Merge remote-tracking branch 'upstream/master' into HEAD

94 files changed, 1673 insertions, 946 deletions

diff --git a/doc/configuration.xml b/doc/configuration.xml
index ea3acf4e5753..ac03b42714c6 100644
--- a/doc/configuration.xml
+++ b/doc/configuration.xml
@@ -243,5 +243,218 @@ set of packages.
 
 </section>
 
+<section xml:id="sec-declarative-package-management">
+  <title>Declarative Package Management</title>
+
+  <section xml:id="sec-building-environment">
+    <title>Build an environment</title>
+
+    <para>
+      Using <literal>packageOverrides</literal>, it is possible to manage
+      packages declaratively. This means that we can list all of our desired
+      packages within a declarative Nix expression. For example, to have
+      <literal>aspell</literal>, <literal>bc</literal>,
+      <literal>ffmpeg</literal>, <literal>coreutils</literal>,
+      <literal>gdb</literal>, <literal>nixUnstable</literal>,
+      <literal>emscripten</literal>, <literal>jq</literal>,
+      <literal>nox</literal>, and <literal>silver-searcher</literal>, we could
+      use the following in <filename>~/.config/nixpkgs/config.nix</filename>:
+    </para>
+
+    <screen>
+{
+  packageOverrides = pkgs: with pkgs; {
+    myPackages = pkgs.buildEnv {
+      name = "my-packages";
+      paths = [ aspell bc coreutils gdb ffmpeg nixUnstable emscripten jq nox silver-searcher ];
+    };
+  };
+}
+    </screen>
+
+    <para>
+      To install it into our environment, you can just run <literal>nix-env -iA
+      nixpkgs.myPackages</literal>. If you want to load the packages to be built
+      from a working copy of <literal>nixpkgs</literal> you just run
+      <literal>nix-env -f. -iA myPackages</literal>. To explore what's been
+      installed, just look through <filename>~/.nix-profile/</filename>. You can
+      see that a lot of stuff has been installed. Some of this stuff is useful
+      some of it isn't. Let's tell Nixpkgs to only link the stuff that we want:
+    </para>
+
+    <screen>
+{
+  packageOverrides = pkgs: with pkgs; {
+    myPackages = pkgs.buildEnv {
+      name = "my-packages";
+      paths = [ aspell bc coreutils gdb ffmpeg nixUnstable emscripten jq nox silver-searcher ];
+      pathsToLink = [ "/share" "/bin" ];
+    };
+  };
+}
+    </screen>
+
+    <para>
+      <literal>pathsToLink</literal> tells Nixpkgs to only link the paths listed
+      which gets rid of the extra stuff in the profile.
+      <filename>/bin</filename> and <filename>/share</filename> are good
+      defaults for a user environment, getting rid of the clutter. If you are
+      running on Nix on MacOS, you may want to add another path as well,
+      <filename>/Applications</filename>, that makes GUI apps available.
+    </para>
+
+  </section>
+
+  <section xml:id="sec-getting-documentation">
+    <title>Getting documentation</title>
+
+    <para>
+      After building that new environment, look through
+      <filename>~/.nix-profile</filename> to make sure everything is there that
+      we wanted. Discerning readers will note that some files are missing. Look
+      inside <filename>~/.nix-profile/share/man/man1/</filename> to verify this.
+      There are no man pages for any of the Nix tools! This is because some
+      packages like Nix have multiple outputs for things like documentation (see
+      section 4). Let's make Nix install those as well.
+    </para>
+
+    <screen>
+{
+  packageOverrides = pkgs: with pkgs; {
+    myPackages = pkgs.buildEnv {
+      name = "my-packages";
+      paths = [ aspell bc coreutils ffmpeg nixUnstable emscripten jq nox silver-searcher ];
+      pathsToLink = [ "/share/man" "/share/doc" /bin" ];
+      extraOutputsToInstall = [ "man" "doc" ];
+    };
+  };
+}
+    </screen>
+
+    <para>
+      This provides us with some useful documentation for using our packages.
+      However, if we actually want those manpages to be detected by man, we need
+      to set up our environment. This can also be managed within Nix
+      expressions.
+    </para>
+
+    <screen>
+{
+  packageOverrides = pkgs: with pkgs; rec {
+    myProfile = writeText "my-profile" ''
+export PATH=$HOME/.nix-profile/bin:/nix/var/nix/profiles/default/bin:/sbin:/bin:/usr/sbin:/usr/bin
+export MANPATH=$HOME/.nix-profile/share/man:/nix/var/nix/profiles/default/share/man:/usr/share/man
+    '';
+    myPackages = pkgs.buildEnv {
+      name = "my-packages";
+      paths = [
+        (runCommand "profile" {} ''
+mkdir -p $out/etc/profile.d
+cp ${myProfile} $out/etc/profile.d/my-profile.sh
+        '')
+        aspell
+        bc
+        coreutils
+        ffmpeg
+        man
+        nixUnstable
+        emscripten
+        jq
+        nox
+        silver-searcher
+      ];
+      pathsToLink = [ "/share/man" "/share/doc" /bin" "/etc" ];
+      extraOutputsToInstall = [ "man" "doc" ];
+    };
+  };
+}
+    </screen>
+
+    <para>
+      For this to work fully, you must also have this script sourced when you
+      are logged in. Try adding something like this to your
+      <filename>~/.profile</filename> file:
+    </para>
+
+    <screen>
+#!/bin/sh
+if [ -d $HOME/.nix-profile/etc/profile.d ]; then
+  for i in $HOME/.nix-profile/etc/profile.d/*.sh; do
+    if [ -r $i ]; then
+      . $i
+    fi
+  done
+fi
+    </screen>
+
+    <para>
+      Now just run <literal>source $HOME/.profile</literal> and you can starting
+      loading man pages from your environent.
+    </para>
+
+  </section>
+    
+  <section xml:id="sec-gnu-info-setup">
+    <title>GNU info setup</title>
+
+    <para>
+      Configuring GNU info is a little bit trickier than man pages. To work
+      correctly, info needs a database to be generated. This can be done with
+      some small modifications to our environment scripts.
+    </para>
+
+    <screen>
+{
+  packageOverrides = pkgs: with pkgs; rec {
+    myProfile = writeText "my-profile" ''
+export PATH=$HOME/.nix-profile/bin:/nix/var/nix/profiles/default/bin:/sbin:/bin:/usr/sbin:/usr/bin
+export MANPATH=$HOME/.nix-profile/share/man:/nix/var/nix/profiles/default/share/man:/usr/share/man
+export INFOPATH=$HOME/.nix-profile/share/info:/nix/var/nix/profiles/default/share/info:/usr/share/info
+    '';
+    myPackages = pkgs.buildEnv {
+      name = "my-packages";
+      paths = [
+        (runCommand "profile" {} ''
+mkdir -p $out/etc/profile.d
+cp ${myProfile} $out/etc/profile.d/my-profile.sh
+        '')
+        aspell
+        bc
+        coreutils
+        ffmpeg
+        man
+        nixUnstable
+        emscripten
+        jq
+        nox
+        silver-searcher
+        texinfoInteractive
+      ];
+      pathsToLink = [ "/share/man" "/share/doc" "/share/info" "/bin" "/etc" ];
+      extraOutputsToInstall = [ "man" "doc" "info" ];
+      postBuild = ''
+          if [ -x $out/bin/install-info -a -w $out/share/info ]; then
+            shopt -s nullglob
+            for i in $out/share/info/*.info $out/share/info/*.info.gz; do
+                $out/bin/install-info $i $out/share/info/dir
+            done
+          fi
+      '';
+    };
+  };
+}
+    </screen>
+
+    <para>
+      <literal>postBuild</literal> tells Nixpkgs to run a command after building
+      the environment. In this case, <literal>install-info</literal> adds the
+      installed info pages to <literal>dir</literal> which is GNU info's default
+      root node. Note that <literal>texinfoInteractive</literal> is added to the
+      environment to give the <literal>install-info</literal> command.
+    </para>
+
+  </section>
+
+</section>
 
 </chapter>
diff --git a/maintainers/scripts/update-python-libraries b/maintainers/scripts/update-python-libraries
index d06dee150994..7c73510c353a 100755
--- a/maintainers/scripts/update-python-libraries
+++ b/maintainers/scripts/update-python-libraries
@@ -91,6 +91,7 @@ def _get_latest_version_pypi(package, extension):
         if release['filename'].endswith(extension):
             # TODO: In case of wheel we need to do further checks!
             sha256 = release['digests']['sha256']
+            break
     else:
         sha256 = None
     return version, sha256
diff --git a/nixos/doc/manual/release-notes/rl-1709.xml b/nixos/doc/manual/release-notes/rl-1709.xml
index 34cfe1702e9c..72dfd60bedd9 100644
--- a/nixos/doc/manual/release-notes/rl-1709.xml
+++ b/nixos/doc/manual/release-notes/rl-1709.xml
@@ -86,6 +86,10 @@ rmdir /var/lib/ipfs/.ipfs
   </listitem>
   <listitem>
     <para>
+      The following changes apply if the <literal>stateVersion</literal> is changed to 17.09 or higher.
+      For <literal>stateVersion = "17.03</literal> or lower the old behavior is preserved.
+    </para>
+    <para>
       The <literal>postgres</literal> default version was changed from 9.5 to 9.6.
     </para>
     <para>
@@ -94,6 +98,9 @@ rmdir /var/lib/ipfs/.ipfs
     <para>
       The <literal>postgres</literal> default <literal>dataDir</literal> has changed from <literal>/var/db/postgres</literal> to <literal>/var/lib/postgresql/$psqlSchema</literal> where $psqlSchema is 9.6 for example.
     </para>
+    <para>
+      The <literal>mysql</literal> default <literal>dataDir</literal> has changed from <literal>/var/mysql</literal> to <literal>/var/lib/mysql</literal>.
+    </para>
   </listitem>
   <listitem>
     <para>
@@ -113,9 +120,18 @@ rmdir /var/lib/ipfs/.ipfs
       also serve as a SSH agent if <literal>enableSSHSupport</literal> is set.
     </para>
   </listitem>
+  <listitem>
+    <para>
+      The <literal>services.tinc.networks.&lt;name&gt;.listenAddress</literal>
+      option had a misleading name that did not correspond to its behavior. It
+      now correctly defines the ip to listen for incoming connections on. To
+      keep the previous behaviour, use
+      <literal>services.tinc.networks.&lt;name&gt;.bindToAddress</literal>
+      instead. Refer to the description of the options for more details.
+    </para>
+  </listitem>
 </itemizedlist>
 
-
 <para>Other notable improvements:</para>
 
 <itemizedlist>
diff --git a/nixos/modules/config/pulseaudio.nix b/nixos/modules/config/pulseaudio.nix
index bd80c8113483..b12ef2fe861d 100644
--- a/nixos/modules/config/pulseaudio.nix
+++ b/nixos/modules/config/pulseaudio.nix
@@ -6,6 +6,7 @@ with lib;
 let
 
   cfg = config.hardware.pulseaudio;
+  alsaCfg = config.sound;
 
   systemWide = cfg.enable && cfg.systemWide;
   nonSystemWide = cfg.enable && !cfg.systemWide;
@@ -76,6 +77,7 @@ let
     ctl.!default {
       type pulse
     }
+    ${alsaCfg.extraConfig}
   '');
 
 in {
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 1f2fbb7d85c9..4335a4b3eece 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -326,6 +326,7 @@
   ./services/misc/ripple-data-api.nix
   ./services/misc/rogue.nix
   ./services/misc/siproxd.nix
+  ./services/misc/snapper.nix
   ./services/misc/sonarr.nix
   ./services/misc/spice-vdagentd.nix
   ./services/misc/ssm-agent.nix
diff --git a/nixos/modules/profiles/all-hardware.nix b/nixos/modules/profiles/all-hardware.nix
index 530b2fbffd1c..6e6ae98e19fc 100644
--- a/nixos/modules/profiles/all-hardware.nix
+++ b/nixos/modules/profiles/all-hardware.nix
@@ -41,6 +41,9 @@
 
       # Virtio (QEMU, KVM etc.) support.
       "virtio_net" "virtio_pci" "virtio_blk" "virtio_scsi" "virtio_balloon" "virtio_console"
+      
+      # VMware support.
+      "mptspi" "vmw_balloon" "vmwgfx" "vmw_vmci" "vmw_vsock_vmci_transport" "vmxnet3" "vsock"
 
       # Hyper-V support.
       "hv_storvsc"
diff --git a/nixos/modules/services/audio/alsa.nix b/nixos/modules/services/audio/alsa.nix
index 53786dbc6270..acf48d3c3d03 100644
--- a/nixos/modules/services/audio/alsa.nix
+++ b/nixos/modules/services/audio/alsa.nix
@@ -7,6 +7,8 @@ let
 
   inherit (pkgs) alsaUtils;
 
+  pulseaudioEnabled = config.hardware.pulseaudio.enable;
+
 in
 
 {
@@ -80,7 +82,7 @@ in
 
     environment.systemPackages = [ alsaUtils ];
 
-    environment.etc = mkIf (config.sound.extraConfig != "")
+    environment.etc = mkIf (!pulseaudioEnabled && config.sound.extraConfig != "")
       [
         { source = pkgs.writeText "asound.conf" config.sound.extraConfig;
           target = "asound.conf";
diff --git a/nixos/modules/services/misc/nixos-manual.nix b/nixos/modules/services/misc/nixos-manual.nix
index 622607f3b32d..515864ec2e2d 100644
--- a/nixos/modules/services/misc/nixos-manual.nix
+++ b/nixos/modules/services/misc/nixos-manual.nix
@@ -62,8 +62,7 @@ let
     name = "nixos-manual";
     desktopName = "NixOS Manual";
     genericName = "View NixOS documentation in a web browser";
-    # TODO: find a better icon (Nix logo + help overlay?)
-    icon = "system-help";
+    icon = "nix-snowflake";
     exec = "${helpScript}/bin/nixos-help";
     categories = "System";
   };
@@ -115,7 +114,7 @@ in
 
     environment.systemPackages =
       [ manual.manual helpScript ]
-      ++ optional config.services.xserver.enable desktopItem
+      ++ optionals config.services.xserver.enable [desktopItem pkgs.nixos-icons]
       ++ optional config.programs.man.enable manual.manpages;
 
     boot.extraTTYs = mkIf cfg.showManual ["tty${toString cfg.ttyNumber}"];
diff --git a/nixos/modules/services/misc/snapper.nix b/nixos/modules/services/misc/snapper.nix
new file mode 100644
index 000000000000..62b344d11b06
--- /dev/null
+++ b/nixos/modules/services/misc/snapper.nix
@@ -0,0 +1,152 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+  cfg = config.services.snapper;
+in
+
+{
+  options.services.snapper = {
+
+    snapshotInterval = mkOption {
+      type = types.str;
+      default = "hourly";
+      description = ''
+        Snapshot interval.
+
+        The format is described in
+        <citerefentry><refentrytitle>systemd.time</refentrytitle>
+        <manvolnum>7</manvolnum></citerefentry>.
+      '';
+    };
+
+    cleanupInterval = mkOption {
+      type = types.str;
+      default = "1d";
+      description = ''
+        Cleanup interval.
+
+        The format is described in
+        <citerefentry><refentrytitle>systemd.time</refentrytitle>
+        <manvolnum>7</manvolnum></citerefentry>.
+      '';
+    };
+
+    filters = mkOption {
+      type = types.nullOr types.lines;
+      default = null;
+      description = ''
+        Global display difference filter. See man:snapper(8) for more details.
+      '';
+    };
+
+    configs = mkOption {
+      default = { };
+      example = literalExample {
+        "home" = {
+          subvolume = "/home";
+          extraConfig = ''
+            ALLOW_USERS="alice"
+          '';
+        };
+      };
+
+      description = ''
+        Subvolume configuration
+      '';
+
+      type = types.attrsOf (types.submodule {
+        options = {
+          subvolume = mkOption {
+            type = types.path;
+            description = ''
+              Path of the subvolume or mount point.
+              This path is a subvolume and has to contain a subvolume named
+              .snapshots.
+              See also man:snapper(8) section PERMISSIONS.
+            '';
+          };
+
+          fstype = mkOption {
+            type = types.enum [ "btrfs" ];
+            default = "btrfs";
+            description = ''
+              Filesystem type. Only btrfs is stable and tested.
+            '';
+          };
+
+          extraConfig = mkOption {
+            type = types.lines;
+            default = "";
+            description = ''
+              Additional configuration next to SUBVOLUME and FSTYPE.
+              See man:snapper-configs(5).
+            '';
+          };
+        };
+      });
+    };
+  };
+
+  config = mkIf (cfg.configs != {}) (let
+    documentation = [ "man:snapper(8)" "man:snapper-configs(5)" ];
+  in {
+
+    environment = {
+
+      systemPackages = [ pkgs.snapper ];
+
+      # Note: snapper/config-templates/default is only needed for create-config
+      #       which is not the NixOS way to configure.
+      etc = {
+
+        "sysconfig/snapper".text = ''
+          SNAPPER_CONFIGS="${lib.concatStringsSep " " (builtins.attrNames cfg.configs)}"
+        '';
+
+      }
+      // (mapAttrs' (name: subvolume: nameValuePair "snapper/configs/${name}" ({
+        text = ''
+          ${subvolume.extraConfig}
+          FSTYPE="${subvolume.fstype}"
+          SUBVOLUME="${subvolume.subvolume}"
+        '';
+      })) cfg.configs)
+      // (lib.optionalAttrs (cfg.filters != null) {
+        "snapper/filters/default.txt".text = cfg.filters;
+      });
+
+    };
+
+    services.dbus.packages = [ pkgs.snapper ];
+
+    systemd.services.snapper-timeline = {
+      description = "Timeline of Snapper Snapshots";
+      inherit documentation;
+      serviceConfig.ExecStart = "${pkgs.snapper}/lib/snapper/systemd-helper --timeline";
+    };
+
+    systemd.timers.snapper-timeline = {
+      description = "Timeline of Snapper Snapshots";
+      inherit documentation;
+      wantedBy = [ "basic.target" ];
+      timerConfig.OnCalendar = cfg.snapshotInterval;
+    };
+
+    systemd.services.snapper-cleanup = {
+      description = "Cleanup of Snapper Snapshots";
+      inherit documentation;
+      serviceConfig.ExecStart = "${pkgs.snapper}/lib/snapper/systemd-helper --cleanup";
+    };
+
+    systemd.timers.snapper-cleanup = {
+      description = "Cleanup of Snapper Snapshots";
+      inherit documentation;
+      wantedBy = [ "basic.target" ];
+      timerConfig.OnBootSec = "10m";
+      timerConfig.OnUnitActiveSec = cfg.cleanupInterval;
+    };
+  });
+}
+
diff --git a/nixos/modules/services/misc/taskserver/helper-tool.py b/nixos/modules/services/misc/taskserver/helper-tool.py
index b97bc1df74f7..22a3d8d5311b 100644
--- a/nixos/modules/services/misc/taskserver/helper-tool.py
+++ b/nixos/modules/services/misc/taskserver/helper-tool.py
@@ -448,6 +448,8 @@ def cli(ctx):
     """
     Manage Taskserver users and certificates
     """
+    if not IS_AUTO_CONFIG:
+        return
     for path in (CA_KEY, CA_CERT, CRL_FILE):
         if not os.path.exists(path):
             msg = "CA setup not done or incomplete, missing file {}."
diff --git a/nixos/modules/services/networking/tinc.nix b/nixos/modules/services/networking/tinc.nix
index 79a0aa953feb..7376d2d24a0b 100644
--- a/nixos/modules/services/networking/tinc.nix
+++ b/nixos/modules/services/networking/tinc.nix
@@ -79,7 +79,15 @@ in
               default = null;
               type = types.nullOr types.str;
               description = ''
-                The ip adress to bind to.
+                The ip address to listen on for incoming connections.
+              '';
+            };
+
+            bindToAddress = mkOption {
+              default = null;
+              type = types.nullOr types.str;
+              description = ''
+                The ip address to bind to (both listen on and send packets from).
               '';
             };
 
@@ -131,7 +139,8 @@ in
               Name = ${if data.name == null then "$HOST" else data.name}
               DeviceType = ${data.interfaceType}
               ${optionalString (data.ed25519PrivateKeyFile != null) "Ed25519PrivateKeyFile = ${data.ed25519PrivateKeyFile}"}
-              ${optionalString (data.listenAddress != null) "BindToAddress = ${data.listenAddress}"}
+              ${optionalString (data.listenAddress != null) "ListenAddress = ${data.listenAddress}"}
+              ${optionalString (data.bindToAddress != null) "BindToAddress = ${data.bindToAddress}"}
               Device = /dev/net/tun
               Interface = tinc.${network}
               ${data.extraConfig}
diff --git a/nixos/modules/services/printing/cupsd.nix b/nixos/modules/services/printing/cupsd.nix
index 7ce2ae38fb36..ba9f99e6a8fb 100644
--- a/nixos/modules/services/printing/cupsd.nix
+++ b/nixos/modules/services/printing/cupsd.nix
@@ -324,6 +324,8 @@ in
               fi
             ''}
           '';
+
+          serviceConfig.PrivateTmp = true;
       };
 
     systemd.services.cups-browsed = mkIf avahiEnabled
diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix
index ae14aa28ae34..f83413b4534e 100644
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@@ -123,45 +123,49 @@ let
 
   vhosts = concatStringsSep "\n" (mapAttrsToList (vhostName: vhost:
       let
-        serverName = vhost.serverName;
         ssl = vhost.enableSSL || vhost.forceSSL;
-        port = if vhost.port != null then vhost.port else (if ssl then 443 else 80);
-        listenString = toString port + optionalString ssl " ssl http2"
-          + optionalString vhost.default " default_server";
-        acmeLocation = optionalString vhost.enableACME (''
+        defaultPort = if ssl then 443 else 80;
+
+        listenString = { addr, port, ... }:
+          "listen ${addr}:${toString (if port != null then port else defaultPort)} "
+          + optionalString ssl "ssl http2 "
+          + optionalString vhost.default "default_server"
+          + ";";
+
+        redirectListenString = { addr, ... }:
+          "listen ${addr}:80 ${optionalString vhost.default "default_server"};";
+
+        acmeLocation = ''
           location /.well-known/acme-challenge {
             ${optionalString (vhost.acmeFallbackHost != null) "try_files $uri @acme-fallback;"}
             root ${vhost.acmeRoot};
             auth_basic off;
           }
-        '' + (optionalString (vhost.acmeFallbackHost != null) ''
-          location @acme-fallback {
-            auth_basic off;
-            proxy_pass http://${vhost.acmeFallbackHost};
-          }
-        ''));
+          ${optionalString (vhost.acmeFallbackHost != null) ''
+            location @acme-fallback {
+              auth_basic off;
+              proxy_pass http://${vhost.acmeFallbackHost};
+            }
+          ''}
+        '';
+
       in ''
         ${optionalString vhost.forceSSL ''
           server {
-            listen 80 ${optionalString vhost.default "default_server"};
-            ${optionalString enableIPv6
-              ''listen [::]:80 ${optionalString vhost.default "default_server"};''
-            }
+            ${concatMapStringsSep "\n" redirectListenString vhost.listen}
 
-            server_name ${serverName} ${concatStringsSep " " vhost.serverAliases};
-            ${acmeLocation}
+            server_name ${vhost.serverName} ${concatStringsSep " " vhost.serverAliases};
+            ${optionalString vhost.enableACME acmeLocation}
             location / {
-              return 301 https://$host${optionalString (port != 443) ":${toString port}"}$request_uri;
+              return 301 https://$host$request_uri;
             }
           }
         ''}
 
         server {
-          listen ${listenString};
-          ${optionalString enableIPv6 "listen [::]:${listenString};"}
-
-          server_name ${serverName} ${concatStringsSep " " vhost.serverAliases};
-          ${acmeLocation}
+          ${concatMapStringsSep "\n" listenString vhost.listen}
+          server_name ${vhost.serverName} ${concatStringsSep " " vhost.serverAliases};
+          ${optionalString vhost.enableACME acmeLocation}
           ${optionalString (vhost.root != null) "root ${vhost.root};"}
           ${optionalString (vhost.globalRedirect != null) ''
             return 301 http${optionalString ssl "s"}://${vhost.globalRedirect}$request_uri;
@@ -380,7 +384,7 @@ in
 
       virtualHosts = mkOption {
         type = types.attrsOf (types.submodule (import ./vhost-options.nix {
-          inherit lib;
+          inherit config lib;
         }));
         default = {
           localhost = {};
diff --git a/nixos/modules/services/web-servers/nginx/vhost-options.nix b/nixos/modules/services/web-servers/nginx/vhost-options.nix
index c0ea645b3dfe..60260512bc2f 100644
--- a/nixos/modules/services/web-servers/nginx/vhost-options.nix
+++ b/nixos/modules/services/web-servers/nginx/vhost-options.nix
@@ -3,7 +3,7 @@
 # has additional options that affect the web server as a whole, like
 # the user/group to run under.)
 
-{ lib }:
+{ config, lib }:
 
 with lib;
 {
@@ -26,12 +26,26 @@ with lib;
       '';
     };
 
-    port = mkOption {
-      type = types.nullOr types.int;
-      default = null;
+    listen = mkOption {
+      type = with types; listOf (submodule {
+        options = {
+          addr = mkOption { type = str; description = "IP address."; };
+          port = mkOption { type = nullOr int; description = "Port number."; };
+        };
+      });
+      default =
+        [ { addr = "0.0.0.0"; port = null; } ]
+        ++ optional config.networking.enableIPv6
+          { addr = "[::]"; port = null; };
+      example = [
+        { addr = "195.154.1.1"; port = 443; }
+        { addr = "192.168.1.2"; port = 443; }
+      ];
       description = ''
-        Port for the server. Defaults to 80 for http
-        and 443 for https (i.e. when enableSSL is set).
+        Listen addresses and ports for this virtual host.
+        IPv6 addresses must be enclosed in square brackets.
+        Setting the port to <literal>null</literal> defaults
+        to 80 for http and 443 for https (i.e. when enableSSL is set).
       '';
     };
 
diff --git a/nixos/modules/system/boot/stage-1-init.sh b/nixos/modules/system/boot/stage-1-init.sh
index 9a125dcb0aeb..1f4ab3eae07e 100644
--- a/nixos/modules/system/boot/stage-1-init.sh
+++ b/nixos/modules/system/boot/stage-1-init.sh
@@ -301,6 +301,7 @@ mountFS() {
         *x-nixos.autoresize*)
             if [ "$fsType" = ext2 -o "$fsType" = ext3 -o "$fsType" = ext4 ]; then
                 echo "resizing $device..."
+                e2fsck -fp "$device"
                 resize2fs "$device"
             fi
             ;;
diff --git a/nixos/release.nix b/nixos/release.nix
index 467e3bb8cd61..0dbdadf97816 100644
--- a/nixos/release.nix
+++ b/nixos/release.nix
@@ -303,6 +303,7 @@ in rec {
   tests.simple = callTest tests/simple.nix {};
   tests.slim = callTest tests/slim.nix {};
   tests.smokeping = callTest tests/smokeping.nix {};
+  tests.snapper = callTest tests/snapper.nix {};
   tests.taskserver = callTest tests/taskserver.nix {};
   tests.tomcat = callTest tests/tomcat.nix {};
   tests.udisks2 = callTest tests/udisks2.nix {};
diff --git a/nixos/tests/snapper.nix b/nixos/tests/snapper.nix
new file mode 100644
index 000000000000..74ec22fd3499
--- /dev/null
+++ b/nixos/tests/snapper.nix
@@ -0,0 +1,43 @@
+import ./make-test.nix ({ ... }:
+{
+  name = "snapper";
+
+  machine = { pkgs, lib, ... }: {
+    boot.initrd.postDeviceCommands = ''
+      ${pkgs.btrfs-progs}/bin/mkfs.btrfs -f -L aux /dev/vdb
+    '';
+
+    virtualisation.emptyDiskImages = [ 4096 ];
+
+    fileSystems = lib.mkVMOverride {
+      "/home" = {
+        device = "/dev/disk/by-label/aux";
+        fsType = "btrfs";
+      };
+    };
+    services.snapper.configs.home.subvolume = "/home";
+    services.snapper.filters = "/nix";
+  };
+
+  testScript = ''
+    $machine->succeed("btrfs subvolume create /home/.snapshots");
+
+    $machine->succeed("snapper -c home list");
+
+    $machine->succeed("snapper -c home create --description empty");
+
+    $machine->succeed("echo test > /home/file");
+    $machine->succeed("snapper -c home create --description file");
+
+    $machine->succeed("snapper -c home status 1..2");
+
+    $machine->succeed("snapper -c home undochange 1..2");
+    $machine->fail("ls /home/file");
+
+    $machine->succeed("snapper -c home delete 2");
+
+    $machine->succeed("systemctl --wait start snapper-timeline.service");
+
+    $machine->succeed("systemctl --wait start snapper-cleanup.service");
+  '';
+})
diff --git a/nixos/tests/taskserver.nix b/nixos/tests/taskserver.nix
index cdccb11d8887..75be97a507d0 100644
--- a/nixos/tests/taskserver.nix
+++ b/nixos/tests/taskserver.nix
@@ -246,6 +246,10 @@ in {
     };
 
     subtest "check manual configuration", sub {
+      # Remove the keys from automatic CA creation, to make sure the new
+      # generation doesn't use keys from before.
+      $server->succeed('rm -rf ${cfg.dataDir}/keys/* >&2');
+
       $server->succeed('${switchToNewServer} >&2');
       $server->waitForUnit("taskserver.service");
       $server->waitForOpenPort(${portStr});
diff --git a/pkgs/applications/audio/mopidy-iris/default.nix b/pkgs/applications/audio/mopidy-iris/default.nix
index d2ba955f9fb7..a39c63277631 100644
--- a/pkgs/applications/audio/mopidy-iris/default.nix
+++ b/pkgs/applications/audio/mopidy-iris/default.nix
@@ -2,12 +2,12 @@
 
 pythonPackages.buildPythonApplication rec {
   name = "mopidy-iris-${version}";
-  version = "3.0.3";
+  version = "3.0.5";
 
   src = pythonPackages.fetchPypi {
     inherit version;
     pname = "Mopidy-Iris";
-    sha256 = "1j8zrkvgs2f6jcqf1sn79afiirk5plfrkychlzcwqrxix293ngjr";
+    sha256 = "0rabpzmiis13z4qz3vqlsfc9xjkwracafckahnq2cq97qawyq9y9";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/applications/editors/jetbrains/default.nix b/pkgs/applications/editors/jetbrains/default.nix
index 99a1837f9f22..9bd002137c49 100644
--- a/pkgs/applications/editors/jetbrains/default.nix
+++ b/pkgs/applications/editors/jetbrains/default.nix
@@ -265,12 +265,12 @@ in
 
   idea-community = buildIdea rec {
     name = "idea-community-${version}";
-    version = "2017.1.4";
+    version = "2017.1.5"; /* updated by script */
     description = "Integrated Development Environment (IDE) by Jetbrains, community edition";
     license = stdenv.lib.licenses.asl20;
     src = fetchurl {
       url = "https://download.jetbrains.com/idea/ideaIC-${version}.tar.gz";
-      sha256 = "1w1knq969dl8rxlkhr9mw8cr2vszn384acwhspimrd3zs9825r45";
+      sha256 = "830c662c517e8d0131dc2df150d6f75adb3d8becaf9de96393730b0f4ae6ccf0"; /* updated by script */
     };
     wmClass = "jetbrains-idea-ce";
     update-channel = "IDEA_Release";
@@ -304,12 +304,12 @@ in
 
   idea-ultimate = buildIdea rec {
     name = "idea-ultimate-${version}";
-    version = "2017.1.4";
+    version = "2017.1.5";
     description = "Integrated Development Environment (IDE) by Jetbrains, requires paid license";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/idea/ideaIU-${version}-no-jdk.tar.gz";
-      sha256 = "0byrsbsscpzb0syamzpavny879src5dlclnissa7173rh8hgkna4";
+      sha256 = "0gjj2g9fcrbbbp3v4clg0kj48qdw0gqcn9im4h8p3z2zscpg16ag";
     };
     wmClass = "jetbrains-idea";
     update-channel = "IDEA_Release";
@@ -343,12 +343,12 @@ in
 
   pycharm-community = buildPycharm rec {
     name = "pycharm-community-${version}";
-    version = "2017.1.4"; /* updated by script */
+    version = "2017.1.5"; /* updated by script */
     description = "PyCharm Community Edition";
     license = stdenv.lib.licenses.asl20;
     src = fetchurl {
       url = "https://download.jetbrains.com/python/${name}.tar.gz";
-      sha256 = "1e69ab29215a9c8c4626de6727df433ae0d9f6ed46eba2a6f48ffa52c2b04256"; /* updated by script */
+      sha256 = "1a0bbf0d881527e08aad7a5adaa3ad44e8754c3eb2c3a8ed5ab113491549679b"; /* updated by script */
     };
     wmClass = "jetbrains-pycharm-ce";
     update-channel = "PyCharm_Release";
@@ -356,12 +356,12 @@ in
 
   pycharm-professional = buildPycharm rec {
     name = "pycharm-professional-${version}";
-    version = "2017.1.4"; /* updated by script */
+    version = "2017.1.5"; /* updated by script */
     description = "PyCharm Professional Edition";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/python/${name}.tar.gz";
-      sha256 = "bbae5602b9cf6d26ccce9e1bf8b388d79c27cf89673d1a56f248bf0a50e518ed"; /* updated by script */
+      sha256 = "52519dfd0e913b5ccb8767155cd4d1fd413967d5010e8474cdc9a1fa688016ce"; /* updated by script */
     };
     wmClass = "jetbrains-pycharm";
     update-channel = "PyCharm_Release";
@@ -369,25 +369,25 @@ in
 
   rider = buildRider rec {
     name = "rider-${version}";
-    version = "171.4456.575"; /* updated by script */
+    version = "171.4456.1432"; /* updated by script */
     description = "A cross-platform .NET IDE based on the IntelliJ platform and ReSharper";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
-      url = "https://download.jetbrains.com/resharper/riderRS-${version}.tar.gz";
-      sha256 = "9b7f46e9c800a091f2cdbe9fda08041729e2abc0ce57252731da659b2424707b"; /* updated by script */
+      url = "https://download.jetbrains.com/resharper/Rider-RC-${version}.tar.gz";
+      sha256 = "37bad69cdfcc4f297b2500a7bb673af7ef8f1fd45baa4eb2fa388d2c4bcb41ee"; /* updated by script */
     };
     wmClass = "jetbrains-rider";
-    update-channel = "rider1.0EAP";
+    update-channel = "rider_2017_1_eap";
   };
 
   ruby-mine = buildRubyMine rec {
     name = "ruby-mine-${version}";
-    version = "2017.1.4";
+    version = "2017.1.5"; /* updated by script */
     description = "The Most Intelligent Ruby and Rails IDE";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/ruby/RubyMine-${version}.tar.gz";
-      sha256 = "06jk0anlnc4gr240i51kam47shdjgda6zg3hglk5w3bpvbyix68z";
+      sha256 = "198eb3d7914529ce3a6857e038167e194fb838c4b94242048ae45e8413458d66"; /* updated by script */
     };
     wmClass = "jetbrains-rubymine";
     update-channel = "rm2017.1";
diff --git a/pkgs/applications/editors/neovim/ruby_provider/Gemfile.lock b/pkgs/applications/editors/neovim/ruby_provider/Gemfile.lock
index 88100b2e8f87..327edca0ed24 100644
--- a/pkgs/applications/editors/neovim/ruby_provider/Gemfile.lock
+++ b/pkgs/applications/editors/neovim/ruby_provider/Gemfile.lock
@@ -1,8 +1,8 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    msgpack (1.0.2)
-    neovim (0.3.1)
+    msgpack (1.1.0)
+    neovim (0.5.0)
       msgpack (~> 1.0)
 
 PLATFORMS
@@ -12,4 +12,4 @@ DEPENDENCIES
   neovim
 
 BUNDLED WITH
-   1.12.5
+   1.15.1
diff --git a/pkgs/applications/editors/neovim/ruby_provider/gemset.nix b/pkgs/applications/editors/neovim/ruby_provider/gemset.nix
index c3ed45a78481..fbb9c63a1cff 100644
--- a/pkgs/applications/editors/neovim/ruby_provider/gemset.nix
+++ b/pkgs/applications/editors/neovim/ruby_provider/gemset.nix
@@ -2,18 +2,18 @@
   msgpack = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1fb2my91j08plsbbry5kilsrh7slmzgbbf6f55zy6xk28p9036lg";
+      sha256 = "0ck7w17d6b4jbb8inh1q57bghi9cjkiaxql1d3glmj1yavbpmlh7";
       type = "gem";
     };
-    version = "1.0.2";
+    version = "1.1.0";
   };
   neovim = {
     dependencies = ["msgpack"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "018mk4vqaxzbk4anq558h2rgj8prbn2rmi777iwrg3n0v8k5nxqw";
+      sha256 = "1da0ha3mz63iyihldp7185b87wx86jg07023xjhbng6i28y1ksn7";
       type = "gem";
     };
-    version = "0.3.1";
+    version = "0.5.0";
   };
 }
\ No newline at end of file
diff --git a/pkgs/applications/gis/qgis/default.nix b/pkgs/applications/gis/qgis/default.nix
index b8c9d1718143..10c2ab9ebf99 100644
--- a/pkgs/applications/gis/qgis/default.nix
+++ b/pkgs/applications/gis/qgis/default.nix
@@ -5,24 +5,15 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "qgis-2.18.4";
+  name = "qgis-2.18.10";
 
   buildInputs = [ gdal qt4 flex openssl bison proj geos xlibsWrapper sqlite gsl qwt qscintilla
     fcgi libspatialindex libspatialite postgresql qjson qca2 txt2tags ] ++
     (stdenv.lib.optional withGrass grass) ++
-    (with python2Packages; [ numpy psycopg2 requests python2Packages.qscintilla sip ]);
+    (with python2Packages; [ jinja2 numpy psycopg2 pygments requests python2Packages.qscintilla sip ]);
 
   nativeBuildInputs = [ cmake makeWrapper ];
 
-  patches = [
-    # See https://hub.qgis.org/issues/16071
-    (fetchpatch {
-      name = "fix-build-against-recent-sip";
-      url = "https://github.com/qgis/QGIS/commit/85a0db24f32351f6096cd8282f03ad5c2f4e6ef5.patch";
-      sha256 = "0snspzdrpawd7j5b69i8kk7pmmy6ij8bn02bzg94qznfpf9ihf30";
-    })
-  ];
-
   # fatal error: ui_qgsdelimitedtextsourceselectbase.h: No such file or directory
   #enableParallelBuilding = true;
 
@@ -34,7 +25,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "http://qgis.org/downloads/${name}.tar.bz2";
-    sha256 = "1s264pahxpn0215xmzm8q2khr5xspipd7bbvxah5kj339kyjfy3k";
+    sha256 = "1vrzxhnpzd75iia4xmhbxy90x0wlvj2w4210f0r8203hd2m4sxdj";
   };
 
   cmakeFlags = stdenv.lib.optional withGrass "-DGRASS_PREFIX7=${grass}/${grass.name}";
diff --git a/pkgs/applications/graphics/darktable/default.nix b/pkgs/applications/graphics/darktable/default.nix
index 68ab287f1a65..8c1db9c039e7 100644
--- a/pkgs/applications/graphics/darktable/default.nix
+++ b/pkgs/applications/graphics/darktable/default.nix
@@ -11,12 +11,12 @@
 assert stdenv ? glibc;
 
 stdenv.mkDerivation rec {
-  version = "2.2.4";
+  version = "2.2.5";
   name = "darktable-${version}";
 
   src = fetchurl {
     url = "https://github.com/darktable-org/darktable/releases/download/release-${version}/darktable-${version}.tar.xz";
-    sha256 = "1n7rddkxwcifc3kcdlnar9w562xv4h78fqkkn27jihqzp3b4am5x";
+    sha256 = "10gjzd4irxhladh4jyss9kgp627k8vgx2divipsb33pp6cms80z3";
   };
 
   buildInputs =
diff --git a/pkgs/applications/misc/bashSnippets/default.nix b/pkgs/applications/misc/bashSnippets/default.nix
new file mode 100644
index 000000000000..542450080fea
--- /dev/null
+++ b/pkgs/applications/misc/bashSnippets/default.nix
@@ -0,0 +1,49 @@
+{ stdenv, lib, fetchFromGitHub, makeWrapper
+, curl, netcat, mpv, python, bind, iproute, bc, gitMinimal }:
+let
+  version = "1.12.0";
+  deps = lib.makeBinPath [
+    curl
+    mpv
+    python
+    bind.dnsutils
+    iproute
+    bc
+    gitMinimal
+  ];
+in
+stdenv.mkDerivation {
+  name = "bashSnippets-${version}";
+
+  src = fetchFromGitHub {
+    owner = "alexanderepstein";
+    repo = "Bash-Snippets";
+    rev = "v${version}";
+    sha256 = "0kx2a8z3jbmmardw9z8fpghbw5mrbz4knb3wdihq35iarcbrddrg";
+  };
+
+  buildInputs = [ makeWrapper ];
+
+  patchPhase = ''
+    patchShebangs install.sh
+    substituteInPlace install.sh --replace /usr/local "$out"
+  '';
+
+  dontBuild = true;
+
+  installPhase = ''
+    mkdir -p "$out"/bin "$out"/man/man1
+    ./install.sh all
+    for file in "$out"/bin/*; do
+      wrapProgram "$file" --prefix PATH : "${deps}"
+    done
+  '';
+
+  meta = with lib; {
+    description = "A collection of small bash scripts for heavy terminal users";
+    homepage = https://github.com/alexanderepstein/Bash-Snippets;
+    license = licenses.mit;
+    maintainers = with maintainers; [ infinisil ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/applications/misc/dunst/default.nix b/pkgs/applications/misc/dunst/default.nix
index 221bd3c4bf5e..919ad10fa706 100644
--- a/pkgs/applications/misc/dunst/default.nix
+++ b/pkgs/applications/misc/dunst/default.nix
@@ -1,32 +1,25 @@
 { stdenv, fetchFromGitHub, fetchpatch
-, pkgconfig, which, perl
-, cairo, dbus, freetype, gdk_pixbuf, glib, libX11, libXScrnSaver
-, libXext, libXinerama, libnotify, libxdg_basedir, pango, xproto
-, librsvg
+, pkgconfig, which, perl, gtk2, xrandr
+, cairo, dbus, gdk_pixbuf, glib, libX11, libXScrnSaver
+, libXinerama, libnotify, libxdg_basedir, pango, xproto, librsvg
 }:
 
 stdenv.mkDerivation rec {
   name = "dunst-${version}";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
-    owner = "knopwob";
+    owner = "dunst-project";
     repo = "dunst";
     rev = "v${version}";
-    sha256 = "102s0rkcdz22hnacsi3dhm7kj3lsw9gnikmh3a7wk862nkvvwjmk";
+    sha256 = "0jncnb4z4hg92ws08bkf52jswsd4vqlzyznwbynhh2jh6q0sl18b";
   };
 
-  patches = [(fetchpatch {
-    name = "add-svg-support.patch";
-    url = "https://github.com/knopwob/dunst/commit/63b11141185d1d07a6d12212257a543e182d250a.patch";
-    sha256 = "0giiaj5zjim7xqcav5ij5gn4x6nnchkllwcx0ln16j0p3vbi4y4x";
-  })];
-
   nativeBuildInputs = [ perl pkgconfig which ];
 
   buildInputs = [
-    cairo dbus freetype gdk_pixbuf glib libX11 libXScrnSaver libXext
-    libXinerama libnotify libxdg_basedir pango xproto librsvg
+    cairo dbus gdk_pixbuf glib libX11 libXScrnSaver
+    libXinerama libnotify libxdg_basedir pango xproto librsvg gtk2 xrandr
   ];
 
   outputs = [ "out" "man" ];
diff --git a/pkgs/applications/networking/browsers/firefox/common.nix b/pkgs/applications/networking/browsers/firefox/common.nix
index 4fe89a403de9..7c9ffc0f4784 100644
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@@ -153,7 +153,7 @@ stdenv.mkDerivation (rec {
   ++ lib.optional googleAPISupport "--with-google-api-keyfile=ga"
   ++ flag crashreporterSupport "crashreporter"
   ++ flag safeBrowsingSupport "safe-browsing"
-  ++ flag drmSupport "eme"
+  ++ lib.optional drmSupport "--enable-eme=widevine"
 
   ++ (if debugBuild then [ "--enable-debug" "--enable-profiling" ]
                     else [ "--disable-debug" "--enable-release"
diff --git a/pkgs/applications/networking/mailreaders/neomutt/default.nix b/pkgs/applications/networking/mailreaders/neomutt/default.nix
index 3473d321c75b..7de359bae5a5 100644
--- a/pkgs/applications/networking/mailreaders/neomutt/default.nix
+++ b/pkgs/applications/networking/mailreaders/neomutt/default.nix
@@ -2,14 +2,14 @@
 , cyrus_sasl, gss, gpgme, kerberos, libidn, notmuch, openssl, lmdb, libxslt, docbook_xsl }:
 
 stdenv.mkDerivation rec {
-  version = "20170609";
+  version = "20170714";
   name = "neomutt-${version}";
 
   src = fetchFromGitHub {
     owner  = "neomutt";
     repo   = "neomutt";
     rev    = "neomutt-${version}";
-    sha256 = "015dd6rphvqdmnv477f1is22l7n5gvcvyblbyp0ggbp64650k0bz";
+    sha256 = "0jbh83hvq1jwb8ps7ffl2325y6i79wdnwcn6db0r5prmxax18hw1";
   };
 
   nativeBuildInputs = [ autoreconfHook docbook_xsl libxslt.bin which ];
diff --git a/pkgs/applications/office/paperwork/default.nix b/pkgs/applications/office/paperwork/default.nix
index c24812418180..e24d96257b27 100644
--- a/pkgs/applications/office/paperwork/default.nix
+++ b/pkgs/applications/office/paperwork/default.nix
@@ -1,19 +1,19 @@
 { lib, python3Packages, fetchFromGitHub, gtk3, cairo
 , aspellDicts, buildEnv
 , gnome3, hicolor_icon_theme
-, xvfb_run, dbus
+, xvfb_run, dbus, libnotify
 }:
 
 python3Packages.buildPythonApplication rec {
   name = "paperwork-${version}";
   # Don't forget to also update paperwork-backend when updating this!
-  version = "1.0.6.1";
+  version = "1.2";
 
   src = fetchFromGitHub {
     repo = "paperwork";
     owner = "jflesch";
     rev = version;
-    sha256 = "1v1lxyi4crdik4jlwjds9n6lzw4m4l4f9n5azlinv8wb477qpv6h";
+    sha256 = "1cb9wnhhpm3dyxjrkyl9bbva56xx85vlwlb7z07m1icflcln14x5";
   };
 
   # Patch out a few paths that assume that we're using the FHS:
@@ -47,7 +47,7 @@ python3Packages.buildPythonApplication rec {
   }}/lib/aspell";
 
   checkInputs = [ xvfb_run dbus.daemon ];
-  buildInputs = [ gnome3.defaultIconTheme hicolor_icon_theme ];
+  buildInputs = [ gnome3.defaultIconTheme hicolor_icon_theme libnotify ];
 
   # A few parts of chkdeps need to have a display and a dbus session, so we not
   # only need to run a virtual X server + dbus but also have a large enough
@@ -59,7 +59,7 @@ python3Packages.buildPythonApplication rec {
   '';
 
   propagatedBuildInputs = with python3Packages; [
-    paperwork-backend pypillowfight gtk3 cairo
+    paperwork-backend pypillowfight gtk3 cairo pyxdg dateutil
   ];
 
   makeWrapperArgs = [
diff --git a/pkgs/build-support/docker/default.nix b/pkgs/build-support/docker/default.nix
index e06be51f4a4e..506ef7837a2e 100644
--- a/pkgs/build-support/docker/default.nix
+++ b/pkgs/build-support/docker/default.nix
@@ -234,11 +234,10 @@ rec {
     # Files to add to the layer.
     contents ? null,
     # Additional commands to run on the layer before it is tar'd up.
-    extraCommands ? ""
+    extraCommands ? "", uid ? 0, gid ? 0
   }:
     runCommand "docker-layer-${name}" {
       inherit baseJson contents extraCommands;
-
       buildInputs = [ jshon rsync ];
     }
     ''
@@ -253,6 +252,8 @@ rec {
         echo "No contents to add to layer."
       fi
 
+      chmod ug+w layer
+
       if [[ -n $extraCommands ]]; then
         (cd layer; eval "$extraCommands")
       fi
@@ -260,7 +261,7 @@ rec {
       # Tar up the layer and throw it into 'layer.tar'.
       echo "Packing layer..."
       mkdir $out
-      tar -C layer --mtime="@$SOURCE_DATE_EPOCH" -cf $out/layer.tar .
+      tar -C layer --mtime="@$SOURCE_DATE_EPOCH" --owner=${toString uid} --group=${toString gid} -cf $out/layer.tar .
 
       # Compute a checksum of the tarball.
       echo "Computing layer checksum..."
@@ -312,6 +313,8 @@ rec {
           echo "Adding $item..."
           rsync -ak --chown=0:0 $item/ layer/
         done
+
+        chmod ug+w layer
       '';
 
       postMount = ''
@@ -375,7 +378,7 @@ rec {
     # Docker config; e.g. what command to run on the container.
     config ? null,
     # Optional bash script to run on the files prior to fixturizing the layer.
-    extraCommands ? "",
+    extraCommands ? "", uid ? 0, gid ? 0,
     # Optional bash script to run as root on the image when provisioning.
     runAsRoot ? null,
     # Size of the virtual machine disk to provision when building the image.
@@ -398,7 +401,7 @@ rec {
         if runAsRoot == null
         then mkPureLayer {
           name = baseName;
-          inherit baseJson contents extraCommands;
+          inherit baseJson contents extraCommands uid gid;
         } else mkRootLayer {
           name = baseName;
           inherit baseJson fromImage fromImageName fromImageTag
@@ -498,7 +501,7 @@ rec {
         chmod -R a-w image
 
         echo "Cooking the image..."
-        tar -C image --mtime="@$SOURCE_DATE_EPOCH" -c . | pigz -nT > $out
+        tar -C image --mtime="@$SOURCE_DATE_EPOCH" --owner=0 --group=0 -c . | pigz -nT > $out
 
         echo "Finished."
       '';
diff --git a/pkgs/data/misc/nixos-artwork/icons.nix b/pkgs/data/misc/nixos-artwork/icons.nix
new file mode 100644
index 000000000000..cee6e600cbe0
--- /dev/null
+++ b/pkgs/data/misc/nixos-artwork/icons.nix
@@ -0,0 +1,13 @@
+{ stdenv, fetchFromGitHub, imagemagick }:
+
+stdenv.mkDerivation {
+  name = "nixos-icons-2017-03-16";
+  srcs = fetchFromGitHub {
+    owner = "nixos";
+    repo = "nixos-artwork";
+    rev = "783ca1249fc4cfe523ad4e541f37e2229891bc8b";
+    sha256 = "0wp08b1gh2chs1xri43wziznyjcplx0clpsrb13wzyscv290ay5a";
+  };
+  makeFlags = [ "DESTDIR=$(out)" "prefix=" ];
+  buildInputs = [ imagemagick ];
+}
diff --git a/pkgs/development/beam-modules/default.nix b/pkgs/development/beam-modules/default.nix
index f0a049bb4b23..fa748da0031c 100644
--- a/pkgs/development/beam-modules/default.nix
+++ b/pkgs/development/beam-modules/default.nix
@@ -54,7 +54,8 @@ let
                        debugInfo = true;
                      };
 
-        lfe = callPackage ../interpreters/lfe { };
+        lfe = lfe_1_2;
+        lfe_1_2 = lib.callLFE ../interpreters/lfe/1.2.nix { inherit erlang buildRebar3 buildHex; };
 
         # Non hex packages
         hex = callPackage ./hex {};
diff --git a/pkgs/development/beam-modules/lib.nix b/pkgs/development/beam-modules/lib.nix
index dd4ed5e1bbf8..26d868a8e7c4 100644
--- a/pkgs/development/beam-modules/lib.nix
+++ b/pkgs/development/beam-modules/lib.nix
@@ -56,4 +56,26 @@ rec {
         mkDerivation = pkgs.makeOverridable builder;
       };
 
+  /* Uses generic-builder to evaluate provided drv containing Elixir version
+  specific data.
+
+  drv: package containing version-specific args;
+  builder: generic builder for all Erlang versions;
+  args: arguments merged into version-specific args, used mostly to customize
+        dependencies;
+
+  Arguments passed to the generic-builder are overridable.
+
+  Please note that "mkDerivation" defined here is the one called from 1.2.nix
+  and similar files.
+  */
+  callLFE = drv: args:
+    let
+      inherit (stdenv.lib) versionAtLeast;
+      builder = callPackage ../interpreters/lfe/generic-builder.nix args;
+    in
+      callPackage drv {
+        mkDerivation = pkgs.makeOverridable builder;
+      };
+
 }
diff --git a/pkgs/development/compilers/oraclejdk/jdk-linux-base.nix b/pkgs/development/compilers/oraclejdk/jdk-linux-base.nix
index 196544a64761..08fd724f7733 100644
--- a/pkgs/development/compilers/oraclejdk/jdk-linux-base.nix
+++ b/pkgs/development/compilers/oraclejdk/jdk-linux-base.nix
@@ -3,6 +3,7 @@
 , downloadUrl
 , sha256_i686
 , sha256_x86_64
+, sha256_armv7l
 , jceName
 , jceDownloadUrl
 , sha256JCE
@@ -34,10 +35,13 @@
 , setJavaClassPath
 }:
 
-assert stdenv.system == "i686-linux" || stdenv.system == "x86_64-linux";
+assert stdenv.system == "i686-linux"
+    || stdenv.system == "x86_64-linux"
+    || stdenv.system == "armv7l-linux";
 assert swingSupport -> xorg != null;
 
 let
+  abortArch = abort "jdk requires i686-linux, x86_64-linux, or armv7l-linux";
 
   /**
    * The JRE libraries are in directories that depend on the CPU.
@@ -47,8 +51,10 @@ let
       "i386"
     else if stdenv.system == "x86_64-linux" then
       "amd64"
+    else if stdenv.system == "armv7l-linux" then
+      "arm"
     else
-      abort "jdk requires i686-linux or x86_64 linux";
+      abortArch;
 
   jce =
     if installjce then
@@ -59,6 +65,14 @@ let
       }
     else
       "";
+
+  rSubPaths = [
+    "lib/${architecture}/jli"
+    "lib/${architecture}/server"
+    "lib/${architecture}/xawt"
+    "lib/${architecture}"
+  ];
+
 in
 
 let result = stdenv.mkDerivation rec {
@@ -78,8 +92,14 @@ let result = stdenv.mkDerivation rec {
         url = downloadUrl;
         sha256 = sha256_x86_64;
       }
+    else if stdenv.system == "armv7l-linux" then
+      requireFile {
+        name = "jdk-${productVersion}u${patchVersion}-linux-arm32-vfp-hflt.tar.gz";
+        url = downloadUrl;
+        sha256 = sha256_armv7l;
+      }
     else
-      abort "jdk requires i686-linux or x86_64 linux";
+      abortArch;
 
   nativeBuildInputs = [ file ]
     ++ stdenv.lib.optional installjce unzip;
@@ -134,18 +154,6 @@ let result = stdenv.mkDerivation rec {
       cp -v UnlimitedJCEPolicy*/*.jar $jrePath/lib/security
     fi
 
-    rpath=$rpath''${rpath:+:}$jrePath/lib/${architecture}/jli
-    rpath=$rpath''${rpath:+:}$jrePath/lib/${architecture}/server
-    rpath=$rpath''${rpath:+:}$jrePath/lib/${architecture}/xawt
-    rpath=$rpath''${rpath:+:}$jrePath/lib/${architecture}
-
-    # set all the dynamic linkers
-    find $out -type f -perm -0100 \
-        -exec patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-        --set-rpath "$rpath" {} \;
-
-    find $out -name "*.so" -exec patchelf --set-rpath "$rpath" {} \;
-
     if test -z "$pluginSupport"; then
       rm -f $out/bin/javaws
       if test -n "$installjdk"; then
@@ -163,11 +171,22 @@ let result = stdenv.mkDerivation rec {
     cat <<EOF >> $out/nix-support/setup-hook
     if [ -z "\$JAVA_HOME" ]; then export JAVA_HOME=$out; fi
     EOF
+  '';
+
+  postFixup = ''
+    rpath+="''${rpath:+:}${stdenv.lib.concatStringsSep ":" (map (a: "$jrePath/${a}") rSubPaths)}"
+
+    # set all the dynamic linkers
+    find $out -type f -perm -0100 \
+        -exec patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+        --set-rpath "$rpath" {} \;
+
+    find $out -name "*.so" -exec patchelf --set-rpath "$rpath" {} \;
 
     # Oracle Java Mission Control needs to know where libgtk-x11 and related is
-    if test -n "$installjdk"; then
+    if test -n "$installjdk" -a -x $out/bin/jmc; then
       wrapProgram "$out/bin/jmc" \
-          --suffix-each LD_LIBRARY_PATH ':' "${rpath}"
+          --suffix-each LD_LIBRARY_PATH ':' "$rpath"
     fi
   '';
 
@@ -192,7 +211,7 @@ let result = stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     license = licenses.unfree;
-    platforms = [ "i686-linux" "x86_64-linux" ]; # some inherit jre.meta.platforms
+    platforms = [ "i686-linux" "x86_64-linux" "armv7l-linux" ]; # some inherit jre.meta.platforms
   };
 
 }; in result
diff --git a/pkgs/development/compilers/oraclejdk/jdk8cpu-linux.nix b/pkgs/development/compilers/oraclejdk/jdk8cpu-linux.nix
index 8e93f76ff185..1c761d586035 100644
--- a/pkgs/development/compilers/oraclejdk/jdk8cpu-linux.nix
+++ b/pkgs/development/compilers/oraclejdk/jdk8cpu-linux.nix
@@ -4,6 +4,7 @@ import ./jdk-linux-base.nix {
   downloadUrl = http://www.oracle.com/technetwork/java/javase/downloads/jdk8-downloads-2133151.html;
   sha256_i686 = "0m3i1n1im1nlwb06wlsdajv19cd3zhrjkw8zbyjfznydn6qs4s80";
   sha256_x86_64 = "0dhj623ya01glcl3iir9ajifcrf6awhvpk936x9cxfj8zfyibck2";
+  sha256_armv7l = "0ja97nqn4x0ji16c7r6i9nnnj3745br7qlbj97jg1s8m2wk7f9jd";
   jceName = "jce_policy-8.zip";
   jceDownloadUrl = http://www.oracle.com/technetwork/java/javase/downloads/jce8-download-2133166.html;
   sha256JCE = "0n8b6b8qmwb14lllk2lk1q1ahd3za9fnjigz5xn65mpg48whl0pk";
diff --git a/pkgs/development/compilers/oraclejdk/jdk8psu-linux.nix b/pkgs/development/compilers/oraclejdk/jdk8psu-linux.nix
index 8e93f76ff185..1c761d586035 100644
--- a/pkgs/development/compilers/oraclejdk/jdk8psu-linux.nix
+++ b/pkgs/development/compilers/oraclejdk/jdk8psu-linux.nix
@@ -4,6 +4,7 @@ import ./jdk-linux-base.nix {
   downloadUrl = http://www.oracle.com/technetwork/java/javase/downloads/jdk8-downloads-2133151.html;
   sha256_i686 = "0m3i1n1im1nlwb06wlsdajv19cd3zhrjkw8zbyjfznydn6qs4s80";
   sha256_x86_64 = "0dhj623ya01glcl3iir9ajifcrf6awhvpk936x9cxfj8zfyibck2";
+  sha256_armv7l = "0ja97nqn4x0ji16c7r6i9nnnj3745br7qlbj97jg1s8m2wk7f9jd";
   jceName = "jce_policy-8.zip";
   jceDownloadUrl = http://www.oracle.com/technetwork/java/javase/downloads/jce8-download-2133166.html;
   sha256JCE = "0n8b6b8qmwb14lllk2lk1q1ahd3za9fnjigz5xn65mpg48whl0pk";
diff --git a/pkgs/development/interpreters/lfe/1.2.nix b/pkgs/development/interpreters/lfe/1.2.nix
new file mode 100644
index 000000000000..b81acdaa499e
--- /dev/null
+++ b/pkgs/development/interpreters/lfe/1.2.nix
@@ -0,0 +1,7 @@
+{ mkDerivation }:
+
+mkDerivation {
+  version = "1.2.1";
+  sha256 = "0j5gjlsk92y14kxgvd80q9vwyhmjkphpzadcswyjxikgahwg1avz";
+  maximumOTPVersion = "19";
+}
diff --git a/pkgs/development/interpreters/lfe/default.nix b/pkgs/development/interpreters/lfe/generic-builder.nix
index cafcc4c28ee8..fb034a471e7c 100644
--- a/pkgs/development/interpreters/lfe/default.nix
+++ b/pkgs/development/interpreters/lfe/generic-builder.nix
@@ -1,29 +1,38 @@
-{ stdenv, fetchFromGitHub, erlang, makeWrapper, coreutils, bash, beamPackages }:
+{ stdenv, fetchFromGitHub, erlang, makeWrapper, coreutils, bash, buildRebar3, buildHex }:
+
+{ baseName ? "lfe"
+, version
+, maximumOTPVersion
+, sha256 ? null
+, rev ? version
+, src ? fetchFromGitHub { inherit rev sha256; owner = "rvirding"; repo = "lfe"; }
+}:
 
 let
-  inherit (beamPackages) buildRebar3 buildHex;
-  proper = buildHex rec {
-    name    = "proper";
+  inherit (stdenv.lib) getVersion versionAtLeast splitString head;
+
+  mainVersion = head (splitString "." (getVersion erlang));
+
+  proper = buildHex {
+    name = "proper";
     version = "1.1.1-beta";
+
     sha256  = "0hnkhs761yjynw9382w8wm4j3x0r7lllzavaq2kh9n7qy3zc1rdx";
 
     configurePhase = ''
       ${erlang}/bin/escript write_compile_flags include/compile_flags.hrl
     '';
   };
+
 in
-buildRebar3 rec {
-  name    = "lfe";
-  version = "1.2.1";
-
-  src = fetchFromGitHub {
-    owner  = "rvirding";
-    repo   = name;
-    rev    = version;
-    sha256 = "0j5gjlsk92y14kxgvd80q9vwyhmjkphpzadcswyjxikgahwg1avz";
-  };
+assert versionAtLeast maximumOTPVersion mainVersion;
+
+buildRebar3 {
+  name = baseName;
 
-  buildInputs = [ makeWrapper ];
+  inherit src version;
+
+  buildInputs = [ erlang makeWrapper ];
   beamDeps    = [ proper ];
   patches     = [ ./no-test-deps.patch ];
   doCheck     = true;
@@ -41,6 +50,7 @@ buildRebar3 rec {
     install -m644 _build/default/lib/lfe/ebin/* $ebindir
 
     install -m755 -d $bindir
+
     for bin in bin/lfe{,c,doc,script}; do install -m755 $bin $bindir; done
 
     install -m755 -d $out/bin
@@ -70,7 +80,7 @@ buildRebar3 rec {
     downloadPage = "https://github.com/rvirding/lfe/releases";
 
     license      = licenses.asl20;
-    maintainers  = with maintainers; [ yurrriq ];
+    maintainers  = with maintainers; [ yurrriq ankhers ];
     platforms    = platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/aspell/aspell-with-dicts.nix b/pkgs/development/libraries/aspell/aspell-with-dicts.nix
new file mode 100644
index 000000000000..eb96070f4fd7
--- /dev/null
+++ b/pkgs/development/libraries/aspell/aspell-with-dicts.nix
@@ -0,0 +1,35 @@
+# Create a derivation that contains aspell and selected dictionaries.
+# Composition is done using `pkgs.buildEnv`.
+
+{ aspell
+, aspellDicts
+, makeWrapper
+, symlinkJoin
+, runCommand
+}:
+
+f:
+
+let
+  # Dictionaries we want
+  dicts = f aspellDicts;
+
+  # A tree containing the dictionaries
+  dictEnv = symlinkJoin {
+    name = "aspell-dicts";
+    paths = dicts;
+  };
+
+in runCommand "aspell-env" {
+  buildInputs = [ makeWrapper ];
+} ''
+  # Construct wrappers in /bin
+  mkdir -p $out/bin
+  pushd "${aspell}/bin"
+  for prg in *; do
+    if [ -f "$prg" ]; then
+      makeWrapper "${aspell}/bin/$prg" "$out/bin/$prg" --set ASPELL_CONF "data-dir ${dictEnv}/lib/aspell"
+    fi
+  done
+  popd
+''
diff --git a/pkgs/development/libraries/exiv2/default.nix b/pkgs/development/libraries/exiv2/default.nix
index a11be14df109..a1a07b43197f 100644
--- a/pkgs/development/libraries/exiv2/default.nix
+++ b/pkgs/development/libraries/exiv2/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, fetchpatch, zlib, expat, gettext }:
 
 stdenv.mkDerivation rec {
-  name = "exiv2-0.25";
+  name = "exiv2-0.26";
 
   src = fetchurl {
-    url = "http://www.exiv2.org/${name}.tar.gz";
-    sha256 = "197g6vgcpyf9p2cwn5p5hb1r714xsk1v4p96f5pv1z8mi9vzq2y8";
+    url = "http://www.exiv2.org/builds/${name}-trunk.tar.gz";
+    sha256 = "1yza317qxd8yshvqnay164imm0ks7cvij8y8j86p1gqi1153qpn7";
   };
   postPatch = "patchShebangs ./src/svn_version.sh";
 
diff --git a/pkgs/development/libraries/hunspell/dictionaries.nix b/pkgs/development/libraries/hunspell/dictionaries.nix
index 0d21649a9b1f..120b4176c196 100644
--- a/pkgs/development/libraries/hunspell/dictionaries.nix
+++ b/pkgs/development/libraries/hunspell/dictionaries.nix
@@ -1,30 +1,13 @@
 /* hunspell dictionaries */
 
-{ stdenv, fetchurl, unzip }:
+{ stdenv, fetchurl, fetchFromGitHub, unzip, coreutils, bash, which, zip }:
 
-with stdenv.lib;
 
 let
-
   mkDict =
-  { name, src, meta, readmeFile, dictFileName, ... }:
-  let
-    isFrench = hasSuffix "fr_" dictFileName;
-    isItaly = hasSuffix "it_" dictFileName;
-    isSpanish = hasSuffix "es_" dictFileName;
-    isEnglish = hasSuffix "en_" dictFileName;
-  in
-  stdenv.mkDerivation rec {
-    inherit name src meta;
-    buildInputs = [ unzip ];
-    sourceRoot = ".";
-    phases = "unpackPhase installPhase" + (if isItaly then "patchPhase" else "");
-    unpackCmd = "unzip $src ${readmeFile} ${dictFileName}.dic ${dictFileName}.aff";
-    prePatch = if isItaly then ''
-    # Fix dic file empty lines (FS#22275)
-    sed '/^\/$/d' -i it_IT.dic
-    '' else "";
-
+  { name, readmeFile, dictFileName, ... }@args:
+  stdenv.mkDerivation (rec {
+    inherit name;
     installPhase = ''
       # hunspell dicts
       install -dm755 "$out/share/hunspell"
@@ -38,7 +21,45 @@ let
       install -dm755 "$out/share/doc"
       install -m644 ${readmeFile} $out/share/doc/${name}.txt
     '';
-  };
+  } // args);
+
+  mkDictFromRla =
+    { shortName, shortDescription, dictFileName }:
+    mkDict rec {
+      inherit dictFileName;
+      version = "2.2";
+      name = "hunspell-dict-${shortName}-rla-${version}";
+      readmeFile = "README.txt";
+      src = fetchFromGitHub {
+        owner = "sbosio";
+        repo = "rla-es";
+        rev = "v${version}";
+        sha256 = "0n9ms092k7vg7xpd3ksadxydbrizkb7js7dfxr08nbnnb9fgy0i8";
+      };
+      meta = with stdenv.lib; {
+        description = "Hunspell dictionary for ${shortDescription} from rla";
+        homepage = https://github.com/sbosio/rla-es;
+        license = with licenses; [ gpl3 lgpl3 mpl11 ];
+        maintainers = with maintainers; [ renzo ];
+        platforms = platforms.all;
+      };
+      phases = "unpackPhase patchPhase buildPhase installPhase";
+      buildInputs = [ bash coreutils unzip which zip ];
+      patchPhase = ''
+        substituteInPlace ortograf/herramientas/make_dict.sh \
+           --replace /bin/bash bash \
+           --replace /dev/stderr stderr.log
+
+        substituteInPlace ortograf/herramientas/remover_comentarios.sh \
+           --replace /bin/bash bash \
+      '';
+      buildPhase = ''
+        cd ortograf/herramientas
+        bash -x ./make_dict.sh -l ${dictFileName} -2
+        unzip ${dictFileName}.zip \
+          ${dictFileName}.dic ${dictFileName}.aff ${readmeFile}
+      '';
+    };
 
   mkDictFromDicollecte =
     { shortName, shortDescription, longDescription, dictFileName }:
@@ -59,6 +80,12 @@ let
         maintainers = with maintainers; [ renzo ];
         platforms = platforms.all;
       };
+      buildInputs = [ unzip ];
+      phases = "unpackPhase installPhase";
+      sourceRoot = ".";
+      unpackCmd = ''
+        unzip $src ${dictFileName}.dic ${dictFileName}.aff ${readmeFile}
+      '';
     };
 
   mkDictFromWordlist =
@@ -75,9 +102,15 @@ let
         maintainers = with maintainers; [ renzo ];
         platforms = platforms.all;
       };
+      buildInputs = [ unzip ];
+      phases = "unpackPhase installPhase";
+      sourceRoot = ".";
+      unpackCmd = ''
+        unzip $src ${dictFileName}.dic ${dictFileName}.aff ${readmeFile}
+      '';
     };
 
-  mkLinguistico =
+  mkDictFromLinguistico =
     { shortName, shortDescription, dictFileName, src }:
     mkDict rec {
       inherit src dictFileName;
@@ -90,6 +123,16 @@ let
         maintainers = with maintainers; [ renzo ];
         platforms = platforms.all;
       };
+      buildInputs = [ unzip ];
+      phases = "unpackPhase patchPhase installPhase";
+      sourceRoot = ".";
+      prePatch = ''
+        # Fix dic file empty lines (FS#22275)
+        sed '/^\/$/d' -i ${dictFileName}.dic
+      '';
+      unpackCmd = ''
+        unzip $src ${dictFileName}.dic ${dictFileName}.aff ${readmeFile}
+      '';
     };
 
   mkDictFromXuxen =
@@ -169,6 +212,134 @@ in {
     };
   };
 
+  /* SPANISH */
+
+  es-any = mkDictFromRla {
+    shortName = "es-any";
+    shortDescription = "Spanish (any variant)";
+    dictFileName = "es_ANY";
+  };
+
+  es-ar = mkDictFromRla {
+    shortName = "es-ar";
+    shortDescription = "Spanish (Argentina)";
+    dictFileName = "es_AR";
+  };
+
+  es-bo = mkDictFromRla {
+    shortName = "es-bo";
+    shortDescription = "Spanish (Bolivia)";
+    dictFileName = "es_BO";
+  };
+
+  es-cl = mkDictFromRla {
+    shortName = "es-cl";
+    shortDescription = "Spanish (Chile)";
+    dictFileName = "es_CL";
+  };
+
+  es-co = mkDictFromRla {
+    shortName = "es-co";
+    shortDescription = "Spanish (Colombia)";
+    dictFileName = "es_CO";
+  };
+
+  es-cr = mkDictFromRla {
+    shortName = "es-cr";
+    shortDescription = "Spanish (Costra Rica)";
+    dictFileName = "es_CR";
+  };
+
+  es-cu = mkDictFromRla {
+    shortName = "es-cu";
+    shortDescription = "Spanish (Cuba)";
+    dictFileName = "es_CU";
+  };
+
+  es-do = mkDictFromRla {
+    shortName = "es-do";
+    shortDescription = "Spanish (Dominican Republic)";
+    dictFileName = "es_DO";
+  };
+
+  es-ec = mkDictFromRla {
+    shortName = "es-ec";
+    shortDescription = "Spanish (Ecuador)";
+    dictFileName = "es_EC";
+  };
+
+  es-es = mkDictFromRla {
+    shortName = "es-es";
+    shortDescription = "Spanish (Spain)";
+    dictFileName = "es_ES";
+  };
+
+  es-gt = mkDictFromRla {
+    shortName = "es-gt";
+    shortDescription = "Spanish (Guatemala)";
+    dictFileName = "es_GT";
+  };
+
+  es-hn = mkDictFromRla {
+    shortName = "es-hn";
+    shortDescription = "Spanish (Honduras)";
+    dictFileName = "es_HN";
+  };
+
+  es-mx = mkDictFromRla {
+    shortName = "es-mx";
+    shortDescription = "Spanish (Mexico)";
+    dictFileName = "es_MX";
+  };
+
+  es-ni = mkDictFromRla {
+    shortName = "es-ni";
+    shortDescription = "Spanish (Nicaragua)";
+    dictFileName = "es_NI";
+  };
+
+  es-pa = mkDictFromRla {
+    shortName = "es-pa";
+    shortDescription = "Spanish (Panama)";
+    dictFileName = "es_PA";
+  };
+
+  es-pe = mkDictFromRla {
+    shortName = "es-pe";
+    shortDescription = "Spanish (Peru)";
+    dictFileName = "es_PE";
+  };
+
+  es-pr = mkDictFromRla {
+    shortName = "es-pr";
+    shortDescription = "Spanish (Puerto Rico)";
+    dictFileName = "es_PR";
+  };
+
+  es-py = mkDictFromRla {
+    shortName = "es-py";
+    shortDescription = "Spanish (Paraguay)";
+    dictFileName = "es_PY";
+  };
+
+  es-sv = mkDictFromRla {
+    shortName = "es-sv";
+    shortDescription = "Spanish (El Salvador)";
+    dictFileName = "es_SV";
+  };
+
+  es-uy = mkDictFromRla {
+    shortName = "es-uy";
+    shortDescription = "Spanish (Uruguay)";
+    dictFileName = "es_UY";
+  };
+
+  es-ve = mkDictFromRla {
+    shortName = "es-ve";
+    shortDescription = "Spanish (Venezuela)";
+    dictFileName = "es_VE";
+  };
+
   /* FRENCH */
 
   fr-any = mkDictFromDicollecte {
@@ -215,7 +386,7 @@ in {
 
   /* ITALIAN */
 
-  it-it =  mkLinguistico rec {
+  it-it =  mkDictFromLinguistico rec {
     shortName = "it-it";
     dictFileName = "it_IT";
     shortDescription = "Hunspell dictionary for 'Italian (Italy)' from Linguistico";
diff --git a/pkgs/development/libraries/science/biology/elastix/default.nix b/pkgs/development/libraries/science/biology/elastix/default.nix
new file mode 100644
index 000000000000..55647713e6ee
--- /dev/null
+++ b/pkgs/development/libraries/science/biology/elastix/default.nix
@@ -0,0 +1,29 @@
+{ stdenv, fetchFromGitHub, cmake, itk, python }:
+
+stdenv.mkDerivation rec {
+  _name    = "elastix";
+  _version = "4.8";
+  name  = "${_name}-${_version}";
+
+  src = fetchFromGitHub {
+    owner  = "SuperElastix";
+    repo   = "elastix";
+    rev    = "ef057ff89233822b26b04b31c3c043af57d5deff";
+    sha256 = "0gm3a8dgqww50h6zld9ighjk92wlpybpimjwfz4s5h82vdjsvxrm";
+  };
+
+  nativeBuildInputs = [ cmake python ];
+  buildInputs = [ itk ];
+
+  cmakeFlags = [ "-DUSE_KNNGraphAlphaMutualInformationMetric=OFF" ];
+
+  checkPhase = "ctest";
+
+  meta = with stdenv.lib; {
+    homepage = http://elastix.isi.uu.nl/;
+    description = "Image registration toolkit based on ITK";
+    maintainers = with maintainers; [ bcdarwin ];
+    platforms = platforms.unix;
+    license = licenses.asl20;
+  };
+}
diff --git a/pkgs/development/ocaml-modules/sedlex/default.nix b/pkgs/development/ocaml-modules/sedlex/default.nix
index 6fcdb5ec6fa4..1e3cb02b913a 100644
--- a/pkgs/development/ocaml-modules/sedlex/default.nix
+++ b/pkgs/development/ocaml-modules/sedlex/default.nix
@@ -1,17 +1,19 @@
-{ stdenv, fetchzip, ocaml, findlib, gen, ppx_tools }:
+{ stdenv, fetchzip, ocaml, findlib, gen, ppx_tools_versioned }:
 
-assert stdenv.lib.versionAtLeast ocaml.version "4.02";
+if !stdenv.lib.versionAtLeast ocaml.version "4.02"
+then throw "sedlex is not available for OCaml ${ocaml.version}"
+else
 
 stdenv.mkDerivation rec {
   name = "ocaml${ocaml.version}-sedlex-${version}";
-  version = "1.99.3";
+  version = "1.99.4";
 
   src = fetchzip {
     url = "http://github.com/alainfrisch/sedlex/archive/v${version}.tar.gz";
-    sha256 = "1wghjy3qyj43ll1ikchlqy7fv2hxcn3ap9xgsscm2ch09d8dcv7y";
+    sha256 = "1b7nqxyfcz8i7m4b8zil2rn6ygh2czy26f9v64xnxn8r0hy9sh1m";
   };
 
-  buildInputs = [ ocaml findlib ppx_tools ];
+  buildInputs = [ ocaml findlib ppx_tools_versioned ];
 
   propagatedBuildInputs = [ gen ];
 
diff --git a/pkgs/development/python-modules/aafigure/default.nix b/pkgs/development/python-modules/aafigure/default.nix
new file mode 100644
index 000000000000..1084eca762be
--- /dev/null
+++ b/pkgs/development/python-modules/aafigure/default.nix
@@ -0,0 +1,32 @@
+{ stdenv, buildPythonPackage, fetchPypi, pillow }:
+
+buildPythonPackage rec {
+  pname = "aafigure";
+  version = "0.5";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "090c88beb091d28a233f854e239713aa15d8d1906ea16211855345c912e8a091";
+  };
+
+  propagatedBuildInputs = [ pillow ];
+
+  # error: invalid command 'test'
+  doCheck = false;
+
+  # Fix impurity. TODO: Do the font lookup using fontconfig instead of this
+  # manual method. Until that is fixed, we get this whenever we run aafigure:
+  #   WARNING: font not found, using PIL default font
+  patchPhase = ''
+    sed -i "s|/usr/share/fonts|/nonexisting-fonts-path|" aafigure/PILhelper.py
+  '';
+
+  meta = with stdenv.lib; {
+    description = "ASCII art to image converter";
+    homepage = https://launchpad.net/aafigure/;
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ bjornfor ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/development/python-modules/acme/default.nix b/pkgs/development/python-modules/acme/default.nix
new file mode 100644
index 000000000000..71357e5bef23
--- /dev/null
+++ b/pkgs/development/python-modules/acme/default.nix
@@ -0,0 +1,19 @@
+{ stdenv, buildPythonPackage, fetchPypi
+, certbot, nose, cryptography, pyasn1, pyopenssl, pyRFC3339
+, pytz, requests, six, werkzeug, mock, ndg-httpsclient }:
+
+buildPythonPackage rec {
+  inherit (certbot) src version;
+
+  pname = "acme";
+  name = "${pname}-${version}";
+
+  propagatedBuildInputs = [
+    cryptography pyasn1 pyopenssl pyRFC3339 pytz requests six werkzeug mock
+    ndg-httpsclient
+  ];
+
+  buildInputs = [ nose ];
+
+  postUnpack = "sourceRoot=\${sourceRoot}/acme";
+}
diff --git a/pkgs/development/python-modules/acoustics/default.nix b/pkgs/development/python-modules/acoustics/default.nix
new file mode 100644
index 000000000000..d1cb1180358f
--- /dev/null
+++ b/pkgs/development/python-modules/acoustics/default.nix
@@ -0,0 +1,26 @@
+{ stdenv, buildPythonPackage, fetchPypi
+, cython, pytest, numpy, scipy, matplotlib, pandas, tabulate }:
+
+buildPythonPackage rec {
+  pname = "acoustics";
+  version = "0.1.2";
+  name = "${pname}-${version}";
+
+  buildInputs = [ cython pytest ];
+  propagatedBuildInputs = [ numpy scipy matplotlib pandas tabulate ];
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "b75a47de700d01e704de95953a6e969922b2f510d7eefe59f7f8980ad44ad1b7";
+  };
+
+  # Tests not distributed
+  doCheck = false;
+
+  meta = with stdenv.lib; {
+    description = "A package for acousticians";
+    maintainer = with maintainers; [ fridh ];
+    license = with licenses; [ bsd3 ];
+    homepage = https://github.com/python-acoustics/python-acoustics;
+  };
+}
diff --git a/pkgs/development/python-modules/altair/default.nix b/pkgs/development/python-modules/altair/default.nix
new file mode 100644
index 000000000000..a0504de4fb81
--- /dev/null
+++ b/pkgs/development/python-modules/altair/default.nix
@@ -0,0 +1,30 @@
+{ stdenv, buildPythonPackage, fetchPypi
+, pytest, vega, pandas, ipython, traitlets }:
+
+buildPythonPackage rec {
+  pname = "altair";
+  version = "1.2.0";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "05c47dm20p7m0017p2h38il721rxag1q0457dj7whp0k8rc7qd1n";
+  };
+
+  buildInputs = [ pytest ];
+
+  checkPhase = ''
+    export LANG=en_US.UTF-8
+    py.test altair --doctest-modules
+  '';
+
+  propagatedBuildInputs = [ vega pandas ipython traitlets ];
+
+  meta = with stdenv.lib; {
+    description = "A declarative statistical visualization library for Python.";
+    homepage = https://github.com/altair-viz/altair;
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ teh ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/development/python-modules/ansicolor/default.nix b/pkgs/development/python-modules/ansicolor/default.nix
new file mode 100644
index 000000000000..3a45811ed9b3
--- /dev/null
+++ b/pkgs/development/python-modules/ansicolor/default.nix
@@ -0,0 +1,19 @@
+{ stdenv, buildPythonPackage, fetchPypi }:
+
+buildPythonPackage rec {
+  pname = "ansicolor";
+  version = "0.2.4";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0zlkk9706xn5yshwzdn8xsfkim8iv44zsl6qjwg2f4gn62rqky1h";
+  };
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/numerodix/ansicolor/";
+    description = "A library to produce ansi color output and colored highlighting and diffing";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ andsild ];
+  };
+}
diff --git a/pkgs/development/python-modules/discid/default.nix b/pkgs/development/python-modules/discid/default.nix
new file mode 100644
index 000000000000..167efe914256
--- /dev/null
+++ b/pkgs/development/python-modules/discid/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, libdiscid, buildPythonPackage, fetchPypi }:
+
+buildPythonPackage rec {
+  pname = "discid";
+  version = "1.1.0";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "b39d443051b26d0230be7a6c616243daae93337a8711dd5d4119bb6a0e516fa8";
+  };
+
+  patchPhase = ''
+    substituteInPlace discid/libdiscid.py \
+      --replace '_open_library(_LIB_NAME)' "_open_library('${libdiscid}/lib/libdiscid.so.0')"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Python binding of libdiscid";
+    homepage    = "https://python-discid.readthedocs.org/";
+    license     = licenses.lgpl3Plus;
+    platforms   = platforms.linux;
+  };
+}
diff --git a/pkgs/development/python-modules/django_tagging/default.nix b/pkgs/development/python-modules/django_tagging/default.nix
new file mode 100644
index 000000000000..6207408e0123
--- /dev/null
+++ b/pkgs/development/python-modules/django_tagging/default.nix
@@ -0,0 +1,22 @@
+{ stdenv, buildPythonPackage, fetchPypi, django }:
+
+buildPythonPackage rec {
+  pname = "django-tagging";
+  version = "0.4.5";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "00ki1g6pb2lnaj4lh0s865mmlf4kdwx7a6n38iy5qz9qv4xrvz4q";
+  };
+
+  # error: invalid command 'test'
+  doCheck = false;
+
+  propagatedBuildInputs = [ django ];
+
+  meta = {
+    description = "A generic tagging application for Django projects";
+    homepage = https://github.com/Fantomas42/django-tagging;
+  };
+}
diff --git a/pkgs/development/python-modules/emcee/default.nix b/pkgs/development/python-modules/emcee/default.nix
new file mode 100644
index 000000000000..3e95859fc0f8
--- /dev/null
+++ b/pkgs/development/python-modules/emcee/default.nix
@@ -0,0 +1,21 @@
+{ stdenv, buildPythonPackage, fetchPypi
+, numpy }:
+
+buildPythonPackage rec {
+  pname = "emcee";
+  version = "2.1.0";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0qyafp9jfya0mkxgqfvljf0rkic5fm8nimzwadyrxyvq7nd07qaw";
+  };
+
+  propagatedBuildInputs = [ numpy ];
+
+  meta = with stdenv.lib; {
+    description = "Kick ass affine-invariant ensemble MCMC sampling";
+    homepage = http://dan.iel.fm/emcee;
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/development/python-modules/intervaltree/default.nix b/pkgs/development/python-modules/intervaltree/default.nix
new file mode 100644
index 000000000000..69b35df29738
--- /dev/null
+++ b/pkgs/development/python-modules/intervaltree/default.nix
@@ -0,0 +1,33 @@
+{ stdenv, buildPythonPackage, fetchPypi
+, python, pytest, sortedcontainers }:
+
+buildPythonPackage rec {
+  version = "2.1.0";
+  pname = "intervaltree";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "02w191m9zxkcjqr1kv2slxvhymwhj3jnsyy3a28b837pi15q19dc";
+  };
+
+  buildInputs = [ pytest ];
+
+  propagatedBuildInputs = [ sortedcontainers ];
+
+  checkPhase = ''
+    runHook preCheck
+    # pytest will try to run tests for nix_run_setup.py / files in build/lib which fails
+    mv nix_run_setup.py run_setup
+    rm build -rf
+    ${python.interpreter} run_setup test
+    runHook postCheck
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Editable interval tree data structure for Python 2 and 3";
+    homepage =  https://github.com/chaimleib/intervaltree;
+    license = [ licenses.asl20 ];
+    maintainers =  [ maintainers.bennofs ];
+  };
+}
diff --git a/pkgs/development/python-modules/jsonref/default.nix b/pkgs/development/python-modules/jsonref/default.nix
new file mode 100644
index 000000000000..ca9549b677bb
--- /dev/null
+++ b/pkgs/development/python-modules/jsonref/default.nix
@@ -0,0 +1,27 @@
+{ stdenv, buildPythonPackage, fetchPypi
+, pytest, mock }:
+
+buildPythonPackage rec {
+  pname = "jsonref";
+  version = "0.1";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1lqa8dy1sr1bxi00ri79lmbxvzxi84ki8p46zynyrgcqhwicxq2n";
+  };
+
+  buildInputs = [ pytest mock ];
+
+  checkPhase = ''
+    py.test tests.py
+  '';
+
+  meta = with stdenv.lib; {
+    description = "An implementation of JSON Reference for Python";
+    homepage    = "http://github.com/gazpachoking/jsonref";
+    license     = licenses.mit;
+    maintainers = with maintainers; [ nand0p ];
+    platforms   = platforms.all;
+  };
+}
diff --git a/pkgs/development/python-modules/packaging/default.nix b/pkgs/development/python-modules/packaging/default.nix
new file mode 100644
index 000000000000..776ec7ffc4b3
--- /dev/null
+++ b/pkgs/development/python-modules/packaging/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, buildPythonPackage, fetchPypi
+, pyparsing, six, pytest, pretend }:
+
+buildPythonPackage rec {
+  pname = "packaging";
+  version = "16.8";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "5d50835fdf0a7edf0b55e311b7c887786504efea1177abd7e69329a8e5ea619e";
+  };
+
+  propagatedBuildInputs = [ pyparsing six ];
+
+  buildInputs = [ pytest pretend ];
+
+  meta = with stdenv.lib; {
+    description = "Core utilities for Python packages";
+    homepage = "https://github.com/pypa/packaging";
+    license = [ licenses.bsd2 licenses.asl20 ];
+    maintainers = with maintainers; [ bennofs ];
+  };
+}
diff --git a/pkgs/development/python-modules/pygame_sdl2/default.nix b/pkgs/development/python-modules/pygame_sdl2/default.nix
new file mode 100644
index 000000000000..6f6163bb35e8
--- /dev/null
+++ b/pkgs/development/python-modules/pygame_sdl2/default.nix
@@ -0,0 +1,33 @@
+{ stdenv, pkgs, buildPythonPackage, fetchFromGitHub
+, cython, SDL2, SDL2_image, SDL2_ttf, SDL2_mixer, libjpeg, libpng }:
+
+buildPythonPackage rec {
+  pname = "pygame_sdl2";
+  version = "6.99.10.1227";
+  name = "${pname}-${version}";
+
+  src = fetchFromGitHub {
+    owner = "renpy";
+    repo = "${pname}";
+    rev = "renpy-${version}";
+    sha256 = "10n6janvqh5adn7pcijqwqfh234sybjz788kb8ac6b4l11hy2lx1";
+  };
+
+  buildInputs = [
+    SDL2 SDL2_image SDL2_ttf SDL2_mixer
+    cython libjpeg libpng
+  ];
+
+  postInstall = ''
+    ( cd "$out"/include/python*/ ;
+      ln -s pygame-sdl2 pygame_sdl2 || true ; )
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A reimplementation of parts of pygame API using SDL2";
+    homepage    = "https://github.com/renpy/pygame_sdl2";
+    # Some parts are also available under Zlib License
+    license     = licenses.lgpl2;
+    maintainers = with maintainers; [ raskin ];
+  };
+}
diff --git a/pkgs/development/python-modules/pypandoc/default.nix b/pkgs/development/python-modules/pypandoc/default.nix
new file mode 100644
index 000000000000..8e06ba38ef97
--- /dev/null
+++ b/pkgs/development/python-modules/pypandoc/default.nix
@@ -0,0 +1,32 @@
+{ stdenv, buildPythonPackage, fetchPypi
+, pip, pandoc, glibcLocales, haskellPackages, texlive }:
+
+buildPythonPackage rec {
+  pname = "pypandoc";
+  version = "1.3.3";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0628f2kn4gqimnhpf251fgzl723hwgyl3idy69dkzyjvi45s5zm6";
+  };
+
+  # Fix tests: first requires network access, second is a bug (reported upstream)
+  preConfigure = ''
+    substituteInPlace tests.py --replace "pypandoc.convert(url, 'html')" "'GPL2 license'"
+    substituteInPlace tests.py --replace "pypandoc.convert_file(file_name, lua_file_name)" "'<h1 id=\"title\">title</h1>'"
+  '';
+
+  LC_ALL="en_US.UTF-8";
+
+  propagatedBuildInputs = [ pip ];
+
+  buildInputs = [ pandoc texlive.combined.scheme-small haskellPackages.pandoc-citeproc glibcLocales ];
+
+  meta = with stdenv.lib; {
+    description = "Thin wrapper for pandoc";
+    homepage = "https://github.com/bebraw/pypandoc";
+    license = licenses.mit;
+    maintainers = with maintainers; [ bennofs kristoff3r ];
+  };
+}
diff --git a/pkgs/development/python-modules/pytoml/default.nix b/pkgs/development/python-modules/pytoml/default.nix
new file mode 100644
index 000000000000..55479e76dafd
--- /dev/null
+++ b/pkgs/development/python-modules/pytoml/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, buildPythonPackage, fetchgit
+, python }:
+
+buildPythonPackage rec {
+  pname = "pytoml";
+  version = "0.1.11";
+  name = "${pname}-${version}";
+
+  checkPhase = "${python.interpreter} test/test.py";
+
+  # fetchgit used to ensure test submodule is available
+  src = fetchgit {
+    url = "${meta.homepage}.git";
+    rev = "refs/tags/v${version}";
+    sha256 = "1jiw04zk9ccynr8kb1vqh9r1p2kh0al7g7b1f94911iazg7dgs9j";
+  };
+
+  meta = with stdenv.lib; {
+    description = "A TOML parser/writer for Python";
+    homepage    = https://github.com/avakar/pytoml;
+    license     = licenses.mit;
+    maintainers = with maintainers; [ peterhoeg ];
+  };
+}
diff --git a/pkgs/development/python-modules/stripe/default.nix b/pkgs/development/python-modules/stripe/default.nix
new file mode 100644
index 000000000000..5a1e114fb259
--- /dev/null
+++ b/pkgs/development/python-modules/stripe/default.nix
@@ -0,0 +1,27 @@
+{ stdenv, buildPythonPackage, fetchPypi
+, unittest2, mock, requests }:
+
+buildPythonPackage rec {
+  pname = "stripe";
+  version = "1.41.1";
+  name = "${pname}-${version}";
+
+  # Tests require network connectivity and there's no easy way to disable
+  # them. ~ C.
+  doCheck = false;
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0zvffvq933ia5w5ll6xhx2zgvppgc6zc2mxhc6f0kypw5g2fxvz5";
+  };
+
+  buildInputs = [ unittest2 mock ];
+
+  propagatedBuildInputs = [ requests ];
+
+  meta = with stdenv.lib; {
+    description = "Stripe Python bindings";
+    homepage = "https://github.com/stripe/stripe-python";
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/development/python-modules/tarsnapper-path.patch b/pkgs/development/python-modules/tarsnapper-path.patch
deleted file mode 100644
index 337ad49f9715..000000000000
--- a/pkgs/development/python-modules/tarsnapper-path.patch
+++ /dev/null
@@ -1,20 +0,0 @@
-diff --git a/src/tarsnapper/script.py b/src/tarsnapper/script.py
-index 737ac8d..52cc775 100644
---- a/src/tarsnapper/script.py
-+++ b/src/tarsnapper/script.py
-@@ -48,7 +48,7 @@ class TarsnapBackend(object):
-         """
-         ``arguments`` is a single list of strings.
-         """
--        call_with = ['tarsnap']
-+        call_with = ['@NIXTARSNAPPATH@']
-         for option in self.options:
-             key = option[0]
-             pre = "-" if len(key) == 1 else "--"
-@@ -499,4 +499,4 @@ def run():
- 
- 
- if __name__ == '__main__':
--    run()
-\ No newline at end of file
-+    run()
diff --git a/pkgs/development/python-modules/unifi/default.nix b/pkgs/development/python-modules/unifi/default.nix
new file mode 100644
index 000000000000..89496e00e568
--- /dev/null
+++ b/pkgs/development/python-modules/unifi/default.nix
@@ -0,0 +1,25 @@
+{ stdenv, buildPythonPackage
+, fetchPypi, urllib3 }:
+
+buildPythonPackage rec {
+  pname = "unifi";
+  version = "1.2.5";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0prgx01hzs49prrazgxrinm7ivqzy57ch06qm2h7s1p957sazds8";
+  };
+
+  propagatedBuildInputs = [ urllib3 ];
+
+  # upstream has no tests
+  doCheck = false;
+
+  meta = with stdenv.lib; {
+    description = "An API towards the Ubiquity Networks UniFi controller";
+    homepage    = https://pypi.python.org/pypi/unifi/;
+    license     = licenses.mit;
+    maintainers = with maintainers; [ peterhoeg ];
+  };
+}
diff --git a/pkgs/development/python-modules/vega/default.nix b/pkgs/development/python-modules/vega/default.nix
new file mode 100644
index 000000000000..efdce1e6dba3
--- /dev/null
+++ b/pkgs/development/python-modules/vega/default.nix
@@ -0,0 +1,30 @@
+{ stdenv, buildPythonPackage , fetchPypi
+, pytest, jupyter_core, pandas }:
+
+buildPythonPackage rec {
+  pname = "vega";
+  version = "0.4.4";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "08k92afnk0bivm07h1l5nh26xl2rfp7qn03aq17q1hr3fs5r6cdm";
+  };
+
+  buildInputs = [ pytest ];
+  propagatedBuildInputs = [ jupyter_core pandas ];
+
+  meta = with stdenv.lib; {
+    description = "An IPython/Jupyter widget for Vega and Vega-Lite";
+    longDescription = ''
+      To use this you have to enter a nix-shell with vega. Then run:
+
+      jupyter nbextension install --user --py vega
+      jupyter nbextension enable --user vega
+    '';
+    homepage = https://github.com/vega/ipyvega;
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ teh ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/development/python-modules/vine/default.nix b/pkgs/development/python-modules/vine/default.nix
new file mode 100644
index 000000000000..85b17f5119ca
--- /dev/null
+++ b/pkgs/development/python-modules/vine/default.nix
@@ -0,0 +1,23 @@
+{ stdenv, buildPythonPackage, fetchPypi
+, case, pytest, pythonOlder }:
+
+buildPythonPackage rec {
+  pname = "vine";
+  version = "1.1.3";
+  name = "${pname}-${version}";
+
+  disable = pythonOlder "2.7";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0h94x9mc9bspg23lb1f73h7smdzc39ps7z7sm0q38ds9jahmvfc7";
+  };
+
+  buildInputs = [ case pytest ];
+
+  meta = with stdenv.lib; {
+    description = "Python promises";
+    homepage = https://github.com/celery/vine;
+    license = licenses.bsd3;
+  };
+}
diff --git a/pkgs/development/python-modules/yamllint/default.nix b/pkgs/development/python-modules/yamllint/default.nix
new file mode 100644
index 000000000000..6fbd6886b1a9
--- /dev/null
+++ b/pkgs/development/python-modules/yamllint/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, buildPythonPackage, fetchPypi
+, nose, pyyaml }:
+
+buildPythonPackage rec {
+  pname = "yamllint";
+  version = "0.5.2";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0brdy1crhfng10hlw0420bv10c2xnjk8ndnhssybkzym47yrzg84";
+  };
+
+  buildInputs = [ nose ];
+
+  propagatedBuildInputs = [  pyyaml ];
+
+  meta = with stdenv.lib; {
+    description = "A linter for YAML files";
+    homepage = "https://github.com/adrienverge/yamllint";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ mikefaille ];
+  };
+}
diff --git a/pkgs/development/python-modules/yapf/default.nix b/pkgs/development/python-modules/yapf/default.nix
new file mode 100644
index 000000000000..b7f9d7139278
--- /dev/null
+++ b/pkgs/development/python-modules/yapf/default.nix
@@ -0,0 +1,20 @@
+{ stdenv, buildPythonPackage, fetchPypi }:
+
+buildPythonPackage rec {
+  pname = "yapf";
+  version = "0.11.0";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "14kb9gxw39zhvrijhp066b4bm6bgv35iw56c394y4dyczpha0dij";
+  };
+
+  meta = with stdenv.lib; {
+    description = "A formatter for Python code.";
+    homepage    = "https://github.com/google/yapf";
+    license     = licenses.asl20;
+    maintainers = with maintainers; [ siddharthist ];
+  };
+
+}
diff --git a/pkgs/development/python-modules/zeroconf/default.nix b/pkgs/development/python-modules/zeroconf/default.nix
new file mode 100644
index 000000000000..487f657680c2
--- /dev/null
+++ b/pkgs/development/python-modules/zeroconf/default.nix
@@ -0,0 +1,22 @@
+{ stdenv, buildPythonPackage, fetchPypi
+, netifaces, six, enum-compat }:
+
+buildPythonPackage rec {
+  pname = "zeroconf";
+  version = "0.18.0";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0s1840v2h4h19ad8lfadbm3dhzs8bw9c5c3slkxql1zsaiycvjy2";
+  };
+
+  propagatedBuildInputs = [ netifaces six enum-compat ];
+
+  meta = with stdenv.lib; {
+    description = "A pure python implementation of multicast DNS service discovery";
+    homepage = "https://github.com/jstasiak/python-zeroconf";
+    license = licenses.lgpl21;
+    maintainers = with maintainers; [ abbradar ];
+  };
+}
diff --git a/pkgs/development/r-modules/default.nix b/pkgs/development/r-modules/default.nix
index 7354f5e5715d..3de25dd1478d 100644
--- a/pkgs/development/r-modules/default.nix
+++ b/pkgs/development/r-modules/default.nix
@@ -281,6 +281,7 @@ let
     pbdMPI = [ pkgs.openmpi ];
     pbdNCDF4 = [ pkgs.netcdf ];
     pbdPROF = [ pkgs.openmpi ];
+    pbdZMQ = [ pkgs.which ];
     PKI = [ pkgs.openssl.dev ];
     png = [ pkgs.libpng.dev ];
     PopGenome = [ pkgs.zlib.dev ];
diff --git a/pkgs/development/tools/misc/lttng-ust/default.nix b/pkgs/development/tools/misc/lttng-ust/default.nix
index 8994d0c3512b..3b294d137574 100644
--- a/pkgs/development/tools/misc/lttng-ust/default.nix
+++ b/pkgs/development/tools/misc/lttng-ust/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, liburcu }:
+{ stdenv, fetchurl, liburcu, python }:
 
 # NOTE:
 #   ./configure ...
@@ -20,7 +20,11 @@ stdenv.mkDerivation rec {
     sha256 = "196snxrs1p205jz566rwxh7dqzsa3k16c7vm6k7i3gdvrmkx54dq";
   };
 
-  buildInputs = [ liburcu ];
+  buildInputs = [ liburcu python ];
+
+  preConfigure = ''
+    patchShebangs .
+  '';
 
   meta = with stdenv.lib; {
     description = "LTTng Userspace Tracer libraries";
diff --git a/pkgs/development/tools/misc/teensy-loader-cli/default.nix b/pkgs/development/tools/misc/teensy-loader-cli/default.nix
index db86f1a56d6e..7b360655c4f7 100644
--- a/pkgs/development/tools/misc/teensy-loader-cli/default.nix
+++ b/pkgs/development/tools/misc/teensy-loader-cli/default.nix
@@ -6,8 +6,8 @@ stdenv.mkDerivation {
   name = "teensy-loader-cli-${version}";
   src = fetchgit {
     url = "git://github.com/PaulStoffregen/teensy_loader_cli.git";
-    rev = "001da416bc362ff24485ff97e3a729bd921afe98";
-    sha256 = "36aed0a725055e36d71183ff57a023993099fdc380072177cffc7676da3c3966";
+    rev = "f5b6d7aafda9a8b014b4bb08660833ca45c136d2";
+    sha256 = "1a663bv3lvm7bsf2wcaj2c0vpmniak7w5hwix5qgz608bvm2v781";
   };
 
   buildInputs = [ unzip libusb ];
diff --git a/pkgs/development/tools/ocaml/ocaml-top/default.nix b/pkgs/development/tools/ocaml/ocaml-top/default.nix
index e194a77fbe81..e9331d078cf3 100644
--- a/pkgs/development/tools/ocaml/ocaml-top/default.nix
+++ b/pkgs/development/tools/ocaml/ocaml-top/default.nix
@@ -1,15 +1,15 @@
 { stdenv, fetchzip, ncurses
 , ocamlPackages
-, opam }:
+, jbuilder }:
 
 stdenv.mkDerivation {
-  name = "ocaml-top-1.1.3";
+  name = "ocaml-top-1.1.4";
   src = fetchzip {
-    url = https://github.com/OCamlPro/ocaml-top/archive/1.1.3.tar.gz;
-    sha256 = "0islyinv7lwhg8hkg4xn30wwz1nv50rj0wpsis8jpimw6jdsnax3";
+    url = https://github.com/OCamlPro/ocaml-top/archive/1.1.4.tar.gz;
+    sha256 = "1lmzjmnzsg8xdz0q5nm95zclihi9z80kzsalapg0s9wq0id8qm4j";
   };
 
-  buildInputs = [ ncurses opam ]
+  buildInputs = [ ncurses jbuilder ]
   ++ (with ocamlPackages; [ ocaml ocpBuild findlib lablgtk ocp-index ]);
 
   configurePhase = ''
@@ -17,9 +17,9 @@ stdenv.mkDerivation {
     ocp-build -init
   '';
 
-  buildPhase = "ocp-build ocaml-top";
+  buildPhase = "jbuilder build";
 
-  installPhase = "opam-installer --prefix=$out";
+  inherit (jbuilder) installPhase;
 
   meta = {
     homepage = http://www.typerex.org/ocaml-top.html;
diff --git a/pkgs/development/tools/ocaml/ocp-build/default.nix b/pkgs/development/tools/ocaml/ocp-build/default.nix
index 931e6989aa10..2a9a634d0a4a 100644
--- a/pkgs/development/tools/ocaml/ocp-build/default.nix
+++ b/pkgs/development/tools/ocaml/ocp-build/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub, ocaml, findlib, ncurses, buildOcaml }:
 let
-  version = "1.99.18-beta";
+  version = "1.99.19-beta";
 in
 buildOcaml {
 
@@ -11,7 +11,7 @@ buildOcaml {
     owner = "OCamlPro";
     repo = "ocp-build";
     rev = version;
-    sha256 = "14vzam8p1d2c5qxljrhsfppd8a3j9lxx8kzxlplwclkr2laar0ss";
+    sha256 = "162k5l0cxyqanxlml5v8mqapdq5qbqc9m4b8wdjq7mf523b3h2zj";
   };
 
   buildInputs = [ ocaml ];
diff --git a/pkgs/games/factorio/default.nix b/pkgs/games/factorio/default.nix
index 1d52cf845d91..5c24c3ec8076 100644
--- a/pkgs/games/factorio/default.nix
+++ b/pkgs/games/factorio/default.nix
@@ -10,7 +10,7 @@ assert releaseType == "alpha" || releaseType == "headless" || releaseType == "de
 
 with stdenv.lib;
 let
-  version = if releaseType != "demo" then "0.15.26" else "0.15.25";
+  version = if releaseType != "demo" then "0.15.30" else "0.15.25";
 
   arch = if stdenv.system == "x86_64-linux" then {
     inUrl = "linux64";
@@ -26,8 +26,8 @@ let
     url = "https://www.factorio.com/get-download/${version}/${releaseType}/${arch.inUrl}";
     name = "factorio_${releaseType}_${arch.inTar}-${version}.tar.xz";
     x64 = {
-      headless =           fetchurl { inherit name url; sha256 = "1nblfff1m5wgp177l508y94n61lga3palhzw4frp2vd98sdp7gqk"; };
-      alpha    = authenticatedFetch { inherit name url; sha256 = "0g7k58h15q4n9wxf96rx72w340xpdbj8k1faaxixrfrfx8bnmsls"; };
+      headless =           fetchurl { inherit name url; sha256 = "0nmr73i9acnqgphfmsps7f8jlw0f2gyal9l8pldlp4rk0cjgvszy"; };
+      alpha    = authenticatedFetch { inherit name url; sha256 = "1ydh44na2lbvdv4anrblym7d6wxwapfbwap40n3722llrsad0zsz"; };
       demo     =           fetchurl { inherit name url; sha256 = "1qz6g8mf221ic663zk92l6rs77ggfydaw2d8g2s7wy0j9097qbsl"; };
     };
     i386 = {
diff --git a/pkgs/games/factorio/fetch.sh b/pkgs/games/factorio/fetch.sh
index 30d9c9fdefe0..312dc9b6d61e 100644
--- a/pkgs/games/factorio/fetch.sh
+++ b/pkgs/games/factorio/fetch.sh
@@ -33,7 +33,7 @@ $curl --data-urlencode csrf_token="$csrf" \
 
 if grep -q 'Location: https://' headers; then
     # Now download. We need --insecure for this, but the sha256 should cover us.
-    $curl --insecure --location $url > $out
+    $curl --insecure --location --fail $url > $out || { echo "Login succeeded, but subsequent fetch failed."; exit 1; }
     set +x
 else
     set +x
diff --git a/pkgs/misc/themes/zuki/default.nix b/pkgs/misc/themes/zuki/default.nix
index 491885a14b3f..8fa6176f22eb 100644
--- a/pkgs/misc/themes/zuki/default.nix
+++ b/pkgs/misc/themes/zuki/default.nix
@@ -4,20 +4,23 @@ stdenv.mkDerivation rec {
   name = "zuki-themes-${version}";
   version = "${gnome3.version}.${date}";
   date = {
-    "3.20" = "2017-02-09";
-    "3.22" = "2017-02-17";
+    "3.20" = "2017-05-03";
+    "3.22" = "2017-04-23";
+    "3.24" = "2017-06-26";
   }."${gnome3.version}";
 
   src = fetchFromGitHub {
     owner = "lassekongo83";
     repo = "zuki-themes";
     rev = {
-      "3.20" = "b9106c3c05012b7e91394819ca550def3357d2eb";
-      "3.22" = "fc3cf7c372bcc439870c4785f91b8ea7af73e1cc";
+      "3.20" = "ce7ae498df7d5c81acaf48ed957b9f828356d58c";
+      "3.22" = "e97f2c3cf75b5205bc5ecd6072696327169fde5d";
+      "3.24" = "d25e0a2fb6e08ad107d8bb627451433362f2a830";
     }."${gnome3.version}";
     sha256 = {
-      "3.20" = "03k18p25gsscv05934vs0py26vpcrx93wi5bj6di277c6kwgjzxg";
-      "3.22" = "02ppk8wsx0k7j3zgmcb1l8jgij0m5rdkrahfv884jxkyjr6wwgs5";
+      "3.20" = "0na81q9mc8kwn9m04kkcchrdr67087dqf3q155imhjgqrxjhh3w4";
+      "3.22" = "195v0d2sgqh92c104xqm00p68yxp6kzp5mzx8q7s36bdv9p972q4";
+      "3.24" = "0z5swi5aah3s4yinfglh491qydxgjkqwf6zxyz7k9c1d7lrvj3ww";
     }."${gnome3.version}";
   };
 
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 73dce131cf8b..9700373c852f 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -302,7 +302,9 @@ with stdenv.lib;
   CIFS_UPCALL y
   CIFS_ACL y
   CIFS_DFS_UPCALL y
-  CIFS_SMB2 y
+  ${optionalString (versionOlder version "4.13") ''
+    CIFS_SMB2 y
+  ''}
   ${optionalString (versionAtLeast version "3.12") ''
     CEPH_FSCACHE y
   ''}
diff --git a/pkgs/os-specific/linux/kernel/linux-4.11.nix b/pkgs/os-specific/linux/kernel/linux-4.11.nix
index eded1422440d..9bb4e85d3f91 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.11.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.11.nix
@@ -1,12 +1,12 @@
 { stdenv, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "4.11.10";
+  version = "4.11.11";
   extraMeta.branch = "4.11";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1dma031rcj8nvcb3znbcffafwm5cpax3cvqkq9zspa8lf5ah52si";
+    sha256 = "1dvs1r3vq15akyv0yxvim6j09pqac5dagqbchvdlsw5yi4fnylc8";
   };
 
   kernelPatches = args.kernelPatches;
diff --git a/pkgs/os-specific/linux/kernel/linux-4.12.nix b/pkgs/os-specific/linux/kernel/linux-4.12.nix
index 5ce28029c112..4cb408d33cb6 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.12.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.12.nix
@@ -1,12 +1,12 @@
 { stdenv, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "4.12.1";
+  version = "4.12.2";
   extraMeta.branch = "4.12";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0qm8lp6z3f2frqb585i5r7cb6hbzd0m13p0ywz4s8bqxwmrym1cw";
+    sha256 = "1ql5y6bvb1bx9b2k5iksdzjgzxnq852rvq69kdnkwa98p8p8ayha";
   };
 
   kernelPatches = args.kernelPatches;
diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix
index 5ac5a52c0a5e..76dc8f030cd2 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,12 +1,12 @@
 { stdenv, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "4.4.76";
+  version = "4.4.77";
   extraMeta.branch = "4.4";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "180mngyar7ky2aiaszmgfqpfvwi0kxcym8j3ifflzggwqjkgrrki";
+    sha256 = "1s5l5b3hpm691w94a3ddliy4gcxi2s9xm3hsazdwgzqrqdv70ysy";
   };
 
   kernelPatches = args.kernelPatches;
diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
index c42dbad57568..260b776999d0 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,12 +1,12 @@
 { stdenv, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "4.9.37";
+  version = "4.9.38";
   extraMeta.branch = "4.9";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "14300vddyz7x6vg1mx64a0i8i61fk5bl8azcvv7rf3b97c4cy7pn";
+    sha256 = "0x4h2b6xapqyxgivj9ay5yclmyl434bjfmq9ikajy7fmgpc8kmvn";
   };
 
   kernelPatches = args.kernelPatches;
diff --git a/pkgs/os-specific/linux/kernel/linux-hardened-copperhead.nix b/pkgs/os-specific/linux/kernel/linux-hardened-copperhead.nix
index 4b44ce9b00db..878f69dbaa57 100644
--- a/pkgs/os-specific/linux/kernel/linux-hardened-copperhead.nix
+++ b/pkgs/os-specific/linux/kernel/linux-hardened-copperhead.nix
@@ -1,9 +1,9 @@
 { stdenv, hostPlatform, fetchFromGitHub, perl, buildLinux, ... } @ args:
 
 let
-  version = "4.12.1";
+  version = "4.12.2";
   revision = "a";
-  sha256 = "0fjw5fmxpvdhfqkr4lcpmqw8xxj92q19ya8q48yhxvv149ahcvhq";
+  sha256 = "0w3k5a30li2qz2msach9sg9qsvmjsc4mf9k3ad5dxd0667a0hygm";
 in
 
 import ./generic.nix (args // {
diff --git a/pkgs/os-specific/linux/kernel/linux-testing.nix b/pkgs/os-specific/linux/kernel/linux-testing.nix
index 60dfe85a1606..c7a4ca30a7c1 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing.nix
@@ -1,13 +1,13 @@
 { stdenv, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "4.12-rc7";
-  modDirVersion = "4.12.0-rc7";
-  extraMeta.branch = "4.12";
+  version = "4.13-rc1";
+  modDirVersion = "4.13.0-rc1";
+  extraMeta.branch = "4.13";
 
   src = fetchurl {
     url = "https://git.kernel.org/torvalds/t/linux-${version}.tar.gz";
-    sha256 = "1svfswv0b4gagv1yiavwb22p726h0w81lgxjqq0h9m3gf4xlqp3x";
+    sha256 = "1pdbykp2336vk7ynrz0l95rwqags6kklbr08wjc7zpmdaad6yd6m";
   };
 
   features.iwlwifi = true;
diff --git a/pkgs/os-specific/linux/kernel/perf-offline-probe.patch b/pkgs/os-specific/linux/kernel/perf-offline-probe.patch
deleted file mode 100644
index 7334a339c858..000000000000
--- a/pkgs/os-specific/linux/kernel/perf-offline-probe.patch
+++ /dev/null
@@ -1,224 +0,0 @@
-From 8a937a25a7e3c19d5fb3f9d92f605cf5fda219d8 Mon Sep 17 00:00:00 2001
-From: Masami Hiramatsu <mhiramat@kernel.org>
-Date: Wed, 4 Jan 2017 12:30:19 +0900
-Subject: perf probe: Fix to probe on gcc generated symbols for offline kernel
-
-From: Masami Hiramatsu <mhiramat@kernel.org>
-
-commit 8a937a25a7e3c19d5fb3f9d92f605cf5fda219d8 upstream.
-
-Fix perf-probe to show probe definition on gcc generated symbols for
-offline kernel (including cross-arch kernel image).
-
-gcc sometimes optimizes functions and generate new symbols with suffixes
-such as ".constprop.N" or ".isra.N" etc. Since those symbol names are
-not recorded in DWARF, we have to find correct generated symbols from
-offline ELF binary to probe on it (kallsyms doesn't correct it).  For
-online kernel or uprobes we don't need it because those are rebased on
-_text, or a section relative address.
-
-E.g. Without this:
-
-  $ perf probe -k build-arm/vmlinux -F __slab_alloc*
-  __slab_alloc.constprop.9
-  $ perf probe -k build-arm/vmlinux -D __slab_alloc
-  p:probe/__slab_alloc __slab_alloc+0
-
-If you put above definition on target machine, it should fail
-because there is no __slab_alloc in kallsyms.
-
-With this fix, perf probe shows correct probe definition on
-__slab_alloc.constprop.9:
-
-  $ perf probe -k build-arm/vmlinux -D __slab_alloc
-  p:probe/__slab_alloc __slab_alloc.constprop.9+0
-
-Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
-Cc: Jiri Olsa <jolsa@redhat.com>
-Cc: Namhyung Kim <namhyung@kernel.org>
-Cc: Peter Zijlstra <peterz@infradead.org>
-Link: http://lkml.kernel.org/r/148350060434.19001.11864836288580083501.stgit@devbox
-Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
-Cc: Krister Johansen <kjlx@templeofstupid.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- tools/perf/util/probe-event.c |   48 +++++++++++++++++++++++++++++++++++++++++-
- 1 file changed, 47 insertions(+), 1 deletion(-)
-
---- a/tools/perf/util/probe-event.c
-+++ b/tools/perf/util/probe-event.c
-@@ -618,6 +618,51 @@ error:
-	return ret ? : -ENOENT;
- }
-
-+/*
-+ * Rename DWARF symbols to ELF symbols -- gcc sometimes optimizes functions
-+ * and generate new symbols with suffixes such as .constprop.N or .isra.N
-+ * etc. Since those symbols are not recorded in DWARF, we have to find
-+ * correct generated symbols from offline ELF binary.
-+ * For online kernel or uprobes we don't need this because those are
-+ * rebased on _text, or already a section relative address.
-+ */
-+static int
-+post_process_offline_probe_trace_events(struct probe_trace_event *tevs,
-+					int ntevs, const char *pathname)
-+{
-+	struct symbol *sym;
-+	struct map *map;
-+	unsigned long stext = 0;
-+	u64 addr;
-+	int i;
-+
-+	/* Prepare a map for offline binary */
-+	map = dso__new_map(pathname);
-+	if (!map || get_text_start_address(pathname, &stext) < 0) {
-+		pr_warning("Failed to get ELF symbols for %s\n", pathname);
-+		return -EINVAL;
-+	}
-+
-+	for (i = 0; i < ntevs; i++) {
-+		addr = tevs[i].point.address + tevs[i].point.offset - stext;
-+		sym = map__find_symbol(map, addr);
-+		if (!sym)
-+			continue;
-+		if (!strcmp(sym->name, tevs[i].point.symbol))
-+			continue;
-+		/* If we have no realname, use symbol for it */
-+		if (!tevs[i].point.realname)
-+			tevs[i].point.realname = tevs[i].point.symbol;
-+		else
-+			free(tevs[i].point.symbol);
-+		tevs[i].point.symbol = strdup(sym->name);
-+		tevs[i].point.offset = addr - sym->start;
-+	}
-+	map__put(map);
-+
-+	return 0;
-+}
-+
- static int add_exec_to_probe_trace_events(struct probe_trace_event *tevs,
-					  int ntevs, const char *exec)
- {
-@@ -694,7 +739,8 @@ post_process_kernel_probe_trace_events(s
-
-	/* Skip post process if the target is an offline kernel */
-	if (symbol_conf.ignore_vmlinux_buildid)
--		return 0;
-+		return post_process_offline_probe_trace_events(tevs, ntevs,
-+						symbol_conf.vmlinux_name);
-
-	reloc_sym = kernel_get_ref_reloc_sym();
-	if (!reloc_sym) {
-
----
-
-From 3e96dac7c956089d3f23aca98c4dfca57b6aaf8a Mon Sep 17 00:00:00 2001
-From: Masami Hiramatsu <mhiramat@kernel.org>
-Date: Wed, 11 Jan 2017 15:00:47 +0900
-Subject: perf probe: Add error checks to offline probe post-processing
-
-From: Masami Hiramatsu <mhiramat@kernel.org>
-
-commit 3e96dac7c956089d3f23aca98c4dfca57b6aaf8a upstream.
-
-Add error check codes on post processing and improve it for offline
-probe events as:
-
- - post processing fails if no matched symbol found in map(-ENOENT)
-   or strdup() failed(-ENOMEM).
-
- - Even if the symbol name is the same, it updates symbol address
-   and offset.
-
-Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
-Cc: Jiri Olsa <jolsa@redhat.com>
-Cc: Namhyung Kim <namhyung@kernel.org>
-Cc: Peter Zijlstra <peterz@infradead.org>
-Link: http://lkml.kernel.org/r/148411443738.9978.4617979132625405545.stgit@devbox
-Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
-Cc: Krister Johansen <kjlx@templeofstupid.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- tools/perf/util/probe-event.c |   50 +++++++++++++++++++++++++++---------------
- 1 file changed, 33 insertions(+), 17 deletions(-)
-
---- a/tools/perf/util/probe-event.c
-+++ b/tools/perf/util/probe-event.c
-@@ -618,6 +618,33 @@ error:
-	return ret ? : -ENOENT;
- }
-
-+/* Adjust symbol name and address */
-+static int post_process_probe_trace_point(struct probe_trace_point *tp,
-+					   struct map *map, unsigned long offs)
-+{
-+	struct symbol *sym;
-+	u64 addr = tp->address + tp->offset - offs;
-+
-+	sym = map__find_symbol(map, addr);
-+	if (!sym)
-+		return -ENOENT;
-+
-+	if (strcmp(sym->name, tp->symbol)) {
-+		/* If we have no realname, use symbol for it */
-+		if (!tp->realname)
-+			tp->realname = tp->symbol;
-+		else
-+			free(tp->symbol);
-+		tp->symbol = strdup(sym->name);
-+		if (!tp->symbol)
-+			return -ENOMEM;
-+	}
-+	tp->offset = addr - sym->start;
-+	tp->address -= offs;
-+
-+	return 0;
-+}
-+
- /*
-  * Rename DWARF symbols to ELF symbols -- gcc sometimes optimizes functions
-  * and generate new symbols with suffixes such as .constprop.N or .isra.N
-@@ -630,11 +657,9 @@ static int
- post_process_offline_probe_trace_events(struct probe_trace_event *tevs,
-					int ntevs, const char *pathname)
- {
--	struct symbol *sym;
-	struct map *map;
-	unsigned long stext = 0;
--	u64 addr;
--	int i;
-+	int i, ret = 0;
-
-	/* Prepare a map for offline binary */
-	map = dso__new_map(pathname);
-@@ -644,23 +669,14 @@ post_process_offline_probe_trace_events(
-	}
-
-	for (i = 0; i < ntevs; i++) {
--		addr = tevs[i].point.address + tevs[i].point.offset - stext;
--		sym = map__find_symbol(map, addr);
--		if (!sym)
--			continue;
--		if (!strcmp(sym->name, tevs[i].point.symbol))
--			continue;
--		/* If we have no realname, use symbol for it */
--		if (!tevs[i].point.realname)
--			tevs[i].point.realname = tevs[i].point.symbol;
--		else
--			free(tevs[i].point.symbol);
--		tevs[i].point.symbol = strdup(sym->name);
--		tevs[i].point.offset = addr - sym->start;
-+		ret = post_process_probe_trace_point(&tevs[i].point,
-+						     map, stext);
-+		if (ret < 0)
-+			break;
-	}
-	map__put(map);
-
--	return 0;
-+	return ret;
- }
-
- static int add_exec_to_probe_trace_events(struct probe_trace_event *tevs,
diff --git a/pkgs/os-specific/linux/kernel/perf.nix b/pkgs/os-specific/linux/kernel/perf.nix
index cb13167eebc5..3fbad924568f 100644
--- a/pkgs/os-specific/linux/kernel/perf.nix
+++ b/pkgs/os-specific/linux/kernel/perf.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation {
 
   inherit (kernel) src;
 
-  patches = kernel.patches ++ [ ./perf-binutils-path.patch ./perf-offline-probe.patch ];
+  patches = kernel.patches ++ [ ./perf-binutils-path.patch ];
 
   preConfigure = ''
     cd tools/perf
diff --git a/pkgs/os-specific/linux/spl/default.nix b/pkgs/os-specific/linux/spl/default.nix
index 26cc8ea7c711..941bd8a86710 100644
--- a/pkgs/os-specific/linux/spl/default.nix
+++ b/pkgs/os-specific/linux/spl/default.nix
@@ -62,11 +62,11 @@ in
   assert buildKernel -> kernel != null;
   {
     splStable = common {
-      version = "0.6.5.10";
-      sha256 = "1zdxggpdz9j0lpcqfnkvf4iym7mp2k246sg1s4frqaw1pwwcw9vi";
+      version = "0.6.5.11";
+      sha256 = "192val8035pj2rryi3fwb134avzirhv5ifaj5021vh8bbjx75pd5";
     };
     splUnstable = common {
-      version = "0.7.0-rc4";
-      sha256 = "13r5qwrdnaabqfy9fvizvdj4n4cvfv6zy4jh0vijzjvbjd4an9g1";
+      version = "0.7.0-rc5";
+      sha256 = "17y25g02c9swi3n90lhjvazcnsr69nh50dz3b8g1c08zlz9n2akp";
     };
   }
diff --git a/pkgs/os-specific/linux/zfs/default.nix b/pkgs/os-specific/linux/zfs/default.nix
index 50f4e6f2b410..414f2ba444a2 100644
--- a/pkgs/os-specific/linux/zfs/default.nix
+++ b/pkgs/os-specific/linux/zfs/default.nix
@@ -123,12 +123,12 @@ in
     # to be adapted
     zfsStable = common {
       # comment/uncomment if breaking kernel versions are known
-      incompatibleKernelVersion = null;
+      incompatibleKernelVersion = "4.12";
 
-      version = "0.6.5.10";
+      version = "0.6.5.11";
 
       # this package should point to the latest release.
-      sha256 = "04gn5fj22z17zq2nazxwl3j9dr33l79clha6ipxvdz241bhjqrk3";
+      sha256 = "1wqz43cjr21m3f52ahcikl2798pbzj5sfy16zqxwiqpv7iy09kr3";
       extraPatches = [
         (fetchpatch {
           url = "https://github.com/Mic92/zfs/compare/zfs-0.6.5.8...nixos-zfs-0.6.5.8.patch";
@@ -141,10 +141,10 @@ in
       # comment/uncomment if breaking kernel versions are known
       incompatibleKernelVersion = "4.12";
 
-      version = "0.7.0-rc4";
+      version = "0.7.0-rc5";
 
       # this package should point to a version / git revision compatible with the latest kernel release
-      sha256 = "16jiq2h7m2ljg5xv7m5lqmsszzclkhvj1iq1wa9w740la4vl22kf";
+      sha256 = "1k0fl6lbi5winri58v26k7gngd560hbj0247rnwcbc6j01ixsr5n";
       extraPatches = [
         (fetchpatch {
           url = "https://github.com/Mic92/zfs/compare/zfs-0.7.0-rc3...nixos-zfs-0.7.0-rc3.patch";
diff --git a/pkgs/servers/tt-rss/default.nix b/pkgs/servers/tt-rss/default.nix
index d42656cf0f6b..2cc0cac8a60a 100644
--- a/pkgs/servers/tt-rss/default.nix
+++ b/pkgs/servers/tt-rss/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   name = "tt-rss-${version}";
-  version = "16.3";
+  version = "17.4";
 
   src = fetchgit {
-    url = "https://tt-rss.org/gitlab/fox/tt-rss.git";
+    url = "https://git.tt-rss.org/git/tt-rss.git";
     rev = "refs/tags/${version}";
-    sha256 = "1584lcq6kcy9f8ik5djb9apck9hxvfpl54sn6yhl3pdfrfdj3nw5";
+    sha256 = "07ng21n4pva56cxnxkzd6vzs381zn67psqpm51ym5wnl644jqh08";
   };
 
   buildPhases = ["unpackPhase" "installPhase"];
diff --git a/pkgs/tools/backup/restic/default.nix b/pkgs/tools/backup/restic/default.nix
index 742c1cafc933..8f918dda59be 100644
--- a/pkgs/tools/backup/restic/default.nix
+++ b/pkgs/tools/backup/restic/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   name = "restic-${version}";
-  version = "0.6.1";
+  version = "0.7.0";
 
   goPackagePath = "github.com/restic/restic";
 
@@ -10,7 +10,7 @@ buildGoPackage rec {
     owner = "restic";
     repo = "restic";
     rev = "v${version}";
-    sha256 = "1rp4s1gh07j06457rhl4r0qnxqn0h7n4i8k50akdr87nwyikkn17";
+    sha256 = "1whzzma2c199i604qy1a807zhi8qgri1r9bbxl5l7wlfh7x0n6sd";
   };
 
   buildPhase = ''
diff --git a/pkgs/tools/backup/tarsnap/default.nix b/pkgs/tools/backup/tarsnap/default.nix
index 0f95a26c9401..9fca48bde1bb 100644
--- a/pkgs/tools/backup/tarsnap/default.nix
+++ b/pkgs/tools/backup/tarsnap/default.nix
@@ -8,11 +8,11 @@ let
 in
 stdenv.mkDerivation rec {
   name = "tarsnap-${version}";
-  version = "1.0.37";
+  version = "1.0.38";
 
   src = fetchurl {
     url = "https://www.tarsnap.com/download/tarsnap-autoconf-${version}.tgz";
-    sha256 = "1ynv323qi6775lzjb6hvifl8ajkv2bizy43sajadjfqvcl9r96gs";
+    sha256 = "0nyd722i7q8h81h5mvwxai0f3jmwd93r3ahjkmr12k55p8c0rvkn";
   };
 
   preConfigure = ''
diff --git a/pkgs/tools/backup/tarsnapper/default.nix b/pkgs/tools/backup/tarsnapper/default.nix
new file mode 100644
index 000000000000..54d85343e2da
--- /dev/null
+++ b/pkgs/tools/backup/tarsnapper/default.nix
@@ -0,0 +1,25 @@
+{ python3Packages, fetchFromGitHub , tarsnap }:
+
+python3Packages.buildPythonApplication rec {
+  name = "tarsnapper-${version}";
+  version = "0.4";
+
+  src = fetchFromGitHub {
+    owner = "miracle2k";
+    repo = "tarsnapper";
+    rev = version;
+    sha256 = "03db49188f4v1946c8mqqj30ah10x68hbg3a58js0syai32v12pm";
+  };
+
+  buildInputs = with python3Packages; [ nose pytest ];
+
+  checkPhase = ''
+    py.test .
+  '';
+
+  propagatedBuildInputs = with python3Packages; [ pyyaml dateutil pexpect ];
+
+  patches = [ ./remove-argparse.patch ];
+
+  makeWrapperArgs = ["--prefix PATH : ${tarsnap}/bin"];
+}
diff --git a/pkgs/tools/backup/tarsnapper/remove-argparse.patch b/pkgs/tools/backup/tarsnapper/remove-argparse.patch
new file mode 100644
index 000000000000..5fd36b14a133
--- /dev/null
+++ b/pkgs/tools/backup/tarsnapper/remove-argparse.patch
@@ -0,0 +1,10 @@
+--- tarsnapper-0.4-src.org/setup.py	1980-01-02 00:00:00.000000000 +0000
++++ tarsnapper-0.4-src/setup.py	2017-07-16 10:54:36.596499451 +0100
+@@ -45,6 +45,6 @@
+       url='http://github.com/miracle2k/tarsnapper',
+       license='BSD',
+       packages=['tarsnapper'],
+-      install_requires = ['argparse>=1.1', 'pyyaml>=3.09', 'python-dateutil>=2.4.0', 'pexpect>=3.1'],
++      install_requires = ['pyyaml>=3.09', 'python-dateutil>=2.4.0', 'pexpect>=3.1'],
+       **kw
+ )
diff --git a/pkgs/tools/networking/lftp/default.nix b/pkgs/tools/networking/lftp/default.nix
index ae62195342f6..67181d8aec36 100644
--- a/pkgs/tools/networking/lftp/default.nix
+++ b/pkgs/tools/networking/lftp/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   name = "lftp-${version}";
-  version = "4.7.7";
+  version = "4.8.0";
 
   src = fetchurl {
     urls = [
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
       "ftp://ftp.st.ryukoku.ac.jp/pub/network/ftp/lftp/${name}.tar.bz2"
       "http://lftp.yar.ru/ftp/old/${name}.tar.bz2"
       ];
-    sha256 = "104jvzmvbmblfg8n8ffrnrrg8za5l25n53lbkawwy5x3m4h1yi7y";
+    sha256 = "0z2432zxzg808swi72yak9kia976qrjj030grk0v4p54mcib3s34";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/tools/package-management/opkg/default.nix b/pkgs/tools/package-management/opkg/default.nix
index 3b636ab0e29b..e1e57a84b555 100644
--- a/pkgs/tools/package-management/opkg/default.nix
+++ b/pkgs/tools/package-management/opkg/default.nix
@@ -2,11 +2,11 @@
 , autoreconfHook }:
 
 stdenv.mkDerivation rec {
-  version = "0.3.4";
+  version = "0.3.5";
   name = "opkg-${version}";
   src = fetchurl {
     url = "http://downloads.yoctoproject.org/releases/opkg/opkg-${version}.tar.gz";
-    sha256 = "1glkxjhsaaji172phd1gv8g0k0fs09pij6k01cl9namnac5r02vm";
+    sha256 = "0ciz6h6sx9hnz463alpkcqwqnq8jk382ifc6z89j29hix8fw4jvk";
   };
 
   nativeBuildInputs = [ pkgconfig autoreconfHook ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 21d96f2edecb..f67a15d5d21a 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4370,6 +4370,8 @@ with pkgs;
 
   tarsnap = callPackage ../tools/backup/tarsnap { };
 
+  tarsnapper = callPackage ../tools/backup/tarsnapper { };
+
   tcpcrypt = callPackage ../tools/security/tcpcrypt { };
 
   tcptraceroute = callPackage ../tools/networking/tcptraceroute { };
@@ -5619,8 +5621,8 @@ with pkgs;
     (lib.addMetaAttrs { outputsToInstall = [ "jre" ]; }
       (openjdk7.jre // { outputs = [ "jre" ]; }));
 
-  jdk8 = openjdk8 // { outputs = [ "out" ]; };
-  jre8 = lib.setName "openjre-${lib.getVersion pkgs.openjdk8.jre}"
+  jdk8 = if stdenv.isArm then oraclejdk8 else openjdk8 // { outputs = [ "out" ]; };
+  jre8 = if stdenv.isArm then oraclejre8 else lib.setName "openjre-${lib.getVersion pkgs.openjdk8.jre}"
     (lib.addMetaAttrs { outputsToInstall = [ "jre" ]; }
       (openjdk8.jre // { outputs = [ "jre" ]; }));
   jre8_headless =
@@ -5653,7 +5655,8 @@ with pkgs;
 
   supportsJDK =
     system == "i686-linux" ||
-    system == "x86_64-linux";
+    system == "x86_64-linux" ||
+    system == "armv7l-linux";
 
   jdkdistro = oraclejdk8distro;
 
@@ -6064,7 +6067,7 @@ with pkgs;
   inherit (beam.interpreters)
     erlang erlang_odbc erlang_javac erlang_odbc_javac
     elixir elixir_1_5_rc elixir_1_4 elixir_1_3
-    lfe
+    lfe lfe_1_2
     erlangR16 erlangR16_odbc
     erlang_basho_R16B02 erlang_basho_R16B02_odbc
     erlangR17 erlangR17_odbc erlangR17_javac erlangR17_odbc_javac
@@ -7390,6 +7393,8 @@ with pkgs;
 
   aspellDicts = recurseIntoAttrs (callPackages ../development/libraries/aspell/dictionaries.nix {});
 
+  aspellWithDicts = callPackage ../development/libraries/aspell/aspell-with-dicts.nix { };
+
   attica = callPackage ../development/libraries/attica { };
 
   attr = callPackage ../development/libraries/attr { };
@@ -7654,6 +7659,8 @@ with pkgs;
 
   vmmlib = callPackage ../development/libraries/vmmlib {};
 
+  elastix = callPackage ../development/libraries/science/biology/elastix { };
+
   enchant = callPackage ../development/libraries/enchant { };
 
   enet = callPackage ../development/libraries/enet { };
@@ -13399,6 +13406,8 @@ with pkgs;
     libgpod = pkgs.libgpod.override { monoSupport = true; };
   };
 
+  bashSnippets = callPackage ../applications/misc/bashSnippets { };
+
   batik = callPackage ../applications/graphics/batik { };
 
   batti = callPackage ../applications/misc/batti { };
@@ -18651,6 +18660,7 @@ with pkgs;
   nix-serve = callPackage ../tools/package-management/nix-serve { };
 
   nixos-artwork = callPackage ../data/misc/nixos-artwork { };
+  nixos-icons = callPackage ../data/misc/nixos-artwork/icons.nix { };
 
   nixos-container = callPackage ../tools/virtualization/nixos-container { };
 
diff --git a/pkgs/top-level/beam-packages.nix b/pkgs/top-level/beam-packages.nix
index 8d01ad36139d..62ffaec26f3f 100644
--- a/pkgs/top-level/beam-packages.nix
+++ b/pkgs/top-level/beam-packages.nix
@@ -58,7 +58,7 @@ rec {
     # `beam.packages.erlangR19.elixir`.
     inherit (packages.erlang) elixir elixir_1_5_rc elixir_1_4 elixir_1_3;
 
-    lfe = packages.erlang.lfe;
+    inherit (packages.erlang) lfe lfe_1_2;
   };
 
   # Helper function to generate package set with a specific Erlang version.
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 971585d9bd4c..0726bfc6f715 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -84,29 +84,7 @@ in {
 
   vowpalwabbit = callPackage ../development/python-modules/vowpalwabbit { pythonPackages = self; };
 
-  acoustics = buildPythonPackage rec {
-    pname = "acoustics";
-    version = "0.1.2";
-    name = pname + "-" + version;
-
-    buildInputs = with self; [ cython pytest ];
-    propagatedBuildInputs = with self; [ numpy scipy matplotlib pandas tabulate ];
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/${builtins.substring 0 1 pname}/${pname}/${name}.tar.gz";
-      sha256 = "b75a47de700d01e704de95953a6e969922b2f510d7eefe59f7f8980ad44ad1b7";
-    };
-
-    # Tests not distributed
-    doCheck = false;
-
-    meta = {
-      description = "A package for acousticians";
-      maintainer = with maintainers; [ fridh ];
-      license = with licenses; [ bsd3 ];
-      homepage = https://github.com/python-acoustics/python-acoustics;
-    };
-  };
+  acoustics = callPackage ../development/python-modules/acoustics { };
 
   "3to2" = callPackage ../development/python-modules/3to2 { };
 
@@ -122,22 +100,7 @@ in {
 
   agate-sql = callPackage ../development/python-modules/agate-sql { };
 
-  ansicolor = buildPythonPackage rec {
-    name = "ansicolor-${version}";
-    version = "0.2.4";
-
-    src = pkgs.fetchurl{
-      url = "mirror://pypi/a/ansicolor/${name}.tar.gz";
-      sha256 = "0zlkk9706xn5yshwzdn8xsfkim8iv44zsl6qjwg2f4gn62rqky1h";
-    };
-
-    meta = {
-      homepage = "https://github.com/numerodix/ansicolor/";
-      description = "A library to produce ansi color output and colored highlighting and diffing";
-      license = licenses.asl20;
-      maintainers = with maintainers; [ andsild ];
-    };
-  };
+  ansicolor = callPackage ../development/python-modules/ansicolor { };
 
   asn1crypto = callPackage ../development/python-modules/asn1crypto { };
 
@@ -167,44 +130,13 @@ in {
 
   dkimpy = callPackage ../development/python-modules/dkimpy { };
 
-  emcee = buildPythonPackage {
-    name = "emcee-2.1.0";
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/e/emcee/emcee-2.1.0.tar.gz";
-      sha256 = "0qyafp9jfya0mkxgqfvljf0rkic5fm8nimzwadyrxyvq7nd07qaw";
-    };
-    propagatedBuildInputs = [ self.numpy ];
-    meta = {
-      homepage = http://dan.iel.fm/emcee;
-      license = "MIT";
-      description = "Kick ass affine-invariant ensemble MCMC sampling";
-    };
-  };
+  emcee = callPackage ../development/python-modules/emcee { };
 
   dbus-python = callPackage ../development/python-modules/dbus {
     dbus = pkgs.dbus;
   };
 
-  discid = buildPythonPackage rec {
-    name = "discid-1.1.0";
-
-    meta = {
-      description = "Python binding of libdiscid";
-      homepage    = "https://python-discid.readthedocs.org/";
-      license     = licenses.lgpl3Plus;
-      platforms   = platforms.linux;
-    };
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/d/discid/${name}.tar.gz";
-      sha256 = "b39d443051b26d0230be7a6c616243daae93337a8711dd5d4119bb6a0e516fa8";
-    };
-
-    patchPhase = ''
-      substituteInPlace discid/libdiscid.py \
-        --replace '_open_library(_LIB_NAME)' "_open_library('${pkgs.libdiscid}/lib/libdiscid.so.0')"
-    '';
-  };
+  discid = callPackage ../development/python-modules/discid { };
 
   discordpy = callPackage ../development/python-modules/discordpy { };
 
@@ -264,38 +196,10 @@ in {
 
   pygame-git = callPackage ../development/python-modules/pygame/git.nix { };
 
-  pygame_sdl2 = buildPythonPackage rec {
-    pname = "pygame_sdl2";
-    version = "6.99.10.1227";
-    name = "${pname}-${version}";
-
-    meta = {
-      description = "A reimplementation of parts of pygame API using SDL2";
-      homepage    = "https://github.com/renpy/pygame_sdl2";
-      # Some parts are also available under Zlib License
-      license     = licenses.lgpl2;
-      maintainers = with maintainers; [ raskin ];
-    };
-
-    propagatedBuildInputs = with self; [ ];
-    buildInputs = with pkgs; with self; [
-      SDL2 SDL2_image SDL2_ttf SDL2_mixer
-      cython libjpeg libpng ];
-
-    postInstall = ''
-      ( cd "$out"/include/python*/ ;
-        ln -s pygame-sdl2 pygame_sdl2 || true ; )
-    '';
-
-    src = pkgs.fetchFromGitHub {
-      owner = "renpy";
-      repo = "${pname}";
-      rev = "renpy-${version}";
-      sha256 = "10n6janvqh5adn7pcijqwqfh234sybjz788kb8ac6b4l11hy2lx1";
-    };
-  };
+  pygame_sdl2 = callPackage ../development/python-modules/pygame_sdl2 { };
 
   pygobject2 = callPackage ../development/python-modules/pygobject { };
+
   pygobject3 = callPackage ../development/python-modules/pygobject/3.nix { };
 
   pygtk = callPackage ../development/python-modules/pygtk { libglade = null; };
@@ -352,121 +256,19 @@ in {
     hdf5 = pkgs.hdf5.override { zlib = pkgs.zlib; };
   };
 
-  unifi = buildPythonPackage rec {
-    name = "unifi-1.2.5";
-
-    propagatedBuildInputs = with self; [ urllib3 ];
-
-    # upstream has no tests
-    doCheck = false;
-
-    meta = {
-      description = "An API towards the Ubiquity Networks UniFi controller";
-      homepage    = https://pypi.python.org/pypi/unifi/;
-      license     = licenses.mit;
-      maintainers = with maintainers; [ peterhoeg ];
-    };
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/u/unifi/${name}.tar.gz";
-      sha256 = "0prgx01hzs49prrazgxrinm7ivqzy57ch06qm2h7s1p957sazds8";
-    };
-  };
+  unifi = callPackage ../development/python-modules/unifi { };
 
   pyunbound = callPackage ../tools/networking/unbound/python.nix { };
 
   # packages defined here
 
-  aafigure = buildPythonPackage rec {
-    name = "aafigure-0.5";
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/a/aafigure/${name}.tar.gz";
-      sha256 = "090c88beb091d28a233f854e239713aa15d8d1906ea16211855345c912e8a091";
-    };
-
-    propagatedBuildInputs = with self; [ pillow ];
-
-    # error: invalid command 'test'
-    doCheck = false;
-
-    # Fix impurity. TODO: Do the font lookup using fontconfig instead of this
-    # manual method. Until that is fixed, we get this whenever we run aafigure:
-    #   WARNING: font not found, using PIL default font
-    patchPhase = ''
-      sed -i "s|/usr/share/fonts|/nonexisting-fonts-path|" aafigure/PILhelper.py
-    '';
-
-    meta = {
-      description = "ASCII art to image converter";
-      homepage = https://launchpad.net/aafigure/;
-      license = licenses.bsd2;
-      platforms = platforms.linux;
-      maintainers = with maintainers; [ bjornfor ];
-    };
-  };
-
-  altair = buildPythonPackage rec {
-    name = "altair-1.2.0";
+  aafigure = callPackage ../development/python-modules/aafigure { };
 
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/a/altair/${name}.tar.gz";
-      sha256 = "05c47dm20p7m0017p2h38il721rxag1q0457dj7whp0k8rc7qd1n";
-    };
-    buildInputs = [ self.pytest ];
+  altair = callPackage ../development/python-modules/altair { };
 
-    checkPhase = ''
-      export LANG=en_US.UTF-8
-      py.test altair --doctest-modules
-    '';
-    propagatedBuildInputs = with self; [ vega pandas ipython traitlets ];
-    meta = {
-      description = "A declarative statistical visualization library for Python.";
-      homepage = https://github.com/altair-viz/altair;
-      license = licenses.bsd3;
-      platforms = platforms.linux;
-      maintainers = with maintainers; [ teh ];
-    };
-  };
-  vega = buildPythonPackage rec {
-    name = "vega-0.4.4";
+  vega = callPackage ../development/python-modules/vega { };
 
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/v/vega/${name}.tar.gz";
-      sha256 = "08k92afnk0bivm07h1l5nh26xl2rfp7qn03aq17q1hr3fs5r6cdm";
-    };
-
-    buildInputs = [ self.pytest ];
-    propagatedBuildInputs = with self; [ jupyter_core pandas ];
-
-    meta = {
-      description = " An IPython/Jupyter widget for Vega and Vega-Lite.";
-      longDescription = ''
-        To use this you have to enter a nix-shell with vega. Then run:
-
-        jupyter nbextension install --user --py vega
-        jupyter nbextension enable --user vega
-      '';
-      homepage = https://github.com/vega/ipyvega;
-      license = licenses.bsd3;
-      platforms = platforms.linux;
-      maintainers = with maintainers; [ teh ];
-    };
-  };
-
-  acme = buildPythonPackage rec {
-    inherit (pkgs.certbot) src version;
-
-    name = "acme-${version}";
-
-    propagatedBuildInputs = with self; [
-      cryptography pyasn1 pyopenssl pyRFC3339 pytz requests six werkzeug mock
-      ndg-httpsclient
-    ];
-
-    buildInputs = with self; [ nose ];
-    postUnpack = "sourceRoot=\${sourceRoot}/acme";
-  };
+  acme = callPackage ../development/python-modules/acme { };
 
   acme-tiny = buildPythonPackage rec {
     name = "acme-tiny-${version}";
@@ -8192,30 +7994,25 @@ in {
 
   paperwork-backend = buildPythonPackage rec {
     name = "paperwork-backend-${version}";
-    version = "1.0.6";
+    version = "1.2.0";
 
     src = pkgs.fetchFromGitHub {
       owner = "jflesch";
       repo = "paperwork-backend";
       rev = version;
-      sha256 = "11jbhv9xcpimp9iq2b1hlpljzij73s86rb5lpgzhslqc7zmm5bxn";
+      sha256 = "1pzyy14f9wzh9vwn855k1z48a8mbs73j1dk8730kdlcdkmn3l1ms";
     };
 
     # Python 2.x is not supported.
     disabled = !isPy3k && !isPyPy;
 
-    # Make sure that chkdeps exits with status 1 if a dependency is not found.
-    postPatch = ''
-      sed -i -e '/print.*Missing dependencies/,/^ *$/ {
-        /^ *$/ a \    sys.exit(1)
-      }' scripts/paperwork-shell
-    '';
-
     preCheck = "\"$out/bin/paperwork-shell\" chkdeps paperwork_backend";
 
     propagatedBuildInputs = with self; [
       pyenchant simplebayes pillow pycountry whoosh termcolor
-      python-Levenshtein pyinsane2 pygobject3 pyocr pkgs.poppler_gi
+      python-Levenshtein pyinsane2 pygobject3 pyocr
+      pkgs.poppler_gi pkgs.gtk3
+      natsort
     ];
 
     meta = {
@@ -9938,26 +9735,9 @@ in {
 
   django_polymorphic = callPackage ../development/python-modules/django-polymorphic { };
 
-  django_tagging = buildPythonPackage rec {
-    name = "django-tagging-0.4.5";
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/d/django-tagging/${name}.tar.gz";
-      sha256 = "00ki1g6pb2lnaj4lh0s865mmlf4kdwx7a6n38iy5qz9qv4xrvz4q";
-    };
-
-    # error: invalid command 'test'
-    doCheck = false;
-
-    propagatedBuildInputs = with self; [ django ];
+  django_tagging = callPackage ../development/python-modules/django_tagging { };
 
-    meta = {
-      description = "A generic tagging application for Django projects";
-      homepage = https://github.com/Fantomas42/django-tagging;
-    };
-  };
-
-  django_tagging_0_3 = self.django_tagging.override (attrs: rec {
+  django_tagging_0_3 = self.django_tagging.overrideAttrs (attrs: rec {
     name = "django-tagging-0.3.6";
 
     src = pkgs.fetchurl {
@@ -23884,26 +23664,6 @@ in {
     };
   };
 
-  tarsnapper = buildPythonPackage rec {
-    name = "tarsnapper-0.2.1";
-    disabled = isPy3k;
-
-    src = pkgs.fetchgit {
-      url = https://github.com/miracle2k/tarsnapper.git;
-      rev = "620439bca68892f2ffaba1079a34b18496cc6596";
-      sha256 = "1n2k2r9x11r1ph9jcjhlk44hsghfnl1pl3aakbx121qc5dg7b0yn";
-    };
-
-    propagatedBuildInputs = with self; [ argparse pyyaml ];
-
-    patches = [ ../development/python-modules/tarsnapper-path.patch ];
-
-    preConfigure = ''
-      substituteInPlace src/tarsnapper/script.py \
-        --replace '@NIXTARSNAPPATH@' '${pkgs.tarsnap}/bin/tarsnap'
-    '';
-  };
-
   taskcoach = buildPythonPackage rec {
     name = "TaskCoach-1.3.22";
     disabled = isPy3k;
@@ -29972,48 +29732,11 @@ EOF
     };
   };
 
-  yapf = buildPythonPackage rec {
-    name = "yapf-${version}";
-    version = "0.11.0";
-
-    meta = {
-      description = "A formatter for Python code.";
-      homepage    = "https://github.com/google/yapf";
-      license     = licenses.asl20;
-      maintainers = with maintainers; [ siddharthist ];
-    };
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/y/yapf/${name}.tar.gz";
-      sha256 = "14kb9gxw39zhvrijhp066b4bm6bgv35iw56c394y4dyczpha0dij";
-    };
-  };
+  yapf = callPackage ../development/python-modules/yapf { };
 
   autobahn = callPackage ../development/python-modules/autobahn { };
 
-  jsonref = buildPythonPackage rec {
-    name = "${pname}-${version}";
-    pname = "jsonref";
-    version = "0.1";
-
-    meta = {
-      description = "An implementation of JSON Reference for Python.";
-      homepage    = "http://github.com/gazpachoking/jsonref";
-      license     = licenses.mit;
-      maintainers = with maintainers; [ nand0p ];
-      platforms   = platforms.all;
-    };
-
-    buildInputs = with self; [ pytest mock ];
-    checkPhase = ''
-      py.test tests.py
-    '';
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/j/${pname}/${name}.tar.gz";
-      sha256 = "1lqa8dy1sr1bxi00ri79lmbxvzxi84ki8p46zynyrgcqhwicxq2n";
-    };
-  };
+  jsonref = callPackage ../development/python-modules/jsonref { };
 
   whoosh = callPackage ../development/python-modules/whoosh { };
 
@@ -30087,115 +29810,15 @@ EOF
     };
   };
 
-  intervaltree = buildPythonPackage rec {
-    name = "intervaltree-${version}";
-    version = "2.1.0";
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/i/intervaltree/${name}.tar.gz";
-      sha256 = "02w191m9zxkcjqr1kv2slxvhymwhj3jnsyy3a28b837pi15q19dc";
-    };
-    buildInputs = with self; [ pytest ];
-    propagatedBuildInputs = with self; [ sortedcontainers ];
-    checkPhase = ''
-      runHook preCheck
-      # pytest will try to run tests for nix_run_setup.py / files in build/lib which fails
-      mv nix_run_setup.py run_setup
-      rm build -rf
-      ${python.interpreter} run_setup test
-      runHook postCheck
-    '';
-    meta = with pkgs.stdenv.lib; {
-      description = "Editable interval tree data structure for Python 2 and 3";
-      homepage =  https://github.com/chaimleib/intervaltree;
-      license = [ licenses.asl20 ];
-      maintainers =  [ maintainers.bennofs ];
-    };
-  };
-
-  packaging = buildPythonPackage rec {
-    name = "packaging-16.8";
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/p/packaging/${name}.tar.gz";
-      sha256 = "5d50835fdf0a7edf0b55e311b7c887786504efea1177abd7e69329a8e5ea619e";
-    };
-    propagatedBuildInputs = with self; [ pyparsing six ];
-    buildInputs = with self; [ pytest pretend ];
-
-    meta = with pkgs.stdenv.lib; {
-      description = "Core utilities for Python packages";
-      homepage = "https://github.com/pypa/packaging";
-      license = [ licenses.bsd2 licenses.asl20 ];
-      maintainers = with maintainers; [ bennofs ];
-    };
-  };
-
-  pytoml = buildPythonPackage rec {
-    name = "pytoml-${version}";
-    version = "0.1.11";
-
-    checkPhase = "${python.interpreter} test/test.py";
-
-    # fetchgit used to ensure test submodule is available
-    src = pkgs.fetchgit {
-      url = "${meta.homepage}.git";
-      rev = "refs/tags/v${version}";
-      sha256 = "1jiw04zk9ccynr8kb1vqh9r1p2kh0al7g7b1f94911iazg7dgs9j";
-    };
-
-    meta = {
-      description = "A TOML parser/writer for Python";
-      homepage    = https://github.com/avakar/pytoml;
-      license     = licenses.mit;
-      maintainers = with maintainers; [ peterhoeg ];
-    };
-  };
-
-  pypandoc = buildPythonPackage rec {
-    name = "pypandoc-1.3.3";
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/p/pypandoc/${name}.tar.gz";
-      sha256 = "0628f2kn4gqimnhpf251fgzl723hwgyl3idy69dkzyjvi45s5zm6";
-    };
-
-    # Fix tests: first requires network access, second is a bug (reported upstream)
-    preConfigure = ''
-      substituteInPlace tests.py --replace "pypandoc.convert(url, 'html')" "'GPL2 license'"
-      substituteInPlace tests.py --replace "pypandoc.convert_file(file_name, lua_file_name)" "'<h1 id=\"title\">title</h1>'"
-    '';
-
-    LC_ALL="en_US.UTF-8";
-
-    propagatedBuildInputs = with self; [ self.pip ];
-    buildInputs = [ pkgs.pandoc pkgs.texlive.combined.scheme-small pkgs.haskellPackages.pandoc-citeproc pkgs.glibcLocales ];
-
-    meta = with pkgs.stdenv.lib; {
-      description = "Thin wrapper for pandoc";
-      homepage = "https://github.com/bebraw/pypandoc";
-      license = licenses.mit;
-      maintainers = with maintainers; [ bennofs kristoff3r ];
-    };
-  };
+  intervaltree = callPackage ../development/python-modules/intervaltree { };
 
-  yamllint = buildPythonPackage rec {
-    name = "${pname}-${version}";
-    pname = "yamllint";
-    version = "0.5.2";
+  packaging = callPackage ../development/python-modules/packaging { };
 
-    src = pkgs.fetchurl{
-      url = "mirror://pypi/y/${pname}/${name}.tar.gz";
-      sha256 = "0brdy1crhfng10hlw0420bv10c2xnjk8ndnhssybkzym47yrzg84";
-    };
+  pytoml = callPackage ../development/python-modules/pytoml { };
 
-    buildInputs = with self; [ nose ];
-    propagatedBuildInputs = with self; [  pyyaml ];
+  pypandoc = callPackage ../development/python-modules/pypandoc { };
 
-    meta = {
-      homepage = "https://github.com/adrienverge/yamllint";
-      description = "A linter for YAML files";
-      license = licenses.gpl3;
-      maintainers = with maintainers; [ mikefaille ];
-    };
-  };
+  yamllint = callPackage ../development/python-modules/yamllint { };
 
   yarl = callPackage ../development/python-modules/yarl { };
 
@@ -30224,51 +29847,11 @@ EOF
 
   typed-ast = callPackage ../development/python-modules/typed-ast { };
 
-  stripe = buildPythonPackage rec {
-    name = "${pname}-${version}";
-    pname = "stripe";
-    version = "1.41.1";
-
-    # Tests require network connectivity and there's no easy way to disable
-    # them. ~ C.
-    doCheck = false;
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/s/${pname}/${name}.tar.gz";
-      sha256 = "0zvffvq933ia5w5ll6xhx2zgvppgc6zc2mxhc6f0kypw5g2fxvz5";
-    };
-
-    buildInputs = with self; [ unittest2 mock ];
-    propagatedBuildInputs = with self; [ requests ];
-
-    meta = {
-      homepage = "https://github.com/stripe/stripe-python";
-      description = "Stripe Python bindings";
-      license = licenses.mit;
-    };
-  };
+  stripe = callPackage ../development/python-modules/stripe { };
 
   uranium = callPackage ../development/python-modules/uranium { };
 
-  vine = buildPythonPackage rec {
-    name = "vine-${version}";
-    version = "1.1.3";
-
-    disable = pythonOlder "2.7";
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/v/vine/${name}.tar.gz";
-      sha256 = "0h94x9mc9bspg23lb1f73h7smdzc39ps7z7sm0q38ds9jahmvfc7";
-    };
-
-    buildInputs = with self; [ case pytest ];
-
-    meta = {
-      homepage = https://github.com/celery/vine;
-      description = "python promises";
-      license = licenses.bsd3;
-    };
-  };
+  vine = callPackage ../development/python-modules/vine { };
 
   wp_export_parser = buildPythonPackage rec {
     name = "${pname}-${version}";
@@ -30282,36 +29865,16 @@ EOF
     };
   };
 
-  wptserve = callPackage ../development/python-modules/wptserve {};
+  wptserve = callPackage ../development/python-modules/wptserve { };
 
-  yenc = callPackage ../development/python-modules/yenc {
-  };
+  yenc = callPackage ../development/python-modules/yenc { };
 
-  zeep = callPackage ../development/python-modules/zeep {
-  };
+  zeep = callPackage ../development/python-modules/zeep { };
 
   zeitgeist = if isPy3k then throw "zeitgeist not supported for interpreter ${python.executable}" else
     (pkgs.zeitgeist.override{python2Packages=self;}).py;
 
-  zeroconf = buildPythonPackage rec {
-    pname = "zeroconf";
-    version = "0.18.0";
-    name = "${pname}-${version}";
-
-    src = fetchPypi {
-      inherit pname version;
-      sha256 = "0s1840v2h4h19ad8lfadbm3dhzs8bw9c5c3slkxql1zsaiycvjy2";
-    };
-
-    propagatedBuildInputs = with self; [ netifaces six enum-compat ];
-
-    meta = {
-      description = "A pure python implementation of multicast DNS service discovery";
-      homepage = "https://github.com/jstasiak/python-zeroconf";
-      license = licenses.lgpl21;
-      maintainers = with maintainers; [ abbradar ];
-    };
-  };
+  zeroconf = callPackage ../development/python-modules/zeroconf { };
 
   zipfile36 = buildPythonPackage rec {
     pname = "zipfile36";