summary refs log tree commit diff
path: root/pkgs
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs')
-rw-r--r--pkgs/applications/misc/gpxsee/default.nix4
-rw-r--r--pkgs/applications/networking/dropbox/default.nix12
-rw-r--r--pkgs/applications/networking/ipfs/default.nix5
-rw-r--r--pkgs/applications/office/mendeley/default.nix9
-rw-r--r--pkgs/applications/science/math/maxima/default.nix8
-rw-r--r--pkgs/applications/science/math/sage/default.nix6
-rw-r--r--pkgs/applications/video/handbrake/default.nix46
-rw-r--r--pkgs/applications/video/handbrake/disable-unfree.patch101
-rw-r--r--pkgs/applications/video/handbrake/handbrake-0.10.3-nolibav.patch76
-rw-r--r--pkgs/build-support/grsecurity/default.nix3
-rw-r--r--pkgs/data/fonts/dejavu-fonts/default.nix6
-rw-r--r--pkgs/development/compilers/go/1.5.nix143
-rw-r--r--pkgs/development/compilers/go/1.6.nix6
-rw-r--r--pkgs/development/compilers/go/1.7.nix6
-rw-r--r--pkgs/development/haskell-modules/configuration-common.nix3
-rw-r--r--pkgs/development/haskell-modules/generic-stack-builder.nix5
-rw-r--r--pkgs/development/haskell-modules/patches/spy.patch26
-rw-r--r--pkgs/development/libraries/cpp-hocon/default.nix26
-rw-r--r--pkgs/development/libraries/fontconfig/default.nix8
-rw-r--r--pkgs/development/libraries/fontconfig/make-fonts-cache.nix2
-rw-r--r--pkgs/development/libraries/fontconfig/make-fonts-conf.nix6
-rw-r--r--pkgs/development/libraries/java/rhino/default.nix2
-rw-r--r--pkgs/development/libraries/leatherman/default.nix8
-rw-r--r--pkgs/development/libraries/liborc/default.nix17
-rw-r--r--pkgs/development/libraries/libsoup/default.nix7
-rw-r--r--pkgs/development/libraries/ucommon/default.nix6
-rw-r--r--pkgs/development/ocaml-modules/menhir/generic.nix8
-rw-r--r--pkgs/development/tools/build-managers/bear/default.nix32
-rw-r--r--pkgs/development/tools/misc/indent/default.nix2
-rw-r--r--pkgs/development/tools/rtags/default.nix7
-rw-r--r--pkgs/misc/vim-plugins/default.nix14
-rw-r--r--pkgs/misc/vim-plugins/vim-plugin-names1
-rw-r--r--pkgs/os-specific/linux/batman-adv/default.nix1
-rw-r--r--pkgs/os-specific/linux/forkstat/default.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/common-config.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/patches.nix2
-rw-r--r--pkgs/os-specific/linux/lttng-modules/default.nix4
-rw-r--r--pkgs/os-specific/linux/musl/default.nix4
-rw-r--r--pkgs/servers/x11/xorg/overrides.nix15
-rw-r--r--pkgs/servers/x11/xquartz/default.nix1
-rw-r--r--pkgs/stdenv/darwin/make-bootstrap-tools.nix10
-rw-r--r--pkgs/tools/graphics/lprof/default.nix1
-rw-r--r--pkgs/tools/misc/fontforge/default.nix3
-rw-r--r--pkgs/tools/system/facter/default.nix8
-rw-r--r--pkgs/tools/system/runit/default.nix8
-rw-r--r--pkgs/tools/typesetting/kindlegen/default.nix48
-rw-r--r--pkgs/tools/typesetting/pdftk/default.nix2
-rw-r--r--pkgs/top-level/all-packages.nix77
48 files changed, 389 insertions, 414 deletions
diff --git a/pkgs/applications/misc/gpxsee/default.nix b/pkgs/applications/misc/gpxsee/default.nix
index 58575af462a..edc8bbc3f77 100644
--- a/pkgs/applications/misc/gpxsee/default.nix
+++ b/pkgs/applications/misc/gpxsee/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "gpxsee-${version}";
-  version = "2.16";
+  version = "2.17";
 
   src = fetchFromGitHub {
     owner = "tumic0";
     repo = "GPXSee";
     rev = version;
-    sha256 = "0xqmjh071my9klxlk5afx8r673zlknq84n7ain6mz9i8n9m1gviv";
+    sha256 = "1422kgj972ydasqqm0k02qf3v2py7if2ibri7yjg8awqilacy6by";
   };
 
   nativeBuildInputs = [ qmakeHook ];
diff --git a/pkgs/applications/networking/dropbox/default.nix b/pkgs/applications/networking/dropbox/default.nix
index eadd85d4648..b98e7eea14b 100644
--- a/pkgs/applications/networking/dropbox/default.nix
+++ b/pkgs/applications/networking/dropbox/default.nix
@@ -23,17 +23,17 @@
 let
   # NOTE: When updating, please also update in current stable,
   # as older versions stop working
-  version = "8.4.19";
+  version = "8.4.21";
   sha256 =
     {
-      "x86_64-linux" = "0pm43cklsm41mg463mz0ypvbladm2mz65s7ar9z4k4hgjrhyh67j";
-      "i686-linux" = "0myz8s2xdl034zb4548fgzz2f5gfvzfr1nwp50fh3f3hmf6frgp3";
+      "x86_64-linux" = "1nihmr99mzyjhhdlg39j6g0m6hqgdz80lgrjdw1nnh38vq4fgbnq";
+      "i686-linux"   = "09jfdc8isjcpvgnvfykawlvdq65ng0dg6b54m4vdswk58ggndvlq";
     }."${stdenv.system}" or (throw "system ${stdenv.system} not supported");
 
   arch =
     {
       "x86_64-linux" = "x86_64";
-      "i686-linux" = "x86";
+      "i686-linux"   = "x86";
     }."${stdenv.system}" or (throw "system ${stdenv.system} not supported");
 
   # relative location where the dropbox libraries are stored
@@ -74,7 +74,7 @@ in stdenv.mkDerivation {
 
   installPhase = ''
     mkdir -p "$out/${appdir}"
-    cp -r "dropbox-lnx.${arch}-${version}"/* "$out/${appdir}/"
+    cp -r --no-preserve=mode "dropbox-lnx.${arch}-${version}"/* "$out/${appdir}/"
 
     rm "$out/${appdir}/libdrm.so.2"
     rm "$out/${appdir}/libffi.so.6"
@@ -104,6 +104,8 @@ in stdenv.mkDerivation {
     RPATH="${ldpath}:$out/${appdir}"
     makeWrapper "$out/${appdir}/dropbox" "$out/bin/dropbox" \
       --prefix LD_LIBRARY_PATH : "$RPATH"
+
+    chmod 755 $out/${appdir}/dropbox
   '';
 
   fixupPhase = ''
diff --git a/pkgs/applications/networking/ipfs/default.nix b/pkgs/applications/networking/ipfs/default.nix
index a08a347ab28..79e2185f04e 100644
--- a/pkgs/applications/networking/ipfs/default.nix
+++ b/pkgs/applications/networking/ipfs/default.nix
@@ -1,6 +1,6 @@
-{ stdenv, buildGo15Package, fetchFromGitHub }:
+{ stdenv, buildGoPackage, fetchFromGitHub }:
 
-buildGo15Package rec {
+buildGoPackage rec {
   name = "ipfs-${version}";
   version = "i20160112--${stdenv.lib.strings.substring 0 7 rev}";
   rev = "7070b4d878baad57dcc8da80080dd293aa46cabd";
@@ -17,5 +17,6 @@ buildGo15Package rec {
   meta = with stdenv.lib; {
     description = "A global, versioned, peer-to-peer filesystem";
     license = licenses.mit;
+    broken = true;
   };
 }
diff --git a/pkgs/applications/office/mendeley/default.nix b/pkgs/applications/office/mendeley/default.nix
index 5ad6df96325..7ccf66c055e 100644
--- a/pkgs/applications/office/mendeley/default.nix
+++ b/pkgs/applications/office/mendeley/default.nix
@@ -1,5 +1,5 @@
 { fetchurl, stdenv, dpkg, makeWrapper, which
-,gcc, xorg, qt4, zlib
+,gcc, liborc, xorg, qt4, zlib
 , ...}:
 
 assert stdenv.system == "i686-linux" || stdenv.system == "x86_64-linux";
@@ -12,17 +12,18 @@ let
     then "i386"
     else "amd64";
 
-  shortVersion = "1.16.1-stable";
+  shortVersion = "1.16.2-stable";
 
   version = "${shortVersion}_${arch}";
 
   url = "http://desktop-download.mendeley.com/download/apt/pool/main/m/mendeleydesktop/mendeleydesktop_${version}.deb";
   sha256 = if stdenv.system == arch32
-    then "0lsmaw8zzyfvndsz1awz3vl5cdvsik9wc3ck8983y20awh7r9f4m"
-    else "0q11v6dv7z5q4s9hlr1hmsd73nmkp8l0sj0b3hjxfblx4mqk6wl7";
+    then "08f61972d5a5e491fcd3d4cf5dfe59ad7e07b3883b7ad50d440868c3057af6fb"
+    else "9bd139b236143f78b23ff4271c01a20c059622abe9dd125e771e0b5db16b7b7b";
 
   deps = [
     gcc.cc
+    liborc
     qt4
     xorg.libX11
     zlib
diff --git a/pkgs/applications/science/math/maxima/default.nix b/pkgs/applications/science/math/maxima/default.nix
index 21d3c656d30..4981767f21f 100644
--- a/pkgs/applications/science/math/maxima/default.nix
+++ b/pkgs/applications/science/math/maxima/default.nix
@@ -1,8 +1,8 @@
-{ stdenv, fetchurl, sbcl, texinfo, perl, makeWrapper, rlwrap ? null, tk ? null, gnuplot ? null }:
+{ stdenv, fetchurl, sbcl, texinfo, perl, python, makeWrapper, rlwrap ? null, tk ? null, gnuplot ? null }:
 
 let
   name    = "maxima";
-  version = "5.36.1";
+  version = "5.38.1";
 
   searchPath =
     stdenv.lib.makeBinPath
@@ -13,10 +13,10 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "mirror://sourceforge/${name}/${name}-${version}.tar.gz";
-    sha256 = "0x1rk659sn3cq0n5c90848ilzr1gb1wf0072fl6jhkdq00qgh2s0";
+    sha256 = "1p6646rvq43hk09msyp0dk50cqpkh07mf4x0bc2fqisqmcv6b1hf";
   };
 
-  buildInputs = [sbcl texinfo perl makeWrapper];
+  buildInputs = [sbcl texinfo perl python makeWrapper];
 
   postInstall = ''
     # Make sure that maxima can find its runtime dependencies.
diff --git a/pkgs/applications/science/math/sage/default.nix b/pkgs/applications/science/math/sage/default.nix
index 6e0b4313b47..9e17fe60c29 100644
--- a/pkgs/applications/science/math/sage/default.nix
+++ b/pkgs/applications/science/math/sage/default.nix
@@ -7,7 +7,7 @@ stdenv.mkDerivation rec {
   name = "sage-6.8";
 
   src = fetchurl {
-    url = "mirror://sagemath/${name}.tar.gz";
+    url = "http://old.files.sagemath.org/src-old/${name}.tar.gz";
     sha256 = "102mrzzi215g1xn5zgcv501x9sghwg758jagx2jixvg1rj2jijj9";
   };
 
@@ -18,11 +18,14 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  hardeningDisable = [ "format" ];
+
   preConfigure = ''
     export SAGE_NUM_THREADS=$NIX_BUILD_CORES
     export SAGE_ATLAS_ARCH=fast
     mkdir -p $out/sageHome
     export HOME=$out/sageHome
+    export CPPFLAGS="-P"
   '';
 
   preBuild = "patchShebangs build";
@@ -30,7 +33,6 @@ stdenv.mkDerivation rec {
   installPhase = ''DESTDIR=$out make install'';
 
   meta = {
-    broken = true;
     homepage = "http://www.sagemath.org";
     description = "A free open source mathematics software system";
     license = stdenv.lib.licenses.gpl2Plus;
diff --git a/pkgs/applications/video/handbrake/default.nix b/pkgs/applications/video/handbrake/default.nix
index 351cf5c5211..9f257cde21f 100644
--- a/pkgs/applications/video/handbrake/default.nix
+++ b/pkgs/applications/video/handbrake/default.nix
@@ -7,8 +7,6 @@
 # This has the benefits of providing improvements to other packages,
 # making licenses more clear and reducing compile time/install size.
 #
-# For compliance, the unfree codec faac is optionally spliced out.
-#
 # Only tested on Linux
 #
 # TODO: package and use libappindicator
@@ -18,47 +16,40 @@
   autoconf, automake, libtool, m4,
   libass, libsamplerate, fribidi, libxml2, bzip2,
   libogg, libtheora, libvorbis, libdvdcss, a52dec, fdk_aac,
-  lame, faac, ffmpeg, libdvdread, libdvdnav, libbluray,
-  mp4v2, mpeg2dec, x264, libmkv,
+  lame, ffmpeg, libdvdread, libdvdnav, libbluray,
+  mp4v2, mpeg2dec, x264, x265, libmkv,
   fontconfig, freetype, hicolor_icon_theme,
-  glib, gtk, webkitgtk, intltool, libnotify,
-  gst_all_1, dbus_glib, udev, libgudev,
-  useGtk ? true,
-  useWebKitGtk ? false # This prevents ghb from starting in my tests
+  glib, gtk3, intltool, libnotify,
+  gst_all_1, dbus_glib, udev, libgudev, libvpx,
+  wrapGAppsHook,
+  useGtk ? true
 }:
 
 stdenv.mkDerivation rec {
-  version = "0.9.9";
+  version = "0.10.5";
   name = "handbrake-${version}";
 
-  # ToDo: doesn't work (yet)
-  allowUnfree = false; # config.allowUnfree or false;
-
   buildInputsX = stdenv.lib.optionals useGtk [
-    glib gtk intltool libnotify
+    glib gtk3 intltool libnotify
     gst_all_1.gstreamer gst_all_1.gst-plugins-base dbus_glib udev
     libgudev
-  ] ++ stdenv.lib.optionals useWebKitGtk [ webkitgtk ];
-
-  # Did not test compiling with it
-  unfreeInputs = stdenv.lib.optional allowUnfree faac;
+    wrapGAppsHook
+  ];
 
   nativeBuildInputs = [ python pkgconfig yasm autoconf automake libtool m4 ];
   buildInputs = [
     fribidi fontconfig freetype hicolor_icon_theme
     libass libsamplerate libxml2 bzip2
     libogg libtheora libvorbis libdvdcss a52dec libmkv fdk_aac
-    lame ffmpeg libdvdread libdvdnav libbluray mp4v2 mpeg2dec x264
-  ] ++ buildInputsX ++ unfreeInputs;
+    lame ffmpeg libdvdread libdvdnav libbluray mp4v2 mpeg2dec x264 x265 libvpx
+  ] ++ buildInputsX;
 
 
   src = fetchurl {
     url = "http://download.handbrake.fr/releases/${version}/HandBrake-${version}.tar.bz2";
-    sha256 = "1crmm1c32vx60jfl2bqzg59q4qqx6m83b08snp7h1njc21sdf7d7";
+    sha256 = "1w720y3bplkz187wgvy4a4xm0vpppg45mlni55l6yi8v2bfk14pv";
   };
 
-  patches = stdenv.lib.optional (! allowUnfree) ./disable-unfree.patch;
-
   preConfigure = ''
     # Fake wget to prevent downloads
     mkdir wget
@@ -72,13 +63,13 @@ stdenv.mkDerivation rec {
     sed -i '/MODULES += contrib/d' make/include/main.defs
     sed -i '/PKG_CONFIG_PATH=/d' gtk/module.rules
 
-    # disable faac if non-free
-    if [ -z "$allowUnfree" ]; then
-      rm libhb/encfaac.c
-    fi
+    patch -p1 -R < ${./handbrake-0.10.3-nolibav.patch}
   '';
 
-  configureFlags = "--enable-fdk-aac ${if useGtk then "--disable-gtk-update-checks" else "--disable-gtk"}";
+  configureFlags = [
+    "--enable-fdk-aac"
+    (if useGtk then "--disable-gtk-update-checks" else "--disable-gtk")
+  ];
 
   preBuild = ''
     cd build
@@ -90,7 +81,6 @@ stdenv.mkDerivation rec {
     longDescription = ''
       Handbrake is a versatile transcoding DVD ripper. This package
       provides the cli HandbrakeCLI and the GTK+ version ghb.
-      The faac library is disabled if you're compiling free-only.
     '';
     license = stdenv.lib.licenses.gpl2;
     maintainers = [ stdenv.lib.maintainers.wmertens ];
diff --git a/pkgs/applications/video/handbrake/disable-unfree.patch b/pkgs/applications/video/handbrake/disable-unfree.patch
deleted file mode 100644
index 30edcb81c09..00000000000
--- a/pkgs/applications/video/handbrake/disable-unfree.patch
+++ /dev/null
@@ -1,101 +0,0 @@
-diff -ru HandBrake-0.9.9-orig/gtk/configure.ac HandBrake-0.9.9/gtk/configure.ac
---- HandBrake-0.9.9-orig/gtk/configure.ac	2014-05-02 22:50:00.047305795 +0200
-+++ HandBrake-0.9.9/gtk/configure.ac	2014-05-02 22:48:57.119304020 +0200
-@@ -203,7 +203,7 @@
-     ;;
- esac
- 
--HB_LIBS="-lhb -la52 -lmkv -lavresample -lavformat -lavcodec -lavutil -ldvdnav -ldvdread -lfaac -lmp3lame -lmpeg2 -lvorbis -lvorbisenc -logg -lsamplerate -lx264 -lmp4v2 -lswscale -ltheoraenc -ltheoradec -lz -lbz2 -lpthread -lbluray -lass -lfontconfig -lfreetype -lxml2"
-+HB_LIBS="-lhb -la52 -lmkv -lavresample -lavformat -lavcodec -lavutil -ldvdnav -ldvdread -lmp3lame -lmpeg2 -lvorbis -lvorbisenc -logg -lsamplerate -lx264 -lmp4v2 -lswscale -ltheoraenc -ltheoradec -lz -lbz2 -lpthread -lbluray -lass -lfontconfig -lfreetype -lxml2"
- 
- if test "x$use_fdk_aac" = "xyes" ; then
-     HB_LIBS+=" -lfdk-aac"
-diff -ru HandBrake-0.9.9-orig/gtk/src/preset_xlat.c HandBrake-0.9.9/gtk/src/preset_xlat.c
---- HandBrake-0.9.9-orig/gtk/src/preset_xlat.c	2014-05-02 22:50:00.043305794 +0200
-+++ HandBrake-0.9.9/gtk/src/preset_xlat.c	2014-05-02 22:42:20.987292846 +0200
-@@ -260,7 +260,6 @@
- 
- static value_map_t acodec_xlat[] =
- {
--    {"AAC (faac)", "faac"},
-     {"AC3 Passthru", "ac3"},
-     {"MP3 (lame)", "lame"},
-     {"Vorbis (vorbis)", "vorbis"},
-diff -ru HandBrake-0.9.9-orig/gtk/src/presets.c HandBrake-0.9.9/gtk/src/presets.c
---- HandBrake-0.9.9-orig/gtk/src/presets.c	2014-05-02 22:50:00.043305794 +0200
-+++ HandBrake-0.9.9/gtk/src/presets.c	2014-05-02 22:42:41.283293419 +0200
-@@ -2029,8 +2029,6 @@
- 
- static value_map_t acodec_xlat_compat[] =
- {
--    {"AAC (CoreAudio)", "faac"},
--    {"HE-AAC (CoreAudio)", "faac"},
-     {"AC3 (ffmpeg)", "ac3"},
-     {"AC3", "ac3"},
-     {"MP3 Passthru", "mp3pass"},
-diff -ru HandBrake-0.9.9-orig/libhb/common.c HandBrake-0.9.9/libhb/common.c
---- HandBrake-0.9.9-orig/libhb/common.c	2014-05-02 22:50:00.047305795 +0200
-+++ HandBrake-0.9.9/libhb/common.c	2014-05-02 22:37:24.679284489 +0200
-@@ -126,7 +126,6 @@
-     { "AAC (CoreAudio)",    "ca_aac",     HB_ACODEC_CA_AAC,       HB_MUX_MP4|HB_MUX_MKV },
-     { "HE-AAC (CoreAudio)", "ca_haac",    HB_ACODEC_CA_HAAC,      HB_MUX_MP4|HB_MUX_MKV },
- #endif
--    { "AAC (faac)",         "faac",       HB_ACODEC_FAAC,         HB_MUX_MP4|HB_MUX_MKV },
- #ifdef USE_FDK_AAC
-     { "AAC (FDK)",          "fdk_aac",    HB_ACODEC_FDK_AAC,      HB_MUX_MP4|HB_MUX_MKV },
-     { "HE-AAC (FDK)",       "fdk_haac",   HB_ACODEC_FDK_HAAC,     HB_MUX_MP4|HB_MUX_MKV },
-diff -ru HandBrake-0.9.9-orig/libhb/common.h HandBrake-0.9.9/libhb/common.h
---- HandBrake-0.9.9-orig/libhb/common.h	2014-05-02 22:50:00.047305795 +0200
-+++ HandBrake-0.9.9/libhb/common.h	2014-05-02 22:39:37.839288245 +0200
-@@ -945,7 +945,6 @@
- extern hb_work_object_t hb_decavcodeca;
- extern hb_work_object_t hb_decavcodecv;
- extern hb_work_object_t hb_declpcm;
--extern hb_work_object_t hb_encfaac;
- extern hb_work_object_t hb_enclame;
- extern hb_work_object_t hb_encvorbis;
- extern hb_work_object_t hb_muxer;
-diff -ru HandBrake-0.9.9-orig/libhb/hb.c HandBrake-0.9.9/libhb/hb.c
---- HandBrake-0.9.9-orig/libhb/hb.c	2014-05-02 22:50:00.047305795 +0200
-+++ HandBrake-0.9.9/libhb/hb.c	2014-05-02 22:39:02.287287242 +0200
-@@ -487,7 +487,6 @@
- 	hb_register( &hb_decavcodeca );
- 	hb_register( &hb_decavcodecv );
- 	hb_register( &hb_declpcm );
--	hb_register( &hb_encfaac );
- 	hb_register( &hb_enclame );
- 	hb_register( &hb_encvorbis );
- 	hb_register( &hb_muxer );
-@@ -588,7 +587,6 @@
- 	hb_register( &hb_decavcodeca );
- 	hb_register( &hb_decavcodecv );
- 	hb_register( &hb_declpcm );
--	hb_register( &hb_encfaac );
- 	hb_register( &hb_enclame );
- 	hb_register( &hb_encvorbis );
- 	hb_register( &hb_muxer );
-diff -ru HandBrake-0.9.9-orig/libhb/module.defs HandBrake-0.9.9/libhb/module.defs
---- HandBrake-0.9.9-orig/libhb/module.defs	2014-05-02 22:50:00.047305795 +0200
-+++ HandBrake-0.9.9/libhb/module.defs	2014-05-02 22:39:25.727287903 +0200
-@@ -95,7 +95,7 @@
- LIBHB.lib = $(LIBHB.build/)hb.lib
- 
- LIBHB.dll.libs = $(foreach n, \
--        a52 ass avcodec avformat avutil avresample dvdnav dvdread faac \
-+        a52 ass avcodec avformat avutil avresample dvdnav dvdread \
-         fontconfig freetype mkv mpeg2 mp3lame mp4v2 \
-         ogg samplerate swscale theora vorbis vorbisenc x264 xml2 bluray, \
-         $(CONTRIB.build/)lib/lib$(n).a )
-Only in HandBrake-0.9.9: libhb-orig
-diff -ru HandBrake-0.9.9orig/test/module.defs HandBrake-0.9.9/test/module.defs
---- HandBrake-0.9.9-orig/test/module.defs	2014-05-02 23:15:10.575348401 +0200
-+++ HandBrake-0.9.9/test/module.defs	2014-05-02 23:17:00.523351502 +0200
-@@ -14,7 +14,7 @@
- TEST.libs = $(LIBHB.a)
- 
- TEST.GCC.l = \
--        a52 ass avcodec avformat avutil avresample dvdnav dvdread faac \
-+        a52 ass avcodec avformat avutil avresample dvdnav dvdread \
-         fontconfig freetype fribidi mkv mpeg2 mp3lame mp4v2 ogg \
-         samplerate swscale theoraenc theoradec vorbis vorbisenc x264 \
-         bluray xml2 bz2 z
diff --git a/pkgs/applications/video/handbrake/handbrake-0.10.3-nolibav.patch b/pkgs/applications/video/handbrake/handbrake-0.10.3-nolibav.patch
new file mode 100644
index 00000000000..8539186aaa5
--- /dev/null
+++ b/pkgs/applications/video/handbrake/handbrake-0.10.3-nolibav.patch
@@ -0,0 +1,76 @@
+From 75549414927212d4d1666730133805b33447de79 Mon Sep 17 00:00:00 2001
+From: John Stebbins <jstebbins.hb@gmail.com>
+Date: Tue, 3 Nov 2015 10:16:01 -0800
+Subject: [PATCH] muxavformat: add support for mp4 fallback audio signalling
+
+---
+diff --git a/libhb/muxavformat.c b/libhb/muxavformat.c
+index 0d70597..373c2ab 100644
+--- a/libhb/muxavformat.c
++++ b/libhb/muxavformat.c
+@@ -121,7 +121,7 @@ static int avformatInit( hb_mux_object_t * m )
+     hb_mux_data_t * track;
+     int meta_mux;
+     int max_tracks;
+-    int ii, ret;
++    int ii, jj, ret;
+ 
+     int clock_min, clock_max, clock;
+     hb_video_framerate_get_limits(&clock_min, &clock_max, &clock);
+@@ -589,6 +589,56 @@ static int avformatInit( hb_mux_object_t * m )
+         }
+     }
+ 
++    // Check for audio track associations
++    for (ii = 0; ii < hb_list_count(job->list_audio); ii++)
++    {
++        audio = hb_list_item(job->list_audio, ii);
++        switch (audio->config.out.codec & HB_ACODEC_MASK)
++        {
++            case HB_ACODEC_FFAAC:
++            case HB_ACODEC_CA_AAC:
++            case HB_ACODEC_CA_HAAC:
++            case HB_ACODEC_FDK_AAC:
++            case HB_ACODEC_FDK_HAAC:
++                break;
++
++            default:
++            {
++                // Mark associated fallback audio tracks for any non-aac track
++                for(jj = 0; jj < hb_list_count( job->list_audio ); jj++ )
++                {
++                    hb_audio_t    * fallback;
++                    int             codec;
++
++                    if (ii == jj) continue;
++
++                    fallback = hb_list_item( job->list_audio, jj );
++                    codec = fallback->config.out.codec & HB_ACODEC_MASK;
++                    if (fallback->config.in.track == audio->config.in.track &&
++                        (codec == HB_ACODEC_FFAAC ||
++                         codec == HB_ACODEC_CA_AAC ||
++                         codec == HB_ACODEC_CA_HAAC ||
++                         codec == HB_ACODEC_FDK_AAC ||
++                         codec == HB_ACODEC_FDK_HAAC))
++                    {
++                        hb_mux_data_t * fallback_track;
++                        int           * sd;
++
++                        track = audio->priv.mux_data;
++                        fallback_track = fallback->priv.mux_data;
++                        sd = (int*)av_stream_new_side_data(track->st,
++                                                     AV_PKT_DATA_FALLBACK_TRACK,
++                                                     sizeof(int));
++                        if (sd != NULL)
++                        {
++                            *sd = fallback_track->st->index;
++                        }
++                    }
++                }
++            } break;
++        }
++    }
++
+     char * subidx_fmt =
+         "size: %dx%d\n"
+         "org: %d, %d\n"
diff --git a/pkgs/build-support/grsecurity/default.nix b/pkgs/build-support/grsecurity/default.nix
index 8713f2d22c4..1070d6f746d 100644
--- a/pkgs/build-support/grsecurity/default.nix
+++ b/pkgs/build-support/grsecurity/default.nix
@@ -20,8 +20,7 @@ assert (kernel.version == grsecPatch.kver);
 
 overrideDerivation (kernel.override {
   inherit modDirVersion;
-  kernelPatches = [ { inherit (grsecPatch) name patch; } ] ++ kernelPatches ++ (kernel.kernelPatches or []);
-  features = (kernel.features or {}) // { grsecurity = true; };
+  kernelPatches = [ grsecPatch ] ++ kernelPatches ++ (kernel.kernelPatches or []);
   inherit extraConfig;
   ignoreConfigErrors = true;
 }) (attrs: {
diff --git a/pkgs/data/fonts/dejavu-fonts/default.nix b/pkgs/data/fonts/dejavu-fonts/default.nix
index f49f5c9bb00..6d9abdad2fa 100644
--- a/pkgs/data/fonts/dejavu-fonts/default.nix
+++ b/pkgs/data/fonts/dejavu-fonts/default.nix
@@ -13,6 +13,8 @@ stdenv.mkDerivation rec {
     sha256 = "1xknlg2h287dx34v2n5r33bpcl4biqf0cv7nak657rjki7s0k4bk";
   };
 
+  outputs = [ "out" "minimal" ];
+
   buildFlags = "full-ttf";
 
   preBuild = "patchShebangs scripts";
@@ -22,6 +24,10 @@ stdenv.mkDerivation rec {
     for i in $(find build -name '*.ttf'); do
         cp $i $out/share/fonts/truetype;
     done;
+  '' + ''
+    local fname=share/fonts/truetype/DejaVuSans.ttf
+    moveToOutput "$fname" "$minimal"
+    ln -s "$minimal/$fname" "$out/$fname"
   '';
 
   meta = {
diff --git a/pkgs/development/compilers/go/1.5.nix b/pkgs/development/compilers/go/1.5.nix
deleted file mode 100644
index e6060f3ecec..00000000000
--- a/pkgs/development/compilers/go/1.5.nix
+++ /dev/null
@@ -1,143 +0,0 @@
-{ stdenv, lib, fetchFromGitHub, tzdata, iana_etc, go_1_4, runCommand
-, perl, which, pkgconfig, patch
-, pcre
-, Security, Foundation }:
-
-let
-  goBootstrap = runCommand "go-bootstrap" {} ''
-    mkdir $out
-    cp -rf ${go_1_4}/* $out/
-    chmod -R u+w $out
-    find $out -name "*.c" -delete
-    cp -rf $out/bin/* $out/share/go/bin/
-  '';
-in
-
-stdenv.mkDerivation rec {
-  name = "go-${version}";
-  version = "1.5.4";
-
-  src = fetchFromGitHub {
-    owner = "golang";
-    repo = "go";
-    rev = "go${version}";
-    sha256 = "1lvk9awmkjbz5z4snv3q3b3r7ijfz97kig2wkqz6jmr7b0lp1fcy";
-  };
-
-  # perl is used for testing go vet
-  nativeBuildInputs = [ perl which pkgconfig patch ];
-  buildInputs = [ pcre ];
-  propagatedBuildInputs = lib.optionals stdenv.isDarwin [
-    Security Foundation
-  ];
-
-  hardeningDisable = [ "all" ];
-
-  # I'm not sure what go wants from its 'src', but the go installation manual
-  # describes an installation keeping the src.
-  preUnpack = ''
-    mkdir -p $out/share
-    cd $out/share
-  '';
-
-  prePatch = ''
-    # Ensure that the source directory is named go
-    cd ..
-    if [ ! -d go ]; then
-      mv * go
-    fi
-
-    cd go
-    patchShebangs ./ # replace /bin/bash
-
-    # Disabling the 'os/http/net' tests (they want files not available in
-    # chroot builds)
-    rm src/net/{listen_test.go,parse_test.go,port_test.go}
-    rm src/syscall/exec_linux_test.go
-    # !!! substituteInPlace does not seems to be effective.
-    # The os test wants to read files in an existing path. Just don't let it be /usr/bin.
-    sed -i 's,/usr/bin,'"`pwd`", src/os/os_test.go
-    sed -i 's,/bin/pwd,'"`type -P pwd`", src/os/os_test.go
-    # Disable the unix socket test
-    sed -i '/TestShutdownUnix/areturn' src/net/net_test.go
-    # Disable the hostname test
-    sed -i '/TestHostname/areturn' src/os/os_test.go
-    # ParseInLocation fails the test
-    sed -i '/TestParseInSydney/areturn' src/time/format_test.go
-    # Remove the api check as it never worked
-    sed -i '/src\/cmd\/api\/run.go/ireturn nil' src/cmd/dist/test.go
-    # Remove the coverage test as we have removed this utility
-    sed -i '/TestCoverageWithCgo/areturn' src/cmd/go/go_test.go
-
-    sed -i 's,/etc/protocols,${iana_etc}/etc/protocols,' src/net/lookup_unix.go
-  '' + lib.optionalString stdenv.isLinux ''
-    sed -i 's,/usr/share/zoneinfo/,${tzdata}/share/zoneinfo/,' src/time/zoneinfo_unix.go
-  '' + lib.optionalString stdenv.isDarwin ''
-    substituteInPlace src/race.bash --replace \
-      "sysctl machdep.cpu.extfeatures | grep -qv EM64T" true
-    sed -i 's,strings.Contains(.*sysctl.*,true {,' src/cmd/dist/util.go
-    sed -i 's,"/etc","'"$TMPDIR"'",' src/os/os_test.go
-    sed -i 's,/_go_os_test,'"$TMPDIR"'/_go_os_test,' src/os/path_test.go
-    sed -i '/TestCgoLookupIP/areturn' src/net/cgo_unix_test.go
-    sed -i '/TestChdirAndGetwd/areturn' src/os/os_test.go
-    sed -i '/TestRead0/areturn' src/os/os_test.go
-    sed -i '/TestNohup/areturn' src/os/signal/signal_test.go
-    sed -i '/TestSystemRoots/areturn' src/crypto/x509/root_darwin_test.go
-
-    sed -i '/TestGoInstallRebuildsStalePackagesInOtherGOPATH/areturn' src/cmd/go/go_test.go
-    sed -i '/TestBuildDashIInstallsDependencies/areturn' src/cmd/go/go_test.go
-
-    sed -i '/TestDisasmExtld/areturn' src/cmd/objdump/objdump_test.go
-
-    touch $TMPDIR/group $TMPDIR/hosts $TMPDIR/passwd
-  '';
-
-  patches = [
-    ./remove-tools-1.5.patch
-  ]
-  # -ldflags=-s is required to compile on Darwin, see
-  # https://github.com/golang/go/issues/11994
-  ++ stdenv.lib.optional stdenv.isDarwin ./strip.patch;
-
-  GOOS = if stdenv.isDarwin then "darwin" else "linux";
-  GOARCH = if stdenv.isDarwin then "amd64"
-           else if stdenv.system == "i686-linux" then "386"
-           else if stdenv.system == "x86_64-linux" then "amd64"
-           else if stdenv.isArm then "arm"
-           else throw "Unsupported system";
-  GOARM = stdenv.lib.optionalString (stdenv.system == "armv5tel-linux") "5";
-  GO386 = 387; # from Arch: don't assume sse2 on i686
-  CGO_ENABLED = 1;
-  GOROOT_BOOTSTRAP = "${goBootstrap}/share/go";
-
-  # The go build actually checks for CC=*/clang and does something different, so we don't
-  # just want the generic `cc` here.
-  CC = if stdenv.isDarwin then "clang" else "cc";
-
-  installPhase = ''
-    mkdir -p "$out/bin"
-    export GOROOT="$(pwd)/"
-    export GOBIN="$out/bin"
-    export PATH="$GOBIN:$PATH"
-    cd ./src
-    echo Building
-    ./all.bash
-  '';
-
-  preFixup = ''
-    rm -r $out/share/go/pkg/bootstrap
-  '';
-
-  setupHook = ./setup-hook.sh;
-
-  disallowedReferences = [ go_1_4 ];
-
-  meta = with stdenv.lib; {
-    branch = "1.5";
-    homepage = http://golang.org/;
-    description = "The Go Programming language";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ cstrahan wkennington ];
-    platforms = platforms.linux ++ platforms.darwin;
-  };
-}
diff --git a/pkgs/development/compilers/go/1.6.nix b/pkgs/development/compilers/go/1.6.nix
index bbf2a946ece..38b114d8d07 100644
--- a/pkgs/development/compilers/go/1.6.nix
+++ b/pkgs/development/compilers/go/1.6.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, tzdata, iana_etc, go_1_4, runCommand
+{ stdenv, lib, fetchurl, tzdata, iana_etc, go_bootstrap, runCommand
 , perl, which, pkgconfig, patch, fetchpatch
 , pcre
 , Security, Foundation, bash }:
@@ -6,7 +6,7 @@
 let
   goBootstrap = runCommand "go-bootstrap" {} ''
     mkdir $out
-    cp -rf ${go_1_4}/* $out/
+    cp -rf ${go_bootstrap}/* $out/
     chmod -R u+w $out
     find $out -name "*.c" -delete
     cp -rf $out/bin/* $out/share/go/bin/
@@ -143,7 +143,7 @@ stdenv.mkDerivation rec {
 
   setupHook = ./setup-hook.sh;
 
-  disallowedReferences = [ go_1_4 ];
+  disallowedReferences = [ go_bootstrap ];
 
   meta = with stdenv.lib; {
     branch = "1.6";
diff --git a/pkgs/development/compilers/go/1.7.nix b/pkgs/development/compilers/go/1.7.nix
index 89f56a2438c..bc298924eb8 100644
--- a/pkgs/development/compilers/go/1.7.nix
+++ b/pkgs/development/compilers/go/1.7.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, tzdata, iana_etc, go_1_4, runCommand
+{ stdenv, lib, fetchFromGitHub, tzdata, iana_etc, go_bootstrap, runCommand
 , perl, which, pkgconfig, patch, fetchpatch
 , pcre
 , Security, Foundation, bash }:
@@ -6,7 +6,7 @@
 let
   goBootstrap = runCommand "go-bootstrap" {} ''
     mkdir $out
-    cp -rf ${go_1_4}/* $out/
+    cp -rf ${go_bootstrap}/* $out/
     chmod -R u+w $out
     find $out -name "*.c" -delete
     cp -rf $out/bin/* $out/share/go/bin/
@@ -153,7 +153,7 @@ stdenv.mkDerivation rec {
 
   setupHook = ./setup-hook.sh;
 
-  disallowedReferences = [ go_1_4 ];
+  disallowedReferences = [ go_bootstrap ];
 
   meta = with stdenv.lib; {
     branch = "1.7";
diff --git a/pkgs/development/haskell-modules/configuration-common.nix b/pkgs/development/haskell-modules/configuration-common.nix
index 19f190aa13e..7e1023134d5 100644
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@@ -998,4 +998,7 @@ self: super: {
     '';
   });
 
+  # https://bitbucket.org/ssaasen/spy/pull-requests/3/fsnotify-dropped-system-filepath
+  spy = appendPatch super.spy ./patches/spy.patch;
+
 }
diff --git a/pkgs/development/haskell-modules/generic-stack-builder.nix b/pkgs/development/haskell-modules/generic-stack-builder.nix
index 09bd38ccc93..c7cfbef7d13 100644
--- a/pkgs/development/haskell-modules/generic-stack-builder.nix
+++ b/pkgs/development/haskell-modules/generic-stack-builder.nix
@@ -19,12 +19,13 @@ stdenv.mkDerivation (args // {
   STACK_PLATFORM_VARIANT="nix";
   STACK_IN_NIX_SHELL=1;
   STACK_IN_NIX_EXTRA_ARGS =
-    concatMap (pkg: ["--extra-lib-dirs=${pkg}/lib"
-                     "--extra-include-dirs=${pkg}/include"]) buildInputs ++
+    concatMap (pkg: ["--extra-lib-dirs=${getLib pkg}/lib"
+                     "--extra-include-dirs=${getDev pkg}/include"]) buildInputs ++
     extraArgs;
 
   # XXX: workaround for https://ghc.haskell.org/trac/ghc/ticket/11042.
   LD_LIBRARY_PATH = makeLibraryPath (LD_LIBRARY_PATH ++ buildInputs);
+                    # ^^^ Internally uses `getOutput "lib"` (equiv. to getLib)
 
   preferLocalBuild = true;
 
diff --git a/pkgs/development/haskell-modules/patches/spy.patch b/pkgs/development/haskell-modules/patches/spy.patch
new file mode 100644
index 00000000000..4c4e1844361
--- /dev/null
+++ b/pkgs/development/haskell-modules/patches/spy.patch
@@ -0,0 +1,26 @@
+diff --git a/src/Spy/Watcher.hs b/src/Spy/Watcher.hs
+     index 8512613..4df67d4 100644
+--- a/src/Spy/Watcher.hs
++++ b/src/Spy/Watcher.hs
+@@ -50,7 +50,7 @@ plainFormat = Plain
+ spy :: Spy -> IO b -> IO ()
+ spy config after = withManager $ \wm ->
+     runIndefinitely
+-      (watchTree wm (decodeString $ dir config)
++      (watchTree wm (dir config)
+                   (not . skipEvent config . eventPath)
+                   (handleEvent config)) 
+       (const after)
+@@ -106,9 +106,9 @@ eventTime (Modified _ t) = t
+ eventTime (Removed _ t) = t
+ 
+ eventPath :: Event -> FilePath
+-eventPath (Added fp _) = encodeString fp
+-eventPath (Modified fp _) = encodeString fp
+-eventPath (Removed fp _) = encodeString fp
++eventPath (Added fp _) = fp
++eventPath (Modified fp _) = fp
++eventPath (Removed fp _) = fp
+ 
+ eventType :: Event -> FilePath
+ eventType (Added _ _) = "Added"
diff --git a/pkgs/development/libraries/cpp-hocon/default.nix b/pkgs/development/libraries/cpp-hocon/default.nix
new file mode 100644
index 00000000000..3c4fe70c19d
--- /dev/null
+++ b/pkgs/development/libraries/cpp-hocon/default.nix
@@ -0,0 +1,26 @@
+{ stdenv, fetchFromGitHub, cmake, boost, curl, leatherman }:
+
+stdenv.mkDerivation rec {
+  name = "cpp-hocon-${version}";
+  version = "0.1.2";
+
+  src = fetchFromGitHub {
+    sha256 = "0v2mnak6fh13dkl25lfvw1la2dfjqrh3lq1d40r3a52m56vwflrg";
+    rev = version;
+    repo = "cpp-hocon";
+    owner = "puppetlabs";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  buildInputs = [ boost curl leatherman ];
+
+  meta = with stdenv.lib; {
+    inherit (src.meta) homepage;
+    description = " A C++ port of the Typesafe Config library";
+    license = licenses.asl20;
+    maintainers = [ maintainers.womfoo ];
+    platforms = platforms.linux;
+  };
+
+}
diff --git a/pkgs/development/libraries/fontconfig/default.nix b/pkgs/development/libraries/fontconfig/default.nix
index fa418af5601..550ec2bf5c3 100644
--- a/pkgs/development/libraries/fontconfig/default.nix
+++ b/pkgs/development/libraries/fontconfig/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, fetchpatch, pkgconfig, freetype, expat, libxslt, fontbhttf
+{ stdenv, fetchurl, fetchpatch, pkgconfig, freetype, expat, libxslt, dejavu_fonts
 , substituteAll }:
 
 /** Font configuration scheme
@@ -44,8 +44,8 @@ stdenv.mkDerivation rec {
   configureFlags = [
     "--with-cache-dir=/var/cache/fontconfig" # otherwise the fallback is in $out/
     "--disable-docs"
-    # just ~1MB; this is what you get when loading config fails for some reason
-    "--with-default-fonts=${fontbhttf}"
+    # just <1MB; this is what you get when loading config fails for some reason
+    "--with-default-fonts=${dejavu_fonts.minimal}"
   ];
 
   # We should find a better way to access the arch reliably.
@@ -66,7 +66,7 @@ stdenv.mkDerivation rec {
 
   postInstall = ''
     cd "$out/etc/fonts"
-    "${libxslt.bin}/bin/xsltproc" --stringparam fontDirectories "${fontbhttf}" \
+    "${libxslt.bin}/bin/xsltproc" --stringparam fontDirectories "${dejavu_fonts.minimal}" \
       --stringparam fontconfigConfigVersion "${configVersion}" \
       --path $out/share/xml/fontconfig \
       ${./make-fonts-conf.xsl} $out/etc/fonts/fonts.conf \
diff --git a/pkgs/development/libraries/fontconfig/make-fonts-cache.nix b/pkgs/development/libraries/fontconfig/make-fonts-cache.nix
index b996cd228c7..53c2a335cc0 100644
--- a/pkgs/development/libraries/fontconfig/make-fonts-cache.nix
+++ b/pkgs/development/libraries/fontconfig/make-fonts-cache.nix
@@ -1,4 +1,4 @@
-{ runCommand, lib, writeText, fontconfig, fontbhttf, fontDirectories }:
+{ runCommand, lib, writeText, fontconfig, fontDirectories }:
 
 runCommand "fc-cache"
   rec {
diff --git a/pkgs/development/libraries/fontconfig/make-fonts-conf.nix b/pkgs/development/libraries/fontconfig/make-fonts-conf.nix
index 2d0a21ea9dd..3cd4a894b37 100644
--- a/pkgs/development/libraries/fontconfig/make-fonts-conf.nix
+++ b/pkgs/development/libraries/fontconfig/make-fonts-conf.nix
@@ -1,10 +1,10 @@
-{ runCommand, libxslt, fontconfig, fontbhttf, fontDirectories }:
+{ runCommand, libxslt, fontconfig, dejavu_fonts, fontDirectories }:
 
 runCommand "fonts.conf"
   {
     buildInputs = [ libxslt fontconfig ];
-    # Add a default font for non-nixos systems. fontbhttf is only about 1mb.
-    fontDirectories = fontDirectories ++ [ fontbhttf ];
+    # Add a default font for non-nixos systems, <1MB and in nixos defaults.
+    fontDirectories = fontDirectories ++ [ dejavu_fonts.minimal ];
   }
   ''
     xsltproc --stringparam fontDirectories "$fontDirectories" \
diff --git a/pkgs/development/libraries/java/rhino/default.nix b/pkgs/development/libraries/java/rhino/default.nix
index 37ab6b4f8fd..f106bbe6ebc 100644
--- a/pkgs/development/libraries/java/rhino/default.nix
+++ b/pkgs/development/libraries/java/rhino/default.nix
@@ -20,6 +20,8 @@ stdenv.mkDerivation {
 
   patches = [ ./gcj-type-mismatch.patch ];
 
+  hardeningDisable = [ "fortify" "format" ];
+
   preConfigure =
     ''
       find -name \*.jar -or -name \*.class -exec rm -v {} \;
diff --git a/pkgs/development/libraries/leatherman/default.nix b/pkgs/development/libraries/leatherman/default.nix
index a4b007fa399..bc62a04808f 100644
--- a/pkgs/development/libraries/leatherman/default.nix
+++ b/pkgs/development/libraries/leatherman/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   name = "leatherman-${version}";
-  version = "0.7.5";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
-    sha256 = "103qzhjhgw7jh0xcaxag735wfm6q35xprq5wmdimfhhmmrmjr51g";
+    sha256 = "18nidasykbwdd9qzwc8pnzhczy6acr3rsxwvv2v3j5gq3nbsk2mc";
     rev = version;
     repo = "leatherman";
     owner = "puppetlabs";
@@ -13,10 +13,6 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ boost cmake curl ];
 
-  # curl upgrade to 7.50.0 (#17152) broke the curl mock tests, disabling for now
-  # upstream bug raised https://tickets.puppetlabs.com/browse/LTH-108
-  cmakeFlags = [ "-DLEATHERMAN_MOCK_CURL=OFF" ];
-
   meta = with stdenv.lib; {
     homepage = https://github.com/puppetlabs/leatherman/;  
     description = "A collection of C++ and CMake utility libraries";
diff --git a/pkgs/development/libraries/liborc/default.nix b/pkgs/development/libraries/liborc/default.nix
new file mode 100644
index 00000000000..2b298c97379
--- /dev/null
+++ b/pkgs/development/libraries/liborc/default.nix
@@ -0,0 +1,17 @@
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  name = "liborc-${version}";
+  version = "0.4.16";
+
+  src = fetchurl {
+    url = "http://http.debian.net/debian/pool/main/o/orc/orc_${version}.orig.tar.gz";
+    sha256 = "1asq58gm87ig60ib4cs69hyqhnsirqkdlidnchhx83halbdlw3kh";
+  };
+
+  meta = with stdenv.lib; {
+    homepage = https://packages.debian.org/wheezy/liborc-0.4-0;
+    description = "Orc is a library and set of tools for compiling and executing very simple programs that operate on arrays of data.";
+    license = with licenses; [ bsd2 bsd3 ];
+  };
+}
diff --git a/pkgs/development/libraries/libsoup/default.nix b/pkgs/development/libraries/libsoup/default.nix
index 66cc0720799..707129a16bb 100644
--- a/pkgs/development/libraries/libsoup/default.nix
+++ b/pkgs/development/libraries/libsoup/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchurl, glib, libxml2, pkgconfig
 , gnomeSupport ? true, libgnome_keyring, sqlite, glib_networking, gobjectIntrospection
-, valaSupport ? true, vala_0_23
+, valaSupport ? true, vala_0_32
 , libintlOrEmpty
 , intltool, python }:
 let
@@ -25,7 +25,7 @@ stdenv.mkDerivation {
   outputs = [ "out" "dev" ];
 
   buildInputs = libintlOrEmpty ++ [ intltool python sqlite ]
-    ++ stdenv.lib.optionals valaSupport [ vala_0_23 ];
+    ++ stdenv.lib.optionals valaSupport [ vala_0_32 ];
   nativeBuildInputs = [ pkgconfig ];
   propagatedBuildInputs = [ glib libxml2 gobjectIntrospection ]
     ++ stdenv.lib.optionals gnomeSupport [ libgnome_keyring ];
@@ -33,8 +33,7 @@ stdenv.mkDerivation {
 
   # glib_networking is a runtime dependency, not a compile-time dependency
   configureFlags = "--disable-tls-check"
-    + stdenv.lib.optionalString (!valaSupport) " --enable-vala=no"
-    + stdenv.lib.optionalString (valaSupport) " --enable-vala=yes"
+    + " --enable-vala=${if valaSupport then "yes" else "no"}"
     + stdenv.lib.optionalString (!gnomeSupport) " --without-gnome";
 
   NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isDarwin "-lintl";
diff --git a/pkgs/development/libraries/ucommon/default.nix b/pkgs/development/libraries/ucommon/default.nix
index 50d8f5e8745..4d140932402 100644
--- a/pkgs/development/libraries/ucommon/default.nix
+++ b/pkgs/development/libraries/ucommon/default.nix
@@ -19,6 +19,12 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ pkgconfig ];
 
+  # disable flaky networking test
+  postPatch = ''
+    substituteInPlace test/stream.cpp \
+      --replace 'ifndef UCOMMON_SYSRUNTIME' 'if 0'
+  '';
+
   # ucommon.pc has link time depdendencies on -lssl, -lcrypto, -lz, -lgnutls
   propagatedBuildInputs = [ openssl zlib gnutls ];
 
diff --git a/pkgs/development/ocaml-modules/menhir/generic.nix b/pkgs/development/ocaml-modules/menhir/generic.nix
index 088c2db061b..c182d210049 100644
--- a/pkgs/development/ocaml-modules/menhir/generic.nix
+++ b/pkgs/development/ocaml-modules/menhir/generic.nix
@@ -13,16 +13,14 @@ stdenv.mkDerivation {
   createFindlibDestdir = true;
 
   preBuild = ''
-    #Fix makefiles.
+    # fix makefiles.
     RM=$(type -p rm)
     CHMOD=$(type -p chmod)
-    ENV=$(type -p env)
-    for f in src/Makefile demos/OMakefile* demos/Makefile* demos/ocamldep.wrapper
+    for f in src/Makefile demos/OMakefile* demos/Makefile*
     do
       substituteInPlace $f \
         --replace /bin/rm $RM \
-	--replace /bin/chmod $CHMOD \
-	--replace /usr/bin/env $ENV
+        --replace /bin/chmod $CHMOD
     done
 
     export PREFIX=$out
diff --git a/pkgs/development/tools/build-managers/bear/default.nix b/pkgs/development/tools/build-managers/bear/default.nix
new file mode 100644
index 00000000000..cc34a73ecd5
--- /dev/null
+++ b/pkgs/development/tools/build-managers/bear/default.nix
@@ -0,0 +1,32 @@
+{ stdenv, fetchFromGitHub, cmake, python }:
+
+stdenv.mkDerivation rec {
+  name = "bear-${version}";
+  version = "2.2.0";
+
+  src = fetchFromGitHub {
+    owner = "rizsotto";
+    repo = "Bear";
+    rev = version;
+    sha256 = "08llfqg8y6d7vfwaw5plrk1rrqzs0ywi2ldnlwvy917603971rg0";
+  };
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ python ]; # just for shebang of bin/bear
+
+  doCheck = false; # all fail
+
+  meta = with stdenv.lib; {
+    description = "Tool that generates a compilation database for clang tooling";
+    longDescription = ''
+      Note: the bear command is very useful to generate compilation commands
+      e.g. for YouCompleteMe.  You just enter your development nix-shell
+      and run `bear make`.  It's not perfect, but it gets a long way.
+    '';
+    homepage = https://github.com/rizsotto/Bear;
+    license = licenses.gpl3Plus;
+    platforms = platforms.unix;
+    maintainers = [ maintainers.vcunat ];
+  };
+}
+
diff --git a/pkgs/development/tools/misc/indent/default.nix b/pkgs/development/tools/misc/indent/default.nix
index 594bef7e16a..996043c16d8 100644
--- a/pkgs/development/tools/misc/indent/default.nix
+++ b/pkgs/development/tools/misc/indent/default.nix
@@ -12,6 +12,8 @@ stdenv.mkDerivation rec {
     sed -i 's|#include <malloc.h>|#include <malloc/malloc.h>|' ./man/texinfo2man.c
   '';
 
+  hardeningDisable = [ "format" ];
+
   meta = {
     homepage = https://www.gnu.org/software/indent/;
     description = "A source code reformatter";
diff --git a/pkgs/development/tools/rtags/default.nix b/pkgs/development/tools/rtags/default.nix
index 06ab4ffed3c..959681c7e1a 100644
--- a/pkgs/development/tools/rtags/default.nix
+++ b/pkgs/development/tools/rtags/default.nix
@@ -2,8 +2,7 @@
 
 stdenv.mkDerivation rec {
   name = "rtags-${version}";
-  version = "git-2016-04-29";
-  rev = "233543d343bf86fa31c35ee21242fa2da3a965ab";
+  version = "2.3";
 
   buildInputs = [ cmake llvmPackages.llvm openssl llvmPackages.clang emacs ];
 
@@ -13,10 +12,10 @@ stdenv.mkDerivation rec {
   '';
 
   src = fetchgit {
-    inherit rev;
+    rev = "refs/tags/v${version}";
     fetchSubmodules = true;
     url = "https://github.com/andersbakken/rtags.git";
-    sha256 = "10j1s7kvnd5823p1kgx3hyca9jz9j27y6xk0q208p095wf8hk105";
+    sha256 = "05kzch88x2wiimygfli6vsr9i5hzgkybsya8qx4zvb6daip4b7yf";
   };
 
   meta = {
diff --git a/pkgs/misc/vim-plugins/default.nix b/pkgs/misc/vim-plugins/default.nix
index 6a49103a2f7..67ea56be847 100644
--- a/pkgs/misc/vim-plugins/default.nix
+++ b/pkgs/misc/vim-plugins/default.nix
@@ -13,7 +13,8 @@ in
 
 # TL;DR
 # Add your plugin to ./vim-plugin-names
-# Generate via `vim-plugin-names-to-nix`
+# Regenerate via `nix-build -Q -A vimPlugins.pluginnames2nix; ./result/bin/vim-plugin-names-to-nix`
+# Copy the generated expression(s) into this file.
 # If plugin is complicated then make changes to ./vim2nix/additional-nix-code
 
 # This attrs contains two sections:
@@ -885,6 +886,17 @@ rec {
 
   };
 
+  vim-indent-guides = buildVimPluginFrom2Nix { # created by nix#NixDerivation
+    name = "vim-indent-guides-2016-04-17";
+    src = fetchgit {
+      url = "git://github.com/nathanaelkane/vim-indent-guides";
+      rev = "018298ead9d3aa9cd3b4ae222f81022a33978b09";
+      sha256 = "0zyrs9r3vza2kqhqir6qpkygy6yljpn877bvycspv89ljzczmwrs";
+    };
+    dependencies = [];
+
+  };
+
   vim-stylish-haskell = buildVimPluginFrom2Nix { # created by nix#NixDerivation
     name = "vim-stylish-haskell-2015-05-10";
     src = fetchgit {
diff --git a/pkgs/misc/vim-plugins/vim-plugin-names b/pkgs/misc/vim-plugins/vim-plugin-names
index 8f09ea935ed..6cef8885ce0 100644
--- a/pkgs/misc/vim-plugins/vim-plugin-names
+++ b/pkgs/misc/vim-plugins/vim-plugin-names
@@ -68,6 +68,7 @@
 "github:mhinz/vim-startify"
 "github:mkasa/lushtags"
 "github:mpickering/hlint-refactor-vim"
+"github:nathanaelkane/vim-indent-guides"
 "github:nbouscal/vim-stylish-haskell"
 "github:neovimhaskell/haskell-vim"
 "github:osyo-manga/shabadou.vim"
diff --git a/pkgs/os-specific/linux/batman-adv/default.nix b/pkgs/os-specific/linux/batman-adv/default.nix
index 627cb8794af..65fcd07a6e0 100644
--- a/pkgs/os-specific/linux/batman-adv/default.nix
+++ b/pkgs/os-specific/linux/batman-adv/default.nix
@@ -26,5 +26,6 @@ stdenv.mkDerivation rec {
     license = stdenv.lib.licenses.gpl2;
     maintainers = with stdenv.lib.maintainers; [ viric fpletz ];
     platforms = with stdenv.lib.platforms; linux;
+    broken = (kernel.features.grsecurity or false);
   };
 }
diff --git a/pkgs/os-specific/linux/forkstat/default.nix b/pkgs/os-specific/linux/forkstat/default.nix
index 3a253003e8e..a0478af912c 100644
--- a/pkgs/os-specific/linux/forkstat/default.nix
+++ b/pkgs/os-specific/linux/forkstat/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   name = "forkstat-${version}";
-  version = "0.01.13";
+  version = "0.01.14";
   src = fetchurl {
     url = "http://kernel.ubuntu.com/~cking/tarballs/forkstat/forkstat-${version}.tar.gz";
-    sha256 = "12dmqpv0q3x166sya93rhcj7vs4868x7y7lwfwv9l54hhirpamhq";
+    sha256 = "0yj3mhf9b2nm8fnz4vf2fqdd8417g30p2sgv3ilq3zwy4hbg9bav";
   };
   installFlags = [ "DESTDIR=$(out)" ];
   postInstall = ''
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index e8d52cc240f..95b1319e981 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -35,9 +35,7 @@ with stdenv.lib;
   DEBUG_DEVRES n
   DEBUG_NX_TEST n
   DEBUG_STACK_USAGE n
-  ${optionalString (!(features.grsecurity or false)) ''
-    DEBUG_STACKOVERFLOW n
-  ''}
+  DEBUG_STACKOVERFLOW n
   RCU_TORTURE_TEST n
   SCHEDSTATS n
   DETECT_HUNG_TASK y
diff --git a/pkgs/os-specific/linux/kernel/patches.nix b/pkgs/os-specific/linux/kernel/patches.nix
index 1b4a83cb114..2a74f9063bf 100644
--- a/pkgs/os-specific/linux/kernel/patches.nix
+++ b/pkgs/os-specific/linux/kernel/patches.nix
@@ -31,6 +31,8 @@ let
       url = "https://raw.githubusercontent.com/slashbeast/grsecurity-scrape/master/${grbranch}/${name}.patch";
       inherit sha256;
     };
+
+    features.grsecurity = true;
   };
 in
 
diff --git a/pkgs/os-specific/linux/lttng-modules/default.nix b/pkgs/os-specific/linux/lttng-modules/default.nix
index eeef64c7083..10551c08077 100644
--- a/pkgs/os-specific/linux/lttng-modules/default.nix
+++ b/pkgs/os-specific/linux/lttng-modules/default.nix
@@ -3,11 +3,11 @@
 stdenv.mkDerivation rec {
   pname = "lttng-modules-${version}";
   name = "${pname}-${kernel.version}";
-  version = "2.6.3";
+  version = "2.8.0";
 
   src = fetchurl {
     url = "http://lttng.org/files/lttng-modules/lttng-modules-${version}.tar.bz2";
-    sha256 = "0sk7cyjf5ylmxqrrrz5zmmw4c0dmxh1f98aj870gmcnxfa76y4mx";
+    sha256 = "0a9xwq0kgpx1y800l232h524f19g3py6cnxff10j9p01q6lzhrxh";
   };
 
   hardeningDisable = [ "pic" ];
diff --git a/pkgs/os-specific/linux/musl/default.nix b/pkgs/os-specific/linux/musl/default.nix
index a8055df92fd..ae0c7703de6 100644
--- a/pkgs/os-specific/linux/musl/default.nix
+++ b/pkgs/os-specific/linux/musl/default.nix
@@ -11,6 +11,10 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  # required to avoid busybox segfaulting on startup when invoking
+  # nix-build "<nixpkgs/pkgs/stdenv/linux/make-bootstrap-tools.nix>"
+  hardeningDisable = [ "stackprotector" ];
+
   preConfigure = ''
     configureFlagsArray+=("--syslibdir=$out/lib")
   '';
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index 83e6588c91d..b9ba8f54325 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -28,6 +28,10 @@ in
     buildInputs = attrs.buildInputs ++ [ xorg.mkfontscale ];
   };
 
+  fontbhttf = attrs: attrs // {
+    meta = attrs.meta // { license = lib.licenses.unfreeRedistributable; };
+  };
+
   fontcursormisc = attrs: attrs // {
     buildInputs = attrs.buildInputs ++ [ xorg.mkfontscale ];
   };
@@ -541,6 +545,17 @@ in
     nativeBuildInputs = [args.autoreconfHook xorg.utilmacros];
   };
 
+  xf86videoxgi = attrs: attrs // {
+    patches = [
+      # fixes invalid open mode
+      # https://cgit.freedesktop.org/xorg/driver/xf86-video-xgi/commit/?id=bd94c475035739b42294477cff108e0c5f15ef67
+      (args.fetchpatch {
+        url = "https://cgit.freedesktop.org/xorg/driver/xf86-video-xgi/patch/?id=bd94c475035739b42294477cff108e0c5f15ef67";
+        sha256 = "0myfry07655adhrpypa9rqigd6rfx57pqagcwibxw7ab3wjay9f6";
+      })
+    ];
+  };
+
   xwd = attrs: attrs // {
     buildInputs = with xorg; attrs.buildInputs ++ [libXt libxkbfile];
   };
diff --git a/pkgs/servers/x11/xquartz/default.nix b/pkgs/servers/x11/xquartz/default.nix
index 79b99faea9b..9b7844960a2 100644
--- a/pkgs/servers/x11/xquartz/default.nix
+++ b/pkgs/servers/x11/xquartz/default.nix
@@ -60,7 +60,6 @@ let
     sudo launchctl load -w /Library/LaunchDaemons/$daemonName
   '';
   fontDirs = [
-    xorg.fontbhttf
     xorg.fontbhlucidatypewriter100dpi
     xorg.fontbhlucidatypewriter75dpi
     ttf_bitstream_vera
diff --git a/pkgs/stdenv/darwin/make-bootstrap-tools.nix b/pkgs/stdenv/darwin/make-bootstrap-tools.nix
index 7bd9a095a85..41c94bd1674 100644
--- a/pkgs/stdenv/darwin/make-bootstrap-tools.nix
+++ b/pkgs/stdenv/darwin/make-bootstrap-tools.nix
@@ -2,9 +2,7 @@
 
 with import ../../.. { inherit system; };
 
-let
-  llvmPackages = llvmPackages_38;
-in rec {
+rec {
   coreutils_ = coreutils.override (args: {
     # We want coreutils without ACL support.
     aclSupport = false;
@@ -80,11 +78,11 @@ in rec {
 
       cp -rL ${llvmPackages.clang-unwrapped}/lib/clang $out/lib
 
-      cp -d ${llvmPackages.libcxx}/lib/libc++*.dylib $out/lib
-      cp -d ${llvmPackages.libcxxabi}/lib/libc++abi*.dylib $out/lib
+      cp -d ${libcxx}/lib/libc++*.dylib $out/lib
+      cp -d ${libcxxabi}/lib/libc++abi*.dylib $out/lib
 
       mkdir $out/include
-      cp -rd ${llvmPackages.libcxx}/include/c++     $out/include
+      cp -rd ${libcxx}/include/c++     $out/include
 
       cp -d ${icu.out}/lib/libicu*.dylib $out/lib
       cp -d ${zlib.out}/lib/libz.*       $out/lib
diff --git a/pkgs/tools/graphics/lprof/default.nix b/pkgs/tools/graphics/lprof/default.nix
index 7f6a15da33d..cbce8bb61f7 100644
--- a/pkgs/tools/graphics/lprof/default.nix
+++ b/pkgs/tools/graphics/lprof/default.nix
@@ -30,6 +30,7 @@ stdenv.mkDerivation {
      -e "s/not config.CheckHeader('tiff.h')/False/" \
      -e "s/not config.CheckCXXHeader('vigra\/impex.hxx')/False/" \
      \
+     -e "s/^\(      'LDFLAGS'.*\)/\1\n,'hardeningDisable' : os.environ['hardeningDisable']/" \
      -e "s/^\(      'LDFLAGS'.*\)/\1\n,'NIX_CFLAGS_COMPILE' : os.environ['NIX_CFLAGS_COMPILE']/" \
      -e "s/^\(      'LDFLAGS'.*\)/\1\n,'NIX_LDFLAGS' : os.environ['NIX_LDFLAGS']/"
 
diff --git a/pkgs/tools/misc/fontforge/default.nix b/pkgs/tools/misc/fontforge/default.nix
index c04b9255afc..54551b5af39 100644
--- a/pkgs/tools/misc/fontforge/default.nix
+++ b/pkgs/tools/misc/fontforge/default.nix
@@ -29,9 +29,8 @@ stdenv.mkDerivation rec {
   buildInputs = [
     git autoconf automake gnum4 libtool perl pkgconfig gettext uthash
     python freetype zlib glib libungif libpng libjpeg libtiff libxml2
-    pango
   ]
-    ++ lib.optionals withGTK [ gtk2 ]
+    ++ lib.optionals withGTK [ gtk2 pango ]
     ++ lib.optionals (withGTK && stdenv.isDarwin) [ Carbon Cocoa ];
 
   configureFlags =
diff --git a/pkgs/tools/system/facter/default.nix b/pkgs/tools/system/facter/default.nix
index 0ebfe36f59d..83936ca65a5 100644
--- a/pkgs/tools/system/facter/default.nix
+++ b/pkgs/tools/system/facter/default.nix
@@ -1,11 +1,11 @@
-{ stdenv, fetchurl, boost, cmake, curl, leatherman, libyamlcpp, openssl, ruby, utillinux }:
+{ stdenv, fetchurl, boost, cmake, cpp-hocon, curl, leatherman, libyamlcpp, openssl, ruby, utillinux }:
 
 stdenv.mkDerivation rec {
   name = "facter-${version}";
-  version = "3.1.8";
+  version = "3.4.1";
   src = fetchurl {
     url = "https://downloads.puppetlabs.com/facter/${name}.tar.gz";
-    sha256 = "1fhfjf5bm5kyjiady14fxhpp7hdrkgx56vsvdbqj82km0xqcxpj9";
+    sha256 = "1vvvqni68l3hmnxi8jp0n2rwzxyh1vmgv6xa2954h94dfax6dmcj";
   };
 
   cmakeFlags = [ "-DFACTER_RUBY=${ruby}/lib/libruby.so" ];
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   # since we cant expand $out in cmakeFlags
   preConfigure = "cmakeFlags+=\" -DRUBY_LIB_INSTALL=$out/lib/ruby\"";
 
-  buildInputs = [ boost cmake curl leatherman libyamlcpp openssl ruby utillinux ];
+  buildInputs = [ boost cmake cpp-hocon curl leatherman libyamlcpp openssl ruby utillinux ];
 
   meta = with stdenv.lib; {
     homepage = https://github.com/puppetlabs/facter;
diff --git a/pkgs/tools/system/runit/default.nix b/pkgs/tools/system/runit/default.nix
index 87cf720b981..54899cb14df 100644
--- a/pkgs/tools/system/runit/default.nix
+++ b/pkgs/tools/system/runit/default.nix
@@ -1,4 +1,6 @@
-{ stdenv, fetchurl }:
+{ stdenv, fetchurl
+, static ? false
+}:
 
 stdenv.mkDerivation rec {
   name = "runit-${version}";
@@ -15,7 +17,9 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  postPatch = ''
+  buildInputs = stdenv.lib.optionals static [ stdenv.cc.libc stdenv.cc.libc.static ];
+
+  postPatch = stdenv.lib.optionalString (!static) ''
     sed -i 's,-static,,g' src/Makefile
   '';
 
diff --git a/pkgs/tools/typesetting/kindlegen/default.nix b/pkgs/tools/typesetting/kindlegen/default.nix
new file mode 100644
index 00000000000..159119a8a71
--- /dev/null
+++ b/pkgs/tools/typesetting/kindlegen/default.nix
@@ -0,0 +1,48 @@
+{ fetchurl, stdenv }:
+
+let
+  version = "2.9";
+  fileVersion = builtins.replaceStrings [ "." ] [ "_" ] version;
+
+  sha256 = {
+    "x86_64-linux"  = "15i20kzhdcmi94w7wfhqbl6j20v47cdakjm2mn3x8w495iddna4q";
+    "i686-linux"    = "15i20kzhdcmi94w7wfhqbl6j20v47cdakjm2mn3x8w495iddna4q";
+    "x86_64-darwin" = "0zniyn0s41fxqrajbgwxbcsj5vzf9m7a6yvdz2b11mphr00kpbbs";
+    "i686-darwin"   = "0zniyn0s41fxqrajbgwxbcsj5vzf9m7a6yvdz2b11mphr00kpbbs";
+    "x86_64-cygwin" = "02slfh1bbpijay4skj85cjiv7z43ha8vm5aa1lwiqjk86qbl1f3h";
+    "i686-cygwin"   = "02slfh1bbpijay4skj85cjiv7z43ha8vm5aa1lwiqjk86qbl1f3h";
+  }."${stdenv.system}" or (throw "system #{stdenv.system.} is not supported");
+
+  url = {
+    "x86_64-linux"  = "http://kindlegen.s3.amazonaws.com/kindlegen_linux_2.6_i386_v${fileVersion}.tar.gz";
+    "i686-linux"    = "http://kindlegen.s3.amazonaws.com/kindlegen_linux_2.6_i386_v${fileVersion}.tar.gz";
+    "x86_64-darwin" = "http://kindlegen.s3.amazonaws.com/KindleGen_Mac_i386_v${fileVersion}.zip";
+    "i686-darwin"   = "http://kindlegen.s3.amazonaws.com/KindleGen_Mac_i386_v${fileVersion}.zip";
+    "x86_64-cygwin" = "http://kindlegen.s3.amazonaws.com/kindlegen_win32_v${fileVersion}.zip";
+    "i686-cygwin"   = "http://kindlegen.s3.amazonaws.com/kindlegen_win32_v${fileVersion}.zip";
+  }."${stdenv.system}" or (throw "system #{stdenv.system.} is not supported");
+
+in stdenv.mkDerivation rec {
+  name = "kindlegen-${version}";
+
+  src = fetchurl {
+    inherit url;
+    inherit sha256;
+  };
+
+  sourceRoot = ".";
+
+  installPhase = ''
+    mkdir -p $out/bin $out/share/kindlegen/doc
+    install -m755 kindlegen $out/bin/kindlegen
+    cp -r *.txt *.html docs/* $out/share/kindlegen/doc
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Convert documents to .mobi for use with Amazon Kindle";
+    homepage = https://www.amazon.com/gp/feature.html?docId=1000765211;
+    license = licenses.unfree;
+    maintainers = with maintainers; [ peterhoeg ];
+    platforms = [ "x86_64-linux" "i686-linux" "x86_64-darwin" "i686-darwin" "x86_64-cygwin" "i686-cygwin" ];
+  };
+}
diff --git a/pkgs/tools/typesetting/pdftk/default.nix b/pkgs/tools/typesetting/pdftk/default.nix
index 84a853bb0df..73bf0b9e128 100644
--- a/pkgs/tools/typesetting/pdftk/default.nix
+++ b/pkgs/tools/typesetting/pdftk/default.nix
@@ -10,6 +10,8 @@ stdenv.mkDerivation {
 
   buildInputs = [ gcj unzip ];
 
+  hardeningDisable = [ "fortify" "format" ];
+
   preBuild = ''
     cd pdftk
     sed -e 's@/usr/bin/@@g' -i Makefile.*
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 61a3c0abcc6..ca4ab18864e 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2376,6 +2376,8 @@ in
 
   npm2nix = nodePackages.npm2nix;
 
+  kindlegen = callPackage ../tools/typesetting/kindlegen { };
+
   ldapvi = callPackage ../tools/misc/ldapvi { };
 
   ldns = callPackage ../development/libraries/ldns { };
@@ -4725,14 +4727,10 @@ in
 
   dotnetPackages = recurseIntoAttrs (callPackage ./dotnet-packages.nix {});
 
-  go_1_4 = callPackage ../development/compilers/go/1.4.nix {
+  go_bootstrap = callPackage ../development/compilers/go/1.4.nix {
     inherit (darwin.apple_sdk.frameworks) Security;
   };
 
-  go_1_5 = callPackage ../development/compilers/go/1.5.nix {
-    inherit (darwin.apple_sdk.frameworks) Security Foundation;
-  };
-
   go_1_6 = callPackage ../development/compilers/go/1.6.nix {
     inherit (darwin.apple_sdk.frameworks) Security Foundation;
   };
@@ -6147,6 +6145,8 @@ in
 
   bazel = callPackage ../development/tools/build-managers/bazel { jdk = openjdk8; };
 
+  bear = callPackage ../development/tools/build-managers/bear { };
+
   bin_replace_string = callPackage ../development/tools/misc/bin_replace_string { };
 
   binutils = if stdenv.isDarwin then self.darwin.binutils else self.binutils-raw;
@@ -6424,7 +6424,7 @@ in
   gnumake = self.gnumake42;
 
   gnustep = recurseIntoAttrs (callPackage ../desktops/gnustep {});
-  
+
   gob2 = callPackage ../development/tools/misc/gob2 { };
 
   gocd-agent = callPackage ../development/tools/continuous-integration/gocd-agent { };
@@ -6537,7 +6537,7 @@ in
     licenseAccepted = (config.neoload.accept_license or false);
     fontsConf = makeFontsConf {
       fontDirectories = [
-        xorg.fontbhttf
+        dejavu_fonts.minimal
       ];
     };
   };
@@ -7051,6 +7051,8 @@ in
 
   cppdb = callPackage ../development/libraries/cppdb { };
 
+  cpp-hocon = callPackage ../development/libraries/cpp-hocon { };
+
   cpp-netlib = callPackage ../development/libraries/cpp-netlib { };
 
   cppcms = callPackage ../development/libraries/cppcms { };
@@ -8397,6 +8399,8 @@ in
 
   libopus = callPackage ../development/libraries/libopus { };
 
+  liborc = callPackage ../development/libraries/liborc { };
+
   libosinfo = callPackage ../development/libraries/libosinfo {
     inherit (gnome3) libsoup;
   };
@@ -9974,14 +9978,6 @@ in
 
   ### DEVELOPMENT / GO MODULES
 
-  buildGo14Package = callPackage ../development/go-modules/generic {
-    go = go_1_4;
-  };
-
-  buildGo15Package = callPackage ../development/go-modules/generic {
-    go = go_1_5;
-  };
-
   buildGo16Package = callPackage ../development/go-modules/generic {
     go = go_1_6;
   };
@@ -10472,7 +10468,7 @@ in
 
   influxdb = (callPackage ../servers/nosql/influxdb/v0.nix { }).bin // { outputs = [ "bin" ]; };
 
-  influxdb10 = (callPackage ../servers/nosql/influxdb/v1.nix { }).bin // { outputs = [ "bin" ]; }; 
+  influxdb10 = (callPackage ../servers/nosql/influxdb/v1.nix { }).bin // { outputs = [ "bin" ]; };
 
   hyperdex = callPackage ../servers/nosql/hyperdex { };
 
@@ -11402,50 +11398,6 @@ in
     '';
   };
 
-  # grsecurity: legacy
-
-  grsecurity_base_linux_3_14 = throw "grsecurity stable is no longer supported";
-  grsecurity_base_linux_4_4  = throw "grsecurity stable is no longer supported";
-
-  linuxPackages_grsec_desktop_3_14    = throw "linuxPackages_grsec_desktop has been removed";
-  linuxPackages_grsec_desktop_4_4    = throw "linuxPackages_grsec_desktop has been removed";
-  linuxPackages_grsec_desktop_4_5    = throw "linuxPackages_grsec_desktop has been removed";
-  linuxPackages_grsec_desktop_latest    = throw "linuxPackages_grsec_desktop has been removed";
-
-  linuxPackages_grsec_server_3_14     = throw "linuxPackages_grsec_server has been removed";
-  linuxPackages_grsec_server_4_4     = throw "linuxPackages_grsec_server has been removed";
-  linuxPackages_grsec_server_4_5     = throw "linuxPackages_grsec_server has been removed";
-  linuxPackages_grsec_server_latest     = throw "linuxPackages_grsec_server has been removed";
-
-  linuxPackages_grsec_server_xen_3_14 = throw "linuxPackages_grsec_server_xen has been removed";
-  linuxPackages_grsec_server_xen_4_4 = throw "linuxPackages_grsec_server_xen has been removed";
-  linuxPackages_grsec_server_xen_4_5 = throw "linuxPackages_grsec_server_xen has been removed";
-  linuxPackages_grsec_server_xen_latest = throw "linuxPackages_grsec_server_xen has been removed";
-
-  linux_grsec_desktop_3_14    = throw "grsecurity stable is no longer supported";
-  linux_grsec_desktop_4_4    = throw "grsecurity stable is no longer supported";
-  linux_grsec_desktop_4_5    = throw "linux_grsec_desktop has been removed";
-  linux_grsec_desktop_latest    = throw "linux_grsec_desktop has been removed";
-
-  linux_grsec_server_3_14     = throw "grsecurity stable is no longer supported";
-  linux_grsec_server_4_4     = throw "grsecurity stable is no longer supported";
-  linux_grsec_server_4_5     = throw "linux_grsec_server has been removed";
-  linux_grsec_server_latest     = throw "linux_grsec_server_latest has been removed";
-
-  linux_grsec_server_xen_3_14 = throw "grsecurity stable is no longer supported";
-  linux_grsec_server_xen_4_4 = throw "grsecurity stable is no longer supported";
-  linux_grsec_server_xen_4_5 = throw "linux_grsec_server_xen has been removed";
-  linux_grsec_server_xen_latest = throw "linux_grsec_server_xen has been removed";
-
-  linux_grsec_stable_desktop    = self.linux_grsec_desktop_3_14;
-  linux_grsec_stable_server     = self.linux_grsec_server_3_14;
-  linux_grsec_stable_server_xen = self.linux_grsec_server_xen_3_14;
-
-  linux_grsec_testing_desktop    = self.linux_grsec_desktop_latest;
-  linux_grsec_testing_server     = self.linux_grsec_server_latest;
-  linux_grsec_testing_server_xen = self.linux_grsec_server_xen_latest;
-
-
   # ChromiumOS kernels
   linuxPackages_chromiumos_3_14 = recurseIntoAttrs (self.linuxPackagesFor self.linux_chromiumos_3_14 linuxPackages_chromiumos_3_14);
   linuxPackages_chromiumos_3_18 = recurseIntoAttrs (self.linuxPackagesFor self.linux_chromiumos_3_18 linuxPackages_chromiumos_3_18);
@@ -13774,7 +13726,7 @@ in
     bluez5 = bluez5_28;
     fontsConf = makeFontsConf {
       fontDirectories = [
-        freefont_ttf xorg.fontmiscmisc xorg.fontbhttf
+        freefont_ttf xorg.fontmiscmisc
       ];
     };
     clucene_core = clucene_core_2;
@@ -13793,7 +13745,7 @@ in
     bluez5 = bluez5_28;
     fontsConf = makeFontsConf {
       fontDirectories = [
-        freefont_ttf xorg.fontmiscmisc xorg.fontbhttf
+        freefont_ttf xorg.fontmiscmisc
       ];
     };
     mdds = mdds_0_12_1;
@@ -13858,7 +13810,6 @@ in
   lxdvdrip = callPackage ../applications/video/lxdvdrip { };
 
   handbrake = callPackage ../applications/video/handbrake {
-    webkitgtk = webkitgtk24x;
     ffmpeg = ffmpeg_2;
   };