diff --git a/lib/maintainers.nix b/lib/maintainers.nix
index 45f7f8f51d13..e01907ac5cdb 100644
--- a/lib/maintainers.nix
+++ b/lib/maintainers.nix
@@ -265,6 +265,7 @@
   hbunke = "Hendrik Bunke <bunke.hendrik@gmail.com>";
   hce = "Hans-Christian Esperer <hc@hcesperer.org>";
   hectorj = "Hector Jusforgues <hector.jusforgues+nixos@gmail.com>";
+  hedning = "Tor Hedin Brønner <torhedinbronner@gmail.com>";
   heel = "Sergii Paryzhskyi <parizhskiy@gmail.com>";
   henrytill = "Henry Till <henrytill@gmail.com>";
   hhm = "hhm <heehooman+nixpkgs@gmail.com>";
@@ -517,6 +518,7 @@
   rardiol = "Ricardo Ardissone <ricardo.ardissone@gmail.com>";
   rasendubi = "Alexey Shmalko <rasen.dubi@gmail.com>";
   raskin = "Michael Raskin <7c6f434c@mail.ru>";
+  ravloony = "Tom Macdonald <ravloony@gmail.com>";
   rbasso = "Rafael Basso <rbasso@sharpgeeks.net>";
   redbaron = "Maxim Ivanov <ivanov.maxim@gmail.com>";
   redvers = "Redvers Davies <red@infect.me>";
diff --git a/nixos/modules/services/databases/mysql.nix b/nixos/modules/services/databases/mysql.nix
index 845e6d4c22ef..c6c463bce7d5 100644
--- a/nixos/modules/services/databases/mysql.nix
+++ b/nixos/modules/services/databases/mysql.nix
@@ -67,7 +67,7 @@ in
         type = types.nullOr types.str;
         default = null;
         example = literalExample "0.0.0.0";
-        description = "Address to bind to. The default it to bind to all addresses";
+        description = "Address to bind to. The default is to bind to all addresses";
       };
 
       port = mkOption {
diff --git a/pkgs/applications/altcoins/bitcoin-abc.nix b/pkgs/applications/altcoins/bitcoin-abc.nix
index a113aadcd628..011e3cd7c874 100644
--- a/pkgs/applications/altcoins/bitcoin-abc.nix
+++ b/pkgs/applications/altcoins/bitcoin-abc.nix
@@ -7,13 +7,13 @@ with stdenv.lib;
 stdenv.mkDerivation rec {
 
   name = "bitcoin" + (toString (optional (!withGui) "d")) + "-abc-" + version;
-  version = "0.15.0";
+  version = "0.16.0";
 
   src = fetchFromGitHub {
     owner = "bitcoin-ABC";
     repo = "bitcoin-abc";
     rev = "v${version}";
-    sha256 = "1fygn6cc99iasg5g5jyps5ps873hfnn4ln4hsmcwlwiqd591qxyv";
+    sha256 = "0wwcgvd8zgl5qh6z1sa3kdv1lr9cwwbs9j2gaad5mqr9sfwbbxdh";
   };
 
   patches = [ ./fix-bitcoin-qt-build.patch ];
diff --git a/pkgs/applications/audio/lmms/default.nix b/pkgs/applications/audio/lmms/default.nix
index dcefbb06436f..25d7f2ed015b 100644
--- a/pkgs/applications/audio/lmms/default.nix
+++ b/pkgs/applications/audio/lmms/default.nix
@@ -1,31 +1,47 @@
-{ stdenv, fetchFromGitHub, SDL, alsaLib, cmake, fftwSinglePrec, fluidsynth
-, fltk13, libjack2, libvorbis , libsamplerate, libsndfile, pkgconfig
-, libpulseaudio, qt4, freetype, libgig
-}:
+{ stdenv, fetchFromGitHub, cmake, pkgconfig, alsaLib ? null, fftwFloat, fltk13
+, fluidsynth ? null, lame ? null, libgig ? null, libjack2 ? null, libpulseaudio ? null
+, libsamplerate, libsoundio ? null, libsndfile, libvorbis ? null, portaudio ? null
+, qtbase, qttools, SDL ? null }:
 
 stdenv.mkDerivation rec {
   name = "lmms-${version}";
-  version = "1.1.90";
+  version = "1.2.0-rc4";
 
   src = fetchFromGitHub {
     owner = "LMMS";
     repo = "lmms";
     rev = "v${version}";
-    sha256 = "0njiarndwqamqiinr1wbwkzjn87yzr1z5k9cfwk0jdkbalgakkq3";
+    sha256 = "1n3py18zqbvfnkdiz4wc6z60xaajpkd3kn1wxmby5dmc4vccvjj5";
   };
 
+  nativeBuildInputs = [ cmake qttools pkgconfig ];
+
   buildInputs = [
-    SDL alsaLib cmake fftwSinglePrec fltk13 fluidsynth libjack2 libgig
-    libsamplerate libsndfile libvorbis pkgconfig libpulseaudio qt4
+    alsaLib
+    fftwFloat
+    fltk13
+    fluidsynth
+    lame
+    libgig
+    libjack2
+    libpulseaudio
+    libsamplerate
+    libsndfile
+    libsoundio
+    libvorbis
+    portaudio
+    qtbase
+    SDL # TODO: switch to SDL2 in the next version
   ];
 
+  cmakeFlags = [ "-DWANT_QT5=ON" ];
   enableParallelBuilding = true;
 
   meta = with stdenv.lib; {
-    description = "Linux MultiMedia Studio";
+    description = "DAW similar to FL Studio (music production software)";
     homepage = https://lmms.io;
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
-    maintainers = [ maintainers.goibhniu ];
+    maintainers = with maintainers; [ goibhniu yegortimoshenko ];
   };
 }
diff --git a/pkgs/applications/editors/eclipse/plugins.nix b/pkgs/applications/editors/eclipse/plugins.nix
index 0aeaee2155a7..4bad9eb2d64a 100644
--- a/pkgs/applications/editors/eclipse/plugins.nix
+++ b/pkgs/applications/editors/eclipse/plugins.nix
@@ -152,16 +152,16 @@ rec {
 
   bytecode-outline = buildEclipsePlugin rec {
     name = "bytecode-outline-${version}";
-    version = "2.4.3";
+    version = "2.5.0.201711011753-5a57fdf";
 
     srcFeature = fetchurl {
       url = "http://andrei.gmxhome.de/eclipse/features/de.loskutov.BytecodeOutline.feature_${version}.jar";
-      sha256 = "0imhwp73gxy1y5d5gpjgd05ywn0xg3vqc5980wcx3fd51g4ifc67";
+      sha256 = "0yciqhcq0n5i326mwy57r4ywmkz2c2jky7r4pcmznmhvks3z65ps";
     };
 
     srcPlugin = fetchurl {
       url = "http://dl.bintray.com/iloveeclipse/plugins/de.loskutov.BytecodeOutline_${version}.jar";
-      sha256 = "0230i88mvvxhn11m9c5mv3494zhh1xkxyfyva9qahck0wbqwpzkw";
+      sha256 = "1vmsqv32jfl7anvdkw0vir342miv5sr9df7vd1w44lf1yf97vxlw";
     };
 
     meta = with stdenv.lib; {
diff --git a/pkgs/applications/editors/rednotebook/default.nix b/pkgs/applications/editors/rednotebook/default.nix
new file mode 100644
index 000000000000..1a0e6e54fb3e
--- /dev/null
+++ b/pkgs/applications/editors/rednotebook/default.nix
@@ -0,0 +1,37 @@
+{ lib, buildPythonApplication, fetchFromGitHub
+, gdk_pixbuf, glib, gtk3, pango, webkitgtk
+, pygobject3, pyyaml
+}:
+
+buildPythonApplication rec {
+  name = "rednotebook-${version}";
+  version = "2.3";
+
+  src = fetchFromGitHub {
+    owner = "jendrikseipp";
+    repo = "rednotebook";
+    rev = "v${version}";
+    sha256 = "0zkfid104hcsf20r6829v11wxdghqkd3j1zbgyvd1s7q4nxjn5lj";
+  };
+
+  # We have not packaged tests.
+  doCheck = false;
+
+  propagatedBuildInputs = [
+    gdk_pixbuf glib gtk3 pango webkitgtk
+    pygobject3 pyyaml
+  ];
+
+  makeWrapperArgs = [
+    "--set GI_TYPELIB_PATH $GI_TYPELIB_PATH"
+    "--prefix XDG_DATA_DIRS : $out/share"
+    "--suffix XDG_DATA_DIRS : $XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH"
+  ];
+
+  meta = with lib; {
+    homepage = http://rednotebook.sourceforge.net/;
+    description = "A modern journal that includes a calendar navigation, customizable templates, export functionality and word clouds";
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ orivej tstrobel ];
+  };
+}
diff --git a/pkgs/applications/networking/browsers/opera/default.nix b/pkgs/applications/networking/browsers/opera/default.nix
index 52a2ce9164c9..0852b5c9d434 100644
--- a/pkgs/applications/networking/browsers/opera/default.nix
+++ b/pkgs/applications/networking/browsers/opera/default.nix
@@ -37,7 +37,7 @@
 let
 
   mirror = https://get.geo.opera.com/pub/opera/desktop;
-  version = "46.0.2597.39";
+  version = "48.0.2685.52";
 
   rpath = stdenv.lib.makeLibraryPath [
 
@@ -87,19 +87,10 @@ in stdenv.mkDerivation {
 
   name = "opera-${version}";
 
-  src =
-    #if stdenv.system == "i686-linux" then
-    #  fetchurl {
-    #    url = "${mirror}/${version}/linux/opera-stable_${version}_i386.deb";
-    #    sha256 = "...";
-    #  }
-    #else 
-    if stdenv.system == "x86_64-linux" then
-      fetchurl {
-        url = "${mirror}/${version}/linux/opera-stable_${version}_amd64.deb";
-        sha256 = "1ladvqilm5rr222wjybvribnyii2l0p8jbsd10xr06wps63g1kia";
-      }
-    else throw "Opera is not supported on ${stdenv.system} (only x86_64 linux is supported)";
+  src = fetchurl {
+    url = "${mirror}/${version}/linux/opera-stable_${version}_amd64.deb";
+    sha256 = "027njqh2as4d0xsnvzamqiplghb8cxqnc19y0vqkvjnsw57v828p";
+  };
 
   unpackCmd = "${dpkg}/bin/dpkg-deb -x $curSrc .";
 
@@ -123,6 +114,7 @@ in stdenv.mkDerivation {
   meta = {
     homepage = http://www.opera.com;
     description = "Web browser";
+    platforms = [ "x86_64-linux" ];
     license = stdenv.lib.licenses.unfree;
   };
 }
diff --git a/pkgs/applications/networking/browsers/palemoon/default.nix b/pkgs/applications/networking/browsers/palemoon/default.nix
index d5e6e47e9285..e24c21b535bf 100644
--- a/pkgs/applications/networking/browsers/palemoon/default.nix
+++ b/pkgs/applications/networking/browsers/palemoon/default.nix
@@ -10,14 +10,14 @@
 
 stdenv.mkDerivation rec {
   name = "palemoon-${version}";
-  version = "27.5.0";
+  version = "27.6.0";
 
   src = fetchFromGitHub {
     name   = "palemoon-src";
     owner  = "MoonchildProductions";
     repo   = "Pale-Moon";
     rev    = version + "_Release";
-    sha256 = "0m4fgwxn6hs8r240i6acaajx76cvqy1b7cqmdsxd33qpjrrj1h9d";
+    sha256 = "1v5rbam93fcc7c1l69clr9chi2l0zv0dhjq12v535n8vv9lhahhl";
   };
 
   desktopItem = makeDesktopItem {
diff --git a/pkgs/applications/networking/cluster/mesos/default.nix b/pkgs/applications/networking/cluster/mesos/default.nix
index 116e74326908..909242273930 100644
--- a/pkgs/applications/networking/cluster/mesos/default.nix
+++ b/pkgs/applications/networking/cluster/mesos/default.nix
@@ -60,6 +60,8 @@ in stdenv.mkDerivation rec {
       "CXXFLAGS=-O2 -Wno-error=strict-aliasing"
     )
 
+    substituteInPlace 3rdparty/stout/include/stout/jsonify.hpp \
+      --replace '<xlocale.h>' '<locale.h>'
     # Fix cases where makedev(),major(),minor() are referenced through
     # <sys/types.h> instead of <sys/sysmacros.h>
     sed 1i'#include <sys/sysmacros.h>' -i src/linux/fs.cpp
diff --git a/pkgs/applications/networking/flexget/default.nix b/pkgs/applications/networking/flexget/default.nix
index 9e5e90996bcb..105239aca024 100644
--- a/pkgs/applications/networking/flexget/default.nix
+++ b/pkgs/applications/networking/flexget/default.nix
@@ -24,9 +24,6 @@ buildPythonApplication rec {
   # unicode-capable filesystem (and setting LC_ALL doesn't work).
   # setlocale: LC_ALL: cannot change locale (en_US.UTF-8)
   postPatch = ''
-    sed -i '/def test_non_ascii/i\    import pytest\
-        @pytest.mark.skip' flexget/tests/test_filesystem.py
-
     substituteInPlace requirements.txt \
       --replace "chardet==3.0.3" "chardet" \
       --replace "rebulk==0.8.2" "rebulk" \
@@ -35,7 +32,13 @@ buildPythonApplication rec {
       --replace "sqlalchemy==1.1.10" "sqlalchemy" \
       --replace "zxcvbn-python==4.4.15" "zxcvbn-python" \
       --replace "flask-cors==3.0.2" "flask-cors" \
-      --replace "certifi==2017.4.17" "certifi"
+      --replace "certifi==2017.4.17" "certifi" \
+      --replace "apscheduler==3.3.1" "apscheduler" \
+      --replace "path.py==10.3.1" "path.py" \
+      --replace "tempora==1.8" "tempora" \
+      --replace "cheroot==5.5.0" "cheroot" \
+      --replace "six==1.10.0" "six" \
+      --replace "aniso8601==1.2.1" "aniso8601"
   '';
 
   checkPhase = ''
@@ -47,7 +50,8 @@ buildPythonApplication rec {
                                           and not test_double_episodes \
                                           and not test_inject_force \
                                           and not test_double_prefered \
-                                          and not test_double"
+                                          and not test_double \
+                                          and not test_non_ascii"
   '';
 
   buildInputs = [ pytest mock vcrpy pytest-catchlog boto3 ];
diff --git a/pkgs/applications/networking/instant-messengers/rambox/bare.nix b/pkgs/applications/networking/instant-messengers/rambox/bare.nix
new file mode 100644
index 000000000000..ceb922624a12
--- /dev/null
+++ b/pkgs/applications/networking/instant-messengers/rambox/bare.nix
@@ -0,0 +1,61 @@
+{ stdenv, fetchFromGitHub, fetchNodeModules, nodejs-8_x, ruby, sencha }:
+
+stdenv.mkDerivation rec {
+  name = "rambox-bare-${version}";
+  version = "0.5.13";
+
+  src = fetchFromGitHub {
+    owner = "saenzramiro";
+    repo = "rambox";
+    rev = version;
+    sha256 = "0c770a9z017y6gcrpyri7s1gifm8zi5f29bq5nvh3zzg4wgqh326";
+  };
+
+  nativeBuildInputs = [ nodejs-8_x ruby sencha ];
+
+  node_modules = fetchNodeModules {
+    inherit src;
+
+    nodejs = nodejs-8_x;
+    sha256 = "1y3q8ggyvfywxqi5hn9mvr1sjfylspis43iyf4b7snyr1a1br3r4";
+  };
+
+  patches = [ ./hide-check-for-updates.patch ./isDev.patch ];
+
+  # These credentials are only for this derivation. If you want to get credentials
+  # for another distribution, go to https://auth0.com. If you want to reuse the same
+  # domain, drop a line at yegortimoshenko@gmail.com!
+  auth0ClientID = "0spuNKfIGeLAQ_Iki9t3fGxbfJl3k8SU";
+  auth0Domain = "nixpkgs.auth0.com";
+
+  configurePhase = ''
+    echo 'var auth0Cfg = { clientID: "${auth0ClientID}", domain: "${auth0Domain}" };' > env.js
+    ln -s ${node_modules} node_modules
+  '';
+
+  buildPhase = ''
+    mkdir ../rambox-build
+    npm run sencha:compile:build
+  '';
+
+  installPhase = ''
+    mv ../rambox-build/ $out
+
+    # https://github.com/saenzramiro/rambox/issues/1281
+    echo '{"name": "rambox", "version": "${version}", "main": "electron/main.js"}' > $out/package.json
+
+    # https://github.com/saenzramiro/rambox/issues/1282
+    cp --parents ext/packages/ext-locale/build/ext-locale-*.js $out
+
+    # Symbolic link causes `Uncaught Error: Cannot find module 'immutable'`
+    cp -r ${node_modules} $out/node_modules
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Messaging and emailing app that combines common web applications into one";
+    homepage = http://rambox.pro;
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ gnidorah ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/applications/networking/instant-messengers/rambox/default.nix b/pkgs/applications/networking/instant-messengers/rambox/default.nix
index 7c8367d7f7fb..2e574fae8fa5 100644
--- a/pkgs/applications/networking/instant-messengers/rambox/default.nix
+++ b/pkgs/applications/networking/instant-messengers/rambox/default.nix
@@ -1,64 +1,26 @@
-{ stdenv, fetchurl, dpkg, makeWrapper
-, xorg, gtk2, atk, glib, pango, gdk_pixbuf, cairo, freetype, fontconfig
-, gnome2, dbus, nss, nspr, alsaLib, cups, expat, udev, libnotify, xdg_utils }:
+{ stdenv, newScope, makeWrapper, electron, xdg_utils }:
 
 let
-  bits = if stdenv.system == "x86_64-linux" then "x64"
-         else "ia32";
-
-  version = "0.5.13";
-
-  runtimeDeps = [
-    udev libnotify
-  ];
-  deps = (with xorg; [
-    libXi libXcursor libXdamage libXrandr libXcomposite libXext libXfixes
-    libXrender libX11 libXtst libXScrnSaver libxcb
-  ]) ++ [
-    gtk2 atk glib pango gdk_pixbuf cairo freetype fontconfig dbus
-    gnome2.GConf nss nspr alsaLib cups expat stdenv.cc.cc
-  ] ++ runtimeDeps;
-in stdenv.mkDerivation rec {
-  name = "rambox-${version}";
-  src = fetchurl {
-    url = "https://github.com/saenzramiro/rambox/releases/download/${version}/Rambox_${version}-${bits}.deb";
-    sha256 = if bits == "x64" then
-      "0bn562fr1wsnn3xsd4q2rrxi6c56vckrkfmjl2dqb30hpmj2vn0d" else
-      "180ndvkil5mk5idwnn7spfygnhhll6pjc342pfzgmzk46a723qs4";
+  callPackage = newScope self;
+  self = {
+    fetchNodeModules = callPackage ./fetchNodeModules.nix {};
+    rambox-bare = callPackage ./bare.nix {};
+    sencha = callPackage ./sencha {};
   };
+in
 
-  # don't remove runtime deps
-  dontPatchELF = true;
+with self;
 
-  buildInputs = [ dpkg makeWrapper ];
+stdenv.mkDerivation {
+  name = "rambox-${rambox-bare.version}";
 
-  unpackPhase = "dpkg-deb -x $src .";
+  nativeBuildInputs = [ makeWrapper ];
+
+  unpackPhase = ":";
 
   installPhase = ''
-    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" opt/Rambox/rambox
-    patchelf --set-rpath "$out/opt/Rambox:${stdenv.lib.makeLibraryPath deps}" opt/Rambox/rambox
-
-    mkdir -p $out/bin
-    cp -r opt $out
-    ln -s $out/opt/Rambox/rambox $out/bin
-
-    # provide resources
-    cp -r usr/share $out
-    substituteInPlace $out/share/applications/rambox.desktop \
-      --replace Exec=\"/opt/Rambox/rambox\" Exec=rambox
+    makeWrapper ${electron}/bin/electron $out/bin/rambox \
+      --add-flags "${rambox-bare} --without-update" \
+      --prefix PATH : ${xdg_utils}/bin
   '';
-
-  postFixup = ''
-    paxmark m $out/opt/Rambox/rambox
-    wrapProgram $out/opt/Rambox/rambox --prefix PATH : ${xdg_utils}/bin
-  '';
-
-  meta = with stdenv.lib; {
-    description = "Free and Open Source messaging and emailing app that combines common web applications into one";
-    homepage = http://rambox.pro;
-    license = licenses.mit;
-    maintainers = [ maintainers.gnidorah ];
-    platforms = ["i686-linux" "x86_64-linux"];
-    hydraPlatforms = [];
-  };
 }
diff --git a/pkgs/applications/networking/instant-messengers/rambox/fetchNodeModules.nix b/pkgs/applications/networking/instant-messengers/rambox/fetchNodeModules.nix
new file mode 100644
index 000000000000..047890a932ca
--- /dev/null
+++ b/pkgs/applications/networking/instant-messengers/rambox/fetchNodeModules.nix
@@ -0,0 +1,26 @@
+{ stdenv, jq }: { src, nodejs, sha256 }:
+
+# Only npm >= 5.4.2 is deterministic, see:
+# https://github.com/npm/npm/issues/17979#issuecomment-332701215
+assert stdenv.lib.versionAtLeast nodejs.version "8.9.0";
+
+stdenv.mkDerivation {
+  name = "node_modules";
+
+  outputHashAlgo = "sha256";
+  outputHash = sha256;
+  outputHashMode = "recursive";
+
+  nativeBuildInputs = [ jq nodejs ];
+
+  buildCommand = ''
+    cp -r ${src}/* .
+    HOME=. npm install --force --ignore-scripts --only=production
+    for f in $(find node_modules -name package.json); do
+      # https://github.com/npm/npm/issues/10393
+      jq -S 'delpaths(keys | map(select(startswith("_")) | [.]))' $f > $f.tmp
+      mv $f.tmp $f
+    done
+    mv node_modules $out
+  '';
+}
diff --git a/pkgs/applications/networking/instant-messengers/rambox/hide-check-for-updates.patch b/pkgs/applications/networking/instant-messengers/rambox/hide-check-for-updates.patch
new file mode 100644
index 000000000000..8363baef2dfc
--- /dev/null
+++ b/pkgs/applications/networking/instant-messengers/rambox/hide-check-for-updates.patch
@@ -0,0 +1,35 @@
+https://github.com/saenzramiro/rambox/issues/1283
+
+diff -urNZ a/electron/menu.js b/electron/menu.js
+--- a/electron/menu.js	2017-11-02 22:02:59.753119865 +0000
++++ b/electron/menu.js	2017-11-02 22:08:34.419698562 +0000
+@@ -220,14 +220,6 @@
+ 					}
+ 				},
+ 				{
+-					label: locale['menu.help[5]'],
+-					click(item, win) {
+-						const webContents = win.webContents;
+-						const send = webContents.send.bind(win.webContents);
+-						send('autoUpdater:check-update');
+-					}
+-				},
+-				{
+ 					label: locale['menu.help[6]'],
+ 					click() {
+ 						sendAction('showAbout')
+@@ -290,14 +282,6 @@
+ 			type: 'separator'
+ 		});
+ 		helpSubmenu.push({
+-			label: `&`+locale['menu.help[5]'],
+-			click(item, win) {
+-				const webContents = win.webContents;
+-				const send = webContents.send.bind(win.webContents);
+-				send('autoUpdater:check-update');
+-			}
+-		});
+-		helpSubmenu.push({
+ 			label: `&`+locale['menu.help[6]'],
+ 			click() {
+ 				sendAction('showAbout')
diff --git a/pkgs/applications/networking/instant-messengers/rambox/isDev.patch b/pkgs/applications/networking/instant-messengers/rambox/isDev.patch
new file mode 100644
index 000000000000..b918144c7662
--- /dev/null
+++ b/pkgs/applications/networking/instant-messengers/rambox/isDev.patch
@@ -0,0 +1,14 @@
+https://github.com/saenzramiro/rambox/issues/1280
+
+diff -urNZ a/electron/main.js b/electron/main.js
+--- a/electron/main.js	2017-11-02 14:58:06.085127616 +0000
++++ b/electron/main.js	2017-11-02 14:58:18.316887679 +0000
+@@ -8,7 +8,7 @@
+ // Configuration
+ const Config = require('electron-config');
+ // Development
+-const isDev = require('electron-is-dev');
++const isDev = false;
+ // Updater
+ const updater = require('./updater');
+ // File System
diff --git a/pkgs/applications/networking/instant-messengers/rambox/sencha/bare.nix b/pkgs/applications/networking/instant-messengers/rambox/sencha/bare.nix
new file mode 100644
index 000000000000..9b4a718ed23d
--- /dev/null
+++ b/pkgs/applications/networking/instant-messengers/rambox/sencha/bare.nix
@@ -0,0 +1,41 @@
+{ stdenv, fetchurl, gzip, which, unzip, jdk }:
+
+let
+  version = "6.5.2";
+  srcs = {
+    i686-linux = fetchurl {
+      url = "https://cdn.sencha.com/cmd/${version}/no-jre/SenchaCmd-${version}-linux-i386.sh.zip";
+      sha256 = "18gcqw9434xab97skcb97iw4p4s2pgggvq7jaisblap0ja00kqjr";
+    };
+    x86_64-linux = fetchurl {
+      url = "https://cdn.sencha.com/cmd/${version}/no-jre/SenchaCmd-${version}-linux-amd64.sh.zip";
+      sha256 = "1b8jv99k37q1bi7b29f23lfzxc66v5fqdmr1rxsrqchwcrllc0z7";
+    };
+  };
+in
+
+stdenv.mkDerivation rec {
+  inherit version;
+
+  name = "sencha-bare-${version}";
+  src = srcs.${stdenv.system};
+
+  nativeBuildInputs = [ gzip which unzip ];
+  buildInputs = [ jdk ];
+
+  sourceRoot = ".";
+
+  configurePhase = ''
+    substituteAll ${./response.varfile} response.varfile
+  '';
+
+  installPhase = ''
+    ./SenchaCmd*.sh -q -dir $out -varfile response.varfile
+    rm $out/shell-wrapper.sh $out/Uninstaller
+  '';
+
+  meta = with stdenv.lib; {
+    license = licenses.unfree;
+    platforms = attrNames srcs;
+  };
+}
diff --git a/pkgs/applications/networking/instant-messengers/rambox/sencha/default.nix b/pkgs/applications/networking/instant-messengers/rambox/sencha/default.nix
new file mode 100644
index 000000000000..1ca04a9e1686
--- /dev/null
+++ b/pkgs/applications/networking/instant-messengers/rambox/sencha/default.nix
@@ -0,0 +1,17 @@
+{ stdenv, callPackage, makeWrapper }:
+
+let
+  sencha-bare = callPackage ./bare.nix {};
+in
+
+stdenv.mkDerivation {
+  name = "sencha-${sencha-bare.version}";
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  unpackPhase = ":";
+
+  installPhase = ''
+    makeWrapper ${sencha-bare}/sencha $out/bin/sencha
+  '';
+}
diff --git a/pkgs/applications/networking/instant-messengers/rambox/sencha/response.varfile b/pkgs/applications/networking/instant-messengers/rambox/sencha/response.varfile
new file mode 100644
index 000000000000..0ff6f0a30d50
--- /dev/null
+++ b/pkgs/applications/networking/instant-messengers/rambox/sencha/response.varfile
@@ -0,0 +1,13 @@
+addToPath$Integer=1
+parentDir=.
+sys.adminRights$Boolean=false
+sys.component.148$Boolean=true
+sys.component.157$Boolean=true
+sys.component.26$Boolean=true
+sys.component.30$Boolean=true
+sys.component.90$Boolean=true
+sys.component.91$Boolean=true
+sys.component.92$Boolean=true
+sys.component.94$Boolean=true
+sys.installationDir=@out@
+sys.languageId=en
\ No newline at end of file
diff --git a/pkgs/applications/networking/instant-messengers/salut-a-toi/default.nix b/pkgs/applications/networking/instant-messengers/salut-a-toi/default.nix
index 4f360c831a25..9ff1799ddd2d 100644
--- a/pkgs/applications/networking/instant-messengers/salut-a-toi/default.nix
+++ b/pkgs/applications/networking/instant-messengers/salut-a-toi/default.nix
@@ -1,7 +1,12 @@
-{stdenv, fetchurl, python27Packages, file }:
+{ stdenv, fetchurl, python27Packages, file }:
 
 let
   inherit (python27Packages) python;
+  requirements = (import ./requirements.nix {
+    inherit stdenv fetchurl;
+    pythonPackages = python27Packages;
+  });
+
 in
   stdenv.mkDerivation rec {
     name = "salut-a-toi";
@@ -13,12 +18,15 @@ in
       sha256 = "0kn9403n8fpzl0hsb9kkzicsmzq2fjl627l31yykbqzc4nsr780d";
     };
 
-    buildInputs = with python27Packages; 
+    buildInputs = with python27Packages;
     [
       python twisted urwid wxPython pygobject2
-      wokkel dbus-python pyfeed wrapPython setuptools file 
+      dbus-python wrapPython setuptools file
       pycrypto pyxdg
-    ];
+    ] ++  (with requirements; [
+      pyfeed
+      wokkel
+    ]);
 
     configurePhase = ''
       sed -i "/use_setuptools/d" setup.py
@@ -26,7 +34,7 @@ in
       sed -e "1aexport PATH=\"\$PATH\":\"$out/bin\":\"${python27Packages.twisted}/bin\"" -i src/sat.sh
       sed -e "1aexport PYTHONPATH=\"\$PYTHONPATHPATH\":\"$PYTHONPATH\":"$out/${python.sitePackages}"" -i src/sat.sh
 
-      echo 'import wokkel.muc' | python 
+      echo 'import wokkel.muc' | python
     '';
 
     buildPhase = ''
@@ -39,7 +47,7 @@ in
       for i in "$out/bin"/*; do
       head -n 1 "$i" | grep -E '[/ ]python( |$)' && {
         wrapProgram "$i" --prefix PYTHONPATH : "$PYTHONPATH:$out/${python.sitePackages}"
-      } || true 
+      } || true
       done
     '';
 
diff --git a/pkgs/applications/networking/instant-messengers/salut-a-toi/requirements.nix b/pkgs/applications/networking/instant-messengers/salut-a-toi/requirements.nix
new file mode 100644
index 000000000000..1a6811182453
--- /dev/null
+++ b/pkgs/applications/networking/instant-messengers/salut-a-toi/requirements.nix
@@ -0,0 +1,67 @@
+{ fetchurl
+, stdenv
+, pythonPackages
+}:
+
+let
+  buildPythonPackage = pythonPackages.buildPythonPackage;
+
+  xe = buildPythonPackage rec {
+    url = "http://www.blarg.net/%7Esteveha/xe-0.7.4.tar.gz";
+    name = stdenv.lib.nameFromURL url ".tar";
+    src = fetchurl {
+      inherit url;
+      sha256 = "0v9878cl0y9cczdsr6xjy8v9l139lc23h4m5f86p4kpf2wlnpi42";
+    };
+
+    # error: invalid command 'test'
+    doCheck = false;
+
+    meta = {
+      homepage = "http://home.blarg.net/~steveha/xe.html";
+      description = "XML elements";
+    };
+  };
+
+in {
+
+  pyfeed = (buildPythonPackage rec {
+    url = "http://www.blarg.net/%7Esteveha/pyfeed-0.7.4.tar.gz";
+
+    name = stdenv.lib.nameFromURL url ".tar";
+
+    src = fetchurl {
+      inherit url;
+      sha256 = "1h4msq573m7wm46h3cqlx4rsn99f0l11rhdqgf50lv17j8a8vvy1";
+    };
+
+    propagatedBuildInputs = [ xe ];
+
+    # error: invalid command 'test'
+    doCheck = false;
+
+    meta = with stdenv.lib; {
+      homepage = "http://home.blarg.net/~steveha/pyfeed.html";
+      description = "Tools for syndication feeds";
+    };
+
+  });
+
+  wokkel = buildPythonPackage (rec {
+    url = "http://wokkel.ik.nu/releases/0.7.0/wokkel-0.7.0.tar.gz";
+    name = stdenv.lib.nameFromURL url ".tar";
+    src = fetchurl {
+      inherit url;
+      sha256 = "0rnshrzw8605x05mpd8ndrx3ri8h6cx713mp8sl4f04f4gcrz8ml";
+    };
+
+    propagatedBuildInputs = with pythonPackages; [twisted dateutil];
+
+    meta = with stdenv.lib; {
+      description = "Some (mainly XMPP-related) additions to twisted";
+      homepage = "http://wokkel.ik.nu/";
+      license = licenses.mit;
+    };
+  });
+
+}
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
new file mode 100644
index 000000000000..0376fb79c9be
--- /dev/null
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@@ -0,0 +1,88 @@
+{ stdenv, lib, fetchurl, dpkg, gnome2, atk, cairo, gdk_pixbuf, glib, freetype,
+fontconfig, dbus, libX11, xlibs, libXi, libXcursor, libXdamage, libXrandr,
+libXcomposite, libXext, libXfixes, libXrender, libXtst, libXScrnSaver, nss,
+nspr, alsaLib, cups, expat, udev
+}:
+let
+  rpath = lib.makeLibraryPath [
+    alsaLib
+    atk
+    cairo
+    cups
+    dbus
+    expat
+    fontconfig
+    freetype
+    gdk_pixbuf
+    glib
+    gnome2.GConf
+    gnome2.gtk
+    gnome2.pango
+    libX11
+    libXScrnSaver
+    libXcomposite
+    libXcursor
+    libXdamage
+    libXext
+    libXfixes
+    libXi
+    libXrandr
+    libXrender
+    libXtst
+    nspr
+    nss
+    stdenv.cc.cc
+    udev
+    xlibs.libxcb
+  ];
+
+in
+  stdenv.mkDerivation rec {
+    name = "signal-desktop-${version}";
+
+    version = "1.0.35";
+
+    src =
+      if stdenv.system == "x86_64-linux" then
+        fetchurl {
+          url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
+          sha256 = "d9f9d4d54f4121efc8eadf1cf0ff957828088b313e53b66dc540b851c44c1860";
+        }
+      else
+        throw "Signal for Desktop is not currently supported on ${stdenv.system}";
+
+    phases = [ "unpackPhase" "installPhase" ];
+    nativeBuildInputs = [ dpkg ];
+    unpackPhase = "dpkg-deb -x $src .";
+    installPhase = ''
+      mkdir -p $out
+      cp -R opt $out
+
+      mv ./usr/share $out/share
+      mv $out/opt/Signal $out/libexec
+      rmdir $out/opt
+
+      chmod -R g-w $out
+
+      # Patch signal
+      patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+               --set-rpath ${rpath}:$out/libexec $out/libexec/signal-desktop
+
+      # Symlink to bin
+      mkdir -p $out/bin
+      ln -s $out/libexec/signal-desktop $out/bin/signal-desktop
+
+      # Fix the desktop link
+      substituteInPlace $out/share/applications/signal-desktop.desktop \
+        --replace /opt/Signal/signal-desktop $out/bin/signal-desktop
+    '';
+
+    meta = {
+      description = "Signal Private Messenger for the Desktop.";
+      homepage = https://signal.org/;
+      license = lib.licenses.gpl3;
+      platforms = [
+        "x86_64-linux"
+      ];
+    };
+  }
diff --git a/pkgs/applications/networking/mailreaders/mailnag/default.nix b/pkgs/applications/networking/mailreaders/mailnag/default.nix
index 281bc690bad5..b1ca80fc7e47 100644
--- a/pkgs/applications/networking/mailreaders/mailnag/default.nix
+++ b/pkgs/applications/networking/mailreaders/mailnag/default.nix
@@ -2,11 +2,13 @@
 , gdk_pixbuf, libnotify, gst_all_1
 , libgnome_keyring3, networkmanager
 , wrapGAppsHook, gnome3
-, withGnomeKeyring ? false
-, withNetworkManager ? true
+# otherwise passwords are stored unencrypted
+, withGnomeKeyring ? true
 }:
 
-pythonPackages.buildPythonApplication rec {
+let
+  inherit (pythonPackages) python;
+in pythonPackages.buildPythonApplication rec {
   name = "mailnag-${version}";
   version = "1.2.1";
 
@@ -20,8 +22,7 @@ pythonPackages.buildPythonApplication rec {
     gst_all_1.gst-plugins-base gst_all_1.gst-plugins-good
     gst_all_1.gst-plugins-bad
     gnome3.defaultIconTheme
-  ] ++ stdenv.lib.optional withGnomeKeyring libgnome_keyring3
-    ++ stdenv.lib.optional withNetworkManager networkmanager;
+  ] ++ stdenv.lib.optional withGnomeKeyring libgnome_keyring3;
 
   nativeBuildInputs = [
     wrapGAppsHook
@@ -31,6 +32,10 @@ pythonPackages.buildPythonApplication rec {
     pygobject3 dbus-python pyxdg
   ];
 
+  buildPhase = "";
+
+  installPhase = "${python}/bin/python setup.py install --prefix=$out";
+
   doCheck = false;
 
   meta = with stdenv.lib; {
diff --git a/pkgs/applications/networking/pyload/beautifulsoup.nix b/pkgs/applications/networking/pyload/beautifulsoup.nix
new file mode 100644
index 000000000000..571df924e1f8
--- /dev/null
+++ b/pkgs/applications/networking/pyload/beautifulsoup.nix
@@ -0,0 +1,20 @@
+{ pythonPackages, isPy3k, pkgs }:
+
+pythonPackages.buildPythonPackage rec {
+  name = "beautifulsoup-3.2.1";
+  disabled = isPy3k;
+
+  src = pkgs.fetchurl {
+    url = "http://www.crummy.com/software/BeautifulSoup/download/3.x/BeautifulSoup-3.2.1.tar.gz";
+    sha256 = "1nshbcpdn0jpcj51x0spzjp519pkmqz0n0748j7dgpz70zlqbfpm";
+  };
+
+  # error: invalid command 'test'
+  doCheck = false;
+
+  meta = {
+    homepage = http://www.crummy.com/software/BeautifulSoup/;
+    license = "bsd";
+    description = "Undemanding HTML/XML parser";
+  };
+}
diff --git a/pkgs/applications/networking/pyload/default.nix b/pkgs/applications/networking/pyload/default.nix
index f8cd1ab1d00b..c331c4f287e6 100644
--- a/pkgs/applications/networking/pyload/default.nix
+++ b/pkgs/applications/networking/pyload/default.nix
@@ -1,5 +1,12 @@
-{ stdenv, fetchFromGitHub, fetchpatch, pythonPackages, gocr, unrar, rhino, spidermonkey }:
-pythonPackages.buildPythonApplication rec {
+{ stdenv, fetchFromGitHub, fetchpatch, pythonPackages, gocr, unrar, rhino, spidermonkey
+, pkgs }:
+
+let
+  beautifulsoup = pythonPackages.callPackage ./beautifulsoup.nix {
+    inherit pythonPackages;
+  };
+
+in pythonPackages.buildPythonApplication rec {
   version = "0.4.9-next";
   name = "pyLoad-" + version;
 
diff --git a/pkgs/applications/version-management/cvs/CVE-2017-12836.patch b/pkgs/applications/version-management/cvs/CVE-2017-12836.patch
new file mode 100644
index 000000000000..950079423685
--- /dev/null
+++ b/pkgs/applications/version-management/cvs/CVE-2017-12836.patch
@@ -0,0 +1,29 @@
+--- a/src/rsh-client.c.orig	2005-10-02 17:17:21.000000000 +0200
++++ b/src/rsh-client.c	2017-11-07 16:56:06.957370469 +0100
+@@ -53,7 +53,7 @@
+     char *cvs_server = (root->cvs_server != NULL
+ 			? root->cvs_server : getenv ("CVS_SERVER"));
+     int i = 0;
+-    /* This needs to fit "rsh", "-b", "-l", "USER", "host",
++    /* This needs to fit "rsh", "-b", "-l", "USER", "--", "host",
+        "cmd (w/ args)", and NULL.  We leave some room to grow. */
+     char *rsh_argv[10];
+ 
+@@ -97,6 +97,9 @@
+ 	rsh_argv[i++] = root->username;
+     }
+ 
++    /* Only non-option arguments from here. (CVE-2017-12836) */
++    rsh_argv[i++] = "--";
++
+     rsh_argv[i++] = root->hostname;
+     rsh_argv[i++] = cvs_server;
+     rsh_argv[i++] = "server";
+@@ -171,6 +174,7 @@
+ 	    *p++ = root->username;
+ 	}
+ 
++	*p++ = "--";
+ 	*p++ = root->hostname;
+ 	*p++ = command;
+ 	*p++ = NULL;
diff --git a/pkgs/applications/version-management/cvs/default.nix b/pkgs/applications/version-management/cvs/default.nix
index 8c69517a7506..a330db6a8d67 100644
--- a/pkgs/applications/version-management/cvs/default.nix
+++ b/pkgs/applications/version-management/cvs/default.nix
@@ -11,6 +11,7 @@ stdenv.mkDerivation {
   patches = [
     ./getcwd-chroot.patch
     ./CVE-2012-0804.patch
+    ./CVE-2017-12836.patch
   ];
 
   hardeningDisable = [ "fortify" "format" ];
diff --git a/pkgs/applications/version-management/gitaly/Gemfile b/pkgs/applications/version-management/gitaly/Gemfile
index 88b7120d6f9a..7e8f9f2b2557 100644
--- a/pkgs/applications/version-management/gitaly/Gemfile
+++ b/pkgs/applications/version-management/gitaly/Gemfile
@@ -3,3 +3,7 @@ source 'https://rubygems.org'
 gem 'github-linguist', '~> 4.7.0', require: 'linguist'
 gem 'gitaly-proto', '~> 0.37.0', require: 'gitaly'
 gem 'activesupport'
+
+group :development, :test do
+  gem 'gitlab-styles', '~> 2.0.0', require: false
+end
diff --git a/pkgs/applications/version-management/gitaly/Gemfile.lock b/pkgs/applications/version-management/gitaly/Gemfile.lock
index 68433fc6878e..5ea14855b97f 100644
--- a/pkgs/applications/version-management/gitaly/Gemfile.lock
+++ b/pkgs/applications/version-management/gitaly/Gemfile.lock
@@ -8,6 +8,7 @@ GEM
       tzinfo (~> 1.1)
     addressable (2.5.1)
       public_suffix (~> 2.0, >= 2.0.2)
+    ast (2.3.0)
     charlock_holmes (0.7.5)
     concurrent-ruby (1.0.5)
     escape_utils (1.1.1)
@@ -21,6 +22,10 @@ GEM
       escape_utils (~> 1.1.0)
       mime-types (>= 1.19)
       rugged (>= 0.23.0b)
+    gitlab-styles (2.0.0)
+      rubocop (~> 0.49)
+      rubocop-gitlab-security (~> 0.1.0)
+      rubocop-rspec (~> 1.15)
     google-protobuf (3.4.0.2)
     googleauth (0.5.3)
       faraday (~> 0.12)
@@ -47,7 +52,26 @@ GEM
     multi_json (1.12.1)
     multipart-post (2.0.0)
     os (0.9.6)
+    parallel (1.12.0)
+    parser (2.4.0.0)
+      ast (~> 2.2)
+    powerpack (0.1.1)
     public_suffix (2.0.5)
+    rainbow (2.2.2)
+      rake
+    rake (12.1.0)
+    rubocop (0.50.0)
+      parallel (~> 1.10)
+      parser (>= 2.3.3.1, < 3.0)
+      powerpack (~> 0.1)
+      rainbow (>= 2.2.2, < 3.0)
+      ruby-progressbar (~> 1.7)
+      unicode-display_width (~> 1.0, >= 1.0.1)
+    rubocop-gitlab-security (0.1.0)
+      rubocop (>= 0.47.1)
+    rubocop-rspec (1.17.0)
+      rubocop (>= 0.50.0)
+    ruby-progressbar (1.8.3)
     rugged (0.26.0)
     signet (0.7.3)
       addressable (~> 2.3)
@@ -57,6 +81,7 @@ GEM
     thread_safe (0.3.6)
     tzinfo (1.2.2)
       thread_safe (~> 0.1)
+    unicode-display_width (1.3.0)
 
 PLATFORMS
   ruby
@@ -65,6 +90,7 @@ DEPENDENCIES
   activesupport
   gitaly-proto (~> 0.37.0)
   github-linguist (~> 4.7.0)
+  gitlab-styles (~> 2.0.0)
 
 BUNDLED WITH
    1.15.4
diff --git a/pkgs/applications/version-management/gitaly/default.nix b/pkgs/applications/version-management/gitaly/default.nix
index ba8831d370c7..63e5758107f7 100644
--- a/pkgs/applications/version-management/gitaly/default.nix
+++ b/pkgs/applications/version-management/gitaly/default.nix
@@ -7,14 +7,14 @@ let
     gemdir = ./.;
   };
 in buildGoPackage rec {
-  version = "0.38.0";
+  version = "0.43.1";
   name = "gitaly-${version}";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitaly";
     rev = "v${version}";
-    sha256 = "02s5gjxbjvm990n4h5zkyqj71a9mp4yj83hfl8mma0g7gx00icsf";
+    sha256 = "19ggfc5nwv8q1wq739ab8qdfdngpi33431dgfa9593p6ad7v6hyq";
   };
 
   goPackagePath = "gitlab.com/gitlab-org/gitaly";
diff --git a/pkgs/applications/version-management/gitaly/gemset.nix b/pkgs/applications/version-management/gitaly/gemset.nix
index 6dc3eb596665..57480f3f337e 100644
--- a/pkgs/applications/version-management/gitaly/gemset.nix
+++ b/pkgs/applications/version-management/gitaly/gemset.nix
@@ -17,6 +17,14 @@
     };
     version = "2.5.1";
   };
+  ast = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0pp82blr5fakdk27d1d21xq9zchzb6vmyb1zcsl520s3ygvprn8m";
+      type = "gem";
+    };
+    version = "2.3.0";
+  };
   charlock_holmes = {
     source = {
       remotes = ["https://rubygems.org"];
@@ -68,6 +76,15 @@
     };
     version = "4.7.6";
   };
+  gitlab-styles = {
+    dependencies = ["rubocop" "rubocop-gitlab-security" "rubocop-rspec"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1k8xrkjx8rcny8p0gsp18wskvn1qbw4rfgdp1f6x0p4xp6dlhjf4";
+      type = "gem";
+    };
+    version = "2.0.0";
+  };
   google-protobuf = {
     source = {
       remotes = ["https://rubygems.org"];
@@ -184,6 +201,31 @@
     };
     version = "0.9.6";
   };
+  parallel = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0qv2yj4sxr36ga6xdxvbq9h05hn10bwcbkqv6j6q1fiixhsdnnzd";
+      type = "gem";
+    };
+    version = "1.12.0";
+  };
+  parser = {
+    dependencies = ["ast"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "130rfk8a2ws2fyq52hmi1n0xakylw39wv4x1qhai4z17x2b0k9cq";
+      type = "gem";
+    };
+    version = "2.4.0.0";
+  };
+  powerpack = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1fnn3fli5wkzyjl4ryh0k90316shqjfnhydmc7f8lqpi0q21va43";
+      type = "gem";
+    };
+    version = "0.1.1";
+  };
   public_suffix = {
     source = {
       remotes = ["https://rubygems.org"];
@@ -192,6 +234,58 @@
     };
     version = "2.0.5";
   };
+  rainbow = {
+    dependencies = ["rake"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "08w2ghc5nv0kcq5b257h7dwjzjz1pqcavajfdx2xjyxqsvh2y34w";
+      type = "gem";
+    };
+    version = "2.2.2";
+  };
+  rake = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0mfqgpp3m69s5v1rd51lfh5qpjwyia5p4rg337pw8c8wzm6pgfsw";
+      type = "gem";
+    };
+    version = "12.1.0";
+  };
+  rubocop = {
+    dependencies = ["parallel" "parser" "powerpack" "rainbow" "ruby-progressbar" "unicode-display_width"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1hpd7zcv4y9y750wj630abvmcjwv39dsrj1fjff60ik7gfri0xlz";
+      type = "gem";
+    };
+    version = "0.50.0";
+  };
+  rubocop-gitlab-security = {
+    dependencies = ["rubocop"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0aw9qmyc6xj6fi0jxp8m4apk358rd91z492ragn6jp4rghkqj5cy";
+      type = "gem";
+    };
+    version = "0.1.0";
+  };
+  rubocop-rspec = {
+    dependencies = ["rubocop"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1hf48ng67yswvshmv4cyysj1rs1z3fnvlycr50jdcgwlynpyxkhs";
+      type = "gem";
+    };
+    version = "1.17.0";
+  };
+  ruby-progressbar = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "029kv0q3kfq53rjyak4ypn7196l8z4hflfmv4p5787n78z7baiqf";
+      type = "gem";
+    };
+    version = "1.8.3";
+  };
   rugged = {
     source = {
       remotes = ["https://rubygems.org"];
@@ -226,4 +320,12 @@
     };
     version = "1.2.2";
   };
+  unicode-display_width = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "12pi0gwqdnbx1lv5136v3vyr0img9wr0kxcn4wn54ipq4y41zxq8";
+      type = "gem";
+    };
+    version = "1.3.0";
+  };
 }
\ No newline at end of file
diff --git a/pkgs/applications/version-management/gitlab-shell/default.nix b/pkgs/applications/version-management/gitlab-shell/default.nix
index 1fdb529d9ac4..ac05ca4c4847 100644
--- a/pkgs/applications/version-management/gitlab-shell/default.nix
+++ b/pkgs/applications/version-management/gitlab-shell/default.nix
@@ -1,14 +1,14 @@
 { stdenv, ruby, bundler, fetchFromGitLab, go }:
 
 stdenv.mkDerivation rec {
-  version = "5.9.0";
+  version = "5.9.3";
   name = "gitlab-shell-${version}";
 
   srcs = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-shell";
     rev = "v${version}";
-    sha256 = "1zjlwivksaqlfxxhxjgpqa3293nhijw76fj7nv0l11820wplc7yf";
+    sha256 = "12iil8ap9lbd7skj7xr2v6lsyjdd97svbmyj0n2j8m819fv0x27p";
   };
 
   buildInputs = [
diff --git a/pkgs/applications/version-management/gitlab-shell/remove-hardcoded-locations.patch b/pkgs/applications/version-management/gitlab-shell/remove-hardcoded-locations.patch
index e88dbad071f5..dd1ecafb8bf8 100644
--- a/pkgs/applications/version-management/gitlab-shell/remove-hardcoded-locations.patch
+++ b/pkgs/applications/version-management/gitlab-shell/remove-hardcoded-locations.patch
@@ -3,7 +3,7 @@ index 0b11ce3..ffc3faf 100644
 --- a/lib/gitlab_projects.rb
 +++ b/lib/gitlab_projects.rb
 @@ -8,7 +8,7 @@ require_relative 'gitlab_metrics'
- require_relative 'gitlab_reference_counter'
+ require_relative 'gitlab_metrics'
  
  class GitlabProjects
 -  GLOBAL_HOOKS_DIRECTORY = File.join(ROOT_PATH, 'hooks')
@@ -15,7 +15,7 @@ diff --git a/lib/gitlab_shell.rb b/lib/gitlab_shell.rb
 index e7d0254..181ec8a 100644
 --- a/lib/gitlab_shell.rb
 +++ b/lib/gitlab_shell.rb
-@@ -163,7 +163,8 @@ class GitlabShell
+@@ -188,7 +188,8 @@ class GitlabShell
      end
  
      # We use 'chdir: ROOT_PATH' to let the next executable know where config.yml is.
diff --git a/pkgs/applications/version-management/gitlab-workhorse/default.nix b/pkgs/applications/version-management/gitlab-workhorse/default.nix
index a91a15e66b85..1f3407eddcf5 100644
--- a/pkgs/applications/version-management/gitlab-workhorse/default.nix
+++ b/pkgs/applications/version-management/gitlab-workhorse/default.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchFromGitLab, git, go }:
 
 stdenv.mkDerivation rec {
-  version = "3.0.0";
+  version = "3.2.0";
   name = "gitlab-workhorse-${version}";
 
   srcs = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-workhorse";
     rev = "v${version}";
-    sha256 = "0lz3bgwww640c7gh97vf40a8h6cz4znscl0r00z6iiwkc0xxzp7j";
+    sha256 = "1ivqlhvmxhdb8359yh469zl45j00n94b53naqi8jx06kijfsdz4r";
   };
 
   buildInputs = [ git go ];
diff --git a/pkgs/applications/version-management/gitlab-workhorse/remove-hardcoded-paths.patch b/pkgs/applications/version-management/gitlab-workhorse/remove-hardcoded-paths.patch
index 37f3d2deef54..d8313ecb433a 100644
--- a/pkgs/applications/version-management/gitlab-workhorse/remove-hardcoded-paths.patch
+++ b/pkgs/applications/version-management/gitlab-workhorse/remove-hardcoded-paths.patch
@@ -2,11 +2,11 @@ diff --git a/internal/git/command.go b/internal/git/command.go
 index 0e5496c..5778294 100644
 --- a/internal/git/command.go
 +++ b/internal/git/command.go
-@@ -16,6 +16,7 @@ func gitCommand(gl_id string, name string, args ...string) *exec.Cmd {
+@@ -19,6 +19,7 @@ func gitCommand(gl_id string, name string, args ...string) *exec.Cmd {
  	cmd.Env = []string{
  		fmt.Sprintf("HOME=%s", os.Getenv("HOME")),
  		fmt.Sprintf("PATH=%s", os.Getenv("PATH")),
 +		fmt.Sprintf("GITLAB_SHELL_CONFIG_PATH=%s", os.Getenv("GITLAB_SHELL_CONFIG_PATH")),
  		fmt.Sprintf("LD_LIBRARY_PATH=%s", os.Getenv("LD_LIBRARY_PATH")),
- 		fmt.Sprintf("GL_ID=%s", gl_id),
+ 		fmt.Sprintf("GL_PROTOCOL=http"),
  	}
diff --git a/pkgs/applications/version-management/gitlab/Gemfile b/pkgs/applications/version-management/gitlab/Gemfile
index 97af3413b156..b4a457bff6e5 100644
--- a/pkgs/applications/version-management/gitlab/Gemfile
+++ b/pkgs/applications/version-management/gitlab/Gemfile
@@ -23,10 +23,10 @@ gem 'faraday', '~> 0.12'
 # Authentication libraries
 gem 'devise', '~> 4.2'
 gem 'doorkeeper', '~> 4.2.0'
-gem 'doorkeeper-openid_connect', '~> 1.1.0'
+gem 'doorkeeper-openid_connect', '~> 1.2.0'
 gem 'omniauth', '~> 1.4.2'
 gem 'omniauth-auth0', '~> 1.4.1'
-gem 'omniauth-azure-oauth2', '~> 0.0.6'
+gem 'omniauth-azure-oauth2', '~> 0.0.9'
 gem 'omniauth-cas3', '~> 1.1.4'
 gem 'omniauth-facebook', '~> 4.0.0'
 gem 'omniauth-github', '~> 1.1.1'
@@ -105,7 +105,7 @@ gem 'fog-rackspace', '~> 0.1.1'
 gem 'fog-aliyun', '~> 0.1.0'
 
 # for Google storage
-gem 'google-api-client', '~> 0.8.6'
+gem 'google-api-client', '~> 0.13.6'
 
 # for aws storage
 gem 'unf', '~> 0.1.4'
@@ -116,7 +116,7 @@ gem 'seed-fu', '~> 2.3.5'
 # Markdown and HTML processing
 gem 'html-pipeline', '~> 1.11.0'
 gem 'deckar01-task_list', '2.0.0'
-gem 'gitlab-markup', '~> 1.5.1'
+gem 'gitlab-markup', '~> 1.6.2'
 gem 'redcarpet', '~> 3.4'
 gem 'RedCloth', '~> 4.3.2'
 gem 'rdoc', '~> 4.2'
@@ -239,7 +239,7 @@ gem 'rack-proxy', '~> 0.6.0'
 gem 'sass-rails', '~> 5.0.6'
 gem 'uglifier', '~> 2.7.2'
 
-gem 'addressable', '~> 2.3.8'
+gem 'addressable', '~> 2.5.2'
 gem 'bootstrap-sass', '~> 3.3.0'
 gem 'font-awesome-rails', '~> 4.7'
 gem 'gemojione', '~> 3.3'
@@ -281,7 +281,7 @@ group :metrics do
   gem 'influxdb', '~> 0.2', require: false
 
   # Prometheus
-  gem 'prometheus-client-mmap', '~>0.7.0.beta14'
+  gem 'prometheus-client-mmap', '~>0.7.0.beta18'
   gem 'raindrops', '~> 0.18'
 end
 
@@ -356,12 +356,13 @@ end
 group :test do
   gem 'shoulda-matchers', '~> 3.1.2', require: false
   gem 'email_spec', '~> 1.6.0'
-  gem 'json-schema', '~> 2.6.2'
+  gem 'json-schema', '~> 2.8.0'
   gem 'webmock', '~> 2.3.2'
   gem 'test_after_commit', '~> 1.1'
   gem 'sham_rack', '~> 1.3.6'
   gem 'timecop', '~> 0.8.0'
   gem 'concurrent-ruby', '~> 1.0.5'
+  gem 'test-prof', '~> 0.2.5'
 end
 
 gem 'octokit', '~> 4.6.2'
@@ -397,7 +398,7 @@ group :ed25519 do
 end
 
 # Gitaly GRPC client
-gem 'gitaly-proto', '~> 0.33.0', require: 'gitaly'
+gem 'gitaly-proto', '~> 0.39.0', require: 'gitaly'
 
 gem 'toml-rb', '~> 0.3.15', require: false
 
diff --git a/pkgs/applications/version-management/gitlab/Gemfile.lock b/pkgs/applications/version-management/gitlab/Gemfile.lock
index 61c5335962b0..fd3aab2d54ad 100644
--- a/pkgs/applications/version-management/gitlab/Gemfile.lock
+++ b/pkgs/applications/version-management/gitlab/Gemfile.lock
@@ -47,7 +47,8 @@ GEM
     adamantium (0.2.0)
       ice_nine (~> 0.11.0)
       memoizable (~> 0.4.0)
-    addressable (2.3.8)
+    addressable (2.5.2)
+      public_suffix (>= 2.0.2, < 4.0)
     akismet (2.0.0)
     allocations (1.0.5)
     arel (6.0.4)
@@ -64,10 +65,6 @@ GEM
     attr_encrypted (3.0.3)
       encryptor (~> 3.0.0)
     attr_required (1.0.0)
-    autoparse (0.3.3)
-      addressable (>= 2.3.1)
-      extlib (>= 0.9.15)
-      multi_json (>= 1.0.0)
     autoprefixer-rails (6.2.3)
       execjs
       json
@@ -85,7 +82,7 @@ GEM
       coderay (>= 1.0.0)
       erubis (>= 2.6.6)
       rack (>= 0.9.0)
-    bindata (2.3.5)
+    bindata (2.4.1)
     binding_of_caller (0.7.2)
       debug_inspector (>= 0.0.1)
     bootstrap-sass (3.3.6)
@@ -148,6 +145,8 @@ GEM
     debugger-ruby_core_source (1.3.8)
     deckar01-task_list (2.0.0)
       html-pipeline
+    declarative (0.0.10)
+    declarative-option (0.1.0)
     default_value_for (3.0.2)
       activerecord (>= 3.2.0, < 5.1)
     descendants_tracker (0.0.4)
@@ -169,9 +168,9 @@ GEM
     docile (1.1.5)
     domain_name (0.5.20161021)
       unf (>= 0.0.5, < 1.0.0)
-    doorkeeper (4.2.0)
+    doorkeeper (4.2.6)
       railties (>= 4.2)
-    doorkeeper-openid_connect (1.1.2)
+    doorkeeper-openid_connect (1.2.0)
       doorkeeper (~> 4.0)
       json-jwt (~> 1.6)
     dropzonejs-rails (0.7.2)
@@ -190,13 +189,12 @@ GEM
     excon (0.57.1)
     execjs (2.6.0)
     expression_parser (0.9.0)
-    extlib (0.9.16)
     factory_girl (4.7.0)
       activesupport (>= 3.0.0)
     factory_girl_rails (4.7.0)
       factory_girl (~> 4.7.0)
       railties (>= 3.0.0)
-    faraday (0.12.1)
+    faraday (0.12.2)
       multipart-post (>= 1.2, < 3)
     faraday_middleware (0.11.0.1)
       faraday (>= 0.7.4, < 1.0)
@@ -277,7 +275,7 @@ GEM
       po_to_json (>= 1.0.0)
       rails (>= 3.2.0)
     gherkin-ruby (0.3.2)
-    gitaly-proto (0.33.0)
+    gitaly-proto (0.39.0)
       google-protobuf (~> 3.1)
       grpc (~> 1.0)
     github-linguist (4.7.6)
@@ -290,12 +288,12 @@ GEM
       flowdock (~> 0.7)
       gitlab-grit (>= 2.4.1)
       multi_json
-    gitlab-grit (2.8.1)
+    gitlab-grit (2.8.2)
       charlock_holmes (~> 0.6)
       diff-lcs (~> 1.1)
-      mime-types (>= 1.16, < 3)
+      mime-types (>= 1.16)
       posix-spawn (~> 0.3)
-    gitlab-markup (1.5.1)
+    gitlab-markup (1.6.2)
     gitlab_omniauth-ldap (2.0.4)
       net-ldap (~> 0.16)
       omniauth (~> 1.3)
@@ -321,20 +319,16 @@ GEM
       json
       multi_json
       request_store (>= 1.0)
-    google-api-client (0.8.7)
-      activesupport (>= 3.2, < 5.0)
-      addressable (~> 2.3)
-      autoparse (~> 0.3)
-      extlib (~> 0.9)
-      faraday (~> 0.9)
-      googleauth (~> 0.3)
-      launchy (~> 2.4)
-      multi_json (~> 1.10)
-      retriable (~> 1.4)
-      signet (~> 0.6)
+    google-api-client (0.13.6)
+      addressable (~> 2.5, >= 2.5.1)
+      googleauth (~> 0.5)
+      httpclient (>= 2.8.1, < 3.0)
+      mime-types (~> 3.0)
+      representable (~> 3.0)
+      retriable (>= 2.0, < 4.0)
     google-protobuf (3.4.0.2)
-    googleauth (0.5.1)
-      faraday (~> 0.9)
+    googleauth (0.5.3)
+      faraday (~> 0.12)
       jwt (~> 1.4)
       logging (~> 2.0)
       memoist (~> 0.12)
@@ -359,7 +353,7 @@ GEM
       rake
     grape_logging (1.7.0)
       grape
-    grpc (1.4.5)
+    grpc (1.6.0)
       google-protobuf (~> 3.1)
       googleauth (~> 0.5.1)
     haml (4.0.7)
@@ -418,14 +412,14 @@ GEM
       railties (>= 4.2.0)
       thor (>= 0.14, < 2.0)
     json (1.8.6)
-    json-jwt (1.7.1)
+    json-jwt (1.7.2)
       activesupport
       bindata
       multi_json (>= 1.3)
       securecompare
       url_safe_base64
-    json-schema (2.6.2)
-      addressable (~> 2.3.8)
+    json-schema (2.8.0)
+      addressable (>= 2.4)
     jwt (1.5.6)
     kaminari (1.0.1)
       activesupport (>= 4.1.0)
@@ -477,18 +471,20 @@ GEM
     mail (2.6.6)
       mime-types (>= 1.16, < 4)
     mail_room (0.9.1)
-    memoist (0.15.0)
+    memoist (0.16.0)
     memoizable (0.4.2)
       thread_safe (~> 0.3, >= 0.3.1)
     method_source (0.8.2)
-    mime-types (2.99.3)
+    mime-types (3.1)
+      mime-types-data (~> 3.2015)
+    mime-types-data (3.2016.0521)
     mimemagic (0.3.0)
     mini_mime (0.1.4)
     mini_portile2 (2.3.0)
     minitest (5.7.0)
     mmap2 (2.2.7)
     mousetrap-rails (1.4.6)
-    multi_json (1.12.1)
+    multi_json (1.12.2)
     multi_xml (0.6.0)
     multipart-post (2.0.0)
     mustermann (1.0.0)
@@ -518,10 +514,10 @@ GEM
       omniauth-oauth2 (~> 1.1)
     omniauth-authentiq (0.3.1)
       omniauth-oauth2 (~> 1.3, >= 1.3.1)
-    omniauth-azure-oauth2 (0.0.6)
+    omniauth-azure-oauth2 (0.0.9)
       jwt (~> 1.0)
       omniauth (~> 1.0)
-      omniauth-oauth2 (~> 1.1)
+      omniauth-oauth2 (~> 1.4)
     omniauth-cas3 (1.1.4)
       addressable (~> 2.3)
       nokogiri (~> 1.7, >= 1.7.1)
@@ -547,7 +543,7 @@ GEM
     omniauth-oauth (1.1.0)
       oauth
       omniauth (~> 1.0)
-    omniauth-oauth2 (1.3.1)
+    omniauth-oauth2 (1.4.0)
       oauth2 (~> 1.0)
       omniauth (~> 1.2)
     omniauth-oauth2-generic (0.2.2)
@@ -626,7 +622,7 @@ GEM
       parser
       unparser
     procto (0.0.3)
-    prometheus-client-mmap (0.7.0.beta14)
+    prometheus-client-mmap (0.7.0.beta18)
       mmap2 (~> 2.2, >= 2.2.7)
     pry (0.10.4)
       coderay (~> 1.1.0)
@@ -637,6 +633,7 @@ GEM
       pry (~> 0.10)
     pry-rails (0.3.5)
       pry (>= 0.9.10)
+    public_suffix (3.0.0)
     pyu-ruby-sasl (0.0.3.3)
     rack (1.6.8)
     rack-accept (0.4.5)
@@ -686,7 +683,7 @@ GEM
     rainbow (2.2.2)
       rake
     raindrops (0.18.0)
-    rake (12.0.0)
+    rake (12.1.0)
     rblineprof (0.3.6)
       debugger-ruby_core_source (~> 1.3)
     rbnacl (4.0.2)
@@ -719,6 +716,10 @@ GEM
       redis-store (~> 1.2.0)
     redis-store (1.2.0)
       redis (>= 2.2)
+    representable (3.0.4)
+      declarative (< 0.1.0)
+      declarative-option (< 0.2.0)
+      uber (< 0.2.0)
     request_store (1.3.1)
     responders (2.3.0)
       railties (>= 4.2.0, < 5.1)
@@ -726,7 +727,7 @@ GEM
       http-cookie (>= 1.0.2, < 2.0)
       mime-types (>= 1.16, < 4.0)
       netrc (~> 0.8)
-    retriable (1.4.1)
+    retriable (3.1.1)
     rinku (2.0.0)
     rotp (2.1.2)
     rouge (2.2.1)
@@ -884,6 +885,7 @@ GEM
       ffi
     sysexits (1.2.0)
     temple (0.7.7)
+    test-prof (0.2.5)
     test_after_commit (1.1.0)
       activerecord (>= 3.2)
     text (1.3.1)
@@ -904,12 +906,13 @@ GEM
     tzinfo (1.2.3)
       thread_safe (~> 0.1)
     u2f (0.2.1)
+    uber (0.1.0)
     uglifier (2.7.2)
       execjs (>= 0.3.0)
       json (>= 1.8.0)
     unf (0.1.4)
       unf_ext
-    unf_ext (0.0.7.2)
+    unf_ext (0.0.7.4)
     unicode-display_width (1.3.0)
     unicorn (5.1.0)
       kgio (~> 2.6)
@@ -965,7 +968,7 @@ DEPENDENCIES
   activerecord-nulldb-adapter
   activerecord_sane_schema_dumper (= 0.2)
   acts-as-taggable-on (~> 4.0)
-  addressable (~> 2.3.8)
+  addressable (~> 2.5.2)
   akismet (~> 2.0)
   allocations (~> 1.0)
   asana (~> 0.6.0)
@@ -1002,7 +1005,7 @@ DEPENDENCIES
   devise-two-factor (~> 3.0.0)
   diffy (~> 3.1.0)
   doorkeeper (~> 4.2.0)
-  doorkeeper-openid_connect (~> 1.1.0)
+  doorkeeper-openid_connect (~> 1.2.0)
   dropzonejs-rails (~> 0.7.1)
   email_reply_trimmer (~> 0.1)
   email_spec (~> 1.6.0)
@@ -1027,15 +1030,15 @@ DEPENDENCIES
   gettext (~> 3.2.2)
   gettext_i18n_rails (~> 1.8.0)
   gettext_i18n_rails_js (~> 1.2.0)
-  gitaly-proto (~> 0.33.0)
+  gitaly-proto (~> 0.39.0)
   github-linguist (~> 4.7.0)
   gitlab-flowdock-git-hook (~> 1.0.1)
-  gitlab-markup (~> 1.5.1)
+  gitlab-markup (~> 1.6.2)
   gitlab_omniauth-ldap (~> 2.0.4)
   gollum-lib (~> 4.2)
   gollum-rugged_adapter (~> 0.4.4)
   gon (~> 6.1.0)
-  google-api-client (~> 0.8.6)
+  google-api-client (~> 0.13.6)
   gpgme
   grape (~> 1.0)
   grape-entity (~> 0.6.0)
@@ -1053,7 +1056,7 @@ DEPENDENCIES
   jira-ruby (~> 1.4)
   jquery-atwho-rails (~> 1.3.2)
   jquery-rails (~> 4.1.0)
-  json-schema (~> 2.6.2)
+  json-schema (~> 2.8.0)
   jwt (~> 1.5.6)
   kaminari (~> 1.0)
   knapsack (~> 1.11.0)
@@ -1077,7 +1080,7 @@ DEPENDENCIES
   omniauth (~> 1.4.2)
   omniauth-auth0 (~> 1.4.1)
   omniauth-authentiq (~> 0.3.1)
-  omniauth-azure-oauth2 (~> 0.0.6)
+  omniauth-azure-oauth2 (~> 0.0.9)
   omniauth-cas3 (~> 1.1.4)
   omniauth-facebook (~> 4.0.0)
   omniauth-github (~> 1.1.1)
@@ -1103,7 +1106,7 @@ DEPENDENCIES
   pg (~> 0.18.2)
   poltergeist (~> 1.9.0)
   premailer-rails (~> 1.9.7)
-  prometheus-client-mmap (~> 0.7.0.beta14)
+  prometheus-client-mmap (~> 0.7.0.beta18)
   pry-byebug (~> 3.4.1)
   pry-rails (~> 0.3.4)
   rack-attack (~> 4.4.1)
@@ -1166,6 +1169,7 @@ DEPENDENCIES
   stackprof (~> 0.2.10)
   state_machines-activerecord (~> 0.4.0)
   sys-filesystem (~> 1.1.6)
+  test-prof (~> 0.2.5)
   test_after_commit (~> 1.1)
   thin (~> 1.7.0)
   timecop (~> 0.8.0)
diff --git a/pkgs/applications/version-management/gitlab/default.nix b/pkgs/applications/version-management/gitlab/default.nix
index 657221d4b420..bc3ca9192bcb 100644
--- a/pkgs/applications/version-management/gitlab/default.nix
+++ b/pkgs/applications/version-management/gitlab/default.nix
@@ -18,11 +18,11 @@ let
     };
   };
 
-  version = "10.0.2";
+  version = "10.1.1";
 
   gitlabDeb = fetchurl {
     url = "https://packages.gitlab.com/gitlab/gitlab-ce/packages/debian/jessie/gitlab-ce_${version}-ce.0_amd64.deb/download";
-    sha256 = "0jsqjarvjzbxv1yiddzp5xwsqqrq5cvam0xn749p1vzqhcp8pahc";
+    sha256 = "0xvzxcygy6ffqm24rk6v9gs6g9r744vpwwvk9d00wjla7hwmq3w2";
   };
 
 in
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
     owner = "gitlabhq";
     repo = "gitlabhq";
     rev = "v${version}";
-    sha256 = "1602d6nkb41gg80n6p0wqxrjsn79s0z3817461d8dw2ha2dmbl34";
+    sha256 = "0p118msad6l12pd4q3vkvjggiiasbkh6pnl94riqyb5zkb7yrb1a";
   };
 
   patches = [
diff --git a/pkgs/applications/version-management/gitlab/gemset.nix b/pkgs/applications/version-management/gitlab/gemset.nix
index 34567ddb3ea4..4fb4c48b0dee 100644
--- a/pkgs/applications/version-management/gitlab/gemset.nix
+++ b/pkgs/applications/version-management/gitlab/gemset.nix
@@ -115,12 +115,13 @@
     version = "0.2.0";
   };
   addressable = {
+    dependencies = ["public_suffix"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1533axm85gpz267km9gnfarf9c78g2scrysd6b8yw33vmhkz2km6";
+      sha256 = "0viqszpkggqi8hq87pqp0xykhvz60g99nwmkwsb0v45kc2liwxvk";
       type = "gem";
     };
-    version = "2.3.8";
+    version = "2.5.2";
   };
   akismet = {
     source = {
@@ -205,15 +206,6 @@
     };
     version = "1.0.0";
   };
-  autoparse = {
-    dependencies = ["addressable" "extlib" "multi_json"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1q5wkd8gc2ckmgry9fba4b8vxb5kr8k8gqq2wycbirgq06mbllb6";
-      type = "gem";
-    };
-    version = "0.3.3";
-  };
   autoprefixer-rails = {
     dependencies = ["execjs" "json"];
     source = {
@@ -292,10 +284,10 @@
   bindata = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "07i51jzq9iamw40xmmcgkrdq4m8f0vb5gp53p6q1vggj7z53q3v7";
+      sha256 = "0anbg203zjr4crql20ss5b9xg2c6a7j8nm6hs8w3ll1h1akkpp2z";
       type = "gem";
     };
-    version = "2.3.5";
+    version = "2.4.1";
   };
   binding_of_caller = {
     dependencies = ["debug_inspector"];
@@ -592,6 +584,22 @@
     };
     version = "2.0.0";
   };
+  declarative = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0642xvwzzbgi3kp1bg467wma4g3xqrrn0sk369hjam7w579gnv5j";
+      type = "gem";
+    };
+    version = "0.0.10";
+  };
+  declarative-option = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1g4ibxq566f1frnhdymzi9hxxcm4g2gw4n21mpjk2mhwym4q6l0p";
+      type = "gem";
+    };
+    version = "0.1.0";
+  };
   default_value_for = {
     dependencies = ["activerecord"];
     source = {
@@ -665,19 +673,19 @@
     dependencies = ["railties"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0hs8r280k7a1kibzxrhifjps880n43jfrybf4mqpffw669jrwk3v";
+      sha256 = "0r5rfvjjnlf9cn97cdrfw260zkg785k4197xqidgb35445k62mah";
       type = "gem";
     };
-    version = "4.2.0";
+    version = "4.2.6";
   };
   doorkeeper-openid_connect = {
     dependencies = ["doorkeeper" "json-jwt"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1pla85j5wxra0k9rhj04g2ai5d5jg97fiavi0s9v2hjba2l54cni";
+      sha256 = "13k0xlr1grjj8ri26qy2zwbgi3fqxinvnygh53bnyi9qcynx5827";
       type = "gem";
     };
-    version = "1.1.2";
+    version = "1.2.0";
   };
   dropzonejs-rails = {
     dependencies = ["rails"];
@@ -778,14 +786,6 @@
     };
     version = "0.9.0";
   };
-  extlib = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1cbw3vgb189z3vfc1arijmsd604m3w5y5xvdfkrblc9qh7sbk2rh";
-      type = "gem";
-    };
-    version = "0.9.16";
-  };
   factory_girl = {
     dependencies = ["activesupport"];
     source = {
@@ -808,10 +808,10 @@
     dependencies = ["multipart-post"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1wkx9844vacsk2229xbc27djf6zw15kqd60ifr78whf9mp9v6l03";
+      sha256 = "157c4cmb5g1b3ny6k9qf9z57rfijl54fcq3hnqqf6g31g1m096b2";
       type = "gem";
     };
-    version = "0.12.1";
+    version = "0.12.2";
   };
   faraday_middleware = {
     dependencies = ["faraday"];
@@ -1071,10 +1071,10 @@
     dependencies = ["google-protobuf" "grpc"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0f15idw1850kwi0na6x3xlk13ljwx3mpfnxfv58631cmb3ac7wf8";
+      sha256 = "0irc3yfyr5li2ki6w03znsklnk0qx3srk4wrb7jav042c4kw325k";
       type = "gem";
     };
-    version = "0.33.0";
+    version = "0.39.0";
   };
   github-linguist = {
     dependencies = ["charlock_holmes" "escape_utils" "mime-types" "rugged"];
@@ -1106,18 +1106,18 @@
     dependencies = ["charlock_holmes" "diff-lcs" "mime-types" "posix-spawn"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0lf1cr6pzqrbnxiiwym6q74b1a2ihdi91dynajk8hi1p093hl66n";
+      sha256 = "0xgs3l81ghlc5nm75n0pz7b2cj3hpscfq5iy27c483nnjn2v5mc4";
       type = "gem";
     };
-    version = "2.8.1";
+    version = "2.8.2";
   };
   gitlab-markup = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1aam7zvvbai5nv7vf0c0640pvik6s71f276lip4yb4slbg0pfpn2";
+      sha256 = "114jfbyyfwad609k1l1fcmbzszb3frdchh83gdwndkglllvprhjz";
       type = "gem";
     };
-    version = "1.5.1";
+    version = "1.6.2";
   };
   gitlab_omniauth-ldap = {
     dependencies = ["net-ldap" "omniauth" "pyu-ruby-sasl" "rubyntlm"];
@@ -1174,13 +1174,13 @@
     version = "6.1.0";
   };
   google-api-client = {
-    dependencies = ["activesupport" "addressable" "autoparse" "extlib" "faraday" "googleauth" "launchy" "multi_json" "retriable" "signet"];
+    dependencies = ["addressable" "googleauth" "httpclient" "mime-types" "representable" "retriable"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "11wr57j9fp6x6fym4k1a7jqp72qgc8l24mfwb4y55bbvdmkv1b2d";
+      sha256 = "0ac9qa0kwnirkvwz2w9zf07lqcgbmnvgd1wg8xxyjbadwsbpyf1y";
       type = "gem";
     };
-    version = "0.8.7";
+    version = "0.13.6";
   };
   google-protobuf = {
     source = {
@@ -1194,10 +1194,10 @@
     dependencies = ["faraday" "jwt" "logging" "memoist" "multi_json" "os" "signet"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1nzkg63s161c6jsia92c1jfwpayzbpwn588smd286idn07y0az2m";
+      sha256 = "1xpmvrzhczak25nm0k3r9aa083lmfnzi94mir3g1xyrgzz66vxli";
       type = "gem";
     };
-    version = "0.5.1";
+    version = "0.5.3";
   };
   gpgme = {
     dependencies = ["mini_portile2"];
@@ -1248,10 +1248,10 @@
     dependencies = ["google-protobuf" "googleauth"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1zhci260088zlghpaz6ania1blz1dd7lgklsjnqk1vcymhpr6b38";
+      sha256 = "056ipqai887x5jpbgcc215kdi0lfqjzcjbx3hx11cjrfww01zc52";
       type = "gem";
     };
-    version = "1.4.5";
+    version = "1.6.0";
   };
   haml = {
     dependencies = ["tilt"];
@@ -1471,19 +1471,19 @@
     dependencies = ["activesupport" "bindata" "multi_json" "securecompare" "url_safe_base64"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1ylvlnb6assan9qkhz1vq1gbfwxg35q9a8f8qhlyx0fak5fyks23";
+      sha256 = "15a3v498lvsshzgjnk2dmyvjv87y3lffq71axj5xq3iz4mp1r4b2";
       type = "gem";
     };
-    version = "1.7.1";
+    version = "1.7.2";
   };
   json-schema = {
     dependencies = ["addressable"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "15bva4w940ckan3q89in5f98s8zz77nxglylgm98697wa4fbfqp9";
+      sha256 = "11di8qyam6bmqn0fvvvf3crgaqy4sil0d406ymx0jacn3ff98ymz";
       type = "gem";
     };
-    version = "2.6.2";
+    version = "2.8.0";
   };
   jwt = {
     source = {
@@ -1662,10 +1662,10 @@
   memoist = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0yd3rd7bnbhn9n47qlhcii5z89liabdjhy3is3h6gq77gyfk4f5q";
+      sha256 = "0pq8fhqh8w25qcw9v3vzfb0i6jp0k3949ahxc3wrwz2791dpbgbh";
       type = "gem";
     };
-    version = "0.15.0";
+    version = "0.16.0";
   };
   memoizable = {
     dependencies = ["thread_safe"];
@@ -1685,12 +1685,21 @@
     version = "0.8.2";
   };
   mime-types = {
+    dependencies = ["mime-types-data"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "03j98xr0qw2p2jkclpmk7pm29yvmmh0073d8d43ajmr0h3w7i5l9";
+      sha256 = "0087z9kbnlqhci7fxh9f6il63hj1k02icq2rs0c6cppmqchr753m";
       type = "gem";
     };
-    version = "2.99.3";
+    version = "3.1";
+  };
+  mime-types-data = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "04my3746hwa4yvbx1ranhfaqkgf6vavi1kyijjnw8w3dy37vqhkm";
+      type = "gem";
+    };
+    version = "3.2016.0521";
   };
   mimemagic = {
     source = {
@@ -1743,10 +1752,10 @@
   multi_json = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1wpc23ls6v2xbk3l1qncsbz16npvmw8p0b38l8czdzri18mp51xk";
+      sha256 = "1raim9ddjh672m32psaa9niw67ywzjbxbdb8iijx3wv9k5b0pk2x";
       type = "gem";
     };
-    version = "1.12.1";
+    version = "1.12.2";
   };
   multi_xml = {
     source = {
@@ -1895,10 +1904,10 @@
     dependencies = ["jwt" "omniauth" "omniauth-oauth2"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0qay454zvyas8xfnfkycqpjkafaq5pw4gaji176cdfw0blhviz0s";
+      sha256 = "0ck5616fjik0dw89xvak1mi8ijcv10lsh6n9h4107l5dys2g3jfx";
       type = "gem";
     };
-    version = "0.0.6";
+    version = "0.0.9";
   };
   omniauth-cas3 = {
     dependencies = ["addressable" "nokogiri" "omniauth"];
@@ -1976,10 +1985,10 @@
     dependencies = ["oauth2" "omniauth"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0mskwlw5ibx9mz7ywqji6mm56ikf7mglbnfc02qhg6ry527jsxdm";
+      sha256 = "0aykbg5qfm37ywrq34dydrhxa5jwpski71dpspgp2fi6dinx09f5";
       type = "gem";
     };
-    version = "1.3.1";
+    version = "1.4.0";
   };
   omniauth-oauth2-generic = {
     dependencies = ["omniauth-oauth2"];
@@ -2247,10 +2256,10 @@
     dependencies = ["mmap2"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1r9s30hypcpw4abxlzcjlkcwkckqvr5sbph3blbl0rq2r8c8h25p";
+      sha256 = "1fgkilpiha338mvfkj5rwhny3vld0nb3v1vgbrlxbhnvch26wakh";
       type = "gem";
     };
-    version = "0.7.0.beta14";
+    version = "0.7.0.beta18";
   };
   pry = {
     dependencies = ["coderay" "method_source" "slop"];
@@ -2279,6 +2288,14 @@
     };
     version = "0.3.5";
   };
+  public_suffix = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0snaj1gxfib4ja1mvy3dzmi7am73i0mkqr0zkz045qv6509dhj5f";
+      type = "gem";
+    };
+    version = "3.0.0";
+  };
   pyu-ruby-sasl = {
     source = {
       remotes = ["https://rubygems.org"];
@@ -2431,10 +2448,10 @@
   rake = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "01j8fc9bqjnrsxbppncai05h43315vmz9fwg28qdsgcjw9ck1d7n";
+      sha256 = "0mfqgpp3m69s5v1rd51lfh5qpjwyia5p4rg337pw8c8wzm6pgfsw";
       type = "gem";
     };
-    version = "12.0.0";
+    version = "12.1.0";
   };
   rblineprof = {
     dependencies = ["debugger-ruby_core_source"];
@@ -2575,6 +2592,15 @@
     };
     version = "1.2.0";
   };
+  representable = {
+    dependencies = ["declarative" "declarative-option" "uber"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0qm9rgi1j5a6nv726ka4mmixivlxfsg91h8rpp72wwd4vqbkkm07";
+      type = "gem";
+    };
+    version = "3.0.4";
+  };
   request_store = {
     source = {
       remotes = ["https://rubygems.org"];
@@ -2604,10 +2630,10 @@
   retriable = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1cmhwgv5r4vn7iqy4bfbnbb73pzl8ik69zrwq9vdim45v8b13gsj";
+      sha256 = "0pnriyn9zh120hxm92vb12hfsf7c98nawyims1shxj3ldpl0l3ar";
       type = "gem";
     };
-    version = "1.4.1";
+    version = "3.1.1";
   };
   rinku = {
     source = {
@@ -3195,6 +3221,14 @@
     };
     version = "0.7.7";
   };
+  test-prof = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "08nvn3c1mzgcjgk9lr3py0zjd8fjjrm3ncn9rpqkfbx429mgw2l3";
+      type = "gem";
+    };
+    version = "0.2.5";
+  };
   test_after_commit = {
     dependencies = ["activerecord"];
     source = {
@@ -3296,6 +3330,14 @@
     };
     version = "0.2.1";
   };
+  uber = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1p1mm7mngg40x05z52md3mbamkng0zpajbzqjjwmsyw0zw3v9vjv";
+      type = "gem";
+    };
+    version = "0.1.0";
+  };
   uglifier = {
     dependencies = ["execjs" "json"];
     source = {
@@ -3317,10 +3359,10 @@
   unf_ext = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "04d13bp6lyg695x94whjwsmzc2ms72d94vx861nx1y40k3817yp8";
+      sha256 = "14hr2dzqh33kqc0xchs8l05pf3kjcayvad4z1ip5rdjxrkfk8glb";
       type = "gem";
     };
-    version = "0.0.7.2";
+    version = "0.0.7.4";
   };
   unicode-display_width = {
     source = {
diff --git a/pkgs/applications/version-management/gitlab/nulladapter.patch b/pkgs/applications/version-management/gitlab/nulladapter.patch
index 70195fe821a0..3b30ff03346b 100644
--- a/pkgs/applications/version-management/gitlab/nulladapter.patch
+++ b/pkgs/applications/version-management/gitlab/nulladapter.patch
@@ -14,7 +14,7 @@ diff --git a/Gemfile.lock b/Gemfile.lock
 index 38944248f9..08ce4486ba 100644
 --- a/Gemfile.lock
 +++ b/Gemfile.lock
-@@ -32,6 +32,8 @@ GEM
+@@ -33,6 +33,8 @@ GEM
        activemodel (= 4.2.8)
        activesupport (= 4.2.8)
        arel (~> 6.0)
@@ -23,11 +23,11 @@ index 38944248f9..08ce4486ba 100644
      activerecord_sane_schema_dumper (0.2)
        rails (>= 4, < 5)
      activesupport (4.2.8)
-@@ -926,6 +928,7 @@ PLATFORMS
+@@ -963,6 +965,7 @@ PLATFORMS
  DEPENDENCIES
    RedCloth (~> 4.3.2)
    ace-rails-ap (~> 4.1.0)
 +  activerecord-nulldb-adapter
    activerecord_sane_schema_dumper (= 0.2)
    acts-as-taggable-on (~> 4.0)
-   addressable (~> 2.3.8)
+   addressable (~> 2.5.2)
diff --git a/pkgs/applications/version-management/gitlab/remove-hardcoded-locations.patch b/pkgs/applications/version-management/gitlab/remove-hardcoded-locations.patch
index c88f525715e0..39c7c28847c4 100644
--- a/pkgs/applications/version-management/gitlab/remove-hardcoded-locations.patch
+++ b/pkgs/applications/version-management/gitlab/remove-hardcoded-locations.patch
@@ -27,20 +27,20 @@ diff --git a/config/gitlab.yml.example b/config/gitlab.yml.example
 index 0b33783869..cd4e41d9bd 100644
 --- a/config/gitlab.yml.example
 +++ b/config/gitlab.yml.example
-@@ -521,7 +521,7 @@ production: &base
+@@ -574,7 +574,7 @@ production: &base
    # CAUTION!
    # Use the default values unless you really know what you are doing
    git:
 -    bin_path: /usr/bin/git
 +    bin_path: git
-     # The next value is the maximum memory size grit can use
-     # Given in number of bytes per git object (e.g. a commit)
-     # This value can be increased if you have very large commits
+ 
+   ## Webpack settings
+   # If enabled, this will tell rails to serve frontend assets from the webpack-dev-server running
 diff --git a/config/initializers/1_settings.rb b/config/initializers/1_settings.rb
 index 8ddf8e4d2e..559cf9adf7 100644
 --- a/config/initializers/1_settings.rb
 +++ b/config/initializers/1_settings.rb
-@@ -219,7 +219,7 @@ Settings.gitlab['user']       ||= 'git'
+@@ -252,7 +252,7 @@ Settings.gitlab['user']       ||= 'git'
  Settings.gitlab['user_home']  ||= begin
    Etc.getpwnam(Settings.gitlab['user']).dir
  rescue ArgumentError # no user configured
@@ -49,15 +49,15 @@ index 8ddf8e4d2e..559cf9adf7 100644
  end
  Settings.gitlab['time_zone'] ||= nil
  Settings.gitlab['signup_enabled'] ||= true if Settings.gitlab['signup_enabled'].nil?
-@@ -454,7 +454,7 @@ Settings.backup['upload']['storage_class'] ||= nil
+@@ -491,7 +491,7 @@ Settings.backup['upload']['storage_class'] ||= nil
+ # Git
  #
  Settings['git'] ||= Settingslogic.new({})
- Settings.git['max_size']  ||= 20971520 # 20.megabytes
--Settings.git['bin_path']  ||= '/usr/bin/git'
-+Settings.git['bin_path']  ||= 'git'
- Settings.git['timeout']   ||= 10
+-Settings.git['bin_path'] ||= '/usr/bin/git'
++Settings.git['bin_path'] ||= 'git'
  
  # Important: keep the satellites.path setting until GitLab 9.0 at
+ # least. This setting is fed to 'rm -rf' in
 diff --git a/lib/gitlab/logger.rb b/lib/gitlab/logger.rb
 index 59b21149a9..4f4a39a06c 100644
 --- a/lib/gitlab/logger.rb
diff --git a/pkgs/applications/window-managers/i3/lock-color.nix b/pkgs/applications/window-managers/i3/lock-color.nix
index fd47a104326e..a589e21be98b 100644
--- a/pkgs/applications/window-managers/i3/lock-color.nix
+++ b/pkgs/applications/window-managers/i3/lock-color.nix
@@ -28,6 +28,9 @@ stdenv.mkDerivation rec {
     homepage = https://i3wm.org/i3lock/;
     maintainers = with maintainers; [ garbas malyn ];
     license = licenses.bsd3;
-    platforms = platforms.all;
+
+    # Needs the SSE2 instruction set. See upstream issue
+    # https://github.com/chrjguill/i3lock-color/issues/44
+    platforms = platforms.i686 ++ platforms.x86_64;
   };
 }
diff --git a/pkgs/build-support/cc-wrapper/cc-wrapper.sh b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
index f1f56cf5cec4..d2cdbf6ce0cc 100644
--- a/pkgs/build-support/cc-wrapper/cc-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
@@ -1,5 +1,5 @@
 #! @shell@
-set -eu -o pipefail
+set -eu -o pipefail +o posix
 shopt -s nullglob
 
 if (( "${NIX_DEBUG:-0}" >= 7 )); then
diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index 489fb02dcb5d..a12c835dd9bf 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -286,7 +286,7 @@ stdenv.mkDerivation {
         *) echo "Multiple dynamic linkers found for platform '${targetPlatform.config}'." >&2;;
       esac
 
-      if [ -n "$dynamicLinker" ]; then
+      if [ -n "''${dynamicLinker:-}" ]; then
         echo $dynamicLinker > $out/nix-support/dynamic-linker
 
     '' + (if targetPlatform.isDarwin then ''
diff --git a/pkgs/build-support/cc-wrapper/gnat-wrapper.sh b/pkgs/build-support/cc-wrapper/gnat-wrapper.sh
index b15f1e461e5f..7a0eb28be636 100644
--- a/pkgs/build-support/cc-wrapper/gnat-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/gnat-wrapper.sh
@@ -1,5 +1,5 @@
 #! @shell@
-set -eu -o pipefail
+set -eu -o pipefail +o posix
 shopt -s nullglob
 
 if (( "${NIX_DEBUG:-0}" >= 7 )); then
diff --git a/pkgs/build-support/cc-wrapper/gnatlink-wrapper.sh b/pkgs/build-support/cc-wrapper/gnatlink-wrapper.sh
index 88e644dc54dc..0944d74e431b 100644
--- a/pkgs/build-support/cc-wrapper/gnatlink-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/gnatlink-wrapper.sh
@@ -1,5 +1,5 @@
 #! @shell@
-set -eu -o pipefail
+set -eu -o pipefail +o posix
 shopt -s nullglob
 
 if (( "${NIX_DEBUG:-0}" >= 7 )); then
diff --git a/pkgs/build-support/cc-wrapper/ld-wrapper.sh b/pkgs/build-support/cc-wrapper/ld-wrapper.sh
index 232e1245af07..ef618f9a86d4 100644
--- a/pkgs/build-support/cc-wrapper/ld-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/ld-wrapper.sh
@@ -1,5 +1,5 @@
 #! @shell@
-set -eu -o pipefail
+set -eu -o pipefail +o posix
 shopt -s nullglob
 
 if (( "${NIX_DEBUG:-0}" >= 7 )); then
diff --git a/pkgs/build-support/fetchurl/default.nix b/pkgs/build-support/fetchurl/default.nix
index 5811950bf053..8dac273eb1ca 100644
--- a/pkgs/build-support/fetchurl/default.nix
+++ b/pkgs/build-support/fetchurl/default.nix
@@ -84,6 +84,9 @@ in
 
 , # Meta information, if any.
   meta ? {}
+
+  # Passthru information, if any.
+, passthru ? {}
 }:
 
 assert builtins.isList urls;
@@ -139,4 +142,5 @@ else stdenv.mkDerivation {
   '';
 
   inherit meta;
+  inherit passthru;
 }
diff --git a/pkgs/data/misc/dns-root-data/default.nix b/pkgs/data/misc/dns-root-data/default.nix
index dade4be1aaff..88b608c78152 100644
--- a/pkgs/data/misc/dns-root-data/default.nix
+++ b/pkgs/data/misc/dns-root-data/default.nix
@@ -4,7 +4,7 @@ let
 
   rootHints = fetchurl {
     url = "https://www.internic.net/domain/named.root";
-    sha256 = "01n4bqf95kbvig1hahqzmmdkpn4v7mzfc1p944gq922i5j3fjr92";
+    sha256 = "0vdrff4l8s8grif52dnh091s8qydhh88k25zqd9rj66sf1qwcwxl";
   };
 
   rootKey = ./root.key;
@@ -13,7 +13,7 @@ let
 in
 
 stdenv.mkDerivation {
-  name = "dns-root-data-2017-08-29";
+  name = "dns-root-data-2017-10-24";
 
   buildCommand = ''
     mkdir $out
diff --git a/pkgs/desktops/gnome-3/misc/gitg/src.nix b/pkgs/desktops/gnome-3/misc/gitg/src.nix
index 9c6dd2148ccf..c72e2830ad1e 100644
--- a/pkgs/desktops/gnome-3/misc/gitg/src.nix
+++ b/pkgs/desktops/gnome-3/misc/gitg/src.nix
@@ -1,10 +1,10 @@
 # Autogenerated by maintainers/scripts/gnome.sh update
 
 fetchurl: {
-  name = "gitg-3.24.0";
+  name = "gitg-3.26.0";
 
   src = fetchurl {
-    url = mirror://gnome/sources/gitg/3.24/gitg-3.24.0.tar.xz;
-    sha256 = "3e4ec4a8ae83bc7ced8c7610927ade70e37daa5e8beeb4f357a6ea30b4cc951e";
+    url = mirror://gnome/sources/gitg/3.26/gitg-3.26.0.tar.xz;
+    sha256 = "26730d437d6a30d6e341b9e8da99d2134dce4b96022c195609f45062f82b54d5";
   };
 }
diff --git a/pkgs/desktops/gnome-3/misc/libgit2-glib/default.nix b/pkgs/desktops/gnome-3/misc/libgit2-glib/default.nix
index a71dbf5494da..36feb09d7eef 100644
--- a/pkgs/desktops/gnome-3/misc/libgit2-glib/default.nix
+++ b/pkgs/desktops/gnome-3/misc/libgit2-glib/default.nix
@@ -1,12 +1,14 @@
-{ stdenv, fetchurl, gnome3, libtool, pkgconfig, vala_0_32, libssh2
+{ stdenv, fetchurl, gnome3, libtool, pkgconfig, vala, libssh2
 , gtk_doc, gobjectIntrospection, libgit2, glib }:
 
 stdenv.mkDerivation rec {
   inherit (import ./src.nix fetchurl) name src;
 
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ gnome3.gnome_common libtool vala_0_32 libssh2
-                  gtk_doc gobjectIntrospection libgit2 glib ];
+  nativeBuildInputs = [
+    gnome3.gnome_common libtool pkgconfig vala gtk_doc gobjectIntrospection
+  ];
+
+  buildInputs = [ libssh2 libgit2 glib ];
 
   meta = with stdenv.lib; {
     platforms = platforms.linux;
diff --git a/pkgs/desktops/gnome-3/misc/libgit2-glib/src.nix b/pkgs/desktops/gnome-3/misc/libgit2-glib/src.nix
index b9abde42cbda..00e747500c61 100644
--- a/pkgs/desktops/gnome-3/misc/libgit2-glib/src.nix
+++ b/pkgs/desktops/gnome-3/misc/libgit2-glib/src.nix
@@ -1,12 +1,10 @@
 # Autogenerated by maintainers/scripts/gnome.sh update
 
-fetchurl: rec {
-  major = "0.25";
-  minor = "0";
-  name = "libgit2-glib-${major}.${minor}";
+fetchurl: {
+  name = "libgit2-glib-0.26.0";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/libgit2-glib/${major}/${name}.tar.xz";
-    sha256 = "0rf5gcr3khp35wj9ax9cbyq5j3iiwa1l0fi16w6sfgmrryd6n9aa";
+    url = mirror://gnome/sources/libgit2-glib/0.26/libgit2-glib-0.26.0.tar.xz;
+    sha256 = "06b16cfcc3a53d9804858618d690e5509e9af2e2245b75f0479cadbbe39745c3";
   };
 }
diff --git a/pkgs/development/compilers/elm/packages/elm-format.nix b/pkgs/development/compilers/elm/packages/elm-format.nix
index a9340fc94fe4..56db835ac10a 100644
--- a/pkgs/development/compilers/elm/packages/elm-format.nix
+++ b/pkgs/development/compilers/elm/packages/elm-format.nix
@@ -1,37 +1,40 @@
-{ mkDerivation, aeson, ansi-terminal, ansi-wl-pprint, base, binary
-, bytestring, containers, directory, edit-distance, fetchgit
-, filemanip, filepath, HUnit, indents, mtl, optparse-applicative
-, parsec, pretty, process, QuickCheck, quickcheck-io
-, regex-applicative, split, stdenv, tasty, tasty-golden
-, tasty-hunit, tasty-quickcheck, text, union-find, wl-pprint
+{ mkDerivation, ansi-terminal, ansi-wl-pprint, base, binary
+, bytestring, Cabal, cmark, containers, directory, fetchgit
+, filepath, free, HUnit, indents, json, mtl, optparse-applicative
+, parsec, process, QuickCheck, quickcheck-io, split, stdenv, tasty
+, tasty-golden, tasty-hunit, tasty-quickcheck, text
 }:
 mkDerivation {
   pname = "elm-format";
-  version = "0.5.2";
+  version = "0.7.0";
   src = fetchgit {
     url = "http://github.com/avh4/elm-format";
-    sha256 = "0lman7h6wr75y90javcc4y1scvwgv125gqqaqvfrd5xrfmm43gg8";
-    rev = "e452ed9342620e7bb0bc822983b96411d57143ef";
+    sha256 = "1snl2lrrzdwgzi68agi3sdw84aslj04pzzxpm1mam9ic6dzhn3jf";
+    rev = "da4b415c6a2b7e77b7d9f00beca3e45230e603fb";
   };
-  isLibrary = false;
+
+  doHaddock = false;
+  isLibrary = true;
   isExecutable = true;
-  executableHaskellDepends = [
-    aeson ansi-terminal ansi-wl-pprint base binary bytestring
-    containers directory edit-distance filemanip filepath indents mtl
-    optparse-applicative parsec pretty process regex-applicative split
-    text
+  setupHaskellDepends = [ base Cabal directory filepath process ];
+  libraryHaskellDepends = [
+    ansi-terminal ansi-wl-pprint base binary bytestring containers
+    directory filepath free indents json mtl optparse-applicative
+    parsec process split text
   ];
+  executableHaskellDepends = [ base ];
   testHaskellDepends = [
-    aeson ansi-terminal ansi-wl-pprint base binary bytestring
-    containers directory edit-distance filemanip filepath HUnit indents
-    mtl optparse-applicative parsec pretty process QuickCheck
-    quickcheck-io regex-applicative split tasty tasty-golden
-    tasty-hunit tasty-quickcheck text union-find wl-pprint
+    base cmark containers HUnit mtl parsec QuickCheck quickcheck-io
+    split tasty tasty-golden tasty-hunit tasty-quickcheck text
   ];
   jailbreak = true;
   postInstall = ''
     ln -s $out/bin/elm-format-0.18 $out/bin/elm-format
   '';
+  postPatch = ''
+    sed -i "s|desc <-.*||" ./Setup.hs
+    sed -i "s|gitDescribe = .*|gitDescribe = \\\\\"da4b415c\\\\\"\"|" ./Setup.hs
+  '';
   homepage = http://elm-lang.org;
   description = "A source code formatter for Elm";
   license = stdenv.lib.licenses.bsd3;
diff --git a/pkgs/development/compilers/gcc/4.5/default.nix b/pkgs/development/compilers/gcc/4.5/default.nix
index 5bad03d30252..41d31888bde1 100644
--- a/pkgs/development/compilers/gcc/4.5/default.nix
+++ b/pkgs/development/compilers/gcc/4.5/default.nix
@@ -153,6 +153,7 @@ stdenv.mkDerivation ({
     # target libraries and tools.
     ++ optional langAda ../gnat-cflags.patch
     ++ optional langVhdl ./ghdl-ortho-cflags.patch
+    ++ [ ../struct-ucontext-4.5.patch ] # glibc-2.26
     ;
 
   postPatch =
diff --git a/pkgs/development/compilers/gcc/4.8/default.nix b/pkgs/development/compilers/gcc/4.8/default.nix
index 72e37f18a178..3031df56150b 100644
--- a/pkgs/development/compilers/gcc/4.8/default.nix
+++ b/pkgs/development/compilers/gcc/4.8/default.nix
@@ -78,7 +78,11 @@ let version = "4.8.5";
           sha256 = "01jd7pdarh54ki498g6sz64ijl9a1l5f9v8q2696aaxalvh2vwzl";
           excludes = [ "gcc/cp/ChangeLog" ];
         })]
-      ;
+      ++ [ # glibc-2.26
+        ../struct-ucontext-4.8.patch
+        ../sigsegv-not-declared.patch
+        ../res_state-not-declared.patch
+      ];
 
     javaEcj = fetchurl {
       # The `$(top_srcdir)/ecj.jar' file is automatically picked up at
diff --git a/pkgs/development/compilers/gcc/4.9/default.nix b/pkgs/development/compilers/gcc/4.9/default.nix
index d7684a61a2ac..4675787912e8 100644
--- a/pkgs/development/compilers/gcc/4.9/default.nix
+++ b/pkgs/development/compilers/gcc/4.9/default.nix
@@ -72,6 +72,7 @@ let version = "4.9.4";
       # target libraries and tools.
       ++ optional langAda ../gnat-cflags.patch
       ++ optional langFortran ../gfortran-driving.patch
+      ++ [ ../struct-ucontext.patch ../struct-sigaltstack-4.9.patch ] # glibc-2.26
       ;
 
     javaEcj = fetchurl {
diff --git a/pkgs/development/compilers/gcc/6/default.nix b/pkgs/development/compilers/gcc/6/default.nix
index 47cb93c19953..7d019c7fe848 100644
--- a/pkgs/development/compilers/gcc/6/default.nix
+++ b/pkgs/development/compilers/gcc/6/default.nix
@@ -72,7 +72,9 @@ let version = "6.4.0";
       # The GNAT Makefiles did not pay attention to CFLAGS_FOR_TARGET for its
       # target libraries and tools.
       ++ optional langAda ../gnat-cflags.patch
-      ++ optional langFortran ../gfortran-driving.patch;
+      ++ optional langFortran ../gfortran-driving.patch
+      ++ [ ../struct-ucontext.patch ../struct-sigaltstack.patch ] # glibc-2.26
+      ;
 
     javaEcj = fetchurl {
       # The `$(top_srcdir)/ecj.jar' file is automatically picked up at
diff --git a/pkgs/development/compilers/gcc/res_state-not-declared.patch b/pkgs/development/compilers/gcc/res_state-not-declared.patch
new file mode 100644
index 000000000000..e970487786d0
--- /dev/null
+++ b/pkgs/development/compilers/gcc/res_state-not-declared.patch
@@ -0,0 +1,13 @@
+diff --git a/libsanitizer/tsan/tsan_platform_linux.cc b/libsanitizer/tsan/tsan_platform_linux.cc
+index fe69430..49f5270 100644
+--- a/libsanitizer/tsan/tsan_platform_linux.cc
++++ b/libsanitizer/tsan/tsan_platform_linux.cc
+@@ -351,7 +351,7 @@ bool IsGlobalVar(uptr addr) {
+ // closes within glibc. The code is a pure hack.
+ int ExtractResolvFDs(void *state, int *fds, int nfd) {
+   int cnt = 0;
+-  __res_state *statp = (__res_state*)state;
++  struct __res_state *statp = (struct __res_state*)state;
+   for (int i = 0; i < MAXNS && cnt < nfd; i++) {
+     if (statp->_u._ext.nsaddrs[i] && statp->_u._ext.nssocks[i] != -1)
+       fds[cnt++] = statp->_u._ext.nssocks[i];
diff --git a/pkgs/development/compilers/gcc/sigsegv-not-declared.patch b/pkgs/development/compilers/gcc/sigsegv-not-declared.patch
new file mode 100644
index 000000000000..f9cfaec82026
--- /dev/null
+++ b/pkgs/development/compilers/gcc/sigsegv-not-declared.patch
@@ -0,0 +1,13 @@
+error: 'SIGSEGV' was not declared in this scope
+diff --git a/libsanitizer/asan/asan_linux.cc b/libsanitizer/asan/asan_linux.cc
+index 0692eb1..472f734 100644
+--- a/libsanitizer/asan/asan_linux.cc
++++ b/libsanitizer/asan/asan_linux.cc
+@@ -26,6 +26,7 @@
+ #include <sys/types.h>
+ #include <fcntl.h>
+ #include <pthread.h>
++#include <signal.h>
+ #include <stdio.h>
+ #include <unistd.h>
+ #include <unwind.h>
diff --git a/pkgs/development/compilers/gcc/struct-sigaltstack-4.9.patch b/pkgs/development/compilers/gcc/struct-sigaltstack-4.9.patch
new file mode 100644
index 000000000000..fc126b4813d6
--- /dev/null
+++ b/pkgs/development/compilers/gcc/struct-sigaltstack-4.9.patch
@@ -0,0 +1,78 @@
+hand-resolved trivial conflicts for 4.9 from the upstream patch
+72edc2c02f8b4768ad660f46a1c7e2400c0a8e06
+diff --git a/libsanitizer/sanitizer_common/sanitizer_linux.cc b/libsanitizer/sanitizer_common/sanitizer_linux.cc
+index 69c9c10..8e53673 100644
+--- a/libsanitizer/sanitizer_common/sanitizer_linux.cc
++++ b/libsanitizer/sanitizer_common/sanitizer_linux.cc
+@@ -599,8 +599,7 @@ uptr internal_prctl(int option, uptr arg2, uptr arg3, uptr arg4, uptr arg5) {
+   return internal_syscall(__NR_prctl, option, arg2, arg3, arg4, arg5);
+ }
+ 
+-uptr internal_sigaltstack(const struct sigaltstack *ss,
+-                         struct sigaltstack *oss) {
++uptr internal_sigaltstack(const void *ss, void *oss) {
+   return internal_syscall(__NR_sigaltstack, (uptr)ss, (uptr)oss);
+ }
+ 
+diff --git a/libsanitizer/sanitizer_common/sanitizer_linux.h b/libsanitizer/sanitizer_common/sanitizer_linux.h
+index 6422df1..8e111d1 100644
+--- a/libsanitizer/sanitizer_common/sanitizer_linux.h
++++ b/libsanitizer/sanitizer_common/sanitizer_linux.h
+@@ -18,7 +18,6 @@
+ #include "sanitizer_platform_limits_posix.h"
+ 
+ struct link_map;  // Opaque type returned by dlopen().
+-struct sigaltstack;
+ 
+ namespace __sanitizer {
+ // Dirent structure for getdents(). Note that this structure is different from
+@@ -28,8 +27,7 @@ struct linux_dirent;
+ // Syscall wrappers.
+ uptr internal_getdents(fd_t fd, struct linux_dirent *dirp, unsigned int count);
+ uptr internal_prctl(int option, uptr arg2, uptr arg3, uptr arg4, uptr arg5);
+-uptr internal_sigaltstack(const struct sigaltstack* ss,
+-                          struct sigaltstack* oss);
++uptr internal_sigaltstack(const void* ss, void* oss);
+ uptr internal_sigaction(int signum, const __sanitizer_kernel_sigaction_t *act,
+     __sanitizer_kernel_sigaction_t *oldact);
+ uptr internal_sigprocmask(int how, __sanitizer_kernel_sigset_t *set,
+diff --git a/libsanitizer/sanitizer_common/sanitizer_stoptheworld_linux_libcdep.cc b/libsanitizer/sanitizer_common/sanitizer_stoptheworld_linux_libcdep.cc
+index 891386dc..234e8c6 100644
+--- a/libsanitizer/sanitizer_common/sanitizer_stoptheworld_linux_libcdep.cc
++++ b/libsanitizer/sanitizer_common/sanitizer_stoptheworld_linux_libcdep.cc
+@@ -273,7 +273,7 @@ static int TracerThread(void* argument) {
+ 
+   // Alternate stack for signal handling.
+   InternalScopedBuffer<char> handler_stack_memory(kHandlerStackSize);
+-  struct sigaltstack handler_stack;
++  stack_t handler_stack;
+   internal_memset(&handler_stack, 0, sizeof(handler_stack));
+   handler_stack.ss_sp = handler_stack_memory.data();
+   handler_stack.ss_size = kHandlerStackSize;
+diff --git a/libsanitizer/tsan/tsan_platform_linux.cc b/libsanitizer/tsan/tsan_platform_linux.cc
+index 2ed5718..6f972ab 100644
+--- a/libsanitizer/tsan/tsan_platform_linux.cc
++++ b/libsanitizer/tsan/tsan_platform_linux.cc
+@@ -287,7 +287,7 @@ void InitializePlatform() {
+ int ExtractResolvFDs(void *state, int *fds, int nfd) {
+ #if SANITIZER_LINUX && !SANITIZER_ANDROID
+   int cnt = 0;
+-  __res_state *statp = (__res_state*)state;
++  struct __res_state *statp = (struct __res_state*)state;
+   for (int i = 0; i < MAXNS && cnt < nfd; i++) {
+     if (statp->_u._ext.nsaddrs[i] && statp->_u._ext.nssocks[i] != -1)
+       fds[cnt++] = statp->_u._ext.nssocks[i];
+
+error: 'SIGSEGV' was not declared in this scope
+diff --git a/libsanitizer/asan/asan_linux.cc b/libsanitizer/asan/asan_linux.cc
+index 0692eb1..472f734 100644
+--- a/libsanitizer/asan/asan_linux.cc
++++ b/libsanitizer/asan/asan_linux.cc
+@@ -26,6 +26,7 @@
+ #include <sys/types.h>
+ #include <fcntl.h>
+ #include <pthread.h>
++#include <signal.h>
+ #include <stdio.h>
+ #include <unistd.h>
+ #include <unwind.h>
diff --git a/pkgs/development/compilers/gcc/struct-sigaltstack.patch b/pkgs/development/compilers/gcc/struct-sigaltstack.patch
new file mode 100644
index 000000000000..6e1ddb252c24
--- /dev/null
+++ b/pkgs/development/compilers/gcc/struct-sigaltstack.patch
@@ -0,0 +1,87 @@
+From 72edc2c02f8b4768ad660f46a1c7e2400c0a8e06 Mon Sep 17 00:00:00 2001
+From: jakub <jakub@138bc75d-0d04-0410-961f-82ee72b054a4>
+Date: Mon, 17 Jul 2017 19:41:08 +0000
+Subject: [PATCH] 	Backported from mainline 	2017-07-14  Jakub
+ Jelinek  <jakub@redhat.com>
+
+	PR sanitizer/81066
+	* sanitizer_common/sanitizer_linux.h: Cherry-pick upstream r307969.
+	* sanitizer_common/sanitizer_linux.cc: Likewise.
+	* sanitizer_common/sanitizer_stoptheworld_linux_libcdep.cc: Likewise.
+	* tsan/tsan_platform_linux.cc: Likewise.
+
+
+git-svn-id: svn+ssh://gcc.gnu.org/svn/gcc/branches/gcc-7-branch@250287 138bc75d-0d04-0410-961f-82ee72b054a4
+---
+ libsanitizer/ChangeLog  (REMOVED)                             | 11 +++++++++++
+ libsanitizer/sanitizer_common/sanitizer_linux.cc              |  3 +--
+ libsanitizer/sanitizer_common/sanitizer_linux.h               |  4 +---
+ .../sanitizer_common/sanitizer_stoptheworld_linux_libcdep.cc  |  2 +-
+ libsanitizer/tsan/tsan_platform_linux.cc                      |  2 +-
+ 5 files changed, 15 insertions(+), 7 deletions(-)
+
+diff --git a/libsanitizer/sanitizer_common/sanitizer_linux.cc b/libsanitizer/sanitizer_common/sanitizer_linux.cc
+index 806fcd5..5b6f186 100644
+--- a/libsanitizer/sanitizer_common/sanitizer_linux.cc
++++ b/libsanitizer/sanitizer_common/sanitizer_linux.cc
+@@ -605,8 +605,7 @@ uptr internal_prctl(int option, uptr arg2, uptr arg3, uptr arg4, uptr arg5) {
+ }
+ #endif
+ 
+-uptr internal_sigaltstack(const struct sigaltstack *ss,
+-                         struct sigaltstack *oss) {
++uptr internal_sigaltstack(const void *ss, void *oss) {
+   return internal_syscall(SYSCALL(sigaltstack), (uptr)ss, (uptr)oss);
+ }
+ 
+diff --git a/libsanitizer/sanitizer_common/sanitizer_linux.h b/libsanitizer/sanitizer_common/sanitizer_linux.h
+index 895bfc1..a42df57 100644
+--- a/libsanitizer/sanitizer_common/sanitizer_linux.h
++++ b/libsanitizer/sanitizer_common/sanitizer_linux.h
+@@ -19,7 +19,6 @@
+ #include "sanitizer_platform_limits_posix.h"
+ 
+ struct link_map;  // Opaque type returned by dlopen().
+-struct sigaltstack;
+ 
+ namespace __sanitizer {
+ // Dirent structure for getdents(). Note that this structure is different from
+@@ -28,8 +27,7 @@ struct linux_dirent;
+ 
+ // Syscall wrappers.
+ uptr internal_getdents(fd_t fd, struct linux_dirent *dirp, unsigned int count);
+-uptr internal_sigaltstack(const struct sigaltstack* ss,
+-                          struct sigaltstack* oss);
++uptr internal_sigaltstack(const void* ss, void* oss);
+ uptr internal_sigprocmask(int how, __sanitizer_sigset_t *set,
+     __sanitizer_sigset_t *oldset);
+ 
+diff --git a/libsanitizer/sanitizer_common/sanitizer_stoptheworld_linux_libcdep.cc b/libsanitizer/sanitizer_common/sanitizer_stoptheworld_linux_libcdep.cc
+index 891386dc..234e8c6 100644
+--- a/libsanitizer/sanitizer_common/sanitizer_stoptheworld_linux_libcdep.cc
++++ b/libsanitizer/sanitizer_common/sanitizer_stoptheworld_linux_libcdep.cc
+@@ -273,7 +273,7 @@ static int TracerThread(void* argument) {
+ 
+   // Alternate stack for signal handling.
+   InternalScopedBuffer<char> handler_stack_memory(kHandlerStackSize);
+-  struct sigaltstack handler_stack;
++  stack_t handler_stack;
+   internal_memset(&handler_stack, 0, sizeof(handler_stack));
+   handler_stack.ss_sp = handler_stack_memory.data();
+   handler_stack.ss_size = kHandlerStackSize;
+diff --git a/libsanitizer/tsan/tsan_platform_linux.cc b/libsanitizer/tsan/tsan_platform_linux.cc
+index 2ed5718..6f972ab 100644
+--- a/libsanitizer/tsan/tsan_platform_linux.cc
++++ b/libsanitizer/tsan/tsan_platform_linux.cc
+@@ -287,7 +287,7 @@ void InitializePlatform() {
+ int ExtractResolvFDs(void *state, int *fds, int nfd) {
+ #if SANITIZER_LINUX && !SANITIZER_ANDROID
+   int cnt = 0;
+-  __res_state *statp = (__res_state*)state;
++  struct __res_state *statp = (struct __res_state*)state;
+   for (int i = 0; i < MAXNS && cnt < nfd; i++) {
+     if (statp->_u._ext.nsaddrs[i] && statp->_u._ext.nssocks[i] != -1)
+       fds[cnt++] = statp->_u._ext.nssocks[i];
+-- 
+2.9.3
+
diff --git a/pkgs/development/compilers/gcc/struct-ucontext-4.5.patch b/pkgs/development/compilers/gcc/struct-ucontext-4.5.patch
new file mode 100644
index 000000000000..a84e9ffe2681
--- /dev/null
+++ b/pkgs/development/compilers/gcc/struct-ucontext-4.5.patch
@@ -0,0 +1,107 @@
+Trivally backported the upstream commit
+b685411208e0aaa79190d54faf945763514706b8
+(different directory, some files not present, etc.)
+We only really use x86* from those, probably, so I didn't bother much.
+diff --git a/gcc/config/alpha/linux-unwind.h b/gcc/config/alpha/linux-unwind.h
+index bdbba4a..e84812e 100644
+--- a/gcc/config/alpha/linux-unwind.h
++++ b/gcc/config/alpha/linux-unwind.h
+@@ -51,7 +51,7 @@ alpha_fallback_frame_state (struct _Unwind_Context *context,
+     {
+       struct rt_sigframe {
+ 	siginfo_t info;
+-	struct ucontext uc;
++	ucontext_t uc;
+       } *rt_ = context->cfa;
+       sc = &rt_->uc.uc_mcontext;
+     }
+diff --git a/gcc/config/bfin/linux-unwind.h b/gcc/config/bfin/linux-unwind.h
+index 77b7c23..8bf5e82 100644
+--- a/gcc/config/bfin/linux-unwind.h
++++ b/gcc/config/bfin/linux-unwind.h
+@@ -52,7 +52,7 @@ bfin_fallback_frame_state (struct _Unwind_Context *context,
+ 	void *puc;
+ 	char retcode[8];
+ 	siginfo_t info;
+-	struct ucontext uc;
++	ucontext_t uc;
+       } *rt_ = context->cfa;
+ 
+       /* The void * cast is necessary to avoid an aliasing warning.
+diff --git a/gcc/config/i386/linux-unwind.h b/gcc/config/i386/linux-unwind.h
+index 540a0a2..29efbe3 100644
+--- a/gcc/config/i386/linux-unwind.h
++++ b/gcc/config/i386/linux-unwind.h
+@@ -58,7 +58,7 @@ x86_64_fallback_frame_state (struct _Unwind_Context *context,
+   if (*(unsigned char *)(pc+0) == 0x48
+       && *(unsigned long long *)(pc+1) == RT_SIGRETURN_SYSCALL)
+     {
+-      struct ucontext *uc_ = context->cfa;
++      ucontext_t *uc_ = context->cfa;
+       /* The void * cast is necessary to avoid an aliasing warning.
+          The aliasing warning is correct, but should not be a problem
+          because it does not alias anything.  */
+@@ -138,7 +138,7 @@ x86_fallback_frame_state (struct _Unwind_Context *context,
+ 	siginfo_t *pinfo;
+ 	void *puc;
+ 	siginfo_t info;
+-	struct ucontext uc;
++	ucontext_t uc;
+       } *rt_ = context->cfa;
+       /* The void * cast is necessary to avoid an aliasing warning.
+          The aliasing warning is correct, but should not be a problem
+diff --git a/gcc/config/m68k/linux-unwind.h b/gcc/config/m68k/linux-unwind.h
+index 75b7cf7..f964e24 100644
+--- a/gcc/config/m68k/linux-unwind.h
++++ b/gcc/config/m68k/linux-unwind.h
+@@ -33,7 +33,7 @@ see the files COPYING3 and COPYING.RUNTIME respectively.  If not, see
+ /* <sys/ucontext.h> is unfortunately broken right now.  */
+ struct uw_ucontext {
+ 	unsigned long	  uc_flags;
+-	struct ucontext  *uc_link;
++	ucontext_t	 *uc_link;
+ 	stack_t		  uc_stack;
+ 	mcontext_t	  uc_mcontext;
+ 	unsigned long	  uc_filler[80];
+diff --git a/gcc/config/pa/linux-unwind.h b/gcc/config/pa/linux-unwind.h
+index 9a2657f..e47493d 100644
+--- a/gcc/config/pa/linux-unwind.h
++++ b/gcc/config/pa/linux-unwind.h
+@@ -80,7 +80,7 @@ pa32_fallback_frame_state (struct _Unwind_Context *context,
+   struct sigcontext *sc;
+   struct rt_sigframe {
+     siginfo_t info;
+-    struct ucontext uc;
++    ucontext_t uc;
+   } *frame;
+ 
+   /* rt_sigreturn trampoline:
+diff --git a/gcc/config/sh/linux-unwind.h b/gcc/config/sh/linux-unwind.h
+index e389cac..0bf43ba 100644
+--- a/gcc/config/sh/linux-unwind.h
++++ b/gcc/config/sh/linux-unwind.h
+@@ -180,7 +180,7 @@ sh_fallback_frame_state (struct _Unwind_Context *context,
+     {
+       struct rt_sigframe {
+ 	siginfo_t info;
+-	struct ucontext uc;
++	ucontext_t uc;
+       } *rt_ = context->cfa;
+       /* The void * cast is necessary to avoid an aliasing warning.
+          The aliasing warning is correct, but should not be a problem
+diff --git a/gcc/config/xtensa/linux-unwind.h b/gcc/config/xtensa/linux-unwind.h
+index 9872492..586a9d4 100644
+--- a/gcc/config/xtensa/linux-unwind.h
++++ b/gcc/config/xtensa/linux-unwind.h
+@@ -67,7 +67,7 @@ xtensa_fallback_frame_state (struct _Unwind_Context *context,
+ 
+   struct rt_sigframe {
+     siginfo_t info;
+-    struct ucontext uc;
++    ucontext_t uc;
+   } *rt_;
+ 
+   /* movi a2, __NR_rt_sigreturn; syscall */
+-- 
+2.9.3
+
diff --git a/pkgs/development/compilers/gcc/struct-ucontext-4.8.patch b/pkgs/development/compilers/gcc/struct-ucontext-4.8.patch
new file mode 100644
index 000000000000..630ef6586e45
--- /dev/null
+++ b/pkgs/development/compilers/gcc/struct-ucontext-4.8.patch
@@ -0,0 +1,177 @@
+From b685411208e0aaa79190d54faf945763514706b8 Mon Sep 17 00:00:00 2001
+From: jsm28 <jsm28@138bc75d-0d04-0410-961f-82ee72b054a4>
+Date: Tue, 4 Jul 2017 10:23:57 +0000
+Subject: [PATCH] Use ucontext_t not struct ucontext in linux-unwind.h files.
+
+Current glibc no longer gives the ucontext_t type the tag struct
+ucontext, to conform with POSIX namespace rules.  This requires
+various linux-unwind.h files in libgcc, that were previously using
+struct ucontext, to be fixed to use ucontext_t instead.  This is
+similar to the removal of the struct siginfo tag from siginfo_t some
+years ago.
+
+This patch changes those files to use ucontext_t instead.  As the
+standard name that should be unconditionally safe, so this is not
+restricted to architectures supported by glibc, or conditioned on the
+glibc version.
+
+Tested compilation together with current glibc with glibc's
+build-many-glibcs.py.
+
+	* config/aarch64/linux-unwind.h (aarch64_fallback_frame_state),
+	config/alpha/linux-unwind.h (alpha_fallback_frame_state),
+	config/bfin/linux-unwind.h (bfin_fallback_frame_state),
+	config/i386/linux-unwind.h (x86_64_fallback_frame_state,
+	x86_fallback_frame_state), config/m68k/linux-unwind.h (struct
+	uw_ucontext), config/nios2/linux-unwind.h (struct nios2_ucontext),
+	config/pa/linux-unwind.h (pa32_fallback_frame_state),
+	config/sh/linux-unwind.h (sh_fallback_frame_state),
+	config/tilepro/linux-unwind.h (tile_fallback_frame_state),
+	config/xtensa/linux-unwind.h (xtensa_fallback_frame_state): Use
+	ucontext_t instead of struct ucontext.
+
+
+git-svn-id: svn+ssh://gcc.gnu.org/svn/gcc/branches/gcc-6-branch@249957 138bc75d-0d04-0410-961f-82ee72b054a4
+---
+ libgcc/ChangeLog     (REMOVED)       | 14 ++++++++++++++
+ libgcc/config/aarch64/linux-unwind.h |  2 +-
+ libgcc/config/alpha/linux-unwind.h   |  2 +-
+ libgcc/config/bfin/linux-unwind.h    |  2 +-
+ libgcc/config/i386/linux-unwind.h    |  4 ++--
+ libgcc/config/m68k/linux-unwind.h    |  2 +-
+ libgcc/config/nios2/linux-unwind.h   |  2 +-
+ libgcc/config/pa/linux-unwind.h      |  2 +-
+ libgcc/config/sh/linux-unwind.h      |  2 +-
+ libgcc/config/tilepro/linux-unwind.h |  2 +-
+ libgcc/config/xtensa/linux-unwind.h  |  2 +-
+ 11 files changed, 25 insertions(+), 11 deletions(-)
+
+diff --git a/libgcc/config/aarch64/linux-unwind.h b/libgcc/config/aarch64/linux-unwind.h
+index 4512efb..06de45a 100644
+--- a/libgcc/config/aarch64/linux-unwind.h
++++ b/libgcc/config/aarch64/linux-unwind.h
+@@ -52,7 +52,7 @@ aarch64_fallback_frame_state (struct _Unwind_Context *context,
+   struct rt_sigframe
+   {
+     siginfo_t info;
+-    struct ucontext uc;
++    ucontext_t uc;
+   };
+ 
+   struct rt_sigframe *rt_;
+diff --git a/libgcc/config/alpha/linux-unwind.h b/libgcc/config/alpha/linux-unwind.h
+index bdbba4a..e84812e 100644
+--- a/libgcc/config/alpha/linux-unwind.h
++++ b/libgcc/config/alpha/linux-unwind.h
+@@ -51,7 +51,7 @@ alpha_fallback_frame_state (struct _Unwind_Context *context,
+     {
+       struct rt_sigframe {
+ 	siginfo_t info;
+-	struct ucontext uc;
++	ucontext_t uc;
+       } *rt_ = context->cfa;
+       sc = &rt_->uc.uc_mcontext;
+     }
+diff --git a/libgcc/config/bfin/linux-unwind.h b/libgcc/config/bfin/linux-unwind.h
+index 77b7c23..8bf5e82 100644
+--- a/libgcc/config/bfin/linux-unwind.h
++++ b/libgcc/config/bfin/linux-unwind.h
+@@ -52,7 +52,7 @@ bfin_fallback_frame_state (struct _Unwind_Context *context,
+ 	void *puc;
+ 	char retcode[8];
+ 	siginfo_t info;
+-	struct ucontext uc;
++	ucontext_t uc;
+       } *rt_ = context->cfa;
+ 
+       /* The void * cast is necessary to avoid an aliasing warning.
+diff --git a/libgcc/config/i386/linux-unwind.h b/libgcc/config/i386/linux-unwind.h
+index 540a0a2..29efbe3 100644
+--- a/libgcc/config/i386/linux-unwind.h
++++ b/libgcc/config/i386/linux-unwind.h
+@@ -58,7 +58,7 @@ x86_64_fallback_frame_state (struct _Unwind_Context *context,
+   if (*(unsigned char *)(pc+0) == 0x48
+       && *(unsigned long long *)(pc+1) == RT_SIGRETURN_SYSCALL)
+     {
+-      struct ucontext *uc_ = context->cfa;
++      ucontext_t *uc_ = context->cfa;
+       /* The void * cast is necessary to avoid an aliasing warning.
+          The aliasing warning is correct, but should not be a problem
+          because it does not alias anything.  */
+@@ -138,7 +138,7 @@ x86_fallback_frame_state (struct _Unwind_Context *context,
+ 	siginfo_t *pinfo;
+ 	void *puc;
+ 	siginfo_t info;
+-	struct ucontext uc;
++	ucontext_t uc;
+       } *rt_ = context->cfa;
+       /* The void * cast is necessary to avoid an aliasing warning.
+          The aliasing warning is correct, but should not be a problem
+diff --git a/libgcc/config/m68k/linux-unwind.h b/libgcc/config/m68k/linux-unwind.h
+index 75b7cf7..f964e24 100644
+--- a/libgcc/config/m68k/linux-unwind.h
++++ b/libgcc/config/m68k/linux-unwind.h
+@@ -33,7 +33,7 @@ see the files COPYING3 and COPYING.RUNTIME respectively.  If not, see
+ /* <sys/ucontext.h> is unfortunately broken right now.  */
+ struct uw_ucontext {
+ 	unsigned long	  uc_flags;
+-	struct ucontext  *uc_link;
++	ucontext_t	 *uc_link;
+ 	stack_t		  uc_stack;
+ 	mcontext_t	  uc_mcontext;
+ 	unsigned long	  uc_filler[80];
+diff --git a/libgcc/config/pa/linux-unwind.h b/libgcc/config/pa/linux-unwind.h
+index 9a2657f..e47493d 100644
+--- a/libgcc/config/pa/linux-unwind.h
++++ b/libgcc/config/pa/linux-unwind.h
+@@ -80,7 +80,7 @@ pa32_fallback_frame_state (struct _Unwind_Context *context,
+   struct sigcontext *sc;
+   struct rt_sigframe {
+     siginfo_t info;
+-    struct ucontext uc;
++    ucontext_t uc;
+   } *frame;
+ 
+   /* rt_sigreturn trampoline:
+diff --git a/libgcc/config/sh/linux-unwind.h b/libgcc/config/sh/linux-unwind.h
+index e389cac..0bf43ba 100644
+--- a/libgcc/config/sh/linux-unwind.h
++++ b/libgcc/config/sh/linux-unwind.h
+@@ -180,7 +180,7 @@ sh_fallback_frame_state (struct _Unwind_Context *context,
+     {
+       struct rt_sigframe {
+ 	siginfo_t info;
+-	struct ucontext uc;
++	ucontext_t uc;
+       } *rt_ = context->cfa;
+       /* The void * cast is necessary to avoid an aliasing warning.
+          The aliasing warning is correct, but should not be a problem
+diff --git a/libgcc/config/tilepro/linux-unwind.h b/libgcc/config/tilepro/linux-unwind.h
+index 796e976..75f8890 100644
+--- a/libgcc/config/tilepro/linux-unwind.h
++++ b/libgcc/config/tilepro/linux-unwind.h
+@@ -61,7 +61,7 @@ tile_fallback_frame_state (struct _Unwind_Context *context,
+   struct rt_sigframe {
+     unsigned char save_area[C_ABI_SAVE_AREA_SIZE];
+     siginfo_t info;
+-    struct ucontext uc;
++    ucontext_t uc;
+   } *rt_;
+ 
+   /* Return if this is not a signal handler.  */
+diff --git a/libgcc/config/xtensa/linux-unwind.h b/libgcc/config/xtensa/linux-unwind.h
+index 9872492..586a9d4 100644
+--- a/libgcc/config/xtensa/linux-unwind.h
++++ b/libgcc/config/xtensa/linux-unwind.h
+@@ -67,7 +67,7 @@ xtensa_fallback_frame_state (struct _Unwind_Context *context,
+ 
+   struct rt_sigframe {
+     siginfo_t info;
+-    struct ucontext uc;
++    ucontext_t uc;
+   } *rt_;
+ 
+   /* movi a2, __NR_rt_sigreturn; syscall */
+-- 
+2.9.3
+
diff --git a/pkgs/development/compilers/gcc/struct-ucontext.patch b/pkgs/development/compilers/gcc/struct-ucontext.patch
new file mode 100644
index 000000000000..c7fb6d1f71cf
--- /dev/null
+++ b/pkgs/development/compilers/gcc/struct-ucontext.patch
@@ -0,0 +1,190 @@
+From b685411208e0aaa79190d54faf945763514706b8 Mon Sep 17 00:00:00 2001
+From: jsm28 <jsm28@138bc75d-0d04-0410-961f-82ee72b054a4>
+Date: Tue, 4 Jul 2017 10:23:57 +0000
+Subject: [PATCH] Use ucontext_t not struct ucontext in linux-unwind.h files.
+
+Current glibc no longer gives the ucontext_t type the tag struct
+ucontext, to conform with POSIX namespace rules.  This requires
+various linux-unwind.h files in libgcc, that were previously using
+struct ucontext, to be fixed to use ucontext_t instead.  This is
+similar to the removal of the struct siginfo tag from siginfo_t some
+years ago.
+
+This patch changes those files to use ucontext_t instead.  As the
+standard name that should be unconditionally safe, so this is not
+restricted to architectures supported by glibc, or conditioned on the
+glibc version.
+
+Tested compilation together with current glibc with glibc's
+build-many-glibcs.py.
+
+	* config/aarch64/linux-unwind.h (aarch64_fallback_frame_state),
+	config/alpha/linux-unwind.h (alpha_fallback_frame_state),
+	config/bfin/linux-unwind.h (bfin_fallback_frame_state),
+	config/i386/linux-unwind.h (x86_64_fallback_frame_state,
+	x86_fallback_frame_state), config/m68k/linux-unwind.h (struct
+	uw_ucontext), config/nios2/linux-unwind.h (struct nios2_ucontext),
+	config/pa/linux-unwind.h (pa32_fallback_frame_state),
+	config/sh/linux-unwind.h (sh_fallback_frame_state),
+	config/tilepro/linux-unwind.h (tile_fallback_frame_state),
+	config/xtensa/linux-unwind.h (xtensa_fallback_frame_state): Use
+	ucontext_t instead of struct ucontext.
+
+
+git-svn-id: svn+ssh://gcc.gnu.org/svn/gcc/branches/gcc-6-branch@249957 138bc75d-0d04-0410-961f-82ee72b054a4
+---
+ libgcc/ChangeLog     (REMOVED)       | 14 ++++++++++++++
+ libgcc/config/aarch64/linux-unwind.h |  2 +-
+ libgcc/config/alpha/linux-unwind.h   |  2 +-
+ libgcc/config/bfin/linux-unwind.h    |  2 +-
+ libgcc/config/i386/linux-unwind.h    |  4 ++--
+ libgcc/config/m68k/linux-unwind.h    |  2 +-
+ libgcc/config/nios2/linux-unwind.h   |  2 +-
+ libgcc/config/pa/linux-unwind.h      |  2 +-
+ libgcc/config/sh/linux-unwind.h      |  2 +-
+ libgcc/config/tilepro/linux-unwind.h |  2 +-
+ libgcc/config/xtensa/linux-unwind.h  |  2 +-
+ 11 files changed, 25 insertions(+), 11 deletions(-)
+
+diff --git a/libgcc/config/aarch64/linux-unwind.h b/libgcc/config/aarch64/linux-unwind.h
+index 4512efb..06de45a 100644
+--- a/libgcc/config/aarch64/linux-unwind.h
++++ b/libgcc/config/aarch64/linux-unwind.h
+@@ -52,7 +52,7 @@ aarch64_fallback_frame_state (struct _Unwind_Context *context,
+   struct rt_sigframe
+   {
+     siginfo_t info;
+-    struct ucontext uc;
++    ucontext_t uc;
+   };
+ 
+   struct rt_sigframe *rt_;
+diff --git a/libgcc/config/alpha/linux-unwind.h b/libgcc/config/alpha/linux-unwind.h
+index bdbba4a..e84812e 100644
+--- a/libgcc/config/alpha/linux-unwind.h
++++ b/libgcc/config/alpha/linux-unwind.h
+@@ -51,7 +51,7 @@ alpha_fallback_frame_state (struct _Unwind_Context *context,
+     {
+       struct rt_sigframe {
+ 	siginfo_t info;
+-	struct ucontext uc;
++	ucontext_t uc;
+       } *rt_ = context->cfa;
+       sc = &rt_->uc.uc_mcontext;
+     }
+diff --git a/libgcc/config/bfin/linux-unwind.h b/libgcc/config/bfin/linux-unwind.h
+index 77b7c23..8bf5e82 100644
+--- a/libgcc/config/bfin/linux-unwind.h
++++ b/libgcc/config/bfin/linux-unwind.h
+@@ -52,7 +52,7 @@ bfin_fallback_frame_state (struct _Unwind_Context *context,
+ 	void *puc;
+ 	char retcode[8];
+ 	siginfo_t info;
+-	struct ucontext uc;
++	ucontext_t uc;
+       } *rt_ = context->cfa;
+ 
+       /* The void * cast is necessary to avoid an aliasing warning.
+diff --git a/libgcc/config/i386/linux-unwind.h b/libgcc/config/i386/linux-unwind.h
+index 540a0a2..29efbe3 100644
+--- a/libgcc/config/i386/linux-unwind.h
++++ b/libgcc/config/i386/linux-unwind.h
+@@ -58,7 +58,7 @@ x86_64_fallback_frame_state (struct _Unwind_Context *context,
+   if (*(unsigned char *)(pc+0) == 0x48
+       && *(unsigned long long *)(pc+1) == RT_SIGRETURN_SYSCALL)
+     {
+-      struct ucontext *uc_ = context->cfa;
++      ucontext_t *uc_ = context->cfa;
+       /* The void * cast is necessary to avoid an aliasing warning.
+          The aliasing warning is correct, but should not be a problem
+          because it does not alias anything.  */
+@@ -138,7 +138,7 @@ x86_fallback_frame_state (struct _Unwind_Context *context,
+ 	siginfo_t *pinfo;
+ 	void *puc;
+ 	siginfo_t info;
+-	struct ucontext uc;
++	ucontext_t uc;
+       } *rt_ = context->cfa;
+       /* The void * cast is necessary to avoid an aliasing warning.
+          The aliasing warning is correct, but should not be a problem
+diff --git a/libgcc/config/m68k/linux-unwind.h b/libgcc/config/m68k/linux-unwind.h
+index 75b7cf7..f964e24 100644
+--- a/libgcc/config/m68k/linux-unwind.h
++++ b/libgcc/config/m68k/linux-unwind.h
+@@ -33,7 +33,7 @@ see the files COPYING3 and COPYING.RUNTIME respectively.  If not, see
+ /* <sys/ucontext.h> is unfortunately broken right now.  */
+ struct uw_ucontext {
+ 	unsigned long	  uc_flags;
+-	struct ucontext  *uc_link;
++	ucontext_t	 *uc_link;
+ 	stack_t		  uc_stack;
+ 	mcontext_t	  uc_mcontext;
+ 	unsigned long	  uc_filler[80];
+diff --git a/libgcc/config/nios2/linux-unwind.h b/libgcc/config/nios2/linux-unwind.h
+index 2304142..30f25ea 100644
+--- a/libgcc/config/nios2/linux-unwind.h
++++ b/libgcc/config/nios2/linux-unwind.h
+@@ -38,7 +38,7 @@ struct nios2_mcontext {
+ 
+ struct nios2_ucontext {
+   unsigned long uc_flags;
+-  struct ucontext *uc_link;
++  ucontext_t *uc_link;
+   stack_t uc_stack;
+   struct nios2_mcontext uc_mcontext;
+   sigset_t uc_sigmask;	/* mask last for extensibility */
+diff --git a/libgcc/config/pa/linux-unwind.h b/libgcc/config/pa/linux-unwind.h
+index 9a2657f..e47493d 100644
+--- a/libgcc/config/pa/linux-unwind.h
++++ b/libgcc/config/pa/linux-unwind.h
+@@ -80,7 +80,7 @@ pa32_fallback_frame_state (struct _Unwind_Context *context,
+   struct sigcontext *sc;
+   struct rt_sigframe {
+     siginfo_t info;
+-    struct ucontext uc;
++    ucontext_t uc;
+   } *frame;
+ 
+   /* rt_sigreturn trampoline:
+diff --git a/libgcc/config/sh/linux-unwind.h b/libgcc/config/sh/linux-unwind.h
+index e389cac..0bf43ba 100644
+--- a/libgcc/config/sh/linux-unwind.h
++++ b/libgcc/config/sh/linux-unwind.h
+@@ -180,7 +180,7 @@ sh_fallback_frame_state (struct _Unwind_Context *context,
+     {
+       struct rt_sigframe {
+ 	siginfo_t info;
+-	struct ucontext uc;
++	ucontext_t uc;
+       } *rt_ = context->cfa;
+       /* The void * cast is necessary to avoid an aliasing warning.
+          The aliasing warning is correct, but should not be a problem
+diff --git a/libgcc/config/tilepro/linux-unwind.h b/libgcc/config/tilepro/linux-unwind.h
+index 796e976..75f8890 100644
+--- a/libgcc/config/tilepro/linux-unwind.h
++++ b/libgcc/config/tilepro/linux-unwind.h
+@@ -61,7 +61,7 @@ tile_fallback_frame_state (struct _Unwind_Context *context,
+   struct rt_sigframe {
+     unsigned char save_area[C_ABI_SAVE_AREA_SIZE];
+     siginfo_t info;
+-    struct ucontext uc;
++    ucontext_t uc;
+   } *rt_;
+ 
+   /* Return if this is not a signal handler.  */
+diff --git a/libgcc/config/xtensa/linux-unwind.h b/libgcc/config/xtensa/linux-unwind.h
+index 9872492..586a9d4 100644
+--- a/libgcc/config/xtensa/linux-unwind.h
++++ b/libgcc/config/xtensa/linux-unwind.h
+@@ -67,7 +67,7 @@ xtensa_fallback_frame_state (struct _Unwind_Context *context,
+ 
+   struct rt_sigframe {
+     siginfo_t info;
+-    struct ucontext uc;
++    ucontext_t uc;
+   } *rt_;
+ 
+   /* movi a2, __NR_rt_sigreturn; syscall */
+-- 
+2.9.3
+
diff --git a/pkgs/development/compilers/llvm/3.7/llvm.nix b/pkgs/development/compilers/llvm/3.7/llvm.nix
index b600665cd8f6..54ab8c108773 100644
--- a/pkgs/development/compilers/llvm/3.7/llvm.nix
+++ b/pkgs/development/compilers/llvm/3.7/llvm.nix
@@ -1,5 +1,6 @@
 { stdenv
 , fetch
+, fetchpatch
 , perl
 , groff
 , cmake
@@ -45,6 +46,18 @@ in stdenv.mkDerivation rec {
   # those always succeed has the net effect of disabling all bindings.
   prePatch = ''
     substituteInPlace cmake/config-ix.cmake --replace "if(WIN32)" "if(1)"
+  ''
+  + stdenv.lib.optionalString (stdenv ? glibc) ''
+    (
+      cd projects/compiler-rt
+      patch -p1 < ${
+        fetchpatch {
+          name = "sigaltstack.patch"; # for glibc-2.26
+          url = https://github.com/llvm-mirror/compiler-rt/commit/8a5e425a68d.diff;
+          sha256 = "0h4y5vl74qaa7dl54b1fcyqalvlpd8zban2d1jxfkxpzyi7m8ifi";
+        }
+      }
+    )
   '';
 
   # hacky fix: created binaries need to be run before installation
diff --git a/pkgs/development/compilers/llvm/3.8/llvm.nix b/pkgs/development/compilers/llvm/3.8/llvm.nix
index f8b8948e749e..a0fbdf2b706a 100644
--- a/pkgs/development/compilers/llvm/3.8/llvm.nix
+++ b/pkgs/development/compilers/llvm/3.8/llvm.nix
@@ -1,5 +1,6 @@
 { stdenv
 , fetch
+, fetchpatch
 , perl
 , groff
 , cmake
@@ -49,6 +50,18 @@ in stdenv.mkDerivation rec {
     substituteInPlace CMakeLists.txt \
       --replace 'set(CMAKE_INSTALL_NAME_DIR "@rpath")' "set(CMAKE_INSTALL_NAME_DIR "$out/lib")" \
       --replace 'set(CMAKE_INSTALL_RPATH "@executable_path/../lib")' ""
+  ''
+  + stdenv.lib.optionalString (stdenv ? glibc) ''
+    (
+      cd projects/compiler-rt
+      patch -p1 < ${
+        fetchpatch {
+          name = "sigaltstack.patch"; # for glibc-2.26
+          url = https://github.com/llvm-mirror/compiler-rt/commit/8a5e425a68d.diff;
+          sha256 = "0h4y5vl74qaa7dl54b1fcyqalvlpd8zban2d1jxfkxpzyi7m8ifi";
+        }
+      }
+    )
   '';
 
   # hacky fix: created binaries need to be run before installation
diff --git a/pkgs/development/compilers/llvm/3.9/llvm.nix b/pkgs/development/compilers/llvm/3.9/llvm.nix
index 809c49ac24a2..495f95a5bbdb 100644
--- a/pkgs/development/compilers/llvm/3.9/llvm.nix
+++ b/pkgs/development/compilers/llvm/3.9/llvm.nix
@@ -91,6 +91,20 @@ in stdenv.mkDerivation rec {
   + stdenv.lib.optionalString (enableSharedLibraries) ''
     substitute '${./llvm-outputs.patch}' ./llvm-outputs.patch --subst-var lib
     patch -p1 < ./llvm-outputs.patch
+  ''
+  + stdenv.lib.optionalString (stdenv ? glibc) ''
+    (
+      cd projects/compiler-rt
+      patch -p1 < ${
+        fetchpatch {
+          name = "sigaltstack.patch"; # for glibc-2.26
+          url = https://github.com/llvm-mirror/compiler-rt/commit/8a5e425a68d.diff;
+          sha256 = "0h4y5vl74qaa7dl54b1fcyqalvlpd8zban2d1jxfkxpzyi7m8ifi";
+        }
+      }
+      substituteInPlace lib/esan/esan_sideline_linux.cpp \
+        --replace 'struct sigaltstack' 'stack_t'
+    )
   '';
 
   # hacky fix: created binaries need to be run before installation
diff --git a/pkgs/development/compilers/llvm/4/llvm.nix b/pkgs/development/compilers/llvm/4/llvm.nix
index e90603ffefae..332fee8529ba 100644
--- a/pkgs/development/compilers/llvm/4/llvm.nix
+++ b/pkgs/development/compilers/llvm/4/llvm.nix
@@ -67,6 +67,20 @@ in stdenv.mkDerivation rec {
   + stdenv.lib.optionalString (enableSharedLibraries) ''
     substitute '${./llvm-outputs.patch}' ./llvm-outputs.patch --subst-var lib
     patch -p1 < ./llvm-outputs.patch
+  ''
+  + stdenv.lib.optionalString (stdenv ? glibc) ''
+    (
+      cd projects/compiler-rt
+      patch -p1 < ${
+        fetchpatch {
+          name = "sigaltstack.patch"; # for glibc-2.26
+          url = https://github.com/llvm-mirror/compiler-rt/commit/8a5e425a68d.diff;
+          sha256 = "0h4y5vl74qaa7dl54b1fcyqalvlpd8zban2d1jxfkxpzyi7m8ifi";
+        }
+      }
+      substituteInPlace lib/esan/esan_sideline_linux.cpp \
+        --replace 'struct sigaltstack' 'stack_t'
+    )
   '';
 
   # hacky fix: created binaries need to be run before installation
diff --git a/pkgs/development/compilers/ponyc/pony-stable.nix b/pkgs/development/compilers/ponyc/pony-stable.nix
index 21488361f4a9..0e382efd7079 100644
--- a/pkgs/development/compilers/ponyc/pony-stable.nix
+++ b/pkgs/development/compilers/ponyc/pony-stable.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "pony-stable-${version}";
-  version = "0.0.1";
+  version = "0.1.1";
 
   src = fetchFromGitHub {
     owner = "ponylang";
     repo = "pony-stable";
     rev = version;
-    sha256 = "0q05135mnzzdwam7cnmxq34clqhmc83yp2gi63sx20c74rcw3p6v";
+    sha256 = "0v4039iijjv93m89s3dsikcbp1y0hml6g1agj44s6w2g4m8kiiw3";
   };
 
   buildInputs = [ ponyc ];
diff --git a/pkgs/development/interpreters/php/default.nix b/pkgs/development/interpreters/php/default.nix
index 0ef1c492d588..7be3cbd5effa 100644
--- a/pkgs/development/interpreters/php/default.nix
+++ b/pkgs/development/interpreters/php/default.nix
@@ -22,10 +22,12 @@ let
 
       enableParallelBuilding = true;
 
-  nativeBuildInputs = [ pkgconfig ];
+      nativeBuildInputs = [ pkgconfig ];
       buildInputs = [ flex bison ]
         ++ lib.optional stdenv.isLinux systemd;
 
+      CXXFLAGS = lib.optional stdenv.cc.isClang "-std=c++11";
+
       flags = {
 
         # much left to do here...
diff --git a/pkgs/development/libraries/SDL2/default.nix b/pkgs/development/libraries/SDL2/default.nix
index 3216a130f671..d2ffa45626be 100644
--- a/pkgs/development/libraries/SDL2/default.nix
+++ b/pkgs/development/libraries/SDL2/default.nix
@@ -2,6 +2,7 @@
 , openglSupport ? false, mesa_noglu
 , alsaSupport ? true, alsaLib
 , x11Support ? true, libICE, libXi, libXScrnSaver, libXcursor, libXinerama, libXext, libXxf86vm, libXrandr
+, waylandSupport ? true, wayland, wayland-protocols, libxkbcommon
 , dbusSupport ? false, dbus
 , udevSupport ? false, udev
 , ibusSupport ? false, ibus
@@ -17,7 +18,7 @@ assert openglSupport -> (stdenv.isDarwin || mesa_noglu != null && x11Support);
 
 let
   configureFlagsFun = attrs: [
-      "--disable-oss" "--disable-x11-shared"
+      "--disable-oss" "--disable-x11-shared" "--disable-wayland-shared"
       "--disable-pulseaudio-shared" "--disable-alsa-shared"
     ] ++ lib.optional alsaSupport "--with-alsa-prefix=${attrs.alsaLib.out}/lib"
       ++ lib.optional (!x11Support) "--without-x";
@@ -39,6 +40,7 @@ stdenv.mkDerivation rec {
 
   # Since `libpulse*.la' contain `-lgdbm', PulseAudio must be propagated.
   propagatedBuildInputs = lib.optionals x11Support [ libICE libXi libXScrnSaver libXcursor libXinerama libXext libXrandr libXxf86vm ] ++
+    lib.optionals waylandSupport [ wayland wayland-protocols libxkbcommon ] ++
     lib.optional pulseaudioSupport libpulseaudio;
 
   buildInputs = [ audiofile ] ++
diff --git a/pkgs/development/libraries/expat/default.nix b/pkgs/development/libraries/expat/default.nix
index 77b826acc032..01f3c11ac737 100644
--- a/pkgs/development/libraries/expat/default.nix
+++ b/pkgs/development/libraries/expat/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchpatch, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "expat-2.2.4";
+  name = "expat-2.2.5";
 
   src = fetchurl {
     url = "mirror://sourceforge/expat/${name}.tar.bz2";
-    sha256 = "17h1fb9zvqvf0sr78j211bngc6jpql5wzar8fg9b52jzjvdqbb83";
+    sha256 = "1xpd78sp7m34jqrw5x13bz7kgz0n6aj15wn4zj4gfx3ypbpk5p6r";
   };
 
   outputs = [ "out" "dev" ]; # TODO: fix referrers
diff --git a/pkgs/development/libraries/git2/0.25.nix b/pkgs/development/libraries/git2/0.25.nix
new file mode 100644
index 000000000000..679049a0e13e
--- /dev/null
+++ b/pkgs/development/libraries/git2/0.25.nix
@@ -0,0 +1,33 @@
+{ stdenv, fetchFromGitHub, cmake, pkgconfig, python
+, zlib, libssh2, openssl, http-parser, curl, libiconv
+}:
+
+stdenv.mkDerivation (rec {
+  version = "0.25.1";
+  name = "libgit2-${version}";
+
+  src = fetchFromGitHub {
+    owner = "libgit2";
+    repo = "libgit2";
+    rev = "v${version}";
+    sha256 = "1jhikg0gqpdzfzhgv44ybdpm24lvgkc7ki4306lc5lvmj1s2nylj";
+  };
+
+  cmakeFlags = "-DTHREADSAFE=ON";
+
+  nativeBuildInputs = [ cmake python pkgconfig ];
+
+  buildInputs = [ zlib libssh2 openssl http-parser curl ];
+
+  enableParallelBuilding = true;
+
+  meta = {
+    description = "The Git linkable library";
+    homepage = https://libgit2.github.com/;
+    license = stdenv.lib.licenses.gpl2;
+    platforms = with stdenv.lib.platforms; all;
+  };
+} // stdenv.lib.optionalAttrs (!stdenv.isLinux) {
+  NIX_LDFLAGS = "-liconv";
+  propagatedBuildInputs = [ libiconv ];
+})
diff --git a/pkgs/development/libraries/git2/default.nix b/pkgs/development/libraries/git2/default.nix
index 0d53d00737ba..42cf181f84f1 100644
--- a/pkgs/development/libraries/git2/default.nix
+++ b/pkgs/development/libraries/git2/default.nix
@@ -1,35 +1,30 @@
-{ stdenv, fetchurl, pkgconfig, cmake, zlib, python, libssh2, openssl, curl, http-parser, libiconv }:
+{ stdenv, fetchFromGitHub, pkgconfig, cmake, zlib, python, libssh2, openssl, curl, http-parser, libiconv }:
 
 stdenv.mkDerivation (rec {
-  version = "0.25.1";
   name = "libgit2-${version}";
+  version = "0.26.0";
+  # keep the version in sync with pythonPackages.pygit2 and gnome3.libgit2-glib
 
-  src = fetchurl {
-    name = "${name}.tar.gz";
-    url = "https://github.com/libgit2/libgit2/tarball/v${version}";
-    sha256 = "100bah8picqjzyhpw4wd7z5vyidcb8aggin50bhbpn607h8n8bml";
+  src = fetchFromGitHub {
+    owner = "libgit2";
+    repo = "libgit2";
+    rev = "v${version}";
+    sha256 = "0zrrmfkfhd2xb4879z5khjb6xsdklrm01f1lscrs2ks68v25fk78";
   };
 
-  # TODO: `cargo` (rust's package manager) surfaced a serious bug in
-  # libgit2 when the `Security.framework` transport is used on Darwin.
-  # The upstream issue is tracked at
-  # https://github.com/libgit2/libgit2/issues/3885 - feel free to
-  # remove this patch as soon as it's resolved (i.E. when cargo is
-  # working fine without this patch)
-  patches = stdenv.lib.optionals stdenv.isDarwin [
-    ./disable-security.framework.patch
-  ];
-
   cmakeFlags = "-DTHREADSAFE=ON";
 
   nativeBuildInputs = [ cmake python pkgconfig ];
+
   buildInputs = [ zlib libssh2 openssl http-parser curl ];
 
-  meta = {
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
     description = "The Git linkable library";
     homepage = https://libgit2.github.com/;
-    license = stdenv.lib.licenses.gpl2;
-    platforms = with stdenv.lib.platforms; all;
+    license = licenses.gpl2;
+    platforms = with platforms; all;
   };
 } // stdenv.lib.optionalAttrs (!stdenv.isLinux) {
   NIX_LDFLAGS = "-liconv";
diff --git a/pkgs/development/libraries/git2/disable-security.framework.patch b/pkgs/development/libraries/git2/disable-security.framework.patch
deleted file mode 100644
index ce6a008b1c4c..000000000000
--- a/pkgs/development/libraries/git2/disable-security.framework.patch
+++ /dev/null
@@ -1,58 +0,0 @@
-From fbc2ea65406236a740b8734dd41dc5ddbc24f8c9 Mon Sep 17 00:00:00 2001
-From: mulrich <mulrich@entwicklerheld.local>
-Date: Mon, 8 Aug 2016 15:36:07 +0200
-Subject: [PATCH] disable security.framework
-
----
- CMakeLists.txt    | 7 +++----
- src/curl_stream.c | 9 ++++++++-
- 2 files changed, 11 insertions(+), 5 deletions(-)
-
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 93a9e47..331e148 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -49,7 +49,8 @@ ENDIF()
- 
- IF(${CMAKE_SYSTEM_NAME} MATCHES "Darwin")
- 	SET( USE_ICONV ON )
--	FIND_PACKAGE(Security)
-+	# FIND_PACKAGE(Security)
-+  SET(SECURITY_FOUND "NO")
- 	FIND_PACKAGE(CoreFoundation REQUIRED)
- ENDIF()
- 
-@@ -87,9 +88,7 @@ IF(MSVC)
- 	OPTION(MSVC_CRTDBG "Enable CRTDBG memory leak reporting" OFF)
- ENDIF()
- 
--IF (NOT ${CMAKE_SYSTEM_NAME} MATCHES "Darwin")
--	OPTION( USE_OPENSSL                     "Link with and use openssl library"             ON )
--ENDIF()
-+OPTION( USE_OPENSSL                     "Link with and use openssl library"             ON )
- 
- CHECK_STRUCT_HAS_MEMBER ("struct stat" st_mtim "sys/types.h;sys/stat.h"
- 	HAVE_STRUCT_STAT_ST_MTIM LANGUAGE C)
-diff --git a/src/curl_stream.c b/src/curl_stream.c
-index 98de187..a8a9f4c 100644
---- a/src/curl_stream.c
-+++ b/src/curl_stream.c
-@@ -309,7 +309,14 @@ int git_curl_stream_new(git_stream **out, const char *host, const char *port)
- 	curl_easy_setopt(handle, CURLOPT_HTTPPROXYTUNNEL, 1);
- 	curl_easy_setopt(handle, CURLOPT_PROXYAUTH, CURLAUTH_ANY);
- 
--	/* curl_easy_setopt(handle, CURLOPT_VERBOSE, 1); */
-+  const char* cainfo = getenv("SSL_CERT_FILE");
-+  if(cainfo != NULL) {
-+    curl_easy_setopt(handle, CURLOPT_CAINFO, cainfo);
-+  }
-+
-+  /*
-+	curl_easy_setopt(handle, CURLOPT_VERBOSE, 1);
-+  */
- 
- 	st->parent.version = GIT_STREAM_VERSION;
- 	st->parent.encrypted = 0; /* we don't encrypt ourselves */
--- 
-2.3.8 (Apple Git-58)
-
diff --git a/pkgs/development/libraries/glibc/2.25-49.patch.gz b/pkgs/development/libraries/glibc/2.25-49.patch.gz
deleted file mode 100644
index 6796347e3795..000000000000
Binary files a/pkgs/development/libraries/glibc/2.25-49.patch.gz and /dev/null differ
diff --git a/pkgs/development/libraries/glibc/2.26-75.patch.gz b/pkgs/development/libraries/glibc/2.26-75.patch.gz
new file mode 100644
index 000000000000..e2a8867e4fff
Binary files /dev/null and b/pkgs/development/libraries/glibc/2.26-75.patch.gz differ
diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index 5c7bbb32c330..7894d75fbe67 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -19,9 +19,9 @@
 } @ args:
 
 let
-  version = "2.25";
-  patchSuffix = "-49";
-  sha256 = "067bd9bb3390e79aa45911537d13c3721f1d9d3769931a30c2681bfee66f23a0";
+  version = "2.26";
+  patchSuffix = "-75";
+  sha256 = "1ggnj1hzjym7sn93rbwydcqd562q73lsb7g7kd199g6j9j9hlkp5";
   cross = if buildPlatform != hostPlatform then hostPlatform else null;
 in
 
@@ -46,7 +46,7 @@ stdenv.mkDerivation ({
           glibc-2.25-49-gbc5ace67fe
           $ git show --reverse glibc-2.25..release/2.25/master | gzip -n -9 --rsyncable - > 2.25-49.patch.gz
       */
-      ./2.25-49.patch.gz
+      ./2.26-75.patch.gz
 
       /* Have rpcgen(1) look for cpp(1) in $PATH.  */
       ./rpcgen-path.patch
@@ -100,15 +100,12 @@ stdenv.mkDerivation ({
       (if profilingLibraries
        then "--enable-profile"
        else "--disable-profile")
-    ] ++ lib.optionals (cross == null && withLinuxHeaders) [
-      "--enable-kernel=2.6.32"
+    ] ++ lib.optionals withLinuxHeaders [
+      "--enable-kernel=3.2.0" # can't get below with glibc >= 2.26
     ] ++ lib.optionals (cross != null) [
       (if cross.withTLS then "--with-tls" else "--without-tls")
       (if cross ? float && cross.float == "soft" then "--without-fp" else "--with-fp")
-    ] ++ lib.optionals (cross != null
-          && cross.platform ? kernelMajor
-          && cross.platform.kernelMajor == "2.6") [
-      "--enable-kernel=2.6.0"
+    ] ++ lib.optionals (cross != null) [
       "--with-__thread"
     ] ++ lib.optionals (cross == null && stdenv.isArm) [
       "--host=arm-linux-gnueabi"
diff --git a/pkgs/development/libraries/icu/base.nix b/pkgs/development/libraries/icu/base.nix
index 78e0c5740446..8a7cf8365a5b 100644
--- a/pkgs/development/libraries/icu/base.nix
+++ b/pkgs/development/libraries/icu/base.nix
@@ -25,6 +25,11 @@ stdenv.mkDerivation {
     echo Source root reset to ''${sourceRoot}
   '';
 
+  # https://sourceware.org/glibc/wiki/Release/2.26#Removal_of_.27xlocale.h.27
+  postPatch = if stdenv ? glibc
+    then "substituteInPlace i18n/digitlst.cpp --replace '<xlocale.h>' '<locale.h>'"
+    else null; # won't find locale_t on darwin
+
   inherit patchFlags patches;
 
   preConfigure = ''
diff --git a/pkgs/development/libraries/iniparser/default.nix b/pkgs/development/libraries/iniparser/default.nix
index a09bcd6f039c..e586b30393e6 100644
--- a/pkgs/development/libraries/iniparser/default.nix
+++ b/pkgs/development/libraries/iniparser/default.nix
@@ -1,17 +1,14 @@
 { stdenv, fetchFromGitHub }:
 
-let
-  inherit (stdenv.lib) optional;
-
-in stdenv.mkDerivation rec {
+stdenv.mkDerivation rec {
   name = "iniparser-${version}";
-  version = "4.0";
+  version = "4.1";
 
   src = fetchFromGitHub {
     owner = "ndevilla";
     repo = "iniparser";
     rev = "v${version}";
-    sha256 = "0339qa0qxa5z02xjcs5my8v91v0r9jm4piswrl1sa29kwyxgv5nb";
+    sha256 = "0dhab6pad6wh816lr7r3jb6z273njlgw2vpw8kcfnmi7ijaqhnr5";
   };
 
   patches = ./no-usr.patch;
@@ -19,9 +16,6 @@ in stdenv.mkDerivation rec {
   doCheck = true;
   preCheck = "patchShebangs test/make-tests.sh";
 
-  # TODO: Build dylib on Darwin
-  buildFlags = (if stdenv.isDarwin then [ "libiniparser.a" ] else [ "libiniparser.so" ]) ++ [ "CC=cc" ];
-
   installPhase = ''
     mkdir -p $out/lib
 
@@ -34,17 +28,16 @@ in stdenv.mkDerivation rec {
     done;
     cp -r html $out/share/doc/${name}
 
-  '' + (if stdenv.isDarwin then ''
     cp libiniparser.a $out/lib
-  '' else ''
-    cp libiniparser.so.0 $out/lib
-    ln -s libiniparser.so.0 $out/lib/libiniparser.so
-  '');
+    cp libiniparser.so.1 $out/lib
+    ln -s libiniparser.so.1 $out/lib/libiniparser.so
+  '';
 
-  meta = {
+  meta = with stdenv.lib; {
     inherit (src.meta) homepage;
     description = "Free standalone ini file parsing library";
-    license = stdenv.lib.licenses.mit;
-    platforms = stdenv.lib.platforms.unix;
+    license = licenses.mit;
+    platforms = platforms.unix;
+    maintainers = [ maintainers.primeos ];
   };
 }
diff --git a/pkgs/development/libraries/libnsl/default.nix b/pkgs/development/libraries/libnsl/default.nix
new file mode 100644
index 000000000000..d4af280c3cd8
--- /dev/null
+++ b/pkgs/development/libraries/libnsl/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, fetchFromGitHub, autoreconfHook, libtirpc, pkgconfig }:
+
+stdenv.mkDerivation rec {
+  name = "libnsl-${version}";
+  version = "1.1.0";
+
+  src = fetchFromGitHub {
+    owner = "thkukuk";
+    repo = "libnsl";
+    rev = "libnsl-${version}";
+    sha256 = "0h8br0gmgw3fp5fmy6bfbj1qlk9hry1ssg25ssjgxbd8spczpscs";
+  };
+
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  buildInputs = [ libtirpc ];
+
+  meta = with stdenv.lib; {
+    description = "Client interface library for NIS(YP) and NIS+";
+    homepage = https://github.com/thkukuk/libnsl;
+    license = licenses.lgpl21;
+    maintainers = [ maintainers.dezgeg ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/development/libraries/live555/default.nix b/pkgs/development/libraries/live555/default.nix
index de4d295ebe3b..e0f84f5080df 100644
--- a/pkgs/development/libraries/live555/default.nix
+++ b/pkgs/development/libraries/live555/default.nix
@@ -12,7 +12,12 @@ stdenv.mkDerivation {
     sha256 = "02z2f8z5cy0ajnh9pgar40lsxdknfw5cbyw52138hxnpr6adrvak";
   };
 
-  postPatch = "sed 's,/bin/rm,rm,g' -i genMakefiles";
+  postPatch = "sed 's,/bin/rm,rm,g' -i genMakefiles"
+  + stdenv.lib.optionalString (stdenv ? glibc) ''
+
+    substituteInPlace liveMedia/include/Locale.hh \
+      --replace '<xlocale.h>' '<locale.h>'
+  '';
 
   configurePhase = ''
     sed \
diff --git a/pkgs/development/libraries/ti-rpc/default.nix b/pkgs/development/libraries/ti-rpc/default.nix
index d66b5d82ff52..0d6674cce814 100644
--- a/pkgs/development/libraries/ti-rpc/default.nix
+++ b/pkgs/development/libraries/ti-rpc/default.nix
@@ -8,6 +8,10 @@ stdenv.mkDerivation rec {
     sha256 = "1xchbxy0xql7yl7z4n1icj8r7dmly46i22fvm00vdjq64zlmqg3j";
   };
 
+  postPatch = ''
+    sed '1i#include <stdint.h>' -i src/xdr_sizeof.c
+  '';
+
   nativeBuildInputs = [ autoreconfHook ];
   propagatedBuildInputs = [ libkrb5 ];
 
diff --git a/pkgs/development/libraries/vigra/default.nix b/pkgs/development/libraries/vigra/default.nix
index 2910e8b7dbbc..324d977c72e5 100644
--- a/pkgs/development/libraries/vigra/default.nix
+++ b/pkgs/development/libraries/vigra/default.nix
@@ -24,6 +24,8 @@ in stdenv.mkDerivation rec {
             ++ stdenv.lib.optionals (stdenv.system == "x86_64-linux")
                   [ "-DCMAKE_CXX_FLAGS=-fPIC" "-DCMAKE_C_FLAGS=-fPIC" ];
 
+  enableParallelBuilding = true;
+
   meta = with stdenv.lib; {
     description = "Novel computer vision C++ library with customizable algorithms and data structures";
     homepage = http://hci.iwr.uni-heidelberg.de/vigra;
diff --git a/pkgs/development/ocaml-modules/zed/default.nix b/pkgs/development/ocaml-modules/zed/default.nix
index 85977792b4d3..1ddb6d180405 100644
--- a/pkgs/development/ocaml-modules/zed/default.nix
+++ b/pkgs/development/ocaml-modules/zed/default.nix
@@ -3,8 +3,8 @@
 let param =
   if stdenv.lib.versionAtLeast ocaml.version "4.02" then
   {
-    version = "1.5";
-    sha256 = "1nq884cxl1k4daa549bk7bxarwivbpp51k4blbiwyxwfhs29xgfr";
+    version = "1.6";
+    sha256 = "00hhxcjf3bj3w2qm8nzs9x6vrqkadf4i0277s5whzy2rmiknj63v";
     buildInputs = [ jbuilder ];
     extra = {
      buildPhase = "jbuilder build -p zed";
diff --git a/pkgs/development/python-modules/betamax-matchers/default.nix b/pkgs/development/python-modules/betamax-matchers/default.nix
new file mode 100644
index 000000000000..762154ac45d2
--- /dev/null
+++ b/pkgs/development/python-modules/betamax-matchers/default.nix
@@ -0,0 +1,21 @@
+{ stdenv, buildPythonPackage, fetchPypi
+, betamax, requests_toolbelt }:
+
+buildPythonPackage rec {
+  pname = "betamax-matchers";
+  version = "0.4.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "07qpwjyq2i2aqhz5iwghnj4pqr2ys5n45v1vmpcfx9r5mhwrsq43";
+  };
+
+  buildInputs = [ betamax requests_toolbelt ];
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/sigmavirus24/betamax_matchers;
+    description = "A group of experimental matchers for Betamax";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ pSub ];
+  };
+}
diff --git a/pkgs/development/python-modules/betamax-serializers/default.nix b/pkgs/development/python-modules/betamax-serializers/default.nix
new file mode 100644
index 000000000000..2ad23f1f9e65
--- /dev/null
+++ b/pkgs/development/python-modules/betamax-serializers/default.nix
@@ -0,0 +1,20 @@
+{ stdenv, buildPythonPackage, fetchPypi
+, betamax, pyyaml }:
+
+buildPythonPackage rec {
+  pname = "betamax-serializers";
+  version = "0.2.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1yqzwx204m4lxlpg04cwv6iwzmcpdzr19wvj97vvxchp0g4qg83d";
+  };
+
+  buildInputs = [ betamax pyyaml ];
+
+  meta = with stdenv.lib; {
+    homepage = https://gitlab.com/betamax/serializers;
+    description = "A set of third-party serializers for Betamax";
+    license = licenses.asl20;
+  };
+}
diff --git a/pkgs/development/python-modules/devpi-common/default.nix b/pkgs/development/python-modules/devpi-common/default.nix
index 082f2baeceb8..67f8debc43a0 100644
--- a/pkgs/development/python-modules/devpi-common/default.nix
+++ b/pkgs/development/python-modules/devpi-common/default.nix
@@ -14,6 +14,8 @@ with pythonPackages;buildPythonPackage rec {
   checkInputs = [ pytest ];
 
   checkPhase = ''
+    # Don't know why this test is failing!
+    substituteInPlace testing/test_request.py --replace "test_env" "noop_test_env"
     py.test
   '';
 
diff --git a/pkgs/development/python-modules/fastimport/default.nix b/pkgs/development/python-modules/fastimport/default.nix
new file mode 100644
index 000000000000..ee1048ec5fac
--- /dev/null
+++ b/pkgs/development/python-modules/fastimport/default.nix
@@ -0,0 +1,22 @@
+{ stdenv, buildPythonPackage, python, fetchurl }:
+
+buildPythonPackage rec {
+  name = "fastimport-${version}";
+  version = "0.9.6";
+
+  src = fetchurl {
+    url = "mirror://pypi/f/fastimport/${name}.tar.gz";
+    sha256 = "1aqjsin4rmqm7ln4j0p73fzxifws6c6ikgyhav7r137m2ixsxl43";
+  };
+
+  checkPhase = ''
+    ${python.interpreter} -m unittest discover
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = https://launchpad.net/python-fastimport;
+    description = "VCS fastimport/fastexport parser";
+    maintainers = with maintainers; [ koral ];
+    license = licenses.gpl2Plus;
+  };
+}
diff --git a/pkgs/development/python-modules/h2/default.nix b/pkgs/development/python-modules/h2/default.nix
new file mode 100644
index 000000000000..08cd1943eff6
--- /dev/null
+++ b/pkgs/development/python-modules/h2/default.nix
@@ -0,0 +1,21 @@
+{ stdenv, buildPythonPackage, fetchPypi
+, enum34, hpack, hyperframe }:
+
+buildPythonPackage rec {
+  name = "${pname}-${version}";
+  pname = "h2";
+  version = "3.0.1";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0r3f43r0v7sqgdjjg5ngw0dndk2v6cyd0jncpwya54m37y42z5mj";
+  };
+
+  propagatedBuildInputs = [ enum34 hpack hyperframe ];
+
+  meta = with stdenv.lib; {
+    description = "HTTP/2 State-Machine based protocol implementation";
+    homepage = "http://hyper.rtfd.org/";
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/development/python-modules/hyperframe/default.nix b/pkgs/development/python-modules/hyperframe/default.nix
new file mode 100644
index 000000000000..91e00a7a1461
--- /dev/null
+++ b/pkgs/development/python-modules/hyperframe/default.nix
@@ -0,0 +1,17 @@
+{ stdenv, buildPythonPackage, fetchPypi }:
+buildPythonPackage rec {
+  name = "${pname}-${version}";
+  pname = "hyperframe";
+  version = "5.1.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "017vjbb1xjak1pxcvihhilzjnmpfvhapk7k88wp6lvdkkm9l8nd2";
+  };
+
+  meta = with stdenv.lib; {
+    description = "HTTP/2 framing layer for Python";
+    homepage = "http://hyper.rtfd.org/";
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/development/python-modules/kaitaistruct/default.nix b/pkgs/development/python-modules/kaitaistruct/default.nix
new file mode 100644
index 000000000000..c99619566175
--- /dev/null
+++ b/pkgs/development/python-modules/kaitaistruct/default.nix
@@ -0,0 +1,18 @@
+{ stdenv, kaitaistruct, buildPythonPackage, fetchPypi }:
+
+buildPythonPackage rec {
+  name = "${pname}-${version}";
+  pname = "kaitaistruct";
+  version = "0.7";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "19j3snmr0qbd48f7yd3cc21ffv13dahf8ys591dnalbhvnkar71i";
+  };
+
+  meta = with stdenv.lib; {
+    description = "Kaitai Struct: runtime library for Python";
+    homepage = "https://github.com/kaitai-io/kaitai_struct_python_runtime";
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/development/python-modules/keepkey/default.nix b/pkgs/development/python-modules/keepkey/default.nix
index 8eba12dfcea2..9ea6840c4d2c 100644
--- a/pkgs/development/python-modules/keepkey/default.nix
+++ b/pkgs/development/python-modules/keepkey/default.nix
@@ -1,21 +1,25 @@
-{ stdenv, fetchPypi, buildPythonPackage, ecdsa
-, mnemonic, protobuf, hidapi }:
+{ stdenv, fetchFromGitHub, buildPythonPackage, pytest
+, ecdsa , mnemonic, protobuf, hidapi, trezor }:
 
 buildPythonPackage rec {
   name = "${pname}-${version}";
   pname = "keepkey";
   version = "4.0.0";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "95c8d5127919f9fc4bb0120b05f92efc8f526d4a68122ac18e63509571ac45a2";
+  src = fetchFromGitHub {
+    owner = "keepkey";
+    repo = "python-keepkey";
+    rev = "v${version}";
+    sha256 = "144awjkc169z2n1ffirs697y6m97izh3pbh3sjhy3nji7jszh592";
   };
 
-  propagatedBuildInputs = [ protobuf hidapi ];
+  propagatedBuildInputs = [ protobuf hidapi trezor ];
 
   buildInputs = [ ecdsa mnemonic ];
 
-  # There are no actual tests: "ImportError: No module named tests"
+  checkInputs = [ pytest ];
+
+  # tests requires hardware
   doCheck = false;
 
   # Remove impossible dependency constraint
diff --git a/pkgs/development/python-modules/ldap3/default.nix b/pkgs/development/python-modules/ldap3/default.nix
new file mode 100644
index 000000000000..895272f351de
--- /dev/null
+++ b/pkgs/development/python-modules/ldap3/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, fetchPypi, buildPythonPackage, gssapi, pyasn1 }:
+
+buildPythonPackage rec {
+  version = "2.3";
+  pname = "ldap3";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1b36lwil4iflk2ay8gi663abpnfm8id7qg4n3jkmmqbnc1sv6mn0";
+  };
+
+  buildInputs = [ gssapi ];
+
+  propagatedBuildInputs = [ pyasn1 ];
+
+  doCheck = false; # requires network
+
+  meta = with stdenv.lib; {
+    homepage = https://pypi.python.org/pypi/ldap3;
+    description = "A strictly RFC 4510 conforming LDAP V3 pure Python client library";
+    license = licenses.lgpl3;
+  };
+}
diff --git a/pkgs/development/python-modules/libagent/default.nix b/pkgs/development/python-modules/libagent/default.nix
index cca10794258f..e8cecda75897 100644
--- a/pkgs/development/python-modules/libagent/default.nix
+++ b/pkgs/development/python-modules/libagent/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchPypi, buildPythonPackage, ed25519, ecdsa
-, semver, keepkey, trezor, mnemonic, ledgerblue
+, semver, keepkey, trezor, mnemonic, ledgerblue, unidecode, mock, pytest
 }:
 
 buildPythonPackage rec {
@@ -17,6 +17,14 @@ buildPythonPackage rec {
     trezor mnemonic ledgerblue
   ];
 
+  propagatedBuildInputs = [ unidecode ];
+
+  checkInputs = [ mock pytest ];
+
+  checkPhase = ''
+    py.test libagent/tests
+  '';
+
   meta = with stdenv.lib; {
     description = "Using hardware wallets as SSH/GPG agent";
     homepage = https://github.com/romanz/trezor-agent;
diff --git a/pkgs/development/python-modules/praw/default.nix b/pkgs/development/python-modules/praw/default.nix
new file mode 100644
index 000000000000..c0be1009b069
--- /dev/null
+++ b/pkgs/development/python-modules/praw/default.nix
@@ -0,0 +1,43 @@
+{ stdenv, buildPythonPackage, fetchFromGitHub
+, requests, decorator, flake8, mock, six, update_checker, pytestrunner, prawcore
+, pytest, betamax, betamax-serializers, betamax-matchers, requests_toolbelt
+}:
+
+buildPythonPackage rec {
+  pname = "praw";
+  version = "5.2.0";
+
+  src = fetchFromGitHub {
+    owner = "praw-dev";
+    repo = "praw";
+    rev = "v${version}";
+    sha256 = "0nwfadczxa1fyq65zc3sfv8g2r4w3xrx3bdi5fv9xpn97wh2ifgw";
+  };
+
+  propagatedBuildInputs = [
+    requests
+    decorator
+    flake8
+    mock
+    six
+    update_checker
+    pytestrunner
+    prawcore
+  ];
+
+  checkInputs = [
+    pytest
+    betamax
+    betamax-serializers
+    betamax-matchers
+    requests_toolbelt
+  ];
+
+  meta = with stdenv.lib; {
+    description = "Python Reddit API wrapper";
+    homepage = http://praw.readthedocs.org/;
+    license = licenses.gpl3;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ jgeerds ];
+  };
+}
diff --git a/pkgs/development/python-modules/prawcore/default.nix b/pkgs/development/python-modules/prawcore/default.nix
new file mode 100644
index 000000000000..eb3fb784dc97
--- /dev/null
+++ b/pkgs/development/python-modules/prawcore/default.nix
@@ -0,0 +1,38 @@
+{ stdenv, buildPythonPackage, fetchFromGitHub
+, requests
+, testfixtures, mock, requests_toolbelt
+, betamax, betamax-serializers, betamax-matchers
+}:
+
+buildPythonPackage rec {
+  pname = "prawcore";
+  version = "0.12.0";
+
+  src = fetchFromGitHub {
+    owner = "praw-dev";
+    repo = "prawcore";
+    rev = "v${version}";
+    sha256 = "1z5fz6v4bv6xw84l4q3rpw3j63bb2dldl0fd6ckz8wqlpb2l45br";
+  };
+
+  propagatedBuildInputs = [
+    requests
+  ];
+
+  checkInputs = [
+    testfixtures
+    mock
+    betamax
+    betamax-serializers
+    betamax-matchers
+    requests_toolbelt
+  ];
+
+  meta = with stdenv.lib; {
+    description = "Low-level communication layer for PRAW";
+    homepage = http://praw.readthedocs.org/;
+    license = licenses.gpl3;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ jgeerds ];
+  };
+}
diff --git a/pkgs/development/python-modules/pyasn1-modules/default.nix b/pkgs/development/python-modules/pyasn1-modules/default.nix
new file mode 100644
index 000000000000..a7ee15d6a181
--- /dev/null
+++ b/pkgs/development/python-modules/pyasn1-modules/default.nix
@@ -0,0 +1,22 @@
+{ stdenv, buildPythonPackage, fetchPypi, pyasn1, isPyPy }:
+
+buildPythonPackage rec {
+  name = "${pname}-${version}";
+  pname = "pyasn1-modules";
+  version = "0.1.5";
+  disabled = isPyPy;
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1239h6h67vg0wazg2qgv6m3hdim2gs66pl89lbnayk55bbnkwc0x";
+  };
+
+  propagatedBuildInputs = [ pyasn1 ];
+
+  meta = with stdenv.lib; {
+    description = "A collection of ASN.1-based protocols modules";
+    homepage = https://pypi.python.org/pypi/pyasn1-modules;
+    license = licenses.bsd3;
+    platforms = platforms.unix;  # same as pyasn1
+  };
+}
diff --git a/pkgs/development/python-modules/pyasn1/default.nix b/pkgs/development/python-modules/pyasn1/default.nix
new file mode 100644
index 000000000000..d0122a5b7e40
--- /dev/null
+++ b/pkgs/development/python-modules/pyasn1/default.nix
@@ -0,0 +1,19 @@
+{ stdenv, buildPythonPackage, fetchPypi, }:
+
+buildPythonPackage rec {
+  name = "${pname}-${version}";
+  pname = "pyasn1";
+  version = "0.3.4";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "06hhy38jhwh95gpn8f03cr439273fsfsh4vhd5024r86nh5gyiir";
+  };
+
+  meta = with stdenv.lib; {
+    description = "ASN.1 tools for Python";
+    homepage = http://pyasn1.sourceforge.net/;
+    license = "mBSD";
+    platforms = platforms.unix;  # arbitrary choice
+  };
+}
diff --git a/pkgs/development/python-modules/pyfeed/default.nix b/pkgs/development/python-modules/pyfeed/default.nix
deleted file mode 100644
index a1591037fb5a..000000000000
--- a/pkgs/development/python-modules/pyfeed/default.nix
+++ /dev/null
@@ -1,23 +0,0 @@
-{ stdenv, buildPythonPackage, fetchurl
-, xe }:
-
-buildPythonPackage rec {
-  url = "http://www.blarg.net/%7Esteveha/pyfeed-0.7.4.tar.gz";
-
-  name = stdenv.lib.nameFromURL url ".tar";
-
-  src = fetchurl {
-    inherit url;
-    sha256 = "1h4msq573m7wm46h3cqlx4rsn99f0l11rhdqgf50lv17j8a8vvy1";
-  };
-
-  propagatedBuildInputs = [ xe ];
-
-  # error: invalid command 'test'
-  doCheck = false;
-
-  meta = with stdenv.lib; {
-    homepage = "http://home.blarg.net/~steveha/pyfeed.html";
-    description = "Tools for syndication feeds";
-  };
-}
diff --git a/pkgs/development/python-modules/pygit2/default.nix b/pkgs/development/python-modules/pygit2/default.nix
new file mode 100644
index 000000000000..90bfe9783918
--- /dev/null
+++ b/pkgs/development/python-modules/pygit2/default.nix
@@ -0,0 +1,31 @@
+{ stdenv, lib, buildPythonPackage, fetchPypi, isPyPy, libgit2, six, cffi }:
+
+buildPythonPackage rec {
+  name = "${pname}-${version}";
+  pname = "pygit2";
+  version = "0.26.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1cbc488ra3kg7r3qky17ms0szi3cda2d96qfkv1l9djsy9hnvw57";
+  };
+
+  preConfigure = lib.optionalString stdenv.isDarwin ''
+    export DYLD_LIBRARY_PATH="${libgit2}/lib"
+  '';
+
+  propagatedBuildInputs = [ libgit2 six ] ++ lib.optional (!isPyPy) cffi;
+
+  preCheck = ''
+    # disable tests that require networking
+    rm test/test_repository.py
+    rm test/test_credentials.py
+    rm test/test_submodule.py
+  '';
+
+  meta = with lib; {
+    description = "A set of Python bindings to the libgit2 shared library";
+    homepage = https://pypi.python.org/pypi/pygit2;
+    license = licenses.gpl2;
+  };
+}
diff --git a/pkgs/development/python-modules/pylibacl/default.nix b/pkgs/development/python-modules/pylibacl/default.nix
new file mode 100644
index 000000000000..97fbe28e50d7
--- /dev/null
+++ b/pkgs/development/python-modules/pylibacl/default.nix
@@ -0,0 +1,27 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pkgs
+}:
+
+buildPythonPackage rec {
+  pname = "pylibacl";
+  version = "0.5.3";
+  name = pname + "-" + version;
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0c3xw1s5bh6jnsc0wwyxnn6kn6x6rpbmmi05ap1f81fyqlgrzgj0";
+  };
+
+  # ERROR: testExtended (tests.test_acls.AclExtensions)
+  # IOError: [Errno 0] Error
+  doCheck = false;
+
+  buildInputs = with pkgs; [ acl ];
+
+  meta = {
+    description = "A Python extension module for POSIX ACLs, it can be used to query, list, add, and remove ACLs from files and directories under operating systems that support them";
+    license = lib.licenses.lgpl21Plus;
+  };
+}
diff --git a/pkgs/development/python-modules/python-fuse/default.nix b/pkgs/development/python-modules/python-fuse/default.nix
new file mode 100644
index 000000000000..d9debce6aecb
--- /dev/null
+++ b/pkgs/development/python-modules/python-fuse/default.nix
@@ -0,0 +1,27 @@
+{ lib
+, pkgconfig
+, fetchurl
+, fuse
+, buildPythonPackage
+, isPy3k
+}:
+
+buildPythonPackage rec {
+    baseName = "fuse";
+    version = "0.2.1";
+    name = "${baseName}-${version}";
+    disabled = isPy3k;
+
+    src = fetchurl {
+      url = "mirror://sourceforge/fuse/fuse-python-${version}.tar.gz";
+      sha256 = "06rmp1ap6flh64m81j0n3a357ij2vj9zwcvvw0p31y6hz1id9shi";
+    };
+
+    nativeBuildInputs = [ pkgconfig ];
+    buildInputs = [ fuse ];
+
+    meta = {
+      description = "Python bindings for FUSE";
+      license = lib.licenses.lgpl21;
+    };
+}
diff --git a/pkgs/development/python-modules/pyxattr/default.nix b/pkgs/development/python-modules/pyxattr/default.nix
new file mode 100644
index 000000000000..558dc37a394f
--- /dev/null
+++ b/pkgs/development/python-modules/pyxattr/default.nix
@@ -0,0 +1,26 @@
+{ lib
+, pkgs
+, fetchPypi
+, buildPythonPackage
+}:
+
+buildPythonPackage rec {
+    pname = "pyxattr";
+    version = "0.6.0";
+    name = pname + "-" + version;
+
+    src = fetchPypi {
+      inherit pname version;
+      sha256 = "1a3fqjlgbzq5hmc3yrnxxxl8nyn3rz2kfn17svbsahaq4gj0xl09";
+    };
+
+    # IOError: [Errno 95] Operation not supported (expected)
+    doCheck = false;
+
+    buildInputs = with pkgs; [ attr ];
+
+    meta = with lib; {
+      description = "A Python extension module which gives access to the extended attributes for filesystem objects available in some operating systems";
+      license = licenses.lgpl21Plus;
+    };
+}
diff --git a/pkgs/development/python-modules/selenium/default.nix b/pkgs/development/python-modules/selenium/default.nix
new file mode 100644
index 000000000000..d33e86a3f079
--- /dev/null
+++ b/pkgs/development/python-modules/selenium/default.nix
@@ -0,0 +1,50 @@
+{ lib
+, stdenv
+, fetchurl
+, fetchFromGitHub
+, buildPythonPackage
+, geckodriver
+, xorg
+}:
+
+buildPythonPackage rec {
+  name = "selenium-3.6.0";
+  src = fetchurl {
+    url = "mirror://pypi/s/selenium/${name}.tar.gz";
+    sha256 = "15qpvz0bdwjvpcj11fm0rw6r5inr66sqw89ww50l025sbhf04qwm";
+  };
+
+  buildInputs = [xorg.libX11];
+
+  propagatedBuildInputs = [
+    geckodriver
+  ];
+
+  # Recompiling x_ignore_nofocus.so as the original one dlopen's libX11.so.6 by some
+  # absolute paths. Replaced by relative path so it is found when used in nix.
+  x_ignore_nofocus =
+    fetchFromGitHub {
+      owner = "SeleniumHQ";
+      repo = "selenium";
+      rev = "selenium-3.6.0";
+      sha256 = "13wf4hx4i7nhl4s8xkziwxl0km1j873syrj4amragj6mpip2wn8v";
+    };
+
+  patchPhase = ''
+    cp "${x_ignore_nofocus}/cpp/linux-specific/"* .
+    substituteInPlace x_ignore_nofocus.c --replace "/usr/lib/libX11.so.6" "${xorg.libX11.out}/lib/libX11.so.6"
+    gcc -c -fPIC x_ignore_nofocus.c -o x_ignore_nofocus.o
+    gcc -shared \
+      -Wl,${if stdenv.isDarwin then "-install_name" else "-soname"},x_ignore_nofocus.so \
+      -o x_ignore_nofocus.so \
+      x_ignore_nofocus.o
+    cp -v x_ignore_nofocus.so selenium/webdriver/firefox/${if stdenv.is64bit then "amd64" else "x86"}/
+  '';
+
+  meta = with lib; {
+    description = "The selenium package is used to automate web browser interaction from Python";
+    homepage = http://www.seleniumhq.org;
+    license = licenses.asl20;
+    maintainers = with maintainers; [ jraygauthier ];
+  };
+}
\ No newline at end of file
diff --git a/pkgs/development/python-modules/sybil/default.nix b/pkgs/development/python-modules/sybil/default.nix
new file mode 100644
index 000000000000..b1fe22df4767
--- /dev/null
+++ b/pkgs/development/python-modules/sybil/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, buildPythonApplication, fetchPypi
+, pytest, nose }:
+
+buildPythonApplication rec {
+  pname   = "sybil";
+  version = "1.0.5";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0x8qd5p5qliv8wmdglda2iy3f70i4jg8zqyk8yhklm5hrxm8jdl6";
+  };
+
+  checkInputs = [ pytest nose ];
+
+  checkPhase = ''
+    py.test tests
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Automated testing for the examples in your documentation.";
+    homepage    = https://github.com/cjw296/sybil/;
+    license     = licenses.mit;
+  };
+}
diff --git a/pkgs/development/python-modules/testfixtures/default.nix b/pkgs/development/python-modules/testfixtures/default.nix
new file mode 100644
index 000000000000..23b5a5aa9e26
--- /dev/null
+++ b/pkgs/development/python-modules/testfixtures/default.nix
@@ -0,0 +1,23 @@
+{ stdenv, buildPythonPackage, fetchPypi
+, mock, manuel, pytest, sybil, zope_component, django }:
+
+buildPythonPackage rec {
+  pname = "testfixtures";
+  version = "5.3.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1xfar653qmikwb94xj3f0xfp8dh2llxjsxipx1272d8qwl0aknnx";
+  };
+
+  checkInputs = [ mock manuel pytest sybil zope_component ];
+
+  checkPhase = ''
+    # django is too much hasle to setup at the moment
+    pytest --ignore=testfixtures/tests/test_django testfixtures/tests
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/Simplistix/testfixtures";
+  };
+}
diff --git a/pkgs/development/python-modules/trezor/default.nix b/pkgs/development/python-modules/trezor/default.nix
index c473403f53d5..cb4b63ade81d 100644
--- a/pkgs/development/python-modules/trezor/default.nix
+++ b/pkgs/development/python-modules/trezor/default.nix
@@ -12,9 +12,9 @@ buildPythonPackage rec {
     sha256 = "6bdb69fc125ba705854e21163be6c7da3aa17c2a3a84f40b6d8a3f6e4a8cb314";
   };
 
-  propagatedBuildInputs = [ protobuf hidapi requests ];
+  propagatedBuildInputs = [ protobuf hidapi requests mnemonic ];
 
-  buildInputs = [ ecdsa mnemonic ];
+  buildInputs = [ ecdsa ];
 
   # There are no actual tests: "ImportError: No module named tests"
   doCheck = false;
diff --git a/pkgs/development/python-modules/update_checker/default.nix b/pkgs/development/python-modules/update_checker/default.nix
new file mode 100644
index 000000000000..ad401d80190d
--- /dev/null
+++ b/pkgs/development/python-modules/update_checker/default.nix
@@ -0,0 +1,22 @@
+{ stdenv, buildPythonPackage, fetchPypi, requests}:
+
+buildPythonPackage rec {
+  pname = "update_checker";
+  version = "0.16";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1f38l40d32dm0avcidf3dmikma8z0la84yngj88v4xygzi399qvh";
+  };
+
+  propagatedBuildInputs = [ requests ];
+
+  # requires network
+  doCheck = false;
+
+  meta = with stdenv.lib; {
+    description = "A python module that will check for package updates";
+    homepage = https://github.com/bboe/update_checker;
+    license = licenses.bsd2;
+  };
+}
diff --git a/pkgs/development/python-modules/urwid/default.nix b/pkgs/development/python-modules/urwid/default.nix
index 000cf5ea5ef2..d77a212003b1 100644
--- a/pkgs/development/python-modules/urwid/default.nix
+++ b/pkgs/development/python-modules/urwid/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildPythonPackage, fetchPypi, fetchurl }:
+{ stdenv, buildPythonPackage, fetchPypi, fetchpatch }:
 
 buildPythonPackage (rec {
   pname = "urwid";
@@ -11,10 +11,16 @@ buildPythonPackage (rec {
   };
 
   patches = [
-    (fetchurl {
-      url = https://github.com/urwid/urwid/commit/4b0ed8b6030450e6d99909a7c683e9642e546387.patch;
-      sha256 = "0ygghd6wzjqij5szg61l1dsk8b0yv8bwyj3bgxxj1lj4m17zsy5q";
-    })
+   # fix tests
+   (fetchpatch {
+     url = "https://github.com/urwid/urwid/commit/4b0ed8b6030450e6d99909a7c683e9642e546387.patch";
+     sha256 = "0azpn0ylbg8mfpr0y27n4lnq0ph75a4d4m9wdv3napnhf1vh9ahx";
+   })
+   # fix tests
+   (fetchpatch {
+     url = "https://github.com/floppym/urwid/commit/f68f2cf089cfd5ec45863baf59a91d5aeb0cf5c3.patch";
+     sha256 = "1b3vz7mrwz2bqvdwvbyv2j835f9lzapgw0j2km4sam76bxmgfpgq";
+   })
   ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/tools/continuous-integration/jenkins/default.nix b/pkgs/development/tools/continuous-integration/jenkins/default.nix
index e6f01ba5c93d..ea5a5e370178 100644
--- a/pkgs/development/tools/continuous-integration/jenkins/default.nix
+++ b/pkgs/development/tools/continuous-integration/jenkins/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "jenkins-${version}";
-  version = "2.87";
+  version = "2.88";
 
   src = fetchurl {
     url = "http://mirrors.jenkins-ci.org/war/${version}/jenkins.war";
-    sha256 = "1nzs9nn1nr2jav59v1xj39rzmrh1zmwaqnpaiqsll8kixkr9rb8f";
+    sha256 = "062hnbyj73311sxhkwla6sl33zb43v8p7hjssgbh0bfvgmnlayim";
   };
 
   buildCommand = ''
@@ -19,6 +19,6 @@ stdenv.mkDerivation rec {
     homepage = http://jenkins-ci.org;
     license = licenses.mit;
     platforms = platforms.all;
-    maintainers = with maintainers; [ coconnor fpletz ];
+    maintainers = with maintainers; [ coconnor fpletz earldouglas ];
   };
 }
diff --git a/pkgs/development/tools/database/sqlitebrowser/default.nix b/pkgs/development/tools/database/sqlitebrowser/default.nix
index adeb377dccd0..74adac9f8a32 100644
--- a/pkgs/development/tools/database/sqlitebrowser/default.nix
+++ b/pkgs/development/tools/database/sqlitebrowser/default.nix
@@ -1,32 +1,39 @@
-{ mkDerivation, lib, fetchFromGitHub, qtbase, qttools, sqlite, cmake }:
+{ mkDerivation, lib, fetchFromGitHub, cmake, antlr
+, qtbase, qttools, qscintilla, sqlite }:
 
 mkDerivation rec {
-  version = "3.10.0";
+  version = "3.10.1";
   name = "sqlitebrowser-${version}";
 
   src = fetchFromGitHub {
     repo   = "sqlitebrowser";
     owner  = "sqlitebrowser";
     rev    = "v${version}";
-    sha256 = "1fwr7p4b6glc3s0a06i7cg8l9p1mrcm4vyhyf2wi89cyg22rrf5c";
+    sha256 = "1brzam8yv6sbdmbqsp7vglhd6wlx49g2ap8llr271zrkld4k3kar";
   };
 
-  buildInputs = [ qtbase qttools sqlite ];
-  nativeBuildInputs = [ cmake ];
+  buildInputs = [ qtbase qscintilla sqlite ];
 
-  cmakeFlags = [ "-DUSE_QT5=TRUE" ];
+  nativeBuildInputs = [ cmake antlr qttools ];
 
-  # A regression was introduced in CMakeLists.txt on v3.9.x
-  # See https://github.com/sqlitebrowser/sqlitebrowser/issues/832 and issues/755
+  enableParallelBuilding = true;
+
+  # We have to patch out Test and PrintSupport to make this work with Qt 5.9
+  # It can go when the application supports 5.9
   postPatch = ''
-    substituteInPlace CMakeLists.txt --replace 'project("DB Browser for SQLite")' 'project(sqlitebrowser)'
+    substituteInPlace CMakeLists.txt \
+      --replace Test         "" \
+      --replace PrintSupport ""
+
+    substituteInPlace libs/qcustomplot-source/CMakeLists.txt \
+      --replace PrintSupport ""
   '';
 
   meta = with lib; {
     description = "DB Browser for SQLite";
     homepage = http://sqlitebrowser.org/;
     license = licenses.gpl3;
-    maintainers = [ maintainers.matthiasbeyer ];
+    maintainers = with maintainers; [ matthiasbeyer ];
     platforms = platforms.linux; # can only test on linux
   };
 }
diff --git a/pkgs/development/tools/geckodriver/default.nix b/pkgs/development/tools/geckodriver/default.nix
new file mode 100644
index 000000000000..8f6e0dde5899
--- /dev/null
+++ b/pkgs/development/tools/geckodriver/default.nix
@@ -0,0 +1,25 @@
+{ lib
+, fetchurl
+, rustPlatform
+}:
+
+with rustPlatform; 
+
+buildRustPackage rec {
+  version = "0.19.1";
+  name = "geckodriver-${version}";
+
+  src = fetchurl {
+    url = "https://github.com/mozilla/geckodriver/archive/v${version}.tar.gz";
+    sha256 = "04zpv4aiwbig466yj24hhazl5hrapkyvwlhvg0za5599ykzdv47m";
+  };
+
+  cargoSha256 = "1cny8caqcd9p98hra1k7y4d3lb8sxsyaplr0svbwam0d2qc1c257";
+
+  meta = with lib; {
+    description = "Proxy for using W3C WebDriver-compatible clients to interact with Gecko-based browsers";
+    homepage = https://github.com/mozilla/geckodriver;
+    license = licenses.mpl20;
+    maintainers = with maintainers; [ jraygauthier ];
+  };
+}
diff --git a/pkgs/development/tools/git-series/default.nix b/pkgs/development/tools/git-series/default.nix
index 44120ad023ae..7d94863ea1cb 100644
--- a/pkgs/development/tools/git-series/default.nix
+++ b/pkgs/development/tools/git-series/default.nix
@@ -17,7 +17,7 @@ buildRustPackage rec {
 
   cargoDepsHook = ''
     (
-      cd ${name}-src
+      cd */
       # see https://github.com/git-series/git-series/pull/56
       patch -p1 < ${fetchpatch {
         url = "https://github.com/Mic92/git-series/commit/3aa30a47d74ebf90b444dccdf8c153f07f119483.patch";
diff --git a/pkgs/development/tools/misc/d-feet/default.nix b/pkgs/development/tools/misc/d-feet/default.nix
index bd08c6c4c05e..14a52f4e08a6 100644
--- a/pkgs/development/tools/misc/d-feet/default.nix
+++ b/pkgs/development/tools/misc/d-feet/default.nix
@@ -2,7 +2,7 @@
 , pythonPackages, makeWrapper, gnome3, libwnck3 }:
 
 let
-  version = "${major}.11";
+  version = "${major}.12";
   major = "0.3";
 in pythonPackages.buildPythonApplication rec {
   name = "d-feet-${version}";
@@ -10,7 +10,7 @@ in pythonPackages.buildPythonApplication rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/d-feet/${major}/d-feet-${version}.tar.xz";
-    sha256 = "a3dc940c66f84b996c328531e3034d475ec690d7ff639445ff7ca746aa8cb9c2";
+    sha256 = "054hl56rii9ff7rzl42h7993ywjbxmhlcd7bk8fi1c2bx98c6s68";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/development/tools/parsing/flex/default.nix b/pkgs/development/tools/parsing/flex/default.nix
index 92fba47b756f..4ea11a622ea1 100644
--- a/pkgs/development/tools/parsing/flex/default.nix
+++ b/pkgs/development/tools/parsing/flex/default.nix
@@ -1,4 +1,6 @@
-{ stdenv, fetchurl, bison, m4 }:
+{ stdenv, fetchurl, bison, m4
+, fetchpatch, autoreconfHook, help2man
+}:
 
 stdenv.mkDerivation rec {
   name = "flex-${version}";
@@ -9,6 +11,16 @@ stdenv.mkDerivation rec {
     sha256 = "15g9bv236nzi665p9ggqjlfn4dwck5835vf0bbw2cz7h5c1swyp8";
   };
 
+  # Also upstream, will be part of 2.6.5
+  # https://github.com/westes/flex/commit/24fd0551333e
+  patches = [(fetchpatch {
+    name = "glibc-2.26.patch";
+    url = "https://raw.githubusercontent.com/lede-project/source/0fb14a2b1ab2f82c"
+        + "/tools/flex/patches/200-build-AC_USE_SYSTEM_EXTENSIONS-in-configure.ac.patch";
+    sha256 = "1aarhcmz7mfrgh15pkj6f7ikxa2m0mllw1i1vscsf1kw5d05lw6f";
+  })];
+  nativeBuildInputs = [ autoreconfHook help2man ];
+
   buildInputs = [ bison ];
 
   propagatedBuildInputs = [ m4 ];
diff --git a/pkgs/development/tools/rtags/default.nix b/pkgs/development/tools/rtags/default.nix
index 32be2a503bfc..8fe47bd0cb54 100644
--- a/pkgs/development/tools/rtags/default.nix
+++ b/pkgs/development/tools/rtags/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   name = "rtags-${version}";
-  version = "2.12";
+  version = "2.15";
 
   nativeBuildInputs = [ cmake pkgconfig ];
   buildInputs = [ llvmPackages.llvm openssl emacs ]
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
     rev = "refs/tags/v${version}";
     fetchSubmodules = true;
     url = "https://github.com/andersbakken/rtags.git";
-    sha256 = "0bgjcvyvkpqcgw4571iz39sqydmcaz6ymx7kxcmq6j7rffs6qs7l";
+    sha256 = "12nnyav2q1ddkz9wm0aclhn7r74xj4ibrb0x05k7mcf694bg79c0";
     # unicode file names lead to different checksums on HFS+ vs. other
     # filesystems because of unicode normalisation
     postFetch = ''
diff --git a/pkgs/games/anki/default.nix b/pkgs/games/anki/default.nix
index c5bac4db8e5b..4a531c07efd0 100644
--- a/pkgs/games/anki/default.nix
+++ b/pkgs/games/anki/default.nix
@@ -7,8 +7,8 @@
 }:
 
 let
-    version = "2.0.46";
-    inherit (python2Packages) python wrapPython sqlalchemy pyaudio beautifulsoup httplib2 matplotlib pyqt4;
+    version = "2.0.47";
+    inherit (python2Packages) python wrapPython sqlalchemy pyaudio beautifulsoup4 httplib2 matplotlib pyqt4;
     qt4 = pyqt4.qt;
 in
 stdenv.mkDerivation rec {
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
       sha256 = "01h51rbnj0r6lmjnn2vzxzaf7mxkc0azmg1v4mvf4pkpsp50a7hr";
     };
 
-    pythonPath = [ pyqt4 sqlalchemy pyaudio beautifulsoup httplib2 ]
+    pythonPath = [ pyqt4 sqlalchemy pyaudio beautifulsoup4 httplib2 ]
               ++ lib.optional plotsSupport matplotlib;
 
     buildInputs = [ python wrapPython lame mplayer libpulseaudio ];
diff --git a/pkgs/games/openra/default.nix b/pkgs/games/openra/default.nix
index fb01346d84e8..5665dfc9e945 100644
--- a/pkgs/games/openra/default.nix
+++ b/pkgs/games/openra/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub, mono, makeWrapper, lua
 , SDL2, freetype, openal, systemd, pkgconfig,
-  dotnetPackages, gnome3, curl, unzip, which
+  dotnetPackages, gnome3, curl, unzip, which, python
 }:
 
 stdenv.mkDerivation rec {
@@ -60,7 +60,7 @@ stdenv.mkDerivation rec {
 
   postInstall = with stdenv.lib; let
     runtime = makeLibraryPath [ SDL2 freetype openal systemd lua ];
-    binaries= makeBinPath [ which mono gnome3.zenity ];
+    binaries= makeBinPath [ which mono gnome3.zenity python ];
   in ''
     wrapProgram $out/lib/openra/launch-game.sh \
       --prefix PATH : "${binaries}" \
diff --git a/pkgs/misc/drivers/hplip/default.nix b/pkgs/misc/drivers/hplip/default.nix
index a01fc74ce471..66ed1d44adc7 100644
--- a/pkgs/misc/drivers/hplip/default.nix
+++ b/pkgs/misc/drivers/hplip/default.nix
@@ -11,16 +11,16 @@
 let
 
   name = "hplip-${version}";
-  version = "3.17.9";
+  version = "3.17.10";
 
   src = fetchurl {
     url = "mirror://sourceforge/hplip/${name}.tar.gz";
-    sha256 = "0y46jjq8jdfk9m4vjq55h8yggibvqbi9rl08vni7vbhxym1diamj";
+    sha256 = "0v27hg856b5z2rilczcbfgz8ksxn0n810g1glac3mxkj8qbl8wqg";
   };
 
   plugin = fetchurl {
-    url = "http://hplipopensource.com/hplip-web/plugin/${name}-plugin.run";
-    sha256 = "10z8vzwcwmwni7s4j9xp0fa7l4lwrhl4kp450dga3fj0cck1gxwq";
+    url = "http://www.openprinting.org/download/printdriver/auxfiles/HP/plugins/${name}-plugin.run";
+    sha256 = "07am3dnl0ipgfswz5wndprryljh9rqbfhq7mm4d4yyj3bdnnzlig";
   };
 
   hplipState = substituteAll {
diff --git a/pkgs/misc/vscode-extensions/cpptools/default.nix b/pkgs/misc/vscode-extensions/cpptools/default.nix
new file mode 100644
index 000000000000..87c782222fc5
--- /dev/null
+++ b/pkgs/misc/vscode-extensions/cpptools/default.nix
@@ -0,0 +1,128 @@
+{ stdenv, lib, fetchurl, vscode-utils, unzip, dos2unix, mono46, clang-tools, writeScript
+, gdbUseFixed ? true, gdb # The gdb default setting will be fixed to specified. Use version from `PATH` otherwise. 
+}:
+
+assert gdbUseFixed -> null != gdb;
+
+/*
+  Note that this version of the extension still has some nix specific issues
+  which could not be fixed merely by patching (inside a C# dll).
+
+  In particular, the debugger requires either gnome-terminal or xterm. However
+  instead of looking for the terminal executable in `PATH`, for any linux platform
+  the dll uses an hardcoded path to one of these.
+
+  So, in order for debugging to work properly, you merely need to create symlinks
+  to one of these terminals at the appropriate location.
+
+  The good news is the the utility library is open source and with some effort
+  we could build a patched version ourselves. See:
+
+  <https://github.com/Microsoft/MIEngine/blob/2885386dc7f35e0f1e44827269341e786361f28e/src/MICore/TerminalLauncher.cs#L156>
+
+  Also, the extension should eventually no longer require an external terminal. See:
+
+  <https://github.com/Microsoft/vscode-cpptools/issues/35>
+
+  Once the symbolic link temporary solution taken, everything shoud run smootly.
+*/
+
+let
+  gdbDefaultsTo = if gdbUseFixed then "${gdb}/bin/gdb" else "gdb";
+
+  langComponentBinaries = stdenv.mkDerivation {
+    name = "cpptools-language-component-binaries";
+
+    src = fetchurl {
+      url = https://download.visualstudio.microsoft.com/download/pr/11151953/d3cc8b654bffb8a2f3896d101f3c3155/Bin_Linux.zip;
+      sha256 = "12qbxsrdc73cqjb84xdck1xafzhfkcyn6bqbpcy1bxxr3b7hxbii";
+    };
+
+    buildInputs = [ unzip ];
+
+    patchPhase = ''
+      elfInterpreter="${stdenv.glibc.out}/lib/ld-linux-x86-64.so.2"
+      patchelf --set-interpreter "$elfInterpreter" ./Microsoft.VSCode.CPP.Extension.linux
+      patchelf --set-interpreter "$elfInterpreter" ./Microsoft.VSCode.CPP.IntelliSense.Msvc.linux
+      chmod a+x ./Microsoft.VSCode.CPP.Extension.linux ./Microsoft.VSCode.CPP.IntelliSense.Msvc.linux
+    '';
+
+    installPhase = ''
+      mkdir -p "$out/bin"
+      find . -mindepth 1 -maxdepth 1 | xargs cp -a -t "$out/bin"
+    '';
+  };
+
+  cpptoolsJsonFile = fetchurl {
+    url = https://download.visualstudio.microsoft.com/download/pr/11070848/7b97d6724d52cae8377c61bb4601c989/cpptools.json;
+    sha256 = "124f091aic92rzbg2vg831y22zr5wi056c1kh775djqs3qv31ja6";
+  };
+
+
+
+  openDebugAD7Script = writeScript "OpenDebugAD7" ''
+    #!${stdenv.shell}
+    BIN_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+    ${if gdbUseFixed
+        then ''
+          export PATH=''${PATH}''${PATH:+:}${gdb}/bin
+        ''
+        else ""}
+    ${mono46}/bin/mono $BIN_DIR/bin/OpenDebugAD7.exe $*
+  '';
+in
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "cpptools";
+    publisher = "ms-vscode";
+    version = "0.12.3";
+    sha256 = "1dcqy54n1w29xhbvxscd41hdrbdwar6g12zx02f6kh2f1kw34z5z";
+  };
+
+  buildInputs = [
+    dos2unix
+  ];
+
+  prePatch = ''
+    dos2unix package.json      
+  '';
+
+  patches = [
+    ./vscode-cpptools-0-12-3-package-json.patch
+  ];
+
+  postPatch = ''
+    # Patch `packages.json` so that nix's *gdb* is used as default value for `miDebuggerPath`.
+    substituteInPlace "./package.json" \
+      --replace "\"default\": \"/usr/bin/gdb\"" "\"default\": \"${gdbDefaultsTo}\""
+
+    # Prevent download/install of extensions
+    touch "./install.lock"
+
+    # Move unused files out of the way.
+    mv ./debugAdapters/bin/OpenDebugAD7.exe.config ./debugAdapters/bin/OpenDebugAD7.exe.config.unused
+
+    # Bring the `cpptools.json` file at the root of the package, same as the extension would do.
+    cp -p "${cpptoolsJsonFile}" "./cpptools.json"
+
+    # Combining the language component binaries as part of our package.
+    find "${langComponentBinaries}/bin" -mindepth 1 -maxdepth 1 | xargs cp -p -t "./bin"
+
+    # Mono runtimes from nix package (used by generated `OpenDebugAD7`).
+    rm "./debugAdapters/OpenDebugAD7"
+    cp -p "${openDebugAD7Script}" "./debugAdapters/OpenDebugAD7"
+
+    # Clang-format from nix package.
+    mkdir -p "./LLVM"
+    find "${clang-tools}" -mindepth 1 -maxdepth 1 | xargs ln -s -t "./LLVM"
+  '';
+
+    meta = with stdenv.lib; {
+      license = licenses.unfree;
+      maintainer = [ maintainers.jraygauthier ];
+      # A 32 bit linux would also be possible with some effort (specific download of binaries + 
+      # patching of the elf files with 32 bit interpreter).
+      platforms = [ "x86_64-linux" ];
+    };
+}
\ No newline at end of file
diff --git a/pkgs/misc/vscode-extensions/cpptools/vscode-cpptools-0-12-3-package-json.patch b/pkgs/misc/vscode-extensions/cpptools/vscode-cpptools-0-12-3-package-json.patch
new file mode 100644
index 000000000000..1873963f460d
--- /dev/null
+++ b/pkgs/misc/vscode-extensions/cpptools/vscode-cpptools-0-12-3-package-json.patch
@@ -0,0 +1,82 @@
+diff --git a/package.json b/package.json
+index 518e839..1c17c35 100644
+--- a/package.json
++++ b/package.json
+@@ -37,7 +37,26 @@
+     "Linters"
+   ],
+   "activationEvents": [
+-    "*"
++    "onLanguage:cpp",
++    "onLanguage:c",
++    "onCommand:extension.pickNativeProcess",
++    "onCommand:extension.pickRemoteNativeProcess",
++    "onCommand:extension.provideInitialConfigurations_cppvsdbg",
++    "onCommand:extension.provideInitialConfigurations_cppdbg",
++    "onCommand:C_Cpp.ConfigurationEdit",
++    "onCommand:C_Cpp.ConfigurationSelect",
++    "onCommand:C_Cpp.SwitchHeaderSource",
++    "onCommand:C_Cpp.UnloadLanguageServer",
++    "onCommand:C_Cpp.Navigate",
++    "onCommand:C_Cpp.GoToDeclaration",
++    "onCommand:C_Cpp.PeekDeclaration",
++    "onCommand:C_Cpp.ToggleErrorSquiggles",
++    "onCommand:C_Cpp.ToggleIncludeFallback",
++    "onCommand:C_Cpp.ShowReleaseNotes",
++    "onCommand:C_Cpp.ResetDatabase",
++    "workspaceContains:.vscode/c_cpp_properties.json",
++    "onDebug:cppdbg",
++    "onDebug:cppvsdbg"
+   ],
+   "main": "./out/src/main",
+   "contributes": {
+@@ -281,8 +300,7 @@
+             "cpp"
+           ]
+         },
+-        "runtime": "node",
+-        "program": "./out/src/Debugger/Proxy/debugProxy.js",
++        "program": "./debugAdapters/OpenDebugAD7",
+         "aiKey": "AIF-d9b70cd4-b9f9-4d70-929b-a071c400b217",
+         "variables": {
+           "pickProcess": "extension.pickNativeProcess",
+@@ -722,7 +740,29 @@
+               }
+             }
+           }
+-        }
++        },
++        "configurationSnippets": [
++          {
++            "label": "C/C++: (gdb) Launch",
++            "description": "Launch with gdb.",
++            "bodyText": "{\n\t\"name\": \"(gdb) Launch\",\n\t\"type\": \"cppdbg\",\n\t\"request\": \"launch\",\n\t\"program\": \"enter program name, for example \\${workspaceRoot}/a.out\",\n\t\"args\": [],\n\t\"stopAtEntry\": false,\n\t\"cwd\": \"\\${workspaceRoot}\",\n\t\"environment\": [],\n\t\"externalConsole\": true,\n\t\"MIMode\": \"gdb\",\n\t\"setupCommands\": [\n\t    {\n\t        \"description\": \"Enable pretty-printing for gdb\",\n\t        \"text\": \"-enable-pretty-printing\",\n\t        \"ignoreFailures\": true\n\t    }\n\t]\n}"
++          },
++          {
++            "label": "C/C++: (gdb) Attach",
++            "description": "Attach with gdb.",
++            "bodyText": "{ \n\t\"name\": \"(gdb) Attach\",\n\t\"type\": \"cppdbg\",\n\t\"request\": \"attach\",\n\t\"program\": \"enter program name, for example \\${workspaceRoot}/a.out\",\n\t\"processId\": \"\\${command:pickProcess}\",\n\t\"MIMode\": \"gdb\"\n}"
++          },
++          {
++            "label": "C/C++: (gdb) Pipe Launch",
++            "description": "Pipe Launch with gdb.",
++            "bodyText": "{\n\t\"name\": \"(gdb) Pipe Launch\",\n\t\"type\": \"cppdbg\",\n\t\"request\": \"launch\",\n\t\"program\": \"enter program name, for example \\${workspaceRoot}/a.out\",\n\t\"args\": [],\n\t\"stopAtEntry\": false,\n\t\"cwd\": \"\\${workspaceRoot}\",\n\t\"environment\": [],\n\t\"externalConsole\": true,\n\t\"pipeTransport\": {\n\t\t\"debuggerPath\": \"/usr/bin/gdb\",\n\t\t\"pipeProgram\": \"/usr/bin/ssh\",\n\t\t\"pipeArgs\": [],\n\t\t\"pipeCwd\": \"\"\n\t},\n\t\"MIMode\": \"gdb\",\n\t\"setupCommands\": [\n\t    {\n\t        \"description\": \"Enable pretty-printing for gdb\",\n\t        \"text\": \"-enable-pretty-printing\",\n\t        \"ignoreFailures\": true\n\t    }\n\t]\n}"
++          },
++          {
++            "label": "C/C++: (gdb) Pipe Attach",
++            "description": "Pipe Attach with gdb.",
++            "bodyText": "{\n\t\"name\": \"(gdb) Pipe Attach\",\n\t\"type\": \"cppdbg\",\n\t\"request\": \"attach\",\n\t\"program\": \"enter program name, for example \\${workspaceRoot}/a.out\",\n\t\"processId\": \"\\${command:pickRemoteProcess}\",\n\t\"pipeTransport\": {\n\t\t\"debuggerPath\": \"/usr/bin/gdb\",\n\t\t\"pipeProgram\": \"/usr/bin/ssh\",\n\t\t\"pipeArgs\": [],\n\t\t\"pipeCwd\": \"\"\n\t},\n\t\"MIMode\": \"gdb\"\n}"
++          }
++        ]
+       },
+       {
+         "type": "cppvsdbg",
+@@ -741,7 +781,7 @@
+         "variables": {
+           "pickProcess": "extension.pickNativeProcess"
+         },
+-        "initialConfigurations": "extension.provideInitialConfigurations_cppvsdbg",
++        "initialConfigurations": "",
+         "configurationAttributes": {
+           "launch": {
+             "required": [
diff --git a/pkgs/misc/vscode-extensions/default.nix b/pkgs/misc/vscode-extensions/default.nix
index d357c43abd85..8047e29ad558 100644
--- a/pkgs/misc/vscode-extensions/default.nix
+++ b/pkgs/misc/vscode-extensions/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, vscode-utils }:
+{ stdenv, lib, fetchurl, callPackage, vscode-utils }:
 
 let
   inherit (vscode-utils) buildVscodeExtension buildVscodeMarketplaceExtension;
@@ -22,4 +22,6 @@ rec {
       license = licenses.mit;
     };
   };
+
+  ms-vscode.cpptools = callPackage ./cpptools {};
 }
\ No newline at end of file
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_filedb/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_filedb/default.nix
index 0234cbc62792..fb1ea2509d76 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_filedb/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_filedb/default.nix
@@ -6,7 +6,7 @@ appleDerivation {
     libsecurity_cdsa_plugin
   ];
   patchPhase = ''
-    cp ${osx_private_sdk}/PrivateSDK10.9.sparse.sdk/usr/local/include/sandbox_private.h .
+    cp ${osx_private_sdk}/include/sandbox_private.h .
     substituteInPlace sandbox_private.h --replace '<sandbox.h>' '"${apple_sdk.sdk}/include/sandbox.h"'
     substituteInPlace lib/AtomicFile.cpp --replace '<sandbox.h>' '"sandbox_private.h"'
   '';
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_generic/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_generic/default.nix
index ef449a7d415d..93857ea792c2 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_generic/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_generic/default.nix
@@ -10,7 +10,7 @@ name: version: sha256: args: let
 
       patchPhase = ''
         # allows including <Security/some-private-header.h>
-        ln -s ${pkgs.darwin.osx_private_sdk}/PrivateSDK10.9.sparse.sdk/System/Library/Frameworks/Security.framework/Versions/A/PrivateHeaders Security
+        cp -R ${pkgs.darwin.osx_private_sdk}/include/SecurityPrivateHeaders Security
 
         grep -Rl MacErrors.h . | while read file; do
           substituteInPlace "''$file" --replace \
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_keychain/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_keychain/default.nix
index 34a2a49ea0e4..06137879410d 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_keychain/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_keychain/default.nix
@@ -18,9 +18,9 @@ appleDerivation {
 
     substituteInPlace lib/SecCertificate.cpp --replace '#include <Security/SecCertificatePriv.h>' ""
 
-    cp ${osx_private_sdk}/PrivateSDK10.9.sparse.sdk/usr/include/xpc/private.h xpc
+    cp ${osx_private_sdk}/include/xpc/private.h xpc
     cp ${apple_sdk.sdk}/include/xpc/*.h xpc
-    cp ${osx_private_sdk}/PrivateSDK10.9.sparse.sdk/usr/local/include/sandbox_private.h lib/sandbox.h
+    cp ${osx_private_sdk}/include/sandbox_private.h lib/sandbox.h
 
     substituteInPlace lib/SecItemPriv.h \
       --replace "extern CFTypeRef kSecAttrAccessGroup" "extern const CFTypeRef kSecAttrAccessGroup" \
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_utilities/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_utilities/default.nix
index 8dae60724137..bb55fd48d8b2 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_utilities/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_utilities/default.nix
@@ -17,9 +17,8 @@ appleDerivation {
     substituteInPlace lib/powerwatch.h --replace \
       '<IOKit/pwr_mgt/IOPMLibPrivate.h>' \
       '"${IOKit}/Library/Frameworks/IOKit.framework/Headers/pwr_mgt/IOPMLibPrivate.h"'
-
-    cp ${osx_private_sdk}/PrivateSDK10.9.sparse.sdk/usr/include/security_utilities/utilities_dtrace.h lib
-    cp -R ${osx_private_sdk}/PrivateSDK10.9.sparse.sdk/usr/local/include/bsm lib
+    cp -R ${osx_private_sdk}/include/bsm lib
+    cp ${osx_private_sdk}/include/utilities_dtrace.h lib
   '' + stdenv.lib.optionalString (!stdenv.cc.nativeLibc) ''
     substituteInPlace lib/vproc++.cpp --replace /usr/local/include/vproc_priv.h ${stdenv.libc}/include/vproc_priv.h
   '';
diff --git a/pkgs/os-specific/darwin/cf-private/default.nix b/pkgs/os-specific/darwin/cf-private/default.nix
index 48860504f73c..f8c25339370b 100644
--- a/pkgs/os-specific/darwin/cf-private/default.nix
+++ b/pkgs/os-specific/darwin/cf-private/default.nix
@@ -1,31 +1,18 @@
 { stdenv, osx_private_sdk, CF }:
 
-let
-  headers = [
-    "CFAvailability.h"
-    "CFAttributedString.h"
-    "CFFileDescriptor.h"
-    "CFFileSecurity.h"
-    "CFNotificationCenter.h"
-    "CFStringTokenizer.h"
-    "CFURLEnumerator.h"
-    "CFURL.h"
-    "CoreFoundation.h"
-  ];
-
-in stdenv.mkDerivation {
+stdenv.mkDerivation {
   name = "${CF.name}-private";
   phases = [ "installPhase" "fixupPhase" ];
   installPhase = ''
     dest=$out/Library/Frameworks/CoreFoundation.framework/Headers
     mkdir -p $dest
     pushd $dest
-    for file in ${CF}/Library/Frameworks/CoreFoundation.framework/Headers/*; do
-      ln -s $file
-    done
+      cp -Lv ${osx_private_sdk}/include/CoreFoundationPrivateHeaders/* $dest
+      for file in ${CF}/Library/Frameworks/CoreFoundation.framework/Headers/*; do
+        ln -sf $file 
+      done
     popd
 
-    install -m 0644 ${osx_private_sdk}/PrivateSDK10.10.sparse.sdk/System/Library/Frameworks/CoreFoundation.framework/Headers/{${stdenv.lib.concatStringsSep "," headers}} $dest
   '';
 
   setupHook = ./setup-hook.sh;
diff --git a/pkgs/os-specific/darwin/osx-private-sdk/default.nix b/pkgs/os-specific/darwin/osx-private-sdk/default.nix
index c2c2aea54f8c..1eecdbc5618d 100644
--- a/pkgs/os-specific/darwin/osx-private-sdk/default.nix
+++ b/pkgs/os-specific/darwin/osx-private-sdk/default.nix
@@ -1,8 +1,27 @@
 { stdenv, fetchFromGitHub }:
 
-fetchFromGitHub {
-  owner = "samdmarshall";
-  repo = "OSXPrivateSDK";
-  rev = "f4d52b60e86b496abfaffa119a7d299562d99783";
-  sha256 = "0bv0884yxpvk2ishxj8gdy1w6wb0gwfq55q5qjp0s8z0z7f63zqh";
+stdenv.mkDerivation {
+  name = "OSXPrivateSDK";
+
+  src = fetchFromGitHub {
+    owner = "samdmarshall";
+    repo = "OSXPrivateSDK";
+    rev = "f4d52b60e86b496abfaffa119a7d299562d99783";
+    sha256 = "0bv0884yxpvk2ishxj8gdy1w6wb0gwfq55q5qjp0s8z0z7f63zqh";
+  };
+
+  # NOTE: we install only headers that are really needed to keep closure sie
+  # reasonable.
+  installPhase = ''
+    mkdir -p $out/include
+    sdk10=PrivateSDK10.10.sparse.sdk
+    sdk=PrivateSDK10.9.sparse.sdk
+    cp $sdk/usr/local/include/sandbox_private.h $out/include/sandbox_private.h
+    # this can be removed once we dtrace binary
+    cp $sdk/usr/local/include/security_utilities/utilities_dtrace.h $out/include/utilities_dtrace.h
+    cp -RL $sdk/usr/include/xpc $out/include/xpc
+    cp -RL $sdk/usr/local/include/bsm $out/include/bsm
+    cp -RL $sdk/System/Library/Frameworks/Security.framework/Versions/A/PrivateHeaders $out/include/SecurityPrivateHeaders
+    cp -RL $sdk10/System/Library/Frameworks/CoreFoundation.framework/Headers $out/include/CoreFoundationPrivateHeaders
+  '';
 }
diff --git a/pkgs/os-specific/darwin/security-tool/default.nix b/pkgs/os-specific/darwin/security-tool/default.nix
index 5a89940c9dae..2b8c7718aee8 100644
--- a/pkgs/os-specific/darwin/security-tool/default.nix
+++ b/pkgs/os-specific/darwin/security-tool/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   patchPhase = ''
     # copied from libsecurity_generic
-    ln -s ${osx_private_sdk}/PrivateSDK10.9.sparse.sdk/System/Library/Frameworks/Security.framework/Versions/A/PrivateHeaders Security
+    cp -R ${osx_private_sdk}/include/SecurityPrivateHeaders Security
 
     substituteInPlace cmsutil.c --replace \
       '<CoreServices/../Frameworks/CarbonCore.framework/Headers/MacErrors.h>' \
diff --git a/pkgs/os-specific/linux/checkpolicy/default.nix b/pkgs/os-specific/linux/checkpolicy/default.nix
index 9fbed50f3b9a..8e01bb2a5c80 100644
--- a/pkgs/os-specific/linux/checkpolicy/default.nix
+++ b/pkgs/os-specific/linux/checkpolicy/default.nix
@@ -10,16 +10,17 @@ stdenv.mkDerivation rec {
     sha256 = "1m5wjm43lzp6bld8higsvdm2dkddydihhwv9qw2w9r4dm0largcv";
   };
 
+  # Don't build tests
+  postPatch = ''
+    sed '/-C test/d' -i Makefile
+    sed '1i#include <ctype.h>' -i checkpolicy.c
+  '';
+
   nativeBuildInputs = [ bison flex ];
   buildInputs = [ libsepol ];
 
   NIX_CFLAGS_COMPILE = "-fstack-protector-all";
 
-  # Don't build tests
-  postPatch = ''
-    sed -i '/-C test/d' Makefile
-  '';
-
   preBuild = ''
     makeFlagsArray+=("LEX=flex")
     makeFlagsArray+=("LIBDIR=${libsepol}/lib")
diff --git a/pkgs/os-specific/linux/firmware/raspberrypi/default.nix b/pkgs/os-specific/linux/firmware/raspberrypi/default.nix
index bb714f60c2df..c71f1c0ea2e9 100644
--- a/pkgs/os-specific/linux/firmware/raspberrypi/default.nix
+++ b/pkgs/os-specific/linux/firmware/raspberrypi/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "raspberrypi-firmware-${version}";
-  version = "1.20170811";
+  version = "1.20171029";
 
   src = fetchFromGitHub {
     owner = "raspberrypi";
     repo = "firmware";
     rev = version;
-    sha256 = "1lrbbslpwjgvrn7hk3l104gkl07qxh7qd4cdyqccqhqzip9wqhkn";
+    sha256 = "12aisha8rlr28310hakps04z9p45kd2wvks0w1vxw1kwfh1ncy9s";
   };
 
   dontStrip = true;    # Stripping breaks some of the binaries
diff --git a/pkgs/os-specific/linux/kernel/linux-rpi.nix b/pkgs/os-specific/linux/kernel/linux-rpi.nix
index 2d8a3f0afcdd..fb97aa579df0 100644
--- a/pkgs/os-specific/linux/kernel/linux-rpi.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rpi.nix
@@ -1,8 +1,8 @@
 { stdenv, hostPlatform, fetchFromGitHub, perl, buildLinux, ... } @ args:
 
 let
-  modDirVersion = "4.9.41";
-  tag = "1.20170811";
+  modDirVersion = "4.9.59";
+  tag = "1.20171029";
 in
 stdenv.lib.overrideDerivation (import ./generic.nix (args // rec {
   version = "${modDirVersion}-${tag}";
@@ -12,7 +12,7 @@ stdenv.lib.overrideDerivation (import ./generic.nix (args // rec {
     owner = "raspberrypi";
     repo = "linux";
     rev = "raspberrypi-kernel_${tag}-1";
-    sha256 = "1ly0x7a43zvig0fv7lc6rpq49pcdb7i9sdb78p4gi5485zap40kb";
+    sha256 = "19lb1gxz21x1d5zdznzqfq60kxg7iqmyl6l0mb9qg2vrl8fcgnxk";
   };
 
   features = {
diff --git a/pkgs/os-specific/linux/libselinux/default.nix b/pkgs/os-specific/linux/libselinux/default.nix
index f20efcb32373..541ead7258f6 100644
--- a/pkgs/os-specific/linux/libselinux/default.nix
+++ b/pkgs/os-specific/linux/libselinux/default.nix
@@ -39,6 +39,9 @@ stdenv.mkDerivation rec {
 
   postPatch = optionalString enablePython ''
     sed -i -e 's|\$(LIBDIR)/libsepol.a|${libsepol}/lib/libsepol.a|' src/Makefile
+  ''
+  + ''
+    sed '1i#include <sys/uio.h>' -i src/setrans_client.c
   '';
 
   preBuild = ''
diff --git a/pkgs/os-specific/linux/tcp-wrappers/default.nix b/pkgs/os-specific/linux/tcp-wrappers/default.nix
index 6a400f1de226..7da4e39ca6c0 100644
--- a/pkgs/os-specific/linux/tcp-wrappers/default.nix
+++ b/pkgs/os-specific/linux/tcp-wrappers/default.nix
@@ -1,4 +1,4 @@
-{ fetchurl, stdenv }:
+{ fetchurl, stdenv, libnsl }:
 
 let
   vanillaVersion = "7.6.q";
@@ -22,6 +22,8 @@ in stdenv.mkDerivation rec {
     patches="$(cat debian/patches/series | sed 's,^,debian/patches/,') $patches"
   '';
 
+  buildInputs = [ libnsl ];
+
   makeFlags = [ "STRINGS=" "REAL_DAEMON_DIR=$(out)/bin" "linux" ];
 
   installPhase = ''
diff --git a/pkgs/servers/gpm/default.nix b/pkgs/servers/gpm/default.nix
index e260ccfb761b..6096aa1ed74d 100644
--- a/pkgs/servers/gpm/default.nix
+++ b/pkgs/servers/gpm/default.nix
@@ -12,6 +12,11 @@ stdenv.mkDerivation rec {
     sha256 = "13d426a8h403ckpc8zyf7s2p5rql0lqbg2bv0454x0pvgbfbf4gh";
   };
 
+  postPatch = ''
+    sed '1i#include <sys/types.h>' -i src/daemon/open_console.c
+    substituteInPlace src/prog/gpm-root.y --replace __sigemptyset sigemptyset
+  '';
+
   nativeBuildInputs = [ automake autoconf libtool flex bison texinfo ];
   buildInputs = [ ncurses ];
 
diff --git a/pkgs/servers/http/hyp/default.nix b/pkgs/servers/http/hyp/default.nix
new file mode 100644
index 000000000000..3a1eb50f05be
--- /dev/null
+++ b/pkgs/servers/http/hyp/default.nix
@@ -0,0 +1,19 @@
+{ stdenv, fetchurl, python3Packages }:
+
+python3Packages.buildPythonPackage rec {
+  name = "hyp-server-${version}";
+  version = "1.2.0";
+
+  src = fetchurl {
+    url    = "mirror://pypi/h/hyp-server/${name}.tar.gz";
+    sha256 = "1lafjdcn9nnq6xc3hhyizfwh6l69lc7rixn6dx65aq71c913jc15";
+  };
+
+  meta = with stdenv.lib; {
+    description = "Hyperminimal https server";
+    homepage    = https://github.com/rnhmjoj/hyp;
+    license     = with licenses; [gpl3Plus mit];
+    maintainers = with maintainers; [ rnhmjoj ];
+    platforms   = platforms.unix;
+  };
+}
diff --git a/pkgs/servers/monitoring/lcdproc/default.nix b/pkgs/servers/monitoring/lcdproc/default.nix
index 027e10901573..859849f7b2c7 100644
--- a/pkgs/servers/monitoring/lcdproc/default.nix
+++ b/pkgs/servers/monitoring/lcdproc/default.nix
@@ -24,7 +24,9 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ freetype libX11 libftdi libusb libusb1 ncurses ];
   nativeBuildInputs = [ autoreconfHook doxygen makeWrapper pkgconfig ];
-  enableParallelBuilding = true;
+
+  # In 0.5.9: gcc: error: libbignum.a: No such file or directory
+  enableParallelBuilding = false;
 
   postFixup = ''
     for f in $out/bin/*.pl ; do
diff --git a/pkgs/servers/rpcbind/default.nix b/pkgs/servers/rpcbind/default.nix
index da59241bad3c..dd09985a07bc 100644
--- a/pkgs/servers/rpcbind/default.nix
+++ b/pkgs/servers/rpcbind/default.nix
@@ -1,4 +1,4 @@
-{ fetchurl, stdenv, pkgconfig, libtirpc
+{ fetchurl, stdenv, pkgconfig, libnsl, libtirpc
 , useSystemd ? true, systemd }:
 
 stdenv.mkDerivation rec {
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
     ./sunrpc.patch
   ];
 
-  buildInputs = [ libtirpc ]
+  buildInputs = [ libnsl libtirpc ]
              ++ stdenv.lib.optional useSystemd systemd;
 
   configureFlags = [
diff --git a/pkgs/shells/nix-zsh-completions/default.nix b/pkgs/shells/nix-zsh-completions/default.nix
index eaae85990b20..af0552662938 100644
--- a/pkgs/shells/nix-zsh-completions/default.nix
+++ b/pkgs/shells/nix-zsh-completions/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchFromGitHub }:
 
 let
-  version = "0.3.1";
+  version = "0.3.2";
 in
 
 stdenv.mkDerivation rec {
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     owner = "spwhitt";
     repo = "nix-zsh-completions";
     rev = "${version}";
-    sha256 = "1sbc52f5818bcygljrji84dyvgw727x50m9v6qfrsdaji3zkqga1";
+    sha256 = "0i306k50g07n9smy68npma1k90sv173zy12jdi8wm7h1sj53m5rv";
   };
 
   installPhase = ''
@@ -24,6 +24,6 @@ stdenv.mkDerivation rec {
     description = "ZSH completions for Nix, NixOS, and NixOps";
     license = stdenv.lib.licenses.bsd3;
     platforms = stdenv.lib.platforms.all;
-    maintainers = [ stdenv.lib.maintainers.spwhitt stdenv.lib.maintainers.olejorgenb ];
+    maintainers = [ stdenv.lib.maintainers.spwhitt stdenv.lib.maintainers.olejorgenb stdenv.lib.maintainers.hedning ];
   };
 }
diff --git a/pkgs/tools/misc/debootstrap/default.nix b/pkgs/tools/misc/debootstrap/default.nix
index e70efe6c4f11..a65862a78451 100644
--- a/pkgs/tools/misc/debootstrap/default.nix
+++ b/pkgs/tools/misc/debootstrap/default.nix
@@ -4,13 +4,13 @@
 # There is also cdebootstrap now. Is that easier to maintain?
 stdenv.mkDerivation rec {
   name = "debootstrap-${version}";
-  version = "1.0.87";
+  version = "1.0.92";
 
   src = fetchurl {
     # git clone git://git.debian.org/d-i/debootstrap.git
     # I'd like to use the source. However it's lacking the lanny script ? (still true?)
     url = "mirror://debian/pool/main/d/debootstrap/debootstrap_${version}.tar.gz";
-    sha256 = "1amk3wghx4f7zfp7d8r0hgqn5gvph50qa6nvh32q2j8aihdr7374";
+    sha256 = "06gp6ivmfh0ks4mibx1mz0pwzjyxqas319s741pp9b3k091jkip1";
   };
 
   buildInputs = [ dpkg gettext gawk perl ];
diff --git a/pkgs/tools/networking/mitmproxy/default.nix b/pkgs/tools/networking/mitmproxy/default.nix
index 7348cd7f1165..f96987a1300b 100644
--- a/pkgs/tools/networking/mitmproxy/default.nix
+++ b/pkgs/tools/networking/mitmproxy/default.nix
@@ -1,82 +1,32 @@
 { stdenv, fetchpatch, fetchFromGitHub, fetchurl, python3, glibcLocales }:
 
-let
-  p = python3.override {
-    packageOverrides = self: super: {
-      cryptography = super.cryptography.overridePythonAttrs (oldAttrs: rec {
-        version = "1.8.2";
-        name = "${oldAttrs.pname}-${version}";
-        src = oldAttrs.src.override {
-          inherit version;
-          sha256 = "8e88ebac371a388024dab3ccf393bf3c1790d21bc3c299d5a6f9f83fb823beda";
-        };
-      });
-      cryptography_vectors = super.cryptography_vectors.overridePythonAttrs (oldAttrs: rec {
-        version = self.cryptography.version;
-        name = "${oldAttrs.pname}-${version}";
-        src = oldAttrs.src.override {
-          inherit version;
-          sha256 = "00daa04c9870345f56605d91d7d4897bc1b16f6fff7c74cb602b08ef16c0fb43";
-        };
-      });
-      pyopenssl = super.pyopenssl.overridePythonAttrs (oldAttrs: rec {
-        version = "17.0.0";
-        name = "${oldAttrs.pname}-${version}";
-        src = oldAttrs.src.override {
-          inherit version;
-          sha256 = "1pdg1gpmkzj8yasg6cmkhcivxcdp4c12nif88y4qvsxq5ffzxas8";
-        };
-        patches = fetchpatch {
-          url = "https://github.com/pyca/pyopenssl/commit/"
-              + "a40898b5f1d472f9449a344f703fa7f90cddc21d.patch";
-          sha256 = "0bdfrhfvdfxhfknn46s4db23i3hww6ami2r1l5rfrri0pn8b8mh7";
-        };
-      });
-    };
-  };
-in p.pkgs.buildPythonPackage rec {
+python3.pkgs.buildPythonPackage rec {
   baseName = "mitmproxy";
-  name = "${baseName}-${version}";
-  version = "2.0.2";
+  name = "${baseName}-unstable-2017-10-31";
 
   src = fetchFromGitHub {
     owner = baseName;
     repo = baseName;
-    rev = "v${version}";
-    sha256 = "1x1a28al5clpfd69rjcpw26gjjnpsm1vfl4scrwpdd1jhkw044h9";
+    rev = "80a8eaa708ea31dd9c5e7e1ab6b02c69079039c0";
+    sha256 = "0rvwm11yryzlp3c1i42rk2iv1m38yn6r83k41jb51hwg6wzbwzvw";
   };
 
-  patches = [
-    # fix tests
-    (fetchpatch {
-      url = "https://github.com/mitmproxy/mitmproxy/commit/b3525570929ba47c10d9d08696876c39487f7000.patch";
-      sha256 = "111fld5gqdii7rs1jhqaqrxgbyhfn6qd0y7l15k4npamsnvdnv20";
-    })
-    # bump pyOpenSSL
-    (fetchpatch {
-      url = https://github.com/mitmproxy/mitmproxy/commit/6af72160bf98b58682b8f9fc5aabf51928d2b1d3.patch;
-      sha256 = "1q4ml81pq9c8j9iscq8janbxf4s37w3bqskbs6r30yqzy63v54f2";
-    })
-    # https://github.com/mitmproxy/mitmproxy/commit/3d7cde058b7e6242d93b9bc9d3e17520ffb578a5
-    ./tornado-4.6.patch
-  ];
-
   checkPhase = ''
     export HOME=$(mktemp -d)
     # test_echo resolves hostnames
-    LC_CTYPE=en_US.UTF-8 pytest -k 'not test_echo'
+    LC_CTYPE=en_US.UTF-8 pytest -k 'not test_echo and not test_find_unclaimed_URLs '
   '';
 
-  propagatedBuildInputs = with p.pkgs; [
-    blinker click certifi construct cryptography
-    cssutils editorconfig h2 html2text hyperframe
-    jsbeautifier kaitaistruct passlib pyasn1 pyopenssl
+  propagatedBuildInputs = with python3.pkgs; [
+    blinker click certifi cryptography
+    h2 hyperframe
+    kaitaistruct passlib pyasn1 pyopenssl
     pyparsing pyperclip requests ruamel_yaml tornado
-    urwid watchdog brotlipy sortedcontainers
+    urwid brotlipy sortedcontainers ldap3
   ];
 
-  buildInputs = with p.pkgs; [
-    beautifulsoup4 flask pytz pytest pytestrunner protobuf glibcLocales
+  buildInputs = with python3.pkgs; [
+    beautifulsoup4 flask pytest pytestrunner glibcLocales
   ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/networking/strongswan/default.nix b/pkgs/tools/networking/strongswan/default.nix
index 7ef278e359cc..89019986bca2 100644
--- a/pkgs/tools/networking/strongswan/default.nix
+++ b/pkgs/tools/networking/strongswan/default.nix
@@ -35,6 +35,8 @@ stdenv.mkDerivation rec {
     # the configuration files. In the absence of that we patch swanctl to look
     # for configuration files in /etc/swanctl.
     substituteInPlace src/swanctl/swanctl.h --replace "SWANCTLDIR" "\"/etc/swanctl\""
+    # glibc-2.26 reorganized internal includes
+    sed '1i#include <stdint.h>' -i src/libstrongswan/utils/utils/memory.h
     '';
 
   preConfigure = ''
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index 4359682d96a0..fe7818691779 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -160,13 +160,13 @@ in rec {
   }) // { perl-bindings = nixStable; };
 
   nixUnstable = (lib.lowPrio (common rec {
-    name = "nix-1.12${suffix}";
-    suffix = "pre5663_c7af84ce";
+    name = "nix-unstable-1.12${suffix}";
+    suffix = "pre5732_fd10f6f2";
     src = fetchFromGitHub {
       owner = "NixOS";
       repo = "nix";
-      rev = "c7af84ce846a9deefa5b4db1b1bce1c091ca2a1e";
-      sha256 = "1sc6rkx0500jz4fyfqm7443s1q24whmpx10mfs12wdk516f0q8qh";
+      rev = "fd10f6f2414521947ca60b9d1508d909f50e9faa";
+      sha256 = "17561jll94c8hdpxnyvdbjslnwr9g7ii4wqvrla7gfza236j9hff";
     };
     fromGit = true;
   })) // { perl-bindings = perl-bindings { nix = nixUnstable; }; };
diff --git a/pkgs/tools/package-management/nox/default.nix b/pkgs/tools/package-management/nox/default.nix
index ed7ec74483f3..f6c5c7b53e13 100644
--- a/pkgs/tools/package-management/nox/default.nix
+++ b/pkgs/tools/package-management/nox/default.nix
@@ -25,6 +25,7 @@ pythonPackages.buildPythonApplication rec {
     homepage = https://github.com/madjar/nox;
     description = "Tools to make nix nicer to use";
     maintainers = [ lib.maintainers.madjar ];
+    license = lib.licenses.mit;
     platforms = lib.platforms.all;
   };
 }
diff --git a/pkgs/tools/security/mpw/default.nix b/pkgs/tools/security/mpw/default.nix
index e30866021da6..3e1e3a882839 100644
--- a/pkgs/tools/security/mpw/default.nix
+++ b/pkgs/tools/security/mpw/default.nix
@@ -1,50 +1,39 @@
-{ stdenv, fetchzip, autoconf, automake, openssl, libxml2, fetchFromGitHub, ncurses }:
+{ stdenv, cmake, fetchFromGitHub, ncurses, libsodium, json_c }:
 
-let
-  scrypt_src = fetchzip {
-    url = "http://www.tarsnap.com/scrypt/scrypt-1.2.0.tgz";
-    sha256 = "0ahylib2pimlhjcm566kpim6n16jci5v749xwdkr9ivgfjrv3xn4";
-  };
-
-in stdenv.mkDerivation {
-  name = "mpw-2.1-6834f36";
+stdenv.mkDerivation rec {
+  name = "mpw-2.6-f8043ae";
 
   src = fetchFromGitHub {
     owner = "Lyndir";
     repo = "MasterPassword";
-    rev = "6834f3689f5dfd4e59ad6959961d349c224977ee";
-    sha256 = "0zlpx3hb1y2l60hg961h05lb9yf3xb5phnyycvazah2674gkwb2p";
+    rev = "f8043ae16d73ddfb205aadd25c35cd9c5e95b228";
+    sha256 = "0hy02ri7y3sca85z3ff5i68crwav5cjd7rrdqj7jrnpp1bw4yapi";
   };
 
   postUnpack = ''
-    sourceRoot+=/MasterPassword/C
+    sourceRoot+=/platform-independent/cli-c
   '';
 
-  prePatch = ''
-    patchShebangs .
-    mkdir lib/scrypt/src
-    cp -R --no-preserve=ownership ${scrypt_src}/* lib/scrypt/src
-    chmod +w -R lib/scrypt/src
-    substituteInPlace lib/scrypt/src/libcperciva/cpusupport/Build/cpusupport.sh \
-      --replace dirname "$(type -P dirname)"
-    substituteInPlace lib/scrypt/src/Makefile.in --replace "command -p mv" "mv"
+  preConfigure = ''
+    substituteInPlace CMakeLists.txt --replace curses ncurses
+    echo ${name} > VERSION
   '';
 
-  NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2";
+  dontUseCmakeBuildDir = true;
 
-  buildInputs = [ autoconf automake openssl libxml2 ncurses ];
+  nativeBuildInputs = [ cmake ];
 
-  buildPhase = ''
-    substituteInPlace build --replace '"curses"' '"ncurses"'
-    targets="mpw mpw-tests" ./build
-  '';
+  buildInputs = [ ncurses libsodium json_c ];
 
   installPhase = ''
     mkdir -p $out/bin
     mv mpw $out/bin/mpw
   '';
 
-  meta = {
-    platforms = stdenv.lib.platforms.unix;
+  meta = with stdenv.lib; {
+    homepage = http://masterpasswordapp.com/;
+    description = "A stateless password management solution";
+    license = licenses.gpl3;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/tools/system/procodile/Gemfile b/pkgs/tools/system/procodile/Gemfile
new file mode 100644
index 000000000000..77e4bb430e96
--- /dev/null
+++ b/pkgs/tools/system/procodile/Gemfile
@@ -0,0 +1,2 @@
+source 'https://rubygems.org'
+gem 'procodile'
diff --git a/pkgs/tools/system/procodile/Gemfile.lock b/pkgs/tools/system/procodile/Gemfile.lock
new file mode 100644
index 000000000000..51ab44a762ab
--- /dev/null
+++ b/pkgs/tools/system/procodile/Gemfile.lock
@@ -0,0 +1,15 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    json (2.1.0)
+    procodile (1.0.17)
+      json
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  procodile
+
+BUNDLED WITH
+   1.14.6
diff --git a/pkgs/tools/system/procodile/default.nix b/pkgs/tools/system/procodile/default.nix
new file mode 100644
index 000000000000..3a5cb1b4965d
--- /dev/null
+++ b/pkgs/tools/system/procodile/default.nix
@@ -0,0 +1,22 @@
+{ lib, bundlerEnv, ruby, stdenv }:
+
+bundlerEnv rec {
+  name = "procodile-${version}";
+
+  gemfile = ./Gemfile;
+  lockfile = ./Gemfile.lock;
+  gemset = ./gemset.nix;
+
+  version = (import gemset).procodile.version;
+  inherit ruby;
+
+  gemdir = ./.;
+
+  meta = with lib; {
+    description = "Run processes in the background (and foreground) on Mac & Linux from a Procfile (for production and/or development environments)";
+    homepage    = https://adam.ac/procodile;
+    license     = with licenses; mit;
+    maintainers = [ maintainers.ravloony ];
+    platforms   = platforms.unix;
+  };
+}
diff --git a/pkgs/tools/system/procodile/gemset.nix b/pkgs/tools/system/procodile/gemset.nix
new file mode 100644
index 000000000000..8216159ad940
--- /dev/null
+++ b/pkgs/tools/system/procodile/gemset.nix
@@ -0,0 +1,19 @@
+{
+  json = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "01v6jjpvh3gnq6sgllpfqahlgxzj50ailwhj9b3cd20hi2dx0vxp";
+      type = "gem";
+    };
+    version = "2.1.0";
+  };
+  procodile = {
+    dependencies = ["json"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1gfms2h4k9zqq7jn04nphibcsjykgxiqwdyyz2r4kq428a25kqsf";
+      type = "gem";
+    };
+    version = "1.0.17";
+  };
+}
\ No newline at end of file
diff --git a/pkgs/tools/system/vboot_reference/default.nix b/pkgs/tools/system/vboot_reference/default.nix
index 0b8933bb7af3..e410ef1cee50 100644
--- a/pkgs/tools/system/vboot_reference/default.nix
+++ b/pkgs/tools/system/vboot_reference/default.nix
@@ -17,17 +17,17 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  buildPhase = ''
+  patches = [ ./dont_static_link.patch ];
+
+  preBuild = ''
     patchShebangs scripts
-    make -j''${NIX_BUILD_CORES:-1} \
-         `pwd`/build/cgpt/cgpt \
-         `pwd`/build/futility/futility
   '';
 
-  installPhase = ''
-    mkdir -p $out/bin
-    cp build/cgpt/cgpt $out/bin
-    cp build/futility/futility $out/bin
+  makeFlags = [
+    "DESTDIR=$(out)"
+  ];
+
+  postInstall = ''
     mkdir -p $out/share/vboot
     cp -r tests/devkeys* $out/share/vboot/
   '';
diff --git a/pkgs/tools/system/vboot_reference/dont_static_link.patch b/pkgs/tools/system/vboot_reference/dont_static_link.patch
new file mode 100644
index 000000000000..506b942e246e
--- /dev/null
+++ b/pkgs/tools/system/vboot_reference/dont_static_link.patch
@@ -0,0 +1,30 @@
+---
+--- a/Makefile
++++ b/Makefile
+@@ -964,7 +964,7 @@ ${UTILLIB21}: ${UTILLIB21_OBJS} ${FWLIB2
+ # Link tests for external repos
+ ${BUILD}/host/linktest/extern: ${HOSTLIB}
+ ${BUILD}/host/linktest/extern: LIBS = ${HOSTLIB}
+-${BUILD}/host/linktest/extern: LDLIBS += -static
++#${BUILD}/host/linktest/extern: LDLIBS += -static
+ TEST_OBJS += ${BUILD}/host/linktest/extern.o
+ 
+ .PHONY: hostlib
+@@ -1056,7 +1056,7 @@ ${UTIL_BINS} ${UTIL_BINS_STATIC}: ${UTIL
+ ${UTIL_BINS} ${UTIL_BINS_STATIC}: LIBS = ${UTILLIB}
+ 
+ # Utilities for auto-update toolkits must be statically linked.
+-${UTIL_BINS_STATIC}: LDFLAGS += -static
++${UTIL_BINS_STATIC}:
+ 
+ 
+ .PHONY: utils
+@@ -1089,7 +1089,7 @@ futil: ${FUTIL_STATIC_BIN} ${FUTIL_BIN}
+ 
+ ${FUTIL_STATIC_BIN}: ${FUTIL_STATIC_OBJS} ${UTILLIB}
+ 	@${PRINTF} "    LD            $(subst ${BUILD}/,,$@)\n"
+-	${Q}${LD} -o $@ ${CFLAGS} ${LDFLAGS} -static $^ ${LDLIBS}
++	${Q}${LD} -o $@ ${CFLAGS} ${LDFLAGS} $^ ${LDLIBS}
+ 
+ ${FUTIL_BIN}: LDLIBS += ${CRYPTO_LIBS}
+ ${FUTIL_BIN}: ${FUTIL_OBJS} ${UTILLIB}
diff --git a/pkgs/tools/text/gawk/default.nix b/pkgs/tools/text/gawk/default.nix
index 415a2ade28db..65d0a1e4c00a 100644
--- a/pkgs/tools/text/gawk/default.nix
+++ b/pkgs/tools/text/gawk/default.nix
@@ -19,11 +19,11 @@ let
   inherit (stdenv.lib) optional;
 in
 stdenv.mkDerivation rec {
-  name = "gawk-4.1.4";
+  name = "gawk-4.2.0";
 
   src = fetchurl {
     url = "mirror://gnu/gawk/${name}.tar.xz";
-    sha256 = "0rn2mmjxm767zliqzd67j7h2ncjn4j0321c60y9fy3grs3i89qak";
+    sha256 = "1wm9lqj77y7xz07zi0n187aqm8zavzxzpm1j53ahxz81q0qwvwyl";
   };
 
   # When we do build separate interactive version, it makes sense to always include man.
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 983dacda0449..82c4465452d2 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1080,6 +1080,8 @@ with pkgs;
 
   go-dependency-manager = callPackage ../development/tools/gdm { };
 
+  geckodriver = callPackage ../development/tools/geckodriver { };
+
   geekbench = callPackage ../tools/misc/geekbench { };
 
   gencfsm = callPackage ../tools/security/gencfsm { };
@@ -4379,6 +4381,8 @@ with pkgs;
 
   sigil = libsForQt56.callPackage ../applications/editors/sigil { };
 
+  signal-desktop = callPackage ../applications/networking/instant-messengers/signal-desktop { };
+
   # aka., pgp-tools
   signing-party = callPackage ../tools/security/signing-party { };
 
@@ -6020,6 +6024,7 @@ with pkgs;
 
   julia_05 = callPackage ../development/compilers/julia/0.5.nix {
     gmp = gmp6;
+    libgit2 = libgit2_0_25;
     openblas = openblasCompat;
     inherit (darwin.apple_sdk.frameworks) CoreServices ApplicationServices;
     llvm = llvm_38;
@@ -7481,6 +7486,8 @@ with pkgs;
 
   premake = premake4;
 
+  procodile = callPackage ../tools/system/procodile { };
+
   qtcreator = libsForQt5.callPackage ../development/qtcreator { };
 
   r10k = callPackage ../tools/system/r10k { };
@@ -7593,7 +7600,7 @@ with pkgs;
     flex = flex_2_5_35;
   };
 
-  sqlitebrowser = libsForQt56.callPackage ../development/tools/database/sqlitebrowser { };
+  sqlitebrowser = libsForQt5.callPackage ../development/tools/database/sqlitebrowser { };
 
   sselp = callPackage ../tools/X11/sselp{ };
 
@@ -8293,11 +8300,13 @@ with pkgs;
 
   icon-lang = callPackage ../development/interpreters/icon-lang { };
 
-  libgit2 = callPackage ../development/libraries/git2 (
-    stdenv.lib.optionalAttrs stdenv.isDarwin {
+  inherit (rec {
+    arg = stdenv.lib.optionalAttrs stdenv.isDarwin {
       inherit (darwin) libiconv;
-    }
-  );
+    };
+    libgit2 = callPackage ../development/libraries/git2 arg;
+    libgit2_0_25 = callPackage ../development/libraries/git2/0.25.nix arg;
+  }) libgit2 libgit2_0_25;
 
   gle = callPackage ../development/libraries/gle { };
 
@@ -9254,6 +9263,8 @@ with pkgs;
 
   libnice = callPackage ../development/libraries/libnice { };
 
+  libnsl = callPackage ../development/libraries/libnsl { };
+
   liboping = callPackage ../development/libraries/liboping { };
 
   libplist = callPackage ../development/libraries/libplist { };
@@ -10579,6 +10590,7 @@ with pkgs;
     openglSupport = mesaSupported;
     alsaSupport = stdenv.isLinux;
     x11Support = !stdenv.isCygwin;
+    waylandSupport = stdenv.isLinux;
     udevSupport = stdenv.isLinux;
     pulseaudioSupport = config.pulseaudio or stdenv.isLinux;
     inherit (darwin.apple_sdk.frameworks) AudioUnit Cocoa CoreAudio CoreServices ForceFeedback OpenGL;
@@ -11493,6 +11505,8 @@ with pkgs;
 
   exhibitor = callPackage ../servers/exhibitor { };
 
+  hyp = callPackage ../servers/http/hyp/default.nix { };
+
   prosody = callPackage ../servers/xmpp/prosody {
     lua5 = lua5_1;
     inherit (lua51Packages) luasocket luasec luaexpat luafilesystem luabitop luaevent luazlib;
@@ -15475,8 +15489,10 @@ with pkgs;
 
   llpp = ocaml-ng.ocamlPackages.callPackage ../applications/misc/llpp { };
 
-  lmms = callPackage ../applications/audio/lmms {
-    stdenv = overrideCC stdenv gcc5;
+  lmms = libsForQt5.callPackage ../applications/audio/lmms {
+    lame = null;
+    libsoundio = null;
+    portaudio = null;
   };
 
   loxodo = callPackage ../applications/misc/loxodo { };
@@ -16359,6 +16375,8 @@ with pkgs;
 
   recode = callPackage ../tools/text/recode { };
 
+  rednotebook = python3Packages.callPackage ../applications/editors/rednotebook { };
+
   remotebox = callPackage ../applications/virtualization/remotebox { };
 
   retroshare = libsForQt5.callPackage ../applications/networking/p2p/retroshare { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index b42195e3630b..c1578987570b 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1257,25 +1257,6 @@ in {
     };
   };
 
-  beautifulsoup = buildPythonPackage (rec {
-    name = "beautifulsoup-3.2.1";
-    disabled = isPy3k;
-
-    src = pkgs.fetchurl {
-      url = "http://www.crummy.com/software/BeautifulSoup/download/3.x/BeautifulSoup-3.2.1.tar.gz";
-      sha256 = "1nshbcpdn0jpcj51x0spzjp519pkmqz0n0748j7dgpz70zlqbfpm";
-    };
-
-    # error: invalid command 'test'
-    doCheck = false;
-
-    meta = {
-      homepage = http://www.crummy.com/software/BeautifulSoup/;
-      license = "bsd";
-      description = "Undemanding HTML/XML parser";
-    };
-  });
-
   beautifulsoup4 = callPackage ../development/python-modules/beautifulsoup4 { };
 
   beaker = buildPythonPackage rec {
@@ -1330,24 +1311,9 @@ in {
     };
   };
 
-  betamax-matchers = buildPythonPackage rec {
-    name = "betamax-matchers-${version}";
-    version = "0.3.0";
+  betamax-matchers = callPackage ../development/python-modules/betamax-matchers { };
 
-    src = pkgs.fetchurl {
-       url = "mirror://pypi/b/betamax-matchers/${name}.tar.gz";
-      sha256 = "039kvqsdcvvlfxjc3n1x2xvjg6qkqbql0p7rc4z7bnxm9kcm88la";
-    };
-
-    buildInputs = with self; [ betamax requests_toolbelt ];
-
-    meta = with stdenv.lib; {
-      homepage = https://github.com/sigmavirus24/betamax_matchers;
-      description = "A group of experimental matchers for Betamax";
-      license = licenses.asl20;
-      maintainers = with maintainers; [ pSub ];
-    };
-  };
+  betamax-serializers = callPackage ../development/python-modules/betamax-serializers { };
 
   bibtexparser = callPackage ../development/python-modules/bibtexparser { };
 
@@ -2756,24 +2722,6 @@ in {
 
   cligj = callPackage ../development/python-modules/cligj { };
 
-  clientform = buildPythonPackage (rec {
-    name = "clientform-0.2.10";
-    disabled = isPy3k;
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/C/ClientForm/ClientForm-0.2.10.tar.gz";
-      sha256 = "0dydh3i1sx7rrj6d0gj375wkjpiivm7jjlsimw6hmwv4ck7yf1wm";
-    };
-
-    meta = {
-      homepage = http://wwwsearch.sourceforge.net/ClientForm/;
-
-      license = "bsd";
-
-      description = "Python module for handling HTML forms on the client side";
-    };
-  });
-
   /* There is a project called "closure-linter" on PyPI that is the
      same as this, but it does not appear to be owned by Google.
      So we're pulling from Google's GitHub repo instead. */
@@ -3022,30 +2970,6 @@ in {
   });
 
 
-  configshell_fb = buildPythonPackage rec {
-    version = "1.1.fb10";
-    name = "configshell-fb-${version}";
-
-    src = pkgs.fetchurl {
-      url = "https://github.com/agrover/configshell-fb/archive/v${version}.tar.gz";
-      sha256 = "1dd87xvm98nk3jzybb041gjdahi2z9b53pwqhyxcfj4a91y82ndy";
-    };
-
-    propagatedBuildInputs = with self; [
-      pyparsing
-      urwid
-    ];
-
-    # Fails on python 3 due to a None value where a string is expected
-    doCheck = !isPy3k;
-
-    meta = {
-      description = "A Python library for building configuration shells";
-      homepage = "https://github.com/agrover/configshell-fb";
-      platforms = platforms.linux;
-    };
-  };
-
   confluent-kafka = callPackage ../development/python-modules/confluent-kafka {};
 
   construct = callPackage ../development/python-modules/construct {};
@@ -4658,30 +4582,6 @@ in {
     };
   };
 
-  deform_bootstrap = buildPythonPackage rec {
-    name = "deform_bootstrap-0.2.9";
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/d/deform_bootstrap/${name}.tar.gz";
-      sha256 = "1hgq3vqsfqdmlyahnlc40w13viawhpzqf4jzigsggdb41x545fda";
-    };
-
-    buildInputs = [ self.mock ];
-    propagatedBuildInputs = with self; [ deform pyramid ];
-
-    # demo is removed as it depends on deformdemo
-    patchPhase = ''
-      rm -rf deform_bootstrap/demo
-    '';
-
-    meta = {
-      maintainers = with maintainers; [ domenkozar ];
-      platforms = platforms.all;
-    };
-  };
-
-  demjson = callPackage ../development/python-modules/demjson { };
-
   derpconf = self.buildPythonPackage rec {
     name = "derpconf-0.4.9";
 
@@ -5680,27 +5580,6 @@ in {
 
   google-compute-engine = callPackage ../tools/virtualization/google-compute-engine { };
 
-  googlecl = buildPythonPackage rec {
-    version = "0.9.14";
-    name    = "googlecl-${version}";
-    disabled = isPy3k;
-
-    src = pkgs.fetchurl {
-      url    = "https://googlecl.googlecode.com/files/${name}.tar.gz";
-      sha256 = "0nnf7xkr780wivr5xnchfcrahlzy9bi2dxcs1w1bh1014jql0iha";
-    };
-
-    meta = {
-      description = "Brings Google services to the command line";
-      homepage    = https://code.google.com/p/googlecl/;
-      license     = licenses.asl20;
-      maintainers = with maintainers; [ lovek323 ];
-      platforms   = platforms.unix;
-    };
-
-    propagatedBuildInputs = with self; [ gdata ];
-  };
-
   gplaycli = buildPythonPackage rec {
     version = "0.1.2";
     name = "gplaycli-${version}";
@@ -6188,35 +6067,6 @@ in {
     };
   };
 
-  ledger-autosync = buildPythonPackage rec {
-    name = "ledger-autosync-${version}";
-    version = "0.2.3";
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/l/ledger-autosync/ledger-autosync-${version}.tar.gz";
-      sha256 = "f19fa66e656309825887171d84a462e64676b1cc36b62e4dd8679ff63926a469";
-    };
-
-    propagatedBuildInputs = with self; [ ofxclient ];
-
-    buildInputs = with self; [
-      mock
-      nose
-      # Used at runtime to translate ofx entries to the ledger
-      # format. In fact, user could use either ledger or hledger.
-      pkgs.which
-      pkgs.ledger ];
-
-    # Tests are disable since they require hledger and python-ledger
-    doCheck = false;
-
-    meta = {
-      homepage = https://gitlab.com/egh/ledger-autosync;
-      description = "ledger-autosync is a program to pull down transactions from your bank and create ledger transactions for them";
-      license = licenses.gpl3;
-      maintainers = with maintainers; [ lewo ];
-    };
-  };
-
   libsexy = callPackage ../development/python-modules/libsexy {
     libsexy = pkgs.libsexy;
   };
@@ -7199,19 +7049,6 @@ in {
   };
 
 
-  pyramid_debugtoolbar = buildPythonPackage rec {
-    name = "pyramid_debugtoolbar-1.0.9";
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/p/pyramid_debugtoolbar/${name}.tar.gz";
-      sha256 = "1vnzg1qnnyisv7znxg7pasayfyr3nz7rrs5nqr4fmdgwj9q2pyv0";
-    };
-
-    buildInputs = with self; [ ];
-    propagatedBuildInputs = with self; [ pyramid pyramid_mako ];
-  };
-
-
   pyramid_mako = buildPythonPackage rec {
     name = "pyramid_mako-0.3.1";
 
@@ -7478,25 +7315,6 @@ in {
 
   subliminal = callPackage ../development/python-modules/subliminal {};
 
-  hyp = buildPythonPackage rec {
-    name = "hyp-server-${version}";
-    version = "1.2.0";
-    disabled = !isPy3k;
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/h/hyp-server/${name}.tar.gz";
-      sha256 = "1lafjdcn9nnq6xc3hhyizfwh6l69lc7rixn6dx65aq71c913jc15";
-    };
-
-    meta = {
-      description = "Hyperminimal https server";
-      homepage = https://github.com/rnhmjoj/hyp;
-      license = with licenses; [gpl3Plus mit];
-      maintainers = with maintainers; [ rnhmjoj ];
-      platforms = platforms.unix;
-    };
-  };
-
   hyperlink = callPackage ../development/python-modules/hyperlink {};
 
   zope_copy = buildPythonPackage rec {
@@ -7749,30 +7567,6 @@ in {
   };
 
 
-  rtmidi = buildPythonPackage rec {
-    version = "0.3a";
-    name = "rtmidi-${version}";
-
-    src = pkgs.fetchurl {
-      url = "http://chrisarndt.de/projects/python-rtmidi/download/python-${name}.tar.bz2";
-      sha256 = "0d2if633m3kbiricd5hgn1csccd8xab6lnab1bq9prdr9ks9i8h6";
-    };
-
-    preConfigure = ''
-      sed -i "/use_setuptools/d" setup.py
-    '';
-
-    buildInputs = with self; [ pkgs.alsaLib pkgs.libjack2 ];
-
-    meta = {
-      description = "A Python wrapper for the RtMidi C++ library written with Cython";
-      homepage = http://trac.chrisarndt.de/code/wiki/python-rtmidi;
-      license = licenses.mit;
-      maintainers = with maintainers; [ goibhniu ];
-    };
-  };
-
-
   setuptools-git = buildPythonPackage rec {
     name = "setuptools-git-${version}";
     version = "1.1";
@@ -8431,22 +8225,6 @@ in {
     };
   };
 
-  doxypy = buildPythonPackage rec {
-    name = "doxypy-0.4.2";
-
-    src = pkgs.fetchurl {
-      url = "http://code.foosel.org/files/${name}.tar.gz";
-      sha256 = "1afmb30zmy7942b53qa5vd3js883wwqqls35n8xfb3rnj0qnll8g";
-    };
-
-    meta = {
-      homepage = http://code.foosel.org/doxypy;
-      description = "An input filter for Doxygen";
-    };
-
-    doCheck = false;
-  };
-
 
   dtopt = buildPythonPackage rec {
     name = "dtopt-0.1";
@@ -8656,30 +8434,8 @@ in {
     };
   };
 
-  fastimport = buildPythonPackage rec {
-    name = "fastimport-${version}";
-    version = "0.9.4";
-
-    # Judging from SyntaxError
-    disabled = isPy3k;
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/f/fastimport/${name}.tar.gz";
-      sha256 = "0k8x7552ypx9rc14vbsvg2lc6z0r8pv9laah28pdwyynbq10825d";
-    };
-
-    checkPhase = ''
-      ${python.interpreter} -m unittest discover
-    '';
-
-    meta = {
-      homepage = https://launchpad.net/python-fastimport;
-      description = "VCS fastimport/fastexport parser";
-      maintainers = with maintainers; [ koral ];
-      license = licenses.gpl2Plus;
-    };
-  };
-
+  fastimport = callPackage ../development/python-modules/fastimport { };
+ 
   feedgen = callPackage ../development/python-modules/feedgen { };
 
   feedgenerator = callPackage ../development/python-modules/feedgenerator {
@@ -9010,27 +8766,6 @@ in {
 
   pytorch = callPackage ../development/python-modules/pytorch { };
 
-  python_tvrage = buildPythonPackage (rec {
-    version = "0.4.1";
-    name = "tvrage-${version}";
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/p/python-tvrage/python-tvrage-${version}.tar.gz";
-      sha256 = "f8a530376c5cf1bc573d1945a8504c3394b228c731a3eff5100c705997a72063";
-    };
-
-    # has mostly networking dependent tests
-    doCheck = false;
-    propagatedBuildInputs = with self; [ beautifulsoup ];
-
-    meta = {
-      homepage = https://github.com/ckreutzer/python-tvrage;
-      description = "Client interface for tvrage.com's XML-based api feeds";
-      license = licenses.bsd3;
-      maintainers = with maintainers; [ domenkozar ];
-    };
-  });
-
   python2-pythondialog = buildPythonPackage rec {
     name = "python2-pythondialog-${version}";
     version = "3.3.0";
@@ -9241,25 +8976,7 @@ in {
     };
   };
 
-  fuse = buildPythonPackage (rec {
-    baseName = "fuse";
-    version = "0.2.1";
-    name = "${baseName}-${version}";
-    disabled = isPy3k;
-
-    src = pkgs.fetchurl {
-      url = "mirror://sourceforge/fuse/fuse-python-${version}.tar.gz";
-      sha256 = "06rmp1ap6flh64m81j0n3a357ij2vj9zwcvvw0p31y6hz1id9shi";
-    };
-
-    nativeBuildInputs = [ pkgs.pkgconfig ];
-    buildInputs = with self; [ pkgs.fuse ];
-
-    meta = {
-      description = "Python bindings for FUSE";
-      license = licenses.lgpl21;
-    };
-  });
+  fuse = callPackage ../development/python-modules/python-fuse { fuse = pkgs.fuse; };
 
   fusepy = buildPythonPackage rec {
     name = "fusepy-2.0.4";
@@ -11249,7 +10966,7 @@ in {
       sha256 = "0rki9nl4y42q694parafcsdcdqvkdjckrbg6n0691302lfsrkyfl";
     };
 
-    propagatedBuildInputs = with self; [ clientform html5lib ];
+    propagatedBuildInputs = with self; [ html5lib ];
 
     doCheck = false;
 
@@ -11591,39 +11308,9 @@ in {
     };
   };
 
-  hyperframe = buildPythonPackage rec {
-    name = "hyperframe-${version}";
-    version = "4.0.1";
+  hyperframe = callPackage ../development/python-modules/hyperframe { };
 
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/h/hyperframe/${name}.tar.gz";
-      sha256 = "0hsfq0jigwa0i58z7vbnp62l7za49gmlg75vnygq2ijhkidkcmwa";
-    };
-
-    meta = {
-      description = "HTTP/2 framing layer for Python";
-      homepage = "http://hyper.rtfd.org/";
-      license = licenses.mit;
-    };
-  };
-
-  h2 = buildPythonPackage rec {
-    name = "h2-${version}";
-    version = "2.5.1";
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/h/h2/${name}.tar.gz";
-      sha256 = "0xhzm5vcfhdq3mihynwh4ljwi0r06lvzk3ypr0gmmbcp1x43ffb7";
-    };
-
-    propagatedBuildInputs = with self; [ enum34 hpack hyperframe ];
-
-    meta = {
-      description = "HTTP/2 State-Machine based protocol implementation";
-      homepage = "http://hyper.rtfd.org/";
-      license = licenses.mit;
-    };
-  };
+  h2 = callPackage ../development/python-modules/h2 { };
 
   editorconfig = buildPythonPackage rec {
     name = "EditorConfig-${version}";
@@ -12631,23 +12318,6 @@ in {
 
   nose-exclude = callPackage ../development/python-modules/nose-exclude { };
 
-  nose-selecttests = buildPythonPackage rec {
-    version = "0.4";
-    name = "nose-selecttests-${version}";
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/n/nose-selecttests/${name}.zip";
-      sha256 = "0lgrfgp3sq8xi8d9grrg0z8jsyk0wl8a3rxw31hb7vdncin5b7n5";
-    };
-
-    propagatedBuildInputs = with self; [ nose ];
-
-    meta = {
-      description = "Simple nose plugin that enables developers to run subset of collected tests to spare some waiting time for better things";
-    };
-  };
-
-
   nose2 = if isPy26 then null else (buildPythonPackage rec {
     name = "nose2-0.5.0";
     src = pkgs.fetchurl {
@@ -13829,21 +13499,7 @@ in {
 
   pecan = callPackage ../development/python-modules/pecan { };
 
-  kaitaistruct = buildPythonPackage rec {
-    name = "kaitaistruct-${version}";
-    version = "0.6";
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/k/kaitaistruct/${name}.tar.gz";
-      sha256 = "0rwcrlz7f2bwmypqa38pag492bp71wp1bhz51hsaynjjyr9knr12";
-    };
-
-    meta = with stdenv.lib; {
-      description = "Kaitai Struct: runtime library for Python";
-      homepage = "https://github.com/kaitai-io/kaitai_struct_python_runtime";
-      license = licenses.mit;
-    };
-  };
+  kaitaistruct = callPackage ../development/python-modules/kaitaistruct { };
 
   Kajiki = buildPythonPackage rec {
     name = "Kajiki-${version}";
@@ -15351,34 +15007,9 @@ in {
     };
   };
 
-  praw = buildPythonPackage rec {
-    name = "praw-3.5.0";
+  praw = callPackage ../development/python-modules/praw { };
 
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/p/praw/${name}.zip";
-      sha256 = "1hwdzqbrjdkicqhyxpcpsmld21k0ndpy8d2gk6l5mv9isw3dm8qa";
-    };
-
-    propagatedBuildInputs = with self; [
-      requests
-      decorator
-      flake8
-      mock
-      six
-      update_checker
-    ];
-
-    # can't find the tests module?
-    doCheck = false;
-
-    meta = {
-      description = "Python Reddit API wrapper";
-      homepage = http://praw.readthedocs.org/;
-      license = licenses.gpl3;
-      platforms = platforms.all;
-      maintainers = with maintainers; [ jgeerds ];
-    };
-  };
+  prawcore = callPackage ../development/python-modules/prawcore { };
 
   premailer = callPackage ../development/python-modules/premailer { };
 
@@ -15556,41 +15187,9 @@ in {
   };
 
 
-  pyasn1 = buildPythonPackage rec {
-    name = "pyasn1-0.1.9";
+  pyasn1 = callPackage ../development/python-modules/pyasn1 { };
 
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/p/pyasn1/${name}.tar.gz";
-      sha256 = "0zraxni14bqi20kr4bi6nwsh32aibz0fq0xaczfisw0zdpcsqg45";
-    };
-
-    meta = {
-      description = "ASN.1 tools for Python";
-      homepage = http://pyasn1.sourceforge.net/;
-      license = "mBSD";
-      platforms = platforms.unix;  # arbitrary choice
-    };
-  };
-
-  pyasn1-modules = buildPythonPackage rec {
-    name = "pyasn1-modules-${version}";
-    version = "0.0.8";
-    disabled = isPyPy;
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/p/pyasn1-modules/${name}.tar.gz";
-      sha256 = "0drqgw81xd3fxdlg89kgd79zzrabvfncvkbybi2wr6w2y4s1jmhh";
-    };
-
-    propagatedBuildInputs = with self; [ pyasn1 ];
-
-    meta = {
-      description = "A collection of ASN.1-based protocols modules";
-      homepage = https://pypi.python.org/pypi/pyasn1-modules;
-      license = licenses.bsd3;
-      platforms = platforms.unix;  # same as pyasn1
-    };
-  };
+  pyasn1-modules = callPackage ../development/python-modules/pyasn1-modules { };
 
   pyaudio = buildPythonPackage rec {
     name = "python-pyaudio-${version}";
@@ -15761,45 +15360,7 @@ in {
     };
   };
 
-  pygit2 = buildPythonPackage rec {
-    name = "pygit2-0.25.1";
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/p/pygit2/${name}.tar.gz";
-      sha256 = "0sja3g9mqwp5bnhdc313b2gc4z3p70nn6zzf2h8j581g0lrn0sg8";
-    };
-
-    # Fixes a bug which can cause test failed when cffi==1.10
-    prePatch = let
-      cffiVersionPatch = pkgs.fetchurl {
-        url = "https://github.com/libgit2/pygit2/commit/b88dc868423af2f760f649960112efd0e37e5335.patch";
-        sha256 = "14cfrz56y2dnwlxrrss9pjhxfnyyg5856gbabzjzyx674k0qcid4";
-      };
-    in ''
-      # we need to delete part of the patch because the missing .travis.yml causes problem
-      sed -e '1,36d' ${cffiVersionPatch} | patch -p1
-    '';
-
-    preConfigure = ( if stdenv.isDarwin then ''
-      export DYLD_LIBRARY_PATH="${pkgs.libgit2}/lib"
-    '' else "" );
-
-    propagatedBuildInputs = with self; [ pkgs.libgit2 six ] ++ optionals (!isPyPy) [ cffi ];
-
-    preCheck = ''
-      # disable tests that require networking
-      rm test/test_repository.py
-      rm test/test_credentials.py
-      rm test/test_submodule.py
-    '';
-
-    meta = {
-      homepage = https://pypi.python.org/pypi/pygit2;
-      description = "A set of Python bindings to the libgit2 shared library";
-      license = licenses.gpl2;
-      platforms = platforms.all;
-    };
-  };
+  pygit2 = callPackage ../development/python-modules/pygit2 { };
 
   Babel = buildPythonPackage (rec {
     name = "Babel-2.3.4";
@@ -16243,8 +15804,6 @@ in {
      };
    };
 
-  pyfeed = callPackage ../development/python-modules/pyfeed { };
-
   pyfftw = callPackage ../development/python-modules/pyfftw { };
 
   pyfiglet = callPackage ../development/python-modules/pyfiglet { };
@@ -16922,25 +16481,7 @@ in {
     inherit (pkgs) openldap cyrus_sasl openssl;
   };
 
-  ldap3 = buildPythonPackage rec {
-    version = "1.0.4";
-    name = "ldap3-${version}";
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/l/ldap3/${name}.tar.gz";
-      sha256 = "0j4qqj9vq022hy7wfqn8s0j4vm2g6paabbzas1vbyspawvcfai98";
-    };
-
-    buildInputs = with self; [ gssapi ];
-
-    propagatedBuildInputs = with self; [ pyasn1 ];
-
-    meta = {
-      homepage = https://pypi.python.org/pypi/ldap3;
-      description = "A strictly RFC 4510 conforming LDAP V3 pure Python client library";
-      license = licenses.lgpl3;
-    };
-  };
+  ldap3 = callPackage ../development/python-modules/ldap3 {};
 
   ptest = buildPythonPackage rec {
     name = pname + "-" + version;
@@ -16975,25 +16516,7 @@ in {
     };
   };
 
-  pylibacl = buildPythonPackage (rec {
-    name = "pylibacl-0.5.1";
-
-    src = pkgs.fetchurl {
-      url = "https://github.com/downloads/iustin/pylibacl/${name}.tar.gz";
-      sha256 = "1idks7j9bn62xzsaxkvhl7bdq6ws8kv8aa0wahfh7724qlbbcf1k";
-    };
-
-    # ERROR: testExtended (tests.test_acls.AclExtensions)
-    # IOError: [Errno 0] Error
-    doCheck = false;
-
-    buildInputs = with self; [ pkgs.acl ];
-
-    meta = {
-      description = "A Python extension module for POSIX ACLs, it can be used to query, list, add, and remove ACLs from files and directories under operating systems that support them";
-      license = licenses.lgpl21Plus;
-    };
-  });
+  pylibacl = callPackage ../development/python-modules/pylibacl { };
 
   pyliblo = buildPythonPackage rec {
     name = "pyliblo-${version}";
@@ -17015,29 +16538,6 @@ in {
     };
   };
 
-  pymacs = buildPythonPackage rec {
-    version = "0.25";
-    name = "pymacs-${version}";
-    disabled = isPy3k || isPyPy;
-
-    src = pkgs.fetchurl {
-      url = "https://github.com/pinard/Pymacs/tarball/v${version}";
-      name = "${name}.tar.gz";
-      sha256 = "1hmy76c5igm95rqbld7gvk0az24smvc8hplfwx2f5rhn6frj3p2i";
-    };
-
-    configurePhase = "make";
-
-    doCheck = false;
-
-    meta = {
-      description = "Emacs Lisp to Python interface";
-      homepage = http://pymacs.progiciels-bpi.ca;
-      license = licenses.gpl2;
-      maintainers = with maintainers; [ goibhniu ];
-    };
-  };
-
   pypcap = callPackage ../development/python-modules/pypcap {};
 
   pyplatec = buildPythonPackage rec {
@@ -17583,25 +17083,7 @@ in {
 
   pywinrm = callPackage ../development/python-modules/pywinrm { };
 
-  pyxattr = buildPythonPackage (rec {
-    name = "pyxattr-0.5.1";
-
-    src = pkgs.fetchurl {
-      url = "https://github.com/downloads/iustin/pyxattr/${name}.tar.gz";
-      sha256 = "0jmkffik6hdzs7ng8c65bggss2ai40nm59jykswdf5lpd36cxddq";
-    };
-
-    # error: invalid command 'test'
-    doCheck = false;
-
-    buildInputs = with self; [ pkgs.attr ];
-
-    meta = {
-      description = "A Python extension module which gives access to the extended attributes for filesystem objects available in some operating systems";
-      license = licenses.lgpl21Plus;
-    };
-  });
-
+  pyxattr = callPackage ../development/python-modules/pyxattr { };
 
   pyaml = buildPythonPackage (rec {
     name = "pyaml-15.02.1";
@@ -17921,27 +17403,6 @@ in {
     };
   };
 
-  requests_oauth2 = buildPythonPackage rec {
-    name = "requests-oauth2-0.1.1";
-    # python3 does not support relative imports
-    disabled = isPy3k;
-
-    src = pkgs.fetchurl {
-      url = https://github.com/maraujop/requests-oauth2/archive/0.1.1.tar.gz;
-      sha256 = "1aij66qg9j5j4vzyh64nbg72y7pcafgjddxsi865racsay43xfqg";
-    };
-
-    propagatedBuildInputs = with self; [ requests ];
-    # no tests in tarball
-    doCheck = false;
-
-    meta = {
-      description = "Python's Requests OAuth2 (Open Authentication) plugin";
-      homepage = https://github.com/maraujop/requests-oauth2;
-    };
-  };
-
-
   restview = callPackage ../development/python-modules/restview { };
 
   readme = buildPythonPackage rec {
@@ -18237,44 +17698,6 @@ in {
     };
   };
 
-  ropemacs = buildPythonPackage rec {
-    version = "0.7";
-    name = "ropemacs-${version}";
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/r/ropemacs/${name}.tar.gz";
-      sha256 = "1x5qf1drcdz9jfiiakc60kzqkb3ahsg9j902c5byf3gjfacdrmqj";
-    };
-
-    propagatedBuildInputs = with self; [ ropemode ];
-
-     meta = {
-       description = "A plugin for performing python refactorings in emacs";
-       homepage = http://rope.sf.net/ropemacs.html;
-       maintainers = with maintainers; [ goibhniu ];
-       license = licenses.gpl2;
-     };
-  };
-
-  ropemode = buildPythonPackage rec {
-    version = "0.2";
-    name = "ropemode-${version}";
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/r/ropemode/${name}.tar.gz";
-      sha256 = "0jw6h1wvk6wk0wknqdf7s9pw76m8472jv546lqdd88jbl2scgcjl";
-    };
-
-    propagatedBuildInputs = with self; [ rope ];
-
-     meta = {
-       description = "A plugin for performing python refactorings in emacs";
-       homepage = http://rope.sf.net;
-       maintainers = with maintainers; [ goibhniu ];
-       license = licenses.gpl2;
-     };
-  };
-
   ropper = callPackage ../development/python-modules/ropper { };
 
   routes = buildPythonPackage rec {
@@ -18471,22 +17894,6 @@ in {
     };
   };
 
-  rtslib_fb = buildPythonPackage rec {
-    version = "2.1.fb43";
-    name = "rtslib-fb-${version}";
-
-    src = pkgs.fetchurl {
-      url = "https://github.com/agrover/rtslib-fb/archive/v${version}.tar.gz";
-      sha256 = "1b59vyy12g6rix9l2fxx0hjiq33shkb79v57gwffs57vh74wc53v";
-    };
-
-    meta = {
-      description = "A Python object API for managing the Linux LIO kernel target";
-      homepage = "https://github.com/agrover/rtslib-fb";
-      platforms = platforms.linux;
-    };
-  };
-
   s3transfer = buildPythonPackage rec {
     version = "0.1.10";
     name = "s3transfer-${version}";
@@ -18630,36 +18037,7 @@ in {
 
   seaborn = callPackage ../development/python-modules/seaborn { };
 
-  selenium = buildPythonPackage rec {
-    name = "selenium-2.52.0";
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/s/selenium/${name}.tar.gz";
-      sha256 = "0971rd9b8kb97xp9fvrwzvxr8vqfdjc020cs75n787ya82km01c2";
-    };
-
-    buildInputs = with self; [pkgs.xorg.libX11];
-
-    # Recompiling x_ignore_nofocus.so as the original one dlopen's libX11.so.6 by some
-    # absolute paths. Replaced by relative path so it is found when used in nix.
-    x_ignore_nofocus =
-      pkgs.fetchFromGitHub {
-        owner = "SeleniumHQ";
-        repo = "selenium";
-        rev = "selenium-2.52.0";
-        sha256 = "1n58akim9np2jy22jfgichq1ckvm8gglqi2hn3syphh0jjqq6cfx";
-      };
-
-    patchPhase = ''
-      cp "${x_ignore_nofocus}/cpp/linux-specific/"* .
-      substituteInPlace x_ignore_nofocus.c --replace "/usr/lib/libX11.so.6" "${pkgs.xorg.libX11.out}/lib/libX11.so.6"
-      gcc -c -fPIC x_ignore_nofocus.c -o x_ignore_nofocus.o
-      gcc -shared \
-        -Wl,${if stdenv.isDarwin then "-install_name" else "-soname"},x_ignore_nofocus.so \
-        -o x_ignore_nofocus.so \
-        x_ignore_nofocus.o
-      cp -v x_ignore_nofocus.so py/selenium/webdriver/firefox/${if pkgs.stdenv.is64bit then "amd64" else "x86"}/
-    '';
-  };
+  selenium = callPackage ../development/python-modules/selenium { };
 
   serpy = callPackage ../development/python-modules/serpy { };
 
@@ -19549,39 +18927,6 @@ in {
 
   six = callPackage ../development/python-modules/six { };
 
-
-  skype4py = buildPythonPackage (rec {
-    name = "Skype4Py-1.0.32.0";
-    disabled = isPy3k || isPyPy;
-
-    src = pkgs.fetchurl {
-      url = mirror://sourceforge/skype4py/Skype4Py-1.0.32.0.tar.gz;
-      sha256 = "0cmkrv450wa8v50bng5dflpwkl5c1p9pzysjkb2956w5kvwh6f5b";
-    };
-
-    unpackPhase = ''
-      tar xf $src
-      find . -type d -exec chmod +rx {} \;
-      sourceRoot=`pwd`/`ls -d S*`
-    '';
-
-    # error: invalid command 'test'
-    doCheck = false;
-
-    propagatedBuildInputs = with self; [ pkgs.xorg.libX11 dbus-python pygobject2 ];
-
-    meta = {
-      description = "High-level, platform independent Skype API wrapper for Python";
-
-      # The advertisement says https://developer.skype.com/wiki/Skype4Py
-      # but that url does not work. This following web page points to the
-      # download link and has some information about the package.
-      homepage = http://pypi.python.org/pypi/Skype4Py/1.0.32.0;
-      broken = true;
-      license = "BSD";
-    };
-  });
-
   smartdc = buildPythonPackage rec {
     name = "smartdc-0.1.12";
 
@@ -20187,6 +19532,8 @@ in {
     };
   };
 
+  sybil = callPackage ../development/python-modules/sybil { };
+
   syncthing-gtk = buildPythonPackage rec {
     version = "0.9.2.3";
     name = "syncthing-gtk-${version}";
@@ -20234,57 +19581,6 @@ in {
 
   tabulate = callPackage ../development/python-modules/tabulate { };
 
-  targetcli_fb = buildPythonPackage rec {
-    version = "2.1.fb33";
-    name = "targetcli-fb-${version}";
-
-    src = pkgs.fetchurl {
-      url = "https://github.com/agrover/targetcli-fb/archive/v${version}.tar.gz";
-      sha256 = "1zcm0agdpf866020b43fl8zyyyzz6r74mn1sz4xpaa0pinpwjk42";
-    };
-
-    propagatedBuildInputs = with self; [
-      configshell_fb
-      rtslib_fb
-    ];
-
-    meta = {
-      description = "A command shell for managing the Linux LIO kernel target";
-      homepage = "https://github.com/agrover/targetcli-fb";
-      platforms = platforms.linux;
-    };
-  };
-
-  taskcoach = buildPythonPackage rec {
-    name = "TaskCoach-1.3.22";
-    disabled = isPy3k;
-
-    src = pkgs.fetchurl {
-      url = "mirror://sourceforge/taskcoach/${name}.tar.gz";
-      sha256 = "1ddx56bqmh347synhgjq625ijv5hqflr0apxg0nl4jqdsqk1zmxh";
-    };
-
-    propagatedBuildInputs = with self; [ wxPython ];
-
-    # I don't know why I need to add these libraries. Shouldn't they
-    # be part of wxPython?
-    postInstall = ''
-      libspaths=${with pkgs.xorg; pkgs.lib.makeLibraryPath [ libSM libXScrnSaver ]}
-      wrapProgram $out/bin/taskcoach.py \
-        --prefix LD_LIBRARY_PATH : $libspaths
-    '';
-
-    # error: invalid command 'test'
-    doCheck = false;
-
-    meta = {
-      homepage = http://taskcoach.org/;
-      description = "Todo manager to keep track of personal tasks and todo lists";
-      license = licenses.gpl3Plus;
-      broken = stdenv.isDarwin;
-    };
-  };
-
   taskw = buildPythonPackage rec {
     version = "1.0.3";
     name = "taskw-${version}";
@@ -20646,29 +19942,6 @@ in {
     };
   };
 
-  trac = buildPythonPackage {
-    name = "trac-1.0.1";
-    disabled = isPy3k;
-
-    src = pkgs.fetchurl {
-      url = http://ftp.edgewall.com/pub/trac/Trac-1.0.1.tar.gz;
-      sha256 = "1nqa95fcnkpyq4jk6az7l7sqgm3b3pjq3bx1n7y4v3bad5jr1m4x";
-    };
-
-    # couple of failing tests
-    doCheck = false;
-
-    PYTHON_EGG_CACHE = "`pwd`/.egg-cache";
-
-    propagatedBuildInputs = with self; [ genshi ];
-
-    meta = {
-      description = "Enhanced wiki and issue tracking system for software development projects";
-
-      license = "BSD";
-    };
-  };
-
   traits = buildPythonPackage rec {
     name = "traits-${version}";
     version = "4.5.0";
@@ -21084,24 +20357,7 @@ in {
     };
   };
 
-  update_checker = buildPythonPackage rec {
-    name = "update_checker-0.11";
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/u/update_checker/${name}.tar.gz";
-      sha256 = "681bc7c26cffd1564eb6f0f3170d975a31c2a9f2224a32f80fe954232b86f173";
-    };
-
-    propagatedBuildInputs = with self; [ requests ];
-
-    doCheck = false;
-
-    meta = {
-      description = "A python module that will check for package updates";
-      homepage = https://github.com/bboe/update_checker;
-      license = licenses.bsd2;
-    };
-  };
+  update_checker = callPackage ../development/python-modules/update_checker {};
 
   uritemplate = buildPythonPackage rec {
     name = "uritemplate-${version}";
@@ -21570,26 +20826,6 @@ EOF
 
   widgetsnbextension = callPackage ../development/python-modules/widgetsnbextension { };
 
-
-  wokkel = buildPythonPackage (rec {
-    url = "http://wokkel.ik.nu/releases/0.7.0/wokkel-0.7.0.tar.gz";
-    name = nameFromURL url ".tar";
-    src = pkgs.fetchurl {
-      inherit url;
-      sha256 = "0rnshrzw8605x05mpd8ndrx3ri8h6cx713mp8sl4f04f4gcrz8ml";
-    };
-
-    disabled = isPy3k;
-
-    propagatedBuildInputs = with self; [twisted dateutil];
-
-    meta = {
-      description = "Some (mainly XMPP-related) additions to twisted";
-      homepage = "http://wokkel.ik.nu/";
-      license = licenses.mit;
-    };
-  });
-
   magic-wormhole = callPackage ../development/python-modules/magic-wormhole { };
 
   wsgiproxy2 = buildPythonPackage rec {
@@ -21630,23 +20866,6 @@ EOF
     propagatedBuildInputs = with self; [ eventlib application ];
   };
 
-  xe = buildPythonPackage rec {
-    url = "http://www.blarg.net/%7Esteveha/xe-0.7.4.tar.gz";
-    name = stdenv.lib.nameFromURL url ".tar";
-    src = pkgs.fetchurl {
-      inherit url;
-      sha256 = "0v9878cl0y9cczdsr6xjy8v9l139lc23h4m5f86p4kpf2wlnpi42";
-    };
-
-    # error: invalid command 'test'
-    doCheck = false;
-
-    meta = {
-      homepage = "http://home.blarg.net/~steveha/xe.html";
-      description = "XML elements";
-    };
-  };
-
   xlib = buildPythonPackage (rec {
     name = "xlib-${version}";
     version = "0.17";
@@ -22374,30 +21593,7 @@ EOF
     };
   };
 
-  testfixtures = buildPythonPackage rec {
-    name = "testfixtures-${version}";
-    version = "4.5.0";
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/t/testfixtures/testfixtures-${version}.tar.gz";
-      sha256 = "0my8zq9d27mc7j78pz9971cn5wz6zi4vxlqa50szr2vq9j2xxkll";
-    };
-
-    buildInputs = with self; [ nose mock manuel ];
-
-    checkPhase = ''
-      nosetests -v
-    '';
-
-    # Test suite seems broken
-    # TypeError: TestSuite() missing 1 required positional argument: 'm'
-    # Haven't checked with newer version
-    doCheck = false;
-
-    meta = with stdenv.lib; {
-      homepage = "https://github.com/Simplistix/testfixtures";
-    };
-  };
+  testfixtures = callPackage ../development/python-modules/testfixtures {};
 
   tissue = buildPythonPackage rec {
     name = "tissue-0.9.2";
@@ -23300,28 +22496,7 @@ EOF
     };
   };
 
-
-  redNotebook = buildPythonPackage rec {
-    name = "rednotebook-1.8.1";
-
-    src = pkgs.fetchurl {
-      url = "mirror://sourceforge/rednotebook/${name}.tar.gz";
-      sha256 = "00b7s4xpqpxsbzjvjx9qsx5d84m9pvn383c5di1nsfh35pig0rzn";
-    };
-
-    # no tests available
-    doCheck = false;
-
-    propagatedBuildInputs = with self; [ pygtk pywebkitgtk pyyaml chardet ];
-
-    meta = {
-      homepage = http://rednotebook.sourceforge.net/index.html;
-      description = "A modern journal that includes a calendar navigation, customizable templates, export functionality and word clouds";
-      license = licenses.gpl2;
-      maintainers = with maintainers; [ tstrobel ];
-    };
-  };
-
+  redNotebook = pkgs.rednotebook; # Backwards compatibility alias.
 
   uncertainties = callPackage ../development/python-modules/uncertainties { };