kernel/grsecurity: stable/longterm/testing updates

kernels:

  - longterm: 3.4.87  -> 3.4.88
  - longterm: 3.10.37 -> 3.10.38
  - stable:   3.13.10 -> 3.13.11
  - stable:   3.14.1  -> 3.14.2

grsecurity:

  - test: 3.0-3.14.1-201404241722 -> 3.0-3.14.2-201404270907

NOTE: technically the 3.13 stable kernel is now EOL. However, it will
become the long-term grsecurity stable kernel, and will have ongoing
support from Canonical.

Signed-off-by: Austin Seipp <aseipp@pobox.com>
ats/ats2: clean-up, adopt, add Hydra packages

This also bumps ATS2 to version 0.0.7

Signed-off-by: Austin Seipp <aseipp@pobox.com>
chromium: Fix desktop icon and duplicate entry.

This should fix the desktop icon location for both desktop entries (the
one from the Chromium derivation itself and the wrapper) and renames the
name of the file so that it gets overridden by the wrappers desktop item
so we don't end up having two of them.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
nixpkgs: yices 2.2.1

Signed-off-by: Austin Seipp <aseipp@pobox.com>
psmisc: (from upstream) Typo in fuser makes -M on all the time
hol_light: fix script, upgrade to r189

This also tweaks the version number to just use the SVN revision (rather
than date), since it's unambiguous and increasing anyway.

Signed-off-by: Austin Seipp <aseipp@pobox.com>
nixpkgs: remove cb1cat

Brice Minaud reported a simple attack on the CBEAM Pi permutation
function, resulting in it being withdrawn from CAESAR. :(

Signed-off-by: Austin Seipp <aseipp@pobox.com>
eigen: upgrading version to 3.2.1
libgnurl, a fork of libcurl used by GNUnet
gnunet: add libgnurl and GnuTLS as dependencies

libgnurl is essential for bootstrapping (needed to download a hostlist).
GnuTLS is needed by gnunet-gns-proxy.

Also sort dependencies alphabetically.
Don't mount /sys/fs/fuse/connections and /sys/kernel/config

These fail to mount if you don't have the appropriate kernel support,
and this confuses NixOps' ‘check’ command. We should teach NixOps not
to complain about non-essential mount points, but in the meantime it's
better to turn them off.
switch-to-configuration: Use old systemctl to stop units

Otherwise, when switching from systemd 203 to 212, you get errors like:

  Failed to stop remote-fs.target: Bad message
  Failed to stop systemd-udevd-control.socket: Bad message
  ...
Revert "Don't mount /sys/fs/fuse/connections and /sys/kernel/config"

This reverts commit 6eaced35820f4c575dd545fb721abd74f248c8cb. Doesn't
work very well, e.g. if you actually have the FUSE module loaded. And
in any case it's already fixed in NixOps.
livestreamer: version 1.8.0

A test fails with Python 3.4 so we ignore that one.
Update haskell-http-kit to version 0.2.1

Closes #2430

Signed-off-by: Austin Seipp <aseipp@pobox.com>
Update haskell-base-compat to version 0.5.0

Closes #2431

Signed-off-by: Austin Seipp <aseipp@pobox.com>
polkit: Restart using systemctl

The use of pkill is now particularly bad due to containers (it might
kill processes in containers).
Update release notes
Bump some mentions of 13.10
qemu-image: Remove (obsolete)