summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--doc/stdenv.xml9
-rw-r--r--nixos/doc/manual/release-notes/rl-1703.xml9
-rw-r--r--nixos/modules/services/networking/ircd-hybrid/builder.sh4
-rw-r--r--pkgs/applications/audio/audacious/default.nix6
-rw-r--r--pkgs/applications/audio/opusfile/default.nix5
-rw-r--r--pkgs/applications/graphics/ImageMagick/default.nix4
-rw-r--r--pkgs/applications/graphics/PythonMagick/default.nix6
-rw-r--r--pkgs/applications/graphics/gimp/plugins/default.nix1
-rw-r--r--pkgs/applications/graphics/graphicsmagick/default.nix22
-rw-r--r--pkgs/applications/networking/mumble/default.nix4
-rw-r--r--pkgs/applications/version-management/git-and-tools/git/ssl-cert-file.patch7
-rw-r--r--pkgs/applications/version-management/smartgithg/default.nix11
-rw-r--r--pkgs/build-support/docker/default.nix452
-rw-r--r--pkgs/build-support/docker/examples.nix108
-rw-r--r--pkgs/build-support/vm/default.nix26
-rw-r--r--pkgs/data/fonts/droid/default.nix2
-rw-r--r--pkgs/data/fonts/roboto-mono/default.nix2
-rw-r--r--pkgs/data/fonts/roboto-slab/default.nix2
-rw-r--r--pkgs/data/icons/arc-icon-theme/default.nix6
-rw-r--r--pkgs/data/icons/faba-mono-icons/default.nix2
-rw-r--r--pkgs/data/icons/moka-icon-theme/default.nix8
-rw-r--r--pkgs/data/sgml+xml/schemas/xml-dtd/docbook-ebnf/builder.sh3
-rw-r--r--pkgs/desktops/enlightenment/enlightenment.nix20
-rw-r--r--pkgs/development/compilers/llvm/3.7/llvm.nix12
-rw-r--r--pkgs/development/compilers/pakcs/case-insensitive.patch19
-rw-r--r--pkgs/development/compilers/pakcs/default.nix7
-rw-r--r--pkgs/development/compilers/swi-prolog/default.nix19
-rw-r--r--pkgs/development/interpreters/mujs/default.nix6
-rw-r--r--pkgs/development/libraries/clutter-gst/default.nix4
-rw-r--r--pkgs/development/libraries/clutter-gtk/default.nix4
-rw-r--r--pkgs/development/libraries/fontconfig/default.nix10
-rw-r--r--pkgs/development/libraries/gdk-pixbuf/default.nix4
-rw-r--r--pkgs/development/libraries/glib/default.nix4
-rw-r--r--pkgs/development/libraries/gtkmm/2.x.nix6
-rw-r--r--pkgs/development/libraries/gtkmm/gtkmm-2.24.4-missing-operator.patch11
-rw-r--r--pkgs/development/libraries/gvfs/default.nix16
-rw-r--r--pkgs/development/libraries/libcue/default.nix19
-rw-r--r--pkgs/development/libraries/libdrm/default.nix4
-rw-r--r--pkgs/development/libraries/libmikmod/default.nix4
-rw-r--r--pkgs/development/libraries/libmpcdec/default.nix7
-rw-r--r--pkgs/development/libraries/libsamplerate/default.nix8
-rw-r--r--pkgs/development/libraries/libsodium/default.nix4
-rw-r--r--pkgs/development/libraries/libsoup/default.nix6
-rw-r--r--pkgs/development/libraries/libuecc/default.nix24
-rw-r--r--pkgs/development/libraries/openssl/default.nix1
-rw-r--r--pkgs/development/libraries/openssl/nix-ssl-cert-file.patch15
-rw-r--r--pkgs/development/libraries/pangomm/default.nix4
-rw-r--r--pkgs/development/libraries/unixODBC/default.nix2
-rw-r--r--pkgs/development/libraries/vaapi-intel/default.nix4
-rw-r--r--pkgs/development/libraries/zeroc-ice/default.nix4
-rw-r--r--pkgs/development/r-modules/README.md24
-rw-r--r--pkgs/development/ruby-modules/bundler-env/default.nix72
-rw-r--r--pkgs/development/tools/misc/gdb/default.nix3
-rw-r--r--pkgs/development/tools/misc/intel-gpu-tools/default.nix4
-rw-r--r--pkgs/development/tools/misc/intltool/default.nix2
-rw-r--r--pkgs/development/tools/misc/travis/default.nix25
-rw-r--r--pkgs/development/tools/xcbuild/default.nix43
-rw-r--r--pkgs/development/web/nodejs/nodejs.nix5
-rw-r--r--pkgs/development/web/nodejs/v4.nix4
-rw-r--r--pkgs/development/web/nodejs/v6.nix12
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix37
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_c_symbols285
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_kernel_symbols106
-rw-r--r--pkgs/os-specific/linux/nvidia-x11/365.35-kernel-4.7.patch40
-rw-r--r--pkgs/os-specific/linux/nvidia-x11/default.nix16
-rw-r--r--pkgs/os-specific/linux/powertop/default.nix12
-rw-r--r--pkgs/servers/monitoring/riemann-dash/default.nix22
-rw-r--r--pkgs/servers/x11/xorg/default.nix48
-rw-r--r--pkgs/servers/x11/xorg/tarballs-7.7.list16
-rw-r--r--pkgs/stdenv/darwin/default.nix12
-rw-r--r--pkgs/stdenv/darwin/make-bootstrap-tools.nix47
-rw-r--r--pkgs/stdenv/darwin/unpack-bootstrap-tools.sh39
-rw-r--r--pkgs/stdenv/generic/setup.sh12
-rw-r--r--pkgs/tools/bluetooth/blueman/default.nix5
-rw-r--r--pkgs/tools/misc/fluentd/default.nix8
-rw-r--r--pkgs/tools/misc/lolcat/default.nix8
-rw-r--r--pkgs/tools/misc/man-db/default.nix17
-rw-r--r--pkgs/tools/networking/curl/default.nix2
-rw-r--r--pkgs/tools/networking/curl/nix-ssl-cert-file.patch14
-rw-r--r--pkgs/tools/networking/fastd/default.nix26
-rw-r--r--pkgs/tools/networking/sshpass/default.nix8
-rw-r--r--pkgs/tools/package-management/fpm/default.nix8
-rw-r--r--pkgs/tools/system/foreman/default.nix25
-rw-r--r--pkgs/tools/system/hiera-eyaml/default.nix23
-rw-r--r--pkgs/tools/text/shfmt/default.nix6
-rw-r--r--pkgs/tools/typesetting/asciidoctor/default.nix14
-rw-r--r--pkgs/tools/typesetting/tex/nix/animatedot.sh2
-rw-r--r--pkgs/tools/typesetting/tex/nix/default.nix2
-rw-r--r--pkgs/tools/typesetting/tex/nix/dot2pdf.sh2
-rw-r--r--pkgs/tools/typesetting/tex/nix/dot2ps.sh2
-rw-r--r--pkgs/tools/typesetting/tex/nix/lhs2tex.sh2
-rw-r--r--pkgs/tools/typesetting/tex/nix/run-latex.sh4
-rw-r--r--pkgs/top-level/all-packages.nix35
-rw-r--r--pkgs/top-level/php-packages.nix17
-rw-r--r--pkgs/top-level/release.nix79
95 files changed, 1235 insertions, 907 deletions
diff --git a/doc/stdenv.xml b/doc/stdenv.xml
index 2e88d6b41548..68441ea9393a 100644
--- a/doc/stdenv.xml
+++ b/doc/stdenv.xml
@@ -1231,13 +1231,12 @@ echo @foo@
     <term><function>stripHash</function>
     <replaceable>path</replaceable></term>
     <listitem><para>Strips the directory and hash part of a store
-    path, storing the name part in the environment variable
-    <literal>strippedName</literal>. For example:
+    path, outputting the name part to <literal>stdout</literal>.
+    For example:
     
 <programlisting>
-stripHash "/nix/store/9s9r019176g7cvn2nvcw41gsp862y6b4-coreutils-8.24"
 # prints coreutils-8.24
-echo $strippedName
+stripHash "/nix/store/9s9r019176g7cvn2nvcw41gsp862y6b4-coreutils-8.24"
 </programlisting>
 
     If you wish to store the result in another variable, then the
@@ -1245,7 +1244,7 @@ echo $strippedName
     
 <programlisting>
 name="/nix/store/9s9r019176g7cvn2nvcw41gsp862y6b4-coreutils-8.24"
-someVar=$(stripHash $name; echo $strippedName)
+someVar=$(stripHash $name)
 </programlisting>
 
     </para></listitem>
diff --git a/nixos/doc/manual/release-notes/rl-1703.xml b/nixos/doc/manual/release-notes/rl-1703.xml
index c1107977db79..21cea77f8768 100644
--- a/nixos/doc/manual/release-notes/rl-1703.xml
+++ b/nixos/doc/manual/release-notes/rl-1703.xml
@@ -52,6 +52,15 @@ following incompatible changes:</para>
       but will need to start that process from gdb (so it is a child).
     </para>
   </listitem>
+
+  <listitem>
+    <para>
+      The <literal>stripHash</literal> bash function in <literal>stdenv</literal>
+      changed according to its documentation; it now outputs the stripped name to
+      <literal>stdout</literal> instead of putting it in the variable
+      <literal>strippedName</literal>.
+    </para>
+  </listitem>
 </itemizedlist>
 
 
diff --git a/nixos/modules/services/networking/ircd-hybrid/builder.sh b/nixos/modules/services/networking/ircd-hybrid/builder.sh
index f2c92878a4dc..38312210df25 100644
--- a/nixos/modules/services/networking/ircd-hybrid/builder.sh
+++ b/nixos/modules/services/networking/ircd-hybrid/builder.sh
@@ -12,7 +12,7 @@ for i in $scripts; do
     if test "$(echo $i | cut -c1-2)" = "=>"; then
         subDir=$(echo $i | cut -c3-)
     else
-        dst=$out/$subDir/$((stripHash $i; echo $strippedName) | sed 's/\.in//')
+        dst=$out/$subDir/$(stripHash $i | sed 's/\.in//')
         doSub $i $dst
         chmod +x $dst # !!!
     fi
@@ -23,7 +23,7 @@ for i in $substFiles; do
     if test "$(echo $i | cut -c1-2)" = "=>"; then
         subDir=$(echo $i | cut -c3-)
     else
-        dst=$out/$subDir/$((stripHash $i; echo $strippedName) | sed 's/\.in//')
+        dst=$out/$subDir/$(stripHash $i | sed 's/\.in//')
         doSub $i $dst
     fi
 done
diff --git a/pkgs/applications/audio/audacious/default.nix b/pkgs/applications/audio/audacious/default.nix
index e6322dd1d0aa..e9d7b5da79a6 100644
--- a/pkgs/applications/audio/audacious/default.nix
+++ b/pkgs/applications/audio/audacious/default.nix
@@ -8,16 +8,16 @@
 
 stdenv.mkDerivation rec {
   name = "audacious-${version}";
-  version = "3.7.2";
+  version = "3.8";
 
   src = fetchurl {
     url = "http://distfiles.audacious-media-player.org/audacious-${version}-gtk3.tar.bz2";
-    sha256 = "1pvyxi8niy70nv13kc16g2vaywwahmg2650fa7v4rlbmykifk75z";
+    sha256 = "0rpdzf9pb52lcswxypwh4nq3qkjzliw42v39nm5rlwwxdq6bm99q";
   };
 
   pluginsSrc = fetchurl {
     url = "http://distfiles.audacious-media-player.org/audacious-plugins-${version}-gtk3.tar.bz2";
-    sha256 = "0gxka0lp9a35k2xgq8bx69wyv83dvrqnpwcsqliy3h3yz6v1fv2v";
+    sha256 = "0j9svdqdjvj5spx1vfp0m63xh8xwk8naqsikdxfxbb68xk33rxb9";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/audio/opusfile/default.nix b/pkgs/applications/audio/opusfile/default.nix
index 4937d09e532e..f840ba278cfc 100644
--- a/pkgs/applications/audio/opusfile/default.nix
+++ b/pkgs/applications/audio/opusfile/default.nix
@@ -1,16 +1,17 @@
 { stdenv, fetchurl, pkgconfig, openssl, libogg, libopus }:
 
 stdenv.mkDerivation rec {
-  name = "opusfile-0.6";
+  name = "opusfile-0.8";
   src = fetchurl {
     url = "http://downloads.xiph.org/releases/opus/${name}.tar.gz";
-    sha256 = "19iys2kld75k0210b807i4illrdmj3cmmnrgxlc9y4vf6mxp2a14";
+    sha256 = "192mp2jgn5s9815h31ybzsfipmbppmdhwx1dymrk26xarz9iw8rc";
   };
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ openssl libogg ];
   propagatedBuildInputs = [ libopus ];
   patches = [ ./include-multistream.patch ];
+  configureFlags = [ "--disable-examples" ];
 
   meta = {
     description = "High-level API for decoding and seeking in .opus files";
diff --git a/pkgs/applications/graphics/ImageMagick/default.nix b/pkgs/applications/graphics/ImageMagick/default.nix
index d481bb934d4c..c7d1adfdd182 100644
--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@@ -11,8 +11,8 @@ let
     else throw "ImageMagick is not supported on this platform.";
 
   cfg = {
-    version = "6.9.5-10";
-    sha256 = "0cxjzqzca80vf6sfx4z9zq4wq2w0vy9ajp9kf88jb4na8mwsn198";
+    version = "6.9.6-2";
+    sha256 = "139h9lycxw3lszn052m34xm0rqyanin4nb529vxjcrkkzqilh91r";
     patches = [];
   }
     # Freeze version on mingw so we don't need to port the patch too often.
diff --git a/pkgs/applications/graphics/PythonMagick/default.nix b/pkgs/applications/graphics/PythonMagick/default.nix
index 5ab7d4d8a694..a8d0d490f8bb 100644
--- a/pkgs/applications/graphics/PythonMagick/default.nix
+++ b/pkgs/applications/graphics/PythonMagick/default.nix
@@ -2,7 +2,7 @@
 
 let
 
-  version = "0.9.12";
+  version = "0.9.14";
 
 in
 
@@ -10,8 +10,8 @@ stdenv.mkDerivation rec {
   name = "pythonmagick-${version}";
 
   src = fetchurl {
-    url = "http://www.imagemagick.org/download/python/releases/PythonMagick-${version}.tar.xz";
-    sha256 = "1l1kr3d7l40fkxgs6mrlxj65alv2jizm9hhgg9i9g90a8qj8642b";
+    url = "mirror://imagemagick/python/releases/PythonMagick-${version}.tar.xz";
+    sha256 = "1flkdfi3c19wy2qcfzax1cqvmmri10rvmhc2y85gmagqvv01zz22";
   };
 
   buildInputs = [python boost pkgconfig imagemagick];
diff --git a/pkgs/applications/graphics/gimp/plugins/default.nix b/pkgs/applications/graphics/gimp/plugins/default.nix
index 1d32ea724faf..9fd669551dec 100644
--- a/pkgs/applications/graphics/gimp/plugins/default.nix
+++ b/pkgs/applications/graphics/gimp/plugins/default.nix
@@ -57,6 +57,7 @@ rec {
       sed -e 's,^\(GIMP_PLUGIN_DIR=\).*,\1'"$out/${gimp.name}-plugins", \
        -e 's,^\(GIMP_DATA_DIR=\).*,\1'"$out/share/${gimp.name}", -i configure
     '';
+    hardeningDisable = [ "format" ];
     meta = with stdenv.lib; {
       description = "The GIMP Animation Package";
       homepage = http://www.gimp.org;
diff --git a/pkgs/applications/graphics/graphicsmagick/default.nix b/pkgs/applications/graphics/graphicsmagick/default.nix
index 70d8feaa2753..2e573e09b31a 100644
--- a/pkgs/applications/graphics/graphicsmagick/default.nix
+++ b/pkgs/applications/graphics/graphicsmagick/default.nix
@@ -1,6 +1,6 @@
-{stdenv, fetchurl, bzip2, freetype, graphviz, ghostscript
-, libjpeg, libpng, libtiff, libxml2, zlib, libtool, xz
-, libX11, libwebp, quantumdepth ? 8}:
+{ stdenv, fetchurl, fetchpatch, bzip2, freetype, graphviz, ghostscript
+, libjpeg, libpng, libtiff, libxml2, zlib, libtool, xz, libX11
+, libwebp, quantumdepth ? 8 }:
 
 let version = "1.3.25"; in
 
@@ -12,7 +12,21 @@ stdenv.mkDerivation {
     sha256 = "17xcc7pfcmiwpfr1g8ys5a7bdnvqzka53vg3kkzhwwz0s99gljyn";
   };
 
-  patches = [ ./disable-popen.patch ];
+  patches = [
+    ./disable-popen.patch
+    (fetchpatch {
+      url = "https://sources.debian.net/data/main/g/graphicsmagick/1.3.25-4/debian/patches/CVE-2016-7996_CVE-2016-7997.patch";
+      sha256 = "0xsby2z8n7cnnln7szjznq7iaabq323wymvdjra59yb41aix74r2";
+    })
+    (fetchpatch {
+      url = "https://sources.debian.net/data/main/g/graphicsmagick/1.3.25-4/debian/patches/CVE-2016-7800_part1.patch";
+      sha256 = "02s0x9bkbnm5wrd0d2x9ld4d9z5xqpfk310lyylyr5zlnhqxmwgn";
+    })
+    (fetchpatch {
+      url = "https://sources.debian.net/data/main/g/graphicsmagick/1.3.25-4/debian/patches/CVE-2016-7800_part2.patch";
+      sha256 = "1h4xv3i1aq5avsd584rwa5sa7ca8f7w9ggmh7j2llqq5kymwsv5f";
+    })
+  ];
 
   configureFlags = [
     "--enable-shared"
diff --git a/pkgs/applications/networking/mumble/default.nix b/pkgs/applications/networking/mumble/default.nix
index 038f4cb1a739..92fe9c9d01be 100644
--- a/pkgs/applications/networking/mumble/default.nix
+++ b/pkgs/applications/networking/mumble/default.nix
@@ -108,12 +108,12 @@ let
   };
 
   stableSource = rec {
-    version = "1.2.16";
+    version = "1.2.17";
     qtVersion = 4;
 
     src = fetchurl {
       url = "https://github.com/mumble-voip/mumble/releases/download/${version}/mumble-${version}.tar.gz";
-      sha256 = "1ikswfm7zhwqcwcc1fwk0i9jjgqng49s0yilw50s34bgg1h3im7b";
+      sha256 = "176br3b0pv5sz3zvgzsz9rxr3n79irlm902h7n1wh4f6vbph2dhw";
     };
   };
 
diff --git a/pkgs/applications/version-management/git-and-tools/git/ssl-cert-file.patch b/pkgs/applications/version-management/git-and-tools/git/ssl-cert-file.patch
index bafd65e8c93e..0e0697dfb211 100644
--- a/pkgs/applications/version-management/git-and-tools/git/ssl-cert-file.patch
+++ b/pkgs/applications/version-management/git-and-tools/git/ssl-cert-file.patch
@@ -1,11 +1,14 @@
 diff -ru git-2.7.4-orig/http.c git-2.7.4/http.c
 --- git-2.7.4-orig/http.c	2016-03-17 21:47:59.000000000 +0100
 +++ git-2.7.4/http.c	2016-04-12 11:38:33.187070848 +0200
-@@ -544,6 +544,7 @@
+@@ -544,6 +544,10 @@
  #if LIBCURL_VERSION_NUM >= 0x070908
  	set_from_env(&ssl_capath, "GIT_SSL_CAPATH");
  #endif
-+	set_from_env(&ssl_cainfo, "SSL_CERT_FILE");
++	if (getenv("NIX_SSL_CERT_FILE"))
++	  set_from_env(&ssl_cainfo, "NIX_SSL_CERT_FILE");
++	else
++	  set_from_env(&ssl_cainfo, "SSL_CERT_FILE");
  	set_from_env(&ssl_cainfo, "GIT_SSL_CAINFO");
  
  	set_from_env(&user_agent, "GIT_HTTP_USER_AGENT");
diff --git a/pkgs/applications/version-management/smartgithg/default.nix b/pkgs/applications/version-management/smartgithg/default.nix
index 485e8cc6c21e..b4b0e74a79c8 100644
--- a/pkgs/applications/version-management/smartgithg/default.nix
+++ b/pkgs/applications/version-management/smartgithg/default.nix
@@ -8,17 +8,16 @@
 
 stdenv.mkDerivation rec {
   name = "smartgithg-${version}";
-  version = "7_1_2";
+  version = "8_0_3";
 
   src = fetchurl {
     url = "http://www.syntevo.com/static/smart/download/smartgit/smartgit-linux-${version}.tar.gz";
-    sha256 = "18jw4g2akhj6h9w8378kacv7ws35ndcnc3kkhci9iypwy432ak8d";
+    sha256 = "1ghxjg5dm22kwfrq26nqp4qhh6h7f4l4fnf1cx9cksd30ypwy223";
   };
 
-  buildInputs = [
-    makeWrapper
-    jre
-  ];
+  nativeBuildInputs = [ makeWrapper ];
+
+  buildInputs = [ jre ];
 
   buildCommand = let
     pkg_path = "$out/${name}";
diff --git a/pkgs/build-support/docker/default.nix b/pkgs/build-support/docker/default.nix
index dd5c523b91b5..b3db68a665dc 100644
--- a/pkgs/build-support/docker/default.nix
+++ b/pkgs/build-support/docker/default.nix
@@ -1,12 +1,36 @@
-{ stdenv, lib, callPackage, runCommand, writeReferencesToFile, writeText, vmTools, writeScript
-, docker, shadow, utillinux, coreutils, jshon, e2fsprogs, go, pigz, findutils }:
+{
+  callPackage,
+  coreutils,
+  docker,
+  e2fsprogs,
+  findutils,
+  go,
+  jshon,
+  lib,
+  pkgs,
+  pigz,
+  runCommand,
+  rsync,
+  shadow,
+  stdenv,
+  storeDir ? builtins.storeDir,
+  utillinux,
+  vmTools,
+  writeReferencesToFile,
+  writeScript,
+  writeText,
+}:
 
 # WARNING: this API is unstable and may be subject to backwards-incompatible changes in the future.
-  
+
 rec {
 
+  examples = import ./examples.nix {
+    inherit pkgs buildImage pullImage shadowSetup;
+  };
+
   pullImage = callPackage ./pull.nix {};
-  
+
   # We need to sum layer.tar, not a directory, hence tarsum instead of nix-hash.
   # And we cannot untar it, because then we cannot preserve permissions ecc.
   tarsum = runCommand "tarsum" {
@@ -23,110 +47,138 @@ rec {
 
     cp tarsum $out
   '';
-  
+
   # buildEnv creates symlinks to dirs, which is hard to edit inside the overlay VM
-  mergeDrvs = { drvs, onlyDeps ? false }:
+  mergeDrvs = {
+    derivations,
+    onlyDeps ? false
+  }:
     runCommand "merge-drvs" {
-      inherit drvs onlyDeps;
+      inherit derivations onlyDeps;
     } ''
-      if [ -n "$onlyDeps" ]; then
-        echo $drvs > $out
+      if [[ -n "$onlyDeps" ]]; then
+        echo $derivations > $out
         exit 0
       fi
-        
+
       mkdir $out
-      for drv in $drvs; do
-        echo Merging $drv
-        if [ -d "$drv" ]; then
-          cp -drf --preserve=mode -f $drv/* $out/
+      for derivation in $derivations; do
+        echo "Merging $derivation..."
+        if [[ -d "$derivation" ]]; then
+          # If it's a directory, copy all of its contents into $out.
+          cp -drf --preserve=mode -f $derivation/* $out/
         else
+          # Otherwise treat the derivation as a tarball and extract it
+          # into $out.
           tar -C $out -xpf $drv || true
         fi
       done
     '';
-  
-  shellScript = text:
-    writeScript "script.sh" ''
-      #!${stdenv.shell}
-      set -e
-      export PATH=${coreutils}/bin:/bin
-
-      ${text}
-    '';
 
+  # Helper for setting up the base files for managing users and
+  # groups, only if such files don't exist already. It is suitable for
+  # being used in a runAsRoot script.
   shadowSetup = ''
     export PATH=${shadow}/bin:$PATH
     mkdir -p /etc/pam.d
-    if [ ! -f /etc/passwd ]; then
+    if [[ ! -f /etc/passwd ]]; then
       echo "root:x:0:0::/root:/bin/sh" > /etc/passwd
       echo "root:!x:::::::" > /etc/shadow
     fi
-    if [ ! -f /etc/group ]; then
+    if [[ ! -f /etc/group ]]; then
       echo "root:x:0:" > /etc/group
       echo "root:x::" > /etc/gshadow
     fi
-    if [ ! -f /etc/pam.d/other ]; then
+    if [[ ! -f /etc/pam.d/other ]]; then
       cat > /etc/pam.d/other <<EOF
-account sufficient pam_unix.so
-auth sufficient pam_rootok.so
-password requisite pam_unix.so nullok sha512
-session required pam_unix.so
-EOF
+    account sufficient pam_unix.so
+    auth sufficient pam_rootok.so
+    password requisite pam_unix.so nullok sha512
+    session required pam_unix.so
+    EOF
     fi
-    if [ ! -f /etc/login.defs ]; then
+    if [[ ! -f /etc/login.defs ]]; then
       touch /etc/login.defs
     fi
   '';
 
-  runWithOverlay = { name , fromImage ? null, fromImageName ? null, fromImageTag ? null
-                   , diskSize ? 1024, preMount ? "", postMount ? "", postUmount ? "" }:
+  # Run commands in a virtual machine.
+  runWithOverlay = {
+    name,
+    fromImage ? null,
+    fromImageName ? null,
+    fromImageTag ? null,
+    diskSize ? 1024,
+    preMount ? "",
+    postMount ? "",
+    postUmount ? ""
+  }:
     vmTools.runInLinuxVM (
       runCommand name {
-        preVM = vmTools.createEmptyImage { size = diskSize; fullName = "docker-run-disk"; };
-
+        preVM = vmTools.createEmptyImage {
+          size = diskSize;
+          fullName = "docker-run-disk";
+        };
         inherit fromImage fromImageName fromImageTag;
-        
-        buildInputs = [ utillinux e2fsprogs jshon ];
+
+        buildInputs = [ utillinux e2fsprogs jshon rsync ];
       } ''
       rm -rf $out
-      
+
       mkdir disk
       mkfs /dev/${vmTools.hd}
       mount /dev/${vmTools.hd} disk
       cd disk
 
-      if [ -n "$fromImage" ]; then
-        echo Unpacking base image
+      if [[ -n "$fromImage" ]]; then
+        echo "Unpacking base image..."
         mkdir image
         tar -C image -xpf "$fromImage"
 
-        if [ -z "$fromImageName" ]; then
-          fromImageName=$(jshon -k < image/repositories|head -n1)
+        # If the image name isn't set, read it from the image repository json.
+        if [[ -z "$fromImageName" ]]; then
+          fromImageName=$(jshon -k < image/repositories | head -n 1)
+          echo "From-image name wasn't set. Read $fromImageName."
         fi
-        if [ -z "$fromImageTag" ]; then
-          fromImageTag=$(jshon -e $fromImageName -k < image/repositories|head -n1)
+
+        # If the tag isn't set, use the name as an index into the json
+        # and read the first key found.
+        if [[ -z "$fromImageTag" ]]; then
+          fromImageTag=$(jshon -e $fromImageName -k < image/repositories \
+                         | head -n1)
+          echo "From-image tag wasn't set. Read $fromImageTag."
         fi
-        parentID=$(jshon -e $fromImageName -e $fromImageTag -u < image/repositories)
+
+        # Use the name and tag to get the parent ID field.
+        parentID=$(jshon -e $fromImageName -e $fromImageTag -u \
+                   < image/repositories)
       fi
 
+      # Unpack all of the parent layers into the image.
       lowerdir=""
-      while [ -n "$parentID" ]; do
-        echo Unpacking layer $parentID
+      while [[ -n "$parentID" ]]; do
+        echo "Unpacking layer $parentID"
         mkdir -p image/$parentID/layer
         tar -C image/$parentID/layer -xpf image/$parentID/layer.tar
         rm image/$parentID/layer.tar
 
         find image/$parentID/layer -name ".wh.*" -exec bash -c 'name="$(basename {}|sed "s/^.wh.//")"; mknod "$(dirname {})/$name" c 0 0; rm {}' \;
 
+        # Get the next lower directory and continue the loop.
         lowerdir=$lowerdir''${lowerdir:+:}image/$parentID/layer
-        parentID=$(cat image/$parentID/json|(jshon -e parent -u 2>/dev/null || true))
+        parentID=$(cat image/$parentID/json \
+                  | (jshon -e parent -u 2>/dev/null || true))
       done
 
       mkdir work
       mkdir layer
       mkdir mnt
 
-      ${preMount}
+      ${lib.optionalString (preMount != "") ''
+        # Execute pre-mount steps
+        echo "Executing pre-mount steps..."
+        ${preMount}
+      ''}
 
       if [ -n "$lowerdir" ]; then
         mount -t overlay overlay -olowerdir=$lowerdir,workdir=work,upperdir=layer mnt
@@ -134,13 +186,19 @@ EOF
         mount --bind layer mnt
       fi
 
-      ${postMount}
- 
+      ${lib.optionalString (postMount != "") ''
+        # Execute post-mount steps
+        echo "Executing post-mount steps..."
+        ${postMount}
+      ''}
+
       umount mnt
 
-      pushd layer
-      find . -type c -exec bash -c 'name="$(basename {})"; touch "$(dirname {})/.wh.$name"; rm "{}"' \;
-      popd
+      (
+        cd layer
+        cmd='name="$(basename {})"; touch "$(dirname {})/.wh.$name"; rm "{}"'
+        find . -type c -exec bash -c "$cmd" \;
+      )
 
       ${postUmount}
       '');
@@ -150,76 +208,148 @@ EOF
       inherit name fromImage fromImageName fromImageTag diskSize;
 
       postMount = ''
-        echo Packing raw image
+        echo "Packing raw image..."
         tar -C mnt --mtime=0 -cf $out .
       '';
     };
-    
-  mkPureLayer = { baseJson, contents ? null, extraCommands ? "" }:
-    runCommand "docker-layer" {
+
+
+  # Create an executable shell script which has the coreutils in its
+  # PATH. Since root scripts are executed in a blank environment, even
+  # things like `ls` or `echo` will be missing.
+  shellScript = name: text:
+    writeScript name ''
+      #!${stdenv.shell}
+      set -e
+      export PATH=${coreutils}/bin:/bin
+      ${text}
+    '';
+
+  # Create a "layer" (set of files).
+  mkPureLayer = {
+    # Name of the layer
+    name,
+    # JSON containing configuration and metadata for this layer.
+    baseJson,
+    # Files to add to the layer.
+    contents ? null,
+    # Additional commands to run on the layer before it is tar'd up.
+    extraCommands ? ""
+  }:
+    runCommand "docker-layer-${name}" {
       inherit baseJson contents extraCommands;
 
-      buildInputs = [ jshon ];
-    } ''
+      buildInputs = [ jshon rsync ];
+    }
+    ''
       mkdir layer
-      if [ -n "$contents" ]; then
-        echo Adding contents
-        for c in $contents; do
-          cp -drf $c/* layer/
-          chmod -R ug+w layer/
+      if [[ -n "$contents" ]]; then
+        echo "Adding contents..."
+        for item in $contents; do
+          echo "Adding $item"
+          rsync -a $item/ layer/
         done
+      else
+        echo "No contents to add to layer."
+      fi
+
+      if [[ -n $extraCommands ]]; then
+        (cd layer; eval "$extraCommands")
       fi
 
-      pushd layer
-      ${extraCommands}
-      popd
-      
-      echo Packing layer
+      # Tar up the layer and throw it into 'layer.tar'.
+      echo "Packing layer..."
       mkdir $out
       tar -C layer --mtime=0 -cf $out/layer.tar .
-      ts=$(${tarsum} < $out/layer.tar)
-      cat ${baseJson} | jshon -s "$ts" -i checksum > $out/json
+
+      # Compute a checksum of the tarball.
+      echo "Computing layer checksum..."
+      tarsum=$(${tarsum} < $out/layer.tar)
+
+      # Add a 'checksum' field to the JSON, with the value set to the
+      # checksum of the tarball.
+      cat ${baseJson} | jshon -s "$tarsum" -i checksum > $out/json
+
+      # Indicate to docker that we're using schema version 1.0.
       echo -n "1.0" > $out/VERSION
+
+      echo "Finished building layer '${name}'"
     '';
 
-  mkRootLayer = { runAsRoot, baseJson, fromImage ? null, fromImageName ? null, fromImageTag ? null
-                , diskSize ? 1024, contents ? null, extraCommands ? "" }:
-    let runAsRootScript = writeScript "run-as-root.sh" runAsRoot;
+  # Make a "root" layer; required if we need to execute commands as a
+  # privileged user on the image. The commands themselves will be
+  # performed in a virtual machine sandbox.
+  mkRootLayer = {
+    # Name of the image.
+    name,
+    # Script to run as root. Bash.
+    runAsRoot,
+    # Files to add to the layer. If null, an empty layer will be created.
+    contents ? null,
+    # JSON containing configuration and metadata for this layer.
+    baseJson,
+    # Existing image onto which to append the new layer.
+    fromImage ? null,
+    # Name of the image we're appending onto.
+    fromImageName ? null,
+    # Tag of the image we're appending onto.
+    fromImageTag ? null,
+    # How much disk to allocate for the temporary virtual machine.
+    diskSize ? 1024,
+    # Commands (bash) to run on the layer; these do not require sudo.
+    extraCommands ? ""
+  }:
+    # Generate an executable script from the `runAsRoot` text.
+    let runAsRootScript = shellScript "run-as-root.sh" runAsRoot;
     in runWithOverlay {
-      name = "docker-layer";
-      
+      name = "docker-layer-${name}";
+
       inherit fromImage fromImageName fromImageTag diskSize;
 
-      preMount = lib.optionalString (contents != null) ''
-        echo Adding contents
-        for c in ${builtins.toString contents}; do
-          cp -drf $c/* layer/
-          chmod -R ug+w layer/
+      preMount = lib.optionalString (contents != null && contents != []) ''
+        echo "Adding contents..."
+        for item in ${toString contents}; do
+          echo "Adding $item..."
+          rsync -a $item/ layer/
         done
       '';
 
       postMount = ''
-        mkdir -p mnt/{dev,proc,sys,nix/store}
+        mkdir -p mnt/{dev,proc,sys} mnt${storeDir}
+
+        # Mount /dev, /sys and the nix store as shared folders.
         mount --rbind /dev mnt/dev
         mount --rbind /sys mnt/sys
-        mount --rbind /nix/store mnt/nix/store
+        mount --rbind ${storeDir} mnt${storeDir}
 
+        # Execute the run as root script. See 'man unshare' for
+        # details on what's going on here; basically this command
+        # means that the runAsRootScript will be executed in a nearly
+        # completely isolated environment.
         unshare -imnpuf --mount-proc chroot mnt ${runAsRootScript}
-        umount -R mnt/dev mnt/sys mnt/nix/store
-        rmdir --ignore-fail-on-non-empty mnt/dev mnt/proc mnt/sys mnt/nix/store mnt/nix
+
+        # Unmount directories and remove them.
+        umount -R mnt/dev mnt/sys mnt${storeDir}
+        rmdir --ignore-fail-on-non-empty \
+          mnt/dev mnt/proc mnt/sys mnt${storeDir} \
+          mnt$(dirname ${storeDir})
       '';
- 
+
       postUmount = ''
-        pushd layer
-        ${extraCommands}
-        popd
+        (cd layer; eval "${extraCommands}")
 
-        echo Packing layer
+        echo "Packing layer..."
         mkdir $out
         tar -C layer --mtime=0 -cf $out/layer.tar .
+
+        # Compute the tar checksum and add it to the output json.
+        echo "Computing checksum..."
         ts=$(${tarsum} < $out/layer.tar)
         cat ${baseJson} | jshon -s "$ts" -i checksum > $out/json
+        # Indicate to docker that we're using schema version 1.0.
         echo -n "1.0" > $out/VERSION
+
+        echo "Finished building layer '${name}'"
       '';
     };
 
@@ -229,116 +359,144 @@ EOF
   # 4. compute the layer id
   # 5. put the layer in the image
   # 6. repack the image
-  buildImage = args@{ name, tag ? "latest"
-               , fromImage ? null, fromImageName ? null, fromImageTag ? null
-               , contents ? null, config ? null, runAsRoot ? null
-               , diskSize ? 1024, extraCommands ? "" }:
+  buildImage = args@{
+    # Image name.
+    name,
+    # Image tag.
+    tag ? "latest",
+    # Parent image, to append to.
+    fromImage ? null,
+    # Name of the parent image; will be read from the image otherwise.
+    fromImageName ? null,
+    # Tag of the parent image; will be read from the image otherwise.
+    fromImageTag ? null,
+    # Files to put on the image (a nix store path or list of paths).
+    contents ? null,
+    # Docker config; e.g. what command to run on the container.
+    config ? null,
+    # Optional bash script to run on the files prior to fixturizing the layer.
+    extraCommands ? "",
+    # Optional bash script to run as root on the image when provisioning.
+    runAsRoot ? null,
+    # Size of the virtual machine disk to provision when building the image.
+    diskSize ? 1024,
+  }:
 
     let
-
       baseName = baseNameOf name;
 
+      # Create a JSON blob of the configuration. Set the date to unix zero.
       baseJson = writeText "${baseName}-config.json" (builtins.toJSON {
-          created = "1970-01-01T00:00:01Z";
-          architecture = "amd64";
-          os = "linux";
-          config = config;
+        created = "1970-01-01T00:00:01Z";
+        architecture = "amd64";
+        os = "linux";
+        config = config;
       });
 
-      layer = (if runAsRoot == null
-               then mkPureLayer { inherit baseJson contents extraCommands; }
-               else mkRootLayer { inherit baseJson fromImage fromImageName fromImageTag contents runAsRoot diskSize extraCommands; });
-      result = runCommand "${baseName}.tar.gz" {
+      layer =
+        if runAsRoot == null
+        then mkPureLayer { inherit name baseJson contents extraCommands; }
+        else mkRootLayer { inherit name baseJson fromImage fromImageName
+                                   fromImageTag contents runAsRoot diskSize
+                                   extraCommands; };
+      result = runCommand "docker-image-${baseName}.tar.gz" {
         buildInputs = [ jshon pigz coreutils findutils ];
-
         imageName = name;
         imageTag = tag;
         inherit fromImage baseJson;
-
         layerClosure = writeReferencesToFile layer;
-
-        passthru = {
-          buildArgs = args;
-        };
+        passthru.buildArgs = args;
+        passthru.layer = layer;
       } ''
         # Print tar contents:
         # 1: Interpreted as relative to the root directory
         # 2: With no trailing slashes on directories
-        # This is useful for ensuring that the output matches the values generated by the "find" command
+        # This is useful for ensuring that the output matches the
+        # values generated by the "find" command
         ls_tar() {
-            for f in $(tar -tf $1 | xargs realpath -ms --relative-to=.); do
-                if [ "$f" != "." ]; then
-                    echo "/$f"
-                fi
-            done
+          for f in $(tar -tf $1 | xargs realpath -ms --relative-to=.); do
+            if [[ "$f" != "." ]]; then
+              echo "/$f"
+            fi
+          done
         }
-      
+
         mkdir image
         touch baseFiles
-        if [ -n "$fromImage" ]; then
-          echo Unpacking base image
+        if [[ -n "$fromImage" ]]; then
+          echo "Unpacking base image..."
           tar -C image -xpf "$fromImage"
-          
-          if [ -z "$fromImageName" ]; then
+
+          if [[ -z "$fromImageName" ]]; then
             fromImageName=$(jshon -k < image/repositories|head -n1)
           fi
-          if [ -z "$fromImageTag" ]; then
-            fromImageTag=$(jshon -e $fromImageName -k < image/repositories|head -n1)
+          if [[ -z "$fromImageTag" ]]; then
+            fromImageTag=$(jshon -e $fromImageName -k \
+                           < image/repositories|head -n1)
           fi
-          parentID=$(jshon -e $fromImageName -e $fromImageTag -u < image/repositories)
-          
+          parentID=$(jshon -e $fromImageName -e $fromImageTag -u \
+                     < image/repositories)
+
           for l in image/*/layer.tar; do
-            ls_tar $l >> baseFiles
+            ls_tar image/*/layer.tar >> baseFiles
           done
         fi
 
         chmod -R ug+rw image
-        
+
         mkdir temp
         cp ${layer}/* temp/
         chmod ug+w temp/*
 
+        echo "$(dirname ${storeDir})" >> layerFiles
+        echo '${storeDir}' >> layerFiles
         for dep in $(cat $layerClosure); do
-          find $dep -path "${layer}" -prune -o -print >> layerFiles
+          find $dep >> layerFiles
         done
 
-        if [ -s layerFiles ]; then
-          # FIXME: might not be /nix/store
-          echo '/nix' >> layerFiles
-          echo '/nix/store' >> layerFiles
-        fi
-
-        echo Adding layer
+        echo "Adding layer..."
+        # Record the contents of the tarball with ls_tar.
         ls_tar temp/layer.tar >> baseFiles
-        comm <(sort -u baseFiles) <(sort -u layerFiles) -1 -3 > newFiles
-        tar -rpf temp/layer.tar --mtime=0 --no-recursion --files-from newFiles 2>/dev/null || true
 
-        echo Adding meta
-        
-        if [ -n "$parentID" ]; then
+        # Get the files in the new layer which were *not* present in
+        # the old layer, and record them as newFiles.
+        comm <(sort -n baseFiles|uniq) \
+             <(sort -n layerFiles|uniq|grep -v ${layer}) -1 -3 > newFiles
+        # Append the new files to the layer.
+        tar -rpf temp/layer.tar --mtime=0 --no-recursion --files-from newFiles
+
+        echo "Adding meta..."
+
+        # If we have a parentID, add it to the json metadata.
+        if [[ -n "$parentID" ]]; then
           cat temp/json | jshon -s "$parentID" -i parent > tmpjson
           mv tmpjson temp/json
         fi
-        
+
+        # Take the sha256 sum of the generated json and use it as the layer ID.
+        # Compute the size and add it to the json under the 'Size' field.
         layerID=$(sha256sum temp/json|cut -d ' ' -f 1)
         size=$(stat --printf="%s" temp/layer.tar)
         cat temp/json | jshon -s "$layerID" -i id -n $size -i Size > tmpjson
         mv tmpjson temp/json
 
+        # Use the temp folder we've been working on to create a new image.
         mv temp image/$layerID
-        
+
+        # Store the json under the name image/repositories.
         jshon -n object \
           -n object -s "$layerID" -i "$imageTag" \
           -i "$imageName" > image/repositories
 
+        # Make the image read-only.
         chmod -R a-w image
 
-        echo Cooking the image
+        echo "Cooking the image..."
         tar -C image --mtime=0 -c . | pigz -nT > $out
+
+        echo "Finished."
       '';
 
     in
-
-      result;
-
+    result;
 }
diff --git a/pkgs/build-support/docker/examples.nix b/pkgs/build-support/docker/examples.nix
new file mode 100644
index 000000000000..05b4a9b4f2d2
--- /dev/null
+++ b/pkgs/build-support/docker/examples.nix
@@ -0,0 +1,108 @@
+# Examples of using the docker tools to build packages.
+#
+# This file defines several docker images. In order to use an image,
+# build its derivation with `nix-build`, and then load the result with
+# `docker load`. For example:
+#
+#  $ nix-build '<nixpkgs>' -A dockerTools.examples.redis
+#  $ docker load < result
+
+{ pkgs, buildImage, pullImage, shadowSetup }:
+
+rec {
+  # 1. basic example
+  bash = buildImage {
+    name = "bash";
+    contents = pkgs.bashInteractive;
+  };
+
+  # 2. service example, layered on another image
+  redis = buildImage {
+    name = "redis";
+    tag = "latest";
+
+    # for example's sake, we can layer redis on top of bash or debian
+    fromImage = bash;
+    # fromImage = debian;
+
+    contents = pkgs.redis;
+    runAsRoot = ''
+      mkdir -p /data
+    '';
+
+    config = {
+      Cmd = [ "/bin/redis-server" ];
+      WorkingDir = "/data";
+      Volumes = {
+        "/data" = {};
+      };
+    };
+  };
+
+  # 3. another service example
+  nginx = let
+    nginxPort = "80";
+    nginxConf = pkgs.writeText "nginx.conf" ''
+      user nginx nginx;
+      daemon off;
+      error_log /dev/stdout info;
+      pid /dev/null;
+      events {}
+      http {
+        access_log /dev/stdout;
+        server {
+          listen ${nginxPort};
+          index index.html;
+          location / {
+            root ${nginxWebRoot};
+          }
+        }
+      }
+    '';
+    nginxWebRoot = pkgs.writeTextDir "index.html" ''
+      <html><body><h1>Hello from NGINX</h1></body></html>
+    '';
+  in
+  buildImage {
+    name = "nginx-container";
+    contents = pkgs.nginx;
+
+    runAsRoot = ''
+      #!${pkgs.stdenv.shell}
+      ${shadowSetup}
+      groupadd --system nginx
+      useradd --system --gid nginx nginx
+    '';
+
+    config = {
+      Cmd = [ "nginx" "-c" nginxConf ];
+      ExposedPorts = {
+        "${nginxPort}/tcp" = {};
+      };
+    };
+  };
+
+  # 4. example of pulling an image. could be used as a base for other images
+  #
+  # ***** Currently broken, getting 404s. Perhaps the docker API has changed?
+  #
+  #
+  # debian = pullImage {
+  #   imageName = "debian";
+  #   imageTag = "jessie";
+  #   # this hash will need change if the tag is updated at docker hub
+  #   sha256 = "18kd495lc2k35h03bpcbdjnix17nlqbwf6nmq3sb161blf0dk14q";
+  # };
+
+  # 5. example of multiple contents, emacs and vi happily coexisting
+  editors = buildImage {
+    name = "editors";
+    contents = [
+      pkgs.coreutils
+      pkgs.bash
+      pkgs.emacs
+      pkgs.vim
+      pkgs.nano
+    ];
+  };
+}
diff --git a/pkgs/build-support/vm/default.nix b/pkgs/build-support/vm/default.nix
index 245d0bebb45d..47f61ab64d61 100644
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@@ -1,6 +1,7 @@
 { pkgs
 , kernel ? pkgs.linux
 , img ? "bzImage"
+, storeDir ? builtins.storeDir
 , rootModules ?
     [ "virtio_pci" "virtio_blk" "virtio_balloon" "virtio_rng" "ext4" "unix" "9p" "9pnet_virtio" "rtc_cmos" ]
 }:
@@ -128,8 +129,8 @@ rec {
     mount -t devpts none /fs/dev/pts
 
     echo "mounting Nix store..."
-    mkdir -p /fs/nix/store
-    mount -t 9p store /fs/nix/store -o trans=virtio,version=9p2000.L,cache=loose
+    mkdir -p /fs${storeDir}
+    mount -t 9p store /fs${storeDir} -o trans=virtio,version=9p2000.L,cache=loose
 
     mkdir -p /fs/tmp /fs/run /fs/var
     mount -t tmpfs -o "mode=1777" none /fs/tmp
@@ -172,7 +173,7 @@ rec {
     # apparent KVM > 1.5.2 bug.
     ${pkgs.utillinux}/bin/hwclock -s
 
-    export NIX_STORE=/nix/store
+    export NIX_STORE=${storeDir}
     export NIX_BUILD_TOP=/tmp
     export TMPDIR=/tmp
     export PATH=/empty
@@ -220,7 +221,7 @@ rec {
       ${lib.optionalString (pkgs.stdenv.system == "x86_64-linux") "-cpu kvm64"} \
       -nographic -no-reboot \
       -device virtio-rng-pci \
-      -virtfs local,path=/nix/store,security_model=none,mount_tag=store \
+      -virtfs local,path=${storeDir},security_model=none,mount_tag=store \
       -virtfs local,path=$TMPDIR/xchg,security_model=none,mount_tag=xchg \
       -drive file=$diskImage,if=virtio,cache=unsafe,werror=report \
       -kernel ${kernel}/${img} \
@@ -298,7 +299,7 @@ rec {
 
   /* Run a derivation in a Linux virtual machine (using Qemu/KVM).  By
      default, there is no disk image; the root filesystem is a tmpfs,
-     and /nix/store is shared with the host (via the 9P protocol).
+     and the nix store is shared with the host (via the 9P protocol).
      Thus, any pure Nix derivation should run unmodified, e.g. the
      call
 
@@ -434,8 +435,8 @@ rec {
         chroot=$(type -tP chroot)
 
         # Make the Nix store available in /mnt, because that's where the RPMs live.
-        mkdir -p /mnt/nix/store
-        ${utillinux}/bin/mount -o bind /nix/store /mnt/nix/store
+        mkdir -p /mnt${storeDir}
+        ${utillinux}/bin/mount -o bind ${storeDir} /mnt${storeDir}
 
         # Newer distributions like Fedora 18 require /lib etc. to be
         # symlinked to /usr.
@@ -474,7 +475,7 @@ rec {
 
         rm /mnt/.debug
 
-        ${utillinux}/bin/umount /mnt/nix/store /mnt/tmp ${lib.optionalString unifiedSystemDir "/mnt/proc"}
+        ${utillinux}/bin/umount /mnt${storeDir} /mnt/tmp ${lib.optionalString unifiedSystemDir "/mnt/proc"}
         ${utillinux}/bin/umount /mnt
       '';
 
@@ -537,8 +538,7 @@ rec {
 
       # Hacky: RPM looks for <basename>.spec inside the tarball, so
       # strip off the hash.
-      stripHash "$src"
-      srcName="$strippedName"
+      srcName="$(stripHash "$src")"
       cp "$src" "$srcName" # `ln' doesn't work always work: RPM requires that the file is owned by root
 
       export HOME=/tmp/home
@@ -605,8 +605,8 @@ rec {
         done
 
         # Make the Nix store available in /mnt, because that's where the .debs live.
-        mkdir -p /mnt/inst/nix/store
-        ${utillinux}/bin/mount -o bind /nix/store /mnt/inst/nix/store
+        mkdir -p /mnt/inst${storeDir}
+        ${utillinux}/bin/mount -o bind ${storeDir} /mnt/inst${storeDir}
         ${utillinux}/bin/mount -o bind /proc /mnt/proc
         ${utillinux}/bin/mount -o bind /dev /mnt/dev
 
@@ -654,7 +654,7 @@ rec {
 
         rm /mnt/.debug
 
-        ${utillinux}/bin/umount /mnt/inst/nix/store
+        ${utillinux}/bin/umount /mnt/inst${storeDir}
         ${utillinux}/bin/umount /mnt/proc
         ${utillinux}/bin/umount /mnt/dev
         ${utillinux}/bin/umount /mnt
diff --git a/pkgs/data/fonts/droid/default.nix b/pkgs/data/fonts/droid/default.nix
index 784dfe710078..8051606632df 100644
--- a/pkgs/data/fonts/droid/default.nix
+++ b/pkgs/data/fonts/droid/default.nix
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
   sourceRoot = "./";
 
   unpackCmd = ''
-    ttfName=$(basename $(stripHash $curSrc; echo $strippedName))
+    ttfName=$(basename $(stripHash $curSrc))
     cp $curSrc ./$ttfName
   '';
 
diff --git a/pkgs/data/fonts/roboto-mono/default.nix b/pkgs/data/fonts/roboto-mono/default.nix
index 451725a6d802..e9eff414bc1d 100644
--- a/pkgs/data/fonts/roboto-mono/default.nix
+++ b/pkgs/data/fonts/roboto-mono/default.nix
@@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
   sourceRoot = "./";
 
   unpackCmd = ''
-    ttfName=$(basename $(stripHash $curSrc; echo $strippedName))
+    ttfName=$(basename $(stripHash $curSrc))
     cp $curSrc ./$ttfName
   '';
 
diff --git a/pkgs/data/fonts/roboto-slab/default.nix b/pkgs/data/fonts/roboto-slab/default.nix
index ade9fd2350e5..5a8a3f3c1201 100644
--- a/pkgs/data/fonts/roboto-slab/default.nix
+++ b/pkgs/data/fonts/roboto-slab/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
   sourceRoot = "./";
 
   unpackCmd = ''
-    ttfName=$(basename $(stripHash $curSrc; echo $strippedName))
+    ttfName=$(basename $(stripHash $curSrc))
     cp $curSrc ./$ttfName
   '';
 
diff --git a/pkgs/data/icons/arc-icon-theme/default.nix b/pkgs/data/icons/arc-icon-theme/default.nix
index 07900eebeefa..760329a94bfa 100644
--- a/pkgs/data/icons/arc-icon-theme/default.nix
+++ b/pkgs/data/icons/arc-icon-theme/default.nix
@@ -3,13 +3,13 @@
 stdenv.mkDerivation rec {
   name = "${package-name}-${version}";
   package-name = "arc-icon-theme";
-  version = "2016-06-06";
+  version = "2016-07-07";
 
   src = fetchFromGitHub {
     owner = "horst3180";
     repo = package-name;
-    rev = "69da5eed0761237fd287ea2fc95c708353ccc332";
-    sha256 = "04ym3ix2cpjh1q7lwvhl578pv41mn9zsadlsygl0nck8yd22widq";
+    rev = "664c05e723ac2971feb123d7baca3d298248e7f9";
+    sha256 = "10vicnrv2v7y4capvllaz9x3nzjkjj9fs1dspjjjg6if3gcif7m4";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/pkgs/data/icons/faba-mono-icons/default.nix b/pkgs/data/icons/faba-mono-icons/default.nix
index 16fa63c5424c..3a871e86d9d1 100644
--- a/pkgs/data/icons/faba-mono-icons/default.nix
+++ b/pkgs/data/icons/faba-mono-icons/default.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation rec {
   version = "2016-04-30";
 
   src = fetchFromGitHub {
-    owner = "moka-project";
+    owner = "snwh";
     repo = package-name;
     rev = "2006c5281eb988c799068734f289a85443800cda";
     sha256 = "0nisfl92y6hrbakp9qxi0ygayl6avkzrhwirg6854bwqjy2dvjv9";
diff --git a/pkgs/data/icons/moka-icon-theme/default.nix b/pkgs/data/icons/moka-icon-theme/default.nix
index 4d98a50c0c4b..0ffe2411c4fa 100644
--- a/pkgs/data/icons/moka-icon-theme/default.nix
+++ b/pkgs/data/icons/moka-icon-theme/default.nix
@@ -3,13 +3,13 @@
 stdenv.mkDerivation rec {
   name = "${package-name}-${version}";
   package-name = "moka-icon-theme";
-  version = "2016-06-07";
+  version = "2016-10-06";
 
   src = fetchFromGitHub {
-    owner = "moka-project";
+    owner = "snwh";
     repo = package-name;
-    rev = "a03d14e30dbdf05e8ea904994b8081ad0824e155";
-    sha256 = "1j1cnrrg0gfr4vfzxlabrv8090fg4yni99g61s82vnyszkiy1rcm";
+    rev = "50894ee9411721649019cd168b8ae2c85f4b5cf0";
+    sha256 = "1dlpsgqsn731ra5drkx72wljcgv1zydgldy4nn5bbia9s5w8mfgs";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/pkgs/data/sgml+xml/schemas/xml-dtd/docbook-ebnf/builder.sh b/pkgs/data/sgml+xml/schemas/xml-dtd/docbook-ebnf/builder.sh
index 70fd729297c0..939305d486a7 100644
--- a/pkgs/data/sgml+xml/schemas/xml-dtd/docbook-ebnf/builder.sh
+++ b/pkgs/data/sgml+xml/schemas/xml-dtd/docbook-ebnf/builder.sh
@@ -3,5 +3,4 @@ source $stdenv/setup
 mkdir -p $out/xml/dtd/docbook-ebnf
 cd $out/xml/dtd/docbook-ebnf
 cp -p $dtd dbebnf.dtd
-stripHash $catalog
-cp -p $catalog $strippedName
+cp -p $catalog $(stripHash $catalog)
diff --git a/pkgs/desktops/enlightenment/enlightenment.nix b/pkgs/desktops/enlightenment/enlightenment.nix
index f4ff94ad088e..e3d676fd4f6e 100644
--- a/pkgs/desktops/enlightenment/enlightenment.nix
+++ b/pkgs/desktops/enlightenment/enlightenment.nix
@@ -4,18 +4,20 @@ mesa_glu , xkeyboard_config }:
 
 stdenv.mkDerivation rec {
   name = "enlightenment-${version}";
-  version = "0.21.2";
+  version = "0.21.3";
 
   src = fetchurl {
     url = "http://download.enlightenment.org/rel/apps/enlightenment/${name}.tar.xz";
-    sha256 = "0fi5dxrprnvhnn2y51gnfpsjj44snriqi20k20a73vhaqxfn8xx8";
+    sha256 = "1ljzcq775njhbcaj8vdnypf2rgc6yqqdwfkf7c22603qvv9if1dr";
   };
 
   nativeBuildInputs = [ pkgconfig ];
 
-  buildInputs = [ efl libXdmcp libxcb
-    xcbutilkeysyms libXrandr libffi pam alsaLib luajit bzip2
-    libpthreadstubs gdbm ] ++ stdenv.lib.optionals stdenv.isLinux [ libcap ];
+  buildInputs = [
+    efl libXdmcp libxcb xcbutilkeysyms libXrandr libffi pam alsaLib
+    luajit bzip2 libpthreadstubs gdbm
+  ] ++
+    stdenv.lib.optionals stdenv.isLinux [ libcap ];
 
   NIX_CFLAGS_COMPILE = [
     "-I${efl}/include/ecore-imf-1"
@@ -49,11 +51,11 @@ stdenv.mkDerivation rec {
     ln -sv /var/setuid-wrappers/e_freqset $CPUFREQ_DIRPATH/freqset
   '';
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "The Compositing Window Manager and Desktop Shell";
     homepage = http://enlightenment.org/;
-    maintainers = with stdenv.lib.maintainers; [ matejc tstrobel ftrvxmtrx ];
-    platforms = stdenv.lib.platforms.linux;
-    license = stdenv.lib.licenses.bsd2;
+    license = licenses.bsd2;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ matejc tstrobel ftrvxmtrx romildo ];
   };
 }
diff --git a/pkgs/development/compilers/llvm/3.7/llvm.nix b/pkgs/development/compilers/llvm/3.7/llvm.nix
index cc65c69927c5..ae9ba62a04ce 100644
--- a/pkgs/development/compilers/llvm/3.7/llvm.nix
+++ b/pkgs/development/compilers/llvm/3.7/llvm.nix
@@ -35,6 +35,18 @@ in stdenv.mkDerivation rec {
 
   propagatedBuildInputs = [ ncurses zlib ];
 
+  # The goal here is to disable LLVM bindings (currently go and ocaml) regardless
+  # of whether the impure CMake search sheananigans find the compilers in global
+  # paths. This mostly exists because sandbox builds don't work very well on Darwin
+  # and sometimes you get weird behavior if CMake finds go in your system path.
+  # This would be far prettier if there were a CMake option to just disable bindings
+  # but from what I can tell, there isn't such a thing. The file in question only
+  # contains `if(WIN32)` conditions to check whether to disable bindings, so making
+  # those always succeed has the net effect of disabling all bindings.
+  prePatch = ''
+    substituteInPlace cmake/config-ix.cmake --replace "if(WIN32)" "if(1)"
+  '';
+
   # hacky fix: created binaries need to be run before installation
   preBuild = ''
     mkdir -p $out/
diff --git a/pkgs/development/compilers/pakcs/case-insensitive.patch b/pkgs/development/compilers/pakcs/case-insensitive.patch
new file mode 100644
index 000000000000..e46558c25208
--- /dev/null
+++ b/pkgs/development/compilers/pakcs/case-insensitive.patch
@@ -0,0 +1,19 @@
+--- www/Makefile.orig	2016-10-10 21:04:36.000000000 +0300
++++ pakcs-1.14.0/www/Makefile	2016-10-10 21:07:56.000000000 +0300
+@@ -6,7 +6,7 @@ all: submitform Registry
+ submitform: SubmitForm.curry $(LIBDIR)/HtmlCgi.curry \
+ 	    $(LIBDIR)/NamedSocket.curry $(LIBDIR)/CPNS.curry
+ 	$(REPL) $(REPL_OPTS) :load SubmitForm :save :q
+-	mv SubmitForm submitform
++	mv SubmitForm submitform.orig && mv submitform.orig submitform
+ 
+ Registry: Registry.curry $(LIBDIR)/HtmlCgi.curry
+ 	$(REPL) $(REPL_OPTS) :load Registry :save :q
+--- currytools/erd2curry/Makefile.orig	2016-10-10 21:13:49.000000000 +0300
++++ pakcs-1.14.0/currytools/erd2curry/Makefile	2016-10-10 21:21:14.000000000 +0300
+@@ -32,4 +32,4 @@ uninstall: clean
+ erd2curry: $(DEPS)
+ 	# create saved state for top-level function "main":
+ 	$(REPL) $(REPL_OPTS) :load ERD2Curry :save "main \"$(CURDIR)\"" :q
+-	mv ERD2Curry $@
++	mv ERD2Curry $@.orig && mv $@.orig $@
diff --git a/pkgs/development/compilers/pakcs/default.nix b/pkgs/development/compilers/pakcs/default.nix
index 92b916ccb8e1..ca790d027e03 100644
--- a/pkgs/development/compilers/pakcs/default.nix
+++ b/pkgs/development/compilers/pakcs/default.nix
@@ -82,7 +82,10 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ swiPrologLocked makeWrapper glibcLocales rlwrap tk which ];
 
-  patches = [ ./adjust-buildsystem.patch ];
+  patches = [
+    ./adjust-buildsystem.patch
+    ./case-insensitive.patch
+  ];
 
   configurePhase = ''
     # Phony HOME.
@@ -151,6 +154,6 @@ stdenv.mkDerivation rec {
     '';
 
     maintainers = [ stdenv.lib.maintainers.gnidorah ];
-    platforms = stdenv.lib.platforms.linux;
+    platforms = stdenv.lib.platforms.unix;
   };
 }
diff --git a/pkgs/development/compilers/swi-prolog/default.nix b/pkgs/development/compilers/swi-prolog/default.nix
index b6d6388c74b9..79f7e5256b21 100644
--- a/pkgs/development/compilers/swi-prolog/default.nix
+++ b/pkgs/development/compilers/swi-prolog/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchurl, gmp, readline, openssl, libjpeg, unixODBC, zlib
 , libXinerama, libXft, libXpm, libSM, libXt, freetype, pkgconfig
-, fontconfig
+, fontconfig, makeWrapper ? stdenv.isDarwin
 }:
 
 let
@@ -15,7 +15,8 @@ stdenv.mkDerivation {
   };
 
   buildInputs = [ gmp readline openssl libjpeg unixODBC libXinerama
-    libXft libXpm libSM libXt zlib freetype pkgconfig fontconfig ];
+    libXft libXpm libSM libXt zlib freetype pkgconfig fontconfig ]
+  ++ stdenv.lib.optional stdenv.isDarwin makeWrapper;
 
   hardeningDisable = [ "format" ];
 
@@ -23,12 +24,24 @@ stdenv.mkDerivation {
 
   buildFlags = "world";
 
+  # For macOS: still not fixed in upstream: "abort trap 6" when called
+  # through symlink, so wrap binary.
+  # We reinvent wrapProgram here but omit argv0 pass in order to not
+  # break PAKCS package build. This is also safe for SWI-Prolog, since
+  # there is no wrapping environment and hence no need to spoof $0
+  postInstall = stdenv.lib.optionalString stdenv.isDarwin ''
+    local prog="$out/bin/swipl"
+    local hidden="$(dirname "$prog")/.$(basename "$prog")"-wrapped
+    mv $prog $hidden
+    makeWrapper $hidden $prog
+  '';
+
   meta = {
     homepage = http://www.swi-prolog.org/;
     description = "A Prolog compiler and interpreter";
     license = "LGPL";
 
-    platforms = stdenv.lib.platforms.linux;
+    platforms = stdenv.lib.platforms.unix;
     maintainers = [ stdenv.lib.maintainers.peti ];
   };
 }
diff --git a/pkgs/development/interpreters/mujs/default.nix b/pkgs/development/interpreters/mujs/default.nix
index 278191bf839f..b8359488725a 100644
--- a/pkgs/development/interpreters/mujs/default.nix
+++ b/pkgs/development/interpreters/mujs/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchgit, clang }:
 
 stdenv.mkDerivation rec {
-  name = "mujs-2016-02-22";
+  name = "mujs-2016-09-21";
 
   src = fetchgit {
     url = git://git.ghostscript.com/mujs.git;
-    rev  = "624f975aae6b451e35406d8cdde808626052ce2c";
-    sha256 = "0cab7x73v380wklpkbrc1k4iyh4q2jyx3zxbymlfi1spmrpn6skl";
+    rev  = "5c337af4b3df80cf967e4f9f6a21522de84b392a";
+    sha256 = "1x5g6nycggc83md2dbr2nahjbkkmmn64bg25a8hih7z72sw41dgw";
   };
 
   buildInputs = [ clang ];
diff --git a/pkgs/development/libraries/clutter-gst/default.nix b/pkgs/development/libraries/clutter-gst/default.nix
index c2bec3a7f1de..41c7f8db6d26 100644
--- a/pkgs/development/libraries/clutter-gst/default.nix
+++ b/pkgs/development/libraries/clutter-gst/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   major = "3.0";
-  minor = "18";
+  minor = "20";
   name = "clutter-gst-${major}.${minor}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/clutter-gst/${major}/${name}.tar.xz";
-    sha256 = "14w0pi9myvcn1yxzmk9sk8dghj17m5ji3aqdpfjikk90c060vv0a";
+    sha256 = "1jb6q0f6vbh8nskz88siny70pm43wbnw2wzr2klsyb9axn3if0d0";
   };
 
   propagatedBuildInputs = [ clutter gtk3 glib cogl ];
diff --git a/pkgs/development/libraries/clutter-gtk/default.nix b/pkgs/development/libraries/clutter-gtk/default.nix
index a126f7709449..ef2ac6f93853 100644
--- a/pkgs/development/libraries/clutter-gtk/default.nix
+++ b/pkgs/development/libraries/clutter-gtk/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   major = "1.8";
-  minor = "0";
+  minor = "2";
   name = "clutter-gtk-${major}.${minor}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/clutter-gtk/${major}/${name}.tar.xz";
-    sha256 = "07dzvx0b3fsswxnpxgk0adjgccnrvbxsd971naqwndnfivbgjbkl";
+    sha256 = "da27d486325490ad3f65d2abf9413aeb8b4a8f7b559e4b2f73567a5344a26b94";
   };
 
   propagatedBuildInputs = [ clutter gtk3 ];
diff --git a/pkgs/development/libraries/fontconfig/default.nix b/pkgs/development/libraries/fontconfig/default.nix
index 550ec2bf5c31..0130ee2a014b 100644
--- a/pkgs/development/libraries/fontconfig/default.nix
+++ b/pkgs/development/libraries/fontconfig/default.nix
@@ -16,20 +16,14 @@ let
   configVersion = "2.11"; # bump whenever fontconfig breaks compatibility with older configurations
 in
 stdenv.mkDerivation rec {
-  name = "fontconfig-2.11.1";
+  name = "fontconfig-2.12.1";
 
   src = fetchurl {
     url = "http://fontconfig.org/release/${name}.tar.bz2";
-    sha256 = "16baa4g5lswkyjlyf1h5lwc0zjap7c4d8grw79349a5w6dsl8qnw";
+    sha256 = "1wy7svvp7df6bjpg1m5vizb3ngd7rhb20vpclv3x3qa71khs6jdl";
   };
 
   patches = [
-    (fetchpatch ({
-        url = "http://cgit.freedesktop.org/fontconfig/patch/?id=f44157c809d280e2a0ce87fb078fc4b278d24a67";
-        sha256 = "19s5irclg4irj2yxd7xw9yikbazs9263px8qbv4r21asw06nfalv";
-        name = "fc-cache-bug-77252.patch";
-      }
-    ))
     (substituteAll {
       src = ./config-compat.patch;
       inherit configVersion;
diff --git a/pkgs/development/libraries/gdk-pixbuf/default.nix b/pkgs/development/libraries/gdk-pixbuf/default.nix
index 85446aae8ca9..f3db9bf59776 100644
--- a/pkgs/development/libraries/gdk-pixbuf/default.nix
+++ b/pkgs/development/libraries/gdk-pixbuf/default.nix
@@ -2,7 +2,7 @@
 , jasper, libintlOrEmpty, gobjectIntrospection, doCheck ? false }:
 
 let
-  ver_maj = "2.34";
+  ver_maj = "2.36";
   ver_min = "0";
 in
 stdenv.mkDerivation rec {
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gdk-pixbuf/${ver_maj}/${name}.tar.xz";
-    sha256 = "0yc8indbl3hf18z6x6kjg59xp9sngm1d8vmz4c7bs6g27qw5npnm";
+    sha256 = "85ab52ce9f2c26327141b3dcf21cca3da6a3f8de84b95fa1e727d8871a23245c";
   };
 
   outputs = [ "out" "dev" "devdoc" ];
diff --git a/pkgs/development/libraries/glib/default.nix b/pkgs/development/libraries/glib/default.nix
index c47a02ef5e47..710b65509959 100644
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@@ -43,7 +43,7 @@ let
   '';
 
   ver_maj = "2.50";
-  ver_min = "0";
+  ver_min = "1";
 in
 
 stdenv.mkDerivation rec {
@@ -51,7 +51,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/glib/${ver_maj}/${name}.tar.xz";
-    sha256 = "830b551fa626bda06e12729205b3c5bb0d82b924a8cf64d948945878f01b7d70";
+    sha256 = "2ef87a78f37c1eb5b95f4cc95efd5b66f69afad9c9c0899918d04659cf6df7dd";
   };
 
   patches = optional stdenv.isDarwin ./darwin-compilation.patch ++ optional doCheck ./skip-timer-test.patch;
diff --git a/pkgs/development/libraries/gtkmm/2.x.nix b/pkgs/development/libraries/gtkmm/2.x.nix
index 422fdebd9c86..119e3f77f670 100644
--- a/pkgs/development/libraries/gtkmm/2.x.nix
+++ b/pkgs/development/libraries/gtkmm/2.x.nix
@@ -1,16 +1,14 @@
 { stdenv, fetchurl, pkgconfig, gtk2, glibmm, cairomm, pangomm, atkmm }:
 
 stdenv.mkDerivation rec {
-  name = "gtkmm-${minVer}.4";
+  name = "gtkmm-${minVer}.5";
   minVer = "2.24";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gtkmm/${minVer}/${name}.tar.xz";
-    sha256 = "1vpmjqv0aqb1ds0xi6nigxnhlr0c74090xzi15b92amlzkrjyfj4";
+    sha256 = "0680a53b7bf90b4e4bf444d1d89e6df41c777e0bacc96e9c09fc4dd2f5fe6b72";
   };
 
-  patches = [ ./gtkmm-2.24.4-missing-operator.patch ];
-
   nativeBuildInputs = [pkgconfig];
 
   propagatedBuildInputs = [ glibmm gtk2 atkmm cairomm pangomm ];
diff --git a/pkgs/development/libraries/gtkmm/gtkmm-2.24.4-missing-operator.patch b/pkgs/development/libraries/gtkmm/gtkmm-2.24.4-missing-operator.patch
deleted file mode 100644
index c1e8cf59dde1..000000000000
--- a/pkgs/development/libraries/gtkmm/gtkmm-2.24.4-missing-operator.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- gtkmm-2.24.4/gtk/gtkmm/menushell.cc.orig	2016-08-26 21:55:08.858311055 +0000
-+++ gtkmm-2.24.4/gtk/gtkmm/menushell.cc	2016-08-26 21:55:33.206310578 +0000
-@@ -130,7 +130,7 @@ MenuList::iterator MenuList::insert(Menu
- {
-   const Glib::RefPtr<Gtk::MenuItem> item = element.get_child();
- 
--  g_return_val_if_fail(item != 0, position);
-+  g_return_val_if_fail(!!item, position);
-   g_return_val_if_fail(gparent() != 0, position);
- 
-   int pos = -1;
\ No newline at end of file
diff --git a/pkgs/development/libraries/gvfs/default.nix b/pkgs/development/libraries/gvfs/default.nix
index 5ef8bbac5d16..f225f34c3364 100644
--- a/pkgs/development/libraries/gvfs/default.nix
+++ b/pkgs/development/libraries/gvfs/default.nix
@@ -1,19 +1,19 @@
 { stdenv, fetchurl, pkgconfig, intltool, libtool
-, glib, dbus, udev, libgudev, udisks2, libgcrypt
+, glib, dbus, udev, libgudev, udisks2, libgcrypt, libcap, polkit
 , libgphoto2, avahi, libarchive, fuse, libcdio
 , libxml2, libxslt, docbook_xsl, samba, libmtp
-, gnomeSupport ? false, gnome, libgnome_keyring, makeWrapper }:
+, gnomeSupport ? false, gnome, makeWrapper }:
 
 let
-  ver_maj = "1.22";
-  version = "${ver_maj}.4";
+  ver_maj = "1.30";
+  version = "${ver_maj}.1";
 in
 stdenv.mkDerivation rec {
   name = "gvfs-${version}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gvfs/${ver_maj}/${name}.tar.xz";
-    sha256 = "57e33faad35aba72be3822099856aca847f391626cf3ec734b42e64ba31f6484";
+    sha256 = "e752e7bb46e64e4025f63428d4f5247e3e5c0d0b5eeb4f81dbf1cd7b75f59d7b";
   };
 
   nativeBuildInputs = [ pkgconfig intltool libtool ];
@@ -21,13 +21,15 @@ stdenv.mkDerivation rec {
   buildInputs =
     [ makeWrapper glib dbus udev libgudev udisks2 libgcrypt
       libgphoto2 avahi libarchive fuse libcdio
-      libxml2 libxslt docbook_xsl samba libmtp
+      libxml2 libxslt docbook_xsl samba libmtp libcap polkit
       # ToDo: a ligther version of libsoup to have FTP/HTTP support?
     ] ++ stdenv.lib.optionals gnomeSupport (with gnome; [
-      gtk libsoup libgnome_keyring gconf
+      gtk libsoup libgnome_keyring gconf gcr
       # ToDo: not working and probably useless until gnome3 from x-updates
     ]);
 
+  configureFlags = stdenv.lib.optional (!gnomeSupport) "--disable-gcr";
+
   enableParallelBuilding = true;
 
   # ToDo: one probably should specify schemas for samba and others here
diff --git a/pkgs/development/libraries/libcue/default.nix b/pkgs/development/libraries/libcue/default.nix
index a5ff8d409b2f..a1639397b5ea 100644
--- a/pkgs/development/libraries/libcue/default.nix
+++ b/pkgs/development/libraries/libcue/default.nix
@@ -1,12 +1,19 @@
-{ stdenv, fetchurl }:
+{ stdenv, fetchFromGitHub, cmake, bison, flex }:
 stdenv.mkDerivation rec {
-  name = "libcue-1.4.0";
-  src = fetchurl {
-    url = "mirror://sourceforge/libcue/${name}.tar.bz2";
-    sha256 = "17kjd7rjz1bvfn44n3n2bjb7a1ywd0yc0g4sqp5ihf9b5bn7cwlb";
+  name = "libcue-${version}";
+  version = "2.1.0";
+
+  src = fetchFromGitHub {
+    owner = "lipnitsk";
+    repo = "libcue";
+    rev = "v${version}";
+    sha256 = "14a84d6sq3yp8s8i05lxvifjpkgpjwfpchrqf3bbpbwa8gvrc0rj";
   };
+
+  nativeBuildInputs = [ cmake bison flex ];
+
   meta = {
-    description = "A library to parse a cue sheet";
+    description = "CUE Sheet Parser Library";
     longDescription = ''
       libcue is intended to parse a so called cue sheet from a char string or
       a file pointer. For handling of the parsed data a convenient API is
diff --git a/pkgs/development/libraries/libdrm/default.nix b/pkgs/development/libraries/libdrm/default.nix
index 64cfb7d56cac..f2174470becf 100644
--- a/pkgs/development/libraries/libdrm/default.nix
+++ b/pkgs/development/libraries/libdrm/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, pkgconfig, libpthreadstubs, libpciaccess, udev, valgrind }:
 
 stdenv.mkDerivation rec {
-  name = "libdrm-2.4.70";
+  name = "libdrm-2.4.71";
 
   src = fetchurl {
     url = "http://dri.freedesktop.org/libdrm/${name}.tar.bz2";
-    sha256 = "b17d4b39ed97ca0e4cffa0db06ff609e617bac94646ec38e8e0579d530540e7b";
+    sha256 = "c66287ddeee5f46ea8f8880b94b80acb3bbc33ba6321d17767eef145046df9b8";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/libmikmod/default.nix b/pkgs/development/libraries/libmikmod/default.nix
index 806f0e9cd824..f6dc4b862921 100644
--- a/pkgs/development/libraries/libmikmod/default.nix
+++ b/pkgs/development/libraries/libmikmod/default.nix
@@ -4,10 +4,10 @@ let
   inherit (stdenv.lib) optional optionals optionalString;
 
 in stdenv.mkDerivation rec {
-  name = "libmikmod-3.3.7";
+  name = "libmikmod-3.3.10";
   src = fetchurl {
     url = "mirror://sourceforge/mikmod/${name}.tar.gz";
-    sha256 = "18nrkf5l50hfg0y50yxr7bvik9f002lhn8c00nbcp6dgm5011x2c";
+    sha256 = "0j7g4jpa2zgzw7x6s3rldypa7zlwjvn97rwx0sylx1iihhlzbcq0";
   };
 
   buildInputs = [ texinfo ]
diff --git a/pkgs/development/libraries/libmpcdec/default.nix b/pkgs/development/libraries/libmpcdec/default.nix
index 64cf460d75a0..084d7ba73704 100644
--- a/pkgs/development/libraries/libmpcdec/default.nix
+++ b/pkgs/development/libraries/libmpcdec/default.nix
@@ -1,13 +1,16 @@
-{stdenv, fetchurl}:
+{ stdenv, fetchurl }:
 
 stdenv.mkDerivation {
   name = "libmpcdec-1.2.6";
+
   src = fetchurl {
     url = http://files.musepack.net/source/libmpcdec-1.2.6.tar.bz2;
-    md5 = "7f7a060e83b4278acf4b77d7a7b9d2c0";
+    sha256 = "1a0jdyga1zfi4wgkg3905y6inghy3s4xfs5m4x7pal08m0llkmab";
   };
 
   meta = {
+    description = "Musepack SV7 decoder library";
     platforms = stdenv.lib.platforms.unix;
+    license = stdenv.lib.licenses.bsd3;
   };
 }
diff --git a/pkgs/development/libraries/libsamplerate/default.nix b/pkgs/development/libraries/libsamplerate/default.nix
index d7cb741a042a..faeeb34d65dd 100644
--- a/pkgs/development/libraries/libsamplerate/default.nix
+++ b/pkgs/development/libraries/libsamplerate/default.nix
@@ -4,20 +4,18 @@ let
   inherit (stdenv.lib) optionals optionalString;
 
 in stdenv.mkDerivation rec {
-  name = "libsamplerate-0.1.8";
+  name = "libsamplerate-0.1.9";
 
   src = fetchurl {
     url = "http://www.mega-nerd.com/SRC/${name}.tar.gz";
-    sha256 = "01hw5xjbjavh412y63brcslj5hi9wdgkjd3h9csx5rnm8vglpdck";
+    sha256 = "1ha46i0nbibq0pl0pjwcqiyny4hj8lp1bnl4dpxm64zjw9lb2zha";
   };
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ libsndfile ]
     ++ optionals stdenv.isDarwin [ ApplicationServices CoreServices ];
 
-  # maybe interesting configure flags:
-  #--disable-fftw          disable usage of FFTW
-  #--disable-cpu-clip      disable tricky cpu specific clipper
+  configureFlags = [ "--disable-fftw" ];
 
   outputs = [ "bin" "dev" "out" ];
 
diff --git a/pkgs/development/libraries/libsodium/default.nix b/pkgs/development/libraries/libsodium/default.nix
index b0bef6149d55..e0ad21008046 100644
--- a/pkgs/development/libraries/libsodium/default.nix
+++ b/pkgs/development/libraries/libsodium/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "libsodium-1.0.10";
+  name = "libsodium-1.0.11";
 
   src = fetchurl {
     url = "https://download.libsodium.org/libsodium/releases/${name}.tar.gz";
-    sha256 = "1gn45g956lyz8l6iq187yc6l627vyivyp8qc5dkr6dnhdnlqddvi";
+    sha256 = "0rf7z6bgpnf8lyz8sph4h43fbb28pmj4dgybf0hsxxj97kdljid1";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/libsoup/default.nix b/pkgs/development/libraries/libsoup/default.nix
index 707129a16bb7..1489ab627742 100644
--- a/pkgs/development/libraries/libsoup/default.nix
+++ b/pkgs/development/libraries/libsoup/default.nix
@@ -4,15 +4,15 @@
 , libintlOrEmpty
 , intltool, python }:
 let
-  majorVersion = "2.54";
-  version = "${majorVersion}.1";
+  majorVersion = "2.56";
+  version = "${majorVersion}.0";
 in
 stdenv.mkDerivation {
   name = "libsoup-${version}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/libsoup/${majorVersion}/libsoup-${version}.tar.xz";
-    sha256 = "0cyn5pq4xl1gb8413h2p4d5wrn558dc054zhwmk4swrl40ijrd27";
+    sha256 = "d8216b71de8247bc6f274ec054c08547b2e04369c1f8add713e9350c8ef81fe5";
   };
 
   prePatch = ''
diff --git a/pkgs/development/libraries/libuecc/default.nix b/pkgs/development/libraries/libuecc/default.nix
new file mode 100644
index 000000000000..3b45d4de8842
--- /dev/null
+++ b/pkgs/development/libraries/libuecc/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, fetchgit, cmake }:
+
+stdenv.mkDerivation rec {
+  version = "7";
+  name = "libuecc-${version}";
+
+  src = fetchgit {
+    url = "git://git.universe-factory.net/libuecc";
+    rev = "refs/tags/v${version}";
+    sha256 = "1sm05aql75sh13ykgsv3ns4x4zzw9lvzid6misd22gfgf6r9n5fs";
+  };
+
+  buildInputs = [ cmake ];
+
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
+    description = "Very small Elliptic Curve Cryptography library";
+    homepage = https://git.universe-factory.net/libuecc;
+    license = licenses.bsd2;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ fpletz ];
+  };
+}
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index ea89bb859e5f..6aefc8b79723 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -19,6 +19,7 @@ let
 
     patches =
       (args.patches or [])
+      ++ [ ./nix-ssl-cert-file.patch ]
       ++ optional (versionOlder version "1.1.0") ./use-etc-ssl-certs.patch
       ++ optional stdenv.isCygwin ./1.0.1-cygwin64.patch
       ++ optional
diff --git a/pkgs/development/libraries/openssl/nix-ssl-cert-file.patch b/pkgs/development/libraries/openssl/nix-ssl-cert-file.patch
new file mode 100644
index 000000000000..4b3c6f458b4c
--- /dev/null
+++ b/pkgs/development/libraries/openssl/nix-ssl-cert-file.patch
@@ -0,0 +1,15 @@
+diff -ru -x '*~' openssl-1.0.2j-orig/crypto/x509/by_file.c openssl-1.0.2j/crypto/x509/by_file.c
+--- openssl-1.0.2j-orig/crypto/x509/by_file.c	2016-09-26 11:49:07.000000000 +0200
++++ openssl-1.0.2j/crypto/x509/by_file.c	2016-10-13 16:54:31.400288302 +0200
+@@ -97,7 +97,10 @@
+     switch (cmd) {
+     case X509_L_FILE_LOAD:
+         if (argl == X509_FILETYPE_DEFAULT) {
+-            file = (char *)getenv(X509_get_default_cert_file_env());
++            file = (char *)getenv("NIX_SSL_CERT_FILE");
++            if (!file)
++                file = (char *)getenv(X509_get_default_cert_file_env());
++            fprintf(stderr, "OPEN %s", file);
+             if (file)
+                 ok = (X509_load_cert_crl_file(ctx, file,
+                                               X509_FILETYPE_PEM) != 0);
diff --git a/pkgs/development/libraries/pangomm/default.nix b/pkgs/development/libraries/pangomm/default.nix
index 0de99ece5c43..6850c13b44e9 100644
--- a/pkgs/development/libraries/pangomm/default.nix
+++ b/pkgs/development/libraries/pangomm/default.nix
@@ -2,14 +2,14 @@
 
 let
   ver_maj = "2.40";
-  ver_min = "0";
+  ver_min = "1";
 in
 stdenv.mkDerivation rec {
   name = "pangomm-${ver_maj}.${ver_min}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/pangomm/${ver_maj}/${name}.tar.xz";
-    sha256 = "03fpqdjp7plybf4zsgszbm8yhgl28vmajzfpmaqcsmyfvjlszl3x";
+    sha256 = "9762ee2a2d5781be6797448d4dd2383ce14907159b30bc12bf6b08e7227be3af";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/development/libraries/unixODBC/default.nix b/pkgs/development/libraries/unixODBC/default.nix
index e40f362a3b10..99ab8a056162 100644
--- a/pkgs/development/libraries/unixODBC/default.nix
+++ b/pkgs/development/libraries/unixODBC/default.nix
@@ -15,6 +15,6 @@ stdenv.mkDerivation rec {
     description = "ODBC driver manager for Unix";
     homepage = http://www.unixodbc.org/;
     license = licenses.lgpl2;
-    platforms = platforms.linux;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/vaapi-intel/default.nix b/pkgs/development/libraries/vaapi-intel/default.nix
index 0bc3c196c460..922aed61ed6d 100644
--- a/pkgs/development/libraries/vaapi-intel/default.nix
+++ b/pkgs/development/libraries/vaapi-intel/default.nix
@@ -3,11 +3,11 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "libva-intel-driver-1.7.0";
+  name = "libva-intel-driver-1.7.2";
 
   src = fetchurl {
     url = "http://www.freedesktop.org/software/vaapi/releases/libva-intel-driver/${name}.tar.bz2";
-    sha256 = "032w8d0whymi5ac8fk7c5d8nnxxsjgwymw644g7gp959i73xc6cx";
+    sha256 = "1g371q9p31i57fkidjp2akvrbaadpyx3bwmg5kn72sc2mbv7p7h9";
   };
 
   patchPhase = ''
diff --git a/pkgs/development/libraries/zeroc-ice/default.nix b/pkgs/development/libraries/zeroc-ice/default.nix
index 144af122d73f..33c30a96251d 100644
--- a/pkgs/development/libraries/zeroc-ice/default.nix
+++ b/pkgs/development/libraries/zeroc-ice/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "zeroc-ice-${version}";
-  version = "3.6.1";
+  version = "3.6.3";
 
   src = fetchFromGitHub {
     owner = "zeroc-ice";
     repo = "ice";
     rev = "v${version}";
-    sha256 = "044511zbhwiach1867r3xjz8i4931wn7c1l3nz4kcpgks16kqhhz";
+    sha256 = "05xympbns32aalgcfcpxwfd7bvg343f16xpg6jv5s335ski3cjy2";
   };
 
   buildInputs = [ mcpp bzip2 expat openssl db5 ];
diff --git a/pkgs/development/r-modules/README.md b/pkgs/development/r-modules/README.md
index 3a88f45b4ccb..e384b375460a 100644
--- a/pkgs/development/r-modules/README.md
+++ b/pkgs/development/r-modules/README.md
@@ -29,6 +29,30 @@ profile. The set of available libraries can be discovered by running the
 command `nix-env -f "<nixpkgs>" -qaP -A rPackages`. The first column from that
 output is the name that has to be passed to rWrapper in the code snipped above.
 
+However, if you'd like to add a file to your project source to make the
+environment available for other contributors, you can create a `default.nix`
+file like so:
+```nix
+let
+  pkgs = import <nixpkgs> {};
+  stdenv = pkgs.stdenv;
+in with pkgs; {
+  myProject = stdenv.mkDerivation {
+    name = "myProject";
+    version = "1";
+    src = if pkgs.lib.inNixShell then null else nix;
+
+    buildInputs = with rPackages; [
+      R
+      ggplot2
+      knitr
+    ];
+  };
+}
+```
+and then run `nix-shell .` to be dropped into a shell with those packages
+available.
+
 ## Updating the package set
 
 ```bash
diff --git a/pkgs/development/ruby-modules/bundler-env/default.nix b/pkgs/development/ruby-modules/bundler-env/default.nix
index 56a3b371d1dc..57ca23d41436 100644
--- a/pkgs/development/ruby-modules/bundler-env/default.nix
+++ b/pkgs/development/ruby-modules/bundler-env/default.nix
@@ -6,7 +6,14 @@
 , tree
 }@defs:
 
-{ name, gemset, gemfile, lockfile, ruby ? defs.ruby, gemConfig ? defaultGemConfig
+{ name ? null
+, pname ? null
+, gemdir ? null
+, gemfile ? null
+, lockfile ? null
+, gemset ? null
+, ruby ? defs.ruby
+, gemConfig ? defaultGemConfig
 , postBuild ? null
 , document ? []
 , meta ? {}
@@ -16,54 +23,95 @@
 }@args:
 
 let
-  importedGemset = import gemset;
+  drvName =
+    if name != null then name
+    else if pname != null then "${toString pname}-${mainGem.version}"
+    else throw "bundlerEnv: either pname or name must be set";
+
+  mainGem =
+    if pname == null then null
+    else gems."${pname}" or (throw "bundlerEnv: gem ${pname} not found");
+
+  gemfile' =
+    if gemfile == null then gemdir + "/Gemfile"
+    else gemfile;
+
+  lockfile' =
+    if lockfile == null then gemdir + "/Gemfile.lock"
+    else lockfile;
+
+  gemset' =
+    if gemset == null then gemdir + "/gemset.nix"
+    else gemset;
+
+  importedGemset = import gemset';
+
   filteredGemset = (lib.filterAttrs (name: attrs:
     if (builtins.hasAttr "groups" attrs)
     then (builtins.any (gemGroup: builtins.any (group: group == gemGroup) groups) attrs.groups)
     else true
   ) importedGemset);
+
   applyGemConfigs = attrs:
     (if gemConfig ? "${attrs.gemName}"
     then attrs // gemConfig."${attrs.gemName}" attrs
     else attrs);
+
   configuredGemset = lib.flip lib.mapAttrs filteredGemset (name: attrs:
     applyGemConfigs (attrs // { inherit ruby; gemName = name; })
   );
+
   hasBundler = builtins.hasAttr "bundler" filteredGemset;
-  bundler = if hasBundler then gems.bundler else defs.bundler.override (attrs: { inherit ruby; });
+
+  bundler =
+    if hasBundler then gems.bundler
+    else defs.bundler.override (attrs: { inherit ruby; });
+
   gems = lib.flip lib.mapAttrs configuredGemset (name: attrs:
     buildRubyGem ((removeAttrs attrs ["source"]) // attrs.source // {
       inherit ruby;
       gemName = name;
       gemPath = map (gemName: gems."${gemName}") (attrs.dependencies or []);
     }));
+
   # We have to normalize the Gemfile.lock, otherwise bundler tries to be
   # helpful by doing so at run time, causing executables to immediately bail
   # out. Yes, I'm serious.
   confFiles = runCommand "gemfile-and-lockfile" {} ''
     mkdir -p $out
-    cp ${gemfile} $out/Gemfile
-    cp ${lockfile} $out/Gemfile.lock
+    cp ${gemfile'} $out/Gemfile
+    cp ${lockfile'} $out/Gemfile.lock
   '';
+
   envPaths = lib.attrValues gems ++ lib.optional (!hasBundler) bundler;
+
+  binPaths = if mainGem != null then [ mainGem ] else envPaths;
+
   bundlerEnv = buildEnv {
-    inherit name ignoreCollisions;
+    inherit ignoreCollisions;
+
+    name = drvName;
+
     paths = envPaths;
     pathsToLink = [ "/lib" ];
+
     postBuild = ''
       ${ruby}/bin/ruby ${./gen-bin-stubs.rb} \
         "${ruby}/bin/ruby" \
         "${confFiles}/Gemfile" \
         "$out/${ruby.gemPath}" \
         "${bundler}/${ruby.gemPath}" \
-        ${lib.escapeShellArg envPaths} \
+        ${lib.escapeShellArg binPaths} \
         ${lib.escapeShellArg groups}
     '' + lib.optionalString (postBuild != null) postBuild;
+
+    meta = { platforms = ruby.meta.platforms; } // meta;
+
     passthru = rec {
-      inherit ruby bundler meta gems;
+      inherit ruby bundler gems;
 
       wrappedRuby = stdenv.mkDerivation {
-        name = "wrapped-ruby-${name}";
+        name = "wrapped-ruby-${drvName}";
         nativeBuildInputs = [ makeWrapper ];
         buildCommand = ''
           mkdir -p $out/bin
@@ -87,7 +135,7 @@ let
           require 'bundler/setup'
         '';
         in stdenv.mkDerivation {
-          name = "interactive-${name}-environment";
+          name = "interactive-${drvName}-environment";
           nativeBuildInputs = [ wrappedRuby bundlerEnv ];
           shellHook = ''
             export OLD_IRBRC="$IRBRC"
@@ -102,7 +150,5 @@ let
         };
     };
   };
-
 in
-
-bundlerEnv
+  bundlerEnv
diff --git a/pkgs/development/tools/misc/gdb/default.nix b/pkgs/development/tools/misc/gdb/default.nix
index 60218bbb1ad4..da0447c49da8 100644
--- a/pkgs/development/tools/misc/gdb/default.nix
+++ b/pkgs/development/tools/misc/gdb/default.nix
@@ -43,6 +43,9 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  # darwin build fails with format hardening since v7.12
+  hardeningDisable = stdenv.lib.optionals stdenv.isDarwin [ "format" ];
+
   configureFlags = with stdenv.lib;
     [ "--with-gmp=${gmp.dev}" "--with-mpfr=${mpfr.dev}" "--with-system-readline"
       "--with-system-zlib" "--with-expat" "--with-libexpat-prefix=${expat.dev}"
diff --git a/pkgs/development/tools/misc/intel-gpu-tools/default.nix b/pkgs/development/tools/misc/intel-gpu-tools/default.nix
index 3d3e457781ad..5ecc0421c361 100644
--- a/pkgs/development/tools/misc/intel-gpu-tools/default.nix
+++ b/pkgs/development/tools/misc/intel-gpu-tools/default.nix
@@ -2,11 +2,11 @@
 , libX11, libXext, libXv, libXrandr, glib, bison, libunwind, python3 }:
 
 stdenv.mkDerivation rec {
-  name = "intel-gpu-tools-1.14";
+  name = "intel-gpu-tools-1.16";
 
   src = fetchurl {
     url = "http://xorg.freedesktop.org/archive/individual/app/${name}.tar.bz2";
-    sha256 = "030g1akybk19y3jcxd8pp573ymrd4w7mmzxbspp064lwdv9y35im";
+    sha256 = "1q9sfb15081zm1rq4z67sfj13ryvbdha4fa6pdzdsfd9261nvgn6";
   };
 
   buildInputs = [ pkgconfig libdrm libpciaccess cairo dri2proto udev libX11
diff --git a/pkgs/development/tools/misc/intltool/default.nix b/pkgs/development/tools/misc/intltool/default.nix
index 4ab9fa284915..e59e4c23776d 100644
--- a/pkgs/development/tools/misc/intltool/default.nix
+++ b/pkgs/development/tools/misc/intltool/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   patches = [(fetchpatch {
     name = "perl-5.22.patch";
     url = "https://anonscm.debian.org/viewvc/pkg-gnome/desktop/unstable/intltool"
-      + "/debian/patches/perl5.22-regex-fixes?revision=47255&view=co";
+      + "/debian/patches/perl5.22-regex-fixes?revision=47258&view=co";
     sha256 = "17clqczb9fky7hp8czxa0fy82b5478irvz4f3fnans3sqxl95hx3";
   })];
 
diff --git a/pkgs/development/tools/misc/travis/default.nix b/pkgs/development/tools/misc/travis/default.nix
index adc63ce7c43f..9e7d6e3c6064 100644
--- a/pkgs/development/tools/misc/travis/default.nix
+++ b/pkgs/development/tools/misc/travis/default.nix
@@ -1,29 +1,14 @@
-{ stdenv, lib, bundlerEnv, ruby }:
+{ lib, bundlerEnv, ruby }:
 
-stdenv.mkDerivation rec {
-  name = "travis-${version}";
-  version = env.gems.travis.version;
-
-  env = bundlerEnv {
-    inherit ruby;
-    name = "${name}-gems";
-    gemset = ./gemset.nix;
-    gemfile = ./Gemfile;
-    lockfile = ./Gemfile.lock;
-  };
-
-  phases = ["installPhase"];
-
-  installPhase = ''
-    mkdir -p $out/bin
-    ln -s ${env}/bin/travis $out/bin/travis
-  '';
+bundlerEnv {
+  inherit ruby;
+  pName = "travis";
+  gemdir = ./.;
 
   meta = with lib; {
     description = "CLI and Ruby client library for Travis CI";
     homepage    = https://github.com/travis-ci/travis.rb;
     license     = licenses.mit;
     maintainers = with maintainers; [ zimbatm ];
-    platforms   = ruby.meta.platforms;
   };
 }
diff --git a/pkgs/development/tools/xcbuild/default.nix b/pkgs/development/tools/xcbuild/default.nix
new file mode 100644
index 000000000000..e313672aea3f
--- /dev/null
+++ b/pkgs/development/tools/xcbuild/default.nix
@@ -0,0 +1,43 @@
+{ stdenv, cmake, fetchFromGitHub, zlib, libxml2, libpng, CoreServices, CoreGraphics, ImageIO }:
+
+let
+  googletest = fetchFromGitHub {
+    owner  = "google";
+    repo   = "googletest";
+    rev    = "43359642a1c16ad3f4fc575c7edd0cb935810815";
+    sha256 = "0y4xaah62fjr3isaryc3vfz3mn9xflr00vchdimj8785milxga4q";
+  };
+
+  linenoise = fetchFromGitHub {
+    owner  = "antirez";
+    repo   = "linenoise";
+    rev    = "c894b9e59f02203dbe4e2be657572cf88c4230c3";
+    sha256 = "0wasql7ph5g473zxhc2z47z3pjp42q0dsn4gpijwzbxawid71b4w";
+  };
+in stdenv.mkDerivation rec {
+  name    = "xcbuild-${stdenv.lib.substring 0 8 version}";
+  version = "49f8a5923f1381f87ac03ad4c1b138d1d2b74369";
+
+  src = fetchFromGitHub {
+    owner  = "facebook";
+    repo   = "xcbuild";
+    rev    = version;
+    sha256 = "0l107xkh7dab2xc58dqyrrhpd1gp12cpzh0wrx0i9jbh0idbwnk0";
+  };
+
+  prePatch = ''
+    rmdir ThirdParty/*
+    cp -r --no-preserve=all ${googletest} ThirdParty/googletest
+    cp -r --no-preserve=all ${linenoise} ThirdParty/linenoise
+  '';
+
+  enableParallelBuilding = true;
+
+  # TODO: instruct cmake not to put it in /usr, rather than cleaning up
+  postInstall = ''
+    mv $out/usr/* $out
+    rmdir $out/usr
+  '';
+
+  buildInputs = [ cmake zlib libxml2 libpng CoreServices CoreGraphics ImageIO ];
+}
\ No newline at end of file
diff --git a/pkgs/development/web/nodejs/nodejs.nix b/pkgs/development/web/nodejs/nodejs.nix
index c10fe99f74a9..6cf73fd22b64 100644
--- a/pkgs/development/web/nodejs/nodejs.nix
+++ b/pkgs/development/web/nodejs/nodejs.nix
@@ -6,7 +6,8 @@
 , preBuild ? ""
 , extraConfigFlags ? []
 , extraBuildInputs ? []
-, ...
+, patches ? [],
+ ...
 }:
 
 assert stdenv.system != "armv5tel-linux";
@@ -44,7 +45,7 @@ in stdenv.mkDerivation {
     PATH=$out/bin:$PATH patchShebangs $out
   '';
 
-  patches = stdenv.lib.optionals stdenv.isDarwin [ ./no-xcode.patch ];
+  patches = patches ++ stdenv.lib.optionals stdenv.isDarwin [ ./no-xcode.patch ];
 
   buildInputs = extraBuildInputs
     ++ [ python which zlib libuv openssl ]
diff --git a/pkgs/development/web/nodejs/v4.nix b/pkgs/development/web/nodejs/v4.nix
index fa22f9d54c5c..d0e2494cd305 100644
--- a/pkgs/development/web/nodejs/v4.nix
+++ b/pkgs/development/web/nodejs/v4.nix
@@ -4,9 +4,9 @@
 }@args:
 
 import ./nodejs.nix (args // rec {
-  version = "4.4.6";
+  version = "4.6.0";
   src = fetchurl {
     url = "http://nodejs.org/dist/v${version}/node-v${version}.tar.xz";
-    sha256 = "0f6bbfbea525469c91932b1aac35e0810e6bcda96f1c720e42a433942ee66106";
+    sha256 = "1566q1kkv8j30fgqx8sm2h8323f38wwpa1hfb10gr6z46jyhv4a2";
   };
 })
diff --git a/pkgs/development/web/nodejs/v6.nix b/pkgs/development/web/nodejs/v6.nix
index f5d6e52ee441..ac54f0f8d492 100644
--- a/pkgs/development/web/nodejs/v6.nix
+++ b/pkgs/development/web/nodejs/v6.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, openssl, python, zlib, libuv, v8, utillinux, http-parser
-, pkgconfig, runCommand, which, libtool
+, pkgconfig, runCommand, which, libtool, fetchpatch
 , callPackage
 , darwin ? null
 }@args:
@@ -8,12 +8,18 @@ let
   inherit (darwin.apple_sdk.frameworks) CoreServices ApplicationServices;
 
 in import ./nodejs.nix (args // rec {
-  version = "6.7.0";
-  sha256 = "1r9vvnczjczqs29ja8gmbqgsfgkg0dph4qkaxb3yh7mb98r2ic6f";
+  version = "6.8.0";
+  sha256 = "13arzwki13688hr1lh871y06lrk019g4hkasmg11arm8j1dcwcpq";
   extraBuildInputs = stdenv.lib.optionals stdenv.isDarwin
     [ CoreServices ApplicationServices ];
   preBuild = stdenv.lib.optionalString stdenv.isDarwin ''
     sed -i -e "s|tr1/type_traits|type_traits|g" \
       -e "s|std::tr1|std|" src/util.h
   '';
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/nodejs/node/commit/fc164acbbb700fd50ab9c04b47fc1b2687e9c0f4.patch";
+      sha256 = "1rms3n09622xmddn013yvf5c6p3s8w8s0d2h813zs8c1l15k4k1i";
+    })
+  ];
 })
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix
index 27d2360a9800..aac213bb8047 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix
@@ -56,9 +56,40 @@ appleDerivation rec {
     # The startup object files
     cp ${Csu}/lib/* $out/lib
 
-    # OMG impurity
-    ln -s /usr/lib/libSystem.B.dylib $out/lib/libSystem.B.dylib
-    ln -s /usr/lib/libSystem.dylib $out/lib/libSystem.dylib
+    # Narrowly speaking, these would work if we re-exported libsystem_c and libsystem_kernel,
+    # but we also need to run the original central libsystem constructor (which initializes
+    # a ton of crap for its consitutent libraries) so we link against the central library here.
+    mkdir -p $out/lib/system
+    ld -macosx_version_min 10.7 -arch x86_64 -dylib \
+       -o $out/lib/system/libsystem_c.dylib \
+       /usr/lib/libSystem.dylib \
+       -reexported_symbols_list ${./system_c_symbols}
+
+    ld -macosx_version_min 10.7 -arch x86_64 -dylib \
+       -o $out/lib/system/libsystem_kernel.dylib \
+       /usr/lib/libSystem.dylib \
+       -reexported_symbols_list ${./system_kernel_symbols}
+
+    libs=$(otool -arch x86_64 -L /usr/lib/libSystem.dylib | tail -n +3 | awk '{ print $1 }')
+
+
+    for i in $libs; do
+      if [ "$i" != "/usr/lib/system/libsystem_kernel.dylib" ] && [ "$i" != "/usr/lib/system/libsystem_c.dylib" ]; then
+        args="$args -reexport_library $i"
+      fi
+    done
+
+    ld -macosx_version_min 10.7 \
+       -arch x86_64 \
+       -dylib \
+       -o $out/lib/libSystem.B.dylib \
+       -compatibility_version 1.0 \
+       -current_version 1226.10.1 \
+       -reexport_library $out/lib/system/libsystem_c.dylib \
+       -reexport_library $out/lib/system/libsystem_kernel.dylib \
+       $args
+
+    ln -s libSystem.B.dylib $out/lib/libSystem.dylib
 
     # Set up links to pretend we work like a conventional unix (Apple's design, not mine!)
     for name in c dbm dl info m mx poll proc pthread rpcsvc util gcc_s.10.4 gcc_s.10.5; do
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_c_symbols b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_c_symbols
index 0c814899c3c4..e298ae47f72d 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_c_symbols
+++ b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_c_symbols
@@ -1,14 +1,3 @@
-_NSGetNextSearchPathEnumeration
-_NSStartSearchPathEnumeration
-_OSAtomicAdd32
-_OSAtomicAdd32Barrier
-_OSAtomicAnd32
-_OSAtomicDequeue
-_OSAtomicEnqueue
-_OSSpinLockLock
-_OSSpinLockUnlock
-__Block_copy
-__Block_release
 __CurrentRuneLocale
 __DefaultRuneLocale
 __Exit
@@ -62,20 +51,18 @@ ___bt_setcur
 ___bt_split
 ___bt_sync
 ___buf_free
-___bzero
 ___cVersionNumber
 ___cVersionString
 ___call_hash
-___chmod_extended
 ___cleanup
 ___cmp_D2A
 ___collate_equiv_match
 ___collate_load_error
 ___collate_lookup
-___commpage_gettimeofday
 ___copybits_D2A
 ___cxa_atexit
 ___cxa_finalize
+___cxa_finalize_ranges
 ___cxa_thread_atexit
 ___d2b_D2A
 ___dbpanic
@@ -85,34 +72,21 @@ ___default_utx
 ___delpair
 ___diff_D2A
 ___dtoa
-___error
-___exit
 ___expand_table
-___fchmod_extended
-___fcntl
-___fcntl_nocancel
 ___fflush
 ___fgetwc
 ___find_bigpair
 ___find_last_page
 ___fix_locale_grouping_str
-___fork
-___fpclassifyd
-___fpclassifyl
 ___fread
 ___free_ovflpage
 ___freedtoa
-___fstat64_extended
-___fstat_extended
 ___gdtoa
 ___gdtoa_locks
 ___get_buf
 ___get_page
-___getdirentries64
 ___gethex_D2A
-___getlogin
 ___getonlyClocaleconv
-___gettimeofday
 ___hash_open
 ___hdtoa
 ___hexdig_D2A
@@ -126,14 +100,11 @@ ___increment_D2A
 ___isctype
 ___istype
 ___istype_l
-___kill
 ___ldtoa
 ___libc_init
 ___lo0bits_D2A
 ___log2
 ___lshift_D2A
-___lstat64_extended
-___lstat_extended
 ___maskrune
 ___maskrune_l
 ___match_D2A
@@ -143,22 +114,15 @@ ___memccpy_chk
 ___memcpy_chk
 ___memmove_chk
 ___memset_chk
-___mkdir_extended
-___mkfifo_extended
 ___mult_D2A
 ___multadd_D2A
 ___nrv_alloc_D2A
-___open
-___open_extended
-___open_nocancel
 ___opendir2
 ___opendir2$INODE64
 ___ovfl_delete
 ___ovfl_get
 ___ovfl_put
 ___pow5mult_D2A
-___pthread_sigmask
-___pthread_workqueue_setkill
 ___put_page
 ___quorem_D2A
 ___ratio_D2A
@@ -179,29 +143,19 @@ ___rec_sync
 ___rec_vmap
 ___rec_vpipe
 ___reclaim_buf
-___recvfrom
-___recvfrom_nocancel
 ___rshift_D2A
 ___rv_alloc_D2A
 ___s2b_D2A
 ___sF
 ___sclose
 ___sdidinit
-___semwait_signal
-___semwait_signal_nocancel
-___sendto
-___sendto_nocancel
 ___set_ones_D2A
-___setlogin
 ___setonlyClocaleconv
-___settimeofday
 ___sflags
 ___sflush
 ___sfp
 ___sfvwrite
 ___sglue
-___sigaction
-___sigaltstack
 ___sinit
 ___slbexpand
 ___smakebuf
@@ -214,8 +168,6 @@ ___srget
 ___sseek
 ___stack_chk_fail
 ___stack_chk_guard
-___stat64_extended
-___stat_extended
 ___stderrp
 ___stdinp
 ___stdoutp
@@ -237,7 +189,6 @@ ___swbuf
 ___swhatbuf
 ___swrite
 ___swsetup
-___sysctl
 ___tens_D2A
 ___tinytens_D2A
 ___tolower
@@ -246,31 +197,25 @@ ___toupper
 ___toupper_l
 ___trailz_D2A
 ___ulp_D2A
-___umask_extended
 ___ungetc
 ___ungetwc
-___unix_conforming
 ___vsnprintf_chk
 ___vsprintf_chk
-___wait4
-___wait4_nocancel
 ___wcwidth
 ___wcwidth_l
 __allocenvstate
+__atexit_receipt
 __c_locale
 __cleanup
 __closeutx
 __copyenv
 __cthread_init_routine
 __deallocenvstate
-__dyld_register_func_for_add_image
 __endutxent
-__exit
 __flockfile_debug_stub
 __fseeko
 __ftello
 __fwalk
-__get_cpu_capabilities
 __getenvp
 __getutxent
 __getutxid
@@ -279,34 +224,18 @@ __inet_aton_check
 __init_clock_port
 __int_to_time
 __libc_fork_child
+__libc_initializer
 __long_to_time
 __mkpath_np
 __mktemp
 __openutx
-__os_alloc_once
-__os_alloc_once_table
 __os_assert_log
 __os_assert_log_ctx
 __os_assumes_log
 __os_assumes_log_ctx
 __os_avoid_tail_call
-__osx_assert_log
-__osx_assert_log_ctx
-__osx_assumes_log
-__osx_assumes_log_ctx
-__osx_avoid_tail_call
-__platform_bzero
-__platform_memccpy
-__platform_memchr
-__platform_memcmp
-__platform_memmove
-__platform_memset
-__platform_memset_pattern16
-__platform_memset_pattern4
-__platform_memset_pattern8
-__platform_strchr
-__platform_strcmp
-__platform_strncmp
+__os_debug_log
+__os_debug_log_error_str
 __putenvp
 __pututxline
 __rand48_add
@@ -322,20 +251,7 @@ __setutxent
 __sigaction_nobind
 __sigintr
 __signal_nobind
-__sigtramp
 __sigvec_nobind
-__simple_asl_log
-__simple_asl_log_prog
-__simple_asl_msg_new
-__simple_asl_msg_set
-__simple_asl_send
-__simple_dprintf
-__simple_salloc
-__simple_sappend
-__simple_sfree
-__simple_sprintf
-__simple_string
-__simple_vsprintf
 __sread
 __sseek
 __swrite
@@ -345,14 +261,11 @@ __time_to_int
 __time_to_long
 __time_to_time32
 __time_to_time64
-__tlv_atexit
-__tlv_exit
 __unsetenvp
 __utmpxname
 _a64l
 _abort
 _abs
-_access
 _acl_add_flag_np
 _acl_add_perm
 _acl_calc_mask
@@ -416,12 +329,6 @@ _arc4random_uniform
 _ascii2addr
 _asctime
 _asctime_r
-_asl_get
-_asl_new
-_asl_open
-_asl_send
-_asl_set
-_asl_set_query
 _asprintf
 _asprintf_l
 _asxprintf
@@ -442,8 +349,6 @@ _backtrace_symbols_fd
 _basename
 _bcmp
 _bcopy
-_bootstrap_parent
-_bootstrap_port
 _brk
 _bsd_signal
 _bsearch
@@ -451,7 +356,6 @@ _bsearch_b
 _btowc
 _btowc_l
 _bzero
-_calloc
 _catclose
 _catgets
 _catopen
@@ -471,17 +375,12 @@ _cgetnum
 _cgetset
 _cgetstr
 _cgetustr
-_chdir
-_chflags
-_chmod
 _chmodx_np
 _clearerr
 _clearerr_unlocked
 _clock
-_clock_get_time
 _clock_port
 _clock_sem
-_close$NOCANCEL
 _closedir
 _compat_mode
 _confstr
@@ -514,19 +413,13 @@ _digittoint
 _digittoint_l
 _dirfd
 _dirname
-_dispatch_get_global_queue
 _div
-_dladdr
-_dlsym
 _dprintf
 _dprintf_l
 _drand48
-_dup2
 _duplocale
 _dxprintf
 _dxprintf_exec
-_dyld_get_program_sdk_version
-_dyld_get_sdk_version
 _ecvt
 _encrypt
 _endttyent
@@ -545,26 +438,22 @@ _execle
 _execlp
 _execv
 _execvP
-_execve
 _execvp
 _exit
 _f_prealloc
-_fchdir
 _fchmodx_np
 _fclose
-_fcntl$NOCANCEL
 _fcvt
 _fdopen
 _fdopen$DARWIN_EXTSN
-_fegetenv
+_fdopendir
+_fdopendir$INODE64
 _feof
 _feof_unlocked
 _ferror
 _ferror_unlocked
-_fesetenv
 _fflagstostr
 _fflush
-_ffsctl
 _fgetc
 _fgetln
 _fgetpos
@@ -586,7 +475,6 @@ _filesec_query_property
 _filesec_set_property
 _filesec_unset_property
 _flockfile
-_flsl
 _fmtcheck
 _fmtmsg
 _fnmatch
@@ -606,33 +494,24 @@ _fputwc_l
 _fputws
 _fputws_l
 _fread
-_free
 _free_printf_comp
 _free_printf_domain
-_freeifaddrs
 _freelocale
 _freopen
 _fscanf
 _fscanf_l
-_fsctl
 _fseek
 _fseeko
 _fsetpos
-_fstat
-_fstat$INODE64
-_fstatfs
-_fstatfs$INODE64
 _fstatvfs
 _fstatx64_np
 _fstatx_np
 _fstatx_np$INODE64
-_fsync$NOCANCEL
 _fsync_volume_np
 _ftell
 _ftello
 _ftime
 _ftok
-_ftruncate
 _ftrylockfile
 _fts_children
 _fts_children$INODE64
@@ -660,7 +539,6 @@ _fwscanf_l
 _fxprintf
 _fxprintf_exec
 _gcvt
-_getattrlist
 _getbsize
 _getc
 _getc_unlocked
@@ -670,22 +548,11 @@ _getcwd
 _getdate
 _getdate_err
 _getdelim
-_getdirentries
 _getdiskbyname
-_getdtablesize
 _getenv
-_geteuid
-_getfsstat
-_getfsstat$INODE64
-_getfsstat64
-_getgrgid
-_getgrnam
-_getgroupcount
-_getgrouplist
 _getgroups$DARWIN_EXTSN
 _gethostid
 _gethostname
-_getifaddrs
 _getipv4sourcefilter
 _getlastlogx
 _getlastlogxbyname
@@ -703,24 +570,13 @@ _getopt_long_only
 _getpagesize
 _getpass
 _getpeereid
-_getpgrp
-_getpid
-_getpriority
 _getprogname
-_getpwnam
-_getpwuid
-_getpwuid_r
-_getrlimit
-_getrusage
 _gets
-_getsectiondata
-_getsockopt
 _getsourcefilter
 _getsubopt
 _gettimeofday
 _getttyent
 _getttynam
-_getuid
 _getusershell
 _getutmp
 _getutmpx
@@ -753,9 +609,7 @@ _hcreate
 _hdestroy
 _heapsort
 _heapsort_b
-_host_get_clock_service
 _hsearch
-_if_nametoindex
 _imaxabs
 _imaxdiv
 _index
@@ -777,7 +631,6 @@ _inet_ntop6
 _inet_pton
 _initstate
 _insque
-_ioctl
 _isalnum
 _isalnum_l
 _isalpha
@@ -808,7 +661,6 @@ _ispunct
 _ispunct_l
 _isrune
 _isrune_l
-_issetugid
 _isspace
 _isspace_l
 _isspecial
@@ -857,7 +709,7 @@ _iswxdigit_l
 _isxdigit
 _isxdigit_l
 _jrand48
-_kill
+_kOSThermalNotificationPressureLevelName
 _killpg
 _l64a
 _labs
@@ -882,26 +734,13 @@ _logout
 _logwtmp
 _lrand48
 _lsearch
-_lseek
-_lstat
-_lstat$INODE64
 _lstatx64_np
 _lstatx_np
 _lstatx_np$INODE64
 _lutimes
-_mach_absolute_time
-_mach_error_string
-_mach_host_self
-_mach_port_deallocate
-_mach_task_self_
-_mach_timebase_info
-_malloc
 _mblen
 _mblen_l
 _mbmb
-_mbr_gid_to_uuid
-_mbr_uid_to_uuid
-_mbr_uuid_to_id
 _mbrlen
 _mbrlen_l
 _mbrrune
@@ -931,7 +770,6 @@ _memset_pattern8
 _memset_s
 _mergesort
 _mergesort_b
-_mkdir
 _mkdirx_np
 _mkdtemp
 _mkfifox_np
@@ -940,7 +778,6 @@ _mkstemp
 _mkstemps
 _mktemp
 _mktime
-_mmap
 _monaddition
 _moncontrol
 _moncount
@@ -957,10 +794,6 @@ _mpool_open
 _mpool_put
 _mpool_sync
 _mrand48
-_munmap
-_nan
-_nanf
-_nanl
 _nanosleep
 _nanosleep$NOCANCEL
 _new_printf_comp
@@ -973,16 +806,10 @@ _nftw$INODE64
 _nice
 _nl_langinfo
 _nl_langinfo_l
-_notify_cancel
-_notify_check
-_notify_monitor_file
-_notify_post
-_notify_register_check
 _nrand48
 _off32
 _off64
 _offtime
-_open$NOCANCEL
 _opendev
 _opendir
 _opendir$INODE64
@@ -993,60 +820,21 @@ _opterr
 _optind
 _optopt
 _optreset
-_pathconf
 _pause
 _pause$NOCANCEL
 _pclose
 _perror
-_pipe
 _popen
 _popen$DARWIN_EXTSN
 _posix2time
 _posix_openpt
-_posix_spawn
-_posix_spawn_file_actions_addclose
-_posix_spawn_file_actions_adddup2
-_posix_spawn_file_actions_destroy
-_posix_spawn_file_actions_init
-_posix_spawnattr_destroy
-_posix_spawnattr_init
-_posix_spawnattr_setflags
-_posix_spawnattr_setsigdefault
-_posix_spawnattr_setsigmask
 _posix_spawnp
-_pread$NOCANCEL
 _printf
 _printf_l
-_proc_name
-_pselect
-_pselect$1050
-_pselect$DARWIN_EXTSN
-_pselect$DARWIN_EXTSN$NOCANCEL
-_pselect$NOCANCEL
 _psignal
 _psort
 _psort_b
 _psort_r
-_pthread_get_stackaddr_np
-_pthread_get_stacksize_np
-_pthread_getspecific
-_pthread_key_create
-_pthread_key_init_np
-_pthread_kill
-_pthread_mutex_destroy
-_pthread_mutex_init
-_pthread_mutex_lock
-_pthread_mutex_trylock
-_pthread_mutex_unlock
-_pthread_once
-_pthread_rwlock_destroy
-_pthread_rwlock_rdlock
-_pthread_rwlock_unlock
-_pthread_rwlock_wrlock
-_pthread_self
-_pthread_setspecific
-_pthread_sigmask
-_pthread_testcancel
 _ptsname
 _putc
 _putc_unlocked
@@ -1060,7 +848,6 @@ _putwc
 _putwc_l
 _putwchar
 _putwchar_l
-_pwrite$NOCANCEL
 _qsort
 _qsort_b
 _qsort_r
@@ -1078,14 +865,11 @@ _rb_tree_init
 _rb_tree_insert_node
 _rb_tree_iterate
 _rb_tree_remove_node
-_read$NOCANCEL
 _readdir
 _readdir$INODE64
 _readdir_r
 _readdir_r$INODE64
-_readlink
 _readpassphrase
-_realloc
 _reallocf
 _realpath
 _realpath$DARWIN_EXTSN
@@ -1113,7 +897,6 @@ _rewind
 _rewinddir
 _rewinddir$INODE64
 _rindex
-_rmdir
 _sbrk
 _scandir
 _scandir$INODE64
@@ -1124,15 +907,8 @@ _scanf_l
 _seed48
 _seekdir
 _seekdir$INODE64
-_select
-_select$1050
-_select$DARWIN_EXTSN
-_select$DARWIN_EXTSN$NOCANCEL
-_select$NOCANCEL
-_semaphore_create
 _send
 _send$NOCANCEL
-_setattrlist
 _setbuf
 _setbuffer
 _setenv
@@ -1140,24 +916,16 @@ _sethostid
 _sethostname
 _setinvalidrune
 _setipv4sourcefilter
-_setitimer
 _setkey
 _setlinebuf
 _setlocale
 _setlogin
 _setmode
-_setpgid
 _setpgrp
-_setpriority
 _setprogname
-_setregid
-_setreuid
 _setrgid
-_setrlimit
 _setruid
 _setrunelocale
-_setsid
-_setsockopt
 _setsourcefilter
 _setstate
 _settimeofday
@@ -1180,12 +948,9 @@ _sigismember
 _signal
 _sigpause
 _sigpause$NOCANCEL
-_sigprocmask
 _sigrelse
 _sigset
 _sigsetmask
-_sigsuspend
-_sigsuspend$NOCANCEL
 _sigvec
 _skip
 _sl_add
@@ -1197,10 +962,6 @@ _sleep$NOCANCEL
 _snprintf
 _snprintf_l
 _sockatmark
-_socket
-_socketpair
-_spin_lock
-_spin_unlock
 _sprintf
 _sprintf_l
 _sradixsort
@@ -1211,9 +972,6 @@ _srandom
 _srandomdev
 _sscanf
 _sscanf_l
-_stat
-_stat$INODE64
-_statfs$INODE64
 _statvfs
 _statx64_np
 _statx_np
@@ -1306,10 +1064,8 @@ _sysconf
 _sysctl
 _sysctlbyname
 _sysctlnametomib
-_syslog
 _system
 _system$NOCANCEL
-_task_set_special_port
 _tcdrain
 _tcdrain$NOCANCEL
 _tcflow
@@ -1346,6 +1102,23 @@ _towlower
 _towlower_l
 _towupper
 _towupper_l
+_tre_ast_new_catenation
+_tre_ast_new_iter
+_tre_ast_new_literal
+_tre_ast_new_node
+_tre_ast_new_union
+_tre_compile
+_tre_fill_pmatch
+_tre_free
+_tre_mem_alloc_impl
+_tre_mem_destroy
+_tre_mem_new_impl
+_tre_parse
+_tre_stack_destroy
+_tre_stack_new
+_tre_stack_num_objects
+_tre_tnfa_run_backtrack
+_tre_tnfa_run_parallel
 _tsearch
 _ttyname
 _ttyname_r
@@ -1356,13 +1129,11 @@ _tzset
 _tzsetwall
 _ualarm
 _ulimit
-_umask
 _umaskx_np
 _uname
 _ungetc
 _ungetwc
 _ungetwc_l
-_unlink
 _unlockpt
 _unsetenv
 _unvis
@@ -1370,7 +1141,6 @@ _uselocale
 _usleep
 _usleep$NOCANCEL
 _utime
-_utimes
 _utmpxname
 _uuid_clear
 _uuid_compare
@@ -1407,7 +1177,6 @@ _vfwscanf_l
 _vfxprintf
 _vfxprintf_exec
 _vis
-_vm_allocate
 _vprintf
 _vprintf_l
 _vscanf
@@ -1436,7 +1205,6 @@ _vxprintf_exec
 _wait
 _wait$NOCANCEL
 _wait3
-_wait4
 _waitpid
 _waitpid$NOCANCEL
 _warn
@@ -1519,12 +1287,9 @@ _wordexp
 _wordfree
 _wprintf
 _wprintf_l
-_write$NOCANCEL
-_writev$NOCANCEL
 _wscanf
 _wscanf_l
 _wtmpxname
 _xprintf
 _xprintf_exec
-dyld_stub_binder
 mcount
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_kernel_symbols b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_kernel_symbols
index 9d53dea70253..ff9073157a58 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_kernel_symbols
+++ b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_kernel_symbols
@@ -9,17 +9,20 @@ ___access_extended
 ___aio_suspend_nocancel
 ___bind
 ___bsdthread_create
+___bsdthread_ctl
 ___bsdthread_register
 ___bsdthread_terminate
 ___carbon_delete
 ___chmod
 ___chmod_extended
-___chud
 ___close_nocancel
+___coalition
+___coalition_info
 ___commpage_gettimeofday
 ___connect
 ___connect_nocancel
 ___copyfile
+___csrctl
 ___delete
 ___disable_threadsignal
 ___error
@@ -29,7 +32,6 @@ ___fchmod_extended
 ___fcntl
 ___fcntl_nocancel
 ___fork
-___fsgetpath
 ___fstat64_extended
 ___fstat_extended
 ___fsync_nocancel
@@ -37,7 +39,6 @@ ___get_remove_counter
 ___getattrlist
 ___getdirentries64
 ___gethostuuid
-___getlcid
 ___getlogin
 ___getpeername
 ___getpid
@@ -47,6 +48,7 @@ ___getsockname
 ___gettid
 ___gettimeofday
 ___getwgroups
+___guarded_open_dprotected_np
 ___guarded_open_np
 ___identitysvc
 ___inc_remove_counter
@@ -54,11 +56,13 @@ ___initgroups
 ___ioctl
 ___iopolicysys
 ___kdebug_trace
+___kdebug_trace64
 ___kernelVersionNumber
 ___kernelVersionString
 ___kill
 ___lchown
 ___libkernel_init
+___libkernel_voucher_init
 ___listen
 ___lseek
 ___lstat64_extended
@@ -66,8 +70,6 @@ ___lstat_extended
 ___mac_execve
 ___mac_get_fd
 ___mac_get_file
-___mac_get_lcid
-___mac_get_lctx
 ___mac_get_link
 ___mac_get_mount
 ___mac_get_pid
@@ -76,7 +78,6 @@ ___mac_getfsstat
 ___mac_mount
 ___mac_set_fd
 ___mac_set_file
-___mac_set_lctx
 ___mac_set_link
 ___mac_set_proc
 ___mac_syscall
@@ -96,6 +97,8 @@ ___open
 ___open_dprotected_np
 ___open_extended
 ___open_nocancel
+___openat
+___openat_nocancel
 ___pipe
 ___poll_nocancel
 ___posix_spawn
@@ -131,6 +134,7 @@ ___recvfrom_nocancel
 ___recvmsg
 ___recvmsg_nocancel
 ___rename
+___renameat
 ___rmdir
 ___sandbox_me
 ___sandbox_mm
@@ -149,8 +153,8 @@ ___sendmsg_nocancel
 ___sendto
 ___sendto_nocancel
 ___setattrlist
-___setlcid
 ___setlogin
+___setpriority
 ___setregid
 ___setreuid
 ___setrlimit
@@ -159,6 +163,8 @@ ___settid
 ___settid_with_pid
 ___settimeofday
 ___setwgroups
+___sfi_ctl
+___sfi_pidctl
 ___shared_region_check_np
 ___shared_region_map_and_slide_np
 ___shm_open
@@ -171,16 +177,18 @@ ___sigsuspend
 ___sigsuspend_nocancel
 ___sigwait
 ___socketpair
-___stack_snapshot
 ___stat64_extended
 ___stat_extended
 ___syscall
 ___syscall_logger
 ___sysctl
+___sysctlbyname
 ___telemetry
 ___thread_selfid
+___thread_selfusage
 ___umask_extended
 ___unlink
+___unlinkat
 ___vfork
 ___wait4
 ___wait4_nocancel
@@ -238,6 +246,7 @@ __kernelrpc_mach_port_set_attributes
 __kernelrpc_mach_port_set_context
 __kernelrpc_mach_port_set_mscount
 __kernelrpc_mach_port_set_seqno
+__kernelrpc_mach_port_space_basic_info
 __kernelrpc_mach_port_space_info
 __kernelrpc_mach_port_type
 __kernelrpc_mach_port_unguard
@@ -253,6 +262,9 @@ __kernelrpc_mach_vm_protect_trap
 __kernelrpc_mach_vm_read
 __kernelrpc_mach_vm_remap
 __kernelrpc_task_set_port_space
+__kernelrpc_thread_policy
+__kernelrpc_thread_policy_set
+__kernelrpc_thread_set_policy
 __kernelrpc_vm_map
 __kernelrpc_vm_read
 __kernelrpc_vm_remap
@@ -304,11 +316,18 @@ _clock_sleep
 _clock_sleep_trap
 _close
 _close$NOCANCEL
+_coalition_create
+_coalition_info_resource_usage
+_coalition_reap
+_coalition_terminate
 _connect
 _connect$NOCANCEL
 _connectx
 _csops
 _csops_audittoken
+_csr_check
+_csr_get_active_config
+_denap_boost_assertion_token
 _disconnectx
 _dup
 _dup2
@@ -321,10 +340,13 @@ _exception_raise_state
 _exception_raise_state_identity
 _exchangedata
 _execve
+_faccessat
 _fchdir
 _fchflags
 _fchmod
+_fchmodat
 _fchown
+_fchownat
 _fcntl
 _fcntl$NOCANCEL
 _fdatasync
@@ -344,6 +366,9 @@ _fsetxattr
 _fstat
 _fstat$INODE64
 _fstat64
+_fstatat
+_fstatat$INODE64
+_fstatat64
 _fstatfs
 _fstatfs$INODE64
 _fstatfs64
@@ -353,6 +378,8 @@ _ftruncate
 _futimes
 _get_dp_control_port
 _getattrlist
+_getattrlistat
+_getattrlistbulk
 _getaudit
 _getaudit_addr
 _getauid
@@ -387,7 +414,12 @@ _getwgroups_np
 _getxattr
 _guarded_close_np
 _guarded_kqueue_np
+_guarded_open_dprotected_np
 _guarded_open_np
+_guarded_pwrite_np
+_guarded_write_np
+_guarded_writev_np
+_host_create_mach_voucher
 _host_default_memory_manager
 _host_get_UNDServer
 _host_get_boot_info
@@ -406,6 +438,8 @@ _host_processor_set_priv
 _host_processor_sets
 _host_processors
 _host_reboot
+_host_register_mach_voucher_attr_manager
+_host_register_well_known_mach_voucher_attr_manager
 _host_request_notification
 _host_security_create_task_token
 _host_security_set_task_token
@@ -426,6 +460,7 @@ _internal_catch_exc_subsystem
 _ioctl
 _issetugid
 _kas_info
+_kdebug_trace
 _kevent
 _kevent64
 _kext_request
@@ -438,6 +473,7 @@ _kqueue
 _lchown
 _ledger
 _link
+_linkat
 _lio_listio
 _listen
 _listxattr
@@ -454,6 +490,7 @@ _lstat
 _lstat$INODE64
 _lstat64
 _mach_absolute_time
+_mach_approximate_time
 _mach_error
 _mach_error_full_diag
 _mach_error_string
@@ -510,6 +547,7 @@ _mach_port_set_attributes
 _mach_port_set_context
 _mach_port_set_mscount
 _mach_port_set_seqno
+_mach_port_space_basic_info
 _mach_port_space_info
 _mach_port_type
 _mach_port_unguard
@@ -540,6 +578,12 @@ _mach_vm_region_recurse
 _mach_vm_remap
 _mach_vm_wire
 _mach_vm_write
+_mach_voucher_attr_command
+_mach_voucher_deallocate
+_mach_voucher_debug_info
+_mach_voucher_extract_all_attr_recipes
+_mach_voucher_extract_attr_content
+_mach_voucher_extract_attr_recipe
 _mach_wait_until
 _mach_zone_force_gc
 _mach_zone_info
@@ -565,6 +609,7 @@ _mk_timer_cancel
 _mk_timer_create
 _mk_timer_destroy
 _mkdir
+_mkdirat
 _mkfifo
 _mknod
 _mlock
@@ -573,6 +618,7 @@ _mmap
 _modwatch
 _mount
 _mprotect
+_mremap_encrypted
 _msg_receive
 _msg_rpc
 _msg_send
@@ -588,6 +634,7 @@ _msync$NOCANCEL
 _munlock
 _munlockall
 _munmap
+_necp_match_policy
 _netname_check_in
 _netname_check_out
 _netname_look_up
@@ -599,12 +646,17 @@ _normal_boost_assertion_token
 _open
 _open$NOCANCEL
 _open_dprotected_np
+_openat
+_openat$NOCANCEL
+_openbyid_np
 _panic
 _panic_init
 _pathconf
 _peeloff
 _pid_for_task
+_pid_hibernate
 _pid_resume
+_pid_shutdown_sockets
 _pid_suspend
 _pipe
 _poll
@@ -621,6 +673,7 @@ _posix_spawn_file_actions_addopen
 _posix_spawn_file_actions_destroy
 _posix_spawn_file_actions_init
 _posix_spawnattr_destroy
+_posix_spawnattr_get_qos_clamp_np
 _posix_spawnattr_getbinpref_np
 _posix_spawnattr_getcpumonitor
 _posix_spawnattr_getflags
@@ -632,8 +685,10 @@ _posix_spawnattr_getsigdefault
 _posix_spawnattr_getsigmask
 _posix_spawnattr_init
 _posix_spawnattr_set_importancewatch_port_np
+_posix_spawnattr_set_qos_clamp_np
 _posix_spawnattr_setauditsessionport_np
 _posix_spawnattr_setbinpref_np
+_posix_spawnattr_setcoalition_np
 _posix_spawnattr_setcpumonitor
 _posix_spawnattr_setcpumonitor_default
 _posix_spawnattr_setexceptionports_np
@@ -648,7 +703,10 @@ _posix_spawnattr_setspecialport_np
 _pread
 _pread$NOCANCEL
 _proc_clear_delayidlesleep
+_proc_clear_dirty
 _proc_clear_vmpressure
+_proc_denap_assertion_begin_with_msg
+_proc_denap_assertion_complete
 _proc_disable_apptype
 _proc_disable_cpumon
 _proc_disable_wakemon
@@ -671,19 +729,23 @@ _proc_pid_rusage
 _proc_pidfdinfo
 _proc_pidfileportinfo
 _proc_pidinfo
+_proc_pidoriginatorinfo
 _proc_pidpath
 _proc_regionfilename
 _proc_rlimit_control
 _proc_set_cpumon_defaults
 _proc_set_cpumon_params
+_proc_set_cpumon_params_fatal
 _proc_set_delayidlesleep
 _proc_set_dirty
 _proc_set_owner_vmpressure
 _proc_set_wakemon_defaults
 _proc_set_wakemon_params
 _proc_setpcontrol
+_proc_setthread_cpupercent
 _proc_suppress
 _proc_terminate
+_proc_trace_log
 _proc_track_dirty
 _proc_uuid_policy
 _processor_assign
@@ -704,6 +766,11 @@ _processor_set_statistics
 _processor_set_tasks
 _processor_set_threads
 _processor_start
+_pselect
+_pselect$1050
+_pselect$DARWIN_EXTSN
+_pselect$DARWIN_EXTSN$NOCANCEL
+_pselect$NOCANCEL
 _pthread_getugid_np
 _pthread_setugid_np
 _ptrace
@@ -714,6 +781,7 @@ _quotactl
 _read
 _read$NOCANCEL
 _readlink
+_readlinkat
 _readv
 _readv$NOCANCEL
 _reboot
@@ -721,8 +789,11 @@ _recvfrom
 _recvfrom$NOCANCEL
 _recvmsg
 _recvmsg$NOCANCEL
+_recvmsg_x
 _removexattr
 _rename
+_rename_ext
+_renameat
 _revoke
 _rmdir
 _searchfs
@@ -764,6 +835,7 @@ _semsys
 _sendfile
 _sendmsg
 _sendmsg$NOCANCEL
+_sendmsg_x
 _sendto
 _sendto$NOCANCEL
 _set_dp_control_port
@@ -790,6 +862,10 @@ _setsockopt
 _setuid
 _setwgroups_np
 _setxattr
+_sfi_get_class_offtime
+_sfi_process_get_flags
+_sfi_process_set_flags
+_sfi_set_class_offtime
 _shm_open
 _shm_unlink
 _shmat
@@ -815,10 +891,13 @@ _swapon
 _swtch
 _swtch_pri
 _symlink
+_symlinkat
 _sync
 _syscall
 _syscall_thread_switch
+_system_get_sfi_window
 _system_override
+_system_set_sfi_window
 _task_assign
 _task_assign_default
 _task_create
@@ -826,6 +905,7 @@ _task_for_pid
 _task_get_assignment
 _task_get_emulation_vector
 _task_get_exception_ports
+_task_get_mach_voucher
 _task_get_special_port
 _task_get_state
 _task_info
@@ -843,6 +923,7 @@ _task_set_emulation
 _task_set_emulation_vector
 _task_set_exception_ports
 _task_set_info
+_task_set_mach_voucher
 _task_set_phys_footprint_limit
 _task_set_policy
 _task_set_port_space
@@ -852,6 +933,7 @@ _task_set_state
 _task_suspend
 _task_suspend2
 _task_swap_exception_ports
+_task_swap_mach_voucher
 _task_terminate
 _task_threads
 _task_zone_info
@@ -864,6 +946,7 @@ _thread_create_running
 _thread_depress_abort
 _thread_get_assignment
 _thread_get_exception_ports
+_thread_get_mach_voucher
 _thread_get_special_port
 _thread_get_state
 _thread_info
@@ -874,11 +957,13 @@ _thread_resume
 _thread_sample
 _thread_self_trap
 _thread_set_exception_ports
+_thread_set_mach_voucher
 _thread_set_policy
 _thread_set_special_port
 _thread_set_state
 _thread_suspend
 _thread_swap_exception_ports
+_thread_swap_mach_voucher
 _thread_switch
 _thread_terminate
 _thread_wire
@@ -886,6 +971,7 @@ _truncate
 _umask
 _undelete
 _unlink
+_unlinkat
 _unmount
 _utimes
 _vfork
@@ -917,6 +1003,10 @@ _vm_region_recurse_64
 _vm_remap
 _vm_wire
 _vm_write
+_voucher_mach_msg_adopt
+_voucher_mach_msg_clear
+_voucher_mach_msg_revert
+_voucher_mach_msg_set
 _vprintf_stderr_func
 _wait4
 _waitevent
diff --git a/pkgs/os-specific/linux/nvidia-x11/365.35-kernel-4.7.patch b/pkgs/os-specific/linux/nvidia-x11/365.35-kernel-4.7.patch
deleted file mode 100644
index 8d1436c50940..000000000000
--- a/pkgs/os-specific/linux/nvidia-x11/365.35-kernel-4.7.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-diff -Naur NVIDIA-Linux-x86_64-367.35-no-compat32-upstream/kernel/nvidia-drm/nvidia-drm-fb.c NVIDIA-Linux-x86_64-367.35-no-compat32/kernel/nvidia-drm/nvidia-drm-fb.c
---- NVIDIA-Linux-x86_64-367.35-no-compat32-upstream/kernel/nvidia-drm/nvidia-drm-fb.c	2016-07-31 19:07:06.595038290 -0400
-+++ NVIDIA-Linux-x86_64-367.35-no-compat32/kernel/nvidia-drm/nvidia-drm-fb.c	2016-07-31 19:09:18.532197060 -0400
-@@ -114,7 +114,7 @@
-      * We don't support any planar format, pick up first buffer only.
-      */
- 
--    gem = drm_gem_object_lookup(dev, file, cmd->handles[0]);
-+    gem = drm_gem_object_lookup(file, cmd->handles[0]);
- 
-     if (gem == NULL)
-     {
-diff -Naur NVIDIA-Linux-x86_64-367.35-no-compat32-upstream/kernel/nvidia-drm/nvidia-drm-gem.c NVIDIA-Linux-x86_64-367.35-no-compat32/kernel/nvidia-drm/nvidia-drm-gem.c
---- NVIDIA-Linux-x86_64-367.35-no-compat32-upstream/kernel/nvidia-drm/nvidia-drm-gem.c	2016-07-31 19:07:06.595038290 -0400
-+++ NVIDIA-Linux-x86_64-367.35-no-compat32/kernel/nvidia-drm/nvidia-drm-gem.c	2016-07-31 19:08:56.187492736 -0400
-@@ -408,7 +408,7 @@
- 
-     mutex_lock(&dev->struct_mutex);
- 
--    gem = drm_gem_object_lookup(dev, file, handle);
-+    gem = drm_gem_object_lookup(file, handle);
- 
-     if (gem == NULL)
-     {
-diff -Naur NVIDIA-Linux-x86_64-367.35-no-compat32-upstream/kernel/nvidia-uvm/uvm_linux.h NVIDIA-Linux-x86_64-367.35-no-compat32/kernel/nvidia-uvm/uvm_linux.h
---- NVIDIA-Linux-x86_64-367.35-no-compat32-upstream/kernel/nvidia-uvm/uvm_linux.h	2016-07-31 19:07:06.600038448 -0400
-+++ NVIDIA-Linux-x86_64-367.35-no-compat32/kernel/nvidia-uvm/uvm_linux.h	2016-07-31 19:08:06.506926763 -0400
-@@ -554,12 +554,6 @@
-     INIT_RADIX_TREE(tree, GFP_NOWAIT);
- }
- 
--static bool radix_tree_empty(struct radix_tree_root *tree)
--{
--    void *dummy;
--    return radix_tree_gang_lookup(tree, &dummy, 0, 1) == 0;
--}
--
- 
- #if !defined(NV_USLEEP_RANGE_PRESENT)
- static void __sched usleep_range(unsigned long min, unsigned long max)
diff --git a/pkgs/os-specific/linux/nvidia-x11/default.nix b/pkgs/os-specific/linux/nvidia-x11/default.nix
index e7297b0efe20..ae05e583061b 100644
--- a/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/default.nix
@@ -12,28 +12,30 @@ assert (!libsOnly) -> kernel != null;
 
 let
 
-  versionNumber = "367.35";
+  versionNumber = "367.57";
 
   # Policy: use the highest stable version as the default (on our master).
   inherit (stdenv.lib) makeLibraryPath;
 
+  nameSuffix = optionalString (!libsOnly) "-${kernel.version}";
+
 in
 
 stdenv.mkDerivation {
-  name = "nvidia-x11-${versionNumber}${optionalString (!libsOnly) "-${kernel.version}"}";
+  name = "nvidia-x11-${versionNumber}${nameSuffix}";
 
   builder = ./builder.sh;
 
   src =
     if stdenv.system == "i686-linux" then
       fetchurl {
-        url = "http://download.nvidia.com/XFree86/Linux-x86/${versionNumber}/NVIDIA-Linux-x86-${versionNumber}.run";
-        sha256 = "05g36bxcfk21ab8b0ay3zy21k5nd71468p9y1nbflx7ghpx25jrq";
+        url = "http://us.download.nvidia.com/XFree86/Linux-x86/${versionNumber}/NVIDIA-Linux-x86-${versionNumber}.run";
+        sha256 = "1fw87nvbf8dmy7clwmm7jwp842c78mkz9bcb060wbihsywkfkm23";
       }
     else if stdenv.system == "x86_64-linux" then
       fetchurl {
-        url = "http://download.nvidia.com/XFree86/Linux-x86_64/${versionNumber}/NVIDIA-Linux-x86_64-${versionNumber}-no-compat32.run";
-        sha256 = "0m4k8f0212l63h22wk6hgi8fbfsgxqih5mizsw4ixqqmjd75av4a";
+        url = "http://us.download.nvidia.com/XFree86/Linux-x86_64/${versionNumber}/NVIDIA-Linux-x86_64-${versionNumber}.run";
+        sha256 = "0lc87bgr29l9idhy2a4bsplkwx9r0dz9kjhcc5xq2xqkkyr5sqd1";
       }
     else throw "nvidia-x11 does not support platform ${stdenv.system}";
 
@@ -55,7 +57,7 @@ stdenv.mkDerivation {
     [ gtk2 atk pango glib gdk_pixbuf cairo ] );
   programPath = makeLibraryPath [ xorg.libXv ];
 
-  patches = if (!libsOnly) && (versionAtLeast kernel.dev.version "4.7") then [ ./365.35-kernel-4.7.patch ] else [];
+
 
   buildInputs = [ perl nukeReferences ];
 
diff --git a/pkgs/os-specific/linux/powertop/default.nix b/pkgs/os-specific/linux/powertop/default.nix
index 59083a8b040e..4d81126af444 100644
--- a/pkgs/os-specific/linux/powertop/default.nix
+++ b/pkgs/os-specific/linux/powertop/default.nix
@@ -8,17 +8,19 @@ stdenv.mkDerivation rec {
     sha256 = "0nlwazxbnn0k6q5f5b09wdhw0f194lpzkp3l7vxansqhfczmcyx8";
   };
 
-  buildInputs = [ gettext libnl ncurses pciutils pkgconfig zlib ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ gettext libnl ncurses pciutils zlib ];
 
   postPatch = ''
     substituteInPlace src/main.cpp --replace "/sbin/modprobe" "modprobe"
     substituteInPlace src/calibrate/calibrate.cpp --replace "/usr/bin/xset" "xset"
   '';
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "Analyze power consumption on Intel-based laptops";
-    license = stdenv.lib.licenses.gpl2;
-    maintainers = [ stdenv.lib.maintainers.chaoflow ];
-    platforms = stdenv.lib.platforms.linux;
+    homepage = https://01.org/powertop;
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ chaoflow fpletz ];
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/servers/monitoring/riemann-dash/default.nix b/pkgs/servers/monitoring/riemann-dash/default.nix
index 32f543fbf2f1..c2d197e6b45a 100644
--- a/pkgs/servers/monitoring/riemann-dash/default.nix
+++ b/pkgs/servers/monitoring/riemann-dash/default.nix
@@ -1,21 +1,9 @@
-{ bundlerEnv, lib, stdenv }:
+{ bundlerEnv, lib, ruby }:
 
-let
-  name = "riemann-dash-${env.gems.riemann-dash.version}";
-
-  env = bundlerEnv {
-    inherit name;
-    gemfile = ./Gemfile;
-    lockfile = ./Gemfile.lock;
-    gemset = ./gemset.nix;
-  };
-
-in stdenv.mkDerivation {
-  inherit name;
-  buildCommand = ''
-    mkdir -p $out/bin
-    ln -s ${env}/bin/riemann-dash $out/bin/riemann-dash
-  '';
+bundlerEnv {
+  inherit ruby;
+  pName = "riemann-dash";
+  gemdir = ./.;
 
   meta = with lib; {
     description = "A javascript, websockets-powered dashboard for Riemann";
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index 6cab8597869e..d892135740c3 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -680,11 +680,11 @@ let
   }) // {inherit windowswmproto libX11 libXext xextproto ;};
 
   libX11 = (mkDerivation "libX11" {
-    name = "libX11-1.6.3";
+    name = "libX11-1.6.4";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/individual/lib/libX11-1.6.3.tar.bz2;
-      sha256 = "04c1vj53xq2xgyxx5vhln3wm2d76hh1n95fvs3myhligkz1sfcfg";
+      url = mirror://xorg/individual/lib/libX11-1.6.4.tar.bz2;
+      sha256 = "0hg46i6h92pmb7xp1cis2j43zq3fkdz89p0yv35w4vm17az4iixp";
     };
     buildInputs = [pkgconfig inputproto kbproto libxcb xextproto xf86bigfontproto xproto xtrans ];
     meta.platforms = stdenv.lib.platforms.unix;
@@ -779,11 +779,11 @@ let
   }) // {inherit libX11 xextproto xproto ;};
 
   libXfixes = (mkDerivation "libXfixes" {
-    name = "libXfixes-5.0.1";
+    name = "libXfixes-5.0.2";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/individual/lib/libXfixes-5.0.1.tar.bz2;
-      sha256 = "0rs7qgzr6dpr62db7sd91c1b47hzhzfr010qwnpcm8sg122w1gk3";
+      url = mirror://xorg/individual/lib/libXfixes-5.0.2.tar.bz2;
+      sha256 = "1slsk898386xii0r3l7szwwq3s6y2m4dsj0x93ninjh8xkghxllv";
     };
     buildInputs = [pkgconfig fixesproto libX11 xextproto xproto ];
     meta.platforms = stdenv.lib.platforms.unix;
@@ -823,11 +823,11 @@ let
   }) // {inherit fontconfig freetype libX11 xproto libXrender ;};
 
   libXi = (mkDerivation "libXi" {
-    name = "libXi-1.7.6";
+    name = "libXi-1.7.7";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/individual/lib/libXi-1.7.6.tar.bz2;
-      sha256 = "1b5p0l19ynmd6blnqr205wyngh6fagl35nqb4v05dw60rr9aachz";
+      url = mirror://xorg/individual/lib/libXi-1.7.7.tar.bz2;
+      sha256 = "0c70n4aq0ba628wr88ih4740nci9d9f6y3v96sx376vvlm7q6vwr";
     };
     buildInputs = [pkgconfig inputproto libX11 libXext xextproto libXfixes xproto ];
     meta.platforms = stdenv.lib.platforms.unix;
@@ -889,22 +889,22 @@ let
   }) // {inherit presentproto libX11 xextproto xproto ;};
 
   libXrandr = (mkDerivation "libXrandr" {
-    name = "libXrandr-1.5.0";
+    name = "libXrandr-1.5.1";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/individual/lib/libXrandr-1.5.0.tar.bz2;
-      sha256 = "0n6ycs1arf4wb1cal9il6v7vbxbf21qhs9sbfl8xndgwnxclk1kg";
+      url = mirror://xorg/individual/lib/libXrandr-1.5.1.tar.bz2;
+      sha256 = "06pmphx8lp3iywqnh88fvbfb0d8xgkx0qpvan49akpja1vxfgy8z";
     };
     buildInputs = [pkgconfig randrproto renderproto libX11 libXext xextproto xproto libXrender ];
     meta.platforms = stdenv.lib.platforms.unix;
   }) // {inherit randrproto renderproto libX11 libXext xextproto xproto libXrender ;};
 
   libXrender = (mkDerivation "libXrender" {
-    name = "libXrender-0.9.9";
+    name = "libXrender-0.9.10";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/individual/lib/libXrender-0.9.9.tar.bz2;
-      sha256 = "06myx7044qqdswxndsmd82fpp670klnizkgzdm194h51h1wyabzw";
+      url = mirror://xorg/individual/lib/libXrender-0.9.10.tar.bz2;
+      sha256 = "0j89cnb06g8x79wmmnwzykgkkfdhin9j7hjpvsxwlr3fz1wmjvf0";
     };
     buildInputs = [pkgconfig renderproto libX11 xproto ];
     meta.platforms = stdenv.lib.platforms.unix;
@@ -933,33 +933,33 @@ let
   }) // {inherit libICE kbproto libSM libX11 xproto ;};
 
   libXtst = (mkDerivation "libXtst" {
-    name = "libXtst-1.2.2";
+    name = "libXtst-1.2.3";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/individual/lib/libXtst-1.2.2.tar.bz2;
-      sha256 = "1ngn161nq679ffmbwl81i2hn75jjg5b3ffv6n4jilpvyazypy2pg";
+      url = mirror://xorg/individual/lib/libXtst-1.2.3.tar.bz2;
+      sha256 = "012jpyj7xfm653a9jcfqbzxyywdmwb2b5wr1dwylx14f3f54jma6";
     };
     buildInputs = [pkgconfig inputproto recordproto libX11 libXext xextproto libXi ];
     meta.platforms = stdenv.lib.platforms.unix;
   }) // {inherit inputproto recordproto libX11 libXext xextproto libXi ;};
 
   libXv = (mkDerivation "libXv" {
-    name = "libXv-1.0.10";
+    name = "libXv-1.0.11";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/individual/lib/libXv-1.0.10.tar.bz2;
-      sha256 = "09a5j6bisysiipd0nw6s352565bp0n6gbyhv5hp63s3cd3w95zjm";
+      url = mirror://xorg/individual/lib/libXv-1.0.11.tar.bz2;
+      sha256 = "125hn06bd3d8y97hm2pbf5j55gg4r2hpd3ifad651i4sr7m16v6j";
     };
     buildInputs = [pkgconfig videoproto libX11 libXext xextproto xproto ];
     meta.platforms = stdenv.lib.platforms.unix;
   }) // {inherit videoproto libX11 libXext xextproto xproto ;};
 
   libXvMC = (mkDerivation "libXvMC" {
-    name = "libXvMC-1.0.9";
+    name = "libXvMC-1.0.10";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/individual/lib/libXvMC-1.0.9.tar.bz2;
-      sha256 = "0mjp1b21dvkaz7r0iq085r92nh5vkpmx99awfgqq9hgzyvgxf0q7";
+      url = mirror://xorg/individual/lib/libXvMC-1.0.10.tar.bz2;
+      sha256 = "0bpffxr5dal90a8miv2w0rif61byqxq2f5angj4z1bnznmws00g5";
     };
     buildInputs = [pkgconfig videoproto libX11 libXext xextproto xproto libXv ];
     meta.platforms = stdenv.lib.platforms.unix;
diff --git a/pkgs/servers/x11/xorg/tarballs-7.7.list b/pkgs/servers/x11/xorg/tarballs-7.7.list
index 2ee394faf02c..5e7a9e81416f 100644
--- a/pkgs/servers/x11/xorg/tarballs-7.7.list
+++ b/pkgs/servers/x11/xorg/tarballs-7.7.list
@@ -59,7 +59,7 @@ mirror://xorg/individual/lib/libICE-1.0.9.tar.bz2
 mirror://xorg/individual/lib/libpciaccess-0.13.4.tar.bz2
 mirror://xorg/individual/lib/libSM-1.2.2.tar.bz2
 mirror://xorg/X11R7.7/src/everything/libWindowsWM-1.0.1.tar.bz2
-mirror://xorg/individual/lib/libX11-1.6.3.tar.bz2
+mirror://xorg/individual/lib/libX11-1.6.4.tar.bz2
 mirror://xorg/individual/lib/libXau-1.0.8.tar.bz2
 mirror://xorg/individual/lib/libXaw-1.0.13.tar.bz2
 mirror://xorg/individual/lib/libXcomposite-0.4.4.tar.bz2
@@ -67,24 +67,24 @@ mirror://xorg/individual/lib/libXcursor-1.1.14.tar.bz2
 mirror://xorg/individual/lib/libXdamage-1.1.4.tar.bz2
 mirror://xorg/individual/lib/libXdmcp-1.1.2.tar.bz2
 mirror://xorg/individual/lib/libXext-1.3.3.tar.bz2
-mirror://xorg/individual/lib/libXfixes-5.0.1.tar.bz2
+mirror://xorg/individual/lib/libXfixes-5.0.2.tar.bz2
 mirror://xorg/individual/lib/libXfont-1.5.1.tar.bz2
 mirror://xorg/individual/lib/libXfont2-2.0.1.tar.bz2
 mirror://xorg/individual/lib/libXft-2.3.2.tar.bz2
-mirror://xorg/individual/lib/libXi-1.7.6.tar.bz2
+mirror://xorg/individual/lib/libXi-1.7.7.tar.bz2
 mirror://xorg/individual/lib/libXinerama-1.1.3.tar.bz2
 mirror://xorg/individual/lib/libxkbfile-1.0.9.tar.bz2
 mirror://xorg/individual/lib/libXmu-1.1.2.tar.bz2
 mirror://xorg/individual/lib/libXpm-3.5.11.tar.bz2
 mirror://xorg/individual/lib/libXpresent-1.0.0.tar.bz2
-mirror://xorg/individual/lib/libXrandr-1.5.0.tar.bz2
-mirror://xorg/individual/lib/libXrender-0.9.9.tar.bz2
+mirror://xorg/individual/lib/libXrandr-1.5.1.tar.bz2
+mirror://xorg/individual/lib/libXrender-0.9.10.tar.bz2
 mirror://xorg/individual/lib/libXres-1.0.7.tar.bz2
 mirror://xorg/X11R7.7/src/everything/libXScrnSaver-1.2.2.tar.bz2
 mirror://xorg/individual/lib/libXt-1.1.5.tar.bz2
-mirror://xorg/individual/lib/libXtst-1.2.2.tar.bz2
-mirror://xorg/individual/lib/libXv-1.0.10.tar.bz2
-mirror://xorg/individual/lib/libXvMC-1.0.9.tar.bz2
+mirror://xorg/individual/lib/libXtst-1.2.3.tar.bz2
+mirror://xorg/individual/lib/libXv-1.0.11.tar.bz2
+mirror://xorg/individual/lib/libXvMC-1.0.10.tar.bz2
 mirror://xorg/individual/lib/libXxf86dga-1.1.4.tar.bz2
 mirror://xorg/individual/lib/libXxf86vm-1.1.4.tar.bz2
 mirror://xorg/X11R7.7/src/everything/luit-1.1.1.tar.bz2
diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index b530b7578e8e..fc81d3fec8d1 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -6,14 +6,14 @@
 # Allow passing in bootstrap files directly so we can test the stdenv bootstrap process when changing the bootstrap tools
 , bootstrapFiles ? let
   fetch = { file, sha256, executable ? true }: import <nix/fetchurl.nix> {
-    url = "http://tarballs.nixos.org/stdenv-darwin/x86_64/62540508837664e9b366e36d1265502db4329a6e/${file}";
+    url = "http://tarballs.nixos.org/stdenv-darwin/x86_64/33f59c9d11b8d5014dfd18cc11a425f6393c884a/${file}";
     inherit sha256 system executable;
   }; in {
-    sh      = fetch { file = "sh";    sha256 = "1qpg16qbqqkmcr5an4d73p6q55izhlzmdd3nvid8gp7f3f9spbz7"; };
-    bzip2   = fetch { file = "bzip2"; sha256 = "1g67sh51fa2ws9wch5gznvrmmh27mks3dbnp6gvac43qxdnv6mpz"; };
-    mkdir   = fetch { file = "mkdir"; sha256 = "1lkp6y33lsrj9yif1cfrw5g021pffynrdscrz3ds19hslg55w4dw"; };
-    cpio    = fetch { file = "cpio";  sha256 = "115pgrl0pcq2h4yfqrmfvffl0dcabw4mgkc91aphd913wrzfmlz9"; };
-    tarball = fetch { file = "bootstrap-tools.cpio.bz2"; sha256 = "1ak16xrj41l15ads5l2kfgbyrb1lczzhmi8nln5h0np8r3w9frw9"; executable = false; };
+    sh      = fetch { file = "sh";    sha256 = "1rx4kg6358xdj05z0m139a0zn4f4zfmq4n4vimlmnwyfiyn4x7wk"; };
+    bzip2   = fetch { file = "bzip2"; sha256 = "104qnhzk79vkbp2yi0kci6lszgfppvrwk3rgxhry842ly1xz2r7l"; };
+    mkdir   = fetch { file = "mkdir"; sha256 = "0d91c19xjzmqisncvldv79d7ddzai9l7vcmajhwlwwv74g6da5yl"; };
+    cpio    = fetch { file = "cpio";  sha256 = "0lw057bmcqls96j0gv1n3mgl66q31mba7i413cbkkaf0rfzz3dxj"; };
+    tarball = fetch { file = "bootstrap-tools.cpio.bz2"; sha256 = "13ihbj002pis3fgy1d9c4fi7flca21z9brjsjkklm82h5b4nlwxl"; executable = false; };
   }
 }:
 
diff --git a/pkgs/stdenv/darwin/make-bootstrap-tools.nix b/pkgs/stdenv/darwin/make-bootstrap-tools.nix
index 41c94bd16745..11a52eb423e9 100644
--- a/pkgs/stdenv/darwin/make-bootstrap-tools.nix
+++ b/pkgs/stdenv/darwin/make-bootstrap-tools.nix
@@ -1,8 +1,10 @@
-{ system ? builtins.currentSystem }:
+{ pkgspath ? ../../.., test-pkgspath ? pkgspath, system ? builtins.currentSystem }:
 
-with import ../../.. { inherit system; };
+with import pkgspath { inherit system; };
 
-rec {
+let
+  llvmPackages = llvmPackages_37;
+in rec {
   coreutils_ = coreutils.override (args: {
     # We want coreutils without ACL support.
     aclSupport = false;
@@ -19,17 +21,15 @@ rec {
     buildInputs = [nukeReferences cpio];
 
     buildCommand = ''
-      mkdir -p $out/bin $out/lib
+      mkdir -p $out/bin $out/lib $out/lib/system
 
-      # Our (fake) loader
-      cp -d ${darwin.dyld}/lib/dyld $out/lib/
-
-      # C standard library stuff
-      cp -d ${darwin.Libsystem}/lib/*.o $out/lib/
-      cp -d ${darwin.Libsystem}/lib/*.dylib $out/lib/
+      # We're not going to bundle the actual libSystem.dylib; instead we reconstruct it on
+      # the other side. See the notes in stdenv/darwin/default.nix for more information.
+      # We also need the .o files for various low-level boot stuff.
+      cp -d ${darwin.Libsystem}/lib/*.o $out/lib
+      cp -d ${darwin.Libsystem}/lib/system/*.dylib $out/lib/system
 
       # Resolv is actually a link to another package, so let's copy it properly
-      rm $out/lib/libresolv.9.dylib
       cp -L ${darwin.Libsystem}/lib/libresolv.9.dylib $out/lib
 
       cp -rL ${darwin.Libsystem}/include $out
@@ -78,11 +78,11 @@ rec {
 
       cp -rL ${llvmPackages.clang-unwrapped}/lib/clang $out/lib
 
-      cp -d ${libcxx}/lib/libc++*.dylib $out/lib
-      cp -d ${libcxxabi}/lib/libc++abi*.dylib $out/lib
+      cp -d ${llvmPackages.libcxx}/lib/libc++*.dylib $out/lib
+      cp -d ${llvmPackages.libcxxabi}/lib/libc++abi*.dylib $out/lib
 
       mkdir $out/include
-      cp -rd ${libcxx}/include/c++     $out/include
+      cp -rd ${llvmPackages.libcxx}/include/c++     $out/include
 
       cp -d ${icu.out}/lib/libicu*.dylib $out/lib
       cp -d ${zlib.out}/lib/libz.*       $out/lib
@@ -107,33 +107,26 @@ rec {
         done
       }
 
-      fix_dyld() {
-        # This is clearly a hack. Once we have an install_name_tool-alike that can patch dyld, this will be nicer.
-        ${perl}/bin/perl -i -0777 -pe 's/\/nix\/store\/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-dyld-239\.4\/lib\/dyld/\/usr\/lib\/dyld\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00/sg' "$1"
-      }
-
       # Strip executables even further
       for i in $out/bin/*; do
         if test -x $i -a ! -L $i; then
           chmod +w $i
-
-          fix_dyld $i
           strip $i || true
         fi
       done
 
       for i in $out/bin/* $out/lib/*.dylib $out/lib/clang/*/lib/darwin/*.dylib $out/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation; do
-        if test -x $i -a ! -L $i; then
+        if test -x "$i" -a ! -L "$i"; then
           echo "Adding rpath to $i"
           rpathify $i
         fi
       done
 
       nuke-refs $out/lib/*
+      nuke-refs $out/lib/system/*
       nuke-refs $out/lib/clang/*/lib/darwin/*
       nuke-refs $out/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
 
-      set -x
       mkdir $out/.pack
       mv $out/* $out/.pack
       mv $out/.pack $out/pack
@@ -148,10 +141,6 @@ rec {
       strip $out/on-server/*
       nuke-refs $out/on-server/*
 
-      for i in $out/on-server/*; do
-        fix_dyld $i
-      done
-
       (cd $out/pack && (find | cpio -o -H newc)) | bzip2 > $out/on-server/bootstrap-tools.cpio.bz2
     '';
 
@@ -294,8 +283,8 @@ rec {
 
   # The ultimate test: bootstrap a whole stdenv from the tools specified above and get a package set out of it
   test-pkgs = let
-    stdenv = import ./. { inherit system bootstrapFiles; };
-  in import ../../.. {
+    stdenv = import (test-pkgspath + "/pkgs/stdenv/darwin") { inherit system bootstrapFiles; };
+  in import test-pkgspath {
     inherit system;
     bootStdenv = stdenv.stdenvDarwin;
   };
diff --git a/pkgs/stdenv/darwin/unpack-bootstrap-tools.sh b/pkgs/stdenv/darwin/unpack-bootstrap-tools.sh
index 8033c7004d93..66c4e9ebeda9 100644
--- a/pkgs/stdenv/darwin/unpack-bootstrap-tools.sh
+++ b/pkgs/stdenv/darwin/unpack-bootstrap-tools.sh
@@ -17,9 +17,44 @@ for i in $out/bin/*; do
   fi
 done
 
+install_name_tool \
+  -id $out/lib/system/libsystem_c.dylib \
+  $out/lib/system/libsystem_c.dylib
+
+install_name_tool \
+  -id $out/lib/system/libsystem_kernel.dylib \
+  $out/lib/system/libsystem_kernel.dylib
+
+# TODO: this logic basically duplicates similar logic in the Libsystem expression. Deduplicate them!
+libs=$(otool -arch x86_64 -L /usr/lib/libSystem.dylib | tail -n +3 | awk '{ print $1 }')
+
+for i in $libs; do
+  if [ "$i" != "/usr/lib/system/libsystem_kernel.dylib" ] && [ "$i" != "/usr/lib/system/libsystem_c.dylib" ]; then
+    args="$args -reexport_library $i"
+  fi
+done
+
+ld -macosx_version_min 10.7 \
+   -arch x86_64 \
+   -dylib \
+   -o $out/lib/libSystem.B.dylib \
+   -compatibility_version 1.0 \
+   -current_version 1226.10.1 \
+   -reexport_library $out/lib/system/libsystem_c.dylib \
+   -reexport_library $out/lib/system/libsystem_kernel.dylib \
+   $args
+
+ln -s libSystem.B.dylib $out/lib/libSystem.dylib
+
+for name in c dbm dl info m mx poll proc pthread rpcsvc util gcc_s.10.4 gcc_s.10.5; do
+  ln -s libSystem.dylib $out/lib/lib$name.dylib
+done
+
+ln -s libresolv.9.dylib $out/lib/libresolv.dylib
+
 for i in $out/lib/*.dylib $out/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation; do
-  if ! test -L $i; then
-    echo patching $i
+  if test ! -L "$i" -a "$i" != "$out/lib/libSystem*.dylib"; then
+    echo "Patching $i"
 
     id=$(otool -D "$i" | tail -n 1)
     install_name_tool -id "$(dirname $i)/$(basename $id)" $i
diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index feb82fd92266..154fdefd789c 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -490,12 +490,14 @@ dumpVars() {
 }
 
 
-# Utility function: return the base name of the given path, with the
+# Utility function: echo the base name of the given path, with the
 # prefix `HASH-' removed, if present.
 stripHash() {
-    strippedName=$(basename $1);
+    local strippedName="$(basename "$1")";
     if echo "$strippedName" | grep -q '^[a-z0-9]\{32\}-'; then
-        strippedName=$(echo "$strippedName" | cut -c34-)
+        echo "$strippedName" | cut -c34-
+    else
+        echo "$strippedName"
     fi
 }
 
@@ -506,12 +508,10 @@ _defaultUnpack() {
 
     if [ -d "$fn" ]; then
 
-        stripHash "$fn"
-
         # We can't preserve hardlinks because they may have been
         # introduced by store optimization, which might break things
         # in the build.
-        cp -pr --reflink=auto "$fn" $strippedName
+        cp -pr --reflink=auto "$fn" "$(stripHash "$fn")"
 
     else
 
diff --git a/pkgs/tools/bluetooth/blueman/default.nix b/pkgs/tools/bluetooth/blueman/default.nix
index 6a668f777941..2efd4660bbcc 100644
--- a/pkgs/tools/bluetooth/blueman/default.nix
+++ b/pkgs/tools/bluetooth/blueman/default.nix
@@ -1,6 +1,6 @@
 { stdenv, lib, fetchurl, intltool, pkgconfig, pythonPackages, bluez, polkit, gtk3
 , obex_data_server, xdg_utils, libnotify, dconf, gsettings_desktop_schemas, dnsmasq, dhcp
-, withPulseAudio ? true, libpulseaudio }:
+, hicolor_icon_theme , withPulseAudio ? true, libpulseaudio }:
 
 let
   binPath = lib.makeBinPath [ xdg_utils dnsmasq dhcp ];
@@ -16,7 +16,8 @@ in stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ intltool pkgconfig pythonPackages.wrapPython pythonPackages.cython ];
 
-  buildInputs = [ bluez gtk3 pythonPackages.python libnotify dconf gsettings_desktop_schemas ]
+  buildInputs = [ bluez gtk3 pythonPackages.python libnotify dconf
+                  gsettings_desktop_schemas hicolor_icon_theme ]
                 ++ pythonPath
                 ++ lib.optional withPulseAudio libpulseaudio;
 
diff --git a/pkgs/tools/misc/fluentd/default.nix b/pkgs/tools/misc/fluentd/default.nix
index 4c5de7448409..25e083b6bf57 100644
--- a/pkgs/tools/misc/fluentd/default.nix
+++ b/pkgs/tools/misc/fluentd/default.nix
@@ -1,12 +1,10 @@
 { stdenv, lib, bundlerEnv, ruby, curl }:
 
 bundlerEnv {
-  name = "fluentd-0.14.0";
-
   inherit ruby;
-  gemfile = ./Gemfile;
-  lockfile = ./Gemfile.lock;
-  gemset = ./gemset.nix;
+
+  pname = "fluentd";
+  gemdir = ./.;
 
   meta = with lib; {
     description = "A data collector";
diff --git a/pkgs/tools/misc/lolcat/default.nix b/pkgs/tools/misc/lolcat/default.nix
index 21355652d3e3..21377d7bfa4a 100644
--- a/pkgs/tools/misc/lolcat/default.nix
+++ b/pkgs/tools/misc/lolcat/default.nix
@@ -2,12 +2,10 @@
 , pkgconfig, which }:
 
 bundlerEnv {
-  name = "lolcat-42.1.0";
-
   inherit ruby;
-  gemfile = ./Gemfile;
-  lockfile = ./Gemfile.lock;
-  gemset = ./gemset.nix;
+
+  pname = "lolcat";
+  gemdir = ./.;
 
   meta = with lib; {
     description = "A rainbow version of cat";
diff --git a/pkgs/tools/misc/man-db/default.nix b/pkgs/tools/misc/man-db/default.nix
index b049e0706e9a..9c1dabc75844 100644
--- a/pkgs/tools/misc/man-db/default.nix
+++ b/pkgs/tools/misc/man-db/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, libpipeline, db, groff }:
+{ stdenv, fetchurl, pkgconfig, libpipeline, db, groff, makeWrapper }:
 
 stdenv.mkDerivation rec {
   name = "man-db-2.7.5";
@@ -11,9 +11,8 @@ stdenv.mkDerivation rec {
   outputs = [ "out" "doc" ];
   outputMan = "out"; # users will want `man man` to work
 
-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ pkgconfig makeWrapper ];
   buildInputs = [ libpipeline db groff ];
-  troff="${groff}/bin/groff";
 
   postPatch = ''
     substituteInPlace src/man_db.conf.in \
@@ -27,14 +26,14 @@ stdenv.mkDerivation rec {
     # Don't try /etc/man_db.conf by default, so we avoid error messages.
     "--with-config-file=\${out}/etc/man_db.conf"
     "--with-systemdtmpfilesdir=\${out}/lib/tmpfiles.d"
-    "--with-eqn=${groff}/bin/eqn"
-    "--with-neqn=${groff}/bin/neqn"
-    "--with-nroff=${groff}/bin/nroff"
-    "--with-pic=${groff}/bin/pic"
-    "--with-refer=${groff}/bin/refer"
-    "--with-tbl=${groff}/bin/tbl"
   ];
 
+  postInstall = ''
+    for i in "$out/bin/"*; do
+      wrapProgram "$i" --prefix PATH : "${groff}/bin"
+    done
+  '';
+
   enableParallelBuilding = true;
 
   doCheck = true;
diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index 958bea34e7d3..d1936cb11ad3 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -25,6 +25,8 @@ stdenv.mkDerivation rec {
     sha256 = "1v6q83qsrf7dgp3y5fa5vkppgqyy82pnsk8z9b4047b6fvclfwvv";
   };
 
+  patches = [ ./nix-ssl-cert-file.patch ];
+
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
 
   nativeBuildInputs = [ pkgconfig perl ];
diff --git a/pkgs/tools/networking/curl/nix-ssl-cert-file.patch b/pkgs/tools/networking/curl/nix-ssl-cert-file.patch
new file mode 100644
index 000000000000..20c408bfae23
--- /dev/null
+++ b/pkgs/tools/networking/curl/nix-ssl-cert-file.patch
@@ -0,0 +1,14 @@
+diff -ru -x '*~' curl-7.50.3-orig/src/tool_operate.c curl-7.50.3/src/tool_operate.c
+--- curl-7.50.3-orig/src/tool_operate.c	2016-09-06 23:25:06.000000000 +0200
++++ curl-7.50.3/src/tool_operate.c	2016-10-14 11:51:48.999943142 +0200
+@@ -269,7 +269,9 @@
+         capath_from_env = true;
+       }
+       else {
+-        env = curlx_getenv("SSL_CERT_FILE");
++        env = curlx_getenv("NIX_SSL_CERT_FILE");
++        if(!env)
++          env = curlx_getenv("SSL_CERT_FILE");
+         if(env) {
+           config->cacert = strdup(env);
+           if(!config->cacert) {
diff --git a/pkgs/tools/networking/fastd/default.nix b/pkgs/tools/networking/fastd/default.nix
new file mode 100644
index 000000000000..3a99adb4a9ef
--- /dev/null
+++ b/pkgs/tools/networking/fastd/default.nix
@@ -0,0 +1,26 @@
+{ stdenv, fetchgit, cmake, bison, pkgconfig
+, libuecc, libsodium, libcap, json_c }:
+
+stdenv.mkDerivation rec {
+  version = "18";
+  name = "fastd-${version}";
+
+  src = fetchgit {
+    url = "git://git.universe-factory.net/fastd";
+    rev = "refs/tags/v${version}";
+    sha256 = "0c9v3igv3812b3jr7jk75a2np658yy00b3i4kpbpdjgvqzc1jrq8";
+  };
+
+  nativeBuildInputs = [ pkgconfig bison cmake ];
+  buildInputs = [ libuecc libsodium libcap json_c ];
+
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
+    description = "Fast and Secure Tunneling Daemon";
+    homepage = https://projects.universe-factory.net/projects/fastd/wiki;
+    license = with licenses; [ bsd2 bsd3 ];
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ fpletz ];
+  };
+}
diff --git a/pkgs/tools/networking/sshpass/default.nix b/pkgs/tools/networking/sshpass/default.nix
index 95212b00beb1..f87cecaf4d27 100644
--- a/pkgs/tools/networking/sshpass/default.nix
+++ b/pkgs/tools/networking/sshpass/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "sshpass-${version}";
-  version = "1.05";
-  
+  version = "1.06";
+
   src = fetchurl {
     url = "mirror://sourceforge/sshpass/sshpass-${version}.tar.gz";
-    sha256 = "0gj8r05h1hy01vh4csygyw21z2hcxb72qcxkxxi3y34alr98gxy3";
+    sha256 = "0q7fblaczb7kwbsz0gdy9267z0sllzgmf0c7z5c9mf88wv74ycn6";
   };
-  
+
   meta = {
     homepage = http://sourceforge.net/projects/sshpass/;
     description = "Non-interactive ssh password auth";
diff --git a/pkgs/tools/package-management/fpm/default.nix b/pkgs/tools/package-management/fpm/default.nix
index ca2e44fcaf00..4a18bfb5345f 100644
--- a/pkgs/tools/package-management/fpm/default.nix
+++ b/pkgs/tools/package-management/fpm/default.nix
@@ -1,13 +1,9 @@
 { lib, bundlerEnv, ruby }:
 
 bundlerEnv rec {
-  name = "fpm-${version}";
-
-  version = (import gemset).fpm.version;
   inherit ruby;
-  gemfile = ./Gemfile;
-  lockfile = ./Gemfile.lock;
-  gemset = ./gemset.nix;
+  pname = "fpm";
+  gemdir = ./.;
 
   meta = with lib; {
     description = "Tool to build packages for multiple platforms with ease";
diff --git a/pkgs/tools/system/foreman/default.nix b/pkgs/tools/system/foreman/default.nix
index 594947c265a3..1c74724793d4 100644
--- a/pkgs/tools/system/foreman/default.nix
+++ b/pkgs/tools/system/foreman/default.nix
@@ -1,24 +1,9 @@
-{ stdenv, lib, ruby, bundlerEnv, makeWrapper }:
+{ bundlerEnv, lib, ruby }:
 
-stdenv.mkDerivation rec {
-  name = "foreman-${env.gems.foreman.version}";
-
-  env = bundlerEnv {
-    inherit ruby;
-    name = "${name}-gems";
-    gemfile = ./Gemfile;
-    lockfile = ./Gemfile.lock;
-    gemset = ./gemset.nix;
-  };
-
-  phases = ["installPhase"];
-
-  nativeBuildInputs = [ makeWrapper ];
-
-  installPhase = ''
-    mkdir -p $out/bin
-    makeWrapper ${env}/bin/foreman $out/bin/foreman
-  '';
+bundlerEnv {
+  inherit ruby;
+  pName = "foreman";
+  gemdir = ./.;
 
   meta = with lib; {
     description = "Process manager for applications with multiple components";
diff --git a/pkgs/tools/system/hiera-eyaml/default.nix b/pkgs/tools/system/hiera-eyaml/default.nix
index 615a66f86551..029a975dc913 100644
--- a/pkgs/tools/system/hiera-eyaml/default.nix
+++ b/pkgs/tools/system/hiera-eyaml/default.nix
@@ -1,22 +1,9 @@
-{ lib, bundlerEnv, stdenv }:
+{ lib, bundlerEnv, ruby }:
 
-let
-  name = "hiera-eyaml-${env.gems.hiera-eyaml.version}";
-
-  env = bundlerEnv {
-    inherit name;
-    gemfile = ./Gemfile;
-    lockfile = ./Gemfile.lock;
-    gemset = ./gemset.nix;
-  };
-
-in stdenv.mkDerivation {
-  inherit name;
-
-  buildCommand = ''
-    mkdir -p $out/bin
-    ln -s ${env}/bin/eyaml $out/bin/eyaml
-  '';
+bundlerEnv {
+  inherit ruby;
+  pName = "hiera-eyaml";
+  gemdir = ./.;
 
   meta = with lib; {
     description = "Per-value asymmetric encryption of sensitive data for Hiera";
diff --git a/pkgs/tools/text/shfmt/default.nix b/pkgs/tools/text/shfmt/default.nix
index aef12ed97439..cac9bbb168b8 100644
--- a/pkgs/tools/text/shfmt/default.nix
+++ b/pkgs/tools/text/shfmt/default.nix
@@ -2,8 +2,8 @@
 
 buildGoPackage rec {
   name = "shfmt-${version}";
-  version = "2016-06-16";
-  rev = "8add0072d6abdc892e4617c95e8bba21ebe0beeb";
+  version = "0.2.0";
+  rev = "v${version}";
 
   goPackagePath = "github.com/mvdan/sh";
 
@@ -11,7 +11,7 @@ buildGoPackage rec {
     owner = "mvdan";
     repo = "sh";
     inherit rev;
-    sha256 = "1m2lkcw6m5gdqjp17m01d822cj1p04qk6hm9m94ni2x19f16qs8m";
+    sha256 = "07jf9v6583vvmk07fp7xdlnh7rvgl6f06ib2588g3xf1wk9vrq3d";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/typesetting/asciidoctor/default.nix b/pkgs/tools/typesetting/asciidoctor/default.nix
index dd90444d6af6..495a5fcf8821 100644
--- a/pkgs/tools/typesetting/asciidoctor/default.nix
+++ b/pkgs/tools/typesetting/asciidoctor/default.nix
@@ -1,19 +1,9 @@
 { stdenv, lib, bundlerEnv, ruby_2_2, curl }:
 
 bundlerEnv rec {
-  name = "asciidoctor-${version}";
-  version = "1.5.4";
-
+  pname = "asciidoctor";
   ruby = ruby_2_2;
-  gemfile = ./Gemfile;
-  lockfile = ./Gemfile.lock;
-  gemset = ./gemset.nix;
-
-  # Delete dependencies' executables
-  postBuild = ''
-    find $out/bin -type f -not -wholename '*bin/asciidoctor*' -print0 \
-    | xargs -0 rm
-  '';
+  gemdir = ./.;
 
   meta = with lib; {
     description = "A faster Asciidoc processor written in Ruby";
diff --git a/pkgs/tools/typesetting/tex/nix/animatedot.sh b/pkgs/tools/typesetting/tex/nix/animatedot.sh
index 46a2c515e03a..f038b83ff7ad 100644
--- a/pkgs/tools/typesetting/tex/nix/animatedot.sh
+++ b/pkgs/tools/typesetting/tex/nix/animatedot.sh
@@ -4,6 +4,6 @@ mkdir -p $out
 
 for ((i = 1; i <= $nrFrames; i++)); do
     echo "producing frame $i...";
-    targetName=$out/$(basename $(stripHash $dotGraph; echo $strippedName) .dot)-f-$i.dot
+    targetName=$out/$(basename $(stripHash $dotGraph) .dot)-f-$i.dot
     cpp -DFRAME=$i < $dotGraph > $targetName
 done
diff --git a/pkgs/tools/typesetting/tex/nix/default.nix b/pkgs/tools/typesetting/tex/nix/default.nix
index ce5c025475a0..0566e5118705 100644
--- a/pkgs/tools/typesetting/tex/nix/default.nix
+++ b/pkgs/tools/typesetting/tex/nix/default.nix
@@ -185,7 +185,7 @@ rec {
         if test -d $postscript; then
           input=$(ls $postscript/*.ps)
         else
-          input=$(stripHash $postscript; echo $strippedName)
+          input=$(stripHash $postscript)
           ln -s $postscript $input
         fi
 
diff --git a/pkgs/tools/typesetting/tex/nix/dot2pdf.sh b/pkgs/tools/typesetting/tex/nix/dot2pdf.sh
index c416bf235a14..71cf601dfac0 100644
--- a/pkgs/tools/typesetting/tex/nix/dot2pdf.sh
+++ b/pkgs/tools/typesetting/tex/nix/dot2pdf.sh
@@ -4,7 +4,7 @@ mkdir -p $out
 
 dot2pdf() {
     sourceFile=$1
-    targetName=$out/$(basename $(stripHash $sourceFile; echo $strippedName) .dot).pdf
+    targetName=$out/$(basename $(stripHash $sourceFile) .dot).pdf
     echo "converting $sourceFile to $targetName..."
     export FONTCONFIG_FILE=$fontsConf
     dot -Tpdf $sourceFile > $targetName
diff --git a/pkgs/tools/typesetting/tex/nix/dot2ps.sh b/pkgs/tools/typesetting/tex/nix/dot2ps.sh
index c70e76ce4c73..dd8de4a23dbc 100644
--- a/pkgs/tools/typesetting/tex/nix/dot2ps.sh
+++ b/pkgs/tools/typesetting/tex/nix/dot2ps.sh
@@ -4,7 +4,7 @@ mkdir -p $out
 
 dot2ps() {
     sourceFile=$1
-    targetName=$out/$(basename $(stripHash $sourceFile; echo $strippedName) .dot).ps
+    targetName=$out/$(basename $(stripHash $sourceFile) .dot).ps
     echo "converting $sourceFile to $targetName..."
     dot -Tps $sourceFile > $targetName
 }
diff --git a/pkgs/tools/typesetting/tex/nix/lhs2tex.sh b/pkgs/tools/typesetting/tex/nix/lhs2tex.sh
index f34b3944c8ef..bfef3df6b0e1 100644
--- a/pkgs/tools/typesetting/tex/nix/lhs2tex.sh
+++ b/pkgs/tools/typesetting/tex/nix/lhs2tex.sh
@@ -10,7 +10,7 @@ cd $startDir
 
 lhstex() {
     sourceFile=$1
-    targetName=$out/$(basename $(stripHash $sourceFile; echo $strippedName) .lhs).tex
+    targetName=$out/$(basename $(stripHash $sourceFile) .lhs).tex
     echo "converting $sourceFile to $targetName..."
     lhs2TeX -o "$targetName" $flags "$sourceFile"
 }
diff --git a/pkgs/tools/typesetting/tex/nix/run-latex.sh b/pkgs/tools/typesetting/tex/nix/run-latex.sh
index fa27520d11cd..3941fdcac4a4 100644
--- a/pkgs/tools/typesetting/tex/nix/run-latex.sh
+++ b/pkgs/tools/typesetting/tex/nix/run-latex.sh
@@ -16,11 +16,11 @@ for i in $extraFiles; do
     if test -d $i; then
         ln -s $i/* .
     else
-        ln -s $i $(stripHash $i; echo $strippedName)
+        ln -s $i $(stripHash $i)
     fi
 done
 
-rootName=$(basename $(stripHash "$rootFile"; echo $strippedName))
+rootName=$(basename $(stripHash "$rootFile"))
 
 rootNameBase=$(echo "$rootName" | sed 's/\..*//')
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index dc4370e9eedc..9450ef9915e3 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1567,6 +1567,8 @@ in
       pillow;
   };
 
+  fastd = callPackage ../tools/networking/fastd { };
+
   fatsort = callPackage ../tools/filesystems/fatsort { };
 
   fcitx = callPackage ../tools/inputmethods/fcitx {
@@ -2305,7 +2307,7 @@ in
   less = callPackage ../tools/misc/less { };
 
   lf = callPackage ../tools/misc/lf {};
-  
+
   lhasa = callPackage ../tools/compression/lhasa {};
 
   libcpuid = callPackage ../tools/misc/libcpuid { };
@@ -2417,10 +2419,6 @@ in
     libtool = darwin.cctools;
   };
 
-  nodejs-5_x = callPackage ../development/web/nodejs/v5.nix {
-    libtool = darwin.cctools;
-  };
-
   nodejs-6_x = callPackage ../development/web/nodejs/v6.nix {
     libtool = darwin.cctools;
   };
@@ -2434,10 +2432,6 @@ in
     nodejs = pkgs.nodejs-6_x;
   };
 
-  nodePackages_5_x = callPackage ../development/node-packages/default-v5.nix {
-    nodejs = pkgs.nodejs-5_x;
-  };
-
   nodePackages_4_x = callPackage ../development/node-packages/default-v4.nix {
     nodejs = pkgs.nodejs-4_x;
   };
@@ -5287,7 +5281,10 @@ in
   erlangR16 = callPackage ../development/interpreters/erlang/R16.nix {
     inherit (darwin.apple_sdk.frameworks) Carbon Cocoa;
   };
-  erlangR16_odbc = callPackage ../development/interpreters/erlang/R16.nix { odbcSupport = true; };
+  erlangR16_odbc = callPackage ../development/interpreters/erlang/R16.nix {
+    inherit (darwin.apple_sdk.frameworks) Carbon Cocoa;
+    odbcSupport = true;
+  };
   erlangR17 = callPackage ../development/interpreters/erlang/R17.nix {
     inherit (darwin.apple_sdk.frameworks) Carbon Cocoa;
   };
@@ -6425,6 +6422,8 @@ in
 
   xc3sprog = callPackage ../development/tools/misc/xc3sprog { };
 
+  xcbuild  = callPackage ../development/tools/xcbuild { inherit (darwin.apple_sdk.frameworks) CoreServices CoreGraphics ImageIO; };
+
   xmlindent = callPackage ../development/web/xmlindent {};
 
   xpwn = callPackage ../development/mobile/xpwn {};
@@ -8174,6 +8173,8 @@ in
 
   libu2f-server = callPackage ../development/libraries/libu2f-server { };
 
+  libuecc = callPackage ../development/libraries/libuecc { };
+
   libui = callPackage ../development/libraries/libui { };
 
   libunity = callPackage ../development/libraries/libunity { };
@@ -11023,9 +11024,11 @@ in
   # Intentionally lacks recurseIntoAttrs, as -rc kernels will quite likely break out-of-tree modules and cause failed Hydra builds.
   linuxPackages_testing = linuxPackagesFor pkgs.linux_testing;
 
-  linuxPackages_custom = {version, src, configfile}:
-                           recurseIntoAttrs (linuxPackagesFor (pkgs.linuxManualConfig {inherit version src configfile;
-                                                                                               allowImportFromDerivation=true;}));
+  linuxPackages_custom = { version, src, configfile }:
+    recurseIntoAttrs (linuxPackagesFor (pkgs.linuxManualConfig {
+      inherit version src configfile;
+      allowImportFromDerivation = true;
+    }));
 
   # Build a kernel for Xen dom0
   linuxPackages_latest_xen_dom0 = recurseIntoAttrs (linuxPackagesFor (pkgs.linux_latest.override { features.xen_dom0=true; }));
@@ -11068,7 +11071,7 @@ in
 
   # A function to build a manually-configured kernel
   linuxManualConfig = pkgs.buildLinux;
-  buildLinux = callPackage ../os-specific/linux/kernel/manual-config.nix {};
+  buildLinux = makeOverridable (callPackage ../os-specific/linux/kernel/manual-config.nix {});
 
   keyutils = callPackage ../os-specific/linux/keyutils { };
 
@@ -15049,7 +15052,9 @@ in
     gtk = gtk2;
   };
 
-  kodiPlain = callPackage ../applications/video/kodi { };
+  kodiPlain = callPackage ../applications/video/kodi {
+    libva = libva-full;
+  };
   xbmcPlain = kodiPlain;
 
   kodiPlugins = recurseIntoAttrs (callPackage ../applications/video/kodi/plugins.nix {
diff --git a/pkgs/top-level/php-packages.nix b/pkgs/top-level/php-packages.nix
index 9bebfa3d9158..74d4e1707a11 100644
--- a/pkgs/top-level/php-packages.nix
+++ b/pkgs/top-level/php-packages.nix
@@ -23,20 +23,11 @@ let
     sha256 = "0r5pfbjbmdj46h20jm3iqmy969qd27ajyf0phjhgykv6j0cqjlgd";
   };
 
-  imagick = if isPhp7 then imagick34 else imagick31;
-
-  imagick31 = assert !isPhp7; buildPecl {
-    name = "imagick-3.1.2";
-    sha256 = "14vclf2pqcgf3w8nzqbdw0b9v30q898344c84jdbw2sa62n6k1sj";
-    configureFlags = "--with-imagick=${pkgs.imagemagick.dev}";
-    buildInputs = [ pkgs.pkgconfig ];
-  };
-
-  imagick34 = buildPecl {
-    name = "imagick-3.4.0RC4";
-    sha256 = "0fdkzdv3r8sm6y1x11kp3rxsimq6zf15xvi0mhn57svmnan4zh0i";
+  imagick = buildPecl {
+    name = "imagick-3.4.3RC1";
+    sha256 = "0siyxpszjz6s095s2g2854bhprjq49rf22v6syjiwvndg1pc9fsh";
     configureFlags = "--with-imagick=${pkgs.imagemagick.dev}";
-    buildInputs = [ pkgs.pkgconfig ];
+    nativeBuildInputs = [ pkgs.pkgconfig ];
   };
 
   # No support for PHP 7 yet
diff --git a/pkgs/top-level/release.nix b/pkgs/top-level/release.nix
index 00ba343e685f..d3fb4e646c3b 100644
--- a/pkgs/top-level/release.nix
+++ b/pkgs/top-level/release.nix
@@ -21,57 +21,52 @@ with import ./release-lib.nix { inherit supportedSystems scrubJobs; };
 
 let
 
-  unstable = pkgs.releaseTools.aggregate
-    { name = "nixpkgs-${jobs.tarball.version}";
-      meta.description = "Release-critical builds for the Nixpkgs unstable channel";
-      constituents =
-        [ jobs.tarball
-          jobs.metrics
-          jobs.manual
-          jobs.lib-tests
-          jobs.stdenv.x86_64-linux
-          jobs.stdenv.i686-linux
-          jobs.stdenv.x86_64-darwin
-          jobs.linux.x86_64-linux
-          jobs.linux.i686-linux
-          jobs.python.x86_64-linux
-          jobs.python.i686-linux
-          jobs.python.x86_64-darwin
-          jobs.python3.x86_64-linux
-          jobs.python3.i686-linux
-          jobs.python3.x86_64-darwin
-          # Many developers use nix-repl
-          jobs.nix-repl.x86_64-linux
-          jobs.nix-repl.i686-linux
-          jobs.nix-repl.x86_64-darwin
-          # Needed by travis-ci to test PRs
-          jobs.nox.i686-linux
-          jobs.nox.x86_64-linux
-          jobs.nox.x86_64-darwin
-          # Ensure that X11/GTK+ are in order.
-          jobs.thunderbird.x86_64-linux
-          jobs.thunderbird.i686-linux
-          # Ensure that basic stuff works on darwin
-          jobs.git.x86_64-darwin
-          jobs.mysql.x86_64-darwin
-          jobs.vim.x86_64-darwin
-        ] ++ lib.collect lib.isDerivation jobs.stdenvBootstrapTools;
-    };
-
   lib = pkgs.lib;
 
   jobs =
-    rec { tarball = import ./make-tarball.nix { inherit pkgs nixpkgs officialRelease; };
+    { tarball = import ./make-tarball.nix { inherit pkgs nixpkgs officialRelease; };
 
       metrics = import ./metrics.nix { inherit pkgs nixpkgs; };
 
       manual = import ../../doc;
       lib-tests = import ../../lib/tests/release.nix { inherit nixpkgs; };
 
-      # for consistency with NixOS tested job
-      tested = unstable;
-      inherit unstable;
-
+      unstable = pkgs.releaseTools.aggregate
+        { name = "nixpkgs-${jobs.tarball.version}";
+          meta.description = "Release-critical builds for the Nixpkgs unstable channel";
+          constituents =
+            [ jobs.tarball
+              jobs.metrics
+              jobs.manual
+              jobs.lib-tests
+              jobs.stdenv.x86_64-linux
+              jobs.stdenv.i686-linux
+              jobs.stdenv.x86_64-darwin
+              jobs.linux.x86_64-linux
+              jobs.linux.i686-linux
+              jobs.python.x86_64-linux
+              jobs.python.i686-linux
+              jobs.python.x86_64-darwin
+              jobs.python3.x86_64-linux
+              jobs.python3.i686-linux
+              jobs.python3.x86_64-darwin
+              # Many developers use nix-repl
+              jobs.nix-repl.x86_64-linux
+              jobs.nix-repl.i686-linux
+              jobs.nix-repl.x86_64-darwin
+              # Needed by travis-ci to test PRs
+              jobs.nox.i686-linux
+              jobs.nox.x86_64-linux
+              jobs.nox.x86_64-darwin
+              # Ensure that X11/GTK+ are in order.
+              jobs.thunderbird.x86_64-linux
+              jobs.thunderbird.i686-linux
+              # Ensure that basic stuff works on darwin
+              jobs.git.x86_64-darwin
+              jobs.mysql.x86_64-darwin
+              jobs.vim.x86_64-darwin
+            ] ++ lib.collect lib.isDerivation jobs.stdenvBootstrapTools;
+        };
 
       stdenvBootstrapTools.i686-linux =
         { inherit (import ../stdenv/linux/make-bootstrap-tools.nix { system = "i686-linux"; }) dist test; };