about summary refs log tree commit diff
path: root/pkgs
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs')
-rw-r--r--pkgs/applications/altcoins/cryptop/default.nix13
-rw-r--r--pkgs/applications/altcoins/default.nix4
-rw-r--r--pkgs/applications/graphics/ImageMagick/7.0.nix4
-rw-r--r--pkgs/applications/graphics/ImageMagick/default.nix4
-rw-r--r--pkgs/applications/graphics/graphicsmagick/default.nix4
-rw-r--r--pkgs/applications/graphics/rawtherapee/ReleaseInfo.cmake4
-rw-r--r--pkgs/applications/graphics/rawtherapee/default.nix4
-rw-r--r--pkgs/applications/graphics/rawtherapee/dev.nix37
-rw-r--r--pkgs/applications/graphics/rawtherapee/fix-glibmm-output.patch23
-rw-r--r--pkgs/applications/misc/calibre/default.nix2
-rw-r--r--pkgs/applications/misc/electron-cash/default.nix2
-rw-r--r--pkgs/applications/misc/electrum-dash/default.nix2
-rw-r--r--pkgs/applications/misc/electrum-ltc/default.nix2
-rw-r--r--pkgs/applications/misc/electrum/default.nix2
-rw-r--r--pkgs/applications/misc/xmr-stak/default.nix38
-rw-r--r--pkgs/applications/networking/browsers/firefox/common.nix3
-rw-r--r--pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/kontemplate/default.nix26
-rw-r--r--pkgs/applications/networking/cluster/kontemplate/deps.nix120
-rw-r--r--pkgs/applications/networking/cluster/kops/default.nix4
-rw-r--r--pkgs/applications/networking/errbot/default.nix2
-rw-r--r--pkgs/applications/networking/gmailieer/default.nix4
-rw-r--r--pkgs/applications/networking/mailreaders/notmuch/default.nix13
-rw-r--r--pkgs/applications/virtualization/docker/default.nix6
-rw-r--r--pkgs/applications/window-managers/awesome/3.5.nix4
-rwxr-xr-xpkgs/build-support/build-fhs-userenv/chroot-user.rb169
-rw-r--r--pkgs/build-support/build-fhs-userenv/chrootenv.c182
-rw-r--r--pkgs/build-support/build-fhs-userenv/default.nix23
-rw-r--r--pkgs/data/documentation/zeal/default.nix6
-rw-r--r--pkgs/data/documentation/zeal/remove_ads.patch11
-rw-r--r--pkgs/desktops/gnome-3/core/totem/default.nix1
-rw-r--r--pkgs/development/compilers/hhvm/default.nix12
-rw-r--r--pkgs/development/compilers/ocaml/ber-metaocaml-104.nix (renamed from pkgs/development/compilers/ocaml/ber-metaocaml-003.nix)54
-rw-r--r--pkgs/development/haskell-modules/configuration-common.nix15
-rw-r--r--pkgs/development/interpreters/python/cpython/2.7/default.nix2
-rw-r--r--pkgs/development/interpreters/python/wrapper.nix3
-rw-r--r--pkgs/development/libraries/gmime/3.nix4
-rw-r--r--pkgs/development/libraries/leveldb/default.nix13
-rw-r--r--pkgs/development/libraries/libcerf/default.nix18
-rw-r--r--pkgs/development/libraries/libvirt/default.nix6
-rw-r--r--pkgs/development/libraries/qt-4.x/4.8/default.nix63
-rw-r--r--pkgs/development/libraries/qt-4.x/4.8/qt-4.8.7-unixmake-darwin.patch11
-rw-r--r--pkgs/development/ocaml-modules/markup/default.nix10
-rw-r--r--pkgs/development/ocaml-modules/ulex/default.nix24
-rw-r--r--pkgs/development/python-modules/FormEncode/default.nix4
-rw-r--r--pkgs/development/python-modules/dkimpy/default.nix4
-rw-r--r--pkgs/development/python-modules/dnspython/default.nix (renamed from pkgs/development/python-modules/dns/default.nix)0
-rw-r--r--pkgs/development/python-modules/email-validator/default.nix4
-rw-r--r--pkgs/development/python-modules/gurobipy/darwin.nix34
-rw-r--r--pkgs/development/python-modules/gurobipy/linux.nix33
-rw-r--r--pkgs/development/python-modules/libvirt/default.nix26
-rw-r--r--pkgs/development/python-modules/salmon/default.nix4
-rw-r--r--pkgs/development/tools/build-managers/gradle/default.nix4
-rw-r--r--pkgs/development/tools/build-managers/sbt-extras/default.nix7
-rw-r--r--pkgs/games/simutrans/default.nix25
-rw-r--r--pkgs/os-specific/darwin/insert_dylib/default.nix1
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.14.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.4.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.9.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-hardened-copperhead.nix4
-rw-r--r--pkgs/os-specific/linux/uclibc/default.nix2
-rw-r--r--pkgs/servers/http/lighttpd/default.nix4
-rw-r--r--pkgs/servers/mail/mailman/default.nix2
-rw-r--r--pkgs/shells/nix-bash-completions/default.nix18
-rw-r--r--pkgs/stdenv/generic/check-meta.nix2
-rw-r--r--pkgs/tools/admin/ansible/2.1.nix2
-rw-r--r--pkgs/tools/admin/ansible/2.2.nix2
-rw-r--r--pkgs/tools/admin/ansible/2.3.nix2
-rw-r--r--pkgs/tools/admin/ansible/2.4.nix2
-rw-r--r--pkgs/tools/admin/cli53/default.nix2
-rw-r--r--pkgs/tools/backup/borg/default.nix4
-rw-r--r--pkgs/tools/graphics/gnuplot/default.nix34
-rw-r--r--pkgs/tools/networking/network-manager/l2tp.nix15
-rw-r--r--pkgs/tools/security/hash-slinger/default.nix2
-rw-r--r--pkgs/tools/typesetting/tex/tetex/default.nix2
-rw-r--r--pkgs/tools/typesetting/tex/tetex/extramembot.patch12
-rw-r--r--pkgs/top-level/all-packages.nix19
-rw-r--r--pkgs/top-level/ocaml-packages.nix2
-rw-r--r--pkgs/top-level/python-packages.nix42
-rw-r--r--pkgs/top-level/splice.nix16
80 files changed, 800 insertions, 508 deletions
diff --git a/pkgs/applications/altcoins/cryptop/default.nix b/pkgs/applications/altcoins/cryptop/default.nix
index 0136ab18ceac..01c47b320de5 100644
--- a/pkgs/applications/altcoins/cryptop/default.nix
+++ b/pkgs/applications/altcoins/cryptop/default.nix
@@ -1,16 +1,15 @@
-{ lib, python2}:
+{ lib, buildPythonApplication, fetchPypi, requests, requests-cache }:
 
-python2.pkgs.buildPythonApplication rec {
+buildPythonApplication rec {
   pname = "cryptop";
-  version = "0.1.0";
-  name = "${pname}-${version}";
+  version = "0.2.0";
 
-  src = python2.pkgs.fetchPypi {
+  src = fetchPypi {
     inherit pname version;
-    sha256 = "00glnlyig1aajh30knc5rnfbamwfxpg29js2db6mymjmfka8lbhh";
+    sha256 = "0akrrz735vjfrm78plwyg84vabj0x3qficq9xxmy9kr40fhdkzpb";
   };
 
-  propagatedBuildInputs = [ python2.pkgs.requests ];
+  propagatedBuildInputs = [ requests requests-cache ];
 
   # No tests in archive
   doCheck = false;
diff --git a/pkgs/applications/altcoins/default.nix b/pkgs/applications/altcoins/default.nix
index aeab29534691..0e5ffab01f44 100644
--- a/pkgs/applications/altcoins/default.nix
+++ b/pkgs/applications/altcoins/default.nix
@@ -1,4 +1,4 @@
-{ callPackage, boost155, boost162, openssl_1_1_0, haskellPackages, darwin, libsForQt5, miniupnpc_2 }:
+{ callPackage, boost155, boost162, openssl_1_1_0, haskellPackages, darwin, libsForQt5, miniupnpc_2, python3 }:
 
 rec {
 
@@ -20,6 +20,8 @@ rec {
   btc1 = callPackage ./btc1.nix { withGui = true; };
   btc1d = callPackage ./btc1.nix { withGui = false; };
 
+  cryptop = python3.pkgs.callPackage ./cryptop { };
+
   dashpay = callPackage ./dashpay.nix { };
 
   dogecoin  = callPackage ./dogecoin.nix { withGui = true; };
diff --git a/pkgs/applications/graphics/ImageMagick/7.0.nix b/pkgs/applications/graphics/ImageMagick/7.0.nix
index 973e7f88e800..98e2c0e3f7d4 100644
--- a/pkgs/applications/graphics/ImageMagick/7.0.nix
+++ b/pkgs/applications/graphics/ImageMagick/7.0.nix
@@ -14,8 +14,8 @@ let
     else throw "ImageMagick is not supported on this platform.";
 
   cfg = {
-    version = "7.0.7-9";
-    sha256 = "0p0879chcfrghcamwgxxcmaaj04xv0z91ris7hxi37qdw8c7836w";
+    version = "7.0.7-14";
+    sha256 = "04hpc9i6fp09iy0xkidlfhfqr7zg45izqqj5fx93n3dxalq65xqw";
     patches = [];
   };
 in
diff --git a/pkgs/applications/graphics/ImageMagick/default.nix b/pkgs/applications/graphics/ImageMagick/default.nix
index 4e0ddfa8def8..e3500a621cbb 100644
--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@@ -14,8 +14,8 @@ let
     else throw "ImageMagick is not supported on this platform.";
 
   cfg = {
-    version = "6.9.9-23";
-    sha256 = "0cd6zcbcfvznf0i3q4xz1c4wm4cfplg4zc466lvlb1w8qbn25948";
+    version = "6.9.9-26";
+    sha256 = "10rcq7b9hhz50m4yqnm4g3iai7lr9jkglb7sm49ycw59arrkmwnw";
     patches = [];
   }
     # Freeze version on mingw so we don't need to port the patch too often.
diff --git a/pkgs/applications/graphics/graphicsmagick/default.nix b/pkgs/applications/graphics/graphicsmagick/default.nix
index c8c9ac8f26ef..11a2b3a8c8b9 100644
--- a/pkgs/applications/graphics/graphicsmagick/default.nix
+++ b/pkgs/applications/graphics/graphicsmagick/default.nix
@@ -2,14 +2,14 @@
 , libjpeg, libpng, libtiff, libxml2, zlib, libtool, xz, libX11
 , libwebp, quantumdepth ? 8, fixDarwinDylibNames }:
 
-let version = "1.3.26"; in
+let version = "1.3.27"; in
 
 stdenv.mkDerivation {
   name = "graphicsmagick-${version}";
 
   src = fetchurl {
     url = "mirror://sourceforge/graphicsmagick/GraphicsMagick-${version}.tar.xz";
-    sha256 = "122zgs96dqrys62mnh8x5yvfff6km4d3yrnvaxzg3mg5sprib87v";
+    sha256 = "0rq35p3rml10cxz2z4s7xcfsilhhk19mmy094g3ivz0fg797hcnh";
   };
 
   patches = [
diff --git a/pkgs/applications/graphics/rawtherapee/ReleaseInfo.cmake b/pkgs/applications/graphics/rawtherapee/ReleaseInfo.cmake
deleted file mode 100644
index 7be7cb63f701..000000000000
--- a/pkgs/applications/graphics/rawtherapee/ReleaseInfo.cmake
+++ /dev/null
@@ -1,4 +0,0 @@
-set(GIT_BRANCH master)
-set(GIT_VERSION 4.2.1115)
-set(GIT_CHANGESET 0821eea7b6a4ac2fce1fcf644e06078e161e41e3)
-set(GIT_TAGDISTANCE 1115)
diff --git a/pkgs/applications/graphics/rawtherapee/default.nix b/pkgs/applications/graphics/rawtherapee/default.nix
index 91a34a505f2f..5743f0c1bcb6 100644
--- a/pkgs/applications/graphics/rawtherapee/default.nix
+++ b/pkgs/applications/graphics/rawtherapee/default.nix
@@ -14,10 +14,10 @@ stdenv.mkDerivation rec {
     sha256 = "1r6sx9zl1wkykgfx6k26268xadair6hzl15v5hmiri9sdhrn33q7";
   };
 
-  nativeBuildInputs = [ pkgconfig wrapGAppsHook ];
+  nativeBuildInputs = [ cmake pkgconfig wrapGAppsHook ];
 
   buildInputs = [
-    cmake pixman libpthreadstubs gtkmm3 libXau libXdmcp
+    pixman libpthreadstubs gtkmm3 libXau libXdmcp
     lcms2 libiptcdata libcanberra_gtk3 fftw expat pcre libsigcxx lensfun
   ];
 
diff --git a/pkgs/applications/graphics/rawtherapee/dev.nix b/pkgs/applications/graphics/rawtherapee/dev.nix
deleted file mode 100644
index fb73feb4a099..000000000000
--- a/pkgs/applications/graphics/rawtherapee/dev.nix
+++ /dev/null
@@ -1,37 +0,0 @@
-{ stdenv, fetchFromGitHub, pkgconfig, cmake, pixman, libpthreadstubs, gtkmm2, libXau
-, libXdmcp, lcms2, libiptcdata, libcanberra_gtk2, fftw, expat, pcre, libsigcxx
-}:
-
-stdenv.mkDerivation rec {
-  name = "rawtherapee-git-2016-10-10";
-
-  src = fetchFromGitHub {
-    owner = "Beep6581";
-    repo = "RawTherapee";
-    rev = "0821eea7b6a4ac2fce1fcf644e06078e161e41e3";
-    sha256 = "1nwb6b1qrpdyigwig7bvr42lf7na1ngm0q2cislcvb2v1nmk6nlz";
-  };
-
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ cmake pixman libpthreadstubs gtkmm2 libXau libXdmcp
-    lcms2 libiptcdata libcanberra_gtk2 fftw expat pcre libsigcxx ];
-
-  NIX_CFLAGS_COMPILE = "-std=gnu++11 -Wno-deprecated-declarations -Wno-unused-result";
-
-  # Copy generated ReleaseInfo.cmake so we don't need git. File was
-  # generated manually using `./tools/generateReleaseInfo` in the
-  # source folder. Make sure to regenerate it when updating.
-  preConfigure = ''
-    cp ${./ReleaseInfo.cmake} ./ReleaseInfo.cmake
-  '';
-
-  enableParallelBuilding = true;
-
-  meta = {
-    description = "RAW converter and digital photo processing software";
-    homepage = http://www.rawtherapee.com/;
-    license = stdenv.lib.licenses.gpl3Plus;
-    maintainers = with stdenv.lib.maintainers; [ viric jcumming mahe the-kenny ];
-    platforms = with stdenv.lib.platforms; linux;
-  };
-}
diff --git a/pkgs/applications/graphics/rawtherapee/fix-glibmm-output.patch b/pkgs/applications/graphics/rawtherapee/fix-glibmm-output.patch
deleted file mode 100644
index 3c87ce64e26b..000000000000
--- a/pkgs/applications/graphics/rawtherapee/fix-glibmm-output.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-From ca0afa8d5f3cc7d09b6bab32d155a87c550f0d7b Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Fl=C3=B6ssie?= <floessie.mail@gmail.com>
-Date: Sat, 1 Oct 2016 12:38:24 +0200
-Subject: [PATCH] Fix incompatibility with glibmm 2.50 (#3440)
-
-Kudos to @Hombre57 for the suggestion.
----
- rtgui/dirbrowser.cc | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/rtgui/dirbrowser.cc b/rtgui/dirbrowser.cc
-index d3fc8bf..6f25f0f 100644
---- a/rtgui/dirbrowser.cc
-+++ b/rtgui/dirbrowser.cc
-@@ -59,7 +59,7 @@ std::vector<Glib::ustring> listSubDirs (const Glib::RefPtr<Gio::File>& dir, bool
-     } catch (const Glib::Exception& exception) {
- 
-         if (options.rtSettings.verbose) {
--            std::cerr << "Failed to list subdirectories of \"" << dir << "\": " << exception.what () << std::endl;
-+            std::cerr << "Failed to list subdirectories of \"" << dir->get_basename() << "\": " << exception.what () << std::endl;
-         }
- 
-     }
diff --git a/pkgs/applications/misc/calibre/default.nix b/pkgs/applications/misc/calibre/default.nix
index e548b944a8d4..b406f38613d5 100644
--- a/pkgs/applications/misc/calibre/default.nix
+++ b/pkgs/applications/misc/calibre/default.nix
@@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
     poppler_utils libpng imagemagick libjpeg
     fontconfig podofo qtbase chmlib icu sqlite libusb1 libmtp xdg_utils wrapGAppsHook
   ] ++ (with python2Packages; [
-    apsw cssselect cssutils dateutil dns html5-parser lxml mechanize netifaces pillow
+    apsw cssselect cssutils dateutil dnspython html5-parser lxml mechanize netifaces pillow
     python pyqt5 sip
     regex msgpack
     # the following are distributed with calibre, but we use upstream instead
diff --git a/pkgs/applications/misc/electron-cash/default.nix b/pkgs/applications/misc/electron-cash/default.nix
index 56c1a8168a82..5b4cb82277a7 100644
--- a/pkgs/applications/misc/electron-cash/default.nix
+++ b/pkgs/applications/misc/electron-cash/default.nix
@@ -12,7 +12,7 @@ python2Packages.buildPythonApplication rec {
   };
 
   propagatedBuildInputs = with python2Packages; [
-    dns
+    dnspython
     ecdsa
     jsonrpclib
     pbkdf2
diff --git a/pkgs/applications/misc/electrum-dash/default.nix b/pkgs/applications/misc/electrum-dash/default.nix
index e7a5a1be1979..bde8d5b81e3e 100644
--- a/pkgs/applications/misc/electrum-dash/default.nix
+++ b/pkgs/applications/misc/electrum-dash/default.nix
@@ -10,7 +10,7 @@ python2Packages.buildPythonApplication rec {
   };
 
   propagatedBuildInputs = with python2Packages; [
-    dns
+    dnspython
     ecdsa
     pbkdf2
     protobuf
diff --git a/pkgs/applications/misc/electrum-ltc/default.nix b/pkgs/applications/misc/electrum-ltc/default.nix
index bb41f8665e57..58844500195e 100644
--- a/pkgs/applications/misc/electrum-ltc/default.nix
+++ b/pkgs/applications/misc/electrum-ltc/default.nix
@@ -21,7 +21,7 @@ python2Packages.buildPythonApplication rec {
     qrcode
     ltc_scrypt
     protobuf
-    dns
+    dnspython
     jsonrpclib
   ];
 
diff --git a/pkgs/applications/misc/electrum/default.nix b/pkgs/applications/misc/electrum/default.nix
index abe8d0dde84b..8de837991aab 100644
--- a/pkgs/applications/misc/electrum/default.nix
+++ b/pkgs/applications/misc/electrum/default.nix
@@ -10,7 +10,7 @@ python2Packages.buildPythonApplication rec {
   };
 
   propagatedBuildInputs = with python2Packages; [
-    dns
+    dnspython
     ecdsa
     jsonrpclib
     matplotlib
diff --git a/pkgs/applications/misc/xmr-stak/default.nix b/pkgs/applications/misc/xmr-stak/default.nix
new file mode 100644
index 000000000000..e5a419f6a8c1
--- /dev/null
+++ b/pkgs/applications/misc/xmr-stak/default.nix
@@ -0,0 +1,38 @@
+{ stdenv, lib, fetchFromGitHub, cmake, libuv, libmicrohttpd, openssl
+, opencl-headers, ocl-icd, hwloc, cudatoolkit
+, devDonationLevel ? "0.0"
+, cudaSupport ? false  # doesn't work currently
+}:
+
+stdenv.mkDerivation rec {
+  name = "xmr-stak-${version}";
+  version = "2.0.0";
+
+  src = fetchFromGitHub {
+    owner = "fireice-uk";
+    repo = "xmr-stak";
+    rev = "v${version}";
+    sha256 = "1gsp5d2qmc8qwbfm87c2vnak6ks6y9csfjbsi0570pdciapaf8vs";
+  };
+
+  NIX_CFLAGS_COMPILE = "-O3";
+
+  cmakeFlags = lib.optional (!cudaSupport) "-DCUDA_ENABLE=OFF";
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs =
+    [ libmicrohttpd openssl opencl-headers ocl-icd hwloc ]
+    ++ lib.optional cudaSupport cudatoolkit;
+
+  postPatch = ''
+    substituteInPlace xmrstak/donate-level.hpp \
+      --replace 'fDevDonationLevel = 2.0' 'fDevDonationLevel = ${devDonationLevel}'
+  '';
+
+  meta = with lib; {
+    description = "Unified All-in-one Monero miner";
+    homepage = "https://github.com/fireice-uk/xmr-stak";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ fpletz ];
+  };
+}
diff --git a/pkgs/applications/networking/browsers/firefox/common.nix b/pkgs/applications/networking/browsers/firefox/common.nix
index e0f2844bd532..aeae471ce5bb 100644
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@@ -135,6 +135,9 @@ stdenv.mkDerivation (rec {
     "--with-libclang-path=${llvmPackages.clang-unwrapped}/lib"
     "--with-clang-path=${llvmPackages.clang}/bin/clang"
   ]
+  ++ lib.optionals (stdenv.lib.versionAtLeast version "57") [
+    "--enable-webrender=build"
+  ]
 
   # TorBrowser patches these
   ++ lib.optionals (!isTorBrowserLike) [
diff --git a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
index 1b6bf2ac3002..8f22045578d7 100644
--- a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
+++ b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
@@ -98,7 +98,7 @@ let
   fteLibPath = makeLibraryPath [ stdenv.cc.cc gmp ];
 
   # Upstream source
-  version = "7.0.10";
+  version = "7.0.11";
 
   lang = "en-US";
 
@@ -108,7 +108,7 @@ let
         "https://github.com/TheTorProject/gettorbrowser/releases/download/v${version}/tor-browser-linux64-${version}_${lang}.tar.xz"
         "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz"
       ];
-      sha256 = "0d1yvb1gmswlzyivr53xxfbd58bvr7nyangd85j36kar4bzbzvhh";
+      sha256 = "0i42jxdka0sq8fp6lj64n0az6m4g72il9qhdn63p0h7y4204i2v4";
     };
 
     "i686-linux" = fetchurl {
@@ -116,7 +116,7 @@ let
         "https://github.com/TheTorProject/gettorbrowser/releases/download/v${version}/tor-browser-linux32-${version}_${lang}.tar.xz"
         "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux32-${version}_${lang}.tar.xz"
       ];
-      sha256 = "0mjw8z76pbm1hshz875shkmjmxqhpan5la52r3y20v6rc0gfd9p5";
+      sha256 = "1p9s6wqghpkml662vnp5194i8gb9bkqxdr96fmw0fh305cyk25k0";
     };
   };
 in
diff --git a/pkgs/applications/networking/cluster/kontemplate/default.nix b/pkgs/applications/networking/cluster/kontemplate/default.nix
new file mode 100644
index 000000000000..aa5f86633318
--- /dev/null
+++ b/pkgs/applications/networking/cluster/kontemplate/default.nix
@@ -0,0 +1,26 @@
+{ stdenv, buildGoPackage, fetchFromGitHub }:
+
+buildGoPackage rec {
+  name = "kontemplate-${version}";
+  version = "1.3.0";
+
+  goPackagePath = "github.com/tazjin/kontemplate";
+
+  src = fetchFromGitHub {
+    rev = "v${version}";
+    owner = "tazjin";
+    repo = "kontemplate";
+    sha256 = "0g9hs9gwwkng9vbnv07ibhll0kggdprffpmhlbz9nmv81w2z3myi";
+  };
+
+  goDeps = ./deps.nix;
+
+  meta = with stdenv.lib; {
+    description = "Extremely simple Kubernetes resource templates";
+    homepage = http://kontemplate.works;
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ mbode ];
+    platforms = platforms.unix;
+    repositories.git = git://github.com/tazjin/kontemplate.git;
+  };
+}
diff --git a/pkgs/applications/networking/cluster/kontemplate/deps.nix b/pkgs/applications/networking/cluster/kontemplate/deps.nix
new file mode 100644
index 000000000000..1d6dfb3e64f5
--- /dev/null
+++ b/pkgs/applications/networking/cluster/kontemplate/deps.nix
@@ -0,0 +1,120 @@
+# This file was generated by https://github.com/kamilchm/go2nix v1.2.1
+[
+  {
+    goPackagePath = "github.com/Masterminds/semver";
+    fetch = {
+      type = "git";
+      url = "https://github.com/Masterminds/semver";
+      rev = "15d8430ab86497c5c0da827b748823945e1cf1e1";
+      sha256 = "0q5w6mjr1zws04z7x1ax1hp1zxdc4mbm9zsikgd6fv0c9ndnjr3q";
+    };
+  }
+  {
+    goPackagePath = "github.com/Masterminds/sprig";
+    fetch = {
+      type = "git";
+      url = "https://github.com/Masterminds/sprig";
+      rev = "b217b9c388de2cacde4354c536e520c52c055563";
+      sha256 = "1f41v3c8c7zagc4qjhcb6nwkvi8nzvf70f89a7ss2m6krkxz0m2a";
+    };
+  }
+  {
+    goPackagePath = "github.com/alecthomas/template";
+    fetch = {
+      type = "git";
+      url = "https://github.com/alecthomas/template";
+      rev = "a0175ee3bccc567396460bf5acd36800cb10c49c";
+      sha256 = "0qjgvvh26vk1cyfq9fadyhfgdj36f1iapbmr5xp6zqipldz8ffxj";
+    };
+  }
+  {
+    goPackagePath = "github.com/alecthomas/units";
+    fetch = {
+      type = "git";
+      url = "https://github.com/alecthomas/units";
+      rev = "2efee857e7cfd4f3d0138cc3cbb1b4966962b93a";
+      sha256 = "1j65b91qb9sbrml9cpabfrcf07wmgzzghrl7809hjjhrmbzri5bl";
+    };
+  }
+  {
+    goPackagePath = "github.com/aokoli/goutils";
+    fetch = {
+      type = "git";
+      url = "https://github.com/aokoli/goutils";
+      rev = "3391d3790d23d03408670993e957e8f408993c34";
+      sha256 = "1yj4yjfwylica31sgj69ygb04p9xxi22kgfxd0j5f58zr8vwww2n";
+    };
+  }
+  {
+    goPackagePath = "github.com/ghodss/yaml";
+    fetch = {
+      type = "git";
+      url = "https://github.com/ghodss/yaml";
+      rev = "0ca9ea5df5451ffdf184b4428c902747c2c11cd7";
+      sha256 = "0skwmimpy7hlh7pva2slpcplnm912rp3igs98xnqmn859kwa5v8g";
+    };
+  }
+  {
+    goPackagePath = "github.com/huandu/xstrings";
+    fetch = {
+      type = "git";
+      url = "https://github.com/huandu/xstrings";
+      rev = "37469d0c81a7910b49d64a0d308ded4823e90937";
+      sha256 = "18c2b4h7phdm71mn66x8bsmghjr1b2lpg07zcbgmab37y36bjl20";
+    };
+  }
+  {
+    goPackagePath = "github.com/imdario/mergo";
+    fetch = {
+      type = "git";
+      url = "https://github.com/imdario/mergo";
+      rev = "7fe0c75c13abdee74b09fcacef5ea1c6bba6a874";
+      sha256 = "1hclh5kpg25s2llpk7j7sm3vf66xci5jchn8wzdcr5fj372ghsbd";
+    };
+  }
+  {
+    goPackagePath = "github.com/polydawn/meep";
+    fetch = {
+      type = "git";
+      url = "https://github.com/polydawn/meep";
+      rev = "eaf1db2168fe380b4da17a35f0adddb5ae15a651";
+      sha256 = "12n134fb2imnj67xkbznzm0gqkg36hdxwr960y91qb5s2q2krxir";
+    };
+  }
+  {
+    goPackagePath = "github.com/satori/go.uuid";
+    fetch = {
+      type = "git";
+      url = "https://github.com/satori/go.uuid";
+      rev = "5bf94b69c6b68ee1b541973bb8e1144db23a194b";
+      sha256 = "0l782l4srv36pj8pfgn61996d0vjifld4a569rbjwq5h14pd0c07";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/crypto";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/crypto";
+      rev = "94eea52f7b742c7cbe0b03b22f0c4c8631ece122";
+      sha256 = "095zyvjb0m2pz382500miqadhk7w3nis8z3j941z8cq4rdafijvi";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/alecthomas/kingpin.v2";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/alecthomas/kingpin.v2";
+      rev = "1087e65c9441605df944fb12c33f0fe7072d18ca";
+      sha256 = "18llqzkdqf62qbqcv2fd3j0igl6cwwn4dissf5skkvxrcxjcmmj0";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/yaml.v2";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/yaml.v2";
+      rev = "287cf08546ab5e7e37d55a84f7ed3fd1db036de5";
+      sha256 = "15502klds9wwv567vclb9kx95gs8lnyzn4ybsk6l9fc7a67lk831";
+    };
+  }
+]
diff --git a/pkgs/applications/networking/cluster/kops/default.nix b/pkgs/applications/networking/cluster/kops/default.nix
index ff7cb245ae2a..41099192176c 100644
--- a/pkgs/applications/networking/cluster/kops/default.nix
+++ b/pkgs/applications/networking/cluster/kops/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   name = "kops-${version}";
-  version = "1.7.1";
+  version = "1.8.0";
 
   goPackagePath = "k8s.io/kops";
 
@@ -10,7 +10,7 @@ buildGoPackage rec {
     rev = version;
     owner = "kubernetes";
     repo = "kops";
-    sha256 = "0wii6w6hs9hjz3vvgqwa5ilwdi8a3qknmqsg3izazmgmnhl712wd";
+    sha256 = "0vaa18vhwk132fv7i896513isp66wnz9gn0b5613n3x28q0gvkmg";
   };
 
   buildInputs = [go-bindata];
diff --git a/pkgs/applications/networking/errbot/default.nix b/pkgs/applications/networking/errbot/default.nix
index 7d815c8fad08..611d7904991a 100644
--- a/pkgs/applications/networking/errbot/default.nix
+++ b/pkgs/applications/networking/errbot/default.nix
@@ -24,7 +24,7 @@ pythonPackages.buildPythonApplication rec {
   buildInputs = [ glibcLocales ];
   propagatedBuildInputs = with pythonPackages; [
     webtest bottle threadpool rocket-errbot requests jinja2
-    pyopenssl colorlog Yapsy markdown ansi pygments dns pep8
+    pyopenssl colorlog Yapsy markdown ansi pygments dnspython pep8
     daemonize pygments-markdown-lexer telegram irc slackclient
     sleekxmpp hypchat pytest
   ];
diff --git a/pkgs/applications/networking/gmailieer/default.nix b/pkgs/applications/networking/gmailieer/default.nix
index 26a05151d1cf..e56dbe0817e7 100644
--- a/pkgs/applications/networking/gmailieer/default.nix
+++ b/pkgs/applications/networking/gmailieer/default.nix
@@ -2,13 +2,13 @@
 
 python3Packages.buildPythonApplication rec {
   name = "gmailieer";
-  version = "0.4";
+  version = "0.5";
 
   src = fetchFromGitHub {
     owner = "gauteh";
     repo = "gmailieer";
     rev = "v${version}";
-    sha256 = "0vpc8nrh3cx91pcw45jjr2jllkqbx6w2khq7nyqv59gc4q5mz0p2";
+    sha256 = "152ky06k1wc3jffb48c6zh7c7pr732m9f4g1i316zaa4nx2ynfsa";
   };
 
   propagatedBuildInputs = with python3Packages; [
diff --git a/pkgs/applications/networking/mailreaders/notmuch/default.nix b/pkgs/applications/networking/mailreaders/notmuch/default.nix
index 6d268f69a7ce..079e1b7927ca 100644
--- a/pkgs/applications/networking/mailreaders/notmuch/default.nix
+++ b/pkgs/applications/networking/mailreaders/notmuch/default.nix
@@ -12,7 +12,7 @@
 with stdenv.lib;
 
 stdenv.mkDerivation rec {
-  version = "0.25.2";
+  version = "0.25.3";
   name = "notmuch-${version}";
 
   passthru = {
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "http://notmuchmail.org/releases/${name}.tar.gz";
-    sha256 = "0ai6vbs9wzwfz7jcphgqsqpcbq137l34xhmcli4h5c8n82fvmdp4";
+    sha256 = "1fyx20rjpwbf2j1v5fpa5s0rjnwhcgvijzh2qyinp8rlbh1qxmab";
   };
 
   nativeBuildInputs = [ pkgconfig ];
@@ -40,14 +40,9 @@ stdenv.mkDerivation rec {
   ++ optionals (!stdenv.isDarwin) [ gdb man ]; # test dependencies
 
   postPatch = ''
-    find test -type f -exec \
+    find test/ -type f -exec \
       sed -i \
         -e "1s|#!/usr/bin/env bash|#!${bash}/bin/bash|" \
-        -e "s|gpg |${gnupg}/bin/gpg |" \
-        -e "s| gpg| ${gnupg}/bin/gpg|" \
-        -e "s|gpgsm |${gnupg}/bin/gpgsm |" \
-        -e "s| gpgsm| ${gnupg}/bin/gpgsm|" \
-        -e "s|crypto.gpg_path=gpg|crypto.gpg_path=${gnupg}/bin/gpg|" \
         "{}" ";"
 
     for src in \
@@ -102,7 +97,7 @@ stdenv.mkDerivation rec {
     description = "Mail indexer";
     homepage    = https://notmuchmail.org/;
     license     = licenses.gpl3;
-    maintainers = with maintainers; [ chaoflow garbas ];
+    maintainers = with maintainers; [ chaoflow garbas the-kenny ];
     platforms   = platforms.unix;
   };
 }
diff --git a/pkgs/applications/virtualization/docker/default.nix b/pkgs/applications/virtualization/docker/default.nix
index ba74bc38a357..09e7de898d5a 100644
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@@ -208,9 +208,9 @@ rec {
   # https://github.com/docker/docker-ce/blob/v${version}/components/engine/hack/dockerfile/binaries-commits
 
   docker_17_09 = dockerGen rec {
-    version = "17.09.0-ce";
-    rev = "afdb6d44a80f777069885a9ee0e0f86cf841b1bb"; # git commit
-    sha256 = "03g0imdcxqx9y4hhyymxqzvm8bqg4cqrmb7sjbxfdgrhzh9kcn1p";
+    version = "17.09.1-ce";
+    rev = "19e2cf6259bd7f027a3fff180876a22945ce4ba8"; # git commit
+    sha256 = "10glpbaw7bg2acgf1nmfn79is2b3xsm4shz67rp72dmpzzaavb42";
     runcRev = "3f2f8b84a77f73d38244dd690525642a72156c64";
     runcSha256 = "0vaagmav8443kmyxac2y1y5l2ipcs1c7gdmsnvj48y9bafqx72rq";
     containerdRev = "06b9cb35161009dcb7123345749fef02f7cea8e0";
diff --git a/pkgs/applications/window-managers/awesome/3.5.nix b/pkgs/applications/window-managers/awesome/3.5.nix
index 3a2a030b8a4d..f3d43d15efba 100644
--- a/pkgs/applications/window-managers/awesome/3.5.nix
+++ b/pkgs/applications/window-managers/awesome/3.5.nix
@@ -70,8 +70,8 @@ stdenv.mkDerivation rec {
 
   postInstall = ''
     wrapProgram $out/bin/awesome \
-      --prefix LUA_CPATH ";" '"${lgi}/lib/lua/${lua.luaversion}/?.so"' \
-      --prefix LUA_PATH ";" '"${lgi}/share/lua/${lua.luaversion}/?.lua;${lgi}/share/lua/${lua.luaversion}/lgi/?.lua"' \
+      --prefix LUA_CPATH ";" "${lgi}/lib/lua/${lua.luaversion}/?.so" \
+      --prefix LUA_PATH ";" "${lgi}/share/lua/${lua.luaversion}/?.lua;${lgi}/share/lua/${lua.luaversion}/lgi/?.lua" \
       --prefix GI_TYPELIB_PATH : "$GI_TYPELIB_PATH" \
       --prefix LD_LIBRARY_PATH : "$LD_LIBRARY_PATH" \
       --prefix PATH : "${stdenv.lib.makeBinPath [ compton unclutter procps iproute coreutils curl alsaUtils findutils xterm ]}"
diff --git a/pkgs/build-support/build-fhs-userenv/chroot-user.rb b/pkgs/build-support/build-fhs-userenv/chroot-user.rb
deleted file mode 100755
index 833aab16ceb1..000000000000
--- a/pkgs/build-support/build-fhs-userenv/chroot-user.rb
+++ /dev/null
@@ -1,169 +0,0 @@
-#!/usr/bin/env ruby
-
-# Bind mounts hierarchy: from => to (relative)
-# If 'to' is nil, path will be the same
-mounts = { '/' => 'host',
-           '/proc' => nil,
-           '/sys' => nil,
-           '/nix' => nil,
-           '/tmp' => nil,
-           '/var' => nil,
-           '/run' => nil,
-           '/dev' => nil,
-           '/home' => nil,
-         }
-
-# Propagate environment variables
-envvars = [ 'TERM',
-            'DISPLAY',
-            'XAUTHORITY',
-            'HOME',
-            'XDG_RUNTIME_DIR',
-            'LANG',
-            'SSL_CERT_FILE',
-            'DBUS_SESSION_BUS_ADDRESS',
-          ]
-
-require 'tmpdir'
-require 'fileutils'
-require 'pathname'
-require 'set'
-require 'fiddle'
-
-def write_file(path, str)
-  File.open(path, 'w') { |file| file.write str }
-end
-
-# Import C standard library and several needed calls
-$libc = Fiddle.dlopen nil
-
-def make_fcall(name, args, output)
-  c = Fiddle::Function.new $libc[name], args, output
-  lambda do |*args|
-    ret = c.call *args
-    raise SystemCallError.new Fiddle.last_error if ret < 0
-    return ret
-  end
-end
-
-$fork = make_fcall 'fork', [], Fiddle::TYPE_INT
-
-CLONE_NEWNS   = 0x00020000
-CLONE_NEWUSER = 0x10000000
-$unshare = make_fcall 'unshare', [Fiddle::TYPE_INT], Fiddle::TYPE_INT
-
-MS_BIND = 0x1000
-MS_REC  = 0x4000
-MS_SLAVE  = 0x80000
-$mount = make_fcall 'mount', [Fiddle::TYPE_VOIDP,
-                              Fiddle::TYPE_VOIDP,
-                              Fiddle::TYPE_VOIDP,
-                              Fiddle::TYPE_LONG,
-                              Fiddle::TYPE_VOIDP],
-                    Fiddle::TYPE_INT
-
-# Read command line args
-abort "Usage: chrootenv program args..." unless ARGV.length >= 1
-execp = ARGV
-
-# Populate extra mounts
-if not ENV["CHROOTENV_EXTRA_BINDS"].nil?
-  $stderr.puts "CHROOTENV_EXTRA_BINDS is discussed for deprecation."
-  $stderr.puts "If you have a usecase, please drop a note in issue #16030."
-  $stderr.puts "Notice that we now bind-mount host FS to '/host' and symlink all directories from it to '/' by default."
-
-  for extra in ENV["CHROOTENV_EXTRA_BINDS"].split(':')
-    paths = extra.split('=')
-    if not paths.empty?
-      if paths.size <= 2
-        mounts[paths[0]] = paths[1]
-      else
-        $stderr.puts "Ignoring invalid entry in CHROOTENV_EXTRA_BINDS: #{extra}"
-      end
-    end
-  end
-end
-
-# Set destination paths for mounts
-mounts = mounts.map { |k, v| [k, v.nil? ? k.sub(/^\/*/, '') : v] }.to_h
-
-# Create temporary directory for root and chdir
-root = Dir.mktmpdir 'chrootenv'
-
-# Fork process; we need this to do a proper cleanup because
-# child process will chroot into temporary directory.
-# We use imported 'fork' instead of native to overcome
-# CRuby's meddling with threads; this should be safe because
-# we don't use threads at all.
-$cpid = $fork.call
-if $cpid == 0
-  # If we are root, no need to create new user namespace.
-  if Process.uid == 0
-    $unshare.call CLONE_NEWNS
-    # Mark all mounted filesystems as slave so changes
-    # don't propagate to the parent mount namespace.
-    $mount.call nil, '/', nil, MS_REC | MS_SLAVE, nil
-  else
-    # Save user UID and GID
-    uid = Process.uid
-    gid = Process.gid
-
-    # Create new mount and user namespaces
-    # CLONE_NEWUSER requires a program to be non-threaded, hence
-    # native fork above.
-    $unshare.call CLONE_NEWNS | CLONE_NEWUSER
-
-    # Map users and groups to the parent namespace
-    begin
-      # setgroups is only available since Linux 3.19
-      write_file '/proc/self/setgroups', 'deny'
-    rescue
-    end
-    write_file '/proc/self/uid_map', "#{uid} #{uid} 1"
-    write_file '/proc/self/gid_map', "#{gid} #{gid} 1"
-  end
-
-  # Do rbind mounts.
-  mounts.each do |from, rto|
-    to = "#{root}/#{rto}"
-    FileUtils.mkdir_p to
-    $mount.call from, to, nil, MS_BIND | MS_REC, nil
-  end
-
-  # Don't make root private so privilege drops inside chroot are possible
-  File.chmod(0755, root)
-  # Chroot!
-  Dir.chroot root
-  Dir.chdir '/'
-
-  # New environment
-  new_env = Hash[ envvars.map { |x| [x, ENV[x]] } ]
-
-  # Finally, exec!
-  exec(new_env, *execp, close_others: true, unsetenv_others: true)
-end
-
-# Wait for a child. If we catch a signal, resend it to child and continue
-# waiting.
-def wait_child
-  begin
-    Process.wait
-
-    # Return child's exit code
-    if $?.exited?
-      exit $?.exitstatus
-      else
-      exit 1
-    end
-  rescue SignalException => e
-    Process.kill e.signo, $cpid
-    wait_child
-  end
-end
-
-begin
-  wait_child
-ensure
-  # Cleanup
-  FileUtils.rm_rf root, secure: true
-end
diff --git a/pkgs/build-support/build-fhs-userenv/chrootenv.c b/pkgs/build-support/build-fhs-userenv/chrootenv.c
new file mode 100644
index 000000000000..8d6c98959cc9
--- /dev/null
+++ b/pkgs/build-support/build-fhs-userenv/chrootenv.c
@@ -0,0 +1,182 @@
+#define _GNU_SOURCE
+
+#include <errno.h>
+#include <error.h>
+
+#define errorf(status, fmt, ...)                                               \
+  error_at_line(status, errno, __FILE__, __LINE__, fmt, ##__VA_ARGS__)
+
+#include <dirent.h>
+#include <ftw.h>
+#include <sched.h>
+#include <stdarg.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sysexits.h>
+#include <unistd.h>
+
+#include <sys/mount.h>
+#include <sys/stat.h>
+#include <sys/wait.h>
+
+char *env_whitelist[] = {"TERM",
+                         "DISPLAY",
+                         "XAUTHORITY",
+                         "HOME",
+                         "XDG_RUNTIME_DIR",
+                         "LANG",
+                         "SSL_CERT_FILE",
+                         "DBUS_SESSION_BUS_ADDRESS"};
+
+char **env_build(char *names[], size_t len) {
+  char *env, **ret = malloc((len + 1) * sizeof(char *)), **ptr = ret;
+
+  for (size_t i = 0; i < len; i++) {
+    if ((env = getenv(names[i]))) {
+      if (asprintf(ptr++, "%s=%s", names[i], env) < 0)
+        errorf(EX_OSERR, "asprintf");
+    }
+  }
+
+  *ptr = NULL;
+  return ret;
+}
+
+struct bind {
+  char *from;
+  char *to;
+};
+
+struct bind binds[] = {{"/", "host"},   {"/proc", "proc"}, {"/sys", "sys"},
+                       {"/nix", "nix"}, {"/tmp", "tmp"},   {"/var", "var"},
+                       {"/run", "run"}, {"/dev", "dev"},   {"/home", "home"}};
+
+void bind(struct bind *bind) {
+  DIR *src = opendir(bind->from);
+
+  if (src) {
+    if (closedir(src) < 0)
+      errorf(EX_IOERR, "closedir");
+
+    if (mkdir(bind->to, 0755) < 0)
+      errorf(EX_IOERR, "mkdir");
+
+    if (mount(bind->from, bind->to, "bind", MS_BIND | MS_REC, NULL) < 0)
+      errorf(EX_OSERR, "mount");
+
+  } else {
+    // https://github.com/NixOS/nixpkgs/issues/31104
+    if (errno != ENOENT)
+      errorf(EX_OSERR, "opendir");
+  }
+}
+
+void spitf(char *path, char *fmt, ...) {
+  va_list args;
+  va_start(args, fmt);
+
+  FILE *f = fopen(path, "w");
+
+  if (f == NULL)
+    errorf(EX_IOERR, "spitf(%s): fopen", path);
+
+  if (vfprintf(f, fmt, args) < 0)
+    errorf(EX_IOERR, "spitf(%s): vfprintf", path);
+
+  if (fclose(f) < 0)
+    errorf(EX_IOERR, "spitf(%s): fclose", path);
+}
+
+int nftw_rm(const char *path, const struct stat *sb, int type,
+            struct FTW *ftw) {
+  if (remove(path) < 0)
+    errorf(EX_IOERR, "nftw_rm");
+
+  return 0;
+}
+
+#define LEN(x) sizeof(x) / sizeof(*x)
+
+int main(int argc, char *argv[]) {
+  if (argc < 2) {
+    fprintf(stderr, "Usage: %s command [arguments...]\n"
+                    "Requires Linux kernel >= 3.19 with CONFIG_USER_NS.\n",
+            argv[0]);
+    exit(EX_USAGE);
+  }
+
+  char tmpl[] = "/tmp/chrootenvXXXXXX";
+  char *root = mkdtemp(tmpl);
+
+  if (root == NULL)
+    errorf(EX_IOERR, "mkdtemp");
+
+  // Don't make root private so that privilege drops inside chroot are possible:
+  if (chmod(root, 0755) < 0)
+    errorf(EX_IOERR, "chmod");
+
+  pid_t cpid = fork();
+
+  if (cpid < 0)
+    errorf(EX_OSERR, "fork");
+
+  if (cpid == 0) {
+    uid_t uid = getuid();
+    gid_t gid = getgid();
+
+    // If we are root, no need to create new user namespace.
+    if (uid == 0) {
+      if (unshare(CLONE_NEWNS) < 0)
+        errorf(EX_OSERR, "unshare() failed: You may have an old kernel or have CLONE_NEWUSER disabled by your distribution security settings.");
+      // Mark all mounted filesystems as slave so changes
+      // don't propagate to the parent mount namespace.
+      if (mount(NULL, "/", NULL, MS_REC | MS_SLAVE, NULL) < 0)
+        errorf(EX_OSERR, "mount");
+    } else {
+      // Create new mount and user namespaces. CLONE_NEWUSER
+      // requires a program to be non-threaded.
+      if (unshare(CLONE_NEWNS | CLONE_NEWUSER) < 0)
+        errorf(EX_OSERR, "unshare");
+
+      // Map users and groups to the parent namespace.
+      // setgroups is only available since Linux 3.19:
+      spitf("/proc/self/setgroups", "deny");
+
+      spitf("/proc/self/uid_map", "%d %d 1", uid, uid);
+      spitf("/proc/self/gid_map", "%d %d 1", gid, gid);
+    }
+
+    if (chdir(root) < 0)
+      errorf(EX_IOERR, "chdir");
+
+    for (size_t i = 0; i < LEN(binds); i++)
+      bind(&binds[i]);
+
+    if (chroot(root) < 0)
+      errorf(EX_OSERR, "chroot");
+
+    if (chdir("/") < 0)
+      errorf(EX_OSERR, "chdir");
+
+    argv++;
+
+    if (execvpe(*argv, argv, env_build(env_whitelist, LEN(env_whitelist))) < 0)
+      errorf(EX_OSERR, "execvpe");
+  }
+
+  int status;
+
+  if (waitpid(cpid, &status, 0) < 0)
+    errorf(EX_OSERR, "waitpid");
+
+  if (nftw(root, nftw_rm, getdtablesize(), FTW_DEPTH | FTW_MOUNT | FTW_PHYS) < 0)
+    errorf(EX_IOERR, "nftw");
+
+  if (WIFEXITED(status))
+    return WEXITSTATUS(status);
+  else if (WIFSIGNALED(status))
+    kill(getpid(), WTERMSIG(status));
+
+  return EX_OSERR;
+}
diff --git a/pkgs/build-support/build-fhs-userenv/default.nix b/pkgs/build-support/build-fhs-userenv/default.nix
index d91cdffcf392..5f3ec4dc8eaf 100644
--- a/pkgs/build-support/build-fhs-userenv/default.nix
+++ b/pkgs/build-support/build-fhs-userenv/default.nix
@@ -2,16 +2,19 @@
 
 let buildFHSEnv = callPackage ./env.nix { }; in
 
-args@{ name, runScript ? "bash", extraBindMounts ? [], extraInstallCommands ? "", meta ? {}, passthru ? {}, ... }:
+args@{ name, runScript ? "bash", extraInstallCommands ? "", meta ? {}, passthru ? {}, ... }:
 
 let
-  env = buildFHSEnv (removeAttrs args [ "runScript" "extraBindMounts" "extraInstallCommands" "meta" "passthru" ]);
+  env = buildFHSEnv (removeAttrs args [ "runScript" "extraInstallCommands" "meta" "passthru" ]);
 
-  # Sandboxing script
-  chroot-user = writeScript "chroot-user" ''
-    #! ${ruby}/bin/ruby
-    ${builtins.readFile ./chroot-user.rb}
-  '';
+  chrootenv = stdenv.mkDerivation {
+    name = "chrootenv";
+
+    unpackPhase = "cp ${./chrootenv.c} chrootenv.c";
+    installPhase = "cp chrootenv $out";
+
+    makeFlags = [ "chrootenv" ];
+  };
 
   init = run: writeScript "${name}-init" ''
     #! ${stdenv.shell}
@@ -32,8 +35,7 @@ in runCommand name {
   passthru = passthru // {
     env = runCommand "${name}-shell-env" {
       shellHook = ''
-        ${lib.optionalString (extraBindMounts != []) ''export CHROOTENV_EXTRA_BINDS="${lib.concatStringsSep ":" extraBindMounts}:$CHROOTENV_EXTRA_BINDS"''}
-        exec ${chroot-user} ${init "bash"} "$(pwd)"
+        exec ${chrootenv} ${init "bash"} "$(pwd)"
       '';
     } ''
       echo >&2 ""
@@ -46,8 +48,7 @@ in runCommand name {
   mkdir -p $out/bin
   cat <<EOF >$out/bin/${name}
   #! ${stdenv.shell}
-  ${lib.optionalString (extraBindMounts != []) ''export CHROOTENV_EXTRA_BINDS="${lib.concatStringsSep ":" extraBindMounts}:$CHROOTENV_EXTRA_BINDS"''}
-  exec ${chroot-user} ${init runScript} "\$(pwd)" "\$@"
+  exec ${chrootenv} ${init runScript} "\$(pwd)" "\$@"
   EOF
   chmod +x $out/bin/${name}
   ${extraInstallCommands}
diff --git a/pkgs/data/documentation/zeal/default.nix b/pkgs/data/documentation/zeal/default.nix
index a1e90244f808..1951429fa907 100644
--- a/pkgs/data/documentation/zeal/default.nix
+++ b/pkgs/data/documentation/zeal/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   name = "zeal-${version}";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner  = "zealdocs";
     repo   = "zeal";
     rev    = "v${version}";
-    sha256 = "1mfcw843g4slr79bvidb5s88m7a3swr9by6srdn233b88j8mqwzl";
+    sha256 = "14gm9n2zmqgig4nz5i3089dhn0a7c175g1szr0zg9yzr9j2hk0mr";
   };
 
   # while ads can be disabled from the user settings, by default they are not so
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     '';
     homepage    = http://zealdocs.org/;
     license     = licenses.gpl3;
-    maintainers = with maintainers; [ skeidel ];
+    maintainers = with maintainers; [ skeidel peterhoeg ];
     platforms   = platforms.linux;
   };
 }
diff --git a/pkgs/data/documentation/zeal/remove_ads.patch b/pkgs/data/documentation/zeal/remove_ads.patch
index 7f163376865c..1c0b3c081f16 100644
--- a/pkgs/data/documentation/zeal/remove_ads.patch
+++ b/pkgs/data/documentation/zeal/remove_ads.patch
@@ -1,13 +1,16 @@
 diff --git a/src/app/resources/browser/welcome.html b/src/app/resources/browser/welcome.html
-index afe9e2a..490a0fb 100644
+index 22e6278..ec09771 100644
 --- a/src/app/resources/browser/welcome.html
 +++ b/src/app/resources/browser/welcome.html
-@@ -34,9 +34,6 @@
+@@ -35,12 +35,6 @@
      <div class="hero-foot">
        <div class="container">
          <div class="content has-text-centered">
--          <div id="carbon" class="box">
--            <script async type="text/javascript" src="https://cdn.carbonads.com/carbon.js?zoneid=1673&serve=C6AILKT&placement=zealdocsforwindowsorg" id="_carbonads_js"></script>
+-          <div id="carboncontainer">
+-            <div id="carbon" class="box">
+-              <script async type="text/javascript" src="https://cdn.carbonads.com/carbon.js?zoneid=1673&serve=C6AILKT&placement=zealdocsforwindowsorg"
+-                onerror="document.getElementById('carboncontainer').style.display = 'none';" id="_carbonads_js"></script>
+-            </div>
 -          </div>
            <p>
              <a class="icon" href="https://github.com/zealdocs/zeal">
diff --git a/pkgs/desktops/gnome-3/core/totem/default.nix b/pkgs/desktops/gnome-3/core/totem/default.nix
index d16a57dbc42d..651b7cff226d 100644
--- a/pkgs/desktops/gnome-3/core/totem/default.nix
+++ b/pkgs/desktops/gnome-3/core/totem/default.nix
@@ -9,6 +9,7 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
+  # https://bugs.launchpad.net/ubuntu/+source/totem/+bug/1712021
   # https://bugzilla.gnome.org/show_bug.cgi?id=784236
   # https://github.com/mesonbuild/meson/issues/1994
   enableParallelBuilding = false;
diff --git a/pkgs/development/compilers/hhvm/default.nix b/pkgs/development/compilers/hhvm/default.nix
index 4159b7bd52b7..2f84387a8888 100644
--- a/pkgs/development/compilers/hhvm/default.nix
+++ b/pkgs/development/compilers/hhvm/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchgit, fetchurl, cmake, pkgconfig, boost, libunwind, libmemcached
+{ stdenv, fetchgit, cmake, pkgconfig, boost, libunwind, libmemcached
 , pcre, libevent, gd, curl, libxml2, icu, flex, bison, openssl, zlib, php
 , expat, libcap, oniguruma, libdwarf, libmcrypt, tbb, gperftools, glog, libkrb5
 , bzip2, openldap, readline, libelf, uwimap, binutils, cyrus_sasl, pam, libpng
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   name    = "hhvm-${version}";
-  version = "3.21";
+  version = "3.23.2";
 
   # use git version since we need submodules
   src = fetchgit {
     url    = "https://github.com/facebook/hhvm.git";
-    rev    = "56483773e2edd9e61782f1901ce40e47959e71b8";
-    sha256 = "0dmdk98nv04m0fv6909gfbsxqlkckn369yi7kadhir0r7vxsj7wa";
+    rev    = "HHVM-${version}";
+    sha256 = "1nic49j8nghx82lgvz0b95r78sqz46qaaqv4nx48p8yrj9ysnd7i";
     fetchSubmodules = true;
   };
 
@@ -29,10 +29,6 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./flexible-array-members-gcc6.patch
-    (fetchurl {
-      url = https://github.com/facebook/hhvm/commit/b506902af2b7c53de6d6c92491c2086472292004.patch;
-      sha256 = "1br7diczqks6b1xjrdsac599fc62m9l17gcx7dvkc0qj54lq7ys4";
-    })
   ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/compilers/ocaml/ber-metaocaml-003.nix b/pkgs/development/compilers/ocaml/ber-metaocaml-104.nix
index c95d29326a4e..81c8cd534025 100644
--- a/pkgs/development/compilers/ocaml/ber-metaocaml-003.nix
+++ b/pkgs/development/compilers/ocaml/ber-metaocaml-104.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, ncurses, xlibsWrapper }:
+{ stdenv, fetchurl, ncurses, libX11, xproto, buildEnv }:
 
 let
    useX11 = stdenv.isi686 || stdenv.isx86_64;
@@ -7,52 +7,65 @@ let
 in
 
 stdenv.mkDerivation rec {
-  
+
   name = "ber-metaocaml-${version}";
-  version = "003";
-  
+  version = "104";
+
   src = fetchurl {
-    url = "http://caml.inria.fr/pub/distrib/ocaml-3.11/ocaml-3.11.2.tar.bz2";
-    sha256 = "0hw1yp1mmfyn1pmda232d0ry69m7ln1z0fn5lgi8nz3y1mx3iww6";
+    url = "http://caml.inria.fr/pub/distrib/ocaml-4.04/ocaml-4.04.0.tar.gz";
+    sha256 = "1pi2hdm9lxhn45qvfqfss1hpa4jijm14qgmrgajsadxqdiplhqyb";
   };
 
   metaocaml = fetchurl {
-    url = "http://okmij.org/ftp/ML/ber-metaocaml.tar.gz";
-    sha256 = "1kq1if25c1wvcdiy4g46xk05dkc1am2gc4qvmg4x19wvvaz09gzf";
+    url = "http://okmij.org/ftp/ML/ber-metaocaml-104.tar.gz";
+    sha256 = "1gmwlxairxqcmqa2r6kbf8b4dxc7pfhfbh48g1s14d3z20rj8nib";
   };
 
   # Needed to avoid a SIGBUS on the final executable on mips
   NIX_CFLAGS_COMPILE = if stdenv.isMips then "-fPIC" else "";
 
-  patches = optionals stdenv.isDarwin [ ./gnused-on-osx-fix.patch ];
+  x11env = buildEnv { name = "x11env"; paths = [libX11 xproto];};
+  x11lib = x11env + "/lib";
+  x11inc = x11env + "/include";
 
   prefixKey = "-prefix ";
-  configureFlags = ["-no-tk"] ++ optionals useX11 [ "-x11lib" xlibsWrapper ];
-  buildFlags = "core coreboot all"; # "world" + optionalString useNativeCompilers " bootstrap world.opt";
-  buildInputs = [ncurses] ++ optionals useX11 [ xlibsWrapper ];
+  configureFlags = optionals useX11 [ "-x11lib" x11lib
+                                      "-x11include" x11inc ];
+
+  dontStrip = true;
+  buildInputs = [ncurses] ++ optionals useX11 [ libX11 xproto ];
   installFlags = "-i";
   installTargets = "install"; # + optionalString useNativeCompilers " installopt";
-  prePatch = ''
-    CAT=$(type -tp cat)
-    sed -e "s@/bin/cat@$CAT@" -i config/auto-aux/sharpbang
-    patch -p0 < ${./mips64.patch}
-  '';
+
   postConfigure = ''
     tar -xvzf $metaocaml
     cd ${name}
     make patch
     cd ..
   '';
-  postBuild = ''
+  buildPhase = ''
+    make world
+    make -i install
+
+    make bootstrap
+    make opt.opt
+    make installopt
     mkdir -p $out/include
     ln -sv $out/lib/ocaml/caml $out/include/caml
-  '';
-  postInstall = ''
     cd ${name}
     make all
     make install
+    make install.opt
+    cd ..
+ '';
+  installPhase = "";
+  postBuild = ''
+  '';
+  checkPhase = ''
+    cd ${name}
     make test
     make test-compile
+    make test-native
     cd ..
   '';
 
@@ -67,6 +80,5 @@ stdenv.mkDerivation rec {
       A conservative extension of OCaml with the primitive type of code values,
       and three basic multi-stage expression forms: Brackets, Escape, and Run
     '';
-    broken = true;
   };
 }
diff --git a/pkgs/development/haskell-modules/configuration-common.nix b/pkgs/development/haskell-modules/configuration-common.nix
index 59ae85332149..172ce5deacf2 100644
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@@ -509,6 +509,21 @@ self: super: {
     preConfigure = "sed -i -e 's,time .* < 1.6,time >= 1.5,' -e 's,haddock-library >= 1.1 && < 1.3,haddock-library >= 1.1,' pandoc.cabal";
   });
 
+  # pandoc 2 dependency resolution
+  hslua_0_9_2 = super.hslua_0_9_2.override { lua5_1 = pkgs.lua5_3; };
+  hslua-module-text = super.hslua-module-text.override { hslua = self.hslua_0_9_2; };
+  texmath_0_10 = super.texmath_0_10.override { pandoc-types = self.pandoc-types_1_17_3; };
+  pandoc_2_0_4 = super.pandoc_2_0_4.override {
+    doctemplates = self.doctemplates_0_2_1;
+    pandoc-types = self.pandoc-types_1_17_3;
+    skylighting = self.skylighting_0_4_4_1;
+    texmath = self.texmath_0_10;
+  };
+  pandoc-citeproc_0_12_1 = super.pandoc-citeproc_0_12_1.override {
+    pandoc = self.pandoc_2_0_4;
+    pandoc-types = self.pandoc-types_1_17_3;
+  };
+
   # https://github.com/tych0/xcffib/issues/37
   xcffib = dontCheck super.xcffib;
 
diff --git a/pkgs/development/interpreters/python/cpython/2.7/default.nix b/pkgs/development/interpreters/python/cpython/2.7/default.nix
index b28df2501aac..9352bb4d52e0 100644
--- a/pkgs/development/interpreters/python/cpython/2.7/default.nix
+++ b/pkgs/development/interpreters/python/cpython/2.7/default.nix
@@ -201,7 +201,7 @@ in stdenv.mkDerivation {
     passthru = let
       pythonPackages = callPackage ../../../../../top-level/python-packages.nix {python=self; overrides=packageOverrides;};
     in rec {
-      inherit libPrefix sitePackages x11Support hasDistutilsCxxPatch;
+      inherit libPrefix sitePackages x11Support hasDistutilsCxxPatch ucsEncoding;
       executable = libPrefix;
       buildEnv = callPackage ../../wrapper.nix { python = self; inherit (pythonPackages) requiredPythonModules; };
       withPackages = import ../../with-packages.nix { inherit buildEnv pythonPackages;};
diff --git a/pkgs/development/interpreters/python/wrapper.nix b/pkgs/development/interpreters/python/wrapper.nix
index fc521828ffc4..8d4e68bf57ca 100644
--- a/pkgs/development/interpreters/python/wrapper.nix
+++ b/pkgs/development/interpreters/python/wrapper.nix
@@ -14,7 +14,8 @@ let
     name = "${python.name}-env";
 
     inherit paths;
-    inherit ignoreCollisions extraOutputsToInstall;
+    inherit ignoreCollisions;
+    extraOutputsToInstall = [ "out" ] ++ extraOutputsToInstall;
 
     postBuild = ''
       . "${makeWrapper}/nix-support/setup-hook"
diff --git a/pkgs/development/libraries/gmime/3.nix b/pkgs/development/libraries/gmime/3.nix
index d6877e72a1f9..66d0cf88bd02 100644
--- a/pkgs/development/libraries/gmime/3.nix
+++ b/pkgs/development/libraries/gmime/3.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, pkgconfig, glib, zlib, gpgme, libidn, gobjectIntrospection }:
 
 stdenv.mkDerivation rec {
-  version = "3.0.1";
+  version = "3.0.5";
   name = "gmime-${version}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gmime/3.0/${name}.tar.xz";
-    sha256 = "001y93b8mq9alzkvli6vfh3pzdcn5c5iy206ml23lzhhhvm5k162";
+    sha256 = "1q45gd1ahnz9q1milc2lqqwl7j3q0wd6kiswhp25iak222n56lrg";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/leveldb/default.nix b/pkgs/development/libraries/leveldb/default.nix
index 2a109e0366fd..3ff2ca0b0ee4 100644
--- a/pkgs/development/libraries/leveldb/default.nix
+++ b/pkgs/development/libraries/leveldb/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, sqlite, kyotocabinet }:
+{ stdenv, fetchFromGitHub }:
 
 stdenv.mkDerivation rec {
   name = "leveldb-${version}";
@@ -11,19 +11,20 @@ stdenv.mkDerivation rec {
     sha256 = "1bnsii47vbyqnbah42qgq6pbmmcg4k3fynjnw7whqfv6lpdgmb8d";
   };
 
-  buildInputs = [ sqlite kyotocabinet ];
-
   buildPhase = ''
-    make all db_bench{,_sqlite3,_tree_db} leveldbutil libmemenv.a
+    make all leveldbutil libmemenv.a
   '';
 
   installPhase = "
     mkdir -p $out/{bin,lib,include}
+
     cp -r include $out
-    cp lib* $out/lib
-    cp db_bench{,_sqlite3,_tree_db} leveldbutil $out/bin
     mkdir -p $out/include/leveldb/helpers
     cp helpers/memenv/memenv.h $out/include/leveldb/helpers
+
+    cp lib* $out/lib
+
+    cp leveldbutil $out/bin
   ";
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/libraries/libcerf/default.nix b/pkgs/development/libraries/libcerf/default.nix
new file mode 100644
index 000000000000..fd5ee8dcaaf9
--- /dev/null
+++ b/pkgs/development/libraries/libcerf/default.nix
@@ -0,0 +1,18 @@
+{ stdenv, lib, fetchurl }:
+
+stdenv.mkDerivation {
+  name = "libcerf-1.5";
+
+  src = fetchurl {
+    url = "http://apps.jcns.fz-juelich.de/src/libcerf/libcerf-1.5.tgz";
+    sha256 = "11jwr8ql4a9kmv04ycgwk4dsqnlv4l65a8aa0x1i3y7zwx3w2vg3";
+  };
+
+  meta = with lib; {
+    description = "Complex error (erf), Dawson, Faddeeva, and Voigt function library";
+    homepage = http://apps.jcns.fz-juelich.de/doku/sc/libcerf;
+    license = licenses.mit;
+    maintainers = with maintainers; [ orivej ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/development/libraries/libvirt/default.nix b/pkgs/development/libraries/libvirt/default.nix
index ff72cc84d265..f2710435c00c 100644
--- a/pkgs/development/libraries/libvirt/default.nix
+++ b/pkgs/development/libraries/libvirt/default.nix
@@ -9,14 +9,14 @@
 
 with stdenv.lib;
 
-# if you update, also bump pythonPackages.libvirt or it will break
+# if you update, also bump <nixpkgs/pkgs/development/python-modules/libvirt/default.nix> or it will break
 stdenv.mkDerivation rec {
   name = "libvirt-${version}";
-  version = "3.8.0";
+  version = "3.10.0";
 
   src = fetchurl {
     url = "http://libvirt.org/sources/${name}.tar.xz";
-    sha256 = "1y83z4jb2by6ara0nw4sivh7svqcrw97yfhqwdscxl4y10saisvk";
+    sha256 = "03kb37iv3dvvdlslznlc0njvjpmq082lczmsslz5p4fcwb50kwfz";
   };
 
   patches = [ ./build-on-bsd.patch ];
diff --git a/pkgs/development/libraries/qt-4.x/4.8/default.nix b/pkgs/development/libraries/qt-4.x/4.8/default.nix
index 369f328666da..32691faa6893 100644
--- a/pkgs/development/libraries/qt-4.x/4.8/default.nix
+++ b/pkgs/development/libraries/qt-4.x/4.8/default.nix
@@ -68,6 +68,7 @@ stdenv.mkDerivation rec {
     [ ./glib-2.32.patch
       ./libressl.patch
       ./parallel-configure.patch
+      ./qt-4.8.7-unixmake-darwin.patch
       (substituteAll {
         src = ./dlopen-absolute-paths.diff;
         cups = if cups != null then stdenv.lib.getLib cups else null;
@@ -76,7 +77,19 @@ stdenv.mkDerivation rec {
         glibc = stdenv.cc.libc.out;
         openglDriver = if mesaSupported then mesa.driverLink else "/no-such-path";
       })
-    ] ++ stdenv.lib.optional gtkStyle (substituteAll ({
+      (fetchpatch {
+        name = "fix-medium-font.patch";
+        url = "http://anonscm.debian.org/cgit/pkg-kde/qt/qt4-x11.git/plain/debian/patches/"
+          + "kubuntu_39_fix_medium_font.diff?id=21b342d71c19e6d68b649947f913410fe6129ea4";
+        sha256 = "0bli44chn03c2y70w1n8l7ss4ya0b40jqqav8yxrykayi01yf95j";
+      })
+      (fetchpatch {
+        name = "qt4-gcc6.patch";
+        url = "https://git.archlinux.org/svntogit/packages.git/plain/trunk/qt4-gcc6.patch?h=packages/qt4&id=ca773a144f5abb244ac4f2749eeee9333cac001f";
+        sha256 = "07lrva7bjh6i40p7b3ml26a2jlznri8bh7y7iyx5zmvb1gfxmj34";
+      })
+    ]
+    ++ stdenv.lib.optional gtkStyle (substituteAll ({
         src = ./dlopen-gtkstyle.diff;
         # substituteAll ignores env vars starting with capital letter
         gtk = gtk2.out;
@@ -93,20 +106,7 @@ stdenv.mkDerivation rec {
     ++ stdenv.lib.optional stdenv.isAarch64 (fetchpatch {
         url = "https://src.fedoraproject.org/rpms/qt/raw/ecf530486e0fb7fe31bad26805cde61115562b2b/f/qt-aarch64.patch";
         sha256 = "1fbjh78nmafqmj7yk67qwjbhl3f6ylkp6x33b1dqxfw9gld8b3gl";
-      })
-    ++ [
-      (fetchpatch {
-        name = "fix-medium-font.patch";
-        url = "http://anonscm.debian.org/cgit/pkg-kde/qt/qt4-x11.git/plain/debian/patches/"
-          + "kubuntu_39_fix_medium_font.diff?id=21b342d71c19e6d68b649947f913410fe6129ea4";
-        sha256 = "0bli44chn03c2y70w1n8l7ss4ya0b40jqqav8yxrykayi01yf95j";
-      })
-      (fetchpatch {
-        name = "qt4-gcc6.patch";
-        url = "https://git.archlinux.org/svntogit/packages.git/plain/trunk/qt4-gcc6.patch?h=packages/qt4&id=ca773a144f5abb244ac4f2749eeee9333cac001f";
-        sha256 = "07lrva7bjh6i40p7b3ml26a2jlznri8bh7y7iyx5zmvb1gfxmj34";
-      })
-    ];
+      });
 
   preConfigure = ''
     export LD_LIBRARY_PATH="`pwd`/lib:$LD_LIBRARY_PATH"
@@ -185,37 +185,8 @@ stdenv.mkDerivation rec {
     sed -i 's/^\(LIBS[[:space:]]*=.*$\)/\1 -lobjc/' ./src/corelib/Makefile.Release
   '';
 
-  installPhase = optionalString stdenv.isDarwin ''
-    runHook preInstall
-    cp -r lib $out
-
-    mkdir -p $out/Applications
-    mv bin/*.app $out/Applications
-    rm -rf bin/*.app
-
-    cp -r bin $out
-
-    mkdir -p $out/share/doc/${name}
-    mkdir -p $out/lib
-    mkdir -p $out/lib/qt4/plugins
-    mkdir -p $out/lib/qt4/imports
-    mkdir -p $out/bin
-    mkdir -p $out/include
-    mkdir -p $out/share/${name}
-
-    cp -r mkspecs $out/share/${name}
-    cp -r translations $out/share/${name}
-    cp -r tools/linguist/phrasebooks $out/share/${name}
-    cp tools/porting/src/q3porting.xml $out/share/${name}
-
-    cp -r plugins $out/lib/qt4
-    cp -r imports $out/lib/qt4
-    cp -r doc/* $out/share/doc/${name}
-    runHook postInstall
-  '';
-
-  postInstall = optionalString (!stdenv.isDarwin) ''
-      rm -rf $out/tests
+  postInstall = ''
+    rm -rf $out/tests
   '';
 
   crossAttrs = {
diff --git a/pkgs/development/libraries/qt-4.x/4.8/qt-4.8.7-unixmake-darwin.patch b/pkgs/development/libraries/qt-4.x/4.8/qt-4.8.7-unixmake-darwin.patch
new file mode 100644
index 000000000000..99a36a24fe43
--- /dev/null
+++ b/pkgs/development/libraries/qt-4.x/4.8/qt-4.8.7-unixmake-darwin.patch
@@ -0,0 +1,11 @@
+--- a/qmake/generators/unix/unixmake.cpp
++++ b/qmake/generators/unix/unixmake.cpp
+@@ -831,7 +831,7 @@ UnixMakefileGenerator::defaultInstall(const QString &t)
+             else if(project->first("TEMPLATE") == "app" && !project->isEmpty("QMAKE_STRIPFLAGS_APP"))
+                 ret += " " + var("QMAKE_STRIPFLAGS_APP");
+             if(bundle)
+-                ret = " \"" + dst_targ + "/Contents/MacOS/$(QMAKE_TARGET)\"";
++                ret += " \"" + dst_targ + "/Contents/MacOS/$(QMAKE_TARGET)\"";
+             else
+                 ret += " \"" + dst_targ + "\"";
+         }
diff --git a/pkgs/development/ocaml-modules/markup/default.nix b/pkgs/development/ocaml-modules/markup/default.nix
index 3ee84d0d1b1c..eb3944db88e9 100644
--- a/pkgs/development/ocaml-modules/markup/default.nix
+++ b/pkgs/development/ocaml-modules/markup/default.nix
@@ -2,19 +2,19 @@
 
 stdenv.mkDerivation rec {
   pname = "markup";
-  version = "0.7.4";
+  version = "0.7.5";
   name = "ocaml${ocaml.version}-${pname}-${version}";
 
   src = fetchzip {
     url = "http://github.com/aantron/markup.ml/archive/${version}.tar.gz";
-    sha256 = "1hchlqzsy9pax91gcdmxzakfm22fbvhxzwyzpvz8fqkx4372zs37";
+    sha256 = "09qm73m6c6wjh51w61vnfsnis37m28cf1r6hnkr3bbg903ahwbp5";
     };
 
-  buildInputs = [ ocaml findlib ocamlbuild ];
+  buildInputs = [ ocaml findlib ocamlbuild lwt ];
 
   installPhase = "make ocamlfind-install";
-  
-  propagatedBuildInputs = [uutf lwt];
+
+  propagatedBuildInputs = [ uutf ];
 
   createFindlibDestdir = true;
 
diff --git a/pkgs/development/ocaml-modules/ulex/default.nix b/pkgs/development/ocaml-modules/ulex/default.nix
index fa26b305da2d..ed868c30a442 100644
--- a/pkgs/development/ocaml-modules/ulex/default.nix
+++ b/pkgs/development/ocaml-modules/ulex/default.nix
@@ -1,16 +1,26 @@
-{ stdenv, fetchurl, ocaml, findlib, ocamlbuild, camlp4 }:
+{ stdenv, fetchFromGitHub, ocaml, findlib, ocamlbuild, camlp4 }:
 
 let
   pname = "ulex";
+  param =
+    if stdenv.lib.versionAtLeast ocaml.version "4.02" then {
+      version = "1.2";
+      sha256 = "08yf2x9a52l2y4savjqfjd2xy4pjd1rpla2ylrr9qrz1drpfw4ic";
+    } else {
+      version = "1.1";
+      sha256 = "0cmscxcmcxhlshh4jd0lzw5ffzns12x3bj7h27smbc8waxkwffhl";
+    };
 in
 
 stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
-  version = "1.1";
+  name = "ocaml${ocaml.version}-${pname}-${version}";
+  inherit (param) version;
 
-  src = fetchurl {
-    url = "http://www.cduce.org/download/${pname}-${version}.tar.gz";
-    sha256 = "0fjlkwps14adfgxdrbb4yg65fhyimplvjjs1xqj5np197cig67x0";
+  src = fetchFromGitHub {
+    owner = "whitequark";
+    repo = pname;
+    rev = "v${version}";
+    inherit (param) sha256;
   };
 
   createFindlibDestdir = true;
@@ -21,7 +31,7 @@ stdenv.mkDerivation rec {
   buildFlags = "all all.opt";
 
   meta = {
-    homepage = http://www.cduce.org/download.html;
+    inherit (src.meta) homepage;
     description = "A lexer generator for Unicode and OCaml";
     license = stdenv.lib.licenses.mit;
     platforms = ocaml.meta.platforms or [];
diff --git a/pkgs/development/python-modules/FormEncode/default.nix b/pkgs/development/python-modules/FormEncode/default.nix
index 2f72f7c16a7a..cd9d8ee46d8a 100644
--- a/pkgs/development/python-modules/FormEncode/default.nix
+++ b/pkgs/development/python-modules/FormEncode/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildPythonPackage, fetchPypi, dns, pycountry, nose }:
+{ stdenv, buildPythonPackage, fetchPypi, dnspython, pycountry, nose }:
 
 buildPythonPackage rec {
   pname = "FormEncode";
@@ -10,7 +10,7 @@ buildPythonPackage rec {
     sha256 = "1xm77h2mds2prlaz0z4nzkx13g61rx5c2v3vpgjq9d5ij8bzb8md";
   };
 
-  buildInputs = [ dns pycountry nose ];
+  buildInputs = [ dnspython pycountry nose ];
 
   patchPhase = ''
     # dnspython3 has been superseded, see its PyPI page
diff --git a/pkgs/development/python-modules/dkimpy/default.nix b/pkgs/development/python-modules/dkimpy/default.nix
index 91d5a17960d8..177e697aab9f 100644
--- a/pkgs/development/python-modules/dkimpy/default.nix
+++ b/pkgs/development/python-modules/dkimpy/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, openssl, makeWrapper, buildPythonApplication
-, pytest, dns }:
+, pytest, dnspython }:
 
 buildPythonApplication rec {
   name = "${pname}-${version}";
@@ -14,7 +14,7 @@ buildPythonApplication rec {
   };
 
   buildInputs = [ pytest ];
-  propagatedBuildInputs =  [ openssl dns ];
+  propagatedBuildInputs =  [ openssl dnspython ];
 
   patchPhase = ''
     substituteInPlace dknewkey.py --replace \
diff --git a/pkgs/development/python-modules/dns/default.nix b/pkgs/development/python-modules/dnspython/default.nix
index 0548c5a1098e..0548c5a1098e 100644
--- a/pkgs/development/python-modules/dns/default.nix
+++ b/pkgs/development/python-modules/dnspython/default.nix
diff --git a/pkgs/development/python-modules/email-validator/default.nix b/pkgs/development/python-modules/email-validator/default.nix
index 4fc78d8bd1e1..cf03a02129d4 100644
--- a/pkgs/development/python-modules/email-validator/default.nix
+++ b/pkgs/development/python-modules/email-validator/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, buildPythonPackage, fetchPypi, isPy3k, dns, idna, ipaddress }:
+{ stdenv, lib, buildPythonPackage, fetchPypi, isPy3k, dnspython, idna, ipaddress }:
 
 buildPythonPackage rec {
   pname = "email_validator";
@@ -13,7 +13,7 @@ buildPythonPackage rec {
   doCheck = false;
 
   propagatedBuildInputs = [
-    dns
+    dnspython
     idna
   ] ++ (if isPy3k then [ ] else [ ipaddress ]);
 
diff --git a/pkgs/development/python-modules/gurobipy/darwin.nix b/pkgs/development/python-modules/gurobipy/darwin.nix
new file mode 100644
index 000000000000..9d7374bd5bd4
--- /dev/null
+++ b/pkgs/development/python-modules/gurobipy/darwin.nix
@@ -0,0 +1,34 @@
+{ stdenv, fetchurl, python, xar, cpio, cctools, insert_dylib }:
+assert python.pkgs.isPy27 && python.ucsEncoding == 2;
+stdenv.mkDerivation
+  { name = "gurobipy-7.0.2";
+    src = fetchurl
+      { url = "http://packages.gurobi.com/7.0/gurobi7.0.2_mac64.pkg";
+        sha256 = "14dpxas6gx02kfb28i0fh68p1z4sbjmwg8hp8h5ch6c701h260mg";
+      };
+    buildInputs = [ xar cpio cctools insert_dylib ];
+    buildCommand =
+      ''
+        # Unpack
+        xar -xf $src
+        zcat gurobi*mac64tar.pkg/Payload | cpio -i
+        tar xf gurobi*_mac64.tar.gz
+
+        # Install
+        cd gurobi*/mac64
+        mkdir -p $out/lib/python2.7/site-packages
+        mv lib/python2.7/gurobipy $out/lib/python2.7/site-packages
+        mv lib/lib*.so $out/lib
+
+        # Fixup
+        install_name_tool -change \
+          /System/Library/Frameworks/Python.framework/Versions/2.7/Python \
+          ${python}/lib/libpython2.7.dylib \
+          $out/lib/python2.7/site-packages/gurobipy/gurobipy.so
+        install_name_tool -change libgurobi70.so \
+          $out/lib/libgurobi70.so \
+          $out/lib/python2.7/site-packages/gurobipy/gurobipy.so
+        insert_dylib --inplace $out/lib/libaes70.so \
+          $out/lib/python2.7/site-packages/gurobipy/gurobipy.so
+      '';
+  }
diff --git a/pkgs/development/python-modules/gurobipy/linux.nix b/pkgs/development/python-modules/gurobipy/linux.nix
new file mode 100644
index 000000000000..f65ae4a2ed2e
--- /dev/null
+++ b/pkgs/development/python-modules/gurobipy/linux.nix
@@ -0,0 +1,33 @@
+{ stdenv, fetchurl, python }:
+assert python.pkgs.isPy27;
+let utf =
+  if python.ucsEncoding == 2 then "16"
+  else if python.ucsEncoding == 4 then "32"
+  else throw "Unsupported python UCS encoding UCS${toString python.ucsEncoding}";
+in stdenv.mkDerivation
+  { name = "gurobipy-7.0.2";
+    src = fetchurl
+      { url = "http://packages.gurobi.com/7.0/gurobi7.0.2_linux64.tar.gz";
+        sha256 = "1lgdj4cncjvnnw8dppiax7q2j8121pxyg9iryj8v26mrk778dnmn";
+      };
+    buildCommand =
+      ''
+        # Unpack
+        tar xf $src
+
+        # Install
+        cd gurobi*/linux64
+        mkdir -p $out/lib/python2.7/site-packages
+        mv lib/python2.7_utf${utf}/gurobipy \
+          $out/lib/python2.7/site-packages
+        mv lib/python2.7_utf${utf}/gurobipy.so \
+          $out/lib/python2.7/site-packages/gurobipy
+        mv lib/libaes*.so* lib/libgurobi*.so* $out/lib
+
+        # Fixup
+        patchelf --set-rpath $out/lib \
+          $out/lib/python2.7/site-packages/gurobipy/gurobipy.so
+        patchelf --add-needed libaes70.so \
+          $out/lib/python2.7/site-packages/gurobipy/gurobipy.so
+      '';
+  }
diff --git a/pkgs/development/python-modules/libvirt/default.nix b/pkgs/development/python-modules/libvirt/default.nix
new file mode 100644
index 000000000000..5dc33d2d93e1
--- /dev/null
+++ b/pkgs/development/python-modules/libvirt/default.nix
@@ -0,0 +1,26 @@
+{ stdenv, buildPythonPackage, fetchurl, python, pkgconfig, lxml, libvirt, nose }:
+
+buildPythonPackage rec {
+  pname = "libvirt";
+  version = "3.10.0";
+
+  src = assert version == libvirt.version; fetchurl {
+    url = "http://libvirt.org/sources/python/${pname}-python-${version}.tar.gz";
+    sha256 = "1l0fgqjnx76pzkhq540x9sf5fgzlrn0dpay90j2m4iq8nkclcbpw";
+  };
+
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libvirt lxml ];
+
+  checkInputs = [ nose ];
+  checkPhase = ''
+    nosetests
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = http://www.libvirt.org/;
+    description = "libvirt Python bindings";
+    license = licenses.lgpl2;
+    maintainers = [ maintainers.fpletz ];
+  };
+}
diff --git a/pkgs/development/python-modules/salmon/default.nix b/pkgs/development/python-modules/salmon/default.nix
index 2169689f3d47..f9d7f79164ac 100644
--- a/pkgs/development/python-modules/salmon/default.nix
+++ b/pkgs/development/python-modules/salmon/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildPythonPackage, fetchFromGitHub, pythonOlder, nose, dns
+{ stdenv, buildPythonPackage, fetchFromGitHub, pythonOlder, nose, dnspython
 ,  chardet, lmtpd, pythondaemon, six, jinja2, mock }:
 
 buildPythonPackage rec {
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   };
 
   checkInputs = [ nose jinja2 mock ];
-  propagatedBuildInputs = [ chardet dns lmtpd pythondaemon six ];
+  propagatedBuildInputs = [ chardet dnspython lmtpd pythondaemon six ];
 
   meta = with stdenv.lib; {
     homepage = http://salmon-mail.readthedocs.org/;
diff --git a/pkgs/development/tools/build-managers/gradle/default.nix b/pkgs/development/tools/build-managers/gradle/default.nix
index 8568b218f37e..77f2e561317b 100644
--- a/pkgs/development/tools/build-managers/gradle/default.nix
+++ b/pkgs/development/tools/build-managers/gradle/default.nix
@@ -52,12 +52,12 @@ rec {
   };
 
   gradle_latest = gradleGen rec {
-    name = "gradle-4.3.1";
+    name = "gradle-4.4";
     nativeVersion = "0.14";
 
     src = fetchurl {
       url = "http://services.gradle.org/distributions/${name}-bin.zip";
-      sha256 = "1irsv5c4g0c8iln5hiikjr78rj1w2hjgyar5dp8a54h3rscf1sqm";
+      sha256 = "0bqaksrxrshqjwba0wj72gbcxvcchjavlj39xh18qpkz5jp76j7s";
     };
   };
 
diff --git a/pkgs/development/tools/build-managers/sbt-extras/default.nix b/pkgs/development/tools/build-managers/sbt-extras/default.nix
index fbbca9a0cfe4..bea20863e7f1 100644
--- a/pkgs/development/tools/build-managers/sbt-extras/default.nix
+++ b/pkgs/development/tools/build-managers/sbt-extras/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, which, curl, makeWrapper }:
+{ stdenv, fetchFromGitHub, which, curl, makeWrapper, jdk }:
 
 let
   rev = "77686b3dfa20a34270cc52377c8e37c3a461e484";
@@ -21,9 +21,12 @@ stdenv.mkDerivation {
 
   installPhase = ''
     mkdir -p $out/bin
+
+    substituteInPlace bin/sbt --replace 'declare java_cmd="java"' 'declare java_cmd="${jdk}/bin/java"'
+
     install bin/sbt $out/bin
 
-    wrapProgram $out/bin/sbt --prefix PATH : ${stdenv.lib.makeBinPath [ which curl]}
+    wrapProgram $out/bin/sbt --prefix PATH : ${stdenv.lib.makeBinPath [ which curl ]}
   '';
 
   meta = {
diff --git a/pkgs/games/simutrans/default.nix b/pkgs/games/simutrans/default.nix
index 02f6026371fe..9ea23423673a 100644
--- a/pkgs/games/simutrans/default.nix
+++ b/pkgs/games/simutrans/default.nix
@@ -4,7 +4,7 @@
 
 let
   # Choose your "paksets" of objects, images, text, music, etc.
-  paksets = config.simutrans.paksets or "pak64 pak128";
+  paksets = config.simutrans.paksets or "pak64 pak64.japan pak128 pak128.britain pak128.german";
 
   result = with stdenv.lib; withPaks (
     if paksets == "*" then attrValues pakSpec # taking all
@@ -12,15 +12,15 @@ let
   );
 
   ver1 = "120";
-  ver2 = "1";
-  ver3 = "1";
+  ver2 = "2";
+  ver3 = "2";
   version =   "${ver1}.${ver2}.${ver3}";
   ver_dash =  "${ver1}-${ver2}-${ver3}";
   ver2_dash = "${ver1}-${ver2}";
 
   binary_src = fetchurl {
     url = "mirror://sourceforge/simutrans/simutrans/${ver_dash}/simutrans-src-${ver_dash}.zip";
-    sha256 = "00cyxbn17r9p1f08jvx1wrhydxknkrxj5wk6ld912yicfql998r0";
+    sha256 = "1yi6rwbrnfd65qfz63cncw2n56pbypvg6cllwh71mgvs6x2c28kz";
   };
 
 
@@ -29,22 +29,21 @@ let
     (pakName: attrs: mkPak (attrs // {inherit pakName;}))
   {
     pak64 = {
-      # No release for 120.1 yet!
-      srcPath = "120-0/simupak64-120-0-1";
-      sha256 = "0y5v1ncpjyhjkkznqmk13kg5d0slhjbbvg1y8q5jxhmhlkghk9q2";
+      srcPath = "120-2/simupak64-120-2";
+      sha256 = "1s310pssar4s1nf6gi9cizbx4m75avqm2qk039ha5rk8jk4lzkmk";
     };
     "pak64.japan" = {
-      # No release for 120.1 yet!
+      # No release for 120.2 yet!
       srcPath = "120-0/simupak64.japan-120-0-1";
       sha256 = "14swy3h4ij74bgaw7scyvmivfb5fmp21nixmhlpk3mav3wr3167i";
     };
 
     pak128 = {
-      srcPath = "pak128%20for%20ST%20120%20%282.5.3%2C%20minor%20changes%29/pak128-2.5.3--ST120";
-      sha256 = "19c66wvfg6rn7s9awi99cfp83hs9d8dmsjlmgn8m91a19fp9isdh";
+      srcPath = "pak128%20for%20ST%20120.2.2%20%282.7%2C%20minor%20changes%29/pak128";
+      sha256 = "1x6g6yfv1hvjyh3ciccly1i2k2n2b63dw694gdg4j90a543rmclg";
     };
     "pak128.britain" = {
-      srcPath = "pak128.Britain%20for%20${ver2_dash}/pak128.Britain.1.17-${ver2_dash}";
+      srcPath = "pak128.Britain%20for%20120-1/pak128.Britain.1.17-120-1";
       sha256 = "1nviwqizvch9n3n826nmmi7c707dxv0727m7lhc1n2zsrrxcxlr5";
     };
     "pak128.cs" = { # note: it needs pak128 to work
@@ -53,8 +52,8 @@ let
     };
     "pak128.german" = {
       url = "mirror://sourceforge/simutrans/PAK128.german/"
-        + "PAK128.german_0.8_${ver1}.x/PAK128.german_0.8.0_${ver1}.x.zip";
-      sha256 = "1a8pc88vi59zlvff9i1f8nphdmisqmgg03qkdvrf5ks46aw8j6s5";
+        + "PAK128.german_0.10.x_for_ST_120.x/PAK128.german_0.10.3_for_ST_120.x.zip";
+      sha256 = "1379zcviyf3v0wsli33sqa509k6zlw6fkk57vahc44mrnhka5fpb";
     };
 
     /* This release contains accented filenames that prevent unzipping.
diff --git a/pkgs/os-specific/darwin/insert_dylib/default.nix b/pkgs/os-specific/darwin/insert_dylib/default.nix
index 293572655b98..b3790b8c87c3 100644
--- a/pkgs/os-specific/darwin/insert_dylib/default.nix
+++ b/pkgs/os-specific/darwin/insert_dylib/default.nix
@@ -15,4 +15,5 @@ stdenv.mkDerivation
         mkdir -p $out/bin
         install -m755 $prog $out/bin
       '';
+    meta.platforms = stdenv.lib.platforms.darwin;
   }
diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix
index 862bf028cc2d..8d07fdb64625 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 import ./generic.nix (args // rec {
-  version = "4.14.4";
+  version = "4.14.5";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = concatStrings (intersperse "." (take 3 (splitString "." "${version}.0")));
@@ -13,6 +13,6 @@ import ./generic.nix (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "17m7ws3yp6f7ivi8n4gw0i10wf77bb37r7s6jbijg6nsj3vvz49a";
+    sha256 = "1nkm54h6sr9bwhm67iy8jk3vklkgxs1sxjpj9wyxb69l0fya72fm";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix
index e247392e6c70..04fc40638d78 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,11 +1,11 @@
 { stdenv, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "4.4.104";
+  version = "4.4.105";
   extraMeta.branch = "4.4";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0bhc4ay8ikvhqxj191mbm5kshh2zj46n5snwfa1d6bqzdkgg5s5h";
+    sha256 = "0h0ivdw74m3s2j9llh0hnigv790jgy6lhcf6jn2csxmvg3ai5sfn";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
index cfaac832ac4c..5956d197836c 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,11 +1,11 @@
 { stdenv, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "4.9.67";
+  version = "4.9.68";
   extraMeta.branch = "4.9";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0zazyxn3q8bpinqvxjqkxg721vgzyk9agfbgr6hdyxvqq7fagfkz";
+    sha256 = "0462cs1n04mw3df216q4qqxjgrhn76rdrnsdnf8myiccgmin0zyv";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-hardened-copperhead.nix b/pkgs/os-specific/linux/kernel/linux-hardened-copperhead.nix
index 707ed10ea0c3..365f6ce54a07 100644
--- a/pkgs/os-specific/linux/kernel/linux-hardened-copperhead.nix
+++ b/pkgs/os-specific/linux/kernel/linux-hardened-copperhead.nix
@@ -3,9 +3,9 @@
 with stdenv.lib;
 
 let
-  version = "4.14.3";
+  version = "4.14.4";
   revision = "a";
-  sha256 = "18pcmi927gw4a0ih09fq1wv0jbzp1z42a8kga8ralcac828i6gi3";
+  sha256 = "1h99nhm3yd528gj0wg71lzi8v314r6r00m8zh2cw2sz82k7fds4w";
 
   # modVersion needs to be x.y.z, will automatically add .0 if needed
   modVersion = concatStrings (intersperse "." (take 3 (splitString "." "${version}.0")));
diff --git a/pkgs/os-specific/linux/uclibc/default.nix b/pkgs/os-specific/linux/uclibc/default.nix
index 4cbb83cf00cf..c4d2bf04d7a0 100644
--- a/pkgs/os-specific/linux/uclibc/default.nix
+++ b/pkgs/os-specific/linux/uclibc/default.nix
@@ -76,7 +76,7 @@ stdenv.mkDerivation {
     ${if cross != null then stdenv.lib.attrByPath [ "uclibc" "extraConfig" ] "" cross else ""}
     $extraCrossConfig
     EOF
-    make oldconfig </dev/null
+    ( set +o pipefail; yes "" | make oldconfig )
   '';
 
   hardeningDisable = [ "stackprotector" ];
diff --git a/pkgs/servers/http/lighttpd/default.nix b/pkgs/servers/http/lighttpd/default.nix
index c3e15ed846db..0bfd50a9d1ab 100644
--- a/pkgs/servers/http/lighttpd/default.nix
+++ b/pkgs/servers/http/lighttpd/default.nix
@@ -7,11 +7,11 @@ assert enableMagnet -> lua5_1 != null;
 assert enableMysql -> mysql != null;
 
 stdenv.mkDerivation rec {
-  name = "lighttpd-1.4.45";
+  name = "lighttpd-1.4.48";
 
   src = fetchurl {
     url = "http://download.lighttpd.net/lighttpd/releases-1.4.x/${name}.tar.xz";
-    sha256 = "0grsqh7pdqnjx6xicd96adsx84vryb7c4n21dnxfygm3xrfj55qw";
+    sha256 = "0djgsx06x3p22rjvzml5klq7gqd9nk88qzlxifa7p7ajqymdb2hg";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/servers/mail/mailman/default.nix b/pkgs/servers/mail/mailman/default.nix
index d64e41f30071..8ff20869b94e 100644
--- a/pkgs/servers/mail/mailman/default.nix
+++ b/pkgs/servers/mail/mailman/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "1r6sjapjmbav45xibjzc2a8y1xf4ikz09470ma1kw7iz174wn8z7";
   };
 
-  buildInputs = [ python pythonPackages.dns ];
+  buildInputs = [ python pythonPackages.dnspython ];
 
   patches = [ ./fix-var-prefix.patch ];
 
diff --git a/pkgs/shells/nix-bash-completions/default.nix b/pkgs/shells/nix-bash-completions/default.nix
index 7de8be10c9b7..f9cd97e97354 100644
--- a/pkgs/shells/nix-bash-completions/default.nix
+++ b/pkgs/shells/nix-bash-completions/default.nix
@@ -1,19 +1,29 @@
 { stdenv, fetchFromGitHub }:
 
 stdenv.mkDerivation rec {
-  version = "0.6";
+  version = "0.6.1";
   name = "nix-bash-completions-${version}";
 
   src = fetchFromGitHub {
     owner = "hedning";
     repo = "nix-bash-completions";
     rev = "v${version}";
-    sha256 = "093rla6wwx51fclh7xm8qlssx70hj0fj23r59qalaaxf7fdzg2hf";
+    sha256 = "10nzdn249f0cw6adgpbpg4x90ysvxm7vs9jjbbwynfh9kngijp64";
   };
 
+  # To enable lazy loading via. bash-completion we need a symlink to the script
+  # from every command name.
   installPhase = ''
-    mkdir -p $out/share/bash-completion/completions
-    cp _nix $out/share/bash-completion/completions
+    commands=$(
+      function complete() { shift 2; echo "$@"; }
+      shopt -s extglob
+      source _nix
+    )
+    install -Dm444 -t $out/share/bash-completion/completions _nix
+    cd $out/share/bash-completion/completions
+    for c in $commands; do
+      ln -s _nix $c
+    done
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/stdenv/generic/check-meta.nix b/pkgs/stdenv/generic/check-meta.nix
index 03a85633ed61..b9d77d980a12 100644
--- a/pkgs/stdenv/generic/check-meta.nix
+++ b/pkgs/stdenv/generic/check-meta.nix
@@ -64,7 +64,7 @@ let
     !allowUnfreePredicate attrs;
 
   allowInsecureDefaultPredicate = x: builtins.elem x.name (config.permittedInsecurePackages or []);
-  allowInsecurePredicate = x: (config.allowUnfreePredicate or allowInsecureDefaultPredicate) x;
+  allowInsecurePredicate = x: (config.allowInsecurePredicate or allowInsecureDefaultPredicate) x;
 
   hasAllowedInsecure = attrs:
     (attrs.meta.knownVulnerabilities or []) == [] ||
diff --git a/pkgs/tools/admin/ansible/2.1.nix b/pkgs/tools/admin/ansible/2.1.nix
index 6232e4ad95ba..d4a349c5e47d 100644
--- a/pkgs/tools/admin/ansible/2.1.nix
+++ b/pkgs/tools/admin/ansible/2.1.nix
@@ -36,7 +36,7 @@ in buildPythonPackage rec {
   dontPatchShebangs = false;
 
   propagatedBuildInputs = [
-    pycrypto paramiko jinja pyyaml httplib2 boto six netaddr dns
+    pycrypto paramiko jinja pyyaml httplib2 boto six netaddr dnspython
   ] ++ stdenv.lib.optional windowsSupport pywinrm;
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/admin/ansible/2.2.nix b/pkgs/tools/admin/ansible/2.2.nix
index 02392d7ac89f..4ef35fa5d9eb 100644
--- a/pkgs/tools/admin/ansible/2.2.nix
+++ b/pkgs/tools/admin/ansible/2.2.nix
@@ -38,7 +38,7 @@ in buildPythonPackage rec {
   dontPatchShebangs = false;
 
   propagatedBuildInputs = [
-    pycrypto paramiko jinja pyyaml httplib2 boto six netaddr dns
+    pycrypto paramiko jinja pyyaml httplib2 boto six netaddr dnspython
   ] ++ stdenv.lib.optional windowsSupport pywinrm;
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/admin/ansible/2.3.nix b/pkgs/tools/admin/ansible/2.3.nix
index 7330b7d0858b..b827bdcc9c31 100644
--- a/pkgs/tools/admin/ansible/2.3.nix
+++ b/pkgs/tools/admin/ansible/2.3.nix
@@ -24,7 +24,7 @@ pythonPackages.buildPythonPackage rec {
   dontPatchShebangs = false;
 
   propagatedBuildInputs = with pythonPackages; [
-    pycrypto paramiko jinja2 pyyaml httplib2 boto six netaddr dns
+    pycrypto paramiko jinja2 pyyaml httplib2 boto six netaddr dnspython
   ] ++ stdenv.lib.optional windowsSupport pywinrm;
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/admin/ansible/2.4.nix b/pkgs/tools/admin/ansible/2.4.nix
index 9c8df647e593..4f90e80202e4 100644
--- a/pkgs/tools/admin/ansible/2.4.nix
+++ b/pkgs/tools/admin/ansible/2.4.nix
@@ -24,7 +24,7 @@ pythonPackages.buildPythonPackage rec {
   dontPatchShebangs = false;
 
   propagatedBuildInputs = with pythonPackages; [
-    pycrypto paramiko jinja2 pyyaml httplib2 boto six netaddr dns
+    pycrypto paramiko jinja2 pyyaml httplib2 boto six netaddr dnspython
   ] ++ stdenv.lib.optional windowsSupport pywinrm;
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/admin/cli53/default.nix b/pkgs/tools/admin/cli53/default.nix
index b9852ed587c5..e70a7ba9b50c 100644
--- a/pkgs/tools/admin/cli53/default.nix
+++ b/pkgs/tools/admin/cli53/default.nix
@@ -23,7 +23,7 @@ python2.pkgs.buildPythonApplication rec {
   propagatedBuildInputs = with python2.pkgs; [
     argparse
     boto
-    dns
+    dnspython
   ];
 
   meta = with lib; {
diff --git a/pkgs/tools/backup/borg/default.nix b/pkgs/tools/backup/borg/default.nix
index 867d2cf903a0..2dc84069d629 100644
--- a/pkgs/tools/backup/borg/default.nix
+++ b/pkgs/tools/backup/borg/default.nix
@@ -2,13 +2,13 @@
 
 python3Packages.buildPythonApplication rec {
   name = "borgbackup-${version}";
-  version = "1.1.1";
+  version = "1.1.3";
   namePrefix = "";
 
   src = fetchurl {
     url = "https://github.com/borgbackup/borg/releases/download/"
       + "${version}/${name}.tar.gz";
-    sha256 = "0iik5lq349cl87imlwra2pp0j36wjhpn8r1d3778azvvqpyjq2d5";
+    sha256 = "1rvn8b6clzd1r317r9jkvk34r31risi0dxfjc7jffhnwasck4anc";
   };
 
   nativeBuildInputs = with python3Packages; [
diff --git a/pkgs/tools/graphics/gnuplot/default.nix b/pkgs/tools/graphics/gnuplot/default.nix
index 0dcaa49487dd..8aa14220250f 100644
--- a/pkgs/tools/graphics/gnuplot/default.nix
+++ b/pkgs/tools/graphics/gnuplot/default.nix
@@ -1,4 +1,5 @@
-{ lib, stdenv, fetchurl, zlib, gd, texinfo4, makeWrapper, readline
+{ lib, stdenv, fetchurl, makeWrapper, pkgconfig, texinfo
+, cairo, gd, libcerf, pango, readline, zlib
 , withTeXLive ? false, texlive
 , withLua ? false, lua
 , emacs ? null
@@ -8,13 +9,11 @@
 , libXaw ? null
 , aquaterm ? false
 , withWxGTK ? false, wxGTK ? null
-, pango ? null
-, cairo ? null
-, pkgconfig ? null
 , fontconfig ? null
 , gnused ? null
 , coreutils ? null
-, withQt ? false, qt }:
+, withQt ? false, qttools, qtbase, qtsvg
+}:
 
 assert libX11 != null -> (fontconfig != null && gnused != null && coreutils != null);
 let
@@ -28,19 +27,26 @@ stdenv.mkDerivation rec {
     sha256 = "18diyy7aib9mn098x07g25c7jij1x7wbfpicz0z8gwxx08px45m4";
   };
 
+  nativeBuildInputs = [ makeWrapper pkgconfig texinfo ] ++ lib.optional withQt qttools;
+
   buildInputs =
-    [ zlib gd texinfo4 readline pango cairo pkgconfig makeWrapper ]
+    [ cairo gd libcerf pango readline zlib ]
     ++ lib.optional withTeXLive (texlive.combine { inherit (texlive) scheme-small; })
     ++ lib.optional withLua lua
     ++ lib.optionals withX [ libX11 libXpm libXt libXaw ]
-    ++ lib.optional withQt qt
-    # compiling with wxGTK causes a malloc (double free) error on darwin
-    ++ lib.optional (withWxGTK && !stdenv.isDarwin) wxGTK;
+    ++ lib.optionals withQt [ qtbase qtsvg ]
+    ++ lib.optional withWxGTK wxGTK;
+
+  postPatch = ''
+    # lrelease is in qttools, not in qtbase.
+    substituteInPlace configure --replace '$'{QT5LOC}/lrelease lrelease
+  '';
 
-  configureFlags =
-    (if withX then ["--with-x"] else ["--without-x"])
-    ++ (if withQt then ["--enable-qt"] else ["--disable-qt"])
-    ++ (if aquaterm then ["--with-aquaterm"] else ["--without-aquaterm"]);
+  configureFlags = [
+    (if withX then "--with-x" else "--without-x")
+    (if withQt then "--with-qt=qt5" else "--without-qt")
+    (if aquaterm then "--with-aquaterm" else "--without-aquaterm")
+  ];
 
   postInstall = lib.optionalString withX ''
     wrapProgram $out/bin/gnuplot \
@@ -50,6 +56,8 @@ stdenv.mkDerivation rec {
        --run '. ${./set-gdfontpath-from-fontconfig.sh}'
   '';
 
+  enableParallelBuilding = true;
+
   meta = with lib; {
     homepage = http://www.gnuplot.info/;
     description = "A portable command-line driven graphing utility for many platforms";
diff --git a/pkgs/tools/networking/network-manager/l2tp.nix b/pkgs/tools/networking/network-manager/l2tp.nix
index 91b4a5e8957f..b40afa605e3b 100644
--- a/pkgs/tools/networking/network-manager/l2tp.nix
+++ b/pkgs/tools/networking/network-manager/l2tp.nix
@@ -5,13 +5,13 @@
 stdenv.mkDerivation rec {
   name    = "${pname}${if withGnome then "-gnome" else ""}-${version}";
   pname   = "NetworkManager-l2tp";
-  version = "1.2.4";
+  version = "1.2.8";
 
   src = fetchFromGitHub {
     owner  = "nm-l2tp";
     repo   = "network-manager-l2tp";
     rev    = "${version}";
-    sha256 = "1mvn0z1vl4j9drl3dsw2dv0pppqvj29d2m07487dzzi8cbxrqj36";
+    sha256 = "110157dpamgr7r5kb8aidi0a2ap9z2m52bff94fb4nhxacz69yv8";
   };
 
   buildInputs = [ networkmanager ppp libsecret ]
@@ -31,13 +31,18 @@ stdenv.mkDerivation rec {
     intltoolize -f
   '';
 
-  configureFlags =
-    if withGnome then "--with-gnome" else "--without-gnome";
+  configureFlags = [
+    "--with-gnome=${if withGnome then "yes" else "no"}"
+    "--localstatedir=/var"
+    "--sysconfdir=$(out)/etc"
+  ];
+
+  enableParallelBuilding = true;
 
   meta = with stdenv.lib; {
     description = "L2TP plugin for NetworkManager";
     inherit (networkmanager.meta) platforms;
-    homepage = https://github.com/seriyps/NetworkManager-l2tp;
+    homepage = https://github.com/nm-l2tp/network-manager-l2tp;
     license = licenses.gpl2;
     maintainers = with maintainers; [ abbradar obadz ];
   };
diff --git a/pkgs/tools/security/hash-slinger/default.nix b/pkgs/tools/security/hash-slinger/default.nix
index 4d60b11f977c..fd78d9b2efbf 100644
--- a/pkgs/tools/security/hash-slinger/default.nix
+++ b/pkgs/tools/security/hash-slinger/default.nix
@@ -14,7 +14,7 @@ in stdenv.mkDerivation rec {
     sha256 = "05wn744ydclpnpyah6yfjqlfjlasrrhzj48lqmm5a91nyps5yqyn";
   };
 
-  pythonPath = with pythonPackages; [ dns m2crypto ipaddr python-gnupg
+  pythonPath = with pythonPackages; [ dnspython m2crypto ipaddr python-gnupg
                                       pyunbound ];
 
   buildInputs = [ pythonPackages.wrapPython ];
diff --git a/pkgs/tools/typesetting/tex/tetex/default.nix b/pkgs/tools/typesetting/tex/tetex/default.nix
index 313474745d10..ac317fd51dcb 100644
--- a/pkgs/tools/typesetting/tex/tetex/default.nix
+++ b/pkgs/tools/typesetting/tex/tetex/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation {
     find ./ -name "config.guess" -exec rm {} \; -exec ln -s ${automake}/share/automake-*/config.guess {} \;
   '' else null;
 
-  patches = [ ./environment.patch ./getline.patch ./clang.patch ];
+  patches = [ ./environment.patch ./getline.patch ./clang.patch ./extramembot.patch ];
 
   setupHook = ./setup-hook.sh;
 
diff --git a/pkgs/tools/typesetting/tex/tetex/extramembot.patch b/pkgs/tools/typesetting/tex/tetex/extramembot.patch
new file mode 100644
index 000000000000..f6c954fcfa5c
--- /dev/null
+++ b/pkgs/tools/typesetting/tex/tetex/extramembot.patch
@@ -0,0 +1,12 @@
+diff -up texlive-2007/texk/web2c/tex.ch.extramembot texlive-2007/texk/web2c/tex.ch
+--- texlive-2007/texk/web2c/tex.ch.extramembot	2006-12-19 02:11:11.000000000 +0100
++++ texlive-2007/texk/web2c/tex.ch	2011-11-30 12:03:32.052795763 +0100
+@@ -365,7 +365,7 @@ for i:=@'177 to @'377 do xchr[i]:=i;
+ {Initialize enc\TeX\ data.}
+ for i:=0 to 255 do mubyte_read[i]:=null;
+ for i:=0 to 255 do mubyte_write[i]:=0;
+-for i:=0 to 128 do mubyte_cswrite[i]:=null;
++for i:=0 to 127 do mubyte_cswrite[i]:=null;
+ mubyte_keep := 0; mubyte_start := false; 
+ write_noexpanding := false; cs_converting := false;
+ special_printing := false; message_printing := false;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2d5a4ec25127..6e0da9616371 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2342,7 +2342,7 @@ with pkgs;
   };
   gnupg = gnupg22;
 
-  gnuplot = callPackage ../tools/graphics/gnuplot { qt = qt4; };
+  gnuplot = libsForQt5.callPackage ../tools/graphics/gnuplot { };
 
   gnuplot_qt = gnuplot.override { withQt = true; };
 
@@ -6264,7 +6264,7 @@ with pkgs;
 
   metaocaml_3_09 = callPackage ../development/compilers/ocaml/metaocaml-3.09.nix { };
 
-  ber_metaocaml_003 = callPackage ../development/compilers/ocaml/ber-metaocaml-003.nix { };
+  ber_metaocaml = callPackage ../development/compilers/ocaml/ber-metaocaml-104.nix { };
 
   ocaml_make = callPackage ../development/ocaml-modules/ocamlmake { };
 
@@ -9010,6 +9010,8 @@ with pkgs;
 
   libcello = callPackage ../development/libraries/libcello {};
 
+  libcerf = callPackage ../development/libraries/libcerf {};
+
   libcdaudio = callPackage ../development/libraries/libcdaudio { };
 
   libcddb = callPackage ../development/libraries/libcddb { };
@@ -13910,8 +13912,7 @@ with pkgs;
   altcoins = recurseIntoAttrs ( callPackage ../applications/altcoins { } );
   bitcoin = altcoins.bitcoin;
   bitcoin-xt = altcoins.bitcoin-xt;
-
-  cryptop = callPackage ../applications/altcoins/cryptop { };
+  cryptop = altcoins.cryptop;
 
   libbitcoin = callPackage ../tools/misc/libbitcoin/libbitcoin.nix {
     secp256k1 = secp256k1.override { enableECDH = true; };
@@ -15787,6 +15788,8 @@ with pkgs;
 
   monero = callPackage ../applications/misc/monero { };
 
+  xmr-stak = callPackage ../applications/misc/xmr-stak { };
+
   monkeysAudio = callPackage ../applications/audio/monkeys-audio { };
 
   monkeysphere = callPackage ../tools/security/monkeysphere { };
@@ -16514,14 +16517,8 @@ with pkgs;
 
   rawtherapee = callPackage ../applications/graphics/rawtherapee {
     fftw = fftwSinglePrec;
-    cmake = cmake_2_8; # problems after 3.4 -> 3.6.0
   };
 
-  rawtherapee-git = lowPrio (callPackage ../applications/graphics/rawtherapee/dev.nix {
-    fftw = fftwSinglePrec;
-    cmake = cmake_2_8; # problems after 3.4 -> 3.6.0
-  });
-
   rclone = callPackage ../applications/networking/sync/rclone { };
 
   rcs = callPackage ../applications/version-management/rcs { };
@@ -19435,6 +19432,8 @@ with pkgs;
 
   kompose = callPackage ../applications/networking/cluster/kompose { };
 
+  kontemplate = callPackage ../applications/networking/cluster/kontemplate { };
+
   kops = callPackage ../applications/networking/cluster/kops { };
 
   lilypond = callPackage ../misc/lilypond { guile = guile_1_8; };
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 2003f30ef2e2..52a921dcc0ed 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -369,7 +369,7 @@ let
 
     magick = callPackage ../development/ocaml-modules/magick { };
 
-    markup = callPackage ../development/ocaml-modules/markup { lwt = lwt2; };
+    markup = callPackage ../development/ocaml-modules/markup { lwt = ocaml_lwt; };
 
     menhir = callPackage ../development/ocaml-modules/menhir { };
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 8affc1249bfb..188fe7440db7 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4523,7 +4523,8 @@ in {
 
   discogs_client = callPackage ../development/python-modules/discogs_client { };
 
-  dns = callPackage ../development/python-modules/dns { };
+  dnspython = callPackage ../development/python-modules/dnspython { };
+  dns = self.dnspython; # Alias for compatibility, 2017-12-10
 
   docker = callPackage ../development/python-modules/docker {};
 
@@ -5600,6 +5601,14 @@ in {
     };
   };
 
+  gurobipy = if stdenv.system == "x86_64-darwin"
+  then callPackage ../development/python-modules/gurobipy/darwin.nix {
+    inherit (pkgs.darwin) cctools insert_dylib;
+  }
+  else if stdenv.system == "x86_64-linux"
+  then callPackage ../development/python-modules/gurobipy/linux.nix {}
+  else throw "gurobipy not yet supported on ${stdenv.system}";
+
   helper = buildPythonPackage rec {
     pname = "helper";
     version = "2.4.1";
@@ -11830,7 +11839,7 @@ in {
     name = "sleekxmpp-${version}";
     version = "1.3.1";
 
-    propagatedBuildInputs = with self ; [ dns pyasn1 ];
+    propagatedBuildInputs = with self ; [ dnspython pyasn1 ];
 
     src = pkgs.fetchurl {
       url = "mirror://pypi/s/sleekxmpp/${name}.tar.gz";
@@ -16674,7 +16683,7 @@ in {
 
     buildInputs = with self; [ nose mock pyopenssl ];
 
-    propagatedBuildInputs = with self; [ urllib3 dns];
+    propagatedBuildInputs = with self; [ urllib3 dnspython ];
 
     postPatch = ''
       sed -i '19s/dns/"dnspython"/' setup.py
@@ -18544,7 +18553,7 @@ in {
 
     nativeBuildInputs = [ pkgs.pkgconfig ];
     buildInputs = with pkgs; [ alsaLib ffmpeg libv4l sqlite libvpx ];
-    propagatedBuildInputs = with self; [ cython pkgs.openssl dns dateutil xcaplib msrplib lxml python-otr ];
+    propagatedBuildInputs = with self; [ cython pkgs.openssl dnspython dateutil xcaplib msrplib lxml python-otr ];
   };
 
 
@@ -21881,29 +21890,8 @@ EOF
     };
   };
 
-  libvirt = let
-    version = "3.8.0";
-  in assert version == pkgs.libvirt.version; pkgs.stdenv.mkDerivation rec {
-    name = "libvirt-python-${version}";
-
-    src = pkgs.fetchurl {
-      url = "http://libvirt.org/sources/python/${name}.tar.gz";
-      sha256 = "02spx8kfcsnqwsshd7bk2plyic2lbpwzg16sf3csh0avck5akjsz";
-    };
-
-    nativeBuildInputs = [ pkgs.pkgconfig ];
-    buildInputs = with self; [ python pkgs.libvirt lxml ];
-
-    buildPhase = "${python.interpreter} setup.py build";
-
-    installPhase = "${python.interpreter} setup.py install --prefix=$out";
-
-    meta = {
-      homepage = http://www.libvirt.org/;
-      description = "libvirt Python bindings";
-      license = licenses.lgpl2;
-      maintainers = [ maintainers.fpletz ];
-    };
+  libvirt = callPackage ../development/python-modules/libvirt {
+    inherit (pkgs) libvirt;
   };
 
   rpdb = buildPythonPackage rec {
diff --git a/pkgs/top-level/splice.nix b/pkgs/top-level/splice.nix
index b13fa86a9958..ea81b110080d 100644
--- a/pkgs/top-level/splice.nix
+++ b/pkgs/top-level/splice.nix
@@ -37,24 +37,26 @@ let
       inherit name;
       value = let
         defaultValue = mash.${name};
+        # `or {}` is for the non-derivation attsert splicing case, where `{}` is the identity.
         buildValue = buildPkgs.${name} or {};
         runValue = runPkgs.${name} or {};
         augmentedValue = defaultValue
           // (lib.optionalAttrs (buildPkgs ? ${name}) { nativeDrv = buildValue; })
           // (lib.optionalAttrs (runPkgs ? ${name}) { crossDrv = runValue; });
-        # Get the set of outputs of a derivation
+        # Get the set of outputs of a derivation. If one derivation fails to
+        # evaluate we don't want to diverge the entire splice, so we fall back
+        # on {}
+        tryGetOutputs = value0: let
+          inherit (builtins.tryEval value0) success value;
+        in getOutputs (lib.optionalAttrs success value);
         getOutputs = value: lib.genAttrs
           (value.outputs or (lib.optional (value ? out) "out"))
           (output: value.${output});
       in
-        # Certain *Cross derivations will fail assertions, but we need their
-        # nativeDrv. We are assuming anything that fails to evaluate is an
-        # attrset (including derivation) and thus can be unioned.
-        if !(builtins.tryEval defaultValue).success then augmentedValue
         # The derivation along with its outputs, which we recur
         # on to splice them together.
-        else if lib.isDerivation defaultValue then augmentedValue
-          // splicer (getOutputs buildValue) (getOutputs runValue)
+        if lib.isDerivation defaultValue then augmentedValue
+          // splicer (tryGetOutputs buildValue) (getOutputs runValue)
         # Just recur on plain attrsets
         else if lib.isAttrs defaultValue then splicer buildValue runValue
         # Don't be fancy about non-derivations. But we could have used used