Merge branch 'staging'

nixos/doc/manual/release-notes/rl-1709.xml

···
       rest of the system on a stable release.
     </para>
   </listitem>
+  <listitem>
+    <para>
+      Updated to FreeType 2.7.1, including a new TrueType engine.
+      The new engine replaces the Infinality engine which was the default in
+      NixOS. The default font rendering settings are now provided by
+      fontconfig-penultimate, replacing fontconfig-ultimate; the new defaults
+      are less invasive and provide rendering that is more consistent with
+      other systems and hopefully with each font designer's intent. Some
+      system-wide configuration has been removed from the Fontconfig NixOS
+      module where user Fontconfig settings are available.
+    </para>
+  </listitem>
 
 </itemizedlist>
 

nixos/modules/config/fonts/fontconfig-penultimate.nix

···
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+  cfg = config.fonts.fontconfig.penultimate;
+
+  latestVersion  = pkgs.fontconfig.configVersion;
+
+  # The configuration to be included in /etc/font/
+  confPkg = pkgs.runCommand "font-penultimate-conf" {} ''
+    support_folder=$out/etc/fonts/conf.d
+    latest_folder=$out/etc/fonts/${latestVersion}/conf.d
+
+    mkdir -p $support_folder
+    mkdir -p $latest_folder
+
+    # fontconfig ultimate various configuration files
+    ln -s ${pkgs.fontconfig-penultimate}/etc/fonts/conf.d/*.conf \
+          $support_folder
+    ln -s ${pkgs.fontconfig-penultimate}/etc/fonts/conf.d/*.conf \
+          $latest_folder
+  '';
+
+in
+{
+
+  options = {
+
+    fonts = {
+
+      fontconfig = {
+
+        penultimate = {
+          enable = mkOption {
+            type = types.bool;
+            default = true;
+            description = ''
+              Enable fontconfig-penultimate settings to supplement the
+              NixOS defaults by providing per-font rendering defaults and
+              metric aliases.
+            '';
+          };
+        };
+
+      };
+    };
+
+  };
+
+  config = mkIf (config.fonts.fontconfig.enable && cfg.enable) {
+
+    fonts.fontconfig.confPackages = [ confPkg ];
+
+  };
+
+}

nixos/modules/config/fonts/fontconfig-ultimate.nix

···
         ultimate = {
           enable = mkOption {
             type = types.bool;
-            default = true;
+            default = false;
             description = ''
               Enable fontconfig-ultimate settings (formerly known as
               Infinality). Besides the customizable settings in this NixOS
···
               <literal>none</literal> disables the substitutions.
             '';
           };
-
-          preset = mkOption {
-            type = types.enum ["ultimate1" "ultimate2" "ultimate3" "ultimate4" "ultimate5" "osx" "windowsxp"];
-            default = "ultimate3";
-            description = ''
-              FreeType rendering settings preset. Any of the presets may be
-              customized by setting environment variables.
-            '';
-          };
         };
       };
     };
···
   config = mkIf (config.fonts.fontconfig.enable && cfg.enable) {
 
     fonts.fontconfig.confPackages = [ confPkg ];
-    environment.variables."INFINALITY_FT" = cfg.preset;
 
   };
 

nixos/modules/config/fonts/fontconfig.nix

···
       <fontconfig>
 
         <!-- Default rendering settings -->
-        <match target="font">
-          <edit mode="assign" name="hinting">
+        <match target="pattern">
+          <edit mode="append" name="hinting">
             ${fcBool cfg.hinting.enable}
           </edit>
-          <edit mode="assign" name="autohint">
+          <edit mode="append" name="autohint">
             ${fcBool cfg.hinting.autohint}
           </edit>
-          <edit mode="assign" name="hintstyle">
-            <const>hint${cfg.hinting.style}</const>
+          <edit mode="append" name="hintstyle">
+            <const>hintslight</const>
           </edit>
-          <edit mode="assign" name="antialias">
+          <edit mode="append" name="antialias">
             ${fcBool cfg.antialias}
           </edit>
-          <edit mode="assign" name="rgba">
+          <edit mode="append" name="rgba">
             <const>${cfg.subpixel.rgba}</const>
           </edit>
-          <edit mode="assign" name="lcdfilter">
+          <edit mode="append" name="lcdfilter">
             <const>lcd${cfg.subpixel.lcdfilter}</const>
           </edit>
         </match>
···
         antialias = mkOption {
           type = types.bool;
           default = true;
-          description = "Enable font antialiasing.";
+          description = ''
+            Enable font antialiasing. At high resolution (> 200 DPI),
+            antialiasing has no visible effect; users of such displays may want
+            to disable this option.
+          '';
         };
 
         dpi = mkOption {
···
           type = types.lines;
           default = "";
           description = ''
-            System-wide customization file contents, has higher priority than 
+            System-wide customization file contents, has higher priority than
             <literal>defaultFonts</literal> settings.
           '';
         };
···
           enable = mkOption {
             type = types.bool;
             default = true;
-            description = "Enable TrueType hinting.";
+            description = ''
+              Enable font hinting. Hinting aligns glyphs to pixel boundaries to
+              improve rendering sharpness at low resolution. At high resolution
+              (> 200 dpi) hinting will do nothing (at best); users of such
+              displays may want to disable this option.
+            '';
           };
 
           autohint = mkOption {
···
               correctly-hinted fonts.
             '';
           };
-
-          style = mkOption {
-            type = types.enum ["none" "slight" "medium" "full"];
-            default = "full";
-            description = ''
-              TrueType hinting style, one of <literal>none</literal>,
-              <literal>slight</literal>, <literal>medium</literal>, or
-              <literal>full</literal>.
-            '';
-          };
         };
 
         includeUserConf = mkOption {
···
             default = "rgb";
             type = types.enum ["rgb" "bgr" "vrgb" "vbgr" "none"];
             description = ''
-              Subpixel order.
+              Subpixel order. The overwhelming majority of displays are
+              <literal>rgb</literal> in their normal orientation. Select
+              <literal>vrgb</literal> for mounting such a display 90 degrees
+              clockwise from its normal orientation or <literal>vbgr</literal>
+              for mounting 90 degrees counter-clockwise. Select
+              <literal>bgr</literal> in the unlikely event of mounting 180
+              degrees from the normal orientation. Reverse these directions in
+              the improbable event that the display's native subpixel order is
+              <literal>bgr</literal>.
             '';
           };
 
···
             default = "default";
             type = types.enum ["none" "default" "light" "legacy"];
             description = ''
-              FreeType LCD filter.
+              FreeType LCD filter. At high resolution (> 200 DPI), LCD filtering
+              has no visible effect; users of such displays may want to select
+              <literal>none</literal>.
             '';
           };
 

nixos/modules/module-list.nix

···
 [
   ./config/debug-info.nix
   ./config/fonts/corefonts.nix
+  ./config/fonts/fontconfig.nix
+  ./config/fonts/fontconfig-penultimate.nix
   ./config/fonts/fontconfig-ultimate.nix
-  ./config/fonts/fontconfig.nix
   ./config/fonts/fontdir.nix
   ./config/fonts/fonts.nix
   ./config/fonts/ghostscript.nix

nixos/modules/rename.nix

···
     # Unity3D
     (mkRenamedOptionModule [ "programs" "unity3d" "enable" ] [ "security" "chromiumSuidSandbox" "enable" ])
 
-    # fontconfig-ultimate
-    (mkRenamedOptionModule [ "fonts" "fontconfig" "ultimate" "rendering" ] [ "fonts" "fontconfig" "ultimate" "preset" ])
-
     # murmur
     (mkRenamedOptionModule [ "services" "murmur" "welcome" ] [ "services" "murmur" "welcometext" ])
 
···
       "See the 16.09 release notes for more information.")
     (mkRemovedOptionModule [ "services" "phpfpm" "phpIni" ] "")
     (mkRemovedOptionModule [ "services" "dovecot2" "package" ] "")
+    (mkRemovedOptionModule [ "fonts" "fontconfig" "hinting" "style" ] "")
     (mkRemovedOptionModule [ "services" "xserver" "displayManager" "sddm" "themes" ]
       "Set the option `services.xserver.displayManager.sddm.package' instead.")
   ];

nixos/modules/services/x11/display-managers/default.nix

···
     Xft.lcdfilter: lcd${fontconfig.subpixel.lcdfilter}
     Xft.hinting: ${if fontconfig.hinting.enable then "1" else "0"}
     Xft.autohint: ${if fontconfig.hinting.autohint then "1" else "0"}
-    Xft.hintstyle: hint${fontconfig.hinting.style}
+    Xft.hintstyle: hintslight
   '';
 
   # file provided by services.xserver.displayManager.session.script

pkgs/applications/version-management/git-and-tools/git/default.nix

···
     ./symlinks-in-bin.patch
     ./git-sh-i18n.patch
     ./ssh-path.patch
-    ./ssl-cert-file.patch
   ];
 
   postPatch = ''

pkgs/applications/version-management/git-and-tools/git/ssl-cert-file.patch

···
-diff -ru git-2.7.4-orig/http.c git-2.7.4/http.c
---- git-2.7.4-orig/http.c	2016-03-17 21:47:59.000000000 +0100
-+++ git-2.7.4/http.c	2016-04-12 11:38:33.187070848 +0200
-@@ -544,6 +544,7 @@
- #if LIBCURL_VERSION_NUM >= 0x070908
- 	set_from_env(&ssl_capath, "GIT_SSL_CAPATH");
- #endif
-+	set_from_env(&ssl_cainfo, "SSL_CERT_FILE");
- 	set_from_env(&ssl_cainfo, "GIT_SSL_CAINFO");
- 
- 	set_from_env(&user_agent, "GIT_HTTP_USER_AGENT");

pkgs/applications/version-management/mercurial/default.nix

···
   version = "3.9.2";
   name = "mercurial-${version}";
   inherit (python2Packages) docutils hg-git dulwich python;
-in python2Packages.mkPythonDerivation {
+in python2Packages.buildPythonApplication {
   inherit name;
+  format = "other";
 
   src = fetchurl {
     url = "https://mercurial-scm.org/release/${name}.tar.gz";

pkgs/data/fonts/fontconfig-penultimate/default.nix

···
+{ stdenv, fetchFromGitHub }:
+
+let version = "0.2.1"; in
+stdenv.mkDerivation {
+  name = "fontconfig-penultimate-${version}";
+
+  src = fetchFromGitHub {
+    owner = "ttuegel";
+    repo = "fontconfig-penultimate";
+    rev = version;
+    sha256 = "14arpalmpn7ig2myxslk4jdg6lm0cnmwsxy7zl0j7yr417k1kprf";
+  };
+
+  installPhase = ''
+    mkdir -p $out/etc/fonts/conf.d
+    cp *.conf $out/etc/fonts/conf.d
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/ttuegel/fontconfig-penultimate;
+    description = "Sensible defaults for Fontconfig";
+    license = licenses.asl20;
+    maintainers = [ maintainers.ttuegel ];
+    platforms = platforms.all;
+  };
+}

pkgs/development/compilers/llvm/3.7/libc++abi.nix

···
-{ stdenv, cmake, fetch, libcxx, libunwind, llvm, version }:
+{ stdenv, cmake, fetch, fetchpatch, libcxx, libunwind, llvm, version }:
 
-stdenv.mkDerivation {
+let
+  # Newer LLVMs (3.8 onwards) have changed how some basic C++ stuff works, which breaks builds of this older version
+  llvm38-and-above = fetchpatch {
+    url    = "https://trac.macports.org/raw-attachment/ticket/50304/0005-string-Fix-exception-declaration.patch";
+    sha256 = "1lm38n7s0l5dbl7kp4i49pvzxz1mcvlr2vgsnj47agnwhhm63jvr";
+  };
+in stdenv.mkDerivation {
   name = "libc++abi-${version}";
 
   src = fetch "libcxxabi" "0ambfcmr2nh88hx000xb7yjm9lsqjjz49w5mlf6dlxzmj3nslzx4";
···
   '' + stdenv.lib.optionalString stdenv.isDarwin ''
     export TRIPLE=x86_64-apple-darwin
   '';
+
+  # I can't use patches directly because this is actually a patch for libc++'s source, which we manually extract
+  # into the libc++abi build environment above.
+  prePatch = ''(
+    cd ../libcxx-*
+    patch -p1 < ${llvm38-and-above}
+  )'';
 
   installPhase = if stdenv.isDarwin
     then ''

pkgs/development/compilers/llvm/3.9/clang/default.nix

···
       sed -i -e 's/DriverArgs.hasArg(options::OPT_nostdlibinc)/true/' lib/Driver/ToolChains.cpp
     '';
 
+    outputs = [ "out" "python" ];
+
     # Clang expects to find LLVMgold in its own prefix
     # Clang expects to find sanitizer libraries in its own prefix
     postInstall = ''
       ln -sv ${llvm}/lib/LLVMgold.so $out/lib
       ln -sv ${llvm}/lib/clang/${version}/lib $out/lib/clang/${version}/
       ln -sv $out/bin/clang $out/bin/cpp
+
+      mkdir -p $python/bin $python/share/clang/
+      mv $out/bin/{git-clang-format,scan-view} $python/bin
+      if [ -e $out/bin/set-xcode-analyzer ]; then
+        mv $out/bin/set-xcode-analyzer $python/bin
+      fi
+      mv $out/share/clang/*.py $python/share/clang
+
+      rm $out/bin/c-index-test
     '';
 
     enableParallelBuilding = true;

pkgs/development/compilers/llvm/3.9/llvm.nix

···
   outputs = [ "out" ] ++ stdenv.lib.optional enableSharedLibraries "lib";
 
   buildInputs = [ perl groff cmake libxml2 python libffi ]
-    ++ stdenv.lib.optionals stdenv.isDarwin
-         [ libcxxabi darwin.cctools darwin.apple_sdk.libs.xpc ];
+    ++ stdenv.lib.optionals stdenv.isDarwin [ libcxxabi ];
 
   propagatedBuildInputs = [ ncurses zlib ];
 
···
       sha256 = "11sq86spw41v72f676igksapdlsgh7fiqp5qkkmgfj0ndqcn9skf";
     }}
   ''
-  # hacky fix: New LLVM releases require a newer OS X SDK than
-  # 10.9. This is a temporary measure until nixpkgs darwin support is
-  # updated.
+  # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks
+  # to get it, but they're unfree. Since LLVM is rather central to the stdenv, we patch out TSAN support so that Hydra
+  # can build this. If we didn't do it, basically the entire nixpkgs on Darwin would have an unfree dependency and we'd
+  # get no binary cache for the entire platform. If you really find yourself wanting the TSAN, make this controllable by
+  # a flag and turn the flag off during the stdenv build. I realize that this LLVM isn't used in the stdenv but I want to
+  # keep it consistent with 4.0. We really shouldn't be copying and pasting all this code around...
   + stdenv.lib.optionalString stdenv.isDarwin ''
-        sed -i 's/os_trace(\(.*\)");$/printf(\1\\n");/g' ./projects/compiler-rt/lib/sanitizer_common/sanitizer_mac.cc
+    substituteInPlace ./projects/compiler-rt/cmake/config-ix.cmake \
+      --replace 'set(COMPILER_RT_HAS_TSAN TRUE)' 'set(COMPILER_RT_HAS_TSAN FALSE)'
   ''
   # Patch llvm-config to return correct library path based on --link-{shared,static}.
   + stdenv.lib.optionalString (enableSharedLibraries) ''
···
     ++ stdenv.lib.optionals (isDarwin) [
     "-DLLVM_ENABLE_LIBCXX=ON"
     "-DCAN_TARGET_i386=false"
-    "-DCMAKE_LIBTOOL=${darwin.cctools}/bin/libtool"
   ];
 
   postBuild = ''

pkgs/development/libraries/cairo/default.nix

···
     sha1 = "c6f7b99986f93c9df78653c3e6a3b5043f65145e";
   };
 
-  infinality = fetchFromGitHub {
-    owner = "bohoomil";
-    repo = "fontconfig-ultimate";
-    rev = "730f5e77580677e86522c1f2119aa78803741759";
-    sha256 = "1hbrdpm6xcczs2c2iid7by8h7dsd0jcf7an88s150njyqnjzxjg7";
-  };
-
   patches = [
     # from https://bugs.freedesktop.org/show_bug.cgi?id=98165
     (fetchpatch {
···
       sha256 = "03sfyaclzlglip4pvfjb4zj4dmm8mlphhxl30mb6giinkc74bfri";
     })
   ];
-
-  prePatch = ''
-    patches="$patches $(echo $infinality/*_cairo-iu/*.patch)"
-  '';
 
   outputs = [ "out" "dev" "devdoc" ];
   outputBin = "dev"; # very small

pkgs/development/libraries/fontconfig/2.10.nix

···
     sha256 = "0llraqw86jmw4vzv7inskp3xxm2gc64my08iwq5mzncgfdbfza4f";
   };
 
-  infinality_patch =
-    let subvers = "1";
-      in fetchurl {
-        url = http://www.infinality.net/fedora/linux/zips/fontconfig-infinality-1-20130104_1.tar.bz2;
-        sha256 = "1fm5xx0mx2243jrq5rxk4v0ajw2nawpj23399h710bx6hd1rviq7";
-      }
-    ;
+  patches = [
+    # FreeType 2.7 prefixes PCF font family names with the foundry name.
+    # The output of fc-list and fc-query change which breaks the tests.
+    ./test-pcf-family-names-freetype-2.7.patch
+  ];
 
   outputs = [ "bin" "dev" "lib" "out" ]; # $out contains all the config
 
···
 
   # Don't try to write to /var/cache/fontconfig at install time.
   installFlags = "sysconfdir=$(out)/etc fc_cachedir=$(TMPDIR)/dummy RUN_FC_CACHE_TEST=false";
-
-  postInstall = ''
-    cd "$out/etc/fonts" && tar xvf ${infinality_patch}
-  '';
 
   passthru = {
     # Empty for backward compatibility, there was no versioning before 2.11

pkgs/development/libraries/fontconfig/default.nix

···
       url = "https://cgit.freedesktop.org/fontconfig/patch/?id=1ab5258f7c";
       sha256 = "0x2a4qx51j3gqcp1kp4lisdzmhrkw1zw0r851d82ksgjlc0vkbaz";
     })
+
+    # FreeType 2.7 prefixes PCF font family names with the foundry name.
+    # The output of fc-list and fc-query change which breaks the tests.
+    ./test-pcf-family-names-freetype-2.7.patch
   ];
   # additionally required for the glibc-2.25 patch; avoid requiring gperf
   postPatch = ''

pkgs/development/libraries/fontconfig/test-pcf-family-names-freetype-2.7.patch

···
+diff -Nuar fontconfig-2.10.2-orig/test/out.expected fontconfig-2.10.2/test/out.expected
+--- fontconfig-2.10.2-orig/test/out.expected	2017-03-06 06:45:50.876053093 -0600
++++ fontconfig-2.10.2/test/out.expected	2017-03-06 06:48:18.012514337 -0600
+@@ -1,8 +1,8 @@
+-Fixed:pixelsize=16
+-Fixed:pixelsize=6
++Misc Fixed:pixelsize=6
++Sony Fixed:pixelsize=16
+ =
+-Fixed:pixelsize=16
+-Fixed:pixelsize=6
++Misc Fixed:pixelsize=6
++Sony Fixed:pixelsize=16
+ =
+-Fixed:pixelsize=16
+-Fixed:pixelsize=6
++Misc Fixed:pixelsize=6
++Sony Fixed:pixelsize=16

pkgs/development/libraries/freetype/default.nix

···
-{ stdenv, fetchurl, fetchFromGitHub, pkgconfig, which, zlib, bzip2, libpng, gnumake
-, glib /* passthru only */
+{
+  stdenv, lib, fetchurl, copyPathsToStore,
+  pkgconfig, which,
+  zlib, bzip2, libpng, gnumake, glib,
 
-  # FreeType supports sub-pixel rendering.  This is patented by
-  # Microsoft, so it is disabled by default.  This option allows it to
-  # be enabled.  See http://www.freetype.org/patents.html.
-, useEncumberedCode ? true
-, useInfinality ? true
+  # FreeType supports LCD filtering (colloquially referred to as sub-pixel rendering).
+  # LCD filtering is also known as ClearType and covered by several Microsoft patents.
+  # This option allows it to be disabled. See http://www.freetype.org/patents.html.
+  useEncumberedCode ? true,
 }:
 
-assert useInfinality -> useEncumberedCode;
+with { inherit (stdenv.lib) optional optionals optionalString; };
 
-let
-  version = "2.6.5";
+let version = "2.7.1"; name = "freetype-" + version; in
 
-  infinality = fetchFromGitHub {
-    owner = "archfan";
-    repo = "infinality_bundle";
-    rev = "5c0949a477bf43d2ac4e57b4fc39bcc3331002ee";
-    sha256 = "17389aqm6rlxl4b5mv1fx4b22x2v2n60hfhixfxqxpd8ialsdi6l";
+stdenv.mkDerivation {
+  inherit name;
+
+  meta = with stdenv.lib; {
+    description = "A font rendering engine";
+    longDescription = ''
+      FreeType is a portable and efficient library for rendering fonts. It
+      supports TrueType, Type 1, CFF fonts, and WOFF, PCF, FNT, BDF and PFR
+      fonts. It has a bytecode interpreter and has an automatic hinter called
+      autofit which can be used instead of hinting instructions included in
+      fonts.
+    '';
+    homepage = https://www.freetype.org/;
+    license = licenses.gpl2Plus; # or the FreeType License (BSD + advertising clause)
+    platforms = platforms.all;
+    maintainers = with maintainers; [ ttuegel ];
   };
-
-in
-with { inherit (stdenv.lib) optional optionals optionalString; };
-stdenv.mkDerivation rec {
-  name = "freetype-${version}";
 
   src = fetchurl {
     url = "mirror://savannah/freetype/${name}.tar.bz2";
-    sha256 = "1w5c87s4rpx9af5b3mk5cjd1yny3c4dq5p9iv3ixb3vr00a6w2p2";
+    sha256 = "121gm15ayfg3rglby8ifh8384mcjb9dhmx9j40zl7yszw72b4frs";
   };
 
-  patches = [
-    # Patch for validation of OpenType and GX/AAT tables.
-    (fetchurl {
-      name = "freetype-2.2.1-enable-valid.patch";
-      url = "http://pkgs.fedoraproject.org/cgit/rpms/freetype.git/plain/freetype-2.2.1-enable-valid.patch?id=9a81147af83b1166a5f301e379f85927cc610990";
-      sha256 = "0zkgqhws2s0j8ywksclf391iijhidb1a406zszd7xbdjn28kmj2l";
-    })
-  ] ++ optionals (!useInfinality && useEncumberedCode) [
-    # Patch to enable subpixel rendering.
-    # See https://www.freetype.org/freetype2/docs/reference/ft2-lcd_filtering.html.
-    (fetchurl {
-      name = "freetype-2.3.0-enable-spr.patch";
-      url = http://pkgs.fedoraproject.org/cgit/rpms/freetype.git/plain/freetype-2.3.0-enable-spr.patch?id=9a81147af83b1166a5f301e379f85927cc610990;
-      sha256 = "13ni9n5q3nla38wjmxd4f8cy29gp62kjx2l6y6nqhdyiqp8fz8nd";
-    })
-  ];
-
-  prePatch = optionalString useInfinality ''
-    patches="$patches $(ls ${infinality}/*_freetype2-iu/*-infinality-*.patch)"
-  '';
-
-  outputs = [ "out" "dev" ];
-
   propagatedBuildInputs = [ zlib bzip2 libpng ]; # needed when linking against freetype
   # dependence on harfbuzz is looser than the reverse dependence
   nativeBuildInputs = [ pkgconfig which ]
     # FreeType requires GNU Make, which is not part of stdenv on FreeBSD.
     ++ optional (!stdenv.isLinux) gnumake;
+
+  patches =
+    [ ./enable-table-validation.patch ]
+    ++ optional useEncumberedCode ./enable-subpixel-rendering.patch;
+
+  outputs = [ "out" "dev" ];
 
   configureFlags = [ "--disable-static" "--bindir=$(dev)/bin" ];
 
···
     # of gcc. I think it's due to the unwrapped gcc being in the PATH. I don't
     # know why it's on the PATH.
     configureFlags = "--disable-static CC_BUILD=gcc";
-  };
-
-  meta = with stdenv.lib; {
-    description = "A font rendering engine";
-    longDescription = ''
-      FreeType is a portable and efficient library for rendering fonts. It
-      supports TrueType, Type 1, CFF fonts, and WOFF, PCF, FNT, BDF and PFR
-      fonts. It has a bytecode interpreter and has an automatic hinter called
-      autofit which can be used instead of hinting instructions included in
-      fonts.
-    '';
-    homepage = https://www.freetype.org/;
-    license = licenses.gpl2Plus; # or the FreeType License (BSD + advertising clause)
-    #ToDo: encumbered = useEncumberedCode;
-    platforms = platforms.all;
   };
 }

pkgs/development/libraries/freetype/enable-subpixel-rendering.patch

···
+Index: freetype-2.7.1/include/freetype/config/ftoption.h
+===================================================================
+--- freetype-2.7.1.orig/include/freetype/config/ftoption.h
++++ freetype-2.7.1/include/freetype/config/ftoption.h
+@@ -122,7 +122,7 @@ FT_BEGIN_HEADER
+   /* This is done to allow FreeType clients to run unmodified, forcing     */
+   /* them to display normal gray-level anti-aliased glyphs.                */
+   /*                                                                       */
+-/* #define FT_CONFIG_OPTION_SUBPIXEL_RENDERING */
++#define FT_CONFIG_OPTION_SUBPIXEL_RENDERING
+ 
+ 
+   /*************************************************************************/

pkgs/development/libraries/freetype/enable-table-validation.patch

···
+Index: freetype-2.7.1/modules.cfg
+===================================================================
+--- freetype-2.7.1.orig/modules.cfg
++++ freetype-2.7.1/modules.cfg
+@@ -120,7 +120,7 @@ AUX_MODULES += cache
+ # TrueType GX/AAT table validation.  Needs ftgxval.c below.
+ #
+ # No FT_CONFIG_OPTION_PIC support.
+-# AUX_MODULES += gxvalid
++AUX_MODULES += gxvalid
+ 
+ # Support for streams compressed with gzip (files with suffix .gz).
+ #
+@@ -143,7 +143,7 @@ AUX_MODULES += bzip2
+ # OpenType table validation.  Needs ftotval.c below.
+ #
+ # No FT_CONFIG_OPTION_PIC support.
+-# AUX_MODULES += otvalid
++AUX_MODULES += otvalid
+ 
+ # Auxiliary PostScript driver component to share common code.
+ #

pkgs/development/libraries/jemalloc/default.nix

···
 
 stdenv.mkDerivation rec {
   name = "jemalloc-${version}";
-  version = "4.3.1";
+  version = "4.5.0";
 
   src = fetchurl {
     url = "https://github.com/jemalloc/jemalloc/releases/download/${version}/${name}.tar.bz2";
-    sha256 = "12r71i8nm3vwz21fc16rwbb0pwcg5s05n1qg3rwl2s85v0x1ifzp";
+    sha256 = "9409d85664b4f135b77518b0b118c549009dc10f6cba14557d170476611f6780";
   };
 
   # By default, jemalloc puts a je_ prefix onto all its symbols on OSX, which
   # then stops downstream builds (mariadb in particular) from detecting it. This
   # option should remove the prefix and give us a working jemalloc.
   configureFlags = stdenv.lib.optional stdenv.isDarwin "--with-jemalloc-prefix=";
+
+  doCheck = true;
+
 
   meta = with stdenv.lib; {
     homepage = http://jemalloc.net;

pkgs/development/libraries/mesa/default.nix

···
 , libelf, libvdpau, python2
 , grsecEnabled ? false
 , enableRadv ? false
-, enableTextureFloats ? false # Texture floats are patented, see docs/patents.txt
+# Texture floats are patented, see docs/patents.txt, so we don't enable them for full Mesa.
+# It's overridden for mesa_drivers.
+, enableTextureFloats ? false
 , galliumDrivers ? null
 , driDrivers ? null
 , vulkanDrivers ? null
···
 in
 
 let
-  version = "17.0.1";
+  version = "17.0.2";
   branch  = head (splitString "." version);
   driverLink = "/run/opengl-driver" + optionalString stdenv.isi686 "-32";
 in
···
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
       "https://launchpad.net/mesa/trunk/${version}/+download/mesa-${version}.tar.xz"
     ];
-    sha256 = "96fd70ef5f31d276a17e424e7e1bb79447ccbbe822b56844213ef932e7ad1b0c";
+    sha256 = "f8f191f909e01e65de38d5bdea5fb057f21649a3aed20948be02348e77a689d4";
   };
 
   prePatch = "patchShebangs .";

pkgs/development/libraries/nghttp2/default.nix

···
 { stdenv, fetchurl, pkgconfig
 
 # Optional Dependencies
-, openssl ? null, libev ? null, zlib ? null, libcares ? null
+, openssl ? null, libev ? null, zlib ? null, c-ares ? null
 , enableHpack ? false, jansson ? null
 , enableAsioLib ? false, boost ? null
 , enableGetAssets ? false, libxml2 ? null
···
 
 stdenv.mkDerivation rec {
   name = "nghttp2-${version}";
-  version = "1.19.0";
+  version = "1.20.0";
 
   # Don't use fetchFromGitHub since this needs a bootstrap curl
   src = fetchurl {
     url = "https://github.com/nghttp2/nghttp2/releases/download/v${version}/nghttp2-${version}.tar.bz2";
-    sha256 = "477466eee27158d37b4478d9335dd091497cae4d7f2375fc6657beab67db9e7a";
+    sha256 = "fb29d0500b194f11680203aed21aafab241063ec1397cc51ab5cc0957341141b";
   };
 
   outputs = [ "out" "dev" "lib" ];
 
   nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ openssl libev zlib libcares ]
+  buildInputs = [ openssl libev zlib c-ares ]
     ++ optional enableHpack jansson
     ++ optional enableAsioLib boost
     ++ optional enableGetAssets libxml2
···
 
   enableParallelBuilding = true;
 
+  configureFlags = [ "--with-spdylay=no" "--disable-examples" "--disable-python-bindings" ]
+    ++ optional enableAsioLib "--enable-asio-lib --with-boost-libdir=${boost}/lib";
+
+  #doCheck = true;  # requires CUnit ; currently failing at test_util_localtime_date in util_test.cc
+
+
   meta = with stdenv.lib; {
-    homepage = http://nghttp2.org/;
+    homepage = https://nghttp2.org/;
     description = "A C implementation of HTTP/2";
     license = licenses.mit;
     platforms = platforms.all;

pkgs/development/libraries/openssl/default.nix

···
 
     patches =
       (args.patches or [])
-      ++ optional (versionOlder version "1.1.0") ./use-etc-ssl-certs.patch
+      ++ [ ./nix-ssl-cert-file.patch ]
+      ++ optional (versionOlder version "1.1.0")
+          (if stdenv.isDarwin then ./use-etc-ssl-certs-darwin.patch else ./use-etc-ssl-certs.patch)
       ++ optional stdenv.isCygwin ./1.0.1-cygwin64.patch
       ++ optional
            (versionOlder version "1.0.2" && (stdenv.isDarwin || (stdenv ? cross && stdenv.cross.libc == "libSystem")))

pkgs/development/libraries/openssl/nix-ssl-cert-file.patch

···
+diff -ru -x '*~' openssl-1.0.2j-orig/crypto/x509/by_file.c openssl-1.0.2j/crypto/x509/by_file.c
+--- openssl-1.0.2j-orig/crypto/x509/by_file.c	2016-09-26 11:49:07.000000000 +0200
++++ openssl-1.0.2j/crypto/x509/by_file.c	2016-10-13 16:54:31.400288302 +0200
+@@ -97,7 +97,9 @@
+     switch (cmd) {
+     case X509_L_FILE_LOAD:
+         if (argl == X509_FILETYPE_DEFAULT) {
+-            file = (char *)getenv(X509_get_default_cert_file_env());
++            file = (char *)getenv("NIX_SSL_CERT_FILE");
++            if (!file)
++                file = (char *)getenv(X509_get_default_cert_file_env());
+             if (file)
+                 ok = (X509_load_cert_crl_file(ctx, file,
+                                               X509_FILETYPE_PEM) != 0);

pkgs/development/libraries/openssl/use-etc-ssl-certs-darwin.patch

···
+diff -ru -x '*~' openssl-1.0.1r-orig/crypto/cryptlib.h openssl-1.0.1r/crypto/cryptlib.h
+--- openssl-1.0.1r-orig/crypto/cryptlib.h	2016-01-28 14:38:30.000000000 +0100
++++ openssl-1.0.1r/crypto/cryptlib.h	2016-02-03 12:54:29.193165176 +0100
+@@ -81,8 +81,8 @@
+ 
+ # ifndef OPENSSL_SYS_VMS
+ #  define X509_CERT_AREA          OPENSSLDIR
+ #  define X509_CERT_DIR           OPENSSLDIR "/certs"
+-#  define X509_CERT_FILE          OPENSSLDIR "/cert.pem"
++#  define X509_CERT_FILE          "/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt"
+ #  define X509_PRIVATE_DIR        OPENSSLDIR "/private"
+ # else
+ #  define X509_CERT_AREA          "SSLROOT:[000000]"

pkgs/development/python-modules/dbus/default.nix

···
-{ lib, fetchurl, mkPythonDerivation, python, pkgconfig, dbus, dbus_glib, dbus_tools, isPyPy
+{ lib, fetchurl, buildPythonPackage, python, pkgconfig, dbus, dbus_glib, dbus_tools, isPyPy
 , ncurses, pygobject3 }:
 
-if isPyPy then throw "dbus-python not supported for interpreter ${python.executable}" else mkPythonDerivation rec {
+if isPyPy then throw "dbus-python not supported for interpreter ${python.executable}" else buildPythonPackage rec {
   name = "dbus-python-1.2.4";
+  format = "other";
 
   src = fetchurl {
     url = "http://dbus.freedesktop.org/releases/dbus-python/${name}.tar.gz";

pkgs/development/python-modules/koji/default.nix

···
-{ stdenv, fetchurl, mkPythonDerivation, pycurl }:
+{ stdenv, fetchurl, buildPythonPackage, pycurl }:
 
-mkPythonDerivation rec {
+buildPythonPackage rec {
   name = "koji-1.8";
+  format = "other";
 
   src = fetchurl {
     url = "https://fedorahosted.org/released/koji/koji-1.8.0.tar.bz2";

pkgs/development/python-modules/libsexy/default.nix

···
-{ stdenv, fetchurl, mkPythonDerivation, libsexy, pkgconfig, libxml2, pygtk, pango, gtk2, glib }:
+{ stdenv, fetchurl, buildPythonPackage, libsexy, pkgconfig, libxml2, pygtk, pango, gtk2, glib }:
 
-mkPythonDerivation rec {
+buildPythonPackage rec {
   name = "libsexy-${version}";
   version = "0.1.9";
+  format = "other";
 
   src = fetchurl {
     url = "http://releases.chipx86.com/libsexy/sexy-python/sexy-python-${version}.tar.gz";

pkgs/development/python-modules/pycairo/default.nix

···
-{ lib, fetchurl, fetchpatch, python, mkPythonDerivation, pkgconfig, cairo, xlibsWrapper, isPyPy, isPy35, isPy3k }:
+{ lib, fetchurl, fetchpatch, python, buildPythonPackage, pkgconfig, cairo, xlibsWrapper, isPyPy, isPy35, isPy3k }:
 
-if (isPyPy) then throw "pycairo not supported for interpreter ${python.executable}" else mkPythonDerivation rec {
+if (isPyPy) then throw "pycairo not supported for interpreter ${python.executable}" else buildPythonPackage rec {
   version = "1.10.0";
   name = "pycairo-${version}";
+  format = "other";
   src = if isPy3k
     then fetchurl {
       url = "http://cairographics.org/releases/pycairo-${version}.tar.bz2";

pkgs/development/python-modules/pygobject/3.nix

···
-{ stdenv, fetchurl, mkPythonDerivation, python, pkgconfig, glib, gobjectIntrospection, pycairo, cairo, which, ncurses}:
+{ stdenv, fetchurl, buildPythonPackage, python, pkgconfig, glib, gobjectIntrospection, pycairo, cairo, which, ncurses}:
 
-mkPythonDerivation rec {
+buildPythonPackage rec {
   major = "3.22";
   minor = "0";
   name = "pygobject-${major}.${minor}";
+  format = "other";
 
   src = fetchurl {
     url = "mirror://gnome/sources/pygobject/${major}/${name}.tar.xz";

pkgs/development/python-modules/pygobject/default.nix

···
-{ stdenv, fetchurl, python, mkPythonDerivation, pkgconfig, glib }:
+{ stdenv, fetchurl, python, buildPythonPackage, pkgconfig, glib }:
 
-mkPythonDerivation rec {
+buildPythonPackage rec {
   name = "pygobject-${version}";
   version = "2.28.6";
+  format = "other";
 
   src = fetchurl {
     url = "mirror://gnome/sources/pygobject/2.28/${name}.tar.xz";

pkgs/development/python-modules/pygtksourceview/default.nix

···
-{ lib, fetchurl, python, mkPythonDerivation, pkgconfig, pygobject2, glib, pygtk, gnome2 }:
+{ lib, fetchurl, python, buildPythonPackage, pkgconfig, pygobject2, glib, pygtk, gnome2 }:
 
 let version = "2.10.1"; in
 
-mkPythonDerivation {
+buildPythonPackage {
   name = "pygtksourceview-${version}";
+  format = "other";
 
   src = fetchurl {
     url = "http://ftp.gnome.org/pub/gnome/sources/pygtksourceview/2.10/pygtksourceview-${version}.tar.bz2";

pkgs/development/python-modules/pyqt/4.x.nix

···
 
 let
   version = "4.12";
-  inherit (pythonPackages) mkPythonDerivation python dbus-python sip;
-in mkPythonDerivation {
+  inherit (pythonPackages) buildPythonPackage python dbus-python sip;
+in buildPythonPackage {
   name = "PyQt-x11-gpl-${version}";
+  format = "other";
 
   src = fetchurl {
     url = "mirror://sourceforge/pyqt/PyQt4_gpl_x11-${version}.tar.gz";

pkgs/development/python-modules/pyqt/5.x.nix

···
 
 let
   version = "5.8.1";
-  inherit (pythonPackages) mkPythonDerivation python dbus-python sip;
-in mkPythonDerivation {
+  inherit (pythonPackages) buildPythonPackage python dbus-python sip;
+in buildPythonPackage {
   name = "PyQt-${version}";
+  format = "other";
 
   meta = with lib; {
     description = "Python bindings for Qt5";

pkgs/development/python-modules/pyside/default.nix

···
-{ lib, fetchurl, cmake, python, mkPythonDerivation, pysideGeneratorrunner, pysideShiboken, qt4 }:
+{ lib, fetchurl, cmake, python, buildPythonPackage, pysideGeneratorrunner, pysideShiboken, qt4 }:
 
-mkPythonDerivation rec {
+buildPythonPackage rec {
   name = "pyside-${version}";
   version = "1.2.4";
+  format = "other";
 
   src = fetchurl {
     url = "https://github.com/PySide/PySide/archive/${version}.tar.gz";

pkgs/development/python-modules/pyxml/default.nix

···
-{lib, fetchurl, python, mkPythonDerivation, makeWrapper}:
+{lib, fetchurl, python, buildPythonPackage, makeWrapper}:
 
-mkPythonDerivation rec {
+buildPythonPackage rec {
   name = "PyXML-0.8.4";
+  format = "other";
   src = fetchurl {
     url = "mirror://sourceforge/pyxml/${name}.tar.gz";
     sha256 = "04wc8i7cdkibhrldy6j65qp5l75zjxf5lx6qxdxfdf2gb3wndawz";

pkgs/development/python-modules/sip/default.nix

···
-{ lib, fetchurl, mkPythonDerivation, python, isPyPy }:
+{ lib, fetchurl, buildPythonPackage, python, isPyPy }:
 
-if isPyPy then throw "sip not supported for interpreter ${python.executable}" else mkPythonDerivation rec {
+if isPyPy then throw "sip not supported for interpreter ${python.executable}" else buildPythonPackage rec {
   name = "sip-4.19.1";
+  format = "other";
 
   src = fetchurl {
     url = "mirror://sourceforge/pyqt/sip/${name}/${name}.tar.gz";

pkgs/development/tools/documentation/gnome-doc-utils/default.nix

···
 {stdenv, fetchurl, pkgconfig, libxml2Python, libxslt, intltool
 , makeWrapper, python2Packages }:
 
-python2Packages.mkPythonDerivation {
+python2Packages.buildPythonApplication {
   name = "gnome-doc-utils-0.20.10";
+  format = "other";
 
   src = fetchurl {
     url = mirror://gnome/sources/gnome-doc-utils/0.20/gnome-doc-utils-0.20.10.tar.xz;

pkgs/development/tools/misc/autogen/default.nix

···
 
 stdenv.mkDerivation rec {
   name = "autogen-${version}";
-  version = "5.18.7";
+  version = "5.18.12";
 
   src = fetchurl {
-    url = "mirror://gnu/autogen/autogen-${version}.tar.xz";
-    sha256 = "01d4m8ckww12sy50vgyxlnz83z9dxqpyqp153cscncc9w6jq19d7";
+    url = "mirror://gnu/autogen/rel${version}/autogen-${version}.tar.xz";
+    sha256 = "1n5zq4872sakvz9c7ncsdcfp0z8rsybsxvbmhkpbd19ii0pacfxy";
   };
 
   outputs = [ "bin" "dev" "lib" "out" "man" "info" ];

pkgs/development/tools/misc/d-feet/default.nix

···
 let
   version = "${major}.11";
   major = "0.3";
-in pythonPackages.mkPythonDerivation rec {
+in pythonPackages.buildPythonApplication rec {
   name = "d-feet-${version}";
-  namePrefix = "";
+  format = "other";
 
   src = fetchurl {
     url = "mirror://gnome/sources/d-feet/${major}/d-feet-${version}.tar.xz";

pkgs/misc/drivers/hplip/default.nix

···
 assert withPlugin -> builtins.elem hplipArch pluginArches
   || throw "HPLIP plugin not supported on ${stdenv.system}";
 
-pythonPackages.mkPythonDerivation {
+pythonPackages.buildPythonApplication {
   inherit name src;
+  format = "other";
 
   buildInputs = [
     libjpeg

pkgs/os-specific/linux/dstat/default.nix

···
 { stdenv, fetchurl, python2Packages }:
 
-python2Packages.mkPythonDerivation rec {
+python2Packages.buildPythonApplication rec {
   name = "dstat-${version}";
+  format = "other";
   version = "0.7.3";
 
   src = fetchurl {

pkgs/shells/bash/4.4.nix

···
   patchFlags = "-p0";
 
   patches = upstreamPatches
-      ++ [ (fetchurl {
-              # https://security.gentoo.org/glsa/201701-02
-              url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/app-shells"
-                  + "/bash/files/bash-4.4-popd-offset-overflow.patch"
-                  + "?id=1bf1ceeb04a2f57e1e5e1636a8c288c4d0db6682";
-              sha256 = "02n08lw5spvsc2b1bll0gr6mg4qxcg7pzfjkw7ji5w7bjcikccbm";
-          }) ]
       ++ optional stdenv.isCygwin ./cygwin-bash-4.3.33-1.src.patch;
 
   crossAttrs = {

pkgs/shells/bash/bash-4.4-patches.nix

···
 (patch "003" "1chqww2rj6g42b8s60q5zlzy0jzp684jkpsbrbfy1vzxja8mmpsi")
 (patch "004" "1cy8abf96hkrjhw921ndr0shlcnc52bg45rn6xri4v5clhq0l25d")
 (patch "005" "0a8515kyk4zsgmvlqvlganjfr7pq0j6kzpr4d6xx02kpbdr4n7i2")
+(patch "006" "1f24wgqngmj2mrj9yibwvc2zvlmn5xi53mnw777g3l40c4m2x3ka")
+(patch "007" "1bzdsnqaf05gdbqpsixhan8vygjxpcxlz1dd8d9f5jdznw3wq76y")
+(patch "008" "1firw915mjm03hbbw9a70ch3cpgrgnvqjpllgdnn6csr8q04f546")
+(patch "009" "0g1l56kvw61rpw7dqa9fcl9llkl693h73g631hrhxlm030ddssqb")
+(patch "010" "01lfhrkdsdkdz8ypzapr614ras23x7ckjnr60aa5bzkaqprccrc4")
+(patch "011" "038p7mhnq9m65g505hi3827jkf9f35nd1cy00w8mwafpyxp44mnx")
+(patch "012" "0gh6lbb1rwpk44pvbamm6vzdfi50xnwkqd9v7s8cjwk3pz973hps")
 ]

pkgs/tools/networking/curl/default.nix

···
     sha256 = "1s1hyndva0yp62xy96pcp4anzrvw6cl0abjajim17sbmdp00fwhw";
   };
 
-  patches = [ ];
-
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
 
   enableParallelBuilding = true;
···
   '';
 
   configureFlags = [
-      # OS X does not have a default system bundle, so we assume cacerts is installed in the default nix-env profile
-      # This sucks. We should probably just include the latest cacerts in the darwin bootstrap.
-      "--with-ca-bundle=${if stdenv.isDarwin then "/nix/var/nix/profiles/default" else ""}/etc/ssl/certs/ca-${if stdenv.isDarwin then "bundle" else "certificates"}.crt"
+      "--with-ca-fallback"
       "--disable-manual"
       ( if sslSupport then "--with-ssl=${openssl.dev}" else "--without-ssl" )
       ( if gnutlsSupport then "--with-gnutls=${gnutls.dev}" else "--without-gnutls" )

pkgs/top-level/all-packages.nix

···
 
   fontconfig = callPackage ../development/libraries/fontconfig { };
 
+  fontconfig-penultimate = callPackage ../data/fonts/fontconfig-penultimate {};
+
   fontconfig-ultimate = callPackage ../development/libraries/fontconfig-ultimate {};
 
   folly = callPackage ../development/libraries/folly { };
···
   mesa_drivers = mesaDarwinOr (
     let mo = mesa_noglu.override {
       grsecEnabled = config.grsecurity or false;
+      enableTextureFloats = true;
     };
     in mo.drivers
   );

pkgs/top-level/python-packages.nix

···
     buildInputs = with self; [ fudge_9 nose ];
   };
 
-  fedora_cert = mkPythonDerivation rec {
+  fedora_cert = buildPythonPackage rec {
     name = "fedora-cert-0.5.9.2";
     meta.maintainers = with maintainers; [ mornfall ];
+    format = "other";
 
     src = pkgs.fetchurl {
       url = "https://fedorahosted.org/releases/f/e/fedora-packager/fedora-packager-0.5.9.2.tar.bz2";
···
   };
 
 
-  pysvn = mkPythonDerivation rec {
+  pysvn = buildPythonPackage rec {
     name = "pysvn-1.8.0";
+    format = "other";
 
     src = pkgs.fetchurl {
       url = "http://pysvn.barrys-emacs.org/source_kits/${name}.tar.gz";
···
   });
 
 
-  pywebkitgtk = mkPythonDerivation rec {
+  pywebkitgtk = buildPythonPackage rec {
     name = "pywebkitgtk-${version}";
     version = "1.1.8";
+    format = "other";
 
     src = pkgs.fetchurl {
       url = "http://pywebkitgtk.googlecode.com/files/${name}.tar.bz2";
···
 
   qscintilla = if isPy3k || isPyPy
     then throw "qscintilla-${pkgs.qscintilla.version} not supported for interpreter ${python.executable}"
-    else mkPythonDerivation rec {
+    else buildPythonPackage rec {
       # TODO: Qt5 support
       name = "qscintilla-${version}";
       version = pkgs.qscintilla.version;
+      format = "other";
 
       src = pkgs.qscintilla.src;
 
···
   # Python package.
   tkinter = let
     py = python.override{x11Support=true;};
-  in mkPythonDerivation rec {
+  in buildPythonPackage rec {
     name = "tkinter-${python.version}";
     src = py;
+    format = "other";
 
     disabled = isPy26 || isPyPy;