diff --git a/nixos/modules/config/fonts/fontconfig.nix b/nixos/modules/config/fonts/fontconfig.nix
index 6f17bd396a0b..922a9cf961df 100644
--- a/nixos/modules/config/fonts/fontconfig.nix
+++ b/nixos/modules/config/fonts/fontconfig.nix
@@ -142,7 +142,7 @@ with lib;
   config =
     let fontconfig = config.fonts.fontconfig;
         fcBool = x: "<bool>" + (if x then "true" else "false") + "</bool>";
-        nixosConf = ''
+        renderConf = ''
           <?xml version='1.0'?>
           <!DOCTYPE fontconfig SYSTEM 'fonts.dtd'>
           <fontconfig>
@@ -169,6 +169,21 @@ with lib;
               </edit>
             </match>
 
+            ${optionalString (fontconfig.dpi != 0) ''
+            <match target="pattern">
+              <edit name="dpi" mode="assign">
+                <double>${toString fontconfig.dpi}</double>
+              </edit>
+            </match>
+            ''}
+
+          </fontconfig>
+        '';
+        genericAliasConf = ''
+          <?xml version='1.0'?>
+          <!DOCTYPE fontconfig SYSTEM 'fonts.dtd'>
+          <fontconfig>
+
             <!-- Default fonts -->
             ${optionalString (fontconfig.defaultFonts.sansSerif != []) ''
             <alias>
@@ -201,14 +216,6 @@ with lib;
             </alias>
             ''}
 
-            ${optionalString (fontconfig.dpi != 0) ''
-            <match target="pattern">
-              <edit name="dpi" mode="assign">
-                <double>${toString fontconfig.dpi}</double>
-              </edit>
-            </match>
-            ''}
-
           </fontconfig>
         '';
     in mkIf fontconfig.enable {
@@ -219,7 +226,8 @@ with lib;
       environment.etc."fonts/fonts.conf".source =
         pkgs.makeFontsConf { fontconfig = pkgs.fontconfig_210; fontDirectories = config.fonts.fonts; };
 
-      environment.etc."fonts/conf.d/98-nixos.conf".text = nixosConf;
+      environment.etc."fonts/conf.d/10-nixos-rendering.conf".text = renderConf;
+      environment.etc."fonts/conf.d/60-nixos-generic-alias.conf".text = genericAliasConf;
 
       # Versioned fontconfig > 2.10. Take shared fonts.conf from fontconfig.
       # Otherwise specify only font directories.
@@ -236,7 +244,8 @@ with lib;
           </fontconfig>
         '';
 
-      environment.etc."fonts/${pkgs.fontconfig.configVersion}/conf.d/98-nixos.conf".text = nixosConf;
+      environment.etc."fonts/${pkgs.fontconfig.configVersion}/conf.d/10-nixos-rendering.conf".text = renderConf;
+      environment.etc."fonts/${pkgs.fontconfig.configVersion}/conf.d/60-nixos-generic-alias.conf".text = genericAliasConf;
 
       environment.etc."fonts/${pkgs.fontconfig.configVersion}/conf.d/99-user.conf" = {
         enable = fontconfig.includeUserConf;
diff --git a/nixos/modules/misc/ids.nix b/nixos/modules/misc/ids.nix
index b25e3d7e40db..1e5393f26b54 100644
--- a/nixos/modules/misc/ids.nix
+++ b/nixos/modules/misc/ids.nix
@@ -228,6 +228,7 @@
       subsonic = 204;
       riak = 205;
       shout = 206;
+      gateone = 207;
 
       # When adding a uid, make sure it doesn't match an existing gid. And don't use uids above 399!
 
@@ -434,6 +435,7 @@
       subsonic = 204;
       riak = 205;
       #shout = 206; #unused
+      gateone = 207;
 
       # When adding a gid, make sure it doesn't match an existing
       # uid. Users and groups with the same name should have equal
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 212555d7efcc..409f22920871 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -72,7 +72,6 @@
   ./programs/ssmtp.nix
   ./programs/uim.nix
   ./programs/venus.nix
-  ./programs/virtualbox-host.nix
   ./programs/wvdial.nix
   ./programs/freetds.nix
   ./programs/zsh/zsh.nix
@@ -283,6 +282,7 @@
   ./services/networking/firewall.nix
   ./services/networking/flashpolicyd.nix
   ./services/networking/freenet.nix
+  ./services/networking/gateone.nix
   ./services/networking/git-daemon.nix
   ./services/networking/gnunet.nix
   ./services/networking/gogoclient.nix
@@ -486,6 +486,7 @@
   ./virtualisation/openvswitch.nix
   ./virtualisation/parallels-guest.nix
   ./virtualisation/virtualbox-guest.nix
+  ./virtualisation/virtualbox-host.nix
   ./virtualisation/vmware-guest.nix
   ./virtualisation/xen-dom0.nix
 ]
diff --git a/nixos/modules/services/hardware/freefall.nix b/nixos/modules/services/hardware/freefall.nix
index 6e6960bac491..7867956c1ab0 100644
--- a/nixos/modules/services/hardware/freefall.nix
+++ b/nixos/modules/services/hardware/freefall.nix
@@ -39,11 +39,14 @@ with lib;
     mkService = dev:
       assert dev != "";
       let dev' = utils.escapeSystemdPath dev; in
-      nameValuePair "freefall-${dev'}"
-        { description = "Free-fall protection for ${dev}";
+      nameValuePair "freefall-${dev'}" {
+        description = "Free-fall protection for ${dev}";
         after = [ "${dev'}.device" ];
         wantedBy = [ "${dev'}.device" ];
         path = [ pkgs.freefall ];
+        unitConfig = {
+          DefaultDependencies = false;
+        };
         serviceConfig = {
           ExecStart = "${pkgs.freefall}/bin/freefall ${dev}";
           Restart = "on-failure";
diff --git a/nixos/modules/services/networking/gateone.nix b/nixos/modules/services/networking/gateone.nix
new file mode 100644
index 000000000000..b8ae5490d7ba
--- /dev/null
+++ b/nixos/modules/services/networking/gateone.nix
@@ -0,0 +1,59 @@
+{ config, lib, pkgs, ...}:
+with lib;
+let
+  cfg = config.services.gateone;
+in
+{
+options = {
+    services.gateone = {
+      enable = mkEnableOption "GateOne server";
+      pidDir = mkOption {
+        default = "/run/gateone";
+        type = types.path;
+        description = ''Path of pid files for GateOne.'';
+      };
+      settingsDir = mkOption {
+        default = "/var/lib/gateone";
+        type = types.path;
+        description = ''Path of configuration files for GateOne.'';
+      };
+    };
+};
+config = mkIf cfg.enable {
+  environment.systemPackages = with pkgs.pythonPackages; [
+    gateone pkgs.openssh pkgs.procps pkgs.coreutils ];
+
+  users.extraUsers.gateone = {
+    description = "GateOne privilege separation user";
+    uid = config.ids.uids.gateone;
+    home = cfg.settingsDir;
+  };
+  users.extraGroups.gateone.gid = config.ids.gids.gateone;
+
+  systemd.services.gateone = with pkgs; {
+    description = "GateOne web-based terminal";
+    path = [ pythonPackages.gateone nix openssh procps coreutils ];
+    preStart = ''
+      if [ ! -d ${cfg.settingsDir} ] ; then
+        mkdir -m 0750 -p ${cfg.settingsDir}
+        mkdir -m 0750 -p ${cfg.pidDir}
+        chown -R gateone.gateone ${cfg.settingsDir}
+        chown -R gateone.gateone ${cfg.pidDir}
+      fi
+      '';
+    #unitConfig.RequiresMountsFor = "${cfg.settingsDir}";
+    serviceConfig = {
+      ExecStart = ''${pythonPackages.gateone}/bin/gateone --settings_dir=${cfg.settingsDir} --pid_file=${cfg.pidDir}/gateone.pid --gid=${toString config.ids.gids.gateone} --uid=${toString config.ids.uids.gateone}'';
+      User = "gateone";
+      Group = "gateone";
+      WorkingDirectory = cfg.settingsDir;
+      PermissionsStartOnly = true;
+
+    };
+
+    wantedBy = [ "multi-user.target" ];
+    requires = [ "network.target" ];
+  };
+};
+}
+  
diff --git a/nixos/modules/services/printing/cupsd.nix b/nixos/modules/services/printing/cupsd.nix
index fd9589883edc..e743aa8a3236 100644
--- a/nixos/modules/services/printing/cupsd.nix
+++ b/nixos/modules/services/printing/cupsd.nix
@@ -230,8 +230,8 @@ in
           ];
       };
 
-    systemd.services.cups-browsed =
-      { description = "Make remote CUPS printers available locally";
+    systemd.services.cups-browsed = mkIf config.services.avahi.enable
+      { description = "CUPS Remote Printer Discovery";
 
         wantedBy = [ "multi-user.target" ];
         wants = [ "cups.service" "avahi-daemon.service" ];
diff --git a/nixos/modules/virtualisation/virtualbox-guest.nix b/nixos/modules/virtualisation/virtualbox-guest.nix
index a0e4bd558e05..6c4014fc4a1e 100644
--- a/nixos/modules/virtualisation/virtualbox-guest.nix
+++ b/nixos/modules/virtualisation/virtualbox-guest.nix
@@ -54,7 +54,7 @@ in
 
         unitConfig.ConditionVirtualization = "oracle";
 
-        serviceConfig.ExecStart = "@${kernel.virtualboxGuestAdditions}/sbin/VBoxService VBoxService --foreground";
+        serviceConfig.ExecStart = "@${kernel.virtualboxGuestAdditions}/bin/VBoxService VBoxService --foreground";
       };
 
     services.xserver.videoDrivers = mkOverride 50 [ "virtualbox" ];
diff --git a/nixos/modules/programs/virtualbox-host.nix b/nixos/modules/virtualisation/virtualbox-host.nix
similarity index 100%
rename from nixos/modules/programs/virtualbox-host.nix
rename to nixos/modules/virtualisation/virtualbox-host.nix
diff --git a/nixos/tests/avahi.nix b/nixos/tests/avahi.nix
index a39104f603ec..a8369a6d1f88 100644
--- a/nixos/tests/avahi.nix
+++ b/nixos/tests/avahi.nix
@@ -2,7 +2,7 @@
 import ./make-test.nix ({ pkgs, ... } : {
   name = "avahi";
   meta = with pkgs.stdenv.lib.maintainers; {
-    maintainers = [ eelco chaoflow wizeman ];
+    maintainers = [ eelco chaoflow ];
   };
 
   nodes = {
diff --git a/nixos/tests/printing.nix b/nixos/tests/printing.nix
index 0db9a529644b..ea18114b61c4 100644
--- a/nixos/tests/printing.nix
+++ b/nixos/tests/printing.nix
@@ -3,7 +3,7 @@
 import ./make-test.nix ({pkgs, ... }: {
   name = "printing";
   meta = with pkgs.stdenv.lib.maintainers; {
-    maintainers = [ iElectric eelco chaoflow jgeerds vcunat ];
+    maintainers = [ iElectric eelco chaoflow jgeerds ];
   };
 
   nodes = {
diff --git a/nixos/tests/riak.nix b/nixos/tests/riak.nix
index a56f51c4e50e..f36d12bdb2cf 100644
--- a/nixos/tests/riak.nix
+++ b/nixos/tests/riak.nix
@@ -16,6 +16,6 @@ import ./make-test.nix {
 
     $master->waitForUnit("riak");
     $master->sleep(20); # Hopefully this is long enough!!
-    $master->succeed("RIAK_DATA_DIR='/var/db/riak' RIAK_LOG_DIR='/var/log/riak' RIAK_ETC_DIR='/etc/riak' riak ping 2>&1");
+    $master->succeed("riak ping 2>&1");
   '';
 }
diff --git a/nixos/tests/virtualbox.nix b/nixos/tests/virtualbox.nix
index f94d219aba60..4895eb134dc1 100644
--- a/nixos/tests/virtualbox.nix
+++ b/nixos/tests/virtualbox.nix
@@ -8,7 +8,7 @@ import ./make-test.nix ({ pkgs, ... }: with pkgs.lib; let
         #!${pkgs.stdenv.shell} -xe
         export PATH="${pkgs.coreutils}/bin:${pkgs.utillinux}/bin"
 
-        ${pkgs.linuxPackages.virtualboxGuestAdditions}/sbin/VBoxService
+        ${pkgs.linuxPackages.virtualboxGuestAdditions}/bin/VBoxService
         ${(attrs.vmScript or (const "")) pkgs}
 
         i=0
@@ -39,7 +39,7 @@ import ./make-test.nix ({ pkgs, ... }: with pkgs.lib; let
     ];
 
     boot.initrd.extraUtilsCommands = ''
-      copy_bin_and_libs "${pkgs.linuxPackages.virtualboxGuestAdditions}/sbin/mount.vboxsf"
+      copy_bin_and_libs "${pkgs.linuxPackages.virtualboxGuestAdditions}/bin/mount.vboxsf"
       copy_bin_and_libs "${pkgs.utillinux}/bin/unshare"
       ${(attrs.extraUtilsCommands or (const "")) pkgs}
     '';
diff --git a/pkgs/applications/graphics/inkscape/default.nix b/pkgs/applications/graphics/inkscape/default.nix
index 41531ed0de84..409fd0a767ce 100644
--- a/pkgs/applications/graphics/inkscape/default.nix
+++ b/pkgs/applications/graphics/inkscape/default.nix
@@ -2,9 +2,20 @@
 , libpng, zlib, popt, boehmgc, libxml2, libxslt, glib, gtkmm
 , glibmm, libsigcxx, lcms, boost, gettext, makeWrapper, intltool
 , gsl, python, pyxml, lxml, poppler, imagemagick, libwpg, librevenge
-, libvisio, libcdr, libexif
+, libvisio, libcdr, libexif, unzip
+, boxMakerPlugin ? false # boxmaker plugin
 }:
 
+let 
+
+boxmaker = fetchurl {
+  # http://www.inkscapeforum.com/viewtopic.php?f=11&t=10403
+  url = "http://www.keppel.demon.co.uk/111000/files/BoxMaker0.91.zip";
+  sha256 = "5c5697f43dc3a95468f61f479cb50b7e2b93379a1729abf19e4040ac9f43a1a8";
+};
+
+in
+
 stdenv.mkDerivation rec {
   name = "inkscape-0.91";
 
@@ -34,12 +45,23 @@ stdenv.mkDerivation rec {
     libxml2 libxslt glib gtkmm glibmm libsigcxx lcms boost gettext
     makeWrapper intltool gsl poppler imagemagick libwpg librevenge
     libvisio libcdr libexif
-  ];
+  ] ++ stdenv.lib.optional boxMakerPlugin unzip;
 
   enableParallelBuilding = true;
   doCheck = true;
 
   postInstall = ''
+    ${if boxMakerPlugin then "
+      mkdir -p $out/share/inkscape/extensions/
+      # boxmaker packaged version 0.91 in a directory called 0.85 ?!??
+      unzip ${boxmaker};
+      cp boxmake-upd-0.85/* $out/share/inkscape/extensions/
+      rm -Rf boxmake-upd-0.85
+      "
+    else 
+      ""
+    }
+
     # Make sure PyXML modules can be found at run-time.
     for i in "$out/bin/"*
     do
diff --git a/pkgs/applications/misc/calibre/default.nix b/pkgs/applications/misc/calibre/default.nix
index 787b5e805287..4c15ccc04289 100644
--- a/pkgs/applications/misc/calibre/default.nix
+++ b/pkgs/applications/misc/calibre/default.nix
@@ -5,11 +5,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "calibre-2.31.0";
+  name = "calibre-2.33.0";
+  version = "2.33.0";
 
   src = fetchurl {
-    url = "mirror://sourceforge/calibre/${name}.tar.xz";
-    sha256 = "1414c324alvgwbiszalklck1kay41yca2wnm488imr2768fihzkz";
+    url = "https://github.com/kovidgoyal/calibre/releases/download/v${version}/${name}.tar.xz";
+    sha256 = "0j1micmjffi6rsn3ayblnz0wq648v05ckbn1qsiz086iaj2285q9";
   };
 
   inherit python;
diff --git a/pkgs/applications/misc/llpp/default.nix b/pkgs/applications/misc/llpp/default.nix
index bd0727ccab11..9d9b69f59588 100644
--- a/pkgs/applications/misc/llpp/default.nix
+++ b/pkgs/applications/misc/llpp/default.nix
@@ -1,19 +1,20 @@
 { stdenv, makeWrapper, fetchgit, pkgconfig, ninja, ocaml, findlib, mupdf, lablgl
-, gtk3, openjpeg, jbig2dec, mujs, xsel }:
+, gtk3, openjpeg, jbig2dec, mujs, xsel, openssl }:
 
 let ocamlVersion = (builtins.parseDrvName (ocaml.name)).version;
 in stdenv.mkDerivation rec {
   name = "llpp-${version}";
-  version = "21-git-2015-06-27";
+  version = "21-git-2015-07-30";
 
   src = fetchgit {
     url = "git://repo.or.cz/llpp.git";
-    rev = "843c42ef41bb78a3b1ee995fc2bab91f8796e8ad";
-    sha256 = "0h8wa7f5bj5sm3sr8namcyy81s4s80hyasimyfw935lqyw2q2k60";
+    rev = "e9fe06d684b145a104cc319673076e069e853cac";
+    sha256 = "0x3hgn6sfjln2sqdw40ylcj943rn732a6mlfwz01llx8ykiyvsvq";
+    fetchSubmodules = false;
   };
 
   buildInputs = [ pkgconfig ninja makeWrapper ocaml findlib mupdf lablgl
-                  gtk3 jbig2dec openjpeg mujs ];
+                  gtk3 jbig2dec openjpeg mujs openssl ];
 
   configurePhase = ''
       sh configure.sh -O -F ${mupdf}
diff --git a/pkgs/applications/networking/browsers/chromium/plugins.nix b/pkgs/applications/networking/browsers/chromium/plugins.nix
index 5bb6a93d8d74..0b0e5bd08382 100644
--- a/pkgs/applications/networking/browsers/chromium/plugins.nix
+++ b/pkgs/applications/networking/browsers/chromium/plugins.nix
@@ -53,7 +53,7 @@ let
       wvDescription = "Playback of encrypted HTML audio/video content";
       wvMimeTypes = "application/x-ppapi-widevine-cdm";
       wvModule = "$widevine/lib/libwidevinecdmadapter.so";
-      wvInfo = "#${wvName}#${wvDescription}:${wvMimeTypes}";
+      wvInfo = "#${wvName}#${wvDescription};${wvMimeTypes}";
     in ''
       flashVersion="$(
         sed -n -r 's/.*"version": "([^"]+)",.*/\1/p' PepperFlash/manifest.json
diff --git a/pkgs/applications/networking/browsers/dwb/default.nix b/pkgs/applications/networking/browsers/dwb/default.nix
index 6f6ffd67a539..d79a5215ce21 100644
--- a/pkgs/applications/networking/browsers/dwb/default.nix
+++ b/pkgs/applications/networking/browsers/dwb/default.nix
@@ -30,5 +30,9 @@ stdenv.mkDerivation {
     platforms = platforms.mesaPlatforms;
     maintainers = with maintainers; [ pSub ];
     license = licenses.gpl3;
+
+    # dwb is no longer maintained by portix and efforts to keep it alive
+    # were not successful, see issue #7952 for discussion.
+    broken = true;
   };
 }
diff --git a/pkgs/applications/networking/cluster/mesos/default.nix b/pkgs/applications/networking/cluster/mesos/default.nix
index c330b8acfbf3..f9c34fdd29df 100644
--- a/pkgs/applications/networking/cluster/mesos/default.nix
+++ b/pkgs/applications/networking/cluster/mesos/default.nix
@@ -9,14 +9,14 @@ let
   soext = if stdenv.system == "x86_64-darwin" then "dylib" else "so";
 
 in stdenv.mkDerivation rec {
-  version = "0.22.1";
+  version = "0.23.0";
   name = "mesos-${version}";
 
   dontDisableStatic = true;
 
   src = fetchurl {
     url = "http://www.apache.org/dist/mesos/${version}/mesos-${version}.tar.gz";
-    sha256 = "0ry0ppzgpab68fz5bzd7ry5rjbg8xjz73x1x4c5id42cpsqnn7x5";
+    sha256 = "1v5xpn4wal4vcrvcklchx9slkpa8xlwqkdbnxzy9zkzpq5g3arxr";
   };
 
   buildInputs = [
@@ -93,13 +93,15 @@ in stdenv.mkDerivation rec {
     echo "export MESOS_NATIVE_LIBRARY=$MESOS_NATIVE_JAVA_LIBRARY" >> $out/nix-support/setup-hook
 
     # Inspired by: pkgs/development/python-modules/generic/default.nix
+    pushd src/python
     mkdir -p $out/lib/${python.libPrefix}/site-packages
     export PYTHONPATH="$out/lib/${python.libPrefix}/site-packages:$PYTHONPATH"
-    ${python}/bin/${python.executable} src/python/setup.py install \
+    ${python}/bin/${python.executable} setup.py install \
       --install-lib=$out/lib/${python.libPrefix}/site-packages \
       --old-and-unmanageable \
       --prefix="$out"
     rm -f "$out/lib/${python.libPrefix}"/site-packages/site.py*
+    popd
   '';
 
   postFixup = ''
diff --git a/pkgs/applications/networking/instant-messengers/telegram-cli/default.nix b/pkgs/applications/networking/instant-messengers/telegram-cli/default.nix
index a68e0ee11045..90c8e9a7e9eb 100644
--- a/pkgs/applications/networking/instant-messengers/telegram-cli/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram-cli/default.nix
@@ -1,28 +1,26 @@
 { stdenv, fetchgit, libconfig, lua5_2, openssl, readline, zlib
+, libevent, pkgconfig, python, jansson, bash
 }:
 
 stdenv.mkDerivation rec {
-  name = "telegram-cli-2014-03-04";
+  name = "telegram-cli-2015-07-30";
 
   src = fetchgit {
     url = "https://github.com/vysheng/tg.git";
-    rev = "ac6079a00ac66bb37a3179a82af130b41ec39bc9";
-    sha256 = "1rpwnyzmqk7p97n5pd00m5c6rypc39mb3hs94qxxrdcpwpgcb73q";
+    sha256 = "0phn9nl0sf2fylzfwi427xq60cfrnpsvhh8bp55y1wcjkmp0fxsn";
+    rev = "2052f4b381337d75e783facdbfad56b04dec1a9c";
   };
 
-  buildInputs = [ libconfig lua5_2 openssl readline zlib ];
-
-  NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations"; # CPPFunction
-
+  buildInputs = [ libconfig lua5_2 openssl readline zlib libevent pkgconfig python jansson ];
   installPhase = ''
     mkdir -p $out/bin
-    cp ./telegram $out/bin/telegram-wo-key
-    cp ./tg.pub $out/
-    cat > $out/bin/telegram <<EOF
-    #!/usr/bin/env bash
-    $out/bin/telegram-wo-key -k $out/tg.pub
+    cp ./bin/telegram-cli $out/bin/telegram-wo-key
+    cp ./tg-server.pub $out/
+    cat > $out/bin/telegram-cli <<EOF
+    #!${bash}/bin/sh
+    $out/bin/telegram-wo-key -k $out/tg-server.pub
     EOF
-    chmod +x $out/bin/telegram
+    chmod +x $out/bin/telegram-cli
   '';
 
   meta = {
@@ -30,5 +28,6 @@ stdenv.mkDerivation rec {
     homepage = https://telegram.org/;
     license = stdenv.lib.licenses.gpl2;
     platforms = stdenv.lib.platforms.linux;
+    maintainers = stdenv.lib.maintainers.jagajaga;
   };
 }
diff --git a/pkgs/applications/networking/mailreaders/thunderbird-bin/default.nix b/pkgs/applications/networking/mailreaders/thunderbird-bin/default.nix
index a5806b7dfe88..4dd734ed0430 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird-bin/default.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird-bin/default.nix
@@ -134,7 +134,7 @@ stdenv.mkDerivation {
       [Desktop Entry]
       Type=Application
       Exec=$out/bin/thunderbird
-      Icon=$out/lib/thunderbird-bin-${version}/chrome/icons/default/default256.png
+      Icon=$out/usr/lib/thunderbird-bin-${version}/chrome/icons/default/default256.png
       Name=Thunderbird
       GenericName=Mail Reader
       Categories=Application;Network;
diff --git a/pkgs/applications/virtualization/docker/default.nix b/pkgs/applications/virtualization/docker/default.nix
index 905830381451..c3b141cba818 100644
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@@ -1,13 +1,15 @@
-{ stdenv, fetchurl, makeWrapper, go, lxc, sqlite, iproute, bridge-utils, devicemapper,
+{ stdenv, fetchFromGitHub, makeWrapper, go, lxc, sqlite, iproute, bridge-utils, devicemapper,
 btrfsProgs, iptables, bash, e2fsprogs, xz}:
 
 stdenv.mkDerivation rec {
   name = "docker-${version}";
-  version = "1.6.0";
+  version = "1.7.1";
 
-  src = fetchurl {
-    url = "https://github.com/dotcloud/docker/archive/v${version}.tar.gz";
-    sha256 = "03nzhikxp60falshzyk6ip8g9fhrczhvnvgmzqr8bny6w8x1v84b";
+  src = fetchFromGitHub {
+    owner = "docker";
+    repo = "docker";
+    rev = "v${version}";
+    sha256 = "0r0j8aj1a7lbnc9piznp02h5n2gdw3v3n4q2ipmapi9ax0wj82lz";
   };
 
   buildInputs = [ makeWrapper go sqlite lxc iproute bridge-utils devicemapper btrfsProgs iptables e2fsprogs ];
@@ -17,7 +19,7 @@ stdenv.mkDerivation rec {
   buildPhase = ''
     patchShebangs .
     export AUTO_GOPATH=1
-    export DOCKER_GITCOMMIT="03nzhikx"
+    export DOCKER_GITCOMMIT="786b29d4"
     ./hack/make.sh dynbinary
   '';
 
@@ -35,7 +37,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with stdenv.lib; {
-    homepage = http://www.docker.io/;
+    homepage = http://www.docker.com/;
     description = "An open source project to pack, ship and run any application as a lightweight container";
     license = licenses.asl20;
     maintainers = with maintainers; [ offline tailhook ];
diff --git a/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix b/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix
index b56e80eb3b67..6bf0ef2e8258 100644
--- a/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix
+++ b/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix
@@ -87,9 +87,8 @@ stdenv.mkDerivation {
     sed -i -e "s|/usr/bin|$out/bin|" bin/VBoxClient-all
 
     # Install binaries
-    mkdir -p $out/sbin
-    install -m 4755 lib/VBoxGuestAdditions/mount.vboxsf $out/sbin/mount.vboxsf
-    install -m 755 sbin/VBoxService $out/sbin
+    install -D -m 4755 lib/VBoxGuestAdditions/mount.vboxsf $out/bin/mount.vboxsf
+    install -D -m 755 sbin/VBoxService $out/bin/VBoxService
 
     mkdir -p $out/bin
     install -m 755 bin/VBoxClient $out/bin
diff --git a/pkgs/build-support/grsecurity/default.nix b/pkgs/build-support/grsecurity/default.nix
index 0fd3df6d5f5f..713f4cdc83e8 100644
--- a/pkgs/build-support/grsecurity/default.nix
+++ b/pkgs/build-support/grsecurity/default.nix
@@ -33,7 +33,7 @@ let
 
     grKernel = if cfg.stable
                then mkKernel pkgs.linux_3_14 stable-patch
-               else mkKernel pkgs.linux_4_0 test-patch;
+               else mkKernel pkgs.linux_4_1 test-patch;
 
     ## -- grsecurity configuration ---------------------------------------------
 
diff --git a/pkgs/development/libraries/liboauth/default.nix b/pkgs/development/libraries/liboauth/default.nix
index 3cb9629e3e1b..8f46d1c0bfd2 100644
--- a/pkgs/development/libraries/liboauth/default.nix
+++ b/pkgs/development/libraries/liboauth/default.nix
@@ -1,4 +1,4 @@
-{ fetchurl, stdenv, nss, openssl, pkgconfig }:
+{ fetchurl, stdenv, nss, nspr, pkgconfig }:
 
 
 stdenv.mkDerivation rec {
@@ -9,7 +9,9 @@ stdenv.mkDerivation rec {
     sha256 = "07w1aq8y8wld43wmbk2q8134p3bfkp2vma78mmsfgw2jn1bh3xhd";
   };
 
-  buildInputs = [ nss openssl ];
+  buildInputs = [ pkgconfig nss nspr ];
+
+  configureFlags = [ "--enable-nss" ];
 
   meta = with stdenv.lib; {
     platforms = platforms.linux;
diff --git a/pkgs/development/tools/misc/ccache/default.nix b/pkgs/development/tools/misc/ccache/default.nix
index 0762d175e89d..f41969ebb43e 100644
--- a/pkgs/development/tools/misc/ccache/default.nix
+++ b/pkgs/development/tools/misc/ccache/default.nix
@@ -42,6 +42,11 @@ stdenv.mkDerivation {
         EOF
           chmod +x $out/bin/g++
         fi
+        for executable in $(ls ${gcc.cc}/bin); do
+          if [ ! -x "$out/bin/$executable" ]; then
+            ln -s ${gcc.cc}/bin/$executable $out/bin/$executable
+          fi
+        done
       '');
   };
 
diff --git a/pkgs/misc/drivers/hplip/default.nix b/pkgs/misc/drivers/hplip/default.nix
index d173b0ac406e..61d76a6c42fc 100644
--- a/pkgs/misc/drivers/hplip/default.nix
+++ b/pkgs/misc/drivers/hplip/default.nix
@@ -6,18 +6,20 @@
 
 let
 
-  version = "3.15.7";
+  # Version 3.15.7 breaks certain (but not all) PCL-based printers:
+  # https://github.com/NixOS/nixpkgs/commit/b0e46fc3ead209ef24ed6214bd41ef6e604af54f
+  version = "3.15.6";
 
   name = "hplip-${version}";
 
   src = fetchurl {
     url = "mirror://sourceforge/hplip/${name}.tar.gz";
-    sha256 = "17flpl89lgwlbsy9mka910g530nnvlwqqnif8a9hyq7k90q9046k";
+    sha256 = "1jbnjw7vrn1qawrjfdv8j58w69q8ki1qkzvlh0nk8nxacpp17i9h";
   };
 
   plugin = fetchurl {
     url = "http://www.openprinting.org/download/printdriver/auxfiles/HP/plugins/${name}-plugin.run";
-    sha256 = "0fblh5m43jnws4vkwks0b4m9k3jg9kspaj1l8bic0r5swy97s41m";
+    sha256 = "1rymxahz12s1s37rri5qyvka6q0yi0yai08kgspg24176ry3a3fx";
   };
 
   hplip_state =
@@ -75,23 +77,25 @@ stdenv.mkDerivation {
       {} +
   '';
 
-  configureFlags = ''
-    --with-cupsfilterdir=$(out)/lib/cups/filter
-    --with-cupsbackenddir=$(out)/lib/cups/backend
-    --with-icondir=$(out)/share/applications
-    --with-systraydir=$(out)/xdg/autostart
-    --with-mimedir=$(out)/etc/cups
-    --enable-policykit
-  '';
+  preConfigure = ''
+    export configureFlags="$configureFlags
+      --with-cupsfilterdir=$out/lib/cups/filter
+      --with-cupsbackenddir=$out/lib/cups/backend
+      --with-icondir=$out/share/applications
+      --with-systraydir=$out/xdg/autostart
+      --with-mimedir=$out/etc/cups
+      --enable-policykit
+    "
 
-  makeFlags = ''
-    halpredir=$(out)/share/hal/fdi/preprobe/10osvendor
-    rulesdir=$(out)/etc/udev/rules.d
-    policykit_dir=$(out)/share/polkit-1/actions
-    policykit_dbus_etcdir=$(out)/etc/dbus-1/system.d
-    policykit_dbus_sharedir=$(out)/share/dbus-1/system-services
-    hplip_confdir=$(out)/etc/hp
-    hplip_statedir=$(out)/var/lib/hp
+    export makeFlags="
+      halpredir=$out/share/hal/fdi/preprobe/10osvendor
+      rulesdir=$out/etc/udev/rules.d
+      policykit_dir=$out/share/polkit-1/actions
+      policykit_dbus_etcdir=$out/etc/dbus-1/system.d
+      policykit_dbus_sharedir=$out/share/dbus-1/system-services
+      hplip_confdir=$out/etc/hp
+      hplip_statedir=$out/var/lib/hp
+    "
   '';
 
   enableParallelBuilding = true;
@@ -175,6 +179,6 @@ stdenv.mkDerivation {
       then licenses.unfree
       else with licenses; [ mit bsd2 gpl2Plus ];
     platforms = [ "i686-linux" "x86_64-linux" "armv6l-linux" "armv7l-linux" ];
-    maintainers = with maintainers; [ ttuegel jgeerds nckx ];
+    maintainers = with maintainers; [ jgeerds nckx ];
   };
 }
diff --git a/pkgs/os-specific/linux/ima-evm-utils/default.nix b/pkgs/os-specific/linux/ima-evm-utils/default.nix
new file mode 100644
index 000000000000..ad3df25df585
--- /dev/null
+++ b/pkgs/os-specific/linux/ima-evm-utils/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, fetchgit, autoreconfHook, pkgconfig, openssl, attr, keyutils, asciidoc, libxslt, docbook_xsl }:
+
+stdenv.mkDerivation rec {
+  name = "ima-evm-utils-${version}";
+  version = "1.0.0";
+
+  src = fetchgit {
+    url = "git://git.code.sf.net/p/linux-ima/ima-evm-utils";
+    rev = "4b56112c095cb5cc34dc35abac37ebfc6eadba65";
+    sha256 = "6f1ef4e84b9214448ea4a530a562a20ad1ba5a7cfefd7ddda90a56e2404f3a87";
+  };
+
+  buildInputs = [ autoreconfHook pkgconfig openssl attr keyutils asciidoc libxslt ];
+
+  buildPhase = "make prefix=$out MANPAGE_DOCBOOK_XSL=${docbook_xsl}/xml/xsl/docbook/manpages/docbook.xsl";
+
+  meta = {
+    description = "evmctl utility to manage digital signatures of the Linux kernel integrity subsystem (IMA/EVM)";
+    homepage = "http://sourceforge.net/projects/linux-ima/";
+    license = stdenv.lib.licenses.gpl2;
+    platforms = stdenv.lib.platforms.linux;
+    maintainers = with stdenv.lib.maintainers; [ tstrobel ];
+  };
+}
diff --git a/pkgs/os-specific/linux/kernel/linux-3.14.nix b/pkgs/os-specific/linux/kernel/linux-3.14.nix
index 377f0271aeaa..c4171948436a 100644
--- a/pkgs/os-specific/linux/kernel/linux-3.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-3.14.nix
@@ -1,13 +1,13 @@
 { stdenv, fetchurl, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "3.14.48";
+  version = "3.14.49";
   # Remember to update grsecurity!
   extraMeta.branch = "3.14";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz";
-    sha256 = "098a7kjfw4jf0f7h6z57f2719jfz3y3jjlcd8y6d95xvhy7xxyw9";
+    sha256 = "1x9p6z195c0nv7hsjcwzmr89yag35v3pyrs0081k2d8dykbl70zs";
   };
 
   features.iwlwifi = true;
diff --git a/pkgs/os-specific/linux/kernel/linux-4.0.nix b/pkgs/os-specific/linux/kernel/linux-4.0.nix
index 8607bcf70cf3..eee052ad3bb9 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.0.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.0.nix
@@ -1,13 +1,12 @@
 { stdenv, fetchurl, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "4.0.8";
-  # Remember to update grsecurity!
+  version = "4.0.9";
   extraMeta.branch = "4.0";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1cggqi5kdan818xw5g5wmapcsf501f5m9bympsy6a2cpphknfdmn";
+    sha256 = "0k42blafzd954fncc0b78vi9x1h2k0jhfvkjqxmpv64i7xwwdhsx";
   };
 
   features.iwlwifi = true;
diff --git a/pkgs/os-specific/linux/kernel/linux-4.1.nix b/pkgs/os-specific/linux/kernel/linux-4.1.nix
index 82bde2535295..e85346563492 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.1.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.1.nix
@@ -2,6 +2,7 @@
 
 import ./generic.nix (args // rec {
   version = "4.1.4";
+  # Remember to update grsecurity!
   extraMeta.branch = "4.1";
 
   src = fetchurl {
diff --git a/pkgs/os-specific/linux/kernel/patches.nix b/pkgs/os-specific/linux/kernel/patches.nix
index a8fc01665082..f3e33047e8ba 100644
--- a/pkgs/os-specific/linux/kernel/patches.nix
+++ b/pkgs/os-specific/linux/kernel/patches.nix
@@ -65,17 +65,17 @@ rec {
   };
 
   grsecurity_stable = grsecPatch
-    { kversion  = "3.14.48";
-      revision  = "201507111210";
+    { kversion  = "3.14.49";
+      revision  = "201508032312";
       branch    = "stable";
-      sha256    = "0phmqlkx6vqlv79ppf6g4wsx7rwsvwpakpkm9xsq8qazffk7s9qk";
+      sha256    = "09x0rb4pgmghcp6sdz57lwhawlb3bzrc3rg372xknhv6993ainjc";
     };
 
   grsecurity_unstable = grsecPatch
-    { kversion  = "4.0.8";
-      revision  = "201507111211";
+    { kversion  = "4.1.4";
+      revision  = "201508032312";
       branch    = "test";
-      sha256    = "1p9ym8hbwaan9pgxgn8k4rm3n33wl8ag1fzmyr5f4mxs634wgwgx";
+      sha256    = "16p1wq98qgwksav0ry6b5jyyi26s404v1k0cwpj7l7n86hxig67i";
     };
 
   grsec_fix_path =
diff --git a/pkgs/servers/nosql/riak/2.1.1.nix b/pkgs/servers/nosql/riak/2.1.1.nix
index 74cf03a1ca86..c62cea180be7 100644
--- a/pkgs/servers/nosql/riak/2.1.1.nix
+++ b/pkgs/servers/nosql/riak/2.1.1.nix
@@ -36,11 +36,11 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     sed -i deps/node_package/priv/base/env.sh \
-      -e 's@{{platform_data_dir}}@$RIAK_DATA_DIR@' \
+      -e 's@{{platform_data_dir}}@''${RIAK_DATA_DIR:-/var/db/riak}@' \
       -e 's@^RUNNER_SCRIPT_DIR=.*@RUNNER_SCRIPT_DIR='$out'/bin@' \
       -e 's@^RUNNER_BASE_DIR=.*@RUNNER_BASE_DIR='$out'@' \
-      -e 's@^RUNNER_ETC_DIR=.*@RUNNER_ETC_DIR=$RIAK_ETC_DIR@' \
-      -e 's@^RUNNER_LOG_DIR=.*@RUNNER_LOG_DIR=$RIAK_LOG_DIR@'
+      -e 's@^RUNNER_ETC_DIR=.*@RUNNER_ETC_DIR=''${RIAK_ETC_DIR:-/etc/riak}@' \
+      -e 's@^RUNNER_LOG_DIR=.*@RUNNER_LOG_DIR=''${RIAK_LOG_DIR:-/var/log}@'
   '';
 
   preBuild = ''
diff --git a/pkgs/tools/misc/cpulimit/default.nix b/pkgs/tools/misc/cpulimit/default.nix
index 8ae137bbd899..72656d2969de 100644
--- a/pkgs/tools/misc/cpulimit/default.nix
+++ b/pkgs/tools/misc/cpulimit/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "http://limitcpu.sourceforge.net/";
     description = "A tool to throttle the CPU usage of programs";
-    platforms = with platforms; linux ++ freebsd ++ darwin;
+    platforms = with platforms; linux ++ freebsd;
     license = licenses.gpl2;
     maintainer = [maintainers.rycee];
   };
diff --git a/pkgs/tools/typesetting/hevea/default.nix b/pkgs/tools/typesetting/hevea/default.nix
index 1acc395dc069..0626ec84fbe5 100644
--- a/pkgs/tools/typesetting/hevea/default.nix
+++ b/pkgs/tools/typesetting/hevea/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, ocaml }:
 
 stdenv.mkDerivation rec {
-  name = "hevea-2.23";
+  name = "hevea-2.25";
 
   src = fetchurl {
     url = "http://pauillac.inria.fr/~maranget/hevea/distri/${name}.tar.gz";
-    sha256 = "1f9pj48518ixhjxbviv2zx27v4anp92zgg3x704g1s5cki2w33nv";
+    sha256 = "0kn99v92xsfy12r9gfvwgs0xf3s9s6frfg86a8q6damj1dampiz4";
   };
 
   buildInputs = [ ocaml ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 1c3cff36be20..79772cfdeae1 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -9589,6 +9589,8 @@ let
 
   ifplugd = callPackage ../os-specific/linux/ifplugd { };
 
+  ima-evm-utils = callPackage ../os-specific/linux/ima-evm-utils { };
+
   iomelt = callPackage ../os-specific/linux/iomelt { };
 
   iotop = callPackage ../os-specific/linux/iotop { };
@@ -11002,7 +11004,7 @@ let
   };
 
   docker = callPackage ../applications/virtualization/docker {
-    go = go_1_3;
+    go = go_1_4;
   };
 
   doodle = callPackage ../applications/search/doodle { };
diff --git a/pkgs/top-level/php-packages.nix b/pkgs/top-level/php-packages.nix
index 03259dde82d9..bfd741ccb4b4 100644
--- a/pkgs/top-level/php-packages.nix
+++ b/pkgs/top-level/php-packages.nix
@@ -102,11 +102,11 @@ let self = with self; {
 
   composer = pkgs.stdenv.mkDerivation rec {
     name = "composer-${version}";
-    version = "1.0.0-alpha9";
+    version = "1.0.0-alpha10";
 
     src = pkgs.fetchurl {
-      url = "https://getcomposer.org/download/1.0.0-alpha9/composer.phar";
-      sha256 = "1x7i9xs9xggq0qq4kzrwh2pky8skax0l829zwwsy3hcvch3irvrk";
+      url = "https://getcomposer.org/download/${version}/composer.phar";
+      sha256 = "0a26zlsr2jffcqlz8z6l8s6c6nlyfj2gxqfgx76knx5wch1psb4z";
     };
 
     phases = [ "installPhase" ];
@@ -123,7 +123,7 @@ let self = with self; {
       description = "Dependency Manager for PHP";
       license = licenses.mit;
       homepage = https://getcomposer.org/;
-      maintainers = with maintainers; [offline];
+      maintainers = with maintainers; [ globin offline ];
     };
   };
 }; in self
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 39c459259eae..1fa7c9dae5b9 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3432,6 +3432,24 @@ let
     };
   };
 
+  gateone = buildPythonPackage rec {
+    name = "gateone-1.2-0d57c3";
+    disabled = ! isPy27;
+    src = pkgs.fetchFromGitHub {
+      rev = "11ed97c663b3e8c1b8eba473b5cf8362b10d57c3";
+      owner= "liftoff";
+      repo = "GateOne";
+      sha256 ="0zp9vfs6sqbx4d0g45kkjinfmsl9zqwa6bhp3xd81wx3ph9yr1hq";
+    };
+    propagatedBuildInputs = with pkgs.pythonPackages; [tornado futures html5lib readline pkgs.openssl];
+    meta = {
+      homepage = https://liftoffsoftware.com/;
+      description = "GateOne is a web-based terminal emulator and SSH client";
+      maintainers = with maintainers; [ tomberek ];
+
+    };
+  };
+
   gcutil = buildPythonPackage rec {
     name = "gcutil-1.16.1";
     meta.maintainers = with maintainers; [ phreedom ];
@@ -5541,6 +5559,7 @@ let
   pyfribidi = buildPythonPackage rec {
     version = "0.11.0";
     name = "pyfribidi-${version}";
+    disabled = isPy3k;
 
     src = pkgs.fetchurl {
       url = "https://pypi.python.org/packages/source/p/pyfribidi/${name}.zip";
@@ -12297,14 +12316,14 @@ let
   };
 
   sigal = buildPythonPackage rec {
-    name = "sigal-0.7.0";
+    name = "sigal-0.9.2";
 
     src = pkgs.fetchurl {
       url = "http://pypi.python.org/packages/source/s/sigal/${name}.tar.gz";
-      md5 = "d2386706ac8543378aebde1ea4edeba4";
+      sha256 = "0mk3bzaxn9snx9lc0pj9zvgdgdyhkza6b8z5x91772mlv84sfw6c";
     };
 
-    propagatedBuildInputs = with self; [ jinja2 markdown pillow pilkit clint argh pytest ];
+    propagatedBuildInputs = with self; [ jinja2 markdown pillow pilkit clint click pytest blinker ];
 
     meta = {
       description = "Yet another simple static gallery generator";