summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--lib/options.nix13
-rw-r--r--nixos/doc/manual/configuration.xml2
-rw-r--r--nixos/doc/manual/default.nix8
-rw-r--r--nixos/doc/manual/development.xml2
-rw-r--r--nixos/doc/manual/man-nixos-generate-config.xml191
-rw-r--r--nixos/doc/manual/man-nixos-install.xml78
-rw-r--r--nixos/doc/manual/man-nixos-option.xml40
-rw-r--r--nixos/doc/manual/man-nixos-rebuild.xml37
-rw-r--r--nixos/doc/manual/man-pages.xml16
-rw-r--r--nixos/doc/manual/userconfiguration.xml80
-rw-r--r--nixos/lib/build-vms.nix2
-rw-r--r--nixos/lib/eval-config.nix6
-rw-r--r--nixos/lib/nixpkgs.nix8
-rw-r--r--nixos/lib/testing.nix7
-rw-r--r--nixos/modules/installer/cd-dvd/channel.nix5
-rw-r--r--nixos/modules/installer/tools/nixos-build-vms/nixos-build-vms.sh11
-rw-r--r--nixos/modules/installer/tools/nixos-gen-seccure-keys.sh13
-rw-r--r--nixos/modules/installer/tools/nixos-generate-config.pl452
-rw-r--r--nixos/modules/installer/tools/nixos-hardware-scan.pl248
-rw-r--r--nixos/modules/installer/tools/nixos-install.sh22
-rw-r--r--nixos/modules/installer/tools/nixos-option.sh168
-rw-r--r--nixos/modules/installer/tools/nixos-rebuild.sh45
-rw-r--r--nixos/modules/installer/tools/tools.nix49
-rw-r--r--nixos/modules/misc/nixpkgs.nix14
-rw-r--r--nixos/modules/misc/version.nix5
-rw-r--r--nixos/modules/module-list.nix4
-rw-r--r--nixos/modules/programs/bash/bash.nix4
-rw-r--r--nixos/modules/programs/environment.nix1
-rw-r--r--nixos/modules/programs/gurobi.nix43
-rw-r--r--nixos/modules/programs/shadow.nix26
-rw-r--r--nixos/modules/security/pam.nix329
-rw-r--r--nixos/modules/security/pam_usb.nix6
-rw-r--r--nixos/modules/security/polkit.nix2
-rw-r--r--nixos/modules/security/prey.nix42
-rw-r--r--nixos/modules/security/sudo.nix2
-rw-r--r--nixos/modules/services/mail/dovecot.nix2
-rw-r--r--nixos/modules/services/misc/gurobi.nix41
-rw-r--r--nixos/modules/services/misc/nix-daemon.nix41
-rw-r--r--nixos/modules/services/misc/nixos-manual.nix8
-rw-r--r--nixos/modules/services/monitoring/graphite.nix59
-rw-r--r--nixos/modules/services/monitoring/munin.nix216
-rw-r--r--nixos/modules/services/monitoring/statsd.nix14
-rw-r--r--nixos/modules/services/monitoring/uptime.nix2
-rw-r--r--nixos/modules/services/network-filesystems/samba.nix3
-rw-r--r--nixos/modules/services/networking/ejabberd.nix2
-rw-r--r--nixos/modules/services/networking/ssh/lshd.nix2
-rw-r--r--nixos/modules/services/networking/ssh/sshd.nix21
-rw-r--r--nixos/modules/services/printing/cupsd.nix2
-rw-r--r--nixos/modules/services/scheduling/atd.nix2
-rw-r--r--nixos/modules/services/search/elasticsearch.nix4
-rw-r--r--nixos/modules/services/security/fail2ban.nix56
-rw-r--r--nixos/modules/services/web-servers/zope2.nix207
-rw-r--r--nixos/modules/services/x11/desktop-managers/kde4.nix2
-rw-r--r--nixos/modules/services/x11/display-managers/default.nix60
-rw-r--r--nixos/modules/services/x11/display-managers/kdm.nix4
-rw-r--r--nixos/modules/services/x11/display-managers/lightdm.nix11
-rw-r--r--nixos/modules/services/x11/display-managers/slim.nix11
-rw-r--r--nixos/modules/services/x11/xserver.nix17
-rw-r--r--nixos/modules/system/boot/loader/grub/grub.nix15
-rw-r--r--nixos/modules/tasks/filesystems/xfs.nix2
-rw-r--r--nixos/modules/virtualisation/qemu-vm.nix3
-rw-r--r--nixos/modules/virtualisation/virtualbox-guest.nix4
-rw-r--r--nixos/release-combined.nix6
-rw-r--r--nixos/release.nix3
-rw-r--r--nixos/tests/default.nix5
-rw-r--r--nixos/tests/efi-installer.nix20
-rw-r--r--nixos/tests/installer.nix18
-rw-r--r--nixos/tests/misc.nix3
-rw-r--r--nixos/tests/openssh.nix3
-rw-r--r--nixos/tests/run-in-machine.nix6
-rw-r--r--pkgs/applications/display-managers/slim/default.nix32
-rw-r--r--pkgs/applications/display-managers/slim/run-once.patch12
-rw-r--r--pkgs/applications/display-managers/slim/runtime-paths.patch66
-rw-r--r--pkgs/applications/editors/eclipse/default.nix19
-rw-r--r--pkgs/applications/ike/default.nix39
-rw-r--r--pkgs/applications/misc/bitcoin/default.nix4
-rw-r--r--pkgs/applications/misc/freicoin/default.nix4
-rw-r--r--pkgs/applications/misc/synergy/cryptopp.patch12
-rw-r--r--pkgs/applications/misc/synergy/default.nix6
-rw-r--r--pkgs/applications/networking/browsers/chromium/sources.nix18
-rw-r--r--pkgs/applications/networking/browsers/dwb/default.nix6
-rw-r--r--pkgs/applications/networking/browsers/mozilla-plugins/fribid/builder.sh4
-rw-r--r--pkgs/applications/networking/browsers/mozilla-plugins/fribid/default.nix31
-rw-r--r--pkgs/applications/networking/browsers/mozilla-plugins/fribid/emulated-version.patch12
-rw-r--r--pkgs/applications/networking/browsers/mozilla-plugins/fribid/ipc-lazytrace.patch10
-rw-r--r--pkgs/applications/networking/browsers/mozilla-plugins/fribid/plugin-linkfix.patch11
-rw-r--r--pkgs/applications/networking/browsers/mozilla-plugins/fribid/translation-xgettext-to-intltool.patch16
-rw-r--r--pkgs/applications/networking/instant-messengers/pidgin-plugins/tox-prpl/default.nix29
-rw-r--r--pkgs/applications/networking/instant-messengers/skype/default.nix1
-rw-r--r--pkgs/applications/networking/instant-messengers/torchat/default.nix13
-rw-r--r--pkgs/applications/networking/instant-messengers/toxic/default.nix40
-rw-r--r--pkgs/applications/networking/p2p/gnunet/svn.nix9
-rw-r--r--pkgs/applications/science/logic/hol/default.nix19
-rw-r--r--pkgs/applications/science/math/maxima/default.nix4
-rw-r--r--pkgs/applications/science/math/wxmaxima/default.nix4
-rw-r--r--pkgs/applications/virtualization/virt-manager/default.nix6
-rw-r--r--pkgs/applications/window-managers/stumpwm/default.nix61
-rw-r--r--pkgs/build-support/builder-defs/builder-defs.nix4
-rwxr-xr-xpkgs/build-support/upstream-updater/urls-from-page.sh2
-rw-r--r--pkgs/data/fonts/lmodern/default.nix4
-rw-r--r--pkgs/data/fonts/lmodern/lmmath.nix4
-rw-r--r--pkgs/data/fonts/tipa/default.nix2
-rw-r--r--pkgs/data/misc/tzdata/default.nix6
-rw-r--r--pkgs/development/compilers/idris/default.nix21
-rw-r--r--pkgs/development/compilers/julia/default.nix6
-rw-r--r--pkgs/development/compilers/ocaml/4.01.0.nix63
-rw-r--r--pkgs/development/compilers/sbcl/default.nix8
-rw-r--r--pkgs/development/interpreters/clisp/default.nix5
-rw-r--r--pkgs/development/interpreters/php/5.4.nix4
-rw-r--r--pkgs/development/interpreters/python/2.6/default.nix5
-rw-r--r--pkgs/development/interpreters/python/2.7/default.nix5
-rw-r--r--pkgs/development/libraries/SDL2/default.nix56
-rw-r--r--pkgs/development/libraries/SDL2_gfx/default.nix54
-rw-r--r--pkgs/development/libraries/SDL2_image/default.nix27
-rw-r--r--pkgs/development/libraries/SDL2_mixer/default.nix20
-rw-r--r--pkgs/development/libraries/gurobi/default.nix25
-rw-r--r--pkgs/development/libraries/harfbuzz/default.nix10
-rw-r--r--pkgs/development/libraries/haskell/Cabal/1.18.1.1.nix (renamed from pkgs/development/libraries/haskell/Cabal/1.18.1.nix)4
-rw-r--r--pkgs/development/libraries/haskell/ChasingBottoms/default.nix4
-rw-r--r--pkgs/development/libraries/haskell/HTTP/4000.2.8.nix1
-rw-r--r--pkgs/development/libraries/haskell/JuicyPixels/default.nix4
-rw-r--r--pkgs/development/libraries/haskell/RSA/default.nix2
-rw-r--r--pkgs/development/libraries/haskell/accelerate/default.nix1
-rw-r--r--pkgs/development/libraries/haskell/active/default.nix4
-rw-r--r--pkgs/development/libraries/haskell/aeson/default.nix4
-rw-r--r--pkgs/development/libraries/haskell/amqp/default.nix15
-rw-r--r--pkgs/development/libraries/haskell/arithmoi/default.nix2
-rw-r--r--pkgs/development/libraries/haskell/bifunctors/default.nix6
-rw-r--r--pkgs/development/libraries/haskell/bindings-DSL/default.nix4
-rw-r--r--pkgs/development/libraries/haskell/bindings-libusb/default.nix15
-rw-r--r--pkgs/development/libraries/haskell/charset/default.nix4
-rw-r--r--pkgs/development/libraries/haskell/clock/default.nix13
-rw-r--r--pkgs/development/libraries/haskell/comonad-transformers/default.nix17
-rw-r--r--pkgs/development/libraries/haskell/comonad/default.nix14
-rw-r--r--pkgs/development/libraries/haskell/comonads-fd/default.nix15
-rw-r--r--pkgs/development/libraries/haskell/conduit/default.nix4
-rw-r--r--pkgs/development/libraries/haskell/connection/default.nix18
-rw-r--r--pkgs/development/libraries/haskell/constraints/default.nix4
-rw-r--r--pkgs/development/libraries/haskell/cryptohash/default.nix5
-rw-r--r--pkgs/development/libraries/haskell/data-pprint/default.nix7
-rw-r--r--pkgs/development/libraries/haskell/datetime/default.nix2
-rw-r--r--pkgs/development/libraries/haskell/distributive/default.nix4
-rw-r--r--pkgs/development/libraries/haskell/dotgen/default.nix2
-rw-r--r--pkgs/development/libraries/haskell/either/default.nix4
-rw-r--r--pkgs/development/libraries/haskell/entropy/default.nix4
-rw-r--r--pkgs/development/libraries/haskell/enumerator/default.nix4
-rw-r--r--pkgs/development/libraries/haskell/errors/default.nix5
-rw-r--r--pkgs/development/libraries/haskell/feed/default.nix2
-rw-r--r--pkgs/development/libraries/haskell/file-embed/default.nix4
-rw-r--r--pkgs/development/libraries/haskell/free/default.nix13
-rw-r--r--pkgs/development/libraries/haskell/groupoids/default.nix7
-rw-r--r--pkgs/development/libraries/haskell/hakyll/default.nix7
-rw-r--r--pkgs/development/libraries/haskell/hamlet/default.nix4
-rw-r--r--pkgs/development/libraries/haskell/hashtables/default.nix4
-rw-r--r--pkgs/development/libraries/haskell/haskell-src-meta/default.nix4
-rw-r--r--pkgs/development/libraries/haskell/haxr/default.nix4
-rw-r--r--pkgs/development/libraries/haskell/heist/default.nix4
-rw-r--r--pkgs/development/libraries/haskell/hoauth/default.nix2
-rw-r--r--pkgs/development/libraries/haskell/hsyslog/default.nix2
-rw-r--r--pkgs/development/libraries/haskell/http-types/default.nix4
-rw-r--r--pkgs/development/libraries/haskell/intervals/default.nix4
-rw-r--r--pkgs/development/libraries/haskell/keys/default.nix11
-rw-r--r--pkgs/development/libraries/haskell/lens/default.nix24
-rw-r--r--pkgs/development/libraries/haskell/monoid-extras/default.nix4
-rw-r--r--pkgs/development/libraries/haskell/mwc-random/default.nix4
-rw-r--r--pkgs/development/libraries/haskell/network-conduit-tls/default.nix17
-rw-r--r--pkgs/development/libraries/haskell/numbers/default.nix4
-rw-r--r--pkgs/development/libraries/haskell/optparse-applicative/default.nix4
-rw-r--r--pkgs/development/libraries/haskell/pandoc-citeproc/default.nix12
-rw-r--r--pkgs/development/libraries/haskell/parsers/default.nix10
-rw-r--r--pkgs/development/libraries/haskell/persistent-template/default.nix9
-rw-r--r--pkgs/development/libraries/haskell/pointed/default.nix14
-rw-r--r--pkgs/development/libraries/haskell/postgresql-simple/default.nix4
-rw-r--r--pkgs/development/libraries/haskell/profunctor-extras/default.nix15
-rw-r--r--pkgs/development/libraries/haskell/profunctors/default.nix10
-rw-r--r--pkgs/development/libraries/haskell/reducers/default.nix4
-rw-r--r--pkgs/development/libraries/haskell/resourcet/default.nix4
-rw-r--r--pkgs/development/libraries/haskell/semigroupoid-extras/default.nix10
-rw-r--r--pkgs/development/libraries/haskell/semigroupoids/default.nix14
-rw-r--r--pkgs/development/libraries/haskell/shake/default.nix9
-rw-r--r--pkgs/development/libraries/haskell/shakespeare-js/default.nix4
-rw-r--r--pkgs/development/libraries/haskell/shakespeare-text/default.nix4
-rw-r--r--pkgs/development/libraries/haskell/shakespeare/default.nix4
-rw-r--r--pkgs/development/libraries/haskell/simple-sendfile/default.nix4
-rw-r--r--pkgs/development/libraries/haskell/skein/default.nix2
-rw-r--r--pkgs/development/libraries/haskell/snap/snap.nix4
-rw-r--r--pkgs/development/libraries/haskell/system-filepath/default.nix4
-rw-r--r--pkgs/development/libraries/haskell/tar/default.nix2
-rw-r--r--pkgs/development/libraries/haskell/tasty/default.nix4
-rw-r--r--pkgs/development/libraries/haskell/th-lift/default.nix4
-rw-r--r--pkgs/development/libraries/haskell/th-orphans/default.nix4
-rw-r--r--pkgs/development/libraries/haskell/transformers-compat/default.nix2
-rw-r--r--pkgs/development/libraries/haskell/trifecta/default.nix4
-rw-r--r--pkgs/development/libraries/haskell/unix-time/default.nix4
-rw-r--r--pkgs/development/libraries/haskell/usb/default.nix14
-rw-r--r--pkgs/development/libraries/haskell/utf8-light/default.nix4
-rw-r--r--pkgs/development/libraries/haskell/uuid/default.nix2
-rw-r--r--pkgs/development/libraries/haskell/wai-app-static/default.nix4
-rw-r--r--pkgs/development/libraries/haskell/warp/default.nix8
-rw-r--r--pkgs/development/libraries/haskell/yaml/default.nix4
-rw-r--r--pkgs/development/libraries/haskell/yesod-bin/default.nix4
-rw-r--r--pkgs/development/libraries/haskell/yesod-core/default.nix4
-rw-r--r--pkgs/development/libraries/haskell/yesod-form/default.nix4
-rw-r--r--pkgs/development/libraries/haskell/yesod-platform/default.nix4
-rw-r--r--pkgs/development/libraries/haskell/zip-archive/default.nix4
-rw-r--r--pkgs/development/libraries/libav/default.nix2
-rw-r--r--pkgs/development/libraries/libjson-rpc-cpp/default.nix28
-rw-r--r--pkgs/development/libraries/libsodium/default.nix21
-rw-r--r--pkgs/development/libraries/libtoxcore/default.nix36
-rw-r--r--pkgs/development/libraries/libtxc_dxtn/default.nix11
-rw-r--r--pkgs/development/libraries/libusb1/default.nix2
-rw-r--r--pkgs/development/libraries/libvncserver/default.nix47
-rw-r--r--pkgs/development/libraries/libvncserver/default.upstream4
-rw-r--r--pkgs/development/libraries/libxtc_dxtn/default.nix12
-rw-r--r--pkgs/development/libraries/libyaml-cpp/0.3.x.nix18
-rw-r--r--pkgs/development/libraries/libyaml-cpp/default.nix18
-rw-r--r--pkgs/development/libraries/nspr/default.nix4
-rw-r--r--pkgs/development/libraries/nss/default.nix6
-rw-r--r--pkgs/development/libraries/silgraphite/graphite2.nix21
-rw-r--r--pkgs/development/libraries/simgear/default.nix6
-rw-r--r--pkgs/development/lisp-modules/asdf/default.nix40
-rw-r--r--pkgs/development/lisp-modules/asdf/default.upstream2
-rwxr-xr-xpkgs/development/lisp-modules/clwrapper/cl-wrapper.sh44
-rwxr-xr-xpkgs/development/lisp-modules/clwrapper/common-lisp.sh3
-rw-r--r--pkgs/development/lisp-modules/clwrapper/default.nix28
-rw-r--r--pkgs/development/lisp-modules/clwrapper/setup-hook.sh33
-rw-r--r--pkgs/development/lisp-modules/define-package.nix45
-rw-r--r--pkgs/development/lisp-modules/lisp-packages.nix49
-rw-r--r--pkgs/development/lisp-modules/stumpwm/default.nix33
-rw-r--r--pkgs/development/mobile/androidenv/build-app.nix9
-rw-r--r--pkgs/development/mobile/xcodeenv/xcodewrapper.nix3
-rw-r--r--pkgs/development/tools/haskell/packunused/default.nix5
-rw-r--r--pkgs/development/tools/misc/texinfo/5.1.nix2
-rw-r--r--pkgs/development/web/nodejs/default.nix4
-rw-r--r--pkgs/games/flightgear/default.nix80
-rw-r--r--pkgs/games/gsb/default.nix74
-rw-r--r--pkgs/games/sdlmame/default.nix44
-rw-r--r--pkgs/os-specific/linux/conspy/default.nix37
-rw-r--r--pkgs/os-specific/linux/conspy/default.upstream1
-rw-r--r--pkgs/os-specific/linux/i7z/default.nix12
-rw-r--r--pkgs/os-specific/linux/kernel/linux-3.11.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-3.12.nix2
-rw-r--r--pkgs/os-specific/linux/kernel/linux-3.4.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/patches.nix6
-rw-r--r--pkgs/os-specific/linux/systemd/0001-Make-systemctl-daemon-reexec-do-the-right-thing-on-N.patch26
-rw-r--r--pkgs/os-specific/linux/systemd/0002-Ignore-duplicate-paths-in-systemctl-start.patch25
-rw-r--r--pkgs/os-specific/linux/systemd/0003-Start-device-units-for-uninitialised-encrypted-devic.patch32
-rw-r--r--pkgs/os-specific/linux/systemd/0004-Set-switch-to-configuration-hints-for-some-units.patch74
-rw-r--r--pkgs/os-specific/linux/systemd/0005-sysinit.target-Drop-the-dependency-on-local-fs.targe.patch33
-rw-r--r--pkgs/os-specific/linux/systemd/0006-Don-t-call-plymouth-quit.patch38
-rw-r--r--pkgs/os-specific/linux/systemd/0007-Ignore-IPv6-link-local-addresses.patch37
-rw-r--r--pkgs/os-specific/linux/systemd/0008-Don-t-try-to-unmount-nix-or-nix-store.patch28
-rw-r--r--pkgs/os-specific/linux/systemd/0009-Start-ctrl-alt-del.target-irreversibly.patch27
-rw-r--r--pkgs/os-specific/linux/systemd/0010-Fix-CPUShares-configuration-option.patch27
-rw-r--r--pkgs/os-specific/linux/systemd/0011-polkit-Avoid-race-condition-in-scraping-proc.patch75
-rw-r--r--pkgs/os-specific/linux/systemd/default.nix17
-rw-r--r--pkgs/os-specific/linux/systemd/fix-tests-1.patch68
-rw-r--r--pkgs/os-specific/linux/systemd/fixes.patch757
-rw-r--r--pkgs/os-specific/linux/systemd/no-global-install.patch26
-rw-r--r--pkgs/os-specific/linux/ttysnoop/default.nix38
-rw-r--r--pkgs/os-specific/linux/ttysnoop/default.upstream3
-rw-r--r--pkgs/os-specific/linux/usbutils/default.nix14
-rw-r--r--pkgs/servers/http/nginx/default.nix4
-rw-r--r--pkgs/servers/monitoring/munin/adding_servicedir_munin-node.patch84
-rw-r--r--pkgs/servers/monitoring/munin/default.nix48
-rw-r--r--pkgs/servers/monitoring/munin/dont_preserve_source_dir_permissions.patch18
-rw-r--r--pkgs/servers/sql/mysql/5.1.x.nix (renamed from pkgs/servers/sql/mysql51/default.nix)4
-rw-r--r--pkgs/servers/sql/mysql/5.5.x.nix (renamed from pkgs/servers/sql/mysql55/default.nix)4
-rw-r--r--pkgs/servers/sql/mysql/abi_check.patch (renamed from pkgs/servers/sql/mysql51/abi_check.patch)0
-rw-r--r--pkgs/servers/sql/mysql/default.nix16
-rw-r--r--pkgs/servers/sql/mysql5/default.nix34
-rw-r--r--pkgs/servers/sql/postgresql/8.4.x.nix4
-rw-r--r--pkgs/servers/sql/postgresql/9.0.x.nix4
-rw-r--r--pkgs/servers/sql/postgresql/9.1.x.nix4
-rw-r--r--pkgs/servers/sql/postgresql/9.2.x.nix4
-rw-r--r--pkgs/servers/x11/xorg/overrides.nix6
-rw-r--r--pkgs/servers/x11/xorg/xorgserver-cve-2013-4396.patch75
-rw-r--r--pkgs/tools/compression/gzrt/default.nix23
-rw-r--r--pkgs/tools/graphics/asymptote/default.nix10
-rw-r--r--pkgs/tools/misc/plantuml/default.nix37
-rw-r--r--pkgs/tools/networking/curl/7.15.nix75
-rw-r--r--pkgs/tools/package-management/nix/unstable.nix6
-rw-r--r--pkgs/tools/security/fail2ban/default.nix9
-rw-r--r--pkgs/tools/security/prey/default.nix46
-rw-r--r--pkgs/tools/system/pciutils/default.nix7
-rw-r--r--pkgs/tools/system/sleuthkit/default.nix56
-rw-r--r--pkgs/tools/text/xml/html-xml-utils/default.nix20
-rw-r--r--pkgs/tools/text/xml/html-xml-utils/no-Boolean-type.patch20
-rw-r--r--pkgs/tools/typesetting/pdf2djvu/default.nix4
-rw-r--r--pkgs/tools/typesetting/tex/tex4ht/default.nix2
-rw-r--r--pkgs/tools/typesetting/tex/texlive/aggregate.nix17
-rw-r--r--pkgs/tools/typesetting/tex/texlive/cm-super.nix20
-rw-r--r--pkgs/tools/typesetting/tex/texlive/context.nix4
-rw-r--r--pkgs/tools/typesetting/tex/texlive/default.nix52
-rw-r--r--pkgs/tools/typesetting/tex/texlive/extra.nix6
-rw-r--r--pkgs/tools/typesetting/tex/texlive/moderncv.nix6
-rw-r--r--pkgs/tools/typesetting/tex/texlive/moderntimeline.nix6
-rw-r--r--pkgs/tools/typesetting/tex/texlive/pgf.nix4
-rw-r--r--pkgs/tools/typesetting/tex/texlive/xcolor.nix12
-rw-r--r--pkgs/top-level/all-packages.nix137
-rw-r--r--pkgs/top-level/haskell-packages.nix16
-rw-r--r--pkgs/top-level/make-tarball.nix2
-rw-r--r--pkgs/top-level/node-packages-generated.nix591
-rw-r--r--pkgs/top-level/node-packages.json1
-rw-r--r--pkgs/top-level/python-packages-generated.nix50
-rw-r--r--pkgs/top-level/python-packages.json7
-rw-r--r--pkgs/top-level/python-packages.nix49
307 files changed, 5336 insertions, 2634 deletions
diff --git a/lib/options.nix b/lib/options.nix
index e8e01083a77..a91115287e4 100644
--- a/lib/options.nix
+++ b/lib/options.nix
@@ -31,7 +31,7 @@ rec {
   mkEnableOption = name: mkOption {
     default = false;
     example = true;
-    description = "Whether to enable ${name}";
+    description = "Whether to enable ${name}.";
     type = lib.types.bool;
   };
 
@@ -266,16 +266,13 @@ rec {
 
   # Generate documentation template from the list of option declaration like
   # the set generated with filterOptionSets.
-  optionAttrSetToDocList = ignore: newOptionAttrSetToDocList;
-  newOptionAttrSetToDocList = attrs:
+  optionAttrSetToDocList = attrs:
     let options = collect isOption attrs; in
       fold (opt: rest:
         let
           docOption = {
             inherit (opt) name;
-            description = if opt ? description then opt.description else
-              throw "Option ${opt.name}: No description.";
-
+            description = opt.description or (throw "Option ${opt.name}: No description.");
             declarations = map (x: toString x.source) opt.declarations;
             #definitions = map (x: toString x.source) opt.definitions;
           }
@@ -285,7 +282,7 @@ rec {
 
           subOptions =
             if opt ? options then
-              newOptionAttrSetToDocList opt.options
+              optionAttrSetToDocList opt.options
             else
               [];
         in
@@ -298,7 +295,7 @@ rec {
      generation of `options.xml' much more efficient: the XML
      representation of derivations is very large (on the order of
      megabytes) and is not actually used by the manual generator. */
-  scrubOptionValue = x: 
+  scrubOptionValue = x:
     if isDerivation x then { type = "derivation"; drvPath = x.name; outPath = x.name; name = x.name; }
     else if isList x then map scrubOptionValue x
     else if isAttrs x then mapAttrs (n: v: scrubOptionValue v) (removeAttrs x ["_args"])
diff --git a/nixos/doc/manual/configuration.xml b/nixos/doc/manual/configuration.xml
index 965ba73105a..e93c49d1cce 100644
--- a/nixos/doc/manual/configuration.xml
+++ b/nixos/doc/manual/configuration.xml
@@ -592,7 +592,7 @@ users.extraUsers.alice.openssh.authorizedKeys.keys =
 <section><title>IPv4 configuration</title>
 
 <para>By default, NixOS uses DHCP (specifically,
-(<command>dhcpcd</command>)) to automatically configure network
+<command>dhcpcd</command>) to automatically configure network
 interfaces.  However, you can configure an interface manually as
 follows:
 
diff --git a/nixos/doc/manual/default.nix b/nixos/doc/manual/default.nix
index e6edb30985c..56ad652c60e 100644
--- a/nixos/doc/manual/default.nix
+++ b/nixos/doc/manual/default.nix
@@ -3,6 +3,8 @@
 , revision ? "HEAD"
 }:
 
+with pkgs.lib;
+
 let
 
   # To prevent infinite recursion, remove system.path from the
@@ -12,7 +14,7 @@ let
     { system = removeAttrs options.system ["path"]; };
 
   optionsXML = builtins.toFile "options.xml" (builtins.unsafeDiscardStringContext
-    (builtins.toXML (pkgs.lib.optionAttrSetToDocList "" options_)));
+    (builtins.toXML (optionAttrSetToDocList options_)));
 
   optionsDocBook = pkgs.runCommand "options-db.xml" {} ''
     ${pkgs.libxslt}/bin/xsltproc \
@@ -26,7 +28,7 @@ in rec {
   manual = pkgs.stdenv.mkDerivation {
     name = "nixos-manual";
 
-    sources = pkgs.lib.sourceFilesBySuffices ./. [".xml"];
+    sources = sourceFilesBySuffices ./. [".xml"];
 
     buildInputs = [ pkgs.libxml2 pkgs.libxslt ];
 
@@ -71,7 +73,7 @@ in rec {
   manpages = pkgs.stdenv.mkDerivation {
     name = "nixos-manpages";
 
-    sources = pkgs.lib.sourceFilesBySuffices ./. [".xml"];
+    sources = sourceFilesBySuffices ./. [".xml"];
 
     buildInputs = [ pkgs.libxml2 pkgs.libxslt ];
 
diff --git a/nixos/doc/manual/development.xml b/nixos/doc/manual/development.xml
index d8b5f6f571c..7b4e6df5f87 100644
--- a/nixos/doc/manual/development.xml
+++ b/nixos/doc/manual/development.xml
@@ -414,7 +414,7 @@ properly:
 
 <screen>
 $ export NIXOS_CONFIG=/etc/nixos/nixos/modules/installer/cd-dvd/installation-cd-minimal.nix
-$ nix-build /etc/nixos/nixos -A config.system.build.nixosInstall
+$ nix-build /etc/nixos/nixos -A config.system.build.nixos-install
 $ dd if=/dev/zero of=diskimage seek=2G count=0 bs=1
 $ yes | mke2fs -j diskimage
 $ mount -o loop diskimage /mnt
diff --git a/nixos/doc/manual/man-nixos-generate-config.xml b/nixos/doc/manual/man-nixos-generate-config.xml
new file mode 100644
index 00000000000..ff69d8d9170
--- /dev/null
+++ b/nixos/doc/manual/man-nixos-generate-config.xml
@@ -0,0 +1,191 @@
+<refentry xmlns="http://docbook.org/ns/docbook"
+          xmlns:xlink="http://www.w3.org/1999/xlink"
+          xmlns:xi="http://www.w3.org/2001/XInclude">
+
+<refmeta>
+  <refentrytitle><command>nixos-generate-config</command></refentrytitle>
+  <manvolnum>8</manvolnum>
+  <refmiscinfo class="source">NixOS</refmiscinfo>
+  <!-- <refmiscinfo class="version"><xi:include href="version.txt" parse="text"/></refmiscinfo> -->
+</refmeta>
+
+<refnamediv>
+  <refname><command>nixos-generate-config</command></refname>
+  <refpurpose>generate NixOS configuration modules</refpurpose>
+</refnamediv>
+
+<refsynopsisdiv>
+  <cmdsynopsis>
+    <command>nixos-generate-config</command>
+    <arg><option>--force</option></arg>
+    <arg>
+      <arg choice='plain'><option>--root</option></arg>
+      <replaceable>root</replaceable>
+    </arg>
+    <arg>
+      <arg choice='plain'><option>--dir</option></arg>
+      <replaceable>dir</replaceable>
+    </arg>
+  </cmdsynopsis>
+</refsynopsisdiv>
+
+
+<refsection><title>Description</title>
+
+<para>This command writes two NixOS configuration modules:
+
+<variablelist>
+
+  <varlistentry>
+    <term><option>/etc/nixos/hardware-configuration.nix</option></term>
+    <listitem>
+      <para>This module sets NixOS configuration options based on your
+      current hardware configuration.  In particular, it sets the
+      <option>fileSystem</option> option to reflect all currently
+      mounted file systems, the <option>swapDevices</option> option to
+      reflect active swap devices, and the
+      <option>boot.initrd.*</option> options to ensure that the
+      initial ramdisk contains any kernel modules necessary for
+      mounting the root file system.</para>
+
+      <para>If this file already exists, it is overwritten.  Thus, you
+      should not modify it manually.  Rather, you should include it
+      from your <filename>/etc/nixos/configuration.nix</filename>, and
+      re-run <command>nixos-generate-config</command> to update it
+      whenever your hardware configuration changes.</para>
+    </listitem>
+  </varlistentry>
+
+  <varlistentry>
+    <term><option>/etc/nixos/configuration.nix</option></term>
+    <listitem>
+      <para>This is the main NixOS system configuration module.  If it
+      already exists, it’s left unchanged.  Otherwise,
+      <command>nixos-generate-config</command> will write a template
+      for you to customise.</para>
+    </listitem>
+  </varlistentry>
+
+</variablelist>
+
+</para>
+
+</refsection>
+
+
+<refsection><title>Options</title>
+
+<para>This command accepts the following options:</para>
+
+<variablelist>
+
+  <varlistentry>
+    <term><option>--root</option></term>
+    <listitem>
+      <para>If this option is given, treat the directory
+      <replaceable>root</replaceable> as the root of the file system.
+      This means that configuration files will be written to
+      <filename><replaceable>root</replaceable>/etc/nixos</filename>,
+      and that any file systems outside of
+      <replaceable>root</replaceable> are ignored for the purpose of
+      generating the <option>fileSystems</option> option.</para>
+    </listitem>
+  </varlistentry>
+
+  <varlistentry>
+    <term><option>--dir</option></term>
+    <listitem>
+      <para>If this option is given, write the configuration files to
+      the directory <replaceable>dir</replaceable> instead of
+      <filename>/etc/nixos</filename>.</para>
+    </listitem>
+  </varlistentry>
+
+  <varlistentry>
+    <term><option>--force</option></term>
+    <listitem>
+      <para>Overwrite
+      <filename>/etc/nixos/configuration.nix</filename> if it already
+      exists.</para>
+    </listitem>
+  </varlistentry>
+
+</variablelist>
+
+</refsection>
+
+
+<refsection><title>Examples</title>
+
+<para>This command is typically used during NixOS installation to
+write initial configuration modules.  For example, if you created and
+mounted the target file systems on <filename>/mnt</filename> and
+<filename>/mnt/boot</filename>, you would run:
+
+<screen>
+$ nixos-generate-config --root /mnt
+</screen>
+
+The resulting file
+<filename>/mnt/etc/nixos/hardware-configuration.nix</filename> might
+look like this:
+
+<programlisting>
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, pkgs, ... }:
+
+{
+  imports =
+    [ &lt;nixos/modules/installer/scan/not-detected.nix>
+    ];
+
+  boot.initrd.availableKernelModules = [ "ehci_hcd" "ahci" ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-label/nixos";
+      fsType = "ext3";
+      options = "rw,data=ordered,relatime";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/sda1";
+      fsType = "ext3";
+      options = "rw,errors=continue,user_xattr,acl,barrier=1,data=writeback,relatime";
+    };
+
+  swapDevices =
+    [ { device = "/dev/sda2"; }
+    ];
+
+  nix.maxJobs = 8;
+}
+</programlisting>
+
+It will also create a basic
+<filename>/mnt/etc/nixos/configuration.nix</filename>, which you
+should edit to customise the logical configuration of your system.
+This file includes the result of the hardware scan as follows:
+
+<programlisting>
+  imports = [ ./hardware-configuration.nix ];
+</programlisting>
+</para>
+
+<para>After installation, if your hardware configuration changes, you
+can run:
+
+<screen>
+$ nixos-generate-config
+</screen>
+
+to update <filename>/etc/nixos/hardware-configuration.nix</filename>.
+Your <filename>/etc/nixos/configuration.nix</filename> will
+<emphasis>not</emphasis> be overwritten.</para>
+
+</refsection>
+
+</refentry>
diff --git a/nixos/doc/manual/man-nixos-install.xml b/nixos/doc/manual/man-nixos-install.xml
new file mode 100644
index 00000000000..d5157859857
--- /dev/null
+++ b/nixos/doc/manual/man-nixos-install.xml
@@ -0,0 +1,78 @@
+<refentry xmlns="http://docbook.org/ns/docbook"
+          xmlns:xlink="http://www.w3.org/1999/xlink"
+          xmlns:xi="http://www.w3.org/2001/XInclude">
+
+<refmeta>
+  <refentrytitle><command>nixos-install</command></refentrytitle>
+  <manvolnum>8</manvolnum>
+  <refmiscinfo class="source">NixOS</refmiscinfo>
+  <!-- <refmiscinfo class="version"><xi:include href="version.txt" parse="text"/></refmiscinfo> -->
+</refmeta>
+
+<refnamediv>
+  <refname><command>nixos-install</command></refname>
+  <refpurpose>install NixOS</refpurpose>
+</refnamediv>
+
+<refsynopsisdiv>
+  <cmdsynopsis>
+    <command>nixos-install</command>
+  </cmdsynopsis>
+</refsynopsisdiv>
+
+
+<refsection><title>Description</title>
+
+<para>This command installs NixOS in the file system mounted on
+<filename>/mnt</filename>, based on the NixOS configuration specified
+in <filename>/mnt/etc/nixos/configuration.nix</filename>.  It performs
+the following steps:
+
+<itemizedlist>
+
+  <listitem><para>It copies Nix and its dependencies to
+  <filename>/mnt/nix/store</filename>.</para></listitem>
+
+  <listitem><para>It runs Nix in <filename>/mnt</filename> to build
+  the NixOS configuration specified in
+  <filename>/mnt/etc/nixos/configuration.nix</filename>.</para></listitem>
+
+  <listitem><para>It installs the GRUB boot loader on the device
+  specified in the option <option>boot.loader.grub.device</option>,
+  and generates a GRUB configuration file that boots into the NixOS
+  configuration just installed.</para></listitem>
+
+</itemizedlist>
+
+</para>
+
+<para>This command is idempotent: if it is interrupted or fails due to
+a temporary problem (e.g. a network issue), you can safely re-run
+it.</para>
+
+</refsection>
+
+
+<refsection><title>Examples</title>
+
+<para>A typical NixOS installation is done by creating and mounting a
+file system on <filename>/mnt</filename>, generating a NixOS
+configuration in
+<filename>/mnt/etc/nixos/configuration.nix</filename>, and running
+<command>nixos-install</command>.  For instance, if we want to install
+NixOS on an <literal>ext4</literal> file system created in
+<filename>/dev/sda1</filename>:
+
+<screen>
+$ mkfs.ext4 /dev/sda1
+$ mount /dev/sda1 /mnt
+$ nixos-generate-config --root /mnt
+$ # edit /mnt/etc/nixos/configuration.nix
+$ nixos-install
+</screen>
+
+</para>
+
+</refsection>
+
+</refentry>
diff --git a/nixos/doc/manual/man-nixos-option.xml b/nixos/doc/manual/man-nixos-option.xml
index f7a8ce403dc..bd180363e70 100644
--- a/nixos/doc/manual/man-nixos-option.xml
+++ b/nixos/doc/manual/man-nixos-option.xml
@@ -18,17 +18,12 @@
   <cmdsynopsis>
     <command>nixos-option</command>
     <group choice="opt">
-      <option>-i</option>
-      <option>v</option>
-      <option>d</option>
-      <option>l</option>
+      <option>-v</option>
+      <option>-d</option>
+      <option>-l</option>
     </group>
     <arg choice='plain'><replaceable>option.name</replaceable></arg>
   </cmdsynopsis>
-  <cmdsynopsis>
-    <command>nixos-option</command>
-    <arg choice='plain'><option>--install</option></arg>
-  </cmdsynopsis>
 </refsynopsisdiv>
 
 
@@ -40,16 +35,7 @@ of the option name given as argument.  By default, it returns the value of
 the option.</para>
 
 <para>When the option name is not an option, the command prints the list of
-attributes in contained in the attribute set.  This could used to provide
-completion in some editors.</para>
-
-<para>When the option <option>--install</option> (or <option>-i</option>) is
-used with no option name, this command generates a template configuration
-with a scan of the target system.  It produces a template configuration
-in <filename>/etc/nixos/configuration.nix</filename>, and a scan of the
-machine in <filename>/etc/nixos/hardware-configuration.nix</filename>.  The
-scan of the machine is produced
-by <command>nixos-hardware-scan</command>.</para>
+attributes contained in the attribute set.</para>
 
 </refsection>
 
@@ -60,15 +46,6 @@ by <command>nixos-hardware-scan</command>.</para>
 <variablelist>
 
   <varlistentry>
-    <term><option>--install</option>, <option>-i</option></term>
-    <listitem>
-      <para>Use the installation configuration instead of current system
-      configuration.  Generate a template configuration if no option name is
-      specified.</para>
-    </listitem>
-  </varlistentry>
-
-  <varlistentry>
     <term><option>--value</option>, <option>-v</option></term>
     <listitem>
       <para>Returns the value of the option.  This is the default operation
@@ -103,15 +80,6 @@ by <command>nixos-hardware-scan</command>.</para>
 <variablelist>
 
   <varlistentry>
-    <term><envar>mountPoint</envar></term>
-    <listitem>
-      <para>Location of the target file system.  Defaults to
-      <filename>/mnt</filename>.  This environment variable is only used in
-      combinaison with <option>--install</option> option.</para>
-    </listitem>
-  </varlistentry>
-
-  <varlistentry>
     <term><envar>NIXOS_CONFIG</envar></term>
     <listitem>
       <para>Path to the main NixOS configuration module.  Defaults to
diff --git a/nixos/doc/manual/man-nixos-rebuild.xml b/nixos/doc/manual/man-nixos-rebuild.xml
index e43dafd3cfe..e08153c723d 100644
--- a/nixos/doc/manual/man-nixos-rebuild.xml
+++ b/nixos/doc/manual/man-nixos-rebuild.xml
@@ -33,6 +33,14 @@
     <arg><option>--fast</option></arg>
     <arg><option>--rollback</option></arg>
     <sbr />
+    <arg>
+      <group choice='req'>
+        <arg choice='plain'><option>--profile-name</option></arg>
+        <arg choice='plain'><option>-p</option></arg>
+      </group>
+      <replaceable>name</replaceable>
+    </arg>
+    <sbr />
     <arg><option>--show-trace</option></arg>
   </cmdsynopsis>
 </refsynopsisdiv>
@@ -229,7 +237,34 @@ $ ./result/bin/run-*-vm
       <filename>/etc/nixos/configuration.nix</filename>, roll back to
       the previous configuration.  (The previous configuration is
       defined as the one before the “current” generation of the
-      profile <filename>/nix/var/nix/profiles/system</filename>.)</para>
+      Nix profile <filename>/nix/var/nix/profiles/system</filename>.)</para>
+    </listitem>
+  </varlistentry>
+
+  <varlistentry>
+    <term><option>--profile-name</option></term>
+    <term><option>-p</option></term>
+    <listitem>
+      <para>Instead of using the Nix profile
+      <filename>/nix/var/nix/profiles/system</filename> to keep track
+      of the current and previous system configurations, use
+      <filename>/nix/var/nix/profiles/system-profiles/<replaceable>name</replaceable></filename>.
+      When you use GRUB 2, for every system profile created with this
+      flag, NixOS will create a submenu named “NixOS - Profile
+      '<replaceable>name</replaceable>'” in GRUB’s boot menu,
+      containing the current and previous configurations of this
+      profile.</para>
+
+      <para>For instance, if you want to test a configuration file
+      named <filename>test.nix</filename> without affecting the
+      default system profile, you would do:
+
+<screen>
+$ nixos-rebuild switch -p test -I nixos-config=./test.nix
+</screen>
+
+      The new configuration will appear in the GRUB 2 submenu “NixOS - Profile
+      'test'”.</para>
     </listitem>
   </varlistentry>
 
diff --git a/nixos/doc/manual/man-pages.xml b/nixos/doc/manual/man-pages.xml
index 7840e1b897b..467864e208b 100644
--- a/nixos/doc/manual/man-pages.xml
+++ b/nixos/doc/manual/man-pages.xml
@@ -15,17 +15,17 @@
     </author>
 
     <copyright>
-      <year>2007</year>
-      <year>2008</year>
-      <year>2009</year>
+      <year>2007-2013</year>
       <holder>Eelco Dolstra</holder>
     </copyright>
-    
+
   </info>
-  
+
   <xi:include href="man-configuration.xml" />
-  <xi:include href="man-nixos-rebuild.xml" />
-  <xi:include href="man-nixos-option.xml" />
   <xi:include href="man-nixos-build-vms.xml" />
-  
+  <xi:include href="man-nixos-generate-config.xml" />
+  <xi:include href="man-nixos-install.xml" />
+  <xi:include href="man-nixos-option.xml" />
+  <xi:include href="man-nixos-rebuild.xml" />
+
 </reference>
diff --git a/nixos/doc/manual/userconfiguration.xml b/nixos/doc/manual/userconfiguration.xml
deleted file mode 100644
index 7c6540caf3a..00000000000
--- a/nixos/doc/manual/userconfiguration.xml
+++ /dev/null
@@ -1,80 +0,0 @@
-<chapter xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink">
-
-<title>Configuration in home directory</title>
-
-
-<!--===============================================================-->
-
-<section>
-<title>Compiz Fusion</title>
-<para>
-	Compiz Fusion is just a set of plugins for Compiz. Your best interest is to have
-	them found both by Compiz and by Compiz Configuration Settings (also in Compiz Fusion
-	distribution). By default they look in Compiz installation path and in home directory.
-	You do not need to track /nix/store manually - everything is already in 
-	/run/current-system/sw/share.
-
-	<orderedlist>
-	<listitem><para><filename>$HOME/.compiz/plugins</filename> 
-	should contain plugins you want to load. All the installed 
-	plugins are available in 
-	<filename>/run/current-system/sw/share/compiz-plugins/compiz/</filename>,
-	so you can use symlinks to this directory.
-	</para></listitem>
-
-	<listitem><para><filename>$HOME/.compiz/metadata</filename> 
-	should contain metadata (definition of configuration options) for plugins 
-	you want to load. All the installed metadata is available in 
-	<filename>/run/current-system/sw/share/compiz/</filename>,
-	so you can use symlinks to this directory.
-	</para></listitem>
-
-	<listitem><para>
-	Probably a way to load <literal>GConf</literal> configuration backend by default 
-	should be found, but if you run <literal>Compiz</literal> with 
-	<literal>GConf</literal> configuration (default for <literal>X server</literal> job
-	for now), you have to link 
-	<filename>/run/current-system/sw/share/compizconfig/backends/</filename>
-	into <filename>$HOME/.compizconfig/backends</filename> directory.
-	</para></listitem>
-
-	</orderedlist>
-
-        To summarize the above, these are the commands you have to execute
-        <command>ln -s /run/current-system/sw/share/compiz/ $HOME/.compiz/metadata</command>
-        <command>ln -s /run/current-system/sw/share/compiz-plugins/compiz/ $HOME/.compiz/plugins</command>
-        <command>ln -s /run/current-system/sw/share/compizconfig/backends/ $HOME/.compizconfig/backends</command>
-
-	Now you can launch <literal>ccsm</literal> and configure everything. You should select
-	GConf as a backend in the preferences menu of <literal>ccsm</literal>
-</para>
-</section>
-
-<section>
-<title>Pidgin-LaTeX</title>
-<para>
-	To have pidgin-latex plugin working after installation, you need the following:
-	<orderedlist>
-	<listitem><para>
-	Symlink <filename>/run/current-system/sw/share/pidgin-latex/pidgin-latex.so</filename>
-	to <filename>$HOME/.purple/plugins/pidgin-latex.so</filename>
-	</para></listitem>
-	<listitem><para>
-	Enable smileys. If you do not want to, you can create 
-	<filename>$HOME/.purple/smileys/empty/theme</filename> with the following contents: 
-	<programlisting>
-	Name=Empty
-	Description=No predefined smileys
-	Author=Nobody
-	</programlisting>	
-	Enabling this theme will enable smileys, but define none.
-	</para></listitem>
-	<listitem><para>
-	Enable the plugin.
-	</para></listitem>	
-	</orderedlist>	
-	</para>
-	</section>
-
-</chapter>
diff --git a/nixos/lib/build-vms.nix b/nixos/lib/build-vms.nix
index aad85aedc48..d20fbc1cc66 100644
--- a/nixos/lib/build-vms.nix
+++ b/nixos/lib/build-vms.nix
@@ -1,6 +1,6 @@
 { system, minimal ? false }:
 
-let pkgs = import ../.. { config = {}; inherit system; }; in
+let pkgs = import ./nixpkgs.nix { config = {}; inherit system; }; in
 
 with pkgs.lib;
 with import ../lib/qemu-flags.nix;
diff --git a/nixos/lib/eval-config.nix b/nixos/lib/eval-config.nix
index 89f81cf70bd..72ba66cdbac 100644
--- a/nixos/lib/eval-config.nix
+++ b/nixos/lib/eval-config.nix
@@ -30,7 +30,7 @@ rec {
   extraArgs = extraArgs_ // {
     inherit pkgs modules baseModules;
     modulesPath = ../modules;
-    pkgs_i686 = import ../.. { system = "i686-linux"; };
+    pkgs_i686 = import ./nixpkgs.nix { system = "i686-linux"; };
     utils = import ./utils.nix pkgs;
   };
 
@@ -47,7 +47,7 @@ rec {
   pkgs =
     if pkgs_ != null
     then pkgs_
-    else import ../.. (
+    else import ./nixpkgs.nix (
       let
         system = if nixpkgsOptions.system != "" then nixpkgsOptions.system else system_;
         nixpkgsOptions = (import ./eval-config.nix {
@@ -55,7 +55,7 @@ rec {
           # For efficiency, leave out most NixOS modules; they don't
           # define nixpkgs.config, so it's pointless to evaluate them.
           baseModules = [ ../modules/misc/nixpkgs.nix ];
-          pkgs = import ../.. { system = system_; config = {}; };
+          pkgs = import ./nixpkgs.nix { system = system_; config = {}; };
         }).optionDefinitions.nixpkgs;
       in
       {
diff --git a/nixos/lib/nixpkgs.nix b/nixos/lib/nixpkgs.nix
new file mode 100644
index 00000000000..10096f58c79
--- /dev/null
+++ b/nixos/lib/nixpkgs.nix
@@ -0,0 +1,8 @@
+/* Terrible backward compatibility hack to get the path to Nixpkgs
+   from here.  Usually, that's the relative path ‘../..’.  However,
+   when using the NixOS channel, <nixos> resolves to a symlink to
+   nixpkgs/nixos, so ‘../..’ doesn't resolve to the top-level Nixpkgs
+   directory but one above it.  So check for that situation. */
+if builtins.pathExists ../../.version then import ../..
+else if builtins.pathExists ../../nixpkgs then import ../../nixpkgs
+else abort "Can't find Nixpkgs, please set ‘NIX_PATH=nixpkgs=/path/to/nixpkgs’."
diff --git a/nixos/lib/testing.nix b/nixos/lib/testing.nix
index 7be0903ed3a..3407229e921 100644
--- a/nixos/lib/testing.nix
+++ b/nixos/lib/testing.nix
@@ -176,7 +176,10 @@ rec {
     let
       vm = buildVM { }
         [ machine
-          { key = "hostname"; networking.hostName = "client"; }
+          { key = "run-in-machine";
+            networking.hostName = "client";
+            nix.readOnlyStore = false;
+          }
         ];
 
       buildrunner = writeText "vm-build" ''
@@ -192,9 +195,11 @@ rec {
 
       testscript = ''
         startAll;
+        $client->waitForUnit("multi-user.target");
         ${preBuild}
         $client->succeed("env -i ${pkgs.bash}/bin/bash ${buildrunner} /tmp/xchg/saved-env >&2");
         ${postBuild}
+        $client->succeed("sync"); # flush all data before pulling the plug
       '';
 
       vmRunCommand = writeText "vm-run" ''
diff --git a/nixos/modules/installer/cd-dvd/channel.nix b/nixos/modules/installer/cd-dvd/channel.nix
index 987b85d6165..c6e0f1577bb 100644
--- a/nixos/modules/installer/cd-dvd/channel.nix
+++ b/nixos/modules/installer/cd-dvd/channel.nix
@@ -14,10 +14,7 @@ let
     { expr = builtins.readFile ../../../lib/channel-expr.nix; }
     ''
       mkdir -p $out/nixos
-      # FIXME: should use ../../../.. instead of <nixpkgs>, but that
-      # doesn't work properly if <nixos> is a symlink to
-      # nixpkgs/nixos.
-      cp -prd ${<nixpkgs>} $out/nixos/nixpkgs
+      cp -prd ${pkgs.path} $out/nixos/nixpkgs
       ln -s nixpkgs/nixos $out/nixos/nixos
       chmod -R u+w $out/nixos
       rm -rf $out/nixos/nixpkgs/.git
diff --git a/nixos/modules/installer/tools/nixos-build-vms/nixos-build-vms.sh b/nixos/modules/installer/tools/nixos-build-vms/nixos-build-vms.sh
index 0a6e8b920a1..f9cbfffde70 100644
--- a/nixos/modules/installer/tools/nixos-build-vms/nixos-build-vms.sh
+++ b/nixos/modules/installer/tools/nixos-build-vms/nixos-build-vms.sh
@@ -2,14 +2,9 @@
 
 # Shows the usage of this command to the user
 
-showUsage()
-{
-    echo "Usage: $0 network_expr"
-    echo "Options:"
-    echo
-    echo "--no-out-link   Do not create a 'result' symlink"
-    echo "--show-trace    Shows the output trace"
-    echo "-h,--help       Shows the usage of this command"
+showUsage() {
+    exec man nixos-build-vms
+    exit 1
 }
 
 # Parse valid argument options
diff --git a/nixos/modules/installer/tools/nixos-gen-seccure-keys.sh b/nixos/modules/installer/tools/nixos-gen-seccure-keys.sh
deleted file mode 100644
index a97eef672f7..00000000000
--- a/nixos/modules/installer/tools/nixos-gen-seccure-keys.sh
+++ /dev/null
@@ -1,13 +0,0 @@
-#! @shell@ -e
-
-mkdir -p /var/elliptic-keys
-chmod 0755 /var/elliptic-keys
-cd /var/elliptic-keys
-touch private
-chmod 0700 private
-dd if=/dev/urandom bs=128 count=1 of=private
-chmod 0500 private
-public=$(seccure-key -F private 2>&1)
-echo ${public#*The public key is: } > public
-chmod 0555 public
-
diff --git a/nixos/modules/installer/tools/nixos-generate-config.pl b/nixos/modules/installer/tools/nixos-generate-config.pl
new file mode 100644
index 00000000000..3418b0122de
--- /dev/null
+++ b/nixos/modules/installer/tools/nixos-generate-config.pl
@@ -0,0 +1,452 @@
+#! @perl@
+
+use File::Spec;
+use File::Path;
+use File::Basename;
+use File::Slurp;
+
+
+sub uniq {
+    my %seen;
+    my @res = ();
+    foreach my $s (@_) {
+        if (!defined $seen{$s}) {
+            $seen{$s} = 1;
+            push @res, $s;
+        }
+    }
+    return @res;
+}
+
+
+# Process the command line.
+my $outDir = "/etc/nixos";
+my $rootDir = ""; # = /
+my $force = 0;
+
+for (my $n = 0; $n < scalar @ARGV; $n++) {
+    my $arg = $ARGV[$n];
+    if ($arg eq "--help") {
+        exec "man nixos-generate-config" or die;
+    }
+    elsif ($arg eq "--dir") {
+        $n++;
+        $outDir = $ARGV[$n];
+        die "$0: ‘--dir’ requires an argument\n" unless defined $outDir;
+    }
+    elsif ($arg eq "--root") {
+        $n++;
+        $rootDir = $ARGV[$n];
+        die "$0: ‘--root’ requires an argument\n" unless defined $rootDir;
+        $rootDir =~ s/\/*$//; # remove trailing slashes
+    }
+    elsif ($arg eq "--force") {
+        $force = 1;
+    }
+    else {
+        die "$0: unrecognized argument ‘$arg’\n";
+    }
+}
+
+
+my @attrs = ();
+my @kernelModules = ();
+my @initrdKernelModules = ();
+my @modulePackages = ();
+my @imports = ("<nixos/modules/installer/scan/not-detected.nix>");
+
+
+sub debug {
+    return unless defined $ENV{"DEBUG"};
+    print STDERR @_;
+}
+
+
+my $cpuinfo = read_file "/proc/cpuinfo";
+
+
+sub hasCPUFeature {
+    my $feature = shift;
+    return $cpuinfo =~ /^flags\s*:.* $feature( |$)/m;
+}
+
+
+# Detect the number of CPU cores.
+my $cpus = scalar (grep {/^processor\s*:/} (split '\n', $cpuinfo));
+
+
+# Virtualization support?
+push @kernelModules, "kvm-intel" if hasCPUFeature "vmx";
+push @kernelModules, "kvm-amd" if hasCPUFeature "svm";
+
+
+# Look at the PCI devices and add necessary modules.  Note that most
+# modules are auto-detected so we don't need to list them here.
+# However, some are needed in the initrd to boot the system.
+
+my $videoDriver;
+
+sub pciCheck {
+    my $path = shift;
+    my $vendor = read_file "$path/vendor";
+    my $device = read_file "$path/device";
+    my $class = read_file "$path/class";
+
+    my $module;
+    if (-e "$path/driver/module") {
+        $module = basename `readlink -f $path/driver/module`;
+        chomp $module;
+    }
+
+    debug "$path: $vendor $device $class";
+    debug " $module" if defined $module;
+    debug "\n";
+
+    if (defined $module) {
+        # See the bottom of http://pciids.sourceforge.net/pci.ids for
+        # device classes.
+        if (# Mass-storage controller.  Definitely important.
+            $class =~ /^0x01/ ||
+
+            # Firewire controller.  A disk might be attached.
+            $class =~ /^0x0c00/ ||
+
+            # USB controller.  Needed if we want to use the
+            # keyboard when things go wrong in the initrd.
+            $class =~ /^0x0c03/
+            )
+        {
+            push @initrdAvailableKernelModules, $module;
+        }
+    }
+
+    # broadcom STA driver (wl.ko)
+    # list taken from http://www.broadcom.com/docs/linux_sta/README.txt
+    if ($vendor eq "0x14e4" &&
+        ($device eq "0x4311" || $device eq "0x4312" || $device eq "0x4313" ||
+         $device eq "0x4315" || $device eq "0x4327" || $device eq "0x4328" ||
+         $device eq "0x4329" || $device eq "0x432a" || $device eq "0x432b" ||
+         $device eq "0x432c" || $device eq "0x432d" || $device eq "0x4353" ||
+         $device eq "0x4357" || $device eq "0x4358" || $device eq "0x4359" ) )
+     {
+        push @modulePackages, "config.boot.kernelPackages.broadcom_sta";
+        push @kernelModules, "wl";
+     }
+
+    # Can't rely on $module here, since the module may not be loaded
+    # due to missing firmware.  Ideally we would check modules.pcimap
+    # here.
+    push @attrs, "networking.enableIntel2200BGFirmware = true;" if
+        $vendor eq "0x8086" &&
+        ($device eq "0x1043" || $device eq "0x104f" || $device eq "0x4220" ||
+         $device eq "0x4221" || $device eq "0x4223" || $device eq "0x4224");
+
+    push @attrs, "networking.enableIntel3945ABGFirmware = true;" if
+        $vendor eq "0x8086" &&
+        ($device eq "0x4229" || $device eq "0x4230" ||
+         $device eq "0x4222" || $device eq "0x4227");
+
+    # Assume that all NVIDIA cards are supported by the NVIDIA driver.
+    # There may be exceptions (e.g. old cards).
+    $videoDriver = "nvidia" if $vendor eq "0x10de" && $class =~ /^0x03/;
+}
+
+foreach my $path (glob "/sys/bus/pci/devices/*") {
+    pciCheck $path;
+}
+
+push @attrs, "services.xserver.videoDrivers = [ \"$videoDriver\" ];" if $videoDriver;
+
+
+# Idem for USB devices.
+
+sub usbCheck {
+    my $path = shift;
+    my $class = read_file "$path/bInterfaceClass";
+    my $subclass = read_file "$path/bInterfaceSubClass";
+    my $protocol = read_file "$path/bInterfaceProtocol";
+
+    my $module;
+    if (-e "$path/driver/module") {
+        $module = basename `readlink -f $path/driver/module`;
+        chomp $module;
+    }
+
+    debug "$path: $class $subclass $protocol";
+    debug " $module" if defined $module;
+    debug "\n";
+
+    if (defined $module) {
+        if (# Mass-storage controller.  Definitely important.
+            $class eq "08" ||
+
+            # Keyboard.  Needed if we want to use the
+            # keyboard when things go wrong in the initrd.
+            ($class eq "03" && $protocol eq "01")
+            )
+        {
+            push @initrdAvailableKernelModules, $module;
+        }
+    }
+}
+
+foreach my $path (glob "/sys/bus/usb/devices/*") {
+    if (-e "$path/bInterfaceClass") {
+        usbCheck $path;
+    }
+}
+
+
+# Add the modules for all block devices.
+foreach my $path (glob "/sys/class/block/*") {
+    my $module;
+    if (-e "$path/device/driver/module") {
+        $module = basename `readlink -f $path/device/driver/module`;
+        chomp $module;
+        push @initrdAvailableKernelModules, $module;
+    }
+}
+
+
+# Check if we're a VirtualBox guest.  If so, enable the guest
+# additions.
+my $dmi = `@dmidecode@/sbin/dmidecode`;
+if ($dmi =~ /Manufacturer: innotek/) {
+    push @attrs, "services.virtualbox.enable = true;"
+}
+
+
+# Generate the swapDevices option from the currently activated swap
+# devices.
+my @swaps = read_file("/proc/swaps");
+shift @swaps;
+my @swapDevices;
+foreach my $swap (@swaps) {
+    $swap =~ /^(\S+)\s/;
+    push @swapDevices, "{ device = \"$1\"; }";
+}
+
+
+# Generate the fileSystems option from the currently mounted
+# filesystems.
+sub in {
+    my ($d1, $d2) = @_;
+    return $d1 eq $d2 || substr($d1, 0, length($d2) + 1) eq "$d2/";
+}
+
+my $fileSystems;
+my %fsByDev;
+foreach my $fs (read_file("/proc/self/mountinfo")) {
+    chomp $fs;
+    my @fields = split / /, $fs;
+    my $mountPoint = $fields[4];
+    next unless -d $mountPoint;
+    my @mountOptions = split /,/, $fields[5];
+
+    next if !in($mountPoint, $rootDir);
+    $mountPoint = substr($mountPoint, length($rootDir)); # strip the root directory (e.g. /mnt)
+    $mountPoint = "/" if $mountPoint eq "";
+
+    # Skip special filesystems.
+    next if in($mountPoint, "/proc") || in($mountPoint, "/dev") || in($mountPoint, "/sys") || in($mountPoint, "/run");
+
+    # Skip the optional fields.
+    my $n = 6; $n++ while $fields[$n] ne "-"; $n++;
+    my $fsType = $fields[$n];
+    my $device = $fields[$n + 1];
+    my @superOptions = split /,/, $fields[$n + 2];
+
+    # Skip the read-only bind-mount on /nix/store.
+    next if $mountPoint eq "/nix/store" && (grep { $_ eq "rw" } @superOptions) && (grep { $_ eq "ro" } @mountOptions);
+
+    # Maybe this is a bind-mount of a filesystem we saw earlier?
+    if (defined $fsByDev{$fields[2]}) {
+        my $path = $fields[3]; $path = "" if $path eq "/";
+        $fileSystems .= <<EOF;
+  fileSystems.\"$mountPoint\" =
+    { device = \"$fsByDev{$fields[2]}$path\";
+      fsType = \"none\";
+      options = \"bind\";
+    };
+
+EOF
+        next;
+    }
+    $fsByDev{$fields[2]} = $mountPoint;
+
+    # We don't know how to handle FUSE filesystems.
+    if ($fsType eq "fuseblk" || $fsType eq "fuse") {
+        print STDERR "warning: don't know how to emit ‘fileSystem’ option for FUSE filesystem ‘$mountPoint’\n";
+        next;
+    }
+
+    # Is this a mount of a loopback device?
+    my @extraOptions;
+    if ($device =~ /\/dev\/loop(\d+)/) {
+        my $loopnr = $1;
+        my $backer = read_file "/sys/block/loop$loopnr/loop/backing_file";
+        if (defined $backer) {
+            chomp $backer;
+            $device = $backer;
+            push @extraOptions, "loop";
+        }
+    }
+
+    # Emit the filesystem.
+    $fileSystems .= <<EOF;
+  fileSystems.\"$mountPoint\" =
+    { device = \"$device\";
+      fsType = \"$fsType\";
+      options = \"${\join ",", uniq(@extraOptions, @superOptions, @mountOptions)}\";
+    };
+
+EOF
+}
+
+
+# Generate the hardware configuration file.
+
+sub toNixExpr {
+    my $res = "";
+    foreach my $s (@_) {
+        $res .= " \"$s\"";
+    }
+    return $res;
+}
+
+sub multiLineList {
+    my $indent = shift;
+    return "[ ]" if !@_;
+    $res = "\n${indent}[ ";
+    my $first = 1;
+    foreach my $s (@_) {
+        $res .= "$indent  " if !$first;
+        $first = 0;
+        $res .= "$s\n";
+    }
+    $res .= "$indent]";
+    return $res;
+}
+
+my $initrdAvailableKernelModules = toNixExpr(uniq @initrdAvailableKernelModules);
+my $kernelModules = toNixExpr(uniq @kernelModules);
+my $modulePackages = toNixExpr(uniq @modulePackages);
+
+$outDir = "$rootDir$outDir";
+
+my $fn = "$outDir/hardware-configuration.nix";
+print STDERR "writing $fn...\n";
+mkpath($outDir, 0, 0755);
+
+write_file($fn, <<EOF);
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, pkgs, ... }:
+
+{
+  imports = ${\multiLineList("    ", @imports)};
+
+  boot.initrd.availableKernelModules = [$initrdAvailableKernelModules ];
+  boot.kernelModules = [$kernelModules ];
+  boot.extraModulePackages = [$modulePackages ];
+
+${fileSystems}  swapDevices = ${\multiLineList("    ", @swapDevices)};
+
+  nix.maxJobs = $cpus;
+${\join "", (map { "  $_\n" } (uniq @attrs))}}
+EOF
+
+
+# Generate a basic configuration.nix, unless one already exists.
+$fn = "$outDir/configuration.nix";
+if ($force || ! -e $fn) {
+    print STDERR "writing $fn...\n";
+
+    my $bootloaderConfig;
+    if (-e "/sys/firmware/efi/efivars") {
+        $bootLoaderConfig = <<EOF;
+  # Use the gummiboot efi boot loader.
+  boot.loader.grub.enable = false;
+  boot.loader.gummiboot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+  # !!! Remove this when nixos is on 3.10 or greater by default
+  # EFI booting requires kernel >= 3.10
+  boot.kernelPackages = pkgs.linuxPackages_3_10;
+EOF
+    } else {
+        $bootLoaderConfig = <<EOF;
+  # Use the GRUB 2 boot loader.
+  boot.loader.grub.enable = true;
+  boot.loader.grub.version = 2;
+  # Define on which hard drive you want to install Grub.
+  # boot.loader.grub.device = "/dev/sda";
+EOF
+    }
+
+    write_file($fn, <<EOF);
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running ‘nixos-help’).
+
+{ config, pkgs, ... }:
+
+{
+  imports =
+    [ # Include the results of the hardware scan.
+      ./hardware-configuration.nix
+    ];
+
+  boot.initrd.kernelModules =
+    [ # Specify all kernel modules that are necessary for mounting the root
+      # filesystem.
+      # "xfs" "ata_piix"
+      # fbcon # Uncomment this when EFI booting to see the console before the root partition is mounted
+    ];
+
+$bootLoaderConfig
+  # networking.hostName = "nixos"; # Define your hostname.
+  # networking.wireless.enable = true;  # Enables wireless.
+
+  # Add filesystem entries for each partition that you want to see
+  # mounted at boot time.  This should include at least the root
+  # filesystem.
+
+  # fileSystems."/".device = "/dev/disk/by-label/nixos";
+
+  # fileSystems."/data" =     # where you want to mount the device
+  #   { device = "/dev/sdb";  # the device
+  #     fsType = "ext3";      # the type of the partition
+  #     options = "data=journal";
+  #   };
+
+  # Select internationalisation properties.
+  # i18n = {
+  #   consoleFont = "lat9w-16";
+  #   consoleKeyMap = "us";
+  #   defaultLocale = "en_US.UTF-8";
+  # };
+
+  # List services that you want to enable:
+
+  # Enable the OpenSSH daemon.
+  # services.openssh.enable = true;
+
+  # Enable CUPS to print documents.
+  # services.printing.enable = true;
+
+  # Enable the X11 windowing system.
+  # services.xserver.enable = true;
+  # services.xserver.layout = "us";
+  # services.xserver.xkbOptions = "eurosign:e";
+
+  # Enable the KDE Desktop Environment.
+  # services.xserver.displayManager.kdm.enable = true;
+  # services.xserver.desktopManager.kde4.enable = true;
+}
+EOF
+} else {
+    print STDERR "warning: not overwriting existing $fn\n";
+}
+
+# workaround for a bug in substituteAll
diff --git a/nixos/modules/installer/tools/nixos-hardware-scan.pl b/nixos/modules/installer/tools/nixos-hardware-scan.pl
deleted file mode 100644
index 3204f3d4051..00000000000
--- a/nixos/modules/installer/tools/nixos-hardware-scan.pl
+++ /dev/null
@@ -1,248 +0,0 @@
-#! @perl@/bin/perl -w
-
-use File::Spec;
-use File::Basename;
-
-
-my @attrs = ();
-my @kernelModules = ();
-my @initrdKernelModules = ();
-my @modulePackages = ();
-my @imports = ("<nixos/modules/installer/scan/not-detected.nix>");
-
-
-sub debug {
-    return unless defined $ENV{"DEBUG"};
-    print STDERR @_;
-}
-
-
-# Read a file, returning undef if the file cannot be opened.
-sub readFile {
-    my $filename = shift;
-    my $res;
-    if (open FILE, "<$filename") {
-        my $prev = $/;
-        undef $/;
-        $res = <FILE>;
-        $/ = $prev;
-        close FILE;
-        chomp $res;
-    }
-    return $res;
-}
-
-
-my $cpuinfo = readFile "/proc/cpuinfo";
-
-
-sub hasCPUFeature {
-    my $feature = shift;
-    return $cpuinfo =~ /^flags\s*:.* $feature( |$)/m;
-}
-
-
-# Detect the number of CPU cores.
-my $cpus = scalar (grep {/^processor\s*:/} (split '\n', $cpuinfo));
-
-
-# Virtualization support?
-push @kernelModules, "kvm-intel" if hasCPUFeature "vmx";
-push @kernelModules, "kvm-amd" if hasCPUFeature "svm";
-
-
-# Look at the PCI devices and add necessary modules.  Note that most
-# modules are auto-detected so we don't need to list them here.
-# However, some are needed in the initrd to boot the system.
-
-my $videoDriver;
-
-sub pciCheck {
-    my $path = shift;
-    my $vendor = readFile "$path/vendor";
-    my $device = readFile "$path/device";
-    my $class = readFile "$path/class";
-    
-    my $module;
-    if (-e "$path/driver/module") {
-        $module = basename `readlink -f $path/driver/module`;
-        chomp $module;
-    }
-    
-    debug "$path: $vendor $device $class";
-    debug " $module" if defined $module;
-    debug "\n";
-
-    if (defined $module) {
-        # See the bottom of http://pciids.sourceforge.net/pci.ids for
-        # device classes.
-        if (# Mass-storage controller.  Definitely important.
-            $class =~ /^0x01/ ||
-
-            # Firewire controller.  A disk might be attached.
-            $class =~ /^0x0c00/ ||
-
-            # USB controller.  Needed if we want to use the
-            # keyboard when things go wrong in the initrd.
-            $class =~ /^0x0c03/
-            )
-        {
-            push @initrdKernelModules, $module;
-        }
-    }
-
-    # broadcom STA driver (wl.ko)
-    # list taken from http://www.broadcom.com/docs/linux_sta/README.txt
-    if ($vendor eq "0x14e4" &&
-        ($device eq "0x4311" || $device eq "0x4312" || $device eq "0x4313" ||
-         $device eq "0x4315" || $device eq "0x4327" || $device eq "0x4328" ||
-         $device eq "0x4329" || $device eq "0x432a" || $device eq "0x432b" ||
-         $device eq "0x432c" || $device eq "0x432d" || $device eq "0x4353" ||
-         $device eq "0x4357" || $device eq "0x4358" || $device eq "0x4359" ) )
-     {
-        push @modulePackages, "config.boot.kernelPackages.broadcom_sta";
-        push @kernelModules, "wl";
-     }
-
-    # Can't rely on $module here, since the module may not be loaded
-    # due to missing firmware.  Ideally we would check modules.pcimap
-    # here.
-    push @attrs, "networking.enableIntel2200BGFirmware = true;" if
-        $vendor eq "0x8086" &&
-        ($device eq "0x1043" || $device eq "0x104f" || $device eq "0x4220" ||
-         $device eq "0x4221" || $device eq "0x4223" || $device eq "0x4224");
-
-    push @attrs, "networking.enableIntel3945ABGFirmware = true;" if
-        $vendor eq "0x8086" &&
-        ($device eq "0x4229" || $device eq "0x4230" ||
-         $device eq "0x4222" || $device eq "0x4227");
-
-    # Assume that all NVIDIA cards are supported by the NVIDIA driver.
-    # There may be exceptions (e.g. old cards).
-    $videoDriver = "nvidia" if $vendor eq "0x10de" && $class =~ /^0x03/;
-}
-
-foreach my $path (glob "/sys/bus/pci/devices/*") {
-    pciCheck $path;
-}
-
-
-# Idem for USB devices.
-
-sub usbCheck {
-    my $path = shift;
-    my $class = readFile "$path/bInterfaceClass";
-    my $subclass = readFile "$path/bInterfaceSubClass";
-    my $protocol = readFile "$path/bInterfaceProtocol";
-
-    my $module;
-    if (-e "$path/driver/module") {
-        $module = basename `readlink -f $path/driver/module`;
-        chomp $module;
-    }
-    
-    debug "$path: $class $subclass $protocol";
-    debug " $module" if defined $module;
-    debug "\n";
- 
-    if (defined $module) {
-        if (# Mass-storage controller.  Definitely important.
-            $class eq "08" ||
-
-            # Keyboard.  Needed if we want to use the
-            # keyboard when things go wrong in the initrd.
-            ($class eq "03" && $protocol eq "01")
-            )
-        {
-            push @initrdKernelModules, $module;
-        }
-    }
-}
-
-foreach my $path (glob "/sys/bus/usb/devices/*") {
-    if (-e "$path/bInterfaceClass") {
-        usbCheck $path;
-    }
-}
-
-
-# Add the modules for all block devices.
-
-foreach my $path (glob "/sys/class/block/*") {
-    my $module;
-    if (-e "$path/device/driver/module") {
-        $module = basename `readlink -f $path/device/driver/module`;
-        chomp $module;
-        push @initrdKernelModules, $module;
-    }
-}
-
-
-if ($videoDriver) {
-    push @attrs, "services.xserver.videoDrivers = [ \"$videoDriver\" ];";
-}
-
-
-# Check if we're a VirtualBox guest.  If so, enable the guest
-# additions.
-my $dmi = `@dmidecode@/sbin/dmidecode`;
-if ($dmi =~ /Manufacturer: innotek/) {
-    push @attrs, "services.virtualbox.enable = true;"
-}
-
-
-# Generate the configuration file.
-
-sub removeDups {
-    my %seen;
-    my @res = ();
-    foreach my $s (@_) {
-        if (!defined $seen{$s}) {
-            $seen{$s} = "";
-            push @res, $s;
-        }
-    }
-    return @res;
-}
-
-sub toNixExpr {
-    my $res = "";
-    foreach my $s (@_) {
-        $res .= " \"$s\"";
-    }
-    return $res;
-}
-
-sub multiLineList {
-    my $indent = shift;
-    my $res = "";
-    $res = "\n" if scalar @_ > 0;
-    foreach my $s (@_) {
-        $res .= "$indent$s\n";
-    }
-    return $res;
-}
-
-my $initrdKernelModules = toNixExpr(removeDups @initrdKernelModules);
-my $kernelModules = toNixExpr(removeDups @kernelModules);
-my $modulePackages = toNixExpr(removeDups @modulePackages);
-my $attrs = multiLineList("  ", removeDups @attrs);
-my $imports = multiLineList("    ", removeDups @imports);
-
-
-print <<EOF ;
-# This is a generated file.  Do not modify!
-# Make changes to /etc/nixos/configuration.nix instead.
-{ config, pkgs, ... }:
-
-{
-  imports = [$imports  ];
-
-  boot.initrd.kernelModules = [$initrdKernelModules ];
-  boot.kernelModules = [$kernelModules ];
-  boot.extraModulePackages = [$modulePackages ];
-
-  nix.maxJobs = $cpus;
-$attrs}
-EOF
-# workaround for a bug in substituteAll
diff --git a/nixos/modules/installer/tools/nixos-install.sh b/nixos/modules/installer/tools/nixos-install.sh
index 19ce81983f1..126d5b185e8 100644
--- a/nixos/modules/installer/tools/nixos-install.sh
+++ b/nixos/modules/installer/tools/nixos-install.sh
@@ -14,15 +14,19 @@ extraBuildFlags=()
 while [ "$#" -gt 0 ]; do
     i="$1"; shift 1
     case "$i" in
-      -I)
-        given_path="$1"; shift 1
-        absolute_path=$(readlink -m $given_path)
-        extraBuildFlags+=("$i" "/mnt$absolute_path")
-        ;;
-      *)
-        echo "$0: unknown option \`$i'"
-        exit 1
-        ;;
+        -I)
+            given_path="$1"; shift 1
+            absolute_path=$(readlink -m $given_path)
+            extraBuildFlags+=("$i" "/mnt$absolute_path")
+            ;;
+        --help)
+            exec man nixos-install
+            exit 1
+            ;;
+        *)
+            echo "$0: unknown option \`$i'"
+            exit 1
+            ;;
     esac
 done
 
diff --git a/nixos/modules/installer/tools/nixos-option.sh b/nixos/modules/installer/tools/nixos-option.sh
index 7f008d62c24..69dd513f95c 100644
--- a/nixos/modules/installer/tools/nixos-option.sh
+++ b/nixos/modules/installer/tools/nixos-option.sh
@@ -1,43 +1,8 @@
 #! @shell@ -e
 
-# Allow the location of NixOS sources and the system configuration
-# file to be overridden.
-
-: ${mountPoint=/mnt}
-: ${NIXOS_CONFIG=/etc/nixos/configuration.nix}
-export NIXOS_CONFIG
-
 usage () {
-  echo 1>&2 "
-Usage: $0 [-v] [-d] [-l] [--xml] OPTION_NAME
-       $0 --install
-
-This program allows you to inspect the current value of NixOS
-configuration options.  It can also generate a basic NixOS
-configuration file.
-
-Options:
-
-  -i | --install        Write a template NixOS configuration file to
-                        ${mountPoint:+$mountPoint/}$NIXOS_CONFIG.
-  -v | --value          Display the current value, based on your
-                        configuration.
-  -d | --description    Display the default value, the example and the
-                        description.
-  -l | --lookup         Display where the option is defined and where it
-                        is declared.
-  --xml                 Print an XML representation of the result.
-                        Implies -vdl options.
-  --help                Show this message.
-
-Environment variables affecting $0:
-
-  \$mountPoint          Path to the target file system.
-  \$NIXOS_CONFIG        Path to your configuration file.
-
-"
-
-  exit 1;
+    exec man nixos-option
+    exit 1
 }
 
 #####################
@@ -48,7 +13,6 @@ desc=false
 defs=false
 value=false
 xml=false
-install=false
 verbose=false
 
 option=""
@@ -66,7 +30,6 @@ for arg; do
             -d*) longarg="$longarg --description";;
             -v*) longarg="$longarg --value";;
             -l*) longarg="$longarg --lookup";;
-            -i*) longarg="$longarg --install";;
             -*) usage;;
           esac
           # remove the first letter option
@@ -81,7 +44,6 @@ for arg; do
         --value) value=true;;
         --lookup) defs=true;;
         --xml) xml=true;;
-        --install) install=true;;
         --verbose) verbose=true;;
         --help) usage;;
         -*) usage;;
@@ -109,16 +71,6 @@ if $xml; then
   defs=true
 fi
 
-# --install cannot be used with -d -v -l without option name.
-if $value || $desc || $defs && $install && test -z "$option"; then
-  usage
-fi
-
-generate=false
-if ! $defs && ! $desc && ! $value && $install && test -z "$option"; then
-  generate=true
-fi
-
 if ! $defs && ! $desc; then
   value=true
 fi
@@ -182,122 +134,6 @@ nixMap() {
   done
 }
 
-if $install; then
-  NIXOS_CONFIG="$mountPoint$NIXOS_CONFIG"
-fi
-
-if $generate; then
-  mkdir -p $(dirname "$NIXOS_CONFIG")
-
-  # Scan the hardware and add the result to /etc/nixos/hardware-scan.nix.
-  hardware_config="${NIXOS_CONFIG%/configuration.nix}/hardware-configuration.nix"
-  if test -e "$hardware_config"; then
-    echo "A hardware configuration file exists, generation skipped."
-  else
-    echo "Generating a hardware configuration file in $hardware_config..."
-    nixos-hardware-scan > "$hardware_config"
-  fi
-
-  if test -e "$NIXOS_CONFIG"; then
-    echo 1>&2 "error: Cannot generate a template configuration because a configuration file exists."
-    exit 1
-  fi
-
-  nl="
-"
-  if test -e /sys/firmware/efi/efivars; then
-    l1="  # Use the gummiboot efi boot loader."
-    l2="  boot.loader.grub.enable = false;"
-    l3="  boot.loader.gummiboot.enable = true;"
-    l4="  boot.loader.efi.canTouchEfiVariables = true;"
-    # !!! Remove me when nixos is on 3.10 or greater by default
-    l5="  # EFI booting requires kernel >= 3.10"
-    l6="  boot.kernelPackages = pkgs.linuxPackages_3_10;"
-    bootloader_config="$l1$nl$l2$nl$l3$nl$l4$nl$nl$l5$nl$l6"
-  else
-    l1="  # Use the Grub2 boot loader."
-    l2="  boot.loader.grub.enable = true;"
-    l3="  boot.loader.grub.version = 2;"
-    l4="  # Define on which hard drive you want to install Grub."
-    l5='  # boot.loader.grub.device = "/dev/sda";'
-    bootloader_config="$l1$nl$l2$nl$l3$nl$nl$l4$nl$l5"
-  fi
-
-  echo "Generating a basic configuration file in $NIXOS_CONFIG..."
-
-  # Generate a template configuration file where the user has to
-  # fill the gaps.
-  cat <<EOF > "$NIXOS_CONFIG"
-# Edit this configuration file to define what should be installed on
-# the system.  Help is available in the configuration.nix(5) man page
-# or the NixOS manual available on virtual console 8 (Alt+F8).
-
-{ config, pkgs, ... }:
-
-{
-  imports =
-    [ # Include the results of the hardware scan.
-      ./hardware-configuration.nix
-    ];
-
-  boot.initrd.kernelModules =
-    [ # Specify all kernel modules that are necessary for mounting the root
-      # filesystem.
-      # "xfs" "ata_piix"
-      # fbcon # Uncomment this when EFI booting to see the console before the root partition is mounted
-    ];
-    
-$bootloader_config
-
-  # networking.hostName = "nixos"; # Define your hostname.
-  # networking.wireless.enable = true;  # Enables Wireless.
-
-  # Add filesystem entries for each partition that you want to see
-  # mounted at boot time.  This should include at least the root
-  # filesystem.
-
-  # fileSystems."/".device = "/dev/disk/by-label/nixos";
-
-  # fileSystems."/data" =     # where you want to mount the device
-  #   { device = "/dev/sdb";  # the device
-  #     fsType = "ext3";      # the type of the partition
-  #     options = "data=journal";
-  #   };
-
-  # List swap partitions activated at boot time.
-  swapDevices =
-    [ # { device = "/dev/disk/by-label/swap"; }
-    ];
-
-  # Select internationalisation properties.
-  # i18n = {
-  #   consoleFont = "lat9w-16";
-  #   consoleKeyMap = "us";
-  #   defaultLocale = "en_US.UTF-8";
-  # };
-
-  # List services that you want to enable:
-
-  # Enable the OpenSSH daemon.
-  # services.openssh.enable = true;
-
-  # Enable CUPS to print documents.
-  # services.printing.enable = true;
-
-  # Enable the X11 windowing system.
-  # services.xserver.enable = true;
-  # services.xserver.layout = "us";
-  # services.xserver.xkbOptions = "eurosign:e";
-
-  # Enable the KDE Desktop Environment.
-  # services.xserver.displayManager.kdm.enable = true;
-  # services.xserver.desktopManager.kde4.enable = true;
-}
-EOF
-
-  exit 0
-fi;
-
 # This duplicates the work made below, but it is useful for processing
 # the output of nixos-option with other tools such as nixos-gui.
 if $xml; then
diff --git a/nixos/modules/installer/tools/nixos-rebuild.sh b/nixos/modules/installer/tools/nixos-rebuild.sh
index 8734cb273d4..6b747bc1a2b 100644
--- a/nixos/modules/installer/tools/nixos-rebuild.sh
+++ b/nixos/modules/installer/tools/nixos-rebuild.sh
@@ -1,44 +1,7 @@
 #! @shell@ -e
 
 showSyntax() {
-    # !!! more or less cut&paste from
-    # system/switch-to-configuration.sh (which we call, of course).
-    cat <<EOF
-Usage: $0 [OPTIONS...] OPERATION
-
-The operation is one of the following:
-
-  switch:   make the configuration the boot default and activate now
-  boot:     make the configuration the boot default
-  test:     activate the configuration, but don't make it the boot default
-  build:    build the configuration, but don't make it the default or
-            activate it
-  build-vm: build a virtual machine containing the configuration
-            (useful for testing)
-  build-vm-with-bootloader:
-            like build-vm, but include a boot loader in the VM
-  dry-run:  just show what store paths would be built/downloaded
-
-Options:
-
-  --upgrade              fetch the latest version of NixOS before rebuilding
-  --install-grub         (re-)install the Grub bootloader
-  --no-build-nix         don't build the latest Nix from Nixpkgs before
-                           building NixOS
-  --rollback             restore the previous NixOS configuration (only
-                           with switch, boot, test, build)
-  --profile-name / -p    install in the specified system profile
-  --fast                 same as --no-build-nix --show-trace
-
-Various nix-build options are also accepted, in particular:
-
-  --show-trace           show a detailed stack trace for evaluation errors
-
-Environment variables affecting nixos-rebuild:
-
-  \$NIX_PATH              Nix expression search path
-  \$NIXOS_CONFIG          path to the NixOS system configuration specification
-EOF
+    exec man nixos-rebuild
     exit 1
 }
 
@@ -157,10 +120,10 @@ fi
 
 # Update the version suffix if we're building from Git (so that
 # nixos-version shows something useful).
-if nixos=$(nix-instantiate --find-file nixos "${extraBuildFlags[@]}"); then
-    suffix=$(@shell@ $nixos/modules/installer/tools/get-version-suffix "${extraBuildFlags[@]}")
+if nixpkgs=$(nix-instantiate --find-file nixpkgs "${extraBuildFlags[@]}"); then
+    suffix=$(@shell@ $nixpkgs/nixos/modules/installer/tools/get-version-suffix "${extraBuildFlags[@]}")
     if [ -n "$suffix" ]; then
-        echo -n "$suffix" > "$nixos/.version-suffix" || true
+        echo -n "$suffix" > "$nixpkgs/.version-suffix" || true
     fi
 fi
 
diff --git a/nixos/modules/installer/tools/tools.nix b/nixos/modules/installer/tools/tools.nix
index c761d74a890..074c77b5146 100644
--- a/nixos/modules/installer/tools/tools.nix
+++ b/nixos/modules/installer/tools/tools.nix
@@ -1,10 +1,10 @@
 # This module generates nixos-install, nixos-rebuild,
-# nixos-hardware-scan, etc.
+# nixos-generate-config, etc.
 
 { config, pkgs, modulesPath, ... }:
 
 let
-  ### implementation
+
   cfg = config.installer;
 
   makeProg = args: pkgs.substituteAll (args // {
@@ -12,12 +12,12 @@ let
     isExecutable = true;
   });
 
-  nixosBuildVMS = makeProg {
+  nixos-build-vms = makeProg {
     name = "nixos-build-vms";
     src = ./nixos-build-vms/nixos-build-vms.sh;
   };
 
-  nixosInstall = makeProg {
+  nixos-install = makeProg {
     name = "nixos-install";
     src = ./nixos-install.sh;
 
@@ -29,36 +29,30 @@ let
       "cp refs $out";
   };
 
-  nixosRebuild = makeProg {
+  nixos-rebuild = makeProg {
     name = "nixos-rebuild";
     src = ./nixos-rebuild.sh;
   };
 
-  /*
-  nixosGenSeccureKeys = makeProg {
-    name = "nixos-gen-seccure-keys";
-    src = ./nixos-gen-seccure-keys.sh;
-  };
-  */
-
-  nixosHardwareScan = makeProg {
-    name = "nixos-hardware-scan";
-    src = ./nixos-hardware-scan.pl;
-    inherit (pkgs) perl dmidecode;
+  nixos-generate-config = makeProg {
+    name = "nixos-generate-config";
+    src = ./nixos-generate-config.pl;
+    perl = "${pkgs.perl}/bin/perl -I${pkgs.perlPackages.FileSlurp}/lib/perl5/site_perl";
+    inherit (pkgs) dmidecode;
   };
 
-  nixosOption = makeProg {
+  nixos-option = makeProg {
     name = "nixos-option";
     src = ./nixos-option.sh;
   };
 
-  nixosVersion = makeProg {
+  nixos-version = makeProg {
     name = "nixos-version";
     src = ./nixos-version.sh;
     inherit (config.system) nixosVersion nixosCodeName;
   };
 
-  nixosGui = pkgs.xulrunnerWrapper {
+  nixos-gui = pkgs.xulrunnerWrapper {
     launcher = "nixos-gui";
     application = pkgs.stdenv.mkDerivation {
       name = "nixos-gui";
@@ -96,17 +90,16 @@ in
 
   config = {
     environment.systemPackages =
-      [ nixosBuildVMS
-        nixosInstall
-        nixosRebuild
-        nixosHardwareScan
-        #nixosGenSeccureKeys
-        nixosOption
-        nixosVersion
-      ] ++ pkgs.lib.optional cfg.enableGraphicalTools nixosGui;
+      [ nixos-build-vms
+        nixos-install
+        nixos-rebuild
+        nixos-generate-config
+        nixos-option
+        nixos-version
+      ] ++ pkgs.lib.optional cfg.enableGraphicalTools nixos-gui;
 
     system.build = {
-      inherit nixosInstall nixosHardwareScan nixosOption;
+      inherit nixos-install nixos-generate-config nixos-option;
     };
   };
 }
diff --git a/nixos/modules/misc/nixpkgs.nix b/nixos/modules/misc/nixpkgs.nix
index 0df0e57c98e..9eba728c339 100644
--- a/nixos/modules/misc/nixpkgs.nix
+++ b/nixos/modules/misc/nixpkgs.nix
@@ -70,18 +70,4 @@ in
     };
 
   };
-
-  config = {
-
-    # FIXME
-    nixpkgs.config.packageOverrides = pkgs: {
-      #udev = pkgs.systemd;
-      slim = pkgs.slim.override (args: if args ? consolekit then { consolekit = null; } else { });
-      lvm2 = pkgs.lvm2.override { udev = pkgs.systemd; };
-      upower = pkgs.upower.override { useSystemd = true; };
-      polkit = pkgs.polkit.override { useSystemd = true; };
-      consolekit = null;
-    };
-
-  };
 }
diff --git a/nixos/modules/misc/version.nix b/nixos/modules/misc/version.nix
index fa7baf36fb9..1b519d3e6ee 100644
--- a/nixos/modules/misc/version.nix
+++ b/nixos/modules/misc/version.nix
@@ -26,10 +26,11 @@ with pkgs.lib;
   config = {
 
     system.nixosVersion =
-      mkDefault (builtins.readFile ../../../.version + config.system.nixosVersionSuffix);
+      mkDefault (builtins.readFile "${toString pkgs.path}/.version" + config.system.nixosVersionSuffix);
 
     system.nixosVersionSuffix =
-      mkDefault (if builtins.pathExists ../../../.version-suffix then builtins.readFile ../../../.version-suffix else "pre-git");
+      let suffixFile = "${toString pkgs.path}/.version-suffix"; in
+      mkDefault (if builtins.pathExists suffixFile then builtins.readFile suffixFile else "pre-git");
 
     # Note: code names must only increase in alphabetical order.
     system.nixosCodeName = "Aardvark";
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 977ca2518ec..fff7a0cfad5 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -46,6 +46,7 @@
   ./programs/bash/command-not-found.nix
   ./programs/blcr.nix
   ./programs/environment.nix
+  ./programs/gurobi.nix
   ./programs/info.nix
   ./programs/shadow.nix
   ./programs/shell.nix
@@ -61,6 +62,7 @@
   ./security/pam.nix
   ./security/pam_usb.nix
   ./security/polkit.nix
+  ./security/prey.nix
   ./security/rngd.nix
   ./security/rtkit.nix
   ./security/setuid-wrappers.nix
@@ -117,6 +119,7 @@
   ./services/misc/felix.nix
   ./services/misc/folding-at-home.nix
   ./services/misc/gpsd.nix
+  ./services/misc/gurobi.nix
   ./services/misc/nix-daemon.nix
   ./services/misc/nix-gc.nix
   ./services/misc/nixos-manual.nix
@@ -127,6 +130,7 @@
   ./services/monitoring/dd-agent.nix
   ./services/monitoring/graphite.nix
   ./services/monitoring/monit.nix
+  ./services/monitoring/munin.nix
   ./services/monitoring/nagios/default.nix
   ./services/monitoring/smartd.nix
   ./services/monitoring/statsd.nix
diff --git a/nixos/modules/programs/bash/bash.nix b/nixos/modules/programs/bash/bash.nix
index 8cfe3f990ad..9d33e26c495 100644
--- a/nixos/modules/programs/bash/bash.nix
+++ b/nixos/modules/programs/bash/bash.nix
@@ -127,8 +127,6 @@ in
       loginShellInit = cfge.loginShellInit;
 
       interactiveShellInit = ''
-        ${cfge.interactiveShellInit}
-
         # Check the window size after every command.
         shopt -s checkwinsize
 
@@ -138,6 +136,8 @@ in
         ${cfg.promptInit}
         ${bashCompletion}
         ${bashAliases}
+
+        ${cfge.interactiveShellInit}
       '';
 
     };
diff --git a/nixos/modules/programs/environment.nix b/nixos/modules/programs/environment.nix
index 683f6b54b10..7c1922cdfd8 100644
--- a/nixos/modules/programs/environment.nix
+++ b/nixos/modules/programs/environment.nix
@@ -24,7 +24,6 @@ in
           [ "/nix/var/nix/profiles/per-user/root/channels/nixos"
             "nixpkgs=/etc/nixos/nixpkgs"
             "nixos-config=/etc/nixos/configuration.nix"
-            "services=/etc/nixos/services"
           ];
         PAGER = "less -R";
         EDITOR = "nano";
diff --git a/nixos/modules/programs/gurobi.nix b/nixos/modules/programs/gurobi.nix
new file mode 100644
index 00000000000..7fa099b0884
--- /dev/null
+++ b/nixos/modules/programs/gurobi.nix
@@ -0,0 +1,43 @@
+{ config, pkgs, ... }:
+
+with pkgs.lib;
+
+let
+  cfg = config.programs.gurobi;
+in {
+  options = {
+    programs.gurobi = {
+      license = mkOption {
+        default = null;
+
+        description = "Path to the Gurobi license file if not using a token server";
+
+        type = types.nullOr types.path;
+      };
+
+      tokenServerAddress = mkOption {
+        default = null;
+
+        description = "Address of the token server";
+
+        type = types.nullOr types.string;
+      };
+    };
+  };
+
+  config = mkIf (cfg.license != null || cfg.tokenServerAddress != null) {
+    assertions = [ {
+      assertion = cfg.license == null || cfg.tokenServerAddress == null;
+      message = "Please only set one of a gurobi license file and a gurobi token server address";
+    } ];
+
+    environment.variables.GRB_LICENSE_FILE = if cfg.license != null
+      then cfg.license
+      else pkgs.writeTextFile {
+        name = "gurobi-generated-license";
+        text = "TOKENSERVER=${cfg.tokenServerAddress}";
+      };
+
+    environment.systemPackages = [ pkgs.gurobi ];
+  };
+}
diff --git a/nixos/modules/programs/shadow.nix b/nixos/modules/programs/shadow.nix
index 695c0b6620f..36c915f755f 100644
--- a/nixos/modules/programs/shadow.nix
+++ b/nixos/modules/programs/shadow.nix
@@ -79,22 +79,22 @@ in
       ];
 
     security.pam.services =
-      [ { name = "chsh"; rootOK = true; }
-        { name = "chfn"; rootOK = true; }
-        { name = "su"; rootOK = true; forwardXAuth = true; }
-        { name = "passwd"; }
+      { chsh = { rootOK = true; };
+        chfn = { rootOK = true; };
+        su = { rootOK = true; forwardXAuth = true; };
+        passwd = {};
         # Note: useradd, groupadd etc. aren't setuid root, so it
         # doesn't really matter what the PAM config says as long as it
         # lets root in.
-        { name = "useradd"; rootOK = true; }
-        { name = "usermod"; rootOK = true; }
-        { name = "userdel"; rootOK = true; }
-        { name = "groupadd"; rootOK = true; }
-        { name = "groupmod"; rootOK = true; }
-        { name = "groupmems"; rootOK = true; }
-        { name = "groupdel"; rootOK = true; }
-        { name = "login"; startSession = true; allowNullPassword = true; showMotd = true; updateWtmp = true; }
-      ];
+        useradd = { rootOK = true; };
+        usermod = { rootOK = true; };
+        userdel = { rootOK = true; };
+        groupadd = { rootOK = true; };
+        groupmod = { rootOK = true; };
+        groupmems = { rootOK = true; };
+        groupdel = { rootOK = true; };
+        login = { startSession = true; allowNullPassword = true; showMotd = true; updateWtmp = true; };
+      };
 
     security.setuidPrograms = [ "passwd" "chfn" "su" "newgrp" ];
 
diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix
index 3ef01ea2c17..1081b41299d 100644
--- a/nixos/modules/security/pam.nix
+++ b/nixos/modules/security/pam.nix
@@ -7,77 +7,147 @@ with pkgs.lib;
 
 let
 
-  inherit (pkgs) pam_krb5 pam_ccreds;
+  pamOpts = args: {
+
+    options = {
+
+      name = mkOption {
+        example = "sshd";
+        type = types.uniq types.string;
+        description = "Name of the PAM service.";
+      };
+
+      unixAuth = mkOption {
+        default = true;
+        type = types.bool;
+        description = ''
+          Whether users can log in with passwords defined in
+          <filename>/etc/shadow</filename>.
+        '';
+      };
+
+      rootOK = mkOption {
+        default = false;
+        type = types.bool;
+        description = ''
+          If set, root doesn't need to authenticate (e.g. for the
+          <command>useradd</command> service).
+        '';
+      };
+
+      usbAuth = mkOption {
+        default = config.security.pam.usb.enable;
+        type = types.bool;
+        description = ''
+          If set, users listed in
+          <filename>/etc/pamusb.conf</filename> are able to log in
+          with the associated USB key.
+        '';
+      };
+
+      otpwAuth = mkOption {
+        default = config.security.pam.enableOTPW;
+        type = types.bool;
+        description = ''
+          If set, the OTPW system will be used (if
+          <filename>~/.otpw</filename> exists).
+        '';
+      };
+
+      sshAgentAuth = mkOption {
+        default = false;
+        type = types.bool;
+        description = ''
+          If set, the calling user's SSH agent is used to authenticate
+          against the keys in the calling user's
+          <filename>~/.ssh/authorized_keys</filename>.  This is useful
+          for <command>sudo</command> on password-less remote systems.
+        '';
+      };
+
+      startSession = mkOption {
+        default = false;
+        type = types.bool;
+        description = ''
+          If set, the service will register a new session with
+          systemd's login manager.  For local sessions, this will give
+          the user access to audio devices, CD-ROM drives.  In the
+          default PolicyKit configuration, it also allows the user to
+          reboot the system.
+        '';
+      };
+
+      setLoginUid = mkOption {
+        type = types.bool;
+        description = ''
+          Set the login uid of the process
+          (<filename>/proc/self/loginuid</filename>) for auditing
+          purposes.  The login uid is only set by ‘entry points’ like
+          <command>login</command> and <command>sshd</command>, not by
+          commands like <command>sudo</command>.
+        '';
+      };
+
+      forwardXAuth = mkOption {
+        default = false;
+        type = types.bool;
+        description = ''
+          Whether X authentication keys should be passed from the
+          calling user to the target user (e.g. for
+          <command>su</command>)
+        '';
+      };
+
+      allowNullPassword = mkOption {
+        default = false;
+        type = types.bool;
+        description = ''
+          Whether to allow logging into accounts that have no password
+          set (i.e., have an empty password field in
+          <filename>/etc/passwd</filename> or
+          <filename>/etc/group</filename>).  This does not enable
+          logging into disabled accounts (i.e., that have the password
+          field set to <literal>!</literal>).  Note that regardless of
+          what the pam_unix documentation says, accounts with hashed
+          empty passwords are always allowed to log in.
+        '';
+      };
 
-  pam_ldap = if config.users.ldap.daemon.enable then pkgs.nss_pam_ldapd else pkgs.pam_ldap;
+      limits = mkOption {
+        description = ''
+          Attribute set describing resource limits.  Defaults to the
+          value of <option>security.pam.loginLimits</option>.
+        '';
+      };
 
-  otherService = pkgs.writeText "other.pam"
-    ''
-      auth     required pam_warn.so
-      auth     required pam_deny.so
-      account  required pam_warn.so
-      account  required pam_deny.so
-      password required pam_warn.so
-      password required pam_deny.so
-      session  required pam_warn.so
-      session  required pam_deny.so
-    '';
+      showMotd = mkOption {
+        default = false;
+        type = types.bool;
+        description = "Whether to show the message of the day.";
+      };
 
-  # Create a limits.conf(5) file.
-  makeLimitsConf = limits:
-    pkgs.writeText "limits.conf"
-      (concatStringsSep "\n"
-           (map ({ domain, type, item, value }:
-                 concatStringsSep " " [ domain type item value ])
-                limits));
+      updateWtmp = mkOption {
+        default = false;
+        type = types.bool;
+        description = "Whether to update <filename>/var/log/wtmp</filename>.";
+      };
 
-  motd = pkgs.writeText "motd" config.users.motd;
+      text = mkOption {
+        type = types.nullOr types.string;
+        description = "Contents of the PAM service file.";
+      };
+
+    };
 
-  makePAMService =
-    { name
-    , # If set, root doesn't need to authenticate (e.g. for the "chsh"
-      # service).
-      rootOK ? false
-    , # If set, user listed in /etc/pamusb.conf are able to log in with
-      # the associated usb key.
-      usbAuth ? config.security.pam.usb.enable
-    , # If set, OTPW system will be used (if ~/.otpw exists)
-      otpwAuth ? config.security.pam.enableOTPW
-    , # If set, the calling user's SSH agent is used to authenticate
-      # against the keys in the calling user's ~/.ssh/authorized_keys.
-      # This is useful for "sudo" on password-less remote systems.
-      sshAgentAuth ? false
-    , # If set, the service will register a new session with systemd's
-      # login manager.  If the service is running locally, this will
-      # give the user ownership of audio devices etc.
-      startSession ? false
-    , # Set the login uid of the process (/proc/self/loginuid) for
-      # auditing purposes.  The login uid is only set by "entry
-      # points" like login and sshd, not by commands like sudo.
-      setLoginUid ? startSession
-    , # Whether to forward XAuth keys between users.  Mostly useful
-      # for "su".
-      forwardXAuth ? false
-    , # Whether to allow logging into accounts that have no password
-      # set (i.e., have an empty password field in /etc/passwd or
-      # /etc/group).  This does not enable logging into disabled
-      # accounts (i.e., that have the password field set to `!').
-      # Note that regardless of what the pam_unix documentation says,
-      # accounts with hashed empty passwords are always allowed to log
-      # in.
-      allowNullPassword ? false
-    , # The limits, as per limits.conf(5).
-      limits ? config.security.pam.loginLimits
-    , # Whether to show the message of the day.
-      showMotd ? false
-    , # Whether to update /var/log/wtmp.
-      updateWtmp ? false
-    }:
-
-    { source = pkgs.writeText "${name}.pam"
-        # !!! TODO: move the LDAP stuff to the LDAP module, and the
-        # Samba stuff to the Samba module.  This requires that the PAM
-        # module provides the right hooks.
+    config = let cfg = args.config; in {
+      name = mkDefault args.name;
+      setLoginUid = mkDefault cfg.startSession;
+      limits = mkDefault config.security.pam.loginLimits;
+
+      # !!! TODO: move the LDAP stuff to the LDAP module, and the
+      # Samba stuff to the Samba module.  This requires that the PAM
+      # module provides the right hooks.
+      text = mkDefault
         ''
           # Account management.
           account sufficient pam_unix.so
@@ -87,14 +157,15 @@ let
               "account sufficient ${pam_krb5}/lib/security/pam_krb5.so"}
 
           # Authentication management.
-          ${optionalString rootOK
+          ${optionalString cfg.rootOK
               "auth sufficient pam_rootok.so"}
-          ${optionalString (config.security.pam.enableSSHAgentAuth && sshAgentAuth)
+          ${optionalString (config.security.pam.enableSSHAgentAuth && cfg.sshAgentAuth)
               "auth sufficient ${pkgs.pam_ssh_agent_auth}/libexec/pam_ssh_agent_auth.so file=~/.ssh/authorized_keys:~/.ssh/authorized_keys2:/etc/ssh/authorized_keys.d/%u"}
-          ${optionalString usbAuth
+          ${optionalString cfg.usbAuth
               "auth sufficient ${pkgs.pam_usb}/lib/security/pam_usb.so"}
-          auth sufficient pam_unix.so ${optionalString allowNullPassword "nullok"} likeauth
-          ${optionalString otpwAuth
+          ${optionalString cfg.unixAuth
+              "auth sufficient pam_unix.so ${optionalString cfg.allowNullPassword "nullok"} likeauth"}
+          ${optionalString cfg.otpwAuth
               "auth sufficient ${pkgs.otpw}/lib/security/pam_otpw.so"}
           ${optionalString config.users.ldap.enable
               "auth sufficient ${pam_ldap}/lib/security/pam_ldap.so use_first_pass"}
@@ -116,26 +187,46 @@ let
 
           # Session management.
           session required pam_unix.so
-          ${optionalString updateWtmp
+          ${optionalString cfg.updateWtmp
               "session required ${pkgs.pam}/lib/security/pam_lastlog.so silent"}
           ${optionalString config.users.ldap.enable
               "session optional ${pam_ldap}/lib/security/pam_ldap.so"}
           ${optionalString config.krb5.enable
               "session optional ${pam_krb5}/lib/security/pam_krb5.so"}
-          ${optionalString otpwAuth
+          ${optionalString cfg.otpwAuth
               "session optional ${pkgs.otpw}/lib/security/pam_otpw.so"}
-          ${optionalString startSession
+          ${optionalString cfg.startSession
               "session optional ${pkgs.systemd}/lib/security/pam_systemd.so"}
-          ${optionalString setLoginUid
+          ${optionalString cfg.setLoginUid
               "session required pam_loginuid.so"}
-          ${optionalString forwardXAuth
+          ${optionalString cfg.forwardXAuth
               "session optional pam_xauth.so xauthpath=${pkgs.xorg.xauth}/bin/xauth systemuser=99"}
-          ${optionalString (limits != [])
-              "session required ${pkgs.pam}/lib/security/pam_limits.so conf=${makeLimitsConf limits}"}
-          ${optionalString (showMotd && config.users.motd != null)
+          ${optionalString (cfg.limits != [])
+              "session required ${pkgs.pam}/lib/security/pam_limits.so conf=${makeLimitsConf cfg.limits}"}
+          ${optionalString (cfg.showMotd && config.users.motd != null)
               "session optional ${pkgs.pam}/lib/security/pam_motd.so motd=${motd}"}
         '';
-      target = "pam.d/${name}";
+    };
+
+  };
+
+
+  inherit (pkgs) pam_krb5 pam_ccreds;
+
+  pam_ldap = if config.users.ldap.daemon.enable then pkgs.nss_pam_ldapd else pkgs.pam_ldap;
+
+  # Create a limits.conf(5) file.
+  makeLimitsConf = limits:
+    pkgs.writeText "limits.conf"
+       (concatMapStrings ({ domain, type, item, value }:
+         "${domain} ${type} ${item} ${toString value}\n")
+         limits);
+
+  motd = pkgs.writeText "motd" config.users.motd;
+
+  makePAMService = pamService:
+    { source = pkgs.writeText "${pamService.name}.pam" pamService.text;
+      target = "pam.d/${pamService.name}";
     };
 
 in
@@ -173,44 +264,15 @@ in
 
     security.pam.services = mkOption {
       default = [];
-      example = [
-        { name = "chsh"; rootOK = true; }
-        { name = "login"; startSession = true; allowNullPassword = true;
-          limits = [
-            { domain = "ftp";
-              type   = "hard";
-              item   = "nproc";
-              value  = "0";
-            }
-          ];
-        }
-      ];
-
+      type = types.loaOf types.optionSet;
+      options = [ pamOpts ];
       description =
         ''
           This option defines the PAM services.  A service typically
           corresponds to a program that uses PAM,
           e.g. <command>login</command> or <command>passwd</command>.
-          Each element of this list is an attribute set describing a
-          service.  The attribute <varname>name</varname> specifies
-          the name of the service.  The attribute
-          <varname>rootOK</varname> specifies whether the root user is
-          allowed to use this service without authentication.  The
-          attribute <varname>startSession</varname> specifies whether
-          systemd's PAM connector module should be used to start a new
-          session; for local sessions, this will give the user
-          ownership of devices such as audio and CD-ROM drives.  The
-          attribute <varname>forwardXAuth</varname> specifies whether
-          X authentication keys should be passed from the calling user
-          to the target user (e.g. for <command>su</command>).
-
-          The attribute <varname>limits</varname> defines resource limits
-          that should apply to users or groups for the service.  Each item in
-          the list should be an attribute set with a
-          <varname>domain</varname>, <varname>type</varname>,
-          <varname>item</varname>, and <varname>value</varname> attribute.
-          The syntax and semantics of these attributes must be that described
-          in the limits.conf(5) man page.
+          Each attribute of this set defines a PAM service, with the attribute name
+          defining the name of the service.
         '';
     };
 
@@ -228,7 +290,7 @@ in
     security.pam.enableOTPW = mkOption {
       default = false;
       description = ''
-        Enable the OTPW (one-time password) PAM module
+        Enable the OTPW (one-time password) PAM module.
       '';
     };
 
@@ -254,11 +316,7 @@ in
       ++ optionals config.security.pam.enableOTPW [ pkgs.otpw ];
 
     environment.etc =
-      map makePAMService config.security.pam.services
-      ++ singleton
-        { source = otherService;
-          target = "pam.d/other";
-        };
+      mapAttrsToList (n: v: makePAMService v) config.security.pam.services;
 
     security.setuidOwners = [ {
       program = "unix_chkpwd";
@@ -268,18 +326,27 @@ in
     } ];
 
     security.pam.services =
-      # Most of these should be moved to specific modules.
-      [ { name = "cups"; }
-        { name = "ejabberd"; }
-        { name = "ftp"; }
-        { name = "i3lock"; }
-        { name = "lshd"; }
-        { name = "samba"; }
-        { name = "screen"; }
-        { name = "vlock"; }
-        { name = "xlock"; }
-        { name = "xscreensaver"; }
-      ];
+      { other.text =
+          ''
+            auth     required pam_warn.so
+            auth     required pam_deny.so
+            account  required pam_warn.so
+            account  required pam_deny.so
+            password required pam_warn.so
+            password required pam_deny.so
+            session  required pam_warn.so
+            session  required pam_deny.so
+          '';
+
+        # Most of these should be moved to specific modules.
+        cups = {};
+        ftp = {};
+        i3lock = {};
+        screen = {};
+        vlock = {};
+        xlock = {};
+        xscreensaver = {};
+      };
 
   };
 
diff --git a/nixos/modules/security/pam_usb.nix b/nixos/modules/security/pam_usb.nix
index 1c2a6a05f26..2bd3069ddb1 100644
--- a/nixos/modules/security/pam_usb.nix
+++ b/nixos/modules/security/pam_usb.nix
@@ -8,7 +8,7 @@ let
 
   cfg = config.security.pam.usb;
 
-  anyUsbAuth = any (attrByPath ["usbAuth"] false) config.security.pam.services;
+  anyUsbAuth = any (attrByPath ["usbAuth"] false) (attrValues config.security.pam.services);
 
 in
 
@@ -19,8 +19,8 @@ in
       enable = mkOption {
         default = false;
         description = ''
-          Enable USB login for all login system unless the service disabled
-          it.  For more information, visit <link
+          Enable USB login for all login systems that support it.  For
+          more information, visit <link
           xlink:href="http://pamusb.org/doc/quickstart#setting_up" />.
         '';
       };
diff --git a/nixos/modules/security/polkit.nix b/nixos/modules/security/polkit.nix
index b9b32496a36..8b04f4043bc 100644
--- a/nixos/modules/security/polkit.nix
+++ b/nixos/modules/security/polkit.nix
@@ -94,7 +94,7 @@ in
 
     services.dbus.packages = [ pkgs.polkit ];
 
-    security.pam.services = [ { name = "polkit-1"; } ];
+    security.pam.services.polkit-1 = {};
 
     security.setuidPrograms = [ "pkexec" ];
 
diff --git a/nixos/modules/security/prey.nix b/nixos/modules/security/prey.nix
new file mode 100644
index 00000000000..75b95d5fbb0
--- /dev/null
+++ b/nixos/modules/security/prey.nix
@@ -0,0 +1,42 @@
+{config, pkgs, ...}:
+
+with pkgs.lib;
+
+let
+  cfg = config.services.prey;
+  myPrey = pkgs."prey-bash-client".override {
+    apiKey = cfg.apiKey;
+    deviceKey = cfg.deviceKey;
+  };
+in {
+  options = {
+
+    services.prey = {
+      enable = mkOption {
+        default = false;
+        type = types.bool;
+        description = ''
+          Enables http://preyproject.com/ bash client. Be sure to specify api and device keys.
+          Once setup, cronjob will run evert 15 minutes and report status.
+        '';
+      };
+
+      deviceKey = mkOption {
+        type = types.string;
+        description = "Device Key obtained from https://panel.preyproject.com/devices (and clicking on the device)";
+      };
+
+      apiKey = mkOption {
+        type = types.string;
+        description = "API key obtained from https://panel.preyproject.com/profile";
+      };
+    };
+
+  };
+
+  config = mkIf cfg.enable {
+      environment.systemPackages = [ myPrey ];
+      services.cron.systemCronJobs = [ "*/15 * * * * root ${myPrey}/prey.sh" ];
+  };
+
+}
diff --git a/nixos/modules/security/sudo.nix b/nixos/modules/security/sudo.nix
index cd548f4a4fe..77251780198 100644
--- a/nixos/modules/security/sudo.nix
+++ b/nixos/modules/security/sudo.nix
@@ -74,7 +74,7 @@ in
 
     environment.systemPackages = [ sudo ];
 
-    security.pam.services = [ { name = "sudo"; sshAgentAuth = true; } ];
+    security.pam.services.sudo = { sshAgentAuth = true; };
 
     environment.etc = singleton
       { source = pkgs.writeText "sudoers-in" cfg.configFile;
diff --git a/nixos/modules/services/mail/dovecot.nix b/nixos/modules/services/mail/dovecot.nix
index 5f8e8e1ade3..92682d644f4 100644
--- a/nixos/modules/services/mail/dovecot.nix
+++ b/nixos/modules/services/mail/dovecot.nix
@@ -124,7 +124,7 @@ in
 
   config = mkIf config.services.dovecot2.enable {
 
-    security.pam.services = [ { name = "dovecot2"; } ];
+    security.pam.services.dovecot2 = {};
 
     users.extraUsers = [
       { name = cfg.user;
diff --git a/nixos/modules/services/misc/gurobi.nix b/nixos/modules/services/misc/gurobi.nix
new file mode 100644
index 00000000000..9cd76a1e78f
--- /dev/null
+++ b/nixos/modules/services/misc/gurobi.nix
@@ -0,0 +1,41 @@
+{ config, pkgs, ... }:
+
+with pkgs.lib;
+
+let
+  cfg = config.services.gurobi.tokenServer;
+in {
+  options = {
+    services.gurobi.tokenServer = {
+      enable = mkOption {
+        default = false;
+
+        description = "Whether to enable the Gurobi token server";
+
+        type = types.bool;
+      };
+
+      license = mkOption {
+        description = "Path to the Gurobi license file";
+
+        type = types.path;
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.gurobi-token-server = {
+      description = "Gurobi token server";
+
+      wantedBy = [ "multi-user.target" ];
+
+      environment.GRB_LICENSE_FILE = cfg.license;
+
+      serviceConfig = {
+        ExecStart = "${pkgs.gurobi}/bin/grb_ts";
+
+        Type = "forking";
+      };
+    };
+  };
+}
diff --git a/nixos/modules/services/misc/nix-daemon.nix b/nixos/modules/services/misc/nix-daemon.nix
index adf4f145f25..ff0bdf65ced 100644
--- a/nixos/modules/services/misc/nix-daemon.nix
+++ b/nixos/modules/services/misc/nix-daemon.nix
@@ -108,24 +108,10 @@ in
 
       distributedBuilds = mkOption {
         default = false;
-        description = "
+        description = ''
           Whether to distribute builds to the machines listed in
           <option>nix.buildMachines</option>.
-          If you know that the <option>buildMachines</option> are not
-          always available either use nixos
-          <command>nixos-rebuild --no-build-hook</command>
-          or consider managing <filename>/etc/nix.machines</filename> manually
-          by setting <option>manualNixMachines</option>. Then you can comment
-          unavailable build machines.
-        ";
-      };
-
-      manualNixMachines = mkOption {
-        default = false;
-        description = "
-          Whether to manually manage the list of build machines used in distributed
-          builds in /etc/nix.machines.
-        ";
+        '';
       };
 
       daemonNiceLevel = mkOption {
@@ -145,6 +131,7 @@ in
       };
 
       buildMachines = mkOption {
+        default = [];
         example = [
           { hostName = "voila.labs.cs.uu.nl";
             sshUser = "nix";
@@ -161,7 +148,7 @@ in
             mandatoryFeatures = "perf";
           }
         ];
-        description = "
+        description = ''
           This option lists the machines to be used if distributed
           builds are enabled (see
           <option>nix.distributedBuilds</option>).  Nix will perform
@@ -185,7 +172,7 @@ in
           key should be added to
           <filename>~<replaceable>sshUser</replaceable>/authorized_keys</filename>
           on the remote machine.
-        ";
+        '';
       };
 
       proxy = mkOption {
@@ -262,8 +249,8 @@ in
 
     # List of machines for distributed Nix builds in the format
     # expected by build-remote.pl.
-    environment.etc."nix.machines" =
-      { enable = cfg.distributedBuilds && !cfg.manualNixMachines;
+    environment.etc."nix/machines" =
+      { enable = cfg.buildMachines != [];
         text =
           concatMapStrings (machine:
             "${machine.sshUser}@${machine.hostName} "
@@ -307,17 +294,17 @@ in
     nix.envVars =
       { NIX_CONF_DIR = "/etc/nix";
 
-        # Enable the copy-from-other-stores substituter, which allows builds
-        # to be sped up by copying build results from remote Nix stores.  To
-        # do this, mount the remote file system on a subdirectory of
-        # /var/run/nix/remote-stores.
-        NIX_OTHER_STORES = "/var/run/nix/remote-stores/*/nix";
+        # Enable the copy-from-other-stores substituter, which allows
+        # builds to be sped up by copying build results from remote
+        # Nix stores.  To do this, mount the remote file system on a
+        # subdirectory of /run/nix/remote-stores.
+        NIX_OTHER_STORES = "/run/nix/remote-stores/*/nix";
       }
 
       // optionalAttrs cfg.distributedBuilds {
         NIX_BUILD_HOOK = "${config.environment.nix}/libexec/nix/build-remote.pl";
-        NIX_REMOTE_SYSTEMS = "/etc/nix.machines";
-        NIX_CURRENT_LOAD = "/var/run/nix/current-load";
+        NIX_REMOTE_SYSTEMS = "/etc/nix/machines";
+        NIX_CURRENT_LOAD = "/run/nix/current-load";
       }
 
       # !!! These should not be defined here, but in some general proxy configuration module!
diff --git a/nixos/modules/services/misc/nixos-manual.nix b/nixos/modules/services/misc/nixos-manual.nix
index 38f1917a46a..1260272b68e 100644
--- a/nixos/modules/services/misc/nixos-manual.nix
+++ b/nixos/modules/services/misc/nixos-manual.nix
@@ -3,7 +3,7 @@
 # of the virtual consoles.  The latter is useful for the installation
 # CD.
 
-{ config, pkgs, options, ... }:
+{ config, pkgs, baseModules, ... } @ extraArgs:
 
 with pkgs.lib;
 
@@ -13,7 +13,11 @@ let
 
   manual = import ../../../doc/manual {
     inherit (cfg) revision;
-    inherit pkgs options;
+    inherit pkgs;
+    options = (fixMergeModules baseModules
+      (removeAttrs extraArgs ["config" "options"]) // {
+        modules = [ ];
+      }).options;
   };
 
   entry = "${manual.manual}/share/doc/nixos/manual.html";
diff --git a/nixos/modules/services/monitoring/graphite.nix b/nixos/modules/services/monitoring/graphite.nix
index ec36db7b21c..7fa3ab22b00 100644
--- a/nixos/modules/services/monitoring/graphite.nix
+++ b/nixos/modules/services/monitoring/graphite.nix
@@ -5,7 +5,18 @@ with pkgs.lib;
 let
   cfg = config.services.graphite;
   writeTextOrNull = f: t: if t == null then null else pkgs.writeText f t;
+
   dataDir = "/var/db/graphite";
+  carbonOpts = name: with config.ids; ''
+    --nodaemon --syslog --prefix=${name} \
+    --uid ${toString uids.graphite} --gid ${toString uids.graphite} ${name}
+  '';
+  carbonEnv = {
+    PYTHONPATH = "${pkgs.python27Packages.carbon}/lib/python2.7/site-packages";
+    GRAPHITE_ROOT = dataDir;
+    GRAPHITE_CONF_DIR = "/etc/graphite/";
+  };
+
 in {
 
   ###### interface
@@ -34,7 +45,14 @@ in {
     carbon = {
       config = mkOption {
         description = "Content of carbon configuration file";
-        default = "";
+        default = ''
+          [cache]
+          # Listen on localhost by default for security reasons
+          UDP_RECEIVER_INTERFACE = 127.0.0.1
+          PICKLE_RECEIVER_INTERFACE = 127.0.0.1
+          LINE_RECEIVER_INTERFACE = 127.0.0.1
+          CACHE_QUERY_INTERFACE = 127.0.0.1
+        '';
         type = types.uniq types.string;
       };
 
@@ -52,7 +70,7 @@ in {
           [all_min]
           pattern = \.min$
           xFilesFactor = 0.1
-         aggregationMethod = min
+          aggregationMethod = min
         '';
       };
 
@@ -153,15 +171,8 @@ in {
       description = "Graphite data storage backend";
       wantedBy = [ "multi-user.target" ];
       after = [ "network-interfaces.target" ];
-      environment = {
-        GRAPHITE_CONF_DIR = "/etc/graphite/";
-        GRAPHITE_STORAGE_DIR = "/var/db/graphite/";
-      };
-      serviceConfig = {
-        ExecStart = "${pkgs.pythonPackages.carbon}/bin/carbon-cache.py --pidfile /tmp/carbonCache.pid start";
-        User = "graphite";
-        Group = "graphite";
-      };
+      environment = carbonEnv;
+      serviceConfig.ExecStart = "${pkgs.twisted}/bin/twistd ${carbonOpts "carbon-cache"}";
       restartTriggers = [
         pkgs.pythonPackages.carbon
         cfg.carbon.config
@@ -178,15 +189,8 @@ in {
       description = "Carbon data aggregator";
       wantedBy = [ "multi-user.target" ];
       after = [ "network-interfaces.target" ];
-      environment = {
-        GRAPHITE_CONF_DIR = "/etc/graphite/";
-        GRAPHITE_STORAGE_DIR = "${dataDir}";
-      };
-      serviceConfig = {
-        ExecStart = "${pkgs.pythonPackages.carbon}/bin/carbon-aggregator.py --pidfile /tmp/carbonAggregator.pid start";
-        User = "graphite";
-        Group = "graphite";
-      };
+      environment = carbonEnv;
+      serviceConfig.ExecStart = "${pkgs.twisted}/bin/twistd ${carbonOpts "carbon-aggregator"}";
       restartTriggers = [
         pkgs.pythonPackages.carbon cfg.carbon.config cfg.carbon.aggregationRules
       ];
@@ -196,15 +200,8 @@ in {
       description = "Carbon data relay";
       wantedBy = [ "multi-user.target" ];
       after = [ "network-interfaces.target" ];
-      environment = {
-        GRAPHITE_CONF_DIR = "/etc/graphite/";
-        GRAPHITE_STORAGE_DIR = "${dataDir}";
-      };
-      serviceConfig = {
-        ExecStart = "${pkgs.pythonPackages.carbon}/bin/carbon-relay.py --pidfile /tmp/carbonRelay.pid start";
-        User = "graphite";
-        Group = "graphite";
-      };
+      environment = carbonEnv;
+      serviceConfig.ExecStart = "${pkgs.twisted}/bin/twistd ${carbonOpts "carbon-relay"}";
       restartTriggers = [
         pkgs.pythonPackages.carbon cfg.carbon.config cfg.carbon.relayRules
       ];
@@ -218,7 +215,7 @@ in {
         PYTHONPATH = "${pkgs.python27Packages.graphite_web}/lib/python2.7/site-packages";
         DJANGO_SETTINGS_MODULE = "graphite.settings";
         GRAPHITE_CONF_DIR = "/etc/graphite/";
-        GRAPHITE_STORAGE_DIR = "${dataDir}";
+        GRAPHITE_STORAGE_DIR = dataDir;
       };
       serviceConfig = {
         ExecStart = ''
@@ -257,7 +254,7 @@ in {
       name = "graphite";
       uid = config.ids.uids.graphite;
       description = "Graphite daemon user";
-      home = "${dataDir}";
+      home = dataDir;
       createHome = true;
     };
     users.extraGroups.graphite.gid = config.ids.gids.graphite;
diff --git a/nixos/modules/services/monitoring/munin.nix b/nixos/modules/services/monitoring/munin.nix
new file mode 100644
index 00000000000..fea52fa5608
--- /dev/null
+++ b/nixos/modules/services/monitoring/munin.nix
@@ -0,0 +1,216 @@
+{ config, pkgs, ... }:
+
+# TODO: support munin-async
+# TODO: LWP/Pg perl libs aren't recognized
+
+# TODO: support fastcgi
+# http://munin-monitoring.org/wiki/CgiHowto2
+# spawn-fcgi -s /var/run/munin/fastcgi-graph.sock -U www-data   -u munin -g munin /usr/lib/munin/cgi/munin-cgi-graph
+# spawn-fcgi -s /var/run/munin/fastcgi-html.sock  -U www-data   -u munin -g munin /usr/lib/munin/cgi/munin-cgi-html
+# https://paste.sh/vofcctHP#-KbDSXVeWoifYncZmLfZzgum
+# nginx http://munin.readthedocs.org/en/latest/example/webserver/nginx.html
+
+
+with pkgs.lib;
+
+let
+  nodeCfg = config.services.munin-node;
+  cronCfg = config.services.munin-cron;
+
+  muninPlugins = pkgs.stdenv.mkDerivation {
+    name = "munin-available-plugins";
+    buildCommand = ''
+      mkdir -p $out
+
+      cp --preserve=mode ${pkgs.munin}/lib/plugins/* $out/
+
+      for file in $out/*; do
+        case "$file" in
+            plugin.sh) continue;;
+        esac
+
+        # read magic makers from the file
+        family=$(sed -nr 's/.*#%#\s+family\s*=\s*(\S+)\s*/\1/p' $file)
+        cap=$(sed -nr 's/.*#%#\s+capabilities\s*=\s*(.+)/\1/p' $file)
+
+        wrapProgram $file \
+          --set PATH "/run/current-system/sw/bin:/run/current-system/sw/sbin" \
+          --set MUNIN_LIBDIR "${pkgs.munin}/lib" \
+          --set MUNIN_PLUGSTATE "/var/run/munin"
+ 
+        # munin uses markers to tell munin-node-configure what a plugin can do
+        echo "#%# family=$family" >> $file
+        echo "#%# capabilities=$cap" >> $file
+      done
+
+      # NOTE: we disable disktstats because plugin seems to fail and it hangs html generation (100% CPU + memory leak)
+      rm -f $out/diskstats
+    '';
+    buildInputs = [ pkgs.makeWrapper ];
+  };
+
+  muninConf = pkgs.writeText "munin.conf"
+    ''
+      dbdir     /var/lib/munin
+      htmldir   /var/www/munin
+      logdir    /var/log/munin
+      rundir    /var/run/munin
+
+      ${cronCfg.extraGlobalConfig}
+      
+      ${cronCfg.hosts}
+    '';
+
+  nodeConf = pkgs.writeText "munin-node.conf"
+    ''
+      log_level 3
+      log_file Sys::Syslog
+      port 4949
+      host *
+      background 0
+      user root
+      group root
+      host_name ${config.networking.hostName}
+      setsid 0
+  
+      # wrapped plugins by makeWrapper being with dots
+      ignore_file ^\.
+      
+      allow ^127\.0\.0\.1$
+
+      ${nodeCfg.extraConfig}
+    '';
+in
+
+{
+
+  options = {
+
+    services.munin-node = {
+
+      enable = mkOption {
+        default = false;
+        description = ''
+          Enable Munin Node agent. Munin node listens on 0.0.0.0 and
+          by default accepts connections only from 127.0.0.1 for security reasons.
+
+          See <link xlink:href='http://munin-monitoring.org/wiki/munin-node' />.
+        '';
+      };
+      
+      extraConfig = mkOption {
+        default = "";
+        description = ''
+          <filename>munin-node.conf</filename> extra configuration. See
+          <link xlink:href='http://munin-monitoring.org/wiki/munin-node.conf' />
+        '';
+      };
+
+      # TODO: add option to add additional plugins
+
+    };
+
+    services.munin-cron = {
+
+      enable = mkOption {
+        default = false;
+        description = ''
+          Enable munin-cron. Takes care of all heavy lifting to collect data from
+          nodes and draws graphs to html. Runs munin-update, munin-limits,
+          munin-graphs and munin-html in that order.
+ 
+          HTML output is in <filename>/var/www/munin/</filename>, configure your
+          favourite webserver to serve static files.
+        '';
+        example = literalExample ''
+          services = {
+             munin-node.enable = true;
+             munin-cron = {
+               enable = true;
+               hosts = '''
+                 [''${config.networking.hostName}]
+                 address localhost
+               ''';
+               extraGlobalConfig = '''
+                 contact.email.command mail -s "Munin notification for ''${var:host}" someone@example.com
+               ''';
+             };
+          };
+        '';
+      };
+      
+      extraGlobalConfig = mkOption {
+        default = "";
+        description = ''
+          <filename>munin.conf</filename> extra global configuration.
+          See <link xlink:href='http://munin-monitoring.org/wiki/munin-node' />.
+          Useful to setup notifications, see
+          <link xlink:href='http://munin-monitoring.org/wiki/HowToContact' />
+        '';
+      };
+
+      hosts = mkOption {
+        example = ''
+          [''${config.networking.hostName}]
+          address localhost
+        '';
+        description = ''
+          Definitions of hosts of nodes to collect data from. Needs at least one
+          hosts for cron to succeed. See
+          <link xlink:href='http://munin-monitoring.org/wiki/munin.conf' />
+        '';
+      };
+ 
+    };
+
+  };
+
+  config = mkMerge [ (mkIf (nodeCfg.enable || cronCfg.enable)  {
+
+    environment.systemPackages = [ pkgs.munin ];
+
+    users.extraUsers = [{
+      name = "munin";
+      description = "Munin monitoring user";
+      group = "munin";
+    }];
+
+    users.extraGroups = [{
+      name = "munin";
+    }];
+
+  }) (mkIf nodeCfg.enable {
+
+    systemd.services.munin-node = {
+      description = "Munin node, the agent process";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      path = [ pkgs.munin ];
+      environment.MUNIN_PLUGSTATE = "/var/run/munin";
+      serviceConfig = {
+        ExecStart = "${pkgs.munin}/sbin/munin-node --config ${nodeConf} --servicedir /etc/munin/plugins/";
+      };
+    };
+
+    system.activationScripts.munin-node = ''
+      echo "updating munin plugins..."
+
+      export PATH="/run/current-system/sw/bin:/run/current-system/sw/sbin";
+      mkdir -p /etc/munin/plugins
+      rm -rf /etc/munin/plugins/*
+      ${pkgs.munin}/sbin/munin-node-configure --shell --families contrib,auto,manual --config ${nodeConf} --libdir=${muninPlugins} --servicedir=/etc/munin/plugins 2>/dev/null | ${pkgs.bash}/bin/bash
+    '';
+
+  }) (mkIf cronCfg.enable {
+
+    services.cron.systemCronJobs = [
+      "*/5 * * * * munin ${pkgs.munin}/bin/munin-cron --config ${muninConf}"
+    ];
+
+    system.activationScripts.munin-cron = stringAfter [ "users" "groups" ] ''
+      mkdir -p /var/{run,log,www,lib}/munin
+      chown -R munin:munin /var/{run,log,www,lib}/munin
+    '';
+
+  })];
+}
diff --git a/nixos/modules/services/monitoring/statsd.nix b/nixos/modules/services/monitoring/statsd.nix
index a3266605671..120c8860d57 100644
--- a/nixos/modules/services/monitoring/statsd.nix
+++ b/nixos/modules/services/monitoring/statsd.nix
@@ -10,6 +10,8 @@ let
     {
       host: "${cfg.host}",
       port: "${toString cfg.port}",
+      mgmt_address: "${cfg.mgmt_address}",
+      mgmt_port: "${toString cfg.mgmt_port}",
       backends: [${concatMapStrings (el: ''"./backends/${el}",'') cfg.backends}],
       graphiteHost: "${cfg.graphiteHost}",
       graphitePort: "${toString cfg.graphitePort}",
@@ -43,6 +45,18 @@ in
       type = types.uniq types.int;
     };
 
+    mgmt_address = mkOption {
+      description = "Address to run managment TCP interface on";
+      default = "127.0.0.1";
+      type = types.uniq types.string;
+    };
+
+    mgmt_port = mkOption {
+      description = "Port to run the management TCP interface on";
+      default = 8126;
+      type = types.uniq types.int;
+    };
+
     backends = mkOption {
       description = "List of backends statsd will use for data persistance";
       default = ["graphite"];
diff --git a/nixos/modules/services/monitoring/uptime.nix b/nixos/modules/services/monitoring/uptime.nix
index fa3de7d90bc..553110d7b80 100644
--- a/nixos/modules/services/monitoring/uptime.nix
+++ b/nixos/modules/services/monitoring/uptime.nix
@@ -51,7 +51,7 @@ in {
 
     enableWebService = mkEnableOption "the uptime monitoring program web service";
 
-    enableSeparateMonitoringService = mkEnableOption "the uptime monitoring service (default: enableWebService == true)" // { default = cfg.enableWebService; };
+    enableSeparateMonitoringService = mkEnableOption "the uptime monitoring service" // { default = cfg.enableWebService; };
 
     nodeEnv = mkOption {
       description = "The node environment to run in (development, production, etc.)";
diff --git a/nixos/modules/services/network-filesystems/samba.nix b/nixos/modules/services/network-filesystems/samba.nix
index 70a14487ea5..e18d9d7b67b 100644
--- a/nixos/modules/services/network-filesystems/samba.nix
+++ b/nixos/modules/services/network-filesystems/samba.nix
@@ -198,6 +198,7 @@ in
       }
 
       (mkIf config.services.samba.enable {
+
         users.extraUsers.smbguest = {
           description = "Samba service user";
           group = group;
@@ -228,6 +229,8 @@ in
           };
         };
 
+        security.pam.services.sambda = {};
+
       })
     ];
 
diff --git a/nixos/modules/services/networking/ejabberd.nix b/nixos/modules/services/networking/ejabberd.nix
index 6d233e543e2..05e0aba7d70 100644
--- a/nixos/modules/services/networking/ejabberd.nix
+++ b/nixos/modules/services/networking/ejabberd.nix
@@ -130,6 +130,8 @@ in
           '';
       };
 
+    security.pam.services.ejabberd = {};
+
   };
 
 }
diff --git a/nixos/modules/services/networking/ssh/lshd.nix b/nixos/modules/services/networking/ssh/lshd.nix
index d32fabbde24..04ef76f1e4d 100644
--- a/nixos/modules/services/networking/ssh/lshd.nix
+++ b/nixos/modules/services/networking/ssh/lshd.nix
@@ -170,6 +170,8 @@ in
           '';
       };
 
+    security.pam.services.lshd = {};
+
   };
 
 }
diff --git a/nixos/modules/services/networking/ssh/sshd.nix b/nixos/modules/services/networking/ssh/sshd.nix
index d57eef860d2..c85c9307e3e 100644
--- a/nixos/modules/services/networking/ssh/sshd.nix
+++ b/nixos/modules/services/networking/ssh/sshd.nix
@@ -128,21 +128,10 @@ in
         '';
       };
 
-      usePAM = mkOption {
-        default = true;
-        description = ''
-          Specifies whether the OpenSSH daemon uses PAM to authenticate
-          login attempts.
-        '';
-      };
-
       passwordAuthentication = mkOption {
         default = true;
         description = ''
-          Specifies whether password authentication is allowed. Note
-          that setting this value to <literal>false</literal> is most
-          probably not going to have the desired effect unless
-          <literal>usePAM</literal> is disabled as well.
+          Specifies whether password authentication is allowed.
         '';
       };
 
@@ -284,7 +273,11 @@ in
 
     networking.firewall.allowedTCPPorts = cfg.ports;
 
-    security.pam.services = optional cfg.usePAM { name = "sshd"; startSession = true; showMotd = true; };
+    security.pam.services.sshd =
+      { startSession = true;
+        showMotd = true;
+        unixAuth = cfg.passwordAuthentication;
+      };
 
     services.openssh.authorizedKeysFiles =
       [ ".ssh/authorized_keys" ".ssh/authorized_keys2" "/etc/ssh/authorized_keys.d/%u" ];
@@ -295,7 +288,7 @@ in
 
         Protocol 2
 
-        UsePAM ${if cfg.usePAM then "yes" else "no"}
+        UsePAM yes
 
         AddressFamily ${if config.networking.enableIPv6 then "any" else "inet"}
         ${concatMapStrings (port: ''
diff --git a/nixos/modules/services/printing/cupsd.nix b/nixos/modules/services/printing/cupsd.nix
index c9a4a9087e5..1c3dc9d90b1 100644
--- a/nixos/modules/services/printing/cupsd.nix
+++ b/nixos/modules/services/printing/cupsd.nix
@@ -219,5 +219,7 @@ in
     # Allow CUPS to receive IPP printer announcements via UDP.
     networking.firewall.allowedUDPPorts = [ 631 ];
 
+    security.pam.services.cups = {};
+
   };
 }
diff --git a/nixos/modules/services/scheduling/atd.nix b/nixos/modules/services/scheduling/atd.nix
index 88bec2cb2f3..8c96252668e 100644
--- a/nixos/modules/services/scheduling/atd.nix
+++ b/nixos/modules/services/scheduling/atd.nix
@@ -49,7 +49,7 @@ in
 
     environment.systemPackages = [ at ];
 
-    security.pam.services = [ { name = "atd"; } ];
+    security.pam.services.atd = {};
 
     users.extraUsers = singleton
       { name = "atd";
diff --git a/nixos/modules/services/search/elasticsearch.nix b/nixos/modules/services/search/elasticsearch.nix
index 6dfabc7e305..3c27c1400f9 100644
--- a/nixos/modules/services/search/elasticsearch.nix
+++ b/nixos/modules/services/search/elasticsearch.nix
@@ -66,9 +66,9 @@ in {
     logging = mkOption {
       description = "Elasticsearch logging configuration";
       default = ''
-        rootLogger: DEBUG, console
+        rootLogger: INFO, console
         logger:
-          action: DEBUG
+          action: INFO
           com.amazonaws: WARN
         appender:
           console:
diff --git a/nixos/modules/services/security/fail2ban.nix b/nixos/modules/services/security/fail2ban.nix
index 2b2a54ef409..395a5df8af0 100644
--- a/nixos/modules/services/security/fail2ban.nix
+++ b/nixos/modules/services/security/fail2ban.nix
@@ -10,7 +10,7 @@ let
 
   jailConf = pkgs.writeText "jail.conf"
     (concatStringsSep "\n" (attrValues (flip mapAttrs cfg.jails (name: def:
-      optionalString (def != "") 
+      optionalString (def != "")
         ''
           [${name}]
           ${def}
@@ -32,7 +32,8 @@ in
             [Definition]
             loglevel  = 3
             logtarget = SYSLOG
-            socket    = /var/run/fail2ban/fail2ban.sock
+            socket    = /run/fail2ban/fail2ban.sock
+            pidfile   = /run/fail2ban/fail2ban.pid
           '';
         type = types.string;
         description =
@@ -71,56 +72,53 @@ in
             <filename>/etc/fail2ban/filter.d</filename>.
           '';
       };
-      
+
     };
 
   };
 
-  
+
   ###### implementation
 
   config = {
 
     environment.systemPackages = [ pkgs.fail2ban ];
 
-    environment.etc =
-      [ { source = fail2banConf;
-          target = "fail2ban/fail2ban.conf";
-        }
-        { source = jailConf;
-          target = "fail2ban/jail.conf";
-        }
-        { source = "${pkgs.fail2ban}/etc/fail2ban/action.d/*.conf";
-          target = "fail2ban/action.d";
-        }
-        { source = "${pkgs.fail2ban}/etc/fail2ban/filter.d/*.conf";
-          target = "fail2ban/filter.d";
-        }
-      ];
-
-    system.activationScripts.fail2ban =
-      ''
-        mkdir -p /var/run/fail2ban -m 0755
-      '';
+    environment.etc."fail2ban/fail2ban.conf".source = fail2banConf;
+    environment.etc."fail2ban/jail.conf".source = jailConf;
+    environment.etc."fail2ban/action.d".source = "${pkgs.fail2ban}/etc/fail2ban/action.d/*.conf";
+    environment.etc."fail2ban/filter.d".source = "${pkgs.fail2ban}/etc/fail2ban/filter.d/*.conf";
 
     systemd.services.fail2ban =
       { description = "Fail2ban intrusion prevention system";
 
         wantedBy = [ "multi-user.target" ];
         after = [ "network.target" ];
-      
+
         restartTriggers = [ fail2banConf jailConf ];
         path = [ pkgs.fail2ban pkgs.iptables ];
-        
+
+        preStart =
+          ''
+            mkdir -p /run/fail2ban -m 0755
+          '';
+
         serviceConfig =
           { ExecStart = "${pkgs.fail2ban}/bin/fail2ban-server -f";
             ReadOnlyDirectories = "/";
-            ReadWriteDirectories = "/var/run/fail2ban /var/tmp";
-            CapabilityBoundingSet="CAP_DAC_READ_SEARCH CAP_NET_ADMIN CAP_NET_RAW";
+            ReadWriteDirectories = "/run/fail2ban /var/tmp";
+            CapabilityBoundingSet = "CAP_DAC_READ_SEARCH CAP_NET_ADMIN CAP_NET_RAW";
           };
 
         postStart =
           ''
+            # Wait for the server to start listening.
+            for ((n = 0; n < 20; n++)); do
+              if fail2ban-client ping; then break; fi
+              sleep 0.5
+            done
+
+            # Reload its configuration.
             fail2ban-client reload
           '';
       };
@@ -137,14 +135,14 @@ in
       '';
 
     # Block SSH if there are too many failing connection attempts.
-    services.fail2ban.jails."ssh-iptables" =
+    services.fail2ban.jails.ssh-iptables =
       ''
         filter   = sshd
         action   = iptables[name=SSH, port=ssh, protocol=tcp]
         logpath  = /var/log/warn
         maxretry = 5
       '';
-    
+
   };
 
 }
diff --git a/nixos/modules/services/web-servers/zope2.nix b/nixos/modules/services/web-servers/zope2.nix
index 19afa55d7fe..f75b62b219a 100644
--- a/nixos/modules/services/web-servers/zope2.nix
+++ b/nixos/modules/services/web-servers/zope2.nix
@@ -37,14 +37,14 @@ let
         default =
           ''
           <zodb_db main>
-          mount-point /
-          cache-size 30000
-          <blobstorage>
-              blob-dir /var/lib/zope2/${name}/blobstorage
-              <filestorage>
-              path /var/lib/zope2/${name}/filestorage/Data.fs
-              </filestorage>
-          </blobstorage>
+            mount-point /
+            cache-size 30000
+            <blobstorage>
+                blob-dir /var/lib/zope2/${name}/blobstorage
+                <filestorage>
+                path /var/lib/zope2/${name}/filestorage/Data.fs
+                </filestorage>
+            </blobstorage>
           </zodb_db>
           '';
         type = types.string;
@@ -76,14 +76,14 @@ in
           extra =
             ''
             <zodb_db main>
-            mount-point /
-            cache-size 30000
-            <blobstorage>
-                blob-dir /var/lib/zope2/plone01/blobstorage
-                <filestorage>
-                path /var/lib/zope2/plone01/filestorage/Data.fs
-                </filestorage>
-            </blobstorage>
+              mount-point /
+              cache-size 30000
+              <blobstorage>
+                  blob-dir /var/lib/zope2/plone01/blobstorage
+                  <filestorage>
+                  path /var/lib/zope2/plone01/filestorage/Data.fs
+                  </filestorage>
+              </blobstorage>
             </zodb_db>
             '';
 
@@ -107,32 +107,32 @@ in
           let
             interpreter = pkgs.writeScript "interpreter"
               ''
-import sys
-
-_interactive = True
-if len(sys.argv) > 1:
-    _options, _args = __import__("getopt").getopt(sys.argv[1:], 'ic:m:')
-    _interactive = False
-    for (_opt, _val) in _options:
-        if _opt == '-i':
-            _interactive = True
-        elif _opt == '-c':
-            exec _val
-        elif _opt == '-m':
-            sys.argv[1:] = _args
-            _args = []
-            __import__("runpy").run_module(
-                 _val, {}, "__main__", alter_sys=True)
-
-    if _args:
-        sys.argv[:] = _args
-        __file__ = _args[0]
-        del _options, _args
-        execfile(__file__)
-
-if _interactive:
-    del _interactive
-    __import__("code").interact(banner="", local=globals())
+              import sys
+
+              _interactive = True
+              if len(sys.argv) > 1:
+                  _options, _args = __import__("getopt").getopt(sys.argv[1:], 'ic:m:')
+                  _interactive = False
+                  for (_opt, _val) in _options:
+                      if _opt == '-i':
+                          _interactive = True
+                      elif _opt == '-c':
+                          exec _val
+                      elif _opt == '-m':
+                          sys.argv[1:] = _args
+                          _args = []
+                          __import__("runpy").run_module(
+                              _val, {}, "__main__", alter_sys=True)
+
+                  if _args:
+                      sys.argv[:] = _args
+                      __file__ = _args[0]
+                      del _options, _args
+                      execfile(__file__)
+
+              if _interactive:
+                  del _interactive
+                  __import__("code").interact(banner="", local=globals())
               '';
             env = pkgs.buildEnv {
               name = "zope2-${name}-env";
@@ -149,73 +149,76 @@ if _interactive:
                 '';
             };
             conf = pkgs.writeText "zope2-${name}-conf"
-              ''%define INSTANCEHOME ${env}
-instancehome $INSTANCEHOME
-%define CLIENTHOME /var/lib/zope2/${name}
-clienthome $CLIENTHOME
-
-debug-mode off
-security-policy-implementation C
-verbose-security off
-default-zpublisher-encoding utf-8
-zserver-threads ${toString opts.threads}
-effective-user ${opts.user}
-
-pid-filename /var/lib/zope2/${name}/pid
-lock-filename /var/lib/zope2/${name}/lock
-python-check-interval 1000
-enable-product-installation off
-
-<environment>
-  zope_i18n_compile_mo_files false
-</environment>
-
-<eventlog>
-level INFO
-<logfile>
-    path /var/log/zope2/${name}.log
-    level INFO
-</logfile>
-</eventlog>
-
-<logger access>
-level WARN
-<logfile>
-    path /var/log/zope2/${name}-Z2.log
-    format %(message)s
-</logfile>
-</logger>
-
-<http-server>
-address ${opts.http_address}
-</http-server>
-
-<zodb_db temporary>
-<temporarystorage>
-    name temporary storage for sessioning
-</temporarystorage>
-mount-point /temp_folder
-container-class Products.TemporaryFolder.TemporaryContainer
-</zodb_db>
-
-${opts.extra}
+              ''
+              %define INSTANCEHOME ${env}
+              instancehome $INSTANCEHOME
+              %define CLIENTHOME /var/lib/zope2/${name}
+              clienthome $CLIENTHOME
+
+              debug-mode off
+              security-policy-implementation C
+              verbose-security off
+              default-zpublisher-encoding utf-8
+              zserver-threads ${toString opts.threads}
+              effective-user ${opts.user}
+
+              pid-filename /var/lib/zope2/${name}/pid
+              lock-filename /var/lib/zope2/${name}/lock
+              python-check-interval 1000
+              enable-product-installation off
+
+              <environment>
+                zope_i18n_compile_mo_files false
+              </environment>
+
+              <eventlog>
+              level INFO
+              <logfile>
+                  path /var/log/zope2/${name}.log
+                  level INFO
+              </logfile>
+              </eventlog>
+
+              <logger access>
+              level WARN
+              <logfile>
+                  path /var/log/zope2/${name}-Z2.log
+                  format %(message)s
+              </logfile>
+              </logger>
+
+              <http-server>
+              address ${opts.http_address}
+              </http-server>
+
+              <zodb_db temporary>
+              <temporarystorage>
+                  name temporary storage for sessioning
+              </temporarystorage>
+              mount-point /temp_folder
+              container-class Products.TemporaryFolder.TemporaryContainer
+              </zodb_db>
+
+              ${opts.extra}
               '';
             ctlScript = pkgs.writeScript "zope2-${name}-ctl-script"
-              ''#!${env}/bin/python
+              ''
+              #!${env}/bin/python
 
-import sys
-import plone.recipe.zope2instance.ctl
+              import sys
+              import plone.recipe.zope2instance.ctl
 
-if __name__ == '__main__':
-    sys.exit(plone.recipe.zope2instance.ctl.main(
-        ["-C", "${conf}"]
-        + sys.argv[1:]))
+              if __name__ == '__main__':
+                  sys.exit(plone.recipe.zope2instance.ctl.main(
+                      ["-C", "${conf}"]
+                      + sys.argv[1:]))
               '';
 
             ctl = pkgs.writeScript "zope2-${name}-ctl"
-              ''#!${pkgs.bash}/bin/bash -e
-export PYTHONHOME=${env}
-exec ${ctlScript} "$@"
+              ''
+              #!${pkgs.bash}/bin/bash -e
+              export PYTHONHOME=${env}
+              exec ${ctlScript} "$@"
               '';
           in {
             description = "zope2 ${name} instance";
diff --git a/nixos/modules/services/x11/desktop-managers/kde4.nix b/nixos/modules/services/x11/desktop-managers/kde4.nix
index c76acfbcd4e..d1eb1799bc8 100644
--- a/nixos/modules/services/x11/desktop-managers/kde4.nix
+++ b/nixos/modules/services/x11/desktop-managers/kde4.nix
@@ -162,7 +162,7 @@ in
     services.udisks2.enable = wantsUdisks2;
     services.upower.enable = config.powerManagement.enable;
 
-    security.pam.services = [ { name = "kde"; allowNullPassword = true; startSession = true; } ];
+    security.pam.services.kde = { allowNullPassword = true; };
 
   };
 
diff --git a/nixos/modules/services/x11/display-managers/default.nix b/nixos/modules/services/x11/display-managers/default.nix
index c7599e245b0..91de910662f 100644
--- a/nixos/modules/services/x11/display-managers/default.nix
+++ b/nixos/modules/services/x11/display-managers/default.nix
@@ -239,39 +239,35 @@ in
         };
       };
 
-      job = mkOption {
-        default = {};
-        type = types.uniq types.optionSet;
-        description = "This option defines how to start the display manager.";
-
-        options = {
-
-          preStart = mkOption {
-            default = "";
-            example = "rm -f /var/log/my-display-manager.log";
-            description = "Script executed before the display manager is started.";
-          };
-
-          execCmd = mkOption {
-            example = "${pkgs.slim}/bin/slim";
-            description = "Command to start the display manager.";
-          };
-
-          environment = mkOption {
-            default = {};
-            example = { SLIM_CFGFILE = /etc/slim.conf; };
-            description = "Additional environment variables needed by the display manager.";
-          };
-
-          logsXsession = mkOption {
-            default = false;
-            description = ''
-              Whether the display manager redirects the
-              output of the session script to
-              <filename>~/.xsession-errors</filename>.
-            '';
-          };
+      job = {
 
+        preStart = mkOption {
+          type = types.lines;
+          default = "";
+          example = "rm -f /var/log/my-display-manager.log";
+          description = "Script executed before the display manager is started.";
+        };
+
+        execCmd = mkOption {
+          type = types.uniq types.string;
+          example = "${pkgs.slim}/bin/slim";
+          description = "Command to start the display manager.";
+        };
+
+        environment = mkOption {
+          default = {};
+          example = { SLIM_CFGFILE = /etc/slim.conf; };
+          description = "Additional environment variables needed by the display manager.";
+        };
+
+        logsXsession = mkOption {
+          type = types.bool;
+          default = false;
+          description = ''
+            Whether the display manager redirects the
+            output of the session script to
+            <filename>~/.xsession-errors</filename>.
+          '';
         };
 
       };
diff --git a/nixos/modules/services/x11/display-managers/kdm.nix b/nixos/modules/services/x11/display-managers/kdm.nix
index 229ab12c6e1..c03f7116454 100644
--- a/nixos/modules/services/x11/display-managers/kdm.nix
+++ b/nixos/modules/services/x11/display-managers/kdm.nix
@@ -128,7 +128,7 @@ in
     services.xserver.displayManager.slim.enable = false;
 
     services.xserver.displayManager.job =
-      { execCmd =
+      { execCmd = mkFixStrictness
           ''
             mkdir -m 0755 -p /var/lib/kdm
             chown kdm /var/lib/kdm
@@ -138,7 +138,7 @@ in
         logsXsession = true;
       };
 
-    security.pam.services = [ { name = "kde"; allowNullPassword = true; startSession = true; } ];
+    security.pam.services.kde = { allowNullPassword = true; startSession = true; };
 
     users.extraUsers = singleton
       { name = "kdm";
diff --git a/nixos/modules/services/x11/display-managers/lightdm.nix b/nixos/modules/services/x11/display-managers/lightdm.nix
index c2b90d239ea..f4fb5ee003a 100644
--- a/nixos/modules/services/x11/display-managers/lightdm.nix
+++ b/nixos/modules/services/x11/display-managers/lightdm.nix
@@ -89,11 +89,14 @@ in
   };
 
   config = mkIf cfg.enable {
+
+    services.xserver.displayManager.slim.enable = false;
+
     services.xserver.displayManager.job = {
       logsXsession = true;
 
       # lightdm relaunches itself via just `lightdm`, so needs to be on the PATH
-      execCmd = ''
+      execCmd = mkFixStrictness ''
         export PATH=${lightdm}/sbin:$PATH
         ${lightdm}/sbin/lightdm --log-dir=/var/log --run-dir=/run --config=${lightdmConf}
       '';
@@ -102,10 +105,8 @@ in
     services.dbus.enable = true;
     services.dbus.packages = [ lightdm ];
 
-    security.pam.services = [
-      { name = "lightdm"; allowNullPassword = true; startSession = true; }
-      { name = "lightdm-greeter"; allowNullPassword = true; startSession = true; }
-    ];
+    security.pam.services.lightdm = { allowNullPassword = true; startSession = true; };
+    security.pam.services.lightdm-greeter = { allowNullPassword = true; startSession = true; };
 
     users.extraUsers.lightdm = {
       createHome = true;
diff --git a/nixos/modules/services/x11/display-managers/slim.nix b/nixos/modules/services/x11/display-managers/slim.nix
index 9e8b9391f45..01c9fa96c8c 100644
--- a/nixos/modules/services/x11/display-managers/slim.nix
+++ b/nixos/modules/services/x11/display-managers/slim.nix
@@ -12,7 +12,7 @@ let
       xauth_path ${dmcfg.xauthBin}
       default_xserver ${dmcfg.xserverBin}
       xserver_arguments ${dmcfg.xserverArgs}
-      sessions ${pkgs.lib.concatStringsSep "," (dmcfg.session.names ++ ["custom"])}
+      sessiondir ${dmcfg.session.desktops}
       login_cmd exec ${pkgs.stdenv.shell} ${dmcfg.session.script} "%session"
       halt_cmd ${config.systemd.package}/sbin/shutdown -h now
       reboot_cmd ${config.systemd.package}/sbin/shutdown -r now
@@ -45,7 +45,7 @@ in
     services.xserver.displayManager.slim = {
 
       enable = mkOption {
-        default = true;
+        default = config.services.xserver.enable;
         description = ''
           Whether to enable SLiM as the display manager.
         '';
@@ -106,7 +106,12 @@ in
 
     # Allow null passwords so that the user can login as root on the
     # installation CD.
-    security.pam.services = [ { name = "slim"; allowNullPassword = true; startSession = true; } ];
+    security.pam.services.slim = { allowNullPassword = true; startSession = true; };
+
+    # Allow slimlock to work.
+    security.pam.services.slimlock = {};
+
+    environment.systemPackages = [ pkgs.slim ];
 
   };
 
diff --git a/nixos/modules/services/x11/xserver.nix b/nixos/modules/services/x11/xserver.nix
index d42d7caaa06..02ba680255b 100644
--- a/nixos/modules/services/x11/xserver.nix
+++ b/nixos/modules/services/x11/xserver.nix
@@ -229,6 +229,14 @@ in
         '';
       };
 
+      s3tcSupport = mkOption {
+        default = false;
+        description = ''
+          Make S2TC via libtxc_dxtn available to OpenGL drivers. Using
+          this library may require a patent license depending on your location.
+        '';
+      };
+
       startOpenSSHAgent = mkOption {
         default = true;
         description = ''
@@ -410,7 +418,9 @@ in
       optionals (elem "nvidia" driverNames) [ "nouveau" "nvidiafb" ];
 
     environment.variables.LD_LIBRARY_PATH =
-      [ "/run/opengl-driver/lib" "/run/opengl-driver-32/lib" ];
+      [ "/run/opengl-driver/lib" "/run/opengl-driver-32/lib" ]
+      ++ pkgs.lib.optional cfg.s3tcSupport "${pkgs.libtxc_dxtn}/lib"
+      ++ pkgs.lib.optional (cfg.s3tcSupport && cfg.driSupport32Bit) "${pkgs_i686.libtxc_dxtn}/lib";
 
     environment.etc =
       (optionals cfg.exportConfiguration
@@ -527,6 +537,11 @@ in
           '';
 
         script = "${cfg.displayManager.job.execCmd}";
+
+        serviceConfig = {
+          Restart = "always";
+          RestartSec = "200ms";
+        };
       };
 
     services.xserver.displayManager.xserverArgs =
diff --git a/nixos/modules/system/boot/loader/grub/grub.nix b/nixos/modules/system/boot/loader/grub/grub.nix
index 8e9f3253f87..c7c1f675c77 100644
--- a/nixos/modules/system/boot/loader/grub/grub.nix
+++ b/nixos/modules/system/boot/loader/grub/grub.nix
@@ -237,13 +237,14 @@ in
 
     boot.loader.grub.devices = optional (cfg.device != "") cfg.device;
 
-    system.build = mkAssert (cfg.devices != [])
-      "You must set the ‘boot.loader.grub.device’ option to make the system bootable."
-      { installBootLoader =
-          "PERL5LIB=${makePerlPath [ pkgs.perlPackages.XMLLibXML pkgs.perlPackages.XMLSAX ]} " +
-          "${pkgs.perl}/bin/perl ${./install-grub.pl} ${grubConfig}";
-        inherit grub;
-      };
+    system.build.installBootLoader =
+      if cfg.devices == [] then
+        throw "You must set the ‘boot.loader.grub.device’ option to make the system bootable."
+      else
+        "PERL5LIB=${makePerlPath [ pkgs.perlPackages.XMLLibXML pkgs.perlPackages.XMLSAX ]} " +
+        "${pkgs.perl}/bin/perl ${./install-grub.pl} ${grubConfig}";
+
+    system.build.grub = grub;
 
     # Common attribute for boot loaders so only one of them can be
     # set at once.
diff --git a/nixos/modules/tasks/filesystems/xfs.nix b/nixos/modules/tasks/filesystems/xfs.nix
index 5f9eb741c2a..6800696a05a 100644
--- a/nixos/modules/tasks/filesystems/xfs.nix
+++ b/nixos/modules/tasks/filesystems/xfs.nix
@@ -13,7 +13,7 @@ in
 
     system.fsPackages = [ pkgs.xfsprogs ];
 
-    boot.initrd.kernelModules = mkIf inInitrd [ "xfs" "crc32c" ];
+    boot.initrd.availableKernelModules = mkIf inInitrd [ "xfs" "crc32c" ];
 
     boot.initrd.extraUtilsCommands = mkIf inInitrd
       ''
diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix
index 5b521a45547..708b462e0e5 100644
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@@ -295,7 +295,7 @@ in
 
     boot.initrd.postMountCommands =
       ''
-        # Mark this as a NixOS machinex.
+        # Mark this as a NixOS machine.
         mkdir -p $targetRoot/etc
         echo -n > $targetRoot/etc/NIXOS
 
@@ -303,7 +303,6 @@ in
         chmod 1777 $targetRoot/tmp
 
         mkdir -p $targetRoot/boot
-        mount -o remount,ro $targetRoot/nix/store
         ${optionalString cfg.writableStore ''
           mkdir -p /unionfs-chroot/ro-store
           mount --rbind $targetRoot/nix/store /unionfs-chroot/ro-store
diff --git a/nixos/modules/virtualisation/virtualbox-guest.nix b/nixos/modules/virtualisation/virtualbox-guest.nix
index e1a83cdecc2..664fd21781c 100644
--- a/nixos/modules/virtualisation/virtualbox-guest.nix
+++ b/nixos/modules/virtualisation/virtualbox-guest.nix
@@ -82,10 +82,6 @@ optionalAttrs (pkgs.stdenv.isi686 || pkgs.stdenv.isx86_64) # ugly...
         # Allow systemd dependencies on vboxguest.
         KERNEL=="vboxguest", TAG+="systemd"
       '';
-
-    # Make the ACPI Shutdown command to do the right thing.
-    services.acpid.enable = true;
-    services.acpid.powerEventCommands = "poweroff";
   };
 
 }
diff --git a/nixos/release-combined.nix b/nixos/release-combined.nix
index f36f3fd9aba..6866c709dd4 100644
--- a/nixos/release-combined.nix
+++ b/nixos/release-combined.nix
@@ -43,16 +43,22 @@ in rec {
         (all nixos.iso_graphical)
         (all nixos.ova)
 
+        (all nixos.tests.efi-installer.simple)
         (all nixos.tests.firefox)
         (all nixos.tests.firewall)
+        (all nixos.tests.installer.grub1)
         (all nixos.tests.installer.lvm)
         (all nixos.tests.installer.separateBoot)
         (all nixos.tests.installer.simple)
+        (all nixos.tests.ipv6)
         (all nixos.tests.kde4)
         (all nixos.tests.login)
         (all nixos.tests.misc)
+        (all nixos.tests.nat)
+        (all nixos.tests.nfs3)
         (all nixos.tests.openssh)
         (all nixos.tests.printing)
+        (all nixos.tests.proxy)
         (all nixos.tests.xfce)
 
         nixpkgs.tarball
diff --git a/nixos/release.nix b/nixos/release.nix
index 094eacf7059..e19403eccb6 100644
--- a/nixos/release.nix
+++ b/nixos/release.nix
@@ -224,7 +224,4 @@ in {
         mapAttrsRecursiveCond (x: !x ? test) (n: v: listToAttrs [(nameValuePair system v.test)])
           (import ./tests { inherit nixpkgs system; });
     in fold recursiveUpdate {} (map testsFor systems);
-    
-    
-  run-in-machine-tests = pkgs.lib.genAttrs systems (system: import ./tests/run-in-machine.nix { inherit nixpkgs system; });
 }
diff --git a/nixos/tests/default.nix b/nixos/tests/default.nix
index 17fe6a6d045..0c971f1b712 100644
--- a/nixos/tests/default.nix
+++ b/nixos/tests/default.nix
@@ -25,13 +25,14 @@ with import ../lib/testing.nix { inherit system minimal; };
   nfs3 = makeTest (import ./nfs.nix { version = 3; });
   #nfs4 = makeTest (import ./nfs.nix { version = 4; });
   openssh = makeTest (import ./openssh.nix);
-  partition = makeTest (import ./partition.nix);
+  #partition = makeTest (import ./partition.nix);
   printing = makeTest (import ./printing.nix);
   proxy = makeTest (import ./proxy.nix);
   quake3 = makeTest (import ./quake3.nix);
   simple = makeTest (import ./simple.nix);
   #subversion = makeTest (import ./subversion.nix);
   tomcat = makeTest (import ./tomcat.nix);
-  trac = makeTest (import ./trac.nix);
+  #trac = makeTest (import ./trac.nix);
   xfce = makeTest (import ./xfce.nix);
+  runInMachine.test = import ./run-in-machine.nix { inherit system; };
 }
diff --git a/nixos/tests/efi-installer.nix b/nixos/tests/efi-installer.nix
index a9c5d719030..8a05dbf2a61 100644
--- a/nixos/tests/efi-installer.nix
+++ b/nixos/tests/efi-installer.nix
@@ -37,13 +37,12 @@ let
   # The config to install
   config = builtins.toFile "configuration.nix" ''
     { pkgs, ... }: {
-      imports = [ ./hardware.nix <nixos/modules/testing/test-instrumentation.nix> ];
+      imports = [ ./hardware-configuration.nix <nixos/modules/testing/test-instrumentation.nix> ];
       boot.kernelPackages = pkgs.linuxPackages_3_10;
       boot.loader.grub.enable = false;
       boot.loader.efi.canTouchEfiVariables = true;
       boot.loader.gummiboot.enable = true;
       fonts.enableFontConfig = false;
-      fileSystems."/".label = "nixos";
     }
   '';
 
@@ -60,7 +59,7 @@ in {
       createDisk("harddisk", 4 * 1024);
 
       my $machine = createMachine({ hda => "harddisk",
-        hdaInterface => "virtio",
+        hdaInterface => "scsi",
         cdrom => glob("${iso}/iso/*.iso"),
         qemuFlags => '-L ${biosDir} ${optionalString (pkgs.stdenv.system == "x86_64-linux") "-cpu kvm64"}'});
       $machine->start;
@@ -69,14 +68,13 @@ in {
       $machine->succeed("echo hello");
       $machine->waitForUnit("rogue");
       $machine->waitForUnit("nixos-manual");
-      $machine->waitForUnit("dhcpcd");
 
       # Partition the disk.
       $machine->succeed(
-          "sgdisk -Z /dev/vda",
-          "sgdisk -n 1:0:+256M -N 2 -t 1:ef00 -t 2:8300 -c 1:boot -c 2:root /dev/vda",
-          "mkfs.vfat -n BOOT /dev/vda1",
-          "mkfs.ext3 -L nixos /dev/vda2",
+          "sgdisk -Z /dev/sda",
+          "sgdisk -n 1:0:+256M -N 2 -t 1:ef00 -t 2:8300 -c 1:boot -c 2:root /dev/sda",
+          "mkfs.vfat -n BOOT /dev/sda1",
+          "mkfs.ext3 -L nixos /dev/sda2",
           "mount LABEL=nixos /mnt",
           "mkdir /mnt/boot",
           "mount LABEL=BOOT /mnt/boot",
@@ -84,12 +82,10 @@ in {
 
       # Create the NixOS configuration.
       $machine->succeed(
-          "mkdir -p /mnt/etc/nixos",
-          "nixos-hardware-scan > /mnt/etc/nixos/hardware.nix",
+          "nixos-generate-config --root /mnt",
       );
 
-      my $cfg = $machine->succeed("cat /mnt/etc/nixos/hardware.nix");
-      print STDERR "Result of the hardware scan:\n$cfg\n";
+      $machine->succeed("cat /mnt/etc/nixos/hardware-configuration.nix >&2");
 
       $machine->copyFileFromHost(
           "${config}",
diff --git a/nixos/tests/installer.nix b/nixos/tests/installer.nix
index 0ce78053171..bebd6c04374 100644
--- a/nixos/tests/installer.nix
+++ b/nixos/tests/installer.nix
@@ -38,7 +38,7 @@ let
       { config, pkgs, modulesPath, ... }:
 
       { imports =
-          [ ./hardware.nix
+          [ ./hardware-configuration.nix
             "''${modulesPath}/testing/test-instrumentation.nix"
           ];
 
@@ -48,10 +48,7 @@ let
         ''}
         boot.loader.grub.device = "${grubDevice}";
         boot.loader.grub.extraConfig = "serial; terminal_output.serial";
-        boot.initrd.kernelModules = [ "ext3" "ext4" "xfs" "virtio_console" ];
-
-        ${fileSystems}
-        swapDevices = [ { label = "swap"; } ];
+        boot.initrd.kernelModules = [ "virtio_console" ];
 
         environment.systemPackages = [ ${optionalString testChannel "pkgs.rlwrap"} ];
       }
@@ -143,12 +140,10 @@ let
 
       # Create the NixOS configuration.
       $machine->succeed(
-          "mkdir -p /mnt/etc/nixos",
-          "nixos-hardware-scan > /mnt/etc/nixos/hardware.nix",
+          "nixos-generate-config --root /mnt",
       );
 
-      my $cfg = $machine->succeed("cat /mnt/etc/nixos/hardware.nix");
-      print STDERR "Result of the hardware scan:\n$cfg\n";
+      $machine->succeed("cat /mnt/etc/nixos/hardware-configuration.nix >&2");
 
       $machine->copyFileFromHost(
           "${ config { inherit fileSystems testChannel grubVersion grubDevice; } }",
@@ -179,6 +174,11 @@ let
 
       $machine->succeed("nixos-rebuild switch >&2");
 
+      # Test nixos-option.
+      $machine->succeed("nixos-option boot.initrd.kernelModules | grep virtio_console");
+      $machine->succeed("nixos-option -d boot.initrd.kernelModules | grep 'List of modules'");
+      $machine->succeed("nixos-option -l boot.initrd.kernelModules | grep /etc/nixos/configuration.nix");
+
       $machine->shutdown;
 
       # And just to be sure, check that the machine still boots after
diff --git a/nixos/tests/misc.nix b/nixos/tests/misc.nix
index e18a208fe43..12ac6f6f9a6 100644
--- a/nixos/tests/misc.nix
+++ b/nixos/tests/misc.nix
@@ -9,6 +9,7 @@
     { swapDevices = pkgs.lib.mkOverride 0
         [ { device = "/root/swapfile"; size = 128; } ];
       environment.variables.EDITOR = pkgs.lib.mkOverride 0 "emacs";
+      services.nixosManual.enable = pkgs.lib.mkOverride 0 true;
     };
 
   testScript =
@@ -18,7 +19,7 @@
       };
 
       subtest "nixos-rebuild", sub {
-          $machine->succeed("nixos-rebuild --help | grep 'Usage:'");
+          $machine->succeed("nixos-rebuild --help | grep SYNOPSIS");
       };
 
       # Sanity check for uid/gid assignment.
diff --git a/nixos/tests/openssh.nix b/nixos/tests/openssh.nix
index 16757cf9098..49d92fbde90 100644
--- a/nixos/tests/openssh.nix
+++ b/nixos/tests/openssh.nix
@@ -8,6 +8,8 @@
 
       {
         services.openssh.enable = true;
+        security.pam.services.sshd.limits =
+          [ { domain = "*"; item = "memlock"; type = "-"; value = 1024; } ];
       };
 
     client =
@@ -31,5 +33,6 @@
 
     $client->waitForUnit("network.target");
     $client->succeed("ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server 'echo hello world' >&2");
+    $client->succeed("ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server 'ulimit -l' | grep 1024");
   '';
 }
diff --git a/nixos/tests/run-in-machine.nix b/nixos/tests/run-in-machine.nix
index 75bd161ec9e..8efe26c1708 100644
--- a/nixos/tests/run-in-machine.nix
+++ b/nixos/tests/run-in-machine.nix
@@ -1,10 +1,8 @@
-{ nixpkgs ? <nixpkgs>
-, system ? builtins.currentSystem
-}:
+{ system ? builtins.currentSystem }:
 
 with import ../lib/testing.nix { inherit system; };
 
 runInMachine {
-  drv = (import nixpkgs { inherit system; }).aterm;
+  drv = pkgs.patchelf;
   machine = { config, pkgs, ... }: { services.sshd.enable = true; };
 }
diff --git a/pkgs/applications/display-managers/slim/default.nix b/pkgs/applications/display-managers/slim/default.nix
index 9d5c728de26..0b5bcccfb21 100644
--- a/pkgs/applications/display-managers/slim/default.nix
+++ b/pkgs/applications/display-managers/slim/default.nix
@@ -1,29 +1,37 @@
-{ stdenv, fetchurl, cmake, pkgconfig, x11, libjpeg, libpng, libXmu
+{ stdenv, fetchurl, cmake, pkgconfig, xorg, libjpeg, libpng
 , fontconfig, freetype, pam, dbus_libs }:
 
 stdenv.mkDerivation rec {
-  name = "slim-1.3.4";
+  name = "slim-1.3.6";
 
   src = fetchurl {
     url = "http://download.berlios.de/slim/${name}.tar.gz";
-    sha256 = "00fmrg2v41jnqhx0yc1kv97xxh5gai18n0i4as9g1fcq1i32cp0m";
+    sha256 = "1pqhk22jb4aja4hkrm7rjgbgzjyh7i4zswdgf5nw862l2znzxpi1";
   };
 
-  patches = [
-    # Allow the paths of the configuration file and theme directory to
-    # be set at runtime.
-    ./runtime-paths.patch
-  ];
+  patches =
+    [ # Allow the paths of the configuration file and theme directory to
+      # be set at runtime.
+      ./runtime-paths.patch
 
-  buildInputs =
-    [ cmake pkgconfig x11 libjpeg libpng libXmu fontconfig freetype
-      pam dbus_libs
+      # Exit after the user's session has finished.  This works around
+      # slim's broken PAM session handling (see
+      # http://developer.berlios.de/bugs/?func=detailbug&bug_id=19102&group_id=2663).
+      ./run-once.patch
     ];
 
-  preConfigure = "substituteInPlace CMakeLists.txt --replace /etc $out/etc";
+  preConfigure = "substituteInPlace CMakeLists.txt --replace /etc $out/etc --replace /lib $out/lib";
 
   cmakeFlags = [ "-DUSE_PAM=1" ];
 
+  enableParallelBuilding = true;
+
+  buildInputs =
+    [ cmake pkgconfig libjpeg libpng fontconfig freetype
+      pam dbus_libs
+      xorg.libX11 xorg.libXext xorg.libXrandr xorg.libXrender xorg.libXmu xorg.libXft
+    ];
+
   NIX_CFLAGS_LINK = "-lXmu";
 
   meta = {
diff --git a/pkgs/applications/display-managers/slim/run-once.patch b/pkgs/applications/display-managers/slim/run-once.patch
new file mode 100644
index 00000000000..78f1454a883
--- /dev/null
+++ b/pkgs/applications/display-managers/slim/run-once.patch
@@ -0,0 +1,12 @@
+diff -ru -x '*~' slim-1.3.6-orig/app.cpp slim-1.3.6/app.cpp
+--- slim-1.3.6-orig/app.cpp	2013-10-15 11:02:55.629263422 +0200
++++ slim-1.3.6/app.cpp	2013-10-15 13:00:10.141210784 +0200
+@@ -816,7 +822,7 @@
+ 	StopServer();
+ 	RemoveLock();
+ 	while (waitpid(-1, NULL, WNOHANG) > 0); /* Collects all dead childrens */
+-	Run();
++	exit(OK_EXIT);
+ }
+ 
+ void App::KillAllClients(Bool top) {
diff --git a/pkgs/applications/display-managers/slim/runtime-paths.patch b/pkgs/applications/display-managers/slim/runtime-paths.patch
index b59b32f3111..f6811dbe668 100644
--- a/pkgs/applications/display-managers/slim/runtime-paths.patch
+++ b/pkgs/applications/display-managers/slim/runtime-paths.patch
@@ -1,41 +1,25 @@
-diff -rc slim-1.2.6-orig/app.cpp slim-1.2.6/app.cpp
-*** slim-1.2.6-orig/app.cpp	Fri Sep 15 23:00:37 2006
---- slim-1.2.6/app.cpp	Sun Feb 25 17:30:50 2007
-***************
-*** 113,119 ****
-  
-      // Read configuration and theme
-      cfg = new Cfg;
-!     cfg->readConf(CFGFILE);
-      string themebase = "";
-      string themefile = "";
-      string themedir = "";
---- 113,121 ----
-  
-      // Read configuration and theme
-      cfg = new Cfg;
-!     char *cfgfile = getenv("SLIM_CFGFILE");
-!     if (!cfgfile) cfgfile = CFGFILE;
-!     cfg->readConf(cfgfile);
-      string themebase = "";
-      string themefile = "";
-      string themedir = "";
-***************
-*** 121,127 ****
-      if (testing) {
-          themeName = testtheme;
-      } else {
-!         themebase = string(THEMESDIR) + "/";
-          themeName = cfg->getOption("current_theme");
-          string::size_type pos;
-          if ((pos = themeName.find(",")) != string::npos) {
---- 123,131 ----
-      if (testing) {
-          themeName = testtheme;
-      } else {
-!         char *themesdir = getenv("SLIM_THEMESDIR");
-!         if (!themesdir) themesdir = THEMESDIR;
-!         themebase = string(themesdir) + "/";
-          themeName = cfg->getOption("current_theme");
-          string::size_type pos;
-          if ((pos = themeName.find(",")) != string::npos) {
+diff -ru -x '*~' slim-1.3.6-orig/app.cpp slim-1.3.6/app.cpp
+--- slim-1.3.6-orig/app.cpp	2013-10-02 00:38:05.000000000 +0200
++++ slim-1.3.6/app.cpp	2013-10-15 11:02:55.629263422 +0200
+@@ -200,7 +200,9 @@
+ 
+ 	/* Read configuration and theme */
+ 	cfg = new Cfg;
+-	cfg->readConf(CFGFILE);
++	char *cfgfile = getenv("SLIM_CFGFILE");
++	if (!cfgfile) cfgfile = CFGFILE;
++	cfg->readConf(cfgfile);
+ 	string themebase = "";
+ 	string themefile = "";
+ 	string themedir = "";
+@@ -208,7 +210,9 @@
+ 	if (testing) {
+ 		themeName = testtheme;
+ 	} else {
+-		themebase = string(THEMESDIR) + "/";
++		char *themesdir = getenv("SLIM_THEMESDIR");
++		if (!themesdir) themesdir = THEMESDIR;
++		themebase = string(themesdir) + "/";
+ 		themeName = cfg->getOption("current_theme");
+ 		string::size_type pos;
+ 		if ((pos = themeName.find(",")) != string::npos) {
diff --git a/pkgs/applications/editors/eclipse/default.nix b/pkgs/applications/editors/eclipse/default.nix
index 21dad42ea46..fe3c7424907 100644
--- a/pkgs/applications/editors/eclipse/default.nix
+++ b/pkgs/applications/editors/eclipse/default.nix
@@ -32,8 +32,9 @@ let
 
         # Patch binaries.
         interpreter=$(echo ${stdenv.glibc}/lib/ld-linux*.so.2)
+        libCairo=$out/eclipse/libcairo-swt.so
         patchelf --set-interpreter $interpreter $out/eclipse/eclipse
-        patchelf --set-rpath ${freetype}/lib:${fontconfig}/lib:${libX11}/lib:${libXrender}/lib:${zlib}/lib $out/eclipse/libcairo-swt.so
+        [ -f $libCairo ] && patchelf --set-rpath ${freetype}/lib:${fontconfig}/lib:${libX11}/lib:${libXrender}/lib:${zlib}/lib $libCairo
 
         # Create wrapper script.  Pass -configuration to store
         # settings in ~/.eclipse/org.eclipse.platform_<version> rather
@@ -205,4 +206,20 @@ in {
         };
     };
   };
+
+  eclipse_sdk_431 = buildEclipse {
+    name = "eclipse-sdk-4.3.1";
+    description = "Eclipse Classic";
+    sources = {
+      "x86_64-linux" = fetchurl {
+          url = http://download.eclipse.org/eclipse/downloads/drops4/R-4.3.1-201309111000/eclipse-SDK-4.3.1-linux-gtk-x86_64.tar.gz;
+          sha256 = "0ncm56ylwxw9z8rk8ccgva68c2yr9yrf1kcr1zkgw6p87xh1yczd";
+        };
+      "i686-linux" = fetchurl {
+          url = http://download.eclipse.org/eclipse/downloads/drops4/R-4.3.1-201309111000/eclipse-SDK-4.3.1-linux-gtk.tar.gz;
+          sha256 = "1zxsh838khny7mvl01h28xna6xdh01yi4mvls28zj22v0340lgsg";
+        };
+    };
+  };
+
 }
diff --git a/pkgs/applications/ike/default.nix b/pkgs/applications/ike/default.nix
new file mode 100644
index 00000000000..52330b57b8f
--- /dev/null
+++ b/pkgs/applications/ike/default.nix
@@ -0,0 +1,39 @@
+{ stdenv, fetchurl, cmake, openssl, libedit, flex, bison, qt4, makeWrapper, gcc }:
+
+# NOTE: use $out/etc/iked.conf as sample configuration and also set: dhcp_file "/etc/iked.dhcp";
+# launch with "iked -f /etc/iked.conf"
+
+stdenv.mkDerivation rec {
+  name = "ike-2.2.1";
+
+  src = fetchurl {
+    url = "https://www.shrew.net/download/ike/${name}-release.tgz";
+    sha256 = "0fhyr2psd93b0zf7yfb72q3nqnh65mymgq5jpjcsj9jv5kfr6l8y";
+  };
+
+  buildInputs = [ cmake openssl libedit flex bison qt4 makeWrapper ];
+
+  configurePhase = ''
+    mkdir -p $out/{bin,sbin,lib}
+    cmake -DQTGUI=YES -DETCDIR=$out/etc -DLIBDIR=$out/lib -DSBINDIR=$out/sbin -DBINDIR=$out/bin -DMANDIR=$out/man -DNATT=YES -DCMAKE_INSTALL_PREFIX:BOOL=$out
+  '';
+
+  buildPhase = ''
+    make
+  '';
+
+  installPhase = ''
+    make install
+    for file in "$out"/bin/* "$out"/sbin/*; do
+        wrapProgram $file --prefix LD_LIBRARY_PATH ":" "$out/lib:${openssl}/lib:${gcc.gcc}/lib:${libedit}/lib:${qt4}/lib"
+    done
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = https://www.shrew.net/software;
+    description = "IPsec Client for FreeBSD, NetBSD and many Linux based operating systems";
+    platforms = platforms.unix;
+    maintainers = [ maintainers.iElectric ];
+    license = "sleepycat";
+  };
+}
diff --git a/pkgs/applications/misc/bitcoin/default.nix b/pkgs/applications/misc/bitcoin/default.nix
index a4048e6f40b..a6a289168c4 100644
--- a/pkgs/applications/misc/bitcoin/default.nix
+++ b/pkgs/applications/misc/bitcoin/default.nix
@@ -1,12 +1,12 @@
 { fetchurl, stdenv, openssl, db4, boost, zlib, miniupnpc, qt4 }:
 
 stdenv.mkDerivation rec {
-  version = "0.8.1";
+  version = "0.8.5";
   name = "bitcoin-${version}";
 
   src = fetchurl {
     url = "mirror://sourceforge/bitcoin/${name}-linux.tar.gz";
-    sha256 = "161arfkzpya5anh6vh5i9ydvwqpia7bpqgz83p2kd97iklx04zvd";
+    sha256 = "0qqzwx1lihlrj7r08alsyznjfqvwncfm0nnxi1pcx0jyvq83ym44";
   };
 
   buildInputs = [ openssl db4 boost zlib miniupnpc qt4 ];
diff --git a/pkgs/applications/misc/freicoin/default.nix b/pkgs/applications/misc/freicoin/default.nix
index bce6d1f639c..d5ed057f56b 100644
--- a/pkgs/applications/misc/freicoin/default.nix
+++ b/pkgs/applications/misc/freicoin/default.nix
@@ -1,12 +1,12 @@
 { fetchurl, stdenv, db4, boost, gmp, mpfr, miniupnpc, qt4, unzip }:
 
 stdenv.mkDerivation rec {
-  version = "0.0.2";
+  version = "0.8.3-1";
   name = "freicoin-${version}";
 
   src = fetchurl {
     url = "https://github.com/freicoin/freicoin/archive/v${version}.zip";
-    sha256 = "09izmm85rb64d5hd0hz9hkfvv3qag55sb3mdyp8z4103icqwd6d7";
+    sha256 = "0v3mh8a96nnb86mkyaylyjj7qfdrl7i9gvybh7f8w2hrl9paszfh";
   };
 
   # I think that openssl and zlib are required, but come through other
diff --git a/pkgs/applications/misc/synergy/cryptopp.patch b/pkgs/applications/misc/synergy/cryptopp.patch
index f20ef9544a2..d0aebb87261 100644
--- a/pkgs/applications/misc/synergy/cryptopp.patch
+++ b/pkgs/applications/misc/synergy/cryptopp.patch
@@ -20,10 +20,10 @@ index 3b61fc0..2206646 100644
  
  if (WIN32)
  	# add /analyze in order to unconver potential bugs in the source code
-diff --git a/src/lib/synergy/CCryptoMode.h b/src/lib/synergy/CCryptoMode.h
+diff --git a/src/lib/io/CCryptoMode.h b/src/lib/io/CCryptoMode.h
 index 9b7e8ad..0d659ac 100644
---- a/src/lib/synergy/CCryptoMode.h
-+++ b/src/lib/synergy/CCryptoMode.h
+--- a/src/lib/io/CCryptoMode.h
++++ b/src/lib/io/CCryptoMode.h
 @@ -17,9 +17,9 @@
  
  #pragma once
@@ -37,10 +37,10 @@ index 9b7e8ad..0d659ac 100644
  #include "ECryptoMode.h"
  #include "CString.h"
  
-diff --git a/src/lib/synergy/CCryptoStream.h b/src/lib/synergy/CCryptoStream.h
+diff --git a/src/lib/io/CCryptoStream.h b/src/lib/io/CCryptoStream.h
 index 104b1f6..09c4dc4 100644
---- a/src/lib/synergy/CCryptoStream.h
-+++ b/src/lib/synergy/CCryptoStream.h
+--- a/src/lib/io/CCryptoStream.h
++++ b/src/lib/io/CCryptoStream.h
 @@ -20,8 +20,8 @@
  #include "BasicTypes.h"
  #include "CStreamFilter.h"
diff --git a/pkgs/applications/misc/synergy/default.nix b/pkgs/applications/misc/synergy/default.nix
index 0b3734ea147..72282ad0f3e 100644
--- a/pkgs/applications/misc/synergy/default.nix
+++ b/pkgs/applications/misc/synergy/default.nix
@@ -7,11 +7,11 @@ assert !stdenv.isLinux -> unzip != null;
 with stdenv.lib;
 
 stdenv.mkDerivation rec {
-  name = "synergy-1.4.12";
+  name = "synergy-1.4.14";
 
   src = fetchurl {
-  	url = "http://synergy.googlecode.com/files/${name}-Source.tar.gz";
-  	sha256 = "0j884skwqy8r8ckj9a4rlwsbjwb1yrj9wqma1nwhr2inff6hrdim";
+    url = "http://synergy.googlecode.com/files/${name}-Source.tar.gz";
+    sha256 = "1sprg3yb0gjhl2927l4c5nymmqhg318ar6dpki8dr42dgvx3d2ir";
   };
 
   patches = optional stdenv.isLinux ./cryptopp.patch;
diff --git a/pkgs/applications/networking/browsers/chromium/sources.nix b/pkgs/applications/networking/browsers/chromium/sources.nix
index 96c58ef8e9c..ae49890caf3 100644
--- a/pkgs/applications/networking/browsers/chromium/sources.nix
+++ b/pkgs/applications/networking/browsers/chromium/sources.nix
@@ -1,18 +1,18 @@
 # This file is autogenerated from update.sh in the same directory.
 {
   dev = {
-    version = "31.0.1650.4";
-    url = "http://commondatastorage.googleapis.com/chromium-browser-official/chromium-31.0.1650.4.tar.xz";
-    sha256 = "1i61izfn06ldxkgdrisdibbn5hrghyjslf81yszpw69k0z87k3lm";
+    version = "32.0.1671.3";
+    url = "http://commondatastorage.googleapis.com/chromium-browser-official/chromium-32.0.1671.3.tar.xz";
+    sha256 = "0bv86ig3mrd95zh78880bcyh9b8w46s7slxq3mwwmrmqp0s8qaq0";
   };
   beta = {
-    version = "30.0.1599.66";
-    url = "http://commondatastorage.googleapis.com/chromium-browser-official/chromium-30.0.1599.66.tar.xz";
-    sha256 = "092ps4y4s544lswrqqk8qij5n7ax4bsfl5vdj5cwfncvsqpjds4g";
+    version = "31.0.1650.26";
+    url = "http://commondatastorage.googleapis.com/chromium-browser-official/chromium-31.0.1650.26.tar.xz";
+    sha256 = "14jvbjn7nsc4psi7n6rjsb5d930k4jawbgqlx3hkhmkz5nhbrplx";
   };
   stable = {
-    version = "30.0.1599.66";
-    url = "http://commondatastorage.googleapis.com/chromium-browser-official/chromium-30.0.1599.66.tar.xz";
-    sha256 = "092ps4y4s544lswrqqk8qij5n7ax4bsfl5vdj5cwfncvsqpjds4g";
+    version = "30.0.1599.101";
+    url = "http://commondatastorage.googleapis.com/chromium-browser-official/chromium-30.0.1599.101.tar.xz";
+    sha256 = "0bd49k9qpycpp4z230pqwsi22565lzhyq59js34baawjqql6ynfr";
   };
 }
diff --git a/pkgs/applications/networking/browsers/dwb/default.nix b/pkgs/applications/networking/browsers/dwb/default.nix
index b120ebcac54..0421a8a6c6a 100644
--- a/pkgs/applications/networking/browsers/dwb/default.nix
+++ b/pkgs/applications/networking/browsers/dwb/default.nix
@@ -6,8 +6,8 @@ stdenv.mkDerivation {
 
   src = fetchgit {
     url = "https://bitbucket.org/portix/dwb.git";
-    rev = "4a4c3adb8fbc680a0a2b8c9d3d3a4105c07c2514";
-    sha256 = "93e8f2c82609447d54a3c139c153cc66d37d3c6aa8922cd09717caa95fd8b1d5";
+    rev = "84a8621787baded72e84afdd5cdda278cb81e007";
+    sha256 = "5a32f3c21ad59b43935a16108244f84d260fafaea9b93d41e8de9ba9089ee7b0";
   };
 
   buildInputs = [ pkgconfig makeWrapper libsoup webkit gtk3 gnutls json_c m4  ];
@@ -21,6 +21,8 @@ stdenv.mkDerivation {
     wrapProgram "$out/bin/dwb" \
      --prefix GIO_EXTRA_MODULES : "${glib_networking}/lib/gio/modules" \
      --prefix XDG_DATA_DIRS : "${gsettings_desktop_schemas}/share:$out/share"
+    wrapProgram "$out/bin/dwbem" \
+     --prefix GIO_EXTRA_MODULES : "${glib_networking}/lib/gio/modules"
   '';
 
   meta = {
diff --git a/pkgs/applications/networking/browsers/mozilla-plugins/fribid/builder.sh b/pkgs/applications/networking/browsers/mozilla-plugins/fribid/builder.sh
new file mode 100644
index 00000000000..fb36125b3a1
--- /dev/null
+++ b/pkgs/applications/networking/browsers/mozilla-plugins/fribid/builder.sh
@@ -0,0 +1,4 @@
+source $stdenv/setup
+export PREFIX=$out
+configureFlags="--plugin-path=$out/lib/mozilla/plugins"
+genericBuild
diff --git a/pkgs/applications/networking/browsers/mozilla-plugins/fribid/default.nix b/pkgs/applications/networking/browsers/mozilla-plugins/fribid/default.nix
new file mode 100644
index 00000000000..7422654ec98
--- /dev/null
+++ b/pkgs/applications/networking/browsers/mozilla-plugins/fribid/default.nix
@@ -0,0 +1,31 @@
+{ stdenv, fetchurl, pkgconfig, openssl, glib, libX11, gtk3, gettext, intltool }:
+
+let version = "1.0.2"; in
+stdenv.mkDerivation rec {
+  name = "fribid-${version}";
+  builder = ./builder.sh;
+
+  src = fetchurl {
+    url = "https://fribid.se/releases/source/${name}.tar.bz2";
+    sha256 = "d7cd9adf04fedf50b266a5c14ddb427cbb263d3bc160ee0ade03aca9d5356e5c";
+  };
+
+  buildInputs = [ pkgconfig openssl libX11 gtk3 glib gettext intltool ];
+  patches = [
+    ./translation-xgettext-to-intltool.patch
+    ./plugin-linkfix.patch
+    ./emulated-version.patch
+    ./ipc-lazytrace.patch
+    ];
+
+  passthru.mozillaPlugin = "/lib/mozilla/plugins";
+
+  meta = {
+    description = "A browser plugin to manage Swedish BankID:s";
+    homepage = http://fribid.se;
+    licenses = [ "GPLv2" "MPLv1" ];
+    maintainers = [ stdenv.lib.maintainers.edwtjo ];
+    platforms = with stdenv.lib.platforms; linux;
+  };
+}
+
diff --git a/pkgs/applications/networking/browsers/mozilla-plugins/fribid/emulated-version.patch b/pkgs/applications/networking/browsers/mozilla-plugins/fribid/emulated-version.patch
new file mode 100644
index 00000000000..f730ad017b1
--- /dev/null
+++ b/pkgs/applications/networking/browsers/mozilla-plugins/fribid/emulated-version.patch
@@ -0,0 +1,12 @@
+--- a/common/defines.h  2012-11-14 18:02:43.000000000 +0100
++++ b/common/defines.h  2013-09-20 19:17:45.669290630 +0200
+@@ -39,7 +39,7 @@
+ #define RELEASE_TIME        1352912534
+ #define IPCVERSION          "10"
+ 
+-#define EMULATED_VERSION    "4.15.0.14"
++#define EMULATED_VERSION    "4.17.0.11" // Was 4.15.0.14
+ #define DNSVERSION          "2"
+ #define STATUSDOMAIN        ".status.fribid.se"
+ 
+
diff --git a/pkgs/applications/networking/browsers/mozilla-plugins/fribid/ipc-lazytrace.patch b/pkgs/applications/networking/browsers/mozilla-plugins/fribid/ipc-lazytrace.patch
new file mode 100644
index 00000000000..b7d05ddd0ef
--- /dev/null
+++ b/pkgs/applications/networking/browsers/mozilla-plugins/fribid/ipc-lazytrace.patch
@@ -0,0 +1,10 @@
+--- a/plugin/ipc.c	2012-11-14 18:02:43.000000000 +0100
++++ b/plugin/ipc.c	2013-09-21 08:55:39.960265058 +0200
+@@ -74,6 +74,7 @@
+         //close(pipeOut[PIPE_READ_END]);
+
+         execvp(mainBinary, (char *const *)argv);
++        fprintf(stderr, "Wanted signing executable\t<%s>\n", mainBinary);
+         perror(BINNAME ": Failed to execute main binary");
+         exit(1);
+     } else {
diff --git a/pkgs/applications/networking/browsers/mozilla-plugins/fribid/plugin-linkfix.patch b/pkgs/applications/networking/browsers/mozilla-plugins/fribid/plugin-linkfix.patch
new file mode 100644
index 00000000000..1128381238b
--- /dev/null
+++ b/pkgs/applications/networking/browsers/mozilla-plugins/fribid/plugin-linkfix.patch
@@ -0,0 +1,11 @@
+--- a/plugin/Makefile	2013-09-18 13:55:11.091652553 +0200
++++ b/plugin/Makefile	2013-09-18 13:58:27.513618750 +0200
+@@ -60,7 +60,7 @@
+ 	for path in $(NPAPI_PLUGIN_PATHS); do \
+ 	    (../configure --internal--remove-link $(DESTDIR)$$path/libfribidplugin.so $(NPAPI_PLUGIN_LIB) || exit 1) && \
+ 	    install -d $(DESTDIR)$$path && \
+-	    ln -sf $(NPAPI_PLUGIN_LIB) $(DESTDIR)$$path/libfribidplugin.so; \
++	    ln -sf $(DESTDIR)$(NPAPI_PLUGIN_LIB) $(DESTDIR)$$path/libfribidplugin.so; \
+ 	done
+
+ uninstall:
diff --git a/pkgs/applications/networking/browsers/mozilla-plugins/fribid/translation-xgettext-to-intltool.patch b/pkgs/applications/networking/browsers/mozilla-plugins/fribid/translation-xgettext-to-intltool.patch
new file mode 100644
index 00000000000..dcac4f17928
--- /dev/null
+++ b/pkgs/applications/networking/browsers/mozilla-plugins/fribid/translation-xgettext-to-intltool.patch
@@ -0,0 +1,16 @@
+--- a/translations/Makefile	2013-09-18 07:25:16.503800613 +0200
++++ b/translations/Makefile	2013-09-18 07:25:29.495869405 +0200
+@@ -38,7 +38,7 @@
+ all: template.pot $(MOFILES)
+
+ template.pot: $(POTFILES) $(DEFINES)
+-	xgettext -k_ -ktranslatable -d $(DOMAIN) --package-name=$(PACKAGENAME) --package-version=$(PACKAGEVERSION) --copyright-holder='YOUR NAME' -o $@ $(POTFILES)
++	intltool-update --gettext-package=$(PACKAGENAME) -o $@ sv
+
+ .po.mo:
+ 	msgfmt $< -o $@
+--- a/translations/POTFILES.in	2013-09-16 20:28:56.766106014 +0200
++++ b/translations/POTFILES.in	2013-09-18 13:15:05.252689648 +0200
+@@ -0,0 +1,2 @@
++client/gtk.c
++client/gtk/sign.glade
diff --git a/pkgs/applications/networking/instant-messengers/pidgin-plugins/tox-prpl/default.nix b/pkgs/applications/networking/instant-messengers/pidgin-plugins/tox-prpl/default.nix
new file mode 100644
index 00000000000..b87db662f45
--- /dev/null
+++ b/pkgs/applications/networking/instant-messengers/pidgin-plugins/tox-prpl/default.nix
@@ -0,0 +1,29 @@
+{ stdenv, fetchurl, libtoxcore, pidgin, autoconf, automake, libtool, libsodium } :
+
+let
+  version = "17a3fd9199";
+  date = "20131012";
+in
+stdenv.mkDerivation rec {
+  name = "tox-prpl-${date}-${version}";
+
+  src = fetchurl {
+    url = "https://github.com/jin-eld/tox-prpl/tarball/${version}";
+    name = "${name}.tar.gz";
+    sha256 = "0sz5wkyfwmhaj652xpsxq4p252cmmfa1vy6mp3jfyn145c758v9n";
+  };
+
+  NIX_LDFLAGS = "-lssp -lsodium";
+
+  preConfigure = "autoreconf -vfi";
+
+  postInstall = "mv $out/lib/purple-2 $out/lib/pidgin";
+
+  buildInputs = [ libtoxcore pidgin autoconf automake libtool libsodium ];
+
+  meta = {
+    homepage = http://tox.dhs.org/;
+    description = "Tox plugin for Pidgin / libpurple";
+    license = "GPLv3";
+  };
+}
diff --git a/pkgs/applications/networking/instant-messengers/skype/default.nix b/pkgs/applications/networking/instant-messengers/skype/default.nix
index aa90c8e7026..ebd84ff47b8 100644
--- a/pkgs/applications/networking/instant-messengers/skype/default.nix
+++ b/pkgs/applications/networking/instant-messengers/skype/default.nix
@@ -48,6 +48,7 @@ stdenv.mkDerivation rec {
 
     cat > $out/bin/skype << EOF
     #!${stdenv.shell}
+    export PULSE_LATENCY_MSEC=60  # workaround for pulseaudio glitches
     export LD_LIBRARY_PATH=$fullPath:$LD_LIBRARY_PATH
     $dynlinker $out/libexec/skype/skype --resources=$out/libexec/skype "\$@"
     EOF
diff --git a/pkgs/applications/networking/instant-messengers/torchat/default.nix b/pkgs/applications/networking/instant-messengers/torchat/default.nix
index 5a82cf9d640..06bcd7a0400 100644
--- a/pkgs/applications/networking/instant-messengers/torchat/default.nix
+++ b/pkgs/applications/networking/instant-messengers/torchat/default.nix
@@ -2,18 +2,17 @@
 stdenv.mkDerivation rec {
 
   name = "torchat-${version}";
-  version = "0.9.9.550";
+  version = "0.9.9.553";
 
   src = fetchurl {
-    url = "http://torchat.googlecode.com/files/torchat-source-${version}.zip";
-    sha256 = "01z0vrmflcmb146m04b66zihkd22aqnxz2vr4x23z1q5mlwylmq2";
+    url = "https://github.com/prof7bit/TorChat/archive/${version}.tar.gz";
+    sha256 = "0rb4lvv40pz6ab5kxq40ycvh7kh1yxn7swzgv2ff2nbhi62xnzp0";
   };
 
   buildInputs = [ python unzip wxPython wrapPython ];
   pythonPath = [ wxPython ];
 
-  preConfigure = "rm portable.txt";
-  preUnpack = "sourceRoot=`pwd`/src";
+  preConfigure = "cd torchat/src; rm portable.txt";
 
   installPhase = ''
     substituteInPlace "Tor/tor.sh" --replace "tor -f" "${tor}/bin/tor -f"
@@ -29,8 +28,8 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with stdenv.lib; {
-    homepage = http://code.google.com/p/torchat/;
-    description = "instant messaging application on top of the Tor network and it's location hidden services";
+    homepage = https://github.com/prof7bit/TorChat;
+    description = "Instant messaging application on top of the Tor network and it's location hidden services";
     license = licenses.gpl3;
     maintainers = [ maintainers.phreedom ];
     platforms = platforms.unix;
diff --git a/pkgs/applications/networking/instant-messengers/toxic/default.nix b/pkgs/applications/networking/instant-messengers/toxic/default.nix
new file mode 100644
index 00000000000..c2af1274a24
--- /dev/null
+++ b/pkgs/applications/networking/instant-messengers/toxic/default.nix
@@ -0,0 +1,40 @@
+{ stdenv, fetchurl, autoconf, libtool, automake, libsodium, ncurses
+, libtoxcore, pkgconfig }:
+
+let
+  version = "75d356e52a";
+  date = "20131011";
+in
+stdenv.mkDerivation rec {
+  name = "toxic-${date}-${version}";
+
+  src = fetchurl {
+    url = "https://github.com/Tox/toxic/tarball/${version}";
+    name = "${name}.tar.gz";
+    sha256 = "14wyvms8l07sl88g8y6g2jv95sq7cnhbaqf4n32xxilch8rymq47";
+  };
+
+  preConfigure = ''
+    autoreconf -i
+  '';
+
+  NIX_LDFLAGS = "-lsodium";
+
+  configureFlags = [
+    "--with-libtoxcore-headers=${libtoxcore}/include"
+    "--with-libtoxcore-libs=${libtoxcore}/lib" 
+    "--with-libsodium-headers=${libtoxcore}/include"
+    "--with-libsodium-libs=${libtoxcore}/lib" 
+  ];
+
+  buildInputs = [ autoconf libtool automake libtoxcore libsodium ncurses pkgconfig ];
+
+  doCheck = true;
+
+  meta = {
+    description = "Reference CLI for Tox";
+    license = "GPLv3+";
+    maintainers = with stdenv.lib.maintainers; [ viric ];
+    platforms = stdenv.lib.platforms.all;
+  };
+}
diff --git a/pkgs/applications/networking/p2p/gnunet/svn.nix b/pkgs/applications/networking/p2p/gnunet/svn.nix
index b6b9db99f90..ed6c348706b 100644
--- a/pkgs/applications/networking/p2p/gnunet/svn.nix
+++ b/pkgs/applications/networking/p2p/gnunet/svn.nix
@@ -1,10 +1,11 @@
 { stdenv, fetchsvn, libextractor, libmicrohttpd, libgcrypt
 , zlib, gmp, curl, libtool, adns, sqlite, pkgconfig
 , libxml2, ncurses, gettext, libunistring, libidn
-, makeWrapper, autoconf, automake }:
+, makeWrapper, autoconf, automake
+, withVerbose ? false }:
 
 let
-  rev = "27775";
+  rev = "27840";
 in
 stdenv.mkDerivation rec {
   name = "gnunet-svn-${rev}";
@@ -12,7 +13,7 @@ stdenv.mkDerivation rec {
   src = fetchsvn {
     url =  https://gnunet.org/svn/gnunet;
     inherit rev;
-    sha256 = "1fa2g63rrn0mmim9v62gnm2hqr556mbcafb7cs7afycbinix4spf";
+    sha256 = "0zhxvvj5rbhca2ykfx3g93dv94xyhqsnj011a6gql7zd5vfhaf6v";
   };
 
   buildInputs = [
@@ -22,6 +23,8 @@ stdenv.mkDerivation rec {
     autoconf automake
   ];
 
+  configureFlags = stdenv.lib.optional withVerbose "--enable-logging=verbose ";
+
   preConfigure = ''
     # Brute force: since nix-worker chroots don't provide
     # /etc/{resolv.conf,hosts}, replace all references to `localhost'
diff --git a/pkgs/applications/science/logic/hol/default.nix b/pkgs/applications/science/logic/hol/default.nix
index 5abee674c47..2e1647b6c71 100644
--- a/pkgs/applications/science/logic/hol/default.nix
+++ b/pkgs/applications/science/logic/hol/default.nix
@@ -1,4 +1,5 @@
-{stdenv, fetchurl, polyml, graphviz, experimentalKernel ? true}:
+{stdenv, fetchurl, polyml, graphviz, fontconfig, liberation_ttf,
+ experimentalKernel ? true}:
 
 let
   pname = "hol4";
@@ -15,9 +16,18 @@ stdenv.mkDerivation {
     sha256 = "5ce4c1e37301dbc38772694e98f1c7eabf69255908de204b280d8b2b1709e9d0";
   };
 
-  buildInputs = [polyml graphviz];
+  buildInputs = [polyml graphviz fontconfig liberation_ttf];
 
   buildCommand = ''
+
+    mkdir chroot-fontconfig
+    cat ${fontconfig}/etc/fonts/fonts.conf > chroot-fontconfig/fonts.conf
+    sed -e 's@</fontconfig>@@' -i chroot-fontconfig/fonts.conf
+    echo "<dir>${liberation_ttf}</dir>" >> chroot-fontconfig/fonts.conf
+    echo "</fontconfig>" >> chroot-fontconfig/fonts.conf
+
+    export FONTCONFIG_FILE=$(pwd)/chroot-fontconfig/fonts.conf
+
     mkdir -p "$out/src"
     cd  "$out/src"
 
@@ -28,7 +38,10 @@ stdenv.mkDerivation {
       --replace "\"/bin/mv\"" "\"mv\"" \
       --replace "\"/bin/cp\"" "\"cp\""
 
-    substituteInPlace tools/buildutils.sml --replace "\"/usr/bin/dot\"" "\"dot\""
+    for f in tools/buildutils.sml help/src-sml/DOT;
+    do
+      substituteInPlace $f --replace "\"/usr/bin/dot\"" "\"${graphviz}/bin/dot\""
+    done
 
     #sed -ie "/compute/,999 d" tools/build-sequence # for testing
 
diff --git a/pkgs/applications/science/math/maxima/default.nix b/pkgs/applications/science/math/maxima/default.nix
index f5fec36756d..b8f7f2e65b6 100644
--- a/pkgs/applications/science/math/maxima/default.nix
+++ b/pkgs/applications/science/math/maxima/default.nix
@@ -2,7 +2,7 @@
 
 let
   name    = "maxima";
-  version = "5.30.0";
+  version = "5.31.2";
 
   searchPath =
     stdenv.lib.makeSearchPath "bin"
@@ -13,7 +13,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "mirror://sourceforge/${name}/${name}-${version}.tar.gz";
-    sha256 = "1mhx7g0kzpiagg97s2zhaplsq1li9ya2764mhwl7jgfw2vp3jlm0";
+    sha256 = "12j5irwfckl5583h7lwh0wrp0c65q7mqzcsri2v086j50xvvv398";
   };
 
   buildInputs = [sbcl texinfo perl makeWrapper];
diff --git a/pkgs/applications/science/math/wxmaxima/default.nix b/pkgs/applications/science/math/wxmaxima/default.nix
index 47baf446d0a..01be4ba7e6c 100644
--- a/pkgs/applications/science/math/wxmaxima/default.nix
+++ b/pkgs/applications/science/math/wxmaxima/default.nix
@@ -2,14 +2,14 @@
 
 let
   name    = "wxmaxima";
-  version = "13.04.1";
+  version = "13.04.2";
 in
 stdenv.mkDerivation {
   name = "${name}-${version}";
 
   src = fetchurl {
     url = "mirror://sourceforge/${name}/wxMaxima/${version}/wxMaxima-${version}.tar.gz";
-    sha256 = "0irp1m9vr50ym7wfj1c1vbrzd2pip1vmvn9ykqsdf04afkkwkran";
+    sha256 = "1sylvr0kfdzxxc3qsb0c6ff3lg0bzm1ib5xh78wjgzykbnvjsd99";
   };
 
   buildInputs = [wxGTK maxima makeWrapper];
diff --git a/pkgs/applications/virtualization/virt-manager/default.nix b/pkgs/applications/virtualization/virt-manager/default.nix
index d1e2a8b7883..de3e5c98d36 100644
--- a/pkgs/applications/virtualization/virt-manager/default.nix
+++ b/pkgs/applications/virtualization/virt-manager/default.nix
@@ -1,4 +1,5 @@
-{ stdenv, fetchurl, pythonPackages, intltool, libvirt, libxml2Python, curl, python, makeWrapper, virtinst, pyGtkGlade, pythonDBus, gnome_python, gtkvnc}:
+{ stdenv, fetchurl, pythonPackages, intltool, libvirt, libxml2Python, curl,
+  python, makeWrapper, virtinst, pyGtkGlade, pythonDBus, gnome_python, gtkvnc, vte}:
 
 with stdenv.lib;
 
@@ -18,7 +19,8 @@ stdenv.mkDerivation rec {
       distutils_extra simplejson readline glance cheetah lockfile httplib2
       # !!! should libvirt be a build-time dependency?  Note that
       # libxml2Python is a dependency of libvirt.py. 
-      libvirt libxml2Python urlgrabber virtinst pyGtkGlade pythonDBus gnome_python gtkvnc
+      libvirt libxml2Python urlgrabber virtinst pyGtkGlade pythonDBus gnome_python
+      gtkvnc vte
     ];
 
   buildInputs =
diff --git a/pkgs/applications/window-managers/stumpwm/default.nix b/pkgs/applications/window-managers/stumpwm/default.nix
deleted file mode 100644
index 721adf41326..00000000000
--- a/pkgs/applications/window-managers/stumpwm/default.nix
+++ /dev/null
@@ -1,61 +0,0 @@
-args : 
-let 
-  lib = args.lib;
-  fetchurl = args.fetchurl;
-  noDepEntry = args.noDepEntry;
-  fullDepEntry = args.fullDepEntry;
-
-  buildInputs = lib.attrVals ["clisp" "texinfo"] args;
-  version = lib.attrByPath ["version"] "0.9.7" args; 
-
-  pkgName = "stumpwm";
-in
-rec {
-  src = fetchurl {
-    url = "mirror://savannah/stumpwm/${pkgName}-${version}.tgz";
-    sha256 = "a0793d22ef90731d34f84e51deafb4bc2095a357c70b9505dc57516f481cdf78";
-  };
-
-  inherit buildInputs;
-  configureFlags = ["--with-lisp=clisp"];
-  envVars = noDepEntry (''
-    export HOME="$NIX_BUILD_TOP";
-  '');
-
-  installation = fullDepEntry (''
-    mkdir -p $out/bin 
-    mkdir -p $out/share/stumpwm/doc
-    mkdir -p $out/share/info 
-    mkdir -p $out/share/stumpwm/lisp
-
-    cp stumpwm $out/bin
-    cp contrib/stumpish $out/bin || true
-    cp sample-stumpwmrc.lisp  $out/share/stumpwm/doc
-    cp stumpwm.info $out/share/info
-
-    cp -r {.,cl-ppcre}/*.{lisp,fas,lib,asd} contrib $out/share/stumpwm/lisp
-    cd $out/share/stumpwm/lisp
-    cat << EOF >init-stumpwm.lisp
-      (require "asdf") 
-      (asdf:operate 'asdf:load-op :cl-ppcre) 
-      (asdf:operate 'asdf:load-op :stumpwm)
-    EOF
-    clisp -K full -i init-stumpwm.lisp
-    cat << EOF >init-stumpwm.lisp
-      (require "asdf") 
-      (asdf:operate 'asdf:load-source-op :cl-ppcre) 
-      (asdf:operate 'asdf:load-source-op :stumpwm)
-    EOF
-    '') ["minInit" "defEnsureDir" "addInputs" "doMake"];
-
-  /* doConfigure should be specified separately */
-  phaseNames = ["envVars" "doConfigure" "doMake" "installation"];
-      
-  name = "${pkgName}-" + version;
-  meta = {
-    description = "Common Lisp-based ratpoison-like window manager";
-    maintainers = [args.lib.maintainers.raskin];
-    platforms = with args.lib.platforms;
-      linux ++ freebsd;
-  };
-}
diff --git a/pkgs/build-support/builder-defs/builder-defs.nix b/pkgs/build-support/builder-defs/builder-defs.nix
index 3c5d7af621c..e22aa6bc66e 100644
--- a/pkgs/build-support/builder-defs/builder-defs.nix
+++ b/pkgs/build-support/builder-defs/builder-defs.nix
@@ -565,13 +565,15 @@ let inherit (builtins) head tail trace; in
      # Interpreters that are already in the store are left untouched.
          echo "patching script interpreter paths"
          local f
-         for f in $(find "${dir}" -type f -perm +0100); do
+         for f in $(find "${dir}" -xtype f -perm +0100); do
              local oldPath=$(sed -ne '1 s,^#![ ]*\([^ ]*\).*$,\1,p' "$f")
              if test -n "$oldPath" -a "''${oldPath:0:''${#NIX_STORE}}" != "$NIX_STORE"; then
                  local newPath=$(type -P $(basename $oldPath) || true)
                  if test -n "$newPath" -a "$newPath" != "$oldPath"; then
                      echo "$f: interpreter changed from $oldPath to $newPath"
                      sed -i "1 s,$oldPath,$newPath," "$f"
+		 else
+		     echo "$f: not changing interpreter from $oldPath"
                  fi
              fi
          done
diff --git a/pkgs/build-support/upstream-updater/urls-from-page.sh b/pkgs/build-support/upstream-updater/urls-from-page.sh
index d456794a563..aecf645eb81 100755
--- a/pkgs/build-support/upstream-updater/urls-from-page.sh
+++ b/pkgs/build-support/upstream-updater/urls-from-page.sh
@@ -9,6 +9,6 @@ relpath="${path#$server}"
  
 echo "URL: $url" >&2
 
-curl -L -k "$url" | sed -re 's/^/-/;s/[hH][rR][eE][fF]=("([^"]*)"|'\''([^'\'']*)'\''|([^"'\'' <>&]+)[ <>&])/\n+\2\3\4\n-/g' | \
+curl -A 'text/html; text/xhtml; text/xml; */*' -L -k "$url" | sed -re 's/^/-/;s/[hH][rR][eE][fF]=("([^"]*)"|'\''([^'\'']*)'\''|([^"'\'' <>&]+)[ <>&])/\n+\2\3\4\n-/g' | \
   sed -e '/^-/d; s/^[+]//; /^#/d;'"s/^\\//$protocol:\\/\\/$server\\//g" | \
   sed -re 's`^[^:]*$`'"$protocol://$basepath/&\`"
diff --git a/pkgs/data/fonts/lmodern/default.nix b/pkgs/data/fonts/lmodern/default.nix
index 831a3ddbd09..1368537c2a1 100644
--- a/pkgs/data/fonts/lmodern/default.nix
+++ b/pkgs/data/fonts/lmodern/default.nix
@@ -9,10 +9,10 @@ stdenv.mkDerivation {
   };
 
   installPhase = ''
-    mkdir -p $out/texmf/
+    mkdir -p $out/texmf-dist/
     mkdir -p $out/share/fonts/
 
-    cp -r ./* $out/texmf/
+    cp -r ./* $out/texmf-dist/
     cp -r fonts/{opentype,type1} $out/share/fonts/
 
     ln -s $out/texmf* $out/share/
diff --git a/pkgs/data/fonts/lmodern/lmmath.nix b/pkgs/data/fonts/lmodern/lmmath.nix
index 651a84726af..90132272dd1 100644
--- a/pkgs/data/fonts/lmodern/lmmath.nix
+++ b/pkgs/data/fonts/lmodern/lmmath.nix
@@ -14,10 +14,10 @@ stdenv.mkDerivation {
   sourceRoot = ".";
 
   installPhase = ''
-    mkdir -p $out/texmf/fonts/opentype
+    mkdir -p $out/texmf-dist/fonts/opentype
     mkdir -p $out/share/fonts/opentype
 
-    cp *.{OTF,otf} $out/texmf/fonts/opentype/lmmath-regular.otf
+    cp *.{OTF,otf} $out/texmf-dist/fonts/opentype/lmmath-regular.otf
     cp *.{OTF,otf} $out/share/fonts/opentype/lmmath-regular.otf
 
     ln -s $out/texmf* $out/share/
diff --git a/pkgs/data/fonts/tipa/default.nix b/pkgs/data/fonts/tipa/default.nix
index 47e98f7c53a..1049e6924bd 100644
--- a/pkgs/data/fonts/tipa/default.nix
+++ b/pkgs/data/fonts/tipa/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation {
   };
 
   installPhase = ''
-    export PREFIX="$out/texmf"
+    export PREFIX="$out/texmf-dist"
     mkdir -p "$PREFIX" "$out/share"
     make install PREFIX="$PREFIX"
 
diff --git a/pkgs/data/misc/tzdata/default.nix b/pkgs/data/misc/tzdata/default.nix
index c49430935ae..da043da0967 100644
--- a/pkgs/data/misc/tzdata/default.nix
+++ b/pkgs/data/misc/tzdata/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchurl }:
 
-let version = "2012f"; in
+let version = "2013g"; in
 
 stdenv.mkDerivation rec {
   name = "tzdata-${version}";
@@ -8,11 +8,11 @@ stdenv.mkDerivation rec {
   srcs =
     [ (fetchurl {
         url = "http://www.iana.org/time-zones/repository/releases/tzdata${version}.tar.gz";
-        sha256 = "1k165i8g23rr0z26k02x1l4immp69g6yqjrd3lwmbvj5li4mmsdg";
+        sha256 = "0krsgncjnk64g3xshj5xd3znskcx9wwy20g1wmm2lwycincx7kdn";
       })
       (fetchurl {
         url = "http://www.iana.org/time-zones/repository/releases/tzcode${version}.tar.gz";
-        sha256 = "1m6rg9003mkjyvpv5gg5lcia9fzhy7ndwgs68qlpbipnw5p0k2pk";
+        sha256 = "0ysqm72xm9vcykqg9zgry69w6gr3i6b6mpbvgfmwyrdvb6s5ihy7";
       })
     ];
 
diff --git a/pkgs/development/compilers/idris/default.nix b/pkgs/development/compilers/idris/default.nix
index 7252343aa55..30ef18a1ef9 100644
--- a/pkgs/development/compilers/idris/default.nix
+++ b/pkgs/development/compilers/idris/default.nix
@@ -1,20 +1,21 @@
-{ cabal, ansiTerminal, binary, boehmgc, Cabal, filepath, gmp, happy
-, haskeline, languageJava, libffi, llvmGeneral, llvmGeneralPure
-, mtl, parsec, parsers, split, text, time, transformers, trifecta
-, unorderedContainers, utf8String, vector, vectorBinaryInstances
+{ cabal, ansiTerminal, ansiWlPprint, binary, boehmgc, Cabal
+, filepath, gmp, happy, haskeline, languageJava, libffi
+, llvmGeneral, llvmGeneralPure, mtl, parsec, parsers, split, text
+, time, transformers, trifecta, unorderedContainers, utf8String
+, vector, vectorBinaryInstances
 }:
 
 cabal.mkDerivation (self: {
   pname = "idris";
-  version = "0.9.9.2";
-  sha256 = "0xfwnlf3jca64i4piyx9scmk4z8f6rak2cvrcjwji505a9vaa0rw";
+  version = "0.9.9.3";
+  sha256 = "1l19xx0xbcwlnnh2w0rmri7wwixffzfrafpbji64nwyx1awz4iab";
   isLibrary = false;
   isExecutable = true;
   buildDepends = [
-    ansiTerminal binary Cabal filepath haskeline languageJava libffi
-    llvmGeneral llvmGeneralPure mtl parsec parsers split text time
-    transformers trifecta unorderedContainers utf8String vector
-    vectorBinaryInstances
+    ansiTerminal ansiWlPprint binary Cabal filepath haskeline
+    languageJava libffi llvmGeneral llvmGeneralPure mtl parsec parsers
+    split text time transformers trifecta unorderedContainers
+    utf8String vector vectorBinaryInstances
   ];
   buildTools = [ happy ];
   extraLibraries = [ boehmgc gmp ];
diff --git a/pkgs/development/compilers/julia/default.nix b/pkgs/development/compilers/julia/default.nix
index e2384b08e5b..ae550f5692d 100644
--- a/pkgs/development/compilers/julia/default.nix
+++ b/pkgs/development/compilers/julia/default.nix
@@ -8,7 +8,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "julia";
-  date = "20130611";
+  date = "20131013";
   name = "${pname}-git-${date}";
 
   grisu_ver = "1.1.1";
@@ -65,8 +65,8 @@ stdenv.mkDerivation rec {
 
   src = fetchgit {
     url = "git://github.com/JuliaLang/julia.git";
-    rev = "60cc4e44bf415dcda90f2bbe22300f842fe44098";
-    sha256 = "018s0zyvdkxjldbvcdv40q3v2gcjznyyql5pv3zhhy1iq11jddfz";
+    rev = "76d2b87a45fff637473c4c342c9f5f9387675fda";
+    sha256 = "079g44r27lv0wsfbg84ihrmgzl73djjjr41xjiaqdph55zqfbn4f";
   };
 
   buildInputs = [ gfortran perl m4 gmp pcre llvm readline zlib
diff --git a/pkgs/development/compilers/ocaml/4.01.0.nix b/pkgs/development/compilers/ocaml/4.01.0.nix
new file mode 100644
index 00000000000..c11bb7536be
--- /dev/null
+++ b/pkgs/development/compilers/ocaml/4.01.0.nix
@@ -0,0 +1,63 @@
+{ stdenv, fetchurl, ncurses, x11 }:
+
+let
+   useX11 = !stdenv.isArm && !stdenv.isMips;
+   useNativeCompilers = !stdenv.isMips;
+   inherit (stdenv.lib) optionals optionalString;
+in
+
+stdenv.mkDerivation rec {
+
+  name = "ocaml-4.01.0";
+
+  src = fetchurl {
+    url = "http://caml.inria.fr/pub/distrib/ocaml-4.01/${name}.tar.bz2";
+    sha256 = "b1ca708994180236917ae79e17606da5bd334ca6acd6873a550027e1c0ec874a";
+  };
+
+  prefixKey = "-prefix ";
+  configureFlags = ["-no-tk"] ++ optionals useX11 [ "-x11lib" x11 ];
+  buildFlags = "world" + optionalString useNativeCompilers " bootstrap world.opt";
+  buildInputs = [ncurses] ++ optionals useX11 [ x11 ];
+  installTargets = "install" + optionalString useNativeCompilers " installopt";
+  preConfigure = ''
+    CAT=$(type -tp cat)
+    sed -e "s@/bin/cat@$CAT@" -i config/auto-aux/sharpbang
+  '';
+  postBuild = ''
+    mkdir -p $out/include
+    ln -sv $out/lib/ocaml/caml $out/include/caml
+  '';
+
+  passthru = {
+    nativeCompilers = useNativeCompilers;
+  };
+
+  meta = {
+    homepage = http://caml.inria.fr/ocaml;
+    licenses = [ "QPL" /* compiler */ "LGPLv2" /* library */ ];
+    description = "OCaml, the most popular variant of the Caml language";
+
+    longDescription =
+      ''
+        OCaml is the most popular variant of the Caml language.  From a
+        language standpoint, it extends the core Caml language with a
+        fully-fledged object-oriented layer, as well as a powerful module
+        system, all connected by a sound, polymorphic type system featuring
+        type inference.
+
+        The OCaml system is an industrial-strength implementation of this
+        language, featuring a high-performance native-code compiler (ocamlopt)
+        for 9 processor architectures (IA32, PowerPC, AMD64, Alpha, Sparc,
+        Mips, IA64, HPPA, StrongArm), as well as a bytecode compiler (ocamlc)
+        and an interactive read-eval-print loop (ocaml) for quick development
+        and portability.  The OCaml distribution includes a comprehensive
+        standard library, a replay debugger (ocamldebug), lexer (ocamllex) and
+        parser (ocamlyacc) generators, a pre-processor pretty-printer (camlp4)
+        and a documentation generator (ocamldoc).
+      '';
+
+    platforms = stdenv.lib.platforms.linux ++ stdenv.lib.platforms.darwin;
+  };
+
+}
diff --git a/pkgs/development/compilers/sbcl/default.nix b/pkgs/development/compilers/sbcl/default.nix
index 1e4feff1107..288fdb33454 100644
--- a/pkgs/development/compilers/sbcl/default.nix
+++ b/pkgs/development/compilers/sbcl/default.nix
@@ -4,11 +4,11 @@ let
   s= # Generated upstream information
   rec {
     baseName="sbcl";
-    version="1.1.8";
+    version="1.1.12";
     name="${baseName}-${version}";
-    hash="1fmcpsi2bddfpz3impm9i62y9p15r3mc4xgm1dg0k77l33859jip";
-    url="mirror://sourceforge/project/sbcl/sbcl/1.1.8/sbcl-1.1.8-source.tar.bz2";
-    sha256="1fmcpsi2bddfpz3impm9i62y9p15r3mc4xgm1dg0k77l33859jip";
+    hash="0mvl6lpi44yv6jv3xhyyzvf9g7bdlj691iz3ydpn66v0vg5i554c";
+    url="mirror://sourceforge/project/sbcl/sbcl/1.1.12/sbcl-1.1.12-source.tar.bz2";
+    sha256="0mvl6lpi44yv6jv3xhyyzvf9g7bdlj691iz3ydpn66v0vg5i554c";
   };
   buildInputs = with a; [
     clisp makeWrapper
diff --git a/pkgs/development/interpreters/clisp/default.nix b/pkgs/development/interpreters/clisp/default.nix
index bd19d738860..b8af3f6d747 100644
--- a/pkgs/development/interpreters/clisp/default.nix
+++ b/pkgs/development/interpreters/clisp/default.nix
@@ -48,6 +48,11 @@ stdenv.mkDerivation rec {
     cd builddir
   '';
 
+  postInstall = ''
+    ./clisp-link add "$out"/lib/clisp*/base "$(dirname "$out"/lib/clisp*/base)"/full \
+        clx/new-clx bindings/glibc pcre rawsock wildcard zlib
+  '';
+
   NIX_CFLAGS_COMPILE="-O0";
 
   # TODO : make mod-check fails
diff --git a/pkgs/development/interpreters/php/5.4.nix b/pkgs/development/interpreters/php/5.4.nix
index 394278dea74..eb3d796f229 100644
--- a/pkgs/development/interpreters/php/5.4.nix
+++ b/pkgs/development/interpreters/php/5.4.nix
@@ -9,7 +9,7 @@ in
 
 composableDerivation.composableDerivation {} ( fixed : let inherit (fixed.fixed) version; in {
 
-  version = "5.4.18";
+  version = "5.4.20";
 
   name = "php-${version}";
 
@@ -230,7 +230,7 @@ composableDerivation.composableDerivation {} ( fixed : let inherit (fixed.fixed)
       "http://nl1.php.net/get/php-${version}.tar.bz2/from/this/mirror"
       "http://se1.php.net/get/php-${version}.tar.bz2/from/this/mirror"
     ];
-    sha256 = "1ncizy992nfy3i3lzns7qcinj5376d840hchaqs5jlfn2nz0k50x";
+    sha256 = "1qarcxj46rzkmql3w2dln0hxzs349ph31fxcslizxch1ig7l43nd";
     name = "php-${version}.tar.bz2";
   };
 
diff --git a/pkgs/development/interpreters/python/2.6/default.nix b/pkgs/development/interpreters/python/2.6/default.nix
index 4b55f7150d3..6192c9e11e7 100644
--- a/pkgs/development/interpreters/python/2.6/default.nix
+++ b/pkgs/development/interpreters/python/2.6/default.nix
@@ -160,6 +160,11 @@ let
       deps = [ ncurses ];
     };
 
+    curses_panel = buildInternalPythonModule {
+      moduleName = "curses_panel";
+      deps = [ ncurses modules.curses ];
+    };
+
     gdbm = buildInternalPythonModule {
       moduleName = "gdbm";
       internalName = "gdbm";
diff --git a/pkgs/development/interpreters/python/2.7/default.nix b/pkgs/development/interpreters/python/2.7/default.nix
index aea2d21fd8d..617be4f29f1 100644
--- a/pkgs/development/interpreters/python/2.7/default.nix
+++ b/pkgs/development/interpreters/python/2.7/default.nix
@@ -164,6 +164,11 @@ let
       deps = [ ncurses ];
     };
 
+    curses_panel = buildInternalPythonModule {
+      moduleName = "curses_panel";
+      deps = [ ncurses modules.curses ];
+    };
+
     crypt = buildInternalPythonModule {
       moduleName = "crypt";
       internalName = "crypt";
diff --git a/pkgs/development/libraries/SDL2/default.nix b/pkgs/development/libraries/SDL2/default.nix
new file mode 100644
index 00000000000..7bc27362a29
--- /dev/null
+++ b/pkgs/development/libraries/SDL2/default.nix
@@ -0,0 +1,56 @@
+{ stdenv, fetchurl, pkgconfig, audiofile
+, openglSupport ? false, mesa ? null
+, alsaSupport ? true, alsaLib ? null
+, x11Support ? true, x11 ? null, libXrandr ? null
+, pulseaudioSupport ? true, pulseaudio ? null
+}:
+
+# OSS is no longer supported, for it's much crappier than ALSA and
+# PulseAudio.
+assert alsaSupport || pulseaudioSupport;
+
+assert openglSupport -> (mesa != null && x11Support);
+assert x11Support -> (x11 != null && libXrandr != null);
+assert alsaSupport -> alsaLib != null;
+assert pulseaudioSupport -> pulseaudio != null;
+
+let
+  configureFlagsFun = attrs: ''
+        --disable-oss --disable-video-x11-xme
+        --disable-x11-shared --disable-alsa-shared --enable-rpath --disable-pulseaudio-shared
+        --disable-osmesa-shared --enable-static
+        ${if alsaSupport then "--with-alsa-prefix=${attrs.alsaLib}/lib" else ""}
+      '';
+in
+stdenv.mkDerivation rec {
+  name = "SDL2-2.0.0";
+
+  src = fetchurl {
+    url = "http://www.libsdl.org/release/${name}.tar.gz";
+    sha256 = "0y3in99brki7vc2mb4c0w39v70mf4h341mblhh8nmq4h7lawhskg";
+  };
+
+  # Since `libpulse*.la' contain `-lgdbm', PulseAudio must be propagated.
+  propagatedBuildInputs = stdenv.lib.optionals x11Support [ x11 libXrandr ] ++
+    stdenv.lib.optional pulseaudioSupport pulseaudio;
+
+  buildInputs = [ pkgconfig audiofile ] ++
+    stdenv.lib.optional openglSupport [ mesa ] ++
+    stdenv.lib.optional alsaSupport alsaLib;
+
+  # XXX: By default, SDL wants to dlopen() PulseAudio, in which case
+  # we must arrange to add it to its RPATH; however, `patchelf' seems
+  # to fail at doing this, hence `--disable-pulseaudio-shared'.
+  configureFlags = configureFlagsFun { inherit alsaLib; };
+
+  crossAttrs = {
+      configureFlags = configureFlagsFun { alsaLib = alsaLib.crossDrv; };
+  };
+
+  passthru = {inherit openglSupport;};
+
+  meta = {
+    description = "A cross-platform multimedia library";
+    homepage = http://www.libsdl.org/;
+  };
+}
diff --git a/pkgs/development/libraries/SDL2_gfx/default.nix b/pkgs/development/libraries/SDL2_gfx/default.nix
new file mode 100644
index 00000000000..693b7bf8fe1
--- /dev/null
+++ b/pkgs/development/libraries/SDL2_gfx/default.nix
@@ -0,0 +1,54 @@
+{stdenv, fetchsvn, SDL2} :
+
+let rev = 5; in
+stdenv.mkDerivation rec {
+  name = "SDL2_gfx-${toString rev}";
+
+  src = fetchsvn {
+    url = http://svn.code.sf.net/p/sdl2gfx/code/trunk;
+    inherit rev;
+    sha256 = "1hzilbn1412m2b44mygrbdfh1gvks4v5p0kmafz248jf9ifsvmzp";
+  };
+
+  buildInputs = [ SDL2 ] ;
+
+  configureFlags = "--disable-mmx";
+
+  postInstall = ''
+    sed -i -e 's,"SDL.h",<SDL2/SDL.h>,' \
+      $out/include/SDL2/*.h
+    
+    ln -s $out/include/SDL2/SDL2_framerate.h $out/include/SDL2/SDL_framerate.h;
+    ln -s $out/include/SDL2/SDL2_gfxPrimitives.h $out/include/SDL2/SDL_gfxPrimitives.h;
+    ln -s $out/include/SDL2/SDL2_rotozoom.h $out/include/SDL2/SDL_rotozoom.h;
+    ln -s $out/include/SDL2/*.h $out/include/;
+  '';
+
+  meta = {
+    description = "SDL graphics drawing primitives and support functions";
+
+    longDescription =
+      '' The SDL_gfx library evolved out of the SDL_gfxPrimitives code
+	 which provided basic drawing routines such as lines, circles or
+	 polygons and SDL_rotozoom which implemented a interpolating
+	 rotozoomer for SDL surfaces.
+
+	 The current components of the SDL_gfx library are:
+
+	    * Graphic Primitives (SDL_gfxPrimitves.h)
+	    * Rotozoomer (SDL_rotozoom.h)
+	    * Framerate control (SDL_framerate.h)
+	    * MMX image filters (SDL_imageFilter.h)
+	    * Custom Blit functions (SDL_gfxBlitFunc.h)
+
+	 The library is backwards compatible to the above mentioned
+         code. Its is written in plain C and can be used in C++ code.
+       '';
+
+    homepage = https://sourceforge.net/projects/sdlgfx/;
+    license = "LGPLv2+";
+
+    maintainers = [ stdenv.lib.maintainers.bjg ];
+    platforms = stdenv.lib.platforms.linux;
+  };
+}
diff --git a/pkgs/development/libraries/SDL2_image/default.nix b/pkgs/development/libraries/SDL2_image/default.nix
new file mode 100644
index 00000000000..73b5ba8d929
--- /dev/null
+++ b/pkgs/development/libraries/SDL2_image/default.nix
@@ -0,0 +1,27 @@
+{ stdenv, fetchurl, SDL2, libpng, libjpeg, libtiff, libungif, libXpm, zlib }:
+
+stdenv.mkDerivation rec {
+  name = "SDL2_image-2.0.0";
+
+  src = fetchurl {
+    url = "http://www.libsdl.org/projects/SDL_image/release/${name}.tar.gz";
+    sha256 = "0d3jlhkmr0j5a2dd5h6y29jfcsj7mkl16wghm6n3nqqp7g3ib65j";
+  };
+
+  buildInputs = [SDL2 libpng libjpeg libtiff libungif libXpm zlib];
+
+  postInstall = ''
+    sed -i -e 's,"SDL.h",<SDL2/SDL.h>,' \
+      -e 's,"SDL_version.h",<SDL2/SDL_version.h>,' \
+      -e 's,"begin_code.h",<SDL2/begin_code.h>,' \
+      -e 's,"close_code.h",<SDL2/close_code.h>,' \
+      $out/include/SDL2/SDL_image.h
+    ln -sv SDL2/SDL_image.h $out/include/SDL_image.h
+  '';
+
+  meta = {
+    description = "SDL image library";
+    homepage = "http://www.libsdl.org/projects/SDL_image/";
+    platforms = stdenv.lib.platforms.linux;
+  };
+}
diff --git a/pkgs/development/libraries/SDL2_mixer/default.nix b/pkgs/development/libraries/SDL2_mixer/default.nix
new file mode 100644
index 00000000000..6d29ddf6eea
--- /dev/null
+++ b/pkgs/development/libraries/SDL2_mixer/default.nix
@@ -0,0 +1,20 @@
+{ stdenv, fetchurl, SDL2, libogg, libvorbis, enableNativeMidi ? false }:
+
+stdenv.mkDerivation rec {
+  name = "SDL2_mixer-2.0.0";
+
+  src = fetchurl {
+    url = "http://www.libsdl.org/projects/SDL_mixer/release/${name}.tar.gz";
+    sha256 = "0nvjdxjchrajrn0jag877hdx9zb788hsd315zzg1lyck2wb0xkm8";
+  };
+
+  buildInputs = [SDL2 libogg libvorbis];
+
+  configureFlags = "--disable-music-ogg-shared" + stdenv.lib.optionalString enableNativeMidi "--enable-music-native-midi-gpl";
+
+  postInstall = "ln -s $out/include/SDL2/SDL_mixer.h $out/include/";
+
+  meta = {
+    description = "SDL multi-channel audio mixer library";
+  };
+}
diff --git a/pkgs/development/libraries/gurobi/default.nix b/pkgs/development/libraries/gurobi/default.nix
new file mode 100644
index 00000000000..4bdee56ae99
--- /dev/null
+++ b/pkgs/development/libraries/gurobi/default.nix
@@ -0,0 +1,25 @@
+{ stdenv, requireFile }:
+
+stdenv.mkDerivation {
+  name = "gurobi-5.6.0";
+
+  src = requireFile {
+    name = "gurobi5.6.0_linux64.tar.gz";
+    sha256 = "1qwfjyx5y71x97gkndqnl9h4xc8hl48zwcwss7jagqfj3gxwvnky";
+    url = "http://www.gurobi.com/download/gurobi-optimizer";
+  };
+
+  installPhase = "mv linux64 $out";
+
+  fixupPhase = ''
+    interp=`cat $NIX_GCC/nix-support/dynamic-linker`
+    find $out/bin -type f -executable -exec patchelf --interpreter "$interp" --set-rpath $out/lib {} \;
+  '';
+
+  meta = {
+    description = "State-of-the-art mathematical programming solver";
+    homepage = http://www.gurobi.com/;
+    license = "unfree";
+    maintainers = [ stdenv.lib.maintainers.shlevy ];
+  };
+}
diff --git a/pkgs/development/libraries/harfbuzz/default.nix b/pkgs/development/libraries/harfbuzz/default.nix
index 4fb024db0e1..1202ab5825d 100644
--- a/pkgs/development/libraries/harfbuzz/default.nix
+++ b/pkgs/development/libraries/harfbuzz/default.nix
@@ -1,4 +1,5 @@
-{ stdenv, fetchurl, pkgconfig, glib, freetype, libintlOrEmpty }:
+{ stdenv, fetchurl, pkgconfig, glib, freetype,
+  icu ? null, graphite2 ? null, libintlOrEmpty }:
 
 stdenv.mkDerivation rec {
   name = "harfbuzz-0.9.12";
@@ -8,7 +9,12 @@ stdenv.mkDerivation rec {
     sha256 = "19cx5y2m20rp7z5j7mwqfb4ph2g8lrri69zim44x362y4w5gfly6";
   };
 
-  buildInputs = [ pkgconfig glib freetype ] ++ libintlOrEmpty;
+  buildInputs = [ pkgconfig glib freetype ]
+    ++ libintlOrEmpty;
+  propagatedBuildInputs = []
+    ++ (stdenv.lib.optionals (icu != null) [icu])
+    ++ (stdenv.lib.optionals (graphite2 != null) [graphite2])
+    ;
 
   meta = {
     description = "An OpenType text shaping engine";
diff --git a/pkgs/development/libraries/haskell/Cabal/1.18.1.nix b/pkgs/development/libraries/haskell/Cabal/1.18.1.1.nix
index f0792be6ec9..431c62b85e0 100644
--- a/pkgs/development/libraries/haskell/Cabal/1.18.1.nix
+++ b/pkgs/development/libraries/haskell/Cabal/1.18.1.1.nix
@@ -5,8 +5,8 @@
 
 cabal.mkDerivation (self: {
   pname = "Cabal";
-  version = "1.18.1";
-  sha256 = "041m3xr8v0bbw0016lnzmnv9xpj15z5pd272j3sbsrwpmcyds3a0";
+  version = "1.18.1.1";
+  sha256 = "1qa6z9kb46hmix15fdjw80jqd69v4rxr52mfq25m8c60l3kxbiny";
   buildDepends = [ deepseq filepath time ];
   testDepends = [
     extensibleExceptions filepath HUnit QuickCheck regexPosix
diff --git a/pkgs/development/libraries/haskell/ChasingBottoms/default.nix b/pkgs/development/libraries/haskell/ChasingBottoms/default.nix
index 719e5eb2cee..b22272a7703 100644
--- a/pkgs/development/libraries/haskell/ChasingBottoms/default.nix
+++ b/pkgs/development/libraries/haskell/ChasingBottoms/default.nix
@@ -2,8 +2,8 @@
 
 cabal.mkDerivation (self: {
   pname = "ChasingBottoms";
-  version = "1.3.0.6";
-  sha256 = "1l40n1ylzrbp0lhm80q9djl8mf39zvmw7zzlg0gzxsqbzwbsggx8";
+  version = "1.3.0.7";
+  sha256 = "0g1bx6d2mi27qsb4bxvby50g39fm56gyi2658fyjiq1gamy50ypa";
   isLibrary = true;
   isExecutable = true;
   buildDepends = [ mtl QuickCheck random syb ];
diff --git a/pkgs/development/libraries/haskell/HTTP/4000.2.8.nix b/pkgs/development/libraries/haskell/HTTP/4000.2.8.nix
index 1b52261dea0..09f0b25910b 100644
--- a/pkgs/development/libraries/haskell/HTTP/4000.2.8.nix
+++ b/pkgs/development/libraries/haskell/HTTP/4000.2.8.nix
@@ -12,6 +12,7 @@ cabal.mkDerivation (self: {
     caseInsensitive conduit deepseq httpdShed httpTypes HUnit mtl
     network pureMD5 split testFramework testFrameworkHunit wai warp
   ];
+  jailbreak = true;
   doCheck = false;
   meta = {
     homepage = "https://github.com/haskell/HTTP";
diff --git a/pkgs/development/libraries/haskell/JuicyPixels/default.nix b/pkgs/development/libraries/haskell/JuicyPixels/default.nix
index 4dba89d9925..b2947318a1f 100644
--- a/pkgs/development/libraries/haskell/JuicyPixels/default.nix
+++ b/pkgs/development/libraries/haskell/JuicyPixels/default.nix
@@ -4,8 +4,8 @@
 
 cabal.mkDerivation (self: {
   pname = "JuicyPixels";
-  version = "3.1.1";
-  sha256 = "0bprga2lh7bjlmfm4p6vyzhjrhqw9ix0wnzc6f1q4a7skwhq0z92";
+  version = "3.1.1.1";
+  sha256 = "0lvhaa8pqknkcsfps5gcbwiqx0y1rhasiw9hwy7975vgpsh58dph";
   buildDepends = [
     binary deepseq mtl primitive transformers vector zlib
   ];
diff --git a/pkgs/development/libraries/haskell/RSA/default.nix b/pkgs/development/libraries/haskell/RSA/default.nix
index 17f4c516a54..c5257c5b262 100644
--- a/pkgs/development/libraries/haskell/RSA/default.nix
+++ b/pkgs/development/libraries/haskell/RSA/default.nix
@@ -12,7 +12,7 @@ cabal.mkDerivation (self: {
     binary cryptoApi cryptoPubkeyTypes monadcryptorandom pureMD5 SHA
   ];
   meta = {
-    description = "Implementation of RSA, using the padding schemes of PKCS#1 v2.1";
+    description = "Implementation of RSA, using the padding schemes of PKCS#1 v2.1.";
     license = self.stdenv.lib.licenses.bsd3;
     platforms = self.ghc.meta.platforms;
     maintainers = [ self.stdenv.lib.maintainers.andres ];
diff --git a/pkgs/development/libraries/haskell/accelerate/default.nix b/pkgs/development/libraries/haskell/accelerate/default.nix
index c2484116f46..b7979f6f5f2 100644
--- a/pkgs/development/libraries/haskell/accelerate/default.nix
+++ b/pkgs/development/libraries/haskell/accelerate/default.nix
@@ -5,6 +5,7 @@ cabal.mkDerivation (self: {
   version = "0.13.0.5";
   sha256 = "1vqkv3k0w1zy0111a786npf3hypbcg675lbdkv2cf3zx5hqcnn6j";
   buildDepends = [ fclabels hashable hashtables ];
+  jailbreak = true;
   meta = {
     homepage = "https://github.com/AccelerateHS/accelerate/";
     description = "An embedded language for accelerated array processing";
diff --git a/pkgs/development/libraries/haskell/active/default.nix b/pkgs/development/libraries/haskell/active/default.nix
index 92cf31226b2..1d6df75e5fa 100644
--- a/pkgs/development/libraries/haskell/active/default.nix
+++ b/pkgs/development/libraries/haskell/active/default.nix
@@ -4,8 +4,8 @@
 
 cabal.mkDerivation (self: {
   pname = "active";
-  version = "0.1.0.7";
-  sha256 = "18pcw98ni8fiy0yd7wmrqvpaf2wgav70rsikqfl571zjmdmzdw7p";
+  version = "0.1.0.8";
+  sha256 = "1q2zrx1i5j04c9bss7c19nm6lqasmwxyfzkh49my7yaik95k7bw9";
   buildDepends = [ newtype semigroupoids semigroups vectorSpace ];
   testDepends = [
     newtype QuickCheck semigroupoids semigroups vectorSpace
diff --git a/pkgs/development/libraries/haskell/aeson/default.nix b/pkgs/development/libraries/haskell/aeson/default.nix
index bcb202c64d0..edd2a21040e 100644
--- a/pkgs/development/libraries/haskell/aeson/default.nix
+++ b/pkgs/development/libraries/haskell/aeson/default.nix
@@ -5,8 +5,8 @@
 
 cabal.mkDerivation (self: {
   pname = "aeson";
-  version = "0.6.2.0";
-  sha256 = "1f7bzgwl9pm5a79gr3a8wxh7dyz4k2508d0bw4l0mbjgv6r7s4an";
+  version = "0.6.2.1";
+  sha256 = "00fa13qr38s4c0fwfvpks3x3sb21kh71cv1v0x2zqg0adnaydknb";
   buildDepends = [
     attoparsec blazeBuilder deepseq dlist hashable mtl syb text time
     unorderedContainers vector
diff --git a/pkgs/development/libraries/haskell/amqp/default.nix b/pkgs/development/libraries/haskell/amqp/default.nix
index 70e86ef1ffb..432d353a0af 100644
--- a/pkgs/development/libraries/haskell/amqp/default.nix
+++ b/pkgs/development/libraries/haskell/amqp/default.nix
@@ -1,12 +1,19 @@
-{ cabal, binary, dataBinaryIeee754, network, text, xml }:
+{ cabal, binary, clock, dataBinaryIeee754, hspec, hspecExpectations
+, network, split, text, xml
+}:
 
 cabal.mkDerivation (self: {
   pname = "amqp";
-  version = "0.6.0";
-  sha256 = "0rfczmhf46sc3pxxb5gwv4ggsxkqkvdi4kkqdnrdpdhs7p41im2n";
+  version = "0.7.0";
+  sha256 = "09zazmbdw8nphbjkmixn2dpwdgkjqjfbn6jv522ykvrcnsn35kc4";
   isLibrary = true;
   isExecutable = true;
-  buildDepends = [ binary dataBinaryIeee754 network text xml ];
+  buildDepends = [
+    binary clock dataBinaryIeee754 network split text xml
+  ];
+  testDepends = [
+    binary dataBinaryIeee754 hspec hspecExpectations network split text
+  ];
   meta = {
     homepage = "https://github.com/hreinhardt/amqp";
     description = "Client library for AMQP servers (currently only RabbitMQ)";
diff --git a/pkgs/development/libraries/haskell/arithmoi/default.nix b/pkgs/development/libraries/haskell/arithmoi/default.nix
index 22707c04e83..181937fdd80 100644
--- a/pkgs/development/libraries/haskell/arithmoi/default.nix
+++ b/pkgs/development/libraries/haskell/arithmoi/default.nix
@@ -7,7 +7,7 @@ cabal.mkDerivation (self: {
   buildDepends = [ mtl random ];
   meta = {
     homepage = "https://bitbucket.org/dafis/arithmoi";
-    description = "Basic number theoretic functions and utilities";
+    description = "Efficient basic number-theoretic functions. Primes, powers, integer logarithms.";
     license = self.stdenv.lib.licenses.mit;
     platforms = self.ghc.meta.platforms;
   };
diff --git a/pkgs/development/libraries/haskell/bifunctors/default.nix b/pkgs/development/libraries/haskell/bifunctors/default.nix
index c659c3bc3be..d7c8fa6debb 100644
--- a/pkgs/development/libraries/haskell/bifunctors/default.nix
+++ b/pkgs/development/libraries/haskell/bifunctors/default.nix
@@ -2,12 +2,12 @@
 
 cabal.mkDerivation (self: {
   pname = "bifunctors";
-  version = "3.2.0.1";
-  sha256 = "1biicx0zi48wzzi7vkhzvrdyk59hmmm1bqbsga6x5nbrbf3qrkm6";
+  version = "4.1.0.1";
+  sha256 = "1mf1v64g5pr2k1jpc7i4994ki2fp5vkxg4n5v84lfbl2r3kr92yg";
   buildDepends = [ semigroupoids semigroups tagged ];
   meta = {
     homepage = "http://github.com/ekmett/bifunctors/";
-    description = "Haskell 98 bifunctors";
+    description = "Bifunctors";
     license = self.stdenv.lib.licenses.bsd3;
     platforms = self.ghc.meta.platforms;
   };
diff --git a/pkgs/development/libraries/haskell/bindings-DSL/default.nix b/pkgs/development/libraries/haskell/bindings-DSL/default.nix
index 5e4e5d79379..ed2a631419a 100644
--- a/pkgs/development/libraries/haskell/bindings-DSL/default.nix
+++ b/pkgs/development/libraries/haskell/bindings-DSL/default.nix
@@ -2,8 +2,8 @@
 
 cabal.mkDerivation (self: {
   pname = "bindings-DSL";
-  version = "1.0.19";
-  sha256 = "0mjlv2ld1qdd83pv7khrk3f0g4ypk8a8z79ykp3nwbvlhhi7bp2h";
+  version = "1.0.20";
+  sha256 = "11qc02fkmrpy6c1a85lwlz06m4fpvfpbpbxgv5rkyb1amg2cnklq";
   meta = {
     homepage = "http://bitbucket.org/mauricio/bindings-dsl";
     description = "FFI domain specific language, on top of hsc2hs";
diff --git a/pkgs/development/libraries/haskell/bindings-libusb/default.nix b/pkgs/development/libraries/haskell/bindings-libusb/default.nix
new file mode 100644
index 00000000000..aeea654577a
--- /dev/null
+++ b/pkgs/development/libraries/haskell/bindings-libusb/default.nix
@@ -0,0 +1,15 @@
+{ cabal, bindingsDSL, libusb }:
+
+cabal.mkDerivation (self: {
+  pname = "bindings-libusb";
+  version = "1.4.4.1";
+  sha256 = "1cip5a0n8svjkzawpx3wi9z7nywmn9bl3k2w559b3awy0wixybrx";
+  buildDepends = [ bindingsDSL ];
+  pkgconfigDepends = [ libusb ];
+  meta = {
+    homepage = "https://github.com/basvandijk/bindings-libusb";
+    description = "Low level bindings to libusb";
+    license = self.stdenv.lib.licenses.bsd3;
+    platforms = self.ghc.meta.platforms;
+  };
+})
diff --git a/pkgs/development/libraries/haskell/charset/default.nix b/pkgs/development/libraries/haskell/charset/default.nix
index 9aee9b97afe..829c35b7563 100644
--- a/pkgs/development/libraries/haskell/charset/default.nix
+++ b/pkgs/development/libraries/haskell/charset/default.nix
@@ -2,8 +2,8 @@
 
 cabal.mkDerivation (self: {
   pname = "charset";
-  version = "0.3.5";
-  sha256 = "0842jdqg7hipgkvax3p4cb2y3znsgcmbj9nfrg2448dg2nanlhsn";
+  version = "0.3.5.1";
+  sha256 = "0bf9s5r2j9bkwmjxzvj5c2c7bhnf5gyh2kkx67lmy8xqalfxgmwn";
   buildDepends = [ semigroups unorderedContainers ];
   meta = {
     homepage = "http://github.com/ekmett/charset";
diff --git a/pkgs/development/libraries/haskell/clock/default.nix b/pkgs/development/libraries/haskell/clock/default.nix
new file mode 100644
index 00000000000..65bfffec52e
--- /dev/null
+++ b/pkgs/development/libraries/haskell/clock/default.nix
@@ -0,0 +1,13 @@
+{ cabal }:
+
+cabal.mkDerivation (self: {
+  pname = "clock";
+  version = "0.4.0.1";
+  sha256 = "1bn6dalank30l680iifyam0mg9izxbyscgq0vmr1aw5brba5kv6j";
+  meta = {
+    homepage = "http://corsis.github.com/clock/";
+    description = "High-resolution clock functions: monotonic, realtime, cputime";
+    license = self.stdenv.lib.licenses.bsd3;
+    platforms = self.ghc.meta.platforms;
+  };
+})
diff --git a/pkgs/development/libraries/haskell/comonad-transformers/default.nix b/pkgs/development/libraries/haskell/comonad-transformers/default.nix
index ef0ffe06198..943a0718e03 100644
--- a/pkgs/development/libraries/haskell/comonad-transformers/default.nix
+++ b/pkgs/development/libraries/haskell/comonad-transformers/default.nix
@@ -1,19 +1,16 @@
-{ cabal, comonad, contravariant, distributive, semigroupoids
-, semigroups, transformers
-}:
+{ cabal, comonad }:
 
 cabal.mkDerivation (self: {
   pname = "comonad-transformers";
-  version = "3.1";
-  sha256 = "024l437xfi0bkbn3121xi8slwsh9jby9a92qg1m5y0nmxzs9lxda";
-  buildDepends = [
-    comonad contravariant distributive semigroupoids semigroups
-    transformers
-  ];
+  version = "4.0";
+  sha256 = "13zzp6r6s6c80skniphwvzxhpazbyal5854m53139kgcw560rv6z";
+  buildDepends = [ comonad ];
+  noHaddock = true;
   meta = {
     homepage = "http://github.com/ekmett/comonad-transformers/";
-    description = "Comonad transformers";
+    description = "This package has been merged into comonad 4.0";
     license = self.stdenv.lib.licenses.bsd3;
     platforms = self.ghc.meta.platforms;
+    maintainers = [ self.stdenv.lib.maintainers.ocharles ];
   };
 })
diff --git a/pkgs/development/libraries/haskell/comonad/default.nix b/pkgs/development/libraries/haskell/comonad/default.nix
index 472e4e315c1..9457a2ad44d 100644
--- a/pkgs/development/libraries/haskell/comonad/default.nix
+++ b/pkgs/development/libraries/haskell/comonad/default.nix
@@ -1,14 +1,18 @@
-{ cabal, doctest, filepath, semigroups, tagged, transformers }:
+{ cabal, contravariant, distributive, doctest, filepath, mtl
+, semigroups, tagged, transformers
+}:
 
 cabal.mkDerivation (self: {
   pname = "comonad";
-  version = "3.1";
-  sha256 = "0sl9b3f1vwpjdvnrxv7b8n512w05pv4in6qx3l4sbksdp1zjvcyv";
-  buildDepends = [ semigroups tagged transformers ];
+  version = "4.0";
+  sha256 = "1f57wqxy1la59kippbj924prnj53a5hwc2ppg48n9xx2wfr63iha";
+  buildDepends = [
+    contravariant distributive mtl semigroups tagged transformers
+  ];
   testDepends = [ doctest filepath ];
   meta = {
     homepage = "http://github.com/ekmett/comonad/";
-    description = "Haskell 98 compatible comonads";
+    description = "Comonads";
     license = self.stdenv.lib.licenses.bsd3;
     platforms = self.ghc.meta.platforms;
   };
diff --git a/pkgs/development/libraries/haskell/comonads-fd/default.nix b/pkgs/development/libraries/haskell/comonads-fd/default.nix
index aac28ff0871..f55123f8fe1 100644
--- a/pkgs/development/libraries/haskell/comonads-fd/default.nix
+++ b/pkgs/development/libraries/haskell/comonads-fd/default.nix
@@ -1,17 +1,14 @@
-{ cabal, comonad, comonadTransformers, mtl, semigroups
-, transformers
-}:
+{ cabal, comonad }:
 
 cabal.mkDerivation (self: {
   pname = "comonads-fd";
-  version = "3.0.3";
-  sha256 = "06x545yq5xc3kphjipkgjrgrfvvkjpy0wji9d5fw44ca91nzglww";
-  buildDepends = [
-    comonad comonadTransformers mtl semigroups transformers
-  ];
+  version = "4.0";
+  sha256 = "19xpv0dsz7w3a1sq1gdxwzglfal45vj2s22zb12g9mpk5rp3hw1s";
+  buildDepends = [ comonad ];
+  noHaddock = true;
   meta = {
     homepage = "http://github.com/ekmett/comonads-fd/";
-    description = "Comonad transformers using functional dependencies";
+    description = "This package has been merged into comonad 4.0";
     license = self.stdenv.lib.licenses.bsd3;
     platforms = self.ghc.meta.platforms;
   };
diff --git a/pkgs/development/libraries/haskell/conduit/default.nix b/pkgs/development/libraries/haskell/conduit/default.nix
index 0e1757f7b50..ab41f5a5621 100644
--- a/pkgs/development/libraries/haskell/conduit/default.nix
+++ b/pkgs/development/libraries/haskell/conduit/default.nix
@@ -4,8 +4,8 @@
 
 cabal.mkDerivation (self: {
   pname = "conduit";
-  version = "1.0.7.4";
-  sha256 = "1bvi9gw9sfi1fml339rn3cfq4i3yd9j9vw41p5cpz5pnv3gw225x";
+  version = "1.0.8";
+  sha256 = "0qsi9p7hwzaw1ridgydfmaagjjpkbgq755b1r9xm4apdy6fikcz5";
   buildDepends = [
     liftedBase mmorph monadControl mtl resourcet text transformers
     transformersBase void
diff --git a/pkgs/development/libraries/haskell/connection/default.nix b/pkgs/development/libraries/haskell/connection/default.nix
new file mode 100644
index 00000000000..a7930cab08b
--- /dev/null
+++ b/pkgs/development/libraries/haskell/connection/default.nix
@@ -0,0 +1,18 @@
+{ cabal, certificate, cprngAes, dataDefault, network, socks, tls
+, tlsExtra
+}:
+
+cabal.mkDerivation (self: {
+  pname = "connection";
+  version = "0.1.3";
+  sha256 = "13bwlbga612kc7g3m3rrdzbdv4w0glp4af9r6crwgjsmxgimrgs9";
+  buildDepends = [
+    certificate cprngAes dataDefault network socks tls tlsExtra
+  ];
+  meta = {
+    homepage = "http://github.com/vincenthz/hs-connection";
+    description = "Simple and easy network connections API";
+    license = self.stdenv.lib.licenses.bsd3;
+    platforms = self.ghc.meta.platforms;
+  };
+})
diff --git a/pkgs/development/libraries/haskell/constraints/default.nix b/pkgs/development/libraries/haskell/constraints/default.nix
index 87ec5d82724..e57b4e6c085 100644
--- a/pkgs/development/libraries/haskell/constraints/default.nix
+++ b/pkgs/development/libraries/haskell/constraints/default.nix
@@ -2,8 +2,8 @@
 
 cabal.mkDerivation (self: {
   pname = "constraints";
-  version = "0.3.3";
-  sha256 = "0mglqd6l6bc333i7gymbm8q037hj5fny6jzyg1zmw5kg6r3xcwdi";
+  version = "0.3.4.1";
+  sha256 = "13jxh2cgcfyiqhx7j5063k8k60wz9h4hd5lf2mw2skbcryg6csmb";
   buildDepends = [ newtype ];
   meta = {
     homepage = "http://github.com/ekmett/constraints/";
diff --git a/pkgs/development/libraries/haskell/cryptohash/default.nix b/pkgs/development/libraries/haskell/cryptohash/default.nix
index 5ad655eb613..839bf4518a1 100644
--- a/pkgs/development/libraries/haskell/cryptohash/default.nix
+++ b/pkgs/development/libraries/haskell/cryptohash/default.nix
@@ -4,14 +4,13 @@
 
 cabal.mkDerivation (self: {
   pname = "cryptohash";
-  version = "0.11.0";
-  sha256 = "03v85lb866lbyd0bykjihiqf948asbgxp3c1dzpjc9mvg22pbmlg";
+  version = "0.11.1";
+  sha256 = "0ww7bikl8i50m1pwkqp145bfsiy07npnjw48j3il4w2ia0b3axmy";
   buildDepends = [ byteable ];
   testDepends = [
     byteable HUnit QuickCheck testFramework testFrameworkHunit
     testFrameworkQuickcheck2
   ];
-  doCheck = false;
   meta = {
     homepage = "http://github.com/vincenthz/hs-cryptohash";
     description = "collection of crypto hashes, fast, pure and practical";
diff --git a/pkgs/development/libraries/haskell/data-pprint/default.nix b/pkgs/development/libraries/haskell/data-pprint/default.nix
index e6a8e59853d..351f1d83477 100644
--- a/pkgs/development/libraries/haskell/data-pprint/default.nix
+++ b/pkgs/development/libraries/haskell/data-pprint/default.nix
@@ -1,10 +1,15 @@
-{ cabal, deepseq, mtl, parallel, time }:
+{ cabal, deepseq, mtl, parallel, time, fetchurl }:
 
 cabal.mkDerivation (self: {
   pname = "data-pprint";
   version = "0.2.2";
   sha256 = "0cr69qv2j8fmmlir8rzlafcxk1cg3lg1z0zrwkz0lb7idm25fy36";
   buildDepends = [ deepseq mtl parallel time ];
+  patches = [ (fetchurl { url = "https://github.com/divipp/ActiveHs-misc/pull/3.patch";
+                          sha256 = "0wxvc7cbv4qpjl5zxy41863qpzda2ma75pmnnqx29qyh3rxp7biw";
+                        })
+            ];
+  patchFlags = "-p2";
   meta = {
     description = "Prettyprint and compare Data values";
     license = self.stdenv.lib.licenses.bsd3;
diff --git a/pkgs/development/libraries/haskell/datetime/default.nix b/pkgs/development/libraries/haskell/datetime/default.nix
index 669bace3366..faf0b40b94d 100644
--- a/pkgs/development/libraries/haskell/datetime/default.nix
+++ b/pkgs/development/libraries/haskell/datetime/default.nix
@@ -7,7 +7,7 @@ cabal.mkDerivation (self: {
   buildDepends = [ QuickCheck time ];
   meta = {
     homepage = "http://github.com/esessoms/datetime";
-    description = "Utilities to make Data.Time.* easier to use";
+    description = "Utilities to make Data.Time.* easier to use.";
     license = "GPL";
     platforms = self.ghc.meta.platforms;
     maintainers = [ self.stdenv.lib.maintainers.andres ];
diff --git a/pkgs/development/libraries/haskell/distributive/default.nix b/pkgs/development/libraries/haskell/distributive/default.nix
index d40952024ef..d03257f54d3 100644
--- a/pkgs/development/libraries/haskell/distributive/default.nix
+++ b/pkgs/development/libraries/haskell/distributive/default.nix
@@ -2,8 +2,8 @@
 
 cabal.mkDerivation (self: {
   pname = "distributive";
-  version = "0.3.1";
-  sha256 = "0zf3wq1xz9sbb0g6fg852jckrwkffsfkghq3zx03d2q9ginc6jbc";
+  version = "0.3.2";
+  sha256 = "1n2xnjffrbfw736qn9w5fxy4pjl2319yhimkglhbayq85pz51r1h";
   buildDepends = [ transformers transformersCompat ];
   testDepends = [ doctest filepath ];
   meta = {
diff --git a/pkgs/development/libraries/haskell/dotgen/default.nix b/pkgs/development/libraries/haskell/dotgen/default.nix
index f56db8f8c5f..a7fe5b791f0 100644
--- a/pkgs/development/libraries/haskell/dotgen/default.nix
+++ b/pkgs/development/libraries/haskell/dotgen/default.nix
@@ -7,7 +7,7 @@ cabal.mkDerivation (self: {
   isLibrary = true;
   isExecutable = true;
   meta = {
-    description = "A simple interface for building .dot graph files";
+    description = "A simple interface for building .dot graph files.";
     license = self.stdenv.lib.licenses.bsd3;
     platforms = self.ghc.meta.platforms;
     maintainers = [ self.stdenv.lib.maintainers.andres ];
diff --git a/pkgs/development/libraries/haskell/either/default.nix b/pkgs/development/libraries/haskell/either/default.nix
index 67c1962cbe9..93dfd043c90 100644
--- a/pkgs/development/libraries/haskell/either/default.nix
+++ b/pkgs/development/libraries/haskell/either/default.nix
@@ -3,8 +3,8 @@
 
 cabal.mkDerivation (self: {
   pname = "either";
-  version = "3.4.1";
-  sha256 = "1cq4glqhxz9k8fxf0dc8b6hcxxfn4yci6h7wmfkmkfq5ca61ax1b";
+  version = "4.0";
+  sha256 = "07axaq43cqyglndr5az7ns4mvkjmybq6z8s32l1jxc5x7532scwr";
   buildDepends = [
     MonadRandom mtl semigroupoids semigroups transformers
   ];
diff --git a/pkgs/development/libraries/haskell/entropy/default.nix b/pkgs/development/libraries/haskell/entropy/default.nix
index 17409f05eed..f2154ddddf7 100644
--- a/pkgs/development/libraries/haskell/entropy/default.nix
+++ b/pkgs/development/libraries/haskell/entropy/default.nix
@@ -2,8 +2,8 @@
 
 cabal.mkDerivation (self: {
   pname = "entropy";
-  version = "0.2.2.2";
-  sha256 = "1xkpfi6njj5iqwn5wa6npyzxksj9hr0xqbxrslg646whxrkd8718";
+  version = "0.2.2.4";
+  sha256 = "1cjmpb0rh1ib4j9mwmf1irn401vmjawxkshxdmmb4643rmcgx1gm";
   meta = {
     homepage = "https://github.com/TomMD/entropy";
     description = "A platform independent entropy source";
diff --git a/pkgs/development/libraries/haskell/enumerator/default.nix b/pkgs/development/libraries/haskell/enumerator/default.nix
index 5b44c9efc62..4dfa4e573dd 100644
--- a/pkgs/development/libraries/haskell/enumerator/default.nix
+++ b/pkgs/development/libraries/haskell/enumerator/default.nix
@@ -2,8 +2,8 @@
 
 cabal.mkDerivation (self: {
   pname = "enumerator";
-  version = "0.4.19";
-  sha256 = "1avxy55vbvkz6yj512bkb2b986y3m0b28c9c5lfc3wd2na7w1s5g";
+  version = "0.4.20";
+  sha256 = "02a75dggj295zkhgjry5cb43s6y6ydpjb5w6vgl7kd9b6ma11qik";
   buildDepends = [ text transformers ];
   meta = {
     homepage = "https://john-millikin.com/software/enumerator/";
diff --git a/pkgs/development/libraries/haskell/errors/default.nix b/pkgs/development/libraries/haskell/errors/default.nix
index d15ac59feba..1b0bc4282a7 100644
--- a/pkgs/development/libraries/haskell/errors/default.nix
+++ b/pkgs/development/libraries/haskell/errors/default.nix
@@ -2,9 +2,10 @@
 
 cabal.mkDerivation (self: {
   pname = "errors";
-  version = "1.4.2";
-  sha256 = "1csry8bbz7r4gc7x3lf1ih10rvnig2i91nfij227p9744yndl2xw";
+  version = "1.4.3";
+  sha256 = "02xvfh0kfca7z5vhnkmqg5gw5i5ad5bc3jf8flxj75ry7wqggfmm";
   buildDepends = [ either safe transformers ];
+  jailbreak = true;
   meta = {
     description = "Simplified error-handling";
     license = self.stdenv.lib.licenses.bsd3;
diff --git a/pkgs/development/libraries/haskell/feed/default.nix b/pkgs/development/libraries/haskell/feed/default.nix
index ec4251d7cb1..a2c1ccde86b 100644
--- a/pkgs/development/libraries/haskell/feed/default.nix
+++ b/pkgs/development/libraries/haskell/feed/default.nix
@@ -7,7 +7,7 @@ cabal.mkDerivation (self: {
   buildDepends = [ utf8String xml ];
   meta = {
     homepage = "https://github.com/sof/feed";
-    description = "Interfacing with RSS (v 0.9x, 2.x, 1.0) + Atom feeds";
+    description = "Interfacing with RSS (v 0.9x, 2.x, 1.0) + Atom feeds.";
     license = self.stdenv.lib.licenses.bsd3;
     platforms = self.ghc.meta.platforms;
     maintainers = [ self.stdenv.lib.maintainers.andres ];
diff --git a/pkgs/development/libraries/haskell/file-embed/default.nix b/pkgs/development/libraries/haskell/file-embed/default.nix
index 2eb9ac94d8c..3d7015d7ec2 100644
--- a/pkgs/development/libraries/haskell/file-embed/default.nix
+++ b/pkgs/development/libraries/haskell/file-embed/default.nix
@@ -2,8 +2,8 @@
 
 cabal.mkDerivation (self: {
   pname = "file-embed";
-  version = "0.0.4.9";
-  sha256 = "128z3jwxn6d13dkrfjx7maxgmax8bfgr8n2jfhqg3rvv4ryjnqv2";
+  version = "0.0.5";
+  sha256 = "0s77g7azw73f7d07hvwwps8sx79jpwj8ap9iqzcglyjw1sw4l1n1";
   buildDepends = [ filepath ];
   testDepends = [ filepath HUnit ];
   meta = {
diff --git a/pkgs/development/libraries/haskell/free/default.nix b/pkgs/development/libraries/haskell/free/default.nix
index 56bf80d71af..64d9541f401 100644
--- a/pkgs/development/libraries/haskell/free/default.nix
+++ b/pkgs/development/libraries/haskell/free/default.nix
@@ -1,15 +1,14 @@
-{ cabal, bifunctors, comonad, comonadsFd, comonadTransformers
-, distributive, mtl, profunctors, semigroupoids, semigroups
-, transformers
+{ cabal, bifunctors, comonad, distributive, mtl, profunctors
+, semigroupoids, semigroups, transformers
 }:
 
 cabal.mkDerivation (self: {
   pname = "free";
-  version = "3.4.2";
-  sha256 = "1x6pdkcxk6z9ndph2yzz5n21afc2330m0ryv4w67jsss5aa69fwb";
+  version = "4.1";
+  sha256 = "16951r4f7ggvcw2qgjwdrmaxxnrmrm69c67nixs77lm1d31nks4w";
   buildDepends = [
-    bifunctors comonad comonadsFd comonadTransformers distributive mtl
-    profunctors semigroupoids semigroups transformers
+    bifunctors comonad distributive mtl profunctors semigroupoids
+    semigroups transformers
   ];
   meta = {
     homepage = "http://github.com/ekmett/free/";
diff --git a/pkgs/development/libraries/haskell/groupoids/default.nix b/pkgs/development/libraries/haskell/groupoids/default.nix
index 4c085c0ae23..7697e8e369f 100644
--- a/pkgs/development/libraries/haskell/groupoids/default.nix
+++ b/pkgs/development/libraries/haskell/groupoids/default.nix
@@ -2,12 +2,13 @@
 
 cabal.mkDerivation (self: {
   pname = "groupoids";
-  version = "3.0.1.1";
-  sha256 = "0r4xjyq7icd52nas27bhr5k8q7li6lba8mlkcipghhsgxsyjfp63";
+  version = "4.0";
+  sha256 = "08la44c19pz2clws5mb939zc1d17cb6qy9qlh2n1634pl0zrawb6";
   buildDepends = [ semigroupoids ];
+  noHaddock = true;
   meta = {
     homepage = "http://github.com/ekmett/groupoids/";
-    description = "Haskell 98 Groupoids";
+    description = "This package has been absorbed into semigroupoids 4.0";
     license = self.stdenv.lib.licenses.bsd3;
     platforms = self.ghc.meta.platforms;
   };
diff --git a/pkgs/development/libraries/haskell/hakyll/default.nix b/pkgs/development/libraries/haskell/hakyll/default.nix
index 9ee06ec5326..22cdf149ef7 100644
--- a/pkgs/development/libraries/haskell/hakyll/default.nix
+++ b/pkgs/development/libraries/haskell/hakyll/default.nix
@@ -8,8 +8,8 @@
 
 cabal.mkDerivation (self: {
   pname = "hakyll";
-  version = "4.4.1.0";
-  sha256 = "17bns61l5d0h8qyhbz5gnc4j9yjjajk57whp0j4gfshaq0s2aif9";
+  version = "4.4.1.2";
+  sha256 = "0rbl0gl5ds63mv8cbcwb8aj0vic9padqs3zrdxr2ny70md1v9m9y";
   isLibrary = true;
   isExecutable = true;
   buildDepends = [
@@ -25,9 +25,6 @@ cabal.mkDerivation (self: {
     snapCore snapServer systemFilepath tagsoup testFramework
     testFrameworkHunit testFrameworkQuickcheck2 text time
   ];
-  postPatch = ''
-    sed -i -e 's|cryptohash.*,|cryptohash,|' -e 's|tagsoup.*,|tagsoup,|' hakyll.cabal
-  '';
   doCheck = false;
   meta = {
     homepage = "http://jaspervdj.be/hakyll";
diff --git a/pkgs/development/libraries/haskell/hamlet/default.nix b/pkgs/development/libraries/haskell/hamlet/default.nix
index c29672767a6..b40025ff716 100644
--- a/pkgs/development/libraries/haskell/hamlet/default.nix
+++ b/pkgs/development/libraries/haskell/hamlet/default.nix
@@ -4,8 +4,8 @@
 
 cabal.mkDerivation (self: {
   pname = "hamlet";
-  version = "1.1.7.2";
-  sha256 = "1pfpygbabfmgx01vjkxhf3p9map2v7x8jys06jd6qgc4j90dnk1c";
+  version = "1.1.7.3";
+  sha256 = "0532gf4xdbjxjpv7gsfv0bapnnb4g81jcfzkn71nwizi8zls3qck";
   buildDepends = [
     blazeBuilder blazeHtml blazeMarkup failure parsec shakespeare text
   ];
diff --git a/pkgs/development/libraries/haskell/hashtables/default.nix b/pkgs/development/libraries/haskell/hashtables/default.nix
index 4fdff950809..ca0e2e529c5 100644
--- a/pkgs/development/libraries/haskell/hashtables/default.nix
+++ b/pkgs/development/libraries/haskell/hashtables/default.nix
@@ -2,8 +2,8 @@
 
 cabal.mkDerivation (self: {
   pname = "hashtables";
-  version = "1.1.2.0";
-  sha256 = "1q0nzsc4x317r7b93b4sj4yfpsdjmqkvc54q62n56kgq9cy4y7qh";
+  version = "1.1.2.1";
+  sha256 = "1166baqalpp9v735821drjvyasr44p4znbcs7njyr09fx87r23f5";
   buildDepends = [ hashable primitive vector ];
   meta = {
     homepage = "http://github.com/gregorycollins/hashtables";
diff --git a/pkgs/development/libraries/haskell/haskell-src-meta/default.nix b/pkgs/development/libraries/haskell/haskell-src-meta/default.nix
index 7c9e7694046..6ce8f9e72ba 100644
--- a/pkgs/development/libraries/haskell/haskell-src-meta/default.nix
+++ b/pkgs/development/libraries/haskell/haskell-src-meta/default.nix
@@ -2,8 +2,8 @@
 
 cabal.mkDerivation (self: {
   pname = "haskell-src-meta";
-  version = "0.6.0.3";
-  sha256 = "1ag26pzppvqw9ch6jz1p0bhsld7fz0b01k7h9516hnmy215h7xai";
+  version = "0.6.0.4";
+  sha256 = "10dixf2abk0canwikf3wdp1ahc51400wxa7x4g59pygv8a3c1c1x";
   buildDepends = [ haskellSrcExts syb thOrphans uniplate ];
   jailbreak = true;
   meta = {
diff --git a/pkgs/development/libraries/haskell/haxr/default.nix b/pkgs/development/libraries/haskell/haxr/default.nix
index a5aaf44c392..26ebbb9f8b0 100644
--- a/pkgs/development/libraries/haskell/haxr/default.nix
+++ b/pkgs/development/libraries/haskell/haxr/default.nix
@@ -4,8 +4,8 @@
 
 cabal.mkDerivation (self: {
   pname = "haxr";
-  version = "3000.9.3";
-  sha256 = "1jg7abgbykxjjpmakmfm6zcwxn0hf9q53430ibr4m9n6alh7nglq";
+  version = "3000.10.1.1";
+  sha256 = "0qvbl3bms2mf650w9j3r0pnl151vzkggy2if3f4rj34qwb2sxmvp";
   buildDepends = [
     base64Bytestring blazeBuilder HaXml HTTP mtl network time
     utf8String
diff --git a/pkgs/development/libraries/haskell/heist/default.nix b/pkgs/development/libraries/haskell/heist/default.nix
index c39a1fc24a8..b8f709a402c 100644
--- a/pkgs/development/libraries/haskell/heist/default.nix
+++ b/pkgs/development/libraries/haskell/heist/default.nix
@@ -6,8 +6,8 @@
 
 cabal.mkDerivation (self: {
   pname = "heist";
-  version = "0.13.0.1";
-  sha256 = "1hxf131xhvsqbvmrm8wbjpndy41pz1lq65gqlk3lxr57dhi59s4w";
+  version = "0.13.0.2";
+  sha256 = "0rbzizgrvwj505dk7qyc9ky5vwyaxyj91xz1dsv0mv7cjl9pp17n";
   buildDepends = [
     aeson attoparsec blazeBuilder blazeHtml directoryTree dlist errors
     filepath hashable MonadCatchIOTransformers mtl random text time
diff --git a/pkgs/development/libraries/haskell/hoauth/default.nix b/pkgs/development/libraries/haskell/hoauth/default.nix
index 0486ee72f3b..c568b292c3c 100644
--- a/pkgs/development/libraries/haskell/hoauth/default.nix
+++ b/pkgs/development/libraries/haskell/hoauth/default.nix
@@ -11,7 +11,7 @@ cabal.mkDerivation (self: {
     time utf8String
   ];
   meta = {
-    description = "A Haskell implementation of OAuth 1.0a protocol";
+    description = "A Haskell implementation of OAuth 1.0a protocol.";
     license = self.stdenv.lib.licenses.bsd3;
     platforms = self.ghc.meta.platforms;
     maintainers = [ self.stdenv.lib.maintainers.andres ];
diff --git a/pkgs/development/libraries/haskell/hsyslog/default.nix b/pkgs/development/libraries/haskell/hsyslog/default.nix
index 2a531875e0b..3f475425659 100644
--- a/pkgs/development/libraries/haskell/hsyslog/default.nix
+++ b/pkgs/development/libraries/haskell/hsyslog/default.nix
@@ -6,7 +6,7 @@ cabal.mkDerivation (self: {
   sha256 = "1dpcawnl3a5lw2w8gc9920sjrw43qmq1k2zws8rx2q0r6ps7nhgp";
   meta = {
     homepage = "http://github.com/peti/hsyslog";
-    description = "FFI interface to syslog(3) from POSIX.1-2001";
+    description = "FFI interface to syslog(3) from POSIX.1-2001.";
     license = self.stdenv.lib.licenses.bsd3;
     platforms = self.ghc.meta.platforms;
     maintainers = [
diff --git a/pkgs/development/libraries/haskell/http-types/default.nix b/pkgs/development/libraries/haskell/http-types/default.nix
index b0b68eec434..c099709e0da 100644
--- a/pkgs/development/libraries/haskell/http-types/default.nix
+++ b/pkgs/development/libraries/haskell/http-types/default.nix
@@ -2,8 +2,8 @@
 
 cabal.mkDerivation (self: {
   pname = "http-types";
-  version = "0.8.1";
-  sha256 = "07hxxlhgnwsvjr2dzqbswwwkjxwsc0pk6shpkvzgclrsyn3xrg7p";
+  version = "0.8.2";
+  sha256 = "1536wpmicmq90qvnvcvq1dzk2vfhj7ls6hz4pqp0ll9aksk3msr1";
   buildDepends = [ blazeBuilder caseInsensitive text ];
   testDepends = [ blazeBuilder hspec QuickCheck text ];
   meta = {
diff --git a/pkgs/development/libraries/haskell/intervals/default.nix b/pkgs/development/libraries/haskell/intervals/default.nix
index 3cc44b05dbb..9a270574570 100644
--- a/pkgs/development/libraries/haskell/intervals/default.nix
+++ b/pkgs/development/libraries/haskell/intervals/default.nix
@@ -2,8 +2,8 @@
 
 cabal.mkDerivation (self: {
   pname = "intervals";
-  version = "0.2.2";
-  sha256 = "059xmk373xz6nwk61iyhx4d7xd328jxb694qmq9plry3k77mdh5q";
+  version = "0.2.2.1";
+  sha256 = "0kbsms3742ppmzbmrfp94aq4wvwrayx5ppsyk7pd1mj7y47aay0f";
   buildDepends = [ numericExtras ];
   meta = {
     homepage = "http://github.com/ekmett/intervals";
diff --git a/pkgs/development/libraries/haskell/keys/default.nix b/pkgs/development/libraries/haskell/keys/default.nix
index 80a61b5b5be..b657f3dd6b9 100644
--- a/pkgs/development/libraries/haskell/keys/default.nix
+++ b/pkgs/development/libraries/haskell/keys/default.nix
@@ -1,14 +1,11 @@
-{ cabal, comonadsFd, comonadTransformers, free, semigroupoids
-, semigroups, transformers
-}:
+{ cabal, comonad, free, semigroupoids, semigroups, transformers }:
 
 cabal.mkDerivation (self: {
   pname = "keys";
-  version = "3.0.3";
-  sha256 = "1fqw0745pj8pzjjlrbg85gdr3acm7gpip5052m9wcz997949ca3r";
+  version = "3.10";
+  sha256 = "1s2xkzvaqk507wrgabpxli8g8n83arflmdhxq40f7qkvyflhhmyh";
   buildDepends = [
-    comonadsFd comonadTransformers free semigroupoids semigroups
-    transformers
+    comonad free semigroupoids semigroups transformers
   ];
   meta = {
     homepage = "http://github.com/ekmett/keys/";
diff --git a/pkgs/development/libraries/haskell/lens/default.nix b/pkgs/development/libraries/haskell/lens/default.nix
index cdccc4768e0..60aa29ac089 100644
--- a/pkgs/development/libraries/haskell/lens/default.nix
+++ b/pkgs/development/libraries/haskell/lens/default.nix
@@ -1,23 +1,21 @@
-{ cabal, bifunctors, comonad, comonadsFd, comonadTransformers
-, contravariant, deepseq, distributive, doctest, filepath
-, genericDeriving, hashable, HUnit, MonadCatchIOTransformers, mtl
-, nats, parallel, profunctorExtras, profunctors, QuickCheck
-, reflection, semigroupoids, semigroups, simpleReflect, split
-, tagged, testFramework, testFrameworkHunit
+{ cabal, bifunctors, comonad, contravariant, deepseq, distributive
+, doctest, filepath, genericDeriving, hashable, HUnit
+, MonadCatchIOTransformers, mtl, nats, parallel, profunctors
+, QuickCheck, reflection, semigroupoids, semigroups, simpleReflect
+, split, tagged, testFramework, testFrameworkHunit
 , testFrameworkQuickcheck2, testFrameworkTh, text, transformers
 , transformersCompat, unorderedContainers, vector, void
 }:
 
 cabal.mkDerivation (self: {
   pname = "lens";
-  version = "3.9.2";
-  sha256 = "17pc0waf3g6dxvmvyxkgh8kz22iscd9z00s67rcn0p604swprj2k";
+  version = "3.10";
+  sha256 = "086kbd59zlx3ldrxilssxd0gr9izwhcfhg5k6bqzm6gwvysrzq3y";
   buildDepends = [
-    bifunctors comonad comonadsFd comonadTransformers contravariant
-    distributive filepath genericDeriving hashable
-    MonadCatchIOTransformers mtl parallel profunctorExtras profunctors
-    reflection semigroupoids semigroups split tagged text transformers
-    transformersCompat unorderedContainers vector void
+    bifunctors comonad contravariant distributive filepath
+    genericDeriving hashable MonadCatchIOTransformers mtl parallel
+    profunctors reflection semigroupoids semigroups split tagged text
+    transformers transformersCompat unorderedContainers vector void
   ];
   testDepends = [
     deepseq doctest filepath genericDeriving HUnit mtl nats parallel
diff --git a/pkgs/development/libraries/haskell/monoid-extras/default.nix b/pkgs/development/libraries/haskell/monoid-extras/default.nix
index e9c8691a8ce..8eb61453f9c 100644
--- a/pkgs/development/libraries/haskell/monoid-extras/default.nix
+++ b/pkgs/development/libraries/haskell/monoid-extras/default.nix
@@ -2,8 +2,8 @@
 
 cabal.mkDerivation (self: {
   pname = "monoid-extras";
-  version = "0.3.2.2";
-  sha256 = "1fy0fk2mzan6n5chc11x303hz3iq3kpx6ma6c8xsi8va1b9ikpda";
+  version = "0.3.2.3";
+  sha256 = "1q7aw4adg082rszkc3skdvidcn86n06xvr3x8qarpjb285znsmc4";
   buildDepends = [ groupoids groups semigroupoids semigroups ];
   jailbreak = true;
   meta = {
diff --git a/pkgs/development/libraries/haskell/mwc-random/default.nix b/pkgs/development/libraries/haskell/mwc-random/default.nix
index 2d6b846e706..d26980994e7 100644
--- a/pkgs/development/libraries/haskell/mwc-random/default.nix
+++ b/pkgs/development/libraries/haskell/mwc-random/default.nix
@@ -4,8 +4,8 @@
 
 cabal.mkDerivation (self: {
   pname = "mwc-random";
-  version = "0.13.0.0";
-  sha256 = "16f8dd81wj81h0jcqnrlr2d6mjc7q2r436qf8z320d6wpzih2djy";
+  version = "0.13.1.0";
+  sha256 = "16g6b1pphr4p36nn5qjj62iwf47rq8kfmpjgfvd35r3cz9qqb8cb";
   buildDepends = [ primitive time vector ];
   testDepends = [
     HUnit QuickCheck statistics testFramework testFrameworkHunit
diff --git a/pkgs/development/libraries/haskell/network-conduit-tls/default.nix b/pkgs/development/libraries/haskell/network-conduit-tls/default.nix
index bfb96e30480..415c047a2f5 100644
--- a/pkgs/development/libraries/haskell/network-conduit-tls/default.nix
+++ b/pkgs/development/libraries/haskell/network-conduit-tls/default.nix
@@ -1,16 +1,17 @@
-{ cabal, aeson, certificate, conduit, cprngAes, cryptoApi
-, cryptoRandomApi, network, networkConduit, pem, systemFileio
-, systemFilepath, tls, tlsExtra, transformers
+{ cabal, aeson, certificate, conduit, connection, cprngAes
+, cryptoApi, cryptoRandomApi, dataDefault, monadControl, network
+, networkConduit, pem, systemFileio, systemFilepath, tls, tlsExtra
+, transformers
 }:
 
 cabal.mkDerivation (self: {
   pname = "network-conduit-tls";
-  version = "1.0.1.1";
-  sha256 = "0v5rspcjhd2vid5i74dy1sdcvci7dlr88sgr0v9vjp4gcyb29qlj";
+  version = "1.0.2";
+  sha256 = "0m3sbb4vpsjf568zaaxri8x7x46wngf5y2s5chgjzfmbj0amkl51";
   buildDepends = [
-    aeson certificate conduit cprngAes cryptoApi cryptoRandomApi
-    network networkConduit pem systemFileio systemFilepath tls tlsExtra
-    transformers
+    aeson certificate conduit connection cprngAes cryptoApi
+    cryptoRandomApi dataDefault monadControl network networkConduit pem
+    systemFileio systemFilepath tls tlsExtra transformers
   ];
   meta = {
     homepage = "https://github.com/snoyberg/conduit";
diff --git a/pkgs/development/libraries/haskell/numbers/default.nix b/pkgs/development/libraries/haskell/numbers/default.nix
index 81a3e866dc0..26ed2d77bd0 100644
--- a/pkgs/development/libraries/haskell/numbers/default.nix
+++ b/pkgs/development/libraries/haskell/numbers/default.nix
@@ -2,8 +2,8 @@
 
 cabal.mkDerivation (self: {
   pname = "numbers";
-  version = "3000.1.0.3";
-  sha256 = "0w2m2m3vp3lpvnc7wkw6pqfz741a68dma4s0asl7cryykwf94xgz";
+  version = "3000.2.0.0";
+  sha256 = "035qc7dgh4nd661z4mm742v8y7xqdyyp0r0vkinxiifciqb1fkbm";
   testDepends = [
     QuickCheck testFramework testFrameworkQuickcheck2
   ];
diff --git a/pkgs/development/libraries/haskell/optparse-applicative/default.nix b/pkgs/development/libraries/haskell/optparse-applicative/default.nix
index a3ab241b28c..6f7ef601d61 100644
--- a/pkgs/development/libraries/haskell/optparse-applicative/default.nix
+++ b/pkgs/development/libraries/haskell/optparse-applicative/default.nix
@@ -4,8 +4,8 @@
 
 cabal.mkDerivation (self: {
   pname = "optparse-applicative";
-  version = "0.5.2.1";
-  sha256 = "0w4mk851mx8dch8lnck0g82asmzrsc47xrf34jygh0f6v4kbj40i";
+  version = "0.7.0.2";
+  sha256 = "1pq620236x8fch9nkq4g4vganbzksnwj8z1bb80c2mwvf6sbg5ci";
   buildDepends = [ transformers ];
   testDepends = [
     HUnit testFramework testFrameworkHunit testFrameworkThPrime
diff --git a/pkgs/development/libraries/haskell/pandoc-citeproc/default.nix b/pkgs/development/libraries/haskell/pandoc-citeproc/default.nix
index 4ae06d59724..4960e16202e 100644
--- a/pkgs/development/libraries/haskell/pandoc-citeproc/default.nix
+++ b/pkgs/development/libraries/haskell/pandoc-citeproc/default.nix
@@ -1,19 +1,19 @@
 { cabal, aeson, aesonPretty, attoparsec, Diff, filepath, hexpat
 , hsBibutils, HTTP, json, mtl, network, pandoc, pandocTypes, parsec
-, rfc5051, syb, tagsoup, texmath, text, time, utf8String, vector
-, yaml
+, rfc5051, split, syb, tagsoup, texmath, text, time, utf8String
+, vector, yaml
 }:
 
 cabal.mkDerivation (self: {
   pname = "pandoc-citeproc";
-  version = "0.1.1.2";
-  sha256 = "02bs9wb3x1p9fs4kixchmvyyrhrkmx0qkwv22qmy4gsp90sc8q8i";
+  version = "0.1.2";
+  sha256 = "055msvrcqjkijkhzws48scpc4z90g0qjjsdcd0fhy309da6vax57";
   isLibrary = true;
   isExecutable = true;
   buildDepends = [
     aeson attoparsec filepath hexpat hsBibutils HTTP json mtl network
-    pandocTypes parsec rfc5051 syb tagsoup texmath text time utf8String
-    vector yaml
+    pandoc pandocTypes parsec rfc5051 split syb tagsoup texmath text
+    time utf8String vector yaml
   ];
   testDepends = [ aeson aesonPretty Diff pandoc pandocTypes ];
   doCheck = false;
diff --git a/pkgs/development/libraries/haskell/parsers/default.nix b/pkgs/development/libraries/haskell/parsers/default.nix
index dc42228df66..529fdf47124 100644
--- a/pkgs/development/libraries/haskell/parsers/default.nix
+++ b/pkgs/development/libraries/haskell/parsers/default.nix
@@ -1,12 +1,14 @@
-{ cabal, charset, doctest, filepath, text, transformers
+{ cabal, charset, doctest, filepath, parsec, text, transformers
 , unorderedContainers
 }:
 
 cabal.mkDerivation (self: {
   pname = "parsers";
-  version = "0.9";
-  sha256 = "04lbayvdv2hax4s9sqlnia7jpzv1sgls41ylql0xbi2zhz5rvyyi";
-  buildDepends = [ charset text transformers unorderedContainers ];
+  version = "0.10";
+  sha256 = "090dvmdb1kmnc3k2x170y9fdifxi16hzkij1gzc51flx3bpx40i1";
+  buildDepends = [
+    charset parsec text transformers unorderedContainers
+  ];
   testDepends = [ doctest filepath ];
   meta = {
     homepage = "http://github.com/ekmett/parsers/";
diff --git a/pkgs/development/libraries/haskell/persistent-template/default.nix b/pkgs/development/libraries/haskell/persistent-template/default.nix
index b9e0e72928f..c3bb228933d 100644
--- a/pkgs/development/libraries/haskell/persistent-template/default.nix
+++ b/pkgs/development/libraries/haskell/persistent-template/default.nix
@@ -1,14 +1,13 @@
 { cabal, aeson, hspec, monadControl, monadLogger, persistent
-, QuickCheck, text, thOrphans, transformers
+, QuickCheck, text, transformers
 }:
 
 cabal.mkDerivation (self: {
   pname = "persistent-template";
-  version = "1.2.0.3";
-  sha256 = "10scyrfa8g79v8ra79bp0bg7q6iwqjw6jpm06g11pngv4x9zx880";
+  version = "1.2.0.4";
+  sha256 = "0lhqv4mcai9r5mzj5h6fsd1hd8mv1458id0rb6q157192gywxhzf";
   buildDepends = [
-    aeson monadControl monadLogger persistent text thOrphans
-    transformers
+    aeson monadControl monadLogger persistent text transformers
   ];
   testDepends = [ aeson hspec persistent QuickCheck text ];
   meta = {
diff --git a/pkgs/development/libraries/haskell/pointed/default.nix b/pkgs/development/libraries/haskell/pointed/default.nix
index e3a8d66be4c..15f4ba59aaa 100644
--- a/pkgs/development/libraries/haskell/pointed/default.nix
+++ b/pkgs/development/libraries/haskell/pointed/default.nix
@@ -1,18 +1,18 @@
-{ cabal, comonad, comonadTransformers, dataDefault, semigroupoids
-, semigroups, stm, tagged, transformers
+{ cabal, comonad, dataDefaultClass, semigroupoids, semigroups, stm
+, tagged, transformers
 }:
 
 cabal.mkDerivation (self: {
   pname = "pointed";
-  version = "3.1";
-  sha256 = "13vx1vy3qfa23145fdfdivdmw01qyl2k6g8ynqxl8pzbj9cbb08n";
+  version = "4.0";
+  sha256 = "02y7ba1pcpmwcp762516p4x75y3ma2kml9mbiv1y8gcnn4ylvir4";
   buildDepends = [
-    comonad comonadTransformers dataDefault semigroupoids semigroups
-    stm tagged transformers
+    comonad dataDefaultClass semigroupoids semigroups stm tagged
+    transformers
   ];
   meta = {
     homepage = "http://github.com/ekmett/pointed/";
-    description = "Haskell 98 pointed and copointed data";
+    description = "Pointed and copointed data";
     license = self.stdenv.lib.licenses.bsd3;
     platforms = self.ghc.meta.platforms;
   };
diff --git a/pkgs/development/libraries/haskell/postgresql-simple/default.nix b/pkgs/development/libraries/haskell/postgresql-simple/default.nix
index 9f89ae83ec6..a6412006e8f 100644
--- a/pkgs/development/libraries/haskell/postgresql-simple/default.nix
+++ b/pkgs/development/libraries/haskell/postgresql-simple/default.nix
@@ -5,8 +5,8 @@
 
 cabal.mkDerivation (self: {
   pname = "postgresql-simple";
-  version = "0.3.7.1";
-  sha256 = "1xrgwpg58srmzv1d0jdknyh5vwdq2c40fyqy0wvgppisxzq469wh";
+  version = "0.3.8.0";
+  sha256 = "1p1cxp7mjrxyxxqrq2skm3kqrnmb3k6fb8kwr2aj9cnbqfhwl1qf";
   buildDepends = [
     aeson attoparsec blazeBuilder blazeTextual postgresqlLibpq text
     time transformers vector
diff --git a/pkgs/development/libraries/haskell/profunctor-extras/default.nix b/pkgs/development/libraries/haskell/profunctor-extras/default.nix
index 6844bcc369a..bf7e6ab7121 100644
--- a/pkgs/development/libraries/haskell/profunctor-extras/default.nix
+++ b/pkgs/development/libraries/haskell/profunctor-extras/default.nix
@@ -1,18 +1,13 @@
-{ cabal, comonad, profunctors, semigroupoidExtras, semigroupoids
-, tagged, transformers
-}:
+{ cabal, profunctors }:
 
 cabal.mkDerivation (self: {
   pname = "profunctor-extras";
-  version = "3.3.3.1";
-  sha256 = "16naa6ksgwy6fh8vwflcc9s0rpamn886as8qhjqrkpjlc8s83h7g";
-  buildDepends = [
-    comonad profunctors semigroupoidExtras semigroupoids tagged
-    transformers
-  ];
+  version = "4.0";
+  sha256 = "10j458liqlyz5s9gkg95c6aq7ap5fa7d8pc7hygy71nn87pm2g4a";
+  buildDepends = [ profunctors ];
   meta = {
     homepage = "http://github.com/ekmett/profunctor-extras/";
-    description = "Profunctor extras";
+    description = "This package has been absorbed into profunctors 4.0";
     license = self.stdenv.lib.licenses.bsd3;
     platforms = self.ghc.meta.platforms;
   };
diff --git a/pkgs/development/libraries/haskell/profunctors/default.nix b/pkgs/development/libraries/haskell/profunctors/default.nix
index 83398295108..83d06b10ca6 100644
--- a/pkgs/development/libraries/haskell/profunctors/default.nix
+++ b/pkgs/development/libraries/haskell/profunctors/default.nix
@@ -1,13 +1,13 @@
-{ cabal, comonad, tagged }:
+{ cabal, comonad, semigroupoids, tagged, transformers }:
 
 cabal.mkDerivation (self: {
   pname = "profunctors";
-  version = "3.3.0.1";
-  sha256 = "16d7xg929r4smmmcgi54bz7rsjxs6psksrdvzl4336sjpp3dw5h2";
-  buildDepends = [ comonad tagged ];
+  version = "4.0.1";
+  sha256 = "13yr3n7jkhxbk4gk6nd1j8p1a7g5ir8g9xprcy3s1x39cqf4m986";
+  buildDepends = [ comonad semigroupoids tagged transformers ];
   meta = {
     homepage = "http://github.com/ekmett/profunctors/";
-    description = "Haskell 98 Profunctors";
+    description = "Profunctors";
     license = self.stdenv.lib.licenses.bsd3;
     platforms = self.ghc.meta.platforms;
   };
diff --git a/pkgs/development/libraries/haskell/reducers/default.nix b/pkgs/development/libraries/haskell/reducers/default.nix
index 319cd138cce..ea1049d2b40 100644
--- a/pkgs/development/libraries/haskell/reducers/default.nix
+++ b/pkgs/development/libraries/haskell/reducers/default.nix
@@ -5,8 +5,8 @@
 
 cabal.mkDerivation (self: {
   pname = "reducers";
-  version = "3.0.2";
-  sha256 = "0inw5gz3bdrfc6hprjfxssyqjwmclgf09gms14blj24qr027gdqq";
+  version = "3.10.1";
+  sha256 = "0pgywdgq0rqir95n4z3nzmyx5n54a1df9abyanz4qfv0g080fjkz";
   buildDepends = [
     comonad fingertree hashable keys pointed semigroupoids semigroups
     text transformers unorderedContainers
diff --git a/pkgs/development/libraries/haskell/resourcet/default.nix b/pkgs/development/libraries/haskell/resourcet/default.nix
index b0953cf9f7c..b4d0fccd8a0 100644
--- a/pkgs/development/libraries/haskell/resourcet/default.nix
+++ b/pkgs/development/libraries/haskell/resourcet/default.nix
@@ -4,8 +4,8 @@
 
 cabal.mkDerivation (self: {
   pname = "resourcet";
-  version = "0.4.8";
-  sha256 = "10pp4hm5c2k2fqzqpagy03gmr526ac2ji8h7k0mcypf4v0ga620m";
+  version = "0.4.9";
+  sha256 = "1jpaphmwvykjshjqwmmyfx64w1j99f6dphy9ygrzc32fjffk5laz";
   buildDepends = [
     liftedBase mmorph monadControl mtl transformers transformersBase
   ];
diff --git a/pkgs/development/libraries/haskell/semigroupoid-extras/default.nix b/pkgs/development/libraries/haskell/semigroupoid-extras/default.nix
index 263adb42f25..cb8ed865da3 100644
--- a/pkgs/development/libraries/haskell/semigroupoid-extras/default.nix
+++ b/pkgs/development/libraries/haskell/semigroupoid-extras/default.nix
@@ -1,13 +1,13 @@
-{ cabal, comonad, distributive, groupoids, semigroupoids }:
+{ cabal, semigroupoids }:
 
 cabal.mkDerivation (self: {
   pname = "semigroupoid-extras";
-  version = "3.0.1";
-  sha256 = "1b6ix9myjav1h4bbq3jxlan8sn2pjw8x0zhazv3anxfab5n2sxpd";
-  buildDepends = [ comonad distributive groupoids semigroupoids ];
+  version = "4.0";
+  sha256 = "07aa7z4nywcrp9msq83b1pcmryl25yxha89sn5vwlgq40cibcm3g";
+  buildDepends = [ semigroupoids ];
   meta = {
     homepage = "http://github.com/ekmett/semigroupoid-extras";
-    description = "Semigroupoids requiring Haskell extensions";
+    description = "This package has been absorbed into semigroupoids 4.0";
     license = self.stdenv.lib.licenses.bsd3;
     platforms = self.ghc.meta.platforms;
   };
diff --git a/pkgs/development/libraries/haskell/semigroupoids/default.nix b/pkgs/development/libraries/haskell/semigroupoids/default.nix
index aa7176f7e16..e0dbf456804 100644
--- a/pkgs/development/libraries/haskell/semigroupoids/default.nix
+++ b/pkgs/development/libraries/haskell/semigroupoids/default.nix
@@ -1,13 +1,17 @@
-{ cabal, comonad, contravariant, semigroups, transformers }:
+{ cabal, comonad, contravariant, distributive, semigroups
+, transformers
+}:
 
 cabal.mkDerivation (self: {
   pname = "semigroupoids";
-  version = "3.1";
-  sha256 = "02147y0nnvyc9ykvjbbxa9gzmkk9kgpsmx40ahwnjk9igjkbyp9g";
-  buildDepends = [ comonad contravariant semigroups transformers ];
+  version = "4.0";
+  sha256 = "12h2b9pisy21xca3x9ilj0aix9clni0za35d2dmv55gb8y8df54l";
+  buildDepends = [
+    comonad contravariant distributive semigroups transformers
+  ];
   meta = {
     homepage = "http://github.com/ekmett/semigroupoids";
-    description = "Haskell 98 semigroupoids: Category sans id";
+    description = "Semigroupoids: Category sans id";
     license = self.stdenv.lib.licenses.bsd3;
     platforms = self.ghc.meta.platforms;
   };
diff --git a/pkgs/development/libraries/haskell/shake/default.nix b/pkgs/development/libraries/haskell/shake/default.nix
index 2588b11ae78..ef7a6d69905 100644
--- a/pkgs/development/libraries/haskell/shake/default.nix
+++ b/pkgs/development/libraries/haskell/shake/default.nix
@@ -4,14 +4,19 @@
 
 cabal.mkDerivation (self: {
   pname = "shake";
-  version = "0.10.7";
-  sha256 = "0r48kzldbgixr1c83sd7frvygqyjx32n67nri1nnamcwpvlv8hgv";
+  version = "0.10.8";
+  sha256 = "15r392b18nis9p0ys95kbj79hki19wid2gyrpy0z9zm2l5d1m3ya";
   isLibrary = true;
   isExecutable = true;
   buildDepends = [
     binary deepseq filepath hashable random time transformers
     unorderedContainers utf8String
   ];
+  testDepends = [
+    binary deepseq filepath hashable random time transformers
+    unorderedContainers utf8String
+  ];
+  doCheck = false;
   meta = {
     homepage = "http://community.haskell.org/~ndm/shake/";
     description = "Build system library, like Make, but more accurate dependencies";
diff --git a/pkgs/development/libraries/haskell/shakespeare-js/default.nix b/pkgs/development/libraries/haskell/shakespeare-js/default.nix
index 6aa34026ce8..ed743d87832 100644
--- a/pkgs/development/libraries/haskell/shakespeare-js/default.nix
+++ b/pkgs/development/libraries/haskell/shakespeare-js/default.nix
@@ -2,8 +2,8 @@
 
 cabal.mkDerivation (self: {
   pname = "shakespeare-js";
-  version = "1.2.0";
-  sha256 = "1g37m7shqxfv7i2dk5qhvxldfzh1xipd91vcyqhks1jwa5byarzj";
+  version = "1.2.0.2";
+  sha256 = "1d7fmw2295ycjipaj9fjgw02y1088h2gxxk1d6sy4c165x95r6vx";
   buildDepends = [ aeson shakespeare text ];
   testDepends = [ aeson hspec HUnit shakespeare text ];
   meta = {
diff --git a/pkgs/development/libraries/haskell/shakespeare-text/default.nix b/pkgs/development/libraries/haskell/shakespeare-text/default.nix
index d05e2247710..d5e91da61b1 100644
--- a/pkgs/development/libraries/haskell/shakespeare-text/default.nix
+++ b/pkgs/development/libraries/haskell/shakespeare-text/default.nix
@@ -2,8 +2,8 @@
 
 cabal.mkDerivation (self: {
   pname = "shakespeare-text";
-  version = "1.0.0.7";
-  sha256 = "0vl8884a0x927svvkza5xzjn4g1rip8dak1zh9wkm4d0q7lhv2px";
+  version = "1.0.0.8";
+  sha256 = "0gf4gsdfjz9c15wvxz886gjzzifgzanfhblgab15inl2rblirv7l";
   buildDepends = [ shakespeare text ];
   testDepends = [ hspec HUnit text ];
   meta = {
diff --git a/pkgs/development/libraries/haskell/shakespeare/default.nix b/pkgs/development/libraries/haskell/shakespeare/default.nix
index 231470dca5a..a5428b0ee3c 100644
--- a/pkgs/development/libraries/haskell/shakespeare/default.nix
+++ b/pkgs/development/libraries/haskell/shakespeare/default.nix
@@ -2,8 +2,8 @@
 
 cabal.mkDerivation (self: {
   pname = "shakespeare";
-  version = "1.2.0";
-  sha256 = "0lzzdkry3sm5i5hhdygsikpnaps66k1sfdxi2mp0ly5aqi1n1blz";
+  version = "1.2.0.1";
+  sha256 = "07qfbqvq8fqbf7y43h0qq2gk9brpf4g0k7gghrjzyjrd57v5zygp";
   buildDepends = [ parsec systemFileio systemFilepath text time ];
   testDepends = [
     hspec parsec systemFileio systemFilepath text time
diff --git a/pkgs/development/libraries/haskell/simple-sendfile/default.nix b/pkgs/development/libraries/haskell/simple-sendfile/default.nix
index b8c527daf1a..806feee295f 100644
--- a/pkgs/development/libraries/haskell/simple-sendfile/default.nix
+++ b/pkgs/development/libraries/haskell/simple-sendfile/default.nix
@@ -2,8 +2,8 @@
 
 cabal.mkDerivation (self: {
   pname = "simple-sendfile";
-  version = "0.2.12";
-  sha256 = "019n82700fbhsqxgn1cwfqii27r436gljis7yl02zjnzy7xlvrha";
+  version = "0.2.13";
+  sha256 = "03cgbzfhkih1ln1xb78r1hfh6zzjjj6763n9nzr9cj6bxs0fiqd3";
   buildDepends = [ network ];
   testDepends = [ conduit hspec HUnit network networkConduit ];
   doCheck = false;
diff --git a/pkgs/development/libraries/haskell/skein/default.nix b/pkgs/development/libraries/haskell/skein/default.nix
index 4d96ea19373..7acc60e3601 100644
--- a/pkgs/development/libraries/haskell/skein/default.nix
+++ b/pkgs/development/libraries/haskell/skein/default.nix
@@ -9,7 +9,7 @@ cabal.mkDerivation (self: {
   jailbreak = true;
   meta = {
     homepage = "https://github.com/meteficha/skein";
-    description = "Family of cryptographic hash functions (includes Skein-MAC)";
+    description = "Skein, a family of cryptographic hash functions. Includes Skein-MAC as well.";
     license = self.stdenv.lib.licenses.bsd3;
     platforms = self.ghc.meta.platforms;
     maintainers = [ self.stdenv.lib.maintainers.andres ];
diff --git a/pkgs/development/libraries/haskell/snap/snap.nix b/pkgs/development/libraries/haskell/snap/snap.nix
index 94f452f69b8..8df65404962 100644
--- a/pkgs/development/libraries/haskell/snap/snap.nix
+++ b/pkgs/development/libraries/haskell/snap/snap.nix
@@ -8,8 +8,8 @@
 
 cabal.mkDerivation (self: {
   pname = "snap";
-  version = "0.13.0.3";
-  sha256 = "0gwcrsmcx5823w53nfi92gg2hkjnyxd3mp97qijp5p8y83mhh0l0";
+  version = "0.13.0.4";
+  sha256 = "1cbc42x7p87fmazm0dqc519rdaiiiwmkri8y1n4hgvr70kfi6569";
   isLibrary = true;
   isExecutable = true;
   buildDepends = [
diff --git a/pkgs/development/libraries/haskell/system-filepath/default.nix b/pkgs/development/libraries/haskell/system-filepath/default.nix
index 851b28baafe..84ca453c6c1 100644
--- a/pkgs/development/libraries/haskell/system-filepath/default.nix
+++ b/pkgs/development/libraries/haskell/system-filepath/default.nix
@@ -2,8 +2,8 @@
 
 cabal.mkDerivation (self: {
   pname = "system-filepath";
-  version = "0.4.7";
-  sha256 = "108bmgz6rynkyabr4pws07smdh31syqvzry9cshrw3zd07c3mn89";
+  version = "0.4.8";
+  sha256 = "15x0yxakqqrdqvghr0l4pzvy5a68xxdv1c75d3qwx604665j3xkw";
   buildDepends = [ deepseq text ];
   meta = {
     homepage = "https://john-millikin.com/software/haskell-filesystem/";
diff --git a/pkgs/development/libraries/haskell/tar/default.nix b/pkgs/development/libraries/haskell/tar/default.nix
index 7ee52e79e03..04257960a64 100644
--- a/pkgs/development/libraries/haskell/tar/default.nix
+++ b/pkgs/development/libraries/haskell/tar/default.nix
@@ -6,7 +6,7 @@ cabal.mkDerivation (self: {
   sha256 = "0vbsv7h3zgp30mlgsw156jkv1rqy5zbm98as9haf7x15hd6jf254";
   buildDepends = [ filepath time ];
   meta = {
-    description = "Reading, writing and manipulating \".tar\" archive files";
+    description = "Reading, writing and manipulating \".tar\" archive files.";
     license = self.stdenv.lib.licenses.bsd3;
     platforms = self.ghc.meta.platforms;
     maintainers = [ self.stdenv.lib.maintainers.andres ];
diff --git a/pkgs/development/libraries/haskell/tasty/default.nix b/pkgs/development/libraries/haskell/tasty/default.nix
index 37030681e34..df14857f9ab 100644
--- a/pkgs/development/libraries/haskell/tasty/default.nix
+++ b/pkgs/development/libraries/haskell/tasty/default.nix
@@ -4,8 +4,8 @@
 
 cabal.mkDerivation (self: {
   pname = "tasty";
-  version = "0.3";
-  sha256 = "0sgc0529sqhj0b75a4mkdw0bkx56ynyl4msmi8hd20jvv5wnzyi6";
+  version = "0.3.1";
+  sha256 = "0ipndrpywzg40s5hiwyyly29mcppcfqbbpwqqp4apma57m8cdpb0";
   buildDepends = [
     ansiTerminal mtl optparseApplicative regexPosix stm tagged
   ];
diff --git a/pkgs/development/libraries/haskell/th-lift/default.nix b/pkgs/development/libraries/haskell/th-lift/default.nix
index b8a118b56a6..c479955db64 100644
--- a/pkgs/development/libraries/haskell/th-lift/default.nix
+++ b/pkgs/development/libraries/haskell/th-lift/default.nix
@@ -2,8 +2,8 @@
 
 cabal.mkDerivation (self: {
   pname = "th-lift";
-  version = "0.5.5";
-  sha256 = "1zp9alv3nbvra1rscddak3i33c2jnv6g6806h94qbfkq3zbimfi0";
+  version = "0.5.6";
+  sha256 = "128rbpqbm4fgn1glbv8bvlqnvn2wvca7wj08xri25w3bikmfy2z4";
   meta = {
     description = "Derive Template Haskell's Lift class for datatypes";
     license = "unknown";
diff --git a/pkgs/development/libraries/haskell/th-orphans/default.nix b/pkgs/development/libraries/haskell/th-orphans/default.nix
index 8fb51c77dbf..9196e9ef76b 100644
--- a/pkgs/development/libraries/haskell/th-orphans/default.nix
+++ b/pkgs/development/libraries/haskell/th-orphans/default.nix
@@ -2,8 +2,8 @@
 
 cabal.mkDerivation (self: {
   pname = "th-orphans";
-  version = "0.7.0.1";
-  sha256 = "19lfq2m7c6n2z8gz4n57wc92x5x5rkgv4chbfq7w4n531qya4bgr";
+  version = "0.8";
+  sha256 = "0kzzcicn6pggvvblhbrs3vh0bf71izlb99lb0f5qww7ymi4smldr";
   buildDepends = [ thLift ];
   meta = {
     description = "Orphan instances for TH datatypes";
diff --git a/pkgs/development/libraries/haskell/transformers-compat/default.nix b/pkgs/development/libraries/haskell/transformers-compat/default.nix
index 3eda20cec05..2abd6efa0ce 100644
--- a/pkgs/development/libraries/haskell/transformers-compat/default.nix
+++ b/pkgs/development/libraries/haskell/transformers-compat/default.nix
@@ -7,7 +7,7 @@ cabal.mkDerivation (self: {
   buildDepends = [ transformers ];
   meta = {
     homepage = "http://github.com/ekmett/transformers-compat/";
-    description = "Small compatibility shim exposing the new types from transformers 0.3 to older Haskell platforms";
+    description = "A small compatibility shim exposing the new types from transformers 0.3 to older Haskell platforms.";
     license = self.stdenv.lib.licenses.bsd3;
     platforms = self.ghc.meta.platforms;
   };
diff --git a/pkgs/development/libraries/haskell/trifecta/default.nix b/pkgs/development/libraries/haskell/trifecta/default.nix
index 2ce40a0672e..f7b9a7aea81 100644
--- a/pkgs/development/libraries/haskell/trifecta/default.nix
+++ b/pkgs/development/libraries/haskell/trifecta/default.nix
@@ -6,8 +6,8 @@
 
 cabal.mkDerivation (self: {
   pname = "trifecta";
-  version = "1.2.1";
-  sha256 = "0l7q6id3l9km7vrqald87d6l03k5w5zxfh44w425kxmm8fwj2j0j";
+  version = "1.2.1.1";
+  sha256 = "1bv35ip7g0h7r2w0s8pkcbvm0b9hx91vblf5w57q3jr843v9314c";
   buildDepends = [
     ansiTerminal ansiWlPprint blazeBuilder blazeHtml blazeMarkup
     charset comonad deepseq fingertree hashable lens mtl parsers
diff --git a/pkgs/development/libraries/haskell/unix-time/default.nix b/pkgs/development/libraries/haskell/unix-time/default.nix
index 846e3d88883..67dbdac3485 100644
--- a/pkgs/development/libraries/haskell/unix-time/default.nix
+++ b/pkgs/development/libraries/haskell/unix-time/default.nix
@@ -2,8 +2,8 @@
 
 cabal.mkDerivation (self: {
   pname = "unix-time";
-  version = "0.2.0";
-  sha256 = "1gmchi6crbd3lpnw1j0zaaj7y0gib8dbqd8ip2s5p3f50qqlsxj8";
+  version = "0.2.1";
+  sha256 = "15kg1rxbw86p5jzig9ac7lsizmlvqkxikq7h8jfi04rri39a9jiy";
   testDepends = [ doctest hspec QuickCheck time ];
   meta = {
     description = "Unix time parser/formatter and utilities";
diff --git a/pkgs/development/libraries/haskell/usb/default.nix b/pkgs/development/libraries/haskell/usb/default.nix
new file mode 100644
index 00000000000..41a71618546
--- /dev/null
+++ b/pkgs/development/libraries/haskell/usb/default.nix
@@ -0,0 +1,14 @@
+{ cabal, baseUnicodeSymbols, bindingsLibusb, text, vector }:
+
+cabal.mkDerivation (self: {
+  pname = "usb";
+  version = "1.2";
+  sha256 = "1k73avkmpbmg6iq2kmwhg2ifibni5c1yp202afdb6v7w5akvmc0b";
+  buildDepends = [ baseUnicodeSymbols bindingsLibusb text vector ];
+  meta = {
+    homepage = "http://basvandijk.github.com/usb";
+    description = "Communicate with USB devices";
+    license = self.stdenv.lib.licenses.bsd3;
+    platforms = self.ghc.meta.platforms;
+  };
+})
diff --git a/pkgs/development/libraries/haskell/utf8-light/default.nix b/pkgs/development/libraries/haskell/utf8-light/default.nix
index 42591158cd7..1c2e1f5c116 100644
--- a/pkgs/development/libraries/haskell/utf8-light/default.nix
+++ b/pkgs/development/libraries/haskell/utf8-light/default.nix
@@ -2,8 +2,8 @@
 
 cabal.mkDerivation (self: {
   pname = "utf8-light";
-  version = "0.4.0.1";
-  sha256 = "1y2vfxjgq8r90bpaxhha0s837vklpwdj4cj3h61bimc0lcx22905";
+  version = "0.4.2";
+  sha256 = "0rwyc5z331yfnm4hpx0sph6i1zvkd1z10vvglhnp0vc9wy644k0q";
   meta = {
     description = "Unicode";
     license = self.stdenv.lib.licenses.bsd3;
diff --git a/pkgs/development/libraries/haskell/uuid/default.nix b/pkgs/development/libraries/haskell/uuid/default.nix
index 0e90ce3ace6..37ef38da4e2 100644
--- a/pkgs/development/libraries/haskell/uuid/default.nix
+++ b/pkgs/development/libraries/haskell/uuid/default.nix
@@ -12,8 +12,8 @@ cabal.mkDerivation (self: {
     criterion deepseq HUnit mersenneRandomPure64 QuickCheck random
     testFramework testFrameworkHunit testFrameworkQuickcheck2
   ];
-  doCheck = false;
   jailbreak = true;
+  doCheck = false;
   meta = {
     homepage = "http://projects.haskell.org/uuid/";
     description = "For creating, comparing, parsing and printing Universally Unique Identifiers";
diff --git a/pkgs/development/libraries/haskell/wai-app-static/default.nix b/pkgs/development/libraries/haskell/wai-app-static/default.nix
index 2d0dd397a08..d88eb2df0bc 100644
--- a/pkgs/development/libraries/haskell/wai-app-static/default.nix
+++ b/pkgs/development/libraries/haskell/wai-app-static/default.nix
@@ -7,8 +7,8 @@
 
 cabal.mkDerivation (self: {
   pname = "wai-app-static";
-  version = "1.3.2.1";
-  sha256 = "1iw2b53p08c38fdh3d0js9j8lyy0i8qszp3jd736kzxxiig6ah79";
+  version = "1.3.3";
+  sha256 = "0lsqfvlh65rggp9z6m5gyx8gv0wk3b44jrk57s8yj2bh74pbr64f";
   buildDepends = [
     base64Bytestring blazeBuilder blazeHtml blazeMarkup cereal
     cryptoApi cryptoConduit cryptohashCryptoapi fileEmbed httpDate
diff --git a/pkgs/development/libraries/haskell/warp/default.nix b/pkgs/development/libraries/haskell/warp/default.nix
index c96e7bfd738..100dbbd7024 100644
--- a/pkgs/development/libraries/haskell/warp/default.nix
+++ b/pkgs/development/libraries/haskell/warp/default.nix
@@ -1,13 +1,13 @@
 { cabal, blazeBuilder, blazeBuilderConduit, caseInsensitive
-, conduit, hashable, hspec, httpAttoparsec, httpTypes, HUnit
+, conduit, hashable, hspec, HTTP, httpAttoparsec, httpTypes, HUnit
 , liftedBase, network, networkConduit, QuickCheck, simpleSendfile
 , transformers, unixCompat, void, wai
 }:
 
 cabal.mkDerivation (self: {
   pname = "warp";
-  version = "1.3.9.2";
-  sha256 = "0l4iq7dl7iv9sf0bj52g577x9i84miscfr27b2vm8g8n6306jr77";
+  version = "1.3.10.1";
+  sha256 = "1pi2x0gi4r6qy151a9gmfq223yiy53j7prj2pyn00cprr0m4mk2v";
   buildDepends = [
     blazeBuilder blazeBuilderConduit caseInsensitive conduit hashable
     httpAttoparsec httpTypes liftedBase network networkConduit
@@ -15,7 +15,7 @@ cabal.mkDerivation (self: {
   ];
   testDepends = [
     blazeBuilder blazeBuilderConduit caseInsensitive conduit hashable
-    hspec httpAttoparsec httpTypes HUnit liftedBase network
+    hspec HTTP httpAttoparsec httpTypes HUnit liftedBase network
     networkConduit QuickCheck simpleSendfile transformers unixCompat
     void wai
   ];
diff --git a/pkgs/development/libraries/haskell/yaml/default.nix b/pkgs/development/libraries/haskell/yaml/default.nix
index 7e2bd368c7e..8d06099b77e 100644
--- a/pkgs/development/libraries/haskell/yaml/default.nix
+++ b/pkgs/development/libraries/haskell/yaml/default.nix
@@ -4,8 +4,8 @@
 
 cabal.mkDerivation (self: {
   pname = "yaml";
-  version = "0.8.5";
-  sha256 = "12jj785gzcnrif460cx2k69pc2h9h956g0w1gp8pcr5hawrvd6rg";
+  version = "0.8.5.1";
+  sha256 = "0vbampykc5a027q5fh5w6i1bxblyxx7s3nzhpzaa4c1yz8nz3k57";
   isLibrary = true;
   isExecutable = true;
   buildDepends = [
diff --git a/pkgs/development/libraries/haskell/yesod-bin/default.nix b/pkgs/development/libraries/haskell/yesod-bin/default.nix
index b260a6e4188..a86417f6b39 100644
--- a/pkgs/development/libraries/haskell/yesod-bin/default.nix
+++ b/pkgs/development/libraries/haskell/yesod-bin/default.nix
@@ -10,8 +10,8 @@
 
 cabal.mkDerivation (self: {
   pname = "yesod-bin";
-  version = "1.2.3.3";
-  sha256 = "13cbahj7kjxvw0p92sza72fyh47by5qna6ym9lsvka0y8fk7jf6w";
+  version = "1.2.3.4";
+  sha256 = "0xwav5ghik0vzg706rcqlzk64gnvr4nn4iikx1bzymzz2p5zyg0z";
   isLibrary = false;
   isExecutable = true;
   buildDepends = [
diff --git a/pkgs/development/libraries/haskell/yesod-core/default.nix b/pkgs/development/libraries/haskell/yesod-core/default.nix
index 14c8259cddb..0bd73c2ade4 100644
--- a/pkgs/development/libraries/haskell/yesod-core/default.nix
+++ b/pkgs/development/libraries/haskell/yesod-core/default.nix
@@ -10,8 +10,8 @@
 
 cabal.mkDerivation (self: {
   pname = "yesod-core";
-  version = "1.2.4.4";
-  sha256 = "0awz5ijhmd7z292irzz8sp2j3vp3lp57k9rcp4bmgqmxkf826hkj";
+  version = "1.2.4.5";
+  sha256 = "091f89bwjsf2qimivbz74rykjjgzghfvs66sv9cz305pgw6kpjc7";
   buildDepends = [
     aeson attoparsecConduit blazeBuilder blazeHtml blazeMarkup
     caseInsensitive cereal clientsession conduit cookie dataDefault
diff --git a/pkgs/development/libraries/haskell/yesod-form/default.nix b/pkgs/development/libraries/haskell/yesod-form/default.nix
index 878e3c9ebce..5c0220f1f2a 100644
--- a/pkgs/development/libraries/haskell/yesod-form/default.nix
+++ b/pkgs/development/libraries/haskell/yesod-form/default.nix
@@ -6,8 +6,8 @@
 
 cabal.mkDerivation (self: {
   pname = "yesod-form";
-  version = "1.3.2.2";
-  sha256 = "1dqhpzkhg9wcdd9djynrjixpp28rj8iy9pfipx250bry7yq77rv2";
+  version = "1.3.3";
+  sha256 = "1maf8yczijx8rdjy4abr2jq1ds4g61jg3zbqxjzaaxsbs77gna4a";
   buildDepends = [
     aeson attoparsec blazeBuilder blazeHtml blazeMarkup cryptoApi
     dataDefault emailValidate hamlet network persistent resourcet
diff --git a/pkgs/development/libraries/haskell/yesod-platform/default.nix b/pkgs/development/libraries/haskell/yesod-platform/default.nix
index 9fe24ca4a74..f75b5706f6a 100644
--- a/pkgs/development/libraries/haskell/yesod-platform/default.nix
+++ b/pkgs/development/libraries/haskell/yesod-platform/default.nix
@@ -30,8 +30,8 @@
 
 cabal.mkDerivation (self: {
   pname = "yesod-platform";
-  version = "1.2.4.2";
-  sha256 = "1hmzdwjqi3cxdmyvcr48kprrsa8h548z272mif07114d0qh48x4w";
+  version = "1.2.4.3";
+  sha256 = "1ilkfmg4sdrz45hc2m8b8rqz242phgxzgizrnd41d5g04jib3hl3";
   buildDepends = [
     aeson ansiTerminal asn1Data asn1Types attoparsec attoparsecConduit
     authenticate base64Bytestring baseUnicodeSymbols blazeBuilder
diff --git a/pkgs/development/libraries/haskell/zip-archive/default.nix b/pkgs/development/libraries/haskell/zip-archive/default.nix
index 38290c8cd54..bddf09bc405 100644
--- a/pkgs/development/libraries/haskell/zip-archive/default.nix
+++ b/pkgs/development/libraries/haskell/zip-archive/default.nix
@@ -4,8 +4,8 @@
 
 cabal.mkDerivation (self: {
   pname = "zip-archive";
-  version = "0.1.3.4";
-  sha256 = "0hvndr3gb7fiv4qjwjvic5mg7wq7h7nw3c3v5xq8fnlr1l943vyb";
+  version = "0.1.4";
+  sha256 = "0ipk8gwa2k8iqg2gg4lbawr8l9sjwhy2p7b8qxazpq0i88dyy3lb";
   isLibrary = true;
   isExecutable = true;
   buildDepends = [ binary digest filepath mtl time utf8String zlib ];
diff --git a/pkgs/development/libraries/libav/default.nix b/pkgs/development/libraries/libav/default.nix
index ea45902b749..287ac32fff5 100644
--- a/pkgs/development/libraries/libav/default.nix
+++ b/pkgs/development/libraries/libav/default.nix
@@ -26,7 +26,7 @@ with { inherit (stdenv.lib) optional optionals; };
 
 let
   result = {
-    libav_9   = libavFun   "9.9" "1rwphyqb2c4zyp20y4ywxjiddmd46vd4dbpdm1lxqm3q63rmmdk9";
+    libav_9   = libavFun  "9.10" "039hx7z8lmsiljy4wj87hk8lkxspbxbrjv43v3lc38cxfx0fdnw3";
     libav_0_8 = libavFun "0.8.8" "1wnbmbs0z4f55y8r9bwb63l04zn383l1avy4c9x1ffb2xccgcp79";
   };
 
diff --git a/pkgs/development/libraries/libjson-rpc-cpp/default.nix b/pkgs/development/libraries/libjson-rpc-cpp/default.nix
new file mode 100644
index 00000000000..3dca6a04af7
--- /dev/null
+++ b/pkgs/development/libraries/libjson-rpc-cpp/default.nix
@@ -0,0 +1,28 @@
+{ stdenv, fetchurl, cmake, curl }:
+
+let
+  name = "libjson-rpc-cpp";
+  version = "0.2.1";
+in
+
+stdenv.mkDerivation {
+  name = "${name}-${version}";
+
+  src = fetchurl {
+    url = "https://github.com/cinemast/${name}/archive/${version}.tar.gz";
+    sha256 = "1pc9nn4968qkda8vr4f9dijn2fcldm8i0ymwmql29h4cl5ghdnpw";
+  };
+
+  buildInputs = [ cmake curl ];
+
+  NIX_LDFLAGS = "-lpthread";
+  enableParallelBuilding = true;
+  doCheck = true;
+
+  checkPhase = "LD_LIBRARY_PATH=out/ ctest";
+
+  meta = {
+    description = "C++ framework for json-rpc (json remote procedure call)";
+    platforms = stdenv.lib.platforms.linux;
+  };
+}
diff --git a/pkgs/development/libraries/libsodium/default.nix b/pkgs/development/libraries/libsodium/default.nix
new file mode 100644
index 00000000000..e8124c2643a
--- /dev/null
+++ b/pkgs/development/libraries/libsodium/default.nix
@@ -0,0 +1,21 @@
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  name = "libsodium-0.4.3";
+
+  src = fetchurl {
+    url = "https://download.libsodium.org/libsodium/releases/${name}.tar.gz";
+    sha256 = "0hk0zca1kpj6xlc2j2qx9qy7287pi0896frmxq5d7qmcwsdf372r";
+  };
+
+  NIX_LDFLAGS = "-lssp";
+
+  doCheck = true;
+
+  meta = {
+    description = "Version of NaCl with harwdare tests at runtime, not build time";
+    license = "ISC";
+    maintainers = with stdenv.lib.maintainers; [ viric ];
+    platforms = stdenv.lib.platforms.all;
+  };
+}
diff --git a/pkgs/development/libraries/libtoxcore/default.nix b/pkgs/development/libraries/libtoxcore/default.nix
new file mode 100644
index 00000000000..0098ddb9d77
--- /dev/null
+++ b/pkgs/development/libraries/libtoxcore/default.nix
@@ -0,0 +1,36 @@
+{ stdenv, fetchurl, autoconf, libtool, automake, libsodium, ncurses
+, libconfig, pkgconfig }:
+
+let
+  version = "31f5d7a8ab";
+  date = "20131011";
+in
+stdenv.mkDerivation rec {
+  name = "tox-core-${date}-${version}";
+
+  src = fetchurl {
+    url = "https://github.com/irungentoo/ProjectTox-Core/tarball/${version}";
+    name = "${name}.tar.gz";
+    sha256 = "0frz8ylvi33i7zkiz3hp28ylqg4c3ffrbc2m3ibb4zv9rwfzf77r";
+  };
+
+  preConfigure = ''
+    autoreconf -i
+  '';
+
+  configureFlags = [ "--with-libsodium-headers=${libsodium}/include"
+    "--with-libsodium-libs=${libsodium}/lib" 
+    "--enable-ntox" ];
+
+  buildInputs = [ autoconf libtool automake libsodium ncurses libconfig
+    pkgconfig ];
+
+  doCheck = true;
+
+  meta = {
+    description = "P2P FOSS instant messaging application aimed to replace Skype with crypto";
+    license = "GPLv3+";
+    maintainers = with stdenv.lib.maintainers; [ viric ];
+    platforms = stdenv.lib.platforms.all;
+  };
+}
diff --git a/pkgs/development/libraries/libtxc_dxtn/default.nix b/pkgs/development/libraries/libtxc_dxtn/default.nix
index 9cf8decf4c8..33e01f86dac 100644
--- a/pkgs/development/libraries/libtxc_dxtn/default.nix
+++ b/pkgs/development/libraries/libtxc_dxtn/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, autoconf, automake, libtool, mesa }:
+{ stdenv, fetchurl, autoreconfHook, mesa }:
 
 let version = "1.0.1"; in
 
@@ -6,15 +6,14 @@ stdenv.mkDerivation rec {
   name = "libtxc_dxtn-${version}";
 
   src = fetchurl {
-    url = "http://cgit.freedesktop.org/~mareko/${name}.tar.gz";
-    sha256 = "0g6lymik9cs7nbzigwzaf49fnhhfsvjanhg92wykw7rfq9zvkhvv";
+    url = "http://people.freedesktop.org/~cbrill/libtxc_dxtn/${name}.tar.bz2";
+    sha256 = "0q5fjaknl7s0z206dd8nzk9bdh8g4p23bz7784zrllnarl90saa5";
   };
 
-  buildInputs = [ autoconf automake libtool mesa ];
-
-  preConfigure = "autoreconf -vfi";
+  buildInputs = [ autoreconfHook mesa ];
 
   meta = {
     homepage = http://dri.freedesktop.org/wiki/S3TC;
+    repositories.git = git://people.freedesktop.org/~mareko/libtxc_dxtn;
   };
 }
diff --git a/pkgs/development/libraries/libusb1/default.nix b/pkgs/development/libraries/libusb1/default.nix
index c01baa2fd0f..d4504a26b7f 100644
--- a/pkgs/development/libraries/libusb1/default.nix
+++ b/pkgs/development/libraries/libusb1/default.nix
@@ -11,6 +11,8 @@ stdenv.mkDerivation rec {
   buildInputs = [ pkgconfig ];
   propagatedBuildInputs = stdenv.lib.optional (stdenv.isLinux) udev;
 
+  NIX_LDFLAGS = "-lgcc_s";
+
   meta = {
     homepage = http://www.libusb.org;
     description = "User-space USB library";
diff --git a/pkgs/development/libraries/libvncserver/default.nix b/pkgs/development/libraries/libvncserver/default.nix
index 7856183e5e9..35adb460041 100644
--- a/pkgs/development/libraries/libvncserver/default.nix
+++ b/pkgs/development/libraries/libvncserver/default.nix
@@ -1,29 +1,38 @@
-args :  
-let 
-  lib = args.lib;
-  fetchurl = args.fetchurl;
-
-  version = lib.attrByPath ["version"] "0.9.9" args; 
-  buildInputs = with args; [
+{stdenv, fetchurl,
+  libtool, libjpeg, openssl, libX11, libXdamage, xproto, damageproto, 
+  xextproto, libXext, fixesproto, libXfixes, xineramaproto, libXinerama, 
+  libXrandr, randrproto, libXtst, zlib
+}:
+let
+  s = # Generated upstream information
+  rec {
+    baseName="libvncserver";
+    version="0.9.9";
+    name="${baseName}-${version}";
+    hash="1y83z31wbjivbxs60kj8a8mmjmdkgxlvr2x15yz95yy24lshs1ng";
+    url="mirror://sourceforge/project/libvncserver/libvncserver/0.9.9/LibVNCServer-0.9.9.tar.gz";
+    sha256="1y83z31wbjivbxs60kj8a8mmjmdkgxlvr2x15yz95yy24lshs1ng";
+  };
+  buildInputs = [
     libtool libjpeg openssl libX11 libXdamage xproto damageproto
     xextproto libXext fixesproto libXfixes xineramaproto libXinerama
     libXrandr randrproto libXtst zlib
   ];
 in
-rec {
+stdenv.mkDerivation {
+  inherit (s) name version;
+  inherit buildInputs;
   src = fetchurl {
-    url = "mirror://sourceforge/libvncserver/LibVNCServer-${version}.tar.gz";
-    sha256 = "1y83z31wbjivbxs60kj8a8mmjmdkgxlvr2x15yz95yy24lshs1ng";
+    inherit (s) url sha256;
   };
-
-  inherit buildInputs;
-  configureFlags = [];
-
-  /* doConfigure should be specified separately */
-  phaseNames = ["doConfigure" "doMakeInstall"];
-      
-  name = "libvncserver-" + version;
+  preConfigure = ''
+    sed -e 's@/usr/include/linux@${stdenv.gcc.libc}/include/linux@g' -i configure
+  '';
   meta = {
-    description = "VNC server library";
+    inherit (s) version;
+    description =  "VNC server library";
+    license = stdenv.lib.licenses.gpl2Plus ;
+    maintainers = [stdenv.lib.maintainers.raskin];
+    platforms = stdenv.lib.platforms.linux;
   };
 }
diff --git a/pkgs/development/libraries/libvncserver/default.upstream b/pkgs/development/libraries/libvncserver/default.upstream
new file mode 100644
index 00000000000..eae48197439
--- /dev/null
+++ b/pkgs/development/libraries/libvncserver/default.upstream
@@ -0,0 +1,4 @@
+url http://sourceforge.net/projects/libvncserver/files/libvncserver/
+SF_version_dir
+version_link '[.]tar[.][bgx]z[0-9]*/download$'
+SF_redirect
diff --git a/pkgs/development/libraries/libxtc_dxtn/default.nix b/pkgs/development/libraries/libxtc_dxtn/default.nix
deleted file mode 100644
index 1f94bcbef99..00000000000
--- a/pkgs/development/libraries/libxtc_dxtn/default.nix
+++ /dev/null
@@ -1,12 +0,0 @@
-{ stdenv, fetchurl, mesa }:
-
-stdenv.mkDerivation rec {
-  name = "libtxc_dxtn-1.0.1";
-
-  src = fetchurl {
-    url = "http://people.freedesktop.org/~cbrill/libtxc_dxtn/${name}.tar.bz2";
-    sha256 = "0q5fjaknl7s0z206dd8nzk9bdh8g4p23bz7784zrllnarl90saa5";
-  };
-
-  NIX_CFLAGS_COMPILE = "-I ${mesa}/include";
-}
diff --git a/pkgs/development/libraries/libyaml-cpp/0.3.x.nix b/pkgs/development/libraries/libyaml-cpp/0.3.x.nix
new file mode 100644
index 00000000000..4b0acd83fc3
--- /dev/null
+++ b/pkgs/development/libraries/libyaml-cpp/0.3.x.nix
@@ -0,0 +1,18 @@
+{stdenv, fetchurl, cmake, boostHeaders}:
+
+stdenv.mkDerivation {
+  name = "libyaml-cpp-0.3.0";
+
+  src = fetchurl {
+    url = http://yaml-cpp.googlecode.com/files/yaml-cpp-0.3.0.tar.gz;
+    sha256 = "10kv25zgq96ybxc6c19lzpax1xi5lpxrdqa9x52nffsql6skil1c";
+  };
+
+  buildInputs = [ cmake boostHeaders ];
+
+  meta = {
+    homepage = http://code.google.com/p/yaml-cpp/;
+    description = "A YAML parser and emitter for C++";
+    license = "MIT";
+  };
+}
diff --git a/pkgs/development/libraries/libyaml-cpp/default.nix b/pkgs/development/libraries/libyaml-cpp/default.nix
new file mode 100644
index 00000000000..09860522ef4
--- /dev/null
+++ b/pkgs/development/libraries/libyaml-cpp/default.nix
@@ -0,0 +1,18 @@
+{stdenv, fetchurl, cmake, boostHeaders}:
+
+stdenv.mkDerivation {
+  name = "libyaml-cpp-0.5.1";
+
+  src = fetchurl {
+    url = http://yaml-cpp.googlecode.com/files/yaml-cpp-0.5.1.tar.gz;
+    sha256 = "01kg0h8ksp162kdhyzn67vnlxpj5zjbks84sh50pv61xni990z1y";
+  };
+
+  buildInputs = [ cmake boostHeaders ];
+
+  meta = {
+    homepage = http://code.google.com/p/yaml-cpp/;
+    description = "A YAML parser and emitter for C++";
+    license = "MIT";
+  };
+}
diff --git a/pkgs/development/libraries/nspr/default.nix b/pkgs/development/libraries/nspr/default.nix
index 1aef55c9b2c..80368031349 100644
--- a/pkgs/development/libraries/nspr/default.nix
+++ b/pkgs/development/libraries/nspr/default.nix
@@ -1,13 +1,13 @@
 { stdenv, fetchurl }:
 
-let version = "4.10"; in
+let version = "4.10.1"; in
 
 stdenv.mkDerivation {
   name = "nspr-${version}";
 
   src = fetchurl {
     url = "http://ftp.mozilla.org/pub/mozilla.org/nspr/releases/v${version}/src/nspr-${version}.tar.gz";
-    sha1 = "10dbf68c07497dab30be09db526931c885d5a7e9";
+    sha1 = "bd1cdf5e7e107846ffe431c5c62b81a560e8c3f7";
   };
 
   preConfigure = "cd nspr";
diff --git a/pkgs/development/libraries/nss/default.nix b/pkgs/development/libraries/nss/default.nix
index de980d718f3..49f3754bc14 100644
--- a/pkgs/development/libraries/nss/default.nix
+++ b/pkgs/development/libraries/nss/default.nix
@@ -17,11 +17,11 @@ let
 
 in stdenv.mkDerivation rec {
   name = "nss-${version}";
-  version = "3.15.1";
+  version = "3.15.2";
 
   src = fetchurl {
-    url = "http://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_15_1_RTM/src/${name}.tar.gz";
-    sha1 = "1aa7c0ff8af7fb2c8b6e4886ae2291f4bfe0d5c0";
+    url = "http://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_15_2_RTM/src/${name}.tar.gz";
+    sha1 = "2d900c296bf11deabbf833ebd6ecdea549c97a5f";
   };
 
   buildInputs = [ nspr perl zlib sqlite ];
diff --git a/pkgs/development/libraries/silgraphite/graphite2.nix b/pkgs/development/libraries/silgraphite/graphite2.nix
new file mode 100644
index 00000000000..0a36efbc982
--- /dev/null
+++ b/pkgs/development/libraries/silgraphite/graphite2.nix
@@ -0,0 +1,21 @@
+{ stdenv, fetchurl, pkgconfig, freetype, libXft, pango, fontconfig, cmake }:
+
+stdenv.mkDerivation rec {
+  version = "1.2.3";
+  name = "graphite2-${version}";
+  
+  src = fetchurl {
+    url = "mirror://sourceforge/silgraphite/graphite2/${name}.tgz";
+    sha256 = "1xgwnd81gm6p293x8paxb3yisnvpj5qnv1dzr7bjdi7b7h00ls7g";
+  };
+
+  buildInputs = [pkgconfig freetype libXft pango fontconfig cmake];
+
+  NIX_CFLAGS_COMPILE = "-I${freetype}/include/freetype2";
+
+  meta = {
+    description = "An advanced font engine";
+    maintainers = [ stdenv.lib.maintainers.raskin ];
+    platforms = stdenv.lib.platforms.linux;
+  };
+}
diff --git a/pkgs/development/libraries/simgear/default.nix b/pkgs/development/libraries/simgear/default.nix
index de8e1d1df1d..cb534cfbf31 100644
--- a/pkgs/development/libraries/simgear/default.nix
+++ b/pkgs/development/libraries/simgear/default.nix
@@ -1,7 +1,7 @@
 x@{builderDefsPackage
   , plib, freeglut, xproto, libX11, libXext, xextproto, libXi , inputproto
   , libICE, libSM, libXt, libXmu, mesa, boost, zlib, libjpeg , freealut
-  , openscenegraph, openal, expat, cmake
+  , openscenegraph, openal, expat, cmake, apr
   , ...}:
 builderDefsPackage
 (a :
@@ -13,11 +13,11 @@ let
     (builtins.attrNames (builtins.removeAttrs x helperArgNames));
   sourceInfo = rec {
     baseName="simgear";
-    version="2.10.0";
+    version="2.12.0";
     name="${baseName}-${version}";
     extension="tar.bz2";
     url="http://mirrors.ibiblio.org/pub/mirrors/simgear/ftp/Source/${name}.${extension}";
-    hash="0pb148hb35p1c5iz0kpiclmswjl9bax9xfm087ldpxsqg9a0sb2q";
+    hash="0spl6afk8rm96ss4lh7zy5561m5m2qgwsnqjyp35jr1gyyrc944f";
   };
 in
 rec {
diff --git a/pkgs/development/lisp-modules/asdf/default.nix b/pkgs/development/lisp-modules/asdf/default.nix
new file mode 100644
index 00000000000..c615573ae3e
--- /dev/null
+++ b/pkgs/development/lisp-modules/asdf/default.nix
@@ -0,0 +1,40 @@
+{stdenv, fetchurl, texinfo, texLive}:
+let
+  s = # Generated upstream information
+  rec {
+    baseName="asdf";
+    version="3.0.2.1";
+    name="${baseName}-${version}";
+    hash="1npd4dxsgk06ayhln56mwwky0vdpf7i77mkxfh105pld8w5xs4r4";
+    url="http://common-lisp.net/project/asdf/archives/asdf-3.0.2.1.tar.gz";
+    sha256="1npd4dxsgk06ayhln56mwwky0vdpf7i77mkxfh105pld8w5xs4r4";
+  };
+  buildInputs = [
+    texinfo texLive
+  ];
+in
+stdenv.mkDerivation {
+  inherit (s) name version;
+  inherit buildInputs;
+  src = fetchurl {
+    inherit (s) url sha256;
+  };
+  buildPhase = ''
+    make build/asdf.lisp
+    make -C doc asdf.info asdf.html
+  '';
+  installPhase = ''
+    mkdir -p "$out"/lib/common-lisp/asdf/
+    mkdir -p "$out"/share/doc/asdf/
+    cp -r ./* "$out"/lib/common-lisp/asdf/
+    cp -r doc/* "$out"/share/doc/asdf/
+  '';
+  sourceRoot=".";
+  meta = {
+    inherit (s) version;
+    description = ''Standard software-system definition library for Common Lisp'';
+    license = stdenv.lib.licenses.mit ;
+    maintainers = [stdenv.lib.maintainers.raskin];
+    platforms = stdenv.lib.platforms.linux;
+  };
+}
diff --git a/pkgs/development/lisp-modules/asdf/default.upstream b/pkgs/development/lisp-modules/asdf/default.upstream
new file mode 100644
index 00000000000..d8625182352
--- /dev/null
+++ b/pkgs/development/lisp-modules/asdf/default.upstream
@@ -0,0 +1,2 @@
+url http://common-lisp.net/project/asdf/archives/
+version_link asdf-[0-9].*[.]tar[.].*
diff --git a/pkgs/development/lisp-modules/clwrapper/cl-wrapper.sh b/pkgs/development/lisp-modules/clwrapper/cl-wrapper.sh
new file mode 100755
index 00000000000..91b8a0c2bb0
--- /dev/null
+++ b/pkgs/development/lisp-modules/clwrapper/cl-wrapper.sh
@@ -0,0 +1,44 @@
+#! /bin/sh
+# Part of NixPkgs package collection
+# This script can be used at your option under the same license as NixPkgs or 
+# under MIT/X11 license
+
+eval "$NIX_LISP_PREHOOK"
+
+NIX_LISP_COMMAND="$1"
+shift
+
+[ -z "$NIX_LISP" ] && NIX_LISP="${NIX_LISP_COMMAND##*/}"
+
+export NIX_LISP NIX_LISP_LOAD_FILE NIX_LISP_EXEC_CODE NIX_LISP_COMMAND NIX_LISP_FINAL_PARAMETERS
+
+case "$NIX_LISP" in
+	sbcl)
+		NIX_LISP_LOAD_FILE="--load"
+		NIX_LISP_EXEC_CODE="--eval"
+		NIX_LISP_FINAL_PARAMETERS=
+		;;
+	ecl)
+		NIX_LISP_LOAD_FILE="-load"
+		NIX_LISP_EXEC_CODE="-eval"
+		NIX_LISP_FINAL_PARAMETERS=
+		;;
+	clisp)
+		NIX_LISP_LOAD_FILE="-c -l"
+		NIX_LISP_EXEC_CODE="-x"
+		NIX_LISP_FINAL_PARAMETERS="-repl"
+		;;
+esac
+
+NIX_LISP_ASDF_REGISTRY_CODE="
+  (progn
+    (setf asdf:*default-source-registries* '(asdf/source-registry:environment-source-registry))
+    (asdf:initialize-source-registry)
+    )
+"
+
+[ -z "$NIX_LISP_SKIP_CODE" ] && "$NIX_LISP_COMMAND" $NIX_LISP_EARLY_OPTIONS \
+	$NIX_LISP_EXEC_CODE "(load \"$NIX_LISP_ASDF/lib/common-lisp/asdf/build/asdf.lisp\")" \
+	$NIX_LISP_EXEC_CODE "$NIX_LISP_ASDF_REGISTRY_CODE" \
+	$NIX_LISP_FINAL_PARAMETERS \
+	"$@"
diff --git a/pkgs/development/lisp-modules/clwrapper/common-lisp.sh b/pkgs/development/lisp-modules/clwrapper/common-lisp.sh
new file mode 100755
index 00000000000..b22ca016128
--- /dev/null
+++ b/pkgs/development/lisp-modules/clwrapper/common-lisp.sh
@@ -0,0 +1,3 @@
+#! /bin/sh
+
+"$(dirname "$0")"/cl-wrapper.sh "${NIX_LISP_COMMAND:-sbcl}" "$@"
diff --git a/pkgs/development/lisp-modules/clwrapper/default.nix b/pkgs/development/lisp-modules/clwrapper/default.nix
new file mode 100644
index 00000000000..0ae4ce13064
--- /dev/null
+++ b/pkgs/development/lisp-modules/clwrapper/default.nix
@@ -0,0 +1,28 @@
+{stdenv, fetchurl, asdf, lisp ? null}:
+stdenv.mkDerivation {
+  name = "cl-wrapper-script";
+
+  buildPhase="";
+
+  installPhase=''
+    mkdir -p "$out"/bin
+    cp ${./cl-wrapper.sh} "$out"/bin/cl-wrapper.sh
+    cp ${./common-lisp.sh} "$out"/bin/common-lisp.sh
+    chmod a+x "$out"/bin/*
+  '';
+
+  inherit asdf lisp;
+
+  setupHook = ./setup-hook.sh;
+
+  phases="installPhase fixupPhase";
+
+  passthru = {
+    inherit lisp;
+  };
+
+  meta = {
+    description = ''Script used to wrap Common Lisp implementations'';
+    maintainers = [stdenv.lib.maintainers.raskin];
+  };
+}
diff --git a/pkgs/development/lisp-modules/clwrapper/setup-hook.sh b/pkgs/development/lisp-modules/clwrapper/setup-hook.sh
new file mode 100644
index 00000000000..5de43dc0e9a
--- /dev/null
+++ b/pkgs/development/lisp-modules/clwrapper/setup-hook.sh
@@ -0,0 +1,33 @@
+NIX_LISP_ASDF="@asdf@"
+
+CL_SOURCE_REGISTRY="@asdf@/lib/common-lisp/asdf/:@asdf@/lib/common-lisp/asdf/uiop/"
+
+addASDFPaths () {
+    for j in "$1"/lib/common-lisp/*; do
+	if [ -d "$j" ]; then
+            CL_SOURCE_REGISTRY="$CL_SOURCE_REGISTRY:$j/"
+	fi
+    done
+}
+
+setLisp () {
+    if [ -z "$NIX_LISP_COMMAND" ]; then 
+      for j in "$1"/bin/*; do
+          case "$(basename "$j")" in
+              sbcl) NIX_LISP_COMMAND="$j" ;;
+              ecl) NIX_LISP_COMMAND="$j" ;;
+              clisp) NIX_LISP_COMMAND="$j" ;;
+          esac
+      done
+    fi
+    if [ -z "$NIX_LISP" ]; then 
+        NIX_LISP="${NIX_LISP_COMMAND##*/}"
+    fi
+}
+
+export NIX_LISP_COMMAND NIX_LISP CL_SOURCE_REGISTRY NIX_LISP_ASDF
+
+envHooks=(envHooks[@] addASDFPaths setLisp)
+
+mkdir -p "$HOME"/.cache/common-lisp || HOME="$TMP/.temp-$USER-home"
+mkdir -p "$HOME"/.cache/common-lisp
diff --git a/pkgs/development/lisp-modules/define-package.nix b/pkgs/development/lisp-modules/define-package.nix
new file mode 100644
index 00000000000..4fe3bb68373
--- /dev/null
+++ b/pkgs/development/lisp-modules/define-package.nix
@@ -0,0 +1,45 @@
+args @ {stdenv, clwrapper, baseName, version ? "latest", src, description, deps, 
+  buildInputs ? [], meta ? {}, overrides?(x: {})}:
+let 
+  deployConfigScript = ''
+    config_script="$out"/lib/common-lisp-settings/${args.baseName}-shell-config.sh
+    mkdir -p "$(dirname "$config_script")"
+    touch "$config_script"
+    chmod a+x "$config_script"
+    echo "export NIX_LISP_COMMAND='$NIX_LISP_COMMAND'" >> "$config_script"
+    echo "export NIX_LISP_ASDF='$NIX_LISP_ASDF'" >> "$config_script"
+    echo "export CL_SOURCE_REGISTRY="\$CL_SOURCE_REGISTRY\''${CL_SOURCE_REGISTRY:+:}"'$CL_SOURCE_REGISTRY:$out/lib/common-lisp/${args.baseName}/'" >> "$config_script"
+  '';
+  deployLaunchScript = ''
+    launch_script="$out"/bin/${args.baseName}-lisp-launcher.sh
+    mkdir -p "$(dirname "$launch_script")"
+    touch "$launch_script"
+    chmod a+x "$launch_script"
+    echo "#! /bin/sh" >> "$launch_script"
+    echo "source '$config_script'" >> "$launch_script"
+    echo '"${clwrapper}/bin/common-lisp.sh" "$@"' >> "$launch_script" 
+  '';
+basePackage = {
+  name = "lisp-${baseName}-${version}";
+  inherit src;
+
+  inherit deployConfigScript deployLaunchScript;
+  installPhase = ''
+    mkdir -p "$out"/share/doc/${args.baseName};
+    mkdir -p "$out"/lib/common-lisp/${args.baseName};
+    cp -r . "$out"/lib/common-lisp/${args.baseName};
+    cp -rf doc/* LICENCE LICENSE COPYING README README.html README.md readme.html "$out"/share/doc/${args.baseName} || true
+
+    ${deployConfigScript}
+    ${deployLaunchScript}
+  '';
+  propagatedBuildInputs = args.deps ++ [clwrapper clwrapper.lisp];
+  buildInputs = buildInputs;
+  dontStrip=true;
+  meta = {
+    inherit description version;
+  } // meta;
+};
+package = basePackage // (overrides basePackage);
+in
+stdenv.mkDerivation package
diff --git a/pkgs/development/lisp-modules/lisp-packages.nix b/pkgs/development/lisp-modules/lisp-packages.nix
new file mode 100644
index 00000000000..8eaaf151fa7
--- /dev/null
+++ b/pkgs/development/lisp-modules/lisp-packages.nix
@@ -0,0 +1,49 @@
+{stdenv, clwrapper, pkgs}:
+let lispPackages = rec {
+  inherit pkgs clwrapper stdenv;
+  nixLib = pkgs.lib;
+  callPackage = nixLib.callPackageWith lispPackages;
+
+  buildLispPackage =  callPackage ./define-package.nix;
+
+  cl-ppcre = buildLispPackage rec {
+    baseName = "cl-ppcre";
+    version = "2.0.4";
+    description = "Regular expression library for Common Lisp";
+    deps = [];
+    src = pkgs.fetchurl {
+      url = "https://github.com/edicl/cl-ppcre/archive/v${version}.tar.gz";
+      sha256 = "16nkfg6j7nn8qkzxn462kqpdlbajpz2p55pdl12sia6yqkj3lh97";
+    };
+  };
+
+  clx = buildLispPackage rec {
+    baseName = "clx";
+    version = "2013-09";
+    description = "X11 bindings for Common Lisp";
+    deps = [];
+    src = pkgs.fetchgit {
+      url = "https://github.com/sharplispers/clx/";
+      rev = "e2b762ac93d78d6eeca4f36698c8dfd1537ce998";
+      sha256 = "0jcrmlaayz7m8ixgriq7id3pdklyk785qvpcxdpcp4aqnfiiqhij";
+    };
+  };
+
+  iterate = buildLispPackage rec {
+    baseName = "iterate";
+    version = "1.4.3";
+    description = "Iteration package for Common Lisp";
+    deps = [];
+    src = pkgs.fetchdarcs {
+      url = "http://common-lisp.net/project/iterate/darcs/iterate";
+      sha256 = "0m3q0s7h5s8varwx584m2akgdslj14df7kg4w1bj1fbgzsag5m1w";
+      tag=version;
+    };
+    overrides = x: {
+      configurePhase="buildPhase(){ true; }";
+    };
+  };
+
+  stumpwm = callPackage ./stumpwm {};
+};
+in lispPackages
diff --git a/pkgs/development/lisp-modules/stumpwm/default.nix b/pkgs/development/lisp-modules/stumpwm/default.nix
new file mode 100644
index 00000000000..f6ef41dda1d
--- /dev/null
+++ b/pkgs/development/lisp-modules/stumpwm/default.nix
@@ -0,0 +1,33 @@
+{pkgs, nixLib, clwrapper, cl-ppcre, clx, buildLispPackage}: 
+buildLispPackage rec {
+  baseName = "stumpwm";
+  version = "2013-09";
+  src = pkgs.fetchgit {
+    url = "https://github.com/sabetts/stumpwm";
+    sha256 = "0dd69myssfn2bsdx3xdp65mjrvs9x81dl3y3659pyf1avnjlir7h";
+    rev = "565ef58f04f59e1667ec1da4087f1a43a32cd67f";
+  };
+  description = "Tiling window manager for X11";
+  deps = [cl-ppcre clx];
+  buildInputs = with pkgs; [texinfo autoconf which makeWrapper];
+  meta = {
+    maintainers = [nixLib.maintainers.raskin];
+    platforms = nixLib.platforms.linux;
+  };
+  overrides = x: {
+    preConfigure = ''
+      ${x.deployConfigScript}
+      export CL_SOURCE_REGISTRY="$CL_SOURCE_REGISTRY:$PWD/"
+      ./autogen.sh 
+      configureFlags=" --with-lisp=$NIX_LISP --with-$NIX_LISP=$(which common-lisp.sh) "
+    '';
+    installPhase=x.installPhase + ''
+      make install 
+
+      if [ "$NIX_LISP" = "sbcl" ]; then
+        wrapProgram "$out"/bin/stumpwm --set SBCL_HOME "${clwrapper.lisp}/lib/sbcl"
+      fi;
+    '';
+    postInstall = ''false'';
+  };
+}
diff --git a/pkgs/development/mobile/androidenv/build-app.nix b/pkgs/development/mobile/androidenv/build-app.nix
index 2792d364f15..db7067c989c 100644
--- a/pkgs/development/mobile/androidenv/build-app.nix
+++ b/pkgs/development/mobile/androidenv/build-app.nix
@@ -1,6 +1,7 @@
 { stdenv, androidsdk, jdk, ant }:
-{ name, src, platformVersions ? [ "8" ], useGoogleAPIs ? false, antFlags ? ""
+args@{ name, src, platformVersions ? [ "8" ], useGoogleAPIs ? false, antFlags ? ""
 , release ? false, keyStore ? null, keyAlias ? null, keyStorePassword ? null, keyAliasPassword ? null
+, ...
 }:
 
 assert release -> keyStore != null && keyAlias != null && keyStorePassword != null && keyAliasPassword != null;
@@ -15,9 +16,8 @@ let
     abiVersions = [];
   };
 in
-stdenv.mkDerivation {
+stdenv.mkDerivation ({
   name = stdenv.lib.replaceChars [" "] [""] name;
-  inherit src;
   
   ANDROID_HOME = "${androidsdkComposition}/libexec/android-sdk-${platformName}";
 
@@ -45,4 +45,5 @@ stdenv.mkDerivation {
     mkdir -p $out/nix-support
     echo "file binary-dist \"$(echo $out/*.apk)\"" > $out/nix-support/hydra-build-products
   '';
-}
+} //
+builtins.removeAttrs args ["name"])
diff --git a/pkgs/development/mobile/xcodeenv/xcodewrapper.nix b/pkgs/development/mobile/xcodeenv/xcodewrapper.nix
index 1cbab99e365..7515fcdd121 100644
--- a/pkgs/development/mobile/xcodeenv/xcodewrapper.nix
+++ b/pkgs/development/mobile/xcodeenv/xcodewrapper.nix
@@ -1,4 +1,4 @@
-{stdenv, version ? "4.6"}:
+{stdenv, version ? "5.0"}:
 
 stdenv.mkDerivation {
   name = "xcode-wrapper-"+version;
@@ -9,6 +9,7 @@ stdenv.mkDerivation {
     ln -s /usr/bin/xcodebuild
     ln -s /usr/bin/xcrun
     ln -s /usr/bin/security
+    ln -s /usr/bin/codesign
     ln -s "/Applications/Xcode.app/Contents/Developer/Platforms/iPhoneSimulator.platform/Developer/Applications/iPhone Simulator.app/Contents/MacOS/iPhone Simulator"
 
     cd ..
diff --git a/pkgs/development/tools/haskell/packunused/default.nix b/pkgs/development/tools/haskell/packunused/default.nix
index 814c2774cb2..35d318d36ba 100644
--- a/pkgs/development/tools/haskell/packunused/default.nix
+++ b/pkgs/development/tools/haskell/packunused/default.nix
@@ -2,11 +2,12 @@
 
 cabal.mkDerivation (self: {
   pname = "packunused";
-  version = "0.1.0.0";
-  sha256 = "131x99id3jcxglj24p5sjb6mnhphj925pp4jdjy09y6ai7wss3rs";
+  version = "0.1.0.1";
+  sha256 = "130717k4rknj5jl904cmb4h09msp4xjj84w6iwzc10lz736dk3jd";
   isLibrary = false;
   isExecutable = true;
   buildDepends = [ Cabal cmdargs filepath haskellSrcExts ];
+  jailbreak = true;
   meta = {
     homepage = "https://github.com/hvr/packunused";
     description = "Tool for detecting redundant Cabal package dependencies";
diff --git a/pkgs/development/tools/misc/texinfo/5.1.nix b/pkgs/development/tools/misc/texinfo/5.1.nix
index cca368f619a..2f318f18d54 100644
--- a/pkgs/development/tools/misc/texinfo/5.1.nix
+++ b/pkgs/development/tools/misc/texinfo/5.1.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ ncurses perl ];
 
   preInstall = ''
-    installFlags="TEXMF=$out/texmf";
+    installFlags="TEXMF=$out/texmf-dist";
     installTargets="install install-tex";
   '';
 
diff --git a/pkgs/development/web/nodejs/default.nix b/pkgs/development/web/nodejs/default.nix
index 610cdd09a71..f82fedb7226 100644
--- a/pkgs/development/web/nodejs/default.nix
+++ b/pkgs/development/web/nodejs/default.nix
@@ -6,7 +6,7 @@ let
     ln -sv /usr/sbin/dtrace $out/bin
   '';
 
-  version = "0.10.12";
+  version = "0.10.21";
 
   # !!! Should we also do shared libuv?
   deps = {
@@ -27,7 +27,7 @@ in stdenv.mkDerivation {
 
   src = fetchurl {
     url = "http://nodejs.org/dist/v${version}/node-v${version}.tar.gz";
-    sha256 = "1dlnjjr135h2xcxifb06g33yi2bc5zpvc06985x5cjj56g1sffbk";
+    sha256 = "038l4j0ilrsmc6m2z2qprqs82z7p4940scb8597hcmhp5kr5n4kw";
   };
 
   configureFlags = concatMap sharedConfigureFlags (builtins.attrNames deps);
diff --git a/pkgs/games/flightgear/default.nix b/pkgs/games/flightgear/default.nix
index 9b9e7ab9680..c81bb23ccce 100644
--- a/pkgs/games/flightgear/default.nix
+++ b/pkgs/games/flightgear/default.nix
@@ -1,58 +1,42 @@
-x@{builderDefsPackage
-  , freeglut, freealut, mesa, libICE, libjpeg, openal, openscenegraph, plib
-  , libSM, libunwind, libX11, xproto, libXext, xextproto, libXi, inputproto
-  , libXmu, libXt, simgear, zlib, boost, cmake, libpng
-  , ...}:
-builderDefsPackage
-(a :
-let
-  helperArgNames = ["stdenv" "fetchurl" "builderDefsPackage"] ++
-    [];
+{ stdenv, fetchurl
+, freeglut, freealut, mesa, libICE, libjpeg, openal, openscenegraph, plib
+, libSM, libunwind, libX11, xproto, libXext, xextproto, libXi, inputproto
+, libXmu, libXt, simgear, zlib, boost, cmake, libpng, udev, fltk13, apr
+}:
 
-  buildInputs = map (n: builtins.getAttr n x)
-    (builtins.attrNames (builtins.removeAttrs x helperArgNames));
-  sourceInfo = rec {
-    baseName="flightgear";
-    version="2.10.0";
-    name="${baseName}-${version}";
-    extension="tar.bz2";
-    url="http://ftp.linux.kiev.ua/pub/fgfs/Source/${name}.${extension}";
-    hash="0pq5nwyxwp8ar5rr0jh8p04bv0i9i841m374jwd748csnsn28zh6";
-  };
-in
-rec {
-  src = a.fetchurl {
-    url = sourceInfo.url;
-    sha256 = sourceInfo.hash;
+stdenv.mkDerivation rec {
+  version = "2.12.0";
+  name = "flightgear-${version}";
+
+  src = fetchurl {
+    url = "http://ftp.linux.kiev.ua/pub/fgfs/Source/${name}.tar.bz2";
+    sha256 = "0h9ka4pa2njxbvy5jlmnsjy5ynzms504ygqn7hd80g3c58drsjc4";
   };
 
-  datasrc = a.fetchurl {
-    url = "http://ftp.igh.cnrs.fr/pub/flightgear/ftp/Shared/FlightGear-data-2.0.0.tar.bz2";
-    sha256 = "0kvmvh5qycbpdjx12l20cbhljwimmcgww2dg4lkc2sky0kg14ic1";
+  datasrc = fetchurl {
+    url = "http://ftp.igh.cnrs.fr/pub/flightgear/ftp/Shared/FlightGear-data-${version}.tar.bz";
+    sha256 = "0qjvcj2cz7ypa91v95lws44fg8c1p0pazv24ljkai2m2r0jgsv8k";
   };
 
-  inherit (sourceInfo) name version;
-  inherit buildInputs;
+  buildInputs = [
+    freeglut freealut mesa libICE libjpeg openal openscenegraph plib
+    libSM libunwind libX11 xproto libXext xextproto libXi inputproto
+    libXmu libXt simgear zlib boost cmake libpng udev fltk13 apr
+  ];
 
-  /* doConfigure should be removed if not needed */
-  phaseNames = ["doCmake" "doMakeInstall" "deployData"];
+  preConfigure = ''
+    export cmakeFlagsArray=(-DFG_DATA_DIR="$out/share/FlightGear/")
+  '';
 
-  deployData = a.fullDepEntry ''
+  postInstall = ''
     mkdir -p "$out/share/FlightGear"
-    cd "$out/share/FlightGear"
-    tar xvf ${datasrc}
-  '' ["minInit" "defEnsureDir"];
+    tar xvf "${datasrc}" -C "$out/share/FlightGear/" --strip-components=1
+  '';
 
-  meta = {
-    description = "A flight simulator";
-    maintainers = with a.lib.maintainers;
-    [
-      raskin
-    ];
-    #platforms = a.lib.platforms.linux;
-    license = a.lib.licenses.gpl2;
+  meta = with stdenv.lib; {
+    description = "Flight simulator";
+    maintainers = with maintainers; [ raskin ];
+    #platforms = platforms.linux; # disabled from hydra because it's so big
+    license = licenses.gpl2;
   };
-  passthru = {
-  };
-}) x
-
+}
diff --git a/pkgs/games/gsb/default.nix b/pkgs/games/gsb/default.nix
new file mode 100644
index 00000000000..52c3830c22a
--- /dev/null
+++ b/pkgs/games/gsb/default.nix
@@ -0,0 +1,74 @@
+{ stdenv, config, requireFile
+, curl3, SDL, SDL_image, libpng12, libjpeg62, libvorbis, libogg, openal, mesa
+, libX11, libXext, libXft, fontconfig, zlib }:
+
+assert stdenv.system == "i686-linux" || stdenv.system == "x86_64-linux";
+
+stdenv.mkDerivation rec {
+  name = "gsb-1.56.0";
+
+  goBuyItNow = '' 
+    We cannot download the full version automatically, as you require a license.
+    Once you bought a license, you need to add your downloaded version to the nix store.
+    You can do this by using "nix-prefetch-url file://gsb1324679796.tar.gz" in the
+    directory where you saved it.
+  ''; 
+
+  src = requireFile {
+     message = goBuyItNow;
+     name = "gsb1324679796.tar.gz";
+     sha256 = "12jsz9v55w9zxwiz4kbm6phkv60q3c2kyv5imsls13385pzwcs8i";
+  };
+
+  arch = if stdenv.system == "i686-linux" then "x86" else "x86_64";
+
+  phases = "unpackPhase installPhase";
+
+  # XXX: stdenv.lib.makeLibraryPath doesn't pick up /lib64
+  libPath = stdenv.lib.makeLibraryPath [ stdenv.gcc.gcc stdenv.gcc.libc ] 
+    + ":" + stdenv.lib.makeLibraryPath [ SDL SDL_image libjpeg62 libpng12 mesa ]
+    + ":" + stdenv.lib.makeLibraryPath [ curl3 openal libvorbis libogg ]
+    + ":" + stdenv.lib.makeLibraryPath [ libX11 libXext libXft fontconfig zlib ]
+    + ":" + stdenv.gcc.gcc + "/lib64";
+
+  installPhase = ''
+    ensureDir $out/libexec/positech/GSB/
+    ensureDir $out/bin
+
+    patchelf \
+      --interpreter "$(cat $NIX_GCC/nix-support/dynamic-linker)" \
+      --set-rpath $libPath \
+      ./GSB.bin.$arch
+
+    cp -r * $out/libexec/positech/GSB/
+    rm -rf $out/libexec/positech/GSB/lib64/
+    rm -rf $out/libexec/positech/GSB/lib/
+
+    #makeWrapper doesn't do cd. :(
+
+    cat > $out/bin/GSB << EOF
+    #!/bin/sh
+    cd $out/libexec/positech/GSB
+    exec ./GSB.bin.$arch
+    EOF
+    chmod +x $out/bin/GSB
+  '';
+
+  meta = {
+    description = "Gratuitous Space Battles";
+    longDescription = ''
+      a strategy / management / simulation game that does away with all the
+      base building and delays and gets straight to the meat and potatoes of
+      science-fiction games : The big space battles fought by huge spaceships with
+      tons of laser beams and things going 'zap!', 'ka-boom!' and 'ka-pow!'. In GSB
+      you put your ships together from modular components, arrange them into fleets,
+      give your ships orders of engagement and then hope they emerge victorious from
+      battle (or at least blow to bits in aesthetically pleasing ways).
+    '';
+    homepage = http://www.positech.co.uk/gratuitousspacebattles/index.html;
+    license = [ "unfree" ];
+    maintainers = with stdenv.lib.maintainers; [ jcumming ];
+    platforms = [ "x86_64-linux" "i686-linux" ] ;
+  };
+
+}
diff --git a/pkgs/games/sdlmame/default.nix b/pkgs/games/sdlmame/default.nix
new file mode 100644
index 00000000000..bd6e9011178
--- /dev/null
+++ b/pkgs/games/sdlmame/default.nix
@@ -0,0 +1,44 @@
+{ stdenv, fetchurl, alsaLib, qt48, SDL, fontconfig, freetype, SDL_ttf, xlibs }:
+
+assert stdenv.system == "x86_64-linux" || stdenv.system == "1686-linux";
+
+stdenv.mkDerivation rec {
+  version = "0.150.u0-1";
+  name    = "sdlmame-${version}";
+
+  src = if stdenv.system == "x86_64-linux"
+    then fetchurl {
+      url    = "ftp://ftp.archlinux.org/community/os/x86_64/${name}-x86_64.pkg.tar.xz";
+      sha256 = "0393xnzrzq53szmicn96lvapm66wmlykdxaa1n7smx8a0mcz0kah";
+    }
+    else fetchurl {
+      url    = "ftp://ftp.archlinux.org/community/os/i686/${name}-i686.pkg.tar.xz";
+      sha256 = "0js67w2szd0qs7ycgxb3bbmcdziv1fywyd9ihra2f6bq5rhcs2jp";
+    };
+
+  buildPhase = ''
+    sed -i "s|/usr|$out|" bin/sdlmame
+  '';
+
+  installPhase = ''
+    patchelf \
+      --set-interpreter "$(cat $NIX_GCC/nix-support/dynamic-linker)" \
+      --set-rpath "${alsaLib}/lib:${qt48}/lib:${SDL}/lib:${fontconfig}/lib:${freetype}/lib:${SDL_ttf}/lib:${xlibs.libX11}/lib:${xlibs.libXinerama}/lib:${stdenv.gcc.gcc}/lib" \
+      share/sdlmame/sdlmame
+
+    mkdir -p "$out/bin"
+    cp -r bin/sdlmame "$out/bin"
+    cp -r share "$out"
+  '';
+
+  dontPatchELF = true;
+  dontStrip    = true;
+
+  meta = with stdenv.lib; {
+    homepage    = http://sdlmame.lngn.net;
+    description = "A port of the popular Multiple Arcade Machine Emulator using SDL with OpenGL support.";
+    license     = "MAME";
+    maintainers = with maintainers; [ lovek323 ];
+    platforms   = platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/conspy/default.nix b/pkgs/os-specific/linux/conspy/default.nix
new file mode 100644
index 00000000000..44689cd5d62
--- /dev/null
+++ b/pkgs/os-specific/linux/conspy/default.nix
@@ -0,0 +1,37 @@
+{stdenv, fetchurl, autoconf, automake, ncurses}:
+let
+  s = # Generated upstream information
+  rec {
+    baseName="conspy";
+    version="1.8";
+    name="${baseName}-${version}";
+    hash=sha256;
+    url="http://ace-host.stuart.id.au/russell/files/conspy/conspy-1.8.tar.gz";
+    sha256="1jc2maqp4w4mzlr3s8yni03w1p9sir5hb7gha3ffxj4n32nx42dq";
+  };
+  buildInputs = [
+    autoconf automake ncurses
+  ];
+in
+stdenv.mkDerivation {
+  inherit (s) name version;
+  inherit buildInputs;
+  src = fetchurl {
+    inherit (s) url sha256;
+    curlOpts = " -A application/octet-stream ";
+  };
+  preConfigure = ''
+    touch NEWS
+    echo "EPL 1.0" > COPYING
+    aclocal
+    automake --add-missing
+    autoconf
+  '';
+  meta = {
+    inherit (s) version;
+    description = "Linux text console viewer";
+    license = stdenv.lib.licenses.epl10 ;
+    maintainers = [stdenv.lib.maintainers.raskin];
+    platforms = stdenv.lib.platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/conspy/default.upstream b/pkgs/os-specific/linux/conspy/default.upstream
new file mode 100644
index 00000000000..db0c0fd9680
--- /dev/null
+++ b/pkgs/os-specific/linux/conspy/default.upstream
@@ -0,0 +1 @@
+url http://ace-host.stuart.id.au/russell/files/conspy/
diff --git a/pkgs/os-specific/linux/i7z/default.nix b/pkgs/os-specific/linux/i7z/default.nix
index 2d0fde3c783..33ac05aef47 100644
--- a/pkgs/os-specific/linux/i7z/default.nix
+++ b/pkgs/os-specific/linux/i7z/default.nix
@@ -1,19 +1,15 @@
 { stdenv, fetchurl, qt4, ncurses}:
 
 stdenv.mkDerivation rec {
-  name = "i7z-0.27.1";
+  name = "i7z-0.27.2";
 
   src = fetchurl {
     url = "http://i7z.googlecode.com/files/${name}.tar.gz";
-    sha256 = "0n3pry1qmpq4basnny3gddls2zlwz0813ixnas87092rvlgjhbc6";
+    sha256 = "1wa7ix6m75wl3k2n88sz0x8cckvlzqklja2gvzqfw5rcfdjjvxx7";
   };
 
   buildInputs = [qt4 ncurses];
 
-  patchPhase = ''
-    substituteInPlace Makefile --replace "/usr/sbin" "$out/sbin"
-  '';
-
   buildPhase = ''
     make
     cd GUI
@@ -24,15 +20,15 @@ stdenv.mkDerivation rec {
   '';
 
   installPhase = ''
-    pwd
     ensureDir $out/sbin
-    make install
+    make install prefix=$out
     install -Dm755 GUI/i7z_GUI $out/sbin/i7z-gui
   '';
 
   meta = {
     description = "A better i7 (and now i3, i5) reporting tool for Linux";
     homepage = http://code.google.com/p/i7z;
+    repositories.git = https://github.com/ajaiantilal/i7z.git;
     license = "GPLv2";
     maintainers = [ stdenv.lib.maintainers.bluescreen303 ];
   };
diff --git a/pkgs/os-specific/linux/kernel/linux-3.11.nix b/pkgs/os-specific/linux/kernel/linux-3.11.nix
index 6a3320669a5..6531895d8a7 100644
--- a/pkgs/os-specific/linux/kernel/linux-3.11.nix
+++ b/pkgs/os-specific/linux/kernel/linux-3.11.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "3.11.4";
+  version = "3.11.6";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz";
-    sha256 = "1kv6j7mc5r5qw43kirc0fv83khpnwy8m7158qf8ar08p3r01i3mi";
+    sha256 = "0klbyx6qy3ifwrwh5w7yzk6m6jd32flkk73z95bih3ihmbnbzlvs";
   };
 
   features.iwlwifi = true;
diff --git a/pkgs/os-specific/linux/kernel/linux-3.12.nix b/pkgs/os-specific/linux/kernel/linux-3.12.nix
index f7cd2892051..f0929af1d29 100644
--- a/pkgs/os-specific/linux/kernel/linux-3.12.nix
+++ b/pkgs/os-specific/linux/kernel/linux-3.12.nix
@@ -4,7 +4,7 @@ import ./generic.nix (args // rec {
   version = "3.12-rc3";
 
   src = fetchurl {
-    url = "https://www.kernel.org/pub/linux/kernel/v3.0/testing/linux-${version}.tar.gz";
+    url = "https://www.kernel.org/pub/linux/kernel/v3.0/testing/linux-${version}.tar.xz";
     sha256 = "1rayb0f4n81yp9ghcws0v36dpqyl9ks3naf37p2qy7jvrwagmj28";
   };
 
diff --git a/pkgs/os-specific/linux/kernel/linux-3.4.nix b/pkgs/os-specific/linux/kernel/linux-3.4.nix
index 79f53b22216..d37ca172479 100644
--- a/pkgs/os-specific/linux/kernel/linux-3.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-3.4.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "3.4.65";
+  version = "3.4.66";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz";
-    sha256 = "1amy6gdqnk0klqmghkdfn2fv1rd30pqvqwx6ix27gf3hmn4s823z";
+    sha256 = "09jrj989mqk76klrg5zq1z8qrx3gif69bqi78ywq3jky8dmrwz3y";
   };
 
   features.iwlwifi = true;
diff --git a/pkgs/os-specific/linux/kernel/patches.nix b/pkgs/os-specific/linux/kernel/patches.nix
index 73533104ca9..5bda5b1f263 100644
--- a/pkgs/os-specific/linux/kernel/patches.nix
+++ b/pkgs/os-specific/linux/kernel/patches.nix
@@ -134,9 +134,11 @@ rec {
   grsecurity_2_9_1_3_2_51 =
     { name = "grsecurity-2.9.1-3.2.51";
       patch = fetchurl {
-        url = http://grsecurity.net/stable/grsecurity-2.9.1-3.2.51-201309101928.patch;
-        sha256 = "90f9ddc74d56f4525b8faa8505a95f45c23a2e763c7519ba5ae953069a51aca2";
+        url = http://grsecurity.net/stable/grsecurity-2.9.1-3.2.51-201309281102.patch;
+        sha256 = "0mwwdmccihzhl25c9q92x0k33c5kxbz6mikid9diramvki7sk0l8";
       };
+      # The grsec kernel patch seems to include the apparmor patches as of 2.9.1-3.2.51
+      features.apparmor = true;
     };
 
 }
diff --git a/pkgs/os-specific/linux/systemd/0001-Make-systemctl-daemon-reexec-do-the-right-thing-on-N.patch b/pkgs/os-specific/linux/systemd/0001-Make-systemctl-daemon-reexec-do-the-right-thing-on-N.patch
deleted file mode 100644
index 84a03dd9733..00000000000
--- a/pkgs/os-specific/linux/systemd/0001-Make-systemctl-daemon-reexec-do-the-right-thing-on-N.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From 8f861550827e750fb56954c3f91a2f565abb42bb Mon Sep 17 00:00:00 2001
-From: Eelco Dolstra <eelco.dolstra@logicblox.com>
-Date: Tue, 8 Jan 2013 15:44:33 +0100
-Subject: [PATCH 01/11] Make "systemctl daemon-reexec" do the right thing on
- NixOS
-
----
- src/core/main.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/core/main.c b/src/core/main.c
-index 7fc06be..7575223 100644
---- a/src/core/main.c
-+++ b/src/core/main.c
-@@ -1857,7 +1857,7 @@ finish:
-                         char_array_0(sfd);
- 
-                         i = 0;
--                        args[i++] = SYSTEMD_BINARY_PATH;
-+                        args[i++] = "/run/current-system/systemd/lib/systemd/systemd";
-                         if (switch_root_dir)
-                                 args[i++] = "--switched-root";
-                         args[i++] = arg_running_as == SYSTEMD_SYSTEM ? "--system" : "--user";
--- 
-1.8.3.4
-
diff --git a/pkgs/os-specific/linux/systemd/0002-Ignore-duplicate-paths-in-systemctl-start.patch b/pkgs/os-specific/linux/systemd/0002-Ignore-duplicate-paths-in-systemctl-start.patch
deleted file mode 100644
index 15946506ac1..00000000000
--- a/pkgs/os-specific/linux/systemd/0002-Ignore-duplicate-paths-in-systemctl-start.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From 2afcee0b4da066fb5f8fc00b749d88f5bd9df3d3 Mon Sep 17 00:00:00 2001
-From: Eelco Dolstra <eelco.dolstra@logicblox.com>
-Date: Tue, 8 Jan 2013 15:45:01 +0100
-Subject: [PATCH 02/11] Ignore duplicate paths in "systemctl start"
-
----
- src/systemctl/systemctl.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/systemctl/systemctl.c b/src/systemctl/systemctl.c
-index 3cca861..16791a2 100644
---- a/src/systemctl/systemctl.c
-+++ b/src/systemctl/systemctl.c
-@@ -1867,7 +1867,7 @@ static int start_unit_one(
-                         return log_oom();
- 
-                 r = set_consume(s, p);
--                if (r < 0) {
-+                if (r < 0 && r != -EEXIST) {
-                         log_error("Failed to add path to set.");
-                         return r;
-                 }
--- 
-1.8.3.4
-
diff --git a/pkgs/os-specific/linux/systemd/0003-Start-device-units-for-uninitialised-encrypted-devic.patch b/pkgs/os-specific/linux/systemd/0003-Start-device-units-for-uninitialised-encrypted-devic.patch
deleted file mode 100644
index 2927d6e4dc6..00000000000
--- a/pkgs/os-specific/linux/systemd/0003-Start-device-units-for-uninitialised-encrypted-devic.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From b288ca7d376e3a78368a2b59529ebe5ba812babf Mon Sep 17 00:00:00 2001
-From: Eelco Dolstra <eelco.dolstra@logicblox.com>
-Date: Tue, 8 Jan 2013 15:46:30 +0100
-Subject: [PATCH 03/11] Start device units for uninitialised encrypted devices
-
-This is necessary because the NixOS service that initialises the
-filesystem depends on the appearance of the device unit.  Also, this
-makes more sense to me: the device is ready; it's the filesystem
-that's not, but taking care of that is the responsibility of the mount
-unit.  (However, this ignores the fsck unit, so it's not perfect...)
----
- rules/99-systemd.rules.in | 4 ----
- 1 file changed, 4 deletions(-)
-
-diff --git a/rules/99-systemd.rules.in b/rules/99-systemd.rules.in
-index d17bdd9..040b10e 100644
---- a/rules/99-systemd.rules.in
-+++ b/rules/99-systemd.rules.in
-@@ -14,10 +14,6 @@ KERNEL=="vport*", TAG+="systemd"
- SUBSYSTEM=="block", KERNEL!="ram*|loop*", TAG+="systemd"
- SUBSYSTEM=="block", KERNEL!="ram*|loop*", ENV{DM_UDEV_DISABLE_OTHER_RULES_FLAG}=="1", ENV{SYSTEMD_READY}="0"
- 
--# Ignore encrypted devices with no identified superblock on it, since
--# we are probably still calling mke2fs or mkswap on it.
--SUBSYSTEM=="block", KERNEL!="ram*|loop*", ENV{DM_UUID}=="CRYPT-*", ENV{ID_PART_TABLE_TYPE}=="", ENV{ID_FS_USAGE}=="", ENV{SYSTEMD_READY}="0"
--
- # Ignore raid devices that are not yet assembled and started
- SUBSYSTEM=="block", ENV{DEVTYPE}=="disk", KERNEL=="md*", TEST!="md/array_state", ENV{SYSTEMD_READY}="0"
- SUBSYSTEM=="block", ENV{DEVTYPE}=="disk", KERNEL=="md*", ATTR{md/array_state}=="|clear|inactive", ENV{SYSTEMD_READY}="0"
--- 
-1.8.3.4
-
diff --git a/pkgs/os-specific/linux/systemd/0004-Set-switch-to-configuration-hints-for-some-units.patch b/pkgs/os-specific/linux/systemd/0004-Set-switch-to-configuration-hints-for-some-units.patch
deleted file mode 100644
index 54fcf9c3e1e..00000000000
--- a/pkgs/os-specific/linux/systemd/0004-Set-switch-to-configuration-hints-for-some-units.patch
+++ /dev/null
@@ -1,74 +0,0 @@
-From 7a498e661f3d111fa09700a6cfa62cfd6733b1cc Mon Sep 17 00:00:00 2001
-From: Eelco Dolstra <eelco.dolstra@logicblox.com>
-Date: Tue, 8 Jan 2013 15:48:19 +0100
-Subject: [PATCH 04/11] Set switch-to-configuration hints for some units
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Target units like local-fs.target need ‘X-StopOnReconfiguration=yes’
-to ensure dependencies *on* that target properly take into account the
-dependencies *of* the target.
-
-‘X-RestartIfChanged=no’ is necessary for systemd-journald.service
-because restarting it causes services connected to journald to stop
-logging.
-
-‘X-RestartIfChanged=no’ is necessary for systemd-user-sessions.service
-to prevent all user sessions from being killed when this unit changes.
----
- units/local-fs.target                  | 2 ++
- units/remote-fs.target                 | 2 ++
- units/systemd-journald.service.in      | 5 +++++
- units/systemd-user-sessions.service.in | 3 +++
- 4 files changed, 12 insertions(+)
-
-diff --git a/units/local-fs.target b/units/local-fs.target
-index 18c3d74..a09054c 100644
---- a/units/local-fs.target
-+++ b/units/local-fs.target
-@@ -11,3 +11,5 @@ Documentation=man:systemd.special(7)
- After=local-fs-pre.target
- OnFailure=emergency.target
- OnFailureIsolate=no
-+
-+X-StopOnReconfiguration=yes
-diff --git a/units/remote-fs.target b/units/remote-fs.target
-index 09213e8..47b4cf5 100644
---- a/units/remote-fs.target
-+++ b/units/remote-fs.target
-@@ -10,5 +10,7 @@ Description=Remote File Systems
- Documentation=man:systemd.special(7)
- After=remote-fs-pre.target
- 
-+X-StopOnReconfiguration=yes
-+
- [Install]
- WantedBy=multi-user.target
-diff --git a/units/systemd-journald.service.in b/units/systemd-journald.service.in
-index ab2e50c..9563a7d 100644
---- a/units/systemd-journald.service.in
-+++ b/units/systemd-journald.service.in
-@@ -24,3 +24,8 @@ CapabilityBoundingSet=CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_SYS_PTRACE CAP_SYSLOG C
- # Increase the default a bit in order to allow many simultaneous
- # services being run since we keep one fd open per service.
- LimitNOFILE=16384
-+
-+# Don't restart journald, since that causes services connected to
-+# journald to stop logging (see
-+# https://bugs.freedesktop.org/show_bug.cgi?id=56043).
-+X-RestartIfChanged=no
-diff --git a/units/systemd-user-sessions.service.in b/units/systemd-user-sessions.service.in
-index 0869e73..b6ed958 100644
---- a/units/systemd-user-sessions.service.in
-+++ b/units/systemd-user-sessions.service.in
-@@ -15,3 +15,6 @@ Type=oneshot
- RemainAfterExit=yes
- ExecStart=@rootlibexecdir@/systemd-user-sessions start
- ExecStop=@rootlibexecdir@/systemd-user-sessions stop
-+
-+# Restart kills all active sessions.
-+X-RestartIfChanged=no
--- 
-1.8.3.4
-
diff --git a/pkgs/os-specific/linux/systemd/0005-sysinit.target-Drop-the-dependency-on-local-fs.targe.patch b/pkgs/os-specific/linux/systemd/0005-sysinit.target-Drop-the-dependency-on-local-fs.targe.patch
deleted file mode 100644
index 9cbb2f716a8..00000000000
--- a/pkgs/os-specific/linux/systemd/0005-sysinit.target-Drop-the-dependency-on-local-fs.targe.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From e6bbe5fa858bd8196c8e1f264904679e6bda426d Mon Sep 17 00:00:00 2001
-From: Eelco Dolstra <eelco.dolstra@logicblox.com>
-Date: Tue, 8 Jan 2013 15:56:03 +0100
-Subject: [PATCH 05/11] sysinit.target: Drop the dependency on local-fs.target
- and swap.target
-
-Having all services with DefaultDependencies=yes depend on
-local-fs.target is annoying, because some of those services might be
-necessary to mount local filesystems.  For instance, Charon's
-send-keys feature requires sshd to be running in order to receive LUKS
-encryption keys, which in turn requires dhcpcd, and so on.  So we drop
-this dependency (and swap.target as well for consistency).  If
-services require a specific mount, they should use RequiresMountsFor
-in any case.
----
- units/sysinit.target | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
-diff --git a/units/sysinit.target b/units/sysinit.target
-index 8f4fb8f..e0f0147 100644
---- a/units/sysinit.target
-+++ b/units/sysinit.target
-@@ -9,6 +9,5 @@
- Description=System Initialization
- Documentation=man:systemd.special(7)
- Conflicts=emergency.service emergency.target
--Wants=local-fs.target swap.target
--After=local-fs.target swap.target emergency.service emergency.target
-+After=emergency.service emergency.target
- RefuseManualStart=yes
--- 
-1.8.3.4
-
diff --git a/pkgs/os-specific/linux/systemd/0006-Don-t-call-plymouth-quit.patch b/pkgs/os-specific/linux/systemd/0006-Don-t-call-plymouth-quit.patch
deleted file mode 100644
index d73733a68b0..00000000000
--- a/pkgs/os-specific/linux/systemd/0006-Don-t-call-plymouth-quit.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From 4731a9074538e9e24d2b81fc737917b064e194e6 Mon Sep 17 00:00:00 2001
-From: Eelco Dolstra <eelco.dolstra@logicblox.com>
-Date: Tue, 8 Jan 2013 18:36:28 +0100
-Subject: [PATCH 06/11] Don't call "plymouth quit"
-
-NixOS doesn't use Plymouth (yet).
----
- units/emergency.service.in | 1 -
- units/rescue.service.m4.in | 1 -
- 2 files changed, 2 deletions(-)
-
-diff --git a/units/emergency.service.in b/units/emergency.service.in
-index 442f0e0..6b7eafd 100644
---- a/units/emergency.service.in
-+++ b/units/emergency.service.in
-@@ -15,7 +15,6 @@ Before=shutdown.target
- [Service]
- Environment=HOME=/root
- WorkingDirectory=/root
--ExecStartPre=-/bin/plymouth quit
- ExecStartPre=-/bin/echo -e 'Welcome to emergency mode! After logging in, type "journalctl -xb" to view\\nsystem logs, "systemctl reboot" to reboot, "systemctl default" to try again\\nto boot into default mode.'
- ExecStart=-/sbin/sulogin
- ExecStopPost=@SYSTEMCTL@ --fail --no-block default
-diff --git a/units/rescue.service.m4.in b/units/rescue.service.m4.in
-index 269797a..2c640f4 100644
---- a/units/rescue.service.m4.in
-+++ b/units/rescue.service.m4.in
-@@ -16,7 +16,6 @@ Before=shutdown.target
- [Service]
- Environment=HOME=/root
- WorkingDirectory=/root
--ExecStartPre=-/bin/plymouth quit
- ExecStartPre=-/bin/echo -e 'Welcome to rescue mode! Type "systemctl default" or ^D to enter default mode.\\nType "journalctl -xb" to view system logs. Type "systemctl reboot" to reboot.'
- ExecStart=-/sbin/sulogin
- ExecStopPost=-@SYSTEMCTL@ --fail --no-block default
--- 
-1.8.3.4
-
diff --git a/pkgs/os-specific/linux/systemd/0007-Ignore-IPv6-link-local-addresses.patch b/pkgs/os-specific/linux/systemd/0007-Ignore-IPv6-link-local-addresses.patch
deleted file mode 100644
index f3b3103fe68..00000000000
--- a/pkgs/os-specific/linux/systemd/0007-Ignore-IPv6-link-local-addresses.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From f0c362873860526579bf9bda216005fd5a0936dd Mon Sep 17 00:00:00 2001
-From: Eelco Dolstra <eelco.dolstra@logicblox.com>
-Date: Mon, 4 Feb 2013 12:41:14 +0100
-Subject: [PATCH 07/11] Ignore IPv6 link-local addresses
-
-Returning IPv6 link-local addresses is a bad idea, because they only
-work if an application connects specifically over the corresponding
-interface.  So you get errors like:
-
-  $ curl -6 http://my-machine/
-  curl: (7) Failed to connect to fe80::d6be:d9ff:fe1b:8477: Invalid argument
-
-To prevent this, this patch filters out link-local addresses.  So if
-you don't have a routable IPv6 address, nss-myhostname will fall back
-to returning ::1.
----
- src/nss-myhostname/netlink.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/src/nss-myhostname/netlink.c b/src/nss-myhostname/netlink.c
-index b1ef912..4f2ab5c 100644
---- a/src/nss-myhostname/netlink.c
-+++ b/src/nss-myhostname/netlink.c
-@@ -113,6 +113,10 @@ static int read_reply(int fd, struct address **list, unsigned *n_list) {
-                     ifaddrmsg->ifa_scope == RT_SCOPE_NOWHERE)
-                         continue;
- 
-+                if (ifaddrmsg->ifa_family == AF_INET6 &&
-+                    ifaddrmsg->ifa_scope == RT_SCOPE_LINK)
-+                        continue;
-+
-                 if (ifaddrmsg->ifa_flags & IFA_F_DEPRECATED)
-                         continue;
- 
--- 
-1.8.3.4
-
diff --git a/pkgs/os-specific/linux/systemd/0008-Don-t-try-to-unmount-nix-or-nix-store.patch b/pkgs/os-specific/linux/systemd/0008-Don-t-try-to-unmount-nix-or-nix-store.patch
deleted file mode 100644
index 252f1cde79a..00000000000
--- a/pkgs/os-specific/linux/systemd/0008-Don-t-try-to-unmount-nix-or-nix-store.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-From 0112df74e576dd683c132ec33861b7099dc94454 Mon Sep 17 00:00:00 2001
-From: Eelco Dolstra <eelco.dolstra@logicblox.com>
-Date: Fri, 12 Apr 2013 13:16:57 +0200
-Subject: [PATCH 08/11] Don't try to unmount /nix or /nix/store
-
-They'll still be remounted read-only.
-
-https://github.com/NixOS/nixos/issues/126
----
- src/core/umount.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/src/core/umount.c b/src/core/umount.c
-index 1e95ad7..9f0e471 100644
---- a/src/core/umount.c
-+++ b/src/core/umount.c
-@@ -435,6 +435,8 @@ static int mount_points_list_umount(MountPoint **head, bool *changed, bool log_e
-                  * anyway, since we are running from it. They have
-                  * already been remounted ro. */
-                 if (path_equal(m->path, "/")
-+                    || path_equal(m->path, "/nix")
-+                    || path_equal(m->path, "/nix/store")
- #ifndef HAVE_SPLIT_USR
-                     || path_equal(m->path, "/usr")
- #endif
--- 
-1.8.3.4
-
diff --git a/pkgs/os-specific/linux/systemd/0009-Start-ctrl-alt-del.target-irreversibly.patch b/pkgs/os-specific/linux/systemd/0009-Start-ctrl-alt-del.target-irreversibly.patch
deleted file mode 100644
index 8a78ded4b0d..00000000000
--- a/pkgs/os-specific/linux/systemd/0009-Start-ctrl-alt-del.target-irreversibly.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From ed7c22c76e1399861ec8e0216f08a7f9419eea50 Mon Sep 17 00:00:00 2001
-From: Eelco Dolstra <eelco.dolstra@logicblox.com>
-Date: Tue, 7 May 2013 14:03:13 +0200
-Subject: [PATCH 09/11] Start ctrl-alt-del.target irreversibly
-
-This makes ctrl-alt-del reboots more robust, just like "systemctl
-reboot".
----
- src/core/manager.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/core/manager.c b/src/core/manager.c
-index c7f8f20..0508628 100644
---- a/src/core/manager.c
-+++ b/src/core/manager.c
-@@ -1372,7 +1372,7 @@ static int manager_process_signal_fd(Manager *m) {
- 
-                 case SIGINT:
-                         if (m->running_as == SYSTEMD_SYSTEM) {
--                                manager_start_target(m, SPECIAL_CTRL_ALT_DEL_TARGET, JOB_REPLACE);
-+                                manager_start_target(m, SPECIAL_CTRL_ALT_DEL_TARGET, JOB_REPLACE_IRREVERSIBLY);
-                                 break;
-                         }
- 
--- 
-1.8.3.4
-
diff --git a/pkgs/os-specific/linux/systemd/0010-Fix-CPUShares-configuration-option.patch b/pkgs/os-specific/linux/systemd/0010-Fix-CPUShares-configuration-option.patch
deleted file mode 100644
index 1f4852e6bfa..00000000000
--- a/pkgs/os-specific/linux/systemd/0010-Fix-CPUShares-configuration-option.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From 687e657cd320cb4d4ae442e3529ae9571108bb6e Mon Sep 17 00:00:00 2001
-From: Eelco Dolstra <eelco.dolstra@logicblox.com>
-Date: Fri, 24 May 2013 13:34:53 -0400
-Subject: [PATCH 10/11] Fix CPUShares configuration option
-
-This fixes the error message "Unknown or unsupported cgroup attribute
-CPUShares".
----
- src/core/cgroup-semantics.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/core/cgroup-semantics.c b/src/core/cgroup-semantics.c
-index 82b02bb..7df9d01 100644
---- a/src/core/cgroup-semantics.c
-+++ b/src/core/cgroup-semantics.c
-@@ -255,7 +255,7 @@ static int map_blkio(const CGroupSemantics *s, const char *value, char **ret) {
- }
- 
- static const CGroupSemantics semantics[] = {
--        { "cpu",     "cpu.shares",                 "CPUShare",              false, parse_cpu_shares,          NULL,       NULL },
-+        { "cpu",     "cpu.shares",                 "CPUShares",             false, parse_cpu_shares,          NULL,       NULL },
-         { "memory",  "memory.soft_limit_in_bytes", "MemorySoftLimit",       false, parse_memory_limit,        NULL,       NULL },
-         { "memory",  "memory.limit_in_bytes",      "MemoryLimit",           false, parse_memory_limit,        NULL,       NULL },
-         { "devices", "devices.allow",              "DeviceAllow",           true,  parse_device,              map_device, NULL },
--- 
-1.8.3.4
-
diff --git a/pkgs/os-specific/linux/systemd/0011-polkit-Avoid-race-condition-in-scraping-proc.patch b/pkgs/os-specific/linux/systemd/0011-polkit-Avoid-race-condition-in-scraping-proc.patch
deleted file mode 100644
index 08446db72c5..00000000000
--- a/pkgs/os-specific/linux/systemd/0011-polkit-Avoid-race-condition-in-scraping-proc.patch
+++ /dev/null
@@ -1,75 +0,0 @@
-From ab7707b4a9b1b7615bfe2e30e4a2bc9cb5261766 Mon Sep 17 00:00:00 2001
-From: Colin Walters <walters@verbum.org>
-Date: Thu, 22 Aug 2013 13:55:21 -0400
-Subject: [PATCH 11/11] polkit: Avoid race condition in scraping /proc
-
-If a calling process execve()s a setuid program, it can appear to be
-uid 0.  Since we're receiving requests over DBus, avoid this by simply
-passing system-bus-name as a subject.
----
- src/shared/polkit.c | 31 +++++--------------------------
- 1 file changed, 5 insertions(+), 26 deletions(-)
-
-diff --git a/src/shared/polkit.c b/src/shared/polkit.c
-index cea7074..1c5e9e3 100644
---- a/src/shared/polkit.c
-+++ b/src/shared/polkit.c
-@@ -38,12 +38,8 @@ int verify_polkit(
- 
- #ifdef ENABLE_POLKIT
-         DBusMessage *m = NULL, *reply = NULL;
--        const char *unix_process = "unix-process", *pid = "pid", *starttime = "start-time", *cancel_id = "";
-+        const char *system_bus_name = "system-bus-name", *name = "name", *cancel_id = "";
-         uint32_t flags = interactive ? 1 : 0;
--        pid_t pid_raw;
--        uint32_t pid_u32;
--        unsigned long long starttime_raw;
--        uint64_t starttime_u64;
-         DBusMessageIter iter_msg, iter_struct, iter_array, iter_dict, iter_variant;
-         int r;
-         dbus_bool_t authorized = FALSE, challenge = FALSE;
-@@ -68,14 +64,6 @@ int verify_polkit(
- 
- #ifdef ENABLE_POLKIT
- 
--        pid_raw = bus_get_unix_process_id(c, sender, error);
--        if (pid_raw == 0)
--                return -EINVAL;
--
--        r = get_starttime_of_pid(pid_raw, &starttime_raw);
--        if (r < 0)
--                return r;
--
-         m = dbus_message_new_method_call(
-                         "org.freedesktop.PolicyKit1",
-                         "/org/freedesktop/PolicyKit1/Authority",
-@@ -86,22 +74,13 @@ int verify_polkit(
- 
-         dbus_message_iter_init_append(m, &iter_msg);
- 
--        pid_u32 = (uint32_t) pid_raw;
--        starttime_u64 = (uint64_t) starttime_raw;
--
-         if (!dbus_message_iter_open_container(&iter_msg, DBUS_TYPE_STRUCT, NULL, &iter_struct) ||
--            !dbus_message_iter_append_basic(&iter_struct, DBUS_TYPE_STRING, &unix_process) ||
-+            !dbus_message_iter_append_basic(&iter_struct, DBUS_TYPE_STRING, &system_bus_name) ||
-             !dbus_message_iter_open_container(&iter_struct, DBUS_TYPE_ARRAY, "{sv}", &iter_array) ||
-             !dbus_message_iter_open_container(&iter_array, DBUS_TYPE_DICT_ENTRY, NULL, &iter_dict) ||
--            !dbus_message_iter_append_basic(&iter_dict, DBUS_TYPE_STRING, &pid) ||
--            !dbus_message_iter_open_container(&iter_dict, DBUS_TYPE_VARIANT, "u", &iter_variant) ||
--            !dbus_message_iter_append_basic(&iter_variant, DBUS_TYPE_UINT32, &pid_u32) ||
--            !dbus_message_iter_close_container(&iter_dict, &iter_variant) ||
--            !dbus_message_iter_close_container(&iter_array, &iter_dict) ||
--            !dbus_message_iter_open_container(&iter_array, DBUS_TYPE_DICT_ENTRY, NULL, &iter_dict) ||
--            !dbus_message_iter_append_basic(&iter_dict, DBUS_TYPE_STRING, &starttime) ||
--            !dbus_message_iter_open_container(&iter_dict, DBUS_TYPE_VARIANT, "t", &iter_variant) ||
--            !dbus_message_iter_append_basic(&iter_variant, DBUS_TYPE_UINT64, &starttime_u64) ||
-+            !dbus_message_iter_append_basic(&iter_dict, DBUS_TYPE_STRING, &name) ||
-+            !dbus_message_iter_open_container(&iter_dict, DBUS_TYPE_VARIANT, "s", &iter_variant) ||
-+            !dbus_message_iter_append_basic(&iter_variant, DBUS_TYPE_STRING, &sender) ||
-             !dbus_message_iter_close_container(&iter_dict, &iter_variant) ||
-             !dbus_message_iter_close_container(&iter_array, &iter_dict) ||
-             !dbus_message_iter_close_container(&iter_struct, &iter_array) ||
--- 
-1.8.3.4
-
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 3215032011a..2c2ed582083 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -16,18 +16,11 @@ stdenv.mkDerivation rec {
   };
 
   patches =
-    [ ./0001-Make-systemctl-daemon-reexec-do-the-right-thing-on-N.patch
-      ./0002-Ignore-duplicate-paths-in-systemctl-start.patch
-      ./0003-Start-device-units-for-uninitialised-encrypted-devic.patch
-      ./0004-Set-switch-to-configuration-hints-for-some-units.patch
-      ./0005-sysinit.target-Drop-the-dependency-on-local-fs.targe.patch
-      ./0006-Don-t-call-plymouth-quit.patch
-      ./0007-Ignore-IPv6-link-local-addresses.patch
-      ./0008-Don-t-try-to-unmount-nix-or-nix-store.patch
-      ./0009-Start-ctrl-alt-del.target-irreversibly.patch
-      ./0010-Fix-CPUShares-configuration-option.patch
-      ./0011-polkit-Avoid-race-condition-in-scraping-proc.patch
-    ] ++ stdenv.lib.optional stdenv.isArm ./libc-bug-accept4-arm.patch;
+    [ # These are all changes between upstream and
+      # https://github.com/edolstra/systemd/tree/nixos-v203.
+      ./fixes.patch
+    ]
+    ++ stdenv.lib.optional stdenv.isArm ./libc-bug-accept4-arm.patch;
 
   buildInputs =
     [ pkgconfig intltool gperf libcap dbus.libs kmod xz pam acl
diff --git a/pkgs/os-specific/linux/systemd/fix-tests-1.patch b/pkgs/os-specific/linux/systemd/fix-tests-1.patch
deleted file mode 100644
index 14bb0fa2708..00000000000
--- a/pkgs/os-specific/linux/systemd/fix-tests-1.patch
+++ /dev/null
@@ -1,68 +0,0 @@
-Signed-off-by: Ramkumar Ramachandra <artag...@gmail.com>
----
- Ramkumar Ramachandra wrote:
- > $ ./test-id128
- > random: a08ea8ed34594d4bbd953dd182ec86f9
- > Assertion 'sd_id128_get_machine(&id) == 0' failed at
- > src/test/test-id128.c:41, function main(). Aborting.
- > [1]    8017 abort (core dumped)  ./test-id128
- 
- Okay, this test fails because I don't have a /etc/machine-id -- I
- thought systemd is supposed to create it?  However, from the logic in
- src/core/machine-id-setup.c, it looks like although open() is called
- with O_CREAT on /etc/machine-id, systemd barfs if the file isn't
- present.  How about changing this?
-
- src/core/machine-id-setup.c |   12 +++++-------
- src/test/test-id128.c       |    6 ++++--
- 2 files changed, 9 insertions(+), 9 deletions(-)
-
-diff --git a/src/core/machine-id-setup.c b/src/core/machine-id-setup.c
-index 7f4c23b..3f21d58 100644
---- a/src/core/machine-id-setup.c
-+++ b/src/core/machine-id-setup.c
-@@ -168,12 +168,8 @@ int machine_id_setup(void) {
-                 writable = true;
-         else {
-                 fd = open("/etc/machine-id", O_RDONLY|O_CLOEXEC|O_NOCTTY);
--                if (fd < 0) {
--                        umask(m);
--                        log_error("Cannot open /etc/machine-id: %m");
--                        return -errno;
--                }
--
-+                if (fd < 0)
-+                        goto generate;
-                 writable = false;
-         }
- 
-@@ -192,7 +188,9 @@ int machine_id_setup(void) {
-                 }
-         }
- 
--        /* Hmm, so, the id currently stored is not useful, then let's
-+generate:
-+        /* Hmm, so, either /etc/machine-id doesn't exist, the id
-+         * currently stored is not useful, then let's
-          * generate one */
- 
-         r = generate(id);
-diff --git a/src/test/test-id128.c b/src/test/test-id128.c
-index bfd743e..60902d0 100644
---- a/src/test/test-id128.c
-+++ b/src/test/test-id128.c
-@@ -38,8 +38,10 @@ int main(int argc, char *argv[]) {
-         assert_se(sd_id128_from_string(t, &id2) == 0);
-         assert_se(sd_id128_equal(id, id2));
- 
--        assert_se(sd_id128_get_machine(&id) == 0);
--        printf("machine: %s\n", sd_id128_to_string(id, t));
-+        if (sd_id128_get_machine(&id) < 0)
-+                printf("machine: run systemd-machine-id-setup first\n");
-+        else
-+                printf("machine: %s\n", sd_id128_to_string(id, t));
- 
-         assert_se(sd_id128_get_boot(&id) == 0);
-         printf("boot: %s\n", sd_id128_to_string(id, t));
--- 
-1.7.8.1.362.g5d6df.dirty
diff --git a/pkgs/os-specific/linux/systemd/fixes.patch b/pkgs/os-specific/linux/systemd/fixes.patch
new file mode 100644
index 00000000000..0ad420cd35c
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/fixes.patch
@@ -0,0 +1,757 @@
+diff --git a/man/systemd.special.xml b/man/systemd.special.xml
+index 7164b1e..29401eb 100644
+--- a/man/systemd.special.xml
++++ b/man/systemd.special.xml
+@@ -381,7 +381,7 @@
+                                         this unit during
+                                         installation. This is best
+                                         configured via
+-                                        <varname>WantedBy=multi-uer.target</varname>
++                                        <varname>WantedBy=multi-user.target</varname>
+                                         in the unit's
+                                         <literal>[Install]</literal>
+                                         section.</para>
+diff --git a/rules/80-net-name-slot.rules b/rules/80-net-name-slot.rules
+index 15b5bc4..c5f1b38 100644
+--- a/rules/80-net-name-slot.rules
++++ b/rules/80-net-name-slot.rules
+@@ -1,6 +1,6 @@
+ # do not edit this file, it will be overwritten on update
+ 
+-ACTION=="remove", GOTO="net_name_slot_end"
++ACTION!="add", GOTO="net_name_slot_end"
+ SUBSYSTEM!="net", GOTO="net_name_slot_end"
+ NAME!="", GOTO="net_name_slot_end"
+ 
+diff --git a/rules/99-systemd.rules.in b/rules/99-systemd.rules.in
+index d17bdd9..040b10e 100644
+--- a/rules/99-systemd.rules.in
++++ b/rules/99-systemd.rules.in
+@@ -14,10 +14,6 @@ KERNEL=="vport*", TAG+="systemd"
+ SUBSYSTEM=="block", KERNEL!="ram*|loop*", TAG+="systemd"
+ SUBSYSTEM=="block", KERNEL!="ram*|loop*", ENV{DM_UDEV_DISABLE_OTHER_RULES_FLAG}=="1", ENV{SYSTEMD_READY}="0"
+ 
+-# Ignore encrypted devices with no identified superblock on it, since
+-# we are probably still calling mke2fs or mkswap on it.
+-SUBSYSTEM=="block", KERNEL!="ram*|loop*", ENV{DM_UUID}=="CRYPT-*", ENV{ID_PART_TABLE_TYPE}=="", ENV{ID_FS_USAGE}=="", ENV{SYSTEMD_READY}="0"
+-
+ # Ignore raid devices that are not yet assembled and started
+ SUBSYSTEM=="block", ENV{DEVTYPE}=="disk", KERNEL=="md*", TEST!="md/array_state", ENV{SYSTEMD_READY}="0"
+ SUBSYSTEM=="block", ENV{DEVTYPE}=="disk", KERNEL=="md*", ATTR{md/array_state}=="|clear|inactive", ENV{SYSTEMD_READY}="0"
+diff --git a/src/core/cgroup-semantics.c b/src/core/cgroup-semantics.c
+index 82b02bb..7df9d01 100644
+--- a/src/core/cgroup-semantics.c
++++ b/src/core/cgroup-semantics.c
+@@ -255,7 +255,7 @@ static int map_blkio(const CGroupSemantics *s, const char *value, char **ret) {
+ }
+ 
+ static const CGroupSemantics semantics[] = {
+-        { "cpu",     "cpu.shares",                 "CPUShare",              false, parse_cpu_shares,          NULL,       NULL },
++        { "cpu",     "cpu.shares",                 "CPUShares",             false, parse_cpu_shares,          NULL,       NULL },
+         { "memory",  "memory.soft_limit_in_bytes", "MemorySoftLimit",       false, parse_memory_limit,        NULL,       NULL },
+         { "memory",  "memory.limit_in_bytes",      "MemoryLimit",           false, parse_memory_limit,        NULL,       NULL },
+         { "devices", "devices.allow",              "DeviceAllow",           true,  parse_device,              map_device, NULL },
+diff --git a/src/core/dbus-execute.h b/src/core/dbus-execute.h
+index 91d70e5..698102f 100644
+--- a/src/core/dbus-execute.h
++++ b/src/core/dbus-execute.h
+@@ -63,7 +63,7 @@
+         "  <property name=\"CPUSchedulingPolicy\" type=\"i\" access=\"read\"/>\n" \
+         "  <property name=\"CPUSchedulingPriority\" type=\"i\" access=\"read\"/>\n" \
+         "  <property name=\"CPUAffinity\" type=\"ay\" access=\"read\"/>\n" \
+-        "  <property name=\"TimerSlackNS\" type=\"t\" access=\"read\"/>\n" \
++        "  <property name=\"TimerSlackNSec\" type=\"t\" access=\"read\"/>\n" \
+         "  <property name=\"CPUSchedulingResetOnFork\" type=\"b\" access=\"read\"/>\n" \
+         "  <property name=\"NonBlocking\" type=\"b\" access=\"read\"/>\n" \
+         "  <property name=\"StandardInput\" type=\"s\" access=\"read\"/>\n" \
+diff --git a/src/core/dbus-manager.c b/src/core/dbus-manager.c
+index 56b02a1..2b6d799 100644
+--- a/src/core/dbus-manager.c
++++ b/src/core/dbus-manager.c
+@@ -1550,7 +1550,7 @@ static DBusHandlerResult bus_manager_message_handler(DBusConnection *connection,
+                 _cleanup_strv_free_ char **l = NULL;
+                 char **e = NULL;
+ 
+-                SELINUX_ACCESS_CHECK(connection, message, "reboot");
++                SELINUX_ACCESS_CHECK(connection, message, "reload");
+ 
+                 r = bus_parse_strv(message, &l);
+                 if (r == -ENOMEM)
+@@ -1577,7 +1577,7 @@ static DBusHandlerResult bus_manager_message_handler(DBusConnection *connection,
+                 _cleanup_strv_free_ char **l = NULL;
+                 char **e = NULL;
+ 
+-                SELINUX_ACCESS_CHECK(connection, message, "reboot");
++                SELINUX_ACCESS_CHECK(connection, message, "reload");
+ 
+                 r = bus_parse_strv(message, &l);
+                 if (r == -ENOMEM)
+@@ -1605,7 +1605,7 @@ static DBusHandlerResult bus_manager_message_handler(DBusConnection *connection,
+                 char **f = NULL;
+                 DBusMessageIter iter;
+ 
+-                SELINUX_ACCESS_CHECK(connection, message, "reboot");
++                SELINUX_ACCESS_CHECK(connection, message, "reload");
+ 
+                 if (!dbus_message_iter_init(message, &iter))
+                         goto oom;
+diff --git a/src/core/dbus-swap.c b/src/core/dbus-swap.c
+index 2e99fba..e72749a 100644
+--- a/src/core/dbus-swap.c
++++ b/src/core/dbus-swap.c
+@@ -93,6 +93,7 @@ static DEFINE_BUS_PROPERTY_APPEND_ENUM(bus_swap_append_swap_result, swap_result,
+ static const BusProperty bus_swap_properties[] = {
+         { "What",       bus_property_append_string, "s", offsetof(Swap, what),  true },
+         { "Priority",   bus_swap_append_priority,   "i", 0 },
++        { "TimeoutUSec",bus_property_append_usec,   "t", offsetof(Swap, timeout_usec)},
+         BUS_EXEC_COMMAND_PROPERTY("ExecActivate",   offsetof(Swap, exec_command[SWAP_EXEC_ACTIVATE]),   false),
+         BUS_EXEC_COMMAND_PROPERTY("ExecDeactivate", offsetof(Swap, exec_command[SWAP_EXEC_DEACTIVATE]), false),
+         { "ControlPID", bus_property_append_pid,    "u", offsetof(Swap, control_pid) },
+diff --git a/src/core/main.c b/src/core/main.c
+index 7fc06be..101ce79 100644
+--- a/src/core/main.c
++++ b/src/core/main.c
+@@ -1590,14 +1590,14 @@ int main(int argc, char *argv[]) {
+                         log_error("Failed to adjust timer slack: %m");
+ 
+         if (arg_capability_bounding_set_drop) {
+-                r = capability_bounding_set_drop(arg_capability_bounding_set_drop, true);
++                r = capability_bounding_set_drop_usermode(arg_capability_bounding_set_drop);
+                 if (r < 0) {
+-                        log_error("Failed to drop capability bounding set: %s", strerror(-r));
++                        log_error("Failed to drop capability bounding set of usermode helpers: %s", strerror(-r));
+                         goto finish;
+                 }
+-                r = capability_bounding_set_drop_usermode(arg_capability_bounding_set_drop);
++                r = capability_bounding_set_drop(arg_capability_bounding_set_drop, true);
+                 if (r < 0) {
+-                        log_error("Failed to drop capability bounding set of usermode helpers: %s", strerror(-r));
++                        log_error("Failed to drop capability bounding set: %s", strerror(-r));
+                         goto finish;
+                 }
+         }
+@@ -1650,6 +1650,7 @@ int main(int argc, char *argv[]) {
+         /* This will close all file descriptors that were opened, but
+          * not claimed by any unit. */
+         fdset_free(fds);
++        fds = NULL;
+ 
+         if (serialization) {
+                 fclose(serialization);
+@@ -1857,7 +1858,7 @@ finish:
+                         char_array_0(sfd);
+ 
+                         i = 0;
+-                        args[i++] = SYSTEMD_BINARY_PATH;
++                        args[i++] = "/run/current-system/systemd/lib/systemd/systemd";
+                         if (switch_root_dir)
+                                 args[i++] = "--switched-root";
+                         args[i++] = arg_running_as == SYSTEMD_SYSTEM ? "--system" : "--user";
+diff --git a/src/core/manager.c b/src/core/manager.c
+index c7f8f20..0508628 100644
+--- a/src/core/manager.c
++++ b/src/core/manager.c
+@@ -1372,7 +1372,7 @@ static int manager_process_signal_fd(Manager *m) {
+ 
+                 case SIGINT:
+                         if (m->running_as == SYSTEMD_SYSTEM) {
+-                                manager_start_target(m, SPECIAL_CTRL_ALT_DEL_TARGET, JOB_REPLACE);
++                                manager_start_target(m, SPECIAL_CTRL_ALT_DEL_TARGET, JOB_REPLACE_IRREVERSIBLY);
+                                 break;
+                         }
+ 
+diff --git a/src/core/service.c b/src/core/service.c
+index 3617c24..4d0e2ad 100644
+--- a/src/core/service.c
++++ b/src/core/service.c
+@@ -2642,6 +2642,9 @@ static int service_serialize(Unit *u, FILE *f, FDSet *fds) {
+         if (s->exec_context.var_tmp_dir)
+                 unit_serialize_item(u, f, "var-tmp-dir", s->exec_context.var_tmp_dir);
+ 
++        if (s->forbid_restart)
++                unit_serialize_item(u, f, "forbid-restart", yes_no(s->forbid_restart));
++
+         return 0;
+ }
+ 
+@@ -2776,6 +2779,14 @@ static int service_deserialize_item(Unit *u, const char *key, const char *value,
+                         return log_oom();
+ 
+                 s->exec_context.var_tmp_dir = t;
++        } else if (streq(key, "forbid-restart")) {
++                int b;
++
++                b = parse_boolean(value);
++                if (b < 0)
++                        log_debug_unit(u->id, "Failed to parse forbid-restart value %s", value);
++                else
++                        s->forbid_restart = b;
+         } else
+                 log_debug_unit(u->id, "Unknown serialization key '%s'", key);
+ 
+diff --git a/src/core/snapshot.c b/src/core/snapshot.c
+index a63eccd..a6807eb 100644
+--- a/src/core/snapshot.c
++++ b/src/core/snapshot.c
+@@ -217,8 +217,10 @@ int snapshot_create(Manager *m, const char *name, bool cleanup, DBusError *e, Sn
+                         if (asprintf(&n, "snapshot-%u.snapshot", ++ m->n_snapshots) < 0)
+                                 return -ENOMEM;
+ 
+-                        if (!manager_get_unit(m, n))
++                        if (!manager_get_unit(m, n)) {
++                                name = n;
+                                 break;
++                        }
+ 
+                         free(n);
+                 }
+diff --git a/src/core/umount.c b/src/core/umount.c
+index 1e95ad7..9f0e471 100644
+--- a/src/core/umount.c
++++ b/src/core/umount.c
+@@ -435,6 +435,8 @@ static int mount_points_list_umount(MountPoint **head, bool *changed, bool log_e
+                  * anyway, since we are running from it. They have
+                  * already been remounted ro. */
+                 if (path_equal(m->path, "/")
++                    || path_equal(m->path, "/nix")
++                    || path_equal(m->path, "/nix/store")
+ #ifndef HAVE_SPLIT_USR
+                     || path_equal(m->path, "/usr")
+ #endif
+diff --git a/src/cryptsetup/cryptsetup-generator.c b/src/cryptsetup/cryptsetup-generator.c
+index 81b7708..edd0b40 100644
+--- a/src/cryptsetup/cryptsetup-generator.c
++++ b/src/cryptsetup/cryptsetup-generator.c
+@@ -111,6 +111,7 @@ static int create_disk(
+                 "Conflicts=umount.target\n"
+                 "DefaultDependencies=no\n"
+                 "BindsTo=dev-mapper-%i.device\n"
++                "IgnoreOnIsolate=true\n"
+                 "After=systemd-readahead-collect.service systemd-readahead-replay.service\n",
+                 f);
+ 
+diff --git a/src/fstab-generator/fstab-generator.c b/src/fstab-generator/fstab-generator.c
+index c17299f..6b3e67e 100644
+--- a/src/fstab-generator/fstab-generator.c
++++ b/src/fstab-generator/fstab-generator.c
+@@ -351,7 +351,7 @@ static int add_mount(
+ 
+         if (automount && !path_equal(where, "/")) {
+                 automount_name = unit_name_from_path(where, ".automount");
+-                if (!name)
++                if (!automount_name)
+                         return log_oom();
+ 
+                 automount_unit = strjoin(arg_dest, "/", automount_name, NULL);
+@@ -596,9 +596,9 @@ static int parse_proc_cmdline(void) {
+                 } else if (startswith(word, "rd.fstab=")) {
+ 
+                         if (in_initrd()) {
+-                                r = parse_boolean(word + 6);
++                                r = parse_boolean(word + 9);
+                                 if (r < 0)
+-                                        log_warning("Failed to parse fstab switch %s. Ignoring.", word + 6);
++                                        log_warning("Failed to parse fstab switch %s. Ignoring.", word + 9);
+                                 else
+                                         arg_enabled = r;
+                         }
+diff --git a/src/journal/journal-file.c b/src/journal/journal-file.c
+index 38499a6..bb80905 100644
+--- a/src/journal/journal-file.c
++++ b/src/journal/journal-file.c
+@@ -907,6 +907,8 @@ static int journal_file_append_field(
+ 
+         osize = offsetof(Object, field.payload) + size;
+         r = journal_file_append_object(f, OBJECT_FIELD, osize, &o, &p);
++        if (r < 0)
++                return r;
+ 
+         o->field.hash = htole64(hash);
+         memcpy(o->field.payload, field, size);
+diff --git a/src/journal/journald-server.c b/src/journal/journald-server.c
+index 88163c0..e09ba4c 100644
+--- a/src/journal/journald-server.c
++++ b/src/journal/journald-server.c
+@@ -333,8 +333,10 @@ void server_rotate(Server *s) {
+                 if (r < 0)
+                         if (f)
+                                 log_error("Failed to rotate %s: %s", f->path, strerror(-r));
+-                        else
++                        else {
+                                 log_error("Failed to create user journal: %s", strerror(-r));
++                                hashmap_remove(s->user_journals, k);
++                        }
+                 else {
+                         hashmap_replace(s->user_journals, k, f);
+                         server_fix_perms(s, f, PTR_TO_UINT32(k));
+@@ -975,7 +977,8 @@ int process_event(Server *s, struct epoll_event *ev) {
+                 ssize_t n;
+ 
+                 if (ev->events != EPOLLIN) {
+-                        log_error("Got invalid event from epoll.");
++                        log_error("Got invalid event from epoll for %s: %"PRIx32,
++                                  "signal fd", ev->events);
+                         return -EIO;
+                 }
+ 
+@@ -1024,8 +1027,12 @@ int process_event(Server *s, struct epoll_event *ev) {
+         } else if (ev->data.fd == s->dev_kmsg_fd) {
+                 int r;
+ 
+-                if (ev->events != EPOLLIN) {
+-                        log_error("Got invalid event from epoll.");
++                if (ev->events & EPOLLERR)
++                        log_warning("/dev/kmsg buffer overrun, some messages lost.");
++
++                if (!(ev->events & EPOLLIN)) {
++                        log_error("Got invalid event from epoll for %s: %"PRIx32,
++                                  "/dev/kmsg", ev->events);
+                         return -EIO;
+                 }
+ 
+@@ -1039,7 +1046,9 @@ int process_event(Server *s, struct epoll_event *ev) {
+                    ev->data.fd == s->syslog_fd) {
+ 
+                 if (ev->events != EPOLLIN) {
+-                        log_error("Got invalid event from epoll.");
++                        log_error("Got invalid event from epoll for %s: %"PRIx32,
++                                  ev->data.fd == s->native_fd ? "native fd" : "syslog fd",
++                                  ev->events);
+                         return -EIO;
+                 }
+ 
+@@ -1140,12 +1149,7 @@ int process_event(Server *s, struct epoll_event *ev) {
+                                 char *e;
+ 
+                                 if (n > 0 && n_fds == 0) {
+-                                        e = memchr(s->buffer, '\n', n);
+-                                        if (e)
+-                                                *e = 0;
+-                                        else
+-                                                s->buffer[n] = 0;
+-
++                                        s->buffer[n] = 0;
+                                         server_process_syslog_message(s, strstrip(s->buffer), ucred, tv, label, label_len);
+                                 } else if (n_fds > 0)
+                                         log_warning("Got file descriptors via syslog socket. Ignoring.");
+@@ -1167,7 +1171,8 @@ int process_event(Server *s, struct epoll_event *ev) {
+         } else if (ev->data.fd == s->stdout_fd) {
+ 
+                 if (ev->events != EPOLLIN) {
+-                        log_error("Got invalid event from epoll.");
++                        log_error("Got invalid event from epoll for %s: %"PRIx32,
++                                  "stdout fd", ev->events);
+                         return -EIO;
+                 }
+ 
+@@ -1178,6 +1183,8 @@ int process_event(Server *s, struct epoll_event *ev) {
+                 StdoutStream *stream;
+ 
+                 if ((ev->events|EPOLLIN|EPOLLHUP) != (EPOLLIN|EPOLLHUP)) {
++                        log_error("Got invalid event from epoll for %s: %"PRIx32,
++                                  "stdout stream", ev->events);
+                         log_error("Got invalid event from epoll.");
+                         return -EIO;
+                 }
+diff --git a/src/journal/mmap-cache.c b/src/journal/mmap-cache.c
+index 54bf114..bd197d0 100644
+--- a/src/journal/mmap-cache.c
++++ b/src/journal/mmap-cache.c
+@@ -308,9 +308,13 @@ static void mmap_cache_free(MMapCache *m) {
+         while ((c = hashmap_first(m->contexts)))
+                 context_free(c);
+ 
++        hashmap_free(m->contexts);
++
+         while ((f = hashmap_first(m->fds)))
+                 fd_free(f);
+ 
++        hashmap_free(m->fds);
++
+         while (m->unused)
+                 window_free(m->unused);
+ 
+diff --git a/src/libsystemd-bus/bus-internal.c b/src/libsystemd-bus/bus-internal.c
+index 0e66f3d..cac948e 100644
+--- a/src/libsystemd-bus/bus-internal.c
++++ b/src/libsystemd-bus/bus-internal.c
+@@ -63,7 +63,7 @@ bool object_path_is_valid(const char *p) {
+ 
+ bool interface_name_is_valid(const char *p) {
+         const char *q;
+-        bool dot, found_dot;
++        bool dot, found_dot = false;
+ 
+         if (isempty(p))
+                 return false;
+@@ -103,7 +103,7 @@ bool interface_name_is_valid(const char *p) {
+ 
+ bool service_name_is_valid(const char *p) {
+         const char *q;
+-        bool dot, found_dot, unique;
++        bool dot, found_dot = false, unique;
+ 
+         if (isempty(p))
+                 return false;
+diff --git a/src/libsystemd-bus/sd-bus.c b/src/libsystemd-bus/sd-bus.c
+index 7d6d848..b0eb2f1 100644
+--- a/src/libsystemd-bus/sd-bus.c
++++ b/src/libsystemd-bus/sd-bus.c
+@@ -1088,11 +1088,11 @@ static int dispatch_rqueue(sd_bus *bus, sd_bus_message **m) {
+                 if (r == 0)
+                         return ret;
+ 
+-                r = 1;
++                ret = 1;
+         } while (!z);
+ 
+         *m = z;
+-        return 1;
++        return ret;
+ }
+ 
+ int sd_bus_send(sd_bus *bus, sd_bus_message *m, uint64_t *serial) {
+diff --git a/src/libudev/libudev-enumerate.c b/src/libudev/libudev-enumerate.c
+index 5ccaabd..100c1fb 100644
+--- a/src/libudev/libudev-enumerate.c
++++ b/src/libudev/libudev-enumerate.c
+@@ -299,7 +299,7 @@ _public_ struct udev_list_entry *udev_enumerate_get_list_entry(struct udev_enume
+                         /* skip to be delayed devices, and move the to
+                          * the point where the prefix changes. We can
+                          * only move one item at a time. */
+-                        if (!move_later) {
++                        if (move_later == -1) {
+                                 move_later_prefix = devices_delay_later(udev_enumerate->udev, entry->syspath);
+ 
+                                 if (move_later_prefix > 0) {
+@@ -718,6 +718,8 @@ static bool match_subsystem(struct udev_enumerate *udev_enumerate, const char *s
+ {
+         struct udev_list_entry *list_entry;
+ 
++        subsystem = subsystem ? : "";
++
+         udev_list_entry_foreach(list_entry, udev_list_get_entry(&udev_enumerate->subsystem_nomatch_list)) {
+                 if (fnmatch(udev_list_entry_get_name(list_entry), subsystem, 0) == 0)
+                         return false;
+@@ -826,23 +828,27 @@ nomatch:
+ static int parent_add_child(struct udev_enumerate *enumerate, const char *path)
+ {
+         struct udev_device *dev;
++        int r = 0;
+ 
+         dev = udev_device_new_from_syspath(enumerate->udev, path);
+         if (dev == NULL)
+                 return -ENODEV;
+ 
+         if (!match_subsystem(enumerate, udev_device_get_subsystem(dev)))
+-                return 0;
++                goto nomatch;
+         if (!match_sysname(enumerate, udev_device_get_sysname(dev)))
+-                return 0;
++                goto nomatch;
+         if (!match_property(enumerate, dev))
+-                return 0;
++                goto nomatch;
+         if (!match_sysattr(enumerate, dev))
+-                return 0;
++                goto nomatch;
+ 
+         syspath_add(enumerate, udev_device_get_syspath(dev));
++        r = 1;
++
++nomatch:
+         udev_device_unref(dev);
+-        return 1;
++        return r;
+ }
+ 
+ static int parent_crawl_children(struct udev_enumerate *enumerate, const char *path, int maxdepth)
+diff --git a/src/libudev/libudev.sym b/src/libudev/libudev.sym
+index 8e09430..1e6f885 100644
+--- a/src/libudev/libudev.sym
++++ b/src/libudev/libudev.sym
+@@ -109,5 +109,6 @@ global:
+ } LIBUDEV_189;
+ 
+ LIBUDEV_199 {
++global:
+         udev_device_set_sysattr_value;
+ } LIBUDEV_196;
+diff --git a/src/modules-load/modules-load.c b/src/modules-load/modules-load.c
+index 7b19ee0..49ee420 100644
+--- a/src/modules-load/modules-load.c
++++ b/src/modules-load/modules-load.c
+@@ -302,8 +302,8 @@ int main(int argc, char *argv[]) {
+ 
+                 STRV_FOREACH(i, arg_proc_cmdline_modules) {
+                         k = load_module(ctx, *i);
+-                        if (k < 0)
+-                                r = EXIT_FAILURE;
++                        if (k < 0 && r == 0)
++                                r = k;
+                 }
+ 
+                 r = conf_files_list_nulstr(&files, ".conf", NULL, conf_file_dirs);
+diff --git a/src/nss-myhostname/netlink.c b/src/nss-myhostname/netlink.c
+index b1ef912..4f2ab5c 100644
+--- a/src/nss-myhostname/netlink.c
++++ b/src/nss-myhostname/netlink.c
+@@ -113,6 +113,10 @@ static int read_reply(int fd, struct address **list, unsigned *n_list) {
+                     ifaddrmsg->ifa_scope == RT_SCOPE_NOWHERE)
+                         continue;
+ 
++                if (ifaddrmsg->ifa_family == AF_INET6 &&
++                    ifaddrmsg->ifa_scope == RT_SCOPE_LINK)
++                        continue;
++
+                 if (ifaddrmsg->ifa_flags & IFA_F_DEPRECATED)
+                         continue;
+ 
+diff --git a/src/shared/efivars.c b/src/shared/efivars.c
+index 8d004ba..99340c9 100644
+--- a/src/shared/efivars.c
++++ b/src/shared/efivars.c
+@@ -383,7 +383,8 @@ int efi_get_boot_options(uint16_t **options) {
+                 list[count ++] = id;
+         }
+ 
+-        qsort(list, count, sizeof(uint16_t), cmp_uint16);
++        if (list)
++                qsort(list, count, sizeof(uint16_t), cmp_uint16);
+ 
+         *options = list;
+         return count;
+diff --git a/src/shared/env-util.c b/src/shared/env-util.c
+index 6a52fb9..598222c 100644
+--- a/src/shared/env-util.c
++++ b/src/shared/env-util.c
+@@ -406,7 +406,9 @@ char **strv_env_clean_log(char **e, const char *message) {
+                 e[k++] = *p;
+         }
+ 
+-        e[k] = NULL;
++        if (e)
++                e[k] = NULL;
++
+         return e;
+ }
+ 
+diff --git a/src/shared/log.c b/src/shared/log.c
+index 27317f7..8f4995a 100644
+--- a/src/shared/log.c
++++ b/src/shared/log.c
+@@ -115,16 +115,20 @@ void log_close_syslog(void) {
+ 
+ static int create_log_socket(int type) {
+         int fd;
++        struct timeval tv;
+ 
+-        /* All output to the syslog/journal fds we do asynchronously,
+-         * and if the buffers are full we just drop the messages */
+-
+-        fd = socket(AF_UNIX, type|SOCK_CLOEXEC|SOCK_NONBLOCK, 0);
++        fd = socket(AF_UNIX, type|SOCK_CLOEXEC, 0);
+         if (fd < 0)
+                 return -errno;
+ 
+         fd_inc_sndbuf(fd, SNDBUF_SIZE);
+ 
++        /* We need a blocking fd here since we'd otherwise lose
++        messages way too early. However, let's not hang forever in the
++        unlikely case of a deadlock. */
++        timeval_store(&tv, 1*USEC_PER_MINUTE);
++        setsockopt(fd, SOL_SOCKET, SO_SNDTIMEO, &tv, sizeof(tv));
++
+         return fd;
+ }
+ 
+diff --git a/src/shared/polkit.c b/src/shared/polkit.c
+index cea7074..1c5e9e3 100644
+--- a/src/shared/polkit.c
++++ b/src/shared/polkit.c
+@@ -38,12 +38,8 @@ int verify_polkit(
+ 
+ #ifdef ENABLE_POLKIT
+         DBusMessage *m = NULL, *reply = NULL;
+-        const char *unix_process = "unix-process", *pid = "pid", *starttime = "start-time", *cancel_id = "";
++        const char *system_bus_name = "system-bus-name", *name = "name", *cancel_id = "";
+         uint32_t flags = interactive ? 1 : 0;
+-        pid_t pid_raw;
+-        uint32_t pid_u32;
+-        unsigned long long starttime_raw;
+-        uint64_t starttime_u64;
+         DBusMessageIter iter_msg, iter_struct, iter_array, iter_dict, iter_variant;
+         int r;
+         dbus_bool_t authorized = FALSE, challenge = FALSE;
+@@ -68,14 +64,6 @@ int verify_polkit(
+ 
+ #ifdef ENABLE_POLKIT
+ 
+-        pid_raw = bus_get_unix_process_id(c, sender, error);
+-        if (pid_raw == 0)
+-                return -EINVAL;
+-
+-        r = get_starttime_of_pid(pid_raw, &starttime_raw);
+-        if (r < 0)
+-                return r;
+-
+         m = dbus_message_new_method_call(
+                         "org.freedesktop.PolicyKit1",
+                         "/org/freedesktop/PolicyKit1/Authority",
+@@ -86,22 +74,13 @@ int verify_polkit(
+ 
+         dbus_message_iter_init_append(m, &iter_msg);
+ 
+-        pid_u32 = (uint32_t) pid_raw;
+-        starttime_u64 = (uint64_t) starttime_raw;
+-
+         if (!dbus_message_iter_open_container(&iter_msg, DBUS_TYPE_STRUCT, NULL, &iter_struct) ||
+-            !dbus_message_iter_append_basic(&iter_struct, DBUS_TYPE_STRING, &unix_process) ||
++            !dbus_message_iter_append_basic(&iter_struct, DBUS_TYPE_STRING, &system_bus_name) ||
+             !dbus_message_iter_open_container(&iter_struct, DBUS_TYPE_ARRAY, "{sv}", &iter_array) ||
+             !dbus_message_iter_open_container(&iter_array, DBUS_TYPE_DICT_ENTRY, NULL, &iter_dict) ||
+-            !dbus_message_iter_append_basic(&iter_dict, DBUS_TYPE_STRING, &pid) ||
+-            !dbus_message_iter_open_container(&iter_dict, DBUS_TYPE_VARIANT, "u", &iter_variant) ||
+-            !dbus_message_iter_append_basic(&iter_variant, DBUS_TYPE_UINT32, &pid_u32) ||
+-            !dbus_message_iter_close_container(&iter_dict, &iter_variant) ||
+-            !dbus_message_iter_close_container(&iter_array, &iter_dict) ||
+-            !dbus_message_iter_open_container(&iter_array, DBUS_TYPE_DICT_ENTRY, NULL, &iter_dict) ||
+-            !dbus_message_iter_append_basic(&iter_dict, DBUS_TYPE_STRING, &starttime) ||
+-            !dbus_message_iter_open_container(&iter_dict, DBUS_TYPE_VARIANT, "t", &iter_variant) ||
+-            !dbus_message_iter_append_basic(&iter_variant, DBUS_TYPE_UINT64, &starttime_u64) ||
++            !dbus_message_iter_append_basic(&iter_dict, DBUS_TYPE_STRING, &name) ||
++            !dbus_message_iter_open_container(&iter_dict, DBUS_TYPE_VARIANT, "s", &iter_variant) ||
++            !dbus_message_iter_append_basic(&iter_variant, DBUS_TYPE_STRING, &sender) ||
+             !dbus_message_iter_close_container(&iter_dict, &iter_variant) ||
+             !dbus_message_iter_close_container(&iter_array, &iter_dict) ||
+             !dbus_message_iter_close_container(&iter_struct, &iter_array) ||
+diff --git a/src/systemctl/systemctl.c b/src/systemctl/systemctl.c
+index 3cca861..f6052dd 100644
+--- a/src/systemctl/systemctl.c
++++ b/src/systemctl/systemctl.c
+@@ -1482,7 +1482,7 @@ static DBusHandlerResult wait_filter(DBusConnection *connection, DBusMessage *me
+ 
+         } else if (dbus_message_is_signal(message, "org.freedesktop.systemd1.Manager", "JobRemoved")) {
+                 uint32_t id;
+-                const char *path, *result, *unit;
++                const char *path, *result, *unit, *r;
+ 
+                 if (dbus_message_get_args(message, &error,
+                                           DBUS_TYPE_UINT32, &id,
+@@ -1491,7 +1491,11 @@ static DBusHandlerResult wait_filter(DBusConnection *connection, DBusMessage *me
+                                           DBUS_TYPE_STRING, &result,
+                                           DBUS_TYPE_INVALID)) {
+ 
+-                        free(set_remove(d->set, (char*) path));
++                        r = set_remove(d->set, (char*) path);
++                        if (!r)
++                                return DBUS_HANDLER_RESULT_NOT_YET_HANDLED;
++
++                        free(r);
+ 
+                         if (!isempty(result))
+                                 d->result = strdup(result);
+@@ -1511,7 +1515,11 @@ static DBusHandlerResult wait_filter(DBusConnection *connection, DBusMessage *me
+                         /* Compatibility with older systemd versions <
+                          * 183 during upgrades. This should be dropped
+                          * one day. */
+-                        free(set_remove(d->set, (char*) path));
++                        r = set_remove(d->set, (char*) path);
++                        if (!r)
++                                return DBUS_HANDLER_RESULT_NOT_YET_HANDLED;
++
++                        free(r);
+ 
+                         if (*result)
+                                 d->result = strdup(result);
+@@ -1867,7 +1875,7 @@ static int start_unit_one(
+                         return log_oom();
+ 
+                 r = set_consume(s, p);
+-                if (r < 0) {
++                if (r < 0 && r != -EEXIST) {
+                         log_error("Failed to add path to set.");
+                         return r;
+                 }
+diff --git a/units/emergency.service.in b/units/emergency.service.in
+index 442f0e0..6b7eafd 100644
+--- a/units/emergency.service.in
++++ b/units/emergency.service.in
+@@ -15,7 +15,6 @@ Before=shutdown.target
+ [Service]
+ Environment=HOME=/root
+ WorkingDirectory=/root
+-ExecStartPre=-/bin/plymouth quit
+ ExecStartPre=-/bin/echo -e 'Welcome to emergency mode! After logging in, type "journalctl -xb" to view\\nsystem logs, "systemctl reboot" to reboot, "systemctl default" to try again\\nto boot into default mode.'
+ ExecStart=-/sbin/sulogin
+ ExecStopPost=@SYSTEMCTL@ --fail --no-block default
+diff --git a/units/local-fs.target b/units/local-fs.target
+index 18c3d74..a09054c 100644
+--- a/units/local-fs.target
++++ b/units/local-fs.target
+@@ -11,3 +11,5 @@ Documentation=man:systemd.special(7)
+ After=local-fs-pre.target
+ OnFailure=emergency.target
+ OnFailureIsolate=no
++
++X-StopOnReconfiguration=yes
+diff --git a/units/remote-fs.target b/units/remote-fs.target
+index 09213e8..47b4cf5 100644
+--- a/units/remote-fs.target
++++ b/units/remote-fs.target
+@@ -10,5 +10,7 @@ Description=Remote File Systems
+ Documentation=man:systemd.special(7)
+ After=remote-fs-pre.target
+ 
++X-StopOnReconfiguration=yes
++
+ [Install]
+ WantedBy=multi-user.target
+diff --git a/units/rescue.service.m4.in b/units/rescue.service.m4.in
+index 269797a..2c640f4 100644
+--- a/units/rescue.service.m4.in
++++ b/units/rescue.service.m4.in
+@@ -16,7 +16,6 @@ Before=shutdown.target
+ [Service]
+ Environment=HOME=/root
+ WorkingDirectory=/root
+-ExecStartPre=-/bin/plymouth quit
+ ExecStartPre=-/bin/echo -e 'Welcome to rescue mode! Type "systemctl default" or ^D to enter default mode.\\nType "journalctl -xb" to view system logs. Type "systemctl reboot" to reboot.'
+ ExecStart=-/sbin/sulogin
+ ExecStopPost=-@SYSTEMCTL@ --fail --no-block default
+diff --git a/units/sysinit.target b/units/sysinit.target
+index 8f4fb8f..e0f0147 100644
+--- a/units/sysinit.target
++++ b/units/sysinit.target
+@@ -9,6 +9,5 @@
+ Description=System Initialization
+ Documentation=man:systemd.special(7)
+ Conflicts=emergency.service emergency.target
+-Wants=local-fs.target swap.target
+-After=local-fs.target swap.target emergency.service emergency.target
++After=emergency.service emergency.target
+ RefuseManualStart=yes
+diff --git a/units/systemd-journald.service.in b/units/systemd-journald.service.in
+index ab2e50c..9563a7d 100644
+--- a/units/systemd-journald.service.in
++++ b/units/systemd-journald.service.in
+@@ -24,3 +24,8 @@ CapabilityBoundingSet=CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_SYS_PTRACE CAP_SYSLOG C
+ # Increase the default a bit in order to allow many simultaneous
+ # services being run since we keep one fd open per service.
+ LimitNOFILE=16384
++
++# Don't restart journald, since that causes services connected to
++# journald to stop logging (see
++# https://bugs.freedesktop.org/show_bug.cgi?id=56043).
++X-RestartIfChanged=no
+diff --git a/units/systemd-user-sessions.service.in b/units/systemd-user-sessions.service.in
+index 0869e73..b6ed958 100644
+--- a/units/systemd-user-sessions.service.in
++++ b/units/systemd-user-sessions.service.in
+@@ -15,3 +15,6 @@ Type=oneshot
+ RemainAfterExit=yes
+ ExecStart=@rootlibexecdir@/systemd-user-sessions start
+ ExecStop=@rootlibexecdir@/systemd-user-sessions stop
++
++# Restart kills all active sessions.
++X-RestartIfChanged=no
diff --git a/pkgs/os-specific/linux/systemd/no-global-install.patch b/pkgs/os-specific/linux/systemd/no-global-install.patch
deleted file mode 100644
index 6567251d57a..00000000000
--- a/pkgs/os-specific/linux/systemd/no-global-install.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-diff --git a/Makefile.am b/Makefile.am
-index 05bf582..aa16a7c 100644
---- a/Makefile.am
-+++ b/Makefile.am
-@@ -2568,11 +2568,6 @@ endif
- # "adm" and "wheel".
- libsystemd-journal-install-hook:
- 	libname=libsystemd-journal.so && $(move-to-rootlibdir)
--	$(MKDIR_P) $(DESTDIR)/var/log/journal
--	-chown 0:0 $(DESTDIR)/var/log/journal
--	-chmod 755 $(DESTDIR)/var/log/journal
--	-setfacl -nm g:adm:rx,d:g:adm:rx $(DESTDIR)/var/log/journal/
--	-setfacl -nm g:wheel:rx,d:g:wheel:rx $(DESTDIR)/var/log/journal/
- 
- libsystemd-journal-uninstall-hook:
- 	rm -f $(DESTDIR)$(rootlibdir)/libsystemd-journal.so*
-@@ -3676,9 +3671,6 @@ if HAVE_SYSV_COMPAT
- sysvinit_DATA = \
- 	docs/sysvinit/README
- 
--varlog_DATA = \
--	docs/var-log/README
--
- docs/sysvinit/README: docs/sysvinit/README.in
- 	$(SED_PROCESS)
- 
diff --git a/pkgs/os-specific/linux/ttysnoop/default.nix b/pkgs/os-specific/linux/ttysnoop/default.nix
new file mode 100644
index 00000000000..f2bf2bdd31b
--- /dev/null
+++ b/pkgs/os-specific/linux/ttysnoop/default.nix
@@ -0,0 +1,38 @@
+{stdenv, fetchurl}:
+let
+  s = # Generated upstream information
+  rec {
+    baseName="ttysnoop";
+    version="0.12d.k26";
+    name="${baseName}-${version}";
+    hash="0jb2zchaiqmmickj0la7wjw3sf9vy65qfhhs11yrzx4mmwkp0395";
+    url="http://sysd.org/stas/files/active/0/ttysnoop-0.12d.k26.tar.gz";
+    sha256="0jb2zchaiqmmickj0la7wjw3sf9vy65qfhhs11yrzx4mmwkp0395";
+  };
+  buildInputs = [
+  ];
+in
+stdenv.mkDerivation {
+  inherit (s) name version;
+  inherit buildInputs;
+  src = fetchurl {
+    inherit (s) url sha256;
+  };
+  preBuild = ''
+    sed -e "s@/sbin@$out/sbin@g" -i Makefile
+    sed -e "s@/usr/man@$out/share/man@g" -i Makefile
+    mkdir -p "$out/share/man/man8"
+    mkdir -p "$out/sbin"
+  '';
+  postInstall = ''
+    mkdir -p "$out/etc"
+    cp snooptab.dist "$out/etc/snooptab"
+  '';
+  meta = {
+    inherit (s) version;
+    description = "A tool to clone input and output of another tty/pty to the current one";
+    license = stdenv.lib.licenses.gpl ;
+    maintainers = [stdenv.lib.maintainers.raskin];
+    platforms = stdenv.lib.platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/ttysnoop/default.upstream b/pkgs/os-specific/linux/ttysnoop/default.upstream
new file mode 100644
index 00000000000..905a639c31e
--- /dev/null
+++ b/pkgs/os-specific/linux/ttysnoop/default.upstream
@@ -0,0 +1,3 @@
+url http://sysd.org/stas/node/35
+ensure_choice
+version '.*-([0-9a-z.]+)[.]tar[.].*' '\1'
diff --git a/pkgs/os-specific/linux/usbutils/default.nix b/pkgs/os-specific/linux/usbutils/default.nix
index b7d139a534f..aff730e387a 100644
--- a/pkgs/os-specific/linux/usbutils/default.nix
+++ b/pkgs/os-specific/linux/usbutils/default.nix
@@ -4,8 +4,8 @@ let
 
   # Obtained from http://www.linux-usb.org/usb.ids.bz2.
   usbids = fetchurl {
-    url = http://tarballs.nixos.org/usb.ids.20120920.bz2;
-    sha256 = "0sz860g7grf6kx22p49s6j8h85c69ymcw16a8110klzfl9hl9hli";
+    url = http://tarballs.nixos.org/usb.ids.20130821.bz2;
+    sha256 = "0x7mf4h5h5wjzhygfr4lc8yz0cwm7mahxrnp5nkxcmawmyxwsg53";
   };
 
 in
@@ -20,8 +20,14 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ pkgconfig libusb1 ];
 
-  # currently up-to-date
-  #preBuild = "bunzip2 < ${usbids} > usb.ids";
+  preBuild = "bunzip2 < ${usbids} > usb.ids";
+
+  postInstall =
+    ''
+      rm $out/sbin/update-usbids.sh
+      substituteInPlace $out/bin/lsusb.py \
+        --replace /usr/share/usb.ids $out/share/usb.ids
+    '';
 
   meta = {
     homepage = http://www.linux-usb.org/;
diff --git a/pkgs/servers/http/nginx/default.nix b/pkgs/servers/http/nginx/default.nix
index 083dbc482f0..8e77d07e5c5 100644
--- a/pkgs/servers/http/nginx/default.nix
+++ b/pkgs/servers/http/nginx/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "http://nginx.org/download/${name}.tar.gz";
-    sha256 = "06ficmjiya3m8mdlyq3bgqx604h475n77qc5c502kfjijzld39dw";
+    sha256 = "116yfy0k65mwxdkld0w7c3gly77jdqlvga5hpbsw79i3r62kh4mf";
   };
 
   buildInputs = [ openssl zlib pcre libxml2 libxslt ] ++ stdenv.lib.optional fullWebDAV expat;
@@ -41,6 +41,6 @@ stdenv.mkDerivation rec {
     description = "A reverse proxy and lightweight webserver";
     maintainers = [ stdenv.lib.maintainers.raskin];
     platforms = stdenv.lib.platforms.all;
-    version = "1.4.1";
+    version = "1.4.3";
   };
 }
diff --git a/pkgs/servers/monitoring/munin/adding_servicedir_munin-node.patch b/pkgs/servers/monitoring/munin/adding_servicedir_munin-node.patch
new file mode 100644
index 00000000000..856f3d73011
--- /dev/null
+++ b/pkgs/servers/monitoring/munin/adding_servicedir_munin-node.patch
@@ -0,0 +1,84 @@
+From 75a3ec48814e7b9a9b22259a04009076363be3f1 Mon Sep 17 00:00:00 2001
+From: Igor Kolar <igor.kolar@gmail.com>
+Date: Thu, 17 Oct 2013 00:48:23 +0200
+Subject: [PATCH 1/2] node: added --servicedir switch to munin-node
+
+This code is copied over from munin-node-config, that already does the same
+---
+ node/sbin/munin-node | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/node/sbin/munin-node b/node/sbin/munin-node
+index 7b2e180..0a93450 100755
+--- a/node/sbin/munin-node
++++ b/node/sbin/munin-node
+@@ -35,7 +35,7 @@ use Munin::Node::OS;
+ use Munin::Node::Service;
+ use Munin::Node::Server;
+ 
+-my $servicedir;
++my $servicedir = "$Munin::Common::Defaults::MUNIN_CONFDIR/plugins";
+ my $sconfdir = "$Munin::Common::Defaults::MUNIN_CONFDIR/plugin-conf.d";
+ my $conffile = "$Munin::Common::Defaults::MUNIN_CONFDIR/munin-node.conf";
+ my $DEBUG    = 0;
+@@ -101,6 +101,7 @@ sub parse_args
+ 
+     print_usage_and_exit() unless GetOptions(
+         "config=s"     => \$conffile,
++        "servicedir=s" => \$servicedir,
+         "debug!"       => \$DEBUG,
+         "pidebug!"     => \$PIDEBUG,
+         "paranoia!"    => \$paranoia,
+@@ -166,6 +167,10 @@ and returning the output they produce.
+ 
+ Use E<lt>fileE<gt> as configuration file. [@@CONFDIR@@/munin-node.conf]
+ 
++=item B<< --servicedir <dir> >>
++
++Override plugin directory [@@CONFDIR@@/plugins/]
++
+ =item B< --[no]paranoia >
+ 
+ Only run plugins owned by root. Check permissions as well. [--noparanoia]
+-- 
+1.8.4
+
+
+From b8e17cbe73ae4c71b93ff5687ba86db1d0c1f5bd Mon Sep 17 00:00:00 2001
+From: Steve Schnepp <steve.schnepp@pwkf.org>
+Date: Thu, 17 Oct 2013 11:52:10 +0200
+Subject: [PATCH 2/2] node: untaint the service-dir args
+
+---
+ node/sbin/munin-node | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/node/sbin/munin-node b/node/sbin/munin-node
+index 0a93450..909c8c4 100755
+--- a/node/sbin/munin-node
++++ b/node/sbin/munin-node
+@@ -99,9 +99,10 @@ sub parse_args
+ {
+     my @ORIG_ARGV  = @ARGV;
+ 
++    my $servicedir_cmdline;
+     print_usage_and_exit() unless GetOptions(
+         "config=s"     => \$conffile,
+-        "servicedir=s" => \$servicedir,
++        "servicedir=s" => \$servicedir_cmdline,
+         "debug!"       => \$DEBUG,
+         "pidebug!"     => \$PIDEBUG,
+         "paranoia!"    => \$paranoia,
+@@ -109,6 +110,9 @@ sub parse_args
+         "help"         => \&print_usage_and_exit,
+     );
+ 
++    # We untaint the args brutally, since the sysadm should know what he does
++    $servicedir = $1 if defined $servicedir_cmdline && $servicedir_cmdline =~ m/(.*)/;
++
+     # Reset ARGV (for HUPing)
+     @ARGV = @ORIG_ARGV;
+ 
+-- 
+1.8.4
+
diff --git a/pkgs/servers/monitoring/munin/default.nix b/pkgs/servers/monitoring/munin/default.nix
index d7da0f658e2..4f16ab35527 100644
--- a/pkgs/servers/monitoring/munin/default.nix
+++ b/pkgs/servers/monitoring/munin/default.nix
@@ -1,9 +1,5 @@
 { stdenv, fetchurl, makeWrapper, which, coreutils, rrdtool, perl, perlPackages
-, python, ruby, openjdk }:
-
-# TODO: split into server/node derivations
-
-# FIXME: munin tries to write log files and web graphs to its installation path.
+, python, ruby, openjdk, nettools }:
 
 stdenv.mkDerivation rec {
   version = "2.0.17";
@@ -19,6 +15,7 @@ stdenv.mkDerivation rec {
     which
     coreutils
     rrdtool
+    nettools
     perl
     perlPackages.ModuleBuild
     perlPackages.HTMLTemplate
@@ -36,17 +33,49 @@ stdenv.mkDerivation rec {
     perlPackages.NetServer
     perlPackages.ListMoreUtils
     perlPackages.TimeHiRes
+    perlPackages.LWPUserAgent
+    perlPackages.DBDPg
     python
     ruby
     openjdk
+    # tests
+    perlPackages.TestLongString
+    perlPackages.TestDifferences
+    perlPackages.TestDeep
+    perlPackages.TestMockModule
+    perlPackages.TestMockObject
+    perlPackages.FileSlurp
+    perlPackages.IOStringy
+  ];
+
+  # TODO: tests are failing http://munin-monitoring.org/ticket/1390#comment:1
+  # NOTE: important, test command always exits with 0, think of a way to abort the build once tests pass
+  doCheck = false;
+
+  checkPhase = ''
+   export PERL5LIB="$PERL5LIB:${rrdtool}/lib/perl"
+   LC_ALL=C make -j1 test 
+  '';
+
+  patches = [
+    # https://rt.cpan.org/Public/Bug/Display.html?id=75112
+    ./dont_preserve_source_dir_permissions.patch
+
+    # https://github.com/munin-monitoring/munin/pull/134
+    ./adding_servicedir_munin-node.patch
   ];
 
   preBuild = ''
+    substituteInPlace "Makefile" \
+      --replace "/bin/pwd" "pwd"
+
+    # munin checks at build time if user/group exists, unpure
     sed -i '/CHECKUSER/d' Makefile
     sed -i '/CHOWN/d' Makefile
     sed -i '/CHECKGROUP/d' Makefile
-    substituteInPlace "Makefile" \
-      --replace "/usr/pwd" "pwd"
+
+    # munin hardcodes PATH, we need it to obey $PATH
+    sed -i '/ENV{PATH}/d' node/lib/Munin/Node/Service.pm
   '';
 
   # DESTDIR shouldn't be needed (and shouldn't have worked), but munin
@@ -60,7 +89,7 @@ stdenv.mkDerivation rec {
     PYTHON=${python}/bin/python
     RUBY=${ruby}/bin/ruby
     JAVARUN=${openjdk}/bin/java
-    HOSTNAME=default
+    PLUGINUSER=munin
   '';
 
   postFixup = ''
@@ -78,7 +107,8 @@ stdenv.mkDerivation rec {
         case "$file" in
             *.jar) continue;;
         esac
-        wrapProgram "$file" --set PERL5LIB $out/lib/perl5/site_perl:${perlPackages.Log4Perl}/lib/perl5/site_perl:${perlPackages.IOSocketInet6}/lib/perl5/site_perl:${perlPackages.Socket6}/lib/perl5/site_perl:${perlPackages.URI}/lib/perl5/site_perl:${perlPackages.DBFile}/lib/perl5/site_perl:${perlPackages.DateManip}/lib/perl5/site_perl:${perlPackages.HTMLTemplate}/lib/perl5/site_perl:${perlPackages.FileCopyRecursive}/lib/perl5/site_perl:${perlPackages.FCGI}/lib/perl5/site_perl:${perlPackages.NetSNMP}/lib/perl5/site_perl:${perlPackages.NetServer}/lib/perl5/site_perl:${perlPackages.ListMoreUtils}/lib/perl5/site_perl:${perlPackages.TimeHiRes}/lib/perl5/site_perl:${rrdtool}/lib/perl
+        wrapProgram "$file" \
+          --set PERL5LIB "$out/lib/perl5/site_perl:${perlPackages.Log4Perl}/lib/perl5/site_perl:${perlPackages.IOSocketInet6}/lib/perl5/site_perl:${perlPackages.Socket6}/lib/perl5/site_perl:${perlPackages.URI}/lib/perl5/site_perl:${perlPackages.DBFile}/lib/perl5/site_perl:${perlPackages.DateManip}/lib/perl5/site_perl:${perlPackages.HTMLTemplate}/lib/perl5/site_perl:${perlPackages.FileCopyRecursive}/lib/perl5/site_perl:${perlPackages.FCGI}/lib/perl5/site_perl:${perlPackages.NetSNMP}/lib/perl5/site_perl:${perlPackages.NetServer}/lib/perl5/site_perl:${perlPackages.ListMoreUtils}/lib/perl5/site_perl:${perlPackages.TimeHiRes}/lib/perl5/site_perl:${rrdtool}/lib/perl:${perlPackages.DBDPg}/lib/perl5/site_perl:${perlPackages.LWPUserAgent}/lib/perl5/site_perl"
     done
   '';
 
diff --git a/pkgs/servers/monitoring/munin/dont_preserve_source_dir_permissions.patch b/pkgs/servers/monitoring/munin/dont_preserve_source_dir_permissions.patch
new file mode 100644
index 00000000000..78eac728305
--- /dev/null
+++ b/pkgs/servers/monitoring/munin/dont_preserve_source_dir_permissions.patch
@@ -0,0 +1,18 @@
+# https://rt.cpan.org/Public/Bug/Display.html?id=75112
+diff --git a/master/lib/Munin/Master/HTMLOld.pm b/master/lib/Munin/Master/HTMLOld.pm
+index 2b6e71f..c0aa2c0 100644
+--- a/master/lib/Munin/Master/HTMLOld.pm
++++ b/master/lib/Munin/Master/HTMLOld.pm
+@@ -711,10 +711,12 @@ sub emit_main_index {
+ 
+ sub copy_web_resources {
+     my ($staticdir, $htmldir) = @_;
++       local $File::Copy::Recursive::KeepMode = 0;
+ 	unless(dircopy($staticdir, "$htmldir/static")){
+ 		ERROR "[ERROR] Could not copy contents from $staticdir to $htmldir";
+ 		die "[ERROR] Could not copy contents from $staticdir to $htmldir";
+ 	}
++       local $File::Copy::Recursive::KeepMode = 1;
+ }
+ 
+ sub instanciate_comparison_templates {
diff --git a/pkgs/servers/sql/mysql51/default.nix b/pkgs/servers/sql/mysql/5.1.x.nix
index b0f125faef7..c210c996532 100644
--- a/pkgs/servers/sql/mysql51/default.nix
+++ b/pkgs/servers/sql/mysql/5.1.x.nix
@@ -3,11 +3,11 @@
 # Note: zlib is not required; MySQL can use an internal zlib.
 
 stdenv.mkDerivation rec {
-  name = "mysql-5.1.69";
+  name = "mysql-5.1.72";
 
   src = fetchurl {
     url = "http://cdn.mysql.com/Downloads/MySQL-5.1/${name}.tar.gz";
-    md5 = "06bbb6a11a2cbe042f80dbd333ff9f12";
+    md5 = "ed79cd48e3e7402143548917813cdb80";
   };
 
   buildInputs = [ncurses zlib perl openssl] ++ stdenv.lib.optional stdenv.isLinux ps;
diff --git a/pkgs/servers/sql/mysql55/default.nix b/pkgs/servers/sql/mysql/5.5.x.nix
index 898acc1ba49..bd30b7db75f 100644
--- a/pkgs/servers/sql/mysql55/default.nix
+++ b/pkgs/servers/sql/mysql/5.5.x.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   name = "mysql-${version}";
-  version = "5.5.31";
+  version = "5.5.34";
 
   src = fetchurl {
     url = "http://cdn.mysql.com/Downloads/MySQL-5.5/${name}.tar.gz";
-    md5 = "bf402cbd52a9af33e5c25b2a4bbc56db";
+    md5 = "930970a42d51e48599deb7fe01778a4a";
   };
 
   buildInputs = [ cmake bison ncurses openssl readline zlib ]
diff --git a/pkgs/servers/sql/mysql51/abi_check.patch b/pkgs/servers/sql/mysql/abi_check.patch
index e9f9cfdc9d9..e9f9cfdc9d9 100644
--- a/pkgs/servers/sql/mysql51/abi_check.patch
+++ b/pkgs/servers/sql/mysql/abi_check.patch
diff --git a/pkgs/servers/sql/mysql/default.nix b/pkgs/servers/sql/mysql/default.nix
deleted file mode 100644
index 3a13aa323a1..00000000000
--- a/pkgs/servers/sql/mysql/default.nix
+++ /dev/null
@@ -1,16 +0,0 @@
-{stdenv, fetchurl, ps, ncurses, zlib ? null, perl}:
-
-# Note: zlib is not required; MySQL can use an internal zlib.
-
-stdenv.mkDerivation {
-  name = "mysql-4.1.18";
-
-  src = fetchurl {
-    url = http://downloads.mysql.com/archives/mysql-4.1/mysql-4.1.18.tar.gz;
-    md5 = "a2db4edb3e1e3b8e0f8c2242225ea513";
-  };
-
-  buildInputs = [ps ncurses zlib perl];
-
-  configureFlags = "--enable-thread-safe-client";
-}
diff --git a/pkgs/servers/sql/mysql5/default.nix b/pkgs/servers/sql/mysql5/default.nix
deleted file mode 100644
index 908ae3fc70c..00000000000
--- a/pkgs/servers/sql/mysql5/default.nix
+++ /dev/null
@@ -1,34 +0,0 @@
-{stdenv, fetchurl, ps, ncurses, zlib, perl, openssl}:
-
-# Note: zlib is not required; MySQL can use an internal zlib.
-
-stdenv.mkDerivation {
-  name = "mysql-5.0.77";
-
-  src = fetchurl {
-    url = http://downloads.mysql.com/archives/mysql-5.0/mysql-5.0.77.tar.gz;
-    sha256 = "1s0m991aynim8ny28cfwhjw0ly8j5d72xi00461w6yc2hlaijcd9";
-  };
-
-  buildInputs = [ps ncurses zlib perl openssl];
-  
-  configureFlags = "--enable-thread-safe-client --with-openssl=${openssl} --with-berkeley-db --with-embedded-server" +
-    (if stdenv.system == "x86_64-linux" then " --with-lib-ccflags=-fPIC" else "");
-
-  NIX_CFLAGS_COMPILE = if stdenv.system == "x86_64-linux" then "-fPIC" else "";
-  
-  NIX_CFLAGS_CXXFLAGS = if stdenv.system == "x86_64-linux" then "-fPIC" else "";
-
-  NIX_LDFLAGS = stdenv.lib.optionalString stdenv.isLinux "-lgcc_s";
-
-  postInstall =
-    ''
-      ln -s mysqld_safe $out/bin/mysqld
-      rm -rf $out/mysql-test $out/sql-bench $out/share/info
-    '';
-
-  meta = {
-    homepage = http://www.mysql.com/;
-    description = "The world's most popular open source database";
-  };
-}
diff --git a/pkgs/servers/sql/postgresql/8.4.x.nix b/pkgs/servers/sql/postgresql/8.4.x.nix
index c8597def61e..a99d7536a8a 100644
--- a/pkgs/servers/sql/postgresql/8.4.x.nix
+++ b/pkgs/servers/sql/postgresql/8.4.x.nix
@@ -1,13 +1,13 @@
 { stdenv, fetchurl, zlib, ncurses, readline }:
 
-let version = "8.4.17"; in
+let version = "8.4.18"; in
 
 stdenv.mkDerivation rec {
   name = "postgresql-${version}";
 
   src = fetchurl {
     url = "mirror://postgresql/source/v${version}/${name}.tar.bz2";
-    sha256 = "0dh4rn4q2amqjwmjjiya99bz1ph3lx45j5brnpwdjd9mxhs4r26w";
+    sha256 = "c08e5e93dac9d484019a07ff91db9f224350b90ef4be1543e33282cc20daf872";
   };
 
   buildInputs = [ zlib ncurses readline ];
diff --git a/pkgs/servers/sql/postgresql/9.0.x.nix b/pkgs/servers/sql/postgresql/9.0.x.nix
index ea25cf0d476..3810eeba72c 100644
--- a/pkgs/servers/sql/postgresql/9.0.x.nix
+++ b/pkgs/servers/sql/postgresql/9.0.x.nix
@@ -1,13 +1,13 @@
 { stdenv, fetchurl, zlib, readline }:
 
-let version = "9.0.13"; in
+let version = "9.0.14"; in
 
 stdenv.mkDerivation rec {
   name = "postgresql-${version}";
 
   src = fetchurl {
     url = "mirror://postgresql/source/v${version}/${name}.tar.bz2";
-    sha256 = "0xwrmwrx0pm21w3ifrqcmb8k2sa46w491ff3gqqfxynyk78a9bji";
+    sha256 = "de42b669cb891fc9b925406e71d1669ed5c856aae6d552ac6f14bf6dec0b79f1";
   };
 
   buildInputs = [ zlib readline ];
diff --git a/pkgs/servers/sql/postgresql/9.1.x.nix b/pkgs/servers/sql/postgresql/9.1.x.nix
index b9436cb4b08..65a969b4db0 100644
--- a/pkgs/servers/sql/postgresql/9.1.x.nix
+++ b/pkgs/servers/sql/postgresql/9.1.x.nix
@@ -1,13 +1,13 @@
 { stdenv, fetchurl, zlib, readline }:
 
-let version = "9.1.9"; in
+let version = "9.1.10"; in
 
 stdenv.mkDerivation rec {
   name = "postgresql-${version}";
 
   src = fetchurl {
     url = "mirror://postgresql/source/v${version}/${name}.tar.bz2";
-    sha256 = "1n1dc1kqc487dylc22iq1j8sn93jxbqm2g4b5rr0i4q0h7hk7998";
+    sha256 = "8329bcd160fcb76ee8c79676f6c979a94069ca5c108449fbb365e1ea98f92b77";
   };
 
   buildInputs = [ zlib readline ];
diff --git a/pkgs/servers/sql/postgresql/9.2.x.nix b/pkgs/servers/sql/postgresql/9.2.x.nix
index 46a6aa0c032..46b7e7ff3c5 100644
--- a/pkgs/servers/sql/postgresql/9.2.x.nix
+++ b/pkgs/servers/sql/postgresql/9.2.x.nix
@@ -1,13 +1,13 @@
 { stdenv, fetchurl, zlib, readline }:
 
-let version = "9.2.4"; in
+let version = "9.2.5"; in
 
 stdenv.mkDerivation rec {
   name = "postgresql-${version}";
 
   src = fetchurl {
     url = "mirror://postgresql/source/v${version}/${name}.tar.bz2";
-    sha256 = "14xfzw3hb2fn60c438v3j7wa65jjm2pnmx4qb4i4ji4am0cdjzfr";
+    sha256 = "22c1edfd6a404bb15fba655863e94f09a10716ded1910a8bc98ee85f413007a4";
   };
 
   buildInputs = [ zlib readline ];
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index 7286f71a8dc..fb8b5856ecb 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -185,7 +185,11 @@ in
       "--with-default-font-path= "  # there were only paths containing "${prefix}",
                                     # and there are no fonts in this package anyway
     ];
-    patches = [./xorgserver-dri-path.patch ./xorgserver-xkbcomp-path.patch];
+    patches =
+      [ ./xorgserver-dri-path.patch
+        ./xorgserver-xkbcomp-path.patch
+        ./xorgserver-cve-2013-4396.patch
+      ];
     buildInputs = attrs.buildInputs ++ [ xtrans ];
     propagatedBuildInputs =
       [ args.zlib args.udev args.mesa args.dbus.libs
diff --git a/pkgs/servers/x11/xorg/xorgserver-cve-2013-4396.patch b/pkgs/servers/x11/xorg/xorgserver-cve-2013-4396.patch
new file mode 100644
index 00000000000..4b6727e61c0
--- /dev/null
+++ b/pkgs/servers/x11/xorg/xorgserver-cve-2013-4396.patch
@@ -0,0 +1,75 @@
+From 7bddc2ba16a2a15773c2ea8947059afa27727764 Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Mon, 16 Sep 2013 21:47:16 -0700
+Subject: [PATCH] Avoid use-after-free in dix/dixfonts.c: doImageText()
+ [CVE-2013-4396]
+
+Save a pointer to the passed in closure structure before copying it
+and overwriting the *c pointer to point to our copy instead of the
+original.  If we hit an error, once we free(c), reset c to point to
+the original structure before jumping to the cleanup code that
+references *c.
+
+Since one of the errors being checked for is whether the server was
+able to malloc(c->nChars * itemSize), the client can potentially pass
+a number of characters chosen to cause the malloc to fail and the
+error path to be taken, resulting in the read from freed memory.
+
+Since the memory is accessed almost immediately afterwards, and the
+X server is mostly single threaded, the odds of the free memory having
+invalid contents are low with most malloc implementations when not using
+memory debugging features, but some allocators will definitely overwrite
+the memory there, leading to a likely crash.
+
+Reported-by: Pedro Ribeiro <pedrib@gmail.com>
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+Reviewed-by: Julien Cristau <jcristau@debian.org>
+---
+ dix/dixfonts.c |    5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/dix/dixfonts.c b/dix/dixfonts.c
+index feb765d..2e34d37 100644
+--- a/dix/dixfonts.c
++++ b/dix/dixfonts.c
+@@ -1425,6 +1425,7 @@ doImageText(ClientPtr client, ITclosurePtr c)
+             GC *pGC;
+             unsigned char *data;
+             ITclosurePtr new_closure;
++            ITclosurePtr old_closure;
+ 
+             /* We're putting the client to sleep.  We need to
+                save some state.  Similar problem to that handled
+@@ -1436,12 +1437,14 @@ doImageText(ClientPtr client, ITclosurePtr c)
+                 err = BadAlloc;
+                 goto bail;
+             }
++            old_closure = c;
+             *new_closure = *c;
+             c = new_closure;
+ 
+             data = malloc(c->nChars * itemSize);
+             if (!data) {
+                 free(c);
++                c = old_closure;
+                 err = BadAlloc;
+                 goto bail;
+             }
+@@ -1452,6 +1455,7 @@ doImageText(ClientPtr client, ITclosurePtr c)
+             if (!pGC) {
+                 free(c->data);
+                 free(c);
++                c = old_closure;
+                 err = BadAlloc;
+                 goto bail;
+             }
+@@ -1464,6 +1468,7 @@ doImageText(ClientPtr client, ITclosurePtr c)
+                 FreeScratchGC(pGC);
+                 free(c->data);
+                 free(c);
++                c = old_closure;
+                 err = BadAlloc;
+                 goto bail;
+             }
+-- 
+1.7.9.2
diff --git a/pkgs/tools/compression/gzrt/default.nix b/pkgs/tools/compression/gzrt/default.nix
new file mode 100644
index 00000000000..44073f84a5d
--- /dev/null
+++ b/pkgs/tools/compression/gzrt/default.nix
@@ -0,0 +1,23 @@
+{ stdenv, fetchurl, zlib }:
+
+stdenv.mkDerivation rec {
+  name = "gzrt-0.8";
+
+  src = fetchurl {
+    url = "http://www.urbanophile.com/arenn/coding/gzrt/${name}.tar.gz";
+    sha256 = "1vhzazj47xfpbfhzkwalz27cc0n5gazddmj3kynhk0yxv99xrdxh";
+  };
+
+  buildInputs = [ zlib ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp gzrecover $out/bin
+  '';
+
+  meta = {
+    homepage = http://www.urbanophile.com/arenn/hacking/gzrt/;
+    description = "The gzip Recovery Toolkit";
+    license = stdenv.lib.licenses.gpl3;
+  };
+}
diff --git a/pkgs/tools/graphics/asymptote/default.nix b/pkgs/tools/graphics/asymptote/default.nix
index e32a3901a92..e9f61228bed 100644
--- a/pkgs/tools/graphics/asymptote/default.nix
+++ b/pkgs/tools/graphics/asymptote/default.nix
@@ -11,11 +11,11 @@ let
   s = # Generated upstream information
   rec {
     baseName="asymptote";
-    version="2.21";
-    name="asymptote-2.21";
-    hash="07lkj0xnxpanfscmbm30lw6j9484rlmmqpnl0mhs7nx9h2lczrjz";
-    url="mirror://sourceforge/project/asymptote/2.21/asymptote-2.21.src.tgz";
-    sha256="07lkj0xnxpanfscmbm30lw6j9484rlmmqpnl0mhs7nx9h2lczrjz";
+    version="2.24";
+    name="asymptote-2.24";
+    hash="0iypv3n89h8mx46b0c3msl0ldmg7fxf8v9fl4zy4sxfszazrvivl";
+    url="mirror://sourceforge/project/asymptote/2.24/asymptote-2.24.src.tgz";
+    sha256="0iypv3n89h8mx46b0c3msl0ldmg7fxf8v9fl4zy4sxfszazrvivl";
   };
   buildInputs = with a; [
     freeglut ghostscriptX imagemagick fftw boehmgc
diff --git a/pkgs/tools/misc/plantuml/default.nix b/pkgs/tools/misc/plantuml/default.nix
new file mode 100644
index 00000000000..10886e969a2
--- /dev/null
+++ b/pkgs/tools/misc/plantuml/default.nix
@@ -0,0 +1,37 @@
+{ stdenv, fetchurl, jre, graphviz }:
+
+stdenv.mkDerivation rec {
+  version = "7982";
+  name = "plantuml-${version}";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/project/plantuml/plantuml.${version}.jar";
+    sha256 = "0hxs0whjgx36j5azdcna40rw2c7smhg0qm3kzld9vx88m0c51dgl";
+  };
+
+  # It's only a .jar file and a shell wrapper
+  phases = [ "installPhase" ];
+
+  installPhase = ''
+    mkdir -p "$out/bin"
+    mkdir -p "$out/lib"
+
+    cp "$src" "$out/lib/plantuml.jar"
+
+    cat > "$out/bin/plantuml" << EOF
+    #!${stdenv.shell}
+    export GRAPHVIZ_DOT="${graphviz}/bin/dot"
+    exec "${jre}/bin/java" -jar "$out/lib/plantuml.jar" "\$@"
+    EOF
+    chmod a+x "$out/bin/plantuml"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Draw UML diagrams using a simple and human readable text description";
+    homepage = http://plantuml.sourceforge.net/;
+    # "java -jar plantuml.jar -license" says GPLv3 or later
+    license = licenses.gpl3Plus;
+    maintainers = [ maintainers.bjornfor ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/tools/networking/curl/7.15.nix b/pkgs/tools/networking/curl/7.15.nix
new file mode 100644
index 00000000000..0a87eaa944c
--- /dev/null
+++ b/pkgs/tools/networking/curl/7.15.nix
@@ -0,0 +1,75 @@
+{ stdenv, fetchurl
+, zlibSupport ? false, zlib ? null
+, sslSupport ? false, openssl ? null
+, scpSupport ? false, libssh2 ? null
+, gssSupport ? false, gss ? null
+, c-aresSupport ? false, c-ares ? null
+, linkStatic ? false
+}:
+
+assert zlibSupport -> zlib != null;
+assert sslSupport -> openssl != null;
+assert scpSupport -> libssh2 != null;
+assert c-aresSupport -> c-ares != null;
+
+stdenv.mkDerivation rec {
+  name = "curl-7.15.0";
+
+  src = fetchurl {
+    url = "http://curl.haxx.se/download/archeology/${name}.tar.gz";
+    sha256 = "061bgjm6rv0l9804vmm4jvr023l52qvmy9qq4zjv4lgqhlljvhz3";
+  };
+
+  # Zlib and OpenSSL must be propagated because `libcurl.la' contains
+  # "-lz -lssl", which aren't necessary direct build inputs of
+  # applications that use Curl.
+  propagatedBuildInputs = with stdenv.lib;
+    optional zlibSupport zlib ++
+    optional gssSupport gss ++
+    optional c-aresSupport c-ares ++
+    optional sslSupport openssl;
+
+  preConfigure = ''
+    sed -e 's|/usr/bin|/no-such-path|g' -i.bak configure
+  '';
+  configureFlags = [
+      ( if sslSupport then "--with-ssl=${openssl}" else "--without-ssl" )
+      ( if scpSupport then "--with-libssh2=${libssh2}" else "--without-libssh2" )
+    ]
+    ++ stdenv.lib.optional c-aresSupport "--enable-ares=${c-ares}"
+    ++ stdenv.lib.optional gssSupport "--with-gssapi=${gss}"
+    ++ stdenv.lib.optionals linkStatic [ "--enable-static" "--disable-shared" ]
+  ;
+
+  dontDisableStatic = linkStatic;
+
+  CFLAGS = if stdenv ? isDietLibC then "-DHAVE_INET_NTOA_R_2_ARGS=1" else "";
+  LDFLAGS = if linkStatic then "-static" else "";
+  CXX = "g++";
+  CXXCPP = "g++ -E";
+
+  # libtool hack to get a static binary. Notice that to 'configure' I passed
+  # other LDFLAGS, because it doesn't use libtool for linking in the tests.
+  makeFlags = if linkStatic then "LDFLAGS=-all-static" else "";
+
+  crossAttrs = {
+    # We should refer to the cross built openssl
+    # For the 'urandom', maybe it should be a cross-system option
+    configureFlags = [
+        ( if sslSupport then "--with-ssl=${openssl.crossDrv}" else "--without-ssl" )
+        "--with-random /dev/urandom"
+      ]
+      ++ stdenv.lib.optionals linkStatic [ "--enable-static" "--disable-shared" ]
+    ;
+  };
+
+  passthru = {
+    inherit sslSupport openssl;
+  };
+
+  meta = {
+    homepage = "http://curl.haxx.se/";
+    description = "A command line tool for transferring files with URL syntax";
+    platforms = stdenv.lib.platforms.all;
+  };
+}
diff --git a/pkgs/tools/package-management/nix/unstable.nix b/pkgs/tools/package-management/nix/unstable.nix
index ba0353e4507..a548a9f13bd 100644
--- a/pkgs/tools/package-management/nix/unstable.nix
+++ b/pkgs/tools/package-management/nix/unstable.nix
@@ -5,11 +5,11 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "nix-1.6pre3220_fecad91";
+  name = "nix-1.7pre3252_792fd51";
 
   src = fetchurl {
-    url = "http://hydra.nixos.org/build/6038922/download/5/${name}.tar.xz";
-    sha256 = "0251b8cb7ad2a4974a9c8002c65f1c6e1b334be082d3dd2f085929594637f947";
+    url = "http://hydra.nixos.org/build/6500161/download/5/${name}.tar.xz";
+    sha256 = "f99c1996292ea1a20068f0a6d58d3dc4775f30fdd22cdd756ac4d749acb2c20e";
   };
 
   nativeBuildInputs = [ perl pkgconfig ];
diff --git a/pkgs/tools/security/fail2ban/default.nix b/pkgs/tools/security/fail2ban/default.nix
index dd869714e05..1a443fc18b6 100644
--- a/pkgs/tools/security/fail2ban/default.nix
+++ b/pkgs/tools/security/fail2ban/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchurl, pythonPackages, unzip, gamin }:
 
-let version = "0.8.6"; in
+let version = "0.8.10"; in
 
 pythonPackages.buildPythonPackage {
   name = "fail2ban-${version}";
@@ -9,7 +9,7 @@ pythonPackages.buildPythonPackage {
   src = fetchurl {
     url    = "https://github.com/fail2ban/fail2ban/zipball/${version}";
     name   = "fail2ban-${version}.zip";
-    sha256 = "0lbanfshr8kasa1bb7861w3mrm2d0c1bvv4s5703265s8zp5m284";
+    sha256 = "0zbjwnghpdnzan7hn40cjjh2r06p2ph5kblpm0w1r72djwsk67x9";
   };
 
   buildInputs = [ unzip ];
@@ -21,6 +21,7 @@ pythonPackages.buildPythonPackage {
       --replace /usr $out
 
     substituteInPlace setup.py \
+      --replace /usr $out \
       --replace /etc $out/etc \
       --replace /var $TMPDIR/var \
 
@@ -28,7 +29,7 @@ pythonPackages.buildPythonPackage {
       substituteInPlace $i \
         --replace /usr/share/fail2ban $out/share/fail2ban
     done
-    
+
     for i in config/action.d/sendmail*.conf; do
       substituteInPlace $i \
         --replace /usr/sbin/sendmail sendmail \
@@ -37,7 +38,7 @@ pythonPackages.buildPythonPackage {
   '';
 
   doCheck = false;
-  
+
   installCommand = ''
     python setup.py install --prefix=$out
   '';
diff --git a/pkgs/tools/security/prey/default.nix b/pkgs/tools/security/prey/default.nix
new file mode 100644
index 00000000000..fe71806301d
--- /dev/null
+++ b/pkgs/tools/security/prey/default.nix
@@ -0,0 +1,46 @@
+{ stdenv, fetchurl, fetchgit, curl, scrot, imagemagick, xawtv, inetutils, makeWrapper, coreutils
+, apiKey ? ""
+, deviceKey ? "" }:
+
+# TODO: this should assert keys are set, somehow if set through .override assertion fails
+#assert apiKey != "";
+#assert deviceKey != "";
+
+let
+  modulesSrc = fetchgit {
+    url = "git://github.com/prey/prey-bash-client-modules.git";
+    rev = "aba260ef110834cb2e92923a31f50c15970639ee";
+  };
+in stdenv.mkDerivation rec {
+  name = "prey-bash-client-${version}";
+  version = "0.6.0";
+
+  src = fetchurl {
+    url = "https://github.com/prey/prey-bash-client/archive/v${version}.tar.gz";
+    sha256 = "09cb15jh4jdwvix9nx048ajkw2r5jaflk68y3rkha541n8n0qwh0";
+  };
+
+  buildInputs = [ curl scrot imagemagick xawtv makeWrapper ];
+
+  phases = "unpackPhase installPhase";
+
+  installPhase = ''
+    substituteInPlace config --replace api_key=\'\' "api_key='${apiKey}'"
+    substituteInPlace config --replace device_key=\'\' "device_key='${deviceKey}'"
+
+    substituteInPlace prey.sh --replace /bin/bash $(type -Pp bash)
+    mkdir -p $out/modules
+    cp -R . $out
+    cp -R ${modulesSrc}/* $out/modules/
+    wrapProgram "$out/prey.sh" \
+      --prefix PATH ":" "${xawtv}/bin:${imagemagick}/bin:${curl}/bin:${scrot}/bin:${inetutils}/bin:${coreutils}/bin" \
+      --set CURL_CA_BUNDLE "/etc/ssl/certs/ca-bundle.crt"
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = http://preyproject.com;
+    description = "Proven tracking software that helps you find, lock and recover your devices when stolen or missing";
+    maintainers = with maintainers; [ iElectric ];
+    license = licenses.gpl3;
+  };
+}
diff --git a/pkgs/tools/system/pciutils/default.nix b/pkgs/tools/system/pciutils/default.nix
index 3f63d077c7f..93486d3decf 100644
--- a/pkgs/tools/system/pciutils/default.nix
+++ b/pkgs/tools/system/pciutils/default.nix
@@ -3,8 +3,8 @@
 let
   pciids = fetchurl {
     # Obtained from http://pciids.sourceforge.net/v2.2/pci.ids.bz2.
-    url = http://tarballs.nixos.org/pci.ids.20120929.bz2;
-    sha256 = "1q3i479ay88wam1zz1vbgkbqb2axg8av9qjxaigrqbnw2pv0srmb";
+    url = http://tarballs.nixos.org/pci.ids.20131006.bz2;
+    sha256 = "1vmshcgxqminiyh52pdcak24lm24qlic49py9cmkp96y1s48lvsc";
   };
 in
 stdenv.mkDerivation rec {
@@ -17,8 +17,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ pkgconfig zlib kmod which ];
 
-  # currently up-to-date
-  #preBuild = "bunzip2 < ${pciids} > pci.ids";
+  preBuild = "bunzip2 < ${pciids} > pci.ids";
 
   makeFlags = "SHARED=yes PREFIX=\${out}";
 
diff --git a/pkgs/tools/system/sleuthkit/default.nix b/pkgs/tools/system/sleuthkit/default.nix
index 86ec54ecb8f..0148e3c699e 100644
--- a/pkgs/tools/system/sleuthkit/default.nix
+++ b/pkgs/tools/system/sleuthkit/default.nix
@@ -1,48 +1,24 @@
-x@{builderDefsPackage
-  , libewf, afflib, openssl, zlib
-  , ...}:
-builderDefsPackage
-(a :  
-let 
-  helperArgNames = ["stdenv" "fetchurl" "builderDefsPackage"] ++ 
-    [];
+{ stdenv, fetchurl, libewf, afflib, openssl, zlib }:
 
-  buildInputs = map (n: builtins.getAttr n x)
-    (builtins.attrNames (builtins.removeAttrs x helperArgNames));
-  sourceInfo = rec {
-    baseName="sleuthkit";
-    version="3.2.2";
-    name="${baseName}-${version}";
-    url="mirror://sourceforge/project/${baseName}/${baseName}/${version}/${name}.tar.gz";
-    hash="02hik5xvbgh1dpisvc3wlhhq1aprnlsk0spbw6h5khpbq9wqnmgj";
-  };
-in
-rec {
-  src = a.fetchurl {
-    url = sourceInfo.url;
-    sha256 = sourceInfo.hash;
+stdenv.mkDerivation rec {
+  name = "sleuthkit-3.2.2";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/sleuthkit/${name}.tar.gz";
+    sha256 = "02hik5xvbgh1dpisvc3wlhhq1aprnlsk0spbw6h5khpbq9wqnmgj";
   };
 
-  inherit (sourceInfo) name version;
-  inherit buildInputs;
+  enableParallelBuilding = true;
+
+  buildInputs = [ libewf afflib openssl zlib ];
+
+  # Hack to fix the RPATH.
+  preFixup = "rm -rf */.libs";
 
-  /* doConfigure should be removed if not needed */
-  phaseNames = ["doConfigure" "doMakeInstall"];
-      
   meta = {
     description = "A forensic/data recovery tool";
-    maintainers = with a.lib.maintainers;
-    [
-      raskin
-    ];
-    platforms = with a.lib.platforms;
-      linux;
+    maintainers = [ stdenv.lib.maintainers.raskin ];
+    platforms = stdenv.lib.platforms.linux;
     license = "IBM Public License";
   };
-  passthru = {
-    updateInfo = {
-      downloadPage = "http://sourceforge.net/projects/sleuthkit/files/sleuthkit";
-    };
-  };
-}) x
-
+}
diff --git a/pkgs/tools/text/xml/html-xml-utils/default.nix b/pkgs/tools/text/xml/html-xml-utils/default.nix
new file mode 100644
index 00000000000..f52855dfc53
--- /dev/null
+++ b/pkgs/tools/text/xml/html-xml-utils/default.nix
@@ -0,0 +1,20 @@
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  name = "html-xml-utils-6.4";
+
+  src = fetchurl {
+    url = "http://www.w3.org/Tools/HTML-XML-utils/${name}.tar.gz";
+
+    sha256 = "0dqa8vjk5my728hmb7dhl6nbg7946fh905j0yzlwx7p7rg2zrxcp";
+  };
+
+  patches = [ ./no-Boolean-type.patch ];
+
+  meta = {
+    description = "Utilities for manipulating HTML and XML files";
+    homepage = http://www.w3.org/Tools/HTML-XML-utils/;
+    license = "free-non-copyleft";
+    maintainers = [ stdenv.lib.maintainers.shlevy ];
+  };
+}
diff --git a/pkgs/tools/text/xml/html-xml-utils/no-Boolean-type.patch b/pkgs/tools/text/xml/html-xml-utils/no-Boolean-type.patch
new file mode 100644
index 00000000000..f675c4280e7
--- /dev/null
+++ b/pkgs/tools/text/xml/html-xml-utils/no-Boolean-type.patch
@@ -0,0 +1,20 @@
+diff -Naur html-xml-utils-6.4-orig/openurl.c html-xml-utils-6.4/openurl.c
+--- html-xml-utils-6.4-orig/openurl.c	2012-10-23 09:55:12.000000000 -0400
++++ html-xml-utils-6.4/openurl.c	2013-10-17 14:05:11.424077842 -0400
+@@ -66,6 +66,7 @@
+ #include <stdlib.h>
+ #include <stdarg.h>
+ #include <assert.h>
++#include <stdbool.h>
+ #include "export.h"
+ #if HAVE_LIBCURL && !HAVE_FOPENCOOKIE
+ # include "fopencookie.e"	/* Use our own fopencookie() */
+@@ -505,7 +506,7 @@
+ 			const conststring path, Dictionary request,
+ 			Dictionary response, int maxredirs, int *status)
+ {
+-  Boolean delete_response = !response;
++  bool delete_response = !response;
+   conststring h, v;
+   char buf[BUFLEN];
+   int fd, n, i;
diff --git a/pkgs/tools/typesetting/pdf2djvu/default.nix b/pkgs/tools/typesetting/pdf2djvu/default.nix
index b7204b95784..b97252e74de 100644
--- a/pkgs/tools/typesetting/pdf2djvu/default.nix
+++ b/pkgs/tools/typesetting/pdf2djvu/default.nix
@@ -1,12 +1,12 @@
 {stdenv, fetchurl, pkgconfig, djvulibre, poppler, fontconfig, libjpeg }:
 
 stdenv.mkDerivation rec {
-  version = "0.7.16";
+  version = "0.7.17";
   name = "pdf2djvu-${version}";
 
   src = fetchurl {
     url = "http://pdf2djvu.googlecode.com/files/pdf2djvu_${version}.tar.gz";
-    sha256 = "1yg4ppqxpfda89yi4c3rrq2zhar5dzyqypvqdvdd0r7is2321nnv";
+    sha256 = "1nplcabb8526bs5707k9212pi000wnskq3c9hbq9acgmdlnnwvgy";
   };
 
   buildInputs = [ pkgconfig djvulibre poppler fontconfig libjpeg ];
diff --git a/pkgs/tools/typesetting/tex/tex4ht/default.nix b/pkgs/tools/typesetting/tex/tex4ht/default.nix
index 24612de549e..f903ef5792f 100644
--- a/pkgs/tools/typesetting/tex/tex4ht/default.nix
+++ b/pkgs/tools/typesetting/tex/tex4ht/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
     for f in src/tex4ht src/t4ht src/htcmd "bin/unix/"*; do
       mv $f $out/bin/
     done
-    mv texmf $out/
+    mv texmf $out/texmf-dist
   '';
 
   meta = {
diff --git a/pkgs/tools/typesetting/tex/texlive/aggregate.nix b/pkgs/tools/typesetting/tex/texlive/aggregate.nix
index 84fa1cfab75..2d1de93fed8 100644
--- a/pkgs/tools/typesetting/tex/texlive/aggregate.nix
+++ b/pkgs/tools/typesetting/tex/texlive/aggregate.nix
@@ -3,6 +3,7 @@ rec {
   name = "TeXLive-linkdir";
 
   buildInputs = lib.closePropagation paths
+    ++ [perl]
     ++ stdenv.lib.optional stdenv.isDarwin makeWrapper;
 
   phaseNames = [ "doAggregate" ];
@@ -11,12 +12,15 @@ rec {
     mkdir -p $out/bin
     for currentPath in ${lib.concatStringsSep " " buildInputs}; do
         echo Symlinking "$currentPath"
+        find $currentPath/share/info $currentPath/share/man $(echo $currentPath/texmf*/) -type d | while read; do
+            REPLY="''${REPLY#$currentPath}"
+            mkdir -p $out/"$REPLY"
+	done
         find $currentPath/share/info $currentPath/share/man $(echo $currentPath/texmf*/) ! -type d | while read; do
             REPLY="''${REPLY#$currentPath}"
-            mkdir -p $out/"$(dirname "$REPLY")"
             ln -fs $currentPath/"$REPLY" $out/"$REPLY"
             echo
-        done | while read; do head -n 99 >/dev/null; echo -n .; done
+        done | while read; do head -n 999 >/dev/null; echo -n .; done
 
         for i in "$currentPath/bin/"* :; do
             test "$i" != : || continue
@@ -31,8 +35,8 @@ rec {
 
     ln -s $out/texmf* $out/share/
 
-    rm -r $out/texmf-config
-    find $out/texmf/ -type d | while read; do
+    rm -rf $out/texmf-config
+    find $out/texmf*/ -type d | while read; do
       REPLY="''${REPLY#$out/texmf}"
       mkdir -p $out/texmf-config/"$REPLY"
     done
@@ -45,9 +49,10 @@ rec {
         chmod a+x $out/bin/$(basename $i)
     done
 
-    rm $out/texmf*/ls-R
+    rm -f $out/texmf*/ls-R
     for i in web2c texconfig fonts/map; do
-        cp -Lr $out/texmf/$i/* $out/texmf-config/$i || true
+        mkdir -p $out/texmf-config/$i 
+        cp -Lr $out/texmf*/$i/* $out/texmf-config/$i || true
     done
     chmod -R u+w $out/texmf-config
 
diff --git a/pkgs/tools/typesetting/tex/texlive/cm-super.nix b/pkgs/tools/typesetting/tex/texlive/cm-super.nix
index e23b3936850..4d161c3e053 100644
--- a/pkgs/tools/typesetting/tex/texlive/cm-super.nix
+++ b/pkgs/tools/typesetting/tex/texlive/cm-super.nix
@@ -10,16 +10,16 @@ rec {
   doCopy = fullDepEntry (''
     mkdir -p $out/share/
 
-    mkdir -p $out/texmf/fonts/enc
-    mkdir -p $out/texmf/fonts/map
-    mkdir -p $out/texmf/fonts/type1/public/cm-super
-    cp pfb/*.pfb $out/texmf/fonts/type1/public/cm-super
-    mkdir -p $out/texmf/dvips/cm-super
-    cp dvips/*.{map,enc}  $out/texmf/dvips/cm-super
-    cp dvips/*.enc  $out/texmf/fonts/enc
-    cp dvips/*.map  $out/texmf/fonts/map
-    mkdir -p $out/texmf/dvipdfm/config
-    cp dvipdfm/*.map  $out/texmf/dvipdfm/config
+    mkdir -p $out/texmf-dist/fonts/enc
+    mkdir -p $out/texmf-dist/fonts/map
+    mkdir -p $out/texmf-dist/fonts/type1/public/cm-super
+    cp pfb/*.pfb $out/texmf-dist/fonts/type1/public/cm-super
+    mkdir -p $out/texmf-dist/dvips/cm-super
+    cp dvips/*.{map,enc}  $out/texmf-dist/dvips/cm-super
+    cp dvips/*.enc  $out/texmf-dist/fonts/enc
+    cp dvips/*.map  $out/texmf-dist/fonts/map
+    mkdir -p $out/texmf-dist/dvipdfm/config
+    cp dvipdfm/*.map  $out/texmf-dist/dvipdfm/config
 
     ln -s $out/texmf* $out/share/
   '') ["minInit" "doUnpack" "defEnsureDir" "addInputs"];
diff --git a/pkgs/tools/typesetting/tex/texlive/context.nix b/pkgs/tools/typesetting/tex/texlive/context.nix
index a7161cea4c1..c0c702cd418 100644
--- a/pkgs/tools/typesetting/tex/texlive/context.nix
+++ b/pkgs/tools/typesetting/tex/texlive/context.nix
@@ -11,8 +11,8 @@ rec {
   doCopy = fullDepEntry (''
     mkdir -p $out/share/
 
-    mkdir -p $out/texmf
-    cp -r * $out/texmf
+    mkdir -p $out/texmf-dist
+    cp -r * $out/texmf-dist
 
     ln -s $out/texmf* $out/share/
   '') ["minInit" "doUnpack" "defEnsureDir" "addInputs"];
diff --git a/pkgs/tools/typesetting/tex/texlive/default.nix b/pkgs/tools/typesetting/tex/texlive/default.nix
index f119dbd1e4a..57f7424dc2d 100644
--- a/pkgs/tools/typesetting/tex/texlive/default.nix
+++ b/pkgs/tools/typesetting/tex/texlive/default.nix
@@ -1,18 +1,18 @@
 args : with args;
 rec {
   src = fetchurl {
-    url = mirror://debian/pool/main/t/texlive-bin/texlive-bin_2012.20120628.orig.tar.xz;
-    sha256 = "0k94df3lfvghngzdzi2d4fz2z0gs8iglz7h3w2lxvlhiwwpmx601";
+    url = mirror://debian/pool/main/t/texlive-bin/texlive-bin_2013.20130729.30972.orig.tar.xz;
+    sha256 = "1idgyim6r4bi3id245k616qrdarfh65xv3gi2psarqqmsw504yhd";
   };
 
   texmfSrc = fetchurl {
-    url = mirror://debian/pool/main/t/texlive-base/texlive-base_2012.20120611.orig.tar.xz;
-    sha256 = "116zm0qdq9rd4vakhd2py9q7lq3ihspc7hy33bh8wy5v1rgiqsm6";
+    url = mirror://debian/pool/main/t/texlive-base/texlive-base_2013.20130918.orig.tar.xz;
+    sha256 = "0h7x49zsd2gs8fr28f4h04dv5m8p2mpgqxk2vvl5xlf4wwxxbm2p";
   };
 
   langTexmfSrc = fetchurl {
-    url = mirror://debian/pool/main/t/texlive-lang/texlive-lang_2012.20120611.orig.tar.xz;
-    sha256 = "0zh9svszfkbjx72i7sa9gg0gak93wf05845mxpjv56h8qwk4bffv";
+    url = mirror://debian/pool/main/t/texlive-lang/texlive-lang_2013.20131010.orig.tar.xz;
+    sha256 = "17wfd2qmyafv74ac3ssy9aga12g09l2q0r1p19fb4vvs0wrkwzbz";
   };
 
   setupHook = ./setup-hook.sh;
@@ -34,6 +34,8 @@ rec {
     sed -e 's@\<env python@${python}/bin/python@' -i $(grep 'env python' -rl . )
 
     sed -e '/ubidi_open/i#include <unicode/urename.h>' -i $(find . -name configure)
+    sed -e 's/-lttf/-lfreetype/' -i $(find . -name configure)
+
     sed -e s@ncurses/curses.h@curses.h@g -i $(grep ncurses/curses.h -rl . )
     sed -e '1i\#include <string.h>\n\#include <stdlib.h>' -i $( find libs/teckit -name '*.cpp' -o -name '*.c' )
 
@@ -44,7 +46,7 @@ rec {
     cd Work
   '' ) [ "minInit" "doUnpack" "addInputs" "defEnsureDir" ];
 
-  doPostInstall = fullDepEntry( ''
+  promoteLibexec = fullDepEntry (''
     mkdir -p $out/libexec/
     mv $out/bin $out/libexec/$(uname -m)
     mkdir -p $out/bin
@@ -61,13 +63,15 @@ rec {
           rm "$out/libexec/$(basename "$i")"
       fi;
     done
+  '') ["doMakeInstall"];
 
-    [ -d $out/texmf-config ] || ln -s $out/texmf $out/texmf-config
-    ln -s -v "$out/"*texmf* "$out/share/" || true
-
-    sed -e 's/.*pyhyph.*/=&/' -i $out/texmf-config/tex/generic/config/language.dat
+  doPostInstall = fullDepEntry( ''
+    cp -r "$out/"texmf* "$out/share/" || true
+    rm -rf "$out"/texmf*
+    [ -d $out/share/texmf-config ] || ln -s $out/share/texmf-dist $out/share/texmf-config
+    ln -s "$out"/share/texmf* "$out"/
 
-    PATH=$PATH:$out/bin mktexlsr $out/texmf*
+    PATH=$PATH:$out/bin mktexlsr $out/share/texmf*
 
     HOME=. PATH=$PATH:$out/bin updmap-sys --syncwithtrees
 
@@ -80,25 +84,37 @@ rec {
     #
     # I find it acceptable, hence the "|| true".
     echo "building format files..."
-    mkdir -p "$out/texmf-var/web2c"
+    mkdir -p "$out/share/texmf-var/web2c"
+    ln -sf "$out"/out/share/texmf* "$out"/
     PATH="$PATH:$out/bin" fmtutil-sys --all || true
 
-    PATH=$PATH:$out/bin mktexlsr $out/texmf*
+    PATH=$PATH:$out/bin mktexlsr $out/share/texmf*
   '' + stdenv.lib.optionalString stdenv.isDarwin ''
     for prog in $out/bin/*; do
       wrapProgram "$prog" --prefix DYLD_LIBRARY_PATH : "${poppler}/lib"
     done
-  '' ) [ "minInit" "defEnsureDir" "doUnpack" "doMakeInstall" ];
+  '' ) [ "minInit" "defEnsureDir" "doUnpack" "doMakeInstall" "promoteLibexec" "patchShebangsInterim"];
+
+  patchShebangsInterimBin = doPatchShebangs ''$out/bin/'';
+  patchShebangsInterimLibexec = doPatchShebangs ''$out/libexec/'';
+  patchShebangsInterimShareTexmfDist = doPatchShebangs ''$out/share/texmf-dist/scripts/'';
+  patchShebangsInterimTexmfDist = doPatchShebangs ''$out/texmf-dist/scripts/'';
+
+  patchShebangsInterim = fullDepEntry ("") ["patchShebangsInterimBin" 
+    "patchShebangsInterimLibexec" "patchShebangsInterimTexmfDist" 
+    "patchShebangsInterimShareTexmfDist"];
 
   buildInputs = [ zlib bzip2 ncurses libpng flex bison libX11 libICE xproto
     freetype t1lib gd libXaw icu ghostscript ed libXt libXpm libXmu libXext
     xextproto perl libSM ruby expat curl libjpeg python fontconfig xz pkgconfig
-    poppler silgraphite lesstif zziplib ]
+    poppler graphite2 lesstif zziplib harfbuzz texinfo ]
     ++ stdenv.lib.optionals stdenv.isDarwin [ makeWrapper ];
 
   configureFlags = [ "--with-x11" "--enable-ipc" "--with-mktexfmt"
     "--enable-shared" "--disable-native-texlive-build" "--with-system-zziplib"
-    "--with-system-libgs" "--with-system-t1lib" "--with-system-freetype2" ]
+    "--with-system-libgs" "--with-system-t1lib" "--with-system-freetype2" 
+    "--with-system-freetype=no" "--disable-ttf2pk" "--enable-ttf2pk2"
+    ]
     ++ ( if stdenv.isDarwin
          # ironically, couldn't get xetex compiling on darwin
          then [ "--disable-xetex" "--disable-xdv2pdf" "--disable-xdvipdfmx" ]
@@ -107,7 +123,7 @@ rec {
 
   phaseNames = [ "addInputs" "doMainBuild" "doMakeInstall" "doPostInstall" ];
 
-  name = "texlive-core-2012";
+  name = "texlive-core-2013";
 
   meta = with stdenv.lib; {
     description = "A TeX distribution";
diff --git a/pkgs/tools/typesetting/tex/texlive/extra.nix b/pkgs/tools/typesetting/tex/texlive/extra.nix
index 180019bb205..6613578e2c6 100644
--- a/pkgs/tools/typesetting/tex/texlive/extra.nix
+++ b/pkgs/tools/typesetting/tex/texlive/extra.nix
@@ -1,9 +1,9 @@
 args: with args;
 rec {
-  name = "texlive-extra-2012";
+  name = "texlive-extra-2013";
   src = fetchurl {
-    url = mirror://debian/pool/main/t/texlive-extra/texlive-extra_2012.20120611.orig.tar.xz;
-    sha256 = "1wn2gwifb5ww6nb15zdbkk5yz5spynvwqscvrgxzb84p0z3hy8dq";
+    url = mirror://debian/pool/main/t/texlive-extra/texlive-extra_2013.20131010.orig.tar.xz;
+    sha256 = "1wciyjwp0swny22amwcnr6vvdwjy423856q7c3l1sd5b31xfbc18";
   };
 
   buildInputs = [texLive xz];
diff --git a/pkgs/tools/typesetting/tex/texlive/moderncv.nix b/pkgs/tools/typesetting/tex/texlive/moderncv.nix
index 28329cff916..0ce1afbb41b 100644
--- a/pkgs/tools/typesetting/tex/texlive/moderncv.nix
+++ b/pkgs/tools/typesetting/tex/texlive/moderncv.nix
@@ -10,9 +10,9 @@ rec {
   buildInputs = [texLive unzip];
   phaseNames = ["doCopy"];
   doCopy = fullDepEntry (''
-    mkdir -p $out/texmf/tex/latex/moderncv $out/texmf/doc $out/share
-    mv *.cls *.sty $out/texmf/tex/latex/moderncv/
-    mv examples $out/texmf/doc/moderncv
+    mkdir -p $out/texmf-dist/tex/latex/moderncv $out/texmf-dist/doc $out/share
+    mv *.cls *.sty $out/texmf-dist/tex/latex/moderncv/
+    mv examples $out/texmf-dist/doc/moderncv
     ln -s $out/texmf* $out/share/
   '') ["minInit" "addInputs" "doUnpack" "defEnsureDir"];
 
diff --git a/pkgs/tools/typesetting/tex/texlive/moderntimeline.nix b/pkgs/tools/typesetting/tex/texlive/moderntimeline.nix
index d129cc62020..4cb93794edf 100644
--- a/pkgs/tools/typesetting/tex/texlive/moderntimeline.nix
+++ b/pkgs/tools/typesetting/tex/texlive/moderntimeline.nix
@@ -13,9 +13,9 @@ rec {
   buildInputs = [texLive unzip];
   phaseNames = ["doCopy"];
   doCopy = fullDepEntry (''
-    mkdir -p $out/texmf/tex/latex/moderntimeline $out/texmf/doc/moderntimeline $out/share
-    mv *.dtx *.ins $out/texmf/tex/latex/moderntimeline/
-    mv *.pdf $out/texmf/doc/moderntimeline/
+    mkdir -p $out/texmf-dist/tex/latex/moderntimeline $out/texmf-dist/doc/moderntimeline $out/share
+    mv *.dtx *.ins $out/texmf-dist/tex/latex/moderntimeline/
+    mv *.pdf $out/texmf-dist/doc/moderntimeline/
     ln -s $out/texmf* $out/share/
   '') ["minInit" "addInputs" "doUnpack" "defEnsureDir"];
 
diff --git a/pkgs/tools/typesetting/tex/texlive/pgf.nix b/pkgs/tools/typesetting/tex/texlive/pgf.nix
index 1f7abc126c3..b46229e9828 100644
--- a/pkgs/tools/typesetting/tex/texlive/pgf.nix
+++ b/pkgs/tools/typesetting/tex/texlive/pgf.nix
@@ -14,8 +14,8 @@ rec {
   phaseNames = ["doCopy"];
   doCopy = fullDepEntry (''
     mkdir -p $out/share/
-    mkdir -p $out/texmf/tex/generic/pgf
-    cp -r * $out/texmf/tex/generic/pgf
+    mkdir -p $out/texmf-dist/tex/generic/pgf
+    cp -r * $out/texmf-dist/tex/generic/pgf
     ln -s $out/texmf* $out/share/
   '') ["minInit" "doUnpack" "defEnsureDir" "addInputs"];
 
diff --git a/pkgs/tools/typesetting/tex/texlive/xcolor.nix b/pkgs/tools/typesetting/tex/texlive/xcolor.nix
index e59a58ce9b2..892734afe46 100644
--- a/pkgs/tools/typesetting/tex/texlive/xcolor.nix
+++ b/pkgs/tools/typesetting/tex/texlive/xcolor.nix
@@ -12,11 +12,11 @@ rec {
     export HOME=$PWD
     mkdir -p $out/share/
 
-    mkdir -p $out/texmf/tex/latex/xcolor
-    mkdir -p $out/texmf/dvips/xcolor
+    mkdir -p $out/texmf-dist/tex/latex/xcolor
+    mkdir -p $out/texmf-dist/dvips/xcolor
     latex xcolor.ins 
-    cp *.sty *.def $out/texmf/tex/latex/xcolor
-    cp *.pro $out/texmf/dvips/xcolor
+    cp *.sty *.def $out/texmf-dist/tex/latex/xcolor
+    cp *.pro $out/texmf-dist/dvips/xcolor
 
     #latex xcolor.dtx
     #latex xcolor.dtx
@@ -25,8 +25,8 @@ rec {
     #latex xcolor.dtx
 
     rm *.sty *.pro *.ins *.def *.dtx
-    mkdir -p $out/texmf/doc/latex-xcolor
-    cp *  $out/texmf/doc/latex-xcolor
+    mkdir -p $out/texmf-dist/doc/latex-xcolor
+    cp *  $out/texmf-dist/doc/latex-xcolor
 
     ln -s $out/texmf* $out/share/
   '') ["minInit" "doUnpack" "defEnsureDir" "addInputs"];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 219add96e10..21749465d9b 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -661,6 +661,8 @@ let
 
   connect = callPackage ../tools/networking/connect { };
 
+  conspy = callPackage ../os-specific/linux/conspy {};
+
   convertlit = callPackage ../tools/text/convertlit { };
 
   collectd = callPackage ../tools/system/collectd { };
@@ -712,6 +714,11 @@ let
     scpSupport = zlibSupport && !stdenv.isSunOS && !stdenv.isCygwin;
   };
 
+  curl3 = callPackage ../tools/networking/curl/7.15.nix rec {
+    zlibSupport = true;
+    sslSupport = zlibSupport;
+  };
+
   cunit = callPackage ../tools/misc/cunit { };
 
   curlftpfs = callPackage ../tools/filesystems/curlftpfs { };
@@ -1060,6 +1067,8 @@ let
 
   gzip = callPackage ../tools/compression/gzip { };
 
+  gzrt = callPackage ../tools/compression/gzrt { };
+
   partclone = callPackage ../tools/backup/partclone { };
 
   partimage = callPackage ../tools/backup/partimage { };
@@ -1561,6 +1570,8 @@ let
 
   pk2cmd = callPackage ../tools/misc/pk2cmd { };
 
+  plantuml = callPackage ../tools/misc/plantuml { };
+
   plan9port = callPackage ../tools/system/plan9port { };
 
   ploticus = callPackage ../tools/graphics/ploticus {
@@ -1597,6 +1608,8 @@ let
 
   pptp = callPackage ../tools/networking/pptp {};
 
+  prey-bash-client = callPackage ../tools/security/prey { };
+
   proxychains = callPackage ../tools/networking/proxychains { };
 
   proxytunnel = callPackage ../tools/misc/proxytunnel { };
@@ -1874,6 +1887,8 @@ let
 
   ttf2pt1 = callPackage ../tools/misc/ttf2pt1 { };
 
+  ttysnoop = callPackage ../os-specific/linux/ttysnoop {};
+
   twitterBootstrap = callPackage ../development/web/twitter-bootstrap {};
 
   txt2man = callPackage ../tools/misc/txt2man { };
@@ -1944,6 +1959,8 @@ let
 
   htmlTidy = callPackage ../tools/text/html-tidy { };
 
+  html-xml-utils = callPackage ../tools/text/xml/html-xml-utils { };
+
   tftp_hpa = callPackage ../tools/networking/tftp-hpa {};
 
   tigervnc = callPackage ../tools/admin/tigervnc {
@@ -2849,6 +2866,8 @@ let
 
   ocaml_4_00_1 = callPackage ../development/compilers/ocaml/4.00.1.nix { };
 
+  ocaml_4_01_0 = callPackage ../development/compilers/ocaml/4.01.0.nix { };
+
   orc = callPackage ../development/compilers/orc { };
 
   metaocaml_3_09 = callPackage ../development/compilers/ocaml/metaocaml-3.09.nix { };
@@ -4104,6 +4123,8 @@ let
 
   gav = callPackage ../games/gav { };
 
+  gsb = callPackage ../games/gsb { };
+
   gdome2 = callPackage ../development/libraries/gdome2 {
     inherit (gnome) gtkdoc;
   };
@@ -4433,6 +4454,8 @@ let
 
   gts = callPackage ../development/libraries/gts { };
 
+  gurobi = callPackage ../development/libraries/gurobi {};
+
   gvfs = callPackage ../development/libraries/gvfs { };
 
   gwenhywfar = callPackage ../development/libraries/gwenhywfar { };
@@ -4442,7 +4465,10 @@ let
 
   heimdal = callPackage ../development/libraries/kerberos/heimdal.nix { };
 
-  harfbuzz = callPackage ../development/libraries/harfbuzz { };
+  harfbuzz = callPackage ../development/libraries/harfbuzz { 
+    icu = null;
+    graphite2 = null;
+  };
 
   hawknl = callPackage ../development/libraries/hawknl { };
 
@@ -4824,6 +4850,8 @@ let
     libtool = libtool_1_5;
   };
 
+  libjson_rpc_cpp = callPackage ../development/libraries/libjson-rpc-cpp { };
+
   libkate = callPackage ../development/libraries/libkate { };
 
   libksba = callPackage ../development/libraries/libksba { };
@@ -4953,6 +4981,8 @@ let
       else stdenv;
   };
 
+  libsodium = callPackage ../development/libraries/libsodium { };
+
   libsoup = callPackage ../development/libraries/libsoup { };
 
   libssh = callPackage ../development/libraries/libssh { };
@@ -4982,6 +5012,8 @@ let
       else stdenv;
   };
 
+  libtoxcore = callPackage ../development/libraries/libtoxcore { };
+
   libtunepimp = callPackage ../development/libraries/libtunepimp { };
 
   libtxc_dxtn = callPackage ../development/libraries/libtxc_dxtn { };
@@ -5030,12 +5062,7 @@ let
 
   libvisual = callPackage ../development/libraries/libvisual { };
 
-  libvncserver = builderDefsPackage (import ../development/libraries/libvncserver) {
-    inherit libtool libjpeg openssl zlib;
-    inherit (xlibs) xproto libX11 damageproto libXdamage
-      libXext xextproto fixesproto libXfixes xineramaproto
-      libXinerama libXrandr randrproto libXtst;
-  };
+  libvncserver = callPackage ../development/libraries/libvncserver {};
 
   libviper = callPackage ../development/libraries/libviper { };
 
@@ -5080,14 +5107,15 @@ let
 
   libxslt = callPackage ../development/libraries/libxslt { };
 
-  libxtc_dxtn = callPackage ../development/libraries/libxtc_dxtn { };
-
   libixp_for_wmii = lowPrio (import ../development/libraries/libixp_for_wmii {
     inherit fetchurl stdenv;
   });
 
   libyaml = callPackage ../development/libraries/libyaml { };
 
+  libyamlcpp = callPackage ../development/libraries/libyaml-cpp { };
+  libyamlcpp03 = callPackage ../development/libraries/libyaml-cpp/0.3.x.nix { };
+
   libzip = callPackage ../development/libraries/libzip { };
 
   libzrtpcpp = callPackage ../development/libraries/libzrtpcpp { };
@@ -5507,9 +5535,23 @@ let
 
   SDL_ttf = callPackage ../development/libraries/SDL_ttf { };
 
+  SDL2 = callPackage ../development/libraries/SDL2 {
+    openglSupport = mesaSupported;
+    alsaSupport = true;
+    x11Support = true;
+    pulseaudioSupport = false; # better go through ALSA
+  };
+
+  SDL2_image = callPackage ../development/libraries/SDL2_image { };
+
+  SDL2_mixer = callPackage ../development/libraries/SDL2_mixer { };
+
+  SDL2_gfx = callPackage ../development/libraries/SDL2_gfx { };
+
   serd = callPackage ../development/libraries/serd {};
 
   silgraphite = callPackage ../development/libraries/silgraphite {};
+  graphite2 = callPackage ../development/libraries/silgraphite/graphite2.nix {};
 
   simgear = callPackage ../development/libraries/simgear { };
 
@@ -5858,6 +5900,17 @@ let
 
   jquery_ui = callPackage ../development/libraries/javascript/jquery-ui { };
 
+  ### DEVELOPMENT / LISP MODULES
+
+  asdf = callPackage ../development/lisp-modules/asdf {};
+  clwrapperFunction = callPackage ../development/lisp-modules/clwrapper;
+  wrapLisp = lisp: clwrapperFunction {lisp=lisp;};
+  lispPackagesFor = clwrapper: callPackage ../development/lisp-modules/lisp-packages.nix{
+    inherit clwrapper;
+  };
+  lispPackagesClisp = lispPackagesFor (wrapLisp clisp);
+  lispPackagesSBCL = lispPackagesFor (wrapLisp sbcl);
+  lispPackages = recurseIntoAttrs lispPackagesSBCL;
 
   ### DEVELOPMENT / PERL MODULES
 
@@ -6159,22 +6212,12 @@ let
 
   riak = callPackage ../servers/nosql/riak/1.3.1.nix { };
 
-  mysql4 = import ../servers/sql/mysql {
-    inherit fetchurl stdenv ncurses zlib perl;
-    ps = procps; /* !!! Linux only */
-  };
-
-  mysql5 = import ../servers/sql/mysql5 {
-    inherit fetchurl stdenv ncurses zlib perl openssl;
-    ps = procps; /* !!! Linux only */
-  };
-
-  mysql51 = import ../servers/sql/mysql51 {
+  mysql51 = import ../servers/sql/mysql/5.1.x.nix {
     inherit fetchurl ncurses zlib perl openssl stdenv;
     ps = procps; /* !!! Linux only */
   };
 
-  mysql55 = callPackage ../servers/sql/mysql55 { };
+  mysql55 = callPackage ../servers/sql/mysql/5.5.x.nix { };
 
   mysql = mysql51;
 
@@ -6533,9 +6576,27 @@ let
       ];
   };
 
+  # Note: grsec is not enabled automatically, you need to specify which kernel
+  # config options you need (e.g. by overriding extraConfig). See list of options here:
+  # https://en.wikibooks.org/wiki/Grsecurity/Appendix/Grsecurity_and_PaX_Configuration_Options
   linux_3_2_grsecurity = lowPrio (lib.overrideDerivation (linux_3_2.override (args: {
     kernelPatches = args.kernelPatches ++ [ kernelPatches.grsecurity_2_9_1_3_2_51 ];
-  })) (args: { makeFlags = "DISABLE_PAX_PLUGINS=y";}));
+  })) (args: {
+    # Install gcc plugins. These are needed for compiling dependant packages.
+    postInstall = ''
+      ${args.postInstall or ""}
+      cp tools/gcc/*.so $out/lib/modules/$version/build/tools/gcc/
+    '';
+    # Apparently as of gcc 4.6, gcc-plugin headers (which are needed by PaX plugins)
+    # include libgmp headers, so we need these extra tweaks
+    buildInputs = args.buildInputs ++ [ gmp ];
+    preConfigure = ''
+      ${args.preConfigure or ""}
+      sed -i 's|-I|-I${gmp}/include -I|' scripts/gcc-plugin.sh
+      sed -i 's|HOST_EXTRACFLAGS +=|HOST_EXTRACFLAGS += -I${gmp}/include|' tools/gcc/Makefile
+      sed -i 's|HOST_EXTRACXXFLAGS +=|HOST_EXTRACXXFLAGS += -I${gmp}/include|' tools/gcc/Makefile
+    '';
+  }));
 
   linux_3_2_apparmor = lowPrio (linux_3_2.override {
     kernelPatches = [ kernelPatches.apparmor_3_2 ];
@@ -6735,6 +6796,7 @@ let
   linuxPackages_3_0 = recurseIntoAttrs (linuxPackagesFor linux_3_0 linuxPackages_3_0);
   linuxPackages_3_2 = recurseIntoAttrs (linuxPackagesFor pkgs.linux_3_2 linuxPackages_3_2);
   linuxPackages_3_2_apparmor = linuxPackagesFor pkgs.linux_3_2_apparmor linuxPackages_3_2_apparmor;
+  linuxPackages_3_2_grsecurity = linuxPackagesFor pkgs.linux_3_2_grsecurity linuxPackages_3_2_grsecurity;
   linuxPackages_3_2_xen = linuxPackagesFor pkgs.linux_3_2_xen linuxPackages_3_2_xen;
   linuxPackages_3_4 = recurseIntoAttrs (linuxPackagesFor pkgs.linux_3_4 linuxPackages_3_4);
   linuxPackages_3_4_apparmor = linuxPackagesFor pkgs.linux_3_4_apparmor linuxPackages_3_4_apparmor;
@@ -6974,7 +7036,7 @@ let
 
   upower = callPackage ../os-specific/linux/upower {
     libusb1 = callPackage ../development/libraries/libusb1/1_0_9.nix {};
-    };
+  };
 
   upstart = callPackage ../os-specific/linux/upstart { };
 
@@ -7686,6 +7748,8 @@ let
 
   fossil = callPackage ../applications/version-management/fossil { };
 
+  fribid = callPackage ../applications/networking/browsers/mozilla-plugins/fribid { };
+
   fvwm = callPackage ../applications/window-managers/fvwm { };
 
   geany = callPackage ../applications/editors/geany { };
@@ -7992,6 +8056,8 @@ let
 
   ii = callPackage ../applications/networking/irc/ii { };
 
+  ike = callPackage ../applications/ike { };
+
   ikiwiki = callPackage ../applications/misc/ikiwiki {
     inherit (perlPackages) TextMarkdown URI HTMLParser HTMLScrubber
       HTMLTemplate TimeDate CGISession DBFile CGIFormBuilder LocaleGettext
@@ -8432,6 +8498,8 @@ let
 
   pidginsipe = callPackage ../applications/networking/instant-messengers/pidgin-plugins/sipe { };
 
+  toxprpl = callPackage ../applications/networking/instant-messengers/pidgin-plugins/tox-prpl { };
+
   pinfo = callPackage ../applications/misc/pinfo { };
 
   pinta = callPackage ../applications/graphics/pinta {
@@ -8615,10 +8683,7 @@ let
 
   stalonetray = callPackage ../applications/window-managers/stalonetray {};
 
-  stumpwm = builderDefsPackage (import ../applications/window-managers/stumpwm) {
-    inherit texinfo;
-    clisp = clisp_2_44_1;
-  };
+  stumpwm = lispPackages.stumpwm;
 
   sublime = callPackage ../applications/editors/sublime { };
 
@@ -8715,6 +8780,8 @@ let
     wrapPython = pythonPackages.wrapPython;
   };
 
+  toxic = callPackage ../applications/networking/instant-messengers/toxic { };
+
   transmission = callPackage ../applications/networking/p2p/transmission { };
   transmission_gtk = transmission.override { enableGTK3 = true; };
 
@@ -8802,6 +8869,7 @@ let
   virtviewer = callPackage ../applications/virtualization/virt-viewer {};
   virtmanager = callPackage ../applications/virtualization/virt-manager {
     inherit (gnome) gnome_python;
+    vte = gnome.vte.override { pythonSupport = true; };
   };
 
   virtinst = callPackage ../applications/virtualization/virtinst {};
@@ -8897,6 +8965,7 @@ let
           ++ lib.optional (cfg.enableGeckoMediaPlayer or false) gecko_mediaplayer
           ++ lib.optional (supportsJDK && cfg.jre or false && jrePlugin ? mozillaPlugin) jrePlugin
           ++ lib.optional (cfg.enableGoogleTalkPlugin or false) google_talk_plugin
+          ++ lib.optional (cfg.enableFriBIDPlugin or false) fribid
          );
       libs =
         if cfg.enableQuakeLive or false
@@ -9216,6 +9285,8 @@ let
 
   scorched3d = callPackage ../games/scorched3d { };
 
+  sdlmame = callPackage ../games/sdlmame { };
+
   sgtpuzzles = builderDefsPackage (import ../games/sgt-puzzles) {
     inherit pkgconfig fetchsvn perl gtk;
     inherit (xlibs) libX11;
@@ -9884,13 +9955,10 @@ let
     stateDir = config.nix.stateDir or "/nix/var";
   };
 
-  nixUnstable = nixStable;
-  /*
   nixUnstable = callPackage ../tools/package-management/nix/unstable.nix {
     storeDir = config.nix.storeDir or "/nix/store";
     stateDir = config.nix.stateDir or "/nix/var";
   };
-  */
 
   nixops = callPackage ../tools/package-management/nixops { };
 
@@ -9996,11 +10064,14 @@ let
 
   texLive = builderDefsPackage (import ../tools/typesetting/tex/texlive) {
     inherit builderDefs zlib bzip2 ncurses libpng ed lesstif ruby
-      gd t1lib freetype icu perl expat curl xz pkgconfig zziplib
-      libjpeg bison python fontconfig flex poppler silgraphite makeWrapper;
+      gd t1lib freetype icu perl expat curl xz pkgconfig zziplib texinfo
+      libjpeg bison python fontconfig flex poppler graphite2 makeWrapper;
     inherit (xlibs) libXaw libX11 xproto libXt libXpm
       libXmu libXext xextproto libSM libICE;
     ghostscript = ghostscriptX;
+    harfbuzz = harfbuzz.override {
+      inherit icu graphite2;
+    };
   };
 
   texLiveFull = lib.setName "texlive-full" (texLiveAggregationFun {
@@ -10023,7 +10094,7 @@ let
   */
   texLiveAggregationFun = params:
     builderDefsPackage (import ../tools/typesetting/tex/texlive/aggregate.nix)
-      ({inherit poppler makeWrapper;} // params);
+      ({inherit poppler perl makeWrapper;} // params);
 
   texDisser = callPackage ../tools/typesetting/tex/disser {};
 
diff --git a/pkgs/top-level/haskell-packages.nix b/pkgs/top-level/haskell-packages.nix
index 8af2c0818f2..abd8522b1bc 100644
--- a/pkgs/top-level/haskell-packages.nix
+++ b/pkgs/top-level/haskell-packages.nix
@@ -599,6 +599,10 @@ let result = let callPackage = x : y : modifyPrio (newScope result.finalReturn x
 
   bindingsDSL = callPackage ../development/libraries/haskell/bindings-DSL {};
 
+  bindingsLibusb = callPackage ../development/libraries/haskell/bindings-libusb {
+    libusb = pkgs.libusb1;
+  };
+
   bindingsPosix = callPackage ../development/libraries/haskell/bindings-posix {};
 
   bitarray = callPackage ../development/libraries/haskell/bitarray {};
@@ -657,7 +661,7 @@ let result = let callPackage = x : y : modifyPrio (newScope result.finalReturn x
 
   Cabal_1_14_0 = callPackage ../development/libraries/haskell/Cabal/1.14.0.nix { cabal = self.cabal.override { Cabal = null; }; };
   Cabal_1_16_0_3 = callPackage ../development/libraries/haskell/Cabal/1.16.0.3.nix { cabal = self.cabal.override { Cabal = null; }; };
-  Cabal_1_18_1 = callPackage ../development/libraries/haskell/Cabal/1.18.1.nix {
+  Cabal_1_18_1_1 = callPackage ../development/libraries/haskell/Cabal/1.18.1.1.nix {
     cabal = self.cabal.override { Cabal = null; };
     deepseq = self.deepseq_1_3_0_1;
   };
@@ -724,6 +728,8 @@ let result = let callPackage = x : y : modifyPrio (newScope result.finalReturn x
 
   clientsession = callPackage ../development/libraries/haskell/clientsession {};
 
+  clock = callPackage ../development/libraries/haskell/clock {};
+
   cmdargs = callPackage ../development/libraries/haskell/cmdargs {};
 
   cmdlib = callPackage ../development/libraries/haskell/cmdlib {};
@@ -750,6 +756,8 @@ let result = let callPackage = x : y : modifyPrio (newScope result.finalReturn x
 
   configurator = callPackage ../development/libraries/haskell/configurator {};
 
+  connection = callPackage ../development/libraries/haskell/connection {};
+
   constraints = callPackage ../development/libraries/haskell/constraints {};
 
   convertible = callPackage ../development/libraries/haskell/convertible {};
@@ -1156,7 +1164,7 @@ let result = let callPackage = x : y : modifyPrio (newScope result.finalReturn x
 
   haskellSrcExts_1_13_5 = callPackage ../development/libraries/haskell/haskell-src-exts/1.13.5.nix {};
   haskellSrcExts_1_14_0 = callPackage ../development/libraries/haskell/haskell-src-exts/1.14.0.nix {};
-  haskellSrcExts = self.haskellSrcExts_1_13_5;
+  haskellSrcExts = self.haskellSrcExts_1_14_0;
 
   haskellSrcMeta = callPackage ../development/libraries/haskell/haskell-src-meta {};
 
@@ -2143,6 +2151,8 @@ let result = let callPackage = x : y : modifyPrio (newScope result.finalReturn x
 
   urlencoded = callPackage ../development/libraries/haskell/urlencoded {};
 
+  usb = callPackage ../development/libraries/haskell/usb {};
+
   utf8Light = callPackage ../development/libraries/haskell/utf8-light {};
 
   utf8String = callPackage ../development/libraries/haskell/utf8-string {};
@@ -2462,7 +2472,7 @@ let result = let callPackage = x : y : modifyPrio (newScope result.finalReturn x
   cabalInstall_0_14_0 = callPackage ../tools/package-management/cabal-install/0.14.0.nix {};
   cabalInstall_1_16_0_2 = callPackage ../tools/package-management/cabal-install/1.16.0.2.nix {};
   cabalInstall_1_18_0_2 = callPackage ../tools/package-management/cabal-install/1.18.0.2.nix {
-    Cabal = self.Cabal_1_18_1;
+    Cabal = self.Cabal_1_18_1_1;
   };
   cabalInstall = self.cabalInstall_1_18_0_2;
 
diff --git a/pkgs/top-level/make-tarball.nix b/pkgs/top-level/make-tarball.nix
index 62317df4163..b50f064af0c 100644
--- a/pkgs/top-level/make-tarball.nix
+++ b/pkgs/top-level/make-tarball.nix
@@ -12,7 +12,7 @@ releaseTools.sourceTarball rec {
 
   inherit officialRelease;
   version = builtins.readFile ../../.version;
-  versionSuffix = "pre${toString nixpkgs.revCount}_${nixpkgs.shortRev}";
+  versionSuffix = "pre${toString nixpkgs.revCount}.${nixpkgs.shortRev}";
 
   buildInputs = [
     lzma
diff --git a/pkgs/top-level/node-packages-generated.nix b/pkgs/top-level/node-packages-generated.nix
index 52a9f33cafa..18ec19437db 100644
--- a/pkgs/top-level/node-packages-generated.nix
+++ b/pkgs/top-level/node-packages-generated.nix
@@ -183,11 +183,11 @@
     passthru.names = [ "ambi" ];
   };
   full."amdefine"."*" = lib.makeOverridable self.buildNodePackage {
-    name = "amdefine-0.0.8";
+    name = "amdefine-0.1.0";
     src = [
       (fetchurl {
-        url = "http://registry.npmjs.org/amdefine/-/amdefine-0.0.8.tgz";
-        sha1 = "34dc8c981e6acb3be1853bef8f0ec94a39d55ba0";
+        url = "http://registry.npmjs.org/amdefine/-/amdefine-0.1.0.tgz";
+        sha1 = "3ca9735cf1dde0edf7a4bf6641709c8024f9b227";
       })
     ];
     buildInputs =
@@ -200,11 +200,11 @@
   };
   "amdefine" = self.full."amdefine"."*";
   full."amdefine".">=0.0.4" = lib.makeOverridable self.buildNodePackage {
-    name = "amdefine-0.0.8";
+    name = "amdefine-0.1.0";
     src = [
       (fetchurl {
-        url = "http://registry.npmjs.org/amdefine/-/amdefine-0.0.8.tgz";
-        sha1 = "34dc8c981e6acb3be1853bef8f0ec94a39d55ba0";
+        url = "http://registry.npmjs.org/amdefine/-/amdefine-0.1.0.tgz";
+        sha1 = "3ca9735cf1dde0edf7a4bf6641709c8024f9b227";
       })
     ];
     buildInputs =
@@ -643,11 +643,11 @@
     passthru.names = [ "async" ];
   };
   full."aws-sdk"."*" = lib.makeOverridable self.buildNodePackage {
-    name = "aws-sdk-1.7.1";
+    name = "aws-sdk-1.9.0";
     src = [
       (self.patchLatest {
-        url = "http://registry.npmjs.org/aws-sdk/-/aws-sdk-1.7.1.tgz";
-        sha1 = "802748ea85a6c508b8665bbf22050c879af17695";
+        url = "http://registry.npmjs.org/aws-sdk/-/aws-sdk-1.9.0.tgz";
+        sha1 = "b4b0c2c954d07c40fa036447fae63181b4f83770";
       })
     ];
     buildInputs =
@@ -662,11 +662,11 @@
   };
   "aws-sdk" = self.full."aws-sdk"."*";
   full."aws-sdk".">=1.2.0 <2" = lib.makeOverridable self.buildNodePackage {
-    name = "aws-sdk-1.7.1";
+    name = "aws-sdk-1.9.0";
     src = [
       (self.patchLatest {
-        url = "http://registry.npmjs.org/aws-sdk/-/aws-sdk-1.7.1.tgz";
-        sha1 = "802748ea85a6c508b8665bbf22050c879af17695";
+        url = "http://registry.npmjs.org/aws-sdk/-/aws-sdk-1.9.0.tgz";
+        sha1 = "b4b0c2c954d07c40fa036447fae63181b4f83770";
       })
     ];
     buildInputs =
@@ -712,11 +712,11 @@
     passthru.names = [ "aws-sign" ];
   };
   full."backbone"."*" = lib.makeOverridable self.buildNodePackage {
-    name = "backbone-1.0.0";
+    name = "backbone-1.1.0";
     src = [
       (fetchurl {
-        url = "http://registry.npmjs.org/backbone/-/backbone-1.0.0.tgz";
-        sha1 = "5e146e1efa8a5361462e578377c39ed0f16b0b4c";
+        url = "http://registry.npmjs.org/backbone/-/backbone-1.1.0.tgz";
+        sha1 = "a3c845ea707dc210aa12b0dc16fceca4bbc18a3e";
       })
     ];
     buildInputs =
@@ -1178,11 +1178,11 @@
     passthru.names = [ "broadway" ];
   };
   full."browserchannel"."*" = lib.makeOverridable self.buildNodePackage {
-    name = "browserchannel-1.0.7";
+    name = "browserchannel-1.0.8";
     src = [
       (fetchurl {
-        url = "http://registry.npmjs.org/browserchannel/-/browserchannel-1.0.7.tgz";
-        sha1 = "0966d021d6001011f3fae3377db4bd2992458b57";
+        url = "http://registry.npmjs.org/browserchannel/-/browserchannel-1.0.8.tgz";
+        sha1 = "96da83d139d8943f5bd616c334f148bd008dbac4";
       })
     ];
     buildInputs =
@@ -1379,18 +1379,18 @@
     passthru.names = [ "cardinal" ];
   };
   full."chai"."*" = lib.makeOverridable self.buildNodePackage {
-    name = "chai-1.8.0";
+    name = "chai-1.8.1";
     src = [
       (fetchurl {
-        url = "http://registry.npmjs.org/chai/-/chai-1.8.0.tgz";
-        sha1 = "1f7accbe91e2e71a08d8208b31bbbdc6862699ac";
+        url = "http://registry.npmjs.org/chai/-/chai-1.8.1.tgz";
+        sha1 = "cc77866d5e7ebca2bd75144b1edc370a88785f72";
       })
     ];
     buildInputs =
       (self.nativeDeps."chai"."*" or []);
     deps = [
       self.full."assertion-error"."1.0.0"
-      self.full."deep-eql"."0.1.2"
+      self.full."deep-eql"."0.1.3"
     ];
     peerDependencies = [
     ];
@@ -2090,23 +2090,6 @@
     ];
     passthru.names = [ "commander" ];
   };
-  full."commander"."1.2.0" = lib.makeOverridable self.buildNodePackage {
-    name = "commander-1.2.0";
-    src = [
-      (fetchurl {
-        url = "http://registry.npmjs.org/commander/-/commander-1.2.0.tgz";
-        sha1 = "fd5713bfa153c7d6cc599378a5ab4c45c535029e";
-      })
-    ];
-    buildInputs =
-      (self.nativeDeps."commander"."1.2.0" or []);
-    deps = [
-      self.full."keypress"."0.1.x"
-    ];
-    peerDependencies = [
-    ];
-    passthru.names = [ "commander" ];
-  };
   full."commander"."2.0.0" = lib.makeOverridable self.buildNodePackage {
     name = "commander-2.0.0";
     src = [
@@ -2212,6 +2195,25 @@
     ];
     passthru.names = [ "configstore" ];
   };
+  full."connect"."1.x" = lib.makeOverridable self.buildNodePackage {
+    name = "connect-1.9.2";
+    src = [
+      (fetchurl {
+        url = "http://registry.npmjs.org/connect/-/connect-1.9.2.tgz";
+        sha1 = "42880a22e9438ae59a8add74e437f58ae8e52807";
+      })
+    ];
+    buildInputs =
+      (self.nativeDeps."connect"."1.x" or []);
+    deps = [
+      self.full."qs".">= 0.4.0"
+      self.full."mime".">= 0.0.1"
+      self.full."formidable"."1.0.x"
+    ];
+    peerDependencies = [
+    ];
+    passthru.names = [ "connect" ];
+  };
   full."connect"."2.7.11" = lib.makeOverridable self.buildNodePackage {
     name = "connect-2.7.11";
     src = [
@@ -2290,16 +2292,16 @@
     ];
     passthru.names = [ "connect" ];
   };
-  full."connect"."2.9.0" = lib.makeOverridable self.buildNodePackage {
-    name = "connect-2.9.0";
+  full."connect"."2.9.1" = lib.makeOverridable self.buildNodePackage {
+    name = "connect-2.9.1";
     src = [
       (fetchurl {
-        url = "http://registry.npmjs.org/connect/-/connect-2.9.0.tgz";
-        sha1 = "ecf478b6f2723e72cf9a19d1c7d19d0b37b53746";
+        url = "http://registry.npmjs.org/connect/-/connect-2.9.1.tgz";
+        sha1 = "a0a733f2e629b8af85aa0701fbd0737f52549052";
       })
     ];
     buildInputs =
-      (self.nativeDeps."connect"."2.9.0" or []);
+      (self.nativeDeps."connect"."2.9.1" or []);
     deps = [
       self.full."qs"."0.6.5"
       self.full."cookie-signature"."1.0.1"
@@ -2312,18 +2314,18 @@
       self.full."uid2"."0.0.2"
       self.full."debug"."*"
       self.full."methods"."0.0.1"
-      self.full."multiparty"."2.1.8"
+      self.full."multiparty"."2.2.0"
     ];
     peerDependencies = [
     ];
     passthru.names = [ "connect" ];
   };
   full."connect"."~2" = lib.makeOverridable self.buildNodePackage {
-    name = "connect-2.9.0";
+    name = "connect-2.9.1";
     src = [
       (fetchurl {
-        url = "http://registry.npmjs.org/connect/-/connect-2.9.0.tgz";
-        sha1 = "ecf478b6f2723e72cf9a19d1c7d19d0b37b53746";
+        url = "http://registry.npmjs.org/connect/-/connect-2.9.1.tgz";
+        sha1 = "a0a733f2e629b8af85aa0701fbd0737f52549052";
       })
     ];
     buildInputs =
@@ -2340,7 +2342,7 @@
       self.full."uid2"."0.0.2"
       self.full."debug"."*"
       self.full."methods"."0.0.1"
-      self.full."multiparty"."2.1.8"
+      self.full."multiparty"."2.2.0"
     ];
     peerDependencies = [
     ];
@@ -2604,6 +2606,22 @@
     ];
     passthru.names = [ "cookies" ];
   };
+  full."core-util-is"."~1.0.0" = lib.makeOverridable self.buildNodePackage {
+    name = "core-util-is-1.0.0";
+    src = [
+      (fetchurl {
+        url = "http://registry.npmjs.org/core-util-is/-/core-util-is-1.0.0.tgz";
+        sha1 = "740c74c400e72707b95cc75d509543f8ad7f83de";
+      })
+    ];
+    buildInputs =
+      (self.nativeDeps."core-util-is"."~1.0.0" or []);
+    deps = [
+    ];
+    peerDependencies = [
+    ];
+    passthru.names = [ "core-util-is" ];
+  };
   full."couch-login"."~0.1.15" = lib.makeOverridable self.buildNodePackage {
     name = "couch-login-0.1.18";
     src = [
@@ -2936,29 +2954,45 @@
     ];
     passthru.names = [ "debug" ];
   };
-  full."deep-eql"."0.1.2" = lib.makeOverridable self.buildNodePackage {
-    name = "deep-eql-0.1.2";
+  full."debuglog"."0.0.2" = lib.makeOverridable self.buildNodePackage {
+    name = "debuglog-0.0.2";
     src = [
       (fetchurl {
-        url = "http://registry.npmjs.org/deep-eql/-/deep-eql-0.1.2.tgz";
-        sha1 = "b54feed3473a6448fbc198be6a6eca9b95d9c58a";
+        url = "http://registry.npmjs.org/debuglog/-/debuglog-0.0.2.tgz";
+        sha1 = "83f4cd091f955f5da7053789727ad506f1010f1c";
       })
     ];
     buildInputs =
-      (self.nativeDeps."deep-eql"."0.1.2" or []);
+      (self.nativeDeps."debuglog"."0.0.2" or []);
     deps = [
-      self.full."type-detect"."0.1.0"
+    ];
+    peerDependencies = [
+    ];
+    passthru.names = [ "debuglog" ];
+  };
+  full."deep-eql"."0.1.3" = lib.makeOverridable self.buildNodePackage {
+    name = "deep-eql-0.1.3";
+    src = [
+      (fetchurl {
+        url = "http://registry.npmjs.org/deep-eql/-/deep-eql-0.1.3.tgz";
+        sha1 = "ef558acab8de25206cd713906d74e56930eb69f2";
+      })
+    ];
+    buildInputs =
+      (self.nativeDeps."deep-eql"."0.1.3" or []);
+    deps = [
+      self.full."type-detect"."0.1.1"
     ];
     peerDependencies = [
     ];
     passthru.names = [ "deep-eql" ];
   };
   full."deep-equal"."*" = lib.makeOverridable self.buildNodePackage {
-    name = "deep-equal-0.0.0";
+    name = "deep-equal-0.1.0";
     src = [
       (fetchurl {
-        url = "http://registry.npmjs.org/deep-equal/-/deep-equal-0.0.0.tgz";
-        sha1 = "99679d3bbd047156fcd450d3d01eeb9068691e83";
+        url = "http://registry.npmjs.org/deep-equal/-/deep-equal-0.1.0.tgz";
+        sha1 = "81fcefc84551d9d67cccdd80e1fced7f355e146f";
       })
     ];
     buildInputs =
@@ -3541,18 +3575,18 @@
     passthru.names = [ "events.node" ];
   };
   full."express"."*" = lib.makeOverridable self.buildNodePackage {
-    name = "express-3.4.0";
+    name = "express-3.4.1";
     src = [
       (fetchurl {
-        url = "http://registry.npmjs.org/express/-/express-3.4.0.tgz";
-        sha1 = "6ed289da0d5f55ac30997cf832e5fc36f784071e";
+        url = "http://registry.npmjs.org/express/-/express-3.4.1.tgz";
+        sha1 = "3b4fb8862b6a1dfce3dc760629833d0cfef9314c";
       })
     ];
     buildInputs =
       (self.nativeDeps."express"."*" or []);
     deps = [
-      self.full."connect"."2.9.0"
-      self.full."commander"."1.2.0"
+      self.full."connect"."2.9.1"
+      self.full."commander"."2.0.0"
       self.full."range-parser"."0.0.4"
       self.full."mkdirp"."0.3.5"
       self.full."cookie"."0.1.0"
@@ -3568,6 +3602,26 @@
     passthru.names = [ "express" ];
   };
   "express" = self.full."express"."*";
+  full."express"."2.5.11" = lib.makeOverridable self.buildNodePackage {
+    name = "express-2.5.11";
+    src = [
+      (fetchurl {
+        url = "http://registry.npmjs.org/express/-/express-2.5.11.tgz";
+        sha1 = "4ce8ea1f3635e69e49f0ebb497b6a4b0a51ce6f0";
+      })
+    ];
+    buildInputs =
+      (self.nativeDeps."express"."2.5.11" or []);
+    deps = [
+      self.full."connect"."1.x"
+      self.full."mime"."1.2.4"
+      self.full."qs"."0.4.x"
+      self.full."mkdirp"."0.3.0"
+    ];
+    peerDependencies = [
+    ];
+    passthru.names = [ "express" ];
+  };
   full."express"."3.2.0" = lib.makeOverridable self.buildNodePackage {
     name = "express-3.2.0";
     src = [
@@ -3623,18 +3677,18 @@
     passthru.names = [ "express" ];
   };
   full."express"."3.x" = lib.makeOverridable self.buildNodePackage {
-    name = "express-3.4.0";
+    name = "express-3.4.1";
     src = [
       (fetchurl {
-        url = "http://registry.npmjs.org/express/-/express-3.4.0.tgz";
-        sha1 = "6ed289da0d5f55ac30997cf832e5fc36f784071e";
+        url = "http://registry.npmjs.org/express/-/express-3.4.1.tgz";
+        sha1 = "3b4fb8862b6a1dfce3dc760629833d0cfef9314c";
       })
     ];
     buildInputs =
       (self.nativeDeps."express"."3.x" or []);
     deps = [
-      self.full."connect"."2.9.0"
-      self.full."commander"."1.2.0"
+      self.full."connect"."2.9.1"
+      self.full."commander"."2.0.0"
       self.full."range-parser"."0.0.4"
       self.full."mkdirp"."0.3.5"
       self.full."cookie"."0.1.0"
@@ -3677,18 +3731,18 @@
     passthru.names = [ "express" ];
   };
   full."express"."~3.4" = lib.makeOverridable self.buildNodePackage {
-    name = "express-3.4.0";
+    name = "express-3.4.1";
     src = [
       (fetchurl {
-        url = "http://registry.npmjs.org/express/-/express-3.4.0.tgz";
-        sha1 = "6ed289da0d5f55ac30997cf832e5fc36f784071e";
+        url = "http://registry.npmjs.org/express/-/express-3.4.1.tgz";
+        sha1 = "3b4fb8862b6a1dfce3dc760629833d0cfef9314c";
       })
     ];
     buildInputs =
       (self.nativeDeps."express"."~3.4" or []);
     deps = [
-      self.full."connect"."2.9.0"
-      self.full."commander"."1.2.0"
+      self.full."connect"."2.9.1"
+      self.full."commander"."2.0.0"
       self.full."range-parser"."0.0.4"
       self.full."mkdirp"."0.3.5"
       self.full."cookie"."0.1.0"
@@ -3855,17 +3909,18 @@
     passthru.names = [ "faye-websocket" ];
   };
   "faye-websocket" = self.full."faye-websocket"."*";
-  full."faye-websocket"."0.4.4" = lib.makeOverridable self.buildNodePackage {
-    name = "faye-websocket-0.4.4";
+  full."faye-websocket"."0.7.0" = lib.makeOverridable self.buildNodePackage {
+    name = "faye-websocket-0.7.0";
     src = [
       (fetchurl {
-        url = "http://registry.npmjs.org/faye-websocket/-/faye-websocket-0.4.4.tgz";
-        sha1 = "c14c5b3bf14d7417ffbfd990c0a7495cd9f337bc";
+        url = "http://registry.npmjs.org/faye-websocket/-/faye-websocket-0.7.0.tgz";
+        sha1 = "c16c50ec0d483357a8eafd1ec6fcc313d027f5be";
       })
     ];
     buildInputs =
-      (self.nativeDeps."faye-websocket"."0.4.4" or []);
+      (self.nativeDeps."faye-websocket"."0.7.0" or []);
     deps = [
+      self.full."websocket-driver".">=0.3.0"
     ];
     peerDependencies = [
     ];
@@ -4003,11 +4058,11 @@
     passthru.names = [ "forEachAsync" ];
   };
   full."forever"."*" = lib.makeOverridable self.buildNodePackage {
-    name = "forever-0.10.8";
+    name = "forever-0.10.9";
     src = [
       (fetchurl {
-        url = "http://registry.npmjs.org/forever/-/forever-0.10.8.tgz";
-        sha1 = "a78137a46fb8ca4adbf2f497d98816a526bb1f82";
+        url = "http://registry.npmjs.org/forever/-/forever-0.10.9.tgz";
+        sha1 = "e4849f459ec27d5a6524fd466e67dfd6222bd9bb";
       })
     ];
     buildInputs =
@@ -4016,7 +4071,7 @@
       self.full."colors"."0.6.0-1"
       self.full."cliff"."0.1.8"
       self.full."flatiron"."0.3.5"
-      self.full."forever-monitor"."1.2.2"
+      self.full."forever-monitor"."1.2.3"
       self.full."nconf"."0.6.7"
       self.full."nssocket"."~0.5.1"
       self.full."optimist"."0.4.0"
@@ -4108,19 +4163,19 @@
     ];
     passthru.names = [ "forever-monitor" ];
   };
-  full."forever-monitor"."1.2.2" = lib.makeOverridable self.buildNodePackage {
-    name = "forever-monitor-1.2.2";
+  full."forever-monitor"."1.2.3" = lib.makeOverridable self.buildNodePackage {
+    name = "forever-monitor-1.2.3";
     src = [
       (fetchurl {
-        url = "http://registry.npmjs.org/forever-monitor/-/forever-monitor-1.2.2.tgz";
-        sha1 = "c1ad6c6ab837a89fa2d47bb439727ca968235684";
+        url = "http://registry.npmjs.org/forever-monitor/-/forever-monitor-1.2.3.tgz";
+        sha1 = "b27ac3acb6fdcc7315d6cd85830f2d004733028b";
       })
     ];
     buildInputs =
-      (self.nativeDeps."forever-monitor"."1.2.2" or []);
+      (self.nativeDeps."forever-monitor"."1.2.3" or []);
     deps = [
       self.full."broadway"."0.2.x"
-      self.full."minimatch"."0.0.x"
+      self.full."minimatch"."0.2.x"
       self.full."pkginfo"."0.x.x"
       self.full."ps-tree"."0.0.x"
       self.full."watch"."0.5.x"
@@ -4251,6 +4306,22 @@
     ];
     passthru.names = [ "formidable" ];
   };
+  full."formidable"."1.0.x" = lib.makeOverridable self.buildNodePackage {
+    name = "formidable-1.0.14";
+    src = [
+      (fetchurl {
+        url = "http://registry.npmjs.org/formidable/-/formidable-1.0.14.tgz";
+        sha1 = "2b3f4c411cbb5fdd695c44843e2a23514a43231a";
+      })
+    ];
+    buildInputs =
+      (self.nativeDeps."formidable"."1.0.x" or []);
+    deps = [
+    ];
+    peerDependencies = [
+    ];
+    passthru.names = [ "formidable" ];
+  };
   full."fresh"."0.1.0" = lib.makeOverridable self.buildNodePackage {
     name = "fresh-0.1.0";
     src = [
@@ -4460,11 +4531,11 @@
     passthru.names = [ "fstream-ignore" ];
   };
   full."fstream-npm"."~0.1.3" = lib.makeOverridable self.buildNodePackage {
-    name = "fstream-npm-0.1.5";
+    name = "fstream-npm-0.1.6";
     src = [
       (fetchurl {
-        url = "http://registry.npmjs.org/fstream-npm/-/fstream-npm-0.1.5.tgz";
-        sha1 = "8f9fdd38c0940f91f7b6ebda4b6611be88f97ec9";
+        url = "http://registry.npmjs.org/fstream-npm/-/fstream-npm-0.1.6.tgz";
+        sha1 = "1369323075d9bd85cfcc9409f33f0d6fe5be104d";
       })
     ];
     buildInputs =
@@ -4478,11 +4549,11 @@
     passthru.names = [ "fstream-npm" ];
   };
   full."generator-angular"."*" = lib.makeOverridable self.buildNodePackage {
-    name = "generator-angular-0.4.0";
+    name = "generator-angular-0.5.0";
     src = [
       (fetchurl {
-        url = "http://registry.npmjs.org/generator-angular/-/generator-angular-0.4.0.tgz";
-        sha1 = "4fbaaa87b829f3f2fc72fac3da1fa47ff801ca1d";
+        url = "http://registry.npmjs.org/generator-angular/-/generator-angular-0.5.0.tgz";
+        sha1 = "f637a6c42984fd949678358be369e413a2e7c6e2";
       })
     ];
     buildInputs =
@@ -6073,7 +6144,7 @@
       self.full."passport"."*"
       self.full."passport-http"."*"
       self.full."js-yaml"."*"
-      self.full."mongoose"."3.6.x"
+      self.full."mongoose"."*"
       self.full."gridfs-stream"."*"
       self.full."temp"."*"
       self.full."kue"."*"
@@ -6214,6 +6285,24 @@
     ];
     passthru.names = [ "jade" ];
   };
+  full."jade"."0.27.0" = lib.makeOverridable self.buildNodePackage {
+    name = "jade-0.27.0";
+    src = [
+      (fetchurl {
+        url = "http://registry.npmjs.org/jade/-/jade-0.27.0.tgz";
+        sha1 = "dc5ebed10d04a5e0eaf49ef0009bec473d1a6b31";
+      })
+    ];
+    buildInputs =
+      (self.nativeDeps."jade"."0.27.0" or []);
+    deps = [
+      self.full."commander"."0.6.1"
+      self.full."mkdirp"."0.3.0"
+    ];
+    peerDependencies = [
+    ];
+    passthru.names = [ "jade" ];
+  };
   full."jade".">= 0.0.1" = lib.makeOverridable self.buildNodePackage {
     name = "jade-0.35.0";
     src = [
@@ -6325,11 +6414,11 @@
     passthru.names = [ "joe-reporter-console" ];
   };
   full."js-yaml"."*" = lib.makeOverridable self.buildNodePackage {
-    name = "js-yaml-2.1.2";
+    name = "js-yaml-2.1.3";
     src = [
       (fetchurl {
-        url = "http://registry.npmjs.org/js-yaml/-/js-yaml-2.1.2.tgz";
-        sha1 = "5404d58972f70112763e0b7e97ced20c39138bbd";
+        url = "http://registry.npmjs.org/js-yaml/-/js-yaml-2.1.3.tgz";
+        sha1 = "0ffb5617be55525878063d7a16aee7fdd282e84c";
       })
     ];
     buildInputs =
@@ -6396,11 +6485,11 @@
     passthru.names = [ "js-yaml" ];
   };
   full."js-yaml"."~2.1.0" = lib.makeOverridable self.buildNodePackage {
-    name = "js-yaml-2.1.2";
+    name = "js-yaml-2.1.3";
     src = [
       (fetchurl {
-        url = "http://registry.npmjs.org/js-yaml/-/js-yaml-2.1.2.tgz";
-        sha1 = "5404d58972f70112763e0b7e97ced20c39138bbd";
+        url = "http://registry.npmjs.org/js-yaml/-/js-yaml-2.1.3.tgz";
+        sha1 = "0ffb5617be55525878063d7a16aee7fdd282e84c";
       })
     ];
     buildInputs =
@@ -6414,11 +6503,11 @@
     passthru.names = [ "js-yaml" ];
   };
   full."jshint"."*" = lib.makeOverridable self.buildNodePackage {
-    name = "jshint-2.1.11";
+    name = "jshint-2.2.0";
     src = [
       (fetchurl {
-        url = "http://registry.npmjs.org/jshint/-/jshint-2.1.11.tgz";
-        sha1 = "eb5108fef9ba5ddebb830983f572d242e49e3f96";
+        url = "http://registry.npmjs.org/jshint/-/jshint-2.2.0.tgz";
+        sha1 = "9cd120e17c6635a5bfd6339531b088ed33eb5af2";
       })
     ];
     buildInputs =
@@ -6937,17 +7026,17 @@
   full."karma-requirejs"."*" = self.full."karma"."~0.10.0";
   "karma-requirejs" = self.full."karma-requirejs"."*";
   full."karma-sauce-launcher"."*" = lib.makeOverridable self.buildNodePackage {
-    name = "karma-sauce-launcher-0.1.0";
+    name = "karma-sauce-launcher-0.1.1";
     src = [
       (fetchurl {
-        url = "http://registry.npmjs.org/karma-sauce-launcher/-/karma-sauce-launcher-0.1.0.tgz";
-        sha1 = "46be4b9888fda09e6512516cd5dc6ab8b114d392";
+        url = "http://registry.npmjs.org/karma-sauce-launcher/-/karma-sauce-launcher-0.1.1.tgz";
+        sha1 = "34b82b8cb285c239b0fede1a8363488cc02f429b";
       })
     ];
     buildInputs =
       (self.nativeDeps."karma-sauce-launcher"."*" or []);
     deps = [
-      self.full."wd"."~0.0.32"
+      self.full."wd"."~0.1.5"
       self.full."sauce-connect-launcher"."~0.1.10"
       self.full."q"."~0.9.6"
     ];
@@ -7024,22 +7113,6 @@
     ];
     passthru.names = [ "kew" ];
   };
-  full."keypress"."0.1.x" = lib.makeOverridable self.buildNodePackage {
-    name = "keypress-0.1.0";
-    src = [
-      (fetchurl {
-        url = "http://registry.npmjs.org/keypress/-/keypress-0.1.0.tgz";
-        sha1 = "4a3188d4291b66b4f65edb99f806aa9ae293592a";
-      })
-    ];
-    buildInputs =
-      (self.nativeDeps."keypress"."0.1.x" or []);
-    deps = [
-    ];
-    peerDependencies = [
-    ];
-    passthru.names = [ "keypress" ];
-  };
   full."knox"."*" = lib.makeOverridable self.buildNodePackage {
     name = "knox-0.8.6";
     src = [
@@ -7117,11 +7190,11 @@
     passthru.names = [ "lcov-parse" ];
   };
   full."lcov-result-merger"."*" = lib.makeOverridable self.buildNodePackage {
-    name = "lcov-result-merger-0.0.1";
+    name = "lcov-result-merger-0.0.2";
     src = [
       (fetchurl {
-        url = "http://registry.npmjs.org/lcov-result-merger/-/lcov-result-merger-0.0.1.tgz";
-        sha1 = "8b0e68a7f9136de084f62d92ecafcfa41ce9e4d9";
+        url = "http://registry.npmjs.org/lcov-result-merger/-/lcov-result-merger-0.0.2.tgz";
+        sha1 = "72a538c09f76e5c79b511bcd1053948d4aa98f10";
       })
     ];
     buildInputs =
@@ -7982,12 +8055,35 @@
     ];
     passthru.names = [ "match-stream" ];
   };
+  full."meat"."*" = lib.makeOverridable self.buildNodePackage {
+    name = "meat-0.2.5";
+    src = [
+      (fetchurl {
+        url = "http://registry.npmjs.org/meat/-/meat-0.2.5.tgz";
+        sha1 = "8f277ec68f51794365e271166c7b7bba8d046869";
+      })
+    ];
+    buildInputs =
+      (self.nativeDeps."meat"."*" or []);
+    deps = [
+      self.full."express"."2.5.11"
+      self.full."jade"."0.27.0"
+      self.full."open"."0.0.2"
+      self.full."winston"."0.6.2"
+      self.full."mkdirp"."0.3.0"
+      self.full."node.extend"."1.0.0"
+    ];
+    peerDependencies = [
+    ];
+    passthru.names = [ "meat" ];
+  };
+  "meat" = self.full."meat"."*";
   full."memoizee"."~0.2.5" = lib.makeOverridable self.buildNodePackage {
-    name = "memoizee-0.2.5";
+    name = "memoizee-0.2.6";
     src = [
       (fetchurl {
-        url = "http://registry.npmjs.org/memoizee/-/memoizee-0.2.5.tgz";
-        sha1 = "44ad0ce73439705f3954a58dbf5f792cd496c01c";
+        url = "http://registry.npmjs.org/memoizee/-/memoizee-0.2.6.tgz";
+        sha1 = "bb45a7ad02530082f1612671dab35219cd2e0741";
       })
     ];
     buildInputs =
@@ -8033,6 +8129,22 @@
     ];
     passthru.names = [ "mime" ];
   };
+  full."mime"."1.2.4" = lib.makeOverridable self.buildNodePackage {
+    name = "mime-1.2.4";
+    src = [
+      (fetchurl {
+        url = "http://registry.npmjs.org/mime/-/mime-1.2.4.tgz";
+        sha1 = "11b5fdaf29c2509255176b80ad520294f5de92b7";
+      })
+    ];
+    buildInputs =
+      (self.nativeDeps."mime"."1.2.4" or []);
+    deps = [
+    ];
+    peerDependencies = [
+    ];
+    passthru.names = [ "mime" ];
+  };
   full."mime"."1.2.5" = lib.makeOverridable self.buildNodePackage {
     name = "mime-1.2.5";
     src = [
@@ -8097,6 +8209,22 @@
     ];
     passthru.names = [ "mime" ];
   };
+  full."mime".">= 0.0.1" = lib.makeOverridable self.buildNodePackage {
+    name = "mime-1.2.11";
+    src = [
+      (fetchurl {
+        url = "http://registry.npmjs.org/mime/-/mime-1.2.11.tgz";
+        sha1 = "58203eed86e3a5ef17aed2b7d9ebd47f0a60dd10";
+      })
+    ];
+    buildInputs =
+      (self.nativeDeps."mime".">= 0.0.1" or []);
+    deps = [
+    ];
+    peerDependencies = [
+    ];
+    passthru.names = [ "mime" ];
+  };
   full."mime"."~1.2" = lib.makeOverridable self.buildNodePackage {
     name = "mime-1.2.11";
     src = [
@@ -9004,19 +9132,19 @@
     ];
     passthru.names = [ "msgpack" ];
   };
-  full."multiparty"."2.1.8" = lib.makeOverridable self.buildNodePackage {
-    name = "multiparty-2.1.8";
+  full."multiparty"."2.2.0" = lib.makeOverridable self.buildNodePackage {
+    name = "multiparty-2.2.0";
     src = [
       (fetchurl {
-        url = "http://registry.npmjs.org/multiparty/-/multiparty-2.1.8.tgz";
-        sha1 = "35a31834323578ee65f5d870568097914739cf4e";
+        url = "http://registry.npmjs.org/multiparty/-/multiparty-2.2.0.tgz";
+        sha1 = "a567c2af000ad22dc8f2a653d91978ae1f5316f4";
       })
     ];
     buildInputs =
-      (self.nativeDeps."multiparty"."2.1.8" or []);
+      (self.nativeDeps."multiparty"."2.2.0" or []);
     deps = [
-      self.full."readable-stream"."~1.0.2"
-      self.full."stream-counter"."~0.1.0"
+      self.full."readable-stream"."~1.1.9"
+      self.full."stream-counter"."~0.2.0"
     ];
     peerDependencies = [
     ];
@@ -9260,11 +9388,11 @@
     passthru.names = [ "nib" ];
   };
   full."nijs"."*" = lib.makeOverridable self.buildNodePackage {
-    name = "nijs-0.0.11";
+    name = "nijs-0.0.12";
     src = [
       (fetchurl {
-        url = "http://registry.npmjs.org/nijs/-/nijs-0.0.11.tgz";
-        sha1 = "386894330e53135a84e1c42c317b0384c0f48b7a";
+        url = "http://registry.npmjs.org/nijs/-/nijs-0.0.12.tgz";
+        sha1 = "23bb40746b409e8556f9a4fe97ca314410a685df";
       })
     ];
     buildInputs =
@@ -9533,6 +9661,22 @@
     ];
     passthru.names = [ "node-uuid" ];
   };
+  full."node.extend"."1.0.0" = lib.makeOverridable self.buildNodePackage {
+    name = "node.extend-1.0.0";
+    src = [
+      (fetchurl {
+        url = "http://registry.npmjs.org/node.extend/-/node.extend-1.0.0.tgz";
+        sha1 = "ab83960c477280d01ba5554a0d8fd3acfe39336e";
+      })
+    ];
+    buildInputs =
+      (self.nativeDeps."node.extend"."1.0.0" or []);
+    deps = [
+    ];
+    peerDependencies = [
+    ];
+    passthru.names = [ "node.extend" ];
+  };
   full."nodemailer"."0.3.35" = lib.makeOverridable self.buildNodePackage {
     name = "nodemailer-0.3.35";
     src = [
@@ -10200,6 +10344,22 @@
     ];
     passthru.names = [ "once" ];
   };
+  full."open"."0.0.2" = lib.makeOverridable self.buildNodePackage {
+    name = "open-0.0.2";
+    src = [
+      (fetchurl {
+        url = "http://registry.npmjs.org/open/-/open-0.0.2.tgz";
+        sha1 = "0a620ba2574464742f51e69f8ba8eccfd97b5dfc";
+      })
+    ];
+    buildInputs =
+      (self.nativeDeps."open"."0.0.2" or []);
+    deps = [
+    ];
+    peerDependencies = [
+    ];
+    passthru.names = [ "open" ];
+  };
   full."open"."0.0.4" = lib.makeOverridable self.buildNodePackage {
     name = "open-0.0.4";
     src = [
@@ -11083,6 +11243,22 @@
     ];
     passthru.names = [ "q" ];
   };
+  full."qs"."0.4.x" = lib.makeOverridable self.buildNodePackage {
+    name = "qs-0.4.2";
+    src = [
+      (fetchurl {
+        url = "http://registry.npmjs.org/qs/-/qs-0.4.2.tgz";
+        sha1 = "3cac4c861e371a8c9c4770ac23cda8de639b8e5f";
+      })
+    ];
+    buildInputs =
+      (self.nativeDeps."qs"."0.4.x" or []);
+    deps = [
+    ];
+    peerDependencies = [
+    ];
+    passthru.names = [ "qs" ];
+  };
   full."qs"."0.5.1" = lib.makeOverridable self.buildNodePackage {
     name = "qs-0.5.1";
     src = [
@@ -11147,6 +11323,22 @@
     ];
     passthru.names = [ "qs" ];
   };
+  full."qs".">= 0.4.0" = lib.makeOverridable self.buildNodePackage {
+    name = "qs-0.6.5";
+    src = [
+      (fetchurl {
+        url = "http://registry.npmjs.org/qs/-/qs-0.6.5.tgz";
+        sha1 = "294b268e4b0d4250f6dde19b3b8b34935dff14ef";
+      })
+    ];
+    buildInputs =
+      (self.nativeDeps."qs".">= 0.4.0" or []);
+    deps = [
+    ];
+    peerDependencies = [
+    ];
+    passthru.names = [ "qs" ];
+  };
   full."qs"."~0.5.0" = lib.makeOverridable self.buildNodePackage {
     name = "qs-0.5.6";
     src = [
@@ -11494,6 +11686,42 @@
     ];
     passthru.names = [ "readable-stream" ];
   };
+  full."readable-stream"."~1.1.8" = lib.makeOverridable self.buildNodePackage {
+    name = "readable-stream-1.1.9";
+    src = [
+      (fetchurl {
+        url = "http://registry.npmjs.org/readable-stream/-/readable-stream-1.1.9.tgz";
+        sha1 = "d87130fbf8f9ee9c3b4058b3c58a3e30db2fcfdd";
+      })
+    ];
+    buildInputs =
+      (self.nativeDeps."readable-stream"."~1.1.8" or []);
+    deps = [
+      self.full."core-util-is"."~1.0.0"
+      self.full."debuglog"."0.0.2"
+    ];
+    peerDependencies = [
+    ];
+    passthru.names = [ "readable-stream" ];
+  };
+  full."readable-stream"."~1.1.9" = lib.makeOverridable self.buildNodePackage {
+    name = "readable-stream-1.1.9";
+    src = [
+      (fetchurl {
+        url = "http://registry.npmjs.org/readable-stream/-/readable-stream-1.1.9.tgz";
+        sha1 = "d87130fbf8f9ee9c3b4058b3c58a3e30db2fcfdd";
+      })
+    ];
+    buildInputs =
+      (self.nativeDeps."readable-stream"."~1.1.9" or []);
+    deps = [
+      self.full."core-util-is"."~1.0.0"
+      self.full."debuglog"."0.0.2"
+    ];
+    peerDependencies = [
+    ];
+    passthru.names = [ "readable-stream" ];
+  };
   full."readdirp"."~0.2.3" = lib.makeOverridable self.buildNodePackage {
     name = "readdirp-0.2.5";
     src = [
@@ -11529,11 +11757,11 @@
     passthru.names = [ "redeyed" ];
   };
   full."redis"."*" = lib.makeOverridable self.buildNodePackage {
-    name = "redis-0.8.6";
+    name = "redis-0.9.0";
     src = [
       (fetchurl {
-        url = "http://registry.npmjs.org/redis/-/redis-0.8.6.tgz";
-        sha1 = "a7ae8f0d6fad24bdeaffe28158d6cd1f1c9d30b8";
+        url = "http://registry.npmjs.org/redis/-/redis-0.9.0.tgz";
+        sha1 = "b0f5b9c5619b4f1784837718677212c1af33ee67";
       })
     ];
     buildInputs =
@@ -11579,11 +11807,11 @@
     passthru.names = [ "redis" ];
   };
   full."redis".">= 0.6.6" = lib.makeOverridable self.buildNodePackage {
-    name = "redis-0.8.6";
+    name = "redis-0.9.0";
     src = [
       (fetchurl {
-        url = "http://registry.npmjs.org/redis/-/redis-0.8.6.tgz";
-        sha1 = "a7ae8f0d6fad24bdeaffe28158d6cd1f1c9d30b8";
+        url = "http://registry.npmjs.org/redis/-/redis-0.9.0.tgz";
+        sha1 = "b0f5b9c5619b4f1784837718677212c1af33ee67";
       })
     ];
     buildInputs =
@@ -12031,11 +12259,11 @@
     passthru.names = [ "request-replay" ];
   };
   full."requirejs"."~2.1.0" = lib.makeOverridable self.buildNodePackage {
-    name = "requirejs-2.1.8";
+    name = "requirejs-2.1.9";
     src = [
       (fetchurl {
-        url = "http://registry.npmjs.org/requirejs/-/requirejs-2.1.8.tgz";
-        sha1 = "f0dfa656d60d404947da796f9c661d92c1b0257a";
+        url = "http://registry.npmjs.org/requirejs/-/requirejs-2.1.9.tgz";
+        sha1 = "624e10d22863e8db9aebfb8f21809ca59da42344";
       })
     ];
     buildInputs =
@@ -12366,11 +12594,11 @@
     passthru.names = [ "sax" ];
   };
   full."selenium-webdriver"."*" = lib.makeOverridable self.buildNodePackage {
-    name = "selenium-webdriver-2.35.2";
+    name = "selenium-webdriver-2.37.0";
     src = [
       (fetchurl {
-        url = "http://registry.npmjs.org/selenium-webdriver/-/selenium-webdriver-2.35.2.tgz";
-        sha1 = "e6bbb6ff26ea61224173caa006a8eb87d6a94c2d";
+        url = "http://registry.npmjs.org/selenium-webdriver/-/selenium-webdriver-2.37.0.tgz";
+        sha1 = "02a8c9240203c22d0400d466253d4af3f63748b8";
       })
     ];
     buildInputs =
@@ -12803,11 +13031,11 @@
     passthru.names = [ "shelljs" ];
   };
   full."should"."*" = lib.makeOverridable self.buildNodePackage {
-    name = "should-1.3.0";
+    name = "should-2.0.1";
     src = [
       (fetchurl {
-        url = "http://registry.npmjs.org/should/-/should-1.3.0.tgz";
-        sha1 = "20b71a09b5ed16146b903022bd306ef332efe873";
+        url = "http://registry.npmjs.org/should/-/should-2.0.1.tgz";
+        sha1 = "d244c90bb919f3e51dca472ef7d93c244eb7b79a";
       })
     ];
     buildInputs =
@@ -13214,18 +13442,18 @@
     passthru.names = [ "socket.io-client" ];
   };
   full."sockjs"."*" = lib.makeOverridable self.buildNodePackage {
-    name = "sockjs-0.3.7";
+    name = "sockjs-0.3.8";
     src = [
       (fetchurl {
-        url = "http://registry.npmjs.org/sockjs/-/sockjs-0.3.7.tgz";
-        sha1 = "2950e0586d8a9d3044958a831ade68db197749cb";
+        url = "http://registry.npmjs.org/sockjs/-/sockjs-0.3.8.tgz";
+        sha1 = "c083cb0505db1ea1a949d3bd12d8a1ea385a456c";
       })
     ];
     buildInputs =
       (self.nativeDeps."sockjs"."*" or []);
     deps = [
       self.full."node-uuid"."1.3.3"
-      self.full."faye-websocket"."0.4.4"
+      self.full."faye-websocket"."0.7.0"
     ];
     peerDependencies = [
     ];
@@ -13387,6 +13615,23 @@
     ];
     passthru.names = [ "stream-counter" ];
   };
+  full."stream-counter"."~0.2.0" = lib.makeOverridable self.buildNodePackage {
+    name = "stream-counter-0.2.0";
+    src = [
+      (fetchurl {
+        url = "http://registry.npmjs.org/stream-counter/-/stream-counter-0.2.0.tgz";
+        sha1 = "ded266556319c8b0e222812b9cf3b26fa7d947de";
+      })
+    ];
+    buildInputs =
+      (self.nativeDeps."stream-counter"."~0.2.0" or []);
+    deps = [
+      self.full."readable-stream"."~1.1.8"
+    ];
+    peerDependencies = [
+    ];
+    passthru.names = [ "stream-counter" ];
+  };
   full."stream-splitter-transform"."*" = lib.makeOverridable self.buildNodePackage {
     name = "stream-splitter-transform-0.0.3";
     src = [
@@ -13977,16 +14222,16 @@
     ];
     passthru.names = [ "tunnel-agent" ];
   };
-  full."type-detect"."0.1.0" = lib.makeOverridable self.buildNodePackage {
-    name = "type-detect-0.1.0";
+  full."type-detect"."0.1.1" = lib.makeOverridable self.buildNodePackage {
+    name = "type-detect-0.1.1";
     src = [
       (fetchurl {
-        url = "http://registry.npmjs.org/type-detect/-/type-detect-0.1.0.tgz";
-        sha1 = "81ed3ab764cd5139388b67d052eb01610edc1a57";
+        url = "http://registry.npmjs.org/type-detect/-/type-detect-0.1.1.tgz";
+        sha1 = "0ba5ec2a885640e470ea4e8505971900dac58822";
       })
     ];
     buildInputs =
-      (self.nativeDeps."type-detect"."0.1.0" or []);
+      (self.nativeDeps."type-detect"."0.1.1" or []);
     deps = [
     ];
     peerDependencies = [
@@ -14328,11 +14573,11 @@
     passthru.names = [ "underscore.string" ];
   };
   full."ungit"."*" = lib.makeOverridable self.buildNodePackage {
-    name = "ungit-0.3.1";
+    name = "ungit-0.3.2";
     src = [
       (fetchurl {
-        url = "http://registry.npmjs.org/ungit/-/ungit-0.3.1.tgz";
-        sha1 = "9541d6ba8545ea4a914cf05a413890da61bdd7ff";
+        url = "http://registry.npmjs.org/ungit/-/ungit-0.3.2.tgz";
+        sha1 = "bb52c4af06280e81c6499cc92f13436e0fefa0d8";
       })
     ];
     buildInputs =
@@ -14738,23 +14983,23 @@
     ];
     passthru.names = [ "watch" ];
   };
-  full."wd"."~0.0.32" = lib.makeOverridable self.buildNodePackage {
-    name = "wd-0.0.34";
+  full."wd"."~0.1.5" = lib.makeOverridable self.buildNodePackage {
+    name = "wd-0.1.5";
     src = [
       (fetchurl {
-        url = "http://registry.npmjs.org/wd/-/wd-0.0.34.tgz";
-        sha1 = "c8d00ccdbb2862f914b7bd5935330a53cfa88562";
+        url = "http://registry.npmjs.org/wd/-/wd-0.1.5.tgz";
+        sha1 = "c0a9c8fb5f62ed6628a6f6e1d1958f9316dadfec";
       })
     ];
     buildInputs =
-      (self.nativeDeps."wd"."~0.0.32" or []);
+      (self.nativeDeps."wd"."~0.1.5" or []);
     deps = [
       self.full."async"."0.2.x"
-      self.full."underscore"."1.4.x"
       self.full."vargs"."~0.1.0"
       self.full."q"."0.9.x"
       self.full."request"."~2.21.0"
       self.full."archiver"."~0.4.6"
+      self.full."lodash"."~1.3.1"
     ];
     peerDependencies = [
     ];
diff --git a/pkgs/top-level/node-packages.json b/pkgs/top-level/node-packages.json
index 3e16f4e3df4..1057e3f6f28 100644
--- a/pkgs/top-level/node-packages.json
+++ b/pkgs/top-level/node-packages.json
@@ -106,4 +106,5 @@
 , "plist-native"
 , "x509"
 , "owl-deepcopy"
+, "meat"
 ]
diff --git a/pkgs/top-level/python-packages-generated.nix b/pkgs/top-level/python-packages-generated.nix
index 4e72b12ffcc..e7308e2b816 100644
--- a/pkgs/top-level/python-packages-generated.nix
+++ b/pkgs/top-level/python-packages-generated.nix
@@ -2263,11 +2263,11 @@ in
   };
 
 
-  "cssselect-0.8" = self.buildPythonPackage {
-    name = "cssselect-0.8";
+  "cssselect-0.9" = self.buildPythonPackage {
+    name = "cssselect-0.9";
     src = fetchurl {
-        url = "https://pypi.python.org/packages/source/c/cssselect/cssselect-0.8.tar.gz";
-        md5 = "c4683e050351abcbbd5990b01f5344e2";
+        url = "https://pypi.python.org/packages/source/c/cssselect/cssselect-0.9.tar.gz";
+        md5 = "3aba1e431787da957a9cd1e2c2e0bf1c";
     };
     doCheck = false;
     buildInputs = [  ];
@@ -2552,7 +2552,7 @@ in
         md5 = "1b433f83d50d1bc61e09026e906d84c7";
     };
     doCheck = false;
-    buildInputs = [ pkgs.postgresql ];
+    buildInputs = [  ];
     propagatedBuildInputs = [  ];
     installCommand = ''easy_install --always-unzip --prefix="$out" .'';
     meta = {
@@ -4036,7 +4036,7 @@ in
         md5 = "bf0a04fcf8b2cdcaa13b04324cefb53d";
     };
     doCheck = true;
-    buildInputs = [ self."nose-1.3.0" self."unittest2-0.5.1" self."pyquery-1.2.4" self."WSGIProxy2-0.3" self."PasteDeploy-1.5.0" self."mock-1.0.1" self."coverage-3.7" pkgs.unzip ];
+    buildInputs = [ self."nose-1.3.0" self."unittest2-0.5.1" self."pyquery-1.2.6" self."WSGIProxy2-0.3" self."PasteDeploy-1.5.0" self."mock-1.0.1" self."coverage-3.7" pkgs.unzip ];
     propagatedBuildInputs = [ self."beautifulsoup4-4.3.2" self."six-1.4.1" self."waitress-0.8.7" self."WebOb-1.2.3" ];
     installCommand = ''easy_install --always-unzip --prefix="$out" .'';
     meta = {
@@ -4409,42 +4409,42 @@ in
   };
 
 
-  "zope.event-3.5.2" = self.buildPythonPackage {
-    name = "zope.event-3.5.2";
+  "pyquery-1.2.6" = self.buildPythonPackage {
+    name = "pyquery-1.2.6";
     src = fetchurl {
-        url = "https://pypi.python.org/packages/source/z/zope.event/zope.event-3.5.2.tar.gz";
-        md5 = "6e8af2a16157a74885d4f0d88137cefb";
+        url = "https://pypi.python.org/packages/source/p/pyquery/pyquery-1.2.6.zip";
+        md5 = "af51aa835f24eef06175c48dc1218029";
     };
-    doCheck = false;
-    buildInputs = [  ];
-    propagatedBuildInputs = [ self.setuptools ];
+    doCheck = true;
+    buildInputs = [ pkgs.unzip ];
+    propagatedBuildInputs = [ self."cssselect-0.9" self."lxml-3.2.3" ];
     installCommand = ''easy_install --always-unzip --prefix="$out" .'';
     meta = {
       description = ''
-        Very basic event publishing system
+        A jquery-like library for python
         '';
-      homepage = "http://pypi.python.org/pypi/zope.event";
-      license = "ZPL 2.1";
+      homepage = "https://github.com/gawel/pyquery";
+      license = "BSD";
     };
   };
 
 
-  "pyquery-1.2.4" = self.buildPythonPackage {
-    name = "pyquery-1.2.4";
+  "zope.event-3.5.2" = self.buildPythonPackage {
+    name = "zope.event-3.5.2";
     src = fetchurl {
-        url = "https://pypi.python.org/packages/source/p/pyquery/pyquery-1.2.4.tar.gz";
-        md5 = "268f08258738d21bc1920d7522f2a63b";
+        url = "https://pypi.python.org/packages/source/z/zope.event/zope.event-3.5.2.tar.gz";
+        md5 = "6e8af2a16157a74885d4f0d88137cefb";
     };
-    doCheck = true;
+    doCheck = false;
     buildInputs = [  ];
-    propagatedBuildInputs = [ self."cssselect-0.8" self."lxml-3.2.3" ];
+    propagatedBuildInputs = [ self.setuptools ];
     installCommand = ''easy_install --always-unzip --prefix="$out" .'';
     meta = {
       description = ''
-        A jquery-like library for python
+        Very basic event publishing system
         '';
-      homepage = "https://github.com/gawel/pyquery";
-      license = "BSD";
+      homepage = "http://pypi.python.org/pypi/zope.event";
+      license = "ZPL 2.1";
     };
   };
 
diff --git a/pkgs/top-level/python-packages.json b/pkgs/top-level/python-packages.json
index 065e9340e7d..aefd911a558 100644
--- a/pkgs/top-level/python-packages.json
+++ b/pkgs/top-level/python-packages.json
@@ -133,12 +133,7 @@
   },
   { "name": "psycopg2",
     "buildInputs": [ "pkgs.postgresql" ],
-    "doCheck": false,
-    "override": {
-      "psycopg2": {
-        "buildInputs": [ "pkgs.postgresql" ]
-      }
-    }
+    "doCheck": false
   }
 
 ]
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 94c8c1ba66e..8baaa25d303 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5,7 +5,7 @@ isPy26 = python.majorVersion == "2.6";
 isPy27 = python.majorVersion == "2.7";
 optional = pkgs.lib.optional;
 optionals = pkgs.lib.optionals;
-modules = python.modules or { readline = null; sqlite3 = null; curses = null; ssl = null; crypt = null; };
+modules = python.modules or { readline = null; sqlite3 = null; curses = null; curses_panel = null; ssl = null; crypt = null; };
 
 pythonPackages = modules // import ./python-packages-generated.nix {
   inherit pkgs python;
@@ -2668,6 +2668,31 @@ pythonPackages = modules // import ./python-packages-generated.nix {
     };
   };
 
+  glances = buildPythonPackage rec {
+    name = "glances-${meta.version}";
+
+    src = fetchurl {
+      url = "https://github.com/nicolargo/glances/archive/v${meta.version}.tar.gz";
+      sha256 = "0g2yg9qf7qgjwv13x0rx51rzhn99pcmjpb3vk0g3gmmdsqyqi0d6";
+    };
+
+    buildInputs = [ pkgs.hddtemp ];
+
+    propagatedBuildInputs = [ psutil jinja2 modules.curses modules.curses_panel];
+
+    doCheck = false;
+
+    preConfigure = ''
+      sed -i -r -e '/data_files.append[(][(](conf|etc)_path/ietc_path="etc/glances"; conf_path="etc/glances"' setup.py;
+    '';
+
+    meta = {
+      version = "1.7.1";
+      homepage = "http://nicolargo.github.io/glances/";
+      description = "Cross-platform curses-based monitoring tool";
+    };
+  };
+
 
   greenlet = buildPythonPackage rec {
     name = "greenlet-0.3.1";
@@ -4320,6 +4345,26 @@ pythonPackages = modules // import ./python-packages-generated.nix {
   };
 
 
+  psycopg2 = buildPythonPackage rec {
+    name = "psycopg2-2.5.1";
+
+    # error: invalid command 'test'
+    doCheck = false;
+
+    src = fetchurl {
+      url = "https://pypi.python.org/packages/source/p/psycopg2/psycopg2-2.5.1.tar.gz";
+      sha256 = "1v7glzzzykbaqj7dhpr0qds9cf4maxmn7f5aazpqnbg0ly40r9v5";
+    };
+
+    propagatedBuildInputs = [ pkgs.postgresql ];
+
+    meta = {
+      description = "PostgreSQL database adapter for the Python programming language";
+      license = "GPLv2/ZPL";
+    };
+  };
+
+
   publicsuffix = buildPythonPackage rec {
     name = "publicsuffix-${version}";
     version = "1.0.2";
@@ -5327,7 +5372,7 @@ pythonPackages = modules // import ./python-packages-generated.nix {
     propagatedBuildInputs =
       [ recaptcha_client pytz memcached dateutil_1_5 paramiko flup pygments
         djblets django_1_3 django_evolution pycrypto modules.sqlite3
-        pysvn pil pythonPackages.psycopg2
+        pysvn pil psycopg2
       ];
   };