about summary refs log tree commit diff
path: root/pkgs
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs')
-rw-r--r--pkgs/applications/editors/nano/default.nix4
-rw-r--r--pkgs/applications/virtualization/qemu/default.nix4
-rwxr-xr-xpkgs/build-support/buildenv/builder.pl7
-rw-r--r--pkgs/build-support/cc-wrapper/cc-wrapper.sh6
-rw-r--r--pkgs/build-support/cc-wrapper/default.nix101
-rw-r--r--pkgs/build-support/cc-wrapper/ld-wrapper.sh44
-rw-r--r--pkgs/build-support/cc-wrapper/setup-hook.sh27
-rw-r--r--pkgs/build-support/fetchurl/builder.sh2
-rw-r--r--pkgs/build-support/gcc-wrapper-old/builder.sh2
-rw-r--r--pkgs/build-support/trivial-builders.nix2
-rw-r--r--pkgs/data/misc/dns-root-data/default.nix29
-rw-r--r--pkgs/data/misc/dns-root-data/root.ds2
-rw-r--r--pkgs/data/misc/dns-root-data/root.key2
-rwxr-xr-xpkgs/data/misc/dns-root-data/update-root-key.sh10
-rw-r--r--pkgs/data/sgml+xml/stylesheets/xslt/docbook-xsl/default.nix7
-rw-r--r--pkgs/desktops/kde-4.14/kde-package/default.nix2
-rw-r--r--pkgs/development/compilers/openjdk-darwin/8.nix2
-rw-r--r--pkgs/development/compilers/openjdk-darwin/default.nix2
-rw-r--r--pkgs/development/compilers/openjdk/7.nix2
-rw-r--r--pkgs/development/compilers/openjdk/8.nix2
-rw-r--r--pkgs/development/compilers/oraclejdk/jdk-linux-base.nix2
-rw-r--r--pkgs/development/compilers/zulu/default.nix2
-rw-r--r--pkgs/development/haskell-modules/generic-builder.nix4
-rw-r--r--pkgs/development/interpreters/python/cpython/3.6/default.nix4
-rw-r--r--pkgs/development/interpreters/python/wrap.sh2
-rw-r--r--pkgs/development/libraries/dbus/default.nix4
-rw-r--r--pkgs/development/libraries/gnutls/generic.nix4
-rw-r--r--pkgs/development/libraries/gtk+/3.x.nix4
-rw-r--r--pkgs/development/libraries/ldns/default.nix18
-rw-r--r--pkgs/development/libraries/libgcrypt/default.nix4
-rw-r--r--pkgs/development/libraries/libjpeg-turbo/default.nix4
-rw-r--r--pkgs/development/libraries/libpng/default.nix8
-rw-r--r--pkgs/development/libraries/libunistring/default.nix4
-rw-r--r--pkgs/development/libraries/libuv/default.nix5
-rw-r--r--pkgs/development/libraries/mesa/default.nix4
-rw-r--r--pkgs/development/libraries/newt/default.nix6
-rw-r--r--pkgs/development/libraries/qt-4.x/4.8/default.nix1
-rw-r--r--pkgs/development/libraries/science/math/openblas/default.nix4
-rw-r--r--pkgs/development/libraries/x264/default.nix5
-rw-r--r--pkgs/development/python-modules/FormEncode/default.nix31
-rw-r--r--pkgs/development/python-modules/actdiag/default.nix4
-rw-r--r--pkgs/development/python-modules/alabaster/default.nix4
-rw-r--r--pkgs/development/python-modules/alembic/default.nix4
-rw-r--r--pkgs/development/python-modules/aniso8601/default.nix4
-rw-r--r--pkgs/development/python-modules/btrees/default.nix3
-rw-r--r--pkgs/development/python-modules/celery/fix_endless_python3.6_loop_logger_isa.patch18
-rw-r--r--pkgs/development/python-modules/dask/default.nix4
-rw-r--r--pkgs/development/python-modules/discid/default.nix4
-rw-r--r--pkgs/development/python-modules/django-raster/default.nix4
-rw-r--r--pkgs/development/python-modules/dkimpy/default.nix28
-rw-r--r--pkgs/development/python-modules/dns/default.nix23
-rw-r--r--pkgs/development/python-modules/email-validator/default.nix27
-rw-r--r--pkgs/development/python-modules/faker/default.nix36
-rw-r--r--pkgs/development/python-modules/keras/default.nix4
-rw-r--r--pkgs/development/python-modules/ldap.nix4
-rw-r--r--pkgs/development/python-modules/libagent/default.nix4
-rw-r--r--pkgs/development/python-modules/libnacl/default.nix4
-rw-r--r--pkgs/development/python-modules/m2r/default.nix4
-rw-r--r--pkgs/development/python-modules/numpy/default.nix4
-rw-r--r--pkgs/development/python-modules/olefile/default.nix19
-rw-r--r--pkgs/development/python-modules/pandas/default.nix4
-rw-r--r--pkgs/development/python-modules/persistent/default.nix23
-rw-r--r--pkgs/development/python-modules/pillow/default.nix62
-rw-r--r--pkgs/development/python-modules/plotly/default.nix4
-rw-r--r--pkgs/development/python-modules/pylint/default.nix4
-rw-r--r--pkgs/development/python-modules/pyparsing/default.nix20
-rw-r--r--pkgs/development/python-modules/pyroute2/default.nix4
-rw-r--r--pkgs/development/python-modules/pyside/shiboken.nix4
-rw-r--r--pkgs/development/python-modules/pyside/shiboken_py35.patch2
-rw-r--r--pkgs/development/python-modules/pytest-xdist/default.nix4
-rw-r--r--pkgs/development/python-modules/scipy/default.nix6
-rw-r--r--pkgs/development/python-modules/sqlalchemy/default.nix4
-rw-r--r--pkgs/development/python-modules/tornado/default.nix28
-rw-r--r--pkgs/development/python-modules/trezor/default.nix4
-rw-r--r--pkgs/development/python-modules/ukpostcodeparser/default.nix22
-rw-r--r--pkgs/development/python-modules/vine/default.nix4
-rw-r--r--pkgs/development/python-modules/zc_lockfile/default.nix27
-rw-r--r--pkgs/development/python-modules/zconfig/default.nix3
-rw-r--r--pkgs/development/python-modules/zodbpickle/default.nix23
-rw-r--r--pkgs/development/tools/build-managers/gnumake/3.80/default.nix18
-rw-r--r--pkgs/development/tools/build-managers/gnumake/3.80/log.patch125
-rw-r--r--pkgs/development/tools/build-managers/gnumake/3.82/default.nix4
-rw-r--r--pkgs/development/tools/build-managers/gnumake/3.82/log.patch125
-rw-r--r--pkgs/development/tools/build-managers/gnumake/4.0/darwin-library_search-dylib.patch17
-rw-r--r--pkgs/development/tools/build-managers/gnumake/4.0/default.nix49
-rw-r--r--pkgs/development/tools/build-managers/gnumake/4.0/impure-dirs.patch34
-rw-r--r--pkgs/development/tools/build-managers/gnumake/4.1/default.nix45
-rw-r--r--pkgs/development/tools/build-managers/gnumake/4.1/impure-dirs.patch34
-rw-r--r--pkgs/development/tools/build-managers/gnumake/4.1/no-tty-name.patch53
-rw-r--r--pkgs/development/tools/build-managers/jam/default.nix4
-rw-r--r--pkgs/development/tools/misc/gnum4/default.nix4
-rw-r--r--pkgs/development/tools/parsing/bison/3.x.nix4
-rw-r--r--pkgs/misc/misc.nix2
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/Libsystem/reexported_libraries2
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_kernel_symbols2
-rw-r--r--pkgs/os-specific/linux/mdadm/default.nix1
-rw-r--r--pkgs/os-specific/linux/syslinux/default.nix3
-rw-r--r--pkgs/os-specific/linux/systemd/default.nix21
-rw-r--r--pkgs/os-specific/linux/zfs/default.nix1
-rw-r--r--pkgs/servers/x11/xorg/builder.sh4
-rw-r--r--pkgs/stdenv/adapters.nix19
-rw-r--r--pkgs/stdenv/darwin/darwin-secure-format.patch15
-rw-r--r--pkgs/stdenv/darwin/default.nix25
-rw-r--r--pkgs/stdenv/darwin/unpack-bootstrap-tools.sh2
-rw-r--r--pkgs/stdenv/generic/builder.sh4
-rw-r--r--pkgs/stdenv/generic/make-derivation.nix25
-rw-r--r--pkgs/stdenv/generic/setup.sh330
-rw-r--r--pkgs/tools/compression/gzip/default.nix4
-rw-r--r--pkgs/tools/graphics/argyllcms/default.nix2
-rw-r--r--pkgs/tools/misc/coreutils/default.nix3
-rw-r--r--pkgs/tools/misc/grub/2.0x.nix2
-rw-r--r--pkgs/tools/networking/openssh/default.nix6
-rw-r--r--pkgs/tools/networking/ppp/default.nix4
-rw-r--r--pkgs/tools/networking/unbound/default.nix3
-rw-r--r--pkgs/tools/security/vulnix/requirements.nix96
-rw-r--r--pkgs/tools/system/pciutils/default.nix4
-rw-r--r--pkgs/tools/text/gnugrep/default.nix4
-rw-r--r--pkgs/top-level/all-packages.nix7
-rw-r--r--pkgs/top-level/python-packages.nix250
119 files changed, 997 insertions, 1197 deletions
diff --git a/pkgs/applications/editors/nano/default.nix b/pkgs/applications/editors/nano/default.nix
index d924532eb340..7b67610772e4 100644
--- a/pkgs/applications/editors/nano/default.nix
+++ b/pkgs/applications/editors/nano/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, fetchFromGitHub
+{ stdenv, hostPlatform, fetchurl, fetchFromGitHub
 , ncurses
 , texinfo
 , gettext ? null
@@ -27,6 +27,8 @@ in stdenv.mkDerivation rec {
     sha256 = "0xjpm2ka56x5ycrgjh06v110na13xlbm42bs8qibk7g578m9cils";
   };
 
+  patches = stdenv.lib.optional hostPlatform.isDarwin stdenv.secure-format-patch;
+
   nativeBuildInputs = [ texinfo ] ++ optional enableNls gettext;
   buildInputs = [ ncurses ];
 
diff --git a/pkgs/applications/virtualization/qemu/default.nix b/pkgs/applications/virtualization/qemu/default.nix
index d09926da7cdb..8277261a1500 100644
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@@ -59,6 +59,10 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "stackprotector" ];
 
+  preConfigure = ''
+    unset CPP # intereferes with dependency calculation
+  '';
+
   configureFlags =
     [ "--smbd=smbd" # use `smbd' from $PATH
       "--audio-drv-list=${audio}"
diff --git a/pkgs/build-support/buildenv/builder.pl b/pkgs/build-support/buildenv/builder.pl
index 678f5a3fe9e6..7cc37d156735 100755
--- a/pkgs/build-support/buildenv/builder.pl
+++ b/pkgs/build-support/buildenv/builder.pl
@@ -141,12 +141,11 @@ sub addPkg {
     my $propagatedFN = "$pkgDir/nix-support/propagated-user-env-packages";
     if (-e $propagatedFN) {
         open PROP, "<$propagatedFN" or die;
-        my $propagated = <PROP>;
-        close PROP;
-        my @propagated = split ' ', $propagated;
-        foreach my $p (@propagated) {
+        while (my $p = <PROP>) {
+            chomp $p;
             $postponed{$p} = 1 unless defined $done{$p};
         }
+        close PROP;
     }
 }
 
diff --git a/pkgs/build-support/cc-wrapper/cc-wrapper.sh b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
index 3ccdc34db5b2..99eb63f40edf 100644
--- a/pkgs/build-support/cc-wrapper/cc-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
@@ -55,7 +55,7 @@ while [ $n -lt ${#params[*]} ]; do
         nonFlagArgs=1
     elif [ "$p" = -m32 ]; then
         if [ -e @out@/nix-support/dynamic-linker-m32 ]; then
-            NIX_LDFLAGS="$NIX_LDFLAGS -dynamic-linker $(cat @out@/nix-support/dynamic-linker-m32)"
+            NIX_LDFLAGS+=" -dynamic-linker $(cat @out@/nix-support/dynamic-linker-m32)"
         fi
     fi
     n=$((n + 1))
@@ -111,9 +111,9 @@ fi
 
 if [[ "$isCpp" = 1 ]]; then
     if [[ "$cppInclude" = 1 ]]; then
-        NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE ${NIX_CXXSTDLIB_COMPILE-@default_cxx_stdlib_compile@}"
+        NIX_CFLAGS_COMPILE+=" ${NIX_CXXSTDLIB_COMPILE-@default_cxx_stdlib_compile@}"
     fi
-    NIX_CFLAGS_LINK="$NIX_CFLAGS_LINK $NIX_CXXSTDLIB_LINK"
+    NIX_CFLAGS_LINK+=" $NIX_CXXSTDLIB_LINK"
 fi
 
 LD=@ldPath@/ld
diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index 676fbd006881..09d1d4cd681a 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -71,22 +71,6 @@ let
         -e 's^addCVars^addCVars${_infixSalt}^g' \
         -e 's^\[ -z "\$crossConfig" \]^\[\[ "${builtins.toString (targetPlatform != hostPlatform)}" || -z "$crossConfig" \]\]^g'
 
-    '' + stdenv.lib.optionalString (textFile == ./setup-hook.sh) ''
-      cat << 'EOF' >> $out
-        for CMD in ar as nm objcopy ranlib strip strings size ld windres
-        do
-          # which is not part of stdenv, but compgen will do for now
-          if
-            PATH=$_PATH type -p ${prefix}$CMD > /dev/null
-          then
-            export ''$(echo "$CMD" | tr "[:lower:]" "[:upper:]")=${prefix}''${CMD};
-          fi
-        done
-      EOF
-
-      sed -i $out -e 's_envHooks_crossEnvHooks_g'
-    '' + ''
-
       # NIX_ things which we don't both use and define, we revert them
       #asymmetric=$(
       #  for pre in "" "\\$"
@@ -105,22 +89,20 @@ let
       done
     '');
 
-  # The dynamic linker has different names on different platforms.
+  # The dynamic linker has different names on different platforms. This is a
+  # shell glob that ought to match it.
   dynamicLinker =
-    if !nativeLibc then
-      (if targetPlatform.system == "i686-linux"     then "ld-linux.so.2" else
-       if targetPlatform.system == "x86_64-linux"   then "ld-linux-x86-64.so.2" else
-       # ARM with a wildcard, which can be "" or "-armhf".
-       if targetPlatform.isArm32                    then "ld-linux*.so.3" else
-       if targetPlatform.system == "aarch64-linux"  then "ld-linux-aarch64.so.1" else
-       if targetPlatform.system == "powerpc-linux"  then "ld.so.1" else
-       if targetPlatform.system == "mips64el-linux" then "ld.so.1" else
-       if targetPlatform.system == "x86_64-darwin"  then "/usr/lib/dyld" else
-       if stdenv.lib.hasSuffix "pc-gnu" targetPlatform.config then "ld.so.1" else
-       builtins.trace
-         "Don't know the name of the dynamic linker for platform ${targetPlatform.config}, so guessing instead."
-         null)
-    else "";
+    /**/ if libc == null then null
+    else if targetPlatform.system == "i686-linux"     then "${libc_lib}/lib/ld-linux.so.2"
+    else if targetPlatform.system == "x86_64-linux"   then "${libc_lib}/lib/ld-linux-x86-64.so.2"
+    # ARM with a wildcard, which can be "" or "-armhf".
+    else if targetPlatform.isArm32                    then "${libc_lib}/lib/ld-linux*.so.3"
+    else if targetPlatform.system == "aarch64-linux"  then "${libc_lib}/lib/ld-linux-aarch64.so.1"
+    else if targetPlatform.system == "powerpc-linux"  then "${libc_lib}/lib/ld.so.1"
+    else if targetPlatform.system == "mips64el-linux" then "${libc_lib}/lib/ld.so.1"
+    else if targetPlatform.system == "x86_64-darwin"  then "/usr/lib/dyld"
+    else if stdenv.lib.hasSuffix "pc-gnu" targetPlatform.config then "ld.so.1"
+    else null;
 
   expand-response-params = if buildPackages.stdenv.cc or null != null && buildPackages.stdenv.cc != "/dev/null"
   then buildPackages.stdenv.mkDerivation {
@@ -145,6 +127,7 @@ stdenv.mkDerivation {
   inherit cc shell libc_bin libc_dev libc_lib binutils_bin coreutils_bin;
   gnugrep_bin = if nativeTools then "" else gnugrep;
 
+  binPrefix = prefix;
 
   passthru = {
     inherit libc nativeTools nativeLibc nativePrefix isGNU isClang default_cxx_stdlib_compile
@@ -175,39 +158,39 @@ stdenv.mkDerivation {
       }
     ''
 
-      # TODO(@Ericson2314): Unify logic next hash break
-    + optionalString (libc != null) (if (targetPlatform.isDarwin) then ''
-      echo $dynamicLinker > $out/nix-support/dynamic-linker
+    + optionalString (libc != null) (''
+      if [[ -z ''${dynamicLinker+x} ]]; then
+        echo "Don't know the name of the dynamic linker for platform '${targetPlatform.config}', so guessing instead." >&2
+        dynamicLinker="${libc_lib}/lib/ld*.so.?"
+      fi
 
-      echo "export LD_DYLD_PATH=\"$dynamicLinker\"" >> $out/nix-support/setup-hook
-    '' else if dynamicLinker != null then ''
-      dynamicLinker="${libc_lib}/lib/$dynamicLinker"
-      echo $dynamicLinker > $out/nix-support/dynamic-linker
+      # Expand globs to fill array of options
+      dynamicLinker=($dynamicLinker)
 
-      if [ -e ${libc_lib}/lib/32/ld-linux.so.2 ]; then
-        echo ${libc_lib}/lib/32/ld-linux.so.2 > $out/nix-support/dynamic-linker-m32
-      fi
+      case ''${#dynamicLinker[@]} in
+        0) echo "No dynamic linker found for platform '${targetPlatform.config}'." >&2;;
+        1) echo "Using dynamic linker: '$dynamicLinker'" >&2;;
+        *) echo "Multiple dynamic linkers found for platform '${targetPlatform.config}'." >&2;;
+      esac
 
-      # The dynamic linker is passed in `ldflagsBefore' to allow
-      # explicit overrides of the dynamic linker by callers to gcc/ld
-      # (the *last* value counts, so ours should come first).
-      echo "-dynamic-linker" $dynamicLinker > $out/nix-support/libc-ldflags-before
-    '' else ''
-      dynamicLinker=`eval 'echo $libc/lib/ld*.so.?'`
       if [ -n "$dynamicLinker" ]; then
         echo $dynamicLinker > $out/nix-support/dynamic-linker
 
+    '' + (if targetPlatform.isDarwin then ''
+        printf "export LD_DYLD_PATH+=%q\n" "$dynamicLinker" >> $out/nix-support/setup-hook
+    '' else ''
         if [ -e ${libc_lib}/lib/32/ld-linux.so.2 ]; then
           echo ${libc_lib}/lib/32/ld-linux.so.2 > $out/nix-support/dynamic-linker-m32
         fi
 
-        ldflagsBefore="-dynamic-linker $dlinker"
+        ldflagsBefore=(-dynamic-linker "$dynamicLinker")
+    '') + ''
       fi
 
       # The dynamic linker is passed in `ldflagsBefore' to allow
       # explicit overrides of the dynamic linker by callers to gcc/ld
       # (the *last* value counts, so ours should come first).
-      echo "$ldflagsBefore" > $out/nix-support/libc-ldflags-before
+      printWords "''${ldflagsBefore[@]}" > $out/nix-support/libc-ldflags-before
     '')
 
     + optionalString (libc != null) ''
@@ -275,9 +258,9 @@ stdenv.mkDerivation {
       # Propagate the wrapped cc so that if you install the wrapper,
       # you get tools like gcov, the manpages, etc. as well (including
       # for binutils and Glibc).
-      echo ${cc} ${cc.man or ""} ${binutils_bin} ${if libc == null then "" else libc_bin} > $out/nix-support/propagated-user-env-packages
+      printWords ${cc} ${cc.man or ""} ${binutils_bin} ${if libc == null then "" else libc_bin} > $out/nix-support/propagated-user-env-packages
 
-      echo ${toString extraPackages} > $out/nix-support/propagated-native-build-inputs
+      printWords ${toString extraPackages} > $out/nix-support/propagated-native-build-inputs
     ''
 
     + optionalString (targetPlatform.isSunOS && nativePrefix != "") ''
@@ -305,20 +288,24 @@ stdenv.mkDerivation {
         wrap ${prefix}ld.bfd ${preWrap ./ld-wrapper.sh} ${binutils_bin}/bin/${prefix}ld.bfd
       fi
 
-      export real_cc=${prefix}cc
-      export real_cxx=${prefix}c++
+      # We export environment variables pointing to the wrapped nonstandard
+      # cmds, lest some lousy configure script use those to guess compiler
+      # version.
+      export named_cc=${prefix}cc
+      export named_cxx=${prefix}c++
+
       export default_cxx_stdlib_compile="${default_cxx_stdlib_compile}"
 
       if [ -e $ccPath/${prefix}gcc ]; then
         wrap ${prefix}gcc ${preWrap ./cc-wrapper.sh} $ccPath/${prefix}gcc
         ln -s ${prefix}gcc $out/bin/${prefix}cc
-        export real_cc=${prefix}gcc
-        export real_cxx=${prefix}g++
+        export named_cc=${prefix}gcc
+        export named_cxx=${prefix}g++
       elif [ -e $ccPath/clang ]; then
         wrap ${prefix}clang ${preWrap ./cc-wrapper.sh} $ccPath/clang
         ln -s ${prefix}clang $out/bin/${prefix}cc
-        export real_cc=clang
-        export real_cxx=clang++
+        export named_cc=${prefix}clang
+        export named_cxx=${prefix}clang++
       fi
 
       if [ -e $ccPath/${prefix}g++ ]; then
diff --git a/pkgs/build-support/cc-wrapper/ld-wrapper.sh b/pkgs/build-support/cc-wrapper/ld-wrapper.sh
index 056cfa920535..240082b5dfdc 100644
--- a/pkgs/build-support/cc-wrapper/ld-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/ld-wrapper.sh
@@ -64,7 +64,9 @@ extra+=($NIX_LDFLAGS_AFTER $NIX_LDFLAGS_HARDEN)
 # Add all used dynamic libraries to the rpath.
 if [ "$NIX_DONT_SET_RPATH" != 1 ]; then
 
-    libPath=""
+    declare -A libDirsSeen
+    declare -a libDirs
+
     addToLibPath() {
         local path="$1"
         if [ "${path:0:1}" != / ]; then return 0; fi
@@ -76,29 +78,27 @@ if [ "$NIX_DONT_SET_RPATH" != 1 ]; then
                 fi
                 ;;
         esac
-        case $libPath in
-            *\ $path\ *) return 0 ;;
-        esac
-        libPath="$libPath $path "
+        if [[ -z ${libDirsSeen[$path]} ]]; then
+            libDirs+=("$path")
+            libDirsSeen[$path]=1
+        fi
     }
 
+    declare -A rpathsSeen
+    declare -a rpaths
+
     addToRPath() {
         # If the path is not in the store, don't add it to the rpath.
         # This typically happens for libraries in /tmp that are later
         # copied to $out/lib.  If not, we're screwed.
         if [ "${1:0:${#NIX_STORE}}" != "$NIX_STORE" ]; then return 0; fi
-        case $rpath in
-            *\ $1\ *) return 0 ;;
-        esac
-        rpath="$rpath $1 "
-    }
-
-    libs=""
-    addToLibs() {
-        libs="$libs $1"
+        if [[ -z ${rpathsSeen[$1]} ]]; then
+            rpaths+=("$1")
+            rpathsSeen[$1]=1
+        fi
     }
 
-    rpath=""
+    declare -a libs
 
     # First, find all -L... switches.
     allParams=("${params[@]}" ${extra[@]})
@@ -112,10 +112,10 @@ if [ "$NIX_DONT_SET_RPATH" != 1 ]; then
             addToLibPath ${p2}
             n=$((n + 1))
         elif [ "$p" = -l ]; then
-            addToLibs ${p2}
+            libs+=(${p2})
             n=$((n + 1))
         elif [ "${p:0:2}" = -l ]; then
-            addToLibs ${p:2}
+            libs+=(${p:2})
         elif [ "$p" = -dynamic-linker ]; then
             # Ignore the dynamic linker argument, or it
             # will get into the next 'elif'. We don't want
@@ -135,9 +135,8 @@ if [ "$NIX_DONT_SET_RPATH" != 1 ]; then
     # so, add the directory to the rpath.
     # It's important to add the rpath in the order of -L..., so
     # the link time chosen objects will be those of runtime linking.
-
-    for i in $libPath; do
-        for j in $libs; do
+    for i in ${libDirs[@]}; do
+        for j in ${libs[@]}; do
             if [ -f "$i/lib$j.so" ]; then
                 addToRPath $i
                 break
@@ -145,10 +144,9 @@ if [ "$NIX_DONT_SET_RPATH" != 1 ]; then
         done
     done
 
-
     # Finally, add `-rpath' switches.
-    for i in $rpath; do
-        extra+=(-rpath $i)
+    for i in ${rpaths[@]}; do
+        extra+=(-rpath "$i")
     done
 fi
 
diff --git a/pkgs/build-support/cc-wrapper/setup-hook.sh b/pkgs/build-support/cc-wrapper/setup-hook.sh
index f4f7ab181d3e..104b82425f29 100644
--- a/pkgs/build-support/cc-wrapper/setup-hook.sh
+++ b/pkgs/build-support/cc-wrapper/setup-hook.sh
@@ -1,5 +1,3 @@
-export NIX_CC=@out@
-
 addCVars () {
     if [ -d $1/include ]; then
         export NIX_CFLAGS_COMPILE+=" ${ccIncludeFlag:--isystem} $1/include"
@@ -39,9 +37,26 @@ if [ -n "@coreutils_bin@" ]; then
 fi
 
 if [ -z "$crossConfig" ]; then
-    export CC=@real_cc@
-    export CXX=@real_cxx@
+  ENV_PREFIX=""
 else
-    export BUILD_CC=@real_cc@
-    export BUILD_CXX=@real_cxx@
+  ENV_PREFIX="BUILD_"
 fi
+
+export NIX_${ENV_PREFIX}CC=@out@
+
+export ${ENV_PREFIX}CC=@named_cc@
+export ${ENV_PREFIX}CXX=@named_cxx@
+
+for CMD in \
+    cpp \
+    ar as nm objcopy ranlib strip strings size ld windres
+do
+    if
+        PATH=$_PATH type -p "@binPrefix@$CMD" > /dev/null
+    then
+        export "${ENV_PREFIX}$(echo "$CMD" | tr "[:lower:]" "[:upper:]")=@binPrefix@${CMD}";
+    fi
+done
+
+# No local scope available for sourced files
+unset ENV_PREFIX
diff --git a/pkgs/build-support/fetchurl/builder.sh b/pkgs/build-support/fetchurl/builder.sh
index c4fd18e46caf..7c2bdf260b4e 100644
--- a/pkgs/build-support/fetchurl/builder.sh
+++ b/pkgs/build-support/fetchurl/builder.sh
@@ -39,7 +39,6 @@ tryDownload() {
           curlexit=$?;
        fi
     done
-    stopNest
 }
 
 
@@ -51,7 +50,6 @@ finish() {
     fi
 
     runHook postFetch
-    stopNest
     exit 0
 }
 
diff --git a/pkgs/build-support/gcc-wrapper-old/builder.sh b/pkgs/build-support/gcc-wrapper-old/builder.sh
index a8e8a370ec0d..22e32814927e 100644
--- a/pkgs/build-support/gcc-wrapper-old/builder.sh
+++ b/pkgs/build-support/gcc-wrapper-old/builder.sh
@@ -211,5 +211,5 @@ cp -p $utils $out/nix-support/utils.sh
 # tools like gcov, the manpages, etc. as well (including for binutils
 # and Glibc).
 if test -z "$nativeTools"; then
-    echo $gcc $binutils $libc $libc_bin > $out/nix-support/propagated-user-env-packages
+    printWords $gcc $binutils $libc $libc_bin > $out/nix-support/propagated-user-env-packages
 fi
diff --git a/pkgs/build-support/trivial-builders.nix b/pkgs/build-support/trivial-builders.nix
index 4debd9636396..16bd4e8e4054 100644
--- a/pkgs/build-support/trivial-builders.nix
+++ b/pkgs/build-support/trivial-builders.nix
@@ -84,7 +84,7 @@ rec {
         mkdir -p $out/nix-support
         cp ${script} $out/nix-support/setup-hook
       '' + lib.optionalString (deps != []) ''
-        echo ${toString deps} > $out/nix-support/propagated-native-build-inputs
+        printWords ${toString deps} > $out/nix-support/propagated-native-build-inputs
       '' + lib.optionalString (substitutions != {}) ''
         substituteAll ${script} $out/nix-support/setup-hook
       '');
diff --git a/pkgs/data/misc/dns-root-data/default.nix b/pkgs/data/misc/dns-root-data/default.nix
new file mode 100644
index 000000000000..ec0d9c83ad51
--- /dev/null
+++ b/pkgs/data/misc/dns-root-data/default.nix
@@ -0,0 +1,29 @@
+{ stdenv, lib, fetchurl }:
+
+let
+
+  rootHints = fetchurl {
+    url = "http://www.internic.net/domain/named.root";
+    sha256 = "1zf3ydn44z70gq1kd95lvk9cp68xlbl8vqpswqlhd30qafx6v6d1";
+  };
+
+  rootKey = ./root.key;
+  rootDs = ./root.ds;
+
+in
+
+stdenv.mkDerivation {
+  name = "dns-root-data-2017-07-11";
+
+  buildCommand = ''
+    mkdir $out
+    cp ${rootHints} $out/root.hints
+    cp ${rootKey} $out/root.key
+    cp ${rootDs} $out/root.ds
+  '';
+
+  meta = with lib; {
+    description = "DNS root data including root zone and DNSSEC key";
+    maintainers = with maintainers; [ fpletz ];
+  };
+}
diff --git a/pkgs/data/misc/dns-root-data/root.ds b/pkgs/data/misc/dns-root-data/root.ds
new file mode 100644
index 000000000000..7578e0405d9d
--- /dev/null
+++ b/pkgs/data/misc/dns-root-data/root.ds
@@ -0,0 +1,2 @@
+. IN DS 19036 8 2 49AAC11D7B6F6446702E54A1607371607A1A41855200FD2CE1CDDE32F24E8FB5
+. IN DS 20326 8 2 E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D
diff --git a/pkgs/data/misc/dns-root-data/root.key b/pkgs/data/misc/dns-root-data/root.key
new file mode 100644
index 000000000000..c0da7b3f60fa
--- /dev/null
+++ b/pkgs/data/misc/dns-root-data/root.key
@@ -0,0 +1,2 @@
+.	172800	IN	DNSKEY	257 3 8 AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjFFVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoXbfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaDX6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpzW5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relSQageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulqQxA+Uk1ihz0= ;{id = 19036 (ksk), size = 2048b}
+.	172800	IN	DNSKEY	257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ;{id = 20326 (ksk), size = 2048b}
diff --git a/pkgs/data/misc/dns-root-data/update-root-key.sh b/pkgs/data/misc/dns-root-data/update-root-key.sh
new file mode 100755
index 000000000000..9a3141aef197
--- /dev/null
+++ b/pkgs/data/misc/dns-root-data/update-root-key.sh
@@ -0,0 +1,10 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p busybox unbound
+
+TMP=`mktemp`
+unbound-anchor -a "$TMP"
+grep -Ev "^($$|;)" "$TMP" | sed -e 's/ ;;.*//' > root.key
+
+unbound-anchor -F -a "$TMP"
+sed '/^;/d' < "$TMP" > root.ds
+rm $TMP
diff --git a/pkgs/data/sgml+xml/stylesheets/xslt/docbook-xsl/default.nix b/pkgs/data/sgml+xml/stylesheets/xslt/docbook-xsl/default.nix
index a527765688d6..a955f5cf8a48 100644
--- a/pkgs/data/sgml+xml/stylesheets/xslt/docbook-xsl/default.nix
+++ b/pkgs/data/sgml+xml/stylesheets/xslt/docbook-xsl/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, ruby }:
+{ lib, stdenv, fetchurl }:
 
 let
 
@@ -10,8 +10,6 @@ let
       inherit sha256;
     };
 
-    buildInputs = [ ruby ];
-
     dontBuild = true;
 
     installPhase = ''
@@ -23,9 +21,6 @@ let
       # Backwards compatibility. Will remove eventually.
       mkdir -p $out/xml/xsl
       ln -s $dst $out/xml/xsl/docbook
-
-      ln -sv $dst/epub/bin $out
-      chmod +x $out/bin/dbtoepub
     '';
 
     meta = {
diff --git a/pkgs/desktops/kde-4.14/kde-package/default.nix b/pkgs/desktops/kde-4.14/kde-package/default.nix
index d5de6f5f6bc1..94f878097ded 100644
--- a/pkgs/desktops/kde-4.14/kde-package/default.nix
+++ b/pkgs/desktops/kde-4.14/kde-package/default.nix
@@ -86,7 +86,7 @@ rec {
        };})
         ''
           mkdir -pv $out/nix-support
-          echo "${toString list}" | tee $out/nix-support/propagated-user-env-packages
+          printWords ${toString list} | tee $out/nix-support/propagated-user-env-packages
         '';
 
   # Given manifest module data, return the module
diff --git a/pkgs/development/compilers/openjdk-darwin/8.nix b/pkgs/development/compilers/openjdk-darwin/8.nix
index 51effd2c7841..6234b63208cd 100644
--- a/pkgs/development/compilers/openjdk-darwin/8.nix
+++ b/pkgs/development/compilers/openjdk-darwin/8.nix
@@ -33,7 +33,7 @@ let
       # any package that depends on the JRE has $CLASSPATH set up
       # properly.
       mkdir -p $out/nix-support
-      echo -n "${setJavaClassPath}" > $out/nix-support/propagated-native-build-inputs
+      printWords ${setJavaClassPath} > $out/nix-support/propagated-native-build-inputs
 
       install_name_tool -change /usr/X11/lib/libfreetype.6.dylib ${freetype}/lib/libfreetype.6.dylib $out/jre/lib/libfontmanager.dylib
 
diff --git a/pkgs/development/compilers/openjdk-darwin/default.nix b/pkgs/development/compilers/openjdk-darwin/default.nix
index 10a9eb2b3666..1e8f88beea66 100644
--- a/pkgs/development/compilers/openjdk-darwin/default.nix
+++ b/pkgs/development/compilers/openjdk-darwin/default.nix
@@ -23,7 +23,7 @@ let
       # any package that depends on the JRE has $CLASSPATH set up
       # properly.
       mkdir -p $out/nix-support
-      echo -n "${setJavaClassPath}" > $out/nix-support/propagated-native-build-inputs
+      printWords ${setJavaClassPath} > $out/nix-support/propagated-native-build-inputs
 
       install_name_tool -change /usr/X11/lib/libfreetype.6.dylib ${freetype}/lib/libfreetype.6.dylib $out/jre/lib/libfontmanager.dylib
 
diff --git a/pkgs/development/compilers/openjdk/7.nix b/pkgs/development/compilers/openjdk/7.nix
index 6dcbb0a330f1..72f0ba293ba9 100644
--- a/pkgs/development/compilers/openjdk/7.nix
+++ b/pkgs/development/compilers/openjdk/7.nix
@@ -190,7 +190,7 @@ let
       # any package that depends on the JRE has $CLASSPATH set up
       # properly.
       mkdir -p $jre/nix-support
-      echo -n "${setJavaClassPath}" > $jre/nix-support/propagated-native-build-inputs
+      printWords ${setJavaClassPath} > $jre/nix-support/propagated-native-build-inputs
 
       # Set JAVA_HOME automatically.
       mkdir -p $out/nix-support
diff --git a/pkgs/development/compilers/openjdk/8.nix b/pkgs/development/compilers/openjdk/8.nix
index 7977881d5f6d..0f0b42640c5d 100644
--- a/pkgs/development/compilers/openjdk/8.nix
+++ b/pkgs/development/compilers/openjdk/8.nix
@@ -202,7 +202,7 @@ let
       # any package that depends on the JRE has $CLASSPATH set up
       # properly.
       mkdir -p $jre/nix-support
-      echo -n "${setJavaClassPath}" > $jre/nix-support/propagated-native-build-inputs
+      printWords ${setJavaClassPath} > $jre/nix-support/propagated-native-build-inputs
 
       # Set JAVA_HOME automatically.
       mkdir -p $out/nix-support
diff --git a/pkgs/development/compilers/oraclejdk/jdk-linux-base.nix b/pkgs/development/compilers/oraclejdk/jdk-linux-base.nix
index 6db0029730a0..fec038199adc 100644
--- a/pkgs/development/compilers/oraclejdk/jdk-linux-base.nix
+++ b/pkgs/development/compilers/oraclejdk/jdk-linux-base.nix
@@ -165,7 +165,7 @@ let result = stdenv.mkDerivation rec {
     ln -s $jrePath/lib/${architecture}/libnpjp2.so $jrePath/lib/${architecture}/plugins
 
     mkdir -p $out/nix-support
-    echo -n "${setJavaClassPath}" > $out/nix-support/propagated-native-build-inputs
+    printWords ${setJavaClassPath} > $out/nix-support/propagated-native-build-inputs
 
     # Set JAVA_HOME automatically.
     cat <<EOF >> $out/nix-support/setup-hook
diff --git a/pkgs/development/compilers/zulu/default.nix b/pkgs/development/compilers/zulu/default.nix
index c4cdf70f14ac..f7638757ff7a 100644
--- a/pkgs/development/compilers/zulu/default.nix
+++ b/pkgs/development/compilers/zulu/default.nix
@@ -54,7 +54,7 @@ in stdenv.mkDerivation rec {
     find $out -name "*.so" -exec patchelf --set-rpath "$rpath" {} \;
 
     mkdir -p $out/nix-support
-    echo -n "${setJavaClassPath}" > $out/nix-support/propagated-native-build-inputs
+    printWords ${setJavaClassPath} > $out/nix-support/propagated-native-build-inputs
 
     # Set JAVA_HOME automatically.
     cat <<EOF >> $out/nix-support/setup-hook
diff --git a/pkgs/development/haskell-modules/generic-builder.nix b/pkgs/development/haskell-modules/generic-builder.nix
index 36e391183fad..7e99300a41e1 100644
--- a/pkgs/development/haskell-modules/generic-builder.nix
+++ b/pkgs/development/haskell-modules/generic-builder.nix
@@ -218,7 +218,7 @@ stdenv.mkDerivation ({
     configureFlags="${concatStringsSep " " defaultConfigureFlags} $configureFlags"
 
     # nativePkgs defined in stdenv/setup.hs
-    for p in $nativePkgs; do
+    for p in "''${nativePkgs[@]}"; do
       if [ -d "$p/lib/${ghc.name}/package.conf.d" ]; then
         cp -f "$p/lib/${ghc.name}/package.conf.d/"*.conf $packageConfDir/
         continue
@@ -318,7 +318,7 @@ stdenv.mkDerivation ({
     ${optionalString isGhcjs ''
       for exeDir in "$out/bin/"*.jsexe; do
         exe="''${exeDir%.jsexe}"
-        printf '%s\n' '#!${nodejs}/bin/node' > "$exe"
+        printWords '#!${nodejs}/bin/node' > "$exe"
         cat "$exeDir/all.js" >> "$exe"
         chmod +x "$exe"
       done
diff --git a/pkgs/development/interpreters/python/cpython/3.6/default.nix b/pkgs/development/interpreters/python/cpython/3.6/default.nix
index d2d922ce4955..bca717b919ba 100644
--- a/pkgs/development/interpreters/python/cpython/3.6/default.nix
+++ b/pkgs/development/interpreters/python/cpython/3.6/default.nix
@@ -27,7 +27,7 @@ with stdenv.lib;
 
 let
   majorVersion = "3.6";
-  minorVersion = "1";
+  minorVersion = "2";
   minorVersionSuffix = "";
   pythonVersion = majorVersion;
   version = "${majorVersion}.${minorVersion}${minorVersionSuffix}";
@@ -48,7 +48,7 @@ in stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://www.python.org/ftp/python/${majorVersion}.${minorVersion}/Python-${version}.tar.xz";
-    sha256 = "0ha03sbakxblzyvlramx5fj0ranzmzx4pa2png6nn8gczkfi0650";
+    sha256 = "1ab4vlpdax1ihpiyiwchlgsk36apl4kgdw271wvl9l8ywhxpfacj";
   };
 
   NIX_LDFLAGS = optionalString stdenv.isLinux "-lgcc_s";
diff --git a/pkgs/development/interpreters/python/wrap.sh b/pkgs/development/interpreters/python/wrap.sh
index 1c74e612b559..4b9b2024981a 100644
--- a/pkgs/development/interpreters/python/wrap.sh
+++ b/pkgs/development/interpreters/python/wrap.sh
@@ -86,7 +86,7 @@ wrapPythonProgramsIn() {
 _addToPythonPath() {
     local dir="$1"
     # Stop if we've already visited here.
-    if [ -n "${pythonPathsSeen[$dir]}" ]; then return; fi
+    [ -n "${pythonPathsSeen[$dir]}" ] || return 0
     pythonPathsSeen[$dir]=1
     # addToSearchPath is defined in stdenv/generic/setup.sh. It will have
     # the effect of calling `export program_X=$dir/...:$program_X`.
diff --git a/pkgs/development/libraries/dbus/default.nix b/pkgs/development/libraries/dbus/default.nix
index f569f53861dc..5fe13d86f2db 100644
--- a/pkgs/development/libraries/dbus/default.nix
+++ b/pkgs/development/libraries/dbus/default.nix
@@ -6,8 +6,8 @@ assert x11Support -> libX11 != null
                   && libSM != null;
 
 let
-  version = "1.10.18";
-  sha256 = "0jjirhw6xwz2ffmbg5kr79108l8i1bdaw7szc67n3qpkygaxsjb0";
+  version = "1.10.20";
+  sha256 = "0j0b8rn9fvh1m4nndp9fzq09xw50grp5kfvkv7jgs9al1dwbjx75";
 
 self = stdenv.mkDerivation {
     name = "dbus-${version}";
diff --git a/pkgs/development/libraries/gnutls/generic.nix b/pkgs/development/libraries/gnutls/generic.nix
index 48aa3fb96737..2a73682a7461 100644
--- a/pkgs/development/libraries/gnutls/generic.nix
+++ b/pkgs/development/libraries/gnutls/generic.nix
@@ -1,6 +1,7 @@
 { lib, fetchurl, stdenv, zlib, lzo, libtasn1, nettle, pkgconfig, lzip
 , guileBindings, guile, perl, gmp, autogen, libidn, p11_kit, libiconv
 , tpmSupport ? false, trousers, which, nettools, libunistring
+, unbound, dns-root-data
 
 # Version dependent args
 , version, src, patches ? [], postPatch ? "", nativeBuildInputs ? []
@@ -32,12 +33,13 @@ stdenv.mkDerivation {
   ++ [
     "--disable-dependency-tracking"
     "--enable-fast-install"
+    "--with-unbound-root-key-file=${dns-root-data}/root.key"
   ] ++ lib.optional guileBindings
     [ "--enable-guile" "--with-guile-site-dir=\${out}/share/guile/site" ];
 
   enableParallelBuilding = true;
 
-  buildInputs = [ lzo lzip libtasn1 libidn p11_kit zlib gmp autogen libunistring ]
+  buildInputs = [ lzo lzip libtasn1 libidn p11_kit zlib gmp autogen libunistring unbound ]
     ++ lib.optional (stdenv.isFreeBSD || stdenv.isDarwin) libiconv
     ++ lib.optional (tpmSupport && stdenv.isLinux) trousers
     ++ lib.optional guileBindings guile
diff --git a/pkgs/development/libraries/gtk+/3.x.nix b/pkgs/development/libraries/gtk+/3.x.nix
index 917371678e9d..cf888641b94b 100644
--- a/pkgs/development/libraries/gtk+/3.x.nix
+++ b/pkgs/development/libraries/gtk+/3.x.nix
@@ -13,7 +13,7 @@ with stdenv.lib;
 
 let
   ver_maj = "3.22";
-  ver_min = "15";
+  ver_min = "16";
   version = "${ver_maj}.${ver_min}";
 in
 stdenv.mkDerivation rec {
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gtk+/${ver_maj}/gtk+-${version}.tar.xz";
-    sha256 = "c8a012c2a99132629ab043f764a2b7cb6388483a015cd15c7a4288bec3590fdb";
+    sha256 = "3e0c3ad01f3c8c5c9b1cc1ae00852bd55164c8e5a9c1f90ba5e07f14f175fe2c";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/ldns/default.nix b/pkgs/development/libraries/ldns/default.nix
index 91eb7aecea90..816b850f1003 100644
--- a/pkgs/development/libraries/ldns/default.nix
+++ b/pkgs/development/libraries/ldns/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchurl, openssl, perl}:
+{stdenv, fetchurl, openssl, perl, dns-root-data}:
 
 stdenv.mkDerivation rec {
   pname = "ldns";
@@ -15,15 +15,27 @@ stdenv.mkDerivation rec {
     patchShebangs doc/doxyparse.pl
   '';
 
-  outputs = [ "out" "dev" "man" ];
+  outputs = [ "out" "dev" "man" "examples" ];
 
   nativeBuildInputs = [ perl ];
   buildInputs = [ openssl ];
 
-  configureFlags = [ "--with-ssl=${openssl.dev}" "--with-drill"];
+  configureFlags = [
+    "--with-ssl=${openssl.dev}"
+    "--with-trust-anchor=${dns-root-data}/root.key"
+    "--with-drill"
+    "--disable-gost"
+  ];
 
   postInstall = ''
     moveToOutput "bin/ldns-config" "$dev"
+
+    pushd examples
+    configureFlagsArray+=( "--bindir=$examples/bin" )
+    configurePhase
+    make
+    make install
+    popd
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/libraries/libgcrypt/default.nix b/pkgs/development/libraries/libgcrypt/default.nix
index ac54858b1de3..ed742bee8741 100644
--- a/pkgs/development/libraries/libgcrypt/default.nix
+++ b/pkgs/development/libraries/libgcrypt/default.nix
@@ -4,11 +4,11 @@ assert enableCapabilities -> stdenv.isLinux;
 
 stdenv.mkDerivation rec {
   name = "libgcrypt-${version}";
-  version = "1.7.8";
+  version = "1.8.0";
 
   src = fetchurl {
     url = "mirror://gnupg/libgcrypt/${name}.tar.bz2";
-    sha256 = "16f1rsv4y4w2pk1il2jbcqggsb6mrlfva5vayd205fp68zm7d0ll";
+    sha256 = "06w97l88y2c29zf8p8cg0m4k2kiiyj6pqxdl0cxigi3wp2brdr13";
   };
 
   outputs = [ "out" "dev" "info" ];
diff --git a/pkgs/development/libraries/libjpeg-turbo/default.nix b/pkgs/development/libraries/libjpeg-turbo/default.nix
index cd8484170bdb..d1181966815e 100644
--- a/pkgs/development/libraries/libjpeg-turbo/default.nix
+++ b/pkgs/development/libraries/libjpeg-turbo/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   name = "libjpeg-turbo-${version}";
-  version = "1.5.1";
+  version = "1.5.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/libjpeg-turbo/${name}.tar.gz";
-    sha256 = "0v365hm6z6lddcqagjj15wflk66rqyw75m73cqzl65rh4lyrshj1";
+    sha256 = "0a5m0psfp5952y5vrcs0nbdz1y9wqzg2ms0xwrx752034wxr964h";
   }; # github releases still need autotools, surprisingly
 
   patches =
diff --git a/pkgs/development/libraries/libpng/default.nix b/pkgs/development/libraries/libpng/default.nix
index c2f50af84ca8..0ae40a763864 100644
--- a/pkgs/development/libraries/libpng/default.nix
+++ b/pkgs/development/libraries/libpng/default.nix
@@ -5,13 +5,13 @@
 assert zlib != null;
 
 let
-  version = "1.6.29";
-  patchVersion = "1.6.26";
+  version = "1.6.30";
+  patchVersion = "1.6.30";
   # patchVersion = version;
-  sha256 = "0fgjqp7x6jynacmqh6dj72cn6nnf6yxjfqqqfsxrx0pyx22bcia2";
+  sha256 = "0rin6la7q03vb7wsafhlvzqri1v9ky30g4ljsfcwa37pzwpk6z16";
   patch_src = fetchurl {
     url = "mirror://sourceforge/libpng-apng/libpng-${patchVersion}-apng.patch.gz";
-    sha256 = "0b6p2k4afvhk1svargpllcvhxb4g3p857wkqk85cks0yv42ckph1";
+    sha256 = "06nrcp2n77f563hch8g9gv62jg894mvya6zizj5fsmbqzaqmjqqs";
   };
   whenPatched = stdenv.lib.optionalString apngSupport;
 
diff --git a/pkgs/development/libraries/libunistring/default.nix b/pkgs/development/libraries/libunistring/default.nix
index 662767b6678f..c4acc0627af8 100644
--- a/pkgs/development/libraries/libunistring/default.nix
+++ b/pkgs/development/libraries/libunistring/default.nix
@@ -8,12 +8,14 @@ stdenv.mkDerivation rec {
     sha256 = "1ra1baz2187kbw9im47g6kqb5mx9plq703mkjxaval8rxv5q3q4w";
   };
 
-  patches = stdenv.lib.optional stdenv.isDarwin [ ./clang.patch ];
+  patches = stdenv.lib.optionals stdenv.isDarwin [ ./clang.patch stdenv.secure-format-patch ];
 
   outputs = [ "out" "dev" "info" "doc" ];
 
   propagatedBuildInputs = stdenv.lib.optional (!stdenv.isLinux) libiconv;
 
+  enableParallelBuilding = false;
+
   configureFlags = [
     "--with-libiconv-prefix=${libiconv}"
   ];
diff --git a/pkgs/development/libraries/libuv/default.nix b/pkgs/development/libraries/libuv/default.nix
index fdf5191bf720..1bc58260afe4 100644
--- a/pkgs/development/libraries/libuv/default.nix
+++ b/pkgs/development/libraries/libuv/default.nix
@@ -2,14 +2,14 @@
 , ApplicationServices, CoreServices }:
 
 stdenv.mkDerivation rec {
-  version = "1.12.0";
+  version = "1.13.1";
   name = "libuv-${version}";
 
   src = fetchFromGitHub {
     owner = "libuv";
     repo = "libuv";
     rev = "v${version}";
-    sha256 = "0m025i0sfm4iv3aiic88x4y4bbhhdb204pmd9r383fsl458fck2p";
+    sha256 = "0k348kgdphha1w4cw78zngq3gqcrhcn0az7k0k4w2bgmdf4ip8z8";
   };
 
   postPatch = let
@@ -17,6 +17,7 @@ stdenv.mkDerivation rec {
       "getnameinfo_basic" "udp_send_hang_loop" # probably network-dependent
       "spawn_setuid_fails" "spawn_setgid_fails" "fs_chown" # user namespaces
       "getaddrinfo_fail" "getaddrinfo_fail_sync"
+      "threadpool_multiple_event_loops" # times out on slow machines
     ]
       # sometimes: timeout (no output), failed uv_listen
       ++ stdenv.lib.optionals stdenv.isDarwin [ "process_title" "emfile" ];
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index e1bd4255636a..45819a8f3a6d 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -67,7 +67,7 @@ let
 in
 
 let
-  version = "17.1.4";
+  version = "17.1.5";
   branch  = head (splitString "." version);
   driverLink = "/run/opengl-driver" + optionalString stdenv.isi686 "-32";
 in
@@ -82,7 +82,7 @@ stdenv.mkDerivation {
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
       "https://launchpad.net/mesa/trunk/${version}/+download/mesa-${version}.tar.xz"
     ];
-    sha256 = "06f3b0e6a28f0d20b7f3391cf67fe89ae98ecd0a686cd545da76557b6cec9cad";
+    sha256 = "378516b171712687aace4c7ea8b37c85895231d7a6d61e1e27362cf6034fded9";
   };
 
   prePatch = "patchShebangs .";
diff --git a/pkgs/development/libraries/newt/default.nix b/pkgs/development/libraries/newt/default.nix
index 9002d06693e5..e00decca2ffd 100644
--- a/pkgs/development/libraries/newt/default.nix
+++ b/pkgs/development/libraries/newt/default.nix
@@ -16,6 +16,12 @@ stdenv.mkDerivation rec {
 
   NIX_LDFLAGS = "-lncurses";
 
+  preConfigure = ''
+    # If CPP is set explicitly, configure and make will not agree about which
+    # programs to use at different stages.
+    unset CPP
+  '';
+
   crossAttrs = {
     makeFlags = "CROSS_COMPILE=${stdenv.cc.prefix}";
   };
diff --git a/pkgs/development/libraries/qt-4.x/4.8/default.nix b/pkgs/development/libraries/qt-4.x/4.8/default.nix
index d3eaeed2f1e0..1b87b1b0a27b 100644
--- a/pkgs/development/libraries/qt-4.x/4.8/default.nix
+++ b/pkgs/development/libraries/qt-4.x/4.8/default.nix
@@ -114,6 +114,7 @@ stdenv.mkDerivation rec {
       -datadir $out/share/${name}
       -translationdir $out/share/${name}/translations
     "
+    unset LD # Makefile uses gcc for linking; setting LD interferes
   '' + optionalString stdenv.cc.isClang ''
     sed -i 's/QMAKE_CC = gcc/QMAKE_CC = clang/' mkspecs/common/g++-base.conf
     sed -i 's/QMAKE_CXX = g++/QMAKE_CXX = clang++/' mkspecs/common/g++-base.conf
diff --git a/pkgs/development/libraries/science/math/openblas/default.nix b/pkgs/development/libraries/science/math/openblas/default.nix
index 6f3f78e55018..4d51d1ed02d6 100644
--- a/pkgs/development/libraries/science/math/openblas/default.nix
+++ b/pkgs/development/libraries/science/math/openblas/default.nix
@@ -61,13 +61,13 @@ let
       then blas64_
       else hasPrefix "x86_64" stdenv.system;
 
-  version = "0.2.19";
+  version = "0.2.20";
 in
 stdenv.mkDerivation {
   name = "openblas-${version}";
   src = fetchurl {
     url = "https://github.com/xianyi/OpenBLAS/archive/v${version}.tar.gz";
-    sha256 = "0mw5ra1vjsqiba79zdhqfkqq6v3bla5a5c0wj7vca9qgjzjbah4w";
+    sha256 = "157kpkbpwlr57dkmqiwr3qp9fglfidagv7l6fibrhln6v4aqpwsy";
     name = "openblas-${version}.tar.gz";
   };
 
diff --git a/pkgs/development/libraries/x264/default.nix b/pkgs/development/libraries/x264/default.nix
index 6e4dc00b0387..bf32969836ca 100644
--- a/pkgs/development/libraries/x264/default.nix
+++ b/pkgs/development/libraries/x264/default.nix
@@ -15,6 +15,11 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "lib" ]; # leaving 52 kB of headers
 
+  preConfigure = ''
+    # `AS' is set to the binutils assembler, but we need yasm
+    unset AS
+  '';
+
   configureFlags = [ "--enable-shared" ]
     ++ stdenv.lib.optional (!stdenv.isi686) "--enable-pic"
     ++ stdenv.lib.optional (enable10bit) "--bit-depth=10";
diff --git a/pkgs/development/python-modules/FormEncode/default.nix b/pkgs/development/python-modules/FormEncode/default.nix
new file mode 100644
index 000000000000..ff744fc1b8a8
--- /dev/null
+++ b/pkgs/development/python-modules/FormEncode/default.nix
@@ -0,0 +1,31 @@
+{ stdenv, buildPythonPackage, fetchPypi, dns, pycountry, nose }:
+
+buildPythonPackage rec {
+  pname = "FormEncode";
+  version = "1.3.1";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1xm77h2mds2prlaz0z4nzkx13g61rx5c2v3vpgjq9d5ij8bzb8md";
+  };
+
+  buildInputs = [ dns pycountry nose ];
+
+  patchPhase = ''
+    # dnspython3 has been superseded, see its PyPI page
+    substituteInPlace setup.py --replace dnspython3 dnspython
+  '';
+
+  preCheck = ''
+    # two tests require dns resolving
+    sed -i 's/test_cyrillic_email/noop/' formencode/tests/test_email.py
+    sed -i 's/test_unicode_ascii_subgroup/noop/' formencode/tests/test_email.py
+  '';
+
+  meta = with stdenv.lib; {
+    description = "FormEncode validates and converts nested structures";
+    homepage = "http://formencode.org";
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/development/python-modules/actdiag/default.nix b/pkgs/development/python-modules/actdiag/default.nix
index 064e5e6c11a3..36d49ad29af9 100644
--- a/pkgs/development/python-modules/actdiag/default.nix
+++ b/pkgs/development/python-modules/actdiag/default.nix
@@ -3,12 +3,12 @@
 
 buildPythonPackage rec {
   pname = "actdiag";
-  version = "0.5.3";
+  version = "0.5.4";
   name = "${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1vr4hnkr0gcvvpaycd8q3vcx029b2f5yv8swhdr8kwspaqb0dvfa";
+    sha256 = "983071777d9941093aaef3be1f67c198a8ac8d2bba264cdd1f337ca415ab46af";
   };
 
   buildInputs = [ pep8 nose unittest2 docutils ];
diff --git a/pkgs/development/python-modules/alabaster/default.nix b/pkgs/development/python-modules/alabaster/default.nix
index 69bcaa1fc06e..fcd9a0978005 100644
--- a/pkgs/development/python-modules/alabaster/default.nix
+++ b/pkgs/development/python-modules/alabaster/default.nix
@@ -3,12 +3,12 @@
 
 buildPythonPackage rec {
   pname = "alabaster";
-  version = "0.7.7";
+  version = "0.7.10";
   name = "${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f416a84e0d0ddbc288f6b8f2c276d10b40ca1238562cd9ed5a751292ec647b71";
+    sha256 = "37cdcb9e9954ed60912ebc1ca12a9d12178c26637abdf124e3cde2341c257fe0";
   };
 
   propagatedBuildInputs = [ pygments ];
diff --git a/pkgs/development/python-modules/alembic/default.nix b/pkgs/development/python-modules/alembic/default.nix
index 0538e7cf416d..d1262d8fab45 100644
--- a/pkgs/development/python-modules/alembic/default.nix
+++ b/pkgs/development/python-modules/alembic/default.nix
@@ -6,11 +6,11 @@
 buildPythonPackage rec {
   name = "${pname}-${version}";
   pname = "alembic";
-  version = "0.9.2";
+  version = "0.9.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0iw6wysm83hycvrycymf9b4mkji47536kl3x7grynfcbyjcvbdm2";
+    sha256 = "57f2ede554c0b18f1cf811cfbb3b02c586a5422df94922e3821883ba0b8c616c";
   };
 
   buildInputs = [ pytest pytestcov mock coverage ];
diff --git a/pkgs/development/python-modules/aniso8601/default.nix b/pkgs/development/python-modules/aniso8601/default.nix
index bc49e991b4fa..95eda37d3f28 100644
--- a/pkgs/development/python-modules/aniso8601/default.nix
+++ b/pkgs/development/python-modules/aniso8601/default.nix
@@ -3,7 +3,7 @@
 
 buildPythonPackage rec {
   pname = "aniso8601";
-  version = "1.2.0";
+  version = "1.2.1";
   name = "${pname}-${version}";
 
   meta = with stdenv.lib; {
@@ -16,6 +16,6 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "502400f82574afa804cc915d83f15c67533d364dcd594f8a6b9d2053f3404dd4";
+    sha256 = "e7ba4f42d3aea75909c79b1f4c4614768b4f13fbb98fc658a7b6061ddb0be47c";
   };
 }
diff --git a/pkgs/development/python-modules/btrees/default.nix b/pkgs/development/python-modules/btrees/default.nix
index 7cb10d96f905..7bfad0d4f5e2 100644
--- a/pkgs/development/python-modules/btrees/default.nix
+++ b/pkgs/development/python-modules/btrees/default.nix
@@ -5,7 +5,8 @@ buildPythonPackage rec {
   version = "4.4.1";
   name = "${pname}-${version}";
 
-  propagatedBuildInputs = [ persistent zope_interface transaction ];
+  buildInputs = [ transaction ];
+  propagatedBuildInputs = [ persistent zope_interface ];
 
   src = fetchPypi {
     inherit pname version;
diff --git a/pkgs/development/python-modules/celery/fix_endless_python3.6_loop_logger_isa.patch b/pkgs/development/python-modules/celery/fix_endless_python3.6_loop_logger_isa.patch
new file mode 100644
index 000000000000..27caa80dd4ca
--- /dev/null
+++ b/pkgs/development/python-modules/celery/fix_endless_python3.6_loop_logger_isa.patch
@@ -0,0 +1,18 @@
+Description: Fix endless loop in logger_isa (Python 3.6)
+Author: George Psarakis <giwrgos.psarakis@gmail.com>
+Origin: upstream, https://github.com/celery/celery/commit/9c950b47eca2b4e93fd2fe52cf80f158e6cf97ad
+Forwarded: not-needed
+Reviewed-By: Nishanth Aravamudan <nish.aravamudan@canonical.com>
+Last-Update: 2017-06-12
+
+--- celery-4.0.2.orig/celery/utils/log.py
++++ celery-4.0.2/celery/utils/log.py
+@@ -82,7 +82,7 @@ def logger_isa(l, p, max=1000):
+         else:
+             if this in seen:
+                 raise RuntimeError(
+-                    'Logger {0!r} parents recursive'.format(l),
++                    'Logger {0!r} parents recursive'.format(l.name),
+                 )
+             seen.add(this)
+             this = this.parent
diff --git a/pkgs/development/python-modules/dask/default.nix b/pkgs/development/python-modules/dask/default.nix
index 6d5388a443ca..740b0644381c 100644
--- a/pkgs/development/python-modules/dask/default.nix
+++ b/pkgs/development/python-modules/dask/default.nix
@@ -12,12 +12,12 @@
 
 buildPythonPackage rec {
   pname = "dask";
-  version = "0.14.3";
+  version = "0.15.1";
   name = "${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "9bf007f9cedc08f73089f0621ff65ec0882fc0a834acef56830dfd2872908211";
+    sha256 = "f62f19ab5958b13d0ee733db18218c28a9d452a3554446a3dfb5ac3d4a5f7e34";
   };
 
   checkInputs = [ pytest ];
diff --git a/pkgs/development/python-modules/discid/default.nix b/pkgs/development/python-modules/discid/default.nix
index 167efe914256..d237f366fdf5 100644
--- a/pkgs/development/python-modules/discid/default.nix
+++ b/pkgs/development/python-modules/discid/default.nix
@@ -2,12 +2,12 @@
 
 buildPythonPackage rec {
   pname = "discid";
-  version = "1.1.0";
+  version = "1.1.1";
   name = "${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "b39d443051b26d0230be7a6c616243daae93337a8711dd5d4119bb6a0e516fa8";
+    sha256 = "78a3bf6c8377fdbe3d85e914a209ff97aa43e35605779639847b510ced31f7b9";
   };
 
   patchPhase = ''
diff --git a/pkgs/development/python-modules/django-raster/default.nix b/pkgs/development/python-modules/django-raster/default.nix
index 2332229100c5..fbdc7282c1b6 100644
--- a/pkgs/development/python-modules/django-raster/default.nix
+++ b/pkgs/development/python-modules/django-raster/default.nix
@@ -3,13 +3,13 @@
   pyparsing, django, celery
 }:
 buildPythonPackage rec {
-  version = "0.4";
+  version = "0.5";
   pname = "django-raster";
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "mirror://pypi/d/django-raster/${name}.tar.gz";
-    sha256 = "7fd6afa42b07ac51a3873e3d4840325dd3a8a631fdb5b853c76fbbfe59a2b17f";
+    sha256 = "0v1jldb13s4dqq1vaq8ghfv3743jpi9a9n05bqgjm8szlkq8s7ah";
   };
 
   # Tests require a postgresql + postgis server
diff --git a/pkgs/development/python-modules/dkimpy/default.nix b/pkgs/development/python-modules/dkimpy/default.nix
index df768f5d1222..e32a9262f535 100644
--- a/pkgs/development/python-modules/dkimpy/default.nix
+++ b/pkgs/development/python-modules/dkimpy/default.nix
@@ -5,19 +5,24 @@ buildPythonApplication rec {
   name = "${pname}-${majorversion}.${minorversion}";
   pname = "dkimpy";
   majorversion = "0.6";
-  minorversion = "1";
+  minorversion = "2";
 
   src = fetchurl {
     url = "https://launchpad.net/${pname}/${majorversion}/${majorversion}.${minorversion}/+download/${name}.tar.gz";
-    sha256 = "0zmvyw18ww1jqrbqws636w3xki59fyqva553r6s74q5c4jvy36v2";
+    sha256 = "1hagz8qk0v4ijfbcdq4z28bpgr2mkpr498z76i1vam2d50chmakl";
   };
 
   buildInputs = [ pytest ];
   propagatedBuildInputs =  [ openssl dns ];
 
-  patchPhase = ''substituteInPlace dknewkey.py --replace \
-     /usr/bin/openssl ${openssl}/bin/openssl
-     '';
+  patchPhase = ''
+    substituteInPlace dknewkey.py --replace \
+      /usr/bin/openssl ${openssl}/bin/openssl
+  '';
+
+  checkPhase = ''
+    python ./test.py
+  '';
 
   postInstall = ''
     mkdir -p $out/bin $out/libexec
@@ -27,15 +32,16 @@ buildPythonApplication rec {
     makeWrapper "$out/libexec/arcverify.py" $out/bin/arcverify
     makeWrapper "$out/libexec/arcsign.py" $out/bin/arcsign
     makeWrapper "$out/libexec/dknewkey.py" $out/bin/dknewkey
-   '';
+  '';
 
   meta = with stdenv.lib; {
     description = "DKIM + ARC email signing/verification tools + Python module";
-    longDescription = ''Python module that implements DKIM (DomainKeys Identified Mail)
-      email signing and verification. It also provides a number of convєnient tools
-      for command line signing and verification, as well as generating new DKIM records.
-      This version also supports the experimental Authenticated Received Chain (ARC)
-      protocol.
+    longDescription = ''
+      Python module that implements DKIM (DomainKeys Identified Mail) email
+      signing and verification. It also provides a number of convєnient tools
+      for command line signing and verification, as well as generating new DKIM
+      records. This version also supports the experimental Authenticated
+      Received Chain (ARC) protocol.
     '';
     homepage = "https://launchpad.net/dkimpy";
     license = licenses.bsd3;
diff --git a/pkgs/development/python-modules/dns/default.nix b/pkgs/development/python-modules/dns/default.nix
new file mode 100644
index 000000000000..0548c5a1098e
--- /dev/null
+++ b/pkgs/development/python-modules/dns/default.nix
@@ -0,0 +1,23 @@
+{ buildPythonPackage, fetchPypi, lib }:
+
+buildPythonPackage rec {
+  pname = "dnspython";
+  version = "1.15.0";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    extension = "zip";
+    sha256 = "0z5d9vwf211v54bybrhm3qpxclys4dfdfsp7lk2hvf57yzhn7xa0";
+  };
+
+  # needs networking for some tests
+  doCheck = false;
+
+  meta = {
+    description = "A DNS toolkit for Python 3.x";
+    homepage = http://www.dnspython.org;
+    # BSD-like, check http://www.dnspython.org/LICENSE for details
+    license = lib.licenses.free;
+  };
+}
diff --git a/pkgs/development/python-modules/email-validator/default.nix b/pkgs/development/python-modules/email-validator/default.nix
new file mode 100644
index 000000000000..4fc78d8bd1e1
--- /dev/null
+++ b/pkgs/development/python-modules/email-validator/default.nix
@@ -0,0 +1,27 @@
+{ stdenv, lib, buildPythonPackage, fetchPypi, isPy3k, dns, idna, ipaddress }:
+
+buildPythonPackage rec {
+  pname = "email_validator";
+  version = "1.0.2";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1ja9149l9ck5n45a72h3is7v476hjny5ybxbcamx1nw6iplsm7k6";
+  };
+
+  doCheck = false;
+
+  propagatedBuildInputs = [
+    dns
+    idna
+  ] ++ (if isPy3k then [ ] else [ ipaddress ]);
+
+  meta = with lib; {
+    description = "A robust email syntax and deliverability validation library for Python 2.x/3.x.";
+    homepage    = https://github.com/JoshData/python-email-validator;
+    license     = licenses.cc0;
+    maintainers = with maintainers; [ siddharthist ];
+    platforms   = platforms.unix;
+  };
+}
diff --git a/pkgs/development/python-modules/faker/default.nix b/pkgs/development/python-modules/faker/default.nix
new file mode 100644
index 000000000000..ce6887f3e062
--- /dev/null
+++ b/pkgs/development/python-modules/faker/default.nix
@@ -0,0 +1,36 @@
+{ stdenv, lib, buildPythonPackage, fetchPypi,
+  # Build inputs
+  dateutil, six,
+  # Test inputs
+  email_validator, nose, mock, ukpostcodeparser }:
+
+buildPythonPackage rec {
+  pname = "Faker";
+  version = "0.7.18";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "310b20f3c497a777622920dca314d90f774028d49c7ee7ccfa96ca4b9d9bf429";
+  };
+
+  checkInputs = [
+    email_validator
+    nose
+    mock
+    ukpostcodeparser
+  ];
+
+  propagatedBuildInputs = [
+    dateutil
+    six
+  ];
+
+  meta = with lib; {
+    description = "A Python library for generating fake user data";
+    homepage    = http://faker.rtfd.org;
+    license     = licenses.mit;
+    maintainers = with maintainers; [ lovek323 ];
+    platforms   = platforms.unix;
+  };
+}
diff --git a/pkgs/development/python-modules/keras/default.nix b/pkgs/development/python-modules/keras/default.nix
index 43e576b1b312..011954ae8273 100644
--- a/pkgs/development/python-modules/keras/default.nix
+++ b/pkgs/development/python-modules/keras/default.nix
@@ -12,12 +12,12 @@
 
 buildPythonPackage rec {
   pname = "Keras";
-  version = "2.0.5";
+  version = "2.0.6";
   name = "${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "cbce24758530e070fe1b403d6d21391cbea78c037b70bf6afc1ca9f1f8269eff";
+    sha256 = "0519480abe4ad18b2c2d1bc580eab75edd82c95083d341a1157952f4b00019bb";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/ldap.nix b/pkgs/development/python-modules/ldap.nix
index b583a2ae2d82..34a179f501b9 100644
--- a/pkgs/development/python-modules/ldap.nix
+++ b/pkgs/development/python-modules/ldap.nix
@@ -3,13 +3,13 @@
 
 buildPythonPackage rec {
   pname = "python-ldap";
-  version = "2.4.39";
+  version = "2.4.41";
   name = "${pname}-${version}";
   disabled = isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "3fb75108d27e8091de80dffa2ba3bf45c7a3bdc357e2959006aed52fa58bb2f3";
+    sha256 = "6d430ecf040f2fc704ee316d3390cb1f5419c191371e1e131baef54a0e42cef0";
   };
 
   # Needed by tests to setup a mockup ldap server.
diff --git a/pkgs/development/python-modules/libagent/default.nix b/pkgs/development/python-modules/libagent/default.nix
index 5192abf8200f..4a3839537e3a 100644
--- a/pkgs/development/python-modules/libagent/default.nix
+++ b/pkgs/development/python-modules/libagent/default.nix
@@ -5,11 +5,11 @@
 buildPythonPackage rec {
   name = "${pname}-${version}";
   pname = "libagent";
-  version = "0.9.1";
+  version = "0.9.2";
 
   src = fetchPypi{
     inherit pname version;
-    sha256 = "1g19lsid7lqw567w31fif89w088lzbgh27xpb1pshjk1gvags3bc";
+    sha256 = "d6c6dccc0a7693fc966f5962604a69a800e044ac5add3dd030c34cfd4d64311f";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/libnacl/default.nix b/pkgs/development/python-modules/libnacl/default.nix
index 7a96530912b6..324740f17de8 100644
--- a/pkgs/development/python-modules/libnacl/default.nix
+++ b/pkgs/development/python-modules/libnacl/default.nix
@@ -2,12 +2,12 @@
 
 buildPythonPackage rec {
   pname = "libnacl";
-  version = "1.5.1";
+  version = "1.5.2";
   name = "${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "e44e9436e7245b0d8b7322bef67750cb7757834d7ccdb7eb7b723b4813df84fb";
+    sha256 = "c58390b0d191db948fc9ab681f07fdfce2a573cd012356bada47d56795d00ee2";
   };
 
   buildInputs = [ pytest ];
diff --git a/pkgs/development/python-modules/m2r/default.nix b/pkgs/development/python-modules/m2r/default.nix
index 74cc87d5d897..b79307a8084e 100644
--- a/pkgs/development/python-modules/m2r/default.nix
+++ b/pkgs/development/python-modules/m2r/default.nix
@@ -3,11 +3,11 @@
 buildPythonPackage rec {
   pname = "m2r";
   name = "${pname}-${version}";
-  version = "0.1.6";
+  version = "0.1.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a26bc2e25e0ad3f8650385aea25cf734ac4fcd30e54faec92fd39675da75e527";
+    sha256 = "771631d051a52764fe5b660f97ad028df3aff90c9859d345ccfd17a4c7c2ab39";
   };
 
   propagatedBuildInputs = [ mistune docutils ];
diff --git a/pkgs/development/python-modules/numpy/default.nix b/pkgs/development/python-modules/numpy/default.nix
index d427a33f80f4..965dda8c43a5 100644
--- a/pkgs/development/python-modules/numpy/default.nix
+++ b/pkgs/development/python-modules/numpy/default.nix
@@ -2,12 +2,12 @@
 
 buildPythonPackage rec {
   pname = "numpy";
-  version = "1.12.1";
+  version = "1.13.1";
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "mirror://pypi/n/numpy/numpy-${version}.zip";
-    sha256 = "a65266a4ad6ec8936a1bc85ce51f8600634a31a258b722c9274a80ff189d9542";
+    sha256 = "c9b0283776085cb2804efff73e9955ca279ba4edafd58d3ead70b61d209c4fbb";
   };
 
   disabled = isPyPy;
diff --git a/pkgs/development/python-modules/olefile/default.nix b/pkgs/development/python-modules/olefile/default.nix
new file mode 100644
index 000000000000..5cf51b841329
--- /dev/null
+++ b/pkgs/development/python-modules/olefile/default.nix
@@ -0,0 +1,19 @@
+{ stdenv, buildPythonPackage, fetchPypi }:
+buildPythonPackage rec {
+  pname = "olefile";
+  version = "0.44";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    extension = "zip";
+    sha256 = "1bbk1xplmrhymqpk6rkb15sg7v9qfih7zh23p6g2fxxas06cmwk1";
+  };
+
+  meta = with stdenv.lib; {
+    description = "Python package to parse, read and write Microsoft OLE2 files";
+    homepage = https://www.decalage.info/python/olefileio;
+    # BSD like + reference to Pillow
+    license = "http://olefile.readthedocs.io/en/latest/License.html";
+  };
+}
diff --git a/pkgs/development/python-modules/pandas/default.nix b/pkgs/development/python-modules/pandas/default.nix
index ee75d211ad80..e9297676eafe 100644
--- a/pkgs/development/python-modules/pandas/default.nix
+++ b/pkgs/development/python-modules/pandas/default.nix
@@ -27,12 +27,12 @@ let
   inherit (stdenv) isDarwin;
 in buildPythonPackage rec {
   pname = "pandas";
-  version = "0.20.2";
+  version = "0.20.3";
   name = "${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "92173c976fcca70cb19a958eccdacf98af62ef7301bf786d0321cb8857cdfae6";
+    sha256 = "a777e07633d83d546c55706420179551c8e01075b53c497dcf8ae4036766bc66";
   };
 
   LC_ALL = "en_US.UTF-8";
diff --git a/pkgs/development/python-modules/persistent/default.nix b/pkgs/development/python-modules/persistent/default.nix
new file mode 100644
index 000000000000..4940a8b2e046
--- /dev/null
+++ b/pkgs/development/python-modules/persistent/default.nix
@@ -0,0 +1,23 @@
+{ buildPythonPackage
+, fetchPypi
+, zope_interface
+, pkgs
+}:
+
+buildPythonPackage rec {
+  pname = "persistent";
+  version = "4.2.4.2";
+  name = "${pname}-${version}";
+
+  propagatedBuildInputs = [ zope_interface ];
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "cf264cd55866c7ffbcbe1328f8d8b28fd042a5dd0c03a03f68c0887df3aa1964";
+  };
+
+  meta = {
+    description = "Automatic persistence for Python objects";
+    homepage = http://www.zope.org/Products/ZODB;
+  };
+}
diff --git a/pkgs/development/python-modules/pillow/default.nix b/pkgs/development/python-modules/pillow/default.nix
new file mode 100644
index 000000000000..0fbb36b3c196
--- /dev/null
+++ b/pkgs/development/python-modules/pillow/default.nix
@@ -0,0 +1,62 @@
+{ stdenv, buildPythonPackage, fetchPypi, isPyPy,
+  nose, olefile,
+  freetype, libjpeg, zlib, libtiff, libwebp, tcl, lcms2, tk, libX11}:
+buildPythonPackage rec {
+  pname = "Pillow";
+  version = "4.2.1";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0wq0fiw964bj5rdmw66mhbfsjnmb13bcdr42krpk2ig5f1cgc967";
+  };
+
+  doCheck = !stdenv.isDarwin && !isPyPy;
+
+  # Disable imagefont tests, because they don't work well with infinality:
+  # https://github.com/python-pillow/Pillow/issues/1259
+  postPatch = ''
+    rm Tests/test_imagefont.py
+  '';
+
+  propagatedBuildInputs = [ olefile ];
+
+  buildInputs = [
+    freetype libjpeg zlib libtiff libwebp tcl nose lcms2 ]
+    ++ stdenv.lib.optionals (isPyPy) [ tk libX11 ];
+
+  # NOTE: we use LCMS_ROOT as WEBP root since there is not other setting for webp.
+  preConfigure = let
+    libinclude' = pkg: ''"${pkg.out}/lib", "${pkg.out}/include"'';
+    libinclude = pkg: ''"${pkg.out}/lib", "${pkg.dev}/include"'';
+  in ''
+    sed -i "setup.py" \
+        -e 's|^FREETYPE_ROOT =.*$|FREETYPE_ROOT = ${libinclude freetype}|g ;
+            s|^JPEG_ROOT =.*$|JPEG_ROOT = ${libinclude libjpeg}|g ;
+            s|^ZLIB_ROOT =.*$|ZLIB_ROOT = ${libinclude zlib}|g ;
+            s|^LCMS_ROOT =.*$|LCMS_ROOT = ${libinclude lcms2}|g ;
+            s|^TIFF_ROOT =.*$|TIFF_ROOT = ${libinclude libtiff}|g ;
+            s|^TCL_ROOT=.*$|TCL_ROOT = ${libinclude' tcl}|g ;'
+    export LDFLAGS="-L${libwebp}/lib"
+    export CFLAGS="-I${libwebp}/include"
+  ''
+  # Remove impurities
+  + stdenv.lib.optionalString stdenv.isDarwin ''
+    substituteInPlace setup.py \
+      --replace '"/Library/Frameworks",' "" \
+      --replace '"/System/Library/Frameworks"' ""
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = "https://python-pillow.github.io/";
+    description = "Fork of The Python Imaging Library (PIL)";
+    longDescription = ''
+      The Python Imaging Library (PIL) adds image processing
+      capabilities to your Python interpreter.  This library
+      supports many file formats, and provides powerful image
+      processing and graphics capabilities.
+    '';
+    license = "http://www.pythonware.com/products/pil/license.htm";
+    maintainers = with maintainers; [ goibhniu prikhi ];
+  };
+}
diff --git a/pkgs/development/python-modules/plotly/default.nix b/pkgs/development/python-modules/plotly/default.nix
index 383dbd1e08f7..ed62a0912818 100644
--- a/pkgs/development/python-modules/plotly/default.nix
+++ b/pkgs/development/python-modules/plotly/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "plotly";
-  version = "2.0.10";
+  version = "2.0.12";
   name = "${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "8c013a01bb11c4c269c38a7086ffb92d6a2827922c49706131842498a49b3b81";
+    sha256 = "0050da900e4420c15766f8dfb8d252510896511361bf485b9308bc0287f7add0";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pylint/default.nix b/pkgs/development/python-modules/pylint/default.nix
index 12871bd8f6c2..8c82cb52910a 100644
--- a/pkgs/development/python-modules/pylint/default.nix
+++ b/pkgs/development/python-modules/pylint/default.nix
@@ -4,11 +4,11 @@
   buildPythonPackage rec {
     name = "${pname}-${version}";
     pname = "pylint";
-    version = "1.7.1";
+    version = "1.7.2";
 
     src = fetchurl {
       url = "mirror://pypi/p/${pname}/${name}.tar.gz";
-      sha256 = "8b4a7ab6cf5062e40e2763c0b4a596020abada1d7304e369578b522e46a6264a";
+      sha256 = "ea6afb93a9ed810cf52ff3838eb3a15e2bf6a81b80de0eaede1ce442caa5ca69";
     };
 
     buildInputs = [ pytest pytestrunner mccabe configparser backports_functools_lru_cache ];
diff --git a/pkgs/development/python-modules/pyparsing/default.nix b/pkgs/development/python-modules/pyparsing/default.nix
new file mode 100644
index 000000000000..f751a8bfbb2d
--- /dev/null
+++ b/pkgs/development/python-modules/pyparsing/default.nix
@@ -0,0 +1,20 @@
+{ stdenv, buildPythonPackage, fetchPypi }:
+buildPythonPackage rec {
+    pname = "pyparsing";
+    name = "${pname}-${version}";
+    version = "2.2.0";
+
+    src = fetchPypi {
+      inherit pname version;
+      sha256 = "016b9gh606aa44sq92jslm89bg874ia0yyiyb643fa6dgbsbqch8";
+    };
+
+    # Not everything necessary to run the tests is included in the distribution
+    doCheck = false;
+
+    meta = with stdenv.lib; {
+      homepage = http://pyparsing.wikispaces.com/;
+      description = "An alternative approach to creating and executing simple grammars, vs. the traditional lex/yacc approach, or the use of regular expressions";
+      license = licenses.mit;
+    };
+}
diff --git a/pkgs/development/python-modules/pyroute2/default.nix b/pkgs/development/python-modules/pyroute2/default.nix
index de1651ec2b0b..2e60f6812e95 100644
--- a/pkgs/development/python-modules/pyroute2/default.nix
+++ b/pkgs/development/python-modules/pyroute2/default.nix
@@ -2,12 +2,12 @@
 
 buildPythonPackage rec {
   pname = "pyroute2";
-  version = "0.4.16";
+  version = "0.4.18";
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "mirror://pypi/p/pyroute2/${name}.tar.gz";
-    sha256 = "5c692efd83369cb44086572b3e1e95ab11f1bc516a89c8ca2429795a789f32a9";
+    sha256 = "bdcff9f598ff4dda7420675ee387426cd9cc79d795ea73eb684a4314d4b00b9e";
   };
 
   # requires root priviledges
diff --git a/pkgs/development/python-modules/pyside/shiboken.nix b/pkgs/development/python-modules/pyside/shiboken.nix
index cef78c215500..0864b641cdba 100644
--- a/pkgs/development/python-modules/pyside/shiboken.nix
+++ b/pkgs/development/python-modules/pyside/shiboken.nix
@@ -1,4 +1,4 @@
-{ lib, fetchurl, cmake, buildPythonPackage, libxml2, libxslt, pysideApiextractor, pysideGeneratorrunner, python, sphinx, qt4, isPy3k, isPy35 }:
+{ lib, fetchurl, cmake, buildPythonPackage, libxml2, libxslt, pysideApiextractor, pysideGeneratorrunner, python, sphinx, qt4, isPy3k, isPy35, isPy36 }:
 
 # This derivation provides a Python module and should therefore be called via `python-packages.nix`.
 # Python 3.5 is not supported: https://github.com/PySide/Shiboken/issues/77
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     substituteInPlace generator/CMakeLists.txt --replace \
       \"$\{GENERATORRUNNER_PLUGIN_DIR}\" lib/generatorrunner/
   '';
-  patches = if isPy35 then [ ./shiboken_py35.patch ] else null;
+  patches = if (isPy35 || isPy36) then [ ./shiboken_py35.patch ] else null;
 
   cmakeFlags = if isPy3k then "-DUSE_PYTHON3=TRUE" else null;
 
diff --git a/pkgs/development/python-modules/pyside/shiboken_py35.patch b/pkgs/development/python-modules/pyside/shiboken_py35.patch
index 5642ddc594d1..32088144ed78 100644
--- a/pkgs/development/python-modules/pyside/shiboken_py35.patch
+++ b/pkgs/development/python-modules/pyside/shiboken_py35.patch
@@ -6,7 +6,7 @@ diff --git a/cmake/Modules/FindPython3Libs.cmake b/cmake/Modules/FindPython3Libs
  # CMAKE_FIND_FRAMEWORKS(Python)
  
 -FOREACH(_CURRENT_VERSION 3.4 3.3 3.2 3.1 3.0)
-+FOREACH(_CURRENT_VERSION 3.5 3.4 3.3 3.2 3.1 3.0)
++FOREACH(_CURRENT_VERSION 3.6 3.5 3.4 3.3 3.2 3.1 3.0)
    IF(_CURRENT_VERSION GREATER 3.1)
        SET(_32FLAGS "m" "u" "mu" "dm" "du" "dmu" "")
    ELSE()
diff --git a/pkgs/development/python-modules/pytest-xdist/default.nix b/pkgs/development/python-modules/pytest-xdist/default.nix
index b3577908cf9c..600c98925af4 100644
--- a/pkgs/development/python-modules/pytest-xdist/default.nix
+++ b/pkgs/development/python-modules/pytest-xdist/default.nix
@@ -3,11 +3,11 @@
 buildPythonPackage rec {
   name = "${pname}-${version}";
   pname = "pytest-xdist";
-  version = "1.16.0";
+  version = "1.18.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "42e5a1e5da9d7cff3e74b07f8692598382f95624f234ff7e00a3b1237e0feba2";
+    sha256 = "10468377901b80255cf192c4603a94ffe8b1f071f5c912868da5f5cb91170dae";
   };
 
   buildInputs = [ pytest setuptools_scm ];
diff --git a/pkgs/development/python-modules/scipy/default.nix b/pkgs/development/python-modules/scipy/default.nix
index a7428f134a7a..ed4e205a2ae9 100644
--- a/pkgs/development/python-modules/scipy/default.nix
+++ b/pkgs/development/python-modules/scipy/default.nix
@@ -2,12 +2,12 @@
 
 buildPythonPackage rec {
   pname = "scipy";
-  version = "0.19.0";
+  version = "0.19.1";
   name = "${pname}-${version}";
 
   src = fetchurl {
-    url = "mirror://pypi/s/scipy/scipy-${version}.zip";
-    sha256 = "4190d34bf9a09626cd42100bbb12e3d96b2daf1a8a3244e991263eb693732122";
+    url = "mirror://pypi/s/scipy/scipy-${version}.tar.gz";
+    sha256 = "a19a2ca7a7336495ec180adeaa0dfdcf41e96dbbee90d51c3ed828ba570884e6";
   };
 
   buildInputs = [ gfortran nose numpy.blas ];
diff --git a/pkgs/development/python-modules/sqlalchemy/default.nix b/pkgs/development/python-modules/sqlalchemy/default.nix
index 4cd522fe1953..36b04692a9e5 100644
--- a/pkgs/development/python-modules/sqlalchemy/default.nix
+++ b/pkgs/development/python-modules/sqlalchemy/default.nix
@@ -11,11 +11,11 @@
 buildPythonPackage rec {
   pname = "SQLAlchemy";
   name = "${pname}-${version}";
-  version = "1.1.11";
+  version = "1.1.12";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "76f76965e9a968ba3aecd2a8bc0d991cea04fd9a182e6c95c81f1551487b0211";
+    sha256 = "d501527319f51a3d9eb639b654222c6f67287228a98ba102b1d0b598eb3266c9";
   };
 
   checkInputs = [ pytest mock pytest_xdist ]
diff --git a/pkgs/development/python-modules/tornado/default.nix b/pkgs/development/python-modules/tornado/default.nix
new file mode 100644
index 000000000000..11078eb85623
--- /dev/null
+++ b/pkgs/development/python-modules/tornado/default.nix
@@ -0,0 +1,28 @@
+{ lib
+, python
+, buildPythonPackage
+, fetchPypi
+, backports_abc
+, backports_ssl_match_hostname
+, certifi
+, singledispatch
+}:
+
+buildPythonPackage rec {
+  pname = "tornado";
+  version = "4.5.1";
+  name = "${pname}-${version}";
+
+  propagatedBuildInputs = [ backports_abc backports_ssl_match_hostname certifi singledispatch ];
+
+  # We specify the name of the test files to prevent
+  # https://github.com/NixOS/nixpkgs/issues/14634
+  checkPhase = ''
+    ${python.interpreter} -m unittest discover *_test.py
+  '';
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "db0904a28253cfe53e7dedc765c71596f3c53bb8a866ae50123320ec1a7b73fd";
+  };
+}
diff --git a/pkgs/development/python-modules/trezor/default.nix b/pkgs/development/python-modules/trezor/default.nix
index 6a3f9c638908..72d73022cabb 100644
--- a/pkgs/development/python-modules/trezor/default.nix
+++ b/pkgs/development/python-modules/trezor/default.nix
@@ -5,11 +5,11 @@
 buildPythonPackage rec {
   name = "${pname}-${version}";
   pname = "trezor";
-  version = "0.7.15";
+  version = "0.7.16";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f7e4f509263ca172532b4c0a440d164add7cdc021b4370a253d51eba5806b618";
+    sha256 = "6bdb69fc125ba705854e21163be6c7da3aa17c2a3a84f40b6d8a3f6e4a8cb314";
   };
 
   propagatedBuildInputs = [ protobuf3_2 hidapi requests ];
diff --git a/pkgs/development/python-modules/ukpostcodeparser/default.nix b/pkgs/development/python-modules/ukpostcodeparser/default.nix
new file mode 100644
index 000000000000..d7d56bed8819
--- /dev/null
+++ b/pkgs/development/python-modules/ukpostcodeparser/default.nix
@@ -0,0 +1,22 @@
+{ stdenv, lib, buildPythonPackage, fetchPypi }:
+
+buildPythonPackage rec {
+  pname = "UkPostcodeParser";
+  version = "1.1.1";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "b7a7ac19d48897637c7aaa2f2970288f1c260e4a99140bf04c6086cf65576c6b";
+  };
+
+  doCheck = false;
+
+  meta = with lib; {
+    description = "UK Postcode parser";
+    homepage    = https://github.com/hamstah/ukpostcodeparser;
+    license     = licenses.publicDomain;
+    maintainers = with maintainers; [ siddharthist ];
+    platforms   = platforms.unix;
+  };
+}
diff --git a/pkgs/development/python-modules/vine/default.nix b/pkgs/development/python-modules/vine/default.nix
index 85b17f5119ca..bf5a09a24187 100644
--- a/pkgs/development/python-modules/vine/default.nix
+++ b/pkgs/development/python-modules/vine/default.nix
@@ -3,14 +3,14 @@
 
 buildPythonPackage rec {
   pname = "vine";
-  version = "1.1.3";
+  version = "1.1.4";
   name = "${pname}-${version}";
 
   disable = pythonOlder "2.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0h94x9mc9bspg23lb1f73h7smdzc39ps7z7sm0q38ds9jahmvfc7";
+    sha256 = "52116d59bc45392af9fdd3b75ed98ae48a93e822cee21e5fda249105c59a7a72";
   };
 
   buildInputs = [ case pytest ];
diff --git a/pkgs/development/python-modules/zc_lockfile/default.nix b/pkgs/development/python-modules/zc_lockfile/default.nix
new file mode 100644
index 000000000000..8a438fadcd72
--- /dev/null
+++ b/pkgs/development/python-modules/zc_lockfile/default.nix
@@ -0,0 +1,27 @@
+{ buildPythonPackage
+, fetchPypi
+, mock
+, zope_testing
+, stdenv
+}:
+
+buildPythonPackage rec {
+  pname = "zc.lockfile";
+  version = "1.2.1";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "11db91ada7f22fe8aae268d4bfdeae012c4fe655f66bbb315b00822ec00d043e";
+  };
+
+  buildInputs = [ mock ];
+  propagatedBuildInputs = [ zope_testing ];
+
+  meta = with stdenv.lib; {
+    description = "Inter-process locks";
+    homepage =  http://www.python.org/pypi/zc.lockfile;
+    license = licenses.zpt20;
+    maintainers = with maintainers; [ goibhniu ];
+  };
+}
diff --git a/pkgs/development/python-modules/zconfig/default.nix b/pkgs/development/python-modules/zconfig/default.nix
index aa90bf0ce1a6..5e7c762d03af 100644
--- a/pkgs/development/python-modules/zconfig/default.nix
+++ b/pkgs/development/python-modules/zconfig/default.nix
@@ -2,6 +2,8 @@
 , fetchPypi
 , buildPythonPackage
 , zope_testrunner
+, manuel
+, docutils
 }:
 
 buildPythonPackage rec {
@@ -16,6 +18,7 @@ buildPythonPackage rec {
 
   patches = [ ./skip-broken-test.patch ];
 
+  buildInputs = [ manuel docutils ];
   propagatedBuildInputs = [ zope_testrunner ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/python-modules/zodbpickle/default.nix b/pkgs/development/python-modules/zodbpickle/default.nix
new file mode 100644
index 000000000000..f51b30ab51e3
--- /dev/null
+++ b/pkgs/development/python-modules/zodbpickle/default.nix
@@ -0,0 +1,23 @@
+{ buildPythonPackage
+, isPyPy
+, fetchPypi
+}:
+
+buildPythonPackage rec {
+  pname = "zodbpickle";
+  version = "0.6.0";
+  name = "${pname}-${version}";
+  disabled = isPyPy; # https://github.com/zopefoundation/zodbpickle/issues/10
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "ea3248be966159e7791e3db0e35ea992b9235d52e7d39835438686741d196665";
+  };
+
+  # fails..
+  doCheck = false;
+
+  meta = {
+    homepage = http://pypi.python.org/pypi/zodbpickle;
+  };
+}
diff --git a/pkgs/development/tools/build-managers/gnumake/3.80/default.nix b/pkgs/development/tools/build-managers/gnumake/3.80/default.nix
deleted file mode 100644
index ad855df73534..000000000000
--- a/pkgs/development/tools/build-managers/gnumake/3.80/default.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-{stdenv, fetchurl}:
-
-stdenv.mkDerivation {
-  name = "gnumake-3.80";
-
-  src = fetchurl {
-    url = http://tarballs.nixos.org/make-3.80.tar.bz2;
-    sha256 = "06rgz6npynr8whmf7rxgkyvcz0clf3ggwf4cyhj3fcscn3kkk6x9";
-  };
-
-  patches = [./log.patch];
-
-  hardeningDisable = [ "format" ];
-
-  meta = {
-    platforms = stdenv.lib.platforms.unix;
-  };
-}
diff --git a/pkgs/development/tools/build-managers/gnumake/3.80/log.patch b/pkgs/development/tools/build-managers/gnumake/3.80/log.patch
deleted file mode 100644
index fa90acfe8de5..000000000000
--- a/pkgs/development/tools/build-managers/gnumake/3.80/log.patch
+++ /dev/null
@@ -1,125 +0,0 @@
-diff -rc make-3.80-orig/job.c make-3.80/job.c
-*** make-3.80-orig/job.c	2002-08-10 03:27:17.000000000 +0200
---- make-3.80/job.c	2004-04-02 17:38:04.000000000 +0200
-***************
-*** 987,993 ****
-       appear.  */
-  
-    message (0, (just_print_flag || (!(flags & COMMANDS_SILENT) && !silent_flag))
-! 	   ? "%s" : (char *) 0, p);
-  
-    /* Tell update_goal_chain that a command has been started on behalf of
-       this target.  It is important that this happens here and not in
---- 987,993 ----
-       appear.  */
-  
-    message (0, (just_print_flag || (!(flags & COMMANDS_SILENT) && !silent_flag))
-! 	   ? "\e[3s\e[a%s\e[b" : (char *) 0, p);
-  
-    /* Tell update_goal_chain that a command has been started on behalf of
-       this target.  It is important that this happens here and not in
-diff -rc make-3.80-orig/main.c make-3.80/main.c
-*** make-3.80-orig/main.c	2002-08-10 03:27:17.000000000 +0200
---- make-3.80/main.c	2004-04-02 17:42:50.000000000 +0200
-***************
-*** 254,259 ****
---- 254,263 ----
-     they appear out of date or not.  */
-  
-  int always_make_flag = 0;
-+ 
-+ int logNestingStdout = 0;
-+ int logNestingStderr = 0;
-+ 
-  
-  /* The usage output.  We write it this way to make life easier for the
-     translators, especially those trying to translate to right-to-left
-***************
-*** 827,832 ****
---- 831,845 ----
-  }
-  
-  
-+ static void closeNesting()
-+ {
-+   while (logNestingStdout--)
-+     printf("\e[q");
-+   while (logNestingStderr--)
-+     fprintf(stderr, "\e[q");
-+ }
-+ 
-+ 
-  #ifndef _AMIGA
-  int
-  main (argc, argv, envp)
-***************
-*** 854,859 ****
---- 867,874 ----
-    no_default_sh_exe = 1;
-  #endif
-  
-+   atexit(closeNesting);
-+ 
-    default_goal_file = 0;
-    reading_file = 0;
-  
-***************
-*** 2782,2787 ****
---- 2797,2808 ----
-  
-    /* Use entire sentences to give the translators a fighting chance.  */
-  
-+   if (entering)
-+     {
-+       printf("\e[p");
-+       logNestingStdout++;
-+     }
-+   
-    if (makelevel == 0)
-      if (starting_directory == 0)
-        if (entering)
-***************
-*** 2810,2813 ****
---- 2831,2840 ----
-        else
-          printf (_("%s[%u]: Leaving directory `%s'\n"),
-                  program, makelevel, starting_directory);
-+ 
-+   if (!entering)
-+     {
-+       printf("\e[q");
-+       logNestingStdout--;
-+     }
-  }
-diff -rc make-3.80-orig/make.h make-3.80/make.h
-*** make-3.80-orig/make.h	2002-09-11 18:55:44.000000000 +0200
---- make-3.80/make.h	2004-04-02 17:42:15.000000000 +0200
-***************
-*** 559,562 ****
---- 559,567 ----
-  extern int atomic_stat PARAMS ((const char *file, struct stat *buf));
-  extern struct dirent *atomic_readdir PARAMS ((DIR *dir));
-  
-+ 
-  #endif
-+ 
-+ 
-+ extern int logNestingStdout;
-+ extern int logNestingStderr;
-diff -rc make-3.80-orig/remake.c make-3.80/remake.c
-*** make-3.80-orig/remake.c	2002-08-08 02:11:19.000000000 +0200
---- make-3.80/remake.c	2004-04-04 23:10:19.000000000 +0200
-***************
-*** 1049,1055 ****
---- 1049,1059 ----
-        /* The normal case: start some commands.  */
-        if (!touch_flag || file->cmds->any_recurse)
-  	{
-+           fprintf(stderr, "\e[pbuilding %s\n", file->name);
-+           logNestingStderr++;
-  	  execute_file_commands (file);
-+           fprintf(stderr, "\e[q");
-+           logNestingStderr--;
-  	  return;
-  	}
-  
diff --git a/pkgs/development/tools/build-managers/gnumake/3.82/default.nix b/pkgs/development/tools/build-managers/gnumake/3.82/default.nix
index ce5eff878ead..87897017f86a 100644
--- a/pkgs/development/tools/build-managers/gnumake/3.82/default.nix
+++ b/pkgs/development/tools/build-managers/gnumake/3.82/default.nix
@@ -15,10 +15,6 @@ stdenv.mkDerivation {
 
   patches =
     [
-      # Provide nested log output for subsequent pretty-printing by
-      # nix-log2xml.
-      ./log.patch
-
       # Purity: don't look for library dependencies (of the form
       # `-lfoo') in /lib and /usr/lib.  It's a stupid feature anyway.
       # Likewise, when searching for included Makefiles, don't look in
diff --git a/pkgs/development/tools/build-managers/gnumake/3.82/log.patch b/pkgs/development/tools/build-managers/gnumake/3.82/log.patch
deleted file mode 100644
index e6197fd8e78f..000000000000
--- a/pkgs/development/tools/build-managers/gnumake/3.82/log.patch
+++ /dev/null
@@ -1,125 +0,0 @@
-diff -rc job.c job.c
-*** job.c	2006-03-20 04:03:04.000000000 +0100
---- job.c	2009-01-19 19:37:28.000000000 +0100
-***************
-*** 1083,1089 ****
-       appear.  */
-  
-    message (0, (just_print_flag || (!(flags & COMMANDS_SILENT) && !silent_flag))
-! 	   ? "%s" : (char *) 0, p);
-  
-    /* Tell update_goal_chain that a command has been started on behalf of
-       this target.  It is important that this happens here and not in
---- 1083,1089 ----
-       appear.  */
-  
-    message (0, (just_print_flag || (!(flags & COMMANDS_SILENT) && !silent_flag))
-!           ? (enable_nested_output ? "\e[3s\e[a%s\e[b" : "%s") : (char *) 0, p);
-  
-    /* Tell update_goal_chain that a command has been started on behalf of
-       this target.  It is important that this happens here and not in
-diff -rc main.c main.c
-*** main.c	2006-03-20 03:36:37.000000000 +0100
---- main.c	2009-01-19 19:41:41.000000000 +0100
-***************
-*** 886,891 ****
---- 886,900 ----
-  }
-  
-  
-+ static void close_nesting()
-+ {
-+   while (stdout_nesting_level--)
-+     printf("\e[q");
-+   while (stderr_nesting_level--)
-+     fprintf(stderr, "\e[q");
-+ }
-+ 
-+ 
-  #ifdef _AMIGA
-  int
-  main (int argc, char **argv)
-***************
-*** 931,936 ****
---- 940,950 ----
-    atexit (close_stdout);
-  #endif
-  
-+   atexit(close_nesting);
-+ 
-+   if (getenv("NIX_INDENT_MAKE"))
-+     enable_nested_output = 1;
-+ 
-    /* Needed for OS/2 */
-    initialize_main(&argc, &argv);
-  
-***************
-*** 3095,3100 ****
---- 3109,3120 ----
-  
-    /* Use entire sentences to give the translators a fighting chance.  */
-  
-+   if (entering && enable_nested_output)
-+     {
-+       printf("\e[p");
-+       stdout_nesting_level++;
-+     }
-+   
-    if (makelevel == 0)
-      if (starting_directory == 0)
-        if (entering)
-***************
-*** 3124,3129 ****
---- 3144,3159 ----
-          printf (_("%s[%u]: Leaving directory `%s'\n"),
-                  program, makelevel, starting_directory);
-  
-+   if (!entering && enable_nested_output)
-+     {
-+       printf("\e[q");
-+       stdout_nesting_level--;
-+     }
-+  
-    /* Flush stdout to be sure this comes before any stderr output.  */
-    fflush (stdout);
-  }
-+ 
-+ int enable_nested_output = 0;
-+ int stdout_nesting_level = 0;
-+ int stderr_nesting_level = 0;
-diff -rc make.h
-*** make.h	2006-02-16 00:54:43.000000000 +0100
---- make.h	2009-01-19 19:32:03.000000000 +0100
-***************
-*** 609,611 ****
---- 609,614 ----
-  
-  #define ENULLLOOP(_v,_c)   do { errno = 0; (_v) = _c; } \
-                             while((_v)==0 && errno==EINTR)
-+ extern int enable_nested_output;
-+ extern int stdout_nesting_level;
-+ extern int stderr_nesting_level;
-diff -rc reremake.c
-*** remake.c	2006-03-20 03:36:37.000000000 +0100
---- remake.c	2009-01-19 19:39:40.000000000 +0100
-***************
-*** 1120,1126 ****
---- 1120,1137 ----
-        /* The normal case: start some commands.  */
-        if (!touch_flag || file->cmds->any_recurse)
-  	{
-+           if (enable_nested_output) 
-+             {
-+               log_working_directory (1);
-+               fprintf(stderr, "\e[pbuilding %s\n", file->name);
-+               stderr_nesting_level++;
-+             }
-  	  execute_file_commands (file);
-+           if (enable_nested_output) 
-+             {
-+               fprintf(stderr, "\e[q");
-+               stderr_nesting_level--;
-+             }
-  	  return;
-  	}
-  
diff --git a/pkgs/development/tools/build-managers/gnumake/4.0/darwin-library_search-dylib.patch b/pkgs/development/tools/build-managers/gnumake/4.0/darwin-library_search-dylib.patch
deleted file mode 100644
index de7e4f615212..000000000000
--- a/pkgs/development/tools/build-managers/gnumake/4.0/darwin-library_search-dylib.patch
+++ /dev/null
@@ -1,17 +0,0 @@
-Fixed default libpatttern on Darwin, imported from prefix overlay.
-Got merged upstream:
-https://savannah.gnu.org/bugs/?37197
---- default.c.orig	2009-05-02 12:25:24 +0200
-+++ default.c	2009-05-02 12:25:58 +0200
-@@ -509,7 +509,11 @@
- #ifdef __MSDOS__
-     ".LIBPATTERNS", "lib%.a $(DJDIR)/lib/lib%.a",
- #else
-+#ifdef __APPLE__
-+    ".LIBPATTERNS", "lib%.dylib lib%.a",
-+#else
-     ".LIBPATTERNS", "lib%.so lib%.a",
-+#endif
- #endif
- #endif
- 
diff --git a/pkgs/development/tools/build-managers/gnumake/4.0/default.nix b/pkgs/development/tools/build-managers/gnumake/4.0/default.nix
deleted file mode 100644
index a4128ac854c7..000000000000
--- a/pkgs/development/tools/build-managers/gnumake/4.0/default.nix
+++ /dev/null
@@ -1,49 +0,0 @@
-{stdenv, fetchurl}:
-
-let version = "4.0"; in
-stdenv.mkDerivation {
-  name = "gnumake-${version}";
-
-  src = fetchurl {
-    url = "mirror://gnu/make/make-${version}.tar.bz2";
-    sha256 = "1nyvn8mknw0mf7727lprva3lisl1y0n03lvar342rrpdmz3qc1p6";
-  };
-
-  /* On Darwin, there are 3 test failures that haven't been investigated
-     yet.  */
-  doCheck = !stdenv.isDarwin && !stdenv.isFreeBSD;
-
-  patches =
-    [
-      # Purity: don't look for library dependencies (of the form
-      # `-lfoo') in /lib and /usr/lib.  It's a stupid feature anyway.
-      # Likewise, when searching for included Makefiles, don't look in
-      # /usr/include and friends.
-      ./impure-dirs.patch
-
-      # a bunch of patches from Gentoo, mostly should be from upstream (unreleased)
-      ./darwin-library_search-dylib.patch
-    ];
-  patchFlags = "-p0";
-
-  meta = {
-    description = "GNU Make, a program controlling the generation of non-source files from sources";
-
-    longDescription =
-      '' Make is a tool which controls the generation of executables and
-         other non-source files of a program from the program's source files.
-
-         Make gets its knowledge of how to build your program from a file
-         called the makefile, which lists each of the non-source files and
-         how to compute it from other files. When you write a program, you
-         should write a makefile for it, so that it is possible to use Make
-         to build and install the program.
-      '';
-
-    homepage = http://www.gnu.org/software/make/;
-
-    license = stdenv.lib.licenses.gpl3Plus;
-    maintainers = [ ];
-    platforms = stdenv.lib.platforms.all;
-  };
-}
diff --git a/pkgs/development/tools/build-managers/gnumake/4.0/impure-dirs.patch b/pkgs/development/tools/build-managers/gnumake/4.0/impure-dirs.patch
deleted file mode 100644
index f6646f1d0126..000000000000
--- a/pkgs/development/tools/build-managers/gnumake/4.0/impure-dirs.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-diff -rc read.c read.c
-*** read.c	2006-03-17 15:24:20.000000000 +0100
---- read.c	2007-05-24 17:16:31.000000000 +0200
-***************
-*** 99,107 ****
---- 99,109 ----
-  #endif
-      INCLUDEDIR,
-  #ifndef _AMIGA
-+ #if 0    
-      "/usr/gnu/include",
-      "/usr/local/include",
-      "/usr/include",
-+ #endif    
-  #endif
-      0
-    };
-diff -rc reremake.c
-*** remake.c	2006-03-20 03:36:37.000000000 +0100
---- remake.c	2007-05-24 17:06:54.000000000 +0200
-***************
-*** 1452,1460 ****
---- 1452,1462 ----
-    static char *dirs[] =
-      {
-  #ifndef _AMIGA
-+ #if 0
-        "/lib",
-        "/usr/lib",
-  #endif
-+ #endif
-  #if defined(WINDOWS32) && !defined(LIBDIR)
-  /*
-   * This is completely up to the user at product install time. Just define
diff --git a/pkgs/development/tools/build-managers/gnumake/4.1/default.nix b/pkgs/development/tools/build-managers/gnumake/4.1/default.nix
deleted file mode 100644
index 7c45a6c8e674..000000000000
--- a/pkgs/development/tools/build-managers/gnumake/4.1/default.nix
+++ /dev/null
@@ -1,45 +0,0 @@
-{ stdenv, fetchurl }:
-
-let
-  version = "4.1";
-in
-stdenv.mkDerivation {
-  name = "gnumake-${version}";
-
-  src = fetchurl {
-    url = "mirror://gnu/make/make-${version}.tar.bz2";
-    sha256 = "19gwwhik3wdwn0r42b7xcihkbxvjl9r2bdal8nifc3k5i4rn3iqb";
-  };
-
-  patchFlags = "-p0";
-  patches = [
-    # Purity: don't look for library dependencies (of the form `-lfoo') in /lib
-    # and /usr/lib. It's a stupid feature anyway. Likewise, when searching for
-    # included Makefiles, don't look in /usr/include and friends.
-    ./impure-dirs.patch
-
-    # Don't segfault if we can't get a tty name.
-    ./no-tty-name.patch
-  ];
-
-  outputs = [ "out" "doc" ];
-
-  meta = {
-    homepage = http://www.gnu.org/software/make/;
-    description = "A tool to control the generation of non-source files from sources";
-    license = stdenv.lib.licenses.gpl3Plus;
-
-    longDescription = ''
-      Make is a tool which controls the generation of executables and
-      other non-source files of a program from the program's source files.
-
-      Make gets its knowledge of how to build your program from a file
-      called the makefile, which lists each of the non-source files and
-      how to compute it from other files. When you write a program, you
-      should write a makefile for it, so that it is possible to use Make
-      to build and install the program.
-    '';
-
-    platforms = stdenv.lib.platforms.all;
-  };
-}
diff --git a/pkgs/development/tools/build-managers/gnumake/4.1/impure-dirs.patch b/pkgs/development/tools/build-managers/gnumake/4.1/impure-dirs.patch
deleted file mode 100644
index f6646f1d0126..000000000000
--- a/pkgs/development/tools/build-managers/gnumake/4.1/impure-dirs.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-diff -rc read.c read.c
-*** read.c	2006-03-17 15:24:20.000000000 +0100
---- read.c	2007-05-24 17:16:31.000000000 +0200
-***************
-*** 99,107 ****
---- 99,109 ----
-  #endif
-      INCLUDEDIR,
-  #ifndef _AMIGA
-+ #if 0    
-      "/usr/gnu/include",
-      "/usr/local/include",
-      "/usr/include",
-+ #endif    
-  #endif
-      0
-    };
-diff -rc reremake.c
-*** remake.c	2006-03-20 03:36:37.000000000 +0100
---- remake.c	2007-05-24 17:06:54.000000000 +0200
-***************
-*** 1452,1460 ****
---- 1452,1462 ----
-    static char *dirs[] =
-      {
-  #ifndef _AMIGA
-+ #if 0
-        "/lib",
-        "/usr/lib",
-  #endif
-+ #endif
-  #if defined(WINDOWS32) && !defined(LIBDIR)
-  /*
-   * This is completely up to the user at product install time. Just define
diff --git a/pkgs/development/tools/build-managers/gnumake/4.1/no-tty-name.patch b/pkgs/development/tools/build-managers/gnumake/4.1/no-tty-name.patch
deleted file mode 100644
index a84d7ab49d04..000000000000
--- a/pkgs/development/tools/build-managers/gnumake/4.1/no-tty-name.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From 292da6f6867b75a5af7ddbb639a1feae022f438f Mon Sep 17 00:00:00 2001
-From: Paul Smith <psmith@gnu.org>
-Date: Mon, 20 Oct 2014 05:54:56 +0000
-Subject: * main.c (main): [SV 43434] Handle NULL returns from ttyname().
-
----
-diff --git main.c main.c
-index b2d169c..0cdb8a8 100644
---- main.c
-+++ main.c
-@@ -1429,13 +1429,18 @@ main (int argc, char **argv, char **envp)
- #ifdef HAVE_ISATTY
-     if (isatty (fileno (stdout)))
-       if (! lookup_variable (STRING_SIZE_TUPLE ("MAKE_TERMOUT")))
--        define_variable_cname ("MAKE_TERMOUT", TTYNAME (fileno (stdout)),
--                               o_default, 0)->export = v_export;
--
-+        {
-+          const char *tty = TTYNAME (fileno (stdout));
-+          define_variable_cname ("MAKE_TERMOUT", tty ? tty : DEFAULT_TTYNAME,
-+                                 o_default, 0)->export = v_export;
-+        }
-     if (isatty (fileno (stderr)))
-       if (! lookup_variable (STRING_SIZE_TUPLE ("MAKE_TERMERR")))
--        define_variable_cname ("MAKE_TERMERR", TTYNAME (fileno (stderr)),
--                               o_default, 0)->export = v_export;
-+        {
-+          const char *tty = TTYNAME (fileno (stderr));
-+          define_variable_cname ("MAKE_TERMERR", tty ? tty : DEFAULT_TTYNAME,
-+                                 o_default, 0)->export = v_export;
-+        }
- #endif
- 
-   /* Reset in case the switches changed our minds.  */
-diff --git makeint.h makeint.h
-index 6223936..2009f41 100644
---- makeint.h
-+++ makeint.h
-@@ -436,10 +436,11 @@ extern struct rlimit stack_limit;
- /* The number of bytes needed to represent the largest integer as a string.  */
- #define INTSTR_LENGTH         CSTRLEN ("18446744073709551616")
- 
-+#define DEFAULT_TTYNAME "true"
- #ifdef HAVE_TTYNAME
- # define TTYNAME(_f) ttyname (_f)
- #else
--# define TTYNAME(_f) "true"
-+# define TTYNAME(_f) DEFAULT_TTYNAME
- #endif
- 
- 
---
-cgit v0.9.0.2
diff --git a/pkgs/development/tools/build-managers/jam/default.nix b/pkgs/development/tools/build-managers/jam/default.nix
index c0d152ee7a2f..7314643530e8 100644
--- a/pkgs/development/tools/build-managers/jam/default.nix
+++ b/pkgs/development/tools/build-managers/jam/default.nix
@@ -10,6 +10,10 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ yacc ];
 
+  preConfigure = ''
+    unset AR
+  '';
+
   buildPhase = ''
     make jam0
     ./jam0 -j$NIX_BUILD_CORES -sBINDIR=$out/bin install
diff --git a/pkgs/development/tools/misc/gnum4/default.nix b/pkgs/development/tools/misc/gnum4/default.nix
index fbbd6cc4d6f8..33ea78907468 100644
--- a/pkgs/development/tools/misc/gnum4/default.nix
+++ b/pkgs/development/tools/misc/gnum4/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl }:
+{ stdenv, hostPlatform, fetchurl }:
 
 stdenv.mkDerivation rec {
   name = "gnum4-1.4.18";
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   configureFlags = "--with-syscmd-shell=${stdenv.shell}";
 
   # Upstream is aware of it; it may be in the next release.
-  patches = [ ./s_isdir.patch ];
+  patches = [ ./s_isdir.patch ] ++ stdenv.lib.optional hostPlatform.isDarwin stdenv.secure-format-patch;
 
   # FIXME needs gcc 4.9 in bootstrap tools
   hardeningDisable = [ "stackprotector" ];
diff --git a/pkgs/development/tools/parsing/bison/3.x.nix b/pkgs/development/tools/parsing/bison/3.x.nix
index ebbee4e693dc..0369d7dabde5 100644
--- a/pkgs/development/tools/parsing/bison/3.x.nix
+++ b/pkgs/development/tools/parsing/bison/3.x.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, m4, perl, help2man }:
+{ stdenv, hostPlatform, fetchurl, m4, perl, help2man }:
 
 stdenv.mkDerivation rec {
   name = "bison-3.0.4";
@@ -8,6 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "b67fd2daae7a64b5ba862c66c07c1addb9e6b1b05c5f2049392cfd8a2172952e";
   };
 
+  patches = stdenv.lib.optional hostPlatform.isDarwin stdenv.secure-format-patch;
+
   nativeBuildInputs = [ m4 perl ] ++ stdenv.lib.optional stdenv.isSunOS help2man;
   propagatedBuildInputs = [ m4 ];
 
diff --git a/pkgs/misc/misc.nix b/pkgs/misc/misc.nix
index 6357c4e6f905..a3c293beab33 100644
--- a/pkgs/misc/misc.nix
+++ b/pkgs/misc/misc.nix
@@ -23,7 +23,7 @@ in
   */
   collection = {list, name} : runCommand "collection-${name}" {} ''
     mkdir -p $out/nix-support
-    echo ${builtins.toString list} > $out/nix-support/propagated-user-env-packages
+    printWords ${builtins.toString list} > $out/nix-support/propagated-user-env-packages
   '';
 
   /* creates a derivation symlinking references C/C++ libs into one include and lib directory called $out/cdt-envs/${name}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/reexported_libraries b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/reexported_libraries
index 00aaba1d4982..494426eba6dc 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/reexported_libraries
+++ b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/reexported_libraries
@@ -19,7 +19,7 @@
 
 /usr/lib/system/libsystem_configuration.dylib
 /usr/lib/system/libsystem_coreservices.dylib
-/usr/lib/system/libsystem_coretls.dylib
+# /usr/lib/system/libsystem_coretls.dylib # Removed in 10.13
 /usr/lib/system/libsystem_dnssd.dylib
 /usr/lib/system/libsystem_info.dylib
 
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_kernel_symbols b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_kernel_symbols
index ff9073157a58..ed76787a9008 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_kernel_symbols
+++ b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_kernel_symbols
@@ -376,7 +376,6 @@ _fsync
 _fsync$NOCANCEL
 _ftruncate
 _futimes
-_get_dp_control_port
 _getattrlist
 _getattrlistat
 _getattrlistbulk
@@ -838,7 +837,6 @@ _sendmsg$NOCANCEL
 _sendmsg_x
 _sendto
 _sendto$NOCANCEL
-_set_dp_control_port
 _setattrlist
 _setaudit
 _setaudit_addr
diff --git a/pkgs/os-specific/linux/mdadm/default.nix b/pkgs/os-specific/linux/mdadm/default.nix
index 589099c911cf..0929bae991dd 100644
--- a/pkgs/os-specific/linux/mdadm/default.nix
+++ b/pkgs/os-specific/linux/mdadm/default.nix
@@ -22,6 +22,7 @@ stdenv.mkDerivation rec {
   makeFlags = [
     "NIXOS=1" "INSTALL=install" "INSTALL_BINDIR=$(out)/sbin"
     "MANDIR=$(out)/share/man" "RUN_DIR=/dev/.mdadm"
+    "STRIP="
   ] ++ stdenv.lib.optionals (hostPlatform != buildPlatform) [
     "CROSS_COMPILE=${stdenv.cc.prefix}"
   ];
diff --git a/pkgs/os-specific/linux/syslinux/default.nix b/pkgs/os-specific/linux/syslinux/default.nix
index ce63d383c8e8..37a237f57ac9 100644
--- a/pkgs/os-specific/linux/syslinux/default.nix
+++ b/pkgs/os-specific/linux/syslinux/default.nix
@@ -30,7 +30,8 @@ stdenv.mkDerivation rec {
   preBuild = ''
     substituteInPlace Makefile --replace /bin/pwd $(type -P pwd)
     substituteInPlace gpxe/src/Makefile.housekeeping --replace /bin/echo $(type -P echo)
-    substituteInPlace utils/ppmtolss16 gpxe/src/Makefile --replace /usr/bin/perl $(type -P perl)
+    substituteInPlace utils/ppmtolss16 --replace /usr/bin/perl $(type -P perl)
+    substituteInPlace gpxe/src/Makefile --replace /usr/bin/perl $(type -P perl)
   '';
 
   stripDebugList = "bin sbin share/syslinux/com32";
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 41f9c1e3e996..8e303bee8214 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -9,14 +9,14 @@
 assert stdenv.isLinux;
 
 stdenv.mkDerivation rec {
-  version = "233";
+  version = "234";
   name = "systemd-${version}";
 
   src = fetchFromGitHub {
     owner = "nixos";
     repo = "systemd";
-    rev = "72782e7ad96f9da9b0e5873f87a64007068cee06";
-    sha256 = "1cj20zrfr8g0vkxiv3h9bbd89xbj3mrsij3rjr1lbh4nkl5mcwpa";
+    rev = "ba777535a890c2a2b7677dfacc63e12c578b9b3f";
+    sha256 = "1vb45fbqkrgczfwkb0y07ldnwhjqk2sh446hzfkdn8hrwl1lifg5";
   };
 
   outputs = [ "out" "lib" "man" "dev" ];
@@ -32,7 +32,6 @@ stdenv.mkDerivation rec {
       autoreconfHook gettext docbook_xsl docbook_xml_dtd_42 docbook_xml_dtd_45
     ];
 
-
   configureFlags =
     [ "--localstatedir=/var"
       "--sysconfdir=/etc"
@@ -76,6 +75,8 @@ stdenv.mkDerivation rec {
 
   preConfigure =
     ''
+      unset RANLIB
+
       ./autogen.sh
 
       # FIXME: patch this in systemd properly (and send upstream).
@@ -99,8 +100,6 @@ stdenv.mkDerivation rec {
         --replace /usr/lib/systemd/catalog/ $out/lib/systemd/catalog/
 
       configureFlagsArray+=("--with-ntp-servers=0.nixos.pool.ntp.org 1.nixos.pool.ntp.org 2.nixos.pool.ntp.org 3.nixos.pool.ntp.org")
-
-      #export NIX_CFLAGS_LINK+=" -Wl,-rpath,$libudev/lib"
     '';
 
   PYTHON_BINARY = "${coreutils}/bin/env python"; # don't want a build time dependency on Python
@@ -166,16 +165,6 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  /*
-  # some libs fail to link to liblzma and/or libffi
-  postFixup = let extraLibs = stdenv.lib.makeLibraryPath [ xz.out libffi.out zlib.out ];
-    in ''
-      for f in "$out"/lib/*.so.0.*; do
-        patchelf --set-rpath `patchelf --print-rpath "$f"`':${extraLibs}' "$f"
-      done
-    '';
-  */
-
   # The interface version prevents NixOS from switching to an
   # incompatible systemd at runtime.  (Switching across reboots is
   # fine, of course.)  It should be increased whenever systemd changes
diff --git a/pkgs/os-specific/linux/zfs/default.nix b/pkgs/os-specific/linux/zfs/default.nix
index 45f1788bf63b..1e28cfe000f7 100644
--- a/pkgs/os-specific/linux/zfs/default.nix
+++ b/pkgs/os-specific/linux/zfs/default.nix
@@ -12,6 +12,7 @@ with stdenv.lib;
 let
   buildKernel = any (n: n == configFile) [ "kernel" "all" ];
   buildUser = any (n: n == configFile) [ "user" "all" ];
+
 in stdenv.mkDerivation rec {
   name = "zfs-${configFile}-${version}${optionalString buildKernel "-${kernel.version}"}";
   version = "0.7.0";
diff --git a/pkgs/servers/x11/xorg/builder.sh b/pkgs/servers/x11/xorg/builder.sh
index 055886374df4..fae8bf5a8ce5 100644
--- a/pkgs/servers/x11/xorg/builder.sh
+++ b/pkgs/servers/x11/xorg/builder.sh
@@ -18,14 +18,14 @@ postInstall() {
 
     for r in $requires; do
         if test -n "$crossConfig"; then
-            for p in $crossPkgs; do
+            for p in "${crossPkgs[@]}"; do
                 if test -e $p/lib/pkgconfig/$r.pc; then
                     echo "  found requisite $r in $p"
                     propagatedBuildInputs="$propagatedBuildInputs $p"
                 fi
             done
         else
-            for p in $nativePkgs; do
+            for p in "${nativePkgs[@]}"; do
                 if test -e $p/lib/pkgconfig/$r.pc; then
                     echo "  found requisite $r in $p"
                     propagatedNativeBuildInputs="$propagatedNativeBuildInputs $p"
diff --git a/pkgs/stdenv/adapters.nix b/pkgs/stdenv/adapters.nix
index 5848ee87b1b0..ac382927b1b9 100644
--- a/pkgs/stdenv/adapters.nix
+++ b/pkgs/stdenv/adapters.nix
@@ -73,15 +73,8 @@ rec {
     };
   in stdenv // {
     mkDerivation =
-      { name ? "", buildInputs ? [], nativeBuildInputs ? []
+      { buildInputs ? [], nativeBuildInputs ? []
       , propagatedBuildInputs ? [], propagatedNativeBuildInputs ? []
-      , # Disabling the tests by default when cross compiling, as usually the
-        # tests rely on being able to run produced binaries.
-        doCheck ? false
-      , configureFlags ? []
-      , # Target is not included by default because most programs don't care.
-        # Including it then would cause needless massive rebuilds.
-        configurePlatforms   ? args.crossAttrs.configurePlatforms   or [ "build" "host" ]
       , selfNativeBuildInput ? args.crossAttrs.selfNativeBuildInput or false
       , ...
       } @ args:
@@ -106,7 +99,6 @@ rec {
         nativeInputsFromBuildInputs = stdenv.lib.filter hostAsNativeDrv buildInputsNotNull;
       in
         stdenv.mkDerivation (args // {
-          name = name + "-" + hostPlatform.config;
           nativeBuildInputs = nativeBuildInputs
             ++ nativeInputsFromBuildInputs
             ++ stdenv.lib.optional selfNativeBuildInput nativeDrv
@@ -116,15 +108,6 @@ rec {
             ++ stdenv.lib.optional (hostPlatform.config == "aarch64-linux-gnu") pkgs.updateAutotoolsGnuConfigScriptsHook
             ;
 
-          inherit doCheck;
-
-          # This parameter is sometimes a string and sometimes a list, yuck
-          configureFlags = let inherit (stdenv.lib) optional elem; in
-            (if stdenv.lib.isString configureFlags then [configureFlags] else configureFlags)
-            ++ optional (elem "build"  configurePlatforms) "--build=${buildPlatform.config}"
-            ++ optional (elem "host"   configurePlatforms) "--host=${hostPlatform.config}"
-            ++ optional (elem "target" configurePlatforms) "--target=${targetPlatform.config}";
-
           # Cross-linking dynamic libraries, every buildInput should
           # be propagated because ld needs the -rpath-link to find
           # any library needed to link the program dynamically at
diff --git a/pkgs/stdenv/darwin/darwin-secure-format.patch b/pkgs/stdenv/darwin/darwin-secure-format.patch
new file mode 100644
index 000000000000..b14d8be6ef16
--- /dev/null
+++ b/pkgs/stdenv/darwin/darwin-secure-format.patch
@@ -0,0 +1,15 @@
+With format string strictness, High Sierra also enforces that %n isn't used
+in dynamic format strings, but we should just disable its use on darwin in
+general.
+
+--- a/lib/vasnprintf.c	2017-06-22 15:19:15.000000000 -0700
++++ b/lib/vasnprintf.c	2017-06-22 15:20:20.000000000 -0700
+@@ -4869,7 +4869,7 @@ VASNPRINTF (DCHAR_T *resultbuf, size_t *
+ #endif
+                   *fbp = dp->conversion;
+ #if USE_SNPRINTF
+-# if !(((__GLIBC__ > 2 || (__GLIBC__ == 2 && __GLIBC_MINOR__ >= 3)) && !defined __UCLIBC__) || ((defined _WIN32 || defined __WIN32__) && ! defined __CYGWIN__))
++# if !defined(__APPLE__) && !(((__GLIBC__ > 2 || (__GLIBC__ == 2 && __GLIBC_MINOR__ >= 3)) && !defined __UCLIBC__) || ((defined _WIN32 || defined __WIN32__) && ! defined __CYGWIN__))
+                 fbp[1] = '%';
+                 fbp[2] = 'n';
+                 fbp[3] = '\0';
diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index f6d9bcac5104..cac33a1bebb2 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -4,15 +4,15 @@
 # Allow passing in bootstrap files directly so we can test the stdenv bootstrap process when changing the bootstrap tools
 , bootstrapFiles ? let
   fetch = { file, sha256, executable ? true }: import <nix/fetchurl.nix> {
-    url = "http://tarballs.nixos.org/stdenv-darwin/x86_64/c4effbe806be9a0a3727fdbbc9a5e28149347532/${file}";
+    url = "http://tarballs.nixos.org/stdenv-darwin/x86_64/10cbca5b30c6cb421ce15139f32ae3a4977292cf/${file}";
     inherit (localSystem) system;
     inherit sha256 executable;
   }; in {
-    sh      = fetch { file = "sh";    sha256 = "1b9r3dksj907bpxp589yhc4217cas73vni8sng4r57f04ydjcinr"; };
-    bzip2   = fetch { file = "bzip2"; sha256 = "1wm28jgap4cbr8hf4ambg6h9flr2b4mcbh7fw20i0l51v6n8igky"; };
-    mkdir   = fetch { file = "mkdir"; sha256 = "0jc32mzx2whhx2xh70grvvgz4jj26118p9yxmhjqcysagc0k7y66"; };
-    cpio    = fetch { file = "cpio";  sha256 = "0x5dcczkzn0g8yb4pah449jmgy3nmpzrqy4s480grcx05b6v6hkp"; };
-    tarball = fetch { file = "bootstrap-tools.cpio.bz2"; sha256 = "0ifdc8bwxdhmpbhx2vd3lwjg71gqm6pi5mfm0fkcsbqavl8hd8hz"; executable = false; };
+    sh      = fetch { file = "sh";    sha256 = "0s8a9vpzj6vadq4jmf4r8cargwnsf327hdjydxgqsfxb8y1q39w3"; };
+    bzip2   = fetch { file = "bzip2"; sha256 = "1jqljpjr8mkiv7g5rl5impqx3all8vn1mxxdwa004pr3h48c1zgg"; };
+    mkdir   = fetch { file = "mkdir"; sha256 = "17zsjiwnq07i5r85q1hg7f6cnkcgllwy2amz9klaqwjy4vzz4vwh"; };
+    cpio    = fetch { file = "cpio";  sha256 = "04hrair58dgja6syh442pswiga5an9nl58ls57yknkn2pq51nx9m"; };
+    tarball = fetch { file = "bootstrap-tools.cpio.bz2"; sha256 = "103833hrci0vwi1gi978hkp69rncicvpdszn87ffpf1cq0jzpa14"; executable = false; };
   }
 }:
 
@@ -50,6 +50,8 @@ in rec {
     args    = [ ./unpack-bootstrap-tools.sh ];
 
     inherit (bootstrapFiles) mkdir bzip2 cpio tarball;
+    reexportedLibrariesFile =
+      ../../os-specific/darwin/apple-source-releases/Libsystem/reexported_libraries;
 
     __sandboxProfile = binShClosure + libSystemProfile;
   };
@@ -109,7 +111,13 @@ in rec {
         stdenvSandboxProfile = binShClosure + libSystemProfile;
         extraSandboxProfile  = binShClosure + libSystemProfile;
 
-        extraAttrs = { inherit platform; parent = last; };
+        extraAttrs = {
+          inherit platform;
+          parent = last;
+
+          # This is used all over the place so I figured I'd just leave it here for now
+          secure-format-patch = ./darwin-secure-format.patch;
+        };
         overrides  = self: super: (overrides self super) // { fetchurl = thisStdenv.fetchurlBoot; };
       };
 
@@ -319,6 +327,9 @@ in rec {
       inherit platform bootstrapTools;
       libc         = pkgs.darwin.Libsystem;
       shellPackage = pkgs.bash;
+
+      # This is used all over the place so I figured I'd just leave it here for now
+      secure-format-patch = ./darwin-secure-format.patch;
     };
 
     allowedRequisites = (with pkgs; [
diff --git a/pkgs/stdenv/darwin/unpack-bootstrap-tools.sh b/pkgs/stdenv/darwin/unpack-bootstrap-tools.sh
index 66c4e9ebeda9..0da80ec5ce56 100644
--- a/pkgs/stdenv/darwin/unpack-bootstrap-tools.sh
+++ b/pkgs/stdenv/darwin/unpack-bootstrap-tools.sh
@@ -26,7 +26,7 @@ install_name_tool \
   $out/lib/system/libsystem_kernel.dylib
 
 # TODO: this logic basically duplicates similar logic in the Libsystem expression. Deduplicate them!
-libs=$(otool -arch x86_64 -L /usr/lib/libSystem.dylib | tail -n +3 | awk '{ print $1 }')
+libs=$(cat $reexportedLibrariesFile | grep -v '^#')
 
 for i in $libs; do
   if [ "$i" != "/usr/lib/system/libsystem_kernel.dylib" ] && [ "$i" != "/usr/lib/system/libsystem_c.dylib" ]; then
diff --git a/pkgs/stdenv/generic/builder.sh b/pkgs/stdenv/generic/builder.sh
index a46c46c2db50..42e1a029e584 100644
--- a/pkgs/stdenv/generic/builder.sh
+++ b/pkgs/stdenv/generic/builder.sh
@@ -15,4 +15,6 @@ cat "$setup" >> $out/setup
 # Allow the user to install stdenv using nix-env and get the packages
 # in stdenv.
 mkdir $out/nix-support
-echo $propagatedUserEnvPkgs > $out/nix-support/propagated-user-env-packages
+if [ "$propagatedUserEnvPkgs" ]; then
+    printf '%s ' $propagatedUserEnvPkgs > $out/nix-support/propagated-user-env-packages
+fi
diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index 05221e2f3c10..be271daf8c8e 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -12,12 +12,22 @@ rec {
   # * https://nixos.org/nix/manual/#ssec-derivation
   #   Explanation about derivations in general
   mkDerivation =
-    { nativeBuildInputs ? []
+    { name ? ""
+
+    , nativeBuildInputs ? []
     , buildInputs ? []
 
     , propagatedNativeBuildInputs ? []
     , propagatedBuildInputs ? []
 
+    , configureFlags ? []
+    , # Target is not included by default because most programs don't care.
+      # Including it then would cause needless mass rebuilds.
+      #
+      # TODO(@Ericson2314): Make [ "build" "host" ] always the default.
+      configurePlatforms ? lib.optionals
+        (stdenv.hostPlatform != stdenv.buildPlatform)
+        [ "build" "host" ]
     , crossConfig ? null
     , meta ? {}
     , passthru ? {}
@@ -72,6 +82,9 @@ rec {
             lib.unique (lib.concatMap (input: input.__propagatedImpureHostDeps or []) (lib.concatLists propagatedDependencies'));
         in
         {
+          name = name + lib.optionalString
+            (stdenv.hostPlatform != stdenv.buildPlatform)
+            stdenv.hostPlatform.config;
           builder = attrs.realBuilder or stdenv.shell;
           args = attrs.args or ["-e" (attrs.builder or ./default-builder.sh)];
           inherit stdenv;
@@ -84,6 +97,16 @@ rec {
 
           propagatedNativeBuildInputs = lib.elemAt propagatedDependencies' 0;
           propagatedBuildInputs = lib.elemAt propagatedDependencies' 1;
+
+          # This parameter is sometimes a string, sometimes null, and sometimes a list, yuck
+          configureFlags = let inherit (lib) optional elem; in
+            (/**/ if lib.isString configureFlags then [configureFlags]
+             else if configureFlags == null      then []
+             else                                     configureFlags)
+            ++ optional (elem "build"  configurePlatforms) "--build=${stdenv.buildPlatform.config}"
+            ++ optional (elem "host"   configurePlatforms) "--host=${stdenv.hostPlatform.config}"
+            ++ optional (elem "target" configurePlatforms) "--target=${stdenv.targetPlatform.config}";
+
         } // lib.optionalAttrs (stdenv.buildPlatform.isDarwin) {
           # TODO: remove lib.unique once nix has a list canonicalization primitive
           __sandboxProfile =
diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index b48b49c0ad1b..dc3369f6611c 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -18,9 +18,9 @@ runHook() {
     local var="$hookName"
     if [[ "$hookName" =~ Hook$ ]]; then var+=s; else var+=Hooks; fi
 
-    eval "local -a dummy=(\"\${$var[@]}\")"
+    local varRef="$var[@]"
     local hook
-    for hook in "_callImplicitHook 0 $hookName" "${dummy[@]}"; do
+    for hook in "_callImplicitHook 0 $hookName" "${!varRef}"; do
         _eval "$hook" "$@"
     done
     return 0
@@ -34,9 +34,10 @@ runOneHook() {
     shift
     local var="$hookName"
     if [[ "$hookName" =~ Hook$ ]]; then var+=s; else var+=Hooks; fi
-    eval "local -a dummy=(\"\${$var[@]}\")"
+
+    local varRef="$var[@]"
     local hook
-    for hook in "_callImplicitHook 1 $hookName" "${dummy[@]}"; do
+    for hook in "_callImplicitHook 1 $hookName" "${!varRef}"; do
         if _eval "$hook" "$@"; then
             return 0
         fi
@@ -53,9 +54,9 @@ runOneHook() {
 _callImplicitHook() {
     local def="$1"
     local hookName="$2"
-    case "$(type -t $hookName)" in
-        (function|alias|builtin) $hookName;;
-        (file) source $hookName;;
+    case "$(type -t "$hookName")" in
+        (function|alias|builtin) "$hookName";;
+        (file) source "$hookName";;
         (keyword) :;;
         (*) if [ -z "${!hookName}" ]; then return "$def"; else eval "${!hookName}"; fi;;
     esac
@@ -67,7 +68,7 @@ _callImplicitHook() {
 _eval() {
     local code="$1"
     shift
-    if [ "$(type -t $code)" = function ]; then
+    if [ "$(type -t "$code")" = function ]; then
         eval "$code \"\$@\""
     else
         eval "$code"
@@ -78,29 +79,20 @@ _eval() {
 ######################################################################
 # Logging.
 
-nestingLevel=0
-
-startNest() {
-    nestingLevel=$(($nestingLevel + 1))
-    echo -en "\033[$1p"
-}
-
-stopNest() {
-    nestingLevel=$(($nestingLevel - 1))
-    echo -en "\033[q"
-}
-
-header() {
-    startNest "$2"
-    echo "$1"
-}
-
-# Make sure that even when we exit abnormally, the original nesting
-# level is properly restored.
-closeNest() {
-    while [ $nestingLevel -gt 0 ]; do
-        stopNest
-    done
+# Obsolete.
+stopNest() { true; }
+header() { echo "$1"; }
+closeNest() { true; }
+
+# Prints a command such that all word splits are unambiguous. We need
+# to split the command in three parts because the middle format string
+# will be, and must be, repeated for each argument. The first argument
+# goes before the ':' and is just for convenience.
+echoCmd() {
+    printf "%s:" "$1"
+    shift
+    printf ' %q' "$@"
+    echo
 }
 
 
@@ -108,11 +100,9 @@ closeNest() {
 # Error handling.
 
 exitHandler() {
-    exitCode=$?
+    exitCode="$?"
     set +e
 
-    closeNest
-
     if [ -n "$showBuildStats" ]; then
         times > "$NIX_BUILD_TOP/.times"
         local -a times=($(cat "$NIX_BUILD_TOP/.times"))
@@ -121,10 +111,10 @@ exitHandler() {
         # - system time for the shell
         # - user time for all child processes
         # - system time for all child processes
-        echo "build time elapsed: " ${times[*]}
+        echo "build time elapsed: " "${times[@]}"
     fi
 
-    if [ $exitCode != 0 ]; then
+    if [ "$exitCode" != 0 ]; then
         runHook failureHook
 
         # If the builder had a non-zero exit code and
@@ -134,7 +124,7 @@ exitHandler() {
         if [ -n "$succeedOnFailure" ]; then
             echo "build failed with exit code $exitCode (ignored)"
             mkdir -p "$out/nix-support"
-            printf "%s" $exitCode > "$out/nix-support/failed"
+            printf "%s" "$exitCode" > "$out/nix-support/failed"
             exit 0
         fi
 
@@ -142,7 +132,7 @@ exitHandler() {
         runHook exitHook
     fi
 
-    exit $exitCode
+    exit "$exitCode"
 }
 
 trap "exitHandler" EXIT
@@ -153,11 +143,11 @@ trap "exitHandler" EXIT
 
 
 addToSearchPathWithCustomDelimiter() {
-    local delimiter=$1
-    local varName=$2
-    local dir=$3
+    local delimiter="$1"
+    local varName="$2"
+    local dir="$3"
     if [ -d "$dir" ]; then
-        eval export ${varName}=${!varName}${!varName:+$delimiter}${dir}
+        export "${varName}=${!varName}${!varName:+$delimiter}${dir}"
     fi
 }
 
@@ -198,7 +188,7 @@ isELF() {
     local fd
     local magic
     exec {fd}< "$fn"
-    read -n 4 -u $fd magic
+    read -r -n 4 -u "$fd" magic
     exec {fd}<&-
     if [[ "$magic" =~ ELF ]]; then return 0; else return 1; fi
 }
@@ -211,11 +201,21 @@ isScript() {
     local magic
     if ! [ -x /bin/sh ]; then return 0; fi
     exec {fd}< "$fn"
-    read -n 2 -u $fd magic
+    read -r -n 2 -u "$fd" magic
     exec {fd}<&-
     if [[ "$magic" =~ \#! ]]; then return 0; else return 1; fi
 }
 
+# printf unfortunately will print a trailing newline regardless
+printLines() {
+    [[ "$#" -gt 0 ]] || return 0
+    printf '%s\n' "$@"
+}
+
+printWords() {
+    [[ "$#" -gt 0 ]] || return 0
+    printf '%s ' "$@"
+}
 
 ######################################################################
 # Initialisation.
@@ -239,7 +239,7 @@ shopt -s nullglob
 PATH=
 for i in $initialPath; do
     if [ "$i" = / ]; then i=; fi
-    addToSearchPath PATH $i/bin
+    addToSearchPath PATH "$i/bin"
 done
 
 if [ "$NIX_DEBUG" = 1 ]; then
@@ -259,7 +259,7 @@ paxmark() { true; }
 
 
 # Execute the pre-hook.
-if [ -z "$shell" ]; then export shell=$SHELL; fi
+if [ -z "$shell" ]; then export shell="$SHELL"; fi
 runHook preHook
 
 
@@ -272,16 +272,20 @@ runHook addInputsHook
 # Recursively find all build inputs.
 findInputs() {
     local pkg="$1"
-    local var=$2
-    local propagatedBuildInputsFile=$3
+    local var="$2"
+    local propagatedBuildInputsFile="$3"
 
-    case ${!var} in
-        *\ $pkg\ *)
-            return 0
-            ;;
+    # TODO(@Ericson2314): Restore using associative array once Darwin
+    # nix-shell doesn't use impure bash. This should replace the O(n)
+    # case with an O(1) hash map lookup, assuming bash is implemented
+    # well :D.
+    local varRef="$var[*]"
+
+    case "${!varRef}" in
+        *" $pkg "*) return 0 ;;
     esac
 
-    eval $var="'${!var} $pkg '"
+    eval "$var"'+=("$pkg")'
 
     if ! [ -e "$pkg" ]; then
         echo "build input $pkg does not exist" >&2
@@ -292,8 +296,8 @@ findInputs() {
         source "$pkg"
     fi
 
-    if [ -d $1/bin ]; then
-        addToSearchPath _PATH $1/bin
+    if [ -d "$pkg/bin" ]; then
+        addToSearchPath _PATH "$pkg/bin"
     fi
 
     if [ -f "$pkg/nix-support/setup-hook" ]; then
@@ -301,8 +305,9 @@ findInputs() {
     fi
 
     if [ -f "$pkg/nix-support/$propagatedBuildInputsFile" ]; then
-        for i in $(cat "$pkg/nix-support/$propagatedBuildInputsFile"); do
-            findInputs "$i" $var $propagatedBuildInputsFile
+        local pkgNext
+        for pkgNext in $(< "$pkg/nix-support/$propagatedBuildInputsFile"); do
+            findInputs "$pkgNext" "$var" "$propagatedBuildInputsFile"
         done
     fi
 }
@@ -310,21 +315,21 @@ findInputs() {
 if [ -z "$crossConfig" ]; then
     # Not cross-compiling - both buildInputs (and variants like propagatedBuildInputs)
     # are handled identically to nativeBuildInputs
-    nativePkgs=""
+    declare -a nativePkgs
     for i in $nativeBuildInputs $buildInputs \
              $defaultNativeBuildInputs $defaultBuildInputs \
              $propagatedNativeBuildInputs $propagatedBuildInputs; do
-        findInputs $i nativePkgs propagated-native-build-inputs
+        findInputs "$i" nativePkgs propagated-native-build-inputs
     done
 else
-    crossPkgs=""
+    declare -a crossPkgs
     for i in $buildInputs $defaultBuildInputs $propagatedBuildInputs; do
-        findInputs $i crossPkgs propagated-build-inputs
+        findInputs "$i" crossPkgs propagated-build-inputs
     done
 
-    nativePkgs=""
+    declare -a nativePkgs
     for i in $nativeBuildInputs $defaultNativeBuildInputs $propagatedNativeBuildInputs; do
-        findInputs $i nativePkgs propagated-native-build-inputs
+        findInputs "$i" nativePkgs propagated-native-build-inputs
     done
 fi
 
@@ -332,25 +337,25 @@ fi
 # Set the relevant environment variables to point to the build inputs
 # found above.
 _addToNativeEnv() {
-    local pkg=$1
+    local pkg="$1"
 
     # Run the package-specific hooks set by the setup-hook scripts.
     runHook envHook "$pkg"
 }
 
-for i in $nativePkgs; do
-    _addToNativeEnv $i
+for i in "${nativePkgs[@]}"; do
+    _addToNativeEnv "$i"
 done
 
 _addToCrossEnv() {
-    local pkg=$1
+    local pkg="$1"
 
     # Run the package-specific hooks set by the setup-hook scripts.
     runHook crossEnvHook "$pkg"
 }
 
-for i in $crossPkgs; do
-    _addToCrossEnv $i
+for i in "${crossPkgs[@]}"; do
+    _addToCrossEnv "$i"
 done
 
 
@@ -417,48 +422,53 @@ fi
 substitute() {
     local input="$1"
     local output="$2"
+    shift 2
 
     if [ ! -f "$input" ]; then
-      echo "substitute(): file '$input' does not exist"
+      echo "${FUNCNAME[0]}(): ERROR: file '$input' does not exist" >&2
       return 1
     fi
 
-    local -a params=("$@")
-
-    local n p pattern replacement varName content
-
-    # a slightly hacky way to keep newline at the end
-    content="$(cat "$input"; printf "%s" X)"
-    content="${content%X}"
+    local content
+    # read returns non-0 on EOF, so we want read to fail
+    if IFS='' read -r -N 0 content < "$input"; then
+        echo "${FUNCNAME[0]}(): ERROR: File \"$input\" has null bytes, won't process" >&2
+        return 1
+    fi
 
-    for ((n = 2; n < ${#params[*]}; n += 1)); do
-        p="${params[$n]}"
+    while (( "$#" )); do
+        case "$1" in
+            --replace)
+                pattern="$2"
+                replacement="$3"
+                shift 3
+                ;;
 
-        if [ "$p" = --replace ]; then
-            pattern="${params[$((n + 1))]}"
-            replacement="${params[$((n + 2))]}"
-            n=$((n + 2))
-        fi
+            --subst-var)
+                local varName="$2"
+                shift 2
+                # check if the used nix attribute name is a valid bash name
+                if ! [[ "$varName" =~ ^[a-zA-Z_][a-zA-Z0-9_]*$ ]]; then
+                    echo "${FUNCNAME[0]}(): WARNING: substitution variables should be valid bash names," >&2
+                    echo "  \"$varName\" isn't and therefore was skipped; it might be caused" >&2
+                    echo "  by multi-line phases in variables - see #14907 for details." >&2
+                    continue
+                fi
+                pattern="@$varName@"
+                replacement="${!varName}"
+                ;;
 
-        if [ "$p" = --subst-var ]; then
-            varName="${params[$((n + 1))]}"
-            n=$((n + 1))
-            # check if the used nix attribute name is a valid bash name
-            if ! [[ "$varName" =~ ^[a-zA-Z_][a-zA-Z0-9_]*$ ]]; then
-                echo "WARNING: substitution variables should be valid bash names,"
-                echo "  \"$varName\" isn't and therefore was skipped; it might be caused"
-                echo "  by multi-line phases in variables - see #14907 for details."
-                continue
-            fi
-            pattern="@$varName@"
-            replacement="${!varName}"
-        fi
+            --subst-var-by)
+                pattern="@$2@"
+                replacement="$3"
+                shift 3
+                ;;
 
-        if [ "$p" = --subst-var-by ]; then
-            pattern="@${params[$((n + 1))]}@"
-            replacement="${params[$((n + 2))]}"
-            n=$((n + 2))
-        fi
+            *)
+                echo "${FUNCNAME[0]}(): ERROR: Invalid command line argument: $1" >&2
+                return 1
+                ;;
+        esac
 
         content="${content//"$pattern"/$replacement}"
     done
@@ -521,7 +531,9 @@ dumpVars() {
 # Utility function: echo the base name of the given path, with the
 # prefix `HASH-' removed, if present.
 stripHash() {
-    local strippedName="$(basename "$1")";
+    local strippedName
+    # On separate line for `set -e`
+    strippedName="$(basename "$1")"
     if echo "$strippedName" | grep -q '^[a-z0-9]\{32\}-'; then
         echo "$strippedName" | cut -c34-
     else
@@ -569,7 +581,6 @@ unpackFile() {
         echo "do not know how to unpack source archive $curSrc"
         exit 1
     fi
-    stopNest
 }
 
 
@@ -578,6 +589,7 @@ unpackPhase() {
 
     if [ -z "$srcs" ]; then
         if [ -z "$src" ]; then
+            # shellcheck disable=SC2016
             echo 'variable $src or $srcs should point to the source'
             exit 1
         fi
@@ -597,7 +609,7 @@ unpackPhase() {
 
     # Unpack all source archives.
     for i in $srcs; do
-        unpackFile $i
+        unpackFile "$i"
     done
 
     # Find the source directory.
@@ -661,8 +673,8 @@ patchPhase() {
                 ;;
         esac
         # "2>&1" is a hack to make patch fail if the decompressor fails (nonexistent patch, etc.)
+        # shellcheck disable=SC2086
         $uncompress < "$i" 2>&1 | patch ${patchFlags:--p1}
-        stopNest
     done
 
     runHook postPatch
@@ -677,18 +689,19 @@ fixLibtool() {
 configurePhase() {
     runHook preConfigure
 
-    if [ -z "$configureScript" -a -x ./configure ]; then
+    if [[ -z "$configureScript" && -x ./configure ]]; then
         configureScript=./configure
     fi
 
     if [ -z "$dontFixLibtool" ]; then
-        find . -iname "ltmain.sh" | while read i; do
+        local i
+        find . -iname "ltmain.sh" -print0 | while IFS='' read -r -d '' i; do
             echo "fixing libtool script $i"
-            fixLibtool $i
+            fixLibtool "$i"
         done
     fi
 
-    if [ -z "$dontAddPrefix" -a -n "$prefix" ]; then
+    if [[ -z "$dontAddPrefix" && -n "$prefix" ]]; then
         configureFlags="${prefixKey:---prefix=}$prefix $configureFlags"
     fi
 
@@ -707,8 +720,12 @@ configurePhase() {
     fi
 
     if [ -n "$configureScript" ]; then
-        echo "configure flags: $configureFlags ${configureFlagsArray[@]}"
-        $configureScript $configureFlags "${configureFlagsArray[@]}"
+        # shellcheck disable=SC2086
+        local flagsArray=($configureFlags "${configureFlagsArray[@]}")
+        echoCmd 'configure flags' "${flagsArray[@]}"
+        # shellcheck disable=SC2086
+        $configureScript "${flagsArray[@]}"
+        unset flagsArray
     else
         echo "no configure script, doing nothing"
     fi
@@ -720,17 +737,21 @@ configurePhase() {
 buildPhase() {
     runHook preBuild
 
-    if [ -z "$makeFlags" ] && ! [ -n "$makefile" -o -e "Makefile" -o -e "makefile" -o -e "GNUmakefile" ]; then
+    if [[ -z "$makeFlags" && ! ( -n "$makefile" || -e Makefile || -e makefile || -e GNUmakefile[[ ) ]]; then
         echo "no Makefile, doing nothing"
     else
         # See https://github.com/NixOS/nixpkgs/pull/1354#issuecomment-31260409
         makeFlags="SHELL=$SHELL $makeFlags"
 
-        echo "make flags: $makeFlags ${makeFlagsArray[@]} $buildFlags ${buildFlagsArray[@]}"
-        make ${makefile:+-f $makefile} \
+        # shellcheck disable=SC2086
+        local flagsArray=( \
             ${enableParallelBuilding:+-j${NIX_BUILD_CORES} -l${NIX_BUILD_CORES}} \
             $makeFlags "${makeFlagsArray[@]}" \
-            $buildFlags "${buildFlagsArray[@]}"
+            $buildFlags "${buildFlagsArray[@]}")
+
+        echoCmd 'build flags' "${flagsArray[@]}"
+        make ${makefile:+-f $makefile} "${flagsArray[@]}"
+        unset flagsArray
     fi
 
     runHook postBuild
@@ -740,11 +761,15 @@ buildPhase() {
 checkPhase() {
     runHook preCheck
 
-    echo "check flags: $makeFlags ${makeFlagsArray[@]} $checkFlags ${checkFlagsArray[@]}"
-    make ${makefile:+-f $makefile} \
+    # shellcheck disable=SC2086
+    local flagsArray=( \
         ${enableParallelBuilding:+-j${NIX_BUILD_CORES} -l${NIX_BUILD_CORES}} \
         $makeFlags "${makeFlagsArray[@]}" \
-        ${checkFlags:-VERBOSE=y} "${checkFlagsArray[@]}" ${checkTarget:-check}
+        ${checkFlags:-VERBOSE=y} "${checkFlagsArray[@]}" ${checkTarget:-check})
+
+    echoCmd 'check flags' "${flagsArray[@]}"
+    make ${makefile:+-f $makefile} "${flagsArray[@]}"
+    unset flagsArray
 
     runHook postCheck
 }
@@ -757,11 +782,16 @@ installPhase() {
         mkdir -p "$prefix"
     fi
 
-    installTargets=${installTargets:-install}
-    echo "install flags: $installTargets $makeFlags ${makeFlagsArray[@]} $installFlags ${installFlagsArray[@]}"
-    make ${makefile:+-f $makefile} $installTargets \
+    installTargets="${installTargets:-install}"
+
+    # shellcheck disable=SC2086
+    local flagsArray=( $installTargets \
         $makeFlags "${makeFlagsArray[@]}" \
-        $installFlags "${installFlagsArray[@]}"
+        $installFlags "${installFlagsArray[@]}")
+
+    echoCmd 'install flags' "${flagsArray[@]}"
+    make ${makefile:+-f $makefile} "${flagsArray[@]}"
+    unset flagsArray
 
     runHook postInstall
 }
@@ -781,7 +811,7 @@ fixupPhase() {
     # Apply fixup to each output.
     local output
     for output in $outputs; do
-        prefix=${!output} runHook fixupOutput
+        prefix="${!output}" runHook fixupOutput
     done
 
 
@@ -795,17 +825,20 @@ fixupPhase() {
         fi
         if [ -n "$propagated" ]; then
             mkdir -p "${!outputDev}/nix-support"
-            echo "$propagated" > "${!outputDev}/nix-support/propagated-native-build-inputs"
+            # shellcheck disable=SC2086
+            printWords $propagated > "${!outputDev}/nix-support/propagated-native-build-inputs"
         fi
     else
         if [ -n "$propagatedBuildInputs" ]; then
             mkdir -p "${!outputDev}/nix-support"
-            echo "$propagatedBuildInputs" > "${!outputDev}/nix-support/propagated-build-inputs"
+            # shellcheck disable=SC2086
+            printWords $propagatedBuildInputs > "${!outputDev}/nix-support/propagated-build-inputs"
         fi
 
         if [ -n "$propagatedNativeBuildInputs" ]; then
             mkdir -p "${!outputDev}/nix-support"
-            echo "$propagatedNativeBuildInputs" > "${!outputDev}/nix-support/propagated-native-build-inputs"
+            # shellcheck disable=SC2086
+            printWords $propagatedNativeBuildInputs > "${!outputDev}/nix-support/propagated-native-build-inputs"
         fi
     fi
 
@@ -818,7 +851,8 @@ fixupPhase() {
 
     if [ -n "$propagatedUserEnvPkgs" ]; then
         mkdir -p "${!outputBin}/nix-support"
-        echo "$propagatedUserEnvPkgs" > "${!outputBin}/nix-support/propagated-user-env-packages"
+        # shellcheck disable=SC2086
+        printWords $propagatedUserEnvPkgs > "${!outputBin}/nix-support/propagated-user-env-packages"
     fi
 
     runHook postFixup
@@ -828,11 +862,15 @@ fixupPhase() {
 installCheckPhase() {
     runHook preInstallCheck
 
-    echo "installcheck flags: $makeFlags ${makeFlagsArray[@]} $installCheckFlags ${installCheckFlagsArray[@]}"
-    make ${makefile:+-f $makefile} \
+    # shellcheck disable=SC2086
+    local flagsArray=( \
         ${enableParallelBuilding:+-j${NIX_BUILD_CORES} -l${NIX_BUILD_CORES}} \
         $makeFlags "${makeFlagsArray[@]}" \
-        $installCheckFlags "${installCheckFlagsArray[@]}" ${installCheckTarget:-installcheck}
+        $installCheckFlags "${installCheckFlagsArray[@]}" ${installCheckTarget:-installcheck})
+
+    echoCmd 'installcheck flags' "${flagsArray[@]}"
+    make ${makefile:+-f $makefile} "${flagsArray[@]}"
+    unset flagsArray
 
     runHook postInstallCheck
 }
@@ -841,15 +879,19 @@ installCheckPhase() {
 distPhase() {
     runHook preDist
 
-    echo "dist flags: $distFlags ${distFlagsArray[@]}"
-    make ${makefile:+-f $makefile} $distFlags "${distFlagsArray[@]}" ${distTarget:-dist}
+    # shellcheck disable=SC2086
+    local flagsArray=($distFlags "${distFlagsArray[@]}" ${distTarget:-dist})
+
+    echo 'dist flags: %q' "${flagsArray[@]}"
+    make ${makefile:+-f $makefile} "${flagsArray[@]}"
 
     if [ "$dontCopyDist" != 1 ]; then
         mkdir -p "$out/tarballs"
 
         # Note: don't quote $tarballs, since we explicitly permit
         # wildcards in there.
-        cp -pvd ${tarballs:-*.tar.gz} $out/tarballs
+        # shellcheck disable=SC2086
+        cp -pvd ${tarballs:-*.tar.gz} "$out/tarballs"
     fi
 
     runHook postDist
@@ -858,7 +900,7 @@ distPhase() {
 
 showPhaseHeader() {
     local phase="$1"
-    case $phase in
+    case "$phase" in
         unpackPhase) header "unpacking sources";;
         patchPhase) header "patching sources";;
         configurePhase) header "configuring";;
@@ -890,14 +932,14 @@ genericBuild() {
     fi
 
     for curPhase in $phases; do
-        if [ "$curPhase" = buildPhase -a -n "$dontBuild" ]; then continue; fi
-        if [ "$curPhase" = checkPhase -a -z "$doCheck" ]; then continue; fi
-        if [ "$curPhase" = installPhase -a -n "$dontInstall" ]; then continue; fi
-        if [ "$curPhase" = fixupPhase -a -n "$dontFixup" ]; then continue; fi
-        if [ "$curPhase" = installCheckPhase -a -z "$doInstallCheck" ]; then continue; fi
-        if [ "$curPhase" = distPhase -a -z "$doDist" ]; then continue; fi
-
-        if [ -n "$tracePhases" ]; then
+        if [[ "$curPhase" = buildPhase && -n "$dontBuild" ]]; then continue; fi
+        if [[ "$curPhase" = checkPhase && -z "$doCheck" ]]; then continue; fi
+        if [[ "$curPhase" = installPhase && -n "$dontInstall" ]]; then continue; fi
+        if [[ "$curPhase" = fixupPhase && -n "$dontFixup" ]]; then continue; fi
+        if [[ "$curPhase" = installCheckPhase && -z "$doInstallCheck" ]]; then continue; fi
+        if [[ "$curPhase" = distPhase && -z "$doDist" ]]; then continue; fi
+
+        if [[ -n "$tracePhases" ]]; then
             echo
             echo "@ phase-started $out $curPhase"
         fi
@@ -917,8 +959,6 @@ genericBuild() {
             echo
             echo "@ phase-succeeded $out $curPhase"
         fi
-
-        stopNest
     done
 }
 
diff --git a/pkgs/tools/compression/gzip/default.nix b/pkgs/tools/compression/gzip/default.nix
index cb7dc65c710d..bb9555fa600c 100644
--- a/pkgs/tools/compression/gzip/default.nix
+++ b/pkgs/tools/compression/gzip/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, xz }:
+{ stdenv, hostPlatform, fetchurl, xz }:
 
 stdenv.mkDerivation rec {
   name = "gzip-${version}";
@@ -9,6 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "1lxv3p4iyx7833mlihkn5wfwmz4cys5nybwpz3dfawag8kn6f5zz";
   };
 
+  patches = stdenv.lib.optional hostPlatform.isDarwin stdenv.secure-format-patch;
+
   outputs = [ "out" "man" "info" ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/tools/graphics/argyllcms/default.nix b/pkgs/tools/graphics/argyllcms/default.nix
index 3c7af45f81dd..3cdb4497baf1 100644
--- a/pkgs/tools/graphics/argyllcms/default.nix
+++ b/pkgs/tools/graphics/argyllcms/default.nix
@@ -84,6 +84,8 @@ stdenv.mkDerivation rec {
     substituteInPlace Makefile --replace "-j 3" "-j $NIX_BUILD_CORES"
     # Remove tiff, jpg and png to be sure the nixpkgs-provided ones are used
     rm -rf tiff jpg png
+
+    unset AR
   '';
 
   buildInputs = [
diff --git a/pkgs/tools/misc/coreutils/default.nix b/pkgs/tools/misc/coreutils/default.nix
index 9a988a2b4311..099e9ee0849d 100644
--- a/pkgs/tools/misc/coreutils/default.nix
+++ b/pkgs/tools/misc/coreutils/default.nix
@@ -24,7 +24,8 @@ stdenv.mkDerivation rec {
   # FIXME needs gcc 4.9 in bootstrap tools
   hardeningDisable = [ "stackprotector" ];
 
-  patches = optional hostPlatform.isCygwin ./coreutils-8.23-4.cygwin.patch;
+  patches = optional hostPlatform.isCygwin ./coreutils-8.23-4.cygwin.patch
+    ++ optional hostPlatform.isDarwin stdenv.secure-format-patch;
 
   # The test tends to fail on btrfs and maybe other unusual filesystems.
   postPatch = optionalString (!hostPlatform.isDarwin) ''
diff --git a/pkgs/tools/misc/grub/2.0x.nix b/pkgs/tools/misc/grub/2.0x.nix
index 2bbeea8133e7..634022e88e02 100644
--- a/pkgs/tools/misc/grub/2.0x.nix
+++ b/pkgs/tools/misc/grub/2.0x.nix
@@ -85,6 +85,8 @@ stdenv.mkDerivation rec {
        # See <http://www.mail-archive.com/qemu-devel@nongnu.org/msg22775.html>.
        sed -i "tests/util/grub-shell.in" \
            -e's/qemu-system-i386/qemu-system-x86_64 -nodefaults/g'
+
+      unset CPP # setting CPP intereferes with dependency calculation
     '';
 
   prePatch =
diff --git a/pkgs/tools/networking/openssh/default.nix b/pkgs/tools/networking/openssh/default.nix
index aaef2723da0c..c0440e78a389 100644
--- a/pkgs/tools/networking/openssh/default.nix
+++ b/pkgs/tools/networking/openssh/default.nix
@@ -60,6 +60,12 @@ stdenv.mkDerivation rec {
     ++ optional withKerberos kerberos
     ++ optional hpnSupport autoreconfHook;
 
+  preConfigure = ''
+    # Setting LD causes `configure' and `make' to disagree about which linker
+    # to use: `configure' wants `gcc', but `make' wants `ld'.
+    unset LD
+  '';
+
   # I set --disable-strip because later we strip anyway. And it fails to strip
   # properly when cross building.
   configureFlags = [
diff --git a/pkgs/tools/networking/ppp/default.nix b/pkgs/tools/networking/ppp/default.nix
index 90a4b988c3f7..d07770260ff6 100644
--- a/pkgs/tools/networking/ppp/default.nix
+++ b/pkgs/tools/networking/ppp/default.nix
@@ -34,7 +34,9 @@ stdenv.mkDerivation rec {
   '';
 
   postFixup = ''
-    substituteInPlace $out/bin/{pon,poff,plog} --replace "/usr/sbin" "$out/bin"
+    for tgt in pon poff plog; do
+      substituteInPlace "$out/bin/$tgt" --replace "/usr/sbin" "$out/bin"
+    done
   '';
 
   meta = {
diff --git a/pkgs/tools/networking/unbound/default.nix b/pkgs/tools/networking/unbound/default.nix
index e700ea4fb286..5b6b2ee7ba70 100644
--- a/pkgs/tools/networking/unbound/default.nix
+++ b/pkgs/tools/networking/unbound/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, openssl, nettle, expat, libevent }:
+{ stdenv, fetchurl, openssl, nettle, expat, libevent, dns-root-data }:
 
 stdenv.mkDerivation rec {
   name = "unbound-${version}";
@@ -20,6 +20,7 @@ stdenv.mkDerivation rec {
     "--localstatedir=/var"
     "--sysconfdir=/etc"
     "--sbindir=\${out}/bin"
+    "--with-rootkey-file=${dns-root-data}/root.key"
     "--enable-pie"
     "--enable-relro-now"
   ];
diff --git a/pkgs/tools/security/vulnix/requirements.nix b/pkgs/tools/security/vulnix/requirements.nix
index 11faca44ef93..d44d49f12a92 100644
--- a/pkgs/tools/security/vulnix/requirements.nix
+++ b/pkgs/tools/security/vulnix/requirements.nix
@@ -1,38 +1,6 @@
 { pythonPackages, fetchurl, stdenv }:
 
 rec {
-  BTrees = pythonPackages.buildPythonPackage {
-    name = "BTrees-4.3.1";
-    src = fetchurl {
-      url = "https://pypi.python.org/packages/24/76/cd6f225f2180c22af5cdb6656f51aec5fca45e45bdc4fa75c0a32f161a61/BTrees-4.3.1.tar.gz";
-      sha256 = "2565b7d35260dfc6b1e2934470fd0a2f9326c58c535a2b4cb396289d1c195a95";
-    };
-    propagatedBuildInputs = [
-      persistent
-      transaction
-    ] ++ (with pythonPackages; [ zope_interface coverage ]);
-
-    meta = with stdenv.lib; {
-      homepage = "";
-      license = licenses.zpt21;
-      description = "Scalable persistent object containers";
-    };
-  };
-
-  ZConfig = pythonPackages.buildPythonPackage {
-    name = "ZConfig-3.1.0";
-    src = fetchurl {
-      url = "https://pypi.python.org/packages/52/b3/a96d62711a26d8cfbe546519975dc9ed54d2eb50b3238d2e6de045764796/ZConfig-3.1.0.tar.gz";
-      sha256 = "c21fa3a073a56925a8098036d46717392994a92cffea1b3cda3176b70c0a842e";
-    };
-    propagatedBuildInputs = with pythonPackages; [ zope_testrunner ];
-    meta = with stdenv.lib; {
-      homepage = "";
-      license = licenses.zpt21;
-      description = "Structured Configuration Library";
-    };
-  };
-
   zodb = pythonPackages.buildPythonPackage {
     name = "ZODB-5.2.0";
     src = fetchurl {
@@ -41,31 +9,22 @@ rec {
     };
     doCheck = false;
     propagatedBuildInputs = [
-      BTrees
-      persistent
       transaction
-      ZConfig
-      zc.lockfile
+    ] ++ (with pythonPackages; [
+      six
+      wheel
+      zope_interface
       zodbpickle
-    ] ++ (with pythonPackages; [ six wheel zope_interface ]);
-    meta = with stdenv.lib; {
-      homepage = "";
-      license = licenses.zpt21;
-      description = "Zope Object Database: object database and persistence";
-    };
-  };
+      zconfig
+      persistent
+      zc_lockfile
+      BTrees
+    ]);
 
-  persistent = pythonPackages.buildPythonPackage {
-    name = "persistent-4.2.2";
-    src = fetchurl {
-      url = "https://pypi.python.org/packages/3d/71/3302512282b606ec4d054e09be24c065915518903b29380b6573bff79c24/persistent-4.2.2.tar.gz";
-      sha256 = "52ececc6dbba5ef572d3435189318b4dff07675bafa9620e32f785e147c6563c";
-    };
-    propagatedBuildInputs = with pythonPackages; [ zope_interface six wheel ];
     meta = with stdenv.lib; {
       homepage = "";
       license = licenses.zpt21;
-      description = "Translucent persistent objects";
+      description = "Zope Object Database: object database and persistence";
     };
   };
 
@@ -75,39 +34,16 @@ rec {
       url = "https://pypi.python.org/packages/8c/af/3ffafe85bcc93ecb09459f3f2bd8fbe142e9ab34048f9e2774543b470cbd/transaction-2.0.3.tar.gz";
       sha256 = "67bfb81309ba9717edbb2ca2e5717c325b78beec0bf19f44e5b4b9410f82df7f";
     };
-    propagatedBuildInputs = with pythonPackages; [ zope_interface six wheel ];
+    propagatedBuildInputs = with pythonPackages; [
+      zope_interface
+      six
+      wheel
+      mock
+    ];
     meta = with stdenv.lib; {
       homepage = "";
       license = licenses.zpt21;
       description = "Transaction management for Python";
     };
   };
-
-  zc.lockfile = pythonPackages.buildPythonPackage {
-    name = "zc.lockfile-1.2.1";
-    src = fetchurl {
-      url = "https://pypi.python.org/packages/bd/84/0299bbabbc9d3f84f718ba1039cc068030d3ad723c08f82a64337edf901e/zc.lockfile-1.2.1.tar.gz";
-      sha256 = "11db91ada7f22fe8aae268d4bfdeae012c4fe655f66bbb315b00822ec00d043e";
-    };
-    meta = with stdenv.lib; {
-      homepage = "";
-      license = licenses.zpt21;
-      description = "Basic inter-process locks";
-    };
-  };
-
-  zodbpickle = pythonPackages.buildPythonPackage {
-    name = "zodbpickle-0.6.0";
-    src = fetchurl {
-      url = "https://pypi.python.org/packages/7a/fc/f6f437a5222b330735eaf8f1e67a6845bd1b600e9a9455e552d3c13c4902/zodbpickle-0.6.0.tar.gz";
-      sha256 = "ea3248be966159e7791e3db0e35ea992b9235d52e7d39835438686741d196665";
-    };
-    doCheck = false;
-
-    meta = with stdenv.lib; {
-      homepage = "";
-      license = licenses.zpt21;
-      description = "Fork of Python 3 pickle module.";
-    };
-  };
 }
diff --git a/pkgs/tools/system/pciutils/default.nix b/pkgs/tools/system/pciutils/default.nix
index 998a3bdf6d1d..8a4fe6cb3cff 100644
--- a/pkgs/tools/system/pciutils/default.nix
+++ b/pkgs/tools/system/pciutils/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, pkgconfig, zlib, kmod, which }:
 
 stdenv.mkDerivation rec {
-  name = "pciutils-3.5.4"; # with database from 2017-02
+  name = "pciutils-3.5.5"; # with database from 2017-07
 
   src = fetchurl {
     url = "mirror://kernel/software/utils/pciutils/${name}.tar.xz";
-    sha256 = "0rpy7kkb2y89wmbcbfjjjxsk2x89v5xxhxib4vpl131ip5m3qab4";
+    sha256 = "1d62f8fa192f90e61c35a6fc15ff3cb9a7a792f782407acc42ef67817c5939f5";
   };
 
   buildInputs = [ pkgconfig zlib kmod which ];
diff --git a/pkgs/tools/text/gnugrep/default.nix b/pkgs/tools/text/gnugrep/default.nix
index b33ea7169783..0db140c7891c 100644
--- a/pkgs/tools/text/gnugrep/default.nix
+++ b/pkgs/tools/text/gnugrep/default.nix
@@ -1,13 +1,13 @@
 { stdenv, fetchurl, pcre, libiconv, perl }:
 
-let version = "3.0"; in
+let version = "3.1"; in
 
 stdenv.mkDerivation {
   name = "gnugrep-${version}";
 
   src = fetchurl {
     url = "mirror://gnu/grep/grep-${version}.tar.xz";
-    sha256 = "1dcasjp3a578nrvzrcn38mpizb8w1q6mvfzhjmcqqgkf0nsivj72";
+    sha256 = "0zm0ywmyz9g8vn1plw14mn8kj74yipx5qsljndbyfgmvndx5qqnv";
   };
 
   # Perl is needed for testing
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index d3c012b37a8f..21daf608d25d 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3646,7 +3646,7 @@ with pkgs;
           (attrs: { nativeBuildInputs = attrs.nativeBuildInputs ++ [ gtk3 ];
                     # Fix this build error in ./tests/examples/waylandsink:
                     #   main.c:28:2: error: #error "Wayland is not supported in GTK+"
-                    configureFlags = attrs.configureFlags or "" + "--enable-wayland=no";
+                    configureFlags = attrs.configureFlags or [] ++ [ "--enable-wayland=no" ];
                   });
       };
   };
@@ -6921,11 +6921,8 @@ with pkgs;
 
   gnum4 = callPackage ../development/tools/misc/gnum4 { };
 
-  gnumake380 = callPackage ../development/tools/build-managers/gnumake/3.80 { };
   gnumake382 = callPackage ../development/tools/build-managers/gnumake/3.82 { };
   gnumake3 = gnumake382;
-  gnumake40 = callPackage ../development/tools/build-managers/gnumake/4.0 { };
-  gnumake41 = callPackage ../development/tools/build-managers/gnumake/4.1 { };
   gnumake42 = callPackage ../development/tools/build-managers/gnumake/4.2 { };
   gnumake = gnumake42;
 
@@ -12879,6 +12876,8 @@ with pkgs;
 
   dina-font-pcf = callPackage ../data/fonts/dina-pcf { };
 
+  dns-root-data = callPackage ../data/misc/dns-root-data { };
+
   docbook5 = callPackage ../data/sgml+xml/schemas/docbook-5.0 { };
 
   docbook_sgml_dtd_31 = callPackage ../data/sgml+xml/schemas/sgml-dtd/docbook/3.1.nix { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 588f9651b071..54a475ad1cbb 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -136,6 +136,8 @@ in {
 
   emcee = callPackage ../development/python-modules/emcee { };
 
+  email_validator = callPackage ../development/python-modules/email-validator { };
+
   dbus-python = callPackage ../development/python-modules/dbus {
     dbus = pkgs.dbus;
   };
@@ -2787,6 +2789,12 @@ in {
       sha256 = "0kgmbs3fl9879n48p4m79nxy9by2yhvxq1jdvlnqzzvkdb2sdmg3";
     };
 
+    # Fixes testsuite for python-3.6
+    # From ubuntu packaging: https://launchpad.net/ubuntu/+archive/primary/+files/celery_4.0.2-0ubuntu1.debian.tar.xz
+    # (linked from https://launchpad.net/ubuntu/+source/celery)
+    # https://github.com/celery/celery/pull/3736#issuecomment-274155454 from upstream
+    patches = [ ../development/python-modules/celery/fix_endless_python3.6_loop_logger_isa.patch ];
+
     buildInputs = with self; [ pytest case ];
     propagatedBuildInputs = with self; [ kombu billiard pytz anyjson amqp eventlet ];
 
@@ -5198,25 +5206,7 @@ in {
     };
   };
 
-  dns = buildPythonPackage rec {
-    name = "dnspython-${version}";
-    version = "1.14.0";
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/d/dnspython/${name}.zip";
-      sha256 = "1p1i46fyhxfic8mfh3gfckpn2pn7282xqabhihiqymrp4sa8ni91";
-    };
-
-    # needs networking for some tests
-    doCheck = false;
-
-    meta = {
-      description = "A DNS toolkit for Python 3.x";
-      homepage = http://www.dnspython.org;
-      # BSD-like, check http://www.dnspython.org/LICENSE for details
-      license = licenses.free;
-    };
-  };
+  dns = callPackage ../development/python-modules/dns { };
 
   docker = callPackage ../development/python-modules/docker.nix {};
 
@@ -5853,22 +5843,7 @@ in {
     };
   };
 
-  faker = buildPythonPackage rec {
-    name = "faker-0.0.4";
-    disabled = isPy3k;
-    src = pkgs.fetchurl {
-      url = mirror://pypi/F/Faker/Faker-0.0.4.tar.gz;
-      sha256 = "09q5jna3j8di0gw5yjx0dvlndkrk2x9vvqzwyfsvg3nlp8h38js1";
-    };
-    buildInputs = with self; [ nose ];
-    meta = {
-      description = "A Python library for generating fake user data";
-      homepage    = http://pypi.python.org/pypi/Faker;
-      license     = licenses.mit;
-      maintainers = with maintainers; [ lovek323 ];
-      platforms   = platforms.unix;
-    };
-  };
+  faker = callPackage ../development/python-modules/faker { };
 
   fake_factory = buildPythonPackage rec {
     name = "fake-factory-${version}";
@@ -12017,6 +11992,14 @@ in {
       sha256 = "18hiricdnbnlz6hx3hbaa4dni6npv8rbid4dhf7k02k16qm6zz6h";
     };
 
+    # Backport fix for python-3.6 from master (see issue https://github.com/celery/kombu/issues/675)
+    # TODO remove at next update
+    patches = [ (pkgs.fetchpatch {
+      url = "https://github.com/celery/kombu/commit/dc3fceff59d79ceac3f8f11a5d697beabb4b7a7f.patch";
+      sha256 = "0s6gsihzjvmpffc7xrrcijw00r56yb74jg0sbjgng2v1324z1da9";
+      name = "don-t-modify-dict-size-while-iterating-over-it";
+    }) ];
+
     buildInputs = with self; [ pytest case pytz ];
 
     propagatedBuildInputs = with self; [ amqp ];
@@ -15844,30 +15827,7 @@ in {
     '';
   };
 
-  FormEncode = buildPythonPackage rec {
-    name = "FormEncode-${version}";
-    version = "1.3.0";
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/F/FormEncode/${name}.zip";
-      sha256 = "0y5gywq0l79l85ylr55p4xy0h921zgmfw6zmrvlh83aa4j074xg6";
-    };
-
-    buildInputs = with self; [
-      dns pycountry nose
-    ];
-
-    preCheck = ''
-      # two tests require dns resolving
-      sed -i 's/test_cyrillic_email/noop/' formencode/tests/test_email.py
-      sed -i 's/test_unicode_ascii_subgroup/noop/' formencode/tests/test_email.py
-    '';
-
-    meta = with stdenv.lib; {
-      description = "FormEncode validates and converts nested structures";
-      homepage = "http://formencode.org";
-    };
-  };
+  FormEncode = callPackage ../development/python-modules/FormEncode { };
 
   pycountry = buildPythonPackage rec {
     name = "pycountry-${version}";
@@ -16051,6 +16011,8 @@ in {
     };
   };
 
+  olefile = callPackage ../development/python-modules/olefile { };
+
   oslo-log = buildPythonPackage rec {
     name = "oslo.log-${version}";
     version = "1.12.1";
@@ -17040,61 +17002,9 @@ in {
 
   pystringtemplate = callPackage ../development/python-modules/stringtemplate { };
 
-  pillow = buildPythonPackage rec {
-    name = "Pillow-${version}";
-    version = "3.4.2";
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/P/Pillow/${name}.tar.gz";
-      sha256 = "0ee9975c05602e755ff5000232e0335ba30d507f6261922a658ee11b1cec36d1";
-    };
-
-    doCheck = !stdenv.isDarwin && !isPyPy;
-
-    # Disable imagefont tests, because they don't work well with infinality:
-    # https://github.com/python-pillow/Pillow/issues/1259
-    postPatch = ''
-      rm Tests/test_imagefont.py
-    '';
-
-    buildInputs = with self; [
-      pkgs.freetype pkgs.libjpeg pkgs.zlib pkgs.libtiff pkgs.libwebp pkgs.tcl nose pkgs.lcms2 ]
-      ++ optionals (isPyPy) [ pkgs.tk pkgs.xorg.libX11 ];
-
-    # NOTE: we use LCMS_ROOT as WEBP root since there is not other setting for webp.
-    preConfigure = let
-      libinclude' = pkg: ''"${pkg.out}/lib", "${pkg.out}/include"'';
-      libinclude = pkg: ''"${pkg.out}/lib", "${pkg.dev}/include"'';
-    in ''
-      sed -i "setup.py" \
-          -e 's|^FREETYPE_ROOT =.*$|FREETYPE_ROOT = ${libinclude pkgs.freetype}|g ;
-              s|^JPEG_ROOT =.*$|JPEG_ROOT = ${libinclude pkgs.libjpeg}|g ;
-              s|^ZLIB_ROOT =.*$|ZLIB_ROOT = ${libinclude pkgs.zlib}|g ;
-              s|^LCMS_ROOT =.*$|LCMS_ROOT = ${libinclude pkgs.lcms2}|g ;
-              s|^TIFF_ROOT =.*$|TIFF_ROOT = ${libinclude pkgs.libtiff}|g ;
-              s|^TCL_ROOT=.*$|TCL_ROOT = ${libinclude' pkgs.tcl}|g ;'
-      export LDFLAGS="-L${pkgs.libwebp}/lib"
-      export CFLAGS="-I${pkgs.libwebp}/include"
-    ''
-    # Remove impurities
-    + stdenv.lib.optionalString stdenv.isDarwin ''
-      substituteInPlace setup.py \
-        --replace '"/Library/Frameworks",' "" \
-        --replace '"/System/Library/Frameworks"' ""
-    '';
-
-    meta = {
-      homepage = "https://python-pillow.github.io/";
-      description = "Fork of The Python Imaging Library (PIL)";
-      longDescription = ''
-        The Python Imaging Library (PIL) adds image processing
-        capabilities to your Python interpreter.  This library
-        supports many file formats, and provides powerful image
-        processing and graphics capabilities.
-      '';
-      license = "http://www.pythonware.com/products/pil/license.htm";
-      maintainers = with maintainers; [ goibhniu prikhi ];
-    };
+  pillow = callPackage ../development/python-modules/pillow {
+    inherit (pkgs) freetype libjpeg zlib libtiff libwebp tcl lcms2 tk;
+    inherit (pkgs.xorg) libX11;
   };
 
   pkgconfig = buildPythonPackage rec {
@@ -18769,23 +18679,7 @@ in {
     };
   };
 
-  pyparsing = buildPythonPackage rec {
-    name = "pyparsing-${version}";
-    version = "2.1.10";
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/p/pyparsing/${name}.tar.gz";
-      sha256 = "811c3e7b0031021137fc83e051795025fcb98674d07eb8fe922ba4de53d39188";
-    };
-
-    # Not everything necessary to run the tests is included in the distribution
-    doCheck = false;
-
-    meta = {
-      homepage = http://pyparsing.wikispaces.com/;
-      description = "An alternative approach to creating and executing simple grammars, vs. the traditional lex/yacc approach, or the use of regular expressions";
-    };
-  };
+  pyparsing = callPackage ../development/python-modules/pyparsing { };
 
   pyparted = buildPythonPackage rec {
     name = "pyparted-${version}";
@@ -21651,14 +21545,23 @@ in {
   };
 
   sqlobject = buildPythonPackage rec {
-    version = "3.0.0";
-    name = "sqlobject-${version}";
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/S/SQLObject/SQLObject-${version}.tar.gz";
-      sha256 = "15g3g7f4yiyplqf54px1dsnmrw3jb7xwx97z8qzgp9ijmm5vpr8r";
+    pname = "SQLObject";
+    version = "3.3.0";
+    name = "${pname}-${version}";
+
+    src = fetchPypi {
+      inherit pname version;
+      sha256 = "0p2dxrxh7xrv5yys09v5z95d0z40w22aq3xc01ghdidd7hr79xy9";
     };
 
-    propagatedBuildInputs = with self; [ pydispatcher FormEncode ];
+    checkInputs = with self; [ pytest ];
+
+    propagatedBuildInputs = with self; [
+      FormEncode
+      PasteDeploy
+      paste
+      pydispatcher
+    ];
 
     meta = {
       description = "Object Relational Manager for providing an object interface to your database";
@@ -23968,6 +23871,8 @@ in {
 
   u-msgpack-python = callPackage ../development/python-modules/u-msgpack-python { };
 
+  ukpostcodeparser = callPackage ../development/python-modules/ukpostcodeparser { };
+
   umalqurra = buildPythonPackage rec {
     name = "umalqurra-${version}";
     version = "0.2";
@@ -24041,7 +23946,7 @@ in {
 
     postPatch = ''
       # argparse is needed for python < 2.7, which we do not support anymore.
-      substituteInPlace setup.py --replace "argparse"
+      substituteInPlace setup.py --replace "argparse" ""
 
       # # fixes a transient error when collecting tests, see https://bugs.launchpad.net/python-neutronclient/+bug/1508547
       sed -i '510i\        return None, False' unittest2/loader.py
@@ -24854,23 +24759,7 @@ EOF
   zconfig = callPackage ../development/python-modules/zconfig { };
 
 
-  zc_lockfile = buildPythonPackage rec {
-    name = "zc.lockfile-${version}";
-    version = "1.0.2";
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/z/zc.lockfile/${name}.tar.gz";
-      sha256 = "96bb2aa0438f3e29a31e4702316f832ec1482837daef729a92e28c202d8fba5c";
-    };
-
-    meta = {
-      description = "Inter-process locks";
-      homepage =  http://www.python.org/pypi/zc.lockfile;
-      license = licenses.zpt20;
-      maintainers = with maintainers; [ goibhniu ];
-    };
-  };
-
+  zc_lockfile = callPackage ../development/python-modules/zc_lockfile { };
 
   zdaemon = buildPythonPackage rec {
     name = "zdaemon-${version}";
@@ -24972,40 +24861,11 @@ EOF
     };
   };
 
-  zodbpickle = self.buildPythonPackage rec {
-    name = "zodbpickle-0.5.2";
-    disabled = isPyPy; # https://github.com/zopefoundation/zodbpickle/issues/10
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/z/zodbpickle/${name}.tar.gz";
-      sha256 = "f65c00fbc13523fced63de6cc11747aa1a6343aeb2895c89838ed55a5ab12cca";
-    };
-
-    # fails..
-    doCheck = false;
-
-    meta = {
-      homepage = http://pypi.python.org/pypi/zodbpickle;
-    };
-  };
+  zodbpickle = callPackage ../development/python-modules/zodbpickle {};
 
   BTrees = callPackage ../development/python-modules/btrees {};
 
-  persistent = self.buildPythonPackage rec {
-    name = "persistent-4.0.8";
-
-    propagatedBuildInputs = with self; [ zope_interface ];
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/p/persistent/${name}.tar.gz";
-      sha256 = "678902217c5370d33694c6dc95b89e1e6284b4dc41f04c056326194a3f6f3e22";
-    };
-
-    meta = {
-      description = "Automatic persistence for Python objects";
-      homepage = http://www.zope.org/Products/ZODB;
-    };
-  };
+  persistent = callPackage ../development/python-modules/persistent {};
 
   xdot = buildPythonPackage rec {
     name = "xdot-0.7";
@@ -25536,23 +25396,7 @@ EOF
     };
   };
 
-  tornado = buildPythonPackage rec {
-    name = "tornado-${version}";
-    version = "4.4.2";
-
-    propagatedBuildInputs = with self; [ backports_abc backports_ssl_match_hostname certifi singledispatch ];
-
-    # We specify the name of the test files to prevent
-    # https://github.com/NixOS/nixpkgs/issues/14634
-    checkPhase = ''
-      ${python.interpreter} -m unittest discover *_test.py
-    '';
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/t/tornado/${name}.tar.gz";
-      sha256 = "1k7d90afm5pivam90a37nqiz9wlmakvnsfymp3p43kcqz29gk618";
-    };
-  };
+  tornado = callPackage ../development/python-modules/tornado { };
 
   tokenlib = buildPythonPackage rec {
     name = "tokenlib-${version}";