NixOS · Sep 20, 2018 · Sep 20, 2018 · Sep 20, 2018 · Sep 20, 2018 · Sep 20, 2018
diff --git a/doc/functions.xml b/doc/functions.xml
@@ -642,20 +642,22 @@ buildImage {
    <example xml:id="example-pkgs-dockerTools-buildImage-creation-date">
      <title>Impurely Defining a Docker Layer's Creation Date</title>
      <para>
-       Because dates are an impurity, by default
-       <function>buildImage</function> will use a static date of one
-       second past the UNIX Epoch. This can be a bit frustrating when
-       listing docker images in the CLI:
+       By default <function>buildImage</function> will use a static
+       date of one second past the UNIX Epoch. This allows
+       <function>buildImage</function> to produce binary reproducible
+       images. When listing images with <command>docker list
+       images</command>, the newly created images will be listed like
+       this:
      </para>
      <screen><![CDATA[
 $ docker image list
 REPOSITORY   TAG      IMAGE ID       CREATED        SIZE
 hello        latest   08c791c7846e   48 years ago   25.2MB
 ]]></screen>
      <para>
-       If you want to trade the purity for a better user experience,
-       you can set <literal>created</literal> to
-       <literal>now</literal>.
+       You can break binary reproducibility but have a sorted,
+       meaningful <literal>CREATED</literal> column by setting
+       <literal>created</literal> to <literal>now</literal>.
      </para>
      <programlisting><![CDATA[
 pkgs.dockerTools.buildImage {
@@ -670,12 +672,13 @@ pkgs.dockerTools.buildImage {
      <para>
        and now the Docker CLI will display a reasonable date and
        sort the images as expected:
-     </para>
-     <screen><![CDATA[
+       <screen><![CDATA[
 $ docker image list
 REPOSITORY   TAG      IMAGE ID       CREATED              SIZE
 hello        latest   de2bf4786de6   About a minute ago   25.2MB
 ]]></screen>
+       however, the produced images will not be binary reproducible.
+     </para>
    </example>
   </section>
 

diff --git a/nixos/tests/atd.nix b/nixos/tests/atd.nix
@@ -16,6 +16,7 @@ import ./make-test.nix ({ pkgs, ... }:
   testScript = ''
     startAll;
 
+    $machine->waitForUnit('atd.service'); # wait for atd to start
     $machine->fail("test -f ~root/at-1");
     $machine->fail("test -f ~alice/at-1");
 

diff --git a/nixos/tests/docker-tools.nix b/nixos/tests/docker-tools.nix
@@ -20,7 +20,10 @@ import ./make-test.nix ({ pkgs, ... }: {
     ''
       $docker->waitForUnit("sockets.target");
 
+      # Ensure Docker images use a stable date by default
       $docker->succeed("docker load --input='${pkgs.dockerTools.examples.bash}'");
+      $docker->succeed("[ '1970-01-01T00:00:01Z' = \"\$(docker inspect ${pkgs.dockerTools.examples.bash.imageName} | ${pkgs.jq}/bin/jq -r .[].Created)\" ]");
+
       $docker->succeed("docker run --rm ${pkgs.dockerTools.examples.bash.imageName} bash --version");
       $docker->succeed("docker rmi ${pkgs.dockerTools.examples.bash.imageName}");
 
@@ -51,5 +54,9 @@ import ./make-test.nix ({ pkgs, ... }: {
       $docker->succeed("docker run --rm runasrootextracommands cat extraCommands");
       $docker->succeed("docker run --rm runasrootextracommands cat runAsRoot");
       $docker->succeed("docker rmi '${pkgs.dockerTools.examples.runAsRootExtraCommands.imageName}'");
+
+      # Ensure Docker images can use an unstable date
+      $docker->succeed("docker load --input='${pkgs.dockerTools.examples.bash}'");
+      $docker->succeed("[ '1970-01-01T00:00:01Z' != \"\$(docker inspect ${pkgs.dockerTools.examples.unstableDate.imageName} | ${pkgs.jq}/bin/jq -r .[].Created)\" ]");
     '';
 })
diff --git a/pkgs/applications/altcoins/bitcoin.nix b/pkgs/applications/altcoins/bitcoin.nix
@@ -5,13 +5,13 @@
 with stdenv.lib;
 stdenv.mkDerivation rec{
   name = "bitcoin" + (toString (optional (!withGui) "d")) + "-" + version;
-  version = "0.16.2";
+  version = "0.16.3";
 
   src = fetchurl {
     urls = [ "https://bitcoincore.org/bin/bitcoin-core-${version}/bitcoin-${version}.tar.gz"
              "https://bitcoin.org/bin/bitcoin-core-${version}/bitcoin-${version}.tar.gz"
            ];
-    sha256 = "1n07qykx5hc0ph8fwn7hfrbsrjv19fdzvs5h0nysq4wfgn5wa40r";
+    sha256 = "060223dzzk2izfzhxwlzzd0fhbgglvbgps2nyc4zz767vybysvl3";
   };
 
   nativeBuildInputs = [ pkgconfig autoreconfHook ];

diff --git a/pkgs/applications/audio/praat/default.nix b/pkgs/applications/audio/praat/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "praat-${version}";
-  version = "6.0.42";
+  version = "6.0.43";
 
   src = fetchurl {
     url = "https://github.com/praat/praat/archive/v${version}.tar.gz";
-    sha256 = "1llcj1cq4k60lnr6jkdshd4l9nkg9yc2xmaqiinqryxrb58jmpcv";
+    sha256 = "1l13bvnl7sv8v6s5z63201bhzavnj6bnqcj446akippsam13z4sf";
   };
 
   configurePhase = ''

diff --git a/pkgs/applications/graphics/feh/default.nix b/pkgs/applications/graphics/feh/default.nix
@@ -6,11 +6,11 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   name = "feh-${version}";
-  version = "2.27.1";
+  version = "2.28";
 
   src = fetchurl {
     url = "https://feh.finalrewind.org/${name}.tar.bz2";
-    sha256 = "10zk76l491s22qrv86rax6cvpgwyl3qq0izl2pbk0k1z1kw3ihvf";
+    sha256 = "1nfka7w6pzj2bbwx8vydr2wwm7z8mrbqiy1xrq97c1g5bxy2vlhk";
   };
 
   outputs = [ "out" "man" "doc" ];

diff --git a/pkgs/applications/networking/browsers/links2/default.nix b/pkgs/applications/networking/browsers/links2/default.nix
@@ -8,12 +8,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "2.16";
+  version = "2.17";
   name = "links2-${version}";
 
   src = fetchurl {
     url = "${meta.homepage}/download/links-${version}.tar.bz2";
-    sha256 = "0gsa2gpb1grhssl5jzpc5pa0zi21mxi8g25rh5bacl70slw31w42";
+    sha256 = "0dh2gbzcw8kxy81z4ggsynibnqs56b83vy8qgz7illsag1irff6q";
   };
 
   buildInputs = with stdenv.lib;

diff --git a/pkgs/build-support/docker/examples.nix b/pkgs/build-support/docker/examples.nix
@@ -141,4 +141,13 @@ rec {
     runAsRoot = ''echo "(runAsRoot)" > runAsRoot'';
     extraCommands = ''echo "(extraCommand)" > extraCommands'';
   };
+
+  # 9. Ensure that setting created to now results in a date which
+  # isn't the epoch + 1
+  unstableDate = pkgs.dockerTools.buildImage {
+    name = "unstable-date";
+    tag = "latest";
+    contents = [ pkgs.coreutils ];
+    created = "now";
+  };
 }
diff --git a/pkgs/development/haskell-modules/configuration-nix.nix b/pkgs/development/haskell-modules/configuration-nix.nix
@@ -126,9 +126,9 @@ self: super: builtins.intersectAttrs super {
   # the system-fileio tests use canonicalizePath, which fails in the sandbox
   system-fileio = if pkgs.stdenv.isDarwin then dontCheck super.system-fileio else super.system-fileio;
 
-  # Prevents needing to add security_tool as a build tool to all of x509-system's
-  # dependencies.
-  x509-system = if pkgs.stdenv.targetPlatform.isDarwin && !pkgs.stdenv.cc.nativeLibc
+  # Prevents needing to add `security_tool` as a run-time dependency for
+  # everything using x509-system to give access to the `security` executable.
+  x509-system = if pkgs.stdenv.hostPlatform.isDarwin && !pkgs.stdenv.cc.nativeLibc
     then let inherit (pkgs.darwin) security_tool;
       in pkgs.lib.overrideDerivation (addBuildDepend super.x509-system security_tool) (drv: {
         postPatch = (drv.postPatch or "") + ''

diff --git a/pkgs/development/libraries/CGAL/default.nix b/pkgs/development/libraries/CGAL/default.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchFromGitHub, cmake, boost, gmp, mpfr }:
 
 stdenv.mkDerivation rec {
-  version = "4.12";
+  version = "4.12.1";
   name = "cgal-" + version;
 
   src = fetchFromGitHub {
     owner = "CGAL";
     repo = "releases";
     rev = "CGAL-${version}";
-    sha256 = "0n4yvg2rkrlb1bwhykrg4iyqg4whxadcs441k10xx0r75i6220mn";
+    sha256 = "0b8wwfnvbayxi18jahfdplkjqr59ynq6phk0kz62gqp8vmwia9d9";
   };
 
   # note: optional component libCGAL_ImageIO would need zlib and opengl;

diff --git a/pkgs/development/libraries/afflib/default.nix b/pkgs/development/libraries/afflib/default.nix
@@ -3,14 +3,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "3.7.16";
+  version = "3.7.17";
   name = "afflib-${version}";
 
   src = fetchFromGitHub {
     owner = "sshock";
     repo = "AFFLIBv3";
     rev = "v${version}";
-    sha256 = "0piwkmg7jn64h57cjf5cybyvyqxj2k752g9vrf4ycds7nhvvbnb6";
+    sha256 = "11q20n6p5nvwmd9wwk0addlfxpxagf47ly89scn3jvc7k484ksan";
   };
 
   nativeBuildInputs = [ autoreconfHook ];

diff --git a/pkgs/development/libraries/libwebsockets/default.nix b/pkgs/development/libraries/libwebsockets/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "libwebsockets-${version}";
-  version = "3.0.0";
+  version = "3.0.1";
 
   src = fetchFromGitHub {
     owner = "warmcat";
     repo = "libwebsockets";
     rev = "v${version}";
-    sha256 = "0cz4f05qd9b2bm27h5pkwym2cl7ff73lgirzwjppwf9b18if58yv";
+    sha256 = "1x3qrz2hqsrv2lg0y9irdx37c8r9j9vf9mwzgw61znzvk6hc9ymq";
   };
 
   buildInputs = [ cmake openssl zlib libuv ];

diff --git a/pkgs/development/python-modules/circus/default.nix b/pkgs/development/python-modules/circus/default.nix
@@ -1,4 +1,4 @@
-{ buildPythonPackage, fetchPypi
+{ stdenv, buildPythonPackage, fetchPypi
 , iowait, psutil, pyzmq, tornado, mock }:
 
 buildPythonPackage rec {
@@ -10,7 +10,22 @@ buildPythonPackage rec {
     sha256 = "d1603cf4c4f620ce6593d3d2a67fad25bf0242183ea24110d8bb1c8079c55d1b";
   };
 
+  postPatch = ''
+    # relax version restrictions to fix build
+    substituteInPlace setup.py \
+      --replace "pyzmq>=13.1.0,<17.0" "pyzmq>13.1.0" \
+      --replace "tornado>=3.0,<5.0" "tornado>=3.0"
+  '';
+
+  checkInputs = [ mock ];
+
   doCheck = false; # weird error
 
-  propagatedBuildInputs = [ iowait psutil pyzmq tornado mock ];
+  propagatedBuildInputs = [ iowait psutil pyzmq tornado ];
+
+  meta = with stdenv.lib; {
+    description = "A process and socket manager";
+    homepage = "https://github.circus.com/circus-tent/circus";
+    license = licenses.asl20;
+  };
 }
diff --git a/pkgs/development/tools/misc/circleci-cli/default.nix b/pkgs/development/tools/misc/circleci-cli/default.nix
@@ -1,28 +1,22 @@
-{ stdenv, fetchFromGitHub, docker, makeWrapper }:
+{ stdenv, fetchFromGitHub, buildGoPackage }:
 
-stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
+let
+  owner = "CircleCI-Public";
   pname = "circleci-cli";
-  version = "0.1.0";
+  version = "0.1.2307";
+in
+buildGoPackage rec {
+  name = "${pname}-${version}";
+  inherit version;
 
-  src = fetchFromGitHub {
-    owner = "circleci";
-    repo = "local-cli";
+  src =  fetchFromGitHub {
+    inherit owner;
+    repo = pname;
     rev = "v${version}";
-    sha256 = "1bv1ck5zvyl6pyvbfglizg8ybna4yg2nz441kiv5rmp4g27n6db2";
+    sha256 = "0z71jnq42idvhgpgn3mdpbajmgn4b41rpifv5qxn3h1pgi08f75s";
   };
 
-  nativeBuildInputs = [ makeWrapper ];
-
-  installPhase = ''
-    mkdir -p "$out/bin/"
-    cp "$src/circleci.sh" "$out/bin/circleci"
-  '';
-
-  postFixup = ''
-    wrapProgram $out/bin/circleci \
-      --prefix "PATH" : "${docker}/bin"
-  '';
+  goPackagePath = "github.com/${owner}/${pname}";
 
   meta = with stdenv.lib; {
     # Box blurb edited from the AUR package circleci-cli

diff --git a/pkgs/games/liquidwar/default.nix b/pkgs/games/liquidwar/default.nix
@@ -2,7 +2,7 @@
 , gmp, libGLU_combined, libjpeg, libpng
 , expat, gettext, perl, guile
 , SDL, SDL_image, SDL_mixer, SDL_ttf
-, curl, sqlite
+, curl, sqlite, libtool, readline
 , libogg, libvorbis, libcaca, csound, cunit } :
 
 stdenv.mkDerivation rec {
@@ -22,6 +22,7 @@ stdenv.mkDerivation rec {
     curl sqlite
     libogg libvorbis csound
     libXrender libcaca cunit
+    libtool readline
   ];
 
   hardeningDisable = [ "format" ];

diff --git a/pkgs/os-specific/linux/dmidecode/default.nix b/pkgs/os-specific/linux/dmidecode/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "dmidecode-3.1";
+  name = "dmidecode-3.2";
 
   src = fetchurl {
     url = "mirror://savannah/dmidecode/${name}.tar.xz";
-    sha256 = "1h0sg0lxa15nzf8s7884p6q7p6md9idm0c79wyqmk32l4ndwwrnp";
+    sha256 = "1pcfhcgs2ifdjwp7amnsr3lq95pgxpr150bjhdinvl505px0cw07";
   };
 
   makeFlags = "prefix=$(out)";

diff --git a/pkgs/os-specific/linux/eudev/default.nix b/pkgs/os-specific/linux/eudev/default.nix
@@ -3,10 +3,10 @@ let
   s = # Generated upstream information
   rec {
     baseName="eudev";
-    version = "3.2.5";
+    version = "3.2.6";
     name="${baseName}-${version}";
     url="http://dev.gentoo.org/~blueness/eudev/eudev-${version}.tar.gz";
-    sha256 = "1bwh72brp4dvr2dm6ng0lflic6abl87h8zk209im5lna0m0x1hj9";
+    sha256 = "1qdpnvsv3qqwy6jl4i4b1dn212y6nvawpaladb7plfping9p2n46";
   };
 
   nativeBuildInputs = [ pkgconfig ];

diff --git a/pkgs/os-specific/linux/firejail/default.nix b/pkgs/os-specific/linux/firejail/default.nix
@@ -3,11 +3,11 @@ let
   s = # Generated upstream information
   rec {
     baseName="firejail";
-    version="0.9.54";
+    version="0.9.56";
     name="${baseName}-${version}";
-    hash="0mkpqlhi1vxiwd1pmlsk02vpydy1gj61k1gi3zlz6qw84xa6i6ff";
-    url="https://vorboss.dl.sourceforge.net/project/firejail/firejail/firejail-0.9.54.tar.xz";
-    sha256="0mkpqlhi1vxiwd1pmlsk02vpydy1gj61k1gi3zlz6qw84xa6i6ff";
+    hash="0b9ig0a91i19sfm94a6yl510pm4dlidmani3fsnb7vh0qy3l9121";
+    url="https://vorboss.dl.sourceforge.net/project/firejail/firejail/firejail-0.9.56.tar.xz";
+    sha256="0b9ig0a91i19sfm94a6yl510pm4dlidmani3fsnb7vh0qy3l9121";
   };
   buildInputs = [
     which

diff --git a/pkgs/tools/misc/you-get/default.nix b/pkgs/tools/misc/you-get/default.nix
@@ -2,15 +2,15 @@
 
 buildPythonApplication rec {
   pname = "you-get";
-  version = "0.4.1128";
+  version = "0.4.1148";
 
   # Tests aren't packaged, but they all hit the real network so
   # probably aren't suitable for a build environment anyway.
   doCheck = false;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0i0wspmgblxwvvbm3q8zz4l450fs3bccqxxfm0ysfgprgcy8fp3l";
+    sha256 = "1ypgqaxf5qn5b3c2n4hcsiixyvvpvmpx5gny523cd5igb7h0yja5";
   };
 
   meta = with stdenv.lib; {

diff --git a/pkgs/tools/system/ioping/default.nix b/pkgs/tools/system/ioping/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "ioping-${version}";
-  version = "1.0";
+  version = "1.1";
 
   src = fetchFromGitHub {
     owner = "koct9i";
     repo = "ioping";
     rev = "v${version}";
-    sha256 = "0yn7wgd6sd39zmr5l97zd6sq1ah7l49k1h7dhgx0nv96fa4r2y9h";
+    sha256 = "0cv2496jplka55yqdcf3ln78r8yggy4lgmgf06l6fbljjrdx7pgq";
   };
 
   makeFlags = "PREFIX=$(out)";

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
@@ -20030,7 +20030,7 @@ with pkgs;
   };
 
   liquidwar = callPackage ../games/liquidwar {
-    guile = guile_1_8;
+    guile = guile_2_0;
   };
 
   liquidwar5 = callPackage ../games/liquidwar/5.nix {