changelog: add all new NixOS modules

(cherry picked from commit cce37d2164)

.github/CONTRIBUTING.md

@@ -1,5 +1,8 @@
 # How to contribute
 
+Note: contributing implies licensing those contributions
+under the terms of [COPYING](../COPYING), which is an MIT-like license.
+
 ## Opening issues
 
 * Make sure you have a [GitHub account](https://github.com/signup/free)

.github/ISSUE_TEMPLATE.md

@@ -0,0 +1,17 @@
+## Basic info
+
+To make sure that we are on the same page:
+
+* Kernel: (run `uname -a`)
+* System: (NixOS: `nixos-version`, Ubuntu/Fedora: `lsb_release -a`, ...)
+* Nix version: (run `nix-env --version`)
+* Nixpkgs version: (run `nix-instantiate --eval '<nixpkgs>' -A lib.nixpkgsVersion`)
+
+## Describe your issue here
+
+### Expected result
+
+### Actual result
+
+### Steps to reproduce
+

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,18 @@
+###### Things done:
+
+- [ ] Tested using sandboxing (`nix-build --option build-use-chroot true` or [nix.useChroot](http://nixos.org/nixos/manual/options.html#opt-nix.useChroot) on NixOS)
+- [ ] Built on platform(s): NixOS / OSX / Linux
+- [ ] Tested compilation of all pkgs that depend on this change using `nix-shell -p nox --run "nox-review wip"`
+- [ ] Tested execution of all binary files (usually in `./result/bin/`)
+- [ ] Fits [CONTRIBUTING.md](https://github.com/NixOS/nixpkgs/blob/master/.github/CONTRIBUTING.md).
+
+###### More
+
+Fixes issue #<insert id>
+
+cc @<maintainer>
+
+
+---
+
+_Please note, that points are not mandatory, but rather desired._

.gitignore

@@ -12,7 +12,5 @@ result-*
 
 .DS_Store
 
-/pkgs/applications/kde-apps-*/tmp/
-/pkgs/development/libraries/kde-frameworks-*/tmp/
 /pkgs/development/libraries/qt-5/*/tmp/
-/pkgs/desktops/plasma-*/tmp/
+/pkgs/desktops/kde-5/*/tmp/

.mention-bot

@@ -0,0 +1,5 @@
+{
+  "userBlacklist": [
+    "civodul"
+  ]
+}

.travis.yml

@@ -1,6 +1,7 @@
 language: python
 python: "3.4"
 sudo: required
+dist: trusty
 before_install: ./maintainers/scripts/travis-nox-review-pr.sh nix
 install: ./maintainers/scripts/travis-nox-review-pr.sh nox
 script: ./maintainers/scripts/travis-nox-review-pr.sh build

.version

@@ -1 +1 @@
-15.09
+16.03

COPYING

@@ -1,4 +1,4 @@
-Copyright (c) 2003-2006 Eelco Dolstra
+Copyright (c) 2003-2016 Eelco Dolstra and the Nixpkgs/NixOS contributors
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the

README.md

@@ -1,8 +1,8 @@
 [<img src="http://nixos.org/logo/nixos-hires.png" width="500px" alt="logo" />](https://nixos.org/nixos)
 
 [![Build Status](https://travis-ci.org/NixOS/nixpkgs.svg?branch=master)](https://travis-ci.org/NixOS/nixpkgs)
-[![Issue Stats](http://www.issuestats.com/github/nixos/nixpkgs/badge/pr)](http://www.issuestats.com/github/nixos/nixpkgs)
-[![Issue Stats](http://www.issuestats.com/github/nixos/nixpkgs/badge/issue)](http://www.issuestats.com/github/nixos/nixpkgs)
+[![Issue Stats](http://www.issuestats.com/github/nixos/nixpkgs/badge/pr?style=flat)](http://www.issuestats.com/github/nixos/nixpkgs)
+[![Issue Stats](http://www.issuestats.com/github/nixos/nixpkgs/badge/issue?style=flat)](http://www.issuestats.com/github/nixos/nixpkgs)
 
 Nixpkgs is a collection of packages for the [Nix](https://nixos.org/nix/) package
 manager. It is periodically built and tested by the [hydra](http://hydra.nixos.org/)
@@ -14,12 +14,12 @@ build daemon as so-called channels. To get channel information via git, add
 ```
 
 For stability and maximum binary package support, it is recommended to maintain
-custom changes on top of one of the channels, e.g. `nixos-14.12` for the latest
+custom changes on top of one of the channels, e.g. `nixos-15.09` for the latest
 release and `nixos-unstable` for the latest successful build of master:
 
 ```
 % git remote update channels
-% git rebase channels/nixos-14.12
+% git rebase channels/nixos-15.09
 ```
 
 For pull-requests, please rebase onto nixpkgs `master`.
@@ -31,11 +31,10 @@ For pull-requests, please rebase onto nixpkgs `master`.
 * [Documentation (Nix Expression Language chapter)](https://nixos.org/nix/manual/#ch-expression-language)
 * [Manual (How to write packages for Nix)](https://nixos.org/nixpkgs/manual/)
 * [Manual (NixOS)](https://nixos.org/nixos/manual/)
+* [Nix Wiki](https://nixos.org/wiki/)
 * [Continuous package builds for unstable/master](https://hydra.nixos.org/jobset/nixos/trunk-combined)
-* [Continuous package builds for 14.12 release](https://hydra.nixos.org/jobset/nixos/release-14.12)
 * [Continuous package builds for 15.09 release](https://hydra.nixos.org/jobset/nixos/release-15.09)
 * [Tests for unstable/master](https://hydra.nixos.org/job/nixos/trunk-combined/tested#tabs-constituents)
-* [Tests for 14.12 release](https://hydra.nixos.org/job/nixos/release-14.12/tested#tabs-constituents)
 * [Tests for 15.09 release](https://hydra.nixos.org/job/nixos/release-15.09/tested#tabs-constituents)
 
 Communication:

default.nix

@@ -1,4 +1,4 @@
-let requiredVersion = "1.8"; in
+let requiredVersion = import ./lib/minver.nix; in
 
 if ! builtins ? nixVersion || builtins.compareVersions requiredVersion builtins.nixVersion == 1 then
 

doc/configuration.xml

@@ -0,0 +1,109 @@
+<chapter xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xml:id="chap-packageconfig">
+
+<title><filename>~/.nixpkgs/config.nix</filename>: global configuration</title>
+
+<para>Nix packages can be configured to allow or deny certain options.</para>
+
+<para>To apply the configuration edit
+<filename>~/.nixpkgs/config.nix</filename> and set it like
+
+<programlisting>
+{
+  allowUnfree = true;
+}
+</programlisting>
+
+and will allow the Nix package manager to install unfree licensed packages.</para>
+
+<para>The configuration as listed also applies to NixOS under
+<option>nixpkgs.config</option> set.</para>
+
+<itemizedlist>
+
+  <listitem>
+    <para>Allow installing of packages that are distributed under
+    unfree license by setting <programlisting>allowUnfree =
+    true;</programlisting> or deny them by setting it to
+    <literal>false</literal>.</para>
+
+    <para>Same can be achieved by setting the environment variable:
+
+<programlisting>
+$ export NIXPKGS_ALLOW_UNFREE=1
+</programlisting>
+
+    </para>
+  </listitem>
+
+  <listitem>
+    <para>Whenever unfree packages are not allowed, single packages
+    can still be allowed by a predicate function that accepts package
+    as an argument and should return a boolean:
+
+<programlisting>
+allowUnfreePredicate = (pkg: ...);
+</programlisting>
+
+    Example to allow flash player only:
+
+<programlisting>
+allowUnfreePredicate = (pkg: pkgs.lib.hasPrefix "flashplayer-" pkg.name);
+</programlisting>
+
+    </para>
+  </listitem>
+
+  <listitem>
+    <para>Whenever unfree packages are not allowed, packages can still
+    be whitelisted by their license:
+
+<programlisting>
+whitelistedLicenses = with stdenv.lib.licenses; [ amd wtfpl ];
+</programlisting>
+    </para>
+  </listitem>
+
+  <listitem>
+    <para>In addition to whitelisting licenses which are denied by the
+    <literal>allowUnfree</literal> setting, you can also explicitely
+    deny installation of packages which have a certain license:
+
+<programlisting>
+blacklistedLicenses = with stdenv.lib.licenses; [ agpl3 gpl3 ];
+</programlisting>
+    </para>
+  </listitem>
+
+</itemizedlist>
+
+<para>A complete list of licenses can be found in the file
+<filename>lib/licenses.nix</filename> of the nix package tree.</para>
+
+
+<!--============================================================-->
+
+<section xml:id="sec-modify-via-packageOverrides"><title>Modify
+packages via <literal>packageOverrides</literal></title>
+
+<para>You can define a function called
+<varname>packageOverrides</varname> in your local
+<filename>~/.nixpkgs/config.nix</filename> to overide nix packages.  It
+must be a function that takes pkgs as an argument and return modified
+set of packages.
+
+<programlisting>
+{
+  packageOverrides = pkgs: rec {
+    foo = pkgs.foo.override { ... };
+  };
+}
+</programlisting>
+
+</para>
+
+</section>
+
+
+</chapter>

doc/default.nix

@@ -1,12 +1,14 @@
 with import ./.. { };
 with lib;
-
+let
+  sources = sourceFilesBySuffices ./. [".xml"];
+  sources-langs = ./languages-frameworks;
+in
 stdenv.mkDerivation {
   name = "nixpkgs-manual";
 
-  sources = sourceFilesBySuffices ./. [".xml"];
 
-  buildInputs = [ libxml2 libxslt ];
+  buildInputs = [ pandoc libxml2 libxslt ];
 
   xsltFlags = ''
     --param section.autolabel 1
@@ -18,14 +20,52 @@ stdenv.mkDerivation {
     --param callout.graphics.extension '.gif'
   '';
 
-  buildCommand = ''
-    ln -s $sources/*.xml . # */
 
+  buildCommand = let toDocbook = { useChapters ? false, inputFile, outputFile }:
+    let
+      extraHeader = ''xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" '';
+    in ''
+      {
+        pandoc '${inputFile}' -w docbook ${optionalString useChapters "--chapters"} \
+          | sed -e 's|<ulink url=|<link xlink:href=|' \
+              -e 's|</ulink>|</link>|' \
+              -e 's|<sect. id=|<section xml:id=|' \
+              -e 's|</sect[0-9]>|</section>|' \
+              -e '1s| id=| xml:id=|' \
+              -e '1s|\(<[^ ]* \)|\1${extraHeader}|'
+      } > '${outputFile}'
+    '';
+  in
+
+  ''
+    ln -s '${sources}/'*.xml .
+    mkdir ./languages-frameworks
+    cp -s '${sources-langs}'/* ./languages-frameworks
+  ''
+  + toDocbook {
+      inputFile = ./introduction.md;
+      outputFile = "introduction.xml";
+      useChapters = true;
+    }
+  + toDocbook {
+      inputFile = ./haskell-users-guide.md;
+      outputFile = "haskell-users-guide.xml";
+      useChapters = true;
+    }
+  + toDocbook {
+      inputFile = ./../pkgs/development/idris-modules/README.md;
+      outputFile = "languages-frameworks/idris.xml";
+    }
+  + toDocbook {
+      inputFile = ./../pkgs/development/r-modules/README.md;
+      outputFile = "languages-frameworks/r.xml";
+    }
+  + ''
     echo ${nixpkgsVersion} > .version
 
-    xmllint --noout --nonet --xinclude --noxincludenode \
-      --relaxng ${docbook5}/xml/rng/docbook/docbook.rng \
-      manual.xml
+    # validate against relaxng schema
+    xmllint --nonet --xinclude --noxincludenode manual.xml --output manual-full.xml
+    ${jing}/bin/jing ${docbook5}/xml/rng/docbook/docbook.rng manual-full.xml
 
     dst=$out/share/doc/nixpkgs
     mkdir -p $dst
@@ -37,7 +77,7 @@ stdenv.mkDerivation {
     cp ${./style.css} $dst/style.css
 
     mkdir -p $dst/images/callouts
-    cp ${docbook5_xsl}/xml/xsl/docbook/images/callouts/*.gif $dst/images/callouts/
+    cp "${docbook5_xsl}/xml/xsl/docbook/images/callouts/"*.gif $dst/images/callouts/
 
     mkdir -p $out/nix-support
     echo "doc manual $dst manual.html" >> $out/nix-support/hydra-build-products

doc/erlang-users-guide.xml

@@ -0,0 +1,305 @@
+<chapter xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xml:id="users-guide-to-the-erlang-infrastructure">
+
+<title>User's Guide to the Erlang Infrastructure</title>
+<section xml:id="build-tools">
+  <title>Build Tools</title>
+  <para>
+    By default Rebar3 wants to manage it's own dependencies. In the
+    normal non-Nix, this is perfectly acceptable. In the Nix world it
+    is not. To support this we have created two versions of rebar3,
+    <literal>rebar3</literal> and <literal>rebar3-open</literal>. The
+    <literal>rebar3</literal> version has been patched to remove the
+    ability to download anything from it. If you are not running it a
+    nix-shell or a nix-build then its probably not going to work for
+    you. <literal>rebar3-open</literal> is the normal, un-modified
+    rebar3. It should work exactly as would any other version of
+    rebar3. Any Erlang package should rely on
+    <literal>rebar3</literal> and thats really what you should be
+    using too.
+  </para>
+</section>
+
+<section xml:id="how-to-install-erlang-packages">
+  <title>How to install Erlang packages</title>
+  <para>
+    Erlang packages are not registered in the top level simply because
+    they are not relevant to the vast majority of Nix users. They are
+    installable using the <literal>erlangPackages</literal> attribute set.
+
+    You can list the avialable packages in the
+    <literal>erlangPackages</literal> with the following command:
+  </para>
+
+  <programlisting>
+$ nix-env -f &quot;&lt;nixpkgs&gt;&quot; -qaP -A erlangPackages
+erlangPackages.esqlite    esqlite-0.2.1
+erlangPackages.goldrush   goldrush-0.1.7
+erlangPackages.ibrowse    ibrowse-4.2.2
+erlangPackages.jiffy      jiffy-0.14.5
+erlangPackages.lager      lager-3.0.2
+erlangPackages.meck       meck-0.8.3
+erlangPackages.rebar3-pc  pc-1.1.0
+  </programlisting>
+  <para>
+    To install any of those packages into your profile, refer to them by
+    their attribute path (first column):
+  </para>
+  <programlisting>
+$ nix-env -f &quot;&lt;nixpkgs&gt;&quot; -iA erlangPackages.ibrowse
+  </programlisting>
+  <para>
+    The attribute path of any Erlang packages corresponds to the name
+    of that particular package in Hex or its OTP Application/Release name.
+  </para>
+</section>
+<section xml:id="packaging-erlang-applications">
+  <title>Packaging Erlang Applications</title>
+  <section xml:id="rebar3-packages">
+    <title>Rebar3 Packages</title>
+    <para>
+      There is a Nix functional called
+      <literal>buildRebar3</literal>. We use this function to make a
+      derivation that understands how to build the rebar3 project. For
+      example, the epression we use to build the <link
+      xlink:href="https://github.com/erlang-nix/hex2nix">hex2nix</link>
+      project follows.
+    </para>
+    <programlisting>
+{stdenv, fetchFromGitHub, buildRebar3, ibrowse, jsx, erlware_commons }:
+
+buildRebar3 rec {
+    name = "hex2nix";
+    version = "0.0.1";
+
+    src = fetchFromGitHub {
+        owner = "ericbmerritt";
+        repo = "hex2nix";
+        rev = "${version}";
+        sha256 = "1w7xjidz1l5yjmhlplfx7kphmnpvqm67w99hd2m7kdixwdxq0zqg";
+    };
+
+    erlangDeps = [ ibrowse jsx erlware_commons ];
+}
+    </programlisting>
+    <para>
+      The only visible difference between this derivation and
+      something like <literal>stdenv.mkDerivation</literal> is that we
+      have added <literal>erlangDeps</literal> to the derivation. If
+      you add your Erlang dependencies here they will be correctly
+      handled by the system.
+    </para>
+    <para>
+      If your package needs to compile native code via Rebar's port
+      compilation mechenism. You should add <literal>compilePort =
+      true;</literal> to the derivation.
+    </para>
+  </section>
+
+  <section xml:id="hex-packages">
+    <title>Hex Packages</title>
+    <para>
+      Hex packages are based on Rebar packages. In fact, at the moment
+      we can only compile Hex packages that are buildable with
+      Rebar3. Packages that use Mix and other build systems are not
+      supported. That being said, we know a lot more about Hex and can
+      do more for you.
+    </para>
+    <programlisting>
+{ buildHex }:
+  buildHex {
+    name = "esqlite";
+    version = "0.2.1";
+    sha256 = "1296fn1lz4lz4zqzn4dwc3flgkh0i6n4sydg501faabfbv8d3wkr";
+    compilePort = true;
+}
+    </programlisting>
+    <para>
+      For Hex packages you need to provide the name, the version, and
+      the Sha 256 digest of the package and use
+      <literal>buildHex</literal> to build it. Obviously, the package
+      needs to have already been published to Hex.
+    </para>
+  </section>
+</section>
+<section xml:id="how-to-develop">
+  <title>How to develop</title>
+  <section xml:id="accessing-an-environment">
+    <title>Accessing an Environment</title>
+    <para>
+      Often, all you want to do is be able to access a valid
+      environment that contains a specific package and its
+      dependencies. we can do that with the <literal>env</literal>
+      part of a derivation. For example, lets say we want to access an
+      erlang repl with ibrowse loaded up. We could do the following.
+    </para>
+    <programlisting>
+      ~/w/nixpkgs ❯❯❯ nix-shell -A erlangPackages.ibrowse.env --run "erl"
+      Erlang/OTP 18 [erts-7.0] [source] [64-bit] [smp:4:4] [async-threads:10] [hipe] [kernel-poll:false]
+
+      Eshell V7.0  (abort with ^G)
+      1> m(ibrowse).
+      Module: ibrowse
+      MD5: 3b3e0137d0cbb28070146978a3392945
+      Compiled: January 10 2016, 23:34
+      Object file: /nix/store/g1rlf65rdgjs4abbyj4grp37ry7ywivj-ibrowse-4.2.2/lib/erlang/lib/ibrowse-4.2.2/ebin/ibrowse.beam
+      Compiler options:  [{outdir,"/tmp/nix-build-ibrowse-4.2.2.drv-0/hex-source-ibrowse-4.2.2/_build/default/lib/ibrowse/ebin"},
+      debug_info,debug_info,nowarn_shadow_vars,
+      warn_unused_import,warn_unused_vars,warnings_as_errors,
+      {i,"/tmp/nix-build-ibrowse-4.2.2.drv-0/hex-source-ibrowse-4.2.2/_build/default/lib/ibrowse/include"}]
+      Exports:
+      add_config/1                  send_req_direct/7
+      all_trace_off/0               set_dest/3
+      code_change/3                 set_max_attempts/3
+      get_config_value/1            set_max_pipeline_size/3
+      get_config_value/2            set_max_sessions/3
+      get_metrics/0                 show_dest_status/0
+      get_metrics/2                 show_dest_status/1
+      handle_call/3                 show_dest_status/2
+      handle_cast/2                 spawn_link_worker_process/1
+      handle_info/2                 spawn_link_worker_process/2
+      init/1                        spawn_worker_process/1
+      module_info/0                 spawn_worker_process/2
+      module_info/1                 start/0
+      rescan_config/0               start_link/0
+      rescan_config/1               stop/0
+      send_req/3                    stop_worker_process/1
+      send_req/4                    stream_close/1
+      send_req/5                    stream_next/1
+      send_req/6                    terminate/2
+      send_req_direct/4             trace_off/0
+      send_req_direct/5             trace_off/2
+      send_req_direct/6             trace_on/0
+      trace_on/2
+      ok
+      2>
+    </programlisting>
+    <para>
+      Notice the <literal>-A erlangPackages.ibrowse.env</literal>.That
+      is the key to this functionality.
+    </para>
+  </section>
+  <section xml:id="creating-a-shell">
+    <title>Creating a Shell</title>
+    <para>
+      Getting access to an environment often isn't enough to do real
+      development. Many times we need to create a
+      <literal>shell.nix</literal> file and do our development inside
+      of the environment specified by that file. This file looks a lot
+      like the packageing described above. The main difference is that
+      <literal>src</literal> points to project root and we call the
+      package directly.
+    </para>
+    <programlisting>
+{ pkgs ? import &quot;&lt;nixpkgs&quot;&gt; {} }:
+
+with pkgs;
+
+let
+
+  f = { buildHex, ibrowse, jsx, erlware_commons }:
+      buildHex {
+        name = "hex2nix";
+        version = "0.1.0";
+        src = ./.;
+        erlangDeps = [ ibrowse jsx erlware_commons ];
+      };
+  drv = erlangPackages.callPackage f {};
+
+in
+ drv
+    </programlisting>
+    <section xml:id="building-in-a-shell">
+    <title>Building in a shell</title>
+    <para>
+      Unfortunatly for us users of Nix, Rebar isn't very cooperative
+      with us from the standpoint of building a hermetic
+      environment. When building the rebar3 support we had to do some
+      sneaky things to get it not to go out and pull packages on its
+      own. Also unfortunately, you have to do some of the same things
+      when building a project inside of a Nix shell.
+
+      <orderedlist numeration="arabic">
+        <listitem>
+          <para>Run <literal>rebar3-nix-bootstrap</literal> every time
+          dependencies change</para>
+        </listitem>
+        <listitem>
+          <para>Set Home to the current directory.</para>
+        </listitem>
+      </orderedlist>
+
+      If you do these two things then Rebar will be happy with you. I
+      codify these into a makefile. Forunately, rebar3-nix-bootstrap
+      is idempotent and fairly quick. so you can run it as often as
+      you like.
+    </para>
+    <programlisting>
+# =============================================================================
+# Rules
+# =============================================================================
+.PHONY= all test clean repl shell build test analyze bootstrap
+
+all: test
+
+clean:
+        rm -rf _build
+        rm -rf .cache
+
+repl:
+        nix-shell --run "erl"
+
+shell:
+        nix-shell --run "bash"
+
+bootstrap:
+        nix-shell --pure --run "rebar3-nix-bootstrap"
+
+build: bootstrap
+        nix-shell --pure --run "HOME=$(CURDIR) rebar3 compile"
+
+analyze: bootstrap
+        nix-shell --pure --run "HOME=$(CURDIR) rebar3 do compile,dialyzer"
+
+test: bootstrap
+        nix-shell --pure --run "HOME=$(CURDIR) rebar3 do compile,dialyzer,eunit"
+
+    </programlisting>
+    <para>
+      If you add the <literal>shell.nix</literal> as described and
+      user rebar as follows things should simply work.
+    </para>
+  </section>
+</section>
+</section>
+<section xml:id="generating-packages-from-hex-with-hex2nix">
+  <title>Generating Packages from Hex with Hex2Nix</title>
+  <para>
+    Updating the Hex packages requires the use of the
+    <literal>hex2nix</literal> tool. Given the path to the Erlang
+    modules (usually
+    <literal>pkgs/development/erlang-modules</literal>). It will
+    happily dump a file called
+    <literal>hex-packages.nix</literal>. That file will contain all
+    the packages that use a recognized build system in Hex. However,
+    it can't know whether or not all those packages are buildable.
+    </para>
+    <para>
+      To make life easier for our users, it makes good sense to go
+      ahead and attempt to build all those packages and remove the
+      ones that don't build. To do that, simply run the command (in
+      the root of your <literal>nixpkgs</literal> repository). that follows.
+    </para>
+    <programlisting>
+$ nix-build -A erlangPackages
+    </programlisting>
+    <para>
+      That will build every package in
+      <literal>erlangPackages</literal>. Then you can go through and
+      manually remove the ones that fail. Hopefully, someone will
+      improve <literal>hex2nix</literal> in the future to automate
+      that.
+    </para>
+</section>
+</chapter>

doc/functions.xml

@@ -88,6 +88,13 @@ in ...</programlisting>
 <section xml:id="sec-pkg-overrideDerivation">
   <title>&lt;pkg&gt;.overrideDerivation</title>
 
+  <warning>
+    <para>Do not use this function in Nixpkgs. Because it breaks
+    package abstraction and doesn’t provide error checking for
+    function arguments, it is only intended for ad-hoc customisation
+    (such as in <filename>~/.nixpkgs/config.nix</filename>).</para>
+  </warning>
+
   <para>
     The function <varname>overrideDerivation</varname> is usually available for all the
     derivations in the nixpkgs expression (<varname>pkgs</varname>).
@@ -127,7 +134,7 @@ in ...</programlisting>
   <title>lib.makeOverridable</title>
 
   <para>
-    The function <varname>lib.makeOverridable</varname> is used make the result
+    The function <varname>lib.makeOverridable</varname> is used to make the result
     of a function easily customizable. This utility only makes sense for functions
     that accept an argument set and return an attribute set.
   </para>
@@ -270,7 +277,7 @@ c = lib.makeOverridable f { a = 1; b = 2; }</programlisting>
   multiPkgs = pkgs: (with pkgs;
     [ udev
       alsaLib
-    ]) ++ (with [];
+    ]);
   runScript = "bash";
 }).env
 ]]></programlisting>
@@ -284,4 +291,339 @@ c = lib.makeOverridable f { a = 1; b = 2; }</programlisting>
   </para>
 </section>
 
+<section xml:id="sec-pkgs-dockerTools">
+ <title>pkgs.dockerTools</title>
+
+ <para>
+  <varname>pkgs.dockerTools</varname> is a set of functions for creating and
+  manipulating Docker images according to the
+  <link xlink:href="https://github.com/docker/docker/blob/master/image/spec/v1.md#docker-image-specification-v100">
+   Docker Image Specification v1.0.0
+  </link>. Docker itself is not used to perform any of the operations done by these
+  functions.
+ </para>
+
+ <warning>
+  <para>
+   The <varname>dockerTools</varname> API is unstable and may be subject to
+   backwards-incompatible changes in the future.
+  </para>
+ </warning>
+
+ <section xml:id="ssec-pkgs-dockerTools-buildImage">
+  <title>buildImage</title>
+
+  <para>
+   This function is analogous to the <command>docker build</command> command,
+   in that can used to build a Docker-compatible repository tarball containing
+   a single image with one or multiple layers. As such, the result
+   is suitable for being loaded in Docker with <command>docker load</command>.
+  </para>
+
+  <para>
+   The parameters of <varname>buildImage</varname> with relative example values are
+   described below:
+  </para>
+
+  <example xml:id='ex-dockerTools-buildImage'><title>Docker build</title>
+  <programlisting>
+  buildImage {
+    name = "redis"; <co xml:id='ex-dockerTools-buildImage-1' />
+    tag = "latest"; <co xml:id='ex-dockerTools-buildImage-2' />
+    
+    fromImage = someBaseImage; <co xml:id='ex-dockerTools-buildImage-3' />
+    fromImageName = null; <co xml:id='ex-dockerTools-buildImage-4' />
+    fromImageTag = "latest"; <co xml:id='ex-dockerTools-buildImage-5' />
+    
+    contents = pkgs.redis; <co xml:id='ex-dockerTools-buildImage-6' />
+    runAsRoot = '' <co xml:id='ex-dockerTools-buildImage-runAsRoot' />
+      #!${stdenv.shell}
+      mkdir -p /data
+    '';
+
+    config = { <co xml:id='ex-dockerTools-buildImage-8' />
+      Cmd = [ "/bin/redis-server" ];
+      WorkingDir = "/data";
+      Volumes = {
+        "/data" = {};
+      };
+    };
+  }
+  </programlisting>
+  </example>
+
+  <para>The above example will build a Docker image <literal>redis/latest</literal>
+   from the given base image. Loading and running this image in Docker results in
+   <literal>redis-server</literal> being started automatically.
+  </para>
+
+  <calloutlist>
+   <callout arearefs='ex-dockerTools-buildImage-1'>
+    <para>
+     <varname>name</varname> specifies the name of the resulting image.
+     This is the only required argument for <varname>buildImage</varname>.
+    </para>
+   </callout>
+
+   <callout arearefs='ex-dockerTools-buildImage-2'>
+    <para>
+     <varname>tag</varname> specifies the tag of the resulting image.
+     By default it's <literal>latest</literal>.
+    </para>
+   </callout>
+
+   <callout arearefs='ex-dockerTools-buildImage-3'>
+    <para>
+     <varname>fromImage</varname> is the repository tarball containing the base image.
+     It must be a valid Docker image, such as exported by <command>docker save</command>.
+     By default it's <literal>null</literal>, which can be seen as equivalent
+     to <literal>FROM scratch</literal> of a <filename>Dockerfile</filename>.
+    </para>
+   </callout>
+   
+   <callout arearefs='ex-dockerTools-buildImage-4'>
+    <para>
+     <varname>fromImageName</varname> can be used to further specify
+     the base image within the repository, in case it contains multiple images.
+     By default it's <literal>null</literal>, in which case
+     <varname>buildImage</varname> will peek the first image available
+     in the repository.
+    </para>
+   </callout>
+
+   <callout arearefs='ex-dockerTools-buildImage-5'>
+    <para>
+     <varname>fromImageTag</varname> can be used to further specify the tag
+     of the base image within the repository, in case an image contains multiple tags.
+     By default it's <literal>null</literal>, in which case
+     <varname>buildImage</varname> will peek the first tag available for the base image.
+    </para>
+   </callout>
+
+   <callout arearefs='ex-dockerTools-buildImage-6'>
+    <para>
+     <varname>contents</varname> is a derivation that will be copied in the new
+     layer of the resulting image. This can be similarly seen as
+     <command>ADD contents/ /</command> in a <filename>Dockerfile</filename>.
+     By default it's <literal>null</literal>.
+    </para>
+   </callout>
+
+   <callout arearefs='ex-dockerTools-buildImage-runAsRoot'>
+    <para>
+     <varname>runAsRoot</varname> is a bash script that will run as root
+     in an environment that overlays the existing layers of the base image with
+     the new resulting layer, including the previously copied
+     <varname>contents</varname> derivation.
+     This can be similarly seen as
+     <command>RUN ...</command> in a <filename>Dockerfile</filename>.
+     
+     <note>
+      <para>
+       Using this parameter requires the <literal>kvm</literal>
+       device to be available.
+      </para>
+     </note>
+    </para>
+   </callout>
+
+   <callout arearefs='ex-dockerTools-buildImage-8'>
+    <para>
+     <varname>config</varname> is used to specify the configuration of the
+     containers that will be started off the built image in Docker.
+     The available options are listed in the
+     <link xlink:href="https://github.com/docker/docker/blob/master/image/spec/v1.md#container-runconfig-field-descriptions">
+      Docker Image Specification v1.0.0
+     </link>.
+    </para>
+   </callout>
+
+  </calloutlist>
+
+  <para>
+   After the new layer has been created, its closure
+   (to which <varname>contents</varname>, <varname>config</varname> and
+   <varname>runAsRoot</varname> contribute) will be copied in the layer itself.
+   Only new dependencies that are not already in the existing layers will be copied.
+  </para>
+
+  <para>
+   At the end of the process, only one new single layer will be produced and
+   added to the resulting image.
+  </para>
+
+  <para>
+   The resulting repository will only list the single image
+   <varname>image/tag</varname>. In the case of <xref linkend='ex-dockerTools-buildImage'/>
+   it would be <varname>redis/latest</varname>.
+  </para>
+
+  <para>
+   It is possible to inspect the arguments with which an image was built
+   using its <varname>buildArgs</varname> attribute.
+  </para>
+
+ </section>
+
+ <section xml:id="ssec-pkgs-dockerTools-fetchFromRegistry">
+  <title>pullImage</title>
+
+  <para>
+   This function is analogous to the <command>docker pull</command> command,
+   in that can be used to fetch a Docker image from a Docker registry.
+   Currently only registry <literal>v1</literal> is supported.
+   By default <link xlink:href="https://hub.docker.com/">Docker Hub</link>
+   is used to pull images.
+  </para>
+
+  <para>
+   Its parameters are described in the example below:
+  </para>
+
+  <example xml:id='ex-dockerTools-pullImage'><title>Docker pull</title>
+  <programlisting>
+  pullImage {
+    imageName = "debian"; <co xml:id='ex-dockerTools-pullImage-1' />
+    imageTag = "jessie"; <co xml:id='ex-dockerTools-pullImage-2' />
+    imageId = null; <co xml:id='ex-dockerTools-pullImage-3' />
+    sha256 = "1bhw5hkz6chrnrih0ymjbmn69hyfriza2lr550xyvpdrnbzr4gk2"; <co xml:id='ex-dockerTools-pullImage-4' />
+
+    indexUrl = "https://index.docker.io"; <co xml:id='ex-dockerTools-pullImage-5' />
+    registryVersion = "v1";
+  }
+  </programlisting>
+  </example>
+
+  <calloutlist>
+   <callout arearefs='ex-dockerTools-pullImage-1'>
+    <para>
+     <varname>imageName</varname> specifies the name of the image to be downloaded,
+     which can also include the registry namespace (e.g. <literal>library/debian</literal>).
+     This argument is required.
+    </para>
+   </callout>
+   
+   <callout arearefs='ex-dockerTools-pullImage-2'>
+    <para>
+     <varname>imageTag</varname> specifies the tag of the image to be downloaded.
+     By default it's <literal>latest</literal>.
+    </para>
+   </callout>
+
+   <callout arearefs='ex-dockerTools-pullImage-3'>
+    <para>
+     <varname>imageId</varname>, if specified this exact image will be fetched, instead
+     of <varname>imageName/imageTag</varname>. However, the resulting repository
+     will still be named <varname>imageName/imageTag</varname>.
+     By default it's <literal>null</literal>.
+    </para>
+   </callout>
+
+   <callout arearefs='ex-dockerTools-pullImage-4'>
+    <para>
+     <varname>sha256</varname> is the checksum of the whole fetched image.
+     This argument is required.
+    </para>
+
+    <note>
+     <para>The checksum is computed on the unpacked directory, not on the final tarball.</para>
+    </note>
+
+   </callout>
+
+   <callout arearefs='ex-dockerTools-pullImage-5'>
+    <para>
+     In the above example the default values are shown for the variables
+     <varname>indexUrl</varname> and <varname>registryVersion</varname>.
+     Hence by default the Docker.io registry is used to pull the images.
+    </para>
+   </callout>
+  </calloutlist>
+   
+ </section>
+  
+ <section xml:id="ssec-pkgs-dockerTools-exportImage">
+  <title>exportImage</title>
+
+  <para>
+   This function is analogous to the <command>docker export</command> command,
+   in that can used to flatten a Docker image that contains multiple layers.
+   It is in fact the result of the merge of all the layers of the image.
+   As such, the result is suitable for being imported in Docker
+   with <command>docker import</command>.
+  </para>
+
+  <note>
+   <para>
+    Using this function requires the <literal>kvm</literal>
+    device to be available.
+   </para>
+  </note>
+
+  <para>
+   The parameters of <varname>exportImage</varname> are the following:
+  </para>
+
+  <example xml:id='ex-dockerTools-exportImage'><title>Docker export</title>
+  <programlisting>
+  exportImage {
+    fromImage = someLayeredImage;
+    fromImageName = null;
+    fromImageTag = null;
+    
+    name = someLayeredImage.name;
+  }
+  </programlisting>
+  </example>
+
+  <para>
+   The parameters relative to the base image have the same synopsis as
+   described in <xref linkend='ssec-pkgs-dockerTools-buildImage'/>, except that
+   <varname>fromImage</varname> is the only required argument in this case.
+  </para>
+
+  <para>
+   The <varname>name</varname> argument is the name of the derivation output,
+   which defaults to <varname>fromImage.name</varname>.
+  </para>
+ </section>
+
+ <section xml:id="ssec-pkgs-dockerTools-shadowSetup">
+  <title>shadowSetup</title>
+
+  <para>
+   This constant string is a helper for setting up the base files for managing
+   users and groups, only if such files don't exist already.
+   It is suitable for being used in a
+   <varname>runAsRoot</varname> <xref linkend='ex-dockerTools-buildImage-runAsRoot'/> script for cases like
+   in the example below:
+  </para>
+  
+  <example xml:id='ex-dockerTools-shadowSetup'><title>Shadow base files</title>
+  <programlisting>
+  buildImage {
+    name = "shadow-basic";
+
+    runAsRoot = ''
+      #!${stdenv.shell}
+      ${shadowSetup}
+      groupadd -r redis
+      useradd -r -g redis redis
+      mkdir /data
+      chown redis:redis /data
+    '';
+  }
+  </programlisting>
+  </example>
+
+  <para>
+   Creating base files like <literal>/etc/passwd</literal> or
+   <literal>/etc/login.defs</literal> are necessary for shadow-utils to
+   manipulate users and groups.
+  </para>
+  
+ </section>
+ 
+</section>
+
 </chapter>

doc/haskell-users-guide.md

@@ -0,0 +1,784 @@
+---
+title: User's Guide for Haskell in Nixpkgs
+author: Peter Simons
+date: 2015-06-01
+---
+# User's Guide to the Haskell Infrastructure
+
+
+## How to install Haskell packages
+
+Nixpkgs distributes build instructions for all Haskell packages registered on
+[Hackage](http://hackage.haskell.org/), but strangely enough normal Nix package
+lookups don't seem to discover any of them, except for the default version of ghc, cabal-install, and stack:
+
+    $ nix-env -i alex
+    error: selector ‘alex’ matches no derivations
+    $ nix-env -qa ghc
+    ghc-7.10.2
+
+The Haskell package set is not registered in the top-level namespace because it
+is *huge*. If all Haskell packages were visible to these commands, then
+name-based search/install operations would be much slower than they are now. We
+avoided that by keeping all Haskell-related packages in a separate attribute
+set called `haskellPackages`, which the following command will list:
+
+    $ nix-env -f "<nixpkgs>" -qaP -A haskellPackages
+    haskellPackages.a50         a50-0.5
+    haskellPackages.abacate     haskell-abacate-0.0.0.0
+    haskellPackages.abcBridge   haskell-abcBridge-0.12
+    haskellPackages.afv         afv-0.1.1
+    haskellPackages.alex        alex-3.1.4
+    haskellPackages.Allure      Allure-0.4.101.1
+    haskellPackages.alms        alms-0.6.7
+    [... some 8000 entries omitted  ...]
+
+To install any of those packages into your profile, refer to them by their
+attribute path (first column):
+
+    $ nix-env -f "<nixpkgs>" -iA haskellPackages.Allure ...
+
+The attribute path of any Haskell packages corresponds to the name of that
+particular package on Hackage: the package `cabal-install` has the attribute
+`haskellPackages.cabal-install`, and so on. (Actually, this convention causes
+trouble with packages like `3dmodels` and `4Blocks`, because these names are
+invalid identifiers in the Nix language. The issue of how to deal with these
+rare corner cases is currently unresolved.)
+
+Haskell packages who's Nix name (second column) begins with a `haskell-` prefix
+are packages that provide a library whereas packages without that prefix
+provide just executables. Libraries may provide executables too, though: the
+package `haskell-pandoc`, for example, installs both a library and an
+application. You can install and use Haskell executables just like any other
+program in Nixpkgs, but using Haskell libraries for development is a bit
+trickier and we'll address that subject in great detail in section [How to
+create a development environment].
+
+Attribute paths are deterministic inside of Nixpkgs, but the path necessary to
+reach Nixpkgs varies from system to system. We dodged that problem by giving
+`nix-env` an explicit `-f "<nixpkgs>"` parameter, but if you call `nix-env`
+without that flag, then chances are the invocation fails:
+
+    $ nix-env -iA haskellPackages.cabal-install
+    error: attribute ‘haskellPackages’ in selection path
+           ‘haskellPackages.cabal-install’ not found
+
+On NixOS, for example, Nixpkgs does *not* exist in the top-level namespace by
+default. To figure out the proper attribute path, it's easiest to query for the
+path of a well-known Nixpkgs package, i.e.:
+
+    $ nix-env -qaP coreutils
+    nixos.coreutils  coreutils-8.23
+
+If your system responds like that (most NixOS installations will), then the
+attribute path to `haskellPackages` is `nixos.haskellPackages`. Thus, if you
+want to use `nix-env` without giving an explicit `-f` flag, then that's the way
+to do it:
+
+    $ nix-env -qaP -A nixos.haskellPackages
+    $ nix-env -iA nixos.haskellPackages.cabal-install
+
+Our current default compiler is GHC 7.10.x and the `haskellPackages` set
+contains packages built with that particular version. Nixpkgs contains the
+latest major release of every GHC since 6.10.4, however, and there is a whole
+family of package sets available that defines Hackage packages built with each
+of those compilers, too:
+
+    $ nix-env -f "<nixpkgs>" -qaP -A haskell.packages.ghc6123
+    $ nix-env -f "<nixpkgs>" -qaP -A haskell.packages.ghc763
+
+The name `haskellPackages` is really just a synonym for
+`haskell.packages.ghc7102`, because we prefer that package set internally and
+recommend it to our users as their default choice, but ultimately you are free
+to compile your Haskell packages with any GHC version you please. The following
+command displays the complete list of available compilers:
+
+    $ nix-env -f "<nixpkgs>" -qaP -A haskell.compiler
+    haskell.compiler.ghc6104        ghc-6.10.4
+    haskell.compiler.ghc6123        ghc-6.12.3
+    haskell.compiler.ghc704         ghc-7.0.4
+    haskell.compiler.ghc722         ghc-7.2.2
+    haskell.compiler.ghc742         ghc-7.4.2
+    haskell.compiler.ghc763         ghc-7.6.3
+    haskell.compiler.ghc784         ghc-7.8.4
+    haskell.compiler.ghc7102        ghc-7.10.2
+    haskell.compiler.ghcHEAD        ghc-7.11.20150402
+    haskell.compiler.ghcNokinds     ghc-nokinds-7.11.20150704
+    haskell.compiler.ghcjs          ghcjs-0.1.0
+    haskell.compiler.jhc            jhc-0.8.2
+    haskell.compiler.uhc            uhc-1.1.9.0
+
+We have no package sets for `jhc` or `uhc` yet, unfortunately, but for every
+version of GHC listed above, there exists a package set based on that compiler.
+Also, the attributes `haskell.compiler.ghcXYC` and
+`haskell.packages.ghcXYC.ghc` are synonymous for the sake of convenience.
+
+## How to create a development environment
+
+### How to install a compiler
+
+A simple development environment consists of a Haskell compiler and one or both
+of the tools `cabal-install` and `stack`. We saw in section
+[How to install Haskell packages] how you can install those programs into your
+user profile:
+
+    $ nix-env -f "<nixpkgs>" -iA haskellPackages.ghc haskellPackages.cabal-install
+
+Instead of the default package set `haskellPackages`, you can also use the more
+precise name `haskell.compiler.ghc7102`, which has the advantage that it refers
+to the same GHC version regardless of what Nixpkgs considers "default" at any
+given time.
+
+Once you've made those tools available in `$PATH`, it's possible to build
+Hackage packages the same way people without access to Nix do it all the time:
+
+    $ cabal get lens-4.11 && cd lens-4.11
+    $ cabal install -j --dependencies-only
+    $ cabal configure
+    $ cabal build
+
+If you enjoy working with Cabal sandboxes, then that's entirely possible too:
+just execute the command
+
+    $ cabal sandbox init
+
+before installing the required dependencies.
+
+The `nix-shell` utility makes it easy to switch to a different compiler
+version; just enter the Nix shell environment with the command
+
+    $ nix-shell -p haskell.compiler.ghc784
+
+to bring GHC 7.8.4 into `$PATH`. Alternatively, you can use Stack instead of
+`nix-shell` directly to select compiler versions and other build tools
+per-project. It uses `nix-shell` under the hood when Nix support is turned on.
+See [How to build a Haskell project using Stack].
+
+If you're using `cabal-install`, re-running `cabal configure` inside the spawned
+shell switches your build to use that compiler instead. If you're working on
+a project that doesn't depend on any additional system libraries outside of GHC,
+then it's even sufficient to just run the `cabal configure` command inside of
+the shell:
+
+    $ nix-shell -p haskell.compiler.ghc784 --command "cabal configure"
+
+Afterwards, all other commands like `cabal build` work just fine in any shell
+environment, because the configure phase recorded the absolute paths to all
+required tools like GHC in its build configuration inside of the `dist/`
+directory. Please note, however, that `nix-collect-garbage` can break such an
+environment because the Nix store paths created by `nix-shell` aren't "alive"
+anymore once `nix-shell` has terminated. If you find that your Haskell builds
+no longer work after garbage collection, then you'll have to re-run `cabal
+configure` inside of a new `nix-shell` environment.
+
+### How to install a compiler with libraries
+
+GHC expects to find all installed libraries inside of its own `lib` directory.
+This approach works fine on traditional Unix systems, but it doesn't work for
+Nix, because GHC's store path is immutable once it's built. We cannot install
+additional libraries into that location. As a consequence, our copies of GHC
+don't know any packages except their own core libraries, like `base`,
+`containers`, `Cabal`, etc.
+
+We can register additional libraries to GHC, however, using a special build
+function called `ghcWithPackages`. That function expects one argument: a
+function that maps from an attribute set of Haskell packages to a list of
+packages, which determines the libraries known to that particular version of
+GHC. For example, the Nix expression `ghcWithPackages (pkgs: [pkgs.mtl])`
+generates a copy of GHC that has the `mtl` library registered in addition to
+its normal core packages:
+
+    $ nix-shell -p "haskellPackages.ghcWithPackages (pkgs: [pkgs.mtl])"
+
+    [nix-shell:~]$ ghc-pkg list mtl
+    /nix/store/zy79...-ghc-7.10.2/lib/ghc-7.10.2/package.conf.d:
+        mtl-2.2.1
+
+This function allows users to define their own development environment by means
+of an override. After adding the following snippet to `~/.nixpkgs/config.nix`,
+
+    {
+      packageOverrides = super: let self = super.pkgs; in
+      {
+        myHaskellEnv = self.haskell.packages.ghc7102.ghcWithPackages
+                         (haskellPackages: with haskellPackages; [
+                           # libraries
+                           arrows async cgi criterion
+                           # tools
+                           cabal-install haskintex
+                         ]);
+      };
+    }
+
+it's possible to install that compiler with `nix-env -f "<nixpkgs>" -iA
+myHaskellEnv`. If you'd like to switch that development environment to a
+different version of GHC, just replace the `ghc7102` bit in the previous
+definition with the appropriate name. Of course, it's also possible to define
+any number of these development environments! (You can't install two of them
+into the same profile at the same time, though, because that would result in
+file conflicts.)
+
+The generated `ghc` program is a wrapper script that re-directs the real
+GHC executable to use a new `lib` directory --- one that we specifically
+constructed to contain all those packages the user requested:
+
+    $ cat $(type -p ghc)
+    #! /nix/store/xlxj...-bash-4.3-p33/bin/bash -e
+    export NIX_GHC=/nix/store/19sm...-ghc-7.10.2/bin/ghc
+    export NIX_GHCPKG=/nix/store/19sm...-ghc-7.10.2/bin/ghc-pkg
+    export NIX_GHC_DOCDIR=/nix/store/19sm...-ghc-7.10.2/share/doc/ghc/html
+    export NIX_GHC_LIBDIR=/nix/store/19sm...-ghc-7.10.2/lib/ghc-7.10.2
+    exec /nix/store/j50p...-ghc-7.10.2/bin/ghc "-B$NIX_GHC_LIBDIR" "$@"
+
+The variables `$NIX_GHC`, `$NIX_GHCPKG`, etc. point to the *new* store path
+`ghcWithPackages` constructed specifically for this environment. The last line
+of the wrapper script then executes the real `ghc`, but passes the path to the
+new `lib` directory using GHC's `-B` flag.
+
+The purpose of those environment variables is to work around an impurity in the
+popular [ghc-paths](http://hackage.haskell.org/package/ghc-paths) library. That
+library promises to give its users access to GHC's installation paths. Only,
+the library can't possible know that path when it's compiled, because the path
+GHC considers its own is determined only much later, when the user configures
+it through `ghcWithPackages`. So we [patched
+ghc-paths](https://github.com/NixOS/nixpkgs/blob/master/pkgs/development/haskell-modules/patches/ghc-paths-nix.patch)
+to return the paths found in those environment variables at run-time rather
+than trying to guess them at compile-time.
+
+To make sure that mechanism works properly all the time, we recommend that you
+set those variables to meaningful values in your shell environment, too, i.e.
+by adding the following code to your `~/.bashrc`:
+
+    if type >/dev/null 2>&1 -p ghc; then
+      eval "$(egrep ^export "$(type -p ghc)")"
+    fi
+
+If you are certain that you'll use only one GHC environment which is located in
+your user profile, then you can use the following code, too, which has the
+advantage that it doesn't contain any paths from the Nix store, i.e. those
+settings always remain valid even if a `nix-env -u` operation updates the GHC
+environment in your profile:
+
+    if [ -e ~/.nix-profile/bin/ghc ]; then
+      export NIX_GHC="$HOME/.nix-profile/bin/ghc"
+      export NIX_GHCPKG="$HOME/.nix-profile/bin/ghc-pkg"
+      export NIX_GHC_DOCDIR="$HOME/.nix-profile/share/doc/ghc/html"
+      export NIX_GHC_LIBDIR="$HOME/.nix-profile/lib/ghc-$($NIX_GHC --numeric-version)"
+    fi
+
+### How to install a compiler with libraries, hoogle and documentation indexes
+
+If you plan to use your environment for interactive programming, not just
+compiling random Haskell code, you might want to replace `ghcWithPackages` in
+all the listings above with `ghcWithHoogle`.
+
+This environment generator not only produces an environment with GHC and all
+the specified libraries, but also generates a `hoogle` and `haddock` indexes
+for all the packages, and provides a wrapper script around `hoogle` binary that
+uses all those things. A precise name for this thing would be
+"`ghcWithPackagesAndHoogleAndDocumentationIndexes`", which is, regrettably, too
+long and scary.
+
+For example, installing the following environment
+
+    {
+      packageOverrides = super: let self = super.pkgs; in
+      {
+        myHaskellEnv = self.haskellPackages.ghcWithHoogle
+                         (haskellPackages: with haskellPackages; [
+                           # libraries
+                           arrows async cgi criterion
+                           # tools
+                           cabal-install haskintex
+                         ]);
+      };
+    }
+
+allows one to browse module documentation index [not too dissimilar to
+this](https://downloads.haskell.org/~ghc/latest/docs/html/libraries/index.html)
+for all the specified packages and their dependencies by directing a browser of
+choice to `~/.nix-profiles/share/doc/hoogle/index.html` (or
+`/run/current-system/sw/share/doc/hoogle/index.html` in case you put it in
+`environment.systemPackages` in NixOS).
+
+After you've marveled enough at that try adding the following to your
+`~/.ghc/ghci.conf`
+
+    :def hoogle \s -> return $ ":! hoogle search -cl --count=15 \"" ++ s ++ "\""
+    :def doc \s -> return $ ":! hoogle search -cl --info \"" ++ s ++ "\""
+
+and test it by typing into `ghci`:
+
+    :hoogle a -> a
+    :doc a -> a
+
+Be sure to note the links to `haddock` files in the output. With any modern and
+properly configured terminal emulator you can just click those links to
+navigate there.
+
+Finally, you can run
+
+    hoogle server -p 8080
+
+and navigate to http://localhost:8080/ for your own local
+[Hoogle](https://www.haskell.org/hoogle/). Note, however, that Firefox and
+possibly other browsers disallow navigation from `http:` to `file:` URIs for
+security reasons, which might be quite an inconvenience. See [this
+page](http://kb.mozillazine.org/Links_to_local_pages_do_not_work) for
+workarounds.
+
+### How to build a Haskell project using Stack
+
+[Stack][http://haskellstack.org] is a popular build tool for Haskell projects.
+It has first-class support for Nix. Stack can optionally use Nix to
+automatically select the right version of GHC and other build tools to build,
+test and execute apps in an existing project downloaded from somewhere on the
+Internet. Pass the `--nix` flag to any `stack` command to do so, e.g.
+
+    $ git clone --recursive http://github.com/yesodweb/wai
+    $ cd wai
+    $ stack --nix build
+
+If you want `stack` to use Nix by default, you can add a `nix` section to the
+`stack.yaml` file, as explained in the [Stack documentation][stack-nix-doc]. For
+example:
+
+    nix:
+      enable: true
+      packages: [pkgconfig zeromq zlib]
+
+The example configuration snippet above tells Stack to create an ad hoc
+environment for `nix-shell` as in the below section, in which the `pkgconfig`,
+`zeromq` and `zlib` packages from Nixpkgs are available. All `stack` commands
+will implicitly be executed inside this ad hoc environment.
+
+Some projects have more sophisticated needs. For examples, some ad hoc
+environments might need to expose Nixpkgs packages compiled in a certain way, or
+with extra environment variables. In these cases, you'll need a `shell` field
+instead of `packages`:
+
+    nix:
+      enable: true
+      shell-file: shell.nix
+
+For more on how to write a `shell.nix` file see the below section. You'll need
+to express a derivation. Note that Nixpkgs ships with a convenience wrapper
+function around `mkDerivation` called `haskell.lib.buildStackProject` to help you
+create this derivation in exactly the way Stack expects. All of the same inputs
+as `mkDerivation` can be provided. For example, to build a Stack project that
+including packages that link against a version of the R library compiled with
+special options turned on:
+
+    with (import <nixpkgs> { });
+
+    let R = pkgs.R.override { enableStrictBarrier = true; };
+    in
+	haskell.lib.buildStackProject {
+      name = "HaskellR";
+	  buildInputs = [ R zeromq zlib ];
+    }
+
+[stack-nix-doc]: http://docs.haskellstack.org/en/stable/nix_integration.html
+
+### How to create ad hoc environments for `nix-shell`
+
+The easiest way to create an ad hoc development environment is to run
+`nix-shell` with the appropriate GHC environment given on the command-line:
+
+    nix-shell -p "haskellPackages.ghcWithPackages (pkgs: with pkgs; [mtl pandoc])"
+
+For more sophisticated use-cases, however, it's more convenient to save the
+desired configuration in a file called `shell.nix` that looks like this:
+
+    { nixpkgs ? import <nixpkgs> {}, compiler ? "ghc7102" }:
+    let
+      inherit (nixpkgs) pkgs;
+      ghc = pkgs.haskell.packages.${compiler}.ghcWithPackages (ps: with ps; [
+              monad-par mtl
+            ]);
+    in
+    pkgs.stdenv.mkDerivation {
+      name = "my-haskell-env-0";
+      buildInputs = [ ghc ];
+      shellHook = "eval $(egrep ^export ${ghc}/bin/ghc)";
+    }
+
+Now run `nix-shell` --- or even `nix-shell --pure` --- to enter a shell
+environment that has the appropriate compiler in `$PATH`. If you use `--pure`,
+then add all other packages that your development environment needs into the
+`buildInputs` attribute. If you'd like to switch to a different compiler
+version, then pass an appropriate `compiler` argument to the expression, i.e.
+`nix-shell --argstr compiler ghc784`.
+
+If you need such an environment because you'd like to compile a Hackage package
+outside of Nix --- i.e. because you're hacking on the latest version from Git
+---, then the package set provides suitable nix-shell environments for you
+already! Every Haskell package has an `env` attribute that provides a shell
+environment suitable for compiling that particular package. If you'd like to
+hack the `lens` library, for example, then you just have to check out the
+source code and enter the appropriate environment:
+
+      $ cabal get lens-4.11 && cd lens-4.11
+      Downloading lens-4.11...
+      Unpacking to lens-4.11/
+
+      $ nix-shell "<nixpkgs>" -A haskellPackages.lens.env
+      [nix-shell:/tmp/lens-4.11]$
+
+At point, you can run `cabal configure`, `cabal build`, and all the other
+development commands. Note that you need `cabal-install` installed in your
+`$PATH` already to use it here --- the `nix-shell` environment does not provide
+it.
+
+## How to create Nix builds for your own private Haskell packages
+
+If your own Haskell packages have build instructions for Cabal, then you can
+convert those automatically into build instructions for Nix using the
+`cabal2nix` utility, which you can install into your profile by running
+`nix-env -i cabal2nix`.
+
+### How to build a stand-alone project
+
+For example, let's assume that you're working on a private project called
+`foo`. To generate a Nix build expression for it, change into the project's
+top-level directory and run the command:
+
+    $ cabal2nix . >foo.nix
+
+Then write the following snippet into a file called `default.nix`:
+
+    { nixpkgs ? import <nixpkgs> {}, compiler ? "ghc7102" }:
+    nixpkgs.pkgs.haskell.packages.${compiler}.callPackage ./foo.nix { }
+
+Finally, store the following code in a file called `shell.nix`:
+
+    { nixpkgs ? import <nixpkgs> {}, compiler ? "ghc7102" }:
+    (import ./default.nix { inherit nixpkgs compiler; }).env
+
+At this point, you can run `nix-build` to have Nix compile your project and
+install it into a Nix store path. The local directory will contain a symlink
+called `result` after `nix-build` returns that points into that location. Of
+course, passing the flag `--argstr compiler ghc763` allows switching the build
+to any version of GHC currently supported.
+
+Furthermore, you can call `nix-shell` to enter an interactive development
+environment in which you can use `cabal configure` and `cabal build` to develop
+your code. That environment will automatically contain a proper GHC derivation
+with all the required libraries registered as well as all the system-level
+libraries your package might need.
+
+If your package does not depend on any system-level libraries, then it's
+sufficient to run
+
+    $ nix-shell --command "cabal configure"
+
+once to set up your build. `cabal-install` determines the absolute paths to all
+resources required for the build and writes them into a config file in the
+`dist/` directory. Once that's done, you can run `cabal build` and any other
+command for that project even outside of the `nix-shell` environment. This
+feature is particularly nice for those of us who like to edit their code with
+an IDE, like Emacs' `haskell-mode`, because it's not necessary to start Emacs
+inside of nix-shell just to make it find out the necessary settings for
+building the project; `cabal-install` has already done that for us.
+
+If you want to do some quick-and-dirty hacking and don't want to bother setting
+up a `default.nix` and `shell.nix` file manually, then you can use the
+`--shell` flag offered by `cabal2nix` to have it generate a stand-alone
+`nix-shell` environment for you. With that feature, running
+
+    $ cabal2nix --shell . >shell.nix
+    $ nix-shell --command "cabal configure"
+
+is usually enough to set up a build environment for any given Haskell package.
+You can even use that generated file to run `nix-build`, too:
+
+    $ nix-build shell.nix
+
+### How to build projects that depend on each other
+
+If you have multiple private Haskell packages that depend on each other, then
+you'll have to register those packages in the Nixpkgs set to make them visible
+for the dependency resolution performed by `callPackage`. First of all, change
+into each of your projects top-level directories and generate a `default.nix`
+file with `cabal2nix`:
+
+    $ cd ~/src/foo && cabal2nix . >default.nix
+    $ cd ~/src/bar && cabal2nix . >default.nix
+
+Then edit your `~/.nixpkgs/config.nix` file to register those builds in the
+default Haskell package set:
+
+      {
+        packageOverrides = super: let self = super.pkgs; in
+        {
+          haskellPackages = super.haskellPackages.override {
+            overrides = self: super: {
+              foo = self.callPackage ../src/foo {};
+              bar = self.callPackage ../src/bar {};
+            };
+          };
+        };
+      }
+
+Once that's accomplished, `nix-env -f "<nixpkgs>" -qA haskellPackages` will
+show your packages like any other package from Hackage, and you can build them
+
+    $ nix-build "<nixpkgs>" -A haskellPackages.foo
+
+or enter an interactive shell environment suitable for building them:
+
+    $ nix-shell "<nixpkgs>" -A haskellPackages.bar.env
+
+## Miscellaneous Topics
+
+### How to build with profiling enabled
+
+Every Haskell package set takes a function called `overrides` that you can use
+to manipulate the package as much as you please. One useful application of this
+feature is to replace the default `mkDerivation` function with one that enables
+library profiling for all packages. To accomplish that, add configure the
+following snippet in your `~/.nixpkgs/config.nix` file:
+
+    {
+      packageOverrides = super: let self = super.pkgs; in
+      {
+        profiledHaskellPackages = self.haskellPackages.override {
+          overrides = self: super: {
+            mkDerivation = args: super.mkDerivation (args // {
+              enableLibraryProfiling = true;
+            });
+          };
+        };
+      };
+    }
+
+Then, replace instances of `haskellPackages` in the `cabal2nix`-generated
+`default.nix` or `shell.nix` files with `profiledHaskellPackages`.
+
+### How to override package versions in a compiler-specific package set
+
+Nixpkgs provides the latest version of
+[`ghc-events`](http://hackage.haskell.org/package/ghc-events), which is 0.4.4.0
+at the time of this writing. This is fine for users of GHC 7.10.x, but GHC
+7.8.4 cannot compile that binary. Now, one way to solve that problem is to
+register an older version of `ghc-events` in the 7.8.x-specific package set.
+The first step is to generate Nix build instructions with `cabal2nix`:
+
+    $ cabal2nix cabal://ghc-events-0.4.3.0 >~/.nixpkgs/ghc-events-0.4.3.0.nix
+
+Then add the override in `~/.nixpkgs/config.nix`:
+
+    {
+      packageOverrides = super: let self = super.pkgs; in
+      {
+        haskell = super.haskell // {
+          packages = super.haskell.packages // {
+            ghc784 = super.haskell.packages.ghc784.override {
+              overrides = self: super: {
+                ghc-events = self.callPackage ./ghc-events-0.4.3.0.nix {};
+              };
+            };
+          };
+        };
+      };
+    }
+
+This code is a little crazy, no doubt, but it's necessary because the intuitive
+version
+
+    haskell.packages.ghc784 = super.haskell.packages.ghc784.override {
+      overrides = self: super: {
+        ghc-events = self.callPackage ./ghc-events-0.4.3.0.nix {};
+      };
+    };
+
+doesn't do what we want it to: that code replaces the `haskell` package set in
+Nixpkgs with one that contains only one entry,`packages`, which contains only
+one entry `ghc784`. This override loses the `haskell.compiler` set, and it
+loses the `haskell.packages.ghcXYZ` sets for all compilers but GHC 7.8.4. To
+avoid that problem, we have to perform the convoluted little dance from above,
+iterating over each step in hierarchy.
+
+Once it's accomplished, however, we can install a variant of `ghc-events`
+that's compiled with GHC 7.8.4:
+
+    nix-env -f "<nixpkgs>" -iA haskell.packages.ghc784.ghc-events
+
+Unfortunately, it turns out that this build fails again while executing the
+test suite! Apparently, the release archive on Hackage is missing some data
+files that the test suite requires, so we cannot run it. We accomplish that by
+re-generating the Nix expression with the `--no-check` flag:
+
+    $ cabal2nix --no-check cabal://ghc-events-0.4.3.0 >~/.nixpkgs/ghc-events-0.4.3.0.nix
+
+Now the builds succeeds.
+
+Of course, in the concrete example of `ghc-events` this whole exercise is not
+an ideal solution, because `ghc-events` can analyze the output emitted by any
+version of GHC later than 6.12 regardless of the compiler version that was used
+to build the `ghc-events' executable, so strictly speaking there's no reason to
+prefer one built with GHC 7.8.x in the first place. However, for users who
+cannot use GHC 7.10.x at all for some reason, the approach of downgrading to an
+older version might be useful.
+
+### How to recover from GHC's infamous non-deterministic library ID bug
+
+GHC and distributed build farms don't get along well:
+
+    https://ghc.haskell.org/trac/ghc/ticket/4012
+
+When you see an error like this one
+
+    package foo-0.7.1.0 is broken due to missing package
+    text-1.2.0.4-98506efb1b9ada233bb5c2b2db516d91
+
+then you have to download and re-install `foo` and all its dependents from
+scratch:
+
+    # nix-store -q --referrers /nix/store/*-haskell-text-1.2.0.4 \
+      | xargs -L 1 nix-store --repair-path --option binary-caches http://hydra.nixos.org
+
+If you're using additional Hydra servers other than `hydra.nixos.org`, then it
+might be necessary to purge the local caches that store data from those
+machines to disable these binary channels for the duration of the previous
+command, i.e. by running:
+
+    rm /nix/var/nix/binary-cache-v3.sqlite
+    rm /nix/var/nix/manifests/*
+    rm /nix/var/nix/channel-cache/*
+
+### Builds on Darwin fail with `math.h` not found
+
+Users of GHC on Darwin have occasionally reported that builds fail, because the
+compiler complains about a missing include file:
+
+    fatal error: 'math.h' file not found
+
+The issue has been discussed at length in [ticket
+6390](https://github.com/NixOS/nixpkgs/issues/6390), and so far no good
+solution has been proposed. As a work-around, users who run into this problem
+can configure the environment variables
+
+    export NIX_CFLAGS_COMPILE="-idirafter /usr/include"
+    export NIX_CFLAGS_LINK="-L/usr/lib"
+
+in their `~/.bashrc` file to avoid the compiler error.
+
+### Builds using Stack complain about missing system libraries
+
+    --  While building package zlib-0.5.4.2 using:
+      runhaskell -package=Cabal-1.22.4.0 -clear-package-db [... lots of flags ...]
+    Process exited with code: ExitFailure 1
+    Logs have been written to: /home/foo/src/stack-ide/.stack-work/logs/zlib-0.5.4.2.log
+
+    Configuring zlib-0.5.4.2...
+    Setup.hs: Missing dependency on a foreign library:
+    * Missing (or bad) header file: zlib.h
+    This problem can usually be solved by installing the system package that
+    provides this library (you may need the "-dev" version). If the library is
+    already installed but in a non-standard location then you can use the flags
+    --extra-include-dirs= and --extra-lib-dirs= to specify where it is.
+    If the header file does exist, it may contain errors that are caught by the C
+    compiler at the preprocessing stage. In this case you can re-run configure
+    with the verbosity flag -v3 to see the error messages.
+
+When you run the build inside of the nix-shell environment, the system
+is configured to find libz.so without any special flags -- the compiler
+and linker "just know" how to find it. Consequently, Cabal won't record
+any search paths for libz.so in the package description, which means
+that the package works fine inside of nix-shell, but once you leave the
+shell the shared object can no longer be found. That issue is by no
+means specific to Stack: you'll have that problem with any other
+Haskell package that's built inside of nix-shell but run outside of that
+environment.
+
+You can remedy this issue in several ways. The easiest is to add a `nix` section
+to the `stack.yaml` like the following:
+
+    nix:
+      enable: true
+	  packages: [ zlib ]
+
+Stack's Nix support knows to add `${zlib}/lib` and `${zlib}/include` as an
+`--extra-lib-dirs` and `extra-include-dirs`, respectively. Alternatively, you
+can achieve the same effect by hand. First of all, run
+
+    $ nix-build --no-out-link "<nixpkgs>" -A zlib
+    /nix/store/alsvwzkiw4b7ip38l4nlfjijdvg3fvzn-zlib-1.2.8
+
+to find out the store path of the system's zlib library. Now, you can
+
+1) add that path (plus a "/lib" suffix) to your $LD_LIBRARY_PATH
+   environment variable to make sure your system linker finds libz.so
+   automatically. It's no pretty solution, but it will work.
+
+2) As a variant of (1), you can also install any number of system
+   libraries into your user's profile (or some other profile) and point
+   $LD_LIBRARY_PATH to that profile instead, so that you don't have to
+   list dozens of those store paths all over the place.
+
+3) The solution I prefer is to call stack with an appropriate
+   --extra-lib-dirs flag like so:
+
+    $ stack --extra-lib-dirs=/nix/store/alsvwzkiw4b7ip38l4nlfjijdvg3fvzn-zlib-1.2.8/lib build
+
+   Typically, you'll need --extra-include-dirs as well. It's possible
+   to add those flag to the project's "stack.yaml" or your user's
+   global "~/.stack/global/stack.yaml" file so that you don't have to
+   specify them manually every time. But again, you're likely better off using
+   Stack's Nix support instead.
+
+   The same thing applies to `cabal configure`, of course, if you're
+   building with `cabal-install` instead of Stack.
+
+### Creating statically linked binaries
+
+There are two levels of static linking. The first option is to configure the
+build with the Cabal flag `--disable-executable-dynamic`. In Nix expressions,
+this can be achieved by setting the attribute:
+
+    enableSharedExecutables = false;
+
+That gives you a binary with statically linked Haskell libraries and
+dynamically linked system libraries.
+
+To link both Haskell libraries and system libraries statically, the additional
+flags `--ghc-option=-optl=-static --ghc-option=-optl=-pthread` need to be used.
+In Nix, this is accomplished with:
+
+    configureFlags = [ "--ghc-option=-optl=-static" "--ghc-option=-optl=-pthread" ];
+
+It's important to realize, however, that most system libraries in Nix are built
+as shared libraries only, i.e. there is just no static library available that
+Cabal could link!
+
+
+## Other resources
+
+- The Youtube video [Nix Loves Haskell](https://www.youtube.com/watch?v=BsBhi_r-OeE)
+  provides an introduction into Haskell NG aimed at beginners. The slides are
+  available at http://cryp.to/nixos-meetup-3-slides.pdf and also -- in a form
+  ready for cut & paste -- at
+  https://github.com/NixOS/cabal2nix/blob/master/doc/nixos-meetup-3-slides.md.
+
+- Another Youtube video is [Escaping Cabal Hell with Nix](https://www.youtube.com/watch?v=mQd3s57n_2Y),
+  which discusses the subject of Haskell development with Nix but also provides
+  a basic introduction to Nix as well, i.e. it's suitable for viewers with
+  almost no prior Nix experience.
+
+- Oliver Charles wrote a very nice [Tutorial how to develop Haskell packages with Nix](http://wiki.ocharles.org.uk/Nix).
+
+- The *Journey into the Haskell NG infrastructure* series of postings
+  describe the new Haskell infrastructure in great detail:
+
+    - [Part 1](http://lists.science.uu.nl/pipermail/nix-dev/2015-January/015591.html)
+      explains the differences between the old and the new code and gives
+      instructions how to migrate to the new setup.
+
+    - [Part 2](http://lists.science.uu.nl/pipermail/nix-dev/2015-January/015608.html)
+      looks in-depth at how to tweak and configure your setup by means of
+      overrides.
+
+    - [Part 3](http://lists.science.uu.nl/pipermail/nix-dev/2015-April/016912.html)
+      describes the infrastructure that keeps the Haskell package set in Nixpkgs
+      up-to-date.

doc/haskell-users-guide.xml

@@ -1,912 +0,0 @@
-<chapter xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xml:id="users-guide-to-the-haskell-infrastructure">
-
-<title>User's Guide to the Haskell Infrastructure</title>
-
-<section xml:id="how-to-install-haskell-packages">
-  <title>How to install Haskell packages</title>
-  <para>
-    Nixpkgs distributes build instructions for all Haskell packages
-    registered on
-    <link xlink:href="http://hackage.haskell.org/">Hackage</link>, but
-    strangely enough normal Nix package lookups don't seem to discover
-    any of them, except for the default version of ghc, cabal-install, and stack:
-  </para>
-  <programlisting>
-$ nix-env -i alex
-error: selector ‘alex’ matches no derivations
-$ nix-env -qa ghc
-ghc-7.10.2
-</programlisting>
-  <para>
-    The Haskell package set is not registered in the top-level namespace
-    because it is <emphasis>huge</emphasis>. If all Haskell packages
-    were visible to these commands, then name-based search/install
-    operations would be much slower than they are now. We avoided that
-    by keeping all Haskell-related packages in a separate attribute set
-    called <literal>haskellPackages</literal>, which the following
-    command will list:
-  </para>
-  <programlisting>
-$ nix-env -f &quot;&lt;nixpkgs&gt;&quot; -qaP -A haskellPackages
-haskellPackages.a50         a50-0.5
-haskellPackages.abacate     haskell-abacate-0.0.0.0
-haskellPackages.abcBridge   haskell-abcBridge-0.12
-haskellPackages.afv         afv-0.1.1
-haskellPackages.alex        alex-3.1.4
-haskellPackages.Allure      Allure-0.4.101.1
-haskellPackages.alms        alms-0.6.7
-[... some 8000 entries omitted  ...]
-</programlisting>
-  <para>
-    To install any of those packages into your profile, refer to them by
-    their attribute path (first column):
-  </para>
-  <programlisting>
-$ nix-env -f &quot;&lt;nixpkgs&gt;&quot; -iA haskellPackages.Allure ...
-</programlisting>
-  <para>
-    The attribute path of any Haskell packages corresponds to the name
-    of that particular package on Hackage: the package
-    <literal>cabal-install</literal> has the attribute
-    <literal>haskellPackages.cabal-install</literal>, and so on.
-    (Actually, this convention causes trouble with packages like
-    <literal>3dmodels</literal> and <literal>4Blocks</literal>, because
-    these names are invalid identifiers in the Nix language. The issue
-    of how to deal with these rare corner cases is currently
-    unresolved.)
-  </para>
-  <para>
-    Haskell packages who's Nix name (second column) begins with a
-    <literal>haskell-</literal> prefix are packages that provide a
-    library whereas packages without that prefix provide just
-    executables. Libraries may provide executables too, though: the
-    package <literal>haskell-pandoc</literal>, for example, installs
-    both a library and an application. You can install and use Haskell
-    executables just like any other program in Nixpkgs, but using
-    Haskell libraries for development is a bit trickier and we'll
-    address that subject in great detail in section
-    <link linkend="how-to-create-a-development-environment">How to
-    create a development environment</link>.
-  </para>
-  <para>
-    Attribute paths are deterministic inside of Nixpkgs, but the path
-    necessary to reach Nixpkgs varies from system to system. We dodged
-    that problem by giving <literal>nix-env</literal> an explicit
-    <literal>-f &quot;&lt;nixpkgs&gt;&quot;</literal> parameter, but if
-    you call <literal>nix-env</literal> without that flag, then chances
-    are the invocation fails:
-  </para>
-  <programlisting>
-$ nix-env -iA haskellPackages.cabal-install
-error: attribute ‘haskellPackages’ in selection path
-       ‘haskellPackages.cabal-install’ not found
-</programlisting>
-  <para>
-    On NixOS, for example, Nixpkgs does <emphasis>not</emphasis> exist
-    in the top-level namespace by default. To figure out the proper
-    attribute path, it's easiest to query for the path of a well-known
-    Nixpkgs package, i.e.:
-  </para>
-  <programlisting>
-$ nix-env -qaP coreutils
-nixos.coreutils  coreutils-8.23
-</programlisting>
-  <para>
-    If your system responds like that (most NixOS installations will),
-    then the attribute path to <literal>haskellPackages</literal> is
-    <literal>nixos.haskellPackages</literal>. Thus, if you want to
-    use <literal>nix-env</literal> without giving an explicit
-    <literal>-f</literal> flag, then that's the way to do it:
-  </para>
-  <programlisting>
-$ nix-env -qaP -A nixos.haskellPackages
-$ nix-env -iA nixos.haskellPackages.cabal-install
-</programlisting>
-  <para>
-    Our current default compiler is GHC 7.10.x and the
-    <literal>haskellPackages</literal> set contains packages built with
-    that particular version. Nixpkgs contains the latest major release
-    of every GHC since 6.10.4, however, and there is a whole family of
-    package sets available that defines Hackage packages built with each
-    of those compilers, too:
-  </para>
-  <programlisting>
-$ nix-env -f &quot;&lt;nixpkgs&gt;&quot; -qaP -A haskell.packages.ghc6123
-$ nix-env -f &quot;&lt;nixpkgs&gt;&quot; -qaP -A haskell.packages.ghc763
-</programlisting>
-  <para>
-    The name <literal>haskellPackages</literal> is really just a synonym
-    for <literal>haskell.packages.ghc7102</literal>, because we prefer
-    that package set internally and recommend it to our users as their
-    default choice, but ultimately you are free to compile your Haskell
-    packages with any GHC version you please. The following command
-    displays the complete list of available compilers:
-  </para>
-  <programlisting>
-$ nix-env -f &quot;&lt;nixpkgs&gt;&quot; -qaP -A haskell.compiler
-haskell.compiler.ghc6104        ghc-6.10.4
-haskell.compiler.ghc6123        ghc-6.12.3
-haskell.compiler.ghc704         ghc-7.0.4
-haskell.compiler.ghc722         ghc-7.2.2
-haskell.compiler.ghc742         ghc-7.4.2
-haskell.compiler.ghc763         ghc-7.6.3
-haskell.compiler.ghc784         ghc-7.8.4
-haskell.compiler.ghc7102        ghc-7.10.2
-haskell.compiler.ghcHEAD        ghc-7.11.20150402
-haskell.compiler.ghcNokinds     ghc-nokinds-7.11.20150704
-haskell.compiler.ghcjs          ghcjs-0.1.0
-haskell.compiler.jhc            jhc-0.8.2
-haskell.compiler.uhc            uhc-1.1.9.0
-</programlisting>
-  <para>
-    We have no package sets for <literal>jhc</literal> or
-    <literal>uhc</literal> yet, unfortunately, but for every version of
-    GHC listed above, there exists a package set based on that compiler.
-    Also, the attributes <literal>haskell.compiler.ghcXYC</literal> and
-    <literal>haskell.packages.ghcXYC.ghc</literal> are synonymous for
-    the sake of convenience.
-  </para>
-</section>
-<section xml:id="how-to-create-a-development-environment">
-  <title>How to create a development environment</title>
-  <section xml:id="how-to-install-a-compiler">
-    <title>How to install a compiler</title>
-    <para>
-      A simple development environment consists of a Haskell compiler
-      and the tool <literal>cabal-install</literal>, and we saw in
-      section <link linkend="how-to-install-haskell-packages">How to
-      install Haskell packages</link> how you can install those programs
-      into your user profile:
-    </para>
-    <programlisting>
-$ nix-env -f &quot;&lt;nixpkgs&gt;&quot; -iA haskellPackages.ghc haskellPackages.cabal-install
-</programlisting>
-    <para>
-      Instead of the default package set
-      <literal>haskellPackages</literal>, you can also use the more
-      precise name <literal>haskell.compiler.ghc7102</literal>, which
-      has the advantage that it refers to the same GHC version
-      regardless of what Nixpkgs considers &quot;default&quot; at any
-      given time.
-    </para>
-    <para>
-      Once you've made those tools available in
-      <literal>$PATH</literal>, it's possible to build Hackage packages
-      the same way people without access to Nix do it all the time:
-    </para>
-    <programlisting>
-$ cabal get lens-4.11 &amp;&amp; cd lens-4.11
-$ cabal install -j --dependencies-only
-$ cabal configure
-$ cabal build
-</programlisting>
-    <para>
-      If you enjoy working with Cabal sandboxes, then that's entirely
-      possible too: just execute the command
-    </para>
-    <programlisting>
-$ cabal sandbox init
-</programlisting>
-    <para>
-      before installing the required dependencies.
-    </para>
-    <para>
-      The <literal>nix-shell</literal> utility makes it easy to switch
-      to a different compiler version; just enter the Nix shell
-      environment with the command
-    </para>
-    <programlisting>
-$ nix-shell -p haskell.compiler.ghc784
-</programlisting>
-    <para>
-      to bring GHC 7.8.4 into <literal>$PATH</literal>. Re-running
-      <literal>cabal configure</literal> switches your build to use that
-      compiler instead. If you're working on a project that doesn't
-      depend on any additional system libraries outside of GHC, then
-      it's sufficient even to run the <literal>cabal configure</literal>
-      command inside of the shell:
-    </para>
-    <programlisting>
-$ nix-shell -p haskell.compiler.ghc784 --command &quot;cabal configure&quot;
-</programlisting>
-    <para>
-      Afterwards, all other commands like <literal>cabal build</literal>
-      work just fine in any shell environment, because the configure
-      phase recorded the absolute paths to all required tools like GHC
-      in its build configuration inside of the <literal>dist/</literal>
-      directory. Please note, however, that
-      <literal>nix-collect-garbage</literal> can break such an
-      environment because the Nix store paths created by
-      <literal>nix-shell</literal> aren't &quot;alive&quot; anymore once
-      <literal>nix-shell</literal> has terminated. If you find that your
-      Haskell builds no longer work after garbage collection, then
-      you'll have to re-run <literal>cabal configure</literal> inside of
-      a new <literal>nix-shell</literal> environment.
-    </para>
-  </section>
-  <section xml:id="how-to-install-a-compiler-with-libraries">
-    <title>How to install a compiler with libraries</title>
-    <para>
-      GHC expects to find all installed libraries inside of its own
-      <literal>lib</literal> directory. This approach works fine on
-      traditional Unix systems, but it doesn't work for Nix, because
-      GHC's store path is immutable once it's built. We cannot install
-      additional libraries into that location. As a consequence, our
-      copies of GHC don't know any packages except their own core
-      libraries, like <literal>base</literal>,
-      <literal>containers</literal>, <literal>Cabal</literal>, etc.
-    </para>
-    <para>
-      We can register additional libraries to GHC, however, using a
-      special build function called <literal>ghcWithPackages</literal>.
-      That function expects one argument: a function that maps from an
-      attribute set of Haskell packages to a list of packages, which
-      determines the libraries known to that particular version of GHC.
-      For example, the Nix expression
-      <literal>ghcWithPackages (pkgs: [pkgs.mtl])</literal> generates a
-      copy of GHC that has the <literal>mtl</literal> library registered
-      in addition to its normal core packages:
-    </para>
-    <programlisting>
-$ nix-shell -p &quot;haskellPackages.ghcWithPackages (pkgs: [pkgs.mtl])&quot;
-
-[nix-shell:~]$ ghc-pkg list mtl
-/nix/store/zy79...-ghc-7.10.2/lib/ghc-7.10.2/package.conf.d:
-    mtl-2.2.1
-</programlisting>
-    <para>
-      This function allows users to define their own development
-      environment by means of an override. After adding the following
-      snippet to <literal>~/.nixpkgs/config.nix</literal>,
-    </para>
-    <programlisting>
-{
-  packageOverrides = super: let self = super.pkgs; in
-  {
-    myHaskellEnv = self.haskell.packages.ghc7102.ghcWithPackages
-                     (haskellPackages: with haskellPackages; [
-                       # libraries
-                       arrows async cgi criterion
-                       # tools
-                       cabal-install haskintex
-                     ]);
-  };
-}
-</programlisting>
-    <para>
-      it's possible to install that compiler with
-      <literal>nix-env -f &quot;&lt;nixpkgs&gt;&quot; -iA myHaskellEnv</literal>.
-      If you'd like to switch that development environment to a
-      different version of GHC, just replace the
-      <literal>ghc7102</literal> bit in the previous definition with the
-      appropriate name. Of course, it's also possible to define any
-      number of these development environments! (You can't install two
-      of them into the same profile at the same time, though, because
-      that would result in file conflicts.)
-    </para>
-    <para>
-      The generated <literal>ghc</literal> program is a wrapper script
-      that re-directs the real GHC executable to use a new
-      <literal>lib</literal> directory --- one that we specifically
-      constructed to contain all those packages the user requested:
-    </para>
-    <programlisting>
-$ cat $(type -p ghc)
-#! /nix/store/xlxj...-bash-4.3-p33/bin/bash -e
-export NIX_GHC=/nix/store/19sm...-ghc-7.10.2/bin/ghc
-export NIX_GHCPKG=/nix/store/19sm...-ghc-7.10.2/bin/ghc-pkg
-export NIX_GHC_DOCDIR=/nix/store/19sm...-ghc-7.10.2/share/doc/ghc/html
-export NIX_GHC_LIBDIR=/nix/store/19sm...-ghc-7.10.2/lib/ghc-7.10.2
-exec /nix/store/j50p...-ghc-7.10.2/bin/ghc &quot;-B$NIX_GHC_LIBDIR&quot; &quot;$@&quot;
-</programlisting>
-    <para>
-      The variables <literal>$NIX_GHC</literal>,
-      <literal>$NIX_GHCPKG</literal>, etc. point to the
-      <emphasis>new</emphasis> store path
-      <literal>ghcWithPackages</literal> constructed specifically for
-      this environment. The last line of the wrapper script then
-      executes the real <literal>ghc</literal>, but passes the path to
-      the new <literal>lib</literal> directory using GHC's
-      <literal>-B</literal> flag.
-    </para>
-    <para>
-      The purpose of those environment variables is to work around an
-      impurity in the popular
-      <link xlink:href="http://hackage.haskell.org/package/ghc-paths">ghc-paths</link>
-      library. That library promises to give its users access to GHC's
-      installation paths. Only, the library can't possible know that
-      path when it's compiled, because the path GHC considers its own is
-      determined only much later, when the user configures it through
-      <literal>ghcWithPackages</literal>. So we
-      <link xlink:href="https://github.com/NixOS/nixpkgs/blob/master/pkgs/development/haskell-modules/ghc-paths-nix.patch">patched
-      ghc-paths</link> to return the paths found in those environment
-      variables at run-time rather than trying to guess them at
-      compile-time.
-    </para>
-    <para>
-      To make sure that mechanism works properly all the time, we
-      recommend that you set those variables to meaningful values in
-      your shell environment, too, i.e. by adding the following code to
-      your <literal>~/.bashrc</literal>:
-    </para>
-    <programlisting>
-if type &gt;/dev/null 2&gt;&amp;1 -p ghc; then
-  eval &quot;$(egrep ^export &quot;$(type -p ghc)&quot;)&quot;
-fi
-</programlisting>
-    <para>
-      If you are certain that you'll use only one GHC environment which
-      is located in your user profile, then you can use the following
-      code, too, which has the advantage that it doesn't contain any
-      paths from the Nix store, i.e. those settings always remain valid
-      even if a <literal>nix-env -u</literal> operation updates the GHC
-      environment in your profile:
-    </para>
-    <programlisting>
-if [ -e ~/.nix-profile/bin/ghc ]; then
-  export NIX_GHC=&quot;$HOME/.nix-profile/bin/ghc&quot;
-  export NIX_GHCPKG=&quot;$HOME/.nix-profile/bin/ghc-pkg&quot;
-  export NIX_GHC_DOCDIR=&quot;$HOME/.nix-profile/share/doc/ghc/html&quot;
-  export NIX_GHC_LIBDIR=&quot;$HOME/.nix-profile/lib/ghc-$($NIX_GHC --numeric-version)&quot;
-fi
-</programlisting>
-  </section>
-  <section xml:id="how-to-install-a-compiler-with-indexes">
-    <title>How to install a compiler with libraries, hoogle and documentation indexes</title>
-    <para>
-      If you plan to use your environment for interactive programming,
-      not just compiling random Haskell code, you might want to
-      replace <literal>ghcWithPackages</literal> in all the listings
-      above with <literal>ghcWithHoogle</literal>.
-    </para>
-    <para>
-      This environment generator not only produces an environment with
-      GHC and all the specified libraries, but also generates a
-      <literal>hoogle</literal> and <literal>haddock</literal> indexes
-      for all the packages, and provides a wrapper script around
-      <literal>hoogle</literal> binary that uses all those things. A
-      precise name for this thing would be
-      "<literal>ghcWithPackagesAndHoogleAndDocumentationIndexes</literal>",
-      which is, regrettably, too long and scary.
-    </para>
-    <para>
-      For example, installing the following environment
-    </para>
-    <programlisting>
-{
-  packageOverrides = super: let self = super.pkgs; in
-  {
-    myHaskellEnv = self.haskellPackages.ghcWithHoogle
-                     (haskellPackages: with haskellPackages; [
-                       # libraries
-                       arrows async cgi criterion
-                       # tools
-                       cabal-install haskintex
-                     ]);
-  };
-}
-</programlisting>
-    <para>
-      allows one to browse module documentation index <link
-      xlink:href="https://downloads.haskell.org/~ghc/latest/docs/html/libraries/index.html">not
-      too dissimilar to this</link> for all the specified packages and
-      their dependencies by directing a browser of choice to
-      <literal>~/.nix-profiles/share/doc/hoogle/index.html</literal>
-      (or
-      <literal>/run/current-system/sw/share/doc/hoogle/index.html</literal>
-      in case you put it in
-      <literal>environment.systemPackages</literal> in NixOS).
-    </para>
-    <para>
-      After you've marveled enough at that try adding the following to
-      your <literal>~/.ghc/ghci.conf</literal>
-    </para>
-    <programlisting>
-:def hoogle \s -> return $ ":! hoogle search -cl --count=15 \"" ++ s ++ "\""
-:def doc \s -> return $ ":! hoogle search -cl --info \"" ++ s ++ "\""
-</programlisting>
-    <para>
-      and test it by typing into <literal>ghci</literal>:
-    </para>
-    <programlisting>
-:hoogle a -> a
-:doc a -> a
-</programlisting>
-    <para>
-      Be sure to note the links to <literal>haddock</literal> files in
-      the output. With any modern and properly configured terminal
-      emulator you can just click those links to navigate there.
-    </para>
-    <para>
-      Finally, you can run
-    </para>
-    <programlisting>
-hoogle server -p 8080
-</programlisting>
-    <para>
-      and navigate to <link xlink:href="http://localhost:8080/"/> for
-      your own local <link
-      xlink:href="https://www.haskell.org/hoogle/">Hoogle</link>.
-      Note, however, that Firefox and possibly other browsers disallow
-      navigation from <literal>http:</literal> to
-      <literal>file:</literal> URIs for security reasons, which might
-      be quite an inconvenience. See <link
-      xlink:href="http://kb.mozillazine.org/Links_to_local_pages_do_not_work">this
-      page</link> for workarounds.
-    </para>
-  </section>
-  <section xml:id="how-to-create-ad-hoc-environments-for-nix-shell">
-    <title>How to create ad hoc environments for
-    <literal>nix-shell</literal></title>
-    <para>
-      The easiest way to create an ad hoc development environment is to
-      run <literal>nix-shell</literal> with the appropriate GHC
-      environment given on the command-line:
-    </para>
-    <programlisting>
-nix-shell -p &quot;haskellPackages.ghcWithPackages (pkgs: with pkgs; [mtl pandoc])&quot;
-</programlisting>
-    <para>
-      For more sophisticated use-cases, however, it's more convenient to
-      save the desired configuration in a file called
-      <literal>shell.nix</literal> that looks like this:
-    </para>
-    <programlisting>
-{ nixpkgs ? import &lt;nixpkgs&gt; {}, compiler ? &quot;ghc7102&quot; }:
-let
-  inherit (nixpkgs) pkgs;
-  ghc = pkgs.haskell.packages.${compiler}.ghcWithPackages (ps: with ps; [
-          monad-par mtl
-        ]);
-in
-pkgs.stdenv.mkDerivation {
-  name = &quot;my-haskell-env-0&quot;;
-  buildInputs = [ ghc ];
-  shellHook = &quot;eval $(egrep ^export ${ghc}/bin/ghc)&quot;;
-}
-</programlisting>
-    <para>
-      Now run <literal>nix-shell</literal> --- or even
-      <literal>nix-shell --pure</literal> --- to enter a shell
-      environment that has the appropriate compiler in
-      <literal>$PATH</literal>. If you use <literal>--pure</literal>,
-      then add all other packages that your development environment
-      needs into the <literal>buildInputs</literal> attribute. If you'd
-      like to switch to a different compiler version, then pass an
-      appropriate <literal>compiler</literal> argument to the
-      expression, i.e.
-      <literal>nix-shell --argstr compiler ghc784</literal>.
-    </para>
-    <para>
-      If you need such an environment because you'd like to compile a
-      Hackage package outside of Nix --- i.e. because you're hacking on
-      the latest version from Git ---, then the package set provides
-      suitable nix-shell environments for you already! Every Haskell
-      package has an <literal>env</literal> attribute that provides a
-      shell environment suitable for compiling that particular package.
-      If you'd like to hack the <literal>lens</literal> library, for
-      example, then you just have to check out the source code and enter
-      the appropriate environment:
-    </para>
-    <programlisting>
-  $ cabal get lens-4.11 &amp;&amp; cd lens-4.11
-  Downloading lens-4.11...
-  Unpacking to lens-4.11/
-
-  $ nix-shell &quot;&lt;nixpkgs&gt;&quot; -A haskellPackages.lens.env
-  [nix-shell:/tmp/lens-4.11]$
-</programlisting>
-    <para>
-      At point, you can run <literal>cabal configure</literal>,
-      <literal>cabal build</literal>, and all the other development
-      commands. Note that you need <literal>cabal-install</literal>
-      installed in your <literal>$PATH</literal> already to use it here
-      --- the <literal>nix-shell</literal> environment does not provide
-      it.
-    </para>
-  </section>
-</section>
-<section xml:id="how-to-create-nix-builds-for-your-own-private-haskell-packages">
-  <title>How to create Nix builds for your own private Haskell
-  packages</title>
-  <para>
-    If your own Haskell packages have build instructions for Cabal, then
-    you can convert those automatically into build instructions for Nix
-    using the <literal>cabal2nix</literal> utility, which you can
-    install into your profile by running
-    <literal>nix-env -i cabal2nix</literal>.
-  </para>
-  <section xml:id="how-to-build-a-stand-alone-project">
-    <title>How to build a stand-alone project</title>
-    <para>
-      For example, let's assume that you're working on a private project
-      called <literal>foo</literal>. To generate a Nix build expression
-      for it, change into the project's top-level directory and run the
-      command:
-    </para>
-    <programlisting>
-$ cabal2nix . &gt;foo.nix
-</programlisting>
-    <para>
-      Then write the following snippet into a file called
-      <literal>default.nix</literal>:
-    </para>
-    <programlisting>
-{ nixpkgs ? import &lt;nixpkgs&gt; {}, compiler ? &quot;ghc7102&quot; }:
-nixpkgs.pkgs.haskell.packages.${compiler}.callPackage ./foo.nix { }
-</programlisting>
-    <para>
-      Finally, store the following code in a file called
-      <literal>shell.nix</literal>:
-    </para>
-    <programlisting>
-{ nixpkgs ? import &lt;nixpkgs&gt; {}, compiler ? &quot;ghc7102&quot; }:
-(import ./default.nix { inherit nixpkgs compiler; }).env
-</programlisting>
-    <para>
-      At this point, you can run <literal>nix-build</literal> to have
-      Nix compile your project and install it into a Nix store path. The
-      local directory will contain a symlink called
-      <literal>result</literal> after <literal>nix-build</literal>
-      returns that points into that location. Of course, passing the
-      flag <literal>--argstr compiler ghc763</literal> allows switching
-      the build to any version of GHC currently supported.
-    </para>
-    <para>
-      Furthermore, you can call <literal>nix-shell</literal> to enter an
-      interactive development environment in which you can use
-      <literal>cabal configure</literal> and
-      <literal>cabal build</literal> to develop your code. That
-      environment will automatically contain a proper GHC derivation
-      with all the required libraries registered as well as all the
-      system-level libraries your package might need.
-    </para>
-    <para>
-      If your package does not depend on any system-level libraries,
-      then it's sufficient to run
-    </para>
-    <programlisting>
-$ nix-shell --command &quot;cabal configure&quot;
-</programlisting>
-    <para>
-      once to set up your build. <literal>cabal-install</literal>
-      determines the absolute paths to all resources required for the
-      build and writes them into a config file in the
-      <literal>dist/</literal> directory. Once that's done, you can run
-      <literal>cabal build</literal> and any other command for that
-      project even outside of the <literal>nix-shell</literal>
-      environment. This feature is particularly nice for those of us who
-      like to edit their code with an IDE, like Emacs'
-      <literal>haskell-mode</literal>, because it's not necessary to
-      start Emacs inside of nix-shell just to make it find out the
-      necessary settings for building the project;
-      <literal>cabal-install</literal> has already done that for us.
-    </para>
-    <para>
-      If you want to do some quick-and-dirty hacking and don't want to
-      bother setting up a <literal>default.nix</literal> and
-      <literal>shell.nix</literal> file manually, then you can use the
-      <literal>--shell</literal> flag offered by
-      <literal>cabal2nix</literal> to have it generate a stand-alone
-      <literal>nix-shell</literal> environment for you. With that
-      feature, running
-    </para>
-    <programlisting>
-$ cabal2nix --shell . &gt;shell.nix
-$ nix-shell --command &quot;cabal configure&quot;
-</programlisting>
-    <para>
-      is usually enough to set up a build environment for any given
-      Haskell package. You can even use that generated file to run
-      <literal>nix-build</literal>, too:
-    </para>
-    <programlisting>
-$ nix-build shell.nix
-</programlisting>
-  </section>
-  <section xml:id="how-to-build-projects-that-depend-on-each-other">
-    <title>How to build projects that depend on each other</title>
-    <para>
-      If you have multiple private Haskell packages that depend on each
-      other, then you'll have to register those packages in the Nixpkgs
-      set to make them visible for the dependency resolution performed
-      by <literal>callPackage</literal>. First of all, change into each
-      of your projects top-level directories and generate a
-      <literal>default.nix</literal> file with
-      <literal>cabal2nix</literal>:
-    </para>
-    <programlisting>
-$ cd ~/src/foo &amp;&amp; cabal2nix . &gt;default.nix
-$ cd ~/src/bar &amp;&amp; cabal2nix . &gt;default.nix
-</programlisting>
-    <para>
-      Then edit your <literal>~/.nixpkgs/config.nix</literal> file to
-      register those builds in the default Haskell package set:
-    </para>
-    <programlisting>
-  {
-    packageOverrides = super: let self = super.pkgs; in
-    {
-      haskellPackages = super.haskellPackages.override {
-        overrides = self: super: {
-          foo = self.callPackage ../src/foo {};
-          bar = self.callPackage ../src/bar {};
-        };
-      };
-    };
-  }
-</programlisting>
-    <para>
-      Once that's accomplished,
-      <literal>nix-env -f &quot;&lt;nixpkgs&gt;&quot; -qA haskellPackages</literal>
-      will show your packages like any other package from Hackage, and
-      you can build them
-    </para>
-    <programlisting>
-$ nix-build &quot;&lt;nixpkgs&gt;&quot; -A haskellPackages.foo
-</programlisting>
-    <para>
-      or enter an interactive shell environment suitable for building
-      them:
-    </para>
-    <programlisting>
-$ nix-shell &quot;&lt;nixpkgs&gt;&quot; -A haskellPackages.bar.env
-</programlisting>
-  </section>
-</section>
-<section xml:id="miscellaneous-topics">
-  <title>Miscellaneous Topics</title>
-  <section xml:id="how-to-build-with-profiling-enabled">
-    <title>How to build with profiling enabled</title>
-    <para>
-      Every Haskell package set takes a function called
-      <literal>overrides</literal> that you can use to manipulate the
-      package as much as you please. One useful application of this
-      feature is to replace the default <literal>mkDerivation</literal>
-      function with one that enables library profiling for all packages.
-      To accomplish that, add configure the following snippet in your
-      <literal>~/.nixpkgs/config.nix</literal> file:
-    </para>
-    <programlisting>
-{
-  packageOverrides = super: let self = super.pkgs; in
-  {
-    profiledHaskellPackages = self.haskellPackages.override {
-      overrides = self: super: {
-        mkDerivation = args: super.mkDerivation (args // {
-          enableLibraryProfiling = true;
-        });
-      };
-    };
-  };
-}
-</programlisting>
-    <para>
-        Then, replace instances of <literal>haskellPackages</literal> in the
-        <literal>cabal2nix</literal>-generated <literal>default.nix</literal>
-        or <literal>shell.nix</literal> files with
-        <literal>profiledHaskellPackages</literal>.
-    </para>
-  </section>
-  <section xml:id="how-to-override-package-versions-in-a-compiler-specific-package-set">
-    <title>How to override package versions in a compiler-specific
-    package set</title>
-    <para>
-      Nixpkgs provides the latest version of
-      <link xlink:href="http://hackage.haskell.org/package/ghc-events"><literal>ghc-events</literal></link>,
-      which is 0.4.4.0 at the time of this writing. This is fine for
-      users of GHC 7.10.x, but GHC 7.8.4 cannot compile that binary.
-      Now, one way to solve that problem is to register an older version
-      of <literal>ghc-events</literal> in the 7.8.x-specific package
-      set. The first step is to generate Nix build instructions with
-      <literal>cabal2nix</literal>:
-    </para>
-    <programlisting>
-$ cabal2nix cabal://ghc-events-0.4.3.0 &gt;~/.nixpkgs/ghc-events-0.4.3.0.nix
-</programlisting>
-    <para>
-      Then add the override in <literal>~/.nixpkgs/config.nix</literal>:
-    </para>
-    <programlisting>
-{
-  packageOverrides = super: let self = super.pkgs; in
-  {
-    haskell = super.haskell // {
-      packages = super.haskell.packages // {
-        ghc784 = super.haskell.packages.ghc784.override {
-          overrides = self: super: {
-            ghc-events = self.callPackage ./ghc-events-0.4.3.0.nix {};
-          };
-        };
-      };
-    };
-  };
-}
-</programlisting>
-    <para>
-      This code is a little crazy, no doubt, but it's necessary because
-      the intuitive version
-    </para>
-    <programlisting>
-haskell.packages.ghc784 = super.haskell.packages.ghc784.override {
-  overrides = self: super: {
-    ghc-events = self.callPackage ./ghc-events-0.4.3.0.nix {};
-  };
-};
-</programlisting>
-    <para>
-      doesn't do what we want it to: that code replaces the
-      <literal>haskell</literal> package set in Nixpkgs with one that
-      contains only one entry,<literal>packages</literal>, which
-      contains only one entry <literal>ghc784</literal>. This override
-      loses the <literal>haskell.compiler</literal> set, and it loses
-      the <literal>haskell.packages.ghcXYZ</literal> sets for all
-      compilers but GHC 7.8.4. To avoid that problem, we have to perform
-      the convoluted little dance from above, iterating over each step
-      in hierarchy.
-    </para>
-    <para>
-      Once it's accomplished, however, we can install a variant of
-      <literal>ghc-events</literal> that's compiled with GHC 7.8.4:
-    </para>
-    <programlisting>
-nix-env -f &quot;&lt;nixpkgs&gt;&quot; -iA haskell.packages.ghc784.ghc-events
-</programlisting>
-    <para>
-      Unfortunately, it turns out that this build fails again while
-      executing the test suite! Apparently, the release archive on
-      Hackage is missing some data files that the test suite requires,
-      so we cannot run it. We accomplish that by re-generating the Nix
-      expression with the <literal>--no-check</literal> flag:
-    </para>
-    <programlisting>
-$ cabal2nix --no-check cabal://ghc-events-0.4.3.0 &gt;~/.nixpkgs/ghc-events-0.4.3.0.nix
-</programlisting>
-    <para>
-      Now the builds succeeds.
-    </para>
-    <para>
-      Of course, in the concrete example of
-      <literal>ghc-events</literal> this whole exercise is not an ideal
-      solution, because <literal>ghc-events</literal> can analyze the
-      output emitted by any version of GHC later than 6.12 regardless of
-      the compiler version that was used to build the `ghc-events'
-      executable, so strictly speaking there's no reason to prefer one
-      built with GHC 7.8.x in the first place. However, for users who
-      cannot use GHC 7.10.x at all for some reason, the approach of
-      downgrading to an older version might be useful.
-    </para>
-  </section>
-  <section xml:id="how-to-recover-from-ghcs-infamous-non-deterministic-library-id-bug">
-    <title>How to recover from GHC's infamous non-deterministic library
-    ID bug</title>
-    <para>
-      GHC and distributed build farms don't get along well:
-    </para>
-    <programlisting>
-https://ghc.haskell.org/trac/ghc/ticket/4012
-</programlisting>
-    <para>
-      When you see an error like this one
-    </para>
-    <programlisting>
-package foo-0.7.1.0 is broken due to missing package
-text-1.2.0.4-98506efb1b9ada233bb5c2b2db516d91
-</programlisting>
-    <para>
-      then you have to download and re-install <literal>foo</literal>
-      and all its dependents from scratch:
-    </para>
-    <programlisting>
-# nix-store -q --referrers /nix/store/*-haskell-text-1.2.0.4 \
-  | xargs -L 1 nix-store --repair-path --option binary-caches http://hydra.nixos.org
-</programlisting>
-    <para>
-      If you're using additional Hydra servers other than
-      <literal>hydra.nixos.org</literal>, then it might be necessary to
-      purge the local caches that store data from those machines to
-      disable these binary channels for the duration of the previous
-      command, i.e. by running:
-    </para>
-    <programlisting>
-rm /nix/var/nix/binary-cache-v3.sqlite
-rm /nix/var/nix/manifests/*
-rm /nix/var/nix/channel-cache/*
-</programlisting>
-  </section>
-  <section xml:id="builds-on-darwin-fail-with-math.h-not-found">
-    <title>Builds on Darwin fail with <literal>math.h</literal> not
-    found</title>
-    <para>
-      Users of GHC on Darwin have occasionally reported that builds
-      fail, because the compiler complains about a missing include file:
-    </para>
-    <programlisting>
-fatal error: 'math.h' file not found
-</programlisting>
-    <para>
-      The issue has been discussed at length in
-      <link xlink:href="https://github.com/NixOS/nixpkgs/issues/6390">ticket
-      6390</link>, and so far no good solution has been proposed. As a
-      work-around, users who run into this problem can configure the
-      environment variables
-    </para>
-    <programlisting>
-export NIX_CFLAGS_COMPILE=&quot;-idirafter /usr/include&quot;
-export NIX_CFLAGS_LINK=&quot;-L/usr/lib&quot;
-</programlisting>
-    <para>
-      in their <literal>~/.bashrc</literal> file to avoid the compiler
-      error.
-    </para>
-  </section>
-</section>
-
-<section xml:id="other-resources">
-  <title>Other resources</title>
-  <itemizedlist>
-    <listitem>
-      <para>
-        The Youtube video
-        <link xlink:href="https://www.youtube.com/watch?v=BsBhi_r-OeE">Nix
-        Loves Haskell</link> provides an introduction into Haskell NG
-        aimed at beginners. The slides are available at
-        http://cryp.to/nixos-meetup-3-slides.pdf and also -- in a form
-        ready for cut &amp; paste -- at
-        https://github.com/NixOS/cabal2nix/blob/master/doc/nixos-meetup-3-slides.md.
-      </para>
-    </listitem>
-    <listitem>
-      <para>
-        Another Youtube video is
-        <link xlink:href="https://www.youtube.com/watch?v=mQd3s57n_2Y">Escaping
-        Cabal Hell with Nix</link>, which discusses the subject of
-        Haskell development with Nix but also provides a basic
-        introduction to Nix as well, i.e. it's suitable for viewers with
-        almost no prior Nix experience.
-      </para>
-    </listitem>
-    <listitem>
-      <para>
-        Oliver Charles wrote a very nice
-        <link xlink:href="http://wiki.ocharles.org.uk/Nix">Tutorial how to
-        develop Haskell packages with Nix</link>.
-      </para>
-    </listitem>
-    <listitem>
-      <para>
-        The <emphasis>Journey into the Haskell NG
-        infrastructure</emphasis> series of postings describe the new
-        Haskell infrastructure in great detail:
-      </para>
-      <itemizedlist>
-        <listitem>
-          <para>
-            <link xlink:href="http://lists.science.uu.nl/pipermail/nix-dev/2015-January/015591.html">Part
-            1</link> explains the differences between the old and the
-            new code and gives instructions how to migrate to the new
-            setup.
-          </para>
-        </listitem>
-        <listitem>
-          <para>
-            <link xlink:href="http://lists.science.uu.nl/pipermail/nix-dev/2015-January/015608.html">Part
-            2</link> looks in-depth at how to tweak and configure your
-            setup by means of overrides.
-          </para>
-        </listitem>
-        <listitem>
-          <para>
-            <link xlink:href="http://lists.science.uu.nl/pipermail/nix-dev/2015-April/016912.html">Part
-            3</link> describes the infrastructure that keeps the
-            Haskell package set in Nixpkgs up-to-date.
-          </para>
-        </listitem>
-      </itemizedlist>
-    </listitem>
-  </itemizedlist>
-</section>
-
-</chapter>

doc/introduction.md

@@ -0,0 +1,48 @@
+---
+title: Introduction
+author: Frederik Rietdijk
+date: 2015-11-25
+---
+
+# Introduction
+
+The Nix Packages collection (Nixpkgs) is a set of over 30,000 packages for the
+[Nix package manager](http://nixos.org/nix/), released under a [permissive MIT/X11 license](https://github.com/NixOS/nixpkgs/blob/master/COPYING).
+Packages are available for several architectures, and can be used with the Nix package manager
+on most GNU/Linux distributions as well as NixOS.
+
+This manual describes how to write packages for the Nix Packages collection
+(Nixpkgs). Thus it’s for packagers and developers who want to add packages to
+Nixpkgs. If you like to learn more about the Nix package manager and the Nix
+expression language, then you are kindly referred to the [Nix manual](http://nixos.org/nix/manual/).
+
+## Overview of Nixpkgs
+
+Nix expressions describe how to build packages from source and are collected in
+the [nixpkgs repository](https://github.com/NixOS/nixpkgs). Also included in the
+collection are Nix expressions for [NixOS modules](http://nixos.org/nixos/manual/index.html#sec-writing-modules). With
+these expressions the Nix package manager can build binary packages.
+
+Packages, including the Nix packages collection, are distributed through
+[channels](http://nixos.org/nix/manual/#sec-channels). The collection is
+distributed for users of Nix on non-NixOS distributions through the channel
+`nixpkgs`. Users of NixOS generally use one of the `nixos-*` channels, e.g.
+`nixos-15.09`, which includes all packages and modules for the stable NixOS
+15.09. The channels of the stable NixOS releases are generally only given
+security updates. More up to date packages and modules are available via the
+`nixos-unstable` channel.
+
+Both `nixos-unstable` and `nixpkgs` follow the `master` branch of the Nixpkgs
+repository, although both do lag the `master` branch by generally [a couple of days](http://howoldis.herokuapp.com/). Updates to a channel are distributed as
+soon as all tests for that channel pass, e.g. [this table](http://hydra.nixos.org/job/nixpkgs/trunk/unstable#tabs-constituents)
+shows the status of tests for the `nixpkgs` channel.
+
+The tests are conducted by a cluster called [Hydra](http://nixos.org/hydra/),
+which also builds binary packages from the Nix expressions in Nixpkgs. As soon
+as a channel is updated, the binaries are made available via a [binary cache](https://cache.nixos.org). Until the channel updates, binaries that have
+already been built, are available via [Hydra's binary cache](https://hydra.nixos.org).
+
+The current Nix expressions of the channels are available in the
+[`nixpkgs-channels`](https://github.com/NixOS/nixpkgs-channels) repository,
+which has branches corresponding to the available channels. There is also the
+Nixpkgs Monitor which keeps track of updates and security vulnerabilities.

doc/introduction.xml

@@ -1,21 +0,0 @@
-<chapter xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xml:id="chap-introduction">
-
-<title>Introduction</title>
-
-<para>This manual tells you how to write packages for the Nix Packages
-collection (Nixpkgs).  Thus it’s for packagers and developers who want
-to add packages to Nixpkgs.  End users are kindly referred to the
-<link xlink:href="http://hydra.nixos.org/job/nix/trunk/tarball/latest/download-by-type/doc/manual">Nix
-manual</link>.</para>
-
-<para>This manual does not describe the syntax and semantics of the
-Nix expression language, which are given in the Nix manual in the
-<link
-xlink:href="http://hydra.nixos.org/job/nix/trunk/tarball/latest/download-by-type/doc/manual/#chap-writing-nix-expressions">chapter
-on writing Nix expressions</link>.  It only describes the facilities
-provided by Nixpkgs to make writing packages easier, such as the
-standard build environment (<literal>stdenv</literal>).</para>
-
-</chapter>

doc/languages-frameworks/coq.xml

@@ -0,0 +1,41 @@
+<section xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xml:id="sec-language-coq">
+
+<title>Coq</title>
+  <para>
+    Coq libraries should be installed in
+    <literal>$(out)/lib/coq/${coq.coq-version}/user-contrib/</literal>.
+    Such directories are automatically added to the
+    <literal>$COQPATH</literal> environment variable by the hook defined
+    in the Coq derivation.
+  </para>
+  <para>
+    Some libraries require OCaml and sometimes also Camlp5. The exact
+    versions that were used to build Coq are saved in the
+    <literal>coq.ocaml</literal> and <literal>coq.camlp5</literal>
+    attributes.
+  </para>
+  <para>
+    Here is a simple package example. It is a pure Coq library, thus it
+    only depends on Coq. Its <literal>makefile</literal> has been
+    generated using <literal>coq_makefile</literal> so we only have to
+    set the <literal>$COQLIB</literal> variable at install time.
+  </para>
+  <programlisting>
+{stdenv, fetchurl, coq}:
+stdenv.mkDerivation {
+  src = fetchurl {
+    url = http://coq.inria.fr/pylons/contribs/files/Karatsuba/v8.4/Karatsuba.tar.gz;
+    sha256 = "0ymfpv4v49k4fm63nq6gcl1hbnnxrvjjp7yzc4973n49b853c5b1";
+  };
+
+  name = "coq-karatsuba";
+
+  buildInputs = [ coq ];
+
+  installFlags = "COQLIB=$(out)/lib/coq/${coq.coq-version}/";
+}
+</programlisting>
+</section>
+

doc/languages-frameworks/go.xml

@@ -0,0 +1,124 @@
+<section xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xml:id="sec-language-go">
+
+<title>Go</title>
+
+<para>The function <varname>buildGoPackage</varname> builds
+standard Go packages.
+</para>
+
+<example xml:id='ex-buildGoPackage'><title>buildGoPackage</title>
+<programlisting>
+net = buildGoPackage rec {
+  name = "go.net-${rev}";
+  goPackagePath = "golang.org/x/net"; <co xml:id='ex-buildGoPackage-1' />
+  subPackages = [ "ipv4" "ipv6" ]; <co xml:id='ex-buildGoPackage-2' />
+  rev = "e0403b4e005";
+  src = fetchFromGitHub {
+    inherit rev;
+    owner = "golang";
+    repo = "net";
+    sha256 = "1g7cjzw4g4301a3yqpbk8n1d4s97sfby2aysl275x04g0zh8jxqp";
+  };
+  goPackageAliases = [ "code.google.com/p/go.net" ]; <co xml:id='ex-buildGoPackage-3' />
+  propagatedBuildInputs = [ goPackages.text ]; <co xml:id='ex-buildGoPackage-4' />
+  buildFlags = "--tags release"; <co xml:id='ex-buildGoPackage-5' />
+  disabled = isGo13;<co xml:id='ex-buildGoPackage-6' />
+};
+</programlisting>
+</example>
+
+<para><xref linkend='ex-buildGoPackage'/> is an example expression using buildGoPackage,
+the following arguments are of special significance to the function:
+
+<calloutlist>
+
+  <callout arearefs='ex-buildGoPackage-1'>
+    <para>
+      <varname>goPackagePath</varname> specifies the package's canonical Go import path.
+    </para>
+  </callout>
+
+  <callout arearefs='ex-buildGoPackage-2'>
+    <para>
+      <varname>subPackages</varname> limits the builder from building child packages that
+      have not been listed. If <varname>subPackages</varname> is not specified, all child
+      packages will be built.
+    </para>
+    <para>
+      In this example only <literal>code.google.com/p/go.net/ipv4</literal> and
+      <literal>code.google.com/p/go.net/ipv6</literal> will be built.
+    </para>
+  </callout>
+
+  <callout arearefs='ex-buildGoPackage-3'>
+    <para>
+      <varname>goPackageAliases</varname> is a list of alternative import paths
+      that are valid for this library.
+      Packages that depend on this library will automatically rename
+      import paths that match any of the aliases to <literal>goPackagePath</literal>.
+    </para>
+    <para>
+      In this example imports will be renamed from
+      <literal>code.google.com/p/go.net</literal> to
+      <literal>golang.org/x/net</literal> in every package that depend on the
+      <literal>go.net</literal> library.
+    </para>
+  </callout>
+
+  <callout arearefs='ex-buildGoPackage-4'>
+    <para>
+      <varname>propagatedBuildInputs</varname> is where the dependencies of a Go library are
+      listed. Only libraries should list <varname>propagatedBuildInputs</varname>. If a standalone
+      program is being built instead, use <varname>buildInputs</varname>. If a library's tests require
+      additional dependencies that are not propagated, they should be listed in <varname>buildInputs</varname>.
+    </para>
+  </callout>
+
+  <callout arearefs='ex-buildGoPackage-5'>
+    <para>
+      <varname>buildFlags</varname> is a list of flags passed to the go build command.
+    </para>
+  </callout>
+
+  <callout arearefs='ex-buildGoPackage-6'>
+    <para>
+      If <varname>disabled</varname> is <literal>true</literal>,
+      nix will refuse to build this package.
+    </para>
+    <para>
+      In this example the package will not be built for go 1.3. The <literal>isGo13</literal>
+      is an utility function that returns <literal>true</literal> if go used to build the
+      package has version 1.3.x.
+    </para>
+  </callout>
+
+</calloutlist>
+
+</para>
+
+<para>
+Reusable Go libraries may be found in the <varname>goPackages</varname> set. You can test
+build a Go package as follows:
+
+<screen>
+$ nix-build -A goPackages.net
+</screen>
+
+</para>
+
+<para>
+You may use Go packages installed into the active Nix profiles by adding
+the following to your ~/.bashrc:
+
+<screen>
+for p in $NIX_PROFILES; do
+    GOPATH="$p/share/go:$GOPATH"
+done
+</screen>
+</para>
+
+  <para>To extract dependency information from a Go package in automated way use <link xlink:href="https://github.com/cstrahan/go2nix">go2nix</link>.</para>
+</section>
+

doc/languages-frameworks/index.xml

@@ -0,0 +1,45 @@
+<chapter xmlns="http://docbook.org/ns/docbook"
+         xmlns:xi="http://www.w3.org/2001/XInclude"
+         xml:id="chap-language-support">
+
+<title>Support for specific programming languages and frameworks</title>
+
+<para>The <link linkend="chap-stdenv">standard build
+environment</link> makes it easy to build typical Autotools-based
+packages with very little code.  Any other kind of package can be
+accomodated by overriding the appropriate phases of
+<literal>stdenv</literal>.  However, there are specialised functions
+in Nixpkgs to easily build packages for other programming languages,
+such as Perl or Haskell.  These are described in this chapter.</para>
+
+
+<xi:include href="perl.xml" />
+<xi:include href="python.xml" />
+<xi:include href="ruby.xml" />
+<xi:include href="go.xml" />
+<xi:include href="java.xml" />
+<xi:include href="lua.xml" />
+<xi:include href="coq.xml" />
+<xi:include href="idris.xml" /> <!-- generated from ../../pkgs/development/idris-modules/README.md  -->
+<xi:include href="r.xml" /> <!-- generated from ../../pkgs/development/r-modules/README.md  -->
+<xi:include href="qt.xml" />
+<xi:include href="texlive.xml" />
+
+
+<!--
+<section><title>Haskell</title>
+
+<para>TODO</para>
+
+</section>
+
+
+<section><title>TeX / LaTeX</title>
+
+<para>* Special support for building TeX documents</para>
+
+</section>
+-->
+
+
+</chapter>

doc/languages-frameworks/java.xml

@@ -0,0 +1,84 @@
+<section xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xml:id="sec-language-java">
+
+<title>Java</title>
+
+<para>Ant-based Java packages are typically built from source as follows:
+
+<programlisting>
+stdenv.mkDerivation {
+  name = "...";
+  src = fetchurl { ... };
+
+  buildInputs = [ jdk ant ];
+
+  buildPhase = "ant";
+}
+</programlisting>
+
+Note that <varname>jdk</varname> is an alias for the OpenJDK.</para>
+
+<para>JAR files that are intended to be used by other packages should
+be installed in <filename>$out/share/java</filename>.  The OpenJDK has
+a stdenv setup hook that adds any JARs in the
+<filename>share/java</filename> directories of the build inputs to the
+<envar>CLASSPATH</envar> environment variable.  For instance, if the
+package <literal>libfoo</literal> installs a JAR named
+<filename>foo.jar</filename> in its <filename>share/java</filename>
+directory, and another package declares the attribute
+
+<programlisting>
+buildInputs = [ jdk libfoo ];
+</programlisting>
+
+then <envar>CLASSPATH</envar> will be set to
+<filename>/nix/store/...-libfoo/share/java/foo.jar</filename>.</para>
+
+<para>Private JARs
+should be installed in a location like
+<filename>$out/share/<replaceable>package-name</replaceable></filename>.</para>
+
+<para>If your Java package provides a program, you need to generate a
+wrapper script to run it using the OpenJRE.  You can use
+<literal>makeWrapper</literal> for this:
+
+<programlisting>
+buildInputs = [ makeWrapper ];
+
+installPhase =
+  ''
+    mkdir -p $out/bin
+    makeWrapper ${jre}/bin/java $out/bin/foo \
+      --add-flags "-cp $out/share/java/foo.jar org.foo.Main"
+  '';
+</programlisting>
+
+Note the use of <literal>jre</literal>, which is the part of the
+OpenJDK package that contains the Java Runtime Environment.  By using
+<literal>${jre}/bin/java</literal> instead of
+<literal>${jdk}/bin/java</literal>, you prevent your package from
+depending on the JDK at runtime.</para>
+
+<para>It is possible to use a different Java compiler than
+<command>javac</command> from the OpenJDK.  For instance, to use the
+Eclipse Java Compiler:
+
+<programlisting>
+buildInputs = [ jre ant ecj ];
+</programlisting>
+
+(Note that here you don’t need the full JDK as an input, but just the
+JRE.)  The ECJ has a stdenv setup hook that sets some environment
+variables to cause Ant to use ECJ, but this doesn’t work with all Ant
+files.  Similarly, you can use the GNU Java Compiler:
+
+<programlisting>
+buildInputs = [ gcj ant ];
+</programlisting>
+
+Here, Ant will automatically use <command>gij</command> (the GNU Java
+Runtime) instead of the OpenJRE.</para>
+
+</section>
+

doc/languages-frameworks/lua.xml

@@ -0,0 +1,51 @@
+<section xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xml:id="sec-language-lua">
+
+<title>Lua</title>
+
+<para>
+  Lua packages are built by the <varname>buildLuaPackage</varname> function.  This function is
+  implemented
+  in <link xlink:href="https://github.com/NixOS/nixpkgs/blob/master/pkgs/development/lua-modules/generic/default.nix">
+  <filename>pkgs/development/lua-modules/generic/default.nix</filename></link>
+  and works similarly to <varname>buildPerlPackage</varname>. (See
+  <xref linkend="sec-language-perl"/> for details.)
+</para>
+
+<para>
+  Lua packages are defined
+  in <link xlink:href="https://github.com/NixOS/nixpkgs/blob/master/pkgs/top-level/lua-packages.nix"><filename>pkgs/top-level/lua-packages.nix</filename></link>.
+  Most of them are simple. For example:
+
+  <programlisting>
+fileSystem = buildLuaPackage {
+  name = "filesystem-1.6.2";
+  src = fetchurl {
+    url = "https://github.com/keplerproject/luafilesystem/archive/v1_6_2.tar.gz";
+    sha256 = "1n8qdwa20ypbrny99vhkmx8q04zd2jjycdb5196xdhgvqzk10abz";
+  };
+  meta = {
+    homepage = "https://github.com/keplerproject/luafilesystem";
+    hydraPlatforms = stdenv.lib.platforms.linux;
+    maintainers = with maintainers; [ flosse ];
+  };
+};
+  </programlisting>
+</para>
+
+<para>
+  Though, more complicated package should be placed in a seperate file in
+  <link
+  xlink:href="https://github.com/NixOS/nixpkgs/blob/master/pkgs/development/lua-modules"><filename>pkgs/development/lua-modules</filename></link>.
+</para>
+<para>
+  Lua packages accept additional parameter <varname>disabled</varname>, which defines
+  the condition of disabling package from luaPackages. For example, if package has
+  <varname>disabled</varname> assigned to <literal>lua.luaversion != "5.1"</literal>,
+  it will not be included in any luaPackages except lua51Packages, making it
+  only be built for lua 5.1.
+</para>
+
+</section>
+

doc/languages-frameworks/perl.xml

@@ -0,0 +1,181 @@
+<section xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xml:id="sec-language-perl">
+
+<title>Perl</title>
+
+<para>Nixpkgs provides a function <varname>buildPerlPackage</varname>,
+a generic package builder function for any Perl package that has a
+standard <varname>Makefile.PL</varname>.  It’s implemented in <link
+xlink:href="https://github.com/NixOS/nixpkgs/blob/master/pkgs/development/perl-modules/generic"><filename>pkgs/development/perl-modules/generic</filename></link>.</para>
+
+<para>Perl packages from CPAN are defined in <link
+xlink:href="https://github.com/NixOS/nixpkgs/blob/master/pkgs/top-level/perl-packages.nix"><filename>pkgs/top-level/perl-packages.nix</filename></link>,
+rather than <filename>pkgs/all-packages.nix</filename>.  Most Perl
+packages are so straight-forward to build that they are defined here
+directly, rather than having a separate function for each package
+called from <filename>perl-packages.nix</filename>.  However, more
+complicated packages should be put in a separate file, typically in
+<filename>pkgs/development/perl-modules</filename>.  Here is an
+example of the former:
+
+<programlisting>
+ClassC3 = buildPerlPackage rec {
+  name = "Class-C3-0.21";
+  src = fetchurl {
+    url = "mirror://cpan/authors/id/F/FL/FLORA/${name}.tar.gz";
+    sha256 = "1bl8z095y4js66pwxnm7s853pi9czala4sqc743fdlnk27kq94gz";
+  };
+};
+</programlisting>
+
+Note the use of <literal>mirror://cpan/</literal>, and the
+<literal>${name}</literal> in the URL definition to ensure that the
+name attribute is consistent with the source that we’re actually
+downloading.  Perl packages are made available in
+<filename>all-packages.nix</filename> through the variable
+<varname>perlPackages</varname>.  For instance, if you have a package
+that needs <varname>ClassC3</varname>, you would typically write
+
+<programlisting>
+foo = import ../path/to/foo.nix {
+  inherit stdenv fetchurl ...;
+  inherit (perlPackages) ClassC3;
+};
+</programlisting>
+
+in <filename>all-packages.nix</filename>.  You can test building a
+Perl package as follows:
+
+<screen>
+$ nix-build -A perlPackages.ClassC3
+</screen>
+
+<varname>buildPerlPackage</varname> adds <literal>perl-</literal> to
+the start of the name attribute, so the package above is actually
+called <literal>perl-Class-C3-0.21</literal>.  So to install it, you
+can say:
+
+<screen>
+$ nix-env -i perl-Class-C3
+</screen>
+
+(Of course you can also install using the attribute name:
+<literal>nix-env -i -A perlPackages.ClassC3</literal>.)</para>
+
+<para>So what does <varname>buildPerlPackage</varname> do?  It does
+the following:
+
+<orderedlist>
+
+  <listitem><para>In the configure phase, it calls <literal>perl
+  Makefile.PL</literal> to generate a Makefile.  You can set the
+  variable <varname>makeMakerFlags</varname> to pass flags to
+  <filename>Makefile.PL</filename></para></listitem>
+
+  <listitem><para>It adds the contents of the <envar>PERL5LIB</envar>
+  environment variable to <literal>#! .../bin/perl</literal> line of
+  Perl scripts as <literal>-I<replaceable>dir</replaceable></literal>
+  flags.  This ensures that a script can find its
+  dependencies.</para></listitem>
+
+  <listitem><para>In the fixup phase, it writes the propagated build
+  inputs (<varname>propagatedBuildInputs</varname>) to the file
+  <filename>$out/nix-support/propagated-user-env-packages</filename>.
+  <command>nix-env</command> recursively installs all packages listed
+  in this file when you install a package that has it.  This ensures
+  that a Perl package can find its dependencies.</para></listitem>
+
+</orderedlist>
+
+</para>
+
+<para><varname>buildPerlPackage</varname> is built on top of
+<varname>stdenv</varname>, so everything can be customised in the
+usual way.  For instance, the <literal>BerkeleyDB</literal> module has
+a <varname>preConfigure</varname> hook to generate a configuration
+file used by <filename>Makefile.PL</filename>:
+
+<programlisting>
+{ buildPerlPackage, fetchurl, db }:
+
+buildPerlPackage rec {
+  name = "BerkeleyDB-0.36";
+
+  src = fetchurl {
+    url = "mirror://cpan/authors/id/P/PM/PMQS/${name}.tar.gz";
+    sha256 = "07xf50riarb60l1h6m2dqmql8q5dij619712fsgw7ach04d8g3z1";
+  };
+
+  preConfigure = ''
+    echo "LIB = ${db}/lib" > config.in
+    echo "INCLUDE = ${db}/include" >> config.in
+  '';
+}
+</programlisting>
+
+</para>
+
+<para>Dependencies on other Perl packages can be specified in the
+<varname>buildInputs</varname> and
+<varname>propagatedBuildInputs</varname> attributes.  If something is
+exclusively a build-time dependency, use
+<varname>buildInputs</varname>; if it’s (also) a runtime dependency,
+use <varname>propagatedBuildInputs</varname>.  For instance, this
+builds a Perl module that has runtime dependencies on a bunch of other
+modules:
+
+<programlisting>
+ClassC3Componentised = buildPerlPackage rec {
+  name = "Class-C3-Componentised-1.0004";
+  src = fetchurl {
+    url = "mirror://cpan/authors/id/A/AS/ASH/${name}.tar.gz";
+    sha256 = "0xql73jkcdbq4q9m0b0rnca6nrlvf5hyzy8is0crdk65bynvs8q1";
+  };
+  propagatedBuildInputs = [
+    ClassC3 ClassInspector TestException MROCompat
+  ];
+};
+</programlisting>
+
+</para>
+
+<section xml:id="ssec-generation-from-CPAN"><title>Generation from CPAN</title>
+
+<para>Nix expressions for Perl packages can be generated (almost)
+automatically from CPAN.  This is done by the program
+<command>nix-generate-from-cpan</command>, which can be installed
+as follows:</para>
+
+<screen>
+$ nix-env -i nix-generate-from-cpan
+</screen>
+
+<para>This program takes a Perl module name, looks it up on CPAN,
+fetches and unpacks the corresponding package, and prints a Nix
+expression on standard output.  For example:
+
+<screen>
+$ nix-generate-from-cpan XML::Simple
+  XMLSimple = buildPerlPackage {
+    name = "XML-Simple-2.20";
+    src = fetchurl {
+      url = mirror://cpan/authors/id/G/GR/GRANTM/XML-Simple-2.20.tar.gz;
+      sha256 = "5cff13d0802792da1eb45895ce1be461903d98ec97c9c953bc8406af7294434a";
+    };
+    propagatedBuildInputs = [ XMLNamespaceSupport XMLSAX XMLSAXExpat ];
+    meta = {
+      description = "Easily read/write XML (esp config files)";
+      license = "perl";
+    };
+  };
+</screen>
+
+The output can be pasted into
+<filename>pkgs/top-level/perl-packages.nix</filename> or wherever else
+you need it.</para>
+
+</section>
+
+</section>
+

doc/languages-frameworks/python.xml

@@ -0,0 +1,447 @@
+<section xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xml:id="sec-python">
+
+<title>Python</title>
+
+<para>
+  Currently supported interpreters are <varname>python26</varname>, <varname>python27</varname>,
+  <varname>python33</varname>, <varname>python34</varname>, <varname>python35</varname>
+  and <varname>pypy</varname>.
+</para>
+
+<para>
+  <varname>python</varname> is an alias to <varname>python27</varname> and <varname>python3</varname> is an alias to <varname>python34</varname>.
+</para>
+
+<para>
+  <varname>python26</varname> and <varname>python27</varname> do not include modules that require
+  external dependencies (to reduce dependency bloat). Following modules need to be added as
+  <varname>buildInput</varname> explicitly:
+</para>
+
+<itemizedlist>
+  <listitem><para><varname>python.modules.bsddb</varname></para></listitem>
+  <listitem><para><varname>python.modules.curses</varname></para></listitem>
+  <listitem><para><varname>python.modules.curses_panel</varname></para></listitem>
+  <listitem><para><varname>python.modules.crypt</varname></para></listitem>
+  <listitem><para><varname>python.modules.gdbm</varname></para></listitem>
+  <listitem><para><varname>python.modules.sqlite3</varname></para></listitem>
+  <listitem><para><varname>python.modules.tkinter</varname></para></listitem>
+  <listitem><para><varname>python.modules.readline</varname></para></listitem>
+</itemizedlist>
+
+<para>For convenience <varname>python27Full</varname> and <varname>python26Full</varname>
+are provided with all modules included.</para>
+
+<para>
+  Python packages that
+  use <link xlink:href="http://pypi.python.org/pypi/setuptools/"><literal>setuptools</literal></link> or <literal>distutils</literal>,
+  can be built using the <varname>buildPythonPackage</varname> function as documented below.
+</para>
+
+<para>
+ All packages depending on any Python interpreter get appended <varname>$out/${python.sitePackages}</varname>
+ to <literal>$PYTHONPATH</literal> if such directory exists.
+</para>
+
+<variablelist>
+  <title>
+     Useful attributes on interpreters packages:
+  </title>
+
+  <varlistentry>
+    <term><varname>libPrefix</varname></term>
+    <listitem><para>
+        Name of the folder in <literal>${python}/lib/</literal> for corresponding interpreter.
+    </para></listitem>
+  </varlistentry>
+
+  <varlistentry>
+    <term><varname>interpreter</varname></term>
+    <listitem><para>
+        Alias for <literal>${python}/bin/${executable}.</literal>
+    </para></listitem>
+  </varlistentry>
+
+  <varlistentry>
+    <term><varname>buildEnv</varname></term>
+    <listitem><para>
+        Function to build python interpreter environments with extra packages bundled together.
+        See <xref linkend="ssec-python-build-env" /> for usage and documentation.
+    </para></listitem>
+  </varlistentry>
+
+  <varlistentry>
+    <term><varname>sitePackages</varname></term>
+    <listitem><para>
+      Alias for <literal>lib/${libPrefix}/site-packages</literal>.
+    </para></listitem>
+  </varlistentry>
+
+  <varlistentry>
+    <term><varname>executable</varname></term>
+    <listitem><para>
+      Name of the interpreter executable, ie <literal>python3.4</literal>.
+    </para></listitem>
+  </varlistentry>
+
+</variablelist>
+<section xml:id="ssec-build-python-package"><title><varname>buildPythonPackage</varname> function</title>
+
+  <para>
+  The function is implemented in <link xlink:href="https://github.com/NixOS/nixpkgs/blob/master/pkgs/development/python-modules/generic/default.nix">
+  <filename>pkgs/development/python-modules/generic/default.nix</filename></link>.
+  Example usage:
+
+<programlisting language="nix">
+twisted = buildPythonPackage {
+  name = "twisted-8.1.0";
+
+  src = pkgs.fetchurl {
+    url = http://tmrc.mit.edu/mirror/twisted/Twisted/8.1/Twisted-8.1.0.tar.bz2;
+    sha256 = "0q25zbr4xzknaghha72mq57kh53qw1bf8csgp63pm9sfi72qhirl";
+  };
+
+  propagatedBuildInputs = [ self.ZopeInterface ];
+
+  meta = {
+    homepage = http://twistedmatrix.com/;
+    description = "Twisted, an event-driven networking engine written in Python";
+    license = stdenv.lib.licenses.mit;
+  };
+};
+</programlisting>
+
+  Most of Python packages that use <varname>buildPythonPackage</varname> are defined
+  in <link xlink:href="https://github.com/NixOS/nixpkgs/blob/master/pkgs/top-level/python-packages.nix"><filename>pkgs/top-level/python-packages.nix</filename></link>
+  and generated for each python interpreter separately into attribute sets <varname>python26Packages</varname>,
+  <varname>python27Packages</varname>, <varname>python35Packages</varname>, <varname>python33Packages</varname>,
+  <varname>python34Packages</varname> and <varname>pypyPackages</varname>.
+  </para>
+
+  <para>
+    <function>buildPythonPackage</function> mainly does four things:
+
+    <orderedlist>
+      <listitem><para>
+        In the <varname>buildPhase</varname>, it calls
+        <literal>${python.interpreter} setup.py bdist_wheel</literal> to build a wheel binary zipfile.
+      </para></listitem>
+
+      <listitem><para>
+        In the <varname>installPhase</varname>, it installs the wheel file using
+        <literal>pip install *.whl</literal>.
+      </para></listitem>
+
+      <listitem><para>
+        In the <varname>postFixup</varname> phase, <literal>wrapPythonPrograms</literal>
+        bash function is called to wrap all programs in <filename>$out/bin/*</filename>
+        directory to include <literal>$PYTHONPATH</literal> and <literal>$PATH</literal>
+        environment variables.
+      </para></listitem>
+
+      <listitem><para>
+        In the <varname>installCheck</varname> phase, <literal>${python.interpreter} setup.py test</literal>
+        is ran.
+      </para></listitem>
+    </orderedlist>
+  </para>
+
+  <para>By default <varname>doCheck = true</varname> is set</para>
+
+  <para>
+    As in Perl, dependencies on other Python packages can be specified in the
+    <varname>buildInputs</varname> and
+    <varname>propagatedBuildInputs</varname> attributes.  If something is
+    exclusively a build-time dependency, use
+    <varname>buildInputs</varname>; if it’s (also) a runtime dependency,
+    use <varname>propagatedBuildInputs</varname>.
+  </para>
+
+  <para>
+    By default <varname>meta.platforms</varname> is set to the same value
+    as the interpreter unless overriden otherwise.
+  </para>
+
+  <variablelist>
+    <title>
+      <varname>buildPythonPackage</varname> parameters
+      (all parameters from <varname>mkDerivation</varname> function are still supported)
+    </title>
+
+    <varlistentry>
+      <term><varname>namePrefix</varname></term>
+      <listitem><para>
+        Prepended text to <varname>${name}</varname> parameter.
+        Defaults to <literal>"python3.3-"</literal> for Python 3.3, etc. Set it to
+        <literal>""</literal>
+        if you're packaging an application or a command line tool.
+      </para></listitem>
+    </varlistentry>
+
+    <varlistentry>
+      <term><varname>disabled</varname></term>
+      <listitem><para>
+        If <varname>true</varname>, package is not build for
+        particular python interpreter version. Grep around
+        <filename>pkgs/top-level/python-packages.nix</filename>
+        for examples.
+      </para></listitem>
+    </varlistentry>
+
+    <varlistentry>
+      <term><varname>setupPyBuildFlags</varname></term>
+      <listitem><para>
+        List of flags passed to <command>setup.py build_ext</command> command.
+      </para></listitem>
+    </varlistentry>
+
+    <varlistentry>
+      <term><varname>pythonPath</varname></term>
+      <listitem><para>
+        List of packages to be added into <literal>$PYTHONPATH</literal>.
+        Packages in <varname>pythonPath</varname> are not propagated
+        (contrary to <varname>propagatedBuildInputs</varname>).
+      </para></listitem>
+    </varlistentry>
+
+    <varlistentry>
+      <term><varname>preShellHook</varname></term>
+      <listitem><para>
+        Hook to execute commands before <varname>shellHook</varname>.
+      </para></listitem>
+    </varlistentry>
+
+    <varlistentry>
+      <term><varname>postShellHook</varname></term>
+      <listitem><para>
+        Hook to execute commands after <varname>shellHook</varname>.
+      </para></listitem>
+    </varlistentry>
+
+    <varlistentry>
+      <term><varname>makeWrapperArgs</varname></term>
+      <listitem><para>
+        A list of strings. Arguments to be passed to
+        <varname>makeWrapper</varname>, which wraps generated binaries. By
+        default, the arguments to <varname>makeWrapper</varname> set
+        <varname>PATH</varname> and <varname>PYTHONPATH</varname> environment
+        variables before calling the binary. Additional arguments here can
+        allow a developer to set environment variables which will be
+        available when the binary is run. For example,
+        <varname>makeWrapperArgs = ["--set FOO BAR" "--set BAZ QUX"]</varname>.
+      </para></listitem>
+    </varlistentry>
+
+  </variablelist>
+
+</section>
+
+<section xml:id="ssec-python-build-env"><title><function>python.buildEnv</function> function</title>
+  <para>
+    Create Python environments using low-level <function>pkgs.buildEnv</function> function. Example <filename>default.nix</filename>:
+
+<programlisting language="nix">
+<![CDATA[with import <nixpkgs> {};
+
+python.buildEnv.override {
+  extraLibs = [ pkgs.pythonPackages.pyramid ];
+  ignoreCollisions = true;
+}]]>
+</programlisting>
+
+    Running <command>nix-build</command> will create
+    <filename>/nix/store/cf1xhjwzmdki7fasgr4kz6di72ykicl5-python-2.7.8-env</filename>
+    with wrapped binaries in <filename>bin/</filename>.
+  </para>
+
+  <para>
+  You can also use <varname>env</varname> attribute to create local
+  environments with needed packages installed (somewhat comparable to
+  <literal>virtualenv</literal>). For example, with the following
+  <filename>shell.nix</filename>:
+
+<programlisting language="nix">
+<![CDATA[with import <nixpkgs> {};
+
+(python3.buildEnv.override {
+  extraLibs = with python3Packages;
+    [ numpy
+      requests
+    ];
+}).env]]>
+</programlisting>
+
+  Running <command>nix-shell</command> will drop you into a shell where
+  <command>python</command> will have specified packages in its path.
+  </para>
+
+  <variablelist>
+    <title>
+      <function>python.buildEnv</function> arguments
+    </title>
+
+    <varlistentry>
+      <term><varname>extraLibs</varname></term>
+      <listitem><para>
+        List of packages installed inside the environment.
+      </para></listitem>
+    </varlistentry>
+
+    <varlistentry>
+      <term><varname>postBuild</varname></term>
+      <listitem><para>
+        Shell command executed after the build of environment.
+      </para></listitem>
+    </varlistentry>
+
+    <varlistentry>
+      <term><varname>ignoreCollisions</varname></term>
+      <listitem><para>
+         Ignore file collisions inside the environment (default is <varname>false</varname>).
+      </para></listitem>
+    </varlistentry>
+  </variablelist>
+</section>
+
+<section xml:id="ssec-python-tools"><title>Tools</title>
+
+<para>Packages inside nixpkgs are written by hand. However many tools
+exist in community to help save time. No tool is preferred at the moment.
+</para>
+
+<itemizedlist>
+
+  <listitem><para>
+    <link xlink:href="https://github.com/proger/python2nix">python2nix</link>
+    by Vladimir Kirillov
+  </para></listitem>
+
+  <listitem><para>
+    <link xlink:href="https://github.com/garbas/pypi2nix">pypi2nix</link>
+    by Rok Garbas
+  </para></listitem>
+
+  <listitem><para>
+    <link xlink:href="https://github.com/offlinehacker/pypi2nix">pypi2nix</link>
+    by Jaka Hudoklin
+  </para></listitem>
+
+</itemizedlist>
+
+</section>
+
+<section xml:id="ssec-python-development"><title>Development</title>
+
+  <para>
+    To develop Python packages <function>buildPythonPackage</function> has
+    additional logic inside <varname>shellPhase</varname> to run
+    <command>pip install -e . --prefix $TMPDIR/</command> for the package.
+  </para>
+
+  <warning><para><varname>shellPhase</varname> is executed only if <filename>setup.py</filename>
+  exists.</para></warning>
+
+  <para>
+    Given a <filename>default.nix</filename>:
+
+<programlisting language="nix">
+<![CDATA[with import <nixpkgs> {};
+
+buildPythonPackage {
+  name = "myproject";
+
+  buildInputs = with pkgs.pythonPackages; [ pyramid ];
+
+  src = ./.;
+}]]>
+</programlisting>
+
+    Running <command>nix-shell</command> with no arguments should give you
+    the environment in which the package would be build with
+    <command>nix-build</command>.
+  </para>
+
+  <para>
+    Shortcut to setup environments with C headers/libraries and python packages:
+
+    <programlisting language="bash">$ nix-shell -p pythonPackages.pyramid zlib libjpeg git</programlisting>
+  </para>
+
+  <note><para>
+    There is a boolean value <varname>lib.inNixShell</varname> set to
+    <varname>true</varname> if nix-shell is invoked.
+  </para></note>
+
+</section>
+
+<section xml:id="ssec-python-faq"><title>FAQ</title>
+
+<variablelist>
+
+  <varlistentry>
+    <term>How to solve circular dependencies?</term>
+    <listitem><para>
+      If you have packages <varname>A</varname> and <varname>B</varname> that
+      depend on each other, when packaging <varname>B</varname> override package
+      <varname>A</varname> not to depend on <varname>B</varname> as input
+      (and also the other way around).
+    </para></listitem>
+  </varlistentry>
+
+  <varlistentry>
+    <term><varname>install_data / data_files</varname> problems resulting into <literal>error: could not create '/nix/store/6l1bvljpy8gazlsw2aw9skwwp4pmvyxw-python-2.7.8/etc': Permission denied</literal></term>
+    <listitem><para>
+      <link xlink:href="https://bitbucket.org/pypa/setuptools/issue/130/install_data-doesnt-respect-prefix">
+      Known bug in setuptools <varname>install_data</varname> does not respect --prefix</link>. Example of
+      such package using the feature is <filename>pkgs/tools/X11/xpra/default.nix</filename>. As workaround
+      install it as an extra <varname>preInstall</varname> step:
+
+      <programlisting>${python.interpreter} setup.py install_data --install-dir=$out --root=$out
+sed -i '/ = data_files/d' setup.py</programlisting>
+    </para></listitem>
+  </varlistentry>
+
+  <varlistentry>
+    <term>Rationale of non-existent global site-packages</term>
+    <listitem><para>
+      There is no need to have global site-packages in Nix. Each package has isolated
+      dependency tree and installing any python package will only populate <varname>$PATH</varname>
+      inside user environment. See <xref linkend="ssec-python-build-env" /> to create self-contained
+      interpreter with a set of packages.
+    </para></listitem>
+  </varlistentry>
+
+</variablelist>
+
+</section>
+
+
+<section xml:id="ssec-python-contrib"><title>Contributing guidelines</title>
+<para>
+  Following rules are desired to be respected:
+</para>
+
+<itemizedlist>
+
+  <listitem><para>
+    Make sure package builds for all python interpreters. Use <varname>disabled</varname> argument to
+    <function>buildPythonPackage</function> to set unsupported interpreters.
+  </para></listitem>
+
+  <listitem><para>
+    If tests need to be disabled for a package, make sure you leave a comment about reasoning.
+  </para></listitem>
+
+  <listitem><para>
+    Packages in <link xlink:href="https://github.com/NixOS/nixpkgs/blob/master/pkgs/top-level/python-packages.nix"><filename>pkgs/top-level/python-packages.nix</filename></link>
+    are sorted quasi-alphabetically to avoid merge conflicts.
+  </para></listitem>
+
+</itemizedlist>
+
+</section>
+
+</section>
+

doc/languages-frameworks/qt.xml

@@ -0,0 +1,70 @@
+<section xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xml:id="sec-language-qt">
+
+<title>Qt</title>
+
+<para>The information in this section applies to Qt 5.5 and later.</para>
+
+<para>Qt is an application development toolkit for C++. Although it is
+not a distinct programming language, there are special considerations
+for packaging Qt-based programs and libraries. A small set of tools
+and conventions has grown out of these considerations.</para>
+
+<section xml:id="ssec-qt-libraries"><title>Libraries</title>
+
+<para>Packages that provide libraries should be listed in
+<varname>qt5LibsFun</varname> so that the library is built with each
+Qt version. A set of packages is provided for each version of Qt; for
+example, <varname>qt5Libs</varname> always provides libraries built
+with the latest version, <varname>qt55Libs</varname> provides
+libraries built with Qt 5.5, and so on. To avoid version conflicts, no
+top-level attributes are created for these packages.</para>
+
+</section>
+
+<section xml:id="ssec-qt-programs"><title>Programs</title>
+
+<para>Application packages do not need to be built with every Qt
+version. To ensure consistency between the package's dependencies,
+call the package with <literal>qt5Libs.callPackage</literal> instead
+of the usual <literal>callPackage</literal>. An older version may be
+selected in case of incompatibility. For example, to build with Qt
+5.5, call the package with
+<literal>qt55Libs.callPackage</literal>.</para>
+
+<para>Several environment variables must be set at runtime for Qt
+applications to function correctly, including:</para>
+
+<itemizedlist>
+  <listitem><para><envar>QT_PLUGIN_PATH</envar></para></listitem>
+  <listitem><para><envar>QML_IMPORT_PATH</envar></para></listitem>
+  <listitem><para><envar>QML2_IMPORT_PATH</envar></para></listitem>
+  <listitem><para><envar>XDG_DATA_DIRS</envar></para></listitem>
+</itemizedlist>
+
+<para>To ensure that these are set correctly, the program must be wrapped by
+invoking <literal>wrapQtProgram <replaceable>program</replaceable></literal>
+during installation (for example, during
+<literal>fixupPhase</literal>). <literal>wrapQtProgram</literal>
+accepts the same options as <literal>makeWrapper</literal>.
+</para>
+
+</section>
+
+<section xml:id="ssec-qt-kde"><title>KDE</title>
+
+<para>Many of the considerations above also apply to KDE packages,
+especially the need to set the correct environment variables at
+runtime. To ensure that this is done, invoke <literal>wrapKDEProgram
+<replaceable>program</replaceable></literal> during
+installation. <literal>wrapKDEProgram</literal> also generates a
+<literal>ksycoca</literal> database so that required data and services
+can be found. Like its Qt counterpart,
+<literal>wrapKDEProgram</literal> accepts the same options as
+<literal>makeWrapper</literal>.</para>
+
+</section>
+
+</section>
+

doc/languages-frameworks/ruby.xml

@@ -0,0 +1,78 @@
+<section xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xml:id="sec-language-ruby">
+
+<title>Ruby</title>
+
+  <para>There currently is support to bundle applications that are packaged as Ruby gems. The utility "bundix" allows you to write a <filename>Gemfile</filename>, let bundler create a <filename>Gemfile.lock</filename>, and then convert
+  this into a nix expression that contains all Gem dependencies automatically.</para>
+
+  <para>For example, to package sensu, we did:</para>
+
+<screen>
+<![CDATA[$ cd pkgs/servers/monitoring
+$ mkdir sensu
+$ cat > Gemfile
+source 'https://rubygems.org'
+gem 'sensu'
+$ bundler package --path /tmp/vendor/bundle
+$ $(nix-build '<nixpkgs>' -A bundix)/bin/bundix
+$ cat > default.nix
+{ lib, bundlerEnv, ruby }:
+
+bundlerEnv {
+  name = "sensu-0.17.1";
+
+  inherit ruby;
+  gemfile = ./Gemfile;
+  lockfile = ./Gemfile.lock;
+  gemset = ./gemset.nix;
+
+  meta = with lib; {
+    description = "A monitoring framework that aims to be simple, malleable,
+and scalable";
+    homepage    = http://sensuapp.org/;
+    license     = with licenses; mit;
+    maintainers = with maintainers; [ theuni ];
+    platforms   = platforms.unix;
+  };
+}]]>
+</screen>
+
+<para>Please check in the <filename>Gemfile</filename>, <filename>Gemfile.lock</filename> and the <filename>gemset.nix</filename> so future updates can be run easily.
+</para>
+
+<para>Resulting derivations also have two helpful items, <literal>env</literal> and <literal>wrapper</literal>. The first one allows one to quickly drop into
+<command>nix-shell</command> with the specified environment present. E.g. <command>nix-shell -A sensu.env</command> would give you an environment with Ruby preset
+so it has all the libraries necessary for <literal>sensu</literal> in its paths. The second one can be used to make derivations from custom Ruby scripts which have
+<filename>Gemfile</filename>s with their dependencies specified. It is a derivation with <command>ruby</command> wrapped so it can find all the needed dependencies.
+For example, to make a derivation <literal>my-script</literal> for a <filename>my-script.rb</filename> (which should be placed in <filename>bin</filename>) you should
+run <command>bundix</command> as specified above and then use <literal>bundlerEnv</literal> lile this:</para>
+
+<programlisting>
+<![CDATA[let env = bundlerEnv {
+  name = "my-script-env";
+
+  inherit ruby;
+  gemfile = ./Gemfile;
+  lockfile = ./Gemfile.lock;
+  gemset = ./gemset.nix;
+};
+
+in stdenv.mkDerivation {
+  name = "my-script";
+
+  buildInputs = [ env.wrapper ];
+
+  script = ./my-script.rb;
+
+  buildCommand = ''
+    mkdir -p $out/bin
+    install -D -m755 $script $out/bin/my-script
+    patchShebangs $out/bin/my-script
+  '';
+}]]>
+</programlisting>
+
+</section>
+

doc/languages-frameworks/texlive.xml

@@ -0,0 +1,59 @@
+<section xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xml:id="sec-language-texlive">
+
+<title>TeX Live</title>
+
+<para>Since release 15.09 there is a new TeX Live packaging that lives entirely under attribute <varname>texlive</varname>.</para>
+<section><title>User's guide</title>
+  <itemizedlist>
+    <listitem><para>
+      For basic usage just pull <varname>texlive.combined.scheme-basic</varname> for an environment with basic LaTeX support.</para></listitem>
+    <listitem><para>
+      It typically won't work to use separately installed packages together.
+      Instead, you can build a custom set of packages like this:
+      <programlisting>
+texlive.combine {
+  inherit (texlive) scheme-small collection-langkorean algorithms cm-super;
+}
+      </programlisting>
+      There are all the schemes, collections and a few thousand packages, as defined upstream (perhaps with tiny differences).
+    </para></listitem>
+    <listitem><para>
+      By default you only get executables and files needed during runtime, and a little documentation for the core packages.  To change that, you need to add <varname>pkgFilter</varname> function to <varname>combine</varname>.
+      <programlisting>
+texlive.combine {
+  # inherit (texlive) whatever-you-want;
+  pkgFilter = pkg:
+    pkg.tlType == "run" || pkg.tlType == "bin" || pkg.pname == "cm-super";
+  # elem tlType [ "run" "bin" "doc" "source" ]
+  # there are also other attributes: version, name
+}
+      </programlisting>
+    </para></listitem>
+    <listitem><para>
+      You can list packages e.g. by <command>nix-repl</command>.
+      <programlisting>
+$ nix-repl
+nix-repl> texlive.collection-&lt;TAB>
+      </programlisting>
+    </para></listitem>
+  </itemizedlist>
+</section>
+
+<section><title>Known problems</title>
+  <itemizedlist>
+    <listitem><para>
+      Some tools are still missing, e.g. luajittex;</para></listitem>
+    <listitem><para>
+      some apps aren't packaged/tested yet (asymptote, biber, etc.);</para></listitem>
+    <listitem><para>
+      feature/bug: when a package is rejected by <varname>pkgFilter</varname>, its dependencies are still propagated;</para></listitem>
+    <listitem><para>
+      in case of any bugs or feature requests, file a github issue or better a pull request and /cc @vcunat.</para></listitem>
+  </itemizedlist>
+</section>
+
+
+</section>
+

doc/manual.xml

@@ -12,14 +12,15 @@
   <xi:include href="introduction.xml" />
   <xi:include href="quick-start.xml" />
   <xi:include href="stdenv.xml" />
-  <xi:include href="packageconfig.xml" />
+  <xi:include href="configuration.xml" />
   <xi:include href="functions.xml" />
   <xi:include href="meta.xml" />
-  <xi:include href="language-support.xml" />
+  <xi:include href="languages-frameworks/index.xml" />
   <xi:include href="package-notes.xml" />
   <xi:include href="coding-conventions.xml" />
   <xi:include href="submitting-changes.xml" />
   <xi:include href="haskell-users-guide.xml" />
+  <xi:include href="erlang-users-guide.xml" />
   <xi:include href="contributing.xml" />
 
 </book>

doc/meta.xml

@@ -33,7 +33,7 @@ the package.  The value of a meta-attribute must be a string.</para>
 command-line using <command>nix-env</command>:
 
 <screen>
-$ nix-env -qa hello --meta --json
+$ nix-env -qa hello --json
 {
     "hello": {
         "meta": {
@@ -112,11 +112,6 @@ meta-attributes</title>
     package.</para></listitem>
   </varlistentry>
 
-  <varlistentry>
-    <term><varname>version</varname></term>
-    <listitem><para>Package version.</para></listitem>
-  </varlistentry>
-
   <varlistentry>
     <term><varname>branch</varname></term>
     <listitem><para>Release branch. Used to specify that a package is not
@@ -263,45 +258,54 @@ a value from <varname>stdenv.lib.licenses</varname> defined in
 <link xlink:href="https://github.com/NixOS/nixpkgs/blob/master/lib/licenses.nix">
 <filename>nixpkgs/lib/licenses.nix</filename></link>,
 or in-place license description of the same format if the license is
-unlikely to be useful in another expression.
+unlikely to be useful in another expression.</para>
+
+<para>Although it's typically better to indicate the specific license,
+a few generic options are available:
 
-A few generic options are available, although it's typically better
-to indicate the specific license:
 <variablelist>
 
   <varlistentry>
-    <term><varname>free</varname></term>
+    <term><varname>stdenv.lib.licenses.free</varname>,
+    <varname>"free"</varname></term>
+
     <listitem><para>Catch-all for free software licenses not listed
     above.</para></listitem>
   </varlistentry>
 
   <varlistentry>
-    <term><varname>unfree-redistributable</varname></term>
+    <term><varname>stdenv.lib.licenses.unfreeRedistributable</varname>,
+    <varname>"unfree-redistributable"</varname></term>
+
     <listitem><para>Unfree package that can be redistributed in binary
-    form.  That is, it’s legal to redistribute the
+    form. That is, it’s legal to redistribute the
     <emphasis>output</emphasis> of the derivation.  This means that
     the package can be included in the Nixpkgs
     channel.</para>
 
     <para>Sometimes proprietary software can only be redistributed
-    unmodified.  Make sure the builder doesn’t actually modify the
+    unmodified. Make sure the builder doesn’t actually modify the
     original binaries; otherwise we’re breaking the license.  For
     instance, the NVIDIA X11 drivers can be redistributed unmodified,
     but our builder applies <command>patchelf</command> to make them
-    work.  Thus, its license is <varname>unfree</varname> and it
+    work. Thus, its license is <varname>"unfree"</varname> and it
     cannot be included in the Nixpkgs channel.</para></listitem>
   </varlistentry>
 
   <varlistentry>
-    <term><varname>unfree</varname></term>
-    <listitem><para>Unfree package that cannot be redistributed.  You
+    <term><varname>stdenv.lib.licenses.unfree</varname>,
+    <varname>"unfree"</varname></term>
+
+    <listitem><para>Unfree package that cannot be redistributed. You
     can build it yourself, but you cannot redistribute the output of
-    the derivation.  Thus it cannot be included in the Nixpkgs
+    the derivation. Thus it cannot be included in the Nixpkgs
     channel.</para></listitem>
   </varlistentry>
 
   <varlistentry>
-    <term><varname>unfree-redistributable-firmware</varname></term>
+    <term><varname>stdenv.lib.licenses.unfreeRedistributableFirmware</varname>,
+    <varname>"unfree-redistributable-firmware"</varname></term>
+
     <listitem><para>This package supplies unfree, redistributable
     firmware.  This is a separate value from
     <varname>unfree-redistributable</varname> because not everybody

doc/package-notes.xml

@@ -125,7 +125,7 @@ $ make menuconfig ARCH=<replaceable>arch</replaceable></screen>
   <listitem>
     <para>It may be that the new kernel requires updating the external
     kernel modules and kernel-dependent packages listed in the
-    <varname>kernelPackagesFor</varname> function in
+    <varname>linuxPackagesFor</varname> function in
     <filename>all-packages.nix</filename> (such as the NVIDIA drivers,
     AUFS, etc.).  If the updated packages aren’t backwards compatible
     with older kernels, you may need to keep the older versions

doc/packageconfig.xml

@@ -1,88 +0,0 @@
-<chapter xmlns="http://docbook.org/ns/docbook"
-	 xmlns:xlink="http://www.w3.org/1999/xlink"
-	 xml:id="chap-packageconfig">
-
-<title><filename>~/.nixpkgs/config.nix</filename>: global configuration</title>
-
-    <para>
-      Nix packages can be configured to allow or deny certain options.
-    </para>
-
-    <para>
-	To apply the configuration edit <filename>~/.nixpkgs/config.nix</filename>
-	and set it like
-<programlisting>{
-  allowUnfree = true;
-}</programlisting>
-	and will allow the Nix package manager to install unfree licensed packages.
-
-	The configuration as listed also applies to NixOS under <option>nixpkgs.config</option> set.
-    </para>
-
-    <itemizedlist>
-	<listitem>
-	    <para>
-		Allow installing of packages that are distributed under unfree license by setting
-		<programlisting>allowUnfree = true;</programlisting>
-		or deny them by setting it to <literal>false</literal>.
-	    </para>
-	    <para>
-		Same can be achieved by setting the environment variable:
-		<programlisting>$ export NIXPKGS_ALLOW_UNFREE=1</programlisting>
-	    </para>
-	</listitem>
-
-	<listitem>
-	    <para>
-		Whenever unfree packages are not allowed, single packages can
-		still be allowed by a predicate function that accepts package
-		as an argument and should return a boolean:
-		<programlisting>allowUnfreePredicate = (pkg: ...);</programlisting>
-
-		Example to allow flash player only:
-		<programlisting>allowUnfreePredicate = (pkg: pkgs.lib.hasPrefix "flashplayer-" pkg.name);</programlisting>
-	    </para>
-	</listitem>
-
-	<listitem>
-	    <para>
-		Whenever unfree packages are not allowed, packages can still be
-		whitelisted by their license:
-		<programlisting>whitelistedLicenses = with stdenv.lib.licenses; [ amd wtfpl ];</programlisting>
-	    </para>
-	</listitem>
-
-	<listitem>
-	    <para>
-		In addition to whitelisting licenses which are denied by the
-		<literal>allowUnfree</literal> setting, you can also explicitely
-		deny installation of packages which have a certain license:
-		<programlisting>blacklistedLicenses = with stdenv.lib.licenses; [ agpl3 gpl3 ];</programlisting>
-	    </para>
-	</listitem>
-    </itemizedlist>
-
-    <para>
-	A complete list of licenses can be found in the file
-	<filename>lib/licenses.nix</filename> of the nix package tree.
-    </para>
-
-<section xml:id="sec-modify-via-packageOverrides"><title>Modify
-packages via <literal>packageOverrides</literal></title>
-
-<para>
-
-  You can define a function called <varname>packageOverrides</varname>
-  in your local <filename>~/.nixpkgs/config</filename> to overide nix
-  packages.  It must be a function that takes pkgs as an argument and
-  return modified set of packages.
-
-  <programlisting>{
-  packageOverrides = pkgs: rec {
-    foo = pkgs.foo.override { ... };
-  };
-}</programlisting>
-</para>
-</section>
-
-</chapter>

doc/stdenv.xml

@@ -224,6 +224,63 @@ genericBuild
 
 </variablelist>
 
+<variablelist>
+  <title>Variables affecting build properties</title>
+
+  <varlistentry>
+    <term><varname>enableParallelBuilding</varname></term>
+    <listitem><para>If set, <literal>stdenv</literal> will pass specific
+    flags to <literal>make</literal> and other build tools to enable
+    parallel building with up to <literal>build-cores</literal>
+    workers.</para></listitem>
+  </varlistentry>
+
+  <varlistentry>
+    <term><varname>preferLocalBuild</varname></term>
+    <listitem><para>If set, specifies that the package is so lightweight
+    in terms of build operations (e.g. write a text file from a Nix string
+    to the store) that there's no need to look for it in binary caches --
+    it's faster to just build it locally. It also tells Hydra and other
+    facilities that this package doesn't need to be exported in binary
+    caches (noone would use it, after all).</para></listitem>
+  </varlistentry>
+
+</variablelist>
+
+<variablelist>
+  <title>Special variables</title>
+
+  <varlistentry>
+    <term><varname>passthru</varname></term>
+    <listitem><para>This is an attribute set which can be filled with arbitrary
+    values. For example:
+
+<programlisting>
+passthru = {
+  foo = "bar";
+  baz = {
+    value1 = 4;
+    value2 = 5;
+  };
+}
+</programlisting>
+
+</para>
+
+    <para>Values inside it are not passed to the builder, so you can change
+    them without triggering a rebuild. However, they can be accessed outside of a
+    derivation directly, as if they were set inside a derivation itself, e.g.
+    <literal>hello.baz.value1</literal>. We don't specify any usage or
+    schema of <literal>passthru</literal> - it is meant for values that would be
+    useful outside the derivation in other parts of a Nix expression (e.g. in other
+    derivations). An example would be to convey some specific dependency of your
+    derivation which contains a program with plugins support.  Later, others who
+    make derivations with plugins can use passed-through dependency to ensure that
+    their plugin would be binary-compatible with built program.</para></listitem>
+  </varlistentry>
+
+</variablelist>
+
 </section>
 
 
@@ -1186,6 +1243,14 @@ echo @foo@
     environment variable.</para></listitem>
   </varlistentry>
 
+  <varlistentry>
+    <term>Autoconf</term>
+    <listitem><para>The <varname>autoreconfHook</varname> derivation adds
+    <varname>autoreconfPhase</varname>, which runs autoreconf, libtoolize and
+    automake, essentially preparing the configure script in autotools-based
+    builds.</para></listitem>
+  </varlistentry>
+
   <varlistentry>
     <term>libxml2</term>
     <listitem><para>Adds every file named
@@ -1204,7 +1269,7 @@ echo @foo@
   </varlistentry>
 
   <varlistentry>
-    <term>Qt</term>
+    <term>Qt 4</term>
     <listitem><para>Sets the <envar>QTDIR</envar> environment variable
     to Qt’s path.</para></listitem>
   </varlistentry>

doc/submitting-changes.xml

@@ -261,23 +261,72 @@ Additional information.
 <para>Hydra builds for master and staging should not be used as testing platform, it's a build farm for changes that have been already tested.</para>
 </listitem>
 
-<listitem>
-<para>Master should only see non-breaking commits that do not cause mass rebuilds.</para>
-</listitem>
-
-<listitem>
-<para>Staging should only see non-breaking mass-rebuild commits. That means it's not to be used for testing, and changes must have been well tested already. <link xlink:href="http://comments.gmane.org/gmane.linux.distributions.nixos/13447">Read policy here</link>.</para>
-</listitem>
-
-<listitem>
-<para>If staging is already in a broken state, please refrain from adding extra new breakages. Stabilize it for a few days, merge into master, then resume development on staging. <link xlink:href="http://hydra.nixos.org/jobset/nixpkgs/staging#tabs-evaluations">Keep an eye on the staging evaluations here</link>.</para>
-</listitem>
-
 <listitem>
 <para>When changing the bootloader installation process, extra care must be taken. Grub installations cannot be rolled back, hence changes may break people's installations forever. For any non-trivial change to the bootloader please file a PR asking for review, especially from @edolstra.</para>
 </listitem>
 </itemizedlist>
 
+<section>
+  <title>Master branch</title>
+
+  <itemizedlist>
+    <listitem>
+      <para>
+        It should only see non-breaking commits that do not cause mass rebuilds.
+      </para>
+    </listitem>
+  </itemizedlist>
+</section>
+
+<section>
+  <title>Staging branch</title>
+
+  <itemizedlist>
+    <listitem>
+      <para>
+        It's only for non-breaking mass-rebuild commits. That means it's not to
+        be used for testing, and changes must have been well tested already.
+        <link xlink:href="http://comments.gmane.org/gmane.linux.distributions.nixos/13447">Read policy here</link>.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        If the branch is already in a broken state, please refrain from adding
+        extra new breakages. Stabilize it for a few days, merge into master,
+        then resume development on staging.
+        <link xlink:href="http://hydra.nixos.org/jobset/nixpkgs/staging#tabs-evaluations">Keep an eye on the staging evaluations here</link>.
+        If any fixes for staging happen to be already in master, then master can
+        be merged into staging.
+      </para>
+    </listitem>
+  </itemizedlist>
+</section>
+
+<section>
+  <title>Stable release branches</title>
+
+  <itemizedlist>
+    <listitem>
+      <para>
+        If you're cherry-picking a commit to a stable release branch, always use
+        <command>git cherry-pick -xe</command> and ensure the message contains a
+        clear description about why this needs to be included in the stable
+        branch.
+      </para>
+      <para>An example of a cherry-picked commit would look like this:</para>
+      <screen>
+nixos: Refactor the world.
+
+The original commit message describing the reason why the world was torn apart.
+
+(cherry picked from commit abcdef)
+Reason: I just had a gut feeling that this would also be wanted by people from
+the stone age.
+      </screen>
+    </listitem>
+  </itemizedlist>
+</section>
+
 </section>
 </chapter>
 

lib/attrsets.nix

@@ -23,6 +23,17 @@ rec {
       then attrByPath (tail attrPath) default e.${attr}
       else default;
 
+  /* Return if an attribute from nested attribute set exists.
+     For instance ["x" "y"] applied to some set e returns true, if e.x.y exists. False
+     is returned otherwise. */
+  hasAttrByPath = attrPath: e:
+    let attr = head attrPath;
+    in
+      if attrPath == [] then true
+      else if e ? ${attr}
+      then hasAttrByPath (tail attrPath) e.${attr}
+      else false;
+
 
   /* Return nested attribute set in which an attribute is set.  For instance
      ["x" "y"] applied with some value v returns `x.y = v;' */
@@ -78,6 +89,26 @@ rec {
     listToAttrs (concatMap (name: let v = set.${name}; in if pred name v then [(nameValuePair name v)] else []) (attrNames set));
 
 
+  /* Filter an attribute set recursivelly by removing all attributes for
+     which the given predicate return false.
+
+     Example:
+       filterAttrsRecursive (n: v: v != null) { foo = { bar = null; }; }
+       => { foo = {}; }
+  */
+  filterAttrsRecursive = pred: set:
+    listToAttrs (
+      concatMap (name:
+        let v = set.${name}; in
+        if pred name v then [
+          (nameValuePair name (
+            if isAttrs v then filterAttrsRecursive pred v
+            else v
+          ))
+        ] else []
+      ) (attrNames set)
+    );
+
   /* foldAttrs: apply fold functions to values grouped by key. Eg accumulate values as list:
      foldAttrs (n: a: [n] ++ a) [] [{ a = 2; } { a = 3; }]
      => { a = [ 2 3 ]; }
@@ -96,7 +127,7 @@ rec {
 
      Type:
        collect ::
-         (AttrSet -> Bool) -> AttrSet -> AttrSet
+         (AttrSet -> Bool) -> AttrSet -> [x]
 
      Example:
        collect isList { a = { b = ["b"]; }; c = [1]; }

lib/default.nix

@@ -17,10 +17,11 @@ let
   systems = import ./systems.nix;
   customisation = import ./customisation.nix;
   licenses = import ./licenses.nix;
+  sandbox = import ./sandbox.nix;
 
 in
   { inherit trivial lists strings stringsWithDeps attrsets sources options
-      modules types meta debug maintainers licenses platforms systems;
+      modules types meta debug maintainers licenses platforms systems sandbox;
   }
   # !!! don't include everything at top-level; perhaps only the most
   # commonly used functions.

lib/deprecated.nix

@@ -411,7 +411,7 @@ rec {
   nixType = x:
       if isAttrs x then
           if x ? outPath then "derivation"
-          else "aattrs"
+          else "attrs"
       else if isFunction x then "function"
       else if isList x then "list"
       else if x == true then "bool"

lib/licenses.nix

@@ -85,6 +85,26 @@ lib.mapAttrs (n: v: v // { shortName = n; }) rec {
     fullName = "Creative Commons Zero v1.0 Universal";
   };
 
+  cc-by-nc-sa-20 = spdx {
+    spdxId = "CC-BY-NC-SA-2.0";
+    fullName = "Creative Commons Attribution Non Commercial Share Alike 2.0";
+  };
+
+  cc-by-nc-sa-25 = spdx {
+    spdxId = "CC-BY-NC-SA-2.5";
+    fullName = "Creative Commons Attribution Non Commercial Share Alike 2.5";
+  };
+
+  cc-by-nc-sa-30 = spdx {
+    spdxId = "CC-BY-NC-SA-3.0";
+    fullName = "Creative Commons Attribution Non Commercial Share Alike 3.0";
+  };
+
+  cc-by-nc-sa-40 = spdx {
+    spdxId = "CC-BY-NC-SA-4.0";
+    fullName = "Creative Commons Attribution Non Commercial Share Alike 4.0";
+  };
+
   cc-by-sa-25 = spdx {
     spdxId = "CC-BY-SA-2.5";
     fullName = "Creative Commons Attribution Share Alike 2.5";
@@ -135,6 +155,11 @@ lib.mapAttrs (n: v: v // { shortName = n; }) rec {
     fullName = "Common Public License 1.0";
   };
 
+  doc = spdx {
+    spdxId = "DOC";
+    fullName = "DOC License";
+  };
+
   efl10 = spdx {
     spdxId = "EFL-1.0";
     fullName = "Eiffel Forum License v1.0";
@@ -402,6 +427,11 @@ lib.mapAttrs (n: v: v // { shortName = n; }) rec {
     fullName = "TCL/TK License";
   };
 
+  ufl = {
+    fullName = "Ubuntu Font License 1.0";
+    url = http://font.ubuntu.com/ufl/ubuntu-font-licence-1.0.txt;
+  };
+
   unfree = {
     fullName = "Unfree";
     free = false;

lib/maintainers.nix

@@ -1,30 +1,33 @@
-/* -*- coding: utf-8; -*- */
+/* List of NixOS maintainers. The format is:
 
+    handle = "Real Name <address@example.org>";
+
+  where <handle> is preferred to be your GitHub username (so it's easy
+  to ping a package @<handle>), and <Real Name> is your real name, not
+  a pseudonym. Please keep the list alphabetically sorted. */
 {
-  /* Add your name and email address here.
-     Keep the list alphabetically sorted.
-     Prefer the same attrname as your github username, please,
-     so it's easy to ping a package @maintainer.
-  */
-
+  a1russell = "Adam Russell <adamlr6+pub@gmail.com>";
   aaronschif = "Aaron Schif <aaronschif@gmail.com>";
   abaldeau = "Andreas Baldeau <andreas@baldeau.net>";
   abbradar = "Nikolay Amiantov <ab@fmap.me>";
-  adev	   = "Adrien Devresse <adev@adev.name>";
-  aforemny = "Alexander Foremny <alexanderforemny@googlemail.com>";
+  adev = "Adrien Devresse <adev@adev.name>";
+  aespinosa = "Allan Espinosa <allan.espinosa@outlook.com>";
   aflatter = "Alexander Flatter <flatter@fastmail.fm>";
+  aforemny = "Alexander Foremny <alexanderforemny@googlemail.com>";
   aherrmann = "Andreas Herrmann <andreash87@gmx.ch>";
   ak = "Alexander Kjeldaas <ak@formalprivacy.com>";
   akaWolf = "Artjom Vejsel <akawolf0@gmail.com>";
   akc = "Anders Claesson <akc@akc.is>";
   algorith = "Dries Van Daele <dries_van_daele@telenet.be>";
   all = "Nix Committers <nix-commits@lists.science.uu.nl>";
+  ambrop72 = "Ambroz Bizjak <ambrop7@gmail.com>";
   amiddelk = "Arie Middelkoop <amiddelk@gmail.com>";
   amorsillo = "Andrew Morsillo <andrew.morsillo@gmail.com>";
   AndersonTorres = "Anderson Torres <torres.anderson.85@gmail.com>";
   anderspapitto = "Anders Papitto <anderspapitto@gmail.com>";
   andres = "Andres Loeh <ksnixos@andres-loeh.de>";
   andrewrk = "Andrew Kelley <superjoe30@gmail.com>";
+  aneeshusa = "Aneesh Agrawal <aneeshusa@gmail.com>";
   antono = "Antono Vasiljev <self@antono.info>";
   ardumont = "Antoine R. Dumont <eniotna.t@gmail.com>";
   aristid = "Aristid Breitkreuz <aristidb@gmail.com>";
@@ -37,12 +40,13 @@
   aycanirican = "Aycan iRiCAN <iricanaycan@gmail.com>";
   badi = "Badi' Abdul-Wahid <abdulwahidc@gmail.com>";
   balajisivaraman = "Balaji Sivaraman<sivaraman.balaji@gmail.com>";
+  Baughn = "Svein Ove Aas <sveina@gmail.com>";
   bbenoist = "Baptist BENOIST <return_0@live.com>";
   bcarrell = "Brandon Carrell <brandoncarrell@gmail.com>";
   bcdarwin = "Ben Darwin <bcdarwin@gmail.com>";
   bdimcheff = "Brandon Dimcheff <brandon@dimcheff.com>";
-  bennofs = "Benno Fünfstück <benno.fuenfstueck@gmail.com>";
   benley = "Benjamin Staffin <benley@gmail.com>";
+  bennofs = "Benno Fünfstück <benno.fuenfstueck@gmail.com>";
   berdario = "Dario Bertini <berdario@gmail.com>";
   bergey = "Daniel Bergey <bergey@teallabs.org>";
   bjg = "Brian Gough <bjg@gnu.org>";
@@ -54,6 +58,7 @@
   bosu = "Boris Sukholitko <boriss@gmail.com>";
   bramd = "Bram Duvigneau <bram@bramd.nl>";
   bstrik = "Berno Strik <dutchman55@gmx.com>";
+  bzizou = "Bruno Bzeznik <Bruno@bzizou.net>";
   c0dehero = "CodeHero <codehero@nerdpol.ch>";
   calrama = "Moritz Maxeiner <moritz@ucworks.org>";
   campadrenalin = "Philip Horger <campadrenalin@gmail.com>";
@@ -62,53 +67,75 @@
   chaoflow = "Florian Friesdorf <flo@chaoflow.net>";
   chattered = "Phil Scott <me@philscotted.com>";
   christopherpoole = "Christopher Mark Poole <mail@christopherpoole.net>";
+  cleverca22 = "Michael Bishop <cleverca22@gmail.com>";
   coconnor = "Corey O'Connor <coreyoconnor@gmail.com>";
+  codsl = "codsl <codsl@riseup.net>";
   codyopel = "Cody Opel <codyopel@gmail.com>";
+  colemickens = "Cole Mickens <cole.mickens@gmail.com>";
   copumpkin = "Dan Peebles <pumpkingod@gmail.com>";
   coroa = "Jonas Hörsch <jonas@chaoflow.net>";
   couchemar = "Andrey Pavlov <couchemar@yandex.ru>";
   cstrahan = "Charles Strahan <charles.c.strahan@gmail.com>";
   cwoac = "Oliver Matthews <oliver@codersoffortune.net>";
   DamienCassou = "Damien Cassou <damien@cassou.me>";
+  dasuxullebt = "Christoph-Simon Senjak <christoph.senjak@googlemail.com>";
+  davidak = "David Kleuker <post@davidak.de>";
   davidrusu = "David Rusu <davidrusu.me@gmail.com>";
   dbohdan = "Danyil Bohdan <danyil.bohdan@gmail.com>";
-  DerGuteMoritz = "Moritz Heidkamp <moritz@twoticketsplease.de>";
   deepfire = "Kosyrev Serge <_deepfire@feelingofgreen.ru>";
+  demin-dmitriy = "Dmitriy Demin <demindf@gmail.com>";
+  DerGuteMoritz = "Moritz Heidkamp <moritz@twoticketsplease.de>";
   desiderius = "Didier J. Devroye <didier@devroye.name>";
   devhell = "devhell <\"^\"@regexmail.net>";
   dezgeg = "Tuomas Tynkkynen <tuomas.tynkkynen@iki.fi>";
   dfoxfranke = "Daniel Fox Franke <dfoxfranke@gmail.com>";
+  dgonyeo = "Derek Gonyeo <derek@gonyeo.com>";
   dmalikov = "Dmitry Malikov <malikov.d.y@gmail.com>";
+  dochang = "Desmond O. Chang <dochang@gmail.com>";
   doublec = "Chris Double <chris.double@double.co.nz>";
+  ebzzry = "Rommel Martinez <ebzzry@gmail.com>";
   ederoyd46 = "Matthew Brown <matt@ederoyd.co.uk>";
   eduarrrd = "Eduard Bachmakov <e.bachmakov@gmail.com>";
   edwtjo = "Edward Tjörnhammar <ed@cflags.cc>";
   eelco = "Eelco Dolstra <eelco.dolstra@logicblox.com>";
-  eikek = "Eike Kettner <eike.kettner@posteo.de>";
-  ellis = "Ellis Whitehead <nixos@ellisw.net>";
+  ehegnes = "Eric Hegnes <eric.hegnes@gmail.com>";
   ehmry = "Emery Hemingway <emery@vfemail.net>";
+  eikek = "Eike Kettner <eike.kettner@posteo.de>";
+  elasticdog = "Aaron Bull Schaefer <aaron@elasticdog.com>";
+  elitak = "Eric Litak <elitak@gmail.com>";
+  ellis = "Ellis Whitehead <nixos@ellisw.net>";
   epitrochoid = "Mabry Cervin <mpcervin@uncg.edu>";
   ericbmerritt = "Eric Merritt <eric@afiniate.com>";
+  ericsagnes = "Eric Sagnes <eric.sagnes@gmail.com>";
+  erikryb = "Erik Rybakken <erik.rybakken@math.ntnu.no>";
   ertes = "Ertugrul Söylemez <ertesx@gmx.de>";
   exi = "Reno Reckling <nixos@reckling.org>";
   exlevan = "Alexey Levan <exlevan@gmail.com>";
+  fadenb = "Tristan Helmich <tristan.helmich+nixos@gmail.com>";
   falsifian = "James Cook <james.cook@utoronto.ca>";
   flosse = "Markus Kohlhase <mail@markus-kohlhase.de>";
   fluffynukeit = "Daniel Austin <dan@fluffynukeit.com>";
   forkk = "Andrew Okin <forkk@forkk.net>";
+  fornever = "Friedrich von Never <friedrich@fornever.me>";
   fpletz = "Franz Pletz <fpletz@fnordicwalking.de>";
+  fps = "Florian Paul Schmidt <mista.tapas@gmx.net>";
+  fridh = "Frederik Rietdijk <fridh@fridh.nl>";
   fro_ozen = "fro_ozen <fro_ozen@gmx.de>";
   ftrvxmtrx = "Siarhei Zirukin <ftrvxmtrx@gmail.com>";
   funfunctor = "Edward O'Callaghan <eocallaghan@alterapraxis.com>";
   fuuzetsu = "Mateusz Kowalczyk <fuuzetsu@fuuzetsu.co.uk>";
+  fxfactorial = "Edgar Aroutiounian <edgar.factorial@gmail.com>";
   gal_bolle = "Florent Becker <florent.becker@ens-lyon.org>";
   garbas = "Rok Garbas <rok@garbas.si>";
   garrison = "Jim Garrison <jim@garrison.cc>";
   gavin = "Gavin Rogers <gavin@praxeology.co.uk>";
   gebner = "Gabriel Ebner <gebner@gebner.org>";
+  gfxmonk = "Tim Cuthbertson <tim@gfxmonk.net>";
   giogadi = "Luis G. Torres <lgtorres42@gmail.com>";
-  globin = "Robin Gloster <robin@glob.in>";
+  gleber = "Gleb Peregud <gleber.p@gmail.com>";
+  globin = "Robin Gloster <mail@glob.in>";
   goibhniu = "Cillian de Róiste <cillian.deroiste@gmail.com>";
+  Gonzih = "Max Gonzih <gonzih@gmail.com>";
   gridaphobe = "Eric Seidel <eric@seidel.io>";
   guibert = "David Guibert <david.guibert@gmail.com>";
   havvy = "Ryan Scheel <ryan.havvy@gmail.com>";
@@ -120,15 +147,17 @@
   iand675 = "Ian Duncan <ian@iankduncan.com>";
   ianwookim = "Ian-Woo Kim <ianwookim@gmail.com>";
   iElectric = "Domen Kozar <domen@dev.si>";
+  igsha = "Igor Sharonov <igor.sharonov@gmail.com>";
   ikervagyok = "Balázs Lengyel <ikervagyok@gmail.com>";
-  iyzsong = "Song Wenwu <iyzsong@gmail.com>";
   j-keck = "Jürgen Keck <jhyphenkeck@gmail.com>";
   jagajaga = "Arseniy Seroka <ars.seroka@gmail.com>";
+  javaguirre = "Javier Aguirre <contacto@javaguirre.net>";
   jb55 = "William Casarin <bill@casarin.me>";
   jcumming = "Jack Cummings <jack@mudshark.org>";
   jefdaj = "Jeffrey David Johnson <jefdaj@gmail.com>";
   jfb = "James Felix Black <james@yamtime.com>";
-  jgeerds = "Jascha Geerds <jg@ekby.de>";
+  jgeerds = "Jascha Geerds <jascha@jgeerds.name>";
+  jgillich = "Jakob Gillich <jakob@gillich.me>";
   jirkamarsik = "Jirka Marsik <jiri.marsik89@gmail.com>";
   joachifm = "Joachim Fasting <joachifm@fastmail.fm>";
   joamaki = "Jussi Maki <joamaki@gmail.com>";
@@ -139,16 +168,21 @@
   jwilberding = "Jordan Wilberding <jwilberding@afiniate.com>";
   jzellner = "Jeff Zellner <jeffz@eml.cc>";
   kamilchm = "Kamil Chmielewski <kamil.chm@gmail.com>";
+  kampfschlaefer = "Arnold Krille <arnold@arnoldarts.de>";
+  kevincox = "Kevin Cox <kevincox@kevincox.ca>";
   khumba = "Bryan Gardiner <bog@khumba.net>";
   kkallio = "Karn Kallio <tierpluspluslists@gmail.com>";
   koral = "Koral <koral@mailoo.org>";
   kovirobi = "Kovacsics Robert <kovirobi@gmail.com>";
-  kragniz = "Louis Taylor <kragniz@gmail.com>";
+  kragniz = "Louis Taylor <louis@kragniz.eu>";
   ktosiek = "Tomasz Kontusz <tomasz.kontusz@gmail.com>";
   lassulus = "Lassulus <lassulus@gmail.com>";
+  layus = "Guillaume Maudoux <layus.on@gmail.com>";
   lebastr = "Alexander Lebedev <lebastr@gmail.com>";
+  leenaars = "Michiel Leenaars <ml.software@leenaa.rs>";
   leonardoce = "Leonardo Cecchi <leonardo.cecchi@gmail.com>";
   lethalman = "Luca Bruno <lucabru@src.gnome.org>";
+  lewo = "Antoine Eiche <lewo@abesis.fr>";
   lhvwb = "Nathaniel Baxter <nathaniel.baxter@gmail.com>";
   lihop = "Leroy Hopson <nixos@leroy.geek.nz>";
   linquize = "Linquize <linquize@yahoo.com.hk>";
@@ -158,6 +192,10 @@
   lowfatcomputing = "Andreas Wagner <andreas.wagner@lowfatcomputing.org>";
   lsix = "Lancelot SIX <lsix@lancelotsix.com>";
   ludo = "Ludovic Courtès <ludo@gnu.org>";
+  luispedro = "Luis Pedro Coelho <luis@luispedro.org>";
+  lukasepple = "Lukas Epple <post@lukasepple.de>";
+  lukego = "Luke Gorrie <luke@snabb.co>";
+  lw = "Sergey Sofeychuk <lw@fmap.me>";
   madjar = "Georges Dubus <georges.dubus@compiletoi.net>";
   magnetophon = "Bart Brouns <bart@magnetophon.nl>";
   mahe = "Matthias Herrmann <matthias.mh.herrmann@gmail.com>";
@@ -165,27 +203,35 @@
   malyn = "Michael Alyn Miller <malyn@strangeGizmo.com>";
   manveru = "Michael Fellinger <m.fellinger@gmail.com>";
   marcweber = "Marc Weber <marco-oweber@gmx.de>";
-  maurer = "Matthew Maurer <matthew.r.maurer+nix@gmail.com>";
+  markWot = "Markus Wotringer <markus@wotringer.de>";
   matejc = "Matej Cotman <cotman.matej@gmail.com>";
   mathnerd314 = "Mathnerd314 <mathnerd314.gph+hs@gmail.com>";
   matthiasbeyer = "Matthias Beyer <mail@beyermatthias.de>";
+  maurer = "Matthew Maurer <matthew.r.maurer+nix@gmail.com>";
   mbakke = "Marius Bakke <ymse@tuta.io>";
+  mbe = "Brandon Edens <brandonedens@gmail.com>";
   mcmtroffaes = "Matthias C. M. Troffaes <matthias.troffaes@gmail.com>";
   meditans = "Carlo Nucera <meditans@gmail.com>";
   meisternu = "Matt Miemiec <meister@krutt.org>";
+  michaelpj = "Michael Peyton Jones <michaelpj@gmail.com>";
   michelk = "Michel Kuhlmann <michel@kuhlmanns.info>";
+  mingchuan = "Ming Chuan <ming@culpring.com>";
   mirdhyn = "Merlin Gaillard <mirdhyn@gmail.com>";
-  mschristiansen = "Mikkel Christiansen <mikkel@rheosystems.com>";
   modulistic = "Pablo Costa <modulistic@gmail.com>";
   mog = "Matthew O'Gorman <mog-lists@rldn.net>";
   mornfall = "Petr Ročkai <me@mornfall.net>";
   MP2E = "Cray Elliott <MP2E@archlinux.us>";
   msackman = "Matthew Sackman <matthew@wellquite.org>";
+  mschristiansen = "Mikkel Christiansen <mikkel@rheosystems.com>";
+  msteen = "Matthijs Steen <emailmatthijs@gmail.com>";
   mtreskin = "Max Treskin <zerthurd@gmail.com>";
   mudri = "James Wood <lamudri@gmail.com>";
   muflax = "Stefan Dorn <mail@muflax.com>";
   nathan-gs = "Nathan Bijnens <nathan@nathan.gs>";
   nckx = "Tobias Geerinckx-Rice <tobias.geerinckx.rice@gmail.com>";
+  nequissimus = "Tim Steinbach <tim@nequissimus.com>";
+  nfjinjing = "Jinjing Wang <nfjinjing@gmail.com>";
+  nico202 = "Nicolò Balzarotti <anothersms@gmail.com>";
   notthemessiah = "Brian Cohen <brian.cohen.88@gmail.com>";
   np = "Nicolas Pouillard <np.nix@nicolaspouillard.fr>";
   nslqqq = "Nikita Mikhailov <nslqqq@gmail.com>";
@@ -196,26 +242,32 @@
   olcai = "Erik Timan <dev@timan.info>";
   orbitz = "Malcolm Matalka <mmatalka@gmail.com>";
   osener = "Ozan Sener <ozan@ozansener.com>";
+  oxij = "Jan Malakhovski <oxij@oxij.org>";
   page = "Carles Pagès <page@cubata.homelinux.net>";
   paholg = "Paho Lurie-Gregg <paho@paholg.com>";
   pakhfn = "Fedor Pakhomov <pakhfn@gmail.com>";
+  palo = "Ingolf Wanger <palipalo9@googlemail.com>";
   pashev = "Igor Pashev <pashev.igor@gmail.com>";
   pesterhazy = "Paulus Esterhazy <pesterhazy@gmail.com>";
-  phile314 = "Philipp Hausmann <nix@314.ch>";
   philandstuff = "Philip Potter <philip.g.potter@gmail.com>";
+  phile314 = "Philipp Hausmann <nix@314.ch>";
+  Phlogistique = "Noé Rubinstein <noe.rubinstein@gmail.com>";
   phreedom = "Evgeny Egorochkin <phreedom@yandex.ru>";
   phunehehe = "Hoang Xuan Phu <phunehehe@gmail.com>";
   pierron = "Nicolas B. Pierron <nixos@nbp.name>";
   piotr = "Piotr Pietraszkiewicz <ppietrasa@gmail.com>";
+  pjbarnoy = "Perry Barnoy <pjbarnoy@gmail.com>";
   pjones = "Peter Jones <pjones@devalot.com>";
   pkmx = "Chih-Mao Chen <pkmx.tw@gmail.com>";
   plcplc = "Philip Lykke Carlsen <plcplc@gmail.com>";
   pmahoney = "Patrick Mahoney <pat@polycrystal.org>";
   pmiddend = "Philipp Middendorf <pmidden@secure.mailbox.org>";
   prikhi = "Pavan Rikhi <pavan.rikhi@gmail.com>";
+  profpatsch = "Profpatsch <mail@profpatsch.de>";
   psibi = "Sibi <sibi@psibi.in>";
   pSub = "Pascal Wittmann <mail@pascal-wittmann.de>";
   puffnfresh = "Brian McKenna <brian@brianmckenna.org>";
+  pxc = "Patrick Callahan <patrick.callahan@latitudeengineering.com>";
   qknight = "Joachim Schiele <js@lastlog.de>";
   ragge = "Ragnar Dahlen <r.dahlen@gmail.com>";
   raskin = "Michael Raskin <7c6f434c@mail.ru>";
@@ -225,15 +277,20 @@
   renzo = "Renzo Carbonara <renzocarbonara@gmail.com>";
   rick68 = "Wei-Ming Yang <rick68@gmail.com>";
   rickynils = "Rickard Nilsson <rickynils@gmail.com>";
+  rnhmjoj = "Michele Guerini Rocco <micheleguerinirocco@me.com>";
   rob = "Rob Vermaas <rob.vermaas@gmail.com>";
   robberer = "Longrin Wischnewski <robberer@freakmail.de>";
   robbinch = "Robbin C. <robbinch33@gmail.com>";
+  robgssp = "Rob Glossop <robgssp@gmail.com>";
   roconnor = "Russell O'Connor <roconnor@theorem.ca>";
-  roelof = "Roelof Wobben <rwobben@hotmail.com>";
   romildo = "José Romildo Malaquias <malaquias@gmail.com>";
   rszibele = "Richard Szibele <richard_szibele@hotmail.com>";
   rushmorem = "Rushmore Mushambi <rushmore@webenchanter.com>";
+  rvl = "Rodney Lorrimar <dev+nix@rodney.id.au>";
+  rvlander = "Gaëtan André <rvlander@gaetanandre.eu>";
+  ryantm = "Ryan Mulligan <ryan@ryantm.com>";
   rycee = "Robert Helgesson <robert@rycee.net>";
+  samuelrivas = "Samuel Rivas <samuelrivas@gmail.com>";
   sander = "Sander van der Burg <s.vanderburg@tudelft.nl>";
   schmitthenner = "Fabian Schmitthenner <development@schmitthenner.eu>";
   schristo = "Scott Christopher <schristopher@konputa.com>";
@@ -245,23 +302,31 @@
   simonvandel = "Simon Vandel Sillesen <simon.vandel@gmail.com>";
   sjagoe = "Simon Jagoe <simon@simonjagoe.com>";
   sjmackenzie = "Stewart Mackenzie <setori88@gmail.com>";
+  sjourdois = "Stéphane ‘kwisatz’ Jourdois <sjourdois@gmail.com>";
   skeidel = "Sven Keidel <svenkeidel@gmail.com>";
+  sleexyz = "Sean Lee <freshdried@gmail.com>";
   smironov = "Sergey Mironov <ierton@gmail.com>";
   spacefrogg = "Michael Raitza <spacefrogg-nixos@meterriblecrew.net>";
+  spencerjanssen = "Spencer Janssen <spencerjanssen@gmail.com>";
   spinus = "Tomasz Czyż <tomasz.czyz@gmail.com>";
   sprock = "Roger Mason <rmason@mun.ca>";
   spwhitt = "Spencer Whitt <sw@swhitt.me>";
   stephenmw = "Stephen Weinberg <stephen@q5comm.com>";
+  steveej = "Stefan Junker <mail@stefanjunker.de>";
   szczyp = "Szczyp <qb@szczyp.com>";
   sztupi = "Attila Sztupak <attila.sztupak@gmail.com>";
+  taeer = "Taeer Bar-Yam <taeer@necsi.edu>";
   tailhook = "Paul Colomiets <paul@colomiets.name>";
   taktoa = "Remy Goldschmidt <taktoa@gmail.com>";
+  tavyc = "Octavian Cerna <octavian.cerna@gmail.com>";
   telotortium = "Robert Irelan <rirelan@gmail.com>";
+  thall = "Niclas Thall <niclas.thall@gmail.com>";
   thammers = "Tobias Hammerschmidt <jawr@gmx.de>";
   the-kenny = "Moritz Ulrich <moritz@tarn-vedra.de>";
   theuni = "Christian Theune <ct@flyingcircus.io>";
   thoughtpolice = "Austin Seipp <aseipp@pobox.com>";
   titanous = "Jonathan Rudenberg <jonathan@titanous.com>";
+  tohl = "Tomas Hlavaty <tom@logand.com>";
   tokudan = "Daniel Frank <git@danielfrank.net>";
   tomberek = "Thomas Bereknyei <tomberek@gmail.com>";
   travisbhartwell = "Travis B. Hartwell <nafai@travishartwell.net>";
@@ -269,9 +334,11 @@
   tstrobel = "Thomas Strobel <ts468@cam.ac.uk>";
   ttuegel = "Thomas Tuegel <ttuegel@gmail.com>";
   tv = "Tomislav Viljetić <tv@shackspace.de>";
+  tvestelind = "Tomas Vestelind <tomas.vestelind@fripost.org>";
   twey = "James ‘Twey’ Kay <twey@twey.co.uk>";
   urkud = "Yury G. Kudryashov <urkud+nix@ya.ru>";
   vandenoever = "Jos van den Oever <jos@vandenoever.info>";
+  vanzef = "Ivan Solyankin <vanzef@gmail.com>";
   vbgl = "Vincent Laporte <Vincent.Laporte@gmail.com>";
   vbmithr = "Vincent Bernardoff <vb@luminar.eu.org>";
   vcunat = "Vladimír Čunát <vcunat@gmail.com>";
@@ -280,18 +347,21 @@
   vlstill = "Vladimír Štill <xstill@fi.muni.cz>";
   vmandela = "Venkateswara Rao Mandela <venkat.mandela@gmail.com>";
   vozz = "Oliver Hunt <oliver.huntuk@gmail.com>";
+  wedens = "wedens <kirill.wedens@gmail.com>";
+  willtim = "Tim Philip Williams <tim.williams.public@gmail.com>";
   winden = "Antonio Vargas Gonzalez <windenntw@gmail.com>";
   wizeman = "Ricardo M. Correia <rcorreia@wizy.org>";
   wjlroe = "William Roe <willroe@gmail.com>";
-  womfoo = "Kranium Gikos Mendoza <kranium@gikos.net>";
   wkennington = "William A. Kennington III <william@wkennington.com>";
   wmertens = "Wout Mertens <Wout.Mertens@gmail.com>";
+  womfoo = "Kranium Gikos Mendoza <kranium@gikos.net>";
   wscott = "Wayne Scott <wsc9tt@gmail.com>";
   wyvie = "Elijah Rum <elijahrum@gmail.com>";
   yarr = "Dmitry V. <savraz@gmail.com>";
   z77z = "Marco Maggesi <maggesi@math.unifi.it>";
+  zagy = "Christian Zagrodnick <cz@flyingcircus.io>";
   zef = "Zef Hemel <zef@zef.me>";
   zimbatm = "zimbatm <zimbatm@zimbatm.com>";
+  zohl = "Al Zohali <zohl@fmap.me>";
   zoomulator = "Kim Simmons <zoomulator@gmail.com>";
-  Gonzih = "Max Gonzih <gonzih@gmail.com>";
 }

lib/minver.nix

@@ -0,0 +1,2 @@
+# Expose the minimum required version for evaluating Nixpkgs
+"1.10"

lib/modules.nix

@@ -469,6 +469,7 @@ rec {
   mkBefore = mkOrder 500;
   mkAfter = mkOrder 1500;
 
+
   # Convenient property used to transfer all definitions and their
   # properties from one option to another. This property is useful for
   # renaming options, and also for including properties from another module
@@ -498,4 +499,68 @@ rec {
   /* Compatibility. */
   fixMergeModules = modules: args: evalModules { inherit modules args; check = false; };
 
+
+  /* Return a module that causes a warning to be shown if the
+     specified option is defined. For example,
+
+       mkRemovedOptionModule [ "boot" "loader" "grub" "bootDevice" ]
+
+     causes a warning if the user defines boot.loader.grub.bootDevice.
+  */
+  mkRemovedOptionModule = optionName:
+    { options, ... }:
+    { options = setAttrByPath optionName (mkOption {
+        visible = false;
+      });
+      config.warnings =
+        let opt = getAttrFromPath optionName options; in
+        optional opt.isDefined
+          "The option definition `${showOption optionName}' in ${showFiles opt.files} no longer has any effect; please remove it.";
+    };
+
+  /* Return a module that causes a warning to be shown if the
+     specified "from" option is defined; the defined value is however
+     forwarded to the "to" option. This can be used to rename options
+     while providing backward compatibility. For example,
+
+       mkRenamedOptionModule [ "boot" "copyKernels" ] [ "boot" "loader" "grub" "copyKernels" ]
+
+     forwards any definitions of boot.copyKernels to
+     boot.loader.grub.copyKernels while printing a warning.
+  */
+  mkRenamedOptionModule = from: to: doRename {
+    inherit from to;
+    visible = false;
+    warn = true;
+    use = builtins.trace "Obsolete option `${showOption from}' is used. It was renamed to `${showOption to}'.";
+  };
+
+  /* Like ‘mkRenamedOptionModule’, but doesn't show a warning. */
+  mkAliasOptionModule = from: to: doRename {
+    inherit from to;
+    visible = true;
+    warn = false;
+    use = id;
+  };
+
+  doRename = { from, to, visible, warn, use }:
+    let
+      toOf = attrByPath to
+        (abort "Renaming error: option `${showOption to}' does not exists.");
+    in
+      { config, options, ... }:
+      { options = setAttrByPath from (mkOption {
+          description = "Alias of <option>${showOption to}</option>.";
+          apply = x: use (toOf config);
+        });
+        config = {
+        /*
+          warnings =
+            let opt = getAttrFromPath from options; in
+            optional (warn && opt.isDefined)
+              "The option `${showOption from}' defined in ${showFiles opt.files} has been renamed to `${showOption to}'.";
+              */
+        } // setAttrByPath to (mkAliasDefinitions (getAttrFromPath from options));
+      };
+
 }

lib/platforms.nix

@@ -1,20 +1,24 @@
 let lists = import ./lists.nix; in
 
 rec {
-  gnu = linux; /* ++ hurd ++ kfreebsd ++ ... */
-  linux = ["i686-linux" "x86_64-linux" "armv5tel-linux" "armv6l-linux" "armv7l-linux" "mips64el-linux"];
+  all = linux ++ darwin ++ cygwin ++ freebsd ++ openbsd ++ netbsd ++ illumos;
+  allBut = platforms: lists.filter (x: !(builtins.elem x platforms)) all;
+  none = [];
+
+  arm = ["armv5tel-linux" "armv6l-linux" "armv7l-linux" ];
+  i686 = ["i686-linux" "i686-freebsd" "i686-netbsd" "i686-cygwin"];
+  mips = [ "mips64el-linux" ];
+  x86_64 = ["x86_64-linux" "x86_64-darwin" "x86_64-freebsd" "x86_64-openbsd" "x86_64-netbsd" "x86_64-cygwin"];
+
+  cygwin = ["i686-cygwin" "x86_64-cygwin"];
   darwin = ["x86_64-darwin"];
   freebsd = ["i686-freebsd" "x86_64-freebsd"];
-  openbsd = ["i686-openbsd" "x86_64-openbsd"];
+  gnu = linux; /* ++ hurd ++ kfreebsd ++ ... */
+  illumos = ["x86_64-solaris"];
+  linux = ["i686-linux" "x86_64-linux" "armv5tel-linux" "armv6l-linux" "armv7l-linux" "mips64el-linux"];
   netbsd = ["i686-netbsd" "x86_64-netbsd"];
-  cygwin = ["i686-cygwin" "x86_64-cygwin"];
-  unix = linux ++ darwin ++ freebsd ++ openbsd;
-  all = linux ++ darwin ++ cygwin ++ freebsd ++ openbsd;
-  none = [];
-  allBut = platforms: lists.filter (x: !(builtins.elem x platforms)) all;
-  mesaPlatforms = ["i686-linux" "x86_64-linux" "x86_64-darwin" "armv5tel-linux" "armv6l-linux"];
-  x86_64 = ["x86_64-linux" "x86_64-darwin" "x86_64-freebsd" "x86_64-openbsd" "x86_64-netbsd" "x86_64-cygwin"];
-  i686 = ["i686-linux" "i686-freebsd" "i686-netbsd" "i686-cygwin"];
-  arm = ["armv5tel-linux" "armv6l-linux" "armv7l-linux" ];
-  mips = [ "mips64el-linux" ];
+  openbsd = ["i686-openbsd" "x86_64-openbsd"];
+  unix = linux ++ darwin ++ freebsd ++ openbsd ++ netbsd ++ illumos;
+
+  mesaPlatforms = ["i686-linux" "x86_64-linux" "x86_64-darwin" "armv5tel-linux" "armv6l-linux" "armv7l-linux"];
 }

lib/sandbox.nix

@@ -0,0 +1,47 @@
+with import ./strings.nix;
+
+/* Helpers for creating lisp S-exprs for the Apple sandbox
+
+lib.sandbox.allowFileRead [ "/usr/bin/file" ];
+  # => "(allow file-read* (literal \"/usr/bin/file\"))";
+
+lib.sandbox.allowFileRead {
+  literal = [ "/usr/bin/file" ];
+  subpath = [ "/usr/lib/system" ];
+}
+  # => "(allow file-read* (literal \"/usr/bin/file\") (subpath \"/usr/lib/system\"))"
+*/
+
+let
+
+sexp = tokens: "(" + builtins.concatStringsSep " " tokens + ")";
+generateFileList = files:
+  if builtins.isList files
+    then concatMapStringsSep " " (x: sexp [ "literal" ''"${x}"'' ]) files
+    else if builtins.isString files
+      then generateFileList [ files ]
+      else concatStringsSep " " (
+        (map (x: sexp [ "literal" ''"${x}"'' ]) (files.literal or [])) ++
+        (map (x: sexp [ "subpath" ''"${x}"'' ]) (files.subpath or []))
+      );
+applyToFiles = f: act: files: f "${act} ${generateFileList files}";
+genActions = actionName: let
+  action = feature: sexp [ actionName feature ];
+  self = {
+    "${actionName}" = action;
+    "${actionName}File" = applyToFiles action "file*";
+    "${actionName}FileRead" = applyToFiles action "file-read*";
+    "${actionName}FileReadMetadata" = applyToFiles action "file-read-metadata";
+    "${actionName}DirectoryList" = self."${actionName}FileReadMetadata";
+    "${actionName}FileWrite" = applyToFiles action "file-write*";
+    "${actionName}FileWriteMetadata" = applyToFiles action "file-write-metadata";
+  };
+  in self;
+
+in
+
+genActions "allow" // genActions "deny" // {
+  importProfile = derivation: ''
+    (import "${derivation}")
+  '';
+}

lib/strings.nix

@@ -52,6 +52,10 @@ rec {
   # libraries for a set of packages, e.g. "${pkg1}/lib:${pkg2}/lib:...".
   makeLibraryPath = makeSearchPath "lib";
 
+  # Construct a binary search path (such as $PATH) containing the
+  # binaries for a set of packages, e.g. "${pkg1}/bin:${pkg2}/bin:...".
+  makeBinPath = makeSearchPath "bin";
+
 
   # Idem for Perl search paths.
   makePerlPath = makeSearchPath "lib/perl5/site_perl";
@@ -227,4 +231,27 @@ rec {
   # Check whether a value is a store path.
   isStorePath = x: builtins.substring 0 1 (toString x) == "/" && dirOf (builtins.toPath x) == builtins.storeDir;
 
+  # Convert string to int
+  # Obviously, it is a bit hacky to use fromJSON that way.
+  toInt = str:
+    let may_be_int = builtins.fromJSON str; in
+    if builtins.isInt may_be_int
+    then may_be_int
+    else throw "Could not convert ${str} to int.";
+
+  # Read a list of paths from `file', relative to the `rootPath'. Lines
+  # beginning with `#' are treated as comments and ignored. Whitespace
+  # is significant.
+  readPathsFromFile = rootPath: file:
+    let
+      root = toString rootPath;
+      lines =
+        builtins.map (lib.removeSuffix "\n")
+        (lib.splitString "\n" (builtins.readFile file));
+      removeComments = lib.filter (line: !(lib.hasPrefix "#" line));
+      relativePaths = removeComments lines;
+      absolutePaths = builtins.map (path: builtins.toPath (root + "/" + path)) relativePaths;
+    in
+      absolutePaths;
+
 }

lib/systems.nix

@@ -84,10 +84,10 @@ rec {
   };
 
 
-  isDarwin = matchAttrs { kernel = kernels.darwin; };
-  isLinux = matchAttrs { kernel = kernels.linux; };
-  isi686 = matchAttrs { cpu = cpuTypes.i686; };
   is64Bit = matchAttrs { cpu = { bits = 64; }; };
+  isDarwin = matchAttrs { kernel = kernels.darwin; };
+  isi686 = matchAttrs { cpu = cpuTypes.i686; };
+  isLinux = matchAttrs { kernel = kernels.linux; };
 
 
   # This should revert the job done by config.guess from the gcc compiler.

lib/tests.nix

@@ -7,7 +7,7 @@ runTests {
     expr = id 1;
     expected = 1;
   };
-  
+
   testConst = {
     expr = const 2 3;
     expected = 2;
@@ -19,12 +19,12 @@ runTests {
     expected = true;
   };
   */
-  
+
   testAnd = {
     expr = and true false;
     expected = false;
   };
-  
+
   testFix = {
     expr = fix (x: {a = if x ? a then "a" else "b";});
     expected = {a = "a";};
@@ -67,7 +67,7 @@ runTests {
   };
 
   testOverridableDelayableArgsTest = {
-    expr = 
+    expr =
       let res1 = defaultOverridableDelayableArgs id {};
           res2 = defaultOverridableDelayableArgs id { a = 7; };
           res3 = let x = defaultOverridableDelayableArgs id { a = 7; };
@@ -87,7 +87,7 @@ runTests {
                         in (x2.replace) { a = 10; }; # and override the value by 10
 
           # fixed tests (delayed args): (when using them add some comments, please)
-          resFixed1 = 
+          resFixed1 =
                 let x = defaultOverridableDelayableArgs id ( x : { a = 7; c = x.fixed.b; });
                     y = x.merge (x : { name = "name-${builtins.toString x.fixed.c}"; });
                 in (y.merge) { b = 10; };
@@ -109,5 +109,25 @@ runTests {
     expr = sort builtins.lessThan [ 40 2 30 42 ];
     expected = [2 30 40 42];
   };
-  
+
+  testToIntShouldConvertStringToInt = {
+    expr = toInt "27";
+    expected = 27;
+  };
+
+  testToIntShouldThrowErrorIfItCouldNotConvertToInt = {
+    expr = builtins.tryEval (toInt "\"foo\"");
+    expected = { success = false; value = false; };
+  };
+
+  testHasAttrByPathTrue = {
+    expr = hasAttrByPath ["a" "b"] { a = { b = "yey"; }; };
+    expected = true;
+  };
+
+  testHasAttrByPathFalse = {
+    expr = hasAttrByPath ["a" "b"] { a = { c = "yey"; }; };
+    expected = false;
+  };
+
 }

lib/tests/release.nix

@@ -11,14 +11,14 @@ stdenv.mkDerivation {
   buildCommand = ''
     datadir="${nix}/share"
     export TEST_ROOT=$(pwd)/test-tmp
-    export NIX_STORE_DIR=$TEST_ROOT/store
+    export NIX_BUILD_HOOK=
+    export NIX_CONF_DIR=$TEST_ROOT/etc
+    export NIX_DB_DIR=$TEST_ROOT/db
     export NIX_LOCALSTATE_DIR=$TEST_ROOT/var
     export NIX_LOG_DIR=$TEST_ROOT/var/log/nix
-    export NIX_STATE_DIR=$TEST_ROOT/var/nix
-    export NIX_DB_DIR=$TEST_ROOT/db
-    export NIX_CONF_DIR=$TEST_ROOT/etc
     export NIX_MANIFESTS_DIR=$TEST_ROOT/var/nix/manifests
-    export NIX_BUILD_HOOK=
+    export NIX_STATE_DIR=$TEST_ROOT/var/nix
+    export NIX_STORE_DIR=$TEST_ROOT/store
     export PAGER=cat
     cacheDir=$TEST_ROOT/binary-cache
     nix-store --init

lib/types.nix

@@ -6,7 +6,7 @@ with import ./attrsets.nix;
 with import ./options.nix;
 with import ./trivial.nix;
 with import ./strings.nix;
-with {inherit (import ./modules.nix) mergeDefinitions; };
+with {inherit (import ./modules.nix) mergeDefinitions filterOverrides; };
 
 rec {
 
@@ -93,7 +93,7 @@ rec {
 
     # derivation is a reserved keyword.
     package = mkOptionType {
-      name = "derivation";
+      name = "package";
       check = x: isDerivation x || isStorePath x;
       merge = loc: defs:
         let res = mergeOneOption loc defs;
@@ -166,6 +166,23 @@ rec {
         substSubModules = m: loaOf (elemType.substSubModules m);
       };
 
+    # List or element of ...
+    loeOf = elemType: mkOptionType {
+      name = "element or list of ${elemType.name}s";
+      check = x: isList x || elemType.check x;
+      merge = loc: defs:
+        let
+          defs' = filterOverrides defs;
+          res = (head defs').value;
+        in
+        if isList res then concatLists (getValues defs')
+        else if lessThan 1 (length defs') then
+          throw "The option `${showOption loc}' is defined multiple times, in ${showFiles (getFiles defs)}."
+        else if !isString res then
+          throw "The option `${showOption loc}' does not have a string value, in ${showFiles (getFiles defs)}."
+        else res;
+    };
+
     uniq = elemType: mkOptionType {
       inherit (elemType) name check;
       merge = mergeOneOption;
@@ -176,9 +193,9 @@ rec {
 
     nullOr = elemType: mkOptionType {
       name = "null or ${elemType.name}";
-      check = x: builtins.isNull x || elemType.check x;
+      check = x: x == null || elemType.check x;
       merge = loc: defs:
-        let nrNulls = count (def: isNull def.value) defs; in
+        let nrNulls = count (def: def.value == null) defs; in
         if nrNulls == length defs then null
         else if nrNulls != 0 then
           throw "The option `${showOption loc}' is defined both null and not null, in ${showFiles (getFiles defs)}."

maintainers/scripts/all-tarballs.nix

@@ -0,0 +1,18 @@
+/* Helper expression for copy-tarballs. This returns (nearly) all
+   tarballs used the free packages in Nixpkgs.
+
+   Typical usage:
+
+   $ copy-tarballs.pl --expr 'import <nixpkgs/maintainers/scripts/all-tarballs.nix>'
+*/
+
+removeAttrs (import ../../pkgs/top-level/release.nix
+  { # Don't apply ‘hydraJob’ to jobs, because then we can't get to the
+    # dependency graph.
+    scrubJobs = false;
+    # No need to evaluate on i686.
+    supportedSystems = [ "x86_64-linux" ];
+  })
+  [ # Remove jobs whose evaluation depends on a writable Nix store.
+    "tarball" "unstable"
+  ]

maintainers/scripts/copy-tarballs.pl

@@ -1,5 +1,5 @@
 #! /usr/bin/env nix-shell
-#! nix-shell -i perl -p perl perlPackages.NetAmazonS3 nixUnstable
+#! nix-shell -i perl -p perl perlPackages.NetAmazonS3 perlPackages.FileSlurp nixUnstable
 
 # This command uploads tarballs to tarballs.nixos.org, the
 # content-addressed cache used by fetchurl as a fallback for when
@@ -17,6 +17,7 @@ use strict;
 use warnings;
 use File::Basename;
 use File::Path;
+use File::Slurp;
 use JSON;
 use Net::Amazon::S3;
 use Nix::Store;
@@ -33,9 +34,21 @@ my $s3 = Net::Amazon::S3->new(
 
 my $bucket = $s3->bucket("nixpkgs-tarballs") or die;
 
+my $cacheFile = "/tmp/copy-tarballs-cache";
+my %cache;
+$cache{$_} = 1 foreach read_file($cacheFile, err_mode => 'quiet', chomp => 1);
+
+END() {
+    write_file($cacheFile, map { "$_\n" } keys %cache);
+}
+
 sub alreadyMirrored {
     my ($algo, $hash) = @_;
-    return defined $bucket->get_key("$algo/$hash");
+    my $key = "$algo/$hash";
+    return 1 if defined $cache{$key};
+    my $res = defined $bucket->get_key($key);
+    $cache{$key} = 1 if $res;
+    return $res;
 }
 
 sub uploadFile {
@@ -50,23 +63,25 @@ sub uploadFile {
 
     my $mainKey = "sha512/$sha512_16";
 
-    # Upload the file as sha512/<hash-in-base-16>.
-    print STDERR "uploading $fn to $mainKey...\n";
-    $bucket->add_key_filename($mainKey, $fn, { 'x-amz-meta-original-name' => $name })
-        or die "failed to upload $fn to $mainKey\n";
-
     # Create redirects from the other hash types.
     sub redirect {
         my ($name, $dest) = @_;
         #print STDERR "linking $name to $dest...\n";
         $bucket->add_key($name, "", { 'x-amz-website-redirect-location' => "/" . $dest })
             or die "failed to create redirect from $name to $dest\n";
+        $cache{$name} = 1;
     }
     redirect "md5/$md5_16", $mainKey;
     redirect "sha1/$sha1_16", $mainKey;
     redirect "sha256/$sha256_32", $mainKey;
     redirect "sha256/$sha256_16", $mainKey;
     redirect "sha512/$sha512_32", $mainKey;
+
+    # Upload the file as sha512/<hash-in-base-16>.
+    print STDERR "uploading $fn to $mainKey...\n";
+    $bucket->add_key_filename($mainKey, $fn, { 'x-amz-meta-original-name' => $name })
+        or die "failed to upload $fn to $mainKey\n";
+    $cache{$mainKey} = 1;
 }
 
 my $op = shift @ARGV;
@@ -74,17 +89,17 @@ my $op = shift @ARGV;
 if ($op eq "--file") {
     my $res = 0;
     foreach my $fn (@ARGV) {
-	eval {
-	    if (alreadyMirrored("sha512", hashFile("sha512", 0, $fn))) {
-		print STDERR "$fn is already mirrored\n";
-	    } else {
-		uploadFile($fn, basename $fn);
-	    }
-	};
-	if ($@) {
-	    warn "$@\n";
-	    $res = 1;
-	}
+        eval {
+            if (alreadyMirrored("sha512", hashFile("sha512", 0, $fn))) {
+                print STDERR "$fn is already mirrored\n";
+            } else {
+                uploadFile($fn, basename $fn);
+            }
+        };
+        if ($@) {
+            warn "$@\n";
+            $res = 1;
+        }
     }
     exit $res;
 }
@@ -93,7 +108,7 @@ elsif ($op eq "--expr") {
 
     # Evaluate find-tarballs.nix.
     my $expr = $ARGV[0] // die "$0: --expr requires a Nix expression\n";
-    my $pid = open(JSON, "-|", "nix-instantiate", "--eval-only", "--json", "--strict",
+    my $pid = open(JSON, "-|", "nix-instantiate", "--eval", "--json", "--strict",
                    "<nixpkgs/maintainers/scripts/find-tarballs.nix>",
                    "--arg", "expr", $expr);
     my $stdout = <JSON>;
@@ -113,6 +128,11 @@ elsif ($op eq "--expr") {
         my $algo = $fetch->{type};
         my $hash = $fetch->{hash};
 
+        if (defined $ENV{DEBUG}) {
+            print "$url $algo $hash\n";
+            next;
+        }
+
         if ($url !~ /^http:/ && $url !~ /^https:/ && $url !~ /^ftp:/ && $url !~ /^mirror:/) {
             print STDERR "skipping $url (unsupported scheme)\n";
             next;

maintainers/scripts/dep-licenses.sh

@@ -17,7 +17,7 @@ trap "exitHandler" EXIT
 # fetch the trace and the drvPath of the attribute.
 nix-instantiate $NIXPKGS -A $attr --show-trace > "$tmp/drvPath" 2> "$tmp/trace" || {
   cat 1>&2 - "$tmp/trace" <<EOF
-An error occured while evaluating $attr.
+An error occurred while evaluating $attr.
 EOF
   exit 1
 }

maintainers/scripts/find-tarballs.nix

@@ -1,10 +1,9 @@
-# This expression returns a list of all fetchurl calls used by all
-# packages reachable from release.nix.
+# This expression returns a list of all fetchurl calls used by ‘expr’.
 
 with import ../.. { };
 with lib;
 
-{ expr ? removeAttrs (import ../../pkgs/top-level/release.nix { }) [ "tarball" "unstable" ] }:
+{ expr }:
 
 let
 
@@ -19,7 +18,8 @@ let
 
   fetchurlDependencies =
     filter
-      (drv: drv.outputHash or "" != "" && drv.outputHashMode == "flat" && drv.postFetch or "" == "" && drv ? urls)
+      (drv: drv.outputHash or "" != "" && drv.outputHashMode or "flat" == "flat"
+          && drv.postFetch or "" == "" && drv ? urls)
       dependencies;
 
   dependencies = map (x: x.value) (genericClosure {

maintainers/scripts/gnome-latest.sh

@@ -1,95 +0,0 @@
-#!/usr/bin/env bash
-
-GNOME_FTP="ftp.gnome.org/pub/GNOME/sources"
-
-project=$1
-
-if [ "$project" == "--help" ]; then
-  echo "Usage: $0 project [major.minor]"
-  exit 0
-fi
-
-baseVersion=$2
-
-if [ -z "$project" ]; then
-  echo "No project specified, exiting"
-  exit 1
-fi
-
-# curl -l ftp://... doesn't work from my office in HSE, and I don't want to have
-# any conversations with sysadmin. Somehow lftp works.
-if [ "$FTP_CLIENT" = "lftp" ]; then
-  ls_ftp() {
-    lftp -c "open $1; cls"
-  }
-else
-  ls_ftp() {
-    curl -l "$1"/
-  }
-fi
-
-if [ -z "$baseVersion" ]; then
-  echo "Looking for available versions..." >&2
-  available_baseversions=( `ls_ftp ftp://${GNOME_FTP}/${project} | grep '[0-9]\.[0-9]' | sort -t. -k1,1n -k 2,2n` )
-  echo -e "The following versions are available:\n ${available_baseversions[@]}" >&2
-  echo -en "Choose one of them: " >&2
-  read baseVersion
-fi
-
-FTPDIR="${GNOME_FTP}/${project}/${baseVersion}"
-
-#version=`curl -l ${FTPDIR}/ 2>/dev/null | grep LATEST-IS | sed -e s/LATEST-IS-//`
-# gnome's LATEST-IS is broken. Do not trust it.
-
-files=$(ls_ftp "${FTPDIR}")
-declare -A versions
-
-for f in $files; do
-  case $f in
-    (LATEST-IS-*|*.news|*.changes|*.sha256sum|*.diff*):
-      ;;
-    ($project-*.*.9*.tar.*):
-      tmp=${f#$project-}
-      tmp=${tmp%.tar*}
-      echo "Ignored unstable version ${tmp}" >&2
-      ;;
-    ($project-*.tar.*):
-      tmp=${f#$project-}
-      tmp=${tmp%.tar*}
-      versions[${tmp}]=1
-      ;;
-    (*):
-      echo "UNKNOWN FILE $f"
-      ;;
-  esac
-done
-echo "Found versions ${!versions[@]}" >&2
-version=`echo ${!versions[@]} | sed -e 's/ /\n/g' | sort -t. -k1,1n -k 2,2n -k 3,3n | tail -n1`
-echo "Latest version is: ${version}" >&2
-
-name=${project}-${version}
-echo "Fetching .sha256 file" >&2
-curl -O http://${FTPDIR}/${name}.sha256sum
-
-extensions=( "xz" "bz2" "gz" )
-echo "Choosing archive extension (known are ${extensions[@]})..." >&2
-for ext in ${extensions[@]}; do
-  if grep "\\.tar\\.${ext}$" ${name}.sha256sum >& /dev/null; then
-    ext_pref=$ext
-    sha256=$(grep "\\.tar\\.${ext}$" ${name}.sha256sum | cut -f1 -d\ )
-    break
-  fi
-done
-sha256=`nix-hash --to-base32 --type sha256 $sha256`
-echo "Chosen ${ext_pref}, hash is ${sha256}" >&2
-
-cat <<EOF
-  name = "${project}-${version}";
-
-  src = fetchurl {
-    url = mirror://gnome/sources/${project}/${baseVersion}/${project}-${version}.tar.${ext_pref};
-    sha256 = "${sha256}";
-  };
-EOF
-
-rm -v ${name}.sha256sum >&2

maintainers/scripts/gnome.sh

@@ -0,0 +1,194 @@
+#!/usr/bin/env bash
+
+set -o pipefail
+
+GNOME_FTP="ftp.gnome.org/pub/GNOME/sources"
+
+# projects that don't follow the GNOME major versioning, or that we don't want to
+# programmatically update
+NO_GNOME_MAJOR="gtkhtml gdm"
+
+usage() {
+  echo "Usage: $0 gnome_dir <show project>|<update project>|<update-all> [major.minor]" >&2
+  echo "gnome_dir is for example pkgs/desktops/gnome-3/3.18" >&2
+  exit 0
+}
+
+if [ "$#" -lt 2 ]; then
+  usage
+fi
+
+GNOME_TOP="$1"
+shift
+
+action="$1"
+
+# curl -l ftp://... doesn't work from my office in HSE, and I don't want to have
+# any conversations with sysadmin. Somehow lftp works.
+if [ "$FTP_CLIENT" = "lftp" ]; then
+  ls_ftp() {
+    lftp -c "open $1; cls"
+  }
+else
+  ls_ftp() {
+    curl -s -l "$1"/
+  }
+fi
+
+find_project() {
+  exec find "$GNOME_TOP" -mindepth 2 -maxdepth 2 -type d $@
+}
+
+show_project() {
+  local project="$1"
+  local majorVersion="$2"
+  local version=""
+
+  if [ -z "$majorVersion" ]; then
+    echo "Looking for available versions..." >&2
+    local available_baseversions=( `ls_ftp ftp://${GNOME_FTP}/${project} | grep '[0-9]\.[0-9]' | sort -t. -k1,1n -k 2,2n` )
+    if [ "$?" -ne "0" ]; then
+      echo "Project $project not found" >&2
+      return 1
+    fi
+    
+    echo -e "The following versions are available:\n ${available_baseversions[@]}" >&2
+    echo -en "Choose one of them: " >&2
+    read majorVersion
+  fi
+  
+  if echo "$majorVersion" | grep -q "[0-9]\+\.[0-9]\+\.[0-9]\+"; then
+    # not a major version
+    version="$majorVersion"
+    majorVersion=$(echo "$majorVersion" | cut -d '.' -f 1,2)
+  fi
+  
+  local FTPDIR="${GNOME_FTP}/${project}/${majorVersion}"
+  
+  #version=`curl -l ${FTPDIR}/ 2>/dev/null | grep LATEST-IS | sed -e s/LATEST-IS-//`
+  # gnome's LATEST-IS is broken. Do not trust it.
+  
+  if [ -z "$version" ]; then
+  	local files=$(ls_ftp "${FTPDIR}")
+  	declare -A versions
+  	
+  	for f in $files; do
+  		case $f in
+      (LATEST-IS-*|*.news|*.changes|*.sha256sum|*.diff*):
+  		;;
+      ($project-*.*.9*.tar.*):
+  		tmp=${f#$project-}
+  		tmp=${tmp%.tar*}
+  		echo "Ignored unstable version ${tmp}" >&2
+  		;;
+      ($project-*.tar.*):
+  		tmp=${f#$project-}
+  		tmp=${tmp%.tar*}
+  		versions[${tmp}]=1
+  		;;
+      (*):
+  		echo "UNKNOWN FILE $f" >&2
+  		;;
+  		esac
+  	done
+  	echo "Found versions ${!versions[@]}" >&2
+  	version=`echo ${!versions[@]} | sed -e 's/ /\n/g' | sort -t. -k1,1n -k 2,2n -k 3,3n | tail -n1`
+        if [ -z "$version" ]; then
+          echo "No version available for major $majorVersion" >&2
+          return 1
+        fi
+
+  	echo "Latest version is: ${version}" >&2
+  fi
+  
+  local name=${project}-${version}
+  echo "Fetching .sha256 file" >&2
+  local sha256out=$(curl -s -f http://${FTPDIR}/${name}.sha256sum)
+  
+  if [ "$?" -ne "0" ]; then
+  	echo "Version not found" >&2
+  	return 1
+  fi
+  
+  extensions=( "xz" "bz2" "gz" )
+  echo "Choosing archive extension (known are ${extensions[@]})..." >&2
+  for ext in ${extensions[@]}; do
+    if echo -e "$sha256out" | grep -q "\\.tar\\.${ext}$"; then
+      ext_pref=$ext
+      sha256=$(echo -e "$sha256out" | grep "\\.tar\\.${ext}$" | cut -f1 -d\ )
+      break
+    fi
+  done
+  echo "Chosen ${ext_pref}, hash is ${sha256}" >&2
+  
+  echo "# Autogenerated by maintainers/scripts/gnome.sh update
+
+fetchurl: {
+  name = \"${project}-${version}\";
+
+  src = fetchurl {
+    url = mirror://gnome/sources/${project}/${majorVersion}/${project}-${version}.tar.${ext_pref};
+    sha256 = \"${sha256}\";
+  };
+}"
+
+  return 0
+}
+
+update_project() {
+  local project="$1"
+  local majorVersion="$2"
+
+  # find project in nixpkgs tree
+  projectPath=$(find_project -name "$project" -print)
+  if [ -z "$projectPath" ]; then
+    echo "Project $project not found under $GNOME_TOP"
+    exit 1
+  fi
+
+  src=$(show_project "$project" "$majorVersion")
+  
+  if [ "$?" -eq "0" ]; then
+    echo "Updating $projectPath/src.nix" >&2
+    echo -e "$src" > "$projectPath/src.nix"
+  fi
+
+  return 0
+}
+
+if [ "$action" == "update-all" ]; then
+  majorVersion="$2"
+  if [ -z "$majorVersion" ]; then
+    echo "No major version specified" >&2
+    usage
+  fi
+
+  # find projects
+  projects=$(find_project -exec basename '{}' \;)
+  for project in $projects; do
+    if echo "$NO_GNOME_MAJOR"|grep -q $project; then
+      echo "Skipping $project"
+    else
+      echo "= Updating $project to $majorVersion" >&2
+      update_project $project $majorVersion
+      echo >&2
+    fi
+  done
+else
+  project="$2"
+  majorVersion="$3"
+
+  if [ -z "$project" ]; then
+    echo "No project specified, exiting" >&2
+    usage
+  fi
+
+  if [ "$action" == "show" ]; then
+    show_project $project $majorVersion
+  elif [ "$action" == "update" ]; then
+    update_project $project $majorVersion
+  else
+    echo "Unknown action $action" >&2
+    usage
+  fi
+fi

maintainers/scripts/nix-call-package

@@ -1,5 +1,5 @@
 #! /bin/sh
 
-echo "let pkgs = import /etc/nixos/nixpkgs$2 {}; x = pkgs.callPackage $1 { $3 }; in ${4:-x}" |
+echo "let pkgs = import <nixpkgs$2> {}; x = pkgs.callPackage $1 { $3 }; in ${4:-x}" |
 nix-instantiate --show-trace - |
 xargs nix-store -r -K

maintainers/scripts/nix-generate-from-cpan.nix

@@ -1,22 +1,24 @@
 { stdenv, makeWrapper, perl, perlPackages }:
 
 stdenv.mkDerivation {
-  name = "nix-generate-from-cpan-1";
+  name = "nix-generate-from-cpan-2";
 
-  buildInputs = [ makeWrapper perl perlPackages.YAMLLibYAML perlPackages.JSON perlPackages.CPANPLUS ];
+  buildInputs = with perlPackages; [
+    makeWrapper perl CPANMeta GetoptLongDescriptive CPANPLUS Readonly Log4Perl
+  ];
 
-  unpackPhase = "true";
-  buildPhase = "true";
+  phases = [ "installPhase" ];
 
   installPhase =
     ''
       mkdir -p $out/bin
       cp ${./nix-generate-from-cpan.pl} $out/bin/nix-generate-from-cpan
+      patchShebangs $out/bin/nix-generate-from-cpan
       wrapProgram $out/bin/nix-generate-from-cpan --set PERL5LIB $PERL5LIB
     '';
 
   meta = {
-    maintainers = [ stdenv.lib.maintainers.eelco ];
+    maintainers = with stdenv.lib.maintainers; [ eelco rycee ];
     description = "Utility to generate a Nix expression for a Perl package from CPAN";
   };
 }

maintainers/scripts/nix-generate-from-cpan.pl

@@ -1,154 +1,440 @@
-#! /run/current-system/sw/bin/perl -w
+#!/usr/bin/env perl
 
+use utf8;
 use strict;
-use CPANPLUS::Backend;
-use YAML::XS;
-use JSON;
+use warnings;
 
-my $module_name = $ARGV[0];
-die "syntax: $0 <MODULE-NAME>\n" unless defined $module_name;
+use CPAN::Meta();
+use CPANPLUS::Backend();
+use Getopt::Long::Descriptive qw( describe_options );
+use JSON::PP qw( encode_json );
+use Log::Log4perl qw(:easy);
+use Readonly();
 
-my $cb = CPANPLUS::Backend->new;
+# Readonly hash that maps CPAN style license strings to information
+# necessary to generate a Nixpkgs style license attribute.
+Readonly::Hash my %LICENSE_MAP => (
 
-my @modules = $cb->search(type => "name", allow => [$module_name]);
-die "module $module_name not found\n" if scalar @modules == 0;
-die "multiple packages that match module $module_name\n" if scalar @modules > 1;
-my $module = $modules[0];
+    # The Perl 5 License (Artistic 1 & GPL 1 or later).
+    perl_5 => {
+        licenses => [qw( artistic1 gpl1Plus )]
+    },
+
+    # GNU Affero General Public License, Version 3.
+    agpl_3 => {
+        licenses => [qw( agpl3Plus )],
+        amb      => 1
+    },
+
+    # Apache Software License, Version 1.1.
+    apache_1_1 => {
+        licenses => ["Apache License 1.1"],
+        in_set   => 0
+    },
+
+    # Apache License, Version 2.0.
+    apache_2_0 => {
+        licenses => [qw( asl20 )]
+    },
+
+    # Artistic License, (Version 1).
+    artistic_1 => {
+        licenses => [qw( artistic1 )]
+    },
+
+    # Artistic License, Version 2.0.
+    artistic_2 => {
+        licenses => [qw( artistic2 )]
+    },
+
+    # BSD License (three-clause).
+    bsd => {
+        licenses => [qw( bsd3 )],
+        amb      => 1
+    },
+
+    # FreeBSD License (two-clause).
+    freebsd => {
+        licenses => [qw( bsd2 )]
+    },
+
+    # GNU Free Documentation License, Version 1.2.
+    gfdl_1_2 => {
+        licenses => [qw( fdl12 )]
+    },
+
+    # GNU Free Documentation License, Version 1.3.
+    gfdl_1_3 => {
+        licenses => [qw( fdl13 )]
+    },
+
+    # GNU General Public License, Version 1.
+    gpl_1 => {
+        licenses => [qw( gpl1Plus )],
+        amb      => 1
+    },
+
+    # GNU General Public License, Version 2. Note, we will interpret
+    # "gpl" alone as GPL v2+.
+    gpl_2 => {
+        licenses => [qw( gpl2Plus )],
+        amb      => 1
+    },
+
+    # GNU General Public License, Version 3.
+    gpl_3 => {
+        licenses => [qw( gpl3Plus )],
+        amb      => 1
+    },
+
+    # GNU Lesser General Public License, Version 2.1. Note, we will
+    # interpret "gpl" alone as LGPL v2.1+.
+    lgpl_2_1 => {
+        licenses => [qw( lgpl21Plus )],
+        amb      => 1
+    },
+
+    # GNU Lesser General Public License, Version 3.0.
+    lgpl_3_0 => {
+        licenses => [qw( lgpl3Plus )],
+        amb      => 1
+    },
+
+    # MIT (aka X11) License.
+    mit => {
+        licenses => [qw( mit )]
+    },
+
+    # Mozilla Public License, Version 1.0.
+    mozilla_1_0 => {
+        licenses => [qw( mpl10 )]
+    },
+
+    # Mozilla Public License, Version 1.1.
+    mozilla_1_1 => {
+        licenses => [qw( mpl11 )]
+    },
+
+    # OpenSSL License.
+    openssl => {
+        licenses => [qw( openssl )]
+    },
+
+    # Q Public License, Version 1.0.
+    qpl_1_0 => {
+        licenses => [qw( qpl )]
+    },
+
+    # Original SSLeay License.
+    ssleay => {
+        licenses => ["Original SSLeay License"],
+        in_set   => 0
+    },
+
+    # Sun Internet Standards Source License (SISSL).
+    sun => {
+        licenses => ["Sun Industry Standards Source License v1.1"],
+        in_set   => 0
+    },
+
+    # zlib License.
+    zlib => {
+        licenses => [qw( zlib )]
+    },
+
+    # Other Open Source Initiative (OSI) approved license.
+    open_source => {
+        licenses => [qw( free )],
+        amb      => 1
+    },
+
+    # Requires special permission from copyright holder.
+    restricted => {
+        licenses => [qw( unfree )],
+        amb      => 1
+    },
+
+    # Not an OSI approved license, but not restricted. Note, we
+    # currently map this to unfreeRedistributable, which is a
+    # conservative choice.
+    unrestricted => {
+        licenses => [qw( unfreeRedistributable )],
+        amb      => 1
+    },
+
+    # License not provided in metadata.
+    unknown => {
+        licenses => [qw( unknown )],
+        amb      => 1
+    }
+);
+
+sub handle_opts {
+    my ( $opt, $usage ) = describe_options(
+        'usage: $0 %o MODULE',
+        [ 'maintainer|m=s', 'the package maintainer' ],
+        [ 'debug|d',        'enable debug output' ],
+        [ 'help',           'print usage message and exit' ]
+    );
+
+    if ( $opt->help ) {
+        print $usage->text;
+        exit;
+    }
+
+    my $module_name = $ARGV[0];
+
+    if ( !defined $module_name ) {
+        print STDERR "Missing module name\n";
+        print STDERR $usage->text;
+        exit 1;
+    }
+
+    return ( $opt, $module_name );
+}
+
+# Takes a Perl package attribute name and returns 1 if the name cannot
+# be referred to as a bareword. This typically happens if the package
+# name is a reserved Nix keyword.
+sub is_reserved {
+    my ($pkg) = @_;
+
+    return $pkg =~ /^(?: assert    |
+                         else      |
+                         if        |
+                         import    |
+                         in        |
+                         inherit   |
+                         let       |
+                         rec       |
+                         then      |
+                         while     |
+                         with      )$/x;
+}
 
 sub pkg_to_attr {
-    my ($pkg_name) = @_;
-    my $attr_name = $pkg_name;
-    $attr_name =~ s/-\d.*//; # strip version
-    return "LWP" if $attr_name eq "libwww-perl";
-    $attr_name =~ s/-//g;
-    return $attr_name;
+    my ($module) = @_;
+    my $attr_name = $module->package_name;
+    if ( $attr_name eq "libwww-perl" ) {
+        return "LWP";
+    }
+    else {
+        $attr_name =~ s/-//g;
+        return $attr_name;
+    }
 }
 
 sub get_pkg_name {
     my ($module) = @_;
-    my $pkg_name = $module->package;
-    $pkg_name =~ s/\.tar.*//;
-    $pkg_name =~ s/\.zip//;
-    return $pkg_name;
+    return $module->package_name . '-' . $module->package_version;
 }
 
-my $pkg_name = get_pkg_name $module;
-my $attr_name = pkg_to_attr $pkg_name;
+sub read_meta {
+    my ($pkg_path) = @_;
 
-print STDERR "attribute name: ", $attr_name, "\n";
-print STDERR "module: ", $module->module, "\n";
-print STDERR "version: ", $module->version, "\n";
-print STDERR "package: ", $module->package, , " (", $pkg_name, ", ", $attr_name, ")\n";
-print STDERR "path: ", $module->path, "\n";
+    my $yaml_path = "$pkg_path/META.yml";
+    my $json_path = "$pkg_path/META.json";
+    my $meta;
 
-my $tar_path = $module->fetch();
-print STDERR "downloaded to: $tar_path\n";
-print STDERR "sha-256: ", $module->status->checksum_value, "\n";
-
-my $pkg_path = $module->extract();
-print STDERR "unpacked to: $pkg_path\n";
-
-my $meta;
-if (-e "$pkg_path/META.yml") {
-    eval {
-        $meta = YAML::XS::LoadFile("$pkg_path/META.yml");
-    };
-    if ($@) {
-        system("iconv -f windows-1252 -t utf-8 '$pkg_path/META.yml' > '$pkg_path/META.yml.tmp'");
-        $meta = YAML::XS::LoadFile("$pkg_path/META.yml.tmp");
+    if ( -r $json_path ) {
+        $meta = CPAN::Meta->load_file($json_path);
+    }
+    elsif ( -r $yaml_path ) {
+        $meta = CPAN::Meta->load_file($yaml_path);
+    }
+    else {
+        WARN("package has no META.yml or META.json");
     }
-} elsif (-e "$pkg_path/META.json") {
-    local $/;
-    open(my $fh, '<', "$pkg_path/META.json") or die;
-    $meta = decode_json(<$fh>);
-} else {
-    warn "package has no META.yml or META.json\n";
-}
 
-print STDERR "metadata: ", encode_json($meta), "\n" if defined $meta;
+    return $meta;
+}
 
 # Map a module to the attribute corresponding to its package
 # (e.g. HTML::HeadParser will be mapped to HTMLParser, because that
 # module is in the HTML-Parser package).
 sub module_to_pkg {
-    my ($module_name) = @_;
-    my @modules = $cb->search(type => "name", allow => [$module_name]);
-    if (scalar @modules == 0) {
+    my ( $cb, $module_name ) = @_;
+    my @modules = $cb->search( type => "name", allow => [$module_name] );
+    if ( scalar @modules == 0 ) {
+
         # Fallback.
         $module_name =~ s/:://g;
         return $module_name;
     }
-    my $module = $modules[0];
-    my $attr_name = pkg_to_attr(get_pkg_name $module);
-    print STDERR "mapped dep $module_name to $attr_name\n";
+    my $module    = $modules[0];
+    my $attr_name = pkg_to_attr($module);
+    DEBUG("mapped dep $module_name to $attr_name");
     return $attr_name;
 }
 
 sub get_deps {
-    my ($type) = @_;
-    my $deps;
-    if (defined $meta->{prereqs}) {
-        die "unimplemented";
-    } elsif ($type eq "runtime") {
-        $deps = $meta->{requires};
-    } elsif ($type eq "configure") {
-        $deps = $meta->{configure_requires};
-    } elsif ($type eq "build") {
-        $deps = $meta->{build_requires};
-    }
+    my ( $cb, $meta, $type ) = @_;
+
+    return if !defined $meta;
+
+    my $prereqs = $meta->effective_prereqs;
+    my $deps = $prereqs->requirements_for( $type, "requires" );
     my @res;
-    foreach my $n (keys %{$deps}) {
+    foreach my $n ( $deps->required_modules ) {
         next if $n eq "perl";
+
         # Hacky way to figure out if this module is part of Perl.
-        if ($n !~ /^JSON/ && $n !~ /^YAML/ && $n !~ /^Module::Pluggable/) {
+        if ( $n !~ /^JSON/ && $n !~ /^YAML/ && $n !~ /^Module::Pluggable/  && $n !~ /^if$/ ) {
             eval "use $n;";
-            if (!$@) {
-                print STDERR "skipping Perl-builtin module $n\n";
+            if ( !$@ ) {
+                DEBUG("skipping Perl-builtin module $n");
                 next;
             }
         }
-        push @res, module_to_pkg($n);
+
+        my $pkg = module_to_pkg( $cb, $n );
+
+        # If the package name is reserved then we need to refer to it
+        # through the "self" variable.
+        $pkg = "self.\"$pkg\"" if is_reserved($pkg);
+
+        push @res, $pkg;
     }
     return @res;
 }
 
 sub uniq {
-    return keys %{{ map { $_ => 1 } @_ }};
+    return keys %{ { map { $_ => 1 } @_ } };
 }
 
-my @build_deps = sort(uniq(get_deps("configure"), get_deps("build"), get_deps("test")));
-print STDERR "build deps: @build_deps\n";
+sub render_license {
+    my ($cpan_license) = @_;
 
-my @runtime_deps = sort(uniq(get_deps("runtime")));
-print STDERR "runtime deps: @runtime_deps\n";
+    return if !defined $cpan_license;
 
-my $homepage = $meta->{resources}->{homepage};
-print STDERR "homepage: $homepage\n" if defined $homepage;
+    my $licenses;
 
-my $description = $meta->{abstract};
-if (defined $description) {
-    $description = uc(substr($description, 0, 1)) . substr($description, 1); # capitalise first letter
-    $description =~ s/\.$//; # remove period at the end
+    # If the license is ambiguous then we'll print an extra warning.
+    # For example, "gpl_2" is ambiguous since it may refer to exactly
+    # "GPL v2" or to "GPL v2 or later".
+    my $amb = 0;
+
+    # Whether the license is available inside `stdenv.lib.licenses`.
+    my $in_set = 1;
+
+    my $nix_license = $LICENSE_MAP{$cpan_license};
+    if ( !$nix_license ) {
+        WARN("Unknown license: $cpan_license");
+        $licenses = [$cpan_license];
+        $in_set   = 0;
+    }
+    else {
+        $licenses = $nix_license->{licenses};
+        $amb      = $nix_license->{amb};
+        $in_set   = !$nix_license->{in_set};
+    }
+
+    my $license_line;
+
+    if ( @$licenses == 0 ) {
+
+        # Avoid defining the license line.
+    }
+    elsif ($in_set) {
+        my $lic = 'stdenv.lib.licenses';
+        if ( @$licenses == 1 ) {
+            $license_line = "$lic.$licenses->[0]";
+        }
+        else {
+            $license_line = "with $lic; [ " . join( ' ', @$licenses ) . " ]";
+        }
+    }
+    else {
+        if ( @$licenses == 1 ) {
+            $license_line = $licenses->[0];
+        }
+        else {
+            $license_line = '[ ' . join( ' ', @$licenses ) . ' ]';
+        }
+    }
+
+    INFO("license: $cpan_license");
+    WARN("License '$cpan_license' is ambiguous, please verify") if $amb;
+
+    return $license_line;
+}
+
+my ( $opt, $module_name ) = handle_opts();
+
+Log::Log4perl->easy_init(
+    {
+        level => $opt->debug ? $DEBUG : $INFO,
+        layout => '%m%n'
+    }
+);
+
+my $cb = CPANPLUS::Backend->new;
+
+my @modules = $cb->search( type => "name", allow => [$module_name] );
+die "module $module_name not found\n" if scalar @modules == 0;
+die "multiple packages that match module $module_name\n" if scalar @modules > 1;
+my $module = $modules[0];
+
+my $pkg_name  = get_pkg_name $module;
+my $attr_name = pkg_to_attr $module;
+
+INFO( "attribute name: ", $attr_name );
+INFO( "module: ",         $module->module );
+INFO( "version: ",        $module->version );
+INFO( "package: ", $module->package, " (", $pkg_name, ", ", $attr_name, ")" );
+INFO( "path: ",    $module->path );
+
+my $tar_path = $module->fetch();
+INFO( "downloaded to: ", $tar_path );
+INFO( "sha-256: ",       $module->status->checksum_value );
+
+my $pkg_path = $module->extract();
+INFO( "unpacked to: ", $pkg_path );
+
+my $meta = read_meta($pkg_path);
+
+DEBUG( "metadata: ", encode_json( $meta->as_struct ) ) if defined $meta;
+
+my @build_deps = sort( uniq(
+        get_deps( $cb, $meta, "configure" ),
+        get_deps( $cb, $meta, "build" ),
+        get_deps( $cb, $meta, "test" )
+) );
+INFO("build deps: @build_deps");
+
+my @runtime_deps = sort( uniq( get_deps( $cb, $meta, "runtime" ) ) );
+INFO("runtime deps: @runtime_deps");
+
+my $homepage = $meta ? $meta->resources->{homepage} : undef;
+INFO("homepage: $homepage") if defined $homepage;
+
+my $description = $meta ? $meta->abstract : undef;
+if ( defined $description ) {
+    $description = uc( substr( $description, 0, 1 ) )
+      . substr( $description, 1 );    # capitalise first letter
+    $description =~ s/\.$//;          # remove period at the end
     $description =~ s/\s*$//;
     $description =~ s/^\s*//;
-    print STDERR "description: $description\n";
+    $description =~ s/\n+/ /;         # Replace new lines by space.
+    INFO("description: $description");
 }
 
-my $license = $meta->{license};
-if (defined $license) {
-    $license = "perl5" if $license eq "perl_5";
-    print STDERR "license: $license\n";
-}
+#print(Data::Dumper::Dumper($meta->licenses) . "\n");
+my $license = $meta ? render_license( $meta->licenses ) : undef;
 
-my $build_fun = -e "$pkg_path/Build.PL" && ! -e "$pkg_path/Makefile.PL" ? "buildPerlModule" : "buildPerlPackage";
+INFO( "RSS feed: https://metacpan.org/feed/distribution/",
+    $module->package_name );
+
+my $build_fun = -e "$pkg_path/Build.PL"
+  && !-e "$pkg_path/Makefile.PL" ? "buildPerlModule" : "buildPerlPackage";
 
 print STDERR "===\n";
 
 print <<EOF;
-  $attr_name = $build_fun {
+  ${\(is_reserved($attr_name) ? "\"$attr_name\"" : $attr_name)} = $build_fun rec {
     name = "$pkg_name";
     src = fetchurl {
-      url = mirror://cpan/${\$module->path}/${\$module->package};
+      url = "mirror://cpan/${\$module->path}/\${name}.${\$module->package_extension}";
       sha256 = "${\$module->status->checksum_value}";
     };
 EOF
@@ -164,11 +450,14 @@ EOF
 print <<EOF if defined $homepage;
       homepage = $homepage;
 EOF
-print <<EOF if defined $description;
+print <<EOF if defined $description && $description ne "Unknown";
       description = "$description";
 EOF
 print <<EOF if defined $license;
-      license = "$license";
+      license = $license;
+EOF
+print <<EOF if $opt->maintainer;
+      maintainers = [ maintainers.${\$opt->maintainer} ];
 EOF
 print <<EOF;
     };

maintainers/scripts/travis-nox-review-pr.sh

@@ -11,11 +11,7 @@ if [[ $1 == nix ]]; then
 
     # Make sure we can use hydra's binary cache
     sudo mkdir /etc/nix
-    sudo tee /etc/nix/nix.conf <<EOF >/dev/null
-binary-caches = http://cache.nixos.org http://hydra.nixos.org
-trusted-binary-caches = http://hydra.nixos.org
-build-max-jobs = 4
-EOF
+    sudo sh -c 'echo "build-max-jobs = 4" > /etc/nix/nix.conf'
 
     # Verify evaluation
     echo "=== Verifying that nixpkgs evaluates..."
@@ -27,6 +23,9 @@ elif [[ $1 == nox ]]; then
 elif [[ $1 == build ]]; then
     source $HOME/.nix-profile/etc/profile.d/nix.sh
 
+    echo "=== Checking tarball creation"
+    nix-build pkgs/top-level/release.nix -A tarball
+
     if [[ $TRAVIS_PULL_REQUEST == false ]]; then
         echo "=== Not a pull request"
     else
@@ -41,8 +40,6 @@ elif [[ $1 == build ]]; then
             exit 1
         fi
     fi
-    # echo "=== Checking tarball creation"
-    # nix-build pkgs/top-level/release.nix -A tarball
 else
     echo "$0: Unknown option $1" >&2
     false

maintainers/scripts/vanity.sh

@@ -12,7 +12,7 @@ git_data="$(echo "$raw_git_log" | grep 'Author:' |
 # Also there are a few manual entries
 maintainers="$(cat "$(dirname "$0")/../../lib/maintainers.nix" |
   grep '=' | sed -re 's/\\"/''/g;
-  s/ *([^ =]*) *= *" *(.*[^ ]) *[<](.*)[>] *".*/\1\t\2\t\3/')"
+  s/[ 	]*([^ 	=]*)[ 	]*=[ 	]*" *(.*[^ ]) *[<](.*)[>] *".*/\1\t\2\t\3/')"
 git_lines="$( ( echo "$git_data";
     cat "$(dirname "$0")/vanity-manual-equalities.txt") | sort |uniq)"
 
@@ -28,7 +28,7 @@ fetchGithubName () {
     )"
     userid="$(
         curl https://github.com/NixOS/nixpkgs/commit/"$commitid" 2>/dev/null |
-        grep authored -B10 | grep 'href="/' |
+        grep committed -B10 | grep 'href="/' |
         sed -re 's@.* href="/@@; s@".*@@' |
 	grep -v "/commit/"
     )";

nixos/doc/manual/administration/declarative-containers.xml

@@ -22,8 +22,10 @@ containers.database =
 </programlisting>
 
 If you run <literal>nixos-rebuild switch</literal>, the container will
-be built and started. If the container was already running, it will be
-updated in place, without rebooting.</para>
+be built. If the container was already running, it will be
+updated in place, without rebooting. The container can be configured to
+start automatically by setting <literal>containers.database.autoStart = true</literal>
+in its configuration.</para>
 
 <para>By default, declarative containers share the network namespace
 of the host, meaning that they can listen on (privileged)
@@ -41,13 +43,15 @@ containers.database =
 This gives the container a private virtual Ethernet interface with IP
 address <literal>192.168.100.11</literal>, which is hooked up to a
 virtual Ethernet interface on the host with IP address
-<literal>192.168.100.10</literal>.  (See the next section for details
+<literal>192.168.100.10</literal>. (See the next section for details
 on container networking.)</para>
 
 <para>To disable the container, just remove it from
 <filename>configuration.nix</filename> and run <literal>nixos-rebuild
 switch</literal>. Note that this will not delete the root directory of
-the container in <literal>/var/lib/containers</literal>.</para>
+the container in <literal>/var/lib/containers</literal>. Containers can be
+destroyed using the imperative method: <literal>nixos-container destroy
+ foo</literal>.</para>
 
 <para>Declarative containers can be started and stopped using the
 corresponding systemd service, e.g. <literal>systemctl start

nixos/doc/manual/configuration/config-file.xml

@@ -157,7 +157,7 @@ boot.kernel.sysctl."net.ipv4.tcp_keepalive_time" = 60;
 fileSystems."/boot" =
   { device = "/dev/sda1";
     fsType = "ext4";
-    options = "rw,data=ordered,relatime";
+    options = [ "rw" "data=ordered" "relatime" ];
   };
 </programlisting>
       </para>

nixos/doc/manual/configuration/configuration.xml

@@ -26,6 +26,8 @@ effect after you run <command>nixos-rebuild</command>.</para>
 
 <!-- FIXME: auto-include NixOS module docs -->
 <xi:include href="postgresql.xml" />
+<xi:include href="gitlab.xml" />
+<xi:include href="acme.xml" />
 
 <!-- Apache; libvirtd virtualisation -->
 

nixos/doc/manual/configuration/user-mgmt.xml

@@ -65,6 +65,14 @@ account named <literal>alice</literal>:
 <screen>
 $ useradd -m alice</screen>
 
+To make all nix tools available to this new user use `su - USER` which 
+opens a login shell (==shell that loads the profile) for given user. 
+This will create the ~/.nix-defexpr symlink. So run:
+
+<screen>
+$ su - alice -c "true"</screen>
+
+
 The flag <option>-m</option> causes the creation of a home directory
 for the new user, which is generally what you want.  The user does not
 have an initial password and therefore cannot log in.  A password can

nixos/doc/manual/configuration/wireless.xml

@@ -18,8 +18,20 @@ NixOS will start wpa_supplicant for you if you enable this setting:
 networking.wireless.enable = true;
 </programlisting>
 
-NixOS currently does not generate wpa_supplicant's
-configuration file, <literal>/etc/wpa_supplicant.conf</literal>. You should edit this file
+NixOS lets you specify networks for wpa_supplicant declaratively:
+<programlisting>
+networking.wireless.networks = {
+  echelon = {
+    psk = "abcdefgh";
+  };
+  "free.wifi" = {};
+}
+</programlisting>
+
+Be aware that keys will be written to the nix store in plaintext!
+
+When no networks are set, it will default to using a configuration file at
+<literal>/etc/wpa_supplicant.conf</literal>. You should edit this file
 yourself to define wireless networks, WPA keys and so on (see
 wpa_supplicant.conf(5)).
 </para>

nixos/doc/manual/default.nix

@@ -1,4 +1,4 @@
-{ pkgs, options, version, revision }:
+{ pkgs, options, version, revision, extraSources ? [] }:
 
 with pkgs;
 with pkgs.lib;
@@ -17,19 +17,20 @@ let
 
   # Clean up declaration sites to not refer to the NixOS source tree.
   optionsList' = flip map optionsList (opt: opt // {
-    declarations = map (fn: stripPrefix fn) opt.declarations;
+    declarations = map stripAnyPrefixes opt.declarations;
   }
   // optionalAttrs (opt ? example) { example = substFunction opt.example; }
   // optionalAttrs (opt ? default) { default = substFunction opt.default; }
   // optionalAttrs (opt ? type) { type = substFunction opt.type; });
 
-  prefix = toString ../../..;
-
-  stripPrefix = fn:
-    if substring 0 (stringLength prefix) fn == prefix then
-      substring (stringLength prefix + 1) 1000 fn
-    else
-      fn;
+  # We need to strip references to /nix/store/* from options,
+  # including any `extraSources` if some modules came from elsewhere,
+  # or else the build will fail.
+  #
+  # E.g. if some `options` came from modules in ${pkgs.customModules}/nix,
+  # you'd need to include `extraSources = [ pkgs.customModules ]`
+  prefixesToStrip = map (p: "${toString p}/") ([ ../../.. ] ++ extraSources);
+  stripAnyPrefixes = flip (fold removePrefix) prefixesToStrip;
 
   # Convert the list of options into an XML file.
   optionsXML = builtins.toFile "options.xml" (builtins.toXML optionsList');
@@ -55,6 +56,8 @@ let
       cp -prd $sources/* . # */
       chmod -R u+w .
       cp ${../../modules/services/databases/postgresql.xml} configuration/postgresql.xml
+      cp ${../../modules/services/misc/gitlab.xml} configuration/gitlab.xml
+      cp ${../../modules/security/acme.xml} configuration/acme.xml
       ln -s ${optionsDocBook} options-db.xml
       echo "${version}" > version
     '';
@@ -146,12 +149,9 @@ in rec {
 
     inherit sources;
 
-    buildInputs = [ libxml2 libxslt dblatex tetex ];
+    buildInputs = [ libxml2 libxslt dblatex dblatex.tex ];
 
     buildCommand = ''
-      # TeX needs a writable font cache.
-      export VARTEXFONTS=$TMPDIR/texfonts
-
       ${copySources}
 
       dst=$out/share/doc/nixos
@@ -162,7 +162,7 @@ in rec {
 
       mkdir -p $out/nix-support
       echo "doc-pdf manual $dst/manual.pdf" >> $out/nix-support/hydra-build-products
-    ''; # */
+    '';
   };
 
   # Generate the NixOS manpages.
@@ -187,6 +187,7 @@ in rec {
         --param man.output.in.separate.dir 1 \
         --param man.output.base.dir "'$out/share/man/'" \
         --param man.endnotes.are.numbered 0 \
+        --param man.break.after.slash 1 \
         ${docbook5_xsl}/xml/xsl/docbook/manpages/docbook.xsl \
         ./man-pages.xml
     '';

nixos/doc/manual/development/writing-modules.xml

@@ -107,12 +107,12 @@ the file system.  This module declares two options that can be defined
 by other modules (typically the user’s
 <filename>configuration.nix</filename>):
 <option>services.locate.enable</option> (whether the database should
-be updated) and <option>services.locate.period</option> (when the
+be updated) and <option>services.locate.interval</option> (when the
 update should be done).  It implements its functionality by defining
 two options declared by other modules:
 <option>systemd.services</option> (the set of all systemd services)
-and <option>services.cron.systemCronJobs</option> (the list of
-commands to be executed periodically by <command>cron</command>).</para>
+and <option>systemd.timers</option> (the list of commands to be
+executed periodically by <command>systemd</command>).</para>
 
 <example xml:id='locate-example'><title>NixOS Module for the “locate” Service</title>
 <programlisting>
@@ -120,53 +120,59 @@ commands to be executed periodically by <command>cron</command>).</para>
 
 with lib;
 
-let locatedb = "/var/cache/locatedb"; in
-
-{
-  options = {
-
-    services.locate = {
-
-      enable = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          If enabled, NixOS will periodically update the database of
-          files used by the <command>locate</command> command.
-        '';
-      };
-
-      period = mkOption {
-        type = types.str;
-        default = "15 02 * * *";
-        description = ''
-          This option defines (in the format used by cron) when the
-          locate database is updated.  The default is to update at
-          02:15 at night every day.
-        '';
-      };
-
+let
+  cfg = config.services.locate;
+in {
+  options.services.locate = {
+    enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        If enabled, NixOS will periodically update the database of
+        files used by the <command>locate</command> command.
+      '';
     };
 
+    interval = mkOption {
+      type = types.str;
+      default = "02:15";
+      example = "hourly";
+      description = ''
+        Update the locate database at this interval. Updates by
+        default at 2:15 AM every day.
+
+        The format is described in
+        <citerefentry><refentrytitle>systemd.time</refentrytitle>
+        <manvolnum>7</manvolnum></citerefentry>.
+      '';
+    };
+
+    # Other options omitted for documentation
   };
 
   config = {
-
     systemd.services.update-locatedb =
       { description = "Update Locate Database";
         path  = [ pkgs.su ];
         script =
           ''
-            mkdir -m 0755 -p $(dirname ${locatedb})
-            exec updatedb --localuser=nobody --output=${locatedb} --prunepaths='/tmp /var/tmp /run'
+            mkdir -m 0755 -p $(dirname ${toString cfg.output})
+            exec updatedb \
+              --localuser=${cfg.localuser} \
+              ${optionalString (!cfg.includeStore) "--prunepaths='/nix/store'"} \
+              --output=${toString cfg.output} ${concatStringsSep " " cfg.extraFlags}
           '';
       };
 
-    services.cron.systemCronJobs = optional config.services.locate.enable
-      "${config.services.locate.period} root ${config.systemd.package}/bin/systemctl start update-locatedb.service";
-
+    systemd.timers.update-locatedb = mkIf cfg.enable
+      { description = "Update timer for locate database";
+        partOf      = [ "update-locatedb.service" ];
+        wantedBy    = [ "timers.target" ];
+        timerConfig.OnCalendar = cfg.interval;
+      };
   };
-}</programlisting>
+}
+</programlisting>
 </example>
 
 <xi:include href="option-declarations.xml" />

nixos/doc/manual/installation/installing.xml

@@ -18,11 +18,14 @@
   <listitem><para>The NixOS manual is available on virtual console 8
   (press Alt+F8 to access).</para></listitem>
 
-  <listitem><para>Login as <literal>root</literal> and the empty
-  password.</para></listitem>
+  <listitem><para>You get logged in as <literal>root</literal>
+  (with empty password).</para></listitem>
 
   <listitem><para>If you downloaded the graphical ISO image, you can
-  run <command>start display-manager</command> to start KDE.</para></listitem>
+  run <command>start display-manager</command> to start KDE. If you
+  want to continue on the terminal, you can use
+  <command>loadkeys</command> to switch to your preferred keyboard layout.
+  (We even provide neo2 via <command>loadkeys de neo</command>!)</para></listitem>
 
   <listitem><para>The boot process should have brought up networking (check
   <command>ip a</command>).  Networking is necessary for the
@@ -35,7 +38,7 @@
   <command>systemctl stop network-manager</command>.</para></listitem>
 
   <listitem><para>The NixOS installer doesn’t do any partitioning or
-  formatting yet, so you need to that yourself.  Use the following
+  formatting yet, so you need to do that yourself.  Use the following
   commands:
 
   <itemizedlist>

nixos/doc/manual/installation/obtaining.xml

@@ -39,8 +39,8 @@ running NixOS system through several other means:
     <para>Using NixOps, the NixOS-based cloud deployment tool, which
     allows you to provision VirtualBox and EC2 NixOS instances from
     declarative specifications.  Check out the <link
-    xlink:href="https://github.com/NixOS/nixops">NixOps
-    homepage</link> for details.</para>
+    xlink:href="https://nixos.org/nixops">NixOps homepage</link> for
+    details.</para>
   </listitem>
 </itemizedlist>
 

nixos/doc/manual/man-nixos-generate-config.xml

@@ -165,13 +165,13 @@ look like this:
   fileSystems."/" =
     { device = "/dev/disk/by-label/nixos";
       fsType = "ext3";
-      options = "rw,data=ordered,relatime";
+      options = [ "rw" "data=ordered" "relatime" ];
     };
 
   fileSystems."/boot" =
     { device = "/dev/sda1";
       fsType = "ext3";
-      options = "rw,errors=continue,user_xattr,acl,barrier=1,data=writeback,relatime";
+      options = [ "rw" "errors=continue" "user_xattr" "acl" "barrier=1" "data=writeback" "relatime" ];
     };
 
   swapDevices =

nixos/doc/manual/man-nixos-rebuild.xml

@@ -281,6 +281,51 @@ $ nixos-rebuild switch -p test -I nixos-config=./test.nix
     </listitem>
   </varlistentry>
 
+  <varlistentry>
+    <term><option>--build-host</option></term>
+    <listitem>
+      <para>Instead of building the new configuration locally, use the
+      specified host to perform the build. The host needs to be accessible
+      with ssh, and must be able to perform Nix builds. If the option
+      <option>--target-host</option> is not set, the build will be copied back
+      to the local machine when done.</para>
+
+      <para>Note that, if <option>--no-build-nix</option> is not specified,
+      Nix will be built both locally and remotely. This is because the
+      configuration will always be evaluated locally even though the building
+      might be performed remotely.</para>
+
+      <para>You can include a remote user name in
+      the host name (<replaceable>user@host</replaceable>). You can also set
+      ssh options by defining the <envar>NIX_SSHOPTS</envar> environment
+      variable.</para>
+    </listitem>
+  </varlistentry>
+
+  <varlistentry>
+    <term><option>--target-host</option></term>
+    <listitem>
+      <para>Specifies the NixOS target host. By setting this to something other
+      than <replaceable>localhost</replaceable>, the system activation will
+      happen on the remote host instead of the local machine. The remote host
+      needs to be accessible over ssh, and for the commands
+      <option>switch</option>, <option>boot</option> and <option>test</option>
+      you need root access.</para>
+
+      <para>If <option>--build-host</option> is not explicitly
+      specified, <option>--build-host</option> will implicitly be set to the
+      same value as <option>--target-host</option>. So, if you only specify
+      <option>--target-host</option> both building and activation will take
+      place remotely (and no build artifacts will be copied to the local
+      machine).</para>
+
+      <para>You can include a remote user name in
+      the host name (<replaceable>user@host</replaceable>). You can also set
+      ssh options by defining the <envar>NIX_SSHOPTS</envar> environment
+      variable.</para>
+    </listitem>
+  </varlistentry>
+
 </variablelist>
 
 <para>In addition, <command>nixos-rebuild</command> accepts various
@@ -305,6 +350,13 @@ the Nix manual for details.</para>
     </listitem>
   </varlistentry>
 
+  <varlistentry><term><envar>NIX_SSHOPTS</envar></term>
+
+    <listitem><para>Additional options to be passed to
+    <command>ssh</command> on the command line.</para></listitem>
+
+  </varlistentry>
+
 </variablelist>
 
 </refsection>

nixos/doc/manual/release-notes/release-notes.xml

@@ -9,6 +9,7 @@
 <para>This section lists the release notes for each stable version of NixOS
 and current unstable revision.</para>
 
+<xi:include href="rl-1603.xml" />
 <xi:include href="rl-1509.xml" />
 <xi:include href="rl-1412.xml" />
 <xi:include href="rl-1404.xml" />

nixos/doc/manual/release-notes/rl-1509.xml

@@ -11,28 +11,6 @@ has the following highlights:</para>
 
 <itemizedlist>
 
-  <listitem>
-    <para>Gnome has been upgraded to 3.16.
-    </para>
-  </listitem>
-
-  <listitem>
-    <para>Xfce has been upgraded to 4.12.
-    </para>
-  </listitem>
-
-  <listitem>
-    <para>KDE 5 has been upgraded to KDE Frameworks 5.10,
-      Plasma 5.3.2 and Applications 15.04.3.
-      KDE 4 has been updated to kdelibs-4.14.10.
-    </para>
-  </listitem>
-
-  <listitem>
-    <para>E19 has been upgraded to 0.16.8.15.
-    </para>
-  </listitem>
-
   <listitem>
     <para>The <link xlink:href="http://haskell.org/">Haskell</link>
     packages infrastructure has been re-designed from the ground up
@@ -78,10 +56,32 @@ system.autoUpgrade.enable = true;
     3.18.</para>
   </listitem>
 
+  <listitem>
+    <para>GNOME has been upgraded to 3.16.
+    </para>
+  </listitem>
+
+  <listitem>
+    <para>Xfce has been upgraded to 4.12.
+    </para>
+  </listitem>
+
+  <listitem>
+    <para>KDE 5 has been upgraded to KDE Frameworks 5.10,
+      Plasma 5.3.2 and Applications 15.04.3.
+      KDE 4 has been updated to kdelibs-4.14.10.
+    </para>
+  </listitem>
+
+  <listitem>
+    <para>E19 has been upgraded to 0.16.8.15.
+    </para>
+  </listitem>
+
 </itemizedlist>
 
 
-  <para>Following new services were added since the last release:
+<para>The following new services were added since the last release:
 
   <itemizedlist>
     <listitem><para><literal>services/mail/exim.nix</literal></para></listitem>
@@ -152,7 +152,7 @@ system.autoUpgrade.enable = true;
     <listitem><para><literal>virtualisation/vmware-guest.nix</literal></para></listitem>
     <listitem><para><literal>virtualisation/xen-dom0.nix</literal></para></listitem>
   </itemizedlist>
-  </para>
+</para>
 
 
 <para>When upgrading from a previous release, please be aware of the

nixos/doc/manual/release-notes/rl-1603.xml

@@ -0,0 +1,414 @@
+<section xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xmlns:xi="http://www.w3.org/2001/XInclude"
+         version="5.0"
+         xml:id="sec-release-16.03">
+
+<title>Release 16.03 (“Emu”, 2016/03/??)</title>
+
+<para>In addition to numerous new and upgraded packages, this release
+has the following highlights:</para>
+
+<itemizedlist>
+
+  <listitem>
+    <para>Systemd 229, bringing <link
+    xlink:href="https://github.com/systemd/systemd/blob/v229/NEWS">numerous
+    improvements</link> over 217.</para>
+  </listitem>
+
+  <listitem>
+    <para>Linux 4.4 (was 3.18).</para>
+  </listitem>
+
+  <listitem>
+    <para>GCC 5.3 (was 4.9). Note that GCC 5 <link
+    xlink:href="https://gcc.gnu.org/onlinedocs/libstdc++/manual/using_dual_abi.html">changes
+    the C++ ABI in an incompatible way</link>; this may cause problems
+    if you try to link objects compiled with different versions of
+    GCC.</para>
+  </listitem>
+
+  <listitem>
+    <para>Glibc 2.23 (was 2.21).</para>
+  </listitem>
+
+  <listitem>
+    <para>Improved support for ensuring <link
+    xlink:href="https://reproducible-builds.org/">bitwise reproducible
+    builds</link>. For example, <literal>stdenv</literal> now sets the
+    environment variable <envar
+    xlink:href="https://reproducible-builds.org/specs/source-date-epoch/">SOURCE_DATE_EPOCH</envar>
+    to a deterministic value, and Nix has <link
+    xlink:href="http://nixos.org/nix/manual/#ssec-relnotes-1.11">gained
+    an option</link> to repeat a build a number of times to test
+    determinism. An ongoing project, the goal of exact reproducibility
+    is to allow binaries to be verified independently (e.g., a user
+    might only trust binaries that appear in three independent binary
+    caches).</para>
+  </listitem>
+
+  <listitem>
+    <para>Perl 5.22.</para>
+  </listitem>
+
+</itemizedlist>
+
+<para>The following new services were added since the last release:
+
+  <itemizedlist>
+    <listitem><para><literal>services/monitoring/longview.nix</literal></para></listitem>
+    <listitem><para><literal>hardware/video/webcam/facetimehd.nix</literal></para></listitem>
+    <listitem><para><literal>i18n/inputMethod/default.nix</literal></para></listitem>
+    <listitem><para><literal>i18n/inputMethod/fcitx.nix</literal></para></listitem>
+    <listitem><para><literal>i18n/inputMethod/ibus.nix</literal></para></listitem>
+    <listitem><para><literal>i18n/inputMethod/nabi.nix</literal></para></listitem>
+    <listitem><para><literal>i18n/inputMethod/uim.nix</literal></para></listitem>
+    <listitem><para><literal>programs/fish.nix</literal></para></listitem>
+    <listitem><para><literal>security/acme.nix</literal></para></listitem>
+    <listitem><para><literal>security/audit.nix</literal></para></listitem>
+    <listitem><para><literal>security/oath.nix</literal></para></listitem>
+    <listitem><para><literal>services/hardware/irqbalance.nix</literal></para></listitem>
+    <listitem><para><literal>services/mail/dspam.nix</literal></para></listitem>
+    <listitem><para><literal>services/mail/opendkim.nix</literal></para></listitem>
+    <listitem><para><literal>services/mail/postsrsd.nix</literal></para></listitem>
+    <listitem><para><literal>services/mail/rspamd.nix</literal></para></listitem>
+    <listitem><para><literal>services/mail/rmilter.nix</literal></para></listitem>
+    <listitem><para><literal>services/misc/autofs.nix</literal></para></listitem>
+    <listitem><para><literal>services/misc/bepasty.nix</literal></para></listitem>
+    <listitem><para><literal>services/misc/calibre-server.nix</literal></para></listitem>
+    <listitem><para><literal>services/misc/cfdyndns.nix</literal></para></listitem>
+    <listitem><para><literal>services/misc/gammu-smsd.nix</literal></para></listitem>
+    <listitem><para><literal>services/misc/mathics.nix</literal></para></listitem>
+    <listitem><para><literal>services/misc/matrix-synapse.nix</literal></para></listitem>
+    <listitem><para><literal>services/misc/octoprint.nix</literal></para></listitem>
+    <listitem><para><literal>services/monitoring/hdaps.nix</literal></para></listitem>
+    <listitem><para><literal>services/monitoring/heapster.nix</literal></para></listitem>
+    <listitem><para><literal>services/monitoring/longview.nix</literal></para></listitem>
+    <listitem><para><literal>services/network-filesystems/netatalk.nix</literal></para></listitem>
+    <listitem><para><literal>services/network-filesystems/xtreemfs.nix</literal></para></listitem>
+    <listitem><para><literal>services/networking/autossh.nix</literal></para></listitem>
+    <listitem><para><literal>services/networking/dnschain.nix</literal></para></listitem>
+    <listitem><para><literal>services/networking/gale.nix</literal></para></listitem>
+    <listitem><para><literal>services/networking/miniupnpd.nix</literal></para></listitem>
+    <listitem><para><literal>services/networking/namecoind.nix</literal></para></listitem>
+    <listitem><para><literal>services/networking/ostinato.nix</literal></para></listitem>
+    <listitem><para><literal>services/networking/pdnsd.nix</literal></para></listitem>
+    <listitem><para><literal>services/networking/shairport-sync.nix</literal></para></listitem>
+    <listitem><para><literal>services/networking/supplicant.nix</literal></para></listitem>
+    <listitem><para><literal>services/search/kibana.nix</literal></para></listitem>
+    <listitem><para><literal>services/security/haka.nix</literal></para></listitem>
+    <listitem><para><literal>services/security/physlock.nix</literal></para></listitem>
+    <listitem><para><literal>services/web-apps/pump.io.nix</literal></para></listitem>
+    <listitem><para><literal>services/x11/hardware/libinput.nix</literal></para></listitem>
+    <listitem><para><literal>services/x11/window-managers/windowlab.nix</literal></para></listitem>
+    <listitem><para><literal>system/boot/initrd-network.nix</literal></para></listitem>
+    <listitem><para><literal>system/boot/initrd-ssh.nix</literal></para></listitem>
+    <listitem><para><literal>system/boot/loader/loader.nix</literal></para></listitem>
+    <listitem><para><literal>system/boot/networkd.nix</literal></para></listitem>
+    <listitem><para><literal>system/boot/resolved.nix</literal></para></listitem>
+    <listitem><para><literal>virtualisation/lxd.nix</literal></para></listitem>
+    <listitem><para><literal>virtualisation/rkt.nix</literal></para></listitem>
+  </itemizedlist>
+</para>
+
+<para>When upgrading from a previous release, please be aware of the
+following incompatible changes:</para>
+
+<itemizedlist>
+
+  <listitem>
+    <para>We no longer produce graphical ISO images and VirtualBox
+    images for <literal>i686-linux</literal>. A minimal ISO image is
+    still provided.</para>
+  </listitem>
+
+  <listitem>
+    <para>Firefox and similar browsers are now <emphasis>wrapped by default</emphasis>.
+    The package and attribute names are plain <literal>firefox</literal>
+    or <literal>midori</literal>, etc.  Backward-compatibility attributes were set up,
+    but note that <command>nix-env -u</command> will <emphasis>not</emphasis> update
+    your current <literal>firefox-with-plugins</literal>;
+    you have to uninstall it and install <literal>firefox</literal> instead.</para>
+  </listitem>
+
+  <listitem>
+    <para><command>wmiiSnap</command> has been replaced with
+    <command>wmii_hg</command>, but
+    <command>services.xserver.windowManager.wmii.enable</command> has
+    been updated respectively so this only affects you if you have
+    explicitly installed <command>wmiiSnap</command>.
+    </para>
+  </listitem>
+
+  <listitem>
+    <para><literal>jobs</literal> NixOS option has been removed. It served as
+    compatibility layer between Upstart jobs and SystemD services. All services
+    have been rewritten to use <literal>systemd.services</literal></para>
+  </listitem>
+
+  <listitem>
+    <para><command>wmiimenu</command> is removed, as it has been
+    removed by the developers upstream. Use <command>wimenu</command>
+    from the <command>wmii-hg</command> package.</para>
+  </listitem>
+
+  <listitem>
+    <para>Gitit is no longer automatically added to the module list in
+    NixOS and as such there will not be any manual entries for it. You
+    will need to add an import statement to your NixOS configuration
+    in order to use it, e.g.
+
+<programlisting><![CDATA[
+{
+  imports = [ <nixos/modules/services/misc/gitit.nix> ];
+}
+]]></programlisting>
+
+    will include the Gitit service configuration options.</para>
+  </listitem>
+
+  <listitem>
+    <para><command>nginx</command> does not accept flags for enabling and
+    disabling modules anymore. Instead it accepts <literal>modules</literal>
+    argument, which is a list of modules to be built in. All modules now
+    reside in <literal>nginxModules</literal> set. Example configuration:
+
+<programlisting><![CDATA[
+nginx.override {
+  modules = [ nginxModules.rtmp nginxModules.dav nginxModules.moreheaders ];
+}
+]]></programlisting>
+    </para>
+  </listitem>
+
+  <listitem>
+    <para><command>s3sync</command> is removed, as it hasn't been
+    developed by upstream for 4 years and only runs with ruby 1.8.
+    For an actively-developer alternative look at
+    <command>tarsnap</command> and others.
+    </para>
+  </listitem>
+
+  <listitem>
+    <para><command>ruby_1_8</command> has been removed as it's not
+    supported from upstream anymore and probably contains security
+    issues.
+    </para>
+  </listitem>
+
+  <listitem>
+    <para><literal>tidy-html5</literal> package is removed.
+    Upstream only provided <literal>(lib)tidy5</literal> during development,
+    and now they went back to <literal>(lib)tidy</literal> to work as a drop-in
+    replacement of the original package that has been unmaintained for years.
+    You can (still) use the <literal>html-tidy</literal> package, which got updated
+    to a stable release from this new upstream.</para>
+  </listitem>
+
+  <listitem>
+    <para><literal>extraDeviceOptions</literal> argument is removed
+    from <literal>bumblebee</literal> package. Instead there are
+    now two separate arguments: <literal>extraNvidiaDeviceOptions</literal>
+    and <literal>extraNouveauDeviceOptions</literal> for setting
+    extra X11 options for nvidia and nouveau drivers, respectively.
+    </para>
+  </listitem>
+
+  <listitem>
+    <para>The <literal>Ctrl+Alt+Backspace</literal> key combination
+    no longer kills the X server by default.
+    There's a new option <option>services.xserver.enableCtrlAltBackspace</option>
+    allowing to enable the combination again.
+    </para>
+  </listitem>
+
+  <listitem>
+    <para><literal>emacsPackagesNg</literal> now contains all packages
+    from the ELPA, MELPA, and MELPA Stable repositories.
+    </para>
+  </listitem>
+
+  <listitem>
+    <para>Data directory for Postfix MTA server is moved from
+    <filename>/var/postfix</filename> to <filename>/var/lib/postfix</filename>.
+    Old configurations are migrated automatically. <literal>service.postfix</literal>
+    module has also received many improvements, such as correct directories' access
+    rights, new <literal>aliasFiles</literal> and <literal>mapFiles</literal>
+    options and more.</para>
+  </listitem>
+
+  <listitem>
+    <para>Filesystem options should now be configured as a list of strings, not
+    a comma-separated string. The old style will continue to work, but print a
+    warning, until the 16.09 release. An example of the new style:
+
+<programlisting>
+fileSystems."/example" = {
+  device = "/dev/sdc";
+  fsType = "btrfs";
+  options = [ "noatime" "compress=lzo" "space_cache" "autodefrag" ];
+};
+</programlisting>
+    </para>
+  </listitem>
+
+  <listitem>
+    <para>CUPS, installed by <literal>services.printing</literal> module, now
+    has its data directory in <filename>/var/lib/cups</filename>. Old
+    configurations from <filename>/etc/cups</filename> are moved there
+    automatically, but there might be problems. Also configuration options
+    <literal>services.printing.cupsdConf</literal> and
+    <literal>services.printing.cupsdFilesConf</literal> were removed
+    because they had been allowing one to override configuration variables
+    required for CUPS to work at all on NixOS. For most use cases,
+    <literal>services.printing.extraConf</literal> and new option
+    <literal>services.printing.extraFilesConf</literal> should be enough;
+    if you encounter a situation when they are not, please file a bug.</para>
+
+    <para>There are also Gutenprint improvements; in particular, a new option
+    <literal>services.printing.gutenprint</literal> is added to enable automatic
+    updating of Gutenprint PPMs; it's greatly recommended to enable it instead
+    of adding <literal>gutenprint</literal> to the <literal>drivers</literal> list.
+    </para>
+  </listitem>
+
+  <listitem>
+    <para><literal>services.xserver.vaapiDrivers</literal> has been removed. Use
+    <literal>services.hardware.opengl.extraPackages{,32}</literal> instead. You can
+    also specify VDPAU drivers there.</para>
+  </listitem>
+
+  <listitem>
+    <para>
+    <literal>programs.ibus</literal> moved to <literal>i18n.inputMethod.ibus</literal>.
+    The option <literal>programs.ibus.plugins</literal> changed to <literal>i18n.inputMethod.ibus.engines</literal>
+    and the option to enable ibus changed from <literal>programs.ibus.enable</literal> to
+    <literal>i18n.inputMethod.enabled</literal>.
+    <literal>i18n.inputMethod.enabled</literal> should be set to the used input method name,
+    <literal>"ibus"</literal> for ibus.
+    An example of the new style:
+
+<programlisting>
+i18n.inputMethod.enabled = "ibus";
+i18n.inputMethod.ibus.engines = with pkgs.ibus-engines; [ anthy mozc ];
+</programlisting>
+
+That is equivalent to the old version:
+
+<programlisting>
+programs.ibus.enable = true;
+programs.ibus.plugins = with pkgs; [ ibus-anthy mozc ];
+</programlisting>
+
+    </para>
+  </listitem>
+
+  <listitem>
+    <para><literal>services.udev.extraRules</literal> option now writes rules
+    to <filename>99-local.rules</filename> instead of <filename>10-local.rules</filename>.
+    This makes all the user rules apply after others, so their results wouldn't be
+    overriden by anything else.</para>
+  </listitem>
+
+  <listitem>
+    <para>Large parts of the <literal>services.gitlab</literal> module has been
+    been rewritten. There are new configuration options available. The
+    <literal>stateDir</literal> option was renamned to
+    <literal>statePath</literal> and the <literal>satellitesDir</literal> option
+    was removed. Please review the currently available options.</para>
+  </listitem>
+
+  <listitem>
+    <para>
+    The option <option>services.nsd.zones.&lt;name&gt;.data</option> no
+    longer interpret the dollar sign ($) as a shell variable, as such it
+    should not be escaped anymore.  Thus the following zone data:
+    </para>
+    <programlisting>
+\$ORIGIN example.com.
+\$TTL 1800
+@       IN      SOA     ns1.vpn.nbp.name.      admin.example.com. (
+    </programlisting>
+    <para>
+    Should modified to look like the actual file expected by nsd:
+    </para>
+    <programlisting>
+$ORIGIN example.com.
+$TTL 1800
+@       IN      SOA     ns1.vpn.nbp.name.      admin.example.com. (
+    </programlisting>
+  </listitem>
+
+  <listitem>
+    <para>
+    <literal>service.syncthing.dataDir</literal> options now has to point
+    to exact folder where syncthing is writing to. Example configuration should
+    loook something like:
+    </para>
+    <programlisting>
+services.syncthing = {
+    enable = true;
+    dataDir = "/home/somebody/.syncthing";
+    user = "somebody";
+};
+    </programlisting>
+  </listitem>
+
+  <listitem>
+    <para>
+      <literal>networking.firewall.allowPing</literal> is now enabled by
+      default. Users are encourarged to configure an approiate rate limit for
+      their machines using the Kernel interface at
+      <filename>/proc/sys/net/ipv4/icmp_ratelimit</filename> and
+      <filename>/proc/sys/net/ipv6/icmp/ratelimit</filename> or using the
+      firewall itself, i.e. by setting the NixOS option
+      <literal>networking.firewall.pingLimit</literal>.
+    </para>
+  </listitem>
+
+  <listitem>
+    <para>
+      Systems with some broadcom cards used to result into a generated config
+      that is no longer accepted. If you get errors like
+      <screen>error: path ‘/nix/store/*-broadcom-sta-*’ does not exist and cannot be created</screen>
+      you should either re-run <command>nixos-generate-config</command> or manually replace
+      <literal>"${config.boot.kernelPackages.broadcom_sta}"</literal>
+      by
+      <literal>config.boot.kernelPackages.broadcom_sta</literal>
+      in your <filename>/etc/nixos/hardware-configuration.nix</filename>.
+      More discussion is on <link xlink:href="https://github.com/NixOS/nixpkgs/pull/12595">
+      the github issue</link>.
+    </para>
+  </listitem>
+</itemizedlist>
+
+
+<para>Other notable improvements:
+
+<itemizedlist>
+
+  <!--
+  <listitem>
+    <para>The <command>command-not-found</command> hook was extended.
+    Apart from <literal>$NIX_AUTO_INSTALL</literal> variable,
+    it newly also checks for <literal>$NIX_AUTO_RUN</literal>
+    which causes it to directly run the missing commands via
+    <command>nix-shell</command> (without installing anything).</para>
+  </listitem>
+  -->
+
+  <listitem>
+    <para><literal>ejabberd</literal> module is brought back and now works on
+    NixOS.</para>
+  </listitem>
+
+  <listitem>
+    <para>Input method support was improved. New NixOS modules (fcitx, nabi and uim),
+    fcitx engines (chewing, hangul, m17n, mozc and table-other) and ibus engines (hangul and m17n)
+    have been added.</para>
+  </listitem>
+
+</itemizedlist></para>
+
+</section>

nixos/lib/build-vms.nix

@@ -1,6 +1,6 @@
-{ system, minimal ? false }:
+{ system, minimal ? false, config ? {} }:
 
-let pkgs = import ../.. { config = {}; inherit system; }; in
+let pkgs = import ../.. { inherit system config; }; in
 
 with pkgs.lib;
 with import ../lib/qemu-flags.nix;

nixos/lib/eval-config.nix

@@ -54,11 +54,6 @@ in rec {
 
   # These are the extra arguments passed to every module.  In
   # particular, Nixpkgs is passed through the "pkgs" argument.
-  # FIXME: we enable config.allowUnfree to make packages like
-  # nvidia-x11 available. This isn't a problem because if the user has
-  # ‘nixpkgs.config.allowUnfree = false’, then evaluation will fail on
-  # the 64-bit package anyway. However, it would be cleaner to respect
-  # nixpkgs.config here.
   extraArgs = extraArgs_ // {
     inherit modules baseModules;
   };

nixos/lib/make-disk-image.nix

@@ -23,6 +23,8 @@
   postVM ? ""
 
 , name ? "nixos-disk-image"
+
+, format ? "raw"
 }:
 
 with lib;
@@ -32,8 +34,8 @@ pkgs.vmTools.runInLinuxVM (
     { preVM =
         ''
           mkdir $out
-          diskImage=$out/nixos.img
-          ${pkgs.vmTools.qemu}/bin/qemu-img create -f raw $diskImage "${toString diskSize}M"
+          diskImage=$out/nixos.${if format == "qcow2" then "qcow2" else "img"}
+          ${pkgs.vmTools.qemu}/bin/qemu-img create -f ${format} $diskImage "${toString diskSize}M"
           mv closure xchg/
         '';
       buildInputs = [ pkgs.utillinux pkgs.perl pkgs.e2fsprogs pkgs.parted ];

nixos/lib/make-iso9660-image.sh

@@ -119,7 +119,11 @@ $xorriso -output $out/iso/$isoName
 
 if test -n "$usbBootable"; then
     echo "Making image hybrid..."
-    isohybrid --uefi $out/iso/$isoName
+    if test -n "$efiBootable"; then
+        isohybrid --uefi $out/iso/$isoName
+    else
+        isohybrid $out/iso/$isoName
+    fi
 fi
 
 if test -n "$compressImage"; then

nixos/lib/test-driver/Machine.pm

@@ -381,6 +381,11 @@ sub waitForUnit {
             my $info = $self->getUnitInfo($unit);
             my $state = $info->{ActiveState};
             die "unit ‘$unit’ reached state ‘$state’\n" if $state eq "failed";
+            if ($state eq "inactive") {
+                my ($status, $jobs) = $self->execute("systemctl list-jobs --full 2>&1");
+                die "unit ‘$unit’ is inactive and there are no pending jobs\n"
+                    if $jobs =~ /No jobs/; # FIXME: fragile
+            }
             return 1 if $state eq "active";
         };
     });
@@ -538,7 +543,7 @@ sub waitForX {
         retry sub {
             my ($status, $out) = $self->execute("journalctl -b SYSLOG_IDENTIFIER=systemd | grep 'session opened'");
             return 0 if $status != 0;
-            ($status, $out) = $self->execute("[ -e /tmp/.X11-unix/X0 ]");
+            ($status, $out) = $self->execute("xwininfo -root > /dev/null 2>&1");
             return 1 if $status == 0;
         }
     });

nixos/lib/testing.nix

@@ -1,6 +1,6 @@
-{ system, minimal ? false }:
+{ system, minimal ? false, config ? {} }:
 
-with import ./build-vms.nix { inherit system minimal; };
+with import ./build-vms.nix { inherit system minimal config; };
 with pkgs;
 
 rec {

nixos/maintainers/scripts/azure/create-azure.sh

@@ -1,11 +1,8 @@
 #! /bin/sh -e
 
-BUCKET_NAME=${BUCKET_NAME:-nixos}
 export NIX_PATH=nixpkgs=../../../..
 export NIXOS_CONFIG=$(dirname $(readlink -f $0))/../../../modules/virtualisation/azure-image.nix
 export TIMESTAMP=$(date +%Y%m%d%H%M)
 
 nix-build '<nixpkgs/nixos>' \
-   -A config.system.build.azureImage --argstr system x86_64-linux -o azure --option extra-binary-caches http://hydra.nixos.org -j 10
-
-azure vm image create nixos-test --location "West Europe" --md5-skip -v --os Linux azure/disk.vhd
+   -A config.system.build.azureImage --argstr system x86_64-linux -o azure --option extra-binary-caches https://hydra.nixos.org -j 10

nixos/maintainers/scripts/azure/upload-azure.sh

@@ -0,0 +1,22 @@
+#! /bin/sh -e
+
+export STORAGE=${STORAGE:-nixos}
+export THREADS=${THREADS:-8}
+
+azure-vhd-utils-for-go  upload --localvhdpath azure/disk.vhd  --stgaccountname "$STORAGE"  --stgaccountkey "$KEY" \
+   --containername images --blobname nixos-unstable-nixops-updated.vhd --parallelism "$THREADS" --overwrite
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+

nixos/maintainers/scripts/ec2/amazon-image.nix

@@ -10,9 +10,11 @@ with lib;
     ];
 
   system.build.amazonImage = import ../../../lib/make-disk-image.nix {
-    inherit pkgs lib config;
+    inherit lib config;
+    pkgs = import ../../../.. { inherit (pkgs) system; }; # ensure we use the regular qemu-kvm package
     partitioned = config.ec2.hvm;
     diskSize = if config.ec2.hvm then 2048 else 8192;
+    format = "qcow2";
     configFile = pkgs.writeText "configuration.nix"
       ''
         {

nixos/maintainers/scripts/ec2/create-amis.sh

@@ -38,8 +38,7 @@ for type in hvm pv; do
         prevAmi=
         prevRegion=
 
-        #for region in eu-west-1 eu-central-1 us-east-1 us-west-1 us-west-2 ap-southeast-1 ap-southeast-2 ap-northeast-1 sa-east-1; do
-        for region in eu-west-1 us-east-1; do
+        for region in eu-west-1 eu-central-1 us-east-1 us-west-1 us-west-2 ap-southeast-1 ap-southeast-2 ap-northeast-1 sa-east-1; do
 
             name=nixos-$version-$arch-$type-$store
             description="NixOS $system $version ($type-$store)"
@@ -177,7 +176,6 @@ for type in hvm pv; do
                         extraFlags+=" --virtualization-type hvm"
                     fi
 
-                    set -x
                     ami=$(ec2-register \
                         -n "$name" \
                         -d "$description" \
@@ -193,15 +191,17 @@ for type in hvm pv; do
                 ami=$(cat $amiFile)
             fi
 
-            echo "waiting for AMI..."
-            while true; do
-                status=$(ec2-describe-images "$ami" --region "$region" | head -n1 | cut -f 5)
-                if [ "$status" = available ]; then break; fi
-                sleep 10
-            done
+            if [ -z "$NO_WAIT" -o -z "$prevAmi" ]; then
+                echo "waiting for AMI..."
+                while true; do
+                    status=$(ec2-describe-images "$ami" --region "$region" | head -n1 | cut -f 5)
+                    if [ "$status" = available ]; then break; fi
+                    sleep 10
+                done
 
-            ec2-modify-image-attribute \
-                --region "$region" "$ami" -l -a all
+                ec2-modify-image-attribute \
+                    --region "$region" "$ami" -l -a all
+            fi
 
             echo "region = $region, type = $type, store = $store, ami = $ami"
             if [ -z "$prevAmi" ]; then

nixos/modules/config/fonts/fontconfig.nix

@@ -108,10 +108,8 @@ with lib;
         subpixel = {
 
           rgba = mkOption {
-            type = types.string // {
-              check = flip elem ["rgb" "bgr" "vrgb" "vbgr" "none"];
-            };
             default = "rgb";
+            type = types.enum ["rgb" "bgr" "vrgb" "vbgr" "none"];
             description = ''
               Subpixel order, one of <literal>none</literal>,
               <literal>rgb</literal>, <literal>bgr</literal>,
@@ -120,10 +118,8 @@ with lib;
           };
 
           lcdfilter = mkOption {
-            type = types.str // {
-              check = flip elem ["none" "default" "light" "legacy"];
-            };
             default = "default";
+            type = types.enum ["none" "default" "light" "legacy"];
             description = ''
               FreeType LCD filter, one of <literal>none</literal>,
               <literal>default</literal>, <literal>light</literal>, or
@@ -133,6 +129,14 @@ with lib;
 
         };
 
+        cache32Bit = mkOption {
+          default = false;
+          type = types.bool;
+          description = ''
+            Generate system fonts cache for 32-bit applications.
+          '';
+        };
+
       };
 
     };
@@ -235,12 +239,19 @@ with lib;
         "${pkgs.fontconfig}/etc/fonts/fonts.conf";
 
       environment.etc."fonts/${pkgs.fontconfig.configVersion}/conf.d/00-nixos.conf".text =
-        ''
+        let
+          cache = fontconfig: pkgs.makeFontsCache { inherit fontconfig; fontDirectories = config.fonts.fonts; };
+        in ''
           <?xml version='1.0'?>
           <!DOCTYPE fontconfig SYSTEM 'fonts.dtd'>
           <fontconfig>
             <!-- Font directories -->
             ${concatStringsSep "\n" (map (font: "<dir>${font}</dir>") config.fonts.fonts)}
+            <!-- Pre-generated font caches -->
+            <cachedir>${cache pkgs.fontconfig}</cachedir>
+            ${optionalString (pkgs.stdenv.isx86_64 && config.fonts.fontconfig.cache32Bit) ''
+              <cachedir>${cache pkgs.pkgsi686Linux.fontconfig}</cachedir>
+            ''}
           </fontconfig>
         '';
 

nixos/modules/config/fonts/fonts.nix

@@ -31,6 +31,7 @@ with lib;
         pkgs.xorg.fontbh100dpi
         pkgs.xorg.fontmiscmisc
         pkgs.xorg.fontcursormisc
+        pkgs.unifont
       ];
 
   };

nixos/modules/config/gtk-exe-env.nix

@@ -1,41 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-{
-  imports = [
-  ];
-
-  options = {
-    gtkPlugins = lib.mkOption {
-      type = lib.types.listOf lib.types.path;
-      default = [];
-      description = ''
-        Plugin packages for GTK+ such as input methods.
-      '';
-    };
-  };
-
-  config = {
-    environment.variables = if builtins.length config.gtkPlugins > 0
-      then
-        let
-          paths = [ pkgs.gtk2 pkgs.gtk3 ] ++ config.gtkPlugins;
-          env = pkgs.buildEnv {
-            name = "gtk-exe-env";
-
-            inherit paths;
-
-            postBuild = lib.concatStringsSep "\n"
-              (map (d: d.gtkExeEnvPostBuild or "") paths);
-
-            ignoreCollisions = true;
-          };
-        in {
-          GTK_EXE_PREFIX = builtins.toString env;
-          GTK_PATH = [
-            "${env}/lib/gtk-2.0"
-            "${env}/lib/gtk-3.0"
-          ];
-        }
-      else {};
-  };
-}

nixos/modules/config/i18n.nix

@@ -52,6 +52,15 @@ in
         '';
       };
 
+      consoleUseXkbConfig = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          If set, configure the console keymap from the xserver keyboard
+          settings.
+        '';
+      };
+
       consoleKeyMap = mkOption {
         type = mkOptionType {
           name = "string or path";
@@ -65,6 +74,23 @@ in
         '';
       };
 
+      consoleColors = mkOption {
+        type = types.listOf types.str;
+        default = [];
+        example = [
+          "002b36" "dc322f" "859900" "b58900"
+          "268bd2" "d33682" "2aa198" "eee8d5"
+          "002b36" "cb4b16" "586e75" "657b83"
+          "839496" "6c71c4" "93a1a1" "fdf6e3"
+        ];
+        description = ''
+          The 16 colors palette used by the virtual consoles.
+          Leave empty to use the default colors.
+          Colors must be in hexadecimal format and listed in
+          order from color 0 to color 15.
+        '';
+      };
+
     };
 
   };
@@ -74,6 +100,13 @@ in
 
   config = {
 
+    i18n.consoleKeyMap = with config.services.xserver;
+      mkIf config.i18n.consoleUseXkbConfig
+        (pkgs.runCommand "xkb-console-keymap" { preferLocalBuild = true; } ''
+          '${pkgs.ckbcomp}/bin/ckbcomp' -model '${xkbModel}' -layout '${layout}' \
+            -option '${xkbOptions}' -variant '${xkbVariant}' > "$out"
+        '');
+
     environment.systemPackages =
       optional (config.i18n.supportedLocales != []) glibcLocales;
 

nixos/modules/config/ldap.nix

@@ -57,6 +57,7 @@ in
     users.ldap = {
 
       enable = mkOption {
+        type = types.bool;
         default = false;
         description = "Whether to enable authentication against an LDAP server.";
       };
@@ -108,7 +109,7 @@ in
 
         extraConfig = mkOption {
           default =  "";
-          type = types.string;
+          type = types.lines;
           description = ''
             Extra configuration options that will be added verbatim at
             the end of the nslcd configuration file (nslcd.conf).
@@ -120,7 +121,7 @@ in
         distinguishedName = mkOption {
           default = "";
           example = "cn=admin,dc=example,dc=com";
-          type = types.string;
+          type = types.str;
           description = ''
             The distinguished name to bind to the LDAP server with. If this
             is not specified, an anonymous bind will be done.
@@ -129,7 +130,7 @@ in
 
         password = mkOption {
           default = "/etc/ldap/bind.password";
-          type = types.string;
+          type = types.str;
           description = ''
             The path to a file containing the credentials to use when binding
             to the LDAP server (if not binding anonymously).
@@ -149,7 +150,7 @@ in
 
         policy = mkOption {
           default = "hard_open";
-          type = types.string;
+          type = types.enum [ "hard_open" "hard_init" "soft" ];
           description = ''
             Specifies the policy to use for reconnecting to an unavailable
             LDAP server. The default is <literal>hard_open</literal>, which
@@ -168,7 +169,7 @@ in
 
       extraConfig = mkOption {
         default = "";
-        type = types.string;
+        type = types.lines;
         description = ''
           Extra configuration options that will be added verbatim at
           the end of the ldap configuration file (ldap.conf).

nixos/modules/config/networking.nix

@@ -39,6 +39,27 @@ in
       '';
     };
 
+    networking.dnsExtensionMechanism = lib.mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Enable the <code>edns0</code> option in <filename>resolv.conf</filename>. With
+        that option set, <code>glibc</code> supports use of the extension mechanisms for
+        DNS (EDNS) specified in RFC 2671. The most popular user of that feature is DNSSEC,
+        which does not work without it.
+      '';
+    };
+
+    networking.extraResolvconfConf = lib.mkOption {
+      type = types.lines;
+      default = "";
+      example = "libc=NO";
+      description = ''
+        Extra configuration to append to <filename>resolvconf.conf</filename>.
+      '';
+    };
+
+
     networking.proxy = {
 
       default = lib.mkOption {
@@ -86,6 +107,15 @@ in
         example = "http://127.0.0.1:3128";
       };
 
+      allProxy = lib.mkOption {
+        type = types.nullOr types.str;
+        default = cfg.proxy.default;
+        description = ''
+          This option specifies the all_proxy environment variable.
+        '';
+        example = "http://127.0.0.1:3128";
+      };
+
       noProxy = lib.mkOption {
         type = types.nullOr types.str;
         default = null;
@@ -143,13 +173,17 @@ in
               libc_restart='${pkgs.systemd}/bin/systemctl try-restart --no-block nscd.service 2> /dev/null'
             '' + optionalString cfg.dnsSingleRequest ''
               # only send one DNS request at a time
-              resolv_conf_options='single-request'
+              resolv_conf_options+=' single-request'
+            '' + optionalString cfg.dnsExtensionMechanism ''
+              # enable extension mechanisms for DNS
+              resolv_conf_options+=' edns0'
             '' + optionalString hasLocalResolver ''
               # This hosts runs a full-blown DNS resolver.
               name_servers='127.0.0.1'
             '' + optionalString dnsmasqResolve ''
               dnsmasq_conf=/etc/dnsmasq-conf.conf
               dnsmasq_resolv=/etc/dnsmasq-resolv.conf
+            '' + cfg.extraResolvconfConf + ''
             '';
 
       } // (optionalAttrs config.services.resolved.enable (
@@ -172,6 +206,8 @@ in
           rsync_proxy = cfg.proxy.rsyncProxy;
         } // optionalAttrs (cfg.proxy.ftpProxy != null) {
           ftp_proxy   = cfg.proxy.ftpProxy;
+        } // optionalAttrs (cfg.proxy.allProxy != null) {
+          all_proxy   = cfg.proxy.allProxy;
         } // optionalAttrs (cfg.proxy.noProxy != null) {
           no_proxy    = cfg.proxy.noProxy;
         };

nixos/modules/config/power-management.nix

@@ -71,7 +71,6 @@ in
 
     # FIXME: Implement powersave governor for sandy bridge or later Intel CPUs
     powerManagement.cpuFreqGovernor = mkDefault "ondemand";
-    powerManagement.scsiLinkPolicy = mkDefault "min_power";
 
     systemd.targets.post-resume = {
       description = "Post-Resume Actions";
@@ -98,6 +97,7 @@ in
         after = [ "suspend.target" "hibernate.target" "hybrid-sleep.target" ];
         script =
           ''
+            ${config.systemd.package}/bin/systemctl try-restart post-resume.target
             ${cfg.resumeCommands}
             ${cfg.powerUpCommands}
           '';

nixos/modules/config/pulseaudio.nix

@@ -99,6 +99,7 @@ in {
       package = mkOption {
         type = types.package;
         default = pulseaudioLight;
+        defaultText = "pkgs.pulseaudioLight";
         example = literalExample "pkgs.pulseaudioFull";
         description = ''
           The PulseAudio derivation to use.  This can be used to enable

nixos/modules/config/qt-plugin-env.nix

@@ -1,37 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-{
-  imports = [
-  ];
-
-  options = {
-    qtPlugins = lib.mkOption {
-      type = lib.types.listOf lib.types.path;
-      default = [];
-      description = ''
-        Plugin packages for Qt such as input methods.
-      '';
-    };
-  };
-
-  config = {
-    environment.variables = if builtins.length config.qtPlugins > 0
-      then
-        let
-          paths = [ pkgs.qt48 ] ++ config.qtPlugins;
-          env = pkgs.buildEnv {
-            name = "qt-plugin-env";
-
-            inherit paths;
-
-            postBuild = lib.concatStringsSep "\n"
-              (map (d: d.qtPluginEnvPostBuild or "") paths);
-
-            ignoreCollisions = true;
-          };
-        in {
-          QT_PLUGIN_PATH = [ (builtins.toString env) ];
-        }
-      else {};
-  };
-}

nixos/modules/config/shells-environment.nix

@@ -41,20 +41,7 @@ in
         strings.  The latter is concatenated, interspersed with colon
         characters.
       '';
-      type = types.attrsOf (mkOptionType {
-        name = "a string or a list of strings";
-        merge = loc: defs:
-          let
-            defs' = filterOverrides defs;
-            res = (head defs').value;
-          in
-          if isList res then concatLists (getValues defs')
-          else if lessThan 1 (length defs') then
-            throw "The option `${showOption loc}' is defined multiple times, in ${showFiles (getFiles defs)}."
-          else if !isString res then
-            throw "The option `${showOption loc}' does not have a string value, in ${showFiles (getFiles defs)}."
-          else res;
-      });
+      type = types.attrsOf (types.loeOf types.str);
       apply = mapAttrs (n: v: if isList v then concatStringsSep ":" v else v);
     };
 
@@ -132,6 +119,7 @@ in
 
     environment.binsh = mkOption {
       default = "${config.system.build.binsh}/bin/sh";
+      defaultText = "\${config.system.build.binsh}/bin/sh";
       example = literalExample ''
         "''${pkgs.dash}/bin/dash"
       '';

nixos/modules/config/swap.nix

@@ -3,6 +3,84 @@
 with utils;
 with lib;
 
+let
+
+  swapCfg = {config, options, ...}: {
+
+    options = {
+
+      device = mkOption {
+        example = "/dev/sda3";
+        type = types.str;
+        description = "Path of the device.";
+      };
+
+      label = mkOption {
+        example = "swap";
+        type = types.str;
+        description = ''
+          Label of the device.  Can be used instead of <varname>device</varname>.
+        '';
+      };
+
+      size = mkOption {
+        default = null;
+        example = 2048;
+        type = types.nullOr types.int;
+        description = ''
+          If this option is set, ‘device’ is interpreted as the
+          path of a swapfile that will be created automatically
+          with the indicated size (in megabytes) if it doesn't
+          exist.
+        '';
+      };
+
+      priority = mkOption {
+        default = null;
+        example = 2048;
+        type = types.nullOr types.int;
+        description = ''
+          Specify the priority of the swap device. Priority is a value between 0 and 32767.
+          Higher numbers indicate higher priority.
+          null lets the kernel choose a priority, which will show up as a negative value.
+        '';
+      };
+
+      randomEncryption = mkOption {
+        default = false;
+        type = types.bool;
+        description = ''
+          Encrypt swap device with a random key. This way you won't have a persistent swap device.
+
+          WARNING: Don't try to hibernate when you have at least one swap partition with
+          this option enabled! We have no way to set the partition into which hibernation image
+          is saved, so if your image ends up on an encrypted one you would lose it!
+        '';
+      };
+
+      deviceName = mkOption {
+        type = types.str;
+        internal = true;
+      };
+
+      realDevice = mkOption {
+        type = types.path;
+        internal = true;
+      };
+
+    };
+
+    config = rec {
+      device = mkIf options.label.isDefined
+        "/dev/disk/by-label/${config.label}";
+      deviceName = escapeSystemdPath config.device;
+      realDevice = if config.randomEncryption then "/dev/mapper/${deviceName}" else config.device;
+    };
+
+  };
+
+in
+
 {
 
   ###### interface
@@ -26,58 +104,7 @@ with lib;
         recommended.
       '';
 
-      type = types.listOf types.optionSet;
-
-      options = {config, options, ...}: {
-
-        options = {
-
-          device = mkOption {
-            example = "/dev/sda3";
-            type = types.str;
-            description = "Path of the device.";
-          };
-
-          label = mkOption {
-            example = "swap";
-            type = types.str;
-            description = ''
-              Label of the device.  Can be used instead of <varname>device</varname>.
-            '';
-          };
-
-          size = mkOption {
-            default = null;
-            example = 2048;
-            type = types.nullOr types.int;
-            description = ''
-              If this option is set, ‘device’ is interpreted as the
-              path of a swapfile that will be created automatically
-              with the indicated size (in megabytes) if it doesn't
-              exist.
-            '';
-          };
-
-          priority = mkOption {
-            default = null;
-            example = 2048;
-            type = types.nullOr types.int;
-            description = ''
-              Specify the priority of the swap device. Priority is a value between 0 and 32767.
-              Higher numbers indicate higher priority.
-              null lets the kernel choose a priority, which will show up as a negative value.
-            '';
-          };
-
-        };
-
-        config = {
-          device = mkIf options.label.isDefined
-            "/dev/disk/by-label/${config.label}";
-        };
-
-      };
-
+      type = types.listOf (types.submodule swapCfg);
     };
 
   };
@@ -95,27 +122,40 @@ with lib;
 
         createSwapDevice = sw:
           assert sw.device != "";
-          let device' = escapeSystemdPath sw.device; in
-          nameValuePair "mkswap-${escapeSystemdPath sw.device}"
-          { description = "Initialisation of Swapfile ${sw.device}";
-            wantedBy = [ "${device'}.swap" ];
-            before = [ "${device'}.swap" ];
-            path = [ pkgs.utillinux ];
+          let realDevice' = escapeSystemdPath sw.realDevice;
+          in nameValuePair "mkswap-${sw.deviceName}"
+          { description = "Initialisation of swap device ${sw.device}";
+            wantedBy = [ "${realDevice'}.swap" ];
+            before = [ "${realDevice'}.swap" ];
+            path = [ pkgs.utillinux ] ++ optional sw.randomEncryption pkgs.cryptsetup;
+
             script =
               ''
-                if [ ! -e "${sw.device}" ]; then
-                  fallocate -l ${toString sw.size}M "${sw.device}" ||
-                    dd if=/dev/zero of="${sw.device}" bs=1M count=${toString sw.size}
-                  chmod 0600 ${sw.device}
-                  mkswap ${sw.device}
-                fi
+                ${optionalString (sw.size != null) ''
+                  if [ ! -e "${sw.device}" ]; then
+                    fallocate -l ${toString sw.size}M "${sw.device}" ||
+                      dd if=/dev/zero of="${sw.device}" bs=1M count=${toString sw.size}
+                    chmod 0600 ${sw.device}
+                    ${optionalString (!sw.randomEncryption) "mkswap ${sw.realDevice}"}
+                  fi
+                ''}
+                ${optionalString sw.randomEncryption ''
+                  echo "secretkey" | cryptsetup luksFormat --batch-mode ${sw.device}
+                  echo "secretkey" | cryptsetup luksOpen ${sw.device} ${sw.deviceName}
+                  cryptsetup luksErase --batch-mode ${sw.device}
+                  mkswap ${sw.realDevice}
+                ''}
               '';
+
             unitConfig.RequiresMountsFor = [ "${dirOf sw.device}" ];
             unitConfig.DefaultDependencies = false; # needed to prevent a cycle
             serviceConfig.Type = "oneshot";
+            serviceConfig.RemainAfterExit = sw.randomEncryption;
+            serviceConfig.ExecStop = optionalString sw.randomEncryption "${pkgs.cryptsetup}/bin/cryptsetup luksClose ${sw.deviceName}";
+            restartIfChanged = false;
           };
 
-      in listToAttrs (map createSwapDevice (filter (sw: sw.size != null) config.swapDevices));
+      in listToAttrs (map createSwapDevice (filter (sw: sw.size != null || sw.randomEncryption) config.swapDevices));
 
   };
 

nixos/modules/config/sysctl.nix

@@ -22,10 +22,9 @@ in
 
     boot.kernel.sysctl = mkOption {
       default = {};
-      example = {
-        "net.ipv4.tcp_syncookies" = false;
-        "vm.swappiness" = 60;
-      };
+      example = literalExample ''
+        { "net.ipv4.tcp_syncookies" = false; "vm.swappiness" = 60; }
+      '';
       type = types.attrsOf sysctlOption;
       description = ''
         Runtime parameters of the Linux kernel, as set by

nixos/modules/config/system-environment.nix

@@ -23,20 +23,7 @@ in
         strings.  The latter is concatenated, interspersed with colon
         characters.
       '';
-      type = types.attrsOf (mkOptionType {
-        name = "a string or a list of strings";
-        merge = loc: defs:
-          let
-            defs' = filterOverrides defs;
-            res = (head defs').value;
-          in
-          if isList res then concatLists (getValues defs')
-          else if lessThan 1 (length defs') then
-            throw "The option `${showOption loc}' is defined multiple times, in ${showFiles (getFiles defs)}."
-          else if !isString res then
-            throw "The option `${showOption loc}' does not have a string value, in ${showFiles (getFiles defs)}."
-          else res;
-      });
+      type = types.attrsOf (types.loeOf types.str);
       apply = mapAttrs (n: v: if isList v then concatStringsSep ":" v else v);
     };
 

nixos/modules/config/system-path.nix

@@ -7,12 +7,6 @@ with lib;
 
 let
 
-  extraManpages = pkgs.runCommand "extra-manpages" { buildInputs = [ pkgs.help2man ]; }
-    ''
-      mkdir -p $out/share/man/man1
-      help2man ${pkgs.gnutar}/bin/tar > $out/share/man/man1/tar.1
-    '';
-
   requiredPackages =
     [ config.nix.package
       pkgs.acl
@@ -46,7 +40,6 @@ let
       pkgs.time
       pkgs.texinfoInteractive
       pkgs.utillinux
-      extraManpages
     ];
 
 in
@@ -135,7 +128,7 @@ in
       # !!! Hacky, should modularise.
       postBuild =
         ''
-          if [ -x $out/bin/update-mime-database -a -w $out/share/mime/packages ]; then
+          if [ -x $out/bin/update-mime-database -a -w $out/share/mime ]; then
               XDG_DATA_DIRS=$out/share $out/bin/update-mime-database -V $out/share/mime > /dev/null
           fi
 

nixos/modules/config/unix-odbc-drivers.nix

@@ -10,8 +10,9 @@ with lib;
 
   options = {
     environment.unixODBCDrivers = mkOption {
+      type = types.listOf types.package;
       default = [];
-      example = literalExample "map (x : x.ini) (with pkgs.unixODBCDrivers; [ mysql psql psqlng ] )";
+      example = literalExample "with pkgs.unixODBCDrivers; [ mysql psql psqlng ]";
       description = ''
         Specifies Unix ODBC drivers to be registered in
         <filename>/etc/odbcinst.ini</filename>.  You may also want to
@@ -26,7 +27,7 @@ with lib;
   config = mkIf (config.environment.unixODBCDrivers != []) {
 
     environment.etc."odbcinst.ini".text =
-      let inis = config.environment.unixODBCDrivers;
+      let inis = map (x : x.ini) config.environment.unixODBCDrivers;
       in lib.concatStringsSep "\n" inis;
 
   };