diff --git a/nixos/modules/programs/bash/bash.nix b/nixos/modules/programs/bash/bash.nix
index ef1acdfe66e6..1abdb4973a44 100644
--- a/nixos/modules/programs/bash/bash.nix
+++ b/nixos/modules/programs/bash/bash.nix
@@ -14,13 +14,16 @@ let
   bashCompletion = optionalString cfg.enableCompletion ''
     # Check whether we're running a version of Bash that has support for
     # programmable completion. If we do, enable all modules installed in
-    # the system (and user profile).
+    # the system and user profile in obsolete /etc/bash_completion.d/
+    # directories. Bash loads completions in all
+    # $XDG_DATA_DIRS/share/bash-completion/completions/
+    # on demand, so they do not need to be sourced here.
     if shopt -q progcomp &>/dev/null; then
       . "${pkgs.bash-completion}/etc/profile.d/bash_completion.sh"
       nullglobStatus=$(shopt -p nullglob)
       shopt -s nullglob
       for p in $NIX_PROFILES; do
-        for m in "$p/etc/bash_completion.d/"* "$p/share/bash-completion/completions/"*; do
+        for m in "$p/etc/bash_completion.d/"*; do
           . $m
         done
       done
diff --git a/nixos/modules/services/networking/networkmanager.nix b/nixos/modules/services/networking/networkmanager.nix
index 6bdae32f72bb..d9ac4b0f274e 100644
--- a/nixos/modules/services/networking/networkmanager.nix
+++ b/nixos/modules/services/networking/networkmanager.nix
@@ -333,10 +333,6 @@ in {
       wireless.enable = lib.mkDefault false;
     };
 
-    powerManagement.resumeCommands = ''
-      ${config.systemd.package}/bin/systemctl restart network-manager
-    '';
-
     security.polkit.extraConfig = polkitConf;
 
     services.dbus.packages = cfg.packages;
diff --git a/pkgs/applications/altcoins/cryptop/default.nix b/pkgs/applications/altcoins/cryptop/default.nix
index 0136ab18ceac..01c47b320de5 100644
--- a/pkgs/applications/altcoins/cryptop/default.nix
+++ b/pkgs/applications/altcoins/cryptop/default.nix
@@ -1,16 +1,15 @@
-{ lib, python2}:
+{ lib, buildPythonApplication, fetchPypi, requests, requests-cache }:
 
-python2.pkgs.buildPythonApplication rec {
+buildPythonApplication rec {
   pname = "cryptop";
-  version = "0.1.0";
-  name = "${pname}-${version}";
+  version = "0.2.0";
 
-  src = python2.pkgs.fetchPypi {
+  src = fetchPypi {
     inherit pname version;
-    sha256 = "00glnlyig1aajh30knc5rnfbamwfxpg29js2db6mymjmfka8lbhh";
+    sha256 = "0akrrz735vjfrm78plwyg84vabj0x3qficq9xxmy9kr40fhdkzpb";
   };
 
-  propagatedBuildInputs = [ python2.pkgs.requests ];
+  propagatedBuildInputs = [ requests requests-cache ];
 
   # No tests in archive
   doCheck = false;
diff --git a/pkgs/applications/altcoins/default.nix b/pkgs/applications/altcoins/default.nix
index aeab29534691..0e5ffab01f44 100644
--- a/pkgs/applications/altcoins/default.nix
+++ b/pkgs/applications/altcoins/default.nix
@@ -1,4 +1,4 @@
-{ callPackage, boost155, boost162, openssl_1_1_0, haskellPackages, darwin, libsForQt5, miniupnpc_2 }:
+{ callPackage, boost155, boost162, openssl_1_1_0, haskellPackages, darwin, libsForQt5, miniupnpc_2, python3 }:
 
 rec {
 
@@ -20,6 +20,8 @@ rec {
   btc1 = callPackage ./btc1.nix { withGui = true; };
   btc1d = callPackage ./btc1.nix { withGui = false; };
 
+  cryptop = python3.pkgs.callPackage ./cryptop { };
+
   dashpay = callPackage ./dashpay.nix { };
 
   dogecoin  = callPackage ./dogecoin.nix { withGui = true; };
diff --git a/pkgs/applications/graphics/rawtherapee/ReleaseInfo.cmake b/pkgs/applications/graphics/rawtherapee/ReleaseInfo.cmake
deleted file mode 100644
index 7be7cb63f701..000000000000
--- a/pkgs/applications/graphics/rawtherapee/ReleaseInfo.cmake
+++ /dev/null
@@ -1,4 +0,0 @@
-set(GIT_BRANCH master)
-set(GIT_VERSION 4.2.1115)
-set(GIT_CHANGESET 0821eea7b6a4ac2fce1fcf644e06078e161e41e3)
-set(GIT_TAGDISTANCE 1115)
diff --git a/pkgs/applications/graphics/rawtherapee/default.nix b/pkgs/applications/graphics/rawtherapee/default.nix
index 91a34a505f2f..5743f0c1bcb6 100644
--- a/pkgs/applications/graphics/rawtherapee/default.nix
+++ b/pkgs/applications/graphics/rawtherapee/default.nix
@@ -14,10 +14,10 @@ stdenv.mkDerivation rec {
     sha256 = "1r6sx9zl1wkykgfx6k26268xadair6hzl15v5hmiri9sdhrn33q7";
   };
 
-  nativeBuildInputs = [ pkgconfig wrapGAppsHook ];
+  nativeBuildInputs = [ cmake pkgconfig wrapGAppsHook ];
 
   buildInputs = [
-    cmake pixman libpthreadstubs gtkmm3 libXau libXdmcp
+    pixman libpthreadstubs gtkmm3 libXau libXdmcp
     lcms2 libiptcdata libcanberra_gtk3 fftw expat pcre libsigcxx lensfun
   ];
 
diff --git a/pkgs/applications/graphics/rawtherapee/dev.nix b/pkgs/applications/graphics/rawtherapee/dev.nix
deleted file mode 100644
index fb73feb4a099..000000000000
--- a/pkgs/applications/graphics/rawtherapee/dev.nix
+++ /dev/null
@@ -1,37 +0,0 @@
-{ stdenv, fetchFromGitHub, pkgconfig, cmake, pixman, libpthreadstubs, gtkmm2, libXau
-, libXdmcp, lcms2, libiptcdata, libcanberra_gtk2, fftw, expat, pcre, libsigcxx
-}:
-
-stdenv.mkDerivation rec {
-  name = "rawtherapee-git-2016-10-10";
-
-  src = fetchFromGitHub {
-    owner = "Beep6581";
-    repo = "RawTherapee";
-    rev = "0821eea7b6a4ac2fce1fcf644e06078e161e41e3";
-    sha256 = "1nwb6b1qrpdyigwig7bvr42lf7na1ngm0q2cislcvb2v1nmk6nlz";
-  };
-
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ cmake pixman libpthreadstubs gtkmm2 libXau libXdmcp
-    lcms2 libiptcdata libcanberra_gtk2 fftw expat pcre libsigcxx ];
-
-  NIX_CFLAGS_COMPILE = "-std=gnu++11 -Wno-deprecated-declarations -Wno-unused-result";
-
-  # Copy generated ReleaseInfo.cmake so we don't need git. File was
-  # generated manually using `./tools/generateReleaseInfo` in the
-  # source folder. Make sure to regenerate it when updating.
-  preConfigure = ''
-    cp ${./ReleaseInfo.cmake} ./ReleaseInfo.cmake
-  '';
-
-  enableParallelBuilding = true;
-
-  meta = {
-    description = "RAW converter and digital photo processing software";
-    homepage = http://www.rawtherapee.com/;
-    license = stdenv.lib.licenses.gpl3Plus;
-    maintainers = with stdenv.lib.maintainers; [ viric jcumming mahe the-kenny ];
-    platforms = with stdenv.lib.platforms; linux;
-  };
-}
diff --git a/pkgs/applications/graphics/rawtherapee/fix-glibmm-output.patch b/pkgs/applications/graphics/rawtherapee/fix-glibmm-output.patch
deleted file mode 100644
index 3c87ce64e26b..000000000000
--- a/pkgs/applications/graphics/rawtherapee/fix-glibmm-output.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-From ca0afa8d5f3cc7d09b6bab32d155a87c550f0d7b Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Fl=C3=B6ssie?= <floessie.mail@gmail.com>
-Date: Sat, 1 Oct 2016 12:38:24 +0200
-Subject: [PATCH] Fix incompatibility with glibmm 2.50 (#3440)
-
-Kudos to @Hombre57 for the suggestion.
----
- rtgui/dirbrowser.cc | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/rtgui/dirbrowser.cc b/rtgui/dirbrowser.cc
-index d3fc8bf..6f25f0f 100644
---- a/rtgui/dirbrowser.cc
-+++ b/rtgui/dirbrowser.cc
-@@ -59,7 +59,7 @@ std::vector<Glib::ustring> listSubDirs (const Glib::RefPtr<Gio::File>& dir, bool
-     } catch (const Glib::Exception& exception) {
- 
-         if (options.rtSettings.verbose) {
--            std::cerr << "Failed to list subdirectories of \"" << dir << "\": " << exception.what () << std::endl;
-+            std::cerr << "Failed to list subdirectories of \"" << dir->get_basename() << "\": " << exception.what () << std::endl;
-         }
- 
-     }
diff --git a/pkgs/applications/misc/calibre/default.nix b/pkgs/applications/misc/calibre/default.nix
index e548b944a8d4..b406f38613d5 100644
--- a/pkgs/applications/misc/calibre/default.nix
+++ b/pkgs/applications/misc/calibre/default.nix
@@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
     poppler_utils libpng imagemagick libjpeg
     fontconfig podofo qtbase chmlib icu sqlite libusb1 libmtp xdg_utils wrapGAppsHook
   ] ++ (with python2Packages; [
-    apsw cssselect cssutils dateutil dns html5-parser lxml mechanize netifaces pillow
+    apsw cssselect cssutils dateutil dnspython html5-parser lxml mechanize netifaces pillow
     python pyqt5 sip
     regex msgpack
     # the following are distributed with calibre, but we use upstream instead
diff --git a/pkgs/applications/misc/electron-cash/default.nix b/pkgs/applications/misc/electron-cash/default.nix
index 56c1a8168a82..5b4cb82277a7 100644
--- a/pkgs/applications/misc/electron-cash/default.nix
+++ b/pkgs/applications/misc/electron-cash/default.nix
@@ -12,7 +12,7 @@ python2Packages.buildPythonApplication rec {
   };
 
   propagatedBuildInputs = with python2Packages; [
-    dns
+    dnspython
     ecdsa
     jsonrpclib
     pbkdf2
diff --git a/pkgs/applications/misc/electrum-dash/default.nix b/pkgs/applications/misc/electrum-dash/default.nix
index e7a5a1be1979..bde8d5b81e3e 100644
--- a/pkgs/applications/misc/electrum-dash/default.nix
+++ b/pkgs/applications/misc/electrum-dash/default.nix
@@ -10,7 +10,7 @@ python2Packages.buildPythonApplication rec {
   };
 
   propagatedBuildInputs = with python2Packages; [
-    dns
+    dnspython
     ecdsa
     pbkdf2
     protobuf
diff --git a/pkgs/applications/misc/electrum-ltc/default.nix b/pkgs/applications/misc/electrum-ltc/default.nix
index bb41f8665e57..58844500195e 100644
--- a/pkgs/applications/misc/electrum-ltc/default.nix
+++ b/pkgs/applications/misc/electrum-ltc/default.nix
@@ -21,7 +21,7 @@ python2Packages.buildPythonApplication rec {
     qrcode
     ltc_scrypt
     protobuf
-    dns
+    dnspython
     jsonrpclib
   ];
 
diff --git a/pkgs/applications/misc/electrum/default.nix b/pkgs/applications/misc/electrum/default.nix
index abe8d0dde84b..8de837991aab 100644
--- a/pkgs/applications/misc/electrum/default.nix
+++ b/pkgs/applications/misc/electrum/default.nix
@@ -10,7 +10,7 @@ python2Packages.buildPythonApplication rec {
   };
 
   propagatedBuildInputs = with python2Packages; [
-    dns
+    dnspython
     ecdsa
     jsonrpclib
     matplotlib
diff --git a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
index 1b6bf2ac3002..8f22045578d7 100644
--- a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
+++ b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
@@ -98,7 +98,7 @@ let
   fteLibPath = makeLibraryPath [ stdenv.cc.cc gmp ];
 
   # Upstream source
-  version = "7.0.10";
+  version = "7.0.11";
 
   lang = "en-US";
 
@@ -108,7 +108,7 @@ let
         "https://github.com/TheTorProject/gettorbrowser/releases/download/v${version}/tor-browser-linux64-${version}_${lang}.tar.xz"
         "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz"
       ];
-      sha256 = "0d1yvb1gmswlzyivr53xxfbd58bvr7nyangd85j36kar4bzbzvhh";
+      sha256 = "0i42jxdka0sq8fp6lj64n0az6m4g72il9qhdn63p0h7y4204i2v4";
     };
 
     "i686-linux" = fetchurl {
@@ -116,7 +116,7 @@ let
         "https://github.com/TheTorProject/gettorbrowser/releases/download/v${version}/tor-browser-linux32-${version}_${lang}.tar.xz"
         "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux32-${version}_${lang}.tar.xz"
       ];
-      sha256 = "0mjw8z76pbm1hshz875shkmjmxqhpan5la52r3y20v6rc0gfd9p5";
+      sha256 = "1p9s6wqghpkml662vnp5194i8gb9bkqxdr96fmw0fh305cyk25k0";
     };
   };
 in
diff --git a/pkgs/applications/networking/cluster/kontemplate/default.nix b/pkgs/applications/networking/cluster/kontemplate/default.nix
new file mode 100644
index 000000000000..aa5f86633318
--- /dev/null
+++ b/pkgs/applications/networking/cluster/kontemplate/default.nix
@@ -0,0 +1,26 @@
+{ stdenv, buildGoPackage, fetchFromGitHub }:
+
+buildGoPackage rec {
+  name = "kontemplate-${version}";
+  version = "1.3.0";
+
+  goPackagePath = "github.com/tazjin/kontemplate";
+
+  src = fetchFromGitHub {
+    rev = "v${version}";
+    owner = "tazjin";
+    repo = "kontemplate";
+    sha256 = "0g9hs9gwwkng9vbnv07ibhll0kggdprffpmhlbz9nmv81w2z3myi";
+  };
+
+  goDeps = ./deps.nix;
+
+  meta = with stdenv.lib; {
+    description = "Extremely simple Kubernetes resource templates";
+    homepage = http://kontemplate.works;
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ mbode ];
+    platforms = platforms.unix;
+    repositories.git = git://github.com/tazjin/kontemplate.git;
+  };
+}
diff --git a/pkgs/applications/networking/cluster/kontemplate/deps.nix b/pkgs/applications/networking/cluster/kontemplate/deps.nix
new file mode 100644
index 000000000000..1d6dfb3e64f5
--- /dev/null
+++ b/pkgs/applications/networking/cluster/kontemplate/deps.nix
@@ -0,0 +1,120 @@
+# This file was generated by https://github.com/kamilchm/go2nix v1.2.1
+[
+  {
+    goPackagePath = "github.com/Masterminds/semver";
+    fetch = {
+      type = "git";
+      url = "https://github.com/Masterminds/semver";
+      rev = "15d8430ab86497c5c0da827b748823945e1cf1e1";
+      sha256 = "0q5w6mjr1zws04z7x1ax1hp1zxdc4mbm9zsikgd6fv0c9ndnjr3q";
+    };
+  }
+  {
+    goPackagePath = "github.com/Masterminds/sprig";
+    fetch = {
+      type = "git";
+      url = "https://github.com/Masterminds/sprig";
+      rev = "b217b9c388de2cacde4354c536e520c52c055563";
+      sha256 = "1f41v3c8c7zagc4qjhcb6nwkvi8nzvf70f89a7ss2m6krkxz0m2a";
+    };
+  }
+  {
+    goPackagePath = "github.com/alecthomas/template";
+    fetch = {
+      type = "git";
+      url = "https://github.com/alecthomas/template";
+      rev = "a0175ee3bccc567396460bf5acd36800cb10c49c";
+      sha256 = "0qjgvvh26vk1cyfq9fadyhfgdj36f1iapbmr5xp6zqipldz8ffxj";
+    };
+  }
+  {
+    goPackagePath = "github.com/alecthomas/units";
+    fetch = {
+      type = "git";
+      url = "https://github.com/alecthomas/units";
+      rev = "2efee857e7cfd4f3d0138cc3cbb1b4966962b93a";
+      sha256 = "1j65b91qb9sbrml9cpabfrcf07wmgzzghrl7809hjjhrmbzri5bl";
+    };
+  }
+  {
+    goPackagePath = "github.com/aokoli/goutils";
+    fetch = {
+      type = "git";
+      url = "https://github.com/aokoli/goutils";
+      rev = "3391d3790d23d03408670993e957e8f408993c34";
+      sha256 = "1yj4yjfwylica31sgj69ygb04p9xxi22kgfxd0j5f58zr8vwww2n";
+    };
+  }
+  {
+    goPackagePath = "github.com/ghodss/yaml";
+    fetch = {
+      type = "git";
+      url = "https://github.com/ghodss/yaml";
+      rev = "0ca9ea5df5451ffdf184b4428c902747c2c11cd7";
+      sha256 = "0skwmimpy7hlh7pva2slpcplnm912rp3igs98xnqmn859kwa5v8g";
+    };
+  }
+  {
+    goPackagePath = "github.com/huandu/xstrings";
+    fetch = {
+      type = "git";
+      url = "https://github.com/huandu/xstrings";
+      rev = "37469d0c81a7910b49d64a0d308ded4823e90937";
+      sha256 = "18c2b4h7phdm71mn66x8bsmghjr1b2lpg07zcbgmab37y36bjl20";
+    };
+  }
+  {
+    goPackagePath = "github.com/imdario/mergo";
+    fetch = {
+      type = "git";
+      url = "https://github.com/imdario/mergo";
+      rev = "7fe0c75c13abdee74b09fcacef5ea1c6bba6a874";
+      sha256 = "1hclh5kpg25s2llpk7j7sm3vf66xci5jchn8wzdcr5fj372ghsbd";
+    };
+  }
+  {
+    goPackagePath = "github.com/polydawn/meep";
+    fetch = {
+      type = "git";
+      url = "https://github.com/polydawn/meep";
+      rev = "eaf1db2168fe380b4da17a35f0adddb5ae15a651";
+      sha256 = "12n134fb2imnj67xkbznzm0gqkg36hdxwr960y91qb5s2q2krxir";
+    };
+  }
+  {
+    goPackagePath = "github.com/satori/go.uuid";
+    fetch = {
+      type = "git";
+      url = "https://github.com/satori/go.uuid";
+      rev = "5bf94b69c6b68ee1b541973bb8e1144db23a194b";
+      sha256 = "0l782l4srv36pj8pfgn61996d0vjifld4a569rbjwq5h14pd0c07";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/crypto";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/crypto";
+      rev = "94eea52f7b742c7cbe0b03b22f0c4c8631ece122";
+      sha256 = "095zyvjb0m2pz382500miqadhk7w3nis8z3j941z8cq4rdafijvi";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/alecthomas/kingpin.v2";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/alecthomas/kingpin.v2";
+      rev = "1087e65c9441605df944fb12c33f0fe7072d18ca";
+      sha256 = "18llqzkdqf62qbqcv2fd3j0igl6cwwn4dissf5skkvxrcxjcmmj0";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/yaml.v2";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/yaml.v2";
+      rev = "287cf08546ab5e7e37d55a84f7ed3fd1db036de5";
+      sha256 = "15502klds9wwv567vclb9kx95gs8lnyzn4ybsk6l9fc7a67lk831";
+    };
+  }
+]
diff --git a/pkgs/applications/networking/cluster/kops/default.nix b/pkgs/applications/networking/cluster/kops/default.nix
index ff7cb245ae2a..41099192176c 100644
--- a/pkgs/applications/networking/cluster/kops/default.nix
+++ b/pkgs/applications/networking/cluster/kops/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   name = "kops-${version}";
-  version = "1.7.1";
+  version = "1.8.0";
 
   goPackagePath = "k8s.io/kops";
 
@@ -10,7 +10,7 @@ buildGoPackage rec {
     rev = version;
     owner = "kubernetes";
     repo = "kops";
-    sha256 = "0wii6w6hs9hjz3vvgqwa5ilwdi8a3qknmqsg3izazmgmnhl712wd";
+    sha256 = "0vaa18vhwk132fv7i896513isp66wnz9gn0b5613n3x28q0gvkmg";
   };
 
   buildInputs = [go-bindata];
diff --git a/pkgs/applications/networking/errbot/default.nix b/pkgs/applications/networking/errbot/default.nix
index 7d815c8fad08..611d7904991a 100644
--- a/pkgs/applications/networking/errbot/default.nix
+++ b/pkgs/applications/networking/errbot/default.nix
@@ -24,7 +24,7 @@ pythonPackages.buildPythonApplication rec {
   buildInputs = [ glibcLocales ];
   propagatedBuildInputs = with pythonPackages; [
     webtest bottle threadpool rocket-errbot requests jinja2
-    pyopenssl colorlog Yapsy markdown ansi pygments dns pep8
+    pyopenssl colorlog Yapsy markdown ansi pygments dnspython pep8
     daemonize pygments-markdown-lexer telegram irc slackclient
     sleekxmpp hypchat pytest
   ];
diff --git a/pkgs/applications/networking/gmailieer/default.nix b/pkgs/applications/networking/gmailieer/default.nix
index 26a05151d1cf..e56dbe0817e7 100644
--- a/pkgs/applications/networking/gmailieer/default.nix
+++ b/pkgs/applications/networking/gmailieer/default.nix
@@ -2,13 +2,13 @@
 
 python3Packages.buildPythonApplication rec {
   name = "gmailieer";
-  version = "0.4";
+  version = "0.5";
 
   src = fetchFromGitHub {
     owner = "gauteh";
     repo = "gmailieer";
     rev = "v${version}";
-    sha256 = "0vpc8nrh3cx91pcw45jjr2jllkqbx6w2khq7nyqv59gc4q5mz0p2";
+    sha256 = "152ky06k1wc3jffb48c6zh7c7pr732m9f4g1i316zaa4nx2ynfsa";
   };
 
   propagatedBuildInputs = with python3Packages; [
diff --git a/pkgs/applications/networking/mailreaders/notmuch/default.nix b/pkgs/applications/networking/mailreaders/notmuch/default.nix
index 6d268f69a7ce..15292ab768ac 100644
--- a/pkgs/applications/networking/mailreaders/notmuch/default.nix
+++ b/pkgs/applications/networking/mailreaders/notmuch/default.nix
@@ -12,7 +12,7 @@
 with stdenv.lib;
 
 stdenv.mkDerivation rec {
-  version = "0.25.2";
+  version = "0.25.3";
   name = "notmuch-${version}";
 
   passthru = {
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "http://notmuchmail.org/releases/${name}.tar.gz";
-    sha256 = "0ai6vbs9wzwfz7jcphgqsqpcbq137l34xhmcli4h5c8n82fvmdp4";
+    sha256 = "1fyx20rjpwbf2j1v5fpa5s0rjnwhcgvijzh2qyinp8rlbh1qxmab";
   };
 
   nativeBuildInputs = [ pkgconfig ];
@@ -40,14 +40,9 @@ stdenv.mkDerivation rec {
   ++ optionals (!stdenv.isDarwin) [ gdb man ]; # test dependencies
 
   postPatch = ''
-    find test -type f -exec \
+    find test/ -type f -exec \
       sed -i \
         -e "1s|#!/usr/bin/env bash|#!${bash}/bin/bash|" \
-        -e "s|gpg |${gnupg}/bin/gpg |" \
-        -e "s| gpg| ${gnupg}/bin/gpg|" \
-        -e "s|gpgsm |${gnupg}/bin/gpgsm |" \
-        -e "s| gpgsm| ${gnupg}/bin/gpgsm|" \
-        -e "s|crypto.gpg_path=gpg|crypto.gpg_path=${gnupg}/bin/gpg|" \
         "{}" ";"
 
     for src in \
diff --git a/pkgs/applications/window-managers/awesome/3.5.nix b/pkgs/applications/window-managers/awesome/3.5.nix
index 3a2a030b8a4d..f3d43d15efba 100644
--- a/pkgs/applications/window-managers/awesome/3.5.nix
+++ b/pkgs/applications/window-managers/awesome/3.5.nix
@@ -70,8 +70,8 @@ stdenv.mkDerivation rec {
 
   postInstall = ''
     wrapProgram $out/bin/awesome \
-      --prefix LUA_CPATH ";" '"${lgi}/lib/lua/${lua.luaversion}/?.so"' \
-      --prefix LUA_PATH ";" '"${lgi}/share/lua/${lua.luaversion}/?.lua;${lgi}/share/lua/${lua.luaversion}/lgi/?.lua"' \
+      --prefix LUA_CPATH ";" "${lgi}/lib/lua/${lua.luaversion}/?.so" \
+      --prefix LUA_PATH ";" "${lgi}/share/lua/${lua.luaversion}/?.lua;${lgi}/share/lua/${lua.luaversion}/lgi/?.lua" \
       --prefix GI_TYPELIB_PATH : "$GI_TYPELIB_PATH" \
       --prefix LD_LIBRARY_PATH : "$LD_LIBRARY_PATH" \
       --prefix PATH : "${stdenv.lib.makeBinPath [ compton unclutter procps iproute coreutils curl alsaUtils findutils xterm ]}"
diff --git a/pkgs/build-support/build-fhs-userenv/chroot-user.rb b/pkgs/build-support/build-fhs-userenv/chroot-user.rb
deleted file mode 100755
index 833aab16ceb1..000000000000
--- a/pkgs/build-support/build-fhs-userenv/chroot-user.rb
+++ /dev/null
@@ -1,169 +0,0 @@
-#!/usr/bin/env ruby
-
-# Bind mounts hierarchy: from => to (relative)
-# If 'to' is nil, path will be the same
-mounts = { '/' => 'host',
-           '/proc' => nil,
-           '/sys' => nil,
-           '/nix' => nil,
-           '/tmp' => nil,
-           '/var' => nil,
-           '/run' => nil,
-           '/dev' => nil,
-           '/home' => nil,
-         }
-
-# Propagate environment variables
-envvars = [ 'TERM',
-            'DISPLAY',
-            'XAUTHORITY',
-            'HOME',
-            'XDG_RUNTIME_DIR',
-            'LANG',
-            'SSL_CERT_FILE',
-            'DBUS_SESSION_BUS_ADDRESS',
-          ]
-
-require 'tmpdir'
-require 'fileutils'
-require 'pathname'
-require 'set'
-require 'fiddle'
-
-def write_file(path, str)
-  File.open(path, 'w') { |file| file.write str }
-end
-
-# Import C standard library and several needed calls
-$libc = Fiddle.dlopen nil
-
-def make_fcall(name, args, output)
-  c = Fiddle::Function.new $libc[name], args, output
-  lambda do |*args|
-    ret = c.call *args
-    raise SystemCallError.new Fiddle.last_error if ret < 0
-    return ret
-  end
-end
-
-$fork = make_fcall 'fork', [], Fiddle::TYPE_INT
-
-CLONE_NEWNS   = 0x00020000
-CLONE_NEWUSER = 0x10000000
-$unshare = make_fcall 'unshare', [Fiddle::TYPE_INT], Fiddle::TYPE_INT
-
-MS_BIND = 0x1000
-MS_REC  = 0x4000
-MS_SLAVE  = 0x80000
-$mount = make_fcall 'mount', [Fiddle::TYPE_VOIDP,
-                              Fiddle::TYPE_VOIDP,
-                              Fiddle::TYPE_VOIDP,
-                              Fiddle::TYPE_LONG,
-                              Fiddle::TYPE_VOIDP],
-                    Fiddle::TYPE_INT
-
-# Read command line args
-abort "Usage: chrootenv program args..." unless ARGV.length >= 1
-execp = ARGV
-
-# Populate extra mounts
-if not ENV["CHROOTENV_EXTRA_BINDS"].nil?
-  $stderr.puts "CHROOTENV_EXTRA_BINDS is discussed for deprecation."
-  $stderr.puts "If you have a usecase, please drop a note in issue #16030."
-  $stderr.puts "Notice that we now bind-mount host FS to '/host' and symlink all directories from it to '/' by default."
-
-  for extra in ENV["CHROOTENV_EXTRA_BINDS"].split(':')
-    paths = extra.split('=')
-    if not paths.empty?
-      if paths.size <= 2
-        mounts[paths[0]] = paths[1]
-      else
-        $stderr.puts "Ignoring invalid entry in CHROOTENV_EXTRA_BINDS: #{extra}"
-      end
-    end
-  end
-end
-
-# Set destination paths for mounts
-mounts = mounts.map { |k, v| [k, v.nil? ? k.sub(/^\/*/, '') : v] }.to_h
-
-# Create temporary directory for root and chdir
-root = Dir.mktmpdir 'chrootenv'
-
-# Fork process; we need this to do a proper cleanup because
-# child process will chroot into temporary directory.
-# We use imported 'fork' instead of native to overcome
-# CRuby's meddling with threads; this should be safe because
-# we don't use threads at all.
-$cpid = $fork.call
-if $cpid == 0
-  # If we are root, no need to create new user namespace.
-  if Process.uid == 0
-    $unshare.call CLONE_NEWNS
-    # Mark all mounted filesystems as slave so changes
-    # don't propagate to the parent mount namespace.
-    $mount.call nil, '/', nil, MS_REC | MS_SLAVE, nil
-  else
-    # Save user UID and GID
-    uid = Process.uid
-    gid = Process.gid
-
-    # Create new mount and user namespaces
-    # CLONE_NEWUSER requires a program to be non-threaded, hence
-    # native fork above.
-    $unshare.call CLONE_NEWNS | CLONE_NEWUSER
-
-    # Map users and groups to the parent namespace
-    begin
-      # setgroups is only available since Linux 3.19
-      write_file '/proc/self/setgroups', 'deny'
-    rescue
-    end
-    write_file '/proc/self/uid_map', "#{uid} #{uid} 1"
-    write_file '/proc/self/gid_map', "#{gid} #{gid} 1"
-  end
-
-  # Do rbind mounts.
-  mounts.each do |from, rto|
-    to = "#{root}/#{rto}"
-    FileUtils.mkdir_p to
-    $mount.call from, to, nil, MS_BIND | MS_REC, nil
-  end
-
-  # Don't make root private so privilege drops inside chroot are possible
-  File.chmod(0755, root)
-  # Chroot!
-  Dir.chroot root
-  Dir.chdir '/'
-
-  # New environment
-  new_env = Hash[ envvars.map { |x| [x, ENV[x]] } ]
-
-  # Finally, exec!
-  exec(new_env, *execp, close_others: true, unsetenv_others: true)
-end
-
-# Wait for a child. If we catch a signal, resend it to child and continue
-# waiting.
-def wait_child
-  begin
-    Process.wait
-
-    # Return child's exit code
-    if $?.exited?
-      exit $?.exitstatus
-      else
-      exit 1
-    end
-  rescue SignalException => e
-    Process.kill e.signo, $cpid
-    wait_child
-  end
-end
-
-begin
-  wait_child
-ensure
-  # Cleanup
-  FileUtils.rm_rf root, secure: true
-end
diff --git a/pkgs/build-support/build-fhs-userenv/chrootenv.c b/pkgs/build-support/build-fhs-userenv/chrootenv.c
new file mode 100644
index 000000000000..8d6c98959cc9
--- /dev/null
+++ b/pkgs/build-support/build-fhs-userenv/chrootenv.c
@@ -0,0 +1,182 @@
+#define _GNU_SOURCE
+
+#include <errno.h>
+#include <error.h>
+
+#define errorf(status, fmt, ...)                                               \
+  error_at_line(status, errno, __FILE__, __LINE__, fmt, ##__VA_ARGS__)
+
+#include <dirent.h>
+#include <ftw.h>
+#include <sched.h>
+#include <stdarg.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sysexits.h>
+#include <unistd.h>
+
+#include <sys/mount.h>
+#include <sys/stat.h>
+#include <sys/wait.h>
+
+char *env_whitelist[] = {"TERM",
+                         "DISPLAY",
+                         "XAUTHORITY",
+                         "HOME",
+                         "XDG_RUNTIME_DIR",
+                         "LANG",
+                         "SSL_CERT_FILE",
+                         "DBUS_SESSION_BUS_ADDRESS"};
+
+char **env_build(char *names[], size_t len) {
+  char *env, **ret = malloc((len + 1) * sizeof(char *)), **ptr = ret;
+
+  for (size_t i = 0; i < len; i++) {
+    if ((env = getenv(names[i]))) {
+      if (asprintf(ptr++, "%s=%s", names[i], env) < 0)
+        errorf(EX_OSERR, "asprintf");
+    }
+  }
+
+  *ptr = NULL;
+  return ret;
+}
+
+struct bind {
+  char *from;
+  char *to;
+};
+
+struct bind binds[] = {{"/", "host"},   {"/proc", "proc"}, {"/sys", "sys"},
+                       {"/nix", "nix"}, {"/tmp", "tmp"},   {"/var", "var"},
+                       {"/run", "run"}, {"/dev", "dev"},   {"/home", "home"}};
+
+void bind(struct bind *bind) {
+  DIR *src = opendir(bind->from);
+
+  if (src) {
+    if (closedir(src) < 0)
+      errorf(EX_IOERR, "closedir");
+
+    if (mkdir(bind->to, 0755) < 0)
+      errorf(EX_IOERR, "mkdir");
+
+    if (mount(bind->from, bind->to, "bind", MS_BIND | MS_REC, NULL) < 0)
+      errorf(EX_OSERR, "mount");
+
+  } else {
+    // https://github.com/NixOS/nixpkgs/issues/31104
+    if (errno != ENOENT)
+      errorf(EX_OSERR, "opendir");
+  }
+}
+
+void spitf(char *path, char *fmt, ...) {
+  va_list args;
+  va_start(args, fmt);
+
+  FILE *f = fopen(path, "w");
+
+  if (f == NULL)
+    errorf(EX_IOERR, "spitf(%s): fopen", path);
+
+  if (vfprintf(f, fmt, args) < 0)
+    errorf(EX_IOERR, "spitf(%s): vfprintf", path);
+
+  if (fclose(f) < 0)
+    errorf(EX_IOERR, "spitf(%s): fclose", path);
+}
+
+int nftw_rm(const char *path, const struct stat *sb, int type,
+            struct FTW *ftw) {
+  if (remove(path) < 0)
+    errorf(EX_IOERR, "nftw_rm");
+
+  return 0;
+}
+
+#define LEN(x) sizeof(x) / sizeof(*x)
+
+int main(int argc, char *argv[]) {
+  if (argc < 2) {
+    fprintf(stderr, "Usage: %s command [arguments...]\n"
+                    "Requires Linux kernel >= 3.19 with CONFIG_USER_NS.\n",
+            argv[0]);
+    exit(EX_USAGE);
+  }
+
+  char tmpl[] = "/tmp/chrootenvXXXXXX";
+  char *root = mkdtemp(tmpl);
+
+  if (root == NULL)
+    errorf(EX_IOERR, "mkdtemp");
+
+  // Don't make root private so that privilege drops inside chroot are possible:
+  if (chmod(root, 0755) < 0)
+    errorf(EX_IOERR, "chmod");
+
+  pid_t cpid = fork();
+
+  if (cpid < 0)
+    errorf(EX_OSERR, "fork");
+
+  if (cpid == 0) {
+    uid_t uid = getuid();
+    gid_t gid = getgid();
+
+    // If we are root, no need to create new user namespace.
+    if (uid == 0) {
+      if (unshare(CLONE_NEWNS) < 0)
+        errorf(EX_OSERR, "unshare() failed: You may have an old kernel or have CLONE_NEWUSER disabled by your distribution security settings.");
+      // Mark all mounted filesystems as slave so changes
+      // don't propagate to the parent mount namespace.
+      if (mount(NULL, "/", NULL, MS_REC | MS_SLAVE, NULL) < 0)
+        errorf(EX_OSERR, "mount");
+    } else {
+      // Create new mount and user namespaces. CLONE_NEWUSER
+      // requires a program to be non-threaded.
+      if (unshare(CLONE_NEWNS | CLONE_NEWUSER) < 0)
+        errorf(EX_OSERR, "unshare");
+
+      // Map users and groups to the parent namespace.
+      // setgroups is only available since Linux 3.19:
+      spitf("/proc/self/setgroups", "deny");
+
+      spitf("/proc/self/uid_map", "%d %d 1", uid, uid);
+      spitf("/proc/self/gid_map", "%d %d 1", gid, gid);
+    }
+
+    if (chdir(root) < 0)
+      errorf(EX_IOERR, "chdir");
+
+    for (size_t i = 0; i < LEN(binds); i++)
+      bind(&binds[i]);
+
+    if (chroot(root) < 0)
+      errorf(EX_OSERR, "chroot");
+
+    if (chdir("/") < 0)
+      errorf(EX_OSERR, "chdir");
+
+    argv++;
+
+    if (execvpe(*argv, argv, env_build(env_whitelist, LEN(env_whitelist))) < 0)
+      errorf(EX_OSERR, "execvpe");
+  }
+
+  int status;
+
+  if (waitpid(cpid, &status, 0) < 0)
+    errorf(EX_OSERR, "waitpid");
+
+  if (nftw(root, nftw_rm, getdtablesize(), FTW_DEPTH | FTW_MOUNT | FTW_PHYS) < 0)
+    errorf(EX_IOERR, "nftw");
+
+  if (WIFEXITED(status))
+    return WEXITSTATUS(status);
+  else if (WIFSIGNALED(status))
+    kill(getpid(), WTERMSIG(status));
+
+  return EX_OSERR;
+}
diff --git a/pkgs/build-support/build-fhs-userenv/default.nix b/pkgs/build-support/build-fhs-userenv/default.nix
index d91cdffcf392..5f3ec4dc8eaf 100644
--- a/pkgs/build-support/build-fhs-userenv/default.nix
+++ b/pkgs/build-support/build-fhs-userenv/default.nix
@@ -2,16 +2,19 @@
 
 let buildFHSEnv = callPackage ./env.nix { }; in
 
-args@{ name, runScript ? "bash", extraBindMounts ? [], extraInstallCommands ? "", meta ? {}, passthru ? {}, ... }:
+args@{ name, runScript ? "bash", extraInstallCommands ? "", meta ? {}, passthru ? {}, ... }:
 
 let
-  env = buildFHSEnv (removeAttrs args [ "runScript" "extraBindMounts" "extraInstallCommands" "meta" "passthru" ]);
+  env = buildFHSEnv (removeAttrs args [ "runScript" "extraInstallCommands" "meta" "passthru" ]);
 
-  # Sandboxing script
-  chroot-user = writeScript "chroot-user" ''
-    #! ${ruby}/bin/ruby
-    ${builtins.readFile ./chroot-user.rb}
-  '';
+  chrootenv = stdenv.mkDerivation {
+    name = "chrootenv";
+
+    unpackPhase = "cp ${./chrootenv.c} chrootenv.c";
+    installPhase = "cp chrootenv $out";
+
+    makeFlags = [ "chrootenv" ];
+  };
 
   init = run: writeScript "${name}-init" ''
     #! ${stdenv.shell}
@@ -32,8 +35,7 @@ in runCommand name {
   passthru = passthru // {
     env = runCommand "${name}-shell-env" {
       shellHook = ''
-        ${lib.optionalString (extraBindMounts != []) ''export CHROOTENV_EXTRA_BINDS="${lib.concatStringsSep ":" extraBindMounts}:$CHROOTENV_EXTRA_BINDS"''}
-        exec ${chroot-user} ${init "bash"} "$(pwd)"
+        exec ${chrootenv} ${init "bash"} "$(pwd)"
       '';
     } ''
       echo >&2 ""
@@ -46,8 +48,7 @@ in runCommand name {
   mkdir -p $out/bin
   cat <<EOF >$out/bin/${name}
   #! ${stdenv.shell}
-  ${lib.optionalString (extraBindMounts != []) ''export CHROOTENV_EXTRA_BINDS="${lib.concatStringsSep ":" extraBindMounts}:$CHROOTENV_EXTRA_BINDS"''}
-  exec ${chroot-user} ${init runScript} "\$(pwd)" "\$@"
+  exec ${chrootenv} ${init runScript} "\$(pwd)" "\$@"
   EOF
   chmod +x $out/bin/${name}
   ${extraInstallCommands}
diff --git a/pkgs/development/compilers/hhvm/default.nix b/pkgs/development/compilers/hhvm/default.nix
index 4159b7bd52b7..2f84387a8888 100644
--- a/pkgs/development/compilers/hhvm/default.nix
+++ b/pkgs/development/compilers/hhvm/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchgit, fetchurl, cmake, pkgconfig, boost, libunwind, libmemcached
+{ stdenv, fetchgit, cmake, pkgconfig, boost, libunwind, libmemcached
 , pcre, libevent, gd, curl, libxml2, icu, flex, bison, openssl, zlib, php
 , expat, libcap, oniguruma, libdwarf, libmcrypt, tbb, gperftools, glog, libkrb5
 , bzip2, openldap, readline, libelf, uwimap, binutils, cyrus_sasl, pam, libpng
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   name    = "hhvm-${version}";
-  version = "3.21";
+  version = "3.23.2";
 
   # use git version since we need submodules
   src = fetchgit {
     url    = "https://github.com/facebook/hhvm.git";
-    rev    = "56483773e2edd9e61782f1901ce40e47959e71b8";
-    sha256 = "0dmdk98nv04m0fv6909gfbsxqlkckn369yi7kadhir0r7vxsj7wa";
+    rev    = "HHVM-${version}";
+    sha256 = "1nic49j8nghx82lgvz0b95r78sqz46qaaqv4nx48p8yrj9ysnd7i";
     fetchSubmodules = true;
   };
 
@@ -29,10 +29,6 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./flexible-array-members-gcc6.patch
-    (fetchurl {
-      url = https://github.com/facebook/hhvm/commit/b506902af2b7c53de6d6c92491c2086472292004.patch;
-      sha256 = "1br7diczqks6b1xjrdsac599fc62m9l17gcx7dvkc0qj54lq7ys4";
-    })
   ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/compilers/ocaml/ber-metaocaml-003.nix b/pkgs/development/compilers/ocaml/ber-metaocaml-104.nix
similarity index 58%
rename from pkgs/development/compilers/ocaml/ber-metaocaml-003.nix
rename to pkgs/development/compilers/ocaml/ber-metaocaml-104.nix
index c95d29326a4e..81c8cd534025 100644
--- a/pkgs/development/compilers/ocaml/ber-metaocaml-003.nix
+++ b/pkgs/development/compilers/ocaml/ber-metaocaml-104.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, ncurses, xlibsWrapper }:
+{ stdenv, fetchurl, ncurses, libX11, xproto, buildEnv }:
 
 let
    useX11 = stdenv.isi686 || stdenv.isx86_64;
@@ -7,52 +7,65 @@ let
 in
 
 stdenv.mkDerivation rec {
-  
+
   name = "ber-metaocaml-${version}";
-  version = "003";
-  
+  version = "104";
+
   src = fetchurl {
-    url = "http://caml.inria.fr/pub/distrib/ocaml-3.11/ocaml-3.11.2.tar.bz2";
-    sha256 = "0hw1yp1mmfyn1pmda232d0ry69m7ln1z0fn5lgi8nz3y1mx3iww6";
+    url = "http://caml.inria.fr/pub/distrib/ocaml-4.04/ocaml-4.04.0.tar.gz";
+    sha256 = "1pi2hdm9lxhn45qvfqfss1hpa4jijm14qgmrgajsadxqdiplhqyb";
   };
 
   metaocaml = fetchurl {
-    url = "http://okmij.org/ftp/ML/ber-metaocaml.tar.gz";
-    sha256 = "1kq1if25c1wvcdiy4g46xk05dkc1am2gc4qvmg4x19wvvaz09gzf";
+    url = "http://okmij.org/ftp/ML/ber-metaocaml-104.tar.gz";
+    sha256 = "1gmwlxairxqcmqa2r6kbf8b4dxc7pfhfbh48g1s14d3z20rj8nib";
   };
 
   # Needed to avoid a SIGBUS on the final executable on mips
   NIX_CFLAGS_COMPILE = if stdenv.isMips then "-fPIC" else "";
 
-  patches = optionals stdenv.isDarwin [ ./gnused-on-osx-fix.patch ];
+  x11env = buildEnv { name = "x11env"; paths = [libX11 xproto];};
+  x11lib = x11env + "/lib";
+  x11inc = x11env + "/include";
 
   prefixKey = "-prefix ";
-  configureFlags = ["-no-tk"] ++ optionals useX11 [ "-x11lib" xlibsWrapper ];
-  buildFlags = "core coreboot all"; # "world" + optionalString useNativeCompilers " bootstrap world.opt";
-  buildInputs = [ncurses] ++ optionals useX11 [ xlibsWrapper ];
+  configureFlags = optionals useX11 [ "-x11lib" x11lib
+                                      "-x11include" x11inc ];
+
+  dontStrip = true;
+  buildInputs = [ncurses] ++ optionals useX11 [ libX11 xproto ];
   installFlags = "-i";
   installTargets = "install"; # + optionalString useNativeCompilers " installopt";
-  prePatch = ''
-    CAT=$(type -tp cat)
-    sed -e "s@/bin/cat@$CAT@" -i config/auto-aux/sharpbang
-    patch -p0 < ${./mips64.patch}
-  '';
+
   postConfigure = ''
     tar -xvzf $metaocaml
     cd ${name}
     make patch
     cd ..
   '';
-  postBuild = ''
+  buildPhase = ''
+    make world
+    make -i install
+
+    make bootstrap
+    make opt.opt
+    make installopt
     mkdir -p $out/include
     ln -sv $out/lib/ocaml/caml $out/include/caml
-  '';
-  postInstall = ''
     cd ${name}
     make all
     make install
+    make install.opt
+    cd ..
+ '';
+  installPhase = "";
+  postBuild = ''
+  '';
+  checkPhase = ''
+    cd ${name}
     make test
     make test-compile
+    make test-native
     cd ..
   '';
 
@@ -67,6 +80,5 @@ stdenv.mkDerivation rec {
       A conservative extension of OCaml with the primitive type of code values,
       and three basic multi-stage expression forms: Brackets, Escape, and Run
     '';
-    broken = true;
   };
 }
diff --git a/pkgs/development/interpreters/python/cpython/2.7/default.nix b/pkgs/development/interpreters/python/cpython/2.7/default.nix
index b28df2501aac..9352bb4d52e0 100644
--- a/pkgs/development/interpreters/python/cpython/2.7/default.nix
+++ b/pkgs/development/interpreters/python/cpython/2.7/default.nix
@@ -201,7 +201,7 @@ in stdenv.mkDerivation {
     passthru = let
       pythonPackages = callPackage ../../../../../top-level/python-packages.nix {python=self; overrides=packageOverrides;};
     in rec {
-      inherit libPrefix sitePackages x11Support hasDistutilsCxxPatch;
+      inherit libPrefix sitePackages x11Support hasDistutilsCxxPatch ucsEncoding;
       executable = libPrefix;
       buildEnv = callPackage ../../wrapper.nix { python = self; inherit (pythonPackages) requiredPythonModules; };
       withPackages = import ../../with-packages.nix { inherit buildEnv pythonPackages;};
diff --git a/pkgs/development/interpreters/python/wrapper.nix b/pkgs/development/interpreters/python/wrapper.nix
index fc521828ffc4..8d4e68bf57ca 100644
--- a/pkgs/development/interpreters/python/wrapper.nix
+++ b/pkgs/development/interpreters/python/wrapper.nix
@@ -14,7 +14,8 @@ let
     name = "${python.name}-env";
 
     inherit paths;
-    inherit ignoreCollisions extraOutputsToInstall;
+    inherit ignoreCollisions;
+    extraOutputsToInstall = [ "out" ] ++ extraOutputsToInstall;
 
     postBuild = ''
       . "${makeWrapper}/nix-support/setup-hook"
diff --git a/pkgs/development/libraries/gmime/3.nix b/pkgs/development/libraries/gmime/3.nix
index d6877e72a1f9..66d0cf88bd02 100644
--- a/pkgs/development/libraries/gmime/3.nix
+++ b/pkgs/development/libraries/gmime/3.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, pkgconfig, glib, zlib, gpgme, libidn, gobjectIntrospection }:
 
 stdenv.mkDerivation rec {
-  version = "3.0.1";
+  version = "3.0.5";
   name = "gmime-${version}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gmime/3.0/${name}.tar.xz";
-    sha256 = "001y93b8mq9alzkvli6vfh3pzdcn5c5iy206ml23lzhhhvm5k162";
+    sha256 = "1q45gd1ahnz9q1milc2lqqwl7j3q0wd6kiswhp25iak222n56lrg";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/leveldb/default.nix b/pkgs/development/libraries/leveldb/default.nix
index 2a109e0366fd..3ff2ca0b0ee4 100644
--- a/pkgs/development/libraries/leveldb/default.nix
+++ b/pkgs/development/libraries/leveldb/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, sqlite, kyotocabinet }:
+{ stdenv, fetchFromGitHub }:
 
 stdenv.mkDerivation rec {
   name = "leveldb-${version}";
@@ -11,19 +11,20 @@ stdenv.mkDerivation rec {
     sha256 = "1bnsii47vbyqnbah42qgq6pbmmcg4k3fynjnw7whqfv6lpdgmb8d";
   };
 
-  buildInputs = [ sqlite kyotocabinet ];
-
   buildPhase = ''
-    make all db_bench{,_sqlite3,_tree_db} leveldbutil libmemenv.a
+    make all leveldbutil libmemenv.a
   '';
 
   installPhase = "
     mkdir -p $out/{bin,lib,include}
+
     cp -r include $out
-    cp lib* $out/lib
-    cp db_bench{,_sqlite3,_tree_db} leveldbutil $out/bin
     mkdir -p $out/include/leveldb/helpers
     cp helpers/memenv/memenv.h $out/include/leveldb/helpers
+
+    cp lib* $out/lib
+
+    cp leveldbutil $out/bin
   ";
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/libraries/qt-4.x/4.8/default.nix b/pkgs/development/libraries/qt-4.x/4.8/default.nix
index 369f328666da..32691faa6893 100644
--- a/pkgs/development/libraries/qt-4.x/4.8/default.nix
+++ b/pkgs/development/libraries/qt-4.x/4.8/default.nix
@@ -68,6 +68,7 @@ stdenv.mkDerivation rec {
     [ ./glib-2.32.patch
       ./libressl.patch
       ./parallel-configure.patch
+      ./qt-4.8.7-unixmake-darwin.patch
       (substituteAll {
         src = ./dlopen-absolute-paths.diff;
         cups = if cups != null then stdenv.lib.getLib cups else null;
@@ -76,7 +77,19 @@ stdenv.mkDerivation rec {
         glibc = stdenv.cc.libc.out;
         openglDriver = if mesaSupported then mesa.driverLink else "/no-such-path";
       })
-    ] ++ stdenv.lib.optional gtkStyle (substituteAll ({
+      (fetchpatch {
+        name = "fix-medium-font.patch";
+        url = "http://anonscm.debian.org/cgit/pkg-kde/qt/qt4-x11.git/plain/debian/patches/"
+          + "kubuntu_39_fix_medium_font.diff?id=21b342d71c19e6d68b649947f913410fe6129ea4";
+        sha256 = "0bli44chn03c2y70w1n8l7ss4ya0b40jqqav8yxrykayi01yf95j";
+      })
+      (fetchpatch {
+        name = "qt4-gcc6.patch";
+        url = "https://git.archlinux.org/svntogit/packages.git/plain/trunk/qt4-gcc6.patch?h=packages/qt4&id=ca773a144f5abb244ac4f2749eeee9333cac001f";
+        sha256 = "07lrva7bjh6i40p7b3ml26a2jlznri8bh7y7iyx5zmvb1gfxmj34";
+      })
+    ]
+    ++ stdenv.lib.optional gtkStyle (substituteAll ({
         src = ./dlopen-gtkstyle.diff;
         # substituteAll ignores env vars starting with capital letter
         gtk = gtk2.out;
@@ -93,20 +106,7 @@ stdenv.mkDerivation rec {
     ++ stdenv.lib.optional stdenv.isAarch64 (fetchpatch {
         url = "https://src.fedoraproject.org/rpms/qt/raw/ecf530486e0fb7fe31bad26805cde61115562b2b/f/qt-aarch64.patch";
         sha256 = "1fbjh78nmafqmj7yk67qwjbhl3f6ylkp6x33b1dqxfw9gld8b3gl";
-      })
-    ++ [
-      (fetchpatch {
-        name = "fix-medium-font.patch";
-        url = "http://anonscm.debian.org/cgit/pkg-kde/qt/qt4-x11.git/plain/debian/patches/"
-          + "kubuntu_39_fix_medium_font.diff?id=21b342d71c19e6d68b649947f913410fe6129ea4";
-        sha256 = "0bli44chn03c2y70w1n8l7ss4ya0b40jqqav8yxrykayi01yf95j";
-      })
-      (fetchpatch {
-        name = "qt4-gcc6.patch";
-        url = "https://git.archlinux.org/svntogit/packages.git/plain/trunk/qt4-gcc6.patch?h=packages/qt4&id=ca773a144f5abb244ac4f2749eeee9333cac001f";
-        sha256 = "07lrva7bjh6i40p7b3ml26a2jlznri8bh7y7iyx5zmvb1gfxmj34";
-      })
-    ];
+      });
 
   preConfigure = ''
     export LD_LIBRARY_PATH="`pwd`/lib:$LD_LIBRARY_PATH"
@@ -185,37 +185,8 @@ stdenv.mkDerivation rec {
     sed -i 's/^\(LIBS[[:space:]]*=.*$\)/\1 -lobjc/' ./src/corelib/Makefile.Release
   '';
 
-  installPhase = optionalString stdenv.isDarwin ''
-    runHook preInstall
-    cp -r lib $out
-
-    mkdir -p $out/Applications
-    mv bin/*.app $out/Applications
-    rm -rf bin/*.app
-
-    cp -r bin $out
-
-    mkdir -p $out/share/doc/${name}
-    mkdir -p $out/lib
-    mkdir -p $out/lib/qt4/plugins
-    mkdir -p $out/lib/qt4/imports
-    mkdir -p $out/bin
-    mkdir -p $out/include
-    mkdir -p $out/share/${name}
-
-    cp -r mkspecs $out/share/${name}
-    cp -r translations $out/share/${name}
-    cp -r tools/linguist/phrasebooks $out/share/${name}
-    cp tools/porting/src/q3porting.xml $out/share/${name}
-
-    cp -r plugins $out/lib/qt4
-    cp -r imports $out/lib/qt4
-    cp -r doc/* $out/share/doc/${name}
-    runHook postInstall
-  '';
-
-  postInstall = optionalString (!stdenv.isDarwin) ''
-      rm -rf $out/tests
+  postInstall = ''
+    rm -rf $out/tests
   '';
 
   crossAttrs = {
diff --git a/pkgs/development/libraries/qt-4.x/4.8/qt-4.8.7-unixmake-darwin.patch b/pkgs/development/libraries/qt-4.x/4.8/qt-4.8.7-unixmake-darwin.patch
new file mode 100644
index 000000000000..99a36a24fe43
--- /dev/null
+++ b/pkgs/development/libraries/qt-4.x/4.8/qt-4.8.7-unixmake-darwin.patch
@@ -0,0 +1,11 @@
+--- a/qmake/generators/unix/unixmake.cpp
++++ b/qmake/generators/unix/unixmake.cpp
+@@ -831,7 +831,7 @@ UnixMakefileGenerator::defaultInstall(const QString &t)
+             else if(project->first("TEMPLATE") == "app" && !project->isEmpty("QMAKE_STRIPFLAGS_APP"))
+                 ret += " " + var("QMAKE_STRIPFLAGS_APP");
+             if(bundle)
+-                ret = " \"" + dst_targ + "/Contents/MacOS/$(QMAKE_TARGET)\"";
++                ret += " \"" + dst_targ + "/Contents/MacOS/$(QMAKE_TARGET)\"";
+             else
+                 ret += " \"" + dst_targ + "\"";
+         }
diff --git a/pkgs/development/ocaml-modules/markup/default.nix b/pkgs/development/ocaml-modules/markup/default.nix
index 3ee84d0d1b1c..eb3944db88e9 100644
--- a/pkgs/development/ocaml-modules/markup/default.nix
+++ b/pkgs/development/ocaml-modules/markup/default.nix
@@ -2,19 +2,19 @@
 
 stdenv.mkDerivation rec {
   pname = "markup";
-  version = "0.7.4";
+  version = "0.7.5";
   name = "ocaml${ocaml.version}-${pname}-${version}";
 
   src = fetchzip {
     url = "http://github.com/aantron/markup.ml/archive/${version}.tar.gz";
-    sha256 = "1hchlqzsy9pax91gcdmxzakfm22fbvhxzwyzpvz8fqkx4372zs37";
+    sha256 = "09qm73m6c6wjh51w61vnfsnis37m28cf1r6hnkr3bbg903ahwbp5";
     };
 
-  buildInputs = [ ocaml findlib ocamlbuild ];
+  buildInputs = [ ocaml findlib ocamlbuild lwt ];
 
   installPhase = "make ocamlfind-install";
-  
-  propagatedBuildInputs = [uutf lwt];
+
+  propagatedBuildInputs = [ uutf ];
 
   createFindlibDestdir = true;
 
diff --git a/pkgs/development/ocaml-modules/ulex/default.nix b/pkgs/development/ocaml-modules/ulex/default.nix
index fa26b305da2d..ed868c30a442 100644
--- a/pkgs/development/ocaml-modules/ulex/default.nix
+++ b/pkgs/development/ocaml-modules/ulex/default.nix
@@ -1,16 +1,26 @@
-{ stdenv, fetchurl, ocaml, findlib, ocamlbuild, camlp4 }:
+{ stdenv, fetchFromGitHub, ocaml, findlib, ocamlbuild, camlp4 }:
 
 let
   pname = "ulex";
+  param =
+    if stdenv.lib.versionAtLeast ocaml.version "4.02" then {
+      version = "1.2";
+      sha256 = "08yf2x9a52l2y4savjqfjd2xy4pjd1rpla2ylrr9qrz1drpfw4ic";
+    } else {
+      version = "1.1";
+      sha256 = "0cmscxcmcxhlshh4jd0lzw5ffzns12x3bj7h27smbc8waxkwffhl";
+    };
 in
 
 stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
-  version = "1.1";
+  name = "ocaml${ocaml.version}-${pname}-${version}";
+  inherit (param) version;
 
-  src = fetchurl {
-    url = "http://www.cduce.org/download/${pname}-${version}.tar.gz";
-    sha256 = "0fjlkwps14adfgxdrbb4yg65fhyimplvjjs1xqj5np197cig67x0";
+  src = fetchFromGitHub {
+    owner = "whitequark";
+    repo = pname;
+    rev = "v${version}";
+    inherit (param) sha256;
   };
 
   createFindlibDestdir = true;
@@ -21,7 +31,7 @@ stdenv.mkDerivation rec {
   buildFlags = "all all.opt";
 
   meta = {
-    homepage = http://www.cduce.org/download.html;
+    inherit (src.meta) homepage;
     description = "A lexer generator for Unicode and OCaml";
     license = stdenv.lib.licenses.mit;
     platforms = ocaml.meta.platforms or [];
diff --git a/pkgs/development/python-modules/FormEncode/default.nix b/pkgs/development/python-modules/FormEncode/default.nix
index 2f72f7c16a7a..cd9d8ee46d8a 100644
--- a/pkgs/development/python-modules/FormEncode/default.nix
+++ b/pkgs/development/python-modules/FormEncode/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildPythonPackage, fetchPypi, dns, pycountry, nose }:
+{ stdenv, buildPythonPackage, fetchPypi, dnspython, pycountry, nose }:
 
 buildPythonPackage rec {
   pname = "FormEncode";
@@ -10,7 +10,7 @@ buildPythonPackage rec {
     sha256 = "1xm77h2mds2prlaz0z4nzkx13g61rx5c2v3vpgjq9d5ij8bzb8md";
   };
 
-  buildInputs = [ dns pycountry nose ];
+  buildInputs = [ dnspython pycountry nose ];
 
   patchPhase = ''
     # dnspython3 has been superseded, see its PyPI page
diff --git a/pkgs/development/python-modules/dkimpy/default.nix b/pkgs/development/python-modules/dkimpy/default.nix
index 91d5a17960d8..177e697aab9f 100644
--- a/pkgs/development/python-modules/dkimpy/default.nix
+++ b/pkgs/development/python-modules/dkimpy/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, openssl, makeWrapper, buildPythonApplication
-, pytest, dns }:
+, pytest, dnspython }:
 
 buildPythonApplication rec {
   name = "${pname}-${version}";
@@ -14,7 +14,7 @@ buildPythonApplication rec {
   };
 
   buildInputs = [ pytest ];
-  propagatedBuildInputs =  [ openssl dns ];
+  propagatedBuildInputs =  [ openssl dnspython ];
 
   patchPhase = ''
     substituteInPlace dknewkey.py --replace \
diff --git a/pkgs/development/python-modules/dns/default.nix b/pkgs/development/python-modules/dnspython/default.nix
similarity index 100%
rename from pkgs/development/python-modules/dns/default.nix
rename to pkgs/development/python-modules/dnspython/default.nix
diff --git a/pkgs/development/python-modules/email-validator/default.nix b/pkgs/development/python-modules/email-validator/default.nix
index 4fc78d8bd1e1..cf03a02129d4 100644
--- a/pkgs/development/python-modules/email-validator/default.nix
+++ b/pkgs/development/python-modules/email-validator/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, buildPythonPackage, fetchPypi, isPy3k, dns, idna, ipaddress }:
+{ stdenv, lib, buildPythonPackage, fetchPypi, isPy3k, dnspython, idna, ipaddress }:
 
 buildPythonPackage rec {
   pname = "email_validator";
@@ -13,7 +13,7 @@ buildPythonPackage rec {
   doCheck = false;
 
   propagatedBuildInputs = [
-    dns
+    dnspython
     idna
   ] ++ (if isPy3k then [ ] else [ ipaddress ]);
 
diff --git a/pkgs/development/python-modules/gurobipy/darwin.nix b/pkgs/development/python-modules/gurobipy/darwin.nix
new file mode 100644
index 000000000000..9d7374bd5bd4
--- /dev/null
+++ b/pkgs/development/python-modules/gurobipy/darwin.nix
@@ -0,0 +1,34 @@
+{ stdenv, fetchurl, python, xar, cpio, cctools, insert_dylib }:
+assert python.pkgs.isPy27 && python.ucsEncoding == 2;
+stdenv.mkDerivation
+  { name = "gurobipy-7.0.2";
+    src = fetchurl
+      { url = "http://packages.gurobi.com/7.0/gurobi7.0.2_mac64.pkg";
+        sha256 = "14dpxas6gx02kfb28i0fh68p1z4sbjmwg8hp8h5ch6c701h260mg";
+      };
+    buildInputs = [ xar cpio cctools insert_dylib ];
+    buildCommand =
+      ''
+        # Unpack
+        xar -xf $src
+        zcat gurobi*mac64tar.pkg/Payload | cpio -i
+        tar xf gurobi*_mac64.tar.gz
+
+        # Install
+        cd gurobi*/mac64
+        mkdir -p $out/lib/python2.7/site-packages
+        mv lib/python2.7/gurobipy $out/lib/python2.7/site-packages
+        mv lib/lib*.so $out/lib
+
+        # Fixup
+        install_name_tool -change \
+          /System/Library/Frameworks/Python.framework/Versions/2.7/Python \
+          ${python}/lib/libpython2.7.dylib \
+          $out/lib/python2.7/site-packages/gurobipy/gurobipy.so
+        install_name_tool -change libgurobi70.so \
+          $out/lib/libgurobi70.so \
+          $out/lib/python2.7/site-packages/gurobipy/gurobipy.so
+        insert_dylib --inplace $out/lib/libaes70.so \
+          $out/lib/python2.7/site-packages/gurobipy/gurobipy.so
+      '';
+  }
diff --git a/pkgs/development/python-modules/gurobipy/linux.nix b/pkgs/development/python-modules/gurobipy/linux.nix
new file mode 100644
index 000000000000..f65ae4a2ed2e
--- /dev/null
+++ b/pkgs/development/python-modules/gurobipy/linux.nix
@@ -0,0 +1,33 @@
+{ stdenv, fetchurl, python }:
+assert python.pkgs.isPy27;
+let utf =
+  if python.ucsEncoding == 2 then "16"
+  else if python.ucsEncoding == 4 then "32"
+  else throw "Unsupported python UCS encoding UCS${toString python.ucsEncoding}";
+in stdenv.mkDerivation
+  { name = "gurobipy-7.0.2";
+    src = fetchurl
+      { url = "http://packages.gurobi.com/7.0/gurobi7.0.2_linux64.tar.gz";
+        sha256 = "1lgdj4cncjvnnw8dppiax7q2j8121pxyg9iryj8v26mrk778dnmn";
+      };
+    buildCommand =
+      ''
+        # Unpack
+        tar xf $src
+
+        # Install
+        cd gurobi*/linux64
+        mkdir -p $out/lib/python2.7/site-packages
+        mv lib/python2.7_utf${utf}/gurobipy \
+          $out/lib/python2.7/site-packages
+        mv lib/python2.7_utf${utf}/gurobipy.so \
+          $out/lib/python2.7/site-packages/gurobipy
+        mv lib/libaes*.so* lib/libgurobi*.so* $out/lib
+
+        # Fixup
+        patchelf --set-rpath $out/lib \
+          $out/lib/python2.7/site-packages/gurobipy/gurobipy.so
+        patchelf --add-needed libaes70.so \
+          $out/lib/python2.7/site-packages/gurobipy/gurobipy.so
+      '';
+  }
diff --git a/pkgs/development/python-modules/salmon/default.nix b/pkgs/development/python-modules/salmon/default.nix
index 2169689f3d47..f9d7f79164ac 100644
--- a/pkgs/development/python-modules/salmon/default.nix
+++ b/pkgs/development/python-modules/salmon/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildPythonPackage, fetchFromGitHub, pythonOlder, nose, dns
+{ stdenv, buildPythonPackage, fetchFromGitHub, pythonOlder, nose, dnspython
 ,  chardet, lmtpd, pythondaemon, six, jinja2, mock }:
 
 buildPythonPackage rec {
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   };
 
   checkInputs = [ nose jinja2 mock ];
-  propagatedBuildInputs = [ chardet dns lmtpd pythondaemon six ];
+  propagatedBuildInputs = [ chardet dnspython lmtpd pythondaemon six ];
 
   meta = with stdenv.lib; {
     homepage = http://salmon-mail.readthedocs.org/;
diff --git a/pkgs/development/tools/build-managers/gradle/default.nix b/pkgs/development/tools/build-managers/gradle/default.nix
index 8568b218f37e..77f2e561317b 100644
--- a/pkgs/development/tools/build-managers/gradle/default.nix
+++ b/pkgs/development/tools/build-managers/gradle/default.nix
@@ -52,12 +52,12 @@ rec {
   };
 
   gradle_latest = gradleGen rec {
-    name = "gradle-4.3.1";
+    name = "gradle-4.4";
     nativeVersion = "0.14";
 
     src = fetchurl {
       url = "http://services.gradle.org/distributions/${name}-bin.zip";
-      sha256 = "1irsv5c4g0c8iln5hiikjr78rj1w2hjgyar5dp8a54h3rscf1sqm";
+      sha256 = "0bqaksrxrshqjwba0wj72gbcxvcchjavlj39xh18qpkz5jp76j7s";
     };
   };
 
diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix
index e247392e6c70..04fc40638d78 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,11 +1,11 @@
 { stdenv, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "4.4.104";
+  version = "4.4.105";
   extraMeta.branch = "4.4";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0bhc4ay8ikvhqxj191mbm5kshh2zj46n5snwfa1d6bqzdkgg5s5h";
+    sha256 = "0h0ivdw74m3s2j9llh0hnigv790jgy6lhcf6jn2csxmvg3ai5sfn";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-hardened-copperhead.nix b/pkgs/os-specific/linux/kernel/linux-hardened-copperhead.nix
index 707ed10ea0c3..365f6ce54a07 100644
--- a/pkgs/os-specific/linux/kernel/linux-hardened-copperhead.nix
+++ b/pkgs/os-specific/linux/kernel/linux-hardened-copperhead.nix
@@ -3,9 +3,9 @@
 with stdenv.lib;
 
 let
-  version = "4.14.3";
+  version = "4.14.4";
   revision = "a";
-  sha256 = "18pcmi927gw4a0ih09fq1wv0jbzp1z42a8kga8ralcac828i6gi3";
+  sha256 = "1h99nhm3yd528gj0wg71lzi8v314r6r00m8zh2cw2sz82k7fds4w";
 
   # modVersion needs to be x.y.z, will automatically add .0 if needed
   modVersion = concatStrings (intersperse "." (take 3 (splitString "." "${version}.0")));
diff --git a/pkgs/servers/mail/mailman/default.nix b/pkgs/servers/mail/mailman/default.nix
index d64e41f30071..8ff20869b94e 100644
--- a/pkgs/servers/mail/mailman/default.nix
+++ b/pkgs/servers/mail/mailman/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "1r6sjapjmbav45xibjzc2a8y1xf4ikz09470ma1kw7iz174wn8z7";
   };
 
-  buildInputs = [ python pythonPackages.dns ];
+  buildInputs = [ python pythonPackages.dnspython ];
 
   patches = [ ./fix-var-prefix.patch ];
 
diff --git a/pkgs/shells/nix-bash-completions/default.nix b/pkgs/shells/nix-bash-completions/default.nix
index 7de8be10c9b7..f9cd97e97354 100644
--- a/pkgs/shells/nix-bash-completions/default.nix
+++ b/pkgs/shells/nix-bash-completions/default.nix
@@ -1,19 +1,29 @@
 { stdenv, fetchFromGitHub }:
 
 stdenv.mkDerivation rec {
-  version = "0.6";
+  version = "0.6.1";
   name = "nix-bash-completions-${version}";
 
   src = fetchFromGitHub {
     owner = "hedning";
     repo = "nix-bash-completions";
     rev = "v${version}";
-    sha256 = "093rla6wwx51fclh7xm8qlssx70hj0fj23r59qalaaxf7fdzg2hf";
+    sha256 = "10nzdn249f0cw6adgpbpg4x90ysvxm7vs9jjbbwynfh9kngijp64";
   };
 
+  # To enable lazy loading via. bash-completion we need a symlink to the script
+  # from every command name.
   installPhase = ''
-    mkdir -p $out/share/bash-completion/completions
-    cp _nix $out/share/bash-completion/completions
+    commands=$(
+      function complete() { shift 2; echo "$@"; }
+      shopt -s extglob
+      source _nix
+    )
+    install -Dm444 -t $out/share/bash-completion/completions _nix
+    cd $out/share/bash-completion/completions
+    for c in $commands; do
+      ln -s _nix $c
+    done
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/stdenv/generic/check-meta.nix b/pkgs/stdenv/generic/check-meta.nix
index 03a85633ed61..b9d77d980a12 100644
--- a/pkgs/stdenv/generic/check-meta.nix
+++ b/pkgs/stdenv/generic/check-meta.nix
@@ -64,7 +64,7 @@ let
     !allowUnfreePredicate attrs;
 
   allowInsecureDefaultPredicate = x: builtins.elem x.name (config.permittedInsecurePackages or []);
-  allowInsecurePredicate = x: (config.allowUnfreePredicate or allowInsecureDefaultPredicate) x;
+  allowInsecurePredicate = x: (config.allowInsecurePredicate or allowInsecureDefaultPredicate) x;
 
   hasAllowedInsecure = attrs:
     (attrs.meta.knownVulnerabilities or []) == [] ||
diff --git a/pkgs/tools/admin/ansible/2.1.nix b/pkgs/tools/admin/ansible/2.1.nix
index 6232e4ad95ba..d4a349c5e47d 100644
--- a/pkgs/tools/admin/ansible/2.1.nix
+++ b/pkgs/tools/admin/ansible/2.1.nix
@@ -36,7 +36,7 @@ in buildPythonPackage rec {
   dontPatchShebangs = false;
 
   propagatedBuildInputs = [
-    pycrypto paramiko jinja pyyaml httplib2 boto six netaddr dns
+    pycrypto paramiko jinja pyyaml httplib2 boto six netaddr dnspython
   ] ++ stdenv.lib.optional windowsSupport pywinrm;
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/admin/ansible/2.2.nix b/pkgs/tools/admin/ansible/2.2.nix
index 02392d7ac89f..4ef35fa5d9eb 100644
--- a/pkgs/tools/admin/ansible/2.2.nix
+++ b/pkgs/tools/admin/ansible/2.2.nix
@@ -38,7 +38,7 @@ in buildPythonPackage rec {
   dontPatchShebangs = false;
 
   propagatedBuildInputs = [
-    pycrypto paramiko jinja pyyaml httplib2 boto six netaddr dns
+    pycrypto paramiko jinja pyyaml httplib2 boto six netaddr dnspython
   ] ++ stdenv.lib.optional windowsSupport pywinrm;
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/admin/ansible/2.3.nix b/pkgs/tools/admin/ansible/2.3.nix
index 7330b7d0858b..b827bdcc9c31 100644
--- a/pkgs/tools/admin/ansible/2.3.nix
+++ b/pkgs/tools/admin/ansible/2.3.nix
@@ -24,7 +24,7 @@ pythonPackages.buildPythonPackage rec {
   dontPatchShebangs = false;
 
   propagatedBuildInputs = with pythonPackages; [
-    pycrypto paramiko jinja2 pyyaml httplib2 boto six netaddr dns
+    pycrypto paramiko jinja2 pyyaml httplib2 boto six netaddr dnspython
   ] ++ stdenv.lib.optional windowsSupport pywinrm;
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/admin/ansible/2.4.nix b/pkgs/tools/admin/ansible/2.4.nix
index 9c8df647e593..4f90e80202e4 100644
--- a/pkgs/tools/admin/ansible/2.4.nix
+++ b/pkgs/tools/admin/ansible/2.4.nix
@@ -24,7 +24,7 @@ pythonPackages.buildPythonPackage rec {
   dontPatchShebangs = false;
 
   propagatedBuildInputs = with pythonPackages; [
-    pycrypto paramiko jinja2 pyyaml httplib2 boto six netaddr dns
+    pycrypto paramiko jinja2 pyyaml httplib2 boto six netaddr dnspython
   ] ++ stdenv.lib.optional windowsSupport pywinrm;
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/admin/cli53/default.nix b/pkgs/tools/admin/cli53/default.nix
index b9852ed587c5..e70a7ba9b50c 100644
--- a/pkgs/tools/admin/cli53/default.nix
+++ b/pkgs/tools/admin/cli53/default.nix
@@ -23,7 +23,7 @@ python2.pkgs.buildPythonApplication rec {
   propagatedBuildInputs = with python2.pkgs; [
     argparse
     boto
-    dns
+    dnspython
   ];
 
   meta = with lib; {
diff --git a/pkgs/tools/backup/borg/default.nix b/pkgs/tools/backup/borg/default.nix
index 867d2cf903a0..2dc84069d629 100644
--- a/pkgs/tools/backup/borg/default.nix
+++ b/pkgs/tools/backup/borg/default.nix
@@ -2,13 +2,13 @@
 
 python3Packages.buildPythonApplication rec {
   name = "borgbackup-${version}";
-  version = "1.1.1";
+  version = "1.1.3";
   namePrefix = "";
 
   src = fetchurl {
     url = "https://github.com/borgbackup/borg/releases/download/"
       + "${version}/${name}.tar.gz";
-    sha256 = "0iik5lq349cl87imlwra2pp0j36wjhpn8r1d3778azvvqpyjq2d5";
+    sha256 = "1rvn8b6clzd1r317r9jkvk34r31risi0dxfjc7jffhnwasck4anc";
   };
 
   nativeBuildInputs = with python3Packages; [
diff --git a/pkgs/tools/security/hash-slinger/default.nix b/pkgs/tools/security/hash-slinger/default.nix
index 4d60b11f977c..fd78d9b2efbf 100644
--- a/pkgs/tools/security/hash-slinger/default.nix
+++ b/pkgs/tools/security/hash-slinger/default.nix
@@ -14,7 +14,7 @@ in stdenv.mkDerivation rec {
     sha256 = "05wn744ydclpnpyah6yfjqlfjlasrrhzj48lqmm5a91nyps5yqyn";
   };
 
-  pythonPath = with pythonPackages; [ dns m2crypto ipaddr python-gnupg
+  pythonPath = with pythonPackages; [ dnspython m2crypto ipaddr python-gnupg
                                       pyunbound ];
 
   buildInputs = [ pythonPackages.wrapPython ];
diff --git a/pkgs/tools/typesetting/tex/tetex/default.nix b/pkgs/tools/typesetting/tex/tetex/default.nix
index 313474745d10..ac317fd51dcb 100644
--- a/pkgs/tools/typesetting/tex/tetex/default.nix
+++ b/pkgs/tools/typesetting/tex/tetex/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation {
     find ./ -name "config.guess" -exec rm {} \; -exec ln -s ${automake}/share/automake-*/config.guess {} \;
   '' else null;
 
-  patches = [ ./environment.patch ./getline.patch ./clang.patch ];
+  patches = [ ./environment.patch ./getline.patch ./clang.patch ./extramembot.patch ];
 
   setupHook = ./setup-hook.sh;
 
diff --git a/pkgs/tools/typesetting/tex/tetex/extramembot.patch b/pkgs/tools/typesetting/tex/tetex/extramembot.patch
new file mode 100644
index 000000000000..f6c954fcfa5c
--- /dev/null
+++ b/pkgs/tools/typesetting/tex/tetex/extramembot.patch
@@ -0,0 +1,12 @@
+diff -up texlive-2007/texk/web2c/tex.ch.extramembot texlive-2007/texk/web2c/tex.ch
+--- texlive-2007/texk/web2c/tex.ch.extramembot	2006-12-19 02:11:11.000000000 +0100
++++ texlive-2007/texk/web2c/tex.ch	2011-11-30 12:03:32.052795763 +0100
+@@ -365,7 +365,7 @@ for i:=@'177 to @'377 do xchr[i]:=i;
+ {Initialize enc\TeX\ data.}
+ for i:=0 to 255 do mubyte_read[i]:=null;
+ for i:=0 to 255 do mubyte_write[i]:=0;
+-for i:=0 to 128 do mubyte_cswrite[i]:=null;
++for i:=0 to 127 do mubyte_cswrite[i]:=null;
+ mubyte_keep := 0; mubyte_start := false; 
+ write_noexpanding := false; cs_converting := false;
+ special_printing := false; message_printing := false;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2be5e568fe7c..8840d70bc131 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -6277,7 +6277,7 @@ with pkgs;
 
   metaocaml_3_09 = callPackage ../development/compilers/ocaml/metaocaml-3.09.nix { };
 
-  ber_metaocaml_003 = callPackage ../development/compilers/ocaml/ber-metaocaml-003.nix { };
+  ber_metaocaml = callPackage ../development/compilers/ocaml/ber-metaocaml-104.nix { };
 
   ocaml_make = callPackage ../development/ocaml-modules/ocamlmake { };
 
@@ -13923,8 +13923,7 @@ with pkgs;
   altcoins = recurseIntoAttrs ( callPackage ../applications/altcoins { } );
   bitcoin = altcoins.bitcoin;
   bitcoin-xt = altcoins.bitcoin-xt;
-
-  cryptop = callPackage ../applications/altcoins/cryptop { };
+  cryptop = altcoins.cryptop;
 
   libbitcoin = callPackage ../tools/misc/libbitcoin/libbitcoin.nix {
     secp256k1 = secp256k1.override { enableECDH = true; };
@@ -16527,14 +16526,8 @@ with pkgs;
 
   rawtherapee = callPackage ../applications/graphics/rawtherapee {
     fftw = fftwSinglePrec;
-    cmake = cmake_2_8; # problems after 3.4 -> 3.6.0
   };
 
-  rawtherapee-git = lowPrio (callPackage ../applications/graphics/rawtherapee/dev.nix {
-    fftw = fftwSinglePrec;
-    cmake = cmake_2_8; # problems after 3.4 -> 3.6.0
-  });
-
   rclone = callPackage ../applications/networking/sync/rclone { };
 
   rcs = callPackage ../applications/version-management/rcs { };
@@ -19448,6 +19441,8 @@ with pkgs;
 
   kompose = callPackage ../applications/networking/cluster/kompose { };
 
+  kontemplate = callPackage ../applications/networking/cluster/kontemplate { };
+
   kops = callPackage ../applications/networking/cluster/kops { };
 
   lilypond = callPackage ../misc/lilypond { guile = guile_1_8; };
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 2003f30ef2e2..52a921dcc0ed 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -369,7 +369,7 @@ let
 
     magick = callPackage ../development/ocaml-modules/magick { };
 
-    markup = callPackage ../development/ocaml-modules/markup { lwt = lwt2; };
+    markup = callPackage ../development/ocaml-modules/markup { lwt = ocaml_lwt; };
 
     menhir = callPackage ../development/ocaml-modules/menhir { };
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 8affc1249bfb..5b10697deb43 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4523,7 +4523,8 @@ in {
 
   discogs_client = callPackage ../development/python-modules/discogs_client { };
 
-  dns = callPackage ../development/python-modules/dns { };
+  dnspython = callPackage ../development/python-modules/dnspython { };
+  dns = self.dnspython; # Alias for compatibility, 2017-12-10
 
   docker = callPackage ../development/python-modules/docker {};
 
@@ -5600,6 +5601,14 @@ in {
     };
   };
 
+  gurobipy = if stdenv.system == "x86_64-darwin"
+  then callPackage ../development/python-modules/gurobipy/darwin.nix {
+    inherit (pkgs.darwin) cctools insert_dylib;
+  }
+  else if stdenv.system == "x86_64-linux"
+  then callPackage ../development/python-modules/gurobipy/linux.nix {}
+  else throw "gurobipy not yet supported on ${stdenv.system}";
+
   helper = buildPythonPackage rec {
     pname = "helper";
     version = "2.4.1";
@@ -11830,7 +11839,7 @@ in {
     name = "sleekxmpp-${version}";
     version = "1.3.1";
 
-    propagatedBuildInputs = with self ; [ dns pyasn1 ];
+    propagatedBuildInputs = with self ; [ dnspython pyasn1 ];
 
     src = pkgs.fetchurl {
       url = "mirror://pypi/s/sleekxmpp/${name}.tar.gz";
@@ -16674,7 +16683,7 @@ in {
 
     buildInputs = with self; [ nose mock pyopenssl ];
 
-    propagatedBuildInputs = with self; [ urllib3 dns];
+    propagatedBuildInputs = with self; [ urllib3 dnspython ];
 
     postPatch = ''
       sed -i '19s/dns/"dnspython"/' setup.py
@@ -18544,7 +18553,7 @@ in {
 
     nativeBuildInputs = [ pkgs.pkgconfig ];
     buildInputs = with pkgs; [ alsaLib ffmpeg libv4l sqlite libvpx ];
-    propagatedBuildInputs = with self; [ cython pkgs.openssl dns dateutil xcaplib msrplib lxml python-otr ];
+    propagatedBuildInputs = with self; [ cython pkgs.openssl dnspython dateutil xcaplib msrplib lxml python-otr ];
   };