From 2ff488c267a873ba583d0bafbb27b166eea53893 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sat, 27 May 2017 17:22:11 +0200
Subject: [PATCH 01/33] python.pkgs.django_hijack

Get rid of overriding inside the fixed-point combinator. Overriding
versions inside the set causes trouble when combining packages.
---
 pkgs/top-level/python-packages.nix | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 0cc9820f4c12..39eb87853975 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -10193,6 +10193,9 @@ in {
     };
   };
 
+  # This package likely needs an older version of Django.
+  # Override the package set and set e.g. `django = super.django_1_9`.
+  # See the Nixpkgs manual for examples on how to override the package set.
   django_hijack = buildPythonPackage rec {
     name = "django-hijack-${version}";
     version = "2.0.7";
@@ -10202,12 +10205,7 @@ in {
       sha256 = "0rpi1bkfx74xfbb2nk874kfdra1jcqp2vzky1r3z7zidlc9kah04";
     };
 
-    # TODO improve the that multi-override necessity (the fixpoint based python
-    # packages work can be the solution)
-    propagatedBuildInputs = with self; [ django_1_9 (django_compat.override {
-      django = django_1_9;
-      django_nose = django_nose.override { propagatedBuildInputs = [django_1_9 nose]; };
-    }) ];
+    propagatedBuildInputs = with self; [ django django_compat ];
 
     meta = {
       description = "Allows superusers to hijack (=login as) and work on behalf of another user";

From 19c298e97328ee78e639682ec195ce3e820d8387 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Niklas=20Hamb=C3=BCchen?= <mail@nh2.me>
Date: Sat, 27 May 2017 17:31:25 +0200
Subject: [PATCH 02/33] tinc: Mention in docs that the host name may not be
 used verbatim. (#26157)

* tinc: Mention in docs that the host name may not be used verbatim.

Source:

  https://github.com/gsliepen/tinc/blob/5c344f297682cf11793407fca4547968aee22d95/src/net_setup.c#L341

* tinc: also replaces non-alphanumeric characters.
---
 nixos/modules/services/networking/tinc.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/networking/tinc.nix b/nixos/modules/services/networking/tinc.nix
index 6cb40185274d..79a0aa953feb 100644
--- a/nixos/modules/services/networking/tinc.nix
+++ b/nixos/modules/services/networking/tinc.nix
@@ -35,7 +35,8 @@ in
               description = ''
                 The name of the node which is used as an identifier when communicating
                 with the remote nodes in the mesh. If null then the hostname of the system
-                is used.
+                is used to derive a name (note that tinc may replace non-alphanumeric characters in
+                hostnames by underscores).
               '';
             };
 

From 6de69a2425446035af7b589809de5fd2f3e637dd Mon Sep 17 00:00:00 2001
From: montag451 <montag451@laposte.net>
Date: Sat, 27 May 2017 17:42:48 +0200
Subject: [PATCH 03/33] simpleproxy: init at 3.5

---
 pkgs/tools/networking/simpleproxy/default.nix | 21 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  2 ++
 2 files changed, 23 insertions(+)
 create mode 100644 pkgs/tools/networking/simpleproxy/default.nix

diff --git a/pkgs/tools/networking/simpleproxy/default.nix b/pkgs/tools/networking/simpleproxy/default.nix
new file mode 100644
index 000000000000..476e7dc229df
--- /dev/null
+++ b/pkgs/tools/networking/simpleproxy/default.nix
@@ -0,0 +1,21 @@
+{ stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  name = "simpleproxy-${version}";
+  version = "3.5";
+  rev = "v.${version}";
+
+  src = fetchFromGitHub {
+    inherit rev;
+    owner = "vzaliva";
+    repo = "simpleproxy";
+    sha256 = "1my9g4vp19dikx3fsbii4ichid1bs9b9in46bkg05gbljhj340f6";
+  };
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/vzaliva/simpleproxy;
+    description = "A simple TCP proxy";
+    license = licenses.gpl2;
+    maintainers = [ maintainers.montag451 ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 23a4bc112452..72bbb30fc6fb 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4056,6 +4056,8 @@ with pkgs;
   silver-searcher = callPackage ../tools/text/silver-searcher { };
   ag = self.silver-searcher;
 
+  simpleproxy = callPackage ../tools/networking/simpleproxy { };
+
   simplescreenrecorder = callPackage ../applications/video/simplescreenrecorder { };
 
   sipsak = callPackage ../tools/networking/sipsak { };

From 476086929af70ed022c79fdc5cced15e502ee2b8 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Fri, 26 May 2017 08:41:58 +0200
Subject: [PATCH 04/33] python.pkgs.urllib3: disable tests

because there are transient failures too often.
---
 pkgs/top-level/python-packages.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 39eb87853975..3732556bfad2 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -6295,6 +6295,8 @@ in {
       nosetests -v --cover-min-percentage 1
     '';
 
+    doCheck = false;
+
     buildInputs = with self; [ coverage tornado mock nose psutil pysocks ];
 
     meta = {

From 0916c26ed6aa7bda09399c8fc8fd444204ccfa59 Mon Sep 17 00:00:00 2001
From: Ryan Trinkle <ryan.trinkle@gmail.com>
Date: Sat, 27 May 2017 16:17:35 -0400
Subject: [PATCH 05/33] symlinkJoin: eliminate lndir spam

By default lndir outputs the name of each subdirectory as it descends into it; this commit gives it the -silent flag to disable this behavior
---
 pkgs/build-support/trivial-builders.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/build-support/trivial-builders.nix b/pkgs/build-support/trivial-builders.nix
index 1529869aa331..4debd9636396 100644
--- a/pkgs/build-support/trivial-builders.nix
+++ b/pkgs/build-support/trivial-builders.nix
@@ -71,7 +71,7 @@ rec {
       ''
         mkdir -p $out
         for i in $paths; do
-          ${lndir}/bin/lndir $i $out
+          ${lndir}/bin/lndir -silent $i $out
         done
         ${postBuild}
       '';

From a50315d7365ebb54fb59c2e409ae49ae608012bd Mon Sep 17 00:00:00 2001
From: Joachim Fasting <joachifm@fastmail.fm>
Date: Sat, 27 May 2017 23:20:32 +0200
Subject: [PATCH 06/33] tinycc: 0.9.27pre-20170225 -> 0.9.27pre-20170527

Contains fixes for the x86_64 codegen [1]

[1]: https://lists.nongnu.org/archive/html/tinycc-devel/2017-05/msg00102.html
---
 pkgs/development/compilers/tinycc/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/compilers/tinycc/default.nix b/pkgs/development/compilers/tinycc/default.nix
index dfbbaa4d4310..fcad6045dbfb 100644
--- a/pkgs/development/compilers/tinycc/default.nix
+++ b/pkgs/development/compilers/tinycc/default.nix
@@ -2,10 +2,10 @@
 with stdenv.lib;
 
 let
-  date = "20170225";
+  date = "20170527";
   version = "0.9.27pre-${date}";
-  rev = "bb93064d7857d887b674999c9b4152b44a628f9a";
-  sha256 = "12wcahj1x4qy9ia931i23lvwkqjmyhaks3wipnzvbnlnc2b03kpr";
+  rev = "53c5fc2246270e0242903de0152a9a5d40f3d679";
+  sha256 = "0z5ayz0kdn5xqm84k730hmd7r9cq0zxxf45g5phgqppdfajrmswz";
 in
 
 stdenv.mkDerivation rec {

From 1f89ba117c0a0bb84178499aebb7868dc85e35e1 Mon Sep 17 00:00:00 2001
From: Samuel Dionne-Riel <samuel@dionne-riel.com>
Date: Sat, 27 May 2017 22:39:16 -0400
Subject: [PATCH 07/33] ibus-m17n: fix homepage URL.

The URL was erroneous.
---
 pkgs/tools/inputmethods/ibus-engines/ibus-m17n/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/tools/inputmethods/ibus-engines/ibus-m17n/default.nix b/pkgs/tools/inputmethods/ibus-engines/ibus-m17n/default.nix
index 2d25e6bf4304..c53f766cb7d3 100644
--- a/pkgs/tools/inputmethods/ibus-engines/ibus-m17n/default.nix
+++ b/pkgs/tools/inputmethods/ibus-engines/ibus-m17n/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     isIbusEngine = true;
     description  = "m17n engine for ibus";
-    homepage     = https://github.com.com/ibus/ibus-m17n;
+    homepage     = https://github.com/ibus/ibus-m17n;
     license      = licenses.gpl2;
     platforms    = platforms.linux;
     maintainers  = with maintainers; [ ericsagnes ];

From 636ce2dfdbb145e7b966d1b4f9cb9ce4b91d96db Mon Sep 17 00:00:00 2001
From: Johannes Barthelmes <jbarthelmes95@gmail.com>
Date: Fri, 26 May 2017 03:41:43 +0200
Subject: [PATCH 08/33] factorio: 0.15.1 -> 0.15.16

---
 pkgs/games/factorio/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/games/factorio/default.nix b/pkgs/games/factorio/default.nix
index f0de56b09538..861a44fea8c5 100644
--- a/pkgs/games/factorio/default.nix
+++ b/pkgs/games/factorio/default.nix
@@ -10,7 +10,7 @@ assert releaseType == "alpha" || releaseType == "headless" || releaseType == "de
 
 with stdenv.lib;
 let
-  version = if releaseType != "demo" then "0.15.1" else "0.14.23";
+  version = if releaseType != "demo" then "0.15.16" else "0.14.23";
 
   arch = if stdenv.system == "x86_64-linux" then {
     inUrl = "linux64";
@@ -27,8 +27,8 @@ let
     url = "https://www.factorio.com/get-download/${version}/${releaseType}/${arch.inUrl}";
     name = "factorio_${releaseType}_${arch.inTar}-${version}.${extension}";
     x64 = {
-      headless =           fetchurl { inherit name url; sha256 = "1z84a9yzlld6fv53viwvswp52hlc9fkxzhb2pil7sidzkws3g49l"; };
-      alpha    = authenticatedFetch { inherit name url; sha256 = "11bxasghrhqb2yg1842v1608x3mjdjv3015jgifpv1xmcqak44jp"; };
+      headless =           fetchurl { inherit name url; sha256 = "0ig0nrvqllb9294qn2ci5j5s31ycsjn23bp6hc633xqkgfmklmic"; };
+      alpha    = authenticatedFetch { inherit name url; sha256 = "0bf0z6fi0cpbq487hz4sz8ljapchzhld01sj767wsldakjfkm9g9"; };
       demo     =           fetchurl { inherit name url; sha256 = "10a2lwmspqviwgymn3zhjgpiynsa6dplgnikdirma5sl2hhcfb6s"; };
     };
     i386 = {

From b27a2667db0b2b2b2546f1c2d5bdcc78e13132d3 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 28 May 2017 08:34:46 +0200
Subject: [PATCH 09/33] python.pkgs.hypothesis fixup

---
 pkgs/development/python-modules/hypothesis.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/hypothesis.nix b/pkgs/development/python-modules/hypothesis.nix
index 0927c703fbfd..b9f95d1a0313 100644
--- a/pkgs/development/python-modules/hypothesis.nix
+++ b/pkgs/development/python-modules/hypothesis.nix
@@ -28,6 +28,7 @@ buildPythonPackage rec {
 
   # https://github.com/DRMacIver/hypothesis/issues/300
   checkPhase = ''
+    rm tox.ini # This file changes how py.test runs and breaks it
     py.test tests/cover
   '';
 

From d0f2361bc1ffdff631fc7ebb9c2ec1b08b135898 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 28 May 2017 10:08:10 +0200
Subject: [PATCH 10/33] python.pkgs.simplejson: 3.8.1 -> 3.10.0

---
 .../python-modules/simplejson/default.nix     | 28 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            | 25 +----------------
 2 files changed, 29 insertions(+), 24 deletions(-)
 create mode 100644 pkgs/development/python-modules/simplejson/default.nix

diff --git a/pkgs/development/python-modules/simplejson/default.nix b/pkgs/development/python-modules/simplejson/default.nix
new file mode 100644
index 000000000000..983d17655215
--- /dev/null
+++ b/pkgs/development/python-modules/simplejson/default.nix
@@ -0,0 +1,28 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+}:
+
+buildPythonPackage rec {
+  pname = "simplejson";
+  version = "3.10.0";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "953be622e88323c6f43fad61ffd05bebe73b9fd9863a46d68b052d2aa7d71ce2";
+  };
+
+  meta = {
+    description = "A simple, fast, extensible JSON encoder/decoder for Python";
+    longDescription = ''
+      simplejson is compatible with Python 2.4 and later with no
+      external dependencies.  It covers the full JSON specification
+      for both encoding and decoding, with unicode support.  By
+      default, encoding is done in an encoding neutral fashion (plain
+      ASCII with \uXXXX escapes for unicode characters).
+    '';
+    homepage = http://code.google.com/p/simplejson/;
+    license = lib.licenses.mit;
+  };
+}
\ No newline at end of file
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 3732556bfad2..3f5b20a62d62 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -22775,30 +22775,7 @@ in {
     };
   };
 
-  simplejson = buildPythonPackage (rec {
-    name = "simplejson-3.8.1";
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/s/simplejson/${name}.tar.gz";
-      sha256 = "14r4l4rcsyf87p2j4ycsbb017n4vzxfmv285rq2gny4w47rwi2j2";
-    };
-
-    meta = {
-      description = "A simple, fast, extensible JSON encoder/decoder for Python";
-
-      longDescription = ''
-        simplejson is compatible with Python 2.4 and later with no
-        external dependencies.  It covers the full JSON specification
-        for both encoding and decoding, with unicode support.  By
-        default, encoding is done in an encoding neutral fashion (plain
-        ASCII with \uXXXX escapes for unicode characters).
-      '';
-
-      homepage = http://code.google.com/p/simplejson/;
-
-      license = licenses.mit;
-    };
-  });
+  simplejson = callPackage ../development/python-modules/simplejson { };
 
   simpleldap = buildPythonPackage rec {
     version = "0.8";

From 3a3aab58fceac5d783d843b68526798a8f465619 Mon Sep 17 00:00:00 2001
From: Kranium Gikos Mendoza <kranium@gikos.net>
Date: Sun, 28 May 2017 23:29:29 +1000
Subject: [PATCH 11/33] mod_auth_mellon: 0.12.0 -> 0.13.1

---
 pkgs/servers/http/apache-modules/mod_auth_mellon/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/http/apache-modules/mod_auth_mellon/default.nix b/pkgs/servers/http/apache-modules/mod_auth_mellon/default.nix
index 67648f9d4f2c..a99f081b24eb 100644
--- a/pkgs/servers/http/apache-modules/mod_auth_mellon/default.nix
+++ b/pkgs/servers/http/apache-modules/mod_auth_mellon/default.nix
@@ -3,13 +3,13 @@
 stdenv.mkDerivation rec {
 
   name = "mod_auth_mellon-${version}";
-  version = "0.12.0";
+  version = "0.13.1";
 
   src = fetchFromGitHub {
     owner = "UNINETT";
     repo = "mod_auth_mellon";
     rev = "v${version}";
-    sha256 = "1p6v6vgrfvgvc5y2ygqyyxi0klpm3nxaw3fg35zmpmw663w8skqn";
+    sha256 = "16b43y5a5p8g1287x04rv923230cy8dfs2j18cx6208n4bv4dvnk";
   };
 
   patches = [

From a3bc7ec0f09759c4eb69948bacc1b471936ba826 Mon Sep 17 00:00:00 2001
From: Kranium Gikos Mendoza <kranium@gikos.net>
Date: Sun, 28 May 2017 23:59:59 +1000
Subject: [PATCH 12/33] pick: 1.4.0 -> 1.6.1

---
 pkgs/tools/misc/pick/default.nix | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/misc/pick/default.nix b/pkgs/tools/misc/pick/default.nix
index a407a85d1a20..075949f47e1a 100644
--- a/pkgs/tools/misc/pick/default.nix
+++ b/pkgs/tools/misc/pick/default.nix
@@ -2,19 +2,23 @@
 
 stdenv.mkDerivation rec {
   name = "pick-${version}";
-  version = "1.4.0";
+  version = "1.6.1";
 
   src = fetchFromGitHub {
     owner = "thoughtbot";
     repo = "pick";
     rev = "v${version}";
-    sha256 = "113if0jh7svwrwrxhrsbi7h1whfr5707v2ny4dc9kk2sjbv6b9pg";
+    sha256 = "0iw3yqwg8j0pg56xx52xwn7n95vxlqbqh71zrc934v4mq971qlhd";
   };
 
   buildInputs = [ ncurses ];
 
   nativeBuildInputs = [ autoreconfHook ];
 
+  postPatch = ''
+    sed -i -e 's/\[curses]/\[ncurses]/g' configure.ac
+  '';
+
   meta = with stdenv.lib; {
     inherit (src.meta) homepage;
     description = "Fuzzy text selection utility";

From 157b5bd1f0ce284bc258c5442e98f56ff65829da Mon Sep 17 00:00:00 2001
From: Joachim Fasting <joachifm@fastmail.fm>
Date: Sun, 28 May 2017 00:59:35 +0200
Subject: [PATCH 13/33] cppcheck: 1.78 -> 1.79

ChangeLog: https://sourceforge.net/p/cppcheck/news/2017/05/cppcheck-179/
---
 pkgs/development/tools/analysis/cppcheck/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/analysis/cppcheck/default.nix b/pkgs/development/tools/analysis/cppcheck/default.nix
index a394105faf4b..ce9ca76a43b2 100644
--- a/pkgs/development/tools/analysis/cppcheck/default.nix
+++ b/pkgs/development/tools/analysis/cppcheck/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "cppcheck";
-  version = "1.78";
+  version = "1.79";
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "mirror://sourceforge/${pname}/${name}.tar.bz2";
-    sha256 = "1cc60y2vjq4g88183jkan91ybzqy0n6p5ncs8z5rh6rjsvvrc9p4";
+    sha256 = "0vgh4zx191d7mcmiilkhcbd9jkspfkppl7l4y5451walvs9vd19b";
   };
 
   buildInputs = [ pcre ];

From cce8dbf8d3f48182125b7112f2e8e57ccacc50fc Mon Sep 17 00:00:00 2001
From: montag451 <montag451@laposte.net>
Date: Sun, 28 May 2017 18:16:00 +0200
Subject: [PATCH 14/33] git-annex-remote-rclone: 0.4 -> 0.5

---
 .../git-and-tools/git-annex-remote-rclone/default.nix         | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/version-management/git-and-tools/git-annex-remote-rclone/default.nix b/pkgs/applications/version-management/git-and-tools/git-annex-remote-rclone/default.nix
index d1996b72154d..d38529e92e60 100644
--- a/pkgs/applications/version-management/git-and-tools/git-annex-remote-rclone/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-annex-remote-rclone/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   name = "git-annex-remote-rclone-${version}";
-  version = "0.4";
+  version = "0.5";
   rev = "v${version}";
 
   src = fetchFromGitHub {
     inherit rev;
     owner = "DanielDent";
     repo = "git-annex-remote-rclone";
-    sha256 = "1myk307hqm8dlxhkmwr347rdd28niv5h0gyrxm30y77zlly30ddk";
+    sha256 = "1353b6q3lnxhpdfy9yd2af65v7aypdhyvgn7ziksmsrbi12lb74i";
   };
 
   nativeBuildInputs = [ makeWrapper ];

From 6ecb92a3c346a0bd29fcea2b2d04ddde6417e4e9 Mon Sep 17 00:00:00 2001
From: Marius Bergmann <marius@yeai.de>
Date: Sun, 28 May 2017 18:33:22 +0200
Subject: [PATCH 15/33] cfssl: init at 20170527

---
 pkgs/tools/security/cfssl/default.nix | 23 +++++++++++++++++++++++
 pkgs/top-level/all-packages.nix       |  2 ++
 2 files changed, 25 insertions(+)
 create mode 100644 pkgs/tools/security/cfssl/default.nix

diff --git a/pkgs/tools/security/cfssl/default.nix b/pkgs/tools/security/cfssl/default.nix
new file mode 100644
index 000000000000..91a5fa4bdd24
--- /dev/null
+++ b/pkgs/tools/security/cfssl/default.nix
@@ -0,0 +1,23 @@
+{ stdenv, lib, buildGoPackage, fetchFromGitHub, pkgs }:
+
+buildGoPackage rec {
+  name = "cfssl-${version}";
+  version = "20170527";
+
+  goPackagePath = "github.com/cloudflare/cfssl";
+
+  src = fetchFromGitHub {
+    owner = "cloudflare";
+    repo = "cfssl";
+    rev = "114dc9691ec7bf3dac49d5953eccf7d91a0e0904";
+    sha256 = "1ijq43mrzrf1gkgj5ssxq7sgy6sd4rl706dzqkq9krqv5f6kwhj1";
+  };
+
+  meta = with stdenv.lib; {
+    homepage = https://cfssl.org/;
+    description = "Cloudflare's PKI and TLS toolkit";
+    platforms = platforms.linux;
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ mbrgm ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 9cd3199a1d5a..b08a42198e1a 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1386,6 +1386,8 @@ with pkgs;
 
   c14 = callPackage ../applications/networking/c14 { };
 
+  cfssl = callPackage ../tools/security/cfssl { };
+
   checkbashisms = callPackage ../development/tools/misc/checkbashisms { };
 
   clamav = callPackage ../tools/security/clamav { };

From aee5fa2f4817c04e2169010ec7c52f9210eaa89c Mon Sep 17 00:00:00 2001
From: Pascal Wittmann <mail@pascal-wittmann.de>
Date: Sun, 28 May 2017 20:00:07 +0200
Subject: [PATCH 16/33] moreutils: 0.59 -> 0.61

---
 pkgs/tools/misc/moreutils/default.nix | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/pkgs/tools/misc/moreutils/default.nix b/pkgs/tools/misc/moreutils/default.nix
index a232028976dc..51ac3249fed8 100644
--- a/pkgs/tools/misc/moreutils/default.nix
+++ b/pkgs/tools/misc/moreutils/default.nix
@@ -1,13 +1,14 @@
-{ stdenv, fetchurl, libxml2, libxslt, docbook-xsl, docbook_xml_dtd_44, perl, IPCRun, TimeDate, TimeDuration, makeWrapper }:
+{ stdenv, fetchgit, libxml2, libxslt, docbook-xsl, docbook_xml_dtd_44, perl, IPCRun, TimeDate, TimeDuration, makeWrapper }:
 
 with stdenv.lib;
 stdenv.mkDerivation rec {
   name = "moreutils-${version}";
-  version = "0.59";
+  version = "0.61";
 
-  src = fetchurl {
-    url = "http://ftp.de.debian.org/debian/pool/main/m/moreutils/moreutils_${version}.orig.tar.gz";
-    sha256 = "1d6ik3j4lwp90vb93p7yv60k6vk2chz448d1z9xrmxvv371i33m4";
+  src = fetchgit {
+    url = "git://git.joeyh.name/moreutils";
+    rev = "refs/tags/${version}";
+    sha256 = "1qvwlq0a2zs7qkjqc9c842979axkjfdr7nic1gsm4zc6jd72y7pr";
   };
 
   preBuild = ''
@@ -25,7 +26,7 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Growing collection of the unix tools that nobody thought to write long ago when unix was young";
     homepage = https://joeyh.name/code/moreutils/;
-    maintainers = with maintainers; [ koral ];
+    maintainers = with maintainers; [ koral pSub ];
     platforms = platforms.all;
   };
 }

From 2262f892302a86ca413f6be9f0630d008f908784 Mon Sep 17 00:00:00 2001
From: Joachim Fasting <joachifm@fastmail.fm>
Date: Sun, 28 May 2017 20:06:19 +0200
Subject: [PATCH 17/33] tor-browser-bundle-bin: additional download urls

To better support users that are unable to access the official Tor
distribution site, e.g., https://github.com/NixOS/nixpkgs/issues/26184
---
 .../browsers/tor-browser-bundle-bin/default.nix       | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
index 4443c8480663..2c9661c36fa5 100644
--- a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
+++ b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
@@ -87,12 +87,18 @@ let
 
   srcs = {
     "x86_64-linux" = fetchurl {
-      url = "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz";
+      urls = [
+        "https://github.com/TheTorProject/gettorbrowser/releases/download/v${version}/tor-browser-linux64-${version}_${lang}.tar.xz"
+        "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz"
+      ];
       sha256 = "0jn98arczlgjigpmql1qg5b7izabv4zy4mji6vvcg3b8g1ma108r";
     };
 
     "i686-linux" = fetchurl {
-      url = "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux32-${version}_${lang}.tar.xz";
+      urls = [
+        "https://github.com/TheTorProject/gettorbrowser/releases/download/v${version}/tor-browser-linux32-${version}_${lang}.tar.xz"
+        "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux32-${version}_${lang}.tar.xz"
+      ];
       sha256 = "0micxgkbys0py4bj6csbc8xz4gq0x5v2zirgi38krnm5x5riqj3w";
     };
   };
@@ -105,6 +111,7 @@ stdenv.mkDerivation rec {
   src = srcs."${stdenv.system}" or (throw "unsupported system: ${stdenv.system}");
 
   preferLocalBuild = true;
+  allowSubstitutes = false;
 
   desktopItem = makeDesktopItem {
     name = "torbrowser";

From 132b503aacb7dcc181d12804dee110f68f9f3730 Mon Sep 17 00:00:00 2001
From: Charles Strahan <charles@cstrahan.com>
Date: Sun, 28 May 2017 14:19:40 -0400
Subject: [PATCH 18/33] GHCJS packages: avoid inode explosion

As noted in #25595, a change introduced in 4b77d425aa597 causes an
explosion of inodes due to the constructions of many, many `ghcEnv`
symlink forests. This commit undoes that change.

To discuss reworking the support for GHCJS plugins, please see: #26192

Fixes #25595
---
 pkgs/development/haskell-modules/generic-builder.nix | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/pkgs/development/haskell-modules/generic-builder.nix b/pkgs/development/haskell-modules/generic-builder.nix
index 653e5cd245ca..7d21996fe1cd 100644
--- a/pkgs/development/haskell-modules/generic-builder.nix
+++ b/pkgs/development/haskell-modules/generic-builder.nix
@@ -197,13 +197,11 @@ stdenv.mkDerivation ({
     ${jailbreak-cabal}/bin/jailbreak-cabal ${pname}.cabal
   '' + postPatch;
 
-  # for ghcjs, we want to put ghcEnv on PATH so compiler plugins will be available.
-  # TODO(cstrahan): would the same be of benefit to native ghc?
   setupCompilerEnvironmentPhase = ''
     runHook preSetupCompilerEnvironment
 
     echo "Build with ${ghc}."
-    export PATH="${if ghc.isGhcjs or false then ghcEnv else ghc}/bin:$PATH"
+    export PATH="${ghc}/bin:$PATH"
     ${optionalString (hasActiveLibrary && hyperlinkSource) "export PATH=${hscolour}/bin:$PATH"}
 
     packageConfDir="$TMPDIR/package.conf.d"

From 815ad7c549b423ebd324027d886d5e67b56f295e Mon Sep 17 00:00:00 2001
From: Anderson Torres <torres.anderson.85@gmail.com>
Date: Sun, 28 May 2017 15:59:36 -0300
Subject: [PATCH 19/33] Galaxis: init at 1.9 (#26185)

* Galaxis: init at 1.9

* galaxis: nitpicks
---
 pkgs/games/galaxis/default.nix  | 47 +++++++++++++++++++++++++++++++++
 pkgs/top-level/all-packages.nix |  2 ++
 2 files changed, 49 insertions(+)
 create mode 100644 pkgs/games/galaxis/default.nix

diff --git a/pkgs/games/galaxis/default.nix b/pkgs/games/galaxis/default.nix
new file mode 100644
index 000000000000..c0799e8fdf4c
--- /dev/null
+++ b/pkgs/games/galaxis/default.nix
@@ -0,0 +1,47 @@
+{ stdenv, fetchurl, ncurses, xmlto }:
+
+with stdenv.lib;
+stdenv.mkDerivation rec{
+
+  name = "galaxis-${version}";
+  version = "1.9";
+
+  src = fetchurl{
+    url = "http://www.catb.org/~esr/galaxis/${name}.tar.gz";
+    sha256 = "1dsypk5brfbc399pg4fk9myyh5yyln0ljl1aiqkypws8h4nsdphl";
+  };
+
+  buildInputs = [ ncurses xmlto ];
+
+  patchPhase = ''
+    sed -i\
+     -e 's|^install: galaxis\.6 uninstall|install: galaxis.6|'\
+     -e 's|usr/||g' -e 's|ROOT|DESTDIR|g'\
+     -e 's|install -m 755 -o 0 -g 0|install -m 755|' Makefile
+  '';
+
+  dontConfigure = true;
+
+  makeFlags = [ "DESTDIR=$(out)" ];
+
+  meta = {
+    description = "Rescue lifeboats lost in interstellar space";
+    longDescription = ''
+      Lifeboats from a crippled interstellar liner are adrift in a starfield. To
+      find them, you can place probes that look in all eight compass directions
+      and tell you how many lifeboats they see. If you drop a probe directly on
+      a lifeboat it will be revealed immediately. Your objective: find the
+      lifeboats as quickly as possible, before the stranded passengers run out
+      of oxygen!
+
+      This is a UNIX-hosted, curses-based clone of the nifty little Macintosh
+      freeware game Galaxis. It doesn't have the super-simple, point-and-click
+      interface of the original, but compensates by automating away some of the
+      game's simpler deductions.
+    '';
+    homepage = http://catb.org/~esr/galaxis/;
+    license = licenses.gpl2;
+    maintainers = [ maintainers.AndersonTorres ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index b08a42198e1a..1ca4e8b20343 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -16936,6 +16936,8 @@ with pkgs;
     wxGTK = wxGTK28.override { unicode = false; };
   };
 
+  galaxis = callPackage ../games/galaxis { };
+
   gambatte = callPackage ../games/gambatte { };
 
   garden-of-coloured-lights = callPackage ../games/garden-of-coloured-lights { allegro = allegro4; };

From 56a4aaf4dfec8c189eca907f2815d29b77dcc6d5 Mon Sep 17 00:00:00 2001
From: romildo <malaquias@gmail.com>
Date: Sun, 28 May 2017 17:38:23 -0300
Subject: [PATCH 20/33] cmdliner: 0.9.8 -> 1.0.0

---
 .../ocaml-modules/cmdliner/default.nix        | 27 ++++++++++---------
 1 file changed, 15 insertions(+), 12 deletions(-)

diff --git a/pkgs/development/ocaml-modules/cmdliner/default.nix b/pkgs/development/ocaml-modules/cmdliner/default.nix
index 8be36a2a408f..9448610a3784 100644
--- a/pkgs/development/ocaml-modules/cmdliner/default.nix
+++ b/pkgs/development/ocaml-modules/cmdliner/default.nix
@@ -1,31 +1,34 @@
-{ stdenv, fetchurl, ocaml, findlib, ocamlbuild, opam }:
+{ stdenv, fetchurl, ocaml, findlib, ocamlbuild, opam, topkg, result }:
 
 let
   pname = "cmdliner";
 in
 
-assert stdenv.lib.versionAtLeast ocaml.version "3.12";
+assert stdenv.lib.versionAtLeast ocaml.version "4.01.0";
 
 stdenv.mkDerivation rec {
-
   name = "ocaml-${pname}-${version}";
-  version = "0.9.8";
+  version = "1.0.0";
 
   src = fetchurl {
     url = "http://erratique.ch/software/${pname}/releases/${pname}-${version}.tbz";
-    sha256 = "0hdxlkgiwjml9dpaa80282a8350if7mc1m6yz2mrd7gci3fszykx";
+    sha256 = "1ryn7qis0izg0wcal8zdlikzzl689l75y6f4zc6blrm93y5agy9x";
   };
 
   unpackCmd = "tar xjf $src";
-  buildInputs = [ ocaml findlib ocamlbuild opam ];
+
+  nativeBuildInputs = [ ocamlbuild opam topkg ];
+  buildInputs = [ ocaml findlib ];
+  propagatedBuildInputs = [ result ];
 
   createFindlibDestdir = true;
 
-  configurePhase = "ocaml pkg/git.ml";
-  buildPhase     = "ocaml pkg/build.ml native=true native-dynlink=true";
-  installPhase   = ''
-    opam-installer --script --prefix=$out ${pname}.install > install.sh
-    sh install.sh
+  buildPhase = ''
+    ocaml -I ${findlib}/lib/ocaml/${ocaml.version}/site-lib pkg/pkg.ml build
+  '';
+
+  installPhase = ''
+    opam-installer --script --prefix=$out | sh
     ln -s $out/lib/${pname} $out/lib/ocaml/${ocaml.version}/site-lib/
   '';
 
@@ -33,7 +36,7 @@ stdenv.mkDerivation rec {
     homepage = http://erratique.ch/software/cmdliner;
     description = "An OCaml module for the declarative definition of command line interfaces";
     license = licenses.bsd3;
-    maintainers = [ maintainers.vbgl ];
     platforms = ocaml.meta.platforms or [];
+    maintainers = [ maintainers.vbgl ];
   };
 }

From 97b3def8cf2caf0d35edfae2b7f157541ea346f2 Mon Sep 17 00:00:00 2001
From: romildo <malaquias@gmail.com>
Date: Sun, 28 May 2017 17:39:21 -0300
Subject: [PATCH 21/33] ocp-indent: 1.5.2 -> 1.6.0

---
 pkgs/development/tools/ocaml/ocp-indent/default.nix | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/tools/ocaml/ocp-indent/default.nix b/pkgs/development/tools/ocaml/ocp-indent/default.nix
index d146dd5e9731..500002bed444 100644
--- a/pkgs/development/tools/ocaml/ocp-indent/default.nix
+++ b/pkgs/development/tools/ocaml/ocp-indent/default.nix
@@ -3,18 +3,21 @@
 let inherit (stdenv.lib) getVersion versionAtLeast; in
 
 assert versionAtLeast (getVersion ocaml) "3.12.1";
+assert versionAtLeast (getVersion cmdliner) "1.0.0";
 assert versionAtLeast (getVersion ocpBuild) "1.99.6-beta";
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
 
-  name = "ocp-indent-1.5.2";
+  name = "ocp-indent-${version}";
+  version = "1.6.0";
 
   src = fetchzip {
-    url = "https://github.com/OCamlPro/ocp-indent/archive/1.5.2.tar.gz";
-    sha256 = "0ynv2yhm7akpvqp72pdabhddwr352s1k85q8m1khsvspgg1mkiqz";
+    url = "https://github.com/OCamlPro/ocp-indent/archive/${version}.tar.gz";
+    sha256 = "1h9y597s3ag8w1z32zzv4dfk3ppq557s55bnlfw5a5wqwvia911f";
   };
 
-  buildInputs = [ ocaml findlib ocpBuild opam cmdliner ];
+  nativeBuildInputs = [ ocpBuild opam ];
+  buildInputs = [ ocaml findlib cmdliner ];
 
   createFindlibDestdir = true;
 

From 4a0c7d1b2d415a419285ee6ff42077678aedad62 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?L=C3=A9o=20Gaspard?= <leo@gaspard.io>
Date: Mon, 29 May 2017 00:25:29 +0200
Subject: [PATCH 22/33] dkimproxy: init at 1.4.1 (#26147)

* dkimproxy: init at 1.4.1

* dkimproxy: simplify by using mkDerivation

* dkimproxy: set ekleog as maintainer

* dkimproxy: style fix

* dkimproxy: also work without the right PERL5LIB environment variable
---
 lib/maintainers.nix                     |  1 +
 pkgs/servers/mail/dkimproxy/default.nix | 36 +++++++++++++++++++++++++
 pkgs/top-level/all-packages.nix         |  4 +++
 3 files changed, 41 insertions(+)
 create mode 100644 pkgs/servers/mail/dkimproxy/default.nix

diff --git a/lib/maintainers.nix b/lib/maintainers.nix
index a3e397f2173b..ad1ba299a530 100644
--- a/lib/maintainers.nix
+++ b/lib/maintainers.nix
@@ -161,6 +161,7 @@
   ehegnes = "Eric Hegnes <eric.hegnes@gmail.com>";
   ehmry = "Emery Hemingway <emery@vfemail.net>";
   eikek = "Eike Kettner <eike.kettner@posteo.de>";
+  ekleog = "Leo Gaspard <leo@gaspard.io>";
   elasticdog = "Aaron Bull Schaefer <aaron@elasticdog.com>";
   eleanor = "Dejan Lukan <dejan@proteansec.com>";
   elitak = "Eric Litak <elitak@gmail.com>";
diff --git a/pkgs/servers/mail/dkimproxy/default.nix b/pkgs/servers/mail/dkimproxy/default.nix
new file mode 100644
index 000000000000..9abf95fb6d60
--- /dev/null
+++ b/pkgs/servers/mail/dkimproxy/default.nix
@@ -0,0 +1,36 @@
+{ stdenv, perl, fetchurl, Error, MailDKIM, MIMEtools, NetServer }:
+
+let
+  pkg = "dkimproxy";
+  version = "1.4.1";
+in
+stdenv.mkDerivation rec {
+  name = "${pkg}-${version}";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/dkimproxy/${name}.tar.gz";
+    sha256 = "1gc5c7lg2qrlck7b0lvjfqr824ch6jkrzkpsn0gjvlzg7hfmld75";
+  };
+
+  # Idea taken from pkgs/development/perl-modules/generic/builder.sh
+  preFixup = ''
+    perlFlags=
+    for i in $(IFS=:; echo $PERL5LIB); do
+      perlFlags="$perlFlags -I$i"
+    done
+    for f in $(ls $out/bin); do
+      sed -i $out/bin/$f -e "s|#\!\(.*/perl.*\)$|#\! \1 $perlFlags|"
+    done
+  '';
+
+  buildInputs = [ perl ];
+  propagatedBuildInputs = [ Error MailDKIM MIMEtools NetServer ];
+
+  meta = with stdenv.lib; {
+    description = "SMTP-proxy that signs and/or verifies emails";
+    homepage = http://dkimproxy.sourceforge.net/;
+    license = licenses.gpl2Plus;
+    maintainers = [ maintainers.ekleog ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 1ca4e8b20343..530d081477ff 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -10876,6 +10876,10 @@ with pkgs;
 
   diod = callPackage ../servers/diod { lua = lua5_1; };
 
+  dkimproxy = callPackage ../servers/mail/dkimproxy {
+    inherit (perlPackages) Error MailDKIM MIMEtools NetServer;
+  };
+
   dnschain = callPackage ../servers/dnschain { };
 
   dovecot = callPackage ../servers/mail/dovecot { };

From 6e95e2a1613389dd0c5ec24fc046942834670ade Mon Sep 17 00:00:00 2001
From: Dmitry Kalinkin <dmitry.kalinkin@gmail.com>
Date: Sun, 28 May 2017 06:41:09 -0400
Subject: [PATCH 23/33] cernlib: init at 2006

---
 .../libraries/physics/cernlib/default.nix     |  63 ++++++
 .../libraries/physics/cernlib/patch           | 186 ++++++++++++++++++
 .../libraries/physics/cernlib/setup-hook.sh   |   3 +
 pkgs/top-level/all-packages.nix               |   2 +
 4 files changed, 254 insertions(+)
 create mode 100644 pkgs/development/libraries/physics/cernlib/default.nix
 create mode 100644 pkgs/development/libraries/physics/cernlib/patch
 create mode 100644 pkgs/development/libraries/physics/cernlib/setup-hook.sh

diff --git a/pkgs/development/libraries/physics/cernlib/default.nix b/pkgs/development/libraries/physics/cernlib/default.nix
new file mode 100644
index 000000000000..dad138c8433a
--- /dev/null
+++ b/pkgs/development/libraries/physics/cernlib/default.nix
@@ -0,0 +1,63 @@
+{ stdenv, fetchurl, gfortran, gnumake, imake, makedepend, motif, xorg }:
+
+stdenv.mkDerivation rec {
+  version = "2006";
+  name = "cernlib-${version}";
+
+  src = fetchurl {
+    url = "http://cernlib.web.cern.ch/cernlib/download/${version}_source/tar/${version}_src.tar.gz";
+    sha256 = "0awla1rl96z82br7slcmg8ks1d2a7slk6dj79ywb871j2ksi3fky";
+  };
+
+  buildInputs = with xorg; [ gfortran motif libX11 libXft libXt ];
+  nativeBuildInputs = [ gnumake imake makedepend ];
+  sourceRoot = ".";
+
+  patches = [ ./patch ];
+
+  postPatch = ''
+    substituteInPlace 2006/src/config/site.def \
+      --replace "# define MakeCmd gmake" "# define MakeCmd make"
+  '';
+
+  configurePhase = ''
+    export CERN=`pwd`
+    export CERN_LEVEL=${version}
+    export CERN_ROOT=$CERN/$CERN_LEVEL
+    export CVSCOSRC=`pwd`/$CERN_LEVEL/src
+    export PATH=$PATH:$CERN_ROOT/bin
+  '';
+
+  buildPhase = ''
+    cd $CERN_ROOT
+    mkdir -p build bin lib
+
+    cd $CERN_ROOT/build
+    $CVSCOSRC/config/imake_boot
+    make bin/kuipc
+    make scripts/Makefile
+    pushd scripts
+    make install.bin
+    popd
+    make
+  '';
+
+  installPhase = ''
+    mkdir "$out"
+    cp -r "$CERN_ROOT/bin" "$out"
+    cp -r "$CERN_ROOT/lib" "$out"
+    mkdir "$out/$CERN_LEVEL"
+    ln -s "$out/bin" "$out/$CERN_LEVEL/bin"
+    ln -s "$out/lib" "$out/$CERN_LEVEL/lib"
+  '';
+
+  setupHook = ./setup-hook.sh;
+
+  meta = {
+    homepage = http://cernlib.web.cern.ch;
+    description = "Legacy collection of libraries and modules for data analysis in high energy physics";
+    platforms = stdenv.lib.platforms.unix;
+    maintainers = with stdenv.lib.maintainers; [ veprbl ];
+    license = stdenv.lib.licenses.gpl2;
+  };
+}
diff --git a/pkgs/development/libraries/physics/cernlib/patch b/pkgs/development/libraries/physics/cernlib/patch
new file mode 100644
index 000000000000..2d75b6bf0f88
--- /dev/null
+++ b/pkgs/development/libraries/physics/cernlib/patch
@@ -0,0 +1,186 @@
+diff --git a/2006/src/config/Imake.tmpl b/2006/src/config/Imake.tmpl
+index 054fb04..a3b3828 100644
+--- a/2006/src/config/Imake.tmpl
++++ b/2006/src/config/Imake.tmpl
+@@ -455,7 +455,7 @@ XCOMM the platform-specific parameters - edit site.def to change
+ #define NoRConst NO /* YES if const for structs of funcs is bad */
+ #endif
+ #ifndef InstPgmFlags
+-#define InstPgmFlags -s
++#define InstPgmFlags
+ #endif
+ #ifndef InstBinFlags
+ #define InstBinFlags -m 0755
+diff --git a/2006/src/config/biglib.rules b/2006/src/config/biglib.rules
+index c90e58a..9173bdc 100644
+--- a/2006/src/config/biglib.rules
++++ b/2006/src/config/biglib.rules
+@@ -368,7 +368,7 @@ define build-object-list						@@\
+ @ (set -e;\							@@\
+ 	 case '${MFLAGS}' in *[i]*) set +e;; esac; \		@@\
+ 	 subdirs=Quote(dirs);\					@@\
+-	 list=`/bin/pwd`/$@;\					@@\
++	 list=`pwd`/$@;\					@@\
+ 	 for dir in $$subdirs; do \				@@\
+ 	  (set -e;cd $$dir;SedCmd -e "\=^[^/]=s=^.=$$dir/&=" $@ >> $$list);\@@\
+ 	 done) || (rm $@; exit 1)				@@\
+diff --git a/2006/src/config/imake_boot b/2006/src/config/imake_boot
+index b52d0d3..69cf1b3 100755
+--- a/2006/src/config/imake_boot
++++ b/2006/src/config/imake_boot
+@@ -10,8 +10,8 @@ if [ "$CVSCOSRC" = "" ] ; then
+ fi
+ if [ -f Imakefile ] ; then
+ 	imake -DUseInstalled -I$CVSCOSRC/config \
+-		-DTOPDIR=`/bin/pwd` -DCURDIR= -fImakefile
++		-DTOPDIR=`pwd` -DCURDIR= -fImakefile
+ else
+ 	imake -DUseInstalled -I$CVSCOSRC/config \
+-		-DTOPDIR=`/bin/pwd` -DCURDIR= -f$CVSCOSRC/Imakefile
++		-DTOPDIR=`pwd` -DCURDIR= -f$CVSCOSRC/Imakefile
+ fi
+diff --git a/2006/src/config/linux-lp64.cf b/2006/src/config/linux-lp64.cf
+index e071b2f..3cc5c3b 100644
+--- a/2006/src/config/linux-lp64.cf
++++ b/2006/src/config/linux-lp64.cf
+@@ -173,7 +173,7 @@
+ #define FortranCmd		g77
+ #define XargsCmd		xargs
+ #define FortranSaveFlags	/* */ /* Everything static !? */
+-#define DefaultFCOptions	-fno-automatic -fno-second-underscore -fugly-complex
++#define DefaultFCOptions	-fno-automatic -fno-second-underscore
+ #define CernlibSystem	        -DCERNLIB_LINUX -DCERNLIB_UNIX -DCERNLIB_LNX -DCERNLIB_QMGLIBC -DCERNLIB_QMLXIA64
+ 
+ # endif
+diff --git a/2006/src/config/linux.cf b/2006/src/config/linux.cf
+index cc0bee5..a8dd954 100644
+--- a/2006/src/config/linux.cf
++++ b/2006/src/config/linux.cf
+@@ -258,7 +258,7 @@ endif									@@\
+ #define FortranCmd		g77
+ #define XargsCmd		xargs
+ #define FortranSaveFlags	/* */ /* Everything static !? */
+-#define DefaultFCOptions	-fno-automatic -fno-second-underscore -fugly-complex
++#define DefaultFCOptions	-fno-automatic -fno-second-underscore
+ #define CernlibSystem	        -DCERNLIB_LINUX -DCERNLIB_UNIX -DCERNLIB_LNX -DCERNLIB_QMGLIBC
+ 
+ # endif
+diff --git a/2006/src/packlib/kuip/code_kuip/kkern.c b/2006/src/packlib/kuip/code_kuip/kkern.c
+index 3a5579f..5f3c352 100644
+--- a/2006/src/packlib/kuip/code_kuip/kkern.c
++++ b/2006/src/packlib/kuip/code_kuip/kkern.c
+@@ -543,24 +543,6 @@ char *str0dup( const char *str )
+ 
+ 
+ /*
+- * like strdup() but string is n characters long and not terminated
+- */
+-char *strndup( const char *str,
+-              size_t len )
+-{
+-  size_t bytes = len + 1;
+-  char *p;
+-
+-  if( bytes < ALLOC_MIN_BYTES )
+-    bytes = ALLOC_MIN_BYTES;
+-
+-  p = strncpy( malloc( bytes ), str, len );
+-  p[len] = '\0';
+-  return p;
+-}
+-
+-
+-/*
+  * strdup() of character representation of integer n
+  */
+ char *stridup( int n )
+diff --git a/2006/src/packlib/kuip/code_kuip/kmenu.c b/2006/src/packlib/kuip/code_kuip/kmenu.c
+index f135b07..23007a8 100644
+--- a/2006/src/packlib/kuip/code_kuip/kmenu.c
++++ b/2006/src/packlib/kuip/code_kuip/kmenu.c
+@@ -1404,7 +1404,7 @@ void interactive_find( char *expr, int keym )
+          printf ("See also:\n    ");
+          for (i = 0; i < nval; i++) {
+              if (i == ncmd) continue;
+-             printf (flis_name[i]);
++             printf ("%s", flis_name[i]);
+              if (i < nval-1)
+                 printf (", ");
+              else
+diff --git a/2006/src/packlib/kuip/kuip/kstring.h b/2006/src/packlib/kuip/kuip/kstring.h
+index 7811f15..12a1344 100644
+--- a/2006/src/packlib/kuip/kuip/kstring.h
++++ b/2006/src/packlib/kuip/kuip/kstring.h
+@@ -21,7 +21,6 @@ extern "C" {
+  */
+ 
+ #ifndef WIN32
+-extern void* memmove( void* dst, const void* src, size_t n );
+ #endif
+ 
+ /* GF. make conform to kkern.c#if !defined(__convexc__)*/
+@@ -46,7 +45,6 @@ extern char* str4dup( const char* str1, const char* str2, const char* str3,
+                      const char* str4 );
+ extern char* str5dup( const char* str1, const char* str2, const char* str3,
+                      const char* str4, const char* str5 );
+-extern char* strndup( const char* buf, size_t n );
+ extern char* stridup( int i );
+ 
+ extern char* mstrcat( char* ptr, const char* str );
+diff --git a/2006/src/pawlib/paw/cpaw/bugrep.c b/2006/src/pawlib/paw/cpaw/bugrep.c
+index d503a45..d26e30f 100644
+--- a/2006/src/pawlib/paw/cpaw/bugrep.c
++++ b/2006/src/pawlib/paw/cpaw/bugrep.c
+@@ -432,51 +432,7 @@ br_add_config( char * tmp_file )
+ 
+ static int
+ br_mail_file( char *addr, char *subj, char *file )
+-#if (defined(CERNLIB_UNIX))&&(!defined(CERNLIB_WINNT))&&(!defined(CERNLIB_MACOSX))
+-{
+-        FILE            *mfp, *fp;
+-        char            line[1024], my_addr[L_cuserid];
+-        time_t          clock;
+-        struct tm       *ts;
+-
+-        fp = fopen( file, "r" );
+-        if ( fp == NULL ) {
+-                printf( "BUGREPORT: cannot (re)open temporary file\n" );
+-                return MAIL_ERROR;
+-        }
+-
+-        cuserid( my_addr );
+-
+-        sprintf( line, "/usr/lib/sendmail -t" );
+-        mfp = popen( line, "w" );
+-
+-        if ( mfp == NULL ) {
+-                printf( "BUGREPORT: cannot run sendmail\n" );
+-                return MAIL_ERROR;
+-        }
+-
+-
+-        clock = time( (time_t *) 0 );
+-        ts = localtime( &clock );
+-        strftime( line, sizeof( line ),
+-                "%a, %d %h %y %H:%M:%S", ts );
+-        fprintf ( mfp, "To: %s\n", addr );
+-        fprintf ( mfp, "Bcc: %s\n", my_addr );
+-        fprintf ( mfp, "Date: %s\n", line );
+-        fprintf ( mfp, "Subject: %s\n", subj );
+-        fprintf ( mfp, "\n" );
+-
+-        while( fgets( line, sizeof( line ), fp ) != NULL ) {
+-                fputs( line, mfp );
+-        }
+-        fclose( fp );
+-
+-        pclose( mfp );
+-
+-        return MAIL_OK;
+-}
+-#endif
+-#if defined(CERNLIB_MACOSX)
++#if (defined(CERNLIB_UNIX))&&(!defined(CERNLIB_WINNT))
+ {
+         FILE            *mfp, *fp;
+         char            line[1024], *my_addr;
diff --git a/pkgs/development/libraries/physics/cernlib/setup-hook.sh b/pkgs/development/libraries/physics/cernlib/setup-hook.sh
new file mode 100644
index 000000000000..d83759327760
--- /dev/null
+++ b/pkgs/development/libraries/physics/cernlib/setup-hook.sh
@@ -0,0 +1,3 @@
+export CERN_LEVEL=@version@
+export CERN=@out@
+export CERN_ROOT=$CERN/$CERN_LEVEL
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 9cd3199a1d5a..62e5c24a11dc 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -18107,6 +18107,8 @@ with pkgs;
     motif = null; # motif or lesstif
   };
 
+  cernlib = callPackage ../development/libraries/physics/cernlib { };
+
   g4py = callPackage ../development/libraries/physics/geant4/g4py { };
 
   hepmc = callPackage ../development/libraries/physics/hepmc { };

From 7bbb9824ac0cb002a35114417f5175e5434424da Mon Sep 17 00:00:00 2001
From: Robert Scott <code@humanleg.org.uk>
Date: Mon, 29 May 2017 02:00:50 +0100
Subject: [PATCH 24/33] python.pkgs.hypothesis: add pytest_xdist as a
 checkInputs dependency

without this py.test doesn't recognize the -n flag and fails
---
 pkgs/development/python-modules/hypothesis.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/hypothesis.nix b/pkgs/development/python-modules/hypothesis.nix
index b9f95d1a0313..cb0db6dc2e0c 100644
--- a/pkgs/development/python-modules/hypothesis.nix
+++ b/pkgs/development/python-modules/hypothesis.nix
@@ -1,6 +1,6 @@
 { stdenv, buildPythonPackage, fetchFromGitHub, python
 , pythonOlder, pythonAtLeast, enum34
-, doCheck ? true, pytest, flake8, flaky
+, doCheck ? true, pytest, pytest_xdist, flake8, flaky
 }:
 buildPythonPackage rec {
   # http://hypothesis.readthedocs.org/en/latest/packaging.html
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     sha256 = "1s911pd3y9hvk0hq2fr6i68dqv1ciagryhgp13wgyfqh8hz8j6zv";
   };
 
-  checkInputs = stdenv.lib.optionals doCheck [ pytest flake8 flaky ];
+  checkInputs = stdenv.lib.optionals doCheck [ pytest pytest_xdist flake8 flaky ];
   propagatedBuildInputs = stdenv.lib.optionals (pythonOlder "3.4") [ enum34 ];
 
   inherit doCheck;

From 2c228f62cd5675fcd63107e948eaa72f827af756 Mon Sep 17 00:00:00 2001
From: Robert Scott <code@humanleg.org.uk>
Date: Mon, 29 May 2017 02:02:40 +0100
Subject: [PATCH 25/33] python.pkgs.pylibmc: use fetchPypi for src

---
 pkgs/development/python-modules/pylibmc/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/pylibmc/default.nix b/pkgs/development/python-modules/pylibmc/default.nix
index ff53e3d304fe..7f57f17efeb1 100644
--- a/pkgs/development/python-modules/pylibmc/default.nix
+++ b/pkgs/development/python-modules/pylibmc/default.nix
@@ -1,11 +1,11 @@
-{ buildPythonPackage, fetchurl, stdenv, libmemcached, zlib }:
+{ buildPythonPackage, fetchPypi, stdenv, libmemcached, zlib }:
 buildPythonPackage rec {
   version = "1.5.2";
   pname = "pylibmc";
   name = "${pname}-${version}";
 
-  src = fetchurl {
-    url = "https://pypi.python.org/packages/source/p/pylibmc/${name}.tar.gz";
+  src = fetchPypi {
+    inherit pname version;
     sha256 = "fc54e28a9f1b5b2ec0c030da29c7ad8a15c2755bd98aaa4142eaf419d5fabb33";
   };
 

From d2ef1a24b86c1ff69c218c8d83b48af0977ca3af Mon Sep 17 00:00:00 2001
From: Robert Scott <code@humanleg.org.uk>
Date: Mon, 29 May 2017 02:05:56 +0100
Subject: [PATCH 26/33] python.pkgs.ldap: use fetchPypi for src

---
 pkgs/development/python-modules/ldap.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/ldap.nix b/pkgs/development/python-modules/ldap.nix
index e2625e2bfbfa..3e715bbe419a 100644
--- a/pkgs/development/python-modules/ldap.nix
+++ b/pkgs/development/python-modules/ldap.nix
@@ -1,4 +1,4 @@
-{ buildPythonPackage, isPy3k, fetchurl
+{ buildPythonPackage, isPy3k, fetchPypi
 , openldap, cyrus_sasl, openssl }:
 
 buildPythonPackage rec {
@@ -7,8 +7,8 @@ buildPythonPackage rec {
   name = "${pname}-${version}";
   disabled = isPy3k;
 
-  src = fetchurl {
-    url = "mirror://pypi/p/python-ldap/python-${name}.tar.gz";
+  src = fetchPypi {
+    inherit pname version;
     sha256 = "88bab69e519dd8bd83becbe36bd141c174b0fe309e84936cf1bae685b31be779";
   };
 

From 21e3b2ff551c8dbf16a010fc377c5f60283034e4 Mon Sep 17 00:00:00 2001
From: Robert Scott <code@humanleg.org.uk>
Date: Mon, 29 May 2017 02:07:53 +0100
Subject: [PATCH 27/33] python.pkgs.pylint: add pytestrunner to buildInputs

---
 pkgs/development/python-modules/pylint/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pylint/default.nix b/pkgs/development/python-modules/pylint/default.nix
index 2922faafa7f7..130aef60f971 100644
--- a/pkgs/development/python-modules/pylint/default.nix
+++ b/pkgs/development/python-modules/pylint/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, buildPythonPackage, python, astroid, isort,
-  pytest,  mccabe, configparser, backports_functools_lru_cache }:
+  pytest, pytestrunner,  mccabe, configparser, backports_functools_lru_cache }:
 
   buildPythonPackage rec {
     name = "${pname}-${version}";
@@ -11,7 +11,7 @@
       sha256 = "8b4a7ab6cf5062e40e2763c0b4a596020abada1d7304e369578b522e46a6264a";
     };
 
-    buildInputs = [ pytest mccabe configparser backports_functools_lru_cache ];
+    buildInputs = [ pytest pytestrunner mccabe configparser backports_functools_lru_cache ];
 
     propagatedBuildInputs = [ astroid isort ];
 

From 78b62836f5cd02626ffaff7f05071e19368f2ea8 Mon Sep 17 00:00:00 2001
From: Will Dietz <github@wdtz.org>
Date: Mon, 29 May 2017 02:14:02 -0500
Subject: [PATCH 28/33] lynx: Fix SSL, widec support (#26134)

* lynx: Fix SSL support by letting it use pkgconfig

lynx wants both the "include" and "lib/lib*.so" paths
to be children of the path given to "--with-ssl",
which is not provided by any of the current openssl outputs.

To fix lynx so it supports SSL (and https URLs),
let it use pkgconfig to figure out where openssl's bits are.

* lynx: Always enable widec support.
---
 .../networking/browsers/lynx/default.nix             | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/pkgs/applications/networking/browsers/lynx/default.nix b/pkgs/applications/networking/browsers/lynx/default.nix
index fb4b33ef71ab..42f454191989 100644
--- a/pkgs/applications/networking/browsers/lynx/default.nix
+++ b/pkgs/applications/networking/browsers/lynx/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, ncurses, gzip
+{ stdenv, fetchurl, ncurses, gzip, pkgconfig
 , sslSupport ? true, openssl ? null
 }:
 
@@ -13,14 +13,10 @@ stdenv.mkDerivation rec {
     sha256 = "1cqm1i7d209brkrpzaqqf2x951ra3l67dw8x9yg10vz7rpr9441a";
   };
 
-  configureFlags = []
-    ++ stdenv.lib.optionals sslSupport [ "--with-ssl=${openssl.dev}" ];
+  configureFlags = [ "--enable-widec" ] ++ stdenv.lib.optional sslSupport "--with-ssl";
 
-  buildInputs = [ ncurses gzip ];
-
-  crossAttrs = {
-    configureFlags = configureFlags ++ [ "--enable-widec" ];
-  };
+  nativeBuildInputs = stdenv.lib.optional sslSupport pkgconfig;
+  buildInputs = [ ncurses gzip ] ++ stdenv.lib.optional sslSupport openssl.dev;
 
   meta = with stdenv.lib; {
     homepage = http://lynx.isc.org/;

From 46de05a3dd6975e5db4cf06eca49e579557a03d6 Mon Sep 17 00:00:00 2001
From: Pascal Wittmann <pascal.wittmann@red6-es.de>
Date: Mon, 29 May 2017 09:23:15 +0200
Subject: [PATCH 29/33] dmenu: 4.6 -> 4.7

---
 pkgs/applications/misc/dmenu/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/misc/dmenu/default.nix b/pkgs/applications/misc/dmenu/default.nix
index 1dc9fe5e2026..8ef4f3ae8974 100644
--- a/pkgs/applications/misc/dmenu/default.nix
+++ b/pkgs/applications/misc/dmenu/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, libX11, libXinerama, libXft, zlib, patches ? null }:
 
 stdenv.mkDerivation rec {
-  name = "dmenu-4.6";
+  name = "dmenu-4.7";
 
   src = fetchurl {
     url = "http://dl.suckless.org/tools/${name}.tar.gz";
-    sha256 = "1cwnvamqqlgczvd5dv5rsgqbhv8kp0ddjnhmavb3q732i8028yja";
+    sha256 = "1fgph549i0yw62x02jhfc8qmqk2rnzcnm46bxq6jig1cvkw3amm7";
   };
 
   buildInputs = [ libX11 libXinerama zlib libXft ];

From f6ef5614a0f23d23c9494811bb1ac3b35d2a07c6 Mon Sep 17 00:00:00 2001
From: Pascal Wittmann <pascal.wittmann@red6-es.de>
Date: Mon, 29 May 2017 09:28:28 +0200
Subject: [PATCH 30/33] radicale: 1.1.1 -> 1.1.2, fixes CVE-2017-8342

---
 pkgs/servers/radicale/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/radicale/default.nix b/pkgs/servers/radicale/default.nix
index e49e399194de..f36d19bfb209 100644
--- a/pkgs/servers/radicale/default.nix
+++ b/pkgs/servers/radicale/default.nix
@@ -2,11 +2,11 @@
 
 pythonPackages.buildPythonApplication rec {
   name = "radicale-${version}";
-  version = "1.1.1";
+  version = "1.1.2";
 
   src = fetchurl {
     url = "mirror://pypi/R/Radicale/Radicale-${version}.tar.gz";
-    sha256 = "1c5lv8qca21mndkx350wxv34qypqh6gb4rhzms4anr642clq3jg2";
+    sha256 = "1g20p3998f46ywda7swv0py63wjbrhvk0nrafajlbb6wgzxjmqpb";
   };
 
   propagatedBuildInputs = stdenv.lib.optionals (!pythonPackages.isPy3k) [

From 1c6abe0230087a9072812023d42ea32e8126bf87 Mon Sep 17 00:00:00 2001
From: romildo <malaquias@gmail.com>
Date: Sun, 28 May 2017 23:06:55 -0300
Subject: [PATCH 31/33] merlin: 2.5.3 -> 2.5.4

- Update to version 2.5.4.
- Remove dependency on menhir, which seems not needed.
---
 pkgs/development/tools/ocaml/merlin/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/tools/ocaml/merlin/default.nix b/pkgs/development/tools/ocaml/merlin/default.nix
index 7af1b5ccd7a3..6f0d71d76b18 100644
--- a/pkgs/development/tools/ocaml/merlin/default.nix
+++ b/pkgs/development/tools/ocaml/merlin/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip, ocaml, findlib, yojson, menhir, lib
+{ stdenv, fetchzip, ocaml, findlib, yojson, lib
 , withEmacsMode ? false, emacs }:
 
 assert stdenv.lib.versionAtLeast (stdenv.lib.getVersion ocaml) "4.00";
@@ -8,10 +8,10 @@ let
   then
     "2.3.1"
   else
-    "2.5.3";
+    "2.5.4";
   hashes = {
     "2.3.1" = "192jamcc7rmvadlqqsjkzsl6hlgwhg9my1qc89fxh1lmd4qdsrpn";
-    "2.5.3" = "0qljklgcrpqdxzvcqj7b4785zcz322pjvw9cddbmzla33hagglha";
+    "2.5.4" = "101vk16c5wayd51s8w0mvy99bk7q3gm2gz8i8616wa1lmyszjknh";
   };
 in
 
@@ -24,7 +24,7 @@ stdenv.mkDerivation {
     sha256 = hashes."${version}";
   };
 
-  buildInputs = [ ocaml findlib yojson menhir ]
+  buildInputs = [ ocaml findlib yojson ]
     ++ stdenv.lib.optional withEmacsMode emacs;
 
   preConfigure = "mkdir -p $out/bin";

From 05a82a9fd0030288b1daea6eb374acdf58926f88 Mon Sep 17 00:00:00 2001
From: Pascal Wittmann <pascal.wittmann@red6-es.de>
Date: Mon, 29 May 2017 09:34:34 +0200
Subject: [PATCH 32/33] homebank: 5.1.4 -> 5.1.5

---
 pkgs/applications/office/homebank/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/office/homebank/default.nix b/pkgs/applications/office/homebank/default.nix
index ac2f71c872da..65a7c9730e9a 100644
--- a/pkgs/applications/office/homebank/default.nix
+++ b/pkgs/applications/office/homebank/default.nix
@@ -2,10 +2,10 @@
 , hicolor_icon_theme, libsoup, gnome3 }:
 
 stdenv.mkDerivation rec {
-  name = "homebank-5.1.4";
+  name = "homebank-5.1.5";
   src = fetchurl {
     url = "http://homebank.free.fr/public/${name}.tar.gz";
-    sha256 = "07zxb9n7d281nfv29gi09fsp7y73fx4w2s48hgdn9s4vij25zwqa";
+    sha256 = "03rkl4bvi1cmb8rqyvmhxhg63bdmb3nzqa3firfimsbphm3x6gsw";
   };
 
   nativeBuildInputs = [ pkgconfig wrapGAppsHook ];

From 9b605ca04118d2ab1604f40906d925540cf392b0 Mon Sep 17 00:00:00 2001
From: Pascal Wittmann <pascal.wittmann@red6-es.de>
Date: Mon, 29 May 2017 09:52:33 +0200
Subject: [PATCH 33/33] fsql: 0.1.0 -> 0.1.1

---
 pkgs/tools/misc/fsql/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/misc/fsql/default.nix b/pkgs/tools/misc/fsql/default.nix
index 117574c3daa1..ffd3b3f51534 100644
--- a/pkgs/tools/misc/fsql/default.nix
+++ b/pkgs/tools/misc/fsql/default.nix
@@ -2,14 +2,14 @@
 
 buildGoPackage rec {
   name = "fsql-${version}";
-  version = "0.1.0";
+  version = "0.1.1";
 
   goPackagePath = "github.com/kshvmdn/fsql";
 
   src = fetchgit {
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
     url = "https://github.com/kshvmdn/fsql";
-    sha256 = "1wkf9rr6x4b5bvxj9zwfw9hd870c831j7mc6fvd448id653wh122";
+    sha256 = "1zvblhfd15l86dcx0p12yrc2rrmfdpzyd107508pb72r2ar638vh";
   };
 
   meta = with stdenv.lib; {