Merge remote-tracking branch 'upstream/master' into hardened-stdenv

62 files changed, 626 insertions, 225 deletions

diff --git a/pkgs/applications/editors/nano/default.nix b/pkgs/applications/editors/nano/default.nix
index 9c8238244ff..61818561f74 100644
--- a/pkgs/applications/editors/nano/default.nix
+++ b/pkgs/applications/editors/nano/default.nix
@@ -1,5 +1,6 @@
 { stdenv, fetchurl
 , ncurses
+, texinfo
 , gettext ? null
 , enableNls ? true
 , enableTiny ? false
@@ -16,7 +17,8 @@ stdenv.mkDerivation rec {
     url = "mirror://gnu/nano/${name}.tar.gz";
     sha256 = "1vl9bim56k1b4zwc3icxp46w6pn6gb042j1h4jlz1jklxxpkwcpz";
   };
-  buildInputs = [ ncurses ] ++ optional enableNls gettext;
+  buildInputs = [ ncurses texinfo ] ++ optional enableNls gettext;
+  outputs = [ "out" "info" ];
   configureFlags = ''
     --sysconfdir=/etc
     ${optionalString (!enableNls) "--disable-nls"}
diff --git a/pkgs/applications/graphics/simple-scan/default.nix b/pkgs/applications/graphics/simple-scan/default.nix
index 658df21a654..7ee298f7281 100644
--- a/pkgs/applications/graphics/simple-scan/default.nix
+++ b/pkgs/applications/graphics/simple-scan/default.nix
@@ -3,10 +3,10 @@
 
 stdenv.mkDerivation rec {
   name = "simple-scan-${version}";
-  version = "3.19.90";
+  version = "3.19.91";
 
   src = fetchurl {
-    sha256 = "16s8855sqrn5iiirpqva0mys8abfpzk9xryrb6rpjbynvx2lanmd";
+    sha256 = "1c5glf5vxgld41w4jxfqcv17q76qnh43fawpv33hncgh8d283xkf";
     url = "https://launchpad.net/simple-scan/3.19/${version}/+download/${name}.tar.xz";
   };
 
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   configureFlags = [ "--disable-packagekit" ];
 
   preBuild = ''
-    # Clean up stale generated .c files still referencing packagekit headers:
+    # Clean up stale .c files referencing packagekit headers as of 3.19.91:
     make clean
   '';
 
diff --git a/pkgs/applications/inferno/default.nix b/pkgs/applications/inferno/default.nix
index a1c4bd912f2..3c970e40b48 100644
--- a/pkgs/applications/inferno/default.nix
+++ b/pkgs/applications/inferno/default.nix
@@ -1,55 +1,47 @@
-{ fetchurl, fetchhg, stdenv, xorg, gcc46, makeWrapper }:
+{ fetchurl, fetchhg, stdenv, xorg, makeWrapper }:
 
 stdenv.mkDerivation rec {
   # Inferno is a rolling release from a mercurial repository. For the verison number
   # of the package I'm using the mercurial commit number.
-  version = "645";
-  name = "inferno-${version}";
-
-  # The mercurial repository does not contain all the components needed for the
-  # runtime system. The 'base' package contains these. For this package I download
-  # the base, extract the elements required from that, and add them to the source
-  # pulled from the mercurial repository.
-  srcBase = fetchurl {
-    url = "http://www.vitanuova.com/dist/4e/inferno-20100120.tgz";
-    sha256 = "0msvy3iwl4n5k0ry0xiyysjkq0qsawmwn3hvg67hbi5y8g7f7l88";
-  };
+  rev = "785";
+  name = "inferno-${rev}";
+  host = "Linux";
+  objtype = "386";
 
   src = fetchhg {
-    url    = "https://inferno-os.googlecode.com/hg";
-    rev    = "7ab390b860ca";
-    sha256 = "09y0iclb3yy10gw1p0182sddg64xh60q2fx4ai7lxyfb65i76qbh";
+    url    = "https://bitbucket.org/inferno-os/inferno-os";
+    sha256 = "1b428ma9fi5skvfrxp91dr43a62kax89wmx7950ahc1cxyx90k7x";
   };
 
-  # Fails with gcc48 due to inferno triggering an optimisation issue with floating point.
-  buildInputs = [ gcc46 xorg.libX11 xorg.libXpm xorg.libXext xorg.xextproto makeWrapper ];
+  buildInputs = [ makeWrapper ] ++ (with xorg; [ libX11 libXpm libXext xextproto ]);
 
   infernoWrapper = ./inferno;
 
   configurePhase = ''
-    tar --strip-components=1 -xvf $srcBase inferno/fonts inferno/Mkdirs inferno/empties
-    sed -e 's@^ROOT=.*$@ROOT='"$out"'/share/inferno@g' -e 's@^OBJTYPE=.*$@OBJTYPE=386@g' -e 's@^SYSHOST=.*$@SYSHOST=Linux@g' -i mkconfig
-    mkdir prof
-    sh Mkdirs
+    sed -e 's@^ROOT=.*$@ROOT='"$out"'/share/inferno@g' \
+        -e 's@^OBJTYPE=.*$@OBJTYPE=${objtype}@g' \
+        -e 's@^SYSHOST=.*$@SYSHOST=${host}@g' \
+        -i mkconfig
+    # Get rid of an annoying warning
+    sed -e 's/_BSD_SOURCE/_DEFAULT_SOURCE/g' \
+        -i ${host}/${objtype}/include/lib9.h
   '';
 
   buildPhase = ''
-    export PATH=$PATH:$out/share/inferno/Linux/386/bin
     mkdir -p $out/share/inferno
     cp -r . $out/share/inferno
     ./makemk.sh
+    export PATH=$PATH:$out/share/inferno/Linux/386/bin
     mk nuke
     mk
   '';
 
   installPhase = ''
+    # Installs executables in $out/share/inferno/${host}/${objtype}/bin
     mk install
     mkdir -p $out/bin
-    makeWrapper $out/share/inferno/Linux/386/bin/emu $out/bin/emu \
-      --suffix LD_LIBRARY_PATH ':' "${gcc46.cc}/lib" \
-      --suffix PATH ':' "$out/share/inferno/Linux/386/bin"
+    # Install start-up script
     makeWrapper $infernoWrapper $out/bin/inferno \
-      --suffix LD_LIBRARY_PATH ':' "${gcc46.cc}/lib" \
       --suffix PATH ':' "$out/share/inferno/Linux/386/bin" \
       --set INFERNO_ROOT "$out/share/inferno"
   '';
@@ -60,7 +52,7 @@ stdenv.mkDerivation rec {
     description = "A compact distributed operating system for building cross-platform distributed systems";
     homepage = "http://inferno-os.org/";
     license = stdenv.lib.licenses.gpl2;
-    maintainers = [ "Chris Double <chris.double@double.co.nz>" ];
+    maintainers = with stdenv.lib.maintainers; [ doublec kovirobi ];
     platforms = with stdenv.lib.platforms; linux;
   };
 }
diff --git a/pkgs/applications/misc/calibre/default.nix b/pkgs/applications/misc/calibre/default.nix
index 5e1bebf900c..5d936421d9e 100644
--- a/pkgs/applications/misc/calibre/default.nix
+++ b/pkgs/applications/misc/calibre/default.nix
@@ -5,12 +5,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "2.51.0";
+  version = "2.52.0";
   name = "calibre-${version}";
 
   src = fetchurl {
     url = "http://download.calibre-ebook.com/${version}/${name}.tar.xz";
-    sha256 = "1rhpcxic4g2zyr5s3xn8dayyb45l9r8zyniaig8j7pl5kmsfjijn";
+    sha256 = "1la114vhkm73iv0rrzwws28ydiszl58q5y9d6aafn5sh16ph2aws";
   };
 
   inherit python;
diff --git a/pkgs/applications/misc/josm/default.nix b/pkgs/applications/misc/josm/default.nix
index 9bd7bbb4385..99e337baa1a 100644
--- a/pkgs/applications/misc/josm/default.nix
+++ b/pkgs/applications/misc/josm/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "josm-${version}";
-  version = "9329";
+  version = "9900";
 
   src = fetchurl {
     url = "https://josm.openstreetmap.de/download/josm-snapshot-${version}.jar";
-    sha256 = "084a3pizmz09abn2n7brhx6757bq9k3xq3jy8ip2ifbl2hcrw7pq";
+    sha256 = "1dsfamh2bsiz3xkhmh7g4jz6bbh25x22k3zgj1k0v0gj8k6yl7dy";
   };
 
   phases = [ "installPhase" ];
diff --git a/pkgs/applications/networking/browsers/chromium/default.nix b/pkgs/applications/networking/browsers/chromium/default.nix
index c0c5e485e59..f9ed1f31e54 100644
--- a/pkgs/applications/networking/browsers/chromium/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/default.nix
@@ -57,6 +57,9 @@ let
       "x-scheme-handler/unknown"
     ];
     categories = "Network;WebBrowser";
+    extraEntries = ''
+      StartupWMClass=chromium-browser
+    '';
   };
 
   suffix = if channel != "stable" then "-" + channel else "";
diff --git a/pkgs/applications/networking/dropbox/default.nix b/pkgs/applications/networking/dropbox/default.nix
index 8030ab313a8..a180e2a01ed 100644
--- a/pkgs/applications/networking/dropbox/default.nix
+++ b/pkgs/applications/networking/dropbox/default.nix
@@ -20,11 +20,11 @@
 
 let
   # NOTE: When updating, please also update in current stable, as older versions stop working
-  version = "3.12.6";
+  version = "3.14.7";
   sha256 =
     {
-      "x86_64-linux" = "16d0g9bygvaixv4r42p72z6a6wqhkf5qzb058lijih93zjr8zjlj";
-      "i686-linux" = "1pgqz6axzzyaahql01g0l80an39hd9j4dnq0vfavwvb2qkb27dph";
+      "x86_64-linux" = "1pwmghpr0kyca2biysyk90kk9k6ffv4i95vs5rq96vc0zbckws6n";
+      "i686-linux" = "08yqrxh09cfd80kbiq1f2sirx9s85acij4khpklvvwrnf2x1i1zm";
     }."${stdenv.system}" or (throw "system ${stdenv.system} not supported");
 
   arch =
diff --git a/pkgs/applications/networking/p2p/transmission/default.nix b/pkgs/applications/networking/p2p/transmission/default.nix
index e81ef7a4f9f..dbd23195a1c 100644
--- a/pkgs/applications/networking/p2p/transmission/default.nix
+++ b/pkgs/applications/networking/p2p/transmission/default.nix
@@ -4,7 +4,7 @@
 }:
 
 let
-  version = "2.84";
+  version = "2.90";
 in
 
 with { inherit (stdenv.lib) optional optionals optionalString; };
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://transmission.cachefly.net/transmission-${version}.tar.xz";
-    sha256 = "1sxr1magqb5s26yvr5yhs1f7bmir8gl09niafg64lhgfnhv1kz59";
+    sha256 = "1lig7y9fhmv2ajgq1isj9wqgpcgignzlczs3dy95ahb8h6pqrzv9";
   };
 
   buildInputs = [ pkgconfig intltool file openssl curl libevent inotify-tools zlib ]
diff --git a/pkgs/applications/office/cb2bib/default.nix b/pkgs/applications/office/cb2bib/default.nix
new file mode 100644
index 00000000000..aa246d241ca
--- /dev/null
+++ b/pkgs/applications/office/cb2bib/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, fetchurl, qt5Full, lzo, libX11 }:
+
+stdenv.mkDerivation rec {
+  name = pname + "-" + version;
+  pname = "cb2bib";
+  version = "1.9.2";
+  src = fetchurl {
+    url = "http://www.molspaces.com/dl/progs/${name}.tar.gz";
+    sha256 = "0yz79v023w1229wzck3gij0iqah1xg8rg4a352q8idvg7bdmyfin";
+  };
+  buildInputs = [ qt5Full lzo libX11 ];
+  QTDIR=qt5Full;
+  configurePhase =''
+    ./configure --prefix $out
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Rapidly extract unformatted, or unstandardized bibliographic references from email alerts, journal Web pages and PDF files";
+    homepage = http://www.molspaces.com/d_cb2bib-overview.php;
+    maintainers = with maintainers; [ edwtjo ];
+    license = licenses.gpl3;
+  };
+
+}
\ No newline at end of file
diff --git a/pkgs/applications/office/zotero/default.nix b/pkgs/applications/office/zotero/default.nix
index d74e1ac4b7c..5939478d695 100644
--- a/pkgs/applications/office/zotero/default.nix
+++ b/pkgs/applications/office/zotero/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, bash, firefox, perl, unzipNLS, xorg }:
+{ stdenv, fetchurl, fetchpatch, bash, firefox, perl, unzipNLS, xorg }:
 
 let
 
@@ -7,6 +7,14 @@ let
     sha256 = "02h2ja08v8as4fawj683rh5rmxsjf5d0qmvqa77i176nm20y5s7s";
   };
 
+  firefox' = stdenv.lib.overrideDerivation (firefox) (attrs: {
+    patches = [ (fetchpatch {
+      url = "https://hg.mozilla.org/releases/mozilla-beta/raw-rev/0558da46f20c";
+      sha256 = "08ibp7hny78x8ywfvrh56z90kf8fjpf04mibdlrwkw4f1vgm3fc3";
+      name = "fix-external-xpi-loader";
+    }) ];
+  });
+
   version = "4.0.28";
 
 in
@@ -21,7 +29,9 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ perl unzipNLS ];
 
-  inherit bash firefox;
+  inherit bash;
+
+  firefox = firefox';
 
   phases = "unpackPhase installPhase fixupPhase";
 
diff --git a/pkgs/applications/science/logic/eprover/default.nix b/pkgs/applications/science/logic/eprover/default.nix
index 97fe7065b85..1f36858ae32 100644
--- a/pkgs/applications/science/logic/eprover/default.nix
+++ b/pkgs/applications/science/logic/eprover/default.nix
@@ -20,7 +20,11 @@ stdenv.mkDerivation {
 
   buildInputs = [ which ];
 
-  preConfigure = "sed -e 's@^EXECPATH\\s.*@EXECPATH = '\$out'/bin@' -i Makefile.vars";
+  preConfigure = ''
+    sed -e 's@^EXECPATH\\s.*@EXECPATH = '\$out'/bin@' \
+    -e 's/^CC *= gcc$//' \
+    -i Makefile.vars
+  '';
 
   buildPhase = "make install";
 
@@ -34,6 +38,8 @@ stdenv.mkDerivation {
   meta = {
     inherit (s) version;
     description = "Automated theorem prover for full first-order logic with equality";
+    homepage = http://www.eprover.org/;
+    license = stdenv.lib.licenses.gpl2;
     maintainers = [stdenv.lib.maintainers.raskin];
     platforms = stdenv.lib.platforms.all;
   };
diff --git a/pkgs/applications/version-management/redmine/Gemfile.lock b/pkgs/applications/version-management/redmine/Gemfile.lock
index 7d83583c019..c660e73f4a0 100644
--- a/pkgs/applications/version-management/redmine/Gemfile.lock
+++ b/pkgs/applications/version-management/redmine/Gemfile.lock
@@ -50,7 +50,7 @@ GEM
     jquery-rails (2.0.3)
       railties (>= 3.1.0, < 5.0)
       thor (~> 0.14)
-    json (1.8.1)
+    json (1.8.3)
     mail (2.5.4)
       mime-types (~> 1.16)
       treetop (~> 1.4.8)
diff --git a/pkgs/applications/version-management/redmine/Gemfile.nix b/pkgs/applications/version-management/redmine/Gemfile.nix
index a7339097b14..77adfba334e 100644
--- a/pkgs/applications/version-management/redmine/Gemfile.nix
+++ b/pkgs/applications/version-management/redmine/Gemfile.nix
@@ -115,9 +115,9 @@ version = "2.0.3";
 }
 {
 name = "json";
-hash = "961bfbbfa9fda1e857e9c791e964e6664e0d43bf687b19669dfbc7cdbc5e0200";
-url = "http://rubygems.org/downloads/json-1.8.1.gem";
-version = "1.8.1";
+hash = "1nsby6ry8l9xg3yw4adlhk2pnc7i0h0rznvcss4vk3v74qg0k8lc";
+url = "http://rubygems.org/downloads/json-1.8.3.gem";
+version = "1.8.3";
 }
 {
 name = "mail";
diff --git a/pkgs/applications/video/kodi/default.nix b/pkgs/applications/video/kodi/default.nix
index 5761a443df8..c2b3914f850 100644
--- a/pkgs/applications/video/kodi/default.nix
+++ b/pkgs/applications/video/kodi/default.nix
@@ -7,7 +7,7 @@
 , libXt, libXmu, libXext, xextproto
 , libXinerama, libXrandr, randrproto
 , libXtst, libXfixes, fixesproto, systemd
-, SDL, SDL_image, SDL_mixer, alsaLib
+, SDL, SDL2, SDL_image, SDL_mixer, alsaLib
 , mesa, glew, fontconfig, freetype, ftgl
 , libjpeg, jasper, libpng, libtiff
 , libmpeg2, libsamplerate, libmad
@@ -26,6 +26,7 @@
 , rtmpdump ? null, rtmpSupport ? true
 , libvdpau ? null, vdpauSupport ? true
 , libpulseaudio ? null, pulseSupport ? true
+, joystickSupport ? true
 }:
 
 assert dbusSupport  -> dbus_libs != null;
@@ -78,7 +79,9 @@ in stdenv.mkDerivation rec {
     ++ lib.optional sambaSupport samba
     ++ lib.optional vdpauSupport libvdpau
     ++ lib.optional pulseSupport libpulseaudio
-    ++ lib.optional rtmpSupport rtmpdump;
+    ++ lib.optional rtmpSupport rtmpdump
+    ++ lib.optional joystickSupport SDL2;
+
 
     dontUseCmakeConfigure = true;
 
@@ -98,7 +101,8 @@ in stdenv.mkDerivation rec {
     ++ lib.optional (!sambaSupport) "--disable-samba"
     ++ lib.optional vdpauSupport "--enable-vdpau"
     ++ lib.optional pulseSupport "--enable-pulse"
-    ++ lib.optional rtmpSupport "--enable-rtmp";
+    ++ lib.optional rtmpSupport "--enable-rtmp"
+    ++ lib.optional joystickSupport "--enable-joystick";
 
     postInstall = ''
       for p in $(ls $out/bin/) ; do
@@ -113,7 +117,8 @@ in stdenv.mkDerivation rec {
           --prefix LD_LIBRARY_PATH ":" "${libcec}/lib" \
           --prefix LD_LIBRARY_PATH ":" "${libcec_platform}/lib" \
           --prefix LD_LIBRARY_PATH ":" "${libass}/lib" \
-          --prefix LD_LIBRARY_PATH ":" "${rtmpdump}/lib"
+          --prefix LD_LIBRARY_PATH ":" "${rtmpdump}/lib" \
+          --prefix LD_LIBRARY_PATH ":" "${SDL2}/lib"
       done
     '';
 
diff --git a/pkgs/applications/video/kodi/plugins.nix b/pkgs/applications/video/kodi/plugins.nix
index 34b454ddcdd..96c47a15ef1 100644
--- a/pkgs/applications/video/kodi/plugins.nix
+++ b/pkgs/applications/video/kodi/plugins.nix
@@ -215,13 +215,13 @@ in
   pvr-hts = (mkKodiPlugin rec {
     plugin = "pvr-hts";
     namespace = "pvr.hts";
-    version = "2.1.18";
+    version = "2.2.13";
 
     src = fetchFromGitHub {
       owner = "kodi-pvr";
       repo = "pvr.hts";
-      rev = "016b0b3251d6d5bffaf68baf59010e4347759c4a";
-      sha256 = "03lhxipz03r516pycabqc9b89kd7wih3c2dr4p602bk64bsmpi0j";
+      rev = "3274354511e970e2101c2aa437001b2f245f80da";
+      sha256 = "0i7cb61pjv6vbj3x96cm1n4w91mvc8z6lxa8ykjasrrbi95ph7ld";
     };
 
     meta = with stdenv.lib; {
diff --git a/pkgs/applications/virtualization/virtualbox/default.nix b/pkgs/applications/virtualization/virtualbox/default.nix
index 855694e0412..c0fd8214b31 100644
--- a/pkgs/applications/virtualization/virtualbox/default.nix
+++ b/pkgs/applications/virtualization/virtualbox/default.nix
@@ -18,7 +18,7 @@ let
   # revision/hash as well. See
   # http://download.virtualbox.org/virtualbox/${version}/SHA256SUMS
   # for hashes.
-  version = "5.0.12";
+  version = "5.0.14";
 
   forEachModule = action: ''
     for mod in \
@@ -39,12 +39,12 @@ let
   '';
 
   # See https://github.com/NixOS/nixpkgs/issues/672 for details
-  extpackRevision = "104815";
+  extpackRevision = "105127";
   extensionPack = requireFile rec {
     name = "Oracle_VM_VirtualBox_Extension_Pack-${version}-${extpackRevision}.vbox-extpack";
     # IMPORTANT: Hash must be base16 encoded because it's used as an input to
     # VBoxExtPackHelperApp!
-    sha256 = "ac1bc8452b7fdf183325272149e9f18b9810cc07adf18e48755385a9cd1b236d";
+    sha256 = "4a404b0d09dfd3952107e314ab63262293b2fb0a4dc6837b57fb7274bd016865";
     message = ''
       In order to use the extension pack, you need to comply with the VirtualBox Personal Use
       and Evaluation License (PUEL) by downloading the related binaries from:
@@ -63,7 +63,7 @@ in stdenv.mkDerivation {
 
   src = fetchurl {
     url = "http://download.virtualbox.org/virtualbox/${version}/VirtualBox-${version}.tar.bz2";
-    sha256 = "de0362b1d404d1ca0298db1984acb6f0f1c6210313aeb744fea345ad9201e86e";
+    sha256 = "69abac7255b2251a18fd73c0b7c200d5f8ce72a59fa019b53a5cdbf7f2843002";
   };
 
   buildInputs =
diff --git a/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix b/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix
index 0ef00550ee4..d579a6445d1 100644
--- a/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix
+++ b/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "http://download.virtualbox.org/virtualbox/${version}/VBoxGuestAdditions_${version}.iso";
-    sha256 = "61a19c9ec4b449cbc6bb41b636b03a16bf5a47ffa4943423d262863017e8bc9b";
+    sha256 = "cec0df18671adfe62a34d3810543f76f76206b212b2b61791fe026214c77507c";
   };
 
   KERN_DIR = "${kernel.dev}/lib/modules/*/build";
diff --git a/pkgs/build-support/build-maven.nix b/pkgs/build-support/build-maven.nix
index ff91828eeca..ba85428ba8c 100644
--- a/pkgs/build-support/build-maven.nix
+++ b/pkgs/build-support/build-maven.nix
@@ -11,7 +11,7 @@
  *        the project.
  */
 infoFile: let
-  info = builtins.fromJSON (builtins.readFile infoFile);
+  info = lib.importJSON infoFile;
 
   script = writeText "build-maven-repository.sh" ''
     ${lib.concatStrings (map (dep: let
diff --git a/pkgs/build-support/fetchgit/nix-prefetch-git b/pkgs/build-support/fetchgit/nix-prefetch-git
index 22a241d5e0e..2c9d61504ed 100755
--- a/pkgs/build-support/fetchgit/nix-prefetch-git
+++ b/pkgs/build-support/fetchgit/nix-prefetch-git
@@ -325,9 +325,9 @@ print_results() {
     fi
     if test -n "$hash"; then
         echo "{"
-        echo "  url = \"$url\";"
-        echo "  rev = \"$fullRev\";"
-        echo "  $hashType = \"$hash\";"
+        echo "  \"url\": \"$url\","
+        echo "  \"rev\": \"$fullRev\","
+        echo "  \"$hashType\": \"$hash\""
         echo "}"
     fi
 }
diff --git a/pkgs/build-support/make-desktopitem/default.nix b/pkgs/build-support/make-desktopitem/default.nix
index 2f6c827d875..f5b4e5af93a 100644
--- a/pkgs/build-support/make-desktopitem/default.nix
+++ b/pkgs/build-support/make-desktopitem/default.nix
@@ -10,6 +10,7 @@
 , mimeType ? ""
 , categories ? "Application;Other;"
 , startupNotify ? null
+, extraEntries ? ""
 }:
 
 stdenv.mkDerivation {
@@ -27,6 +28,7 @@ stdenv.mkDerivation {
     GenericName=${genericName}
     MimeType=${mimeType}
     Categories=${categories}
+    ${extraEntries}
     ${if startupNotify == null then ''EOF'' else ''
     StartupNotify=${startupNotify}
     EOF''}
diff --git a/pkgs/build-support/trivial-builders.nix b/pkgs/build-support/trivial-builders.nix
index 6cd82adf8e7..93b8b1cbc42 100644
--- a/pkgs/build-support/trivial-builders.nix
+++ b/pkgs/build-support/trivial-builders.nix
@@ -157,6 +157,9 @@ rec {
       '';
 
   # Copy a path to the Nix store.
+  # Nix automatically copies files to the store before stringifying paths.
+  # If you need the store path of a file, ${copyPathToStore <path>} can be
+  # shortened to ${<path>}.
   copyPathToStore = builtins.filterSource (p: t: true);
 
   # Copy a list of paths to the Nix store.
diff --git a/pkgs/build-support/vm/rpm/rpm-closure.pl b/pkgs/build-support/vm/rpm/rpm-closure.pl
index 8f7669d6fef..6442cd91a95 100644
--- a/pkgs/build-support/vm/rpm/rpm-closure.pl
+++ b/pkgs/build-support/vm/rpm/rpm-closure.pl
@@ -90,7 +90,7 @@ for (my $i = 0; $i < scalar(@packagesFiles); $i++) {
 }
 
 my %provides;
-PKG: foreach my $pkgName (keys %pkgs) {
+PKG: foreach my $pkgName (sort(keys %pkgs)) {
     #print STDERR "looking at $pkgName\n";
     my $pkg = $pkgs{$pkgName};
 
diff --git a/pkgs/data/misc/geolite-legacy/default.nix b/pkgs/data/misc/geolite-legacy/default.nix
index 59ae72d863c..c9b6eb8917f 100644
--- a/pkgs/data/misc/geolite-legacy/default.nix
+++ b/pkgs/data/misc/geolite-legacy/default.nix
@@ -8,7 +8,7 @@ let
 in
 stdenv.mkDerivation rec {
   name = "geolite-legacy-${version}";
-  version = "2016-02-25";
+  version = "2016-02-29";
 
   srcGeoIP = fetchDB
     "GeoLiteCountry/GeoIP.dat.gz" "GeoIP.dat.gz"
@@ -24,10 +24,10 @@ stdenv.mkDerivation rec {
     "0fnlznn04lpkkd7sy9r9kdl3fcp8ix7msdrncwgz26dh537ml32z";
   srcGeoIPASNum = fetchDB
     "asnum/GeoIPASNum.dat.gz" "GeoIPASNum.dat.gz"
-    "0gli3glr2w58qw2b4lwlp8cqbpfy27c3ryih3qi2bbilqy0r3ibl";
+    "10i4c8irvh9shbl3y0s0ffkm71vf3r290fvxjx20snqa558hkvib";
   srcGeoIPASNumv6 = fetchDB
     "asnum/GeoIPASNumv6.dat.gz" "GeoIPASNumv6.dat.gz"
-    "1k7a9b8hsman64jjk6y3nkhms89gkq1vk26n2xklw710f15jzcsf";
+    "1rvbjrj98pqj9w5ql5j49b3h40496g6aralpnz1gj21v6dfrd55n";
 
   meta = with stdenv.lib; {
     description = "GeoLite Legacy IP geolocation databases";
diff --git a/pkgs/desktops/gnome-3/3.18/core/gnome-shell/default.nix b/pkgs/desktops/gnome-3/3.18/core/gnome-shell/default.nix
index 899efc5443b..11d78cd6132 100644
--- a/pkgs/desktops/gnome-3/3.18/core/gnome-shell/default.nix
+++ b/pkgs/desktops/gnome-3/3.18/core/gnome-shell/default.nix
@@ -37,7 +37,8 @@ stdenv.mkDerivation rec {
       --prefix PATH : "${unzip}/bin" \
       --prefix GI_TYPELIB_PATH : "$GI_TYPELIB_PATH" \
       --set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE" \
-      --suffix XDG_DATA_DIRS : "${gnome_themes_standard}/share:$out/share:$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH"
+      --prefix XDG_DATA_DIRS : "${gnome_themes_standard}/share:$out/share:$XDG_ICON_DIRS" \
+      --suffix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH"
 
     wrapProgram "$out/libexec/gnome-shell-calendar-server" \
       --prefix XDG_DATA_DIRS : "${evolution_data_server}/share:$out/share:$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH"
diff --git a/pkgs/desktops/gnome-3/3.18/core/nautilus/default.nix b/pkgs/desktops/gnome-3/3.18/core/nautilus/default.nix
index f28e86d7bad..ff9f847d3cd 100644
--- a/pkgs/desktops/gnome-3/3.18/core/nautilus/default.nix
+++ b/pkgs/desktops/gnome-3/3.18/core/nautilus/default.nix
@@ -13,7 +13,8 @@ stdenv.mkDerivation rec {
     wrapProgram "$out/bin/nautilus" \
       --prefix GI_TYPELIB_PATH : "$GI_TYPELIB_PATH" \
       --set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE" \
-      --prefix XDG_DATA_DIRS : "$XDG_ICON_DIRS:$out/share:$GSETTINGS_SCHEMAS_PATH"
+      --prefix XDG_DATA_DIRS : "$XDG_ICON_DIRS:$out/share" \
+      --suffix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH"
   '';
 
   patches = [ ./extension_dir.patch ];
diff --git a/pkgs/desktops/gnome-3/3.18/default.nix b/pkgs/desktops/gnome-3/3.18/default.nix
index f949eb1b208..de8b6a5e0dc 100644
--- a/pkgs/desktops/gnome-3/3.18/default.nix
+++ b/pkgs/desktops/gnome-3/3.18/default.nix
@@ -65,6 +65,9 @@ let
 # Simplify the nixos module and gnome packages
   defaultIconTheme = adwaita-icon-theme;
 
+# ISO installer
+# installerIso = callPackage ./installer.nix {};
+
 #### Core (http://ftp.acc.umu.se/pub/GNOME/core/)
 
   adwaita-icon-theme = callPackage ./core/adwaita-icon-theme { };
@@ -309,9 +312,7 @@ let
 
   anjuta = callPackage ./devtools/anjuta { };
 
-  devhelp = callPackage ./devtools/devhelp {
-    webkitgtk = webkitgtk24x;
-  };
+  devhelp = callPackage ./devtools/devhelp { };
 
   gdl = callPackage ./devtools/gdl { };
 
diff --git a/pkgs/desktops/gnome-3/3.18/installer.nix b/pkgs/desktops/gnome-3/3.18/installer.nix
new file mode 100644
index 00000000000..e4d64ac9e88
--- /dev/null
+++ b/pkgs/desktops/gnome-3/3.18/installer.nix
@@ -0,0 +1,15 @@
+{ isoBaseName ? "nixos-graphical-gnome", system ? builtins.currentSystem
+, extraModules ? [] }:
+    
+let
+
+  module = ../../../../nixos/modules/installer/cd-dvd/installation-cd-graphical-gnome.nix;
+
+  config = (import ../../../../nixos/lib/eval-config.nix {
+    inherit system;
+    modules = [ module { isoImage.isoBaseName = isoBaseName; } ] ++ extraModules;
+  }).config;
+
+in
+  config.system.build.isoImage
+
diff --git a/pkgs/development/compilers/ecl/default.nix b/pkgs/development/compilers/ecl/default.nix
index bd99335192b..2208d844049 100644
--- a/pkgs/development/compilers/ecl/default.nix
+++ b/pkgs/development/compilers/ecl/default.nix
@@ -1,35 +1,42 @@
 {stdenv, fetchurl
 , libtool, autoconf, automake
 , gmp, mpfr, libffi
-, noUnicode ? false,
+, noUnicode ? false, 
 }:
-
 let
-  baseName = "ecl";
-  version = "16.0.0";
+  s = # Generated upstream information
+  rec {
+    baseName="ecl";
+    version="16.1.2";
+    name="${baseName}-${version}";
+    hash="16ab8qs3awvdxy8xs8jy82v8r04x4wr70l9l2j45vgag18d2nj1d";
+    url="https://common-lisp.net/project/ecl/files/release/16.1.2/ecl-16.1.2.tgz";
+    sha256="16ab8qs3awvdxy8xs8jy82v8r04x4wr70l9l2j45vgag18d2nj1d";
+  };
+  buildInputs = [
+    libtool autoconf automake
+  ];
+  propagatedBuildInputs = [
+    libffi gmp mpfr
+  ];
 in
 stdenv.mkDerivation {
-  name = "${baseName}-${version}";
-  inherit version;
+  inherit (s) name version;
+  inherit buildInputs propagatedBuildInputs;
 
   src = fetchurl {
-    url = "https://common-lisp.net/project/ecl/files/ecl-16.0.0.tgz";
-    sha256 = "0czh78z9i5b7jc241mq1h1gdscvdw5fbhfb0g9sn4rchwk1x8gil";
+    inherit (s) url sha256;
   };
 
   configureFlags = [
     "--enable-threads"
     "--with-gmp-prefix=${gmp}"
     "--with-libffi-prefix=${libffi}"
-  ] ++ (stdenv.lib.optional (!noUnicode) "--enable-unicode");
-
-  buildInputs = [
-    libtool autoconf automake
-  ];
-
-  propagatedBuildInputs = [
-    libffi gmp mpfr
-  ];
+    ]
+    ++
+    (stdenv.lib.optional (! noUnicode)
+      "--enable-unicode")
+    ;
 
   hardening_format = false;
 
@@ -38,8 +45,9 @@ stdenv.mkDerivation {
   '';
 
   meta = {
+    inherit (s) version;
     description = "Lisp implementation aiming to be small, fast and easy to embed";
-    license = stdenv.lib.licenses.mit;
+    license = stdenv.lib.licenses.mit ;
     maintainers = [stdenv.lib.maintainers.raskin];
     platforms = stdenv.lib.platforms.linux;
   };
diff --git a/pkgs/development/compilers/sbcl/default.nix b/pkgs/development/compilers/sbcl/default.nix
index 3212601e789..82348f35e30 100644
--- a/pkgs/development/compilers/sbcl/default.nix
+++ b/pkgs/development/compilers/sbcl/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name    = "sbcl-${version}";
-  version = "1.3.2";
+  version = "1.3.3";
 
   src = fetchurl {
     url    = "mirror://sourceforge/project/sbcl/sbcl/${version}/${name}-source.tar.bz2";
-    sha256 = "18mgj1h9wqi0zq4k7y5r5fk10mlbpgh3796d3dac75bpxabg30nk";
+    sha256 = "0kzvwzz196ws9z20l8fm15m5gckhmkkc6lxvdib12mfvy80gcf6v";
   };
 
   patchPhase = ''
diff --git a/pkgs/development/haskell-modules/configuration-common.nix b/pkgs/development/haskell-modules/configuration-common.nix
index a307041e0c8..80047f0ca1e 100644
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@@ -327,7 +327,7 @@ self: super: {
   github-types = dontCheck super.github-types;          # http://hydra.cryp.to/build/1114046/nixlog/1/raw
   hadoop-rpc = dontCheck super.hadoop-rpc;              # http://hydra.cryp.to/build/527461/nixlog/2/raw
   hasql = dontCheck super.hasql;                        # http://hydra.cryp.to/build/502489/nixlog/4/raw
-  hjsonschema = overrideCabal (super.hjsonschema.override { hjsonpointer = pkgs.hjsonpointer_0_2_0_4; }) (drv: { testTarget = "local"; });
+  hjsonschema = overrideCabal (super.hjsonschema.override { hjsonpointer = self.hjsonpointer_0_2_0_4; }) (drv: { testTarget = "local"; });
   hoogle = overrideCabal super.hoogle (drv: { testTarget = "--test-option=--no-net"; });
   marmalade-upload = dontCheck super.marmalade-upload;  # http://hydra.cryp.to/build/501904/nixlog/1/raw
   network-transport-tcp = dontCheck super.network-transport-tcp;
diff --git a/pkgs/development/interpreters/bats/default.nix b/pkgs/development/interpreters/bats/default.nix
index 4eb86460be9..bf262d4f050 100644
--- a/pkgs/development/interpreters/bats/default.nix
+++ b/pkgs/development/interpreters/bats/default.nix
@@ -9,6 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "05xpvfm0xky1532i3hd2l3wznxzh99bv2hxgykwdpxh18h6jr6jm";
   };
 
+  patchPhase = "patchShebangs ./install.sh";
+
   installPhase = "./install.sh $out";
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/interpreters/ruby/rubygems.nix b/pkgs/development/interpreters/ruby/rubygems.nix
index fb210ceff4b..a08790a15ce 100644
--- a/pkgs/development/interpreters/ruby/rubygems.nix
+++ b/pkgs/development/interpreters/ruby/rubygems.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   name = "rubygems-${version}";
-  version = "2.4.8";
+  version = "2.5.2";
   src = fetchurl {
     url = "http://production.cf.rubygems.org/rubygems/${name}.tgz";
-    sha256 = "0pl4civyf0vhqsqbqaivvxrb3fsg8sid9a8jv5vfnk4hypz3ahss";
+    sha256 = "1jpcmvjfpj2m0jh23371ghfj95gh4jliihzrj5ln0x2cl1pwwwai";
   };
 
   patches = [ ./gem_hook.patch ];
diff --git a/pkgs/development/libraries/libfilezilla/default.nix b/pkgs/development/libraries/libfilezilla/default.nix
index 120b707af1e..d8e1c29875c 100644
--- a/pkgs/development/libraries/libfilezilla/default.nix
+++ b/pkgs/development/libraries/libfilezilla/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "libfilezilla-${version}";
-  version = "0.4.0";
+  version = "0.4.0.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/project/filezilla/libfilezilla/${version}/${name}.tar.bz2";
-    sha256 = "1l7rih17nzy75zf5h8mx5x38jbl9kxyxpr0ib6nn2615fw92xxgj";
+    sha256 = "1ldiyhjv4jg2jyj3d56mlgyj9lx0qkf1857wvsy51lp9aj96h0v0";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/libraries/pixman/default.nix b/pkgs/development/libraries/pixman/default.nix
index 681e54a781b..dc378711d36 100644
--- a/pkgs/development/libraries/pixman/default.nix
+++ b/pkgs/development/libraries/pixman/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
     sha256 = "184lazwdpv67zrlxxswpxrdap85wminh1gmq1i5lcz6iycw39fir";
   };
 
-  patches = stdenv.lib.optional stdenv.isDarwin ./fix-clang36.patch;
+  patches = [];
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = stdenv.lib.optional doCheck libpng;
diff --git a/pkgs/development/libraries/pixman/fix-clang36.patch b/pkgs/development/libraries/pixman/fix-clang36.patch
deleted file mode 100644
index 7db3c7ecaba..00000000000
--- a/pkgs/development/libraries/pixman/fix-clang36.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- a/pixman/pixman-mmx.c	2014-04-24 08:34:14.000000000 +0400
-+++ b/pixman/pixman-mmx.c	2015-01-30 20:19:28.000000000 +0300
-@@ -89,7 +89,7 @@
-     return __A;
- }
- 
--#  ifdef __OPTIMIZE__
-+#  if defined(__OPTIMIZE__) && !(defined (__clang__) && defined(__clang_major__) && defined(__clang_minor__) && __clang_major__ == 3 && __clang_minor__ >= 6)
- extern __inline __m64 __attribute__((__gnu_inline__, __always_inline__, __artificial__))
- _mm_shuffle_pi16 (__m64 __A, int8_t const __N)
- {
diff --git a/pkgs/development/ocaml-modules/ocaml-result/default.nix b/pkgs/development/ocaml-modules/ocaml-result/default.nix
new file mode 100644
index 00000000000..8b6e0966f7e
--- /dev/null
+++ b/pkgs/development/ocaml-modules/ocaml-result/default.nix
@@ -0,0 +1,30 @@
+{ stdenv, fetchFromGitHub, ocaml, findlib }:
+
+let version = "1.1"; in
+
+stdenv.mkDerivation {
+  name = "ocaml-result-${version}";
+
+  src = fetchFromGitHub {
+    owner = "janestreet";
+    repo = "result";
+    rev = "${version}";
+    sha256 = "05y07rxdbkaxsc8cy458y00gq05i8gp35hhwg1b757mam21ccxxz";
+  };
+
+  buildInputs = [ ocaml findlib ];
+
+  createFindlibDestdir = true;
+
+  meta = {
+    homepage = https://github.com/janestreet/result;
+    description = "Compatibility Result module";
+    longDescription = ''
+      Projects that want to use the new result type defined in OCaml >= 4.03
+      while staying compatible with older version of OCaml should use the
+      Result module defined in this library.
+    '';
+    license = stdenv.lib.licenses.bsd3;
+    platforms = ocaml.meta.platforms;
+  };
+}
diff --git a/pkgs/development/ocaml-modules/tsdl/default.nix b/pkgs/development/ocaml-modules/tsdl/default.nix
new file mode 100644
index 00000000000..85ea80aeafe
--- /dev/null
+++ b/pkgs/development/ocaml-modules/tsdl/default.nix
@@ -0,0 +1,49 @@
+{ stdenv, fetchurl, ocaml, findlib, ctypes, result, SDL2, pkgconfig, opam }:
+
+let
+  inherit (stdenv.lib) getVersion;
+
+  pname = "tsdl";
+  version = "0.9.0";
+  webpage = "http://erratique.ch/software/${pname}";
+
+in
+
+stdenv.mkDerivation {
+  name = "ocaml-${pname}-${version}";
+
+  src = fetchurl {
+    url = "${webpage}/releases/${pname}-${version}.tbz";
+    sha256 = "02x0wsy5nxagxrh07yb2h4yqqy1bxryp2gwrylds0j6ybqsv4shm";
+  };
+
+  buildInputs = [ ocaml findlib result pkgconfig opam ];
+  propagatedBuildInputs = [ SDL2 ctypes ];
+
+  createFindlibDestdir = true;
+
+  unpackCmd = "tar xjf $src";
+
+  buildPhase = ''
+    # The following is done to avoid an additional dependency (ncurses)
+    # due to linking in the custom bytecode runtime. Instead, just
+    # compile directly into a native binary, even if it's just a
+    # temporary build product.
+    substituteInPlace myocamlbuild.ml \
+      --replace ".byte" ".native"
+
+    ocaml pkg/build.ml native=true native-dynlink=true
+  '';
+
+  installPhase = ''
+    opam-installer --script --prefix=$out ${pname}.install | sh
+    ln -s $out/lib/${pname} $out/lib/ocaml/${getVersion ocaml}/site-lib/${pname}
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = "${webpage}";
+    description = "Thin bindings to the cross-platform SDL library";
+    license = licenses.bsd3;
+    platforms = ocaml.meta.platforms;
+  };
+}
diff --git a/pkgs/development/pharo/vm/build-vm.nix b/pkgs/development/pharo/vm/build-vm.nix
index d18f64c9aba..3dfe913145c 100644
--- a/pkgs/development/pharo/vm/build-vm.nix
+++ b/pkgs/development/pharo/vm/build-vm.nix
@@ -88,6 +88,10 @@ stdenv.mkDerivation rec {
     homepage = http://pharo.org;
     license = stdenv.lib.licenses.mit;
     maintainers = [ stdenv.lib.maintainers.DamienCassou ];
-    platforms = stdenv.lib.platforms.mesaPlatforms;
+    # Pharo VM sources are packaged separately for darwin (OS X)
+    platforms = with stdenv.lib;
+                  intersectLists
+                    platforms.mesaPlatforms
+                    (subtractLists platforms.darwin platforms.unix);
   };
 }
diff --git a/pkgs/development/tools/analysis/checkstyle/default.nix b/pkgs/development/tools/analysis/checkstyle/default.nix
index f9131cf2af2..168e9ce95be 100644
--- a/pkgs/development/tools/analysis/checkstyle/default.nix
+++ b/pkgs/development/tools/analysis/checkstyle/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  version = "6.15";
+  version = "6.16";
   name = "checkstyle-${version}";
 
   src = fetchurl {
     url = "mirror://sourceforge/checkstyle/${name}-bin.tar.gz";
-    sha256 = "1bazjgfr1mq6qfg4nmack467zg7s4z8v7zfzw46d2dk04mv8y9b8";
+    sha256 = "0kmddfzn7p6fads6crw4gnahvi36xwqyw35i7a2lplrdp8dn9xdd";
   };
 
   installPhase = ''
diff --git a/pkgs/development/tools/build-managers/gup/default.nix b/pkgs/development/tools/build-managers/gup/default.nix
index 0f1ecdcaa54..a907e6ace9e 100644
--- a/pkgs/development/tools/build-managers/gup/default.nix
+++ b/pkgs/development/tools/build-managers/gup/default.nix
@@ -1,10 +1,10 @@
 { stdenv, fetchgit, lib, python, which }:
 let
-  version = "0.5.3";
+  version = "0.5.4";
   src = fetchgit {
     url = "https://github.com/gfxmonk/gup.git";
-    rev = "55ffd8828ddc28a2a786b75422d672d6569f961f";
-    sha256 = "7c2abbf5d3814c6b84da0de1c91f9f7d299c2362cf091da96f6a68d8fffcb5ce";
+    rev = "b3980e529c860167b48e31634d2b479fc4d10274";
+    sha256 = "bb02ba0a7f1680ed5b9a8e8c9cc42aa07016329840f397d914b94744f9ed7c85";
   };
 in
 import ./build.nix
diff --git a/pkgs/development/tools/repository-managers/nexus/default.nix b/pkgs/development/tools/repository-managers/nexus/default.nix
new file mode 100644
index 00000000000..1b2f48b696c
--- /dev/null
+++ b/pkgs/development/tools/repository-managers/nexus/default.nix
@@ -0,0 +1,29 @@
+{ stdenv, fetchurl, makeWrapper, jre }:
+stdenv.mkDerivation rec {
+  name = "nexus-${version}";
+  version = "2.12.0-01";
+
+  src = fetchurl {
+    url = "https://sonatype-download.global.ssl.fastly.net/nexus/oss/nexus-${version}-bundle.tar.gz";
+    sha256 = "1k3z7kwcmr1pxaxfnak99fq5s8br9zbqbfpyw1afi86ykkph4g5z";
+  };
+
+  sourceRoot = name;
+
+  buildInputs = [ makeWrapper ];
+
+  installPhase = 
+    ''
+      mkdir -p $out
+      cp -rfv * $out
+      rm -fv $out/bin/nexus.bat
+    '';
+
+  meta = with stdenv.lib; {
+    description = "Repository manager for binary software components";
+    homepage = http://www.sonatype.org/nexus;
+    license = licenses.epl10;
+    platforms = platforms.all;
+    maintainers = [ maintainers.aespinosa ];
+  };
+}
diff --git a/pkgs/development/web/nodejs/v4.nix b/pkgs/development/web/nodejs/v4.nix
index 04dbd1b1a27..629864b6e0b 100644
--- a/pkgs/development/web/nodejs/v4.nix
+++ b/pkgs/development/web/nodejs/v4.nix
@@ -7,7 +7,7 @@
 assert stdenv.system != "armv5tel-linux";
 
 let
-  version = "4.3.0";
+  version = "4.3.1";
 
   deps = {
     inherit openssl zlib libuv;
@@ -31,7 +31,7 @@ in stdenv.mkDerivation {
 
   src = fetchurl {
     url = "http://nodejs.org/dist/v${version}/node-v${version}.tar.gz";
-    sha256 = "1f86jy71mi01g4xd411l5w8pi80nlk6sz7d2c0ghdk83v734ll0q";
+    sha256 = "0wzf5sirbph5kaik3pm9i2dxbjwqh5qlnqn71azrsv0vhs7dbqk1";
   };
 
   configureFlags = concatMap sharedConfigureFlags (builtins.attrNames deps) ++ [ "--without-dtrace" ];
diff --git a/pkgs/development/web/nodejs/v5.nix b/pkgs/development/web/nodejs/v5.nix
index 948c4d10b30..c5bc3311503 100644
--- a/pkgs/development/web/nodejs/v5.nix
+++ b/pkgs/development/web/nodejs/v5.nix
@@ -7,7 +7,7 @@
 assert stdenv.system != "armv5tel-linux";
 
 let
-  version = "5.6.0";
+  version = "5.7.0";
 
   deps = {
     inherit openssl zlib libuv;
@@ -31,7 +31,7 @@ in stdenv.mkDerivation {
 
   src = fetchurl {
     url = "http://nodejs.org/dist/v${version}/node-v${version}.tar.gz";
-    sha256 = "0zy2pq2xpw170lycs0518jjldy1d5vm5y1pjb4zcibvhb5gcrwis";
+    sha256 = "1n6jvvf3jfmv7fjd64c5jajjapsmc8gr6rlw113vgys55xmb8f13";
   };
 
   configureFlags = concatMap sharedConfigureFlags (builtins.attrNames deps) ++ [ "--without-dtrace" ];
diff --git a/pkgs/games/nethack/default.nix b/pkgs/games/nethack/default.nix
index 05c39fb2f2b..ce12196d3c3 100644
--- a/pkgs/games/nethack/default.nix
+++ b/pkgs/games/nethack/default.nix
@@ -6,6 +6,7 @@ let
     else abort "Unknown platform for NetHack";
   unixHint =
     if stdenv.isLinux then "linux"
+    else if stdenv.isDarwin then "macosx10.10"
     # We probably want something different for Darwin
     else "unix";
   userDir = "~/.config/nethack";
@@ -24,25 +25,30 @@ in stdenv.mkDerivation {
 
   makeFlags = [ "PREFIX=$(out)" ];
 
+  patchPhase = ''
+    sed -e '/^ *cd /d' -i sys/unix/nethack.sh
+    sed \
+      -e 's/^YACC *=.*/YACC = bison -y/' \
+      -e 's/^LEX *=.*/LEX = flex/' \
+      -i sys/unix/Makefile.utl
+    sed \
+      -e 's,/bin/gzip,${gzip}/bin/gzip,g' \
+      -e 's,^WINTTYLIB=.*,WINTTYLIB=-lncurses,' \
+      -i sys/unix/hints/linux
+    sed \
+      -e 's,^CC=.*$,CC=cc,' \
+      -e 's,^HACKDIR=.*$,HACKDIR=\$(PREFIX)/games/lib/\$(GAME)dir,' \
+      -e 's,^SHELLDIR=.*$,SHELLDIR=\$(PREFIX)/games,' \
+      -i sys/unix/hints/macosx10.10
+    sed -e '/define CHDIR/d' -i include/config.h
+  '';
+
   configurePhase = ''
     cd sys/${platform}
     ${lib.optionalString (platform == "unix") ''
-      sed -e '/^ *cd /d' -i nethack.sh
-      ${lib.optionalString (unixHint == "linux") ''
-        sed \
-          -e 's,/bin/gzip,${gzip}/bin/gzip,g' \
-          -e 's,^WINTTYLIB=.*,WINTTYLIB=-lncurses,' \
-          -i hints/linux
-      ''}
       sh setup.sh hints/${unixHint}
     ''}
     cd ../..
-
-    sed -e '/define CHDIR/d' -i include/config.h
-    sed \
-      -e 's/^YACC *=.*/YACC = bison -y/' \
-      -e 's/^LEX *=.*/LEX = flex/' \
-      -i util/Makefile
   '';
 
   postInstall = ''
@@ -61,7 +67,7 @@ in stdenv.mkDerivation {
       chmod -R +w ${userDir}
     fi
 
-    RUNDIR=\$(mktemp -td nethack.\$USER.XXXXX)
+    RUNDIR=\$(mktemp -d)
 
     cleanup() {
       rm -rf \$RUNDIR
diff --git a/pkgs/games/openspades/default.nix b/pkgs/games/openspades/default.nix
index df987b3f856..475a844c1ab 100644
--- a/pkgs/games/openspades/default.nix
+++ b/pkgs/games/openspades/default.nix
@@ -12,6 +12,13 @@ stdenv.mkDerivation rec {
     sha256 = "1aa848cck8qrp67ha9vrkzm3k24r2aiv1v4dxla6pi22rw98yxzm";
   };
 
+  # https://github.com/yvt/openspades/issues/354
+  postPatch = ''
+    substituteInPlace Sources/Client/Client_Input.cpp --replace "isnan(" "std::isnan("
+    substituteInPlace Sources/Client/Corpse.cpp --replace "isnan(" "std::isnan("
+    substituteInPlace Sources/Draw/SWMapRenderer.cpp --replace "isnan(" "std::isnan(" --replace "isinf(" "std::isinf("
+  '';
+
   nativeBuildInputs = 
     with stdenv.lib;
     [ cmake curl glew makeWrapper mesa SDL2 SDL2_image unzip wget zlib ]
diff --git a/pkgs/os-specific/linux/open-iscsi/default.nix b/pkgs/os-specific/linux/open-iscsi/default.nix
index e6682aec6c6..d004328a10b 100644
--- a/pkgs/os-specific/linux/open-iscsi/default.nix
+++ b/pkgs/os-specific/linux/open-iscsi/default.nix
@@ -2,13 +2,16 @@
 let
   pname = "open-iscsi-2.0-873";
 in stdenv.mkDerivation {
-  name = "${pname}";
+  name = pname;
   outputs = [ "out" "iscsistart" ];
 
   buildInputs = [ nukeReferences ];
   
   src = fetchurl {
-    url = "http://www.open-iscsi.org/bits/${pname}.tar.gz";
+    urls = [
+      "http://www.open-iscsi.org/bits/${pname}.tar.gz"
+      "http://pkgs.fedoraproject.org/repo/pkgs/iscsi-initiator-utils/${pname}.tar.gz/8b8316d7c9469149a6cc6234478347f7/${pname}.tar.gz"
+    ];
     sha256 = "1nbwmj48xzy45h52917jbvyqpsfg9zm49nm8941mc5x4gpwz5nbx";
   };
   
@@ -24,9 +27,10 @@ in stdenv.mkDerivation {
     nuke-refs $iscsistart/bin/iscsistart
   '';
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "A high performance, transport independent, multi-platform implementation of RFC3720";
-    license = stdenv.lib.licenses.gpl2Plus;
+    license = licenses.gpl2Plus;
     homepage = http://www.open-iscsi.org;
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/servers/nosql/rethinkdb/default.nix b/pkgs/servers/nosql/rethinkdb/default.nix
index 4566a670206..f1b57546c7d 100644
--- a/pkgs/servers/nosql/rethinkdb/default.nix
+++ b/pkgs/servers/nosql/rethinkdb/default.nix
@@ -11,6 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "0zs07g7arrrvm85mqbkffyzgd255qawn64r6iqdws25lj1kq2qim";
   };
 
+  patches = [ ./glibc-2.23.patch ];
+
   postPatch = stdenv.lib.optionalString stdenv.isDarwin ''
     sed -i 's/raise.*No Xcode or CLT version detected.*/version = "7.0.0"/' external/v8_3.30.33.16/build/gyp/pylib/gyp/xcode_emulation.py
 
diff --git a/pkgs/servers/nosql/rethinkdb/glibc-2.23.patch b/pkgs/servers/nosql/rethinkdb/glibc-2.23.patch
new file mode 100644
index 00000000000..818ea124564
--- /dev/null
+++ b/pkgs/servers/nosql/rethinkdb/glibc-2.23.patch
@@ -0,0 +1,111 @@
+From 84be09f314c4cbf88b4ac8fe9dbff1d36f0f5781 Mon Sep 17 00:00:00 2001
+From: Daniel Mewes <daniel@rethinkdb.com>
+Date: Fri, 5 Feb 2016 18:45:28 -0800
+Subject: [PATCH] Alpinelinux compilation fixes
+
+by @clandmeter
+---
+ src/containers/buffer_group.hpp                            |  1 +
+ src/containers/printf_buffer.hpp                           |  1 +
+ src/errors.cc                                              |  2 +-
+ src/rdb_protocol/geo/s2/util/math/exactfloat/exactfloat.cc |  4 ++--
+ src/rdb_protocol/geo/s2/util/math/mathlimits.h             | 12 ++++++------
+ src/threading.hpp                                          |  2 ++
+ 6 files changed, 13 insertions(+), 9 deletions(-)
+
+diff --git a/src/containers/buffer_group.hpp b/src/containers/buffer_group.hpp
+index 865c5cb..0403db6 100644
+--- a/src/containers/buffer_group.hpp
++++ b/src/containers/buffer_group.hpp
+@@ -3,6 +3,7 @@
+ #define CONTAINERS_BUFFER_GROUP_HPP_
+ 
+ #include <stdlib.h>
++#include <sys/types.h>
+ #include <unistd.h>
+ #include <vector>
+ 
+diff --git a/src/containers/printf_buffer.hpp b/src/containers/printf_buffer.hpp
+index b7a5154..76959f3 100644
+--- a/src/containers/printf_buffer.hpp
++++ b/src/containers/printf_buffer.hpp
+@@ -5,6 +5,7 @@
+ #include <stdarg.h>
+ #include <stdio.h>
+ #include <string.h>
++#include <sys/types.h>
+ 
+ // Cannot include utils.hpp, we are included by utils.hpp.
+ #include "errors.hpp"
+diff --git a/src/errors.cc b/src/errors.cc
+index d40c04f..39efc9f 100644
+--- a/src/errors.cc
++++ b/src/errors.cc
+@@ -89,7 +89,7 @@ void report_fatal_error(const char *file, int line, const char *msg, ...) {
+ }
+ 
+ const char *errno_string_maybe_using_buffer(int errsv, char *buf, size_t buflen) {
+-#ifdef _GNU_SOURCE
++#ifdef __GLIBC__
+     return strerror_r(errsv, buf, buflen);
+ #elif defined(_WIN32)
+     UNUSED errno_t res = strerror_s(buf, buflen, errsv);
+diff --git a/src/rdb_protocol/geo/s2/util/math/exactfloat/exactfloat.cc b/src/rdb_protocol/geo/s2/util/math/exactfloat/exactfloat.cc
+index 3b07392..aa1a1d3 100644
+--- a/src/rdb_protocol/geo/s2/util/math/exactfloat/exactfloat.cc
++++ b/src/rdb_protocol/geo/s2/util/math/exactfloat/exactfloat.cc
+@@ -110,9 +110,9 @@ static int BN_ext_count_low_zero_bits(const BIGNUM* bn) {
+ ExactFloat::ExactFloat(double v) {
+   BN_init(&bn_);
+   sign_ = signbit(v) ? -1 : 1;
+-  if (isnan(v)) {
++  if (std::isnan(v)) {
+     set_nan();
+-  } else if (isinf(v)) {
++  } else if (std::isinf(v)) {
+     set_inf(sign_);
+   } else {
+     // The following code is much simpler than messing about with bit masks,
+diff --git a/src/rdb_protocol/geo/s2/util/math/mathlimits.h b/src/rdb_protocol/geo/s2/util/math/mathlimits.h
+index 5148422..86af72d 100644
+--- a/src/rdb_protocol/geo/s2/util/math/mathlimits.h
++++ b/src/rdb_protocol/geo/s2/util/math/mathlimits.h
+@@ -14,7 +14,7 @@
+ #define UTIL_MATH_MATHLIMITS_H__
+ 
+ #include <string.h>
+-#include <math.h>
++#include <cmath>
+ #include <cfloat>
+ 
+ #include "rdb_protocol/geo/s2/base/basictypes.h"
+@@ -195,11 +195,11 @@ DECL_UNSIGNED_INT_LIMITS(unsigned long long int)
+   static bool IsNegInf(const Type x) { return _fpclass(x) == _FPCLASS_NINF; }
+ #else
+ #define DECL_FP_LIMIT_FUNCS \
+-  static bool IsFinite(const Type x) { return !isinf(x)  &&  !isnan(x); } \
+-  static bool IsNaN(const Type x) { return isnan(x); } \
+-  static bool IsInf(const Type x) { return isinf(x); } \
+-  static bool IsPosInf(const Type x) { return isinf(x)  &&  x > 0; } \
+-  static bool IsNegInf(const Type x) { return isinf(x)  &&  x < 0; }
++  static bool IsFinite(const Type x) { return !std::isinf(x)  &&  !std::isnan(x); } \
++  static bool IsNaN(const Type x) { return std::isnan(x); } \
++  static bool IsInf(const Type x) { return std::isinf(x); } \
++  static bool IsPosInf(const Type x) { return std::isinf(x)  &&  x > 0; } \
++  static bool IsNegInf(const Type x) { return std::isinf(x)  &&  x < 0; }
+ #endif
+ 
+ // We can't put floating-point constant values in the header here because
+diff --git a/src/threading.hpp b/src/threading.hpp
+index 14fc6a8..9bf033f 100644
+--- a/src/threading.hpp
++++ b/src/threading.hpp
+@@ -1,6 +1,8 @@
+ #ifndef THREADING_HPP_
+ #define THREADING_HPP_
+ 
++#include <sys/types.h>
++#include <unistd.h>
+ #include <functional>
+ #include <vector>
+ 
diff --git a/pkgs/servers/plex/default.nix b/pkgs/servers/plex/default.nix
index aa27f6dd532..799fea0fe50 100644
--- a/pkgs/servers/plex/default.nix
+++ b/pkgs/servers/plex/default.nix
@@ -5,13 +5,13 @@
 
 let
   plexpkg = if enablePlexPass then {
-    version = "0.9.15.5.1712";
-    vsnHash = "ba5070a";
-    sha256 = "0nwcjlfbs8dacp6wzmga75hkx16ngyaqrmdhcx8vqvgwm8l31rxs";
+    version = "0.9.15.6.1714";
+    vsnHash = "7be11e1";
+    sha256 = "1kyk41qnbm8w5bvnisp3d99cf0r72wvlggfi9h4np7sq4p8ksa0g";
   } else {
-    version = "0.9.15.3.1674";
-    vsnHash = "f46e7e6";
-    sha256 = "086njnjcmknmbn90mmvf60ls7q73g2m955yk621jjdngs4ybvm19";
+    version = "0.9.15.6.1714";
+    vsnHash = "7be11e1";
+    sha256 = "1kyk41qnbm8w5bvnisp3d99cf0r72wvlggfi9h4np7sq4p8ksa0g";
   };
 
 in stdenv.mkDerivation rec {
diff --git a/pkgs/servers/samba/4.x.nix b/pkgs/servers/samba/4.x.nix
index 8fcc1a4a973..4ef47122c28 100644
--- a/pkgs/servers/samba/4.x.nix
+++ b/pkgs/servers/samba/4.x.nix
@@ -5,7 +5,6 @@
 , gnutls, libgcrypt, libgpgerror
 , ncurses, libunwind, libibverbs, librdmacm, systemd
 
-, enableKerberos ? false
 , enableInfiniband ? false
 , enableLDAP ? false
 , enablePrinting ? false
@@ -34,10 +33,9 @@ stdenv.mkDerivation rec {
   buildInputs =
     [ python pkgconfig perl libxslt docbook_xsl docbook_xml_dtd_42 /*
       docbook_xml_dtd_45 */ readline talloc ntdb tdb tevent ldb popt iniparser
-      libbsd libarchive zlib acl fam libiconv gettext libunwind
+      libbsd libarchive zlib acl fam libiconv gettext libunwind kerberos
     ]
     ++ optionals stdenv.isLinux [ libaio pam systemd ]
-    ++ optional enableKerberos kerberos
     ++ optionals (enableInfiniband && stdenv.isLinux) [ libibverbs librdmacm ]
     ++ optional enableLDAP openldap
     ++ optional (enablePrinting && stdenv.isLinux) cups
@@ -58,23 +56,22 @@ stdenv.mkDerivation rec {
   configureFlags =
     [ "--with-static-modules=NONE"
       "--with-shared-modules=ALL"
+      "--with-system-mitkrb5"
       "--enable-fhs"
       "--sysconfdir=/etc"
       "--localstatedir=/var"
-      "--bundled-libraries=${if enableKerberos && kerberos != null &&
-        kerberos.implementation == "heimdal" then "NONE" else "com_err"}"
+      "--bundled-libraries=NONE"
       "--private-libraries=NONE"
-      "--builtin-libraries=replace"
+      "--builtin-libraries=NONE"
     ]
-    ++ optional (enableKerberos && kerberos != null &&
-      kerberos.implementation == "krb5") "--with-system-mitkrb5"
     ++ optional (!enableDomainController) "--without-ad-dc"
     ++ optionals (!enableLDAP) [ "--without-ldap" "--without-ads" ];
 
   enableParallelBuilding = true;
 
-  stripAllList = [ "bin" "sbin" ];
-
+  # Some libraries don't have /lib/samba in RPATH but need it.
+  # Use find -type f -executable -exec echo {} \; -exec sh -c 'ldd {} | grep "not found"' \;
+  # Looks like a bug in installer scripts.
   postFixup = ''
     export SAMBA_LIBS="$(find $out -type f -name \*.so -exec dirname {} \; | sort | uniq)"
     read -r -d "" SCRIPT << EOF || true
@@ -85,7 +82,7 @@ stdenv.mkDerivation rec {
     patchelf --set-rpath "\$ALL_LIBS" "\$BIN" 2>/dev/null || exit $?;
     patchelf --shrink-rpath "\$BIN";
     EOF
-    find $out -type f -exec $SHELL -c "$SCRIPT" \;
+    find $out -type f -name \*.so -exec $SHELL -c "$SCRIPT" \;
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/shells/fish/default.nix b/pkgs/shells/fish/default.nix
index 11eeb18661c..52121294067 100644
--- a/pkgs/shells/fish/default.nix
+++ b/pkgs/shells/fish/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, ncurses, nettools, python, which, groff, gettext, man_db,
-  bc, libiconv, coreutils, gnused, kbd }:
+  bc, libiconv, coreutils, gnused, kbd, utillinux, glibc }:
 
 stdenv.mkDerivation rec {
   name = "fish-${version}";
@@ -22,8 +22,10 @@ stdenv.mkDerivation rec {
 
   postInstall = ''
     sed -e "s|expr|${coreutils}/bin/expr|" \
+  '' + stdenv.lib.optionalString (!stdenv.isDarwin) ''
         -e "s|if which unicode_start|if true|" \
         -e "s|unicode_start|${kbd}/bin/unicode_start|" \
+  '' + ''
         -i "$out/etc/fish/config.fish"
     sed -e "s|bc|${bc}/bin/bc|" \
         -e "s|/usr/bin/seq|${coreutils}/bin/seq|" \
@@ -43,6 +45,13 @@ stdenv.mkDerivation rec {
            "$out/share/fish/functions/prompt_pwd.fish"
     substituteInPlace "$out/share/fish/functions/fish_default_key_bindings.fish" \
       --replace "clear;" "${ncurses}/bin/clear;"
+  '' + stdenv.lib.optionalString stdenv.isLinux ''
+    substituteInPlace "$out/share/fish/functions/__fish_print_help.fish" \
+      --replace "| ul" "| ${utillinux}/bin/ul" 
+
+    for cur in $out/share/fish/functions/*.fish; do
+      substituteInPlace "$cur" --replace "/usr/bin/getent" "${glibc}/bin/getent" 
+    done
   '' + stdenv.lib.optionalString (!stdenv.isDarwin) ''
     sed -i "s|(hostname\||(${nettools}/bin/hostname\||" "$out/share/fish/functions/fish_prompt.fish"
     sed -i "s|Popen(\['manpath'|Popen(\['${man_db}/bin/manpath'|" "$out/share/fish/tools/create_manpage_completions.py"
diff --git a/pkgs/stdenv/nix/default.nix b/pkgs/stdenv/nix/default.nix
index 75e1c3814ed..30ac92837cb 100644
--- a/pkgs/stdenv/nix/default.nix
+++ b/pkgs/stdenv/nix/default.nix
@@ -18,10 +18,9 @@ import ../generic rec {
     nativePrefix = stdenv.lib.optionalString stdenv.isSunOS "/usr";
     nativeLibc = true;
     inherit stdenv;
-    binutils = pkgs.binutils;
+    inherit (pkgs) binutils coreutils gnugrep;
     cc = pkgs.gcc.cc;
     isGNU = true;
-    coreutils = pkgs.coreutils;
     shell = pkgs.bash + "/bin/sh";
   };
 
diff --git a/pkgs/tools/admin/letsencrypt/default.nix b/pkgs/tools/admin/letsencrypt/default.nix
index 516fc20c5a7..be314a56731 100644
--- a/pkgs/tools/admin/letsencrypt/default.nix
+++ b/pkgs/tools/admin/letsencrypt/default.nix
@@ -1,22 +1,36 @@
-{ stdenv, pythonPackages, fetchurl, dialog }:
+{ stdenv, pythonPackages, fetchFromGitHub, dialog }:
 
 pythonPackages.buildPythonApplication rec {
-  version = "0.1.0";
   name = "letsencrypt-${version}";
+  version = "0.4.0";
 
-  src = fetchurl {
-    url = "https://github.com/letsencrypt/letsencrypt/archive/v${version}.tar.gz";
-    sha256 = "056y5bsmpc4ya5xxals4ypzsm927j6n5kwby3bjc03sy3sscf6hw";
+  src = fetchFromGitHub {
+    owner = "letsencrypt";
+    repo = "letsencrypt";
+    rev = "v${version}";
+    sha256 = "0r2wis48w5nailzp2d5brkh2f40al6sbz816xx0akh3ll0rl1hbv";
   };
 
   propagatedBuildInputs = with pythonPackages; [
-    zope_interface zope_component six requests2 pytz pyopenssl psutil mock acme
-    cryptography configobj pyRFC3339 python2-pythondialog parsedatetime ConfigArgParse
+    ConfigArgParse
+    acme
+    configobj
+    cryptography
+    parsedatetime
+    psutil
+    pyRFC3339
+    pyopenssl
+    python2-pythondialog
+    pytz
+    six
+    zope_component
+    zope_interface
   ];
   buildInputs = with pythonPackages; [ nose dialog ];
 
   patchPhase = ''
     substituteInPlace letsencrypt/notify.py --replace "/usr/sbin/sendmail" "/var/setuid-wrappers/sendmail"
+    substituteInPlace letsencrypt/le_util.py --replace "sw_vers" "/usr/bin/sw_vers"
   '';
 
   postInstall = ''
diff --git a/pkgs/tools/misc/parallel/default.nix b/pkgs/tools/misc/parallel/default.nix
index c45c62cb3ad..d4c920f4acc 100644
--- a/pkgs/tools/misc/parallel/default.nix
+++ b/pkgs/tools/misc/parallel/default.nix
@@ -1,11 +1,11 @@
 { fetchurl, stdenv, perl, makeWrapper, procps }:
 
 stdenv.mkDerivation rec {
-  name = "parallel-20160122";
+  name = "parallel-20160222";
 
   src = fetchurl {
     url = "mirror://gnu/parallel/${name}.tar.bz2";
-    sha256 = "1xs8y8jh7wyjs27079xz0ja7xfi4dywz8d6hbkl44mafdnnfjfiy";
+    sha256 = "1sjmvinwr9j2a0jdk9y9nf2x4hhzcbl529slkwpz0vva0cwybywd";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/security/clamav/default.nix b/pkgs/tools/security/clamav/default.nix
index 1f36d54ff50..efb72783391 100644
--- a/pkgs/tools/security/clamav/default.nix
+++ b/pkgs/tools/security/clamav/default.nix
@@ -1,15 +1,15 @@
 { stdenv, fetchurl, zlib, bzip2, libiconv, libxml2, openssl, ncurses, curl
-, libmilter }:
+, libmilter, pcre }:
 stdenv.mkDerivation rec {
   name = "clamav-${version}";
-  version = "0.98.7";
+  version = "0.99";
 
   src = fetchurl {
     url = "mirror://sourceforge/clamav/clamav-${version}.tar.gz";
-    sha256 = "0wp2ad8km4cqmlndni5ljv7q3lfxm6y4r3giv0yf23bl0yvif918";
+    sha256 = "1abyg349yr31z764jcgx67q5v098jrkrj88bqkzmys6xza62qyfj";
   };
 
-  buildInputs = [ zlib bzip2 libxml2 openssl ncurses curl libiconv libmilter ];
+  buildInputs = [ zlib bzip2 libxml2 openssl ncurses curl libiconv libmilter pcre ];
 
   configureFlags = [
     "--with-zlib=${zlib}"
@@ -19,6 +19,7 @@ stdenv.mkDerivation rec {
     "--with-openssl=${openssl}"
     "--with-libncurses-prefix=${ncurses}"
     "--with-libcurl=${curl}"
+    "--with-pcre=${pcre}"
     "--enable-milter"
     "--disable-clamav"
   ];
diff --git a/pkgs/tools/text/wring/default.nix b/pkgs/tools/text/wring/default.nix
new file mode 100644
index 00000000000..038456f82c5
--- /dev/null
+++ b/pkgs/tools/text/wring/default.nix
@@ -0,0 +1,26 @@
+{ stdenv, callPackage, makeWrapper, nodejs, phantomjs2 }:
+
+let
+  self = (
+    callPackage ../../../top-level/node-packages.nix {
+      generated = callPackage ./node-packages.nix { inherit self; };
+      overrides = {
+        "wring" = {
+          buildInputs = [ makeWrapper phantomjs2 ];
+
+          postInstall = ''
+            wrapProgram "$out/bin/wring" \
+              --prefix PATH : ${phantomjs2}/bin
+          '';
+
+          meta = with stdenv.lib; {
+            description = "Command-line tool for extracting content from webpages using CSS Selectors, XPath, and JS expressions";
+            homepage = https://github.com/osener/wring;
+            license = licenses.mit;
+            platforms = platforms.darwin ++ platforms.linux;
+            maintainers = [ maintainers.osener ];
+          };
+        };
+      };
+    });
+in self.wring
diff --git a/pkgs/tools/text/wring/node-packages.json b/pkgs/tools/text/wring/node-packages.json
new file mode 100644
index 00000000000..9c0e1712928
--- /dev/null
+++ b/pkgs/tools/text/wring/node-packages.json
@@ -0,0 +1 @@
+[ "wring" ]
diff --git a/pkgs/tools/text/wring/node-packages.nix b/pkgs/tools/text/wring/node-packages.nix
new file mode 100644
index 00000000000..b3761bd33cb
--- /dev/null
+++ b/pkgs/tools/text/wring/node-packages.nix
@@ -0,0 +1,24 @@
+{ self, fetchurl, fetchgit ? null, lib }:
+
+{
+  by-spec."wring"."*" =
+    self.by-version."wring"."1.0.0";
+  by-version."wring"."1.0.0" = self.buildNodePackage {
+    name = "wring-1.0.0";
+    version = "1.0.0";
+    bin = true;
+    src = fetchurl {
+      url = "http://registry.npmjs.org/wring/-/wring-1.0.0.tgz";
+      name = "wring-1.0.0.tgz";
+      sha1 = "3d8ebe894545bf0b42946fdc84c61e37ae657ce1";
+    };
+    deps = {
+    };
+    optionalDependencies = {
+    };
+    peerDependencies = [];
+    os = [ ];
+    cpu = [ ];
+  };
+  "wring" = self.by-version."wring"."1.0.0";
+}
diff --git a/pkgs/tools/typesetting/pdf2djvu/default.nix b/pkgs/tools/typesetting/pdf2djvu/default.nix
index 96106d06ca5..5f344628e37 100644
--- a/pkgs/tools/typesetting/pdf2djvu/default.nix
+++ b/pkgs/tools/typesetting/pdf2djvu/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, pkgconfig, djvulibre, poppler, fontconfig, libjpeg }:
 
 stdenv.mkDerivation rec {
-  version = "0.9.3";
+  version = "0.9.4";
   name = "pdf2djvu-${version}";
 
   src = fetchurl {
     url = "https://bitbucket.org/jwilk/pdf2djvu/downloads/${name}.tar.xz";
-    sha256 = "0xvh9kzfym5vsma9bhr1w1lla31qdqfaqc9q25vqpl921shvfpnh";
+    sha256 = "1a1gwr6yzbiximbpgg4rc69dq8g3jmxwcbcwqk0fhfbgzj1j4w65";
   };
 
   buildInputs = [ pkgconfig djvulibre poppler fontconfig libjpeg ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 0f2a40a548e..6735dc4bbc8 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -64,7 +64,7 @@ let
       # { /* the config */ } and
       # { pkgs, ... } : { /* the config */ }
       if builtins.isFunction configExpr
-        then configExpr { pkgs = pkgsFinal; }
+        then configExpr { inherit pkgs; }
         else configExpr;
 
   # Allow setting the platform in the config file. Otherwise, let's use a reasonable default (pc)
@@ -83,38 +83,51 @@ let
   platform = if platform_ != null then platform_
     else config.platform or platformAuto;
 
-  # The complete set of packages, after applying the overrides
-  pkgsFinal = lib.fix' (lib.extends configOverrides (lib.extends stdenvOverrides pkgsFun));
+  # Helper functions that are exported through `pkgs'.
+  helperFunctions =
+    stdenvAdapters //
+    (import ../build-support/trivial-builders.nix { inherit lib; inherit (pkgs) stdenv; inherit (pkgs.xorg) lndir; });
+
+  stdenvAdapters =
+    import ../stdenv/adapters.nix pkgs;
 
-  stdenvOverrides =
-    # We don't want stdenv overrides in the case of cross-building,
-    # or otherwise the basic overrided packages will not be built
-    # with the crossStdenv adapter.
-    if crossSystem == null
-      then self: super: lib.optionalAttrs (super.stdenv ? overrides) (super.stdenv.overrides super)
-      else self: super: {};
 
-  # Packages can be overriden globally via the `packageOverrides'
+  # Allow packages to be overriden globally via the `packageOverrides'
   # configuration option, which must be a function that takes `pkgs'
   # as an argument and returns a set of new or overriden packages.
-  # The recommended usage follows this snippet:
-  #   packageOverrides = super: let self = super.pkgs in ...
-  # `super' is the *original* (un-overriden) set of packages,
-  # while `self' refers to the final (overriden) set of packages.
-  configOverrides =
-      if config ? packageOverrides && bootStdenv == null # don't apply config overrides in stdenv boot
-        then self: config.packageOverrides
-        else self: super: {};
+  # The `packageOverrides' function is called with the *original*
+  # (un-overriden) set of packages, allowing packageOverrides
+  # attributes to refer to the original attributes (e.g. "foo =
+  # ... pkgs.foo ...").
+  pkgs = applyGlobalOverrides (config.packageOverrides or (pkgs: {}));
+
+  mkOverrides = pkgsOrig: overrides: overrides //
+        (lib.optionalAttrs (pkgsOrig.stdenv ? overrides && crossSystem == null) (pkgsOrig.stdenv.overrides pkgsOrig));
+
+  # Return the complete set of packages, after applying the overrides
+  # returned by the `overrider' function (see above).  Warning: this
+  # function is very expensive!
+  applyGlobalOverrides = overrider:
+    let
+      # Call the overrider function.  We don't want stdenv overrides
+      # in the case of cross-building, or otherwise the basic
+      # overrided packages will not be built with the crossStdenv
+      # adapter.
+      overrides = mkOverrides pkgsOrig (overrider pkgsOrig);
+
+      # The un-overriden packages, passed to `overrider'.
+      pkgsOrig = pkgsFun pkgs {};
+
+      # The overriden, final packages.
+      pkgs = pkgsFun pkgs overrides;
+    in pkgs;
+
 
   # The package compositions.  Yes, this isn't properly indented.
-  pkgsFun = pkgs:
-    let defaultScope = pkgs // pkgs.xorg;
-        helperFunctions = pkgs_.stdenvAdapters // pkgs_.trivial-builders;
-        pkgsRet = helperFunctions // pkgs_;
-        pkgs_ = with pkgs; {
-  # Helper functions that are exported through `pkgs'.
-  trivial-builders = import ../build-support/trivial-builders.nix { inherit lib; inherit stdenv; inherit (xorg) lndir; };
-  stdenvAdapters = import ../stdenv/adapters.nix pkgs;
+  pkgsFun = pkgs: overrides:
+    with helperFunctions;
+    let defaultScope = pkgs // pkgs.xorg; self = self_ // overrides;
+    self_ = with self; helperFunctions // {
 
   # Make some arguments passed to all-packages.nix available
   inherit system platform;
@@ -144,7 +157,11 @@ let
   #
   # The result is `pkgs' where all the derivations depending on `foo'
   # will use the new version.
-  overridePackages = f: lib.fix' (lib.extends f pkgs.__unfix__);
+  overridePackages = f:
+    let
+      newpkgs = pkgsFun newpkgs overrides;
+      overrides = mkOverrides pkgs (f newpkgs pkgs);
+    in newpkgs;
 
   # Override system. This is useful to build i686 packages on x86_64-linux.
   forceSystem = system: kernel: (import ./all-packages.nix) {
@@ -166,7 +183,7 @@ let
 
 
   ### Helper functions.
-  inherit lib config;
+  inherit lib config stdenvAdapters;
 
   inherit (lib) lowPrio hiPrio appendToName makeOverridable;
   inherit (misc) versionedDerivation;
@@ -197,10 +214,7 @@ let
     allPackages = args: import ./all-packages.nix ({ inherit config system; } // args);
   };
 
-  # We use pkgs_ because accessing pkgs would lead to an infinite recursion in stdenvOverrides
-  defaultStdenv = (import ../stdenv/adapters.nix pkgs_).useHardenFlags (
-    pkgs_.allStdenvs.stdenv // { inherit platform; }
-  );
+  defaultStdenv = stdenvAdapters.useHardenFlags (allStdenvs.stdenv // { inherit platform; });
 
   stdenvCross = lowPrio (makeStdenvCross defaultStdenv crossSystem binutilsCross gccCrossStageFinal);
 
@@ -220,7 +234,7 @@ let
             };
           }
       else
-        pkgs_.defaultStdenv;
+        defaultStdenv;
 
   forceNativeDrv = drv : if crossSystem == null then drv else
     (drv // { crossDrv = drv.nativeDrv; });
@@ -3766,6 +3780,8 @@ let
 
   wml = callPackage ../development/web/wml { };
 
+  wring = callPackage ../tools/text/wring { };
+
   wrk = callPackage ../tools/networking/wrk { };
 
   wv = callPackage ../tools/misc/wv { };
@@ -4907,6 +4923,8 @@ let
 
     re2 = callPackage ../development/ocaml-modules/re2 { };
 
+    result = callPackage ../development/ocaml-modules/ocaml-result { };
+
     sequence = callPackage ../development/ocaml-modules/sequence { };
 
     tuntap = callPackage ../development/ocaml-modules/tuntap { };
@@ -4986,6 +5004,8 @@ let
 
     stringext = callPackage ../development/ocaml-modules/stringext { };
 
+    tsdl = callPackage ../development/ocaml-modules/tsdl { };
+
     twt = callPackage ../development/ocaml-modules/twt { };
 
     typerep = callPackage ../development/ocaml-modules/typerep { };
@@ -5950,8 +5970,8 @@ let
   gotty = goPackages.gotty.bin // { outputs = [ "bin" ]; };
 
   gradleGen = callPackage ../development/tools/build-managers/gradle { };
-  gradle = gradleGen.gradleLatest;
-  gradle25 = gradleGen.gradle25;
+  gradle = self.gradleGen.gradleLatest;
+  gradle25 = self.gradleGen.gradle25;
 
   gperf = callPackage ../development/tools/misc/gperf { };
 
@@ -6058,6 +6078,8 @@ let
       pythonPackages = python3Packages;
   };
 
+  nexus = callPackage ../development/tools/repository-managers/nexus { };
+
   node_webkit = node_webkit_0_9;
 
   nwjs_0_12 = callPackage ../development/tools/node-webkit/nw12.nix {
@@ -9789,7 +9811,6 @@ let
 
   samba4 = callPackage ../servers/samba/4.x.nix {
     python = python2;
-    kerberos = null;  # Bundle kerberos because samba uses internal, non-stable functions
     # enableLDAP
   };
 
@@ -9809,7 +9830,6 @@ let
   });
 
   samba4Full = lowPrio (samba4.override {
-    enableKerberos  = true;
     enableInfiniband = true;
     enableLDAP = true;
     enablePrinting = true;
@@ -11511,6 +11531,10 @@ let
 
   cava = callPackage ../applications/audio/cava { };
 
+  cb2bib = callPackage ../applications/office/cb2bib {
+    inherit (xorg) libX11;
+  };
+
   cbatticon = callPackage ../applications/misc/cbatticon { };
 
   cbc = callPackage ../applications/science/math/cbc { };
@@ -11778,7 +11802,7 @@ let
       AppKit Carbon Cocoa IOKit OSAKit Quartz QuartzCore WebKit
       ImageCaptureCore GSS ImageIO;
   });
-  emacs24Macport = emacs24Macport_24_5;
+  emacs24Macport = self.emacs24Macport_24_5;
 
   emacs25pre = lowPrio (callPackage ../applications/editors/emacs-25 {
     # use override to enable additional features
@@ -13483,7 +13507,7 @@ let
 
   copy-com = callPackage ../applications/networking/copy-com { };
 
-  dropbox = qt5.callPackage ../applications/networking/dropbox { };
+  dropbox = qt55.callPackage ../applications/networking/dropbox { };
 
   dropbox-cli = callPackage ../applications/networking/dropbox-cli { };
 
@@ -16148,13 +16172,12 @@ let
 
   mg = callPackage ../applications/editors/mg { };
 
-};
-# end pkgs_ =
+}; # self_ =
 
 
   ### Deprecated aliases - for backward compatibility
 
-aliases = with pkgs; {
+aliases = with self; rec {
   accounts-qt = qt5.accounts-qt;  # added 2015-12-19
   adobeReader = adobe-reader;
   aircrackng = aircrack-ng; # added 2016-01-14
@@ -16243,7 +16266,4 @@ tweakAlias = _n: alias: with lib;
     removeAttrs alias ["recurseForDerivations"]
   else alias;
 
-in lib.mapAttrs tweakAlias aliases // pkgsRet;
-# end pkgsFun
-
-in pkgsFinal
+in lib.mapAttrs tweakAlias aliases // self; in pkgs
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 7cae676f829..41e46f32342 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -8147,7 +8147,7 @@ let self = _self // overrides; _self = with self; {
     name = "MooseX-Role-WithOverloading-0.17";
     src = fetchurl {
       url = "mirror://cpan/authors/id/E/ET/ETHER/${name}.tar.gz";
-      sha256 = "01mqpvbz7yw993918hgp72vl22i6mgicpq5b3zrrsp6vl8sqj2sw";
+      sha256 = "0rb8k0dp1a55bm2pr6r0vsi5msvjl1dslfidxp1gj80j7zbrbc4j";
     };
     buildInputs = [ TestCheckDeps TestNoWarnings ModuleMetadata];
     propagatedBuildInputs = [ aliased Moose namespaceautoclean namespaceclean ];
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 19c4ce2baab..ff2fe1e840a 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -260,7 +260,7 @@ in modules // {
 
     buildInputs = with self; [ nose ];
 
-    sourceRoot = "letsencrypt-${version}/acme";
+    sourceRoot = "letsencrypt-v${version}-src/acme";
   };
 
   acme-tiny = buildPythonPackage rec {
@@ -282,6 +282,7 @@ in modules // {
 
     patchPhase = ''
       substituteInPlace acme_tiny.py --replace "openssl" "${pkgs.openssl}/bin/openssl"
+      substituteInPlace letsencrypt/le_util.py --replace '"sw_vers"' '"/usr/bin/sw_vers"'
     '';
 
     installPhase = ''
@@ -299,7 +300,6 @@ in modules // {
     };
   };
 
-
   actdiag = buildPythonPackage rec {
     name = "actdiag-0.5.3";
 
@@ -8935,15 +8935,19 @@ in modules // {
   };
 
   wtforms = buildPythonPackage rec {
-    version = "2.0.2";
+    version = "2.1";
     name = "wtforms-${version}";
 
     src = pkgs.fetchurl {
       url = "https://pypi.python.org/packages/source/W/WTForms/WTForms-${version}.zip";
-      md5 = "613cf723ab40537705bec02733c78d95";
+      sha256 = "0vyl26y9cg409cfyj8rhqxazsdnd0jipgjw06civhrd53yyi1pzz";
     };
 
-    propagatedBuildInputs = with self; [ ordereddict Babel ];
+    # Django tests are broken "django.core.exceptions.AppRegistryNotReady: Apps aren't loaded yet."
+    # This is fixed in master I believe but not yet in 2.1;
+    doCheck = false;
+
+    propagatedBuildInputs = with self; ([ Babel ] ++ (optionals isPy26 [ ordereddict ]));
 
     meta = {
       homepage = https://github.com/wtforms/wtforms;