Merge remote-tracking branch 'upstream/master' into HEAD

63 files changed, 832 insertions, 694 deletions

diff --git a/lib/licenses.nix b/lib/licenses.nix
index a790b576032..1bb153ce4c3 100644
--- a/lib/licenses.nix
+++ b/lib/licenses.nix
@@ -281,6 +281,11 @@ lib.mapAttrs (n: v: v // { shortName = n; }) rec {
     url = https://fedoraproject.org/wiki/Licensing/GPL_Classpath_Exception;
   };
 
+  hpnd = spdx {
+    spdxId = "HPND";
+    fullName = "Historic Permission Notice and Disclaimer";
+  };
+
   # Intel's license, seems free
   iasl = {
     fullName = "iASL";
diff --git a/nixos/doc/manual/release-notes/rl-1709.xml b/nixos/doc/manual/release-notes/rl-1709.xml
index 1d6e693f83c..e4fac275d79 100644
--- a/nixos/doc/manual/release-notes/rl-1709.xml
+++ b/nixos/doc/manual/release-notes/rl-1709.xml
@@ -335,6 +335,13 @@ FLUSH PRIVILEGES;
     was removed and should not be needed anymore.</para>
   </listitem>
 
+  <listitem>
+    <para>
+      Redis has been updated to version 4 which mandates a cluster
+      mass-restart, due to changes in the network handling, in order
+      to ensure compatibility with networks NATing traffic.
+    </para>
+  </listitem>
 </itemizedlist>
 
 <para>Other notable improvements:</para>
@@ -432,6 +439,16 @@ FLUSH PRIVILEGES;
       version, kernel version and build date of all bootable generations.
     </para>
   </listitem>
+  <listitem>
+    <para>
+      The dnscrypt-proxy service now defaults to using a random upstream resolver,
+      selected from the list of public non-logging resolvers with DNSSEC support.
+      Existing configurations can be migrated to this mode of operation by
+      omitting the <option>services.dnscrypt-proxy.resolverName</option> option
+      or setting it to <literal>"random"</literal>.
+    </para>
+  </listitem>
+
 </itemizedlist>
 
 </section>
diff --git a/nixos/modules/hardware/video/nvidia.nix b/nixos/modules/hardware/video/nvidia.nix
index 80abec95c03..52f1773e9c4 100644
--- a/nixos/modules/hardware/video/nvidia.nix
+++ b/nixos/modules/hardware/video/nvidia.nix
@@ -40,6 +40,12 @@ in
 {
 
   config = mkIf enabled {
+    assertions = [
+      {
+        assertion = services.xserver.displayManager.gdm.wayland;
+        message = "NVidia drivers don't support wayland";
+      }
+    ];
 
     services.xserver.drivers = singleton
       { name = "nvidia"; modules = [ nvidia_x11.bin ]; libPath = [ nvidia_x11 ]; };
@@ -62,11 +68,16 @@ in
     boot.extraModulePackages = [ nvidia_x11.bin ];
 
     # nvidia-uvm is required by CUDA applications.
-    boot.kernelModules = [ "nvidia-uvm" ];
+    boot.kernelModules = [ "nvidia-uvm" ] ++
+      lib.optionals config.services.xserver.enable [ "nvidia" "nvidia_modeset" "nvidia_drm" ];
+
 
     # Create /dev/nvidia-uvm when the nvidia-uvm module is loaded.
     services.udev.extraRules =
       ''
+        KERNEL=="nvidia", RUN+="${pkgs.stdenv.shell} -c 'mknod -m 666 /dev/nvidiactl c $(grep nvidia-frontend /proc/devices | cut -d \  -f 1) 255'"
+        KERNEL=="nvidia_modeset", RUN+="${pkgs.stdenv.shell} -c 'mknod -m 666 /dev/nvidia-modeset c $(grep nvidia-frontend /proc/devices | cut -d \  -f 1) 254'"
+        KERNEL=="card*", SUBSYSTEM=="drm", DRIVERS=="nvidia", RUN+="${pkgs.stdenv.shell} -c 'mknod -m 666 /dev/nvidia%n c $(grep nvidia-frontend /proc/devices | cut -d \  -f 1) %n'"
         KERNEL=="nvidia_uvm", RUN+="${pkgs.stdenv.shell} -c 'mknod -m 666 /dev/nvidia-uvm c $(grep nvidia-uvm /proc/devices | cut -d \  -f 1) 0'"
       '';
 
diff --git a/nixos/modules/installer/cd-dvd/iso-image.nix b/nixos/modules/installer/cd-dvd/iso-image.nix
index 96f7aac1d59..a039f7fdcb6 100644
--- a/nixos/modules/installer/cd-dvd/iso-image.nix
+++ b/nixos/modules/installer/cd-dvd/iso-image.nix
@@ -361,6 +361,9 @@ in
         { source = config.isoImage.splashImage;
           target = "/isolinux/background.png";
         }
+        { source = pkgs.writeText "version" config.system.nixosVersion;
+          target = "/version.txt";
+        }
       ] ++ optionals config.isoImage.makeEfiBootable [
         { source = efiImg;
           target = "/boot/efi.img";
diff --git a/nixos/modules/services/monitoring/monit.nix b/nixos/modules/services/monitoring/monit.nix
index e07ffd2e8b5..71f50cc0f19 100644
--- a/nixos/modules/services/monitoring/monit.nix
+++ b/nixos/modules/services/monitoring/monit.nix
@@ -17,20 +17,22 @@ in
       };
       config = mkOption {
         default = "";
-        description = "monit.conf content";
+        description = "monitrc content";
       };
     };
   };
 
   config = mkIf config.services.monit.enable {
 
+    environment.systemPackages = [ pkgs.monit ];
+
     environment.etc = [
       {
         source = pkgs.writeTextFile {
-          name = "monit.conf";
+          name = "monitrc";
           text = config.services.monit.config;
         };
-        target = "monit.conf";
+        target = "monitrc";
         mode = "0400";
       }
     ];
@@ -40,9 +42,9 @@ in
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
       serviceConfig = {
-        ExecStart = "${pkgs.monit}/bin/monit -I -c /etc/monit.conf";
-        ExecStop = "${pkgs.monit}/bin/monit -c /etc/monit.conf quit";
-        ExecReload = "${pkgs.monit}/bin/monit -c /etc/monit.conf reload";
+        ExecStart = "${pkgs.monit}/bin/monit -I -c /etc/monitrc";
+        ExecStop = "${pkgs.monit}/bin/monit -c /etc/monitrc quit";
+        ExecReload = "${pkgs.monit}/bin/monit -c /etc/monitrc reload";
         KillMode = "process";
         Restart = "always";
       };
diff --git a/nixos/modules/services/networking/consul.nix b/nixos/modules/services/networking/consul.nix
index 166ee773237..6333970cb33 100644
--- a/nixos/modules/services/networking/consul.nix
+++ b/nixos/modules/services/networking/consul.nix
@@ -183,6 +183,7 @@ in
           ExecReload = "${cfg.package.bin}/bin/consul reload";
           PermissionsStartOnly = true;
           User = if cfg.dropPrivileges then "consul" else null;
+          Restart = "on-failure";
           TimeoutStartSec = "0";
         } // (optionalAttrs (cfg.leaveOnStop) {
           ExecStop = "${cfg.package.bin}/bin/consul leave";
diff --git a/nixos/modules/services/networking/tinc.nix b/nixos/modules/services/networking/tinc.nix
index 0354e76d74f..adb80ea2984 100644
--- a/nixos/modules/services/networking/tinc.nix
+++ b/nixos/modules/services/networking/tinc.nix
@@ -163,6 +163,12 @@ in
         wantedBy = [ "multi-user.target" ];
         after = [ "network.target" ];
         path = [ data.package ];
+        restartTriggers =
+          let
+            drvlist = [ config.environment.etc."tinc/${network}/tinc.conf".source ]
+                        ++ mapAttrsToList (host: _: config.environment.etc."tinc/${network}/hosts/${host}".source) data.hosts;
+          in # drvlist might be too long to be used directly
+            [ (builtins.hashString "sha256" (concatMapStrings (d: d.outPath) drvlist)) ];
         serviceConfig = {
           Type = "simple";
           Restart = "always";
diff --git a/nixos/modules/services/networking/wpa_supplicant.nix b/nixos/modules/services/networking/wpa_supplicant.nix
index c91ba91fcb4..908c8730ad2 100644
--- a/nixos/modules/services/networking/wpa_supplicant.nix
+++ b/nixos/modules/services/networking/wpa_supplicant.nix
@@ -148,6 +148,7 @@ in {
       wants = [ "network.target" ];
       requires = lib.concatMap deviceUnit ifaces;
       wantedBy = [ "multi-user.target" ];
+      stopIfChanged = false;
 
       path = [ pkgs.wpa_supplicant ];
 
diff --git a/nixos/modules/services/networking/znc.nix b/nixos/modules/services/networking/znc.nix
index 763843fdec0..3d9cec46a58 100644
--- a/nixos/modules/services/networking/znc.nix
+++ b/nixos/modules/services/networking/znc.nix
@@ -212,6 +212,14 @@ in
         '';
       };
 
+      openFirewall = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to open ports in the firewall for ZNC.
+        '';
+      };
+
       zncConf = mkOption {
         default = "";
         example = "See: http://wiki.znc.in/Configuration";
@@ -276,14 +284,6 @@ in
           '';
         };
 
-        openFirewall = mkOption {
-          type = types.bool;
-          default = false;
-          description = ''
-            Whether to open ports in the firewall for ZNC.
-          '';
-        };
-
         passBlock = mkOption {
           example = defaultPassBlock;
           type = types.string;
@@ -359,7 +359,7 @@ in
   config = mkIf cfg.enable {
 
     networking.firewall = mkIf cfg.openFirewall {
-      allowedTCPPorts = [ cfg.port ];
+      allowedTCPPorts = [ cfg.confOptions.port ];
     };
 
     systemd.services.znc = {
diff --git a/nixos/modules/services/x11/display-managers/gdm.nix b/nixos/modules/services/x11/display-managers/gdm.nix
index b0a3ff1bb75..83c5c95dae7 100644
--- a/nixos/modules/services/x11/display-managers/gdm.nix
+++ b/nixos/modules/services/x11/display-managers/gdm.nix
@@ -64,6 +64,14 @@ in
         };
       };
 
+      wayland = mkOption {
+        default = true;
+        description = ''
+          Allow GDM run on Wayland instead of Xserver
+        '';
+        type = types.bool;
+      };
+
     };
 
   };
@@ -94,6 +102,7 @@ in
     # GDM needs different xserverArgs, presumable because using wayland by default.
     services.xserver.tty = null;
     services.xserver.display = null;
+    services.xserver.verbose = null;
 
     services.xserver.displayManager.job =
       {
@@ -139,6 +148,7 @@ in
     # presented and there's a little delay.
     environment.etc."gdm/custom.conf".text = ''
       [daemon]
+      WaylandEnable=${if cfg.gdm.wayland then "true" else "false"}
       ${optionalString cfg.gdm.autoLogin.enable (
         if cfg.gdm.autoLogin.delay > 0 then ''
           TimedLoginEnable=true
diff --git a/nixos/modules/services/x11/xserver.nix b/nixos/modules/services/x11/xserver.nix
index 3ce124d3da2..d4fe475690c 100644
--- a/nixos/modules/services/x11/xserver.nix
+++ b/nixos/modules/services/x11/xserver.nix
@@ -480,6 +480,15 @@ in
         '';
       };
 
+      verbose = mkOption {
+        type = types.nullOr types.int;
+        default = 3;
+        example = 7;
+        description = ''
+          Controls verbosity of X logging.
+        '';
+      };
+
       useGlamor = mkOption {
         type = types.bool;
         default = false;
@@ -631,10 +640,11 @@ in
       [ "-config ${configFile}"
         "-xkbdir" "${cfg.xkbDir}"
         # Log at the default verbosity level to stderr rather than /var/log/X.*.log.
-        "-verbose" "3" "-logfile" "/dev/null"
+         "-logfile" "/dev/null"
       ] ++ optional (cfg.display != null) ":${toString cfg.display}"
         ++ optional (cfg.tty     != null) "vt${toString cfg.tty}"
         ++ optional (cfg.dpi     != null) "-dpi ${toString cfg.dpi}"
+        ++ optional (cfg.verbose != null) "-verbose ${toString cfg.verbose}"
         ++ optional (!cfg.enableTCP) "-nolisten tcp"
         ++ optional (cfg.autoRepeatDelay != null) "-ardelay ${toString cfg.autoRepeatDelay}"
         ++ optional (cfg.autoRepeatInterval != null) "-arinterval ${toString cfg.autoRepeatInterval}"
diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix
index ed1f5d20afb..dd9ba710448 100644
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@@ -875,7 +875,12 @@ in
     systemd.services.systemd-remount-fs.restartIfChanged = false;
     systemd.services.systemd-update-utmp.restartIfChanged = false;
     systemd.services.systemd-user-sessions.restartIfChanged = false; # Restart kills all active sessions.
-    systemd.services.systemd-logind.restartTriggers = [ config.environment.etc."systemd/logind.conf".source ];
+    # Restarting systemd-logind breaks X11
+    # - upstream commit: https://cgit.freedesktop.org/xorg/xserver/commit/?id=dc48bd653c7e101
+    # - systemd announcement: https://github.com/systemd/systemd/blob/22043e4317ecd2bc7834b48a6d364de76bb26d91/NEWS#L103-L112
+    # - this might be addressed in the future by xorg
+    #systemd.services.systemd-logind.restartTriggers = [ config.environment.etc."systemd/logind.conf".source ];
+    systemd.services.systemd-logind.restartIfChanged = false;
     systemd.services.systemd-logind.stopIfChanged = false;
     systemd.services.systemd-journald.restartTriggers = [ config.environment.etc."systemd/journald.conf".source ];
     systemd.services.systemd-journald.stopIfChanged = false;
diff --git a/nixos/modules/tasks/kbd.nix b/nixos/modules/tasks/kbd.nix
index 3975dd5b0ff..7fb3cbc5c1b 100644
--- a/nixos/modules/tasks/kbd.nix
+++ b/nixos/modules/tasks/kbd.nix
@@ -98,22 +98,10 @@ in
           '') config.i18n.consoleColors}
         '';
 
-        /* XXX: systemd-vconsole-setup needs a "main" terminal. By default
-         * /dev/tty0 is used which wouldn't work when the service is restarted
-         * from X11. We set this to /dev/tty1; not ideal because it may also be
-         * owned by X11 or something else.
-         *
-         * See #22470.
-         */
         systemd.services."systemd-vconsole-setup" =
-          { wantedBy = [ "sysinit.target" ];
-            before = [ "display-manager.service" ];
+          { before = [ "display-manager.service" ];
             after = [ "systemd-udev-settle.service" ];
             restartTriggers = [ vconsoleConf kbdEnv ];
-            serviceConfig.ExecStart = [
-              ""
-              "${pkgs.systemd}/lib/systemd/systemd-vconsole-setup /dev/tty1"
-            ];
           };
       }
 
diff --git a/nixos/modules/tasks/network-interfaces-scripted.nix b/nixos/modules/tasks/network-interfaces-scripted.nix
index 3512296dff4..e92c9bc27de 100644
--- a/nixos/modules/tasks/network-interfaces-scripted.nix
+++ b/nixos/modules/tasks/network-interfaces-scripted.nix
@@ -122,24 +122,32 @@ let
 
                 # Set the default gateway.
                 ${optionalString (cfg.defaultGateway != null && cfg.defaultGateway.address != "") ''
-                  # FIXME: get rid of "|| true" (necessary to make it idempotent).
-                  ip route add default ${optionalString (cfg.defaultGateway.metric != null)
+                  ${optionalString (cfg.defaultGateway.interface != null) ''
+                    ip route replace ${cfg.defaultGateway.address} dev ${cfg.defaultGateway.interface} ${optionalString (cfg.defaultGateway.metric != null)
+                      "metric ${toString cfg.defaultGateway.metric}"
+                    } proto static
+                  ''}
+                  ip route replace default ${optionalString (cfg.defaultGateway.metric != null)
                       "metric ${toString cfg.defaultGateway.metric}"
                     } via "${cfg.defaultGateway.address}" ${
                     optionalString (cfg.defaultGatewayWindowSize != null)
                       "window ${toString cfg.defaultGatewayWindowSize}"} ${
                     optionalString (cfg.defaultGateway.interface != null)
-                      "dev ${cfg.defaultGateway.interface}"} proto static || true
+                      "dev ${cfg.defaultGateway.interface}"} proto static
                 ''}
                 ${optionalString (cfg.defaultGateway6 != null && cfg.defaultGateway6.address != "") ''
-                  # FIXME: get rid of "|| true" (necessary to make it idempotent).
-                  ip -6 route add ::/0 ${optionalString (cfg.defaultGateway6.metric != null)
+                  ${optionalString (cfg.defaultGateway6.interface != null) ''
+                    ip -6 route replace ${cfg.defaultGateway6.address} dev ${cfg.defaultGateway6.interface} ${optionalString (cfg.defaultGateway6.metric != null)
+                      "metric ${toString cfg.defaultGateway6.metric}"
+                    } proto static
+                  ''}
+                  ip -6 route replace default ${optionalString (cfg.defaultGateway6.metric != null)
                       "metric ${toString cfg.defaultGateway6.metric}"
                     } via "${cfg.defaultGateway6.address}" ${
                     optionalString (cfg.defaultGatewayWindowSize != null)
                       "window ${toString cfg.defaultGatewayWindowSize}"} ${
                     optionalString (cfg.defaultGateway6.interface != null)
-                      "dev ${cfg.defaultGateway6.interface}"} proto static || true
+                      "dev ${cfg.defaultGateway6.interface}"} proto static
                 ''}
               '';
           };
diff --git a/nixos/tests/mesos.nix b/nixos/tests/mesos.nix
index 6e9af126f03..34671df047c 100644
--- a/nixos/tests/mesos.nix
+++ b/nixos/tests/mesos.nix
@@ -56,9 +56,7 @@ import ./make-test.nix ({ pkgs, ...} : rec {
     src = ./mesos_test.py;
     phases = [ "installPhase" "fixupPhase" ];
     installPhase = ''
-      mkdir $out
-      cp $src $out/mesos_test.py
-      chmod +x $out/mesos_test.py
+      install -Dvm 0755 $src $out/bin/mesos_test.py
 
       echo "done" > test.result
       tar czf $out/test.tar.gz test.result
@@ -74,18 +72,18 @@ import ./make-test.nix ({ pkgs, ...} : rec {
       $master->waitForOpenPort(5050);
       $slave->waitForOpenPort(5051);
 
-      # is slave registred? 
+      # is slave registered?
       $master->waitUntilSucceeds("curl -s --fail http://master:5050/master/slaves".
                                  " | grep -q \"\\\"hostname\\\":\\\"slave\\\"\"");
 
-      # try to run docker image 
+      # try to run docker image
       $master->succeed("${pkgs.mesos}/bin/mesos-execute --master=master:5050".
                        " --resources=\"cpus:0.1;mem:32\" --name=simple-docker".
                        " --containerizer=mesos --docker_image=echo:latest".
                        " --shell=true --command=\"echo done\" | grep -q TASK_FINISHED");
 
       # simple command with .tar.gz uri
-      $master->succeed("${testFramework}/mesos_test.py master ".
+      $master->succeed("${testFramework}/bin/mesos_test.py master ".
                        "${testFramework}/test.tar.gz");
     '';
 })
diff --git a/pkgs/applications/altcoins/bitcoin-abc.nix b/pkgs/applications/altcoins/bitcoin-abc.nix
new file mode 100644
index 00000000000..d3800062b11
--- /dev/null
+++ b/pkgs/applications/altcoins/bitcoin-abc.nix
@@ -0,0 +1,43 @@
+{ stdenv, fetchFromGitHub, pkgconfig, autoreconfHook, openssl, db48, boost
+, zlib, miniupnpc, qt5, utillinux, protobuf, qrencode, libevent
+, withGui }:
+
+with stdenv.lib;
+
+stdenv.mkDerivation rec {
+
+  name = "bitcoin" + (toString (optional (!withGui) "d")) + "-abc-" + version;
+  version = "0.15.0";
+
+  src = fetchFromGitHub {
+    owner = "bitcoin-ABC";
+    repo = "bitcoin-abc";
+    rev = "v${version}";
+    sha256 = "1fygn6cc99iasg5g5jyps5ps873hfnn4ln4hsmcwlwiqd591qxyv";
+  };
+
+  patches = [ ./fix-bitcoin-qt-build.patch ];
+
+  nativeBuildInputs = [ pkgconfig autoreconfHook ];
+  buildInputs = [ openssl db48 boost zlib
+                  miniupnpc utillinux protobuf libevent ]
+                  ++ optionals withGui [ qt5.qtbase qt5.qttools qrencode ];
+
+  configureFlags = [ "--with-boost-libdir=${boost.out}/lib" ]
+                     ++ optionals withGui [ "--with-gui=qt5" ];
+
+  meta = {
+    description = "Peer-to-peer electronic cash system (Cash client)";
+    longDescription= ''
+      Bitcoin ABC is the name of open source software which enables the use of Bitcoin.
+      It is designed to facilite a hard fork to increase Bitcoin's block size limit.
+      "ABC" stands for "Adjustable Blocksize Cap".
+
+      Bitcoin ABC is a fork of the Bitcoin Core software project.
+    '';
+    homepage = https://bitcoinabc.org/;
+    maintainers = with maintainers; [ lassulus ];
+    license = licenses.mit;
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/applications/altcoins/default.nix b/pkgs/applications/altcoins/default.nix
index 31dcc78d3d7..f83e565db91 100644
--- a/pkgs/applications/altcoins/default.nix
+++ b/pkgs/applications/altcoins/default.nix
@@ -5,6 +5,9 @@ rec {
   bitcoin  = callPackage ./bitcoin.nix { withGui = true; };
   bitcoind = callPackage ./bitcoin.nix { withGui = false; };
 
+  bitcoin-abc  = callPackage ./bitcoin-abc.nix { withGui = true; };
+  bitcoind-abc = callPackage ./bitcoin-abc.nix { withGui = false; };
+
   bitcoin-unlimited  = callPackage ./bitcoin-unlimited.nix { withGui = true; };
   bitcoind-unlimited = callPackage ./bitcoin-unlimited.nix { withGui = false; };
 
diff --git a/pkgs/applications/altcoins/fix-bitcoin-qt-build.patch b/pkgs/applications/altcoins/fix-bitcoin-qt-build.patch
new file mode 100644
index 00000000000..cbbfd85fe5b
--- /dev/null
+++ b/pkgs/applications/altcoins/fix-bitcoin-qt-build.patch
@@ -0,0 +1,15 @@
+--- bitcoin-abc-v0.15.0-src/build-aux/m4/bitcoin_qt.m4	1970-01-01 01:00:01.000000000 +0100
++++ bitcoin-abc-v0.15.0-src.org/build-aux/m4/bitcoin_qt.m4	2017-09-27 23:38:44.748384197 +0100
+@@ -35,11 +35,7 @@
+ dnl Output: $1 is set to the path of $2 if found. $2 are searched in order.
+ AC_DEFUN([BITCOIN_QT_PATH_PROGS],[
+   BITCOIN_QT_CHECK([
+-    if test "x$3" != "x"; then
+-      AC_PATH_PROGS($1,$2,,$3)
+-    else
+-      AC_PATH_PROGS($1,$2)
+-    fi
++    AC_PATH_PROGS($1,$2)
+     if test "x$$1" = "x" && test "x$4" != "xyes"; then
+       BITCOIN_QT_FAIL([$1 not found])
+     fi
diff --git a/pkgs/applications/misc/mupdf/default.nix b/pkgs/applications/misc/mupdf/default.nix
index da5f3c3bf12..9fe275b490c 100644
--- a/pkgs/applications/misc/mupdf/default.nix
+++ b/pkgs/applications/misc/mupdf/default.nix
@@ -1,6 +1,8 @@
-{ stdenv, fetchurl, fetchpatch, pkgconfig
-, zlib, freetype, libjpeg, jbig2dec, openjpeg
-, libX11, libXcursor, libXrandr, libXinerama, libXext, harfbuzz, mesa }:
+{ stdenv, lib, fetchurl, fetchpatch, pkgconfig
+, freetype, harfbuzz, openjpeg, jbig2dec
+, enableX11 ? true, libX11, libXext
+, enableCurl ? true, curl, openssl
+}:
 
 stdenv.mkDerivation rec {
   version = "1.11";
@@ -28,7 +30,9 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "prefix=$(out)" ];
   nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ zlib libX11 libXcursor libXext harfbuzz mesa libXrandr libXinerama freetype libjpeg jbig2dec openjpeg ];
+  buildInputs = [ freetype harfbuzz openjpeg jbig2dec ]
+                ++ lib.optionals enableX11 [ libX11 libXext ]
+                ++ lib.optionals enableCurl [ curl openssl ];
   outputs = [ "bin" "dev" "out" "man" "doc" ];
 
   preConfigure = ''
diff --git a/pkgs/applications/misc/octoprint/m33-fio-one-library.patch b/pkgs/applications/misc/octoprint/m33-fio-one-library.patch
index 87b00f3ab70..24c9c4a80f5 100644
--- a/pkgs/applications/misc/octoprint/m33-fio-one-library.patch
+++ b/pkgs/applications/misc/octoprint/m33-fio-one-library.patch
@@ -1,18 +1,18 @@
-From 0defcf6ec155899c414f66524b7df629f59327f0 Mon Sep 17 00:00:00 2001
+From 314bcebfcd1759981ce12255be29d8ae68cd400b Mon Sep 17 00:00:00 2001
 From: Nikolay Amiantov <ab@fmap.me>
 Date: Wed, 23 Nov 2016 00:40:48 +0300
 Subject: [PATCH] Build and use one version of preprocessor library
 
 ---
- octoprint_m33fio/__init__.py   | 67 ++----------------------------------------
- shared library source/Makefile | 62 +++-----------------------------------
- 2 files changed, 6 insertions(+), 123 deletions(-)
+ octoprint_m33fio/__init__.py   | 73 ++----------------------------------------
+ shared library source/Makefile | 62 +++--------------------------------
+ 2 files changed, 6 insertions(+), 129 deletions(-)
 
 diff --git a/octoprint_m33fio/__init__.py b/octoprint_m33fio/__init__.py
-index 4b43c59..d1259e4 100755
+index 054870a..4d5ecc1 100755
 --- a/octoprint_m33fio/__init__.py
 +++ b/octoprint_m33fio/__init__.py
-@@ -1062,71 +1062,8 @@ class M33FioPlugin(
+@@ -1189,78 +1189,9 @@ class M33FioPlugin(
  		# Check if using shared library or checking if it is usable
  		if self._settings.get_boolean(["UseSharedLibrary"]) or isUsable :
  	
@@ -54,7 +54,9 @@ index 4b43c59..d1259e4 100755
 -
 -			# Otherwise check if running on Windows and using an i386 or x86-64 device
 -			elif platform.uname()[0].startswith("Windows") and (platform.uname()[4].endswith("86") or platform.uname()[4].endswith("64")) :
--
++			# Set shared library
++			self.sharedLibrary = ctypes.cdll.LoadLibrary(self._basefolder.replace('\\', '/') + "/static/libraries/libpreprocessor.so")
+ 
 -				# Check if Python is running as 32-bit
 -				if platform.architecture()[0].startswith("32") :
 -	
@@ -81,11 +83,16 @@ index 4b43c59..d1259e4 100755
 -	
 -					# Set shared library
 -					self.sharedLibrary = ctypes.cdll.LoadLibrary(self._basefolder.replace("\\", "/") + "/static/libraries/preprocessor_x86-64.dylib")
-+			# Set shared library
-+			self.sharedLibrary = ctypes.cdll.LoadLibrary(self._basefolder.replace('\\', '/') + "/static/libraries/libpreprocessor.so")
- 
+-			
+-			# Otherwise check if running FreeBSD
+-			elif platform.uname()[0].startswith("FreeBSD") :
+-			
+-				# TODO: Compile FreeBSD shared library pre-processors
+-				pass
+-			
  			# Check if shared library was set
  			if self.sharedLibrary :
+ 
 diff --git a/shared library source/Makefile b/shared library source/Makefile
 index 792b4f4..4c74f5c 100755
 --- a/shared library source/Makefile	
@@ -164,5 +171,5 @@ index 792b4f4..4c74f5c 100755
  clean:
  	rm -f ../octoprint_m33fio/static/libraries/$(PROG)
 -- 
-2.11.0
+2.14.1
 
diff --git a/pkgs/applications/misc/octoprint/plugins.nix b/pkgs/applications/misc/octoprint/plugins.nix
index c09e8d2f5e6..0a1d26012a8 100644
--- a/pkgs/applications/misc/octoprint/plugins.nix
+++ b/pkgs/applications/misc/octoprint/plugins.nix
@@ -12,13 +12,13 @@ let
 
     m33-fio = buildPlugin rec {
       name = "M33-Fio-${version}";
-      version = "1.20";
+      version = "1.21";
 
       src = fetchFromGitHub {
         owner = "donovan6000";
         repo = "M33-Fio";
         rev = "V${version}";
-        sha256 = "1ng7lzlkqsjcr1w7wgzwsqkkvcvpajcj2cwqlffh95916sw8n767";
+        sha256 = "1la3611kkqn8yiwjn6cizc45ri8pnk6ckld1na4nk6mqk88jvjq7";
       };
 
       patches = [
diff --git a/pkgs/applications/networking/browsers/tor-browser-bundle/default.nix b/pkgs/applications/networking/browsers/tor-browser-bundle/default.nix
index ca20125332a..16182c8e4e7 100644
--- a/pkgs/applications/networking/browsers/tor-browser-bundle/default.nix
+++ b/pkgs/applications/networking/browsers/tor-browser-bundle/default.nix
@@ -15,7 +15,6 @@
 , noto-fonts-emoji
 
 # Extensions, common
-, unzip
 , zip
 
 # HTTPS Everywhere
@@ -27,6 +26,7 @@
 
 # Customization
 , extraPrefs ? ""
+, extraExtensions ? [ ]
 }:
 
 let
@@ -36,144 +36,19 @@ let
     sha256 = "0j37mqldj33fnzghxifvy6v8vdwkcz0i4z81prww64md5s8qcsa9";
   };
 
-  # Each extension drv produces an output comprising an unpacked .xpi
-  # named after the extension uuid, as it would appear under
-  # `firefox/extensions'.
-  firefoxExtensions = {
-    https-everywhere = stdenv.mkDerivation rec {
-      name = "https-everywhere-${version}";
-      version = "5.2.21";
-
-      extid = "https-everywhere-eff@eff.org";
-
-      src = fetchgit {
-        url = "https://git.torproject.org/https-everywhere.git";
-        rev = "refs/tags/${version}";
-        sha256 = "0z9madihh4b4z4blvfmh6w1hsv8afyi0x7b243nciq9r4w55xgfa";
-      };
-
-      nativeBuildInputs = [
-        git
-        libxml2 # xmllint
-        python27
-        python27Packages.lxml
-        rsync
-        unzip
-        zip
-      ];
-
-      unpackPhase = ''
-        cp -dR --no-preserve=mode "$src" src
-        cd src
-      '';
-
-      # Beware: the build expects translations/ to be non-empty (which it
-      # will be with submodules initialized).
-      buildPhase = ''
-        $shell ./makexpi.sh ${version} --no-recurse
-      '';
-
-      installPhase = ''
-        mkdir $out
-        unzip -d "$out/$extid" "pkg/https-everywhere-$version-eff.xpi"
-      '';
-
-      meta = {
-        homepage = https://gitweb.torproject.org/https-everywhere.git/;
-      };
-    };
-
-    noscript = stdenv.mkDerivation rec {
-      name = "noscript-${version}";
-      version = "5.0.10";
-
-      extid = "{73a6fe31-595d-460b-a920-fcc0f8843232}";
-
-      src = fetchurl {
-        url = "https://secure.informaction.com/download/releases/noscript-${version}.xpi";
-        sha256 = "18k5karbaj5mhd9cyjbqgik6044bw88rjalkh6anjanxbn503j6g";
-      };
-
-      nativeBuildInputs = [ unzip ];
-
-      unpackPhase = ":";
-
-      installPhase = ''
-        mkdir $out
-        unzip -d "$out/$extid" "$src"
-      '';
-    };
-
-    torbutton = stdenv.mkDerivation rec {
-      name = "torbutton-${version}";
-      version = "1.9.8.1";
-
-      extid = "torbutton@torproject.org";
-
-      src = fetchgit {
-        url = "https://git.torproject.org/torbutton.git";
-        rev = "refs/tags/${version}";
-        sha256 = "1amp0c9ky0a7fsa0bcbi6n6ginw7s2g3an4rj7kvc1lxmrcsm65l";
-      };
-
-      nativeBuildInputs = [ unzip zip ];
-
-      unpackPhase = ''
-        cp -dR --no-preserve=mode "$src" src
-        cd src
-      '';
-
-      buildPhase = ''
-        $shell ./makexpi.sh
-      '';
-
-      installPhase = ''
-        mkdir $out
-        unzip -d "$out/$extid" "pkg/torbutton-$version.xpi"
-      '';
-
-      meta = {
-        homepage = https://gitweb.torproject.org/torbutton.git/;
-      };
-    };
-
-    tor-launcher = stdenv.mkDerivation rec {
-      name = "tor-launcher-${version}";
-      version = "0.2.12.3";
-
-      extid = "tor-launcher@torproject.org";
-
-      src = fetchgit {
-        url = "https://git.torproject.org/tor-launcher.git";
-        rev = "refs/tags/${version}";
-        sha256 = "0126x48pjiy2zm4l8jzhk70w24hviaz560ffp4lb9x0ar615bc9q";
-      };
-
-      nativeBuildInputs = [ unzip zip ];
-
-      unpackPhase = ''
-        cp -dR --no-preserve=mode "$src" src
-        cd src
-      '';
-
-      buildPhase = ''
-        make package
-      '';
-
-      installPhase = ''
-        mkdir $out
-        unzip -d "$out/$extid" "pkg/tor-launcher-$version.xpi"
-      '';
-
-      meta = {
-        homepage = https://gitweb.torproject.org/tor-launcher.git/;
-      };
-    };
+  firefoxExtensions = import ./extensions.nix {
+    inherit stdenv fetchurl fetchgit zip
+      git libxml2 python27 python27Packages rsync;
   };
 
   extensionsEnv = symlinkJoin {
     name = "tor-browser-extensions";
-    paths = with firefoxExtensions; [ https-everywhere noscript torbutton tor-launcher ];
+    paths = with firefoxExtensions; [
+      https-everywhere
+      noscript
+      torbutton
+      tor-launcher
+    ] ++ extraExtensions;
   };
 
   fontsEnv = symlinkJoin {
diff --git a/pkgs/applications/networking/browsers/tor-browser-bundle/extensions.nix b/pkgs/applications/networking/browsers/tor-browser-bundle/extensions.nix
new file mode 100644
index 00000000000..4adf99365ba
--- /dev/null
+++ b/pkgs/applications/networking/browsers/tor-browser-bundle/extensions.nix
@@ -0,0 +1,122 @@
+{ stdenv
+, fetchgit
+, fetchurl
+
+# common
+, zip
+
+# HTTPS Everywhere
+, git
+, libxml2 # xmllint
+, python27
+, python27Packages
+, rsync
+}:
+
+{
+  https-everywhere = stdenv.mkDerivation rec {
+    name = "https-everywhere-${version}";
+    version = "5.2.21";
+
+    extid = "https-everywhere-eff@eff.org";
+
+    src = fetchgit {
+      url = "https://git.torproject.org/https-everywhere.git";
+      rev = "refs/tags/${version}";
+      sha256 = "0z9madihh4b4z4blvfmh6w1hsv8afyi0x7b243nciq9r4w55xgfa";
+    };
+
+    nativeBuildInputs = [
+      git
+      libxml2 # xmllint
+      python27
+      python27Packages.lxml
+      rsync
+      zip
+    ];
+
+    unpackPhase = ''
+      cp -dR --no-preserve=mode "$src" src && cd src
+    '';
+
+    buildPhase = ''
+      $shell ./makexpi.sh ${version} --no-recurse
+    '';
+
+    installPhase = ''
+      install -m 444 -D pkg/https-everywhere-$version-eff.xpi "$out/$extid.xpi"
+    '';
+  };
+
+  noscript = stdenv.mkDerivation rec {
+    name = "noscript-${version}";
+    version = "5.0.10";
+
+    extid = "{73a6fe31-595d-460b-a920-fcc0f8843232}";
+
+    src = fetchurl {
+      url = "https://secure.informaction.com/download/releases/noscript-${version}.xpi";
+      sha256 = "18k5karbaj5mhd9cyjbqgik6044bw88rjalkh6anjanxbn503j6g";
+    };
+
+    unpackPhase = ":";
+
+    installPhase = ''
+      install -m 444 -D $src "$out/$extid.xpi"
+    '';
+  };
+
+  torbutton = stdenv.mkDerivation rec {
+    name = "torbutton-${version}";
+    version = "1.9.8.1";
+
+    extid = "torbutton@torproject.org";
+
+    src = fetchgit {
+      url = "https://git.torproject.org/torbutton.git";
+      rev = "refs/tags/${version}";
+      sha256 = "1amp0c9ky0a7fsa0bcbi6n6ginw7s2g3an4rj7kvc1lxmrcsm65l";
+    };
+
+    nativeBuildInputs = [ zip ];
+
+    unpackPhase = ''
+      cp -dR --no-preserve=mode "$src" src && cd src
+    '';
+
+    buildPhase = ''
+      $shell ./makexpi.sh
+    '';
+
+    installPhase = ''
+      install -m 444 -D pkg/torbutton-$version.xpi "$out/$extid.xpi"
+    '';
+  };
+
+  tor-launcher = stdenv.mkDerivation rec {
+    name = "tor-launcher-${version}";
+    version = "0.2.12.3";
+
+    extid = "tor-launcher@torproject.org";
+
+    src = fetchgit {
+      url = "https://git.torproject.org/tor-launcher.git";
+      rev = "refs/tags/${version}";
+      sha256 = "0126x48pjiy2zm4l8jzhk70w24hviaz560ffp4lb9x0ar615bc9q";
+    };
+
+    nativeBuildInputs = [ zip ];
+
+    unpackPhase = ''
+      cp -dR --no-preserve=mode "$src" src && cd src
+    '';
+
+    buildPhase = ''
+      make package
+    '';
+
+    installPhase = ''
+      install -m 444 -D pkg/tor-launcher-$version.xpi "$out/$extid.xpi"
+    '';
+  };
+}
diff --git a/pkgs/applications/networking/cluster/mesos/default.nix b/pkgs/applications/networking/cluster/mesos/default.nix
index 0506f7c154d..712b1376845 100644
--- a/pkgs/applications/networking/cluster/mesos/default.nix
+++ b/pkgs/applications/networking/cluster/mesos/default.nix
@@ -1,9 +1,9 @@
-{ stdenv, lib, makeWrapper, fetchurl, curl, sasl, openssh, autoconf
-, automake, libtool, unzip, gnutar, jdk, maven, python, wrapPython
+{ stdenv, lib, makeWrapper, fetchurl, curl, sasl, openssh
+, unzip, gnutar, jdk, python, wrapPython
 , setuptools, boto, pythonProtobuf, apr, subversion, gzip, systemd
 , leveldb, glog, perf, utillinux, libnl, iproute, openssl, libevent
-, ethtool, coreutils, which, iptables
-, bash
+, ethtool, coreutils, which, iptables, maven
+, bash, autoreconfHook
 }:
 
 let
@@ -21,7 +21,7 @@ let
   });
 
 in stdenv.mkDerivation rec {
-  version = "1.1.1";
+  version = "1.4.0";
   name = "mesos-${version}";
 
   enableParallelBuilding = true;
@@ -29,7 +29,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://apache/mesos/${version}/${name}.tar.gz";
-    sha256 = "0f46ebb130d2d4a9732f95d0a71d80c8c5967f3c172b110f2ece316e05922115";
+    sha256 = "0c08kd226nrjwm2z2drpq4vi97h9r8b1xkdvkgh1114fxg7cyvys";
   };
 
   patches = [
@@ -40,11 +40,13 @@ in stdenv.mkDerivation rec {
     # see https://github.com/cstrahan/mesos/tree/nixos-${version}
     ./nixos.patch
   ];
-
+  nativeBuildInputs = [
+    autoreconfHook
+  ];
   buildInputs = [
-    makeWrapper autoconf automake libtool curl sasl jdk maven
+    makeWrapper curl sasl jdk
     python wrapPython boto setuptools leveldb
-    subversion apr glog openssl libevent
+    subversion apr glog openssl libevent maven
   ] ++ lib.optionals stdenv.isLinux [
     libnl
   ];
@@ -52,10 +54,6 @@ in stdenv.mkDerivation rec {
   propagatedBuildInputs = [
     pythonProtobuf
   ];
-
-  # note that we *must* statically link libprotobuf.
-  # if we dynamically link the lib, we get these errors:
-  # https://github.com/NixOS/nixpkgs/pull/19064#issuecomment-255082684
   preConfigure = ''
     # https://issues.apache.org/jira/browse/MESOS-6616
     configureFlagsArray+=(
@@ -66,13 +64,10 @@ in stdenv.mkDerivation rec {
     # <sys/types.h> instead of <sys/sysmacros.h>
     sed 1i'#include <sys/sysmacros.h>' -i src/linux/fs.cpp
     sed 1i'#include <sys/sysmacros.h>' -i src/slave/containerizer/mesos/isolators/gpu/isolator.cpp
-
     substituteInPlace 3rdparty/stout/include/stout/os/posix/chown.hpp \
       --subst-var-by chown ${coreutils}/bin/chown
 
     substituteInPlace 3rdparty/stout/Makefile.am \
-      --replace "-lprotobuf" \
-                "${pythonProtobuf.protobuf}/lib/libprotobuf.so"
 
     substituteInPlace 3rdparty/stout/include/stout/os/posix/fork.hpp \
       --subst-var-by sh ${bash}/bin/bash
@@ -99,8 +94,6 @@ in stdenv.mkDerivation rec {
       --subst-var-by mesos-resolve $out/bin/mesos-resolve
 
     substituteInPlace src/python/native_common/ext_modules.py.in \
-      --replace "-lprotobuf" \
-                "${pythonProtobuf.protobuf}/lib/libprotobuf.so"
 
     substituteInPlace src/slave/containerizer/mesos/isolators/gpu/volume.cpp \
       --subst-var-by cp    ${coreutils}/bin/cp \
@@ -124,8 +117,6 @@ in stdenv.mkDerivation rec {
 
     substituteInPlace src/Makefile.am \
       --subst-var-by mavenRepo ${mavenRepo} \
-      --replace "-lprotobuf" \
-                "${pythonProtobuf.protobuf}/lib/libprotobuf.so"
 
   '' + lib.optionalString stdenv.isLinux ''
 
@@ -179,7 +170,7 @@ in stdenv.mkDerivation rec {
     "--enable-libevent"
     "--with-libevent=${libevent.dev}"
     "--with-protobuf=${pythonProtobuf.protobuf}"
-    "PROTOBUF_JAR=${mavenRepo}/com/google/protobuf/protobuf-java/2.6.1/protobuf-java-2.6.1.jar"
+    "PROTOBUF_JAR=${mavenRepo}/com/google/protobuf/protobuf-java/3.3.0/protobuf-java-3.3.0.jar"
   ] ++ lib.optionals stdenv.isLinux [
     "--with-network-isolator"
     "--with-nl=${libnl.dev}"
diff --git a/pkgs/applications/networking/cluster/mesos/fetch-mesos-deps.sh b/pkgs/applications/networking/cluster/mesos/fetch-mesos-deps.sh
index f4a4588dbe4..cf7318ecb27 100644
--- a/pkgs/applications/networking/cluster/mesos/fetch-mesos-deps.sh
+++ b/pkgs/applications/networking/cluster/mesos/fetch-mesos-deps.sh
@@ -1127,10 +1127,12 @@ fetchArtifact org/vafer/jdependency/0.7/jdependency-0.7.pom
 fetchArtifact org/vafer/jdependency/0.7/jdependency-0.7.pom.sha1
 fetchArtifact org/vafer/jdependency/0.7/jdependency-0.7.jar
 fetchArtifact org/vafer/jdependency/0.7/jdependency-0.7.jar.sha1
-fetchArtifact com/google/protobuf/protobuf-java/2.6.1/protobuf-java-2.6.1.pom
-fetchArtifact com/google/protobuf/protobuf-java/2.6.1/protobuf-java-2.6.1.pom.sha1
-fetchArtifact com/google/protobuf/protobuf-java/2.6.1/protobuf-java-2.6.1.jar
-fetchArtifact com/google/protobuf/protobuf-java/2.6.1/protobuf-java-2.6.1.jar.sha1
+fetchArtifact com/google/protobuf/protobuf-java/3.3.0/protobuf-java-3.3.0.pom
+fetchArtifact com/google/protobuf/protobuf-java/3.3.0/protobuf-java-3.3.0.pom.sha1
+fetchArtifact com/google/protobuf/protobuf-java/3.3.0/protobuf-java-3.3.0.jar
+fetchArtifact com/google/protobuf/protobuf-java/3.3.0/protobuf-java-3.3.0.jar.sha1
+fetchArtifact com/google/protobuf/protobuf-parent/3.3.0/protobuf-parent-3.3.0.pom
+fetchArtifact com/google/protobuf/protobuf-parent/3.3.0/protobuf-parent-3.3.0.pom.sha1
 fetchArtifact com/google/google/1/google-1.pom
 fetchArtifact com/google/google/1/google-1.pom.sha1
 fetchArtifact com/google/guava/guava/11.0.2/guava-11.0.2.pom
diff --git a/pkgs/applications/networking/cluster/mesos/mesos-deps.nix b/pkgs/applications/networking/cluster/mesos/mesos-deps.nix
index 1edb4a755d8..642c660edb6 100644
--- a/pkgs/applications/networking/cluster/mesos/mesos-deps.nix
+++ b/pkgs/applications/networking/cluster/mesos/mesos-deps.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation {
 
   outputHashAlgo = "sha256";
   outputHashMode = "recursive";
-  outputHash = "066ikswavq3l37x1s3pfdncyj77pvpa0kj14ax5dqb9njmsg0s11";
+  outputHash = "10h0qs7svw0cqjkyxs8z6s3qraa8ga920zfrr59rdlanbwg4klly";
 
   buildInputs = [ curl ];
 
diff --git a/pkgs/applications/networking/cluster/mesos/nixos.patch b/pkgs/applications/networking/cluster/mesos/nixos.patch
index 78e374b8d6b..a6fea024b08 100644
--- a/pkgs/applications/networking/cluster/mesos/nixos.patch
+++ b/pkgs/applications/networking/cluster/mesos/nixos.patch
@@ -1,20 +1,7 @@
-diff --git a/3rdparty/stout/include/stout/os/posix/chown.hpp b/3rdparty/stout/include/stout/os/posix/chown.hpp
-index c82e2e574..15d332107 100644
---- a/3rdparty/stout/include/stout/os/posix/chown.hpp
-+++ b/3rdparty/stout/include/stout/os/posix/chown.hpp
-@@ -34,7 +34,7 @@ inline Try<Nothing> chown(
-     // TODO(bmahler): Consider walking the file tree instead. We would need
-     // to be careful to not miss dotfiles.
-     std::string command =
--      "chown -R " + stringify(uid) + ':' + stringify(gid) + " '" + path + "'";
-+      "@chown@ -R " + stringify(uid) + ':' + stringify(gid) + " '" + path + "'";
- 
-     int status = os::system(command);
-     if (status != 0) {
-diff --git a/3rdparty/stout/include/stout/os/posix/fork.hpp b/3rdparty/stout/include/stout/os/posix/fork.hpp
-index a29967dcb..290b98b50 100644
---- a/3rdparty/stout/include/stout/os/posix/fork.hpp
-+++ b/3rdparty/stout/include/stout/os/posix/fork.hpp
+diff --git i/3rdparty/stout/include/stout/os/posix/fork.hpp w/3rdparty/stout/include/stout/os/posix/fork.hpp
+index a29967d..290b98b 100644
+--- i/3rdparty/stout/include/stout/os/posix/fork.hpp
++++ w/3rdparty/stout/include/stout/os/posix/fork.hpp
 @@ -369,7 +369,7 @@ private:
      if (exec.isSome()) {
        // Execute the command (via '/bin/sh -c command').
@@ -24,11 +11,11 @@ index a29967dcb..290b98b50 100644
        EXIT(EXIT_FAILURE)
          << "Failed to execute '" << command << "': " << os::strerror(errno);
      } else if (wait.isSome()) {
-diff --git a/3rdparty/stout/include/stout/posix/os.hpp b/3rdparty/stout/include/stout/posix/os.hpp
-index c37e64db6..d3d87b7f0 100644
---- a/3rdparty/stout/include/stout/posix/os.hpp
-+++ b/3rdparty/stout/include/stout/posix/os.hpp
-@@ -375,7 +375,7 @@ inline Option<std::string> getenv(const std::string& key)
+diff --git i/3rdparty/stout/include/stout/posix/os.hpp w/3rdparty/stout/include/stout/posix/os.hpp
+index 8511dfd..1e7be01 100644
+--- i/3rdparty/stout/include/stout/posix/os.hpp
++++ w/3rdparty/stout/include/stout/posix/os.hpp
+@@ -366,7 +366,7 @@ inline Try<std::set<pid_t>> pids(Option<pid_t> group, Option<pid_t> session)
  inline Try<Nothing> tar(const std::string& path, const std::string& archive)
  {
    Try<std::string> tarOut =
@@ -37,11 +24,11 @@ index c37e64db6..d3d87b7f0 100644
  
    if (tarOut.isError()) {
      return Error("Failed to archive " + path + ": " + tarOut.error());
-diff --git a/src/Makefile.am b/src/Makefile.am
-index 3bcc0f2df..e5cbc57e8 100644
---- a/src/Makefile.am
-+++ b/src/Makefile.am
-@@ -1545,7 +1545,7 @@ if HAS_JAVA
+diff --git i/src/Makefile.am w/src/Makefile.am
+index 68fff14..c572f92 100644
+--- i/src/Makefile.am
++++ w/src/Makefile.am
+@@ -1775,7 +1775,7 @@ if HAS_JAVA
  
  $(MESOS_JAR): $(MESOS_JAR_SOURCE) $(MESOS_JAR_GENERATED) java/mesos.pom
  	@echo "Building mesos-$(PACKAGE_VERSION).jar ..."
@@ -50,10 +37,10 @@ index 3bcc0f2df..e5cbc57e8 100644
  
  # Convenience library for JNI bindings.
  # TODO(Charles Reiss): We really should be building the Java library
-diff --git a/src/cli/mesos-scp b/src/cli/mesos-scp
-index a71ab0708..1043d1b3c 100755
---- a/src/cli/mesos-scp
-+++ b/src/cli/mesos-scp
+diff --git i/src/cli/mesos-scp w/src/cli/mesos-scp
+index a71ab07..1043d1b 100755
+--- i/src/cli/mesos-scp
++++ w/src/cli/mesos-scp
 @@ -19,7 +19,8 @@ if sys.version_info < (2,6,0):
  
  
@@ -64,11 +51,11 @@ index a71ab0708..1043d1b3c 100755
      try:
          process = subprocess.Popen(
              cmd,
-diff --git a/src/common/command_utils.cpp b/src/common/command_utils.cpp
-index 09e805140..90bf65896 100644
---- a/src/common/command_utils.cpp
-+++ b/src/common/command_utils.cpp
-@@ -140,7 +140,7 @@ Future<Nothing> tar(
+diff --git i/src/common/command_utils.cpp w/src/common/command_utils.cpp
+index c50be76..388cc53 100644
+--- i/src/common/command_utils.cpp
++++ w/src/common/command_utils.cpp
+@@ -142,7 +142,7 @@ Future<Nothing> tar(
  
    argv.emplace_back(input);
  
@@ -77,7 +64,7 @@ index 09e805140..90bf65896 100644
      .then([]() { return Nothing(); });
  }
  
-@@ -162,7 +162,7 @@ Future<Nothing> untar(
+@@ -164,7 +164,7 @@ Future<Nothing> untar(
      argv.emplace_back(directory.get());
    }
  
@@ -86,7 +73,7 @@ index 09e805140..90bf65896 100644
      .then([]() { return Nothing(); });
  }
  
-@@ -170,7 +170,7 @@ Future<Nothing> untar(
+@@ -172,7 +172,7 @@ Future<Nothing> untar(
  Future<string> sha512(const Path& input)
  {
  #ifdef __linux__
@@ -95,7 +82,7 @@ index 09e805140..90bf65896 100644
    vector<string> argv = {
      cmd,
      input             // Input file to compute shasum.
-@@ -206,7 +206,7 @@ Future<Nothing> gzip(const Path& input)
+@@ -208,7 +208,7 @@ Future<Nothing> gzip(const Path& input)
      input
    };
  
@@ -104,7 +91,7 @@ index 09e805140..90bf65896 100644
      .then([]() { return Nothing(); });
  }
  
-@@ -219,7 +219,7 @@ Future<Nothing> decompress(const Path& input)
+@@ -221,7 +221,7 @@ Future<Nothing> decompress(const Path& input)
      input
    };
  
@@ -113,41 +100,45 @@ index 09e805140..90bf65896 100644
      .then([]() { return Nothing(); });
  }
  
-diff --git a/src/launcher/fetcher.cpp b/src/launcher/fetcher.cpp
-index 4456c2813..e22c8fc03 100644
---- a/src/launcher/fetcher.cpp
-+++ b/src/launcher/fetcher.cpp
-@@ -68,13 +68,13 @@ static Try<bool> extract(
+diff --git i/src/launcher/fetcher.cpp w/src/launcher/fetcher.cpp
+index 42980f5..3aebeed 100644
+--- i/src/launcher/fetcher.cpp
++++ w/src/launcher/fetcher.cpp
+@@ -80,17 +80,17 @@ static Try<bool> extract(
        strings::endsWith(sourcePath, ".tar.bz2") ||
        strings::endsWith(sourcePath, ".txz") ||
        strings::endsWith(sourcePath, ".tar.xz")) {
--    command = "tar -C '" + destinationDirectory + "' -xf";
-+    command = "@tar@ -C '" + destinationDirectory + "' -xf";
+-    command = {"tar", "-C", destinationDirectory, "-xf", sourcePath};
++    command = {"@tar@", "-C", destinationDirectory, "-xf", sourcePath};
    } else if (strings::endsWith(sourcePath, ".gz")) {
      string pathWithoutExtension = sourcePath.substr(0, sourcePath.length() - 3);
      string filename = Path(pathWithoutExtension).basename();
--    command = "gzip -dc > '" + destinationDirectory + "/" + filename + "' <";
-+    command = "@gzip@ -dc > '" + destinationDirectory + "/" + filename + "' <";
+     string destinationPath = path::join(destinationDirectory, filename);
+ 
+-    command = {"gunzip", "-d", "-c"};
++    command = {"@gunzip@", "-d", "-c"};
+     in = Subprocess::PATH(sourcePath);
+     out = Subprocess::PATH(destinationPath);
    } else if (strings::endsWith(sourcePath, ".zip")) {
--    command = "unzip -o -d '" + destinationDirectory + "'";
-+    command = "@unzip@ -o -d '" + destinationDirectory + "'";
+-    command = {"unzip", "-o", "-d", destinationDirectory, sourcePath};
++    command = {"@unzip@", "-o", "-d", destinationDirectory, sourcePath};
    } else {
      return false;
    }
-@@ -162,7 +162,7 @@ static Try<string> copyFile(
+@@ -193,7 +193,7 @@ static Try<string> copyFile(
      const string& sourcePath,
      const string& destinationPath)
  {
--  const string command = "cp '" + sourcePath + "' '" + destinationPath + "'";
-+  const string command = "@cp@ '" + sourcePath + "' '" + destinationPath + "'";
- 
-   LOG(INFO) << "Copying resource with command:" << command;
- 
-diff --git a/src/linux/perf.cpp b/src/linux/perf.cpp
-index aa31982eb..8b5331b17 100644
---- a/src/linux/perf.cpp
-+++ b/src/linux/perf.cpp
-@@ -127,7 +127,7 @@ private:
+-  int status = os::spawn("cp", {"cp", sourcePath, destinationPath});
++  int status = os::spawn("cp", {"@cp@", sourcePath, destinationPath});
+ 
+   if (status == -1) {
+     return ErrnoError("Failed to copy '" + sourcePath + "'");
+diff --git i/src/linux/perf.cpp w/src/linux/perf.cpp
+index b301e25..356a2cf 100644
+--- i/src/linux/perf.cpp
++++ w/src/linux/perf.cpp
+@@ -128,7 +128,7 @@ private:
      // NOTE: The supervisor childhook places perf in its own process group
      // and will kill the perf process when the parent dies.
      Try<Subprocess> _perf = subprocess(
@@ -156,19 +147,10 @@ index aa31982eb..8b5331b17 100644
          argv,
          Subprocess::PIPE(),
          Subprocess::PIPE(),
-@@ -319,7 +319,7 @@ bool valid(const set<string>& events)
-   ostringstream command;
- 
-   // Log everything to stderr which is then redirected to /dev/null.
--  command << "perf stat --log-fd 2";
-+  command << "@perf@ stat --log-fd 2";
-   foreach (const string& event, events) {
-     command << " --event " << event;
-   }
-diff --git a/src/linux/systemd.cpp b/src/linux/systemd.cpp
-index 6318f48fc..394d88d47 100644
---- a/src/linux/systemd.cpp
-+++ b/src/linux/systemd.cpp
+diff --git i/src/linux/systemd.cpp w/src/linux/systemd.cpp
+index 6318f48..394d88d 100644
+--- i/src/linux/systemd.cpp
++++ w/src/linux/systemd.cpp
 @@ -196,13 +196,21 @@ bool exists()
    // This is static as the init system should not change while we are running.
    static const bool exists = []() -> bool {
@@ -209,10 +191,10 @@ index 6318f48fc..394d88d47 100644
    Try<string> daemonReload = os::shell("systemctl daemon-reload");
    if (daemonReload.isError()) {
      return Error("Failed to reload systemd daemon: " + daemonReload.error());
-diff --git a/src/python/cli/src/mesos/cli.py b/src/python/cli/src/mesos/cli.py
-index f342992e0..354abf443 100644
---- a/src/python/cli/src/mesos/cli.py
-+++ b/src/python/cli/src/mesos/cli.py
+diff --git i/src/python/cli/src/mesos/cli.py w/src/python/cli/src/mesos/cli.py
+index 4a9b558..c08a8b9 100644
+--- i/src/python/cli/src/mesos/cli.py
++++ w/src/python/cli/src/mesos/cli.py
 @@ -40,7 +40,7 @@ def resolve(master):
      import subprocess
  
@@ -222,10 +204,10 @@ index f342992e0..354abf443 100644
          stdin=None,
          stdout=subprocess.PIPE,
          stderr=subprocess.PIPE,
-diff --git a/src/slave/containerizer/mesos/isolators/docker/volume/isolator.cpp b/src/slave/containerizer/mesos/isolators/docker/volume/isolator.cpp
-index af9f3736b..f8554d414 100644
---- a/src/slave/containerizer/mesos/isolators/docker/volume/isolator.cpp
-+++ b/src/slave/containerizer/mesos/isolators/docker/volume/isolator.cpp
+diff --git i/src/slave/containerizer/mesos/isolators/docker/volume/isolator.cpp w/src/slave/containerizer/mesos/isolators/docker/volume/isolator.cpp
+index 5b630c1..d63ad69 100644
+--- i/src/slave/containerizer/mesos/isolators/docker/volume/isolator.cpp
++++ w/src/slave/containerizer/mesos/isolators/docker/volume/isolator.cpp
 @@ -499,7 +499,7 @@ Future<Option<ContainerLaunchInfo>> DockerVolumeIsolatorProcess::_prepare(
      // unsafe arbitrary commands).
      CommandInfo* command = launchInfo.add_pre_exec_commands();
@@ -235,11 +217,11 @@ index af9f3736b..f8554d414 100644
      command->add_arguments("mount");
      command->add_arguments("-n");
      command->add_arguments("--rbind");
-diff --git a/src/slave/containerizer/mesos/isolators/filesystem/linux.cpp b/src/slave/containerizer/mesos/isolators/filesystem/linux.cpp
-index df16b8fee..4a17475bd 100644
---- a/src/slave/containerizer/mesos/isolators/filesystem/linux.cpp
-+++ b/src/slave/containerizer/mesos/isolators/filesystem/linux.cpp
-@@ -159,9 +159,9 @@ Try<Isolator*> LinuxFilesystemIsolatorProcess::create(const Flags& flags)
+diff --git i/src/slave/containerizer/mesos/isolators/filesystem/linux.cpp w/src/slave/containerizer/mesos/isolators/filesystem/linux.cpp
+index d7fe9a8..1361a4e 100644
+--- i/src/slave/containerizer/mesos/isolators/filesystem/linux.cpp
++++ w/src/slave/containerizer/mesos/isolators/filesystem/linux.cpp
+@@ -154,9 +154,9 @@ Try<Isolator*> LinuxFilesystemIsolatorProcess::create(const Flags& flags)
        // here because 'create' will only be invoked during
        // initialization.
        Try<string> mount = os::shell(
@@ -252,7 +234,7 @@ index df16b8fee..4a17475bd 100644
            workDir->c_str(),
            workDir->c_str(),
            workDir->c_str(),
-@@ -180,8 +180,8 @@ Try<Isolator*> LinuxFilesystemIsolatorProcess::create(const Flags& flags)
+@@ -175,8 +175,8 @@ Try<Isolator*> LinuxFilesystemIsolatorProcess::create(const Flags& flags)
        LOG(INFO) << "Making '" << workDir.get() << "' a shared mount";
  
        Try<string> mount = os::shell(
@@ -263,7 +245,7 @@ index df16b8fee..4a17475bd 100644
            workDir->c_str(),
            workDir->c_str());
  
-@@ -404,7 +404,7 @@ Try<vector<CommandInfo>> LinuxFilesystemIsolatorProcess::getPreExecCommands(
+@@ -422,7 +422,7 @@ Try<vector<CommandInfo>> LinuxFilesystemIsolatorProcess::getPreExecCommands(
  
      CommandInfo command;
      command.set_shell(false);
@@ -272,7 +254,7 @@ index df16b8fee..4a17475bd 100644
      command.add_arguments("mount");
      command.add_arguments("-n");
      command.add_arguments("--rbind");
-@@ -569,7 +569,7 @@ Try<vector<CommandInfo>> LinuxFilesystemIsolatorProcess::getPreExecCommands(
+@@ -610,7 +610,7 @@ Try<vector<CommandInfo>> LinuxFilesystemIsolatorProcess::getPreExecCommands(
      // TODO(jieyu): Consider the mode in the volume.
      CommandInfo command;
      command.set_shell(false);
@@ -281,11 +263,11 @@ index df16b8fee..4a17475bd 100644
      command.add_arguments("mount");
      command.add_arguments("-n");
      command.add_arguments("--rbind");
-diff --git a/src/slave/containerizer/mesos/isolators/filesystem/shared.cpp b/src/slave/containerizer/mesos/isolators/filesystem/shared.cpp
-index a1283e5ee..a918427bf 100644
---- a/src/slave/containerizer/mesos/isolators/filesystem/shared.cpp
-+++ b/src/slave/containerizer/mesos/isolators/filesystem/shared.cpp
-@@ -207,7 +207,7 @@ Future<Option<ContainerLaunchInfo>> SharedFilesystemIsolatorProcess::prepare(
+diff --git i/src/slave/containerizer/mesos/isolators/filesystem/shared.cpp w/src/slave/containerizer/mesos/isolators/filesystem/shared.cpp
+index 927d95b..576dc63 100644
+--- i/src/slave/containerizer/mesos/isolators/filesystem/shared.cpp
++++ w/src/slave/containerizer/mesos/isolators/filesystem/shared.cpp
+@@ -208,7 +208,7 @@ Future<Option<ContainerLaunchInfo>> SharedFilesystemIsolatorProcess::prepare(
      }
  
      launchInfo.add_pre_exec_commands()->set_value(
@@ -294,11 +276,11 @@ index a1283e5ee..a918427bf 100644
    }
  
    return launchInfo;
-diff --git a/src/slave/containerizer/mesos/isolators/gpu/isolator.cpp b/src/slave/containerizer/mesos/isolators/gpu/isolator.cpp
-index e3756c920..cfe458b59 100644
---- a/src/slave/containerizer/mesos/isolators/gpu/isolator.cpp
-+++ b/src/slave/containerizer/mesos/isolators/gpu/isolator.cpp
-@@ -355,7 +355,7 @@ Future<Option<ContainerLaunchInfo>> NvidiaGpuIsolatorProcess::_prepare(
+diff --git i/src/slave/containerizer/mesos/isolators/gpu/isolator.cpp w/src/slave/containerizer/mesos/isolators/gpu/isolator.cpp
+index 25636b5..33ec315 100644
+--- i/src/slave/containerizer/mesos/isolators/gpu/isolator.cpp
++++ w/src/slave/containerizer/mesos/isolators/gpu/isolator.cpp
+@@ -401,7 +401,7 @@ Future<Option<ContainerLaunchInfo>> NvidiaGpuIsolatorProcess::_prepare(
      }
  
      launchInfo.add_pre_exec_commands()->set_value(
@@ -307,11 +289,11 @@ index e3756c920..cfe458b59 100644
        volume.HOST_PATH() + " " + target);
    }
  
-diff --git a/src/slave/containerizer/mesos/isolators/gpu/volume.cpp b/src/slave/containerizer/mesos/isolators/gpu/volume.cpp
-index 478752f37..ab527f0cd 100644
---- a/src/slave/containerizer/mesos/isolators/gpu/volume.cpp
-+++ b/src/slave/containerizer/mesos/isolators/gpu/volume.cpp
-@@ -281,7 +281,7 @@ Try<NvidiaVolume> NvidiaVolume::create()
+diff --git i/src/slave/containerizer/mesos/isolators/gpu/volume.cpp w/src/slave/containerizer/mesos/isolators/gpu/volume.cpp
+index 536a3c7..e2819dd 100644
+--- i/src/slave/containerizer/mesos/isolators/gpu/volume.cpp
++++ w/src/slave/containerizer/mesos/isolators/gpu/volume.cpp
+@@ -274,7 +274,7 @@ Try<NvidiaVolume> NvidiaVolume::create()
      string path = path::join(hostPath, "bin", binary);
  
      if (!os::exists(path)) {
@@ -320,7 +302,7 @@ index 478752f37..ab527f0cd 100644
        Try<string> which = os::shell(command);
  
        if (which.isSome()) {
-@@ -295,7 +295,7 @@ Try<NvidiaVolume> NvidiaVolume::create()
+@@ -288,7 +288,7 @@ Try<NvidiaVolume> NvidiaVolume::create()
                                : "No such file or directory"));
          }
  
@@ -329,7 +311,7 @@ index 478752f37..ab527f0cd 100644
          Try<string> cp = os::shell(command);
          if (cp.isError()) {
            return Error("Failed to os::shell '" + command + "': " + cp.error());
-@@ -367,7 +367,7 @@ Try<NvidiaVolume> NvidiaVolume::create()
+@@ -360,7 +360,7 @@ Try<NvidiaVolume> NvidiaVolume::create()
              Path(realpath.get()).basename());
  
          if (!os::exists(libraryPath)) {
@@ -338,11 +320,11 @@ index 478752f37..ab527f0cd 100644
            Try<string> cp = os::shell(command);
            if (cp.isError()) {
              return Error("Failed to os::shell '" + command + "':"
-diff --git a/src/slave/containerizer/mesos/isolators/namespaces/pid.cpp b/src/slave/containerizer/mesos/isolators/namespaces/pid.cpp
-index 0d9ec57d9..a177e4476 100644
---- a/src/slave/containerizer/mesos/isolators/namespaces/pid.cpp
-+++ b/src/slave/containerizer/mesos/isolators/namespaces/pid.cpp
-@@ -94,7 +94,7 @@ Future<Option<ContainerLaunchInfo>> NamespacesPidIsolatorProcess::prepare(
+diff --git i/src/slave/containerizer/mesos/isolators/namespaces/pid.cpp w/src/slave/containerizer/mesos/isolators/namespaces/pid.cpp
+index 42bc2e1..2f9066e 100644
+--- i/src/slave/containerizer/mesos/isolators/namespaces/pid.cpp
++++ w/src/slave/containerizer/mesos/isolators/namespaces/pid.cpp
+@@ -131,7 +131,7 @@ Future<Option<ContainerLaunchInfo>> NamespacesPidIsolatorProcess::prepare(
    //
    // TOOD(jieyu): Consider unmount the existing /proc.
    launchInfo.add_pre_exec_commands()->set_value(
@@ -351,11 +333,11 @@ index 0d9ec57d9..a177e4476 100644
  
    return launchInfo;
  }
-diff --git a/src/slave/containerizer/mesos/isolators/network/cni/cni.cpp b/src/slave/containerizer/mesos/isolators/network/cni/cni.cpp
-index c87e6715a..6601cd1b3 100644
---- a/src/slave/containerizer/mesos/isolators/network/cni/cni.cpp
-+++ b/src/slave/containerizer/mesos/isolators/network/cni/cni.cpp
-@@ -262,9 +262,9 @@ Try<Isolator*> NetworkCniIsolatorProcess::create(const Flags& flags)
+diff --git i/src/slave/containerizer/mesos/isolators/network/cni/cni.cpp w/src/slave/containerizer/mesos/isolators/network/cni/cni.cpp
+index fc68f04..267b040 100644
+--- i/src/slave/containerizer/mesos/isolators/network/cni/cni.cpp
++++ w/src/slave/containerizer/mesos/isolators/network/cni/cni.cpp
+@@ -205,9 +205,9 @@ Try<Isolator*> NetworkCniIsolatorProcess::create(const Flags& flags)
        // here because 'create' will only be invoked during
        // initialization.
        Try<string> mount = os::shell(
@@ -368,7 +350,7 @@ index c87e6715a..6601cd1b3 100644
            rootDir->c_str(),
            rootDir->c_str(),
            rootDir->c_str(),
-@@ -284,8 +284,8 @@ Try<Isolator*> NetworkCniIsolatorProcess::create(const Flags& flags)
+@@ -227,8 +227,8 @@ Try<Isolator*> NetworkCniIsolatorProcess::create(const Flags& flags)
        LOG(INFO) << "Making '" << rootDir.get() << "' a shared mount";
  
        Try<string> mount = os::shell(
@@ -379,11 +361,11 @@ index c87e6715a..6601cd1b3 100644
            rootDir->c_str(),
            rootDir->c_str());
  
-diff --git a/src/slave/containerizer/mesos/isolators/network/cni/plugins/port_mapper/port_mapper.cpp b/src/slave/containerizer/mesos/isolators/network/cni/plugins/port_mapper/port_mapper.cpp
-index b470f0c82..6110a43ee 100644
---- a/src/slave/containerizer/mesos/isolators/network/cni/plugins/port_mapper/port_mapper.cpp
-+++ b/src/slave/containerizer/mesos/isolators/network/cni/plugins/port_mapper/port_mapper.cpp
-@@ -303,7 +303,7 @@ Try<Nothing> PortMapper::addPortMapping(
+diff --git i/src/slave/containerizer/mesos/isolators/network/cni/plugins/port_mapper/port_mapper.cpp w/src/slave/containerizer/mesos/isolators/network/cni/plugins/port_mapper/port_mapper.cpp
+index 43cf3e4..94bad8b 100644
+--- i/src/slave/containerizer/mesos/isolators/network/cni/plugins/port_mapper/port_mapper.cpp
++++ w/src/slave/containerizer/mesos/isolators/network/cni/plugins/port_mapper/port_mapper.cpp
+@@ -301,7 +301,7 @@ Try<Nothing> PortMapper::addPortMapping(
        # Check if the `chain` exists in the iptable. If it does not
        # exist go ahead and install the chain in the iptables NAT
        # table.
@@ -392,7 +374,7 @@ index b470f0c82..6110a43ee 100644
        if [ $? -ne 0 ]; then
          # NOTE: When we create the chain, there is a possibility of a
          # race due to which a container launch can fail. This can
-@@ -317,25 +317,25 @@ Try<Nothing> PortMapper::addPortMapping(
+@@ -315,25 +315,25 @@ Try<Nothing> PortMapper::addPortMapping(
          # since it can happen only when the chain is created the first
          # time and two commands for creation of the chain are executed
          # simultaneously.
@@ -422,7 +404,7 @@ index b470f0c82..6110a43ee 100644
        chain,
        chain,
        chain,
-@@ -362,7 +362,7 @@ Try<Nothing> PortMapper::delPortMapping()
+@@ -360,7 +360,7 @@ Try<Nothing> PortMapper::delPortMapping()
        # The iptables command searches for the DNAT rules with tag
        # "container_id: <CNI_CONTAINERID>", and if it exists goes ahead
        # and deletes it.
@@ -431,11 +413,11 @@ index b470f0c82..6110a43ee 100644
        chain,
        getIptablesRuleTag()).get();
  
-diff --git a/src/slave/containerizer/mesos/isolators/network/port_mapping.cpp b/src/slave/containerizer/mesos/isolators/network/port_mapping.cpp
-index 20fb6ab35..46c160977 100644
---- a/src/slave/containerizer/mesos/isolators/network/port_mapping.cpp
-+++ b/src/slave/containerizer/mesos/isolators/network/port_mapping.cpp
-@@ -1393,19 +1393,19 @@ Try<Isolator*> PortMappingIsolatorProcess::create(const Flags& flags)
+diff --git i/src/slave/containerizer/mesos/isolators/network/port_mapping.cpp w/src/slave/containerizer/mesos/isolators/network/port_mapping.cpp
+index 57d4ccd..68c9577 100644
+--- i/src/slave/containerizer/mesos/isolators/network/port_mapping.cpp
++++ w/src/slave/containerizer/mesos/isolators/network/port_mapping.cpp
+@@ -1394,19 +1394,19 @@ Try<Isolator*> PortMappingIsolatorProcess::create(const Flags& flags)
    // Check the availability of a few Linux commands that we will use.
    // We use the blocking os::shell here because 'create' will only be
    // invoked during initialization.
@@ -458,7 +440,7 @@ index 20fb6ab35..46c160977 100644
    if (checkCommandIp.isError()) {
      return Error("Check command 'ip' failed: " + checkCommandIp.error());
    }
-@@ -1925,9 +1925,9 @@ Try<Isolator*> PortMappingIsolatorProcess::create(const Flags& flags)
+@@ -1940,9 +1940,9 @@ Try<Isolator*> PortMappingIsolatorProcess::create(const Flags& flags)
      // visible. It's OK to use the blocking os::shell here because
      // 'create' will only be invoked during initialization.
      Try<string> mount = os::shell(
@@ -471,7 +453,7 @@ index 20fb6ab35..46c160977 100644
          bindMountRoot->c_str(),
          bindMountRoot->c_str(),
          bindMountRoot->c_str(),
-@@ -1944,8 +1944,8 @@ Try<Isolator*> PortMappingIsolatorProcess::create(const Flags& flags)
+@@ -1959,8 +1959,8 @@ Try<Isolator*> PortMappingIsolatorProcess::create(const Flags& flags)
        // shared mount yet (possibly due to slave crash while preparing
        // the work directory mount). It's safe to re-do the following.
        Try<string> mount = os::shell(
@@ -482,7 +464,7 @@ index 20fb6ab35..46c160977 100644
            bindMountRoot->c_str(),
            bindMountRoot->c_str());
  
-@@ -1964,8 +1964,8 @@ Try<Isolator*> PortMappingIsolatorProcess::create(const Flags& flags)
+@@ -1979,8 +1979,8 @@ Try<Isolator*> PortMappingIsolatorProcess::create(const Flags& flags)
            // so that they are in different peer groups.
            if (entry.shared() == bindMountEntry->shared()) {
              Try<string> mount = os::shell(
@@ -493,7 +475,7 @@ index 20fb6ab35..46c160977 100644
                  bindMountRoot->c_str(),
                  bindMountRoot->c_str());
  
-@@ -3911,6 +3911,8 @@ Try<Nothing> PortMappingIsolatorProcess::removeHostIPFilters(
+@@ -3927,6 +3927,8 @@ Try<Nothing> PortMappingIsolatorProcess::removeHostIPFilters(
  // TODO(jieyu): Use the Subcommand abstraction to remove most of the
  // logic here. Completely remove this function once we can assume a
  // newer kernel where 'setns' works for mount namespaces.
@@ -502,7 +484,7 @@ index 20fb6ab35..46c160977 100644
  string PortMappingIsolatorProcess::scripts(Info* info)
  {
    ostringstream script;
-@@ -3921,7 +3923,7 @@ string PortMappingIsolatorProcess::scripts(Info* info)
+@@ -3937,7 +3939,7 @@ string PortMappingIsolatorProcess::scripts(Info* info)
    // Mark the mount point PORT_MAPPING_BIND_MOUNT_ROOT() as slave
    // mount so that changes in the container will not be propagated to
    // the host.
@@ -511,7 +493,7 @@ index 20fb6ab35..46c160977 100644
  
    // Disable IPv6 when IPv6 module is loaded as IPv6 packets won't be
    // forwarded anyway.
-@@ -3929,7 +3931,7 @@ string PortMappingIsolatorProcess::scripts(Info* info)
+@@ -3945,7 +3947,7 @@ string PortMappingIsolatorProcess::scripts(Info* info)
           << " echo 1 > /proc/sys/net/ipv6/conf/all/disable_ipv6\n";
  
    // Configure lo and eth0.
@@ -520,7 +502,7 @@ index 20fb6ab35..46c160977 100644
           << " mtu " << hostEth0MTU << " up\n";
  
    // NOTE: This is mostly a kernel issue: in veth_xmit() the kernel
-@@ -3938,12 +3940,12 @@ string PortMappingIsolatorProcess::scripts(Info* info)
+@@ -3954,12 +3956,12 @@ string PortMappingIsolatorProcess::scripts(Info* info)
    // when we receive a packet with a bad checksum. Disabling rx
    // checksum offloading ensures the TCP layer will checksum and drop
    // it.
@@ -537,7 +519,7 @@ index 20fb6ab35..46c160977 100644
  
    // Restrict the ephemeral ports that can be used by the container.
    script << "echo " << info->ephemeralPorts.lower() << " "
-@@ -3972,19 +3974,19 @@ string PortMappingIsolatorProcess::scripts(Info* info)
+@@ -3988,19 +3990,19 @@ string PortMappingIsolatorProcess::scripts(Info* info)
    }
  
    // Set up filters on lo and eth0.
@@ -561,7 +543,7 @@ index 20fb6ab35..46c160977 100644
           << " protocol ip"
           << " prio " << Priority(IP_FILTER_PRIORITY, NORMAL).get() << " u32"
           << " flowid ffff:0"
-@@ -3995,7 +3997,7 @@ string PortMappingIsolatorProcess::scripts(Info* info)
+@@ -4011,7 +4013,7 @@ string PortMappingIsolatorProcess::scripts(Info* info)
    foreach (const PortRange& range,
             getPortRanges(info->nonEphemeralPorts + info->ephemeralPorts)) {
      // Local traffic inside a container will not be redirected to eth0.
@@ -570,7 +552,7 @@ index 20fb6ab35..46c160977 100644
             << " protocol ip"
             << " prio " << Priority(IP_FILTER_PRIORITY, HIGH).get() << " u32"
             << " flowid ffff:0"
-@@ -4004,7 +4006,7 @@ string PortMappingIsolatorProcess::scripts(Info* info)
+@@ -4020,7 +4022,7 @@ string PortMappingIsolatorProcess::scripts(Info* info)
  
      // Traffic going to host loopback IP and ports assigned to this
      // container will be redirected to lo.
@@ -579,7 +561,7 @@ index 20fb6ab35..46c160977 100644
             << " protocol ip"
             << " prio " << Priority(IP_FILTER_PRIORITY, NORMAL).get() << " u32"
             << " flowid ffff:0"
-@@ -4016,14 +4018,14 @@ string PortMappingIsolatorProcess::scripts(Info* info)
+@@ -4032,14 +4034,14 @@ string PortMappingIsolatorProcess::scripts(Info* info)
    }
  
    // Do not forward the ICMP packet if the destination IP is self.
@@ -596,8 +578,8 @@ index 20fb6ab35..46c160977 100644
           << " protocol ip"
           << " prio " << Priority(ICMP_FILTER_PRIORITY, NORMAL).get() << " u32"
           << " flowid ffff:0"
-@@ -4032,9 +4034,9 @@ string PortMappingIsolatorProcess::scripts(Info* info)
-          << net::IPNetwork::LOOPBACK_V4().address() << "\n";
+@@ -4048,9 +4050,9 @@ string PortMappingIsolatorProcess::scripts(Info* info)
+          << net::IP::Network::LOOPBACK_V4().address() << "\n";
  
    // Display the filters created on eth0 and lo.
 -  script << "tc filter show dev " << eth0
@@ -608,7 +590,7 @@ index 20fb6ab35..46c160977 100644
           << " parent " << ingress::HANDLE << "\n";
  
    // If throughput limit for container egress traffic exists, use HTB
-@@ -4046,9 +4048,9 @@ string PortMappingIsolatorProcess::scripts(Info* info)
+@@ -4062,9 +4064,9 @@ string PortMappingIsolatorProcess::scripts(Info* info)
    // throughput. TBF requires other parameters such as 'burst' that
    // HTB already has default values for.
    if (egressRateLimitPerContainer.isSome()) {
@@ -620,7 +602,7 @@ index 20fb6ab35..46c160977 100644
             << CONTAINER_TX_HTB_HANDLE << " classid "
             << CONTAINER_TX_HTB_CLASS_ID << " htb rate "
             << egressRateLimitPerContainer.get().bytes() * 8 << "bit\n";
-@@ -4059,12 +4061,12 @@ string PortMappingIsolatorProcess::scripts(Info* info)
+@@ -4075,12 +4077,12 @@ string PortMappingIsolatorProcess::scripts(Info* info)
      // fq_codel, which has a larger buffer and better control on
      // buffer bloat.
      // TODO(cwang): Verity that fq_codel qdisc is available.
@@ -636,24 +618,24 @@ index 20fb6ab35..46c160977 100644
    }
  
    return script.str();
-diff --git a/src/slave/containerizer/mesos/isolators/posix/disk.cpp b/src/slave/containerizer/mesos/isolators/posix/disk.cpp
-index db0583386..542586370 100644
---- a/src/slave/containerizer/mesos/isolators/posix/disk.cpp
-+++ b/src/slave/containerizer/mesos/isolators/posix/disk.cpp
-@@ -540,7 +540,7 @@ private:
+diff --git i/src/slave/containerizer/mesos/isolators/posix/disk.cpp w/src/slave/containerizer/mesos/isolators/posix/disk.cpp
+index eb23025..db268ea 100644
+--- i/src/slave/containerizer/mesos/isolators/posix/disk.cpp
++++ w/src/slave/containerizer/mesos/isolators/posix/disk.cpp
+@@ -572,7 +572,7 @@ private:
      // NOTE: The supervisor childhook will watch the parent process and kill
      // the 'du' process in case that the parent die.
      Try<Subprocess> s = subprocess(
 -        "du",
 +        "@du@",
          command,
-         Subprocess::PATH("/dev/null"),
+         Subprocess::PATH(os::DEV_NULL),
          Subprocess::PIPE(),
-diff --git a/src/slave/containerizer/mesos/isolators/volume/image.cpp b/src/slave/containerizer/mesos/isolators/volume/image.cpp
-index 210e67ad0..60b3a15e4 100644
---- a/src/slave/containerizer/mesos/isolators/volume/image.cpp
-+++ b/src/slave/containerizer/mesos/isolators/volume/image.cpp
-@@ -214,7 +214,7 @@ Future<Option<ContainerLaunchInfo>> VolumeImageIsolatorProcess::_prepare(
+diff --git i/src/slave/containerizer/mesos/isolators/volume/image.cpp w/src/slave/containerizer/mesos/isolators/volume/image.cpp
+index 35966aa..b62fc86 100644
+--- i/src/slave/containerizer/mesos/isolators/volume/image.cpp
++++ w/src/slave/containerizer/mesos/isolators/volume/image.cpp
+@@ -231,7 +231,7 @@ Future<Option<ContainerLaunchInfo>> VolumeImageIsolatorProcess::_prepare(
  
      CommandInfo* command = launchInfo.add_pre_exec_commands();
      command->set_shell(false);
@@ -662,11 +644,11 @@ index 210e67ad0..60b3a15e4 100644
      command->add_arguments("mount");
      command->add_arguments("-n");
      command->add_arguments("--rbind");
-diff --git a/src/slave/containerizer/mesos/isolators/volume/sandbox_path.cpp b/src/slave/containerizer/mesos/isolators/volume/sandbox_path.cpp
-index 7b976d292..474dcd486 100644
---- a/src/slave/containerizer/mesos/isolators/volume/sandbox_path.cpp
-+++ b/src/slave/containerizer/mesos/isolators/volume/sandbox_path.cpp
-@@ -240,7 +240,7 @@ Future<Option<ContainerLaunchInfo>> VolumeSandboxPathIsolatorProcess::prepare(
+diff --git i/src/slave/containerizer/mesos/isolators/volume/sandbox_path.cpp w/src/slave/containerizer/mesos/isolators/volume/sandbox_path.cpp
+index b321b86..8ed3e78 100644
+--- i/src/slave/containerizer/mesos/isolators/volume/sandbox_path.cpp
++++ w/src/slave/containerizer/mesos/isolators/volume/sandbox_path.cpp
+@@ -265,7 +265,7 @@ Future<Option<ContainerLaunchInfo>> VolumeSandboxPathIsolatorProcess::prepare(
  
        CommandInfo* command = launchInfo.add_pre_exec_commands();
        command->set_shell(false);
@@ -675,58 +657,60 @@ index 7b976d292..474dcd486 100644
        command->add_arguments("mount");
        command->add_arguments("-n");
        command->add_arguments("--rbind");
-diff --git a/src/slave/containerizer/mesos/provisioner/backends/copy.cpp b/src/slave/containerizer/mesos/provisioner/backends/copy.cpp
-index 9c5354e5f..a73a9692e 100644
---- a/src/slave/containerizer/mesos/provisioner/backends/copy.cpp
-+++ b/src/slave/containerizer/mesos/provisioner/backends/copy.cpp
-@@ -147,7 +147,7 @@ Future<Nothing> CopyBackendProcess::_provision(
+diff --git i/src/slave/containerizer/mesos/provisioner/backends/copy.cpp w/src/slave/containerizer/mesos/provisioner/backends/copy.cpp
+index 69faa03..01a3ed6 100644
+--- i/src/slave/containerizer/mesos/provisioner/backends/copy.cpp
++++ w/src/slave/containerizer/mesos/provisioner/backends/copy.cpp
+@@ -266,7 +266,7 @@ Future<Nothing> CopyBackendProcess::_provision(
  #endif // __APPLE__ || __FreeBSD__
  
    Try<Subprocess> s = subprocess(
 -      "cp",
 +      "@cp@",
        args,
-       Subprocess::PATH("/dev/null"),
-       Subprocess::PATH("/dev/null"),
-@@ -180,7 +180,7 @@ Future<bool> CopyBackendProcess::destroy(const string& rootfs)
+       Subprocess::PATH(os::DEV_NULL),
+       Subprocess::PATH(os::DEV_NULL),
+@@ -313,7 +313,7 @@ Future<bool> CopyBackendProcess::destroy(const string& rootfs)
    vector<string> argv{"rm", "-rf", rootfs};
  
    Try<Subprocess> s = subprocess(
 -      "rm",
 +      "@rm@",
        argv,
-       Subprocess::PATH("/dev/null"),
+       Subprocess::PATH(os::DEV_NULL),
        Subprocess::FD(STDOUT_FILENO),
-diff --git a/src/uri/fetchers/copy.cpp b/src/uri/fetchers/copy.cpp
-index 2cfef5ab0..8a62f7699 100644
---- a/src/uri/fetchers/copy.cpp
-+++ b/src/uri/fetchers/copy.cpp
-@@ -97,7 +97,7 @@ Future<Nothing> CopyFetcherPlugin::fetch(
-   const vector<string> argv = {"cp", "-a", uri.path(), directory};
- 
-   Try<Subprocess> s = subprocess(
--      "cp",
-+      "@cp@",
-       argv,
-       Subprocess::PATH("/dev/null"),
-       Subprocess::PIPE(),
-diff --git a/src/uri/fetchers/curl.cpp b/src/uri/fetchers/curl.cpp
-index 7b746d619..12bbb04df 100644
---- a/src/uri/fetchers/curl.cpp
-+++ b/src/uri/fetchers/curl.cpp
-@@ -107,7 +107,7 @@ Future<Nothing> CurlFetcherPlugin::fetch(
+diff --git i/src/uri/fetchers/copy.cpp w/src/uri/fetchers/copy.cpp
+index 17f69be..831b08a 100644
+--- i/src/uri/fetchers/copy.cpp
++++ w/src/uri/fetchers/copy.cpp
+@@ -97,8 +97,8 @@ Future<Nothing> CopyFetcherPlugin::fetch(
+   VLOG(1) << "Copying '" << uri.path() << "' to '" << directory << "'";
+ 
+ #ifndef __WINDOWS__
+-  const char* copyCommand = "cp";
+-  const vector<string> argv = {"cp", "-a", uri.path(), directory};
++  const char* copyCommand = "@cp@";
++  const vector<string> argv = {"@cp@", "-a", uri.path(), directory};
+ #else // __WINDOWS__
+   const char* copyCommand = os::Shell::name;
+   const vector<string> argv =
+diff --git i/src/uri/fetchers/curl.cpp w/src/uri/fetchers/curl.cpp
+index f34daf2..6a50341 100644
+--- i/src/uri/fetchers/curl.cpp
++++ w/src/uri/fetchers/curl.cpp
+@@ -109,7 +109,7 @@ Future<Nothing> CurlFetcherPlugin::fetch(
    };
  
    Try<Subprocess> s = subprocess(
 -      "curl",
 +      "@curl@",
        argv,
-       Subprocess::PATH("/dev/null"),
+       Subprocess::PATH(os::DEV_NULL),
        Subprocess::PIPE(),
-diff --git a/src/uri/fetchers/docker.cpp b/src/uri/fetchers/docker.cpp
-index 3f38dddfb..fd991ee74 100644
---- a/src/uri/fetchers/docker.cpp
-+++ b/src/uri/fetchers/docker.cpp
+diff --git i/src/uri/fetchers/docker.cpp w/src/uri/fetchers/docker.cpp
+index 91db13b..82a7fc4 100644
+--- i/src/uri/fetchers/docker.cpp
++++ w/src/uri/fetchers/docker.cpp
 @@ -114,7 +114,7 @@ static Future<http::Response> curl(
  
    // TODO(jieyu): Kill the process if discard is called.
@@ -734,14 +718,14 @@ index 3f38dddfb..fd991ee74 100644
 -      "curl",
 +      "@curl@",
        argv,
-       Subprocess::PATH("/dev/null"),
+       Subprocess::PATH(os::DEV_NULL),
        Subprocess::PIPE(),
-@@ -213,7 +213,7 @@ static Future<int> download(
+@@ -229,7 +229,7 @@ static Future<int> download(
  
    // TODO(jieyu): Kill the process if discard is called.
    Try<Subprocess> s = subprocess(
 -      "curl",
 +      "@curl@",
        argv,
-       Subprocess::PATH("/dev/null"),
+       Subprocess::PATH(os::DEV_NULL),
        Subprocess::PIPE(),
diff --git a/pkgs/applications/science/biology/freebayes/builder.sh b/pkgs/applications/science/biology/freebayes/builder.sh
deleted file mode 100644
index a9f56e77d7e..00000000000
--- a/pkgs/applications/science/biology/freebayes/builder.sh
+++ /dev/null
@@ -1,11 +0,0 @@
-source $stdenv/setup
-
-unpackPhase
-
-cd freebayes-*
-
-make
-
-mkdir -p $out/bin
-cp bin/freebayes bin/bamleftalign $out/bin
-cp scripts/* $out/bin
diff --git a/pkgs/applications/science/biology/freebayes/default.nix b/pkgs/applications/science/biology/freebayes/default.nix
index ef0da619b25..99d2dfa55dd 100644
--- a/pkgs/applications/science/biology/freebayes/default.nix
+++ b/pkgs/applications/science/biology/freebayes/default.nix
@@ -1,21 +1,23 @@
-{ stdenv, fetchFromGitHub, cmake, gcc, zlib}:
+{ stdenv, fetchFromGitHub, cmake, gcc, zlib, bzip2, lzma }:
 
 stdenv.mkDerivation rec {
   name    = "freebayes-${version}";
-  version = "1.1.0";
+  version = "2017-08-23";
 
   src = fetchFromGitHub {
     name = "freebayes-${version}-src";
     owner  = "ekg";
     repo   = "freebayes";
-    rev    = "refs/tags/v${version}";
-    sha256 = "0xb8aicb36w9mfs1gq1x7mcp3p82kl7i61d162hfncqzg2npg8rr";
+    rev    = "8d2b3a060da473e1f4f89be04edfce5cba63f1d3";
+    sha256 = "0yyrgk2639lz1yvg4jf0ccahnkic31dy77q05pb3i28rjf37v45z";
     fetchSubmodules = true;
   };
 
-  buildInputs = [ cmake gcc zlib ];
+  buildInputs = [ zlib bzip2 lzma ];
 
-  builder = ./builder.sh;
+  installPhase = ''
+    install -vD bin/freebayes bin/bamleftalign scripts/* -t $out/bin
+  '';
 
   meta = with stdenv.lib; {
     description = "Bayesian haplotype-based polymorphism discovery and genotyping";
diff --git a/pkgs/applications/window-managers/i3/default.nix b/pkgs/applications/window-managers/i3/default.nix
index 54dfc08e3b5..19aa89a7f7e 100644
--- a/pkgs/applications/window-managers/i3/default.nix
+++ b/pkgs/applications/window-managers/i3/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   name = "i3-${version}";
-  version = "4.14";
+  version = "4.14.1";
 
   src = fetchurl {
     url = "http://i3wm.org/downloads/${name}.tar.bz2";
-    sha256 = "1mm5jazwv4dz3k8vl1lfrcw86agpws5k9lmav1ly51qvmzivsfmf";
+    sha256 = "1cazmfbbx6n8c81h6x6pdayq3mxs2ml3adz165z8vapkc72kl1nh";
   };
 
   nativeBuildInputs = [ which pkgconfig makeWrapper ];
diff --git a/pkgs/applications/window-managers/i3/gaps.nix b/pkgs/applications/window-managers/i3/gaps.nix
index 58ab5b1d676..b322c7da193 100644
--- a/pkgs/applications/window-managers/i3/gaps.nix
+++ b/pkgs/applications/window-managers/i3/gaps.nix
@@ -3,12 +3,12 @@
 i3.overrideDerivation (super : rec {
 
   name = "i3-gaps-${version}";
-  version = "4.14";
-  releaseDate = "2017-09-04";
+  version = "4.14.1";
+  releaseDate = "2017-09-24";
 
   src = fetchurl {
     url = "https://github.com/Airblader/i3/archive/${version}.tar.gz";
-    sha256 = "08y2m0afcm8mbzb92qz286fd1hnqfya2pvhpxbgv83sgjcsg6hlr";
+    sha256 = "11fnkg4halplcnannfw3ishzwwbxbnjafmkxsim199jhlyjjd8j7";
   };
 
   nativeBuildInputs = super.nativeBuildInputs ++ [ autoreconfHook ];
diff --git a/pkgs/desktops/lxqt/optional/screengrab/default.nix b/pkgs/desktops/lxqt/optional/screengrab/default.nix
index e8cc7c30fa1..4bd040c00a8 100644
--- a/pkgs/desktops/lxqt/optional/screengrab/default.nix
+++ b/pkgs/desktops/lxqt/optional/screengrab/default.nix
@@ -1,13 +1,14 @@
 { stdenv, fetchFromGitHub, cmake, pkgconfig, qtbase, qttools, qtx11extras, qtsvg, kwindowsystem, libqtxdg, xorg }:
 
 stdenv.mkDerivation rec {
-  name = "screengrab-unstable-2017-02-18";
+  name = "screengrab-${version}";
+  version = "1.97";
 
   srcs = fetchFromGitHub {
     owner = "QtDesktop";
     repo = "screengrab";
-    rev = "6fc03c70fe132b89f35d4cef2f62c9d804de3b64";
-    sha256 = "1h3rlpmaqxzysaibcw7s5msbrwaxkg6sz7a8xv6cqzjvggv09my0";
+    rev = version;
+    sha256 = "0qhdxnv1pz745qgvdv5x7kyfx9dz9rrq0wxyfimppzxcszv4pl2z";
   };
 
   nativeBuildInputs = [ cmake pkgconfig ];
diff --git a/pkgs/development/compilers/tinycc/default.nix b/pkgs/development/compilers/tinycc/default.nix
index 8e56c1ee50b..4d655521334 100644
--- a/pkgs/development/compilers/tinycc/default.nix
+++ b/pkgs/development/compilers/tinycc/default.nix
@@ -2,9 +2,9 @@
 with stdenv.lib;
 
 let
-  date = "20170911";
-  rev = "870271ea071971002fa556e09e1873db316fa1a9";
-  sha256 = "1a9djm0p7cd5nzqdhch9y48c4wai76x6d4nwx0bj5jz46ws39bs9";
+  date = "20170924";
+  rev = "1443039416dd02750765efde1af35e31c8d41be3";
+  sha256 = "060l0f77hirq3i5bg294gxcszlvyn89ds2q21jwgy3ryrapfbl8i";
   version = "0.9.27pre-${date}";
 in
 
diff --git a/pkgs/development/compilers/urweb/default.nix b/pkgs/development/compilers/urweb/default.nix
index 7145a8f2fa0..74ca5dc4c4b 100644
--- a/pkgs/development/compilers/urweb/default.nix
+++ b/pkgs/development/compilers/urweb/default.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, fetchurl, file, openssl, mlton
-, mysql, postgresql, sqlite
+, mysql, postgresql, sqlite, gcc
 }:
 
 stdenv.mkDerivation rec {
@@ -24,8 +24,10 @@ stdenv.mkDerivation rec {
     export MSHEADER="${lib.getDev mysql.client}/include/mysql/mysql.h";
     export SQHEADER="${sqlite.dev}/include/sqlite3.h";
 
+    export CC="${gcc}/bin/gcc";
     export CCARGS="-I$out/include \
-                   -L${lib.getLib mysql.client}/lib/mysql \
+                   -L${openssl.out}/lib \
+                   -L${lib.getLib mysql.client}/lib \
                    -L${postgresql.lib}/lib \
                    -L${sqlite.out}/lib";
   '';
@@ -37,7 +39,7 @@ stdenv.mkDerivation rec {
     description = "Advanced purely-functional web programming language";
     homepage    = "http://www.impredicative.com/ur/";
     license     = stdenv.lib.licenses.bsd3;
-    platforms   = stdenv.lib.platforms.linux;
+    platforms   = stdenv.lib.platforms.linux ++ stdenv.lib.platforms.darwin;
     maintainers = [ stdenv.lib.maintainers.thoughtpolice stdenv.lib.maintainers.sheganinans ];
   };
 }
diff --git a/pkgs/development/interpreters/php/default.nix b/pkgs/development/interpreters/php/default.nix
index 7b832fa6eed..ed018a94227 100644
--- a/pkgs/development/interpreters/php/default.nix
+++ b/pkgs/development/interpreters/php/default.nix
@@ -99,12 +99,12 @@ let
         };
 
         postgresql = {
-          configureFlags = ["--with-pgsql=${postgresql.dev}"];
+          configureFlags = ["--with-pgsql=${postgresql}"];
           buildInputs = [ postgresql ];
         };
 
         pdo_pgsql = {
-          configureFlags = ["--with-pdo-pgsql=${postgresql.dev}"];
+          configureFlags = ["--with-pdo-pgsql=${postgresql}"];
           buildInputs = [ postgresql ];
         };
 
diff --git a/pkgs/development/libraries/gdal/default.nix b/pkgs/development/libraries/gdal/default.nix
index 600e9314cd4..984d3da8119 100644
--- a/pkgs/development/libraries/gdal/default.nix
+++ b/pkgs/development/libraries/gdal/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     "--with-png=${libpng.dev}"      # optional
     "--with-poppler=${poppler.dev}" # optional
     "--with-libz=${zlib.dev}"       # optional
-    "--with-pg=${postgresql.dev}/bin/pg_config"
+    "--with-pg=${postgresql}/bin/pg_config"
     "--with-mysql=${mysql.lib.dev}/bin/mysql_config"
     "--with-geotiff=${libgeotiff}"
     "--with-sqlite3=${sqlite.dev}"
diff --git a/pkgs/development/libraries/glfw/2.x.nix b/pkgs/development/libraries/glfw/2.x.nix
index 00b9cff9576..a017ff3d988 100644
--- a/pkgs/development/libraries/glfw/2.x.nix
+++ b/pkgs/development/libraries/glfw/2.x.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, mesa, libX11 }:
+{ stdenv, fetchurl, mesa_glu, mesa_noglu, libX11, libXext }:
 
 stdenv.mkDerivation rec {
   name = "glfw-2.7.9";
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
     sha256 = "17c2msdcb7pn3p8f83805h1c216bmdqnbn9hgzr1j8wnwjcpxx6i";
   };
 
-  buildInputs = [ mesa libX11 ];
+  buildInputs = [ mesa_glu mesa_noglu libX11 libXext ];
 
   buildPhase = ''
     make x11
diff --git a/pkgs/development/libraries/glfw/3.x.nix b/pkgs/development/libraries/glfw/3.x.nix
index 52673061b72..c10b3c05986 100644
--- a/pkgs/development/libraries/glfw/3.x.nix
+++ b/pkgs/development/libraries/glfw/3.x.nix
@@ -1,5 +1,4 @@
-{ stdenv, fetchFromGitHub, cmake, mesa, libXrandr, libXi, libXxf86vm, libXfixes, xlibsWrapper
-, libXinerama, libXcursor
+{ stdenv, lib, fetchFromGitHub, cmake, mesa_noglu, libXrandr, libXinerama, libXcursor, libX11
 , darwin, fixDarwinDylibNames
 }:
 
@@ -16,12 +15,15 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  propagatedBuildInputs = [ mesa_noglu ];
+
+  nativeBuildInputs = [ cmake ];
+
   buildInputs = [
-    cmake mesa libXrandr libXi libXxf86vm libXfixes xlibsWrapper
-    libXinerama libXcursor
-  ] ++ stdenv.lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [ Cocoa Kernel fixDarwinDylibNames ]);
+    libX11 libXrandr libXinerama libXcursor
+  ] ++ lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [ Cocoa Kernel fixDarwinDylibNames ]);
 
-  cmakeFlags = "-DBUILD_SHARED_LIBS=ON";
+  cmakeFlags = [ "-DBUILD_SHARED_LIBS=ON" ];
 
   meta = with stdenv.lib; {
     description = "Multi-platform library for creating OpenGL contexts and managing input, including keyboard, mouse, joystick and time";
diff --git a/pkgs/development/libraries/liboping/default.nix b/pkgs/development/libraries/liboping/default.nix
index 435f593b597..c177f7ba58e 100644
--- a/pkgs/development/libraries/liboping/default.nix
+++ b/pkgs/development/libraries/liboping/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, ncurses ? null, perl ? null }:
 
 stdenv.mkDerivation rec {
-  name = "liboping-1.9.0";
+  name = "liboping-1.10.0";
 
   src = fetchurl {
     url = "http://verplant.org/liboping/files/${name}.tar.bz2";
-    sha256 = "0c1mdx9ixqypayhm617jjv9kr6y60nh3mnryafjzv23bnn41vfs4";
+    sha256 = "1n2wkmvw6n80ybdwkjq8ka43z2x8mvxq49byv61b52iyz69slf7b";
   };
 
   buildInputs = [ ncurses perl ];
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     '';
     homepage = http://noping.cc/;
     license = licenses.lgpl21;
-    platforms = platforms.linux;
+    platforms = platforms.unix;
     maintainers = [ maintainers.bjornfor ];
   };
 }
diff --git a/pkgs/development/libraries/opencascade/6.5.nix b/pkgs/development/libraries/opencascade/6.5.nix
deleted file mode 100644
index 252a6bb0ad1..00000000000
--- a/pkgs/development/libraries/opencascade/6.5.nix
+++ /dev/null
@@ -1,47 +0,0 @@
-{stdenv, fetchurl, mesa, tcl, tk, file, libXmu, automake, autoconf, libtool, qt4,
-ftgl, freetype}:
-
-stdenv.mkDerivation rec {
-  name = "opencascade-6.5.5";
-  src = fetchurl {
-    url = http://files.opencascade.com/OCCT/OCC_6.5.5_release/OpenCASCADE655.tgz;
-    sha256 = "1dnik00adfh6dxvn9kgf35yjda8chbi05f71i9119idmmrcapipm";
-  };
-
-  buildInputs = [ mesa tcl tk file libXmu automake autoconf libtool qt4 ftgl freetype ];
-
-  preUnpack = ''
-    sourceRoot=`pwd`/ros
-  '';
-
-  preConfigure = ''
-    sh ./build_configure
-  '';
-
-  # -fpermissive helps building opencascade, although gcc detects a flaw in the code
-  # and reports an error otherwise. Further versions may fix that.
-  NIX_CFLAGS_COMPILE = "-fpermissive"
-  # https://bugzilla.redhat.com/show_bug.cgi?id=902561
-    + " -DUSE_INTERP_RESULT"
-  # https://bugs.freedesktop.org/show_bug.cgi?id=83631
-    + " -DGLX_GLXEXT_LEGACY";
-
-  hardeningDisable = [ "format" ];
-
-  configureFlags = [ "--with-tcl=${tcl}/lib" "--with-tk=${tk}/lib" "--with-qt=${qt4}" "--with-ftgl=${ftgl}" "--with-freetype=${freetype.dev}" ];
-
-  postInstall = ''
-    mv $out/inc $out/include
-    mkdir -p $out/share/doc/${name}
-    cp -R ../doc $out/share/doc/${name}
-  '';
-
-  enableParallelBuilding = true;
-
-  meta = {
-    description = "Open CASCADE Technology, libraries for 3D modeling and numerical simulation";
-    homepage = http://www.opencascade.org/;
-    maintainers = with stdenv.lib.maintainers; [viric];
-    platforms = with stdenv.lib.platforms; linux;
-  };
-}
diff --git a/pkgs/development/libraries/opencascade/default.nix b/pkgs/development/libraries/opencascade/default.nix
index 51581bca382..58f9019d6e0 100644
--- a/pkgs/development/libraries/opencascade/default.nix
+++ b/pkgs/development/libraries/opencascade/default.nix
@@ -1,38 +1,21 @@
-{stdenv, fetchurl, mesa, tcl, tk, file, libXmu, cmake, qt4, freetype}:
+{stdenv, fetchurl, mesa, tcl, tk, file, libXmu, cmake, libtool, qt4,
+ftgl, freetype}:
 
 stdenv.mkDerivation rec {
-  name = "opencascade-6.6.0";
+  name = "opencascade-oce-0.17.2";
   src = fetchurl {
-    url = http://files.opencascade.com/OCCT/OCC_6.6.0_release/OpenCASCADE660.tgz;
-    sha256 = "0q2xn915w9skv9sj74lxnyv9g3b0yi1j04majyzxk6sv4nra97z3";
+    url = https://github.com/tpaviot/oce/archive/OCE-0.17.2.tar.gz;
+    sha256 = "0vpmnb0k5y2f7lpmwx9pg9yfq24zjvnsak5alzacncfm1hv9b6cd";
   };
 
-  buildInputs = [ cmake mesa tcl tk file libXmu qt4 freetype ];
-
-  sourceRoot = "ros/adm/cmake";
-
-  cmakeFlags = [
-    "-D3RDPARTY_TCL_DIR=${tcl}"
-    "-D3RDPARTY_FREETYPE_DIR=${freetype.dev}"
-
-    # Not used on Linux but must be defined during configuration.
-    "-D3RDPARTY_FREETYPE_DLL=${freetype.dev}"
-  ];
-
-  # https://bugs.freedesktop.org/show_bug.cgi?id=83631
-  NIX_CFLAGS_COMPILE = "-DGLX_GLXEXT_LEGACY";
-
-  hardeningDisable = [ "format" ];
+  buildInputs = [ mesa tcl tk file libXmu libtool qt4 ftgl freetype cmake ];
 
   preConfigure = ''
-    cmakeFlags="$cmakeFlags -DINSTALL_DIR=$out"
+    cmakeFlags="$cmakeFlags -DOCE_INSTALL_PREFIX=$out"
   '';
 
-  postInstall = ''
-    mv $out/inc $out/include
-    mkdir -p $out/share/doc/${name}
-    cp -R ../../../doc $out/share/doc/${name}
-  '';
+  # https://bugs.freedesktop.org/show_bug.cgi?id=83631
+  NIX_CFLAGS_COMPILE = "-DGLX_GLXEXT_LEGACY";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/opencascade/oce.nix b/pkgs/development/libraries/opencascade/oce.nix
deleted file mode 100644
index 58f9019d6e0..00000000000
--- a/pkgs/development/libraries/opencascade/oce.nix
+++ /dev/null
@@ -1,28 +0,0 @@
-{stdenv, fetchurl, mesa, tcl, tk, file, libXmu, cmake, libtool, qt4,
-ftgl, freetype}:
-
-stdenv.mkDerivation rec {
-  name = "opencascade-oce-0.17.2";
-  src = fetchurl {
-    url = https://github.com/tpaviot/oce/archive/OCE-0.17.2.tar.gz;
-    sha256 = "0vpmnb0k5y2f7lpmwx9pg9yfq24zjvnsak5alzacncfm1hv9b6cd";
-  };
-
-  buildInputs = [ mesa tcl tk file libXmu libtool qt4 ftgl freetype cmake ];
-
-  preConfigure = ''
-    cmakeFlags="$cmakeFlags -DOCE_INSTALL_PREFIX=$out"
-  '';
-
-  # https://bugs.freedesktop.org/show_bug.cgi?id=83631
-  NIX_CFLAGS_COMPILE = "-DGLX_GLXEXT_LEGACY";
-
-  enableParallelBuilding = true;
-
-  meta = {
-    description = "Open CASCADE Technology, libraries for 3D modeling and numerical simulation";
-    homepage = http://www.opencascade.org/;
-    maintainers = with stdenv.lib.maintainers; [viric];
-    platforms = with stdenv.lib.platforms; linux;
-  };
-}
diff --git a/pkgs/development/python-modules/pyblake2/default.nix b/pkgs/development/python-modules/pyblake2/default.nix
new file mode 100644
index 00000000000..4e166dcb183
--- /dev/null
+++ b/pkgs/development/python-modules/pyblake2/default.nix
@@ -0,0 +1,24 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+}:
+
+buildPythonPackage rec {
+  pname = "pyblake2";
+  version = "0.9.3";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "626448e1fe1cc01d2197118954bec9f158378577e12686d5b01979f7f0fa2212";
+  };
+
+  # requires setting up sphinx doctest
+  doCheck = false;
+
+  meta = {
+    description = "BLAKE2 hash function extension module";
+    license = lib.licenses.publicDomain;
+    homepage = https://github.com/dchest/pyblake2;
+  };
+}
\ No newline at end of file
diff --git a/pkgs/development/python-modules/requests-toolbelt/default.nix b/pkgs/development/python-modules/requests-toolbelt/default.nix
new file mode 100644
index 00000000000..e7834e62b82
--- /dev/null
+++ b/pkgs/development/python-modules/requests-toolbelt/default.nix
@@ -0,0 +1,32 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, requests
+, betamax
+, mock
+, pytest
+}:
+
+buildPythonPackage rec {
+  pname = "requests-toolbelt";
+  version = "0.8.0";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "f6a531936c6fa4c6cfce1b9c10d5c4f498d16528d2a54a22ca00011205a187b5";
+  };
+
+  checkInputs = [ betamax mock pytest ];
+  propagatedBuildInputs = [ requests ];
+
+  checkPhase = ''
+    py.test tests
+  '';
+
+  meta = {
+    description = "A toolbelt of useful classes and functions to be used with python-requests";
+    homepage = http://toolbelt.rtfd.org;
+    maintainers = with lib.maintainers; [ matthiasbeyer jgeerds ];
+  };
+}
\ No newline at end of file
diff --git a/pkgs/development/python-modules/twine/default.nix b/pkgs/development/python-modules/twine/default.nix
new file mode 100644
index 00000000000..a3f0df8ca2c
--- /dev/null
+++ b/pkgs/development/python-modules/twine/default.nix
@@ -0,0 +1,32 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pkginfo
+, requests
+, requests_toolbelt
+, tqdm
+, pyblake2
+}:
+
+buildPythonPackage rec {
+  pname = "twine";
+  version = "1.9.1";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "caa45b7987fc96321258cd7668e3be2ff34064f5c66d2d975b641adca659c1ab";
+  };
+
+  propagatedBuildInputs = [ pkginfo requests requests_toolbelt tqdm pyblake2 ];
+
+  # Requires network
+  doCheck = false;
+
+  meta = {
+    description = "Collection of utilities for interacting with PyPI";
+    homepage = https://github.com/pypa/twine;
+    license = lib.licenses.asl20;
+    maintainer = with lib.maintainers; [ fridh ];
+  };
+}
\ No newline at end of file
diff --git a/pkgs/development/ruby-modules/gem-config/default.nix b/pkgs/development/ruby-modules/gem-config/default.nix
index a0d4b9adcbe..6647d71bd00 100644
--- a/pkgs/development/ruby-modules/gem-config/default.nix
+++ b/pkgs/development/ruby-modules/gem-config/default.nix
@@ -183,7 +183,7 @@ in
 
   pg = attrs: {
     buildFlags = [
-      "--with-pg-config=${postgresql.dev}/bin/pg_config"
+      "--with-pg-config=${postgresql}/bin/pg_config"
     ];
   };
 
diff --git a/pkgs/misc/emulators/snes9x-gtk/default.nix b/pkgs/misc/emulators/snes9x-gtk/default.nix
index c6f4df1e5c0..f2d3abc0de3 100644
--- a/pkgs/misc/emulators/snes9x-gtk/default.nix
+++ b/pkgs/misc/emulators/snes9x-gtk/default.nix
@@ -1,26 +1,26 @@
-{stdenv, fetchurl, nasm, SDL, zlib, libpng, ncurses, mesa, intltool, gtk2, pkgconfig, libxml2, xlibsWrapper, libpulseaudio}:
+{ stdenv, fetchFromGitHub, autoreconfHook, intltool, pkgconfig
+, SDL, zlib, gtk2, libxml2, libXv }:
 
 stdenv.mkDerivation rec {
   name = "snes9x-gtk-${version}";
-  version = "1.53";
+  version = "1.54.1";
 
-  src = fetchurl {
-    url = "http://files.ipherswipsite.com/snes9x/snes9x-${version}-src.tar.bz2";
-    sha256 = "9f7c5d2d0fa3fe753611cf94e8879b73b8bb3c0eab97cdbcb6ab7376efa78dc3";
+  src = fetchFromGitHub {
+    owner = "snes9xgit";
+    repo = "snes9x";
+    rev = version;
+    sha256 = "10fqm7lk36zj2gnx0ypps0nlws923f60b0zj4pmq9apawgx8k6rw";
   };
 
-  buildInputs = [ nasm SDL zlib libpng ncurses mesa intltool gtk2 pkgconfig libxml2 xlibsWrapper libpulseaudio];
+  nativeBuildInputs = [ autoreconfHook intltool pkgconfig ];
 
-  sourceRoot = "snes9x-${version}-src/gtk";
+  sourceRoot = "snes9x-${version}-src";
+  preAutoreconf = "cd gtk; intltoolize";  
+    
+  buildInputs = [ SDL zlib gtk2 libxml2 libXv ];
+  installPhase = "install -Dt $out/bin snes9x-gtk";
 
-  configureFlags = "--prefix=$out/ --with-opengl";
-
-  installPhase = ''
-    mkdir -p $out/bin
-    cp snes9x-gtk $out/bin
-  '';
-
-  meta = {
+  meta = with stdenv.lib; {
     description = "A portable, freeware Super Nintendo Entertainment System (SNES) emulator";
     longDescription = ''
       Snes9x is a portable, freeware Super Nintendo Entertainment System (SNES)
@@ -28,9 +28,9 @@ stdenv.mkDerivation rec {
       and Super Famicom Nintendo game systems on your PC or Workstation; which
       includes some real gems that were only ever released in Japan.
     '';
-    license = stdenv.lib.licenses.lgpl2;
-    maintainers = [ stdenv.lib.maintainers.qknight ];
+    license = licenses.lgpl2;
+    maintainers = with maintainers; [ qknight ];
     homepage = http://www.snes9x.com/;
-    platforms = stdenv.lib.platforms.linux;
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/bluez/default.nix b/pkgs/os-specific/linux/bluez/default.nix
index f0a59f36e43..e9a1f314abc 100644
--- a/pkgs/os-specific/linux/bluez/default.nix
+++ b/pkgs/os-specific/linux/bluez/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, pkgconfig, dbus, glib, alsaLib,
-  pythonPackages, readline, libsndfile, udev, libical,
+  pythonPackages, readline, udev, libical,
   systemd, enableWiimote ? false }:
 
 assert stdenv.isLinux;
@@ -15,13 +15,10 @@ stdenv.mkDerivation rec {
   pythonPath = with pythonPackages;
     [ dbus pygobject2 pygobject3 recursivePthLoader ];
 
-  buildInputs =
-    [ pkgconfig dbus glib alsaLib pythonPackages.python pythonPackages.wrapPython
-      readline libsndfile udev libical
-      # Disables GStreamer; not clear what it gains us other than a
-      # zillion extra dependencies.
-      # gstreamer gst-plugins-base
-    ];
+  buildInputs = [
+    pkgconfig dbus glib alsaLib pythonPackages.python pythonPackages.wrapPython
+    readline udev libical
+  ];
 
   outputs = [ "out" "dev" "test" ];
 
@@ -51,10 +48,8 @@ stdenv.mkDerivation rec {
 
   makeFlags = "rulesdir=$(out)/lib/udev/rules.d";
 
-  # FIXME: Move these into a separate package to prevent Bluez from
-  # depending on Python etc.
   postInstall = ''
-    mkdir -p $test/test
+    mkdir -p $test/{bin,test}
     cp -a test $test
     pushd $test/test
     for a in \
@@ -65,7 +60,7 @@ stdenv.mkDerivation rec {
             list-devices \
             monitor-bluetooth \
             ; do
-      ln -s ../test/$a $out/bin/bluez-$a
+      ln -s ../test/$a $test/bin/bluez-$a
     done
     popd
     wrapPythonProgramsIn $test/test "$test/test $pythonPath"
diff --git a/pkgs/os-specific/linux/nvidia-x11/default.nix b/pkgs/os-specific/linux/nvidia-x11/default.nix
index 22ceb1b2378..ba9b332e6d7 100644
--- a/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/default.nix
@@ -6,11 +6,11 @@ in
 {
   # Policy: use the highest stable version as the default (on our master).
   stable = generic {
-    version = "384.69";
-    sha256_32bit = "1zgq9vji0ndadvql3bsnd0a6p7pq0vr8d0yb5c8b22i2h9smhw1v";
-    sha256_64bit = "0l3np6cx2rnb2q89zbnq4lvfcjl2g7i56hxwcb11ggijqm7ridx7";
-    settingsSha256 = "064va75p7dnkhy4hyi9b1gl4wjmrpjksg4cyiwl6n3lkmjnvmnwy";
-    persistencedSha256 = "0ijq25gnihw34qhkba62l5fy6lwkma94i0fxp8084byyilm3fwms";
+    version = "384.90";
+    sha256_32bit = "0mq0h7g56m9zvr42ipy2664ph922754l0pdp8wpsmzfpkzg6g9lp";
+    sha256_64bit = "1ggylpzw1j217w64rspw4fhvq25wz0la0hhy0b1kxjpwy8h6ipqd";
+    settingsSha256 = "023jfbsxsbkjk78i9i6wd0sybv5hib2d7mfvy635w3anjcrsk5il";
+    persistencedSha256 = "166ya8pnv4frvrsp0x5zkg8li85vipags03wy6dlf8s940al92z2";
   };
 
   beta = generic {
diff --git a/pkgs/servers/dgraph/default.nix b/pkgs/servers/dgraph/default.nix
index 1712476b923..06aef0babd3 100644
--- a/pkgs/servers/dgraph/default.nix
+++ b/pkgs/servers/dgraph/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   name = "dgraph-${version}";
-  version = "0.8.1";
+  version = "0.8.2";
 
   goPackagePath = "github.com/dgraph-io/dgraph";
 
@@ -10,13 +10,13 @@ buildGoPackage rec {
     owner = "dgraph-io";
     repo = "dgraph";
     rev = "v${version}";
-    sha256 = "1gls2pvgcmd364x84gz5fafs7pwkll4k352rg1lmv70wvzyydsdr";
+    sha256 = "0zc5bda8m2srjbk0gy1nnm0bya8if0kmk1szqr1qv3xifdzmi4nf";
   };
 
   extraOutputsToInstall = [ "dashboard" ];
 
   goDeps = ./deps.nix;
-  subPackages = [ "cmd/dgraph" "cmd/dgraphloader" ];
+  subPackages = [ "cmd/dgraph" "cmd/dgraphloader" "cmd/bulkloader"];
 
   # let's move the dashboard to a different output, to prevent $bin from
   # depending on $out
@@ -36,6 +36,7 @@ buildGoPackage rec {
     # Removing it fixes cycle between $out and $bin
     install_name_tool -delete_rpath $out/lib $bin/bin/dgraph
     install_name_tool -delete_rpath $out/lib $bin/bin/dgraphloader
+    install_name_tool -delete_rpath $out/lib $bin/bin/bulkloader
   '';
  
   meta = {
diff --git a/pkgs/servers/dgraph/deps.nix b/pkgs/servers/dgraph/deps.nix
index 2e03c75489b..89e00e0d8cb 100644
--- a/pkgs/servers/dgraph/deps.nix
+++ b/pkgs/servers/dgraph/deps.nix
@@ -94,8 +94,8 @@
     fetch = {
       type = "git";
       url = "https://github.com/coreos/etcd";
-      rev = "1ebeef5cbfe69c0dab2bc701ee5307eed7a7d8d2";
-      sha256 = "12lidn1a8nwsk6nlwyfirrxkxhs4lhj53f4cd19xm8w070q0mg19";
+      rev = "9d43462d174c664f5edf313dec0de31e1ef4ed47";
+      sha256 = "0qxqjxhhciaacag1jz2rlncmlgw861ig2yx993ylvfm30jvyj2cj";
     };
   }
   {
@@ -112,8 +112,8 @@
     fetch = {
       type = "git";
       url = "https://github.com/dgraph-io/badger";
-      rev = "ad23a425b3c87b8223780cb882bed568ca14b9f0";
-      sha256 = "1xjd05vska1kanmgdhp5cvkn2i6236rqphrc9i4kfjndgwkmas57";
+      rev = "64df7f57d9ee20d7b28de4a3eea90bf8d7310a77";
+      sha256 = "1ikgzn2l62kb238n0wm6s95py5ypv71p09w7zyvzkjf34x675mzz";
     };
   }
   {
@@ -139,8 +139,8 @@
     fetch = {
       type = "git";
       url = "https://github.com/golang/geo";
-      rev = "3a42ea109208469f16baf9e090135dd0e82ece5c";
-      sha256 = "1fzlakjj94gv516q7gd9qycn91lij7wmjbdv0vsrh6qnxvgqr8hw";
+      rev = "31fb0106dc4a947e5aaee1fe186e56447f839510";
+      sha256 = "00w4kwm98hrgr3ggfdk1h7qa5gp00z4s0j0iwgwd9rgadb59kb2c";
     };
   }
   {
@@ -292,8 +292,8 @@
     fetch = {
       type = "git";
       url = "https://go.googlesource.com/text";
-      rev = "836efe42bb4aa16aaa17b9c155d8813d336ed720";
-      sha256 = "11s7bjk0karl1lx8v4n6dvdnsh702x4f2qlmnqac2qdz8hdswmi1";
+      rev = "1cbadb444a806fd9430d14ad08967ed91da4fa0a";
+      sha256 = "0ih9ysagh4ylj08393497sscf3yziybc6acg4mrh0wa7mld75j56";
     };
   }
   {
@@ -301,8 +301,8 @@
     fetch = {
       type = "git";
       url = "https://github.com/google/go-genproto";
-      rev = "b0a3dcfcd1a9bd48e63634bd8802960804cf8315";
-      sha256 = "0lkj73lyr4dzj2pxgmild0i1bl6kdgrxa3c8m44j5ms537pyxcpr";
+      rev = "1e559d0a00eef8a9a43151db4665280bd8dd5886";
+      sha256 = "1dfm8zd9mif1aswks79wgyi7n818s5brbdnnrrlg79whfhaf20hd";
     };
   }
   {
@@ -310,8 +310,8 @@
     fetch = {
       type = "git";
       url = "https://github.com/grpc/grpc-go";
-      rev = "2bb318258959db281674bc6fd67b5167b7ff0d65";
-      sha256 = "1g8ir87ksr8549801vdgb0n6rmxws05ky50bkgjv86370h146cqm";
+      rev = "f92cdcd7dcdc69e81b2d7b338479a19a8723cfa3";
+      sha256 = "1li8rn2s4f8qc77npamlm2ijin44scb8vvd8c4cr0l7za2m89jfn";
     };
   }
   {
diff --git a/pkgs/servers/search/elasticsearch/5.x.nix b/pkgs/servers/search/elasticsearch/5.x.nix
index cfa471f217e..fb988b54630 100644
--- a/pkgs/servers/search/elasticsearch/5.x.nix
+++ b/pkgs/servers/search/elasticsearch/5.x.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, elk5Version, makeWrapper, jre, utillinux, getopt }:
+{ stdenv, fetchurl, elk5Version, makeWrapper, jre_headless, utillinux, getopt }:
 
 with stdenv.lib;
 
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   patches = [ ./es-home-5.x.patch ./es-classpath-5.x.patch ];
 
-  buildInputs = [ makeWrapper jre ] ++
+  buildInputs = [ makeWrapper jre_headless ] ++
     (if (!stdenv.isDarwin) then [utillinux] else [getopt]);
 
   installPhase = ''
@@ -27,10 +27,10 @@ stdenv.mkDerivation rec {
       ${if (!stdenv.isDarwin)
         then ''--prefix PATH : "${utillinux}/bin/"''
         else ''--prefix PATH : "${getopt}/bin"''} \
-      --set JAVA_HOME "${jre}" \
+      --set JAVA_HOME "${jre_headless}" \
       --set ES_JVM_OPTIONS "$out/config/jvm.options"
 
-    wrapProgram $out/bin/elasticsearch-plugin --set JAVA_HOME "${jre}"
+    wrapProgram $out/bin/elasticsearch-plugin --set JAVA_HOME "${jre_headless}"
   '';
 
   meta = {
diff --git a/pkgs/servers/sql/postgresql/default.nix b/pkgs/servers/sql/postgresql/default.nix
index 980ed5056a1..8a3097ae9de 100644
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@@ -11,7 +11,7 @@ let
       inherit sha256;
     };
 
-    outputs = [ "out" "dev" "lib" "doc" "man" ];
+    outputs = [ "out" "lib" "doc" "man" ];
     setOutputFlags = false; # $out retains configureFlags :-/
 
     buildInputs =
@@ -46,16 +46,18 @@ let
       let path = if atLeast "9.6" then "src/common/config_info.c" else "src/bin/pg_config/pg_config.c"; in
         ''
           # Hardcode the path to pgxs so pg_config returns the path in $out
-          substituteInPlace "${path}" --replace HARDCODED_PGXS_PATH $dev/lib
+          substituteInPlace "${path}" --replace HARDCODED_PGXS_PATH $out/lib
         '';
 
     postInstall =
       ''
-        moveToOutput "bin/pg_config" "$dev"
-        moveToOutput "lib/pgxs" "$dev" # looks strange, but not deleting it
+        moveToOutput "lib/pgxs" "$out" # looks strange, but not deleting it
         moveToOutput "lib/*.a" "$out"
         moveToOutput "lib/libecpg*" "$out"
 
+        # Prevent a retained dependency on gcc-wrapper.
+        substituteInPlace "$out/lib/pgxs/src/Makefile.global" --replace ${stdenv.cc}/bin/ld ld
+
         # Remove static libraries in case dynamic are available.
         for i in $out/lib/*.a; do
           name="$(basename "$i")"
diff --git a/pkgs/servers/udpt/default.nix b/pkgs/servers/udpt/default.nix
index 97938de74a5..9e9816c941d 100644
--- a/pkgs/servers/udpt/default.nix
+++ b/pkgs/servers/udpt/default.nix
@@ -1,8 +1,8 @@
-{ stdenv, fetchFromGitHub, boost, sqlite }:
+{ stdenv, fetchFromGitHub, boost, sqlite, cmake, gtest }:
 
 stdenv.mkDerivation rec {
   name = "udpt-${version}";
-  version = "2016-02-20"; # v2.0-rc0 with sample config
+  version = "2017-09-27";
 
   enableParallelBuilding = true;
 
@@ -12,11 +12,21 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "naim94a";
     repo = "udpt";
-    rev = "0790558de8b5bb841bb10a9115bbf72c3b4711b5";
-    sha256 = "0rgkjwvnqwbnqy7pm3dk176d3plb5lypaf12533yr0yfzcp6gnzk";
+    rev = "e0dffc83c8ce76b08a41a4abbd5f8065535d534f";
+    sha256 = "187dw96mzgcmh4k9pvfpb7ckbb8d4vlikamr2x8vkpwzgjs3xd6g";
   };
 
-  buildInputs = [ boost sqlite ];
+  doCheck = true;
+
+  checkPhase = ''
+    runHook preCheck
+
+    make test
+
+    runHook postCheck
+  '';
+
+  buildInputs = [ boost sqlite cmake gtest ];
 
   postPatch = ''
     # Enabling optimization (implied by fortify hardening) causes htons
@@ -27,7 +37,7 @@ stdenv.mkDerivation rec {
   installPhase = ''
     mkdir -p $out/bin $out/etc/
     cp udpt $out/bin
-    cp udpt.conf $out/etc/
+    cp ../udpt.conf $out/etc/
     # without this, the resulting binary is unstripped.
     runHook postInstall
   '';
diff --git a/pkgs/tools/X11/xwinwrap/default.nix b/pkgs/tools/X11/xwinwrap/default.nix
new file mode 100644
index 00000000000..6ea24ad2c6a
--- /dev/null
+++ b/pkgs/tools/X11/xwinwrap/default.nix
@@ -0,0 +1,54 @@
+{ stdenv, fetchbzr, x11 }:
+
+let
+  version = "4";
+in
+stdenv.mkDerivation {
+  name = "xwinwrap-${version}";
+
+  src = fetchbzr {
+    url = https://code.launchpad.net/~shantanu-goel/xwinwrap/devel;
+    rev = version;
+    sha256 = "1annhqc71jcgx5zvcy31c1c488ygx4q1ygrwyy2y0ww743smbchw";
+  };
+
+  buildInputs = [
+    x11
+  ];
+
+  buildPhase = if stdenv.system == "x86_64-linux" then ''
+    make all64
+  '' else if stdenv.system == "i686-linux" then ''
+    make all32
+  '' else throw "xwinwrap is not supported on ${stdenv.system}";
+
+  installPhase = ''
+    mkdir -p $out/bin
+    mv */xwinwrap $out/bin
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A utility that allows you to use an animated X window as the wallpaper";
+    longDescription = ''
+      XWinWrap is a small utility written a loooong time ago that allowed you to
+      stick most of the apps to your desktop background. What this meant was you
+      could use an animated screensaver (like glmatrix, electric sheep, etc) or
+      even a movie, and use it as your wallpaper. But only one version of this
+      app was ever released, and it had a few problems, like:
+
+      - Well, sticking didn’t work. So if you did a “minimize all” or “go to
+      desktop” kind of thing, your “wallpaper” got minimized as well.
+
+      - The geometry option didn’t work, so you could not create, e.g., a small
+      matrix window surrounded by your original wallpaper.
+
+      Seeing no-one picking it up, I decided to give it a bit of polish last
+      weekend by fixing the above problems and also add a few features. And here
+      it is, in its new avatar “Shantz XWinWrap”.
+    '';
+    license = licenses.hpnd;
+    homepage = https://shantanugoel.com/2008/09/03/shantz-xwinwrap/;
+    maintainers = with maintainers; [ infinisil ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/tools/backup/bacula/default.nix b/pkgs/tools/backup/bacula/default.nix
index 7c368ce4d03..374122814c5 100644
--- a/pkgs/tools/backup/bacula/default.nix
+++ b/pkgs/tools/backup/bacula/default.nix
@@ -12,9 +12,9 @@ stdenv.mkDerivation rec {
     # acl relies on attr, which I can't get to build on darwin
     ++ stdenv.lib.optional (!stdenv.isDarwin) acl;
 
-  configureFlags = [
+  configureFlags = [ 
     "--with-sqlite3=${sqlite.dev}"
-    "--with-postgresql=${postgresql.dev}"
+    "--with-postgresql=${postgresql}"
   ];
 
   postInstall = ''
diff --git a/pkgs/tools/misc/hdf5/default.nix b/pkgs/tools/misc/hdf5/default.nix
index eb29e7d914c..257ade40727 100644
--- a/pkgs/tools/misc/hdf5/default.nix
+++ b/pkgs/tools/misc/hdf5/default.nix
@@ -1,5 +1,7 @@
 { stdenv
 , fetchurl
+, gcc
+, removeReferencesTo
 , cpp ? false
 , gfortran ? null
 , zlib ? null
@@ -30,6 +32,8 @@ stdenv.mkDerivation rec {
     inherit mpi;
   };
 
+  nativeBuildInputs = [ removeReferencesTo ];
+
   buildInputs = []
     ++ optional (gfortran != null) gfortran
     ++ optional (szip != null) szip;
@@ -47,6 +51,10 @@ stdenv.mkDerivation rec {
 
   patches = [./bin-mv.patch];
 
+  postInstall = ''
+    find "$out" -type f -exec remove-references-to -t ${stdenv.cc} '{}' +
+  '';
+
   meta = {
     description = "Data model, library, and file format for storing and managing data";
     longDescription = ''
diff --git a/pkgs/tools/misc/ipxe/default.nix b/pkgs/tools/misc/ipxe/default.nix
index 6cd451264ab..2d36ad17eec 100644
--- a/pkgs/tools/misc/ipxe/default.nix
+++ b/pkgs/tools/misc/ipxe/default.nix
@@ -1,8 +1,8 @@
 { stdenv, fetchgit, perl, cdrkit, syslinux, xz, openssl }:
 
 let
-  date = "20160831";
-  rev = "827dd1bfee67daa683935ce65316f7e0f057fe1c";
+  date = "20170922";
+  rev = "74d90b33f8490adcee2026ece18d8411d93b6a39";
 in
 
 stdenv.mkDerivation {
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
 
   src = fetchgit {
     url = git://git.ipxe.org/ipxe.git;
-    sha256 = "11w8b0vln3skfn8r1cvzngslz12njdkwmnacyq3qffb96k2dn2ww";
+    sha256 = "12ijrq451fj2x3i7c7xjlxig5mwbhmgzqjvmfl2sza953vfbk4vw";
     inherit rev;
   };
 
@@ -40,6 +40,10 @@ stdenv.mkDerivation {
   installPhase = ''
     mkdir -p $out
     cp bin/ipxe.dsk bin/ipxe.usb bin/ipxe.iso bin/ipxe.lkrn bin/undionly.kpxe $out
+
+    # Some PXE constellations especially with dnsmasq are looking for the file with .0 ending
+    # let's provide it as a symlink to be compatible in this case.
+    ln -s undionly.kpxe $out/undionly.kpxe.0
   '';
 
   meta = with stdenv.lib;
diff --git a/pkgs/tools/misc/youtube-dl/default.nix b/pkgs/tools/misc/youtube-dl/default.nix
index 3af0c543560..c364935b12c 100644
--- a/pkgs/tools/misc/youtube-dl/default.nix
+++ b/pkgs/tools/misc/youtube-dl/default.nix
@@ -15,11 +15,11 @@ with stdenv.lib;
 buildPythonApplication rec {
 
   name = "youtube-dl-${version}";
-  version = "2017.09.15";
+  version = "2017.09.24";
 
   src = fetchurl {
     url = "https://yt-dl.org/downloads/${version}/${name}.tar.gz";
-    sha256 = "1kw8pqzvhbpyxcz2jb692j4cgzd3vmd81mra09xvpzkq974jkx7f";
+    sha256 = "0j2m75j0d1n83i7jzpkcj7ir0bkskj024j9b0yi88zipcg740wbx";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/networking/kea/default.nix b/pkgs/tools/networking/kea/default.nix
index cd4c4512169..e1829bcaf7d 100644
--- a/pkgs/tools/networking/kea/default.nix
+++ b/pkgs/tools/networking/kea/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   configureFlags = [
     "--localstatedir=/var"
     "--with-botan-config=${botan}/bin/botan-config-1.10"
-    "--with-dhcp-pgsql=${postgresql.dev}/bin/pg_config"
+    "--with-dhcp-pgsql=${postgresql}/bin/pg_config"
     "--with-dhcp-mysql=${mysql.client.dev}/bin/mysql_config"
   ];
 
diff --git a/pkgs/tools/networking/lftp/default.nix b/pkgs/tools/networking/lftp/default.nix
index b6d8baeee7e..aa5a7b514cb 100644
--- a/pkgs/tools/networking/lftp/default.nix
+++ b/pkgs/tools/networking/lftp/default.nix
@@ -1,8 +1,8 @@
-{ stdenv, fetchurl, gnutls, pkgconfig, readline, zlib, libidn2, gmp, libiconv, gettext }:
+{ stdenv, fetchurl, gnutls, pkgconfig, readline, zlib, libidn2, gmp, libiconv, libunistring, gettext }:
 
 stdenv.mkDerivation rec {
   name = "lftp-${version}";
-  version = "4.8.0";
+  version = "4.8.2";
 
   src = fetchurl {
     urls = [
@@ -10,12 +10,12 @@ stdenv.mkDerivation rec {
       "ftp://ftp.st.ryukoku.ac.jp/pub/network/ftp/lftp/${name}.tar.bz2"
       "http://lftp.yar.ru/ftp/old/${name}.tar.bz2"
       ];
-    sha256 = "0z2432zxzg808swi72yak9kia976qrjj030grk0v4p54mcib3s34";
+    sha256 = "0a4sp9khqgny1md0b2c9vvg4c7sz0g31w3sfdslxw7dsvijin3mn";
   };
 
   nativeBuildInputs = [ pkgconfig ];
 
-  buildInputs = [ gnutls readline zlib libidn2 gmp libiconv ]
+  buildInputs = [ gnutls readline zlib libidn2 gmp libiconv libunistring ]
     ++ stdenv.lib.optional stdenv.isDarwin gettext;
 
   hardeningDisable = stdenv.lib.optional stdenv.isDarwin "format";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 78870b391a0..f3b5cb57292 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -5157,6 +5157,8 @@ with pkgs;
 
   xwinmosaic = callPackage ../tools/X11/xwinmosaic {};
 
+  xwinwrap = callPackage ../tools/X11/xwinwrap {};
+
   yaft = callPackage ../applications/misc/yaft { };
 
   yarn = callPackage ../development/tools/yarn  { };
@@ -9906,17 +9908,9 @@ with pkgs;
 
   openbabel = callPackage ../development/libraries/openbabel { };
 
-  opencascade = callPackage ../development/libraries/opencascade {
-    tcl = tcl-8_5;
-    tk = tk-8_5;
-  };
+  opencascade = callPackage ../development/libraries/opencascade { };
 
-  opencascade_6_5 = callPackage ../development/libraries/opencascade/6.5.nix {
-    automake = automake111x;
-    ftgl = ftgl212;
-  };
-
-  opencascade_oce = callPackage ../development/libraries/opencascade/oce.nix { };
+  opencascade_oce = opencascade;
 
   opencl-headers = callPackage ../development/libraries/opencl-headers { };
 
@@ -11123,6 +11117,10 @@ with pkgs;
     go = go_1_8;
   };
 
+  buildGo19Package = callPackage ../development/go-modules/generic {
+    go = go_1_9;
+  };
+
   buildGoPackage = buildGo18Package;
 
   go2nix = callPackage ../development/tools/go2nix { };
@@ -11684,7 +11682,7 @@ with pkgs;
     libmemcached = null; # Detection is broken upstream
   };
 
-  postgresql = postgresql95;
+  postgresql = postgresql96;
 
   inherit (callPackages ../servers/sql/postgresql { })
     postgresql93
@@ -14546,7 +14544,6 @@ with pkgs;
 
   freecad = callPackage ../applications/graphics/freecad {
     boost = boost155;
-    opencascade = opencascade_oce;
   };
 
   freemind = callPackage ../applications/misc/freemind { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 70c334dda0b..27d41c059ad 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -7156,6 +7156,8 @@ in {
 
   pycassa = callPackage ../development/python-modules/pycassa { };
 
+  pyblake2 = callPackage ../development/python-modules/pyblake2 { };
+
   pybluez = buildPythonPackage rec {
     version = "unstable-20160819";
     pname = "pybluez";
@@ -18428,26 +18430,8 @@ in {
 
   requests_oauthlib = callPackage ../development/python-modules/requests-oauthlib.nix { };
 
-  requests_toolbelt = buildPythonPackage rec {
-    version = "0.7.1";
-    name = "requests-toolbelt-${version}";
-
-    src = pkgs.fetchurl {
-      url = "https://github.com/sigmavirus24/requests-toolbelt/archive/${version}.tar.gz";
-      sha256 = "16grklnbgcfwqj3f39gw7fc9afi7xlp9gm7x8w6mi81dzhdxf50y";
-    };
-
-    propagatedBuildInputs = with self; [ requests ];
-
-    buildInputs = with self; [ betamax mock pytest ];
-
-    meta = {
-      description = "A toolbelt of useful classes and functions to be used with python-requests";
-      homepage = http://toolbelt.rtfd.org;
-      maintainers = with maintainers; [ matthiasbeyer jgeerds ];
-    };
-
-  };
+  requests-toolbelt = callPackage ../development/python-modules/requests-toolbelt { };
+  requests_toolbelt = self.requests-toolbelt; # Old attr, 2017-09-26
 
   retry_decorator = buildPythonPackage rec {
     name = "retry_decorator-1.0.0";
@@ -21944,27 +21928,7 @@ in {
     };
   };
 
-  twine = buildPythonPackage rec {
-    name = "twine-${version}";
-    version = "1.8.1";
-
-    src = pkgs.fetchurl {
-      url    = "mirror://pypi/t/twine/${name}.tar.gz";
-      sha256 = "68b663691a947b844f92853c992d42bb68b6333bffc9ab7f661346b001c1da82";
-    };
-
-    propagatedBuildInputs = with self; [ clint pkginfo requests requests_toolbelt ];
-
-    # Requires network
-    doCheck = false;
-
-    meta = {
-      description = "Collection of utilities for interacting with PyPI";
-      homepage = https://github.com/pypa/twine;
-      license = licenses.asl20;
-      maintainer = with maintainers; [ fridh ];
-    };
-  };
+  twine = callPackage ../development/python-modules/twine { };
 
   twisted = callPackage ../development/python-modules/twisted { };