Merge branch 'master' into patch-3

2017-07-25 22:17:41 -04:00
parent 318189f26f 90acbe5449
commit 3ffcbdd0f0
4540 changed files with 168710 additions and 122404 deletions
@@ -15,7 +15,7 @@ under the terms of [COPYING](../COPYING), which is an MIT-like license.
 * Format the commits in the following way:
  ```
-  (pkg-name | service-name): (from -> to | init at version | refactor | etc)
+  (pkg-name | nixos/<module>): (from -> to | init at version | refactor | etc)
  (Motivation for change. Additional information.)
  ```
@@ -24,10 +24,10 @@ under the terms of [COPYING](../COPYING), which is an MIT-like license.
  * nginx: init at 2.0.1
  * firefox: 3.0 -> 3.1.1
-  * hydra service: add bazBaz option
+  * nixos/hydra: add bazBaz option
    Dual baz behavior is needed to do foo.
-  * nginx service: refactor config generation
+  * nixos/nginx: refactor config generation
    The old config generation system used impure shell scripts and could break in specific circumstances (see #1234).
@@ -11,3 +11,4 @@
 * System: (NixOS: `nixos-version`, Ubuntu/Fedora: `lsb_release -a`, ...)
 * Nix version: (run `nix-env --version`)
 * Nixpkgs version: (run `nix-instantiate --eval '<nixpkgs>' -A lib.nixpkgsVersion`)
 * Sandboxing enabled: (run `grep build-use-sandbox /etc/nix/nix.conf`)
@@ -3,6 +3,8 @@
 ###### Things done
 Please check what applies. Note that these are not hard requirements but mereley serve as information for reviewers.
 - [ ] Tested using sandboxing
  ([nix.useSandbox](http://nixos.org/nixos/manual/options.html#opt-nix.useSandbox) on NixOS,
    or option `build-use-sandbox` in [`nix.conf`](http://nixos.org/nix/manual/#sec-conf-file)
@@ -11,6 +13,7 @@
   - [ ] NixOS
   - [ ] macOS
   - [ ] Linux
 - [ ] Tested via one or more NixOS test(s) if existing and applicable for the change (look inside [nixos/tests](https://github.com/NixOS/nixpkgs/blob/master/nixos/tests))
 - [ ] Tested compilation of all pkgs that depend on this change using `nix-shell -p nox --run "nox-review wip"`
 - [ ] Tested execution of all binary files (usually in `./result/bin/`)
 - [ ] Fits [CONTRIBUTING.md](https://github.com/NixOS/nixpkgs/blob/master/.github/CONTRIBUTING.md).
@@ -2,7 +2,8 @@
  "userBlacklist": [
    "civodul",
    "jhasse",
-    "shlevy"
+    "shlevy",
    "bbenoist"
  ],
  "alwaysNotifyForPaths": [
    { "name": "FRidh", "files": ["pkgs/top-level/python-packages.nix", "pkgs/development/interpreters/python/*", "pkgs/development/python-modules/*" ] },
@@ -1,8 +1,14 @@
 language: nix
 sudo: true
 # 'sudo: false' == containers that start fast, but only get 4G ram;
 # 'sudo: true'  == VMs that start slow, but with 8G
 # ..as per:  https://docs.travis-ci.com/user/ci-environment/#Virtualization-environments
 # Nixpkgs PR tests OOM with 4G: https://github.com/NixOS/nixpkgs/issues/24200
 matrix:
    include:
        - os: linux
-          sudo: false
+          sudo: required
          script:
              - ./maintainers/scripts/travis-nox-review-pr.sh nixpkgs-verify nixpkgs-manual nixpkgs-tarball nixpkgs-unstable
              - ./maintainers/scripts/travis-nox-review-pr.sh nixos-options nixos-manual
@@ -18,3 +24,6 @@ matrix:
 env:
    global:
        - GITHUB_TOKEN=5edaaf1017f691ed34e7f80878f8f5fbd071603f
 notifications:
    email: false
@@ -13,12 +13,12 @@ build daemon as so-called channels. To get channel information via git, add
 ```
 For stability and maximum binary package support, it is recommended to maintain
-custom changes on top of one of the channels, e.g. `nixos-16.09` for the latest
+custom changes on top of one of the channels, e.g. `nixos-17.03` for the latest
 release and `nixos-unstable` for the latest successful build of master:
 ```
 % git remote update channels
-% git rebase channels/nixos-16.09
+% git rebase channels/nixos-17.03
 ```
 For pull-requests, please rebase onto nixpkgs `master`.
@@ -32,11 +32,11 @@ For pull-requests, please rebase onto nixpkgs `master`.
 * [Manual (NixOS)](https://nixos.org/nixos/manual/)
 * [Nix Wiki](https://nixos.org/wiki/) (deprecated, see milestone ["Move the Wiki!"](https://github.com/NixOS/nixpkgs/issues?q=is%3Aopen+is%3Aissue+milestone%3A%22Move+the+wiki%21%22))
 * [Continuous package builds for unstable/master](https://hydra.nixos.org/jobset/nixos/trunk-combined)
-* [Continuous package builds for 16.09 release](https://hydra.nixos.org/jobset/nixos/release-16.09)
+* [Continuous package builds for 17.03 release](https://hydra.nixos.org/jobset/nixos/release-17.03)
 * [Tests for unstable/master](https://hydra.nixos.org/job/nixos/trunk-combined/tested#tabs-constituents)
-* [Tests for 16.09 release](https://hydra.nixos.org/job/nixos/release-16.09/tested#tabs-constituents)
+* [Tests for 17.03 release](https://hydra.nixos.org/job/nixos/release-17.03/tested#tabs-constituents)
 Communication:
-* [Mailing list](http://lists.science.uu.nl/mailman/listinfo/nix-dev)
+* [Mailing list](https://groups.google.com/forum/#!forum/nix-devel)
 * [IRC - #nixos on freenode.net](irc://irc.freenode.net/#nixos)
@@ -2,7 +2,17 @@ let requiredVersion = import ./lib/minver.nix; in
 if ! builtins ? nixVersion || builtins.compareVersions requiredVersion builtins.nixVersion == 1 then
-  abort "This version of Nixpkgs requires Nix >= ${requiredVersion}, please upgrade! See https://nixos.org/wiki/How_to_update_when_Nix_is_too_old_to_evaluate_Nixpkgs"
+  abort ''
    This version of Nixpkgs requires Nix >= ${requiredVersion}, please upgrade:
    - If you are running NixOS, use `nixos-rebuild' to upgrade your system.
    - If you installed Nix using the install script (https://nixos.org/nix/install),
      it is safe to upgrade by running it again:
          curl https://nixos.org/nix/install | sh
  ''
 else
@@ -227,7 +227,7 @@ packages via <literal>packageOverrides</literal></title>
 <para>You can define a function called
 <varname>packageOverrides</varname> in your local
-<filename>~/.config/nixpkgs/config.nix</filename> to overide nix packages.  It
+<filename>~/.config/nixpkgs/config.nix</filename> to override nix packages.  It
 must be a function that takes pkgs as an argument and return modified
 set of packages.
@@ -243,5 +243,218 @@ set of packages.
 </section>
 <section xml:id="sec-declarative-package-management">
  <title>Declarative Package Management</title>
  <section xml:id="sec-building-environment">
    <title>Build an environment</title>
    <para>
      Using <literal>packageOverrides</literal>, it is possible to manage
      packages declaratively. This means that we can list all of our desired
      packages within a declarative Nix expression. For example, to have
      <literal>aspell</literal>, <literal>bc</literal>,
      <literal>ffmpeg</literal>, <literal>coreutils</literal>,
      <literal>gdb</literal>, <literal>nixUnstable</literal>,
      <literal>emscripten</literal>, <literal>jq</literal>,
      <literal>nox</literal>, and <literal>silver-searcher</literal>, we could
      use the following in <filename>~/.config/nixpkgs/config.nix</filename>:
    </para>
    <screen>
 {
  packageOverrides = pkgs: with pkgs; {
    myPackages = pkgs.buildEnv {
      name = "my-packages";
      paths = [ aspell bc coreutils gdb ffmpeg nixUnstable emscripten jq nox silver-searcher ];
    };
  };
 }
    </screen>
    <para>
      To install it into our environment, you can just run <literal>nix-env -iA
      nixpkgs.myPackages</literal>. If you want to load the packages to be built
      from a working copy of <literal>nixpkgs</literal> you just run
      <literal>nix-env -f. -iA myPackages</literal>. To explore what's been
      installed, just look through <filename>~/.nix-profile/</filename>. You can
      see that a lot of stuff has been installed. Some of this stuff is useful
      some of it isn't. Let's tell Nixpkgs to only link the stuff that we want:
    </para>
    <screen>
 {
  packageOverrides = pkgs: with pkgs; {
    myPackages = pkgs.buildEnv {
      name = "my-packages";
      paths = [ aspell bc coreutils gdb ffmpeg nixUnstable emscripten jq nox silver-searcher ];
      pathsToLink = [ "/share" "/bin" ];
    };
  };
 }
    </screen>
    <para>
      <literal>pathsToLink</literal> tells Nixpkgs to only link the paths listed
      which gets rid of the extra stuff in the profile.
      <filename>/bin</filename> and <filename>/share</filename> are good
      defaults for a user environment, getting rid of the clutter. If you are
      running on Nix on MacOS, you may want to add another path as well,
      <filename>/Applications</filename>, that makes GUI apps available.
    </para>
  </section>
  <section xml:id="sec-getting-documentation">
    <title>Getting documentation</title>
    <para>
      After building that new environment, look through
      <filename>~/.nix-profile</filename> to make sure everything is there that
      we wanted. Discerning readers will note that some files are missing. Look
      inside <filename>~/.nix-profile/share/man/man1/</filename> to verify this.
      There are no man pages for any of the Nix tools! This is because some
      packages like Nix have multiple outputs for things like documentation (see
      section 4). Let's make Nix install those as well.
    </para>
    <screen>
 {
  packageOverrides = pkgs: with pkgs; {
    myPackages = pkgs.buildEnv {
      name = "my-packages";
      paths = [ aspell bc coreutils ffmpeg nixUnstable emscripten jq nox silver-searcher ];
      pathsToLink = [ "/share/man" "/share/doc" /bin" ];
      extraOutputsToInstall = [ "man" "doc" ];
    };
  };
 }
    </screen>
    <para>
      This provides us with some useful documentation for using our packages.
      However, if we actually want those manpages to be detected by man, we need
      to set up our environment. This can also be managed within Nix
      expressions.
    </para>
    <screen>
 {
  packageOverrides = pkgs: with pkgs; rec {
    myProfile = writeText "my-profile" ''
 export PATH=$HOME/.nix-profile/bin:/nix/var/nix/profiles/default/bin:/sbin:/bin:/usr/sbin:/usr/bin
 export MANPATH=$HOME/.nix-profile/share/man:/nix/var/nix/profiles/default/share/man:/usr/share/man
    '';
    myPackages = pkgs.buildEnv {
      name = "my-packages";
      paths = [
        (runCommand "profile" {} ''
 mkdir -p $out/etc/profile.d
 cp ${myProfile} $out/etc/profile.d/my-profile.sh
        '')
        aspell
        bc
        coreutils
        ffmpeg
        man
        nixUnstable
        emscripten
        jq
        nox
        silver-searcher
      ];
      pathsToLink = [ "/share/man" "/share/doc" /bin" "/etc" ];
      extraOutputsToInstall = [ "man" "doc" ];
    };
  };
 }
    </screen>
    <para>
      For this to work fully, you must also have this script sourced when you
      are logged in. Try adding something like this to your
      <filename>~/.profile</filename> file:
    </para>
    <screen>
 #!/bin/sh
 if [ -d $HOME/.nix-profile/etc/profile.d ]; then
  for i in $HOME/.nix-profile/etc/profile.d/*.sh; do
    if [ -r $i ]; then
      . $i
    fi
  done
 fi
    </screen>
    <para>
      Now just run <literal>source $HOME/.profile</literal> and you can starting
      loading man pages from your environent.
    </para>
  </section>
  <section xml:id="sec-gnu-info-setup">
    <title>GNU info setup</title>
    <para>
      Configuring GNU info is a little bit trickier than man pages. To work
      correctly, info needs a database to be generated. This can be done with
      some small modifications to our environment scripts.
    </para>
    <screen>
 {
  packageOverrides = pkgs: with pkgs; rec {
    myProfile = writeText "my-profile" ''
 export PATH=$HOME/.nix-profile/bin:/nix/var/nix/profiles/default/bin:/sbin:/bin:/usr/sbin:/usr/bin
 export MANPATH=$HOME/.nix-profile/share/man:/nix/var/nix/profiles/default/share/man:/usr/share/man
 export INFOPATH=$HOME/.nix-profile/share/info:/nix/var/nix/profiles/default/share/info:/usr/share/info
    '';
    myPackages = pkgs.buildEnv {
      name = "my-packages";
      paths = [
        (runCommand "profile" {} ''
 mkdir -p $out/etc/profile.d
 cp ${myProfile} $out/etc/profile.d/my-profile.sh
        '')
        aspell
        bc
        coreutils
        ffmpeg
        man
        nixUnstable
        emscripten
        jq
        nox
        silver-searcher
        texinfoInteractive
      ];
      pathsToLink = [ "/share/man" "/share/doc" "/share/info" "/bin" "/etc" ];
      extraOutputsToInstall = [ "man" "doc" "info" ];
      postBuild = ''
          if [ -x $out/bin/install-info -a -w $out/share/info ]; then
            shopt -s nullglob
            for i in $out/share/info/*.info $out/share/info/*.info.gz; do
                $out/bin/install-info $i $out/share/info/dir
            done
          fi
      '';
    };
  };
 }
    </screen>
    <para>
      <literal>postBuild</literal> tells Nixpkgs to run a command after building
      the environment. In this case, <literal>install-info</literal> adds the
      installed info pages to <literal>dir</literal> which is GNU info's default
      root node. Note that <literal>texinfoInteractive</literal> is added to the
      environment to give the <literal>install-info</literal> command.
    </para>
  </section>
 </section>
 </chapter>
@@ -30,23 +30,17 @@
  <section>
    <title>Platform parameters</title>
    <para>
-      The three GNU Autoconf platforms, <wordasword>build</wordasword>, <wordasword>host</wordasword>, and <wordasword>cross</wordasword>, are historically the result of much confusion.
+      The three GNU Autoconf platforms, <wordasword>build</wordasword>, <wordasword>host</wordasword>, and <wordasword>target</wordasword>, are historically the result of much confusion.
      <link xlink:href="https://gcc.gnu.org/onlinedocs/gccint/Configure-Terms.html" /> clears this up somewhat but there is more to be said.
      An important advice to get out the way is, unless you are packaging a compiler or other build tool, just worry about the build and host platforms.
      Dealing with just two platforms usually better matches people's preconceptions, and in this case is completely correct.
    </para>
    <para>
      In Nixpkgs, these three platforms are defined as attribute sets under the names <literal>buildPlatform</literal>, <literal>hostPlatform</literal>, and <literal>targetPlatform</literal>.
-      All are guaranteed to contain at least a <varname>platform</varname> field, which contains detailed information on the platform.
+      All three are always defined as attributes in the standard environment, and at the top level. That means one can get at them just like a dependency in a function that is imported with <literal>callPackage</literal>:
-      All three are always defined at the top level, so one can get at them just like a dependency in a function that is imported with <literal>callPackage</literal>:
+      <programlisting>{ stdenv, buildPlatform, hostPlatform, fooDep, barDep, .. }: ...buildPlatform...</programlisting>, or just off <varname>stdenv</varname>:
-      <programlisting>{ stdenv, buildPlatform, hostPlatform, fooDep, barDep, .. }: ...</programlisting>
+      <programlisting>{ stdenv, fooDep, barDep, .. }: ...stdenv.buildPlatform...</programlisting>.
    </para>
    <warning><para>
      These platforms should all have the same structure in all scenarios, but that is currently not the case.
      When not cross-compiling, they will each contain a <literal>system</literal> field with a short 2-part, hyphen-separated summering string name for the platform.
      But, when when cross compiling, <literal>hostPlatform</literal> and <literal>targetPlatform</literal> may instead contain <literal>config</literal> with a fuller 3- or 4-part string in the manner of LLVM.
      We should have all 3 platforms always contain both, and maybe give <literal>config</literal> a better name while we are at it.
    </para></warning>
    <variablelist>
      <varlistentry>
        <term><varname>buildPlatform</varname></term>
@@ -69,8 +63,8 @@
            The "target platform" is black sheep.
            The other two intrinsically apply to all compiled software—or any build process with a notion of "build-time" followed by "run-time".
            The target platform only applies to programming tools, and even then only is a good for for some of them.
-            Briefly, GCC, Binutils, GHC, and certain other tools are written in such a way such that a single build can only compiler code for a single platform.
+            Briefly, GCC, Binutils, GHC, and certain other tools are written in such a way such that a single build can only compile code for a single platform.
-            Thus, when building them, one must think ahead about what platforms they wish to use the tool to produce machine code for, and build binaries for each.
+            Thus, when building them, one must think ahead about which platforms they wish to use the tool to produce machine code for, and build binaries for each.
          </para>
          <para>
            There is no fundamental need to think about the target ahead of time like this.
@@ -83,14 +77,79 @@
            Nixpkgs tries to avoid this where possible too, but still, because the concept of a target platform is so ingrained now in Autoconf and other tools, it is best to support it as is.
            Tools like LLVM that don't need up-front target platforms can safely ignore it like normal packages, and it will do no harm.
          </para>
-          </listitem>
+        </listitem>
      </varlistentry>
    </variablelist>
    <para>
      The exact schema these fields follow is a bit ill-defined due to a long and convoluted evolution, but this is slowly being cleaned up.
      You can see examples of ones used in practice in <literal>lib.systems.examples</literal>; note how they are not all very consistent.
      For now, here are few fields can count on them containing:
    </para>
    <variablelist>
      <varlistentry>
        <term><varname>system</varname></term>
        <listitem>
          <para>
            This is a two-component shorthand for the platform.
            Examples of this would be "x86_64-darwin" and "i686-linux"; see <literal>lib.systems.doubles</literal> for more.
            This format isn't very standard, but has built-in support in Nix, such as the <varname>builtins.currentSystem</varname> impure string.
          </para>
        </listitem>
      </varlistentry>
      <varlistentry>
        <term><varname>config</varname></term>
        <listitem>
          <para>
            This is a 3- or 4- component shorthand for the platform.
            Examples of this would be "x86_64-unknown-linux-gnu" and "aarch64-apple-darwin14".
            This is a standard format called the "LLVM target triple", as they are pioneered by LLVM and traditionally just used for the <varname>targetPlatform</varname>.
            This format is strictly more informative than the "Nix host double", as the previous format could analogously be termed.
            This needs a better name than <varname>config</varname>!
          </para>
        </listitem>
      </varlistentry>
      <varlistentry>
        <term><varname>parsed</varname></term>
        <listitem>
          <para>
            This is a nix representation of a parsed LLVM target triple with white-listed components.
            This can be specified directly, or actually parsed from the <varname>config</varname>.
            [Technically, only one need be specified and the others can be inferred, though the precision of inference may not be very good.]
            See <literal>lib.systems.parse</literal> for the exact representation.
          </para>
        </listitem>
      </varlistentry>
      <varlistentry>
        <term><varname>libc</varname></term>
        <listitem>
          <para>
            This is a string identifying the standard C library used.
            Valid identifiers include "glibc" for GNU libc, "libSystem" for Darwin's Libsystem, and "uclibc" for µClibc.
            It should probably be refactored to use the module system, like <varname>parse</varname>.
          </para>
        </listitem>
      </varlistentry>
      <varlistentry>
        <term><varname>is*</varname></term>
        <listitem>
          <para>
            These predicates are defined in <literal>lib.systems.inspect</literal>, and slapped on every platform.
            They are superior to the ones in <varname>stdenv</varname> as they force the user to be explicit about which platform they are inspecting.
            Please use these instead of those.
          </para>
        </listitem>
      </varlistentry>
      <varlistentry>
        <term><varname>platform</varname></term>
        <listitem>
          <para>
            This is, quite frankly, a dumping ground of ad-hoc settings (it's an attribute set).
            See <literal>lib.systems.platforms</literal> for examples—there's hopefully one in there that will work verbatim for each platform that is working.
            Please help us triage these flags and give them better homes!
          </para>
        </listitem>
      </varlistentry>
    </variablelist>
    <note><para>
      If you dig around nixpkgs, you may notice there is also <varname>stdenv.cross</varname>.
      This field defined as <varname>hostPlatform</varname> when the host and build platforms differ, but otherwise not defined at all.
      This field is obsolete and will soon disappear—please do not use it.
    </para></note>
  </section>
  <section>
@@ -115,15 +174,20 @@
      The depending package's target platform is unconstrained by the sliding window principle, which makes sense in that one can in principle build cross compilers targeting arbitrary platforms.
    </para></note>
    <para>
-      How does this work in practice? Nixpkgs is now structured so that build-time dependencies are taken from from <varname>buildPackages</varname>, whereas run-time dependencies are taken from the top level attribute set.
+      How does this work in practice? Nixpkgs is now structured so that build-time dependencies are taken from <varname>buildPackages</varname>, whereas run-time dependencies are taken from the top level attribute set.
      For example, <varname>buildPackages.gcc</varname> should be used at build time, while <varname>gcc</varname> should be used at run time.
      Now, for most of Nixpkgs's history, there was no <varname>buildPackages</varname>, and most packages have not been refactored to use it explicitly.
-      Instead, one can use the four attributes used for specifying dependencies as documented in <link linkend="ssec-stdenv-attributes" />.
+      Instead, one can use the four attributes used for specifying dependencies as documented in <xref linkend="ssec-stdenv-attributes"/>.
      We "splice" together the run-time and build-time package sets with <varname>callPackage</varname>, and then <varname>mkDerivation</varname> for each of four attributes pulls the right derivation out.
      This splicing can be skipped when not cross compiling as the package sets are the same, but is a bit slow for cross compiling.
      Because of this, a best-of-both-worlds solution is in the works with no splicing or explicit access of <varname>buildPackages</varname> needed.
      For now, feel free to use either method.
    </para>
    <note><para>
      There is also a "backlink" <varname>__targetPackages</varname>, yielding a package set whose <varname>buildPackages</varname> is the current package set.
      This is a hack, though, to accommodate compilers with lousy build systems.
      Please do not use this unless you are absolutely sure you are packaging such a compiler and there is no other way.
    </para></note>
  </section>
 </section>
@@ -136,11 +200,27 @@
    More information needs to moved from the old wiki, especially <link xlink:href="https://nixos.org/wiki/CrossCompiling" />, for this section.
  </para></note>
  <para>
-    Many sources (manual, wiki, etc) probably mention passing <varname>system</varname>, <varname>platform</varname>, and, optionally, <varname>crossSystem</varname> to nixpkgs:
+    Nixpkgs can be instantiated with <varname>localSystem</varname> alone, in which case there is no cross compiling and everything is built by and for that system,
-    <literal>import &lt;nixpkgs&gt; { system = ..; platform = ..; crossSystem = ..; }</literal>.
+    or also with <varname>crossSystem</varname>, in which case packages run on the latter, but all building happens on the former.
-    <varname>system</varname> and <varname>platform</varname> together determine the system on which packages are built, and <varname>crossSystem</varname> specifies the platform on which packages are ultimately intended to run, if it is different.
+    Both parameters take the same schema as the 3 (build, host, and target) platforms defined in the previous section.
-    This still works, but with more recent changes, one can alternatively pass <varname>localSystem</varname>, containing <varname>system</varname> and <varname>platform</varname>, for symmetry.
+    As mentioned above, <literal>lib.systems.examples</literal> has some platforms which are used as arguments for these parameters in practice.
    You can use them programmatically, or on the command line like <command>nix-build &lt;nixpkgs&gt; --arg crossSystem '(import &lt;nixpkgs/lib&gt;).systems.examples.fooBarBaz'</command>.
  </para>
  <para>
    While one is free to pass both parameters in full, there's a lot of logic to fill in missing fields.
    As discussed in the previous section, only one of <varname>system</varname>, <varname>config</varname>, and <varname>parsed</varname> is needed to infer the other two.
    Additionally, <varname>libc</varname> will be inferred from <varname>parse</varname>.
    Finally, <literal>localSystem.system</literal> is also <emphasis>impurely</emphasis> inferred based on the platform evaluation occurs.
    This means it is often not necessary to pass <varname>localSystem</varname> at all, as in the command-line example in the previous paragraph.
  </para>
  <note>
    <para>
      Many sources (manual, wiki, etc) probably mention passing <varname>system</varname>, <varname>platform</varname>, along with the optional <varname>crossSystem</varname> to nixpkgs:
      <literal>import &lt;nixpkgs&gt; { system = ..; platform = ..; crossSystem = ..; }</literal>.
      Passing those two instead of <varname>localSystem</varname> is still supported for compatibility, but is discouraged.
      Indeed, much of the inference we do for these parameters is motivated by compatibility as much as convenience.
    </para>
  </note>
  <para>
    One would think that <varname>localSystem</varname> and <varname>crossSystem</varname> overlap horribly with the three <varname>*Platforms</varname> (<varname>buildPlatform</varname>, <varname>hostPlatform,</varname> and <varname>targetPlatform</varname>; see <varname>stage.nix</varname> or the manual).
    Actually, those identifiers are purposefully not used here to draw a subtle but important distinction:
@@ -26,7 +26,7 @@ pkgs.stdenv.mkDerivation {
      extraHeader = ''xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" '';
    in ''
      {
-        pandoc '${inputFile}' -w docbook ${lib.optionalString useChapters "--chapters"} \
+        pandoc '${inputFile}' -w docbook ${lib.optionalString useChapters "--top-level-division=chapter"} \
          --smart \
          | sed -e 's|<ulink url=|<link xlink:href=|' \
              -e 's|</ulink>|</link>|' \
@@ -68,6 +68,10 @@ pkgs.stdenv.mkDerivation {
      inputFile = ../pkgs/development/r-modules/README.md;
      outputFile = "languages-frameworks/r.xml";
    }
  + toDocbook {
      inputFile = ./languages-frameworks/rust.md;
      outputFile = "./languages-frameworks/rust.xml";
    }
  + toDocbook {
      inputFile = ./languages-frameworks/vim.md;
      outputFile = "./languages-frameworks/vim.xml";
@@ -70,7 +70,7 @@
    <para>
      In the above example, the <varname>separateDebugInfo</varname> attribute is
-      overriden to be true, thus building debug info for
+      overridden to be true, thus building debug info for
      <varname>helloWithDebug</varname>, while all other attributes will be
      retained from the original <varname>hello</varname> package.
    </para>
@@ -529,7 +529,7 @@
  <note>
  <para>
  If you see errors similar to <literal>getProtocolByName: does not exist (no such protocol name: tcp)</literal>
-  you may need to add <literal>pkgs.iana_etc</literal> to <varname>contents</varname>.
+  you may need to add <literal>pkgs.iana-etc</literal> to <varname>contents</varname>.
  </para>
  </note>
@@ -2,60 +2,120 @@
         xmlns:xlink="http://www.w3.org/1999/xlink"
         xml:id="sec-beam">
-  <title>Beam Languages (Erlang &amp; Elixir)</title>
+  <title>BEAM Languages (Erlang, Elixir &amp; LFE)</title>
  <section xml:id="beam-introduction">
    <title>Introduction</title>
    <para>
-      In this document and related Nix expressions we use the term
+      In this document and related Nix expressions, we use the term,
-      <emphasis>Beam</emphasis> to describe the environment. Beam is
+      <emphasis>BEAM</emphasis>, to describe the environment. BEAM is the name
-      the name of the Erlang Virtial Machine and, as far as we know,
+      of the Erlang Virtual Machine and, as far as we're concerned, from a
-      from a packaging perspective all languages that run on Beam are
+      packaging perspective, all languages that run on the BEAM are
-      interchangable. The things that do change, like the build
+      interchangeable. That which varies, like the build system, is transparent
-      system, are transperant to the users of the package. So we make
+      to users of any given BEAM package, so we make no distinction.
      no distinction.
    </para>
  </section>
-<section xml:id="build-tools">
+  <section xml:id="beam-structure">
    <title>Structure</title>
    <para>
      All BEAM-related expressions are available via the top-level
      <literal>beam</literal> attribute, which includes:
    </para>
    <itemizedlist>
      <listitem>
        <para>
          <literal>interpreters</literal>: a set of compilers running on the
          BEAM, including multiple Erlang/OTP versions
          (<literal>beam.interpreters.erlangR19</literal>, etc), Elixir
          (<literal>beam.interpreters.elixir</literal>) and LFE
          (<literal>beam.interpreters.lfe</literal>).
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>packages</literal>: a set of package sets, each compiled with
          a specific Erlang/OTP version, e.g.
          <literal>beam.packages.erlangR19</literal>.
        </para>
      </listitem>
    </itemizedlist>
    <para>
      The default Erlang compiler, defined by
      <literal>beam.interpreters.erlang</literal>, is aliased as
      <literal>erlang</literal>. The default BEAM package set is defined by
      <literal>beam.packages.erlang</literal> and aliased at the top level as
      <literal>beamPackages</literal>.
    </para>
    <para>
      To create a package set built with a custom Erlang version, use the
      lambda, <literal>beam.packagesWith</literal>, which accepts an Erlang/OTP
      derivation and produces a package set similar to
      <literal>beam.packages.erlang</literal>.
    </para>
    <para>
      Many Erlang/OTP distributions available in
      <literal>beam.interpreters</literal> have versions with ODBC and/or Java
      enabled. For example, there's
      <literal>beam.interpreters.erlangR19_odbc_javac</literal>, which
      corresponds to <literal>beam.interpreters.erlangR19</literal>.
    </para>
    <para xml:id="erlang-call-package">
      We also provide the lambda,
      <literal>beam.packages.erlang.callPackage</literal>, which simplifies
      writing BEAM package definitions by injecting all packages from
      <literal>beam.packages.erlang</literal> into the top-level context.
    </para>
  </section>
  <section xml:id="build-tools">
  <title>Build Tools</title>
  <section xml:id="build-tools-rebar3">
    <title>Rebar3</title>
    <para>
-      By default Rebar3 wants to manage it's own dependencies. In the
+      By default, Rebar3 wants to manage its own dependencies. This is perfectly
-      normal non-Nix, this is perfectly acceptable. In the Nix world it
+      acceptable in the normal, non-Nix setup, but in the Nix world, it is not.
-      is not. To support this we have created two versions of rebar3,
+      To rectify this, we provide two versions of Rebar3:
-      <literal>rebar3</literal> and <literal>rebar3-open</literal>. The
+      <itemizedlist>
-      <literal>rebar3</literal> version has been patched to remove the
+        <listitem>
-      ability to download anything from it. If you are not running it a
+          <para>
-      nix-shell or a nix-build then its probably not going to work for
+            <literal>rebar3</literal>: patched to remove the ability to download
-      you. <literal>rebar3-open</literal> is the normal, un-modified
+            anything. When not running it via <literal>nix-shell</literal> or
-      rebar3. It should work exactly as would any other version of
+            <literal>nix-build</literal>, it's probably not going to work as
-      rebar3. Any Erlang package should rely on
+            desired.
-      <literal>rebar3</literal> and thats really what you should be
+          </para>
-      using too.
+        </listitem>
        <listitem>
          <para>
            <literal>rebar3-open</literal>: the normal, unmodified Rebar3. It
            should work exactly as would any other version of Rebar3. Any Erlang
            package should rely on <literal>rebar3</literal> instead. See <xref
            linkend="rebar3-packages"/>.
          </para>
        </listitem>
      </itemizedlist>
    </para>
  </section>
  <section xml:id="build-tools-other">
    <title>Mix &amp; Erlang.mk</title>
    <para>
-      Both Mix and Erlang.mk work exactly as you would expect. There
+      Both Mix and Erlang.mk work exactly as expected. There is a bootstrap
-      is a bootstrap process that needs to be run for both of
+      process that needs to be run for both, however, which is supported by the
-      them. However, that is supported by the
+      <literal>buildMix</literal> and <literal>buildErlangMk</literal>
-      <literal>buildMix</literal> and <literal>buildErlangMk</literal> derivations.
+      derivations, respectively.
    </para>
  </section>
 </section>
 <section xml:id="how-to-install-beam-packages">
-  <title>How to install Beam packages</title>
+  <title>How to Install BEAM Packages</title>
  <para>
-    Beam packages are not registered in the top level simply because
+    BEAM packages are not registered at the top level, simply because they are
-    they are not relevant to the vast majority of Nix users. They are
+    not relevant to the vast majority of Nix users. They are installable using
-    installable using the <literal>beamPackages</literal> attribute
+    the <literal>beam.packages.erlang</literal> attribute set (aliased as
-    set.
+    <literal>beamPackages</literal>), which points to packages built by the
    default Erlang/OTP version in Nixpkgs, as defined by
    <literal>beam.interpreters.erlang</literal>.
-    You can list the avialable packages in the
+    To list the available packages in
-    <literal>beamPackages</literal> with the following command:
+    <literal>beamPackages</literal>, use the following command:
  </para>
  <programlisting>
@@ -69,115 +129,152 @@ beamPackages.meck       meck-0.8.3
 beamPackages.rebar3-pc  pc-1.1.0
  </programlisting>
  <para>
-    To install any of those packages into your profile, refer to them by
+    To install any of those packages into your profile, refer to them by their
-    their attribute path (first column):
+    attribute path (first column):
  </para>
  <programlisting>
 $ nix-env -f &quot;&lt;nixpkgs&gt;&quot; -iA beamPackages.ibrowse
  </programlisting>
  <para>
-    The attribute path of any Beam packages corresponds to the name
+    The attribute path of any BEAM package corresponds to the name of that
-    of that particular package in Hex or its OTP Application/Release name.
+    particular package in <link xlink:href="https://hex.pm">Hex</link> or its
    OTP Application/Release name.
  </para>
 </section>
 <section xml:id="packaging-beam-applications">
-  <title>Packaging Beam Applications</title>
+  <title>Packaging BEAM Applications</title>
  <section  xml:id="packaging-erlang-applications">
    <title>Erlang Applications</title>
    <section xml:id="rebar3-packages">
      <title>Rebar3 Packages</title>
      <para>
-        There is a Nix functional called
+        The Nix function, <literal>buildRebar3</literal>, defined in
-        <literal>buildRebar3</literal>. We use this function to make a
+        <literal>beam.packages.erlang.buildRebar3</literal> and aliased at the
-        derivation that understands how to build the rebar3 project. For
+        top level, can be used to build a derivation that understands how to
-        example, the epression we use to build the <link
+        build a Rebar3 project. For example, we can build <link
-        xlink:href="https://github.com/erlang-nix/hex2nix">hex2nix</link>
+        xlink:href="https://github.com/erlang-nix/hex2nix">hex2nix</link> as
-        project follows.
+        follows:
      </para>
      <programlisting>
-        {stdenv, fetchFromGitHub, buildRebar3, ibrowse, jsx, erlware_commons }:
+        { stdenv, fetchFromGitHub, buildRebar3, ibrowse, jsx, erlware_commons }:
-          buildRebar3 rec {
+        buildRebar3 rec {
-            name = "hex2nix";
+          name = "hex2nix";
-            version = "0.0.1";
+          version = "0.0.1";
-            src = fetchFromGitHub {
+          src = fetchFromGitHub {
-              owner = "ericbmerritt";
+            owner = "ericbmerritt";
-              repo = "hex2nix";
+            repo = "hex2nix";
-              rev = "${version}";
+            rev = "${version}";
-              sha256 = "1w7xjidz1l5yjmhlplfx7kphmnpvqm67w99hd2m7kdixwdxq0zqg";
+            sha256 = "1w7xjidz1l5yjmhlplfx7kphmnpvqm67w99hd2m7kdixwdxq0zqg";
-            };
+          };
          beamDeps = [ ibrowse jsx erlware_commons ];
        }
      </programlisting>
      <para>
-        The only visible difference between this derivation and
+        Such derivations are callable with
-        something like <literal>stdenv.mkDerivation</literal> is that we
+        <literal>beam.packages.erlang.callPackage</literal> (see <xref
-        have added <literal>erlangDeps</literal> to the derivation. If
+        linkend="erlang-call-package"/>). To call this package using the normal
-        you add your Beam dependencies here they will be correctly
+        <literal>callPackage</literal>, refer to dependency packages via
-        handled by the system.
+        <literal>beamPackages</literal>, e.g.
        <literal>beamPackages.ibrowse</literal>.
      </para>
      <para>
-        If your package needs to compile native code via Rebar's port
+        Notably, <literal>buildRebar3</literal> includes
-        compilation mechenism. You should add <literal>compilePort =
+        <literal>beamDeps</literal>, while
-        true;</literal> to the derivation.
+        <literal>stdenv.mkDerivation</literal> does not. BEAM dependencies added
        there will be correctly handled by the system.
      </para>
      <para>
        If a package needs to compile native code via Rebar3's port compilation
        mechanism, add <literal>compilePort = true;</literal> to the derivation.
      </para>
    </section>
    <section xml:id="erlang-mk-packages">
      <title>Erlang.mk Packages</title>
      <para>
-        Erlang.mk functions almost identically to Rebar. The only real
+        Erlang.mk functions similarly to Rebar3, except we use
-        difference is that <literal>buildErlangMk</literal> is called
+        <literal>buildErlangMk</literal> instead of
-        instead of <literal>buildRebar3</literal>
+        <literal>buildRebar3</literal>.
      </para>
      <programlisting>
-        { buildErlangMk, fetchHex,  cowlib, ranch }:
+        { buildErlangMk, fetchHex, cowlib, ranch }:
          buildErlangMk {
            name = "cowboy";
            version = "1.0.4";
            src = fetchHex {
              pkg = "cowboy";
              version = "1.0.4";
              sha256 =
                "6a0edee96885fae3a8dd0ac1f333538a42e807db638a9453064ccfdaa6b9fdac";
            };
            beamDeps  = [ cowlib ranch ];
-            meta = {
+        buildErlangMk {
-              description = ''Small, fast, modular HTTP server written in
+          name = "cowboy";
-                            Erlang.'';
+          version = "1.0.4";
-              license = stdenv.lib.licenses.isc;
+
-              homepage = "https://github.com/ninenines/cowboy";
+          src = fetchHex {
-            };
+            pkg = "cowboy";
            version = "1.0.4";
            sha256 = "6a0edee96885fae3a8dd0ac1f333538a42e807db638a9453064ccfdaa6b9fdac";
          };
          beamDeps = [ cowlib ranch ];
          meta = {
            description = ''
              Small, fast, modular HTTP server written in Erlang
            '';
            license = stdenv.lib.licenses.isc;
            homepage = https://github.com/ninenines/cowboy;
          };
        }
      </programlisting>
    </section>
    <section xml:id="mix-packages">
      <title>Mix Packages</title>
      <para>
-        Mix functions almost identically to Rebar. The only real
+        Mix functions similarly to Rebar3, except we use
-        difference is that <literal>buildMix</literal> is called
+        <literal>buildMix</literal> instead of <literal>buildRebar3</literal>.
        instead of <literal>buildRebar3</literal>
      </para>
      <programlisting>
        { buildMix, fetchHex, plug, absinthe }:
        buildMix {
          name = "absinthe_plug";
          version = "1.0.0";
          src = fetchHex {
            pkg = "absinthe_plug";
            version = "1.0.0";
-            sha256 =
+            sha256 = "08459823fe1fd4f0325a8bf0c937a4520583a5a26d73b193040ab30a1dfc0b33";
              "08459823fe1fd4f0325a8bf0c937a4520583a5a26d73b193040ab30a1dfc0b33";
          };
-          beamDeps  = [ plug absinthe];
+
          beamDeps = [ plug absinthe ];
          meta = {
-            description = ''A plug for Absinthe, an experimental GraphQL
+            description = ''
-                            toolkit'';
+              A plug for Absinthe, an experimental GraphQL toolkit
            '';
            license = stdenv.lib.licenses.bsd3;
-            homepage = "https://github.com/CargoSense/absinthe_plug";
+            homepage = https://github.com/CargoSense/absinthe_plug;
          };
        }
      </programlisting>
      <para>
        Alternatively, we can use <literal>buildHex</literal> as a shortcut:
      </para>
      <programlisting>
        { buildHex, buildMix, plug, absinthe }:
        buildHex {
          name = "absinthe_plug";
          version = "1.0.0";
          sha256 = "08459823fe1fd4f0325a8bf0c937a4520583a5a26d73b193040ab30a1dfc0b33";
          builder = buildMix;
          beamDeps = [ plug absinthe ];
          meta = {
            description = ''
              A plug for Absinthe, an experimental GraphQL toolkit
            '';
            license = stdenv.lib.licenses.bsd3;
            homepage = https://github.com/CargoSense/absinthe_plug;
         };
       }
      </programlisting>
@@ -185,18 +282,18 @@ $ nix-env -f &quot;&lt;nixpkgs&gt;&quot; -iA beamPackages.ibrowse
  </section>
 </section>
 <section xml:id="how-to-develop">
-  <title>How to develop</title>
+  <title>How to Develop</title>
  <section xml:id="accessing-an-environment">
    <title>Accessing an Environment</title>
    <para>
-      Often, all you want to do is be able to access a valid
+      Often, we simply want to access a valid environment that contains a
-      environment that contains a specific package and its
+      specific package and its dependencies. We can accomplish that with the
-      dependencies. we can do that with the <literal>env</literal>
+      <literal>env</literal> attribute of a derivation. For example, let's say
-      part of a derivation. For example, lets say we want to access an
+      we want to access an Erlang REPL with <literal>ibrowse</literal> loaded
-      erlang repl with ibrowse loaded up. We could do the following.
+      up. We could do the following:
    </para>
    <programlisting>
-      ~/w/nixpkgs ❯❯❯ nix-shell -A beamPackages.ibrowse.env --run "erl"
+      $ nix-shell -A beamPackages.ibrowse.env --run "erl"
      Erlang/OTP 18 [erts-7.0] [source] [64-bit] [smp:4:4] [async-threads:10] [hipe] [kernel-poll:false]
      Eshell V7.0  (abort with ^G)
@@ -237,20 +334,19 @@ $ nix-env -f &quot;&lt;nixpkgs&gt;&quot; -iA beamPackages.ibrowse
      2>
    </programlisting>
    <para>
-      Notice the <literal>-A beamPackages.ibrowse.env</literal>.That
+      Notice the <literal>-A beamPackages.ibrowse.env</literal>. That is the key
-      is the key to this functionality.
+      to this functionality.
    </para>
  </section>
  <section xml:id="creating-a-shell">
    <title>Creating a Shell</title>
    <para>
      Getting access to an environment often isn't enough to do real
-      development. Many times we need to create a
+      development. Usually, we need to create a <literal>shell.nix</literal>
-      <literal>shell.nix</literal> file and do our development inside
+      file and do our development inside of the environment specified therein.
-      of the environment specified by that file. This file looks a lot
+      This file looks a lot like the packaging described above, except that
-      like the packaging described above. The main difference is that
+      <literal>src</literal> points to the project root and we call the package
-      <literal>src</literal> points to project root and we call the
+      directly.
      package directly.
    </para>
    <programlisting>
 { pkgs ? import &quot;&lt;nixpkgs&quot;&gt; {} }:
@@ -264,18 +360,19 @@ let
        name = "hex2nix";
        version = "0.1.0";
        src = ./.;
-        erlangDeps = [ ibrowse jsx erlware_commons ];
+        beamDeps = [ ibrowse jsx erlware_commons ];
      };
  drv = beamPackages.callPackage f {};
 in
- drv
+
  drv
    </programlisting>
    <section xml:id="building-in-a-shell">
-    <title>Building in a shell</title>
+    <title>Building in a Shell (for Mix Projects)</title>
    <para>
-      We can leveral the support of the Derivation, regardless of
+      We can leverage the support of the derivation, irrespective of the build
-      which build Derivation is called by calling the commands themselv.s
+      derivation, by calling the commands themselves.
    </para>
    <programlisting>
 # =============================================================================
@@ -335,42 +432,43 @@ analyze: build plt
    </programlisting>
    <para>
-      If you add the <literal>shell.nix</literal> as described and
+      Using a <literal>shell.nix</literal> as described (see <xref
-      user rebar as follows things should simply work. Aside from the
+      linkend="creating-a-shell"/>) should just work. Aside from
      <literal>test</literal>, <literal>plt</literal>, and
-      <literal>analyze</literal> the talks work just fine for all of
+      <literal>analyze</literal>, the Make targets work just fine for all of the
-      the build Derivations.
+      build derivations.
    </para>
  </section>
 </section>
 </section>
 <section xml:id="generating-packages-from-hex-with-hex2nix">
-  <title>Generating Packages from Hex with Hex2Nix</title>
+  <title>Generating Packages from Hex with <literal>hex2nix</literal></title>
  <para>
-    Updating the Hex packages requires the use of the
+    Updating the <link xlink:href="https://hex.pm">Hex</link> package set
-    <literal>hex2nix</literal> tool. Given the path to the Erlang
+    requires <link
-    modules (usually
+    xlink:href="https://github.com/erlang-nix/hex2nix">hex2nix</link>. Given the
-    <literal>pkgs/development/erlang-modules</literal>). It will
+    path to the Erlang modules (usually
-    happily dump a file called
+    <literal>pkgs/development/erlang-modules</literal>), it will dump a file
-    <literal>hex-packages.nix</literal>. That file will contain all
+    called <literal>hex-packages.nix</literal>, containing all the packages that
-    the packages that use a recognized build system in Hex. However,
+    use a recognized build system in <link
-    it can't know whether or not all those packages are buildable.
+    xlink:href="https://hex.pm">Hex</link>. It can't be determined, however,
    whether every package is buildable.
    </para>
    <para>
-      To make life easier for our users, it makes good sense to go
+      To make life easier for our users, try to build every <link
-      ahead and attempt to build all those packages and remove the
+      xlink:href="https://hex.pm">Hex</link> package and remove those that fail.
-      ones that don't build. To do that, simply run the command (in
+      To do that, simply run the following command in the root of your
-      the root of your <literal>nixpkgs</literal> repository). that follows.
+      <literal>nixpkgs</literal> repository:
    </para>
    <programlisting>
 $ nix-build -A beamPackages
    </programlisting>
    <para>
-      That will build every package in
+      That will attempt to build every package in
-      <literal>beamPackages</literal>. Then you can go through and
+      <literal>beamPackages</literal>. Then manually remove those that fail.
-      manually remove the ones that fail. Hopefully, someone will
+      Hopefully, someone will improve <link
-      improve <literal>hex2nix</literal> in the future to automate
+      xlink:href="https://github.com/erlang-nix/hex2nix">hex2nix</link> in the
-      that.
+      future to automate the process.
    </para>
 </section>
 </section>
@@ -13,7 +13,7 @@ standard Go programs.
 deis = buildGoPackage rec {
  name = "deis-${version}";
  version = "1.13.0";
-  
+
  goPackagePath = "github.com/deis/deis"; <co xml:id='ex-buildGoPackage-1' />
  subPackages = [ "client" ]; <co xml:id='ex-buildGoPackage-2' />
@@ -130,6 +130,9 @@ the following arguments are of special significance to the function:
 </para>
 <para>To extract dependency information from a Go package in automated way use <link xlink:href="https://github.com/kamilchm/go2nix">go2nix</link>.
  It can produce complete derivation and <varname>goDeps</varname> file for Go programs.</para>
 <para>
  <varname>buildGoPackage</varname> produces <xref linkend='chap-multiple-output' xrefstyle="select: title" />
  where <varname>bin</varname> includes program binaries. You can test build a Go binary as follows:
@@ -160,7 +163,4 @@ done
 </screen>
 </para>
 <para>To extract dependency information from a Go package in automated way use <link xlink:href="https://github.com/kamilchm/go2nix">go2nix</link>.
  It can produce complete derivation and <varname>goDeps</varname> file for Go programs.</para>
 </section>
@@ -27,6 +27,7 @@ such as Perl or Haskell.  These are described in this chapter.</para>
 <xi:include href="qt.xml" />
 <xi:include href="r.xml" /> <!-- generated from ../../pkgs/development/r-modules/README.md  -->
 <xi:include href="ruby.xml" />
 <xi:include href="rust.xml" />
 <xi:include href="texlive.xml" />
 <xi:include href="vim.xml" />
@@ -3,7 +3,7 @@
 ## User Guide
 Several versions of Python are available on Nix as well as a high amount of
-packages. The default interpreter is CPython 3.5.
+packages. The default interpreter is CPython 2.7.
 ### Using Python
@@ -131,7 +131,7 @@ specify some (optional) [meta information](http://nixos.org/nixpkgs/manual/#chap
 The output of the function is a derivation, which is an attribute with the name
 `toolz` of the set `pythonPackages`. Actually, sets are created for all interpreter versions,
-so `python27Packages`, `python34Packages`, `python35Packages` and `pypyPackages`.
+so e.g. `python27Packages`, `python35Packages` and `pypyPackages`.
 The above example works when you're directly working on
 `pkgs/top-level/python-packages.nix` in the Nixpkgs repository. Often though,
@@ -422,8 +422,8 @@ and in this case the `python35` interpreter is automatically used.
 ### Interpreters
-Versions 2.6, 2.7, 3.3, 3.4 and 3.5 of the CPython interpreter are available as respectively
+Versions 2.7, 3.3, 3.4, 3.5 and 3.6 of the CPython interpreter are available as
-`python26`, `python27`, `python33`, `python34` and `python35`. The PyPy interpreter
+respectively `python27`, `python33`, `python34`, `python35` and `python36`. The PyPy interpreter
 is available as `pypy`. The aliases `python2` and `python3` correspond to respectively `python27` and
 `python35`. The default interpreter, `python`, maps to `python2`.
 The Nix expressions for the interpreters can be found in
@@ -472,6 +472,7 @@ sets are
 * `pkgs.python33Packages`
 * `pkgs.python34Packages`
 * `pkgs.python35Packages`
 * `pkgs.python36Packages`
 * `pkgs.pypyPackages`
 and the aliases
@@ -579,7 +580,7 @@ running `nix-shell` with the following `shell.nix`
 with import <nixpkgs> {};
 (python3.buildEnv.override {
-  extraLibs = with python3Packages; [ numpy requests2 ];
+  extraLibs = with python3Packages; [ numpy requests ];
 }).env
 ```
@@ -621,12 +622,15 @@ attribute. The `shell.nix` file from the previous section can thus be also writt
 ```nix
 with import <nixpkgs> {};
-(python33.withPackages (ps: [ps.numpy ps.requests2])).env
+(python33.withPackages (ps: [ps.numpy ps.requests])).env
 ```
 In contrast to `python.buildEnv`, `python.withPackages` does not support the more advanced options
 such as `ignoreCollisions = true` or `postBuild`. If you need them, you have to use `python.buildEnv`.
 Python 2 namespace packages may provide `__init__.py` that collide. In that case `python.buildEnv` 
 should be used with `ignoreCollisions = true`.
 ### Development mode
 Development or editable mode is supported. To develop Python packages
@@ -674,8 +678,8 @@ deterministic bytecode. This has security implications and is relevant for
 those using Python in a `nix-shell`.
 When the environment variable `DETERMINISTIC_BUILD` is set, all bytecode will have timestamp 1.
-The `buildPythonPackage` function sets `DETERMINISTIC_BUILD` as well as
+The `buildPythonPackage` function sets `DETERMINISTIC_BUILD=1` and
-[PYTHONHASHSEED](https://docs.python.org/3.5/using/cmdline.html#envvar-PYTHONHASHSEED).
+[PYTHONHASHSEED=0](https://docs.python.org/3.5/using/cmdline.html#envvar-PYTHONHASHSEED).
 Both are also exported in `nix-shell`.
@@ -706,7 +710,7 @@ nix-env -if build.nix
 ```
 Now you can use the Python interpreter, as well as the extra packages that you added to the environment.
-#### Environment defined in `~/.nixpkgs/config.nix`
+#### Environment defined in `~/.config/nixpkgs/config.nix`
 If you prefer to, you could also add the environment as a package override to the Nixpkgs set.
 ```nix
@@ -897,6 +901,49 @@ is executed it will attempt to download the python modules listed in
 requirements.txt. However these will be cached locally within the `virtualenv`
 folder and not downloaded again.
 ### How to override a Python package from `configuration.nix`?
 If you need to change a package's attribute(s) from `configuration.nix` you could do:
 ```nix
  nixpkgs.config.packageOverrides = superP: {
    pythonPackages = superP.pythonPackages.override {
      overrides = self: super: {
        bepasty-server = super.bepasty-server.overrideAttrs ( oldAttrs: {
          src = pkgs.fetchgit {
            url = "https://github.com/bepasty/bepasty-server";
            sha256 = "9ziqshmsf0rjvdhhca55sm0x8jz76fsf2q4rwh4m6lpcf8wr0nps";
            rev = "e2516e8cf4f2afb5185337073607eb9e84a61d2d";
          };
        });
      };
    };
  };
 ```
 If you are using the `bepasty-server` package somewhere, for example in `systemPackages` or indirectly from `services.bepasty`, then a `nixos-rebuild switch` will rebuild the system but with the `bepasty-server` package using a different `src` attribute. This way one can modify `python` based software/libraries easily. Using `self` and `super` one can also alter dependencies (`buildInputs`) between the old state (`self`) and new state (`super`). 
 ### How to override a Python package using overlays?
 To alter a python package using overlays, you would use the following approach:
 ```nix
 self: super:
 rec {
  python = super.python.override {
    packageOverrides = python-self: python-super: {
      bepasty-server = python-super.bepasty-server.overrideAttrs ( oldAttrs: {
        src = self.pkgs.fetchgit {
          url = "https://github.com/bepasty/bepasty-server";
          sha256 = "9ziqshmsf0rjvdhhca55sm0x8jz76fsf2q4rwh4m6lpcf8wr0nps";
          rev = "e2516e8cf4f2afb5185337073607eb9e84a61d2d";
        };
      });
    };
  };
  pythonPackages = python.pkgs;
 }
 ```
 ## Contributing
@@ -2,31 +2,55 @@
         xmlns:xlink="http://www.w3.org/1999/xlink"
         xml:id="sec-language-qt">
-<title>Qt and KDE</title>
+<title>Qt</title>
-<para>Qt is a comprehensive desktop and mobile application development toolkit for C++. Legacy support is available for Qt 3 and Qt 4, but all current development uses Qt 5. The Qt 5 packages in Nixpkgs are updated frequently to take advantage of new features, but older versions are typically retained to support packages that may not be compatible with the latest version. When packaging applications and libraries for Nixpkgs, it is important to ensure that compatible versions of Qt 5 are used throughout; this consideration motivates the tools described below.</para>
+<para>
 Qt is a comprehensive desktop and mobile application development toolkit for C++.
 Legacy support is available for Qt 3 and Qt 4, but all current development uses Qt 5.
 The Qt 5 packages in Nixpkgs are updated frequently to take advantage of new features,
 but older versions are typically retained until their support window ends.
 The most important consideration in packaging Qt-based software is ensuring that each package and all its dependencies use the same version of Qt 5;
 this consideration motivates most of the tools described below.
 </para>
-<section xml:id="ssec-qt-libraries"><title>Libraries</title>
+<section xml:id="ssec-qt-libraries"><title>Packaging Libraries for Nixpkgs</title>
-<para>Libraries that depend on Qt 5 should be built with each available version to avoid linking a dependent package against incompatible versions of Qt 5. (Although Qt 5 maintains backward ABI compatibility, linking against multiple versions at once is generally not possible; at best it will lead to runtime faults.) Packages that provide libraries should be added to the top-level function <varname>mkLibsForQt5</varname>, which is used to build a set of libraries for every Qt 5 version. The <varname>callPackage</varname> provided in this scope will ensure that only one Qt version will be used throughout the dependency tree. Dependencies should be imported unqualified, i.e. <literal>qtbase</literal> not <literal>qt5.qtbase</literal>, so that <varname>callPackage</varname> can do its work. <emphasis>Do not</emphasis> import a package set such as <literal>qt5</literal> or <literal>libsForQt5</literal> into your package; although it may work fine in the moment, it could well break at the next Qt update.</para>
+<para>
 Whenever possible, libraries that use Qt 5 should be built with each available version.
 Packages providing libraries should be added to the top-level function <varname>mkLibsForQt5</varname>,
 which is used to build a set of libraries for every Qt 5 version.
 A special <varname>callPackage</varname> function is used in this scope to ensure that the entire dependency tree uses the same Qt 5 version.
 Import dependencies unqualified, i.e., <literal>qtbase</literal> not <literal>qt5.qtbase</literal>.
 <emphasis>Do not</emphasis> import a package set such as <literal>qt5</literal> or <literal>libsForQt5</literal>.
 </para>
-<para>If a library does not support a particular version of Qt 5, it is best to mark it as broken by setting its <literal>meta.broken</literal> attribute. A package may be marked broken for certain versions by testing the <literal>qtbase.version</literal> attribute, which will always give the current Qt 5 version.</para>
+<para>
 If a library does not support a particular version of Qt 5, it is best to mark it as broken by setting its <literal>meta.broken</literal> attribute.
 A package may be marked broken for certain versions by testing the <literal>qtbase.version</literal> attribute, which will always give the current Qt 5 version.
 </para>
 </section>
-<section xml:id="ssec-qt-applications"><title>Applications</title>
+<section xml:id="ssec-qt-applications"><title>Packaging Applications for Nixpkgs</title>
-<para>Applications generally do not need to be built with every Qt version because they do not provide any libraries for dependent packages to link against. The primary consideration is merely ensuring that the application itself and its dependencies are linked against only one version of Qt. To call your application expression, use <literal>libsForQt5.callPackage</literal> instead of <literal>callPackage</literal>. Dependencies should be imported unqualified, i.e. <literal>qtbase</literal> not <literal>qt5.qtbase</literal>. <emphasis>Do not</emphasis> import a package set such as <literal>qt5</literal> or <literal>libsForQt5</literal> into your package; although it may work fine in the moment, it could well break at the next Qt update.</para>
+<para>
 Call your application expression using <literal>libsForQt5.callPackage</literal> instead of <literal>callPackage</literal>.
 Import dependencies unqualified, i.e., <literal>qtbase</literal> not <literal>qt5.qtbase</literal>.
 <emphasis>Do not</emphasis> import a package set such as <literal>qt5</literal> or <literal>libsForQt5</literal>.
 </para>
-<para>It is generally best to build an application package against the <varname>libsForQt5</varname> library set. In case a package does not build with the latest Qt version, it is possible to pick a set pinned to a particular version, e.g. <varname>libsForQt55</varname> for Qt 5.5, if that is the latest version the package supports.</para>
+<para>
 Qt 5 maintains strict backward compatibility, so it is generally best to build an application package against the latest version using the <varname>libsForQt5</varname> library set.
 In case a package does not build with the latest Qt version, it is possible to pick a set pinned to a particular version, e.g. <varname>libsForQt55</varname> for Qt 5.5, if that is the latest version the package supports.
 If a package must be pinned to an older Qt version, be sure to file a bug upstream;
 because Qt is strictly backwards-compatible, any incompatibility is by definition a bug in the application.
 </para>
-<para>Qt-based applications require that several paths be set at runtime. This is accomplished by wrapping the provided executables in a package with <literal>wrapQtProgram</literal> or <literal>makeQtWrapper</literal> during the <literal>postFixup</literal> phase. To use the wrapper generators, add <literal>makeQtWrapper</literal> to <literal>nativeBuildInputs</literal>. The wrapper generators support the same options as <literal>wrapProgram</literal> and <literal>makeWrapper</literal> respectively. It is usually only necessary to generate wrappers for programs intended to be invoked by the user.</para>
+<para>
-
+When testing applications in Nixpkgs, it is a common practice to build the package with <literal>nix-build</literal> and run it using the created symbolic link.
-</section>
+This will not work with Qt applications, however, because they have many hard runtime requirements that can only be guaranteed if the package is actually installed.
-
+To test a Qt application, install it with <literal>nix-env</literal> or run it inside <literal>nix-shell</literal>.
-<section xml:id="ssec-qt-kde"><title>KDE</title>
+</para>
 <para>The KDE Frameworks are a set of libraries for Qt 5 which form the basis of the Plasma desktop environment and the KDE Applications suite. Packaging a Frameworks-based library does not require any steps beyond those described above for general Qt-based libraries. Frameworks-based applications should not use <literal>makeQtWrapper</literal>; instead, use <literal>kdeWrapper</literal> to create the necessary wrappers: <literal>kdeWrapper { unwrapped = <replaceable>expr</replaceable>; targets = <replaceable>exes</replaceable>; }</literal>, where <replaceable>expr</replaceable> is the un-wrapped package expression and <replaceable>exes</replaceable> is a list of strings giving the relative paths to programs in the package which should be wrapped.</para>
 </section>
@@ -16,8 +16,7 @@ $ cd sensu
 $ cat > Gemfile
 source 'https://rubygems.org'
 gem 'sensu'
-$ nix-shell -p bundler --command "bundler package --path /tmp/vendor/bundle"
+$ $(nix-build '<nixpkgs>' -A bundix)/bin/bundix --magic
 $ $(nix-build '<nixpkgs>' -A bundix)/bin/bundix
 $ cat > default.nix
 { lib, bundlerEnv, ruby }:
@@ -47,7 +46,7 @@ bundlerEnv rec {
 so it has all the libraries necessary for <literal>sensu</literal> in its paths. The second one can be used to make derivations from custom Ruby scripts which have
 <filename>Gemfile</filename>s with their dependencies specified. It is a derivation with <command>ruby</command> wrapped so it can find all the needed dependencies.
 For example, to make a derivation <literal>my-script</literal> for a <filename>my-script.rb</filename> (which should be placed in <filename>bin</filename>) you should
-run <command>bundix</command> as specified above and then use <literal>bundlerEnv</literal> lile this:</para>
+run <command>bundix</command> as specified above and then use <literal>bundlerEnv</literal> like this:</para>
 <programlisting>
 <![CDATA[let env = bundlerEnv {
@@ -0,0 +1,91 @@
 ---
 title: Rust
 author: Matthias Beyer
 date: 2017-03-05
 ---
 # User's Guide to the Rust Infrastructure
 To install the rust compiler and cargo put
 ```
 rustStable.rustc
 rustStable.cargo
 ```
 into the `environment.systemPackages` or bring them into scope with
 `nix-shell -p rustStable.rustc -p rustStable.cargo`.
 There are also `rustBeta` and `rustNightly` package sets available.
 These are not updated very regulary. For daily builds use either rustup from
 nixpkgs or use the [Rust nightlies overlay](#using-the-rust-nightlies-overlay).
 ## Packaging Rust applications
 Rust applications are packaged by using the `buildRustPackage` helper from `rustPlatform`:
 ```
 with rustPlatform;
 buildRustPackage rec {
  name = "ripgrep-${version}";
  version = "0.4.0";
  src = fetchFromGitHub {
    owner = "BurntSushi";
    repo = "ripgrep";
    rev = "${version}";
    sha256 = "0y5d1n6hkw85jb3rblcxqas2fp82h3nghssa4xqrhqnz25l799pj";
  };
  depsSha256 = "0q68qyl2h6i0qsz82z840myxlnjay8p1w5z7hfyr8fqp7wgwa9cx";
  meta = with stdenv.lib; {
    description = "A utility that combines the usability of The Silver Searcher with the raw speed of grep";
    homepage = https://github.com/BurntSushi/ripgrep;
    license = with licenses; [ unlicense ];
    maintainers = [ maintainers.tailhook ];
    platforms = platforms.all;
  };
 }
 ```
 `buildRustPackage` requires a `depsSha256` attribute which is computed over
 all crate sources of this package. Currently it is obtained by inserting a
 fake checksum into the expression and building the package once. The correct
 checksum can be then take from the failed build.
 To install crates with nix there is also an experimental project called
 [nixcrates](https://github.com/fractalide/nixcrates).
 ## Using the Rust nightlies overlay
 Mozilla provides an overlay for nixpkgs to bring a nightly version of Rust into scope.
 This overlay can _also_ be used to install recent unstable or stable versions
 of Rust, if desired.
 To use this overlay, clone
 [nixpkgs-mozilla](https://github.com/mozilla/nixpkgs-mozilla),
 and create a symbolic link to the file
 [rust-overlay.nix](https://github.com/mozilla/nixpkgs-mozilla/blob/master/rust-overlay.nix)
 in the `~/.config/nixpkgs/overlays` directory.
    $ git clone https://github.com/mozilla/nixpkgs-mozilla.git
    $ mkdir -p ~/.config/nixpkgs/overlays
    $ ln -s $(pwd)/nixpkgs-mozilla/rust-overlay.nix ~/.config/nixpkgs/overlays/rust-overlay.nix
 The latest version can be installed with the following command:
    $ nix-env -Ai nixos.rustChannels.stable.rust
 Or using the attribute with nix-shell:
    $ nix-shell -p nixos.rustChannels.stable.rust
 To install the beta or nightly channel, "stable" should be substituted by
 "nightly" or "beta", or
 use the function provided by this overlay to pull a version based on a
 build date.
 The overlay automatically updates itself as it uses the same source as
 [rustup](https://www.rustup.rs/).
@@ -8,15 +8,48 @@ date: 2016-06-25
 You'll get a vim(-your-suffix) in PATH also loading the plugins you want.
 Loading can be deferred; see examples.
-VAM (=vim-addon-manager) and Pathogen plugin managers are supported.
+Vim packages, VAM (=vim-addon-manager) and Pathogen are supported to load
-Vundle, NeoBundle could be your turn.
+packages.
-## dependencies by Vim plugins
+## Custom configuration
 Adding custom .vimrc lines can be done using the following code:
 ```
 vim_configurable.customize {
  name = "vim-with-plugins";
  vimrcConfig.customRC = ''
    set hidden
  '';
 }
 ```
 ## Vim packages
 To store you plugins in Vim packages the following example can be used:
 ```
 vim_configurable.customize {
  vimrcConfig.packages.myVimPackage = with pkgs.vimPlugins; {
    # loaded on launch
    start = [ youcompleteme fugitive ];
    # manually loadable by calling `:packadd $plugin-name`
    opt = [ phpCompletion elm-vim ];
    # To automatically load a plugin when opening a filetype, add vimrc lines like:
    # autocmd FileType php :packadd phpCompletion
  }
 };
 ```
 ## VAM
 ### dependencies by Vim plugins
 VAM introduced .json files supporting dependencies without versioning
 assuming that "using latest version" is ok most of the time.
-## HOWTO
+### Example
 First create a vim-scripts file having one plugin name per line. Example:
@@ -16,7 +16,6 @@
 <section><title>Installing a split package</title>
  <para>When installing a package via <varname>systemPackages</varname> or <command>nix-env</command> you have several options:</para>
  <warning><para>Currently <command>nix-env</command> almost always installs all outputs until https://github.com/NixOS/nix/pull/815 gets merged.</para></warning>
  <itemizedlist>
    <listitem><para>You can install particular outputs explicitly, as each is available in the Nix language as an attribute of the package.  The <varname>outputs</varname> attribute contains a list of output names.</para></listitem>
    <listitem><para>You can let it use the default outputs.  These are handled by <varname>meta.outputsToInstall</varname> attribute that contains a list of output names.</para>
@@ -34,7 +34,7 @@ first one present is considered, and all the rest are ignored:
  <listitem>
-    <para>In the directory <filename>~/.nixpkgs/overlays/</filename>.</para>
+    <para>In the directory <filename>~/.config/nixpkgs/overlays/</filename>.</para>
  </listitem>
 </orderedlist>
@@ -50,7 +50,7 @@ the same recipe. In the case where overlays are loaded from a directory, they ar
 alphabetical order.</para>
 <para>To install an overlay using the last option, you can clone the overlay's repository and add
-a symbolic link to it in <filename>~/.nixpkgs/overlays/</filename> directory.</para>
+a symbolic link to it in <filename>~/.config/nixpkgs/overlays/</filename> directory.</para>
 </section>
@@ -78,7 +78,7 @@ self: super:
 <para>The first argument, usually named <varname>self</varname>, corresponds to the final package
 set. You should use this set for the dependencies of all packages specified in your
 overlay. For example, all the dependencies of <varname>rr</varname> in the example above come
-from <varname>self</varname>, as well as the overriden dependencies used in the
+from <varname>self</varname>, as well as the overridden dependencies used in the
 <varname>boost</varname> override.</para>
 <para>The second argument, usually named <varname>super</varname>,
@@ -516,4 +516,140 @@ to your configuration, rebuild, and run the game with
 </section>
 <section xml:id="sec-emacs">
 <title>Emacs</title>
 <section xml:id="sec-emacs-config">
 <title>Configuring Emacs</title>
 <para>
  The Emacs package comes with some extra helpers to make it easier to
  configure. <varname>emacsWithPackages</varname> allows you to manage
  packages from ELPA. This means that you will not have to install
  that packages from within Emacs. For instance, if you wanted to use
  <literal>company</literal>, <literal>counsel</literal>,
  <literal>flycheck</literal>, <literal>ivy</literal>,
  <literal>magit</literal>, <literal>projectile</literal>, and
  <literal>use-package</literal> you could use this as a
  <filename>~/.config/nixpkgs/config.nix</filename> override:
 </para>
 <screen>
 {
  packageOverrides = pkgs: with pkgs; {
    myEmacs = emacsWithPackages (epkgs: (with epkgs.melpaStablePackages; [
      company
      counsel
      flycheck
      ivy
      magit
      projectile
      use-package
    ]));
  }
 }
 </screen>
 <para>
  You can install it like any other packages via <command>nix-env -iA
  myEmacs</command>. However, this will only install those packages.
  It will not <literal>configure</literal> them for us. To do this, we
  need to provide a configuration file. Luckily, it is possible to do
  this from within Nix! By modifying the above example, we can make
  Emacs load a custom config file. The key is to create a package that
  provide a <filename>default.el</filename> file in
  <filename>/share/emacs/site-start/</filename>. Emacs knows to load
  this file automatically when it starts.
 </para>
 <screen>
 {
  packageOverrides = pkgs: with pkgs; rec {
    myEmacsConfig = writeText "default.el" ''
 ;; initialize package
 (require 'package)
 (package-initialize 'noactivate)
 (eval-when-compile
  (require 'use-package))
 ;; load some packages
 (use-package company
  :bind ("&lt;C-tab&gt;" . company-complete)
  :diminish company-mode
  :commands (company-mode global-company-mode)
  :defer 1
  :config
  (global-company-mode))
 (use-package counsel
  :commands (counsel-descbinds)
  :bind (([remap execute-extended-command] . counsel-M-x)
         ("C-x C-f" . counsel-find-file)
         ("C-c g" . counsel-git)
         ("C-c j" . counsel-git-grep)
         ("C-c k" . counsel-ag)
         ("C-x l" . counsel-locate)
         ("M-y" . counsel-yank-pop)))
 (use-package flycheck
  :defer 2
  :config (global-flycheck-mode))
 (use-package ivy
  :defer 1
  :bind (("C-c C-r" . ivy-resume)
         ("C-x C-b" . ivy-switch-buffer)
         :map ivy-minibuffer-map
         ("C-j" . ivy-call))
  :diminish ivy-mode
  :commands ivy-mode
  :config
  (ivy-mode 1))
 (use-package magit
  :defer
  :if (executable-find "git")
  :bind (("C-x g" . magit-status)
         ("C-x G" . magit-dispatch-popup))
  :init
  (setq magit-completing-read-function 'ivy-completing-read))
 (use-package projectile
  :commands projectile-mode
  :bind-keymap ("C-c p" . projectile-command-map)
  :defer 5
  :config
  (projectile-global-mode))
    '';
    myEmacs = emacsWithPackages (epkgs: (with epkgs.melpaStablePackages; [
      (runCommand "default.el" {} ''
 mkdir -p $out/share/emacs/site-lisp
 cp ${myEmacsConfig} $out/share/emacs/site-lisp/default.el
 '')
      company
      counsel
      flycheck
      ivy
      magit
      projectile
      use-package
    ]));
  };
 }
 </screen>
 <para>
  This provides a fairly full Emacs start file. It will load in
  addition to the user's presonal config. You can always disable it by
  passing <command>-q</command> to the Emacs command.
 </para>
 </section>
 </section>
 </chapter>
@@ -212,7 +212,7 @@ $ nix-env -f . -iA libfoo</screen>
  <listitem>
    <para>Optionally commit the new package and open a pull request, or send a patch to
-    <literal>nix-dev@cs.uu.nl</literal>.</para>
+    <literal>https://groups.google.com/forum/#!forum/nix-devel</literal>.</para>
  </listitem>
@@ -18,7 +18,7 @@
 <para>The high change rate of nixpkgs make any pull request that is open for 
  long enough subject to conflicts that will require extra work from the 
  submitter or the merger. Reviewing pull requests in a timely manner and being 
-  responsive to the comments is the key to avoid these. Github provides sort 
+  responsive to the comments is the key to avoid these. GitHub provides sort 
  filters that can be used to see the <link 
    xlink:href="https://github.com/NixOS/nixpkgs/pulls?q=is%3Apr+is%3Aopen+sort%3Aupdated-desc">most 
    recently</link> and the <link 
@@ -318,7 +318,13 @@ containing some shell commands to be executed, or by redefining the
 shell function
 <varname><replaceable>name</replaceable>Phase</varname>.  The former
 is convenient to override a phase from the derivation, while the
-latter is convenient from a build script.</para>
+latter is convenient from a build script.
 However, typically one only wants to <emphasis>add</emphasis> some
 commands to a phase, e.g. by defining <literal>postInstall</literal>
 or <literal>preFixup</literal>, as skipping some of the default actions
 may have unexpected consequences.
 </para>
 <section xml:id="ssec-controlling-phases"><title>Controlling
@@ -634,6 +640,16 @@ script) if it exists.</para>
    true.</para></listitem>
  </varlistentry>
  <varlistentry>
    <term><varname>configurePlatforms</varname></term>
    <listitem><para>
      By default, when cross compiling, the configure script has <option>--build=...</option> and <option>--host=...</option> passed.
      Packages can instead pass <literal>[ "build" "host" "target" ]</literal> or a subset to control exactly which platform flags are passed.
      Compilers and other tools should use this to also pass the target platform, for example.
      Note eventually these will be passed when in native builds too, to improve determinism: build-time guessing, as is done today, is a risk of impurity.
    </para></listitem>
  </varlistentry>
  <varlistentry>
    <term><varname>preConfigure</varname></term>
    <listitem><para>Hook executed at the start of the configure
@@ -1156,7 +1172,7 @@ makeWrapper $out/bin/foo $wrapperfile --prefix PATH : ${lib.makeBinPath [ hello
            <term><option>--replace</option>
            <replaceable>s1</replaceable>
            <replaceable>s2</replaceable></term>
-            <listitem><para>Replace every occurence of the string
+            <listitem><para>Replace every occurrence of the string
            <replaceable>s1</replaceable> by
            <replaceable>s2</replaceable>.</para></listitem>
          </varlistentry>
@@ -1164,7 +1180,7 @@ makeWrapper $out/bin/foo $wrapperfile --prefix PATH : ${lib.makeBinPath [ hello
          <varlistentry>
            <term><option>--subst-var</option>
            <replaceable>varName</replaceable></term>
-            <listitem><para>Replace every occurence of
+            <listitem><para>Replace every occurrence of
            <literal>@<replaceable>varName</replaceable>@</literal> by
            the contents of the environment variable
            <replaceable>varName</replaceable>.  This is useful for
@@ -1177,7 +1193,7 @@ makeWrapper $out/bin/foo $wrapperfile --prefix PATH : ${lib.makeBinPath [ hello
            <term><option>--subst-var-by</option>
            <replaceable>varName</replaceable>
            <replaceable>s</replaceable></term>
-            <listitem><para>Replace every occurence of
+            <listitem><para>Replace every occurrence of
            <literal>@<replaceable>varName</replaceable>@</literal> by
            the string <replaceable>s</replaceable>.</para></listitem>
          </varlistentry>
@@ -1225,7 +1241,7 @@ substitute ./foo.in ./foo.out \
    <term><function>substituteAll</function>
    <replaceable>infile</replaceable>
    <replaceable>outfile</replaceable></term>
-    <listitem><para>Replaces every occurence of
+    <listitem><para>Replaces every occurrence of
    <literal>@<replaceable>varName</replaceable>@</literal>, where
    <replaceable>varName</replaceable> is any environment variable, in
    <replaceable>infile</replaceable>, writing the result to
@@ -1528,7 +1544,7 @@ bin/blib.a(bios_console.o): In function `bios_handle_cup':
    depends on such a format string, it will need to be worked around.
    </para>
-    <para>Addtionally, some warnings are enabled which might trigger build
+    <para>Additionally, some warnings are enabled which might trigger build
    failures if compiler warnings are treated as errors in the package build.
    In this case, set <option>NIX_CFLAGS_COMPILE</option> to
    <option>-Wno-error=warning-type</option>.</para>
@@ -1558,7 +1574,7 @@ fcntl2.h:50:4: error: call to '__open_missing_mode' declared with attribute erro
    <term><varname>pic</varname></term>
    <listitem>
    <para>Adds the <option>-fPIC</option> compiler options. This options adds
-    support for position independant code in shared libraries and thus making
+    support for position independent code in shared libraries and thus making
    ASLR possible.</para>
    <para>Most notably, the Linux kernel, kernel modules and other code
    not running in an operating system environment like boot loaders won't
@@ -1,12 +1,12 @@
 # Operations on attribute sets.
-with {
+let
  inherit (builtins) head tail length;
-  inherit (import ./trivial.nix) or;
+  inherit (import ./trivial.nix) and or;
  inherit (import ./default.nix) fold;
  inherit (import ./strings.nix) concatStringsSep;
  inherit (import ./lists.nix) concatMap concatLists all deepSeqList;
-};
+in
 rec {
  inherit (builtins) attrNames listToAttrs hasAttr isAttrs getAttr;
@@ -116,7 +116,7 @@ rec {
    listToAttrs (concatMap (name: let v = set.${name}; in if pred name v then [(nameValuePair name v)] else []) (attrNames set));
-  /* Filter an attribute set recursivelly by removing all attributes for
+  /* Filter an attribute set recursively by removing all attributes for
     which the given predicate return false.
     Example:
@@ -334,7 +334,7 @@ rec {
      value = f name (catAttrs name sets);
    }) names);
-  /* Implentation note: Common names  appear multiple times in the list of
+  /* Implementation note: Common names  appear multiple times in the list of
     names, hopefully this does not affect the system because the maximal
     laziness avoid computing twice the same expression and listToAttrs does
     not care about duplicated attribute names.
@@ -353,7 +353,7 @@ rec {
  zipAttrs = zipAttrsWith (name: values: values);
  /* Does the same as the update operator '//' except that attributes are
-     merged until the given pedicate is verified.  The predicate should
+     merged until the given predicate is verified.  The predicate should
     accept 3 arguments which are the path to reach the attribute, a part of
     the first attribute set and a part of the second attribute set.  When
     the predicate is verified, the value of the first attribute set is
@@ -417,18 +417,15 @@ rec {
  /* Returns true if the pattern is contained in the set. False otherwise.
     FIXME(zimbatm): this example doesn't work !!!
     Example:
-       sys = mkSystem { }
+       matchAttrs { cpu = {}; } { cpu = { bits = 64; }; }
       matchAttrs { cpu = { bits = 64; }; } sys
       => true
   */
-  matchAttrs = pattern: attrs:
+  matchAttrs = pattern: attrs: assert isAttrs pattern;
-    fold or false (attrValues (zipAttrsWithNames (attrNames pattern) (n: values:
+    fold and true (attrValues (zipAttrsWithNames (attrNames pattern) (n: values:
      let pat = head values; val = head (tail values); in
      if length values == 1 then false
-      else if isAttrs pat then isAttrs val && matchAttrs head values
+      else if isAttrs pat then isAttrs val && matchAttrs pat val
      else pat == val
    ) [pattern attrs]));
@@ -1,4 +1,4 @@
-{lib, pkgs} :
+{lib, pkgs}:
 let inherit (lib) nv nvs; in
 {
@@ -19,7 +19,7 @@ let inherit (lib) nv nvs; in
  # * vim_configurable
  #
  # A minimal example illustrating most features would look like this:
-  # let base = composableDerivation { (fixed : let inherit (fixed.fixed) name in {
+  # let base = composableDerivation { (fixed: let inherit (fixed.fixed) name in {
  #    src = fetchurl {
  #    }
  #    buildInputs = [A];
@@ -39,7 +39,7 @@ let inherit (lib) nv nvs; in
  #
  # issues:
  # * its complicated to understand
-  # * some "features" such as exact merge behaviour are burried in mergeAttrBy
+  # * some "features" such as exact merge behaviour are buried in mergeAttrBy
  #   and defaultOverridableDelayableArgs assuming the default behaviour does
  #   the right thing in the common case
  # * Eelco once said using such fix style functions are slow to evaluate
@@ -48,7 +48,7 @@ let inherit (lib) nv nvs; in
  #   / add patches the way you want without having to declare function arguments
  #
  # nice features:
-  # declaring "optional featuers" is modular. For instance:
+  # declaring "optional features" is modular. For instance:
  #   flags.curl = {
  #     configureFlags = ["--with-curl=${curl.dev}" "--with-curlwrappers"];
  #     buildInputs = [curl openssl];
@@ -79,7 +79,7 @@ let inherit (lib) nv nvs; in
        # consider adding addtional elements by derivation.merge { removeAttrs = ["elem"]; };
        removeAttrs ? ["cfg" "flags"]
-      }: (lib.defaultOverridableDelayableArgs ( a: mkDerivation a) 
+      }: (lib.defaultOverridableDelayableArgs ( a: mkDerivation a)
         {
           inherit applyPreTidy removeAttrs;
         }).merge;
@@ -10,7 +10,7 @@ rec {
  /* `overrideDerivation drv f' takes a derivation (i.e., the result
     of a call to the builtin function `derivation') and returns a new
-     derivation in which the attributes of the original are overriden
+     derivation in which the attributes of the original are overridden
     according to the function `f'.  The function `f' is called with
     the original derivation attributes.
@@ -51,6 +51,24 @@ rec {
       else { }));
  /* `makeOverridable` takes a function from attribute set to attribute set and
     injects `override` attibute which can be used to override arguments of
     the function.
       nix-repl> x = {a, b}: { result = a + b; }
       nix-repl> y = lib.makeOverridable x { a = 1; b = 2; }
       nix-repl> y
       { override = «lambda»; overrideDerivation = «lambda»; result = 3; }
       nix-repl> y.override { a = 10; }
       { override = «lambda»; overrideDerivation = «lambda»; result = 12; }
     Please refer to "Nixpkgs Contributors Guide" section
     "<pkg>.overrideDerivation" to learn about `overrideDerivation` and caveats
     related to its use.
  */
  makeOverridable = f: origArgs:
    let
      ff = f origArgs;
@@ -167,7 +185,7 @@ rec {
  /* Make a set of packages with a common scope. All packages called
     with the provided `callPackage' will be evaluated with the same
     arguments. Any package in the set may depend on any other. The
-     `override' function allows subsequent modification of the package
+     `overrideScope' function allows subsequent modification of the package
     set in a consistent way, i.e. all packages in the set will be
     called with the overridden packages. The package sets may be
     hierarchical: the packages in the set are called with the scope
@@ -177,7 +195,7 @@ rec {
    let self = f self // {
          newScope = scope: newScope (self // scope);
          callPackage = self.newScope {};
-          override = g:
+          overrideScope = g:
            makeScope newScope
            (self_: let super = f self_; in super // g super self_);
          packages = f;
@@ -20,14 +20,38 @@ rec {
  traceXMLValMarked = str: x: trace (str + builtins.toXML x) x;
  # strict trace functions (traced structure is fully evaluated and printed)
  /* `builtins.trace`, but the value is `builtins.deepSeq`ed first. */
  traceSeq = x: y: trace (builtins.deepSeq x x) y;
  /* Like `traceSeq`, but only down to depth n.
   * This is very useful because lots of `traceSeq` usages
   * lead to an infinite recursion.
   */
  traceSeqN = depth: x: y: with lib;
    let snip = v: if      isList  v then noQuotes "[…]" v
                  else if isAttrs v then noQuotes "{…}" v
                  else v;
        noQuotes = str: v: { __pretty = const str; val = v; };
        modify = n: fn: v: if (n == 0) then fn v
                      else if isList  v then map (modify (n - 1) fn) v
                      else if isAttrs v then mapAttrs
                        (const (modify (n - 1) fn)) v
                      else v;
    in trace (generators.toPretty { allowPrettyValues = true; }
               (modify depth snip x)) y;
  /* `traceSeq`, but the same value is traced and returned */
  traceValSeq = v: traceVal (builtins.deepSeq v v);
  /* `traceValSeq` but with fixed depth */
  traceValSeqN = depth: v: traceSeqN depth v v;
  # this can help debug your code as well - designed to not produce thousands of lines
-  traceShowVal = x : trace (showVal x) x;
+  traceShowVal = x: trace (showVal x) x;
  traceShowValMarked = str: x: trace (str + showVal x) x;
-  attrNamesToStr = a : lib.concatStringsSep "; " (map (x : "${x}=") (attrNames a));
+  attrNamesToStr = a: lib.concatStringsSep "; " (map (x: "${x}=") (attrNames a));
-  showVal = x :
+  showVal = x:
      if isAttrs x then
          if x ? outPath then "x is a derivation, name ${if x ? name then x.name else "<no name>"}, { ${attrNamesToStr x} }"
          else "x is attr set { ${attrNamesToStr x} }"
@@ -43,9 +67,9 @@ rec {
  # trace the arguments passed to function and its result
  # maybe rewrite these functions in a traceCallXml like style. Then one function is enough
-  traceCall  = n : f : a : let t = n2 : x : traceShowValMarked "${n} ${n2}:" x; in t "result" (f (t "arg 1" a));
+  traceCall  = n: f: a: let t = n2: x: traceShowValMarked "${n} ${n2}:" x; in t "result" (f (t "arg 1" a));
-  traceCall2 = n : f : a : b : let t = n2 : x : traceShowValMarked "${n} ${n2}:" x; in t "result" (f (t "arg 1" a) (t "arg 2" b));
+  traceCall2 = n: f: a: b: let t = n2: x: traceShowValMarked "${n} ${n2}:" x; in t "result" (f (t "arg 1" a) (t "arg 2" b));
-  traceCall3 = n : f : a : b : c : let t = n2 : x : traceShowValMarked "${n} ${n2}:" x; in t "result" (f (t "arg 1" a) (t "arg 2" b) (t "arg 3" c));
+  traceCall3 = n: f: a: b: c: let t = n2: x: traceShowValMarked "${n} ${n2}:" x; in t "result" (f (t "arg 1" a) (t "arg 2" b) (t "arg 3" c));
  # FIXME: rename this?
  traceValIfNot = c: x:
@@ -71,7 +95,7 @@ rec {
  # create a test assuming that list elements are true
  # usage: { testX = allTrue [ true ]; }
-  testAllTrue = expr : { inherit expr; expected = map (x: true) expr; };
+  testAllTrue = expr: { inherit expr; expected = map (x: true) expr; };
  strict = v:
    trace "Warning: strict is deprecated and will be removed in the next release"
@@ -1,7 +1,13 @@
 /* Library of low-level helper functions for nix expressions.
 *
 * Please implement (mostly) exhaustive unit tests
 * for new functions in `./tests.nix'.
 */
 let
-  # trivial, often used functions
+  # often used, or depending on very little
  trivial = import ./trivial.nix;
  fixedPoints = import ./fixed-points.nix;
  # datatypes
  attrsets = import ./attrsets.nix;
@@ -22,8 +28,7 @@ let
  # constants
  licenses = import ./licenses.nix;
-  platforms = import ./platforms.nix;
+  systems = import ./systems;
  systems = import ./systems.nix;
  # misc
  debug = import ./debug.nix;
@@ -38,17 +43,20 @@ let
  filesystem = import ./filesystem.nix;
 in
-  { inherit trivial
+  { inherit trivial fixedPoints
            attrsets lists strings stringsWithDeps
            customisation maintainers meta sources
            modules options types
-            licenses platforms systems
+            licenses systems
            debug generators misc
            sandbox fetchers filesystem;
    # back-compat aliases
    platforms = systems.doubles;
  }
  # !!! don't include everything at top-level; perhaps only the most
  # commonly used functions.
-  // trivial // lists // strings // stringsWithDeps // attrsets // sources
+  // trivial // fixedPoints
  // lists // strings // stringsWithDeps // attrsets // sources
  // options // types // meta // debug // misc // modules
  // systems
  // customisation
@@ -16,23 +16,23 @@ rec {
  defaultMergeArg = x : y: if builtins.isAttrs y then
    y
-  else 
+  else
    (y x);
  defaultMerge = x: y: x // (defaultMergeArg x y);
-  foldArgs = merger: f: init: x: 
+  foldArgs = merger: f: init: x:
-    let arg=(merger init (defaultMergeArg init x));
+    let arg = (merger init (defaultMergeArg init x));
-      # now add the function with composed args already applied to the final attrs
+        # now add the function with composed args already applied to the final attrs
-        base = (setAttrMerge "passthru" {} (f arg) 
+        base = (setAttrMerge "passthru" {} (f arg)
-                        ( z : z // rec { 
+                        ( z: z // rec {
-                          function = foldArgs merger f arg; 
+                            function = foldArgs merger f arg;
-			  args = (lib.attrByPath ["passthru" "args"] {} z) // x;
+                            args = (lib.attrByPath ["passthru" "args"] {} z) // x;
                          } ));
-	withStdOverrides = base // {
+        withStdOverrides = base // {
-	   override = base.passthru.function;
+          override = base.passthru.function;
-	   } ;
+        };
        in
-	withStdOverrides;
+          withStdOverrides;
-    
+
  # predecessors: proposed replacement for applyAndFun (which has a bug cause it merges twice)
  # the naming "overridableDelayableArgs" tries to express that you can
@@ -49,35 +49,35 @@ rec {
  #
  # examples: see test cases "res" below;
  overridableDelayableArgs =
-          f :        # the function applied to the arguments
+          f:        # the function applied to the arguments
-          initial :  # you pass attrs, the functions below are passing a function taking the fix argument
+          initial:  # you pass attrs, the functions below are passing a function taking the fix argument
    let
        takeFixed = if isFunction initial then initial else (fixed : initial); # transform initial to an expression always taking the fixed argument
-        tidy = args : 
+        tidy = args:
            let # apply all functions given in "applyPreTidy" in sequence
-                applyPreTidyFun = fold ( n : a : x : n ( a x ) ) lib.id (maybeAttr "applyPreTidy" [] args);
+                applyPreTidyFun = fold ( n: a: x: n ( a x ) ) lib.id (maybeAttr "applyPreTidy" [] args);
            in removeAttrs (applyPreTidyFun args) ( ["applyPreTidy"] ++ (maybeAttr  "removeAttrs" [] args) ); # tidy up args before applying them
-        fun = n : x :
+        fun = n: x:
-             let newArgs = fixed :
+            let newArgs = fixed:
-                     let args = takeFixed fixed; 
+                    let args = takeFixed fixed;
-                         mergeFun = args.${n};
+                        mergeFun = args.${n};
-                     in if isAttrs x then (mergeFun args x)
+                    in if isAttrs x then (mergeFun args x)
-                        else assert isFunction x;
+                       else assert isFunction x;
-                             mergeFun args (x ( args // { inherit fixed; }));
+                            mergeFun args (x ( args // { inherit fixed; }));
-             in overridableDelayableArgs f newArgs;
+            in overridableDelayableArgs f newArgs;
    in
    (f (tidy (lib.fix takeFixed))) // {
      merge   = fun "mergeFun";
      replace = fun "keepFun";
    };
-  defaultOverridableDelayableArgs = f : 
+  defaultOverridableDelayableArgs = f:
      let defaults = {
            mergeFun = mergeAttrByFunc; # default merge function. merge strategie (concatenate lists, strings) is given by mergeAttrBy
-            keepFun = a : b : { inherit (a) removeAttrs mergeFun keepFun mergeAttrBy; } // b; # even when using replace preserve these values
+            keepFun = a: b: { inherit (a) removeAttrs mergeFun keepFun mergeAttrBy; } // b; # even when using replace preserve these values
            applyPreTidy = []; # list of functions applied to args before args are tidied up (usage case : prepareDerivationArgs)
            mergeAttrBy = mergeAttrBy // {
-              applyPreTidy = a : b : a ++ b;
+              applyPreTidy = a: b: a ++ b;
-              removeAttrs = a : b: a ++ b;
+              removeAttrs = a: b: a ++ b;
            };
            removeAttrs = ["mergeFun" "keepFun" "mergeAttrBy" "removeAttrs" "fixed" ]; # before applying the arguments to the function make sure these names are gone
          };
@@ -86,7 +86,7 @@ rec {
  # rec { # an example of how composedArgsAndFun can be used
-  #  a  = composedArgsAndFun (x : x) { a = ["2"]; meta = { d = "bar";}; };
+  #  a  = composedArgsAndFun (x: x) { a = ["2"]; meta = { d = "bar";}; };
  #  # meta.d will be lost ! It's your task to preserve it (eg using a merge function)
  #  b  = a.passthru.function { a = [ "3" ]; meta = { d2 = "bar2";}; };
  #  # instead of passing/ overriding values you can use a merge function:
@@ -119,7 +119,7 @@ rec {
    else if val == true || val == false then false
    else null;
-    
+
  # Return true only if there is an attribute and it is true.
  checkFlag = attrSet: name:
        if name == "true" then true else
@@ -134,29 +134,29 @@ rec {
  ( attrByPath [name] (if checkFlag attrSet name then true else
        if argList == [] then null else
        let x = builtins.head argList; in
-                if (head x) == name then 
+                if (head x) == name then
                        (head (tail x))
-                else (getValue attrSet 
+                else (getValue attrSet
                        (tail argList) name)) attrSet );
-                        
+
  # Input : attrSet, [[name default] ...], [ [flagname reqs..] ... ]
  # Output : are reqs satisfied? It's asserted.
-  checkReqs = attrSet : argList : condList :
+  checkReqs = attrSet: argList: condList:
  (
-    fold lib.and true 
+    fold lib.and true
-      (map (x: let name = (head x) ; in
+      (map (x: let name = (head x); in
-        
+
-        ((checkFlag attrSet name) -> 
+        ((checkFlag attrSet name) ->
        (fold lib.and true
        (map (y: let val=(getValue attrSet argList y); in
-                (val!=null) && (val!=false)) 
+                (val!=null) && (val!=false))
-        (tail x))))) condList)) ;
+        (tail x))))) condList));
-        
+
  # This function has O(n^2) performance.
-  uniqList = {inputList, acc ? []} :
+  uniqList = { inputList, acc ? [] }:
-    let go = xs : acc :
+    let go = xs: acc:
             if xs == []
             then []
             else let x = head xs;
@@ -164,26 +164,26 @@ rec {
                  in y ++ go (tail xs) (y ++ acc);
    in go inputList acc;
-  uniqListExt = {inputList, outputList ? [],
+  uniqListExt = { inputList,
-    getter ? (x : x), compare ? (x: y: x==y)}:
+                  outputList ? [],
                  getter ? (x: x),
                  compare ? (x: y: x==y) }:
        if inputList == [] then outputList else
-        let x=head inputList; 
+        let x = head inputList;
-        isX = y: (compare (getter y) (getter x));
+            isX = y: (compare (getter y) (getter x));
-        newOutputList = outputList ++
+            newOutputList = outputList ++
-         (if any isX outputList then [] else [x]);
+                (if any isX outputList then [] else [x]);
-        in uniqListExt {outputList=newOutputList; 
+        in uniqListExt { outputList = newOutputList;
-                inputList = (tail inputList);
+                         inputList = (tail inputList);
-                inherit getter compare;
+                         inherit getter compare;
-                };
+                       };
  condConcat = name: list: checker:
        if list == [] then name else
-        if checker (head list) then 
+        if checker (head list) then
-                condConcat 
+                condConcat
-                        (name + (head (tail list))) 
+                        (name + (head (tail list)))
-                        (tail (tail list)) 
+                        (tail (tail list))
                        checker
        else condConcat
                name (tail (tail list)) checker;
@@ -202,12 +202,12 @@ rec {
    in
      work startSet [] [];
-  innerModifySumArgs = f: x: a: b: if b == null then (f a b) // x else 
+  innerModifySumArgs = f: x: a: b: if b == null then (f a b) // x else
        innerModifySumArgs f x (a // b);
  modifySumArgs = f: x: innerModifySumArgs f x {};
-  innerClosePropagation = acc : xs :
+  innerClosePropagation = acc: xs:
    if xs == []
    then acc
    else let y  = head xs;
@@ -227,45 +227,45 @@ rec {
  closePropagation = list: (uniqList {inputList = (innerClosePropagation [] list);});
  # calls a function (f attr value ) for each record item. returns a list
-  mapAttrsFlatten = f : r : map (attr: f attr r.${attr}) (attrNames r);
+  mapAttrsFlatten = f: r: map (attr: f attr r.${attr}) (attrNames r);
  # attribute set containing one attribute
-  nvs = name : value : listToAttrs [ (nameValuePair name value) ];
+  nvs = name: value: listToAttrs [ (nameValuePair name value) ];
  # adds / replaces an attribute of an attribute set
-  setAttr = set : name : v : set // (nvs name v);
+  setAttr = set: name: v: set // (nvs name v);
  # setAttrMerge (similar to mergeAttrsWithFunc but only merges the values of a particular name)
-  # setAttrMerge "a" [] { a = [2];} (x : x ++ [3]) -> { a = [2 3]; } 
+  # setAttrMerge "a" [] { a = [2];} (x: x ++ [3]) -> { a = [2 3]; }
-  # setAttrMerge "a" [] {         } (x : x ++ [3]) -> { a = [  3]; }
+  # setAttrMerge "a" [] {         } (x: x ++ [3]) -> { a = [  3]; }
-  setAttrMerge = name : default : attrs : f :
+  setAttrMerge = name: default: attrs: f:
    setAttr attrs name (f (maybeAttr name default attrs));
-  # Using f = a : b = b the result is similar to //
+  # Using f = a: b = b the result is similar to //
  # merge attributes with custom function handling the case that the attribute
  # exists in both sets
-  mergeAttrsWithFunc = f : set1 : set2 :
+  mergeAttrsWithFunc = f: set1: set2:
-    fold (n: set : if set ? ${n}
+    fold (n: set: if set ? ${n}
                        then setAttr set n (f set.${n} set2.${n})
                        else set )
           (set2 // set1) (attrNames set2);
  # merging two attribute set concatenating the values of same attribute names
  # eg { a = 7; } {  a = [ 2 3 ]; } becomes { a = [ 7 2 3 ]; }
-  mergeAttrsConcatenateValues = mergeAttrsWithFunc ( a : b : (toList a) ++ (toList b) );
+  mergeAttrsConcatenateValues = mergeAttrsWithFunc ( a: b: (toList a) ++ (toList b) );
-  # merges attributes using //, if a name exisits in both attributes
+  # merges attributes using //, if a name exists in both attributes
  # an error will be triggered unless its listed in mergeLists
  # so you can mergeAttrsNoOverride { buildInputs = [a]; } { buildInputs = [a]; } {} to get
  # { buildInputs = [a b]; }
-  # merging buildPhase does'nt really make sense. The cases will be rare where appending /prefixing will fit your needs?
+  # merging buildPhase doesn't really make sense. The cases will be rare where appending /prefixing will fit your needs?
  # in these cases the first buildPhase will override the second one
  # ! deprecated, use mergeAttrByFunc instead
  mergeAttrsNoOverride = { mergeLists ? ["buildInputs" "propagatedBuildInputs"],
                           overrideSnd ? [ "buildPhase" ]
-                         } : attrs1 : attrs2 :
+                         }: attrs1: attrs2:
-    fold (n: set : 
+    fold (n: set:
        setAttr set n ( if set ? ${n}
-            then # merge 
+            then # merge
              if elem n mergeLists # attribute contains list, merge them by concatenating
                then attrs2.${n} ++ attrs1.${n}
              else if elem n overrideSnd
@@ -286,14 +286,14 @@ rec {
  # { mergeAttrsBy = [...]; buildInputs = [ a b c d ]; }
  # is used by prepareDerivationArgs, defaultOverridableDelayableArgs and can be used when composing using
  # foldArgs, composedArgsAndFun or applyAndFun. Example: composableDerivation in all-packages.nix
-  mergeAttrByFunc = x : y :
+  mergeAttrByFunc = x: y:
    let
-          mergeAttrBy2 = { mergeAttrBy=lib.mergeAttrs; }
+          mergeAttrBy2 = { mergeAttrBy = lib.mergeAttrs; }
                      // (maybeAttr "mergeAttrBy" {} x)
                      // (maybeAttr "mergeAttrBy" {} y); in
    fold lib.mergeAttrs {} [
      x y
-      (mapAttrs ( a : v : # merge special names using given functions
+      (mapAttrs ( a: v: # merge special names using given functions
          if x ? ${a}
             then if y ? ${a}
               then v x.${a} y.${a} # both have attr, use merge func
@@ -313,9 +313,9 @@ rec {
  #
  # This function is best explained by an example:
  #
-  #     {version ? "2.x"} :
+  #     {version ? "2.x"}:
  #
-  #     mkDerivation (mergeAttrsByVersion "package-name" version 
+  #     mkDerivation (mergeAttrsByVersion "package-name" version
  #       { # version specific settings
  #         "git" = { src = ..; preConfigre = "autogen.sh"; buildInputs = [automake autoconf libtool];  };
  #         "2.x" = { src = ..; };
@@ -346,21 +346,24 @@ rec {
  # See misc.nix -> versionedDerivation
  # discussion: nixpkgs: pull/310
  mergeAttrsByVersion = name: version: attrsByVersion: base:
-    mergeAttrsByFuncDefaultsClean [ { name = "${name}-${version}"; } base (maybeAttr version (throw "bad version ${version} for ${name}") attrsByVersion)];
+    mergeAttrsByFuncDefaultsClean [ { name = "${name}-${version}"; }
                                    base
                                    (maybeAttr version (throw "bad version ${version} for ${name}") attrsByVersion)
                                  ];
  # sane defaults (same name as attr name so that inherit can be used)
  mergeAttrBy = # { buildInputs = concatList; [...]; passthru = mergeAttr; [..]; }
-    listToAttrs (map (n : nameValuePair n lib.concat)
+    listToAttrs (map (n: nameValuePair n lib.concat)
      [ "nativeBuildInputs" "buildInputs" "propagatedBuildInputs" "configureFlags" "prePhases" "postAll" "patches" ])
-    // listToAttrs (map (n : nameValuePair n lib.mergeAttrs) [ "passthru" "meta" "cfg" "flags" ])
+    // listToAttrs (map (n: nameValuePair n lib.mergeAttrs) [ "passthru" "meta" "cfg" "flags" ])
-    // listToAttrs (map (n : nameValuePair n (a: b: "${a}\n${b}") ) [ "preConfigure" "postInstall" ])
+    // listToAttrs (map (n: nameValuePair n (a: b: "${a}\n${b}") ) [ "preConfigure" "postInstall" ])
  ;
  # prepareDerivationArgs tries to make writing configurable derivations easier
  # example:
  #  prepareDerivationArgs {
  #    mergeAttrBy = {
-  #       myScript = x : y : x ++ "\n" ++ y;
+  #       myScript = x: y: x ++ "\n" ++ y;
  #    };
  #    cfg = {
  #      readlineSupport = true;
@@ -392,10 +395,10 @@ rec {
  # TODO use args.mergeFun here as well?
  prepareDerivationArgs = args:
    let args2 = { cfg = {}; flags = {}; } // args;
-        flagName = name : "${name}Support";
+        flagName = name: "${name}Support";
-        cfgWithDefaults = (listToAttrs (map (n : nameValuePair (flagName n) false) (attrNames args2.flags)))
+        cfgWithDefaults = (listToAttrs (map (n: nameValuePair (flagName n) false) (attrNames args2.flags)))
                          // args2.cfg;
-        opts = attrValues (mapAttrs (a : v :
+        opts = attrValues (mapAttrs (a: v:
                let v2 = if v ? set || v ? unset then v else { set = v; };
                    n = if cfgWithDefaults.${flagName a} then "set" else "unset";
                    attr = maybeAttr n {} v2; in
@@ -420,4 +423,12 @@ rec {
      else if isInt x then "int"
      else "string";
  /* deprecated:
     For historical reasons, imap has an index starting at 1.
     But for consistency with the rest of the library we want an index
     starting at zero.
  */
  imap = imap1;
 }
@@ -1,4 +1,4 @@
-# snippets that can be shared by mutliple fetchers (pkgs/build-support)
+# snippets that can be shared by multiple fetchers (pkgs/build-support)
 {
  proxyImpureEnvVars = [
@@ -1,4 +1,22 @@
-{ # locateDominatingFile :  RegExp
+{ # haskellPathsInDir : Path -> Map String Path
  # A map of all haskell packages defined in the given path,
  # identified by having a cabal file with the same name as the
  # directory itself.
  haskellPathsInDir = root:
    let # Files in the root
        root-files = builtins.attrNames (builtins.readDir root);
        # Files with their full paths
        root-files-with-paths =
          map (file:
            { name = file; value = root + "/${file}"; }
          ) root-files;
        # Subdirectories of the root with a cabal file.
        cabal-subdirs =
          builtins.filter ({ name, value }:
            builtins.pathExists (value + "/${name}.cabal")
          ) root-files-with-paths;
    in builtins.listToAttrs cabal-subdirs;
  # locateDominatingFile :  RegExp
  #                      -> Path
  #                      -> Nullable { path : Path;
  #                                    matches : [ MatchResults ];
@@ -0,0 +1,78 @@
 rec {
  # Compute the fixed point of the given function `f`, which is usually an
  # attribute set that expects its final, non-recursive representation as an
  # argument:
  #
  #     f = self: { foo = "foo"; bar = "bar"; foobar = self.foo + self.bar; }
  #
  # Nix evaluates this recursion until all references to `self` have been
  # resolved. At that point, the final result is returned and `f x = x` holds:
  #
  #     nix-repl> fix f
  #     { bar = "bar"; foo = "foo"; foobar = "foobar"; }
  #
  #  Type: fix :: (a -> a) -> a
  #
  # See https://en.wikipedia.org/wiki/Fixed-point_combinator for further
  # details.
  fix = f: let x = f x; in x;
  # A variant of `fix` that records the original recursive attribute set in the
  # result. This is useful in combination with the `extends` function to
  # implement deep overriding. See pkgs/development/haskell-modules/default.nix
  # for a concrete example.
  fix' = f: let x = f x // { __unfix__ = f; }; in x;
  # Modify the contents of an explicitly recursive attribute set in a way that
  # honors `self`-references. This is accomplished with a function
  #
  #     g = self: super: { foo = super.foo + " + "; }
  #
  # that has access to the unmodified input (`super`) as well as the final
  # non-recursive representation of the attribute set (`self`). `extends`
  # differs from the native `//` operator insofar as that it's applied *before*
  # references to `self` are resolved:
  #
  #     nix-repl> fix (extends g f)
  #     { bar = "bar"; foo = "foo + "; foobar = "foo + bar"; }
  #
  # The name of the function is inspired by object-oriented inheritance, i.e.
  # think of it as an infix operator `g extends f` that mimics the syntax from
  # Java. It may seem counter-intuitive to have the "base class" as the second
  # argument, but it's nice this way if several uses of `extends` are cascaded.
  extends = f: rattrs: self: let super = rattrs self; in super // f self super;
  # Compose two extending functions of the type expected by 'extends'
  # into one where changes made in the first are available in the
  # 'super' of the second
  composeExtensions =
    f: g: self: super:
      let fApplied = f self super;
          super' = super // fApplied;
      in fApplied // g self super';
  # Create an overridable, recursive attribute set. For example:
  #
  #     nix-repl> obj = makeExtensible (self: { })
  #
  #     nix-repl> obj
  #     { __unfix__ = «lambda»; extend = «lambda»; }
  #
  #     nix-repl> obj = obj.extend (self: super: { foo = "foo"; })
  #
  #     nix-repl> obj
  #     { __unfix__ = «lambda»; extend = «lambda»; foo = "foo"; }
  #
  #     nix-repl> obj = obj.extend (self: super: { foo = super.foo + " + "; bar = "bar"; foobar = self.foo + self.bar; })
  #
  #     nix-repl> obj
  #     { __unfix__ = «lambda»; bar = "bar"; extend = «lambda»; foo = "foo + "; foobar = "foo + bar"; }
  makeExtensible = makeExtensibleWithCustomName "extend";
  # Same as `makeExtensible` but the name of the extending attribute is
  # customized.
  makeExtensibleWithCustomName = extenderName: rattrs:
    fix' rattrs // {
      ${extenderName} = f: makeExtensibleWithCustomName extenderName (extends f rattrs);
   };
 }
@@ -90,4 +90,41 @@ rec {
    * parsers as well.
    */
  toYAML = {}@args: toJSON args;
  /* Pretty print a value, akin to `builtins.trace`.
    * Should probably be a builtin as well.
    */
  toPretty = {
    /* If this option is true, attrsets like { __pretty = fn; val = …; }
       will use fn to convert val to a pretty printed representation.
       (This means fn is type Val -> String.) */
    allowPrettyValues ? false
  }@args: v: with builtins;
    if      isInt      v then toString v
    else if isBool     v then (if v == true then "true" else "false")
    else if isString   v then "\"" + v + "\""
    else if null ==    v then "null"
    else if isFunction v then
      let fna = functionArgs v;
          showFnas = concatStringsSep "," (libAttr.mapAttrsToList
                       (name: hasDefVal: if hasDefVal then "(${name})" else name)
                       fna);
      in if fna == {}    then "<λ>"
                         else "<λ:{${showFnas}}>"
    else if isList     v then "[ "
        + libStr.concatMapStringsSep " " (toPretty args) v
      + " ]"
    else if isAttrs    v then
      # apply pretty values if allowed
      if attrNames v == [ "__pretty" "val" ] && allowPrettyValues
         then v.__pretty v.val
      # TODO: there is probably a better representation?
      else if v ? type && v.type == "derivation" then "<δ>"
      else "{ "
          + libStr.concatStringsSep " " (libAttr.mapAttrsToList
              (name: value:
                "${toPretty args name} = ${toPretty args value};") v)
        + " }"
    else "toPretty: should never happen (v = ${v})";
 }
@@ -45,6 +45,11 @@ lib.mapAttrs (n: v: v // { shortName = n; }) rec {
    fullName = "Apple Public Source License 2.0";
  };
  arphicpl = {
    fullName = "Arphic Public License";
    url = https://www.freedesktop.org/wiki/Arphic_Public_License/;
  };
  artistic1 = spdx {
    spdxId = "Artistic-1.0";
    fullName = "Artistic License 1.0";
@@ -357,6 +362,11 @@ lib.mapAttrs (n: v: v // { shortName = n; }) rec {
    fullName = "Lucent Public License v1.02";
  };
  miros = {
    fullname = "MirOS License";
    url = https://opensource.org/licenses/MirOS;
  };
  # spdx.org does not (yet) differentiate between the X11 and Expat versions
  # for details see http://en.wikipedia.org/wiki/MIT_License#Various_versions
  mit = spdx {
@@ -526,6 +536,11 @@ lib.mapAttrs (n: v: v // { shortName = n; }) rec {
    fullName = "Do What The F*ck You Want To Public License";
  };
  wxWindows = spdx {
    spdxId = "WXwindows";
    fullName = "wxWindows Library Licence, Version 3.1";
  };
  zlib = spdx {
    spdxId = "Zlib";
    fullName = "zlib License";
@@ -16,17 +16,22 @@ rec {
  */
  singleton = x: [x];
-  /* "Fold" a binary function `op' between successive elements of
+  /* “right fold” a binary function `op' between successive elements of
-     `list' with `nul' as the starting value, i.e., `fold op nul [x_1
+     `list' with `nul' as the starting value, i.e.,
-     x_2 ... x_n] == op x_1 (op x_2 ... (op x_n nul))'.  (This is
+     `foldr op nul [x_1 x_2 ... x_n] == op x_1 (op x_2 ... (op x_n nul))'.
-     Haskell's foldr).
+     Type:
       foldr :: (a -> b -> b) -> b -> [a] -> b
     Example:
-       concat = fold (a: b: a + b) "z"
+       concat = foldr (a: b: a + b) "z"
       concat [ "a" "b" "c" ]
       => "abcz"
       # different types
       strange = foldr (int: str: toString (int + 1) + str) "a"
       strange [ 1 2 3 4 ]
       => "2345a"
  */
-  fold = op: nul: list:
+  foldr = op: nul: list:
    let
      len = length list;
      fold' = n:
@@ -35,13 +40,25 @@ rec {
        else op (elemAt list n) (fold' (n + 1));
    in fold' 0;
-  /* Left fold: `fold op nul [x_1 x_2 ... x_n] == op (... (op (op nul
+  /* `fold' is an alias of `foldr' for historic reasons */
-     x_1) x_2) ... x_n)'.
+  # FIXME(Profpatsch): deprecate?
  fold = foldr;
  /* “left fold”, like `foldr', but from the left:
     `foldl op nul [x_1 x_2 ... x_n] == op (... (op (op nul x_1) x_2) ... x_n)`.
     Type:
       foldl :: (b -> a -> b) -> b -> [a] -> b
     Example:
       lconcat = foldl (a: b: a + b) "z"
       lconcat [ "a" "b" "c" ]
       => "zabc"
       # different types
       lstrange = foldl (str: int: str + toString (int + 1)) ""
       strange [ 1 2 3 4 ]
       => "a2345"
  */
  foldl = op: nul: list:
    let
@@ -52,7 +69,7 @@ rec {
        else op (foldl' (n - 1)) (elemAt list n);
    in foldl' (length list - 1);
-  /* Strict version of foldl.
+  /* Strict version of `foldl'.
     The difference is that evaluation is forced upon access. Usually used
     with small whole results (in contract with lazily-generated list or large
@@ -60,15 +77,21 @@ rec {
  */
  foldl' = builtins.foldl' or foldl;
-  /* Map with index
+  /* Map with index starting from 0
     FIXME(zimbatm): why does this start to count at 1?
     Example:
-       imap (i: v: "${v}-${toString i}") ["a" "b"]
+       imap0 (i: v: "${v}-${toString i}") ["a" "b"]
       => [ "a-0" "b-1" ]
  */
  imap0 = f: list: genList (n: f n (elemAt list n)) (length list);
  /* Map with index starting from 1
     Example:
       imap1 (i: v: "${v}-${toString i}") ["a" "b"]
       => [ "a-1" "b-2" ]
  */
-  imap = f: list: genList (n: f (n + 1) (elemAt list n)) (length list);
+  imap1 = f: list: genList (n: f (n + 1) (elemAt list n)) (length list);
  /* Map and concatenate the result.
@@ -140,7 +163,7 @@ rec {
       any isString [ 1 { } ]
       => false
  */
-  any = builtins.any or (pred: fold (x: y: if pred x then true else y) false);
+  any = builtins.any or (pred: foldr (x: y: if pred x then true else y) false);
  /* Return true iff function `pred' returns true for all elements of
     `list'.
@@ -151,7 +174,7 @@ rec {
       all (x: x < 3) [ 1 2 3 ]
       => false
  */
-  all = builtins.all or (pred: fold (x: y: if pred x then y else false) true);
+  all = builtins.all or (pred: foldr (x: y: if pred x then y else false) true);
  /* Count how many times function `pred' returns true for the elements
     of `list'.
@@ -174,7 +197,7 @@ rec {
  */
  optional = cond: elem: if cond then [elem] else [];
-  /* Return a list or an empty list, dependening on a boolean value.
+  /* Return a list or an empty list, depending on a boolean value.
     Example:
       optionals true [ 2 3 ]
@@ -219,7 +242,7 @@ rec {
       => { right = [ 5 3 4 ]; wrong = [ 1 2 ]; }
  */
  partition = builtins.partition or (pred:
-    fold (h: t:
+    foldr (h: t:
      if pred h
      then { right = [h] ++ t.right; wrong = t.wrong; }
      else { right = t.right; wrong = [h] ++ t.wrong; }
@@ -454,4 +477,12 @@ rec {
  */
  subtractLists = e: filter (x: !(elem x e));
  /* Test if two lists have no common element.
     It should be slightly more efficient than (intersectLists a b == [])
  */
  mutuallyExclusive = a: b:
    (builtins.length a) == 0 ||
    (!(builtins.elem (builtins.head a) b) &&
     mutuallyExclusive (builtins.tail a) b);
 }
@@ -14,7 +14,9 @@
  aboseley = "Adam Boseley <adam.boseley@gmail.com>";
  abuibrahim = "Ruslan Babayev <ruslan@babayev.com>";
  acowley = "Anthony Cowley <acowley@gmail.com>";
  adelbertc = "Adelbert Chang <adelbertc@gmail.com>";
  adev = "Adrien Devresse <adev@adev.name>";
  adisbladis = "Adam Hose <adis@blad.is>";
  Adjective-Object = "Maxwell Huang-Hobbs <mhuan13@gmail.com>";
  adnelson = "Allen Nelson <ithinkican@gmail.com>";
  adolfogc = "Adolfo E. García Castro <adolfo.garcia.cr@gmail.com>";
@@ -24,6 +26,7 @@
  aforemny = "Alexander Foremny <alexanderforemny@googlemail.com>";
  afranchuk = "Alex Franchuk <alex.franchuk@gmail.com>";
  aherrmann = "Andreas Herrmann <andreash87@gmx.ch>";
  ahmedtd = "Taahir Ahmed <ahmed.taahir@gmail.com>";
  ak = "Alexander Kjeldaas <ak@formalprivacy.com>";
  akaWolf = "Artjom Vejsel <akawolf0@gmail.com>";
  akc = "Anders Claesson <akc@akc.is>";
@@ -40,7 +43,9 @@
  andrewrk = "Andrew Kelley <superjoe30@gmail.com>";
  andsild = "Anders Sildnes <andsild@gmail.com>";
  aneeshusa = "Aneesh Agrawal <aneeshusa@gmail.com>";
  ankhers = "Justin Wood <justin.k.wood@gmail.com>";
  antono = "Antono Vasiljev <self@antono.info>";
  apeschar = "Albert Peschar <albert@peschar.net>";
  apeyroux = "Alexandre Peyroux <alex@px.io>";
  ardumont = "Antoine R. Dumont <eniotna.t@gmail.com>";
  aristid = "Aristid Breitkreuz <aristidb@gmail.com>";
@@ -58,8 +63,9 @@
  bachp = "Pascal Bach <pascal.bach@nextrem.ch>";
  badi = "Badi' Abdul-Wahid <abdulwahidc@gmail.com>";
  balajisivaraman = "Balaji Sivaraman<sivaraman.balaji@gmail.com>";
  barrucadu = "Michael Walker <mike@barrucadu.co.uk>";
  basvandijk = "Bas van Dijk <v.dijk.bas@gmail.com>";
  Baughn = "Svein Ove Aas <sveina@gmail.com>";
  bbenoist = "Baptist BENOIST <return_0@live.com>";
  bcarrell = "Brandon Carrell <brandoncarrell@gmail.com>";
  bcdarwin = "Ben Darwin <bcdarwin@gmail.com>";
  bdimcheff = "Brandon Dimcheff <brandon@dimcheff.com>";
@@ -68,9 +74,11 @@
  benwbooth = "Ben Booth <benwbooth@gmail.com>";
  berdario = "Dario Bertini <berdario@gmail.com>";
  bergey = "Daniel Bergey <bergey@teallabs.org>";
  bhipple = "Benjamin Hipple <bhipple@protonmail.com>";
  bjg = "Brian Gough <bjg@gnu.org>";
  bjornfor = "Bjørn Forsman <bjorn.forsman@gmail.com>";
  bluescreen303 = "Mathijs Kwik <mathijs@bluescreen303.nl>";
  bobakker = "Bo Bakker <bobakk3r@gmail.com>";
  bobvanderlinden = "Bob van der Linden <bobvanderlinden@gmail.com>";
  bodil = "Bodil Stokke <nix@bodil.org>";
  boothead = "Ben Ford <ben@perurbis.com>";
@@ -81,6 +89,7 @@
  bzizou = "Bruno Bzeznik <Bruno@bzizou.net>";
  c0dehero = "CodeHero <codehero@nerdpol.ch>";
  calrama = "Moritz Maxeiner <moritz@ucworks.org>";
  calvertvl = "Victor Calvert <calvertvl@gmail.com>";
  campadrenalin = "Philip Horger <campadrenalin@gmail.com>";
  canndrew = "Andrew Cann <shum@canndrew.org>";
  carlsverre = "Carl Sverre <accounts@carlsverre.com>";
@@ -93,6 +102,7 @@
  chris-martin = "Chris Martin <ch.martin@gmail.com>";
  chrisjefferson = "Christopher Jefferson <chris@bubblescope.net>";
  christopherpoole = "Christopher Mark Poole <mail@christopherpoole.net>";
  ciil = "Simon Lackerbauer <simon@lackerbauer.com>";
  ckampka = "Christian Kampka <christian@kampka.net>";
  cko = "Christine Koppelt <christine.koppelt@gmail.com>";
  cleverca22 = "Michael Bishop <cleverca22@gmail.com>";
@@ -102,6 +112,7 @@
  codsl = "codsl <codsl@riseup.net>";
  codyopel = "Cody Opel <codyopel@gmail.com>";
  colemickens = "Cole Mickens <cole.mickens@gmail.com>";
  colescott = "Cole Scott <colescottsf@gmail.com>";
  copumpkin = "Dan Peebles <pumpkingod@gmail.com>";
  corngood = "David McFarland <corngood@gmail.com>";
  coroa = "Jonas Hörsch <jonas@chaoflow.net>";
@@ -125,6 +136,7 @@
  deepfire = "Kosyrev Serge <_deepfire@feelingofgreen.ru>";
  demin-dmitriy = "Dmitriy Demin <demindf@gmail.com>";
  DerGuteMoritz = "Moritz Heidkamp <moritz@twoticketsplease.de>";
  dermetfan = "Robin Stumm <serverkorken@gmail.com>";
  DerTim1 = "Tim Digel <tim.digel@active-group.de>";
  desiderius = "Didier J. Devroye <didier@devroye.name>";
  devhell = "devhell <\"^\"@regexmail.net>";
@@ -132,18 +144,24 @@
  dfoxfranke = "Daniel Fox Franke <dfoxfranke@gmail.com>";
  dgonyeo = "Derek Gonyeo <derek@gonyeo.com>";
  dipinhora = "Dipin Hora <dipinhora+github@gmail.com>";
  disassembler = "Samuel Leathers <disasm@gmail.com>";
  dmalikov = "Dmitry Malikov <malikov.d.y@gmail.com>";
  DmitryTsygankov = "Dmitry Tsygankov <dmitry.tsygankov@gmail.com>";
  dmjio = "David Johnson <djohnson.m@gmail.com>";
  dochang = "Desmond O. Chang <dochang@gmail.com>";
  domenkozar = "Domen Kozar <domen@dev.si>";
  dotlambda = "Robert Schütz <rschuetz17@gmail.com>";
  doublec = "Chris Double <chris.double@double.co.nz>";
  dpaetzel = "David Pätzel <david.a.paetzel@gmail.com>";
  drets = "Dmytro Rets <dmitryrets@gmail.com>";
  drewkett = "Andrew Burkett <burkett.andrew@gmail.com>";
  dsferruzza = "David Sferruzza <david.sferruzza@gmail.com>";
  dtzWill = "Will Dietz <nix@wdtz.org>";
  dywedir = "Vladyslav M. <dywedir@protonmail.ch>";
  e-user = "Alexander Kahl <nixos@sodosopa.io>";
  ebzzry = "Rommel Martinez <ebzzry@gmail.com>";
  edanaher = "Evan Danaher <nixos@edanaher.net>";
  edef = "edef <edef@edef.eu>";
  ederoyd46 = "Matthew Brown <matt@ederoyd.co.uk>";
  eduarrrd = "Eduard Bachmakov <e.bachmakov@gmail.com>";
  edwtjo = "Edward Tjörnhammar <ed@cflags.cc>";
@@ -151,10 +169,13 @@
  ehegnes = "Eric Hegnes <eric.hegnes@gmail.com>";
  ehmry = "Emery Hemingway <emery@vfemail.net>";
  eikek = "Eike Kettner <eike.kettner@posteo.de>";
  ekleog = "Leo Gaspard <leo@gaspard.io>";
  elasticdog = "Aaron Bull Schaefer <aaron@elasticdog.com>";
  eleanor = "Dejan Lukan <dejan@proteansec.com>";
  elijahcaine = "Elijah Caine <elijahcainemv@gmail.com>";
  elitak = "Eric Litak <elitak@gmail.com>";
  ellis = "Ellis Whitehead <nixos@ellisw.net>";
  eperuffo = "Emanuele Peruffo <info@emanueleperuffo.com>";
  epitrochoid = "Mabry Cervin <mpcervin@uncg.edu>";
  ericbmerritt = "Eric Merritt <eric@afiniate.com>";
  ericsagnes = "Eric Sagnes <eric.sagnes@gmail.com>";
@@ -165,7 +186,9 @@
  exlevan = "Alexey Levan <exlevan@gmail.com>";
  expipiplus1 = "Joe Hermaszewski <nix@monoid.al>";
  fadenb = "Tristan Helmich <tristan.helmich+nixos@gmail.com>";
  fare = "Francois-Rene Rideau <fahree@gmail.com>";
  falsifian = "James Cook <james.cook@utoronto.ca>";
  florianjacob = "Florian Jacob <projects+nixos@florianjacob.de>";
  flosse = "Markus Kohlhase <mail@markus-kohlhase.de>";
  fluffynukeit = "Daniel Austin <dan@fluffynukeit.com>";
  fmthoma = "Franz Thoma <f.m.thoma@googlemail.com>";
@@ -179,12 +202,14 @@
  ftrvxmtrx = "Siarhei Zirukin <ftrvxmtrx@gmail.com>";
  funfunctor = "Edward O'Callaghan <eocallaghan@alterapraxis.com>";
  fuuzetsu = "Mateusz Kowalczyk <fuuzetsu@fuuzetsu.co.uk>";
  fuzzy-id = "Thomas Bach <hacking+nixos@babibo.de>";
  fxfactorial = "Edgar Aroutiounian <edgar.factorial@gmail.com>";
  gal_bolle = "Florent Becker <florent.becker@ens-lyon.org>";
  garbas = "Rok Garbas <rok@garbas.si>";
  garrison = "Jim Garrison <jim@garrison.cc>";
  gavin = "Gavin Rogers <gavin@praxeology.co.uk>";
  gebner = "Gabriel Ebner <gebner@gebner.org>";
  georgewhewell = "George Whewell <georgerw@gmail.com>";
  gilligan = "Tobias Pflug <tobias.pflug@gmail.com>";
  giogadi = "Luis G. Torres <lgtorres42@gmail.com>";
  gleber = "Gleb Peregud <gleber.p@gmail.com>";
@@ -195,6 +220,7 @@
  goodrone = "Andrew Trachenko <goodrone@gmail.com>";
  gpyh = "Yacine Hmito <yacine.hmito@gmail.com>";
  grahamc = "Graham Christensen <graham@grahamc.com>";
  grburst = "Julius Elias <grburst@openmailbox.org>";
  gridaphobe = "Eric Seidel <eric@seidel.io>";
  guibert = "David Guibert <david.guibert@gmail.com>";
  guillaumekoenig = "Guillaume Koenig <guillaume.edward.koenig@gmail.com>";
@@ -203,39 +229,54 @@
  havvy = "Ryan Scheel <ryan.havvy@gmail.com>";
  hbunke = "Hendrik Bunke <bunke.hendrik@gmail.com>";
  hce = "Hans-Christian Esperer <hc@hcesperer.org>";
  hectorj = "Hector Jusforgues <hector.jusforgues+nixos@gmail.com>";
  heel = "Sergii Paryzhskyi <parizhskiy@gmail.com>";
  henrytill = "Henry Till <henrytill@gmail.com>";
  hhm = "hhm <heehooman+nixpkgs@gmail.com>";
  hinton = "Tom Hinton <t@larkery.com>";
  hodapp = "Chris Hodapp <hodapp87@gmail.com>";
  hrdinka = "Christoph Hrdinka <c.nix@hrdinka.at>";
  htr = "Hugo Tavares Reis <hugo@linux.com>";
  iand675 = "Ian Duncan <ian@iankduncan.com>";
  ianwookim = "Ian-Woo Kim <ianwookim@gmail.com>";
  igsha = "Igor Sharonov <igor.sharonov@gmail.com>";
  ikervagyok = "Balázs Lengyel <ikervagyok@gmail.com>";
  infinisil = "Silvan Mosberger <infinisil@icloud.com";
  ivan-tkatchev = "Ivan Tkatchev <tkatchev@gmail.com>";
  j-keck = "Jürgen Keck <jhyphenkeck@gmail.com>";
  jagajaga = "Arseniy Seroka <ars.seroka@gmail.com>";
  jammerful = "jammerful <jammerful@gmail.com>";
  jansol = "Jan Solanti <jan.solanti@paivola.fi>";
  javaguirre = "Javier Aguirre <contacto@javaguirre.net>";
  jb55 = "William Casarin <bill@casarin.me>";
  jbedo = "Justin Bedő <cu@cua0.org>";
  jcumming = "Jack Cummings <jack@mudshark.org>";
  jdagilliland = "Jason Gilliland <jdagilliland@gmail.com>";
  jefdaj = "Jeffrey David Johnson <jefdaj@gmail.com>";
  jensbin = "Jens Binkert <jensbin@protonmail.com>";
  jerith666 = "Matt McHenry <github@matt.mchenryfamily.org>";
  jfb = "James Felix Black <james@yamtime.com>";
  jfrankenau = "Johannes Frankenau <johannes@frankenau.net>";
  jgeerds = "Jascha Geerds <jascha@jgeerds.name>";
  jgertm = "Tim Jaeger <jger.tm@gmail.com>";
  jgillich = "Jakob Gillich <jakob@gillich.me>";
  jhhuh = "Ji-Haeng Huh <jhhuh.note@gmail.com>";
  jirkamarsik = "Jirka Marsik <jiri.marsik89@gmail.com>";
  jlesquembre = "José Luis Lafuente <jl@lafuente.me>";
  jluttine = "Jaakko Luttinen <jaakko.luttinen@iki.fi>";
  joachifm = "Joachim Fasting <joachifm@fastmail.fm>";
  joamaki = "Jussi Maki <joamaki@gmail.com>";
  joelmo = "Joel Moberg <joel.moberg@gmail.com>";
  joelteon = "Joel Taylor <me@joelt.io>";
  johbo = "Johannes Bornhold <johannes@bornhold.name>";
  johnramsden = "John Ramsden <johnramsden@riseup.net>";
  joko = "Ioannis Koutras <ioannis.koutras@gmail.com>";
  jonafato = "Jon Banafato <jon@jonafato.com>";
  jpbernardy = "Jean-Philippe Bernardy <jeanphilippe.bernardy@gmail.com>";
  jpierre03 = "Jean-Pierre PRUNARET <nix@prunetwork.fr>";
  jpotier = "Martin Potier <jpo.contributes.to.nixos@marvid.fr>";
  jraygauthier = "Raymond Gauthier <jraygauthier@gmail.com>";
  jtojnar = "Jan Tojnar <jtojnar@gmail.com>";
  juliendehos = "Julien Dehos <dehos@lisic.univ-littoral.fr>";
  jwiegley = "John Wiegley <johnw@newartisans.com>";
  jwilberding = "Jordan Wilberding <jwilberding@afiniate.com>";
@@ -243,6 +284,7 @@
  kaiha = "Kai Harries <kai.harries@gmail.com>";
  kamilchm = "Kamil Chmielewski <kamil.chm@gmail.com>";
  kampfschlaefer = "Arnold Krille <arnold@arnoldarts.de>";
  kentjames = "James Kent <jameschristopherkent@gmail.com";
  kevincox = "Kevin Cox <kevincox@kevincox.ca>";
  khumba = "Bryan Gardiner <bog@khumba.net>";
  KibaFox = "Kiba Fox <kiba.fox@foxypossibilities.com>";
@@ -276,9 +318,12 @@
  lsix = "Lancelot SIX <lsix@lancelotsix.com>";
  lucas8 = "Luc Chabassier <luc.linux@mailoo.org>";
  ludo = "Ludovic Courtès <ludo@gnu.org>";
  lufia = "Kyohei Kadota <lufia@lufia.org>";
  luispedro = "Luis Pedro Coelho <luis@luispedro.org>";
  lukego = "Luke Gorrie <luke@snabb.co>";
  lw = "Sergey Sofeychuk <lw@fmap.me>";
  lyt = "Tim Liou <wheatdoge@gmail.com>";
  m3tti = "Mathaeus Sander <mathaeus.peter.sander@gmail.com>";
  ma27 = "Maximilian Bosch <maximilian@mbosch.me>";
  madjar = "Georges Dubus <georges.dubus@compiletoi.net>";
  magnetophon = "Bart Brouns <bart@magnetophon.nl>";
@@ -311,7 +356,9 @@
  michaelpj = "Michael Peyton Jones <michaelpj@gmail.com>";
  michalrus = "Michal Rus <m@michalrus.com>";
  michelk = "Michel Kuhlmann <michel@kuhlmanns.info>";
  midchildan = "midchildan <midchildan+nix@gmail.com>";
  mikefaille = "Michaël Faille <michael@faille.io>";
  miltador = "Vasiliy Solovey <miltador@yandex.ua>";
  mimadrid = "Miguel Madrid <mimadrid@ucm.es>";
  mingchuan = "Ming Chuan <ming@culpring.com>";
  mirdhyn = "Merlin Gaillard <mirdhyn@gmail.com>";
@@ -332,6 +379,7 @@
  msackman = "Matthew Sackman <matthew@wellquite.org>";
  mschristiansen = "Mikkel Christiansen <mikkel@rheosystems.com>";
  msteen = "Matthijs Steen <emailmatthijs@gmail.com>";
  mt-caret = "Masayuki Takeda <mtakeda.enigsol@gmail.com>";
  mtreskin = "Max Treskin <zerthurd@gmail.com>";
  mudri = "James Wood <lamudri@gmail.com>";
  muflax = "Stefan Dorn <mail@muflax.com>";
@@ -340,10 +388,12 @@
  nand0p = "Fernando Jose Pando <nando@hex7.com>";
  Nate-Devv = "Nathan Moore <natedevv@gmail.com>";
  nathan-gs = "Nathan Bijnens <nathan@nathan.gs>";
-  nckx = "Tobias Geerinckx-Rice <tobias.geerinckx.rice@gmail.com>";
+  nckx = "Tobias Geerinckx-Rice <github@tobias.gr>";
  ndowens = "Nathan Owens <ndowens04@gmail.com>";
  neeasade = "Nathan Isom <nathanisom27@gmail.com>";
  nequissimus = "Tim Steinbach <tim@nequissimus.com>";
  nfjinjing = "Jinjing Wang <nfjinjing@gmail.com>";
  nh2 = "Niklas Hambüchen <mail@nh2.me>";
  nhooyr = "Anmol Sethi <anmol@aubble.com>";
  nickhu = "Nick Hu <me@nickhu.co.uk>";
  nicknovitski = "Nick Novitski <nixpkgs@nicknovitski.com>";
@@ -363,6 +413,7 @@
  okasu = "Okasu <oka.sux@gmail.com>";
  olcai = "Erik Timan <dev@timan.info>";
  olejorgenb = "Ole Jørgen Brønner <olejorgenb@yahoo.no>";
  olynch = "Owen Lynch <owen@olynch.me>";
  orbekk = "KJ Ørbekk <kjetil.orbekk@gmail.com>";
  orbitz = "Malcolm Matalka <mmatalka@gmail.com>";
  orivej = "Orivej Desh <orivej@gmx.fr>";
@@ -372,9 +423,12 @@
  paholg = "Paho Lurie-Gregg <paho@paholg.com>";
  pakhfn = "Fedor Pakhomov <pakhfn@gmail.com>";
  palo = "Ingolf Wanger <palipalo9@googlemail.com>";
  panaeon = "Vitalii Voloshyn <vitalii.voloshyn@gmail.com";
  paperdigits = "Mica Semrick <mica@silentumbrella.com>";
  pashev = "Igor Pashev <pashev.igor@gmail.com>";
  patternspandemic = "Brad Christensen <patternspandemic@live.com>";
  pawelpacana = "Paweł Pacana <pawel.pacana@gmail.com>";
  pbogdan = "Piotr Bogdan <ppbogdan@gmail.com>";
  periklis = "theopompos@gmail.com";
  pesterhazy = "Paulus Esterhazy <pesterhazy@gmail.com>";
  peterhoeg = "Peter Hoeg <peter@hoeg.com>";
@@ -391,6 +445,7 @@
  pjones = "Peter Jones <pjones@devalot.com>";
  pkmx = "Chih-Mao Chen <pkmx.tw@gmail.com>";
  plcplc = "Philip Lykke Carlsen <plcplc@gmail.com>";
  plumps = "Maksim Bronsky <maks.bronsky@web.de";
  pmahoney = "Patrick Mahoney <pat@polycrystal.org>";
  pmiddend = "Philipp Middendorf <pmidden@secure.mailbox.org>";
  polyrod = "Maurizio Di Pietro <dc1mdp@gmail.com>";
@@ -420,43 +475,51 @@
  relrod = "Ricky Elrod <ricky@elrod.me>";
  renzo = "Renzo Carbonara <renzocarbonara@gmail.com>";
  retrry = "Tadas Barzdžius <retrry@gmail.com>";
  rht = "rht <rhtbot@protonmail.com>";
  rick68 = "Wei-Ming Yang <rick68@gmail.com>";
  rickynils = "Rickard Nilsson <rickynils@gmail.com>";
  ris = "Robert Scott <code@humanleg.org.uk>";
  rlupton20 = "Richard Lupton <richard.lupton@gmail.com>";
  rnhmjoj = "Michele Guerini Rocco <micheleguerinirocco@me.com>";
  rob = "Rob Vermaas <rob.vermaas@gmail.com>";
  robberer = "Longrin Wischnewski <robberer@freakmail.de>";
  robbinch = "Robbin C. <robbinch33@gmail.com>";
  roberth = "Robert Hensing <nixpkgs@roberthensing.nl>";
  robgssp = "Rob Glossop <robgssp@gmail.com>";
  roblabla = "Robin Lambertz <robinlambertz+dev@gmail.com>";
  roconnor = "Russell O'Connor <roconnor@theorem.ca>";
  romildo = "José Romildo Malaquias <malaquias@gmail.com>";
  rongcuid = "Rongcui Dong <rongcuid@outlook.com>";
-  ronny = "Ronny Pfannschmidt <nixos@ronnypfannschmidt.de>";
+  rszibele = "Richard Szibele <richard@szibele.com>";
  rszibele = "Richard Szibele <richard_szibele@hotmail.com>";
  rtreffer = "Rene Treffer <treffer+nixos@measite.de>";
  rushmorem = "Rushmore Mushambi <rushmore@webenchanter.com>";
  rvl = "Rodney Lorrimar <dev+nix@rodney.id.au>";
  rvlander = "Gaëtan André <rvlander@gaetanandre.eu>";
  rvolosatovs = "Roman Volosatovs <rvolosatovs@riseup.net";
  ryanartecona = "Ryan Artecona <ryanartecona@gmail.com>";
  ryansydnor = "Ryan Sydnor <ryan.t.sydnor@gmail.com>";
  ryantm = "Ryan Mulligan <ryan@ryantm.com>";
  rycee = "Robert Helgesson <robert@rycee.net>";
  ryneeverett = "Ryne Everett <ryneeverett@gmail.com>";
  rzetterberg = "Richard Zetterberg <richard.zetterberg@gmail.com>";
  s1lvester = "Markus Silvester <s1lvester@bockhacker.me>";
  samuelrivas = "Samuel Rivas <samuelrivas@gmail.com>";
  sander = "Sander van der Burg <s.vanderburg@tudelft.nl>";
  sargon = "Daniel Ehlers <danielehlers@mindeye.net>";
  schmitthenner = "Fabian Schmitthenner <development@schmitthenner.eu>";
  schneefux = "schneefux <schneefux+nixos_pkg@schneefux.xyz>";
  schristo = "Scott Christopher <schristopher@konputa.com>";
  scolobb = "Sergiu Ivanov <sivanov@colimite.fr>";
  sepi = "Raffael Mancini <raffael@mancini.lu>";
  seppeljordan = "Sebastian Jordan <sebastian.jordan.mail@googlemail.com>";
  shanemikel = "Shane Pearlman <shanemikel1@gmail.com>";
  shawndellysse = "Shawn Dellysse <sdellysse@gmail.com>";
  sheenobu = "Sheena Artrip <sheena.artrip@gmail.com>";
  sheganinans = "Aistis Raulinaitis <sheganinans@gmail.com>";
  shell = "Shell Turner <cam.turn@gmail.com>";
  shlevy = "Shea Levy <shea@shealevy.com>";
  siddharthist = "Langston Barrett <langston.barrett@gmail.com>";
  sigma = "Yann Hodique <yann.hodique@gmail.com>";
  simonvandel = "Simon Vandel Sillesen <simon.vandel@gmail.com>";
  sjagoe = "Simon Jagoe <simon@simonjagoe.com>";
  sjmackenzie = "Stewart Mackenzie <setori88@gmail.com>";
@@ -465,6 +528,7 @@
  skrzyp = "Jakub Skrzypnik <jot.skrzyp@gmail.com>";
  sleexyz = "Sean Lee <freshdried@gmail.com>";
  smironov = "Sergey Mironov <grrwlf@gmail.com>";
  snyh = "Xia Bin <snyh@snyh.org>";
  solson = "Scott Olson <scott@solson.me>";
  spacefrogg = "Michael Raitza <spacefrogg-nixos@meterriblecrew.net>";
  spencerjanssen = "Spencer Janssen <spencerjanssen@gmail.com>";
@@ -477,7 +541,9 @@
  sternenseemann = "Lukas Epple <post@lukasepple.de>";
  stesie = "Stefan Siegl <stesie@brokenpipe.de>";
  steveej = "Stefan Junker <mail@stefanjunker.de>";
  SuprDewd = "Bjarki Ágúst Guðmundsson <suprdewd@gmail.com>";
  swarren83 = "Shawn Warren <shawn.w.warren@gmail.com>";
  swflint = "Samuel W. Flint <swflint@flintfam.org>";
  swistak35 = "Rafał Łasocha <me@swistak35.com>";
  szczyp = "Szczyp <qb@szczyp.com>";
  sztupi = "Attila Sztupak <attila.sztupak@gmail.com>";
@@ -485,6 +551,8 @@
  tailhook = "Paul Colomiets <paul@colomiets.name>";
  takikawa = "Asumu Takikawa <asumu@igalia.com>";
  taktoa = "Remy Goldschmidt <taktoa@gmail.com>";
  taku0 = "Takuo Yonezawa <mxxouy6x3m_github@tatapa.org>";
  tari = "Peter Marheine <peter@taricorp.net>";
  tavyc = "Octavian Cerna <octavian.cerna@gmail.com>";
  teh = "Tom Hunger <tehunger@gmail.com>";
  telotortium = "Robert Irelan <rirelan@gmail.com>";
@@ -498,17 +566,22 @@
  tohl = "Tomas Hlavaty <tom@logand.com>";
  tokudan = "Daniel Frank <git@danielfrank.net>";
  tomberek = "Thomas Bereknyei <tomberek@gmail.com>";
  tomsmeets = "Tom Smeets <tom@tsmeets.nl>";
  travisbhartwell = "Travis B. Hartwell <nafai@travishartwell.net>";
  trevorj = "Trevor Joynson <nix@trevor.joynson.io>";
  trino = "Hubert Mühlhans <muehlhans.hubert@ekodia.de>";
  tstrobel = "Thomas Strobel <4ZKTUB6TEP74PYJOPWIR013S2AV29YUBW5F9ZH2F4D5UMJUJ6S@hash.domains>";
  ttuegel = "Thomas Tuegel <ttuegel@mailbox.org>";
  tv = "Tomislav Viljetić <tv@shackspace.de>";
  tvestelind = "Tomas Vestelind <tomas.vestelind@fripost.org>";
  tvorog = "Marsel Zaripov <marszaripov@gmail.com>";
  tweber = "Thorsten Weber <tw+nixpkgs@360vier.de>";
  twey = "James ‘Twey’ Kay <twey@twey.co.uk>";
  uralbash = "Svintsov Dmitry <root@uralbash.ru>";
-  urkud = "Yury G. Kudryashov <urkud+nix@ya.ru>";
+  utdemir = "Utku Demir <me@utdemir.com>";
  #urkud = "Yury G. Kudryashov <urkud+nix@ya.ru>"; inactive since 2012
  uwap = "uwap <me@uwap.name>";
  vaibhavsagar = "Vaibhav Sagar <vaibhavsagar@gmail.com>";
  vandenoever = "Jos van den Oever <jos@vandenoever.info>";
  vanzef = "Ivan Solyankin <vanzef@gmail.com>";
  vbgl = "Vincent Laporte <Vincent.Laporte@gmail.com>";
@@ -522,10 +595,13 @@
  vklquevs = "vklquevs <vklquevs@gmail.com>";
  vlstill = "Vladimír Štill <xstill@fi.muni.cz>";
  vmandela = "Venkateswara Rao Mandela <venkat.mandela@gmail.com>";
  vmchale = "Vanessa McHale <tmchale@wisc.edu>";
  valeriangalliat = "Valérian Galliat <val@codejam.info>";
  volhovm = "Mikhail Volkhov <volhovm.cs@gmail.com>";
  volth = "Jaroslavas Pocepko <jaroslavas@volth.com>";
  vozz = "Oliver Hunt <oliver.huntuk@gmail.com>";
  vrthra = "Rahul Gopinath <rahul@gopinath.org>";
  vyp = "vyp <elisp.vim@gmail.com>";
  wedens = "wedens <kirill.wedens@gmail.com>";
  willtim = "Tim Philip Williams <tim.williams.public@gmail.com>";
  winden = "Antonio Vargas Gonzalez <windenntw@gmail.com>";
@@ -537,17 +613,22 @@
  wscott = "Wayne Scott <wsc9tt@gmail.com>";
  wyvie = "Elijah Rum <elijahrum@gmail.com>";
  xnwdd = "Guillermo NWDD <nwdd+nixos@no.team>";
  xvapx = "Marti Serra <marti.serra.coscollano@gmail.com>";
  xwvvvvwx = "David Terry <davidterry@posteo.de>";
  yarr = "Dmitry V. <savraz@gmail.com>";
  yochai = "Yochai <yochai@titat.info>";
  yorickvp = "Yorick van Pelt <yorickvanpelt@gmail.com>";
  yuriaisaka = "Yuri Aisaka <yuri.aisaka+nix@gmail.com>";
  yurrriq = "Eric Bailey <eric@ericb.me>";
  z77z = "Marco Maggesi <maggesi@math.unifi.it>";
  zagy = "Christian Zagrodnick <cz@flyingcircus.io>";
  zalakain = "Unai Zalakain <contact@unaizalakain.info>";
  zarelit = "David Costa <david@zarel.net>";
  zauberpony = "Elmar Athmer <elmar@athmer.org>";
  zef = "Zef Hemel <zef@zef.me>";
  zimbatm = "zimbatm <zimbatm@zimbatm.com>";
  zohl = "Al Zohali <zohl@fmap.me>";
  zoomulator = "Kim Simmons <zoomulator@gmail.com>";
  zraexy = "David Mell <zraexy@gmail.com>";
  zx2c4 = "Jason A. Donenfeld <Jason@zx2c4.com>";
 }
@@ -17,6 +17,11 @@ rec {
    drv // { meta = (drv.meta or {}) // newAttrs; };
  /* Disable Hydra builds of given derivation.
  */
  dontDistribute = drv: addMetaAttrs { hydraPlatforms = []; } drv;
  /* Change the symbolic name of a package for presentation purposes
     (i.e., so that nix-env users can tell them apart).
  */
@@ -45,7 +50,7 @@ rec {
  /* Decrease the nix-env priority of the package, i.e., other
     versions/variants of the package will be preferred.
  */
-  lowPrio = drv: addMetaAttrs { priority = "10"; } drv;
+  lowPrio = drv: addMetaAttrs { priority = 10; } drv;
  /* Apply lowPrio to an attrset with derivations
@@ -56,7 +61,7 @@ rec {
  /* Increase the nix-env priority of the package, i.e., this
     version/variant of the package will be preferred.
  */
-  hiPrio = drv: addMetaAttrs { priority = "-10"; } drv;
+  hiPrio = drv: addMetaAttrs { priority = -10; } drv;
  /* Apply hiPrio to an attrset with derivations
@@ -98,7 +98,7 @@ rec {
  /* Close a set of modules under the ‘imports’ relation. */
  closeModules = modules: args:
    let
-      toClosureList = file: parentKey: imap (n: x:
+      toClosureList = file: parentKey: imap1 (n: x:
        if isAttrs x || isFunction x then
          let key = "${parentKey}:anon-${toString n}"; in
          unifyModuleSyntax file key (unpackSubmodule (applyIfFunction key) x args)
@@ -114,7 +114,7 @@ rec {
  /* Massage a module into canonical form, that is, a set consisting
     of ‘options’, ‘config’ and ‘imports’ attributes. */
  unifyModuleSyntax = file: key: m:
-    let metaSet = if m ? meta 
+    let metaSet = if m ? meta
      then { meta = m.meta; }
      else {};
    in
@@ -423,7 +423,7 @@ rec {
    in concatMap (def: if getPrio def == highestPrio then [(strip def)] else []) defs;
  /* Sort a list of properties.  The sort priority of a property is
-     1000 by default, but can be overriden by wrapping the property
+     1000 by default, but can be overridden by wrapping the property
     using mkOrder. */
  sortProperties = defs:
    let
@@ -595,7 +595,7 @@ rec {
       functionality
     This show a warning if any a.b.c or d.e.f is set, and set the value of
-     x.y.z to the result of the merge function 
+     x.y.z to the result of the merge function
  */
  mkMergedOptionModule = from: to: mergeFn:
    { config, options, ... }:
@@ -611,12 +611,12 @@ rec {
          let val = getAttrFromPath f config;
              opt = getAttrFromPath f options;
          in
-          optionalString 
+          optionalString
            (val != "_mkMergedOptionModule")
            "The option `${showOption f}' defined in ${showFiles opt.files} has been changed to `${showOption to}' that has a different type. Please read `${showOption to}' documentation and update your configuration accordingly."
        ) from);
      } // setAttrByPath to (mkMerge
-             (optional 
+             (optional
               (any (f: (getAttrFromPath f config) != "_mkMergedOptionModule") from)
               (mergeFn config)));
    };
@@ -1,24 +0,0 @@
 let lists = import ./lists.nix; in
 rec {
  all = linux ++ darwin ++ cygwin ++ freebsd ++ openbsd ++ netbsd ++ illumos;
  allBut = platforms: lists.filter (x: !(builtins.elem x platforms)) all;
  none = [];
  arm = ["armv5tel-linux" "armv6l-linux" "armv7l-linux" ];
  i686 = ["i686-linux" "i686-freebsd" "i686-netbsd" "i686-cygwin"];
  mips = [ "mips64el-linux" ];
  x86_64 = ["x86_64-linux" "x86_64-darwin" "x86_64-freebsd" "x86_64-openbsd" "x86_64-netbsd" "x86_64-cygwin"];
  cygwin = ["i686-cygwin" "x86_64-cygwin"];
  darwin = ["x86_64-darwin"];
  freebsd = ["i686-freebsd" "x86_64-freebsd"];
  gnu = linux; /* ++ hurd ++ kfreebsd ++ ... */
  illumos = ["x86_64-solaris"];
  linux = ["i686-linux" "x86_64-linux" "armv5tel-linux" "armv6l-linux" "armv7l-linux" "aarch64-linux" "mips64el-linux"];
  netbsd = ["i686-netbsd" "x86_64-netbsd"];
  openbsd = ["i686-openbsd" "x86_64-openbsd"];
  unix = linux ++ darwin ++ freebsd ++ openbsd ++ netbsd ++ illumos;
  mesaPlatforms = ["i686-linux" "x86_64-linux" "x86_64-darwin" "armv5tel-linux" "armv6l-linux" "armv7l-linux" "aarch64-linux"];
 }
@@ -33,7 +33,7 @@ rec {
       concatImapStrings (pos: x: "${toString pos}-${x}") ["foo" "bar"]
       => "1-foo2-bar"
  */
-  concatImapStrings = f: list: concatStrings (lib.imap f list);
+  concatImapStrings = f: list: concatStrings (lib.imap1 f list);
  /* Place an element between each element of a list
@@ -70,7 +70,7 @@ rec {
       concatImapStringsSep "-" (pos: x: toString (x / pos)) [ 6 6 6 ]
       => "6-3-2"
  */
-  concatImapStringsSep = sep: f: list: concatStringsSep sep (lib.imap f list);
+  concatImapStringsSep = sep: f: list: concatStringsSep sep (lib.imap1 f list);
  /* Construct a Unix-style search path consisting of each `subDir"
     directory of the given list of packages.
@@ -126,8 +126,8 @@ rec {
  */
  makePerlPath = makeSearchPathOutput "lib" "lib/perl5/site_perl";
-  /* Dependening on the boolean `cond', return either the given string
+  /* Depending on the boolean `cond', return either the given string
-     or the empty string. Useful to contatenate against a bigger string.
+     or the empty string. Useful to concatenate against a bigger string.
     Example:
       optionalString true "some-string"
@@ -291,7 +291,7 @@ rec {
      recurse = index: startAt:
        let cutUntil = i: [(substring startAt (i - startAt) s)]; in
-        if index < lastSearch then
+        if index <= lastSearch then
          if startWithSep index then
            let restartAt = index + sepLen; in
            cutUntil index ++ recurse restartAt restartAt
@@ -438,8 +438,13 @@ rec {
       => true
       isStorePath pkgs.python
       => true
       isStorePath [] || isStorePath 42 || isStorePath {} || …
       => false
  */
-  isStorePath = x: builtins.substring 0 1 (toString x) == "/" && dirOf (builtins.toPath x) == builtins.storeDir;
+  isStorePath = x:
       builtins.isString x
    && builtins.substring 0 1 (toString x) == "/"
    && dirOf (builtins.toPath x) == builtins.storeDir;
  /* Convert string to int
     Obviously, it is a bit hacky to use fromJSON that way.
@@ -476,10 +481,8 @@ rec {
  readPathsFromFile = rootPath: file:
    let
      root = toString rootPath;
-      lines =
+      lines = lib.splitString "\n" (builtins.readFile file);
-        builtins.map (lib.removeSuffix "\n")
+      removeComments = lib.filter (line: line != "" && !(lib.hasPrefix "#" line));
        (lib.splitString "\n" (builtins.readFile file));
      removeComments = lib.filter (line: !(lib.hasPrefix "#" line));
      relativePaths = removeComments lines;
      absolutePaths = builtins.map (path: builtins.toPath (root + "/" + path)) relativePaths;
    in
@@ -1,126 +0,0 @@
 # Define the list of system with their properties.  Only systems tested for
 # Nixpkgs are listed below
 with import ./lists.nix;
 with import ./types.nix;
 with import ./attrsets.nix;
 let
  lib = import ./default.nix;
  setTypes = type:
    mapAttrs (name: value:
      setType type ({inherit name;} // value)
    );
 in
 rec {
  isSignificantByte = isType "significant-byte";
  significantBytes = setTypes "significant-byte" {
    bigEndian = {};
    littleEndian = {};
  };
  isCpuType = x: isType "cpu-type" x
    && elem x.bits [8 16 32 64 128]
    && (8 < x.bits -> isSignificantByte x.significantByte);
  cpuTypes = with significantBytes;
    setTypes "cpu-type" {
      arm =      { bits = 32; significantByte = littleEndian; };
      armv5tel = { bits = 32; significantByte = littleEndian; };
      armv7l   = { bits = 32; significantByte = littleEndian; };
      i686 =     { bits = 32; significantByte = littleEndian; };
      powerpc =  { bits = 32; significantByte = bigEndian; };
      x86_64 =   { bits = 64; significantByte = littleEndian; };
    };
  isExecFormat = isType "exec-format";
  execFormats = setTypes "exec-format" {
    aout = {}; # a.out
    elf = {};
    macho = {};
    pe = {};
    unknow = {};
  };
  isKernel = isType "kernel";
  kernels = with execFormats;
    setTypes "kernel" {
      cygwin =  { execFormat = pe; };
      darwin =  { execFormat = macho; };
      freebsd = { execFormat = elf; };
      linux =   { execFormat = elf; };
      netbsd =  { execFormat = elf; };
      none =    { execFormat = unknow; };
      openbsd = { execFormat = elf; };
      win32 =   { execFormat = pe; };
    };
  isArchitecture = isType "architecture";
  architectures = setTypes "architecture" {
    apple = {};
    pc = {};
    unknow = {};
  };
  isSystem = x: isType "system" x
    && isCpuType x.cpu
    && isArchitecture x.arch
    && isKernel x.kernel;
  mkSystem = {
    cpu ? cpuTypes.i686,
    arch ? architectures.pc,
    kernel ? kernels.linux,
    name ? "${cpu.name}-${arch.name}-${kernel.name}"
  }: setType "system" {
    inherit name cpu arch kernel;
  };
  is64Bit = matchAttrs { cpu = { bits = 64; }; };
  isDarwin = matchAttrs { kernel = kernels.darwin; };
  isi686 = matchAttrs { cpu = cpuTypes.i686; };
  isLinux = matchAttrs { kernel = kernels.linux; };
  # This should revert the job done by config.guess from the gcc compiler.
  mkSystemFromString = s: let
    l = lib.splitString "-" s;
    getCpu = name:
      attrByPath [name] (throw "Unknow cpuType `${name}'.")
        cpuTypes;
    getArch = name:
      attrByPath [name] (throw "Unknow architecture `${name}'.")
        architectures;
    getKernel = name:
      attrByPath [name] (throw "Unknow kernel `${name}'.")
        kernels;
    system =
      if builtins.length l == 2 then
        mkSystem rec {
          name = s;
          cpu = getCpu (head l);
          arch =
            if isDarwin system
            then architectures.apple
            else architectures.pc;
          kernel = getKernel (head (tail l));
        }
      else
        mkSystem {
          name = s;
          cpu = getCpu (head l);
          arch = getArch (head (tail l));
          kernel = getKernel (head (tail (tail l)));
        };
  in assert isSystem system; system;
 }
@@ -0,0 +1,34 @@
 let inherit (import ../attrsets.nix) mapAttrs; in
 rec {
  doubles = import ./doubles.nix;
  parse = import ./parse.nix;
  inspect = import ./inspect.nix;
  platforms = import ./platforms.nix;
  examples = import ./examples.nix;
  # Elaborate a `localSystem` or `crossSystem` so that it contains everything
  # necessary.
  #
  # `parsed` is inferred from args, both because there are two options with one
  # clearly prefered, and to prevent cycles. A simpler fixed point where the RHS
  # always just used `final.*` would fail on both counts.
  elaborate = args: let
    final = {
      # Prefer to parse `config` as it is strictly more informative.
      parsed = parse.mkSystemFromString (if args ? config then args.config else args.system);
      # Either of these can be losslessly-extracted from `parsed` iff parsing succeeds.
      system = parse.doubleFromSystem final.parsed;
      config = parse.tripleFromSystem final.parsed;
      # Just a guess, based on `system`
      platform = platforms.selectBySystem final.system;
      libc =
        /**/ if final.isDarwin then "libSystem"
        else if final.isMinGW  then "msvcrt"
        else if final.isLinux  then "glibc"
        # TODO(@Ericson2314) think more about other operating systems
        else                        "native/impure";
    } // mapAttrs (n: v: v final.parsed) inspect.predicates
      // args;
  in final;
 }
@@ -0,0 +1,46 @@
 let
  lists = import ../lists.nix;
  parse = import ./parse.nix;
  inherit (import ./inspect.nix) predicates;
  inherit (import ../attrsets.nix) matchAttrs;
  all = [
    "aarch64-linux"
    "armv5tel-linux" "armv6l-linux" "armv7l-linux"
    "mips64el-linux"
    "i686-cygwin" "i686-freebsd" "i686-linux" "i686-netbsd" "i686-openbsd"
    "x86_64-cygwin" "x86_64-darwin" "x86_64-freebsd" "x86_64-linux"
    "x86_64-netbsd" "x86_64-openbsd" "x86_64-solaris"
  ];
  allParsed = map parse.mkSystemFromString all;
  filterDoubles = f: map parse.doubleFromSystem (lists.filter f allParsed);
 in rec {
  inherit all;
  allBut = platforms: lists.filter (x: !(builtins.elem x platforms)) all;
  none = [];
  arm     = filterDoubles predicates.isArm32;
  i686    = filterDoubles predicates.isi686;
  mips    = filterDoubles predicates.isMips;
  x86_64  = filterDoubles predicates.isx86_64;
  cygwin  = filterDoubles predicates.isCygwin;
  darwin  = filterDoubles predicates.isDarwin;
  freebsd = filterDoubles predicates.isFreeBSD;
  # Should be better, but MinGW is unclear, and HURD is bit-rotted.
  gnu     = filterDoubles (matchAttrs { kernel = parse.kernels.linux;  abi = parse.abis.gnu; });
  illumos = filterDoubles predicates.isSunOS;
  linux   = filterDoubles predicates.isLinux;
  netbsd  = filterDoubles predicates.isNetBSD;
  openbsd = filterDoubles predicates.isOpenBSD;
  unix    = filterDoubles predicates.isUnix;
  mesaPlatforms = ["i686-linux" "x86_64-linux" "x86_64-darwin" "armv5tel-linux" "armv6l-linux" "armv7l-linux" "aarch64-linux"];
 }
@@ -0,0 +1,130 @@
 # These can be passed to nixpkgs as either the `localSystem` or
 # `crossSystem`. They are put here for user convenience, but also used by cross
 # tests and linux cross stdenv building, so handle with care!
 let platforms = import ./platforms.nix; in
 rec {
  #
  # Linux
  #
  sheevaplug = rec {
    config = "armv5tel-unknown-linux-gnueabi";
    bigEndian = false;
    arch = "armv5tel";
    float = "soft";
    withTLS = true;
    libc = "glibc";
    platform = platforms.sheevaplug;
    openssl.system = "linux-generic32";
    inherit (platform) gcc;
  };
  raspberryPi = rec {
    config = "armv6l-unknown-linux-gnueabihf";
    bigEndian = false;
    arch = "armv6l";
    float = "hard";
    fpu = "vfp";
    withTLS = true;
    libc = "glibc";
    platform = platforms.raspberrypi;
    openssl.system = "linux-generic32";
    inherit (platform) gcc;
  };
  armv7l-hf-multiplatform = rec {
    config = "arm-unknown-linux-gnueabihf";
    bigEndian = false;
    arch = "armv7-a";
    float = "hard";
    fpu = "vfpv3-d16";
    withTLS = true;
    libc = "glibc";
    platform = platforms.armv7l-hf-multiplatform;
    openssl.system = "linux-generic32";
    inherit (platform) gcc;
  };
  aarch64-multiplatform = rec {
    config = "aarch64-unknown-linux-gnu";
    bigEndian = false;
    arch = "aarch64";
    withTLS = true;
    libc = "glibc";
    platform = platforms.aarch64-multiplatform;
    inherit (platform) gcc;
  };
  scaleway-c1 = armv7l-hf-multiplatform // rec {
    platform = platforms.scaleway-c1;
    inherit (platform) gcc;
    inherit (gcc) fpu;
  };
  pogoplug4 = rec {
    arch = "armv5tel";
    config = "armv5tel-softfloat-linux-gnueabi";
    float = "soft";
    platform = platforms.pogoplug4;
    inherit (platform) gcc;
    libc = "glibc";
    withTLS = true;
    openssl.system = "linux-generic32";
  };
  fuloongminipc = rec {
    config = "mips64el-unknown-linux-gnu";
    bigEndian = false;
    arch = "mips";
    float = "hard";
    withTLS = true;
    libc = "glibc";
    platform = platforms.fuloong2f_n32;
    openssl.system = "linux-generic32";
    inherit (platform) gcc;
  };
  #
  # Darwin
  #
  iphone64 = {
    config = "aarch64-apple-darwin14";
    arch = "arm64";
    libc = "libSystem";
    platform = {};
  };
  iphone32 = {
    config = "arm-apple-darwin10";
    arch = "armv7-a";
    libc = "libSystem";
    platform = {};
  };
  #
  # Windows
  #
  # 32 bit mingw-w64
  mingw32 = {
    config = "i686-pc-mingw32";
    arch = "x86"; # Irrelevant
    libc = "msvcrt"; # This distinguishes the mingw (non posix) toolchain
    platform = {};
  };
  # 64 bit mingw-w64
  mingwW64 = {
    # That's the triplet they use in the mingw-w64 docs.
    config = "x86_64-pc-mingw32";
    arch = "x86_64"; # Irrelevant
    libc = "msvcrt"; # This distinguishes the mingw (non posix) toolchain
    platform = {};
  };
 }
@@ -0,0 +1,43 @@
 with import ./parse.nix;
 with import ../attrsets.nix;
 with import ../lists.nix;
 rec {
  patterns = rec {
    "32bit"      = { cpu = { bits = 32; }; };
    "64bit"      = { cpu = { bits = 64; }; };
    i686         = { cpu = cpuTypes.i686; };
    x86_64       = { cpu = cpuTypes.x86_64; };
    PowerPC      = { cpu = cpuTypes.powerpc; };
    x86          = { cpu = { family = "x86"; }; };
    Arm          = { cpu = { family = "arm"; }; };
    Mips         = { cpu = { family = "mips"; }; };
    BigEndian    = { cpu = { significantByte = significantBytes.bigEndian; }; };
    LittleEndian = { cpu = { significantByte = significantBytes.littleEndian; }; };
    BSD          = { kernel = { families = { inherit (kernelFamilies) bsd; }; }; };
    Unix         = [ BSD Darwin Linux SunOS Hurd Cygwin ];
    Darwin       = { kernel = kernels.darwin; };
    Linux        = { kernel = kernels.linux; };
    SunOS        = { kernel = kernels.solaris; };
    FreeBSD      = { kernel = kernels.freebsd; };
    Hurd         = { kernel = kernels.hurd; };
    NetBSD       = { kernel = kernels.netbsd; };
    OpenBSD      = { kernel = kernels.openbsd; };
    Windows      = { kernel = kernels.windows; };
    Cygwin       = { kernel = kernels.windows; abi = abis.cygnus; };
    MinGW        = { kernel = kernels.windows; abi = abis.gnu; };
    Arm32        = recursiveUpdate Arm patterns."32bit";
    Arm64        = recursiveUpdate Arm patterns."64bit";
  };
  matchAnyAttrs = patterns:
    if builtins.isList patterns then attrs: any (pattern: matchAttrs pattern attrs) patterns
    else matchAttrs patterns;
  predicates = mapAttrs'
    (name: value: nameValuePair ("is" + name) (matchAnyAttrs value))
    patterns;
 }
@@ -0,0 +1,174 @@
 # Define the list of system with their properties.
 #
 # See https://clang.llvm.org/docs/CrossCompilation.html and
 # http://llvm.org/docs/doxygen/html/Triple_8cpp_source.html especially
 # Triple::normalize. Parsing should essentially act as a more conservative
 # version of that last function.
 with import ../lists.nix;
 with import ../types.nix;
 with import ../attrsets.nix;
 with (import ./inspect.nix).predicates;
 let
  lib = import ../default.nix;
  setTypesAssert = type: pred:
    mapAttrs (name: value:
      assert pred value;
      setType type ({ inherit name; } // value));
  setTypes = type: setTypesAssert type (_: true);
 in
 rec {
  isSignificantByte = isType "significant-byte";
  significantBytes = setTypes "significant-byte" {
    bigEndian = {};
    littleEndian = {};
  };
  isCpuType = isType "cpu-type";
  cpuTypes = with significantBytes; setTypesAssert "cpu-type"
    (x: elem x.bits [8 16 32 64 128]
        && (if 8 < x.bits
            then isSignificantByte x.significantByte
            else !(x ? significantByte)))
  {
    arm      = { bits = 32; significantByte = littleEndian; family = "arm"; };
    armv5tel = { bits = 32; significantByte = littleEndian; family = "arm"; };
    armv6l   = { bits = 32; significantByte = littleEndian; family = "arm"; };
    armv7a   = { bits = 32; significantByte = littleEndian; family = "arm"; };
    armv7l   = { bits = 32; significantByte = littleEndian; family = "arm"; };
    aarch64  = { bits = 64; significantByte = littleEndian; family = "arm"; };
    i686     = { bits = 32; significantByte = littleEndian; family = "x86"; };
    x86_64   = { bits = 64; significantByte = littleEndian; family = "x86"; };
    mips64el = { bits = 32; significantByte = littleEndian; family = "mips"; };
    powerpc  = { bits = 32; significantByte = bigEndian;    family = "power"; };
  };
  isVendor = isType "vendor";
  vendors = setTypes "vendor" {
    apple = {};
    pc = {};
    unknown = {};
  };
  isExecFormat = isType "exec-format";
  execFormats = setTypes "exec-format" {
    aout = {}; # a.out
    elf = {};
    macho = {};
    pe = {};
    unknown = {};
  };
  isKernelFamily = isType "kernel-family";
  kernelFamilies = setTypes "kernel-family" {
    bsd = {};
  };
  isKernel = x: isType "kernel" x;
  kernels = with execFormats; with kernelFamilies; setTypesAssert "kernel"
    (x: isExecFormat x.execFormat && all isKernelFamily (attrValues x.families))
  {
    darwin  = { execFormat = macho;   families = { }; };
    freebsd = { execFormat = elf;     families = { inherit bsd; }; };
    hurd    = { execFormat = elf;     families = { }; };
    linux   = { execFormat = elf;     families = { }; };
    netbsd  = { execFormat = elf;     families = { inherit bsd; }; };
    none    = { execFormat = unknown; families = { }; };
    openbsd = { execFormat = elf;     families = { inherit bsd; }; };
    solaris = { execFormat = elf;     families = { }; };
    windows = { execFormat = pe;      families = { }; };
  } // { # aliases
    # TODO(@Ericson2314): Handle these Darwin version suffixes more generally.
    darwin10 = kernels.darwin;
    darwin14 = kernels.darwin;
    win32 = kernels.windows;
  };
  isAbi = isType "abi";
  abis = setTypes "abi" {
    cygnus = {};
    gnu = {};
    msvc = {};
    eabi = {};
    androideabi = {};
    gnueabi = {};
    gnueabihf = {};
    unknown = {};
  };
  isSystem = isType "system";
  mkSystem = { cpu, vendor, kernel, abi }:
    assert isCpuType cpu && isVendor vendor && isKernel kernel && isAbi abi;
    setType "system" {
      inherit cpu vendor kernel abi;
    };
  mkSkeletonFromList = l: {
    "2" = # We only do 2-part hacks for things Nix already supports
      if elemAt l 1 == "cygwin"
        then { cpu = elemAt l 0;                      kernel = "windows";  abi = "cygnus";   }
      else if elemAt l 1 == "gnu"
        then { cpu = elemAt l 0;                      kernel = "hurd";     abi = "gnu";      }
      else   { cpu = elemAt l 0;                      kernel = elemAt l 1;                   };
    "3" = # Awkwards hacks, beware!
      if elemAt l 1 == "apple"
        then { cpu = elemAt l 0; vendor = "apple";    kernel = elemAt l 2;                   }
      else if (elemAt l 1 == "linux") || (elemAt l 2 == "gnu")
        then { cpu = elemAt l 0;                      kernel = elemAt l 1; abi = elemAt l 2; }
      else if (elemAt l 2 == "mingw32") # autotools breaks on -gnu for window
        then { cpu = elemAt l 0; vendor = elemAt l 1; kernel = "windows";  abi = "gnu"; }
      else throw "Target specification with 3 components is ambiguous";
    "4" =    { cpu = elemAt l 0; vendor = elemAt l 1; kernel = elemAt l 2; abi = elemAt l 3; };
  }.${toString (length l)}
    or (throw "system string has invalid number of hyphen-separated components");
  # This should revert the job done by config.guess from the gcc compiler.
  mkSystemFromSkeleton = { cpu
                         , # Optional, but fallback too complex for here.
                           # Inferred below instead.
                           vendor ? assert false; null
                         , kernel
                         , # Also inferred below
                           abi    ? assert false; null
                         } @ args: let
    getCpu    = name: cpuTypes.${name} or (throw "Unknown CPU type: ${name}");
    getVendor = name:  vendors.${name} or (throw "Unknown vendor: ${name}");
    getKernel = name:  kernels.${name} or (throw "Unknown kernel: ${name}");
    getAbi    = name:     abis.${name} or (throw "Unknown ABI: ${name}");
    parsed = rec {
      cpu = getCpu args.cpu;
      vendor =
        /**/ if args ? vendor    then getVendor args.vendor
        else if isDarwin  parsed then vendors.apple
        else if isWindows parsed then vendors.pc
        else                     vendors.unknown;
      kernel = getKernel args.kernel;
      abi =
        /**/ if args ? abi       then getAbi args.abi
        else if isLinux   parsed then abis.gnu
        else if isWindows parsed then abis.gnu
        else                     abis.unknown;
    };
  in mkSystem parsed;
  mkSystemFromString = s: mkSystemFromSkeleton (mkSkeletonFromList (lib.splitString "-" s));
  doubleFromSystem = { cpu, vendor, kernel, abi, ... }:
    if abi == abis.cygnus
    then "${cpu.name}-cygwin"
    else "${cpu.name}-${kernel.name}";
  tripleFromSystem = { cpu, vendor, kernel, abi, ... } @ sys: assert isSystem sys; let
    optAbi = lib.optionalString (abi != abis.unknown) "-${abi.name}";
  in "${cpu.name}-${vendor.name}-${kernel.name}${optAbi}";
 }
@@ -0,0 +1,563 @@
 rec {
  pcBase = {
    name = "pc";
    uboot = null;
    kernelHeadersBaseConfig = "defconfig";
    kernelBaseConfig = "defconfig";
    # Build whatever possible as a module, if not stated in the extra config.
    kernelAutoModules = true;
    kernelTarget = "bzImage";
  };
  pc64 = pcBase // { kernelArch = "x86_64"; };
  pc32 = pcBase // { kernelArch = "i386"; };
  pc32_simplekernel = pc32 // {
    kernelAutoModules = false;
  };
  pc64_simplekernel = pc64 // {
    kernelAutoModules = false;
  };
  pogoplug4 = {
    name = "pogoplug4";
    gcc = {
      arch = "armv5te";
      float = "soft";
    };
    kernelMajor = "2.6";
    kernelHeadersBaseConfig = "multi_v5_defconfig";
    kernelBaseConfig = "multi_v5_defconfig";
    kernelArch = "arm";
    kernelAutoModules = false;
    kernelExtraConfig =
      ''
        # Ubi for the mtd
        MTD_UBI y
        UBIFS_FS y
        UBIFS_FS_XATTR y
        UBIFS_FS_ADVANCED_COMPR y
        UBIFS_FS_LZO y
        UBIFS_FS_ZLIB y
        UBIFS_FS_DEBUG n
      '';
    kernelMakeFlags = [ "LOADADDR=0x8000" ];
    kernelTarget = "uImage";
    # TODO reenable once manual-config's config actually builds a .dtb and this is checked to be working
    #kernelDTB = true;
    # XXX can be anything non-null, pkgs actually only cares if it is set or not
    uboot = "pogoplug4";
  };
  sheevaplug = {
    name = "sheevaplug";
    kernelMajor = "2.6";
    kernelHeadersBaseConfig = "multi_v5_defconfig";
    kernelBaseConfig = "multi_v5_defconfig";
    kernelArch = "arm";
    kernelAutoModules = false;
    kernelExtraConfig = ''
      BLK_DEV_RAM y
      BLK_DEV_INITRD y
      BLK_DEV_CRYPTOLOOP m
      BLK_DEV_DM m
      DM_CRYPT m
      MD y
      REISERFS_FS m
      BTRFS_FS m
      XFS_FS m
      JFS_FS m
      EXT4_FS m
      USB_STORAGE_CYPRESS_ATACB m
      # mv cesa requires this sw fallback, for mv-sha1
      CRYPTO_SHA1 y
      # Fast crypto
      CRYPTO_TWOFISH y
      CRYPTO_TWOFISH_COMMON y
      CRYPTO_BLOWFISH y
      CRYPTO_BLOWFISH_COMMON y
      IP_PNP y
      IP_PNP_DHCP y
      NFS_FS y
      ROOT_NFS y
      TUN m
      NFS_V4 y
      NFS_V4_1 y
      NFS_FSCACHE y
      NFSD m
      NFSD_V2_ACL y
      NFSD_V3 y
      NFSD_V3_ACL y
      NFSD_V4 y
      NETFILTER y
      IP_NF_IPTABLES y
      IP_NF_FILTER y
      IP_NF_MATCH_ADDRTYPE y
      IP_NF_TARGET_LOG y
      IP_NF_MANGLE y
      IPV6 m
      VLAN_8021Q m
      CIFS y
      CIFS_XATTR y
      CIFS_POSIX y
      CIFS_FSCACHE y
      CIFS_ACL y
      WATCHDOG y
      WATCHDOG_CORE y
      ORION_WATCHDOG m
      ZRAM m
      NETCONSOLE m
      # Disable OABI to have seccomp_filter (required for systemd)
      # https://github.com/raspberrypi/firmware/issues/651
      OABI_COMPAT n
      # Fail to build
      DRM n
      SCSI_ADVANSYS n
      USB_ISP1362_HCD n
      SND_SOC n
      SND_ALI5451 n
      FB_SAVAGE n
      SCSI_NSP32 n
      ATA_SFF n
      SUNGEM n
      IRDA n
      ATM_HE n
      SCSI_ACARD n
      BLK_DEV_CMD640_ENHANCED n
      FUSE_FS m
      # systemd uses cgroups
      CGROUPS y
      # Latencytop
      LATENCYTOP y
      # Ubi for the mtd
      MTD_UBI y
      UBIFS_FS y
      UBIFS_FS_XATTR y
      UBIFS_FS_ADVANCED_COMPR y
      UBIFS_FS_LZO y
      UBIFS_FS_ZLIB y
      UBIFS_FS_DEBUG n
      # Kdb, for kernel troubles
      KGDB y
      KGDB_SERIAL_CONSOLE y
      KGDB_KDB y
    '';
    kernelMakeFlags = [ "LOADADDR=0x0200000" ];
    kernelTarget = "uImage";
    uboot = "sheevaplug";
    # Only for uboot = uboot :
    ubootConfig = "sheevaplug_config";
    kernelDTB = true; # Beyond 3.10
    gcc = {
      arch = "armv5te";
      float = "soft";
    };
  };
  raspberrypi = {
    name = "raspberrypi";
    kernelMajor = "2.6";
    kernelHeadersBaseConfig = "bcm2835_defconfig";
    kernelBaseConfig = "bcmrpi_defconfig";
    kernelDTB = true;
    kernelArch = "arm";
    kernelAutoModules = false;
    kernelExtraConfig = ''
      BLK_DEV_RAM y
      BLK_DEV_INITRD y
      BLK_DEV_CRYPTOLOOP m
      BLK_DEV_DM m
      DM_CRYPT m
      MD y
      REISERFS_FS m
      BTRFS_FS y
      XFS_FS m
      JFS_FS y
      EXT4_FS y
      IP_PNP y
      IP_PNP_DHCP y
      NFS_FS y
      ROOT_NFS y
      TUN m
      NFS_V4 y
      NFS_V4_1 y
      NFS_FSCACHE y
      NFSD m
      NFSD_V2_ACL y
      NFSD_V3 y
      NFSD_V3_ACL y
      NFSD_V4 y
      NETFILTER y
      IP_NF_IPTABLES y
      IP_NF_FILTER y
      IP_NF_MATCH_ADDRTYPE y
      IP_NF_TARGET_LOG y
      IP_NF_MANGLE y
      IPV6 m
      VLAN_8021Q m
      CIFS y
      CIFS_XATTR y
      CIFS_POSIX y
      CIFS_FSCACHE y
      CIFS_ACL y
      ZRAM m
      # Disable OABI to have seccomp_filter (required for systemd)
      # https://github.com/raspberrypi/firmware/issues/651
      OABI_COMPAT n
      # Fail to build
      DRM n
      SCSI_ADVANSYS n
      USB_ISP1362_HCD n
      SND_SOC n
      SND_ALI5451 n
      FB_SAVAGE n
      SCSI_NSP32 n
      ATA_SFF n
      SUNGEM n
      IRDA n
      ATM_HE n
      SCSI_ACARD n
      BLK_DEV_CMD640_ENHANCED n
      FUSE_FS m
      # nixos mounts some cgroup
      CGROUPS y
      # Latencytop
      LATENCYTOP y
    '';
    kernelTarget = "zImage";
    uboot = null;
    gcc = {
      arch = "armv6";
      fpu = "vfp";
      float = "hard";
      # TODO(@Ericson2314) what is this and is it a good idea? It was
      # used in some cross compilation examples but not others.
      #
      # abi = "aapcs-linux";
    };
  };
  raspberrypi2 = armv7l-hf-multiplatform // {
    name = "raspberrypi2";
    kernelBaseConfig = "bcm2709_defconfig";
    kernelDTB = true;
    kernelAutoModules = false;
    kernelExtraConfig = ''
      BLK_DEV_RAM y
      BLK_DEV_INITRD y
      BLK_DEV_CRYPTOLOOP m
      BLK_DEV_DM m
      DM_CRYPT m
      MD y
      REISERFS_FS m
      BTRFS_FS y
      XFS_FS m
      JFS_FS y
      EXT4_FS y
      IP_PNP y
      IP_PNP_DHCP y
      NFS_FS y
      ROOT_NFS y
      TUN m
      NFS_V4 y
      NFS_V4_1 y
      NFS_FSCACHE y
      NFSD m
      NFSD_V2_ACL y
      NFSD_V3 y
      NFSD_V3_ACL y
      NFSD_V4 y
      NETFILTER y
      IP_NF_IPTABLES y
      IP_NF_FILTER y
      IP_NF_MATCH_ADDRTYPE y
      IP_NF_TARGET_LOG y
      IP_NF_MANGLE y
      IPV6 m
      VLAN_8021Q m
      CIFS y
      CIFS_XATTR y
      CIFS_POSIX y
      CIFS_FSCACHE y
      CIFS_ACL y
      ZRAM m
      # Disable OABI to have seccomp_filter (required for systemd)
      # https://github.com/raspberrypi/firmware/issues/651
      OABI_COMPAT n
      # Fail to build
      DRM n
      SCSI_ADVANSYS n
      USB_ISP1362_HCD n
      SND_SOC n
      SND_ALI5451 n
      FB_SAVAGE n
      SCSI_NSP32 n
      ATA_SFF n
      SUNGEM n
      IRDA n
      ATM_HE n
      SCSI_ACARD n
      BLK_DEV_CMD640_ENHANCED n
      FUSE_FS m
      # nixos mounts some cgroup
      CGROUPS y
      # Latencytop
      LATENCYTOP y
      # Disable the common config Xen, it doesn't build on ARM
      XEN? n
    '';
    kernelTarget = "zImage";
    uboot = null;
  };
  scaleway-c1 = armv7l-hf-multiplatform // {
    gcc = {
      cpu = "cortex-a9";
      fpu = "vfpv3";
      float = "hard";
    };
  };
  utilite = {
    name = "utilite";
    kernelMajor = "2.6";
    kernelHeadersBaseConfig = "multi_v7_defconfig";
    kernelBaseConfig = "multi_v7_defconfig";
    kernelArch = "arm";
    kernelAutoModules = false;
    kernelExtraConfig =
      ''
        # Ubi for the mtd
        MTD_UBI y
        UBIFS_FS y
        UBIFS_FS_XATTR y
        UBIFS_FS_ADVANCED_COMPR y
        UBIFS_FS_LZO y
        UBIFS_FS_ZLIB y
        UBIFS_FS_DEBUG n
      '';
    kernelMakeFlags = [ "LOADADDR=0x10800000" ];
    kernelTarget = "uImage";
    kernelDTB = true;
    uboot = true; #XXX: any non-null value here is needed so that mkimage is present to build kernelTarget uImage
    gcc = {
      cpu = "cortex-a9";
      fpu = "neon";
      float = "hard";
    };
  };
  guruplug = sheevaplug // {
    # Define `CONFIG_MACH_GURUPLUG' (see
    # <http://kerneltrap.org/mailarchive/git-commits-head/2010/5/19/33618>)
    # and other GuruPlug-specific things.  Requires the `guruplug-defconfig'
    # patch.
    kernelBaseConfig = "guruplug_defconfig";
    #kernelHeadersBaseConfig = "guruplug_defconfig";
  };
  fuloong2f_n32 = {
    name = "fuloong2f_n32";
    kernelMajor = "2.6";
    kernelHeadersBaseConfig = "fuloong2e_defconfig";
    kernelBaseConfig = "lemote2f_defconfig";
    kernelArch = "mips";
    kernelAutoModules = false;
    kernelExtraConfig = ''
      MIGRATION n
      COMPACTION n
      # nixos mounts some cgroup
      CGROUPS y
      BLK_DEV_RAM y
      BLK_DEV_INITRD y
      BLK_DEV_CRYPTOLOOP m
      BLK_DEV_DM m
      DM_CRYPT m
      MD y
      REISERFS_FS m
      EXT4_FS m
      USB_STORAGE_CYPRESS_ATACB m
      IP_PNP y
      IP_PNP_DHCP y
      IP_PNP_BOOTP y
      NFS_FS y
      ROOT_NFS y
      TUN m
      NFS_V4 y
      NFS_V4_1 y
      NFS_FSCACHE y
      NFSD m
      NFSD_V2_ACL y
      NFSD_V3 y
      NFSD_V3_ACL y
      NFSD_V4 y
      # Fail to build
      DRM n
      SCSI_ADVANSYS n
      USB_ISP1362_HCD n
      SND_SOC n
      SND_ALI5451 n
      FB_SAVAGE n
      SCSI_NSP32 n
      ATA_SFF n
      SUNGEM n
      IRDA n
      ATM_HE n
      SCSI_ACARD n
      BLK_DEV_CMD640_ENHANCED n
      FUSE_FS m
      # Needed for udev >= 150
      SYSFS_DEPRECATED_V2 n
      VGA_CONSOLE n
      VT_HW_CONSOLE_BINDING y
      SERIAL_8250_CONSOLE y
      FRAMEBUFFER_CONSOLE y
      EXT2_FS y
      EXT3_FS y
      REISERFS_FS y
      MAGIC_SYSRQ y
      # The kernel doesn't boot at all, with FTRACE
      FTRACE n
    '';
    kernelTarget = "vmlinux";
    uboot = null;
    gcc = {
      arch = "loongson2f";
      abi = "n32";
    };
  };
  beaglebone = armv7l-hf-multiplatform // {
    name = "beaglebone";
    kernelBaseConfig = "omap2plus_defconfig";
    kernelAutoModules = false;
    kernelExtraConfig = ""; # TBD kernel config
    kernelTarget = "zImage";
    uboot = null;
  };
  armv7l-hf-multiplatform = {
    name = "armv7l-hf-multiplatform";
    kernelMajor = "2.6"; # Using "2.6" enables 2.6 kernel syscalls in glibc.
    kernelHeadersBaseConfig = "multi_v7_defconfig";
    kernelBaseConfig = "multi_v7_defconfig";
    kernelArch = "arm";
    kernelDTB = true;
    kernelAutoModules = true;
    kernelPreferBuiltin = true;
    uboot = null;
    kernelTarget = "zImage";
    kernelExtraConfig = ''
      # Fix broken sunxi-sid nvmem driver.
      TI_CPTS y
      # Hangs ODROID-XU4
      ARM_BIG_LITTLE_CPUIDLE n
    '';
    gcc = {
      # Some table about fpu flags:
      # http://community.arm.com/servlet/JiveServlet/showImage/38-1981-3827/blogentry-103749-004812900+1365712953_thumb.png
      # Cortex-A5: -mfpu=neon-fp16
      # Cortex-A7 (rpi2): -mfpu=neon-vfpv4
      # Cortex-A8 (beaglebone): -mfpu=neon
      # Cortex-A9: -mfpu=neon-fp16
      # Cortex-A15: -mfpu=neon-vfpv4
      # More about FPU:
      # https://wiki.debian.org/ArmHardFloatPort/VfpComparison
      # vfpv3-d16 is what Debian uses and seems to be the best compromise: NEON is not supported in e.g. Scaleway or Tegra 2,
      # and the above page suggests NEON is only an improvement with hand-written assembly.
      arch = "armv7-a";
      fpu = "vfpv3-d16";
      float = "hard";
      # For Raspberry Pi the 2 the best would be:
      #   cpu = "cortex-a7";
      #   fpu = "neon-vfpv4";
    };
  };
  aarch64-multiplatform = {
    name = "aarch64-multiplatform";
    kernelMajor = "2.6"; # Using "2.6" enables 2.6 kernel syscalls in glibc.
    kernelHeadersBaseConfig = "defconfig";
    kernelBaseConfig = "defconfig";
    kernelArch = "arm64";
    kernelDTB = true;
    kernelAutoModules = true;
    kernelPreferBuiltin = true;
    kernelExtraConfig = ''
      # Raspberry Pi 3 stuff. Not needed for kernels >= 4.10.
      ARCH_BCM2835 y
      BCM2835_MBOX y
      BCM2835_WDT y
      RASPBERRYPI_FIRMWARE y
      RASPBERRYPI_POWER y
      SERIAL_8250_BCM2835AUX y
      SERIAL_8250_EXTENDED y
      SERIAL_8250_SHARE_IRQ y
      # Cavium ThunderX stuff.
      PCI_HOST_THUNDER_ECAM y
    '';
    uboot = null;
    kernelTarget = "Image";
    gcc = {
      arch = "armv8-a";
    };
  };
  selectBySystem = system: {
      "i686-linux" = pc32;
      "x86_64-linux" = pc64;
      "armv5tel-linux" = sheevaplug;
      "armv6l-linux" = raspberrypi;
      "armv7l-linux" = armv7l-hf-multiplatform;
      "aarch64-linux" = aarch64-multiplatform;
      "mips64el-linux" = fuloong2f_n32;
    }.${system} or pcBase;
 }
@@ -1,8 +1,13 @@
-let inherit (builtins) add; in
+# to run these tests:
-with import ./default.nix;
+# nix-instantiate --eval --strict nixpkgs/lib/tests/misc.nix
 # if the resulting list is empty, all tests passed
 with import ../default.nix;
 runTests {
 # TRIVIAL
  testId = {
    expr = id 1;
    expected = 1;
@@ -30,6 +35,18 @@ runTests {
    expected = {a = "a";};
  };
  testComposeExtensions = {
    expr = let obj = makeExtensible (self: { foo = self.bar; });
               f = self: super: { bar = false; baz = true; };
               g = self: super: { bar = super.baz or false; };
               f_o_g = composeExtensions f g;
               composed = obj.extend f_o_g;
           in composed.foo;
    expected = true;
  };
 # STRINGS
  testConcatMapStrings = {
    expr = concatMapStrings (x: x + ";") ["a" "b" "c"];
    expected = "a;b;c;";
@@ -40,15 +57,102 @@ runTests {
    expected = "a,b,c";
  };
  testSplitStringsSimple = {
    expr = strings.splitString "." "a.b.c.d";
    expected = [ "a" "b" "c" "d" ];
  };
  testSplitStringsEmpty = {
    expr = strings.splitString "." "a..b";
    expected = [ "a" "" "b" ];
  };
  testSplitStringsOne = {
    expr = strings.splitString ":" "a.b";
    expected = [ "a.b" ];
  };
  testSplitStringsNone = {
    expr = strings.splitString "." "";
    expected = [ "" ];
  };
  testSplitStringsFirstEmpty = {
    expr = strings.splitString "/" "/a/b/c";
    expected = [ "" "a" "b" "c" ];
  };
  testSplitStringsLastEmpty = {
    expr = strings.splitString ":" "2001:db8:0:0042::8a2e:370:";
    expected = [ "2001" "db8" "0" "0042" "" "8a2e" "370" "" ];
  };
  testIsStorePath =  {
    expr =
      let goodPath =
            "${builtins.storeDir}/d945ibfx9x185xf04b890y4f9g3cbb63-python-2.7.11";
      in {
        storePath = isStorePath goodPath;
        storePathAppendix = isStorePath
          "${goodPath}/bin/python";
        nonAbsolute = isStorePath (concatStrings (tail (stringToCharacters goodPath)));
        asPath = isStorePath (builtins.toPath goodPath);
        otherPath = isStorePath "/something/else";
        otherVals = {
          attrset = isStorePath {};
          list = isStorePath [];
          int = isStorePath 42;
        };
      };
    expected = {
      storePath = true;
      storePathAppendix = false;
      nonAbsolute = false;
      asPath = true;
      otherPath = false;
      otherVals = {
        attrset = false;
        list = false;
        int = false;
      };
    };
  };
 # LISTS
  testFilter = {
    expr = filter (x: x != "a") ["a" "b" "c" "a"];
    expected = ["b" "c"];
  };
-  testFold = {
+  testFold =
-    expr = fold (builtins.add) 0 (range 0 100);
+    let
-    expected = 5050;
+      f = op: fold: fold op 0 (range 0 100);
-  };
+      # fold with associative operator
      assoc = f builtins.add;
      # fold with non-associative operator
      nonAssoc = f builtins.sub;
    in {
      expr = {
        assocRight = assoc foldr;
        # right fold with assoc operator is same as left fold
        assocRightIsLeft = assoc foldr == assoc foldl;
        nonAssocRight = nonAssoc foldr;
        nonAssocLeft = nonAssoc foldl;
        # with non-assoc operator the fold results are not the same
        nonAssocRightIsNotLeft = nonAssoc foldl != nonAssoc foldr;
        # fold is an alias for foldr
        foldIsRight = nonAssoc fold == nonAssoc foldr;
      };
      expected = {
        assocRight = 5050;
        assocRightIsLeft = true;
        nonAssocRight = 50;
        nonAssocLeft = (-5050);
        nonAssocRightIsNotLeft = true;
        foldIsRight = true;
      };
    };
  testTake = testAllTrue [
    ([] == (take 0 [  1 2 3 ]))
@@ -66,45 +170,6 @@ runTests {
    expected = { a = [ 2 3 ]; b = [7]; c = [8];};
  };
  testOverridableDelayableArgsTest = {
    expr =
      let res1 = defaultOverridableDelayableArgs id {};
          res2 = defaultOverridableDelayableArgs id { a = 7; };
          res3 = let x = defaultOverridableDelayableArgs id { a = 7; };
                 in (x.merge) { b = 10; };
          res4 = let x = defaultOverridableDelayableArgs id { a = 7; };
                in (x.merge) ( x: { b = 10; });
          res5 = let x = defaultOverridableDelayableArgs id { a = 7; };
                in (x.merge) ( x: { a = add x.a 3; });
          res6 = let x = defaultOverridableDelayableArgs id { a = 7; mergeAttrBy = { a = add; }; };
                     y = x.merge {};
                in (y.merge) { a = 10; };
          resRem7 = res6.replace (a : removeAttrs a ["a"]);
          resReplace6 = let x = defaultOverridableDelayableArgs id { a = 7; mergeAttrBy = { a = add; }; };
                            x2 = x.merge { a = 20; }; # now we have 27
                        in (x2.replace) { a = 10; }; # and override the value by 10
          # fixed tests (delayed args): (when using them add some comments, please)
          resFixed1 =
                let x = defaultOverridableDelayableArgs id ( x : { a = 7; c = x.fixed.b; });
                    y = x.merge (x : { name = "name-${builtins.toString x.fixed.c}"; });
                in (y.merge) { b = 10; };
          strip = attrs : removeAttrs attrs ["merge" "replace"];
      in all id
        [ ((strip res1) == { })
          ((strip res2) == { a = 7; })
          ((strip res3) == { a = 7; b = 10; })
          ((strip res4) == { a = 7; b = 10; })
          ((strip res5) == { a = 10; })
          ((strip res6) == { a = 17; })
          ((strip resRem7) == {})
          ((strip resFixed1) == { a = 7; b = 10; c =10; name = "name-10"; })
        ];
    expected = true;
  };
  testSort = {
    expr = sort builtins.lessThan [ 40 2 30 42 ];
    expected = [2 30 40 42];
@@ -131,9 +196,9 @@ runTests {
  };
-  /* Generator tests */
+# GENERATORS
-  # these tests assume attributes are converted to lists
+# these tests assume attributes are converted to lists
-  # in alphabetical order
+# in alphabetical order
  testMkKeyValueDefault = {
    expr = generators.mkKeyValueDefault ":" "f:oo" "bar";
@@ -204,7 +269,7 @@ runTests {
    };
    in {
      expr = generators.toJSON {} val;
-      # trival implementation
+      # trivial implementation
      expected = builtins.toJSON val;
  };
@@ -216,8 +281,81 @@ runTests {
    };
    in {
      expr = generators.toYAML {} val;
-      # trival implementation
+      # trivial implementation
      expected = builtins.toJSON val;
  };
  testToPretty = {
    expr = mapAttrs (const (generators.toPretty {})) rec {
      int = 42;
      bool = true;
      string = "fnord";
      null_ = null;
      function = x: x;
      functionArgs = { arg ? 4, foo }: arg;
      list = [ 3 4 function [ false ] ];
      attrs = { foo = null; "foo bar" = "baz"; };
      drv = derivation { name = "test"; system = builtins.currentSystem; };
    };
    expected = rec {
      int = "42";
      bool = "true";
      string = "\"fnord\"";
      null_ = "null";
      function = "<λ>";
      functionArgs = "<λ:{(arg),foo}>";
      list = "[ 3 4 ${function} [ false ] ]";
      attrs = "{ \"foo\" = null; \"foo bar\" = \"baz\"; }";
      drv = "<δ>";
    };
  };
  testToPrettyAllowPrettyValues = {
    expr = generators.toPretty { allowPrettyValues = true; }
             { __pretty = v: "«" + v + "»"; val = "foo"; };
    expected  = "«foo»";
  };
 # MISC
  testOverridableDelayableArgsTest = {
    expr =
      let res1 = defaultOverridableDelayableArgs id {};
          res2 = defaultOverridableDelayableArgs id { a = 7; };
          res3 = let x = defaultOverridableDelayableArgs id { a = 7; };
                 in (x.merge) { b = 10; };
          res4 = let x = defaultOverridableDelayableArgs id { a = 7; };
                in (x.merge) ( x: { b = 10; });
          res5 = let x = defaultOverridableDelayableArgs id { a = 7; };
                in (x.merge) ( x: { a = builtins.add x.a 3; });
          res6 = let x = defaultOverridableDelayableArgs id { a = 7; mergeAttrBy = { a = builtins.add; }; };
                     y = x.merge {};
                in (y.merge) { a = 10; };
          resRem7 = res6.replace (a: removeAttrs a ["a"]);
          resReplace6 = let x = defaultOverridableDelayableArgs id { a = 7; mergeAttrBy = { a = builtins.add; }; };
                            x2 = x.merge { a = 20; }; # now we have 27
                        in (x2.replace) { a = 10; }; # and override the value by 10
          # fixed tests (delayed args): (when using them add some comments, please)
          resFixed1 =
                let x = defaultOverridableDelayableArgs id ( x: { a = 7; c = x.fixed.b; });
                    y = x.merge (x: { name = "name-${builtins.toString x.fixed.c}"; });
                in (y.merge) { b = 10; };
          strip = attrs: removeAttrs attrs ["merge" "replace"];
      in all id
        [ ((strip res1) == { })
          ((strip res2) == { a = 7; })
          ((strip res3) == { a = 7; b = 10; })
          ((strip res4) == { a = 7; b = 10; })
          ((strip res5) == { a = 10; })
          ((strip res6) == { a = 17; })
          ((strip resRem7) == {})
          ((strip resFixed1) == { a = 7; b = 10; c =10; name = "name-10"; })
        ];
    expected = true;
  };
 }
@@ -1,15 +1,12 @@
-{ nixpkgs }:
+{ pkgs ? import ((import ../.).cleanSource ../..) {} }:
-with import ../.. { };
+pkgs.stdenv.mkDerivation {
 with lib;
 stdenv.mkDerivation {
  name = "nixpkgs-lib-tests";
-  buildInputs = [ nix ];
+  buildInputs = [ pkgs.nix ];
-  NIX_PATH="nixpkgs=${nixpkgs}";
+  NIX_PATH="nixpkgs=${pkgs.path}";
  buildCommand = ''
-    datadir="${nix}/share"
+    datadir="${pkgs.nix}/share"
    export TEST_ROOT=$(pwd)/test-tmp
    export NIX_BUILD_HOOK=
    export NIX_CONF_DIR=$TEST_ROOT/etc
@@ -23,9 +20,13 @@ stdenv.mkDerivation {
    cacheDir=$TEST_ROOT/binary-cache
    nix-store --init
-    cd ${nixpkgs}/lib/tests
+    cd ${pkgs.path}/lib/tests
    ./modules.sh
    [[ "$(nix-instantiate --eval --strict misc.nix)" == "[ ]" ]]
    [[ "$(nix-instantiate --eval --strict systems.nix)" == "[ ]" ]]
    touch $out
  '';
 }
@@ -0,0 +1,31 @@
 # We assert that the new algorithmic way of generating these lists matches the
 # way they were hard-coded before.
 #
 # One might think "if we exhaustively test, what's the point of procedurally
 # calculating the lists anyway?". The answer is one can mindlessly update these
 # tests as new platforms become supported, and then just give the diff a quick
 # sanity check before committing :).
 let
  lib = import ../default.nix;
  mseteq = x: y: {
    expr     = lib.sort lib.lessThan x;
    expected = lib.sort lib.lessThan y;
  };
 in with lib.systems.doubles; lib.runTests {
  all = assertTrue (mseteq all (linux ++ darwin ++ cygwin ++ freebsd ++ openbsd ++ netbsd ++ illumos));
  arm = assertTrue (mseteq arm [ "armv5tel-linux" "armv6l-linux" "armv7l-linux" ]);
  i686 = assertTrue (mseteq i686 [ "i686-linux" "i686-freebsd" "i686-netbsd" "i686-openbsd" "i686-cygwin" ]);
  mips = assertTrue (mseteq mips [ "mips64el-linux" ]);
  x86_64 = assertTrue (mseteq x86_64 [ "x86_64-linux" "x86_64-darwin" "x86_64-freebsd" "x86_64-openbsd" "x86_64-netbsd" "x86_64-cygwin" "x86_64-solaris" ]);
  cygwin = assertTrue (mseteq cygwin [ "i686-cygwin" "x86_64-cygwin" ]);
  darwin = assertTrue (mseteq darwin [ "x86_64-darwin" ]);
  freebsd = assertTrue (mseteq freebsd [ "i686-freebsd" "x86_64-freebsd" ]);
  gnu = assertTrue (mseteq gnu (linux /* ++ hurd ++ kfreebsd ++ ... */));
  illumos = assertTrue (mseteq illumos [ "x86_64-solaris" ]);
  linux = assertTrue (mseteq linux [ "i686-linux" "x86_64-linux" "armv5tel-linux" "armv6l-linux" "armv7l-linux" "aarch64-linux" "mips64el-linux" ]);
  netbsd = assertTrue (mseteq netbsd [ "i686-netbsd" "x86_64-netbsd" ]);
  openbsd = assertTrue (mseteq openbsd [ "i686-openbsd" "x86_64-openbsd" ]);
  unix = assertTrue (mseteq unix (linux ++ darwin ++ freebsd ++ openbsd ++ netbsd ++ illumos));
 }
@@ -1,86 +1,54 @@
 rec {
-  # Identity function.
+  /* The identity function
     For when you need a function that does “nothing”.
     Type: id :: a -> a
  */
  id = x: x;
-  # Constant function.
+  /* The constant function
     Ignores the second argument.
     Or: Construct a function that always returns a static value.
     Type: const :: a -> b -> a
     Example:
       let f = const 5; in f 10
       => 5
  */
  const = x: y: x;
-  # Named versions corresponding to some builtin operators.
+
  ## Named versions corresponding to some builtin operators.
  /* Concat two strings */
  concat = x: y: x ++ y;
  /* boolean “or” */
  or = x: y: x || y;
  /* boolean “and” */
  and = x: y: x && y;
  /* Convert a boolean to a string.
     Note that toString on a bool returns "1" and "".
  */
  boolToString = b: if b then "true" else "false";
  /* Merge two attribute sets shallowly, right side trumps left
     Example:
       mergeAttrs { a = 1; b = 2; } { b = 3; c = 4; }
       => { a = 1; b = 3; c = 4; }
  */
  mergeAttrs = x: y: x // y;
  # Compute the fixed point of the given function `f`, which is usually an
  # attribute set that expects its final, non-recursive representation as an
  # argument:
  #
  #     f = self: { foo = "foo"; bar = "bar"; foobar = self.foo + self.bar; }
  #
  # Nix evaluates this recursion until all references to `self` have been
  # resolved. At that point, the final result is returned and `f x = x` holds:
  #
  #     nix-repl> fix f
  #     { bar = "bar"; foo = "foo"; foobar = "foobar"; }
  #
  # See https://en.wikipedia.org/wiki/Fixed-point_combinator for further
  # details.
  fix = f: let x = f x; in x;
  # A variant of `fix` that records the original recursive attribute set in the
  # result. This is useful in combination with the `extends` function to
  # implement deep overriding. See pkgs/development/haskell-modules/default.nix
  # for a concrete example.
  fix' = f: let x = f x // { __unfix__ = f; }; in x;
  # Modify the contents of an explicitly recursive attribute set in a way that
  # honors `self`-references. This is accomplished with a function
  #
  #     g = self: super: { foo = super.foo + " + "; }
  #
  # that has access to the unmodified input (`super`) as well as the final
  # non-recursive representation of the attribute set (`self`). `extends`
  # differs from the native `//` operator insofar as that it's applied *before*
  # references to `self` are resolved:
  #
  #     nix-repl> fix (extends g f)
  #     { bar = "bar"; foo = "foo + "; foobar = "foo + bar"; }
  #
  # The name of the function is inspired by object-oriented inheritance, i.e.
  # think of it as an infix operator `g extends f` that mimics the syntax from
  # Java. It may seem counter-intuitive to have the "base class" as the second
  # argument, but it's nice this way if several uses of `extends` are cascaded.
  extends = f: rattrs: self: let super = rattrs self; in super // f self super;
  # Create an overridable, recursive attribute set. For example:
  #
  #     nix-repl> obj = makeExtensible (self: { })
  #
  #     nix-repl> obj
  #     { __unfix__ = «lambda»; extend = «lambda»; }
  #
  #     nix-repl> obj = obj.extend (self: super: { foo = "foo"; })
  #
  #     nix-repl> obj
  #     { __unfix__ = «lambda»; extend = «lambda»; foo = "foo"; }
  #
  #     nix-repl> obj = obj.extend (self: super: { foo = super.foo + " + "; bar = "bar"; foobar = self.foo + self.bar; })
  #
  #     nix-repl> obj
  #     { __unfix__ = «lambda»; bar = "bar"; extend = «lambda»; foo = "foo + "; foobar = "foo + bar"; }
  makeExtensible = makeExtensibleWithCustomName "extend";
  # Same as `makeExtensible` but the name of the extending attribute is
  # customized.
  makeExtensibleWithCustomName = extenderName: rattrs:
    fix' rattrs // {
      ${extenderName} = f: makeExtensibleWithCustomName extenderName (extends f rattrs);
   };
  # Flip the order of the arguments of a binary function.
  flip = f: a: b: f b a;
  # Apply function if argument is non-null
  mapNullable = f: a: if isNull a then a else f a;
  # Pull in some builtins not included elsewhere.
  inherit (builtins)
    pathExists readFile isBool isFunction
@@ -6,7 +6,7 @@ with import ./attrsets.nix;
 with import ./options.nix;
 with import ./trivial.nix;
 with import ./strings.nix;
-with {inherit (import ./modules.nix) mergeDefinitions filterOverrides; };
+let inherit (import ./modules.nix) mergeDefinitions filterOverrides; in
 rec {
@@ -52,7 +52,7 @@ rec {
    { # Human-readable representation of the type, should be equivalent to
      # the type function name.
      name
-    , # Description of the type, defined recursively by embedding the the wrapped type if any.
+    , # Description of the type, defined recursively by embedding the wrapped type if any.
      description ? null
    , # Function applied to each definition that should return true if
      # its type-correct, false otherwise.
@@ -81,7 +81,7 @@ rec {
      #   name: name of the type
      #   type: type function.
      #   wrapped: the type wrapped in case of compound types.
-      #   payload: values of the type, two payloads of the same type must be 
+      #   payload: values of the type, two payloads of the same type must be
      #            combinable with the binOp binary operation.
      #   binOp: binary operation that merge two payloads of the same type.
      functor ? defaultFunctor name
@@ -92,6 +92,8 @@ rec {
    };
  # When adding new types don't forget to document them in
  # nixos/doc/manual/development/option-types.xml!
  types = rec {
    unspecified = mkOptionType {
@@ -177,9 +179,9 @@ rec {
      description = "list of ${elemType.description}s";
      check = isList;
      merge = loc: defs:
-        map (x: x.value) (filter (x: x ? value) (concatLists (imap (n: def:
+        map (x: x.value) (filter (x: x ? value) (concatLists (imap1 (n: def:
          if isList def.value then
-            imap (m: def':
+            imap1 (m: def':
              (mergeDefinitions
                (loc ++ ["[definition ${toString n}-entry ${toString m}]"])
                elemType
@@ -218,7 +220,7 @@ rec {
          if isList def.value then
            { inherit (def) file;
              value = listToAttrs (
-                imap (elemIdx: elem:
+                imap1 (elemIdx: elem:
                  { name = elem.name or "unnamed-${toString defIdx}.${toString elemIdx}";
                    value = elem;
                  }) def.value);
@@ -231,7 +233,7 @@ rec {
        name = "loaOf";
        description = "list or attribute set of ${elemType.description}s";
        check = x: isList x || isAttrs x;
-        merge = loc: defs: attrOnly.merge loc (imap convertIfList defs);
+        merge = loc: defs: attrOnly.merge loc (imap1 convertIfList defs);
        getSubOptions = prefix: elemType.getSubOptions (prefix ++ ["<name?>"]);
        getSubModules = elemType.getSubModules;
        substSubModules = m: loaOf (elemType.substSubModules m);
@@ -257,6 +259,7 @@ rec {
      functor = (defaultFunctor name) // { wrapped = elemType; };
    };
    # Value of given type but with no merging (i.e. `uniq list`s are not concatenated).
    uniq = elemType: mkOptionType rec {
      name = "uniq";
      inherit (elemType) description check;
@@ -267,6 +270,7 @@ rec {
      functor = (defaultFunctor name) // { wrapped = elemType; };
    };
    # Null or value of ...
    nullOr = elemType: mkOptionType rec {
      name = "nullOr";
      description = "null or ${elemType.description}";
@@ -283,6 +287,7 @@ rec {
      functor = (defaultFunctor name) // { wrapped = elemType; };
    };
    # A submodule (like typed attribute set). See NixOS manual.
    submodule = opts:
      let
        opts' = toList opts;
@@ -314,6 +319,7 @@ rec {
        };
      };
    # A value from a set of allowed ones.
    enum = values:
      let
        show = v:
@@ -329,6 +335,7 @@ rec {
        functor = (defaultFunctor name) // { payload = values; binOp = a: b: unique (a ++ b); };
      };
    # Either value of type `t1` or `t2`.
    either = t1: t2: mkOptionType rec {
      name = "either";
      description = "${t1.description} or ${t2.description}";
@@ -352,6 +359,8 @@ rec {
      functor = (defaultFunctor name) // { wrapped = [ t1 t2 ]; };
    };
    # Either value of type `finalType` or `coercedType`, the latter is
    # converted to `finalType` using `coerceFunc`.
    coercedTo = coercedType: coerceFunc: finalType:
      assert coercedType.getSubModules == null;
      mkOptionType rec {
@@ -1,14 +0,0 @@
 *~
 ,*
 .*.swp
 .*.swo
 result
 result-*
 /doc/NEWS.html
 /doc/NEWS.txt
 /doc/manual.html
 /doc/manual.pdf
 .version-suffix
 .DS_Store
 .git
@@ -1,12 +0,0 @@
 FROM busybox
 RUN dir=`mktemp -d` && trap 'rm -rf "$dir"' EXIT && \
    wget -O- https://nixos.org/releases/nix/nix-1.7/nix-1.7-x86_64-linux.tar.bz2  | bzcat | tar x -C $dir && \
    mkdir -m 0755 /nix && USER=root sh $dir/*/install && \
    echo ". /root/.nix-profile/etc/profile.d/nix.sh" >> /etc/profile
 ADD . /root/nix/nixpkgs
 ONBUILD ENV NIX_PATH nixpkgs=/root/nix/nixpkgs:nixos=/root/nix/nixpkgs/nixos
 ONBUILD ENV PATH /root/.nix-profile/bin:/root/.nix-profile/sbin:/bin:/sbin:/usr/bin:/usr/sbin
 ONBUILD ENV ENV /etc/profile
 ENV ENV /etc/profile
@@ -14,5 +14,5 @@ removeAttrs (import ../../pkgs/top-level/release.nix
    supportedSystems = [ "x86_64-linux" ];
  })
  [ # Remove jobs whose evaluation depends on a writable Nix store.
-    "tarball" "unstable"
+    "tarball" "unstable" "darwin-tested"
  ]
@@ -6,7 +6,7 @@ GNOME_FTP=ftp.gnome.org/pub/GNOME/sources
 # projects that don't follow the GNOME major versioning, or that we don't want to
 # programmatically update
-NO_GNOME_MAJOR='gtkhtml gdm'
+NO_GNOME_MAJOR="ghex gtkhtml gdm"
 usage() {
  echo "Usage: $0 gnome_dir <show project>|<update project>|<update-all> [major.minor]" >&2
@@ -48,8 +48,8 @@ def get_maintainers(attr_name):
@click.command()
@click.option(
    '--jobset',
-    default="nixos/release-16.09",
+    default="nixos/release-17.03",
-    help='Hydra project like nixos/release-16.09')
+    help='Hydra project like nixos/release-17.03')
 def cli(jobset):
    """
    Given a Hydra project, inspect latest evaluation
@@ -74,13 +74,13 @@ def cli(jobset):
    # TODO: dependency failed without propagated builds
    for tr in d('img[alt="Failed"]').parents('tr'):
        a = pq(tr)('a')[1]
-        print "- [ ] [{}]({})".format(a.text, a.get('href'))
+        print("- [ ] [{}]({})".format(a.text, a.get('href')))
        sys.stdout.flush()
        maintainers = get_maintainers(a.text)
        if maintainers:
-            print "  - maintainers: {}".format(", ".join(map(lambda u: '@' + u, maintainers)))
+            print("  - maintainers: {}".format(", ".join(map(lambda u: '@' + u, maintainers))))
        # TODO: print last three persons that touched this file
        # TODO: pinpoint the diff that broke this build, or maybe it's transient or maybe it never worked?
@@ -0,0 +1,277 @@
 #!/usr/bin/env nix-shell
 #! nix-shell -i bash -p coreutils gnugrep gnused
 ################################################################################
 # nix-diff.sh                                                                  #
 ################################################################################
 # This script "diffs" Nix profile generations.                                 #
 #                                                                              #
 # Example:                                                                     #
 ################################################################################
 # > nix-diff.sh 90 92                                                          #
 # + gnumake-4.2.1                                                              #
 # + gnumake-4.2.1-doc                                                          #
 # - htmldoc-1.8.29                                                             #
 ################################################################################
 # The example shows that as of generation 92 and since generation 90,          #
 # gnumake-4.2.1 and gnumake-4.2.1-doc have been installed, while               #
 # htmldoc-1.8.29 has been removed.                                             #
 #                                                                              #
 # The example above shows the default, minimal output mode of this script.     #
 # For more features, run `nix-diff.sh -h` for usage instructions.              #
 ################################################################################
 usage() {
    cat <<EOF
 usage: nix-diff.sh [-h | [-p profile | -s] [-q] [-l] [range]]
 -h:         print this message before exiting
 -q:         list the derivations installed in the parent generation
 -l:         diff every available intermediate generation between parent and
            child
 -p profile: specify the Nix profile to use
            * defaults to ~/.nix-profile
 -s:         use the system profile
            * equivalent to: -p /nix/var/nix/profiles/system
 profile:    * should be something like /nix/var/nix/profiles/default, not a
              generation link like /nix/var/nix/profiles/default-2-link
 range:      the range of generations to diff
            * the following patterns are allowed, where A, B, and N are positive
              integers, and G is the currently active generation:
                A..B => diffs from generation A to generation B
                ~N   => diffs from the Nth newest generation (older than G) to G
                A    => diffs from generation A to G
            * defaults to ~1
 EOF
 }
 usage_tip() {
    echo 'run `nix-diff.sh -h` for usage instructions' >&2
    exit 1
 }
 while getopts :hqlp:s opt; do
    case $opt in
        h)
            usage
            exit
            ;;
        q)
            opt_query=1
            ;;
        l)
            opt_log=1
            ;;
        p)
            opt_profile=$OPTARG
            ;;
        s)
            opt_profile=/nix/var/nix/profiles/system
            ;;
        \?)
            echo "error: invalid option -$OPTARG" >&2
            usage_tip
            ;;
    esac
 done
 shift $((OPTIND-1))
 if [ -n "$opt_profile" ]; then
    if ! [ -L "$opt_profile" ]; then
        echo "error: expecting \`$opt_profile\` to be a symbolic link" >&2
        usage_tip
    fi
 else
    opt_profile=$(readlink ~/.nix-profile)
    if (( $? != 0 )); then
        echo 'error: unable to dereference `~/.nix-profile`' >&2
        echo 'specify the profile manually with the `-p` flag' >&2
        usage_tip
    fi
 fi
 list_gens() {
    nix-env -p "$opt_profile" --list-generations \
        | sed -r 's:^\s*::' \
        | cut -d' ' -f1
 }
 current_gen() {
    nix-env -p "$opt_profile" --list-generations \
        | grep -E '\(current\)\s*$' \
        | sed -r 's:^\s*::' \
        | cut -d' ' -f1
 }
 neg_gen() {
    local i=0 from=$1 n=$2 tmp
    for gen in $(list_gens | sort -rn); do
        if ((gen < from)); then
            tmp=$gen
            ((i++))
            ((i == n)) && break
        fi
    done
    if ((i < n)); then
        echo -n "error: there aren't $n generation(s) older than" >&2
        echo " generation $from" >&2
        return 1
    fi
    echo $tmp
 }
 match() {
    argv=("$@")
    for i in $(seq $(($#-1))); do
        if grep -E "^${argv[$i]}\$" <(echo "$1") >/dev/null; then
            echo $i
            return
        fi
    done
    echo 0
 }
 case $(match "$1" '' '[0-9]+' '[0-9]+\.\.[0-9]+' '~[0-9]+') in
    1)
        diffTo=$(current_gen)
        diffFrom=$(neg_gen $diffTo 1)
        (($? == 1)) && usage_tip
        ;;
    2)
        diffFrom=$1
        diffTo=$(current_gen)
        ;;
    3)
        diffFrom=${1%%.*}
        diffTo=${1##*.}
        ;;
    4)
        diffTo=$(current_gen)
        diffFrom=$(neg_gen $diffTo ${1#*~})
        (($? == 1)) && usage_tip
        ;;
    0)
        echo 'error: invalid invocation' >&2
        usage_tip
        ;;
 esac
 dirA="${opt_profile}-${diffFrom}-link"
 dirB="${opt_profile}-${diffTo}-link"
 declare -a temp_files
 temp_length() {
    echo -n ${#temp_files[@]}
 }
 temp_make() {
    temp_files[$(temp_length)]=$(mktemp)
 }
 temp_clean() {
    rm -f ${temp_files[@]}
 }
 temp_name() {
    echo -n "${temp_files[$(($(temp_length)-1))]}"
 }
 trap 'temp_clean' EXIT
 temp_make
 versA=$(temp_name)
 refs=$(nix-store -q --references "$dirA")
 (( $? != 0 )) && exit 1
 echo "$refs" \
    | grep -v env-manifest.nix \
    | sort \
          > "$versA"
 print_tag() {
    local gen=$1
    nix-env -p "$opt_profile" --list-generations \
        | grep -E "^\s*${gen}" \
        | sed -r 's:^\s*::' \
        | sed -r 's:\s*$::'
 }
 if [ -n "$opt_query" ]; then
    print_tag $diffFrom
    cat "$versA" \
        | sed -r 's:^[^-]+-(.*)$:    \1:'
    print_line=1
 fi
 if [ -n "$opt_log" ]; then
    gens=$(for gen in $(list_gens); do
               ((diffFrom < gen && gen < diffTo)) && echo $gen
           done)
    # Force the $diffTo generation to be included in this list, instead of using
    # `gen <= diffTo` in the preceding loop, so we encounter an error upon the
    # event of its nonexistence.
    gens=$(echo "$gens"
           echo $diffTo)
 else
    gens=$diffTo
 fi
 temp_make
 add=$(temp_name)
 temp_make
 rem=$(temp_name)
 temp_make
 out=$(temp_name)
 for gen in $gens; do
    [ -n "$print_line" ] && echo
    temp_make
    versB=$(temp_name)
    dirB="${opt_profile}-${gen}-link"
    refs=$(nix-store -q --references "$dirB")
    (( $? != 0 )) && exit 1
    echo "$refs" \
        | grep -v env-manifest.nix \
        | sort \
              > "$versB"
    in=$(comm -3 -1 "$versA" "$versB")
    sed -r 's:^[^-]*-(.*)$:\1+:' <(echo "$in") \
        | sort -f \
               > "$add"
    un=$(comm -3 -2 "$versA" "$versB")
    sed -r 's:^[^-]*-(.*)$:\1-:' <(echo "$un") \
        | sort -f \
               > "$rem"
    cat "$rem" "$add" \
        | sort -f \
        | sed -r 's:(.*)-$:- \1:' \
        | sed -r 's:(.*)\+$:\+ \1:' \
        | grep -v '^$' \
              > "$out"
    if [ -n "$opt_query" -o -n "$opt_log" ]; then
        lines=$(wc -l "$out" | cut -d' ' -f1)
        tag=$(print_tag "$gen")
        (( $? != 0 )) && exit 1
        if [ $lines -eq 0 ]; then
            echo "$tag   (no change)"
        else
            echo "$tag"
        fi
        cat "$out" \
            | sed 's:^:    :'
        print_line=1
    else
        echo "diffing from generation $diffFrom to $diffTo"
        cat "$out"
    fi
    versA=$versB
 done
 exit 0
@@ -1,260 +1,115 @@
-#!/bin/sh
+#!/usr/bin/env bash
 set -e
-usage () {
+if [ "$#" != 1 ] && [ "$#" != 2 ]; then
-  echo 1>&2 "
+	cat <<-EOF
-usage:
+	Usage: $0 commit-spec [commit-spec]
-  $0
+	    You need to be in a git-controlled nixpkgs tree.
-    [--git commit..commit | --git commit]
+	    The current state of the tree will be used if the second commit is missing.
-    [--svn rev:rev | --svn rev]
+	EOF
-    [--path path[:path]*]
+	exit 1
    [--help]
 This program is used to investigate how any changes inside your nixpkgs
 repository may hurt.  With these kind of information you may choose wisely
 where you should commit your changes.
 This program adapts it-self to your versionning system to avoid too much
 effort on your Internet bandwidth.  If you need to check more than one
 commits / revisions, you may use the following commands:
  --git remotes/trunk..master
  --svn 17670:17677
    Check the differences between each commit separating the first and the
    last commit.
  --path /etc/nixos/nixpkgs:/tmp/nixpkgs_1:/tmp/nixpkgs_2
    Check the differences between multiple directories containing different
    versions of nixpkgs.
 All these options exist with one commit / revision argument.  Such options
 are used to compare your \$NIXPKGS path with the specified version.
 If you omit to mention any other commit / revision, then your \$NIXPKGS path
 is compared with its last update.  This command is useful to test code from
 a dirty repository.
 "
  exit 1;
 }
 #####################
 # Process Arguments #
 #####################
 : ${NIXPKGS=/etc/nixos/nixpkgs/}
 vcs=""
 gitCommits=""
 svnRevisions=""
 pathLocations=""
 verbose=false
 argfun=""
 for arg; do
  if test -z "$argfun"; then
    case $arg in
      --git) vcs="git"; argfun="set_gitCommits";;
      --svn) vcs="svn"; argfun="set_svnRevisions";;
      --path) vcs="path"; argfun="set_pathLocations";;
      --verbose) verbose=true;;
      --help) usage;;
      *) usage;;
    esac
  else
    case $argfun in
      set_*)
        var=$(echo $argfun | sed 's,^set_,,')
        eval $var=$arg
        ;;
    esac
    argfun=""
  fi
 done
 if $verbose; then
  set -x
 else
  set +x
 fi
-############################
+# A slightly hacky way to get the config.
-# Find the repository type #
+parallel="$(echo 'config.rebuild-amount.parallel or false' | nix-repl . 2>/dev/null \
-############################
+			| grep -v '^\(nix-repl.*\)\?$' | tail -n 1 || true)"
-if test -z "$vcs"; then
+echo "Estimating rebuild amount by counting changed Hydra jobs."
  if test -x "$NIXPKGS/.git"; then
    if git --git-dir="$NIXPKGS/.git" branch > /dev/null 2>&1; then
      vcs="git"
      gitCommits=$(git --git-dir="$NIXPKGS/.git" log -n 1 --pretty=format:%H 2> /dev/null)
    fi
  elif test -x "$NIXPKGS/.svn"; then
    cd "$NIXPKGS"
    if svn info > /dev/null 2>&1; then
      vcs="svn";
      svnRevisions=$(svn info | sed -n 's,Revision: ,,p')
    fi
    cd -
  else
    usage
  fi
 fi
-###############################
+toRemove=()
 # Define a storage directory. #
 ###############################
-pkgListDir=""
+cleanup() {
-exitCode=1
+	rm -rf "${toRemove[@]}"
 cleanup(){
  test -e "$pkgListDir" && rm -rf "$pkgListDir"
  exit $exitCode;
 }
 trap cleanup EXIT SIGINT SIGQUIT ERR
-pkgListDir=$(mktemp --tmpdir -d rebuild-amount-XXXXXXXX)
+MKTEMP='mktemp --tmpdir nix-rebuild-amount-XXXXXXXX'
 vcsDir="$pkgListDir/.vcs"
-###########################
+nixexpr() {
-# Versionning for Dummies #
+	cat <<-EONIX
-###########################
+		let
 		  lib = import $1/lib;
 		  hydraJobs = import $1/pkgs/top-level/release.nix
 		    # Compromise: accuracy vs. resources needed for evaluation.
 		    { supportedSystems = cfg.systems or [ "x86_64-linux" "x86_64-darwin" ]; };
 		  cfg = (import $1 {}).config.rebuild-amount or {};
-path_init() {
+		  recurseIntoAttrs = attrs: attrs // { recurseForDerivations = true; };
-  if test "${pathLocations#*:}" = "$pathLocations"; then
+
-    pathLocations="$NIXPKGS:$pathLocations"
+		  # hydraJobs leaves recurseForDerivations as empty attrmaps;
-  fi
+		  # that would break nix-env and we also need to recurse everywhere.
-  pathLocations="${pathLocations}:"
+		  tweak = lib.mapAttrs
 		    (name: val:
 		      if name == "recurseForDerivations" then true
 		      else if lib.isAttrs val && val.type or null != "derivation"
 		              then recurseIntoAttrs (tweak val)
 		      else val
 		    );
 		  # Some of these contain explicit references to platform(s) we want to avoid;
 		  # some even (transitively) depend on ~/.nixpkgs/config.nix (!)
 		  blacklist = [
 		    "tarball" "metrics" "manual"
 		    "darwin-tested" "unstable" "stdenvBootstrapTools"
 		    "moduleSystem" "lib-tests" # these just confuse the output
 		  ];
 		in
 		  tweak (builtins.removeAttrs hydraJobs blacklist)
 	EONIX
 }
-path_getNext() {
+# Output packages in tree $2 that weren't in $1.
-  pathLoc="${pathLocations%%:*}"
+# Changing the output hash or name is taken as a change.
-  pathLocations="${pathLocations#*:}"
+# Extra nix-env parameters can be in $3
 newPkgs() {
 	# We use files instead of pipes, as running multiple nix-env processes
 	# could eat too much memory for a standard 4GiB machine.
 	local -a list
 	for i in 1 2; do
 		local l="$($MKTEMP)"
 		list[$i]="$l"
 		toRemove+=("$l")
 		local expr="$($MKTEMP)"
 		toRemove+=("$expr")
 		nixexpr "${!i}" > "$expr"
 		nix-env -f "$expr" -qaP --no-name --out-path --show-trace $3 \
 			| sort > "${list[$i]}" &
 		if [ "$parallel" != "true" ]; then
 			wait
 		fi
 	done
 	wait
 	comm -13 "${list[@]}"
 }
-path_setPath() {
+# Prepare nixpkgs trees.
-  path="$pathLoc"
+declare -a tree
-}
+for i in 1 2; do
 	if [ -n "${!i}" ]; then # use the given commit
 		dir="$($MKTEMP -d)"
 		tree[$i]="$dir"
 		toRemove+=("$dir")
-path_setName() {
+		git clone --shared --no-checkout --quiet . "${tree[$i]}"
-  name=$(echo "$pathLoc" | tr '/' '_')
+		(cd "${tree[$i]}" && git checkout --quiet "${!i}")
-}
+	else #use the current tree
-
+		tree[$i]="$(pwd)"
-################
+	fi
 # Git Commands #
 ################
 git_init() {
  git clone "$NIXPKGS/.git" "$vcsDir" > /dev/null 2>&1
  if echo "gitCommits" | grep -c "\.\." > /dev/null 2>&1; then
    gitCommits=$(git --git-dir="$vcsDir/.git" log --reverse --pretty=format:%H $gitCommits 2> /dev/null)
  else
    pathLocations="$vcsDir:$NIXPKGS"
    vcs="path"
    path_init
  fi
 }
 git_getNext() {
  git --git-dir="$vcsDir/.git" checkout $(echo "$gitCommits" | head -n 1) > /dev/null 2>&1
  gitCommits=$(echo "$gitCommits" | sed '1 d')
 }
 git_setPath() {
  path="$vcsDir"
 }
 git_setName() {
  name=$(git --git-dir="$vcsDir/.git" log -n 1 --pretty=format:%H  2> /dev/null)
 }
 #######################
 # Subversion Commands #
 #######################
 svn_init() {
  cp -r "$NIXPKGS" "$vcsDir" > /dev/null 2>&1
  if echo "svnRevisions" | grep -c ":" > /dev/null 2>&1; then
    svnRevisions=$(seq ${svnRevisions%:*} ${svnRevisions#*:})
  else
    pathLocations="$vcsDir:$NIXPKGS"
    vcs="path"
    path_init
  fi
 }
 svn_getNext() {
  cd "$vcsDir"
  svn checkout $(echo "$svnRevisions" | head -n 1) > /dev/null 2>&1
  cd -
  svnRevisions=$(echo "$svnRevisions" | sed '1 d')
 }
 svn_setPath() {
  path="$vcsDir"
 }
 svn_setName() {
  name=$(svn info  2> /dev/null | sed -n 's,Revision: ,,p')
 }
 ####################
 # Logical Commands #
 ####################
 init    () { ${vcs}_init; }
 getNext () { ${vcs}_getNext; }
 setPath () { ${vcs}_setPath; }
 setName () { ${vcs}_setName; }
 #####################
 # Check for Rebuild #
 #####################
 # Generate the list of all derivations that could be build from a nixpkgs
 # respository.  This list of derivation hashes is compared with previous
 # lists and a brief summary is produced on the output.
 compareNames () {
    nb=$(diff -y --suppress-common-lines --speed-large-files "$pkgListDir/$1.drvs" "$pkgListDir/$2.drvs" 2> /dev/null | wc -l)
    echo "$1 -> $2: $nb"
 }
 echo "Please wait, this may take some minutes ..."
 init
 first=""
 oldPrev=""
 prev=""
 curr=""
 while true; do
  getNext
  setPath # set path=...
  setName # set name=...
  curr="$name"
  test -z "$curr" && break || true
  nix-instantiate "$path" > "$pkgListDir/$curr.drvs" > /dev/null 2>&1 || true
  if test -n "$prev"; then
    compareNames "$prev" "$curr"
  else
    echo "Number of package to rebuild:"
    first="$curr"
  fi
  oldPrev="$prev"
  prev="$curr"
 done
-if test "$first" != "$oldPrev"; then
+newlist="$($MKTEMP)"
-  echo "Number of package to rebuild (first -> last):"
+toRemove+=("$newlist")
-  compareNames "$first" "$curr"
+# Notes:
-fi
+#	- the evaluation is done on x86_64-linux, like on Hydra.
 #	- using $newlist file so that newPkgs() isn't in a sub-shell (because of toRemove)
 newPkgs "${tree[1]}" "${tree[2]}" '--argstr system "x86_64-linux"' > "$newlist"
 # Hacky: keep only the last word of each attribute path and sort.
 sed -n 's/\([^. ]*\.\)*\([^. ]*\) .*$/\2/p' < "$newlist" \
 	| sort | uniq -c
 exitCode=0
@@ -0,0 +1,243 @@
 #! /usr/bin/env nix-shell
 #! nix-shell -i python3 -p 'python3.withPackages(ps: with ps; [ requests toolz ])'
 """
 Update a Python package expression by passing in the `.nix` file, or the directory containing it.
 You can pass in multiple files or paths.
 You'll likely want to use
 ``
  $ ./update-python-libraries ../../pkgs/development/python-modules/*
 ``
 to update all libraries in that folder.
 """
 import argparse
 import logging
 import os
 import re
 import requests
 import toolz
 INDEX = "https://pypi.io/pypi"
 """url of PyPI"""
 EXTENSIONS = ['tar.gz', 'tar.bz2', 'tar', 'zip', '.whl']
 """Permitted file extensions. These are evaluated from left to right and the first occurance is returned."""
 import logging
 logging.basicConfig(level=logging.INFO)
 def _get_values(attribute, text):
    """Match attribute in text and return all matches.
    :returns: List of matches.
    """
    regex = '{}\s+=\s+"(.*)";'.format(attribute)
    regex = re.compile(regex)
    values = regex.findall(text)
    return values
 def _get_unique_value(attribute, text):
    """Match attribute in text and return unique match.
    :returns: Single match.
    """
    values = _get_values(attribute, text)
    n = len(values)
    if n > 1:
        raise ValueError("found too many values for {}".format(attribute))
    elif n == 1:
        return values[0]
    else:
        raise ValueError("no value found for {}".format(attribute))
 def _get_line_and_value(attribute, text):
    """Match attribute in text. Return the line and the value of the attribute."""
    regex = '({}\s+=\s+"(.*)";)'.format(attribute)
    regex = re.compile(regex)
    value = regex.findall(text)
    n = len(value)
    if n > 1:
        raise ValueError("found too many values for {}".format(attribute))
    elif n == 1:
        return value[0]
    else:
        raise ValueError("no value found for {}".format(attribute))
 def _replace_value(attribute, value, text):
    """Search and replace value of attribute in text."""
    old_line, old_value = _get_line_and_value(attribute, text)
    new_line = old_line.replace(old_value, value)
    new_text = text.replace(old_line, new_line)
    return new_text
 def _fetch_page(url):
    r = requests.get(url)
    if r.status_code == requests.codes.ok:
        return r.json()
    else:
        raise ValueError("request for {} failed".format(url))
 def _get_latest_version_pypi(package, extension):
    """Get latest version and hash from PyPI."""
    url = "{}/{}/json".format(INDEX, package)
    json = _fetch_page(url)
    version = json['info']['version']
    for release in json['releases'][version]:
        if release['filename'].endswith(extension):
            # TODO: In case of wheel we need to do further checks!
            sha256 = release['digests']['sha256']
            break
    else:
        sha256 = None
    return version, sha256
 def _get_latest_version_github(package, extension):
    raise ValueError("updating from GitHub is not yet supported.")
 FETCHERS = {
    'fetchFromGitHub'   :   _get_latest_version_github,
    'fetchPypi'         :   _get_latest_version_pypi,
    'fetchurl'          :   _get_latest_version_pypi,
 }
 DEFAULT_SETUPTOOLS_EXTENSION = 'tar.gz'
 FORMATS = {
    'setuptools'        :   DEFAULT_SETUPTOOLS_EXTENSION,
    'wheel'             :   'whl'
 }
 def _determine_fetcher(text):
    # Count occurences of fetchers.
    nfetchers = sum(text.count('src = {}'.format(fetcher)) for fetcher in FETCHERS.keys())
    if nfetchers == 0:
        raise ValueError("no fetcher.")
    elif nfetchers > 1:
        raise ValueError("multiple fetchers.")
    else:
        # Then we check which fetcher to use.
        for fetcher in FETCHERS.keys():
            if 'src = {}'.format(fetcher) in text:
                return fetcher
 def _determine_extension(text, fetcher):
    """Determine what extension is used in the expression.
    If we use:
    - fetchPypi, we check if format is specified.
    - fetchurl, we determine the extension from the url.
    - fetchFromGitHub we simply use `.tar.gz`.
    """
    if fetcher == 'fetchPypi':
        try:
            format = _get_unique_value('format', text)
        except ValueError as e:
            format = None   # format was not given
        try:
            extension = _get_unique_value('extension', text)
        except ValueError as e:
            extension = None    # extension was not given
        if extension is None:
            if format is None:
                format = 'setuptools'
            extension = FORMATS[format]
    elif fetcher == 'fetchurl':
        url = _get_unique_value('url', text)
        extension = os.path.splitext(url)[1]
        if 'pypi' not in url:
            raise ValueError('url does not point to PyPI.')
    elif fetcher == 'fetchFromGitHub':
        raise ValueError('updating from GitHub is not yet implemented.')
    return extension
 def _update_package(path):
    # Read the expression
    with open(path, 'r') as f:
        text = f.read()
    # Determine pname.
    pname = _get_unique_value('pname', text)
    # Determine version.
    version = _get_unique_value('version', text)
    # First we check how many fetchers are mentioned.
    fetcher = _determine_fetcher(text)
    extension = _determine_extension(text, fetcher)
    new_version, new_sha256 = _get_latest_version_pypi(pname, extension)
    if new_version == version:
        logging.info("Path {}: no update available for {}.".format(path, pname))
        return False
    if not new_sha256:
        raise ValueError("no file available for {}.".format(pname))
    text = _replace_value('version', new_version, text)
    text = _replace_value('sha256', new_sha256, text)
    with open(path, 'w') as f:
        f.write(text)
        logging.info("Path {}: updated {} from {} to {}".format(path, pname, version, new_version))
    return True
 def _update(path):
    # We need to read and modify a Nix expression.
    if os.path.isdir(path):
        path = os.path.join(path, 'default.nix')
    # If a default.nix does not exist, we quit.
    if not os.path.isfile(path):
        logging.info("Path {}: does not exist.".format(path))
        return False
    # If file is not a Nix expression, we quit.
    if not path.endswith(".nix"):
        logging.info("Path {}: does not end with `.nix`.".format(path))
        return False
    try:
        return _update_package(path)
    except ValueError as e:
        logging.warning("Path {}: {}".format(path, e))
        return False
 def main():
    parser = argparse.ArgumentParser()
    parser.add_argument('package', type=str, nargs='+')
    args = parser.parse_args()
    packages = map(os.path.abspath, args.package)
    count = list(map(_update, packages))
    logging.info("{} package(s) updated".format(sum(count)))
 if __name__ == '__main__':
    main()
@@ -29,8 +29,10 @@ line. For instance, to create a container that has
 <literal>root</literal>:
 <screen>
-# nixos-container create foo --config 'services.openssh.enable = true; \
+# nixos-container create foo --config '
-  users.extraUsers.root.openssh.authorizedKeys.keys = ["ssh-dss AAAAB3N…"];'
+  services.openssh.enable = true;
  users.extraUsers.root.openssh.authorizedKeys.keys = ["ssh-dss AAAAB3N…"];
 '
 </screen>
 </para>
@@ -55,7 +57,7 @@ Thus, if something went wrong, you can get status info using
 </para>
-<para>If the container has started succesfully, you can log in as
+<para>If the container has started successfully, you can log in as
 root using the <command>root-login</command> operation:
 <screen>
@@ -97,8 +99,11 @@ This will build and activate the new configuration. You can also
 specify a new configuration on the command line:
 <screen>
-# nixos-container update foo --config 'services.httpd.enable = true; \
+# nixos-container update foo --config '
-  services.httpd.adminAddr = "foo@example.org";'
+  services.httpd.enable = true;
  services.httpd.adminAddr = "foo@example.org";
  networking.firewall.allowedTCPPorts = [ 80 ];
 '
 # curl http://$(nixos-container show-ip foo)/
 &lt;!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">…
@@ -35,6 +35,12 @@ or <literal>ext4</literal>, then it’s best to specify
 <option>fsType</option> to ensure that the kernel module is
 available.</para>
 <note><para>System startup will fail if any of the filesystems fails to mount,
 dropping you to the emergency shell.
 You can make a mount asynchronous and non-critical by adding
 <literal>options = [ "nofail" ];</literal>.
 </para></note>
 <xi:include href="luks-file-systems.xml" />
 </chapter>
@@ -45,6 +45,13 @@ services.xserver.displayManager.lightdm.enable = true;
 </programlisting>
 </para>
 <para>You can set the keyboard layout (and optionally the layout variant):
 <programlisting>
 services.xserver.layout = "de";
 services.xserver.xkbVariant = "neo";
 </programlisting>
 </para>
 <para>The X server is started automatically at boot time.  If you
 don’t want this to happen, you can set:
 <programlisting>
@@ -65,7 +65,7 @@ let
      chmod -R u+w .
      ln -s ${modulesDoc} configuration/modules.xml
      ln -s ${optionsDocBook} options-db.xml
-      echo "${version}" > version
+      printf "%s" "${version}" > version
    '';
  toc = builtins.toFile "toc.xml"
@@ -94,25 +94,43 @@ let
    "--stringparam chunk.toc ${toc}"
  ];
  manual-combined = runCommand "nixos-manual-combined"
    { inherit sources;
      buildInputs = [ libxml2 libxslt ];
      meta.description = "The NixOS manual as plain docbook XML";
    }
    ''
      ${copySources}
      xmllint --xinclude --output ./manual-combined.xml ./manual.xml
      xmllint --xinclude --noxincludenode \
         --output ./man-pages-combined.xml ./man-pages.xml
      xmllint --debug --noout --nonet \
        --relaxng ${docbook5}/xml/rng/docbook/docbook.rng \
        manual-combined.xml
      xmllint --debug --noout --nonet \
        --relaxng ${docbook5}/xml/rng/docbook/docbook.rng \
        man-pages-combined.xml
      mkdir $out
      cp manual-combined.xml $out/
      cp man-pages-combined.xml $out/
    '';
  olinkDB = runCommand "manual-olinkdb"
    { inherit sources;
      buildInputs = [ libxml2 libxslt ];
    }
    ''
      ${copySources}
      xsltproc \
        ${manualXsltprocOptions} \
        --stringparam collect.xref.targets only \
        --stringparam targets.filename "$out/manual.db" \
-        --nonet --xinclude \
+        --nonet \
        ${docbook5_xsl}/xml/xsl/docbook/xhtml/chunktoc.xsl \
-        ./manual.xml
+        ${manual-combined}/manual-combined.xml
      # Check the validity of the man pages sources.
      xmllint --noout --nonet --xinclude --noxincludenode \
        --relaxng ${docbook5}/xml/rng/docbook/docbook.rng \
        ./man-pages.xml
      cat > "$out/olinkdb.xml" <<EOF
      <?xml version="1.0" encoding="utf-8"?>
@@ -158,21 +176,15 @@ in rec {
      allowedReferences = ["out"];
    }
    ''
      ${copySources}
      # Check the validity of the manual sources.
      xmllint --noout --nonet --xinclude --noxincludenode \
        --relaxng ${docbook5}/xml/rng/docbook/docbook.rng \
        manual.xml
      # Generate the HTML manual.
      dst=$out/share/doc/nixos
      mkdir -p $dst
      xsltproc \
        ${manualXsltprocOptions} \
        --stringparam target.database.document "${olinkDB}/olinkdb.xml" \
-        --nonet --xinclude --output $dst/ \
+        --nonet --output $dst/ \
-        ${docbook5_xsl}/xml/xsl/docbook/xhtml/chunktoc.xsl ./manual.xml
+        ${docbook5_xsl}/xml/xsl/docbook/xhtml/chunktoc.xsl \
        ${manual-combined}/manual-combined.xml
      mkdir -p $dst/images/callouts
      cp ${docbook5_xsl}/xml/xsl/docbook/images/callouts/*.gif $dst/images/callouts/
@@ -190,13 +202,6 @@ in rec {
      buildInputs = [ libxml2 libxslt zip ];
    }
    ''
      ${copySources}
      # Check the validity of the manual sources.
      xmllint --noout --nonet --xinclude --noxincludenode \
        --relaxng ${docbook5}/xml/rng/docbook/docbook.rng \
        manual.xml
      # Generate the epub manual.
      dst=$out/share/doc/nixos
@@ -204,10 +209,11 @@ in rec {
        ${manualXsltprocOptions} \
        --stringparam target.database.document "${olinkDB}/olinkdb.xml" \
        --nonet --xinclude --output $dst/epub/ \
-        ${docbook5_xsl}/xml/xsl/docbook/epub/docbook.xsl ./manual.xml
+        ${docbook5_xsl}/xml/xsl/docbook/epub/docbook.xsl \
        ${manual-combined}/manual-combined.xml
      mkdir -p $dst/epub/OEBPS/images/callouts
-      cp -r ${docbook5_xsl}/xml/xsl/docbook/images/callouts/*.gif $dst/epub/OEBPS/images/callouts
+      cp -r ${docbook5_xsl}/xml/xsl/docbook/images/callouts/*.gif $dst/epub/OEBPS/images/callouts # */
      echo "application/epub+zip" > mimetype
      manual="$dst/nixos-manual.epub"
      zip -0Xq "$manual" mimetype
@@ -227,23 +233,16 @@ in rec {
      allowedReferences = ["out"];
    }
    ''
      ${copySources}
      # Check the validity of the man pages sources.
      xmllint --noout --nonet --xinclude --noxincludenode \
        --relaxng ${docbook5}/xml/rng/docbook/docbook.rng \
        ./man-pages.xml
      # Generate manpages.
      mkdir -p $out/share/man
-      xsltproc --nonet --xinclude \
+      xsltproc --nonet \
        --param man.output.in.separate.dir 1 \
        --param man.output.base.dir "'$out/share/man/'" \
        --param man.endnotes.are.numbered 0 \
        --param man.break.after.slash 1 \
        --stringparam target.database.document "${olinkDB}/olinkdb.xml" \
        ${docbook5_xsl}/xml/xsl/docbook/manpages/docbook.xsl \
-        ./man-pages.xml
+        ${manual-combined}/man-pages-combined.xml
    '';
 }
@@ -12,12 +12,12 @@ your <filename>configuration.nix</filename> to configure the system that
 would be installed on the CD.</para>
 <para>Default CD/DVD configurations are available
-inside <filename>nixos/modules/installer/cd-dvd</filename>.  To build them
+inside <filename>nixos/modules/installer/cd-dvd</filename>.
 you have to set <envar>NIXOS_CONFIG</envar> before
 running <command>nix-build</command> to build the ISO.
 <screen>
-$ nix-build -A config.system.build.isoImage -I nixos-config=modules/installer/cd-dvd/installation-cd-minimal.nix</screen>
+$ git clone https://github.com/NixOS/nixpkgs.git
 $ cd nixpkgs/nixos
 $ nix-build -A config.system.build.isoImage -I nixos-config=modules/installer/cd-dvd/installation-cd-minimal.nix default.nix</screen>
 </para>
@@ -41,8 +41,9 @@ options = {
    <term><varname>default</varname></term>
    <listitem>
      <para>The default value used if no value is defined by any
-      module.  A default is not required; in that case, if the option
+      module.  A default is not required; but if a default is not given,
-      value is never used, an error will be thrown.</para>
+      then users of the module will have to define the value of the
      option, otherwise an error will be thrown.</para>
    </listitem>
  </varlistentry>
@@ -95,7 +96,7 @@ options = {
  </itemizedlist>
  </para>
-  <para>Both approachs have problems.</para>
+  <para>Both approaches have problems.</para>
  <para>Making backends independent can quickly become hard to manage. For
    display managers, there can be only one enabled at a time, but the type
@@ -68,8 +68,7 @@
 <section><title>Value Types</title>
-   <para>Value types are type that take a value parameter. The only value type 
+   <para>Value types are type that take a value parameter.</para>
     in the library is <literal>enum</literal>.</para>
 <variablelist>
  <varlistentry>
@@ -141,6 +140,17 @@
          str</literal>. Multiple definitions cannot be 
        merged.</para></listitem>
  </varlistentry>
  <varlistentry>
    <term><varname>types.coercedTo</varname> <replaceable>from</replaceable>
        <replaceable>f</replaceable> <replaceable>to</replaceable></term>
    <listitem><para>Type <replaceable>to</replaceable> or type
        <replaceable>from</replaceable> which will be coerced to
 	type <replaceable>to</replaceable> using function
 	<replaceable>f</replaceable> which takes an argument of type
        <replaceable>from</replaceable> and return a value of type
 	<replaceable>to</replaceable>. Can be used to preserve backwards
        compatibility of an option if its type was changed.</para></listitem>
  </varlistentry>
 </variablelist>
 </section>
@@ -282,7 +292,7 @@ config.mod.two = { foo = 2; bar = "two"; };</screen></example>
 <screen>
 byte = mkOption {
  description = "An integer between 0 and 255.";
-  type = addCheck (x: x &gt;= 0 &amp;&amp; x &lt;= 255) types.int;
+  type = addCheck types.int (x: x &gt;= 0 &amp;&amp; x &lt;= 255);
 };</screen></example>
 <example xml:id='ex-extending-type-check-2'><title>Overriding a type 
@@ -386,7 +396,7 @@ code before creating a new type.</para>
    <listitem><para>For composed types that can take a submodule as type 
        parameter, this function can be used to substitute the parameter of a 
        submodule type. It takes a module as parameter and return the type with 
-        the submodule options substituted. It is usally defined as a type 
+        the submodule options substituted. It is usually defined as a type 
        function call with a recursive call to 
        <literal>substSubModules</literal>, e.g for a type 
        <literal>composedType</literal> that take an <literal>elemtype</literal> 
@@ -8,7 +8,7 @@
 <para>By default, NixOS’s <command>nixos-rebuild</command> command
 uses the NixOS and Nixpkgs sources provided by the
-<literal>nixos-unstable</literal> channel (kept in
+<literal>nixos</literal> channel (kept in
 <filename>/nix/var/nix/profiles/per-user/root/channels/nixos</filename>).
 To modify NixOS, however, you should check out the latest sources from
 Git.  This is as follows:
@@ -27,8 +27,8 @@ a subdirectory of the Nixpkgs repository.) The remote
 <literal>channels</literal> refers to a read-only repository that
 tracks the Nixpkgs/NixOS channels (see <xref linkend="sec-upgrading"/>
 for more information about channels). Thus, the Git branch
-<literal>channels/nixos-14.12</literal> will contain the latest built
+<literal>channels/nixos-17.03</literal> will contain the latest built
-and tested version available in the <literal>nixos-14.12</literal>
+and tested version available in the <literal>nixos-17.03</literal>
 channel.</para>
 <para>It’s often inconvenient to develop directly on the master
@@ -39,9 +39,9 @@ branch based on your current NixOS version:
 <screen>
 $ nixos-version
-14.04.273.ea1952b (Baboon)
+17.09pre104379.6e0b727 (Hummingbird)
-$ git checkout -b local ea1952b
+$ git checkout -b local 6e0b727
 </screen>
 Or, to base your local branch on the latest version available in a
@@ -49,17 +49,17 @@ NixOS channel:
 <screen>
 $ git remote update channels
-$ git checkout -b local channels/nixos-14.12
+$ git checkout -b local channels/nixos-17.03
 </screen>
-(Replace <literal>nixos-14.12</literal> with the name of the channel
+(Replace <literal>nixos-17.03</literal> with the name of the channel
 you want to use.) You can use <command>git merge</command> or
 <command>git rebase</command> to keep your local branch in sync with
 the channel, e.g.
 <screen>
 $ git remote update channels
-$ git merge channels/nixos-14.12
+$ git merge channels/nixos-17.03
 </screen>
 You can use <command>git cherry-pick</command> to copy commits from
@@ -87,7 +87,11 @@ $ ln -s <replaceable>/my/sources</replaceable>/nixpkgs ~/.nix-defexpr/nixpkgs
 You may want to delete the symlink
 <filename>~/.nix-defexpr/channels_root</filename> to prevent root’s
-NixOS channel from clashing with your own tree.</para>
+NixOS channel from clashing with your own tree (this may break the
 command-not-found utility though). If you want to go back to the default
 state, you may just remove the <filename>~/.nix-defexpr</filename>
 directory completely, log out and log in again and it should have been
 recreated with a link to the root channels.</para>
 <!-- FIXME: not sure what this means.
 <para>You should not pass the base directory
@@ -26,7 +26,8 @@ changes:
    <literal>vfat</literal> filesystem.</para>
  </listitem>
  <listitem>
-    <para>You must set <option>boot.loader.systemd-boot.enable</option> to
+    <para>Instead of <option>boot.loader.grub.device</option>,
    you must set <option>boot.loader.systemd-boot.enable</option> to
    <literal>true</literal>. <command>nixos-generate-config</command>
    should do this automatically for new configurations when booted in
    UEFI mode.</para>
@@ -11,7 +11,9 @@ a USB stick. You can use the <command>dd</command> utility to write the image:
 <command>dd if=<replaceable>path-to-image</replaceable>
 of=<replaceable>/dev/sdb</replaceable></command>. Be careful about specifying the
 correct drive; you can use the <command>lsblk</command> command to get a list of
-block devices.</para>
+block devices. If you're on OS X you can run <command>diskutil list</command>
 to see the list of devices; the device you'll use for the USB must be ejected
 before writing the image.</para>
 <para>The <command>dd</command> utility will write the image verbatim to the drive,
 making it the recommended option for both UEFI and non-UEFI installations. For
@@ -32,6 +34,11 @@ ISO, copy its contents verbatim to your drive, then either:
    in <link xlink:href="https://www.kernel.org/doc/Documentation/kernel-parameters.txt">
    the kernel documentation</link> for more details).</para>
  </listitem>
  <listitem>
    <para>If you want to load the contents of the ISO to ram after bootin
    (So you can remove the stick after bootup) you can append the parameter
    <literal>copytoram</literal>to the <literal>options</literal> field.</para>
  </listitem>
 </itemizedlist>
 </para>
@@ -37,15 +37,7 @@
 </orderedlist>
 <para>
-  There are a few modifications you should make in configuration.nix. Enable
+  There are a few modifications you should make in configuration.nix.
  the virtualbox guest service in the main block:
 </para>
 <programlisting>
 virtualisation.virtualbox.guest.enable = true;
 </programlisting>
 <para>
  Enable booting:
 </para>
@@ -15,12 +15,12 @@ been built.  These channels are:
 <itemizedlist>
  <listitem>
    <para><emphasis>Stable channels</emphasis>, such as <literal
-    xlink:href="https://nixos.org/channels/nixos-14.12">nixos-14.12</literal>.
+    xlink:href="https://nixos.org/channels/nixos-17.03">nixos-17.03</literal>.
    These only get conservative bug fixes and package upgrades.  For
    instance, a channel update may cause the Linux kernel on your
-    system to be upgraded from 3.4.66 to 3.4.67 (a minor bug fix), but
+    system to be upgraded from 4.9.16 to 4.9.17 (a minor bug fix), but
-    not from 3.4.<replaceable>x</replaceable> to
+    not from 4.9.<replaceable>x</replaceable> to
-    3.11.<replaceable>x</replaceable> (a major change that has the
+    4.11.<replaceable>x</replaceable> (a major change that has the
    potential to break things).  Stable channels are generally
    maintained until the next stable branch is created.</para>
    <para></para>
@@ -34,7 +34,7 @@ been built.  These channels are:
  </listitem>
  <listitem>
    <para><emphasis>Small channels</emphasis>, such as <literal
-    xlink:href="https://nixos.org/channels/nixos-14.12-small">nixos-14.12-small</literal>
+    xlink:href="https://nixos.org/channels/nixos-17.03-small">nixos-17.03-small</literal>
    or <literal
    xlink:href="https://nixos.org/channels/nixos-unstable-small">nixos-unstable-small</literal>. These
    are identical to the stable and unstable channels described above,
@@ -55,8 +55,8 @@ appliances.)</para>
 <para>When you first install NixOS, you’re automatically subscribed to
 the NixOS channel that corresponds to your installation source.   For
-instance, if you installed from a 14.12 ISO, you will be subscribed to
+instance, if you installed from a 17.03 ISO, you will be subscribed to
-the <literal>nixos-14.12</literal> channel.  To see which NixOS
+the <literal>nixos-17.03</literal> channel.  To see which NixOS
 channel you’re subscribed to, run the following as root:
 <screen>
@@ -71,16 +71,16 @@ To switch to a different NixOS channel, do
 </screen>
 (Be sure to include the <literal>nixos</literal> parameter at the
-end.)  For instance, to use the NixOS 14.12 stable channel:
+end.)  For instance, to use the NixOS 17.03 stable channel:
 <screen>
-# nix-channel --add https://nixos.org/channels/nixos-14.12 nixos
+# nix-channel --add https://nixos.org/channels/nixos-17.03 nixos
 </screen>
 If you have a server, you may want to use the “small” channel instead:
 <screen>
-# nix-channel --add https://nixos.org/channels/nixos-14.12-small nixos
+# nix-channel --add https://nixos.org/channels/nixos-17.03-small nixos
 </screen>
 And if you want to live on the bleeding edge:
@@ -130,7 +130,7 @@ runs, see <command>systemctl list-timers</command>.)  You can also
 specify a channel explicitly, e.g.
 <programlisting>
-system.autoUpgrade.channel = https://nixos.org/channels/nixos-15.09;
+system.autoUpgrade.channel = https://nixos.org/channels/nixos-17.03;
 </programlisting>
 </para>
@@ -18,7 +18,7 @@
    <para>If you encounter problems, please report them on the
    <literal
-    xlink:href="http://lists.science.uu.nl/mailman/listinfo/nix-dev">nix-dev@lists.science.uu.nl</literal>
+    xlink:href="https://groups.google.com/forum/#!forum/nix-devel">nix-devel</literal>
    mailing list or on the <link
    xlink:href="irc://irc.freenode.net/#nixos">
    <literal>#nixos</literal> channel on Freenode</link>.  Bugs should
@@ -28,7 +28,7 @@ has the following highlights:</para>
    since version 0.0 as well as the most recent <link
    xlink:href="http://www.stackage.org/">Stackage Nightly</link>
    snapshot. The announcement <link
-    xlink:href="http://lists.science.uu.nl/pipermail/nix-dev/2015-September/018138.html">&quot;Full
+    xlink:href="https://nixos.org/nix-dev/2015-September/018138.html">&quot;Full
    Stackage Support in Nixpkgs&quot;</link> gives additional
    details.</para>
  </listitem>
@@ -342,7 +342,7 @@ nix-env -f &quot;&lt;nixpkgs&gt;&quot; -iA haskellPackages.pandoc
 <listitem>
  <para>
-    Python 2.6 has been marked as broken (as it no longer recieves
+    Python 2.6 has been marked as broken (as it no longer receives
    security updates from upstream).
  </para>
 </listitem>
@@ -362,7 +362,7 @@ services.syncthing = {
  <listitem>
    <para>
      <literal>networking.firewall.allowPing</literal> is now enabled by
-      default. Users are encourarged to configure an approiate rate limit for
+      default. Users are encouraged to configure an appropriate rate limit for
      their machines using the Kernel interface at
      <filename>/proc/sys/net/ipv4/icmp_ratelimit</filename> and
      <filename>/proc/sys/net/ipv6/icmp/ratelimit</filename> or using the
@@ -78,13 +78,13 @@ following incompatible changes:</para>
    our package set it loosely based on the latest available LTS release, i.e.
    LTS 7.x at the time of this writing. New releases of NixOS and Nixpkgs will
    drop those old names entirely. <link
-    xlink:href="http://lists.science.uu.nl/pipermail/nix-dev/2016-June/020585.html">The
+    xlink:href="https://nixos.org/nix-dev/2016-June/020585.html">The
    motivation for this change</link> has been discussed at length on the
    <literal>nix-dev</literal> mailing list and in <link
    xlink:href="https://github.com/NixOS/nixpkgs/issues/14897">Github issue
    #14897</link>. Development strategies for Haskell hackers who want to rely
    on Nix and NixOS have been described in <link
-    xlink:href="http://lists.science.uu.nl/pipermail/nix-dev/2016-June/020642.html">another
+    xlink:href="https://nixos.org/nix-dev/2016-June/020642.html">another
    nix-dev article</link>.</para>
  </listitem>
@@ -4,7 +4,15 @@
         version="5.0"
         xml:id="sec-release-17.03">
-<title>Release 17.03 (“XXX”, 2017/03/??)</title>
+<title>Release 17.03 (“Gorilla”, 2017/03/31)</title>
 <section xmlns="http://docbook.org/ns/docbook"
         xmlns:xlink="http://www.w3.org/1999/xlink"
         xmlns:xi="http://www.w3.org/2001/XInclude"
         version="5.0"
         xml:id="sec-release-17.03-highlights">
 <title>Highlights</title>
 <para>In addition to numerous new and upgraded packages, this release
 has the following highlights: </para>
@@ -16,19 +24,40 @@ has the following highlights: </para>
    manual</link> for more information.</para>
  </listitem>
  <listitem>
    <para>This release is based on Glibc 2.25, GCC 5.4.0 and systemd
    232. The default Linux kernel is 4.9 and Nix is at 1.11.8.</para>
  </listitem>
  <listitem>
    <para>The default desktop environment now is KDE's Plasma 5. KDE 4 has been removed</para>
  </listitem>
  <listitem>
    <para>The setuid wrapper functionality now supports setting
    capabilities.</para>
  </listitem>
  <listitem>
-    <para>X.org server uses branch 1.19.  Due to ABI incompatibilities,
+    <para>X.org server uses branch 1.19. Due to ABI incompatibilities,
      <literal>ati_unfree</literal> keeps forcing 1.17
      and <literal>amdgpu-pro</literal> starts forcing 1.18.</para>
  </listitem>
  <listitem>
-    <para>PHP now defaults to PHP 7.1</para>
+    <para>
      Cross compilation has been rewritten. See the nixpkgs manual for
      details. The most obvious breaking change is that in derivations there is no
      <literal>.nativeDrv</literal> nor <literal>.crossDrv</literal> are now
      cross by default, not native.
    </para>
  </listitem>
  <listitem>
    <para>The <literal>overridePackages</literal> function has been rewritten
    to be replaced by <link
    xlink:href="https://nixos.org/nixpkgs/manual/#sec-overlays-install">
    overlays</link></para>
  </listitem>
  <listitem>
@@ -38,16 +67,115 @@ has the following highlights: </para>
    manual</link> for more information.</para>
  </listitem>
  <listitem>
    <para>PHP now defaults to PHP 7.1</para>
  </listitem>
 </itemizedlist>
 </section>
 <section xmlns="http://docbook.org/ns/docbook"
         xmlns:xlink="http://www.w3.org/1999/xlink"
         xmlns:xi="http://www.w3.org/2001/XInclude"
         version="5.0"
         xml:id="sec-release-17.03-new-services">
 <title>New Services</title>
 <para>The following new services were added since the last release:</para>
 <itemizedlist>
-  <listitem>
+  <listitem><para><literal>hardware/ckb.nix</literal></para></listitem>
-    <para></para>
+  <listitem><para><literal>hardware/mcelog.nix</literal></para></listitem>
-  </listitem>
+  <listitem><para><literal>hardware/usb-wwan.nix</literal></para></listitem>
  <listitem><para><literal>hardware/video/capture/mwprocapture.nix</literal></para></listitem>
  <listitem><para><literal>programs/adb.nix</literal></para></listitem>
  <listitem><para><literal>programs/chromium.nix</literal></para></listitem>
  <listitem><para><literal>programs/gphoto2.nix</literal></para></listitem>
  <listitem><para><literal>programs/java.nix</literal></para></listitem>
  <listitem><para><literal>programs/mtr.nix</literal></para></listitem>
  <listitem><para><literal>programs/oblogout.nix</literal></para></listitem>
  <listitem><para><literal>programs/vim.nix</literal></para></listitem>
  <listitem><para><literal>programs/wireshark.nix</literal></para></listitem>
  <listitem><para><literal>security/dhparams.nix</literal></para></listitem>
  <listitem><para><literal>services/audio/ympd.nix</literal></para></listitem>
  <listitem><para><literal>services/computing/boinc/client.nix</literal></para></listitem>
  <listitem><para><literal>services/continuous-integration/buildbot/master.nix</literal></para></listitem>
  <listitem><para><literal>services/continuous-integration/buildbot/worker.nix</literal></para></listitem>
  <listitem><para><literal>services/continuous-integration/gitlab-runner.nix</literal></para></listitem>
  <listitem><para><literal>services/databases/riak-cs.nix</literal></para></listitem>
  <listitem><para><literal>services/databases/stanchion.nix</literal></para></listitem>
  <listitem><para><literal>services/desktops/gnome3/gnome-terminal-server.nix</literal></para></listitem>
  <listitem><para><literal>services/editors/infinoted.nix</literal></para></listitem>
  <listitem><para><literal>services/hardware/illum.nix</literal></para></listitem>
  <listitem><para><literal>services/hardware/trezord.nix</literal></para></listitem>
  <listitem><para><literal>services/logging/journalbeat.nix</literal></para></listitem>
  <listitem><para><literal>services/mail/offlineimap.nix</literal></para></listitem>
  <listitem><para><literal>services/mail/postgrey.nix</literal></para></listitem>
  <listitem><para><literal>services/misc/couchpotato.nix</literal></para></listitem>
  <listitem><para><literal>services/misc/docker-registry.nix</literal></para></listitem>
  <listitem><para><literal>services/misc/errbot.nix</literal></para></listitem>
  <listitem><para><literal>services/misc/geoip-updater.nix</literal></para></listitem>
  <listitem><para><literal>services/misc/gogs.nix</literal></para></listitem>
  <listitem><para><literal>services/misc/leaps.nix</literal></para></listitem>
  <listitem><para><literal>services/misc/nix-optimise.nix</literal></para></listitem>
  <listitem><para><literal>services/misc/ssm-agent.nix</literal></para></listitem>
  <listitem><para><literal>services/misc/sssd.nix</literal></para></listitem>
  <listitem><para><literal>services/monitoring/arbtt.nix</literal></para></listitem>
  <listitem><para><literal>services/monitoring/netdata.nix</literal></para></listitem>
  <listitem><para><literal>services/monitoring/prometheus/default.nix</literal></para></listitem>
  <listitem><para><literal>services/monitoring/prometheus/alertmanager.nix</literal></para></listitem>
  <listitem><para><literal>services/monitoring/prometheus/blackbox-exporter.nix</literal></para></listitem>
  <listitem><para><literal>services/monitoring/prometheus/json-exporter.nix</literal></para></listitem>
  <listitem><para><literal>services/monitoring/prometheus/nginx-exporter.nix</literal></para></listitem>
  <listitem><para><literal>services/monitoring/prometheus/node-exporter.nix</literal></para></listitem>
  <listitem><para><literal>services/monitoring/prometheus/snmp-exporter.nix</literal></para></listitem>
  <listitem><para><literal>services/monitoring/prometheus/unifi-exporter.nix</literal></para></listitem>
  <listitem><para><literal>services/monitoring/prometheus/varnish-exporter.nix</literal></para></listitem>
  <listitem><para><literal>services/monitoring/sysstat.nix</literal></para></listitem>
  <listitem><para><literal>services/monitoring/telegraf.nix</literal></para></listitem>
  <listitem><para><literal>services/monitoring/vnstat.nix</literal></para></listitem>
  <listitem><para><literal>services/network-filesystems/cachefilesd.nix</literal></para></listitem>
  <listitem><para><literal>services/network-filesystems/glusterfs.nix</literal></para></listitem>
  <listitem><para><literal>services/network-filesystems/ipfs.nix</literal></para></listitem>
  <listitem><para><literal>services/networking/dante.nix</literal></para></listitem>
  <listitem><para><literal>services/networking/dnscrypt-wrapper.nix</literal></para></listitem>
  <listitem><para><literal>services/networking/fakeroute.nix</literal></para></listitem>
  <listitem><para><literal>services/networking/flannel.nix</literal></para></listitem>
  <listitem><para><literal>services/networking/htpdate.nix</literal></para></listitem>
  <listitem><para><literal>services/networking/miredo.nix</literal></para></listitem>
  <listitem><para><literal>services/networking/nftables.nix</literal></para></listitem>
  <listitem><para><literal>services/networking/powerdns.nix</literal></para></listitem>
  <listitem><para><literal>services/networking/pdns-recursor.nix</literal></para></listitem>
  <listitem><para><literal>services/networking/quagga.nix</literal></para></listitem>
  <listitem><para><literal>services/networking/redsocks.nix</literal></para></listitem>
  <listitem><para><literal>services/networking/wireguard.nix</literal></para></listitem>
  <listitem><para><literal>services/system/cgmanager.nix</literal></para></listitem>
  <listitem><para><literal>services/torrent/opentracker.nix</literal></para></listitem>
  <listitem><para><literal>services/web-apps/atlassian/confluence.nix</literal></para></listitem>
  <listitem><para><literal>services/web-apps/atlassian/crowd.nix</literal></para></listitem>
  <listitem><para><literal>services/web-apps/atlassian/jira.nix</literal></para></listitem>
  <listitem><para><literal>services/web-apps/frab.nix</literal></para></listitem>
  <listitem><para><literal>services/web-apps/nixbot.nix</literal></para></listitem>
  <listitem><para><literal>services/web-apps/selfoss.nix</literal></para></listitem>
  <listitem><para><literal>services/web-apps/quassel-webserver.nix</literal></para></listitem>
  <listitem><para><literal>services/x11/unclutter-xfixes.nix</literal></para></listitem>
  <listitem><para><literal>services/x11/urxvtd.nix</literal></para></listitem>
  <listitem><para><literal>system/boot/systemd-nspawn.nix</literal></para></listitem>
  <listitem><para><literal>virtualisation/ecs-agent.nix</literal></para></listitem>
  <listitem><para><literal>virtualisation/lxcfs.nix</literal></para></listitem>
  <listitem><para><literal>virtualisation/openstack/keystone.nix</literal></para></listitem>
  <listitem><para><literal>virtualisation/openstack/glance.nix</literal></para></listitem>
 </itemizedlist>
 </section>
 <section xmlns="http://docbook.org/ns/docbook"
         xmlns:xlink="http://www.w3.org/1999/xlink"
         xmlns:xi="http://www.w3.org/2001/XInclude"
         version="5.0"
         xml:id="sec-release-17.03-incompatibilities">
 <title>Backward Incompatibilities</title>
 <para>When upgrading from a previous release, please be aware of the
 following incompatible changes:</para>
@@ -55,10 +183,8 @@ following incompatible changes:</para>
 <itemizedlist>
  <listitem>
    <para>
-      Cross compilation has been rewritten. See the nixpkgs manual for
+      Derivations have no <literal>.nativeDrv</literal> nor <literal>.crossDrv</literal> 
-      details. The most obvious breaking change is that derivations absent a
+      and are now cross by default, not native.
      <literal>.nativeDrv</literal> or <literal>.crossDrv</literal> are now
      cross by default, not native.
    </para>
  </listitem>
@@ -95,15 +221,6 @@ following incompatible changes:</para>
    </para>
  </listitem>
  <listitem>
    <para>
      The Yama LSM is now enabled by default in the kernel,
      which prevents ptracing non-child processes.
      This means you will not be able to attach gdb to an existing process,
      but will need to start that process from gdb (so it is a child).
    </para>
  </listitem>
  <listitem>
    <para>
      The <literal>stripHash</literal> bash function in <literal>stdenv</literal>
@@ -183,7 +300,7 @@ following incompatible changes:</para>
    <para><literal>overridePackages</literal> function no longer exists.
    It is replaced by <link
    xlink:href="https://nixos.org/nixpkgs/manual/#sec-overlays-install">
-    overlays</link>.  For example, the following code:
+    overlays</link>. For example, the following code:
 <programlisting>
  let
@@ -198,7 +315,7 @@ following incompatible changes:</para>
  let
    pkgs = import &lt;nixpkgs&gt; {};
  in
-    import pkgs.path { overlays = [(self: super: ...)] }
+    import pkgs.path { overlays = [(self: super: ...)]; }
 </programlisting>
    </para>
@@ -228,7 +345,7 @@ following incompatible changes:</para>
  <listitem>
    <para>
    Iputils no longer provide ping6 and traceroute6. The functionality of
-    these tools have been integrated into ping and traceroute respectively. To
+    these tools has been integrated into ping and traceroute respectively. To
    enforce an address family the new flags <literal>-4</literal> and
    <literal>-6</literal> have been added. One notable incompatibility is that
    specifying an interface (for link-local IPv6 for instance) is no longer done
@@ -237,10 +354,60 @@ following incompatible changes:</para>
    </para>
  </listitem>
  <listitem>
    <para>
      The socket handling of the <literal>services.rmilter</literal> module
      has been fixed and refactored. As rmilter doesn't support binding to
      more than one socket, the options <literal>bindUnixSockets</literal>
      and <literal>bindInetSockets</literal> have been replaced by
      <literal>services.rmilter.bindSocket.*</literal>. The default is still
      a unix socket in <literal>/run/rmilter/rmilter.sock</literal>. Refer to
      the options documentation for more information.
    </para>
  </listitem>
  <listitem>
    <para>
      The <literal>fetch*</literal> functions no longer support md5,
      please use sha256 instead.
    </para>
  </listitem>
  <listitem>
    <para>
      The dnscrypt-proxy module interface has been streamlined around the
      <option>extraArgs</option> option. Where possible, legacy option
      declarations are mapped to <option>extraArgs</option> but will emit
      warnings. The <option>resolverList</option> has been outright
      removed: to use an unlisted resolver, use the
      <option>customResolver</option> option.
    </para>
  </listitem>
  <listitem>
    <para>
      torbrowser now stores local state under
      <filename>~/.local/share/tor-browser</filename> by default. Any
      browser profile data from the old location,
      <filename>~/.torbrowser4</filename>, must be migrated manually.
    </para>
  </listitem>
  <listitem>
    <para>
      The ihaskell, monetdb, offlineimap and sitecopy services have been removed.
    </para>
  </listitem>
 </itemizedlist>
 </section>
 <section xmlns="http://docbook.org/ns/docbook"
         xmlns:xlink="http://www.w3.org/1999/xlink"
         xmlns:xi="http://www.w3.org/2001/XInclude"
         version="5.0"
         xml:id="sec-release-17.03-notable-changes">
-<para>Other notable improvements:</para>
+<title>Other Notable Changes</title>
 <itemizedlist>
@@ -261,6 +428,18 @@ following incompatible changes:</para>
    </para>
  </listitem>
  <listitem>
    <para>Python 2.6 interpreter and package set have been removed.</para>
  </listitem>
  <listitem>
    <para>
      The Python 2.7 interpreter does not use modules anymore. Instead, all
      CPython interpreters now include the whole standard library except for `tkinter`,
      which is available in the Python package set.
    </para>
  </listitem>
  <listitem>
    <para>
      Python 2.7, 3.5 and 3.6 are now built deterministically and 3.4 mostly.
@@ -271,7 +450,65 @@ following incompatible changes:</para>
    </para>
  </listitem>
  <listitem>
    <para>
      The Python package sets now use a fixed-point combinator and the sets are
      available as attributes of the interpreters.
    </para>
  </listitem>
  <listitem>
    <para>
      The Python function <literal>buildPythonPackage</literal> has been improved and can be
      used to build from Setuptools source, Flit source, and precompiled Wheels.
    </para>
  </listitem>
  <listitem>
    <para>
      When adding new or updating current Python libraries, the expressions should be put
      in separate files in <literal>pkgs/development/python-modules</literal> and
      called from <literal>python-packages.nix</literal>.
    </para>
  </listitem>
  <listitem>
    <para>
      The dnscrypt-proxy service supports synchronizing the list of public
      resolvers without working DNS resolution. This fixes issues caused by the
      resolver list becoming outdated. It also improves the viability of
      DNSCrypt only configurations.
    </para>
  </listitem>
  <listitem>
    <para>
      Containers using bridged networking no longer lose their connection after
      changes to the host networking.
    </para>
  </listitem>
  <listitem>
    <para>
      ZFS supports pool auto scrubbing.
    </para>
  </listitem>
  <listitem>
    <para>
      The bind DNS utilities (e.g. dig) have been split into their own output and
      are now also available in <literal>pkgs.dnsutils</literal> and it is no longer
      necessary to pull in all of <literal>bind</literal> to use them.
    </para>
  </listitem>
  <listitem>
    <para>
      Per-user configuration was moved from <filename>~/.nixpkgs</filename> to
      <filename>~/.config/nixpkgs</filename>. The former is still valid for
      <filename>config.nix</filename> for backwards compatibility.
    </para>
  </listitem>
 </itemizedlist>
-
+</section>
 </section>
@@ -11,9 +11,35 @@ has the following highlights: </para>
 <itemizedlist>
  <listitem>
-    <para></para>
+    <para>
      The user handling now keeps track of deallocated UIDs/GIDs. When a user
      or group is revived, this allows it to be allocated the UID/GID it had before.
      A consequence is that UIDs and GIDs are no longer reused.
    </para>
  </listitem>
  <listitem>
    <para>
      The module option <option>services.xserver.xrandrHeads</option> now
      causes the first head specified in this list to be set as the primary
      head. Apart from that, it's now possible to also set additional options
      by using an attribute set, for example:
 <programlisting>
 { services.xserver.xrandrHeads = [
    "HDMI-0"
    {
      output = &quot;DVI-0&quot;;
      primary = true;
      monitorConfig = ''
        Option &quot;Rotate&quot; &quot;right&quot;
      '';
    }
  ];
 }
 </programlisting>
      This will set the <literal>DVI-0</literal> output to be the primary head,
      even though <literal>HDMI-0</literal> is the first head in the list.
    </para>
  </listitem>
 </itemizedlist>
 <para>The following new services were added since the last release:</para>
@@ -31,11 +57,81 @@ following incompatible changes:</para>
 <itemizedlist>
  <listitem>
    <para>
      <literal>aiccu</literal> package was removed. This is due to SixXS
      <link xlink:href="https://www.sixxs.net/main/"> sunsetting</link> its IPv6 tunnel.
    </para>
  </listitem>
  <listitem>
    <para>
      Top-level <literal>idea</literal> package collection was renamed.
      All JetBrains IDEs are now at <literal>jetbrains</literal>.
    </para>
  </listitem>
  <listitem>
    <para>
      <literal>flexget</literal>'s state database cannot be upgraded to its
      new internal format, requiring removal of any existing
      <literal>db-config.sqlite</literal> which will be automatically recreated.
    </para>
  </listitem>
  <listitem>
    <para>
      The ipfs package now doesn't ignore the <literal>dataDir</literal> option anymore. If you've ever set this option to anything other than the default you'll have to either unset it (so the default gets used) or migrate the old data manually with
 <programlisting>
 dataDir=&lt;valueOfDataDir&gt;
 mv /var/lib/ipfs/.ipfs/* $dataDir
 rmdir /var/lib/ipfs/.ipfs
 </programlisting>
    </para>
  </listitem>
  <listitem>
    <para>
      The following changes apply if the <literal>stateVersion</literal> is changed to 17.09 or higher.
      For <literal>stateVersion = "17.03</literal> or lower the old behavior is preserved.
    </para>
    <para>
      The <literal>postgres</literal> default version was changed from 9.5 to 9.6.
    </para>
    <para>
      The <literal>postgres</literal> superuser name has changed from <literal>root</literal> to <literal>postgres</literal> to more closely follow what other Linux distributions are doing.
    </para>
    <para>
      The <literal>postgres</literal> default <literal>dataDir</literal> has changed from <literal>/var/db/postgres</literal> to <literal>/var/lib/postgresql/$psqlSchema</literal> where $psqlSchema is 9.6 for example.
    </para>
    <para>
      The <literal>mysql</literal> default <literal>dataDir</literal> has changed from <literal>/var/mysql</literal> to <literal>/var/lib/mysql</literal>.
    </para>
  </listitem>
  <listitem>
    <para>
      The <literal>caddy</literal> service was previously using an extra
      <literal>.caddy</literal> in the data directory specified with the
      <literal>dataDir</literal> option. The contents of the
      <literal>.caddy</literal> directory are now expected to be in the
      <literal>dataDir</literal>.
    </para>
  </listitem>
  <listitem>
    <para>
      The <literal>ssh-agent</literal> user service is not started by default
      anymore. Use <literal>programs.ssh.startAgent</literal> to enable it if
      needed. There is also a new <literal>programs.gnupg.agent</literal>
      module that creates a <literal>gpg-agent</literal> user service. It can
      also serve as a SSH agent if <literal>enableSSHSupport</literal> is set.
    </para>
  </listitem>
  <listitem>
    <para>
      The <literal>services.tinc.networks.&lt;name&gt;.listenAddress</literal>
      option had a misleading name that did not correspond to its behavior. It
      now correctly defines the ip to listen for incoming connections on. To
      keep the previous behaviour, use
      <literal>services.tinc.networks.&lt;name&gt;.bindToAddress</literal>
      instead. Refer to the description of the options for more details.
    </para>
  </listitem>
 </itemizedlist>
 <para>Other notable improvements:</para>
 <itemizedlist>
@@ -49,6 +145,18 @@ following incompatible changes:</para>
      rest of the system on a stable release.
    </para>
  </listitem>
  <listitem>
    <para>
      Updated to FreeType 2.7.1, including a new TrueType engine.
      The new engine replaces the Infinality engine which was the default in
      NixOS. The default font rendering settings are now provided by
      fontconfig-penultimate, replacing fontconfig-ultimate; the new defaults
      are less invasive and provide rendering that is more consistent with
      other systems and hopefully with each font designer's intent. Some
      system-wide configuration has been removed from the Fontconfig NixOS
      module where user Fontconfig settings are available.
    </para>
  </listitem>
 </itemizedlist>
@@ -33,42 +33,124 @@
 , name ? "nixos-disk-image"
  # This prevents errors while checking nix-store validity, see
  # https://github.com/NixOS/nix/issues/1134
 , fixValidity ? true
 , format ? "raw"
 }:
 with lib;
-pkgs.vmTools.runInLinuxVM (
+let
  # Copied from https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/installer/cd-dvd/channel.nix
  # TODO: factor out more cleanly
  # Do not include these things:
  #   - The '.git' directory
  #   - Result symlinks from nix-build ('result', 'result-2', 'result-bin', ...)
  #   - VIM/Emacs swap/backup files ('.swp', '.swo', '.foo.swp', 'foo~', ...)
  filterFn = path: type: let basename = baseNameOf (toString path); in
    if type == "directory" then basename != ".git"
    else if type == "symlink" then builtins.match "^result(|-.*)$" basename == null
    else builtins.match "^((|\..*)\.sw[a-z]|.*~)$" basename == null;
  nixpkgs = builtins.filterSource filterFn pkgs.path;
  channelSources = pkgs.runCommand "nixos-${config.system.nixosVersion}" {} ''
    mkdir -p $out
    cp -prd ${nixpkgs} $out/nixos
    chmod -R u+w $out/nixos
    if [ ! -e $out/nixos/nixpkgs ]; then
      ln -s . $out/nixos/nixpkgs
    fi
    rm -rf $out/nixos/.git
    echo -n ${config.system.nixosVersionSuffix} > $out/nixos/.version-suffix
  '';
  metaClosure = pkgs.writeText "meta" ''
    ${config.system.build.toplevel}
    ${config.nix.package.out}
    ${channelSources}
  '';
  prepareImageInputs = with pkgs; [ rsync utillinux parted e2fsprogs lkl fakeroot config.system.build.nixos-prepare-root ] ++ stdenv.initialPath;
  # I'm preserving the line below because I'm going to search for it across nixpkgs to consolidate
  # image building logic. The comment right below this now appears in 4 different places in nixpkgs :)
  # !!! should use XML.
  sources = map (x: x.source) contents;
  targets = map (x: x.target) contents;
  prepareImage = ''
    export PATH=${pkgs.lib.makeSearchPathOutput "bin" "bin" prepareImageInputs}
    mkdir $out
    diskImage=nixos.raw
    truncate -s ${toString diskSize}M $diskImage
    ${if partitioned then ''
      parted $diskImage -- mklabel msdos mkpart primary ext4 1M -1s
      offset=$((2048*512))
    '' else ''
      offset=0
    ''}
    mkfs.${fsType} -F -L nixos -E offset=$offset $diskImage
    root="$PWD/root"
    mkdir -p $root
    # Copy arbitrary other files into the image
    # Semi-shamelessly copied from make-etc.sh. I (@copumpkin) shall factor this stuff out as part of
    # https://github.com/NixOS/nixpkgs/issues/23052.
    set -f
    sources_=(${concatStringsSep " " sources})
    targets_=(${concatStringsSep " " targets})
    set +f
    for ((i = 0; i < ''${#targets_[@]}; i++)); do
      source="''${sources_[$i]}"
      target="''${targets_[$i]}"
      if [[ "$source" =~ '*' ]]; then
        # If the source name contains '*', perform globbing.
        mkdir -p $root/$target
        for fn in $source; do
          rsync -a --no-o --no-g "$fn" $root/$target/
        done
      else
        mkdir -p $root/$(dirname $target)
        if ! [ -e $root/$target ]; then
          rsync -a --no-o --no-g $source $root/$target
        else
          echo "duplicate entry $target -> $source"
          exit 1
        fi
      fi
    done
    # TODO: Nix really likes to chown things it creates to its current user...
    fakeroot nixos-prepare-root $root ${channelSources} ${config.system.build.toplevel} closure
    echo "copying staging root to image..."
    cptofs ${pkgs.lib.optionalString partitioned "-P 1"} -t ${fsType} -i $diskImage $root/* /
  '';
 in pkgs.vmTools.runInLinuxVM (
  pkgs.runCommand name
-    { preVM =
+    { preVM = prepareImage;
-        ''
+      buildInputs = with pkgs; [ utillinux e2fsprogs ];
-          mkdir $out
+      exportReferencesGraph = [ "closure" metaClosure ];
-          diskImage=$out/nixos.${if format == "qcow2" then "qcow2" else "img"}
+      postVM = ''
-          ${pkgs.vmTools.qemu}/bin/qemu-img create -f ${format} $diskImage "${toString diskSize}M"
+        ${if format == "raw" then ''
-          mv closure xchg/
+          mv $diskImage $out/nixos.img
-        '';
+          diskImage=$out/nixos.img
-      buildInputs = with pkgs; [ utillinux perl e2fsprogs parted rsync ];
+        '' else ''
-
+          ${pkgs.qemu}/bin/qemu-img convert -f raw -O qcow2 $diskImage $out/nixos.qcow2
-      # I'm preserving the line below because I'm going to search for it across nixpkgs to consolidate
+          diskImage=$out/nixos.qcow2
-      # image building logic. The comment right below this now appears in 4 different places in nixpkgs :)
+        ''}
-      # !!! should use XML.
+        ${postVM}
-      sources = map (x: x.source) contents;
+      '';
      targets = map (x: x.target) contents;
      exportReferencesGraph =
        [ "closure" config.system.build.toplevel ];
      inherit postVM;
      memSize = 1024;
    }
    ''
      ${if partitioned then ''
        # Create a single / partition.
        parted /dev/vda mklabel msdos
        parted /dev/vda -- mkpart primary ext2 1M -1s
        . /sys/class/block/vda1/uevent
        mknod /dev/vda1 b $MAJOR $MINOR
        rootDisk=/dev/vda1
@@ -76,74 +158,34 @@ pkgs.vmTools.runInLinuxVM (
        rootDisk=/dev/vda
      ''}
-      # Create an empty filesystem and mount it.
+      # Some tools assume these exist
      mkfs.${fsType} -L nixos $rootDisk
      mkdir /mnt
      mount $rootDisk /mnt
      # Register the paths in the Nix database.
      printRegistration=1 perl ${pkgs.pathsFromGraph} /tmp/xchg/closure | \
          ${config.nix.package.out}/bin/nix-store --load-db --option build-users-group ""
      ${if fixValidity then ''
        # Add missing size/hash fields to the database. FIXME:
        # exportReferencesGraph should provide these directly.
        ${config.nix.package.out}/bin/nix-store --verify --check-contents --option build-users-group ""
      '' else ""}
      # In case the bootloader tries to write to /dev/sda…
      ln -s vda /dev/xvda
      ln -s vda /dev/sda
-      # Install the closure onto the image
+      mountPoint=/mnt
-      USER=root ${config.system.build.nixos-install}/bin/nixos-install \
+      mkdir $mountPoint
-        --closure ${config.system.build.toplevel} \
+      mount $rootDisk $mountPoint
        --no-channel-copy \
        --no-root-passwd \
        ${optionalString (!installBootLoader) "--no-bootloader"}
-      # Install a configuration.nix.
+      # Install a configuration.nix
      mkdir -p /mnt/etc/nixos
      ${optionalString (configFile != null) ''
        cp ${configFile} /mnt/etc/nixos/configuration.nix
      ''}
-      # Remove /etc/machine-id so that each machine cloning this image will get its own id
+      mount --rbind /dev  $mountPoint/dev
-      rm -f /mnt/etc/machine-id
+      mount --rbind /proc $mountPoint/proc
      mount --rbind /sys  $mountPoint/sys
-      # Copy arbitrary other files into the image
+      # Set up core system link, GRUB, etc.
-      # Semi-shamelessly copied from make-etc.sh. I (@copumpkin) shall factor this stuff out as part of
+      NIXOS_INSTALL_BOOTLOADER=1 chroot $mountPoint /nix/var/nix/profiles/system/bin/switch-to-configuration boot
      # https://github.com/NixOS/nixpkgs/issues/23052.
      set -f
      sources_=($sources)
      targets_=($targets)
      set +f
-      for ((i = 0; i < ''${#targets_[@]}; i++)); do
+      # TODO: figure out if I should activate, but for now I won't
-        source="''${sources_[$i]}"
+      # chroot $mountPoint /nix/var/nix/profiles/system/activate
        target="''${targets_[$i]}"
-        if [[ "$source" =~ '*' ]]; then
+      # The above scripts will generate a random machine-id and we don't want to bake a single ID into all our images
      rm -f $mountPoint/etc/machine-id
-          # If the source name contains '*', perform globbing.
+      umount -R /mnt
          mkdir -p /mnt/$target
          for fn in $source; do
            rsync -a --no-o --no-g "$fn" /mnt/$target/
          done
        else
          mkdir -p /mnt/$(dirname $target)
          if ! [ -e /mnt/$target ]; then
            rsync -a --no-o --no-g $source /mnt/$target
          else
            echo "duplicate entry $target -> $source"
            exit 1
          fi
        fi
      done
      umount /mnt
      # Make sure resize2fs works. Note that resize2fs has stricter criteria for resizing than a normal
      # mount, so the `-c 0` and `-i 0` don't affect it. Setting it to `now` doesn't produce deterministic
@@ -219,8 +219,8 @@ sub waitForMonitorPrompt {
 sub retry {
    my ($coderef) = @_;
    my $n;
-    for ($n = 0; $n < 900; $n++) {
+    for ($n = 899; $n >=0; $n--) {
-        return if &$coderef;
+        return if &$coderef($n);
        sleep 1;
    }
    die "action timed out after $n seconds";
@@ -518,6 +518,12 @@ sub waitUntilTTYMatches {
    $self->nest("waiting for $regexp to appear on tty $tty", sub {
        retry sub {
            my ($retries_remaining) = @_;
            if ($retries_remaining == 0) {
                $self->log("Last chance to match /$regexp/ on TTY$tty, which currently contains:");
                $self->log($self->getTTYText($tty));
            }
            return 1 if $self->getTTYText($tty) =~ /$regexp/;
        }
    });
@@ -542,16 +548,20 @@ sub getScreenText {
    $self->nest("performing optical character recognition", sub {
        my $tmpbase = Cwd::abs_path(".")."/ocr";
        my $tmpin = $tmpbase."in.ppm";
        my $tmpout = "$tmpbase.ppm";
        $self->sendMonitorCommand("screendump $tmpin");
-        system("ppmtopgm $tmpin | pamscale 4 -filter=lanczos > $tmpout") == 0
+
-            or die "cannot scale screenshot";
+        my $magickArgs = "-filter Catrom -density 72 -resample 300 "
                       . "-contrast -normalize -despeckle -type grayscale "
                       . "-sharpen 1 -posterize 3 -negate -gamma 100 "
                       . "-blur 1x65535";
        my $tessArgs = "-c debug_file=/dev/null --psm 11 --oem 2";
        $text = `convert $magickArgs $tmpin tiff:- | tesseract - - $tessArgs`;
        my $status = $? >> 8;
        unlink $tmpin;
-        system("tesseract $tmpout $tmpbase") == 0 or die "OCR failed";
+
-        unlink $tmpout;
+        die "OCR failed with exit code $status" if $status != 0;
        $text = read_file("$tmpbase.txt");
        unlink "$tmpbase.txt";
    });
    return $text;
 }
@@ -562,6 +572,12 @@ sub waitForText {
    my ($self, $regexp) = @_;
    $self->nest("waiting for $regexp to appear on the screen", sub {
        retry sub {
            my ($retries_remaining) = @_;
            if ($retries_remaining == 0) {
                $self->log("Last chance to match /$regexp/ on the screen, which currently contains:");
                $self->log($self->getScreenText);
            }
            return 1 if $self->getScreenText =~ /$regexp/;
        }
    });
@@ -596,6 +612,13 @@ sub waitForWindow {
    $self->nest("waiting for a window to appear", sub {
        retry sub {
            my @names = $self->getWindowNames;
            my ($retries_remaining) = @_;
            if ($retries_remaining == 0) {
                $self->log("Last chance to match /$regexp/ on the the window list, which currently contains:");
                $self->log(join(", ", @names));
            }
            foreach my $n (@names) {
                return 1 if $n =~ /$regexp/;
            }
@@ -613,29 +636,19 @@ sub copyFileFromHost {
 my %charToKey = (
-    '!' => "shift-0x02",
+    'A' => "shift-a", 'N' => "shift-n",  '-' => "0x0C", '_' => "shift-0x0C", '!' => "shift-0x02",
-    '@' => "shift-0x03",
+    'B' => "shift-b", 'O' => "shift-o",  '=' => "0x0D", '+' => "shift-0x0D", '@' => "shift-0x03",
-    '#' => "shift-0x04",
+    'C' => "shift-c", 'P' => "shift-p",  '[' => "0x1A", '{' => "shift-0x1A", '#' => "shift-0x04",
-    '$' => "shift-0x05",
+    'D' => "shift-d", 'Q' => "shift-q",  ']' => "0x1B", '}' => "shift-0x1B", '$' => "shift-0x05",
-    '%' => "shift-0x06",
+    'E' => "shift-e", 'R' => "shift-r",  ';' => "0x27", ':' => "shift-0x27", '%' => "shift-0x06",
-    '^' => "shift-0x07",
+    'F' => "shift-f", 'S' => "shift-s", '\'' => "0x28", '"' => "shift-0x28", '^' => "shift-0x07",
-    '&' => "shift-0x08",
+    'G' => "shift-g", 'T' => "shift-t",  '`' => "0x29", '~' => "shift-0x29", '&' => "shift-0x08",
-    '*' => "shift-0x09",
+    'H' => "shift-h", 'U' => "shift-u", '\\' => "0x2B", '|' => "shift-0x2B", '*' => "shift-0x09",
-    '(' => "shift-0x0A",
+    'I' => "shift-i", 'V' => "shift-v",  ',' => "0x33", '<' => "shift-0x33", '(' => "shift-0x0A",
-    ')' => "shift-0x0B",
+    'J' => "shift-j", 'W' => "shift-w",  '.' => "0x34", '>' => "shift-0x34", ')' => "shift-0x0B",
-    '-' => "0x0C", '_' => "shift-0x0C",
+    'K' => "shift-k", 'X' => "shift-x",  '/' => "0x35", '?' => "shift-0x35",
-    '=' => "0x0D", '+' => "shift-0x0D",
+    'L' => "shift-l", 'Y' => "shift-y",  ' ' => "spc",
-    '[' => "0x1A", '{' => "shift-0x1A",
+    'M' => "shift-m", 'Z' => "shift-z", "\n" => "ret",
    ']' => "0x1B", '}' => "shift-0x1B",
    ';' => "0x27", ':' => "shift-0x27",
   '\'' => "0x28", '"' => "shift-0x28",
    '`' => "0x29", '~' => "shift-0x29",
   '\\' => "0x2B", '|' => "shift-0x2B",
    ',' => "0x33", '<' => "shift-0x33",
    '.' => "0x34", '>' => "shift-0x34",
    '/' => "0x35", '?' => "shift-0x35",
    ' ' => "spc",
   "\n" => "ret",
 );
@@ -35,7 +35,7 @@ foreach my $vlan (split / /, $ENV{VLANS} || "") {
    if ($pid == 0) {
        dup2(fileno($pty->slave), 0);
        dup2(fileno($stdoutW), 1);
-        exec "vde_switch -s $socket" or _exit(1);
+        exec "vde_switch -s $socket --dirmode 0700" or _exit(1);
    }
    close $stdoutW;
    print $pty "version\n";
@@ -93,7 +93,7 @@ rec {
      vms = map (m: m.config.system.build.vm) (lib.attrValues nodes);
-      ocrProg = tesseract;
+      ocrProg = tesseract_4.override { enableLanguages = [ "eng" ]; };
      # Generate onvenience wrappers for running the test driver
      # interactively with the specified network, and for starting the
@@ -108,16 +108,17 @@ rec {
          mkdir -p $out/bin
          echo "$testScript" > $out/test-script
          ln -s ${testDriver}/bin/nixos-test-driver $out/bin/
-          vms="$(for i in ${toString vms}; do echo $i/bin/run-*-vm; done)"
+          vms=($(for i in ${toString vms}; do echo $i/bin/run-*-vm; done))
          wrapProgram $out/bin/nixos-test-driver \
-            --add-flags "$vms" \
+            --add-flags "''${vms[*]}" \
-            ${lib.optionalString enableOCR "--prefix PATH : '${ocrProg}/bin'"} \
+            ${lib.optionalString enableOCR
              "--prefix PATH : '${ocrProg}/bin:${imagemagick}/bin'"} \
            --run "testScript=\"\$(cat $out/test-script)\"" \
            --set testScript '$testScript' \
            --set VLANS '${toString vlans}'
          ln -s ${testDriver}/bin/nixos-test-driver $out/bin/nixos-run-vms
          wrapProgram $out/bin/nixos-run-vms \
-            --add-flags "$vms" \
+            --add-flags "''${vms[*]}" \
            ${lib.optionalString enableOCR "--prefix PATH : '${ocrProg}/bin'"} \
            --set tests 'startAll; joinAll;' \
            --set VLANS '${toString vlans}' \
@@ -6,10 +6,7 @@ let
  cfg = config.amazonImage;
 in {
-  imports =
+  imports = [ ../../../modules/virtualisation/amazon-image.nix ];
    [ ../../../modules/installer/cd-dvd/channel.nix
      ../../../modules/virtualisation/amazon-image.nix
    ];
  options.amazonImage = {
    contents = mkOption {
@@ -3,21 +3,20 @@
 # To start with do: nix-shell -p awscli --run "aws configure"
-
+set -e
 set -o pipefail
 #set -x
 stateDir=${TMPDIR:-/tmp}/ec2-image
 echo "keeping state in $stateDir"
 mkdir -p $stateDir
 version=$(nix-instantiate --eval --strict '<nixpkgs>' -A lib.nixpkgsVersion | sed s/'"'//g)
 major=${version:0:5}
 echo "NixOS version is $version ($major)"
 stateDir=/var/tmp/ec2-image-$version
 echo "keeping state in $stateDir"
 mkdir -p $stateDir
 rm -f ec2-amis.nix
-types="hvm pv"
+types="hvm"
 stores="ebs s3"
 regions="eu-west-1 eu-west-2 eu-central-1 us-east-1 us-east-2 us-west-1 us-west-2 ca-central-1 ap-southeast-1 ap-southeast-2 ap-northeast-1 ap-northeast-2 sa-east-1 ap-south-1"
@@ -206,7 +205,7 @@ for type in $types; do
                    # Register the AMI.
                    if [ $type = pv ]; then
-                        kernel=$(aws ec2 describe-images --owner amazon --filters "Name=name,Values=pv-grub-hd0_1.04-$arch.gz" | jq -r .Images[0].ImageId)
+                        kernel=$(aws ec2 describe-images --owner amazon --filters "Name=name,Values=pv-grub-hd0_1.05-$arch.gz" | jq -r .Images[0].ImageId)
                        if [ "$kernel" = null ]; then break; fi
                        echo "using PV-GRUB kernel $kernel"
                        extraFlags+=" --virtualization-type paravirtual --kernel $kernel"
@@ -1,15 +1,23 @@
-#! /bin/sh -e
+#!/usr/bin/env nix-shell
 #! nix-shell -i bash -p google-cloud-sdk
-BUCKET_NAME=${BUCKET_NAME:-nixos-images}
+set -euo pipefail
-export NIX_PATH=nixpkgs=../../../..
+
-export NIXOS_CONFIG=$(dirname $(readlink -f $0))/../../../modules/virtualisation/google-compute-image.nix
+BUCKET_NAME="${BUCKET_NAME:-nixos-images}"
-export TIMESTAMP=$(date +%Y%m%d%H%M)
+TIMESTAMP="$(date +%Y%m%d%H%M)"
 export TIMESTAMP
 nix-build '<nixpkgs/nixos>' \
-   -A config.system.build.googleComputeImage --argstr system x86_64-linux -o gce --option extra-binary-caches http://hydra.nixos.org -j 10
+   -A config.system.build.googleComputeImage \
   --arg configuration "{ imports = [ <nixpkgs/nixos/modules/virtualisation/google-compute-image.nix> ]; }" \
   --argstr system x86_64-linux \
   -o gce \
   -j 10
-img=$(echo gce/*.tar.gz)
+img_path=$(echo gce/*.tar.gz)
-if ! gsutil ls gs://${BUCKET_NAME}/$(basename $img); then
+img_name=$(basename "$img_path")
-  gsutil cp $img gs://${BUCKET_NAME}/$(basename $img)
+img_id=$(echo "$img_name" | sed 's|.raw.tar.gz$||;s|\.|-|g;s|_|-|g')
 if ! gsutil ls "gs://${BUCKET_NAME}/$img_name"; then
  gsutil cp "$img_path" "gs://${BUCKET_NAME}/$img_name"
 fi
-gcloud compute images create $(basename $img .raw.tar.gz | sed 's|\.|-|' | sed 's|_|-|') --source-uri gs://${BUCKET_NAME}/$(basename $img)
+gcloud compute images create "$img_id" --source-uri "gs://${BUCKET_NAME}/$img_name"
@@ -0,0 +1,270 @@
 { config, pkgs, lib, ... }:
 with lib;
 let
  cfg = config.fonts.fontconfig;
  fcBool = x: "<bool>" + (boolToString x) + "</bool>";
  # back-supported fontconfig version and package
  # version is used for font cache generation
  supportVersion = "210";
  supportPkg     = pkgs."fontconfig_${supportVersion}";
  # latest fontconfig version and package
  # version is used for configuration folder name, /etc/fonts/VERSION/
  # note: format differs from supportVersion and can not be used with makeCacheConf
  latestVersion  = pkgs.fontconfig.configVersion;
  latestPkg      = pkgs.fontconfig;
  # supported version fonts.conf
  supportFontsConf = pkgs.makeFontsConf { fontconfig = supportPkg; fontDirectories = config.fonts.fonts; };
  # configuration file to read fontconfig cache
  # version dependent
  # priority 0
  cacheConfSupport = makeCacheConf { version = supportVersion; };
  cacheConfLatest  = makeCacheConf {};
  # generate the font cache setting file for a fontconfig version
  # use latest when no version is passed
  makeCacheConf = { version ? null }:
    let
      fcPackage = if builtins.isNull version
                  then "fontconfig"
                  else "fontconfig_${version}";
      makeCache = fontconfig: pkgs.makeFontsCache { inherit fontconfig; fontDirectories = config.fonts.fonts; };
      cache     = makeCache pkgs."${fcPackage}";
      cache32   = makeCache pkgs.pkgsi686Linux."${fcPackage}";
    in
    pkgs.writeText "fc-00-nixos-cache.conf" ''
      <?xml version='1.0'?>
      <!DOCTYPE fontconfig SYSTEM 'fonts.dtd'>
      <fontconfig>
        <!-- Font directories -->
        ${concatStringsSep "\n" (map (font: "<dir>${font}</dir>") config.fonts.fonts)}
        <!-- Pre-generated font caches -->
        <cachedir>${cache}</cachedir>
        ${optionalString (pkgs.stdenv.isx86_64 && cfg.cache32Bit) ''
          <cachedir>${cache32}</cachedir>
        ''}
      </fontconfig>
    '';
  # The configuration to be included in /etc/font/
  penultimateConf = pkgs.runCommand "font-penultimate-conf" {} ''
    support_folder=$out/etc/fonts/conf.d
    latest_folder=$out/etc/fonts/${latestVersion}/conf.d
    mkdir -p $support_folder
    mkdir -p $latest_folder
    ln -s ${supportFontsConf} $support_folder/../fonts.conf
    ln -s ${latestPkg.out}/etc/fonts/fonts.conf \
          $latest_folder/../fonts.conf
    # fontconfig-penultimate various configuration files
    ln -s ${pkgs.fontconfig-penultimate}/etc/fonts/conf.d/*.conf \
          $support_folder
    ln -s ${pkgs.fontconfig-penultimate}/etc/fonts/conf.d/*.conf \
          $latest_folder
    ln -s ${cacheConfSupport} $support_folder/00-nixos-cache.conf
    ln -s ${cacheConfLatest}  $latest_folder/00-nixos-cache.conf
    rm $support_folder/10-antialias.conf $latest_folder/10-antialias.conf
    ln -s ${antialiasConf} $support_folder/10-antialias.conf
    ln -s ${antialiasConf} $latest_folder/10-antialias.conf
    rm $support_folder/10-hinting.conf $latest_folder/10-hinting.conf
    ln -s ${hintingConf} $support_folder/10-hinting.conf
    ln -s ${hintingConf} $latest_folder/10-hinting.conf
    ${optionalString cfg.useEmbeddedBitmaps ''
    rm $support_folder/10-no-embedded-bitmaps.conf
    rm $latest_folder/10-no-embedded-bitmaps.conf
    ''}
    rm $support_folder/10-subpixel.conf $latest_folder/10-subpixel.conf
    ln -s ${subpixelConf} $support_folder/10-subpixel.conf
    ln -s ${subpixelConf} $latest_folder/10-subpixel.conf
    ${optionalString (cfg.dpi != 0) ''
    ln -s ${dpiConf} $support_folder/11-dpi.conf
    ln -s ${dpiConf} $latest_folder/11-dpi.conf
    ''}
    ${optionalString (!cfg.includeUserConf) ''
    rm $support_folder/50-user.conf
    rm $latest_folder/50-user.conf
    ''}
    # 51-local.conf
    rm $latest_folder/51-local.conf
    substitute \
      ${pkgs.fontconfig-penultimate}/etc/fonts/conf.d/51-local.conf \
      $latest_folder/51-local.conf \
      --replace local.conf /etc/fonts/${latestVersion}/local.conf
    ln -s ${defaultFontsConf} $support_folder/52-default-fonts.conf
    ln -s ${defaultFontsConf} $latest_folder/52-default-fonts.conf
    ${optionalString cfg.allowBitmaps ''
    rm $support_folder/53-no-bitmaps.conf
    rm $latest_folder/53-no-bitmaps.conf
    ''}
    ${optionalString (!cfg.allowType1) ''
    ln -s ${rejectType1} $support_folder/53-no-type1.conf
    ln -s ${rejectType1} $latest_folder/53-no-type1.conf
    ''}
  '';
  hintingConf = pkgs.writeText "fc-10-hinting.conf" ''
    <?xml version='1.0'?>
    <!DOCTYPE fontconfig SYSTEM 'fonts.dtd'>
    <fontconfig>
      <!-- Default rendering settings -->
      <match target="pattern">
        <edit mode="append" name="hinting">
          ${fcBool cfg.hinting.enable}
        </edit>
        <edit mode="append" name="autohint">
          ${fcBool cfg.hinting.autohint}
        </edit>
        <edit mode="append" name="hintstyle">
          <const>hintslight</const>
        </edit>
      </match>
    </fontconfig>
  '';
  antialiasConf = pkgs.writeText "fc-10-antialias.conf" ''
    <?xml version='1.0'?>
    <!DOCTYPE fontconfig SYSTEM 'fonts.dtd'>
    <fontconfig>
      <!-- Default rendering settings -->
      <match target="pattern">
        <edit mode="append" name="antialias">
          ${fcBool cfg.antialias}
        </edit>
      </match>
    </fontconfig>
  '';
  subpixelConf = pkgs.writeText "fc-10-subpixel.conf" ''
    <?xml version='1.0'?>
    <!DOCTYPE fontconfig SYSTEM 'fonts.dtd'>
    <fontconfig>
      <!-- Default rendering settings -->
      <match target="pattern">
        <edit mode="append" name="rgba">
          <const>${cfg.subpixel.rgba}</const>
        </edit>
        <edit mode="append" name="lcdfilter">
          <const>lcd${cfg.subpixel.lcdfilter}</const>
        </edit>
      </match>
    </fontconfig>
  '';
  dpiConf = pkgs.writeText "fc-11-dpi.conf" ''
    <?xml version='1.0'?>
    <!DOCTYPE fontconfig SYSTEM 'fonts.dtd'>
    <fontconfig>
      <match target="pattern">
        <edit name="dpi" mode="assign">
          <double>${toString cfg.dpi}</double>
        </edit>
      </match>
    </fontconfig>
  '';
  defaultFontsConf =
    let genDefault = fonts: name:
      optionalString (fonts != []) ''
        <alias>
          <family>${name}</family>
          <prefer>
          ${concatStringsSep ""
          (map (font: ''
            <family>${font}</family>
          '') fonts)}
          </prefer>
        </alias>
      '';
    in
    pkgs.writeText "fc-52-nixos-default-fonts.conf" ''
    <?xml version='1.0'?>
    <!DOCTYPE fontconfig SYSTEM 'fonts.dtd'>
    <fontconfig>
      <!-- Default fonts -->
      ${genDefault cfg.defaultFonts.sansSerif "sans-serif"}
      ${genDefault cfg.defaultFonts.serif     "serif"}
      ${genDefault cfg.defaultFonts.monospace "monospace"}
    </fontconfig>
  '';
  rejectType1 = pkgs.writeText "fc-53-no-type1.conf" ''
    <?xml version="1.0"?>
    <!DOCTYPE fontconfig SYSTEM "fonts.dtd">
    <fontconfig>
    <!-- Reject Type 1 fonts -->
    <selectfont>
      <rejectfont>
        <pattern>
          <patelt name="fontformat"><string>Type 1</string></patelt>
        </pattern>
      </rejectfont>
    </selectfont>
    </fontconfig>
  '';
 in
 {
  options = {
    fonts = {
      fontconfig = {
        penultimate = {
          enable = mkOption {
            type = types.bool;
            default = true;
            description = ''
              Enable fontconfig-penultimate settings to supplement the
              NixOS defaults by providing per-font rendering defaults and
              metric aliases.
            '';
          };
        };
      };
    };
  };
  config = mkIf (config.fonts.fontconfig.enable && cfg.enable) {
    fonts.fontconfig.confPackages = [ penultimateConf ];
  };
 }
@@ -43,7 +43,7 @@ in
        ultimate = {
          enable = mkOption {
            type = types.bool;
-            default = true;
+            default = false;
            description = ''
              Enable fontconfig-ultimate settings (formerly known as
              Infinality). Besides the customizable settings in this NixOS
@@ -20,7 +20,7 @@ with lib;
 let cfg = config.fonts.fontconfig;
-    fcBool = x: "<bool>" + (if x then "true" else "false") + "</bool>";
+    fcBool = x: "<bool>" + (boolToString x) + "</bool>";
    # back-supported fontconfig version and package
    # version is used for font cache generation
@@ -75,23 +75,23 @@ let cfg = config.fonts.fontconfig;
      <fontconfig>
        <!-- Default rendering settings -->
-        <match target="font">
+        <match target="pattern">
-          <edit mode="assign" name="hinting">
+          <edit mode="append" name="hinting">
            ${fcBool cfg.hinting.enable}
          </edit>
-          <edit mode="assign" name="autohint">
+          <edit mode="append" name="autohint">
            ${fcBool cfg.hinting.autohint}
          </edit>
-          <edit mode="assign" name="hintstyle">
+          <edit mode="append" name="hintstyle">
-            <const>hint${cfg.hinting.style}</const>
+            <const>hintslight</const>
          </edit>
-          <edit mode="assign" name="antialias">
+          <edit mode="append" name="antialias">
            ${fcBool cfg.antialias}
          </edit>
-          <edit mode="assign" name="rgba">
+          <edit mode="append" name="rgba">
            <const>${cfg.subpixel.rgba}</const>
          </edit>
-          <edit mode="assign" name="lcdfilter">
+          <edit mode="append" name="lcdfilter">
            <const>lcd${cfg.subpixel.lcdfilter}</const>
          </edit>
        </match>
@@ -104,13 +104,6 @@ let cfg = config.fonts.fontconfig;
        </match>
        ''}
        <!-- Force autohint always -->
        <match target="font">
          <edit name="force_autohint" mode="assign">
            ${fcBool cfg.forceAutohint}
          </edit>
        </match>
      </fontconfig>
    '';
@@ -174,13 +167,6 @@ let cfg = config.fonts.fontconfig;
        </edit>
      </match>
      <!-- Render some monospace TTF fonts as bitmaps -->
      <match target="pattern">
        <edit name="bitmap_monospace" mode="assign">
          ${fcBool cfg.renderMonoTTFAsBitmap}
        </edit>
      </match>
      </fontconfig>
    '';
@@ -304,7 +290,11 @@ in
        antialias = mkOption {
          type = types.bool;
          default = true;
-          description = "Enable font antialiasing.";
+          description = ''
            Enable font antialiasing. At high resolution (> 200 DPI),
            antialiasing has no visible effect; users of such displays may want
            to disable this option.
          '';
        };
        dpi = mkOption {
@@ -320,7 +310,7 @@ in
          type = types.lines;
          default = "";
          description = ''
-            System-wide customization file contents, has higher priority than 
+            System-wide customization file contents, has higher priority than
            <literal>defaultFonts</literal> settings.
          '';
        };
@@ -358,26 +348,21 @@ in
          enable = mkOption {
            type = types.bool;
            default = true;
-            description = "Enable TrueType hinting.";
+            description = ''
              Enable font hinting. Hinting aligns glyphs to pixel boundaries to
              improve rendering sharpness at low resolution. At high resolution
              (> 200 dpi) hinting will do nothing (at best); users of such
              displays may want to disable this option.
            '';
          };
          autohint = mkOption {
            type = types.bool;
-            default = true;
+            default = false;
            description = ''
-              Enable the autohinter, which provides hinting for otherwise
+              Enable the autohinter in place of the default interpreter.
-              un-hinted fonts. The results are usually lower quality than
+              The results are usually lower quality than correctly-hinted
-              correctly-hinted fonts.
+              fonts, but better than unhinted fonts.
            '';
          };
          style = mkOption {
            type = types.enum ["none" "slight" "medium" "full"];
            default = "full";
            description = ''
              TrueType hinting style, one of <literal>none</literal>,
              <literal>slight</literal>, <literal>medium</literal>, or
              <literal>full</literal>.
            '';
          };
        };
@@ -398,7 +383,15 @@ in
            default = "rgb";
            type = types.enum ["rgb" "bgr" "vrgb" "vbgr" "none"];
            description = ''
-              Subpixel order.
+              Subpixel order. The overwhelming majority of displays are
              <literal>rgb</literal> in their normal orientation. Select
              <literal>vrgb</literal> for mounting such a display 90 degrees
              clockwise from its normal orientation or <literal>vbgr</literal>
              for mounting 90 degrees counter-clockwise. Select
              <literal>bgr</literal> in the unlikely event of mounting 180
              degrees from the normal orientation. Reverse these directions in
              the improbable event that the display's native subpixel order is
              <literal>bgr</literal>.
            '';
          };
@@ -406,7 +399,9 @@ in
            default = "default";
            type = types.enum ["none" "default" "light" "legacy"];
            description = ''
-              FreeType LCD filter.
+              FreeType LCD filter. At high resolution (> 200 DPI), LCD filtering
              has no visible effect; users of such displays may want to select
              <literal>none</literal>.
            '';
          };
@@ -444,31 +439,19 @@ in
          description = ''Use embedded bitmaps in fonts like Calibri.'';
        };
        forceAutohint = mkOption {
          type = types.bool;
          default = false;
          description = ''
            Force use of the TrueType Autohinter. Useful for debugging or
            free-software purists.
          '';
        };
        renderMonoTTFAsBitmap = mkOption {
          type = types.bool;
          default = false;
          description = ''Render some monospace TTF fonts as bitmaps.'';
        };
      };
    };
  };
-  config = mkIf cfg.enable {
+  config = mkMerge [
-    fonts.fontconfig.confPackages = [ confPkg ];
+    (mkIf cfg.enable {
-
+      environment.systemPackages    = [ pkgs.fontconfig ];
-    environment.systemPackages    = [ pkgs.fontconfig ];
+      environment.etc.fonts.source  = "${fontconfigEtc}/etc/fonts/";
-    environment.etc.fonts.source  = "${fontconfigEtc}/etc/fonts/";
+    })
-  };
+    (mkIf (cfg.enable && !cfg.penultimate.enable) {
      fonts.fontconfig.confPackages = [ confPkg ];
    })
  ];
 }
@@ -37,6 +37,7 @@ with lib;
        pkgs.xorg.fontbhlucidatypewriter75dpi
        pkgs.dejavu_fonts
        pkgs.freefont_ttf
        pkgs.gyre-fonts # TrueType substitutes for standard PostScript fonts
        pkgs.liberation_ttf
        pkgs.xorg.fontbh100dpi
        pkgs.xorg.fontmiscmisc
@@ -2,21 +2,27 @@
 with lib;
 let
  glibcLocales = pkgs.glibcLocales.override {
    allLocales = any (x: x == "all") config.i18n.supportedLocales;
    locales = config.i18n.supportedLocales;
  };
 in
 {
  ###### interface
  options = {
    i18n = {
      glibcLocales = mkOption {
        type = types.path;
        default = pkgs.glibcLocales.override {
          allLocales = any (x: x == "all") config.i18n.supportedLocales;
          locales = config.i18n.supportedLocales;
        };
        example = literalExample "pkgs.glibcLocales";
        description = ''
          Customized pkg.glibcLocales package.
          Changing this option can disable handling of i18n.defaultLocale
          and supportedLocale.
        '';
      };
      defaultLocale = mkOption {
        type = types.str;
        default = "en_US.UTF-8";
@@ -118,7 +124,7 @@ in
        '');
    environment.systemPackages =
-      optional (config.i18n.supportedLocales != []) glibcLocales;
+      optional (config.i18n.supportedLocales != []) config.i18n.glibcLocales;
    environment.sessionVariables =
      { LANG = config.i18n.defaultLocale;
@@ -126,7 +132,7 @@ in
      };
    systemd.globalEnvironment = mkIf (config.i18n.supportedLocales != []) {
-      LOCALE_ARCHIVE = "${glibcLocales}/lib/locale/locale-archive";
+      LOCALE_ARCHIVE = "${config.i18n.glibcLocales}/lib/locale/locale-archive";
    };
    # ‘/etc/locale.conf’ is used by systemd.
@@ -19,7 +19,6 @@ let
      bind_policy ${config.users.ldap.bind.policy}
      ${optionalString config.users.ldap.useTLS ''
        ssl start_tls
        tls_checkpeer no
      ''}
      ${optionalString (config.users.ldap.bind.distinguishedName != "") ''
        binddn ${config.users.ldap.bind.distinguishedName}
@@ -178,10 +178,10 @@ in
    environment.etc =
      { # /etc/services: TCP/UDP port assignments.
-        "services".source = pkgs.iana_etc + "/etc/services";
+        "services".source = pkgs.iana-etc + "/etc/services";
        # /etc/protocols: IP protocol numbers.
-        "protocols".source  = pkgs.iana_etc + "/etc/protocols";
+        "protocols".source  = pkgs.iana-etc + "/etc/protocols";
        # /etc/rpc: RPC program numbers.
        "rpc".source = pkgs.glibc.out + "/etc/rpc";
@@ -222,13 +222,13 @@ in
            '' + cfg.extraResolvconfConf + ''
            '';
-      } // (optionalAttrs config.services.resolved.enable (
+      } // optionalAttrs config.services.resolved.enable {
-        if dnsmasqResolve then {
+        # symlink the static version of resolv.conf as recommended by upstream:
-          "dnsmasq-resolv.conf".source = "/run/systemd/resolve/resolv.conf";
+        # https://www.freedesktop.org/software/systemd/man/systemd-resolved.html#/etc/resolv.conf
-        } else {
+        "resolv.conf".source = "${pkgs.systemd}/lib/systemd/resolv.conf";
-          "resolv.conf".source = "/run/systemd/resolve/resolv.conf";
+      } // optionalAttrs (config.services.resolved.enable && dnsmasqResolve) {
-        }
+        "dnsmasq-resolv.conf".source = "/run/systemd/resolve/resolv.conf";
-      ));
+      };
      networking.proxy.envVars =
        optionalAttrs (cfg.proxy.default != null) {
@@ -6,22 +6,29 @@ with lib;
 let
-  inherit (config.services.avahi) nssmdns;
+  # only with nscd up and running we can load NSS modules that are not integrated in NSS
-  inherit (config.services.samba) nsswins;
+  canLoadExternalModules = config.services.nscd.enable;
-  ldap = (config.users.ldap.enable && config.users.ldap.nsswitch);
+  myhostname = canLoadExternalModules;
-  sssd = config.services.sssd.enable;
+  mymachines = canLoadExternalModules;
  nssmdns = canLoadExternalModules && config.services.avahi.nssmdns;
  nsswins = canLoadExternalModules && config.services.samba.nsswins;
  ldap = canLoadExternalModules && (config.users.ldap.enable && config.users.ldap.nsswitch);
  sssd = canLoadExternalModules && config.services.sssd.enable;
  resolved = canLoadExternalModules && config.services.resolved.enable;
-  hostArray = [ "files" "mymachines" ]
+  hostArray = [ "files" ]
    ++ optionals mymachines [ "mymachines" ]
    ++ optionals nssmdns [ "mdns_minimal [!UNAVAIL=return]" ]
    ++ optionals nsswins [ "wins" ]
    ++ optionals resolved ["resolve [!UNAVAIL=return]"]
    ++ [ "dns" ]
    ++ optionals nssmdns [ "mdns" ]
-    ++ ["myhostname" ];
+    ++ optionals myhostname ["myhostname" ];
  passwdArray = [ "files" ]
    ++ optional sssd "sss"
    ++ optionals ldap [ "ldap" ]
-    ++ [ "mymachines" ];
+    ++ optionals mymachines [ "mymachines" ];
  shadowArray = [ "files" ]
    ++ optional sssd "sss"
@@ -34,6 +41,7 @@ in {
  options = {
    # NSS modules.  Hacky!
    # Only works with nscd!
    system.nssModules = mkOption {
      type = types.listOf types.path;
      internal = true;
@@ -53,6 +61,18 @@ in {
  };
  config = {
    assertions = [
      {
        # generic catch if the NixOS module adding to nssModules does not prevent it with specific message.
        assertion = config.system.nssModules.path != "" -> canLoadExternalModules;
        message = "Loading NSS modules from path ${config.system.nssModules.path} requires nscd being enabled.";
      }
      {
        # resolved does not need to add to nssModules, therefore needs an extra assertion
        assertion = resolved -> canLoadExternalModules;
        message = "Loading systemd-resolved's nss-resolve NSS module requires nscd being enabled.";
      }
    ];
    # Name Service Switch configuration file.  Required by the C
    # library.  !!! Factor out the mdns stuff.  The avahi module
@@ -76,7 +96,7 @@ in {
    # configured IP addresses, or ::1 and 127.0.0.2 as
    # fallbacks. Systemd also provides nss-mymachines to return IP
    # addresses of local containers.
-    system.nssModules = [ config.systemd.package.out ];
+    system.nssModules = optionals canLoadExternalModules [ config.systemd.package.out ];
  };
 }
@@ -6,6 +6,7 @@ with lib;
 let
  cfg = config.hardware.pulseaudio;
  alsaCfg = config.sound;
  systemWide = cfg.enable && cfg.systemWide;
  nonSystemWide = cfg.enable && !cfg.systemWide;
@@ -76,6 +77,7 @@ let
    ctl.!default {
      type pulse
    }
    ${alsaCfg.extraConfig}
  '');
 in {
@@ -240,11 +242,14 @@ in {
      };
      systemd.user = {
        services.pulseaudio = {
          restartIfChanged = true;
          serviceConfig = {
            RestartSec = "500ms";
            PassEnvironment = "DISPLAY";
          };
-          environment = { DISPLAY = ":${toString config.services.xserver.display}"; };
+        };
-          restartIfChanged = true;
+        sockets.pulseaudio = {
          wantedBy = [ "sockets.target" ];
        };
      };
    })
@@ -55,7 +55,7 @@ in
    environment.profileRelativeEnvVars = mkOption {
      type = types.attrsOf (types.listOf types.str);
-      example = { PATH = [ "/bin" "/sbin" ]; MANPATH = [ "/man" "/share/man" ]; };
+      example = { PATH = [ "/bin" ]; MANPATH = [ "/man" "/share/man" ]; };
      description = ''
        Attribute set of environment variable.  Each attribute maps to a list
        of relative paths.  Each relative path is appended to the each profile
@@ -168,9 +168,6 @@ in
         ${cfg.extraInit}
         # The setuid/setcap wrappers override other bin directories.
         export PATH="${config.security.wrapperDir}:$PATH"
         # ~/bin if it exists overrides other bin directories.
         export PATH="$HOME/bin:$PATH"
       '';
@@ -60,9 +60,10 @@ in
    # Hide kernel pointers (e.g. in /proc/modules) for unprivileged
    # users as these make it easier to exploit kernel vulnerabilities.
-    #
+    boot.kernel.sysctl."kernel.kptr_restrict" = 1;
-    # Removed under grsecurity.
+
-    boot.kernel.sysctl."kernel.kptr_restrict" =
+    # Disable YAMA by default to allow easy debugging.
-      if (config.boot.kernelPackages.kernel.features.grsecurity or false) then null else 1;
+    boot.kernel.sysctl."kernel.yama.ptrace_scope" = mkDefault 0;
  };
 }
@@ -115,7 +115,6 @@ in
        "/share/mime"
        "/share/nano"
        "/share/org"
        "/share/terminfo"
        "/share/themes"
        "/share/vim-plugins"
        "/share/vulkan"
--- a/Show More
+++ b/Show More