Merge master into staging

22 files changed, 140 insertions, 127 deletions

diff --git a/pkgs/os-specific/linux/bluez/default.nix b/pkgs/os-specific/linux/bluez/default.nix
index b095096caa7..3882a742586 100644
--- a/pkgs/os-specific/linux/bluez/default.nix
+++ b/pkgs/os-specific/linux/bluez/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, pkgconfig, dbus, glib, alsaLib,
-  pythonPackages, readline, udev, libical,
+  python3, readline, udev, libical,
   systemd, enableWiimote ? false, enableMidi ? false }:
 
 stdenv.mkDerivation rec {
@@ -10,12 +10,12 @@ stdenv.mkDerivation rec {
     sha256 = "048r91vx9gs5nwwbah2s0xig04nwk14c5s0vb7qmaqdvighsmz2z";
   };
 
-  pythonPath = with pythonPackages; [
+  pythonPath = with python3.pkgs; [
     dbus-python pygobject2 pygobject3 recursivePthLoader
   ];
 
   buildInputs = [
-    dbus glib alsaLib pythonPackages.python pythonPackages.wrapPython
+    dbus glib alsaLib python3 python3.pkgs.wrapPython
     readline udev libical
   ];
 
diff --git a/pkgs/os-specific/linux/btfs/default.nix b/pkgs/os-specific/linux/btfs/default.nix
index 83c442618b8..9c2692b037e 100644
--- a/pkgs/os-specific/linux/btfs/default.nix
+++ b/pkgs/os-specific/linux/btfs/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub, autoreconfHook, pkgconfig,
-  python, boost, fuse, libtorrentRasterbar, curl }:
+  python3, boost, fuse, libtorrentRasterbar, curl }:
 
 stdenv.mkDerivation rec {
   name = "btfs-${version}";
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
 
   preInstall = ''
     substituteInPlace scripts/btplay \
-      --replace "/usr/bin/env python" "${python}/bin/python"
+      --replace "/usr/bin/env python" "${python3.interpreter}"
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/os-specific/linux/firmware/broadcom-bt-firmware/default.nix b/pkgs/os-specific/linux/firmware/broadcom-bt-firmware/default.nix
index 01609c8779d..a57a6f1d70f 100644
--- a/pkgs/os-specific/linux/firmware/broadcom-bt-firmware/default.nix
+++ b/pkgs/os-specific/linux/firmware/broadcom-bt-firmware/default.nix
@@ -27,11 +27,15 @@ stdenv.mkDerivation rec {
       linkname=$(basename $filename | awk 'match($0,/^(BCM)[0-9A-Z]+(-[0-9a-z]{4}-[0-9a-z]{4}\.hcd)$/,c) { print c[1]c[2] }')
       if ! [ -z $linkname ]
       then
-        ln -s -T $filename $out/lib/firmware/brcm/$linkname
+        ln -s --relative -T $filename $out/lib/firmware/brcm/$linkname
       fi
     done
   '';
 
+  outputHashMode = "recursive";
+  outputHashAlgo = "sha256";
+  outputHash = "042frb2dmrqfj8q83h5p769q6hg2b3i8fgnyvs9r9a71z7pbsagq";
+
   meta = with stdenv.lib; {
     description = "Firmware for Broadcom WIDCOMM® Bluetooth devices";
     homepage = http://www.catalog.update.microsoft.com/Search.aspx?q=Broadcom+bluetooth;
diff --git a/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix b/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix
index 47d56cbf796..47fe2e446c3 100644
--- a/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix
+++ b/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix
@@ -10,15 +10,15 @@ stdenv.mkDerivation rec {
     sha256 = "110vxgahyx5dvylqrxsm5cmx4a32cl2zchvm6cgc270jz75fg7wd";
   };
 
-  preInstall = ''
-    mkdir -p $out
-  '';
-
   installFlags = [ "DESTDIR=$(out)" ];
 
   # Firmware blobs do not need fixing and should not be modified
   dontFixup = true;
 
+  outputHashMode = "recursive";
+  outputHashAlgo = "sha256";
+  outputHash = "0r2g91hc7csp2fbp2ny4s4rwv0mw2m130gpnisxnhzi05hkwki66";
+
   meta = with stdenv.lib; {
     description = "Binary firmware collection packaged by kernel.org";
     homepage = http://packages.debian.org/sid/firmware-linux-nonfree;
diff --git a/pkgs/os-specific/linux/firmware/fwupd/default.nix b/pkgs/os-specific/linux/firmware/fwupd/default.nix
index 646c18860c5..fec1b3ed6f0 100644
--- a/pkgs/os-specific/linux/firmware/fwupd/default.nix
+++ b/pkgs/os-specific/linux/firmware/fwupd/default.nix
@@ -1,40 +1,48 @@
 { stdenv, fetchurl, fetchpatch, gtk-doc, pkgconfig, gobjectIntrospection, intltool
 , libgudev, polkit, appstream-glib, gusb, sqlite, libarchive, glib-networking
 , libsoup, help2man, gpgme, libxslt, elfutils, libsmbios, efivar, glibcLocales
-, fwupdate, libyaml, valgrind, meson, libuuid, colord, docbook_xml_dtd_43, docbook_xsl
-, ninja, gcab, gnutls, python3, wrapGAppsHook, json-glib
-, shared-mime-info, umockdev
+, gnu-efi, libyaml, valgrind, meson, libuuid, colord, docbook_xml_dtd_43, docbook_xsl
+, ninja, gcab, gnutls, python3, wrapGAppsHook, json-glib, bash-completion
+, shared-mime-info, umockdev, vala, makeFontsConf, freefont_ttf
 }:
 let
   # Updating? Keep $out/etc synchronized with passthru.filesInstalledToEtc
-  version = "1.0.5";
+  version = "1.1.0";
   python = python3.withPackages (p: with p; [ pygobject3 pycairo pillow ]);
   installedTestsPython = python3.withPackages (p: with p; [ pygobject3 requests ]);
+
+  fontsConf = makeFontsConf {
+    fontDirectories = [ freefont_ttf ];
+  };
 in stdenv.mkDerivation {
   name = "fwupd-${version}";
   src = fetchurl {
     url = "https://people.freedesktop.org/~hughsient/releases/fwupd-${version}.tar.xz";
-    sha256 = "0wm195vkf6x1kg1dz0sbfwpdcn9f6638l7vyzplcfrb3v07pqxpq";
+    sha256 = "0flfpzb0fxgixxddpwak4s63i35kr915pdfq5mfrnxq4bwcj24yd";
   };
 
-  outputs = [ "out" "devdoc" "man" "installedTests" ];
+  outputs = [ "out" "lib" "dev" "devdoc" "man" "installedTests" ];
 
   nativeBuildInputs = [
     meson ninja gtk-doc pkgconfig gobjectIntrospection intltool glibcLocales shared-mime-info
-    valgrind gcab docbook_xml_dtd_43 docbook_xsl help2man libxslt python wrapGAppsHook
+    valgrind gcab docbook_xml_dtd_43 docbook_xsl help2man libxslt python wrapGAppsHook vala
   ];
   buildInputs = [
-    polkit appstream-glib gusb sqlite libarchive libsoup elfutils libsmbios fwupdate libyaml
+    polkit appstream-glib gusb sqlite libarchive libsoup elfutils libsmbios gnu-efi libyaml
     libgudev colord gpgme libuuid gnutls glib-networking efivar json-glib umockdev
+    bash-completion
   ];
 
   LC_ALL = "en_US.UTF-8"; # For po/make-images
 
   patches = [
-    ./fix-missing-deps.patch
+    ./fix-paths.patch
+
+    # Allow localedir in lib output
+    # https://github.com/hughsie/fwupd/pull/626
     (fetchpatch {
-      url = https://github.com/hughsie/fwupd/commit/767210e4b1401d5d5bb7ac1e7c052a60b6529d88.patch;
-      sha256 = "00adfabxpgdg74jx7i6jihhh8njjk2r7v3fxqs4scj3vn06k5fmw";
+      url = https://github.com/hughsie/fwupd/commit/9822c387ea13419a0eb2624fcd13d50735cb89f8.patch;
+      sha256 = "12bk6ga2hvsswpc4gal95l2z5a6gp3vdjq16zm2npligcvf37b6i";
     })
   ];
 
@@ -47,7 +55,8 @@ in stdenv.mkDerivation {
     substituteInPlace data/installed-tests/fwupdmgr.test.in --subst-var-by installedtestsdir "$installedTests/share/installed-tests/fwupd"
   '';
 
-  doCheck = true;
+  # /etc/os-release not available in sandbox
+  # doCheck = true;
 
   preFixup = ''
     gappsWrapperArgs+=(--prefix XDG_DATA_DIRS : "${shared-mime-info}/share")
@@ -55,18 +64,29 @@ in stdenv.mkDerivation {
 
   mesonFlags = [
     "-Dplugin_dummy=true"
-    "-Dbootdir=/boot"
     "-Dudevdir=lib/udev"
     "-Dsystemdunitdir=lib/systemd/system"
+    "-Defi-libdir=${gnu-efi}/lib"
+    "-Defi-ldsdir=${gnu-efi}/lib"
+    "-Defi-includedir=${gnu-efi}/include/efi"
     "--localstatedir=/var"
   ];
 
+  # TODO: We need to be able to override the directory flags from meson setup hook
+  # better – declaring them multiple times might become an error.
+  preConfigure = ''
+    mesonFlagsArray+=("--libexecdir=$out/libexec")
+  '';
+
   postInstall = ''
     moveToOutput share/installed-tests "$installedTests"
     wrapProgram $installedTests/share/installed-tests/fwupd/hardware.py \
       --prefix GI_TYPELIB_PATH : "$out/lib/girepository-1.0:${libsoup}/lib/girepository-1.0"
   '';
 
+  FONTCONFIG_FILE = fontsConf; # Fontconfig error: Cannot load default config file
+
+  # /etc/fwupd/uefi.conf is created by the services.hardware.fwupd NixOS module
   passthru = {
     filesInstalledToEtc = [
       "fwupd/remotes.d/fwupd.conf"
@@ -74,8 +94,10 @@ in stdenv.mkDerivation {
       "fwupd/remotes.d/lvfs.conf"
       "fwupd/remotes.d/vendor.conf"
       "pki/fwupd/GPG-KEY-Hughski-Limited"
+      "pki/fwupd/GPG-KEY-Linux-Foundation-Metadata"
       "pki/fwupd/GPG-KEY-Linux-Vendor-Firmware-Service"
       "pki/fwupd/LVFS-CA.pem"
+      "pki/fwupd-metadata/GPG-KEY-Linux-Foundation-Metadata"
       "pki/fwupd-metadata/GPG-KEY-Linux-Vendor-Firmware-Service"
       "pki/fwupd-metadata/LVFS-CA.pem"
     ];
diff --git a/pkgs/os-specific/linux/firmware/fwupd/fix-missing-deps.patch b/pkgs/os-specific/linux/firmware/fwupd/fix-paths.patch
index d1d7c06027f..1cd9eb0e8f1 100644
--- a/pkgs/os-specific/linux/firmware/fwupd/fix-missing-deps.patch
+++ b/pkgs/os-specific/linux/firmware/fwupd/fix-paths.patch
@@ -6,7 +6,7 @@
 -)
 --- a/data/meson.build
 +++ b/data/meson.build
-@@ -7,16 +7,12 @@
+@@ -8,16 +8,12 @@
    subdir('installed-tests')
  endif
  
@@ -26,8 +26,8 @@
  install_data(['metadata.xml'],
 --- a/data/pki/meson.build
 +++ b/data/pki/meson.build
-@@ -3,13 +3,13 @@
-       'GPG-KEY-Hughski-Limited',
+@@ -4,14 +4,14 @@
+       'GPG-KEY-Linux-Foundation-Firmware',
        'GPG-KEY-Linux-Vendor-Firmware-Service',
      ],
 -    install_dir : join_paths(sysconfdir, 'pki', 'fwupd')
@@ -35,6 +35,7 @@
    )
  
    install_data([
+       'GPG-KEY-Linux-Foundation-Metadata',
        'GPG-KEY-Linux-Vendor-Firmware-Service',
      ],
 -    install_dir : join_paths(sysconfdir, 'pki', 'fwupd-metadata')
@@ -42,7 +43,7 @@
    )
  endif
  
-@@ -17,12 +17,12 @@
+@@ -19,12 +19,12 @@
    install_data([
        'LVFS-CA.pem',
      ],
@@ -66,9 +67,9 @@
 -    install_dir : join_paths(sysconfdir, 'fwupd', 'remotes.d')
 +    install_dir : join_paths(get_option('prefix'), 'etc', 'fwupd', 'remotes.d')
    )
- endif
- 
-@@ -19,12 +19,12 @@
+   i18n.merge_file(
+     input: 'lvfs.metainfo.xml',
+@@ -37,12 +37,12 @@
    output : 'fwupd.conf',
    configuration : con2,
    install: true,
@@ -92,13 +93,3 @@
 -    echo 'Creating stateful directory'
 -    mkdir -p ${DESTDIR}${LOCALSTATEDIR}/lib/fwupd
  #fi
---- a/po/make-images.sh
-+++ b/po/make-images.sh
-@@ -7,6 +7,7 @@
- #
- install -m 0755 -d ${MESON_INSTALL_DESTDIR_PREFIX}/share/locale/
- ${MESON_SOURCE_ROOT}/po/make-images "Installing firmware update…" ${MESON_INSTALL_DESTDIR_PREFIX}/share/locale/ ${MESON_SOURCE_ROOT}/po/LINGUAS
-+shopt -s nullglob
- for x in ${MESON_INSTALL_DESTDIR_PREFIX}/share/locale/*/LC_IMAGES/*.bmp ; do
-     gzip -f ${x}
- done
diff --git a/pkgs/os-specific/linux/firmware/intel2200BGFirmware/default.nix b/pkgs/os-specific/linux/firmware/intel2200BGFirmware/default.nix
index bf8bcf38726..372be2d71f2 100644
--- a/pkgs/os-specific/linux/firmware/intel2200BGFirmware/default.nix
+++ b/pkgs/os-specific/linux/firmware/intel2200BGFirmware/default.nix
@@ -1,35 +1,25 @@
-{ stdenv, fetchurl }:
+{ lib, fetchzip }:
 
 let version = "3.1"; in
 
-stdenv.mkDerivation {
+fetchzip {
   name = "intel2200BGFirmware-${version}";
+  url = "https://src.fedoraproject.org/repo/pkgs/ipw2200-firmware/ipw2200-fw-${version}.tgz/eaba788643c7cc7483dd67ace70f6e99/ipw2200-fw-${version}.tgz";
+  sha256 = "0zjyjndyc401pn5x5lgypxdal21n82ymi3vbb2ja1b89yszj432b";
 
-  src = fetchurl {
-    url = "https://src.fedoraproject.org/repo/pkgs/ipw2200-firmware/ipw2200-fw-${version}.tgz/eaba788643c7cc7483dd67ace70f6e99/ipw2200-fw-${version}.tgz";
-    sha256 = "c6818c11c18cc030d55ff83f64b2bad8feef485e7742f84f94a61d811a6258bd";
-  };
-
-  phases = [ "unpackPhase" "installPhase" ];
-
-  installPhase = ''
-    mkdir -p $out/lib/firmware
-    for fw in \
-      ipw2200-bss.fw \
-      ipw2200-ibss.fw \
-      ipw2200-sniffer.fw
-    do
-      cp -f $fw $out/lib/firmware/$fw
-    done
-    mkdir -p $out/share/doc/intel2200BGFirmware
-    cp -f LICENSE.ipw2200-fw $out/share/doc/intel2200BGFirmware/LICENSE
+  postFetch = ''
+    tar -xzvf $downloadedFile --strip-components=1
+    install -D -m644 ipw2200-bss.fw     $out/lib/firmware/ipw2200-bss.fw
+    install -D -m644 ipw2200-ibss.fw    $out/lib/firmware/ipw2200-ibss.fw
+    install -D -m644 ipw2200-sniffer.fw $out/lib/firmware/ipw2200-sniffer.fw
+    install -D -m644 LICENSE.ipw2200-fw $out/share/doc/intel2200BGFirmware/LICENSE
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Firmware for Intel 2200BG cards";
     homepage = http://ipw2200.sourceforge.net/firmware.php;
-    license = stdenv.lib.licenses.unfreeRedistributableFirmware;
+    license = licenses.unfreeRedistributableFirmware;
     maintainers = with maintainers; [ sternenseemann ];
-    platforms = with platforms; linux;
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/firmware/raspberrypi-wireless/default.nix b/pkgs/os-specific/linux/firmware/raspberrypi-wireless/default.nix
index 0918279cc9a..eb5b0bd294c 100644
--- a/pkgs/os-specific/linux/firmware/raspberrypi-wireless/default.nix
+++ b/pkgs/os-specific/linux/firmware/raspberrypi-wireless/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl }:
+{ stdenv, fetchurl, dpkg }:
 
 stdenv.mkDerivation rec {
   name = "raspberrypi-wireless-firmware-${version}";
@@ -20,11 +20,12 @@ stdenv.mkDerivation rec {
   # Firmware blobs do not need fixing and should not be modified
   dontFixup = true;
 
+
   # Unpack the debian package
+  nativeBuildInputs = [ dpkg ];
   unpackCmd = ''
     if ! [[ "$curSrc" =~ \.deb$ ]]; then return 1; fi
-    ar -xf "$curSrc"
-    tar -xf data.tar.xz
+    dpkg -x "$curSrc" .
   '';
 
   installPhase = ''
@@ -39,6 +40,10 @@ stdenv.mkDerivation rec {
     cp broadcom/*.hcd "$out/lib/firmware/brcm"
   '';
 
+  outputHashMode = "recursive";
+  outputHashAlgo = "sha256";
+  outputHash = "1gwzasl5w5nc0awqv3w2081ns63wd1yds0xh0dg95dc6brnqhhf8";
+
   meta = with stdenv.lib; {
     description = "Firmware for builtin Wifi/Bluetooth devices in the Raspberry Pi 3 and Zero W";
     homepage = https://archive.raspberrypi.org/debian/pool/main/f/firmware-nonfree/;
diff --git a/pkgs/os-specific/linux/firmware/zd1211/default.nix b/pkgs/os-specific/linux/firmware/zd1211/default.nix
index e28a85ab0b2..2c9db47539f 100644
--- a/pkgs/os-specific/linux/firmware/zd1211/default.nix
+++ b/pkgs/os-specific/linux/firmware/zd1211/default.nix
@@ -1,23 +1,20 @@
-{ stdenv, fetchurl }:
+{ stdenv, fetchzip }:
 
-stdenv.mkDerivation rec {
+let
   pname = "zd1211-firmware";
   version = "1.5";
-
+in fetchzip rec {
   name = "${pname}-${version}";
+  url = "mirror://sourceforge/zd1211/${name}.tar.bz2";
 
-  src = fetchurl {
-    url = "mirror://sourceforge/zd1211/${name}.tar.bz2";
-    sha256 = "04ibs0qw8bh6h6zmm5iz6lddgknwhsjq8ib3gyck6a7psw83h7gi";
-  };
-
-  dontBuild = true;
-
-  installPhase = ''
+  postFetch = ''
+    tar -xjvf $downloadedFile
     mkdir -p $out/lib/firmware/zd1211
-    cp * $out/lib/firmware/zd1211
+    cp zd1211-firmware/* $out/lib/firmware/zd1211
   '';
 
+  sha256 = "0sj2zl3r0549mjz37xy6iilm1hm7ak5ax02gwrn81r5yvphqzd52";
+
   meta = {
     description = "Firmware for the ZyDAS ZD1211(b) 802.11a/b/g USB WLAN chip";
     homepage = https://sourceforge.net/projects/zd1211/;
diff --git a/pkgs/os-specific/linux/fwts/default.nix b/pkgs/os-specific/linux/fwts/default.nix
index 40d6967c66f..e54ab7bcba7 100644
--- a/pkgs/os-specific/linux/fwts/default.nix
+++ b/pkgs/os-specific/linux/fwts/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   name = "fwts-${version}";
-  version = "18.06.02";
+  version = "18.07.00";
 
   src = fetchzip {
     url = "http://fwts.ubuntu.com/release/fwts-V${version}.tar.gz";
-    sha256 = "1j7yn3qyy9baylhjvr9j8hiyl1nc7la1j4fffvxk8qvxakwxbyl2";
+    sha256 = "11fc26k1k98i1rv1jw9ahbbal7p7cl6wxy967a7ixs330q5ry1lb";
     stripRoot = false;
   };
 
diff --git a/pkgs/os-specific/linux/hwdata/default.nix b/pkgs/os-specific/linux/hwdata/default.nix
index 2b296ebabca..f5f73255d29 100644
--- a/pkgs/os-specific/linux/hwdata/default.nix
+++ b/pkgs/os-specific/linux/hwdata/default.nix
@@ -1,12 +1,14 @@
-{ stdenv, fetchurl }:
+{ stdenv, fetchFromGitHub }:
 
 stdenv.mkDerivation rec {
   name = "hwdata-${version}";
   version = "0.313";
 
-  src = fetchurl {
-    url = "https://github.com/vcrhonek/hwdata/archive/v0.313.tar.gz";
-    sha256 = "0x0qk2cim1mv8cl8h8rwqn8mbbs43j04rn06m81b531i182zii17";
+  src = fetchFromGitHub {
+    owner = "vcrhonek";
+    repo = "hwdata";
+    rev = "v${version}";
+    sha256 = "1mmqiy4ams14mdiakz60dm07wfan343hisiiz0dwvh685mjxap8h";
   };
 
   preConfigure = "patchShebangs ./configure";
@@ -15,6 +17,10 @@ stdenv.mkDerivation rec {
 
   doCheck = false; # this does build machine-specific checks (e.g. enumerates PCI bus)
 
+  outputHashMode = "recursive";
+  outputHashAlgo = "sha256";
+  outputHash = "0lz8pykpfw6aqkpdaqdc3jnny1iqgsqnc0wm61784xxml7zqfdvx";
+
   meta = {
     homepage = https://github.com/vcrhonek/hwdata;
     description = "Hardware Database, including Monitors, pci.ids, usb.ids, and video cards";
diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix
index d8040fbf3bf..9c9957d2193 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.14.60";
+  version = "4.14.61";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "15djfcl4m388vm3wkfa6yx0sglyp8zh04s7m7xa1ybmsiwjl7qbc";
+    sha256 = "1s3h3js073h4ww2dryip91d2lvmgv439ly2vya9x7rvilwhwa3hd";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.17.nix b/pkgs/os-specific/linux/kernel/linux-4.17.nix
index 6004577fad6..b98cf98904e 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.17.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.17.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.17.12";
+  version = "4.17.13";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "18xmkj1bmfrmvx6p8cl5l7pyv0zk5y3mxhyfnlzqwkxnvkjf5660";
+    sha256 = "0x1zas3jwvhjkifh20cwpd2g0glgr8m7h8lqng7awrd116xkw2w2";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix
index 8bb2d53da9e..60a4d5a76ed 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.4.145";
+  version = "4.4.146";
   extraMeta.branch = "4.4";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1max0d1b1y1ndrfprrcyb7c9y12pkx2whxzlr70qypcb5jz0v7ff";
+    sha256 = "1xbxw6yvbjam0xj8j44h730dpf5v94pcf9j7iivcmasgjp61120z";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
index 231e24be911..1863aadf8f1 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.9.117";
+  version = "4.9.118";
   extraMeta.branch = "4.9";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1c3r0a4fchg358zff2ww8kw789kah3bhr750p9qlsy65d8rflcl2";
+    sha256 = "0myx79rmxgjbr87r815vybmbg6iqgd3nycildrpwsh301kj8kxvx";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix b/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix
index 1366a11b573..1fb9866f4e9 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix
@@ -1,22 +1,21 @@
 { stdenv, buildPackages, hostPlatform, fetchgit, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.15.2018.04.14";
-  modDirVersion = "4.15.0";
-  extraMeta.branch = "master";
-  extraMeta.maintainers = [ stdenv.lib.maintainers.davidak stdenv.lib.maintainers.chiiruno ];
+  version = "4.16.2018.08.03";
+  modDirVersion = "4.16.0";
 
   src = fetchgit {
     url = "https://evilpiepirate.org/git/bcachefs.git";
-    rev = "3b7c824e9330a640312fce1b04537c684c1d602c";
-    sha256 = "1l5ib28qkhrxggn6zj9b2839543anbxk2ip75yizgzlv9vr5m4pk";
+    rev = "e7a00a52b57336c04d1043c6fa0a67a7c8301cfb";
+    sha256 = "1a0kvpazvvh0rfb9hkyr4zw55ndh060j95fvhf2aaaj9qyc7p7wp";
   };
 
-  extraConfig = ''
-    BCACHEFS_FS m
-  '';
+  extraConfig = "BCACHEFS_FS m";
 
-  # Should the testing kernels ever be built on Hydra?
-  extraMeta.hydraPlatforms = [];
+  extraMeta = {
+    branch = "master";
+    hydraPlatforms = []; # Should the testing kernels ever be built on Hydra?
+    maintainers = with stdenv.lib.maintainers; [ davidak chiiruno ];
+  };
 
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-testing.nix b/pkgs/os-specific/linux/kernel/linux-testing.nix
index ec4d9c29dbc..ec3baaf1e0a 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing.nix
@@ -1,13 +1,13 @@
 { stdenv, buildPackages, hostPlatform, fetchurl, perl, buildLinux, libelf, utillinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.18-rc7";
-  modDirVersion = "4.18.0-rc7";
+  version = "4.18-rc8";
+  modDirVersion = "4.18.0-rc8";
   extraMeta.branch = "4.18";
 
   src = fetchurl {
     url = "https://git.kernel.org/torvalds/t/linux-${version}.tar.gz";
-    sha256 = "005kk7rxawkka60y31a5aiqrq3w6i1k27b5n2lcq63agjcxh54rq";
+    sha256 = "0rqyqms63c15iwcwy40yqd9fvlvh3ah09gddv0wf45z9dqp7id1m";
   };
 
   # Should the testing kernels ever be built on Hydra?
diff --git a/pkgs/os-specific/linux/kernel/patches.nix b/pkgs/os-specific/linux/kernel/patches.nix
index 1a365046f5f..143671428c4 100644
--- a/pkgs/os-specific/linux/kernel/patches.nix
+++ b/pkgs/os-specific/linux/kernel/patches.nix
@@ -48,17 +48,6 @@ rec {
     };
   };
 
-  # https://patchwork.kernel.org/patch/9626797/
-  # Should be included in 4.17, so this patch can be dropped when 4.16 becomes obsolete.
-  bcm2835_mmal_v4l2_camera_driver = rec {
-    name = "bcm2835_mmal_v4l2_camera_driver";
-    patch = fetchpatch {
-      name = name + ".patch";
-      url = https://patchwork.kernel.org/patch/9626797/raw/;
-      sha256 = "0iwb0yxsf95zv4qxkvlvhqfmzx0rk13g9clvxsharvwkb4w5lwa0";
-    };
-  };
-
   # https://github.com/NixOS/nixpkgs/issues/42755
   xen-netfront_fix_mismatched_rtnl_unlock = rec {
     name = "xen-netfront_fix_mismatched_rtnl_unlock";
diff --git a/pkgs/os-specific/linux/light/default.nix b/pkgs/os-specific/linux/light/default.nix
index 1c44c0d78a8..d500019c50b 100644
--- a/pkgs/os-specific/linux/light/default.nix
+++ b/pkgs/os-specific/linux/light/default.nix
@@ -1,12 +1,15 @@
-{ stdenv, fetchurl, help2man }:
+{ stdenv, fetchFromGitHub, help2man }:
 
 stdenv.mkDerivation rec {
-  version = "1.0";
+  version = "1.1.2";
   name = "light-${version}";
-  src = fetchurl {
-    url = "https://github.com/haikarainen/light/archive/v${version}.tar.gz";
-    sha256 = "974608ee42ffe85cfd23184306d56d86ec4e6f4b0518bafcb7b3330998b1af64";
+  src = fetchFromGitHub {
+    owner = "haikarainen";
+    repo = "light";
+    rev = version;
+    sha256 = "0c934gxav9cgdf94li6dp0rfqmpday9d33vdn9xb2mfp4war9n4w";
   };
+
   buildInputs = [ help2man ];
 
   installPhase = "mkdir -p $out/bin; cp light $out/bin/";
diff --git a/pkgs/os-specific/linux/powerstat/default.nix b/pkgs/os-specific/linux/powerstat/default.nix
index 5408c4237ec..1031cc9a56e 100644
--- a/pkgs/os-specific/linux/powerstat/default.nix
+++ b/pkgs/os-specific/linux/powerstat/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   name = "powerstat-${version}";
-  version = "0.02.17";
+  version = "0.02.18";
   src = fetchurl {
     url = "http://kernel.ubuntu.com/~cking/tarballs/powerstat/powerstat-${version}.tar.gz";
-    sha256 = "1lxzrvwlf6h35i0d8v1yj1ka63i9i0yvv3adhy3pa3fl8arpvycs";
+    sha256 = "1glryfmq9h7h8hsasg5ffl9vrcbjkkq3xqdxmbdhxmn137w7vgm5";
   };
   installFlags = [ "DESTDIR=$(out)" ];
   postInstall = ''
diff --git a/pkgs/os-specific/linux/sysstat/default.nix b/pkgs/os-specific/linux/sysstat/default.nix
index 0da32371b35..5f3eb22f127 100644
--- a/pkgs/os-specific/linux/sysstat/default.nix
+++ b/pkgs/os-specific/linux/sysstat/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, gettext, bzip2 }:
 
 stdenv.mkDerivation rec {
-  name = "sysstat-11.7.4";
+  name = "sysstat-12.0.1";
 
   src = fetchurl {
     url = "http://perso.orange.fr/sebastien.godard/${name}.tar.xz";
-    sha256 = "144h5fb93s33w3pmgw7qadw1f7c4jq41m5lzcs49ihl44yi6aqm9";
+    sha256 = "114wh7iqi82c0az8wn3dg3y56279fb2wg81v8kvx87mq5975bg51";
   };
 
   buildInputs = [ gettext ];
diff --git a/pkgs/os-specific/linux/wpa_supplicant/default.nix b/pkgs/os-specific/linux/wpa_supplicant/default.nix
index add7c648856..3b19b7bff54 100644
--- a/pkgs/os-specific/linux/wpa_supplicant/default.nix
+++ b/pkgs/os-specific/linux/wpa_supplicant/default.nix
@@ -80,7 +80,8 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./build-fix.patch
-    #KRACKAttack.com
+
+    # KRACKAttack.com
     (fetchurl {
       url = "http://w1.fi/security/2017-1/rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch";
       sha256 = "02zl2x4pxay666yq18g4f3byccrzipfjbky1ydw62v15h76174aj";
@@ -113,6 +114,12 @@ stdenv.mkDerivation rec {
       url = "http://w1.fi/security/2017-1/rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch";
       sha256 = "1ca312cixbld70rp12q7h66lnjjxzz0qag0ii2sg6cllgf2hv168";
     })
+
+    # Unauthenticated EAPOL-Key decryption (CVE-2018-14526)
+    (fetchurl {
+      url = "https://w1.fi/security/2018-1/rebased-v2.6-0001-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch";
+      sha256 = "0z0zxc9wrikmvciyqpdhx0l5v7qsd8c6b5ph9h5rniqllpr3q34n";
+    })
   ];
 
   postInstall = ''