Merge remote-tracking branch 'upstream/master' into hardened-stdenv

21 files changed, 216 insertions, 287 deletions

diff --git a/pkgs/servers/dns/bind/default.nix b/pkgs/servers/dns/bind/default.nix
index a6933653e605..61ca93184dd6 100644
--- a/pkgs/servers/dns/bind/default.nix
+++ b/pkgs/servers/dns/bind/default.nix
@@ -1,13 +1,13 @@
 { stdenv, fetchurl, openssl, libtool, perl, libxml2 }:
 
-let version = "9.10.3"; in
+let version = "9.10.3-P4"; in
 
 stdenv.mkDerivation rec {
   name = "bind-${version}";
 
   src = fetchurl {
     url = "http://ftp.isc.org/isc/bind9/${version}/${name}.tar.gz";
-    sha256 = "1w4gp4hdkb452nmz91l413d1rx89isl2l6wv8kpbdd2afpc3phws";
+    sha256 = "0giys46ifypysf799w9v58kbaz1v3fbdzw3s212znifzzfsl9h1a";
   };
 
   patches = [ ./libressl.patch ./remove-mkdir-var.patch ];
diff --git a/pkgs/servers/freeradius/default.nix b/pkgs/servers/freeradius/default.nix
index 818cc30b0545..15bda5d3090d 100644
--- a/pkgs/servers/freeradius/default.nix
+++ b/pkgs/servers/freeradius/default.nix
@@ -1,28 +1,69 @@
-{ stdenv, fetchurl, autoreconfHook, talloc, openssl ? null }:
+{ stdenv, fetchurl, autoreconfHook, talloc
+, openssl
+, linkOpenssl? true
+, openldap
+, withLdap ? false
+, sqlite
+, withSqlite ? false
+, libpcap
+, withPcap ? true
+, libcap
+, withCap ? true
+, libmemcached
+, withMemcached ? false
+, hiredis
+, withRedis ? false
+, libmysql
+, withMysql ? false
+, withJson ? false
+, libyubikey
+, withYubikey ? false
+, collectd
+, withCollectd ? false
+}:
 
-## TODO: include ldap optionally
-## TODO: include sqlite optionally
-## TODO: include mysql optionally
+assert withSqlite -> sqlite != null;
+assert withLdap -> openldap != null;
+assert withPcap -> libpcap != null;
+assert withCap -> libcap != null;
+assert withMemcached -> libmemcached != null;
+assert withRedis -> hiredis != null;
+assert withMysql -> libmysql != null;
+assert withYubikey -> libyubikey != null;
+assert withCollectd -> collectd != null;
 
+## TODO: include windbind optionally (via samba?)
+## TODO: include oracle optionally
+## TODO: include ykclient optionally
+
+with stdenv.lib;
 stdenv.mkDerivation rec {
   name = "freeradius-${version}";
   version = "3.0.11";
 
-  buildInputs = [
-    autoreconfHook
-    talloc
-    openssl
-  ];
+  buildInputs = [ autoreconfHook openssl talloc ]
+    ++ optional withLdap [ openldap ]
+    ++ optional withSqlite [ sqlite ]
+    ++ optional withPcap [ libpcap ]
+    ++ optional withCap [ libcap ]
+    ++ optional withMemcached [ libmemcached ]
+    ++ optional withRedis [ hiredis ]
+    ++ optional withMysql [ libmysql ]
+    ++ optional withJson [ pkgs."json-c" ]
+    ++ optional withYubikey [ libyubikey ]
+    ++ optional withCollectd [ collectd ];
+
+  # NOTE: are the --with-{lib}-lib-dir and --with-{lib}-include-dir necessary with buildInputs ?
 
   configureFlags = [
      "--sysconfdir=/etc"
      "--localstatedir=/var"
-  ];
+  ] ++ optional (!linkOpenssl) "--with-openssl=no";
 
   installFlags = [
     "sysconfdir=\${out}/etc"
     "localstatedir=\${TMPDIR}"
-   ];
+  ];
 
   src = fetchurl {
     url = "ftp://ftp.freeradius.org/pub/freeradius/freeradius-server-${version}.tar.gz";
@@ -33,6 +74,7 @@ stdenv.mkDerivation rec {
     homepage = http://freeradius.org/;
     description = "A modular, high performance free RADIUS suite";
     license = stdenv.lib.licenses.gpl2;
+    maintainers = with maintainers; [ sheenobu ];
   };
 
 }
diff --git a/pkgs/servers/http/apt-cacher-ng/default.nix b/pkgs/servers/http/apt-cacher-ng/default.nix
index 625d9406641c..9e485946a18d 100644
--- a/pkgs/servers/http/apt-cacher-ng/default.nix
+++ b/pkgs/servers/http/apt-cacher-ng/default.nix
@@ -2,20 +2,21 @@
 
 stdenv.mkDerivation rec {
   name = "apt-cacher-ng-${version}";
-  version = "0.8.9";
+  version = "0.9.1";
 
   src = fetchurl {
     url = "http://ftp.debian.org/debian/pool/main/a/apt-cacher-ng/apt-cacher-ng_${version}.orig.tar.xz";
-    sha256 = "15zkacy8n6fiklqpdk139pa7qssynrr9akv5h54ky1l53n0k70m6";
+    sha256 = "1d686knvig1niapc1ib2045f7jfad3m4jvz6gkwm276fqvm4p694";
   };
 
   NIX_LDFLAGS = "-lpthread";
-  buildInputs = [ doxygen cmake zlib openssl bzip2 pkgconfig libpthreadstubs ];
+  nativeBuildInputs = [ cmake doxygen pkgconfig ];
+  buildInputs = [ zlib openssl bzip2 libpthreadstubs ];
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "A caching proxy specialized for linux distribution files";
-    homepage = http://www.unix-ag.uni-kl.de/~bloch/acng/;
-    license = stdenv.lib.licenses.gpl2;
-    maintainers = [ stdenv.lib.maintainers.makefu ];
+    homepage = https://www.unix-ag.uni-kl.de/~bloch/acng/;
+    license = licenses.gpl2;
+    maintainers = [ maintainers.makefu ];
   };
 }
diff --git a/pkgs/servers/mail/dovecot/2.2.x.nix b/pkgs/servers/mail/dovecot/2.2.x.nix
deleted file mode 100644
index ec4c5c935af0..000000000000
--- a/pkgs/servers/mail/dovecot/2.2.x.nix
+++ /dev/null
@@ -1,75 +0,0 @@
-{ stdenv, lib, fetchurl, perl, pkgconfig, systemd, openssl
-, bzip2, zlib, inotify-tools, pam, libcap
-, clucene_core_2, icu, openldap
-# Auth modules
-, withMySQL ? false, libmysql
-, withPgSQL ? false, postgresql
-, withSQLite ? true, sqlite
-}:
-
-stdenv.mkDerivation rec {
-  name = "dovecot-2.2.21";
-
-  nativeBuildInputs = [ perl pkgconfig ];
-  buildInputs = [ openssl bzip2 zlib clucene_core_2 icu openldap ]
-    ++ lib.optionals (stdenv.isLinux) [ systemd pam libcap inotify-tools ]
-    ++ lib.optional withMySQL libmysql
-    ++ lib.optional withPgSQL postgresql
-    ++ lib.optional withSQLite sqlite;
-
-  src = fetchurl {
-    url = "http://dovecot.org/releases/2.2/${name}.tar.gz";
-    sha256 = "080bil83gr2dski4gk2bxykg2g497kqm2hn2z4xkbw71b6g17dvs";
-  };
-
-  preConfigure = ''
-    patchShebangs src/config/settings-get.pl
-  '';
-
-  # We need this for sysconfdir, see remark below.
-  installFlags = [ "DESTDIR=$(out)" ];
-
-  postInstall = ''
-    cp -r $out/$out/* $out
-    rm -rf $out/$(echo "$out" | cut -d "/" -f2)
-  '' + lib.optionalString stdenv.isDarwin ''
-    install_name_tool -change libclucene-shared.1.dylib \
-        ${clucene_core_2}/lib/libclucene-shared.1.dylib \
-        $out/lib/dovecot/lib21_fts_lucene_plugin.so
-    install_name_tool -change libclucene-core.1.dylib \
-        ${clucene_core_2}/lib/libclucene-core.1.dylib \
-        $out/lib/dovecot/lib21_fts_lucene_plugin.so
-  '';
-
-  patches = [
-    # Make dovecot look for plugins in /etc/dovecot/modules
-    # so we can symlink plugins from several packages there.
-    # The symlinking needs to be done in NixOS.
-    ./2.2.x-module_dir.patch
-  ];
-
-  configureFlags = [
-    # It will hardcode this for /var/lib/dovecot.
-    # http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=626211
-    "--localstatedir=/var"
-    # We need this so utilities default to reading /etc/dovecot/dovecot.conf file.
-    "--sysconfdir=/etc"
-    "--with-ldap"
-    "--with-ssl=openssl"
-    "--with-zlib"
-    "--with-bzlib"
-    "--with-ldap"
-    "--with-lucene"
-    "--with-icu"
-  ] ++ lib.optional (stdenv.isLinux) "--with-systemdsystemunitdir=$(out)/etc/systemd/system"
-    ++ lib.optional withMySQL "--with-mysql"
-    ++ lib.optional withPgSQL "--with-pgsql"
-    ++ lib.optional withSQLite "--with-sqlite";
-
-  meta = {
-    homepage = "http://dovecot.org/";
-    description = "Open source IMAP and POP3 email server written with security primarily in mind";
-    maintainers = with stdenv.lib.maintainers; [viric simons rickynils];
-    hydraPlatforms = stdenv.lib.platforms.linux;
-  };
-}
diff --git a/pkgs/servers/mail/dovecot/default.nix b/pkgs/servers/mail/dovecot/default.nix
index 3997370154e4..ec4c5c935af0 100644
--- a/pkgs/servers/mail/dovecot/default.nix
+++ b/pkgs/servers/mail/dovecot/default.nix
@@ -1,27 +1,75 @@
-{stdenv, fetchurl, openssl, pam, bzip2, zlib, inotify-tools, openldap}:
+{ stdenv, lib, fetchurl, perl, pkgconfig, systemd, openssl
+, bzip2, zlib, inotify-tools, pam, libcap
+, clucene_core_2, icu, openldap
+# Auth modules
+, withMySQL ? false, libmysql
+, withPgSQL ? false, postgresql
+, withSQLite ? true, sqlite
+}:
 
 stdenv.mkDerivation rec {
-  name = "dovecot-2.1.17";
+  name = "dovecot-2.2.21";
 
-  buildInputs = [openssl bzip2 zlib openldap] ++ stdenv.lib.optionals stdenv.isLinux [pam inotify-tools];
+  nativeBuildInputs = [ perl pkgconfig ];
+  buildInputs = [ openssl bzip2 zlib clucene_core_2 icu openldap ]
+    ++ lib.optionals (stdenv.isLinux) [ systemd pam libcap inotify-tools ]
+    ++ lib.optional withMySQL libmysql
+    ++ lib.optional withPgSQL postgresql
+    ++ lib.optional withSQLite sqlite;
 
   src = fetchurl {
-    url = "http://dovecot.org/releases/2.1/${name}.tar.gz";
-    sha256 = "06j2s5bcrmc0dhjsyavqiss3k65p6xn00a7sffpsv6w3yngv777m";
+    url = "http://dovecot.org/releases/2.2/${name}.tar.gz";
+    sha256 = "080bil83gr2dski4gk2bxykg2g497kqm2hn2z4xkbw71b6g17dvs";
   };
 
-  # It will hardcode this for /var/lib/dovecot.
-  # http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=626211
+  preConfigure = ''
+    patchShebangs src/config/settings-get.pl
+  '';
+
+  # We need this for sysconfdir, see remark below.
+  installFlags = [ "DESTDIR=$(out)" ];
+
+  postInstall = ''
+    cp -r $out/$out/* $out
+    rm -rf $out/$(echo "$out" | cut -d "/" -f2)
+  '' + lib.optionalString stdenv.isDarwin ''
+    install_name_tool -change libclucene-shared.1.dylib \
+        ${clucene_core_2}/lib/libclucene-shared.1.dylib \
+        $out/lib/dovecot/lib21_fts_lucene_plugin.so
+    install_name_tool -change libclucene-core.1.dylib \
+        ${clucene_core_2}/lib/libclucene-core.1.dylib \
+        $out/lib/dovecot/lib21_fts_lucene_plugin.so
+  '';
+
+  patches = [
+    # Make dovecot look for plugins in /etc/dovecot/modules
+    # so we can symlink plugins from several packages there.
+    # The symlinking needs to be done in NixOS.
+    ./2.2.x-module_dir.patch
+  ];
+
   configureFlags = [
+    # It will hardcode this for /var/lib/dovecot.
+    # http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=626211
     "--localstatedir=/var"
+    # We need this so utilities default to reading /etc/dovecot/dovecot.conf file.
+    "--sysconfdir=/etc"
     "--with-ldap"
-  ];
+    "--with-ssl=openssl"
+    "--with-zlib"
+    "--with-bzlib"
+    "--with-ldap"
+    "--with-lucene"
+    "--with-icu"
+  ] ++ lib.optional (stdenv.isLinux) "--with-systemdsystemunitdir=$(out)/etc/systemd/system"
+    ++ lib.optional withMySQL "--with-mysql"
+    ++ lib.optional withPgSQL "--with-pgsql"
+    ++ lib.optional withSQLite "--with-sqlite";
 
   meta = {
     homepage = "http://dovecot.org/";
     description = "Open source IMAP and POP3 email server written with security primarily in mind";
-    maintainers = with stdenv.lib.maintainers; [viric simons];
+    maintainers = with stdenv.lib.maintainers; [viric simons rickynils];
     hydraPlatforms = stdenv.lib.platforms.linux;
   };
-
 }
diff --git a/pkgs/servers/mail/rspamd/default.nix b/pkgs/servers/mail/rspamd/default.nix
index bd4f3db3ab5d..f3156afd97ac 100644
--- a/pkgs/servers/mail/rspamd/default.nix
+++ b/pkgs/servers/mail/rspamd/default.nix
@@ -6,13 +6,13 @@ in
 
 stdenv.mkDerivation rec {
   name = "rspamd-${version}";
-  version = "1.1.3";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "vstakhov";
     repo = "rspamd";
     rev = version;
-    sha256 = "0mvh812a91yqynmcpv159dmkipx72fwg7rgscq7virzphchkbzvj";
+    sha256 = "00d9c9b8w6j0ls1w08bfghn4635as779b45vhhlv1f5wfzhxz6a1";
   };
 
   nativeBuildInputs = [ cmake pkgconfig perl ];
diff --git a/pkgs/servers/monitoring/munin/default.nix b/pkgs/servers/monitoring/munin/default.nix
index 51eda757e3c2..71f76695bb2e 100644
--- a/pkgs/servers/monitoring/munin/default.nix
+++ b/pkgs/servers/monitoring/munin/default.nix
@@ -55,7 +55,7 @@ stdenv.mkDerivation rec {
   doCheck = false;
 
   checkPhase = ''
-   export PERL5LIB="$PERL5LIB:${rrdtool}/lib/perl"
+   export PERL5LIB="$PERL5LIB:${rrdtool}/lib/perl5/site_perl"
    LC_ALL=C make -j1 test 
   '';
 
@@ -109,10 +109,10 @@ stdenv.mkDerivation rec {
             *.jar) continue;;
         esac
         wrapProgram "$file" \
-          --set PERL5LIB "$out/lib/perl5/site_perl:${rrdtool}/lib/perl:${with perlPackages; stdenv.lib.makePerlPath [
+          --set PERL5LIB "$out/lib/perl5/site_perl:${with perlPackages; stdenv.lib.makePerlPath [
                 Log4Perl IOSocketInet6 Socket6 URI DBFile DateManip
                 HTMLTemplate FileCopyRecursive FCGI NetCIDR NetSNMP NetServer
-                ListMoreUtils TimeHiRes DBDPg LWPUserAgent
+                ListMoreUtils TimeHiRes DBDPg LWPUserAgent rrdtool
                 ]}"
     done
   '';
diff --git a/pkgs/servers/nosql/arangodb/default.nix b/pkgs/servers/nosql/arangodb/default.nix
index 4ff12f630c9b..7ccd29bc783a 100644
--- a/pkgs/servers/nosql/arangodb/default.nix
+++ b/pkgs/servers/nosql/arangodb/default.nix
@@ -15,6 +15,8 @@ stdenv.mkDerivation rec {
     openssl zlib python gyp go readline
   ];
 
+  NIX_CFLAGS_COMPILE = "-Wno-error=strict-overflow";
+
   configureFlagsArray = [ "--with-openssl-lib=${openssl}/lib" ];
 
   patchPhase = ''
diff --git a/pkgs/servers/nosql/mongodb/default.nix b/pkgs/servers/nosql/mongodb/default.nix
index 913b312a54a3..1ef79f2ebcdc 100644
--- a/pkgs/servers/nosql/mongodb/default.nix
+++ b/pkgs/servers/nosql/mongodb/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, scons, boost, gperftools, pcre, snappy
+{ stdenv, fetchurl, fetchpatch, scons, boost, gperftools, pcre, snappy
 , zlib, libyamlcpp, sasl, openssl, libpcap, wiredtiger
 }:
 
@@ -54,7 +54,14 @@ in stdenv.mkDerivation rec {
   # vendored header file - regardless of whether or not we're using the system
   # tcmalloc - so we need to lift the include path manipulation out of the
   # conditional.
-  patches = [ ./valgrind-include.patch ];
+  patches =
+    [ ./valgrind-include.patch
+      (fetchpatch {
+        url = https://projects.archlinux.org/svntogit/community.git/plain/trunk/boost160.patch?h=packages/mongodb;
+        name = "boost160.patch";
+        sha256 = "0bvsf3499zj55pzamwjmsssr6x63w434944w76273fr5rxwzcmh8";
+      })
+    ];
 
   postPatch = ''
     # fix environment variable reading
diff --git a/pkgs/servers/nosql/riak/1.3.1.nix b/pkgs/servers/nosql/riak/1.3.1.nix
deleted file mode 100644
index 565ed226ab4f..000000000000
--- a/pkgs/servers/nosql/riak/1.3.1.nix
+++ /dev/null
@@ -1,67 +0,0 @@
-{ stdenv, fetchurl, fetchFromGitHub, unzip, erlangR15}:
-
-let
-  srcs = {
-    riak = fetchurl {
-      url = "http://s3.amazonaws.com/downloads.basho.com/riak/1.3/1.3.1/riak-1.3.1.tar.gz";
-      sha256 = "a69093fc5df1b79f58645048b9571c755e00c3ca14dfd27f9f1cae2c6e628f01";
-    };
-    leveldb = fetchFromGitHub {
-      owner  = "basho";
-      repo   = "leveldb";
-      rev    = "1.3.1";
-      sha256 = "1jvv260ic38657y4lwwcvzmhah8xai594xy19r28gkzlpra1lnbb";
-    };
-  };
-in
-stdenv.mkDerivation rec {
-  name = "riak-1.3.1";
-
-  buildInputs = [unzip erlangR15];
-
-  src = srcs.riak;
-
-  patches = [ ./riak-1.3.1.patch ./riak-admin-1.3.1.patch ];
-
-  hardeningDisable = [ "format" ];
-
-  postUnpack = ''
-    mkdir -p $sourceRoot/deps/eleveldb/c_src/leveldb
-    cp -r ${srcs.leveldb}/* $sourceRoot/deps/eleveldb/c_src/leveldb
-    chmod 755 -R $sourceRoot/deps/eleveldb/c_src/leveldb
-    pushd $sourceRoot/deps/
-    mkdir riaknostic/deps
-    cp -R lager riaknostic/deps
-    cp -R getopt riaknostic/deps
-    cp -R meck riaknostic/deps
-    popd
-    patchShebangs .
-  '';
-
-  buildPhase = ''
-    make rel
-  '';
-
-  doCheck = false;
-
-  installPhase = ''
-    mkdir $out
-    mv rel/riak/etc rel/riak/riak-etc
-    mkdir -p rel/riak/etc
-    mv rel/riak/riak-etc rel/riak/etc/riak
-    mv rel/riak/* $out
-  '';
-
-  meta = {
-    maintainers = [ stdenv.lib.maintainers.orbitz ];
-    description = "Dynamo inspired NoSQL DB by Basho";
-    longDescription = ''
-      This patches the riak and riak-admin scripts to work better in Nix.
-      Rather than the scripts using their own location to determine where
-      the data, log, and etc directories should live, the scripts expect
-      RIAK_DATA_DIR, RIAK_LOG_DIR, and RIAK_ETC_DIR to be defined
-      and use those.
-    '';
-    platforms   = stdenv.lib.platforms.all;
-  };
-}
diff --git a/pkgs/servers/openafs-client/default.nix b/pkgs/servers/openafs-client/default.nix
index aab4ee9059f9..3375ec2240bb 100644
--- a/pkgs/servers/openafs-client/default.nix
+++ b/pkgs/servers/openafs-client/default.nix
@@ -1,27 +1,18 @@
 { stdenv, fetchurl, fetchgit, which, autoconf, automake, flex, yacc,
   kernel, glibc, ncurses, perl, kerberos }:
 
-let
-  version = if stdenv.lib.versionAtLeast kernel.version "4.2"
-    then "1.6.14-1-602130"
-    else "1.6.14";
-in
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   name = "openafs-${version}-${kernel.version}";
+  version = "1.6.17";
 
-  src = if version == "1.6.14-1-602130"
-    # 1.6.14 + patches to run on linux 4.2 that will get into 1.6.15
-    then fetchgit {
-      url = "git://git.openafs.org/openafs.git";
-      rev = "feab09080ec050b3026eff966352b058e2c2295b";
-      sha256 = "03j71c7y487jbjmm6ydr1hw38pf43j2dz153xknndf4x4v21nnp2";
-    }
-    else fetchurl {
-      url = "http://www.openafs.org/dl/openafs/${version}/openafs-${version}-src.tar.bz2";
-      sha256 = "3e62c798a7f982c4f88d85d32e46bee6a47848d207b1e318fe661ce44ae4e01f";
-    };
+  src = fetchurl {
+    url = "http://www.openafs.org/dl/openafs/${version}/openafs-${version}-src.tar.bz2";
+    sha256 = "16532f4951piv1g2i539233868xfs1damrnxql61gjgxpwnklhcn";
+  };
+
+  nativeBuildInputs = [ autoconf automake flex yacc perl which ];
 
-  buildInputs = [ autoconf automake flex yacc ncurses perl which ];
+  buildInputs = [ ncurses ];
 
   hardeningDisable = [ "pic" ];
 
@@ -49,11 +40,15 @@ stdenv.mkDerivation {
     )
   '';
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "Open AFS client";
-    homepage = http://www.openafs.org;
-    license = stdenv.lib.licenses.ipl10;
-    platforms = stdenv.lib.platforms.linux;
-    maintainers = [ stdenv.lib.maintainers.z77z ];
+    homepage = https://www.openafs.org;
+    license = licenses.ipl10;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.z77z ];
+    broken =
+      (builtins.compareVersions kernel.version  "3.18" == -1) ||
+      (builtins.compareVersions kernel.version "4.4" != -1) ||
+      (kernel.features.grsecurity or false);
   };
 }
diff --git a/pkgs/servers/osrm-backend/4.5.0-gcc-binutils.patch b/pkgs/servers/osrm-backend/4.5.0-gcc-binutils.patch
new file mode 100644
index 000000000000..87b9b9501c4c
--- /dev/null
+++ b/pkgs/servers/osrm-backend/4.5.0-gcc-binutils.patch
@@ -0,0 +1,15 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -127,8 +127,9 @@ if(CMAKE_BUILD_TYPE MATCHES Release)
+     if ("${CMAKE_CXX_COMPILER_ID}" STREQUAL "GNU" AND
+         NOT "${CMAKE_CXX_COMPILER_VERSION}" VERSION_LESS "4.9.0" AND NOT MINGW)
+       message(STATUS "Using gcc specific binutils for LTO.")
+-      set(CMAKE_AR     "/usr/bin/gcc-ar")
+-      set(CMAKE_RANLIB "/usr/bin/gcc-ranlib")
++      # Just let PATH do its job
++      set(CMAKE_AR     "gcc-ar")
++      set(CMAKE_RANLIB "gcc-ranlib")
+     endif()
+   endif (HAS_LTO_FLAG)
+ endif()
diff --git a/pkgs/servers/osrm-backend/default.nix b/pkgs/servers/osrm-backend/default.nix
index 3e9e2158524c..9c1dd23b39f0 100644
--- a/pkgs/servers/osrm-backend/default.nix
+++ b/pkgs/servers/osrm-backend/default.nix
@@ -1,15 +1,18 @@
-{stdenv, fetchurl, cmake, luabind, libosmpbf, stxxl, tbb, boost, expat, protobuf, bzip2, zlib, substituteAll}:
+{stdenv, fetchFromGitHub, cmake, luabind, libosmpbf, stxxl, tbb, boost, expat, protobuf, bzip2, zlib, substituteAll}:
 
 stdenv.mkDerivation rec {
   name = "osrm-backend-4.5.0";
 
-  src = fetchurl {
-    url = "https://github.com/Project-OSRM/osrm-backend/archive/v4.5.0.tar.gz";
-    sha256 = "af61e883051f2ecb73520ace6f17cc6da30edc413208ff7cf3d87992eca0756c";
+  src = fetchFromGitHub {
+    rev = "v4.5.0";
+    owner  = "Project-OSRM";
+    repo   = "osrm-backend";
+    sha256 = "19a8d1llvsrysyk1q48dpmh75qcbibfjlszndrysk11yh62hdvsz";
   };
 
   patches = [
     ./4.5.0-openmp.patch
+    ./4.5.0-gcc-binutils.patch
     (substituteAll {
       src = ./4.5.0-default-profile-path.template.patch;
     })
diff --git a/pkgs/servers/plex/default.nix b/pkgs/servers/plex/default.nix
index 672e441875ab..11f1bc4a988c 100644
--- a/pkgs/servers/plex/default.nix
+++ b/pkgs/servers/plex/default.nix
@@ -5,9 +5,9 @@
 
 let
   plexpkg = if enablePlexPass then {
-    version = "0.9.16.0.1754";
-    vsnHash = "23623fb";
-    sha256 = "0yn5bqpgz28ig6y3qw3zxzm8gfvwaw7nh5krmav8h1ryws98cc6g";
+    version = "0.9.16.3.1840";
+    vsnHash = "cece46d";
+    sha256 = "0p1rnia18a67h05f7l7smkpry1ldkpdkyvs9fgrqpay3w0jfk9gd";
   } else {
     version = "0.9.15.6.1714";
     vsnHash = "7be11e1";
diff --git a/pkgs/servers/quagga/default.nix b/pkgs/servers/quagga/default.nix
index cdc2905d62db..b73086ca7c75 100644
--- a/pkgs/servers/quagga/default.nix
+++ b/pkgs/servers/quagga/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "quagga-${version}";
-  version = "0.99.24.1";
+  version = "1.0.20160315";
 
   src = fetchurl {
     url = "mirror://savannah/quagga/${name}.tar.gz";
-    sha256 = "0kvmc810m7ssrvgb3213271rpywyxb646v5bzjl1jl88vx3imbl4";
+    sha256 = "0qrjhp6l1hw35jrvcwyl0df4zjx1kqhrsafx307i6pzgs2xbgzr1";
   };
 
   buildInputs =
@@ -64,7 +64,7 @@ stdenv.mkDerivation rec {
       It is more than a routed replacement, it can be used as a Route Server and
       a Route Reflector.
     '';
-    homepage = http://www.quagga.net/;
+    homepage = http://www.nongnu.org/quagga/;
     license = licenses.gpl2;
     platforms = platforms.unix;
     maintainers = with maintainers; [ tavyc ];
diff --git a/pkgs/servers/rt/default.nix b/pkgs/servers/rt/default.nix
index 253f90e68efa..77b7c6d4f269 100644
--- a/pkgs/servers/rt/default.nix
+++ b/pkgs/servers/rt/default.nix
@@ -3,12 +3,12 @@
 stdenv.mkDerivation rec {
   name = "rt-${version}";
 
-  version = "4.2.12";
+  version = "4.4.0";
 
   src = fetchurl {
     url = "https://download.bestpractical.com/pub/rt/release/${name}.tar.gz";
 
-    sha256 = "0r3jhgfwwhhk654zag42mrai85yrliw9sc0kgabwjvbh173204p2";
+    sha256 = "1hgz50fxv9zdcngww083aqh8vzyk148lm7mcivxflpnsqfw3696x";
   };
 
   patches = [ ./override-generated.patch ];
diff --git a/pkgs/servers/sql/mariadb/default.nix b/pkgs/servers/sql/mariadb/default.nix
index eb132a0be22f..9ca1a23ea345 100644
--- a/pkgs/servers/sql/mariadb/default.nix
+++ b/pkgs/servers/sql/mariadb/default.nix
@@ -64,7 +64,7 @@ stdenv.mkDerivation rec {
   ];
 
   # fails to find lex_token.h sometimes
-  enableParallelBuilding = true;
+  enableParallelBuilding = false;
 
   outputs = [ "out" "lib" ];
 
diff --git a/pkgs/servers/sql/mysql/5.5.x.nix b/pkgs/servers/sql/mysql/5.5.x.nix
index 8c288e54cd48..163deda7ae08 100644
--- a/pkgs/servers/sql/mysql/5.5.x.nix
+++ b/pkgs/servers/sql/mysql/5.5.x.nix
@@ -1,4 +1,5 @@
-{ stdenv, fetchurl, cmake, bison, ncurses, openssl, readline, zlib, perl }:
+{ stdenv, fetchurl, cmake, bison, ncurses, openssl, readline, zlib, perl
+, cctools, CoreServices }:
 
 # Note: zlib is not required; MySQL can use an internal zlib.
 
@@ -22,7 +23,7 @@ stdenv.mkDerivation rec {
   '';
 
   buildInputs = [ cmake bison ncurses openssl readline zlib ]
-     ++ stdenv.lib.optional stdenv.isDarwin perl;
+     ++ stdenv.lib.optionals stdenv.isDarwin [ perl cctools CoreServices ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/servers/squid/default.nix b/pkgs/servers/squid/default.nix
new file mode 100644
index 000000000000..2831423d1237
--- /dev/null
+++ b/pkgs/servers/squid/default.nix
@@ -0,0 +1,24 @@
+{ fetchurl, stdenv, perl, lib, openldap, pam, db, cyrus_sasl, libcap,
+expat, libxml2, libtool, openssl}:
+stdenv.mkDerivation rec {
+  name = "squid-3.5.15";
+  src = fetchurl {
+    url = "http://www.squid-cache.org/Versions/v3/3.5/${name}.tar.bz2";
+    sha256 = "1cgy6ffyarqd35plqmqi3mrsp0941c6n55pr3zavp07ksj46wgzm";
+  };
+  buildInputs = [perl openldap pam db cyrus_sasl libcap expat libxml2
+    libtool openssl];
+  configureFlags = [
+    "--enable-ipv6"
+    "--disable-strict-error-checking"
+    "--disable-arch-native"
+    "--with-openssl"
+    "--enable-ssl-crtd"
+  ];
+
+  meta = {
+    description = "a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more";
+    homepage = "http://www.squid-cache.org";
+    license = stdenv.lib.licenses.gpl2;
+  };
+}
diff --git a/pkgs/servers/squid/squids.nix b/pkgs/servers/squid/squids.nix
deleted file mode 100644
index 35aea7aa1308..000000000000
--- a/pkgs/servers/squid/squids.nix
+++ /dev/null
@@ -1,67 +0,0 @@
-args @ { fetchurl, stdenv, perl, lib, composableDerivation
-, openldap, pam, db, cyrus_sasl, kerberos, libcap, expat, libxml2, libtool
-, openssl, ... }: with args;
-let edf = composableDerivation.edf; in
-rec {
-  squid30 = composableDerivation.composableDerivation {} {
-    name = "squid-3.0-stable26";
-
-    buildInputs = [perl];
-
-    src = args.fetchurl {
-      url = http://www.squid-cache.org/Versions/v3/3.0/squid-3.0.STABLE26.tar.bz2;
-      sha256 = "3e54ae3ad09870203862f0856c7d0cca16a85f62d5012085009003ee3d5467b4";
-    };
-
-    configureFlags = ["--enable-ipv6" "--disable-strict-error-checking" "--disable-arch-native"];
-
-    meta = {
-      description = "http-proxy";
-      homepage = "http://www.squid-cache.org";
-      license = stdenv.lib.licenses.gpl2;
-    };
-
-  };
-
-  squid31 = squid30.merge {
-    name = "squid-3.1.23";
-    src = args.fetchurl {
-      url = http://www.squid-cache.org/Versions/v3/3.1/squid-3.1.23.tar.bz2;
-      sha256 = "13g4y0gg48xnlzrvpymb08gh25xi50y383faapkxws7i7v94305s";
-    };
-  };
-
-  squid32 = squid30.merge rec {
-    name = "squid-3.2.13";
-    src = args.fetchurl {
-      url = "http://www.squid-cache.org/Versions/v3/3.2/${name}.tar.bz2";
-      sha256 = "0dafqv00dr3nyrm9k47d6r7gv2r3f9hjd1ykl3kkvjca11r4n54j";
-    };
-    buildInputs = [openldap pam db cyrus_sasl libcap expat libxml2
-      libtool openssl];
-  };
-
-  squid34 = squid30.merge rec {
-    name = "squid-3.4.11";
-    src = args.fetchurl {
-      url = "http://www.squid-cache.org/Versions/v3/3.4/${name}.tar.bz2";
-      sha256 = "0p9dbsz541cpcc88albwpgq15jgpczv12j9b9g5xw6d3i977qm1h";
-    };
-    buildInputs = [openldap pam db cyrus_sasl libcap expat libxml2
-      libtool openssl];
-    configureFlags = ["--enable-ssl" "--enable-ssl-crtd"];
-  };
-
-  squid35 = squid30.merge rec {
-    name = "squid-3.5.1";
-    src = args.fetchurl {
-      url = "http://www.squid-cache.org/Versions/v3/3.5/${name}.tar.bz2";
-      sha256 = "0rfv1v5vkk7l08v4j16l0lz2grrzd8qf2n25i73qd7c8rgwd6a3x";
-    };
-    buildInputs = [openldap pam db cyrus_sasl libcap expat libxml2
-      libtool openssl];
-    configureFlags = ["--with-openssl" "--enable-ssl-crtd"];
-  };
-
-  latest = squid35;
-}
diff --git a/pkgs/servers/unifi/default.nix b/pkgs/servers/unifi/default.nix
index 5e647f90de19..e683c7f5f0c3 100644
--- a/pkgs/servers/unifi/default.nix
+++ b/pkgs/servers/unifi/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "unifi-controller-${version}";
-  version = "4.7.6";
+  version = "4.8.14";
 
   src = fetchurl {
-    url = "https://www.ubnt.com/downloads/unifi/${version}/UniFi.unix.zip";
-    sha256 = "0xinrxcbd5gb2jgcvrx3jcslad0f19qrbjzkiir9zjq59sn68gfn";
+    url = "https://dl.ubnt.com/unifi/${version}/UniFi.unix.zip";
+    sha256 = "2498d898399c4ce636ea62e5e4bb1afdd6146e45d721084fe28a44bfd3dffb11";
   };
 
   buildInputs = [ unzip ];