Merge branch 'master' into staging

2025-02-20 11:05:14 +00:00 · 2016-10-29 15:25:59 +02:00 · 2016-10-29 15:25:59 +02:00 · e9fee02ff9
commit e9fee02ff9
parent f706ab7dbe ffc6e46dad
83 changed files with 4631 additions and 1952 deletions
--- a/doc/functions.xml
+++ b/doc/functions.xml
@ -57,7 +57,7 @@ in ...</programlisting>
    linkend="sec-modify-via-packageOverrides">config.packageOverrides</link>,
    along with that from previous calls if this function was called repeatedly.
    Now those previous changes will be preserved so this function can be "chained" meaningfully.
-    To recover the old behavior, make sure <varname>config.packageOverrides<varname> is unset,
+    To recover the old behavior, make sure <varname>config.packageOverrides</varname> is unset,
    and call this only once off a "freshly" imported nixpkgs:

    <programlisting>let
--- a/lib/maintainers.nix
+++ b/lib/maintainers.nix
@ -179,6 +179,7 @@
  grahamc = "Graham Christensen <graham@grahamc.com>";
  gridaphobe = "Eric Seidel <eric@seidel.io>";
  guibert = "David Guibert <david.guibert@gmail.com>";
+  guillaumekoenig = "Guillaume Koenig <guillaume.edward.koenig@gmail.com>";
  hakuch = "Jesse Haber-Kucharsky <hakuch@gmail.com>";
  havvy = "Ryan Scheel <ryan.havvy@gmail.com>";
  hbunke = "Hendrik Bunke <bunke.hendrik@gmail.com>";
--- a/nixos/modules/security/grsecurity.nix
+++ b/nixos/modules/security/grsecurity.nix
@ -67,9 +67,9 @@ in
    system.requiredKernelConfig = with config.lib.kernelConfig;
      [ (isEnabled "GRKERNSEC")
        (isEnabled "PAX")
-        (isYES "GRKERNSEC_SYSCTL")
-        (isYES "GRKERNSEC_SYSCTL_DISTRO")
-        (isNO "GRKERNSEC_NO_RBAC")
+        (isYes "GRKERNSEC_SYSCTL")
+        (isYes "GRKERNSEC_SYSCTL_DISTRO")
+        (isNo "GRKERNSEC_NO_RBAC")
      ];

    nixpkgs.config.grsecurity = true;
--- a/nixos/modules/services/mail/opensmtpd.nix
+++ b/nixos/modules/services/mail/opensmtpd.nix
@ -1,17 +1,16 @@
 { config, lib, pkgs, ... }:

-with pkgs;
 with lib;

 let

  cfg = config.services.opensmtpd;
-  conf = writeText "smtpd.conf" cfg.serverConfiguration;
+  conf = pkgs.writeText "smtpd.conf" cfg.serverConfiguration;
  args = concatStringsSep " " cfg.extraServerArgs;

  sendmail = pkgs.runCommand "opensmtpd-sendmail" {} ''
    mkdir -p $out/bin
-    ln -s ${opensmtpd}/sbin/smtpctl $out/bin/sendmail
+    ln -s ${pkgs.opensmtpd}/sbin/smtpctl $out/bin/sendmail
  '';

 in {
@ -48,21 +47,19 @@ in {
      };

      serverConfiguration = mkOption {
-        type = types.string;
-        default = "";
+        type = types.lines;
        example = ''
          listen on lo
          accept for any deliver to lmtp localhost:24
-        ''; 
+        '';
        description = ''
          The contents of the smtpd.conf configuration file. See the
-          OpenSMTPD documentation for syntax information. If this option
-          is left empty, the OpenSMTPD server will not start.
+          OpenSMTPD documentation for syntax information.
        '';
      };

      procPackages = mkOption {
-        type = types.listOf types.path;
+        type = types.listOf types.package;
        default = [];
        description = ''
          Packages to search for filters, tables, queues, and schedulers.
@ -100,12 +97,11 @@ in {
    systemd.services.opensmtpd = let
      procEnv = pkgs.buildEnv {
        name = "opensmtpd-procs";
-        paths = [ opensmtpd ] ++ cfg.procPackages;
+        paths = [ pkgs.opensmtpd ] ++ cfg.procPackages;
        pathsToLink = [ "/libexec/opensmtpd" ];
      };
    in {
      wantedBy = [ "multi-user.target" ];
-      wants = [ "network.target" ];
      after = [ "network.target" ];
      preStart = ''
        mkdir -p /var/spool/smtpd
--- a/nixos/modules/services/networking/cjdns-hosts.sh
+++ b/nixos/modules/services/networking/cjdns-hosts.sh
@ -1,11 +0,0 @@
-pubs=($pubs)
-hosts=($hosts)
-
-lines="''\n"
-for ((i = 0; i < ${#pubs[*]}; i++)); do
-    addr=$($cjdns/bin/publictoip6 ${pubs[i]})
-    lines="${lines}$addr ${hosts[i]}\n"
-done
-lines="${lines}''"
-
-echo -ne $lines > $out
--- a/nixos/modules/services/networking/cjdns.nix
+++ b/nixos/modules/services/networking/cjdns.nix
@ -28,21 +28,18 @@ let
    };
  };

-  peers = mapAttrsToList (n: v: v) (cfg.ETHInterface.connectTo // cfg.UDPInterface.connectTo);
-
-  pubs  = toString (map (p: if p.hostname == "" then "" else p.publicKey) peers);
-  hosts = toString (map (p: if p.hostname == "" then "" else p.hostname)  peers);
-
-  cjdnsHosts =
-    if hosts != "" then
-      import (pkgs.stdenv.mkDerivation {
-        name = "cjdns-hosts";
-        builder = ./cjdns-hosts.sh;
-
-        inherit (pkgs) cjdns;
-        inherit pubs hosts;
-      })
-    else "";
+  # Additional /etc/hosts entries for peers with an associated hostname
+  cjdnsExtraHosts = import (pkgs.runCommand "cjdns-hosts" {}
+    # Generate a builder that produces an output usable as a Nix string value
+    ''
+      exec >$out
+      echo \'\'
+      ${concatStringsSep "\n" (mapAttrsToList (k: v:
+          optionalString (v.hostname != "")
+            "echo $(${pkgs.cjdns}/bin/publictoip6 ${x.key}) ${x.host}")
+          (cfg.ETHInterface.connectTo // cfg.UDPInterface.connectTo))}
+      echo \'\'
+    '');

  parseModules = x:
    x // { connectTo = mapAttrs (name: value: { inherit (value) password publicKey; }) x.connectTo; };
@ -95,8 +92,8 @@ in
      };

      confFile = mkOption {
-        type = types.str;
-        default = "";
+        type = types.nullOr types.path;
+        default = null;
        example = "/etc/cjdroute.conf";
        description = ''
          Ignore all other cjdns options and load configuration from this file.
@ -112,14 +109,14 @@ in
          "49275fut6tmzu354pq70sr5b95qq0vj"
        ];
        description = ''
-          Any remote cjdns nodes that offer these passwords on 
+          Any remote cjdns nodes that offer these passwords on
          connection will be allowed to route through this node.
        '';
      };
-    
+
      admin = {
        bind = mkOption {
-          type = types.string;
+          type = types.str;
          default = "127.0.0.1:11234";
          description = ''
            Bind the administration port to this address and port.
@ -129,7 +126,7 @@ in

      UDPInterface = {
        bind = mkOption {
-          type = types.string;
+          type = types.str;
          default = "";
          example = "192.168.1.32:43211";
          description = ''
@ -154,6 +151,7 @@ in

      ETHInterface = {
        bind = mkOption {
+          type = types.str;
          default = "";
          example = "eth0";
          description =
@ -201,7 +199,7 @@ in

  };

-  config = mkIf config.services.cjdns.enable {
+  config = mkIf cfg.enable {

    boot.kernelModules = [ "tun" ];

@ -212,7 +210,7 @@ in
      wantedBy = [ "multi-user.target" ];
      after = [ "network.target" ];

-      preStart = if cfg.confFile != "" then "" else ''
+      preStart = if cfg.confFile != null then "" else ''
        [ -e /etc/cjdns.keys ] && source /etc/cjdns.keys

        if [ -z "$CJDNS_PRIVATE_KEY" ]; then
@ -228,13 +226,13 @@ in
        fi

        if [ -z "$CJDNS_ADMIN_PASSWORD" ]; then
-            echo "CJDNS_ADMIN_PASSWORD=$(${pkgs.coreutils}/bin/head -c 96 /dev/urandom | ${pkgs.coreutils}/bin/tr -dc A-Za-z0-9)" \
+            echo "CJDNS_ADMIN_PASSWORD=$(tr -dc A-Za-z0-9 </dev/urandom | head -c 96)" \
                >> /etc/cjdns.keys
        fi
      '';

      script = (
-        if cfg.confFile != "" then "${pkg}/bin/cjdroute < ${cfg.confFile}" else
+        if cfg.confFile != null then "${pkg}/bin/cjdroute < ${cfg.confFile}" else
          ''
            source /etc/cjdns.keys
            echo '${cjdrouteConf}' | sed \
@ -247,13 +245,16 @@ in
      serviceConfig = {
        Type = "forking";
        Restart = "on-failure";
+
+        ProtectHome = true;
+        PrivateTmp = true;
      };
    };

-    networking.extraHosts = "${cjdnsHosts}";
+    networking.extraHosts = cjdnsExtraHosts;

    assertions = [
-      { assertion = ( cfg.ETHInterface.bind != "" || cfg.UDPInterface.bind != "" || cfg.confFile != "" );
+      { assertion = ( cfg.ETHInterface.bind != "" || cfg.UDPInterface.bind != "" || cfg.confFile != null );
        message = "Neither cjdns.ETHInterface.bind nor cjdns.UDPInterface.bind defined.";
      }
      { assertion = config.networking.enableIPv6;
--- a/nixos/modules/services/networking/dnscrypt-proxy.nix
+++ b/nixos/modules/services/networking/dnscrypt-proxy.nix
@ -35,7 +35,11 @@ in

  options = {
    services.dnscrypt-proxy = {
-      enable = mkEnableOption "DNSCrypt client proxy";
+      enable = mkOption {
+        default = false;
+        type = types.bool;
+        description = "Whether to enable the DNSCrypt client proxy";
+      };

      localAddress = mkOption {
        default = "127.0.0.1";
--- a/nixos/modules/services/networking/dnscrypt-proxy.xml
+++ b/nixos/modules/services/networking/dnscrypt-proxy.xml
@ -49,8 +49,8 @@
  <para>
    <programlisting>
      {
-      services.dnsmasq.enable = true;
-      services.dnsmasq.servers = [ "127.0.0.1#43" ];
+        services.dnsmasq.enable = true;
+        services.dnsmasq.servers = [ "127.0.0.1#43" ];
      }
    </programlisting>
  </para>
@ -60,12 +60,9 @@
  <para>
    <programlisting>
      {
-      networking.nameservers = [ "127.0.0.1" ];
-      services.unbound.enable = true;
-      services.unbound.forwardAddresses = [ "127.0.0.1@43" ];
-      services.unbound.extraConfig = ''
-        do-not-query-localhost: no
-      '';
+        networking.nameservers = [ "127.0.0.1" ];
+        services.unbound.enable = true;
+        services.unbound.forwardAddresses = [ "127.0.0.1@43" ];
      }
    </programlisting>
  </para>
--- a/nixos/modules/services/x11/xserver.nix
+++ b/nixos/modules/services/x11/xserver.nix
@ -547,19 +547,18 @@ in
        };
      };

-    services.xserver.displayManager.xserverArgs = mkDefault (
-      [ #"-terminate"
+    services.xserver.displayManager.xserverArgs =
+      [ "-terminate"
        "-config ${configFile}"
        "-xkbdir" "${cfg.xkbDir}"
        # Log at the default verbosity level to stderr rather than /var/log/X.*.log.
-        #"-verbose" "3" "-logfile" "/dev/null"
-      ] #++ optional (cfg.display != null) ":${toString cfg.display}"
-        #++ optional (cfg.tty     != null) "vt${toString cfg.tty}"
+        "-verbose" "3" "-logfile" "/dev/null"
+      ] ++ optional (cfg.display != null) ":${toString cfg.display}"
+        ++ optional (cfg.tty     != null) "vt${toString cfg.tty}"
        ++ optional (cfg.dpi     != null) "-dpi ${toString cfg.dpi}"
-        #++ optional (!cfg.enableTCP) "-nolisten tcp");
+        ++ optional (!cfg.enableTCP) "-nolisten tcp"
        ++ optional (cfg.autoRepeatDelay != null) "-ardelay ${toString cfg.autoRepeatDelay}"
-        ++ optional (cfg.autoRepeatInterval != null) "-arinterval ${toString cfg.autoRepeatInterval}"
-);
+        ++ optional (cfg.autoRepeatInterval != null) "-arinterval ${toString cfg.autoRepeatInterval}";

    services.xserver.modules =
      concatLists (catAttrs "modules" cfg.drivers) ++
--- a/nixos/modules/system/boot/stage-1-init.sh
+++ b/nixos/modules/system/boot/stage-1-init.sh
@ -498,8 +498,7 @@ eval "exec $logOutFd>&- $logErrFd>&-"
 #
 # Storage daemons are distinguished by an @ in front of their command line:
 # https://www.freedesktop.org/wiki/Software/systemd/RootStorageDaemons/
-local pidsToKill="$(pgrep -v -f '^@')"
-for pid in $pidsToKill; do
+for pid in $(pgrep -v -f '^@'); do
    # Make sure we don't kill kernel processes, see #15226 and:
    # http://stackoverflow.com/questions/12213445/identifying-kernel-threads
    readlink "/proc/$pid/exe" &> /dev/null || continue
--- a/nixos/tests/virtualbox.nix
+++ b/nixos/tests/virtualbox.nix
@ -11,10 +11,10 @@ let
      #!${pkgs.stdenv.shell} -xe
      export PATH="${lib.makeBinPath [ pkgs.coreutils pkgs.utillinux ]}"

-      mkdir -p /var/run/dbus
+      mkdir -p /run/dbus
      cat > /etc/passwd <<EOF
      root:x:0:0::/root:/bin/false
-      messagebus:x:1:1::/var/run/dbus:/bin/false
+      messagebus:x:1:1::/run/dbus:/bin/false
      EOF
      cat > /etc/group <<EOF
      root:x:0:
--- a/pkgs/applications/audio/groovebasin/default.nix
+++ b/pkgs/applications/audio/groovebasin/default.nix
@ -62,5 +62,8 @@ in nodePackages.buildNodePackage rec {

      Groove Basin supports Last.fm scrobbling.
    '';
+    # groovebasin was built with nodejs 0.10 which reached end of LTS
+    # in October 216, it doesn't built with nodejs 4.x
+    broken = true;
  };
 }
--- a/pkgs/applications/audio/openmpt123/default.nix
+++ b/pkgs/applications/audio/openmpt123/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchurl, SDL2, pkgconfig }:
+{ stdenv, fetchurl, SDL2, pkgconfig, flac, libsndfile }:

 let
  version = "0.2.7025-beta20.1";
@ -8,7 +8,7 @@ in stdenv.mkDerivation rec {
    url = "https://lib.openmpt.org/files/libopenmpt/src/libopenmpt-${version}.tar.gz";
    sha256 = "0qp2nnz6pnl1d7yv9hcjyim7q6yax5881k1jxm8jfgjqagmz5k6p";
  };
-  buildInputs = [ SDL2 pkgconfig ];
+  buildInputs = [ SDL2 pkgconfig flac libsndfile ];
  makeFlags = [ "NO_LTDL=1 TEST=0 EXAMPLES=0" ]
  ++ stdenv.lib.optional (stdenv.isDarwin) "SHARED_SONAME=0";
  installFlags = "PREFIX=\${out}";
--- a/pkgs/applications/editors/eclipse/default.nix
+++ b/pkgs/applications/editors/eclipse/default.nix
@ -20,12 +20,12 @@ rec {
    src =
      if stdenv.system == "x86_64-linux" then
        fetchurl {
-          url = http://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/technology/epp/downloads/release/neon/R/eclipse-cpp-neon-R-linux-gtk-x86_64.tar.gz;
+          url = https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/technology/epp/downloads/release/neon/R/eclipse-cpp-neon-R-linux-gtk-x86_64.tar.gz;
          sha256 = "09fqsgvbjfdqvn7z03crkii34z4bsb34y272q68ib8741bxk0i6m";
        }
      else if stdenv.system == "i686-linux" then
        fetchurl {
-          url = http://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/technology/epp/downloads/release/neon/R/eclipse-cpp-neon-R-linux-gtk.tar.gz;
+          url = https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/technology/epp/downloads/release/neon/R/eclipse-cpp-neon-R-linux-gtk.tar.gz;
          sha256 = "0a12qmqq22v7sbmwn1hjv1zcrkmp64bf0ajmdjljhs9ac79mxn5h";
        }
      else throw "Unsupported system: ${stdenv.system}";
@ -37,12 +37,12 @@ rec {
    src =
      if stdenv.system == "x86_64-linux" then
        fetchurl {
-          url = http://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/technology/epp/downloads/release/indigo/R/eclipse-cpp-indigo-incubation-linux-gtk-x86_64.tar.gz;
+          url = https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/technology/epp/downloads/release/indigo/R/eclipse-cpp-indigo-incubation-linux-gtk-x86_64.tar.gz;
          sha256 = "14ppc9g9igzvj1pq7jl01vwhzb66nmzbl9wsdl1sf3xnwa9wnqk3";
        }
      else
        fetchurl {
-          url = http://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/technology/epp/downloads/release/indigo/R/eclipse-cpp-indigo-incubation-linux-gtk.tar.gz;
+          url = https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/technology/epp/downloads/release/indigo/R/eclipse-cpp-indigo-incubation-linux-gtk.tar.gz;
          sha256 = "1cvg1vgyazrkinwzlvlf0dpl197p4784752srqybqylyj5psdi3b";
        };
  };
@ -56,12 +56,12 @@ rec {
    src =
      if stdenv.system == "x86_64-linux" then
        fetchurl {
-          url = http://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/technology/epp/downloads/release/neon/1a/eclipse-modeling-neon-1a-linux-gtk-x86_64.tar.gz;
+          url = https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/technology/epp/downloads/release/neon/1a/eclipse-modeling-neon-1a-linux-gtk-x86_64.tar.gz;
          sha1 = "3695fd049c4cca2d235f424557e19877795a8183";
        }
      else
        fetchurl {
-          url = http://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/technology/epp/downloads/release/neon/1a/eclipse-modeling-neon-1a-linux-gtk.tar.gz;
+          url = https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/technology/epp/downloads/release/neon/1a/eclipse-modeling-neon-1a-linux-gtk.tar.gz;
          sha1 = "fa0694a0b44e8e9c2301417f84dba45cf9ac6e61";
        };
  };
@ -72,12 +72,12 @@ rec {
    src =
      if stdenv.system == "x86_64-linux" then
        fetchurl {
-          url = http://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/technology/epp/downloads/release/helios/SR2/eclipse-modeling-helios-SR2-incubation-linux-gtk-x86_64.tar.gz;
+          url = https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/technology/epp/downloads/release/helios/SR2/eclipse-modeling-helios-SR2-incubation-linux-gtk-x86_64.tar.gz;
          sha1 = "e96f5f006298f68476f4a15a2be8589158d5cc61";
        }
      else
        fetchurl {
-          url = http://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/technology/epp/downloads/release/helios/SR2/eclipse-modeling-helios-SR2-incubation-linux-gtk.tar.gz;
+          url = https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/technology/epp/downloads/release/helios/SR2/eclipse-modeling-helios-SR2-incubation-linux-gtk.tar.gz;
          sha1 = "696377895bb26445de39d82a916b7e69edb1d939";
        };
  };
@ -92,11 +92,11 @@ rec {
    description = "Eclipse platform";
    sources = {
      "x86_64-linux" = fetchurl {
-          url = http://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops4/R-4.6.1-201609071200/eclipse-SDK-4.6.1-linux-gtk-x86_64.tar.gz;
+          url = https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops4/R-4.6.1-201609071200/eclipse-SDK-4.6.1-linux-gtk-x86_64.tar.gz;
          sha256 = "1mr7sj4whz23iwz5j6mbqd80a39177qv0r7b6cip7dji4n2agl8j";
        };
      "i686-linux" = fetchurl {
-          url = http://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops4/R-4.6.1-201609071200/eclipse-SDK-4.6.1-linux-gtk.tar.gz;
+          url = https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops4/R-4.6.1-201609071200/eclipse-SDK-4.6.1-linux-gtk.tar.gz;
          sha256 = "0kgj0zpgzwx90q13c4mr8swf63azd56532ycxgq2rbs0d1qbl87j";
        };
    };
@ -110,12 +110,12 @@ rec {
    src =
      if stdenv.system == "x86_64-linux" then
        fetchurl { # tested
-          url = http://downloads.typesafe.com/scalaide-pack/4.4.1-vfinal-luna-211-20160504/scala-SDK-4.4.1-vfinal-2.11-linux.gtk.x86_64.tar.gz;
+          url = https://downloads.typesafe.com/scalaide-pack/4.4.1-vfinal-luna-211-20160504/scala-SDK-4.4.1-vfinal-2.11-linux.gtk.x86_64.tar.gz;
          sha256  = "4c2d1ac68384e12a11a851cf0fc7757aea087eba69329b21d539382a65340d27";
        }
      else
        fetchurl { # untested
-          url = http://downloads.typesafe.com/scalaide-pack/4.4.1-vfinal-luna-211-20160504/scala-SDK-4.4.1-vfinal-2.11-linux.gtk.x86.tar.gz;
+          url = https://downloads.typesafe.com/scalaide-pack/4.4.1-vfinal-luna-211-20160504/scala-SDK-4.4.1-vfinal-2.11-linux.gtk.x86.tar.gz;
          sha256 = "35383cb09567187e14a30c15de9fd9aa0eef99e4bbb342396ce3acd11fb5cbac";
        };
  };
@ -127,11 +127,11 @@ rec {
    description = "Eclipse Neon Classic";
    sources = {
      "x86_64-linux" = fetchurl {
-          url = http://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops4/R-4.6.1-201609071200/eclipse-SDK-4.6.1-linux-gtk-x86_64.tar.gz;
+          url = https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops4/R-4.6.1-201609071200/eclipse-SDK-4.6.1-linux-gtk-x86_64.tar.gz;
          sha256 = "1mr7sj4whz23iwz5j6mbqd80a39177qv0r7b6cip7dji4n2agl8j";
        };
      "i686-linux" = fetchurl {
-          url = http://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops4/R-4.6.1-201609071200/eclipse-SDK-4.6.1-linux-gtk.tar.gz;
+          url = https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops4/R-4.6.1-201609071200/eclipse-SDK-4.6.1-linux-gtk.tar.gz;
          sha256 = "0kgj0zpgzwx90q13c4mr8swf63azd56532ycxgq2rbs0d1qbl87j";
        };
    };
@ -142,11 +142,11 @@ rec {
    description = "Eclipse Classic";
    sources = {
      "x86_64-linux" = fetchurl {
-          url = http://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops/R-3.7.2-201202080800/eclipse-SDK-3.7.2-linux-gtk-x86_64.tar.gz;
+          url = https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops/R-3.7.2-201202080800/eclipse-SDK-3.7.2-linux-gtk-x86_64.tar.gz;
          sha256 = "0nf4nv7awhp1k8b1hjb7chpjyjrqnyszsjbc4dlk9phpjv3j4wg5";
        };
      "i686-linux" = fetchurl {
-          url = http://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops/R-3.7.2-201202080800/eclipse-SDK-3.7.2-linux-gtk.tar.gz;
+          url = https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops/R-3.7.2-201202080800/eclipse-SDK-3.7.2-linux-gtk.tar.gz;
          sha256 = "1isn7i45l9kyn2yx6vm88jl1gnxph8ynank0aaa218cg8kdygk7j";
        };
    };
--- a/pkgs/applications/misc/electrum/default.nix
+++ b/pkgs/applications/misc/electrum/default.nix
@ -2,11 +2,11 @@

 pythonPackages.buildPythonApplication rec {
  name = "electrum-${version}";
-  version = "2.7.9";
+  version = "2.7.11";

  src = fetchurl {
    url = "https://download.electrum.org/${version}/Electrum-${version}.tar.gz";
-    sha256 = "0a3bdfcyrq5g3ihck80fqxxyzpj5k9sfax2nsmmwafmzmfqw819h";
+    sha256 = "0qy2ynyw57jgi7fw3xzsyy608yk4bhsda7qfw0j26zqinv52mrsb";
  };

  propagatedBuildInputs = with pythonPackages; [
--- a/pkgs/applications/misc/khal/default.nix
+++ b/pkgs/applications/misc/khal/default.nix
@ -4,12 +4,12 @@ with python3Packages;

 buildPythonApplication rec {
  # Reenable tests for 0.9.0, they are broken at the moment: #15981
-  version = "0.8.2";
+  version = "0.8.4";
  name = "khal-${version}";

  src = fetchurl {
    url = "mirror://pypi/k/khal/khal-${version}.tar.gz";
-    sha256 = "0ihclh3jsxhvq7azgdxbdzwbl7my30cdcg3g5ss5bpm4ivskrzzj";
+    sha256 = "03vy4dp9n43w51mwqjjy08dr5nj7wxqnb085visz3j43vzm42p1f";
  };

  LC_ALL = "en_US.UTF-8";
--- a/pkgs/applications/misc/tnef/tnef/default.nix
+++ b/pkgs/applications/misc/tnef/tnef/default.nix
@ -1,30 +0,0 @@
-{ fetchurl, lib }:
-
-stdenv.mkDerivation rec {
-  version = "1.4.12";
-  name = "tnef-${version}";
-
-  src = fetchFromGitHub {
-    owner = "verdammelt";
-    repo = "tnef";
-    rev = "${version}";
-    sha256 = "0ssi2wpaf7plaswqqjwigppsg5fyh99vdlb9kzl7c9lng89ndq1i";
-  };
-
-  doCheck = true;
-
-  meta = with lib; {
-    description = "Unpacks MIME attachments of type application/ms-tnef";
-    longDescription = ''
-      TNEF is a program for unpacking MIME attachments of type "application/ms-tnef". This is a Microsoft only attachment.
-
-      Due to the proliferation of Microsoft Outlook and Exchange mail servers, more and more mail is encapsulated into this format.
-
-      The TNEF program allows one to unpack the attachments which were encapsulated into the TNEF attachment. Thus alleviating the need to use Microsoft Outlook to view the attachment.
-    '';
-    homepage = https://github.com/verdammelt/tnef;
-    license = licenses.gpl2;
-    maintainers = [ maintainers.DamienCassou ];
-    platforms = platforms.all;
-  };
-}
--- a/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer-11/default.nix
+++ b/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer-11/default.nix
@ -70,11 +70,11 @@ let
 in
 stdenv.mkDerivation rec {
  name = "flashplayer-${version}";
-  version = "11.2.202.637";
+  version = "11.2.202.643";

  src = fetchurl {
    url = "https://fpdownload.macromedia.com/pub/flashplayer/installers/archive/fp_${version}_archive.zip";
-    sha256 = "0xp1pxhrnam4yi8wfwaifqx7m2im0zx2xv8xgbdm0llrzbkc57mh";
+    sha256 = "02imhdzhali42m8d1rw3bqscvi70707mssss7c43dm2kf67z6y8s";
  };

  nativeBuildInputs = [ unzip ];
--- a/pkgs/applications/science/math/pari/unstable.nix
+++ b/pkgs/applications/science/math/pari/unstable.nix
@ -1,12 +1,12 @@
 { stdenv, fetchurl, gmp, readline, perl }:

 stdenv.mkDerivation rec {
-  version = "2.8.0.alpha";
-  name = "pari-${version}";
+  version = "2.8.1.beta";
+  name = "pari-unstable-${version}";

  src = fetchurl {
-    url = "http://pari.math.u-bordeaux.fr/pub/pari/unix/${name}.tar.gz";
-    sha256 = "1nrjybrqv55p669rmlkghb940hzf63vnpn34sbwhy9zlbw3hg305";
+    url = "http://pari.math.u-bordeaux.fr/pub/pari/unstable/pari-${version}.tar.gz";
+    sha256 = "167dcqrqsblqrd7z5pb8jrs9xqm8138mik0s4ihlqcq6c3wndhv1";
  };

  buildInputs = [gmp readline];
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@ -11,13 +11,13 @@ with lib;

 stdenv.mkDerivation rec {
  name = "docker-${version}";
-  version = "1.12.2";
+  version = "1.12.3";

  src = fetchFromGitHub {
    owner = "docker";
    repo = "docker";
    rev = "v${version}";
-    sha256 = "01smz3j55p12z5gkpl945sw49g7aqkxacrlzrlm5px9158z1j74p";
+    sha256 = "0jifd35h22lgh36w1j2k97pgndjh5sppr3cwndlv0saf9618wx5k";
  };

  buildInputs = [
--- a/pkgs/applications/virtualization/virtualbox/default.nix
+++ b/pkgs/applications/virtualization/virtualbox/default.nix
@ -81,7 +81,7 @@ in stdenv.mkDerivation {
  '';

  patches = optional enableHardening ./hardened.patch
-    ++ [ ./libressl.patch ./qtx11extras.patch ];
+    ++ [ ./qtx11extras.patch ];

  postPatch = ''
    sed -i -e 's|/sbin/ifconfig|${nettools}/bin/ifconfig|' \
--- a/pkgs/applications/virtualization/virtualbox/libressl.patch
+++ b/pkgs/applications/virtualization/virtualbox/libressl.patch
@ -1,47 +0,0 @@
-diff --git a/src/VBox/Runtime/common/crypto/digest-builtin.cpp b/src/VBox/Runtime/common/crypto/digest-builtin.cpp
-index 66b4304..1aaceff 100644
--- a/src/VBox/Runtime/common/crypto/digest-builtin.cpp
-+++ b/src/VBox/Runtime/common/crypto/digest-builtin.cpp
-@@ -561,7 +561,7 @@ static PCRTCRDIGESTDESC const g_apDigestOps[] =
-  * OpenSSL EVP.
-  */
- 
-# if OPENSSL_VERSION_NUMBER >= 0x10100000
-+# if OPENSSL_VERSION_NUMBER >= 0x10100000 && !defined(LIBRESSL_VERSION_NUMBER)
- /** @impl_interface_method{RTCRDIGESTDESC::pfnNew} */
- static DECLCALLBACK(void*) rtCrDigestOsslEvp_New(void)
- {
-@@ -597,7 +597,7 @@ static DECLCALLBACK(int) rtCrDigestOsslEvp_Init(void *pvState, void *pvOpaque, b
-     if (fReInit)
-     {
-         pEvpType = EVP_MD_CTX_md(pThis);
-# if OPENSSL_VERSION_NUMBER >= 0x10100000
-+# if OPENSSL_VERSION_NUMBER >= 0x10100000 && !defined(LIBRESSL_VERSION_NUMBER)
-         EVP_MD_CTX_reset(pThis);
- # else
-         EVP_MD_CTX_cleanup(pThis);
-@@ -616,7 +616,7 @@ static DECLCALLBACK(int) rtCrDigestOsslEvp_Init(void *pvState, void *pvOpaque, b
- static DECLCALLBACK(void) rtCrDigestOsslEvp_Delete(void *pvState)
- {
-     EVP_MD_CTX *pThis = (EVP_MD_CTX *)pvState;
-# if OPENSSL_VERSION_NUMBER >= 0x10100000
-+# if OPENSSL_VERSION_NUMBER >= 0x10100000 && !defined(LIBRESSL_VERSION_NUMBER)
-     EVP_MD_CTX_reset(pThis);
- # else
-     EVP_MD_CTX_cleanup(pThis);
-@@ -661,13 +661,13 @@ static RTCRDIGESTDESC const g_rtCrDigestOpenSslDesc =
-     NULL,
-     RTDIGESTTYPE_UNKNOWN,
-     EVP_MAX_MD_SIZE,
-# if OPENSSL_VERSION_NUMBER >= 0x10100000
-+# if OPENSSL_VERSION_NUMBER >= 0x10100000 && !defined(LIBRESSL_VERSION_NUMBER)
-     0,
- # else
-     sizeof(EVP_MD_CTX),
- # endif
-     0,
-# if OPENSSL_VERSION_NUMBER >= 0x10100000
-+# if OPENSSL_VERSION_NUMBER >= 0x10100000 && !defined(LIBRESSL_VERSION_NUMBER)
-     rtCrDigestOsslEvp_New,
-     rtCrDigestOsslEvp_Free,
- # else
--- a/pkgs/applications/virtualization/virtualbox/upstream-info.json
+++ b/pkgs/applications/virtualization/virtualbox/upstream-info.json
@ -1,8 +1,8 @@
 {
  "__NOTE": "Generated using update.py from the same directory.",
-  "extpack": "607ac3636bd49a738d5c48159b39261369b5487f71fb10afa2ecf869627a12de",
-  "extpackRev": "110634",
-  "guest": "cbcf9b9b1000e09911b3d20e1efe529aef8a945cf130f6abffc14a39522cc1ed",
-  "main": "2e0112b0d85841587b8f212e6ba8f6c35b31e1cce6b6999497dc917cd37e6911",
-  "version": "5.1.6"
+  "extpack": "d28bcd01c14eb07eedd2b964d1abe4876f0a7e0e89530e7ba285a5d6267bf322",
+  "extpackRev": "111374",
+  "guest": "347fd39df6ddee8079ad41fbc038e2fb64952a40255d75292e8e49a0a0cbf657",
+  "main": "e447031de468aee746529b2cf60768922f9beff22a13c54284aa430f5e925933",
+  "version": "5.1.8"
 }
--- a/pkgs/applications/window-managers/jwm/default.nix
+++ b/pkgs/applications/window-managers/jwm/default.nix
@ -1,15 +1,17 @@
-{ stdenv, fetchurl, pkgconfig, automake, autoconf, libtool, gettext, which,
-  xorg, libX11, libXext, libXinerama, libXpm, libXft, libXau, libXdmcp,
-  libXmu, libpng, libjpeg, expat, xproto, xextproto, xineramaproto, librsvg,
-  freetype, fontconfig }:
+{ stdenv, fetchFromGitHub, pkgconfig, automake, autoconf, libtool,
+  gettext, which, xorg, libX11, libXext, libXinerama, libXpm, libXft,
+  libXau, libXdmcp, libXmu, libpng, libjpeg, expat, xproto, xextproto,
+  xineramaproto, librsvg, freetype, fontconfig }:

 stdenv.mkDerivation rec {
  name = "jwm-${version}";
-  version = "1548";
+  version = "1563";
  
-  src = fetchurl {
-     url = "https://github.com/joewing/jwm/archive/s${version}.tar.gz";
-     sha256 = "1ih5y7567vwcbnkjwm3cc9iq4n9rzz818mkh6ryli9ld230hla5r";
+  src = fetchFromGitHub {
+    owner = "joewing";
+    repo = "jwm";
+    rev = "s${version}";
+    sha256 = "0xfrsk0cffc0fmlmq1340ylzdcmancn2bwgzv6why3gklxplsp9z";
  };

  nativeBuildInputs = [ pkgconfig automake autoconf libtool gettext which ];
--- a/pkgs/build-support/fetchfile/builder.sh
+++ b/pkgs/build-support/fetchfile/builder.sh
@ -1,11 +0,0 @@
-source $stdenv/setup
-
-echo "copying $pathname into $out..."
-
-cp "$pathname" "$out" || exit 1
-
-actual=$(md5sum -b $out | cut -c1-32)
-if test "$actual" != "$md5"; then
-    echo "hash is $actual, expected $md5"
-    exit 1
-fi
--- a/pkgs/build-support/fetchfile/default.nix
+++ b/pkgs/build-support/fetchfile/default.nix
@ -1,11 +0,0 @@
-{stdenv}: {pathname, md5 ? "", sha256 ? ""}: stdenv.mkDerivation {
-  name = baseNameOf (toString pathname);
-  builder = ./builder.sh;
-  pathname = pathname;
-} // if (sha256 == "") then {
-  md5 = (stdenv.lib.fetchMD5warn "fetchfile" pathname md5);
-  id = md5;
-} else {
-  sha256 = sha256;
-  id = sha256;
-}
--- a/pkgs/data/fonts/mplus-outline-fonts/default.nix
+++ b/pkgs/data/fonts/mplus-outline-fonts/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name = "mplus-${version}";
-  version = "061";
+  version = "062";

  src = fetchurl {
    url = "mirror://sourceforgejp/mplus-fonts/62344/mplus-TESTFLIGHT-${version}.tar.xz";
-    sha256 = "1yrv65l2y8f9jmpalqb5iiay7z1x3754mnqpgp2bax72g8k8728g";
+    sha256 = "1f44vmnma5njhfiz351gwblxmdh9njv486864zrxqaa1h5pvdhha";
  };

  phases = [ "unpackPhase" "installPhase" ];
--- a/pkgs/desktops/gnome-3/3.20/core/epiphany/default.nix
+++ b/pkgs/desktops/gnome-3/3.20/core/epiphany/default.nix
@ -1,6 +1,6 @@
 { stdenv, intltool, fetchurl, pkgconfig, gtk3, glib, nspr, icu
 , bash, wrapGAppsHook, gnome3, libwnck3, libxml2, libxslt, libtool
-, webkitgtk, libsoup, glib_networking, libsecret, gnome_desktop, libnotify, p11_kit
+, webkitgtk214x, libsoup, glib_networking, libsecret, gnome_desktop, libnotify, p11_kit
 , sqlite, gcr, avahi, nss, isocodes, itstool, file, which
 , gdk_pixbuf, librsvg, gnome_common }:

@ -14,8 +14,8 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ pkgconfig file wrapGAppsHook ];

-  buildInputs = [ gtk3 glib intltool libwnck3 libxml2 libxslt pkgconfig file 
-                  webkitgtk libsoup libsecret gnome_desktop libnotify libtool
+  buildInputs = [ gtk3 glib intltool libwnck3 libxml2 libxslt pkgconfig file
+                  webkitgtk214x libsoup libsecret gnome_desktop libnotify libtool
                  sqlite isocodes nss itstool p11_kit nspr icu gnome3.yelp_tools
                  gdk_pixbuf gnome3.defaultIconTheme librsvg which gnome_common
                  gcr avahi gnome3.gsettings_desktop_schemas gnome3.dconf
--- a/pkgs/desktops/gnome-3/3.20/core/epiphany/src.nix
+++ b/pkgs/desktops/gnome-3/3.20/core/epiphany/src.nix
@ -1,10 +1,10 @@
 # Autogenerated by maintainers/scripts/gnome.sh update

 fetchurl: {
-  name = "epiphany-3.20.3";
+  name = "epiphany-3.20.4";

  src = fetchurl {
-    url = mirror://gnome/sources/epiphany/3.20/epiphany-3.20.3.tar.xz;
-    sha256 = "4d9de1bdb44c14adf25aa6dc02ea3de60925cff5eb01fe89545e6032c9b424a2";
+    url = mirror://gnome/sources/epiphany/3.20/epiphany-3.20.4.tar.xz;
+    sha256 = "051av2xcg7ii2y273vqmdkzanygws9qsaq7ks0070y06d4rhl6xy";
  };
 }
--- a/pkgs/development/compilers/opa/default.nix
+++ b/pkgs/development/compilers/opa/default.nix
@ -63,5 +63,8 @@ stdenv.mkDerivation rec {
    license = stdenv.lib.licenses.gpl3;
    maintainers = [ stdenv.lib.maintainers.kkallio ];
    platforms = with stdenv.lib.platforms; linux;
+    # opa was built with nodejs 0.10 which reached end of LTS
+    # in October 216, it doesn't built with nodejs 4.x
+    broken = true;
  };
 }
--- a/pkgs/development/compilers/openjdk/8.nix
+++ b/pkgs/development/compilers/openjdk/8.nix
@ -22,41 +22,41 @@ let
      throw "openjdk requires i686-linux or x86_64 linux";

  update = "122";
-  build = "03";
+  build = "04";
  baseurl = "http://hg.openjdk.java.net/jdk8u/jdk8u";
  repover = "jdk8u${update}-b${build}";
  paxflags = if stdenv.isi686 then "msp" else "m";
  jdk8 = fetchurl {
             url = "${baseurl}/archive/${repover}.tar.gz";
-             sha256 = "0s3igii73s9jpq8prpvfhymiadr7vi15cllkxjrks7khx0brcs6m";
+             sha256 = "1zqqy5gzrx7f438j5pjdavj41plb04p6b1ikspksrgnhs5wrrr02";
          };
  langtools = fetchurl {
             url = "${baseurl}/langtools/archive/${repover}.tar.gz";
-             sha256 = "1x9g3z10mskcv08sdgd1vcm1mf4668ww2s4ivx9spf2vdalk9a4x";
+             sha256 = "0hhsm23mxvjxmf0jxlhm57s203k88s8xbmk71l8zlnjsz88ni4gx";
          };
  hotspot = fetchurl {
             url = "${baseurl}/hotspot/archive/${repover}.tar.gz";
-             sha256 = "1zz0k4grqw57mgcrximq7g7h3c149s1x9b6xcwvvl2f6qn791pn9";
+             sha256 = "1r4a52brsg1xd2dc2b8lzd4w4yvcjdmj9a6avjihx1hpgcs4xzd1";
          };
  corba = fetchurl {
             url = "${baseurl}/corba/archive/${repover}.tar.gz";
-             sha256 = "1xi2yi6wplzfnx213w8zpc78rbclig13m7zl2mgz61ay2l2v8znh";
+             sha256 = "0ixa6kdqkiq83817qdymiy772449iva11rh3pr68qpfnmbx1zzil";
          };
  jdk = fetchurl {
             url = "${baseurl}/jdk/archive/${repover}.tar.gz";
-             sha256 = "01r9cwm68dc34qigl3jn0bifmbgf8jgmddr0wi54sn126pn48c2j";
+             sha256 = "1kw4h3j93cvnlzh0vhj4xxdm90bk7hfg6kpqk09x0a12whh2ww3h";
          };
  jaxws = fetchurl {
             url = "${baseurl}/jaxws/archive/${repover}.tar.gz";
-             sha256 = "043zwvnq9zjnb06xfcbi3rd15ji80z79cdar7hdx0d8ifgd75wsb";
+             sha256 = "0wrj3jyv3922m3pxfg0i9c3ap71b0rass7swvhi996c029rd12r7";
          };
  jaxp = fetchurl {
             url = "${baseurl}/jaxp/archive/${repover}.tar.gz";
-             sha256 = "1ydbwpa4v28npdgla7aiwsfk3k4ylj86vz482zq3j7h30i6w9h4v";
+             sha256 = "0b743mygzdavdd59l98b3l6a03dihs4ipd1xlpkacy778wzpr59d";
          };
  nashorn = fetchurl {
             url = "${baseurl}/nashorn/archive/${repover}.tar.gz";
-             sha256 = "01bpbfwh1ilqn5ls7krmkklsmvl2zhzkqwag49jypiqa0w3vvaih";
+             sha256 = "10wkshhzj15wvx7i53dbkwi85f4fbbxi26zphr5b6daf3ib0hind";
          };
  openjdk8 = stdenv.mkDerivation {
    name = "openjdk-8u${update}b${build}";
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@ -43,7 +43,7 @@ self: super: {
    src = pkgs.fetchFromGitHub {
      owner = "joeyh";
      repo = "git-annex";
-      sha256 = "1j29ydbw86j3qd4qb4l348pcnjd24irgdra9ss2afi6w2pn60yjn";
+      sha256 = "1nd1q5c4jr9s6xczyv464zq4y10rk8c1av22nfb28abrskxagcjc";
      rev = drv.version;
    };
  })).overrideScope (self: super: {
@ -167,6 +167,13 @@ self: super: {
    then addBuildDepend super.halive pkgs.darwin.apple_sdk.frameworks.AppKit
    else super.halive;

+  # Hakyll's tests are broken on Darwin (3 failures); and they require util-linux
+  hakyll = if pkgs.stdenv.isDarwin
+    then dontCheck (overrideCabal super.hakyll (drv: {
+      testToolDepends = [];
+    }))
+    else super.hakyll;
+
  # cabal2nix likes to generate dependencies on hinotify when hfsevents is really required
  # on darwin: https://github.com/NixOS/cabal2nix/issues/146.
  hinotify = if pkgs.stdenv.isDarwin then self.hfsevents else super.hinotify;
@ -456,7 +463,6 @@ self: super: {
  translatable-intset = dontCheck super.translatable-intset;
  ua-parser = dontCheck super.ua-parser;
  unagi-chan = dontCheck super.unagi-chan;
-  wai-app-file-cgi = dontCheck super.wai-app-file-cgi;
  wai-logger = dontCheck super.wai-logger;
  WebBits = dontCheck super.WebBits;                    # http://hydra.cryp.to/build/499604/log/raw
  webdriver = dontCheck super.webdriver;
@ -970,7 +976,7 @@ self: super: {

  # https://github.com/commercialhaskell/stack/issues/2263
  stack = super.stack.overrideScope (self: super: {
-    http-client = self.http-client_0_5_3_2;
+    http-client = self.http-client_0_5_3_3;
    http-client-tls = self.http-client-tls_0_3_3;
    http-conduit = self.http-conduit_2_2_3;
    optparse-applicative = dontCheck self.optparse-applicative_0_13_0_0;
@ -1024,4 +1030,11 @@ self: super: {
  # https://github.com/vshabanov/HsOpenSSL/issues/11
  HsOpenSSL = doJailbreak super.HsOpenSSL;

+  # https://github.com/NixOS/nixpkgs/issues/19612
+  wai-app-file-cgi = (dontCheck super.wai-app-file-cgi).overrideScope (self: super: {
+    http-client = self.http-client_0_5_3_2;
+    http-client-tls = self.http-client-tls_0_3_3;
+    http-conduit = self.http-conduit_2_2_3;
+  });
+
 }
--- a/pkgs/development/haskell-modules/configuration-ghc-8.0.x.nix
+++ b/pkgs/development/haskell-modules/configuration-ghc-8.0.x.nix
@ -60,7 +60,4 @@ self: super: {
    sha256 = "026vv2k3ks73jngwifszv8l59clg88pcdr4mz0wr0gamivkfa1zy";
  });

-  # https://github.com/nkaretnikov/titlecase/issues/6
-  titlecase = doJailbreak super.titlecase;
-
 }
--- a/pkgs/development/haskell-modules/configuration-hackage2nix.yaml
+++ b/pkgs/development/haskell-modules/configuration-hackage2nix.yaml
@ -32,7 +32,7 @@ core-packages:
  - xhtml-3000.2.1

 default-package-overrides:
-  # LTS Haskell 7.4
+  # LTS Haskell 7.5
  - abstract-deque ==0.3
  - abstract-par ==0.3.3
  - AC-Vector ==2.3.2
@ -138,7 +138,7 @@ default-package-overrides:
  - ansi-wl-pprint ==0.6.7.3
  - ansigraph ==0.2.0.0
  - api-field-json-th ==0.1.0.1
-  - app-settings ==0.2.0.8
+  - app-settings ==0.2.0.9
  - appar ==0.1.4
  - apply-refact ==0.3.0.0
  - arbtt ==0.9.0.10
@ -179,7 +179,7 @@ default-package-overrides:
  - base64-bytestring ==1.0.0.1
  - base64-string ==0.2
  - basic-prelude ==0.6.1
-  - bcrypt ==0.0.9
+  - bcrypt ==0.0.10
  - benchpress ==0.2.2.8
  - bencode ==0.6.0.0
  - bento ==0.1.0
@ -192,7 +192,7 @@ default-package-overrides:
  - binary-orphans ==0.1.5.1
  - binary-parser ==0.5.2
  - binary-search ==1.0.0.3
-  - binary-tagged ==0.1.4.0
+  - binary-tagged ==0.1.4.1
  - binary-typed ==1.0
  - bindings-DSL ==1.0.23
  - bindings-GLFW ==3.1.2.2
@ -305,8 +305,8 @@ default-package-overrides:
  - circle-packing ==0.1.0.5
  - clash-lib ==0.6.21
  - clash-prelude ==0.10.14
-  - clash-systemverilog ==0.6.9
-  - clash-verilog ==0.6.9
+  - clash-systemverilog ==0.6.10
+  - clash-verilog ==0.6.10
  - clash-vhdl ==0.6.16
  - classy-prelude ==1.0.0.2
  - classy-prelude-conduit ==1.0.0
@ -428,7 +428,7 @@ default-package-overrides:
  - dependent-sum ==0.3.2.2
  - dependent-sum-template ==0.0.0.5
  - derive ==2.5.26
-  - deriving-compat ==0.3.3
+  - deriving-compat ==0.3.4
  - descriptive ==0.9.4
  - diagrams ==1.3.0.1
  - diagrams-cairo ==1.3.1.1
@ -461,7 +461,7 @@ default-package-overrides:
  - djinn-lib ==0.0.1.2
  - dlist ==0.8.0.2
  - dlist-instances ==0.1.1.1
-  - dns ==2.0.7
+  - dns ==2.0.8
  - do-list ==1.0.1
  - dockerfile ==0.1.0.1
  - docopt ==0.7.0.4
@ -469,7 +469,7 @@ default-package-overrides:
  - doctest-discover ==0.1.0.7
  - doctest-prop ==0.2.0.1
  - docvim ==0.3.2.1
-  - dotenv ==0.3.0.3
+  - dotenv ==0.3.1.0
  - dotnet-timespan ==0.0.1.0
  - double-conversion ==2.0.1.0
  - download ==0.3.2.4
@ -826,7 +826,7 @@ default-package-overrides:
  - heaps ==0.3.3
  - hebrew-time ==0.1.1
  - hedis ==0.9.4
-  - here ==1.2.8
+  - here ==1.2.9
  - heredoc ==0.2.0.0
  - hex ==0.1.2
  - hexstring ==0.11.1
@ -844,7 +844,7 @@ default-package-overrides:
  - histogram-fill ==0.8.4.1
  - hit ==0.6.3
  - hjsmin ==0.2.0.2
-  - hjsonpointer ==1.0.0.1
+  - hjsonpointer ==1.0.0.2
  - hjsonschema ==1.1.0.1
  - hledger ==0.27.1
  - hledger-interest ==1.4.4
@ -892,13 +892,13 @@ default-package-overrides:
  - hsemail ==1.7.7
  - HSet ==0.0.0
  - hset ==2.2.0
-  - hsexif ==0.6.0.9
+  - hsexif ==0.6.0.10
  - hsignal ==0.2.7.4
  - hslogger ==1.2.10
  - hslua ==0.4.1
  - hsndfile ==0.8.0
  - hsndfile-vector ==0.5.2
-  - HsOpenSSL ==0.11.3.1
+  - HsOpenSSL ==0.11.3.2
  - HsOpenSSL-x509-system ==0.1.0.3
  - hsp ==0.10.0
  - hspec ==2.2.3
@ -946,7 +946,7 @@ default-package-overrides:
  - human-readable-duration ==0.2.0.3
  - HUnit ==1.3.1.2
  - HUnit-approx ==1.0
-  - hunit-dejafu ==0.3.0.2
+  - hunit-dejafu ==0.3.0.3
  - hvect ==0.3.1.0
  - hw-bits ==0.1.0.1
  - hw-conduit ==0.0.0.11
@ -958,12 +958,12 @@ default-package-overrides:
  - hweblib ==0.6.3
  - hworker ==0.1.0.1
  - hworker-ses ==0.1.1.0
-  - hxt ==9.3.1.15
+  - hxt ==9.3.1.16
  - hxt-charproperties ==9.2.0.1
  - hxt-css ==0.1.0.3
  - hxt-http ==9.1.5.2
  - hxt-pickle-utils ==0.1.0.3
-  - hxt-regex-xmlschema ==9.2.0.2
+  - hxt-regex-xmlschema ==9.2.0.3
  - hxt-unicode ==9.0.2.4
  - hybrid-vectors ==0.2.1
  - hyphenation ==0.6
@ -1004,7 +1004,7 @@ default-package-overrides:
  - io-storage ==0.3
  - io-streams ==1.3.5.0
  - io-streams-haproxy ==1.0.0.1
-  - ip6addr ==0.5.1.3
+  - ip6addr ==0.5.1.4
  - iproute ==1.7.1
  - IPv6Addr ==0.6.1.0
  - irc ==0.6.1.0
@ -1033,7 +1033,7 @@ default-package-overrides:
  - json-rpc-generic ==0.2.1.2
  - json-schema ==0.7.4.1
  - JuicyPixels ==3.2.8
-  - JuicyPixels-extra ==0.1.0
+  - JuicyPixels-extra ==0.1.1
  - JuicyPixels-scale-dct ==0.1.1.2
  - jwt ==0.7.2
  - kan-extensions ==5.0.1
@ -1261,7 +1261,7 @@ default-package-overrides:
  - openpgp-asciiarmor ==0.1
  - opensource ==0.1.0.0
  - openssl-streams ==1.2.1.0
-  - operational ==0.2.3.3
+  - operational ==0.2.3.4
  - operational-class ==0.3.0.0
  - opml-conduit ==0.5.0.1
  - optional-args ==1.0.1
@ -1274,7 +1274,7 @@ default-package-overrides:
  - osdkeys ==0.0
  - overloaded-records ==0.4.2.0
  - package-description-remote ==0.2.0.0
-  - packdeps ==0.4.2.1
+  - packdeps ==0.4.3
  - pager ==0.1.1.0
  - pagerduty ==0.0.7
  - pagination ==0.1.1
@ -1330,7 +1330,7 @@ default-package-overrides:
  - pipes-cliff ==0.12.0.0
  - pipes-concurrency ==2.0.6
  - pipes-csv ==1.4.3
-  - pipes-extras ==1.0.5
+  - pipes-extras ==1.0.7
  - pipes-fastx ==0.3.0.0
  - pipes-group ==1.0.5
  - pipes-http ==1.0.4
@ -1411,7 +1411,7 @@ default-package-overrides:
  - quickcheck-assertions ==0.2.0
  - quickcheck-combinators ==0.0.1
  - quickcheck-instances ==0.3.12
-  - quickcheck-io ==0.1.3
+  - quickcheck-io ==0.1.4
  - quickcheck-properties ==0.1
  - quickcheck-simple ==0.1.0.1
  - quickcheck-text ==0.1.2.1
@ -1436,7 +1436,7 @@ default-package-overrides:
  - readable ==0.3.1
  - ReadArgs ==1.2.2
  - readline ==1.0.3.0
-  - rebase ==1
+  - rebase ==1.0.2.1
  - redis-io ==0.7.0
  - redis-resp ==0.4.0
  - reducers ==3.12.1
@ -1460,7 +1460,7 @@ default-package-overrides:
  - regex-tdfa ==1.2.2
  - regex-tdfa-text ==1.0.0.3
  - reinterpret-cast ==0.1.0
-  - relational-query ==0.8.3.1
+  - relational-query ==0.8.3.2
  - relational-query-HDBC ==0.6.0.2
  - relational-record ==0.1.5.1
  - relational-schemas ==0.1.3.1
@ -1536,7 +1536,7 @@ default-package-overrides:
  - servant-mock ==0.8.1.1
  - servant-purescript ==0.3.1.5
  - servant-server ==0.8.1
-  - servant-subscriber ==0.5.0.2
+  - servant-subscriber ==0.5.0.3
  - servant-swagger ==1.1.2
  - servant-swagger-ui ==0.2.0.2.1.5
  - servant-yaml ==0.1.0.0
@ -1569,7 +1569,7 @@ default-package-overrides:
  - simple-session ==0.10.1.1
  - simple-smt ==0.6.0
  - simple-templates ==0.8.0.1
-  - singleton-bool ==0.1.1.0
+  - singleton-bool ==0.1.2.0
  - singletons ==2.2
  - siphash ==1.0.3
  - skein ==1.0.9.4
@ -1598,7 +1598,7 @@ default-package-overrides:
  - speculation ==1.5.0.3
  - speedy-slice ==0.1.3
  - sphinx ==0.6.0.1
-  - Spintax ==0.1.0.0
+  - Spintax ==0.1.0.1
  - splice ==0.6.1.1
  - split ==0.2.3.1
  - Spock ==0.11.0.0
@ -1780,7 +1780,7 @@ default-package-overrides:
  - turtle ==1.2.8
  - turtle-options ==0.1.0.4
  - twitter-conduit ==0.2.1
-  - twitter-feed ==0.2.0.10
+  - twitter-feed ==0.2.0.11
  - twitter-types ==0.7.2.2
  - twitter-types-lens ==0.7.2
  - type-aligned ==0.9.6
@ -1865,7 +1865,7 @@ default-package-overrides:
  - wai-conduit ==3.0.0.3
  - wai-cors ==0.2.5
  - wai-eventsource ==3.0.0
-  - wai-extra ==3.0.18
+  - wai-extra ==3.0.19
  - wai-logger ==2.3.0
  - wai-middleware-caching ==0.1.0.2
  - wai-middleware-caching-lru ==0.1.0.0
@ -1904,7 +1904,7 @@ default-package-overrides:
  - weigh ==0.0.3
  - werewolf ==1.5.1.1
  - werewolf-slack ==1.0.2.0
-  - wikicfp-scraper ==0.1.0.4
+  - wikicfp-scraper ==0.1.0.5
  - Win32 ==2.3.1.1
  - Win32-extras ==0.2.0.1
  - Win32-notify ==0.3.0.1
@ -1952,11 +1952,11 @@ default-package-overrides:
  - xss-sanitize ==0.3.5.7
  - yackage ==0.8.1
  - yahoo-finance-api ==0.1.0.0
-  - yaml ==0.8.18.7
+  - yaml ==0.8.20
  - Yampa ==0.10.5
  - YampaSynth ==0.2
  - yarr ==1.4.0.2
-  - yes-precure5-command ==5.5.2
+  - yes-precure5-command ==5.5.3
  - yesod ==1.4.3
  - yesod-auth ==1.4.13.5
  - yesod-auth-account ==1.4.3
@ -4518,7 +4518,7 @@ dont-distribute-packages:
  HROOT-io:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
  HROOT-math:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
  HROOT:                                        [ i686-linux, x86_64-linux, x86_64-darwin ]
-  hruby:                                        [ i686-linux, x86_64-linux, x86_64-darwin ]
+  hruby:                                        [ i686-linux, x86_64-darwin ]
  hs-blake2:                                    [ i686-linux, x86_64-linux, x86_64-darwin ]
  hs-carbon-examples:                           [ i686-linux, x86_64-linux, x86_64-darwin ]
  hs-cdb:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]
--- a/pkgs/development/haskell-modules/hackage-packages.nix
+++ b/pkgs/development/haskell-modules/hackage-packages.nix
--- a/pkgs/development/interpreters/python/cpython/2.7/default.nix
+++ b/pkgs/development/interpreters/python/cpython/2.7/default.nix
@ -39,6 +39,7 @@ let
    sha256 = "0y7rl603vmwlxm6ilkhc51rx2mfj14ckcz40xxgs0ljnvlhp30yp";
  };

+  hasDistutilsCxxPatch = !(stdenv.cc.isGNU or false);
  patches =
    [ # Look in C_INCLUDE_PATH and LIBRARY_PATH for stuff.
      ./search-path.patch
@ -82,7 +83,7 @@ let
      ./2.7.3-dylib.patch
      ./2.7.3-getpath-exe-extension.patch
      ./2.7.3-no-libm.patch
-    ] ++ optionals (!(stdenv.cc.isGNU or false)) [
+    ] ++ optionals hasDistutilsCxxPatch [

      # Patch from http://bugs.python.org/issue1222585 adapted to work with
      # `patch -p1' and with a last hunk removed
@ -180,7 +181,7 @@ in stdenv.mkDerivation {
      '';

    passthru = rec {
-      inherit libPrefix sitePackages x11Support;
+      inherit libPrefix sitePackages x11Support hasDistutilsCxxPatch;
      executable = libPrefix;
      buildEnv = callPackage ../../wrapper.nix { python = self; };
      withPackages = import ../../with-packages.nix { inherit buildEnv; pythonPackages = python27Packages; };
--- a/pkgs/development/libraries/libdwarf/default.nix
+++ b/pkgs/development/libraries/libdwarf/default.nix
@ -1,11 +1,11 @@
 { stdenv, fetchurl, libelf }:

 stdenv.mkDerivation rec {
-  name = "libdwarf-20161001";
+  name = "libdwarf-20161021";

  src = fetchurl {
    url = "http://www.prevanders.net/${name}.tar.gz";
-    sha512 = "2c522ae0b6e2afffd09e2e79562987fd819b197c9bce4900b6a4fd176b5ff229e88c6b755cfbae7831e7160ddeb3bfe2afbf39d756d7e75ec31ace0668554048";
+    sha512 = "733523fd5c58f878d65949c1812b2f46b40c4cc3177bc780c703ec71f83675d4b84e81bc1bcca42adf69b5e122562e4ce8e9a8743af29cc6fafe78ed9f8213fd";
  };

  configureFlags = " --enable-shared --disable-nonshared";
--- a/pkgs/development/libraries/libspatialite/default.nix
+++ b/pkgs/development/libraries/libspatialite/default.nix
@ -1,4 +1,6 @@
-{ stdenv, fetchurl, pkgconfig, libxml2, sqlite, zlib, proj, geos, libiconv }:
+{ stdenv, lib, fetchurl, pkgconfig, libxml2, sqlite, zlib, proj, geos, libiconv }:
+
+with lib;

 stdenv.mkDerivation rec {
  name = "libspatialite-4.2.0";
@ -14,7 +16,11 @@ stdenv.mkDerivation rec {

  enableParallelBuilding = true;

-  meta = with stdenv.lib; {
+  postInstall = "" + optionalString stdenv.isDarwin ''
+    ln -s $out/lib/mod_spatialite.{so,dylib}
+  '';
+
+  meta = {
    description = "Extensible spatial index library in C++";
    homepage = https://www.gaia-gis.it/fossil/libspatialite;
    # They allow any of these
--- a/pkgs/development/libraries/lmdb/default.nix
+++ b/pkgs/development/libraries/lmdb/default.nix
@ -3,11 +3,11 @@
 let optional = stdenv.lib.optional;
 in stdenv.mkDerivation rec {
  name = "lmdb-${version}";
-  version = "0.9.16";
+  version = "0.9.18";

  src = fetchzip {
    url = "https://github.com/LMDB/lmdb/archive/LMDB_${version}.tar.gz";
-    sha256 = "1lkmngscijwiz09gdkqygdp87x55vp8gb4fh4vq7s34k4jv0327l";
+    sha256 = "01j384kxg36kym060pybr5p6mjw0xv33bqbb8arncdkdq57xk8wg";
  };

  postUnpack = "sourceRoot=\${sourceRoot}/libraries/liblmdb";
--- a/pkgs/development/libraries/openldap/default.nix
+++ b/pkgs/development/libraries/openldap/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchurl, openssl, cyrus_sasl, db, groff }:
+{ stdenv, fetchurl, openssl, cyrus_sasl, db, groff, libtool }:

 stdenv.mkDerivation rec {
  name = "openldap-2.4.44";
@ -13,11 +13,12 @@ stdenv.mkDerivation rec {

  enableParallelBuilding = true;

-  buildInputs = [ openssl cyrus_sasl db groff ];
+  buildInputs = [ openssl cyrus_sasl db groff libtool ];

  configureFlags =
    [ "--enable-overlays"
      "--disable-dependency-tracking"   # speeds up one-time build
+      "--enable-modules"
    ] ++ stdenv.lib.optional (openssl == null) "--without-tls"
      ++ stdenv.lib.optional (cyrus_sasl == null) "--without-cyrus-sasl"
      ++ stdenv.lib.optional stdenv.isFreeBSD "--with-pic";
@ -36,6 +37,10 @@ stdenv.mkDerivation rec {
    rm -r libraries/*/.libs
  '';

+  postInstall = ''
+    chmod +x $out/lib/*.so
+  '';
+
  meta = with stdenv.lib; {
    homepage    = http://www.openldap.org/;
    description = "An open source implementation of the Lightweight Directory Access Protocol";
--- a/pkgs/development/libraries/tinyxml/2.6.2.nix
+++ b/pkgs/development/libraries/tinyxml/2.6.2.nix
@ -63,6 +63,8 @@ in stdenv.mkDerivation {
    cp -v tinyxml.pc $out/lib/pkgconfig/

    cp -v docs/* $out/share/doc/tinyxml/
+  '' + stdenv.lib.optionalString stdenv.isDarwin ''
+    install_name_tool -id $out/lib/libtinyxml.dylib $out/lib/libtinyxml.dylib
  '';

  meta = {
--- a/pkgs/development/libraries/webkitgtk/2.14.nix
+++ b/pkgs/development/libraries/webkitgtk/2.14.nix
@ -11,7 +11,7 @@ assert enableGeoLocation -> geoclue2 != null;
 with stdenv.lib;
 stdenv.mkDerivation rec {
  name = "webkitgtk-${version}";
-  version = "2.14.0";
+  version = "2.14.1";

  meta = {
    description = "Web content rendering engine, GTK+ port";
@ -26,14 +26,14 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "http://webkitgtk.org/releases/${name}.tar.xz";
-    sha256 = "02paj0anbnqn1z3hn5c4csmq9nga995rzagiplj3sjk2dj1ss4q5";
+    sha256 = "1dffnz20psgc604azhbzn9a6cdhafar9dw74w3bbwrfy531pcb9f";
  };

  # see if we can clean this up....

  patches = [ ./finding-harfbuzz-icu.patch ];

-  cmakeFlags = [ 
+  cmakeFlags = [
  "-DPORT=GTK"
  "-DUSE_LIBHYPHEN=0"
  "-DENABLE_GLES2=ON"
--- a/pkgs/development/python-modules/numpy.nix
+++ b/pkgs/development/python-modules/numpy.nix
@ -12,7 +12,7 @@ in buildPythonPackage (args // rec {
  buildInputs = args.buildInputs or [ gfortran nose ];
  propagatedBuildInputs = args.propagatedBuildInputs or [ passthru.blas ];

-  patches = lib.optionals isPy27 [
+  patches = lib.optionals (python.hasDistutilsCxxPatch or false) [
    # See cpython 2.7 patches.
    # numpy.distutils is used by cython during it's check phase
    ./numpy-distutils-C++.patch
--- a/pkgs/development/tools/build-managers/sbt/default.nix
+++ b/pkgs/development/tools/build-managers/sbt/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name = "sbt-${version}";
-  version = "0.13.12";
+  version = "0.13.13";

  src = fetchurl {
    url = "https://dl.bintray.com/sbt/native-packages/sbt/${version}/${name}.tgz";
-    sha256 = "1pq3c9nhxbdpx5csmpvjv93nz2z04n2gzzwyd7sllaplqgwk00i8";
+    sha256 = "0ygrz92qkzasj6fps1bjg7wlgl69867jjjc37yjadib0l8hkvl20";
  };

  patchPhase = ''
--- a/pkgs/development/tools/devpi-client/default.nix
+++ b/pkgs/development/tools/devpi-client/default.nix
@ -2,11 +2,11 @@

 pythonPackages.buildPythonApplication rec {
  name = "devpi-client-${version}";
-  version = "2.3.2";
+  version = "2.7.0";

  src = fetchurl {
    url = "mirror://pypi/d/devpi-client/${name}.tar.gz";
-    sha256 = "22484d6a1ccc957d3e4f857e428244fb27c042baedd3bf28fe7522cd89d8ff45";
+    sha256 = "0z7vaf0a66n82mz0vx122pbynjvkhp2mjf9lskgyv09y3bxzzpj3";
  };

  doCheck = false;
--- a/pkgs/development/tools/reno/default.nix
+++ b/pkgs/development/tools/reno/default.nix
@ -0,0 +1,27 @@
+{ stdenv, fetchurl, pythonPackages }:
+
+pythonPackages.buildPythonApplication rec {
+  name = "reno-${version}";
+  version = "1.8.0";
+
+  src = fetchurl {
+    url = "mirror://pypi/r/reno/${name}.tar.gz";
+    sha256 = "1pqg0xzcilmyrrnpa87m11xwlvfc94a98s28z9cgddkhw27lg3ps";
+  };
+
+  # Don't know how to make tests pass
+  doCheck = false;
+
+  # Nothing to strip (python files)
+  dontStrip = true;
+
+  propagatedBuildInputs = with pythonPackages; [ pbr six pyyaml ];
+  buildInputs = with pythonPackages; [ Babel ];
+
+  meta = with stdenv.lib; {
+    description = "Release Notes Manager";
+    homepage    = http://docs.openstack.org/developer/reno/;
+    license     = licenses.asl20;
+    maintainers = with maintainers; [ guillaumekoenig ];
+  };
+}
--- a/pkgs/development/web/nodejs/v0_10.nix
+++ b/pkgs/development/web/nodejs/v0_10.nix
@ -1,75 +0,0 @@
-{ stdenv, lib, fetchurl, openssl, python2, zlib, v8, utillinux, http-parser, c-ares
-, pkgconfig, runCommand, which, libtool
-
-# apple frameworks
-, CoreServices, ApplicationServices, Carbon, Foundation
-}:
-
-let
-  version = "0.10.42";
-
-  # !!! Should we also do shared libuv?
-  deps = {
-    inherit openssl zlib;
-
-    # disabled system v8 because v8 3.14 no longer receives security fixes
-    # we fall back to nodejs' internal v8 copy which receives backports for now
-    # inherit v8
-  } // (stdenv.lib.optionalAttrs (!stdenv.isDarwin) {
-    inherit http-parser;
-  })
-  // ({ cares = c-ares; });
-
-  sharedConfigureFlags = name: let drv = builtins.getAttr name deps; in [
-    "--shared-${name}"
-    "--shared-${name}-includes=${lib.getDev drv}/include"
-    "--shared-${name}-libpath=${lib.getLib drv}/lib"
-  ];
-
-  inherit (stdenv.lib) concatMap optional optionals maintainers licenses platforms;
-in stdenv.mkDerivation {
-  name = "nodejs-${version}";
-
-  src = fetchurl {
-    url = "http://nodejs.org/dist/v${version}/node-v${version}.tar.gz";
-    sha256 = "01g19mq8b3b828f59x7bv79973w5sw4133ll1dxml37qk0vdbhgb";
-  };
-
-  configureFlags = concatMap sharedConfigureFlags (builtins.attrNames deps) ++
-    stdenv.lib.optional stdenv.isDarwin "--without-dtrace";
-
-  prePatch = ''
-    patchShebangs .
-    sed -i 's/raise.*No Xcode or CLT version detected.*/version = "7.0.0"/' deps/npm/node_modules/node-gyp/gyp/pylib/gyp/xcode_emulation.py
-    sed -i 's/raise.*No Xcode or CLT version detected.*/version = "7.0.0"/' tools/gyp/pylib/gyp/xcode_emulation.py
-  '';
-
-  patches = stdenv.lib.optionals stdenv.isDarwin [ ./default-arch.patch ./no-xcode.patch ];
-
-  postPatch = stdenv.lib.optionalString stdenv.isDarwin ''
-    (cd tools/gyp; patch -Np1 -i ${../../python-modules/gyp/no-darwin-cflags.patch})
-  '';
-
-  buildInputs = [ python2 which ]
-    ++ (optional stdenv.isLinux utillinux)
-    ++ optionals stdenv.isDarwin [ pkgconfig openssl libtool CoreServices ApplicationServices Foundation ];
-  propagatedBuildInputs = optionals stdenv.isDarwin [ Carbon ];
-  setupHook = ./setup-hook.sh;
-
-  enableParallelBuilding = true;
-
-  postFixup = ''
-    pushd $out/lib/node_modules/npm/node_modules/node-gyp
-    patch -p2 < ${./no-xcode.patch}
-    popd
-  '';
-
-  passthru.interpreterName = "nodejs-0.10";
-
-  meta = {
-    description = "Event-driven I/O framework for the V8 JavaScript engine";
-    homepage = http://nodejs.org;
-    license = licenses.mit;
-    platforms = platforms.linux ++ platforms.darwin;
-  };
-}
--- a/pkgs/games/openra/default.nix
+++ b/pkgs/games/openra/default.nix
@ -1,10 +1,10 @@
 { stdenv, fetchurl, mono, makeWrapper, lua
 , SDL2, freetype, openal, systemd, pkgconfig,
-  dotnetPackages, gnome3
+  dotnetPackages, gnome3, curl, unzip
 }:

 let
-  version = "20160508";
+  version = "20161019";
 in stdenv.mkDerivation rec {
  name = "openra-${version}";

@ -19,15 +19,15 @@ in stdenv.mkDerivation rec {
  src = fetchurl {
    name = "${name}.tar.gz";
    url = "https://github.com/OpenRA/OpenRA/archive/release-${version}.tar.gz";
-    sha256 = "1vr5bvdkh0n5569ga2h7ggj43vnzr37hfqkfnsis1sg4vgwrnzr7";
+    sha256 = "1psmq3kb2whkavh5pm0xc4m5b4bihvrl8pfrk851iqg1cs22bg0w";
  };

  dontStrip = true;

  buildInputs = with dotnetPackages;
-     [ NUnit3 NewtonsoftJson MonoNat FuzzyLogicLibrary SmartIrc4net SharpZipLib MaxMindGeoIP2 MaxMindDb SharpFont StyleCopMSBuild StyleCopPlusMSBuild RestSharp NUnitConsole ]
-     ++ [ lua gnome3.zenity ];
-  nativeBuildInputs = [ mono makeWrapper lua pkgconfig ];
+     [ NUnit3 NewtonsoftJson MonoNat FuzzyLogicLibrary SmartIrc4net SharpZipLib MaxMindGeoIP2 MaxMindDb SharpFont StyleCopMSBuild StyleCopPlusMSBuild RestSharp NUnitConsole OpenNAT ]
+     ++ [ curl unzip lua gnome3.zenity ];
+  nativeBuildInputs = [ curl unzip mono makeWrapper lua pkgconfig ];

  patchPhase = ''
    mkdir Support
@ -42,6 +42,7 @@ in stdenv.mkDerivation rec {
  '';

  preBuild = let dotnetPackagesDlls = with dotnetPackages; [
+    "${OpenNAT}/lib/dotnet/Open.NAT/net45/Open.Nat.dll"
    "${MonoNat}/lib/dotnet/Mono.Nat/net40/Mono.Nat.dll"
    "${FuzzyLogicLibrary}/lib/dotnet/FuzzyLogicLibrary/Release/FuzzyLogicLibrary.dll"
    "${SmartIrc4net}/lib/dotnet/SmartIrc4net/net40/SmarIrc4net*"
--- a/pkgs/misc/drivers/hplip/default.nix
+++ b/pkgs/misc/drivers/hplip/default.nix
@ -3,7 +3,7 @@
 , cups, zlib, libjpeg, libusb1, pythonPackages, sane-backends, dbus, usbutils
 , net_snmp, openssl, polkit
 , bash, coreutils, utillinux
-, qtSupport ? true, qt4
+, qtSupport ? true
 , withPlugin ? false
 }:

@ -47,32 +47,27 @@ in
 assert withPlugin -> builtins.elem hplipArch pluginArches
  || throw "HPLIP plugin not supported on ${stdenv.system}";

-stdenv.mkDerivation {
+pythonPackages.mkPythonDerivation {
  inherit name src;

  buildInputs = [
    libjpeg
    cups
    libusb1
-    pythonPackages.python
-    pythonPackages.wrapPython
    sane-backends
    dbus
    net_snmp
    openssl
-  ] ++ stdenv.lib.optionals qtSupport [
-    qt4
  ];

  nativeBuildInputs = [
    pkgconfig
  ];

-  pythonPath = with pythonPackages; [
+  propagatedBuildInputs = with pythonPackages; [
    dbus
    pillow
    pygobject2
-    recursivePthLoader
    reportlab
    usbutils
  ] ++ stdenv.lib.optionals qtSupport [
@ -149,32 +144,7 @@ stdenv.mkDerivation {
    rm $out/etc/udev/rules.d/56-hpmud.rules
  '';

-  fixupPhase = ''
-    # Wrap the user-facing Python scripts in $out/bin without turning the
-    # ones in $out /share into shell scripts (they need to be importable).
-    # Note that $out/bin contains only symlinks to $out/share.
-    for bin in $out/bin/*; do
-      py=`readlink -m $bin`
-      rm $bin
-      cp $py $bin
-      wrapPythonProgramsIn $bin "$out $pythonPath"
-      sed -i "s@$(dirname $bin)/[^ ]*@$py@g" $bin
-    done
-
-    # Remove originals. Knows a little too much about wrapPythonProgramsIn.
-    rm -f $out/bin/.*-wrapped
-
-    # Merely patching shebangs in $out/share does not cause trouble.
-    for i in $out/share/hplip{,/*}/*.py; do
-      substituteInPlace $i \
-        --replace /usr/bin/python \
-        ${pythonPackages.python}/bin/${pythonPackages.python.executable} \
-        --replace "/usr/bin/env python" \
-        ${pythonPackages.python}/bin/${pythonPackages.python.executable}
-    done
-
-    wrapPythonProgramsIn $out/lib "$out $pythonPath"
-
+  postFixup = ''
    substituteInPlace $out/etc/hp/hplip.conf --replace /usr $out
  '' + stdenv.lib.optionalString (!withPlugin) ''
    # A udev rule to notify users that they need the binary plugin.
--- a/pkgs/os-specific/linux/busybox/busybox-in-store.patch
+++ b/pkgs/os-specific/linux/busybox/busybox-in-store.patch
@ -1,15 +1,14 @@
 Allow BusyBox to be invoked as "<something>-busybox". This is
 necessary when it's run from the Nix store as <hash>-busybox during
 stdenv bootstrap.
-
--- busybox-1.24.2-orig/libbb/appletlib.c	2016-03-17 21:35:49.000000000 +0100
-+++ busybox-1.24.2/libbb/appletlib.c	2016-09-25 08:48:18.293104041 +0200
-@@ -779,7 +779,7 @@
- 	int applet = find_applet_by_name(name);
- 	if (applet >= 0)
- 		run_applet_no_and_exit(applet, argv);
+--- busybox-1.25.1-orig/libbb/appletlib.orig	2016-10-26 19:54:20.510957575 -0400
+++ busybox-1.25.1/libbb/appletlib.c	2016-10-26 19:48:31.590862853 -0400
+@@ -884,7 +884,7 @@
+ 	int applet;
+ 
+ # if ENABLE_BUSYBOX
 -	if (is_prefixed_with(name, "busybox"))
 +	if (strstr(name, "busybox") != 0)
 		exit(busybox_main(argv));
- }
- 
+ # endif
+ 	/* find_applet_by_name() search is more expensive, so goes second */
--- a/pkgs/os-specific/linux/busybox/default.nix
+++ b/pkgs/os-specific/linux/busybox/default.nix
@ -26,11 +26,11 @@ let
 in

 stdenv.mkDerivation rec {
-  name = "busybox-1.24.2";
+  name = "busybox-1.25.1";

  src = fetchurl {
    url = "http://busybox.net/downloads/${name}.tar.bz2";
-    sha256 = "0mf8f6ly8yi1fbr15jkyv6hxwh2x800x661rcd11rwsnqqzga7p7";
+    sha256 = "0bm0l8xdjdz3kdyajp8wg27yamsw7r2y88nnrxwvvz984c7pwri7";
  };

  hardeningDisable = [ "format" ] ++ lib.optional enableStatic [ "fortify" ];
--- a/pkgs/os-specific/linux/kernel/linux-3.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-3.10.nix
@ -1,12 +1,12 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:

 import ./generic.nix (args // rec {
-  version = "3.10.103";
+  version = "3.10.104";
  extraMeta.branch = "3.10";

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz";
-    sha256 = "008dz40zig0fhkm3hjmcn0kn5b1sfvpxb7dc4fbsddb6gifrh44v";
+    sha256 = "04kc64zdpg8h8655m825lbny3fwvqhmh3mg9h564i2irnll35lp3";
  };

  kernelPatches = args.kernelPatches;
--- a/pkgs/os-specific/linux/kernel/linux-3.12.nix
+++ b/pkgs/os-specific/linux/kernel/linux-3.12.nix
@ -1,12 +1,12 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:

 import ./generic.nix (args // rec {
-  version = "3.12.63";
+  version = "3.12.66";
  extraMeta.branch = "3.12";

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz";
-    sha256 = "0srg7xd68n10b28c3l5qa4dx5qr84ci7fdn48wcj79y7h2s0367x";
+    sha256 = "02nac7sr0c1h10mxp5azlsmz0gsr7qllsn2hibjknhk7jg8ry8cc";
  };

  kernelPatches = args.kernelPatches;
--- a/pkgs/os-specific/linux/kernel/linux-3.18.nix
+++ b/pkgs/os-specific/linux/kernel/linux-3.18.nix
@ -1,12 +1,12 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:

 import ./generic.nix (args // rec {
-  version = "3.18.42";
+  version = "3.18.44";
  extraMeta.branch = "3.18";

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz";
-    sha256 = "0ymimvy8kp2a2x0h31m3sipwx1h80576ws04k3cl49wgcgjwpwn4";
+    sha256 = "1cjdh9w2q164r53k06vv6nhxwjzm69nha5wndp8r1hjywjwcqqan";
  };

  kernelPatches = args.kernelPatches;
--- a/pkgs/os-specific/linux/kernel/linux-testing.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing.nix
@ -1,13 +1,13 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:

 import ./generic.nix (args // rec {
-  version = "4.9-rc1";
-  modDirVersion = "4.9.0-rc1";
+  version = "4.9-rc2";
+  modDirVersion = "4.9.0-rc2";
  extraMeta.branch = "4.9";

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v4.x/testing/linux-${version}.tar.xz";
-    sha256 = "1s123bs20zp1zzy0i12y63n6wsr9cwaad4110rl5ir49j6z6byqf";
+    sha256 = "1hf913mgyz5niy971c505s8yhqrdvq65psdrjz7cxmdxsb96pk94";
  };

  features.iwlwifi = true;
--- a/pkgs/os-specific/linux/kernel/patches.nix
+++ b/pkgs/os-specific/linux/kernel/patches.nix
@ -87,8 +87,8 @@ rec {

  grsecurity_testing = grsecPatch
    { kver   = "4.7.10";
-      grrev  = "201610222037";
-      sha256 = "14zp8gsjgzp97mb479s27zzs2ya68dy1pb5izqqvp83xrx16rayc";
+      grrev  = "201610262029";
+      sha256 = "0bczfyb0zazccl9d8sxm4p34nayamyiv7c1hp272glcjjmvlb7cv";
    };

  # This patch relaxes grsec constraints on the location of usermode helpers,
--- a/pkgs/os-specific/linux/sysdig/default.nix
+++ b/pkgs/os-specific/linux/sysdig/default.nix
@ -1,26 +1,19 @@
-{stdenv, fetchurl, fetchFromGitHub, cmake, luajit, kernel, zlib, ncurses, perl, jsoncpp, libb64, openssl, curl}:
+{stdenv, fetchurl, fetchFromGitHub, cmake, luajit, kernel, zlib, ncurses, perl, jsoncpp, libb64, openssl, curl, jq, gcc}:
 let
  inherit (stdenv.lib) optional optionalString;
  baseName = "sysdig";
-  version = "0.10.0";
-  # sysdig-0.11.0 depends on some headers from jq which are not
-  # installed by default.
-  # Relevant sysdig issue: https://github.com/draios/sysdig/issues/626
-  jq-prefix = fetchurl {
-    url="https://github.com/stedolan/jq/releases/download/jq-1.5/jq-1.5.tar.gz";
-    sha256="0g29kyz4ykasdcrb0zmbrp2jqs9kv1wz9swx849i2d1ncknbzln4";
-  };
+  version = "0.12.0";
 in
 stdenv.mkDerivation {
  name = "${baseName}-${version}";

  src = fetchurl {
    url = "https://github.com/draios/sysdig/archive/${version}.tar.gz";
-    sha256 = "0hs0r9z9j7padqdcj69bwx52iw6gvdl0w322qwivpv12j3prcpsj";
+    sha256 = "17nf2h5ajy333rwh91hzaw8zq2mnkb3lxy8fmbbs8qazgsvwz6c3";
  };

  buildInputs = [
-    cmake zlib luajit ncurses perl jsoncpp libb64 openssl curl
+    cmake zlib luajit ncurses perl jsoncpp libb64 openssl curl jq gcc
  ];

  hardeningDisable = [ "pic" ];
@ -31,7 +24,6 @@ stdenv.mkDerivation {

  cmakeFlags = [
    "-DUSE_BUNDLED_DEPS=OFF"
-    "-DUSE_BUNDLED_JQ=ON"
    "-DSYSDIG_VERSION=${version}"
  ] ++ optional (kernel == null) "-DBUILD_DRIVER=OFF";

@ -41,12 +33,23 @@ stdenv.mkDerivation {
    export KERNELDIR="${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
  '';

-  preBuild = ''
-    mkdir -p jq-prefix/src
-    cp ${jq-prefix} jq-prefix/src/jq-1.5.tar.gz
-  '';
+  libPath = stdenv.lib.makeLibraryPath [
+    zlib
+    luajit
+    ncurses
+    jsoncpp
+    curl
+    jq
+    openssl
+    libb64
+    gcc
+    stdenv.cc.cc
+  ];

-  postInstall = optionalString (kernel != null) ''
+  postInstall = ''
+    patchelf --set-rpath "$libPath" "$out/bin/sysdig"
+    patchelf --set-rpath "$libPath" "$out/bin/csysdig"
+  '' + optionalString (kernel != null) ''
    make install_driver
    kernel_dev=${kernel.dev}
    kernel_dev=''${kernel_dev#/nix/store/}
--- a/pkgs/os-specific/linux/wpa_supplicant/default.nix
+++ b/pkgs/os-specific/linux/wpa_supplicant/default.nix
@ -4,13 +4,13 @@

 with stdenv.lib;
 stdenv.mkDerivation rec {
-  version = "2.5";
+  version = "2.6";

  name = "wpa_supplicant-${version}";

  src = fetchurl {
    url = "http://hostap.epitest.fi/releases/${name}.tar.gz";
-    sha256 = "05mkp5bx1c3z7h5biddsv0p49gkrq9ksany3anp4wdiv92p5prfc";
+    sha256 = "0l0l5gz3d5j9bqjsbjlfcv4w4jwndllp9fmyai4x9kg6qhs6v4xl";
  };

  # TODO: Patch epoll so that the dbus actually responds
@ -79,7 +79,6 @@ stdenv.mkDerivation rec {

  patches = [
    ./build-fix.patch
-    ./libressl.patch
  ];

  postInstall = ''
--- a/pkgs/os-specific/linux/wpa_supplicant/libressl.patch
+++ b/pkgs/os-specific/linux/wpa_supplicant/libressl.patch
@ -1,69 +0,0 @@
-$OpenBSD: patch-src_crypto_tls_openssl_c,v 1.3 2015/09/29 11:57:54 dcoppa Exp $
-
-Compatibility fixes for LibreSSL
-
--- a/src/crypto/tls_openssl.c	Sun Sep 27 21:02:05 2015
-+++ b/src/crypto/tls_openssl.c	Mon Sep 28 13:43:46 2015
-@@ -2229,7 +2229,7 @@ static int tls_parse_pkcs12(struct tls_data *data, SSL
- 	}
- 
- 	if (certs) {
-#if OPENSSL_VERSION_NUMBER >= 0x10002000L
-+#if OPENSSL_VERSION_NUMBER >= 0x10002000L && !defined(LIBRESSL_VERSION_NUMBER)
- 		SSL_clear_chain_certs(ssl);
- 		while ((cert = sk_X509_pop(certs)) != NULL) {
- 			X509_NAME_oneline(X509_get_subject_name(cert), buf,
-@@ -2247,7 +2247,7 @@ static int tls_parse_pkcs12(struct tls_data *data, SSL
- 			/* Try to continue anyway */
- 		}
- 		sk_X509_free(certs);
-#ifndef OPENSSL_IS_BORINGSSL
-+#if !defined(OPENSSL_IS_BORINGSSL) && !defined(LIBRESSL_VERSION_NUMBER)
- 		res = SSL_build_cert_chain(ssl,
- 					   SSL_BUILD_CHAIN_FLAG_CHECK |
- 					   SSL_BUILD_CHAIN_FLAG_IGNORE_ERROR);
-@@ -2812,7 +2812,7 @@ int tls_connection_get_random(void *ssl_ctx, struct tl
- 	if (conn == NULL || keys == NULL)
- 		return -1;
- 	ssl = conn->ssl;
-#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
- 	if (ssl == NULL || ssl->s3 == NULL || ssl->session == NULL)
- 		return -1;
- 
-@@ -2841,7 +2841,7 @@ int tls_connection_get_random(void *ssl_ctx, struct tl
- #ifndef CONFIG_FIPS
- static int openssl_get_keyblock_size(SSL *ssl)
- {
-#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
- 	const EVP_CIPHER *c;
- 	const EVP_MD *h;
- 	int md_size;
-@@ -2911,7 +2911,7 @@ static int openssl_tls_prf(struct tls_connection *conn
- 		   "mode");
- 	return -1;
- #else /* CONFIG_FIPS */
-#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
- 	SSL *ssl;
- 	u8 *rnd;
- 	int ret = -1;
-@@ -3394,7 +3394,7 @@ int tls_connection_set_cipher_list(void *tls_ctx, stru
- 
- 	wpa_printf(MSG_DEBUG, "OpenSSL: cipher suites: %s", buf + 1);
- 
-#if OPENSSL_VERSION_NUMBER >= 0x10100000L
-+#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
- #if defined(EAP_FAST) || defined(EAP_FAST_DYNAMIC) || defined(EAP_SERVER_FAST)
- 	if (os_strstr(buf, ":ADH-")) {
- 		/*
-@@ -3977,7 +3977,7 @@ static int tls_sess_sec_cb(SSL *s, void *secret, int *
- 	struct tls_connection *conn = arg;
- 	int ret;
- 
-#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
- 	if (conn == NULL || conn->session_ticket_cb == NULL)
- 		return 0;
- 
--- a/pkgs/servers/corosync/default.nix
+++ b/pkgs/servers/corosync/default.nix
@ -7,11 +7,11 @@

 with stdenv.lib;
 stdenv.mkDerivation rec {
-  name = "corosync-2.3.4";
+  name = "corosync-2.4.1";

  src = fetchurl {
    url = "http://build.clusterlabs.org/corosync/releases/${name}.tar.gz";
-    sha256 = "1m276b060fjghr93hdzfag81whi5ph65dc2ka8ln1igm3kxr7bix";
+    sha256 = "0w8m97ih7a2g99pmjsckw4xwbgzv96xdgg62s2a4qbgnw4yl637y";
  };

  buildInputs = [
--- a/pkgs/servers/nosql/influxdb/default.nix
+++ b/pkgs/servers/nosql/influxdb/default.nix
@ -1,16 +1,21 @@
-{ lib, buildGoPackage, fetchFromGitHub, src, version }:
+{ lib, buildGoPackage, fetchFromGitHub, }:

 buildGoPackage rec {
  name = "influxdb-${version}";
+  version = "1.0.2";
+
+  src = fetchFromGitHub {
+    owner = "influxdata";
+    repo = "influxdb";
+    rev = "v${version}";
+    sha256 = "0z8y995gm2hpxny7l5nx5fjc5c26hfgvghwmzva8d1mrlnapcsyc";
+  };

  goPackagePath = "github.com/influxdata/influxdb";

  excludedPackages = "test";
-  
-  inherit src;

-  # Generated with the `gdm2nix.rb` script and the `Godeps` file from the
-  # influxdb repo root.
+  # Generated with the nix2go
  goDeps = ./. + builtins.toPath "/deps-${version}.nix";

  meta = with lib; {
--- a/pkgs/servers/nosql/influxdb/deps-0.13.0.json.nix
+++ b/pkgs/servers/nosql/influxdb/deps-0.13.0.json.nix
--- a/pkgs/servers/nosql/influxdb/deps-0.13.0.nix
+++ b/pkgs/servers/nosql/influxdb/deps-0.13.0.nix
@ -1,200 +0,0 @@
-[
-{
-  goPackagePath = "collectd.org";
-  fetch = {
-    type = "git";
-    url = "https://github.com/collectd/go-collectd.git";
-    rev = "9fc824c70f713ea0f058a07b49a4c563ef2a3b98";
-    sha256 = "0kjal6bsjpnppfnlqbg7g56xwssaj2ani499yykyj817zq56hi0w";
-  };
-}
-{
-  goPackagePath = "github.com/BurntSushi/toml";
-  fetch = {
-    type = "git";
-    url = "https://github.com/BurntSushi/toml.git";
-    rev = "a4eecd407cf4129fc902ece859a0114e4cf1a7f4";
-    sha256 = "1l74zvd534k2fs73gmaq4mgl48p1i9559k1gwq4vakca727z5sgf";
-  };
-}
-{
-  goPackagePath = "github.com/armon/go-metrics";
-  fetch = {
-    type = "git";
-    url = "https://github.com/armon/go-metrics.git";
-    rev = "345426c77237ece5dab0e1605c3e4b35c3f54757";
-    sha256 = "13bp2ykqhnhzif7wzrwsg54c2b0czhgs9csbvzbvc93n72s59jh5";
-  };
-}
-{
-  goPackagePath = "github.com/bmizerany/pat";
-  fetch = {
-    type = "git";
-    url = "https://github.com/bmizerany/pat.git";
-    rev = "b8a35001b773c267eb260a691f4e5499a3531600";
-    sha256 = "11zxd45rvjm6cn3wzbi18wy9j4vr1r1hgg6gzlqnxffiizkycxmz";
-  };
-}
-{
-  goPackagePath = "github.com/boltdb/bolt";
-  fetch = {
-    type = "git";
-    url = "https://github.com/boltdb/bolt.git";
-    rev = "2f846c3551b76d7710f159be840d66c3d064abbe";
-    sha256 = "0cvpcgmzlrn87jqrflwf4pciz6i25ri1r83sq7v1z9zry1ah16r5";
-  };
-}
-{
-  goPackagePath = "github.com/davecgh/go-spew";
-  fetch = {
-    type = "git";
-    url = "https://github.com/davecgh/go-spew.git";
-    rev = "fc32781af5e85e548d3f1abaf0fa3dbe8a72495c";
-    sha256 = "1dwwd4va0qnyr256i7n8d4g24d7yyvwd0975y6v4dy06qpwir232";
-  };
-}
-{
-  goPackagePath = "github.com/dgryski/go-bits";
-  fetch = {
-    type = "git";
-    url = "https://github.com/dgryski/go-bits.git";
-    rev = "86c69b3c986f9d40065df5bd8f765796549eef2e";
-    sha256 = "08i3p8lcisr88gmwvi8qdc8bgksxh5ydjspgfbi4aba9msybp78b";
-  };
-}
-{
-  goPackagePath = "github.com/dgryski/go-bitstream";
-  fetch = {
-    type = "git";
-    url = "https://github.com/dgryski/go-bitstream.git";
-    rev = "27cd5973303fde7d914860be1ea4b927a6be0c92";
-    sha256 = "12ji4vcfy0cz12yq43cz0w1f1k4c1kg0vwpsk1iy47kc38kzdkc6";
-  };
-}
-{
-  goPackagePath = "github.com/gogo/protobuf";
-  fetch = {
-    type = "git";
-    url = "https://github.com/gogo/protobuf.git";
-    rev = "74b6e9deaff6ba6da1389ec97351d337f0d08b06";
-    sha256 = "0045fz4bx72rikm2ggx9j1h3yrq518299qwaizrgy5jvxzj1707b";
-  };
-}
-{
-  goPackagePath = "github.com/golang/snappy";
-  fetch = {
-    type = "git";
-    url = "https://github.com/golang/snappy.git";
-    rev = "5979233c5d6225d4a8e438cdd0b411888449ddab";
-    sha256 = "0i0pvwc2a4xgsns6mr3xbc6p0sra34qsaagd7yf7v1as0z7ydl3s";
-  };
-}
-{
-  goPackagePath = "github.com/hashicorp/go-msgpack";
-  fetch = {
-    type = "git";
-    url = "https://github.com/hashicorp/go-msgpack.git";
-    rev = "fa3f63826f7c23912c15263591e65d54d080b458";
-    sha256 = "1f6rd6bm2dm2rk46x8cqrxh5nks1gpk6dvvsag7s5pdjgdxy951k";
-  };
-}
-{
-  goPackagePath = "github.com/hashicorp/raft";
-  fetch = {
-    type = "git";
-    url = "https://github.com/hashicorp/raft.git";
-    rev = "8fd9a2fdfd154f4b393aa24cff91e3c317efe839";
-    sha256 = "04k03x6r6h2xwxfvbzicfdblifdjn35agw9kwla6akw6l54ygy0f";
-  };
-}
-{
-  goPackagePath = "github.com/hashicorp/raft-boltdb";
-  fetch = {
-    type = "git";
-    url = "https://github.com/hashicorp/raft-boltdb.git";
-    rev = "d1e82c1ec3f15ee991f7cc7ffd5b67ff6f5bbaee";
-    sha256 = "0p609w6x0h6bapx4b0d91dxnp2kj7dv0534q4blyxp79shv2a8ia";
-  };
-}
-{
-  goPackagePath = "github.com/influxdata/usage-client";
-  fetch = {
-    type = "git";
-    url = "https://github.com/influxdata/usage-client.git";
-    rev = "475977e68d79883d9c8d67131c84e4241523f452";
-    sha256 = "0yhywablqqpd2x70rax1kf7yaw1jpvrc2gks8360cwisda57d3qy";
-  };
-}
-{
-  goPackagePath = "github.com/jwilder/encoding";
-  fetch = {
-    type = "git";
-    url = "https://github.com/jwilder/encoding.git";
-    rev = "b421ab402545ef5a119f4f827784c6551d9bfc37";
-    sha256 = "0sjz2cl8kpni0mh0y4269k417dj06gn2y0ppi25i3wh9p4j4i4fq";
-  };
-}
-{
-  goPackagePath = "github.com/kimor79/gollectd";
-  fetch = {
-    type = "git";
-    url = "https://github.com/kimor79/gollectd.git";
-    rev = "61d0deeb4ffcc167b2a1baa8efd72365692811bc";
-    sha256 = "0als2v4d5hlw0sqam670p3fi471ikgl3l81bp31mf3s3jssdxwfs";
-  };
-}
-{
-  goPackagePath = "github.com/paulbellamy/ratecounter";
-  fetch = {
-    type = "git";
-    url = "https://github.com/paulbellamy/ratecounter.git";
-    rev = "5a11f585a31379765c190c033b6ad39956584447";
-    sha256 = "137p62imi91zhkjcjigdd64n7f9z6djjpsxcyifgrcxs41jj9ra0";
-  };
-}
-{
-  goPackagePath = "github.com/peterh/liner";
-  fetch = {
-    type = "git";
-    url = "https://github.com/peterh/liner.git";
-    rev = "82a939e738b0ee23e84ec7a12d8e216f4d95c53f";
-    sha256 = "1187c1rqmh9k9ap5bz3p9hbjp3ad5hysykh58kgv5clah1jbkg04";
-  };
-}
-{
-  goPackagePath = "github.com/rakyll/statik";
-  fetch = {
-    type = "git";
-    url = "https://github.com/rakyll/statik.git";
-    rev = "274df120e9065bdd08eb1120e0375e3dc1ae8465";
-    sha256 = "0llk7bxmk66wdiy42h32vj1jfk8zg351xq21hwhrq7gkfljghffp";
-  };
-}
-{
-  goPackagePath = "golang.org/x/crypto";
-  fetch = {
-    type = "git";
-    url = "https://github.com/golang/crypto.git";
-    rev = "1f22c0103821b9390939b6776727195525381532";
-    sha256 = "1acy12f396sr3lrnbcnym5q72qnlign5bagving41qijzjnc219m";
-  };
-}
-{
-  goPackagePath = "golang.org/x/tools";
-  fetch = {
-    type = "git";
-    url = "https://github.com/golang/tools.git";
-    rev = "8b178a93c1f5b5c8f4e36cd6bd64e0d5bf0ee180";
-    sha256 = "0rqm56c4acrvyqsp53dkzr34pkz922x4rwknaslwlbkyc4gyg2c8";
-  };
-}
-{
-  goPackagePath = "gopkg.in/fatih/pool.v2";
-  fetch = {
-    type = "git";
-    url = "https://github.com/fatih/pool.git";
-    rev = "cba550ebf9bce999a02e963296d4bc7a486cb715";
-    sha256 = "1jlrakgnpvhi2ny87yrsj1gyrcncfzdhypa9i2mlvvzqlj4r0dn0";
-  };
-}
-]
--- a/pkgs/servers/nosql/influxdb/gdm2nix.rb
+++ b/pkgs/servers/nosql/influxdb/gdm2nix.rb
@ -1,39 +0,0 @@
-#!/usr/bin/env ruby
-#
-#
-require "json"
-
-redirects = {
-  "collectd.org" => "github.com/collectd/go-collectd",
-  "git.eclipse.org/gitroot/paho/org.eclipse.paho.mqtt.golang.git" => "github.com/eclipse/paho.mqtt.golang",
-  "golang.org/x/net" => "github.com/golang/net",
-  "golang.org/x/crypto" => "github.com/golang/crypto",
-  "golang.org/x/text" => "github.com/golang/text",
-  "golang.org/x/tools" => "github.com/golang/tools",
-  "gopkg.in/fatih/pool.v2" => "github.com/fatih/pool",
-}
-
-godeps = ARGV[0] || "Godeps"
-
-deps = File.read(godeps).lines.map do |line|
-  (name, rev) = line.split(" ")
-
-  host = redirects.fetch(name, name)
-
-  url = "https://#{host}.git"
-
-  xxx = JSON.load(`nix-prefetch-git #{url} #{rev}`)
-
-  {
-    goPackagePath: name,
-    fetch: {
-      type: "git",
-      url: url,
-      rev: rev,
-      sha256: xxx['sha256'],
-    }
-  }
-end
-
-#TODO: move to deps.nix in NIXON format
-File.write("deps.json", JSON.pretty_generate(deps))
--- a/pkgs/servers/nosql/influxdb/v0.nix
+++ b/pkgs/servers/nosql/influxdb/v0.nix
@ -1,13 +0,0 @@
-{ lib, buildGoPackage, fetchFromGitHub }@args:
-
-import ./default.nix (args // rec {
-  
-  version = "0.13.0";
-
-  src = fetchFromGitHub {
-    owner = "influxdata";
-    repo = "influxdb";
-    rev = "v${version}";
-    sha256 = "0f7af5jb1f65qnslhc7zccml1qvk6xx5naczqfsf4s1zc556fdi4";
-  };
-}) 
--- a/pkgs/servers/nosql/influxdb/v1.nix
+++ b/pkgs/servers/nosql/influxdb/v1.nix
@ -1,13 +0,0 @@
-{ lib, buildGoPackage, fetchFromGitHub }@args:
-
-import ./default.nix (args // rec {
-  
-  version = "1.0.2";
-
-  src = fetchFromGitHub {
-    owner = "influxdata";
-    repo = "influxdb";
-    rev = "v${version}";
-    sha256 = "0z8y995gm2hpxny7l5nx5fjc5c26hfgvghwmzva8d1mrlnapcsyc";
-  };
-}) 
--- a/pkgs/stdenv/default.nix
+++ b/pkgs/stdenv/default.nix
@ -16,9 +16,7 @@ rec {
  # i.e., the stuff in /bin, /usr/bin, etc.  This environment should
  # be used with care, since many Nix packages will not build properly
  # with it (e.g., because they require GNU Make).
-  stdenvNative = (import ./native {
-    inherit system allPackages config;
-  }).stdenv;
+  inherit (import ./native { inherit system allPackages config; }) stdenvNative;

  stdenvNativePkgs = allPackages {
    bootStdenv = stdenvNative;
@ -33,12 +31,12 @@ rec {
    pkgs = stdenvNativePkgs;
  };

-  stdenvFreeBSD = (import ./freebsd { inherit system allPackages platform config; }).stdenvFreeBSD;
+  inherit (import ./freebsd { inherit system allPackages platform config; }) stdenvFreeBSD;

  # Linux standard environment.
-  stdenvLinux = (import ./linux { inherit system allPackages platform config lib; }).stdenvLinux;
+  inherit (import ./linux { inherit system allPackages platform config lib; }) stdenvLinux;

-  stdenvDarwin = (import ./darwin { inherit system allPackages platform config;}).stdenvDarwin;
+  inherit (import ./darwin { inherit system allPackages platform config;}) stdenvDarwin;

  # Select the appropriate stdenv for the platform `system'.
  stdenv =
--- a/pkgs/stdenv/native/default.nix
+++ b/pkgs/stdenv/native/default.nix
@ -141,5 +141,5 @@ rec {
  };


-  stdenv = stdenvBoot2;
+  stdenvNative = stdenvBoot2;
 }
--- a/pkgs/tools/backup/duplicity/default.nix
+++ b/pkgs/tools/backup/duplicity/default.nix
@ -3,7 +3,7 @@

 let
  version = "0.7.07.1";
-  inherit (python2Packages) boto ecdsa lockfile paramiko pycrypto python setuptools;
+  inherit (python2Packages) boto cffi cryptography ecdsa enum idna ipaddress lockfile paramiko pyasn1 pycrypto python setuptools six;
 in stdenv.mkDerivation {
  name = "duplicity-${version}";

@ -15,10 +15,10 @@ in stdenv.mkDerivation {
  installPhase = ''
    python setup.py install --prefix=$out
    wrapProgram $out/bin/duplicity \
-      --prefix PYTHONPATH : "$(toPythonPath $out):$(toPythonPath ${pycrypto}):$(toPythonPath ${ecdsa}):$(toPythonPath ${paramiko}):$(toPythonPath ${boto}):$(toPythonPath ${lockfile})" \
+      --prefix PYTHONPATH : "$(toPythonPath $out):$(toPythonPath ${idna}):$(toPythonPath ${cffi}):$(toPythonPath ${ipaddress}):$(toPythonPath ${pyasn1}):$(toPythonPath ${six}):$(toPythonPath ${enum}):$(toPythonPath ${setuptools}):$(toPythonPath ${cryptography}):$(toPythonPath ${pycrypto}):$(toPythonPath ${ecdsa}):$(toPythonPath ${paramiko}):$(toPythonPath ${boto}):$(toPythonPath ${lockfile})" \
      --prefix PATH : "${stdenv.lib.makeBinPath [ gnupg ncftp rsync ]}"
    wrapProgram $out/bin/rdiffdir \
-      --prefix PYTHONPATH : "$(toPythonPath $out):$(toPythonPath ${pycrypto}):$(toPythonPath ${ecdsa}):$(toPythonPath ${paramiko}):$(toPythonPath ${boto}):$(toPythonPath ${lockfile})"
+      --prefix PYTHONPATH : "$(toPythonPath $out):$(toPythonPath ${idna}):$(toPythonPath ${cffi}):$(toPythonPath ${ipaddress}):$(toPythonPath ${pyasn1}):$(toPythonPath ${six}):$(toPythonPath ${enum}):$(toPythonPath ${setuptools}):$(toPythonPath ${cryptography}):$(toPythonPath ${pycrypto}):$(toPythonPath ${ecdsa}):$(toPythonPath ${paramiko}):$(toPythonPath ${boto}):$(toPythonPath ${lockfile})"
  '';

  buildInputs = [ python librsync makeWrapper setuptools ];
--- a/pkgs/tools/filesystems/btrfs-progs/default.nix
+++ b/pkgs/tools/filesystems/btrfs-progs/default.nix
@ -2,14 +2,14 @@
 , asciidoc, xmlto, docbook_xml_dtd_45, docbook_xsl, libxslt
 }:

-let version = "4.6.1"; in
+let version = "4.8.2"; in

 stdenv.mkDerivation rec {
  name = "btrfs-progs-${version}";

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/people/kdave/btrfs-progs/btrfs-progs-v${version}.tar.xz";
-    sha256 = "06c9l6m3w29dndk17jrlpgr01wykl10h34zva8zc2c571z6mrlaf";
+    sha256 = "0pswcfmdnfc586770h74abp67gn2xv8fd46vxlimnmn837sj7h41";
  };

  buildInputs = [
--- a/pkgs/tools/misc/remind/default.nix
+++ b/pkgs/tools/misc/remind/default.nix
@ -1,12 +1,33 @@
-{stdenv, fetchurl} :
+{stdenv, fetchurl, tk, tcllib, makeWrapper
+, tkremind ? true
+} :

-stdenv.mkDerivation {
+assert tkremind -> tk != null;
+assert tkremind -> tcllib != null;
+assert tkremind -> makeWrapper != null;
+
+stdenv.mkDerivation rec {
  name = "remind-3.1.15";
  src = fetchurl {
    url = http://www.roaringpenguin.com/files/download/remind-03.01.15.tar.gz;
    sha256 = "1hcfcxz5fjzl7606prlb7dgls5kr8z3wb51h48s6qm8ang0b9nla";
  };

+  tclLibraries = if tkremind then [ tcllib tk ] else [];
+  tclLibPaths = stdenv.lib.concatStringsSep " "
+    (map (p: "${p}/lib/${p.libPrefix}") tclLibraries);
+
+  buildInputs = if tkremind then [ makeWrapper ] else [];
+  propagatedBuildInputs = tclLibraries;
+
+  postPatch = if tkremind then ''
+    substituteInPlace scripts/tkremind --replace "exec wish" "exec ${tk}/bin/wish"
+  '' else "";
+
+  postInstall = if tkremind then ''
+    wrapProgram $out/bin/tkremind --set TCLLIBPATH "${tclLibPaths}"
+  '' else "";
+
  meta = {
    homepage = http://www.roaringpenguin.com/products/remind;
    description = "Sophisticated calendar and alarm program for the console";
--- a/pkgs/tools/misc/vdirsyncer/default.nix
+++ b/pkgs/tools/misc/vdirsyncer/default.nix
@ -6,12 +6,12 @@ let
  pythonPackages = python3Packages;
 in
 pythonPackages.buildPythonApplication rec {
-  version = "0.13.1";
+  version = "0.14.0";
  name = "vdirsyncer-${version}";

  src = fetchurl {
    url = "mirror://pypi/v/vdirsyncer/${name}.tar.gz";
-    sha256 = "1c4kipcc7dx1rn5j1a1x7wckz09mm9ihwakf3ramwn1y78q5zanb";
+    sha256 = "1mbh2gykx9sqsnyfa962ifxksx4afl2lb9rcsbd6rsh3gj2il898";
  };

  propagatedBuildInputs = with pythonPackages; [
--- a/pkgs/tools/networking/dnscrypt-wrapper/default.nix
+++ b/pkgs/tools/networking/dnscrypt-wrapper/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  name = "dnscrypt-wrapper-${version}";
-  version = "0.2.1";
+  version = "0.2.2";

  src = fetchFromGitHub {
    owner = "Cofyc";
    repo = "dnscrypt-wrapper";
    rev = "v${version}";
-    sha256 = "0gysylchvmxvqd4ims2cf2610vmxl80wlk62jhsv13p94yvrl53b";
+    sha256 = "0ip205safbpkmk1z7qf3hshqlc2q2zwhsm3i705m0y7rxc4200ms";
  };

  nativeBuildInputs = [ pkgconfig autoreconfHook ];
@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
  meta = with stdenv.lib; {
    description = "A tool for adding dnscrypt support to any name resolver";
    homepage = https://dnscrypt.org/;
-    license = licenses.gpl2;
+    license = licenses.isc;
    maintainers = with maintainers; [ tstrobel joachifm ];
    platforms = platforms.linux;
  };
--- a/pkgs/tools/networking/nc6/default.nix
+++ b/pkgs/tools/networking/nc6/default.nix
@ -1,18 +0,0 @@
-{ stdenv, fetchurl }:
-
-stdenv.mkDerivation {
-  name = "nc6-1.0";
-
-  src = fetchurl {
-    urls = [
-      ftp://ftp.deepspace6.net/pub/ds6/sources/nc6/nc6-1.0.tar.bz2
-      http://fossies.org/linux/privat/nc6-1.0.tar.bz2
-    ];
-    sha256 = "01l28zv1yal58ilfnz6albdzqqxzsx3a58vmc14r9gv0bahffdgb";
-  };
-
-  meta = {
-    description = "A netcat implementation with IPv6 support";
-    homepage = http://www.deepspace6.net/projects/netcat6.html;
-  };
-}
--- a/pkgs/tools/security/gnupg/20.nix
+++ b/pkgs/tools/security/gnupg/20.nix
@ -3,13 +3,13 @@

 # Each of the dependencies below are optional.
 # Gnupg can be built without them at the cost of reduced functionality.
-, pinentry ? null, x11Support ? true
+, pinentry ? null, guiSupport ? true
 , openldap ? null, bzip2 ? null, libusb ? null, curl ? null
 }:

 with stdenv.lib;

-assert x11Support -> pinentry != null;
+assert guiSupport -> pinentry != null;

 stdenv.mkDerivation rec {
  name = "gnupg-2.0.30";
@ -35,7 +35,8 @@ stdenv.mkDerivation rec {
    patch gl/stdint_.h < ${./clang.patch}
  '';

-  configureFlags = optional x11Support "--with-pinentry-pgm=${pinentry}/bin/pinentry";
+  pinentryBinaryPath = pinentry.binaryPath or "bin/pinentry";
+  configureFlags = optional guiSupport "--with-pinentry-pgm=${pinentry}/${pinentryBinaryPath}";

  postConfigure = "substituteAllInPlace tools/gpgkey2ssh.c";

--- a/pkgs/tools/security/gnupg/21.nix
+++ b/pkgs/tools/security/gnupg/21.nix
@ -3,14 +3,14 @@

 # Each of the dependencies below are optional.
 # Gnupg can be built without them at the cost of reduced functionality.
-, pinentry ? null, x11Support ? true
+, pinentry ? null, guiSupport ? true
 , adns ? null, gnutls ? null, libusb ? null, openldap ? null
 , readline ? null, zlib ? null, bzip2 ? null
 }:

 with stdenv.lib;

-assert x11Support -> pinentry != null;
+assert guiSupport -> pinentry != null;

 stdenv.mkDerivation rec {
  name = "gnupg-${version}";
@ -32,7 +32,8 @@ stdenv.mkDerivation rec {
    sed -i 's,"libpcsclite\.so[^"]*","${pcsclite}/lib/libpcsclite.so",g' scd/scdaemon.c
  ''; #" fix Emacs syntax highlighting :-(

-  configureFlags = optional x11Support "--with-pinentry-pgm=${pinentry}/bin/pinentry";
+  pinentryBinaryPath = pinentry.binaryPath or "bin/pinentry";
+  configureFlags = optional guiSupport "--with-pinentry-pgm=${pinentry}/${pinentryBinaryPath}";

  meta = with stdenv.lib; {
    homepage = http://gnupg.org;
--- a/pkgs/tools/security/nmap/default.nix
+++ b/pkgs/tools/security/nmap/default.nix
@ -22,11 +22,11 @@ let

 in stdenv.mkDerivation rec {
  name = "nmap${optionalString graphicalSupport "-graphical"}-${version}";
-  version = "7.12";
+  version = "7.31";

  src = fetchurl {
-    url = "http://nmap.org/dist/nmap-${version}.tar.bz2";
-    sha256 = "014vagh9ak10hidwzp9s6g30y5h5fhsh8wykcnc1hnn9hwm0ipv3";
+    url = "https://nmap.org/dist/nmap-${version}.tar.bz2";
+    sha256 = "0hiqb28950kn4bjsmw0ksfyss7j2qdmgrj3xsjf7073pq01lx7yb";
  };

  patches = ./zenmap.patch;
--- a/pkgs/tools/security/pinentry-mac/default.nix
+++ b/pkgs/tools/security/pinentry-mac/default.nix
@ -17,6 +17,10 @@ stdenv.mkDerivation rec {
    mv build/Release/pinentry-mac.app $out/Applications
  '';

+  passthru = {
+    binaryPath = "Applications/pinentry-mac.app/Contents/MacOS/pinentry-mac";
+  };
+
  meta = {
    description = "Pinentry for GPG on Mac";
    license = stdenv.lib.licenses.gpl2Plus;
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -1845,8 +1845,12 @@ in
  gnupg1orig = callPackage ../tools/security/gnupg/1.nix { };
  gnupg1compat = callPackage ../tools/security/gnupg/1compat.nix { };
  gnupg1 = gnupg1compat;    # use config.packageOverrides if you prefer original gnupg1
-  gnupg20 = callPackage ../tools/security/gnupg/20.nix { };
-  gnupg21 = callPackage ../tools/security/gnupg/21.nix { };
+  gnupg20 = callPackage ../tools/security/gnupg/20.nix {
+    pinentry = if stdenv.isDarwin then pinentry_mac else pinentry;
+  };
+  gnupg21 = callPackage ../tools/security/gnupg/21.nix {
+    pinentry = if stdenv.isDarwin then pinentry_mac else pinentry;
+  };
  gnupg = gnupg21;

  gnuplot = callPackage ../tools/graphics/gnuplot { qt = qt4; };
@ -2413,11 +2417,6 @@ in

  ninka = callPackage ../development/tools/misc/ninka { };

-  nodejs-0_10 = callPackage ../development/web/nodejs/v0_10.nix {
-    libtool = darwin.cctools;
-    inherit (darwin.apple_sdk.frameworks) CoreServices ApplicationServices Carbon Foundation;
-  };
-
  nodejs-4_x = callPackage ../development/web/nodejs/v4.nix {
    libtool = darwin.cctools;
  };
@ -2426,10 +2425,7 @@ in
    libtool = darwin.cctools;
  };

-  nodejs = if stdenv.system == "armv5tel-linux" then
-    nodejs-0_10
-  else
-    nodejs-4_x;
+  nodejs = nodejs-4_x;

  nodePackages_6_x = callPackage ../development/node-packages/default-v6.nix {
    nodejs = pkgs.nodejs-6_x;
@ -2439,14 +2435,7 @@ in
    nodejs = pkgs.nodejs-4_x;
  };

-  nodePackages_0_10 = callPackage ../development/node-packages/default-v0_10.nix {
-    nodejs = pkgs.nodejs-0_10;
-  };
-
-  nodePackages = if stdenv.system == "armv5tel-linux" then
-    nodePackages_0_10
-  else
-    nodePackages_4_x;
+  nodePackages = nodePackages_4_x;

  # Can be used as a user shell
  nologin = shadow;
@ -2798,8 +2787,6 @@ in

  nco = callPackage ../development/libraries/nco { };

-  nc6 = callPackage ../tools/networking/nc6 { };
-
  ncftp = callPackage ../tools/networking/ncftp { };

  ncompress = callPackage ../tools/compression/ncompress { };
@ -5092,7 +5079,7 @@ in
  inherit (ocamlPackages) ocaml-top;

  opa = callPackage ../development/compilers/opa {
-    nodejs = nodejs-0_10;
+    nodejs = nodejs-4_x;
  };

  inherit (ocaml-ng.ocamlPackages_4_01_0) opam_1_0_0;
@ -6301,6 +6288,8 @@ in

  redo = callPackage ../development/tools/build-managers/redo { };

+  reno = callPackage ../development/tools/reno { };
+
  re2c = callPackage ../development/tools/parsing/re2c { };

  remake = callPackage ../development/tools/build-managers/remake { };
@ -8842,7 +8831,7 @@ in
  qt48 = callPackage ../development/libraries/qt-4.x/4.8 {
    # GNOME dependencies are not used unless gtkStyle == true
    mesa = mesa_noglu;
-    inherit (pkgs.gnome) libgnomeui GConf gnome_vfs;
+    inherit (pkgs.gnome2) libgnomeui GConf gnome_vfs;
    cups = if stdenv.isLinux then cups else null;

    # XXX: mariadb doesn't built on fbsd as of nov 2015
@ -10010,7 +9999,7 @@ in

  grafana = callPackage ../servers/monitoring/grafana { };

-  groovebasin = callPackage ../applications/audio/groovebasin { nodejs = nodejs-0_10; };
+  groovebasin = callPackage ../applications/audio/groovebasin { nodejs = nodejs-4_x; };

  haka = callPackage ../tools/security/haka { };

@ -10177,9 +10166,7 @@ in

  riak = callPackage ../servers/nosql/riak/2.1.1.nix { };

-  influxdb = callPackage ../servers/nosql/influxdb/v0.nix { };
-
-  influxdb10 = callPackage ../servers/nosql/influxdb/v1.nix { };
+  influxdb = callPackage ../servers/nosql/influxdb { };

  mysql55 = callPackage ../servers/sql/mysql/5.5.x.nix {
    inherit (darwin) cctools;
@ -16702,7 +16689,7 @@ in
  wxmaxima = callPackage ../applications/science/math/wxmaxima { wxGTK = wxGTK30; };

  pari = callPackage ../applications/science/math/pari {};
-  pari_alpha = callPackage ../applications/science/math/pari/alpha.nix {};
+  pari-unstable = callPackage ../applications/science/math/pari/unstable.nix {};

  ratpoints = callPackage ../applications/science/math/ratpoints {};

--- a/pkgs/top-level/dotnet-packages.nix
+++ b/pkgs/top-level/dotnet-packages.nix
@ -181,6 +181,13 @@ let self = dotnetPackages // overrides; dotnetPackages = with self; {
    outputFiles = [ "bin/*" ];
  };

+  OpenNAT = fetchNuGet {
+    baseName = "Open.NAT";
+    version = "2.1.0";
+    sha256 = "1jyd30fwycdwx5ck96zhp2xf20yz0sp7g3pjbqhmay4kd322mfwk";
+    outputFiles = [ "lib/*" ];
+  };
+
  MonoNat = fetchNuGet {
    baseName = "Mono.Nat";
    version = "1.2.24";
--- a/pkgs/top-level/guile-2-test.nix
+++ b/pkgs/top-level/guile-2-test.nix
@ -1,84 +0,0 @@
-/* A Hydra jobset to test Guile-using applications and libraries with the
-   Guile 2.x pre-releases.
-
-   -- ludo@gnu.org  */
-
-let
-  allPackages = import ../..;
-
-  pkgsFun = { system ? builtins.currentSystem }:
-    allPackages {
-      inherit system;
-      config.packageOverrides = pkgs: {
-        guile = pkgs.guile_2_0;
-      };
-    };
-
-  pkgs = pkgsFun {};
-
-  toJob = x: if builtins.isAttrs x then x else
-    { type = "job"; systems = x; schedulingPriority = 10; };
-
-  /* Perform a job on the given set of platforms.  The function `f' is
-     called by Hydra for each platform, and should return some job
-     to build on that platform.  `f' is passed the Nixpkgs collection
-     for the platform in question. */
-  testOn = systems: f: {system ? builtins.currentSystem}:
-    if pkgs.lib.elem system systems
-    then f (pkgsFun {inherit system;})
-    else {};
-
-  /* Map an attribute of the form `foo = [platforms...]'  to `testOn
-     [platforms...] (pkgs: pkgs.foo)'. */
-  mapTestOn = pkgs.lib.mapAttrsRecursiveCond
-    (as: !(as ? type && as.type == "job"))
-    (path: value:
-      let
-        job = toJob value;
-        getPkg = pkgs:
-          pkgs.lib.addMetaAttrs { schedulingPriority = toString job.schedulingPriority; }
-          (pkgs.lib.getAttrFromPath path pkgs);
-      in testOn job.systems getPkg);
-
-  inherit (pkgs.lib.platforms) linux darwin cygwin allBut all;
-
-in (mapTestOn {
-  /* The package list below was obtained with:
-
-     cat top-level/all-packages.nix                             \
-     | grep -B3 'guile[^=]*$'                                   \
-     | grep '^[[:blank:]]*[a-zA-Z0-9_]\+[[:blank:]]*='          \
-     | sed -es'/^[[:blank:]]*\(.\+\)[[:blank:]]*=.*$/\1= linux;/g'
-
-     with some minor edits.
-   */
-
-  guile = linux;
-
-  autogen = linux;
-  lsh = linux;
-  mailutils = linux;
-  mcron = linux;
-  texmacs = linux;
-  guileCairo = linux;
-  guileGnome = linux;
-  guile_lib = linux;
-  guileLint = linux;
-  guile_ncurses = linux;
-  gwrap = linux;
-  swig = linux;
-  gnutls = linux;
-  slibGuile = linux;
-  dico = linux;
-  trackballs = linux;
-  beast = linux;
-  elinks = linux;
-  gnucash = linux;
-  gnunet = linux;
-  snd = linux;
-  ballAndPaddle = linux;
-  drgeo = linux;
-  lilypond = linux;
-  liquidwar = linux;
-  freetalk = linux;
-})
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@ -3603,6 +3603,8 @@ let self = _self // overrides; _self = with self; {
  };

  DBIxClass = buildPerlPackage rec {
+    # tests broken again
+    doCheck = false;
    name = "DBIx-Class-0.082840";
    src = fetchurl {
      url = "mirror://cpan/authors/id/R/RI/RIBASUSHI/${name}.tar.gz";
@ -3615,7 +3617,6 @@ let self = _self // overrides; _self = with self; {
      homepage = http://www.dbix-class.org/;
      description = "Extensible and flexible object <-> relational mapper";
      license = with stdenv.lib.licenses; [ artistic1 gpl1Plus ];
-      maintainers = [ maintainers.rycee ];
    };
  };

--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -1452,13 +1452,13 @@ in {

  awscli = buildPythonPackage rec {
    name = "awscli-${version}";
-    version = "1.10.51";
+    version = "1.11.10";

    namePrefix = "";

    src = pkgs.fetchurl {
      url = "mirror://pypi/a/awscli/${name}.tar.gz";
-      sha256 = "19n7r6fwnwpi0cyrqh20w80mrcj0b6j3if5p58hi1k3fdp60nscq";
+      sha256 = "174lfpai5cga1ml2bwswjil6h544m57js9ki7hqkr9gdbpa8pyrk";
    };

    # No tests included
@ -2941,16 +2941,16 @@ in {

  boto3 = buildPythonPackage rec {
    name = "boto3-${version}";
-    version = "1.3.1";
+    version = "1.4.1";

    src = pkgs.fetchFromGitHub {
      owner = "boto";
      repo  = "boto3";
      rev   = version;
-      sha256 = "1rbwcslk9dgayrg3vy3m0bqj767hdy1aphy5wjgz925bsydgxdg6";
+      sha256 = "19ij6cs2n3p5fgipbrq1dybq2sjjvlhg9n5a5sv9wi95x9wqi5wb";
    };

-    propagatedBuildInputs = [ self.botocore self.jmespath ] ++
+    propagatedBuildInputs = [ self.botocore self.jmespath self.s3transfer ] ++
                            (if isPy3k then [] else [self.futures]);
    buildInputs = [ self.docutils self.nose self.mock ];
    checkPhase = ''
@ -2978,12 +2978,12 @@ in {
  };

  botocore = buildPythonPackage rec {
-    version = "1.4.41"; # This version is required by awscli
+    version = "1.4.67"; # This version is required by awscli
    name = "botocore-${version}";

    src = pkgs.fetchurl {
      url = "mirror://pypi/b/botocore/${name}.tar.gz";
-      sha256 = "0c3abr2rxiilqklika8x360pr0mgx7hlhbhj8w72izs2r6ww4dys";
+      sha256 = "15fh3ng33mcbhm76pk9qqglf342qj471gfcqxv0nrl9f8sn3v60q";
    };

    propagatedBuildInputs =
@ -3151,11 +3151,11 @@ in {

  devpi-common = buildPythonPackage rec {
    name = "devpi-common";
-    version = "2.0.8";
+    version = "3.0.1";

    src = pkgs.fetchurl {
      url = "mirror://pypi/d/devpi-common/devpi-common-${version}.tar.gz";
-      sha256 = "a059c4099002d4af8f3ccfc8a9f4bf133b20ea404049b21a31fc1003e1d79452";
+      sha256 = "0l3a7iyk596x6pvzg7604lzzi012qszr804fqn6f517zcy1xz23j";
    };

    propagatedBuildInputs = [ self.requests2 self.py ];
@ -3164,7 +3164,7 @@ in {
      homepage = https://bitbucket.org/hpk42/devpi;
      description = "Utilities jointly used by devpi-server and devpi-client";
      license = licenses.mit;
-      maintainers = with maintainers; [ lewo ];
+      maintainers = with maintainers; [ lewo makefu ];
    };
  };

@ -5630,11 +5630,11 @@ in {

  dateutil = buildPythonPackage (rec {
    name = "dateutil-${version}";
-    version = "2.4.2";
+    version = "2.5.3";

    src = pkgs.fetchurl {
      url = "mirror://pypi/p/python-dateutil/python-${name}.tar.gz";
-      sha256 = "3e95445c1db500a344079a47b171c45ef18f57d188dffdb0e4165c71bea8eb3d";
+      sha256 = "1v9j9fmf8g911yg6k01xa2db6dx3wv73zkk7fncsj7vagjqgs20l";
    };

    propagatedBuildInputs = with self; [ self.six ];
@ -8168,12 +8168,12 @@ in {
  };

  passlib = buildPythonPackage rec {
-    version = "1.6.2";
+    version = "1.6.5";
    name    = "passlib-${version}";

    src = pkgs.fetchurl {
      url = "mirror://pypi/p/passlib/passlib-${version}.tar.gz";
-      sha256 = "e987f6000d16272f75314c7147eb015727e8532a3b747b1a8fb58e154c68392d";
+      sha256 = "1z27wdxs5rj5xhhqfzvzn3yg682irkxw6dcs5jj7mcf97psk8gd8";
    };

    buildInputs = with self; [ nose pybcrypt];
@ -12888,11 +12888,11 @@ in {
  };

  jmespath = buildPythonPackage rec {
-    name = "jmespath-0.7.1";
+    name = "jmespath-0.9.0";

    src = pkgs.fetchurl {
      url = "mirror://pypi/j/jmespath/${name}.tar.gz";
-      sha256 = "1lazbx65imassd7h24z49za001rvx1lmx8r0l21h4izs7pp14nnd";
+      sha256 = "0g9xvl69y7nr3w7ag4fsp6sm4fqf6vrqjw7504x2hzrrsh3ampq8";
    };

    buildInputs = with self; [ nose ];
@ -13721,6 +13721,38 @@ in {
    };
  };

+  markdown-macros = buildPythonPackage rec {
+    name = "markdown-macros-${version}";
+    version = "0.1.2";
+
+    src = pkgs.fetchurl {
+      url = "mirror://pypi/m/markdown-macros/${name}.tar.gz";
+      sha256 = "1lzvrb7nci22yp21ab2qqc9p0fhkazqj29vw0wln2r4ckb2nbawv";
+    };
+
+    patches = [
+      # Fixes a bug with markdown>2.4
+      (pkgs.fetchpatch {
+        url = "https://github.com/wnielson/markdown-macros/pull/1.patch";
+        sha256 = "17njbgq2srzkf03ar6yn92frnsbda3g45cdi529fdh0x8mmyxci0";
+      })
+    ];
+
+    prePatch = ''
+      substituteInPlace setup.py --replace "distribute" "setuptools"
+    '';
+
+    propagatedBuildInputs = with self; [ markdown ];
+
+    doCheck = false;
+
+    meta = {
+      description = "An extension for python-markdown that makes writing trac-like macros easy";
+      homepage = https://github.com/wnielson/markdown-macros;
+      license = licenses.mit;
+      maintainers = [ maintainers.abigailbuccaneer ];
+    };
+  };

  mathics = buildPythonPackage rec {
    name = "mathics-${version}";
@ -17193,11 +17225,11 @@ in {

  fasteners = buildPythonPackage rec {
    name = "fasteners-${version}";
-    version = "0.13.0";
+    version = "0.14.1";

    src = pkgs.fetchurl {
-      url = "mirror://pypi/f/fasteners/fasteners-0.13.0.tar.gz";
-      sha256 = "0nghdq3zihiqg10dp76ls7yn44m5wjncyz7fk8isagkrspkh9a3n";
+      url = "mirror://pypi/f/fasteners/${name}.tar.gz";
+      sha256 = "063y20kx01ihbz2mziapmjxi2cd0dq48jzg587xdsdp07xvpcz22";
    };

    propagatedBuildInputs = with self; [ six monotonic testtools ];
@ -17672,6 +17704,29 @@ in {
    };
  };

+  patch = buildPythonPackage rec {
+    name = "${pname}-${version}";
+    version = "1.16";
+    pname = "patch";
+
+    src = pkgs.fetchzip {
+      url = "mirror://pypi/p/${pname}/${name}.zip";
+      sha256 = "1nj55hvyvzax4lxq7vkyfbw91pianzr3hp7ka7j12pgjxccac50g";
+      stripRoot = false;
+    };
+
+    # No tests included in archive
+    doCheck = false;
+
+    meta = {
+      description = "A library to parse and apply unified diffs";
+      homepage = https://github.com/techtonik/python-patch/;
+      license = licenses.mit;
+      platforms = platforms.all;
+      maintainers = [ maintainers.igsha ];
+    };
+  };
+
  pathos = buildPythonPackage rec {
    name = "pathos-${version}";
    version = "0.2.0";
@ -22312,12 +22367,12 @@ in {
  };

  s3transfer = buildPythonPackage rec {
-    version = "0.0.1"; # This version is required by awscli
+    version = "0.1.9";
    name = "s3transfer-${version}";

    src = pkgs.fetchurl {
      url = "mirror://pypi/s/s3transfer/${name}.tar.gz";
-      sha256 = "0ma31zvv7gy240xgd1zw853lpzkdci6mapzpg3x4vycann6yvf9b";
+      sha256 = "0m67nhdnp2pd11j8h4bgz63zq0mvn2f205vrxmr3my8m45kpvb8p";
    };

    foo = 1;
@ -22468,16 +22523,19 @@ in {

  scikitimage = buildPythonPackage rec {
    name = "scikit-image-${version}";
-    version = "0.11.3";
+    version = "0.12.3";

    src = pkgs.fetchurl {
      url = "mirror://pypi/s/scikit-image/${name}.tar.gz";
-      sha256 = "768e568f3299966c294b7eb8cd114fc648f7bfaef422ee9cc750dd8d9d09e44b";
+      sha256 = "1iypjww5hk46i9vzg2zlfc9w4vdw029cfyakkkl02isj1qpiknl2";
    };

-    buildInputs = with self; [ cython nose numpy six ];
+    buildInputs = with self; [ cython dask nose numpy scipy six ];

-    propagatedBuildInputs = with self; [ pillow matplotlib networkx scipy ];
+    propagatedBuildInputs = with self; [ pillow matplotlib networkx scipy six numpy ];
+
+    # the test fails because the loader cannot create test objects!
+    doCheck = false;

    meta = {
      description = "Image processing routines for SciPy";