summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--lib/maintainers.nix1
-rw-r--r--nixos/modules/services/misc/plex.nix2
-rw-r--r--nixos/modules/services/web-servers/apache-httpd/default.nix12
-rw-r--r--nixos/modules/services/web-servers/lighttpd/inginious.nix3
-rw-r--r--nixos/modules/services/web-servers/nginx/default.nix15
-rw-r--r--nixos/modules/virtualisation/docker.nix93
-rw-r--r--nixos/tests/docker-registry.nix2
-rw-r--r--pkgs/applications/editors/rstudio/default.nix23
-rw-r--r--pkgs/applications/graphics/shotwell/default.nix8
-rw-r--r--pkgs/applications/misc/mediainfo-gui/default.nix4
-rw-r--r--pkgs/applications/misc/mediainfo/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/helm/default.nix6
-rw-r--r--pkgs/applications/science/biology/freebayes/builder.sh11
-rw-r--r--pkgs/applications/science/biology/freebayes/default.nix27
-rw-r--r--pkgs/applications/science/biology/igv/default.nix4
-rw-r--r--pkgs/applications/science/logic/coq/8.4.nix (renamed from pkgs/applications/science/logic/coq/default.nix)0
-rw-r--r--pkgs/applications/window-managers/bspwm/default.nix4
-rw-r--r--pkgs/desktops/gnome-3/3.22/misc/gexiv2/default.nix4
-rw-r--r--pkgs/development/compilers/ghc/8.0.2.nix14
-rw-r--r--pkgs/development/compilers/haxe/default.nix8
-rw-r--r--pkgs/development/compilers/haxe/haxelib-nix.patch34
-rw-r--r--pkgs/development/coq-modules/mathcomp/default.nix45
-rw-r--r--pkgs/development/coq-modules/mathcomp/generic.nix5
-rw-r--r--pkgs/development/coq-modules/ssreflect/default.nix14
-rw-r--r--pkgs/development/coq-modules/ssreflect/generic.nix5
-rw-r--r--pkgs/development/interpreters/maude/default.nix33
-rw-r--r--pkgs/development/libraries/aws-sdk-cpp/default.nix14
-rw-r--r--pkgs/development/libraries/aws-sdk-cpp/s3-encryption-headers.patch18
-rw-r--r--pkgs/development/libraries/kde-frameworks/default.nix2
-rw-r--r--pkgs/development/libraries/kde-frameworks/kde-wrapper.nix51
-rw-r--r--pkgs/development/libraries/libgcrypt/default.nix4
-rw-r--r--pkgs/development/libraries/libmediainfo/default.nix4
-rw-r--r--pkgs/development/libraries/libssh2/default.nix4
-rw-r--r--pkgs/development/libraries/libzen/default.nix4
-rw-r--r--pkgs/development/libraries/science/biology/htslib/default.nix4
-rw-r--r--pkgs/development/libraries/tecla/default.nix6
-rw-r--r--pkgs/development/tools/pypi2nix/default.nix17
-rw-r--r--pkgs/games/gnuchess/default.nix2
-rw-r--r--pkgs/games/xboard/default.nix2
-rw-r--r--pkgs/misc/emulators/wine/sources.nix8
-rw-r--r--pkgs/os-specific/linux/nvidia-x11/default.nix6
-rw-r--r--pkgs/servers/bird/default.nix4
-rw-r--r--pkgs/servers/http/apache-modules/mod_perl/default.nix25
-rw-r--r--pkgs/servers/monitoring/grafana/default.nix8
-rw-r--r--pkgs/servers/plex/default.nix6
-rw-r--r--pkgs/tools/admin/salt/fix-libcrypto-loading.patch6
-rw-r--r--pkgs/tools/misc/parallel/default.nix4
-rw-r--r--pkgs/tools/security/gnupg/21.nix4
-rw-r--r--pkgs/tools/security/sudo/default.nix4
-rw-r--r--pkgs/top-level/all-packages.nix83
-rw-r--r--pkgs/top-level/python-packages.nix4
51 files changed, 398 insertions, 277 deletions
diff --git a/lib/maintainers.nix b/lib/maintainers.nix
index f88cd1212fb0..7ed8ae953bc0 100644
--- a/lib/maintainers.nix
+++ b/lib/maintainers.nix
@@ -206,6 +206,7 @@
   jb55 = "William Casarin <bill@casarin.me>";
   jbedo = "Justin Bedő <cu@cua0.org>";
   jcumming = "Jack Cummings <jack@mudshark.org>";
+  jdagilliland = "Jason Gilliland <jdagilliland@gmail.com>";
   jefdaj = "Jeffrey David Johnson <jefdaj@gmail.com>";
   jerith666 = "Matt McHenry <github@matt.mchenryfamily.org>";
   jfb = "James Felix Black <james@yamtime.com>";
diff --git a/nixos/modules/services/misc/plex.nix b/nixos/modules/services/misc/plex.nix
index 92b352db416c..48d3c05785ce 100644
--- a/nixos/modules/services/misc/plex.nix
+++ b/nixos/modules/services/misc/plex.nix
@@ -127,7 +127,7 @@ in
         User = cfg.user;
         Group = cfg.group;
         PermissionsStartOnly = "true";
-        ExecStart = "/bin/sh -c '${cfg.package}/usr/lib/plexmediaserver/Plex\\ Media\\ Server'";
+        ExecStart = "/bin/sh -c ${cfg.package}/usr/lib/plexmediaserver/Plex\\ Media\\ Server";
         Restart = "on-failure";
       };
       environment = {
diff --git a/nixos/modules/services/web-servers/apache-httpd/default.nix b/nixos/modules/services/web-servers/apache-httpd/default.nix
index 2d71bcc0c79a..84c608ca2ab1 100644
--- a/nixos/modules/services/web-servers/apache-httpd/default.nix
+++ b/nixos/modules/services/web-servers/apache-httpd/default.nix
@@ -16,6 +16,8 @@ let
 
   phpMajorVersion = head (splitString "." php.version);
 
+  mod_perl = pkgs.mod_perl.override { apacheHttpd = httpd; };
+
   defaultListen = cfg: if cfg.enableSSL
     then [{ip = "*"; port = 443;}]
     else [{ip = "*"; port = 80;}];
@@ -76,6 +78,7 @@ let
           robotsEntries = "";
           startupScript = "";
           enablePHP = false;
+          enablePerl = false;
           phpOptions = "";
           options = {};
           documentRoot = null;
@@ -355,6 +358,7 @@ let
           ++ map (name: {inherit name; path = "${httpd}/modules/mod_${name}.so";}) apacheModules
           ++ optional mainCfg.enableMellon { name = "auth_mellon"; path = "${pkgs.apacheHttpdPackages.mod_auth_mellon}/modules/mod_auth_mellon.so"; }
           ++ optional enablePHP { name = "php${phpMajorVersion}"; path = "${php}/modules/libphp${phpMajorVersion}.so"; }
+          ++ optional enablePerl { name = "perl"; path = "${mod_perl}/modules/mod_perl.so"; }
           ++ concatMap (svc: svc.extraModules) allSubservices
           ++ extraForeignModules;
       in concatMapStrings load allModules
@@ -415,6 +419,8 @@ let
 
   enablePHP = mainCfg.enablePHP || any (svc: svc.enablePHP) allSubservices;
 
+  enablePerl = mainCfg.enablePerl || any (svc: svc.enablePerl) allSubservices;
+
 
   # Generate the PHP configuration file.  Should probably be factored
   # out into a separate module.
@@ -579,6 +585,12 @@ in
         '';
       };
 
+      enablePerl = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Whether to enable the Perl module (mod_perl).";
+      };
+
       phpOptions = mkOption {
         type = types.lines;
         default = "";
diff --git a/nixos/modules/services/web-servers/lighttpd/inginious.nix b/nixos/modules/services/web-servers/lighttpd/inginious.nix
index 43deccb6aef8..669e81d0f14b 100644
--- a/nixos/modules/services/web-servers/lighttpd/inginious.nix
+++ b/nixos/modules/services/web-servers/lighttpd/inginious.nix
@@ -191,9 +191,8 @@ in
         virtualisation.docker = {
           enable = true;
           # We need docker to listen on port 2375.
-          extraOptions = "-H tcp://127.0.0.1:2375 -H unix:///var/run/docker.sock";
+          listenOptions = ["127.0.0.1:2375" "/var/run/docker.sock"];
           storageDriver = mkDefault "overlay";
-          socketActivation = false;
         };
 
         users.extraUsers."lighttpd".extraGroups = [ "docker" ];
diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix
index 698d37133d74..68a672c42c90 100644
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@@ -10,6 +10,7 @@ let
       sslCertificateKey = "/var/lib/acme/${vhostName}/key.pem";
     })
   ) cfg.virtualHosts;
+  enableIPv6 = config.networking.enableIPv6;
 
   configFile = pkgs.writeText "nginx.conf" ''
     user ${cfg.user} ${cfg.group};
@@ -84,7 +85,7 @@ let
       ${optionalString cfg.statusPage ''
         server {
           listen 80;
-          listen [::]:80;
+          ${optionalString enableIPv6 "listen [::]:80;" }
 
           server_name localhost;
 
@@ -92,7 +93,7 @@ let
             stub_status on;
             access_log off;
             allow 127.0.0.1;
-            allow ::1;
+            ${optionalString enableIPv6 "allow ::1;"}
             deny all;
           }
         }
@@ -116,7 +117,7 @@ let
         ssl = vhost.enableSSL || vhost.forceSSL;
         port = if vhost.port != null then vhost.port else (if ssl then 443 else 80);
         listenString = toString port + optionalString ssl " ssl http2"
-          + optionalString vhost.default " default";
+          + optionalString vhost.default " default_server";
         acmeLocation = optionalString vhost.enableACME (''
           location /.well-known/acme-challenge {
             ${optionalString (vhost.acmeFallbackHost != null) "try_files $uri @acme-fallback;"}
@@ -132,8 +133,10 @@ let
       in ''
         ${optionalString vhost.forceSSL ''
           server {
-            listen 80 ${optionalString vhost.default "default"};
-            listen [::]:80 ${optionalString vhost.default "default"};
+            listen 80 ${optionalString vhost.default "default_server"};
+            ${optionalString enableIPv6
+              ''listen [::]:80 ${optionalString vhost.default "default_server"};''
+            }
 
             server_name ${serverName} ${concatStringsSep " " vhost.serverAliases};
             ${acmeLocation}
@@ -145,7 +148,7 @@ let
 
         server {
           listen ${listenString};
-          listen [::]:${listenString};
+          ${optionalString enableIPv6 "listen [::]:${listenString};"}
 
           server_name ${serverName} ${concatStringsSep " " vhost.serverAliases};
           ${acmeLocation}
diff --git a/nixos/modules/virtualisation/docker.nix b/nixos/modules/virtualisation/docker.nix
index 92fe98f3f9c2..8902799936cb 100644
--- a/nixos/modules/virtualisation/docker.nix
+++ b/nixos/modules/virtualisation/docker.nix
@@ -28,16 +28,42 @@ in
             <command>docker</command> command line tool.
           '';
       };
-    socketActivation =
+
+    listenOptions =
+      mkOption {
+        type = types.listOf types.str;
+        default = ["/var/run/docker.sock"];
+        description =
+          ''
+            A list of unix and tcp docker should listen to. The format follows
+            ListenStream as described in systemd.socket(5).
+          '';
+      };
+
+    enableOnBoot =
       mkOption {
         type = types.bool;
         default = true;
         description =
           ''
-            This option enables docker with socket activation. I.e. docker will
-            start when first called by client.
+            When enabled dockerd is started on boot. This is required for
+            container, which are created with the
+            <literal>--restart=always</literal> flag, to work. If this option is
+            disabled, docker might be started on demand by socket activation.
           '';
       };
+
+    liveRestore =
+      mkOption {
+        type = types.bool;
+        default = true;
+        description =
+          ''
+            Allow dockerd to be restarted without affecting running container.
+            This option is incompatible with docker swarm.
+          '';
+      };
+
     storageDriver =
       mkOption {
         type = types.nullOr (types.enum ["aufs" "btrfs" "devicemapper" "overlay" "overlay2" "zfs"]);
@@ -69,24 +95,6 @@ in
             <command>docker</command> daemon.
           '';
       };
-
-    postStart =
-      mkOption {
-        type = types.lines;
-        default = ''
-          while ! [ -e /var/run/docker.sock ]; do
-            sleep 0.1
-          done
-        '';
-        description = ''
-          The postStart phase of the systemd service. You may need to
-          override this if you are passing in flags to docker which
-          don't cause the socket file to be created. This option is ignored
-          if socket activation is used.
-        '';
-      };
-
-
   };
 
   ###### implementation
@@ -94,44 +102,53 @@ in
   config = mkIf cfg.enable (mkMerge [
     { environment.systemPackages = [ pkgs.docker ];
       users.extraGroups.docker.gid = config.ids.gids.docker;
+      # this unit follows the one provided by upstream see: https://github.com/docker/docker/blob/master/contrib/init/systemd/docker.service
+      # comments below reflect experience from upstream.
       systemd.services.docker = {
         description = "Docker Application Container Engine";
-        wantedBy = optional (!cfg.socketActivation) "multi-user.target";
-        after = [ "network.target" ] ++ (optional cfg.socketActivation "docker.socket") ;
-        requires = optional cfg.socketActivation "docker.socket";
+        wantedBy = optional cfg.enableOnBoot "multi-user.target";
+        after = [ "network.target" "docker.socket" ];
+        requires = ["docker.socket"];
         serviceConfig = {
+          # the default is not to use systemd for cgroups because the delegate issues still
+          # exists and systemd currently does not support the cgroup feature set required
+          # for containers run by docker
           ExecStart = ''${pkgs.docker}/bin/dockerd \
-            --group=docker --log-driver=${cfg.logDriver} \
+            --group=docker \
+            --host=fd:// \
+            --log-driver=${cfg.logDriver} \
             ${optionalString (cfg.storageDriver != null) "--storage-driver=${cfg.storageDriver}"} \
-            ${optionalString cfg.socketActivation "--host=fd://"} \
+            ${optionalString cfg.liveRestore "--live-restore" } \
             ${cfg.extraOptions}
           '';
-          #  I'm not sure if that limits aren't too high, but it's what
-          #  goes in config bundled with docker itself
+          Type="notify";
+          ExecReload="${pkgs.procps}/bin/kill -s HUP $MAINPID";
           LimitNOFILE = 1048576;
-          LimitNPROC = 1048576;
+          # Having non-zero Limit*s causes performance problems due to accounting overhead
+          # in the kernel. We recommend using cgroups to do container-local accounting.
+          LimitNPROC="infinity";
+          LimitCORE="infinity";
+          TasksMax="infinity";
+          TimeoutStartSec=0;
+          # set delegate yes so that systemd does not reset the cgroups of docker containers
+          Delegate="yes";
+          # kill only the docker process, not all processes in the cgroup
+          KillMode="process";
         } // proxy_env;
 
         path = [ pkgs.kmod ] ++ (optional (cfg.storageDriver == "zfs") pkgs.zfs);
-
-        postStart = if cfg.socketActivation then "" else cfg.postStart;
-
-        # Presumably some containers are running we don't want to interrupt
-        restartIfChanged = false;
       };
-    }
-    (mkIf cfg.socketActivation {
       systemd.sockets.docker = {
         description = "Docker Socket for the API";
         wantedBy = [ "sockets.target" ];
         socketConfig = {
-          ListenStream = "/var/run/docker.sock";
+          ListenStream = cfg.listenOptions;
           SocketMode = "0660";
           SocketUser = "root";
           SocketGroup = "docker";
         };
       };
-    })
+    }
   ]);
 
 }
diff --git a/nixos/tests/docker-registry.nix b/nixos/tests/docker-registry.nix
index df24686aba8e..109fca440e57 100644
--- a/nixos/tests/docker-registry.nix
+++ b/nixos/tests/docker-registry.nix
@@ -16,13 +16,11 @@ import ./make-test.nix ({ pkgs, ...} : {
 
     client1 = { config, pkgs, ...}: {
       virtualisation.docker.enable = true;
-      virtualisation.docker.socketActivation = false;
       virtualisation.docker.extraOptions = "--insecure-registry registry:8080";
     };
 
     client2 = { config, pkgs, ...}: {
       virtualisation.docker.enable = true;
-      virtualisation.docker.socketActivation = false;
       virtualisation.docker.extraOptions = "--insecure-registry registry:8080";
     };
   };
diff --git a/pkgs/applications/editors/rstudio/default.nix b/pkgs/applications/editors/rstudio/default.nix
index 0749f58ecea2..82bcc485da3c 100644
--- a/pkgs/applications/editors/rstudio/default.nix
+++ b/pkgs/applications/editors/rstudio/default.nix
@@ -1,11 +1,11 @@
-{ stdenv, fetchurl, cmake, boost155, zlib, openssl, R, qt4, libuuid, hunspellDicts, unzip, ant, jdk, gnumake, makeWrapper }:
+{ stdenv, fetchurl, makeDesktopItem, cmake, boost155, zlib, openssl, R, qt4, libuuid, hunspellDicts, unzip, ant, jdk, gnumake, makeWrapper }:
 
 let
   version = "0.98.110";
   ginVer = "1.5";
   gwtVer = "2.5.1";
 in
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   name = "RStudio-${version}";
 
   buildInputs = [ cmake boost155 zlib openssl R qt4 libuuid unzip ant jdk makeWrapper ];
@@ -31,7 +31,7 @@ stdenv.mkDerivation {
     sha256 = "0fjr2rcr8lnywj54mzhg9i4xz1b6fh8yv12p5i2q5mgfld2xymy4";
   };
 
-  hunspellDicts = builtins.attrValues hunspellDicts;
+  hunspellDictionaries = builtins.attrValues hunspellDicts;
 
   mathJaxSrc = fetchurl {
     url = https://s3.amazonaws.com/rstudio-buildtools/mathjax-20.zip;
@@ -50,7 +50,7 @@ stdenv.mkDerivation {
       mv gwt-$gwtVer $GWT_LIB_DIR/gwt/$gwtVer
 
       mkdir dependencies/common/dictionaries
-      for dict in $hunspellDicts; do
+      for dict in $hunspellDictionaries; do
           for i in "$dict/share/hunspell/"*
 	  do ln -sv $i dependencies/common/dictionaries/
 	  done
@@ -61,8 +61,23 @@ stdenv.mkDerivation {
 
   cmakeFlags = [ "-DRSTUDIO_TARGET=Desktop" ];
 
+  desktopItem = makeDesktopItem {
+    name = name;
+    exec = "rstudio %F";
+    icon = "rstudio";
+    desktopName = "RStudio";
+    genericName = "IDE";
+    comment = meta.description;
+    categories = "Development;";
+    mimeType = "text/x-r-source;text/x-r;text/x-R;text/x-r-doc;text/x-r-sweave;text/x-r-markdown;text/x-r-html;text/x-r-presentation;application/x-r-data;application/x-r-project;text/x-r-history;text/x-r-profile;text/x-tex;text/x-markdown;text/html;text/css;text/javascript;text/x-chdr;text/x-csrc;text/x-c++hdr;text/x-c++src;";
+  };
+
   postInstall = ''
       wrapProgram $out/bin/rstudio --suffix PATH : ${gnumake}/bin
+      mkdir $out/share
+      cp -r ${desktopItem}/share/applications $out/share
+      mkdir $out/share/icons
+      ln $out/rstudio.png $out/share/icons
   '';
 
   meta = with stdenv.lib;
diff --git a/pkgs/applications/graphics/shotwell/default.nix b/pkgs/applications/graphics/shotwell/default.nix
index 3f9fd132c09e..ca74cd1a4aa3 100644
--- a/pkgs/applications/graphics/shotwell/default.nix
+++ b/pkgs/applications/graphics/shotwell/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   version = "${major}.${minor}";
-  major = "0.23";
-  minor = "5";
+  major = "0.25";
+  minor = "2";
   name = "shotwell-${version}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/shotwell/${major}/${name}.tar.xz";
-    sha256 = "0fgs1rgvkmy79bmpxrsvm5w8rvqml4l1vnwma0xqx5zzm02p8a07";
+    sha256 = "1bih5hr3pvpkx3fck55bnhngn4fl92ryjizc34wb8pwigbkxnaj1";
   };
 
   NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/glib-2.0 -I${glib.out}/lib/glib-2.0/include";
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
                   pkgconfig gst_all_1.gstreamer gst_all_1.gst-plugins-base gnome3.libgee
                   which udev libgudev gnome3.gexiv2 hicolor_icon_theme
                   libraw json_glib gettext desktop_file_utils glib lcms2 gdk_pixbuf librsvg
-                  wrapGAppsHook gnome_doc_utils gnome3.rest
+                  wrapGAppsHook gnome_doc_utils gnome3.rest gnome3.gcr
                   gnome3.defaultIconTheme itstool ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/applications/misc/mediainfo-gui/default.nix b/pkgs/applications/misc/mediainfo-gui/default.nix
index 2fe806649c24..e60d1619685a 100644
--- a/pkgs/applications/misc/mediainfo-gui/default.nix
+++ b/pkgs/applications/misc/mediainfo-gui/default.nix
@@ -2,11 +2,11 @@
 , desktop_file_utils, libSM, imagemagick }:
 
 stdenv.mkDerivation rec {
-  version = "0.7.87";
+  version = "0.7.91";
   name = "mediainfo-gui-${version}";
   src = fetchurl {
     url = "http://mediaarea.net/download/source/mediainfo/${version}/mediainfo_${version}.tar.xz";
-    sha256 = "1ws4hyfcw289hax0bq8y3bbw5y321xmh0va1x4zv5rjwfzcd51pv";
+    sha256 = "15jrph9hjza4c87m739s7c9v27gji94ha7rpchb8li0rcdvy40dm";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
diff --git a/pkgs/applications/misc/mediainfo/default.nix b/pkgs/applications/misc/mediainfo/default.nix
index 77c1badbf401..0ddee228e9d0 100644
--- a/pkgs/applications/misc/mediainfo/default.nix
+++ b/pkgs/applications/misc/mediainfo/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, autoreconfHook, pkgconfig, libzen, libmediainfo, zlib }:
 
 stdenv.mkDerivation rec {
-  version = "0.7.87";
+  version = "0.7.91";
   name = "mediainfo-${version}";
   src = fetchurl {
     url = "http://mediaarea.net/download/source/mediainfo/${version}/mediainfo_${version}.tar.xz";
-    sha256 = "1ws4hyfcw289hax0bq8y3bbw5y321xmh0va1x4zv5rjwfzcd51pv";
+    sha256 = "15jrph9hjza4c87m739s7c9v27gji94ha7rpchb8li0rcdvy40dm";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
diff --git a/pkgs/applications/networking/cluster/helm/default.nix b/pkgs/applications/networking/cluster/helm/default.nix
index 58ac31ce49f5..a258a8024770 100644
--- a/pkgs/applications/networking/cluster/helm/default.nix
+++ b/pkgs/applications/networking/cluster/helm/default.nix
@@ -4,12 +4,12 @@ let
          then "linux-amd64"
          else "darwin-amd64";
   checksum = if stdenv.isLinux
-             then "dad3791fb07e6cf34f4cf611728cb8ae109a75234498a888529a68ac6923f200"
-             else "d27bd7e40e12c0a5f08782a8a883166008565b28e0b82126d2089300ff3f8465";
+             then "1797ab74720f122432eace591fb415e5e5f5db97f4b6608ca8dbe59bae988374"
+             else "2b522dcfe27e987138f7826c79fb26a187075dd9be5c5a4c76fd6846bf109014";
 in
 stdenv.mkDerivation rec {
   pname = "helm";
-  version = "2.0.2";
+  version = "2.1.2";
   name = "${pname}-${version}";
 
   src = fetchurl {
diff --git a/pkgs/applications/science/biology/freebayes/builder.sh b/pkgs/applications/science/biology/freebayes/builder.sh
new file mode 100644
index 000000000000..a9f56e77d7e3
--- /dev/null
+++ b/pkgs/applications/science/biology/freebayes/builder.sh
@@ -0,0 +1,11 @@
+source $stdenv/setup
+
+unpackPhase
+
+cd freebayes-*
+
+make
+
+mkdir -p $out/bin
+cp bin/freebayes bin/bamleftalign $out/bin
+cp scripts/* $out/bin
diff --git a/pkgs/applications/science/biology/freebayes/default.nix b/pkgs/applications/science/biology/freebayes/default.nix
new file mode 100644
index 000000000000..ef0da619b25a
--- /dev/null
+++ b/pkgs/applications/science/biology/freebayes/default.nix
@@ -0,0 +1,27 @@
+{ stdenv, fetchFromGitHub, cmake, gcc, zlib}:
+
+stdenv.mkDerivation rec {
+  name    = "freebayes-${version}";
+  version = "1.1.0";
+
+  src = fetchFromGitHub {
+    name = "freebayes-${version}-src";
+    owner  = "ekg";
+    repo   = "freebayes";
+    rev    = "refs/tags/v${version}";
+    sha256 = "0xb8aicb36w9mfs1gq1x7mcp3p82kl7i61d162hfncqzg2npg8rr";
+    fetchSubmodules = true;
+  };
+
+  buildInputs = [ cmake gcc zlib ];
+
+  builder = ./builder.sh;
+
+  meta = with stdenv.lib; {
+    description = "Bayesian haplotype-based polymorphism discovery and genotyping";
+    license     = licenses.mit;
+    homepage    = https://github.com/ekg/freebayes;
+    maintainers = with maintainers; [ jdagilliland ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/applications/science/biology/igv/default.nix b/pkgs/applications/science/biology/igv/default.nix
index 3d0f7154e0e0..3acf7d965279 100644
--- a/pkgs/applications/science/biology/igv/default.nix
+++ b/pkgs/applications/science/biology/igv/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "igv-${version}";
-  version = "2.3.77";
+  version = "2.3.89";
 
   src = fetchurl {
     url = "http://data.broadinstitute.org/igv/projects/downloads/IGV_${version}.zip";
-    sha256 = "9d8c622649f9f02026e92fa44006bb57e897baad4359c8708ca9cdbb71f94bb5";
+    sha256 = "06bmj9jsnk5010ipv0w4qlcvgw67dy8hsvgcx9l74v3s0zp5di3y";
   };
 
   buildInputs = [ unzip jre ];
diff --git a/pkgs/applications/science/logic/coq/default.nix b/pkgs/applications/science/logic/coq/8.4.nix
index f162fe4a86ea..f162fe4a86ea 100644
--- a/pkgs/applications/science/logic/coq/default.nix
+++ b/pkgs/applications/science/logic/coq/8.4.nix
diff --git a/pkgs/applications/window-managers/bspwm/default.nix b/pkgs/applications/window-managers/bspwm/default.nix
index 641716ab2fc0..8798d2b38329 100644
--- a/pkgs/applications/window-managers/bspwm/default.nix
+++ b/pkgs/applications/window-managers/bspwm/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   name = "bspwm-${version}";
-  version = "0.9.1";
+  version = "0.9.2";
 
 
   src = fetchurl {
     url = "https://github.com/baskerville/bspwm/archive/${version}.tar.gz";
-    sha256 = "11dvfcvr8bc116yb3pvl0k1h2gfm9rv652jbxd1c5pmc0yimifq2";
+    sha256 = "1w6wxwgyb14w664xafp3b2ps6zzf9yw7cfhbh9229x2hil9rss1k";
   };
 
   buildInputs = [ libxcb libXinerama xcbutil xcbutilkeysyms xcbutilwm ];
diff --git a/pkgs/desktops/gnome-3/3.22/misc/gexiv2/default.nix b/pkgs/desktops/gnome-3/3.22/misc/gexiv2/default.nix
index 7cea9cd8d150..d27e10f104c3 100644
--- a/pkgs/desktops/gnome-3/3.22/misc/gexiv2/default.nix
+++ b/pkgs/desktops/gnome-3/3.22/misc/gexiv2/default.nix
@@ -5,11 +5,11 @@ let
 in
 stdenv.mkDerivation rec {
   name = "gexiv2-${version}";
-  version = "${majorVersion}.3";
+  version = "${majorVersion}.4";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gexiv2/${majorVersion}/${name}.tar.xz";
-    sha256 = "390cfb966197fa9f3f32200bc578d7c7f3560358c235e6419657206a362d3988";
+    sha256 = "190www3b61spfgwx42jw8h5hsz2996jcxky48k63468avjpk33dd";
   };
 
   preConfigure = ''
diff --git a/pkgs/development/compilers/ghc/8.0.2.nix b/pkgs/development/compilers/ghc/8.0.2.nix
index 9b8645fc1dbd..977a0fb39b6f 100644
--- a/pkgs/development/compilers/ghc/8.0.2.nix
+++ b/pkgs/development/compilers/ghc/8.0.2.nix
@@ -13,21 +13,15 @@ let
   });
 in
 stdenv.mkDerivation rec {
-  version = "8.0.1.20161117";
+  version = "8.0.1.20161213";
   name = "ghc-${version}";
 
   src = fetchurl {
-    url = "https://downloads.haskell.org/~ghc/8.0.2-rc1/${name}-src.tar.xz";
-    sha256 = "08hpzvg059ha0knmlngd0winfkplkkb7dk88zfz3s177z38kd874";
+    url = "https://downloads.haskell.org/~ghc/8.0.2-rc2/${name}-src.tar.xz";
+    sha256 = "0l1arhbh3rbs011f0y4pgc35yn07x3hz6lfqlvqbwn96f8ff5529";
   };
 
-  patches = [
-    # Already applied?
-    # ./relocation.patch
-    # Fix https://ghc.haskell.org/trac/ghc/ticket/12130
-    # (fetchFilteredPatch { url = https://git.haskell.org/ghc.git/patch/4d71cc89b4e9648f3fbb29c8fcd25d725616e265; sha256 = "0syaxb4y4s2dc440qmrggb4vagvqqhb55m6mx12rip4i9qhxl8k0"; })
-    (fetchFilteredPatch { url = https://git.haskell.org/ghc.git/patch/2f8cd14fe909a377b3e084a4f2ded83a0e6d44dd; sha256 = "06zvlgcf50ab58bw6yw3krn45dsmhg4cmlz4nqff8k4z1f1bj01v"; })
-  ] ++ stdenv.lib.optional stdenv.isLinux ./ghc-no-madv-free.patch;
+  patches = [] ++ stdenv.lib.optional stdenv.isLinux ./ghc-no-madv-free.patch;
 
   buildInputs = [ ghc perl hscolour ];
 
diff --git a/pkgs/development/compilers/haxe/default.nix b/pkgs/development/compilers/haxe/default.nix
index a2afcc773802..a4077408ef00 100644
--- a/pkgs/development/compilers/haxe/default.nix
+++ b/pkgs/development/compilers/haxe/default.nix
@@ -1,17 +1,17 @@
 { stdenv, fetchgit, ocaml, zlib, neko, camlp4 }:
 
 stdenv.mkDerivation {
-  name = "haxe-3.1.3";
+  name = "haxe-3.2.1";
 
   buildInputs = [ocaml zlib neko camlp4];
 
   src = fetchgit {
     url = "https://github.com/HaxeFoundation/haxe.git";
-    sha256 = "0d8s9yqsqcbr2lfw4xnmg7vzgb6k1jq6hlwwaf1kmn9wxpvcc6x9";
+    sha256 = "1x9ay5a2llq46fww3k07jxx8h1vfpyxb522snc6702a050ki5vz3";
     fetchSubmodules = true;
 
-    # Tag 3.1.3
-    rev = "7be30670b2f1f9b6082499c8fb9e23c0a6df6c28";
+    # Tag 3.2.1
+    rev = "deab4424399b520750671e51e5f5c2684e942c17";
   };
 
   prePatch = ''
diff --git a/pkgs/development/compilers/haxe/haxelib-nix.patch b/pkgs/development/compilers/haxe/haxelib-nix.patch
index da7e4c8dacb8..ed370e8efd12 100644
--- a/pkgs/development/compilers/haxe/haxelib-nix.patch
+++ b/pkgs/development/compilers/haxe/haxelib-nix.patch
@@ -1,10 +1,10 @@
-diff --git a/extra/haxelib_src/src/tools/haxelib/Main.hx b/extra/haxelib_src/src/tools/haxelib/Main.hx
-index a44a785..0eb811a 100644
+diff --git a/src/tools/haxelib/Main.hx b/src/tools/haxelib/Main.hx
+index dc18815..def5231 100644
 --- a/extra/haxelib_src/src/tools/haxelib/Main.hx
 +++ b/extra/haxelib_src/src/tools/haxelib/Main.hx
-@@ -996,21 +996,26 @@ class Main {
+@@ -1301,21 +1301,26 @@ class Main {
  	}
- 
+
  	function checkRec( prj : String, version : String, l : List<{ project : String, version : String, info : Infos }> ) {
 -		var pdir = getRepository() + Data.safe(prj);
 -		if( !FileSystem.exists(pdir) )
@@ -44,7 +44,7 @@ index a44a785..0eb811a 100644
  		var json = try File.getContent(vdir+"/"+Data.JSON) catch( e : Dynamic ) null;
  		var inf = Data.readData(json,false);
  		l.add({ project : prj, version : version, info: inf });
-@@ -1025,15 +1030,21 @@ class Main {
+@@ -1330,15 +1335,21 @@ class Main {
  			var a = args[argcur++].split(":");
  			checkRec(a[0],a[1],list);
  		}
@@ -73,10 +73,10 @@ index a44a785..0eb811a 100644
  			var ndir = dir + "ndll";
  			if( FileSystem.exists(ndir) ) {
  				var sysdir = ndir+"/"+Sys.systemName();
-@@ -1153,21 +1164,39 @@ class Main {
- 		print('  Path: $devPath');
+@@ -1491,23 +1502,43 @@ class Main {
+ 			);
  	}
- 
+
 +	function getNixLib(project:String):Null<String>
 +	{
 +		var hlibPath = Sys.getEnv("HAXELIB_PATH");
@@ -91,7 +91,7 @@ index a44a785..0eb811a 100644
 +		}
 +		return null;
 +	}
-+
+
  	function run() {
 -		var rep = getRepository();
  		var project = param("Library");
@@ -103,10 +103,10 @@ index a44a785..0eb811a 100644
 -		pdir += "/";
 -		var version = temp[1] != null ? temp[1] : getCurrent(pdir);
 -		var dev = try getDev(pdir) catch ( e : Dynamic ) null;
--		var vdir = dev!=null ? dev : pdir + Data.safe(version);
--		var rdir = vdir + "/run.n";
--		if( !FileSystem.exists(rdir) )
--			throw "Library "+project+" version "+version+" does not have a run script";
+-		var vdir = dev != null ? dev : pdir + Data.safe(version);
+
+ 		args.push(cli.cwd);
++
 +		var vdir = this.getNixLib(project);
 +		if (vdir == null) {
 +			var rep = getRepository();
@@ -121,6 +121,8 @@ index a44a785..0eb811a 100644
 +			if( !FileSystem.exists(rdir) )
 +				throw "Library "+project+" version "+version+" does not have a run script";
 +		}
- 		args.push(Sys.getCwd());
- 		Sys.setCwd(vdir);
- 		var cmd = "neko run.n";
+ 		cli.cwd = vdir;
+-
+ 		var callArgs =
+ 			switch try [Data.readData(File.getContent(vdir + '/haxelib.json'), false), null] catch (e:Dynamic) [null, e] {
+ 				case [null, e]:
diff --git a/pkgs/development/coq-modules/mathcomp/default.nix b/pkgs/development/coq-modules/mathcomp/default.nix
index 189b12206400..81cfdecdfffb 100644
--- a/pkgs/development/coq-modules/mathcomp/default.nix
+++ b/pkgs/development/coq-modules/mathcomp/default.nix
@@ -1,24 +1,39 @@
-{ callPackage, coq, fetchurl }:
+{ callPackage, fetchurl, coq }:
 
-let src = 
-  if coq.coq-version == "8.4" then
+if coq.coq-version == "8.4" then
 
-    fetchurl {
-      url = http://ssr.msr-inria.inria.fr/FTP/mathcomp-1.6.tar.gz;
-      sha256 = "0adr556032r1jkvphbpfvrrv041qk0yqb7a1xnbam52ji0mdl2w8";
-    }
+callPackage ./generic.nix {
+
+  name = "coq-mathcomp-1.6-${coq.coq-version}";
+  src = fetchurl {
+    url = http://ssr.msr-inria.inria.fr/FTP/mathcomp-1.6.tar.gz;
+    sha256 = "0adr556032r1jkvphbpfvrrv041qk0yqb7a1xnbam52ji0mdl2w8";
+  };
+
+}
+
+else if coq.coq-version == "8.5" then
 
-  else if coq.coq-version == "8.5" then
+callPackage ./generic.nix {
 
-    fetchurl {
-      url = http://ssr.msr-inria.inria.fr/FTP/mathcomp-1.6.tar.gz;
-      sha256 = "0adr556032r1jkvphbpfvrrv041qk0yqb7a1xnbam52ji0mdl2w8";
-    }
+  name = "coq-mathcomp-1.6-${coq.coq-version}";
+  src = fetchurl {
+    url = http://ssr.msr-inria.inria.fr/FTP/mathcomp-1.6.tar.gz;
+    sha256 = "0adr556032r1jkvphbpfvrrv041qk0yqb7a1xnbam52ji0mdl2w8";
+  };
 
-  else throw "No mathcomp package for Coq version ${coq.coq-version}";
+}
 
-in
+else if coq.coq-version == "8.6" then
 
 callPackage ./generic.nix {
-  inherit src;
+
+  name = "coq-mathcomp-1.6.1-${coq.coq-version}";
+  src = fetchurl {
+    url = https://github.com/math-comp/math-comp/archive/mathcomp-1.6.1.tar.gz;
+    sha256 = "1j9ylggjzrxz1i2hdl2yhsvmvy5z6l4rprwx7604401080p5sgjw";
+  };
+
 }
+
+else throw "No ssreflect package for Coq version ${coq.coq-version}"
diff --git a/pkgs/development/coq-modules/mathcomp/generic.nix b/pkgs/development/coq-modules/mathcomp/generic.nix
index b257c81e85f8..9a6a98609d29 100644
--- a/pkgs/development/coq-modules/mathcomp/generic.nix
+++ b/pkgs/development/coq-modules/mathcomp/generic.nix
@@ -1,12 +1,11 @@
 { stdenv, fetchurl, coq, ssreflect, ncurses, which
 , graphviz, ocamlPackages, withDoc ? false
-, src
+, src, name
 }:
 
 stdenv.mkDerivation {
 
-  name = "coq-mathcomp-1.6-${coq.coq-version}";
-
+  inherit name;
   inherit src;
 
   nativeBuildInputs = stdenv.lib.optionals withDoc [ graphviz ];
diff --git a/pkgs/development/coq-modules/ssreflect/default.nix b/pkgs/development/coq-modules/ssreflect/default.nix
index 8ba49d06bae9..16147c4dc2ae 100644
--- a/pkgs/development/coq-modules/ssreflect/default.nix
+++ b/pkgs/development/coq-modules/ssreflect/default.nix
@@ -4,6 +4,7 @@ if coq.coq-version == "8.4" then
 
 callPackage ./generic.nix {
 
+  name = "coq-ssreflect-1.6-${coq.coq-version}";
   src = fetchurl {
     url = http://ssr.msr-inria.inria.fr/FTP/mathcomp-1.6.tar.gz;
     sha256 = "0adr556032r1jkvphbpfvrrv041qk0yqb7a1xnbam52ji0mdl2w8";
@@ -15,6 +16,7 @@ else if coq.coq-version == "8.5" then
 
 callPackage ./generic.nix {
 
+  name = "coq-ssreflect-1.6-${coq.coq-version}";
   src = fetchurl {
     url = http://ssr.msr-inria.inria.fr/FTP/mathcomp-1.6.tar.gz;
     sha256 = "0adr556032r1jkvphbpfvrrv041qk0yqb7a1xnbam52ji0mdl2w8";
@@ -22,4 +24,16 @@ callPackage ./generic.nix {
 
 }
 
+else if coq.coq-version == "8.6" then
+
+callPackage ./generic.nix {
+
+  name = "coq-ssreflect-1.6.1-${coq.coq-version}";
+  src = fetchurl {
+    url = https://github.com/math-comp/math-comp/archive/mathcomp-1.6.1.tar.gz;
+    sha256 = "1j9ylggjzrxz1i2hdl2yhsvmvy5z6l4rprwx7604401080p5sgjw";
+  };
+
+}
+
 else throw "No ssreflect package for Coq version ${coq.coq-version}"
diff --git a/pkgs/development/coq-modules/ssreflect/generic.nix b/pkgs/development/coq-modules/ssreflect/generic.nix
index 891a4e2885a6..3362e8839a75 100644
--- a/pkgs/development/coq-modules/ssreflect/generic.nix
+++ b/pkgs/development/coq-modules/ssreflect/generic.nix
@@ -1,12 +1,11 @@
 { stdenv, fetchurl, coq, ncurses, which
 , graphviz, withDoc ? false
-, src, patches ? []
+, src, name, patches ? []
 }:
 
 stdenv.mkDerivation {
 
-  name = "coq-ssreflect-1.6-${coq.coq-version}";
-
+  inherit name;
   inherit src;
 
   nativeBuildInputs = stdenv.lib.optionals withDoc [ graphviz ];
diff --git a/pkgs/development/interpreters/maude/default.nix b/pkgs/development/interpreters/maude/default.nix
index 13403d50759a..e833e7b0c6da 100644
--- a/pkgs/development/interpreters/maude/default.nix
+++ b/pkgs/development/interpreters/maude/default.nix
@@ -1,26 +1,34 @@
-{ stdenv, fetchurl, flex, bison, ncurses, buddy, tecla, libsigsegv, gmpxx, makeWrapper }:
+{ stdenv, fetchurl, unzip, makeWrapper
+, flex, bison, ncurses, buddy, tecla, libsigsegv, gmpxx,
+}:
 
-stdenv.mkDerivation rec {
-  name = "maude-2.6";
+let
 
-  src = fetchurl {
-    url = "http://maude.cs.uiuc.edu/download/current/Maude-2.6.tar.gz";
-    sha256 = "182abzhvjvlaa21aqv7802v3bs57a4dm7cw09s3mqmih7nzpkfm5";
-  };
+  version = "2.7";
 
   fullMaude = fetchurl {
-    url = "https://full-maude.googlecode.com/git/full-maude261h.maude";
-    sha256 = "0xx8bfn6arsa75m5vhp5lmpazgfw230ssq33h9vifswlvzzc81ha";
+    url = "https://raw.githubusercontent.com/maude-team/full-maude/master/full-maude27c.maude";
+    sha256 = "08bg3gn1vyjy5k69hnynpzc9s1hnrbkyv6z08y1h2j37rlc4c18y";
+  };
+
+in
+
+stdenv.mkDerivation rec {
+  name = "maude-${version}";
+
+  src = fetchurl {
+    url = "https://github.com/maude-team/maude/archive/v${version}-ext-hooks.tar.gz";
+    sha256 = "02p0snxm69rs8pvm93r91p881dw6p3bxmazr3cfw5pnxpgz0vjl0";
   };
 
-  buildInputs = [flex bison ncurses buddy tecla gmpxx libsigsegv makeWrapper];
+  buildInputs = [flex bison ncurses buddy tecla gmpxx libsigsegv makeWrapper unzip];
 
   hardeningDisable = [ "stackprotector" ] ++
     stdenv.lib.optionals stdenv.isi686 [ "pic" "fortify" ];
 
   preConfigure = ''
     configureFlagsArray=(
-      --datadir=$out/share/maude
+      --datadir="$out/share/maude"
       TECLA_LIBS="-ltecla -lncursesw"
       CFLAGS="-O3" CXXFLAGS="-O3"
     )
@@ -30,8 +38,7 @@ stdenv.mkDerivation rec {
 
   postInstall = ''
     for n in "$out/bin/"*; do wrapProgram "$n" --suffix MAUDE_LIB ':' "$out/share/maude"; done
-    mkdir -p $out/share/maude
-    cp ${fullMaude} -d $out/share/maude/full-maude.maude
+    install -D -m 444 ${fullMaude} $out/share/maude/full-maude.maude
   '';
 
   meta = {
diff --git a/pkgs/development/libraries/aws-sdk-cpp/default.nix b/pkgs/development/libraries/aws-sdk-cpp/default.nix
index d5d7371aebf3..bb07b41b059c 100644
--- a/pkgs/development/libraries/aws-sdk-cpp/default.nix
+++ b/pkgs/development/libraries/aws-sdk-cpp/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake, curl, libuuid, openssl, zlib
+{ lib, stdenv, fetchFromGitHub, cmake, curl, openssl, zlib
 , # Allow building a limited set of APIs, e.g. ["s3" "ec2"].
   apis ? ["*"]
 , # Whether to enable AWS' custom memory management.
@@ -7,20 +7,22 @@
 
 stdenv.mkDerivation rec {
   name = "aws-sdk-cpp-${version}";
-  version = "1.0.34";
+  version = "1.0.43";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-sdk-cpp";
     rev = version;
-    sha256 = "09vag1ybfqvw37djmd9g740iqjvg8nwr4p0xb21rfj06vazrdg4b";
+    sha256 = "0sa0pkkbxxfn3h7b19yf296r5g5nqm4aqpwrkij0rq7jix9lxqj6";
   };
 
+  patches = [ ./s3-encryption-headers.patch ];
+
   # FIXME: might be nice to put different APIs in different outputs
   # (e.g. libaws-cpp-sdk-s3.so in output "s3").
   outputs = [ "out" "dev" ];
 
-  buildInputs = [ cmake curl libuuid ];
+  buildInputs = [ cmake curl ];
 
   cmakeFlags =
     lib.optional (!customMemoryManagement) "-DCUSTOM_MEMORY_MANAGEMENT=0"
@@ -39,13 +41,13 @@ stdenv.mkDerivation rec {
 
   NIX_LDFLAGS = lib.concatStringsSep " " (
     (map (pkg: "-rpath ${lib.getOutput "lib" pkg}/lib"))
-      [ libuuid curl openssl zlib stdenv.cc.cc ]);
+      [ curl openssl zlib stdenv.cc.cc ]);
 
   meta = {
     description = "A C++ interface for Amazon Web Services";
     homepage = https://github.com/awslabs/aws-sdk-cpp;
     license = lib.licenses.asl20;
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
     maintainers = [ lib.maintainers.eelco ];
   };
 }
diff --git a/pkgs/development/libraries/aws-sdk-cpp/s3-encryption-headers.patch b/pkgs/development/libraries/aws-sdk-cpp/s3-encryption-headers.patch
new file mode 100644
index 000000000000..10e427a15099
--- /dev/null
+++ b/pkgs/development/libraries/aws-sdk-cpp/s3-encryption-headers.patch
@@ -0,0 +1,18 @@
+diff --git a/aws-cpp-sdk-s3-encryption/CMakeLists.txt b/aws-cpp-sdk-s3-encryption/CMakeLists.txt
+index 0a1a907..cf9ce0e 100644
+--- a/aws-cpp-sdk-s3-encryption/CMakeLists.txt
++++ b/aws-cpp-sdk-s3-encryption/CMakeLists.txt
+@@ -69,9 +69,9 @@ target_link_libraries(${PROJECT_NAME} ${PROJECT_LIBS})
+ 
+ setup_install()
+ 
+-install (FILES ${S3ENCRYPTION_HEADERS} DESTINATION include/aws/s3-encryption)
+-install (FILES ${S3ENCRYPTION_MATERIALS_HEADERS} DESTINATION include/aws/s3-encryption/materials)
+-install (FILES ${S3ENCRYPTION_HANDLERS_HEADERS} DESTINATION include/aws/s3-encryption/handlers)
+-install (FILES ${S3ENCRYPTION_MODULES_HEADERS} DESTINATION include/aws/s3-encryption/modules)
++install (FILES ${S3ENCRYPTION_HEADERS} DESTINATION ${INCLUDE_DIRECTORY}/aws/s3-encryption)
++install (FILES ${S3ENCRYPTION_MATERIALS_HEADERS} DESTINATION ${INCLUDE_DIRECTORY}/aws/s3-encryption/materials)
++install (FILES ${S3ENCRYPTION_HANDLERS_HEADERS} DESTINATION ${INCLUDE_DIRECTORY}/aws/s3-encryption/handlers)
++install (FILES ${S3ENCRYPTION_MODULES_HEADERS} DESTINATION ${INCLUDE_DIRECTORY}/aws/s3-encryption/modules)
+ 
+ do_packaging()
diff --git a/pkgs/development/libraries/kde-frameworks/default.nix b/pkgs/development/libraries/kde-frameworks/default.nix
index 936a3953a51c..93a8d62ed1dd 100644
--- a/pkgs/development/libraries/kde-frameworks/default.nix
+++ b/pkgs/development/libraries/kde-frameworks/default.nix
@@ -57,7 +57,7 @@ let
       });
 
     kdeWrapper = import ./kde-wrapper.nix {
-      inherit (pkgs) stdenv lib makeWrapper;
+      inherit (pkgs) stdenv lib makeWrapper buildEnv;
     };
 
     attica = callPackage ./attica.nix {};
diff --git a/pkgs/development/libraries/kde-frameworks/kde-wrapper.nix b/pkgs/development/libraries/kde-frameworks/kde-wrapper.nix
index 3591e20d11fb..890ec1e4eec3 100644
--- a/pkgs/development/libraries/kde-frameworks/kde-wrapper.nix
+++ b/pkgs/development/libraries/kde-frameworks/kde-wrapper.nix
@@ -1,53 +1,40 @@
-{ stdenv, lib, makeWrapper }:
+{ stdenv, lib, makeWrapper, buildEnv }:
 
 drv:
 
 { targets, paths ? [] }:
 
+let
+  env = buildEnv {
+    inherit (drv) name meta;
+    paths = builtins.map lib.getBin ([drv] ++ paths);
+    pathsToLink = [ "/bin" "/share" "/lib/qt5" "/etc/xdg" ];
+  };
+in
+
 stdenv.mkDerivation {
   inherit (drv) name meta;
+  preferLocalBuild = true;
 
   paths = builtins.map lib.getBin ([drv] ++ paths);
-  inherit drv targets;
+  inherit drv env targets;
   passthru = { unwrapped = drv; };
 
   nativeBuildInputs = [ makeWrapper ];
 
-  unpackPhase = "true";
-  configurePhase = "runHook preConfigure; runHook postConfigure";
-  buildPhase = "true";
-
-  installPhase = ''
-    propagated=
-    for p in $drv $paths; do
-        findInputs $p propagated propagated-user-env-packages
-    done
-
-    wrap_PATH="$out/bin"
-    wrap_XDG_DATA_DIRS=
-    wrap_XDG_CONFIG_DIRS=
-    wrap_QML_IMPORT_PATH=
-    wrap_QML2_IMPORT_PATH=
-    wrap_QT_PLUGIN_PATH=
-    for p in $propagated; do
-        addToSearchPath wrap_PATH "$p/bin"
-        addToSearchPath wrap_XDG_DATA_DIRS "$p/share"
-        addToSearchPath wrap_XDG_CONFIG_DIRS "$p/etc/xdg"
-        addToSearchPath wrap_QML_IMPORT_PATH "$p/lib/qt5/imports"
-        addToSearchPath wrap_QML2_IMPORT_PATH "$p/lib/qt5/qml"
-        addToSearchPath wrap_QT_PLUGIN_PATH "$p/lib/qt5/plugins"
-    done
+  builder = builtins.toFile "builder.sh" ''
+    . $stdenv/setup
 
     for t in $targets; do
         if [ -a "$drv/$t" ]; then
             makeWrapper "$drv/$t" "$out/$t" \
                 --argv0 '"$0"' \
-                --suffix PATH : "$wrap_PATH" \
-                --prefix XDG_CONFIG_DIRS : "$wrap_XDG_CONFIG_DIRS" \
-                --prefix XDG_DATA_DIRS : "$wrap_XDG_DATA_DIRS" \
-                --set QML_IMPORT_PATH "$wrap_QML_IMPORT_PATH" \
-                --set QML2_IMPORT_PATH "$wrap_QML2_IMPORT_PATH" \
-                --set QT_PLUGIN_PATH "$wrap_QT_PLUGIN_PATH"
+                --suffix PATH : "$env/bin" \
+                --prefix XDG_CONFIG_DIRS : "$env/share" \
+                --prefix XDG_DATA_DIRS : "$env/etc/xdg" \
+                --set QML_IMPORT_PATH "$env/lib/qt5/imports" \
+                --set QML2_IMPORT_PATH "$env/lib/qt5/qml" \
+                --set QT_PLUGIN_PATH "$env/lib/qt5/plugins"
         else
             echo "no such file or directory: $drv/$t"
             exit 1
diff --git a/pkgs/development/libraries/libgcrypt/default.nix b/pkgs/development/libraries/libgcrypt/default.nix
index 8b7f48967e03..f05257898964 100644
--- a/pkgs/development/libraries/libgcrypt/default.nix
+++ b/pkgs/development/libraries/libgcrypt/default.nix
@@ -4,11 +4,11 @@ assert enableCapabilities -> stdenv.isLinux;
 
 stdenv.mkDerivation rec {
   name = "libgcrypt-${version}";
-  version = "1.7.3";
+  version = "1.7.5";
 
   src = fetchurl {
     url = "mirror://gnupg/libgcrypt/${name}.tar.bz2";
-    sha256 = "0wbh6fq5zi9wg2xcfvfpwh7dv52jihivx1vm4h91c2kx0w8n3b6x";
+    sha256 = "0078pbzm6nlgvnwlylshsg707ifcmfpnpbvhlhqbpwpfic9a9zni";
   };
 
   outputs = [ "out" "dev" "info" ];
diff --git a/pkgs/development/libraries/libmediainfo/default.nix b/pkgs/development/libraries/libmediainfo/default.nix
index 90869a4c8a5a..f57a49ab8123 100644
--- a/pkgs/development/libraries/libmediainfo/default.nix
+++ b/pkgs/development/libraries/libmediainfo/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, autoreconfHook, pkgconfig, libzen, zlib }:
 
 stdenv.mkDerivation rec {
-  version = "0.7.87";
+  version = "0.7.91";
   name = "libmediainfo-${version}";
   src = fetchurl {
     url = "http://mediaarea.net/download/source/libmediainfo/${version}/libmediainfo_${version}.tar.xz";
-    sha256 = "1gvjvc809mrhpcqr62cihhc6jnwml197xjbgydnzvsghih8dq8s9";
+    sha256 = "1h39cwd85rgidr0hbwab9dwbjv25xhvjv8y2nv35p3fwrs48p098";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
diff --git a/pkgs/development/libraries/libssh2/default.nix b/pkgs/development/libraries/libssh2/default.nix
index 89e402d2416d..0e53d27c8892 100644
--- a/pkgs/development/libraries/libssh2/default.nix
+++ b/pkgs/development/libraries/libssh2/default.nix
@@ -1,11 +1,11 @@
 {stdenv, fetchurlBoot, openssl, zlib, windows}:
 
 stdenv.mkDerivation rec {
-  name = "libssh2-1.7.0";
+  name = "libssh2-1.8.0";
 
   src = fetchurlBoot {
     url = "${meta.homepage}/download/${name}.tar.gz";
-    sha256 = "116mh112w48vv9k3f15ggp5kxw5sj4b88dzb5j69llsh7ba1ymp4";
+    sha256 = "1m3n8spv79qhjq4yi0wgly5s5rc8783jb1pyra9bkx1md0plxwrr";
   };
 
   outputs = [ "out" "dev" "devdoc" ];
diff --git a/pkgs/development/libraries/libzen/default.nix b/pkgs/development/libraries/libzen/default.nix
index 23597c2e03b1..5bb3f79f790e 100644
--- a/pkgs/development/libraries/libzen/default.nix
+++ b/pkgs/development/libraries/libzen/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, autoreconfHook }:
 
 stdenv.mkDerivation rec {
-  version = "0.4.33";
+  version = "0.4.34";
   name = "libzen-${version}";
   src = fetchurl {
     url = "https://mediaarea.net/download/source/libzen/${version}/libzen_${version}.tar.bz2";
-    sha256 = "0py5iagajz6m5zh26svkjyy85k1dmyhi6cdbmc3cb56a4ix1k2d2";
+    sha256 = "02krmhl6dplidz6h251ajpzzdhzzm0hp0lwwv9rgn55xjgh4yxw3";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/pkgs/development/libraries/science/biology/htslib/default.nix b/pkgs/development/libraries/science/biology/htslib/default.nix
index 2609861e319e..29fb338c8389 100644
--- a/pkgs/development/libraries/science/biology/htslib/default.nix
+++ b/pkgs/development/libraries/science/biology/htslib/default.nix
@@ -3,11 +3,11 @@
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
   pname = "htslib";
-  version = "1.3.1";
+  version = "1.3.2";
 
   src = fetchurl {
     url = "https://github.com/samtools/${pname}/releases/download/${version}/${name}.tar.bz2";
-    sha256 = "49d53a2395b8cef7d1d11270a09de888df8ba06f70fe68282e8235ee04124ae6";
+    sha256 = "0iq3blw23s55vkr1z88p9y2dqrb2dybzhl6hz2nlk53ncihrxcdr";
   };
 
   buildInputs = [ zlib ];
diff --git a/pkgs/development/libraries/tecla/default.nix b/pkgs/development/libraries/tecla/default.nix
index ea03795afc8f..93cf0670dc73 100644
--- a/pkgs/development/libraries/tecla/default.nix
+++ b/pkgs/development/libraries/tecla/default.nix
@@ -1,15 +1,13 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "tecla-1.6.2";
+  name = "tecla-1.6.3";
 
   src = fetchurl {
     url = "http://www.astro.caltech.edu/~mcs/tecla/lib${name}.tar.gz";
-    sha256 = "1f5p1v9ac5r1f6pjzwacb4yf8m6z19rv77p76j7fix34hd9dnqcc";
+    sha256 = "06pfq5wa8d25i9bdjkp4xhms5101dsrbg82riz7rz1a0a32pqxgj";
   };
 
-  configureFlags = "CFLAGS=-O3 CXXFLAGS=-O3";
-
   meta = {
     homepage = "http://www.astro.caltech.edu/~mcs/tecla/";
     description = "Command-line editing library";
diff --git a/pkgs/development/tools/pypi2nix/default.nix b/pkgs/development/tools/pypi2nix/default.nix
index 229d680f8351..1e6b6690e71b 100644
--- a/pkgs/development/tools/pypi2nix/default.nix
+++ b/pkgs/development/tools/pypi2nix/default.nix
@@ -1,13 +1,13 @@
-{ stdenv, fetchurl, python, zip, makeWrapper
+{ stdenv, fetchurl, python, zip, makeWrapper, nix, nix-prefetch-scripts
 }:
 
 let
 
-  version = "1.5.0";
+  version = "1.6.0";
 
   src = fetchurl {
     url = "https://github.com/garbas/pypi2nix/archive/v${version}.tar.gz";
-    sha256 = "0s79pp7gkgyk7discnv94m6z81fd67p66rdbd4cwk1ma0qljlh2k";
+    sha256 = "08iad1ad2gnvsnd66ddw3lff19ms2yly4iq63c8800j603d0pdhn";
   };
 
   click = fetchurl {
@@ -16,8 +16,8 @@ let
   };
 
   requests = fetchurl {
-    url = "https://pypi.python.org/packages/2e/ad/e627446492cc374c284e82381215dcd9a0a87c4f6e90e9789afefe6da0ad/requests-2.11.1.tar.gz";
-    sha256 = "0cx1w7m4cpslxz9jljxv0l9892ygrrckkiwpp2hangr8b01rikss";
+    url = "https://pypi.python.org/packages/5b/0b/34be574b1ec997247796e5d516f3a6b6509c4e064f2885a96ed885ce7579/requests-2.12.4.tar.gz";
+    sha256 = "0d5fwxmw4ibynk3imph3n4n84m0n3ib1vj339fxhkqri0qd4767d";
   };
 
 in stdenv.mkDerivation rec {
@@ -27,7 +27,7 @@ in stdenv.mkDerivation rec {
     click
     requests
   ];
-  buildInputs = [ python zip makeWrapper ];
+  buildInputs = [ python zip makeWrapper nix.out nix-prefetch-scripts ];
   sourceRoot = ".";
 
   postUnpack = ''
@@ -45,6 +45,11 @@ in stdenv.mkDerivation rec {
     fi
   '';
 
+  patchPhase = ''
+    sed -i -e "s|default='nix-shell',|default='${nix.out}/bin/nix-shell',|" $out/pkgs/pypi2nix/cli.py
+    sed -i -e "s|nix-prefetch-git|${nix-prefetch-scripts}/bin/nix-prefetch-git|" $out/pkgs/pypi2nix/stage2.py
+  '';
+
   commonPhase = ''
     mkdir -p $out/bin
 
diff --git a/pkgs/games/gnuchess/default.nix b/pkgs/games/gnuchess/default.nix
index 9b0ada3f9260..c61d46e9d339 100644
--- a/pkgs/games/gnuchess/default.nix
+++ b/pkgs/games/gnuchess/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     inherit (s) version;
     description = "GNU Chess engine";
     maintainers = [stdenv.lib.maintainers.raskin];
-    platforms = stdenv.lib.platforms.linux;
+    platforms = stdenv.lib.platforms.unix;
     license = stdenv.lib.licenses.gpl3Plus;
   };
 }
diff --git a/pkgs/games/xboard/default.nix b/pkgs/games/xboard/default.nix
index 46d3873659ff..442aad46fea8 100644
--- a/pkgs/games/xboard/default.nix
+++ b/pkgs/games/xboard/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation {
     inherit (s) version;
     description = ''GUI for chess engines'';
     maintainers = [stdenv.lib.maintainers.raskin];
-    platforms = stdenv.lib.platforms.linux;
+    platforms = stdenv.lib.platforms.unix;
     license = stdenv.lib.licenses.gpl3Plus;
   };
 }
diff --git a/pkgs/misc/emulators/wine/sources.nix b/pkgs/misc/emulators/wine/sources.nix
index f583fbff231e..5ad39a914f64 100644
--- a/pkgs/misc/emulators/wine/sources.nix
+++ b/pkgs/misc/emulators/wine/sources.nix
@@ -30,9 +30,9 @@ in rec {
   };
 
   unstable = fetchurl rec {
-    version = "1.9.23";
-    url = "https://dl.winehq.org/wine/source/1.9/wine-${version}.tar.bz2";
-    sha256 = "131nqkwlss24r8la84s3v1qx376wq0016d2i2767bpxkyqkagvz3";
+    version = "2.0-rc2";
+    url = "https://dl.winehq.org/wine/source/2.0/wine-${version}.tar.bz2";
+    sha256 = "0pjkrvslfksx7m2w52pnd3dfxb82l082cz9dr57x58s9al2jpwb6";
     inherit (stable) mono;
     gecko32 = fetchurl rec {
       version = "2.47";
@@ -48,7 +48,7 @@ in rec {
 
   staging = fetchFromGitHub rec {
     inherit (unstable) version;
-    sha256 = "188svpmaba2x5a7g8rk68cl2mqrv1vhf1si2g5j5lps9r6pgq1c0";
+    sha256 = "1xx9bfirij12l278f5f7vpxxay1zacnrsaib6yfzrybm517ynfw3";
     owner = "wine-compholio";
     repo = "wine-staging";
     rev = "v${version}";
diff --git a/pkgs/os-specific/linux/nvidia-x11/default.nix b/pkgs/os-specific/linux/nvidia-x11/default.nix
index 69e4de69f9c9..967a98d95663 100644
--- a/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/default.nix
@@ -12,7 +12,7 @@ assert (!libsOnly) -> kernel != null;
 
 let
 
-  versionNumber = "375.20";
+  versionNumber = "375.26";
 
   # Policy: use the highest stable version as the default (on our master).
   inherit (stdenv.lib) makeLibraryPath;
@@ -30,12 +30,12 @@ stdenv.mkDerivation {
     if stdenv.system == "i686-linux" then
       fetchurl {
         url = "http://download.nvidia.com/XFree86/Linux-x86/${versionNumber}/NVIDIA-Linux-x86-${versionNumber}.run";
-        sha256 = "0da3mgfmkhs576wfkdmk8pbmvsksalkwz8a75vnhk0385fnd6yfc";
+        sha256 = "0yv19rkz2wzzj0fygfjb1mh21iy769kff3yg2kzk8bsiwnmcyybw";
       }
     else if stdenv.system == "x86_64-linux" then
       fetchurl {
         url = "http://download.nvidia.com/XFree86/Linux-x86_64/${versionNumber}/NVIDIA-Linux-x86_64-${versionNumber}.run";
-        sha256 = "02v20xns8w4flpllibc684g5yghi5dy28avsarccjyn5knhl03ni";
+        sha256 = "1kqy9ayja3g5znj2hzx8pklz8qi0b0l9da7c3ldg3hlxf31v4hjg";
       }
     else throw "nvidia-x11 does not support platform ${stdenv.system}";
 
diff --git a/pkgs/servers/bird/default.nix b/pkgs/servers/bird/default.nix
index a03b81583c0e..0e77aa1d8ee7 100644
--- a/pkgs/servers/bird/default.nix
+++ b/pkgs/servers/bird/default.nix
@@ -2,11 +2,11 @@
 , enableIPv6 ? false }:
 
 stdenv.mkDerivation rec {
-  name = "bird-1.6.2";
+  name = "bird-1.6.3";
 
   src = fetchurl {
     url = "ftp://bird.network.cz/pub/bird/${name}.tar.gz";
-    sha256 = "1xlq78mgfyh9yvg9zld9mx75bxg9ajbn4cjjchnf0msh0ibzhlw8";
+    sha256 = "0z3yrxqb0p7f8b7r2gk4mvrwfzk45zx7yr9aifbvba1vgksiri9r";
   };
 
   buildInputs = [ flex bison readline ];
diff --git a/pkgs/servers/http/apache-modules/mod_perl/default.nix b/pkgs/servers/http/apache-modules/mod_perl/default.nix
new file mode 100644
index 000000000000..04746d678c52
--- /dev/null
+++ b/pkgs/servers/http/apache-modules/mod_perl/default.nix
@@ -0,0 +1,25 @@
+{ stdenv, fetchurl, apacheHttpd, perl }:
+
+stdenv.mkDerivation rec {
+  name = "mod_perl-2.0.10";
+
+  src = fetchurl {
+    url = "mirror://apache/perl/${name}.tar.gz";
+    sha256 = "0r1bhzwl5gr0202r6448943hjxsickzn55kdmb7dzad39vnq7kyi";
+  };
+
+  buildInputs = [ apacheHttpd perl ];
+  buildPhase = ''
+    perl Makefile.PL \
+      MP_APXS=${apacheHttpd.dev}/bin/apxs
+    make
+  '';
+  installPhase = ''
+    mkdir -p $out
+    make install DESTDIR=$out
+    mv $out${apacheHttpd}/* $out
+    mv $out${apacheHttpd.dev}/* $out
+    mv $out${perl}/* $out
+    rm $out/nix -rf
+  '';
+}
diff --git a/pkgs/servers/monitoring/grafana/default.nix b/pkgs/servers/monitoring/grafana/default.nix
index 821d049c2974..aa14af89c32d 100644
--- a/pkgs/servers/monitoring/grafana/default.nix
+++ b/pkgs/servers/monitoring/grafana/default.nix
@@ -1,8 +1,8 @@
 { lib, buildGoPackage, fetchurl, fetchFromGitHub, phantomjs2 }:
 
 buildGoPackage rec {
-  version = "4.0.0";
-  ts = "1480439068";
+  version = "4.0.2";
+  ts = "1481203731";
   name = "grafana-v${version}";
   goPackagePath = "github.com/grafana/grafana";
 
@@ -10,12 +10,12 @@ buildGoPackage rec {
     rev = "v${version}";
     owner = "grafana";
     repo = "grafana";
-    sha256 = "0ps9bi4mnb3k6g2824crhyb804srk2b4d2j9k306vg0cizirn75c";
+    sha256 = "1z71nb4qmp1qavsc101k86hc4yyis3mlqb1csrymkhgl94qpiiqm";
   };
 
   srcStatic = fetchurl {
     url = "https://grafanarel.s3.amazonaws.com/builds/grafana-${version}-${ts}.linux-x64.tar.gz";
-    sha256 = "10n3vmmyr1rvq29r5cz1rwz60smavj6fahz4vaqldh1v0qyqzjlm";
+    sha256 = "1jnh2hn95r1ik0z31b4p0niq7apykppf8jcjjhsbqf8yp8i2b737";
   };
 
   preBuild = "export GOPATH=$GOPATH:$NIX_BUILD_TOP/go/src/${goPackagePath}/Godeps/_workspace";
diff --git a/pkgs/servers/plex/default.nix b/pkgs/servers/plex/default.nix
index 467f3ffb1d48..122d5bd7dc9c 100644
--- a/pkgs/servers/plex/default.nix
+++ b/pkgs/servers/plex/default.nix
@@ -6,9 +6,9 @@
 let
   plexPass = throw "Plex pass has been removed at upstream's request; please unset nixpkgs.config.plex.pass";
   plexpkg = if enablePlexPass then plexPass else {
-    version = "1.2.7.2987";
-    vsnHash = "1bef33a";
-    sha256 = "17d1yisbikcp25mgn71rf8w76zhy015f33hxjj93swfm1qrq55hq";
+    version = "1.3.3.3148";
+    vsnHash = "b38628e";
+    sha256 = "1dx8z27l1dwigr3ipcdzn25hnj0206255ihxh9rnh2qchrcqmb5y";
   };
 
 in stdenv.mkDerivation rec {
diff --git a/pkgs/tools/admin/salt/fix-libcrypto-loading.patch b/pkgs/tools/admin/salt/fix-libcrypto-loading.patch
index c5cc1bde5d07..fa2c5c0aa521 100644
--- a/pkgs/tools/admin/salt/fix-libcrypto-loading.patch
+++ b/pkgs/tools/admin/salt/fix-libcrypto-loading.patch
@@ -2,10 +2,10 @@ diff --git a/salt/utils/rsax931.py b/salt/utils/rsax931.py
 index 9eb1f4a..d764f7a 100644
 --- a/salt/utils/rsax931.py
 +++ b/salt/utils/rsax931.py
-@@ -36,7 +36,7 @@ def _load_libcrypto():
+@@ -36,7 +36,6 @@ def _load_libcrypto():
                  'libcrypto.so*'))
              lib = lib[0] if len(lib) > 0 else None
-         if lib:
+-        if lib:
 -            return cdll.LoadLibrary(lib)
-+            return cdll.LoadLibrary('@libcrypto@')
++        return cdll.LoadLibrary('@libcrypto@')
          raise OSError('Cannot locate OpenSSL libcrypto')
diff --git a/pkgs/tools/misc/parallel/default.nix b/pkgs/tools/misc/parallel/default.nix
index 4bc346d41f8b..99a933b32435 100644
--- a/pkgs/tools/misc/parallel/default.nix
+++ b/pkgs/tools/misc/parallel/default.nix
@@ -1,11 +1,11 @@
 { fetchurl, stdenv, perl, makeWrapper, procps }:
 
 stdenv.mkDerivation rec {
-  name = "parallel-20161122";
+  name = "parallel-20161222";
 
   src = fetchurl {
     url = "mirror://gnu/parallel/${name}.tar.bz2";
-    sha256 = "0z5c4r35d926ac04ilaivx67cmflr1rsvmjb2ci7hmab948m0ng2";
+    sha256 = "1chgr3csyc7hbq2wq4jnwnbsr3ix8rzsk2lf4vdnvkjpd6dvw517";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/security/gnupg/21.nix b/pkgs/tools/security/gnupg/21.nix
index a4b47843583f..e91f91dbdeab 100644
--- a/pkgs/tools/security/gnupg/21.nix
+++ b/pkgs/tools/security/gnupg/21.nix
@@ -15,11 +15,11 @@ assert guiSupport -> pinentry != null;
 stdenv.mkDerivation rec {
   name = "gnupg-${version}";
 
-  version = "2.1.16";
+  version = "2.1.17";
 
   src = fetchurl {
     url = "mirror://gnupg/gnupg/${name}.tar.bz2";
-    sha256 = "0i483m9q032a0s50f1izb213g4h5i7pcgn395m6hvl3sg2kadfa9";
+    sha256 = "1js308b46ifx1gim0c9nivr5yxhans7iq1yvkf7zl2928gdm9p65";
   };
 
   buildInputs = [
diff --git a/pkgs/tools/security/sudo/default.nix b/pkgs/tools/security/sudo/default.nix
index b430fd8aad09..f2fede456d12 100644
--- a/pkgs/tools/security/sudo/default.nix
+++ b/pkgs/tools/security/sudo/default.nix
@@ -4,14 +4,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "sudo-1.8.18p1";
+  name = "sudo-1.8.19p1";
 
   src = fetchurl {
     urls =
       [ "ftp://ftp.sudo.ws/pub/sudo/${name}.tar.gz"
         "ftp://ftp.sudo.ws/pub/sudo/OLD/${name}.tar.gz"
       ];
-    sha256 = "0d4l6y03khmzdd8vhfnq8lrb8gcxplzf7gav0a9sd08jf8f4g875";
+    sha256 = "14pwdwl03kdbbyjkvxrfx409x3c1fjqz8aqz2wgwddinhz7v3bxq";
   };
 
   configureFlags = [
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index d7db015d1f77..77164a08bbc4 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2253,7 +2253,7 @@ in
   ioping = callPackage ../tools/system/ioping { };
 
   iops = callPackage ../tools/system/iops { };
-  
+
   ior = callPackage ../tools/system/ior { };
 
   iodine = callPackage ../tools/networking/iodine { };
@@ -2606,7 +2606,7 @@ in
   libmbim = callPackage ../development/libraries/libmbim { };
 
   libmongo-client = callPackage ../development/libraries/libmongo-client { };
-  
+
   libmesode = callPackage ../development/libraries/libmesode { };
 
   libnabo = callPackage ../development/libraries/libnabo { };
@@ -6605,7 +6605,9 @@ in
 
   valkyrie = callPackage ../development/tools/analysis/valkyrie { };
 
-  inherit (ocaml-ng.ocamlPackages_4_02) verasco;
+  verasco = ocaml-ng.ocamlPackages_4_02.verasco.override {
+    coq = coq_8_4;
+  };
 
   visualvm = callPackage ../development/tools/java/visualvm { };
 
@@ -10007,6 +10009,8 @@ in
 
     mod_evasive = callPackage ../servers/http/apache-modules/mod_evasive { };
 
+    mod_perl = callPackage ../servers/http/apache-modules/mod_perl { };
+
     mod_fastcgi = callPackage ../servers/http/apache-modules/mod_fastcgi { };
 
     mod_python = callPackage ../servers/http/apache-modules/mod_python { };
@@ -11004,8 +11008,6 @@ in
   linux_3_12 = callPackage ../os-specific/linux/kernel/linux-3.12.nix {
     kernelPatches = with kernelPatches;
       [ bridge_stp_helper
-        crc_regression
-        packet_fix_race_condition_CVE_2016_8655
       ]
       ++ lib.optionals ((platform.kernelArch or null) == "mips")
       [ kernelPatches.mips_fpureg_emu
@@ -12994,6 +12996,8 @@ in
 
   fossil = callPackage ../applications/version-management/fossil { };
 
+  freebayes = callPackage ../applications/science/biology/freebayes { };
+
   freewheeling = callPackage ../applications/audio/freewheeling { };
 
   fribid = callPackage ../applications/networking/browsers/mozilla-plugins/fribid { };
@@ -16720,38 +16724,34 @@ in
 
   aspino = callPackage ../applications/science/logic/aspino {};
 
-  coq = callPackage ../applications/science/logic/coq {
+  coq_8_3 = callPackage ../applications/science/logic/coq/8.3.nix {
+    make = pkgs.gnumake3;
+    inherit (ocamlPackages_3_12_1) ocaml findlib;
+    camlp5 = ocamlPackages_3_12_1.camlp5_transitional;
+    lablgtk = ocamlPackages_3_12_1.lablgtk_2_14;
+  };
+  coq_8_4 = callPackage ../applications/science/logic/coq/8.4.nix {
     inherit (ocamlPackages_4_01_0) ocaml findlib lablgtk;
     camlp5 = ocamlPackages_4_01_0.camlp5_transitional;
   };
-
-  coq_HEAD = callPackage ../applications/science/logic/coq/HEAD.nix {
+  coq_8_5 = callPackage ../applications/science/logic/coq/8.5.nix {
     inherit (ocamlPackages) ocaml findlib lablgtk;
     camlp5 = ocamlPackages.camlp5_transitional;
   };
-
   coq_8_6 = callPackage ../applications/science/logic/coq/8.6.nix {
     inherit (ocamlPackages) ocaml findlib lablgtk;
     camlp5 = ocamlPackages.camlp5_transitional;
   };
-
-  coq_8_5 = callPackage ../applications/science/logic/coq/8.5.nix {
+  coq_HEAD = callPackage ../applications/science/logic/coq/HEAD.nix {
     inherit (ocamlPackages) ocaml findlib lablgtk;
     camlp5 = ocamlPackages.camlp5_transitional;
   };
-
-  coq_8_3 = callPackage ../applications/science/logic/coq/8.3.nix {
-    make = pkgs.gnumake3;
-    inherit (ocamlPackages_3_12_1) ocaml findlib;
-    camlp5 = ocamlPackages_3_12_1.camlp5_transitional;
-    lablgtk = ocamlPackages_3_12_1.lablgtk_2_14;
-  };
+  coq = coq_8_4;
 
   mkCoqPackages_8_4 = self: let callPackage = newScope self; in {
-
     inherit callPackage;
-
-    bedrock = callPackage ../development/coq-modules/bedrock {};
+    coq = coq_8_4;
+    coqPackages = coqPackages_8_4;
 
     contribs =
       let contribs =
@@ -16761,86 +16761,59 @@ in
       in
         recurseIntoAttrs contribs;
 
+    bedrock = callPackage ../development/coq-modules/bedrock {};
     coqExtLib = callPackage ../development/coq-modules/coq-ext-lib {};
-
     coqeal = callPackage ../development/coq-modules/coqeal {};
-
     coquelicot = callPackage ../development/coq-modules/coquelicot {};
-
     domains = callPackage ../development/coq-modules/domains {};
-
     fiat = callPackage ../development/coq-modules/fiat {};
     fiat_HEAD = callPackage ../development/coq-modules/fiat/HEAD.nix {};
-
     flocq = callPackage ../development/coq-modules/flocq {};
-
     heq = callPackage ../development/coq-modules/heq {};
-
     interval = callPackage ../development/coq-modules/interval {};
-
     mathcomp = callPackage ../development/coq-modules/mathcomp {};
-
     paco = callPackage ../development/coq-modules/paco {};
-
     QuickChick = callPackage ../development/coq-modules/QuickChick {};
-
     ssreflect = callPackage ../development/coq-modules/ssreflect {};
-
     tlc = callPackage ../development/coq-modules/tlc {};
-
     unimath = callPackage ../development/coq-modules/unimath {};
-
     ynot = callPackage ../development/coq-modules/ynot {};
-
   };
 
   mkCoqPackages_8_5 = self: let callPackage = newScope self; in rec {
-
     inherit callPackage;
-
     coq = coq_8_5;
+    coqPackages = coqPackages_8_5;
 
     coq-ext-lib = callPackage ../development/coq-modules/coq-ext-lib {};
-
     coquelicot = callPackage ../development/coq-modules/coquelicot {};
-
     dpdgraph = callPackage ../development/coq-modules/dpdgraph {};
-
     flocq = callPackage ../development/coq-modules/flocq {};
-
     interval = callPackage ../development/coq-modules/interval {};
-
     mathcomp = callPackage ../development/coq-modules/mathcomp { };
-
     ssreflect = callPackage ../development/coq-modules/ssreflect { };
-
     fiat_HEAD = callPackage ../development/coq-modules/fiat/HEAD.nix {};
-
   };
 
   mkCoqPackages_8_6 = self: let callPackage = newScope self; in rec {
-
     inherit callPackage;
-
     coq = coq_8_6;
+    coqPackages = coqPackages_8_6;
 
     coq-ext-lib = callPackage ../development/coq-modules/coq-ext-lib {};
-
     coquelicot = callPackage ../development/coq-modules/coquelicot {};
-
     dpdgraph = callPackage ../development/coq-modules/dpdgraph {};
-
     flocq = callPackage ../development/coq-modules/flocq {};
-
     interval = callPackage ../development/coq-modules/interval {};
-
+    mathcomp = callPackage ../development/coq-modules/mathcomp { };
+    ssreflect = callPackage ../development/coq-modules/ssreflect { };
     fiat_HEAD = callPackage ../development/coq-modules/fiat/HEAD.nix {};
-
   };
 
-  coqPackages = mkCoqPackages_8_4 coqPackages;
+  coqPackages_8_4 = mkCoqPackages_8_4 coqPackages_8_4;
   coqPackages_8_5 = mkCoqPackages_8_5 coqPackages_8_5;
   coqPackages_8_6 = mkCoqPackages_8_6 coqPackages_8_6;
+  coqPackages = coqPackages_8_4;
 
   cryptoverif = callPackage ../applications/science/logic/cryptoverif { };
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 9a6b30772136..693fe1028e09 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -14140,12 +14140,12 @@ in {
   };
 
   markdown = buildPythonPackage rec {
-    version = "2.6.4";
+    version = "2.6.7";
     name = "markdown-${version}";
 
     src = pkgs.fetchurl {
       url = "mirror://pypi/M/Markdown/Markdown-${version}.tar.gz";
-      sha256 = "1kll5b35wqkhvniwm2kh6rqc43wakv9ls0qm6g5318pjmbkywdp4";
+      sha256 = "1h055llfd0ps0ig7qb3v1j9068xv90dc9s7xkhkgz9zg8r4g5sys";
     };
 
     # error: invalid command 'test'