh/default.nix6
-rw-r--r--pkgs/tools/graphics/maim/default.nix13
-rw-r--r--pkgs/tools/misc/ipxe/default.nix8
-rw-r--r--pkgs/tools/misc/slop/default.nix8
-rw-r--r--pkgs/tools/package-management/nix-pin/default.nix33
-rw-r--r--pkgs/top-level/all-packages.nix5
-rw-r--r--pkgs/top-level/ocaml-packages.nix2
46 files changed, 1890 insertions, 171 deletions
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 1cd73469e78a..1178ebb536ec 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -28,6 +28,11 @@
     github = "AndersonTorres";
     name = "Anderson Torres";
   };
+  Anton-Latukha = {
+    email = "anton.latuka+nixpkgs@gmail.com";
+    github = "Anton-Latukha";
+    name = "Anton Latukha";
+  };
   Baughn = {
     email = "sveina@gmail.com";
     github = "Baughn";
diff --git a/nixos/modules/config/zram.nix b/nixos/modules/config/zram.nix
index ae1b0a6c8e11..c1748812821e 100644
--- a/nixos/modules/config/zram.nix
+++ b/nixos/modules/config/zram.nix
@@ -25,16 +25,16 @@ in
         type = types.bool;
         description = ''
           Enable in-memory compressed swap space provided by the zram kernel
-          module. It is recommended to enable only for kernel 3.14 or higher.
+          module.
+          See https://www.kernel.org/doc/Documentation/blockdev/zram.txt
         '';
       };
 
       numDevices = mkOption {
-        default = 4;
+        default = 1;
         type = types.int;
         description = ''
-          Number of zram swap devices to create. It should be equal to the
-          number of CPU cores your system has.
+          Number of zram swap devices to create.
         '';
       };
 
diff --git a/nixos/modules/misc/documentation.nix b/nixos/modules/misc/documentation.nix
index cea8981370bb..2e426c017080 100644
--- a/nixos/modules/misc/documentation.nix
+++ b/nixos/modules/misc/documentation.nix
@@ -16,7 +16,10 @@ let cfg = config.documentation; in
         description = ''
           Whether to install documentation of packages from
           <option>environment.systemPackages</option> into the generated system path.
+
+          See "Multiple-output packages" chapter in the nixpkgs manual for more info.
         '';
+        # which is at ../../../doc/multiple-output.xml
       };
 
       man.enable = mkOption {
@@ -28,6 +31,15 @@ let cfg = config.documentation; in
         '';
       };
 
+      info.enable = mkOption {
+        type = types.bool;
+        default = true;
+        description = ''
+          Whether to install info pages and the <command>info</command> command.
+          This also includes "info" outputs.
+        '';
+      };
+
       doc.enable = mkOption {
         type = types.bool;
         default = true;
@@ -38,12 +50,19 @@ let cfg = config.documentation; in
         '';
       };
 
-      info.enable = mkOption {
+      dev.enable = mkOption {
         type = types.bool;
-        default = true;
+        default = false;
         description = ''
-          Whether to install info pages and the <command>info</command> command.
-          This also includes "info" outputs.
+          Whether to install documentation targeted at developers.
+          <itemizedlist>
+          <listitem><para>This includes man pages targeted at developers if <option>man.enable</option> is
+                    set (this also includes "devman" outputs).</para></listitem>
+          <listitem><para>This includes info pages targeted at developers if <option>info.enable</option>
+                    is set (this also includes "devinfo" outputs).</para></listitem>
+          <listitem><para>This includes other pages targeted at developers if <option>doc.enable</option>
+                    is set (this also includes "devdoc" outputs).</para></listitem>
+          </itemizedlist>
         '';
       };
 
@@ -56,20 +75,20 @@ let cfg = config.documentation; in
     (mkIf cfg.man.enable {
       environment.systemPackages = [ pkgs.man-db ];
       environment.pathsToLink = [ "/share/man" ];
-      environment.extraOutputsToInstall = [ "man" ];
+      environment.extraOutputsToInstall = [ "man" ] ++ optional cfg.dev.enable [ "devman" ];
+    })
+
+    (mkIf cfg.info.enable {
+      environment.systemPackages = [ pkgs.texinfoInteractive ];
+      environment.pathsToLink = [ "/share/info" ];
+      environment.extraOutputsToInstall = [ "info" ] ++ optional cfg.dev.enable [ "devinfo" ];
     })
 
     (mkIf cfg.doc.enable {
       # TODO(@oxij): put it here and remove from profiles?
       # environment.systemPackages = [ pkgs.w3m ]; # w3m-nox?
       environment.pathsToLink = [ "/share/doc" ];
-      environment.extraOutputsToInstall = [ "doc" ];
-    })
-
-    (mkIf cfg.info.enable {
-      environment.systemPackages = [ pkgs.texinfoInteractive ];
-      environment.pathsToLink = [ "/share/info" ];
-      environment.extraOutputsToInstall = [ "info" ];
+      environment.extraOutputsToInstall = [ "doc" ] ++ optional cfg.dev.enable [ "devdoc" ];
     })
 
   ]);
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index c0c3249c60b6..1261fe950928 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -195,6 +195,7 @@
   ./services/databases/clickhouse.nix
   ./services/databases/couchdb.nix
   ./services/databases/firebird.nix
+  ./services/databases/foundationdb.nix
   ./services/databases/hbase.nix
   ./services/databases/influxdb.nix
   ./services/databases/memcached.nix
@@ -481,6 +482,7 @@
   ./services/networking/gnunet.nix
   ./services/networking/gogoclient.nix
   ./services/networking/gvpe.nix
+  ./services/networking/hans.nix
   ./services/networking/haproxy.nix
   ./services/networking/heyefi.nix
   ./services/networking/hostapd.nix
diff --git a/nixos/modules/services/databases/foundationdb.nix b/nixos/modules/services/databases/foundationdb.nix
new file mode 100644
index 000000000000..ba921a9c1521
--- /dev/null
+++ b/nixos/modules/services/databases/foundationdb.nix
@@ -0,0 +1,360 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.foundationdb;
+
+  # used for initial cluster configuration
+  initialIpAddr = if (cfg.publicAddress != "auto") then cfg.publicAddress else "127.0.0.1";
+
+  fdbServers = n:
+    concatStringsSep "\n" (map (x: "[fdbserver.${toString (x+cfg.listenPortStart)}]") (range 0 (n - 1)));
+
+  backupAgents = n:
+    concatStringsSep "\n" (map (x: "[backup_agent.${toString x}]") (range 1 n));
+
+  configFile = pkgs.writeText "foundationdb.conf" ''
+    [general]
+    cluster_file  = /etc/foundationdb/fdb.cluster
+
+    [fdbmonitor]
+    restart_delay = ${toString cfg.restartDelay}
+    user          = ${cfg.user}
+    group         = ${cfg.group}
+
+    [fdbserver]
+    command        = ${pkgs.foundationdb}/bin/fdbserver
+    public_address = ${cfg.publicAddress}:$ID
+    listen_address = ${cfg.listenAddress}
+    datadir        = ${cfg.dataDir}/$ID
+    logdir         = ${cfg.logDir}
+    logsize        = ${cfg.logSize}
+    maxlogssize    = ${cfg.maxLogSize}
+    ${optionalString (cfg.class != null) "class = ${cfg.class}"}
+    memory         = ${cfg.memory}
+    storage_memory = ${cfg.storageMemory}
+
+    ${optionalString (cfg.locality.machineId    != null) "locality_machineid=${cfg.locality.machineId}"}
+    ${optionalString (cfg.locality.zoneId       != null) "locality_zoneid=${cfg.locality.zoneId}"}
+    ${optionalString (cfg.locality.datacenterId != null) "locality_dcid=${cfg.locality.datacenterId}"}
+    ${optionalString (cfg.locality.dataHall     != null) "locality_data_hall=${cfg.locality.dataHall}"}
+
+    ${fdbServers cfg.serverProcesses}
+
+    [backup_agent]
+    command = ${pkgs.foundationdb}/libexec/backup_agent
+    ${backupAgents cfg.backupProcesses}
+  '';
+in
+{
+  options.services.foundationdb = {
+
+    enable = mkEnableOption "FoundationDB Server";
+
+    publicAddress = mkOption {
+      type        = types.str;
+      default     = "auto";
+      description = "Publicly visible IP address of the process. Port is determined by process ID";
+    };
+
+    listenAddress = mkOption {
+      type        = types.str;
+      default     = "public";
+      description = "Publicly visible IP address of the process. Port is determined by process ID";
+    };
+
+    listenPortStart = mkOption {
+      type          = types.int;
+      default       = 4500;
+      description   = ''
+        Starting port number for database listening sockets. Every FDB process binds to a
+        subsequent port, to this number reflects the start of the overall range. e.g. having
+        8 server processes will use all ports between 4500 and 4507.
+      '';
+    };
+
+    openFirewall = mkOption {
+      type        = types.bool;
+      default     = false;
+      description = ''
+        Open the firewall ports corresponding to FoundationDB processes and coordinators
+        using <option>config.networking.firewall.*</option>.
+      '';
+    };
+
+    dataDir = mkOption {
+      type        = types.path;
+      default     = "/var/lib/foundationdb";
+      description = "Data directory. All cluster data will be put under here.";
+    };
+
+    logDir = mkOption {
+      type        = types.path;
+      default     = "/var/log/foundationdb";
+      description = "Log directory.";
+    };
+
+    user = mkOption {
+      type        = types.str;
+      default     = "foundationdb";
+      description = "User account under which FoundationDB runs.";
+    };
+
+    group = mkOption {
+      type        = types.str;
+      default     = "foundationdb";
+      description = "Group account under which FoundationDB runs.";
+    };
+
+    class = mkOption {
+      type        = types.nullOr (types.enum [ "storage" "transaction" "stateless" ]);
+      default     = null;
+      description = "Process class";
+    };
+
+    restartDelay = mkOption {
+      type = types.int;
+      default = 10;
+      description = "Number of seconds to wait before restarting servers.";
+    };
+
+    logSize = mkOption {
+      type        = types.string;
+      default     = "10MiB";
+      description = ''
+        Roll over to a new log file after the current log file
+        reaches the specified size.
+      '';
+    };
+
+    maxLogSize = mkOption {
+      type        = types.string;
+      default     = "100MiB";
+      description = ''
+        Delete the oldest log file when the total size of all log
+        files exceeds the specified size. If set to 0, old log files
+        will not be deleted.
+      '';
+    };
+
+    serverProcesses = mkOption {
+      type = types.int;
+      default = 1;
+      description = "Number of fdbserver processes to run.";
+    };
+
+    backupProcesses = mkOption {
+      type = types.int;
+      default = 1;
+      description = "Number of backup_agent processes to run for snapshots.";
+    };
+
+    memory = mkOption {
+      type        = types.string;
+      default     = "8GiB";
+      description = ''
+        Maximum memory used by the process. The default value is
+        <literal>8GiB</literal>. When specified without a unit,
+        <literal>MiB</literal> is assumed. This parameter does not
+        change the memory allocation of the program. Rather, it sets
+        a hard limit beyond which the process will kill itself and
+        be restarted. The default value of <literal>8GiB</literal>
+        is double the intended memory usage in the default
+        configuration (providing an emergency buffer to deal with
+        memory leaks or similar problems). It is not recommended to
+        decrease the value of this parameter below its default
+        value. It may be increased if you wish to allocate a very
+        large amount of storage engine memory or cache. In
+        particular, when the <literal>storageMemory</literal>
+        parameter is increased, the <literal>memory</literal>
+        parameter should be increased by an equal amount.
+      '';
+    };
+
+    storageMemory = mkOption {
+      type        = types.string;
+      default     = "1GiB";
+      description = ''
+        Maximum memory used for data storage. The default value is
+        <literal>1GiB</literal>. When specified without a unit,
+        <literal>MB</literal> is assumed. Clusters using the memory
+        storage engine will be restricted to using this amount of
+        memory per process for purposes of data storage. Memory
+        overhead associated with storing the data is counted against
+        this total. If you increase the
+        <literal>storageMemory</literal>, you should also increase
+        the <literal>memory</literal> parameter by the same amount.
+      '';
+    };
+
+    locality = mkOption {
+      default = {
+        machineId    = null;
+        zoneId       = null;
+        datacenterId = null;
+        dataHall     = null;
+      };
+
+      description = ''
+        FoundationDB locality settings.
+      '';
+
+      type = types.submodule ({
+        options = {
+          machineId = mkOption {
+            default = null;
+            type = types.nullOr types.str;
+            description = ''
+	      Machine identifier key. All processes on a machine should share a
+              unique id. By default, processes on a machine determine a unique id to share.
+              This does not generally need to be set.
+            '';
+          };
+
+          zoneId = mkOption {
+            default = null;
+            type = types.nullOr types.str;
+            description = ''
+	      Zone identifier key. Processes that share a zone id are
+              considered non-unique for the purposes of data replication.
+              If unset, defaults to machine id.
+            '';
+          };
+
+          datacenterId = mkOption {
+            default = null;
+            type = types.nullOr types.str;
+            description = ''
+	      Data center identifier key. All processes physically located in a
+              data center should share the id. If you are depending on data
+              center based replication this must be set on all processes.
+            '';
+          };
+
+          dataHall = mkOption {
+            default = null;
+            type = types.nullOr types.str;
+            description = ''
+	      Data hall identifier key. All processes physically located in a
+              data hall should share the id. If you are depending on data
+              hall based replication this must be set on all processes.
+            '';
+          };
+        };
+      });
+    };
+
+    extraReadWritePaths = mkOption {
+      default = [ ];
+      type = types.listOf types.path;
+      description = ''
+        An extra set of filesystem paths that FoundationDB can read to
+        and write from. By default, FoundationDB runs under a heavily
+        namespaced systemd environment without write access to most of
+        the filesystem outside of its data and log directories. By
+        adding paths to this list, the set of writeable paths will be
+        expanded. This is useful for allowing e.g. backups to local files,
+        which must be performed on behalf of the foundationdb service.
+      '';
+    };
+
+    pidfile = mkOption {
+      type        = types.path;
+      default     = "/run/foundationdb.pid";
+      description = "Path to pidfile for fdbmonitor.";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    meta.doc         = ./foundationdb.xml;
+    meta.maintainers = with lib.maintainers; [ thoughtpolice ];
+
+    environment.systemPackages = [ pkgs.foundationdb ];
+
+    users.extraUsers = optionalAttrs (cfg.user == "foundationdb") (singleton
+      { name        = "foundationdb";
+        description = "FoundationDB User";
+        uid         = config.ids.uids.foundationdb;
+        group       = cfg.group;
+      });
+
+    users.extraGroups = optionalAttrs (cfg.group == "foundationdb") (singleton
+      { name = "foundationdb";
+        gid  = config.ids.gids.foundationdb;
+      });
+
+    networking.firewall.allowedTCPPortRanges = mkIf cfg.openFirewall
+      [ { from = cfg.listenPortStart;
+          to = (cfg.listenPortStart + cfg.serverProcesses) - 1;
+        }
+      ];
+
+    systemd.services.foundationdb = {
+      description             = "FoundationDB Service";
+
+      after                   = [ "network.target" ];
+      wantedBy                = [ "multi-user.target" ];
+      unitConfig =
+        { RequiresMountsFor = "${cfg.dataDir} ${cfg.logDir}";
+        };
+
+      serviceConfig =
+        let rwpaths = [ cfg.dataDir cfg.logDir cfg.pidfile "/etc/foundationdb" ]
+                   ++ cfg.extraReadWritePaths;
+        in
+        { Type       = "simple";
+          Restart    = "always";
+          RestartSec = 5;
+          User       = cfg.user;
+          Group      = cfg.group;
+          PIDFile    = "${cfg.pidfile}";
+
+          PermissionsStartOnly = true;  # setup needs root perms
+          TimeoutSec           = 120;   # give reasonable time to shut down
+
+          # Security options
+          NoNewPrivileges       = true;
+          ProtectHome           = true;
+          ProtectSystem         = "strict";
+          ProtectKernelTunables = true;
+          ProtectControlGroups  = true;
+          PrivateTmp            = true;
+          PrivateDevices        = true;
+          ReadWritePaths        = lib.concatStringsSep " " (map (x: "-" + x) rwpaths);
+        };
+
+      path = [ pkgs.foundationdb pkgs.coreutils ];
+
+      preStart = ''
+        rm -f ${cfg.pidfile}   && \
+          touch ${cfg.pidfile} && \
+          chown -R ${cfg.user}:${cfg.group} ${cfg.pidfile}
+
+        for x in "${cfg.logDir}" "${cfg.dataDir}" /etc/foundationdb; do
+          [ ! -d "$x" ] && mkdir -m 0700 -vp "$x" && chown -R ${cfg.user}:${cfg.group} "$x";
+        done
+
+        if [ ! -f /etc/foundationdb/fdb.cluster ]; then
+            cf=/etc/foundationdb/fdb.cluster
+            desc=$(tr -dc A-Za-z0-9 </dev/urandom 2>/dev/null | head -c8)
+            rand=$(tr -dc A-Za-z0-9 </dev/urandom 2>/dev/null | head -c8)
+            echo ''${desc}:''${rand}@${initialIpAddr}:${builtins.toString cfg.listenPortStart} > $cf
+            chmod 0660 $cf && chown -R ${cfg.user}:${cfg.group} $cf
+            touch "${cfg.dataDir}/.first_startup"
+        fi
+      '';
+
+      script = ''
+        exec fdbmonitor --lockfile ${cfg.pidfile} --conffile ${configFile};
+      '';
+
+      postStart = ''
+        if [ -e "${cfg.dataDir}/.first_startup" ]; then
+          fdbcli --exec "configure new single ssd"
+          rm -f "${cfg.dataDir}/.first_startup";
+        fi
+      '';
+    };
+  };
+}
diff --git a/nixos/modules/services/databases/foundationdb.xml b/nixos/modules/services/databases/foundationdb.xml
new file mode 100644
index 000000000000..d10a5cfe836e
--- /dev/null
+++ b/nixos/modules/services/databases/foundationdb.xml
@@ -0,0 +1,279 @@
+<chapter xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xmlns:xi="http://www.w3.org/2001/XInclude"
+         version="5.0"
+         xml:id="module-foundationdb">
+
+<title>FoundationDB</title>
+
+<para><emphasis>Source:</emphasis> <filename>modules/services/databases/foundationdb.nix</filename></para>
+
+<para><emphasis>Upstream documentation:</emphasis> <link xlink:href="https://apple.github.io/foundationdb/"/></para>
+
+<para><emphasis>Maintainer:</emphasis> Austin Seipp</para>
+
+<para><emphasis>Default version:</emphasis> 5.1.x</para>
+
+<para>FoundationDB (or "FDB") is a distributed, open source, high performance,
+transactional key-value store. It can store petabytes of data and deliver
+exceptional performance while maintaining consistency and ACID semantics over a
+large cluster.</para>
+
+<section><title>Configuring and basic setup</title>
+
+<para>To enable FoundationDB, add the following to your
+<filename>configuration.nix</filename>:
+
+<programlisting>
+services.foundationdb.enable = true;
+</programlisting>
+</para>
+
+<para>After running <command>nixos-rebuild</command>, you can verify whether
+FoundationDB is running by executing <command>fdbcli</command> (which is added
+to <option>environment.systemPackages</option>):
+
+<programlisting>
+$ sudo -u foundationdb fdbcli
+Using cluster file `/etc/foundationdb/fdb.cluster'.
+
+The database is available.
+
+Welcome to the fdbcli. For help, type `help'.
+fdb> status
+
+Using cluster file `/etc/foundationdb/fdb.cluster'.
+
+Configuration:
+  Redundancy mode        - single
+  Storage engine         - memory
+  Coordinators           - 1
+
+Cluster:
+  FoundationDB processes - 1
+  Machines               - 1
+  Memory availability    - 5.4 GB per process on machine with least available
+  Fault Tolerance        - 0 machines
+  Server time            - 04/20/18 15:21:14
+
+...
+
+fdb>
+</programlisting>
+</para>
+
+<para>FoundationDB is run under the <command>foundationdb</command> user and
+group by default, but this may be changed in the NixOS configuration. The
+systemd unit <command>foundationdb.service</command> controls the
+<command>fdbmonitor</command> process.</para>
+
+<para>By default, the NixOS module for FoundationDB creates a single
+SSD-storage based database for development and basic usage. This storage engine
+is designed for SSDs and will perform poorly on HDDs; however it can handle far
+more data than the alternative "memory" engine and is a better default choice
+for most deployments. (Note that you can change the storage backend on-the-fly
+for a given FoundationDB cluster using <command>fdbcli</command>.)</para>
+
+<para>Furthermore, only 1 server process and 1 backup agent are started in the
+default configuration. See below for more on scaling to increase this.</para>
+
+<para>FoundationDB stores all data for all server processes under
+<filename>/var/lib/foundationdb</filename>. You can override this using
+<option>services.foundationdb.dataDir</option>, e.g.
+
+<programlisting>
+services.foundationdb.dataDir = "/data/fdb";
+</programlisting>
+
+</para>
+
+<para>Similarly, logs are stored under
+<filename>/var/log/foundationdb</filename> by default, and there is a
+corresponding <option>services.foundationdb.logDir</option> as well.</para>
+
+</section>
+
+<section><title>Scaling processes and backup agents</title>
+
+<para>Scaling the number of server processes is quite easy; simply specify
+<option>services.foundationdb.serverProcesses</option> to be the number of
+FoundationDB worker processes that should be started on the machine.</para>
+
+<para>FoundationDB worker processes typically require 4GB of RAM per-process at
+minimum for good performance, so this option is set to 1 by default since the
+maximum aount of RAM is unknown. You're advised to abide by this restriction,
+so pick a number of processes so that each has 4GB or more.</para>
+
+<para>A similar option exists in order to scale backup agent processes,
+<option>services.foundationdb.backupProcesses</option>. Backup agents are not
+as performance/RAM sensitive, so feel free to experiment with the number of
+available backup processes.</para>
+
+</section>
+
+<section><title>Clustering</title>
+
+<para>FoundationDB on NixOS works similarly to other Linux systems, so this
+section will be brief. Please refer to the full FoundationDB documentation for
+more on clustering.</para>
+
+<para>FoundationDB organizes clusters using a set of
+<emphasis>coordinators</emphasis>, which are just specially-designated worker
+processes. By default, every installation of FoundationDB on NixOS will start
+as its own individual cluster, with a single coordinator: the first worker
+process on <command>localhost</command>.</para>
+
+<para>Coordinators are specified globally using the
+<command>/etc/foundationdb/fdb.cluster</command> file, which all servers and
+client applications will use to find and join coordinators. Note that this file
+<emphasis>can not</emphasis> be managed by NixOS so easily: FoundationDB is
+designed so that it will rewrite the file at runtime for all clients and nodes
+when cluster coordinators change, with clients transparently handling this
+without intervention.</para>
+
+<para>When dealing with a cluster, there are two main things you want to
+do:</para>
+
+<itemizedlist>
+  <listitem><para>Add a node to the cluster for storage/compute.</para></listitem>
+  <listitem><para>Promote an ordinary worker to a coordinator.</para></listitem>
+</itemizedlist>
+
+<para>A node must already be a member of the cluster in order to properly be
+promoted to a coordinator, so you must always add it first if you wish to
+promote it.</para>
+
+<para>To add a machine to a FoundationDB cluster:</para>
+
+<itemizedlist>
+  <listitem><para>Choose one of the servers to start as the initial coordinator.
+      </para></listitem>
+  <listitem><para>Copy the <command>/etc/foundationdb/fdb.cluster</command> file
+      from this server to all the other servers. Restart FoundationDB on all of
+      these other servers, so they join the cluster.</para></listitem>
+  <listitem><para>All of these servers are now connected and working together
+      in the cluster, under the chosen coordinator.</para></listitem>
+</itemizedlist>
+
+<para>At this point, you can add as many nodes as you want by just repeating
+the above steps. By default there will still be a single coordinator: you can
+use <command>fdbcli</command> to change this and add new coordinators.</para>
+
+<para>As a convenience, FoundationDB can automatically assign coordinators
+based on the redundancy mode you wish to achieve for the cluster. Once all the
+nodes have been joined, simply set the replication policy, and then issue the
+<command>coordinators auto</command> command</para>
+
+<para>For example, assuming we have 3 nodes available, we can enable double
+redundancy mode, then auto-select coordinators. For double redundancy, 3
+coordinators is ideal: therefore FoundationDB will make
+<emphasis>every</emphasis> node a coordinator automatically:</para>
+
+<programlisting>
+fdbcli> configure double ssd
+fdbcli> coordinators auto
+</programlisting>
+
+<para>This will transparently update all the servers within seconds, and
+appropriately rewrite the <command>fdb.cluster</command> file, as well as
+informing all client processes to do the same.</para>
+
+</section>
+
+<section><title>Client connectivity</title>
+
+<para>By default, all clients must use the current
+<command>fdb.cluster</command> file to access a given FoundationDB cluster.
+This file is located by default in
+<command>/etc/foundationdb/fdb.cluster</command> on all machines with the
+FoundationDB service enabled, so you may copy the active one from your cluster
+to a new node in order to connect, if it is not part of the cluster.</para>
+
+</section>
+
+<section><title>Backups and Disaster Recovery</title>
+
+<para>The usual rules for doing FoundationDB backups apply on NixOS as written
+in the FoundationDB manual. However, one important difference is the security
+profile for NixOS: by default, the <command>foundationdb</command> systemd unit
+uses <emphasis>Linux namespaces</emphasis> to restrict write access to the
+system, except for the log directory, data directory, and the
+<command>/etc/foundationdb/</command> directory. This is enforced by default
+and cannot be disabled.</para>
+
+<para>However, a side effect of this is that the <command>fdbbackup</command>
+command doesn't work properly for local filesystem backups: FoundationDB uses a
+server process alongside the database processes to perform backups and copy the
+backups to the filesystem. As a result, this process is put under the
+restricted namespaces above: the backup process can only write to a limited
+number of paths.</para>
+
+<para>In order to allow flexible backup locations on local disks, the
+FoundationDB NixOS module supports a
+<option>services.foundationdb.extraReadWritePaths</option> option. This option
+takes a list of paths, and adds them to the systemd unit, allowing the
+processes inside the service to write (and read) the specified
+directories.</para>
+
+<para>For example, to create backups in <command>/opt/fdb-backups</command>,
+first set up the paths in the module options:</para>
+
+<programlisting>
+services.foundationdb.extraReadWritePaths = [ "/opt/fdb-backups" ];
+</programlisting>
+
+<para>Restart the FoundationDB service, and it will now be able to write to
+this directory (even if it does not yet exist.) Note: this path
+<emphasis>must</emphasis> exist before restarting the unit. Otherwise, systemd
+will not include it in the private FoundationDB namespace (and it will not add
+it dynamically at runtime).</para>
+
+<para>You can now perform a backup:</para>
+
+<programlisting>
+$ sudo -u foundationdb fdbbackup start  -t default -d file:///opt/fdb-backups
+$ sudo -u foundationdb fdbbackup status -t default
+</programlisting>
+
+</section>
+
+<section><title>Known limitations</title>
+
+<para>The FoundationDB setup for NixOS should currently be considered beta.
+FoundationDB is not new software, but the NixOS compilation and integration has
+only undergone fairly basic testing of all the available functionality.</para>
+
+<itemizedlist>
+  <listitem><para>TLS plugin support is compiled in, but it's currently not
+      possible to specify the set of TLS certificate options in
+      <command>services.foundationdb</command></para></listitem>
+  <listitem><para>There is no way to specify individual parameters for
+      individual <command>fdbserver</command> processes. Currently, all server
+      processes inherit all the global <command>fdbmonitor</command> settings.
+      </para></listitem>
+  <listitem><para>Python bindings are not currently installed.</para></listitem>
+  <listitem><para>Ruby bindings are not currently installed.</para></listitem>
+  <listitem><para>Java bindings are not currently installed.</para></listitem>
+  <listitem><para>Go bindings are not currently installed.</para></listitem>
+</itemizedlist>
+
+</section>
+
+<section><title>Options</title>
+
+<para>NixOS's FoundationDB module allows you to configure all of the most
+relevant configuration options for <command>fdbmonitor</command>, matching it
+quite closely. For a complete list of all options, check <command>man
+configuration.nix</command>.</para>
+
+</section>
+
+<section><title>Full documentation</title>
+
+<para>FoundationDB is a complex piece of software, and requires careful
+administration to properly use. Full documentation for administration can be
+found here: <link xlink:href="https://apple.github.io/foundationdb/"/>.</para>
+
+</section>
+
+</chapter>
diff --git a/nixos/modules/services/hardware/trezord.nix b/nixos/modules/services/hardware/trezord.nix
index fa0496114684..f2ec00a7d3e1 100644
--- a/nixos/modules/services/hardware/trezord.nix
+++ b/nixos/modules/services/hardware/trezord.nix
@@ -26,8 +26,15 @@ in {
       name = "trezord-udev-rules";
       destination = "/etc/udev/rules.d/51-trezor.rules";
       text = ''
-        SUBSYSTEM=="usb", ATTR{idVendor}=="534c", ATTR{idProduct}=="0001", MODE="0666", GROUP="dialout", SYMLINK+="trezor%n"
-        KERNEL=="hidraw*", ATTRS{idVendor}=="534c", ATTRS{idProduct}=="0001",  MODE="0666", GROUP="dialout"
+        # Trezor 1
+        SUBSYSTEM=="usb",  ATTR{idVendor}=="534c",  ATTR{idProduct}=="0001",  MODE="0666", GROUP="dialout", SYMLINK+="trezor%n"
+        KERNEL=="hidraw*", ATTRS{idVendor}=="534c", ATTRS{idProduct}=="0001", MODE="0666", GROUP="dialout"
+
+        # Trezor 2 (Model-T)
+        SUBSYSTEM=="usb",  ATTR{idVendor}=="1209",  ATTR{idProduct}=="53c0",  MODE="0661", GROUP="dialout", TAG+="uaccess", TAG+="udev-acl", SYMLINK+="trezor%n"
+        SUBSYSTEM=="usb",  ATTR{idVendor}=="1209",  ATTR{idProduct}=="53c1",  MODE="0660", GROUP="dialout", TAG+="uaccess", TAG+="udev-acl", SYMLINK+="trezor%n"
+        KERNEL=="hidraw*", ATTRS{idVendor}=="1209", ATTRS{idProduct}=="53c1", MODE="0660", GROUP="dialout", TAG+="uaccess", TAG+="udev-acl"
+  ];
       '';
     });
 
diff --git a/nixos/modules/services/networking/hans.nix b/nixos/modules/services/networking/hans.nix
new file mode 100644
index 000000000000..56c30a6b96e1
--- /dev/null
+++ b/nixos/modules/services/networking/hans.nix
@@ -0,0 +1,145 @@
+# NixOS module for hans, ip over icmp daemon
+
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.hans;
+
+  hansUser = "hans";
+
+in
+{
+
+  ### configuration
+
+  options = {
+
+    services.hans = {
+      clients = mkOption {
+        default = {};
+        description = ''
+          Each attribute of this option defines a systemd service that
+          runs hans. Many or none may be defined.
+          The name of each service is
+          <literal>hans-<replaceable>name</replaceable></literal>
+          where <replaceable>name</replaceable> is the name of the
+          corresponding attribute name.
+        '';
+        example = literalExample ''
+        {
+          foo = {
+            server = "192.0.2.1";
+            extraConfig = "-v";
+          }
+        }
+        '';
+        type = types.attrsOf (types.submodule (
+        {
+          options = {
+            server = mkOption {
+              type = types.str;
+              default = "";
+              description = "IP address of server running hans";
+              example = "192.0.2.1";
+            };
+
+            extraConfig = mkOption {
+              type = types.str;
+              default = "";
+              description = "Additional command line parameters";
+              example = "-v";
+            };
+
+            passwordFile = mkOption {
+              type = types.str;
+              default = "";
+              description = "File that containts password";
+            };
+
+          };
+        }));
+      };
+
+      server = {
+        enable = mkOption {
+          type = types.bool;
+          default = false;
+          description = "enable hans server";
+        };
+
+        ip = mkOption {
+          type = types.str;
+          default = "";
+          description = "The assigned ip range";
+          example = "198.51.100.0";
+        };
+
+        respondToSystemPings = mkOption {
+          type = types.bool;
+          default = false;
+          description = "Force hans respond to ordinary pings";
+        };
+
+        extraConfig = mkOption {
+          type = types.str;
+          default = "";
+          description = "Additional command line parameters";
+          example = "-v";
+        };
+
+        passwordFile = mkOption {
+          type = types.str;
+          default = "";
+          description = "File that containts password";
+        };
+      };
+
+    };
+  };
+
+  ### implementation
+
+  config = mkIf (cfg.server.enable || cfg.clients != {}) {
+    boot.kernel.sysctl = optionalAttrs cfg.server.respondToSystemPings {
+      "net.ipv4.icmp_echo_ignore_all" = 1;
+    };
+
+    boot.kernelModules = [ "tun" ];
+
+    systemd.services =
+    let
+      createHansClientService = name: cfg:
+      {
+        description = "hans client - ${name}";
+        after = [ "network.target" ];
+        wantedBy = [ "multi-user.target" ];
+        script = "${pkgs.hans}/bin/hans -f -u ${hansUser} ${cfg.extraConfig} -c ${cfg.server} ${optionalString (cfg.passwordFile != "") "-p $(cat \"${cfg.passwordFile}\")"}";
+        serviceConfig = {
+          RestartSec = "30s";
+          Restart = "always";
+        };
+      };
+    in
+    listToAttrs (
+      mapAttrsToList
+        (name: value: nameValuePair "hans-${name}" (createHansClientService name value))
+        cfg.clients
+    ) // {
+      hans = mkIf (cfg.server.enable) {
+        description = "hans, ip over icmp server daemon";
+        after = [ "network.target" ];
+        wantedBy = [ "multi-user.target" ];
+        script = "${pkgs.hans}/bin/hans -f -u ${hansUser} ${cfg.server.extraConfig} -s ${cfg.server.ip} ${optionalString cfg.server.respondToSystemPings "-r"} ${optionalString (cfg.passwordFile != "") "-p $(cat \"${cfg.passwordFile}\")"}";
+      };
+    };
+
+    users.extraUsers = singleton {
+      name = hansUser;
+      description = "Hans daemon user";
+    };
+  };
+
+  meta.maintainers = with maintainers; [ gnidorah ];
+}
diff --git a/nixos/modules/services/networking/iodine.nix b/nixos/modules/services/networking/iodine.nix
index 512dbd77ae4b..709c36ee54f0 100644
--- a/nixos/modules/services/networking/iodine.nix
+++ b/nixos/modules/services/networking/iodine.nix
@@ -32,7 +32,7 @@ in
           foo = {
             server = "tunnel.mdomain.com";
             relay = "8.8.8.8";
-            extraConfig = "-P mysecurepassword";
+            extraConfig = "-v";
           }
         }
         '';
@@ -57,7 +57,13 @@ in
               type = types.str;
               default = "";
               description = "Additional command line parameters";
-              example = "-P mysecurepassword -l 192.168.1.10 -p 23";
+              example = "-l 192.168.1.10 -p 23";
+            };
+
+            passwordFile = mkOption {
+              type = types.str;
+              default = "";
+              description = "File that containts password";
             };
           };
         }));
@@ -88,7 +94,13 @@ in
           type = types.str;
           default = "";
           description = "Additional command line parameters";
-          example = "-P mysecurepassword -l 192.168.1.10 -p 23";
+          example = "-l 192.168.1.10 -p 23";
+        };
+
+        passwordFile = mkOption {
+          type = types.str;
+          default = "";
+          description = "File that containts password";
         };
       };
 
@@ -108,10 +120,10 @@ in
         description = "iodine client - ${name}";
         after = [ "network.target" ];
         wantedBy = [ "multi-user.target" ];
+        script = "${pkgs.iodine}/bin/iodine -f -u ${iodinedUser} ${cfg.extraConfig} ${optionalString (cfg.passwordFile != "") "-P $(cat \"${cfg.passwordFile}\")"} ${cfg.relay} ${cfg.server}";
         serviceConfig = {
           RestartSec = "30s";
           Restart = "always";
-          ExecStart = "${pkgs.iodine}/bin/iodine -f -u ${iodinedUser} ${cfg.extraConfig} ${cfg.relay} ${cfg.server}";
         };
       };
     in
@@ -124,7 +136,7 @@ in
         description = "iodine, ip over dns server daemon";
         after = [ "network.target" ];
         wantedBy = [ "multi-user.target" ];
-        serviceConfig.ExecStart = "${pkgs.iodine}/bin/iodined -f -u ${iodinedUser} ${cfg.server.extraConfig} ${cfg.server.ip} ${cfg.server.domain}";
+        script = "${pkgs.iodine}/bin/iodined -f -u ${iodinedUser} ${cfg.server.extraConfig} ${optionalString (cfg.passwordFile != "") "-P $(cat \"${cfg.passwordFile}\")"} ${cfg.server.ip} ${cfg.server.domain}";
       };
     };
 
diff --git a/pkgs/applications/altcoins/bitcoin-unlimited.nix b/pkgs/applications/altcoins/bitcoin-unlimited.nix
index d9040377ebe3..5a67dc565aa7 100644
--- a/pkgs/applications/altcoins/bitcoin-unlimited.nix
+++ b/pkgs/applications/altcoins/bitcoin-unlimited.nix
@@ -1,6 +1,7 @@
 { stdenv, fetchFromGitHub, pkgconfig, autoreconfHook, openssl, db48, boost
 , zlib, miniupnpc, qt4, utillinux, protobuf, qrencode, libevent
-, withGui }:
+, withGui
+, Foundation, ApplicationServices, AppKit }:
 
 with stdenv.lib;
 
@@ -19,7 +20,8 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig autoreconfHook ];
   buildInputs = [ openssl db48 boost zlib
                   miniupnpc utillinux protobuf libevent ]
-                  ++ optionals withGui [ qt4 qrencode ];
+                  ++ optionals withGui [ qt4 qrencode ]
+                  ++ optionals stdenv.isDarwin [ Foundation ApplicationServices AppKit ];
 
   patches = [
     ./bitcoin-unlimited-const-comparators.patch
@@ -36,7 +38,7 @@ stdenv.mkDerivation rec {
       completely decentralized, without the need for a central server or trusted
       parties. Users hold the crypto keys to their own money and transact directly
       with each other, with the help of a P2P network to check for double-spending.
-      
+
       The Bitcoin Unlimited (BU) project seeks to provide a voice to all
       stakeholders in the Bitcoin ecosystem.
 
@@ -55,7 +57,7 @@ stdenv.mkDerivation rec {
 
       If you support an increase in the blocksize limit by any means - or just
       support Bitcoin conflict resolution as originally envisioned by its founder -
-      consider running a Bitcoin Unlimited client.      
+      consider running a Bitcoin Unlimited client.
     '';
     homepage = https://www.bitcoinunlimited.info/;
     maintainers = with maintainers; [ DmitryTsygankov ];
diff --git a/pkgs/applications/altcoins/bitcoin-xt.nix b/pkgs/applications/altcoins/bitcoin-xt.nix
index ccc55d17bcf6..feb2924f8651 100644
--- a/pkgs/applications/altcoins/bitcoin-xt.nix
+++ b/pkgs/applications/altcoins/bitcoin-xt.nix
@@ -1,6 +1,7 @@
 { stdenv, fetchFromGitHub, pkgconfig, autoreconfHook, openssl, db48, boost
 , zlib, miniupnpc, qt4, utillinux, protobuf, qrencode, curl, libevent
-, withGui }:
+, withGui
+, Foundation, ApplicationServices, AppKit }:
 
 with stdenv.lib;
 stdenv.mkDerivation rec{
@@ -18,7 +19,8 @@ stdenv.mkDerivation rec{
   nativeBuildInputs = [ pkgconfig autoreconfHook ];
   buildInputs = [ openssl db48 boost zlib libevent
                   miniupnpc utillinux protobuf curl ]
-                  ++ optionals withGui [ qt4 qrencode ];
+                  ++ optionals withGui [ qt4 qrencode ]
+                  ++ optionals stdenv.isDarwin [ Foundation ApplicationServices AppKit ];
 
   configureFlags = [
     "--with-boost-libdir=${boost.out}/lib"
@@ -36,7 +38,7 @@ stdenv.mkDerivation rec{
       Bitcoin XT is an implementation of a Bitcoin full node, based upon the
       source code of Bitcoin Core. It is built by taking the latest stable
       Core release, applying a series of patches, and then doing deterministic
-      builds so anyone can check the downloads correspond to the source code. 
+      builds so anyone can check the downloads correspond to the source code.
     '';
     homepage = https://bitcoinxt.software/;
     maintainers = with maintainers; [ jefdaj ];
diff --git a/pkgs/applications/altcoins/default.nix b/pkgs/applications/altcoins/default.nix
index 174ff96a1247..c58178e3edbb 100644
--- a/pkgs/applications/altcoins/default.nix
+++ b/pkgs/applications/altcoins/default.nix
@@ -10,14 +10,26 @@ rec {
   bitcoin-abc  = libsForQt5.callPackage ./bitcoin-abc.nix { boost = boost165; withGui = true; };
   bitcoind-abc = callPackage ./bitcoin-abc.nix { boost = boost165; withGui = false; };
 
-  bitcoin-unlimited  = callPackage ./bitcoin-unlimited.nix { withGui = true; };
-  bitcoind-unlimited = callPackage ./bitcoin-unlimited.nix { withGui = false; };
+  bitcoin-unlimited  = callPackage ./bitcoin-unlimited.nix {
+    inherit (darwin.apple_sdk.frameworks) Foundation ApplicationServices AppKit;
+    withGui = true;
+  };
+  bitcoind-unlimited = callPackage ./bitcoin-unlimited.nix {
+    inherit (darwin.apple_sdk.frameworks) Foundation ApplicationServices AppKit;
+    withGui = false;
+  };
 
   bitcoin-classic  = libsForQt5.callPackage ./bitcoin-classic.nix { boost = boost165; withGui = true; };
   bitcoind-classic = callPackage ./bitcoin-classic.nix { boost = boost165; withGui = false; };
 
-  bitcoin-xt  = callPackage ./bitcoin-xt.nix { boost = boost165; withGui = true; };
-  bitcoind-xt = callPackage ./bitcoin-xt.nix { boost = boost165; withGui = false; };
+  bitcoin-xt  = callPackage ./bitcoin-xt.nix {
+    inherit (darwin.apple_sdk.frameworks) Foundation ApplicationServices AppKit;
+    boost = boost165; withGui = true;
+  };
+  bitcoind-xt = callPackage ./bitcoin-xt.nix {
+    inherit (darwin.apple_sdk.frameworks) Foundation ApplicationServices AppKit;
+    boost = boost165; withGui = false;
+  };
 
   btc1 = callPackage ./btc1.nix { boost = boost165; withGui = true; };
   btc1d = callPackage ./btc1.nix { boost = boost165; withGui = false; };
diff --git a/pkgs/applications/audio/cdparanoia/default.nix b/pkgs/applications/audio/cdparanoia/default.nix
index d4d302f07d21..760b04bef005 100644
--- a/pkgs/applications/audio/cdparanoia/default.nix
+++ b/pkgs/applications/audio/cdparanoia/default.nix
@@ -17,7 +17,8 @@ stdenv.mkDerivation rec {
       url = "https://trac.macports.org/export/70964/trunk/dports/audio/cdparanoia/files/patch-paranoia_paranoia.c.10.4.diff";
       sha256 = "17l2qhn8sh4jy6ryy5si6ll6dndcm0r537rlmk4a6a8vkn852vad";
     })
-  ] ++ stdenv.lib.optional stdenv.hostPlatform.isMusl ./utils.patch;
+    ] ++ stdenv.lib.optional stdenv.hostPlatform.isMusl ./utils.patch
+    ++ [./fix_private_keyword.patch];
 
   buildInputs = stdenv.lib.optional stdenv.isAarch64 autoreconfHook;
 
diff --git a/pkgs/applications/audio/cdparanoia/fix_private_keyword.patch b/pkgs/applications/audio/cdparanoia/fix_private_keyword.patch
new file mode 100644
index 000000000000..3e9cbe2bd8c2
--- /dev/null
+++ b/pkgs/applications/audio/cdparanoia/fix_private_keyword.patch
@@ -0,0 +1,468 @@
+--- cdparanoia-III-10.2/interface/cdda_interface.h	(revision 15337)
++++ cdparanoia-III-10.2/interface/cdda_interface.h	(revision 15338)
+@@ -85,5 +85,5 @@
+   int is_mmc;
+ 
+-  cdda_private_data_t *private;
++  cdda_private_data_t *private_data;
+   void         *reserved;
+   unsigned char inqbytes[4];
+--- cdparanoia-III-10.2/interface/cooked_interface.c	(revision 15337)
++++ cdparanoia-III-10.2/interface/cooked_interface.c	(revision 15338)
+@@ -14,11 +14,11 @@
+   struct timespec tv1;
+   struct timespec tv2;
+-  int ret1=clock_gettime(d->private->clock,&tv1);
++  int ret1=clock_gettime(d->private_data->clock,&tv1);
+   int ret2=ioctl(fd, command,arg);
+-  int ret3=clock_gettime(d->private->clock,&tv2);
++  int ret3=clock_gettime(d->private_data->clock,&tv2);
+   if(ret1<0 || ret3<0){
+-    d->private->last_milliseconds=-1;
++    d->private_data->last_milliseconds=-1;
+   }else{
+-    d->private->last_milliseconds = (tv2.tv_sec-tv1.tv_sec)*1000. + (tv2.tv_nsec-tv1.tv_nsec)/1000000.;
++    d->private_data->last_milliseconds = (tv2.tv_sec-tv1.tv_sec)*1000. + (tv2.tv_nsec-tv1.tv_nsec)/1000000.;
+   }
+   return ret2;
+--- cdparanoia-III-10.2/interface/interface.c	(revision 15337)
++++ cdparanoia-III-10.2/interface/interface.c	(revision 15338)
+@@ -40,7 +40,7 @@
+     if(d->cdda_fd!=-1)close(d->cdda_fd);
+     if(d->ioctl_fd!=-1 && d->ioctl_fd!=d->cdda_fd)close(d->ioctl_fd);
+-    if(d->private){
+-      if(d->private->sg_hd)free(d->private->sg_hd);
+-      free(d->private);
++    if(d->private_data){
++      if(d->private_data->sg_hd)free(d->private_data->sg_hd);
++      free(d->private_data);
+     }
+ 
+@@ -128,5 +128,5 @@
+       }	
+     }
+-    if(ms)*ms=d->private->last_milliseconds;
++    if(ms)*ms=d->private_data->last_milliseconds;
+     return(sectors);
+   }
+--- cdparanoia-III-10.2/interface/scan_devices.c	(revision 15337)
++++ cdparanoia-III-10.2/interface/scan_devices.c	(revision 15338)
+@@ -265,9 +265,9 @@
+   d->bigendianp=-1; /* We don't know yet... */
+   d->nsectors=-1;
+-  d->private=calloc(1,sizeof(*d->private));
++  d->private_data=calloc(1,sizeof(*d->private_data));
+   {
+     /* goddamnit */
+     struct timespec tv;
+-    d->private->clock=(clock_gettime(CLOCK_MONOTONIC,&tv)<0?CLOCK_REALTIME:CLOCK_MONOTONIC);
++    d->private_data->clock=(clock_gettime(CLOCK_MONOTONIC,&tv)<0?CLOCK_REALTIME:CLOCK_MONOTONIC);
+   }
+   idmessage(messagedest,messages,"\t\tCDROM sensed: %s\n",description);
+@@ -675,13 +675,13 @@
+   d->nsectors=-1;
+   d->messagedest = messagedest;
+-  d->private=calloc(1,sizeof(*d->private));
++  d->private_data=calloc(1,sizeof(*d->private_data));
+   {
+     /* goddamnit */
+     struct timespec tv;
+-    d->private->clock=(clock_gettime(CLOCK_MONOTONIC,&tv)<0?CLOCK_REALTIME:CLOCK_MONOTONIC);
++    d->private_data->clock=(clock_gettime(CLOCK_MONOTONIC,&tv)<0?CLOCK_REALTIME:CLOCK_MONOTONIC);
+   }
+   if(use_sgio){
+     d->interface=SGIO_SCSI;
+-    d->private->sg_buffer=(unsigned char *)(d->private->sg_hd=malloc(MAX_BIG_BUFF_SIZE));
++    d->private_data->sg_buffer=(unsigned char *)(d->private_data->sg_hd=malloc(MAX_BIG_BUFF_SIZE));
+     g_fd=d->cdda_fd=dup(d->ioctl_fd);
+   }else{
+@@ -697,6 +697,6 @@
+ 
+     /* malloc our big buffer for scsi commands */
+-    d->private->sg_hd=malloc(MAX_BIG_BUFF_SIZE);
+-    d->private->sg_buffer=((unsigned char *)d->private->sg_hd)+SG_OFF;
++    d->private_data->sg_hd=malloc(MAX_BIG_BUFF_SIZE);
++    d->private_data->sg_buffer=((unsigned char *)d->private_data->sg_hd)+SG_OFF;
+   }
+ 
+@@ -773,7 +773,7 @@
+   if(g_fd!=-1)close(g_fd);
+   if(d){
+-    if(d->private){
+-      if(d->private->sg_hd)free(d->private->sg_hd);
+-      free(d->private);
++    if(d->private_data){
++      if(d->private_data->sg_hd)free(d->private_data->sg_hd);
++      free(d->private_data);
+     }
+     free(d);
+@@ -822,5 +822,5 @@
+   d->bigendianp=-1; /* We don't know yet... */
+   d->nsectors=-1;
+-  d->private=calloc(1,sizeof(*d->private));
++  d->private_data=calloc(1,sizeof(*d->private_data));
+   d->drive_model=copystring("File based test interface");
+   idmessage(messagedest,messages,"\t\tCDROM sensed: %s\n",d->drive_model);
+--- cdparanoia-III-10.2/interface/scsi_interface.c	(revision 15337)
++++ cdparanoia-III-10.2/interface/scsi_interface.c	(revision 15338)
+@@ -16,11 +16,11 @@
+   struct timespec tv1;
+   struct timespec tv2;
+-  int ret1=clock_gettime(d->private->clock,&tv1);
++  int ret1=clock_gettime(d->private_data->clock,&tv1);
+   int ret2=ioctl(fd, command,arg);
+-  int ret3=clock_gettime(d->private->clock,&tv2);
++  int ret3=clock_gettime(d->private_data->clock,&tv2);
+   if(ret1<0 || ret3<0){
+-    d->private->last_milliseconds=-1;
++    d->private_data->last_milliseconds=-1;
+   }else{
+-    d->private->last_milliseconds = (tv2.tv_sec-tv1.tv_sec)*1000. + (tv2.tv_nsec-tv1.tv_nsec)/1000000.;
++    d->private_data->last_milliseconds = (tv2.tv_sec-tv1.tv_sec)*1000. + (tv2.tv_nsec-tv1.tv_nsec)/1000000.;
+   }
+   return ret2;
+@@ -97,5 +97,5 @@
+   fd_set fdset;
+   struct timeval tv;
+-  struct sg_header *sg_hd=d->private->sg_hd;
++  struct sg_header *sg_hd=d->private_data->sg_hd;
+   int flag=0;
+ 
+@@ -186,5 +186,5 @@
+   int tret1,tret2;
+   int status = 0;
+-  struct sg_header *sg_hd=d->private->sg_hd;
++  struct sg_header *sg_hd=d->private_data->sg_hd;
+   long writebytes=SG_OFF+cmd_len+in_size;
+ 
+@@ -196,5 +196,5 @@
+   memset(sg_hd,0,sizeof(sg_hd)); 
+   memset(sense_buffer,0,SG_MAX_SENSE); 
+-  memcpy(d->private->sg_buffer,cmd,cmd_len+in_size);
++  memcpy(d->private_data->sg_buffer,cmd,cmd_len+in_size);
+   sg_hd->twelve_byte = cmd_len == 12;
+   sg_hd->result = 0;
+@@ -210,5 +210,5 @@
+ 
+   if(bytecheck && out_size>in_size){
+-    memset(d->private->sg_buffer+cmd_len+in_size,bytefill,out_size-in_size); 
++    memset(d->private_data->sg_buffer+cmd_len+in_size,bytefill,out_size-in_size); 
+     /* the size does not remove cmd_len due to the way the kernel
+        driver copies buffers */
+@@ -244,5 +244,5 @@
+ 
+   sigprocmask (SIG_BLOCK, &(d->sigset), NULL );
+-  tret1=clock_gettime(d->private->clock,&tv1);  
++  tret1=clock_gettime(d->private_data->clock,&tv1);  
+   errno=0;
+   status = write(d->cdda_fd, sg_hd, writebytes );
+@@ -290,5 +290,5 @@
+   }
+ 
+-  tret2=clock_gettime(d->private->clock,&tv2);  
++  tret2=clock_gettime(d->private_data->clock,&tv2);  
+   errno=0;
+   status = read(d->cdda_fd, sg_hd, SG_OFF + out_size);
+@@ -314,5 +314,5 @@
+     long i,flag=0;
+     for(i=in_size;i<out_size;i++)
+-      if(d->private->sg_buffer[i]!=bytefill){
++      if(d->private_data->sg_buffer[i]!=bytefill){
+ 	flag=1;
+ 	break;
+@@ -327,7 +327,7 @@
+   errno=0;
+   if(tret1<0 || tret2<0){
+-    d->private->last_milliseconds=-1;
++    d->private_data->last_milliseconds=-1;
+   }else{
+-    d->private->last_milliseconds = (tv2.tv_sec-tv1.tv_sec)*1000 + (tv2.tv_nsec-tv1.tv_nsec)/1000000;
++    d->private_data->last_milliseconds = (tv2.tv_sec-tv1.tv_sec)*1000 + (tv2.tv_nsec-tv1.tv_nsec)/1000000;
+   }
+   return(0);
+@@ -348,5 +348,5 @@
+   memset(&hdr,0,sizeof(hdr));
+   memset(sense,0,sizeof(sense));
+-  memcpy(d->private->sg_buffer,cmd+cmd_len,in_size);
++  memcpy(d->private_data->sg_buffer,cmd+cmd_len,in_size);
+ 
+   hdr.cmdp = cmd;
+@@ -356,5 +356,5 @@
+   hdr.timeout = 50000;
+   hdr.interface_id = 'S';
+-  hdr.dxferp =  d->private->sg_buffer;
++  hdr.dxferp =  d->private_data->sg_buffer;
+   hdr.flags = SG_FLAG_DIRECT_IO;  /* direct IO if we can get it */
+ 
+@@ -401,5 +401,5 @@
+     long i,flag=0;
+     for(i=in_size;i<out_size;i++)
+-      if(d->private->sg_buffer[i]!=bytefill){
++      if(d->private_data->sg_buffer[i]!=bytefill){
+ 	flag=1;
+ 	break;
+@@ -413,5 +413,5 @@
+ 
+   /* Can't rely on .duration because we can't be certain kernel has HZ set to something useful */
+-  /* d->private->last_milliseconds = hdr.duration; */
++  /* d->private_data->last_milliseconds = hdr.duration; */
+ 
+   errno = 0;
+@@ -446,7 +446,7 @@
+   handle_scsi_cmd(d, cmd, 6, 0, 56, 0,0, sense);
+ 
+-  key = d->private->sg_buffer[2] & 0xf;
+-  ASC = d->private->sg_buffer[12];
+-  ASCQ = d->private->sg_buffer[13];
++  key = d->private_data->sg_buffer[2] & 0xf;
++  ASC = d->private_data->sg_buffer[12];
++  ASCQ = d->private_data->sg_buffer[13];
+   
+   if(key == 2 && ASC == 4 && ASCQ == 1) return 0;
+@@ -493,5 +493,5 @@
+ 
+   {
+-    unsigned char *b=d->private->sg_buffer;
++    unsigned char *b=d->private_data->sg_buffer;
+     if(b[0])return(1); /* Handles only up to 256 bytes */
+     if(b[6])return(1); /* Handles only up to 256 bytes */
+@@ -605,6 +605,6 @@
+   if(mode_sense(d,12,0x01))return(-1);
+ 
+-  d->orgdens = d->private->sg_buffer[4];
+-  return(d->orgsize = ((int)(d->private->sg_buffer[10])<<8)+d->private->sg_buffer[11]);
++  d->orgdens = d->private_data->sg_buffer[4];
++  return(d->orgsize = ((int)(d->private_data->sg_buffer[10])<<8)+d->private_data->sg_buffer[11]);
+ }
+ 
+@@ -665,6 +665,6 @@
+   }
+ 
+-  first=d->private->sg_buffer[2];
+-  last=d->private->sg_buffer[3];
++  first=d->private_data->sg_buffer[2];
++  last=d->private_data->sg_buffer[3];
+   tracks=last-first+1;
+ 
+@@ -684,5 +684,5 @@
+     }
+     {
+-      scsi_TOC *toc=(scsi_TOC *)(d->private->sg_buffer+4);
++      scsi_TOC *toc=(scsi_TOC *)(d->private_data->sg_buffer+4);
+ 
+       d->disc_toc[i-first].bFlags=toc->bFlags;
+@@ -705,5 +705,5 @@
+   }
+   {
+-    scsi_TOC *toc=(scsi_TOC *)(d->private->sg_buffer+4);
++    scsi_TOC *toc=(scsi_TOC *)(d->private_data->sg_buffer+4);
+     
+     d->disc_toc[i-first].bFlags=toc->bFlags;
+@@ -739,5 +739,5 @@
+ 
+   /* copy to our structure and convert start sector */
+-  tracks = d->private->sg_buffer[1];
++  tracks = d->private_data->sg_buffer[1];
+   if (tracks > MAXTRK) {
+     cderror(d,"003: CDROM reporting illegal number of tracks\n");
+@@ -755,31 +755,31 @@
+     }
+     
+-    d->disc_toc[i].bFlags = d->private->sg_buffer[10];
++    d->disc_toc[i].bFlags = d->private_data->sg_buffer[10];
+     d->disc_toc[i].bTrack = i + 1;
+ 
+     d->disc_toc[i].dwStartSector= d->adjust_ssize * 
+-	(((signed char)(d->private->sg_buffer[2])<<24) | 
+-	 (d->private->sg_buffer[3]<<16)|
+-	 (d->private->sg_buffer[4]<<8)|
+-	 (d->private->sg_buffer[5]));
++	(((signed char)(d->private_data->sg_buffer[2])<<24) | 
++	 (d->private_data->sg_buffer[3]<<16)|
++	 (d->private_data->sg_buffer[4]<<8)|
++	 (d->private_data->sg_buffer[5]));
+   }
+ 
+   d->disc_toc[i].bFlags = 0;
+   d->disc_toc[i].bTrack = i + 1;
+-  memcpy (&foo, d->private->sg_buffer+2, 4);
+-  memcpy (&bar, d->private->sg_buffer+6, 4);
++  memcpy (&foo, d->private_data->sg_buffer+2, 4);
++  memcpy (&bar, d->private_data->sg_buffer+6, 4);
+   d->disc_toc[i].dwStartSector = d->adjust_ssize * (be32_to_cpu(foo) +
+ 						    be32_to_cpu(bar));
+ 
+   d->disc_toc[i].dwStartSector= d->adjust_ssize * 
+-    ((((signed char)(d->private->sg_buffer[2])<<24) | 
+-      (d->private->sg_buffer[3]<<16)|
+-      (d->private->sg_buffer[4]<<8)|
+-      (d->private->sg_buffer[5]))+
++    ((((signed char)(d->private_data->sg_buffer[2])<<24) | 
++      (d->private_data->sg_buffer[3]<<16)|
++      (d->private_data->sg_buffer[4]<<8)|
++      (d->private_data->sg_buffer[5]))+
+      
+-     ((((signed char)(d->private->sg_buffer[6])<<24) | 
+-       (d->private->sg_buffer[7]<<16)|
+-       (d->private->sg_buffer[8]<<8)|
+-       (d->private->sg_buffer[9]))));
++     ((((signed char)(d->private_data->sg_buffer[6])<<24) | 
++       (d->private_data->sg_buffer[7]<<16)|
++       (d->private_data->sg_buffer[8]<<8)|
++       (d->private_data->sg_buffer[9]))));
+ 
+ 
+@@ -818,5 +818,5 @@
+   if((ret=handle_scsi_cmd(d,cmd,10,0,sectors * CD_FRAMESIZE_RAW,'\177',1,sense)))
+     return(ret);
+-  if(p)memcpy(p,d->private->sg_buffer,sectors*CD_FRAMESIZE_RAW);
++  if(p)memcpy(p,d->private_data->sg_buffer,sectors*CD_FRAMESIZE_RAW);
+   return(0);
+ }
+@@ -837,5 +837,5 @@
+   if((ret=handle_scsi_cmd(d,cmd,12,0,sectors * CD_FRAMESIZE_RAW,'\177',1,sense)))
+     return(ret);
+-  if(p)memcpy(p,d->private->sg_buffer,sectors*CD_FRAMESIZE_RAW);
++  if(p)memcpy(p,d->private_data->sg_buffer,sectors*CD_FRAMESIZE_RAW);
+   return(0);
+ }
+@@ -855,5 +855,5 @@
+   if((ret=handle_scsi_cmd(d,cmd,10,0,sectors * CD_FRAMESIZE_RAW,'\177',1,sense)))
+     return(ret);
+-  if(p)memcpy(p,d->private->sg_buffer,sectors*CD_FRAMESIZE_RAW);
++  if(p)memcpy(p,d->private_data->sg_buffer,sectors*CD_FRAMESIZE_RAW);
+   return(0);
+ }
+@@ -873,5 +873,5 @@
+   if((ret=handle_scsi_cmd(d,cmd,12,0,sectors * CD_FRAMESIZE_RAW,'\177',1,sense)))
+     return(ret);
+-  if(p)memcpy(p,d->private->sg_buffer,sectors*CD_FRAMESIZE_RAW);
++  if(p)memcpy(p,d->private_data->sg_buffer,sectors*CD_FRAMESIZE_RAW);
+   return(0);
+ }
+@@ -891,5 +891,5 @@
+   if((ret=handle_scsi_cmd(d,cmd,10,0,sectors * CD_FRAMESIZE_RAW,'\177',1,sense)))
+     return(ret);
+-  if(p)memcpy(p,d->private->sg_buffer,sectors*CD_FRAMESIZE_RAW);
++  if(p)memcpy(p,d->private_data->sg_buffer,sectors*CD_FRAMESIZE_RAW);
+   return(0);
+ }
+@@ -909,5 +909,5 @@
+   if((ret=handle_scsi_cmd(d,cmd,12,0,sectors * CD_FRAMESIZE_RAW,'\177',1,sense)))
+     return(ret);
+-  if(p)memcpy(p,d->private->sg_buffer,sectors*CD_FRAMESIZE_RAW);
++  if(p)memcpy(p,d->private_data->sg_buffer,sectors*CD_FRAMESIZE_RAW);
+   return(0);
+ }
+@@ -923,5 +923,5 @@
+   if((ret=handle_scsi_cmd(d,cmd,12,0,sectors * CD_FRAMESIZE_RAW,'\177',1,sense)))
+     return(ret);
+-  if(p)memcpy(p,d->private->sg_buffer,sectors*CD_FRAMESIZE_RAW);
++  if(p)memcpy(p,d->private_data->sg_buffer,sectors*CD_FRAMESIZE_RAW);
+   return(0);
+ }
+@@ -937,5 +937,5 @@
+   if((ret=handle_scsi_cmd(d,cmd,12,0,sectors * CD_FRAMESIZE_RAW,'\177',1,sense)))
+     return(ret);
+-  if(p)memcpy(p,d->private->sg_buffer,sectors*CD_FRAMESIZE_RAW);
++  if(p)memcpy(p,d->private_data->sg_buffer,sectors*CD_FRAMESIZE_RAW);
+   return(0);
+ }
+@@ -951,5 +951,5 @@
+   if((ret=handle_scsi_cmd(d,cmd,12,0,sectors * CD_FRAMESIZE_RAW,'\177',1,sense)))
+     return(ret);
+-  if(p)memcpy(p,d->private->sg_buffer,sectors*CD_FRAMESIZE_RAW);
++  if(p)memcpy(p,d->private_data->sg_buffer,sectors*CD_FRAMESIZE_RAW);
+   return(0);
+ }
+@@ -965,5 +965,5 @@
+   if((ret=handle_scsi_cmd(d,cmd,12,0,sectors * CD_FRAMESIZE_RAW,'\177',1,sense)))
+     return(ret);
+-  if(p)memcpy(p,d->private->sg_buffer,sectors*CD_FRAMESIZE_RAW);
++  if(p)memcpy(p,d->private_data->sg_buffer,sectors*CD_FRAMESIZE_RAW);
+   return(0);
+ }
+@@ -979,5 +979,5 @@
+   if((ret=handle_scsi_cmd(d,cmd,12,0,sectors * CD_FRAMESIZE_RAW,'\177',1,sense)))
+     return(ret);
+-  if(p)memcpy(p,d->private->sg_buffer,sectors*CD_FRAMESIZE_RAW);
++  if(p)memcpy(p,d->private_data->sg_buffer,sectors*CD_FRAMESIZE_RAW);
+   return(0);
+ }
+@@ -993,5 +993,5 @@
+   if((ret=handle_scsi_cmd(d,cmd,12,0,sectors * CD_FRAMESIZE_RAW,'\177',1,sense)))
+     return(ret);
+-  if(p)memcpy(p,d->private->sg_buffer,sectors*CD_FRAMESIZE_RAW);
++  if(p)memcpy(p,d->private_data->sg_buffer,sectors*CD_FRAMESIZE_RAW);
+   return(0);
+ }
+@@ -1027,5 +1027,5 @@
+   if((ret=handle_scsi_cmd(d,cmd,12,0,sectors * CD_FRAMESIZE_RAW,'\177',1,sense)))
+     return(ret);
+-  if(p)memcpy(p,d->private->sg_buffer,sectors*CD_FRAMESIZE_RAW);
++  if(p)memcpy(p,d->private_data->sg_buffer,sectors*CD_FRAMESIZE_RAW);
+   return(0);
+ }
+@@ -1040,5 +1040,5 @@
+   if((ret=handle_scsi_cmd(d,cmd,12,0,sectors * CD_FRAMESIZE_RAW,'\177',1,sense)))
+     return(ret);
+-  if(p)memcpy(p,d->private->sg_buffer,sectors*CD_FRAMESIZE_RAW);
++  if(p)memcpy(p,d->private_data->sg_buffer,sectors*CD_FRAMESIZE_RAW);
+   return(0);
+ }
+@@ -1053,5 +1053,5 @@
+   if((ret=handle_scsi_cmd(d,cmd,12,0,sectors * CD_FRAMESIZE_RAW,'\177',1,sense)))
+     return(ret);
+-  if(p)memcpy(p,d->private->sg_buffer,sectors*CD_FRAMESIZE_RAW);
++  if(p)memcpy(p,d->private_data->sg_buffer,sectors*CD_FRAMESIZE_RAW);
+   return(0);
+ }
+@@ -1276,5 +1276,5 @@
+   long i;
+   for(i=2351;i>=0;i--)
+-    if(d->private->sg_buffer[i]!=(unsigned char)'\177')
++    if(d->private_data->sg_buffer[i]!=(unsigned char)'\177')
+       return(((i+3)>>2)<<2);
+ 
+@@ -1285,5 +1285,5 @@
+   long i,flag=0;
+   for(i=0;i<2352;i++)
+-    if(d->private->sg_buffer[i]!=0){
++    if(d->private_data->sg_buffer[i]!=0){
+       flag=1;
+       break;
+@@ -1622,5 +1622,5 @@
+   if(mode_sense(d,22,0x2A)==0){
+   
+-    b=d->private->sg_buffer;
++    b=d->private_data->sg_buffer;
+     b+=b[3]+4;
+     
+@@ -1670,5 +1670,5 @@
+     return(NULL);
+   }
+-  return (d->private->sg_buffer);
++  return (d->private_data->sg_buffer);
+ }
+ 
+@@ -1726,6 +1726,6 @@
+ 
+   d->error_retry=1;
+-  d->private->sg_hd=realloc(d->private->sg_hd,d->nsectors*CD_FRAMESIZE_RAW + SG_OFF + 128);
+-  d->private->sg_buffer=((unsigned char *)d->private->sg_hd)+SG_OFF;
++  d->private_data->sg_hd=realloc(d->private_data->sg_hd,d->nsectors*CD_FRAMESIZE_RAW + SG_OFF + 128);
++  d->private_data->sg_buffer=((unsigned char *)d->private_data->sg_hd)+SG_OFF;
+   d->report_all=1;
+   return(0);
+--- cdparanoia-III-10.2/interface/test_interface.c	(revision 15337)
++++ cdparanoia-III-10.2/interface/test_interface.c	(revision 15338)
+@@ -67,7 +67,7 @@
+ 
+   if(begin<lastread)
+-    d->private->last_milliseconds=20;
++    d->private_data->last_milliseconds=20;
+   else
+-    d->private->last_milliseconds=sectors;
++    d->private_data->last_milliseconds=sectors;
+ 
+ #ifdef CDDA_TEST_UNDERRUN
diff --git a/pkgs/applications/misc/gphoto2/default.nix b/pkgs/applications/misc/gphoto2/default.nix
index 77e7b592f647..5131e0739e73 100644
--- a/pkgs/applications/misc/gphoto2/default.nix
+++ b/pkgs/applications/misc/gphoto2/default.nix
@@ -3,11 +3,11 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "gphoto2-2.5.15";
+  name = "gphoto2-2.5.17";
 
   src = fetchurl {
     url = "mirror://sourceforge/gphoto/${name}.tar.bz2";
-    sha256 = "0xsa12k5fz49v8y4h3zahzr427a3ylxaf0k7hybrkp43g4i1lmxf";
+    sha256 = "0kslwclyyzvnxjw3gdzhlagj7l5f8lba833ipr9s0s0c4hwi0mxa";
   };
 
   nativeBuildInputs = [ pkgconfig gettext libtool ];
diff --git a/pkgs/applications/misc/urh/default.nix b/pkgs/applications/misc/urh/default.nix
index d2463616d677..fa2f16166446 100644
--- a/pkgs/applications/misc/urh/default.nix
+++ b/pkgs/applications/misc/urh/default.nix
@@ -2,13 +2,13 @@
 
 python3Packages.buildPythonApplication rec {
   name = "urh-${version}";
-  version = "2.0.1";
+  version = "2.0.2";
 
   src = fetchFromGitHub {
     owner = "jopohl";
     repo = "urh";
     rev = "v${version}";
-    sha256 = "0mnnrxm49s77s1qg7zbfciw0525ipsl010sciqdw8a22jg1rfjh8";
+    sha256 = "1qqb31y65rd85rf3gvxxxy06hm89ary00km1ac84qz5bwm6n5fyb";
   };
 
   buildInputs = [ hackrf rtl-sdr ];
diff --git a/pkgs/applications/networking/browsers/firefox/wrapper.nix b/pkgs/applications/networking/browsers/firefox/wrapper.nix
index 8f07415db5f2..45917bf65c1e 100644
--- a/pkgs/applications/networking/browsers/firefox/wrapper.nix
+++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix
@@ -132,8 +132,10 @@ let
         else
             for res in 16 32 48 64 128; do
             mkdir -p "$out/share/icons/hicolor/''${res}x''${res}/apps"
-            ln -s "${browser}/lib/"*"/browser/chrome/icons/default/default''${res}.png" \
+            icon=( "${browser}/lib/"*"/browser/chrome/icons/default/default''${res}.png" )
+              if [ -e "$icon" ]; then ln -s "$icon" \
                 "$out/share/icons/hicolor/''${res}x''${res}/apps/${browserName}.png"
+              fi
             done
         fi
 
diff --git a/pkgs/applications/office/todo.txt-cli/default.nix b/pkgs/applications/office/todo.txt-cli/default.nix
index faecc3f4227b..77a602954438 100644
--- a/pkgs/applications/office/todo.txt-cli/default.nix
+++ b/pkgs/applications/office/todo.txt-cli/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl }:
 let
-  version = "2.10";
+  version = "2.11.0";
 in stdenv.mkDerivation {
   name = "todo.txt-cli-${version}";
 
   src = fetchurl {
     url = "https://github.com/ginatrapani/todo.txt-cli/releases/download/v${version}/todo.txt_cli-${version}.tar.gz";
-    sha256 = "1agn4zzbizrrylvbfi053b5mpb39bvl1gzziw08xibzfdyi1g55m";
+    sha256 = "0majx8lcvhh8ji54qi0sxr833wchdss95fjc92byd8g3lfz27rsz";
   };
 
   installPhase = ''
diff --git a/pkgs/applications/science/math/calc/default.nix b/pkgs/applications/science/math/calc/default.nix
index efd38f053451..9d95960bde27 100644
--- a/pkgs/applications/science/math/calc/default.nix
+++ b/pkgs/applications/science/math/calc/default.nix
@@ -1,47 +1,49 @@
-{ stdenv, fetchurl, makeWrapper, glibc, readline, ncurses, utillinux }:
+{ stdenv, lib, fetchurl, utillinux, makeWrapper
+, enableReadline ? true, readline, ncurses }:
 
-with stdenv.lib;
-let
-  makeFlags = ''
-    INCDIR=${glibc.dev}/include \
-    BINDIR=$out/bin LIBDIR=$out/lib CALC_INCDIR=$out/include/calc CALC_SHAREDIR=$out/share/calc MANDIR=$out/share/man/man1 \
-    USE_READLINE=-DUSE_READLINE READLINE_LIB=-lreadline READLINE_EXTRAS='-lhistory -lncurses' \
-    TERMCONTROL=-DUSE_TERMIOS \
-  '';
-in
 stdenv.mkDerivation rec {
-
   name = "calc-${version}";
   version = "2.12.6.6";
 
   src = fetchurl {
-    url = "https://github.com/lcn2/calc/releases/download/${version}/${name}.tar.bz2";
+    urls = [
+      "https://github.com/lcn2/calc/releases/download/${version}/${name}.tar.bz2"
+      "http://www.isthe.com/chongo/src/calc/${name}.tar.bz2"
+    ];
     sha256 = "03sg1xhin6qsrz82scf96mmzw8lz1yj68rhj4p4npp4s0fawc9d5";
   };
 
-  buildInputs = [ makeWrapper readline ncurses utillinux ];
-
-  configurePhase = ''
-    sed -i 's/all: check_include/all:/' Makefile
-  '';
-
-  buildPhase = ''
-    make ${makeFlags}
-  '';
-
-  installPhase = ''
-    make install ${makeFlags}
-    wrapProgram $out/bin/calc --prefix LD_LIBRARY_PATH : $out/lib
+  patchPhase = ''
+    substituteInPlace Makefile \
+      --replace 'all: check_include' 'all:' \
+      --replace '-install_name ''${LIBDIR}/libcalc''${LIB_EXT_VERSION}' '-install_name ''${T}''${LIBDIR}/libcalc''${LIB_EXT_VERSION}' \
+      --replace '-install_name ''${LIBDIR}/libcustcalc''${LIB_EXT_VERSION}' '-install_name ''${T}''${LIBDIR}/libcustcalc''${LIB_EXT_VERSION}'
   '';
 
-  # Hack to avoid TMPDIR in RPATHs.
-  preFixup = ''rm -rf "$(pwd)" '';
-
-  meta = {
+  buildInputs = [ utillinux makeWrapper ]
+             ++ lib.optionals enableReadline [ readline ncurses ];
+
+  makeFlags = [
+    "T=$(out)"
+    "INCDIR=${lib.getDev stdenv.cc.libc}/include"
+    "BINDIR=/bin"
+    "LIBDIR=/lib"
+    "CALC_SHAREDIR=/share/calc"
+    "CALC_INCDIR=/include"
+    "MANDIR=/share/man/man1"
+
+    # Handle LDFLAGS defaults in calc
+    "DEFAULT_LIB_INSTALL_PATH=$(out)/lib"
+  ] ++ lib.optionals enableReadline [
+    "READLINE_LIB=-lreadline"
+    "USE_READLINE=-DUSE_READLINE"
+  ];
+
+  meta = with lib; {
     description = "C-style arbitrary precision calculator";
     homepage = http://www.isthe.com/chongo/tech/comp/calc/;
     license = licenses.lgpl21;
-    maintainers = [ ];
+    maintainers = with maintainers; [ matthewbauer ];
     platforms = platforms.all;
   };
 }
diff --git a/pkgs/applications/science/math/mathematica/default.nix b/pkgs/applications/science/math/mathematica/default.nix
index 1c86097f2ee4..9b9d5b250ef6 100644
--- a/pkgs/applications/science/math/mathematica/default.nix
+++ b/pkgs/applications/science/math/mathematica/default.nix
@@ -1,7 +1,7 @@
 { stdenv
 , coreutils
 , patchelf
-, requireFile
+, callPackage
 , alsaLib
 , dbus
 , fontconfig
@@ -18,6 +18,7 @@
 , zlib
 , libxml2
 , libuuid
+, lang ? "en"
 }:
 
 let
@@ -26,21 +27,15 @@ let
       "Linux"
     else
       throw "Mathematica requires i686-linux or x86_64 linux";
+
+  l10n =
+    with stdenv.lib;
+    with callPackage ./l10ns.nix {};
+    flip (findFirst (l: l.lang == lang)) l10ns
+      (throw "Language '${lang}' not supported");
 in
 stdenv.mkDerivation rec {
-  version = "11.2.0";
-
-  name = "mathematica-${version}";
-
-  src = requireFile rec {
-    name = "Mathematica_${version}_LINUX.sh";
-    message = '' 
-      This nix expression requires that ${name} is
-      already part of the store. Find the file on your Mathematica CD
-      and add it to the nix store with nix-store --add-fixed sha256 <FILE>.
-    '';
-    sha256 = "4a1293cc1c404303aa1cab1bd273c7be151d37ac5ed928fbbb18e9c5ab2d8df9";
-  };
+  inherit (l10n) version name src;
 
   buildInputs = [
     coreutils
diff --git a/pkgs/applications/science/math/mathematica/l10ns.nix b/pkgs/applications/science/math/mathematica/l10ns.nix
new file mode 100644
index 000000000000..2158021c7548
--- /dev/null
+++ b/pkgs/applications/science/math/mathematica/l10ns.nix
@@ -0,0 +1,33 @@
+{ lib, requireFile }:
+
+with lib;
+{
+  l10ns = flip map
+  [
+    {
+      version = "11.2.0";
+      lang = "en";
+      language = "English";
+      sha256 = "4a1293cc1c404303aa1cab1bd273c7be151d37ac5ed928fbbb18e9c5ab2d8df9";
+    }
+    {
+      version = "11.2.0";
+      lang = "ja";
+      language = "Japanese";
+      sha256 = "916392edd32bed8622238df435dd8e86426bb043038a3336f30df10d819b49b1";
+    }
+  ]
+  ({ version, lang, language, sha256 }: {
+    inherit version lang;
+    name = "mathematica-${version}" + optionalString (lang != "en") "-${lang}";
+    src = requireFile rec {
+      name = "Mathematica_${version}" + optionalString (lang != "en") "_${language}" + "_LINUX.sh";
+      message = ''
+        This nix expression requires that ${name} is
+        already part of the store. Find the file on your Mathematica CD
+        and add it to the nix store with nix-store --add-fixed sha256 <FILE>.
+      '';
+      inherit sha256;
+    };
+  });
+}
diff --git a/pkgs/applications/video/handbrake/default.nix b/pkgs/applications/video/handbrake/default.nix
index 904401c5e913..6ce2ae08eeb4 100644
--- a/pkgs/applications/video/handbrake/default.nix
+++ b/pkgs/applications/video/handbrake/default.nix
@@ -37,15 +37,13 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     cmake python2 pkgconfig yasm autoconf automake libtool m4
-  ] ++ lib.optionals useGtk [
-    intltool wrapGAppsHook
-  ];
+  ] ++ lib.optionals useGtk [ intltool wrapGAppsHook ];
 
   buildInputs = [
     fribidi fontconfig freetype jansson zlib
     libass libiconv libsamplerate libxml2 bzip2
     libogg libopus libtheora libvorbis libdvdcss a52dec libmkv
-    lame ffmpeg libdvdread libdvdnav libbluray mp4v2 mpeg2dec x264 x265 libvpx
+    lame libdvdread libdvdnav libbluray mp4v2 mpeg2dec x264 x265 libvpx
   ] ++ lib.optionals useGtk [
     glib gtk3 libappindicator-gtk3 libnotify
     gst_all_1.gstreamer gst_all_1.gst-plugins-base dbus-glib udev
@@ -60,8 +58,6 @@ stdenv.mkDerivation rec {
   preConfigure = ''
     patchShebangs scripts
 
-    echo 'TAG=${version}' > version.txt
-
     # `configure` errors out when trying to read the current year which is too low
     substituteInPlace make/configure.py \
       --replace developer release \
@@ -97,13 +93,17 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     homepage = http://handbrake.fr/;
-    description = "A tool for ripping DVDs into video files";
+    description = "A tool for converting video files and ripping DVDs";
     longDescription = ''
-      Handbrake is a versatile transcoding DVD ripper. This package
-      provides the cli HandbrakeCLI and the GTK+ version ghb.
+      Tool for converting and remuxing video files
+      into selection of modern and widely supported codecs
+      and containers. Very versatile and customizable.
+      Package provides:
+      CLI - `HandbrakeCLI`
+      GTK+ GUI - `ghb`
     '';
     license = licenses.gpl2;
-    maintainers = with maintainers; [ wmertens ];
+    maintainers = with maintainers; [ Anton-Latukha wmertens ];
     # Not tested on anything else
     platforms = platforms.linux;
   };
diff --git a/pkgs/build-support/vm/default.nix b/pkgs/build-support/vm/default.nix
index 8e8b88a9bd2d..08d0a358e61f 100644
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@@ -997,22 +997,22 @@ rec {
     };
 
     debian9i386 = {
-      name = "debian-9.3-stretch-i386";
-      fullName = "Debian 9.3 Stretch (i386)";
+      name = "debian-9.4-stretch-i386";
+      fullName = "Debian 9.4 Stretch (i386)";
       packagesList = fetchurl {
         url = mirror://debian/dists/stretch/main/binary-i386/Packages.xz;
-        sha256 = "1rpv0r92pkr9dmjvpffvgmq3an1s83npfmq870h67jqag3qpwj9l";
+        sha256 = "05z5ccg4ysbrgallhai53sh83i0364w7a3fdq84dpv1li059jf10";
       };
       urlPrefix = mirror://debian;
       packages = commonDebianPackages;
     };
 
     debian9x86_64 = {
-      name = "debian-9.3-stretch-amd64";
-      fullName = "Debian 9.3 Stretch (amd64)";
+      name = "debian-9.4-stretch-amd64";
+      fullName = "Debian 9.4 Stretch (amd64)";
       packagesList = fetchurl {
         url = mirror://debian/dists/stretch/main/binary-amd64/Packages.xz;
-        sha256 = "1gnkvh7wc5yp0rw8kq8p8rlskvl0lc4cv3gdylw8qpqzy75xqlig";
+        sha256 = "19j0c54b1b9lbk9fv2c2aswdh0s2c3klf97zrlmsz4hs8wm9jylq";
       };
       urlPrefix = mirror://debian;
       packages = commonDebianPackages;
diff --git a/pkgs/development/interpreters/eff/default.nix b/pkgs/development/interpreters/eff/default.nix
index 28ea05066c23..258aebe81727 100644
--- a/pkgs/development/interpreters/eff/default.nix
+++ b/pkgs/development/interpreters/eff/default.nix
@@ -1,20 +1,21 @@
-{ stdenv, fetchgit, ocaml, findlib, ocamlbuild, menhir, which }:
+{ stdenv, fetchFromGitHub, which, ocamlPackages }:
 
-let inherit (stdenv.lib) getVersion versionAtLeast; in
-
-assert versionAtLeast (getVersion ocaml) "3.12";
+let version = "5.0"; in
 
 stdenv.mkDerivation {
 
-  name = "eff-20140928";
+  name = "eff-${version}";
 
-  src = fetchgit {
-    url = "https://github.com/matijapretnar/eff.git";
-    rev = "90f884a790fddddb51d4d1d3b7c2edf1e8aabb64";
-    sha256 = "0cqqrpvfw0nrk5d28mkzfvc8yzqxcss0k46bkmqhqjkqq886n2mm";
+  src = fetchFromGitHub {
+    owner = "matijapretnar";
+    repo = "eff";
+    rev = "v${version}";
+    sha256 = "1fslfj5d7fhj3f7kh558b8mk5wllwyq4rnhfkyd96fpy144sdcka";
   };
 
-  buildInputs = [ ocaml findlib ocamlbuild menhir which ];
+  buildInputs = [ which ] ++ (with ocamlPackages; [
+    ocaml findlib ocamlbuild menhir js_of_ocaml js_of_ocaml-ocamlbuild
+  ]);
 
   doCheck = true;
   checkTarget = "test";
@@ -29,7 +30,7 @@ stdenv.mkDerivation {
       backtracking, multi-threading, and much more...
     '';
     license = licenses.bsd2;
-    platforms = ocaml.meta.platforms or [];
+    inherit (ocamlPackages.ocaml.meta) platforms;
     maintainers = [ maintainers.jirkamarsik ];
   };
 }
diff --git a/pkgs/development/interpreters/supercollider/default.nix b/pkgs/development/interpreters/supercollider/default.nix
index 2d3509542135..2737fd6fae04 100644
--- a/pkgs/development/interpreters/supercollider/default.nix
+++ b/pkgs/development/interpreters/supercollider/default.nix
@@ -9,12 +9,12 @@ in
 
 stdenv.mkDerivation rec {
   name = "supercollider-${version}";
-  version = "3.9.2";
+  version = "3.9.3";
 
 
   src = fetchurl {
     url = "https://github.com/supercollider/supercollider/releases/download/Version-${version}/SuperCollider-${version}-Source-linux.tar.bz2";
-    sha256 = "0d3cb6dw8jz7ijriqn3rlwin24gffczp69hl17pzxj1d5w57yj44";
+    sha256 = "1d8ixfl100jvlialxdizp8wqsl1mp5pi2bam25vp97bhjd59cfdr";
   };
 
   hardeningDisable = [ "stackprotector" ];
diff --git a/pkgs/development/libraries/fflas-ffpack/default.nix b/pkgs/development/libraries/fflas-ffpack/default.nix
index edea352ae2dd..82ece22b7c7d 100644
--- a/pkgs/development/libraries/fflas-ffpack/default.nix
+++ b/pkgs/development/libraries/fflas-ffpack/default.nix
@@ -1,4 +1,7 @@
-{stdenv, fetchFromGitHub, autoreconfHook, givaro, pkgconfig, openblas, liblapack}:
+{ stdenv, fetchFromGitHub, autoreconfHook, givaro, pkgconfig, openblas, liblapack
+, gmpxx
+, optimize ? false # impure
+}:
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
   pname = "fflas-ffpack";
@@ -9,9 +12,31 @@ stdenv.mkDerivation rec {
     rev = "v${version}";
     sha256 = "1cqhassj2dny3gx0iywvmnpq8ca0d6m82xl5rz4mb8gaxr2kwddl";
   };
-  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  checkInputs = [
+    gmpxx
+  ];
+  nativeBuildInputs = [
+    autoreconfHook
+    pkgconfig
+  ] ++ stdenv.lib.optionals doCheck checkInputs;
   buildInputs = [ givaro (liblapack.override {shared = true;}) openblas];
-  configureFlags = "--with-blas-libs=-lopenblas --with-lapack-libs=-llapack";
+  configureFlags = [
+    "--with-blas-libs=-lopenblas"
+    "--with-lapack-libs=-llapack"
+  ] ++ stdenv.lib.optionals (!optimize) [
+    # disable SIMD instructions (which are enabled *when available* by default)
+    "--disable-sse"
+    "--disable-sse2"
+    "--disable-sse3"
+    "--disable-ssse3"
+    "--disable-sse41"
+    "--disable-sse42"
+    "--disable-avx"
+    "--disable-avx2"
+    "--disable-fma"
+    "--disable-fma4"
+  ];
+  doCheck = true;
   meta = {
     inherit version;
     description = ''Finite Field Linear Algebra Subroutines'';
diff --git a/pkgs/development/libraries/gmime/3.nix b/pkgs/development/libraries/gmime/3.nix
index 66d0cf88bd02..124fc08cf3bd 100644
--- a/pkgs/development/libraries/gmime/3.nix
+++ b/pkgs/development/libraries/gmime/3.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, pkgconfig, glib, zlib, gpgme, libidn, gobjectIntrospection }:
 
 stdenv.mkDerivation rec {
-  version = "3.0.5";
+  version = "3.2.0";
   name = "gmime-${version}";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/gmime/3.0/${name}.tar.xz";
-    sha256 = "1q45gd1ahnz9q1milc2lqqwl7j3q0wd6kiswhp25iak222n56lrg";
+    url = "mirror://gnome/sources/gmime/3.2/${name}.tar.xz";
+    sha256 = "1q6palbpf6lh6bvy9ly26q5apl5k0z0r4mvl6zzqh90rz4rn1v3m";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/libgphoto2/default.nix b/pkgs/development/libraries/libgphoto2/default.nix
index 9c0ea4a3a73e..96b42ac068cc 100644
--- a/pkgs/development/libraries/libgphoto2/default.nix
+++ b/pkgs/development/libraries/libgphoto2/default.nix
@@ -7,7 +7,7 @@ stdenv.mkDerivation rec {
     owner = "gphoto";
     repo = "libgphoto2";
     rev = "${meta.tag}";
-    sha256 = "1svbpmxqm56pqkv0rxhlyk4vw7mjgjz8zz4p669qvmw630082yj9";
+    sha256 = "0pbfg89817qkb35mmajsw2iz6j9nhkkj67m419f8x8yxpqkaa0wb";
   };
 
   patches = [];
@@ -33,8 +33,8 @@ stdenv.mkDerivation rec {
       MTP, and other vendor specific protocols for controlling and transferring data
       from digital cameras.
     '';
-    version = "2.5.16";
-    tag = "libgphoto2-2_5_16-release";
+    version = "2.5.17";
+    tag = "libgphoto2-2_5_17-release";
     # XXX: the homepage claims LGPL, but several src files are lgpl21Plus
     license = stdenv.lib.licenses.lgpl21Plus;
     platforms = with stdenv.lib.platforms; unix;
diff --git a/pkgs/development/libraries/linbox/default.nix b/pkgs/development/libraries/linbox/default.nix
new file mode 100644
index 000000000000..0f5442bd63b6
--- /dev/null
+++ b/pkgs/development/libraries/linbox/default.nix
@@ -0,0 +1,79 @@
+{ stdenv
+, fetchFromGitHub
+, fetchpatch
+, autoreconfHook
+, givaro
+, pkgconfig
+, openblas
+, liblapack
+, fflas-ffpack
+, gmpxx
+, optimize ? false # impure
+, withSage ? false # sage support
+}:
+stdenv.mkDerivation rec {
+  name = "${pname}-${version}";
+  pname = "linbox";
+  version = "1.5.2";
+
+  src = fetchFromGitHub {
+    owner = "linbox-team";
+    repo = "${pname}";
+    rev = "v${version}";
+    sha256 = "1wfivlwp30mzdy1697w7rzb8caajim50mc8h27k82yipn2qc5n4i";
+  };
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkgconfig
+  ];
+
+  buildInputs = [
+    givaro
+    (liblapack.override {shared = true;})
+    openblas
+    gmpxx
+    fflas-ffpack
+  ];
+
+  configureFlags = [
+    "--with-blas-libs=-lopenblas"
+    "--with-lapack-libs=-llapack"
+    "--disable-optimization"
+  ] ++ stdenv.lib.optionals (!optimize) [
+    # disable SIMD instructions (which are enabled *when available* by default)
+    "--disable-sse"
+    "--disable-sse2"
+    "--disable-sse3"
+    "--disable-ssse3"
+    "--disable-sse41"
+    "--disable-sse42"
+    "--disable-avx"
+    "--disable-avx2"
+    "--disable-fma"
+    "--disable-fma4"
+  ] ++ stdenv.lib.optionals withSage [
+    "--enable-sage"
+  ];
+
+  patches = stdenv.lib.optionals withSage [
+    # https://trac.sagemath.org/ticket/24214#comment:39
+    # Will be resolved by
+    # https://github.com/linbox-team/linbox/issues/69
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/sagemath/sage/a843f48b7a4267e44895a3dfa892c89c85b85611/build/pkgs/linbox/patches/linbox_charpoly_fullCRA.patch";
+      sha256 = "16nxfzfknra3k2yk3xy0k8cq9rmnmsch3dnkb03kx15h0y0jmibk";
+    })
+  ];
+
+  doCheck = true;
+
+  meta = {
+    inherit version;
+    description = "C++ library for exact, high-performance linear algebra";
+    license = stdenv.lib.licenses.lgpl21Plus;
+    maintainers = [stdenv.lib.maintainers.timokau];
+    platforms = stdenv.lib.platforms.linux;
+    homepage = http://linalg.org/;
+  };
+}
diff --git a/pkgs/development/libraries/openmpi/default.nix b/pkgs/development/libraries/openmpi/default.nix
index 9aca076c5dcb..2d3b9780090d 100644
--- a/pkgs/development/libraries/openmpi/default.nix
+++ b/pkgs/development/libraries/openmpi/default.nix
@@ -9,14 +9,14 @@
 
 let
   majorVersion = "3.0";
-  minorVersion = "0";
+  minorVersion = "1";
 
 in stdenv.mkDerivation rec {
   name = "openmpi-${majorVersion}.${minorVersion}";
 
   src = fetchurl {
     url = "http://www.open-mpi.org/software/ompi/v${majorVersion}/downloads/${name}.tar.bz2";
-    sha256 = "1mw2d94k6mp4scg1wnkj50vdh734fy5m2ygyrj65s4mh3prbz6gn";
+    sha256 = "0pbqrm5faf57nasy1s81wqivl7zvxmv8lzjh8hvb0f3qxv8m0d36";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/rocksdb/default.nix b/pkgs/development/libraries/rocksdb/default.nix
index bb0faf76be69..bb36d942a69b 100644
--- a/pkgs/development/libraries/rocksdb/default.nix
+++ b/pkgs/development/libraries/rocksdb/default.nix
@@ -19,7 +19,7 @@ let
 in
 stdenv.mkDerivation rec {
   name = "rocksdb-${version}";
-  version = "5.10.3";
+  version = "5.11.3";
 
   outputs = [ "dev" "out" "static" "bin" ];
 
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     owner = "facebook";
     repo = "rocksdb";
     rev = "v${version}";
-    sha256 = "19d8i8map8qz639mhflmxc0w9gp78fvkq1l46y5s6b5imwh0w7xq";
+    sha256 = "15x2r7aib1xinwcchl32wghs8g96k4q5xgv6z97mxgp35475x01p";
   };
 
   nativeBuildInputs = [ which perl ];
diff --git a/pkgs/development/tools/build-managers/buildbot/default.nix b/pkgs/development/tools/build-managers/buildbot/default.nix
index 3e994227ef05..98adaf1c1aa1 100644
--- a/pkgs/development/tools/build-managers/buildbot/default.nix
+++ b/pkgs/development/tools/build-managers/buildbot/default.nix
@@ -14,11 +14,11 @@ let
   package = pythonPackages.buildPythonApplication rec {
     name = "${pname}-${version}";
     pname = "buildbot";
-    version = "1.0.0";
+    version = "1.1.0";
 
     src = pythonPackages.fetchPypi {
       inherit pname version;
-      sha256 = "0y7gpymxl09gd9dyqj7zqhaihpl9da1v8ppxi4r161ywd8jv9b1g";
+      sha256 = "1rhmlcvw0dsr4f37sb3xmb9xcn76lsrsw2g1z611g339nmxzi0sc";
     };
 
     buildInputs = with pythonPackages; [
diff --git a/pkgs/development/tools/misc/hydra/default.nix b/pkgs/development/tools/misc/hydra/default.nix
index 38b28ec0f607..4fdd017306ac 100644
--- a/pkgs/development/tools/misc/hydra/default.nix
+++ b/pkgs/development/tools/misc/hydra/default.nix
@@ -27,6 +27,7 @@ let
         CatalystViewDownload
         CatalystViewJSON
         CatalystViewTT
+        CatalystXRoleApplicator
         CatalystXScriptServerStarman
         CryptRandPasswd
         DBDPg
@@ -39,6 +40,7 @@ let
         FileSlurp
         IOCompress
         IPCRun
+        JSONAny
         JSONXS
         LWP
         LWPProtocolHttps
diff --git a/pkgs/servers/dns/knot-resolver/default.nix b/pkgs/servers/dns/knot-resolver/default.nix
index 09fda1b81b8b..1a5577e81655 100644
--- a/pkgs/servers/dns/knot-resolver/default.nix
+++ b/pkgs/servers/dns/knot-resolver/default.nix
@@ -12,11 +12,11 @@ inherit (stdenv.lib) optional optionals optionalString concatStringsSep;
 
 unwrapped = stdenv.mkDerivation rec {
   name = "knot-resolver-${version}";
-  version = "2.2.0";
+  version = "2.3.0";
 
   src = fetchurl {
     url = "http://secure.nic.cz/files/knot-resolver/${name}.tar.xz";
-    sha256 = "1yhlwvpl81klyfb8hhvrhii99q7wvydi3vandmq9j7dvig6z1dvv";
+    sha256 = "2d19c5daf8440bd3d2acd1886b9ede65f04f7753c6fd4618a92a1a4ba3b27a9b";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/servers/foundationdb/default.nix b/pkgs/servers/foundationdb/default.nix
new file mode 100644
index 000000000000..95326b4c1c6c
--- /dev/null
+++ b/pkgs/servers/foundationdb/default.nix
@@ -0,0 +1,99 @@
+{ stdenv, fetchurl, fetchFromGitHub
+, which, findutils, m4, gawk, python, openjdk, mono58, libressl_2_6
+}:
+
+let
+  version = "5.1.7";
+  branch  = "release-5.1";
+  rev     = "9ad8d02386d4a6a5efecf898df80f2747695c627";
+  sha256  = "1rc472ih24f9s5g3xmnlp3v62w206ny0pvvw02bzpix2sdrpbp06";
+
+  # hysterical raisins dictate a version of boost this old. however,
+  # we luckily do not need to build anything, we just need the header
+  # files.
+  boost152 = stdenv.mkDerivation rec {
+    name = "boost-headers-1.52.0";
+
+    src = fetchurl {
+      url = "mirror://sourceforge/boost/boost_1_52_0.tar.bz2";
+      sha256 = "14mc7gsnnahdjaxbbslzk79rc0d12h1i681cd3srdwr3fzynlar2";
+    };
+
+    buildPhase = ":";
+    configurePhase = ":";
+    installPhase = ''
+      mkdir -p $out/include/
+      cp -R boost $out/include/
+    '';
+  };
+
+in stdenv.mkDerivation rec {
+  name = "foundationdb-${version}";
+  inherit version;
+
+  src = fetchFromGitHub {
+    owner = "apple";
+    repo  = "foundationdb";
+    inherit rev sha256;
+  };
+
+  nativeBuildInputs = [ gawk which m4 findutils boost152 mono58 ];
+  buildInputs = [ python openjdk libressl_2_6 ];
+
+  patches =
+    [ ./fix-scm-version.patch
+      ./ldflags.patch
+    ];
+
+  postPatch = ''
+    substituteInPlace ./build/scver.mk \
+      --subst-var-by NIXOS_FDB_VERSION_ID "${rev}" \
+      --subst-var-by NIXOS_FDB_SCBRANCH   "${branch}"
+
+    substituteInPlace ./Makefile \
+      --replace 'shell which ccache' 'shell true' \
+      --replace -Werror ""
+
+    substituteInPlace ./Makefile \
+      --replace libstdc++_pic libstdc++
+
+    substituteInPlace ./build/link-validate.sh \
+      --replace 'exit 1' '#exit 1'
+
+    patchShebangs .
+  '';
+
+  enableParallelBuilding = true;
+  makeFlags = [ "all" "fdb_c" "KVRELEASE=1" ];
+
+  configurePhase = ":";
+  installPhase = ''
+    mkdir -vp $out/{bin,libexec/plugins} $lib/lib $dev/include/foundationdb
+
+    cp -v ./lib/libfdb_c.so     $lib/lib
+    cp -v ./lib/libFDBLibTLS.so $out/libexec/plugins/FDBLibTLS.so
+
+    cp -v ./bindings/c/foundationdb/fdb_c.h           $dev/include/foundationdb
+    cp -v ./bindings/c/foundationdb/fdb_c_options.g.h $dev/include/foundationdb
+
+    for x in fdbbackup fdbcli fdbserver fdbmonitor; do
+      cp -v "./bin/$x" $out/bin;
+    done
+
+    ln -sfv $out/bin/fdbbackup $out/bin/dr_agent
+    ln -sfv $out/bin/fdbbackup $out/bin/fdbrestore
+    ln -sfv $out/bin/fdbbackup $out/bin/fdbdr
+
+    ln -sfv $out/bin/fdbbackup $out/libexec/backup_agent
+  '';
+
+  outputs = [ "out" "lib" "dev" ];
+
+  meta = with stdenv.lib; {
+    description = "Open source, distributed, transactional key-value store";
+    homepage    = https://www.foundationdb.org;
+    license     = licenses.asl20;
+    platforms   = platforms.linux;
+    maintainers = with maintainers; [ thoughtpolice ];
+  };
+}
diff --git a/pkgs/servers/foundationdb/fix-scm-version.patch b/pkgs/servers/foundationdb/fix-scm-version.patch
new file mode 100644
index 000000000000..0e0df7ade82b
--- /dev/null
+++ b/pkgs/servers/foundationdb/fix-scm-version.patch
@@ -0,0 +1,42 @@
+diff --git a/build/scver.mk b/build/scver.mk
+index bdae8be..7539864 100644
+--- a/build/scver.mk
++++ b/build/scver.mk
+@@ -98,33 +98,10 @@ endif
+ GITPRESENT := $(wildcard $(FDBDIR)/.git)
+ HGPRESENT := $(wildcard $(FDBDIR)/.hg)
+ 
+-# Use Git, if not missing
+-ifneq ($(GITPRESENT),)
+-	SCVER := $(shell cd "$(FDBDIR)" && git --version 2>/dev/null)
+-	ifneq ($(SCVER),)
+-		VERSION_ID := $(shell cd "$(FDBDIR)" && git rev-parse --verify HEAD)
+-		SOURCE_CONTROL := GIT
+-		SCBRANCH := $(shell cd "$(FDBDIR)" && git rev-parse --abbrev-ref HEAD)
+-	else
+-$(error Missing git executable on $(PLATFORM) )
+-	endif
+-# Otherwise, use Mercurial
+-else
+-	# Otherwise, use Mercurial, if not missing
+-	ifneq ($(HGPRESENT),)
+-		SCVER := $(shell cd "$(FDBDIR)" && hg --version 2>/dev/null)
+-		ifdef SCVER
+-			VERSION_ID := $(shell cd "$(FDBDIR)" && hg id -n)
+-			SOURCE_CONTROL := MERCURIAL
+-			SCBRANCH := $(shell cd "$(FDBDIR)" && hg branch)
+-		else
+-$(error Missing hg executable on $(PLATFORM))
+-		endif
+-	else
+-	FDBFILES := (shell ls -la $(FDBDIR))
+-$(error Missing source control information for source on $(PLATFORM) in directory: $(FDBDIR) with files: $(FDBFILES))
+-	endif
+-endif
++# NixOS-specific non-VCS packaging, filled out by the nix build
++SOURCE_CONTROL := GIT
++VERSION_ID     := @NIXOS_FDB_VERSION_ID@
++SCBRANCH       := @NIXOS_FDB_SCBRANCH@
+ 
+ # Set the RELEASE variable based on the KVRELEASE variable.
+ ifeq ($(KVRELEASE),1)
diff --git a/pkgs/servers/foundationdb/ldflags.patch b/pkgs/servers/foundationdb/ldflags.patch
new file mode 100644
index 000000000000..4d523a7ecdd3
--- /dev/null
+++ b/pkgs/servers/foundationdb/ldflags.patch
@@ -0,0 +1,90 @@
+diff --git a/FDBLibTLS/local.mk b/FDBLibTLS/local.mk
+index 0b6eac8..b1891ca 100644
+--- a/FDBLibTLS/local.mk
++++ b/FDBLibTLS/local.mk
+@@ -1,6 +1,5 @@
+ FDBLibTLS_CFLAGS := -fPIC -I/usr/local/include -I$(BOOSTDIR)
+-FDBLibTLS_STATIC_LIBS := -ltls -lssl -lcrypto
+-FDBLibTLS_LDFLAGS := -L/usr/local/lib -static-libstdc++ -static-libgcc -lrt
++FDBLibTLS_LDFLAGS := -L/usr/local/lib -static-libstdc++ -static-libgcc -lrt -ltls -lssl -lcrypto
+ FDBLibTLS_LDFLAGS += -Wl,-soname,FDBLibTLS.so -Wl,--version-script=FDBLibTLS/FDBLibTLS.map
+ 
+ # The plugin isn't a typical library, so it feels more sensible to have a copy
+diff --git a/bindings/c/local.mk b/bindings/c/local.mk
+index 44f0c31..7aea5a4 100644
+--- a/bindings/c/local.mk
++++ b/bindings/c/local.mk
+@@ -29,8 +29,8 @@ fdb_c_tests_HEADERS := -Ibindings/c
+ CLEAN_TARGETS += fdb_c_tests_clean
+ 
+ ifeq ($(PLATFORM),linux)
+-  fdb_c_LIBS += lib/libstdc++.a -lm -lpthread -lrt -ldl
+-  fdb_c_LDFLAGS += -Wl,--version-script=bindings/c/fdb_c.map -static-libgcc -Wl,-z,nodelete
++  fdb_c_LIBS += lib/libstdc++.a
++  fdb_c_LDFLAGS += -Wl,--version-script=bindings/c/fdb_c.map -static-libgcc -Wl,-z,nodelete -lm -lpthread -lrt -ldl
+   fdb_c_tests_LIBS += -lpthread
+ endif
+ 
+diff --git a/bindings/flow/tester/local.mk b/bindings/flow/tester/local.mk
+index 2ef4fcb..6e59625 100644
+--- a/bindings/flow/tester/local.mk
++++ b/bindings/flow/tester/local.mk
+@@ -35,8 +35,7 @@ _fdb_flow_tester_clean:
+ 	@rm -rf bindings/flow/bin
+ 
+ ifeq ($(PLATFORM),linux)
+-  fdb_flow_tester_LIBS += -ldl -lpthread -lrt
+-  fdb_flow_tester_LDFLAGS += -static-libstdc++ -static-libgcc
++  fdb_flow_tester_LDFLAGS += -static-libstdc++ -static-libgcc -ldl -lpthread -lrt
+ else ifeq ($(PLATFORM),osx)
+   fdb_flow_tester_LDFLAGS += -lc++
+ endif
+diff --git a/fdbbackup/local.mk b/fdbbackup/local.mk
+index 033fe7d..865fc92 100644
+--- a/fdbbackup/local.mk
++++ b/fdbbackup/local.mk
+@@ -25,8 +25,7 @@ fdbbackup_LDFLAGS := $(fdbrpc_LDFLAGS)
+ fdbbackup_LIBS := lib/libfdbclient.a lib/libfdbrpc.a lib/libflow.a
+ 
+ ifeq ($(PLATFORM),linux)
+-  fdbbackup_LIBS += -ldl -lpthread -lrt
+-  fdbbackup_LDFLAGS += -static-libstdc++ -static-libgcc
++  fdbbackup_LDFLAGS += -static-libstdc++ -static-libgcc -ldl -lpthread -lrt
+ 
+   # GPerfTools profiler (uncomment to use)
+   # fdbbackup_CFLAGS += -I/opt/gperftools/include -DUSE_GPERFTOOLS=1
+diff --git a/fdbcli/local.mk b/fdbcli/local.mk
+index 81a4a42..892c079 100644
+--- a/fdbcli/local.mk
++++ b/fdbcli/local.mk
+@@ -22,14 +22,13 @@
+ 
+ fdbcli_CFLAGS := $(fdbclient_CFLAGS)
+ fdbcli_LDFLAGS := $(fdbrpc_LDFLAGS)
+-fdbcli_LIBS := lib/libfdbclient.a lib/libfdbrpc.a lib/libflow.a -ldl
++fdbcli_LIBS := lib/libfdbclient.a lib/libfdbrpc.a lib/libflow.a
+ fdbcli_STATIC_LIBS :=
+ 
+ fdbcli_GENERATED_SOURCES += versions.h
+ 
+ ifeq ($(PLATFORM),linux)
+-  fdbcli_LDFLAGS += -static-libstdc++ -static-libgcc
+-  fdbcli_LIBS += -lpthread -lrt
++  fdbcli_LDFLAGS += -static-libstdc++ -static-libgcc -lpthread -lrt -ldl
+ else ifeq ($(PLATFORM),osx)
+   fdbcli_LDFLAGS += -lc++
+ endif
+diff --git a/fdbserver/local.mk b/fdbserver/local.mk
+index 78cad1b..36f2c0f 100644
+--- a/fdbserver/local.mk
++++ b/fdbserver/local.mk
+@@ -25,8 +25,7 @@ fdbserver_LDFLAGS := $(fdbrpc_LDFLAGS)
+ fdbserver_LIBS := lib/libfdbclient.a lib/libfdbrpc.a lib/libflow.a
+ 
+ ifeq ($(PLATFORM),linux)
+-  fdbserver_LIBS += -ldl -lpthread -lrt
+-  fdbserver_LDFLAGS += -static-libstdc++ -static-libgcc
++  fdbserver_LDFLAGS += -static-libstdc++ -static-libgcc -ldl -lpthread -lrt
+ 
+   # GPerfTools profiler (uncomment to use)
+   # fdbserver_CFLAGS += -I/opt/gperftools/include -DUSE_GPERFTOOLS=1
diff --git a/pkgs/servers/ftp/bftpd/default.nix b/pkgs/servers/ftp/bftpd/default.nix
index 38fb7d250e34..c35177e6aa90 100644
--- a/pkgs/servers/ftp/bftpd/default.nix
+++ b/pkgs/servers/ftp/bftpd/default.nix
@@ -1,24 +1,36 @@
-{stdenv, fetchurl}:
-stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
+{ stdenv, fetchurl }:
+
+let
   pname = "bftpd";
+
+in stdenv.mkDerivation rec {
+  name = "${pname}-${version}";
   version = "4.9";
-  # or fetchFromGitHub(owner,repo,rev) or fetchgit(rev)
+
   src = fetchurl {
     url = "mirror://sourceforge/project/${pname}/${pname}/${name}/${name}.tar.gz";
     sha256 = "13pjil9cjggpi773m0516lszyqvwzlgcrmmj8yn9nc24rbxwvn6d";
   };
-  buildInputs = [];
+
   preConfigure = ''
     sed -re 's/-[og] 0//g' -i Makefile*
   '';
-  meta = {
+
+  postInstall = ''
+    mkdir -p $out/share/doc/${pname}
+    mv $out/etc/*.conf $out/share/doc/${pname}
+    rm -rf $out/{etc,var}
+  '';
+
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
     inherit version;
-    description = ''A minimal ftp server'';
-    license = stdenv.lib.licenses.gpl2Plus;
-    maintainers = [stdenv.lib.maintainers.raskin];
-    platforms = stdenv.lib.platforms.linux;
-    homepage = http://bftpd.sf.net/;
+    description = "A minimal ftp server";
     downloadPage = "http://bftpd.sf.net/download.html";
+    homepage = http://bftpd.sf.net/;
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ raskin ];
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/servers/jackett/default.nix b/pkgs/servers/jackett/default.nix
index 34d242b92a8a..f2d38111d5d2 100644
--- a/pkgs/servers/jackett/default.nix
+++ b/pkgs/servers/jackett/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "jackett-${version}";
-  version = "0.8.823";
+  version = "0.8.886";
 
   src = fetchurl {
     url = "https://github.com/Jackett/Jackett/releases/download/v${version}/Jackett.Binaries.Mono.tar.gz";
-    sha256 = "0hicz21dvcakqkxix70akc3rrz570j3g0a512pqrr3bdq7ay0dkk";
+    sha256 = "18agnavhch29pi1w6vp374cs6bz2j7bf55mh4ym0cs038h5xkdvv";
   };
 
   buildInputs = [ makeWrapper ];
diff --git a/pkgs/shells/xonsh/default.nix b/pkgs/shells/xonsh/default.nix
index d22a66eb93ae..a923602cdd76 100644
--- a/pkgs/shells/xonsh/default.nix
+++ b/pkgs/shells/xonsh/default.nix
@@ -2,13 +2,13 @@
 
 python3Packages.buildPythonApplication rec {
   name = "xonsh-${version}";
-  version = "0.6.0";
+  version = "0.6.1";
 
   src = fetchFromGitHub {
     owner = "scopatz";
     repo = "xonsh";
     rev = version;
-    sha256= "0hfsan22i81wffx2xbamm8wwkxgpv12z4kfl37p9m22vpqgg0fdg";
+    sha256= "0lxjklwj267q0ikqab8p743sjvm44gq1w7mp80c7hgrn2ndvrypg";
   };
 
   LC_ALL = "en_US.UTF-8";
@@ -34,7 +34,7 @@ python3Packages.buildPythonApplication rec {
 
   meta = with stdenv.lib; {
     description = "A Python-ish, BASHwards-compatible shell";
-    homepage = http://xonsh.org;
+    homepage = http://xon.sh/;
     license = licenses.bsd3;
     maintainers = with maintainers; [ spwhitt garbas vrthra ];
     platforms = platforms.all;
diff --git a/pkgs/tools/graphics/maim/default.nix b/pkgs/tools/graphics/maim/default.nix
index c7e8dc966e8d..cac86e29c472 100644
--- a/pkgs/tools/graphics/maim/default.nix
+++ b/pkgs/tools/graphics/maim/default.nix
@@ -1,22 +1,23 @@
 { stdenv, fetchFromGitHub, cmake, pkgconfig
-, zlib, libpng, libjpeg
-, libGLU_combined, glm, libX11, libXext, libXfixes, libXrandr, libXcomposite, slop, icu }:
+, zlib, libpng, libjpeg, libGLU_combined, glm
+, libX11, libXext, libXfixes, libXrandr, libXcomposite, slop, icu
+}:
 
 stdenv.mkDerivation rec {
   name = "maim-${version}";
-  version = "5.4.68";
+  version = "5.5";
 
   src = fetchFromGitHub {
     owner = "naelstrof";
     repo = "maim";
     rev = "v${version}";
-    sha256 = "12jvfxzfhh6cbk6ygliwnkvm3mb7rca60k6x9qdzm17jsz65xhh0";
+    sha256 = "0dr44lwqsvhwf9pncxq6k42zj9hj07b96qsk1q8vh4l42zcpqzla";
   };
 
   nativeBuildInputs = [ cmake pkgconfig ];
   buildInputs =
-    [ zlib libpng libjpeg libGLU_combined glm libX11 libXext libXfixes libXrandr
-      libXcomposite slop icu ];
+    [ zlib libpng libjpeg libGLU_combined glm
+      libX11 libXext libXfixes libXrandr libXcomposite slop icu ];
 
   doCheck = false;
 
diff --git a/pkgs/tools/misc/ipxe/default.nix b/pkgs/tools/misc/ipxe/default.nix
index 786b3992a5cc..d34ccaa4b9e9 100644
--- a/pkgs/tools/misc/ipxe/default.nix
+++ b/pkgs/tools/misc/ipxe/default.nix
@@ -3,8 +3,8 @@
 }:
 
 let
-  date = "20170922";
-  rev = "74d90b33f8490adcee2026ece18d8411d93b6a39";
+  date = "20180220";
+  rev = "47849be3a900c546cf92066849be0806f4e611d9";
 in
 
 stdenv.mkDerivation {
@@ -14,7 +14,7 @@ stdenv.mkDerivation {
 
   src = fetchgit {
     url = git://git.ipxe.org/ipxe.git;
-    sha256 = "12ijrq451fj2x3i7c7xjlxig5mwbhmgzqjvmfl2sza953vfbk4vw";
+    sha256 = "1f4pi1dp2zqnrbfnggnzycfvrxv0bqgw73dxbyy3hfy4mhdj6z45";
     inherit rev;
   };
 
@@ -26,6 +26,7 @@ stdenv.mkDerivation {
   makeFlags =
     [ "ECHO_E_BIN_ECHO=echo" "ECHO_E_BIN_ECHO_E=echo" # No /bin/echo here.
       "ISOLINUX_BIN_LIST=${syslinux}/share/syslinux/isolinux.bin"
+      "LDLINUX_C32=${syslinux}/share/syslinux/ldlinux.c32"
     ] ++ lib.optional (embedScript != null) "EMBED=${embedScript}";
 
 
@@ -34,6 +35,7 @@ stdenv.mkDerivation {
   configurePhase = ''
     runHook preConfigure
     for opt in $enabledOptions; do echo "#define $opt" >> src/config/general.h; done
+    sed -i '/cp \''${ISOLINUX_BIN}/s/$/ --no-preserve=mode/' src/util/geniso
     runHook postConfigure
   '';
 
diff --git a/pkgs/tools/misc/slop/default.nix b/pkgs/tools/misc/slop/default.nix
index ad1c2b64e65d..f411bbd2c300 100644
--- a/pkgs/tools/misc/slop/default.nix
+++ b/pkgs/tools/misc/slop/default.nix
@@ -1,15 +1,17 @@
 { stdenv, fetchFromGitHub, cmake, pkgconfig
-, glew, glm, libGLU_combined, libX11, libXext, libXrender, cppcheck, icu}:
+, glew, glm, libGLU_combined, libX11, libXext, libXrender, icu
+, cppcheck
+}:
 
 stdenv.mkDerivation rec {
   name = "slop-${version}";
-  version = "7.3.49";
+  version = "7.4";
 
   src = fetchFromGitHub {
     owner = "naelstrof";
     repo = "slop";
     rev = "v${version}";
-    sha256 = "0is3mh2d1jqgvv72v5x92w23yf26n8n384nbr1b6cn883aw8j7jz";
+    sha256 = "0fgd8a2dqkg64all0f96sca92sdss9r3pzmv5kck46b99z2325z6";
   };
 
   nativeBuildInputs = [ cmake pkgconfig ];
diff --git a/pkgs/tools/package-management/nix-pin/default.nix b/pkgs/tools/package-management/nix-pin/default.nix
index c12b82a61e17..bb3a1faa0c3b 100644
--- a/pkgs/tools/package-management/nix-pin/default.nix
+++ b/pkgs/tools/package-management/nix-pin/default.nix
@@ -1,12 +1,12 @@
 { pkgs, stdenv, fetchFromGitHub, mypy, python3 }:
 let self = stdenv.mkDerivation rec {
   name = "nix-pin-${version}";
-  version = "0.1.2";
+  version = "0.2.2";
   src = fetchFromGitHub {
     owner = "timbertson";
     repo = "nix-pin";
-    rev = "version-0.1.2";
-    sha256 = "1zwfb5198qzbjwivgiaxbwva9frgrrqaj92nw8vz95yi08pijssh";
+    rev = "version-0.2.2";
+    sha256 = "1kw43kzy4m6lnnif51r2a8i4vcgr7d4vqb1c75p7pk2b9y3jwxsz";
   };
   buildInputs = [ python3 mypy ];
   buildPhase = ''
@@ -16,12 +16,27 @@ let self = stdenv.mkDerivation rec {
     mkdir "$out"
     cp -r bin share "$out"
   '';
-  passthru = {
-    callWithPins = path: args:
-      import "${self}/share/nix/call.nix" {
-        inherit pkgs path args;
-      };
-  };
+  passthru =
+    let
+      defaults = import "${self}/share/nix/defaults.nix";
+    in {
+      api = { pinConfig ? defaults.pinConfig }:
+        let impl = import "${self}/share/nix/api.nix" { inherit pkgs pinConfig; }; in
+        { inherit (impl) augmentedPkgs pins callPackage; };
+      updateScript = ''
+        set -e
+        echo
+        cd ${toString ./.}
+        ${pkgs.nix-update-source}/bin/nix-update-source \
+          --prompt version \
+          --replace-attr version \
+          --set owner timbertson \
+          --set repo nix-pin \
+          --set type fetchFromGitHub \
+          --set rev 'version-{version}' \
+          --modify-nix default.nix
+      '';
+    };
   meta = with stdenv.lib; {
     homepage = "https://github.com/timbertson/nix-pin";
     description = "nixpkgs development utility";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index d07ac59c80f1..67a5390aa6aa 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2089,6 +2089,8 @@ with pkgs;
 
   edk2 = callPackage ../development/compilers/edk2 { };
 
+  eff = callPackage ../development/interpreters/eff { };
+
   eflite = callPackage ../applications/audio/eflite {};
 
   eid-mw = callPackage ../tools/security/eid-mw { };
@@ -2407,6 +2409,8 @@ with pkgs;
 
   fuseiso = callPackage ../tools/filesystems/fuseiso { };
 
+  foundationdb = callPackage ../servers/foundationdb { stdenv = overrideCC stdenv gcc49; };
+
   fuse-7z-ng = callPackage ../tools/filesystems/fuse-7z-ng { };
 
   fwknop = callPackage ../tools/security/fwknop { };
@@ -8786,6 +8790,7 @@ with pkgs;
 
   fflas-ffpack = callPackage ../development/libraries/fflas-ffpack {};
   fflas-ffpack_1 = callPackage ../development/libraries/fflas-ffpack/1.nix {};
+  linbox = callPackage ../development/libraries/linbox {};
 
   ffmpeg_0_10 = callPackage ../development/libraries/ffmpeg/0.10.nix {
     inherit (darwin.apple_sdk.frameworks) Cocoa;
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 72bcc45c48e6..f095ccb34ab5 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -217,8 +217,6 @@ let
 
     easy-format = callPackage ../development/ocaml-modules/easy-format { };
 
-    eff = callPackage ../development/interpreters/eff { };
-
     eliom = callPackage ../development/ocaml-modules/eliom {
       lwt = lwt2;
       js_of_ocaml = js_of_ocaml_2;