Merge branch 'master' into staging

2016-12-22 11:28:56 +01:00 · 2016-12-22 11:28:56 +01:00 · 2e03ae274d
parent 41f55691a9 0c1382085b
commit 2e03ae274d
73 changed files with 1676 additions and 990 deletions
--- a/doc/languages-frameworks/python.md
+++ b/doc/languages-frameworks/python.md
@ -97,7 +97,7 @@ We will first have a look at how Python packages are packaged on Nix. Then, we w

 #### Python packaging on Nix

-On Nix all packages are built by functions. The main function in Nix for building Python packages is [`buildPythonPackage`](https://github.com/NixOS/nixpkgs/blob/master/pkgs/development/python-modules/generic/default.nix).
+On Nix all packages are built by functions. The main function in Nix for building Python packages is [`buildPythonPackage`](https://github.com/NixOS/nixpkgs/blob/master/pkgs/development/interpreters/python/build-python-package.nix).
 Let's see how we would build the `toolz` package. According to [`python-packages.nix`](https://raw.githubusercontent.com/NixOS/nixpkgs/master/pkgs/top-level/python-packages.nix) `toolz` is build using

 ```nix
@ -141,13 +141,15 @@ with import <nixpkgs> {};

 pkgs.python35Packages.buildPythonPackage rec {
  name = "toolz-${version}";
-  version = "0.7.4";
+  version = "0.8.0";

  src = pkgs.fetchurl{
    url = "mirror://pypi/t/toolz/toolz-${version}.tar.gz";
-    sha256 = "43c2c9e5e7a16b6c88ba3088a9bfc82f7db8e13378be7c78d6c14a5f8ed05afd";
+    sha256 = "e8451af61face57b7c5d09e71c0d27b8005f001ead56e9fdf470417e5cc6d479";
  };

+  doCheck = false;
+
  meta = {
    homepage = "http://github.com/pytoolz/toolz/";
    description = "List processing tools and functional utilities";
@ -170,18 +172,18 @@ with import <nixpkgs> {};
 ( let
    toolz = pkgs.python35Packages.buildPythonPackage rec {
      name = "toolz-${version}";
-      version = "0.7.4";
+      version = "0.8.0";

      src = pkgs.fetchurl{
        url = "mirror://pypi/t/toolz/toolz-${version}.tar.gz";
-        sha256 = "43c2c9e5e7a16b6c88ba3088a9bfc82f7db8e13378be7c78d6c14a5f8ed05afd";
+        sha256 = "e8451af61face57b7c5d09e71c0d27b8005f001ead56e9fdf470417e5cc6d479";
      };

+      doCheck = false;
+
      meta = {
        homepage = "http://github.com/pytoolz/toolz/";
        description = "List processing tools and functional utilities";
-        license = licenses.bsd3;
-        maintainers = with maintainers; [ fridh ];
      };
    };

@ -308,11 +310,10 @@ Note also the line `doCheck = false;`, we explicitly disabled running the test-s

 #### Develop local package

-As a Python developer you're likely aware of [development mode](http://pythonhosted.org/setuptools/setuptools.html#development-mode) (`python setup.py develop`);
+As a Python developer you're likely aware of [development mode](http://setuptools.readthedocs.io/en/latest/setuptools.html#development-mode) (`python setup.py develop`);
 instead of installing the package this command creates a special link to the project code.
 That way, you can run updated code without having to reinstall after each and every change you make.
-Development mode is also available on Nix as [explained](http://nixos.org/nixpkgs/manual/#ssec-python-development) in the Nixpkgs manual.
-Let's see how you can use it.
+Development mode is also available. Let's see how you can use it.

 In the previous Nix expression the source was fetched from an url. We can also refer to a local source instead using

--- a/nixos/lib/make-system-tarball.sh
+++ b/nixos/lib/make-system-tarball.sh
@ -52,9 +52,10 @@ $extraCommands

 mkdir -p $out/tarball

-tar cvJf $out/tarball/$fileName.tar.xz * $extraArgs
+rm env-vars
+
+tar --sort=name --mtime='1970-01-01' -cvJf $out/tarball/$fileName.tar.xz * $extraArgs

 mkdir -p $out/nix-support
 echo $system > $out/nix-support/system
 echo "file system-tarball $out/tarball/$fileName.tar.xz" > $out/nix-support/hydra-build-products
-
--- a/nixos/modules/services/monitoring/prometheus/default.nix
+++ b/nixos/modules/services/monitoring/prometheus/default.nix
@ -25,9 +25,16 @@ let
    scrape_configs = cfg.scrapeConfigs;
  };

+  generatedPrometheusYml = writePrettyJSON "prometheus.yml" promConfig;
+
+  prometheusYml =
+    if cfg.configText != null then
+      pkgs.writeText "prometheus.yml" cfg.configText
+    else generatedPrometheusYml;
+
  cmdlineArgs = cfg.extraFlags ++ [
    "-storage.local.path=${cfg.dataDir}/metrics"
-    "-config.file=${writePrettyJSON "prometheus.yml" promConfig}"
+    "-config.file=${prometheusYml}"
    "-web.listen-address=${cfg.listenAddress}"
    "-alertmanager.notification-queue-capacity=${toString cfg.alertmanagerNotificationQueueCapacity}"
    "-alertmanager.timeout=${toString cfg.alertmanagerTimeout}s"
@ -359,6 +366,16 @@ in {
        '';
      };

+      configText = mkOption {
+        type = types.nullOr types.lines;
+        default = null;
+        description = ''
+          If non-null, this option defines the text that is written to
+          prometheus.yml. If null, the contents of prometheus.yml is generated
+          from the structured config options.
+        '';
+      };
+
      globalConfig = mkOption {
        type = promTypes.globalConfig;
        default = {};
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@ -278,7 +278,7 @@ in
        description =
          ''
            If enabled, the Nix store in the VM is made writable by
-            layering a unionfs-fuse/tmpfs filesystem on top of the host's Nix
+            layering an overlay filesystem on top of the host's Nix
            store.
          '';
      };
@ -395,6 +395,13 @@ in
        chmod 1777 $targetRoot/tmp

        mkdir -p $targetRoot/boot
+
+        ${optionalString cfg.writableStore ''
+          echo "mounting overlay filesystem on /nix/store..."
+          mkdir -p 0755 $targetRoot/nix/.rw-store/store $targetRoot/nix/.rw-store/work $targetRoot/nix/store
+          mount -t overlay overlay $targetRoot/nix/store \
+            -o lowerdir=$targetRoot/nix/.ro-store,upperdir=$targetRoot/nix/.rw-store/store,workdir=$targetRoot/nix/.rw-store/work || fail
+        ''}
      '';

    # After booting, register the closure of the paths in
@ -412,7 +419,8 @@ in
      '';

    boot.initrd.availableKernelModules =
-      optional (cfg.qemu.diskInterface == "scsi") "sym53c8xx";
+      optional cfg.writableStore "overlay"
+      ++ optional (cfg.qemu.diskInterface == "scsi") "sym53c8xx";

    virtualisation.bootDevice =
      mkDefault (if cfg.qemu.diskInterface == "scsi" then "/dev/sda" else "/dev/vda");
@ -447,12 +455,6 @@ in
            options = [ "trans=virtio" "version=9p2000.L" ];
            neededForBoot = true;
          };
-      } // optionalAttrs cfg.writableStore
-      { "/nix/store" =
-          { fsType = "unionfs-fuse";
-            device = "unionfs";
-            options = [ "allow_other" "cow" "nonempty" "chroot=/mnt-root" "max_files=32768" "hide_meta_files" "dirs=/nix/.rw-store=rw:/nix/.ro-store=ro" ];
-          };
      } // optionalAttrs (cfg.writableStore && cfg.writableStoreUseTmpfs)
      { "/nix/.rw-store" =
          { fsType = "tmpfs";
--- a/nixos/tests/kde5.nix
+++ b/nixos/tests/kde5.nix
@ -18,6 +18,7 @@ import ./make-test.nix ({ pkgs, ...} :
      };
    };
    services.xserver.desktopManager.kde5.enable = true;
+    virtualisation.writableStore = false; # FIXME
  };

  testScript = { nodes, ... }:
--- a/nixos/tests/prometheus.nix
+++ b/nixos/tests/prometheus.nix
@ -10,7 +10,7 @@ import ./make-test.nix {
        };
        scrapeConfigs = [{
          job_name = "prometheus";
-          target_groups = [{
+          static_configs = [{
            targets = [ "127.0.0.1:9090" ];
            labels = { instance = "localhost"; };
          }];
--- a/pkgs/applications/audio/game-music-emu/default.nix
+++ b/pkgs/applications/audio/game-music-emu/default.nix
@ -1,12 +1,12 @@
 { stdenv, fetchurl, cmake }:

 stdenv.mkDerivation rec {
-  version = "0.6.0";
+  version = "0.6.1";
  name = "game-music-emu-${version}";

  src = fetchurl {
-    url = "https://game-music-emu.googlecode.com/files/${name}.tar.bz2";
-    sha256 = "11s9l938nxbrk7qb2k1ppfgizcz00cakbxgv0gajc6hyqv882vjh";
+    url = "https://bitbucket.org/mpyne/game-music-emu/downloads/${name}.tar.bz2";
+    sha256 = "08fk7zddpn7v93d0fa7fcypx7hvgwx9b5psj9l6m8b87k2hbw4fw";
  };

  buildInputs = [ cmake ];
--- a/pkgs/applications/audio/spotify/default.nix
+++ b/pkgs/applications/audio/spotify/default.nix
@ -6,7 +6,7 @@ assert stdenv.system == "x86_64-linux";

 let
  # Please update the stable branch!
-  version = "1.0.45.182.gbbd5909f-72";
+  version = "1.0.45.186.g3b5036d6-95";

  deps = [
    alsaLib
@ -51,7 +51,7 @@ stdenv.mkDerivation {
  src =
    fetchurl {
      url = "http://repository-origin.spotify.com/pool/non-free/s/spotify-client/spotify-client_${version}_amd64.deb";
-      sha256 = "0vpwwla5vrx5ryx434a486l8vcgr1vxh28ri6ab4f28xrz16ipys";
+      sha256 = "0fpvz1mzyva1sypg4gjmrv0clckb0c3xwjfcxnb8gvkxx9vm56p1";
    };

  buildInputs = [ dpkg makeWrapper ];
--- a/pkgs/applications/audio/ssrc/default.nix
+++ b/pkgs/applications/audio/ssrc/default.nix
@ -0,0 +1,42 @@
+{ stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  pname = "ssrc";
+  name = "${pname}-${version}";
+  version = "1.33";
+
+  src = fetchFromGitHub {
+    owner = "shibatch";
+    repo = "SSRC";
+    rev = "4adf75116dfc0ef709fef74a0e2f3360bd15007f";
+    sha256 = "0hgma66v7sszkpz5jkyscj0q6lmjfqdwf1hw57535c012pa2vdrh";
+  };
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp ssrc ssrc_hp $out/bin
+    '';
+
+  meta = with stdenv.lib; {
+    description = "A high quality audio sampling rate converter";
+    longDescription = ''
+      This program converts sampling rates of PCM wav files. This
+      program also has a function to apply dither to its output and
+      extend perceived dynamic range.
+
+      Sampling rates of 44.1kHz and 48kHz are popularly used, but the
+      ratio between these two frequencies is 147:160, which are not
+      small numbers. As a result, sampling rate conversion without
+      degradation of sound quality requires filter with very large
+      order, and it is difficult to have both quality and speed. This
+      program quickly converts between these sampling frequencies
+      without audible degradation.
+    '';
+
+    version = "${version}";
+    homepage = "http://shibatch.sourceforge.net/";
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ leenaars];
+    platforms = with platforms; [ linux ] ;
+  };
+}
--- a/pkgs/applications/misc/gnome15/default.nix
+++ b/pkgs/applications/misc/gnome15/default.nix
@ -0,0 +1,36 @@
+{ stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, python2, gnome_python, gnome_python_desktop }:
+
+stdenv.mkDerivation rec {
+  name = "gnome15-2016-06-10";
+
+  src = fetchFromGitHub {
+    owner = "achilleas-k";
+    repo = "gnome15";
+    rev = "1077c890d9ba8ef7a5e448e70a792de5c7443c84";
+    sha256 = "0z5k2rgvv5zyi3lbbk6svncypidj44qzfchivb4vlr7clmh16m95";
+  };
+
+  nativeBuildInputs = [ autoreconfHook pkgconfig python2.pkgs.wrapPython ];
+  buildInputs = [ python2 ];
+  propagatedBuildInputs = with python2.pkgs; [
+    pygtk keyring virtkey pillow dbus-python pyinotify lxml pyxdg pyusb gnome_python gnome_python_desktop
+    python-uinput xlib pyudev pyinputevent
+  ];
+
+  postPatch = ''
+    touch README
+    export UDEV_RULES_PATH="$out/lib/udev/rules.d"
+  '';
+
+  postFixup = ''
+    wrapPythonPrograms
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A set of tools for configuring the Logitech G15 keyboard";
+    license = licenses.gpl3;
+    homepage = "https://gnome15.org/";
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ abbradar ];
+  };
+}
--- a/pkgs/applications/networking/dropbox/default.nix
+++ b/pkgs/applications/networking/dropbox/default.nix
@ -23,11 +23,11 @@
 let
  # NOTE: When updating, please also update in current stable,
  # as older versions stop working
-  version = "15.4.22";
+  version = "16.4.29";
  sha256 =
    {
-      "x86_64-linux" = "105a64w6rxhrg2dcpb4h4a2956x2r7flf41rszhw5nnczal0s8gx";
-      "i686-linux"   = "001c6dfdxip67w19h3zlx8w72kvnkl1hbkj7gqvw9lixmnq82fhr";
+      "x86_64-linux" = "0zng19qisbr3c9d312ar43p1b44xidabj4x2l3g3q85i300vj661";
+      "i686-linux"   = "0hc5fs0akc437valbxwlymk7ncjkdnhc51pja5bbiy48gqmd42bb";
    }."${stdenv.system}" or (throw "system ${stdenv.system} not supported");

  arch =
--- a/pkgs/applications/networking/instant-messengers/scudcloud/default.nix
+++ b/pkgs/applications/networking/instant-messengers/scudcloud/default.nix
@ -1,15 +1,14 @@
 { stdenv, fetchgit, python3Packages }:

 python3Packages.buildPythonPackage {
-  name = "scudcloud-1.35";
-  namePrefix = "";
+  name = "scudcloud-1.38";

-  # Version 1.35, branch 254-port-to-qt5
-  # https://github.com/raelgc/scudcloud/commit/6d924b5c23597c94d1a8e829a8a5d917806a5bc9
+  # Branch 254-port-to-qt5
+  # https://github.com/raelgc/scudcloud/commit/6bcd877daea3d679cd5fd2c946c2d933940c48d9
  src = fetchgit {
      url = https://github.com/raelgc/scudcloud/;
-      rev = "6d924b5c23597c94d1a8e829a8a5d917806a5bc9";
-      sha256 = "01k5am3067l3p1c91mdrh2fk3cgr20dhppa6flqi5b2ygzrc1i8q";
+      rev = "6bcd877daea3d679cd5fd2c946c2d933940c48d9";
+      sha256 = "1884svz6m5vl06d0yac5zjb2phxwg6bjva72y15fw4larkjnh72s";
  };

  propagatedBuildInputs = with python3Packages; [ pyqt5 dbus-python ];
--- a/pkgs/applications/networking/syncthing/default.nix
+++ b/pkgs/applications/networking/syncthing/default.nix
@ -1,14 +1,14 @@
 { stdenv, lib, fetchFromGitHub, go, pkgs }:

 stdenv.mkDerivation rec {
-  version = "0.14.13";
+  version = "0.14.15";
  name = "syncthing-${version}";

  src = fetchFromGitHub {
    owner  = "syncthing";
    repo   = "syncthing";
    rev    = "v${version}";
-    sha256 = "0gq218f1rhzjrqh2gjyvqksa7a1agwhm8rfqf5jw58pncblrn6v4";
+    sha256 = "0iq7pzb9f0vgikxxxwvrhi5rlgw9frcwy0lgvc61l6lbw3vl0rd7";
  };

  buildInputs = [ go ];
--- a/pkgs/applications/science/astronomy/stellarium/default.nix
+++ b/pkgs/applications/science/astronomy/stellarium/default.nix
@ -1,20 +1,22 @@
 { stdenv, fetchurl, cmake, freetype, libpng, mesa, gettext, openssl, perl, libiconv
 , qtscript, qtserialport, qttools, makeQtWrapper
+, qtmultimedia
 }:

 stdenv.mkDerivation rec {
-  name = "stellarium-0.14.3";
+  name = "stellarium-${version}";
+  version = "0.15.0";

  src = fetchurl {
    url = "mirror://sourceforge/stellarium/${name}.tar.gz";
-    sha256 = "1919wzlvhfxdxficbwhp31xlhm0571grgcmsfdp5y36z9yqwahfy";
+    sha256 = "0il751lgnfkx35h1m8fzwwnrygpxjx2a80gng1i1rbybkykf7l3l";
  };

  nativeBuildInputs = [ makeQtWrapper ];

  buildInputs = [
    cmake freetype libpng mesa gettext openssl perl libiconv qtscript
-    qtserialport qttools
+    qtserialport qttools qtmultimedia
  ];

  enableParallelBuilding = true;
--- a/pkgs/applications/version-management/meld/default.nix
+++ b/pkgs/applications/version-management/meld/default.nix
@ -5,14 +5,14 @@

 let
  minor = "3.16";
-  version = "${minor}.2";
+  version = "${minor}.4";
  inherit (python2Packages) python buildPythonApplication pycairo pygobject3;
 in buildPythonApplication rec {
  name = "meld-${version}";

  src = fetchurl {
    url = "mirror://gnome/sources/meld/${minor}/meld-${version}.tar.xz";
-    sha256 = "2dd3f58b95444bf721e0c912668c29cf8f47a402440b772ea12c4b9a0c94966f";
+    sha256 = "0rwflfkfnb9ydnk4k591x0il29d4dvz95cjs2f279blx64lgki4k";
  };

  buildInputs = [
--- a/pkgs/applications/virtualization/xen/4.5.nix
+++ b/pkgs/applications/virtualization/xen/4.5.nix
@ -2,8 +2,19 @@

 let
  # Xen 4.5.5
+  #
+  # Patching XEN? Check the XSAs and try applying all the ones we
+  # don't have yet.
+  #
+  # XSAs at: https://xenbits.xen.org/xsa/
  xenConfig = rec {
    version = "4.5.5";
+
+    xsaPatch = { name , sha256 }: (fetchpatch {
+      url = "https://xenbits.xen.org/xsa/xsa${name}.patch";
+      inherit sha256;
+    });
+
    name = "xen-${version}";

    src = fetchurl {
@ -52,25 +63,60 @@ let
        }
      ];

-    xenPatches = [ ./0001-libxl-Spice-image-compression-setting-support-for-up.patch
-                   ./0002-libxl-Spice-streaming-video-setting-support-for-upst.patch
-                   ./0003-Add-qxl-vga-interface-support-for-upstream-qem.patch
-                   (fetchpatch {
-                     url = "https://bugzilla.redhat.com/attachment.cgi?id=1218547";
-                     name = "CVE-2016-9385.patch";
-                     sha256 = "0k9mykhrpm4rbjkhv067f6s05lqmgnldcyb3vi8cl0ndlyh66lvr";
-                   })
-                   (fetchpatch {
-                     url = "https://bugzilla.redhat.com/attachment.cgi?id=1218536";
-                     name = "CVE-2016-9377-CVE-2016-9378-part1.patch";
-                     sha256 = "0z53nzrjvc745y26z1qc8jlg3blxp7brawvji1hx3s74n346ssl6";
-                   })
-                   (fetchpatch {
-                     url = "https://bugzilla.redhat.com/attachment.cgi?id=1218537";
-                     name = "CVE-2016-9377-CVE-2016-9378-part2.patch";
-                     sha256 = "11cqvr5jn2s92wsshpilx9qnfczrd9hnyb5aim6qwmz3fq3hrrkz";
-                   })
-                 ];
+      # Note this lacks patches for:
+      # XSA-201
+      # XSA-199
+      # XSA-197
+      # they didn't apply, and there are plenty of other patches here
+      # to get this deployed as-is.
+      xenPatches = [ ./0001-libxl-Spice-image-compression-setting-support-for-up.patch
+                     ./0002-libxl-Spice-streaming-video-setting-support-for-upst.patch
+                     ./0003-Add-qxl-vga-interface-support-for-upstream-qem.patch
+                     (xsaPatch {
+                       name = "190-4.5";
+                       sha256 = "0f8pw38kkxky89ny3ic5h26v9zsjj9id89lygx896zc3w1klafqm";
+                     })
+                     (xsaPatch {
+                       name = "191-4.6";
+                       sha256 = "1wl1ndli8rflmc44pkp8cw4642gi8z7j7gipac8mmlavmn3wdqhg";
+                     })
+                     (xsaPatch {
+                       name = "192-4.5";
+                       sha256 = "0m8cv0xqvx5pdk7fcmaw2vv43xhl62plyx33xqj48y66x5z9lxpm";
+                     })
+                     (xsaPatch {
+                       name = "193-4.5";
+                       sha256 = "0k9mykhrpm4rbjkhv067f6s05lqmgnldcyb3vi8cl0ndlyh66lvr";
+                     })
+                     (xsaPatch {
+                       name = "195";
+                       sha256 = "0m0g953qnjy2knd9qnkdagpvkkgjbk3ydgajia6kzs499dyqpdl7";
+                     })
+                     (xsaPatch {
+                       name = "196-0001-x86-emul-Correct-the-IDT-entry-calculation-in-inject";
+                       sha256 = "0z53nzrjvc745y26z1qc8jlg3blxp7brawvji1hx3s74n346ssl6";
+                     })
+                     (xsaPatch {
+                       name = "196-0002-x86-svm-Fix-injection-of-software-interrupts";
+                       sha256 = "11cqvr5jn2s92wsshpilx9qnfczrd9hnyb5aim6qwmz3fq3hrrkz";
+                     })
+                     (xsaPatch {
+                       name = "198";
+                       sha256 = "0d1nndn4p520c9xa87ixnyks3mrvzcri7c702d6mm22m8ansx6d9";
+                     })
+                     (xsaPatch {
+                       name = "200-4.6";
+                       sha256 = "0k918ja83470iz5k4vqi15293zjvz2dipdhgc9sy9rrhg4mqncl7";
+                     })
+                     (xsaPatch {
+                       name = "202-4.6";
+                       sha256 = "0nnznkrvfbbc8z64dr9wvbdijd4qbpc0wz2j5vpmx6b32sm7932f";
+                     })
+                     (xsaPatch {
+                       name = "204-4.5";
+                       sha256 = "083z9pbdz3f532fnzg7n2d5wzv6rmqc0f4mvc3mnmkd0rzqw8vcp";
+                     })
+                   ];
  };

 in callPackage ./generic.nix (args // { xenConfig=xenConfig; })
--- a/pkgs/applications/virtualization/xhyve/default.nix
+++ b/pkgs/applications/virtualization/xhyve/default.nix
@ -1,25 +1,19 @@
-{ stdenv, lib, fetchurl, Hypervisor, vmnet, xpc, libobjc }:
+{ stdenv, lib, fetchurl }:

 stdenv.mkDerivation rec {
-  name    = "xhyve-${version}";
-  version = "1f1dbe305";
+  name = "xhyve-${version}";
+  version = "0.2.0";

  src = fetchurl {
-    url    = "https://github.com/mist64/xhyve/archive/1f1dbe3059904f885e4ab2b3328f4bb350ea5c37.tar.gz";
-    sha256 = "0hfix8yr90szlv2yyqb2rlq5qsrxyam8kg52sly0adja0cpwfjvx";
+    url = "https://github.com/mist64/xhyve/archive/v${version}.tar.gz";
+    sha256 = "0g1vknnh88kxc8aaqv3j9wqhq45mm9xxxbn1vcrypj3kk9991hrj";
  };

-  buildInputs = [ Hypervisor vmnet xpc libobjc ];
-
  # Don't use git to determine version
-  prePatch = ''
-    substituteInPlace Makefile \
-      --replace 'shell git describe --abbrev=6 --dirty --always --tags' "$version"
+  buildFlags = ''
+    CFLAGS=-DVERSION=\"${version}\"
  '';

-
-  makeFlags = [ "CFLAGS+=-Wno-shift-sign-overflow" ''CFLAGS+=-DVERSION=\"${version}\"'' ];
-
  installPhase = ''
    mkdir -p $out/bin
    cp build/xhyve $out/bin
--- a/pkgs/build-support/kernel/cpio-clean.pl
+++ b/pkgs/build-support/kernel/cpio-clean.pl
@ -1,17 +0,0 @@
-use strict;
-
-# Make inode number, link info and mtime consistent in order to get a consistent hash.
-#
-# Author: Alexander Kjeldaas <ak@formalprivacy.com>
-
-use Archive::Cpio;
-
-my $cpio = Archive::Cpio->new;
-my $IN = \*STDIN;
-my $ino = 1;
-$cpio->read_with_handler($IN, sub {
-        my ($e) = @_;
-        $e->{mtime} = 1;
-	$cpio->write_one(\*STDOUT, $e);
-    });
-$cpio->write_trailer(\*STDOUT);
--- a/pkgs/build-support/kernel/make-initrd.nix
+++ b/pkgs/build-support/kernel/make-initrd.nix
@ -12,10 +12,10 @@
 # `contents = {object = ...; symlink = /init;}' is a typical
 # argument.

-{ stdenv, perl, perlArchiveCpio, cpio, contents, ubootChooser, compressor, prepend }:
+{ stdenv, perl, cpio, contents, ubootChooser, compressor, prepend }:

 let
-  inputsFun = ubootName : [perl cpio perlArchiveCpio ]
+  inputsFun = ubootName : [ perl cpio ]
    ++ stdenv.lib.optional (ubootName != null) [ (ubootChooser ubootName) ];
  makeUInitrdFun = ubootName : (ubootName != null);
 in
@ -30,12 +30,11 @@ stdenv.mkDerivation {
  objects = map (x: x.object) contents;
  symlinks = map (x: x.symlink) contents;
  suffices = map (x: if x ? suffix then x.suffix else "none") contents;
-  
+
  # For obtaining the closure of `contents'.
  exportReferencesGraph =
    map (x: [("closure-" + baseNameOf x.symlink) x.object]) contents;
  pathsFromGraph = ./paths-from-graph.pl;
-  cpioClean = ./cpio-clean.pl;

  crossAttrs = {
    nativeBuildInputs = inputsFun stdenv.cross.platform.uboot;
--- a/pkgs/build-support/kernel/make-initrd.sh
+++ b/pkgs/build-support/kernel/make-initrd.sh
@ -39,7 +39,8 @@ mkdir -p $out
 for PREP in $prepend; do
  cat $PREP >> $out/initrd
 done
-(cd root && find * -print0 | cpio -o -H newc -R 0:0 --null | perl $cpioClean | $compressor >> $out/initrd)
+(cd root && find * -print0 | xargs -0r touch -h -d '@1')
+(cd root && find * -print0 | sort -z | cpio -o -H newc -R +0:+0 --reproducible --null | $compressor >> $out/initrd)

 if [ -n "$makeUInitrd" ]; then
    mv $out/initrd $out/initrd.gz
--- a/pkgs/desktops/gnome-2/bindings/gnome-python-desktop/default.nix
+++ b/pkgs/desktops/gnome-2/bindings/gnome-python-desktop/default.nix
@ -0,0 +1,32 @@
+{ stdenv, fetchurl, gnome_python, librsvg, libwnck, libgtop, pkgconfig, python2, gtk }:
+
+let
+  inherit (python2.pkgs) python pygtk;
+in stdenv.mkDerivation rec {
+  ver_maj = "2.32";
+  ver_min = "0";
+  version = "${ver_maj}.${ver_min}";
+  name = "gnome-python-desktop-${version}";
+
+  src = fetchurl {
+    url = "mirror://gnome/sources/gnome-python-desktop/${ver_maj}/gnome-python-desktop-${version}.tar.bz2";
+    sha256 = "1s8f9rns9v7qlwjv9qh9lr8crp88dpzfm45hj47zc3ivpy0dbnq9";
+  };
+
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ gtk librsvg libwnck libgtop python ];
+  propagatedBuildInputs = [ gnome_python pygtk ];
+
+  # gnome-python-desktop expects that .pth file is already installed by PyGTK
+  # in the same directory. This is not the case for Nix.
+  postInstall = ''
+    echo "gtk-2.0" > $out/${python2.sitePackages}/${name}.pth
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = "http://www.pygtk.org";
+    description = "Python bindings for GNOME desktop packages";
+    license = licenses.lgpl21;
+    maintainers = [ maintainers.goibhniu ];
+  };
+}
--- a/pkgs/desktops/gnome-2/bindings/gnome-python/default.nix
+++ b/pkgs/desktops/gnome-2/bindings/gnome-python/default.nix
@ -1,9 +1,9 @@
-{ stdenv, fetchurl, pythonPackages, pkgconfig, libgnome, GConf, glib, gtk, gnome_vfs}:
+{ stdenv, fetchurl, python2, pkgconfig, libgnome, GConf, glib, gtk, gnome_vfs }:

 with stdenv.lib;

 let
-  inherit (pythonPackages) python pygobject2 pygtk dbus-python;
+  inherit (python2.pkgs) python pygobject2 pygtk dbus-python;
 in stdenv.mkDerivation rec {
  version = "2.28";
  name = "gnome-python-${version}.1";
@ -13,30 +13,21 @@ in stdenv.mkDerivation rec {
    sha256 = "759ce9344cbf89cf7f8449d945822a0c9f317a494f56787782a901e4119b96d8";
  };

-  phases = "unpackPhase configurePhase buildPhase installPhase";
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ python glib gtk GConf libgnome gnome_vfs ];
+  propagatedBuildInputs = [ pygobject2 pygtk dbus-python ];

-  # WAF is probably the biggest crap on this planet, btw i removed the /gtk-2.0 path thingy
-  configurePhase = ''
-    sed -e "s@{PYTHONDIR}/gtk-2.0@{PYTHONDIR}/@" -i gconf/wscript
-    python waf configure --prefix=$out
+  # gnome-python expects that .pth file is already installed by PyGTK in the
+  # same directory. This is not the case for Nix.
+  postInstall = ''
+    echo "gtk-2.0" > $out/${python2.sitePackages}/${name}.pth
  '';

-  buildPhase = ''
-    python waf build
-  '';
-
-  installPhase = ''
-    python waf install
-    cp bonobo/*.{py,defs} $out/share/pygtk/2.0/defs/
-  '';
-
-  buildInputs = [ python pkgconfig pygobject2 pygtk glib gtk GConf libgnome dbus-python gnome_vfs ];
-
-  doCheck = false;
-
-  meta = {
-    homepage = "http://projects.gnome.org/gconf/";
-    description = "Python wrapper for gconf";
-    maintainers = [ stdenv.lib.maintainers.qknight ];
+  meta = with stdenv.lib; {
+    homepage = "http://pygtk.org/";
+    description = "Python wrapper for GNOME libraries";
+    platforms = platforms.linux;
+    licenses = licenses.lgpl2;
+    maintainers = with maintainers; [ qknight ];
  };
 }
--- a/pkgs/desktops/gnome-2/bindings/python-rsvg/default.nix
+++ b/pkgs/desktops/gnome-2/bindings/python-rsvg/default.nix
@ -1,33 +0,0 @@
-{ stdenv, fetchurl, gnome2, librsvg, pkgconfig, python27Packages, gtk }:
-
-let
-  inherit (python27Packages) python pygtk;
-in stdenv.mkDerivation rec {
-  ver_maj = "2.32";
-  ver_min = "0";
-  version = "${ver_maj}.${ver_min}";
-  name = "python-rsvg-${version}";
-
-  src = fetchurl {
-    url = "mirror://gnome/sources/gnome-python-desktop/${ver_maj}/gnome-python-desktop-${version}.tar.bz2";
-    sha256 = "1s8f9rns9v7qlwjv9qh9lr8crp88dpzfm45hj47zc3ivpy0dbnq9";
-  };
-
-  configurePhase = ''
-    sed -e "s@{PYTHONDIR}/gtk-2.0@{PYTHONDIR}/@" -i rsvg/wscript
-    python waf configure --enable-modules=rsvg --prefix=$out
-  '';
-
-  buildPhase = "python waf build";
-
-  installPhase = "python waf install";
-
-  buildInputs = [ gtk gnome2.gnome_python librsvg pkgconfig pygtk python ];
-
-  meta = with stdenv.lib; {
-    homepage = "http://www.pygtk.org";
-    description = "The rsvg python module";
-    license = licenses.lgpl21;
-    maintainers = [ maintainers.goibhniu ];
-  };
-}
--- a/pkgs/desktops/gnome-2/default.nix
+++ b/pkgs/desktops/gnome-2/default.nix
@ -47,6 +47,9 @@ let overridden = set // overrides; set = with overridden; {

  gnome_python = callPackage ./bindings/gnome-python { };

+  gnome_python_desktop = callPackage ./bindings/gnome-python-desktop { };
+  python_rsvg = overridden.gnome_python_desktop;
+
  gnome_vfs = callPackage ./platform/gnome-vfs { };

  gnome_vfs_monikers = callPackage ./platform/gnome-vfs-monikers { };
@ -59,8 +62,6 @@ let overridden = set // overrides; set = with overridden; {

  libbonoboui = callPackage ./platform/libbonoboui { };

-  python_rsvg = callPackage ./bindings/python-rsvg { };
-
  at_spi = callPackage ./platform/at-spi { };

  gtkhtml = callPackage ./platform/gtkhtml { };
--- a/pkgs/desktops/kde-5/applications/okular.nix
+++ b/pkgs/desktops/kde-5/applications/okular.nix
@ -11,7 +11,7 @@ let
  unwrapped = kdeApp {
    name = "okular";
    nativeBuildInputs = [ ecm kdoctools ];
-    buildInputs = [
+    propagatedBuildInputs = [
      djvulibre ebook_tools kactivities karchive kbookmarks kcompletion kconfig
      kconfigwidgets kcoreaddons kdbusaddons kdegraphics-mobipocket kiconthemes
      kjs khtml kio kparts kpty kwallet kwindowsystem libkexiv2 libspectre poppler
--- a/pkgs/development/compilers/gcc/6/default.nix
+++ b/pkgs/development/compilers/gcc/6/default.nix
@ -59,7 +59,7 @@ assert langGo -> langCC;
 with stdenv.lib;
 with builtins;

-let version = "6.2.0";
+let version = "6.3.0";

    # Whether building a cross-compiler for GNU/Hurd.
    crossGNU = cross != null && cross.config == "i586-pc-gnu";
@ -216,7 +216,7 @@ stdenv.mkDerivation ({

  src = fetchurl {
    url = "mirror://gnu/gcc/gcc-${version}/gcc-${version}.tar.bz2";
-    sha256 = "1idpf43988v1a6i8lw9ak1r7igcfg1bm5kn011iydlr2qygmhi4r";
+    sha256 = "17xjz30jb65hcf714vn9gcxvrrji8j20xm7n33qg1ywhyzryfsph";
  };

  inherit patches;
--- a/pkgs/development/compilers/go/1.4.nix
+++ b/pkgs/development/compilers/go/1.4.nix
@ -90,6 +90,7 @@ stdenv.mkDerivation rec {
  patches = [
    ./remove-tools-1.4.patch
    ./new-binutils.patch
+    ./creds-test-1.4.patch
  ];

  GOOS = if stdenv.isDarwin then "darwin" else "linux";
--- a/pkgs/development/compilers/go/1.6.nix
+++ b/pkgs/development/compilers/go/1.6.nix
@ -110,6 +110,7 @@ stdenv.mkDerivation rec {

  patches = [
    ./remove-tools-1.5.patch
+    ./creds-test.patch
  ];

  GOOS = if stdenv.isDarwin then "darwin" else "linux";
--- a/pkgs/development/compilers/go/1.7.nix
+++ b/pkgs/development/compilers/go/1.7.nix
@ -101,7 +101,11 @@ stdenv.mkDerivation rec {
    sed -i '1 a\exit 0' misc/cgo/errors/test.bash
  '';

-  patches = [ ./remove-tools-1.7.patch ./cacert-1.7.patch ];
+  patches =
+    [ ./remove-tools-1.7.patch
+      ./cacert-1.7.patch
+      ./creds-test.patch
+    ];

  SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";

--- a/pkgs/development/compilers/go/creds-test-1.4.patch
+++ b/pkgs/development/compilers/go/creds-test-1.4.patch
@ -0,0 +1,17 @@
+diff --git a/go-go1.4.3/src/syscall/creds_test.go b/go-go1.4.3/src/syscall/creds_test.go
+index b1894c6..b2d6b4e 100644
+--- a/src/syscall/creds_test.go
+++ b/src/syscall/creds_test.go
+@@ -56,9 +56,10 @@ func TestSCMCredentials(t *testing.T) {
+ 		ucred.Gid = 0
+ 		oob := syscall.UnixCredentials(&ucred)
+ 		_, _, err := cli.(*net.UnixConn).WriteMsgUnix(nil, oob, nil)
+-		if err.(*net.OpError).Err != syscall.EPERM {
+-			t.Fatalf("WriteMsgUnix failed with %v, want EPERM", err)
+		if err.(*net.OpError).Err != syscall.EPERM && err.(*net.OpError).Err != syscall.EINVAL {
+			t.Fatalf("WriteMsgUnix failed with %v, want EPERM or EINVAL", err)
+ 		}
+
+ 	}
+
+ 	ucred.Pid = int32(os.Getpid())
--- a/pkgs/development/compilers/go/creds-test.patch
+++ b/pkgs/development/compilers/go/creds-test.patch
@ -0,0 +1,14 @@
+diff -ru -x '*~' ./result/src/syscall/creds_test.go go-go1.7.4-src/src/syscall/creds_test.go
+--- ./result/src/syscall/creds_test.go	1970-01-01 01:00:01.000000000 +0100
+++ go-go1.7.4-src/src/syscall/creds_test.go	2016-12-21 14:06:39.559932164 +0100
+@@ -62,8 +62,8 @@
+ 		if sys, ok := err.(*os.SyscallError); ok {
+ 			err = sys.Err
+ 		}
+-		if err != syscall.EPERM {
+-			t.Fatalf("WriteMsgUnix failed with %v, want EPERM", err)
+		if err != syscall.EPERM && err != syscall.EINVAL {
+			t.Fatalf("WriteMsgUnix failed with %v, want EPERM or EINVAL", err)
+ 		}
+ 	}
+ 
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@ -57,6 +57,8 @@ self: super: {
      rev = drv.version;
    };
  })).overrideScope (self: super: {
+    # https://github.com/yesodweb/yesod/issues/1324
+    yesod-persistent = self.yesod-persistent_1_4_1_1;
    # https://github.com/prowdsponsor/esqueleto/issues/137
    persistent = self.persistent_2_2_4_1;
    persistent-template = self.persistent-template_2_1_8_1;
--- a/pkgs/development/haskell-modules/configuration-hackage2nix.yaml
+++ b/pkgs/development/haskell-modules/configuration-hackage2nix.yaml
@ -37,7 +37,7 @@ core-packages:
  - ghcjs-base-0

 default-package-overrides:
-  # LTS Haskell 7.13
+  # LTS Haskell 7.14
  - abstract-deque ==0.3
  - abstract-par ==0.3.3
  - AC-Vector ==2.3.2
@ -51,7 +51,7 @@ default-package-overrides:
  - adjunctions ==4.3
  - adler32 ==0.1.1.0
  - aeson ==0.11.2.1
-  - aeson-better-errors ==0.9.0.1
+  - aeson-better-errors ==0.9.1.0
  - aeson-casing ==0.1.0.5
  - aeson-compat ==0.3.6
  - aeson-generic-compat ==0.0.1.0
@ -324,7 +324,7 @@ default-package-overrides:
  - clckwrks-theme-bootstrap ==0.4.2
  - cli ==0.1.2
  - clientsession ==0.9.1.2
-  - Clipboard ==2.3.0.1
+  - Clipboard ==2.3.0.2
  - clock ==0.7.2
  - clumpiness ==0.17.0.0
  - ClustalParser ==1.1.4
@ -393,6 +393,8 @@ default-package-overrides:
  - cryptohash ==0.11.9
  - cryptohash-conduit ==0.1.1
  - cryptohash-cryptoapi ==0.1.4
+  - cryptohash-md5 ==0.11.100.1
+  - cryptohash-sha1 ==0.11.100.1
  - cryptohash-sha256 ==0.11.100.1
  - cryptol ==2.4.0
  - cryptonite ==0.19
@ -433,7 +435,7 @@ default-package-overrides:
  - dependent-sum ==0.3.2.2
  - dependent-sum-template ==0.0.0.5
  - derive ==2.5.26
-  - deriving-compat ==0.3.4
+  - deriving-compat ==0.3.5
  - descriptive ==0.9.4
  - diagrams ==1.3.0.1
  - diagrams-cairo ==1.3.1.1
@ -476,7 +478,7 @@ default-package-overrides:
  - docvim ==0.3.2.1
  - dotenv ==0.3.1.0
  - dotnet-timespan ==0.0.1.0
-  - double-conversion ==2.0.1.0
+  - double-conversion ==2.0.2.0
  - download ==0.3.2.5
  - dpor ==0.2.0.0
  - drawille ==0.1.2.0
@ -586,7 +588,7 @@ default-package-overrides:
  - foreign-store ==0.2
  - formatting ==6.2.4
  - fortran-src ==0.1.0.4
-  - Frames ==0.1.8
+  - Frames ==0.1.9
  - free ==4.12.4
  - free-vl ==0.1.4
  - freenect ==1.2.1
@ -847,6 +849,7 @@ default-package-overrides:
  - highlighting-kate ==0.6.3
  - hinotify ==0.3.9
  - hint ==0.6.0
+  - hip ==1.2.0.0
  - histogram-fill ==0.8.4.1
  - hit ==0.6.3
  - hjsmin ==0.2.0.2
@ -1320,7 +1323,7 @@ default-package-overrides:
  - persistent-refs ==0.4
  - persistent-sqlite ==2.6
  - persistent-template ==2.5.1.6
-  - pgp-wordlist ==0.1.0.1
+  - pgp-wordlist ==0.1.0.2
  - phantom-state ==0.2.1.2
  - picoparsec ==0.1.2.3
  - pinboard ==0.9.6
@ -1591,7 +1594,7 @@ default-package-overrides:
  - snap-core ==1.0.1.0
  - snap-server ==1.0.1.1
  - snowflake ==0.1.1.1
-  - soap ==0.2.3.2
+  - soap ==0.2.3.3
  - soap-openssl ==0.1.0.2
  - soap-tls ==0.1.1.2
  - socket ==0.6.1.0
@ -1638,7 +1641,7 @@ default-package-overrides:
  - STMonadTrans ==0.3.4
  - stopwatch ==0.1.0.3
  - storable-complex ==0.2.2
-  - storable-endian ==0.2.5
+  - storable-endian ==0.2.6
  - storable-record ==0.0.3.1
  - store ==0.2.1.2
  - store-core ==0.2.0.2
@ -1689,7 +1692,7 @@ default-package-overrides:
  - tar ==0.5.0.3
  - tardis ==0.4.1.0
  - tasty ==0.11.0.4
-  - tasty-ant-xml ==1.0.2
+  - tasty-ant-xml ==1.0.3
  - tasty-dejafu ==0.3.0.2
  - tasty-expected-failure ==0.11.0.4
  - tasty-golden ==2.3.1.1
@ -1746,7 +1749,7 @@ default-package-overrides:
  - th-reify-many ==0.1.6
  - th-to-exp ==0.0.1.0
  - th-utilities ==0.2.0.1
-  - these ==0.7.2
+  - these ==0.7.3
  - threads ==0.5.1.4
  - through-text ==0.1.0.0
  - thumbnail-plus ==1.0.5
@ -1755,7 +1758,7 @@ default-package-overrides:
  - time-compat ==0.1.0.3
  - time-lens ==0.4.0.1
  - time-locale-compat ==0.1.1.3
-  - time-parsers ==0.1.1.0
+  - time-parsers ==0.1.2.0
  - timeit ==1.0.0.0
  - timelens ==0.2.0.2
  - timemap ==0.0.4
@ -1842,7 +1845,7 @@ default-package-overrides:
  - utility-ht ==0.0.12
  - uu-interleaved ==0.2.0.0
  - uu-parsinglib ==2.9.1.1
-  - uuid ==1.3.12
+  - uuid ==1.3.13
  - uuid-orphans ==1.4.1
  - uuid-types ==1.0.3
  - vado ==0.0.7
@ -1864,7 +1867,7 @@ default-package-overrides:
  - versions ==3.0.0
  - vhd ==0.2.2
  - ViennaRNAParser ==1.2.9
-  - vinyl ==0.5.2
+  - vinyl ==0.5.3
  - vinyl-utils ==0.3.0.0
  - void ==0.7.1
  - vty ==5.11.3
@ -1930,7 +1933,7 @@ default-package-overrides:
  - Workflow ==0.8.3
  - wrap ==0.0.0
  - wreq ==0.4.1.0
-  - writer-cps-mtl ==0.1.1.0
+  - writer-cps-mtl ==0.1.1.1
  - writer-cps-transformers ==0.1.1.0
  - wuss ==1.1.3
  - X11 ==1.6.1.2
@ -1982,7 +1985,7 @@ default-package-overrides:
  - yesod-gitrev ==0.1.0.0
  - yesod-job-queue ==0.3.0.1
  - yesod-newsfeed ==1.6
-  - yesod-persistent ==1.4.0.6
+  - yesod-persistent ==1.4.1.0
  - yesod-sitemap ==1.4.0.1
  - yesod-static ==1.5.1.1
  - yesod-static-angular ==0.1.8
@ -1996,7 +1999,7 @@ default-package-overrides:
  - yjtools ==0.9.18
  - zero ==0.1.4
  - zeromq4-haskell ==0.6.5
-  - zip ==0.1.3
+  - zip ==0.1.4
  - zip-archive ==0.3.0.5
  - zippers ==0.2.2
  - zlib ==0.6.1.2
@ -2676,6 +2679,7 @@ dont-distribute-packages:
  cabalvchk:                                    [ i686-linux, x86_64-linux, x86_64-darwin ]
  cabocha:                                      [ i686-linux, x86_64-linux, x86_64-darwin ]
  cached-io:                                    [ i686-linux, x86_64-linux, x86_64-darwin ]
+  cacophony:                                    [ i686-linux, x86_64-linux, x86_64-darwin ]
  caffegraph:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
  cake3:                                        [ i686-linux, x86_64-linux, x86_64-darwin ]
  cakyrespa:                                    [ i686-linux, x86_64-linux, x86_64-darwin ]
@ -3066,6 +3070,7 @@ dont-distribute-packages:
  cubicbezier:                                  [ i686-linux, x86_64-linux, x86_64-darwin ]
  cuboid:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]
  cudd:                                         [ i686-linux, x86_64-linux, x86_64-darwin ]
+  cue-sheet:                                    [ i686-linux, x86_64-linux, x86_64-darwin ]
  currency-convert:                             [ i686-linux, x86_64-linux, x86_64-darwin ]
  curry-base:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
  curry-frontend:                               [ i686-linux, x86_64-linux, x86_64-darwin ]
@ -3268,6 +3273,7 @@ dont-distribute-packages:
  direct-http:                                  [ i686-linux, x86_64-linux, x86_64-darwin ]
  direct-plugins:                               [ i686-linux, x86_64-linux, x86_64-darwin ]
  directed-cubical:                             [ i686-linux, x86_64-linux, x86_64-darwin ]
+  directory-tree:                               [ i686-linux, x86_64-linux, x86_64-darwin ]
  dirfiles:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
  discogs-haskell:                              [ i686-linux, x86_64-linux, x86_64-darwin ]
  discordian-calendar:                          [ i686-linux, x86_64-linux, x86_64-darwin ]
@ -4270,6 +4276,7 @@ dont-distribute-packages:
  haste-gapi:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
  haste-perch:                                  [ i686-linux, x86_64-linux, x86_64-darwin ]
  haste:                                        [ i686-linux, x86_64-linux, x86_64-darwin ]
+  hastily:                                      [ i686-linux, x86_64-linux, x86_64-darwin ]
  hat:                                          [ i686-linux, x86_64-linux, x86_64-darwin ]
  Hate:                                         [ i686-linux, x86_64-linux, x86_64-darwin ]
  hatex-guide:                                  [ i686-linux, x86_64-linux, x86_64-darwin ]
@ -4575,6 +4582,7 @@ dont-distribute-packages:
  hpasteit:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
  HPath:                                        [ i686-linux, x86_64-linux, x86_64-darwin ]
  hpath:                                        [ i686-linux, x86_64-linux, x86_64-darwin ]
+  hpc-coveralls:                                [ i686-linux, x86_64-linux, x86_64-darwin ]
  hpc-tracer:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
  hpdft:                                        [ i686-linux, x86_64-linux, x86_64-darwin ]
  HPi:                                          [ i686-linux, x86_64-linux, x86_64-darwin ]
@ -4710,6 +4718,7 @@ dont-distribute-packages:
  hspec-shouldbe:                               [ i686-linux, x86_64-linux, x86_64-darwin ]
  hspec-snap:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
  hspec-test-sandbox:                           [ i686-linux, x86_64-linux, x86_64-darwin ]
+  hspec-webdriver:                              [ i686-linux, x86_64-linux, x86_64-darwin ]
  HsPerl5:                                      [ i686-linux, x86_64-linux, x86_64-darwin ]
  hspread:                                      [ i686-linux, x86_64-linux, x86_64-darwin ]
  hspresent:                                    [ i686-linux, x86_64-linux, x86_64-darwin ]
@ -5721,6 +5730,7 @@ dont-distribute-packages:
  mysnapsession-example:                        [ i686-linux, x86_64-linux, x86_64-darwin ]
  mysnapsession:                                [ i686-linux, x86_64-linux, x86_64-darwin ]
  mysql-effect:                                 [ i686-linux, x86_64-linux, x86_64-darwin ]
+  mysql-haskell-nem:                            [ i686-linux, x86_64-linux, x86_64-darwin ]
  mysql-haskell-openssl:                        [ i686-linux, x86_64-linux, x86_64-darwin ]
  mysql-haskell:                                [ i686-linux, x86_64-linux, x86_64-darwin ]
  mysql-simple-quasi:                           [ i686-linux, x86_64-linux, x86_64-darwin ]
@ -6085,6 +6095,7 @@ dont-distribute-packages:
  pipes-async:                                  [ i686-linux, x86_64-linux, x86_64-darwin ]
  pipes-attoparsec-streaming:                   [ i686-linux, x86_64-linux, x86_64-darwin ]
  pipes-binary:                                 [ i686-linux, x86_64-linux, x86_64-darwin ]
+  pipes-cacophony:                              [ i686-linux, x86_64-linux, x86_64-darwin ]
  pipes-cereal-plus:                            [ i686-linux, x86_64-linux, x86_64-darwin ]
  pipes-cereal:                                 [ i686-linux, x86_64-linux, x86_64-darwin ]
  pipes-conduit:                                [ i686-linux, x86_64-linux, x86_64-darwin ]
@ -6844,9 +6855,11 @@ dont-distribute-packages:
  snap-cors:                                    [ i686-linux, x86_64-linux, x86_64-darwin ]
  snap-error-collector:                         [ i686-linux, x86_64-linux, x86_64-darwin ]
  snap-extras:                                  [ i686-linux, x86_64-linux, x86_64-darwin ]
+  snap-loader-dynamic:                          [ i686-linux, x86_64-linux, x86_64-darwin ]
  snap-predicates:                              [ i686-linux, x86_64-linux, x86_64-darwin ]
  snap-routes:                                  [ i686-linux, x86_64-linux, x86_64-darwin ]
  snap-server:                                  [ i686-linux, x86_64-linux, x86_64-darwin ]
+  snap-templates:                               [ i686-linux, x86_64-linux, x86_64-darwin ]
  snap-testing:                                 [ i686-linux, x86_64-linux, x86_64-darwin ]
  snap-utils:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
  snap-web-routes:                              [ i686-linux, x86_64-linux, x86_64-darwin ]
@ -6884,6 +6897,7 @@ dont-distribute-packages:
  snaplet-scoped-session:                       [ i686-linux, x86_64-linux, x86_64-darwin ]
  snaplet-sedna:                                [ i686-linux, x86_64-linux, x86_64-darwin ]
  snaplet-ses-html:                             [ i686-linux, x86_64-linux, x86_64-darwin ]
+  snaplet-sqlite-simple-jwt-auth:               [ i686-linux, x86_64-linux, x86_64-darwin ]
  snaplet-sqlite-simple:                        [ i686-linux, x86_64-linux, x86_64-darwin ]
  snaplet-stripe:                               [ i686-linux, x86_64-linux, x86_64-darwin ]
  snaplet-tasks:                                [ i686-linux, x86_64-linux, x86_64-darwin ]
@ -6956,6 +6970,7 @@ dont-distribute-packages:
  spoty:                                        [ i686-linux, x86_64-linux, x86_64-darwin ]
  Sprig:                                        [ i686-linux, x86_64-linux, x86_64-darwin ]
  spritz:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]
+  sproxy-web:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
  sproxy2:                                      [ i686-linux, x86_64-linux, x86_64-darwin ]
  spsa:                                         [ i686-linux, x86_64-linux, x86_64-darwin ]
  sql-simple-mysql:                             [ i686-linux, x86_64-linux, x86_64-darwin ]
@ -7580,6 +7595,7 @@ dont-distribute-packages:
  wai-middleware-preprocessor:                  [ i686-linux, x86_64-linux, x86_64-darwin ]
  wai-middleware-route:                         [ i686-linux, x86_64-linux, x86_64-darwin ]
  wai-middleware-static-caching:                [ i686-linux, x86_64-linux, x86_64-darwin ]
+  wai-middleware-static:                        [ i686-linux, x86_64-linux, x86_64-darwin ]
  wai-responsible:                              [ i686-linux, x86_64-linux, x86_64-darwin ]
  wai-router:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
  wai-routes:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
@ -7597,6 +7613,7 @@ dont-distribute-packages:
  watchdog:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
  watcher:                                      [ i686-linux, x86_64-linux, x86_64-darwin ]
  watchit:                                      [ i686-linux, x86_64-linux, x86_64-darwin ]
+  wave:                                         [ i686-linux, x86_64-linux, x86_64-darwin ]
  WaveFront:                                    [ i686-linux, x86_64-linux, x86_64-darwin ]
  wavesurfer:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
  wavy:                                         [ i686-linux, x86_64-linux, x86_64-darwin ]
@ -7620,7 +7637,9 @@ dont-distribute-packages:
  webcrank-dispatch:                            [ i686-linux, x86_64-linux, x86_64-darwin ]
  webcrank-wai:                                 [ i686-linux, x86_64-linux, x86_64-darwin ]
  webcrank:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
+  webdriver-angular:                            [ i686-linux, x86_64-linux, x86_64-darwin ]
  webdriver-snoy:                               [ i686-linux, x86_64-linux, x86_64-darwin ]
+  webdriver:                                    [ i686-linux, x86_64-linux, x86_64-darwin ]
  WeberLogic:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
  webify:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]
  webkit-javascriptcore:                        [ i686-linux, x86_64-linux, x86_64-darwin ]
--- a/pkgs/development/haskell-modules/hackage-packages.nix
+++ b/pkgs/development/haskell-modules/hackage-packages.nix
--- a/pkgs/development/libraries/boehm-gc/cygwin.patch
+++ b/pkgs/development/libraries/boehm-gc/cygwin.patch
@ -1,108 +0,0 @@
--- gc-7.2/include/gc.h	2014-06-01 19:00:48.000000000 +0200
-+++ gc-7.2/include/gc.h	2015-05-27 12:55:42.248984200 +0200
-@@ -1386,7 +1386,14 @@
- /* THREAD_LOCAL_ALLOC defined and the initial allocation call is not    */
- /* to GC_malloc() or GC_malloc_atomic().                                */
- 
-#ifdef __CYGWIN32__
-+#ifdef __CYGWIN__
-+#ifdef __x86_64__
-+  extern int __data_start__[], __data_end__[], __bss_start__[], __bss_end__[];
-+#define GC_DATASTART (__data_start__ < __bss_start__ ?\
-+                      (void *)__data_start__ : (void *)__bss_start__)
-+#define GC_DATAEND (__data_end__ < __bss_end__ ?\
-+                      (void *)__data_end__ : (void *)__bss_end__)
-+#else
-   /* Similarly gnu-win32 DLLs need explicit initialization from the     */
-   /* main program, as does AIX.                                         */
-   extern int _data_start__[], _data_end__[], _bss_start__[], _bss_end__[];
-@@ -1394,6 +1401,7 @@
-                        (void *)_data_start__ : (void *)_bss_start__)
- # define GC_DATAEND (_data_end__ > _bss_end__ ? \
-                      (void *)_data_end__ : (void *)_bss_end__)
-+#endif
- # define GC_INIT_CONF_ROOTS GC_add_roots(GC_DATASTART, GC_DATAEND); \
-                                  GC_gcollect() /* For blacklisting. */
-         /* Required at least if GC is in a DLL.  And doesn't hurt. */
--- gc-7.2/include/private/gcconfig.h	2014-06-01 19:00:48.000000000 +0200
-+++ gc-7.2/include/private/gcconfig.h	2015-05-27 12:46:01.864338700 +0200
-@@ -441,10 +441,20 @@
- #   endif
- #   define mach_type_known
- # endif
-# if defined(__CYGWIN32__) || defined(__CYGWIN__)
-+# if defined(__CYGWIN32__)
- #   define I386
- #   define CYGWIN32
- #   define mach_type_known
-+#if defined(__CYGWIN__)
-+#  if defined(__LP64__)
-+#    define X86_64
-+#    define mach_type_known
-+#  else
-+#    define I386
-+#  endif
-+#  define CYGWIN32
-+#  define mach_type_known
-+#endif
- # endif
- # if defined(__MINGW32__) && !defined(mach_type_known)
- #   define I386
-@@ -511,6 +521,16 @@
- #    define mach_type_known
- # endif
- 
-+#if defined(__CYGWIN__)
-+#  if defined(__LP64__)
-+#    define X86_64
-+#    define mach_type_known
-+#  else
-+#    define I386
-+#  endif
-+#  define CYGWIN32
-+#  define mach_type_known
-+#endif
- /* Feel free to add more clauses here */
- 
- /* Or manually define the machine type here.  A machine type is         */
-@@ -2279,6 +2299,20 @@
- #       define GWW_VDB
- #       define DATAEND  /* not needed */
- #   endif
-+
-+#   ifdef CYGWIN32
-+#       define OS_TYPE "CYGWIN32"
-+#       define DATASTART ((ptr_t)GC_DATASTART)  /* From gc.h */
-+#       define DATAEND   ((ptr_t)GC_DATAEND)
-+#       define ALIGNMENT 8
-+#       undef STACK_GRAN
-+#       define STACK_GRAN 0x10000
-+#       ifdef USE_MMAP
-+#         define NEED_FIND_LIMIT
-+#         define USE_MMAP_ANON
-+#       endif
-+#   endif
-+
- # endif /* X86_64 */
- 
- # ifdef HEXAGON
--- gc-7.2/os_dep.c	2015-05-27 12:25:29.097698800 +0200
-+++ gc-7.2/os_dep.c	2015-05-27 12:48:23.714600800 +0200
-@@ -764,10 +764,16 @@
-     /* gcc version of boehm-gc).                                        */
-     GC_API int GC_CALL GC_get_stack_base(struct GC_stack_base *sb)
-     {
-+# ifdef __x86_64__
-+      PNT_TIB pTib = NtCurrentTeb();
-+      void * _tlsbase = pTib->StackBase;
-+      /*void * _tlsbase = NtCurrentTeb()->pTib.StackBase;*/
-+      /*extern void * _tlsbase __asm__ ("%gs:8");*/
-+# else
-       void * _tlsbase;
-
-       __asm__ ("movl %%fs:4, %0"
-                : "=r" (_tlsbase));
-+# endif
-       sb -> mem_base = _tlsbase;
-       return GC_SUCCESS;
-     }
--- a/pkgs/development/libraries/boehm-gc/default.nix
+++ b/pkgs/development/libraries/boehm-gc/default.nix
@ -1,13 +1,15 @@
-{ lib, stdenv, fetchurl, enableLargeConfig ? false }:
+{ lib, stdenv, fetchurl, pkgconfig, libatomic_ops, enableLargeConfig ? false }:

 stdenv.mkDerivation rec {
-  name = "boehm-gc-7.2g";
+  name = "boehm-gc-7.6.0";

  src = fetchurl {
-    url = http://www.hboehm.info/gc/gc_source/gc-7.2g.tar.gz;
-    sha256 = "0bvw6cc555qg5b7dgcqy3ryiw0wir79dqy0glff3hjmyy7i2jkjq";
+    url = http://www.hboehm.info/gc/gc_source/gc-7.6.0.tar.gz;
+    sha256 = "143x7g0d0k6250ai6m2x3l4y352mzizi4wbgrmahxscv2aqjhjm1";
  };
-  patches = if stdenv.isCygwin then [ ./cygwin.patch ] else null;
+
+  buildInputs = [ libatomic_ops ];
+  nativeBuildInputs = [ pkgconfig ];

  outputs = [ "out" "dev" "doc" ];

--- a/pkgs/development/libraries/libfaketime/default.nix
+++ b/pkgs/development/libraries/libfaketime/default.nix
@ -8,6 +8,10 @@ stdenv.mkDerivation rec {
    sha256 = "1dw2lqsv2iqwxg51mdn25b4fjj3v357s0mc6ahxawqp210krg29s";
  };

+  patches = [
+    ./no-date-in-gzip-man-page.patch
+  ];
+
  preBuild = ''
    makeFlagsArray+=(PREFIX="$out" LIBDIRNAME=/lib)
  '';
--- a/pkgs/development/libraries/libfaketime/no-date-in-gzip-man-page.patch
+++ b/pkgs/development/libraries/libfaketime/no-date-in-gzip-man-page.patch
@ -0,0 +1,12 @@
+diff -ur libfaketime-0.9.5.orig/man/Makefile libfaketime-0.9.5/man/Makefile
+--- libfaketime-0.9.5.orig/man/Makefile	2013-10-13 11:19:30.000000000 +0200
+++ libfaketime-0.9.5/man/Makefile	2014-04-13 01:22:14.362296519 +0200
+@@ -6,7 +6,7 @@
+ 
+ install:
+ 	$(INSTALL) -Dm0644 faketime.1 "${DESTDIR}${PREFIX}/share/man/man1/faketime.1"
+-	gzip -f "${DESTDIR}${PREFIX}/share/man/man1/faketime.1"
+	gzip -9nf "${DESTDIR}${PREFIX}/share/man/man1/faketime.1"
+ 
+ uninstall:
+ 	rm -f "${DESTDIR}${PREFIX}/share/man/man1/faketime.1.gz"
--- a/pkgs/development/libraries/openjpeg/2.1.nix
+++ b/pkgs/development/libraries/openjpeg/2.1.nix
@ -5,4 +5,12 @@ callPackage ./generic.nix (args // rec {
  branch = "2.1";
  revision = "v2.1.2";
  sha256 = "0kdcl9sqjz0vagli4ad6bxq1r8ma086m0prpkm5x3dxp37hpjp8h";
+
+  patches = [
+    # Fetched from https://github.com/szukw000/openjpeg/commit/cadff5fb6e73398de26a92e96d3d7cac893af255
+    # Referenced from https://bugzilla.redhat.com/show_bug.cgi?id=1405135
+    # Put in our source code to make sure we don't lose it, since that
+    # referenced commit is someone else's fork, and not actually up-stream.
+    ./CVE-2016-9580-and-CVE-2016-9581.patch
+  ];
 })
--- a/pkgs/development/libraries/openjpeg/CVE-2016-9580-and-CVE-2016-9581.patch
+++ b/pkgs/development/libraries/openjpeg/CVE-2016-9580-and-CVE-2016-9581.patch
@ -0,0 +1,242 @@
+From cadff5fb6e73398de26a92e96d3d7cac893af255 Mon Sep 17 00:00:00 2001
+From: szukw000 <szukw000@arcor.de>
+Date: Fri, 9 Dec 2016 08:29:55 +0100
+Subject: [PATCH] These changes repair bugs of #871 and #872
+
+---
+ src/bin/jp2/converttif.c | 107 +++++++++++++++++++++++++++++++----------------
+ 1 file changed, 70 insertions(+), 37 deletions(-)
+
+diff --git a/src/bin/jp2/converttif.c b/src/bin/jp2/converttif.c
+index 143d3be..c690f8b 100644
+--- a/src/bin/jp2/converttif.c
+++ b/src/bin/jp2/converttif.c
+@@ -553,20 +553,18 @@ static void tif_32sto16u(const OPJ_INT32* pSrc, OPJ_UINT16* pDst, OPJ_SIZE_T len
+ 
+ int imagetotif(opj_image_t * image, const char *outfile)
+ {
+-	int width, height;
+-	int bps,adjust, sgnd;
+-	int tiPhoto;
+	uint32 width, height, bps, tiPhoto;
+	int adjust, sgnd;
+ 	TIFF *tif;
+ 	tdata_t buf;
+-	tsize_t strip_size;
+	tmsize_t strip_size, rowStride;
+ 	OPJ_UINT32 i, numcomps;
+-	OPJ_SIZE_T rowStride;
+ 	OPJ_INT32* buffer32s = NULL;
+ 	OPJ_INT32 const* planes[4];
+ 	convert_32s_PXCX cvtPxToCx = NULL;
+ 	convert_32sXXx_C1R cvt32sToTif = NULL;
+ 
+-	bps = (int)image->comps[0].prec;
+	bps = (uint32)image->comps[0].prec;
+ 	planes[0] = image->comps[0].data;
+ 	
+ 	numcomps = image->numcomps;
+@@ -674,13 +672,13 @@ int imagetotif(opj_image_t * image, const char *outfile)
+ 			break;
+ 	}
+ 	sgnd = (int)image->comps[0].sgnd;
+-	adjust = sgnd ? 1 << (image->comps[0].prec - 1) : 0;
+-	width   = (int)image->comps[0].w;
+-	height  = (int)image->comps[0].h;
+	adjust = sgnd ? (int)(1 << (image->comps[0].prec - 1)) : 0;
+	width   = (uint32)image->comps[0].w;
+	height  = (uint32)image->comps[0].h;
+ 	
+ 	TIFFSetField(tif, TIFFTAG_IMAGEWIDTH, width);
+ 	TIFFSetField(tif, TIFFTAG_IMAGELENGTH, height);
+-	TIFFSetField(tif, TIFFTAG_SAMPLESPERPIXEL, numcomps);
+	TIFFSetField(tif, TIFFTAG_SAMPLESPERPIXEL, (uint32)numcomps);
+ 	TIFFSetField(tif, TIFFTAG_BITSPERSAMPLE, bps);
+ 	TIFFSetField(tif, TIFFTAG_ORIENTATION, ORIENTATION_TOPLEFT);
+ 	TIFFSetField(tif, TIFFTAG_PLANARCONFIG, PLANARCONFIG_CONTIG);
+@@ -688,8 +686,8 @@ int imagetotif(opj_image_t * image, const char *outfile)
+ 	TIFFSetField(tif, TIFFTAG_ROWSPERSTRIP, 1);
+ 	
+ 	strip_size = TIFFStripSize(tif);
+-	rowStride = ((OPJ_SIZE_T)width * numcomps * (OPJ_SIZE_T)bps + 7U) / 8U;
+-	if (rowStride != (OPJ_SIZE_T)strip_size) {
+	rowStride = (width * numcomps * bps + 7U) / 8U;
+	if (rowStride != strip_size) {
+ 		fprintf(stderr, "Invalid TIFF strip size\n");
+ 		TIFFClose(tif);
+ 		return 1;
+@@ -699,7 +697,7 @@ int imagetotif(opj_image_t * image, const char *outfile)
+ 		TIFFClose(tif);
+ 		return 1;
+ 	}
+-	buffer32s = (OPJ_INT32 *)malloc((OPJ_SIZE_T)width * numcomps * sizeof(OPJ_INT32));
+	buffer32s = (OPJ_INT32 *)malloc((OPJ_SIZE_T)(width * numcomps * sizeof(OPJ_INT32)));
+ 	if (buffer32s == NULL) {
+ 		_TIFFfree(buf);
+ 		TIFFClose(tif);
+@@ -1211,20 +1209,19 @@ opj_image_t* tiftoimage(const char *filename, opj_cparameters_t *parameters)
+ 	TIFF *tif;
+ 	tdata_t buf;
+ 	tstrip_t strip;
+-	tsize_t strip_size;
+	tmsize_t strip_size;
+ 	int j, currentPlane, numcomps = 0, w, h;
+ 	OPJ_COLOR_SPACE color_space = OPJ_CLRSPC_UNKNOWN;
+ 	opj_image_cmptparm_t cmptparm[4]; /* RGBA */
+ 	opj_image_t *image = NULL;
+ 	int has_alpha = 0;
+-	unsigned short tiBps, tiPhoto, tiSf, tiSpp, tiPC;
+-	unsigned int tiWidth, tiHeight;
+	uint32 tiBps, tiPhoto, tiSf, tiSpp, tiPC, tiWidth, tiHeight;
+ 	OPJ_BOOL is_cinema = OPJ_IS_CINEMA(parameters->rsiz);
+ 	convert_XXx32s_C1R cvtTifTo32s = NULL;
+ 	convert_32s_CXPX cvtCxToPx = NULL;
+ 	OPJ_INT32* buffer32s = NULL;
+ 	OPJ_INT32* planes[4];
+-	OPJ_SIZE_T rowStride;
+	tmsize_t rowStride;
+ 	
+ 	tif = TIFFOpen(filename, "r");
+ 	
+@@ -1243,22 +1240,35 @@ opj_image_t* tiftoimage(const char *filename, opj_cparameters_t *parameters)
+ 	TIFFGetField(tif, TIFFTAG_SAMPLESPERPIXEL, &tiSpp);
+ 	TIFFGetField(tif, TIFFTAG_PHOTOMETRIC, &tiPhoto);
+ 	TIFFGetField(tif, TIFFTAG_PLANARCONFIG, &tiPC);
+-	w= (int)tiWidth;
+-	h= (int)tiHeight;
+-	
+-	if(tiBps > 16U) {
+-		fprintf(stderr,"tiftoimage: Bits=%d, Only 1 to 16 bits implemented\n",tiBps);
+-		fprintf(stderr,"\tAborting\n");
+
+	if(tiSpp == 0 || tiSpp > 4) { /* should be 1 ... 4 */
+		fprintf(stderr,"tiftoimage: Bad value for samples per pixel == %hu.\n"
+		 "\tAborting.\n", tiSpp);
+		TIFFClose(tif);
+		return NULL;
+	}
+	if(tiBps > 16U || tiBps == 0) {
+		fprintf(stderr,"tiftoimage: Bad values for Bits == %d.\n"
+		 "\tMax. 16 Bits are allowed here.\n\tAborting.\n",tiBps);
+ 		TIFFClose(tif);
+ 		return NULL;
+ 	}
+ 	if(tiPhoto != PHOTOMETRIC_MINISBLACK && tiPhoto != PHOTOMETRIC_RGB) {
+-		fprintf(stderr,"tiftoimage: Bad color format %d.\n\tOnly RGB(A) and GRAY(A) has been implemented\n",(int) tiPhoto);
+		fprintf(stderr,"tiftoimage: Bad color format %d.\n"
+		 "\tOnly RGB(A) and GRAY(A) has been implemented\n",(int) tiPhoto);
+ 		fprintf(stderr,"\tAborting\n");
+ 		TIFFClose(tif);
+ 		return NULL;
+ 	}
+-	
+	if(tiWidth == 0 || tiHeight == 0) {
+		fprintf(stderr,"tiftoimage: Bad values for width(%u) "
+		 "and/or height(%u)\n\tAborting.\n",tiWidth,tiHeight);
+		TIFFClose(tif);
+		return NULL;
+	}
+	w= (int)tiWidth;
+	h= (int)tiHeight;
+
+ 	switch (tiBps) {
+ 		case 1:
+ 		case 2:
+@@ -1312,7 +1322,7 @@ opj_image_t* tiftoimage(const char *filename, opj_cparameters_t *parameters)
+ 		
+ 		TIFFGetFieldDefaulted(tif, TIFFTAG_EXTRASAMPLES,
+ 													&extrasamples, &sampleinfo);
+-		
+
+ 		if(extrasamples >= 1)
+ 		{
+ 			switch(sampleinfo[0])
+@@ -1333,7 +1343,7 @@ opj_image_t* tiftoimage(const char *filename, opj_cparameters_t *parameters)
+ 		else /* extrasamples == 0 */
+ 			if(tiSpp == 4 || tiSpp == 2) has_alpha = 1;
+ 	}
+-	
+
+ 	/* initialize image components */
+ 	memset(&cmptparm[0], 0, 4 * sizeof(opj_image_cmptparm_t));
+ 	
+@@ -1346,7 +1356,7 @@ opj_image_t* tiftoimage(const char *filename, opj_cparameters_t *parameters)
+ 	} else {
+ 		is_cinema = 0U;
+ 	}
+-	
+
+ 	if(tiPhoto == PHOTOMETRIC_RGB) /* RGB(A) */
+ 	{
+ 		numcomps = 3 + has_alpha;
+@@ -1384,10 +1394,24 @@ opj_image_t* tiftoimage(const char *filename, opj_cparameters_t *parameters)
+ 	image->x0 = (OPJ_UINT32)parameters->image_offset_x0;
+ 	image->y0 = (OPJ_UINT32)parameters->image_offset_y0;
+ 	image->x1 =	!image->x0 ? (OPJ_UINT32)(w - 1) * (OPJ_UINT32)subsampling_dx + 1 :
+-	image->x0 + (OPJ_UINT32)(w - 1) * (OPJ_UINT32)subsampling_dx + 1;
+	 image->x0 + (OPJ_UINT32)(w - 1) * (OPJ_UINT32)subsampling_dx + 1;
+	if(image->x1 <= image->x0) {
+		fprintf(stderr,"tiftoimage: Bad value for image->x1(%d) vs. "
+		 "image->x0(%d)\n\tAborting.\n",image->x1,image->x0);
+		TIFFClose(tif);
+		opj_image_destroy(image);
+		return NULL;
+	}
+ 	image->y1 =	!image->y0 ? (OPJ_UINT32)(h - 1) * (OPJ_UINT32)subsampling_dy + 1 :
+-	image->y0 + (OPJ_UINT32)(h - 1) * (OPJ_UINT32)subsampling_dy + 1;
+-
+	 image->y0 + (OPJ_UINT32)(h - 1) * (OPJ_UINT32)subsampling_dy + 1;
+	if(image->y1 <= image->y0) {
+		fprintf(stderr,"tiftoimage: Bad value for image->y1(%d) vs. "
+		 "image->y0(%d)\n\tAborting.\n",image->y1,image->y0);
+		TIFFClose(tif);
+		opj_image_destroy(image);
+		return NULL;
+	}
+	
+ 	for(j = 0; j < numcomps; j++)
+ 	{
+ 		planes[j] = image->comps[j].data;
+@@ -1395,15 +1419,15 @@ opj_image_t* tiftoimage(const char *filename, opj_cparameters_t *parameters)
+ 	image->comps[numcomps - 1].alpha = (OPJ_UINT16)(1 - (numcomps & 1));
+ 		
+ 	strip_size = TIFFStripSize(tif);
+-	
+
+ 	buf = _TIFFmalloc(strip_size);
+ 	if (buf == NULL) {
+ 		TIFFClose(tif);
+ 		opj_image_destroy(image);
+ 		return NULL;
+ 	}
+-	rowStride = ((OPJ_SIZE_T)w * tiSpp * tiBps + 7U) / 8U;
+-	buffer32s = (OPJ_INT32 *)malloc((OPJ_SIZE_T)w * tiSpp * sizeof(OPJ_INT32));
+	rowStride = (w * tiSpp * tiBps + 7U) / 8U;
+	buffer32s = (OPJ_INT32 *)malloc((OPJ_SIZE_T)(w * tiSpp * sizeof(OPJ_INT32)));
+ 	if (buffer32s == NULL) {
+ 		_TIFFfree(buf);
+ 		TIFFClose(tif);
+@@ -1421,11 +1445,20 @@ opj_image_t* tiftoimage(const char *filename, opj_cparameters_t *parameters)
+ 		for(; (h > 0) && (strip < TIFFNumberOfStrips(tif)); strip++)
+ 		{
+ 				const OPJ_UINT8 *dat8;
+-				OPJ_SIZE_T ssize;
+				tmsize_t ssize;
+ 				
+-				ssize = (OPJ_SIZE_T)TIFFReadEncodedStrip(tif, strip, buf, strip_size);
+				ssize = TIFFReadEncodedStrip(tif, strip, buf, strip_size);
+				if(ssize < 1 || ssize > strip_size) {
+					fprintf(stderr,"tiftoimage: Bad value for ssize(%ld) "
+                     "vs. strip_size(%ld).\n\tAborting.\n",ssize,strip_size);
+					_TIFFfree(buf);
+					_TIFFfree(buffer32s);
+					TIFFClose(tif);
+					opj_image_destroy(image);
+					return NULL;
+				}
+ 				dat8 = (const OPJ_UINT8*)buf;
+-				
+
+ 				while (ssize >= rowStride) {
+ 					cvtTifTo32s(dat8, buffer32s, (OPJ_SIZE_T)w * tiSpp);
+ 					cvtCxToPx(buffer32s, planes, (OPJ_SIZE_T)w);
--- a/pkgs/development/libraries/openjpeg/generic.nix
+++ b/pkgs/development/libraries/openjpeg/generic.nix
@ -11,7 +11,7 @@
 , testsSupport ? false
 , jdk ? null
 # Inherit generics
-, branch, version, revision, sha256, ...
+, branch, version, revision, sha256, patches ? [], ...
 }:

 assert jpipServerSupport -> jpipLibSupport && curl != null && fcgi != null;
@ -33,6 +33,8 @@ stdenv.mkDerivation rec {
    inherit sha256;
  };

+  inherit patches;
+
  outputs = [ "out" "dev" ];

  cmakeFlags = [
--- a/pkgs/development/libraries/pupnp/default.nix
+++ b/pkgs/development/libraries/pupnp/default.nix
@ -1,15 +1,28 @@
-{ fetchurl, stdenv }:
+{ fetchFromGitHub, stdenv, autoconf, automake, libtool }:

 stdenv.mkDerivation rec {
-  name = "libupnp-1.6.20";
+  name = "libupnp-${version}";
+  version = "1.6.20";

-  src = fetchurl {
-    url = "mirror://sourceforge/pupnp/${name}.tar.bz2";
-    sha256 = "0qrsdsb1qm85hc4jy04qph895613d148f0x1mmk6z99y3q43fdgf";
+  src = fetchFromGitHub {
+    owner = "mrjimenez";
+    repo = "pupnp";
+    rev = "release-${version}";
+    sha256 = "10583dkz1l5sjp2833smql8w428x2nbh1fni8j6h9rji6ma2yhs0";
  };

+  buildInputs = [
+    autoconf
+    automake
+    libtool
+  ];
+
  hardeningDisable = [ "fortify" ];

+  preConfigure = ''
+    ./bootstrap
+  '';
+
  meta = {
    description = "libupnp, an open source UPnP development kit for Linux";

--- a/pkgs/development/libraries/qt-5/5.7/fetch.sh
+++ b/pkgs/development/libraries/qt-5/5.7/fetch.sh
@ -1,2 +1,2 @@
-WGET_ARGS=( http://download.qt.io/official_releases/qt/5.7/5.7.0/submodules/ \
+WGET_ARGS=( http://download.qt.io/official_releases/qt/5.7/5.7.1/submodules/ \
            -A '*.tar.xz' )
--- a/pkgs/development/libraries/qt-5/5.7/qtbase/default.nix
+++ b/pkgs/development/libraries/qt-5/5.7/qtbase/default.nix
@ -114,7 +114,6 @@ stdenv.mkDerivation {
    -widgets
    -opengl desktop
    -qml-debug
-    -nis
    -iconv
    -icu
    -pch
--- a/pkgs/development/libraries/qt-5/5.7/srcs.nix
+++ b/pkgs/development/libraries/qt-5/5.7/srcs.nix
@ -1,4 +1,4 @@
-# DO NOT EDIT! This file is generated automatically by fetchsrcs.sh
+# DO NOT EDIT! This file is generated automatically by fetch-kde-qt.sh
 { fetchurl, mirror }:

 {
@ -11,299 +11,299 @@
    };
  };
  qt3d = {
-    version = "5.7.0";
+    version = "5.7.1";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.7/5.7.0/submodules/qt3d-opensource-src-5.7.0.tar.xz";
-      sha256 = "0a9y4fxm4xmdl5hsv4hfvxcw7jmshy0mwd4j1r2ylqdmg4bql958";
-      name = "qt3d-opensource-src-5.7.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.7/5.7.1/submodules/qt3d-opensource-src-5.7.1.tar.xz";
+      sha256 = "1sh7yz8nb9iqz3bp6bfc2kmji70zq39d9c0sfxnhif3p2x1wyx0x";
+      name = "qt3d-opensource-src-5.7.1.tar.xz";
    };
  };
  qtactiveqt = {
-    version = "5.7.0";
+    version = "5.7.1";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.7/5.7.0/submodules/qtactiveqt-opensource-src-5.7.0.tar.xz";
-      sha256 = "149wj6a5i35k750129kz77y4r8q3hpxqzn1c676fcn9wpmfhay4v";
-      name = "qtactiveqt-opensource-src-5.7.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.7/5.7.1/submodules/qtactiveqt-opensource-src-5.7.1.tar.xz";
+      sha256 = "1md14jdgwsdczpfvc0qkk5agxqk7a9qs91k41zj15ykkw86r428c";
+      name = "qtactiveqt-opensource-src-5.7.1.tar.xz";
    };
  };
  qtandroidextras = {
-    version = "5.7.0";
+    version = "5.7.1";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.7/5.7.0/submodules/qtandroidextras-opensource-src-5.7.0.tar.xz";
-      sha256 = "1caimhfyag96v98j1b07pfzjl5inhsyfi9kxzy9nj0pkvpjdgi4g";
-      name = "qtandroidextras-opensource-src-5.7.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.7/5.7.1/submodules/qtandroidextras-opensource-src-5.7.1.tar.xz";
+      sha256 = "1wq9m7a3dh9k8z006cw6m96awc53yf5vnq3wdqf5yfclfz696lhg";
+      name = "qtandroidextras-opensource-src-5.7.1.tar.xz";
    };
  };
  qtbase = {
-    version = "5.7.0";
+    version = "5.7.1";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.7/5.7.0/submodules/qtbase-opensource-src-5.7.0.tar.xz";
-      sha256 = "0ip6xnizsn269r4s1nq9lkx8cdxkjqr1fidwrj3sa8xb7h96syry";
-      name = "qtbase-opensource-src-5.7.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.7/5.7.1/submodules/qtbase-opensource-src-5.7.1.tar.xz";
+      sha256 = "0zjmcrmnnmaz1lr9wc5i6y565hsvl8ycn790ivqaz62dv54zbkgd";
+      name = "qtbase-opensource-src-5.7.1.tar.xz";
    };
  };
  qtcanvas3d = {
-    version = "5.7.0";
+    version = "5.7.1";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.7/5.7.0/submodules/qtcanvas3d-opensource-src-5.7.0.tar.xz";
-      sha256 = "15xxwciyiy8rwrwgb7bgcbxdiiaba3l4cxxm7rdiqmhs9kyv6wbq";
-      name = "qtcanvas3d-opensource-src-5.7.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.7/5.7.1/submodules/qtcanvas3d-opensource-src-5.7.1.tar.xz";
+      sha256 = "1d5xpq3mhjg4ipxzap7s2vnlfcd02d3yq720npv10xxp2ww0i1x8";
+      name = "qtcanvas3d-opensource-src-5.7.1.tar.xz";
    };
  };
  qtcharts = {
-    version = "5.7.0";
+    version = "5.7.1";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.7/5.7.0/submodules/qtcharts-opensource-src-5.7.0.tar.xz";
-      sha256 = "0hsj5m9in4w9wzyvbs76v7zc67n9ja641ljc5vgfpbn7fmrsij1b";
-      name = "qtcharts-opensource-src-5.7.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.7/5.7.1/submodules/qtcharts-opensource-src-5.7.1.tar.xz";
+      sha256 = "1qrzcddwff2hxsbxrraff16j4abah2zkra2756s1mvydj9lyxzl5";
+      name = "qtcharts-opensource-src-5.7.1.tar.xz";
    };
  };
  qtconnectivity = {
-    version = "5.7.0";
+    version = "5.7.1";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.7/5.7.0/submodules/qtconnectivity-opensource-src-5.7.0.tar.xz";
-      sha256 = "00r7lc1w3snfp2qfqmviqzv0cw16zd8m1sfpvxvpl65yqmzcli4q";
-      name = "qtconnectivity-opensource-src-5.7.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.7/5.7.1/submodules/qtconnectivity-opensource-src-5.7.1.tar.xz";
+      sha256 = "0rmr7bd4skby7bax9hpj2sid2bq3098nkw7xm02mdp04hc3bks5k";
+      name = "qtconnectivity-opensource-src-5.7.1.tar.xz";
    };
  };
  qtdatavis3d = {
-    version = "5.7.0";
+    version = "5.7.1";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.7/5.7.0/submodules/qtdatavis3d-opensource-src-5.7.0.tar.xz";
-      sha256 = "18p82vh5s9bdshmxxkh7r9482i5vaih8nfya9f81l8ff7lw7lpcs";
-      name = "qtdatavis3d-opensource-src-5.7.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.7/5.7.1/submodules/qtdatavis3d-opensource-src-5.7.1.tar.xz";
+      sha256 = "1y00p0wyj5cw9c2925y537vpmmg9q3kpf7qr1s7sv67dvvf8bzqv";
+      name = "qtdatavis3d-opensource-src-5.7.1.tar.xz";
    };
  };
  qtdeclarative = {
-    version = "5.7.0";
+    version = "5.7.1";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.7/5.7.0/submodules/qtdeclarative-opensource-src-5.7.0.tar.xz";
-      sha256 = "1x7rij423g5chlfd2kix54f393vxwjvdfsn1c7sybqmfycwn5pl6";
-      name = "qtdeclarative-opensource-src-5.7.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.7/5.7.1/submodules/qtdeclarative-opensource-src-5.7.1.tar.xz";
+      sha256 = "0mjxfwnplpx60jc6y94krg00isddl9bfwc7dayl981njb4qds4zx";
+      name = "qtdeclarative-opensource-src-5.7.1.tar.xz";
    };
  };
  qtdeclarative-render2d = {
-    version = "5.7.0";
+    version = "5.7.1";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.7/5.7.0/submodules/qtdeclarative-render2d-opensource-src-5.7.0.tar.xz";
-      sha256 = "1qf893i7z2iyjpqpaxfhji4cgzlmpgh0w3vdqarpn51vcn7jj4q6";
-      name = "qtdeclarative-render2d-opensource-src-5.7.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.7/5.7.1/submodules/qtdeclarative-render2d-opensource-src-5.7.1.tar.xz";
+      sha256 = "0zwch9vn17f3bpy300jcfxx6cx9qymk5j7khx0x9k1xqid4166c3";
+      name = "qtdeclarative-render2d-opensource-src-5.7.1.tar.xz";
    };
  };
  qtdoc = {
-    version = "5.7.0";
+    version = "5.7.1";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.7/5.7.0/submodules/qtdoc-opensource-src-5.7.0.tar.xz";
-      sha256 = "0d7c7137jvxlwl91c2hh33l4falmjvkmsy1f7lyi73x6nnqzdz8i";
-      name = "qtdoc-opensource-src-5.7.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.7/5.7.1/submodules/qtdoc-opensource-src-5.7.1.tar.xz";
+      sha256 = "1nyrgfw3d8ja2cqb12vyq5mwryw89976f3xkpdhy49mvsws03ysm";
+      name = "qtdoc-opensource-src-5.7.1.tar.xz";
    };
  };
  qtgamepad = {
-    version = "5.7.0";
+    version = "5.7.1";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.7/5.7.0/submodules/qtgamepad-opensource-src-5.7.0.tar.xz";
-      sha256 = "0g36nlnnq19p9svl6pvklxybpwig7r7z4hw0d5dwc2id02ygg62q";
-      name = "qtgamepad-opensource-src-5.7.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.7/5.7.1/submodules/qtgamepad-opensource-src-5.7.1.tar.xz";
+      sha256 = "10lijbsg9xx5ddbbjymdgl41nxz99yn1qgiww2kkggxwwdjj2axv";
+      name = "qtgamepad-opensource-src-5.7.1.tar.xz";
    };
  };
  qtgraphicaleffects = {
-    version = "5.7.0";
+    version = "5.7.1";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.7/5.7.0/submodules/qtgraphicaleffects-opensource-src-5.7.0.tar.xz";
-      sha256 = "1rwdjg5mk6xpadmxfq64xfp573zp5lrj9illb9105ra5wff565n8";
-      name = "qtgraphicaleffects-opensource-src-5.7.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.7/5.7.1/submodules/qtgraphicaleffects-opensource-src-5.7.1.tar.xz";
+      sha256 = "1j2drnx7zp3w6cgvy7bn00fyk5v7vw1j1hidaqcg78lzb6zgls1c";
+      name = "qtgraphicaleffects-opensource-src-5.7.1.tar.xz";
    };
  };
  qtimageformats = {
-    version = "5.7.0";
+    version = "5.7.1";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.7/5.7.0/submodules/qtimageformats-opensource-src-5.7.0.tar.xz";
-      sha256 = "1rb27x7i2pmvsck6wax2cg31gqpzaakciy45wm5l3lcl86j48czg";
-      name = "qtimageformats-opensource-src-5.7.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.7/5.7.1/submodules/qtimageformats-opensource-src-5.7.1.tar.xz";
+      sha256 = "1x3p1xmw7spxa4bwriyrwsfrq31jabsdjsi5fras9y39naia55sg";
+      name = "qtimageformats-opensource-src-5.7.1.tar.xz";
    };
  };
  qtlocation = {
-    version = "5.7.0";
+    version = "5.7.1";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.7/5.7.0/submodules/qtlocation-opensource-src-5.7.0.tar.xz";
-      sha256 = "0rd898gndn41jrp78203lxd94ybfv693l0qg0myag4r46ikk69vh";
-      name = "qtlocation-opensource-src-5.7.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.7/5.7.1/submodules/qtlocation-opensource-src-5.7.1.tar.xz";
+      sha256 = "17zkzffzwbg6aqhsggs23cmwzq4y45m938842lsc423hfm7fdsgr";
+      name = "qtlocation-opensource-src-5.7.1.tar.xz";
    };
  };
  qtmacextras = {
-    version = "5.7.0";
+    version = "5.7.1";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.7/5.7.0/submodules/qtmacextras-opensource-src-5.7.0.tar.xz";
-      sha256 = "1p439sqnchrypggaqkfq3rvfk7xmvqgck4nhwv762jk3kgp48ccq";
-      name = "qtmacextras-opensource-src-5.7.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.7/5.7.1/submodules/qtmacextras-opensource-src-5.7.1.tar.xz";
+      sha256 = "0rr6nl1j6bq47lcq87zsqyma3cdqysamnngwbaccxvpznpcx7jhx";
+      name = "qtmacextras-opensource-src-5.7.1.tar.xz";
    };
  };
  qtmultimedia = {
-    version = "5.7.0";
+    version = "5.7.1";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.7/5.7.0/submodules/qtmultimedia-opensource-src-5.7.0.tar.xz";
-      sha256 = "0ndmhiflmyr144nq8drd5njsdi282ixsm4730q5n0ji2v9dp1bh5";
-      name = "qtmultimedia-opensource-src-5.7.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.7/5.7.1/submodules/qtmultimedia-opensource-src-5.7.1.tar.xz";
+      sha256 = "1vvxmgmvjnz9w1h2ph1j2fy77ij141ycx5fric60lq02pxzifax5";
+      name = "qtmultimedia-opensource-src-5.7.1.tar.xz";
    };
  };
  qtpurchasing = {
-    version = "5.7.0";
+    version = "5.7.1";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.7/5.7.0/submodules/qtpurchasing-opensource-src-5.7.0.tar.xz";
-      sha256 = "1db44q3d02nhmrh0fd239n2nsm74myac8saa6jqx1pcap4y4llby";
-      name = "qtpurchasing-opensource-src-5.7.0.tar.xz";
-    };
-  };
-  qtquickcontrols2 = {
-    version = "5.7.0";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.7/5.7.0/submodules/qtquickcontrols2-opensource-src-5.7.0.tar.xz";
-      sha256 = "0i8h933vhvx1bmniqdx0idg6vk82w9byd3dq0bb2phwjg5vv1xb3";
-      name = "qtquickcontrols2-opensource-src-5.7.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.7/5.7.1/submodules/qtpurchasing-opensource-src-5.7.1.tar.xz";
+      sha256 = "0hkvrgafz1hx9q4yc3nskv3pd3fszghvvd5a7mj33ynf55wpb57n";
+      name = "qtpurchasing-opensource-src-5.7.1.tar.xz";
    };
  };
  qtquickcontrols = {
-    version = "5.7.0";
+    version = "5.7.1";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.7/5.7.0/submodules/qtquickcontrols-opensource-src-5.7.0.tar.xz";
-      sha256 = "0cpcrmz9n5b4bgmshmk093lirl9xwqb23inchnai1zqg21vrmqfq";
-      name = "qtquickcontrols-opensource-src-5.7.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.7/5.7.1/submodules/qtquickcontrols-opensource-src-5.7.1.tar.xz";
+      sha256 = "17cyfyqzjbm9dhq9pjscz36y84y16rmxwk6h826gjfprddrimsvg";
+      name = "qtquickcontrols-opensource-src-5.7.1.tar.xz";
+    };
+  };
+  qtquickcontrols2 = {
+    version = "5.7.1";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.7/5.7.1/submodules/qtquickcontrols2-opensource-src-5.7.1.tar.xz";
+      sha256 = "1v77ydy4k15lksp3bi2kgha2h7m79g4n7c2qhbr09xnvpb8ars7j";
+      name = "qtquickcontrols2-opensource-src-5.7.1.tar.xz";
    };
  };
  qtscript = {
-    version = "5.7.0";
+    version = "5.7.1";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.7/5.7.0/submodules/qtscript-opensource-src-5.7.0.tar.xz";
-      sha256 = "0040890p5ilyrmcpndz1hhp08x2ms5gw4lp4n5iax2a957yy2i4w";
-      name = "qtscript-opensource-src-5.7.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.7/5.7.1/submodules/qtscript-opensource-src-5.7.1.tar.xz";
+      sha256 = "09m41n95448pszr7inlg03ycb66s1a9hzfylaka92382acf1myav";
+      name = "qtscript-opensource-src-5.7.1.tar.xz";
    };
  };
  qtscxml = {
-    version = "5.7.0";
+    version = "5.7.1";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.7/5.7.0/submodules/qtscxml-opensource-src-5.7.0.tar.xz";
-      sha256 = "1waidk96vp9510g94fry0sv1vm2lgzgpwybf6c2xybcsdkbi62rp";
-      name = "qtscxml-opensource-src-5.7.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.7/5.7.1/submodules/qtscxml-opensource-src-5.7.1.tar.xz";
+      sha256 = "135kknqdmib2cjryfmvfgv7a2qx9pyba3m7i7nkbc5d742r4mbcx";
+      name = "qtscxml-opensource-src-5.7.1.tar.xz";
    };
  };
  qtsensors = {
-    version = "5.7.0";
+    version = "5.7.1";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.7/5.7.0/submodules/qtsensors-opensource-src-5.7.0.tar.xz";
-      sha256 = "1gii6wg2xd3bkb86y5hgpmwcpl04xav030zscpl6fhscl9kcqg98";
-      name = "qtsensors-opensource-src-5.7.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.7/5.7.1/submodules/qtsensors-opensource-src-5.7.1.tar.xz";
+      sha256 = "041v1x8pwfzpyk6y0sy5zgm915pi15xdhiy18fd5wqayvcp99cyc";
+      name = "qtsensors-opensource-src-5.7.1.tar.xz";
    };
  };
  qtserialbus = {
-    version = "5.7.0";
+    version = "5.7.1";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.7/5.7.0/submodules/qtserialbus-opensource-src-5.7.0.tar.xz";
-      sha256 = "0f2xq6fm8lmvd88lc3l37kybqp4wqp71kdch14bwz79y7777lhrc";
-      name = "qtserialbus-opensource-src-5.7.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.7/5.7.1/submodules/qtserialbus-opensource-src-5.7.1.tar.xz";
+      sha256 = "0mxi43l2inpbar8rmg21qjg33bv3f1ycxjgvzjf12ncnybhdnzkj";
+      name = "qtserialbus-opensource-src-5.7.1.tar.xz";
    };
  };
  qtserialport = {
-    version = "5.7.0";
+    version = "5.7.1";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.7/5.7.0/submodules/qtserialport-opensource-src-5.7.0.tar.xz";
-      sha256 = "0rc2l14s59qskp16wqlkizfai32s41qlm7a86r3qahx28gc51qaw";
-      name = "qtserialport-opensource-src-5.7.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.7/5.7.1/submodules/qtserialport-opensource-src-5.7.1.tar.xz";
+      sha256 = "09jsryc0z49cz9783kq48rkn42f10c6krzivp812ddwjsfdy3mbn";
+      name = "qtserialport-opensource-src-5.7.1.tar.xz";
    };
  };
  qtsvg = {
-    version = "5.7.0";
+    version = "5.7.1";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.7/5.7.0/submodules/qtsvg-opensource-src-5.7.0.tar.xz";
-      sha256 = "10fqrlqkiq83xhx79g8d2sjy7hjdnp28067z8f4byj7db81rzy51";
-      name = "qtsvg-opensource-src-5.7.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.7/5.7.1/submodules/qtsvg-opensource-src-5.7.1.tar.xz";
+      sha256 = "0irr9h566hl9nx8p919rz276zbfvvd6vqdb6i9g6b3piikdigw5h";
+      name = "qtsvg-opensource-src-5.7.1.tar.xz";
    };
  };
  qttools = {
-    version = "5.7.0";
+    version = "5.7.1";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.7/5.7.0/submodules/qttools-opensource-src-5.7.0.tar.xz";
-      sha256 = "004m9l7bgh7qnncbyl3d5fkggdrqx58ib21xv4hflvvarxrssibg";
-      name = "qttools-opensource-src-5.7.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.7/5.7.1/submodules/qttools-opensource-src-5.7.1.tar.xz";
+      sha256 = "1b6zqa5690b8lqms7rrhb8rcq0xg5hp117v3m08qngbcd0i706b4";
+      name = "qttools-opensource-src-5.7.1.tar.xz";
    };
  };
  qttranslations = {
-    version = "5.7.0";
+    version = "5.7.1";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.7/5.7.0/submodules/qttranslations-opensource-src-5.7.0.tar.xz";
-      sha256 = "0vasg5ycg5rhj8ljk3aqg1sxfrlz3602n38fr14ip853yqld83ha";
-      name = "qttranslations-opensource-src-5.7.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.7/5.7.1/submodules/qttranslations-opensource-src-5.7.1.tar.xz";
+      sha256 = "1rsq0bp6p8yf41h1nxrbclxr4xq8v025cbi0lq7yh917ac4xpv0n";
+      name = "qttranslations-opensource-src-5.7.1.tar.xz";
    };
  };
  qtvirtualkeyboard = {
-    version = "5.7.0";
+    version = "5.7.1";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.7/5.7.0/submodules/qtvirtualkeyboard-opensource-src-5.7.0.tar.xz";
-      sha256 = "0bzzci32f8ji94p2n6n16n838lrykyy3h822gfw77c93ivk3shyz";
-      name = "qtvirtualkeyboard-opensource-src-5.7.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.7/5.7.1/submodules/qtvirtualkeyboard-opensource-src-5.7.1.tar.xz";
+      sha256 = "1p9acm75am5lybmn8j2339vck808dmayk4xwbr67jpfigs9qp2xj";
+      name = "qtvirtualkeyboard-opensource-src-5.7.1.tar.xz";
    };
  };
  qtwayland = {
-    version = "5.7.0";
+    version = "5.7.1";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.7/5.7.0/submodules/qtwayland-opensource-src-5.7.0.tar.xz";
-      sha256 = "04dynjcr6gxi3hcqdf688a4hkabi2l17slpcx9k0f3dxygwcgf96";
-      name = "qtwayland-opensource-src-5.7.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.7/5.7.1/submodules/qtwayland-opensource-src-5.7.1.tar.xz";
+      sha256 = "1iq1c89y4ggq0dxjlf62jyhh8a9l3x7y914x84w5pby8h3hwagzj";
+      name = "qtwayland-opensource-src-5.7.1.tar.xz";
    };
  };
  qtwebchannel = {
-    version = "5.7.0";
+    version = "5.7.1";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.7/5.7.0/submodules/qtwebchannel-opensource-src-5.7.0.tar.xz";
-      sha256 = "05lqfidlh1ahdd1j9y20p2037qbcq51zkdzj2m8fwhn7ghbwvd1s";
-      name = "qtwebchannel-opensource-src-5.7.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.7/5.7.1/submodules/qtwebchannel-opensource-src-5.7.1.tar.xz";
+      sha256 = "16rij92dxy4k5231l3dpmhy7cnz0cjkn50cpzaf014zrdz3kmav3";
+      name = "qtwebchannel-opensource-src-5.7.1.tar.xz";
    };
  };
  qtwebengine = {
-    version = "5.7.0";
+    version = "5.7.1";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.7/5.7.0/submodules/qtwebengine-opensource-src-5.7.0.tar.xz";
-      sha256 = "0pfwsqjh107jqdw1mzzrhn38jxl64d8lljk4586im2ndypzn4mwq";
-      name = "qtwebengine-opensource-src-5.7.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.7/5.7.1/submodules/qtwebengine-opensource-src-5.7.1.tar.xz";
+      sha256 = "0ayc3j17nampy7pg464nbi09wr2d3pfbpqql789m0av37lz8h091";
+      name = "qtwebengine-opensource-src-5.7.1.tar.xz";
    };
  };
  qtwebsockets = {
-    version = "5.7.0";
+    version = "5.7.1";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.7/5.7.0/submodules/qtwebsockets-opensource-src-5.7.0.tar.xz";
-      sha256 = "0hwb2l7iwf4wf7l95dli8j3b7h0nffp56skfg1x810kzj0df26vl";
-      name = "qtwebsockets-opensource-src-5.7.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.7/5.7.1/submodules/qtwebsockets-opensource-src-5.7.1.tar.xz";
+      sha256 = "1laj0slwibs0bg69kgrdhc9k1s6yisq3pcsr0r9rhbkzisv7aajw";
+      name = "qtwebsockets-opensource-src-5.7.1.tar.xz";
    };
  };
  qtwebview = {
-    version = "5.7.0";
+    version = "5.7.1";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.7/5.7.0/submodules/qtwebview-opensource-src-5.7.0.tar.xz";
-      sha256 = "1i2ikv1ah4g3rc1pivxiw77p0yj79lialqww91fj781g66pky6l0";
-      name = "qtwebview-opensource-src-5.7.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.7/5.7.1/submodules/qtwebview-opensource-src-5.7.1.tar.xz";
+      sha256 = "17qmyayy67ji4d3i3cq0wb8s7hqjrw224zr2blzjc1827rlzkg5k";
+      name = "qtwebview-opensource-src-5.7.1.tar.xz";
    };
  };
  qtwinextras = {
-    version = "5.7.0";
+    version = "5.7.1";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.7/5.7.0/submodules/qtwinextras-opensource-src-5.7.0.tar.xz";
-      sha256 = "1fh7kqfwgwi9pcfg9b6hp2fpgvs938wl96ppqan79apxlhqy5awd";
-      name = "qtwinextras-opensource-src-5.7.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.7/5.7.1/submodules/qtwinextras-opensource-src-5.7.1.tar.xz";
+      sha256 = "1k7kiq0k7qwsn06p6sg13lr8hnnz7lvvsx18gas46dggkyj66514";
+      name = "qtwinextras-opensource-src-5.7.1.tar.xz";
    };
  };
  qtx11extras = {
-    version = "5.7.0";
+    version = "5.7.1";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.7/5.7.0/submodules/qtx11extras-opensource-src-5.7.0.tar.xz";
-      sha256 = "1yrkn8pqdbvbqykas3wx1vdfimhjkgx3s5jgdxib9dgmgyx6vjzw";
-      name = "qtx11extras-opensource-src-5.7.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.7/5.7.1/submodules/qtx11extras-opensource-src-5.7.1.tar.xz";
+      sha256 = "09z49jm70f5i0gcdz9a16z00pg96x8pz7vri5wpirh3fqqn0qnjz";
+      name = "qtx11extras-opensource-src-5.7.1.tar.xz";
    };
  };
  qtxmlpatterns = {
-    version = "5.7.0";
+    version = "5.7.1";
    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.7/5.7.0/submodules/qtxmlpatterns-opensource-src-5.7.0.tar.xz";
-      sha256 = "02z2qxamslg6sphnaykjcjfpypq4b69pb586s43vw4fplm72m21q";
-      name = "qtxmlpatterns-opensource-src-5.7.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.7/5.7.1/submodules/qtxmlpatterns-opensource-src-5.7.1.tar.xz";
+      sha256 = "1rgqnpg64gn5agmvjwy0am8hp5fpxl3cdkixr1yrsdxi5a6961d8";
+      name = "qtxmlpatterns-opensource-src-5.7.1.tar.xz";
    };
  };
 }
--- a/pkgs/development/ocaml-modules/containers/default.nix
+++ b/pkgs/development/ocaml-modules/containers/default.nix
@ -6,7 +6,7 @@ let
  mkpath = p:
      "${p}/lib/ocaml/${ocaml.version}/site-lib";

-  version = "0.20";
+  version = "0.22";

 in

@ -17,7 +17,7 @@ stdenv.mkDerivation {
    owner = "c-cube";
    repo = "ocaml-containers";
    rev = "${version}";
-    sha256 = "1gwflgdbvj293cwi434aafrsgpdgj2sv7r1ghm4l4k5xn17l0qzg";
+    sha256 = "1kbf865z484z9nxskmg150xhfspikkvsxk0wbry5vvczqr63cwhq";
  };

  buildInputs = [ ocaml findlib ocamlbuild cppo gen sequence qtest ounit ocaml_oasis qcheck ];
--- a/pkgs/development/ocaml-modules/lablgtk/default.nix
+++ b/pkgs/development/ocaml-modules/lablgtk/default.nix
@ -8,11 +8,11 @@ assert stdenv.lib.versionAtLeast ocaml.version "3.12";

 stdenv.mkDerivation rec {
  name = "${pname}-${version}";
-  version = "2.18.3";
+  version = "2.18.5";

  src = fetchurl {
-    url = https://forge.ocamlcore.org/frs/download.php/1479/lablgtk-2.18.3.tar.gz;
-    sha256 = "1bybn3jafxf4cx25zvn8h2xj9agn1xjbn7j3ywxxqx6az7rfnnwp";
+    url = https://forge.ocamlcore.org/frs/download.php/1627/lablgtk-2.18.5.tar.gz;
+    sha256 = "0cyj6sfdvzx8hw7553lhgwc0krlgvlza0ph3dk9gsxy047dm3wib";
  };

  buildInputs = [ocaml findlib pkgconfig gtk2 libgnomecanvas libglade gtksourceview camlp4];
--- a/pkgs/development/ocaml-modules/pcre/default.nix
+++ b/pkgs/development/ocaml-modules/pcre/default.nix
@ -1,7 +1,7 @@
 {stdenv, buildOcaml, fetchurl, pcre, ocaml, findlib}:

 buildOcaml {
-  name = "ocaml-pcre";
+  name = "pcre";
  version = "7.1.1";

  src = fetchurl {
--- a/pkgs/development/tools/misc/rolespec/default.nix
+++ b/pkgs/development/tools/misc/rolespec/default.nix
@ -7,8 +7,8 @@ stdenv.mkDerivation rec {
  src = fetchFromGitHub {
    owner = "nickjj";
    repo = "rolespec";
-    rev = "64a2092773b77f7a888522ceddd815e97b129321";
-    sha256 = "1867acxy18a3cgi84iwsp37sxglaljn1dq50amahp5zkmd8x8vnz";
+    rev = "d9ee530cd709168882059776c482fc37f46cb743";
+    sha256 = "1jkidw6aqr0zfqwmcvlpi9qa140z2pxcfsd43xm5ikx6jcwjdrzl";
    inherit name;
  };

@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
    '';
    downloadPage = "https://github.com/nickjj/rolespec";
    license = licenses.gpl3;
-    version = "20160105";
+    version = "20161104";
    maintainers = [ maintainers.dochang ];
    platforms = platforms.unix;
  };
--- a/pkgs/development/tools/sauce-connect/default.nix
+++ b/pkgs/development/tools/sauce-connect/default.nix
@ -4,18 +4,18 @@ with lib;

 stdenv.mkDerivation rec {
  name = "sauce-connect-${version}";
-  version = "4.4.0";
+  version = "4.4.2";

  src = fetchurl (
    if stdenv.system == "x86_64-linux" then {
      url = "https://saucelabs.com/downloads/sc-${version}-linux.tar.gz";
-      sha256 = "19zgnw0qn5f775p581mq5ry086rhcnnhqc6x82hzmwfysbsyl7xs";
+      sha256 = "0n3c9ihrxqy4y4mzgchggqa2v7c0y9jw2yqnjdd7cf4nd24fixbq";
    } else if stdenv.system == "i686-linux" then {
      url = "https://saucelabs.com/downloads/sc-${version}-linux32.tar.gz";
-      sha256 = "1m4nf1yidwkmlwald0ycwzvnsp5p93nc4bs1xh67phw0b2db99x9";
+      sha256 = "1pdvx4apd4x1bsyl8lhzlpv3jp3xzyv7yrsl3wjrql17p2asaba6";
    } else {
      url = "https://saucelabs.com/downloads/sc-${version}-osx.zip";
-      sha256 = "1bpdpwqa9sw2n7vw2g8q4c1mzgh8wgwn4p7sbryc2ki90yz8ibga";
+      sha256 = "03kn7i0a6mpxfc6mz9h560wadhmw5qxn15is7cl9kgkz5j874xlz";
    }
  );

--- a/pkgs/games/minecraft-server/default.nix
+++ b/pkgs/games/minecraft-server/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name    = "minecraft-server-${version}";
-  version = "1.11";
+  version = "1.11.1";

  src  = fetchurl {
    url    = "http://s3.amazonaws.com/Minecraft.Download/versions/${version}/minecraft_server.${version}.jar";
-    sha256 = "10vgvkklv3l66cvin2ikva2nj86gjl6p9ffizd6r89ixv1grcxrj";
+    sha256 = "161cwwcv73zisac1biz9arrby8y8n0j4bn9hz9rvy8dszlrbq0l0";
  };

  preferLocalBuild = true;
--- a/pkgs/os-specific/darwin/apple-sdk/default.nix
+++ b/pkgs/os-specific/darwin/apple-sdk/default.nix
@ -1,42 +1,29 @@
-{ stdenv, fetchurl, xar, xz, cpio, pkgs, python }:
+{ stdenv, fetchurl, xar, gzip, cpio, pkgs }:

 let
-  # TODO: make this available to other packages and generalize the unpacking a bit
-  # from https://gist.github.com/pudquick/ff412bcb29c9c1fa4b8d
-  unpbzx = fetchurl {
-    url    = "https://gist.githubusercontent.com/pudquick/ff412bcb29c9c1fa4b8d/raw/24b25538ea8df8d0634a2a6189aa581ccc6a5b4b/parse_pbzx2.py";
-    sha256 = "0jgp6qbfl36i0jlz7as5zk2w20z4ca8wlrhdw49lwsld6wi3rfhc";
-  };
-
  # sadly needs to be exported because security_tool needs it
  sdk = stdenv.mkDerivation rec {
-    version = "10.11";
+    version = "10.9";
    name    = "MacOS_SDK-${version}";

-    # This URL comes from https://swscan.apple.com/content/catalogs/others/index-10.11-1.sucatalog, which we found by:
-    #  1. Google: site:swscan.apple.com and look for a name that seems appropriate for your version
-    #  2. In the resulting file, search for a file called DevSDK ending in .pkg
-    #  3. ???
-    #  4. Profit
    src = fetchurl {
-      url    = "http://swcdn.apple.com/content/downloads/61/58/031-85396/fsu2775ydsciy13wycm3zngxrjcp0eqsl2/DevSDK_OSX1011.pkg";
-      sha256 = "182yh8li653pjrzgk7s2dvsqm7vwkk6ry8n31qqs8c0xr67yrqgl";
+      url    = "http://swcdn.apple.com/content/downloads/27/02/031-06182/xxog8vxu8i6af781ivf4uhy6yt1lslex34/DevSDK_OSX109.pkg";
+      sha256 = "16b7aplha5573yl1d44nl2yxzp0w2hafihbyh7930wrcvba69iy4";
    };

-    buildInputs = [ xar xz cpio python ];
+    buildInputs = [ xar gzip cpio ];

    phases = [ "unpackPhase" "installPhase" "fixupPhase" ];

    unpackPhase = ''
      xar -x -f $src
-      python ${unpbzx} Payload
    '';

    installPhase = ''
      start="$(pwd)"
      mkdir -p $out
      cd $out
-      cat $start/Payload.*.xz | xz -d | cpio -idm
+      cat $start/Payload | gzip -d | cpio -idm

      mv usr/* .
      rmdir usr
@ -127,7 +114,6 @@ let
        popd >/dev/null
      }

-
      linkFramework "${name}.framework"
    '';

--- a/pkgs/os-specific/darwin/apple-sdk/frameworks.nix
+++ b/pkgs/os-specific/darwin/apple-sdk/frameworks.nix
@ -52,7 +52,6 @@ with frameworks; with libs; {
  GSS                     = [];
  GameController          = [];
  GameKit                 = [ Foundation ];
-  Hypervisor              = [];
  ICADevices              = [ Carbon CF IOBluetooth ];
  IMServicePlugIn         = [];
  IOBluetoothUI           = [ IOBluetooth ];
@ -117,6 +116,4 @@ with frameworks; with libs; {
  OpenDirectory       = [];
  Quartz              = [ QuickLook QTKit ];
  QuartzCore          = [ ApplicationServices CF CoreVideo OpenCL ];
-
-  vmnet = [];
 }
--- a/pkgs/os-specific/linux/kernel/linux-3.12.nix
+++ b/pkgs/os-specific/linux/kernel/linux-3.12.nix
@ -1,12 +1,12 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:

 import ./generic.nix (args // rec {
-  version = "3.12.68";
+  version = "3.12.69";
  extraMeta.branch = "3.12";

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz";
-    sha256 = "0k4kwxmm6vj840k4v6iyswsajaxsb5g9vrc7mzr4grflfbjrgh14";
+    sha256 = "1pzghmj0j2shms4n3knryigy73qssskd6awbgk6mmyg42wypbcmm";
  };

  kernelPatches = args.kernelPatches;
--- a/pkgs/os-specific/linux/kernel/linux-3.18.nix
+++ b/pkgs/os-specific/linux/kernel/linux-3.18.nix
@ -1,12 +1,12 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:

 import ./generic.nix (args // rec {
-  version = "3.18.44";
+  version = "3.18.45";
  extraMeta.branch = "3.18";

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz";
-    sha256 = "1cjdh9w2q164r53k06vv6nhxwjzm69nha5wndp8r1hjywjwcqqan";
+    sha256 = "1qwvqrlzpf57zvh57dsdk4c4swgbasf2ab75vcn2py8l7jl6rxf0";
  };

  kernelPatches = args.kernelPatches;
--- a/pkgs/os-specific/linux/multipath-tools/default.nix
+++ b/pkgs/os-specific/linux/multipath-tools/default.nix
@ -15,6 +15,8 @@ stdenv.mkDerivation rec {
    ' libmultipath/defaults.h
    sed -i -e 's,\$(DESTDIR)/\(usr/\)\?,$(prefix)/,g' \
      kpartx/Makefile libmpathpersist/Makefile
+    sed -i -e "s,GZIP = .*, GZIP = gzip -9n -c," \
+      Makefile.inc
  '';

  nativeBuildInputs = [ gzip ];
--- a/pkgs/os-specific/linux/wireguard/default.nix
+++ b/pkgs/os-specific/linux/wireguard/default.nix
@ -6,11 +6,11 @@ assert kernel != null -> stdenv.lib.versionAtLeast kernel.version "4.1";
 let
  name = "wireguard-${version}";

-  version = "0.0.20161209";
+  version = "0.0.20161218";

  src = fetchurl {
    url    = "https://git.zx2c4.com/WireGuard/snapshot/WireGuard-${version}.tar.xz";
-    sha256 = "11n8dq8a8w0qj8xg5np9w02kmk14hn5hphv2h4bjw9hs8yxvkaya";
+    sha256 = "d805035d3e99768e69d8cdeb8fb5250a59b994ce127fceb71a078582c30f5597";
  };

  meta = with stdenv.lib; {
--- a/pkgs/servers/http/tomcat/default.nix
+++ b/pkgs/servers/http/tomcat/default.nix
@ -51,14 +51,13 @@ in {

  tomcat85 = common {
    versionMajor = "8";
-    versionMinor = "5.8";
-    sha256 = "1rfws897m09pbnb1jc4684didpklfhqp86szv2jcqzdx0hlfxxs0";
+    versionMinor = "5.9";
+    sha256 = "1dy8bf18jwyi6p7ayb96gbhd4iyfq4d37s3qxnlll8vklfx388np";
  };

  tomcatUnstable = common {
    versionMajor = "9";
-    versionMinor = "0.0.M13";
-    sha256 = "0im3w4iqpar7x50vg7c9zkxyqf9x53xs5jvcq79xqgrmcqb9lk91";
+    versionMinor = "0.0.M15";
+    sha256 = "1spbq5vh2dplp83ki3fbbwl0klxq36s4rwkpcjdnwjxjymg9k432";
  };
-
 }
--- a/pkgs/servers/monitoring/nagios/default.nix
+++ b/pkgs/servers/monitoring/nagios/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name = "nagios-${version}";
-  version = "4.2.3";
+  version = "4.2.4";

  src = fetchurl {
    url = "mirror://sourceforge/nagios/nagios-4.x/${name}/${name}.tar.gz";
-    sha256 = "0p16sm5pkbzf4py30hwzm38194cl23wfzsvkhk4jkf3p1fq7xvl3";
+    sha256 = "0w0blbwiw0ps04b7gkyyk89qkgwsxh6gydhmggbm1kl3ar3mq1dh";
  };

  patches = [ ./nagios.patch ];
--- a/pkgs/shells/nix-zsh-completions/default.nix
+++ b/pkgs/shells/nix-zsh-completions/default.nix
@ -6,8 +6,8 @@ stdenv.mkDerivation rec {
  src = fetchFromGitHub {
    owner = "spwhitt";
    repo = "nix-zsh-completions";
-    rev = "0.2";
-    sha256 = "0wimjdxnkw1lzhjn28zm4pgbij86ym0z17ayivpzz27g0sacimga";
+    rev = "0.3";
+    sha256 = "1vwkd4nppjrvy6xb0vx4z73awrhaah1433dp6h4ghi3cdrrjn7ri";
  };

  installPhase = ''
@ -20,6 +20,6 @@ stdenv.mkDerivation rec {
    description = "ZSH completions for Nix, NixOS, and NixOps";
    license = stdenv.lib.licenses.bsd3;
    platforms = stdenv.lib.platforms.all;
-    maintainers = [ stdenv.lib.maintainers.spwhitt ];
+    maintainers = [ stdenv.lib.maintainers.spwhitt stdenv.lib.maintainers.olejorgenb ];
  };
 }
--- a/pkgs/shells/zsh/default.nix
+++ b/pkgs/shells/zsh/default.nix
@ -2,11 +2,11 @@

 let

-  version = "5.3";
+  version = "5.3.1";

  documentation = fetchurl {
    url = "mirror://sourceforge/zsh/zsh-${version}-doc.tar.gz";
-    sha256 = "0cvkdw7x6i4m2brc9aakw8d3bmp6baziv72amlq9jd65r421bq88";
+    sha256 = "0hbqn1zg3x5i9klqfzhizk88jzy8pkg65r9k41b3cn42lg3ncsy1";
  };

 in
@ -16,7 +16,7 @@ stdenv.mkDerivation {

  src = fetchurl {
    url = "mirror://sourceforge/zsh/zsh-${version}.tar.gz";
-    sha256 = "0vcsgc1ymqhq0acklhlq5skgj27z597x2a7nx5g3j6q4jvx778hx";
+    sha256 = "03h42gjqx7yb7qggi7ha0ndsggnnav1qm9vx737jwmiwzy8ab51x";
  };

  buildInputs = [ ncurses pcre ];
--- a/pkgs/tools/admin/certbot/default.nix
+++ b/pkgs/tools/admin/certbot/default.nix
@ -4,13 +4,13 @@

 python2Packages.buildPythonApplication rec {
  name = "certbot-${version}";
-  version = "0.6.0";
+  version = "0.9.3";

  src = fetchFromGitHub {
    owner = "certbot";
    repo = "certbot";
    rev = "v${version}";
-    sha256 = "1x0prlldkgg0hxmya4m5h3k3c872wr0jylmzpr3m04mk339yiw0c";
+    sha256 = "03yfr8vlq62l0h14qk03flrkbvbv9mc5cf6rmh37naj8jwpl8cic";
  };

  propagatedBuildInputs = with python2Packages; [
@ -32,7 +32,7 @@ python2Packages.buildPythonApplication rec {

  patchPhase = ''
    substituteInPlace certbot/notify.py --replace "/usr/sbin/sendmail" "/var/setuid-wrappers/sendmail"
-    substituteInPlace certbot/le_util.py --replace "sw_vers" "/usr/bin/sw_vers"
+    substituteInPlace certbot/util.py --replace "sw_vers" "/usr/bin/sw_vers"
  '';

  postInstall = ''
--- a/pkgs/tools/admin/simp_le/default.nix
+++ b/pkgs/tools/admin/simp_le/default.nix
@ -1,26 +1,16 @@
 { stdenv, fetchFromGitHub, fetchpatch, pythonPackages }:

 pythonPackages.buildPythonApplication rec {
-  name = "simp_le-2016-04-17";
+  name = "simp_le-2016-12-16";

+  # kuba/simp_le seems unmaintained
  src = fetchFromGitHub {
-    owner = "kuba";
+    owner = "zenhack";
    repo = "simp_le";
-    rev = "3a103b76f933f9aef782a47401dd2eff5057a6f7";
-    sha256 = "0x8gqazn09m30bn1l7xnf8snhbb7yz7sb09imciqmm4jqdvn797z";
+    rev = "63a43b8547cd9fbc87db6bcd9497c6e37f73abef";
+    sha256 = "04dr8lvcpi797722lsy06nxhlihrxdqgdy187pg3hl1ki2iq3ixx";
  };

-  patches = [
-    (fetchpatch {
-      url = "https://github.com/kuba/simp_le/commit/4bc788fdd611c4118c3f86b5f546779723aca5a7.patch";
-      sha256 = "0036p11qn3plydv5s5z6i28r6ihy1ipjl0y8la0izpkiq273byfc";
-    })
-    (fetchpatch {
-      url = "https://github.com/kuba/simp_le/commit/9ec7efe593cadb46348dc6924c1e6a31f0f9e636.patch";
-      sha256 = "0n3m94n14y9c42185ly47d061g6awc8vb8xs9abffaigxv59k06j";
-    })
-  ];
-
  propagatedBuildInputs = with pythonPackages; [ acme ];

  meta = with stdenv.lib; {
--- a/pkgs/tools/cd-dvd/nrg2iso/default.nix
+++ b/pkgs/tools/cd-dvd/nrg2iso/default.nix
@ -0,0 +1,23 @@
+{stdenv, fetchurl}:
+
+stdenv.mkDerivation rec {
+  name = "nrg2iso-${version}";
+  version = "0.4";
+
+  src = fetchurl {
+    url = "gregory.kokanosky.free.fr/v4/linux/${name}.tar.gz";
+    sha256 = "18sam7yy50rbfhjixwd7wx7kmfn1x1y5j80vwfxi5v408s39s115";
+  };
+
+  installPhase = ''
+    mkdir -pv $out/bin/
+    cp -v nrg2iso $out/bin/nrg2iso
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A linux utils for converting CD (or DVD) image generated by Nero Burning Rom to ISO format";
+    homepage = http://gregory.kokanosky.free.fr/v4/linux/nrg2iso.en.html;
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/tools/misc/lnav/default.nix
+++ b/pkgs/tools/misc/lnav/default.nix
@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
    owner = "tstack";
    repo = "lnav";
    rev = "v${meta.version}";
-    sha256 = "06h0hy8k0w692df2490dshxf2x8qcnw5myyp0k5jkc63ai2ra6aq";
+    sha256 = "0pag2rl7b6s2xfl80c629vhwsdvvlhcdy6732yvpgfv94w0zyjp9";
    inherit name;
  };

@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
    '';
    downloadPage = "https://github.com/tstack/lnav/releases";
    license = licenses.bsd2;
-    version = "0.8.0";
+    version = "0.8.1";
    maintainers = [ maintainers.dochang ];
  };

--- a/pkgs/tools/misc/parted/default.nix
+++ b/pkgs/tools/misc/parted/default.nix
@ -29,10 +29,9 @@ stdenv.mkDerivation rec {
    ++ stdenv.lib.optional (devicemapper == null) "--disable-device-mapper"
    ++ stdenv.lib.optional enableStatic "--enable-static";

-  # Tests are currently failing because Hydra runs builds as uid 0.
-  # It'd be better to try to fix these tests, but this is blocking
-  # all NixOS Hydra builds right now.
-  doCheck = false;
+  # Tests were previously failing due to Hydra running builds as uid 0.
+  # That should hopefully be fixed now.
+  doCheck = true;

  preCheck =
    stdenv.lib.optionalString doCheck
--- a/pkgs/tools/misc/yank/default.nix
+++ b/pkgs/tools/misc/yank/default.nix
@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
    owner = "mptre";
    repo = "yank";
    rev = "v${meta.version}";
-    sha256 = "0iv3ilyjcq6cd429qkg8mfpwagkb30617z0kdjlhk2s74chyaghm";
+    sha256 = "1m8pnarm8n5x6ylbzxv8j9amylrllw166arrj4cx9f2jp2zbzcic";
    inherit name;
  };

@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
    '';
    downloadPage = "https://github.com/mptre/yank/releases";
    license = licenses.mit;
-    version = "0.7.0";
+    version = "0.7.1";
    maintainers = [ maintainers.dochang ];
    platforms = platforms.unix;
  };
--- a/pkgs/tools/misc/youtube-dl/default.nix
+++ b/pkgs/tools/misc/youtube-dl/default.nix
@ -15,11 +15,11 @@ with stdenv.lib;
 buildPythonApplication rec {

  name = "youtube-dl-${version}";
-  version = "2016.12.15";
+  version = "2016.12.20";

  src = fetchurl {
    url = "https://yt-dl.org/downloads/${version}/${name}.tar.gz";
-    sha256 = "85d937a6edb8c14f8eac1b17d2e5d45574c7ec3f2cb792781ac1d8fb6a6ca39e";
+    sha256 = "f80d47d5e2a236ea6c9d8b4636199aea01a041607ce7b544babedb0fe1ce59a5";
  };

  buildInputs = [ makeWrapper zip ] ++ optional generateManPage pandoc;
--- a/pkgs/tools/networking/stun/default.nix
+++ b/pkgs/tools/networking/stun/default.nix
@ -20,8 +20,8 @@ stdenv.mkDerivation rec {

  preBuild = ''
    tar Jxvf ${srcManpages} debian/manpages
-    gzip -9 debian/manpages/stun.1
-    gzip -9 debian/manpages/stund.8
+    gzip -9n debian/manpages/stun.1
+    gzip -9n debian/manpages/stund.8
  '';

  installPhase = ''
--- a/pkgs/tools/networking/zerotierone/default.nix
+++ b/pkgs/tools/networking/zerotierone/default.nix
@ -28,7 +28,7 @@ stdenv.mkDerivation rec {

    mkdir -p $man/share/man/man8
    for cmd in zerotier-one.8 zerotier-cli.1 zerotier-idtool.1; do
-      cat doc/$cmd | gzip -9 > $man/share/man/man8/$cmd.gz
+      cat doc/$cmd | gzip -9n > $man/share/man/man8/$cmd.gz
    done
  '';

--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -1099,6 +1099,8 @@ in

  mdf2iso = callPackage ../tools/cd-dvd/mdf2iso { };

+  nrg2iso = callPackage ../tools/cd-dvd/nrg2iso { };
+
  libceph = ceph.lib;
  ceph = callPackage ../tools/filesystems/ceph { boost = boost159; };
  ceph-dev = ceph;
@ -1880,6 +1882,10 @@ in
    stdenv = overrideCC stdenv gcc49;
  };

+  gnome15 = callPackage ../applications/misc/gnome15 {
+    inherit (gnome2) gnome_python gnome_python_desktop;
+  };
+
  gnokii = callPackage ../tools/misc/gnokii { };

  gnuapl = callPackage ../development/interpreters/gnu-apl { };
@ -14809,6 +14815,8 @@ in

  ssr = callPackage ../applications/audio/soundscape-renderer {};

+  ssrc = callPackage ../applications/audio/ssrc { };
+
  stalonetray = callPackage ../applications/window-managers/stalonetray {};

  stp = callPackage ../applications/science/logic/stp {};
@ -17656,11 +17664,7 @@ in

  xcftools = callPackage ../tools/graphics/xcftools { };

-  xhyve = callPackage ../applications/virtualization/xhyve {
-    inherit (darwin.apple_sdk.frameworks) Hypervisor vmnet;
-    inherit (darwin.apple_sdk.libs) xpc;
-    inherit (darwin) libobjc;
-  };
+  xhyve = callPackage ../applications/virtualization/xhyve { };

  xinput_calibrator = callPackage ../tools/X11/xinput_calibrator { };

--- a/pkgs/top-level/default.nix
+++ b/pkgs/top-level/default.nix
@ -49,8 +49,8 @@ in let
  # reasonable default.
  platform =
    args.platform
-    or (config.platform
-    or (import ./platforms.nix).selectPlatformBySystem system);
+    or ( config.platform
+      or ((import ./platforms.nix).selectPlatformBySystem system) );

  # A few packages make a new package set to draw their dependencies from.
  # (Currently to get a cross tool chain, or forced-i686 package.) Rather than
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -729,6 +729,27 @@ in {
    };
  };

+  python-uinput = buildPythonPackage rec {
+    name = "python-uinput-${version}";
+    version = "0.11.2";
+
+    src = pkgs.fetchurl {
+      url = "mirror://pypi/p/python-uinput/${name}.tar.gz";
+      sha256 = "033zqiypjz0nigav6vz0s57pbzikvds55mxphrdpkdbpdikjnfcr";
+    };
+
+    buildInputs = [ pkgs.udev ];
+
+    NIX_CFLAGS_LINK = [ "-ludev" ];
+
+    meta = with stdenv.lib; {
+      description = "Pythonic API to Linux uinput kernel module";
+      homepage = "http://tjjr.fi/sw/python-uinput/";
+      license = licenses.gpl3Plus;
+      maintainers = with maintainers; [ abbradar ];
+    };
+  };
+
  almir = buildPythonPackage rec {
    name = "almir-0.1.8";

@ -3059,12 +3080,12 @@ in {
  };

  bottle = buildPythonPackage rec {
-    version = "0.12.9";
+    version = "0.12.11";
    name = "bottle-${version}";

    src = pkgs.fetchurl {
      url = "mirror://pypi/b/bottle/${name}.tar.gz";
-      sha256 = "0l80a1qkg7zbi8s077brfgm5w4ypwxgq9rvsvw16snc5jfsj82py";
+      sha256 = "0cd787lzggs933qfav6xicx5c78dz6npwgg3xc4rhah44nbqz5d1";
    };

    propagatedBuildInputs = with self; [ setuptools ];
@ -8870,12 +8891,9 @@ in {
      sha256 = "1rwmajsy9qhl3qhhy5mw0xmr3n8abxcq8baidpn0sxv6yjg2369z";
    };

-    # Disable certain tests. Reported upstream at:
-    # https://github.com/jflesch/libpillowfight/issues/2
-    postPatch = ''
-      sed -i -e '/test_\(all_2\|ace\)/i \    @unittest.expectedFailure' \
-        tests/tests_ace.py tests/tests_all.py
-    '';
+    # Disable tests because they're designed to only work on Debian:
+    # https://github.com/jflesch/libpillowfight/issues/2#issuecomment-268259174
+    doCheck = false;

    # Python 2.x is not supported, see:
    # https://github.com/jflesch/libpillowfight/issues/1
@ -20132,6 +20150,7 @@ in {
    buildInputs = with self; [ unittest2 ];

    doCheck = !isPyPy;
+    force-rebuild = 1;  # fix transient test suite error at http://hydra.nixos.org/build/45083762

    meta = {
      homepage = https://launchpad.net/pyflakes;
@ -20471,12 +20490,30 @@ in {
    };
  };

+  pyinputevent = buildPythonPackage rec {
+    name = "pyinputevent-2016-10-18";
+
+    src = pkgs.fetchFromGitHub {
+      owner = "ntzrmtthihu777";
+      repo = "pyinputevent";
+      rev = "d2075fa5db5d8a402735fe788bb33cf9fe272a5b";
+      sha256 = "0rkis0xp8f9jc00x7jb9kbvhdla24z1vl30djqa6wy6fx0cr6sib";
+    };
+
+    meta = {
+      homepage = "https://github.com/ntzrmtthihu777/pyinputevent";
+      description = "Python interface to the Input Subsystem's input_event and uinput";
+      license = licenses.bsd3;
+      platforms = platforms.linux;
+    };
+  };
+
  pyinotify = buildPythonPackage rec {
-    name = "pyinotify";
+    name = "pyinotify-${version}";
    version = "0.9.6";

    src = pkgs.fetchurl {
-      url = "mirror://pypi/p/${name}/${name}-${version}.tar.gz";
+      url = "mirror://pypi/p/${name}/${name}.tar.gz";
      sha256 = "1x3i9wmzw33fpkis203alygfnrkcmq9w1aydcm887jh6frfqm6cw";
    };

@ -26182,6 +26219,32 @@ in {
    };
  };

+  virtkey = buildPythonPackage rec {
+    name = "virtkey-${version}";
+    majorVersion = "0.63";
+    version = "${majorVersion}.0";
+
+    src = pkgs.fetchurl {
+      url = "https://launchpad.net/virtkey/${majorVersion}/${version}/+download/virtkey-${version}.tar.gz";
+      sha256 = "0hd99hrxn6bh3rxcrdnad5cqjsphrn1s6fzx91q07d44k6cg6qcr";
+    };
+
+    nativeBuildInputs = [ pkgs.pkgconfig ];
+
+    buildInputs =
+         [ pkgs.gtk2 ]
+      ++ (with pkgs.xorg; [ libX11 libXtst libXi libxkbfile xextproto xproto ]);
+
+    meta = {
+      description = "Extension to emulate keypresses and to get the layout information from the X server";
+      homepage = "https://launchpad.net/virtkey";
+      license = licenses.gpl3;
+      maintainers = with maintainers; [ abbradar ];
+    };
+  };
+
+
+
  virtual-display = buildPythonPackage rec {
    name = "PyVirtualDisplay-0.1.5";