Merge remote-tracking branch 'upstream/master' into hardened-stdenv

author: Robin Gloster <mail@glob.in> 2016-08-02 13:46:36 +0000
committer: Robin Gloster <mail@glob.in> 2016-08-02 13:46:36 +0000
commit: 1be4907ca203805ad3f2f38a5cdcf4041ee9ad4a (patch)
tree: 744227983cb23911bae2c1269d927b72408ff8b8
parent: 63c7b4f9a7844f0bc84d008b810375eb0fba6b2f (diff)
parent: 450c866730df749ad928f3e70855ef7231c05a71 (diff)
download: nixlib-1be4907ca203805ad3f2f38a5cdcf4041ee9ad4a.tar
nixlib-1be4907ca203805ad3f2f38a5cdcf4041ee9ad4a.tar.gz
nixlib-1be4907ca203805ad3f2f38a5cdcf4041ee9ad4a.tar.bz2
nixlib-1be4907ca203805ad3f2f38a5cdcf4041ee9ad4a.tar.lz
nixlib-1be4907ca203805ad3f2f38a5cdcf4041ee9ad4a.tar.xz
nixlib-1be4907ca203805ad3f2f38a5cdcf4041ee9ad4a.tar.zst
nixlib-1be4907ca203805ad3f2f38a5cdcf4041ee9ad4a.zip
107 files changed, 1434 insertions, 779 deletions
diff --git a/lib/sources.nix b/lib/sources.nix
index 535b04523b57..c1ec02b9c26c 100644
--- a/lib/sources.nix
+++ b/lib/sources.nix
@@ -44,12 +44,12 @@ rec {
             packedRefsName = toString path + "/packed-refs";
         in if lib.pathExists fileName
            then
-             let fileContent = readFile fileName;
+             let fileContent = lib.fileContents fileName;
                  # Sometimes git stores the commitId directly in the file but
                  # sometimes it stores something like: «ref: refs/heads/branch-name»
-                 matchRef    = match "^ref: (.*)\n$" fileContent;
+                 matchRef    = match "^ref: (.*)$" fileContent;
              in if   isNull matchRef
-                then lib.removeSuffix "\n" fileContent
+                then fileContent
                 else readCommitFromFile path (lib.head matchRef)
            # Sometimes, the file isn't there at all and has been packed away in the
            # packed-refs file, so we have to grep through it:
diff --git a/lib/strings.nix b/lib/strings.nix
index 5e5f7b378667..daf845839343 100644
--- a/lib/strings.nix
+++ b/lib/strings.nix
@@ -479,4 +479,14 @@ rec {
       absolutePaths = builtins.map (path: builtins.toPath (root + "/" + path)) relativePaths;
     in
       absolutePaths;
+
+  /* Read the contents of a file removing the trailing \n
+
+     Example:
+       $ echo "1.0" > ./version
+
+       fileContents ./version
+       => "1.0"
+  */
+  fileContents = file: removeSuffix "\n" (builtins.readFile file);
 }
diff --git a/lib/trivial.nix b/lib/trivial.nix
index 9821e3c138dd..f85c74ab88e3 100644
--- a/lib/trivial.nix
+++ b/lib/trivial.nix
@@ -62,11 +62,13 @@ rec {
     isInt add sub lessThan
     seq deepSeq genericClosure;
 
+  inherit (import ./strings.nix) fileContents;
+
   # Return the Nixpkgs version number.
   nixpkgsVersion =
     let suffixFile = ../.version-suffix; in
-    readFile ../.version
-    + (if pathExists suffixFile then readFile suffixFile else "pre-git");
+    fileContents ../.version
+    + (if pathExists suffixFile then fileContents suffixFile else "pre-git");
 
   # Whether we're being called by nix-shell.
   inNixShell = builtins.getEnv "IN_NIX_SHELL" == "1";
diff --git a/nixos/doc/manual/default.nix b/nixos/doc/manual/default.nix
index 83dad5fd8dc7..1bec0d925222 100644
--- a/nixos/doc/manual/default.nix
+++ b/nixos/doc/manual/default.nix
@@ -122,7 +122,7 @@ let
       <targetset>
         <targetsetinfo>
             Allows for cross-referencing olinks between the manpages
-            and the HTML/PDF manuals.
+            and manual.
         </targetsetinfo>
 
         <document targetdoc="manual">&manualtargets;</document>
@@ -221,34 +221,14 @@ in rec {
       mkdir -p $dst/epub/OEBPS/images/callouts
       cp -r ${docbook5_xsl}/xml/xsl/docbook/images/callouts/*.gif $dst/epub/OEBPS/images/callouts
       echo "application/epub+zip" > mimetype
-      zip -0Xq  "$dst/NixOS Manual - NixOS community.epub" mimetype
-      zip -Xr9D "$dst/NixOS Manual - NixOS community.epub" $dst/epub/*
+      manual="$dst/nixos-manual.epub"
+      zip -0Xq "$manual" mimetype
+      cd $dst/epub && zip -Xr9D "$manual" *
 
-      mkdir -p $out/nix-support
-      echo "doc-epub manual $dst/NixOS Manual - NixOS community.epub" >> $out/nix-support/hydra-build-products
-    '';
-  };
-
-
-  manualPDF = stdenv.mkDerivation {
-    name = "nixos-manual-pdf";
-
-    inherit sources;
-
-    buildInputs = [ libxml2 libxslt dblatex dblatex.tex ];
-
-    buildCommand = ''
-      ${copySources}
-
-      dst=$out/share/doc/nixos
-      mkdir -p $dst
-      xmllint --xinclude manual.xml | dblatex -o $dst/manual.pdf - \
-        -P target.database.document="${olinkDB}/olinkdb.xml" \
-        -P doc.collab.show=0 \
-        -P latex.output.revhistory=0
+      rm -rf $dst/epub
 
       mkdir -p $out/nix-support
-      echo "doc-pdf manual $dst/manual.pdf" >> $out/nix-support/hydra-build-products
+      echo "doc-epub manual $manual" >> $out/nix-support/hydra-build-products
     '';
   };
 
diff --git a/nixos/doc/manual/release-notes/rl-1609.xml b/nixos/doc/manual/release-notes/rl-1609.xml
index 0bea6cbbf2dd..8dbf03ee42b4 100644
--- a/nixos/doc/manual/release-notes/rl-1609.xml
+++ b/nixos/doc/manual/release-notes/rl-1609.xml
@@ -33,12 +33,19 @@ has the following highlights: </para>
 following incompatible changes:</para>
 
 <itemizedlist>
+
   <listitem>
     <para>Shell aliases for systemd sub-commands
     <link xlink:href="https://github.com/NixOS/nixpkgs/pull/15598">were dropped</link>:
     <command>start</command>, <command>stop</command>,
     <command>restart</command>, <command>status</command>.</para>
   </listitem>
+
+  <listitem>
+    <para>Redis now binds to 127.0.0.1 only instead of listening to all network interfaces. This is the default 
+    behavior of Redis 3.2</para>
+  </listitem>
+
 </itemizedlist>
 
 
diff --git a/nixos/modules/misc/version.nix b/nixos/modules/misc/version.nix
index 9a37f5950930..6af310a9d877 100644
--- a/nixos/modules/misc/version.nix
+++ b/nixos/modules/misc/version.nix
@@ -35,57 +35,42 @@ in
     nixosLabel = mkOption {
       type = types.str;
       description = ''
-        NixOS version name to be used in the names of generated
-        outputs and boot labels.
-
-        If you ever wanted to influence the labels in your GRUB menu,
-        this is option is for you.
-
-        Can be set directly or with <envar>NIXOS_LABEL</envar>
-        environment variable for <command>nixos-rebuild</command>,
-        e.g.:
-
-        <screen>
-        #!/bin/sh
-        today=`date +%Y%m%d`
-        branch=`(cd nixpkgs ; git branch 2>/dev/null | sed -n '/^\* / { s|^\* ||; p; }')`
-        revision=`(cd nixpkgs ; git rev-parse HEAD)`
-        export NIXOS_LABEL="$today.$branch-''${revision:0:7}"
-        nixos-rebuild switch</screen>
+        Label to be used in the names of generated outputs and boot
+        labels.
       '';
     };
 
     nixosVersion = mkOption {
       internal = true;
       type = types.str;
-      description = "NixOS version.";
+      description = "The full NixOS version (e.g. <literal>16.03.1160.f2d4ee1</literal>).";
     };
 
     nixosRelease = mkOption {
       readOnly = true;
       type = types.str;
-      default = readFile releaseFile;
-      description = "NixOS release.";
+      default = fileContents releaseFile;
+      description = "The NixOS release (e.g. <literal>16.03</literal>).";
     };
 
     nixosVersionSuffix = mkOption {
       internal = true;
       type = types.str;
-      default = if pathExists suffixFile then readFile suffixFile else "pre-git";
-      description = "NixOS version suffix.";
+      default = if pathExists suffixFile then fileContents suffixFile else "pre-git";
+      description = "The NixOS version suffix (e.g. <literal>1160.f2d4ee1</literal>).";
     };
 
     nixosRevision = mkOption {
       internal = true;
       type = types.str;
-      default = if pathExists revisionFile then readFile revisionFile else "master";
-      description = "NixOS Git revision hash.";
+      default = if pathExists revisionFile then fileContents revisionFile else "master";
+      description = "The Git revision from which this NixOS configuration was built.";
     };
 
     nixosCodeName = mkOption {
       readOnly = true;
       type = types.str;
-      description = "NixOS release code name.";
+      description = "The NixOS release code name (e.g. <literal>Emu</literal>).";
     };
 
     defaultChannel = mkOption {
@@ -102,8 +87,8 @@ in
     system = {
       # These defaults are set here rather than up there so that
       # changing them would not rebuild the manual
-      nixosLabel   = mkDefault (maybeEnv "NIXOS_LABEL" cfg.nixosVersion);
-      nixosVersion = mkDefault (maybeEnv "NIXOS_VERSION" (cfg.nixosRelease + cfg.nixosVersionSuffix));
+      nixosLabel   = mkDefault cfg.nixosVersion;
+      nixosVersion = mkDefault (cfg.nixosRelease + cfg.nixosVersionSuffix);
       nixosRevision      = mkIf (pathIsDirectory gitRepo) (mkDefault            gitCommitId);
       nixosVersionSuffix = mkIf (pathIsDirectory gitRepo) (mkDefault (".git." + gitCommitId));
 
diff --git a/nixos/modules/security/grsecurity.nix b/nixos/modules/security/grsecurity.nix
index 4b9a11cf6dc8..6b4dbe8e11f8 100644
--- a/nixos/modules/security/grsecurity.nix
+++ b/nixos/modules/security/grsecurity.nix
@@ -97,7 +97,7 @@ in
 
     # Configure system tunables
     boot.kernel.sysctl = {
-      # Removed under grsecurity
+      # Read-only under grsecurity
       "kernel.kptr_restrict" = mkForce null;
     } // optionalAttrs config.nix.useSandbox {
       # chroot(2) restrictions that conflict with sandboxed Nix builds
diff --git a/nixos/modules/services/misc/nixos-manual.nix b/nixos/modules/services/misc/nixos-manual.nix
index 37ea339300d4..a60d5f7983bc 100644
--- a/nixos/modules/services/misc/nixos-manual.nix
+++ b/nixos/modules/services/misc/nixos-manual.nix
@@ -11,12 +11,6 @@ let
 
   cfg = config.services.nixosManual;
 
-  versionModule =
-    { system.nixosVersionSuffix = config.system.nixosVersionSuffix;
-      system.nixosRevision = config.system.nixosRevision;
-      nixpkgs.system = config.nixpkgs.system;
-    };
-
   /* For the purpose of generating docs, evaluate options with each derivation
     in `pkgs` (recursively) replaced by a fake with path "\${pkgs.attribute.path}".
     It isn't perfect, but it seems to cover a vast majority of use cases.
@@ -24,12 +18,12 @@ let
     the path above will be shown and not e.g. `${config.services.foo.package}`. */
   manual = import ../../../doc/manual {
     inherit pkgs;
-    version = config.system.nixosVersion;
-    revision = config.system.nixosRevision;
+    version = config.system.nixosRelease;
+    revision = "release-${config.system.nixosRelease}";
     options =
       let
         scrubbedEval = evalModules {
-          modules = [ versionModule ] ++ baseModules;
+          modules = [ { nixpkgs.system = config.nixpkgs.system; } ] ++ baseModules;
           args = (config._module.args) // { modules = [ ]; };
           specialArgs = { pkgs = scrubDerivations "pkgs" pkgs; };
         };
diff --git a/nixos/modules/services/networking/dnscrypt-proxy.nix b/nixos/modules/services/networking/dnscrypt-proxy.nix
index 227e38acc4a6..cf36ccf05725 100644
--- a/nixos/modules/services/networking/dnscrypt-proxy.nix
+++ b/nixos/modules/services/networking/dnscrypt-proxy.nix
@@ -55,7 +55,7 @@ in
       ''; };
       localAddress = mkOption {
         default = "127.0.0.1";
-        type = types.string;
+        type = types.str;
         description = ''
           Listen for DNS queries to relay on this address. The only reason to
           change this from its default value is to proxy queries on behalf
@@ -74,7 +74,7 @@ in
       };
       resolverName = mkOption {
         default = "dnscrypt.eu-nl";
-        type = types.nullOr types.string;
+        type = types.nullOr types.str;
         description = ''
           The name of the upstream DNSCrypt resolver to use, taken from the
           list named in the <literal>resolverList</literal> option.
@@ -90,7 +90,7 @@ in
         example = literalExample "${pkgs.dnscrypt-proxy}/share/dnscrypt-proxy/dnscrypt-resolvers.csv";
         default = pkgs.fetchurl {
           url = https://raw.githubusercontent.com/jedisct1/dnscrypt-proxy/master/dnscrypt-resolvers.csv;
-          sha256 = "171zvdqcqqvcw3zr7wl9h1wmdmk6m3h55xr4gq2z1j7a0x0ba2in";
+          sha256 = "1i9wzw4zl052h5nyp28bwl8d66cgj0awvjhw5wgwz0warkjl1g8g";
         };
         defaultText = "pkgs.fetchurl { url = ...; sha256 = ...; }";
       };
diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix
index 27a33f33ff93..8385d8e60266 100644
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@@ -4,31 +4,222 @@ with lib;
 
 let
   cfg = config.services.nginx;
-  nginx = cfg.package;
+  virtualHosts = mapAttrs (vhostName: vhostConfig:
+    vhostConfig // (optionalAttrs vhostConfig.enableACME {
+      sslCertificate = "/var/lib/acme/${vhostName}/fullchain.pem";
+      sslCertificateKey = "/var/lib/acme/${vhostName}/key.pem";
+    })
+  ) cfg.virtualHosts;
+
   configFile = pkgs.writeText "nginx.conf" ''
     user ${cfg.user} ${cfg.group};
+    error_log stderr;
     daemon off;
 
     ${cfg.config}
 
+    ${optionalString (cfg.httpConfig == "") ''
+    http {
+      include ${cfg.package}/conf/mime.types;
+      include ${cfg.package}/conf/fastcgi.conf;
+
+      ${optionalString (cfg.recommendedOptimisation) ''
+        # optimisation
+        sendfile on;
+        tcp_nopush on;
+        tcp_nodelay on;
+        keepalive_timeout 65;
+        types_hash_max_size 2048;
+      ''}
+
+      ssl_protocols ${cfg.sslProtocols};
+      ssl_ciphers ${cfg.sslCiphers};
+      ${optionalString (cfg.sslDhparam != null) "ssl_dhparam ${cfg.sslDhparam};"}
+
+      ${optionalString (cfg.recommendedTlsSettings) ''
+        ssl_session_cache shared:SSL:42m;
+        ssl_session_timeout 23m;
+        ssl_ecdh_curve secp384r1;
+        ssl_prefer_server_ciphers on;
+        ssl_stapling on;
+        ssl_stapling_verify on;
+      ''}
+
+      ${optionalString (cfg.recommendedGzipSettings) ''
+        gzip on;
+        gzip_disable "msie6";
+        gzip_proxied any;
+        gzip_comp_level 9;
+        gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
+      ''}
+
+      ${optionalString (cfg.recommendedProxySettings) ''
+        proxy_set_header        Host $host;
+        proxy_set_header        X-Real-IP $remote_addr;
+        proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header        X-Forwarded-Proto $scheme;
+        proxy_set_header        X-Forwarded-Host $host;
+        proxy_set_header        X-Forwarded-Server $host;
+        proxy_set_header        Accept-Encoding "";
+
+        proxy_redirect          off;
+        proxy_connect_timeout   90;
+        proxy_send_timeout      90;
+        proxy_read_timeout      90;
+        proxy_http_version      1.0;
+      ''}
+
+      client_max_body_size ${cfg.clientMaxBodySize};
+
+      server_tokens ${if cfg.serverTokens then "on" else "off"};
+
+      ${vhosts}
+
+      ${optionalString cfg.statusPage ''
+        server {
+          listen 80;
+          listen [::]:80;
+
+          server_name localhost;
+
+          location /nginx_status {
+            stub_status on;
+            access_log off;
+            allow 127.0.0.1;
+            allow ::1;
+            deny all;
+          }
+        }
+      ''}
+
+      ${cfg.appendHttpConfig}
+    }''}
+
     ${optionalString (cfg.httpConfig != "") ''
     http {
       include ${cfg.package}/conf/mime.types;
+      include ${cfg.package}/conf/fastcgi.conf;
       ${cfg.httpConfig}
-    }
-    ''}
+    }''}
+
     ${cfg.appendConfig}
   '';
+
+  vhosts = concatStringsSep "\n" (mapAttrsToList (serverName: vhost:
+      let
+        ssl = vhost.enableSSL || vhost.forceSSL;
+        port = if vhost.port != null then vhost.port else (if ssl then 443 else 80);
+        listenString = toString port + optionalString ssl " ssl http2"
+          + optionalString vhost.default " default";
+        acmeLocation = optionalString vhost.enableACME ''
+          location /.well-known/acme-challenge {
+            try_files $uri @acme-fallback;
+            root ${vhost.acmeRoot};
+            auth_basic off;
+          }
+          location @acme-fallback {
+            auth_basic off;
+            proxy_pass http://${vhost.acmeFallbackHost};
+          }
+        '';
+      in ''
+        ${optionalString vhost.forceSSL ''
+          server {
+            listen 80 ${optionalString vhost.default "default"};
+            listen [::]:80 ${optionalString vhost.default "default"};
+
+            server_name ${serverName} ${concatStringsSep " " vhost.serverAliases};
+            ${acmeLocation}
+            location / {
+              return 301 https://$host${optionalString (port != 443) ":${port}"}$request_uri;
+            }
+          }
+        ''}
+
+        server {
+          listen ${listenString};
+          listen [::]:${listenString};
+
+          server_name ${serverName} ${concatStringsSep " " vhost.serverAliases};
+          ${acmeLocation}
+          ${optionalString (vhost.root != null) "root ${vhost.root};"}
+          ${optionalString (vhost.globalRedirect != null) ''
+            return 301 http${optionalString ssl "s"}://${vhost.globalRedirect}$request_uri;
+          ''}
+          ${optionalString ssl ''
+            ssl_certificate ${vhost.sslCertificate};
+            ssl_certificate_key ${vhost.sslCertificateKey};
+          ''}
+
+          ${optionalString (vhost.basicAuth != {}) (mkBasicAuth serverName vhost.basicAuth)}
+
+          ${mkLocations vhost.locations}
+
+          ${vhost.extraConfig}
+        }
+      ''
+  ) virtualHosts);
+  mkLocations = locations: concatStringsSep "\n" (mapAttrsToList (location: config: ''
+    location ${location} {
+      ${optionalString (config.proxyPass != null) "proxy_pass ${config.proxyPass};"}
+      ${optionalString (config.root != null) "root ${config.root};"}
+      ${config.extraConfig}
+    }
+  '') locations);
+  mkBasicAuth = serverName: authDef: let
+    htpasswdFile = pkgs.writeText "${serverName}.htpasswd" (
+      concatStringsSep "\n" (mapAttrsToList (user: password: ''
+        ${user}:{PLAIN}${password}
+      '') authDef)
+    );
+  in ''
+    auth_basic secured;
+    auth_basic_user_file ${htpasswdFile};
+  '';
 in
 
 {
   options = {
     services.nginx = {
-      enable = mkOption {
+      enable = mkEnableOption "Nginx Web Server";
+
+      statusPage = mkOption {
+        default = false;
+        type = types.bool;
+        description = "
+          Enable status page reachable from localhost on http://127.0.0.1/nginx_status.
+        ";
+      };
+
+      recommendedTlsSettings = mkOption {
+        default = false;
+        type = types.bool;
+        description = "
+          Enable recommended TLS settings.
+        ";
+      };
+
+      recommendedOptimisation = mkOption {
+        default = false;
+        type = types.bool;
+        description = "
+          Enable recommended optimisation settings.
+        ";
+      };
+
+      recommendedGzipSettings = mkOption {
+        default = false;
+        type = types.bool;
+        description = "
+          Enable recommended gzip settings.
+        ";
+      };
+
+      recommendedProxySettings = mkOption {
         default = false;
         type = types.bool;
         description = "
-          Enable the nginx Web Server.
+          Enable recommended proxy settings.
         ";
       };
 
@@ -64,7 +255,22 @@ in
       httpConfig = mkOption {
         type = types.lines;
         default = "";
-        description = "Configuration lines to be appended inside of the http {} block.";
+        description = "
+          Configuration lines to be set inside the http block.
+          This is mutually exclusive with the structured configuration
+          via virtualHosts and the recommendedXyzSettings configuration
+          options. See appendHttpConfig for appending to the generated http block.
+        ";
+      };
+
+      appendHttpConfig = mkOption {
+        type = types.lines;
+        default = "";
+        description = "
+          Configuration lines to be appended to the generated http block.
+          This is mutually exclusive with using httpConfig for specifying the whole
+          http block verbatim.
+        ";
       };
 
       stateDir = mkOption {
@@ -86,8 +292,59 @@ in
         description = "Group account under which nginx runs.";
       };
 
-    };
+      serverTokens = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Show nginx version in headers and error pages.";
+      };
+
+      clientMaxBodySize = mkOption {
+        type = types.string;
+        default = "10m";
+        description = "Set nginx global client_max_body_size.";
+      };
+
+      sslCiphers = mkOption {
+        type = types.str;
+        default = "EECDH+aRSA+AESGCM:EDH+aRSA:EECDH+aRSA:+AES256:+AES128:+SHA1:!CAMELLIA:!SEED:!3DES:!DES:!RC4:!eNULL";
+        description = "Ciphers to choose from when negotiating tls handshakes.";
+      };
+
+      sslProtocols = mkOption {
+        type = types.str;
+        default = "TLSv1.2";
+        example = "TLSv1 TLSv1.1 TLSv1.2";
+        description = "Allowed TLS protocol versions.";
+      };
+
+      sslDhparam = mkOption {
+        type = types.nullOr types.path;
+        default = null;
+        example = "/path/to/dhparams.pem";
+        description = "Path to DH parameters file.";
+      };
 
+      virtualHosts = mkOption {
+        type = types.attrsOf (types.submodule (import ./vhost-options.nix {
+          inherit lib;
+        }));
+        default = {
+          localhost = {};
+        };
+        example = literalExample ''
+          {
+            "hydra.example.com" = {
+              forceSSL = true;
+              enableACME = true;
+              locations."/" = {
+                proxyPass = "http://localhost:3000";
+              };
+            };
+          };
+        '';
+        description = "Declarative vhost config";
+      };
+    };
   };
 
   config = mkIf cfg.enable {
@@ -97,7 +354,6 @@ in
       description = "Nginx Web Server";
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
-      path = [ nginx ];
       preStart =
         ''
         mkdir -p ${cfg.stateDir}/logs
@@ -105,14 +361,23 @@ in
         chown -R ${cfg.user}:${cfg.group} ${cfg.stateDir}
         '';
       serviceConfig = {
-        ExecStart = "${nginx}/bin/nginx -c ${configFile} -p ${cfg.stateDir}";
+        ExecStart = "${cfg.package}/bin/nginx -c ${configFile} -p ${cfg.stateDir}";
         ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
-        Restart = "on-failure";
+        Restart = "always";
         RestartSec = "10s";
         StartLimitInterval = "1min";
       };
     };
 
+    security.acme.certs = filterAttrs (n: v: v != {}) (
+      mapAttrs (vhostName: vhostConfig:
+        optionalAttrs vhostConfig.enableACME {
+          webroot = vhostConfig.acmeRoot;
+          extraDomains = genAttrs vhostConfig.serverAliases (alias: null);
+        }
+      ) virtualHosts
+    );
+
     users.extraUsers = optionalAttrs (cfg.user == "nginx") (singleton
       { name = "nginx";
         group = cfg.group;
diff --git a/nixos/modules/services/web-servers/nginx/location-options.nix b/nixos/modules/services/web-servers/nginx/location-options.nix
new file mode 100644
index 000000000000..8aaa3e96f800
--- /dev/null
+++ b/nixos/modules/services/web-servers/nginx/location-options.nix
@@ -0,0 +1,40 @@
+# This file defines the options that can be used both for the Apache
+# main server configuration, and for the virtual hosts.  (The latter
+# has additional options that affect the web server as a whole, like
+# the user/group to run under.)
+
+{ lib }:
+
+with lib;
+
+{
+  options = {
+    proxyPass = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      example = "http://www.example.org/";
+      description = ''
+        Adds proxy_pass directive and sets default proxy headers Host, X-Real-Ip
+        and X-Forwarded-For.
+      '';
+    };
+
+    root = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      example = "/your/root/directory";
+      description = ''
+        Root directory for requests.
+      '';
+    };
+
+    extraConfig = mkOption {
+      type = types.lines;
+      default = "";
+      description = ''
+        These lines go to the end of the location verbatim.
+      '';
+    };
+  };
+}
+
diff --git a/nixos/modules/services/web-servers/nginx/vhost-options.nix b/nixos/modules/services/web-servers/nginx/vhost-options.nix
new file mode 100644
index 000000000000..ee3f68bf8059
--- /dev/null
+++ b/nixos/modules/services/web-servers/nginx/vhost-options.nix
@@ -0,0 +1,140 @@
+# This file defines the options that can be used both for the Apache
+# main server configuration, and for the virtual hosts.  (The latter
+# has additional options that affect the web server as a whole, like
+# the user/group to run under.)
+
+{ lib }:
+
+with lib;
+{
+  options = {
+    serverAliases = mkOption {
+      type = types.listOf types.str;
+      default = [];
+      example = ["www.example.org" "example.org"];
+      description = ''
+        Additional names of virtual hosts served by this virtual host configuration.
+      '';
+    };
+
+    port = mkOption {
+      type = types.nullOr types.int;
+      default = null;
+      description = ''
+        Port for the server. Defaults to 80 for http
+        and 443 for https (i.e. when enableSSL is set).
+      '';
+    };
+
+    enableACME = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Whether to ask Let's Encrypt to sign a certificate for this vhost.";
+    };
+
+    acmeRoot = mkOption {
+      type = types.str;
+      default = "/var/lib/acme/acme-challenge";
+      description = "Directory to store certificates and keys managed by the ACME service.";
+    };
+
+    acmeFallbackHost = mkOption {
+      type = types.str;
+      default = "0.0.0.0";
+      description = ''
+        Host which to proxy requests to if acme challenge is not found. Useful
+        if you want multiple hosts to be able to verify the same domain name.
+      '';
+    };
+
+    enableSSL = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Whether to enable SSL (https) support.";
+    };
+
+    forceSSL = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Whether to always redirect to https.";
+    };
+
+    sslCertificate = mkOption {
+      type = types.path;
+      example = "/var/host.cert";
+      description = "Path to server SSL certificate.";
+    };
+
+    sslCertificateKey = mkOption {
+      type = types.path;
+      example = "/var/host.key";
+      description = "Path to server SSL certificate key.";
+    };
+
+    root = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      example = "/data/webserver/docs";
+      description = ''
+        The path of the web root directory.
+      '';
+    };
+
+    default = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Makes this vhost the default.
+      '';
+    };
+
+    extraConfig = mkOption {
+      type = types.lines;
+      default = "";
+      description = ''
+        These lines go to the end of the vhost verbatim.
+      '';
+    };
+
+    globalRedirect = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      example = http://newserver.example.org/;
+      description = ''
+        If set, all requests for this host are redirected permanently to
+        the given URL.
+      '';
+    };
+
+    basicAuth = mkOption {
+      type = types.attrsOf types.str;
+      default = {};
+      example = literalExample ''
+        {
+          user = "password";
+        };
+      '';
+      description = ''
+        Basic Auth protection for a vhost.
+
+        WARNING: This is implemented to store the password in plain text in the
+        nix store.
+      '';
+    };
+
+    locations = mkOption {
+      type = types.attrsOf (types.submodule (import ./location-options.nix {
+        inherit lib;
+      }));
+      default = {};
+      example = literalExample ''
+        {
+          "/" = {
+            proxyPass = "http://localhost:3000";
+          };
+        };
+      '';
+      description = "Declarative location config";
+    };
+  };
+}
diff --git a/nixos/release.nix b/nixos/release.nix
index 68f06a832980..4647a02afb1c 100644
--- a/nixos/release.nix
+++ b/nixos/release.nix
@@ -7,7 +7,7 @@ with import ../lib;
 
 let
 
-  version = builtins.readFile ../.version;
+  version = fileContents ../.version;
   versionSuffix =
     (if stableBranch then "." else "pre") + "${toString nixpkgs.revCount}.${nixpkgs.shortRev}";
 
@@ -96,7 +96,6 @@ in rec {
 
   manual = buildFromConfig ({ pkgs, ... }: { }) (config: config.system.build.manual.manual);
   manualEpub = (buildFromConfig ({ pkgs, ... }: { }) (config: config.system.build.manual.manualEpub));
-  manualPDF = (buildFromConfig ({ pkgs, ... }: { }) (config: config.system.build.manual.manualPDF)).x86_64-linux;
   manpages = buildFromConfig ({ pkgs, ... }: { }) (config: config.system.build.manual.manpages);
   options = (buildFromConfig ({ pkgs, ... }: { }) (config: config.system.build.manual.optionsJSON)).x86_64-linux;
 
diff --git a/pkgs/applications/audio/mopidy/default.nix b/pkgs/applications/audio/mopidy/default.nix
index c1bdab8622c9..5feabbf42063 100644
--- a/pkgs/applications/audio/mopidy/default.nix
+++ b/pkgs/applications/audio/mopidy/default.nix
@@ -22,7 +22,7 @@ pythonPackages.buildPythonApplication rec {
   ];
 
   propagatedBuildInputs = with pythonPackages; [
-    gst-python pygobject3 pykka tornado requests2
+    gst-python pygobject3 pykka tornado requests2 dbus
   ];
 
   # There are no tests
diff --git a/pkgs/applications/audio/zam-plugins/default.nix b/pkgs/applications/audio/zam-plugins/default.nix
index 70051e587cda..b79083ee402c 100644
--- a/pkgs/applications/audio/zam-plugins/default.nix
+++ b/pkgs/applications/audio/zam-plugins/default.nix
@@ -2,20 +2,19 @@
 
 stdenv.mkDerivation rec {
   name = "zam-plugins-${version}";
-  version = "3.6";
+  version = "3.7";
 
   src = fetchgit {
     url = "https://github.com/zamaudio/zam-plugins.git";
     deepClone = true;
-    rev = "91fe56931a3e57b80f18c740d2dde6b44f962aee";
-    sha256 = "1ldrqh6nk0m1axb553wjp1gfznw8b6b3k0v0z1jdwy425sl6g07d";
+    rev = "932046905a57f698406318765a60807a1f81257d";
+    sha256 = "0zgkmq3jgysrsb6cm6sfbgqpgfpwv8nxlgkqm29zzvb97j56bm7z";
   };
 
   buildInputs = [ boost libX11 mesa liblo libjack2 ladspaH lv2 pkgconfig rubberband libsndfile ];
 
   patchPhase = ''
     patchShebangs ./dpf/utils/generate-ttl.sh
-    substituteInPlace Makefile --replace "ZaMaximX2" "ZaMaximX2 ZamPiano ZamChild670"
   '';
 
   makeFlags = [
diff --git a/pkgs/applications/editors/atom/default.nix b/pkgs/applications/editors/atom/default.nix
index 620d0fb629ed..13816f8bfdc6 100644
--- a/pkgs/applications/editors/atom/default.nix
+++ b/pkgs/applications/editors/atom/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "atom-${version}";
-  version = "1.8.0";
+  version = "1.9.0";
 
   src = fetchurl {
     url = "https://github.com/atom/atom/releases/download/v${version}/atom-amd64.deb";
-    sha256 = "0x73n64y3jfwbwg6s9pmsajryrjrrx1a0dzf3ff6dbi5gvv950xi";
+    sha256 = "0hhv1yfs2h5x86pjbkbdg1mn15afdd3baddwpf3p0fl8x2gv9z7m";
     name = "${name}.deb";
   };
 
diff --git a/pkgs/applications/editors/kile/frameworks.nix b/pkgs/applications/editors/kile/frameworks.nix
index 2fd8dfe4128f..f42e9fa4335f 100644
--- a/pkgs/applications/editors/kile/frameworks.nix
+++ b/pkgs/applications/editors/kile/frameworks.nix
@@ -1,9 +1,9 @@
-{ stdenv
+{ kdeDerivation
 , lib
 , fetchgit
-, extra-cmake-modules
+, ecm
 , kdoctools
-, makeQtWrapper
+, kdeWrapper
 , qtscript
 , kconfig
 , kcrash
@@ -13,54 +13,55 @@
 , kiconthemes
 , kinit
 , khtml
+, konsole
 , kparts
 , ktexteditor
 , kwindowsystem
 , poppler
 }:
 
-stdenv.mkDerivation rec {
-  name = "kile-${version}";
-  version = "2016-07-02";
+let
+  unwrapped =
+    kdeDerivation rec {
+      name = "kile-${version}";
+      version = "2016-07-02";
 
-  src = fetchgit {
-    url = git://anongit.kde.org/kile.git;
-    rev = "d38bc7069667119cc891b351188484ca6fb88973";
-    sha256 = "1nha71i16fs7nq2812b5565nbmbsbs3ak5czas6xg1dg5bsvdqh8";
+      src = fetchgit {
+        url = git://anongit.kde.org/kile.git;
+        rev = "d38bc7069667119cc891b351188484ca6fb88973";
+        sha256 = "1nha71i16fs7nq2812b5565nbmbsbs3ak5czas6xg1dg5bsvdqh8";
 
-  };
+      };
 
-  nativeBuildInputs = [
-    extra-cmake-modules
-    kdoctools
-    makeQtWrapper
-  ];
+      nativeBuildInputs = [ ecm kdoctools ];
 
-  buildInputs = [
-    qtscript
-    kconfig
-    kcrash
-    kdbusaddons
-    kdelibs4support
-    kdoctools
-    kguiaddons
-    kiconthemes
-    kinit
-    khtml
-    kparts
-    ktexteditor
-    kwindowsystem
-    poppler
-  ];
+      buildInputs = [
+        kconfig
+        kcrash
+        kdbusaddons
+        kdelibs4support
+        kdoctools
+        kguiaddons
+        kiconthemes
+        kinit
+        khtml
+        kparts
+        ktexteditor
+        kwindowsystem
+        poppler
+        qtscript
+      ];
 
-  postInstall = ''
-    wrapQtProgram "$out/bin/kile"
-  '';
-
-  meta = {
-    description = "Kile is a user friendly TeX/LaTeX authoring tool for the KDE desktop environment";
-    homepage = https://www.kde.org/applications/office/kile/;
-    maintainers = with lib.maintainers; [ fridh ];
-    license = lib.licenses.gpl2Plus;
-  };
+      meta = {
+        description = "Kile is a user friendly TeX/LaTeX authoring tool for the KDE desktop environment";
+        homepage = https://www.kde.org/applications/office/kile/;
+        maintainers = with lib.maintainers; [ fridh ];
+        license = lib.licenses.gpl2Plus;
+      };
+    };
+in
+kdeWrapper unwrapped
+{
+  targets = [ "bin/kile" ];
+  paths = [ konsole.unwrapped ];
 }
diff --git a/pkgs/applications/gis/qgis/default.nix b/pkgs/applications/gis/qgis/default.nix
index b771d2552d87..a8c1428f8cb7 100644
--- a/pkgs/applications/gis/qgis/default.nix
+++ b/pkgs/applications/gis/qgis/default.nix
@@ -1,15 +1,16 @@
 { stdenv, fetchurl, gdal, cmake, qt4, flex, bison, proj, geos, xlibsWrapper, sqlite, gsl
 , qwt, fcgi, pythonPackages, libspatialindex, libspatialite, qscintilla, postgresql, makeWrapper
+, qjson, qca2, txt2tags
 , withGrass ? false, grass
 }:
 
 stdenv.mkDerivation rec {
-  name = "qgis-2.10.1";
+  name = "qgis-2.16.1";
 
   buildInputs = [ gdal qt4 flex bison proj geos xlibsWrapper sqlite gsl qwt qscintilla
-    fcgi libspatialindex libspatialite postgresql ] ++
+    fcgi libspatialindex libspatialite postgresql qjson qca2 txt2tags ] ++
     (stdenv.lib.optional withGrass grass) ++
-    (with pythonPackages; [ numpy psycopg2 ]) ++ [ pythonPackages.qscintilla ];
+    (with pythonPackages; [ numpy psycopg2 requests2 ]) ++ [ pythonPackages.qscintilla ];
 
   nativeBuildInputs = [ cmake makeWrapper ];
 
@@ -24,7 +25,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "http://qgis.org/downloads/${name}.tar.bz2";
-    sha256 = "79119b54642edaffe3cda513531eb7b81913e013954a49c6d3b21c8b00143307";
+    sha256 = "4a526cd8ae76fc06bb2b6a158e86db5dc0c94545137a8233cd465ef867acdc8b";
   };
 
   cmakeFlags = stdenv.lib.optional withGrass "-DGRASS_PREFIX7=${grass}/${grass.name}";
diff --git a/pkgs/applications/misc/moonlight-embedded/default.nix b/pkgs/applications/misc/moonlight-embedded/default.nix
new file mode 100644
index 000000000000..9171e0128076
--- /dev/null
+++ b/pkgs/applications/misc/moonlight-embedded/default.nix
@@ -0,0 +1,34 @@
+{ stdenv, fetchgit, cmake, perl
+, alsaLib, libevdev, libopus, libudev, SDL2
+, ffmpeg, pkgconfig, xorg, libvdpau, libpulseaudio, libcec
+, curl, expat, avahi, enet, libuuid
+}:
+
+stdenv.mkDerivation rec {
+  name = "moonlight-embedded-${version}";
+  version = "2.2.1";
+
+  # fetchgit used to ensure submodules are available
+  src = fetchgit {
+    url = "git://github.com/irtimmer/moonlight-embedded";
+    rev = "refs/tags/v${version}";
+    sha256 = "0m1114dsz44rvq402b4v5ib2cwj2vbasir0l8vi0q5iymwmsvxj4";
+  };
+
+  outputs = [ "out" "doc" ];
+
+  nativeBuildInputs = [ cmake perl ];
+  buildInputs = [
+    alsaLib libevdev libopus libudev SDL2
+    ffmpeg pkgconfig xorg.libxcb libvdpau libpulseaudio libcec
+    xorg.libpthreadstubs curl expat avahi enet libuuid
+  ];
+
+  meta = with stdenv.lib; {
+    description = "Open source implementation of NVIDIA's GameStream";
+    homepage = https://github.com/irtimmer/moonlight-embedded;
+    license = licenses.gpl3;
+    maintainers = [ maintainers.globin ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/applications/misc/yakuake/3.0.nix b/pkgs/applications/misc/yakuake/3.0.nix
index f3aff480914a..4ccef7f435a4 100644
--- a/pkgs/applications/misc/yakuake/3.0.nix
+++ b/pkgs/applications/misc/yakuake/3.0.nix
@@ -1,8 +1,9 @@
-{ stdenv
+{ kdeDerivation
 , lib
 , fetchurl
-, cmake
-, extra-cmake-modules
+, kdoctools
+, kdeWrapper
+, ecm
 , karchive
 , kcrash
 , kdbusaddons
@@ -14,53 +15,49 @@
 , konsole
 , kparts
 , kwindowsystem
-, makeQtWrapper
-
 }:
 
 let
-  pname = "yakuake";
-  version = "3.0.2";
-in
-stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
-
-  src = fetchurl {
-    url = "http://download.kde.org/stable/${pname}/${version}/src/${name}.tar.xz";
-    sha256 = "0vcdji1k8d3pz7k6lkw8ighkj94zff2l2cf9v1avf83f4hjyfhg5";
+  unwrapped = let
+    pname = "yakuake";
+    version = "3.0.2";
+  in kdeDerivation rec {
+    name = "${pname}-${version}";
+
+    src = fetchurl {
+      url = "http://download.kde.org/stable/${pname}/${version}/src/${name}.tar.xz";
+      sha256 = "0vcdji1k8d3pz7k6lkw8ighkj94zff2l2cf9v1avf83f4hjyfhg5";
+    };
+
+    buildInputs = [
+      karchive
+      kcrash
+      kdbusaddons
+      ki18n
+      kiconthemes
+      knewstuff
+      knotifications
+      knotifyconfig
+      kparts
+      kwindowsystem
+    ];
+
+    nativeBuildInputs = [
+      ecm kdoctools
+    ];
+
+    meta = {
+      homepage = https://yakuake.kde.org;
+      description = "Quad-style terminal emulator for KDE";
+      maintainers = with lib.maintainers; [ fridh ];
+    };
   };
 
-  buildInputs = [
-    cmake
-    extra-cmake-modules
-    karchive
-    kcrash
-    kdbusaddons
-    ki18n
-    kiconthemes
-    knewstuff
-    knotifications
-    knotifyconfig
-    kparts
-    kwindowsystem
-  ];
-
-  nativeBuildInputs = [
-    extra-cmake-modules
-    makeQtWrapper
-  ];
-
-  propagatedUserEnvPkgs = [
-    konsole
-  ];
 
-  postInstall = ''
-    wrapQtProgram "$out/bin/yakuake"
-  '';
-
-  meta = {
-    homepage = https://yakuake.kde.org;
-    description = "Quad-style terminal emulator for KDE";
-    maintainers = with lib.maintainers; [ fridh ];
-  };
+in
+kdeWrapper unwrapped
+{
+  targets = [ "bin/yakuake" ];
+  paths = [ konsole.unwrapped ];
 }
+
diff --git a/pkgs/applications/networking/irc/konversation/1.6.nix b/pkgs/applications/networking/irc/konversation/1.6.nix
index 158fe886b8b0..995eddd9321b 100644
--- a/pkgs/applications/networking/irc/konversation/1.6.nix
+++ b/pkgs/applications/networking/irc/konversation/1.6.nix
@@ -1,14 +1,14 @@
-{ stdenv
+{ kdeDerivation
 , lib
 , fetchurl
-, cmake
-, extra-cmake-modules
+, ecm
 , kbookmarks
 , karchive
 , kconfig
 , kconfigwidgets
 , kcoreaddons
 , kdbusaddons
+, kdeWrapper
 , kdoctools
 , kemoticons
 , kglobalaccel
@@ -24,61 +24,58 @@
 , makeQtWrapper
 , solid
 , sonnet
-, phonon}:
+, phonon
+}:
 
 let
-  pn = "konversation";
-  v = "1.6";
-in
+  unwrapped = let
+    pname = "konversation";
+    version = "1.6.1";
+  in kdeDerivation rec {
+    name = "${pname}-${version}";
 
-stdenv.mkDerivation rec {
-  name = "${pn}-${v}";
+    src = fetchurl {
+      url = "mirror://kde/stable/${pname}/${version}/src/${name}.tar.xz";
+      sha256 = "28346d6629261a5328c43ffa09c12e37743b3ef4f4bc4c411d39bc19f7bf06c6";
+    };
 
-  src = fetchurl {
-    url = "mirror://kde/stable/${pn}/${v}/src/${name}.tar.xz";
-    sha256 = "789fd75644bf54606778971310433dbe2bc01ac0917b34bc4e8cac88e204d5b6";
-  };
-
-  buildInputs = [
-    cmake
-    extra-cmake-modules
-    kbookmarks
-    karchive
-    kconfig
-    kconfigwidgets
-    kcoreaddons
-    kdbusaddons
-    kdoctools
-    kemoticons
-    kglobalaccel
-    ki18n
-    kiconthemes
-    kidletime
-    kitemviews
-    knotifications
-    knotifyconfig
-    kio
-    kparts
-    kwallet
-    solid
-    sonnet
-    phonon
-  ];
+    buildInputs = [
+      kbookmarks
+      karchive
+      kconfig
+      kconfigwidgets
+      kcoreaddons
+      kdbusaddons
+      kdoctools
+      kemoticons
+      kglobalaccel
+      ki18n
+      kiconthemes
+      kidletime
+      kitemviews
+      knotifications
+      knotifyconfig
+      kio
+      kparts
+      kwallet
+      solid
+      sonnet
+      phonon
+    ];
 
-  nativeBuildInputs = [
-    extra-cmake-modules
-    kdoctools
-    makeQtWrapper
-  ];
+    nativeBuildInputs = [
+      ecm
+      kdoctools
+    ];
 
-  postInstall = ''
-    wrapQtProgram "$out/bin/konversation"
-  '';
-
-  meta = {
-    description = "Integrated IRC client for KDE";
-    license = with lib.licenses; [ gpl2 ];
-    maintainers = with lib.maintainers; [ fridh ];
-    homepage = https://konversation.kde.org;
+    meta = {
+      description = "Integrated IRC client for KDE";
+      license = with lib.licenses; [ gpl2 ];
+      maintainers = with lib.maintainers; [ fridh ];
+      homepage = https://konversation.kde.org;
+    };
   };
+in kdeWrapper unwrapped {
+  targets = [ "bin/konversation" ];
 }
+
diff --git a/pkgs/applications/networking/mailreaders/notmuch/default.nix b/pkgs/applications/networking/mailreaders/notmuch/default.nix
index b9fc84d20583..bbf92ea0462a 100644
--- a/pkgs/applications/networking/mailreaders/notmuch/default.nix
+++ b/pkgs/applications/networking/mailreaders/notmuch/default.nix
@@ -5,10 +5,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "notmuch-0.22";
+  version = "0.22";
+  name = "notmuch-${version}";
 
   passthru = {
     pythonSourceRoot = "${name}/bindings/python";
+    inherit version;
   };
 
   src = fetchurl {
diff --git a/pkgs/applications/networking/mailreaders/notmuch/mutt.nix b/pkgs/applications/networking/mailreaders/notmuch/mutt.nix
new file mode 100644
index 000000000000..6d08ad724b27
--- /dev/null
+++ b/pkgs/applications/networking/mailreaders/notmuch/mutt.nix
@@ -0,0 +1,46 @@
+{ stdenv, lib, perl, perlPackages, makeWrapper, coreutils, notmuch }:
+
+stdenv.mkDerivation rec {
+  name = "notmuch-mutt-${version}";
+  version = notmuch.version;
+
+  outputs = [ "out" ];
+
+  dontStrip = true;
+
+  buildInputs = [
+    perl
+    makeWrapper
+  ] ++ (with perlPackages; [
+    FileRemove
+    DigestSHA1
+    Later
+    MailBox
+    MailMaildir
+    MailTools
+    StringShellQuote
+    TermReadLineGnu
+  ]);
+
+  src = notmuch.src;
+
+  phases = [ "unpackPhase" "installPhase" "fixupPhase" ];
+
+  installPhase = ''
+    ${coreutils}/bin/install -Dm755 \
+      ./contrib/notmuch-mutt/notmuch-mutt \
+      $out/bin/notmuch-mutt
+
+    wrapProgram $out/bin/notmuch-mutt \
+      --prefix PERL5LIB : $PERL5LIB
+  '';
+
+  meta = with lib; {
+    inherit version;
+    description = "Mutt support for notmuch";
+    homepage    = http://notmuchmua.org/;
+    license     = with licenses; mit;
+    maintainers = with maintainers; [ peterhoeg ];
+    platforms   = platforms.unix;
+  };
+}
diff --git a/pkgs/applications/office/libreoffice/default.nix b/pkgs/applications/office/libreoffice/default.nix
index 63af5babca27..6b206bb13d9b 100644
--- a/pkgs/applications/office/libreoffice/default.nix
+++ b/pkgs/applications/office/libreoffice/default.nix
@@ -76,7 +76,9 @@ in stdenv.mkDerivation rec {
 
   # For some reason librdf_redland sometimes refers to rasqal.h instead 
   # of rasqal/rasqal.h
-  NIX_CFLAGS_COMPILE="-I${librdf_rasqal}/include/rasqal";
+  # curl upgrade to 7.50.0 (#17152) changes the libcurl headers slightly and
+  # therefore requires the -fpermissive flag until this package gets updated
+  NIX_CFLAGS_COMPILE="-I${librdf_rasqal}/include/rasqal -fpermissive";
 
   # If we call 'configure', 'make' will then call configure again without parameters.
   # It's their system.
diff --git a/pkgs/applications/office/libreoffice/still.nix b/pkgs/applications/office/libreoffice/still.nix
index eadf41356308..248772b759f1 100644
--- a/pkgs/applications/office/libreoffice/still.nix
+++ b/pkgs/applications/office/libreoffice/still.nix
@@ -76,7 +76,9 @@ in stdenv.mkDerivation rec {
 
   # For some reason librdf_redland sometimes refers to rasqal.h instead 
   # of rasqal/rasqal.h
-  NIX_CFLAGS_COMPILE="-I${librdf_rasqal}/include/rasqal";
+  # curl upgrade to 7.50.0 (#17152) changes the libcurl headers slightly and
+  # therefore requires the -fpermissive flag until this package gets updated
+  NIX_CFLAGS_COMPILE="-I${librdf_rasqal}/include/rasqal -fpermissive";
 
   # If we call 'configure', 'make' will then call configure again without parameters.
   # It's their system.
diff --git a/pkgs/build-support/vm/default.nix b/pkgs/build-support/vm/default.nix
index fa7107bd7382..7ac1b2cc5194 100644
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@@ -2,7 +2,7 @@
 , kernel ? pkgs.linux
 , img ? "bzImage"
 , rootModules ?
-    [ "virtio_pci" "virtio_blk" "virtio_balloon" "ext4" "unix" "9p" "9pnet_virtio" "rtc_cmos" ]
+    [ "virtio_pci" "virtio_blk" "virtio_balloon" "virtio_rng" "ext4" "unix" "9p" "9pnet_virtio" "rtc_cmos" ]
 }:
 
 with pkgs;
@@ -218,6 +218,7 @@ rec {
     ${qemuProg} \
       ${lib.optionalString (pkgs.stdenv.system == "x86_64-linux") "-cpu kvm64"} \
       -nographic -no-reboot \
+      -device virtio-rng-pci \
       -virtfs local,path=/nix/store,security_model=none,mount_tag=store \
       -virtfs local,path=$TMPDIR/xchg,security_model=none,mount_tag=xchg \
       -drive file=$diskImage,if=virtio,cache=unsafe,werror=report \
diff --git a/pkgs/desktops/kde-5/applications/dolphin.nix b/pkgs/desktops/kde-5/applications/dolphin.nix
index 27e4a38741e7..4e636ae31863 100644
--- a/pkgs/desktops/kde-5/applications/dolphin.nix
+++ b/pkgs/desktops/kde-5/applications/dolphin.nix
@@ -4,7 +4,7 @@
   baloo, baloo-widgets, dolphin-plugins, kactivities, kbookmarks, kcmutils,
   kcompletion, kconfig, kcoreaddons, kdelibs4support, kdbusaddons,
   kfilemetadata, ki18n, kiconthemes, kinit, kio, knewstuff, knotifications,
-  kparts, ktexteditor, kwindowsystem, phonon, solid
+  konsole, kparts, ktexteditor, kwindowsystem, phonon, solid
 }:
 
 let
@@ -27,5 +27,5 @@ in
 kdeWrapper unwrapped
 {
   targets = [ "bin/dolphin" ];
-  paths = [ dolphin-plugins ];
+  paths = [ dolphin-plugins konsole.unwrapped ];
 }
diff --git a/pkgs/desktops/kde-5/applications/kate.nix b/pkgs/desktops/kde-5/applications/kate.nix
index 738266e8df7e..ab0087930c01 100644
--- a/pkgs/desktops/kde-5/applications/kate.nix
+++ b/pkgs/desktops/kde-5/applications/kate.nix
@@ -1,10 +1,10 @@
 {
   kdeApp, lib, kdeWrapper,
   ecm, kdoctools,
-  kactivities, kconfig, kcrash, kguiaddons, kiconthemes, ki18n, kinit,
-  kjobwidgets, kio, kparts, ktexteditor, kwindowsystem, kxmlgui, kdbusaddons,
-  kwallet, plasma-framework, kitemmodels, knotifications, qtscript,
-  threadweaver, knewstuff, libgit2
+  kactivities, kconfig, kcrash, kdbusaddons, kguiaddons, kiconthemes, ki18n,
+  kinit, kio, kitemmodels, kjobwidgets, knewstuff, knotifications, konsole,
+  kparts, ktexteditor, kwindowsystem, kwallet, kxmlgui, libgit2,
+  plasma-framework, qtscript, threadweaver
 }:
 
 let
@@ -24,4 +24,8 @@ let
       ];
     };
 in
-kdeWrapper unwrapped { targets = [ "bin/kate" "bin/kwrite" ]; }
+kdeWrapper unwrapped
+{
+  targets = [ "bin/kate" "bin/kwrite" ];
+  paths = [ konsole.unwrapped ];
+}
diff --git a/pkgs/development/compilers/ponyc/default.nix b/pkgs/development/compilers/ponyc/default.nix
index ef355e64e1ed..30b96822cab6 100644
--- a/pkgs/development/compilers/ponyc/default.nix
+++ b/pkgs/development/compilers/ponyc/default.nix
@@ -1,29 +1,35 @@
-{stdenv, glibc, fetchFromGitHub, llvm, makeWrapper, openssl, pcre2 }:
+{stdenv, glibc, fetchFromGitHub, llvm, makeWrapper, openssl, pcre2, coreutils }:
 
 stdenv.mkDerivation {
-  name = "ponyc-0.2.1";
+  name = "ponyc-2016-07-26";
 
   src = fetchFromGitHub {
-    owner = "CausalityLtd";
+    owner = "ponylang";
     repo = "ponyc";
-    rev = "0.2.1";
-    sha256 = "1wmvqrj9v2kjqha9fcs10vfnhdxhc3rf67wpn36ldhs1hq0k25jy";
+    rev = "4eec8a9b0d9936b2a0249bd17fd7a2caac6aaa9c";
+    sha256 = "184x2jivp7826i60rf0dpx0a9dg5rsj56dv0cll28as4nyqfmna2";
   };
 
   buildInputs = [ llvm makeWrapper ];
 
-  makeFlags = [ "config=release" ];
-  doCheck = true;
-  checkTarget = "test";
+  # Disable problematic networking tests
+  patches = [ ./disable-tests.patch ];
 
-  patchPhase = ''
-    sed 's|/usr/lib/x86_64-linux-gnu/|${glibc.out}/lib/|g' -i src/libponyc/codegen/genexe.c
-    sed 's|/lib/x86_64-linux-gnu/|${stdenv.cc.cc.lib}/lib/|g' -i src/libponyc/codegen/genexe.c
+  preBuild = ''
+    # Fix tests
+    substituteInPlace packages/process/_test.pony \
+        --replace "/bin/cat" "${coreutils}/bin/cat"
+
+    export LLVM_CONFIG=${llvm}/bin/llvm-config
   '';
 
-  preBuild = ''
-      export LLVM_CONFIG=${llvm}/bin/llvm-config
-    '';
+  makeFlags = [ "config=release" ];
+
+  enableParallelBuilding = true;
+
+  doCheck = true;
+
+  checkTarget = "test";
 
   preCheck = ''
     export LIBRARY_PATH="$out/lib:${openssl.out}/lib:${pcre2}/lib"
diff --git a/pkgs/development/compilers/ponyc/disable-tests.patch b/pkgs/development/compilers/ponyc/disable-tests.patch
new file mode 100644
index 000000000000..9335ebd6eea8
--- /dev/null
+++ b/pkgs/development/compilers/ponyc/disable-tests.patch
@@ -0,0 +1,16 @@
+diff --git a/packages/net/_test.pony b/packages/net/_test.pony
+index d6c3e56..dc37dd9 100644
+--- a/packages/net/_test.pony
++++ b/packages/net/_test.pony
+@@ -7,11 +7,6 @@ actor Main is TestList
+   fun tag tests(test: PonyTest) =>
+     test(_TestReadBuffer)
+     test(_TestWriteBuffer)
+-    test(_TestBroadcast)
+-    ifdef not windows then
+-      test(_TestTCPExpect)
+-      test(_TestTCPWritev)
+-    end
+ 
+ class iso _TestReadBuffer is UnitTest
+   """
diff --git a/pkgs/development/interpreters/python/2.6/default.nix b/pkgs/development/interpreters/python/cpython/2.6/default.nix
index 6641eb24b241..e5c33cd7b2bd 100644
--- a/pkgs/development/interpreters/python/2.6/default.nix
+++ b/pkgs/development/interpreters/python/cpython/2.6/default.nix
@@ -99,8 +99,8 @@ let
       inherit zlibSupport;
       isPy2 = true;
       isPy26 = true;
-      buildEnv = callPackage ../wrapper.nix { python = self; };
-      withPackages = import ../with-packages.nix { inherit buildEnv; pythonPackages = python26Packages; };
+      buildEnv = callPackage ../../wrapper.nix { python = self; };
+      withPackages = import ../../with-packages.nix { inherit buildEnv; pythonPackages = python26Packages; };
       libPrefix = "python${majorVersion}";
       executable = libPrefix;
       sitePackages = "lib/${libPrefix}/site-packages";
diff --git a/pkgs/development/interpreters/python/2.6/nix-store-mtime.patch b/pkgs/development/interpreters/python/cpython/2.6/nix-store-mtime.patch
index 83f3fea1931b..83f3fea1931b 100644
--- a/pkgs/development/interpreters/python/2.6/nix-store-mtime.patch
+++ b/pkgs/development/interpreters/python/cpython/2.6/nix-store-mtime.patch
diff --git a/pkgs/development/interpreters/python/2.6/python2.6-fix-parallel-make.patch b/pkgs/development/interpreters/python/cpython/2.6/python2.6-fix-parallel-make.patch
index c43e141f9afb..c43e141f9afb 100644
--- a/pkgs/development/interpreters/python/2.6/python2.6-fix-parallel-make.patch
+++ b/pkgs/development/interpreters/python/cpython/2.6/python2.6-fix-parallel-make.patch
diff --git a/pkgs/development/interpreters/python/2.6/search-path.patch b/pkgs/development/interpreters/python/cpython/2.6/search-path.patch
index 2e7b7526c0ce..2e7b7526c0ce 100644
--- a/pkgs/development/interpreters/python/2.6/search-path.patch
+++ b/pkgs/development/interpreters/python/cpython/2.6/search-path.patch
diff --git a/pkgs/development/interpreters/python/2.6/setup-hook.sh b/pkgs/development/interpreters/python/cpython/2.6/setup-hook.sh
index 4caff9c9d846..4caff9c9d846 100644
--- a/pkgs/development/interpreters/python/2.6/setup-hook.sh
+++ b/pkgs/development/interpreters/python/cpython/2.6/setup-hook.sh
diff --git a/pkgs/development/interpreters/python/2.7/2.5.2-ctypes-util-find_library.patch b/pkgs/development/interpreters/python/cpython/2.7/2.5.2-ctypes-util-find_library.patch
index 22bc0f7ced0a..22bc0f7ced0a 100644
--- a/pkgs/development/interpreters/python/2.7/2.5.2-ctypes-util-find_library.patch
+++ b/pkgs/development/interpreters/python/cpython/2.7/2.5.2-ctypes-util-find_library.patch
diff --git a/pkgs/development/interpreters/python/2.7/2.5.2-tkinter-x11.patch b/pkgs/development/interpreters/python/cpython/2.7/2.5.2-tkinter-x11.patch
index 28b6dafc3f15..28b6dafc3f15 100644
--- a/pkgs/development/interpreters/python/2.7/2.5.2-tkinter-x11.patch
+++ b/pkgs/development/interpreters/python/cpython/2.7/2.5.2-tkinter-x11.patch
diff --git a/pkgs/development/interpreters/python/2.7/2.6.2-ssl-threads.patch b/pkgs/development/interpreters/python/cpython/2.7/2.6.2-ssl-threads.patch
index bef137efda7b..bef137efda7b 100644
--- a/pkgs/development/interpreters/python/2.7/2.6.2-ssl-threads.patch
+++ b/pkgs/development/interpreters/python/cpython/2.7/2.6.2-ssl-threads.patch
diff --git a/pkgs/development/interpreters/python/2.7/2.6.5-FD_SETSIZE.patch b/pkgs/development/interpreters/python/cpython/2.7/2.6.5-FD_SETSIZE.patch
index d1dae8c47dc1..d1dae8c47dc1 100644
--- a/pkgs/development/interpreters/python/2.7/2.6.5-FD_SETSIZE.patch
+++ b/pkgs/development/interpreters/python/cpython/2.7/2.6.5-FD_SETSIZE.patch
diff --git a/pkgs/development/interpreters/python/2.7/2.6.5-export-PySignal_SetWakeupFd.patch b/pkgs/development/interpreters/python/cpython/2.7/2.6.5-export-PySignal_SetWakeupFd.patch
index ea696978236a..ea696978236a 100644
--- a/pkgs/development/interpreters/python/2.7/2.6.5-export-PySignal_SetWakeupFd.patch
+++ b/pkgs/development/interpreters/python/cpython/2.7/2.6.5-export-PySignal_SetWakeupFd.patch
diff --git a/pkgs/development/interpreters/python/2.7/2.6.5-ncurses-abi6.patch b/pkgs/development/interpreters/python/cpython/2.7/2.6.5-ncurses-abi6.patch
index e1cf5ad4bbf9..e1cf5ad4bbf9 100644
--- a/pkgs/development/interpreters/python/2.7/2.6.5-ncurses-abi6.patch
+++ b/pkgs/development/interpreters/python/cpython/2.7/2.6.5-ncurses-abi6.patch
diff --git a/pkgs/development/interpreters/python/2.7/2.7.3-dbm.patch b/pkgs/development/interpreters/python/cpython/2.7/2.7.3-dbm.patch
index bfaeb37c287d..bfaeb37c287d 100644
--- a/pkgs/development/interpreters/python/2.7/2.7.3-dbm.patch
+++ b/pkgs/development/interpreters/python/cpython/2.7/2.7.3-dbm.patch
diff --git a/pkgs/development/interpreters/python/2.7/2.7.3-dylib.patch b/pkgs/development/interpreters/python/cpython/2.7/2.7.3-dylib.patch
index 6e1fc8b53e83..6e1fc8b53e83 100644
--- a/pkgs/development/interpreters/python/2.7/2.7.3-dylib.patch
+++ b/pkgs/development/interpreters/python/cpython/2.7/2.7.3-dylib.patch
diff --git a/pkgs/development/interpreters/python/2.7/2.7.3-getpath-exe-extension.patch b/pkgs/development/interpreters/python/cpython/2.7/2.7.3-getpath-exe-extension.patch
index 68f6921ba6aa..68f6921ba6aa 100644
--- a/pkgs/development/interpreters/python/2.7/2.7.3-getpath-exe-extension.patch
+++ b/pkgs/development/interpreters/python/cpython/2.7/2.7.3-getpath-exe-extension.patch
diff --git a/pkgs/development/interpreters/python/2.7/2.7.3-no-libm.patch b/pkgs/development/interpreters/python/cpython/2.7/2.7.3-no-libm.patch
index 55281db6768f..55281db6768f 100644
--- a/pkgs/development/interpreters/python/2.7/2.7.3-no-libm.patch
+++ b/pkgs/development/interpreters/python/cpython/2.7/2.7.3-no-libm.patch
diff --git a/pkgs/development/interpreters/python/2.7/default.nix b/pkgs/development/interpreters/python/cpython/2.7/default.nix
index aca88f504a0d..96c098c82dca 100644
--- a/pkgs/development/interpreters/python/2.7/default.nix
+++ b/pkgs/development/interpreters/python/cpython/2.7/default.nix
@@ -160,8 +160,8 @@ let
       inherit zlibSupport;
       isPy2 = true;
       isPy27 = true;
-      buildEnv = callPackage ../wrapper.nix { python = self; };
-      withPackages = import ../with-packages.nix { inherit buildEnv; pythonPackages = python27Packages; };
+      buildEnv = callPackage ../../wrapper.nix { python = self; };
+      withPackages = import ../../with-packages.nix { inherit buildEnv; pythonPackages = python27Packages; };
       libPrefix = "python${majorVersion}";
       executable = libPrefix;
       sitePackages = "lib/${libPrefix}/site-packages";
diff --git a/pkgs/development/interpreters/python/2.7/deterministic-build.patch b/pkgs/development/interpreters/python/cpython/2.7/deterministic-build.patch
index 98d9d339fa11..98d9d339fa11 100644
--- a/pkgs/development/interpreters/python/2.7/deterministic-build.patch
+++ b/pkgs/development/interpreters/python/cpython/2.7/deterministic-build.patch
diff --git a/pkgs/development/interpreters/python/2.7/nix-store-mtime.patch b/pkgs/development/interpreters/python/cpython/2.7/nix-store-mtime.patch
index 83f3fea1931b..83f3fea1931b 100644
--- a/pkgs/development/interpreters/python/2.7/nix-store-mtime.patch
+++ b/pkgs/development/interpreters/python/cpython/2.7/nix-store-mtime.patch
diff --git a/pkgs/development/interpreters/python/2.7/no-ldconfig.patch b/pkgs/development/interpreters/python/cpython/2.7/no-ldconfig.patch
index 44c38fb29534..44c38fb29534 100644
--- a/pkgs/development/interpreters/python/2.7/no-ldconfig.patch
+++ b/pkgs/development/interpreters/python/cpython/2.7/no-ldconfig.patch
diff --git a/pkgs/development/interpreters/python/2.7/properly-detect-curses.patch b/pkgs/development/interpreters/python/cpython/2.7/properly-detect-curses.patch
index e2640bab0e9a..e2640bab0e9a 100644
--- a/pkgs/development/interpreters/python/2.7/properly-detect-curses.patch
+++ b/pkgs/development/interpreters/python/cpython/2.7/properly-detect-curses.patch
diff --git a/pkgs/development/interpreters/python/2.7/search-path.patch b/pkgs/development/interpreters/python/cpython/2.7/search-path.patch
index 2e7b7526c0ce..2e7b7526c0ce 100644
--- a/pkgs/development/interpreters/python/2.7/search-path.patch
+++ b/pkgs/development/interpreters/python/cpython/2.7/search-path.patch
diff --git a/pkgs/development/interpreters/python/2.7/setup-hook.sh b/pkgs/development/interpreters/python/cpython/2.7/setup-hook.sh
index 4770eea886f6..4770eea886f6 100644
--- a/pkgs/development/interpreters/python/2.7/setup-hook.sh
+++ b/pkgs/development/interpreters/python/cpython/2.7/setup-hook.sh
diff --git a/pkgs/development/interpreters/python/3.3/default.nix b/pkgs/development/interpreters/python/cpython/3.3/default.nix
index 8a36e03c7840..1d2312fdc151 100644
--- a/pkgs/development/interpreters/python/3.3/default.nix
+++ b/pkgs/development/interpreters/python/cpython/3.3/default.nix
@@ -88,8 +88,8 @@ stdenv.mkDerivation {
     tkSupport = (tk != null) && (tcl != null) && (libX11 != null) && (xproto != null);
     libPrefix = "python${majorVersion}";
     executable = "python3.3m";
-    buildEnv = callPackage ../wrapper.nix { python = self; };
-    withPackages = import ../with-packages.nix { inherit buildEnv; pythonPackages = python33Packages; };
+    buildEnv = callPackage ../../wrapper.nix { python = self; };
+    withPackages = import ../../with-packages.nix { inherit buildEnv; pythonPackages = python33Packages; };
     isPy3 = true;
     isPy33 = true;
     is_py3k = true;  # deprecated
diff --git a/pkgs/development/interpreters/python/3.3/setup-hook.sh b/pkgs/development/interpreters/python/cpython/3.3/setup-hook.sh
index 82a8c0abd32f..82a8c0abd32f 100644
--- a/pkgs/development/interpreters/python/3.3/setup-hook.sh
+++ b/pkgs/development/interpreters/python/cpython/3.3/setup-hook.sh
diff --git a/pkgs/development/interpreters/python/3.4/default.nix b/pkgs/development/interpreters/python/cpython/3.4/default.nix
index 7ea6adc4370d..64c61e504b7e 100644
--- a/pkgs/development/interpreters/python/3.4/default.nix
+++ b/pkgs/development/interpreters/python/cpython/3.4/default.nix
@@ -111,8 +111,8 @@ stdenv.mkDerivation {
     tkSupport = (tk != null) && (tcl != null) && (libX11 != null) && (xproto != null);
     libPrefix = "python${majorVersion}";
     executable = "python3.4m";
-    buildEnv = callPackage ../wrapper.nix { python = self; };
-    withPackages = import ../with-packages.nix { inherit buildEnv; pythonPackages = python34Packages; };
+    buildEnv = callPackage ../../wrapper.nix { python = self; };
+    withPackages = import ../../with-packages.nix { inherit buildEnv; pythonPackages = python34Packages; };
     isPy3 = true;
     isPy34 = true;
     is_py3k = true;  # deprecated
diff --git a/pkgs/development/interpreters/python/3.4/setup-hook.sh b/pkgs/development/interpreters/python/cpython/3.4/setup-hook.sh
index fddcc0b73fe8..fddcc0b73fe8 100644
--- a/pkgs/development/interpreters/python/3.4/setup-hook.sh
+++ b/pkgs/development/interpreters/python/cpython/3.4/setup-hook.sh
diff --git a/pkgs/development/interpreters/python/3.5/default.nix b/pkgs/development/interpreters/python/cpython/3.5/default.nix
index 21716c87386f..c36d7c2a6eb9 100644
--- a/pkgs/development/interpreters/python/3.5/default.nix
+++ b/pkgs/development/interpreters/python/cpython/3.5/default.nix
@@ -111,8 +111,8 @@ stdenv.mkDerivation {
     tkSupport = (tk != null) && (tcl != null) && (libX11 != null) && (xproto != null);
     libPrefix = "python${majorVersion}";
     executable = "python${majorVersion}m";
-    buildEnv = callPackage ../wrapper.nix { python = self; };
-    withPackages = import ../with-packages.nix { inherit buildEnv; pythonPackages = python35Packages; };
+    buildEnv = callPackage ../../wrapper.nix { python = self; };
+    withPackages = import ../../with-packages.nix { inherit buildEnv; pythonPackages = python35Packages; };
     isPy3 = true;
     isPy35 = true;
     is_py3k = true;  # deprecated
diff --git a/pkgs/development/interpreters/python/3.5/setup-hook.sh b/pkgs/development/interpreters/python/cpython/3.5/setup-hook.sh
index 2836ad7e8f56..2836ad7e8f56 100644
--- a/pkgs/development/interpreters/python/3.5/setup-hook.sh
+++ b/pkgs/development/interpreters/python/cpython/3.5/setup-hook.sh
diff --git a/pkgs/development/interpreters/python/3.6/default.nix b/pkgs/development/interpreters/python/cpython/3.6/default.nix
index 9515e1587d7f..a337b28859b7 100644
--- a/pkgs/development/interpreters/python/3.6/default.nix
+++ b/pkgs/development/interpreters/python/cpython/3.6/default.nix
@@ -115,8 +115,8 @@ stdenv.mkDerivation {
     tkSupport = (tk != null) && (tcl != null) && (libX11 != null) && (xproto != null);
     libPrefix = "python${majorVersion}";
     executable = "python${majorVersion}m";
-    buildEnv = callPackage ../wrapper.nix { python = self; };
-    withPackages = import ../with-packages.nix { inherit buildEnv; pythonPackages = python36Packages; };
+    buildEnv = callPackage ../../wrapper.nix { python = self; };
+    withPackages = import ../../with-packages.nix { inherit buildEnv; pythonPackages = python36Packages; };
     isPy3 = true;
     isPy35 = true;
     is_py3k = true;  # deprecated
diff --git a/pkgs/development/interpreters/python/3.6/setup-hook.sh b/pkgs/development/interpreters/python/cpython/3.6/setup-hook.sh
index 26a0d57bc87c..26a0d57bc87c 100644
--- a/pkgs/development/interpreters/python/3.6/setup-hook.sh
+++ b/pkgs/development/interpreters/python/cpython/3.6/setup-hook.sh
diff --git a/pkgs/development/interpreters/python/docs/2.6-html.nix b/pkgs/development/interpreters/python/cpython/docs/2.6-html.nix
index 2b41f122fa9b..2b41f122fa9b 100644
--- a/pkgs/development/interpreters/python/docs/2.6-html.nix
+++ b/pkgs/development/interpreters/python/cpython/docs/2.6-html.nix
diff --git a/pkgs/development/interpreters/python/docs/2.6-pdf-a4.nix b/pkgs/development/interpreters/python/cpython/docs/2.6-pdf-a4.nix
index ec031821a03f..ec031821a03f 100644
--- a/pkgs/development/interpreters/python/docs/2.6-pdf-a4.nix
+++ b/pkgs/development/interpreters/python/cpython/docs/2.6-pdf-a4.nix
diff --git a/pkgs/development/interpreters/python/docs/2.6-pdf-letter.nix b/pkgs/development/interpreters/python/cpython/docs/2.6-pdf-letter.nix
index 7cacf7778348..7cacf7778348 100644
--- a/pkgs/development/interpreters/python/docs/2.6-pdf-letter.nix
+++ b/pkgs/development/interpreters/python/cpython/docs/2.6-pdf-letter.nix
diff --git a/pkgs/development/interpreters/python/docs/2.6-text.nix b/pkgs/development/interpreters/python/cpython/docs/2.6-text.nix
index eb394a3f3e2d..eb394a3f3e2d 100644
--- a/pkgs/development/interpreters/python/docs/2.6-text.nix
+++ b/pkgs/development/interpreters/python/cpython/docs/2.6-text.nix
diff --git a/pkgs/development/interpreters/python/docs/2.7-html.nix b/pkgs/development/interpreters/python/cpython/docs/2.7-html.nix
index 3885b43960f5..3885b43960f5 100644
--- a/pkgs/development/interpreters/python/docs/2.7-html.nix
+++ b/pkgs/development/interpreters/python/cpython/docs/2.7-html.nix
diff --git a/pkgs/development/interpreters/python/docs/2.7-pdf-a4.nix b/pkgs/development/interpreters/python/cpython/docs/2.7-pdf-a4.nix
index d8dde17ac66a..d8dde17ac66a 100644
--- a/pkgs/development/interpreters/python/docs/2.7-pdf-a4.nix
+++ b/pkgs/development/interpreters/python/cpython/docs/2.7-pdf-a4.nix
diff --git a/pkgs/development/interpreters/python/docs/2.7-pdf-letter.nix b/pkgs/development/interpreters/python/cpython/docs/2.7-pdf-letter.nix
index 32581cd229a9..32581cd229a9 100644
--- a/pkgs/development/interpreters/python/docs/2.7-pdf-letter.nix
+++ b/pkgs/development/interpreters/python/cpython/docs/2.7-pdf-letter.nix
diff --git a/pkgs/development/interpreters/python/docs/2.7-text.nix b/pkgs/development/interpreters/python/cpython/docs/2.7-text.nix
index 590192383016..590192383016 100644
--- a/pkgs/development/interpreters/python/docs/2.7-text.nix
+++ b/pkgs/development/interpreters/python/cpython/docs/2.7-text.nix
diff --git a/pkgs/development/interpreters/python/docs/3.3-html.nix b/pkgs/development/interpreters/python/cpython/docs/3.3-html.nix
index 055224dd740b..055224dd740b 100644
--- a/pkgs/development/interpreters/python/docs/3.3-html.nix
+++ b/pkgs/development/interpreters/python/cpython/docs/3.3-html.nix
diff --git a/pkgs/development/interpreters/python/docs/3.3-pdf-a4.nix b/pkgs/development/interpreters/python/cpython/docs/3.3-pdf-a4.nix
index 8c6b842d0b94..8c6b842d0b94 100644
--- a/pkgs/development/interpreters/python/docs/3.3-pdf-a4.nix
+++ b/pkgs/development/interpreters/python/cpython/docs/3.3-pdf-a4.nix
diff --git a/pkgs/development/interpreters/python/docs/3.3-pdf-letter.nix b/pkgs/development/interpreters/python/cpython/docs/3.3-pdf-letter.nix
index 046abe8f83d7..046abe8f83d7 100644
--- a/pkgs/development/interpreters/python/docs/3.3-pdf-letter.nix
+++ b/pkgs/development/interpreters/python/cpython/docs/3.3-pdf-letter.nix
diff --git a/pkgs/development/interpreters/python/docs/3.3-text.nix b/pkgs/development/interpreters/python/cpython/docs/3.3-text.nix
index 4d99c25bf598..4d99c25bf598 100644
--- a/pkgs/development/interpreters/python/docs/3.3-text.nix
+++ b/pkgs/development/interpreters/python/cpython/docs/3.3-text.nix
diff --git a/pkgs/development/interpreters/python/docs/default.nix b/pkgs/development/interpreters/python/cpython/docs/default.nix
index 8f5fc810fb71..8f5fc810fb71 100644
--- a/pkgs/development/interpreters/python/docs/default.nix
+++ b/pkgs/development/interpreters/python/cpython/docs/default.nix
diff --git a/pkgs/development/interpreters/python/docs/generate.sh b/pkgs/development/interpreters/python/cpython/docs/generate.sh
index bebefc10ccd0..bebefc10ccd0 100755
--- a/pkgs/development/interpreters/python/docs/generate.sh
+++ b/pkgs/development/interpreters/python/cpython/docs/generate.sh
diff --git a/pkgs/development/interpreters/python/docs/template.nix b/pkgs/development/interpreters/python/cpython/docs/template.nix
index cc92f71bc1ea..cc92f71bc1ea 100644
--- a/pkgs/development/interpreters/python/docs/template.nix
+++ b/pkgs/development/interpreters/python/cpython/docs/template.nix
diff --git a/pkgs/development/interpreters/pypy/default.nix b/pkgs/development/interpreters/python/pypy/2.7/default.nix
index f07e53e592f5..ba6f5706bbdc 100644
--- a/pkgs/development/interpreters/pypy/default.nix
+++ b/pkgs/development/interpreters/python/pypy/2.7/default.nix
@@ -117,10 +117,10 @@ let
       inherit zlibSupport libPrefix;
       executable = "pypy";
       isPypy = true;
-      buildEnv = callPackage ../python/wrapper.nix { python = self; };
+      buildEnv = callPackage ../../wrapper.nix { python = self; };
       interpreter = "${self}/bin/${executable}";
       sitePackages = "site-packages";
-      withPackages = import ../python/with-packages.nix { inherit buildEnv; pythonPackages = pypyPackages; };
+      withPackages = import ../../with-packages.nix { inherit buildEnv; pythonPackages = pypyPackages; };
     };
 
     enableParallelBuilding = true;  # almost no parallelization without STM
diff --git a/pkgs/development/interpreters/pypy/setup-hook.sh b/pkgs/development/interpreters/python/pypy/2.7/setup-hook.sh
index e9081d1eaa53..e9081d1eaa53 100644
--- a/pkgs/development/interpreters/pypy/setup-hook.sh
+++ b/pkgs/development/interpreters/python/pypy/2.7/setup-hook.sh
diff --git a/pkgs/development/libraries/gdal/default.nix b/pkgs/development/libraries/gdal/default.nix
index a748bb9ac8fd..90341898a8a8 100644
--- a/pkgs/development/libraries/gdal/default.nix
+++ b/pkgs/development/libraries/gdal/default.nix
@@ -6,12 +6,12 @@
  }:
 
 composableDerivation.composableDerivation {} (fixed: rec {
-  version = "2.0.2";
+  version = "2.1.1";
   name = "gdal-${version}";
 
   src = fetchurl {
     url = "http://download.osgeo.org/gdal/${version}/${name}.tar.gz";
-    sha256 = "db7722caf8d9dd798ec18012b9cacf40a518918466126a88b9fd277bd7d40cc4";
+    sha256 = "55fc6ffbe76e9d2e7e6cf637010e5d4bba6a966d065f40194ff798544198236b";
   };
 
   buildInputs = [ unzip libjpeg libtiff libpng proj openssl ]
@@ -20,12 +20,6 @@ composableDerivation.composableDerivation {} (fixed: rec {
 
   hardeningDisable = [ "format" ];
 
-  patches = [
-    # This ensures that the python package is installed into gdal's prefix,
-    # rather than trying to install into python's prefix.
-    ./python.patch
-  ];
-
   # Don't use optimization for gcc >= 4.3. That's said to be causing segfaults.
   # Unset CC and CXX as they confuse libtool.
   preConfigure = "export CFLAGS=-O0 CXXFLAGS=-O0; unset CC CXX";
diff --git a/pkgs/development/libraries/leatherman/default.nix b/pkgs/development/libraries/leatherman/default.nix
index 3dfc9e2990ec..a4b007fa399d 100644
--- a/pkgs/development/libraries/leatherman/default.nix
+++ b/pkgs/development/libraries/leatherman/default.nix
@@ -13,6 +13,10 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ boost cmake curl ];
 
+  # curl upgrade to 7.50.0 (#17152) broke the curl mock tests, disabling for now
+  # upstream bug raised https://tickets.puppetlabs.com/browse/LTH-108
+  cmakeFlags = [ "-DLEATHERMAN_MOCK_CURL=OFF" ];
+
   meta = with stdenv.lib; {
     homepage = https://github.com/puppetlabs/leatherman/;  
     description = "A collection of C++ and CMake utility libraries";
diff --git a/pkgs/development/libraries/poppler/default.nix b/pkgs/development/libraries/poppler/default.nix
index 51b5ac5981ef..e445af46e09a 100644
--- a/pkgs/development/libraries/poppler/default.nix
+++ b/pkgs/development/libraries/poppler/default.nix
@@ -1,6 +1,8 @@
 { stdenv, lib, fetchurl, fetchpatch, pkgconfig, libiconv, libintlOrEmpty
 , zlib, curl, cairo, freetype, fontconfig, lcms, libjpeg, openjpeg
-, minimal ? false, qt4Support ? false, qt4 ? null, qt5Support ? false, qtbase ? null
+, minimal ? false
+, qt4Support ? false, qt4 ? null
+, qt5Support ? false, qtbase ? null
 , utils ? false, suffix ? "glib"
 }:
 
@@ -31,6 +33,9 @@ stdenv.mkDerivation rec {
 
   NIX_CFLAGS_COMPILE = [ "-DQT_NO_DEBUG" ];
 
+  # Any package depending on Qt >= 5.7 must build using the C++11 standard.
+  CXXFLAGS = lib.optional qt5Support "-std=c++11";
+
   configureFlags = with lib;
     [
       "--enable-xpdf-headers"
diff --git a/pkgs/development/python-modules/setuptools/default.nix b/pkgs/development/python-modules/setuptools/default.nix
index d01bc684f699..290b0d98fe08 100644
--- a/pkgs/development/python-modules/setuptools/default.nix
+++ b/pkgs/development/python-modules/setuptools/default.nix
@@ -28,5 +28,6 @@ stdenv.mkDerivation rec {
     homepage = http://pypi.python.org/pypi/setuptools;
     license = with lib.licenses; [ psfl zpt20 ];
     platforms = platforms.all;
+    priority = 10;
   };
 }
diff --git a/pkgs/games/construo/default.nix b/pkgs/games/construo/default.nix
index f94b489908eb..0c9e83cdb9ab 100644
--- a/pkgs/games/construo/default.nix
+++ b/pkgs/games/construo/default.nix
@@ -1,29 +1,25 @@
-{ stdenv, fetchurl, builderDefs, libX11, zlib, xproto, mesa ? null, freeglut ? null }:
+{ stdenv, fetchurl, libX11, zlib, xproto, mesa ? null, freeglut ? null }:
 
-	let localDefs = builderDefs.passthru.function {
-		src = /* put a fetchurl here */
-		fetchurl {
-			url = http://savannah.nongnu.org/download/construo/construo-0.2.2.tar.gz;
-			sha256 = "0c661rjasax4ykw77dgqj39jhb4qi48m0bhhdy42vd5a4rfdrcck";
-		};
-
-		buildInputs = [ libX11 zlib xproto ]
-                  ++ stdenv.lib.optional (mesa != null) mesa
-                  ++ stdenv.lib.optional (freeglut != null) freeglut;
-		preConfigure = builderDefs.stringsWithDeps.fullDepEntry (''
-		  sed -e 's/math[.]h/cmath/' -i vector.cxx
-		  sed -e 's/games/bin/' -i Makefile.in
-		  sed -e '1i\#include <stdlib.h>' -i construo_main.cxx -i command_line.cxx -i config.hxx
-		  sed -e '1i\#include <string.h>' -i command_line.cxx -i lisp_reader.cxx -i unix_system.cxx \
-		      -i world.cxx construo_main.cxx
-		'') ["doUnpack" "minInit"];
-	};
-	in with localDefs;
 stdenv.mkDerivation rec {
-	name = "construo-0.2.2";
-	builder = writeScript (name + "-builder")
-		(textClosure localDefs ["preConfigure" "doConfigure" "doMakeInstall" "doForceShare" "doPropagate"]);
-	meta = {
-		description = "Masses and springs simulation game";
-	};
+  name = "construo-${version}";
+  version = "0.2.3";
+
+  src = fetchurl {
+    url = "https://github.com/Construo/construo/releases/download/v${version}/${name}.tar.gz";
+    sha256 = "1wmj527hbj1qv44cdsj6ahfjrnrjwg2dp8gdick8nd07vm062qxa";
+  };
+
+  buildInputs = [ libX11 zlib xproto ]
+    ++ stdenv.lib.optional (mesa != null) mesa
+    ++ stdenv.lib.optional (freeglut != null) freeglut;
+
+  preConfigure = ''
+    substituteInPlace src/Makefile.in \
+      --replace games bin
+  '';
+
+  meta = {
+    description = "Masses and springs simulation game";
+    homepage = http://fs.fsf.org/construo/;
+  };
 }
diff --git a/pkgs/games/holdingnuts/default.nix b/pkgs/games/holdingnuts/default.nix
new file mode 100644
index 000000000000..e6d6febeac6f
--- /dev/null
+++ b/pkgs/games/holdingnuts/default.nix
@@ -0,0 +1,38 @@
+{ stdenv, fetchurl, cmake, SDL, qt4 }:
+
+let mirror = "http://download.holdingnuts.net";
+in stdenv.mkDerivation rec {
+  name    = "${pname}-${version}";
+  pname   = "holdingnuts";
+  version = "0.0.5";
+
+  src = fetchurl {
+    url    = "${mirror}/release/${version}/${name}.tar.bz2";
+    sha256 = "0iw25jmnqzscg34v66d4zz70lvgjp4l7gi16nna6491xnqha5a8g";
+  };
+
+  patches = [
+    (fetchurl {
+      url    = "${mirror}/patches/holdingnuts-0.0.5-wheel.patch";
+      sha256 = "0hap5anxgc19s5qi64mjpi3wpgphy4dqdxqw34q19dw3gwxw5g8n";
+    })
+    (fetchurl {
+      url    = "${mirror}/patches/holdingnuts-qpixmapcache-workaround.patch";
+      sha256 = "15cf9j9mdm85f0h7w5f5852ic7xpim0243yywkd2qrfp37mi93pd";
+    })
+  ];
+
+  postPatch = ''
+    substituteInPlace src/system/SysAccess.c --replace /usr/share $out/share
+  '';
+
+  buildInputs = [ cmake SDL qt4 ];
+
+  meta = with stdenv.lib; {
+    homepage    = http://www.holdingnuts.net/;
+    description = "Open Source Poker client and server";
+    license     = licenses.gpl3;
+    maintainers = with maintainers; [ obadz ];
+    platforms   = platforms.all;
+  };
+}
diff --git a/pkgs/misc/drivers/dell-530cdn/default.nix b/pkgs/misc/drivers/dell-530cdn/default.nix
new file mode 100644
index 000000000000..9b2f8bd47b34
--- /dev/null
+++ b/pkgs/misc/drivers/dell-530cdn/default.nix
@@ -0,0 +1,13 @@
+{ runCommand, fetchurl, rpm, cpio }: let
+  version = "1.3-1";
+
+  src = fetchurl {
+    url = "http://downloads.dell.com/printer/Dell-5130cdn-Color-Laser-${version}.noarch.rpm";
+    md5 = "7fb7122e67e40b99deb9665d88df62d1";
+  };
+in runCommand "Dell-5130cdn-Color-Laser-1.3-1" {} ''
+  mkdir -p usr/share/cups/model
+  ${rpm}/bin/rpm2cpio ${src} | ${cpio}/bin/cpio -i
+  mkdir -p $out/share/ppd
+  mv usr/share/cups/model/Dell $out/share/ppd
+''
diff --git a/pkgs/os-specific/linux/broadcom-sta/default.nix b/pkgs/os-specific/linux/broadcom-sta/default.nix
index 64a0c3138c9b..28b23a61ff06 100644
--- a/pkgs/os-specific/linux/broadcom-sta/default.nix
+++ b/pkgs/os-specific/linux/broadcom-sta/default.nix
@@ -1,43 +1,47 @@
 { stdenv, fetchurl, kernel }:
+
 let
-  version = "6.30.223.248";
+  version = "6.30.223.271";
+  hashes = {
+    i686-linux   = "1kaqa2dw3nb8k23ffvx46g8jj3wdhz8xa6jp1v3wb35cjfr712sg";
+    x86_64-linux = "1gj485qqr190idilacpxwgqyw21il03zph2rddizgj7fbd6pfyaz";
+  };
+
+  arch = stdenv.lib.optionalString (stdenv.system == "x86_64-linux") "_64";
+  tarballVersion = stdenv.lib.replaceStrings ["."] ["_"] version;
+  tarball = "hybrid-v35${arch}-nodebug-pcoem-${tarballVersion}.tar.gz";
 in
 stdenv.mkDerivation {
   name = "broadcom-sta-${version}-${kernel.version}";
 
-  src = if stdenv.system == "i686-linux" then (
-    fetchurl {
-      url = http://www.broadcom.com/docs/linux_sta/hybrid-v35-nodebug-pcoem-6_30_223_248.tar.gz;
-      sha256 = "1bd13pq5hj4yzp32rx71sg1i5wkzdsg1s32xsywb48lw88x595mi";
-    } ) else (
-    fetchurl {
-      url = http://www.broadcom.com/docs/linux_sta/hybrid-v35_64-nodebug-pcoem-6_30_223_248.tar.gz;
-      sha256 = "08ihbhwnqpnazskw9rlrk0alanp4x70kl8bsy2vg962iq334r69x";
-    }
-  );
+  src = fetchurl {
+    url = "http://www.broadcom.com/docs/linux_sta/${tarball}";
+    sha256 = hashes.${stdenv.system};
+  };
 
   patches = [
+    ./i686-build-failure.patch
     ./license.patch
-    ./linux-recent.patch
+    ./linux-4.7.patch
+    ./null-pointer-fix.patch
     ./gcc.patch
   ];
 
   makeFlags = "KBASE=${kernel.dev}/lib/modules/${kernel.modDirVersion}";
 
   unpackPhase = ''
-      sourceRoot=broadcom-sta
-      mkdir "$sourceRoot"
-      tar xvf "$src" -C "$sourceRoot"
+    sourceRoot=broadcom-sta
+    mkdir "$sourceRoot"
+    tar xvf "$src" -C "$sourceRoot"
   '';
 
-  installPhase =
-    ''
-      binDir="$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
-      docDir="$out/share/doc/broadcom-sta/"
-      mkdir -p "$binDir" "$docDir"
-      cp wl.ko "$binDir"
-      cp lib/LICENSE.txt "$docDir"
-    '';
+  installPhase = ''
+    binDir="$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
+    docDir="$out/share/doc/broadcom-sta/"
+    mkdir -p "$binDir" "$docDir"
+    cp wl.ko "$binDir"
+    cp lib/LICENSE.txt "$docDir"
+  '';
 
   meta = {
     description = "Kernel module driver for some Broadcom's wireless cards";
diff --git a/pkgs/os-specific/linux/broadcom-sta/i686-build-failure.patch b/pkgs/os-specific/linux/broadcom-sta/i686-build-failure.patch
new file mode 100644
index 000000000000..cfa16075409b
--- /dev/null
+++ b/pkgs/os-specific/linux/broadcom-sta/i686-build-failure.patch
@@ -0,0 +1,18 @@
+https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit?id=fe47ae6e1a5005b2e82f7eab57b5c3820453293a
+https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit?id=4ea1636b04dbd66536fa387bae2eea463efc705b
+
+diff -ru a/src/shared/linux_osl.c b/src/shared/linux_osl.c
+--- a/src/shared/linux_osl.c	2015-09-19 01:47:15.000000000 +0300
++++ b/src/shared/linux_osl.c	2015-11-21 15:20:30.585902518 +0200
+@@ -932,7 +932,11 @@
+ 	uint cycles;
+ 
+ #if defined(__i386__)
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 3, 0)
++	cycles = (u32)rdtsc();
++#else
+ 	rdtscl(cycles);
++#endif
+ #else
+ 	cycles = 0;
+ #endif 
diff --git a/pkgs/os-specific/linux/broadcom-sta/linux-4.7.patch b/pkgs/os-specific/linux/broadcom-sta/linux-4.7.patch
new file mode 100644
index 000000000000..566680a09140
--- /dev/null
+++ b/pkgs/os-specific/linux/broadcom-sta/linux-4.7.patch
@@ -0,0 +1,109 @@
+Since Linux 4.7, the enum ieee80211_band is no longer used
+
+This shall cause no problem's since both enums ieee80211_band
+and nl80211_band were added in the same commit:
+https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit?id=13ae75b103e07304a34ab40c9136e9f53e06475c
+
+This patch refactors the references of IEEE80211_BAND_* to NL80211_BAND_*
+
+Reference:
+https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit?id=57fbcce37be7c1d2622b56587c10ade00e96afa3
+
+--- a/src/wl/sys/wl_cfg80211_hybrid.c	2016-06-13 11:57:36.159340297 -0500
++++ b/src/wl/sys/wl_cfg80211_hybrid.c	2016-06-13 11:58:18.442323435 -0500
+@@ -236,7 +236,7 @@
+ #endif				
+ 
+ #define CHAN2G(_channel, _freq, _flags) {			\
+-	.band			= IEEE80211_BAND_2GHZ,		\
++	.band			= NL80211_BAND_2GHZ,		\
+ 	.center_freq		= (_freq),			\
+ 	.hw_value		= (_channel),			\
+ 	.flags			= (_flags),			\
+@@ -245,7 +245,7 @@
+ }
+ 
+ #define CHAN5G(_channel, _flags) {				\
+-	.band			= IEEE80211_BAND_5GHZ,		\
++	.band			= NL80211_BAND_5GHZ,		\
+ 	.center_freq		= 5000 + (5 * (_channel)),	\
+ 	.hw_value		= (_channel),			\
+ 	.flags			= (_flags),			\
+@@ -379,7 +379,7 @@
+ };
+ 
+ static struct ieee80211_supported_band __wl_band_2ghz = {
+-	.band = IEEE80211_BAND_2GHZ,
++	.band = NL80211_BAND_2GHZ,
+ 	.channels = __wl_2ghz_channels,
+ 	.n_channels = ARRAY_SIZE(__wl_2ghz_channels),
+ 	.bitrates = wl_g_rates,
+@@ -387,7 +387,7 @@
+ };
+ 
+ static struct ieee80211_supported_band __wl_band_5ghz_a = {
+-	.band = IEEE80211_BAND_5GHZ,
++	.band = NL80211_BAND_5GHZ,
+ 	.channels = __wl_5ghz_a_channels,
+ 	.n_channels = ARRAY_SIZE(__wl_5ghz_a_channels),
+ 	.bitrates = wl_a_rates,
+@@ -395,7 +395,7 @@
+ };
+ 
+ static struct ieee80211_supported_band __wl_band_5ghz_n = {
+-	.band = IEEE80211_BAND_5GHZ,
++	.band = NL80211_BAND_5GHZ,
+ 	.channels = __wl_5ghz_n_channels,
+ 	.n_channels = ARRAY_SIZE(__wl_5ghz_n_channels),
+ 	.bitrates = wl_a_rates,
+@@ -1876,8 +1876,8 @@
+ 	wdev->wiphy->max_num_pmkids = WL_NUM_PMKIDS_MAX;
+ #endif
+ 	wdev->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) | BIT(NL80211_IFTYPE_ADHOC);
+-	wdev->wiphy->bands[IEEE80211_BAND_2GHZ] = &__wl_band_2ghz;
+-	wdev->wiphy->bands[IEEE80211_BAND_5GHZ] = &__wl_band_5ghz_a; 
++	wdev->wiphy->bands[NL80211_BAND_2GHZ] = &__wl_band_2ghz;
++	wdev->wiphy->bands[NL80211_BAND_5GHZ] = &__wl_band_5ghz_a; 
+ 	wdev->wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
+ 	wdev->wiphy->cipher_suites = __wl_cipher_suites;
+ 	wdev->wiphy->n_cipher_suites = ARRAY_SIZE(__wl_cipher_suites);
+@@ -2000,7 +2000,7 @@
+ #if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 39)
+ 	freq = ieee80211_channel_to_frequency(notif_bss_info->channel,
+ 		(notif_bss_info->channel <= CH_MAX_2G_CHANNEL) ?
+-		IEEE80211_BAND_2GHZ : IEEE80211_BAND_5GHZ);
++		NL80211_BAND_2GHZ : NL80211_BAND_5GHZ);
+ #else
+ 	freq = ieee80211_channel_to_frequency(notif_bss_info->channel);
+ #endif
+@@ -2116,7 +2116,7 @@
+ 				return err;
+ 			}
+ 			chan = wf_chspec_ctlchan(chanspec);
+-			band = (chan <= CH_MAX_2G_CHANNEL) ? IEEE80211_BAND_2GHZ : IEEE80211_BAND_5GHZ;
++			band = (chan <= CH_MAX_2G_CHANNEL) ? NL80211_BAND_2GHZ : NL80211_BAND_5GHZ;
+ 			freq = ieee80211_channel_to_frequency(chan, band);
+ 			channel = ieee80211_get_channel(wiphy, freq);
+ 			cfg80211_ibss_joined(ndev, (u8 *)&wl->bssid, channel, GFP_KERNEL);
+@@ -2250,10 +2250,10 @@
+ 		join_params->params.chanspec_list[0] =
+ 		    ieee80211_frequency_to_channel(chan->center_freq);
+ 
+-		if (chan->band == IEEE80211_BAND_2GHZ) {
++		if (chan->band == NL80211_BAND_2GHZ) {
+ 			chanspec |= WL_CHANSPEC_BAND_2G;
+ 		}
+-		else if (chan->band == IEEE80211_BAND_5GHZ) {
++		else if (chan->band == NL80211_BAND_5GHZ) {
+ 			chanspec |= WL_CHANSPEC_BAND_5G;
+ 		}
+ 		else {
+@@ -2885,7 +2885,7 @@
+ 
+ 	if (phy == 'n' || phy == 'a' || phy == 'v') {
+ 		wiphy = wl_to_wiphy(wl);
+-		wiphy->bands[IEEE80211_BAND_5GHZ] = &__wl_band_5ghz_n;
++		wiphy->bands[NL80211_BAND_5GHZ] = &__wl_band_5ghz_n;
+ 	}
+ 
+ 	return err;
diff --git a/pkgs/os-specific/linux/broadcom-sta/linux-recent.patch b/pkgs/os-specific/linux/broadcom-sta/linux-recent.patch
deleted file mode 100644
index a690558eb5b8..000000000000
--- a/pkgs/os-specific/linux/broadcom-sta/linux-recent.patch
+++ /dev/null
@@ -1,386 +0,0 @@
---- a/src/wl/sys/wl_cfg80211_hybrid.c	2014-06-26 12:42:08.000000000 +0200
-+++ b/src/wl/sys/wl_cfg80211_hybrid.c	2015-04-13 13:20:08.140013177 +0200
-@@ -63,8 +63,13 @@
- static s32 wl_cfg80211_join_ibss(struct wiphy *wiphy, struct net_device *dev,
-            struct cfg80211_ibss_params *params);
- static s32 wl_cfg80211_leave_ibss(struct wiphy *wiphy, struct net_device *dev);
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 16, 0)
- static s32 wl_cfg80211_get_station(struct wiphy *wiphy,
-            struct net_device *dev, u8 *mac, struct station_info *sinfo);
-+#else
-+static s32 wl_cfg80211_get_station(struct wiphy *wiphy,
-+           struct net_device *dev, const u8 *mac, struct station_info *sinfo);
-+#endif
- static s32 wl_cfg80211_set_power_mgmt(struct wiphy *wiphy,
-            struct net_device *dev, bool enabled, s32 timeout);
- static int wl_cfg80211_connect(struct wiphy *wiphy, struct net_device *dev,
-@@ -1387,7 +1392,7 @@
- 	key_endian_to_host(&key);
- 
- 	params.key_len = (u8) min_t(u8, DOT11_MAX_KEY_SIZE, key.len);
--	memcpy(params.key, key.data, params.key_len);
-+	memcpy((char *)params.key, key.data, params.key_len);
- 
- 	if ((err = wl_dev_ioctl(dev, WLC_GET_WSEC, &wsec, sizeof(wsec)))) {
- 		return err;
-@@ -1421,9 +1426,15 @@
- 	return err;
- }
- 
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 16, 0)
- static s32
- wl_cfg80211_get_station(struct wiphy *wiphy, struct net_device *dev,
-                         u8 *mac, struct station_info *sinfo)
-+#else
-+static s32
-+wl_cfg80211_get_station(struct wiphy *wiphy, struct net_device *dev,
-+                        const u8 *mac, struct station_info *sinfo)
-+#endif
- {
- 	struct wl_cfg80211_priv *wl = wiphy_to_wl(wiphy);
- 	scb_val_t scb_val;
-@@ -1441,7 +1452,11 @@
- 		WL_DBG(("Could not get rate (%d)\n", err));
- 	} else {
- 		rate = dtoh32(rate);
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 0, 0)
- 		sinfo->filled |= STATION_INFO_TX_BITRATE;
-+#else
-+		sinfo->filled |= BIT(NL80211_STA_INFO_TX_BITRATE);
-+#endif
- 		sinfo->txrate.legacy = rate * 5;
- 		WL_DBG(("Rate %d Mbps\n", (rate / 2)));
- 	}
-@@ -1454,7 +1469,11 @@
- 			return err;
- 		}
- 		rssi = dtoh32(scb_val.val);
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 0, 0)
- 		sinfo->filled |= STATION_INFO_SIGNAL;
-+#else
-+		sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
-+#endif
- 		sinfo->signal = rssi;
- 		WL_DBG(("RSSI %d dBm\n", rssi));
- 	}
-@@ -2010,9 +2029,15 @@
- 
- 	notify_ie = (u8 *)bi + le16_to_cpu(bi->ie_offset);
- 	notify_ielen = le32_to_cpu(bi->ie_length);
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 18, 0)
- 	cbss = cfg80211_inform_bss(wiphy, channel, (const u8 *)(bi->BSSID.octet),
- 		0, beacon_proberesp->capab_info, beacon_proberesp->beacon_int,
- 		(const u8 *)notify_ie, notify_ielen, signal, GFP_KERNEL);
-+#else
-+	cbss = cfg80211_inform_bss(wiphy, channel, CFG80211_BSS_FTYPE_UNKNOWN, (const u8 *)(bi->BSSID.octet),
-+		0, beacon_proberesp->capab_info, beacon_proberesp->beacon_int,
-+		(const u8 *)notify_ie, notify_ielen, signal, GFP_KERNEL);
-+#endif
- 
- 	if (unlikely(!cbss))
- 		return -ENOMEM;
-@@ -2047,7 +2072,11 @@
- 		}
- 		else if ((event == WLC_E_LINK && ~(flags & WLC_EVENT_MSG_LINK)) ||
- 			event == WLC_E_DEAUTH_IND || event == WLC_E_DISASSOC_IND) {
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 2, 0)
-+			cfg80211_disconnected(ndev, 0, NULL, 0, false, GFP_KERNEL);
-+#else
- 			cfg80211_disconnected(ndev, 0, NULL, 0, GFP_KERNEL);
-+#endif
- 			clear_bit(WL_STATUS_CONNECTED, &wl->status);
- 			wl_link_down(wl);
- 			wl_init_prof(wl->profile);
-@@ -2071,7 +2100,26 @@
- 			wl_get_assoc_ies(wl);
- 			memcpy(&wl->bssid, &e->addr, ETHER_ADDR_LEN);
- 			wl_update_bss_info(wl);
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 15, 0)
-+			{
-+				struct wl_bss_info *bi;
-+				u16 bss_info_channel;
-+				struct ieee80211_channel *channel;
-+				u32 freq;
-+
-+				bi = (struct wl_bss_info *)(wl->extra_buf + 4);
-+				bss_info_channel = bi->ctl_ch ? bi->ctl_ch : CHSPEC_CHANNEL(bi->chanspec);
-+
-+				freq = ieee80211_channel_to_frequency(bss_info_channel,
-+				       (bss_info_channel <= CH_MAX_2G_CHANNEL) ?
-+				       IEEE80211_BAND_2GHZ : IEEE80211_BAND_5GHZ);
-+
-+				channel = ieee80211_get_channel(wl_to_wiphy(wl), freq);
-+				cfg80211_ibss_joined(ndev, (u8 *)&wl->bssid, channel, GFP_KERNEL);
-+			}
-+#else
- 			cfg80211_ibss_joined(ndev, (u8 *)&wl->bssid, GFP_KERNEL);
-+#endif
- 			set_bit(WL_STATUS_CONNECTED, &wl->status);
- 			wl->profile->active = true;
- 		}
-@@ -2629,7 +2677,15 @@
- 
- void wl_cfg80211_detach(struct net_device *ndev)
- {
--	struct wl_cfg80211_priv *wl = ndev_to_wl(ndev);
-+	struct wl_cfg80211_priv *wl;
-+	struct wireless_dev *wdev;
-+	
-+	wdev = ndev->ieee80211_ptr;
-+	if (wdev == NULL) {
-+                printk(KERN_ERR "[%s()] in ndev=%p: IEEE80211ptr=%p\n", __FUNCTION__, ndev, wdev);
-+                return;
-+        }
-+	wl = ndev_to_wl(ndev);
- 
- 	wl_deinit_cfg80211_priv(wl);
- 	wl_free_wdev(wl);
---- a/src/wl/sys/wl_dbg.h	2014-06-26 12:42:08.000000000 +0200
-+++ b/src/wl/sys/wl_dbg.h	2015-04-13 13:19:52.443345832 +0200
-@@ -55,10 +55,12 @@
- 
- #define WL_NONE(args)
- 
-+#define FORCE_TRACE_LEVEL(fmt, ...) do { printk(KERN_ERR fmt, ## __VA_ARGS__); } while (0) /* ## is GCC specific syntax to remove comma when single arg */
-+
- #ifdef BCMDBG_ERR
- #define	WL_ERROR(args)		WL_PRINT(args)
- #else
--#define	WL_ERROR(args)
-+#define	WL_ERROR(args)		FORCE_TRACE_LEVEL args
- #endif 
- #define	WL_TRACE(args)
- #define WL_APSTA_UPDN(args)
---- a/src/wl/sys/wl_linux.c	2014-06-26 12:42:08.000000000 +0200
-+++ b/src/wl/sys/wl_linux.c	2015-04-13 13:19:52.443345832 +0200
-@@ -878,7 +878,7 @@
- static SIMPLE_DEV_PM_OPS(wl_pm_ops, wl_suspend, wl_resume);
- #endif
- 
--static struct pci_driver wl_pci_driver = {
-+static struct pci_driver wl_pci_driver __refdata = {
- 	.name =		"wl",
- 	.probe =	wl_pci_probe,
- 	.remove =	__devexit_p(wl_remove),
-@@ -1270,6 +1270,7 @@
- 		MFREE(wl->osh, wlif->dev, sizeof(struct net_device));
- #else
- 		free_netdev(wlif->dev);
-+		wlif->dev = NULL;
- #endif 
- 	}
- 
-@@ -1307,7 +1308,12 @@
- 	dev->priv = priv_link;
- #else
- 
-+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 17, 0))
- 	dev = alloc_netdev(sizeof(priv_link_t), intf_name, ether_setup);
-+#else
-+	dev = alloc_netdev(sizeof(priv_link_t), intf_name, NET_NAME_UNKNOWN,
-+			   ether_setup);
-+#endif
- 	if (!dev) {
- 		WL_ERROR(("wl%d: %s: alloc_netdev failed\n",
- 			(wl->pub)?wl->pub->unit:wlif->subunit, __FUNCTION__));
-@@ -1651,11 +1657,7 @@
- 	}
- 
- 	WL_LOCK(wl);
--	if (!capable(CAP_NET_ADMIN)) {
--		bcmerror = BCME_EPERM;
--	} else {
--		bcmerror = wlc_ioctl(wl->wlc, ioc.cmd, buf, ioc.len, wlif->wlcif);
--	}
-+	bcmerror = wlc_ioctl(wl->wlc, ioc.cmd, buf, ioc.len, wlif->wlcif);
- 	WL_UNLOCK(wl);
- 
- done1:
-@@ -2157,8 +2159,8 @@
- 	wlif = WL_DEV_IF(dev);
- 	wl = WL_INFO(dev);
- 
-+	skb->prev = NULL;
- 	if (WL_ALL_PASSIVE_ENAB(wl) || (WL_RTR() && WL_CONFIG_SMP())) {
--		skb->prev = NULL;
- 
- 		TXQ_LOCK(wl);
- 
-@@ -2455,8 +2457,10 @@
- 		p80211msg_t *phdr;
- 
- 		len = sizeof(p80211msg_t) + oskb->len - D11_PHY_HDR_LEN;
--		if ((skb = dev_alloc_skb(len)) == NULL)
-+		if ((skb = dev_alloc_skb(len)) == NULL) {
-+			WL_ERROR(("in %s:%d [%s()] dev_alloc_skb() failure!", __FILE__, __LINE__, __FUNCTION__));
- 			return;
-+		}
- 
- 		skb_put(skb, len);
- 		phdr = (p80211msg_t*)skb->data;
-@@ -2535,8 +2539,10 @@
- 			rtap_len = sizeof(wl_radiotap_ht_brcm_2_t);
- 
- 		len = rtap_len + (oskb->len - D11_PHY_HDR_LEN);
--		if ((skb = dev_alloc_skb(len)) == NULL)
-+		if ((skb = dev_alloc_skb(len)) == NULL) {
-+			WL_ERROR(("in %s:%d [%s()] dev_alloc_skb() failure!", __FILE__, __LINE__, __FUNCTION__));
- 			return;
-+		}
- 
- 		skb_put(skb, len);
- 
-@@ -2664,8 +2670,10 @@
- 			len += amsdu_len;
- 		}
- 
--		if ((skb = dev_alloc_skb(len)) == NULL)
-+		if ((skb = dev_alloc_skb(len)) == NULL) {
-+			WL_ERROR(("in %s:%d [%s()] dev_alloc_skb() failure!", __FILE__, __LINE__, __FUNCTION__));
- 			return;
-+		}
- 
- 		skb_put(skb, len);
- 
-@@ -2990,7 +2998,7 @@
- }
- 
- void
--wl_set_monitor(wl_info_t *wl, int val)
-+wl_set_monitor(wl_info_t *wl, int val) /* public => is called by wlc_hybrid.o_shipped */
- {
- 	const char *devname;
- 	wl_if_t *wlif;
-@@ -3224,42 +3232,75 @@
- #if LINUX_VERSION_CODE < KERNEL_VERSION(3, 10, 0)
- static int
- wl_proc_read(char *buffer, char **start, off_t offset, int length, int *eof, void *data)
-+{
-+	wl_info_t * wl = (wl_info_t *)data;
- #else
- static ssize_t
--wl_proc_read(struct file *filp, char __user *buffer, size_t length, loff_t *data)
--#endif
-+wl_proc_read(struct file *filp, char __user *buffer, size_t length, loff_t *offp)
- {
--	wl_info_t * wl = (wl_info_t *)data;
--	int to_user;
--	int len;
-+	wl_info_t * wl = PDE_DATA(file_inode(filp));
-+#endif
-+	int bcmerror, len;
-+	int to_user = 0;
-+	char tmp[8];
- 
- #if LINUX_VERSION_CODE < KERNEL_VERSION(3, 10, 0)
- 	if (offset > 0) {
- 		*eof = 1;
- 		return 0;
- 	}
-+#else
-+	if (*offp > 0) { /* for example, stop: cat /proc/brcm_monitor0 */
-+		return 0; /* 0 <=> EOF */
-+	}
- #endif
- 
--	if (!length) {
--		WL_ERROR(("%s: Not enough return buf space\n", __FUNCTION__));
--		return 0;
--	}
- 	WL_LOCK(wl);
--	wlc_ioctl(wl->wlc, WLC_GET_MONITOR, &to_user, sizeof(int), NULL);
--	len = sprintf(buffer, "%d\n", to_user);
--	WL_UNLOCK(wl);
--	return len;
-+	bcmerror = wlc_ioctl(wl->wlc, WLC_GET_MONITOR, &to_user, sizeof(int), NULL);
-+ 	WL_UNLOCK(wl);
-+
-+	if (bcmerror != BCME_OK) {
-+		WL_ERROR(("%s: GET_MONITOR failed with %d\n", __FUNCTION__, bcmerror));
-+		return -EIO;
-+	}
-+
-+ 	len = snprintf(tmp, ARRAY_SIZE(tmp), "%d\n", to_user);
-+	tmp[ARRAY_SIZE(tmp) - 1] = '\0';
-+	if (len >= ARRAY_SIZE(tmp)) {
-+		printk(KERN_ERR "%s:%d [%s()] output would be truncated (ret=%d)!", __FILE__, __LINE__, __FUNCTION__, len);
-+		return -ERANGE;
-+	}
-+	else if (len < 0) {
-+		printk(KERN_ERR "%s:%d [%s()] unable to convert value (ret=%d)!", __FILE__, __LINE__, __FUNCTION__, len);
-+		return len;
-+	}
-+	if (length < len) {
-+		printk(KERN_ERR "%s:%d [%s()] user buffer is too small (at least=%d ; user=%d)!", __FILE__, __LINE__, __FUNCTION__, len, (int)length);
-+		return -EMSGSIZE;
-+	}
-+	if (copy_to_user(buffer, tmp, len) != 0) {
-+		printk(KERN_ERR "%s:%d [%s()] unable to copy data!", __FILE__, __LINE__, __FUNCTION__);
-+		return -EFAULT;
-+	}
-+	
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 10, 0)
-+	*offp += len;
-+#endif
-+
-+ 	return len;
- }
- 
- #if LINUX_VERSION_CODE < KERNEL_VERSION(3, 10, 0)
- static int
- wl_proc_write(struct file *filp, const char *buff, unsigned long length, void *data)
-+{
-+	wl_info_t * wl = (wl_info_t *)data;
- #else
- static ssize_t
--wl_proc_write(struct file *filp, const char __user *buff, size_t length, loff_t *data)
--#endif
-+wl_proc_write(struct file *filp, const char __user *buff, size_t length, loff_t *offp)
- {
--	wl_info_t * wl = (wl_info_t *)data;
-+	wl_info_t * wl = PDE_DATA(file_inode(filp));
-+#endif
- 	int from_user = 0;
- 	int bcmerror;
- 
-@@ -3270,7 +3311,11 @@
- 	}
- 	if (copy_from_user(&from_user, buff, 1)) {
- 		WL_ERROR(("%s: copy from user failed\n", __FUNCTION__));
--		return -EIO;
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 10, 0)
-+ 		return -EIO;
-+#else
-+		return -EFAULT;
-+#endif
- 	}
- 
- 	if (from_user >= 0x30)
-@@ -3280,10 +3325,15 @@
- 	bcmerror = wlc_ioctl(wl->wlc, WLC_SET_MONITOR, &from_user, sizeof(int), NULL);
- 	WL_UNLOCK(wl);
- 
--	if (bcmerror < 0) {
-+	if (bcmerror != BCME_OK) {
- 		WL_ERROR(("%s: SET_MONITOR failed with %d\n", __FUNCTION__, bcmerror));
- 		return -EIO;
- 	}
-+	
-+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 10, 0)) && 0 /* no need to update offset because this file should only trigger action... */
-+	*offp += length;
-+#endif
-+
- 	return length;
- }
- 
-@@ -3304,8 +3354,8 @@
- 	if ((wl->proc_entry = create_proc_entry(tmp, 0644, NULL)) == NULL) {
- 		WL_ERROR(("%s: create_proc_entry %s failed\n", __FUNCTION__, tmp));
- #else
--	if ((wl->proc_entry = proc_create(tmp, 0644, NULL, &wl_fops)) == NULL) {
--		WL_ERROR(("%s: proc_create %s failed\n", __FUNCTION__, tmp));
-+	if ((wl->proc_entry = proc_create_data(tmp, 0644, NULL, &wl_fops, wl)) == NULL) {
-+		WL_ERROR(("%s: proc_create_data %s failed\n", __FUNCTION__, tmp));
- #endif
- 		ASSERT(0);
- 		return -1;
diff --git a/pkgs/os-specific/linux/broadcom-sta/null-pointer-fix.patch b/pkgs/os-specific/linux/broadcom-sta/null-pointer-fix.patch
new file mode 100644
index 000000000000..763797294307
--- /dev/null
+++ b/pkgs/os-specific/linux/broadcom-sta/null-pointer-fix.patch
@@ -0,0 +1,13 @@
+diff -urN a/src/wl/sys/wl_linux.c b/src/wl/sys/wl_linux.c
+--- a/src/wl/sys/wl_linux.c	2015-01-06 12:33:42.981659618 +0100
++++ b/src/wl/sys/wl_linux.c	2015-01-06 12:34:05.647395418 +0100
+@@ -2157,8 +2157,8 @@
+ 	wlif = WL_DEV_IF(dev);
+ 	wl = WL_INFO(dev);
+ 
++	skb->prev = NULL;
+ 	if (WL_ALL_PASSIVE_ENAB(wl) || (WL_RTR() && WL_CONFIG_SMP())) {
+-		skb->prev = NULL;
+ 
+ 		TXQ_LOCK(wl);
+ 
diff --git a/pkgs/os-specific/linux/kernel/patches.nix b/pkgs/os-specific/linux/kernel/patches.nix
index e538a527f507..375f0e3b0b42 100644
--- a/pkgs/os-specific/linux/kernel/patches.nix
+++ b/pkgs/os-specific/linux/kernel/patches.nix
@@ -94,8 +94,8 @@ rec {
 
   grsecurity_testing = grsecPatch
     { kver   = "4.6.5";
-      grrev  = "201607272152";
-      sha256 = "120rj3cpvbchihj3w3i9j2fxvap3270kfxjfznw2ljglzf7pi8zc";
+      grrev  = "201607312210";
+      sha256 = "17dnp6w092kvqxqxbdgjpl4mrsn2wkb7z8q5d8ck7dfanpmqap0w";
     };
 
   # This patch relaxes grsec constraints on the location of usermode helpers,
diff --git a/pkgs/os-specific/linux/nvidia-x11/365.35-kernel-4.7.patch b/pkgs/os-specific/linux/nvidia-x11/365.35-kernel-4.7.patch
new file mode 100644
index 000000000000..8d1436c50940
--- /dev/null
+++ b/pkgs/os-specific/linux/nvidia-x11/365.35-kernel-4.7.patch
@@ -0,0 +1,40 @@
+diff -Naur NVIDIA-Linux-x86_64-367.35-no-compat32-upstream/kernel/nvidia-drm/nvidia-drm-fb.c NVIDIA-Linux-x86_64-367.35-no-compat32/kernel/nvidia-drm/nvidia-drm-fb.c
+--- NVIDIA-Linux-x86_64-367.35-no-compat32-upstream/kernel/nvidia-drm/nvidia-drm-fb.c	2016-07-31 19:07:06.595038290 -0400
++++ NVIDIA-Linux-x86_64-367.35-no-compat32/kernel/nvidia-drm/nvidia-drm-fb.c	2016-07-31 19:09:18.532197060 -0400
+@@ -114,7 +114,7 @@
+      * We don't support any planar format, pick up first buffer only.
+      */
+ 
+-    gem = drm_gem_object_lookup(dev, file, cmd->handles[0]);
++    gem = drm_gem_object_lookup(file, cmd->handles[0]);
+ 
+     if (gem == NULL)
+     {
+diff -Naur NVIDIA-Linux-x86_64-367.35-no-compat32-upstream/kernel/nvidia-drm/nvidia-drm-gem.c NVIDIA-Linux-x86_64-367.35-no-compat32/kernel/nvidia-drm/nvidia-drm-gem.c
+--- NVIDIA-Linux-x86_64-367.35-no-compat32-upstream/kernel/nvidia-drm/nvidia-drm-gem.c	2016-07-31 19:07:06.595038290 -0400
++++ NVIDIA-Linux-x86_64-367.35-no-compat32/kernel/nvidia-drm/nvidia-drm-gem.c	2016-07-31 19:08:56.187492736 -0400
+@@ -408,7 +408,7 @@
+ 
+     mutex_lock(&dev->struct_mutex);
+ 
+-    gem = drm_gem_object_lookup(dev, file, handle);
++    gem = drm_gem_object_lookup(file, handle);
+ 
+     if (gem == NULL)
+     {
+diff -Naur NVIDIA-Linux-x86_64-367.35-no-compat32-upstream/kernel/nvidia-uvm/uvm_linux.h NVIDIA-Linux-x86_64-367.35-no-compat32/kernel/nvidia-uvm/uvm_linux.h
+--- NVIDIA-Linux-x86_64-367.35-no-compat32-upstream/kernel/nvidia-uvm/uvm_linux.h	2016-07-31 19:07:06.600038448 -0400
++++ NVIDIA-Linux-x86_64-367.35-no-compat32/kernel/nvidia-uvm/uvm_linux.h	2016-07-31 19:08:06.506926763 -0400
+@@ -554,12 +554,6 @@
+     INIT_RADIX_TREE(tree, GFP_NOWAIT);
+ }
+ 
+-static bool radix_tree_empty(struct radix_tree_root *tree)
+-{
+-    void *dummy;
+-    return radix_tree_gang_lookup(tree, &dummy, 0, 1) == 0;
+-}
+-
+ 
+ #if !defined(NV_USLEEP_RANGE_PRESENT)
+ static void __sched usleep_range(unsigned long min, unsigned long max)
diff --git a/pkgs/os-specific/linux/nvidia-x11/default.nix b/pkgs/os-specific/linux/nvidia-x11/default.nix
index 30a3a912d43b..8ca01b7499e2 100644
--- a/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/default.nix
@@ -12,7 +12,7 @@ assert (!libsOnly) -> kernel != null;
 
 let
 
-  versionNumber = "361.45.11";
+  versionNumber = "367.35";
 
   # Policy: use the highest stable version as the default (on our master).
   inherit (stdenv.lib) makeLibraryPath;
@@ -28,12 +28,12 @@ stdenv.mkDerivation {
     if stdenv.system == "i686-linux" then
       fetchurl {
         url = "http://download.nvidia.com/XFree86/Linux-x86/${versionNumber}/NVIDIA-Linux-x86-${versionNumber}.run";
-        sha256 = "036v7bzh9zy7zvaz2wf7zsamrynbg1yr1dll7sf1l928w059i6pb";
+        sha256 = "05g36bxcfk21ab8b0ay3zy21k5nd71468p9y1nbflx7ghpx25jrq";
       }
     else if stdenv.system == "x86_64-linux" then
       fetchurl {
         url = "http://download.nvidia.com/XFree86/Linux-x86_64/${versionNumber}/NVIDIA-Linux-x86_64-${versionNumber}-no-compat32.run";
-        sha256 = "1f8bxmf8cr3cgzxgap5ccb1yrqyrrdig19dp282y6z9xjq27l074";
+        sha256 = "0m4k8f0212l63h22wk6hgi8fbfsgxqih5mizsw4ixqqmjd75av4a";
       }
     else throw "nvidia-x11 does not support platform ${stdenv.system}";
 
@@ -53,6 +53,8 @@ stdenv.mkDerivation {
     [ gtk atk pango glib gdk_pixbuf cairo ] );
   programPath = makeLibraryPath [ xorg.libXv ];
 
+  patches = if versionAtLeast kernel.version "4.7" then [ ./365.35-kernel-4.7.patch ] else [];
+
   buildInputs = [ perl nukeReferences ];
 
   hardeningDisable = [ "pic" "format" ];
diff --git a/pkgs/servers/nosql/redis/default.nix b/pkgs/servers/nosql/redis/default.nix
index 16a2ec210794..69d6377b664a 100644
--- a/pkgs/servers/nosql/redis/default.nix
+++ b/pkgs/servers/nosql/redis/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, lua }:
 
 stdenv.mkDerivation rec {
-  version = "3.0.7";
+  version = "3.2.2";
   name = "redis-${version}";
 
   src = fetchurl {
     url = "http://download.redis.io/releases/${name}.tar.gz";
-    sha256 = "08vzfdr67gp3lvk770qpax2c5g2sx8hn6p64jn3jddrvxb2939xj";
+    sha256 = "05cf63502b2248b5d39588962100bfa4fcb47dabd56931a8cb60b301b1d8daea";
   };
 
   buildInputs = [ lua ];
diff --git a/pkgs/tools/audio/beets/default.nix b/pkgs/tools/audio/beets/default.nix
index 33de429d5312..9dcfbd10b353 100644
--- a/pkgs/tools/audio/beets/default.nix
+++ b/pkgs/tools/audio/beets/default.nix
@@ -6,7 +6,6 @@
 , enableBadfiles       ? true, flac ? null, mp3val ? null
 , enableConvert        ? true, ffmpeg ? null
 , enableDiscogs        ? true
-, enableEchonest       ? true
 , enableEmbyupdate     ? true
 , enableFetchart       ? true
 , enableLastfm         ? true
@@ -25,7 +24,6 @@ assert enableAcoustid    -> pythonPackages.pyacoustid     != null;
 assert enableBadfiles    -> flac != null && mp3val != null;
 assert enableConvert     -> ffmpeg != null;
 assert enableDiscogs     -> pythonPackages.discogs_client != null;
-assert enableEchonest    -> pythonPackages.pyechonest     != null;
 assert enableFetchart    -> pythonPackages.responses      != null;
 assert enableLastfm      -> pythonPackages.pylast         != null;
 assert enableMpd         -> pythonPackages.mpd            != null;
@@ -42,7 +40,6 @@ let
     chroma = enableAcoustid;
     convert = enableConvert;
     discogs = enableDiscogs;
-    echonest = enableEchonest;
     embyupdate = enableEmbyupdate;
     fetchart = enableFetchart;
     lastgenre = enableLastfm;
@@ -55,8 +52,8 @@ let
   };
 
   pluginsWithoutDeps = [
-    "bench" "bpd" "bpm" "bucket" "cue" "duplicates" "edit" "embedart"
-    "filefilter" "freedesktop" "fromfilename" "ftintitle" "fuzzy" "ihate"
+    "beatport" "bench" "bpd" "bpm" "bucket" "cue" "duplicates" "edit" "embedart"
+    "export" "filefilter" "freedesktop" "fromfilename" "ftintitle" "fuzzy" "hook" "ihate"
     "importadded" "importfeeds" "info" "inline" "ipfs" "keyfinder" "lyrics"
     "mbcollection" "mbsubmit" "mbsync" "metasync" "missing" "permissions" "play"
     "plexupdate" "random" "rewrite" "scrub" "smartplaylist" "spotify" "the"
@@ -73,14 +70,14 @@ let
 
 in buildPythonApplication rec {
   name = "beets-${version}";
-  version = "1.3.17";
+  version = "1.3.19";
   namePrefix = "";
 
   src = fetchFromGitHub {
     owner = "sampsyo";
     repo = "beets";
     rev = "v${version}";
-    sha256 = "1fskxx5xxjqf4xmfjrinh7idjiq6qncb24hiyccv09l47fr1yipc";
+    sha256 = "0f2v1924ryx5xijpv1jycanl4471vcd7c5lld58lm0viyvh5k28x";
   };
 
   propagatedBuildInputs = [
@@ -101,7 +98,6 @@ in buildPythonApplication rec {
                                    pythonPackages.requests2
     ++ optional enableConvert      ffmpeg
     ++ optional enableDiscogs      pythonPackages.discogs_client
-    ++ optional enableEchonest     pythonPackages.pyechonest
     ++ optional enableLastfm       pythonPackages.pylast
     ++ optional enableMpd          pythonPackages.mpd
     ++ optional enableThumbnails   pythonPackages.pyxdg
diff --git a/pkgs/tools/backup/rdup/default.nix b/pkgs/tools/backup/rdup/default.nix
new file mode 100644
index 000000000000..8ca07e2c8235
--- /dev/null
+++ b/pkgs/tools/backup/rdup/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, fetchFromGitHub, pkgconfig, autoreconfHook, glib, pcre }:
+
+stdenv.mkDerivation rec {
+  name = "rdup-${version}";
+  version = "1.1.15";
+
+  src = fetchFromGitHub {
+    owner = "miekg";
+    repo = "rdup";
+    rev = "d66e4320cd0bbcc83253baddafe87f9e0e83caa6";
+    sha256 = "0bzyv6qmnivxnv9nw7lnfn46k0m1dlxcjj53zcva6v8y8084l1iw";
+  };
+
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  buildInputs = [ glib pcre ];
+
+  meta = {
+    description = "The only backup program that doesn't make backups";
+    homepage    = "https://github.com/miekg/rdup";
+    license    = stdenv.lib.licenses.gpl3;
+    platforms   = stdenv.lib.platforms.linux;
+    maintainers = with stdenv.lib.maintainers; [ lukasepple ];
+  };
+}
diff --git a/pkgs/tools/misc/cpuminer-multi/default.nix b/pkgs/tools/misc/cpuminer-multi/default.nix
index 5657703d3f22..9c8a54b5545c 100644
--- a/pkgs/tools/misc/cpuminer-multi/default.nix
+++ b/pkgs/tools/misc/cpuminer-multi/default.nix
@@ -2,8 +2,8 @@
 , aesni ? true }:
 
 let
-  rev = "977dad27e18627e5b723800f5f4201e385fe0d2e";
-  date = "20140723";
+  rev = "8393e03089c0abde61bd5d72aba8f926c3d6eca4";
+  date = "20160316";
 in
 stdenv.mkDerivation rec {
   name = "cpuminer-multi-${date}-${stdenv.lib.strings.substring 0 7 rev}";
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
   src = fetchgit {
     inherit rev;
     url = https://github.com/wolf9466/cpuminer-multi.git;
-    sha256 = "1lzaiwy2wk9awpzpfnp3d6dymnb4bvgw1vg2433plfqhi9jfdrqj";
+    sha256 = "11dg4rra4dgfb9x6q85irn0hrkx2lkwyrdpgdh10pag09s3vhy4v";
   };
 
   buildInputs = [ autoconf automake curl jansson ];
@@ -27,5 +27,6 @@ stdenv.mkDerivation rec {
     homepage = https://github.com/wolf9466/cpuminer-multi;
     license = licenses.gpl2;
     maintainers = [ maintainers.ehmry ];
+    platforms = platforms.linux;
   };
-}
\ No newline at end of file
+}
diff --git a/pkgs/tools/misc/tmuxp/default.nix b/pkgs/tools/misc/tmuxp/default.nix
new file mode 100644
index 000000000000..08dcc184b3ce
--- /dev/null
+++ b/pkgs/tools/misc/tmuxp/default.nix
@@ -0,0 +1,25 @@
+{ stdenv, fetchurl, pythonPackages }:
+
+pythonPackages.buildPythonApplication rec {
+  name = "tmuxp-${version}";
+  version = "1.2.0";
+
+  namePrefix = "";
+
+  src = fetchurl {
+    url = "mirror://pypi/t/tmuxp/${name}.tar.gz";
+    sha256 = "05z5ssv9glsqmcy9fdq06bawy1274dnzqsqd3a4z4jd0w6j09smn";
+  };
+
+  propagatedBuildInputs = with pythonPackages; [
+    click colorama kaptan libtmux
+  ];
+
+  meta = with stdenv.lib; {
+    description = "Manage tmux workspaces from JSON and YAML";
+    homepage = "http://tmuxp.readthedocs.io";
+    license = licenses.bsd3;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ jgeerds ];
+  };
+}
diff --git a/pkgs/tools/misc/vdirsyncer/default.nix b/pkgs/tools/misc/vdirsyncer/default.nix
index 1a8621effd54..51762006b623 100644
--- a/pkgs/tools/misc/vdirsyncer/default.nix
+++ b/pkgs/tools/misc/vdirsyncer/default.nix
@@ -3,12 +3,12 @@
 # Packaging documentation at:
 # https://github.com/untitaker/vdirsyncer/blob/master/docs/packaging.rst
 pythonPackages.buildPythonApplication rec {
-  version = "0.11.2";
+  version = "0.11.3";
   name = "vdirsyncer-${version}";
 
   src = fetchurl {
     url = "mirror://pypi/v/vdirsyncer/${name}.tar.gz";
-    sha256 = "15isw2jhjfxi213wdj9d8mwq2m58k8bwf831qnxrjcz7j7bwy7mj";
+    sha256 = "10majl58vdpxgbddjqgwblvl7akvvr4c2c8iaxnf3kgyh01jq6k9";
   };
 
   propagatedBuildInputs = with pythonPackages; [
diff --git a/pkgs/tools/networking/dnscrypt-proxy/default.nix b/pkgs/tools/networking/dnscrypt-proxy/default.nix
index 3dadbeedd4df..1eac3cf6c027 100644
--- a/pkgs/tools/networking/dnscrypt-proxy/default.nix
+++ b/pkgs/tools/networking/dnscrypt-proxy/default.nix
@@ -4,11 +4,11 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   name = "dnscrypt-proxy-${version}";
-  version = "1.6.1";
+  version = "1.7.0";
 
   src = fetchurl {
     url = "https://download.dnscrypt.org/dnscrypt-proxy/${name}.tar.bz2";
-    sha256 = "16lif3qhyfjpgg54vjlwpslxk90akmbhlpnn1szxm628bmpw6nl9";
+    sha256 = "1qw2nib0d5ia8581lbdnjxgn9c7pf2qw8vhpnnh1wjcjj3gpgbqx";
   };
 
   configureFlags = optional stdenv.isLinux "--with-systemd";
diff --git a/pkgs/tools/networking/unbound/python.nix b/pkgs/tools/networking/unbound/python.nix
new file mode 100644
index 000000000000..5d7096ab168f
--- /dev/null
+++ b/pkgs/tools/networking/unbound/python.nix
@@ -0,0 +1,65 @@
+{ stdenv, fetchurl, openssl, expat, libevent, swig, pythonPackages }:
+
+let
+  inherit (pythonPackages) python;
+in stdenv.mkDerivation rec {
+  pname = "pyunbound";
+  name = "${pname}-${version}";
+  version = "1.5.9";
+
+  src = fetchurl {
+    url = "http://unbound.net/downloads/unbound-${version}.tar.gz";
+    sha256 = "01328cfac99ab5b8c47115151896a244979e442e284eb962c0ea84b7782b6990";
+  };
+
+  buildInputs = [ openssl expat libevent swig python ];
+
+  patchPhase = ''substituteInPlace Makefile.in \
+    --replace "\$(DESTDIR)\$(PYTHON_SITE_PKG)" "$out/${python.sitePackages}" \
+    --replace "\$(LIBTOOL) --mode=install cp _unbound.la" "cp _unbound.la"
+    '';
+
+  preConfigure = "export PYTHON_VERSION=${python.majorVersion}";
+
+  configureFlags = [
+    "--with-ssl=${openssl.dev}"
+    "--with-libexpat=${expat.dev}"
+    "--with-libevent=${libevent.dev}"
+    "--localstatedir=/var"
+    "--sysconfdir=/etc"
+    "--sbindir=\${out}/bin"
+    "--enable-pie"
+    "--enable-relro-now"
+    "--with-pyunbound"
+    "DESTDIR=$out PREFIX="
+  ];
+
+  preInstall = ''
+    mkdir -p $out/${python.sitePackages} $out/etc/${pname}
+    cp .libs/_unbound.so .libs/libunbound.so* $out/${python.sitePackages}
+    substituteInPlace _unbound.la \
+      --replace "-L.libs $PWD/libunbound.la" "-L$out/${python.sitePackages}" \
+      --replace "libdir=\'$PWD/${python.sitePackages}\'" "libdir=\'$out/${python.sitePackages}\'"
+    '';
+
+  installFlags = [ "configfile=\${out}/etc/unbound/unbound.conf pyunbound-install lib" ];
+
+  # All we want is the Unbound Python module
+  postInstall = ''
+    # Generate the built in root anchor and root key and store these in a logical place 
+    # to be used by tools depending only on the Python module
+    $out/bin/unbound-anchor -l | head -1 > $out/etc/${pname}/root.anchor
+    $out/bin/unbound-anchor -l | tail --lines=+2 - > $out/etc/${pname}/root.key
+    # We don't need anything else
+    rm -fR $out/bin $out/share $out/include $out/etc/unbound
+    patchelf --replace-needed libunbound.so.2 $out/${python.sitePackages}/libunbound.so.2 $out/${python.sitePackages}/_unbound.so 
+    '';
+
+  meta = with stdenv.lib; {
+    description = "Python library for Unbound, the validating, recursive, and caching DNS resolver";
+    license = licenses.bsd3;
+    homepage = http://www.unbound.net;
+    maintainers = with maintainers; [ leenaars ];
+    platforms = stdenv.lib.platforms.unix;
+  };
+}
diff --git a/pkgs/tools/security/afl/default.nix b/pkgs/tools/security/afl/default.nix
index a252dad5ea12..eac593e00767 100644
--- a/pkgs/tools/security/afl/default.nix
+++ b/pkgs/tools/security/afl/default.nix
@@ -9,11 +9,11 @@ let
 in
 stdenv.mkDerivation rec {
   name    = "afl-${version}";
-  version = "2.10b";
+  version = "2.23b";
 
   src = fetchurl {
     url    = "http://lcamtuf.coredump.cx/afl/releases/${name}.tgz";
-    sha256 = "1qxz3szsdr3ciz496mjb5v2k8p90nilgnlbwwv9csk828qb2jhc1";
+    sha256 = "152pqrc0py6jk1i3pwn2k928bsgax0d4yavpa3ca29bmrbzpnadh";
   };
 
   # Note: libcgroup isn't needed for building, just for the afl-cgroup
diff --git a/pkgs/tools/security/hash-slinger/default.nix b/pkgs/tools/security/hash-slinger/default.nix
new file mode 100644
index 000000000000..4d60b11f977c
--- /dev/null
+++ b/pkgs/tools/security/hash-slinger/default.nix
@@ -0,0 +1,46 @@
+{ stdenv, fetchFromGitHub, pythonPackages, openssh, gnupg, unbound, libreswan }:
+
+let
+  inherit (pythonPackages) python;
+in stdenv.mkDerivation rec {
+  pname    = "hash-slinger";
+  name    = "${pname}-${version}";
+  version = "2.7";
+
+  src = fetchFromGitHub {
+    owner = "letoams";
+    repo = "${pname}";
+    rev = "${version}";
+    sha256 = "05wn744ydclpnpyah6yfjqlfjlasrrhzj48lqmm5a91nyps5yqyn";
+  };
+
+  pythonPath = with pythonPackages; [ dns m2crypto ipaddr python-gnupg
+                                      pyunbound ];
+
+  buildInputs = [ pythonPackages.wrapPython ];
+  propagatedBuildInputs = [ unbound libreswan ] ++ pythonPath;
+  propagatedUserEnvPkgs = [ unbound libreswan ];
+
+  patchPhase = ''
+    substituteInPlace Makefile \
+      --replace "$(DESTDIR)/usr" "$out"
+    substituteInPlace ipseckey \
+      --replace "/usr/sbin/ipsec" "${libreswan}/sbin/ipsec"
+    substituteInPlace tlsa \
+      --replace "/var/lib/unbound/root" "${pythonPackages.pyunbound}/etc/pyunbound/root"
+    patchShebangs *
+    '';
+
+  installPhase = ''
+    mkdir -p $out/bin $out/man $out/${python.sitePackages}/
+    make install
+    wrapPythonPrograms
+   '';
+
+   meta = {
+    description = "Various tools to generate special DNS records";
+    homepage    = "https://github.com/letoams/hash-slinger";
+    license     = stdenv.lib.licenses.gpl2Plus;
+    maintainers = [ stdenv.lib.maintainers.leenaars ];
+  };
+}
diff --git a/pkgs/tools/system/acct/default.nix b/pkgs/tools/system/acct/default.nix
index c99d20d7953e..4263709fe9ab 100644
--- a/pkgs/tools/system/acct/default.nix
+++ b/pkgs/tools/system/acct/default.nix
@@ -25,6 +25,6 @@ stdenv.mkDerivation rec {
     homepage = http://www.gnu.org/software/acct/;
 
     maintainers = with maintainers; [ pSub ];
-    platforms = with platforms; allBut cygwin;
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 5119c077f943..9cc72c442b7c 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1960,6 +1960,8 @@ in
 
   hashcat = callPackage ../tools/security/hashcat { };
 
+  hash-slinger = callPackage ../tools/security/hash-slinger { };
+
   hal-flash = callPackage ../os-specific/linux/hal-flash { };
 
   halibut = callPackage ../tools/typesetting/halibut { };
@@ -3692,6 +3694,8 @@ in
 
   tmux-cssh = callPackage ../tools/misc/tmux-cssh { };
 
+  tmuxp = callPackage ../tools/misc/tmuxp { };
+
   tmuxinator = callPackage ../tools/misc/tmuxinator { };
 
   tmin = callPackage ../tools/security/tmin { };
@@ -5448,9 +5452,7 @@ in
     stdenv = overrideCC stdenv gcc49;
   };
 
-  ponyc = callPackage ../development/compilers/ponyc {
-    llvm = llvm_36;
-  };
+  ponyc = callPackage ../development/compilers/ponyc { };
 
   rgbds = callPackage ../development/compilers/rgbds { };
 
@@ -5853,31 +5855,34 @@ in
   python2Packages = python27Packages;
   python3Packages = python35Packages;
 
-  python26 = callPackage ../development/interpreters/python/2.6 {
+  python26 = callPackage ../development/interpreters/python/cpython/2.6 {
     db = db47;
     self = python26;
   };
-  python27 = callPackage ../development/interpreters/python/2.7 {
+  python27 = callPackage ../development/interpreters/python/cpython/2.7 {
     self = python27;
     inherit (darwin) CF configd;
   };
-  python33 = callPackage ../development/interpreters/python/3.3 {
+  python33 = callPackage ../development/interpreters/python/cpython/3.3 {
     self = python33;
   };
-  python34 = hiPrio (callPackage ../development/interpreters/python/3.4 {
+  python34 = hiPrio (callPackage ../development/interpreters/python/cpython/3.4 {
     inherit (darwin) CF configd;
     self = python34;
   });
-  python35 = hiPrio (callPackage ../development/interpreters/python/3.5 {
+  python35 = hiPrio (callPackage ../development/interpreters/python/cpython/3.5 {
     inherit (darwin) CF configd;
     self = python35;
   });
-  python36 = callPackage ../development/interpreters/python/3.6 {
+  python36 = callPackage ../development/interpreters/python/cpython/3.6 {
     inherit (darwin) CF configd;
     self = python36;
   };
-  pypy = callPackage ../development/interpreters/pypy {
-    self = pypy;
+
+  pypy = pypy27;
+
+  pypy27 = callPackage ../development/interpreters/python/pypy/2.7 {
+    self = pypy27;
   };
 
   pythonFull = python2Full;
@@ -5893,7 +5898,7 @@ in
 
   python2nix = callPackage ../tools/package-management/python2nix { };
 
-  pythonDocs = recurseIntoAttrs (callPackage ../development/interpreters/python/docs {});
+  pythonDocs = recurseIntoAttrs (callPackage ../development/interpreters/python/cpython/docs {});
 
   pypi2nix = callPackage ../development/tools/pypi2nix { python = python35; };
 
@@ -13848,6 +13853,8 @@ in
     inherit (gnome) libgnomecanvas glib;
   };
 
+  moonlight-embedded = callPackage ../applications/misc/moonlight-embedded { };
+
   mop = callPackage ../applications/misc/mop { };
 
   mopidy = callPackage ../applications/audio/mopidy { };
@@ -14075,6 +14082,8 @@ in
     sphinx = pythonPackages.sphinx;
   };
 
+  notmuch-mutt = callPackage ../applications/networking/mailreaders/notmuch/mutt.nix { };
+
   # Open Stack
   nova = callPackage ../applications/virtualization/openstack/nova.nix { };
   keystone = callPackage ../applications/virtualization/openstack/keystone.nix { };
@@ -14390,6 +14399,8 @@ in
 
   rdesktop = callPackage ../applications/networking/remote/rdesktop { };
 
+  rdup = callPackage ../tools/backup/rdup { };
+
   recode = callPackage ../tools/text/recode { };
 
   remotebox = callPackage ../applications/virtualization/remotebox { };
@@ -15617,6 +15628,8 @@ in
 
   hexen = callPackage ../games/hexen { };
 
+  holdingnuts = callPackage ../games/holdingnuts { };
+
   icbm3d = callPackage ../games/icbm3d { };
 
   ingen = callPackage ../applications/audio/ingen {
@@ -16953,6 +16966,8 @@ in
 
   dbus-map = callPackage ../tools/misc/dbus-map { };
 
+  dell-530cdn = callPackage ../misc/drivers/dell-530cdn {};
+
   dosbox = callPackage ../misc/emulators/dosbox { };
 
   dpkg = callPackage ../tools/package-management/dpkg { };
diff --git a/pkgs/top-level/make-tarball.nix b/pkgs/top-level/make-tarball.nix
index b664dceaa954..2fe69390ec5b 100644
--- a/pkgs/top-level/make-tarball.nix
+++ b/pkgs/top-level/make-tarball.nix
@@ -15,7 +15,7 @@ releaseTools.sourceTarball rec {
   src = nixpkgs;
 
   inherit officialRelease;
-  version = builtins.readFile ../../.version;
+  version = pkgs.lib.fileContents ../../.version;
   versionSuffix = "pre${toString nixpkgs.revCount}.${nixpkgs.shortRev}";
 
   buildInputs = [ nix.out jq ];
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index e87964fd9a6d..d746a45753c9 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -6956,6 +6956,15 @@ let self = _self // overrides; _self = with self; {
     };
   };
 
+  Later = buildPerlPackage rec {
+    version = "0.19";
+    name = "Object-Realize-Later-${version}";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/M/MA/MARKOV/${name}.tar.gz";
+      sha256 = "0ka0qar51kk5wlvd2s3yis3w9qc14h0ngn0ds0v6c8ssmjvfcgbz";
+    };
+  };
+
   lib_ = buildPerlPackage {
     name = "lib-0.63";
     src = fetchurl {
@@ -7601,6 +7610,36 @@ let self = _self // overrides; _self = with self; {
     inherit fetchurl buildPerlPackage stdenv DBDmysql;
   };
 
+  MailMaildir = buildPerlPackage rec {
+    version = "1.0.0";
+    name = "Mail-Maildir-${version}";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/Z/ZE/ZEROALTI/Mail-Maildir-100/${name}.tar.bz2";
+      sha256 = "1krkqfps6q3ifrhi9450l5gm9199qyfcm6vidllr0dv65kdaqpj4";
+    };
+  };
+
+  MailBox = buildPerlPackage rec {
+    version = "2.118";
+    name = "Mail-Box-${version}";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/M/MA/MARKOV/${name}.tar.gz";
+      sha256 = "1ixi7xpvj8kn2y0l8rxkvdnnl7x5wqg7mi2av0viwdh5l828dcfc";
+    };
+
+    doCheck = false;
+
+    propagatedBuildInputs = [
+      Later
+
+      DevelGlobalDestruction
+      FileRemove
+      IOStringy
+      MailTools
+      MIMETypes
+    ];
+  };
+
   MailMboxMessageParser = buildPerlPackage rec {
     name = "Mail-Mbox-MessageParser-1.5105";
     src = fetchurl {
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 76fd4596e545..6dd8d613d72a 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -24,16 +24,6 @@ let
 
   buildPythonApplication = args: buildPythonPackage ({namePrefix="";} // args );
 
-  # Unique python version identifier
-  pythonName =
-    if isPy26 then "python26" else
-    if isPy27 then "python27" else
-    if isPy33 then "python33" else
-    if isPy34 then "python34" else
-    if isPy35 then "python35" else
-    if isPy36 then "python36" else
-    if isPyPy then "pypy" else "";
-
   modules = python.modules or {
     readline = null;
     sqlite3 = null;
@@ -44,7 +34,7 @@ let
 
 in modules // {
 
-  inherit python bootstrapped-pip isPy26 isPy27 isPy33 isPy34 isPy35 isPy36 isPyPy isPy3k pythonName buildPythonPackage buildPythonApplication;
+  inherit python bootstrapped-pip isPy26 isPy27 isPy33 isPy34 isPy35 isPy36 isPyPy isPy3k buildPythonPackage buildPythonApplication;
 
   # helpers
 
@@ -327,6 +317,8 @@ in modules // {
     hdf5 = pkgs.hdf5.override { zlib = pkgs.zlib; };
   };
 
+  pyunbound = callPackage ../tools/networking/unbound/python.nix { };
+
   # packages defined here
 
   aafigure = buildPythonPackage rec {
@@ -846,13 +838,13 @@ in modules // {
   };
 
   ansible2 = buildPythonPackage rec {
-    version = "2.1.0.0";
+    version = "2.1.1.0";
     name = "ansible-${version}";
     disabled = isPy3k;
 
     src = pkgs.fetchurl {
       url = "http://releases.ansible.com/ansible/${name}.tar.gz";
-      sha256 = "1bfc2xiplpad6f2nwi48y0kps7xqnsll85dlz63cy8k5bysl6d20";
+      sha256 = "12v7smivjz8d2skk5qxl83nmkxqxypjm8b7ld40sjfwj4g0kkrv1";
     };
 
     prePatch = ''
@@ -1359,13 +1351,13 @@ in modules // {
 
   awscli = buildPythonPackage rec {
     name = "awscli-${version}";
-    version = "1.10.46";
+    version = "1.10.51";
 
     namePrefix = "";
 
     src = pkgs.fetchurl {
       url = "mirror://pypi/a/awscli/${name}.tar.gz";
-      sha256 = "1d2xjhdmjna9zxa4ybk7cjypib5yq2gd3w5fgpb4lfs6bh3mr554";
+      sha256 = "19n7r6fwnwpi0cyrqh20w80mrcj0b6j3if5p58hi1k3fdp60nscq";
     };
 
     # No tests included
@@ -2776,12 +2768,12 @@ in modules // {
   };
 
   botocore = buildPythonPackage rec {
-    version = "1.4.36"; # This version is required by awscli
+    version = "1.4.41"; # This version is required by awscli
     name = "botocore-${version}";
 
     src = pkgs.fetchurl {
       url = "mirror://pypi/b/botocore/${name}.tar.gz";
-      sha256 = "0mkydnbbn0x97nfzwqia68zw2y5j7i9yzpq5kasvc80n2z999h39";
+      sha256 = "0c3abr2rxiilqklika8x360pr0mgx7hlhbhj8w72izs2r6ww4dys";
     };
 
     propagatedBuildInputs =
@@ -3225,7 +3217,7 @@ in modules // {
     name = "celery-${version}";
     version = "3.1.23";
 
-    disabled = pythonOlder "2.6";
+    disabled = (pythonOlder "2.6") || isPy35;
 
     src = pkgs.fetchurl {
       url = "mirror://pypi/c/celery/${name}.tar.gz";
@@ -4926,6 +4918,24 @@ in modules // {
     };
   };
 
+  libtmux = buildPythonPackage rec {
+    name = "libtmux-${version}";
+    version = "0.5.0";
+
+    src = pkgs.fetchurl {
+      url = "mirror://pypi/l/libtmux/${name}.tar.gz";
+      sha256 = "0fwydaahgflz9w753v1cmkfzrlfq1vb8zp4i20m2d3lvkm4crv93";
+    };
+
+    meta = with stdenv.lib; {
+      description = "Scripting library for tmux";
+      homepage = https://libtmux.readthedocs.io/;
+      license = licenses.bsd3;
+      platforms = platforms.linux;
+      maintainers = with maintainers; [ jgeerds ];
+    };
+  };
+
   locket = buildPythonPackage rec {
     name = "locket-${version}";
     version = "0.2.0";
@@ -8494,6 +8504,23 @@ in modules // {
     };
   };
 
+  schedule = buildPythonPackage rec {
+    name = "schedule-0.3.2";
+
+    src = pkgs.fetchurl {
+      url = "https://pypi.python.org/packages/10/96/d101fab391753ebc81fa3bb0e744df1ddcfb032c31b036d38083f8994db1/schedule-0.3.2.tar.gz";
+      sha256 = "1h0waw4jd5ql68y5kxb9irwapkbkwfs1w0asvbl24fq5f8czdijm";
+    };
+
+    buildInputs = with self; [ mock ];
+
+    meta = with stdenv.lib; {
+      description = "Python job scheduling for humans";
+      homepage = https://github.com/dbader/schedule;
+      license = licenses.mit;
+    };
+  };
+
   substanced = buildPythonPackage rec {
     # no release yet
     rev = "089818bc61c3dc5eca023254e37a280b041ea8cc";
@@ -9023,8 +9050,6 @@ in modules // {
     name = "django-colorful-${version}";
     version = "1.2";
 
-    disabled = isPy35;
-
     src = pkgs.fetchurl {
       url = "mirror://pypi/d/django-colorful/${name}.tar.gz";
       sha256 = "0y34hzvfrm1xbxrd8frybc9yzgqvz4c07frafipjikw7kfjsw8az";
@@ -9227,6 +9252,25 @@ in modules // {
     };
   };
 
+  django_raster = buildPythonPackage rec {
+    name = "django-raster-${version}";
+    version = "0.2";
+
+    src = pkgs.fetchurl {
+      url = "mirror://pypi/d/django-raster/${name}.tar.gz";
+      sha256 = "1zdcxzj43qrv7cl6q9nb2dkfnsyn74dzf2igpnd6nbbfdnkif9bm";
+    };
+
+    propagatedBuildInputs = with self ; [ numpy django_colorful pillow psycopg2
+                                          pyparsing django celery ];
+
+    meta = {
+      description = "Basic raster data integration for Django";
+      homepage = https://github.com/geodesign/django-raster;
+      license = licenses.mit;
+    };
+  };
+
   django_redis = buildPythonPackage rec {
     name = "django-redis-${version}";
     version = "4.2.0";
@@ -9406,6 +9450,25 @@ in modules // {
     };
   };
 
+  kaptan = buildPythonPackage rec {
+    name = "kaptan-${version}";
+    version = "0.5.8";
+
+    src = pkgs.fetchurl {
+      url = "mirror://pypi/k/kaptan/${name}.tar.gz";
+      sha256 = "1b8r86yyvdvyxd6f10mhkl6cr2jhxm80jjqr4zch96w9hs9rh5vq";
+    };
+
+    propagatedBuildInputs = with self; [ pyyaml ];
+
+    meta = with stdenv.lib; {
+      description = "Configuration manager for python applications";
+      homepage = https://emre.github.io/kaptan/;
+      license = licenses.bsd3;
+      platforms = platforms.linux;
+      maintainers = with maintainers; [ jgeerds ];
+    };
+  };
 
   keepalive = buildPythonPackage rec {
     name = "keepalive-${version}";
@@ -12081,13 +12144,13 @@ in modules // {
     };
 
     # most of these are simply to allow the test suite to do its job
-    buildInputs = with self; [ mock unittest2 nose redis qpid-python pymongo sqlalchemy pyyaml msgpack boto ];
+    buildInputs = with self; optionals isPy27 [ mock unittest2 nose redis qpid-python pymongo sqlalchemy pyyaml msgpack boto ];
 
     propagatedBuildInputs = with self; [ amqp anyjson ] ++
       (optionals (pythonOlder "2.7") [ importlib ordereddict ]);
 
     # tests broken on python 2.6? https://github.com/nose-devs/nose/issues/806
-    doCheck = (pythonAtLeast "2.7");
+    doCheck = isPy27;
 
     meta = {
       description = "Messaging library for Python";
author	Robin Gloster <mail@glob.in>	2016-08-02 13:46:36 +0000
committer	Robin Gloster <mail@glob.in>	2016-08-02 13:46:36 +0000
commit	1be4907ca203805ad3f2f38a5cdcf4041ee9ad4a (patch)
tree	744227983cb23911bae2c1269d927b72408ff8b8
parent	63c7b4f9a7844f0bc84d008b810375eb0fba6b2f (diff)
parent	450c866730df749ad928f3e70855ef7231c05a71 (diff)
download	nixlib-1be4907ca203805ad3f2f38a5cdcf4041ee9ad4a.tar nixlib-1be4907ca203805ad3f2f38a5cdcf4041ee9ad4a.tar.gz nixlib-1be4907ca203805ad3f2f38a5cdcf4041ee9ad4a.tar.bz2 nixlib-1be4907ca203805ad3f2f38a5cdcf4041ee9ad4a.tar.lz nixlib-1be4907ca203805ad3f2f38a5cdcf4041ee9ad4a.tar.xz nixlib-1be4907ca203805ad3f2f38a5cdcf4041ee9ad4a.tar.zst nixlib-1be4907ca203805ad3f2f38a5cdcf4041ee9ad4a.zip