summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--doc/languages-frameworks/haskell.section.md50
-rw-r--r--doc/reviewing-contributions.xml4
-rw-r--r--maintainers/maintainer-list.nix7
-rw-r--r--nixos/modules/config/zram.nix8
-rw-r--r--nixos/modules/installer/cd-dvd/iso-image.nix2
-rw-r--r--nixos/modules/installer/tools/nixos-enter.sh3
-rw-r--r--nixos/modules/misc/documentation.nix43
-rw-r--r--nixos/modules/module-list.nix2
-rw-r--r--nixos/modules/services/databases/foundationdb.nix360
-rw-r--r--nixos/modules/services/databases/foundationdb.xml279
-rw-r--r--nixos/modules/services/hardware/trezord.nix11
-rw-r--r--nixos/modules/services/networking/hans.nix145
-rw-r--r--nixos/modules/services/networking/iodine.nix22
-rw-r--r--nixos/modules/services/networking/wireguard.nix101
-rw-r--r--pkgs/applications/altcoins/bitcoin-unlimited.nix10
-rw-r--r--pkgs/applications/altcoins/bitcoin-xt.nix8
-rw-r--r--pkgs/applications/altcoins/default.nix20
-rw-r--r--pkgs/applications/audio/cdparanoia/default.nix3
-rw-r--r--pkgs/applications/audio/cdparanoia/fix_private_keyword.patch468
-rw-r--r--pkgs/applications/editors/android-studio/default.nix12
-rw-r--r--pkgs/applications/misc/gphoto2/default.nix4
-rw-r--r--pkgs/applications/misc/urh/default.nix4
-rw-r--r--pkgs/applications/networking/browsers/firefox/wrapper.nix4
-rw-r--r--pkgs/applications/networking/cluster/spark/default.nix23
-rw-r--r--pkgs/applications/networking/enhanced-ctorrent/default.nix15
-rw-r--r--pkgs/applications/office/todo.txt-cli/default.nix4
-rw-r--r--pkgs/applications/science/math/calc/default.nix62
-rw-r--r--pkgs/applications/science/math/mathematica/default.nix23
-rw-r--r--pkgs/applications/science/math/mathematica/l10ns.nix33
-rw-r--r--pkgs/applications/video/handbrake/default.nix20
-rw-r--r--pkgs/applications/virtualization/qemu/default.nix4
-rw-r--r--pkgs/build-support/vm/default.nix12
-rw-r--r--pkgs/data/fonts/dejavu-fonts/default.nix4
-rw-r--r--pkgs/development/compilers/ecl/16.1.2.nix13
-rw-r--r--pkgs/development/compilers/ecl/default.nix1
-rw-r--r--pkgs/development/compilers/mono/4.0.nix3
-rw-r--r--pkgs/development/compilers/mono/generic.nix8
-rw-r--r--pkgs/development/interpreters/eff/default.nix23
-rw-r--r--pkgs/development/interpreters/supercollider/default.nix4
-rw-r--r--pkgs/development/libraries/arb/default.nix12
-rw-r--r--pkgs/development/libraries/eclib/default.nix39
-rw-r--r--pkgs/development/libraries/fflas-ffpack/default.nix33
-rw-r--r--pkgs/development/libraries/gmime/3.nix6
-rw-r--r--pkgs/development/libraries/gstreamer/base/default.nix50
-rw-r--r--pkgs/development/libraries/gstreamer/core/default.nix15
-rw-r--r--pkgs/development/libraries/libgphoto2/default.nix6
-rw-r--r--pkgs/development/libraries/linbox/default.nix79
-rw-r--r--pkgs/development/libraries/oniguruma/default.nix13
-rw-r--r--pkgs/development/libraries/openmpi/default.nix4
-rw-r--r--pkgs/development/libraries/rocksdb/default.nix4
-rw-r--r--pkgs/development/python-modules/faulthandler/default.nix15
-rw-r--r--pkgs/development/python-modules/flask-autoindex/default.nix44
-rw-r--r--pkgs/development/python-modules/html5-parser/default.nix4
-rw-r--r--pkgs/development/python-modules/milksnake/default.nix26
-rw-r--r--pkgs/development/tools/build-managers/buildbot/default.nix4
-rw-r--r--pkgs/development/tools/misc/hydra/default.nix2
-rw-r--r--pkgs/os-specific/linux/tbs/default.nix50
-rw-r--r--pkgs/os-specific/linux/zfs/default.nix2
-rw-r--r--pkgs/servers/dns/knot-resolver/default.nix4
-rw-r--r--pkgs/servers/foundationdb/default.nix99
-rw-r--r--pkgs/servers/foundationdb/fix-scm-version.patch42
-rw-r--r--pkgs/servers/foundationdb/ldflags.patch90
-rw-r--r--pkgs/servers/ftp/bftpd/default.nix34
-rw-r--r--pkgs/servers/jackett/default.nix4
-rw-r--r--pkgs/shells/xonsh/default.nix6
-rw-r--r--pkgs/tools/backup/diskrsync/default.nix2
-rw-r--r--pkgs/tools/graphics/maim/default.nix13
-rw-r--r--pkgs/tools/misc/ipxe/default.nix8
-rw-r--r--pkgs/tools/misc/memtest86+/default.nix36
-rw-r--r--pkgs/tools/misc/slop/default.nix8
-rw-r--r--pkgs/tools/misc/vdirsyncer/default.nix51
-rw-r--r--pkgs/tools/package-management/nix-pin/default.nix33
-rw-r--r--pkgs/tools/virtualization/google-compute-engine/default.nix5
-rw-r--r--pkgs/top-level/all-packages.nix11
-rw-r--r--pkgs/top-level/haskell-packages.nix8
-rw-r--r--pkgs/top-level/ocaml-packages.nix2
-rw-r--r--pkgs/top-level/python-packages.nix4
-rw-r--r--pkgs/top-level/release.nix3
78 files changed, 2283 insertions, 410 deletions
diff --git a/doc/languages-frameworks/haskell.section.md b/doc/languages-frameworks/haskell.section.md
index 1623e0d276f2..3b8971c295bb 100644
--- a/doc/languages-frameworks/haskell.section.md
+++ b/doc/languages-frameworks/haskell.section.md
@@ -666,6 +666,56 @@ prefer one built with GHC 7.8.x in the first place. However, for users who
 cannot use GHC 7.10.x at all for some reason, the approach of downgrading to an
 older version might be useful.
 
+### How to override packages in all compiler-specific package sets
+
+In the previous section we learned how to override a package in a single
+compiler-specific package set. You may have some overrides defined that you want
+to use across multiple package sets. To accomplish this you could use the
+technique that we learned in the previous section by repeating the overrides for
+all the compiler-specific package sets. For example:
+
+```nix
+{
+  packageOverrides = super: let self = super.pkgs; in
+  {
+    haskell = super.haskell // {
+      packages = super.haskell.packages // {
+        ghc784 = super.haskell.packages.ghc784.override {
+          overrides = self: super: {
+            my-package = ...;
+            my-other-package = ...;
+          };
+        };
+        ghc822 = super.haskell.packages.ghc784.override {
+          overrides = self: super: {
+            my-package = ...;
+            my-other-package = ...;
+          };
+        };
+        ...
+      };
+    };
+  };
+}
+```
+
+However there's a more convenient way to override all compiler-specific package
+sets at once:
+
+```nix
+{
+  packageOverrides = super: let self = super.pkgs; in
+  {
+    haskell = super.haskell // {
+      packageOverrides = self: super: {
+        my-package = ...;
+        my-other-package = ...;
+      };
+    };
+  };
+}
+```
+
 ### How to recover from GHC's infamous non-deterministic library ID bug
 
 GHC and distributed build farms don't get along well:
diff --git a/doc/reviewing-contributions.xml b/doc/reviewing-contributions.xml
index d6f33ccd1cdb..7b017f0a8cc4 100644
--- a/doc/reviewing-contributions.xml
+++ b/doc/reviewing-contributions.xml
@@ -23,7 +23,9 @@
     xlink:href="https://github.com/NixOS/nixpkgs/pulls?q=is%3Apr+is%3Aopen+sort%3Aupdated-desc">most
     recently</link> and the <link
     xlink:href="https://github.com/NixOS/nixpkgs/pulls?q=is%3Apr+is%3Aopen+sort%3Aupdated-asc">least
-    recently</link> updated pull-requests.</para>
+        recently</link> updated pull-requests.
+  We highly encourage looking at <link xlink:href="https://github.com/NixOS/nixpkgs/pulls?q=is%3Apr+is%3Aopen+review%3Anone+status%3Asuccess+-label%3A%222.status%3A+work-in-progress%22+no%3Aproject+no%3Aassignee+no%3Amilestone">
+  this list of ready to merge, unreviewed pull requests</link>.</para>
 
 <para>When reviewing a pull request, please always be nice and polite.
   Controversial changes can lead to controversial opinions, but it is important
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 1cd73469e78a..c827e0d11a92 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -28,6 +28,11 @@
     github = "AndersonTorres";
     name = "Anderson Torres";
   };
+  Anton-Latukha = {
+    email = "anton.latuka+nixpkgs@gmail.com";
+    github = "Anton-Latukha";
+    name = "Anton Latukha";
+  };
   Baughn = {
     email = "sveina@gmail.com";
     github = "Baughn";
@@ -1726,7 +1731,7 @@
     name = "Jeffrey David Johnson";
   };
   jensbin = {
-    email = "jensbin@protonmail.com";
+    email = "jensbin+git@pm.me";
     github = "jensbin";
     name = "Jens Binkert";
   };
diff --git a/nixos/modules/config/zram.nix b/nixos/modules/config/zram.nix
index ae1b0a6c8e11..c1748812821e 100644
--- a/nixos/modules/config/zram.nix
+++ b/nixos/modules/config/zram.nix
@@ -25,16 +25,16 @@ in
         type = types.bool;
         description = ''
           Enable in-memory compressed swap space provided by the zram kernel
-          module. It is recommended to enable only for kernel 3.14 or higher.
+          module.
+          See https://www.kernel.org/doc/Documentation/blockdev/zram.txt
         '';
       };
 
       numDevices = mkOption {
-        default = 4;
+        default = 1;
         type = types.int;
         description = ''
-          Number of zram swap devices to create. It should be equal to the
-          number of CPU cores your system has.
+          Number of zram swap devices to create.
         '';
       };
 
diff --git a/nixos/modules/installer/cd-dvd/iso-image.nix b/nixos/modules/installer/cd-dvd/iso-image.nix
index e7cbf415a223..83f8a2586bd3 100644
--- a/nixos/modules/installer/cd-dvd/iso-image.nix
+++ b/nixos/modules/installer/cd-dvd/iso-image.nix
@@ -59,7 +59,7 @@ let
     INITRD /boot/${config.system.boot.loader.initrdFile}
 
     # A variant to boot with verbose logging to the console
-    LABEL boot-nomodeset
+    LABEL boot-debug
     MENU LABEL NixOS ${config.system.nixos.label}${config.isoImage.appendToMenuLabel} (debug)
     LINUX /boot/${config.system.boot.loader.kernelFile}
     APPEND init=${config.system.build.toplevel}/init ${toString config.boot.kernelParams} loglevel=7
diff --git a/nixos/modules/installer/tools/nixos-enter.sh b/nixos/modules/installer/tools/nixos-enter.sh
index 679391189612..518dbbbf21e3 100644
--- a/nixos/modules/installer/tools/nixos-enter.sh
+++ b/nixos/modules/installer/tools/nixos-enter.sh
@@ -51,8 +51,9 @@ if [[ ! -e $mountPoint/etc/NIXOS ]]; then
     exit 126
 fi
 
-mkdir -m 0755 -p "$mountPoint/dev"
+mkdir -m 0755 -p "$mountPoint/dev" "$mountPoint/sys"
 mount --rbind /dev "$mountPoint/dev"
+mount --rbind /sys "$mountPoint/sys"
 
 # Run the activation script. Set $LOCALE_ARCHIVE to supress some Perl locale warnings.
 LOCALE_ARCHIVE=$system/sw/lib/locale/locale-archive chroot "$mountPoint" "$system/activate" >&2 || true
diff --git a/nixos/modules/misc/documentation.nix b/nixos/modules/misc/documentation.nix
index cea8981370bb..2e426c017080 100644
--- a/nixos/modules/misc/documentation.nix
+++ b/nixos/modules/misc/documentation.nix
@@ -16,7 +16,10 @@ let cfg = config.documentation; in
         description = ''
           Whether to install documentation of packages from
           <option>environment.systemPackages</option> into the generated system path.
+
+          See "Multiple-output packages" chapter in the nixpkgs manual for more info.
         '';
+        # which is at ../../../doc/multiple-output.xml
       };
 
       man.enable = mkOption {
@@ -28,6 +31,15 @@ let cfg = config.documentation; in
         '';
       };
 
+      info.enable = mkOption {
+        type = types.bool;
+        default = true;
+        description = ''
+          Whether to install info pages and the <command>info</command> command.
+          This also includes "info" outputs.
+        '';
+      };
+
       doc.enable = mkOption {
         type = types.bool;
         default = true;
@@ -38,12 +50,19 @@ let cfg = config.documentation; in
         '';
       };
 
-      info.enable = mkOption {
+      dev.enable = mkOption {
         type = types.bool;
-        default = true;
+        default = false;
         description = ''
-          Whether to install info pages and the <command>info</command> command.
-          This also includes "info" outputs.
+          Whether to install documentation targeted at developers.
+          <itemizedlist>
+          <listitem><para>This includes man pages targeted at developers if <option>man.enable</option> is
+                    set (this also includes "devman" outputs).</para></listitem>
+          <listitem><para>This includes info pages targeted at developers if <option>info.enable</option>
+                    is set (this also includes "devinfo" outputs).</para></listitem>
+          <listitem><para>This includes other pages targeted at developers if <option>doc.enable</option>
+                    is set (this also includes "devdoc" outputs).</para></listitem>
+          </itemizedlist>
         '';
       };
 
@@ -56,20 +75,20 @@ let cfg = config.documentation; in
     (mkIf cfg.man.enable {
       environment.systemPackages = [ pkgs.man-db ];
       environment.pathsToLink = [ "/share/man" ];
-      environment.extraOutputsToInstall = [ "man" ];
+      environment.extraOutputsToInstall = [ "man" ] ++ optional cfg.dev.enable [ "devman" ];
+    })
+
+    (mkIf cfg.info.enable {
+      environment.systemPackages = [ pkgs.texinfoInteractive ];
+      environment.pathsToLink = [ "/share/info" ];
+      environment.extraOutputsToInstall = [ "info" ] ++ optional cfg.dev.enable [ "devinfo" ];
     })
 
     (mkIf cfg.doc.enable {
       # TODO(@oxij): put it here and remove from profiles?
       # environment.systemPackages = [ pkgs.w3m ]; # w3m-nox?
       environment.pathsToLink = [ "/share/doc" ];
-      environment.extraOutputsToInstall = [ "doc" ];
-    })
-
-    (mkIf cfg.info.enable {
-      environment.systemPackages = [ pkgs.texinfoInteractive ];
-      environment.pathsToLink = [ "/share/info" ];
-      environment.extraOutputsToInstall = [ "info" ];
+      environment.extraOutputsToInstall = [ "doc" ] ++ optional cfg.dev.enable [ "devdoc" ];
     })
 
   ]);
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index c0c3249c60b6..1261fe950928 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -195,6 +195,7 @@
   ./services/databases/clickhouse.nix
   ./services/databases/couchdb.nix
   ./services/databases/firebird.nix
+  ./services/databases/foundationdb.nix
   ./services/databases/hbase.nix
   ./services/databases/influxdb.nix
   ./services/databases/memcached.nix
@@ -481,6 +482,7 @@
   ./services/networking/gnunet.nix
   ./services/networking/gogoclient.nix
   ./services/networking/gvpe.nix
+  ./services/networking/hans.nix
   ./services/networking/haproxy.nix
   ./services/networking/heyefi.nix
   ./services/networking/hostapd.nix
diff --git a/nixos/modules/services/databases/foundationdb.nix b/nixos/modules/services/databases/foundationdb.nix
new file mode 100644
index 000000000000..ba921a9c1521
--- /dev/null
+++ b/nixos/modules/services/databases/foundationdb.nix
@@ -0,0 +1,360 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.foundationdb;
+
+  # used for initial cluster configuration
+  initialIpAddr = if (cfg.publicAddress != "auto") then cfg.publicAddress else "127.0.0.1";
+
+  fdbServers = n:
+    concatStringsSep "\n" (map (x: "[fdbserver.${toString (x+cfg.listenPortStart)}]") (range 0 (n - 1)));
+
+  backupAgents = n:
+    concatStringsSep "\n" (map (x: "[backup_agent.${toString x}]") (range 1 n));
+
+  configFile = pkgs.writeText "foundationdb.conf" ''
+    [general]
+    cluster_file  = /etc/foundationdb/fdb.cluster
+
+    [fdbmonitor]
+    restart_delay = ${toString cfg.restartDelay}
+    user          = ${cfg.user}
+    group         = ${cfg.group}
+
+    [fdbserver]
+    command        = ${pkgs.foundationdb}/bin/fdbserver
+    public_address = ${cfg.publicAddress}:$ID
+    listen_address = ${cfg.listenAddress}
+    datadir        = ${cfg.dataDir}/$ID
+    logdir         = ${cfg.logDir}
+    logsize        = ${cfg.logSize}
+    maxlogssize    = ${cfg.maxLogSize}
+    ${optionalString (cfg.class != null) "class = ${cfg.class}"}
+    memory         = ${cfg.memory}
+    storage_memory = ${cfg.storageMemory}
+
+    ${optionalString (cfg.locality.machineId    != null) "locality_machineid=${cfg.locality.machineId}"}
+    ${optionalString (cfg.locality.zoneId       != null) "locality_zoneid=${cfg.locality.zoneId}"}
+    ${optionalString (cfg.locality.datacenterId != null) "locality_dcid=${cfg.locality.datacenterId}"}
+    ${optionalString (cfg.locality.dataHall     != null) "locality_data_hall=${cfg.locality.dataHall}"}
+
+    ${fdbServers cfg.serverProcesses}
+
+    [backup_agent]
+    command = ${pkgs.foundationdb}/libexec/backup_agent
+    ${backupAgents cfg.backupProcesses}
+  '';
+in
+{
+  options.services.foundationdb = {
+
+    enable = mkEnableOption "FoundationDB Server";
+
+    publicAddress = mkOption {
+      type        = types.str;
+      default     = "auto";
+      description = "Publicly visible IP address of the process. Port is determined by process ID";
+    };
+
+    listenAddress = mkOption {
+      type        = types.str;
+      default     = "public";
+      description = "Publicly visible IP address of the process. Port is determined by process ID";
+    };
+
+    listenPortStart = mkOption {
+      type          = types.int;
+      default       = 4500;
+      description   = ''
+        Starting port number for database listening sockets. Every FDB process binds to a
+        subsequent port, to this number reflects the start of the overall range. e.g. having
+        8 server processes will use all ports between 4500 and 4507.
+      '';
+    };
+
+    openFirewall = mkOption {
+      type        = types.bool;
+      default     = false;
+      description = ''
+        Open the firewall ports corresponding to FoundationDB processes and coordinators
+        using <option>config.networking.firewall.*</option>.
+      '';
+    };
+
+    dataDir = mkOption {
+      type        = types.path;
+      default     = "/var/lib/foundationdb";
+      description = "Data directory. All cluster data will be put under here.";
+    };
+
+    logDir = mkOption {
+      type        = types.path;
+      default     = "/var/log/foundationdb";
+      description = "Log directory.";
+    };
+
+    user = mkOption {
+      type        = types.str;
+      default     = "foundationdb";
+      description = "User account under which FoundationDB runs.";
+    };
+
+    group = mkOption {
+      type        = types.str;
+      default     = "foundationdb";
+      description = "Group account under which FoundationDB runs.";
+    };
+
+    class = mkOption {
+      type        = types.nullOr (types.enum [ "storage" "transaction" "stateless" ]);
+      default     = null;
+      description = "Process class";
+    };
+
+    restartDelay = mkOption {
+      type = types.int;
+      default = 10;
+      description = "Number of seconds to wait before restarting servers.";
+    };
+
+    logSize = mkOption {
+      type        = types.string;
+      default     = "10MiB";
+      description = ''
+        Roll over to a new log file after the current log file
+        reaches the specified size.
+      '';
+    };
+
+    maxLogSize = mkOption {
+      type        = types.string;
+      default     = "100MiB";
+      description = ''
+        Delete the oldest log file when the total size of all log
+        files exceeds the specified size. If set to 0, old log files
+        will not be deleted.
+      '';
+    };
+
+    serverProcesses = mkOption {
+      type = types.int;
+      default = 1;
+      description = "Number of fdbserver processes to run.";
+    };
+
+    backupProcesses = mkOption {
+      type = types.int;
+      default = 1;
+      description = "Number of backup_agent processes to run for snapshots.";
+    };
+
+    memory = mkOption {
+      type        = types.string;
+      default     = "8GiB";
+      description = ''
+        Maximum memory used by the process. The default value is
+        <literal>8GiB</literal>. When specified without a unit,
+        <literal>MiB</literal> is assumed. This parameter does not
+        change the memory allocation of the program. Rather, it sets
+        a hard limit beyond which the process will kill itself and
+        be restarted. The default value of <literal>8GiB</literal>
+        is double the intended memory usage in the default
+        configuration (providing an emergency buffer to deal with
+        memory leaks or similar problems). It is not recommended to
+        decrease the value of this parameter below its default
+        value. It may be increased if you wish to allocate a very
+        large amount of storage engine memory or cache. In
+        particular, when the <literal>storageMemory</literal>
+        parameter is increased, the <literal>memory</literal>
+        parameter should be increased by an equal amount.
+      '';
+    };
+
+    storageMemory = mkOption {
+      type        = types.string;
+      default     = "1GiB";
+      description = ''
+        Maximum memory used for data storage. The default value is
+        <literal>1GiB</literal>. When specified without a unit,
+        <literal>MB</literal> is assumed. Clusters using the memory
+        storage engine will be restricted to using this amount of
+        memory per process for purposes of data storage. Memory
+        overhead associated with storing the data is counted against
+        this total. If you increase the
+        <literal>storageMemory</literal>, you should also increase
+        the <literal>memory</literal> parameter by the same amount.
+      '';
+    };
+
+    locality = mkOption {
+      default = {
+        machineId    = null;
+        zoneId       = null;
+        datacenterId = null;
+        dataHall     = null;
+      };
+
+      description = ''
+        FoundationDB locality settings.
+      '';
+
+      type = types.submodule ({
+        options = {
+          machineId = mkOption {
+            default = null;
+            type = types.nullOr types.str;
+            description = ''
+	      Machine identifier key. All processes on a machine should share a
+              unique id. By default, processes on a machine determine a unique id to share.
+              This does not generally need to be set.
+            '';
+          };
+
+          zoneId = mkOption {
+            default = null;
+            type = types.nullOr types.str;
+            description = ''
+	      Zone identifier key. Processes that share a zone id are
+              considered non-unique for the purposes of data replication.
+              If unset, defaults to machine id.
+            '';
+          };
+
+          datacenterId = mkOption {
+            default = null;
+            type = types.nullOr types.str;
+            description = ''
+	      Data center identifier key. All processes physically located in a
+              data center should share the id. If you are depending on data
+              center based replication this must be set on all processes.
+            '';
+          };
+
+          dataHall = mkOption {
+            default = null;
+            type = types.nullOr types.str;
+            description = ''
+	      Data hall identifier key. All processes physically located in a
+              data hall should share the id. If you are depending on data
+              hall based replication this must be set on all processes.
+            '';
+          };
+        };
+      });
+    };
+
+    extraReadWritePaths = mkOption {
+      default = [ ];
+      type = types.listOf types.path;
+      description = ''
+        An extra set of filesystem paths that FoundationDB can read to
+        and write from. By default, FoundationDB runs under a heavily
+        namespaced systemd environment without write access to most of
+        the filesystem outside of its data and log directories. By
+        adding paths to this list, the set of writeable paths will be
+        expanded. This is useful for allowing e.g. backups to local files,
+        which must be performed on behalf of the foundationdb service.
+      '';
+    };
+
+    pidfile = mkOption {
+      type        = types.path;
+      default     = "/run/foundationdb.pid";
+      description = "Path to pidfile for fdbmonitor.";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    meta.doc         = ./foundationdb.xml;
+    meta.maintainers = with lib.maintainers; [ thoughtpolice ];
+
+    environment.systemPackages = [ pkgs.foundationdb ];
+
+    users.extraUsers = optionalAttrs (cfg.user == "foundationdb") (singleton
+      { name        = "foundationdb";
+        description = "FoundationDB User";
+        uid         = config.ids.uids.foundationdb;
+        group       = cfg.group;
+      });
+
+    users.extraGroups = optionalAttrs (cfg.group == "foundationdb") (singleton
+      { name = "foundationdb";
+        gid  = config.ids.gids.foundationdb;
+      });
+
+    networking.firewall.allowedTCPPortRanges = mkIf cfg.openFirewall
+      [ { from = cfg.listenPortStart;
+          to = (cfg.listenPortStart + cfg.serverProcesses) - 1;
+        }
+      ];
+
+    systemd.services.foundationdb = {
+      description             = "FoundationDB Service";
+
+      after                   = [ "network.target" ];
+      wantedBy                = [ "multi-user.target" ];
+      unitConfig =
+        { RequiresMountsFor = "${cfg.dataDir} ${cfg.logDir}";
+        };
+
+      serviceConfig =
+        let rwpaths = [ cfg.dataDir cfg.logDir cfg.pidfile "/etc/foundationdb" ]
+                   ++ cfg.extraReadWritePaths;
+        in
+        { Type       = "simple";
+          Restart    = "always";
+          RestartSec = 5;
+          User       = cfg.user;
+          Group      = cfg.group;
+          PIDFile    = "${cfg.pidfile}";
+
+          PermissionsStartOnly = true;  # setup needs root perms
+          TimeoutSec           = 120;   # give reasonable time to shut down
+
+          # Security options
+          NoNewPrivileges       = true;
+          ProtectHome           = true;
+          ProtectSystem         = "strict";
+          ProtectKernelTunables = true;
+          ProtectControlGroups  = true;
+          PrivateTmp            = true;
+          PrivateDevices        = true;
+          ReadWritePaths        = lib.concatStringsSep " " (map (x: "-" + x) rwpaths);
+        };
+
+      path = [ pkgs.foundationdb pkgs.coreutils ];
+
+      preStart = ''
+        rm -f ${cfg.pidfile}   && \
+          touch ${cfg.pidfile} && \
+          chown -R ${cfg.user}:${cfg.group} ${cfg.pidfile}
+
+        for x in "${cfg.logDir}" "${cfg.dataDir}" /etc/foundationdb; do
+          [ ! -d "$x" ] && mkdir -m 0700 -vp "$x" && chown -R ${cfg.user}:${cfg.group} "$x";
+        done
+
+        if [ ! -f /etc/foundationdb/fdb.cluster ]; then
+            cf=/etc/foundationdb/fdb.cluster
+            desc=$(tr -dc A-Za-z0-9 </dev/urandom 2>/dev/null | head -c8)
+            rand=$(tr -dc A-Za-z0-9 </dev/urandom 2>/dev/null | head -c8)
+            echo ''${desc}:''${rand}@${initialIpAddr}:${builtins.toString cfg.listenPortStart} > $cf
+            chmod 0660 $cf && chown -R ${cfg.user}:${cfg.group} $cf
+            touch "${cfg.dataDir}/.first_startup"
+        fi
+      '';
+
+      script = ''
+        exec fdbmonitor --lockfile ${cfg.pidfile} --conffile ${configFile};
+      '';
+
+      postStart = ''
+        if [ -e "${cfg.dataDir}/.first_startup" ]; then
+          fdbcli --exec "configure new single ssd"
+          rm -f "${cfg.dataDir}/.first_startup";
+        fi
+      '';
+    };
+  };
+}
diff --git a/nixos/modules/services/databases/foundationdb.xml b/nixos/modules/services/databases/foundationdb.xml
new file mode 100644
index 000000000000..d10a5cfe836e
--- /dev/null
+++ b/nixos/modules/services/databases/foundationdb.xml
@@ -0,0 +1,279 @@
+<chapter xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xmlns:xi="http://www.w3.org/2001/XInclude"
+         version="5.0"
+         xml:id="module-foundationdb">
+
+<title>FoundationDB</title>
+
+<para><emphasis>Source:</emphasis> <filename>modules/services/databases/foundationdb.nix</filename></para>
+
+<para><emphasis>Upstream documentation:</emphasis> <link xlink:href="https://apple.github.io/foundationdb/"/></para>
+
+<para><emphasis>Maintainer:</emphasis> Austin Seipp</para>
+
+<para><emphasis>Default version:</emphasis> 5.1.x</para>
+
+<para>FoundationDB (or "FDB") is a distributed, open source, high performance,
+transactional key-value store. It can store petabytes of data and deliver
+exceptional performance while maintaining consistency and ACID semantics over a
+large cluster.</para>
+
+<section><title>Configuring and basic setup</title>
+
+<para>To enable FoundationDB, add the following to your
+<filename>configuration.nix</filename>:
+
+<programlisting>
+services.foundationdb.enable = true;
+</programlisting>
+</para>
+
+<para>After running <command>nixos-rebuild</command>, you can verify whether
+FoundationDB is running by executing <command>fdbcli</command> (which is added
+to <option>environment.systemPackages</option>):
+
+<programlisting>
+$ sudo -u foundationdb fdbcli
+Using cluster file `/etc/foundationdb/fdb.cluster'.
+
+The database is available.
+
+Welcome to the fdbcli. For help, type `help'.
+fdb> status
+
+Using cluster file `/etc/foundationdb/fdb.cluster'.
+
+Configuration:
+  Redundancy mode        - single
+  Storage engine         - memory
+  Coordinators           - 1
+
+Cluster:
+  FoundationDB processes - 1
+  Machines               - 1
+  Memory availability    - 5.4 GB per process on machine with least available
+  Fault Tolerance        - 0 machines
+  Server time            - 04/20/18 15:21:14
+
+...
+
+fdb>
+</programlisting>
+</para>
+
+<para>FoundationDB is run under the <command>foundationdb</command> user and
+group by default, but this may be changed in the NixOS configuration. The
+systemd unit <command>foundationdb.service</command> controls the
+<command>fdbmonitor</command> process.</para>
+
+<para>By default, the NixOS module for FoundationDB creates a single
+SSD-storage based database for development and basic usage. This storage engine
+is designed for SSDs and will perform poorly on HDDs; however it can handle far
+more data than the alternative "memory" engine and is a better default choice
+for most deployments. (Note that you can change the storage backend on-the-fly
+for a given FoundationDB cluster using <command>fdbcli</command>.)</para>
+
+<para>Furthermore, only 1 server process and 1 backup agent are started in the
+default configuration. See below for more on scaling to increase this.</para>
+
+<para>FoundationDB stores all data for all server processes under
+<filename>/var/lib/foundationdb</filename>. You can override this using
+<option>services.foundationdb.dataDir</option>, e.g.
+
+<programlisting>
+services.foundationdb.dataDir = "/data/fdb";
+</programlisting>
+
+</para>
+
+<para>Similarly, logs are stored under
+<filename>/var/log/foundationdb</filename> by default, and there is a
+corresponding <option>services.foundationdb.logDir</option> as well.</para>
+
+</section>
+
+<section><title>Scaling processes and backup agents</title>
+
+<para>Scaling the number of server processes is quite easy; simply specify
+<option>services.foundationdb.serverProcesses</option> to be the number of
+FoundationDB worker processes that should be started on the machine.</para>
+
+<para>FoundationDB worker processes typically require 4GB of RAM per-process at
+minimum for good performance, so this option is set to 1 by default since the
+maximum aount of RAM is unknown. You're advised to abide by this restriction,
+so pick a number of processes so that each has 4GB or more.</para>
+
+<para>A similar option exists in order to scale backup agent processes,
+<option>services.foundationdb.backupProcesses</option>. Backup agents are not
+as performance/RAM sensitive, so feel free to experiment with the number of
+available backup processes.</para>
+
+</section>
+
+<section><title>Clustering</title>
+
+<para>FoundationDB on NixOS works similarly to other Linux systems, so this
+section will be brief. Please refer to the full FoundationDB documentation for
+more on clustering.</para>
+
+<para>FoundationDB organizes clusters using a set of
+<emphasis>coordinators</emphasis>, which are just specially-designated worker
+processes. By default, every installation of FoundationDB on NixOS will start
+as its own individual cluster, with a single coordinator: the first worker
+process on <command>localhost</command>.</para>
+
+<para>Coordinators are specified globally using the
+<command>/etc/foundationdb/fdb.cluster</command> file, which all servers and
+client applications will use to find and join coordinators. Note that this file
+<emphasis>can not</emphasis> be managed by NixOS so easily: FoundationDB is
+designed so that it will rewrite the file at runtime for all clients and nodes
+when cluster coordinators change, with clients transparently handling this
+without intervention.</para>
+
+<para>When dealing with a cluster, there are two main things you want to
+do:</para>
+
+<itemizedlist>
+  <listitem><para>Add a node to the cluster for storage/compute.</para></listitem>
+  <listitem><para>Promote an ordinary worker to a coordinator.</para></listitem>
+</itemizedlist>
+
+<para>A node must already be a member of the cluster in order to properly be
+promoted to a coordinator, so you must always add it first if you wish to
+promote it.</para>
+
+<para>To add a machine to a FoundationDB cluster:</para>
+
+<itemizedlist>
+  <listitem><para>Choose one of the servers to start as the initial coordinator.
+      </para></listitem>
+  <listitem><para>Copy the <command>/etc/foundationdb/fdb.cluster</command> file
+      from this server to all the other servers. Restart FoundationDB on all of
+      these other servers, so they join the cluster.</para></listitem>
+  <listitem><para>All of these servers are now connected and working together
+      in the cluster, under the chosen coordinator.</para></listitem>
+</itemizedlist>
+
+<para>At this point, you can add as many nodes as you want by just repeating
+the above steps. By default there will still be a single coordinator: you can
+use <command>fdbcli</command> to change this and add new coordinators.</para>
+
+<para>As a convenience, FoundationDB can automatically assign coordinators
+based on the redundancy mode you wish to achieve for the cluster. Once all the
+nodes have been joined, simply set the replication policy, and then issue the
+<command>coordinators auto</command> command</para>
+
+<para>For example, assuming we have 3 nodes available, we can enable double
+redundancy mode, then auto-select coordinators. For double redundancy, 3
+coordinators is ideal: therefore FoundationDB will make
+<emphasis>every</emphasis> node a coordinator automatically:</para>
+
+<programlisting>
+fdbcli> configure double ssd
+fdbcli> coordinators auto
+</programlisting>
+
+<para>This will transparently update all the servers within seconds, and
+appropriately rewrite the <command>fdb.cluster</command> file, as well as
+informing all client processes to do the same.</para>
+
+</section>
+
+<section><title>Client connectivity</title>
+
+<para>By default, all clients must use the current
+<command>fdb.cluster</command> file to access a given FoundationDB cluster.
+This file is located by default in
+<command>/etc/foundationdb/fdb.cluster</command> on all machines with the
+FoundationDB service enabled, so you may copy the active one from your cluster
+to a new node in order to connect, if it is not part of the cluster.</para>
+
+</section>
+
+<section><title>Backups and Disaster Recovery</title>
+
+<para>The usual rules for doing FoundationDB backups apply on NixOS as written
+in the FoundationDB manual. However, one important difference is the security
+profile for NixOS: by default, the <command>foundationdb</command> systemd unit
+uses <emphasis>Linux namespaces</emphasis> to restrict write access to the
+system, except for the log directory, data directory, and the
+<command>/etc/foundationdb/</command> directory. This is enforced by default
+and cannot be disabled.</para>
+
+<para>However, a side effect of this is that the <command>fdbbackup</command>
+command doesn't work properly for local filesystem backups: FoundationDB uses a
+server process alongside the database processes to perform backups and copy the
+backups to the filesystem. As a result, this process is put under the
+restricted namespaces above: the backup process can only write to a limited
+number of paths.</para>
+
+<para>In order to allow flexible backup locations on local disks, the
+FoundationDB NixOS module supports a
+<option>services.foundationdb.extraReadWritePaths</option> option. This option
+takes a list of paths, and adds them to the systemd unit, allowing the
+processes inside the service to write (and read) the specified
+directories.</para>
+
+<para>For example, to create backups in <command>/opt/fdb-backups</command>,
+first set up the paths in the module options:</para>
+
+<programlisting>
+services.foundationdb.extraReadWritePaths = [ "/opt/fdb-backups" ];
+</programlisting>
+
+<para>Restart the FoundationDB service, and it will now be able to write to
+this directory (even if it does not yet exist.) Note: this path
+<emphasis>must</emphasis> exist before restarting the unit. Otherwise, systemd
+will not include it in the private FoundationDB namespace (and it will not add
+it dynamically at runtime).</para>
+
+<para>You can now perform a backup:</para>
+
+<programlisting>
+$ sudo -u foundationdb fdbbackup start  -t default -d file:///opt/fdb-backups
+$ sudo -u foundationdb fdbbackup status -t default
+</programlisting>
+
+</section>
+
+<section><title>Known limitations</title>
+
+<para>The FoundationDB setup for NixOS should currently be considered beta.
+FoundationDB is not new software, but the NixOS compilation and integration has
+only undergone fairly basic testing of all the available functionality.</para>
+
+<itemizedlist>
+  <listitem><para>TLS plugin support is compiled in, but it's currently not
+      possible to specify the set of TLS certificate options in
+      <command>services.foundationdb</command></para></listitem>
+  <listitem><para>There is no way to specify individual parameters for
+      individual <command>fdbserver</command> processes. Currently, all server
+      processes inherit all the global <command>fdbmonitor</command> settings.
+      </para></listitem>
+  <listitem><para>Python bindings are not currently installed.</para></listitem>
+  <listitem><para>Ruby bindings are not currently installed.</para></listitem>
+  <listitem><para>Java bindings are not currently installed.</para></listitem>
+  <listitem><para>Go bindings are not currently installed.</para></listitem>
+</itemizedlist>
+
+</section>
+
+<section><title>Options</title>
+
+<para>NixOS's FoundationDB module allows you to configure all of the most
+relevant configuration options for <command>fdbmonitor</command>, matching it
+quite closely. For a complete list of all options, check <command>man
+configuration.nix</command>.</para>
+
+</section>
+
+<section><title>Full documentation</title>
+
+<para>FoundationDB is a complex piece of software, and requires careful
+administration to properly use. Full documentation for administration can be
+found here: <link xlink:href="https://apple.github.io/foundationdb/"/>.</para>
+
+</section>
+
+</chapter>
diff --git a/nixos/modules/services/hardware/trezord.nix b/nixos/modules/services/hardware/trezord.nix
index fa0496114684..f2ec00a7d3e1 100644
--- a/nixos/modules/services/hardware/trezord.nix
+++ b/nixos/modules/services/hardware/trezord.nix
@@ -26,8 +26,15 @@ in {
       name = "trezord-udev-rules";
       destination = "/etc/udev/rules.d/51-trezor.rules";
       text = ''
-        SUBSYSTEM=="usb", ATTR{idVendor}=="534c", ATTR{idProduct}=="0001", MODE="0666", GROUP="dialout", SYMLINK+="trezor%n"
-        KERNEL=="hidraw*", ATTRS{idVendor}=="534c", ATTRS{idProduct}=="0001",  MODE="0666", GROUP="dialout"
+        # Trezor 1
+        SUBSYSTEM=="usb",  ATTR{idVendor}=="534c",  ATTR{idProduct}=="0001",  MODE="0666", GROUP="dialout", SYMLINK+="trezor%n"
+        KERNEL=="hidraw*", ATTRS{idVendor}=="534c", ATTRS{idProduct}=="0001", MODE="0666", GROUP="dialout"
+
+        # Trezor 2 (Model-T)
+        SUBSYSTEM=="usb",  ATTR{idVendor}=="1209",  ATTR{idProduct}=="53c0",  MODE="0661", GROUP="dialout", TAG+="uaccess", TAG+="udev-acl", SYMLINK+="trezor%n"
+        SUBSYSTEM=="usb",  ATTR{idVendor}=="1209",  ATTR{idProduct}=="53c1",  MODE="0660", GROUP="dialout", TAG+="uaccess", TAG+="udev-acl", SYMLINK+="trezor%n"
+        KERNEL=="hidraw*", ATTRS{idVendor}=="1209", ATTRS{idProduct}=="53c1", MODE="0660", GROUP="dialout", TAG+="uaccess", TAG+="udev-acl"
+  ];
       '';
     });
 
diff --git a/nixos/modules/services/networking/hans.nix b/nixos/modules/services/networking/hans.nix
new file mode 100644
index 000000000000..dd34ef8d4ca1
--- /dev/null
+++ b/nixos/modules/services/networking/hans.nix
@@ -0,0 +1,145 @@
+# NixOS module for hans, ip over icmp daemon
+
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.hans;
+
+  hansUser = "hans";
+
+in
+{
+
+  ### configuration
+
+  options = {
+
+    services.hans = {
+      clients = mkOption {
+        default = {};
+        description = ''
+          Each attribute of this option defines a systemd service that
+          runs hans. Many or none may be defined.
+          The name of each service is
+          <literal>hans-<replaceable>name</replaceable></literal>
+          where <replaceable>name</replaceable> is the name of the
+          corresponding attribute name.
+        '';
+        example = literalExample ''
+        {
+          foo = {
+            server = "192.0.2.1";
+            extraConfig = "-v";
+          }
+        }
+        '';
+        type = types.attrsOf (types.submodule (
+        {
+          options = {
+            server = mkOption {
+              type = types.str;
+              default = "";
+              description = "IP address of server running hans";
+              example = "192.0.2.1";
+            };
+
+            extraConfig = mkOption {
+              type = types.str;
+              default = "";
+              description = "Additional command line parameters";
+              example = "-v";
+            };
+
+            passwordFile = mkOption {
+              type = types.str;
+              default = "";
+              description = "File that containts password";
+            };
+
+          };
+        }));
+      };
+
+      server = {
+        enable = mkOption {
+          type = types.bool;
+          default = false;
+          description = "enable hans server";
+        };
+
+        ip = mkOption {
+          type = types.str;
+          default = "";
+          description = "The assigned ip range";
+          example = "198.51.100.0";
+        };
+
+        respondToSystemPings = mkOption {
+          type = types.bool;
+          default = false;
+          description = "Force hans respond to ordinary pings";
+        };
+
+        extraConfig = mkOption {
+          type = types.str;
+          default = "";
+          description = "Additional command line parameters";
+          example = "-v";
+        };
+
+        passwordFile = mkOption {
+          type = types.str;
+          default = "";
+          description = "File that containts password";
+        };
+      };
+
+    };
+  };
+
+  ### implementation
+
+  config = mkIf (cfg.server.enable || cfg.clients != {}) {
+    boot.kernel.sysctl = optionalAttrs cfg.server.respondToSystemPings {
+      "net.ipv4.icmp_echo_ignore_all" = 1;
+    };
+
+    boot.kernelModules = [ "tun" ];
+
+    systemd.services =
+    let
+      createHansClientService = name: cfg:
+      {
+        description = "hans client - ${name}";
+        after = [ "network.target" ];
+        wantedBy = [ "multi-user.target" ];
+        script = "${pkgs.hans}/bin/hans -f -u ${hansUser} ${cfg.extraConfig} -c ${cfg.server} ${optionalString (cfg.passwordFile != "") "-p $(cat \"${cfg.passwordFile}\")"}";
+        serviceConfig = {
+          RestartSec = "30s";
+          Restart = "always";
+        };
+      };
+    in
+    listToAttrs (
+      mapAttrsToList
+        (name: value: nameValuePair "hans-${name}" (createHansClientService name value))
+        cfg.clients
+    ) // {
+      hans = mkIf (cfg.server.enable) {
+        description = "hans, ip over icmp server daemon";
+        after = [ "network.target" ];
+        wantedBy = [ "multi-user.target" ];
+        script = "${pkgs.hans}/bin/hans -f -u ${hansUser} ${cfg.server.extraConfig} -s ${cfg.server.ip} ${optionalString cfg.server.respondToSystemPings "-r"} ${optionalString (cfg.server.passwordFile != "") "-p $(cat \"${cfg.server.passwordFile}\")"}";
+      };
+    };
+
+    users.extraUsers = singleton {
+      name = hansUser;
+      description = "Hans daemon user";
+    };
+  };
+
+  meta.maintainers = with maintainers; [ gnidorah ];
+}
diff --git a/nixos/modules/services/networking/iodine.nix b/nixos/modules/services/networking/iodine.nix
index 512dbd77ae4b..3f41421d27f7 100644
--- a/nixos/modules/services/networking/iodine.nix
+++ b/nixos/modules/services/networking/iodine.nix
@@ -32,7 +32,7 @@ in
           foo = {
             server = "tunnel.mdomain.com";
             relay = "8.8.8.8";
-            extraConfig = "-P mysecurepassword";
+            extraConfig = "-v";
           }
         }
         '';
@@ -57,7 +57,13 @@ in
               type = types.str;
               default = "";
               description = "Additional command line parameters";
-              example = "-P mysecurepassword -l 192.168.1.10 -p 23";
+              example = "-l 192.168.1.10 -p 23";
+            };
+
+            passwordFile = mkOption {
+              type = types.str;
+              default = "";
+              description = "File that containts password";
             };
           };
         }));
@@ -88,7 +94,13 @@ in
           type = types.str;
           default = "";
           description = "Additional command line parameters";
-          example = "-P mysecurepassword -l 192.168.1.10 -p 23";
+          example = "-l 192.168.1.10 -p 23";
+        };
+
+        passwordFile = mkOption {
+          type = types.str;
+          default = "";
+          description = "File that containts password";
         };
       };
 
@@ -108,10 +120,10 @@ in
         description = "iodine client - ${name}";
         after = [ "network.target" ];
         wantedBy = [ "multi-user.target" ];
+        script = "${pkgs.iodine}/bin/iodine -f -u ${iodinedUser} ${cfg.extraConfig} ${optionalString (cfg.passwordFile != "") "-P $(cat \"${cfg.passwordFile}\")"} ${cfg.relay} ${cfg.server}";
         serviceConfig = {
           RestartSec = "30s";
           Restart = "always";
-          ExecStart = "${pkgs.iodine}/bin/iodine -f -u ${iodinedUser} ${cfg.extraConfig} ${cfg.relay} ${cfg.server}";
         };
       };
     in
@@ -124,7 +136,7 @@ in
         description = "iodine, ip over dns server daemon";
         after = [ "network.target" ];
         wantedBy = [ "multi-user.target" ];
-        serviceConfig.ExecStart = "${pkgs.iodine}/bin/iodined -f -u ${iodinedUser} ${cfg.server.extraConfig} ${cfg.server.ip} ${cfg.server.domain}";
+        script = "${pkgs.iodine}/bin/iodined -f -u ${iodinedUser} ${cfg.server.extraConfig} ${optionalString (cfg.server.passwordFile != "") "-P $(cat \"${cfg.server.passwordFile}\")"} ${cfg.server.ip} ${cfg.server.domain}";
       };
     };
 
diff --git a/nixos/modules/services/networking/wireguard.nix b/nixos/modules/services/networking/wireguard.nix
index 24accd41511c..0591917c7423 100644
--- a/nixos/modules/services/networking/wireguard.nix
+++ b/nixos/modules/services/networking/wireguard.nix
@@ -53,30 +53,30 @@ let
       };
 
       preSetup = mkOption {
-        example = literalExample [''
+        example = literalExample ''
           ${pkgs.iproute}/bin/ip netns add foo
-        ''];
-        default = [];
-        type = with types; listOf str;
+        '';
+        default = "";
+        type = with types; coercedTo (listOf str) (concatStringsSep "\n") lines;
         description = ''
-          A list of commands called at the start of the interface setup.
+          Commands called at the start of the interface setup.
         '';
       };
 
       postSetup = mkOption {
-        example = literalExample [''
-          ${pkgs.bash} -c 'printf "nameserver 10.200.100.1" | ${pkgs.openresolv}/bin/resolvconf -a wg0 -m 0'
-        ''];
-        default = [];
-        type = with types; listOf str;
-        description = "A list of commands called at the end of the interface setup.";
+        example = literalExample ''
+          printf "nameserver 10.200.100.1" | ${pkgs.openresolv}/bin/resolvconf -a wg0 -m 0
+        '';
+        default = "";
+        type = with types; coercedTo (listOf str) (concatStringsSep "\n") lines;
+        description = "Commands called at the end of the interface setup.";
       };
 
       postShutdown = mkOption {
-        example = literalExample ["${pkgs.openresolv}/bin/resolvconf -d wg0"];
-        default = [];
-        type = with types; listOf str;
-        description = "A list of commands called after shutting down the interface.";
+        example = literalExample "${pkgs.openresolv}/bin/resolvconf -d wg0";
+        default = "";
+        type = with types; coercedTo (listOf str) (concatStringsSep "\n") lines;
+        description = "Commands called after shutting down the interface.";
       };
 
       table = mkOption {
@@ -182,9 +182,6 @@ let
 
   };
 
-  ipCommand = "${pkgs.iproute}/bin/ip";
-  wgCommand = "${pkgs.wireguard}/bin/wg";
-
   generateUnit = name: values:
     # exactly one way to specify the private key must be set
     assert (values.privateKey != null) != (values.privateKeyFile != null);
@@ -196,49 +193,53 @@ let
         after = [ "network.target" ];
         wantedBy = [ "multi-user.target" ];
         environment.DEVICE = name;
+        path = with pkgs; [ kmod iproute wireguard ];
 
         serviceConfig = {
           Type = "oneshot";
           RemainAfterExit = true;
-          ExecStart = flatten([
-            values.preSetup
+        };
+
+        script = ''
+          modprobe wireguard
+
+          ${values.preSetup}
 
-            "-${ipCommand} link del dev ${name}"
-            "${ipCommand} link add dev ${name} type wireguard"
+          ip link add dev ${name} type wireguard
 
-            (map (ip:
-            "${ipCommand} address add ${ip} dev ${name}"
-            ) values.ips)
+          ${concatMapStringsSep "\n" (ip:
+            "ip address add ${ip} dev ${name}"
+          ) values.ips}
 
-            ("${wgCommand} set ${name} private-key ${privKey}" +
-            optionalString (values.listenPort != null) " listen-port ${toString values.listenPort}")
+          wg set ${name} private-key ${privKey} ${
+            optionalString (values.listenPort != null) " listen-port ${toString values.listenPort}"}
 
-            (map (peer:
+          ${concatMapStringsSep "\n" (peer:
             assert (peer.presharedKeyFile == null) || (peer.presharedKey == null); # at most one of the two must be set
             let psk = if peer.presharedKey != null then pkgs.writeText "wg-psk" peer.presharedKey else peer.presharedKeyFile;
             in
-            "${wgCommand} set ${name} peer ${peer.publicKey}" +
-            optionalString (psk != null) " preshared-key ${psk}" +
-            optionalString (peer.endpoint != null) " endpoint ${peer.endpoint}" +
-            optionalString (peer.persistentKeepalive != null) " persistent-keepalive ${toString peer.persistentKeepalive}" +
-            optionalString (peer.allowedIPs != []) " allowed-ips ${concatStringsSep "," peer.allowedIPs}"
-            ) values.peers)
-
-            "${ipCommand} link set up dev ${name}"
-
-            (optionals (values.allowedIPsAsRoutes != false) (map (peer:
-            (map (allowedIP:
-            "${ipCommand} route replace ${allowedIP} dev ${name} table ${values.table}"
-            ) peer.allowedIPs)
-            ) values.peers))
-
-            values.postSetup
-          ]);
-          ExecStop = flatten([
-            "${ipCommand} link del dev ${name}"
-            values.postShutdown
-          ]);
-        };
+              "wg set ${name} peer ${peer.publicKey}" +
+              optionalString (psk != null) " preshared-key ${psk}" +
+              optionalString (peer.endpoint != null) " endpoint ${peer.endpoint}" +
+              optionalString (peer.persistentKeepalive != null) " persistent-keepalive ${toString peer.persistentKeepalive}" +
+              optionalString (peer.allowedIPs != []) " allowed-ips ${concatStringsSep "," peer.allowedIPs}"
+            ) values.peers}
+
+          ip link set up dev ${name}
+
+          ${optionalString (values.allowedIPsAsRoutes != false) (concatStringsSep "\n" (concatMap (peer:
+              (map (allowedIP:
+                "ip route replace ${allowedIP} dev ${name} table ${values.table}"
+              ) peer.allowedIPs)
+            ) values.peers))}
+
+          ${values.postSetup}
+        '';
+
+        preStop = ''
+          ip link del dev ${name}
+          ${values.postShutdown}
+        '';
       };
 
 in
diff --git a/pkgs/applications/altcoins/bitcoin-unlimited.nix b/pkgs/applications/altcoins/bitcoin-unlimited.nix
index d9040377ebe3..5a67dc565aa7 100644
--- a/pkgs/applications/altcoins/bitcoin-unlimited.nix
+++ b/pkgs/applications/altcoins/bitcoin-unlimited.nix
@@ -1,6 +1,7 @@
 { stdenv, fetchFromGitHub, pkgconfig, autoreconfHook, openssl, db48, boost
 , zlib, miniupnpc, qt4, utillinux, protobuf, qrencode, libevent
-, withGui }:
+, withGui
+, Foundation, ApplicationServices, AppKit }:
 
 with stdenv.lib;
 
@@ -19,7 +20,8 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig autoreconfHook ];
   buildInputs = [ openssl db48 boost zlib
                   miniupnpc utillinux protobuf libevent ]
-                  ++ optionals withGui [ qt4 qrencode ];
+                  ++ optionals withGui [ qt4 qrencode ]
+                  ++ optionals stdenv.isDarwin [ Foundation ApplicationServices AppKit ];
 
   patches = [
     ./bitcoin-unlimited-const-comparators.patch
@@ -36,7 +38,7 @@ stdenv.mkDerivation rec {
       completely decentralized, without the need for a central server or trusted
       parties. Users hold the crypto keys to their own money and transact directly
       with each other, with the help of a P2P network to check for double-spending.
-      
+
       The Bitcoin Unlimited (BU) project seeks to provide a voice to all
       stakeholders in the Bitcoin ecosystem.
 
@@ -55,7 +57,7 @@ stdenv.mkDerivation rec {
 
       If you support an increase in the blocksize limit by any means - or just
       support Bitcoin conflict resolution as originally envisioned by its founder -
-      consider running a Bitcoin Unlimited client.      
+      consider running a Bitcoin Unlimited client.
     '';
     homepage = https://www.bitcoinunlimited.info/;
     maintainers = with maintainers; [ DmitryTsygankov ];
diff --git a/pkgs/applications/altcoins/bitcoin-xt.nix b/pkgs/applications/altcoins/bitcoin-xt.nix
index ccc55d17bcf6..feb2924f8651 100644
--- a/pkgs/applications/altcoins/bitcoin-xt.nix
+++ b/pkgs/applications/altcoins/bitcoin-xt.nix
@@ -1,6 +1,7 @@
 { stdenv, fetchFromGitHub, pkgconfig, autoreconfHook, openssl, db48, boost
 , zlib, miniupnpc, qt4, utillinux, protobuf, qrencode, curl, libevent
-, withGui }:
+, withGui
+, Foundation, ApplicationServices, AppKit }:
 
 with stdenv.lib;
 stdenv.mkDerivation rec{
@@ -18,7 +19,8 @@ stdenv.mkDerivation rec{
   nativeBuildInputs = [ pkgconfig autoreconfHook ];
   buildInputs = [ openssl db48 boost zlib libevent
                   miniupnpc utillinux protobuf curl ]
-                  ++ optionals withGui [ qt4 qrencode ];
+                  ++ optionals withGui [ qt4 qrencode ]
+                  ++ optionals stdenv.isDarwin [ Foundation ApplicationServices AppKit ];
 
   configureFlags = [
     "--with-boost-libdir=${boost.out}/lib"
@@ -36,7 +38,7 @@ stdenv.mkDerivation rec{
       Bitcoin XT is an implementation of a Bitcoin full node, based upon the
       source code of Bitcoin Core. It is built by taking the latest stable
       Core release, applying a series of patches, and then doing deterministic
-      builds so anyone can check the downloads correspond to the source code. 
+      builds so anyone can check the downloads correspond to the source code.
     '';
     homepage = https://bitcoinxt.software/;
     maintainers = with maintainers; [ jefdaj ];
diff --git a/pkgs/applications/altcoins/default.nix b/pkgs/applications/altcoins/default.nix
index 174ff96a1247..c58178e3edbb 100644
--- a/pkgs/applications/altcoins/default.nix
+++ b/pkgs/applications/altcoins/default.nix
@@ -10,14 +10,26 @@ rec {
   bitcoin-abc  = libsForQt5.callPackage ./bitcoin-abc.nix { boost = boost165; withGui = true; };
   bitcoind-abc = callPackage ./bitcoin-abc.nix { boost = boost165; withGui = false; };
 
-  bitcoin-unlimited  = callPackage ./bitcoin-unlimited.nix { withGui = true; };
-  bitcoind-unlimited = callPackage ./bitcoin-unlimited.nix { withGui = false; };
+  bitcoin-unlimited  = callPackage ./bitcoin-unlimited.nix {
+    inherit (darwin.apple_sdk.frameworks) Foundation ApplicationServices AppKit;
+    withGui = true;
+  };
+  bitcoind-unlimited = callPackage ./bitcoin-unlimited.nix {
+    inherit (darwin.apple_sdk.frameworks) Foundation ApplicationServices AppKit;
+    withGui = false;
+  };
 
   bitcoin-classic  = libsForQt5.callPackage ./bitcoin-classic.nix { boost = boost165; withGui = true; };
   bitcoind-classic = callPackage ./bitcoin-classic.nix { boost = boost165; withGui = false; };
 
-  bitcoin-xt  = callPackage ./bitcoin-xt.nix { boost = boost165; withGui = true; };
-  bitcoind-xt = callPackage ./bitcoin-xt.nix { boost = boost165; withGui = false; };
+  bitcoin-xt  = callPackage ./bitcoin-xt.nix {
+    inherit (darwin.apple_sdk.frameworks) Foundation ApplicationServices AppKit;
+    boost = boost165; withGui = true;
+  };
+  bitcoind-xt = callPackage ./bitcoin-xt.nix {
+    inherit (darwin.apple_sdk.frameworks) Foundation ApplicationServices AppKit;
+    boost = boost165; withGui = false;
+  };
 
   btc1 = callPackage ./btc1.nix { boost = boost165; withGui = true; };
   btc1d = callPackage ./btc1.nix { boost = boost165; withGui = false; };
diff --git a/pkgs/applications/audio/cdparanoia/default.nix b/pkgs/applications/audio/cdparanoia/default.nix
index d4d302f07d21..760b04bef005 100644
--- a/pkgs/applications/audio/cdparanoia/default.nix
+++ b/pkgs/applications/audio/cdparanoia/default.nix
@@ -17,7 +17,8 @@ stdenv.mkDerivation rec {
       url = "https://trac.macports.org/export/70964/trunk/dports/audio/cdparanoia/files/patch-paranoia_paranoia.c.10.4.diff";
       sha256 = "17l2qhn8sh4jy6ryy5si6ll6dndcm0r537rlmk4a6a8vkn852vad";
     })
-  ] ++ stdenv.lib.optional stdenv.hostPlatform.isMusl ./utils.patch;
+    ] ++ stdenv.lib.optional stdenv.hostPlatform.isMusl ./utils.patch
+    ++ [./fix_private_keyword.patch];
 
   buildInputs = stdenv.lib.optional stdenv.isAarch64 autoreconfHook;
 
diff --git a/pkgs/applications/audio/cdparanoia/fix_private_keyword.patch b/pkgs/applications/audio/cdparanoia/fix_private_keyword.patch
new file mode 100644
index 000000000000..3e9cbe2bd8c2
--- /dev/null
+++ b/pkgs/applications/audio/cdparanoia/fix_private_keyword.patch
@@ -0,0 +1,468 @@
+--- cdparanoia-III-10.2/interface/cdda_interface.h	(revision 15337)
++++ cdparanoia-III-10.2/interface/cdda_interface.h	(revision 15338)
+@@ -85,5 +85,5 @@
+   int is_mmc;
+ 
+-  cdda_private_data_t *private;
++  cdda_private_data_t *private_data;
+   void         *reserved;
+   unsigned char inqbytes[4];
+--- cdparanoia-III-10.2/interface/cooked_interface.c	(revision 15337)
++++ cdparanoia-III-10.2/interface/cooked_interface.c	(revision 15338)
+@@ -14,11 +14,11 @@
+   struct timespec tv1;
+   struct timespec tv2;
+-  int ret1=clock_gettime(d->private->clock,&tv1);
++  int ret1=clock_gettime(d->private_data->clock,&tv1);
+   int ret2=ioctl(fd, command,arg);
+-  int ret3=clock_gettime(d->private->clock,&tv2);
++  int ret3=clock_gettime(d->private_data->clock,&tv2);
+   if(ret1<0 || ret3<0){
+-    d->private->last_milliseconds=-1;
++    d->private_data->last_milliseconds=-1;
+   }else{
+-    d->private->last_milliseconds = (tv2.tv_sec-tv1.tv_sec)*1000. + (tv2.tv_nsec-tv1.tv_nsec)/1000000.;
++    d->private_data->last_milliseconds = (tv2.tv_sec-tv1.tv_sec)*1000. + (tv2.tv_nsec-tv1.tv_nsec)/1000000.;
+   }
+   return ret2;
+--- cdparanoia-III-10.2/interface/interface.c	(revision 15337)
++++ cdparanoia-III-10.2/interface/interface.c	(revision 15338)
+@@ -40,7 +40,7 @@
+     if(d->cdda_fd!=-1)close(d->cdda_fd);
+     if(d->ioctl_fd!=-1 && d->ioctl_fd!=d->cdda_fd)close(d->ioctl_fd);
+-    if(d->private){
+-      if(d->private->sg_hd)free(d->private->sg_hd);
+-      free(d->private);
++    if(d->private_data){
++      if(d->private_data->sg_hd)free(d->private_data->sg_hd);
++      free(d->private_data);
+     }
+ 
+@@ -128,5 +128,5 @@
+       }	
+     }
+-    if(ms)*ms=d->private->last_milliseconds;
++    if(ms)*ms=d->private_data->last_milliseconds;
+     return(sectors);
+   }
+--- cdparanoia-III-10.2/interface/scan_devices.c	(revision 15337)
++++ cdparanoia-III-10.2/interface/scan_devices.c	(revision 15338)
+@@ -265,9 +265,9 @@
+   d->bigendianp=-1; /* We don't know yet... */
+   d->nsectors=-1;
+-  d->private=calloc(1,sizeof(*d->private));
++  d->private_data=calloc(1,sizeof(*d->private_data));
+   {
+     /* goddamnit */
+     struct timespec tv;
+-    d->private->clock=(clock_gettime(CLOCK_MONOTONIC,&tv)<0?CLOCK_REALTIME:CLOCK_MONOTONIC);
++    d->private_data->clock=(clock_gettime(CLOCK_MONOTONIC,&tv)<0?CLOCK_REALTIME:CLOCK_MONOTONIC);
+   }
+   idmessage(messagedest,messages,"\t\tCDROM sensed: %s\n",description);
+@@ -675,13 +675,13 @@
+   d->nsectors=-1;
+   d->messagedest = messagedest;
+-  d->private=calloc(1,sizeof(*d->private));
++  d->private_data=calloc(1,sizeof(*d->private_data));
+   {
+     /* goddamnit */
+     struct timespec tv;
+-    d->private->clock=(clock_gettime(CLOCK_MONOTONIC,&tv)<0?CLOCK_REALTIME:CLOCK_MONOTONIC);
++    d->private_data->clock=(clock_gettime(CLOCK_MONOTONIC,&tv)<0?CLOCK_REALTIME:CLOCK_MONOTONIC);
+   }
+   if(use_sgio){
+     d->interface=SGIO_SCSI;
+-    d->private->sg_buffer=(unsigned char *)(d->private->sg_hd=malloc(MAX_BIG_BUFF_SIZE));
++    d->private_data->sg_buffer=(unsigned char *)(d->private_data->sg_hd=malloc(MAX_BIG_BUFF_SIZE));
+     g_fd=d->cdda_fd=dup(d->ioctl_fd);
+   }else{
+@@ -697,6 +697,6 @@
+ 
+     /* malloc our big buffer for scsi commands */
+-    d->private->sg_hd=malloc(MAX_BIG_BUFF_SIZE);
+-    d->private->sg_buffer=((unsigned char *)d->private->sg_hd)+SG_OFF;
++    d->private_data->sg_hd=malloc(MAX_BIG_BUFF_SIZE);
++    d->private_data->sg_buffer=((unsigned char *)d->private_data->sg_hd)+SG_OFF;
+   }
+ 
+@@ -773,7 +773,7 @@
+   if(g_fd!=-1)close(g_fd);
+   if(d){
+-    if(d->private){
+-      if(d->private->sg_hd)free(d->private->sg_hd);
+-      free(d->private);
++    if(d->private_data){
++      if(d->private_data->sg_hd)free(d->private_data->sg_hd);
++      free(d->private_data);
+     }
+     free(d);
+@@ -822,5 +822,5 @@
+   d->bigendianp=-1; /* We don't know yet... */
+   d->nsectors=-1;
+-  d->private=calloc(1,sizeof(*d->private));
++  d->private_data=calloc(1,sizeof(*d->private_data));
+   d->drive_model=copystring("File based test interface");
+   idmessage(messagedest,messages,"\t\tCDROM sensed: %s\n",d->drive_model);
+--- cdparanoia-III-10.2/interface/scsi_interface.c	(revision 15337)
++++ cdparanoia-III-10.2/interface/scsi_interface.c	(revision 15338)
+@@ -16,11 +16,11 @@
+   struct timespec tv1;
+   struct timespec tv2;
+-  int ret1=clock_gettime(d->private->clock,&tv1);
++  int ret1=clock_gettime(d->private_data->clock,&tv1);
+   int ret2=ioctl(fd, command,arg);
+-  int ret3=clock_gettime(d->private->clock,&tv2);
++  int ret3=clock_gettime(d->private_data->clock,&tv2);
+   if(ret1<0 || ret3<0){
+-    d->private->last_milliseconds=-1;
++    d->private_data->last_milliseconds=-1;
+   }else{
+-    d->private->last_milliseconds = (tv2.tv_sec-tv1.tv_sec)*1000. + (tv2.tv_nsec-tv1.tv_nsec)/1000000.;
++    d->private_data->last_milliseconds = (tv2.tv_sec-tv1.tv_sec)*1000. + (tv2.tv_nsec-tv1.tv_nsec)/1000000.;
+   }
+   return ret2;
+@@ -97,5 +97,5 @@
+   fd_set fdset;
+   struct timeval tv;
+-  struct sg_header *sg_hd=d->private->sg_hd;
++  struct sg_header *sg_hd=d->private_data->sg_hd;
+   int flag=0;
+ 
+@@ -186,5 +186,5 @@
+   int tret1,tret2;
+   int status = 0;
+-  struct sg_header *sg_hd=d->private->sg_hd;
++  struct sg_header *sg_hd=d->private_data->sg_hd;
+   long writebytes=SG_OFF+cmd_len+in_size;
+ 
+@@ -196,5 +196,5 @@
+   memset(sg_hd,0,sizeof(sg_hd)); 
+   memset(sense_buffer,0,SG_MAX_SENSE); 
+-  memcpy(d->private->sg_buffer,cmd,cmd_len+in_size);
++  memcpy(d->private_data->sg_buffer,cmd,cmd_len+in_size);
+   sg_hd->twelve_byte = cmd_len == 12;
+   sg_hd->result = 0;
+@@ -210,5 +210,5 @@
+ 
+   if(bytecheck && out_size>in_size){
+-    memset(d->private->sg_buffer+cmd_len+in_size,bytefill,out_size-in_size); 
++    memset(d->private_data->sg_buffer+cmd_len+in_size,bytefill,out_size-in_size); 
+     /* the size does not remove cmd_len due to the way the kernel
+        driver copies buffers */
+@@ -244,5 +244,5 @@
+ 
+   sigprocmask (SIG_BLOCK, &(d->sigset), NULL );
+-  tret1=clock_gettime(d->private->clock,&tv1);  
++  tret1=clock_gettime(d->private_data->clock,&tv1);  
+   errno=0;
+   status = write(d->cdda_fd, sg_hd, writebytes );
+@@ -290,5 +290,5 @@
+   }
+ 
+-  tret2=clock_gettime(d->private->clock,&tv2);  
++  tret2=clock_gettime(d->private_data->clock,&tv2);  
+   errno=0;
+   status = read(d->cdda_fd, sg_hd, SG_OFF + out_size);
+@@ -314,5 +314,5 @@
+     long i,flag=0;
+     for(i=in_size;i<out_size;i++)
+-      if(d->private->sg_buffer[i]!=bytefill){
++      if(d->private_data->sg_buffer[i]!=bytefill){
+ 	flag=1;
+ 	break;
+@@ -327,7 +327,7 @@
+   errno=0;
+   if(tret1<0 || tret2<0){
+-    d->private->last_milliseconds=-1;
++    d->private_data->last_milliseconds=-1;
+   }else{
+-    d->private->last_milliseconds = (tv2.tv_sec-tv1.tv_sec)*1000 + (tv2.tv_nsec-tv1.tv_nsec)/1000000;
++    d->private_data->last_milliseconds = (tv2.tv_sec-tv1.tv_sec)*1000 + (tv2.tv_nsec-tv1.tv_nsec)/1000000;
+   }
+   return(0);
+@@ -348,5 +348,5 @@
+   memset(&hdr,0,sizeof(hdr));
+   memset(sense,0,sizeof(sense));
+-  memcpy(d->private->sg_buffer,cmd+cmd_len,in_size);
++  memcpy(d->private_data->sg_buffer,cmd+cmd_len,in_size);
+ 
+   hdr.cmdp = cmd;
+@@ -356,5 +356,5 @@
+   hdr.timeout = 50000;
+   hdr.interface_id = 'S';
+-  hdr.dxferp =  d->private->sg_buffer;
++  hdr.dxferp =  d->private_data->sg_buffer;
+   hdr.flags = SG_FLAG_DIRECT_IO;  /* direct IO if we can get it */
+ 
+@@ -401,5 +401,5 @@
+     long i,flag=0;
+     for(i=in_size;i<out_size;i++)
+-      if(d->private->sg_buffer[i]!=bytefill){
++      if(d->private_data->sg_buffer[i]!=bytefill){
+ 	flag=1;
+ 	break;
+@@ -413,5 +413,5 @@
+ 
+   /* Can't rely on .duration because we can't be certain kernel has HZ set to something useful */
+-  /* d->private->last_milliseconds = hdr.duration; */
++  /* d->private_data->last_milliseconds = hdr.duration; */
+ 
+   errno = 0;
+@@ -446,7 +446,7 @@
+   handle_scsi_cmd(d, cmd, 6, 0, 56, 0,0, sense);
+ 
+-  key = d->private->sg_buffer[2] & 0xf;
+-  ASC = d->private->sg_buffer[12];
+-  ASCQ = d->private->sg_buffer[13];
++  key = d->private_data->sg_buffer[2] & 0xf;
++  ASC = d->private_data->sg_buffer[12];
++  ASCQ = d->private_data->sg_buffer[13];
+   
+   if(key == 2 && ASC == 4 && ASCQ == 1) return 0;
+@@ -493,5 +493,5 @@
+ 
+   {
+-    unsigned char *b=d->private->sg_buffer;
++    unsigned char *b=d->private_data->sg_buffer;
+     if(b[0])return(1); /* Handles only up to 256 bytes */
+     if(b[6])return(1); /* Handles only up to 256 bytes */
+@@ -605,6 +605,6 @@
+   if(mode_sense(d,12,0x01))return(-1);
+ 
+-  d->orgdens = d->private->sg_buffer[4];
+-  return(d->orgsize = ((int)(d->private->sg_buffer[10])<<8)+d->private->sg_buffer[11]);
++  d->orgdens = d->private_data->sg_buffer[4];
++  return(d->orgsize = ((int)(d->private_data->sg_buffer[10])<<8)+d->private_data->sg_buffer[11]);
+ }
+ 
+@@ -665,6 +665,6 @@
+   }
+ 
+-  first=d->private->sg_buffer[2];
+-  last=d->private->sg_buffer[3];
++  first=d->private_data->sg_buffer[2];
++  last=d->private_data->sg_buffer[3];
+   tracks=last-first+1;
+ 
+@@ -684,5 +684,5 @@
+     }
+     {
+-      scsi_TOC *toc=(scsi_TOC *)(d->private->sg_buffer+4);
++      scsi_TOC *toc=(scsi_TOC *)(d->private_data->sg_buffer+4);
+ 
+       d->disc_toc[i-first].bFlags=toc->bFlags;
+@@ -705,5 +705,5 @@
+   }
+   {
+-    scsi_TOC *toc=(scsi_TOC *)(d->private->sg_buffer+4);
++    scsi_TOC *toc=(scsi_TOC *)(d->private_data->sg_buffer+4);
+     
+     d->disc_toc[i-first].bFlags=toc->bFlags;
+@@ -739,5 +739,5 @@
+ 
+   /* copy to our structure and convert start sector */
+-  tracks = d->private->sg_buffer[1];
++  tracks = d->private_data->sg_buffer[1];
+   if (tracks > MAXTRK) {
+     cderror(d,"003: CDROM reporting illegal number of tracks\n");
+@@ -755,31 +755,31 @@
+     }
+     
+-    d->disc_toc[i].bFlags = d->private->sg_buffer[10];
++    d->disc_toc[i].bFlags = d->private_data->sg_buffer[10];
+     d->disc_toc[i].bTrack = i + 1;
+ 
+     d->disc_toc[i].dwStartSector= d->adjust_ssize * 
+-	(((signed char)(d->private->sg_buffer[2])<<24) | 
+-	 (d->private->sg_buffer[3]<<16)|
+-	 (d->private->sg_buffer[4]<<8)|
+-	 (d->private->sg_buffer[5]));
++	(((signed char)(d->private_data->sg_buffer[2])<<24) | 
++	 (d->private_data->sg_buffer[3]<<16)|
++	 (d->private_data->sg_buffer[4]<<8)|
++	 (d->private_data->sg_buffer[5]));
+   }
+ 
+   d->disc_toc[i].bFlags = 0;
+   d->disc_toc[i].bTrack = i + 1;
+-  memcpy (&foo, d->private->sg_buffer+2, 4);
+-  memcpy (&bar, d->private->sg_buffer+6, 4);
++  memcpy (&foo, d->private_data->sg_buffer+2, 4);
++  memcpy (&bar, d->private_data->sg_buffer+6, 4);
+   d->disc_toc[i].dwStartSector = d->adjust_ssize * (be32_to_cpu(foo) +
+ 						    be32_to_cpu(bar));
+ 
+   d->disc_toc[i].dwStartSector= d->adjust_ssize * 
+-    ((((signed char)(d->private->sg_buffer[2])<<24) | 
+-      (d->private->sg_buffer[3]<<16)|
+-      (d->private->sg_buffer[4]<<8)|
+-      (d->private->sg_buffer[5]))+
++    ((((signed char)(d->private_data->sg_buffer[2])<<24) | 
++      (d->private_data->sg_buffer[3]<<16)|
++      (d->private_data->sg_buffer[4]<<8)|
++      (d->private_data->sg_buffer[5]))+
+      
+-     ((((signed char)(d->private->sg_buffer[6])<<24) | 
+-       (d->private->sg_buffer[7]<<16)|
+-       (d->private->sg_buffer[8]<<8)|
+-       (d->private->sg_buffer[9]))));
++     ((((signed char)(d->private_data->sg_buffer[6])<<24) | 
++       (d->private_data->sg_buffer[7]<<16)|
++       (d->private_data->sg_buffer[8]<<8)|
++       (d->private_data->sg_buffer[9]))));
+ 
+ 
+@@ -818,5 +818,5 @@
+   if((ret=handle_scsi_cmd(d,cmd,10,0,sectors * CD_FRAMESIZE_RAW,'\177',1,sense)))
+     return(ret);
+-  if(p)memcpy(p,d->private->sg_buffer,sectors*CD_FRAMESIZE_RAW);
++  if(p)memcpy(p,d->private_data->sg_buffer,sectors*CD_FRAMESIZE_RAW);
+   return(0);
+ }
+@@ -837,5 +837,5 @@
+   if((ret=handle_scsi_cmd(d,cmd,12,0,sectors * CD_FRAMESIZE_RAW,'\177',1,sense)))
+     return(ret);
+-  if(p)memcpy(p,d->private->sg_buffer,sectors*CD_FRAMESIZE_RAW);
++  if(p)memcpy(p,d->private_data->sg_buffer,sectors*CD_FRAMESIZE_RAW);
+   return(0);
+ }
+@@ -855,5 +855,5 @@
+   if((ret=handle_scsi_cmd(d,cmd,10,0,sectors * CD_FRAMESIZE_RAW,'\177',1,sense)))
+     return(ret);
+-  if(p)memcpy(p,d->private->sg_buffer,sectors*CD_FRAMESIZE_RAW);
++  if(p)memcpy(p,d->private_data->sg_buffer,sectors*CD_FRAMESIZE_RAW);
+   return(0);
+ }
+@@ -873,5 +873,5 @@
+   if((ret=handle_scsi_cmd(d,cmd,12,0,sectors * CD_FRAMESIZE_RAW,'\177',1,sense)))
+     return(ret);
+-  if(p)memcpy(p,d->private->sg_buffer,sectors*CD_FRAMESIZE_RAW);
++  if(p)memcpy(p,d->private_data->sg_buffer,sectors*CD_FRAMESIZE_RAW);
+   return(0);
+ }
+@@ -891,5 +891,5 @@
+   if((ret=handle_scsi_cmd(d,cmd,10,0,sectors * CD_FRAMESIZE_RAW,'\177',1,sense)))
+     return(ret);
+-  if(p)memcpy(p,d->private->sg_buffer,sectors*CD_FRAMESIZE_RAW);
++  if(p)memcpy(p,d->private_data->sg_buffer,sectors*CD_FRAMESIZE_RAW);
+   return(0);
+ }
+@@ -909,5 +909,5 @@
+   if((ret=handle_scsi_cmd(d,cmd,12,0,sectors * CD_FRAMESIZE_RAW,'\177',1,sense)))
+     return(ret);
+-  if(p)memcpy(p,d->private->sg_buffer,sectors*CD_FRAMESIZE_RAW);
++  if(p)memcpy(p,d->private_data->sg_buffer,sectors*CD_FRAMESIZE_RAW);
+   return(0);
+ }
+@@ -923,5 +923,5 @@
+   if((ret=handle_scsi_cmd(d,cmd,12,0,sectors * CD_FRAMESIZE_RAW,'\177',1,sense)))
+     return(ret);
+-  if(p)memcpy(p,d->private->sg_buffer,sectors*CD_FRAMESIZE_RAW);
++  if(p)memcpy(p,d->private_data->sg_buffer,sectors*CD_FRAMESIZE_RAW);
+   return(0);
+ }
+@@ -937,5 +937,5 @@
+   if((ret=handle_scsi_cmd(d,cmd,12,0,sectors * CD_FRAMESIZE_RAW,'\177',1,sense)))
+     return(ret);
+-  if(p)memcpy(p,d->private->sg_buffer,sectors*CD_FRAMESIZE_RAW);
++  if(p)memcpy(p,d->private_data->sg_buffer,sectors*CD_FRAMESIZE_RAW);
+   return(0);
+ }
+@@ -951,5 +951,5 @@
+   if((ret=handle_scsi_cmd(d,cmd,12,0,sectors * CD_FRAMESIZE_RAW,'\177',1,sense)))
+     return(ret);
+-  if(p)memcpy(p,d->private->sg_buffer,sectors*CD_FRAMESIZE_RAW);
++  if(p)memcpy(p,d->private_data->sg_buffer,sectors*CD_FRAMESIZE_RAW);
+   return(0);
+ }
+@@ -965,5 +965,5 @@
+   if((ret=handle_scsi_cmd(d,cmd,12,0,sectors * CD_FRAMESIZE_RAW,'\177',1,sense)))
+     return(ret);
+-  if(p)memcpy(p,d->private->sg_buffer,sectors*CD_FRAMESIZE_RAW);
++  if(p)memcpy(p,d->private_data->sg_buffer,sectors*CD_FRAMESIZE_RAW);
+   return(0);
+ }
+@@ -979,5 +979,5 @@
+   if((ret=handle_scsi_cmd(d,cmd,12,0,sectors * CD_FRAMESIZE_RAW,'\177',1,sense)))
+     return(ret);
+-  if(p)memcpy(p,d->private->sg_buffer,sectors*CD_FRAMESIZE_RAW);
++  if(p)memcpy(p,d->private_data->sg_buffer,sectors*CD_FRAMESIZE_RAW);
+   return(0);
+ }
+@@ -993,5 +993,5 @@
+   if((ret=handle_scsi_cmd(d,cmd,12,0,sectors * CD_FRAMESIZE_RAW,'\177',1,sense)))
+     return(ret);
+-  if(p)memcpy(p,d->private->sg_buffer,sectors*CD_FRAMESIZE_RAW);
++  if(p)memcpy(p,d->private_data->sg_buffer,sectors*CD_FRAMESIZE_RAW);
+   return(0);
+ }
+@@ -1027,5 +1027,5 @@
+   if((ret=handle_scsi_cmd(d,cmd,12,0,sectors * CD_FRAMESIZE_RAW,'\177',1,sense)))
+     return(ret);
+-  if(p)memcpy(p,d->private->sg_buffer,sectors*CD_FRAMESIZE_RAW);
++  if(p)memcpy(p,d->private_data->sg_buffer,sectors*CD_FRAMESIZE_RAW);
+   return(0);
+ }
+@@ -1040,5 +1040,5 @@
+   if((ret=handle_scsi_cmd(d,cmd,12,0,sectors * CD_FRAMESIZE_RAW,'\177',1,sense)))
+     return(ret);
+-  if(p)memcpy(p,d->private->sg_buffer,sectors*CD_FRAMESIZE_RAW);
++  if(p)memcpy(p,d->private_data->sg_buffer,sectors*CD_FRAMESIZE_RAW);
+   return(0);
+ }
+@@ -1053,5 +1053,5 @@
+   if((ret=handle_scsi_cmd(d,cmd,12,0,sectors * CD_FRAMESIZE_RAW,'\177',1,sense)))
+     return(ret);
+-  if(p)memcpy(p,d->private->sg_buffer,sectors*CD_FRAMESIZE_RAW);
++  if(p)memcpy(p,d->private_data->sg_buffer,sectors*CD_FRAMESIZE_RAW);
+   return(0);
+ }
+@@ -1276,5 +1276,5 @@
+   long i;
+   for(i=2351;i>=0;i--)
+-    if(d->private->sg_buffer[i]!=(unsigned char)'\177')
++    if(d->private_data->sg_buffer[i]!=(unsigned char)'\177')
+       return(((i+3)>>2)<<2);
+ 
+@@ -1285,5 +1285,5 @@
+   long i,flag=0;
+   for(i=0;i<2352;i++)
+-    if(d->private->sg_buffer[i]!=0){
++    if(d->private_data->sg_buffer[i]!=0){
+       flag=1;
+       break;
+@@ -1622,5 +1622,5 @@
+   if(mode_sense(d,22,0x2A)==0){
+   
+-    b=d->private->sg_buffer;
++    b=d->private_data->sg_buffer;
+     b+=b[3]+4;
+     
+@@ -1670,5 +1670,5 @@
+     return(NULL);
+   }
+-  return (d->private->sg_buffer);
++  return (d->private_data->sg_buffer);
+ }
+ 
+@@ -1726,6 +1726,6 @@
+ 
+   d->error_retry=1;
+-  d->private->sg_hd=realloc(d->private->sg_hd,d->nsectors*CD_FRAMESIZE_RAW + SG_OFF + 128);
+-  d->private->sg_buffer=((unsigned char *)d->private->sg_hd)+SG_OFF;
++  d->private_data->sg_hd=realloc(d->private_data->sg_hd,d->nsectors*CD_FRAMESIZE_RAW + SG_OFF + 128);
++  d->private_data->sg_buffer=((unsigned char *)d->private_data->sg_hd)+SG_OFF;
+   d->report_all=1;
+   return(0);
+--- cdparanoia-III-10.2/interface/test_interface.c	(revision 15337)
++++ cdparanoia-III-10.2/interface/test_interface.c	(revision 15338)
+@@ -67,7 +67,7 @@
+ 
+   if(begin<lastread)
+-    d->private->last_milliseconds=20;
++    d->private_data->last_milliseconds=20;
+   else
+-    d->private->last_milliseconds=sectors;
++    d->private_data->last_milliseconds=sectors;
+ 
+ #ifdef CDDA_TEST_UNDERRUN
diff --git a/pkgs/applications/editors/android-studio/default.nix b/pkgs/applications/editors/android-studio/default.nix
index e18235024df4..75385275ec84 100644
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@@ -8,14 +8,14 @@ let
     inherit (gnome2) GConf gnome_vfs;
   };
   stableVersion = {
-    version = "3.1.1.0"; # "Android Studio 3.1.1"
-    build = "173.4697961";
-    sha256Hash = "0xn02miq2hz7666mziza56pfqw9sjflgvn88ds7j5yd4rlcr0lq8";
+    version = "3.1.2.0"; # "Android Studio 3.1.2"
+    build = "173.4720617";
+    sha256Hash = "1h9f4pkyqxkqxampi8v035czg5d4g6lp4bsrnq5mgpwhjwkr1whk";
   };
   latestVersion = {
-    version = "3.2.0.10"; # "Android Studio 3.2 Canary 11"
-    build = "181.4720098";
-    sha256Hash = "00cd7qdznspi69cgs1a13a3fnkvsc7zjfl517jgp32vdygkb0qxw";
+    version = "3.2.0.11"; # "Android Studio 3.2 Canary 12"
+    build = "181.4729833";
+    sha256Hash = "1b976m59d230pl35ajhdic46cw8qmnykkbrg3l7am7zmih0zk64c";
   };
 in rec {
   # Old alias
diff --git a/pkgs/applications/misc/gphoto2/default.nix b/pkgs/applications/misc/gphoto2/default.nix
index 77e7b592f647..5131e0739e73 100644
--- a/pkgs/applications/misc/gphoto2/default.nix
+++ b/pkgs/applications/misc/gphoto2/default.nix
@@ -3,11 +3,11 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "gphoto2-2.5.15";
+  name = "gphoto2-2.5.17";
 
   src = fetchurl {
     url = "mirror://sourceforge/gphoto/${name}.tar.bz2";
-    sha256 = "0xsa12k5fz49v8y4h3zahzr427a3ylxaf0k7hybrkp43g4i1lmxf";
+    sha256 = "0kslwclyyzvnxjw3gdzhlagj7l5f8lba833ipr9s0s0c4hwi0mxa";
   };
 
   nativeBuildInputs = [ pkgconfig gettext libtool ];
diff --git a/pkgs/applications/misc/urh/default.nix b/pkgs/applications/misc/urh/default.nix
index d2463616d677..fa2f16166446 100644
--- a/pkgs/applications/misc/urh/default.nix
+++ b/pkgs/applications/misc/urh/default.nix
@@ -2,13 +2,13 @@
 
 python3Packages.buildPythonApplication rec {
   name = "urh-${version}";
-  version = "2.0.1";
+  version = "2.0.2";
 
   src = fetchFromGitHub {
     owner = "jopohl";
     repo = "urh";
     rev = "v${version}";
-    sha256 = "0mnnrxm49s77s1qg7zbfciw0525ipsl010sciqdw8a22jg1rfjh8";
+    sha256 = "1qqb31y65rd85rf3gvxxxy06hm89ary00km1ac84qz5bwm6n5fyb";
   };
 
   buildInputs = [ hackrf rtl-sdr ];
diff --git a/pkgs/applications/networking/browsers/firefox/wrapper.nix b/pkgs/applications/networking/browsers/firefox/wrapper.nix
index 8f07415db5f2..45917bf65c1e 100644
--- a/pkgs/applications/networking/browsers/firefox/wrapper.nix
+++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix
@@ -132,8 +132,10 @@ let
         else
             for res in 16 32 48 64 128; do
             mkdir -p "$out/share/icons/hicolor/''${res}x''${res}/apps"
-            ln -s "${browser}/lib/"*"/browser/chrome/icons/default/default''${res}.png" \
+            icon=( "${browser}/lib/"*"/browser/chrome/icons/default/default''${res}.png" )
+              if [ -e "$icon" ]; then ln -s "$icon" \
                 "$out/share/icons/hicolor/''${res}x''${res}/apps/${browserName}.png"
+              fi
             done
         fi
 
diff --git a/pkgs/applications/networking/cluster/spark/default.nix b/pkgs/applications/networking/cluster/spark/default.nix
index 2b36d7c5647a..6401194eac20 100644
--- a/pkgs/applications/networking/cluster/spark/default.nix
+++ b/pkgs/applications/networking/cluster/spark/default.nix
@@ -1,20 +1,16 @@
-{ stdenv, fetchzip, makeWrapper, jre, pythonPackages, coreutils
+{ stdenv, fetchzip, makeWrapper, jre, pythonPackages, coreutils, hadoop
 , RSupport? true, R
 , mesosSupport ? true, mesos
 , version
 }:
 
 let
-  versionMap = {
-    "2.2.1" = {
-                hadoopVersion = "hadoop2.7";
-                sparkSha256 = "10nxsf9a6hj1263sxv0cbdqxdb8mb4cl6iqq32ljq9ydvk32s99c";
-              };
-  };
+  sha256 = {
+    "1.6.3" = "142hw73wf20d846l83ydx0yg7qj5qxywm4h7qrhwnd7lsy2sbnjf";
+    "2.2.1" = "10nxsf9a6hj1263sxv0cbdqxdb8mb4cl6iqq32ljq9ydvk32s99c";
+  }.${version};
 in
 
-with versionMap.${version};
-
 with stdenv.lib;
 
 stdenv.mkDerivation rec {
@@ -22,15 +18,15 @@ stdenv.mkDerivation rec {
   name = "spark-${version}";
 
   src = fetchzip {
-    url    = "mirror://apache/spark/${name}/${name}-bin-${hadoopVersion}.tgz";
-    sha256 = sparkSha256;
+    inherit sha256;
+    url    = "mirror://apache/spark/${name}/${name}-bin-without-hadoop.tgz";
   };
 
   buildInputs = [ makeWrapper jre pythonPackages.python pythonPackages.numpy ]
     ++ optional RSupport R
     ++ optional mesosSupport mesos;
 
-  untarDir = "${name}-bin-${hadoopVersion}";
+  untarDir = "${name}-bin-without-hadoop";
   installPhase = ''
     mkdir -p $out/{lib/${untarDir}/conf,bin,/share/java}
     mv * $out/lib/${untarDir}
@@ -42,6 +38,7 @@ stdenv.mkDerivation rec {
     cat > $out/lib/${untarDir}/conf/spark-env.sh <<- EOF
     export JAVA_HOME="${jre}"
     export SPARK_HOME="$out/lib/${untarDir}"
+    export SPARK_DIST_CLASSPATH=$(${hadoop}/bin/hadoop classpath)
     export PYSPARK_PYTHON="${pythonPackages.python}/bin/${pythonPackages.python.executable}"
     export PYTHONPATH="\$PYTHONPATH:$PYTHONPATH"
     ${optionalString RSupport
@@ -63,7 +60,7 @@ stdenv.mkDerivation rec {
     homepage         = "http://spark.apache.org";
     license          = stdenv.lib.licenses.asl20;
     platforms        = stdenv.lib.platforms.all;
-    maintainers      = with maintainers; [ thoughtpolice offline ];
+    maintainers      = with maintainers; [ thoughtpolice offline kamilchm ];
     repositories.git = git://git.apache.org/spark.git;
   };
 }
diff --git a/pkgs/applications/networking/enhanced-ctorrent/default.nix b/pkgs/applications/networking/enhanced-ctorrent/default.nix
index fedbfeb957ce..2cfde73a01a6 100644
--- a/pkgs/applications/networking/enhanced-ctorrent/default.nix
+++ b/pkgs/applications/networking/enhanced-ctorrent/default.nix
@@ -1,13 +1,26 @@
-{ stdenv, fetchurl }:
+{ stdenv, fetchurl, fetchpatch }:
 
 stdenv.mkDerivation rec {
   version = "dnh3.3.2";
   name = "enhanced-ctorrent";
+
   src = fetchurl {
     url = "http://www.rahul.net/dholmes/ctorrent/ctorrent-dnh3.3.2.tar.gz";
     sha256 = "0qs8waqwllk56i3yy3zhncy7nsnhmf09a494p5siz4vm2k4ncwy8";
   };
 
+  # These patches come from Debian and fix CVE-2009-1759.
+  patches = [
+    (fetchpatch {
+      url = "https://sources.debian.org/data/main/c/ctorrent/1.3.4.dnh3.3.2-5/debian/patches/cve-security-fix.diff";
+      sha256 = "1qkzzm8sfspbcs10azmmif4qcr7pr8r38dsa2py84lsjm1yi3kls";
+    })
+    (fetchpatch {
+      url = "https://sources.debian.org/data/main/c/ctorrent/1.3.4.dnh3.3.2-5/debian/patches/FTBFS-fix.diff";
+      sha256 = "1m3zh96xwqjjzsbg62f7kx0miams58nys1f484qhdn870b5x9p06";
+    })
+  ];
+
   meta = {
     description = "BitTorrent client written in C++";
     longDescription = ''
diff --git a/pkgs/applications/office/todo.txt-cli/default.nix b/pkgs/applications/office/todo.txt-cli/default.nix
index faecc3f4227b..77a602954438 100644
--- a/pkgs/applications/office/todo.txt-cli/default.nix
+++ b/pkgs/applications/office/todo.txt-cli/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl }:
 let
-  version = "2.10";
+  version = "2.11.0";
 in stdenv.mkDerivation {
   name = "todo.txt-cli-${version}";
 
   src = fetchurl {
     url = "https://github.com/ginatrapani/todo.txt-cli/releases/download/v${version}/todo.txt_cli-${version}.tar.gz";
-    sha256 = "1agn4zzbizrrylvbfi053b5mpb39bvl1gzziw08xibzfdyi1g55m";
+    sha256 = "0majx8lcvhh8ji54qi0sxr833wchdss95fjc92byd8g3lfz27rsz";
   };
 
   installPhase = ''
diff --git a/pkgs/applications/science/math/calc/default.nix b/pkgs/applications/science/math/calc/default.nix
index efd38f053451..9d95960bde27 100644
--- a/pkgs/applications/science/math/calc/default.nix
+++ b/pkgs/applications/science/math/calc/default.nix
@@ -1,47 +1,49 @@
-{ stdenv, fetchurl, makeWrapper, glibc, readline, ncurses, utillinux }:
+{ stdenv, lib, fetchurl, utillinux, makeWrapper
+, enableReadline ? true, readline, ncurses }:
 
-with stdenv.lib;
-let
-  makeFlags = ''
-    INCDIR=${glibc.dev}/include \
-    BINDIR=$out/bin LIBDIR=$out/lib CALC_INCDIR=$out/include/calc CALC_SHAREDIR=$out/share/calc MANDIR=$out/share/man/man1 \
-    USE_READLINE=-DUSE_READLINE READLINE_LIB=-lreadline READLINE_EXTRAS='-lhistory -lncurses' \
-    TERMCONTROL=-DUSE_TERMIOS \
-  '';
-in
 stdenv.mkDerivation rec {
-
   name = "calc-${version}";
   version = "2.12.6.6";
 
   src = fetchurl {
-    url = "https://github.com/lcn2/calc/releases/download/${version}/${name}.tar.bz2";
+    urls = [
+      "https://github.com/lcn2/calc/releases/download/${version}/${name}.tar.bz2"
+      "http://www.isthe.com/chongo/src/calc/${name}.tar.bz2"
+    ];
     sha256 = "03sg1xhin6qsrz82scf96mmzw8lz1yj68rhj4p4npp4s0fawc9d5";
   };
 
-  buildInputs = [ makeWrapper readline ncurses utillinux ];
-
-  configurePhase = ''
-    sed -i 's/all: check_include/all:/' Makefile
-  '';
-
-  buildPhase = ''
-    make ${makeFlags}
-  '';
-
-  installPhase = ''
-    make install ${makeFlags}
-    wrapProgram $out/bin/calc --prefix LD_LIBRARY_PATH : $out/lib
+  patchPhase = ''
+    substituteInPlace Makefile \
+      --replace 'all: check_include' 'all:' \
+      --replace '-install_name ''${LIBDIR}/libcalc''${LIB_EXT_VERSION}' '-install_name ''${T}''${LIBDIR}/libcalc''${LIB_EXT_VERSION}' \
+      --replace '-install_name ''${LIBDIR}/libcustcalc''${LIB_EXT_VERSION}' '-install_name ''${T}''${LIBDIR}/libcustcalc''${LIB_EXT_VERSION}'
   '';
 
-  # Hack to avoid TMPDIR in RPATHs.
-  preFixup = ''rm -rf "$(pwd)" '';
-
-  meta = {
+  buildInputs = [ utillinux makeWrapper ]
+             ++ lib.optionals enableReadline [ readline ncurses ];
+
+  makeFlags = [
+    "T=$(out)"
+    "INCDIR=${lib.getDev stdenv.cc.libc}/include"
+    "BINDIR=/bin"
+    "LIBDIR=/lib"
+    "CALC_SHAREDIR=/share/calc"
+    "CALC_INCDIR=/include"
+    "MANDIR=/share/man/man1"
+
+    # Handle LDFLAGS defaults in calc
+    "DEFAULT_LIB_INSTALL_PATH=$(out)/lib"
+  ] ++ lib.optionals enableReadline [
+    "READLINE_LIB=-lreadline"
+    "USE_READLINE=-DUSE_READLINE"
+  ];
+
+  meta = with lib; {
     description = "C-style arbitrary precision calculator";
     homepage = http://www.isthe.com/chongo/tech/comp/calc/;
     license = licenses.lgpl21;
-    maintainers = [ ];
+    maintainers = with maintainers; [ matthewbauer ];
     platforms = platforms.all;
   };
 }
diff --git a/pkgs/applications/science/math/mathematica/default.nix b/pkgs/applications/science/math/mathematica/default.nix
index 1c86097f2ee4..9b9d5b250ef6 100644
--- a/pkgs/applications/science/math/mathematica/default.nix
+++ b/pkgs/applications/science/math/mathematica/default.nix
@@ -1,7 +1,7 @@
 { stdenv
 , coreutils
 , patchelf
-, requireFile
+, callPackage
 , alsaLib
 , dbus
 , fontconfig
@@ -18,6 +18,7 @@
 , zlib
 , libxml2
 , libuuid
+, lang ? "en"
 }:
 
 let
@@ -26,21 +27,15 @@ let
       "Linux"
     else
       throw "Mathematica requires i686-linux or x86_64 linux";
+
+  l10n =
+    with stdenv.lib;
+    with callPackage ./l10ns.nix {};
+    flip (findFirst (l: l.lang == lang)) l10ns
+      (throw "Language '${lang}' not supported");
 in
 stdenv.mkDerivation rec {
-  version = "11.2.0";
-
-  name = "mathematica-${version}";
-
-  src = requireFile rec {
-    name = "Mathematica_${version}_LINUX.sh";
-    message = '' 
-      This nix expression requires that ${name} is
-      already part of the store. Find the file on your Mathematica CD
-      and add it to the nix store with nix-store --add-fixed sha256 <FILE>.
-    '';
-    sha256 = "4a1293cc1c404303aa1cab1bd273c7be151d37ac5ed928fbbb18e9c5ab2d8df9";
-  };
+  inherit (l10n) version name src;
 
   buildInputs = [
     coreutils
diff --git a/pkgs/applications/science/math/mathematica/l10ns.nix b/pkgs/applications/science/math/mathematica/l10ns.nix
new file mode 100644
index 000000000000..2158021c7548
--- /dev/null
+++ b/pkgs/applications/science/math/mathematica/l10ns.nix
@@ -0,0 +1,33 @@
+{ lib, requireFile }:
+
+with lib;
+{
+  l10ns = flip map
+  [
+    {
+      version = "11.2.0";
+      lang = "en";
+      language = "English";
+      sha256 = "4a1293cc1c404303aa1cab1bd273c7be151d37ac5ed928fbbb18e9c5ab2d8df9";
+    }
+    {
+      version = "11.2.0";
+      lang = "ja";
+      language = "Japanese";
+      sha256 = "916392edd32bed8622238df435dd8e86426bb043038a3336f30df10d819b49b1";
+    }
+  ]
+  ({ version, lang, language, sha256 }: {
+    inherit version lang;
+    name = "mathematica-${version}" + optionalString (lang != "en") "-${lang}";
+    src = requireFile rec {
+      name = "Mathematica_${version}" + optionalString (lang != "en") "_${language}" + "_LINUX.sh";
+      message = ''
+        This nix expression requires that ${name} is
+        already part of the store. Find the file on your Mathematica CD
+        and add it to the nix store with nix-store --add-fixed sha256 <FILE>.
+      '';
+      inherit sha256;
+    };
+  });
+}
diff --git a/pkgs/applications/video/handbrake/default.nix b/pkgs/applications/video/handbrake/default.nix
index 904401c5e913..6ce2ae08eeb4 100644
--- a/pkgs/applications/video/handbrake/default.nix
+++ b/pkgs/applications/video/handbrake/default.nix
@@ -37,15 +37,13 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     cmake python2 pkgconfig yasm autoconf automake libtool m4
-  ] ++ lib.optionals useGtk [
-    intltool wrapGAppsHook
-  ];
+  ] ++ lib.optionals useGtk [ intltool wrapGAppsHook ];
 
   buildInputs = [
     fribidi fontconfig freetype jansson zlib
     libass libiconv libsamplerate libxml2 bzip2
     libogg libopus libtheora libvorbis libdvdcss a52dec libmkv
-    lame ffmpeg libdvdread libdvdnav libbluray mp4v2 mpeg2dec x264 x265 libvpx
+    lame libdvdread libdvdnav libbluray mp4v2 mpeg2dec x264 x265 libvpx
   ] ++ lib.optionals useGtk [
     glib gtk3 libappindicator-gtk3 libnotify
     gst_all_1.gstreamer gst_all_1.gst-plugins-base dbus-glib udev
@@ -60,8 +58,6 @@ stdenv.mkDerivation rec {
   preConfigure = ''
     patchShebangs scripts
 
-    echo 'TAG=${version}' > version.txt
-
     # `configure` errors out when trying to read the current year which is too low
     substituteInPlace make/configure.py \
       --replace developer release \
@@ -97,13 +93,17 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     homepage = http://handbrake.fr/;
-    description = "A tool for ripping DVDs into video files";
+    description = "A tool for converting video files and ripping DVDs";
     longDescription = ''
-      Handbrake is a versatile transcoding DVD ripper. This package
-      provides the cli HandbrakeCLI and the GTK+ version ghb.
+      Tool for converting and remuxing video files
+      into selection of modern and widely supported codecs
+      and containers. Very versatile and customizable.
+      Package provides:
+      CLI - `HandbrakeCLI`
+      GTK+ GUI - `ghb`
     '';
     license = licenses.gpl2;
-    maintainers = with maintainers; [ wmertens ];
+    maintainers = with maintainers; [ Anton-Latukha wmertens ];
     # Not tested on anything else
     platforms = platforms.linux;
   };
diff --git a/pkgs/applications/virtualization/qemu/default.nix b/pkgs/applications/virtualization/qemu/default.nix
index f5cd661fbecb..a10687141615 100644
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@@ -8,7 +8,7 @@
 , seccompSupport ? stdenv.isLinux, libseccomp
 , pulseSupport ? !stdenv.isDarwin, libpulseaudio
 , sdlSupport ? !stdenv.isDarwin, SDL2
-, gtkSupport ? !xenSupport, gtk3, gettext, gnome3
+, gtkSupport ? !stdenv.isDarwin && !xenSupport, gtk3, gettext, gnome3
 , vncSupport ? true, libjpeg, libpng
 , spiceSupport ? !stdenv.isDarwin, spice, spice-protocol
 , usbredirSupport ? spiceSupport, usbredir
@@ -107,6 +107,8 @@ stdenv.mkDerivation rec {
       "--sysconfdir=/etc"
       "--localstatedir=/var"
     ]
+    # disable sysctl check on darwin.
+    ++ optional stdenv.isDarwin "--cpu=x86_64"
     ++ optional numaSupport "--enable-numa"
     ++ optional seccompSupport "--enable-seccomp"
     ++ optional spiceSupport "--enable-spice"
diff --git a/pkgs/build-support/vm/default.nix b/pkgs/build-support/vm/default.nix
index 8e8b88a9bd2d..08d0a358e61f 100644
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@@ -997,22 +997,22 @@ rec {
     };
 
     debian9i386 = {
-      name = "debian-9.3-stretch-i386";
-      fullName = "Debian 9.3 Stretch (i386)";
+      name = "debian-9.4-stretch-i386";
+      fullName = "Debian 9.4 Stretch (i386)";
       packagesList = fetchurl {
         url = mirror://debian/dists/stretch/main/binary-i386/Packages.xz;
-        sha256 = "1rpv0r92pkr9dmjvpffvgmq3an1s83npfmq870h67jqag3qpwj9l";
+        sha256 = "05z5ccg4ysbrgallhai53sh83i0364w7a3fdq84dpv1li059jf10";
       };
       urlPrefix = mirror://debian;
       packages = commonDebianPackages;
     };
 
     debian9x86_64 = {
-      name = "debian-9.3-stretch-amd64";
-      fullName = "Debian 9.3 Stretch (amd64)";
+      name = "debian-9.4-stretch-amd64";
+      fullName = "Debian 9.4 Stretch (amd64)";
       packagesList = fetchurl {
         url = mirror://debian/dists/stretch/main/binary-amd64/Packages.xz;
-        sha256 = "1gnkvh7wc5yp0rw8kq8p8rlskvl0lc4cv3gdylw8qpqzy75xqlig";
+        sha256 = "19j0c54b1b9lbk9fv2c2aswdh0s2c3klf97zrlmsz4hs8wm9jylq";
       };
       urlPrefix = mirror://debian;
       packages = commonDebianPackages;
diff --git a/pkgs/data/fonts/dejavu-fonts/default.nix b/pkgs/data/fonts/dejavu-fonts/default.nix
index 23158a38f218..251654e2d58d 100644
--- a/pkgs/data/fonts/dejavu-fonts/default.nix
+++ b/pkgs/data/fonts/dejavu-fonts/default.nix
@@ -1,4 +1,4 @@
-{fetchFromGitHub, stdenv, fontforge, perl, FontTTF}:
+{ fetchFromGitHub, stdenv, fontforge, perl, perlPackages }:
 
 let
   version = "2.37";
@@ -25,7 +25,7 @@ let
 
   full-ttf = stdenv.mkDerivation {
     name = "dejavu-fonts-full-${version}";
-    nativeBuildInputs = [fontforge perl FontTTF];
+    nativeBuildInputs = [fontforge perl perlPackages.IOString perlPackages.FontTTF];
 
     src = fetchFromGitHub {
       owner = "dejavu-fonts";
diff --git a/pkgs/development/compilers/ecl/16.1.2.nix b/pkgs/development/compilers/ecl/16.1.2.nix
index 30fee77321f5..b324ec490f1a 100644
--- a/pkgs/development/compilers/ecl/16.1.2.nix
+++ b/pkgs/development/compilers/ecl/16.1.2.nix
@@ -1,9 +1,9 @@
-{stdenv, fetchurl
+{ stdenv, fetchurl, fetchpatch
 , libtool, autoconf, automake
 , gmp, mpfr, libffi, makeWrapper
 , noUnicode ? false
 , gcc
-, threadSupport ? true
+, threadSupport ? false
 }:
 let
   s = # Generated upstream information
@@ -39,6 +39,15 @@ stdenv.mkDerivation {
       "--enable-unicode")
     ;
 
+  patches = [
+    (fetchpatch {
+      # Avoid infinite loop, see https://gitlab.com/embeddable-common-lisp/ecl/issues/43 (fixed upstream)
+      name = "avoid-infinite-loop.patch";
+      url = "https://gitlab.com/embeddable-common-lisp/ecl/commit/caba1989f40ef917e7486f41b9cd5c7e3c5c2d79.patch";
+      sha256 = "07vw91psbc9gdn8grql46ra8lq3bgkzg5v480chnbryna4sv6lbb";
+    })
+  ];
+
   hardeningDisable = [ "format" ];
 
   postInstall = ''
diff --git a/pkgs/development/compilers/ecl/default.nix b/pkgs/development/compilers/ecl/default.nix
index e506e3aace1f..b877ca58e95b 100644
--- a/pkgs/development/compilers/ecl/default.nix
+++ b/pkgs/development/compilers/ecl/default.nix
@@ -53,6 +53,7 @@ stdenv.mkDerivation {
   meta = {
     inherit (s) version;
     description = "Lisp implementation aiming to be small, fast and easy to embed";
+    homepage = https://common-lisp.net/project/ecl/;
     license = stdenv.lib.licenses.mit ;
     maintainers = [stdenv.lib.maintainers.raskin];
     platforms = stdenv.lib.platforms.linux;
diff --git a/pkgs/development/compilers/mono/4.0.nix b/pkgs/development/compilers/mono/4.0.nix
index 8621751e5a14..f13883db74ff 100644
--- a/pkgs/development/compilers/mono/4.0.nix
+++ b/pkgs/development/compilers/mono/4.0.nix
@@ -3,4 +3,7 @@ callPackage ./generic.nix (rec {
   inherit Foundation libobjc;
   version = "4.0.4.1";
   sha256 = "1ydw9l89apc9p7xr5mdzy0h97g2q6v243g82mxswfc2rrqhfs4gd";
+  meta = {
+    knownVulnerabilities = [ "CVE-2009-0689" ];
+  };
 })
diff --git a/pkgs/development/compilers/mono/generic.nix b/pkgs/development/compilers/mono/generic.nix
index 3b476bce0273..a62f2f24dd87 100644
--- a/pkgs/development/compilers/mono/generic.nix
+++ b/pkgs/development/compilers/mono/generic.nix
@@ -5,13 +5,15 @@
 , version, sha256
 , withLLVM ? false
 , enableParallelBuilding ? true
+, meta ? {}
 }:
 
 let
   llvm     = callPackage ./llvm.nix { };
-in
-stdenv.mkDerivation rec {
   name = "mono-${version}";
+in
+stdenv.mkDerivation {
+  inherit name;
 
   src = fetchurl {
     inherit sha256;
@@ -91,5 +93,5 @@ stdenv.mkDerivation rec {
     platforms = stdenv.lib.platforms.x86;
     maintainers = with stdenv.lib.maintainers; [ viric thoughtpolice obadz vrthra ];
     license = stdenv.lib.licenses.free; # Combination of LGPL/X11/GPL ?
-  };
+  } // meta;
 }
diff --git a/pkgs/development/interpreters/eff/default.nix b/pkgs/development/interpreters/eff/default.nix
index 28ea05066c23..258aebe81727 100644
--- a/pkgs/development/interpreters/eff/default.nix
+++ b/pkgs/development/interpreters/eff/default.nix
@@ -1,20 +1,21 @@
-{ stdenv, fetchgit, ocaml, findlib, ocamlbuild, menhir, which }:
+{ stdenv, fetchFromGitHub, which, ocamlPackages }:
 
-let inherit (stdenv.lib) getVersion versionAtLeast; in
-
-assert versionAtLeast (getVersion ocaml) "3.12";
+let version = "5.0"; in
 
 stdenv.mkDerivation {
 
-  name = "eff-20140928";
+  name = "eff-${version}";
 
-  src = fetchgit {
-    url = "https://github.com/matijapretnar/eff.git";
-    rev = "90f884a790fddddb51d4d1d3b7c2edf1e8aabb64";
-    sha256 = "0cqqrpvfw0nrk5d28mkzfvc8yzqxcss0k46bkmqhqjkqq886n2mm";
+  src = fetchFromGitHub {
+    owner = "matijapretnar";
+    repo = "eff";
+    rev = "v${version}";
+    sha256 = "1fslfj5d7fhj3f7kh558b8mk5wllwyq4rnhfkyd96fpy144sdcka";
   };
 
-  buildInputs = [ ocaml findlib ocamlbuild menhir which ];
+  buildInputs = [ which ] ++ (with ocamlPackages; [
+    ocaml findlib ocamlbuild menhir js_of_ocaml js_of_ocaml-ocamlbuild
+  ]);
 
   doCheck = true;
   checkTarget = "test";
@@ -29,7 +30,7 @@ stdenv.mkDerivation {
       backtracking, multi-threading, and much more...
     '';
     license = licenses.bsd2;
-    platforms = ocaml.meta.platforms or [];
+    inherit (ocamlPackages.ocaml.meta) platforms;
     maintainers = [ maintainers.jirkamarsik ];
   };
 }
diff --git a/pkgs/development/interpreters/supercollider/default.nix b/pkgs/development/interpreters/supercollider/default.nix
index 2d3509542135..2737fd6fae04 100644
--- a/pkgs/development/interpreters/supercollider/default.nix
+++ b/pkgs/development/interpreters/supercollider/default.nix
@@ -9,12 +9,12 @@ in
 
 stdenv.mkDerivation rec {
   name = "supercollider-${version}";
-  version = "3.9.2";
+  version = "3.9.3";
 
 
   src = fetchurl {
     url = "https://github.com/supercollider/supercollider/releases/download/Version-${version}/SuperCollider-${version}-Source-linux.tar.bz2";
-    sha256 = "0d3cb6dw8jz7ijriqn3rlwin24gffczp69hl17pzxj1d5w57yj44";
+    sha256 = "1d8ixfl100jvlialxdizp8wqsl1mp5pi2bam25vp97bhjd59cfdr";
   };
 
   hardeningDisable = [ "stackprotector" ];
diff --git a/pkgs/development/libraries/arb/default.nix b/pkgs/development/libraries/arb/default.nix
index c4b37ddb78fd..a59641e99d39 100644
--- a/pkgs/development/libraries/arb/default.nix
+++ b/pkgs/development/libraries/arb/default.nix
@@ -2,15 +2,21 @@
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
   pname = "arb";
-  version = "2.8.1";
+  version = "2.13.0";
   src = fetchFromGitHub {
     owner = "fredrik-johansson";
     repo = "${pname}";
     rev = "${version}";
-    sha256 = "15phk71ci9rr32aqznpkd2b993wjahsgliilkg4mnxsr86nwdf6x";
+    sha256 = "1fl9gmxf6c1cphk5r8jbys5pywj2rfm705kv0055i0aqc6hrv303";
   };
   buildInputs = [mpir gmp mpfr flint];
-  configureFlags = "--with-gmp=${gmp} --with-mpir=${mpir} --with-mpfr=${mpfr} --with-flint=${flint}";
+  configureFlags = [
+    "--with-gmp=${gmp}"
+    "--with-mpir=${mpir}"
+    "--with-mpfr=${mpfr}"
+    "--with-flint=${flint}"
+  ];
+  doCheck = true;
   meta = {
     inherit version;
     description = ''A library for arbitrary-precision interval arithmetic'';
diff --git a/pkgs/development/libraries/eclib/default.nix b/pkgs/development/libraries/eclib/default.nix
index 3651b9e7660e..dbe487368dc5 100644
--- a/pkgs/development/libraries/eclib/default.nix
+++ b/pkgs/development/libraries/eclib/default.nix
@@ -1,21 +1,44 @@
-{stdenv, fetchFromGitHub, autoconf, automake, libtool, gettext, autoreconfHook
-, pari, ntl, gmp}:
+{ stdenv
+, fetchFromGitHub
+, autoreconfHook
+, libtool
+, gettext
+, pari
+, ntl
+, gmp
+# "FLINT is optional and only used for one part of sparse matrix reduction,
+# which is used in the modular symbol code but not mwrank or other elliptic
+# curve programs." -- https://github.com/JohnCremona/eclib/blob/master/README
+, withFlint ? false, flint ? null
+}:
+
+assert withFlint -> flint != null;
+
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
   pname = "eclib";
-  version = "20160720";
-  # or fetchFromGitHub(owner,repo,rev) or fetchgit(rev)
+  version = "20171002";
   src = fetchFromGitHub {
     owner = "JohnCremona";
     repo = "${pname}";
-    rev = "${version}";
-    sha256 = "0qrcd5c8cqhw9f14my6k6013w8li5vdigrjvchkr19n2l8g75j0h";
+    rev = "v${version}";
+    sha256 = "092an90405q9da0k0z5jfp5rng9jl0mqbvsbv4fx6jc9ykfcahsj";
   };
-  buildInputs = [pari ntl gmp];
-  nativeBuildInputs = [autoconf automake libtool gettext autoreconfHook];
+  buildInputs = [
+    pari
+    ntl
+    gmp
+  ] ++ stdenv.lib.optionals withFlint [
+    flint
+  ];
+  nativeBuildInputs = [
+    autoreconfHook
+  ];
+  doCheck = true;
   meta = {
     inherit version;
     description = ''Elliptic curve tools'';
+    homepage = https://github.com/JohnCremona/eclib;
     license = stdenv.lib.licenses.gpl2Plus;
     maintainers = [stdenv.lib.maintainers.raskin];
     platforms = stdenv.lib.platforms.linux;
diff --git a/pkgs/development/libraries/fflas-ffpack/default.nix b/pkgs/development/libraries/fflas-ffpack/default.nix
index edea352ae2dd..5f99f35a1599 100644
--- a/pkgs/development/libraries/fflas-ffpack/default.nix
+++ b/pkgs/development/libraries/fflas-ffpack/default.nix
@@ -1,4 +1,7 @@
-{stdenv, fetchFromGitHub, autoreconfHook, givaro, pkgconfig, openblas, liblapack}:
+{ stdenv, fetchFromGitHub, autoreconfHook, givaro, pkgconfig, openblas
+, gmpxx
+, optimize ? false # impure
+}:
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
   pname = "fflas-ffpack";
@@ -9,9 +12,31 @@ stdenv.mkDerivation rec {
     rev = "v${version}";
     sha256 = "1cqhassj2dny3gx0iywvmnpq8ca0d6m82xl5rz4mb8gaxr2kwddl";
   };
-  nativeBuildInputs = [ autoreconfHook pkgconfig ];
-  buildInputs = [ givaro (liblapack.override {shared = true;}) openblas];
-  configureFlags = "--with-blas-libs=-lopenblas --with-lapack-libs=-llapack";
+  checkInputs = [
+    gmpxx
+  ];
+  nativeBuildInputs = [
+    autoreconfHook
+    pkgconfig
+  ] ++ stdenv.lib.optionals doCheck checkInputs;
+  buildInputs = [ givaro openblas];
+  configureFlags = [
+    "--with-blas-libs=-lopenblas"
+    "--with-lapack-libs=-lopenblas"
+  ] ++ stdenv.lib.optionals (!optimize) [
+    # disable SIMD instructions (which are enabled *when available* by default)
+    "--disable-sse"
+    "--disable-sse2"
+    "--disable-sse3"
+    "--disable-ssse3"
+    "--disable-sse41"
+    "--disable-sse42"
+    "--disable-avx"
+    "--disable-avx2"
+    "--disable-fma"
+    "--disable-fma4"
+  ];
+  doCheck = true;
   meta = {
     inherit version;
     description = ''Finite Field Linear Algebra Subroutines'';
diff --git a/pkgs/development/libraries/gmime/3.nix b/pkgs/development/libraries/gmime/3.nix
index 66d0cf88bd02..124fc08cf3bd 100644
--- a/pkgs/development/libraries/gmime/3.nix
+++ b/pkgs/development/libraries/gmime/3.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, pkgconfig, glib, zlib, gpgme, libidn, gobjectIntrospection }:
 
 stdenv.mkDerivation rec {
-  version = "3.0.5";
+  version = "3.2.0";
   name = "gmime-${version}";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/gmime/3.0/${name}.tar.xz";
-    sha256 = "1q45gd1ahnz9q1milc2lqqwl7j3q0wd6kiswhp25iak222n56lrg";
+    url = "mirror://gnome/sources/gmime/3.2/${name}.tar.xz";
+    sha256 = "1q6palbpf6lh6bvy9ly26q5apl5k0z0r4mvl6zzqh90rz4rn1v3m";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/gstreamer/base/default.nix b/pkgs/development/libraries/gstreamer/base/default.nix
index b3a4f445289e..39cf57ec5258 100644
--- a/pkgs/development/libraries/gstreamer/base/default.nix
+++ b/pkgs/development/libraries/gstreamer/base/default.nix
@@ -1,17 +1,22 @@
-{ stdenv, fetchurl, fetchpatch, pkgconfig, meson
-, ninja, gettext, gobjectIntrospection, python
-, gstreamer, orc, alsaLib, libXv, pango, libtheora
-, wayland, cdparanoia, libvisual, libintl
-}:
+{ stdenv, fetchurl, fetchpatch, lib
+, pkgconfig, meson, ninja, gettext, gobjectIntrospection
+, python, gstreamer, orc, pango, libtheora, libvisual
+, libintl
+, enableX11 ? stdenv.isLinux, libXv
+, enableWayland ? stdenv.isLinux, wayland
+, enableAlsa ? stdenv.isLinux, alsaLib
+, enableCocoa ? false, darwin
+, enableCdparanoia ? (!stdenv.isDarwin), cdparanoia }:
 
 stdenv.mkDerivation rec {
   name = "gst-plugins-base-1.14.0";
 
-  meta = {
+  meta = with lib; {
     description = "Base plugins and helper libraries";
     homepage = https://gstreamer.freedesktop.org;
-    license = stdenv.lib.licenses.lgpl2Plus;
-    platforms = stdenv.lib.platforms.unix;
+    license = licenses.lgpl2Plus;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ matthewbauer ];
   };
 
   src = fetchurl {
@@ -21,19 +26,32 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" ];
 
-  nativeBuildInputs = [
-    pkgconfig python meson ninja gettext gobjectIntrospection
-  ];
+  nativeBuildInputs = [ pkgconfig python gettext gobjectIntrospection ]
+
+  # Broken meson with Darwin. Should hopefully be fixed soon. Tracking
+  # in https://bugzilla.gnome.org/show_bug.cgi?id=781148.
+  ++ lib.optionals (!stdenv.isDarwin) [ meson ninja ];
 
-  buildInputs = [
-    orc libXv pango libtheora cdparanoia libintl wayland
+  # TODO How to pass these to Meson?
+  configureFlags = [
+    "--enable-x11=${if enableX11 then "yes" else "no"}"
+    "--enable-wayland=${if enableWayland then "yes" else "no"}"
+    "--enable-cocoa=${if enableCocoa then "yes" else "no"}"
   ]
-  ++ stdenv.lib.optional stdenv.isLinux alsaLib
-  ++ stdenv.lib.optional (!stdenv.isDarwin) libvisual;
+
+  # Introspection fails on my MacBook currently
+  ++ lib.optional stdenv.isDarwin "--disable-introspection";
+
+  buildInputs = [ orc libtheora libintl ]
+    ++ lib.optional enableAlsa alsaLib
+    ++ lib.optionals enableX11 [ libXv pango ]
+    ++ lib.optional enableWayland wayland
+    ++ lib.optional enableCocoa darwin.apple_sdk.frameworks.Cocoa
+    ++ lib.optional enableCdparanoia cdparanoia;
 
   propagatedBuildInputs = [ gstreamer ];
 
-  preConfigure = ''
+  postPatch = ''
     patchShebangs .
   '';
 
diff --git a/pkgs/development/libraries/gstreamer/core/default.nix b/pkgs/development/libraries/gstreamer/core/default.nix
index ab3f78767a1c..5845c8c50db2 100644
--- a/pkgs/development/libraries/gstreamer/core/default.nix
+++ b/pkgs/development/libraries/gstreamer/core/default.nix
@@ -2,17 +2,18 @@
 , pkgconfig, gettext, gobjectIntrospection
 , bison, flex, python3, glib, makeWrapper
 , libcap,libunwind, darwin
+, lib
 }:
 
 stdenv.mkDerivation rec {
   name = "gstreamer-1.14.0";
 
-  meta = {
+  meta = with lib ;{
     description = "Open source multimedia framework";
     homepage = https://gstreamer.freedesktop.org;
-    license = stdenv.lib.licenses.lgpl2Plus;
-    platforms = stdenv.lib.platforms.unix;
-    maintainers = [ stdenv.lib.maintainers.ttuegel ];
+    license = licenses.lgpl2Plus;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ ttuegel matthewbauer ];
   };
 
   src = fetchurl {
@@ -20,7 +21,7 @@ stdenv.mkDerivation rec {
     sha256 = "0vj6k01lp2yva6rfd95fkyng9jdr62gkz0x8d2l81dyly1ki6dpw";
   };
 
-  patches = [ 
+  patches = [
     (fetchpatch {
         url = "https://bug794856.bugzilla-attachments.gnome.org/attachment.cgi?id=370411";
         sha256 = "16plzzmkk906k4892zq68j3c9z8vdma5nxzlviq20jfv04ykhmk2";
@@ -34,7 +35,9 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     meson ninja pkgconfig gettext bison flex python3 makeWrapper gobjectIntrospection
   ];
-  buildInputs = [ libcap libunwind ] ++ stdenv.lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.CoreServices;
+  buildInputs =
+       lib.optionals stdenv.isLinux [ libcap libunwind ]
+    ++ lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.CoreServices;
 
   propagatedBuildInputs = [ glib ];
 
diff --git a/pkgs/development/libraries/libgphoto2/default.nix b/pkgs/development/libraries/libgphoto2/default.nix
index 9c0ea4a3a73e..96b42ac068cc 100644
--- a/pkgs/development/libraries/libgphoto2/default.nix
+++ b/pkgs/development/libraries/libgphoto2/default.nix
@@ -7,7 +7,7 @@ stdenv.mkDerivation rec {
     owner = "gphoto";
     repo = "libgphoto2";
     rev = "${meta.tag}";
-    sha256 = "1svbpmxqm56pqkv0rxhlyk4vw7mjgjz8zz4p669qvmw630082yj9";
+    sha256 = "0pbfg89817qkb35mmajsw2iz6j9nhkkj67m419f8x8yxpqkaa0wb";
   };
 
   patches = [];
@@ -33,8 +33,8 @@ stdenv.mkDerivation rec {
       MTP, and other vendor specific protocols for controlling and transferring data
       from digital cameras.
     '';
-    version = "2.5.16";
-    tag = "libgphoto2-2_5_16-release";
+    version = "2.5.17";
+    tag = "libgphoto2-2_5_17-release";
     # XXX: the homepage claims LGPL, but several src files are lgpl21Plus
     license = stdenv.lib.licenses.lgpl21Plus;
     platforms = with stdenv.lib.platforms; unix;
diff --git a/pkgs/development/libraries/linbox/default.nix b/pkgs/development/libraries/linbox/default.nix
new file mode 100644
index 000000000000..0f5442bd63b6
--- /dev/null
+++ b/pkgs/development/libraries/linbox/default.nix
@@ -0,0 +1,79 @@
+{ stdenv
+, fetchFromGitHub
+, fetchpatch
+, autoreconfHook
+, givaro
+, pkgconfig
+, openblas
+, liblapack
+, fflas-ffpack
+, gmpxx
+, optimize ? false # impure
+, withSage ? false # sage support
+}:
+stdenv.mkDerivation rec {
+  name = "${pname}-${version}";
+  pname = "linbox";
+  version = "1.5.2";
+
+  src = fetchFromGitHub {
+    owner = "linbox-team";
+    repo = "${pname}";
+    rev = "v${version}";
+    sha256 = "1wfivlwp30mzdy1697w7rzb8caajim50mc8h27k82yipn2qc5n4i";
+  };
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkgconfig
+  ];
+
+  buildInputs = [
+    givaro
+    (liblapack.override {shared = true;})
+    openblas
+    gmpxx
+    fflas-ffpack
+  ];
+
+  configureFlags = [
+    "--with-blas-libs=-lopenblas"
+    "--with-lapack-libs=-llapack"
+    "--disable-optimization"
+  ] ++ stdenv.lib.optionals (!optimize) [
+    # disable SIMD instructions (which are enabled *when available* by default)
+    "--disable-sse"
+    "--disable-sse2"
+    "--disable-sse3"
+    "--disable-ssse3"
+    "--disable-sse41"
+    "--disable-sse42"
+    "--disable-avx"
+    "--disable-avx2"
+    "--disable-fma"
+    "--disable-fma4"
+  ] ++ stdenv.lib.optionals withSage [
+    "--enable-sage"
+  ];
+
+  patches = stdenv.lib.optionals withSage [
+    # https://trac.sagemath.org/ticket/24214#comment:39
+    # Will be resolved by
+    # https://github.com/linbox-team/linbox/issues/69
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/sagemath/sage/a843f48b7a4267e44895a3dfa892c89c85b85611/build/pkgs/linbox/patches/linbox_charpoly_fullCRA.patch";
+      sha256 = "16nxfzfknra3k2yk3xy0k8cq9rmnmsch3dnkb03kx15h0y0jmibk";
+    })
+  ];
+
+  doCheck = true;
+
+  meta = {
+    inherit version;
+    description = "C++ library for exact, high-performance linear algebra";
+    license = stdenv.lib.licenses.lgpl21Plus;
+    maintainers = [stdenv.lib.maintainers.timokau];
+    platforms = stdenv.lib.platforms.linux;
+    homepage = http://linalg.org/;
+  };
+}
diff --git a/pkgs/development/libraries/oniguruma/default.nix b/pkgs/development/libraries/oniguruma/default.nix
index 3989ab42468d..f9a75801e101 100644
--- a/pkgs/development/libraries/oniguruma/default.nix
+++ b/pkgs/development/libraries/oniguruma/default.nix
@@ -13,16 +13,11 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
 
-  prePatch = stdenv.lib.optional stdenv.isDarwin ''
-    substituteInPlace cmake/dist.cmake \
-      --replace '@executable_path/''${UP_DIR}/''${INSTALL_LIB}' $out'/''${INSTALL_LIB}'
-  '';
-
-  meta = {
+  meta = with stdenv.lib; {
     homepage = https://github.com/kkos/oniguruma;
     description = "Regular expressions library";
-    license = stdenv.lib.licenses.bsd2;
-    maintainers = with stdenv.lib.maintainers; [ fuuzetsu ];
-    platforms = with stdenv.lib.platforms; unix;
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ fuuzetsu ];
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/openmpi/default.nix b/pkgs/development/libraries/openmpi/default.nix
index 9aca076c5dcb..2d3b9780090d 100644
--- a/pkgs/development/libraries/openmpi/default.nix
+++ b/pkgs/development/libraries/openmpi/default.nix
@@ -9,14 +9,14 @@
 
 let
   majorVersion = "3.0";
-  minorVersion = "0";
+  minorVersion = "1";
 
 in stdenv.mkDerivation rec {
   name = "openmpi-${majorVersion}.${minorVersion}";
 
   src = fetchurl {
     url = "http://www.open-mpi.org/software/ompi/v${majorVersion}/downloads/${name}.tar.bz2";
-    sha256 = "1mw2d94k6mp4scg1wnkj50vdh734fy5m2ygyrj65s4mh3prbz6gn";
+    sha256 = "0pbqrm5faf57nasy1s81wqivl7zvxmv8lzjh8hvb0f3qxv8m0d36";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/rocksdb/default.nix b/pkgs/development/libraries/rocksdb/default.nix
index bb0faf76be69..bb36d942a69b 100644
--- a/pkgs/development/libraries/rocksdb/default.nix
+++ b/pkgs/development/libraries/rocksdb/default.nix
@@ -19,7 +19,7 @@ let
 in
 stdenv.mkDerivation rec {
   name = "rocksdb-${version}";
-  version = "5.10.3";
+  version = "5.11.3";
 
   outputs = [ "dev" "out" "static" "bin" ];
 
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     owner = "facebook";
     repo = "rocksdb";
     rev = "v${version}";
-    sha256 = "19d8i8map8qz639mhflmxc0w9gp78fvkq1l46y5s6b5imwh0w7xq";
+    sha256 = "15x2r7aib1xinwcchl32wghs8g96k4q5xgv6z97mxgp35475x01p";
   };
 
   nativeBuildInputs = [ which perl ];
diff --git a/pkgs/development/python-modules/faulthandler/default.nix b/pkgs/development/python-modules/faulthandler/default.nix
index 1fc1aea94d57..a05ac1ba679e 100644
--- a/pkgs/development/python-modules/faulthandler/default.nix
+++ b/pkgs/development/python-modules/faulthandler/default.nix
@@ -2,24 +2,13 @@
 
 buildPythonPackage rec {
   pname = "faulthandler";
-  version = "3.0";
+  version = "3.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "acc10e10909f0f956ba1b42b6c450ea0bdaaa27b3942899f65931396cfcdd36a";
+    sha256 = "83301ffab03c86b291677b64b5cec7026f412cbda5ebd27e4cb3338452c40021";
   };
 
-  patches = [
-    (fetchpatch {
-      url = https://github.com/vstinner/faulthandler/commit/67b661e.patch;
-      sha256 = "1nn8c9nq5qypja949hzz0n4yprsyr63wihf5g3gwrinm2nkjnnv7";
-    })
-    (fetchpatch {
-      url = https://github.com/vstinner/faulthandler/commit/07cbb7b.patch;
-      sha256 = "0fh6rjyjw7z1hsiy3sgdc8j9mncg1vlv3y0h4bplqyw18vq3srb3";
-    })
-  ];
-
   meta = {
     description = "Dump the Python traceback";
     license = stdenv.lib.licenses.bsd2;
diff --git a/pkgs/development/python-modules/flask-autoindex/default.nix b/pkgs/development/python-modules/flask-autoindex/default.nix
new file mode 100644
index 000000000000..397d1e03ee82
--- /dev/null
+++ b/pkgs/development/python-modules/flask-autoindex/default.nix
@@ -0,0 +1,44 @@
+{ stdenv
+, buildPythonPackage
+, fetchpatch
+, fetchPypi
+, flask
+, flask-silk
+, future
+}:
+
+buildPythonPackage rec {
+  pname = "Flask-AutoIndex";
+  version = "0.6";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "19b10mb1nrqfjyafki6wnrbn8mqi30bbyyiyvp5xssc74pciyfqs";
+  };
+
+  propagatedBuildInputs = [
+    flask
+    flask-silk
+    future
+  ];
+
+  patches = [
+    # fix generated binary, see https://github.com/sublee/flask-autoindex/pull/32
+    (fetchpatch {
+      name = "fix_binary.patch";
+      url = "https://github.com/sublee/flask-autoindex/pull/32.patch";
+      sha256 = "1v2r0wvi7prhipjq89774svv6aqj0a13mdfj07pdlkpzfbf029dn";
+    })
+  ];
+
+  meta = with stdenv.lib; {
+    description = "The mod_autoindex for Flask";
+    longDescription = ''
+      Flask-AutoIndex generates an index page for your Flask application automatically.
+      The result is just like mod_autoindex, but the look is more awesome!
+    '';
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ timokau ];
+    homepage = http://pythonhosted.org/Flask-AutoIndex/;
+  };
+}
diff --git a/pkgs/development/python-modules/html5-parser/default.nix b/pkgs/development/python-modules/html5-parser/default.nix
index faddfe2bfddb..ae036d33f9ed 100644
--- a/pkgs/development/python-modules/html5-parser/default.nix
+++ b/pkgs/development/python-modules/html5-parser/default.nix
@@ -2,12 +2,12 @@
 
 buildPythonPackage rec {
   pname = "html5-parser";
-  version = "0.4.4";
+  version = "0.4.5";
   name = "${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "b9f3a1d4cdb8742e8e4ecafab04bff541bde4ff09af233293ed0b94028ec1ab5";
+    sha256 = "01mx33sx4dhl4kj6wc48nj6jz7ry60rkhjv0s6k8h5xmjf5yy0x9";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/development/python-modules/milksnake/default.nix b/pkgs/development/python-modules/milksnake/default.nix
new file mode 100644
index 000000000000..014bb223225d
--- /dev/null
+++ b/pkgs/development/python-modules/milksnake/default.nix
@@ -0,0 +1,26 @@
+{ lib, buildPythonPackage, fetchPypi, cffi }:
+
+buildPythonPackage rec {
+  pname = "milksnake";
+  version = "0.1.5";
+
+  src = fetchPypi {
+    inherit pname version;
+    extension = "zip";
+    sha256 = "120nprd8lqis7x7zy72536gk2j68f7gxm8gffmx8k4ygifvl7kfz";
+  };
+
+  propagatedBuildInputs = [
+   cffi
+  ];
+
+  # tests rely on pip/venv
+  doCheck = false;
+
+  meta = with lib; {
+    description = "A python library that extends setuptools for binary extensions";
+    homepage = https://github.com/getsentry/milksnake;
+    license = licenses.asl20;
+    maintainers = with maintainers; [ matthiasbeyer ];
+  };
+}
diff --git a/pkgs/development/tools/build-managers/buildbot/default.nix b/pkgs/development/tools/build-managers/buildbot/default.nix
index 3e994227ef05..98adaf1c1aa1 100644
--- a/pkgs/development/tools/build-managers/buildbot/default.nix
+++ b/pkgs/development/tools/build-managers/buildbot/default.nix
@@ -14,11 +14,11 @@ let
   package = pythonPackages.buildPythonApplication rec {
     name = "${pname}-${version}";
     pname = "buildbot";
-    version = "1.0.0";
+    version = "1.1.0";
 
     src = pythonPackages.fetchPypi {
       inherit pname version;
-      sha256 = "0y7gpymxl09gd9dyqj7zqhaihpl9da1v8ppxi4r161ywd8jv9b1g";
+      sha256 = "1rhmlcvw0dsr4f37sb3xmb9xcn76lsrsw2g1z611g339nmxzi0sc";
     };
 
     buildInputs = with pythonPackages; [
diff --git a/pkgs/development/tools/misc/hydra/default.nix b/pkgs/development/tools/misc/hydra/default.nix
index 38b28ec0f607..4fdd017306ac 100644
--- a/pkgs/development/tools/misc/hydra/default.nix
+++ b/pkgs/development/tools/misc/hydra/default.nix
@@ -27,6 +27,7 @@ let
         CatalystViewDownload
         CatalystViewJSON
         CatalystViewTT
+        CatalystXRoleApplicator
         CatalystXScriptServerStarman
         CryptRandPasswd
         DBDPg
@@ -39,6 +40,7 @@ let
         FileSlurp
         IOCompress
         IPCRun
+        JSONAny
         JSONXS
         LWP
         LWPProtocolHttps
diff --git a/pkgs/os-specific/linux/tbs/default.nix b/pkgs/os-specific/linux/tbs/default.nix
deleted file mode 100644
index e4b954d4dbf5..000000000000
--- a/pkgs/os-specific/linux/tbs/default.nix
+++ /dev/null
@@ -1,50 +0,0 @@
-{ stdenv, fetchFromGitHub, kernel, kmod, perl, patchutils, perlPackages }:
-let
-  media = fetchFromGitHub {
-    owner = "tbsdtv";
-    repo = "linux_media";
-    rev = "14ebbec91f2cd0423aaf859fc6e6d5d986397cd4";
-    sha256 = "1cmqj3kby8sxfcpvslbxywr95529vjxzbn800fdp35lka1fv962h";
-  };
-  build = fetchFromGitHub {
-    owner = "tbsdtv";
-    repo = "media_build";
-    rev = "c340e29a4047e43f7ea7ebf19e1e28c1f2112d05";
-    sha256 = "0hfn1j9qk8lh30z3ywj22qky480nsf8z2iag2bqhrhy4375vjlbl";
-  };
-in stdenv.mkDerivation {
-  name = "tbs-2017-11-05-${kernel.version}";
-
-  srcs = [ media build ];
-  sourceRoot = "${build.name}";
-
-  preConfigure = ''
-    make dir DIR=../${media.name}
-  '';
-
-  postPatch = ''
-    patchShebangs .
-
-    sed -i v4l/Makefile \
-      -i v4l/scripts/make_makefile.pl \
-      -e 's,/sbin/depmod,${kmod}/bin/depmod,g' \
-      -e 's,/sbin/lsmod,${kmod}/bin/lsmod,g'
-
-    sed -i v4l/Makefile \
-      -e 's,^OUTDIR ?= /lib/modules,OUTDIR ?= ${kernel.dev}/lib/modules,' \
-      -e 's,^SRCDIR ?= /lib/modules,SRCDIR ?= ${kernel.dev}/lib/modules,'
-  '';
-
-  buildFlags = [ "VER=${kernel.modDirVersion}" ];
-  installFlags = [ "DESTDIR=$(out)" ];
-
-  hardeningDisable = [ "pic" "format" ];
-  nativeBuildInputs = [ patchutils kmod perl perlPackages.ProcProcessTable ];
-
-  meta = with stdenv.lib; {
-    homepage = https://www.tbsdtv.com/;
-    license = licenses.gpl2;
-    maintainers = with maintainers; [ ck3d ];
-    priority = 20;
-  };
-}
diff --git a/pkgs/os-specific/linux/zfs/default.nix b/pkgs/os-specific/linux/zfs/default.nix
index a467b457f236..bdc43a092f7f 100644
--- a/pkgs/os-specific/linux/zfs/default.nix
+++ b/pkgs/os-specific/linux/zfs/default.nix
@@ -153,7 +153,7 @@ in {
   # to be adapted
   zfsStable = common {
     # comment/uncomment if breaking kernel versions are known
-    incompatibleKernelVersion = null;
+    incompatibleKernelVersion = "4.16";
 
     # this package should point to the latest release.
     version = "0.7.8";
diff --git a/pkgs/servers/dns/knot-resolver/default.nix b/pkgs/servers/dns/knot-resolver/default.nix
index 09fda1b81b8b..1a5577e81655 100644
--- a/pkgs/servers/dns/knot-resolver/default.nix
+++ b/pkgs/servers/dns/knot-resolver/default.nix
@@ -12,11 +12,11 @@ inherit (stdenv.lib) optional optionals optionalString concatStringsSep;
 
 unwrapped = stdenv.mkDerivation rec {
   name = "knot-resolver-${version}";
-  version = "2.2.0";
+  version = "2.3.0";
 
   src = fetchurl {
     url = "http://secure.nic.cz/files/knot-resolver/${name}.tar.xz";
-    sha256 = "1yhlwvpl81klyfb8hhvrhii99q7wvydi3vandmq9j7dvig6z1dvv";
+    sha256 = "2d19c5daf8440bd3d2acd1886b9ede65f04f7753c6fd4618a92a1a4ba3b27a9b";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/servers/foundationdb/default.nix b/pkgs/servers/foundationdb/default.nix
new file mode 100644
index 000000000000..95326b4c1c6c
--- /dev/null
+++ b/pkgs/servers/foundationdb/default.nix
@@ -0,0 +1,99 @@
+{ stdenv, fetchurl, fetchFromGitHub
+, which, findutils, m4, gawk, python, openjdk, mono58, libressl_2_6
+}:
+
+let
+  version = "5.1.7";
+  branch  = "release-5.1";
+  rev     = "9ad8d02386d4a6a5efecf898df80f2747695c627";
+  sha256  = "1rc472ih24f9s5g3xmnlp3v62w206ny0pvvw02bzpix2sdrpbp06";
+
+  # hysterical raisins dictate a version of boost this old. however,
+  # we luckily do not need to build anything, we just need the header
+  # files.
+  boost152 = stdenv.mkDerivation rec {
+    name = "boost-headers-1.52.0";
+
+    src = fetchurl {
+      url = "mirror://sourceforge/boost/boost_1_52_0.tar.bz2";
+      sha256 = "14mc7gsnnahdjaxbbslzk79rc0d12h1i681cd3srdwr3fzynlar2";
+    };
+
+    buildPhase = ":";
+    configurePhase = ":";
+    installPhase = ''
+      mkdir -p $out/include/
+      cp -R boost $out/include/
+    '';
+  };
+
+in stdenv.mkDerivation rec {
+  name = "foundationdb-${version}";
+  inherit version;
+
+  src = fetchFromGitHub {
+    owner = "apple";
+    repo  = "foundationdb";
+    inherit rev sha256;
+  };
+
+  nativeBuildInputs = [ gawk which m4 findutils boost152 mono58 ];
+  buildInputs = [ python openjdk libressl_2_6 ];
+
+  patches =
+    [ ./fix-scm-version.patch
+      ./ldflags.patch
+    ];
+
+  postPatch = ''
+    substituteInPlace ./build/scver.mk \
+      --subst-var-by NIXOS_FDB_VERSION_ID "${rev}" \
+      --subst-var-by NIXOS_FDB_SCBRANCH   "${branch}"
+
+    substituteInPlace ./Makefile \
+      --replace 'shell which ccache' 'shell true' \
+      --replace -Werror ""
+
+    substituteInPlace ./Makefile \
+      --replace libstdc++_pic libstdc++
+
+    substituteInPlace ./build/link-validate.sh \
+      --replace 'exit 1' '#exit 1'
+
+    patchShebangs .
+  '';
+
+  enableParallelBuilding = true;
+  makeFlags = [ "all" "fdb_c" "KVRELEASE=1" ];
+
+  configurePhase = ":";
+  installPhase = ''
+    mkdir -vp $out/{bin,libexec/plugins} $lib/lib $dev/include/foundationdb
+
+    cp -v ./lib/libfdb_c.so     $lib/lib
+    cp -v ./lib/libFDBLibTLS.so $out/libexec/plugins/FDBLibTLS.so
+
+    cp -v ./bindings/c/foundationdb/fdb_c.h           $dev/include/foundationdb
+    cp -v ./bindings/c/foundationdb/fdb_c_options.g.h $dev/include/foundationdb
+
+    for x in fdbbackup fdbcli fdbserver fdbmonitor; do
+      cp -v "./bin/$x" $out/bin;
+    done
+
+    ln -sfv $out/bin/fdbbackup $out/bin/dr_agent
+    ln -sfv $out/bin/fdbbackup $out/bin/fdbrestore
+    ln -sfv $out/bin/fdbbackup $out/bin/fdbdr
+
+    ln -sfv $out/bin/fdbbackup $out/libexec/backup_agent
+  '';
+
+  outputs = [ "out" "lib" "dev" ];
+
+  meta = with stdenv.lib; {
+    description = "Open source, distributed, transactional key-value store";
+    homepage    = https://www.foundationdb.org;
+    license     = licenses.asl20;
+    platforms   = platforms.linux;
+    maintainers = with maintainers; [ thoughtpolice ];
+  };
+}
diff --git a/pkgs/servers/foundationdb/fix-scm-version.patch b/pkgs/servers/foundationdb/fix-scm-version.patch
new file mode 100644
index 000000000000..0e0df7ade82b
--- /dev/null
+++ b/pkgs/servers/foundationdb/fix-scm-version.patch
@@ -0,0 +1,42 @@
+diff --git a/build/scver.mk b/build/scver.mk
+index bdae8be..7539864 100644
+--- a/build/scver.mk
++++ b/build/scver.mk
+@@ -98,33 +98,10 @@ endif
+ GITPRESENT := $(wildcard $(FDBDIR)/.git)
+ HGPRESENT := $(wildcard $(FDBDIR)/.hg)
+ 
+-# Use Git, if not missing
+-ifneq ($(GITPRESENT),)
+-	SCVER := $(shell cd "$(FDBDIR)" && git --version 2>/dev/null)
+-	ifneq ($(SCVER),)
+-		VERSION_ID := $(shell cd "$(FDBDIR)" && git rev-parse --verify HEAD)
+-		SOURCE_CONTROL := GIT
+-		SCBRANCH := $(shell cd "$(FDBDIR)" && git rev-parse --abbrev-ref HEAD)
+-	else
+-$(error Missing git executable on $(PLATFORM) )
+-	endif
+-# Otherwise, use Mercurial
+-else
+-	# Otherwise, use Mercurial, if not missing
+-	ifneq ($(HGPRESENT),)
+-		SCVER := $(shell cd "$(FDBDIR)" && hg --version 2>/dev/null)
+-		ifdef SCVER
+-			VERSION_ID := $(shell cd "$(FDBDIR)" && hg id -n)
+-			SOURCE_CONTROL := MERCURIAL
+-			SCBRANCH := $(shell cd "$(FDBDIR)" && hg branch)
+-		else
+-$(error Missing hg executable on $(PLATFORM))
+-		endif
+-	else
+-	FDBFILES := (shell ls -la $(FDBDIR))
+-$(error Missing source control information for source on $(PLATFORM) in directory: $(FDBDIR) with files: $(FDBFILES))
+-	endif
+-endif
++# NixOS-specific non-VCS packaging, filled out by the nix build
++SOURCE_CONTROL := GIT
++VERSION_ID     := @NIXOS_FDB_VERSION_ID@
++SCBRANCH       := @NIXOS_FDB_SCBRANCH@
+ 
+ # Set the RELEASE variable based on the KVRELEASE variable.
+ ifeq ($(KVRELEASE),1)
diff --git a/pkgs/servers/foundationdb/ldflags.patch b/pkgs/servers/foundationdb/ldflags.patch
new file mode 100644
index 000000000000..4d523a7ecdd3
--- /dev/null
+++ b/pkgs/servers/foundationdb/ldflags.patch
@@ -0,0 +1,90 @@
+diff --git a/FDBLibTLS/local.mk b/FDBLibTLS/local.mk
+index 0b6eac8..b1891ca 100644
+--- a/FDBLibTLS/local.mk
++++ b/FDBLibTLS/local.mk
+@@ -1,6 +1,5 @@
+ FDBLibTLS_CFLAGS := -fPIC -I/usr/local/include -I$(BOOSTDIR)
+-FDBLibTLS_STATIC_LIBS := -ltls -lssl -lcrypto
+-FDBLibTLS_LDFLAGS := -L/usr/local/lib -static-libstdc++ -static-libgcc -lrt
++FDBLibTLS_LDFLAGS := -L/usr/local/lib -static-libstdc++ -static-libgcc -lrt -ltls -lssl -lcrypto
+ FDBLibTLS_LDFLAGS += -Wl,-soname,FDBLibTLS.so -Wl,--version-script=FDBLibTLS/FDBLibTLS.map
+ 
+ # The plugin isn't a typical library, so it feels more sensible to have a copy
+diff --git a/bindings/c/local.mk b/bindings/c/local.mk
+index 44f0c31..7aea5a4 100644
+--- a/bindings/c/local.mk
++++ b/bindings/c/local.mk
+@@ -29,8 +29,8 @@ fdb_c_tests_HEADERS := -Ibindings/c
+ CLEAN_TARGETS += fdb_c_tests_clean
+ 
+ ifeq ($(PLATFORM),linux)
+-  fdb_c_LIBS += lib/libstdc++.a -lm -lpthread -lrt -ldl
+-  fdb_c_LDFLAGS += -Wl,--version-script=bindings/c/fdb_c.map -static-libgcc -Wl,-z,nodelete
++  fdb_c_LIBS += lib/libstdc++.a
++  fdb_c_LDFLAGS += -Wl,--version-script=bindings/c/fdb_c.map -static-libgcc -Wl,-z,nodelete -lm -lpthread -lrt -ldl
+   fdb_c_tests_LIBS += -lpthread
+ endif
+ 
+diff --git a/bindings/flow/tester/local.mk b/bindings/flow/tester/local.mk
+index 2ef4fcb..6e59625 100644
+--- a/bindings/flow/tester/local.mk
++++ b/bindings/flow/tester/local.mk
+@@ -35,8 +35,7 @@ _fdb_flow_tester_clean:
+ 	@rm -rf bindings/flow/bin
+ 
+ ifeq ($(PLATFORM),linux)
+-  fdb_flow_tester_LIBS += -ldl -lpthread -lrt
+-  fdb_flow_tester_LDFLAGS += -static-libstdc++ -static-libgcc
++  fdb_flow_tester_LDFLAGS += -static-libstdc++ -static-libgcc -ldl -lpthread -lrt
+ else ifeq ($(PLATFORM),osx)
+   fdb_flow_tester_LDFLAGS += -lc++
+ endif
+diff --git a/fdbbackup/local.mk b/fdbbackup/local.mk
+index 033fe7d..865fc92 100644
+--- a/fdbbackup/local.mk
++++ b/fdbbackup/local.mk
+@@ -25,8 +25,7 @@ fdbbackup_LDFLAGS := $(fdbrpc_LDFLAGS)
+ fdbbackup_LIBS := lib/libfdbclient.a lib/libfdbrpc.a lib/libflow.a
+ 
+ ifeq ($(PLATFORM),linux)
+-  fdbbackup_LIBS += -ldl -lpthread -lrt
+-  fdbbackup_LDFLAGS += -static-libstdc++ -static-libgcc
++  fdbbackup_LDFLAGS += -static-libstdc++ -static-libgcc -ldl -lpthread -lrt
+ 
+   # GPerfTools profiler (uncomment to use)
+   # fdbbackup_CFLAGS += -I/opt/gperftools/include -DUSE_GPERFTOOLS=1
+diff --git a/fdbcli/local.mk b/fdbcli/local.mk
+index 81a4a42..892c079 100644
+--- a/fdbcli/local.mk
++++ b/fdbcli/local.mk
+@@ -22,14 +22,13 @@
+ 
+ fdbcli_CFLAGS := $(fdbclient_CFLAGS)
+ fdbcli_LDFLAGS := $(fdbrpc_LDFLAGS)
+-fdbcli_LIBS := lib/libfdbclient.a lib/libfdbrpc.a lib/libflow.a -ldl
++fdbcli_LIBS := lib/libfdbclient.a lib/libfdbrpc.a lib/libflow.a
+ fdbcli_STATIC_LIBS :=
+ 
+ fdbcli_GENERATED_SOURCES += versions.h
+ 
+ ifeq ($(PLATFORM),linux)
+-  fdbcli_LDFLAGS += -static-libstdc++ -static-libgcc
+-  fdbcli_LIBS += -lpthread -lrt
++  fdbcli_LDFLAGS += -static-libstdc++ -static-libgcc -lpthread -lrt -ldl
+ else ifeq ($(PLATFORM),osx)
+   fdbcli_LDFLAGS += -lc++
+ endif
+diff --git a/fdbserver/local.mk b/fdbserver/local.mk
+index 78cad1b..36f2c0f 100644
+--- a/fdbserver/local.mk
++++ b/fdbserver/local.mk
+@@ -25,8 +25,7 @@ fdbserver_LDFLAGS := $(fdbrpc_LDFLAGS)
+ fdbserver_LIBS := lib/libfdbclient.a lib/libfdbrpc.a lib/libflow.a
+ 
+ ifeq ($(PLATFORM),linux)
+-  fdbserver_LIBS += -ldl -lpthread -lrt
+-  fdbserver_LDFLAGS += -static-libstdc++ -static-libgcc
++  fdbserver_LDFLAGS += -static-libstdc++ -static-libgcc -ldl -lpthread -lrt
+ 
+   # GPerfTools profiler (uncomment to use)
+   # fdbserver_CFLAGS += -I/opt/gperftools/include -DUSE_GPERFTOOLS=1
diff --git a/pkgs/servers/ftp/bftpd/default.nix b/pkgs/servers/ftp/bftpd/default.nix
index 38fb7d250e34..c35177e6aa90 100644
--- a/pkgs/servers/ftp/bftpd/default.nix
+++ b/pkgs/servers/ftp/bftpd/default.nix
@@ -1,24 +1,36 @@
-{stdenv, fetchurl}:
-stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
+{ stdenv, fetchurl }:
+
+let
   pname = "bftpd";
+
+in stdenv.mkDerivation rec {
+  name = "${pname}-${version}";
   version = "4.9";
-  # or fetchFromGitHub(owner,repo,rev) or fetchgit(rev)
+
   src = fetchurl {
     url = "mirror://sourceforge/project/${pname}/${pname}/${name}/${name}.tar.gz";
     sha256 = "13pjil9cjggpi773m0516lszyqvwzlgcrmmj8yn9nc24rbxwvn6d";
   };
-  buildInputs = [];
+
   preConfigure = ''
     sed -re 's/-[og] 0//g' -i Makefile*
   '';
-  meta = {
+
+  postInstall = ''
+    mkdir -p $out/share/doc/${pname}
+    mv $out/etc/*.conf $out/share/doc/${pname}
+    rm -rf $out/{etc,var}
+  '';
+
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
     inherit version;
-    description = ''A minimal ftp server'';
-    license = stdenv.lib.licenses.gpl2Plus;
-    maintainers = [stdenv.lib.maintainers.raskin];
-    platforms = stdenv.lib.platforms.linux;
-    homepage = http://bftpd.sf.net/;
+    description = "A minimal ftp server";
     downloadPage = "http://bftpd.sf.net/download.html";
+    homepage = http://bftpd.sf.net/;
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ raskin ];
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/servers/jackett/default.nix b/pkgs/servers/jackett/default.nix
index 34d242b92a8a..f2d38111d5d2 100644
--- a/pkgs/servers/jackett/default.nix
+++ b/pkgs/servers/jackett/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "jackett-${version}";
-  version = "0.8.823";
+  version = "0.8.886";
 
   src = fetchurl {
     url = "https://github.com/Jackett/Jackett/releases/download/v${version}/Jackett.Binaries.Mono.tar.gz";
-    sha256 = "0hicz21dvcakqkxix70akc3rrz570j3g0a512pqrr3bdq7ay0dkk";
+    sha256 = "18agnavhch29pi1w6vp374cs6bz2j7bf55mh4ym0cs038h5xkdvv";
   };
 
   buildInputs = [ makeWrapper ];
diff --git a/pkgs/shells/xonsh/default.nix b/pkgs/shells/xonsh/default.nix
index d22a66eb93ae..a923602cdd76 100644
--- a/pkgs/shells/xonsh/default.nix
+++ b/pkgs/shells/xonsh/default.nix
@@ -2,13 +2,13 @@
 
 python3Packages.buildPythonApplication rec {
   name = "xonsh-${version}";
-  version = "0.6.0";
+  version = "0.6.1";
 
   src = fetchFromGitHub {
     owner = "scopatz";
     repo = "xonsh";
     rev = version;
-    sha256= "0hfsan22i81wffx2xbamm8wwkxgpv12z4kfl37p9m22vpqgg0fdg";
+    sha256= "0lxjklwj267q0ikqab8p743sjvm44gq1w7mp80c7hgrn2ndvrypg";
   };
 
   LC_ALL = "en_US.UTF-8";
@@ -34,7 +34,7 @@ python3Packages.buildPythonApplication rec {
 
   meta = with stdenv.lib; {
     description = "A Python-ish, BASHwards-compatible shell";
-    homepage = http://xonsh.org;
+    homepage = http://xon.sh/;
     license = licenses.bsd3;
     maintainers = with maintainers; [ spwhitt garbas vrthra ];
     platforms = platforms.all;
diff --git a/pkgs/tools/backup/diskrsync/default.nix b/pkgs/tools/backup/diskrsync/default.nix
index 2e86ad0deda8..3a5ffc30f8f2 100644
--- a/pkgs/tools/backup/diskrsync/default.nix
+++ b/pkgs/tools/backup/diskrsync/default.nix
@@ -19,7 +19,7 @@ buildGoPackage rec {
   buildInputs = [ makeWrapper ];
 
   preFixup = ''
-    wrapProgram "$bin/bin/diskrsync" --prefix PATH : ${openssh}/bin
+    wrapProgram "$bin/bin/diskrsync" --argv0 diskrsync --prefix PATH : ${openssh}/bin
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/graphics/maim/default.nix b/pkgs/tools/graphics/maim/default.nix
index c7e8dc966e8d..cac86e29c472 100644
--- a/pkgs/tools/graphics/maim/default.nix
+++ b/pkgs/tools/graphics/maim/default.nix
@@ -1,22 +1,23 @@
 { stdenv, fetchFromGitHub, cmake, pkgconfig
-, zlib, libpng, libjpeg
-, libGLU_combined, glm, libX11, libXext, libXfixes, libXrandr, libXcomposite, slop, icu }:
+, zlib, libpng, libjpeg, libGLU_combined, glm
+, libX11, libXext, libXfixes, libXrandr, libXcomposite, slop, icu
+}:
 
 stdenv.mkDerivation rec {
   name = "maim-${version}";
-  version = "5.4.68";
+  version = "5.5";
 
   src = fetchFromGitHub {
     owner = "naelstrof";
     repo = "maim";
     rev = "v${version}";
-    sha256 = "12jvfxzfhh6cbk6ygliwnkvm3mb7rca60k6x9qdzm17jsz65xhh0";
+    sha256 = "0dr44lwqsvhwf9pncxq6k42zj9hj07b96qsk1q8vh4l42zcpqzla";
   };
 
   nativeBuildInputs = [ cmake pkgconfig ];
   buildInputs =
-    [ zlib libpng libjpeg libGLU_combined glm libX11 libXext libXfixes libXrandr
-      libXcomposite slop icu ];
+    [ zlib libpng libjpeg libGLU_combined glm
+      libX11 libXext libXfixes libXrandr libXcomposite slop icu ];
 
   doCheck = false;
 
diff --git a/pkgs/tools/misc/ipxe/default.nix b/pkgs/tools/misc/ipxe/default.nix
index 786b3992a5cc..d34ccaa4b9e9 100644
--- a/pkgs/tools/misc/ipxe/default.nix
+++ b/pkgs/tools/misc/ipxe/default.nix
@@ -3,8 +3,8 @@
 }:
 
 let
-  date = "20170922";
-  rev = "74d90b33f8490adcee2026ece18d8411d93b6a39";
+  date = "20180220";
+  rev = "47849be3a900c546cf92066849be0806f4e611d9";
 in
 
 stdenv.mkDerivation {
@@ -14,7 +14,7 @@ stdenv.mkDerivation {
 
   src = fetchgit {
     url = git://git.ipxe.org/ipxe.git;
-    sha256 = "12ijrq451fj2x3i7c7xjlxig5mwbhmgzqjvmfl2sza953vfbk4vw";
+    sha256 = "1f4pi1dp2zqnrbfnggnzycfvrxv0bqgw73dxbyy3hfy4mhdj6z45";
     inherit rev;
   };
 
@@ -26,6 +26,7 @@ stdenv.mkDerivation {
   makeFlags =
     [ "ECHO_E_BIN_ECHO=echo" "ECHO_E_BIN_ECHO_E=echo" # No /bin/echo here.
       "ISOLINUX_BIN_LIST=${syslinux}/share/syslinux/isolinux.bin"
+      "LDLINUX_C32=${syslinux}/share/syslinux/ldlinux.c32"
     ] ++ lib.optional (embedScript != null) "EMBED=${embedScript}";
 
 
@@ -34,6 +35,7 @@ stdenv.mkDerivation {
   configurePhase = ''
     runHook preConfigure
     for opt in $enabledOptions; do echo "#define $opt" >> src/config/general.h; done
+    sed -i '/cp \''${ISOLINUX_BIN}/s/$/ --no-preserve=mode/' src/util/geniso
     runHook postConfigure
   '';
 
diff --git a/pkgs/tools/misc/memtest86+/default.nix b/pkgs/tools/misc/memtest86+/default.nix
index d949108524f6..6103ba021260 100644
--- a/pkgs/tools/misc/memtest86+/default.nix
+++ b/pkgs/tools/misc/memtest86+/default.nix
@@ -1,36 +1,14 @@
-{ stdenv, fetchurl }:
+{ stdenv, fetchgit }:
 
 stdenv.mkDerivation rec {
-  name = "memtest86+-5.01";
+  name = "memtest86+-5.01+coreboot-20180113";
 
-  src = fetchurl {
-    url = "http://www.memtest.org/download/5.01/${name}.tar.gz";
-    sha256 = "0fch1l55753y6jkk0hj8f6vw4h1kinkn9ysp22dq5g9zjnvjf88l";
+  src = fetchgit {
+    url = "https://review.coreboot.org/memtest86plus";
+    rev = "5ca4eb9544e51254254d09ae6e70f93403469ec3";
+    sha256 = "08m4rjr0chhhb1whgggknz926zv9hm8bisnxqp8lffqiwhb55rgk";
   };
 
-  patches = [
-    (fetchurl {
-      url = "https://sources.debian.net/data/main/m/memtest86+/5.01-3/debian/patches/doc-serialconsole";
-      sha256 = "1qh2byj9bmpchym8iq20n4hqmy10nrl6bi0d9pgdqikkmw9m38jq";
-    })
-    (fetchurl {
-      url = "https://sources.debian.net/data/main/m/memtest86+/5.01-3/debian/patches/multiboot";
-      sha256 = "0nq61307ah5b41ff5nqs99wjzjzlajvfv6k9c9d0gqvhx8r4dvmy";
-    })
-    (fetchurl {
-      url = "https://sources.debian.net/data/main/m/memtest86+/5.01-3/debian/patches/memtest86+-5.01-O0.patch";
-      sha256 = "1xmj3anq1fr0cxwv8lqfp5cr5f58v7glwc6z0v8hx8aib8yj1wl2";
-    })
-    (fetchurl {
-      url = "https://sources.debian.net/data/main/m/memtest86+/5.01-3/debian/patches/memtest86+-5.01-array-size.patch";
-      sha256 = "0yxlzpfs6313s91y984p7rlf5rgybcjhg7i9zqy4wqhm3j90f1kb";
-    })
-    (fetchurl {
-      url = "https://sources.debian.net/data/main/m/memtest86+/5.01-3/debian/patches/gcc-5";
-      sha256 = "13xfy6sn8qbj1hx4vms2cz24dsa3bl8n2iblz185hkn11y7141sc";
-    })
-  ];
-
   preBuild = ''
     # Really dirty hack to get Memtest to build without needing a Glibc
     # with 32-bit libraries and headers.
@@ -42,7 +20,7 @@ stdenv.mkDerivation rec {
 
   NIX_CFLAGS_COMPILE = "-I. -std=gnu90";
 
-  hardeningDisable = [ "fortify" "stackprotector" "pic" ];
+  hardeningDisable = [ "all" ];
 
   buildFlags = "memtest.bin";
 
diff --git a/pkgs/tools/misc/slop/default.nix b/pkgs/tools/misc/slop/default.nix
index ad1c2b64e65d..f411bbd2c300 100644
--- a/pkgs/tools/misc/slop/default.nix
+++ b/pkgs/tools/misc/slop/default.nix
@@ -1,15 +1,17 @@
 { stdenv, fetchFromGitHub, cmake, pkgconfig
-, glew, glm, libGLU_combined, libX11, libXext, libXrender, cppcheck, icu}:
+, glew, glm, libGLU_combined, libX11, libXext, libXrender, icu
+, cppcheck
+}:
 
 stdenv.mkDerivation rec {
   name = "slop-${version}";
-  version = "7.3.49";
+  version = "7.4";
 
   src = fetchFromGitHub {
     owner = "naelstrof";
     repo = "slop";
     rev = "v${version}";
-    sha256 = "0is3mh2d1jqgvv72v5x92w23yf26n8n384nbr1b6cn883aw8j7jz";
+    sha256 = "0fgd8a2dqkg64all0f96sca92sdss9r3pzmv5kck46b99z2325z6";
   };
 
   nativeBuildInputs = [ cmake pkgconfig ];
diff --git a/pkgs/tools/misc/vdirsyncer/default.nix b/pkgs/tools/misc/vdirsyncer/default.nix
index 9d1e4096776a..9e9ded5c3a76 100644
--- a/pkgs/tools/misc/vdirsyncer/default.nix
+++ b/pkgs/tools/misc/vdirsyncer/default.nix
@@ -1,18 +1,30 @@
-{ stdenv, fetchurl, python3Packages, glibcLocales }:
+{ stdenv, python3Packages, glibcLocales, rustPlatform }:
 
 # Packaging documentation at:
 # https://github.com/untitaker/vdirsyncer/blob/master/docs/packaging.rst
 let
   pythonPackages = python3Packages;
-in
-pythonPackages.buildPythonApplication rec {
-  version = "0.16.4";
-  name = "vdirsyncer-${version}";
-
-  src = fetchurl {
-    url = "mirror://pypi/v/vdirsyncer/${name}.tar.gz";
-    sha256 = "03wva48bgv1ad3df6plc9b8xxh6k8bcaxrhlzwh81c9mzn5bspzv";
+  version = "0.17.0a2";
+  pname = "vdirsyncer";
+  name = pname + "-" + version;
+  src = pythonPackages.fetchPypi {
+    inherit pname version;
+    sha256 = "0y464rsx5la6bp94z2g0nnkbl4nwfya08abynvifw4c84vs1gr4q";
   };
+  native = rustPlatform.buildRustPackage {
+    name = name + "-native";
+    inherit src;
+    sourceRoot = name + "/rust";
+    cargoSha256 = "1cr7xs11gbsc3x5slga9qahchwc22qq49amf28g4jgs9lzf57qis";
+    postInstall = ''
+      mkdir $out/include $out/lib
+      cp $out/bin/libvdirsyncer_rustext* $out/lib
+      rm -r $out/bin
+      cp target/vdirsyncer_rustext.h $out/include
+    '';
+  };
+in pythonPackages.buildPythonApplication rec {
+  inherit version pname src;
 
   propagatedBuildInputs = with pythonPackages; [
     click click-log click-threading
@@ -20,14 +32,33 @@ pythonPackages.buildPythonApplication rec {
     requests
     requests_oauthlib # required for google oauth sync
     atomicwrites
+    milksnake
   ];
 
-  buildInputs = with pythonPackages; [hypothesis pytest pytest-localserver pytest-subtesthack setuptools_scm ] ++ [ glibcLocales ];
+  buildInputs = with pythonPackages; [ setuptools_scm ];
+
+  checkInputs = with pythonPackages; [ hypothesis pytest pytest-localserver pytest-subtesthack ] ++ [ glibcLocales ];
+
+  postPatch = ''
+    sed -i "/cargo build/d" Makefile
+  '';
+
+  preBuild = ''
+    mkdir -p rust/target/release
+    ln -s ${native}/lib/libvdirsyncer_rustext* rust/target/release/
+    ln -s ${native}/include/vdirsyncer_rustext.h rust/target/
+  '';
 
   LC_ALL = "en_US.utf8";
 
+  preCheck = ''
+    ln -sf ../dist/tmpbuild/vdirsyncer/vdirsyncer/_native__lib.so vdirsyncer
+  '';
+
   checkPhase = ''
+    runHook preCheck
     make DETERMINISTIC_TESTS=true test
+    runHook postCheck
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/package-management/nix-pin/default.nix b/pkgs/tools/package-management/nix-pin/default.nix
index c12b82a61e17..bb3a1faa0c3b 100644
--- a/pkgs/tools/package-management/nix-pin/default.nix
+++ b/pkgs/tools/package-management/nix-pin/default.nix
@@ -1,12 +1,12 @@
 { pkgs, stdenv, fetchFromGitHub, mypy, python3 }:
 let self = stdenv.mkDerivation rec {
   name = "nix-pin-${version}";
-  version = "0.1.2";
+  version = "0.2.2";
   src = fetchFromGitHub {
     owner = "timbertson";
     repo = "nix-pin";
-    rev = "version-0.1.2";
-    sha256 = "1zwfb5198qzbjwivgiaxbwva9frgrrqaj92nw8vz95yi08pijssh";
+    rev = "version-0.2.2";
+    sha256 = "1kw43kzy4m6lnnif51r2a8i4vcgr7d4vqb1c75p7pk2b9y3jwxsz";
   };
   buildInputs = [ python3 mypy ];
   buildPhase = ''
@@ -16,12 +16,27 @@ let self = stdenv.mkDerivation rec {
     mkdir "$out"
     cp -r bin share "$out"
   '';
-  passthru = {
-    callWithPins = path: args:
-      import "${self}/share/nix/call.nix" {
-        inherit pkgs path args;
-      };
-  };
+  passthru =
+    let
+      defaults = import "${self}/share/nix/defaults.nix";
+    in {
+      api = { pinConfig ? defaults.pinConfig }:
+        let impl = import "${self}/share/nix/api.nix" { inherit pkgs pinConfig; }; in
+        { inherit (impl) augmentedPkgs pins callPackage; };
+      updateScript = ''
+        set -e
+        echo
+        cd ${toString ./.}
+        ${pkgs.nix-update-source}/bin/nix-update-source \
+          --prompt version \
+          --replace-attr version \
+          --set owner timbertson \
+          --set repo nix-pin \
+          --set type fetchFromGitHub \
+          --set rev 'version-{version}' \
+          --modify-nix default.nix
+      '';
+    };
   meta = with stdenv.lib; {
     homepage = "https://github.com/timbertson/nix-pin";
     description = "nixpkgs development utility";
diff --git a/pkgs/tools/virtualization/google-compute-engine/default.nix b/pkgs/tools/virtualization/google-compute-engine/default.nix
index a923d73c03e4..3645de88bf8a 100644
--- a/pkgs/tools/virtualization/google-compute-engine/default.nix
+++ b/pkgs/tools/virtualization/google-compute-engine/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonApplication rec {
   name = "google-compute-engine-${version}";
-  version = "20170914";
+  version = "20180129";
   namePrefix = "";
 
   src = fetchFromGitHub {
     owner = "GoogleCloudPlatform";
     repo = "compute-image-packages";
     rev = version;
-    sha256 = "0hlzcrf6yhzan25f4wzy1vbncak9whhqzrzza026ly3sq0smmjpg";
+    sha256 = "0380fnr64109hv8l1f3sgdg8a5mf020axj7jh8y25xq6wzkjm20c";
   };
 
   postPatch = ''
@@ -52,5 +52,6 @@ buildPythonApplication rec {
     homepage = "https://github.com/GoogleCloudPlatform/compute-image-packages";
     license = licenses.asl20;
     maintainers = with maintainers; [ zimbatm ];
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index c227e2367da7..946be093765d 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2089,6 +2089,8 @@ with pkgs;
 
   edk2 = callPackage ../development/compilers/edk2 { };
 
+  eff = callPackage ../development/interpreters/eff { };
+
   eflite = callPackage ../applications/audio/eflite {};
 
   eid-mw = callPackage ../tools/security/eid-mw { };
@@ -2407,6 +2409,8 @@ with pkgs;
 
   fuseiso = callPackage ../tools/filesystems/fuseiso { };
 
+  foundationdb = callPackage ../servers/foundationdb { stdenv = overrideCC stdenv gcc49; };
+
   fuse-7z-ng = callPackage ../tools/filesystems/fuse-7z-ng { };
 
   fwknop = callPackage ../tools/security/fwknop { };
@@ -8786,6 +8790,7 @@ with pkgs;
 
   fflas-ffpack = callPackage ../development/libraries/fflas-ffpack {};
   fflas-ffpack_1 = callPackage ../development/libraries/fflas-ffpack/1.nix {};
+  linbox = callPackage ../development/libraries/linbox {};
 
   ffmpeg_0_10 = callPackage ../development/libraries/ffmpeg/0.10.nix {
     inherit (darwin.apple_sdk.frameworks) Cocoa;
@@ -13501,8 +13506,6 @@ with pkgs;
 
     broadcom_sta = callPackage ../os-specific/linux/broadcom-sta/default.nix { };
 
-    tbs = callPackage ../os-specific/linux/tbs { };
-
     nvidiabl = callPackage ../os-specific/linux/nvidiabl { };
 
     nvidiaPackages = callPackage ../os-specific/linux/nvidia-x11 { };
@@ -14243,9 +14246,7 @@ with pkgs;
 
   crimson = callPackage ../data/fonts/crimson {};
 
-  dejavu_fonts = lowPrio (callPackage ../data/fonts/dejavu-fonts {
-    inherit (perlPackages) FontTTF;
-  });
+  dejavu_fonts = lowPrio (callPackage ../data/fonts/dejavu-fonts {});
 
   # solve collision for nix-env before https://github.com/NixOS/nix/pull/815
   dejavu_fontsEnv = buildEnv {
diff --git a/pkgs/top-level/haskell-packages.nix b/pkgs/top-level/haskell-packages.nix
index f9cd2eb94337..48980e48f1d4 100644
--- a/pkgs/top-level/haskell-packages.nix
+++ b/pkgs/top-level/haskell-packages.nix
@@ -19,7 +19,10 @@ let
     inherit pkgs;
   };
 
-  callPackage = newScope { inherit haskellLib; };
+  callPackage = newScope {
+    inherit haskellLib;
+    overrides = pkgs.haskell.packageOverrides;
+  };
 
   bootstrapPackageSet = self: super: {
     mkDerivation = drv: super.mkDerivation (drv // {
@@ -99,6 +102,9 @@ in rec {
       (name: compiler."${name}".override { enableIntegerSimple = true; }));
   };
 
+  # Default overrides that are applied to all package sets.
+  packageOverrides = self : super : {};
+
   # Always get compilers from `buildPackages`
   packages = let bh = buildPackages.haskell; in {
 
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 72bcc45c48e6..f095ccb34ab5 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -217,8 +217,6 @@ let
 
     easy-format = callPackage ../development/ocaml-modules/easy-format { };
 
-    eff = callPackage ../development/interpreters/eff { };
-
     eliom = callPackage ../development/ocaml-modules/eliom {
       lwt = lwt2;
       js_of_ocaml = js_of_ocaml_2;
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 5b1877875344..127e4ac9c0e6 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5533,6 +5533,8 @@ in {
 
   flask_assets = callPackage ../development/python-modules/flask-assets { };
 
+  flask-autoindex = callPackage ../development/python-modules/flask-autoindex { };
+
   flask-babel = callPackage ../development/python-modules/flask-babel { };
 
   flask_cache = buildPythonPackage rec {
@@ -7640,6 +7642,8 @@ in {
 
   micawber = callPackage ../development/python-modules/micawber { };
 
+  milksnake = callPackage ../development/python-modules/milksnake { };
+
   minimock = buildPythonPackage rec {
     version = "1.2.8";
     name = "minimock-${version}";
diff --git a/pkgs/top-level/release.nix b/pkgs/top-level/release.nix
index aee73f206696..3ea873cdc7ff 100644
--- a/pkgs/top-level/release.nix
+++ b/pkgs/top-level/release.nix
@@ -101,6 +101,9 @@ let
               jobs.git.x86_64-darwin
               jobs.mysql.x86_64-darwin
               jobs.vim.x86_64-darwin
+              # Ensure that UI stuff works on darwin
+              jobs.inkscape.x86_64-darwin
+              jobs.qt5.qtmultimedia.x86_64-darwin
 
               jobs.tests.cc-wrapper.x86_64-linux
               jobs.tests.cc-wrapper.x86_64-darwin