summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--doc/languages-frameworks/haskell.section.md50
-rw-r--r--doc/reviewing-contributions.xml4
-rw-r--r--maintainers/maintainer-list.nix2
-rw-r--r--nixos/modules/installer/tools/nixos-enter.sh3
-rw-r--r--nixos/modules/module-list.nix2
-rw-r--r--nixos/modules/services/databases/foundationdb.nix360
-rw-r--r--nixos/modules/services/databases/foundationdb.xml279
-rw-r--r--nixos/modules/services/networking/hans.nix145
-rw-r--r--nixos/modules/services/networking/iodine.nix22
-rw-r--r--pkgs/applications/audio/cdparanoia/default.nix3
-rw-r--r--pkgs/applications/audio/cdparanoia/fix_private_keyword.patch468
-rw-r--r--pkgs/applications/editors/android-studio/default.nix12
-rw-r--r--pkgs/applications/misc/qlcplus/default.nix4
-rw-r--r--pkgs/applications/misc/urh/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/spark/default.nix23
-rw-r--r--pkgs/applications/office/todo.txt-cli/default.nix4
-rw-r--r--pkgs/applications/science/math/mathematica/default.nix23
-rw-r--r--pkgs/applications/science/math/mathematica/l10ns.nix33
-rw-r--r--pkgs/applications/virtualization/qemu/default.nix4
-rw-r--r--pkgs/development/compilers/ecl/16.1.2.nix20
-rw-r--r--pkgs/development/compilers/ecl/default.nix6
-rw-r--r--pkgs/development/libraries/fflas-ffpack/default.nix33
-rw-r--r--pkgs/development/libraries/gstreamer/base/default.nix50
-rw-r--r--pkgs/development/libraries/gstreamer/core/default.nix15
-rw-r--r--pkgs/development/libraries/linbox/default.nix79
-rw-r--r--pkgs/development/libraries/oniguruma/default.nix13
-rw-r--r--pkgs/development/libraries/rocksdb/default.nix4
-rw-r--r--pkgs/development/libraries/science/math/rankwidth/default.nix28
-rw-r--r--pkgs/development/python-modules/faulthandler/default.nix15
-rw-r--r--pkgs/development/python-modules/flask-autoindex/default.nix44
-rw-r--r--pkgs/development/python-modules/milksnake/default.nix26
-rw-r--r--pkgs/development/tools/build-managers/buildbot/default.nix4
-rw-r--r--pkgs/misc/drivers/sc-controller/default.nix4
-rw-r--r--pkgs/servers/foundationdb/default.nix99
-rw-r--r--pkgs/servers/foundationdb/fix-scm-version.patch42
-rw-r--r--pkgs/servers/foundationdb/ldflags.patch90
-rw-r--r--pkgs/servers/jackett/default.nix4
-rw-r--r--pkgs/servers/sabnzbd/default.nix4
-rw-r--r--pkgs/tools/misc/ipxe/default.nix8
-rw-r--r--pkgs/tools/misc/powerline-go/default.nix4
-rw-r--r--pkgs/tools/misc/powerline-go/deps.nix29
-rw-r--r--pkgs/tools/misc/vdirsyncer/default.nix51
-rw-r--r--pkgs/tools/virtualization/google-compute-engine/default.nix5
-rw-r--r--pkgs/top-level/all-packages.nix5
-rw-r--r--pkgs/top-level/haskell-packages.nix8
-rw-r--r--pkgs/top-level/python-packages.nix4
-rw-r--r--pkgs/top-level/release.nix3
47 files changed, 2005 insertions, 137 deletions
diff --git a/doc/languages-frameworks/haskell.section.md b/doc/languages-frameworks/haskell.section.md
index 1623e0d276f2..3b8971c295bb 100644
--- a/doc/languages-frameworks/haskell.section.md
+++ b/doc/languages-frameworks/haskell.section.md
@@ -666,6 +666,56 @@ prefer one built with GHC 7.8.x in the first place. However, for users who
 cannot use GHC 7.10.x at all for some reason, the approach of downgrading to an
 older version might be useful.
 
+### How to override packages in all compiler-specific package sets
+
+In the previous section we learned how to override a package in a single
+compiler-specific package set. You may have some overrides defined that you want
+to use across multiple package sets. To accomplish this you could use the
+technique that we learned in the previous section by repeating the overrides for
+all the compiler-specific package sets. For example:
+
+```nix
+{
+  packageOverrides = super: let self = super.pkgs; in
+  {
+    haskell = super.haskell // {
+      packages = super.haskell.packages // {
+        ghc784 = super.haskell.packages.ghc784.override {
+          overrides = self: super: {
+            my-package = ...;
+            my-other-package = ...;
+          };
+        };
+        ghc822 = super.haskell.packages.ghc784.override {
+          overrides = self: super: {
+            my-package = ...;
+            my-other-package = ...;
+          };
+        };
+        ...
+      };
+    };
+  };
+}
+```
+
+However there's a more convenient way to override all compiler-specific package
+sets at once:
+
+```nix
+{
+  packageOverrides = super: let self = super.pkgs; in
+  {
+    haskell = super.haskell // {
+      packageOverrides = self: super: {
+        my-package = ...;
+        my-other-package = ...;
+      };
+    };
+  };
+}
+```
+
 ### How to recover from GHC's infamous non-deterministic library ID bug
 
 GHC and distributed build farms don't get along well:
diff --git a/doc/reviewing-contributions.xml b/doc/reviewing-contributions.xml
index d6f33ccd1cdb..7b017f0a8cc4 100644
--- a/doc/reviewing-contributions.xml
+++ b/doc/reviewing-contributions.xml
@@ -23,7 +23,9 @@
     xlink:href="https://github.com/NixOS/nixpkgs/pulls?q=is%3Apr+is%3Aopen+sort%3Aupdated-desc">most
     recently</link> and the <link
     xlink:href="https://github.com/NixOS/nixpkgs/pulls?q=is%3Apr+is%3Aopen+sort%3Aupdated-asc">least
-    recently</link> updated pull-requests.</para>
+        recently</link> updated pull-requests.
+  We highly encourage looking at <link xlink:href="https://github.com/NixOS/nixpkgs/pulls?q=is%3Apr+is%3Aopen+review%3Anone+status%3Asuccess+-label%3A%222.status%3A+work-in-progress%22+no%3Aproject+no%3Aassignee+no%3Amilestone">
+  this list of ready to merge, unreviewed pull requests</link>.</para>
 
 <para>When reviewing a pull request, please always be nice and polite.
   Controversial changes can lead to controversial opinions, but it is important
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 1178ebb536ec..c827e0d11a92 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -1731,7 +1731,7 @@
     name = "Jeffrey David Johnson";
   };
   jensbin = {
-    email = "jensbin@protonmail.com";
+    email = "jensbin+git@pm.me";
     github = "jensbin";
     name = "Jens Binkert";
   };
diff --git a/nixos/modules/installer/tools/nixos-enter.sh b/nixos/modules/installer/tools/nixos-enter.sh
index 679391189612..518dbbbf21e3 100644
--- a/nixos/modules/installer/tools/nixos-enter.sh
+++ b/nixos/modules/installer/tools/nixos-enter.sh
@@ -51,8 +51,9 @@ if [[ ! -e $mountPoint/etc/NIXOS ]]; then
     exit 126
 fi
 
-mkdir -m 0755 -p "$mountPoint/dev"
+mkdir -m 0755 -p "$mountPoint/dev" "$mountPoint/sys"
 mount --rbind /dev "$mountPoint/dev"
+mount --rbind /sys "$mountPoint/sys"
 
 # Run the activation script. Set $LOCALE_ARCHIVE to supress some Perl locale warnings.
 LOCALE_ARCHIVE=$system/sw/lib/locale/locale-archive chroot "$mountPoint" "$system/activate" >&2 || true
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index c0c3249c60b6..1261fe950928 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -195,6 +195,7 @@
   ./services/databases/clickhouse.nix
   ./services/databases/couchdb.nix
   ./services/databases/firebird.nix
+  ./services/databases/foundationdb.nix
   ./services/databases/hbase.nix
   ./services/databases/influxdb.nix
   ./services/databases/memcached.nix
@@ -481,6 +482,7 @@
   ./services/networking/gnunet.nix
   ./services/networking/gogoclient.nix
   ./services/networking/gvpe.nix
+  ./services/networking/hans.nix
   ./services/networking/haproxy.nix
   ./services/networking/heyefi.nix
   ./services/networking/hostapd.nix
diff --git a/nixos/modules/services/databases/foundationdb.nix b/nixos/modules/services/databases/foundationdb.nix
new file mode 100644
index 000000000000..ba921a9c1521
--- /dev/null
+++ b/nixos/modules/services/databases/foundationdb.nix
@@ -0,0 +1,360 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.foundationdb;
+
+  # used for initial cluster configuration
+  initialIpAddr = if (cfg.publicAddress != "auto") then cfg.publicAddress else "127.0.0.1";
+
+  fdbServers = n:
+    concatStringsSep "\n" (map (x: "[fdbserver.${toString (x+cfg.listenPortStart)}]") (range 0 (n - 1)));
+
+  backupAgents = n:
+    concatStringsSep "\n" (map (x: "[backup_agent.${toString x}]") (range 1 n));
+
+  configFile = pkgs.writeText "foundationdb.conf" ''
+    [general]
+    cluster_file  = /etc/foundationdb/fdb.cluster
+
+    [fdbmonitor]
+    restart_delay = ${toString cfg.restartDelay}
+    user          = ${cfg.user}
+    group         = ${cfg.group}
+
+    [fdbserver]
+    command        = ${pkgs.foundationdb}/bin/fdbserver
+    public_address = ${cfg.publicAddress}:$ID
+    listen_address = ${cfg.listenAddress}
+    datadir        = ${cfg.dataDir}/$ID
+    logdir         = ${cfg.logDir}
+    logsize        = ${cfg.logSize}
+    maxlogssize    = ${cfg.maxLogSize}
+    ${optionalString (cfg.class != null) "class = ${cfg.class}"}
+    memory         = ${cfg.memory}
+    storage_memory = ${cfg.storageMemory}
+
+    ${optionalString (cfg.locality.machineId    != null) "locality_machineid=${cfg.locality.machineId}"}
+    ${optionalString (cfg.locality.zoneId       != null) "locality_zoneid=${cfg.locality.zoneId}"}
+    ${optionalString (cfg.locality.datacenterId != null) "locality_dcid=${cfg.locality.datacenterId}"}
+    ${optionalString (cfg.locality.dataHall     != null) "locality_data_hall=${cfg.locality.dataHall}"}
+
+    ${fdbServers cfg.serverProcesses}
+
+    [backup_agent]
+    command = ${pkgs.foundationdb}/libexec/backup_agent
+    ${backupAgents cfg.backupProcesses}
+  '';
+in
+{
+  options.services.foundationdb = {
+
+    enable = mkEnableOption "FoundationDB Server";
+
+    publicAddress = mkOption {
+      type        = types.str;
+      default     = "auto";
+      description = "Publicly visible IP address of the process. Port is determined by process ID";
+    };
+
+    listenAddress = mkOption {
+      type        = types.str;
+      default     = "public";
+      description = "Publicly visible IP address of the process. Port is determined by process ID";
+    };
+
+    listenPortStart = mkOption {
+      type          = types.int;
+      default       = 4500;
+      description   = ''
+        Starting port number for database listening sockets. Every FDB process binds to a
+        subsequent port, to this number reflects the start of the overall range. e.g. having
+        8 server processes will use all ports between 4500 and 4507.
+      '';
+    };
+
+    openFirewall = mkOption {
+      type        = types.bool;
+      default     = false;
+      description = ''
+        Open the firewall ports corresponding to FoundationDB processes and coordinators
+        using <option>config.networking.firewall.*</option>.
+      '';
+    };
+
+    dataDir = mkOption {
+      type        = types.path;
+      default     = "/var/lib/foundationdb";
+      description = "Data directory. All cluster data will be put under here.";
+    };
+
+    logDir = mkOption {
+      type        = types.path;
+      default     = "/var/log/foundationdb";
+      description = "Log directory.";
+    };
+
+    user = mkOption {
+      type        = types.str;
+      default     = "foundationdb";
+      description = "User account under which FoundationDB runs.";
+    };
+
+    group = mkOption {
+      type        = types.str;
+      default     = "foundationdb";
+      description = "Group account under which FoundationDB runs.";
+    };
+
+    class = mkOption {
+      type        = types.nullOr (types.enum [ "storage" "transaction" "stateless" ]);
+      default     = null;
+      description = "Process class";
+    };
+
+    restartDelay = mkOption {
+      type = types.int;
+      default = 10;
+      description = "Number of seconds to wait before restarting servers.";
+    };
+
+    logSize = mkOption {
+      type        = types.string;
+      default     = "10MiB";
+      description = ''
+        Roll over to a new log file after the current log file
+        reaches the specified size.
+      '';
+    };
+
+    maxLogSize = mkOption {
+      type        = types.string;
+      default     = "100MiB";
+      description = ''
+        Delete the oldest log file when the total size of all log
+        files exceeds the specified size. If set to 0, old log files
+        will not be deleted.
+      '';
+    };
+
+    serverProcesses = mkOption {
+      type = types.int;
+      default = 1;
+      description = "Number of fdbserver processes to run.";
+    };
+
+    backupProcesses = mkOption {
+      type = types.int;
+      default = 1;
+      description = "Number of backup_agent processes to run for snapshots.";
+    };
+
+    memory = mkOption {
+      type        = types.string;
+      default     = "8GiB";
+      description = ''
+        Maximum memory used by the process. The default value is
+        <literal>8GiB</literal>. When specified without a unit,
+        <literal>MiB</literal> is assumed. This parameter does not
+        change the memory allocation of the program. Rather, it sets
+        a hard limit beyond which the process will kill itself and
+        be restarted. The default value of <literal>8GiB</literal>
+        is double the intended memory usage in the default
+        configuration (providing an emergency buffer to deal with
+        memory leaks or similar problems). It is not recommended to
+        decrease the value of this parameter below its default
+        value. It may be increased if you wish to allocate a very
+        large amount of storage engine memory or cache. In
+        particular, when the <literal>storageMemory</literal>
+        parameter is increased, the <literal>memory</literal>
+        parameter should be increased by an equal amount.
+      '';
+    };
+
+    storageMemory = mkOption {
+      type        = types.string;
+      default     = "1GiB";
+      description = ''
+        Maximum memory used for data storage. The default value is
+        <literal>1GiB</literal>. When specified without a unit,
+        <literal>MB</literal> is assumed. Clusters using the memory
+        storage engine will be restricted to using this amount of
+        memory per process for purposes of data storage. Memory
+        overhead associated with storing the data is counted against
+        this total. If you increase the
+        <literal>storageMemory</literal>, you should also increase
+        the <literal>memory</literal> parameter by the same amount.
+      '';
+    };
+
+    locality = mkOption {
+      default = {
+        machineId    = null;
+        zoneId       = null;
+        datacenterId = null;
+        dataHall     = null;
+      };
+
+      description = ''
+        FoundationDB locality settings.
+      '';
+
+      type = types.submodule ({
+        options = {
+          machineId = mkOption {
+            default = null;
+            type = types.nullOr types.str;
+            description = ''
+	      Machine identifier key. All processes on a machine should share a
+              unique id. By default, processes on a machine determine a unique id to share.
+              This does not generally need to be set.
+            '';
+          };
+
+          zoneId = mkOption {
+            default = null;
+            type = types.nullOr types.str;
+            description = ''
+	      Zone identifier key. Processes that share a zone id are
+              considered non-unique for the purposes of data replication.
+              If unset, defaults to machine id.
+            '';
+          };
+
+          datacenterId = mkOption {
+            default = null;
+            type = types.nullOr types.str;
+            description = ''
+	      Data center identifier key. All processes physically located in a
+              data center should share the id. If you are depending on data
+              center based replication this must be set on all processes.
+            '';
+          };
+
+          dataHall = mkOption {
+            default = null;
+            type = types.nullOr types.str;
+            description = ''
+	      Data hall identifier key. All processes physically located in a
+              data hall should share the id. If you are depending on data
+              hall based replication this must be set on all processes.
+            '';
+          };
+        };
+      });
+    };
+
+    extraReadWritePaths = mkOption {
+      default = [ ];
+      type = types.listOf types.path;
+      description = ''
+        An extra set of filesystem paths that FoundationDB can read to
+        and write from. By default, FoundationDB runs under a heavily
+        namespaced systemd environment without write access to most of
+        the filesystem outside of its data and log directories. By
+        adding paths to this list, the set of writeable paths will be
+        expanded. This is useful for allowing e.g. backups to local files,
+        which must be performed on behalf of the foundationdb service.
+      '';
+    };
+
+    pidfile = mkOption {
+      type        = types.path;
+      default     = "/run/foundationdb.pid";
+      description = "Path to pidfile for fdbmonitor.";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    meta.doc         = ./foundationdb.xml;
+    meta.maintainers = with lib.maintainers; [ thoughtpolice ];
+
+    environment.systemPackages = [ pkgs.foundationdb ];
+
+    users.extraUsers = optionalAttrs (cfg.user == "foundationdb") (singleton
+      { name        = "foundationdb";
+        description = "FoundationDB User";
+        uid         = config.ids.uids.foundationdb;
+        group       = cfg.group;
+      });
+
+    users.extraGroups = optionalAttrs (cfg.group == "foundationdb") (singleton
+      { name = "foundationdb";
+        gid  = config.ids.gids.foundationdb;
+      });
+
+    networking.firewall.allowedTCPPortRanges = mkIf cfg.openFirewall
+      [ { from = cfg.listenPortStart;
+          to = (cfg.listenPortStart + cfg.serverProcesses) - 1;
+        }
+      ];
+
+    systemd.services.foundationdb = {
+      description             = "FoundationDB Service";
+
+      after                   = [ "network.target" ];
+      wantedBy                = [ "multi-user.target" ];
+      unitConfig =
+        { RequiresMountsFor = "${cfg.dataDir} ${cfg.logDir}";
+        };
+
+      serviceConfig =
+        let rwpaths = [ cfg.dataDir cfg.logDir cfg.pidfile "/etc/foundationdb" ]
+                   ++ cfg.extraReadWritePaths;
+        in
+        { Type       = "simple";
+          Restart    = "always";
+          RestartSec = 5;
+          User       = cfg.user;
+          Group      = cfg.group;
+          PIDFile    = "${cfg.pidfile}";
+
+          PermissionsStartOnly = true;  # setup needs root perms
+          TimeoutSec           = 120;   # give reasonable time to shut down
+
+          # Security options
+          NoNewPrivileges       = true;
+          ProtectHome           = true;
+          ProtectSystem         = "strict";
+          ProtectKernelTunables = true;
+          ProtectControlGroups  = true;
+          PrivateTmp            = true;
+          PrivateDevices        = true;
+          ReadWritePaths        = lib.concatStringsSep " " (map (x: "-" + x) rwpaths);
+        };
+
+      path = [ pkgs.foundationdb pkgs.coreutils ];
+
+      preStart = ''
+        rm -f ${cfg.pidfile}   && \
+          touch ${cfg.pidfile} && \
+          chown -R ${cfg.user}:${cfg.group} ${cfg.pidfile}
+
+        for x in "${cfg.logDir}" "${cfg.dataDir}" /etc/foundationdb; do
+          [ ! -d "$x" ] && mkdir -m 0700 -vp "$x" && chown -R ${cfg.user}:${cfg.group} "$x";
+        done
+
+        if [ ! -f /etc/foundationdb/fdb.cluster ]; then
+            cf=/etc/foundationdb/fdb.cluster
+            desc=$(tr -dc A-Za-z0-9 </dev/urandom 2>/dev/null | head -c8)
+            rand=$(tr -dc A-Za-z0-9 </dev/urandom 2>/dev/null | head -c8)
+            echo ''${desc}:''${rand}@${initialIpAddr}:${builtins.toString cfg.listenPortStart} > $cf
+            chmod 0660 $cf && chown -R ${cfg.user}:${cfg.group} $cf
+            touch "${cfg.dataDir}/.first_startup"
+        fi
+      '';
+
+      script = ''
+        exec fdbmonitor --lockfile ${cfg.pidfile} --conffile ${configFile};
+      '';
+
+      postStart = ''
+        if [ -e "${cfg.dataDir}/.first_startup" ]; then
+          fdbcli --exec "configure new single ssd"
+          rm -f "${cfg.dataDir}/.first_startup";
+        fi
+      '';
+    };
+  };
+}
diff --git a/nixos/modules/services/databases/foundationdb.xml b/nixos/modules/services/databases/foundationdb.xml
new file mode 100644
index 000000000000..d10a5cfe836e
--- /dev/null
+++ b/nixos/modules/services/databases/foundationdb.xml
@@ -0,0 +1,279 @@
+<chapter xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xmlns:xi="http://www.w3.org/2001/XInclude"
+         version="5.0"
+         xml:id="module-foundationdb">
+
+<title>FoundationDB</title>
+
+<para><emphasis>Source:</emphasis> <filename>modules/services/databases/foundationdb.nix</filename></para>
+
+<para><emphasis>Upstream documentation:</emphasis> <link xlink:href="https://apple.github.io/foundationdb/"/></para>
+
+<para><emphasis>Maintainer:</emphasis> Austin Seipp</para>
+
+<para><emphasis>Default version:</emphasis> 5.1.x</para>
+
+<para>FoundationDB (or "FDB") is a distributed, open source, high performance,
+transactional key-value store. It can store petabytes of data and deliver
+exceptional performance while maintaining consistency and ACID semantics over a
+large cluster.</para>
+
+<section><title>Configuring and basic setup</title>
+
+<para>To enable FoundationDB, add the following to your
+<filename>configuration.nix</filename>:
+
+<programlisting>
+services.foundationdb.enable = true;
+</programlisting>
+</para>
+
+<para>After running <command>nixos-rebuild</command>, you can verify whether
+FoundationDB is running by executing <command>fdbcli</command> (which is added
+to <option>environment.systemPackages</option>):
+
+<programlisting>
+$ sudo -u foundationdb fdbcli
+Using cluster file `/etc/foundationdb/fdb.cluster'.
+
+The database is available.
+
+Welcome to the fdbcli. For help, type `help'.
+fdb> status
+
+Using cluster file `/etc/foundationdb/fdb.cluster'.
+
+Configuration:
+  Redundancy mode        - single
+  Storage engine         - memory
+  Coordinators           - 1
+
+Cluster:
+  FoundationDB processes - 1
+  Machines               - 1
+  Memory availability    - 5.4 GB per process on machine with least available
+  Fault Tolerance        - 0 machines
+  Server time            - 04/20/18 15:21:14
+
+...
+
+fdb>
+</programlisting>
+</para>
+
+<para>FoundationDB is run under the <command>foundationdb</command> user and
+group by default, but this may be changed in the NixOS configuration. The
+systemd unit <command>foundationdb.service</command> controls the
+<command>fdbmonitor</command> process.</para>
+
+<para>By default, the NixOS module for FoundationDB creates a single
+SSD-storage based database for development and basic usage. This storage engine
+is designed for SSDs and will perform poorly on HDDs; however it can handle far
+more data than the alternative "memory" engine and is a better default choice
+for most deployments. (Note that you can change the storage backend on-the-fly
+for a given FoundationDB cluster using <command>fdbcli</command>.)</para>
+
+<para>Furthermore, only 1 server process and 1 backup agent are started in the
+default configuration. See below for more on scaling to increase this.</para>
+
+<para>FoundationDB stores all data for all server processes under
+<filename>/var/lib/foundationdb</filename>. You can override this using
+<option>services.foundationdb.dataDir</option>, e.g.
+
+<programlisting>
+services.foundationdb.dataDir = "/data/fdb";
+</programlisting>
+
+</para>
+
+<para>Similarly, logs are stored under
+<filename>/var/log/foundationdb</filename> by default, and there is a
+corresponding <option>services.foundationdb.logDir</option> as well.</para>
+
+</section>
+
+<section><title>Scaling processes and backup agents</title>
+
+<para>Scaling the number of server processes is quite easy; simply specify
+<option>services.foundationdb.serverProcesses</option> to be the number of
+FoundationDB worker processes that should be started on the machine.</para>
+
+<para>FoundationDB worker processes typically require 4GB of RAM per-process at
+minimum for good performance, so this option is set to 1 by default since the
+maximum aount of RAM is unknown. You're advised to abide by this restriction,
+so pick a number of processes so that each has 4GB or more.</para>
+
+<para>A similar option exists in order to scale backup agent processes,
+<option>services.foundationdb.backupProcesses</option>. Backup agents are not
+as performance/RAM sensitive, so feel free to experiment with the number of
+available backup processes.</para>
+
+</section>
+
+<section><title>Clustering</title>
+
+<para>FoundationDB on NixOS works similarly to other Linux systems, so this
+section will be brief. Please refer to the full FoundationDB documentation for
+more on clustering.</para>
+
+<para>FoundationDB organizes clusters using a set of
+<emphasis>coordinators</emphasis>, which are just specially-designated worker
+processes. By default, every installation of FoundationDB on NixOS will start
+as its own individual cluster, with a single coordinator: the first worker
+process on <command>localhost</command>.</para>
+
+<para>Coordinators are specified globally using the
+<command>/etc/foundationdb/fdb.cluster</command> file, which all servers and
+client applications will use to find and join coordinators. Note that this file
+<emphasis>can not</emphasis> be managed by NixOS so easily: FoundationDB is
+designed so that it will rewrite the file at runtime for all clients and nodes
+when cluster coordinators change, with clients transparently handling this
+without intervention.</para>
+
+<para>When dealing with a cluster, there are two main things you want to
+do:</para>
+
+<itemizedlist>
+  <listitem><para>Add a node to the cluster for storage/compute.</para></listitem>
+  <listitem><para>Promote an ordinary worker to a coordinator.</para></listitem>
+</itemizedlist>
+
+<para>A node must already be a member of the cluster in order to properly be
+promoted to a coordinator, so you must always add it first if you wish to
+promote it.</para>
+
+<para>To add a machine to a FoundationDB cluster:</para>
+
+<itemizedlist>
+  <listitem><para>Choose one of the servers to start as the initial coordinator.
+      </para></listitem>
+  <listitem><para>Copy the <command>/etc/foundationdb/fdb.cluster</command> file
+      from this server to all the other servers. Restart FoundationDB on all of
+      these other servers, so they join the cluster.</para></listitem>
+  <listitem><para>All of these servers are now connected and working together
+      in the cluster, under the chosen coordinator.</para></listitem>
+</itemizedlist>
+
+<para>At this point, you can add as many nodes as you want by just repeating
+the above steps. By default there will still be a single coordinator: you can
+use <command>fdbcli</command> to change this and add new coordinators.</para>
+
+<para>As a convenience, FoundationDB can automatically assign coordinators
+based on the redundancy mode you wish to achieve for the cluster. Once all the
+nodes have been joined, simply set the replication policy, and then issue the
+<command>coordinators auto</command> command</para>
+
+<para>For example, assuming we have 3 nodes available, we can enable double
+redundancy mode, then auto-select coordinators. For double redundancy, 3
+coordinators is ideal: therefore FoundationDB will make
+<emphasis>every</emphasis> node a coordinator automatically:</para>
+
+<programlisting>
+fdbcli> configure double ssd
+fdbcli> coordinators auto
+</programlisting>
+
+<para>This will transparently update all the servers within seconds, and
+appropriately rewrite the <command>fdb.cluster</command> file, as well as
+informing all client processes to do the same.</para>
+
+</section>
+
+<section><title>Client connectivity</title>
+
+<para>By default, all clients must use the current
+<command>fdb.cluster</command> file to access a given FoundationDB cluster.
+This file is located by default in
+<command>/etc/foundationdb/fdb.cluster</command> on all machines with the
+FoundationDB service enabled, so you may copy the active one from your cluster
+to a new node in order to connect, if it is not part of the cluster.</para>
+
+</section>
+
+<section><title>Backups and Disaster Recovery</title>
+
+<para>The usual rules for doing FoundationDB backups apply on NixOS as written
+in the FoundationDB manual. However, one important difference is the security
+profile for NixOS: by default, the <command>foundationdb</command> systemd unit
+uses <emphasis>Linux namespaces</emphasis> to restrict write access to the
+system, except for the log directory, data directory, and the
+<command>/etc/foundationdb/</command> directory. This is enforced by default
+and cannot be disabled.</para>
+
+<para>However, a side effect of this is that the <command>fdbbackup</command>
+command doesn't work properly for local filesystem backups: FoundationDB uses a
+server process alongside the database processes to perform backups and copy the
+backups to the filesystem. As a result, this process is put under the
+restricted namespaces above: the backup process can only write to a limited
+number of paths.</para>
+
+<para>In order to allow flexible backup locations on local disks, the
+FoundationDB NixOS module supports a
+<option>services.foundationdb.extraReadWritePaths</option> option. This option
+takes a list of paths, and adds them to the systemd unit, allowing the
+processes inside the service to write (and read) the specified
+directories.</para>
+
+<para>For example, to create backups in <command>/opt/fdb-backups</command>,
+first set up the paths in the module options:</para>
+
+<programlisting>
+services.foundationdb.extraReadWritePaths = [ "/opt/fdb-backups" ];
+</programlisting>
+
+<para>Restart the FoundationDB service, and it will now be able to write to
+this directory (even if it does not yet exist.) Note: this path
+<emphasis>must</emphasis> exist before restarting the unit. Otherwise, systemd
+will not include it in the private FoundationDB namespace (and it will not add
+it dynamically at runtime).</para>
+
+<para>You can now perform a backup:</para>
+
+<programlisting>
+$ sudo -u foundationdb fdbbackup start  -t default -d file:///opt/fdb-backups
+$ sudo -u foundationdb fdbbackup status -t default
+</programlisting>
+
+</section>
+
+<section><title>Known limitations</title>
+
+<para>The FoundationDB setup for NixOS should currently be considered beta.
+FoundationDB is not new software, but the NixOS compilation and integration has
+only undergone fairly basic testing of all the available functionality.</para>
+
+<itemizedlist>
+  <listitem><para>TLS plugin support is compiled in, but it's currently not
+      possible to specify the set of TLS certificate options in
+      <command>services.foundationdb</command></para></listitem>
+  <listitem><para>There is no way to specify individual parameters for
+      individual <command>fdbserver</command> processes. Currently, all server
+      processes inherit all the global <command>fdbmonitor</command> settings.
+      </para></listitem>
+  <listitem><para>Python bindings are not currently installed.</para></listitem>
+  <listitem><para>Ruby bindings are not currently installed.</para></listitem>
+  <listitem><para>Java bindings are not currently installed.</para></listitem>
+  <listitem><para>Go bindings are not currently installed.</para></listitem>
+</itemizedlist>
+
+</section>
+
+<section><title>Options</title>
+
+<para>NixOS's FoundationDB module allows you to configure all of the most
+relevant configuration options for <command>fdbmonitor</command>, matching it
+quite closely. For a complete list of all options, check <command>man
+configuration.nix</command>.</para>
+
+</section>
+
+<section><title>Full documentation</title>
+
+<para>FoundationDB is a complex piece of software, and requires careful
+administration to properly use. Full documentation for administration can be
+found here: <link xlink:href="https://apple.github.io/foundationdb/"/>.</para>
+
+</section>
+
+</chapter>
diff --git a/nixos/modules/services/networking/hans.nix b/nixos/modules/services/networking/hans.nix
new file mode 100644
index 000000000000..dd34ef8d4ca1
--- /dev/null
+++ b/nixos/modules/services/networking/hans.nix
@@ -0,0 +1,145 @@
+# NixOS module for hans, ip over icmp daemon
+
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.hans;
+
+  hansUser = "hans";
+
+in
+{
+
+  ### configuration
+
+  options = {
+
+    services.hans = {
+      clients = mkOption {
+        default = {};
+        description = ''
+          Each attribute of this option defines a systemd service that
+          runs hans. Many or none may be defined.
+          The name of each service is
+          <literal>hans-<replaceable>name</replaceable></literal>
+          where <replaceable>name</replaceable> is the name of the
+          corresponding attribute name.
+        '';
+        example = literalExample ''
+        {
+          foo = {
+            server = "192.0.2.1";
+            extraConfig = "-v";
+          }
+        }
+        '';
+        type = types.attrsOf (types.submodule (
+        {
+          options = {
+            server = mkOption {
+              type = types.str;
+              default = "";
+              description = "IP address of server running hans";
+              example = "192.0.2.1";
+            };
+
+            extraConfig = mkOption {
+              type = types.str;
+              default = "";
+              description = "Additional command line parameters";
+              example = "-v";
+            };
+
+            passwordFile = mkOption {
+              type = types.str;
+              default = "";
+              description = "File that containts password";
+            };
+
+          };
+        }));
+      };
+
+      server = {
+        enable = mkOption {
+          type = types.bool;
+          default = false;
+          description = "enable hans server";
+        };
+
+        ip = mkOption {
+          type = types.str;
+          default = "";
+          description = "The assigned ip range";
+          example = "198.51.100.0";
+        };
+
+        respondToSystemPings = mkOption {
+          type = types.bool;
+          default = false;
+          description = "Force hans respond to ordinary pings";
+        };
+
+        extraConfig = mkOption {
+          type = types.str;
+          default = "";
+          description = "Additional command line parameters";
+          example = "-v";
+        };
+
+        passwordFile = mkOption {
+          type = types.str;
+          default = "";
+          description = "File that containts password";
+        };
+      };
+
+    };
+  };
+
+  ### implementation
+
+  config = mkIf (cfg.server.enable || cfg.clients != {}) {
+    boot.kernel.sysctl = optionalAttrs cfg.server.respondToSystemPings {
+      "net.ipv4.icmp_echo_ignore_all" = 1;
+    };
+
+    boot.kernelModules = [ "tun" ];
+
+    systemd.services =
+    let
+      createHansClientService = name: cfg:
+      {
+        description = "hans client - ${name}";
+        after = [ "network.target" ];
+        wantedBy = [ "multi-user.target" ];
+        script = "${pkgs.hans}/bin/hans -f -u ${hansUser} ${cfg.extraConfig} -c ${cfg.server} ${optionalString (cfg.passwordFile != "") "-p $(cat \"${cfg.passwordFile}\")"}";
+        serviceConfig = {
+          RestartSec = "30s";
+          Restart = "always";
+        };
+      };
+    in
+    listToAttrs (
+      mapAttrsToList
+        (name: value: nameValuePair "hans-${name}" (createHansClientService name value))
+        cfg.clients
+    ) // {
+      hans = mkIf (cfg.server.enable) {
+        description = "hans, ip over icmp server daemon";
+        after = [ "network.target" ];
+        wantedBy = [ "multi-user.target" ];
+        script = "${pkgs.hans}/bin/hans -f -u ${hansUser} ${cfg.server.extraConfig} -s ${cfg.server.ip} ${optionalString cfg.server.respondToSystemPings "-r"} ${optionalString (cfg.server.passwordFile != "") "-p $(cat \"${cfg.server.passwordFile}\")"}";
+      };
+    };
+
+    users.extraUsers = singleton {
+      name = hansUser;
+      description = "Hans daemon user";
+    };
+  };
+
+  meta.maintainers = with maintainers; [ gnidorah ];
+}
diff --git a/nixos/modules/services/networking/iodine.nix b/nixos/modules/services/networking/iodine.nix
index 512dbd77ae4b..3f41421d27f7 100644
--- a/nixos/modules/services/networking/iodine.nix
+++ b/nixos/modules/services/networking/iodine.nix
@@ -32,7 +32,7 @@ in
           foo = {
             server = "tunnel.mdomain.com";
             relay = "8.8.8.8";
-            extraConfig = "-P mysecurepassword";
+            extraConfig = "-v";
           }
         }
         '';
@@ -57,7 +57,13 @@ in
               type = types.str;
               default = "";
               description = "Additional command line parameters";
-              example = "-P mysecurepassword -l 192.168.1.10 -p 23";
+              example = "-l 192.168.1.10 -p 23";
+            };
+
+            passwordFile = mkOption {
+              type = types.str;
+              default = "";
+              description = "File that containts password";
             };
           };
         }));
@@ -88,7 +94,13 @@ in
           type = types.str;
           default = "";
           description = "Additional command line parameters";
-          example = "-P mysecurepassword -l 192.168.1.10 -p 23";
+          example = "-l 192.168.1.10 -p 23";
+        };
+
+        passwordFile = mkOption {
+          type = types.str;
+          default = "";
+          description = "File that containts password";
         };
       };
 
@@ -108,10 +120,10 @@ in
         description = "iodine client - ${name}";
         after = [ "network.target" ];
         wantedBy = [ "multi-user.target" ];
+        script = "${pkgs.iodine}/bin/iodine -f -u ${iodinedUser} ${cfg.extraConfig} ${optionalString (cfg.passwordFile != "") "-P $(cat \"${cfg.passwordFile}\")"} ${cfg.relay} ${cfg.server}";
         serviceConfig = {
           RestartSec = "30s";
           Restart = "always";
-          ExecStart = "${pkgs.iodine}/bin/iodine -f -u ${iodinedUser} ${cfg.extraConfig} ${cfg.relay} ${cfg.server}";
         };
       };
     in
@@ -124,7 +136,7 @@ in
         description = "iodine, ip over dns server daemon";
         after = [ "network.target" ];
         wantedBy = [ "multi-user.target" ];
-        serviceConfig.ExecStart = "${pkgs.iodine}/bin/iodined -f -u ${iodinedUser} ${cfg.server.extraConfig} ${cfg.server.ip} ${cfg.server.domain}";
+        script = "${pkgs.iodine}/bin/iodined -f -u ${iodinedUser} ${cfg.server.extraConfig} ${optionalString (cfg.server.passwordFile != "") "-P $(cat \"${cfg.server.passwordFile}\")"} ${cfg.server.ip} ${cfg.server.domain}";
       };
     };
 
diff --git a/pkgs/applications/audio/cdparanoia/default.nix b/pkgs/applications/audio/cdparanoia/default.nix
index d4d302f07d21..760b04bef005 100644
--- a/pkgs/applications/audio/cdparanoia/default.nix
+++ b/pkgs/applications/audio/cdparanoia/default.nix
@@ -17,7 +17,8 @@ stdenv.mkDerivation rec {
       url = "https://trac.macports.org/export/70964/trunk/dports/audio/cdparanoia/files/patch-paranoia_paranoia.c.10.4.diff";
       sha256 = "17l2qhn8sh4jy6ryy5si6ll6dndcm0r537rlmk4a6a8vkn852vad";
     })
-  ] ++ stdenv.lib.optional stdenv.hostPlatform.isMusl ./utils.patch;
+    ] ++ stdenv.lib.optional stdenv.hostPlatform.isMusl ./utils.patch
+    ++ [./fix_private_keyword.patch];
 
   buildInputs = stdenv.lib.optional stdenv.isAarch64 autoreconfHook;
 
diff --git a/pkgs/applications/audio/cdparanoia/fix_private_keyword.patch b/pkgs/applications/audio/cdparanoia/fix_private_keyword.patch
new file mode 100644
index 000000000000..3e9cbe2bd8c2
--- /dev/null
+++ b/pkgs/applications/audio/cdparanoia/fix_private_keyword.patch
@@ -0,0 +1,468 @@
+--- cdparanoia-III-10.2/interface/cdda_interface.h	(revision 15337)
++++ cdparanoia-III-10.2/interface/cdda_interface.h	(revision 15338)
+@@ -85,5 +85,5 @@
+   int is_mmc;
+ 
+-  cdda_private_data_t *private;
++  cdda_private_data_t *private_data;
+   void         *reserved;
+   unsigned char inqbytes[4];
+--- cdparanoia-III-10.2/interface/cooked_interface.c	(revision 15337)
++++ cdparanoia-III-10.2/interface/cooked_interface.c	(revision 15338)
+@@ -14,11 +14,11 @@
+   struct timespec tv1;
+   struct timespec tv2;
+-  int ret1=clock_gettime(d->private->clock,&tv1);
++  int ret1=clock_gettime(d->private_data->clock,&tv1);
+   int ret2=ioctl(fd, command,arg);
+-  int ret3=clock_gettime(d->private->clock,&tv2);
++  int ret3=clock_gettime(d->private_data->clock,&tv2);
+   if(ret1<0 || ret3<0){
+-    d->private->last_milliseconds=-1;
++    d->private_data->last_milliseconds=-1;
+   }else{
+-    d->private->last_milliseconds = (tv2.tv_sec-tv1.tv_sec)*1000. + (tv2.tv_nsec-tv1.tv_nsec)/1000000.;
++    d->private_data->last_milliseconds = (tv2.tv_sec-tv1.tv_sec)*1000. + (tv2.tv_nsec-tv1.tv_nsec)/1000000.;
+   }
+   return ret2;
+--- cdparanoia-III-10.2/interface/interface.c	(revision 15337)
++++ cdparanoia-III-10.2/interface/interface.c	(revision 15338)
+@@ -40,7 +40,7 @@
+     if(d->cdda_fd!=-1)close(d->cdda_fd);
+     if(d->ioctl_fd!=-1 && d->ioctl_fd!=d->cdda_fd)close(d->ioctl_fd);
+-    if(d->private){
+-      if(d->private->sg_hd)free(d->private->sg_hd);
+-      free(d->private);
++    if(d->private_data){
++      if(d->private_data->sg_hd)free(d->private_data->sg_hd);
++      free(d->private_data);
+     }
+ 
+@@ -128,5 +128,5 @@
+       }	
+     }
+-    if(ms)*ms=d->private->last_milliseconds;
++    if(ms)*ms=d->private_data->last_milliseconds;
+     return(sectors);
+   }
+--- cdparanoia-III-10.2/interface/scan_devices.c	(revision 15337)
++++ cdparanoia-III-10.2/interface/scan_devices.c	(revision 15338)
+@@ -265,9 +265,9 @@
+   d->bigendianp=-1; /* We don't know yet... */
+   d->nsectors=-1;
+-  d->private=calloc(1,sizeof(*d->private));
++  d->private_data=calloc(1,sizeof(*d->private_data));
+   {
+     /* goddamnit */
+     struct timespec tv;
+-    d->private->clock=(clock_gettime(CLOCK_MONOTONIC,&tv)<0?CLOCK_REALTIME:CLOCK_MONOTONIC);
++    d->private_data->clock=(clock_gettime(CLOCK_MONOTONIC,&tv)<0?CLOCK_REALTIME:CLOCK_MONOTONIC);
+   }
+   idmessage(messagedest,messages,"\t\tCDROM sensed: %s\n",description);
+@@ -675,13 +675,13 @@
+   d->nsectors=-1;
+   d->messagedest = messagedest;
+-  d->private=calloc(1,sizeof(*d->private));
++  d->private_data=calloc(1,sizeof(*d->private_data));
+   {
+     /* goddamnit */
+     struct timespec tv;
+-    d->private->clock=(clock_gettime(CLOCK_MONOTONIC,&tv)<0?CLOCK_REALTIME:CLOCK_MONOTONIC);
++    d->private_data->clock=(clock_gettime(CLOCK_MONOTONIC,&tv)<0?CLOCK_REALTIME:CLOCK_MONOTONIC);
+   }
+   if(use_sgio){
+     d->interface=SGIO_SCSI;
+-    d->private->sg_buffer=(unsigned char *)(d->private->sg_hd=malloc(MAX_BIG_BUFF_SIZE));
++    d->private_data->sg_buffer=(unsigned char *)(d->private_data->sg_hd=malloc(MAX_BIG_BUFF_SIZE));
+     g_fd=d->cdda_fd=dup(d->ioctl_fd);
+   }else{
+@@ -697,6 +697,6 @@
+ 
+     /* malloc our big buffer for scsi commands */
+-    d->private->sg_hd=malloc(MAX_BIG_BUFF_SIZE);
+-    d->private->sg_buffer=((unsigned char *)d->private->sg_hd)+SG_OFF;
++    d->private_data->sg_hd=malloc(MAX_BIG_BUFF_SIZE);
++    d->private_data->sg_buffer=((unsigned char *)d->private_data->sg_hd)+SG_OFF;
+   }
+ 
+@@ -773,7 +773,7 @@
+   if(g_fd!=-1)close(g_fd);
+   if(d){
+-    if(d->private){
+-      if(d->private->sg_hd)free(d->private->sg_hd);
+-      free(d->private);
++    if(d->private_data){
++      if(d->private_data->sg_hd)free(d->private_data->sg_hd);
++      free(d->private_data);
+     }
+     free(d);
+@@ -822,5 +822,5 @@
+   d->bigendianp=-1; /* We don't know yet... */
+   d->nsectors=-1;
+-  d->private=calloc(1,sizeof(*d->private));
++  d->private_data=calloc(1,sizeof(*d->private_data));
+   d->drive_model=copystring("File based test interface");
+   idmessage(messagedest,messages,"\t\tCDROM sensed: %s\n",d->drive_model);
+--- cdparanoia-III-10.2/interface/scsi_interface.c	(revision 15337)
++++ cdparanoia-III-10.2/interface/scsi_interface.c	(revision 15338)
+@@ -16,11 +16,11 @@
+   struct timespec tv1;
+   struct timespec tv2;
+-  int ret1=clock_gettime(d->private->clock,&tv1);
++  int ret1=clock_gettime(d->private_data->clock,&tv1);
+   int ret2=ioctl(fd, command,arg);
+-  int ret3=clock_gettime(d->private->clock,&tv2);
++  int ret3=clock_gettime(d->private_data->clock,&tv2);
+   if(ret1<0 || ret3<0){
+-    d->private->last_milliseconds=-1;
++    d->private_data->last_milliseconds=-1;
+   }else{
+-    d->private->last_milliseconds = (tv2.tv_sec-tv1.tv_sec)*1000. + (tv2.tv_nsec-tv1.tv_nsec)/1000000.;
++    d->private_data->last_milliseconds = (tv2.tv_sec-tv1.tv_sec)*1000. + (tv2.tv_nsec-tv1.tv_nsec)/1000000.;
+   }
+   return ret2;
+@@ -97,5 +97,5 @@
+   fd_set fdset;
+   struct timeval tv;
+-  struct sg_header *sg_hd=d->private->sg_hd;
++  struct sg_header *sg_hd=d->private_data->sg_hd;
+   int flag=0;
+ 
+@@ -186,5 +186,5 @@
+   int tret1,tret2;
+   int status = 0;
+-  struct sg_header *sg_hd=d->private->sg_hd;
++  struct sg_header *sg_hd=d->private_data->sg_hd;
+   long writebytes=SG_OFF+cmd_len+in_size;
+ 
+@@ -196,5 +196,5 @@
+   memset(sg_hd,0,sizeof(sg_hd)); 
+   memset(sense_buffer,0,SG_MAX_SENSE); 
+-  memcpy(d->private->sg_buffer,cmd,cmd_len+in_size);
++  memcpy(d->private_data->sg_buffer,cmd,cmd_len+in_size);
+   sg_hd->twelve_byte = cmd_len == 12;
+   sg_hd->result = 0;
+@@ -210,5 +210,5 @@
+ 
+   if(bytecheck && out_size>in_size){
+-    memset(d->private->sg_buffer+cmd_len+in_size,bytefill,out_size-in_size); 
++    memset(d->private_data->sg_buffer+cmd_len+in_size,bytefill,out_size-in_size); 
+     /* the size does not remove cmd_len due to the way the kernel
+        driver copies buffers */
+@@ -244,5 +244,5 @@
+ 
+   sigprocmask (SIG_BLOCK, &(d->sigset), NULL );
+-  tret1=clock_gettime(d->private->clock,&tv1);  
++  tret1=clock_gettime(d->private_data->clock,&tv1);  
+   errno=0;
+   status = write(d->cdda_fd, sg_hd, writebytes );
+@@ -290,5 +290,5 @@
+   }
+ 
+-  tret2=clock_gettime(d->private->clock,&tv2);  
++  tret2=clock_gettime(d->private_data->clock,&tv2);  
+   errno=0;
+   status = read(d->cdda_fd, sg_hd, SG_OFF + out_size);
+@@ -314,5 +314,5 @@
+     long i,flag=0;
+     for(i=in_size;i<out_size;i++)
+-      if(d->private->sg_buffer[i]!=bytefill){
++      if(d->private_data->sg_buffer[i]!=bytefill){
+ 	flag=1;
+ 	break;
+@@ -327,7 +327,7 @@
+   errno=0;
+   if(tret1<0 || tret2<0){
+-    d->private->last_milliseconds=-1;
++    d->private_data->last_milliseconds=-1;
+   }else{
+-    d->private->last_milliseconds = (tv2.tv_sec-tv1.tv_sec)*1000 + (tv2.tv_nsec-tv1.tv_nsec)/1000000;
++    d->private_data->last_milliseconds = (tv2.tv_sec-tv1.tv_sec)*1000 + (tv2.tv_nsec-tv1.tv_nsec)/1000000;
+   }
+   return(0);
+@@ -348,5 +348,5 @@
+   memset(&hdr,0,sizeof(hdr));
+   memset(sense,0,sizeof(sense));
+-  memcpy(d->private->sg_buffer,cmd+cmd_len,in_size);
++  memcpy(d->private_data->sg_buffer,cmd+cmd_len,in_size);
+ 
+   hdr.cmdp = cmd;
+@@ -356,5 +356,5 @@
+   hdr.timeout = 50000;
+   hdr.interface_id = 'S';
+-  hdr.dxferp =  d->private->sg_buffer;
++  hdr.dxferp =  d->private_data->sg_buffer;
+   hdr.flags = SG_FLAG_DIRECT_IO;  /* direct IO if we can get it */
+ 
+@@ -401,5 +401,5 @@
+     long i,flag=0;
+     for(i=in_size;i<out_size;i++)
+-      if(d->private->sg_buffer[i]!=bytefill){
++      if(d->private_data->sg_buffer[i]!=bytefill){
+ 	flag=1;
+ 	break;
+@@ -413,5 +413,5 @@
+ 
+   /* Can't rely on .duration because we can't be certain kernel has HZ set to something useful */
+-  /* d->private->last_milliseconds = hdr.duration; */
++  /* d->private_data->last_milliseconds = hdr.duration; */
+ 
+   errno = 0;
+@@ -446,7 +446,7 @@
+   handle_scsi_cmd(d, cmd, 6, 0, 56, 0,0, sense);
+ 
+-  key = d->private->sg_buffer[2] & 0xf;
+-  ASC = d->private->sg_buffer[12];
+-  ASCQ = d->private->sg_buffer[13];
++  key = d->private_data->sg_buffer[2] & 0xf;
++  ASC = d->private_data->sg_buffer[12];
++  ASCQ = d->private_data->sg_buffer[13];
+   
+   if(key == 2 && ASC == 4 && ASCQ == 1) return 0;
+@@ -493,5 +493,5 @@
+ 
+   {
+-    unsigned char *b=d->private->sg_buffer;
++    unsigned char *b=d->private_data->sg_buffer;
+     if(b[0])return(1); /* Handles only up to 256 bytes */
+     if(b[6])return(1); /* Handles only up to 256 bytes */
+@@ -605,6 +605,6 @@
+   if(mode_sense(d,12,0x01))return(-1);
+ 
+-  d->orgdens = d->private->sg_buffer[4];
+-  return(d->orgsize = ((int)(d->private->sg_buffer[10])<<8)+d->private->sg_buffer[11]);
++  d->orgdens = d->private_data->sg_buffer[4];
++  return(d->orgsize = ((int)(d->private_data->sg_buffer[10])<<8)+d->private_data->sg_buffer[11]);
+ }
+ 
+@@ -665,6 +665,6 @@
+   }
+ 
+-  first=d->private->sg_buffer[2];
+-  last=d->private->sg_buffer[3];
++  first=d->private_data->sg_buffer[2];
++  last=d->private_data->sg_buffer[3];
+   tracks=last-first+1;
+ 
+@@ -684,5 +684,5 @@
+     }
+     {
+-      scsi_TOC *toc=(scsi_TOC *)(d->private->sg_buffer+4);
++      scsi_TOC *toc=(scsi_TOC *)(d->private_data->sg_buffer+4);
+ 
+       d->disc_toc[i-first].bFlags=toc->bFlags;
+@@ -705,5 +705,5 @@
+   }
+   {
+-    scsi_TOC *toc=(scsi_TOC *)(d->private->sg_buffer+4);
++    scsi_TOC *toc=(scsi_TOC *)(d->private_data->sg_buffer+4);
+     
+     d->disc_toc[i-first].bFlags=toc->bFlags;
+@@ -739,5 +739,5 @@
+ 
+   /* copy to our structure and convert start sector */
+-  tracks = d->private->sg_buffer[1];
++  tracks = d->private_data->sg_buffer[1];
+   if (tracks > MAXTRK) {
+     cderror(d,"003: CDROM reporting illegal number of tracks\n");
+@@ -755,31 +755,31 @@
+     }
+     
+-    d->disc_toc[i].bFlags = d->private->sg_buffer[10];
++    d->disc_toc[i].bFlags = d->private_data->sg_buffer[10];
+     d->disc_toc[i].bTrack = i + 1;
+ 
+     d->disc_toc[i].dwStartSector= d->adjust_ssize * 
+-	(((signed char)(d->private->sg_buffer[2])<<24) | 
+-	 (d->private->sg_buffer[3]<<16)|
+-	 (d->private->sg_buffer[4]<<8)|
+-	 (d->private->sg_buffer[5]));
++	(((signed char)(d->private_data->sg_buffer[2])<<24) | 
++	 (d->private_data->sg_buffer[3]<<16)|
++	 (d->private_data->sg_buffer[4]<<8)|
++	 (d->private_data->sg_buffer[5]));
+   }
+ 
+   d->disc_toc[i].bFlags = 0;
+   d->disc_toc[i].bTrack = i + 1;
+-  memcpy (&foo, d->private->sg_buffer+2, 4);
+-  memcpy (&bar, d->private->sg_buffer+6, 4);
++  memcpy (&foo, d->private_data->sg_buffer+2, 4);
++  memcpy (&bar, d->private_data->sg_buffer+6, 4);
+   d->disc_toc[i].dwStartSector = d->adjust_ssize * (be32_to_cpu(foo) +
+ 						    be32_to_cpu(bar));
+ 
+   d->disc_toc[i].dwStartSector= d->adjust_ssize * 
+-    ((((signed char)(d->private->sg_buffer[2])<<24) | 
+-      (d->private->sg_buffer[3]<<16)|
+-      (d->private->sg_buffer[4]<<8)|
+-      (d->private->sg_buffer[5]))+
++    ((((signed char)(d->private_data->sg_buffer[2])<<24) | 
++      (d->private_data->sg_buffer[3]<<16)|
++      (d->private_data->sg_buffer[4]<<8)|
++      (d->private_data->sg_buffer[5]))+
+      
+-     ((((signed char)(d->private->sg_buffer[6])<<24) | 
+-       (d->private->sg_buffer[7]<<16)|
+-       (d->private->sg_buffer[8]<<8)|
+-       (d->private->sg_buffer[9]))));
++     ((((signed char)(d->private_data->sg_buffer[6])<<24) | 
++       (d->private_data->sg_buffer[7]<<16)|
++       (d->private_data->sg_buffer[8]<<8)|
++       (d->private_data->sg_buffer[9]))));
+ 
+ 
+@@ -818,5 +818,5 @@
+   if((ret=handle_scsi_cmd(d,cmd,10,0,sectors * CD_FRAMESIZE_RAW,'\177',1,sense)))
+     return(ret);
+-  if(p)memcpy(p,d->private->sg_buffer,sectors*CD_FRAMESIZE_RAW);
++  if(p)memcpy(p,d->private_data->sg_buffer,sectors*CD_FRAMESIZE_RAW);
+   return(0);
+ }
+@@ -837,5 +837,5 @@
+   if((ret=handle_scsi_cmd(d,cmd,12,0,sectors * CD_FRAMESIZE_RAW,'\177',1,sense)))
+     return(ret);
+-  if(p)memcpy(p,d->private->sg_buffer,sectors*CD_FRAMESIZE_RAW);
++  if(p)memcpy(p,d->private_data->sg_buffer,sectors*CD_FRAMESIZE_RAW);
+   return(0);
+ }
+@@ -855,5 +855,5 @@
+   if((ret=handle_scsi_cmd(d,cmd,10,0,sectors * CD_FRAMESIZE_RAW,'\177',1,sense)))
+     return(ret);
+-  if(p)memcpy(p,d->private->sg_buffer,sectors*CD_FRAMESIZE_RAW);
++  if(p)memcpy(p,d->private_data->sg_buffer,sectors*CD_FRAMESIZE_RAW);
+   return(0);
+ }
+@@ -873,5 +873,5 @@
+   if((ret=handle_scsi_cmd(d,cmd,12,0,sectors * CD_FRAMESIZE_RAW,'\177',1,sense)))
+     return(ret);
+-  if(p)memcpy(p,d->private->sg_buffer,sectors*CD_FRAMESIZE_RAW);
++  if(p)memcpy(p,d->private_data->sg_buffer,sectors*CD_FRAMESIZE_RAW);
+   return(0);
+ }
+@@ -891,5 +891,5 @@
+   if((ret=handle_scsi_cmd(d,cmd,10,0,sectors * CD_FRAMESIZE_RAW,'\177',1,sense)))
+     return(ret);
+-  if(p)memcpy(p,d->private->sg_buffer,sectors*CD_FRAMESIZE_RAW);
++  if(p)memcpy(p,d->private_data->sg_buffer,sectors*CD_FRAMESIZE_RAW);
+   return(0);
+ }
+@@ -909,5 +909,5 @@
+   if((ret=handle_scsi_cmd(d,cmd,12,0,sectors * CD_FRAMESIZE_RAW,'\177',1,sense)))
+     return(ret);
+-  if(p)memcpy(p,d->private->sg_buffer,sectors*CD_FRAMESIZE_RAW);
++  if(p)memcpy(p,d->private_data->sg_buffer,sectors*CD_FRAMESIZE_RAW);
+   return(0);
+ }
+@@ -923,5 +923,5 @@
+   if((ret=handle_scsi_cmd(d,cmd,12,0,sectors * CD_FRAMESIZE_RAW,'\177',1,sense)))
+     return(ret);
+-  if(p)memcpy(p,d->private->sg_buffer,sectors*CD_FRAMESIZE_RAW);
++  if(p)memcpy(p,d->private_data->sg_buffer,sectors*CD_FRAMESIZE_RAW);
+   return(0);
+ }
+@@ -937,5 +937,5 @@
+   if((ret=handle_scsi_cmd(d,cmd,12,0,sectors * CD_FRAMESIZE_RAW,'\177',1,sense)))
+     return(ret);
+-  if(p)memcpy(p,d->private->sg_buffer,sectors*CD_FRAMESIZE_RAW);
++  if(p)memcpy(p,d->private_data->sg_buffer,sectors*CD_FRAMESIZE_RAW);
+   return(0);
+ }
+@@ -951,5 +951,5 @@
+   if((ret=handle_scsi_cmd(d,cmd,12,0,sectors * CD_FRAMESIZE_RAW,'\177',1,sense)))
+     return(ret);
+-  if(p)memcpy(p,d->private->sg_buffer,sectors*CD_FRAMESIZE_RAW);
++  if(p)memcpy(p,d->private_data->sg_buffer,sectors*CD_FRAMESIZE_RAW);
+   return(0);
+ }
+@@ -965,5 +965,5 @@
+   if((ret=handle_scsi_cmd(d,cmd,12,0,sectors * CD_FRAMESIZE_RAW,'\177',1,sense)))
+     return(ret);
+-  if(p)memcpy(p,d->private->sg_buffer,sectors*CD_FRAMESIZE_RAW);
++  if(p)memcpy(p,d->private_data->sg_buffer,sectors*CD_FRAMESIZE_RAW);
+   return(0);
+ }
+@@ -979,5 +979,5 @@
+   if((ret=handle_scsi_cmd(d,cmd,12,0,sectors * CD_FRAMESIZE_RAW,'\177',1,sense)))
+     return(ret);
+-  if(p)memcpy(p,d->private->sg_buffer,sectors*CD_FRAMESIZE_RAW);
++  if(p)memcpy(p,d->private_data->sg_buffer,sectors*CD_FRAMESIZE_RAW);
+   return(0);
+ }
+@@ -993,5 +993,5 @@
+   if((ret=handle_scsi_cmd(d,cmd,12,0,sectors * CD_FRAMESIZE_RAW,'\177',1,sense)))
+     return(ret);
+-  if(p)memcpy(p,d->private->sg_buffer,sectors*CD_FRAMESIZE_RAW);
++  if(p)memcpy(p,d->private_data->sg_buffer,sectors*CD_FRAMESIZE_RAW);
+   return(0);
+ }
+@@ -1027,5 +1027,5 @@
+   if((ret=handle_scsi_cmd(d,cmd,12,0,sectors * CD_FRAMESIZE_RAW,'\177',1,sense)))
+     return(ret);
+-  if(p)memcpy(p,d->private->sg_buffer,sectors*CD_FRAMESIZE_RAW);
++  if(p)memcpy(p,d->private_data->sg_buffer,sectors*CD_FRAMESIZE_RAW);
+   return(0);
+ }
+@@ -1040,5 +1040,5 @@
+   if((ret=handle_scsi_cmd(d,cmd,12,0,sectors * CD_FRAMESIZE_RAW,'\177',1,sense)))
+     return(ret);
+-  if(p)memcpy(p,d->private->sg_buffer,sectors*CD_FRAMESIZE_RAW);
++  if(p)memcpy(p,d->private_data->sg_buffer,sectors*CD_FRAMESIZE_RAW);
+   return(0);
+ }
+@@ -1053,5 +1053,5 @@
+   if((ret=handle_scsi_cmd(d,cmd,12,0,sectors * CD_FRAMESIZE_RAW,'\177',1,sense)))
+     return(ret);
+-  if(p)memcpy(p,d->private->sg_buffer,sectors*CD_FRAMESIZE_RAW);
++  if(p)memcpy(p,d->private_data->sg_buffer,sectors*CD_FRAMESIZE_RAW);
+   return(0);
+ }
+@@ -1276,5 +1276,5 @@
+   long i;
+   for(i=2351;i>=0;i--)
+-    if(d->private->sg_buffer[i]!=(unsigned char)'\177')
++    if(d->private_data->sg_buffer[i]!=(unsigned char)'\177')
+       return(((i+3)>>2)<<2);
+ 
+@@ -1285,5 +1285,5 @@
+   long i,flag=0;
+   for(i=0;i<2352;i++)
+-    if(d->private->sg_buffer[i]!=0){
++    if(d->private_data->sg_buffer[i]!=0){
+       flag=1;
+       break;
+@@ -1622,5 +1622,5 @@
+   if(mode_sense(d,22,0x2A)==0){
+   
+-    b=d->private->sg_buffer;
++    b=d->private_data->sg_buffer;
+     b+=b[3]+4;
+     
+@@ -1670,5 +1670,5 @@
+     return(NULL);
+   }
+-  return (d->private->sg_buffer);
++  return (d->private_data->sg_buffer);
+ }
+ 
+@@ -1726,6 +1726,6 @@
+ 
+   d->error_retry=1;
+-  d->private->sg_hd=realloc(d->private->sg_hd,d->nsectors*CD_FRAMESIZE_RAW + SG_OFF + 128);
+-  d->private->sg_buffer=((unsigned char *)d->private->sg_hd)+SG_OFF;
++  d->private_data->sg_hd=realloc(d->private_data->sg_hd,d->nsectors*CD_FRAMESIZE_RAW + SG_OFF + 128);
++  d->private_data->sg_buffer=((unsigned char *)d->private_data->sg_hd)+SG_OFF;
+   d->report_all=1;
+   return(0);
+--- cdparanoia-III-10.2/interface/test_interface.c	(revision 15337)
++++ cdparanoia-III-10.2/interface/test_interface.c	(revision 15338)
+@@ -67,7 +67,7 @@
+ 
+   if(begin<lastread)
+-    d->private->last_milliseconds=20;
++    d->private_data->last_milliseconds=20;
+   else
+-    d->private->last_milliseconds=sectors;
++    d->private_data->last_milliseconds=sectors;
+ 
+ #ifdef CDDA_TEST_UNDERRUN
diff --git a/pkgs/applications/editors/android-studio/default.nix b/pkgs/applications/editors/android-studio/default.nix
index e18235024df4..75385275ec84 100644
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@@ -8,14 +8,14 @@ let
     inherit (gnome2) GConf gnome_vfs;
   };
   stableVersion = {
-    version = "3.1.1.0"; # "Android Studio 3.1.1"
-    build = "173.4697961";
-    sha256Hash = "0xn02miq2hz7666mziza56pfqw9sjflgvn88ds7j5yd4rlcr0lq8";
+    version = "3.1.2.0"; # "Android Studio 3.1.2"
+    build = "173.4720617";
+    sha256Hash = "1h9f4pkyqxkqxampi8v035czg5d4g6lp4bsrnq5mgpwhjwkr1whk";
   };
   latestVersion = {
-    version = "3.2.0.10"; # "Android Studio 3.2 Canary 11"
-    build = "181.4720098";
-    sha256Hash = "00cd7qdznspi69cgs1a13a3fnkvsc7zjfl517jgp32vdygkb0qxw";
+    version = "3.2.0.11"; # "Android Studio 3.2 Canary 12"
+    build = "181.4729833";
+    sha256Hash = "1b976m59d230pl35ajhdic46cw8qmnykkbrg3l7am7zmih0zk64c";
   };
 in rec {
   # Old alias
diff --git a/pkgs/applications/misc/qlcplus/default.nix b/pkgs/applications/misc/qlcplus/default.nix
index e162d0d317f7..2fa4887a0f0f 100644
--- a/pkgs/applications/misc/qlcplus/default.nix
+++ b/pkgs/applications/misc/qlcplus/default.nix
@@ -5,13 +5,13 @@
 
 mkDerivation rec {
   name = "qlcplus-${version}";
-  version = "4.11.1";
+  version = "4.11.2";
 
   src = fetchFromGitHub {
     owner = "mcallegari";
     repo = "qlcplus";
     rev = "QLC+_${version}";
-    sha256 = "0lb1mdp7kbnkja14phgyknr65irwkxcmzk96rqacysvwrvzvfzyd";
+    sha256 = "0ry7j8d5mm3h3mzd49xqlagnldmfhfr6plwk73pz62hxr4j58s6w";
   };
 
   nativeBuildInputs = [ qmake pkgconfig ];
diff --git a/pkgs/applications/misc/urh/default.nix b/pkgs/applications/misc/urh/default.nix
index d2463616d677..fa2f16166446 100644
--- a/pkgs/applications/misc/urh/default.nix
+++ b/pkgs/applications/misc/urh/default.nix
@@ -2,13 +2,13 @@
 
 python3Packages.buildPythonApplication rec {
   name = "urh-${version}";
-  version = "2.0.1";
+  version = "2.0.2";
 
   src = fetchFromGitHub {
     owner = "jopohl";
     repo = "urh";
     rev = "v${version}";
-    sha256 = "0mnnrxm49s77s1qg7zbfciw0525ipsl010sciqdw8a22jg1rfjh8";
+    sha256 = "1qqb31y65rd85rf3gvxxxy06hm89ary00km1ac84qz5bwm6n5fyb";
   };
 
   buildInputs = [ hackrf rtl-sdr ];
diff --git a/pkgs/applications/networking/cluster/spark/default.nix b/pkgs/applications/networking/cluster/spark/default.nix
index 2b36d7c5647a..6401194eac20 100644
--- a/pkgs/applications/networking/cluster/spark/default.nix
+++ b/pkgs/applications/networking/cluster/spark/default.nix
@@ -1,20 +1,16 @@
-{ stdenv, fetchzip, makeWrapper, jre, pythonPackages, coreutils
+{ stdenv, fetchzip, makeWrapper, jre, pythonPackages, coreutils, hadoop
 , RSupport? true, R
 , mesosSupport ? true, mesos
 , version
 }:
 
 let
-  versionMap = {
-    "2.2.1" = {
-                hadoopVersion = "hadoop2.7";
-                sparkSha256 = "10nxsf9a6hj1263sxv0cbdqxdb8mb4cl6iqq32ljq9ydvk32s99c";
-              };
-  };
+  sha256 = {
+    "1.6.3" = "142hw73wf20d846l83ydx0yg7qj5qxywm4h7qrhwnd7lsy2sbnjf";
+    "2.2.1" = "10nxsf9a6hj1263sxv0cbdqxdb8mb4cl6iqq32ljq9ydvk32s99c";
+  }.${version};
 in
 
-with versionMap.${version};
-
 with stdenv.lib;
 
 stdenv.mkDerivation rec {
@@ -22,15 +18,15 @@ stdenv.mkDerivation rec {
   name = "spark-${version}";
 
   src = fetchzip {
-    url    = "mirror://apache/spark/${name}/${name}-bin-${hadoopVersion}.tgz";
-    sha256 = sparkSha256;
+    inherit sha256;
+    url    = "mirror://apache/spark/${name}/${name}-bin-without-hadoop.tgz";
   };
 
   buildInputs = [ makeWrapper jre pythonPackages.python pythonPackages.numpy ]
     ++ optional RSupport R
     ++ optional mesosSupport mesos;
 
-  untarDir = "${name}-bin-${hadoopVersion}";
+  untarDir = "${name}-bin-without-hadoop";
   installPhase = ''
     mkdir -p $out/{lib/${untarDir}/conf,bin,/share/java}
     mv * $out/lib/${untarDir}
@@ -42,6 +38,7 @@ stdenv.mkDerivation rec {
     cat > $out/lib/${untarDir}/conf/spark-env.sh <<- EOF
     export JAVA_HOME="${jre}"
     export SPARK_HOME="$out/lib/${untarDir}"
+    export SPARK_DIST_CLASSPATH=$(${hadoop}/bin/hadoop classpath)
     export PYSPARK_PYTHON="${pythonPackages.python}/bin/${pythonPackages.python.executable}"
     export PYTHONPATH="\$PYTHONPATH:$PYTHONPATH"
     ${optionalString RSupport
@@ -63,7 +60,7 @@ stdenv.mkDerivation rec {
     homepage         = "http://spark.apache.org";
     license          = stdenv.lib.licenses.asl20;
     platforms        = stdenv.lib.platforms.all;
-    maintainers      = with maintainers; [ thoughtpolice offline ];
+    maintainers      = with maintainers; [ thoughtpolice offline kamilchm ];
     repositories.git = git://git.apache.org/spark.git;
   };
 }
diff --git a/pkgs/applications/office/todo.txt-cli/default.nix b/pkgs/applications/office/todo.txt-cli/default.nix
index faecc3f4227b..77a602954438 100644
--- a/pkgs/applications/office/todo.txt-cli/default.nix
+++ b/pkgs/applications/office/todo.txt-cli/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl }:
 let
-  version = "2.10";
+  version = "2.11.0";
 in stdenv.mkDerivation {
   name = "todo.txt-cli-${version}";
 
   src = fetchurl {
     url = "https://github.com/ginatrapani/todo.txt-cli/releases/download/v${version}/todo.txt_cli-${version}.tar.gz";
-    sha256 = "1agn4zzbizrrylvbfi053b5mpb39bvl1gzziw08xibzfdyi1g55m";
+    sha256 = "0majx8lcvhh8ji54qi0sxr833wchdss95fjc92byd8g3lfz27rsz";
   };
 
   installPhase = ''
diff --git a/pkgs/applications/science/math/mathematica/default.nix b/pkgs/applications/science/math/mathematica/default.nix
index 1c86097f2ee4..9b9d5b250ef6 100644
--- a/pkgs/applications/science/math/mathematica/default.nix
+++ b/pkgs/applications/science/math/mathematica/default.nix
@@ -1,7 +1,7 @@
 { stdenv
 , coreutils
 , patchelf
-, requireFile
+, callPackage
 , alsaLib
 , dbus
 , fontconfig
@@ -18,6 +18,7 @@
 , zlib
 , libxml2
 , libuuid
+, lang ? "en"
 }:
 
 let
@@ -26,21 +27,15 @@ let
       "Linux"
     else
       throw "Mathematica requires i686-linux or x86_64 linux";
+
+  l10n =
+    with stdenv.lib;
+    with callPackage ./l10ns.nix {};
+    flip (findFirst (l: l.lang == lang)) l10ns
+      (throw "Language '${lang}' not supported");
 in
 stdenv.mkDerivation rec {
-  version = "11.2.0";
-
-  name = "mathematica-${version}";
-
-  src = requireFile rec {
-    name = "Mathematica_${version}_LINUX.sh";
-    message = '' 
-      This nix expression requires that ${name} is
-      already part of the store. Find the file on your Mathematica CD
-      and add it to the nix store with nix-store --add-fixed sha256 <FILE>.
-    '';
-    sha256 = "4a1293cc1c404303aa1cab1bd273c7be151d37ac5ed928fbbb18e9c5ab2d8df9";
-  };
+  inherit (l10n) version name src;
 
   buildInputs = [
     coreutils
diff --git a/pkgs/applications/science/math/mathematica/l10ns.nix b/pkgs/applications/science/math/mathematica/l10ns.nix
new file mode 100644
index 000000000000..2158021c7548
--- /dev/null
+++ b/pkgs/applications/science/math/mathematica/l10ns.nix
@@ -0,0 +1,33 @@
+{ lib, requireFile }:
+
+with lib;
+{
+  l10ns = flip map
+  [
+    {
+      version = "11.2.0";
+      lang = "en";
+      language = "English";
+      sha256 = "4a1293cc1c404303aa1cab1bd273c7be151d37ac5ed928fbbb18e9c5ab2d8df9";
+    }
+    {
+      version = "11.2.0";
+      lang = "ja";
+      language = "Japanese";
+      sha256 = "916392edd32bed8622238df435dd8e86426bb043038a3336f30df10d819b49b1";
+    }
+  ]
+  ({ version, lang, language, sha256 }: {
+    inherit version lang;
+    name = "mathematica-${version}" + optionalString (lang != "en") "-${lang}";
+    src = requireFile rec {
+      name = "Mathematica_${version}" + optionalString (lang != "en") "_${language}" + "_LINUX.sh";
+      message = ''
+        This nix expression requires that ${name} is
+        already part of the store. Find the file on your Mathematica CD
+        and add it to the nix store with nix-store --add-fixed sha256 <FILE>.
+      '';
+      inherit sha256;
+    };
+  });
+}
diff --git a/pkgs/applications/virtualization/qemu/default.nix b/pkgs/applications/virtualization/qemu/default.nix
index f5cd661fbecb..a10687141615 100644
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@@ -8,7 +8,7 @@
 , seccompSupport ? stdenv.isLinux, libseccomp
 , pulseSupport ? !stdenv.isDarwin, libpulseaudio
 , sdlSupport ? !stdenv.isDarwin, SDL2
-, gtkSupport ? !xenSupport, gtk3, gettext, gnome3
+, gtkSupport ? !stdenv.isDarwin && !xenSupport, gtk3, gettext, gnome3
 , vncSupport ? true, libjpeg, libpng
 , spiceSupport ? !stdenv.isDarwin, spice, spice-protocol
 , usbredirSupport ? spiceSupport, usbredir
@@ -107,6 +107,8 @@ stdenv.mkDerivation rec {
       "--sysconfdir=/etc"
       "--localstatedir=/var"
     ]
+    # disable sysctl check on darwin.
+    ++ optional stdenv.isDarwin "--cpu=x86_64"
     ++ optional numaSupport "--enable-numa"
     ++ optional seccompSupport "--enable-seccomp"
     ++ optional spiceSupport "--enable-spice"
diff --git a/pkgs/development/compilers/ecl/16.1.2.nix b/pkgs/development/compilers/ecl/16.1.2.nix
index 30fee77321f5..291b0ed013d6 100644
--- a/pkgs/development/compilers/ecl/16.1.2.nix
+++ b/pkgs/development/compilers/ecl/16.1.2.nix
@@ -1,10 +1,14 @@
-{stdenv, fetchurl
+{ stdenv, fetchurl, fetchpatch
 , libtool, autoconf, automake
 , gmp, mpfr, libffi, makeWrapper
 , noUnicode ? false
 , gcc
-, threadSupport ? true
+, threadSupport ? false
+, useBoehmgc ? true, boehmgc
 }:
+
+assert useBoehmgc -> boehmgc != null;
+
 let
   s = # Generated upstream information
   rec {
@@ -19,6 +23,9 @@ let
   ];
   propagatedBuildInputs = [
     libffi gmp mpfr gcc
+  ] ++ stdenv.lib.optionals useBoehmgc [
+    # replaces ecl's own gc which other packages can depend on, thus propagated
+    boehmgc
   ];
 in
 stdenv.mkDerivation {
@@ -39,6 +46,15 @@ stdenv.mkDerivation {
       "--enable-unicode")
     ;
 
+  patches = [
+    (fetchpatch {
+      # Avoid infinite loop, see https://gitlab.com/embeddable-common-lisp/ecl/issues/43 (fixed upstream)
+      name = "avoid-infinite-loop.patch";
+      url = "https://gitlab.com/embeddable-common-lisp/ecl/commit/caba1989f40ef917e7486f41b9cd5c7e3c5c2d79.patch";
+      sha256 = "07vw91psbc9gdn8grql46ra8lq3bgkzg5v480chnbryna4sv6lbb";
+    })
+  ];
+
   hardeningDisable = [ "format" ];
 
   postInstall = ''
diff --git a/pkgs/development/compilers/ecl/default.nix b/pkgs/development/compilers/ecl/default.nix
index e506e3aace1f..33ed690772ea 100644
--- a/pkgs/development/compilers/ecl/default.nix
+++ b/pkgs/development/compilers/ecl/default.nix
@@ -4,6 +4,7 @@
 , noUnicode ? false
 , gcc
 , threadSupport ? true
+, useBoehmgc ? false, boehmgc
 }:
 let
   s = # Generated upstream information
@@ -20,6 +21,10 @@ let
   ];
   propagatedBuildInputs = [
     libffi gmp mpfr gcc
+    # replaces ecl's own gc which other packages can depend on, thus propagated
+  ] ++ stdenv.lib.optionals useBoehmgc [
+    # replaces ecl's own gc which other packages can depend on, thus propagated
+    boehmgc
   ];
 in
 stdenv.mkDerivation {
@@ -53,6 +58,7 @@ stdenv.mkDerivation {
   meta = {
     inherit (s) version;
     description = "Lisp implementation aiming to be small, fast and easy to embed";
+    homepage = https://common-lisp.net/project/ecl/;
     license = stdenv.lib.licenses.mit ;
     maintainers = [stdenv.lib.maintainers.raskin];
     platforms = stdenv.lib.platforms.linux;
diff --git a/pkgs/development/libraries/fflas-ffpack/default.nix b/pkgs/development/libraries/fflas-ffpack/default.nix
index edea352ae2dd..5f99f35a1599 100644
--- a/pkgs/development/libraries/fflas-ffpack/default.nix
+++ b/pkgs/development/libraries/fflas-ffpack/default.nix
@@ -1,4 +1,7 @@
-{stdenv, fetchFromGitHub, autoreconfHook, givaro, pkgconfig, openblas, liblapack}:
+{ stdenv, fetchFromGitHub, autoreconfHook, givaro, pkgconfig, openblas
+, gmpxx
+, optimize ? false # impure
+}:
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
   pname = "fflas-ffpack";
@@ -9,9 +12,31 @@ stdenv.mkDerivation rec {
     rev = "v${version}";
     sha256 = "1cqhassj2dny3gx0iywvmnpq8ca0d6m82xl5rz4mb8gaxr2kwddl";
   };
-  nativeBuildInputs = [ autoreconfHook pkgconfig ];
-  buildInputs = [ givaro (liblapack.override {shared = true;}) openblas];
-  configureFlags = "--with-blas-libs=-lopenblas --with-lapack-libs=-llapack";
+  checkInputs = [
+    gmpxx
+  ];
+  nativeBuildInputs = [
+    autoreconfHook
+    pkgconfig
+  ] ++ stdenv.lib.optionals doCheck checkInputs;
+  buildInputs = [ givaro openblas];
+  configureFlags = [
+    "--with-blas-libs=-lopenblas"
+    "--with-lapack-libs=-lopenblas"
+  ] ++ stdenv.lib.optionals (!optimize) [
+    # disable SIMD instructions (which are enabled *when available* by default)
+    "--disable-sse"
+    "--disable-sse2"
+    "--disable-sse3"
+    "--disable-ssse3"
+    "--disable-sse41"
+    "--disable-sse42"
+    "--disable-avx"
+    "--disable-avx2"
+    "--disable-fma"
+    "--disable-fma4"
+  ];
+  doCheck = true;
   meta = {
     inherit version;
     description = ''Finite Field Linear Algebra Subroutines'';
diff --git a/pkgs/development/libraries/gstreamer/base/default.nix b/pkgs/development/libraries/gstreamer/base/default.nix
index b3a4f445289e..39cf57ec5258 100644
--- a/pkgs/development/libraries/gstreamer/base/default.nix
+++ b/pkgs/development/libraries/gstreamer/base/default.nix
@@ -1,17 +1,22 @@
-{ stdenv, fetchurl, fetchpatch, pkgconfig, meson
-, ninja, gettext, gobjectIntrospection, python
-, gstreamer, orc, alsaLib, libXv, pango, libtheora
-, wayland, cdparanoia, libvisual, libintl
-}:
+{ stdenv, fetchurl, fetchpatch, lib
+, pkgconfig, meson, ninja, gettext, gobjectIntrospection
+, python, gstreamer, orc, pango, libtheora, libvisual
+, libintl
+, enableX11 ? stdenv.isLinux, libXv
+, enableWayland ? stdenv.isLinux, wayland
+, enableAlsa ? stdenv.isLinux, alsaLib
+, enableCocoa ? false, darwin
+, enableCdparanoia ? (!stdenv.isDarwin), cdparanoia }:
 
 stdenv.mkDerivation rec {
   name = "gst-plugins-base-1.14.0";
 
-  meta = {
+  meta = with lib; {
     description = "Base plugins and helper libraries";
     homepage = https://gstreamer.freedesktop.org;
-    license = stdenv.lib.licenses.lgpl2Plus;
-    platforms = stdenv.lib.platforms.unix;
+    license = licenses.lgpl2Plus;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ matthewbauer ];
   };
 
   src = fetchurl {
@@ -21,19 +26,32 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" ];
 
-  nativeBuildInputs = [
-    pkgconfig python meson ninja gettext gobjectIntrospection
-  ];
+  nativeBuildInputs = [ pkgconfig python gettext gobjectIntrospection ]
+
+  # Broken meson with Darwin. Should hopefully be fixed soon. Tracking
+  # in https://bugzilla.gnome.org/show_bug.cgi?id=781148.
+  ++ lib.optionals (!stdenv.isDarwin) [ meson ninja ];
 
-  buildInputs = [
-    orc libXv pango libtheora cdparanoia libintl wayland
+  # TODO How to pass these to Meson?
+  configureFlags = [
+    "--enable-x11=${if enableX11 then "yes" else "no"}"
+    "--enable-wayland=${if enableWayland then "yes" else "no"}"
+    "--enable-cocoa=${if enableCocoa then "yes" else "no"}"
   ]
-  ++ stdenv.lib.optional stdenv.isLinux alsaLib
-  ++ stdenv.lib.optional (!stdenv.isDarwin) libvisual;
+
+  # Introspection fails on my MacBook currently
+  ++ lib.optional stdenv.isDarwin "--disable-introspection";
+
+  buildInputs = [ orc libtheora libintl ]
+    ++ lib.optional enableAlsa alsaLib
+    ++ lib.optionals enableX11 [ libXv pango ]
+    ++ lib.optional enableWayland wayland
+    ++ lib.optional enableCocoa darwin.apple_sdk.frameworks.Cocoa
+    ++ lib.optional enableCdparanoia cdparanoia;
 
   propagatedBuildInputs = [ gstreamer ];
 
-  preConfigure = ''
+  postPatch = ''
     patchShebangs .
   '';
 
diff --git a/pkgs/development/libraries/gstreamer/core/default.nix b/pkgs/development/libraries/gstreamer/core/default.nix
index ab3f78767a1c..5845c8c50db2 100644
--- a/pkgs/development/libraries/gstreamer/core/default.nix
+++ b/pkgs/development/libraries/gstreamer/core/default.nix
@@ -2,17 +2,18 @@
 , pkgconfig, gettext, gobjectIntrospection
 , bison, flex, python3, glib, makeWrapper
 , libcap,libunwind, darwin
+, lib
 }:
 
 stdenv.mkDerivation rec {
   name = "gstreamer-1.14.0";
 
-  meta = {
+  meta = with lib ;{
     description = "Open source multimedia framework";
     homepage = https://gstreamer.freedesktop.org;
-    license = stdenv.lib.licenses.lgpl2Plus;
-    platforms = stdenv.lib.platforms.unix;
-    maintainers = [ stdenv.lib.maintainers.ttuegel ];
+    license = licenses.lgpl2Plus;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ ttuegel matthewbauer ];
   };
 
   src = fetchurl {
@@ -20,7 +21,7 @@ stdenv.mkDerivation rec {
     sha256 = "0vj6k01lp2yva6rfd95fkyng9jdr62gkz0x8d2l81dyly1ki6dpw";
   };
 
-  patches = [ 
+  patches = [
     (fetchpatch {
         url = "https://bug794856.bugzilla-attachments.gnome.org/attachment.cgi?id=370411";
         sha256 = "16plzzmkk906k4892zq68j3c9z8vdma5nxzlviq20jfv04ykhmk2";
@@ -34,7 +35,9 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     meson ninja pkgconfig gettext bison flex python3 makeWrapper gobjectIntrospection
   ];
-  buildInputs = [ libcap libunwind ] ++ stdenv.lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.CoreServices;
+  buildInputs =
+       lib.optionals stdenv.isLinux [ libcap libunwind ]
+    ++ lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.CoreServices;
 
   propagatedBuildInputs = [ glib ];
 
diff --git a/pkgs/development/libraries/linbox/default.nix b/pkgs/development/libraries/linbox/default.nix
new file mode 100644
index 000000000000..0f5442bd63b6
--- /dev/null
+++ b/pkgs/development/libraries/linbox/default.nix
@@ -0,0 +1,79 @@
+{ stdenv
+, fetchFromGitHub
+, fetchpatch
+, autoreconfHook
+, givaro
+, pkgconfig
+, openblas
+, liblapack
+, fflas-ffpack
+, gmpxx
+, optimize ? false # impure
+, withSage ? false # sage support
+}:
+stdenv.mkDerivation rec {
+  name = "${pname}-${version}";
+  pname = "linbox";
+  version = "1.5.2";
+
+  src = fetchFromGitHub {
+    owner = "linbox-team";
+    repo = "${pname}";
+    rev = "v${version}";
+    sha256 = "1wfivlwp30mzdy1697w7rzb8caajim50mc8h27k82yipn2qc5n4i";
+  };
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkgconfig
+  ];
+
+  buildInputs = [
+    givaro
+    (liblapack.override {shared = true;})
+    openblas
+    gmpxx
+    fflas-ffpack
+  ];
+
+  configureFlags = [
+    "--with-blas-libs=-lopenblas"
+    "--with-lapack-libs=-llapack"
+    "--disable-optimization"
+  ] ++ stdenv.lib.optionals (!optimize) [
+    # disable SIMD instructions (which are enabled *when available* by default)
+    "--disable-sse"
+    "--disable-sse2"
+    "--disable-sse3"
+    "--disable-ssse3"
+    "--disable-sse41"
+    "--disable-sse42"
+    "--disable-avx"
+    "--disable-avx2"
+    "--disable-fma"
+    "--disable-fma4"
+  ] ++ stdenv.lib.optionals withSage [
+    "--enable-sage"
+  ];
+
+  patches = stdenv.lib.optionals withSage [
+    # https://trac.sagemath.org/ticket/24214#comment:39
+    # Will be resolved by
+    # https://github.com/linbox-team/linbox/issues/69
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/sagemath/sage/a843f48b7a4267e44895a3dfa892c89c85b85611/build/pkgs/linbox/patches/linbox_charpoly_fullCRA.patch";
+      sha256 = "16nxfzfknra3k2yk3xy0k8cq9rmnmsch3dnkb03kx15h0y0jmibk";
+    })
+  ];
+
+  doCheck = true;
+
+  meta = {
+    inherit version;
+    description = "C++ library for exact, high-performance linear algebra";
+    license = stdenv.lib.licenses.lgpl21Plus;
+    maintainers = [stdenv.lib.maintainers.timokau];
+    platforms = stdenv.lib.platforms.linux;
+    homepage = http://linalg.org/;
+  };
+}
diff --git a/pkgs/development/libraries/oniguruma/default.nix b/pkgs/development/libraries/oniguruma/default.nix
index 3989ab42468d..f9a75801e101 100644
--- a/pkgs/development/libraries/oniguruma/default.nix
+++ b/pkgs/development/libraries/oniguruma/default.nix
@@ -13,16 +13,11 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
 
-  prePatch = stdenv.lib.optional stdenv.isDarwin ''
-    substituteInPlace cmake/dist.cmake \
-      --replace '@executable_path/''${UP_DIR}/''${INSTALL_LIB}' $out'/''${INSTALL_LIB}'
-  '';
-
-  meta = {
+  meta = with stdenv.lib; {
     homepage = https://github.com/kkos/oniguruma;
     description = "Regular expressions library";
-    license = stdenv.lib.licenses.bsd2;
-    maintainers = with stdenv.lib.maintainers; [ fuuzetsu ];
-    platforms = with stdenv.lib.platforms; unix;
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ fuuzetsu ];
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/rocksdb/default.nix b/pkgs/development/libraries/rocksdb/default.nix
index bb0faf76be69..bb36d942a69b 100644
--- a/pkgs/development/libraries/rocksdb/default.nix
+++ b/pkgs/development/libraries/rocksdb/default.nix
@@ -19,7 +19,7 @@ let
 in
 stdenv.mkDerivation rec {
   name = "rocksdb-${version}";
-  version = "5.10.3";
+  version = "5.11.3";
 
   outputs = [ "dev" "out" "static" "bin" ];
 
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     owner = "facebook";
     repo = "rocksdb";
     rev = "v${version}";
-    sha256 = "19d8i8map8qz639mhflmxc0w9gp78fvkq1l46y5s6b5imwh0w7xq";
+    sha256 = "15x2r7aib1xinwcchl32wghs8g96k4q5xgv6z97mxgp35475x01p";
   };
 
   nativeBuildInputs = [ which perl ];
diff --git a/pkgs/development/libraries/science/math/rankwidth/default.nix b/pkgs/development/libraries/science/math/rankwidth/default.nix
new file mode 100644
index 000000000000..f38fce5831ee
--- /dev/null
+++ b/pkgs/development/libraries/science/math/rankwidth/default.nix
@@ -0,0 +1,28 @@
+{ stdenv
+, fetchurl
+}:
+
+stdenv.mkDerivation rec {
+  pname = "rankwidth";
+  version = "0.7";
+  name = "${pname}-${version}";
+
+  src = fetchurl {
+    url = "http://mirrors.mit.edu/sage/spkg/upstream/rw/rw-${version}.tar.gz";
+    sha256 = "1rv2v42x2506x7f10349m1wpmmfxrv9l032bkminni2gbip9cjg0";
+  };
+
+  configureFlags = [
+    "--enable-executable=no" # no igraph dependency
+  ];
+
+  # check phase is empty for now (as of version 0.7)
+  doCheck = true;
+
+  meta = with stdenv.lib; {
+    description = "Calculates rank-width and rank-decompositions";
+    license = with licenses; [ gpl2Plus ];
+    maintainers = with maintainers; [ timokau ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/development/python-modules/faulthandler/default.nix b/pkgs/development/python-modules/faulthandler/default.nix
index 1fc1aea94d57..a05ac1ba679e 100644
--- a/pkgs/development/python-modules/faulthandler/default.nix
+++ b/pkgs/development/python-modules/faulthandler/default.nix
@@ -2,24 +2,13 @@
 
 buildPythonPackage rec {
   pname = "faulthandler";
-  version = "3.0";
+  version = "3.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "acc10e10909f0f956ba1b42b6c450ea0bdaaa27b3942899f65931396cfcdd36a";
+    sha256 = "83301ffab03c86b291677b64b5cec7026f412cbda5ebd27e4cb3338452c40021";
   };
 
-  patches = [
-    (fetchpatch {
-      url = https://github.com/vstinner/faulthandler/commit/67b661e.patch;
-      sha256 = "1nn8c9nq5qypja949hzz0n4yprsyr63wihf5g3gwrinm2nkjnnv7";
-    })
-    (fetchpatch {
-      url = https://github.com/vstinner/faulthandler/commit/07cbb7b.patch;
-      sha256 = "0fh6rjyjw7z1hsiy3sgdc8j9mncg1vlv3y0h4bplqyw18vq3srb3";
-    })
-  ];
-
   meta = {
     description = "Dump the Python traceback";
     license = stdenv.lib.licenses.bsd2;
diff --git a/pkgs/development/python-modules/flask-autoindex/default.nix b/pkgs/development/python-modules/flask-autoindex/default.nix
new file mode 100644
index 000000000000..397d1e03ee82
--- /dev/null
+++ b/pkgs/development/python-modules/flask-autoindex/default.nix
@@ -0,0 +1,44 @@
+{ stdenv
+, buildPythonPackage
+, fetchpatch
+, fetchPypi
+, flask
+, flask-silk
+, future
+}:
+
+buildPythonPackage rec {
+  pname = "Flask-AutoIndex";
+  version = "0.6";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "19b10mb1nrqfjyafki6wnrbn8mqi30bbyyiyvp5xssc74pciyfqs";
+  };
+
+  propagatedBuildInputs = [
+    flask
+    flask-silk
+    future
+  ];
+
+  patches = [
+    # fix generated binary, see https://github.com/sublee/flask-autoindex/pull/32
+    (fetchpatch {
+      name = "fix_binary.patch";
+      url = "https://github.com/sublee/flask-autoindex/pull/32.patch";
+      sha256 = "1v2r0wvi7prhipjq89774svv6aqj0a13mdfj07pdlkpzfbf029dn";
+    })
+  ];
+
+  meta = with stdenv.lib; {
+    description = "The mod_autoindex for Flask";
+    longDescription = ''
+      Flask-AutoIndex generates an index page for your Flask application automatically.
+      The result is just like mod_autoindex, but the look is more awesome!
+    '';
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ timokau ];
+    homepage = http://pythonhosted.org/Flask-AutoIndex/;
+  };
+}
diff --git a/pkgs/development/python-modules/milksnake/default.nix b/pkgs/development/python-modules/milksnake/default.nix
new file mode 100644
index 000000000000..014bb223225d
--- /dev/null
+++ b/pkgs/development/python-modules/milksnake/default.nix
@@ -0,0 +1,26 @@
+{ lib, buildPythonPackage, fetchPypi, cffi }:
+
+buildPythonPackage rec {
+  pname = "milksnake";
+  version = "0.1.5";
+
+  src = fetchPypi {
+    inherit pname version;
+    extension = "zip";
+    sha256 = "120nprd8lqis7x7zy72536gk2j68f7gxm8gffmx8k4ygifvl7kfz";
+  };
+
+  propagatedBuildInputs = [
+   cffi
+  ];
+
+  # tests rely on pip/venv
+  doCheck = false;
+
+  meta = with lib; {
+    description = "A python library that extends setuptools for binary extensions";
+    homepage = https://github.com/getsentry/milksnake;
+    license = licenses.asl20;
+    maintainers = with maintainers; [ matthiasbeyer ];
+  };
+}
diff --git a/pkgs/development/tools/build-managers/buildbot/default.nix b/pkgs/development/tools/build-managers/buildbot/default.nix
index 3e994227ef05..98adaf1c1aa1 100644
--- a/pkgs/development/tools/build-managers/buildbot/default.nix
+++ b/pkgs/development/tools/build-managers/buildbot/default.nix
@@ -14,11 +14,11 @@ let
   package = pythonPackages.buildPythonApplication rec {
     name = "${pname}-${version}";
     pname = "buildbot";
-    version = "1.0.0";
+    version = "1.1.0";
 
     src = pythonPackages.fetchPypi {
       inherit pname version;
-      sha256 = "0y7gpymxl09gd9dyqj7zqhaihpl9da1v8ppxi4r161ywd8jv9b1g";
+      sha256 = "1rhmlcvw0dsr4f37sb3xmb9xcn76lsrsw2g1z611g339nmxzi0sc";
     };
 
     buildInputs = with pythonPackages; [
diff --git a/pkgs/misc/drivers/sc-controller/default.nix b/pkgs/misc/drivers/sc-controller/default.nix
index 93e8ffbc3ca8..d4ed749ca9cc 100644
--- a/pkgs/misc/drivers/sc-controller/default.nix
+++ b/pkgs/misc/drivers/sc-controller/default.nix
@@ -7,13 +7,13 @@
 
 buildPythonApplication rec {
   pname = "sc-controller";
-  version = "0.4.1";
+  version = "0.4.2";
 
   src = fetchFromGitHub {
     owner  = "kozec";
     repo   = pname;
     rev    = "v${version}";
-    sha256 = "0zal8sl3j17gqmynig8jhqrhj7zfqql8vci4whn19gymchwjalzi";
+    sha256 = "19i9z5cjjgi3a94hrz5g3a6m4vj71p1gs6mhklc6dq8ydwsadwzz";
   };
 
   nativeBuildInputs = [ wrapGAppsHook ];
diff --git a/pkgs/servers/foundationdb/default.nix b/pkgs/servers/foundationdb/default.nix
new file mode 100644
index 000000000000..95326b4c1c6c
--- /dev/null
+++ b/pkgs/servers/foundationdb/default.nix
@@ -0,0 +1,99 @@
+{ stdenv, fetchurl, fetchFromGitHub
+, which, findutils, m4, gawk, python, openjdk, mono58, libressl_2_6
+}:
+
+let
+  version = "5.1.7";
+  branch  = "release-5.1";
+  rev     = "9ad8d02386d4a6a5efecf898df80f2747695c627";
+  sha256  = "1rc472ih24f9s5g3xmnlp3v62w206ny0pvvw02bzpix2sdrpbp06";
+
+  # hysterical raisins dictate a version of boost this old. however,
+  # we luckily do not need to build anything, we just need the header
+  # files.
+  boost152 = stdenv.mkDerivation rec {
+    name = "boost-headers-1.52.0";
+
+    src = fetchurl {
+      url = "mirror://sourceforge/boost/boost_1_52_0.tar.bz2";
+      sha256 = "14mc7gsnnahdjaxbbslzk79rc0d12h1i681cd3srdwr3fzynlar2";
+    };
+
+    buildPhase = ":";
+    configurePhase = ":";
+    installPhase = ''
+      mkdir -p $out/include/
+      cp -R boost $out/include/
+    '';
+  };
+
+in stdenv.mkDerivation rec {
+  name = "foundationdb-${version}";
+  inherit version;
+
+  src = fetchFromGitHub {
+    owner = "apple";
+    repo  = "foundationdb";
+    inherit rev sha256;
+  };
+
+  nativeBuildInputs = [ gawk which m4 findutils boost152 mono58 ];
+  buildInputs = [ python openjdk libressl_2_6 ];
+
+  patches =
+    [ ./fix-scm-version.patch
+      ./ldflags.patch
+    ];
+
+  postPatch = ''
+    substituteInPlace ./build/scver.mk \
+      --subst-var-by NIXOS_FDB_VERSION_ID "${rev}" \
+      --subst-var-by NIXOS_FDB_SCBRANCH   "${branch}"
+
+    substituteInPlace ./Makefile \
+      --replace 'shell which ccache' 'shell true' \
+      --replace -Werror ""
+
+    substituteInPlace ./Makefile \
+      --replace libstdc++_pic libstdc++
+
+    substituteInPlace ./build/link-validate.sh \
+      --replace 'exit 1' '#exit 1'
+
+    patchShebangs .
+  '';
+
+  enableParallelBuilding = true;
+  makeFlags = [ "all" "fdb_c" "KVRELEASE=1" ];
+
+  configurePhase = ":";
+  installPhase = ''
+    mkdir -vp $out/{bin,libexec/plugins} $lib/lib $dev/include/foundationdb
+
+    cp -v ./lib/libfdb_c.so     $lib/lib
+    cp -v ./lib/libFDBLibTLS.so $out/libexec/plugins/FDBLibTLS.so
+
+    cp -v ./bindings/c/foundationdb/fdb_c.h           $dev/include/foundationdb
+    cp -v ./bindings/c/foundationdb/fdb_c_options.g.h $dev/include/foundationdb
+
+    for x in fdbbackup fdbcli fdbserver fdbmonitor; do
+      cp -v "./bin/$x" $out/bin;
+    done
+
+    ln -sfv $out/bin/fdbbackup $out/bin/dr_agent
+    ln -sfv $out/bin/fdbbackup $out/bin/fdbrestore
+    ln -sfv $out/bin/fdbbackup $out/bin/fdbdr
+
+    ln -sfv $out/bin/fdbbackup $out/libexec/backup_agent
+  '';
+
+  outputs = [ "out" "lib" "dev" ];
+
+  meta = with stdenv.lib; {
+    description = "Open source, distributed, transactional key-value store";
+    homepage    = https://www.foundationdb.org;
+    license     = licenses.asl20;
+    platforms   = platforms.linux;
+    maintainers = with maintainers; [ thoughtpolice ];
+  };
+}
diff --git a/pkgs/servers/foundationdb/fix-scm-version.patch b/pkgs/servers/foundationdb/fix-scm-version.patch
new file mode 100644
index 000000000000..0e0df7ade82b
--- /dev/null
+++ b/pkgs/servers/foundationdb/fix-scm-version.patch
@@ -0,0 +1,42 @@
+diff --git a/build/scver.mk b/build/scver.mk
+index bdae8be..7539864 100644
+--- a/build/scver.mk
++++ b/build/scver.mk
+@@ -98,33 +98,10 @@ endif
+ GITPRESENT := $(wildcard $(FDBDIR)/.git)
+ HGPRESENT := $(wildcard $(FDBDIR)/.hg)
+ 
+-# Use Git, if not missing
+-ifneq ($(GITPRESENT),)
+-	SCVER := $(shell cd "$(FDBDIR)" && git --version 2>/dev/null)
+-	ifneq ($(SCVER),)
+-		VERSION_ID := $(shell cd "$(FDBDIR)" && git rev-parse --verify HEAD)
+-		SOURCE_CONTROL := GIT
+-		SCBRANCH := $(shell cd "$(FDBDIR)" && git rev-parse --abbrev-ref HEAD)
+-	else
+-$(error Missing git executable on $(PLATFORM) )
+-	endif
+-# Otherwise, use Mercurial
+-else
+-	# Otherwise, use Mercurial, if not missing
+-	ifneq ($(HGPRESENT),)
+-		SCVER := $(shell cd "$(FDBDIR)" && hg --version 2>/dev/null)
+-		ifdef SCVER
+-			VERSION_ID := $(shell cd "$(FDBDIR)" && hg id -n)
+-			SOURCE_CONTROL := MERCURIAL
+-			SCBRANCH := $(shell cd "$(FDBDIR)" && hg branch)
+-		else
+-$(error Missing hg executable on $(PLATFORM))
+-		endif
+-	else
+-	FDBFILES := (shell ls -la $(FDBDIR))
+-$(error Missing source control information for source on $(PLATFORM) in directory: $(FDBDIR) with files: $(FDBFILES))
+-	endif
+-endif
++# NixOS-specific non-VCS packaging, filled out by the nix build
++SOURCE_CONTROL := GIT
++VERSION_ID     := @NIXOS_FDB_VERSION_ID@
++SCBRANCH       := @NIXOS_FDB_SCBRANCH@
+ 
+ # Set the RELEASE variable based on the KVRELEASE variable.
+ ifeq ($(KVRELEASE),1)
diff --git a/pkgs/servers/foundationdb/ldflags.patch b/pkgs/servers/foundationdb/ldflags.patch
new file mode 100644
index 000000000000..4d523a7ecdd3
--- /dev/null
+++ b/pkgs/servers/foundationdb/ldflags.patch
@@ -0,0 +1,90 @@
+diff --git a/FDBLibTLS/local.mk b/FDBLibTLS/local.mk
+index 0b6eac8..b1891ca 100644
+--- a/FDBLibTLS/local.mk
++++ b/FDBLibTLS/local.mk
+@@ -1,6 +1,5 @@
+ FDBLibTLS_CFLAGS := -fPIC -I/usr/local/include -I$(BOOSTDIR)
+-FDBLibTLS_STATIC_LIBS := -ltls -lssl -lcrypto
+-FDBLibTLS_LDFLAGS := -L/usr/local/lib -static-libstdc++ -static-libgcc -lrt
++FDBLibTLS_LDFLAGS := -L/usr/local/lib -static-libstdc++ -static-libgcc -lrt -ltls -lssl -lcrypto
+ FDBLibTLS_LDFLAGS += -Wl,-soname,FDBLibTLS.so -Wl,--version-script=FDBLibTLS/FDBLibTLS.map
+ 
+ # The plugin isn't a typical library, so it feels more sensible to have a copy
+diff --git a/bindings/c/local.mk b/bindings/c/local.mk
+index 44f0c31..7aea5a4 100644
+--- a/bindings/c/local.mk
++++ b/bindings/c/local.mk
+@@ -29,8 +29,8 @@ fdb_c_tests_HEADERS := -Ibindings/c
+ CLEAN_TARGETS += fdb_c_tests_clean
+ 
+ ifeq ($(PLATFORM),linux)
+-  fdb_c_LIBS += lib/libstdc++.a -lm -lpthread -lrt -ldl
+-  fdb_c_LDFLAGS += -Wl,--version-script=bindings/c/fdb_c.map -static-libgcc -Wl,-z,nodelete
++  fdb_c_LIBS += lib/libstdc++.a
++  fdb_c_LDFLAGS += -Wl,--version-script=bindings/c/fdb_c.map -static-libgcc -Wl,-z,nodelete -lm -lpthread -lrt -ldl
+   fdb_c_tests_LIBS += -lpthread
+ endif
+ 
+diff --git a/bindings/flow/tester/local.mk b/bindings/flow/tester/local.mk
+index 2ef4fcb..6e59625 100644
+--- a/bindings/flow/tester/local.mk
++++ b/bindings/flow/tester/local.mk
+@@ -35,8 +35,7 @@ _fdb_flow_tester_clean:
+ 	@rm -rf bindings/flow/bin
+ 
+ ifeq ($(PLATFORM),linux)
+-  fdb_flow_tester_LIBS += -ldl -lpthread -lrt
+-  fdb_flow_tester_LDFLAGS += -static-libstdc++ -static-libgcc
++  fdb_flow_tester_LDFLAGS += -static-libstdc++ -static-libgcc -ldl -lpthread -lrt
+ else ifeq ($(PLATFORM),osx)
+   fdb_flow_tester_LDFLAGS += -lc++
+ endif
+diff --git a/fdbbackup/local.mk b/fdbbackup/local.mk
+index 033fe7d..865fc92 100644
+--- a/fdbbackup/local.mk
++++ b/fdbbackup/local.mk
+@@ -25,8 +25,7 @@ fdbbackup_LDFLAGS := $(fdbrpc_LDFLAGS)
+ fdbbackup_LIBS := lib/libfdbclient.a lib/libfdbrpc.a lib/libflow.a
+ 
+ ifeq ($(PLATFORM),linux)
+-  fdbbackup_LIBS += -ldl -lpthread -lrt
+-  fdbbackup_LDFLAGS += -static-libstdc++ -static-libgcc
++  fdbbackup_LDFLAGS += -static-libstdc++ -static-libgcc -ldl -lpthread -lrt
+ 
+   # GPerfTools profiler (uncomment to use)
+   # fdbbackup_CFLAGS += -I/opt/gperftools/include -DUSE_GPERFTOOLS=1
+diff --git a/fdbcli/local.mk b/fdbcli/local.mk
+index 81a4a42..892c079 100644
+--- a/fdbcli/local.mk
++++ b/fdbcli/local.mk
+@@ -22,14 +22,13 @@
+ 
+ fdbcli_CFLAGS := $(fdbclient_CFLAGS)
+ fdbcli_LDFLAGS := $(fdbrpc_LDFLAGS)
+-fdbcli_LIBS := lib/libfdbclient.a lib/libfdbrpc.a lib/libflow.a -ldl
++fdbcli_LIBS := lib/libfdbclient.a lib/libfdbrpc.a lib/libflow.a
+ fdbcli_STATIC_LIBS :=
+ 
+ fdbcli_GENERATED_SOURCES += versions.h
+ 
+ ifeq ($(PLATFORM),linux)
+-  fdbcli_LDFLAGS += -static-libstdc++ -static-libgcc
+-  fdbcli_LIBS += -lpthread -lrt
++  fdbcli_LDFLAGS += -static-libstdc++ -static-libgcc -lpthread -lrt -ldl
+ else ifeq ($(PLATFORM),osx)
+   fdbcli_LDFLAGS += -lc++
+ endif
+diff --git a/fdbserver/local.mk b/fdbserver/local.mk
+index 78cad1b..36f2c0f 100644
+--- a/fdbserver/local.mk
++++ b/fdbserver/local.mk
+@@ -25,8 +25,7 @@ fdbserver_LDFLAGS := $(fdbrpc_LDFLAGS)
+ fdbserver_LIBS := lib/libfdbclient.a lib/libfdbrpc.a lib/libflow.a
+ 
+ ifeq ($(PLATFORM),linux)
+-  fdbserver_LIBS += -ldl -lpthread -lrt
+-  fdbserver_LDFLAGS += -static-libstdc++ -static-libgcc
++  fdbserver_LDFLAGS += -static-libstdc++ -static-libgcc -ldl -lpthread -lrt
+ 
+   # GPerfTools profiler (uncomment to use)
+   # fdbserver_CFLAGS += -I/opt/gperftools/include -DUSE_GPERFTOOLS=1
diff --git a/pkgs/servers/jackett/default.nix b/pkgs/servers/jackett/default.nix
index 34d242b92a8a..f2d38111d5d2 100644
--- a/pkgs/servers/jackett/default.nix
+++ b/pkgs/servers/jackett/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "jackett-${version}";
-  version = "0.8.823";
+  version = "0.8.886";
 
   src = fetchurl {
     url = "https://github.com/Jackett/Jackett/releases/download/v${version}/Jackett.Binaries.Mono.tar.gz";
-    sha256 = "0hicz21dvcakqkxix70akc3rrz570j3g0a512pqrr3bdq7ay0dkk";
+    sha256 = "18agnavhch29pi1w6vp374cs6bz2j7bf55mh4ym0cs038h5xkdvv";
   };
 
   buildInputs = [ makeWrapper ];
diff --git a/pkgs/servers/sabnzbd/default.nix b/pkgs/servers/sabnzbd/default.nix
index d46f5677b9f0..1b5a8c24424a 100644
--- a/pkgs/servers/sabnzbd/default.nix
+++ b/pkgs/servers/sabnzbd/default.nix
@@ -4,7 +4,7 @@ let
   pythonEnv = python2.withPackages(ps: with ps; [ cryptography cheetah yenc ]);
   path = stdenv.lib.makeBinPath [ par2cmdline unrar unzip p7zip ];
 in stdenv.mkDerivation rec {
-  version = "2.3.2";
+  version = "2.3.3";
   pname = "sabnzbd";
   name = "${pname}-${version}";
 
@@ -12,7 +12,7 @@ in stdenv.mkDerivation rec {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "0c0ap8bygvz643fgfvvmwshcyfblq2c5jziqwgpf30g6rsbfv2v0";
+    sha256 = "0za4xjc4x44f7i30r86bbza3zppid333ifwzp5h526w3zak1lal8";
   };
 
   buildInputs = [ pythonEnv makeWrapper ];
diff --git a/pkgs/tools/misc/ipxe/default.nix b/pkgs/tools/misc/ipxe/default.nix
index 786b3992a5cc..d34ccaa4b9e9 100644
--- a/pkgs/tools/misc/ipxe/default.nix
+++ b/pkgs/tools/misc/ipxe/default.nix
@@ -3,8 +3,8 @@
 }:
 
 let
-  date = "20170922";
-  rev = "74d90b33f8490adcee2026ece18d8411d93b6a39";
+  date = "20180220";
+  rev = "47849be3a900c546cf92066849be0806f4e611d9";
 in
 
 stdenv.mkDerivation {
@@ -14,7 +14,7 @@ stdenv.mkDerivation {
 
   src = fetchgit {
     url = git://git.ipxe.org/ipxe.git;
-    sha256 = "12ijrq451fj2x3i7c7xjlxig5mwbhmgzqjvmfl2sza953vfbk4vw";
+    sha256 = "1f4pi1dp2zqnrbfnggnzycfvrxv0bqgw73dxbyy3hfy4mhdj6z45";
     inherit rev;
   };
 
@@ -26,6 +26,7 @@ stdenv.mkDerivation {
   makeFlags =
     [ "ECHO_E_BIN_ECHO=echo" "ECHO_E_BIN_ECHO_E=echo" # No /bin/echo here.
       "ISOLINUX_BIN_LIST=${syslinux}/share/syslinux/isolinux.bin"
+      "LDLINUX_C32=${syslinux}/share/syslinux/ldlinux.c32"
     ] ++ lib.optional (embedScript != null) "EMBED=${embedScript}";
 
 
@@ -34,6 +35,7 @@ stdenv.mkDerivation {
   configurePhase = ''
     runHook preConfigure
     for opt in $enabledOptions; do echo "#define $opt" >> src/config/general.h; done
+    sed -i '/cp \''${ISOLINUX_BIN}/s/$/ --no-preserve=mode/' src/util/geniso
     runHook postConfigure
   '';
 
diff --git a/pkgs/tools/misc/powerline-go/default.nix b/pkgs/tools/misc/powerline-go/default.nix
index 4e465e7ea1ca..e31c0da6306a 100644
--- a/pkgs/tools/misc/powerline-go/default.nix
+++ b/pkgs/tools/misc/powerline-go/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "powerline-go";
-  version = "1.8.2";
+  version = "1.10.0";
   name = "${pname}-${version}";
   rev = "v${version}";
 
@@ -12,7 +12,7 @@ buildGoPackage rec {
     owner = "justjanne";
     repo = pname;
     inherit rev;
-    sha256 = "1q45hxbrnx0mgi7z1rqkxp47dk8yf4mzy62i0027fhr65aifq6xj";
+    sha256 = "1bmgim61cx6i4m24a474nm3w4zqjflm0wnw3y24299n9dj14izs3";
   };
 
   goDeps = ./deps.nix;
diff --git a/pkgs/tools/misc/powerline-go/deps.nix b/pkgs/tools/misc/powerline-go/deps.nix
index a3276ab229bb..78e28efb3b10 100644
--- a/pkgs/tools/misc/powerline-go/deps.nix
+++ b/pkgs/tools/misc/powerline-go/deps.nix
@@ -5,8 +5,17 @@
     fetch = {
       type = "git";
       url = "https://github.com/mattn/go-runewidth";
-      rev = "a9d6d1e4dc51df2130326793d49971f238839169";
-      sha256 = "1x6x5r6ijik5ardfrpncjbqvpv8j5m7yb94svzz83a15ln44ajmg";
+      rev = "ce7b0b5c7b45a81508558cd1dba6bb1e4ddb51bb";
+      sha256 = "0lc39b6xrxv7h3v3y1kgz49cgi5qxwlygs715aam6ba35m48yi7g";
+    };
+  }
+  {
+    goPackagePath = "github.com/shirou/gopsutil";
+    fetch = {
+      type = "git";
+      url = "https://github.com/shirou/gopsutil";
+      rev = "63047d776e07105e370af46ecbd0ae96850f5ef2";
+      sha256 = "0204f0gx3fd8ya6rb478a7a4gr2v4i3m71148iv3jrdfvr5q5aaw";
     };
   }
   {
@@ -14,8 +23,8 @@
     fetch = {
       type = "git";
       url = "https://go.googlesource.com/crypto";
-      rev = "91a49db82a88618983a78a06c1cbd4e00ab749ab";
-      sha256 = "1xb4vlshx76xany4w60dkpz67plyfk7nr97pinf1bbha32pi36jc";
+      rev = "2b6c08872f4b66da917bb4ce98df4f0307330f78";
+      sha256 = "07wgdhs7ac3qmx0lfr4zazg2l159jqbwmn7jx49rr9811vivl1yh";
     };
   }
   {
@@ -23,8 +32,8 @@
     fetch = {
       type = "git";
       url = "https://go.googlesource.com/sys";
-      rev = "dd2ff4accc098aceecb86b36eaa7829b2a17b1c9";
-      sha256 = "086j1kk56vm1m5m9sf3lcww9phqw6p2q3g0is1jn4ixfxd3wm2wg";
+      rev = "79b0c6888797020a994db17c8510466c72fe75d9";
+      sha256 = "0aydjw886c4dwcjg7ssb7xp39ag1529nh3ly1la71rqjr94cjnag";
     };
   }
   {
@@ -32,8 +41,8 @@
     fetch = {
       type = "git";
       url = "https://go.googlesource.com/text";
-      rev = "b7ef84aaf62aa3e70962625c80a571ae7c17cb40";
-      sha256 = "0xfb515f3bmcq15sq1cm641qwgsmq1w5xjdx2mhwgns770jngndd";
+      rev = "7922cc490dd5a7dbaa7fd5d6196b49db59ac042f";
+      sha256 = "06sicjc24hv7v9p1l6psaq87w4lycx3mjixd6gsd1wnd4jhqvlnr";
     };
   }
   {
@@ -41,8 +50,8 @@
     fetch = {
       type = "git";
       url = "https://gopkg.in/yaml.v2";
-      rev = "7f97868eec74b32b0982dd158a51a446d1da7eb5";
-      sha256 = "0a31jd1p00b9c82f3sfsbv2bdh7mlfy9vhcqxipll2cyvxplgfq8";
+      rev = "5420a8b6744d3b0345ab293f6fcba19c978f1183";
+      sha256 = "0dwjrs2lp2gdlscs7bsrmyc5yf6mm4fvgw71bzr9mv2qrd2q73s1";
     };
   }
 ]
diff --git a/pkgs/tools/misc/vdirsyncer/default.nix b/pkgs/tools/misc/vdirsyncer/default.nix
index 9d1e4096776a..9e9ded5c3a76 100644
--- a/pkgs/tools/misc/vdirsyncer/default.nix
+++ b/pkgs/tools/misc/vdirsyncer/default.nix
@@ -1,18 +1,30 @@
-{ stdenv, fetchurl, python3Packages, glibcLocales }:
+{ stdenv, python3Packages, glibcLocales, rustPlatform }:
 
 # Packaging documentation at:
 # https://github.com/untitaker/vdirsyncer/blob/master/docs/packaging.rst
 let
   pythonPackages = python3Packages;
-in
-pythonPackages.buildPythonApplication rec {
-  version = "0.16.4";
-  name = "vdirsyncer-${version}";
-
-  src = fetchurl {
-    url = "mirror://pypi/v/vdirsyncer/${name}.tar.gz";
-    sha256 = "03wva48bgv1ad3df6plc9b8xxh6k8bcaxrhlzwh81c9mzn5bspzv";
+  version = "0.17.0a2";
+  pname = "vdirsyncer";
+  name = pname + "-" + version;
+  src = pythonPackages.fetchPypi {
+    inherit pname version;
+    sha256 = "0y464rsx5la6bp94z2g0nnkbl4nwfya08abynvifw4c84vs1gr4q";
   };
+  native = rustPlatform.buildRustPackage {
+    name = name + "-native";
+    inherit src;
+    sourceRoot = name + "/rust";
+    cargoSha256 = "1cr7xs11gbsc3x5slga9qahchwc22qq49amf28g4jgs9lzf57qis";
+    postInstall = ''
+      mkdir $out/include $out/lib
+      cp $out/bin/libvdirsyncer_rustext* $out/lib
+      rm -r $out/bin
+      cp target/vdirsyncer_rustext.h $out/include
+    '';
+  };
+in pythonPackages.buildPythonApplication rec {
+  inherit version pname src;
 
   propagatedBuildInputs = with pythonPackages; [
     click click-log click-threading
@@ -20,14 +32,33 @@ pythonPackages.buildPythonApplication rec {
     requests
     requests_oauthlib # required for google oauth sync
     atomicwrites
+    milksnake
   ];
 
-  buildInputs = with pythonPackages; [hypothesis pytest pytest-localserver pytest-subtesthack setuptools_scm ] ++ [ glibcLocales ];
+  buildInputs = with pythonPackages; [ setuptools_scm ];
+
+  checkInputs = with pythonPackages; [ hypothesis pytest pytest-localserver pytest-subtesthack ] ++ [ glibcLocales ];
+
+  postPatch = ''
+    sed -i "/cargo build/d" Makefile
+  '';
+
+  preBuild = ''
+    mkdir -p rust/target/release
+    ln -s ${native}/lib/libvdirsyncer_rustext* rust/target/release/
+    ln -s ${native}/include/vdirsyncer_rustext.h rust/target/
+  '';
 
   LC_ALL = "en_US.utf8";
 
+  preCheck = ''
+    ln -sf ../dist/tmpbuild/vdirsyncer/vdirsyncer/_native__lib.so vdirsyncer
+  '';
+
   checkPhase = ''
+    runHook preCheck
     make DETERMINISTIC_TESTS=true test
+    runHook postCheck
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/virtualization/google-compute-engine/default.nix b/pkgs/tools/virtualization/google-compute-engine/default.nix
index a923d73c03e4..3645de88bf8a 100644
--- a/pkgs/tools/virtualization/google-compute-engine/default.nix
+++ b/pkgs/tools/virtualization/google-compute-engine/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonApplication rec {
   name = "google-compute-engine-${version}";
-  version = "20170914";
+  version = "20180129";
   namePrefix = "";
 
   src = fetchFromGitHub {
     owner = "GoogleCloudPlatform";
     repo = "compute-image-packages";
     rev = version;
-    sha256 = "0hlzcrf6yhzan25f4wzy1vbncak9whhqzrzza026ly3sq0smmjpg";
+    sha256 = "0380fnr64109hv8l1f3sgdg8a5mf020axj7jh8y25xq6wzkjm20c";
   };
 
   postPatch = ''
@@ -52,5 +52,6 @@ buildPythonApplication rec {
     homepage = "https://github.com/GoogleCloudPlatform/compute-image-packages";
     license = licenses.asl20;
     maintainers = with maintainers; [ zimbatm ];
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 35e320dc31fc..946be093765d 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2409,6 +2409,8 @@ with pkgs;
 
   fuseiso = callPackage ../tools/filesystems/fuseiso { };
 
+  foundationdb = callPackage ../servers/foundationdb { stdenv = overrideCC stdenv gcc49; };
+
   fuse-7z-ng = callPackage ../tools/filesystems/fuse-7z-ng { };
 
   fwknop = callPackage ../tools/security/fwknop { };
@@ -8788,6 +8790,7 @@ with pkgs;
 
   fflas-ffpack = callPackage ../development/libraries/fflas-ffpack {};
   fflas-ffpack_1 = callPackage ../development/libraries/fflas-ffpack/1.nix {};
+  linbox = callPackage ../development/libraries/linbox {};
 
   ffmpeg_0_10 = callPackage ../development/libraries/ffmpeg/0.10.nix {
     inherit (darwin.apple_sdk.frameworks) Cocoa;
@@ -19902,6 +19905,8 @@ with pkgs;
 
   planarity = callPackage ../development/libraries/science/math/planarity { };
 
+  rankwidth = callPackage ../development/libraries/science/math/rankwidth { };
+
   fenics = callPackage ../development/libraries/science/math/fenics {
     inherit (python3Packages) numpy ply pytest python six sympy;
     pythonPackages = python3Packages;
diff --git a/pkgs/top-level/haskell-packages.nix b/pkgs/top-level/haskell-packages.nix
index f9cd2eb94337..48980e48f1d4 100644
--- a/pkgs/top-level/haskell-packages.nix
+++ b/pkgs/top-level/haskell-packages.nix
@@ -19,7 +19,10 @@ let
     inherit pkgs;
   };
 
-  callPackage = newScope { inherit haskellLib; };
+  callPackage = newScope {
+    inherit haskellLib;
+    overrides = pkgs.haskell.packageOverrides;
+  };
 
   bootstrapPackageSet = self: super: {
     mkDerivation = drv: super.mkDerivation (drv // {
@@ -99,6 +102,9 @@ in rec {
       (name: compiler."${name}".override { enableIntegerSimple = true; }));
   };
 
+  # Default overrides that are applied to all package sets.
+  packageOverrides = self : super : {};
+
   # Always get compilers from `buildPackages`
   packages = let bh = buildPackages.haskell; in {
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 5b1877875344..127e4ac9c0e6 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5533,6 +5533,8 @@ in {
 
   flask_assets = callPackage ../development/python-modules/flask-assets { };
 
+  flask-autoindex = callPackage ../development/python-modules/flask-autoindex { };
+
   flask-babel = callPackage ../development/python-modules/flask-babel { };
 
   flask_cache = buildPythonPackage rec {
@@ -7640,6 +7642,8 @@ in {
 
   micawber = callPackage ../development/python-modules/micawber { };
 
+  milksnake = callPackage ../development/python-modules/milksnake { };
+
   minimock = buildPythonPackage rec {
     version = "1.2.8";
     name = "minimock-${version}";
diff --git a/pkgs/top-level/release.nix b/pkgs/top-level/release.nix
index aee73f206696..3ea873cdc7ff 100644
--- a/pkgs/top-level/release.nix
+++ b/pkgs/top-level/release.nix
@@ -101,6 +101,9 @@ let
               jobs.git.x86_64-darwin
               jobs.mysql.x86_64-darwin
               jobs.vim.x86_64-darwin
+              # Ensure that UI stuff works on darwin
+              jobs.inkscape.x86_64-darwin
+              jobs.qt5.qtmultimedia.x86_64-darwin
 
               jobs.tests.cc-wrapper.x86_64-linux
               jobs.tests.cc-wrapper.x86_64-darwin