From 8e74e1fdedbadd58e218d99f215ef91e6b84e3e7 Mon Sep 17 00:00:00 2001
From: Moritz Maxeiner <moritz@ucworks.org>
Date: Mon, 3 Feb 2014 22:50:17 +0100
Subject: [PATCH 01/59] Replace the current Yubikey PBA implementation with the
 previous one.

Rationale:
  * The main reason for choosing to implement the PBA in accordance
    with the Yubico documentation was to prevent a MITM-USB-attack
    successfully recovering the new LUKS key.
  * However, a MITM-USB-attacker can read user id and password when
    they were entered for PBA, which allows him to recover the new
    challenge after the PBA is complete, with which he can challenge
    the Yubikey, decrypt the new AES blob and recover the LUKS key.
  * Additionally, since the Yubikey shared secret is stored in the
    same AES blob, after such an attack not only is the LUKS device
    compromised, the Yubikey is as well, since the shared secret
    has also been recovered by the attacker.
  * Furthermore, with this method an attacker could also bruteforce
    the AES blob, if he has access to the unencrypted device, which
    would again compromise the Yubikey, should he be successful.
  * Finally, with this method, once the LUKS key has been recovered
    once, the encryption is permanently broken, while with the previous
    system, the LUKS key itself it changed at every successful boot,
    so recovering it once will not necessarily result in a permanent
    breakage and will also not compromise the Yubikey itself (since
    its secret is never stored anywhere but on the Yubikey itself).

Summary:
The current implementation opens up up vulnerability to brute-forcing
the AES blob, while retaining the current MITM-USB attack, additionally
making the consequences of this attack permanent and extending it to
the Yubikey itself.
---
 nixos/modules/system/boot/luksroot.nix | 134 ++++++++-----------------
 1 file changed, 42 insertions(+), 92 deletions(-)

diff --git a/nixos/modules/system/boot/luksroot.nix b/nixos/modules/system/boot/luksroot.nix
index 8547682284f..d70d1341166 100644
--- a/nixos/modules/system/boot/luksroot.nix
+++ b/nixos/modules/system/boot/luksroot.nix
@@ -39,27 +39,11 @@ let
     ${optionalString (luks.yubikeySupport && (yubikey != null)) ''
 
     rbtohex() {
-        od -An -vtx1 | tr -d ' \n'
+        ( od -An -vtx1 | tr -d ' \n' )
     }
 
     hextorb() {
-        tr '[:lower:]' '[:upper:]' | sed -e 's|\([0-9A-F]\{2\}\)|\\\\\\x\1|gI' | xargs printf
-    }
-
-    take() {
-        local c="$1"
-        shift
-        head -c $c "$@"
-    }
-
-    drop() {
-        local c="$1"
-        shift
-        if [ -e "$1" ]; then
-            cat "$1" | ( dd of=/dev/null bs="$c" count=1 2>/dev/null ; dd 2>/dev/null )
-        else
-            ( dd of=/dev/null bs="$c" count=1 2>/dev/null ; dd 2>/dev/null )
-        fi
+        ( tr '[:lower:]' '[:upper:]' | sed -e 's/\([0-9A-F]\{2\}\)/\\\\\\x\1/gI'| xargs printf )
     }
 
     open_yubikey() {
@@ -70,83 +54,41 @@ let
         local uuid_r
         local k_user
         local challenge
-        local k_blob
-        local aes_blob_decrypted
-        local checksum_correct
-        local checksum
-        local uuid_luks
-        local user_record
+        local opened
 
-        uuid_luks="$(cryptsetup luksUUID ${device} | take 36 | tr -d '-')"
+        sleep 1
 
-        ${optionalString (!yubikey.multiUser) ''
-        user_record="$(cat ${yubikey.storage.mountPoint}${yubikey.storage.path})"
-        uuid_r="$(echo -n $user_record | take 32)"
-        ''}
+        uuid_r="$(cat ${yubikey.storage.mountPoint}${yubikey.storage.path})"
 
         for try in $(seq 3); do
 
-            ${optionalString yubikey.multiUser ''
-            local user_id
-            echo -n "Enter user id: "
-            read -s user_id
-            echo
-            ''}
-
             ${optionalString yubikey.twoFactor ''
             echo -n "Enter two-factor passphrase: "
             read -s k_user
             echo
             ''}
 
-            ${optionalString yubikey.multiUser ''
-            local user_id_hash
-            user_id_hash="$(echo -n $user_id | openssl-wrap dgst -binary -sha512 | rbtohex)"
+            challenge="$(echo -n $k_user$uuid_r | openssl-wrap dgst -binary -sha512 | rbtohex)"
 
-            user_record="$(sed -n -e /^$user_id_hash[^$]*$/p ${yubikey.storage.mountPoint}${yubikey.storage.path} | tr -d '\n')"
+            k_luks="$(ykchalresp -${toString yubikey.slot} -x $challenge 2>/dev/null)"
 
-            if [ ! -z "$user_record" ]; then
-                user_record="$(echo -n $user_record | drop 128)"
-                uuid_r="$(echo -n $user_record | take 32)"
-            ''}
+            echo -n "$k_luks" | hextorb | cryptsetup luksOpen ${device} ${name} ${optionalString allowDiscards "--allow-discards"} --key-file=-
 
-                challenge="$(echo -n $k_user$uuid_r$uuid_luks | openssl-wrap dgst -binary -sha1 | rbtohex)"
-
-                k_blob="$(ykchalresp -${toString yubikey.slot} -x $challenge 2>/dev/null)"
-
-                aes_blob_decrypted="$(echo -n $user_record | drop 32 | hextorb | openssl-wrap enc -d -aes-256-ctr -K $k_blob -iv $uuid_r | rbtohex)"
-
-                checksum="$(echo -n $aes_blob_decrypted | drop 168)"
-                if [ "$(echo -n $aes_blob_decrypted | hextorb | take 84 | openssl-wrap dgst -binary -sha512 | rbtohex)" == "$checksum" ]; then
-                    checksum_correct=1
-                    break
-                else
-                    checksum_correct=0
-                    echo "Authentication failed!"
-                fi
-
-            ${optionalString yubikey.multiUser ''
+            if [ $? == "0" ]; then
+                opened=true
+                break
             else
-                checksum_correct=0
+                opened=false
                 echo "Authentication failed!"
             fi
-            ''}
         done
 
-        if [ "$checksum_correct" != "1" ]; then
+        if [ "$opened" == false ]; then
             umount ${yubikey.storage.mountPoint}
             echo "Maximum authentication errors reached"
             exit 1
         fi
 
-        local k_yubi
-        k_yubi="$(echo -n $aes_blob_decrypted | take 40)"
-
-        local k_luks
-        k_luks="$(echo -n $aes_blob_decrypted | drop 40 | take 128)"
-
-        echo -n "$k_luks" | hextorb | cryptsetup luksOpen ${device} ${name} ${optionalString allowDiscards "--allow-discards"} --key-file=-
-
         update_failed=false
 
         local new_uuid_r
@@ -161,24 +103,32 @@ let
         fi
 
         if [ "$update_failed" == false ]; then
-            new_uuid_r="$(echo -n $new_uuid_r | take 36 | tr -d '-')"
+            new_uuid_r="$(echo -n $new_uuid_r | head -c 36 | tr -d '-')"
 
             local new_challenge
-            new_challenge="$(echo -n $k_user$new_uuid_r$uuid_luks | openssl-wrap dgst -binary -sha1 | rbtohex)"
+            new_challenge="$(echo -n $k_user$new_uuid_r | openssl-wrap dgst -binary -sha512 | rbtohex)"
 
-            local new_k_blob
-            new_k_blob="$(echo -n $new_challenge | hextorb | openssl-wrap dgst -binary -sha1 -mac HMAC -macopt hexkey:$k_yubi | rbtohex)"
+            local new_k_luks
+            new_k_luks="$(ykchalresp -${toString yubikey.slot} -x $new_challenge 2>/dev/null)"
 
-            local new_aes_blob
-            new_aes_blob=$(echo -n "$k_yubi$k_luks$checksum" | hextorb | openssl-wrap enc -e -aes-256-ctr -K "$new_k_blob" -iv "$new_uuid_r" | rbtohex)
+            mkdir -p ${yubikey.ramfsMountPoint}
+            # A ramfs is used here to ensure that the file used to update
+            # the key slot with cryptsetup will never get swapped out.
+            # Warning: Do NOT replace with tmpfs!
+            mount -t ramfs none ${yubikey.ramfsMountPoint}
 
-            ${optionalString yubikey.multiUser ''
-            sed -i -e "s|^$user_id_hash$user_record|$user_id_hash$new_uuid_r$new_aes_blob|1"
-            ''}
+            echo -n "$new_k_luks" | hextorb > ${yubikey.ramfsMountPoint}/new_key
+            echo -n "$k_luks" | cryptsetup luksChangeKey ${device} --key-file=- ${yubikey.ramfsMountPoint}/new_key
 
-            ${optionalString (!yubikey.multiUser) ''
-            echo -n "$new_uuid_r$new_aes_blob" > ${yubikey.storage.mountPoint}${yubikey.storage.path}
-            ''}
+            if [ $? == "0" ]; then
+                echo -n "$new_uuid_r" > ${yubikey.storage.mountPoint}${yubikey.storage.path}
+            else
+                echo "Warning: Could not update LUKS key, current challenge persists!"
+            fi
+
+            rm -f ${yubikey.ramfsMountPoint}/new_key
+            umount ${yubikey.ramfsMountPoint}
+            rm -rf ${yubikey.ramfsMountPoint}
         else
             echo "Warning: Could not obtain new UUID, current challenge persists!"
         fi
@@ -336,21 +286,21 @@ in
               description = "Whether to use a passphrase and a Yubikey (true), or only a Yubikey (false)";
             };
 
-            multiUser = mkOption {
-              default = false;
-              type = types.bool;
-              description = "Whether to allow multiple users to authenticate with a Yubikey";
-            };
-
             slot = mkOption {
               default = 2;
               type = types.int;
               description = "Which slot on the Yubikey to challenge";
             };
 
+            ramfsMountPoint = mkOption {
+              default = "/crypt-ramfs";
+              type = types.string;
+              description = "Path where the ramfs used to update the LUKS key will be mounted in stage-1";
+            };
+
             storage = mkOption {
               type = types.optionSet;
-              description = "Options related to the authentication record";
+              description = "Options related to the storing the random UUID";
 
               options = {
                 device = mkOption {
@@ -358,7 +308,7 @@ in
                   type = types.path;
                   description = ''
                     An unencrypted device that will temporarily be mounted in stage-1.
-                    Must contain the authentication record for this LUKS device.
+                    Must contain the current random UUID to create the challenge for this LUKS device.
                   '';
                 };
 
@@ -378,7 +328,7 @@ in
                   default = "/crypt-storage/default";
                   type = types.string;
                   description = ''
-                    Absolute path of the authentication record on the unencrypted device with
+                    Absolute path of the random UUID on the unencrypted device with
                     that device's root directory as "/".
                   '';
                 };

From ce5f84ce567e735b4f6b9cd3ea69264ed98ab109 Mon Sep 17 00:00:00 2001
From: James Cook <james.cook@utoronto.ca>
Date: Thu, 6 Feb 2014 12:15:43 -0800
Subject: [PATCH 02/59] nss: update to 3.15.4

---
 pkgs/development/libraries/nss/default.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/libraries/nss/default.nix b/pkgs/development/libraries/nss/default.nix
index b352064cee5..92cc12fe1be 100644
--- a/pkgs/development/libraries/nss/default.nix
+++ b/pkgs/development/libraries/nss/default.nix
@@ -5,17 +5,17 @@
 let
 
   nssPEM = fetchurl {
-    url = http://dev.gentoo.org/~anarchy/patches/nss-3.15-pem-support-20130617.patch.xz;
-    sha256 = "1k1m8lsgqwxx251943hks1dd13hz1adpqqb0hxwn011by5vmi201";
+    url = http://dev.gentoo.org/~polynomial-c/mozilla/nss-3.15.4-pem-support-20140109.patch.xz;
+    sha256 = "10ibz6y0hknac15zr6dw4gv9nb5r5z9ym6gq18j3xqx7v7n3vpdw";
   };
 
 in stdenv.mkDerivation rec {
   name = "nss-${version}";
-  version = "3.15.3.1";
+  version = "3.15.4";
 
   src = fetchurl {
-    url = "http://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_15_3_1_RTM/src/${name}.tar.gz";
-    sha1 = "4e0f81a1f770447dc5440201a579151b601463e2";
+    url = "http://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_15_4_RTM/src/${name}.tar.gz";
+    sha1 = "c164fac83fcbaff010786767e2a858ca23a89a5b";
   };
 
   buildInputs = [ nspr perl zlib sqlite ];

From d7eb849349972656fc99e1b8f56286aa10cf7836 Mon Sep 17 00:00:00 2001
From: James Cook <james.cook@utoronto.ca>
Date: Thu, 6 Feb 2014 14:41:54 -0800
Subject: [PATCH 03/59] firefox: update to 27.0.

---
 .../networking/browsers/firefox/default.nix       | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/pkgs/applications/networking/browsers/firefox/default.nix b/pkgs/applications/networking/browsers/firefox/default.nix
index 27363482be0..9869e24ce5a 100644
--- a/pkgs/applications/networking/browsers/firefox/default.nix
+++ b/pkgs/applications/networking/browsers/firefox/default.nix
@@ -17,9 +17,9 @@ assert stdenv.gcc ? libc && stdenv.gcc.libc != null;
 
 rec {
 
-  firefoxVersion = "26.0";
+  firefoxVersion = "27.0";
 
-  xulVersion = "26.0"; # this attribute is used by other packages
+  xulVersion = "27.0"; # this attribute is used by other packages
 
 
   src = fetchurl {
@@ -29,7 +29,7 @@ rec {
         # Fall back to this url for versions not available at releases.mozilla.org.
         "http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/${firefoxVersion}/source/firefox-${firefoxVersion}.source.tar.bz2"
     ];
-    sha1 = "f7c6642d6f62aea8d4eced48dd27aba0634edcd5";
+    sha1 = "ec2031385237e30be829817ac79caa8e80cc2a14";
   };
 
   commonConfigureFlags =
@@ -162,13 +162,20 @@ rec {
       "SYSTEM_LIBXUL=1"
     ];
 
-    # Hack to work around make's idea of -lbz2 dependency
+    # Because preConfigure runs configure from a subdirectory.
+    configureScript = "../configure";
+
     preConfigure =
       ''
+        # Hack to work around make's idea of -lbz2 dependency
         find . -name Makefile.in -execdir sed -i '{}' -e '1ivpath %.so ${
           stdenv.lib.concatStringsSep ":"
             (map (s : s + "/lib") (buildInputs ++ [stdenv.gcc.libc]))
         }' ';'
+
+        # Building directly in the main source directory is not allowed.
+        mkdir obj_dir
+        cd obj_dir
       '';
 
     postInstall =

From 70e4f8f928f8cc29414b3d49d92cb328f85a4437 Mon Sep 17 00:00:00 2001
From: Vladimir Still <vl.still@gmail.com>
Date: Fri, 7 Feb 2014 18:16:24 +0100
Subject: [PATCH 04/59] perf: Allow proceeding in build even if patch fails.
 Patching fails for linux 3.13 but it builds OK.

---
 pkgs/os-specific/linux/kernel/perf.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/kernel/perf.nix b/pkgs/os-specific/linux/kernel/perf.nix
index 0a92e39c153..f486f55654e 100644
--- a/pkgs/os-specific/linux/kernel/perf.nix
+++ b/pkgs/os-specific/linux/kernel/perf.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
   preConfigure = ''
     cd tools/perf
     sed -i s,/usr/include/elfutils,$elfutils/include/elfutils, Makefile
-    patch -p1 < ${./perf.diff}
+    patch -p1 < ${./perf.diff} || true
     [ -f bash_completion ] && sed -i 's,^have perf,_have perf,' bash_completion
     export makeFlags="DESTDIR=$out $makeFlags"
   '';

From d3979b659cb385597baecf5518a614089b489424 Mon Sep 17 00:00:00 2001
From: Vladimir Still <vl.still@gmail.com>
Date: Fri, 7 Feb 2014 22:53:55 +0100
Subject: [PATCH 05/59] perf: Make build fix for 3.13 cleaner.

---
 pkgs/os-specific/linux/kernel/perf.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/kernel/perf.nix b/pkgs/os-specific/linux/kernel/perf.nix
index f486f55654e..a7337760b79 100644
--- a/pkgs/os-specific/linux/kernel/perf.nix
+++ b/pkgs/os-specific/linux/kernel/perf.nix
@@ -4,6 +4,9 @@
 
 assert withGtk -> gtk != null;
 
+let optionalString = stdenv.lib.optionalString;
+    versionOlder = stdenv.lib.versionOlder;
+in
 stdenv.mkDerivation {
   name = "perf-linux-${kernel.version}";
 
@@ -12,7 +15,7 @@ stdenv.mkDerivation {
   preConfigure = ''
     cd tools/perf
     sed -i s,/usr/include/elfutils,$elfutils/include/elfutils, Makefile
-    patch -p1 < ${./perf.diff} || true
+    ${optionalString (versionOlder kernel.version "3.13") "patch -p1 < ${./perf.diff}"}
     [ -f bash_completion ] && sed -i 's,^have perf,_have perf,' bash_completion
     export makeFlags="DESTDIR=$out $makeFlags"
   '';

From 8ef2cadca4e4e74679ce16ac7b31688382a9aae4 Mon Sep 17 00:00:00 2001
From: James Cook <james.cook@utoronto.ca>
Date: Fri, 7 Feb 2014 17:28:02 -0800
Subject: [PATCH 06/59] gnash: Hack to define nullptr as NULL, since some
 included mozilla headers seem to want nullptr

---
 pkgs/applications/video/gnash/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/applications/video/gnash/default.nix b/pkgs/applications/video/gnash/default.nix
index 4f2addcc99b..616b474393c 100644
--- a/pkgs/applications/video/gnash/default.nix
+++ b/pkgs/applications/video/gnash/default.nix
@@ -73,6 +73,8 @@ stdenv.mkDerivation rec {
        echo "\$GST_PLUGIN_PATH set to \`$GST_PLUGIN_PATH'"
     '';
 
+  postConfigure = "echo '#define nullptr NULL' >> gnashconfig.h";
+
   # Make sure `gtk-gnash' gets `libXext' in its `RPATH'.
   NIX_LDFLAGS="-lX11 -lXext";
 

From 07b38340bd5f1c14acc0a6add96350bc8bc920c7 Mon Sep 17 00:00:00 2001
From: "William A. Kennington III" <william@wkennington.com>
Date: Fri, 7 Feb 2014 21:29:29 -0600
Subject: [PATCH 07/59] mumble: Upgrade 1.2.4 -> 1.2.5

---
 pkgs/applications/networking/mumble/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/mumble/default.nix b/pkgs/applications/networking/mumble/default.nix
index 43fbe952b18..9d2050d10fe 100644
--- a/pkgs/applications/networking/mumble/default.nix
+++ b/pkgs/applications/networking/mumble/default.nix
@@ -15,11 +15,11 @@ let
 in
 stdenv.mkDerivation rec {
   name = "mumble-" + version;
-  version = "1.2.4";
+  version = "1.2.5";
 
   src = fetchurl {
     url = "mirror://sourceforge/mumble/${name}.tar.gz";
-    sha256 = "16wwj6gwcnyjlnzh7wk0l255ldxmbwx0wi652sdp20lsv61q7kx1";
+    sha256 = "1bsgains6xgpgpd1b5bq682z0kswp5fcjh2cir4c4qkndya5clci";
   };
 
   patches = optional jackSupport ./mumble-jack-support.patch;

From 4191ee53b972b7c01d365571da4cfda606a95a7c Mon Sep 17 00:00:00 2001
From: "William A. Kennington III" <william@wkennington.com>
Date: Fri, 7 Feb 2014 21:29:38 -0600
Subject: [PATCH 08/59] murmur: Upgrade 1.2.4 -> 1.2.5

---
 pkgs/applications/networking/mumble/murmur.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/mumble/murmur.nix b/pkgs/applications/networking/mumble/murmur.nix
index 4b074b0708e..b886896c071 100644
--- a/pkgs/applications/networking/mumble/murmur.nix
+++ b/pkgs/applications/networking/mumble/murmur.nix
@@ -12,11 +12,11 @@ let
 in
 stdenv.mkDerivation rec {
   name = "murmur-" + version;
-  version = "1.2.4";
+  version = "1.2.5";
 
   src = fetchurl {
     url = "mirror://sourceforge/mumble/mumble-${version}.tar.gz";
-    sha256 = "16wwj6gwcnyjlnzh7wk0l255ldxmbwx0wi652sdp20lsv61q7kx1";
+    sha256 = "1bsgains6xgpgpd1b5bq682z0kswp5fcjh2cir4c4qkndya5clci";
   };
 
   patchPhase = optional iceSupport ''

From 3967a1c444c1ba17c068eb14d2badf418d1365e6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <vcunat@gmail.com>
Date: Wed, 5 Feb 2014 08:20:20 +0100
Subject: [PATCH 09/59] spring: disable parallel building, as it breaks on
 Hydra

(cherry picked from commit e43018e0196dd6af57087ecb6aaa3af7b17776ab)
---
 pkgs/games/spring/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/games/spring/default.nix b/pkgs/games/spring/default.nix
index 99066581aa2..4f8fe0d1974 100644
--- a/pkgs/games/spring/default.nix
+++ b/pkgs/games/spring/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
       --replace "which" "type -p"
   '';
 
-  enableParallelBuilding = true;
+  #enableParallelBuilding = true; # occasionally missing generated files on Hydra
 
   meta = with stdenv.lib; {
     homepage = http://springrts.com/;

From 989bfbac7907eb01b6fb6e6183bcfc9c3198bddc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <vcunat@gmail.com>
Date: Sat, 8 Feb 2014 09:49:41 +0100
Subject: [PATCH 10/59] llvmPackages on darwin: attempt to fix build by using
 gcc48

---
 pkgs/top-level/all-packages.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2d8e96cc664..252f77d00f7 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2809,7 +2809,7 @@ let
     inherit newScope fetchurl;
     isl = isl_0_12;
     stdenv = if stdenv.isDarwin
-      then stdenvAdapters.overrideGCC stdenv gccApple
+      then stdenvAdapters.overrideGCC stdenv gcc48
       else stdenv;
   });
   llvmPackagesSelf = import ../development/compilers/llvm/3.4 { inherit newScope fetchurl; isl = isl_0_12; stdenv = libcxxStdenv; };

From 0fa30be7a8725392f92aeb959e880ae5cf1ef891 Mon Sep 17 00:00:00 2001
From: Pascal Wittmann <mail@pascal-wittmann.de>
Date: Sat, 8 Feb 2014 11:10:47 +0100
Subject: [PATCH 11/59] andagii: fix fetch by providing a different user-agent

Close #1706.
---
 pkgs/data/fonts/andagii/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/data/fonts/andagii/default.nix b/pkgs/data/fonts/andagii/default.nix
index 8b08708fb1d..8143d284120 100644
--- a/pkgs/data/fonts/andagii/default.nix
+++ b/pkgs/data/fonts/andagii/default.nix
@@ -19,6 +19,7 @@ in
 rec {
   src = a.fetchurl {
     url = sourceInfo.url;
+    curlOpts = "--user-agent 'Mozilla/5.0'";
     sha256 = sourceInfo.hash;
   };
 

From 9665c85f992f1a830cf3e0f32089592ba0afd032 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <vcunat@gmail.com>
Date: Sat, 8 Feb 2014 11:52:56 +0100
Subject: [PATCH 12/59] kde410.kde_workspace: fix CVE-2013-4132 by upstream
 patch

---
 pkgs/desktops/kde-4.10/kde-workspace.nix | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/pkgs/desktops/kde-4.10/kde-workspace.nix b/pkgs/desktops/kde-4.10/kde-workspace.nix
index a478dc975fe..57b2fea79b2 100644
--- a/pkgs/desktops/kde-4.10/kde-workspace.nix
+++ b/pkgs/desktops/kde-4.10/kde-workspace.nix
@@ -1,7 +1,8 @@
 { kde, kdelibs, qimageblitz, libdbusmenu_qt, xorg, shared_desktop_ontologies,
   lm_sensors, pciutils, libraw1394, libusb, libxklavier, python, libqalculate,
   xkeyboard_config, kdepimlibs, pam, boost, gpsd, prison, akonadi,
-  libjpeg, pkgconfig, libXft, libXxf86misc, kactivities, qjson, networkmanager
+  libjpeg, pkgconfig, libXft, libXxf86misc, kactivities, qjson, networkmanager,
+  fetchurl
 }:
 
 kde {
@@ -17,6 +18,12 @@ kde {
       kactivities
     ];
 
+  patches = [(fetchurl {
+    url = "https://git.reviewboard.kde.org/r/111261/diff/raw/";
+    sha256 = "0g8qjna1s0imz7801k4iy2ap5z81izi4bncvks7z3n9agji4zf40";
+    name = "CVE-2013-4132.patch";
+  })];
+
   nativeBuildInputs = [ pkgconfig ];
 
   preConfigure =

From 24029ec478b1755eb375f05714a311d9b1d94541 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <vcunat@gmail.com>
Date: Sat, 8 Feb 2014 11:54:16 +0100
Subject: [PATCH 13/59] linux: minor updates 3.12.10, 3.10.29, 3.4.79

---
 pkgs/os-specific/linux/kernel/linux-3.10.nix | 4 ++--
 pkgs/os-specific/linux/kernel/linux-3.12.nix | 4 ++--
 pkgs/os-specific/linux/kernel/linux-3.4.nix  | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-3.10.nix b/pkgs/os-specific/linux/kernel/linux-3.10.nix
index 6e22d6ed524..212e676a28f 100644
--- a/pkgs/os-specific/linux/kernel/linux-3.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-3.10.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "3.10.28";
+  version = "3.10.29";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz";
-    sha256 = "1blzvr3qywi8wxgl28zsn5djwgvw70yh3i6qjh2sz3zk9gnpd6mq";
+    sha256 = "14g8z5g2xwf0s6r7m9586xdpd56nc810dny70cz6zq8c03kfq594";
   };
 
   features.iwlwifi = true;
diff --git a/pkgs/os-specific/linux/kernel/linux-3.12.nix b/pkgs/os-specific/linux/kernel/linux-3.12.nix
index 6edb3669c53..5baddbbdc7d 100644
--- a/pkgs/os-specific/linux/kernel/linux-3.12.nix
+++ b/pkgs/os-specific/linux/kernel/linux-3.12.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "3.12.9";
+  version = "3.12.10";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz";
-    sha256 = "1jzmcqshfgnkk4dibkxc7w06axw7c2fxdpghvm6d7amfpcd9ygka";
+    sha256 = "0p30mfrf3jfp353k0fbfpbmz3sfkhlyzcispqg22dc0lzcj76aj7";
   };
 
   features.iwlwifi = true;
diff --git a/pkgs/os-specific/linux/kernel/linux-3.4.nix b/pkgs/os-specific/linux/kernel/linux-3.4.nix
index 14a4b64fe55..0993b0e74ee 100644
--- a/pkgs/os-specific/linux/kernel/linux-3.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-3.4.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "3.4.78";
+  version = "3.4.79";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz";
-    sha256 = "1n9avgjy3qpr28n1rq80kc1gn33w9nz6bvwds6i4d5z793fp7qpk";
+    sha256 = "07xd01b5vl6gl4p2cs75fsn295jvwmlq2j9jw582b2ii8vsaavvv";
   };
 
   features.iwlwifi = true;

From 5ffab7710dd6aee43f37f710583a4dd066031997 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Domen=20Ko=C5=BEar?= <domen@dev.si>
Date: Sat, 8 Feb 2014 12:30:10 +0100
Subject: [PATCH 14/59] gnome3.gnome_control_center: build and fix runtime deps

---
 .../services/x11/desktop-managers/gnome3.nix  |  1 +
 .../core/gnome-control-center/default.nix     | 42 ++++++++++++++++---
 .../gnome-3/core/gnome-shell/default.nix      |  5 ++-
 pkgs/tools/misc/colord-gtk/default.nix        | 18 ++++++++
 pkgs/top-level/all-packages.nix               |  2 +
 5 files changed, 61 insertions(+), 7 deletions(-)
 create mode 100644 pkgs/tools/misc/colord-gtk/default.nix

diff --git a/nixos/modules/services/x11/desktop-managers/gnome3.nix b/nixos/modules/services/x11/desktop-managers/gnome3.nix
index 6c43112c813..ecb6706544a 100644
--- a/nixos/modules/services/x11/desktop-managers/gnome3.nix
+++ b/nixos/modules/services/x11/desktop-managers/gnome3.nix
@@ -52,6 +52,7 @@ in {
         gnome3.gnome_terminal
         gnome3.gnome_icon_theme
         gnome3.gnome_themes_standard
+        gnome3.gnome_control_center
       ];
   };
 
diff --git a/pkgs/desktops/gnome-3/core/gnome-control-center/default.nix b/pkgs/desktops/gnome-3/core/gnome-control-center/default.nix
index b73009d896d..ed9adb370d4 100644
--- a/pkgs/desktops/gnome-3/core/gnome-control-center/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-control-center/default.nix
@@ -1,11 +1,24 @@
-{ fetchurl, stdenv, pkgconfig, gnome3, ibus, intltool, upower, libcanberra
-, libxml2, polkit, libxslt, libgtop, libsoup, colord, pulseaudio, fontconfig }:
+{ fetchurl, stdenv, pkgconfig, gnome3, ibus, intltool, upower, libcanberra, accountservice
+, libxml2, polkit, libxslt, libgtop, libsoup, colord, colord-gtk, pulseaudio, fontconfig
+, cracklib, python, krb5, networkmanagerapplet, libwacom, samba, libnotify, libxkbfile
+, shared_mime_info, tzdata, icu, libtool, docbook_xsl, docbook_xsl_ns, makeWrapper }:
 
 # http://ftp.gnome.org/pub/GNOME/teams/releng/3.10.2/gnome-suites-core-3.10.2.modules
-# TODO: colord_gtk
+# TODO: bluetooth, networkmanager, wacom, smbclient, printers
 
+let
+  libpwquality = stdenv.mkDerivation rec {
+    name = "libpwquality-1.2.3";
 
-stdenv.mkDerivation rec {
+    src = fetchurl {
+      url = "https://fedorahosted.org/releases/l/i/libpwquality/${name}.tar.bz2";
+      sha256 = "0sjiabvl5277nfxyy96jdz65a0a3pmkkwrfbziwgik83gg77j75i";
+    };
+
+    buildInputs = [ cracklib python ];
+  };
+
+in stdenv.mkDerivation rec {
   name = "gnome-control-center-3.10.2";
 
   src = fetchurl {
@@ -16,7 +29,26 @@ stdenv.mkDerivation rec {
   buildInputs = with gnome3;
     [ pkgconfig intltool ibus gtk glib upower libcanberra gsettings_desktop_schemas
       libxml2 gnome_desktop gnome_settings_daemon polkit libxslt libgtop gnome-menus
-      gnome_online_accounts libsoup colord pulseaudio fontconfig ];
+      gnome_online_accounts libsoup colord pulseaudio fontconfig colord-gtk libpwquality
+      accountservice krb5 networkmanagerapplet libwacom samba libnotify libxkbfile
+      shared_mime_info icu libtool docbook_xsl docbook_xsl_ns makeWrapper ];
+
+  preBuild = ''
+    substituteInPlace tz.h --replace "/usr/share/zoneinfo/zone.tab" "${tzdata}/share/zoneinfo/zone.tab"
+    substituteInPlace panels/datetime/tz.h --replace "/usr/share/zoneinfo/zone.tab" "${tzdata}/share/zoneinfo/zone.tab"
+
+    # hack to make test-endianess happy
+    mkdir -p $out/share/locale
+    substituteInPlace panels/datetime/test-endianess.c --replace "/usr/share/locale/" "$out/share/locale/"
+  '';
+
+  postInstall = with gnome3; ''
+    wrapProgram $out/bin/gnome-control-center \
+      --prefix XDG_DATA_DIRS : "${gsettings_desktop_schemas}/share:${gnome_settings_daemon}/share:${glib}/share:${gtk}/share:${colord}/share:$out/share"
+    for i in $out/share/applications/*; do
+      substituteInPlace $i --replace "gnome-control-center" "$out/bin/gnome-control-center"
+    done
+  '';
 
   meta = with stdenv.lib; {
     platforms = platforms.linux;
diff --git a/pkgs/desktops/gnome-3/core/gnome-shell/default.nix b/pkgs/desktops/gnome-3/core/gnome-shell/default.nix
index 92c8d2a3bc7..7dee64a8aff 100644
--- a/pkgs/desktops/gnome-3/core/gnome-shell/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-shell/default.nix
@@ -19,13 +19,14 @@ stdenv.mkDerivation rec {
       libcroco intltool libsecret pkgconfig python libsoup polkit libcanberra gdk_pixbuf librsvg
       clutter networkmanager libstartup_notification telepathy_glib docbook_xsl docbook_xsl_ns
       libXtst p11_kit networkmanagerapplet gjs mutter pulseaudio caribou evolution_data_server
-      libical libtool nss gobjectIntrospection gtk gstreamer makeWrapper gdm
+      libical libtool nss gobjectIntrospection gtk gstreamer makeWrapper gdm gnome_control_center
       at_spi2_core upower ibus gnome_session gnome_desktop telepathy_logger ];
 
   configureFlags = "--disable-static";
 
   preBuild = ''
     patchShebangs src/data-to-c.pl
+    substituteInPlace data/Makefile --replace " install-keysDATA" ""
   '';
 
   postInstall = with gnome3; ''
@@ -33,7 +34,7 @@ stdenv.mkDerivation rec {
       --prefix GI_TYPELIB_PATH : "$GI_TYPELIB_PATH" \
       --prefix LD_LIBRARY_PATH : "${accountservice}/lib:${ibus}/lib:${gdm}/lib" \
       --set GDK_PIXBUF_MODULE_FILE ${gnome_themes_standard}/lib/gdk-pixbuf/loaders.cache \
-      --prefix XDG_DATA_DIRS : "${gnome-menus}:/share:${ibus}/share:${gnome_settings_daemon}/share:${gdm}/share:${glib}/share:${gnome_themes_standard}/share:${mutter}/share:${gnome_icon_theme}/share:${gsettings_desktop_schemas}/share:${gtk}/share:$out/share"
+      --prefix XDG_DATA_DIRS : "${gnome-menus}:/share:${ibus}/share:${gnome_settings_daemon}/share:${gnome_control_center}/share:${gdm}/share:${glib}/share:${gnome_themes_standard}/share:${mutter}/share:${gnome_icon_theme}/share:${gsettings_desktop_schemas}/share:${gtk}/share:$out/share"
     wrapProgram "$out/libexec/gnome-shell-calendar-server" \
       --prefix XDG_DATA_DIRS : "${evolution_data_server}/share:$out/share"
   '';
diff --git a/pkgs/tools/misc/colord-gtk/default.nix b/pkgs/tools/misc/colord-gtk/default.nix
new file mode 100644
index 00000000000..f46bf3ef7a4
--- /dev/null
+++ b/pkgs/tools/misc/colord-gtk/default.nix
@@ -0,0 +1,18 @@
+{ stdenv, fetchurl, colord, intltool, glib, gtk3, pkgconfig, lcms2 }:
+
+stdenv.mkDerivation rec {
+  name = "colord-gtk-0.1.25";
+
+  src = fetchurl {
+    url = "http://www.freedesktop.org/software/colord/releases/${name}.tar.xz";
+    sha256 = "02hblw9rw24dhj0wqfw86pfq4y4icb6iaa92308a9jwa6k2923xx";
+  };
+
+  buildInputs = [ intltool colord glib gtk3 pkgconfig lcms2 ];
+
+  meta = {
+    homepage = http://www.freedesktop.org/software/colord/intro.html;
+    license = stdenv.lib.licenses.lgpl2Plus;
+    platforms = stdenv.lib.platforms.linux;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 252f77d00f7..57a1933c7b2 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -684,6 +684,8 @@ let
 
   colord = callPackage ../tools/misc/colord { };
 
+  colord-gtk = callPackage ../tools/misc/colord-gtk { };
+
   colordiff = callPackage ../tools/text/colordiff { };
 
   connect = callPackage ../tools/networking/connect { };

From 140e06f9aae33daae501441e2933a981f2fc3344 Mon Sep 17 00:00:00 2001
From: Petr Rockai <me@mornfall.net>
Date: Tue, 28 Jan 2014 17:24:33 +0100
Subject: [PATCH 15/59] osc: Add an OBS (open build system) CLI client.

---
 pkgs/top-level/python-packages.nix | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 48d0a8c5db3..3624502e121 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4293,6 +4293,23 @@ pythonPackages = modules // import ./python-packages-generated.nix {
     };
   });
 
+  osc = buildPythonPackage (rec {
+    name = "osc-0.133+git";
+
+    src = fetchgit {
+      url = git://gitorious.org/opensuse/osc.git;
+      rev = "6cd541967ee2fca0b89e81470f18b97a3ffc23ce";
+      sha256 = "a39ce0e321e40e9758bf7b9128d316c71b35b80eabc84f13df492083bb6f1cc6";
+    };
+
+    buildPhase = "python setup.py build";
+    doCheck = false;
+    postInstall = "ln -s $out/bin/osc-wrapper.py $out/bin/osc";
+
+    propagatedBuildInputs = [ pythonPackages.m2crypto ];
+
+  });
+
   pandas = buildPythonPackage rec {
     name = "pandas-0.12.0";
 

From 63478d95909a065dc4416c1b2fa0d7b62ef5e08d Mon Sep 17 00:00:00 2001
From: Petr Rockai <me@mornfall.net>
Date: Sat, 8 Feb 2014 13:42:04 +0100
Subject: [PATCH 16/59] Add fedpkg, koji &c. + their python dependencies.

---
 .../python-modules/fedpkg-buildfix.diff       |  14 ++
 .../python-modules/rpkg-buildfix.diff         |  11 ++
 pkgs/top-level/python-packages.nix            | 152 ++++++++++++++++++
 3 files changed, 177 insertions(+)
 create mode 100644 pkgs/development/python-modules/fedpkg-buildfix.diff
 create mode 100644 pkgs/development/python-modules/rpkg-buildfix.diff

diff --git a/pkgs/development/python-modules/fedpkg-buildfix.diff b/pkgs/development/python-modules/fedpkg-buildfix.diff
new file mode 100644
index 00000000000..b9d46d7c741
--- /dev/null
+++ b/pkgs/development/python-modules/fedpkg-buildfix.diff
@@ -0,0 +1,14 @@
+--- a/setup.py	2014-02-04 16:12:37.021993713 +0100
++++ b/setup.py	2014-02-04 16:11:42.653995607 +0100
+@@ -13,8 +13,8 @@
+     package_dir = {'': 'src'},
+     packages = ['fedpkg'],
+     scripts = ['src/bin/fedpkg'],
+-    data_files = [('/etc/bash_completion.d', ['src/fedpkg.bash']),
+-                  ('/etc/rpkg', ['src/fedpkg.conf']),
+-                  ('/usr/libexec/', ['src/fedpkg-fixbranches.py']),
++    data_files = [('etc/bash_completion.d', ['src/fedpkg.bash']),
++                  ('etc/rpkg', ['src/fedpkg.conf']),
++                  ('libexec/', ['src/fedpkg-fixbranches.py']),
+                  ]
+ )
diff --git a/pkgs/development/python-modules/rpkg-buildfix.diff b/pkgs/development/python-modules/rpkg-buildfix.diff
new file mode 100644
index 00000000000..d410f09072f
--- /dev/null
+++ b/pkgs/development/python-modules/rpkg-buildfix.diff
@@ -0,0 +1,11 @@
+--- a/setup.py	2012-03-12 23:26:16.000000000 +0100
++++ b/setup.py	2014-02-04 14:52:02.335856975 +0100
+@@ -14,6 +14,6 @@
+     package_dir = {'': 'src'},
+     packages = ['pyrpkg'],
+     scripts = ['src/rpkg'],
+-    data_files = [('/etc/bash_completion.d', ['src/rpkg.bash']),
+-                  ('/etc/rpkg', ['src/rpkg.conf'])],
++    data_files = [('etc/bash_completion.d', ['src/rpkg.bash']),
++                  ('etc/rpkg', ['src/rpkg.conf'])],
+ )
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 3624502e121..6d2605e0f98 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -417,6 +417,19 @@ pythonPackages = modules // import ./python-packages-generated.nix {
   });
 
 
+  async = buildPythonPackage rec {
+    name = "async-0.6.1";
+    meta.maintainers = [ stdenv.lib.maintainers.mornfall ];
+
+    buildInputs = [ pkgs.zlib ];
+    doCheck = false;
+
+    src = fetchurl {
+      url = "https://pypi.python.org/packages/source/a/async/${name}.tar.gz";
+      sha256 = "1lfmjm8apy9qpnpbq8g641fd01qxh9jlya5g2d6z60vf8p04rla1";
+    };
+  };
+
   argparse = buildPythonPackage (rec {
     name = "argparse-1.2.1";
 
@@ -795,6 +808,17 @@ pythonPackages = modules // import ./python-packages-generated.nix {
     };
   };
 
+  bunch = buildPythonPackage (rec {
+    name = "bunch-1.0.1";
+    meta.maintainers = [ stdenv.lib.maintainers.mornfall ];
+
+    src = fetchurl {
+      url = "https://pypi.python.org/packages/source/b/bunch/${name}.tar.gz";
+      sha256 = "1akalx2pd1fjlvrq69plvcx783ppslvikqdm93z2sdybq07pmish";
+    };
+    doCheck = false;
+  });
+
 
   carrot = buildPythonPackage rec {
     name = "carrot-0.10.7";
@@ -1555,6 +1579,33 @@ pythonPackages = modules // import ./python-packages-generated.nix {
     buildInputs = [ fudge nose ];
   };
 
+  fedora_cert = buildPythonPackage (rec {
+    name = "fedora-cert-0.5.9.2";
+    meta.maintainers = [ stdenv.lib.maintainers.mornfall ];
+
+    src = fetchurl {
+      url = "https://fedorahosted.org/releases/f/e/fedora-packager/fedora-packager-0.5.9.2.tar.bz2";
+      sha256 = "105swvzshgn3g6bjwk67xd8pslnhpxwa63mdsw6cl4c7cjp2blx9";
+    };
+    installCommand = "make install";
+    propagatedBuildInputs = [ python_fedora ];
+    postInstall = "mv $out/bin/fedpkg $out/bin/fedora-cert-fedpkg";
+    doCheck = false;
+  });
+
+  fedpkg = buildPythonPackage (rec {
+    name = "fedpkg-1.14";
+    meta.maintainers = [ stdenv.lib.maintainers.mornfall ];
+
+    src = fetchurl {
+      url = "https://fedorahosted.org/releases/f/e/fedpkg/fedpkg-1.14.tar.bz2";
+      sha256 = "0rj60525f2sv34g5llafnkmpvbwrfbmfajxjc14ldwzymp8clc02";
+    };
+
+    patches = [ ../development/python-modules/fedpkg-buildfix.diff ];
+    propagatedBuildInputs = [ rpkg offtrac urlgrabber fedora_cert ];
+  });
+
   fudge = buildPythonPackage rec {
     name = "fudge-0.9.4";
     src = fetchurl {
@@ -1582,6 +1633,31 @@ pythonPackages = modules // import ./python-packages-generated.nix {
     };
   };
 
+  gitdb = buildPythonPackage rec {
+    name = "gitdb-0.5.4";
+    meta.maintainers = [ stdenv.lib.maintainers.mornfall ];
+    doCheck = false;
+
+    src = fetchurl {
+      url = "https://pypi.python.org/packages/source/g/gitdb/${name}.tar.gz";
+      sha256 = "10rpmmlln59aq44cd5vkb77hslak5pa1rbmigg6ski5f1nn2spfy";
+    };
+
+    propagatedBuildInputs = [ smmap async ];
+  };
+
+  GitPython = buildPythonPackage rec {
+    name = "GitPython-0.3.2";
+    meta.maintainers = [ stdenv.lib.maintainers.mornfall ];
+
+    src = fetchurl {
+      url = "https://pypi.python.org/packages/source/G/GitPython/GitPython-0.3.2.RC1.tar.gz";
+      sha256 = "1q4lc2ps12l517mmrxc8iq6gxyhj6d77bnk1p7mxf38d99l8crzx";
+    };
+
+    buildInputs = [ nose ];
+    propagatedBuildInputs = [ gitdb ];
+  };
 
   googlecl = buildPythonPackage rec {
     version = "0.9.14";
@@ -1619,6 +1695,22 @@ pythonPackages = modules // import ./python-packages-generated.nix {
     };
   };
 
+  koji = buildPythonPackage (rec {
+    name = "koji-1.8";
+    meta.maintainers = [ stdenv.lib.maintainers.mornfall ];
+
+    src = fetchurl {
+      url = "https://fedorahosted.org/released/koji/koji-1.8.0.tar.bz2";
+      sha256 = "10dph209h4jgajb5jmbjhqy4z4hd22i7s2d93vm3ikdf01i8iwf1";
+    };
+
+    buildPhase = ":";
+    installCommand = "make install DESTDIR=$out/ && cp -R $out/nix/store/*/* $out/ && rm -rf $out/nix";
+    doCheck = false;
+    propagatedBuildInputs = [ pythonPackages.pycurl ];
+
+  });
+
   logilab_astng = buildPythonPackage rec {
     name = "logilab-astng-0.24.1";
 
@@ -3227,6 +3319,16 @@ pythonPackages = modules // import ./python-packages-generated.nix {
       [ pkgs.unzip fs gdata python_keyczar mock pyasn1 pycrypto pytest ];
   };
 
+  kitchen = buildPythonPackage (rec {
+    name = "kitchen-1.1.1";
+    meta.maintainers = [ stdenv.lib.maintainers.mornfall ];
+
+    src = fetchurl {
+      url = "https://pypi.python.org/packages/source/k/kitchen/kitchen-1.1.1.tar.gz";
+      sha256 = "0ki840hjk1q19w6icv0dj2jxb00966nwy9b1jib0dgdspj00yrr5";
+    };
+  });
+
   pylast = buildPythonPackage rec {
     name = "pylast-${version}";
     version = "0.5.11";
@@ -4229,6 +4331,17 @@ pythonPackages = modules // import ./python-packages-generated.nix {
     };
   });
 
+  offtrac = buildPythonPackage rec {
+    name = "offtrac-0.1.0";
+    meta.maintainers = [ stdenv.lib.maintainers.mornfall ];
+
+    src = fetchurl {
+      url = "https://pypi.python.org/packages/source/o/offtrac/${name}.tar.gz";
+      sha256 = "06vd010pa1z7lyfj1na30iqzffr4kzj2k2sba09spik7drlvvl56";
+    };
+    doCheck = false;
+  };
+
   # optfunc = buildPythonPackage ( rec {
   #   name = "optfunc-git";
   #
@@ -5188,6 +5301,18 @@ pythonPackages = modules // import ./python-packages-generated.nix {
     };
   });
 
+  python_fedora = buildPythonPackage (rec {
+    name = "python-fedora-0.3.32.3";
+    meta.maintainers = [ stdenv.lib.maintainers.mornfall ];
+
+    src = fetchurl {
+      url = "https://fedorahosted.org/releases/p/y/python-fedora/python-fedora-0.3.32.3.tar.gz";
+      sha256 = "0qwmbid4pkdj6z9gwa43fzs97fr6ci2h2vj1hyk0gp0vqim4kv4l";
+    };
+    propagatedBuildInputs = [ kitchen requests bunch ];
+    doCheck = false;
+  });
+
   python_keyczar = buildPythonPackage rec {
     name = "python-keyczar-0.71c";
 
@@ -5958,6 +6083,24 @@ pythonPackages = modules // import ./python-packages-generated.nix {
     };
   };
 
+  rpkg = buildPythonPackage (rec {
+    name = "rpkg-1.14";
+    meta.maintainers = [ stdenv.lib.maintainers.mornfall ];
+
+    src = fetchurl {
+      url = "https://fedorahosted.org/releases/r/p/rpkg/rpkg-1.14.tar.gz";
+      sha256 = "0d053hdjz87aym1sfm6c4cxmzmy5g0gkrmrczly86skj957r77a7";
+    };
+
+    patches = [ ../development/python-modules/rpkg-buildfix.diff ];
+
+    # buildPhase = "python setup.py build";
+    # doCheck = false;
+    propagatedBuildInputs = [ pycurl koji GitPython pkgs.git
+                              pkgs.rpm pkgs.pyopenssl ];
+
+  });
+
   rtslib_fb = buildPythonPackage rec {
     version = "2.1.fb43";
     name = "rtslib-fb-${version}";
@@ -6823,6 +6966,15 @@ pythonPackages = modules // import ./python-packages-generated.nix {
   #   };
   # };
 
+  smmap = buildPythonPackage rec {
+    name = "smmap-0.8.2";
+    meta.maintainers = [ stdenv.lib.maintainers.mornfall ];
+
+    src = fetchurl {
+      url = "https://pypi.python.org/packages/source/s/smmap/${name}.tar.gz";
+      sha256 = "0vrdgr6npmajrv658fv8bij7zgm5jmz2yxkbv8kmbv25q1f9b8ny";
+    };
+  };
 
   trac = buildPythonPackage {
     name = "trac-1.0.1";

From 8d877463f697cdd965343fcf3636d64f1efce633 Mon Sep 17 00:00:00 2001
From: Petr Rockai <me@mornfall.net>
Date: Sat, 8 Feb 2014 13:23:38 +0100
Subject: [PATCH 17/59] rpm: Build python bindings (--enable-python).

---
 pkgs/tools/package-management/rpm/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/package-management/rpm/default.nix b/pkgs/tools/package-management/rpm/default.nix
index 73b0ca58828..9a96baf5fe0 100644
--- a/pkgs/tools/package-management/rpm/default.nix
+++ b/pkgs/tools/package-management/rpm/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, cpio, zlib, bzip2, file, elfutils, nspr, nss, popt, db4, xz }:
+{ stdenv, fetchurl, cpio, zlib, bzip2, file, elfutils, nspr, nss, popt, db4, xz, python }:
 
 stdenv.mkDerivation rec {
   name = "rpm-4.7.2";
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
     sha1 = "07b90f653775329ea726ce0005c4c82f56167ca0";
   };
 
-  buildInputs = [ cpio zlib bzip2 file nspr nss popt db4 xz ];
+  buildInputs = [ cpio zlib bzip2 file nspr nss popt db4 xz python ];
 
   # Note: we don't add elfutils to buildInputs, since it provides a
   # bad `ld' and other stuff.
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   NIX_CFLAGS_LINK = "-L${elfutils}/lib";
   
-  configureFlags = "--with-external-db --without-lua";
+  configureFlags = "--with-external-db --without-lua --enable-python";
 
   meta = {
     homepage = http://www.rpm.org/;

From 09f9af17b46c8c6dad4df82214afa9f0b15af3b9 Mon Sep 17 00:00:00 2001
From: Moritz Maxeiner <moritz@ucworks.org>
Date: Wed, 5 Feb 2014 17:10:59 +0100
Subject: [PATCH 18/59] Update to the Yubikey PBA

Security-relevant changes:
 * No (salted) passphrase hash send to the yubikey, only hash of the salt (as it was in the original implementation).
 * Derive $k_luks with PBKDF2 from the yubikey $response (as the PBKDF2 salt) and the passphrase $k_user
   (as the PBKDF2 password), so that if two-factor authentication is enabled
   (a) a USB-MITM attack on the yubikey itself is not enough to break the system
   (b) the potentially low-entropy $k_user is better protected against brute-force attacks
 * Instead of using uuidgen, gather the salt (previously random uuid / uuid_r) directly from /dev/random.
 * Length of the new salt in byte added as the parameter "saltLength", defaults to 16 byte.
   Note: Length of the challenge is 64 byte, so saltLength > 64 may have no benefit over saltLengh = 64.
 * Length of $k_luks derived with PBKDF2 in byte added as the parameter "keyLength", defaults to 64 byte.
   Example: For a luks device with a 512-bit key, keyLength should be 64.
 * Increase of the PBKDF2 iteration count per successful authentication added as the
   parameter "iterationStep", defaults to 0.

Other changes:
 * Add optional grace period before trying to find the yubikey, defaults to 2 seconds.

Full overview of the yubikey authentication process:

  (1) Read $salt and $iterations from unencrypted device (UD).
  (2) Calculate the $challenge from the $salt with a hash function.
      Chosen instantiation: SHA-512($salt).
  (3) Challenge the yubikey with the $challenge and receive the $response.
  (4) Repeat three times:
    (a) Prompt for the passphrase $k_user.
    (b) Derive the key $k_luks for the luks device with a key derivation function from $k_user and $response.
        Chosen instantiation: PBKDF2(HMAC-SHA-512, $k_user, $response, $iterations, keyLength).
    (c) Try to open the luks device with $k_luks and escape loop (4) only on success.
  (5) Proceed only if luks device was opened successfully, fail otherwise.

  (6) Gather $new_salt from a cryptographically secure pseudorandom number generator
      Chosen instantiation: /dev/random
  (7) Calculate the $new_challenge from the $new_salt with the same hash function as (2).
  (8) Challenge the yubikey with the $new_challenge and receive the $new_response.
  (9) Derive the new key $new_k_luks for the luks device in the same manner as in (4) (b),
      but with more iterations as given by iterationStep.
 (10) Try to change the luks device's key $k_luks to $new_k_luks.
 (11) If (10) was successful, write the $new_salt and the $new_iterations to the UD.
      Note: $new_iterations = $iterations + iterationStep

Known (software) attack vectors:

 * A MITM attack on the keyboard can recover $k_user. This, combined with a USB-MITM
   attack on the yubikey for the $response (1) or the $new_response (2) will result in
   (1) $k_luks being recovered,
   (2) $new_k_luks being recovered.
 * Any attacker with access to the RAM state of stage-1 at mid- or post-authentication
   can recover $k_user, $k_luks, and  $new_k_luks
 * If an attacker has recovered $response or $new_response, he can perform a brute-force
   attack on $k_user with it without the Yubikey needing to be present (using cryptsetup's
   "luksOpen --verify-passphrase" oracle. He could even make a copy of the luks device's
   luks header and run the brute-force attack without further access to the system.
 * A USB-MITM attack on the yubikey will allow an attacker to attempt to brute-force
   the yubikey's internal key ("shared secret") without it needing to be present anymore.

Credits:

 * Florian Klien,
   for the original concept and the reference implementation over at
   https://github.com/flowolf/initramfs_ykfde
 * Anthony Thysse,
   for the reference implementation of accessing OpenSSL's PBKDF2 over at
   http://www.ict.griffith.edu.au/anthony/software/pbkdf2.c
---
 nixos/modules/system/boot/luksroot.nix    | 153 ++++++++++++++--------
 nixos/modules/system/boot/pbkdf2-sha512.c |  38 ++++++
 2 files changed, 137 insertions(+), 54 deletions(-)
 create mode 100644 nixos/modules/system/boot/pbkdf2-sha512.c

diff --git a/nixos/modules/system/boot/luksroot.nix b/nixos/modules/system/boot/luksroot.nix
index d70d1341166..117c526fcd3 100644
--- a/nixos/modules/system/boot/luksroot.nix
+++ b/nixos/modules/system/boot/luksroot.nix
@@ -43,22 +43,33 @@ let
     }
 
     hextorb() {
-        ( tr '[:lower:]' '[:upper:]' | sed -e 's/\([0-9A-F]\{2\}\)/\\\\\\x\1/gI'| xargs printf )
+        ( tr '[:lower:]' '[:upper:]' | sed -e 's/\([0-9A-F]\{2\}\)/\\\\\\x\1/gI' | xargs printf )
     }
 
     open_yubikey() {
 
+        # Make all of these local to this function
+        # to prevent their values being leaked
+        local salt
+        local iterations
+        local k_user
+        local challenge
+        local response
+        local k_luks
+        local opened
+        local new_salt
+        local new_iterations
+        local new_challenge
+        local new_response
+        local new_k_luks
+
         mkdir -p ${yubikey.storage.mountPoint}
         mount -t ${yubikey.storage.fsType} ${toString yubikey.storage.device} ${yubikey.storage.mountPoint}
 
-        local uuid_r
-        local k_user
-        local challenge
-        local opened
-
-        sleep 1
-
-        uuid_r="$(cat ${yubikey.storage.mountPoint}${yubikey.storage.path})"
+        salt="$(cat ${yubikey.storage.mountPoint}${yubikey.storage.path} | sed -n 1p | tr -d '\n')"
+        iterations="$(cat ${yubikey.storage.mountPoint}${yubikey.storage.path} | sed -n 2p | tr -d '\n')"
+        challenge="$(echo -n $salt | openssl-wrap dgst -binary -sha512 | rbtohex)"
+        response="$(ykchalresp -${toString yubikey.slot} -x $challenge 2>/dev/null)"
 
         for try in $(seq 3); do
 
@@ -68,9 +79,11 @@ let
             echo
             ''}
 
-            challenge="$(echo -n $k_user$uuid_r | openssl-wrap dgst -binary -sha512 | rbtohex)"
-
-            k_luks="$(ykchalresp -${toString yubikey.slot} -x $challenge 2>/dev/null)"
+            if [ ! -z "$k_user" ]; then
+                k_luks="$(echo -n $k_user | pbkdf2-sha512 ${toString yubikey.keyLength} $iterations $response | rbtohex)"
+            else
+                k_luks="$(echo | pbkdf2-sha512 ${toString yubikey.keyLength} $iterations $response | rbtohex)"
+            fi
 
             echo -n "$k_luks" | hextorb | cryptsetup luksOpen ${device} ${name} ${optionalString allowDiscards "--allow-discards"} --key-file=-
 
@@ -89,53 +102,60 @@ let
             exit 1
         fi
 
-        update_failed=false
+        echo -n "Gathering entropy for new salt (please enter random keys to generate entropy if this blocks for long)..."
+        for i in $(seq ${toString yubikey.saltLength}); do
+            byte="$(dd if=/dev/random bs=1 count=1 2>/dev/null | rbtohex)";
+            new_salt="$new_salt$byte";
+            echo -n .
+        done;
+        echo "ok"
 
-        local new_uuid_r
-        new_uuid_r="$(uuidgen)"
-        if [ $? != "0" ]; then
-            for try in $(seq 10); do
-                sleep 1
-                new_uuid_r="$(uuidgen)"
-                if [ $? == "0" ]; then break; fi
-                if [ $try -eq 10 ]; then update_failed=true; fi
-            done
-        fi
+        new_iterations="$iterations"
+        ${optionalString (yubikey.iterationStep > 0) ''
+        new_iterations="$(($new_iterations + ${toString yubikey.iterationStep}))"
+        ''}
 
-        if [ "$update_failed" == false ]; then
-            new_uuid_r="$(echo -n $new_uuid_r | head -c 36 | tr -d '-')"
+        new_challenge="$(echo -n $new_salt | openssl-wrap dgst -binary -sha512 | rbtohex)"
 
-            local new_challenge
-            new_challenge="$(echo -n $k_user$new_uuid_r | openssl-wrap dgst -binary -sha512 | rbtohex)"
+        new_response="$(ykchalresp -${toString yubikey.slot} -x $new_challenge 2>/dev/null)"
 
-            local new_k_luks
-            new_k_luks="$(ykchalresp -${toString yubikey.slot} -x $new_challenge 2>/dev/null)"
-
-            mkdir -p ${yubikey.ramfsMountPoint}
-            # A ramfs is used here to ensure that the file used to update
-            # the key slot with cryptsetup will never get swapped out.
-            # Warning: Do NOT replace with tmpfs!
-            mount -t ramfs none ${yubikey.ramfsMountPoint}
-
-            echo -n "$new_k_luks" | hextorb > ${yubikey.ramfsMountPoint}/new_key
-            echo -n "$k_luks" | cryptsetup luksChangeKey ${device} --key-file=- ${yubikey.ramfsMountPoint}/new_key
-
-            if [ $? == "0" ]; then
-                echo -n "$new_uuid_r" > ${yubikey.storage.mountPoint}${yubikey.storage.path}
-            else
-                echo "Warning: Could not update LUKS key, current challenge persists!"
-            fi
-
-            rm -f ${yubikey.ramfsMountPoint}/new_key
-            umount ${yubikey.ramfsMountPoint}
-            rm -rf ${yubikey.ramfsMountPoint}
+        if [ ! -z "$k_user" ]; then
+            new_k_luks="$(echo -n $k_user | pbkdf2-sha512 ${toString yubikey.keyLength} $new_iterations $new_response | rbtohex)"
         else
-            echo "Warning: Could not obtain new UUID, current challenge persists!"
+            new_k_luks="$(echo | pbkdf2-sha512 ${toString yubikey.keyLength} $new_iterations $new_response | rbtohex)"
         fi
 
+        mkdir -p ${yubikey.ramfsMountPoint}
+        # A ramfs is used here to ensure that the file used to update
+        # the key slot with cryptsetup will never get swapped out.
+        # Warning: Do NOT replace with tmpfs!
+        mount -t ramfs none ${yubikey.ramfsMountPoint}
+
+        echo -n "$new_k_luks" | hextorb > ${yubikey.ramfsMountPoint}/new_key
+        echo -n "$k_luks" | hextorb | cryptsetup luksChangeKey ${device} --key-file=- ${yubikey.ramfsMountPoint}/new_key
+
+        if [ $? == "0" ]; then
+            echo -ne "$new_salt\n$new_iterations" > ${yubikey.storage.mountPoint}${yubikey.storage.path}
+        else
+            echo "Warning: Could not update LUKS key, current challenge persists!"
+        fi
+
+        rm -f ${yubikey.ramfsMountPoint}/new_key
+        umount ${yubikey.ramfsMountPoint}
+        rm -rf ${yubikey.ramfsMountPoint}
+
         umount ${yubikey.storage.mountPoint}
     }
 
+    ${optionalString (yubikey.gracePeriod > 0) ''
+    echo -n "Waiting ${toString yubikey.gracePeriod} seconds as grace..."
+    for i in $(seq ${toString yubikey.gracePeriod}); do
+        sleep 1
+        echo -n .
+    done
+    echo "ok"
+    ''}
+
     yubikey_missing=true
     ykinfo -v 1>/dev/null 2>&1
     if [ $? != "0" ]; then
@@ -292,6 +312,30 @@ in
               description = "Which slot on the Yubikey to challenge";
             };
 
+            saltLength = mkOption {
+              default = 16;
+              type = types.int;
+              description = "Length of the new salt in byte (64 is the effective maximum)";
+            };
+
+            keyLength = mkOption {
+              default = 64;
+              type = types.int;
+              description = "Length of the LUKS slot key derived with PBKDF2 in byte";
+            };
+
+            iterationStep = mkOption {
+              default = 0;
+              type = types.int;
+              description = "How much the iteration count for PBKDF2 is increased at each successful authentication";
+            };
+
+            gracePeriod = mkOption {
+              default = 2;
+              type = types.int;
+              description = "Time in seconds to wait before attempting to find the Yubikey";
+            };
+
             ramfsMountPoint = mkOption {
               default = "/crypt-ramfs";
               type = types.string;
@@ -300,7 +344,7 @@ in
 
             storage = mkOption {
               type = types.optionSet;
-              description = "Options related to the storing the random UUID";
+              description = "Options related to the storing the salt";
 
               options = {
                 device = mkOption {
@@ -308,7 +352,7 @@ in
                   type = types.path;
                   description = ''
                     An unencrypted device that will temporarily be mounted in stage-1.
-                    Must contain the current random UUID to create the challenge for this LUKS device.
+                    Must contain the current salt to create the challenge for this LUKS device.
                   '';
                 };
 
@@ -328,7 +372,7 @@ in
                   default = "/crypt-storage/default";
                   type = types.string;
                   description = ''
-                    Absolute path of the random UUID on the unencrypted device with
+                    Absolute path of the salt on the unencrypted device with
                     that device's root directory as "/".
                   '';
                 };
@@ -370,11 +414,13 @@ in
       cp -pdv ${pkgs.popt}/lib/libpopt*.so.* $out/lib
 
       ${optionalString luks.yubikeySupport ''
-      cp -pdv ${pkgs.utillinux}/bin/uuidgen $out/bin
       cp -pdv ${pkgs.ykpers}/bin/ykchalresp $out/bin
       cp -pdv ${pkgs.ykpers}/bin/ykinfo $out/bin
       cp -pdv ${pkgs.openssl}/bin/openssl $out/bin
 
+      cc -O3 -I${pkgs.openssl}/include -L${pkgs.openssl}/lib ${./pbkdf2-sha512.c} -o $out/bin/pbkdf2-sha512 -lcrypto
+      strip -s $out/bin/pbkdf2-sha512
+
       cp -pdv ${pkgs.libusb1}/lib/libusb*.so.* $out/lib
       cp -pdv ${pkgs.ykpers}/lib/libykpers*.so.* $out/lib
       cp -pdv ${pkgs.libyubikey}/lib/libyubikey*.so.* $out/lib
@@ -394,7 +440,6 @@ EOF
     boot.initrd.extraUtilsCommandsTest = ''
       $out/bin/cryptsetup --version
       ${optionalString luks.yubikeySupport ''
-        $out/bin/uuidgen --version
         $out/bin/ykchalresp -V
         $out/bin/ykinfo -V
         cat > $out/bin/openssl-wrap <<EOF
diff --git a/nixos/modules/system/boot/pbkdf2-sha512.c b/nixos/modules/system/boot/pbkdf2-sha512.c
new file mode 100644
index 00000000000..b40c383ac02
--- /dev/null
+++ b/nixos/modules/system/boot/pbkdf2-sha512.c
@@ -0,0 +1,38 @@
+#include <stdint.h>
+#include <string.h>
+#include <stdio.h>
+#include <openssl/evp.h>
+
+void hextorb(uint8_t* hex, uint8_t* rb)
+{
+	while(sscanf(hex, "%2x", rb) == 1)
+	{
+		hex += 2;
+		rb += 1;
+	}
+	*rb = '\0';
+}
+
+int main(int argc, char** argv)
+{
+	uint8_t k_user[2048];
+	uint8_t salt[2048];
+	uint8_t key[4096];
+
+	uint32_t key_length = atoi(argv[1]);
+	uint32_t iteration_count = atoi(argv[2]);
+
+	hextorb(argv[3], salt);
+	uint32_t salt_length = strlen(argv[3]) / 2;
+
+	fgets(k_user, 2048, stdin);
+	uint32_t k_user_length = strlen(k_user);
+	if(k_user[k_user_length - 1] == '\n') {
+			k_user[k_user_length - 1] = '\0';
+	}
+
+	PKCS5_PBKDF2_HMAC(k_user, k_user_length, salt, salt_length, iteration_count, EVP_sha512(), key_length, key);
+	fwrite(key, 1, key_length, stdout);
+
+	return 0;
+}
\ No newline at end of file

From 31fa2cd52bef42d670c569cb8951509c89c143b0 Mon Sep 17 00:00:00 2001
From: "Ricardo M. Correia" <rcorreia@wizy.org>
Date: Wed, 29 Jan 2014 19:06:45 +0100
Subject: [PATCH 19/59] grsecurity: Fix building grsec-3.x.0 kernels

---
 pkgs/os-specific/linux/kernel/linux-3.13.nix | 2 +-
 pkgs/os-specific/linux/kernel/linux-3.2.nix  | 2 +-
 pkgs/top-level/all-packages.nix              | 8 ++++++--
 3 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-3.13.nix b/pkgs/os-specific/linux/kernel/linux-3.13.nix
index 637d2935c98..a5d816b2563 100644
--- a/pkgs/os-specific/linux/kernel/linux-3.13.nix
+++ b/pkgs/os-specific/linux/kernel/linux-3.13.nix
@@ -13,4 +13,4 @@ import ./generic.nix (args // rec {
   features.needsCifsUtils = true;
   features.canDisableNetfilterConntrackHelpers = true;
   features.netfilterRPFilter = true;
-})
+} // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-3.2.nix b/pkgs/os-specific/linux/kernel/linux-3.2.nix
index d7598b53b1b..c0006ed7348 100644
--- a/pkgs/os-specific/linux/kernel/linux-3.2.nix
+++ b/pkgs/os-specific/linux/kernel/linux-3.2.nix
@@ -9,4 +9,4 @@ import ./generic.nix (args // rec {
   };
 
   features.iwlwifi = true;
-})
+} // (args.argsOverride or {}))
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 57a1933c7b2..c6f8fe8b8dd 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -6660,13 +6660,17 @@ let
   # config options you need (e.g. by overriding extraConfig). See list of options here:
   # https://en.wikibooks.org/wiki/Grsecurity/Appendix/Grsecurity_and_PaX_Configuration_Options
   linux_3_2_grsecurity = lowPrio (lib.overrideDerivation (linux_3_2.override (args: {
-    modDirVersion = "${linux_3_2.version}-grsec";
     kernelPatches = args.kernelPatches ++ [ kernelPatches.grsecurity_3_0_3_2_54 kernelPatches.grsec_path ];
+    argsOverride = {
+      modDirVersion = "${linux_3_2.modDirVersion}-grsec";
+    };
   })) (args: grsecurityOverrider args));
 
   linux_3_12_grsecurity = lowPrio (lib.overrideDerivation (linux_3_12.override (args: {
-    modDirVersion = "${linux_3_12.version}-grsec";
     kernelPatches = args.kernelPatches ++ [ kernelPatches.grsecurity_3_0_3_12_8 kernelPatches.grsec_path ];
+    argsOverride = {
+      modDirVersion = "${linux_3_12.modDirVersion}-grsec";
+    };
   })) (args: grsecurityOverrider args));
 
   linux_3_2_apparmor = lowPrio (linux_3_2.override {

From b31547654d7fd5fea0eadbae07fcae5c9dd60077 Mon Sep 17 00:00:00 2001
From: "Ricardo M. Correia" <rcorreia@wizy.org>
Date: Wed, 29 Jan 2014 14:52:18 +0100
Subject: [PATCH 20/59] grsecurity: Update stable and test patches

stable: 3.0-3.2.54-201401191012 -> 3.0-3.2.54-201402062221
test:   3.0-3.12.8-201401191015 -> 3.0-3.13.2-201402062224
---
 pkgs/os-specific/linux/kernel/patches.nix | 14 +++++++-------
 pkgs/top-level/all-packages.nix           |  8 ++++----
 2 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/patches.nix b/pkgs/os-specific/linux/kernel/patches.nix
index 8b658a6030e..5ade01014f9 100644
--- a/pkgs/os-specific/linux/kernel/patches.nix
+++ b/pkgs/os-specific/linux/kernel/patches.nix
@@ -81,22 +81,22 @@ rec {
   grsecurity_3_0_3_2_54 =
     { name = "grsecurity-3.0-3.2.54";
       patch = fetchurl {
-        url = https://grsecurity.net/stable/grsecurity-3.0-3.2.54-201401191012.patch;
-        sha256 = "10kfdk46fgd1awys8f8520w7kanc4m0ckn28xg36473fi76i6snx";
+        url = https://grsecurity.net/stable/grsecurity-3.0-3.2.54-201402062221.patch;
+        sha256 = "14x887xibl7d50a1pxmi0snnwcnh27z8bnidhxg2xfasxxp248m5";
       };
       features.grsecurity = true;
       # The grsec kernel patch seems to include the apparmor patches as of 3.0-3.2.54
       features.apparmor = true;
     };
 
-  grsecurity_3_0_3_12_8 =
-    { name = "grsecurity-3.0-3.12.8";
+  grsecurity_3_0_3_13_2 =
+    { name = "grsecurity-3.0-3.13.2";
       patch = fetchurl {
-        url = https://grsecurity.net/test/grsecurity-3.0-3.12.8-201401191015.patch;
-        sha256 = "0dy7daar873jp0afkf48l8ij1ii8cgcc9z5pn50h1fvhc9ap1j4f";
+        url = https://grsecurity.net/test/grsecurity-3.0-3.13.2-201402062224.patch;
+        sha256 = "0w42d76bv7yzpr23bicsadf64csbmq988kmpzxg4yv5qwzhhbyh7";
       };
       features.grsecurity = true;
-      # The grsec kernel patch seems to include the apparmor patches as of 3.0-3.12.8
+      # The grsec kernel patch seems to include the apparmor patches as of 3.0-3.13.2
       features.apparmor = true;
     };
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index c6f8fe8b8dd..fd24b251b48 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -6666,10 +6666,10 @@ let
     };
   })) (args: grsecurityOverrider args));
 
-  linux_3_12_grsecurity = lowPrio (lib.overrideDerivation (linux_3_12.override (args: {
-    kernelPatches = args.kernelPatches ++ [ kernelPatches.grsecurity_3_0_3_12_8 kernelPatches.grsec_path ];
+  linux_3_13_grsecurity = lowPrio (lib.overrideDerivation (linux_3_13.override (args: {
+    kernelPatches = args.kernelPatches ++ [ kernelPatches.grsecurity_3_0_3_13_2 kernelPatches.grsec_path ];
     argsOverride = {
-      modDirVersion = "${linux_3_12.modDirVersion}-grsec";
+      modDirVersion = "${linux_3_13.modDirVersion}-grsec";
     };
   })) (args: grsecurityOverrider args));
 
@@ -6854,7 +6854,7 @@ let
   linuxPackages_3_10_tuxonice = linuxPackagesFor pkgs.linux_3_10_tuxonice linuxPackages_3_10_tuxonice;
   linuxPackages_3_11 = recurseIntoAttrs (linuxPackagesFor pkgs.linux_3_11 linuxPackages_3_11);
   linuxPackages_3_12 = recurseIntoAttrs (linuxPackagesFor pkgs.linux_3_12 linuxPackages_3_12);
-  linuxPackages_3_12_grsecurity = linuxPackagesFor pkgs.linux_3_12_grsecurity linuxPackages_3_12_grsecurity;
+  linuxPackages_3_13_grsecurity = linuxPackagesFor pkgs.linux_3_13_grsecurity linuxPackages_3_13_grsecurity;
   linuxPackages_3_13 = recurseIntoAttrs (linuxPackagesFor pkgs.linux_3_13 linuxPackages_3_13);
   # Update this when adding a new version!
   linuxPackages_latest = pkgs.linuxPackages_3_13;

From 979473a17b5026e9f972dc02fb2b47272bfb0bc0 Mon Sep 17 00:00:00 2001
From: "Ricardo M. Correia" <rcorreia@wizy.org>
Date: Fri, 7 Feb 2014 12:18:31 +0000
Subject: [PATCH 21/59] chromium: Update stable channel from 32.0.1700.102 ->
 32.0.1700.107

---
 pkgs/applications/networking/browsers/chromium/sources.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/browsers/chromium/sources.nix b/pkgs/applications/networking/browsers/chromium/sources.nix
index 6ad9d9090d5..ffce71ef09f 100644
--- a/pkgs/applications/networking/browsers/chromium/sources.nix
+++ b/pkgs/applications/networking/browsers/chromium/sources.nix
@@ -11,8 +11,8 @@
     sha256 = "04n43c4vn8i7qhlybqb19c2c8kri8nc1wpa2l83vin4sqxkq519h";
   };
   stable = {
-    version = "32.0.1700.102";
-    url = "http://commondatastorage.googleapis.com/chromium-browser-official/chromium-32.0.1700.102.tar.xz";
-    sha256 = "0jxwhd7cd60ivisrnzcglqqnmy99np1vvjqa27y42d852xjx84ys";
+    version = "32.0.1700.107";
+    url = "http://commondatastorage.googleapis.com/chromium-browser-official/chromium-32.0.1700.107.tar.xz";
+    sha256 = "1bf1gbjf4r9nf3xdn7zgq0ny1ihak21ka4rkkiadxsg8aq9vdsqz";
   };
 }

From e78351cf3a4829c9eecb43af3acba0f82c07513b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <vcunat@gmail.com>
Date: Sat, 8 Feb 2014 17:24:17 +0100
Subject: [PATCH 22/59] llvm: revert to _33 default on darwin as a temp
 workaround

_34 doesn't build and I don't have a clue what to do about it
(and I don't have a machine to test it anyway).
---
 pkgs/top-level/all-packages.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 57a1933c7b2..1332cadc646 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2794,7 +2794,8 @@ let
 
   lessc = callPackage ../development/compilers/lessc { };
 
-  llvm = llvmPackages.llvm;
+  llvm = if stdenv.isDarwin then llvm_33 # until someone solves build problems with _34
+    else llvmPackages.llvm;
 
   llvm_34 = llvmPackages.llvm;
   llvm_33 = llvm_v ../development/compilers/llvm/3.3/llvm.nix;

From 64a8ae3692a3139ce0b576e6b1a0575b605187b7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Domen=20Ko=C5=BEar?= <domen@dev.si>
Date: Sat, 8 Feb 2014 18:09:27 +0100
Subject: [PATCH 23/59] SpringRTS: fix runtime dependencies and maintain

---
 pkgs/games/spring/default.nix | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/pkgs/games/spring/default.nix b/pkgs/games/spring/default.nix
index 4f8fe0d1974..c5ba87b113e 100644
--- a/pkgs/games/spring/default.nix
+++ b/pkgs/games/spring/default.nix
@@ -14,23 +14,24 @@ stdenv.mkDerivation rec {
     sha256 = "1axyqkxgv3a0zg0afzlc7j3lyi412zd551j317ci41yqz2qzf0px";
   };
 
-  buildInputs = [ cmake lzma boost libdevil zlib p7zip openal libvorbis freetype SDL
-    xlibs.libX11 xlibs.libXcursor mesa glew asciidoc libxslt docbook_xsl curl ]
+  cmakeFlags = ["-DCMAKE_BUILD_WITH_INSTALL_RPATH:BOOL=ON"
+                "-DCMAKE_INSTALL_RPATH_USE_LINK_PATH:BOOL=ON"
+                "-DPREFER_STATIC_LIBS=OFF"];
+
+  buildInputs = [ cmake lzma boost libdevil zlib p7zip openal libvorbis freetype SDL glibc
+    xlibs.libX11 xlibs.libXcursor mesa glew asciidoc libxslt docbook_xsl curl
+    docbook_xsl_ns ]
     ++ stdenv.lib.optional withAI jdk
     ++ stdenv.lib.optional withAI python;
 
-  prePatch = ''
-    substituteInPlace cont/base/make_gamedata_arch.sh --replace "#!/bin/sh" "#!${stdenv.shell}/bin/sh" \
-      --replace "which" "type -p"
-  '';
-
+  # reported upstream http://springrts.com/mantis/view.php?id=4305
   #enableParallelBuilding = true; # occasionally missing generated files on Hydra
 
   meta = with stdenv.lib; {
     homepage = http://springrts.com/;
     description = "A powerful real-time strategy (RTS) game engine";
     license = licenses.gpl2;
-    maintainers = [ maintainers.phreedom maintainers.qknight ];
+    maintainers = [ maintainers.phreedom maintainers.qknight maintainers.iElectric ];
     platforms = platforms.mesaPlatforms;
   };
 }

From 4baa1197ddf9ece82da78d32a981985f182e5b5a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Domen=20Ko=C5=BEar?= <domen@dev.si>
Date: Sat, 8 Feb 2014 18:16:28 +0100
Subject: [PATCH 24/59] spring: add missing function parameters

---
 pkgs/games/spring/default.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/games/spring/default.nix b/pkgs/games/spring/default.nix
index c5ba87b113e..b073aa3488b 100644
--- a/pkgs/games/spring/default.nix
+++ b/pkgs/games/spring/default.nix
@@ -1,9 +1,10 @@
-{ stdenv, fetchurl, cmake, lzma, boost, libdevil, zlib, p7zip
+{ stdenv, fetchurl, cmake, lzma, boost, libdevil, zlib, p7zip, glibc
 , openal, libvorbis, glew, freetype, xlibs, SDL, mesa, binutils
-, asciidoc, libxslt, docbook_xsl, curl
+, asciidoc, libxslt, docbook_xsl, docbook_xsl_ns, curl
 , jdk ? null, python ? null
 , withAI ? true # support for AI Interfaces and Skirmish AIs
 }:
+
 stdenv.mkDerivation rec {
 
   name = "spring-${version}";

From 93f45ad2e5af3af22f91fc57e1a51e180b547b53 Mon Sep 17 00:00:00 2001
From: Moritz Ulrich <moritz@tarn-vedra.de>
Date: Sat, 8 Feb 2014 18:54:34 +0100
Subject: [PATCH 25/59] Rebar: update to 2.2.0

---
 .../development/tools/build-managers/rebar/default.nix | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/build-managers/rebar/default.nix b/pkgs/development/tools/build-managers/rebar/default.nix
index ac695178541..a64360c5727 100644
--- a/pkgs/development/tools/build-managers/rebar/default.nix
+++ b/pkgs/development/tools/build-managers/rebar/default.nix
@@ -1,11 +1,15 @@
 { stdenv, fetchurl, erlang }:
 
+
+let
+  version = "2.2.0";
+in
 stdenv.mkDerivation {
-  name = "rebar-2.1.0-pre";
+  name = "rebar-${version}";
 
   src = fetchurl {
-    url = "https://github.com/basho/rebar/archive/2.1.0-pre.tar.gz";
-    sha256 = "0dsbk9ssvk1hx9275900dg4bz79kpwcid4gsz09ziiwzv0jjbrjn";
+    url = "https://github.com/rebar/rebar/archive/${version}.tar.gz";
+    sha256 = "0wprgzin09286v583jmlc385jqpi2lcpdql9srm4c7g39122dg43";
   };
 
   buildInputs = [ erlang ];

From c983d23e336acb74ad3bc15c707353f731c51190 Mon Sep 17 00:00:00 2001
From: Moritz Ulrich <moritz@tarn-vedra.de>
Date: Sat, 8 Feb 2014 19:05:31 +0100
Subject: [PATCH 26/59] elixir: Update to 0.12.3.

---
 pkgs/development/interpreters/elixir/default.nix | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/interpreters/elixir/default.nix b/pkgs/development/interpreters/elixir/default.nix
index 5f1749f33c9..56fc15b0511 100644
--- a/pkgs/development/interpreters/elixir/default.nix
+++ b/pkgs/development/interpreters/elixir/default.nix
@@ -1,29 +1,30 @@
 { stdenv, fetchurl, erlang, rebar, makeWrapper, coreutils }:
 
 let
-  version = "0.12.0";
+  version = "0.12.3";
 in
 stdenv.mkDerivation {
   name = "elixir-${version}";
 
   src = fetchurl {
     url = "https://github.com/elixir-lang/elixir/archive/v${version}.tar.gz";
-    sha256 = "0cir2y36zljwphiqyz8xmq7qq0f094jmfy3qwk3wdm05c05nqnc8";
+    sha256 = "1im00cki38ldsig93djlsap8zbgwv74kpgw7xg9l6ik2cbpk0131";
   };
 
   buildInputs = [ erlang rebar makeWrapper ];
 
   preBuild = ''
-    substituteInPlace rebar \
-      --replace "/usr/bin/env escript" ${erlang}/bin/escript
+    # The build process uses ./rebar. Link it to the nixpkgs rebar
+    rm -v rebar
+    ln -s ${rebar}/bin/rebar rebar
+
     substituteInPlace Makefile \
-      --replace '$(shell echo `pwd`/rebar)' ${rebar}/bin/rebar \
       --replace "/usr/local" $out
   '';
 
   postFixup = ''
-    # Elixirs binaries are shell scripts which run erl. This adds some
-    # stuff to PATH so the scripts run without problems.
+    # Elixir binaries are shell scripts which run erl. Add some stuff
+    # to PATH so the scripts can run without problems.
 
     for f in $out/bin/*
     do

From bb66a3ff6ce25350f3999b80932e40c91d079e73 Mon Sep 17 00:00:00 2001
From: Moritz Ulrich <moritz@tarn-vedra.de>
Date: Sat, 8 Feb 2014 19:17:18 +0100
Subject: [PATCH 27/59] Anki: Update to 2.0.22.

---
 pkgs/games/anki/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/games/anki/default.nix b/pkgs/games/anki/default.nix
index e039291882c..720be6fb1d2 100644
--- a/pkgs/games/anki/default.nix
+++ b/pkgs/games/anki/default.nix
@@ -6,13 +6,13 @@
 
 let
     py = pythonPackages;
+    version = "2.0.22";
 in
-
 stdenv.mkDerivation rec {
-    name = "anki-2.0.20";
+    name = "anki-${version}";
     src = fetchurl {
       url = "http://ankisrs.net/download/mirror/${name}.tgz";
-      sha256 = "1w274g7as458bfkh86635p04fimvmkn70j8qy9m6nl2xwjaq8nhm";
+      sha256 = "1bnjzf8050hrs3iiaak0m07sxj07vqic677llg2g6iarg9ws8x26";
     };
 
     pythonPath = [ pyqt4 py.pysqlite py.sqlalchemy py.pyaudio ]
@@ -55,7 +55,7 @@ stdenv.mkDerivation rec {
         decrease your time spent studying, or greatly increase the amount you learn.
 
         Anyone who needs to remember things in their daily life can benefit from
-        Anki. Since it is content-agnostic and supports images, audio, videos and 
+        Anki. Since it is content-agnostic and supports images, audio, videos and
         scientific markup (via LaTeX), the possibilities are endless. For example:
 
         * learning a language

From 61f20ca45ea848185123c65f483d4929c417dadc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Domen=20Ko=C5=BEar?= <domen@dev.si>
Date: Sat, 8 Feb 2014 20:15:12 +0100
Subject: [PATCH 28/59] libqmi: 1.0 -> 1.8.0, move outside gnome3 namespace,
 fix build

---
 pkgs/desktops/gnome-3/core/libqmi/default.nix | 16 --------------
 pkgs/desktops/gnome-3/default.nix             |  2 --
 pkgs/development/libraries/libqmi/default.nix | 21 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  2 ++
 4 files changed, 23 insertions(+), 18 deletions(-)
 delete mode 100644 pkgs/desktops/gnome-3/core/libqmi/default.nix
 create mode 100644 pkgs/development/libraries/libqmi/default.nix

diff --git a/pkgs/desktops/gnome-3/core/libqmi/default.nix b/pkgs/desktops/gnome-3/core/libqmi/default.nix
deleted file mode 100644
index beb63f80b80..00000000000
--- a/pkgs/desktops/gnome-3/core/libqmi/default.nix
+++ /dev/null
@@ -1,16 +0,0 @@
-{ stdenv, fetchurl, pkgconfig, glib, python }:
-
-stdenv.mkDerivation rec {
-  name = "libqmi-1.0";
-
-  src = fetchurl {
-    url = "http://ftp.acc.umu.se/pub/GNOME/core/3.10/3.10.2/sources/${name}.tar.xz";
-    sha256 = "0w4cd7nihp73frh3sfi13fx0rkwmd581xpil54bsjc7pw7z01bd1";
-  };
-
-  buildInputs = [ pkgconfig glib python ];
-
-  meta = with stdenv.lib; {
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/desktops/gnome-3/default.nix b/pkgs/desktops/gnome-3/default.nix
index e9ec7be55b9..197a135dcaa 100644
--- a/pkgs/desktops/gnome-3/default.nix
+++ b/pkgs/desktops/gnome-3/default.nix
@@ -70,8 +70,6 @@ rec {
 
   libpeas = callPackage ./core/libpeas {};
 
-  libqmi = callPackage ./core/libqmi {};
-
   libgweather = callPackage ./core/libgweather { };
 
   libzapojit = callPackage ./core/libzapojit { };
diff --git a/pkgs/development/libraries/libqmi/default.nix b/pkgs/development/libraries/libqmi/default.nix
new file mode 100644
index 00000000000..a0292067dbb
--- /dev/null
+++ b/pkgs/development/libraries/libqmi/default.nix
@@ -0,0 +1,21 @@
+{ stdenv, fetchurl, pkgconfig, glib, python }:
+
+stdenv.mkDerivation rec {
+  name = "libqmi-1.8.0";
+
+  src = fetchurl {
+    url = "http://www.freedesktop.org/software/libqmi/${name}.tar.xz";
+    sha256 = "03gf221yjcdzvnl4v2adwpc6cyg5mlbccn20s00fp5bgvmq81pgs";
+  };
+
+  preBuild = ''
+    patchShebangs .
+  '';
+
+  buildInputs = [ pkgconfig glib python ];
+
+  meta = with stdenv.lib; {
+    description = "Modem protocol helper library";
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 1c542dfc361..d7aff1acc06 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1282,6 +1282,8 @@ let
 
   libshout = callPackage ../development/libraries/libshout { };
 
+  libqmi = callPackage ../development/libraries/libqmi { };
+
   libtorrent = callPackage ../tools/networking/p2p/libtorrent { };
 
   logcheck = callPackage ../tools/system/logcheck {

From b17edbac57919117475525cdc7fb9301224c0263 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Domen=20Ko=C5=BEar?= <domen@dev.si>
Date: Sat, 8 Feb 2014 20:16:34 +0100
Subject: [PATCH 29/59] ModemManager: 0.5.4.0 -> 0.7.991

---
 .../services/networking/networkmanager.nix    |  8 ++++---
 .../development/libraries/libmbim/default.nix | 23 +++++++++++++++++++
 .../tools/networking/modemmanager/default.nix | 19 ++++++++-------
 pkgs/top-level/all-packages.nix               |  2 ++
 4 files changed, 41 insertions(+), 11 deletions(-)
 create mode 100644 pkgs/development/libraries/libmbim/default.nix

diff --git a/nixos/modules/services/networking/networkmanager.nix b/nixos/modules/services/networking/networkmanager.nix
index 0b079e3567a..2db96d9cd31 100644
--- a/nixos/modules/services/networking/networkmanager.nix
+++ b/nixos/modules/services/networking/networkmanager.nix
@@ -31,7 +31,7 @@ let
 
     [modem-manager]
     Identity=unix-group:networkmanager
-    Action=org.freedesktop.ModemManager.*
+    Action=org.freedesktop.ModemManager*
     ResultAny=yes
     ResultInactive=no
     ResultActive=yes
@@ -42,7 +42,7 @@ let
         subject.isInGroup("networkmanager")
         && subject.active
         && (action.id.indexOf("org.freedesktop.NetworkManager.") == 0
-            || action.id.indexOf("org.freedesktop.ModemManager.")  == 0
+            || action.id.indexOf("org.freedesktop.ModemManager")  == 0
         ))
           { return polkit.Result.YES; }
     });
@@ -161,6 +161,7 @@ in {
         networkmanager_vpnc
         networkmanager_openconnect
         networkmanager_pptp
+        modemmanager
         ];
 
     users.extraGroups = singleton {
@@ -177,7 +178,7 @@ in {
       description = "NetworkManager initialisation";
       wantedBy = [ "network.target" ];
       partOf = [ "NetworkManager.service" ];
-      wants = [ "NetworkManager.service" ];
+      wants = [ "ModemManager.service" ];
       before = [ "NetworkManager.service" ];
       script = ''
         mkdir -m 700 -p /etc/NetworkManager/system-connections
@@ -206,6 +207,7 @@ in {
         networkmanager_vpnc
         networkmanager_openconnect
         networkmanager_pptp
+        modemmanager
         ];
 
     services.udev.packages = cfg.packages;
diff --git a/pkgs/development/libraries/libmbim/default.nix b/pkgs/development/libraries/libmbim/default.nix
new file mode 100644
index 00000000000..8207051b2a8
--- /dev/null
+++ b/pkgs/development/libraries/libmbim/default.nix
@@ -0,0 +1,23 @@
+{ stdenv, fetchurl, pkgconfig, glib, python, udev }:
+
+stdenv.mkDerivation rec {
+  name = "libmbim-1.6.0";
+
+  src = fetchurl {
+    url = "http://www.freedesktop.org/software/libmbim/${name}.tar.xz";
+    sha256 = "10mh1b8jfxg6y6nhr7swbi9wx4acjgvx1if7nhrw1ppd5apvvvz0";
+  };
+
+  preConfigure = ''
+    for f in build-aux/mbim-codegen/*; do
+       substituteInPlace $f --replace "/usr/bin/env python" "${python}/bin/python"
+    done
+  '';
+
+  buildInputs = [ pkgconfig glib udev ];
+
+  meta = with stdenv.lib; {
+    description = "talking to WWAN modems and devices which speak the Mobile Interface Broadband Model (MBIM) protocol";
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/tools/networking/modemmanager/default.nix b/pkgs/tools/networking/modemmanager/default.nix
index bfa673eff09..3e33b845b60 100644
--- a/pkgs/tools/networking/modemmanager/default.nix
+++ b/pkgs/tools/networking/modemmanager/default.nix
@@ -1,19 +1,22 @@
-{ stdenv, fetchurl_gnome, udev, polkit, dbus_glib, ppp, intltool, pkgconfig }:
+{ stdenv, fetchurl, udev, polkit, dbus_glib, ppp, intltool, pkgconfig, libmbim, libqmi }:
 
 stdenv.mkDerivation rec {
-  name = src.pkgname;
+  name = "ModemManager-0.7.991";
 
-  src = fetchurl_gnome {
-    project = "ModemManager";
-    major = "0"; minor = "5"; patchlevel = "4.0"; extension = "xz";
-    sha256 = "1fdf5d5cc494825afe9f551248e00a2d91e220e88435b47f109ca2a707a40f1f";
+  src = fetchurl {
+    url = "mirror://gnome/sources/ModemManager/0.7/${name}.tar.xz";
+    sha256 = "0p8shqsbgnsazim7s52ylxjk064cbx2n1vm1jgywr7i58hsd6n4y";
   };
 
   nativeBuildInputs = [ intltool pkgconfig ];
 
-  buildInputs = [ udev polkit dbus_glib ppp ];
+  buildInputs = [ udev polkit dbus_glib ppp libmbim libqmi ];
 
-  configureFlags = "--with-polkit --with-udev-base-dir=$(out)/lib/udev";
+  configureFlags = [
+    "--with-polkit"
+    "--with-udev-base-dir=$(out)/lib/udev"
+    "--with-systemdsystemunitdir=$(out)/etc/systemd/system"
+  ];
 
   meta = {
     description = "WWAN modem manager, part of NetworkManager";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index d7aff1acc06..a51d1d33f56 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1284,6 +1284,8 @@ let
 
   libqmi = callPackage ../development/libraries/libqmi { };
 
+  libmbim = callPackage ../development/libraries/libmbim { };
+
   libtorrent = callPackage ../tools/networking/p2p/libtorrent { };
 
   logcheck = callPackage ../tools/system/logcheck {

From a23b87a13a68c4d838318fab7d835b5d704ceb58 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Domen=20Ko=C5=BEar?= <domen@dev.si>
Date: Sat, 8 Feb 2014 20:26:23 +0100
Subject: [PATCH 30/59] pypy: disable a test with transient error #1634

---
 pkgs/development/interpreters/pypy/2.2/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/interpreters/pypy/2.2/default.nix b/pkgs/development/interpreters/pypy/2.2/default.nix
index b870522f629..a348937d8af 100644
--- a/pkgs/development/interpreters/pypy/2.2/default.nix
+++ b/pkgs/development/interpreters/pypy/2.2/default.nix
@@ -58,7 +58,8 @@ let
        # disable shutils because it assumes gid 0 exists
        # disable socket because it has two actual network tests that fail
        # disable test_mhlib because it fails for unknown reason
-      ./pypy-c ./pypy/test_all.py --pypy=./pypy-c -k '-test_socket -test_shutil -test_mhlib' lib-python
+       # disable test_multiprocessing due to transient errors
+      ./pypy-c ./pypy/test_all.py --pypy=./pypy-c -k '-test_socket -test_shutil -test_mhlib -test_multiprocessing' lib-python
     '';
 
     installPhase = ''

From 4a1e74673a2ead0e727f5a356fbccbd88c52dd91 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Domen=20Ko=C5=BEar?= <domen@dev.si>
Date: Sat, 8 Feb 2014 20:27:57 +0100
Subject: [PATCH 31/59] pypy: support only linux for now

---
 pkgs/development/interpreters/pypy/2.2/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/interpreters/pypy/2.2/default.nix b/pkgs/development/interpreters/pypy/2.2/default.nix
index a348937d8af..231a0a7dfaa 100644
--- a/pkgs/development/interpreters/pypy/2.2/default.nix
+++ b/pkgs/development/interpreters/pypy/2.2/default.nix
@@ -87,7 +87,7 @@ let
       homepage = "http://pypy.org/";
       description = "PyPy is a fast, compliant alternative implementation of the Python language (2.7.3)";
       license = licenses.mit;
-      platforms = platforms.all;
+      platforms = platforms.linux;
       maintainers = with maintainers; [ iElectric ];
     };
   };

From dea562b6b920463395db47d141689e0768eb4836 Mon Sep 17 00:00:00 2001
From: Shea Levy <shea@shealevy.com>
Date: Sat, 8 Feb 2014 14:45:28 -0500
Subject: [PATCH 32/59] services.mesa -> hardware.opengl

Signed-off-by: Shea Levy <shea@shealevy.com>
---
 .../x11/mesa.nix => hardware/opengl.nix}      | 22 +++++++++----------
 nixos/modules/module-list.nix                 |  2 +-
 nixos/modules/rename.nix                      |  4 ++++
 nixos/modules/services/ttys/kmscon.nix        |  2 +-
 nixos/modules/services/x11/xserver.nix        |  8 +++----
 nixos/modules/virtualisation/qemu-vm.nix      |  2 +-
 .../virtualisation/virtualbox-guest.nix       |  2 +-
 7 files changed, 23 insertions(+), 19 deletions(-)
 rename nixos/modules/{services/x11/mesa.nix => hardware/opengl.nix} (89%)

diff --git a/nixos/modules/services/x11/mesa.nix b/nixos/modules/hardware/opengl.nix
similarity index 89%
rename from nixos/modules/services/x11/mesa.nix
rename to nixos/modules/hardware/opengl.nix
index 12fc7ae1178..603012cb109 100644
--- a/nixos/modules/services/x11/mesa.nix
+++ b/nixos/modules/hardware/opengl.nix
@@ -2,19 +2,19 @@
 let
   inherit (pkgs.lib) mkOption types mkIf optional optionals elem optionalString optionalAttrs;
 
-  cfg = config.services.mesa;
+  cfg = config.hardware.opengl;
 
   kernelPackages = config.boot.kernelPackages;
 in {
   options = {
-    services.mesa.enable = mkOption {
-      description = "Whether this configuration requires mesa.";
+    hardware.opengl.enable = mkOption {
+      description = "Whether this configuration requires opengl.";
       type = types.bool;
       default = false;
       internal = true;
     };
 
-    services.mesa.driSupport = mkOption {
+    hardware.opengl.driSupport = mkOption {
       type = types.bool;
       default = true;
       description = ''
@@ -23,18 +23,18 @@ in {
       '';
     };
 
-    services.mesa.driSupport32Bit = mkOption {
+    hardware.opengl.driSupport32Bit = mkOption {
       type = types.bool;
       default = false;
       description = ''
         On 64-bit systems, whether to support Direct Rendering for
         32-bit applications (such as Wine).  This is currently only
         supported for the <literal>nvidia</literal> driver and for
-        <literal>mesa</literal>.
+        <literal>Mesa</literal>.
       '';
     };
 
-    services.mesa.s3tcSupport = mkOption {
+    hardware.opengl.s3tcSupport = mkOption {
       type = types.bool;
       default = false;
       description = ''
@@ -47,15 +47,15 @@ in {
     };
 
 
-    services.mesa.videoDrivers = mkOption {
+    hardware.opengl.videoDrivers = mkOption {
       type = types.listOf types.str;
       # !!! We'd like "nv" here, but it segfaults the X server.
       default = [ "ati" "cirrus" "intel" "vesa" "vmware" ];
       example = [ "vesa" ];
       description = ''
-        The names of the video drivers that the mesa should
-        support.  Mesa will try all of the drivers listed
-        here until it finds one that supports your video card.
+        The names of the opengl video drivers the configuration
+        supports. They will be tried in order until one that
+        supports your card is found.
       '';
     };
   };
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index aa4bada8b28..5d52f71c9ff 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -29,6 +29,7 @@
   ./hardware/network/intel-3945abg.nix
   ./hardware/network/ralink.nix
   ./hardware/network/rtl8192c.nix
+  ./hardware/opengl.nix
   ./hardware/pcmcia.nix
   ./installer/tools/nixos-checkout.nix
   ./installer/tools/tools.nix
@@ -235,7 +236,6 @@
   ./services/x11/hardware/multitouch.nix
   ./services/x11/hardware/synaptics.nix
   ./services/x11/hardware/wacom.nix
-  ./services/x11/mesa.nix
   ./services/x11/window-managers/awesome.nix
   #./services/x11/window-managers/compiz.nix
   ./services/x11/window-managers/default.nix
diff --git a/nixos/modules/rename.nix b/nixos/modules/rename.nix
index 15e05a3d675..8393b5758f3 100644
--- a/nixos/modules/rename.nix
+++ b/nixos/modules/rename.nix
@@ -119,6 +119,10 @@ in zipModules ([]
 ++ obsolete [ "services" "xserver" "driSupport32Bit" ] [ "services" "mesa" "driSupport32Bit" ]
 ++ obsolete [ "services" "xserver" "s3tcSupport" ] [ "services" "mesa" "s3tcSupport" ]
 ++ obsolete [ "services" "xserver" "videoDrivers" ] [ "services" "mesa" "videoDrivers" ]
+++ obsolete [ "services" "mesa" "driSupport" ] [ "hardware" "opengl" "driSupport" ]
+++ obsolete [ "services" "mesa" "driSupport32Bit" ] [ "hardware" "opengl" "driSupport32Bit" ]
+++ obsolete [ "services" "mesa" "s3tcSupport" ] [ "hardware" "opengl" "s3tcSupport" ]
+++ obsolete [ "services" "mesa" "videoDrivers" ] [ "hardware" "opengl" "videoDrivers" ]
 
 # Options that are obsolete and have no replacement.
 ++ obsolete' [ "boot" "loader" "grub" "bootDevice" ]
diff --git a/nixos/modules/services/ttys/kmscon.nix b/nixos/modules/services/ttys/kmscon.nix
index 302e660a7bf..eb68a3d95d8 100644
--- a/nixos/modules/services/ttys/kmscon.nix
+++ b/nixos/modules/services/ttys/kmscon.nix
@@ -73,6 +73,6 @@ in {
       hwaccel
     '';
 
-    services.mesa.enable = mkIf cfg.hwRender true;
+    hardware.opengl.enable = mkIf cfg.hwRender true;
   };
 }
diff --git a/nixos/modules/services/x11/xserver.nix b/nixos/modules/services/x11/xserver.nix
index 5600ce7fac1..2677f758456 100644
--- a/nixos/modules/services/x11/xserver.nix
+++ b/nixos/modules/services/x11/xserver.nix
@@ -22,7 +22,7 @@ let
     virtualbox   = { modules = [ kernelPackages.virtualboxGuestAdditions ]; driverName = "vboxvideo"; };
   };
 
-  driverNames = config.services.mesa.videoDrivers;
+  driverNames = config.hardware.opengl.videoDrivers;
 
   drivers = flip map driverNames
     (name: { inherit name; driverName = name; } //
@@ -181,7 +181,7 @@ in
         description = ''
           The name of the video driver for your graphics card.  This
           option is obsolete; please set the
-          <option>services.mesa.videoDrivers</option> instead.
+          <option>hardware.opengl.videoDrivers</option> instead.
         '';
       };
 
@@ -381,8 +381,8 @@ in
   ###### implementation
 
   config = mkIf cfg.enable {
-    services.mesa.enable = true;
-    services.mesa.videoDrivers = mkIf (cfg.videoDriver != null) [ cfg.videoDriver ];
+    hardware.opengl.enable = true;
+    hardware.opengl.videoDrivers = mkIf (cfg.videoDriver != null) [ cfg.videoDriver ];
 
     assertions =
       [ { assertion = !(cfg.startOpenSSHAgent && cfg.startGnuPGAgent);
diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix
index 2483ee63d57..4f7f6ae8f2b 100644
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@@ -387,7 +387,7 @@ in
     # When building a regular system configuration, override whatever
     # video driver the host uses.
     services.xserver.videoDriver = mkVMOverride null;
-    services.mesa.videoDrivers = mkVMOverride [ "vesa" ];
+    hardware.opengl.videoDrivers = mkVMOverride [ "vesa" ];
     services.xserver.defaultDepth = mkVMOverride 0;
     services.xserver.resolutions = mkVMOverride [ { x = 1024; y = 768; } ];
     services.xserver.monitorSection =
diff --git a/nixos/modules/virtualisation/virtualbox-guest.nix b/nixos/modules/virtualisation/virtualbox-guest.nix
index 9dda455e5d3..e4c00fe4a41 100644
--- a/nixos/modules/virtualisation/virtualbox-guest.nix
+++ b/nixos/modules/virtualisation/virtualbox-guest.nix
@@ -52,7 +52,7 @@ optionalAttrs (pkgs.stdenv.isi686 || pkgs.stdenv.isx86_64) # ugly...
         serviceConfig.ExecStart = "@${kernel.virtualboxGuestAdditions}/sbin/VBoxService VBoxService --foreground";
       };
 
-    services.mesa.videoDrivers = mkOverride 50 [ "virtualbox" ];
+    hardware.opengl.videoDrivers = mkOverride 50 [ "virtualbox" ];
 
     services.xserver.config =
       ''

From ee14f8da9a04daa6c0412d983aa8daf37a539662 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Domen=20Ko=C5=BEar?= <domen@dev.si>
Date: Sat, 8 Feb 2014 21:09:48 +0100
Subject: [PATCH 33/59] remove references to isSystemUser and fix eval of
 tested job

---
 nixos/doc/manual/configuration.xml  | 1 -
 nixos/modules/profiles/demo.nix     | 2 +-
 nixos/tests/common/user-account.nix | 1 +
 3 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/doc/manual/configuration.xml b/nixos/doc/manual/configuration.xml
index e6d7dee251a..da08098ddda 100644
--- a/nixos/doc/manual/configuration.xml
+++ b/nixos/doc/manual/configuration.xml
@@ -1025,7 +1025,6 @@ users.extraUsers.alice =
     home = "/home/alice";
     description = "Alice Foobar";
     extraGroups = [ "wheel" ];
-    isSystemUser = false;
     useDefaultShell = true;
     openssh.authorizedKeys.keys = [ "ssh-dss AAAAB3Nza... alice@foobar" ];
   };
diff --git a/nixos/modules/profiles/demo.nix b/nixos/modules/profiles/demo.nix
index 396dcf6c5d3..605cc6aad1d 100644
--- a/nixos/modules/profiles/demo.nix
+++ b/nixos/modules/profiles/demo.nix
@@ -11,6 +11,6 @@
       createHome = true;
       useDefaultShell = true;
       password = "demo";
-      isSystemUser = false;
+      uid = 1000;
     };
 }
diff --git a/nixos/tests/common/user-account.nix b/nixos/tests/common/user-account.nix
index 8157cf8d263..0239a3c4d08 100644
--- a/nixos/tests/common/user-account.nix
+++ b/nixos/tests/common/user-account.nix
@@ -7,5 +7,6 @@
       createHome = true;
       useDefaultShell = true;
       password = "foobar";
+      uid = 1000;
     };
 }

From 84a7a09bc8c0bd1b53ea5f56ae6426e3a2e9bb21 Mon Sep 17 00:00:00 2001
From: Shea Levy <shea@shealevy.com>
Date: Sat, 8 Feb 2014 15:20:15 -0500
Subject: [PATCH 34/59] Try to improve naming of list elements in loaOf types

Signed-off-by: Shea Levy <shea@shealevy.com>
---
 lib/types.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/types.nix b/lib/types.nix
index bdd21f12395..afc8f80eb0e 100644
--- a/lib/types.nix
+++ b/lib/types.nix
@@ -132,7 +132,7 @@ rec {
             { inherit (def) file;
               value = listToAttrs (
                 imap (elemIdx: elem:
-                  { name = "unnamed-${toString defIdx}.${toString elemIdx}";
+                  { name = "${elem.name or "unnamed"}-${toString defIdx}.${toString elemIdx}";
                     value = elem;
                   }) def.value);
             }

From 028379be28695cf07ac31a73bcbc1439bfb944b9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Domen=20Ko=C5=BEar?= <domen@dev.si>
Date: Sat, 8 Feb 2014 21:47:28 +0100
Subject: [PATCH 35/59] nixos: add most basic gnome3 test and take a screenshot

---
 nixos/release-combined.nix |  1 +
 nixos/tests/default.nix    |  1 +
 nixos/tests/gnome3.nix     | 31 +++++++++++++++++++++++++++++++
 3 files changed, 33 insertions(+)
 create mode 100644 nixos/tests/gnome3.nix

diff --git a/nixos/release-combined.nix b/nixos/release-combined.nix
index dccc3acbf46..ed5c4769d0a 100644
--- a/nixos/release-combined.nix
+++ b/nixos/release-combined.nix
@@ -61,6 +61,7 @@ in rec {
         (all nixos.tests.printing)
         (all nixos.tests.proxy)
         (all nixos.tests.xfce)
+        (all nixos.tests.gnome3)
 
         nixpkgs.tarball
         (all nixpkgs.emacs)
diff --git a/nixos/tests/default.nix b/nixos/tests/default.nix
index 574e1dd2f8b..b37a0d5fa0c 100644
--- a/nixos/tests/default.nix
+++ b/nixos/tests/default.nix
@@ -12,6 +12,7 @@ with import ../lib/testing.nix { inherit system minimal; };
   firewall = makeTest (import ./firewall.nix);
   installer = makeTests (import ./installer.nix);
   efi-installer = makeTests (import ./efi-installer.nix);
+  gnome3 = makeTest (import ./gnome3.nix);
   ipv6 = makeTest (import ./ipv6.nix);
   kde4 = makeTest (import ./kde4.nix);
   #kexec = makeTest (import ./kexec.nix);
diff --git a/nixos/tests/gnome3.nix b/nixos/tests/gnome3.nix
new file mode 100644
index 00000000000..98a76137842
--- /dev/null
+++ b/nixos/tests/gnome3.nix
@@ -0,0 +1,31 @@
+{ pkgs, ... }:
+
+{
+
+  machine =
+    { config, pkgs, ... }:
+
+    { imports = [ ./common/user-account.nix ];
+
+      services.xserver.enable = true;
+
+      services.xserver.displayManager.auto.enable = true;
+      services.xserver.displayManager.auto.user = "alice";
+      services.xserver.desktopManager.gnome3.enable = true;
+    };
+
+  testScript =
+    ''
+      $machine->waitForX;
+      $machine->sleep(15);
+
+      # Check that logging in has given the user ownership of devices.
+      $machine->succeed("getfacl /dev/snd/timer | grep -q alice");
+
+      $machine->succeed("su - alice -c 'DISPLAY=:0.0 gnome-terminal &'");
+      $machine->waitForWindow(qr/Terminal/);
+      $machine->sleep(10);
+      $machine->screenshot("screen");
+    '';
+
+}

From 18a03d72852b9a95dd9a8090da2cfd3ad0ef390a Mon Sep 17 00:00:00 2001
From: Moritz Ulrich <moritz@tarn-vedra.de>
Date: Sat, 8 Feb 2014 21:48:50 +0100
Subject: [PATCH 36/59] Leiningen: Update to 2.3.4

---
 .../tools/build-managers/leiningen/builder.sh         |  2 +-
 .../tools/build-managers/leiningen/default.nix        | 11 ++++++-----
 2 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/tools/build-managers/leiningen/builder.sh b/pkgs/development/tools/build-managers/leiningen/builder.sh
index 6a66466506c..e1dd9d5a786 100644
--- a/pkgs/development/tools/build-managers/leiningen/builder.sh
+++ b/pkgs/development/tools/build-managers/leiningen/builder.sh
@@ -19,5 +19,5 @@ chmod -v 755 $out_bin
 patchShebangs $out
 
 wrapProgram $out_bin \
-    --prefix PATH ":" ${rlwrap}/bin \
+    --prefix PATH ":" "${rlwrap}/bin:${coreutils}/bin:${findutils}/bin" \
     --set LEIN_GPG ${gnupg}/bin/gpg
diff --git a/pkgs/development/tools/build-managers/leiningen/default.nix b/pkgs/development/tools/build-managers/leiningen/default.nix
index a41cf69ad23..2c039b3fa0c 100644
--- a/pkgs/development/tools/build-managers/leiningen/default.nix
+++ b/pkgs/development/tools/build-managers/leiningen/default.nix
@@ -1,23 +1,24 @@
-{ stdenv, fetchurl, makeWrapper, jdk, rlwrap, clojure, gnupg }:
+{ stdenv, fetchurl, makeWrapper
+, coreutils, findutils, jdk, rlwrap, clojure, gnupg }:
 
 stdenv.mkDerivation rec {
   pname = "leiningen";
-  version = "2.3.3";
+  version = "2.3.4";
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "https://raw.github.com/technomancy/leiningen/${version}/bin/lein-pkg";
-    sha256 = "0lc5ivgknkflk6k4a4q1r8bm3kq63p4cazfs1rdb02cfhdip52hc";
+    sha256 = "1v83hpvp349pgqqiy4babc5m5b9lcwk0fif80fpv4jqvp0a8v6r7";
   };
 
   jarsrc = fetchurl {
     url = "https://leiningen.s3.amazonaws.com/downloads/${pname}-${version}-standalone.jar";
-    sha256 = "1a8i0940ww7xqhwlaaavsgw8s9rjqdnv46hfsla41ns789bappxf";
+    sha256 = "1pqc99p4vz4q3qcs90cqql6m7kc27ihx4hbqs5alxkzk7jv8s2bk";
   };
 
   patches = ./lein_2.3.0.patch;
 
-  inherit rlwrap clojure gnupg;
+  inherit rlwrap clojure gnupg findutils coreutils;
 
   builder = ./builder.sh;
 

From b95b70c7a6a21f4ec2d4d2dd684b59404c950527 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Domen=20Ko=C5=BEar?= <domen@dev.si>
Date: Sat, 8 Feb 2014 23:05:36 +0100
Subject: [PATCH 37/59] firefox: whitespace change to trigger a rebuild

---
 pkgs/applications/networking/browsers/firefox/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/applications/networking/browsers/firefox/default.nix b/pkgs/applications/networking/browsers/firefox/default.nix
index 9869e24ce5a..3b2911a97ac 100644
--- a/pkgs/applications/networking/browsers/firefox/default.nix
+++ b/pkgs/applications/networking/browsers/firefox/default.nix
@@ -116,6 +116,7 @@ rec {
       for i in $out/lib/$libDir/{plugin-container,xulrunner,xulrunner-stub}; do
           wrapProgram $i --prefix LD_LIBRARY_PATH ':' "$out/lib/$libDir"
       done
+
       rm -f $out/bin/run-mozilla.sh
     ''; # */
 

From 3f30c971c8d65312cf0a1a18a8a804621eaae967 Mon Sep 17 00:00:00 2001
From: PkmX <pkmx.tw@gmail.com>
Date: Sun, 9 Feb 2014 04:16:43 +0800
Subject: [PATCH 38/59] Add haskell package 'taffybar'

---
 pkgs/applications/misc/taffybar/default.nix | 25 +++++++++++++++++++++
 pkgs/top-level/haskell-packages.nix         |  2 ++
 2 files changed, 27 insertions(+)
 create mode 100644 pkgs/applications/misc/taffybar/default.nix

diff --git a/pkgs/applications/misc/taffybar/default.nix b/pkgs/applications/misc/taffybar/default.nix
new file mode 100644
index 00000000000..a92e7e32f04
--- /dev/null
+++ b/pkgs/applications/misc/taffybar/default.nix
@@ -0,0 +1,25 @@
+{ cabal, cairo, dbus, dyre, filepath, gtk, gtkTraymanager
+, HStringTemplate, HTTP, mtl, network, parsec, split, stm, text
+, time, transformers, utf8String, X11, xdgBasedir, xmonad
+, xmonadContrib
+}:
+
+cabal.mkDerivation (self: {
+  pname = "taffybar";
+  version = "0.3.0";
+  sha256 = "02vpfbwfprca997ykk746ih7id0ls3i5pnb33gj3nrfgc59fkz7v";
+  isLibrary = true;
+  isExecutable = true;
+  buildDepends = [
+    cairo dbus dyre filepath gtk gtkTraymanager HStringTemplate HTTP
+    mtl network parsec split stm text time transformers utf8String X11
+    xdgBasedir xmonad xmonadContrib
+  ];
+  pkgconfigDepends = [ gtk ];
+  meta = {
+    homepage = "http://github.com/travitch/taffybar";
+    description = "A desktop bar similar to xmobar, but with more GUI";
+    license = self.stdenv.lib.licenses.bsd3;
+    platforms = self.ghc.meta.platforms;
+  };
+})
diff --git a/pkgs/top-level/haskell-packages.nix b/pkgs/top-level/haskell-packages.nix
index a599b48f065..1cf642539e9 100644
--- a/pkgs/top-level/haskell-packages.nix
+++ b/pkgs/top-level/haskell-packages.nix
@@ -2769,6 +2769,8 @@ let result = let callPackage = x : y : modifyPrio (newScope result.finalReturn x
     QuickCheck = self.QuickCheck2;
   };
 
+  taffybar = callPackage ../applications/misc/taffybar {};
+
   yi = callPackage ../applications/editors/yi/yi.nix {};
 
   yiContrib = callPackage ../applications/editors/yi/yi-contrib.nix {};

From 807d01debd4d81b028c1b62de72c3f6a934b5d49 Mon Sep 17 00:00:00 2001
From: PkmX <pkmx.tw@gmail.com>
Date: Sun, 9 Feb 2014 04:09:04 +0800
Subject: [PATCH 39/59] Add Haskell package 'gtk-traymanager'

---
 .../libraries/haskell/gtk-traymanager/default.nix | 15 +++++++++++++++
 pkgs/top-level/haskell-packages.nix               |  2 ++
 2 files changed, 17 insertions(+)
 create mode 100644 pkgs/development/libraries/haskell/gtk-traymanager/default.nix

diff --git a/pkgs/development/libraries/haskell/gtk-traymanager/default.nix b/pkgs/development/libraries/haskell/gtk-traymanager/default.nix
new file mode 100644
index 00000000000..8d319ee246e
--- /dev/null
+++ b/pkgs/development/libraries/haskell/gtk-traymanager/default.nix
@@ -0,0 +1,15 @@
+{ cabal, glib, gtk, X11 }:
+
+cabal.mkDerivation (self: {
+  pname = "gtk-traymanager";
+  version = "0.1.3";
+  sha256 = "07671f3j3r07djgvrlpbdaqqnm2yc7sc5f5isjn5nczrwh8n0sj4";
+  buildDepends = [ glib gtk ];
+  pkgconfigDepends = [ gtk X11 ];
+  meta = {
+    homepage = "http://github.com/travitch/gtk-traymanager";
+    description = "A wrapper around the eggtraymanager library for Linux system trays";
+    license = self.stdenv.lib.licenses.lgpl21;
+    platforms = self.ghc.meta.platforms;
+  };
+})
diff --git a/pkgs/top-level/haskell-packages.nix b/pkgs/top-level/haskell-packages.nix
index 1cf642539e9..7bf78003777 100644
--- a/pkgs/top-level/haskell-packages.nix
+++ b/pkgs/top-level/haskell-packages.nix
@@ -1216,6 +1216,8 @@ let result = let callPackage = x : y : modifyPrio (newScope result.finalReturn x
     libc = pkgs.stdenv.gcc.libc;
   };
 
+  gtkTraymanager = callPackage ../development/libraries/haskell/gtk-traymanager {};
+
   graphviz = callPackage ../development/libraries/haskell/graphviz {};
 
   groups = callPackage ../development/libraries/haskell/groups {};

From 5b41db9765e33465988900cbb5f1aafe51bf548a Mon Sep 17 00:00:00 2001
From: Linquize <linquize@yahoo.com.hk>
Date: Sun, 9 Feb 2014 11:47:30 +0800
Subject: [PATCH 40/59] git: update to 1.8.5.4 (close #1714)

---
 .../version-management/git-and-tools/git/default.nix          | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/version-management/git-and-tools/git/default.nix b/pkgs/applications/version-management/git-and-tools/git/default.nix
index dad607c1462..d9d09def5ca 100644
--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@@ -10,7 +10,7 @@
 
 let
 
-  version = "1.8.5.2";
+  version = "1.8.5.4";
 
   svn = subversionClient.override { perlBindings = true; };
 
@@ -21,7 +21,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "http://git-core.googlecode.com/files/git-${version}.tar.gz";
-    sha256 = "12iyj6f89dmb1cn2pvym5lrf23g4m71mp9pwkbi1zscb9d998ih2";
+    sha256 = "062z4j4hfhfdlvkxs2mzarsyvbqvfy4kv8j5h4c75ymb5yp8iklk";
   };
 
   patches = [ ./docbook2texi.patch ./symlinks-in-bin.patch ];

From c3df9e21c0116eddaeff0f446d9ae005321afa44 Mon Sep 17 00:00:00 2001
From: Moritz Ulrich <moritz@tarn-vedra.de>
Date: Sun, 9 Feb 2014 12:42:26 +0100
Subject: [PATCH 41/59] Weechat: Update to 0.4.3

---
 pkgs/applications/networking/irc/weechat/default.nix | 4 ++--
 pkgs/top-level/all-packages.nix                      | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/applications/networking/irc/weechat/default.nix b/pkgs/applications/networking/irc/weechat/default.nix
index 01ba8c97d98..89b437acc90 100644
--- a/pkgs/applications/networking/irc/weechat/default.nix
+++ b/pkgs/applications/networking/irc/weechat/default.nix
@@ -3,12 +3,12 @@
 , pythonPackages, cacert, cmake, makeWrapper }:
 
 stdenv.mkDerivation rec {
-  version = "0.4.2";
+  version = "0.4.3";
   name = "weechat-${version}";
 
   src = fetchurl {
     url = "http://weechat.org/files/src/${name}.tar.gz";
-    sha256 = "03ypji34kb5yrxqyn8dbrjm3j00pc8v7wfsip7d3l63nyx79df9v";
+    sha256 = "1sfx2j8xy6das0zis2nmzi9z41q96gzq61xaw4i0xbgag17s7ddz";
   };
 
   buildInputs = 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index a51d1d33f56..2302c5bb700 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -9044,8 +9044,8 @@ let
   };
 
   weechat = callPackage ../applications/networking/irc/weechat {
-    # weechat crashes on /exit when using gnutls 3.1.x. gnutls 3.2.x works.
-    gnutls = gnutls32;
+    # weechat doesn't exit with gnutls32. Use 3.1 for now.
+    gnutls = gnutls31;
   };
 
   weston = callPackage ../applications/window-managers/weston { };

From de6222577a547d233cf8f000d60130a323db2b63 Mon Sep 17 00:00:00 2001
From: Oliver Charles <ollie@ocharles.org.uk>
Date: Sun, 9 Feb 2014 12:26:16 +0000
Subject: [PATCH 42/59] haskellPackages.jsonAssertions: New expression

---
 .../libraries/haskell/json-assertions/default.nix | 15 +++++++++++++++
 pkgs/top-level/haskell-packages.nix               |  5 +++++
 2 files changed, 20 insertions(+)
 create mode 100644 pkgs/development/libraries/haskell/json-assertions/default.nix

diff --git a/pkgs/development/libraries/haskell/json-assertions/default.nix b/pkgs/development/libraries/haskell/json-assertions/default.nix
new file mode 100644
index 00000000000..8797ca90029
--- /dev/null
+++ b/pkgs/development/libraries/haskell/json-assertions/default.nix
@@ -0,0 +1,15 @@
+{ cabal, aeson, indexed, indexedFree, lens, text }:
+
+cabal.mkDerivation (self: {
+  pname = "json-assertions";
+  version = "1.0.1";
+  sha256 = "0rpj300knyk602wqkqipmy54xv3pn20cd06sa8irkf2wz0xribzm";
+  buildDepends = [ aeson indexed indexedFree lens text ];
+  meta = {
+    homepage = "http://github.com/ocharles/json-assertions.git";
+    description = "Test that your (Aeson) JSON encoding matches your expectations";
+    license = self.stdenv.lib.licenses.bsd3;
+    platforms = self.ghc.meta.platforms;
+    maintainers = [ self.stdenv.lib.maintainers.ocharles ];
+  };
+})
diff --git a/pkgs/top-level/haskell-packages.nix b/pkgs/top-level/haskell-packages.nix
index a599b48f065..89de24234d1 100644
--- a/pkgs/top-level/haskell-packages.nix
+++ b/pkgs/top-level/haskell-packages.nix
@@ -1508,6 +1508,11 @@ let result = let callPackage = x : y : modifyPrio (newScope result.finalReturn x
 
   json = callPackage ../development/libraries/haskell/json {};
 
+  jsonAssertions = callPackage ../development/libraries/haskell/json-assertions {
+    aeson = self.aeson_0_7_0_0;
+    lens = self.lens_4_0_1;
+  };
+
   jsonTypes = callPackage ../development/libraries/haskell/jsonTypes {};
 
   kansasLava = callPackage ../development/libraries/haskell/kansas-lava {};

From cf5513f2409ae0cd46a69f3dcc65e880305c8ed5 Mon Sep 17 00:00:00 2001
From: Oliver Charles <ollie@ocharles.org.uk>
Date: Sun, 9 Feb 2014 12:12:31 +0000
Subject: [PATCH 43/59] haskellPackages.diff3: New expression

---
 .../libraries/haskell/diff3/default.nix       | 19 +++++++++++++++++++
 pkgs/top-level/haskell-packages.nix           |  2 ++
 2 files changed, 21 insertions(+)
 create mode 100644 pkgs/development/libraries/haskell/diff3/default.nix

diff --git a/pkgs/development/libraries/haskell/diff3/default.nix b/pkgs/development/libraries/haskell/diff3/default.nix
new file mode 100644
index 00000000000..60f27e89d58
--- /dev/null
+++ b/pkgs/development/libraries/haskell/diff3/default.nix
@@ -0,0 +1,19 @@
+{ cabal, Diff, QuickCheck, testFramework, testFrameworkQuickcheck2
+}:
+
+cabal.mkDerivation (self: {
+  pname = "diff3";
+  version = "0.2.0.3";
+  sha256 = "0zdfn1jhsq8pd23qpkhzr8wgiwbazfbq688bjnpc406i7gq88k78";
+  buildDepends = [ Diff ];
+  testDepends = [
+    QuickCheck testFramework testFrameworkQuickcheck2
+  ];
+  meta = {
+    homepage = "http://github.com/ocharles/diff3.git";
+    description = "Perform a 3-way difference of documents";
+    license = self.stdenv.lib.licenses.bsd3;
+    platforms = self.ghc.meta.platforms;
+    maintainers = [ self.stdenv.lib.maintainers.ocharles ];
+  };
+})
diff --git a/pkgs/top-level/haskell-packages.nix b/pkgs/top-level/haskell-packages.nix
index a599b48f065..0d457bbbb51 100644
--- a/pkgs/top-level/haskell-packages.nix
+++ b/pkgs/top-level/haskell-packages.nix
@@ -944,6 +944,8 @@ let result = let callPackage = x : y : modifyPrio (newScope result.finalReturn x
 
   Diff = callPackage ../development/libraries/haskell/Diff {};
 
+  diff3 = callPackage ../development/libraries/haskell/diff3 {};
+
   digest = callPackage ../development/libraries/haskell/digest {
     inherit (pkgs) zlib;
   };

From cba2444d11ca4d2a8a335a752568c5fe09a90390 Mon Sep 17 00:00:00 2001
From: "Ricardo M. Correia" <rcorreia@wizy.org>
Date: Tue, 21 Jan 2014 17:25:49 +0100
Subject: [PATCH 44/59] nixos/memtest: Allow user to specify memtest86 boot
 parameters

---
 .../installer/cd-dvd/installation-cd-base.nix |  2 +-
 .../system/boot/loader/grub/memtest.nix       | 41 +++++++++++++++----
 2 files changed, 33 insertions(+), 10 deletions(-)

diff --git a/nixos/modules/installer/cd-dvd/installation-cd-base.nix b/nixos/modules/installer/cd-dvd/installation-cd-base.nix
index 2a28131c28c..07c054b391a 100644
--- a/nixos/modules/installer/cd-dvd/installation-cd-base.nix
+++ b/nixos/modules/installer/cd-dvd/installation-cd-base.nix
@@ -36,7 +36,7 @@ with pkgs.lib;
   isoImage.makeEfiBootable = true;
 
   # Add Memtest86+ to the CD.
-  boot.loader.grub.memtest86 = true;
+  boot.loader.grub.memtest86.enable = true;
 
   # Get a console as soon as the initrd loads fbcon on EFI boot
   boot.initrd.kernelModules = [ "fbcon" ];
diff --git a/nixos/modules/system/boot/loader/grub/memtest.nix b/nixos/modules/system/boot/loader/grub/memtest.nix
index 80c1a160cfd..3745b405712 100644
--- a/nixos/modules/system/boot/loader/grub/memtest.nix
+++ b/nixos/modules/system/boot/loader/grub/memtest.nix
@@ -6,28 +6,51 @@ with pkgs.lib;
 
 let
   memtest86 = pkgs.memtest86plus;
+  cfg = config.boot.loader.grub.memtest86;
+  params = concatStringsSep " " cfg.params;
 in
 
 {
   options = {
 
-    boot.loader.grub.memtest86 = mkOption {
-      default = false;
-      type = types.bool;
-      description = ''
-        Make Memtest86+, a memory testing program, available from the
-        GRUB boot menu.
-      '';
+    boot.loader.grub.memtest86 = {
+
+      enable = mkOption {
+        default = false;
+        type = types.bool;
+        description = ''
+          Make Memtest86+, a memory testing program, available from the
+          GRUB boot menu.
+        '';
+      };
+
+      params = mkOption {
+        default = [];
+        example = [ "console=ttyS0,115200" ];
+        type = types.listOf types.str;
+        description = ''
+          Parameters added to the Memtest86+ command line. As of memtest86+ 5.01
+          the following list of (apparently undocumented) parameters are
+          accepted:
+            console=... -- set up a serial console.
+            btrace      -- enable boot trace.
+            maxcpus=... -- limit number of CPUs.
+            onepass     -- run one pass and exit if there are no errors.
+            tstlist=... -- list of tests to run.
+            cpumask=... -- set a CPU mask, to select CPUs to use for testing.
+        '';
+      };
+
     };
   };
 
-  config = mkIf config.boot.loader.grub.memtest86 {
+  config = mkIf cfg.enable {
 
     boot.loader.grub.extraEntries =
       if config.boot.loader.grub.version == 2 then
         ''
           menuentry "Memtest86+" {
-            linux16 @bootRoot@/memtest.bin
+            linux16 @bootRoot@/memtest.bin ${params}
           }
         ''
       else

From 48851fa749d634d68eaaa0dcd6c4041615b6c0f0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B8rn=20Forsman?= <bjorn.forsman@gmail.com>
Date: Sun, 9 Feb 2014 13:43:12 +0100
Subject: [PATCH 45/59] nixos/memtest: use docbook formatting

Without this the HTML manual and manpage is quite unreadable (newlines
are squashed so it doesn't look like a list anymore).

(Unfortunately, this makes the source unreadable.)
---
 .../system/boot/loader/grub/memtest.nix       | 44 ++++++++++++++++---
 1 file changed, 38 insertions(+), 6 deletions(-)

diff --git a/nixos/modules/system/boot/loader/grub/memtest.nix b/nixos/modules/system/boot/loader/grub/memtest.nix
index 3745b405712..2461d1f80c7 100644
--- a/nixos/modules/system/boot/loader/grub/memtest.nix
+++ b/nixos/modules/system/boot/loader/grub/memtest.nix
@@ -32,12 +32,44 @@ in
           Parameters added to the Memtest86+ command line. As of memtest86+ 5.01
           the following list of (apparently undocumented) parameters are
           accepted:
-            console=... -- set up a serial console.
-            btrace      -- enable boot trace.
-            maxcpus=... -- limit number of CPUs.
-            onepass     -- run one pass and exit if there are no errors.
-            tstlist=... -- list of tests to run.
-            cpumask=... -- set a CPU mask, to select CPUs to use for testing.
+
+          <itemizedlist>
+
+          <listitem>
+            <para><literal>console=...</literal>, set up a serial console.
+            Examples:
+            <literal>console=ttyS0</literal>,
+            <literal>console=ttyS0,9600</literal> or
+            <literal>console=ttyS0,115200n8</literal>.</para>
+          </listitem>
+
+          <listitem>
+            <para><literal>btrace</literal>, enable boot trace.</para>
+          </listitem>
+
+          <listitem>
+            <para><literal>maxcpus=N</literal>, limit number of CPUs.</para>
+          </listitem>
+
+          <listitem>
+            <para><literal>onepass</literal>, run one pass and exit if there
+            are no errors.</para>
+          </listitem>
+
+          <listitem>
+            <para><literal>tstlist=...</literal>, list of tests to run.
+            Example: <literal>0,1,2</literal>.</para>
+          </listitem>
+
+          <listitem>
+            <para><literal>cpumask=...</literal>, set a CPU mask, to select CPUs
+            to use for testing.</para>
+          </listitem>
+
+          </itemizedlist>
+
+          This list of command line options was obtained by reading the
+          Memtest86+ source code.
         '';
       };
 

From fe38031168620d0bc30c0b79f464f3c04c99f9d1 Mon Sep 17 00:00:00 2001
From: Tomasz Kontusz <tomasz.kontusz@gmail.com>
Date: Sat, 8 Feb 2014 19:47:51 +0100
Subject: [PATCH 46/59] Upgrade bumblebee and add nixos module

 * Bump bumblebee to 3.2.1
 * Remove config.patch - options it added can be passed to ./configure now
 * Remove the provided xorg.conf
   Provided xorg.conf was causing problems for some users,
   and Bumblebee provides its own default configuration anyway.
 * Make secondary X11 log to /var/log/X.bumblebee.log
 * Add a module for bumblebee
---
 nixos/modules/hardware/video/bumblebee.nix | 41 +++++++++++++++
 nixos/modules/module-list.nix              |  1 +
 pkgs/tools/X11/bumblebee/config.patch      | 30 -----------
 pkgs/tools/X11/bumblebee/default.nix       | 59 +++++-----------------
 pkgs/tools/X11/bumblebee/xopts.patch       |  2 +-
 pkgs/tools/X11/bumblebee/xorg.conf.nvidia  | 49 ------------------
 6 files changed, 57 insertions(+), 125 deletions(-)
 create mode 100644 nixos/modules/hardware/video/bumblebee.nix
 delete mode 100644 pkgs/tools/X11/bumblebee/config.patch
 delete mode 100644 pkgs/tools/X11/bumblebee/xorg.conf.nvidia

diff --git a/nixos/modules/hardware/video/bumblebee.nix b/nixos/modules/hardware/video/bumblebee.nix
new file mode 100644
index 00000000000..504da2cde85
--- /dev/null
+++ b/nixos/modules/hardware/video/bumblebee.nix
@@ -0,0 +1,41 @@
+{ config, pkgs, ... }:
+
+let kernel = config.boot.kernelPackages; in
+with pkgs.lib;
+
+{
+
+  options = {
+    hardware.bumblebee.enable = mkOption {
+      default = false;
+      type = types.bool;
+      description = ''
+        Enable the bumblebee daemon to manage Optimus hybrid video cards.
+        This should power off secondary GPU until its use is requested
+        by running an application with optirun.
+
+        Only nvidia driver is supported so far.
+      '';
+    };
+  };
+
+  config = mkIf config.hardware.bumblebee.enable {
+    boot.blacklistedKernelModules = [ "nouveau" "nvidia" ];
+    boot.kernelModules = [ "bbswitch" ];
+    boot.extraModulePackages = [ kernel.bbswitch kernel.nvidia_x11 ];
+
+    environment.systemPackages = [ pkgs.bumblebee ];
+
+    systemd.services.bumblebeed = {
+      description = "Bumblebee Hybrid Graphics Switcher";
+      wantedBy = [ "display-manager.service" ];
+      script = "bumblebeed --use-syslog";
+      path = [ kernel.bbswitch pkgs.bumblebee ];
+      serviceConfig = {
+        Restart = "always";
+        RestartSec = 60;
+        CPUSchedulingPolicy = "idle";
+      };
+    };
+  };
+}
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 5d52f71c9ff..c66cccb3975 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -31,6 +31,7 @@
   ./hardware/network/rtl8192c.nix
   ./hardware/opengl.nix
   ./hardware/pcmcia.nix
+  ./hardware/video/bumblebee.nix
   ./installer/tools/nixos-checkout.nix
   ./installer/tools/tools.nix
   ./misc/assertions.nix
diff --git a/pkgs/tools/X11/bumblebee/config.patch b/pkgs/tools/X11/bumblebee/config.patch
deleted file mode 100644
index 61b671f80c1..00000000000
--- a/pkgs/tools/X11/bumblebee/config.patch
+++ /dev/null
@@ -1,30 +0,0 @@
---- bumblebee-3.0/src/driver.c.orig	2012-02-03 14:51:10.282464426 +0100
-+++ bumblebee-3.0/src/driver.c	2012-02-04 22:26:02.715498536 +0100
-@@ -23,6 +23,7 @@
- #include "module.h"
- #include "bblogger.h"
- #include "driver.h"
-+#include <stdlib.h>
- 
- /**
-  * Check what drivers are available and autodetect if possible. Driver, module
-@@ -30,6 +31,7 @@
-  */
- void driver_detect(void) {
-   /* determine driver to be used */
-+  set_string_value(&bb_config.driver, getenv("BUMBLEBEE_DRIVER"));
-   if (*bb_config.driver) {
-     bb_log(LOG_DEBUG, "Skipping auto-detection, using configured driver"
-             " '%s'\n", bb_config.driver);
-@@ -65,8 +67,8 @@
-     }
-   }
- 
--  if (strcmp(bb_config.driver, "nvidia")) {
--    set_string_value(&bb_config.ld_path, CONF_LDPATH_NVIDIA);
--    set_string_value(&bb_config.mod_path, CONF_MODPATH_NVIDIA);
-+  if (!strcmp(bb_config.driver, "nvidia")) {
-+    set_string_value(&bb_config.ld_path, getenv("BUMBLEBEE_LDPATH_NVIDIA"));
-+    set_string_value(&bb_config.mod_path, getenv("BUMBLEBEE_MODPATH_NVIDIA"));
-   }
- }
diff --git a/pkgs/tools/X11/bumblebee/default.nix b/pkgs/tools/X11/bumblebee/default.nix
index 74e3e7b1f82..58db0c13abb 100644
--- a/pkgs/tools/X11/bumblebee/default.nix
+++ b/pkgs/tools/X11/bumblebee/default.nix
@@ -8,19 +8,7 @@
 
 # To test: make sure that the 'bbswitch' kernel module is installed,
 # then run 'bumblebeed' as root and 'optirun glxgears' as user.
-# To use at startup, add e.g. to configuration.nix:
-# jobs = {
-#   bumblebeed = {
-#     name = "bumblebeed";
-#     description = "Manages the Optimus video card";
-#     startOn = "started udev and started syslogd";
-#     stopOn = "starting shutdown";
-#     exec = "bumblebeed --use-syslog";
-#     path = [ pkgs.bumblebee ];
-#     environment = { MODULE_DIR = "${config.system.modulesTree}/lib/modules"; };
-#     respawn = true;
-#   };
-# };
+# To use at startup, see hardware.bumblebee options.
 
 # This nix expression supports for now only the native nvidia driver.
 # It should not be hard to generalize this approach to support the
@@ -34,7 +22,7 @@
 }:
 
 let
-  version = "3.0";
+  version = "3.2.1";
   name = "bumblebee-${version}";
 
   # isolated X11 environment with the nvidia module
@@ -61,22 +49,15 @@ let
     ignoreCollisions = true;
   };
 
-  # Custom X11 configuration for the additional xserver instance.
-  xorgConf = ./xorg.conf.nvidia;
-
 in stdenv.mkDerivation {
   inherit name;
 
   src = fetchurl {
-    url = "http://github.com/downloads/Bumblebee-Project/Bumblebee/${name}.tar.gz";
-    sha256 = "a27ddb77b282ac8b972857fdb0dc5061cf0a0982b7ac3e1cfa698b4f786e49a1";
+    url = "http://bumblebee-project.org/${name}.tar.gz";
+    sha256 = "03p3gvx99lwlavznrpg9l7jnl1yfg2adcj8jcjj0gxp20wxp060h";
   };
 
-  # 'config.patch' makes bumblebee read the active module and the nvidia configuration
-  # from the environment variables instead of the config file:
-  #   BUMBLEBEE_DRIVER, BUMBLEBEE_LDPATH_NVIDIA, BUMBLEBEE_MODPATH_NVIDIA
-  # These variables must be set when bumblebeed and optirun are executed.
-  patches = [ ./config.patch ./xopts.patch ];
+  patches = [ ./xopts.patch ];
 
   preConfigure = ''
     # Substitute the path to the actual modinfo program in module.c.
@@ -88,32 +69,25 @@ in stdenv.mkDerivation {
     # Don't use a special group, just reuse wheel.
     substituteInPlace configure \
       --replace 'CONF_GID="bumblebee"' 'CONF_GID="wheel"'
-
-    # Ensures that the config file ends up with a nonempty
-    # name of the nvidia module. This is needed, because the
-    # configuration handling code otherwise resets the
-    # data that we obtained from the environment (see config.patch)
-    export CONF_DRIVER_MODULE_NVIDIA=nvidia
   '';
 
   # Build-time dependencies of bumblebeed and optirun.
   # Note that it has several runtime dependencies.
   buildInputs = [ stdenv makeWrapper pkgconfig help2man libX11 glib libbsd ];
 
+  configureFlags = [
+    "--with-udev-rules=$out/lib/udev/rules.d"
+    "CONF_DRIVER=nvidia"
+    "CONF_DRIVER_MODULE_NVIDIA=nvidia"
+    "CONF_LDPATH_NVIDIA=${commonEnv}/lib"
+    "CONF_MODPATH_NVIDIA=${commonEnv}/lib/xorg/modules"
+  ];
+
   # create a wrapper environment for bumblebeed and optirun
   postInstall = ''
-    # remove some entries from the configuration file that would otherwise
-    # cause our environment variables to be ignored.
-    substituteInPlace "$out/etc/bumblebee/bumblebee.conf" \
-      --replace "LibraryPath=" "" \
-      --replace "XorgModulePath=" ""
-
     wrapProgram "$out/sbin/bumblebeed" \
       --prefix PATH : "${commonEnv}/sbin:${commonEnv}/bin:\$PATH" \
       --prefix LD_LIBRARY_PATH : "${commonEnv}/lib:\$LD_LIBRARY_PATH" \
-      --set BUMBLEBEE_DRIVER "nvidia" \
-      --set BUMBLEBEE_LDPATH_NVIDIA "${commonEnv}/lib" \
-      --set BUMBLEBEE_MODPATH_NVIDIA "${commonEnv}/lib/xorg/modules" \
       --set FONTCONFIG_FILE "/etc/fonts/fonts.conf" \
       --set XKB_BINDIR "${xorg.xkbcomp}/bin" \
       --set XKB_DIR "${xkeyboard_config}/etc/X11/xkb"
@@ -121,16 +95,11 @@ in stdenv.mkDerivation {
     wrapProgram "$out/bin/optirun" \
       --prefix PATH : "${commonEnv}/sbin:${commonEnv}/bin" \
       --prefix LD_LIBRARY_PATH : "${commonEnv}/lib" \
-      --set BUMBLEBEE_DRIVER "nvidia" \
-      --set BUMBLEBEE_LDPATH_NVIDIA "${commonEnv}/lib" \
-      --set BUMBLEBEE_MODPATH_NVIDIA "${commonEnv}/lib/xorg/modules"
-
-    cp ${xorgConf} "$out/etc/bumblebee/xorg.conf.nvidia"
   '';
 
   meta = {
     homepage = http://github.com/Bumblebee-Project/Bumblebee;
     description = "Daemon for managing Optimus videocards (power-on/off, spawns xservers)";
-    license = "free";
+    license = stdenv.lib.licenses.gpl3;
   };
 }
diff --git a/pkgs/tools/X11/bumblebee/xopts.patch b/pkgs/tools/X11/bumblebee/xopts.patch
index 9e44a8e9fd1..f24b2a20562 100644
--- a/pkgs/tools/X11/bumblebee/xopts.patch
+++ b/pkgs/tools/X11/bumblebee/xopts.patch
@@ -5,7 +5,7 @@
        "-nolisten", "tcp",
        "-noreset",
 +      "-xkbdir", getenv("XKB_DIR"),
-+      "-logfile", "/dev/null",
++      "-logfile", "/var/log/X.bumblebee.log",
        "-verbose", "3",
        "-isolateDevice", pci_id,
        "-modulepath",
diff --git a/pkgs/tools/X11/bumblebee/xorg.conf.nvidia b/pkgs/tools/X11/bumblebee/xorg.conf.nvidia
deleted file mode 100644
index 31c417d6971..00000000000
--- a/pkgs/tools/X11/bumblebee/xorg.conf.nvidia
+++ /dev/null
@@ -1,49 +0,0 @@
-Section "DRI"
-    Mode 0666
-EndSection
-
-Section "ServerLayout"
-    Identifier "Layout0"
-    Screen "Screen1"
-    Option "AutoAddDevices" "false"
-EndSection
-
-Section "Module"
-    Load "dbe"
-    Load "extmod"
-    Load "glx"
-    Load "record"
-    Load "freetype"
-    Load "type1"
-EndSection
-
-Section "Files"
-EndSection
-
-Section "Device"
-    Identifier "Device1"
-    Driver "nvidia"
-    VendorName "NVIDIA Corporation"
-    Option "NoLogo" "true"
-    Option "UseEDID" "false"
-    Option "ConnectedMonitor" "CRT-0"
-EndSection
-
-Section "Screen"
-    Identifier "Screen1"
-    Device "Device1"
-    Monitor "Monitor0"
-    DefaultDepth 24
-    SubSection "Display"
-        Depth 24
-    EndSubSection
-EndSection
-
-Section "Extensions"
-    Option "Composite" "Enable"
-EndSection
-
-Section "Monitor"
-    Identifier "Monitor0"
-    Option "DPMS"
-EndSection

From 52e99bc723cd7b481d3f66612e518fd88a3c54df Mon Sep 17 00:00:00 2001
From: Artyom Shalkhakov <artyom.shalkhakov@gmail.com>
Date: Sun, 9 Feb 2014 16:26:46 +0100
Subject: [PATCH 47/59] Bumping ATS/Postiats version to 0.0.5.

---
 pkgs/development/compilers/ats2/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/ats2/default.nix b/pkgs/development/compilers/ats2/default.nix
index 0f46b7aeb6d..ae9a202a529 100644
--- a/pkgs/development/compilers/ats2/default.nix
+++ b/pkgs/development/compilers/ats2/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, gmp }:
 
-let version = "0.0.3"; in stdenv.mkDerivation {
+let version = "0.0.5"; in stdenv.mkDerivation {
   name = "ats2-postiats-${version}";
 
   src = fetchurl {
     url = "mirror://sourceforge/ats2-lang/ATS2-Postiats-${version}.tgz";
-    sha256 = "0hq63zrmm92j5ffnsmylhhllm8kgjpjkaj4xvzz1zlshz39lijxp";
+    sha256 = "1rzcqc7fwqf0y4cc14lr282r25s66jygf6cxrnf5l8p5p550l0dl";
   };
 
   buildInputs = [ gmp ];

From 258c7536be8f74242f29b012dd1f1094cdd36fb7 Mon Sep 17 00:00:00 2001
From: Shea Levy <shea@shealevy.com>
Date: Sun, 9 Feb 2014 11:59:02 -0500
Subject: [PATCH 48/59] Force a rebuild

---
 nixos/tests/installer.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/tests/installer.nix b/nixos/tests/installer.nix
index 564792a1a9d..b32012ea034 100644
--- a/nixos/tests/installer.nix
+++ b/nixos/tests/installer.nix
@@ -252,9 +252,9 @@ in {
         ''
           $machine->succeed(
               "parted /dev/vda mklabel msdos",
-              "parted /dev/vda -- mkpart primary 1M 2048M", # first PV
+              "parted /dev/vda -- mkpart primary 1M 2048M", # PV1
               "parted /dev/vda -- set 1 lvm on",
-              "parted /dev/vda -- mkpart primary 2048M -1s", # second PV
+              "parted /dev/vda -- mkpart primary 2048M -1s", # PV2
               "parted /dev/vda -- set 2 lvm on",
               "udevadm settle",
               "pvcreate /dev/vda1 /dev/vda2",

From 0f79534aa72807c86c96604e875a50ab2f997401 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Domen=20Ko=C5=BEar?= <domen@dev.si>
Date: Sun, 9 Feb 2014 23:52:59 +0100
Subject: [PATCH 49/59] spring: use wrapper to set gcc lib path

---
 pkgs/games/spring/default.nix | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/pkgs/games/spring/default.nix b/pkgs/games/spring/default.nix
index b073aa3488b..9de55a24312 100644
--- a/pkgs/games/spring/default.nix
+++ b/pkgs/games/spring/default.nix
@@ -1,6 +1,6 @@
-{ stdenv, fetchurl, cmake, lzma, boost, libdevil, zlib, p7zip, glibc
+{ stdenv, fetchurl, cmake, lzma, boost, libdevil, zlib, p7zip
 , openal, libvorbis, glew, freetype, xlibs, SDL, mesa, binutils
-, asciidoc, libxslt, docbook_xsl, docbook_xsl_ns, curl
+, asciidoc, libxslt, docbook_xsl, docbook_xsl_ns, curl, makeWrapper
 , jdk ? null, python ? null
 , withAI ? true # support for AI Interfaces and Skirmish AIs
 }:
@@ -17,10 +17,10 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = ["-DCMAKE_BUILD_WITH_INSTALL_RPATH:BOOL=ON"
                 "-DCMAKE_INSTALL_RPATH_USE_LINK_PATH:BOOL=ON"
-                "-DPREFER_STATIC_LIBS=OFF"];
+                "-DPREFER_STATIC_LIBS:BOOL=OFF"];
 
-  buildInputs = [ cmake lzma boost libdevil zlib p7zip openal libvorbis freetype SDL glibc
-    xlibs.libX11 xlibs.libXcursor mesa glew asciidoc libxslt docbook_xsl curl
+  buildInputs = [ cmake lzma boost libdevil zlib p7zip openal libvorbis freetype SDL stdenv.glibc 
+    xlibs.libX11 xlibs.libXcursor mesa glew asciidoc libxslt docbook_xsl curl makeWrapper
     docbook_xsl_ns ]
     ++ stdenv.lib.optional withAI jdk
     ++ stdenv.lib.optional withAI python;
@@ -28,6 +28,11 @@ stdenv.mkDerivation rec {
   # reported upstream http://springrts.com/mantis/view.php?id=4305
   #enableParallelBuilding = true; # occasionally missing generated files on Hydra
 
+  postInstall = ''
+    wrapProgram "$out/bin/spring" \
+      --prefix LD_LIBRARY_PATH : "${stdenv.gcc.gcc}/lib64:${stdenv.gcc.gcc}/lib"
+  '';
+
   meta = with stdenv.lib; {
     homepage = http://springrts.com/;
     description = "A powerful real-time strategy (RTS) game engine";

From 8e9f61995ebd6b272dd338d671bb5db2cc26b751 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Domen=20Ko=C5=BEar?= <domen@dev.si>
Date: Mon, 10 Feb 2014 09:41:30 +0100
Subject: [PATCH 50/59] spring: don't pass glibc

---
 pkgs/games/spring/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/games/spring/default.nix b/pkgs/games/spring/default.nix
index 9de55a24312..f9d380d9cd5 100644
--- a/pkgs/games/spring/default.nix
+++ b/pkgs/games/spring/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
                 "-DCMAKE_INSTALL_RPATH_USE_LINK_PATH:BOOL=ON"
                 "-DPREFER_STATIC_LIBS:BOOL=OFF"];
 
-  buildInputs = [ cmake lzma boost libdevil zlib p7zip openal libvorbis freetype SDL stdenv.glibc 
+  buildInputs = [ cmake lzma boost libdevil zlib p7zip openal libvorbis freetype SDL 
     xlibs.libX11 xlibs.libXcursor mesa glew asciidoc libxslt docbook_xsl curl makeWrapper
     docbook_xsl_ns ]
     ++ stdenv.lib.optional withAI jdk

From e5124e7a0ea5514b9fa4334cd4fa474331f6e300 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Domen=20Ko=C5=BEar?= <domen@dev.si>
Date: Mon, 10 Feb 2014 14:18:58 +0100
Subject: [PATCH 51/59] springlobby: specify spring run-time dependency paths

---
 pkgs/games/spring/springlobby.nix | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/pkgs/games/spring/springlobby.nix b/pkgs/games/spring/springlobby.nix
index f522eef8eb9..34760db7c68 100644
--- a/pkgs/games/spring/springlobby.nix
+++ b/pkgs/games/spring/springlobby.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, cmake, wxGTK, openal, pkgconfig, curl, libtorrentRasterbar, libpng, libX11
-, gettext, bash, gawk, boost, libnotify, gtk, doxygen }:
+, gettext, bash, gawk, boost, libnotify, gtk, doxygen, spring, makeWrapper }:
 stdenv.mkDerivation rec {
 
   name = "springlobby-${version}";
@@ -12,9 +12,11 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     cmake wxGTK openal pkgconfig curl gettext libtorrentRasterbar boost libpng libX11
-    libnotify gtk doxygen
+    libnotify gtk doxygen makeWrapper
   ];
 
+  patches = [ ./unitsync_path_find.patch ];
+
   prePatch = ''
     substituteInPlace tools/regen_config_header.sh --replace "#!/usr/bin/env bash" "#!${bash}/bin/bash"
     substituteInPlace tools/test-susynclib.awk --replace "#!/usr/bin/awk" "#!${gawk}/bin/awk"
@@ -26,13 +28,17 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  #buildPhase = "make VERBOSE=1";
+  postInstall = ''
+    wrapProgram $out/bin/springlobby \
+      --prefix PATH : "${spring}/bin" \
+      --set SPRING_LIB_DIRS "${spring}/lib"
+  '';
 
   meta = with stdenv.lib; {
     homepage = http://springlobby.info/;
     description = "Cross-platform lobby client for the Spring RTS project";
     license = licenses.gpl2;
-    maintainers = [ maintainers.phreedom maintainers.qknight];
+    maintainers = [ maintainers.phreedom maintainers.qknight maintainers.iElectric ];
     platforms = platforms.linux;
   };
 }

From e5017d8239f39308c897eadf1d7de8371f5ea55b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Domen=20Ko=C5=BEar?= <domen@dev.si>
Date: Mon, 10 Feb 2014 14:21:42 +0100
Subject: [PATCH 52/59] springlobby: add unitsync patch

---
 pkgs/games/spring/unitsync_path_find.patch | 10 ++++++++++
 1 file changed, 10 insertions(+)
 create mode 100644 pkgs/games/spring/unitsync_path_find.patch

diff --git a/pkgs/games/spring/unitsync_path_find.patch b/pkgs/games/spring/unitsync_path_find.patch
new file mode 100644
index 00000000000..66257a5f52f
--- /dev/null
+++ b/pkgs/games/spring/unitsync_path_find.patch
@@ -0,0 +1,10 @@
+--- a/src/settings.cpp	2013-12-02 10:09:19.000000000 +0000
++++ b/src/settings.cpp-new	2014-02-10 11:39:48.265628767 +0000
+@@ -498,6 +498,7 @@
+ 
+ wxString Settings::AutoFindUnitSync(wxPathList pl) const
+ {
++	pl.AddEnvList( _T( "SPRING_LIB_DIRS" ) );
+ 	wxString retpath = pl.FindValidPath( _T( "unitsync" ) + GetLibExtension() );
+ 	if ( retpath.IsEmpty() )
+ 		retpath = pl.FindValidPath( _T( "libunitsync" ) + GetLibExtension() );

From 42df6fcee920248a1a39b42f914705e32791bd0e Mon Sep 17 00:00:00 2001
From: Shea Levy <shea@shealevy.com>
Date: Mon, 10 Feb 2014 08:56:16 -0500
Subject: [PATCH 53/59] mediawiki: Run update script after initializing the
 database

---
 nixos/modules/services/web-servers/apache-httpd/mediawiki.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/modules/services/web-servers/apache-httpd/mediawiki.nix b/nixos/modules/services/web-servers/apache-httpd/mediawiki.nix
index 423087991e1..a310884525a 100644
--- a/nixos/modules/services/web-servers/apache-httpd/mediawiki.nix
+++ b/nixos/modules/services/web-servers/apache-httpd/mediawiki.nix
@@ -290,6 +290,7 @@ in
             echo COMMIT
           ) | ${pkgs.postgresql}/bin/psql -U "${config.dbUser}" "${config.dbName}"
       fi
+      ${php}/bin/php ${mediawikiRoot}/maintenance/update.php
     '');
 
   robotsEntries = optionalString (config.articleUrlPrefix != "")

From 6a8cc9ab11765d101023076f022e8682d40ad7f0 Mon Sep 17 00:00:00 2001
From: Shea Levy <shea@shealevy.com>
Date: Mon, 10 Feb 2014 09:14:30 -0500
Subject: [PATCH 54/59] mediawiki: Fix some references to /bin/bash

---
 nixos/modules/services/web-servers/apache-httpd/mediawiki.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/nixos/modules/services/web-servers/apache-httpd/mediawiki.nix b/nixos/modules/services/web-servers/apache-httpd/mediawiki.nix
index a310884525a..af2e2cae797 100644
--- a/nixos/modules/services/web-servers/apache-httpd/mediawiki.nix
+++ b/nixos/modules/services/web-servers/apache-httpd/mediawiki.nix
@@ -93,6 +93,10 @@ let
         ensureDir $out
         cp -r * $out
         cp ${mediawikiConfig} $out/LocalSettings.php
+        sed -i 's|/bin/bash|${pkgs.stdenv.shell}|' \
+          $out/maintenance/fuzz-tester.php \
+          $out/bin/ulimit.sh \
+          $out/includes/GlobalFunctions.php
       '';
   };
 

From 3dc6168b317fb3923f2ae073575a8582d01d3ba9 Mon Sep 17 00:00:00 2001
From: Thomas Tuegel <ttuegel@gmail.com>
Date: Mon, 10 Feb 2014 08:15:24 -0600
Subject: [PATCH 55/59] Properly escape passwords sent to chpasswd

The mutableUsers feature uses `chpasswd` to set users passwords.
Passwords and their hashes were being piped into the program using
double quotes ("") to escape. This causes any `$` characters to be
expanded as shell variables. This is a serious problem because all the
password hash methods besides DES use multiple `$` in the hashes. Single
quotes ('') should be used instead to prevent shell variable expansion.
---
 nixos/modules/config/users-groups.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/config/users-groups.nix b/nixos/modules/config/users-groups.nix
index f70e8c292c4..09e7fc53c76 100644
--- a/nixos/modules/config/users-groups.nix
+++ b/nixos/modules/config/users-groups.nix
@@ -411,13 +411,13 @@ in
           if [ "$setpw" == "yes" ]; then
             ${if !(isNull u.hashedPassword)
               then ''
-                echo "${u.name}:${u.hashedPassword}" | \
+                echo '${u.name}:${u.hashedPassword}' | \
                   ${pkgs.shadow}/sbin/chpasswd -e''
               else if u.password == ""
               then "passwd -d '${u.name}' &>/dev/null"
               else if !(isNull u.password)
               then ''
-                echo "${u.name}:${u.password}" | ${pkgs.shadow}/sbin/chpasswd''
+                echo '${u.name}:${u.password}' | ${pkgs.shadow}/sbin/chpasswd''
               else if !(isNull u.passwordFile)
               then ''
                 echo -n "${u.name}:" | cat - "${u.passwordFile}" | \

From 80cc2697b147c63300e4dd09f2790dee78220d5f Mon Sep 17 00:00:00 2001
From: Shea Levy <shea@shealevy.com>
Date: Mon, 10 Feb 2014 10:12:34 -0500
Subject: [PATCH 56/59] user-groups: Sidestep all password escaping issues

Now passwords are written to a file first
---
 nixos/modules/config/users-groups.nix | 19 ++++++++-----------
 1 file changed, 8 insertions(+), 11 deletions(-)

diff --git a/nixos/modules/config/users-groups.nix b/nixos/modules/config/users-groups.nix
index 09e7fc53c76..a0fd99732bd 100644
--- a/nixos/modules/config/users-groups.nix
+++ b/nixos/modules/config/users-groups.nix
@@ -403,24 +403,21 @@ in
       let
         mkhomeUsers = filterAttrs (n: u: u.createHome) cfg.extraUsers;
         setpwUsers = filterAttrs (n: u: u.createUser) cfg.extraUsers;
+        pwFile = u: if !(isNull u.hashedPassword)
+          then pkgs.writeTextFile { name = "password-file"; text = u.hashedPassword; }
+          else if !(isNull u.password)
+          then pkgs.runCommand "password-file" { pw = u.password; } ''
+            echo -n "$pw" | ${pkgs.mkpasswd}/bin/mkpasswd -s > $out
+          '' else u.passwordFile;
         setpw = n: u: ''
           setpw=yes
           ${optionalString cfg.mutableUsers ''
             test "$(getent shadow '${u.name}' | cut -d: -f2)" != "x" && setpw=no
           ''}
           if [ "$setpw" == "yes" ]; then
-            ${if !(isNull u.hashedPassword)
+            ${if !(isNull (pwFile u))
               then ''
-                echo '${u.name}:${u.hashedPassword}' | \
-                  ${pkgs.shadow}/sbin/chpasswd -e''
-              else if u.password == ""
-              then "passwd -d '${u.name}' &>/dev/null"
-              else if !(isNull u.password)
-              then ''
-                echo '${u.name}:${u.password}' | ${pkgs.shadow}/sbin/chpasswd''
-              else if !(isNull u.passwordFile)
-              then ''
-                echo -n "${u.name}:" | cat - "${u.passwordFile}" | \
+                echo -n "${u.name}:" | cat - "${pwFile u}" | \
                   ${pkgs.shadow}/sbin/chpasswd -e
               ''
               else "passwd -l '${u.name}' &>/dev/null"

From 00b1461e4fdf968948491930aed4ec79a79b1100 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cillian=20de=20R=C3=B3iste?= <goibhniu@fsfe.org>
Date: Mon, 10 Feb 2014 16:41:09 +0100
Subject: [PATCH 57/59] ATI-driver: the hash has changed, reported by:
 @ikervagyok

---
 pkgs/os-specific/linux/ati-drivers/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/ati-drivers/default.nix b/pkgs/os-specific/linux/ati-drivers/default.nix
index 518ca784d4a..0aa67dba237 100644
--- a/pkgs/os-specific/linux/ati-drivers/default.nix
+++ b/pkgs/os-specific/linux/ati-drivers/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = http://www2.ati.com/drivers/linux/amd-catalyst-13.12-linux-x86.x86_64.zip;
-    sha256 = "1jm0c4rqyjjhyj8a7axf4hz16bcvy8yhnkn45wc2l73xhks36h02";
+    sha256 = "1c3fn328340by4qn99dgfj8c2q34fxdb2alcak0vnyc6bw7l5sms";
     curlOpts = "--referer http://support.amd.com/en-us/download/desktop?os=Linux%20x86_64";
   };
 

From e9a894a97ddee892fe85a87851424a202198508d Mon Sep 17 00:00:00 2001
From: Rob Vermaas <rob.vermaas@gmail.com>
Date: Mon, 10 Feb 2014 17:34:35 +0100
Subject: [PATCH 58/59] Revert "Update hipchat"

This reverts commit 54288f5cfe4e48779d7c08abefa8cbb23d58e58a.
---
 .../instant-messengers/hipchat/default.nix    | 47 +++++++++----------
 pkgs/top-level/all-packages.nix               |  2 +-
 2 files changed, 22 insertions(+), 27 deletions(-)

diff --git a/pkgs/applications/networking/instant-messengers/hipchat/default.nix b/pkgs/applications/networking/instant-messengers/hipchat/default.nix
index c7ea2d135d5..c0f76602b2b 100644
--- a/pkgs/applications/networking/instant-messengers/hipchat/default.nix
+++ b/pkgs/applications/networking/instant-messengers/hipchat/default.nix
@@ -1,12 +1,21 @@
-{ stdenv, fetchurl, libtool, libXext, libSM, libICE, libX11, libXft, libXau, libXdmcp, libXrender
-, libxcb, libXfixes, libXcomposite, libXi, dbus, freetype, fontconfig, openssl, zlib, mesa
-, libxslt, libxml2
+{ stdenv
+, fetchurl
+, libtool
+, libXext
+, libSM
+, libICE
+, libX11
+, libXft
+, libXau
+, libXdmcp
+, libXrender
+, freetype
+, fontconfig
+, openssl
 }:
 
-assert stdenv.system == "i686-linux" || stdenv.system == "x86_64-linux"; 
-
 let
-  version = "2.1.982";
+  version = "1.94.407";
 
   rpath = stdenv.lib.makeSearchPath "lib" [
     stdenv.glibc
@@ -20,29 +29,15 @@ let
     libXau
     libXdmcp
     libXrender
-    libxcb
-    libXfixes
-    libXcomposite
-    libXi
-    dbus
     freetype
     fontconfig
     openssl
-    zlib
-    mesa
-    libxslt
-    libxml2
   ];
 
-  src = 
-    if stdenv.system == "i686-linux" then fetchurl {
-      url = "http://downloads.hipchat.com/linux/arch/i686/hipchat-${version}-i686.pkg.tar.xz";
-      sha256 = "1i60fkl5hdx2p2yfsx9w8qkzn6hl8fajvfls0r0gc2bqc9whg6vn";
-    } else fetchurl {
-      url = "http://downloads.hipchat.com/linux/arch/x86_64/hipchat-${version}-x86_64.pkg.tar.xz";
-      sha256 = "12bn4la9z1grkbcnixjwhadgxa2g6qkd5x7r3l3vn1sdalgal4ks";
-    };
-
+  src = fetchurl {
+    url = "http://downloads.hipchat.com/linux/arch/hipchat-${version}-i686.pkg.tar.xz";
+    sha256 = "0kyjpa2ir066zqkvs1zmnx6kvl8v4jfl8h7bw110cgigwmiplk7k";
+  };
 in stdenv.mkDerivation {
   name = "hipchat-${version}";
 
@@ -54,8 +49,8 @@ in stdenv.mkDerivation {
     mv usr/share $out
     patchShebangs $out/bin
     for file in $(find $out/lib -type f); do
-        patchelf --set-interpreter $(cat $NIX_GCC/nix-support/dynamic-linker) $file || true
-        patchelf --set-rpath ${rpath}:${stdenv.lib.optionalString stdenv.is64bit "${stdenv.gcc.gcc}/lib64:"}$out/lib $file || true
+        patchelf --set-interpreter ${stdenv.glibc}/lib/ld-linux.so.2 $file || true
+        patchelf --set-rpath ${rpath}:$out/lib $file || true
     done
     substituteInPlace $out/share/applications/hipchat.desktop \
       --replace /opt/HipChat/bin $out/bin
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2302c5bb700..8d657ed4435 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -8120,7 +8120,7 @@ let
 
   hexedit = callPackage ../applications/editors/hexedit { };
 
-  hipchat = callPackage ../applications/networking/instant-messengers/hipchat { };
+  hipchat = callPackage_i686 ../applications/networking/instant-messengers/hipchat { };
 
   homebank = callPackage ../applications/office/homebank { };
 

From 3269027235e562ecb73264b708af48a79149b891 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <vcunat@gmail.com>
Date: Mon, 10 Feb 2014 18:40:18 +0100
Subject: [PATCH 59/59] thunderbird: simple esr bump (Nov 2013), incl. CVE

I failed to make -26 build, so this will get security fixes at least.
---
 .../networking/mailreaders/thunderbird/default.nix            | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/mailreaders/thunderbird/default.nix b/pkgs/applications/networking/mailreaders/thunderbird/default.nix
index 08758c55a4e..3a8dab10ff2 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird/default.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/default.nix
@@ -12,14 +12,14 @@
   enableOfficialBranding ? false
 }:
 
-let version = "17.0.8"; in
+let version = "17.0.11esr"; in
 
 stdenv.mkDerivation {
   name = "thunderbird-${version}";
 
   src = fetchurl {
     url = "ftp://ftp.mozilla.org/pub/thunderbird/releases/${version}/source/thunderbird-${version}.source.tar.bz2";
-    sha1 = "4bcbb33f0b3ea050e805723680b5669d80438812";
+    sha256 = "1m2lph8x82kgxqzlyaxr1l1x7s4qnqfzfnqck4b777914mrv1mdp";
   };
 
   #enableParallelBuilding = true;