diff --git a/lib/maintainers.nix b/lib/maintainers.nix
index b0a08cfd619..f4cd203e41d 100644
--- a/lib/maintainers.nix
+++ b/lib/maintainers.nix
@@ -177,6 +177,7 @@
   nslqqq = "Nikita Mikhailov <nslqqq@gmail.com>";
   obadz = "obadz <dav-nixos@odav.org>";
   ocharles = "Oliver Charles <ollie@ocharles.org.uk>";
+  odi = "Oliver Dunkl <oliver.dunkl@gmail.com>";
   offline = "Jaka Hudoklin <jakahudoklin@gmail.com>";
   olcai = "Erik Timan <dev@timan.info>";
   orbitz = "Malcolm Matalka <mmatalka@gmail.com>";
diff --git a/nixos/modules/config/timezone.nix b/nixos/modules/config/timezone.nix
index 06857139311..b9844b4adad 100644
--- a/nixos/modules/config/timezone.nix
+++ b/nixos/modules/config/timezone.nix
@@ -26,6 +26,7 @@ in
 
       hardwareClockInLocalTime = mkOption {
         default = false;
+        type = types.bool;
         description = "If set, keep the hardware clock in local time instead of UTC.";
       };
 
diff --git a/nixos/modules/services/networking/quassel.nix b/nixos/modules/services/networking/quassel.nix
index 579d62884c7..005eb7bd761 100644
--- a/nixos/modules/services/networking/quassel.nix
+++ b/nixos/modules/services/networking/quassel.nix
@@ -3,7 +3,7 @@
 with lib;
 
 let
-  quassel = pkgs.kde4.quasselDaemon;
+  quassel = pkgs.quasselDaemon_qt5;
   cfg = config.services.quassel;
   user = if cfg.user != null then cfg.user else "quassel";
 in
diff --git a/nixos/modules/system/boot/stage-1-init.sh b/nixos/modules/system/boot/stage-1-init.sh
index 26cf7f06c9e..480bbfa2b07 100644
--- a/nixos/modules/system/boot/stage-1-init.sh
+++ b/nixos/modules/system/boot/stage-1-init.sh
@@ -184,7 +184,7 @@ if test -e /sys/power/resume -a -e /sys/power/disk; then
             # https://bugs.launchpad.net/ubuntu/+source/pm-utils/+bug/923326/comments/1
             # when there are multiple swap devices, we can't know where the hibernate
             # image will reside. We can check all of them for swsuspend blkid.
-            resumeInfo="$(test -e "$d" && udevadm info -q property "$sd")"
+            resumeInfo="$(test -e "$sd" && udevadm info -q property "$sd")"
             if [ "$(echo "$resumeInfo" | sed -n 's/^ID_FS_TYPE=//p')" = "swsuspend" ]; then
                 resumeDev="$sd"
                 break
diff --git a/pkgs/applications/editors/neovim/default.nix b/pkgs/applications/editors/neovim/default.nix
index 28d455e06b2..c55d4b0e76a 100644
--- a/pkgs/applications/editors/neovim/default.nix
+++ b/pkgs/applications/editors/neovim/default.nix
@@ -17,7 +17,7 @@ let
   version = "2015-06-09";
 
   # Note: this is NOT the libvterm already in nixpkgs, but some NIH silliness:
-  neovimLibvterm = let version = "2015-02-23"; in stdenv.mkDerivation rec {
+  neovimLibvterm = let version = "2015-02-23"; in stdenv.mkDerivation {
     name = "neovim-libvterm-${version}";
 
     src = fetchFromGitHub {
@@ -54,7 +54,7 @@ let
     ignoreCollisions = true;
   };
 
-  neovim = stdenv.mkDerivation rec {
+  neovim = stdenv.mkDerivation {
     name = "neovim-${version}";
 
     src = fetchFromGitHub {
@@ -135,7 +135,7 @@ let
     };
   };
 
-in if (vimAlias == false && configure == null) then neovim else stdenv.mkDerivation rec {
+in if (vimAlias == false && configure == null) then neovim else stdenv.mkDerivation {
   name = "neovim-${version}-configured";
   nativeBuildInputs = [ makeWrapper ];
   buildCommand = ''
diff --git a/pkgs/applications/graphics/shotwell/default.nix b/pkgs/applications/graphics/shotwell/default.nix
index 2b25f8d41f6..052ba9402be 100644
--- a/pkgs/applications/graphics/shotwell/default.nix
+++ b/pkgs/applications/graphics/shotwell/default.nix
@@ -1,7 +1,7 @@
 { fetchurl, stdenv, m4, glibc, gtk3, libexif, libgphoto2, libsoup, libxml2, vala, sqlite
 , webkitgtk24x, pkgconfig, gnome3, gst_all_1, which, udev, libraw, glib, json_glib
 , gettext, desktop_file_utils, lcms2, gdk_pixbuf, librsvg, makeWrapper
-, gnome_doc_utils, hicolor_icon_theme, cacert }:
+, gnome_doc_utils, hicolor_icon_theme }:
 
 # for dependencies see http://www.yorba.org/projects/shotwell/install/
 
@@ -15,9 +15,9 @@ stdenv.mkDerivation rec {
   };
 
   NIX_CFLAGS_COMPILE = "-I${glib}/include/glib-2.0 -I${glib}/lib/glib-2.0/include";
-  
+
   configureFlags = [ "--disable-gsettings-convert-install" ];
-  
+
   preConfigure = ''
     patchShebangs .
   '';
diff --git a/pkgs/applications/misc/cmatrix/default.nix b/pkgs/applications/misc/cmatrix/default.nix
new file mode 100644
index 00000000000..c7a76ef00a6
--- /dev/null
+++ b/pkgs/applications/misc/cmatrix/default.nix
@@ -0,0 +1,27 @@
+{ stdenv, fetchurl, pkgconfig, ncurses }:
+
+let
+  version = "1.2a";
+in with stdenv.lib;
+stdenv.mkDerivation rec {
+
+  name = "cmatrix-${version}";
+
+  src = fetchurl{
+    url = "http://www.asty.org/cmatrix/dist/${name}.tar.gz";
+    sha256 = "0k06fw2n8nzp1pcdynhajp5prba03gfgsbj91bknyjr5xb5fd9hz";
+  };
+
+  buildInputs = [ pkgconfig ncurses ];
+
+  meta = {
+    description = "Simulates the falling characters theme from The Matrix movie";
+    longDescription = ''
+      CMatrix simulates the display from "The Matrix" and is based
+      on the screensaver from the movie's website.  
+    '';
+    homepage = http://www.asty.org/cmatrix/;
+    platforms = ncurses.meta.platforms;
+    maintainers = [ maintainers.AndersonTorres ];
+  };
+}
diff --git a/pkgs/applications/misc/mupdf/default.nix b/pkgs/applications/misc/mupdf/default.nix
index 9b39f1c3c38..c988d171327 100644
--- a/pkgs/applications/misc/mupdf/default.nix
+++ b/pkgs/applications/misc/mupdf/default.nix
@@ -2,12 +2,12 @@
 , libX11, libXext }:
 
 stdenv.mkDerivation rec {
-  version = "1.7";
+  version = "1.7a";
   name = "mupdf-${version}";
 
   src = fetchurl {
     url = "http://mupdf.com/download/archive/${name}-source.tar.gz";
-    sha256 = "0hjn1ywxhblqgj63qkp8x7qqjnwsgid3viw8az5i2i26dijmrgfh";
+    sha256 = "073xq6kczq331awycvznpc49b22idqzdlw4g9254zi0z07x5y0wc";
   };
 
   buildInputs = [ pkgconfig zlib freetype libjpeg jbig2dec openjpeg libX11 libXext ];
diff --git a/pkgs/applications/networking/browsers/vimb/default.nix b/pkgs/applications/networking/browsers/vimb/default.nix
index 3222e87ac65..84a2870b6d0 100644
--- a/pkgs/applications/networking/browsers/vimb/default.nix
+++ b/pkgs/applications/networking/browsers/vimb/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, pkgconfig, libsoup, webkit, gtk, glib_networking
-, gsettings_desktop_schemas, makeWrapper, cacert
+, gsettings_desktop_schemas, makeWrapper
 }:
 
 stdenv.mkDerivation rec {
@@ -11,11 +11,6 @@ stdenv.mkDerivation rec {
     sha256 = "0h9m5qfs09lb0dz8a79yccmm3a5rv6z8gi5pkyfh8fqkgkh2940p";
   };
 
-  # Nixos default ca bundle
-  patchPhase = ''
-    sed -i s,/etc/ssl/certs/ca-certificates.crt,${cacert}/etc/ssl/certs/ca-bundle.crt, src/config.def.h
-  '';
-
   buildInputs = [ makeWrapper gtk libsoup pkgconfig webkit gsettings_desktop_schemas ];
 
   makeFlags = [ "PREFIX=$(out)" ];
diff --git a/pkgs/applications/networking/browsers/vimprobable2/default.nix b/pkgs/applications/networking/browsers/vimprobable2/default.nix
index ad5f8aa4691..6f8eede9b3f 100644
--- a/pkgs/applications/networking/browsers/vimprobable2/default.nix
+++ b/pkgs/applications/networking/browsers/vimprobable2/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, makeWrapper, glib, glib_networking, gtk, libsoup, libX11, perl,
-  pkgconfig, webkit, gsettings_desktop_schemas, cacert }:
+  pkgconfig, webkit, gsettings_desktop_schemas }:
 
 stdenv.mkDerivation rec {
   version = "1.4.2";
@@ -9,11 +9,6 @@ stdenv.mkDerivation rec {
     sha256 = "13jdximksh9r3cgd2f8vms0pbsn3x0gxvyqdqiw16xp5fmdx5kzr";
   };
 
-  # Nixos default ca bundle
-  patchPhase = ''
-    sed -i s,/etc/ssl/certs/ca-certificates.crt,${cacert}/etc/ssl/certs/ca-bundle.crt, config.h
-  '';
-
   buildInputs = [ makeWrapper gtk libsoup libX11 perl pkgconfig webkit gsettings_desktop_schemas ];
 
   installPhase = ''
diff --git a/pkgs/applications/networking/cluster/panamax/api/default.nix b/pkgs/applications/networking/cluster/panamax/api/default.nix
index 524433b45fb..dcfef83f1be 100644
--- a/pkgs/applications/networking/cluster/panamax/api/default.nix
+++ b/pkgs/applications/networking/cluster/panamax/api/default.nix
@@ -1,5 +1,5 @@
 { stdenv, buildEnv, fetchgit, fetchurl, makeWrapper, bundlerEnv, bundler_HEAD
-, ruby, libxslt, libxml2, sqlite, openssl, cacert, docker
+, ruby, libxslt, libxml2, sqlite, openssl, docker
 , dataDir ? "/var/lib/panamax-api" }:
 
 with stdenv.lib;
@@ -62,7 +62,7 @@ stdenv.mkDerivation rec {
       --prefix "PATH" : "$out/share/panamax-api/bin:${env.ruby}/bin:$PATH" \
       --prefix "HOME" : "$out/share/panamax-api" \
       --prefix "GEM_HOME" : "${env}/${env.ruby.gemPath}" \
-      --prefix "SSL_CERT_FILE" : "${cacert}/etc/ssl/certs/ca-bundle.crt" \
+      --prefix "SSL_CERT_FILE" : /etc/ssl/certs/ca-certificates.crt \
       --prefix "GEM_PATH" : "$out/share/panamax-api:${bundler}/${env.ruby.gemPath}"
   '';
 
diff --git a/pkgs/applications/networking/instant-messengers/fuze/default.nix b/pkgs/applications/networking/instant-messengers/fuze/default.nix
index 6b85e107d06..33ffe87a4ff 100644
--- a/pkgs/applications/networking/instant-messengers/fuze/default.nix
+++ b/pkgs/applications/networking/instant-messengers/fuze/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, dpkg, openssl, alsaLib, libXext, libXfixes, libXrandr
 , libjpeg, curl, libX11, libXmu, libXv, libXtst, qt4, mesa, zlib
-, gnome, libidn, rtmpdump, c-ares, openldap, makeWrapper, cacert
+, gnome, libidn, rtmpdump, c-ares, openldap, makeWrapper
 }:
 assert stdenv.system == "x86_64-linux";
 let
   curl_custom =
     stdenv.lib.overrideDerivation curl (args: { 
-      configureFlags = args.configureFlags ++ ["--with-ca-bundle=${cacert}/etc/ssl/certs/ca-bundle.crt"] ; 
+      configureFlags = args.configureFlags ++ ["--with-ca-bundle=/etc/ssl/certs/ca-certificates.crt"] ; 
     } );
 in
 stdenv.mkDerivation {
diff --git a/pkgs/applications/networking/instant-messengers/telepathy/gabble/default.nix b/pkgs/applications/networking/instant-messengers/telepathy/gabble/default.nix
index a74885b2ce3..971a834f409 100644
--- a/pkgs/applications/networking/instant-messengers/telepathy/gabble/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telepathy/gabble/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, pkgconfig, libxslt, telepathy_glib, libxml2, dbus_glib, dbus_daemon
-, sqlite, libsoup, libnice, gnutls, cacert }:
+, sqlite, libsoup, libnice, gnutls }:
 
 stdenv.mkDerivation rec {
   name = "telepathy-gabble-0.18.2";
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ libxml2 dbus_glib sqlite libsoup libnice telepathy_glib gnutls ]
     ++ stdenv.lib.optional doCheck dbus_daemon;
 
-  configureFlags = "--with-ca-certificates=${cacert}/etc/ssl/certs/ca-bundle.crt";
+  configureFlags = "--with-ca-certificates=/etc/ssl/certs/ca-certificates.crt";
 
   enableParallelBuilding = true;
   doCheck = true;
diff --git a/pkgs/applications/networking/irc/quassel/default.nix b/pkgs/applications/networking/irc/quassel/default.nix
index a8bd2e801b9..c1944cf6d0d 100644
--- a/pkgs/applications/networking/irc/quassel/default.nix
+++ b/pkgs/applications/networking/irc/quassel/default.nix
@@ -1,20 +1,27 @@
 { monolithic ? true # build monolithic Quassel
 , daemon ? false # build Quassel daemon
 , client ? false # build Quassel client
-, withKDE ? stdenv.isLinux # enable KDE integration
 , previews ? false # enable webpage previews on hovering over URLs
 , tag ? "" # tag added to the package name
-, kdelibs ? null # optional
-, useQt5 ? false
-, phonon_qt5, libdbusmenu_qt5
-, stdenv, fetchurl, cmake, makeWrapper, qt, automoc4, phonon, dconf, qca2, qca-qt5 }:
+, useQt5 ? false, phonon_qt5, libdbusmenu_qt5, qca-qt5
+, withKDE ? stdenv.isLinux # enable KDE integration
+, kf5 ? null, kdelibs ? null
 
+, stdenv, fetchurl, cmake, makeWrapper, qt, automoc4, phonon, dconf, qca2 }:
+
+let useKF5 = useQt5 && withKDE;
+    useKDE4 = withKDE && !useQt5;
+    buildClient = monolithic || client;
+    buildCore = monolithic || daemon;
+in
 
 assert stdenv.isLinux;
 
 assert monolithic -> !client && !daemon;
 assert client || daemon -> !monolithic;
-assert withKDE -> kdelibs != null;
+assert useKDE4 -> kdelibs != null;
+assert useKF5 -> kf5 != null;
+assert !buildClient -> !withKDE; # KDE is used by the client only
 
 let
   edf = flag: feature: [("-D" + feature + (if flag then "=ON" else "=OFF"))];
@@ -31,15 +38,21 @@ in with stdenv; mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  buildInputs = [ cmake makeWrapper ]
-    ++ (if useQt5 then [ qt.base qca-qt5 ] else [ qt qca2 ])
-    ++ (if useQt5 && (monolithic || daemon) then [ qt.script ] else [])
-    ++ (if useQt5 && previews then [ qt.webkit qt.webkitwidgets ] else [])
-    ++ lib.optional withKDE kdelibs
-    ++ lib.optional withKDE automoc4
-    ++ lib.optional withKDE phonon
-    ++ lib.optional useQt5 phonon_qt5
-    ++ lib.optional useQt5 libdbusmenu_qt5;
+  buildInputs =
+       [ cmake makeWrapper ]
+    ++ [(if useQt5 then qt.base else qt)]
+    ++ lib.optionals buildCore (if useQt5 then [qt.script qca-qt5] else [qca2])
+    ++ lib.optionals buildClient
+       (   lib.optionals (previews && useQt5) [qt.webkit qt.webkitwidgets]
+        ++ lib.optionals useQt5 [libdbusmenu_qt5 phonon_qt5]
+        ++ lib.optionals useKDE4 [automoc4 kdelibs phonon]
+        ++ lib.optionals useKF5
+           (with kf5; [
+             extra-cmake-modules kconfigwidgets kcoreaddons
+             knotifications knotifyconfig ktextwidgets kwidgetsaddons
+             kxmlgui
+           ])
+       );
 
   cmakeFlags = [
     "-DEMBED_DATA=OFF"
@@ -52,24 +65,20 @@ in with stdenv; mkDerivation rec {
     ++ edf useQt5 "USE_QT5";
 
   preFixup =
-    lib.optionalString client ''
-        wrapProgram "$out/bin/quasselclient" \
-          --prefix GIO_EXTRA_MODULES : "${dconf}/lib/gio/modules"
-    '' +
-    lib.optionalString monolithic ''
-        wrapProgram "$out/bin/quassel" \
+    lib.optionalString buildClient ''
+        wrapProgram "$out/bin/quassel${lib.optionalString client "client"}" \
           --prefix GIO_EXTRA_MODULES : "${dconf}/lib/gio/modules"
     '';
 
   meta = with stdenv.lib; {
     homepage = http://quassel-irc.org/;
-    description = "Qt4/KDE4/Qt5 distributed IRC client suppporting a remote daemon";
+    description = "Qt/KDE distributed IRC client suppporting a remote daemon";
     longDescription = ''
       Quassel IRC is a cross-platform, distributed IRC client,
       meaning that one (or multiple) client(s) can attach to
       and detach from a central core -- much like the popular
       combination of screen and a text-based IRC client such
-      as WeeChat, but graphical (based on Qt4/KDE4 or Qt5).
+      as WeeChat, but graphical (based on Qt4/KDE4 or Qt5/KF5).
     '';
     license = stdenv.lib.licenses.gpl3;
     maintainers = with maintainers; [ phreedom ttuegel ];
diff --git a/pkgs/applications/networking/irc/weechat/default.nix b/pkgs/applications/networking/irc/weechat/default.nix
index c39c5be1d4c..060be8ab1eb 100644
--- a/pkgs/applications/networking/irc/weechat/default.nix
+++ b/pkgs/applications/networking/irc/weechat/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchurl, ncurses, openssl, perl, python, aspell, gnutls
 , zlib, curl , pkgconfig, libgcrypt, ruby, lua5, tcl, guile
-, pythonPackages, cacert, cmake, makeWrapper, libobjc
+, pythonPackages, cmake, makeWrapper, libobjc
 , extraBuildInputs ? [] }:
 
 stdenv.mkDerivation rec {
@@ -15,11 +15,11 @@ stdenv.mkDerivation rec {
   buildInputs = 
     [ ncurses perl python openssl aspell gnutls zlib curl pkgconfig
       libgcrypt ruby lua5 tcl guile pythonPackages.pycrypto makeWrapper
-      cacert cmake ]
+      cmake ]
     ++ stdenv.lib.optionals stdenv.isDarwin [ pythonPackages.pync libobjc ]
     ++ extraBuildInputs;
 
-  NIX_CFLAGS_COMPILE = "-I${python}/include/${python.libPrefix} -DCA_FILE=${cacert}/etc/ssl/certs/ca-bundle.crt";
+  NIX_CFLAGS_COMPILE = "-I${python}/include/${python.libPrefix} -DCA_FILE=/etc/ssl/certs/ca-certificates.crt";
 
   postInstall = ''
     NIX_PYTHONPATH="$out/lib/${python.libPrefix}/site-packages"
diff --git a/pkgs/applications/version-management/bazaar/default.nix b/pkgs/applications/version-management/bazaar/default.nix
index c3b238eeb0a..28406cecbb0 100644
--- a/pkgs/applications/version-management/bazaar/default.nix
+++ b/pkgs/applications/version-management/bazaar/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pythonPackages, cacert }:
+{ stdenv, fetchurl, pythonPackages }:
 
 stdenv.mkDerivation rec {
   version = "2.6";
@@ -19,10 +19,9 @@ stdenv.mkDerivation rec {
   patches = [ ./add_certificates.patch ];
   postPatch = ''
     substituteInPlace bzrlib/transport/http/_urllib2_wrappers.py \
-      --subst-var-by "certPath" "${cacert}/etc/ssl/certs/ca-bundle.crt"
+      --subst-var-by certPath /etc/ssl/certs/ca-certificates.crt
   '';
 
-
   installPhase = ''
     python setup.py install --prefix=$out
     wrapPythonPrograms
diff --git a/pkgs/applications/version-management/mercurial/default.nix b/pkgs/applications/version-management/mercurial/default.nix
index 4d8b2fe27c6..12f3c8f11d8 100644
--- a/pkgs/applications/version-management/mercurial/default.nix
+++ b/pkgs/applications/version-management/mercurial/default.nix
@@ -1,6 +1,5 @@
 { stdenv, fetchurl, python, makeWrapper, docutils, unzip, hg-git, dulwich
-, guiSupport ? false, tk ? null, curses, cacert
-
+, guiSupport ? false, tk ? null, curses
 , ApplicationServices }:
 
 let
@@ -48,7 +47,7 @@ stdenv.mkDerivation {
       mkdir -p $out/etc/mercurial
       cat >> $out/etc/mercurial/hgrc << EOF
       [web]
-      cacerts = ${cacert}/etc/ssl/certs/ca-bundle.crt
+      cacerts = /etc/ssl/certs/ca-certificates.crt
       EOF
 
       # copy hgweb.cgi to allow use in apache
diff --git a/pkgs/data/misc/cacert/default.nix b/pkgs/data/misc/cacert/default.nix
index 7bcb499aab4..0b125485fd4 100644
--- a/pkgs/data/misc/cacert/default.nix
+++ b/pkgs/data/misc/cacert/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     unpackFile ${curl.src};
   '';
 
-  nativeBuildInputs = [ perl ] ++ (with perlPackages; [ LWP ]);
+  nativeBuildInputs = [ perl perlPackages.LWP ];
 
   buildPhase = ''
     perl curl-*/lib/mk-ca-bundle.pl -d "file://$(pwd)/nss/lib/ckfw/builtins/certdata.txt" ca-bundle.crt
diff --git a/pkgs/desktops/gnome-3/3.16/core/gdm/3.16-wip/default.nix b/pkgs/desktops/gnome-3/3.16/core/gdm/3.16-wip/default.nix
index 83642f1afe6..51b67afb01f 100644
--- a/pkgs/desktops/gnome-3/3.16/core/gdm/3.16-wip/default.nix
+++ b/pkgs/desktops/gnome-3/3.16/core/gdm/3.16-wip/default.nix
@@ -3,23 +3,24 @@
 , gtk, libcanberra_gtk3, pam, libtool, gobjectIntrospection }:
 
 stdenv.mkDerivation rec {
-  name = "gdm-${gnome3.version}.0";
+  name = "gdm-${gnome3.version}.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gdm/${gnome3.version}/${name}.tar.xz";
-    sha256 = "0qg2qxlfdvi1081r8bbid5hg7vqlpm91996ck2z7fq6kczy4hvdv";
+    sha256 = "0mhv3q8z208qvhz00zrxlqn7w9gi5vy6w8dpjh5s2ka28l3yhbn3";
   };
 
-  # Only needed to make it build
   preConfigure = ''
     substituteInPlace ./configure --replace "/usr/bin/X" "${xorg.xorgserver}/bin/X"
     substituteInPlace daemon/gdm-simple-slave.c --replace 'BINDIR "/gnome-session' '"${gnome_session}/bin/gnome-session'
     substituteInPlace daemon/gdm-launch-environment.c --replace 'BINDIR "/dbus-launch' '"${dbus.tools}/bin/dbus-launch'
     substituteInPlace data/gdm.conf-custom.in --replace '#WaylandEnable=false' 'WaylandEnable=false'
+    sed 's/#Enable=true/Enable=true/' -i data/gdm.conf-custom.in
  '';
 
   configureFlags = [ "--localstatedir=/var" "--with-systemd=yes" "--without-plymouth"
-                     "--with-systemdsystemunitdir=$(out)/etc/systemd/system" ];
+                     "--with-systemdsystemunitdir=$(out)/etc/systemd/system"
+                     "--with-initial-vt=10" ];
 
   buildInputs = [ pkgconfig glib itstool libxml2 intltool
                   accountsservice gnome3.dconf systemd
diff --git a/pkgs/desktops/gnome-3/3.16/core/gnome-keyring/default.nix b/pkgs/desktops/gnome-3/3.16/core/gnome-keyring/default.nix
index a6621aebe43..c3f16db359e 100644
--- a/pkgs/desktops/gnome-3/3.16/core/gnome-keyring/default.nix
+++ b/pkgs/desktops/gnome-3/3.16/core/gnome-keyring/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchurl, pkgconfig, dbus, libgcrypt, libtasn1, pam, python, glib, libxslt
 , intltool, pango, gcr, gdk_pixbuf, atk, p11_kit, makeWrapper
-, docbook_xsl_ns, docbook_xsl, gnome3, cacert }:
+, docbook_xsl_ns, docbook_xsl, gnome3 }:
 
 let
   majVer = gnome3.version;
@@ -22,7 +22,7 @@ in stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig intltool docbook_xsl_ns docbook_xsl ];
 
   configureFlags = [
-    "--with-ca-certificates=${cacert}/etc/ssl/certs/ca-bundle.crt" # NixOS hardcoded path
+    "--with-ca-certificates=/etc/ssl/certs/ca-certificates.crt" # NixOS hardcoded path
     "--with-pkcs11-config=$$out/etc/pkcs11/" # installation directories
     "--with-pkcs11-modules=$$out/lib/pkcs11/"
   ];
diff --git a/pkgs/desktops/gnome-3/3.16/core/nautilus/default.nix b/pkgs/desktops/gnome-3/3.16/core/nautilus/default.nix
index a4e94db0b74..0e732b60748 100644
--- a/pkgs/desktops/gnome-3/3.16/core/nautilus/default.nix
+++ b/pkgs/desktops/gnome-3/3.16/core/nautilus/default.nix
@@ -3,11 +3,11 @@
 , libnotify, makeWrapper, exempi, librsvg, tracker }:
 
 stdenv.mkDerivation rec {
-  name = "nautilus-${gnome3.version}.1";
+  name = "nautilus-${gnome3.version}.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/nautilus/${gnome3.version}/${name}.tar.xz";
-    sha256 = "0y83adhfaq4ns01rdkqmrvdwj0ch2pb10hl43as98kqqzm0qxs3y";
+    sha256 = "13s785kzk68xf4gdj0inz9k2hy06ll598w42141svdj77bdcsziy";
   };
 
   buildInputs = [ pkgconfig libxml2 dbus_glib shared_mime_info libexif gtk libunique intltool exempi librsvg
diff --git a/pkgs/desktops/gnome-3/3.16/core/rest/default.nix b/pkgs/desktops/gnome-3/3.16/core/rest/default.nix
index 354f1715dc1..eada9ab1993 100644
--- a/pkgs/desktops/gnome-3/3.16/core/rest/default.nix
+++ b/pkgs/desktops/gnome-3/3.16/core/rest/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, glib, libsoup, gobjectIntrospection, cacert, gnome3 }:
+{ stdenv, fetchurl, pkgconfig, glib, libsoup, gobjectIntrospection, gnome3 }:
 
 stdenv.mkDerivation rec {
   name = "rest-0.7.92";
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ pkgconfig glib libsoup gobjectIntrospection];
 
-  configureFlags = "--with-ca-certificates=${cacert}/etc/ssl/certs/ca-bundle.crt";
+  configureFlags = "--with-ca-certificates=/etc/ssl/certs/ca-certificates.crt";
 
   meta = with stdenv.lib; {
     platforms = platforms.linux;
diff --git a/pkgs/development/compilers/squeak/default.nix b/pkgs/development/compilers/squeak/default.nix
index 6e68defb624..7f3ed5c6ec3 100644
--- a/pkgs/development/compilers/squeak/default.nix
+++ b/pkgs/development/compilers/squeak/default.nix
@@ -2,7 +2,7 @@
 , libpthreadstubs, pango, pkgconfig, libpulseaudio, which }:
 
 let version = "4.10.2.2614"; in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   name = "squeak-${version}";
 
   src = fetchurl {
diff --git a/pkgs/development/haskell-modules/configuration-common.nix b/pkgs/development/haskell-modules/configuration-common.nix
index 30c5912a5a8..5260d508ab1 100644
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@@ -21,8 +21,6 @@ self: super: {
   options = dontCheck super.options;
   statistics = dontCheck super.statistics;
   text = dontCheck super.text;
-  c2hs = dontCheck super.c2hs;
-  mockery = dontCheck super.mockery;
 
   # The package doesn't compile with ruby 1.9, which is our default at the moment.
   hruby = super.hruby.override { ruby = pkgs.ruby_2_1; };
diff --git a/pkgs/development/haskell-modules/hackage-packages.nix b/pkgs/development/haskell-modules/hackage-packages.nix
index 622ebfa7473..ba7bc517aa7 100644
--- a/pkgs/development/haskell-modules/hackage-packages.nix
+++ b/pkgs/development/haskell-modules/hackage-packages.nix
@@ -54313,7 +54313,7 @@ self: {
          yesod-static
        ];
        buildTools = [
-         curl git gnupg openssh perl rsync wget which
+         bup curl git gnupg lsof openssh perl rsync wget which
        ];
        configureFlags = [ "-fassistant" "-fproduction" ];
        preConfigure = "export HOME=$TEMPDIR";
diff --git a/pkgs/development/interpreters/elixir/default.nix b/pkgs/development/interpreters/elixir/default.nix
index 99d649f3f68..c9a83774486 100644
--- a/pkgs/development/interpreters/elixir/default.nix
+++ b/pkgs/development/interpreters/elixir/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, erlang, rebar, makeWrapper, coreutils, curl, bash, cacert }:
+{ stdenv, fetchurl, erlang, rebar, makeWrapper, coreutils, curl, bash }:
 
 let
   version = "1.0.5";
@@ -32,8 +32,8 @@ stdenv.mkDerivation {
      b=$(basename $f)
       if [ $b == "mix" ]; then continue; fi
       wrapProgram $f \
-      --prefix PATH ":" "${erlang}/bin:${coreutils}/bin:${curl}/bin:${bash}/bin" \
-      --set CURL_CA_BUNDLE "${cacert}/etc/ssl/certs/ca-bundle.crt"
+        --prefix PATH ":" "${erlang}/bin:${coreutils}/bin:${curl}/bin:${bash}/bin" \
+        --set CURL_CA_BUNDLE /etc/ssl/certs/ca-certificates.crt
     done
   '';
 
diff --git a/pkgs/development/interpreters/picoc/default.nix b/pkgs/development/interpreters/picoc/default.nix
index c9ec01703bf..290abca5474 100644
--- a/pkgs/development/interpreters/picoc/default.nix
+++ b/pkgs/development/interpreters/picoc/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchFromGitHub, readline }:
 
 let version = "2015-05-04"; in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   name = "picoc-${version}";
 
   src = fetchFromGitHub {
diff --git a/pkgs/development/libraries/accounts-qt/default.nix b/pkgs/development/libraries/accounts-qt/default.nix
index 824a2949492..26a04362090 100644
--- a/pkgs/development/libraries/accounts-qt/default.nix
+++ b/pkgs/development/libraries/accounts-qt/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchFromGitLab, doxygen, glib, libaccounts-glib, pkgconfig, qt5 }:
 
 let version = "1.13"; in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   name = "accounts-qt-${version}";
 
   src = fetchFromGitLab {
diff --git a/pkgs/development/libraries/glib-networking/default.nix b/pkgs/development/libraries/glib-networking/default.nix
index 79b31b1365b..a17b7a21409 100644
--- a/pkgs/development/libraries/glib-networking/default.nix
+++ b/pkgs/development/libraries/glib-networking/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, pkgconfig, glib, intltool, gnutls, libproxy
-, gsettings_desktop_schemas, cacert }:
+, gsettings_desktop_schemas }:
 
 let
   ver_maj = "2.44";
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     sha256 = "8f8a340d3ba99bfdef38b653da929652ea6640e27969d29f7ac51fbbe11a4346";
   };
 
-  configureFlags = "--with-ca-certificates=${cacert}/etc/ssl/certs/ca-bundle.crt";
+  configureFlags = "--with-ca-certificates=/etc/ssl/certs/ca-certificates.crt";
 
   preBuild = ''
     sed -e "s@${glib}/lib/gio/modules@$out/lib/gio/modules@g" -i $(find . -name Makefile)
diff --git a/pkgs/development/libraries/glibc/locales.nix b/pkgs/development/libraries/glibc/locales.nix
index 5d6e678bfe6..cbf7af22cac 100644
--- a/pkgs/development/libraries/glibc/locales.nix
+++ b/pkgs/development/libraries/glibc/locales.nix
@@ -29,10 +29,25 @@ build null {
 
       # Hack to allow building of the locales (needed since glibc-2.12)
       sed -i -e 's,^$(rtld-prefix) $(common-objpfx)locale/localedef,localedef --prefix='$TMPDIR',' ../glibc-2*/localedata/Makefile
+    ''
+      + stdenv.lib.optionalString (!allLocales) ''
+      # Check that all locales to be built are supported
+      echo -n '${stdenv.lib.concatMapStrings (s: s + " \\\n") locales}' \
+        | sort > locales-to-build.txt
+      cat ../glibc-2*/localedata/SUPPORTED | grep ' \\' \
+        | sort > locales-supported.txt
+      comm -13 locales-supported.txt locales-to-build.txt \
+        > locales-unsupported.txt
+      if [[ $(wc -c locales-unsupported.txt) != "0 locales-unsupported.txt" ]]; then
+        cat locales-supported.txt
+        echo "Error: unsupported locales detected:"
+        cat locales-unsupported.txt
+        echo "You should choose from the list above the error."
+        false
+      fi
 
-      ${if allLocales then "" else
-          "echo SUPPORTED-LOCALES=\"${toString locales}\" > ../glibc-2*/localedata/SUPPORTED"}
-
+      echo SUPPORTED-LOCALES='${toString locales}' > ../glibc-2*/localedata/SUPPORTED
+    '' + ''
       make localedata/install-locales \
           localedir=$out/lib/locale \
     '';
diff --git a/pkgs/development/libraries/ldb/default.nix b/pkgs/development/libraries/ldb/default.nix
index b400ff813d2..07d4b034474 100644
--- a/pkgs/development/libraries/ldb/default.nix
+++ b/pkgs/development/libraries/ldb/default.nix
@@ -3,11 +3,11 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "ldb-1.1.20";
+  name = "ldb-1.1.21";
 
   src = fetchurl {
     url = "mirror://samba/ldb/${name}.tar.gz";
-    sha256 = "1ckplfvr8rp5y632w5j0abdgkj3irbzjh1wn0yxadnhz4ymknjds";
+    sha256 = "1wfvqys8g3l2gki5xhf5jc50f6k95vdgzb97vvqfls404xzvnyr6";
   };
 
   buildInputs = [
@@ -16,7 +16,6 @@ stdenv.mkDerivation rec {
   ];
 
   preConfigure = ''
-    echo $PYTHONPATH
     sed -i 's,#!/usr/bin/env python,#!${python}/bin/python,g' buildtools/bin/waf
   '';
 
diff --git a/pkgs/development/libraries/libcli/default.nix b/pkgs/development/libraries/libcli/default.nix
index bbeb75d0b8d..a6d564d9294 100644
--- a/pkgs/development/libraries/libcli/default.nix
+++ b/pkgs/development/libraries/libcli/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchFromGitHub }:
 
 let version = "1.9.7"; in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   name = "libcli-${version}";
 
   src = fetchFromGitHub {
diff --git a/pkgs/development/libraries/talloc/default.nix b/pkgs/development/libraries/talloc/default.nix
index d9f52d8d87c..467ccf9db86 100644
--- a/pkgs/development/libraries/talloc/default.nix
+++ b/pkgs/development/libraries/talloc/default.nix
@@ -3,11 +3,11 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "talloc-2.1.2";
+  name = "talloc-2.1.3";
 
   src = fetchurl {
     url = "mirror://samba/talloc/${name}.tar.gz";
-    sha256 = "13c365f7y8idjf2v1jxdjpkc3lxdmsxxfxjx1ymianm7zjiph393";
+    sha256 = "1c1c3zs13qyripjwcjpz2hqc3p9p50m5yl95gdrrrvyl49dzg9bs";
   };
 
   buildInputs = [
diff --git a/pkgs/development/libraries/tdb/default.nix b/pkgs/development/libraries/tdb/default.nix
index 46f4bb68347..2bb47df20cf 100644
--- a/pkgs/development/libraries/tdb/default.nix
+++ b/pkgs/development/libraries/tdb/default.nix
@@ -3,11 +3,11 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "tdb-1.3.6";
+  name = "tdb-1.3.7";
 
   src = fetchurl {
     url = "mirror://samba/tdb/${name}.tar.gz";
-    sha256 = "19arbbicw469q6a9m8yyaigrxzrxkb1jnajlvq1v7n2qgqjdvmw5";
+    sha256 = "04k42cjvjc5wsqsqf44397hclq3nxlm9avjcsbz2hsn01k59akd6";
   };
 
   buildInputs = [
diff --git a/pkgs/development/libraries/ustr/default.nix b/pkgs/development/libraries/ustr/default.nix
index b016a6f715c..9a7475969c6 100644
--- a/pkgs/development/libraries/ustr/default.nix
+++ b/pkgs/development/libraries/ustr/default.nix
@@ -1,6 +1,6 @@
-{ stdenv, fetchurl, glibc }:
-stdenv.mkDerivation rec {
+{ stdenv, fetchurl }:
 
+stdenv.mkDerivation rec {
   name = "ustr-${version}";
   version = "1.0.4";
 
@@ -9,14 +9,30 @@ stdenv.mkDerivation rec {
     sha256 = "1i623ygdj7rkizj7985q9d6vj5amwg686aqb5j3ixpkqkyp6xbrx";
   };
 
-  prePatch = "substituteInPlace Makefile --replace /usr/include/ ${glibc}/include/";
+  # Fixes bogus warnings that failed libsemanage
+  patches = [ ./va_args.patch ];
 
-  patches = [ ./va_args.patch ]; # fixes bogus warnings that failed libsemanage
+  # Work around gcc5 switch to gnu11
+  NIX_CFLAGS_COMPILE = "-std=gnu89";
 
-  makeFlags = "DESTDIR=$(out) prefix= LDCONFIG=echo";
+  # Fix detection of stdint.h
+  postPatch = ''
+    sed -i 's,\(have_stdint_h\)=0,\1=1,g' Makefile
+    sed -i 's,\(USTR_CONF_HAVE_STDINT_H\) 0,\1 1,g' ustr-import.in
+  '';
 
-  configurePhase = "make ustr-import";
-  buildInputs = [ glibc ];
+  buildTargets = [ "all-shared" ];
+
+  preBuild = ''
+    makeFlagsArray+=("prefix=$out")
+    makeFlagsArray+=("LDCONFIG=echo")
+    makeFlagsArray+=("HIDE=")
+  '';
+
+  # Remove debug libraries
+  postInstall = ''
+    find $out/lib -name \*debug\* -delete
+  '';
 
   meta = with stdenv.lib; {
     homepage = http://www.and.org/ustr/;
diff --git a/pkgs/development/tools/misc/bin_replace_string/default.nix b/pkgs/development/tools/misc/bin_replace_string/default.nix
index 7d33d8ee3c3..9e4b77c196e 100644
--- a/pkgs/development/tools/misc/bin_replace_string/default.nix
+++ b/pkgs/development/tools/misc/bin_replace_string/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchurl, libelf, txt2man }:
 
 let version = "0.2"; in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   name = "bin_replace_string-${version}";
 
   src = fetchurl {
diff --git a/pkgs/development/tools/parsing/flexc++/default.nix b/pkgs/development/tools/parsing/flexc++/default.nix
index d723cc0382b..0b9c4fcbc64 100644
--- a/pkgs/development/tools/parsing/flexc++/default.nix
+++ b/pkgs/development/tools/parsing/flexc++/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchurl, bobcat, icmake, yodl }:
 
 let version = "2.02.00"; in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   name = "flexc++-${version}";
 
   src = fetchurl {
diff --git a/pkgs/misc/emulators/ppsspp/default.nix b/pkgs/misc/emulators/ppsspp/default.nix
index 732500be0fc..439566de0ca 100644
--- a/pkgs/misc/emulators/ppsspp/default.nix
+++ b/pkgs/misc/emulators/ppsspp/default.nix
@@ -2,17 +2,21 @@
 , withGamepads ? true, SDL # SDL is used for gamepad functionality
 }:
 
+assert withGamepads -> (SDL != null);
+
 let
-  version = "0.9.9.1";
+  version = "1.1.0";
   fstat = x: fn: "-D" + fn + "=" + (if x then "ON" else "OFF");
-in stdenv.mkDerivation {
+in
+with stdenv.lib;
+stdenv.mkDerivation rec{
   name = "PPSSPP-${version}";
 
   src = fetchgit {
     url = "https://github.com/hrydgard/ppsspp.git";
-    sha256 = "0fdbda0b4dfbecacd01850f1767e980281fed4cc34a21df26ab3259242d8c352";
-    rev = "bf709790c4fed9cd211f755acaa650ace0f7555a";
+    rev = "8c8e5de89d52b8bcb968227d96cbf049d04d1241";
     fetchSubmodules = true;
+    sha256 = "71dfa0be045f31969b1d6ab4f1adf6a208f9ef4834d708bc7bf6d9195efb5f80";
   };
 
   buildInputs = [ zlib libpng pkgconfig qt4 ]
@@ -21,11 +25,11 @@ in stdenv.mkDerivation {
   configurePhase = "cd Qt && qmake PPSSPPQt.pro";
   installPhase = "mkdir -p $out/bin && cp ppsspp $out/bin";
 
-  meta = with stdenv.lib; {
+  meta = {
     homepage = "http://www.ppsspp.org/";
     description = "A PSP emulator, the Qt4 version";
     license = licenses.gpl2Plus;
-    maintainers = [ maintainers.fuuzetsu ];
+    maintainers = [ maintainers.fuuzetsu maintainers.AndersonTorres ];
     platforms = platforms.linux ++ platforms.darwin ++ platforms.cygwin;
   };
-}
\ No newline at end of file
+}
diff --git a/pkgs/os-specific/linux/cgmanager/default.nix b/pkgs/os-specific/linux/cgmanager/default.nix
index 79be500a13d..8f56eda3a1b 100644
--- a/pkgs/os-specific/linux/cgmanager/default.nix
+++ b/pkgs/os-specific/linux/cgmanager/default.nix
@@ -1,31 +1,21 @@
 { stdenv, fetchurl, pkgconfig, libnih, dbus }:
 
 stdenv.mkDerivation rec {
-  name = "cgmanager-0.36";
+  name = "cgmanager-0.37";
 
   src = fetchurl {
     url = "https://linuxcontainers.org/downloads/cgmanager/${name}.tar.gz";
-    sha256 = "039azd4ghpmiccd95ki8fna321kccapff00rib6hrdgg600pyw7l";
+    sha256 = "0vkv8am6h3x89c1rqb6a1glwz3mik3065jigri96njjzmvrff2c3";
   };
 
   buildInputs = [ pkgconfig libnih dbus ];
 
   configureFlags = [
     "--with-init-script=systemd"
-    "--sysconfdir=/etc/"
+    "--sysconfdir=/etc"
     "--localstatedir=/var"
   ];
 
-  installFlags = [ "DESTDIR=\${out}" ];
-
-  postInstall = ''
-    mv $out/$out/* $out
-    DIR=$out/$out
-    while rmdir $DIR 2>/dev/null; do
-      DIR="$(dirname "$DIR")"
-    done
-  '';
-
   meta = with stdenv.lib; {
     homepage = https://linuxcontainers.org/cgmanager/introduction/;
     description = "a central privileged daemon that manages all your cgroups";
diff --git a/pkgs/os-specific/linux/checkpolicy/default.nix b/pkgs/os-specific/linux/checkpolicy/default.nix
index 1f06fb66218..9fbed50f3b9 100644
--- a/pkgs/os-specific/linux/checkpolicy/default.nix
+++ b/pkgs/os-specific/linux/checkpolicy/default.nix
@@ -1,25 +1,32 @@
-{ stdenv, fetchurl, libsepol, libselinux, bison, flex }:
-stdenv.mkDerivation rec {
+{ stdenv, fetchurl, bison, flex, libsepol }:
 
+stdenv.mkDerivation rec {
   name = "checkpolicy-${version}";
-  version = "2.3";
+  version = "2.4";
   inherit (libsepol) se_release se_url;
 
   src = fetchurl {
     url = "${se_url}/${se_release}/checkpolicy-${version}.tar.gz";
-    sha256 = "0yr0r2cxz9lbj7i0wqgcd4wjvc6zf1fmqk0xjybnkdpcmw8jsqwh";
+    sha256 = "1m5wjm43lzp6bld8higsvdm2dkddydihhwv9qw2w9r4dm0largcv";
   };
 
-  buildInputs = [ libsepol libselinux bison flex ];
+  nativeBuildInputs = [ bison flex ];
+  buildInputs = [ libsepol ];
 
-  preBuild = ''
-    makeFlags="$makeFlags LEX=flex LIBDIR=${libsepol}/lib PREFIX=$out"
-    sed -e 's@[.]o$@& ../lex.yy.o@' -i test/Makefile
+  NIX_CFLAGS_COMPILE = "-fstack-protector-all";
+
+  # Don't build tests
+  postPatch = ''
+    sed -i '/-C test/d' Makefile
   '';
 
-  meta = with stdenv.lib; {
+  preBuild = ''
+    makeFlagsArray+=("LEX=flex")
+    makeFlagsArray+=("LIBDIR=${libsepol}/lib")
+    makeFlagsArray+=("PREFIX=$out")
+  '';
+
+  meta = libsepol.meta // {
     description = "SELinux policy compiler";
-    license = licenses.gpl2;
-    inherit (libsepol.meta) homepage platforms maintainers;
   };
 }
diff --git a/pkgs/os-specific/linux/freefall/default.nix b/pkgs/os-specific/linux/freefall/default.nix
index 4c1497367e3..34d0f3881e4 100644
--- a/pkgs/os-specific/linux/freefall/default.nix
+++ b/pkgs/os-specific/linux/freefall/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchurl }:
 
 let version = "3.19"; in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   name = "freefall-${version}";
 
   src = fetchurl {
diff --git a/pkgs/os-specific/linux/jfbview/default.nix b/pkgs/os-specific/linux/jfbview/default.nix
index 34bf136ece7..c89f6e81410 100644
--- a/pkgs/os-specific/linux/jfbview/default.nix
+++ b/pkgs/os-specific/linux/jfbview/default.nix
@@ -5,7 +5,7 @@ let
   version = "0.5.1";
   binaries = [ "jfbpdf" "jfbview" "jpdfcat" "jpdfgrep" ];
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   name = "jfbview-${version}";
 
   src = fetchFromGitHub {
diff --git a/pkgs/os-specific/linux/libselinux/default.nix b/pkgs/os-specific/linux/libselinux/default.nix
index 746f49b519d..22ff351e45a 100644
--- a/pkgs/os-specific/linux/libselinux/default.nix
+++ b/pkgs/os-specific/linux/libselinux/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, pkgconfig, libsepol, pcre
-, enablePython ? false, swig ? null, python ? null
+, enablePython ? true, swig ? null, python ? null
 }:
 
 assert enablePython -> swig != null && python != null;
@@ -8,31 +8,34 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   name = "libselinux-${version}";
-  version = "2.3";
+  version = "2.4";
   inherit (libsepol) se_release se_url;
 
   src = fetchurl {
     url = "${se_url}/${se_release}/libselinux-${version}.tar.gz";
-    sha256 = "1ckpiv6m5c07rp5vawlhv02w5rq8kc0n95fh2ckq2jnqxi1hn7hb";
+    sha256 = "0yqg73ns97jwjh1iyv0jr5qxb8k5sqq5ywfkx11lzfn5yj8k0126";
   };
 
   buildInputs = [ pkgconfig libsepol pcre ]
              ++ optionals enablePython [ swig python ];
 
+  NIX_CFLAGS_COMPILE = "-fstack-protector-all -std=gnu89";
+
   postPatch = optionalString enablePython ''
     sed -i -e 's|\$(LIBDIR)/libsepol.a|${libsepol}/lib/libsepol.a|' src/Makefile
   '';
 
-  installFlags = [ "PREFIX=$(out)" "DESTDIR=$(out)" ];
-  installTargets = [ "install" ] ++ optional enablePython "install-pywrap";
+  preBuild = ''
+    # Build fails without this precreated
+    mkdir -p $out/include
 
-  # TODO: Figure out why the build incorrectly links libselinux.so
-  postInstall = ''
-    rm $out/lib/libselinux.so
-    ln -s libselinux.so.1 $out/lib/libselinux.so
+    makeFlagsArray+=("PREFIX=$out")
+    makeFlagsArray+=("DESTDIR=$out")
   '';
 
-  meta = {
-    inherit (libsepol.meta) homepage platforms maintainers;
+  installTargets = [ "install" ] ++ optional enablePython "install-pywrap";
+
+  meta = libsepol.meta // {
+    description = "SELinux core library";
   };
 }
diff --git a/pkgs/os-specific/linux/libsemanage/default.nix b/pkgs/os-specific/linux/libsemanage/default.nix
index 599da9e4b3c..c60d96bba78 100644
--- a/pkgs/os-specific/linux/libsemanage/default.nix
+++ b/pkgs/os-specific/linux/libsemanage/default.nix
@@ -1,25 +1,27 @@
-{ stdenv, fetchurl, libsepol, libselinux, ustr, bzip2, bison, flex, audit }:
-stdenv.mkDerivation rec {
+{ stdenv, fetchurl, bison, flex, libsepol, libselinux, ustr, bzip2, libaudit }:
 
+stdenv.mkDerivation rec {
   name = "libsemanage-${version}";
-  version = "2.3";
+  version = "2.4";
   inherit (libsepol) se_release se_url;
 
   src = fetchurl {
     url = "${se_url}/${se_release}/libsemanage-${version}.tar.gz";
-    sha256 = "0jrf66df80mvjhrsbxcnb60j69pg4dh2pydy8vj8dhhiwqsrxq03";
+    sha256 = "1134ka4mi4387ac5yv68bpp2y7ln5xxhwp07xhqnay0nxzjaqk0s";
   };
 
-  makeFlags = "PREFIX=$(out) DESTDIR=$(out)";
+  nativeBuildInputs = [ bison flex ];
+  buildInputs = [ libsepol libselinux ustr bzip2 libaudit ];
 
-  NIX_CFLAGS_COMPILE = "-fstack-protector-all";
-  NIX_CFLAGS_LINK = "-lsepol";
+  NIX_CFLAGS_COMPILE = "-fstack-protector-all -std=gnu89";
 
-  buildInputs = [ libsepol libselinux ustr bzip2 bison flex audit ];
+  preBuild = ''
+    makeFlagsArray+=("PREFIX=$out")
+    makeFlagsArray+=("DESTDIR=$out")
+  '';
 
-  meta = with stdenv.lib; {
-    inherit (libsepol.meta) homepage platforms maintainers;
+  meta = libsepol.meta // {
     description = "Policy management tools for SELinux";
-    license = licenses.lgpl21;
+    license = stdenv.lib.licenses.lgpl21;
   };
 }
diff --git a/pkgs/os-specific/linux/libsepol/default.nix b/pkgs/os-specific/linux/libsepol/default.nix
index 29b6d80445a..ecbb2a0ec46 100644
--- a/pkgs/os-specific/linux/libsepol/default.nix
+++ b/pkgs/os-specific/linux/libsepol/default.nix
@@ -1,22 +1,23 @@
-{ stdenv, fetchurl }:
+{ stdenv, fetchurl, flex }:
 
 stdenv.mkDerivation rec {
   name = "libsepol-${version}";
-  version = "2.3";
-  se_release = "20140506";
+  version = "2.4";
+  se_release = "20150202";
   se_url = "https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases";
 
   src = fetchurl {
     url = "${se_url}/${se_release}/libsepol-${version}.tar.gz";
-    sha256 = "13z6xakc2qqyhlvnc5h53jy7lqmh5b5cnpfn51lmvfdpqd18d3fc";
+    sha256 = "0ncnwhpc1gx4hrrb822fqkwy5h75zzngsrfkd5mlqh1jk7aib419";
   };
 
-  preBuild = '' makeFlags="$makeFlags PREFIX=$out DESTDIR=$out" '';
+  nativeBuildInputs = [ flex ];
 
-  # TODO: Figure out why the build incorrectly links libsepol.so
-  postInstall = ''
-    rm $out/lib/libsepol.so
-    ln -s libsepol.so.1 $out/lib/libsepol.so
+  NIX_CFLAGS_COMPILE = "-fstack-protector-all";
+
+  preBuild = ''
+    makeFlagsArray+=("PREFIX=$out")
+    makeFlagsArray+=("DESTDIR=$out")
   '';
 
   passthru = { inherit se_release se_url; };
diff --git a/pkgs/os-specific/linux/lxc/default.nix b/pkgs/os-specific/linux/lxc/default.nix
index 1c6847cce82..c7170d5b464 100644
--- a/pkgs/os-specific/linux/lxc/default.nix
+++ b/pkgs/os-specific/linux/lxc/default.nix
@@ -1,7 +1,9 @@
 { stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, perl, docbook2x
-, docbook_xml_dtd_45, systemd, wrapPython
-, libapparmor ? null, gnutls ? null, libseccomp ? null, cgmanager ? null
-, libnih ? null, dbus ? null, libcap ? null, python3 ? null
+, docbook_xml_dtd_45, python3Packages
+
+# Optional Dependencies
+, libapparmor ? null, gnutls ? null, libselinux ? null, libseccomp ? null
+, cgmanager ? null, libnih ? null, dbus ? null, libcap ? null, systemd ? null
 }:
 
 let
@@ -18,10 +20,12 @@ stdenv.mkDerivation rec {
     sha256 = "149nq630h9bg87hb3cn086ci0cz29l7fp3i6qf1mqxv7hnildm8p";
   };
 
+  nativeBuildInputs = [
+    autoreconfHook pkgconfig perl docbook2x python3Packages.wrapPython
+  ];
   buildInputs = [
-    autoreconfHook pkgconfig perl docbook2x systemd
-    libapparmor gnutls libseccomp cgmanager libnih dbus libcap python3
-    wrapPython
+    libapparmor gnutls libselinux libseccomp cgmanager libnih dbus libcap
+    python3Packages.python systemd
   ];
 
   patches = [ ./support-db2x.patch ];
@@ -31,17 +35,23 @@ stdenv.mkDerivation rec {
   configureFlags = [
     "--localstatedir=/var"
     "--sysconfdir=/etc"
-    "--with-rootfs-path=/var/lib/lxc/rootfs"
+    "--enable-doc"
+    "--disable-api-docs"
   ] ++ optional (libapparmor != null) "--enable-apparmor"
-    ++ optional (gnutls != null) "--enable-gnutls"
+    ++ optional (libselinux != null) "--enable-selinux"
     ++ optional (libseccomp != null) "--enable-seccomp"
-    ++ optional (enableCgmanager) "--enable-cgmanager"
     ++ optional (libcap != null) "--enable-capabilities"
     ++ [
-    "--enable-doc"
-    "--enable-tests"
+    "--disable-examples"
+    "--enable-python"
+    "--disable-lua"
+    "--enable-bash"
+    (if doCheck then "--enable-tests" else "--disable-tests")
+    "--with-rootfs-path=/var/lib/lxc/rootfs"
   ];
 
+  doCheck = false;
+
   installFlags = [
     "localstatedir=\${TMPDIR}"
     "sysconfdir=\${out}/etc"
@@ -50,7 +60,9 @@ stdenv.mkDerivation rec {
     "LXCPATH=\${TMPDIR}/var/lib/lxc"
   ];
 
-  postInstall = "wrapPythonPrograms";
+  postInstall = ''
+    wrapPythonPrograms
+  '';
 
   meta = {
     homepage = "http://lxc.sourceforge.net";
diff --git a/pkgs/os-specific/linux/phc-intel/default.nix b/pkgs/os-specific/linux/phc-intel/default.nix
index 4b656967386..4c47047ff74 100644
--- a/pkgs/os-specific/linux/phc-intel/default.nix
+++ b/pkgs/os-specific/linux/phc-intel/default.nix
@@ -7,7 +7,7 @@ assert stdenv.lib.versionAtLeast kernel.version "4.0";
 assert !kernel.features ? grsecurity;
 
 let version = "0.4.0-rev17"; in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   name = "linux-phc-intel-${version}-${kernel.version}";
 
   src = fetchurl {
diff --git a/pkgs/os-specific/linux/policycoreutils/default.nix b/pkgs/os-specific/linux/policycoreutils/default.nix
index ef7e76824db..4eb8394a4d3 100644
--- a/pkgs/os-specific/linux/policycoreutils/default.nix
+++ b/pkgs/os-specific/linux/policycoreutils/default.nix
@@ -1,29 +1,38 @@
-{ stdenv, fetchurl, intltool, pcre, libcap_ng, libcgroup
-, libsepol, libselinux, libsemanage, setools
-, python, sepolgen }:
-stdenv.mkDerivation rec {
+{ stdenv, fetchurl, pythonPackages, gettext
+, setools, libsepol, libselinux, libcap_ng, libsemanage, sepolgen
+}:
 
+stdenv.mkDerivation rec {
   name = "policycoreutils-${version}";
-  version = "2.3";
+  version = "2.4";
   inherit (libsepol) se_release se_url;
 
   src = fetchurl {
     url = "${se_url}/${se_release}/policycoreutils-${version}.tar.gz";
-    sha256 = "1lpwxr5hw3dwhlp2p7y8jcr18mvfcrclwd8c2idz3lmmb3pglk46";
+    sha256 = "0y9l9k60iy21hj0lcvfdfxs1fxydg6d3pxp9rhy7hwr4y5vgh6dq";
   };
 
-  preConfigure = ''
+  postPatch = ''
+    # Fix references to libsepol.a
+    find . -name Makefile -exec sed -i 's,[^ ]*/libsepol.a,${libsepol}/lib/libsepol.a,g' {} \;
+
+    # Fix install references
     substituteInPlace po/Makefile --replace /usr/bin/install install
-    find . -type f -exec sed -i 's,/usr/bin/python,${python}/bin/python,' {} \;
+
+    # Fix references to /usr/share
+    grep -r '/usr/share' | awk -F: '{print $1}' | xargs sed -i "s,\(\$(DESTDIR)\)*/usr/share,$out/share,g"
+
+    # Fix sepolicy install
+    sed -i "s,\(setup.py install\).*,\1 --prefix=$out,g" sepolicy/Makefile
   '';
 
-  buildInputs = [ intltool pcre libcap_ng libcgroup
-    libsepol libselinux libsemanage setools
-    python sepolgen # ToDo? these are optional
-  ];
+  nativeBuildInputs = [ pythonPackages.python gettext ];
+  buildInputs = [ setools libsepol libselinux libcap_ng libsemanage ];
+  pythonPath = [ libselinux sepolgen ];
 
   preBuild = ''
-    mkdir -p "$out/lib" && cp -s "${libsepol}/lib/libsepol.a" "$out/lib"
+    makeFlagsArray+=("PREFIX=$out")
+    makeFlagsArray+=("DESTDIR=$out")
   '';
 
   # Creation of the system-config-selinux directory is broken
@@ -31,14 +40,19 @@ stdenv.mkDerivation rec {
     mkdir -p $out/share/system-config-selinux
   '';
 
+  # Fix the python scripts to include paths to libraries
+  # NOTE: We are not using wrapPythonPrograms or makeWrapper as these scripts
+  # purge the environment as a security measure
+  postInstall = ''
+    grep -r '#!.*python' $out/bin | awk -F: '{print $1}' | xargs sed -i "1a \
+    import sys; \
+    sys.path.append('$(toPythonPath "$out")'); \
+    ${stdenv.lib.flip stdenv.lib.concatMapStrings pythonPath (lib: ''
+      sys.path.append('$(toPythonPath "${lib}")'); \
+    '')}"
+  '';
+
   NIX_CFLAGS_COMPILE = "-fstack-protector-all";
-  NIX_LDFLAGS = "-lsepol -lpcre";
-
-  makeFlags = "PREFIX=$(out) DESTDIR=$(out) LOCALEDIR=$(out)/share/locale";
-
-  patches = [ ./size_format.patch ];
-
-  patchFlags = [ "-p0" ];
 
   meta = with stdenv.lib; {
     description = "SELinux policy core utilities";
diff --git a/pkgs/os-specific/linux/policycoreutils/size_format.patch b/pkgs/os-specific/linux/policycoreutils/size_format.patch
deleted file mode 100644
index 04432098547..00000000000
--- a/pkgs/os-specific/linux/policycoreutils/size_format.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- setfiles/restore.c.orig	2014-08-21 17:26:00.200788259 +0200
-+++ setfiles/restore.c	2014-08-21 17:26:04.728888118 +0200
-@@ -118,7 +118,7 @@
- 		r_opts->count++;
- 		if (r_opts->count % STAR_COUNT == 0) {
- 			if (r_opts->progress == 1) {
--				fprintf(stdout, "\r%luk", (size_t) r_opts->count / STAR_COUNT );
-+				fprintf(stdout, "\r%zuk", (size_t) r_opts->count / STAR_COUNT );
- 			} else {
- 				if (r_opts->nfile > 0) {
- 					progress = (r_opts->count < r_opts->nfile) ? (100.0 * r_opts->count / r_opts->nfile) : 100;
diff --git a/pkgs/os-specific/linux/sepolgen/default.nix b/pkgs/os-specific/linux/sepolgen/default.nix
index 812b100699f..4067e5f70e2 100644
--- a/pkgs/os-specific/linux/sepolgen/default.nix
+++ b/pkgs/os-specific/linux/sepolgen/default.nix
@@ -2,17 +2,19 @@
 
 stdenv.mkDerivation rec {
   name = "sepolgen-${version}";
-  version = "1.2.1";
+  version = "1.2.2";
   inherit (libsepol) se_release se_url;
 
   src = fetchurl {
     url = "${se_url}/${se_release}/sepolgen-${version}.tar.gz";
-    sha256 = "1c41hz4a64mjvbfhgc7c7plydahsc161z0qn46qz2g3bvimj9323";
+    sha256 = "09139kspr41zgksayi4dh982p8080lrfl96p4dld51nknbpaigdy";
   };
 
-  makeFlags = "PREFIX=$(out) DESTDIR=$(out) PYTHONLIBDIR=lib/${python.libPrefix}/site-packages";
-
-  buildInputs = [ python ];
+  preBuild = ''
+    makeFlagsArray+=("PREFIX=$out")
+    makeFlagsArray+=("DESTDIR=$out")
+    makeFlagsArray+=("PYTHONLIBDIR=lib/${python.libPrefix}/site-packages")
+  '';
 
   meta = with stdenv.lib; {
     inherit (libsepol.meta) homepage platforms maintainers;
diff --git a/pkgs/os-specific/linux/setools/default.nix b/pkgs/os-specific/linux/setools/default.nix
index 63a43b2b5e9..bb17683800f 100644
--- a/pkgs/os-specific/linux/setools/default.nix
+++ b/pkgs/os-specific/linux/setools/default.nix
@@ -1,28 +1,28 @@
-{ stdenv, fetchurl, fetchpatch, autoreconfHook, pkgconfig, bison, flex
+{ stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, bison, flex
 , python, swig2, tcl, libsepol, libselinux, libxml2, sqlite, bzip2 }:
 
 stdenv.mkDerivation rec {
-  name = "setools-3.3.8";
+  name = "setools-2015-02-12";
 
-  src = fetchurl {
-    url = "http://oss.tresys.com/projects/setools/chrome/site/dists/${name}/${name}.tar.bz2";
-    sha256 = "16g987ijaxabc30zyjzia4nafq49rm038y1pm4vca7i3kb67wf24";
+  src = fetchFromGitHub {
+    owner = "TresysTechnology";
+    repo = "setools3";
+    rev = "f1e5b208d507171968ca4d2eeefd7980f1004a3c";
+    sha256 = "02gzy2kpszhr13f0d9qfiwh2hj4201g2x366j53v5n5qz481aykd";
   };
 
-  patches = [ ./ftbfs-invalid-operands-of-types.patch ];
+  configureFlags = [
+    "--disable-gui"
+    "--with-sepol-devel=${libsepol}"
+    "--with-selinux-devel=${libselinux}"
+    "--with-tcl=${tcl}/lib"
+  ];
 
-  # SWIG-TCL is broken in 3.3.8
-  configureFlags = ''
-    --with-tcl=${tcl}/lib
-    --with-sepol-devel=${libsepol}
-    --with-selinux-devel=${libselinux}
-    --disable-gui
-    --disable-swig-tcl
-  '';
+  NIX_CFLAGS_COMPILE = "-fstack-protector-all";
+  NIX_LDFLAGS = "-L${libsepol}/lib -L${libselinux}/lib";
 
-  buildInputs = [ autoreconfHook pkgconfig bison flex python swig2 ];
-
-  nativeBuildInputs = [ tcl libsepol libselinux libxml2 sqlite bzip2 ];
+  nativeBuildInputs = [ autoreconfHook pkgconfig python swig2 bison flex ];
+  buildInputs = [ tcl libxml2 sqlite bzip2 ];
 
   meta = {
     description = "SELinux Tools";
diff --git a/pkgs/os-specific/linux/setools/ftbfs-invalid-operands-of-types.patch b/pkgs/os-specific/linux/setools/ftbfs-invalid-operands-of-types.patch
deleted file mode 100644
index 97a5727f05b..00000000000
--- a/pkgs/os-specific/linux/setools/ftbfs-invalid-operands-of-types.patch
+++ /dev/null
@@ -1,15 +0,0 @@
-https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=750331
-
-Index: setools-git/secmds/replcon.cc
-===================================================================
---- setools-git.orig/secmds/replcon.cc
-+++ setools-git/secmds/replcon.cc
-@@ -60,7 +60,7 @@ static struct option const longopts[] =
- 	{NULL, 0, NULL, 0}
- };
- 
--extern int lsetfilecon_raw(const char *, security_context_t) __attribute__ ((weak));
-+extern int lsetfilecon_raw(const char *, const char *) __attribute__ ((weak));
- 
- /**
-  * As that setools must work with older libselinux versions that may
diff --git a/pkgs/servers/mail/opensmtpd/default.nix b/pkgs/servers/mail/opensmtpd/default.nix
index 810012fb60a..a95a5d81ce9 100644
--- a/pkgs/servers/mail/opensmtpd/default.nix
+++ b/pkgs/servers/mail/opensmtpd/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     "--with-sock-dir=/run"
     "--with-privsep-user=smtpd"
     "--with-queue-user=smtpq"
-    "--with-ca-file=${cacert}/etc/ssl/certs/ca-bundle.crt"
+    "--with-ca-file=/etc/ssl/certs/ca-certificates.crt"
   ];
 
   installFlags = [
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index 0ac991bb1e6..afd864eafac 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -80,9 +80,9 @@ in
     nativeBuildInputs = [ args.python ];
   };
 
-  # libxkbfile = attrs: attrs // {
-  #   patches = lib.optional stdenv.cc.isClang ./libxkbfile-clang36.patch;
-  # };
+  libxkbfile = attrs: attrs // {
+    patches = lib.optional stdenv.cc.isClang ./libxkbfile-clang36.patch;
+  };
 
   libpciaccess = attrs : attrs // {
     patches = [ ./libpciaccess-apple.patch ];
@@ -287,9 +287,9 @@ in
         dmxproto /*libdmx not used*/ xf86vidmodeproto
         recordproto libXext pixman libXfont
         damageproto xcmiscproto  bigreqsproto
-        inputproto xextproto randrproto renderproto presentproto
+        libpciaccess inputproto xextproto randrproto renderproto presentproto
         dri2proto dri3proto kbproto xineramaproto resourceproto scrnsaverproto videoproto
-      ] ++ lib.optional (!isDarwin) libpciaccess;
+      ];
       commonPatches = [ ./xorgserver-xkbcomp-path.patch ]
                    ++ lib.optional isDarwin ./fix-clang.patch;
       # XQuartz requires two compilations: the first to get X / XQuartz,
diff --git a/pkgs/tools/backup/bup/default.nix b/pkgs/tools/backup/bup/default.nix
index 1964f01b077..b4efe9fb441 100644
--- a/pkgs/tools/backup/bup/default.nix
+++ b/pkgs/tools/backup/bup/default.nix
@@ -1,5 +1,5 @@
-{ stdenv, fetchzip, python, pyxattr, pylibacl, setuptools, fuse, git, perl, pandoc, makeWrapper
-, par2cmdline, par2Support ? false }:
+{ stdenv, fetchzip, fetchurl, python, pyxattr, pylibacl, setuptools
+, fuse, git, perl, pandoc, makeWrapper, par2cmdline, par2Support ? false }:
 
 assert par2Support -> par2cmdline != null;
 
@@ -7,7 +7,7 @@ let version = "0.26"; in
 
 with stdenv.lib;
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   name = "bup-${version}";
 
   src = fetchzip {
@@ -18,12 +18,19 @@ stdenv.mkDerivation {
   buildInputs = [ python git ];
   nativeBuildInputs = [ pandoc perl makeWrapper ];
 
-  patchPhase = ''
+  darwin_10_10_patch = fetchurl {
+    url = "https://github.com/bup/bup/commit/75d089e7cdb7a7eb4d69c352f56dad5ad3aa1f97.diff";
+    sha256 = "05kp47p30a45ip0fg090vijvzc7ijr0alc3y8kjl6bvv3gliails";
+  };
+
+  postPatch = ''
     patchShebangs .
     substituteInPlace Makefile --replace "-Werror" ""
     substituteInPlace Makefile --replace "./format-subst.pl" "perl ./format-subst.pl"
   '' + optionalString par2Support ''
     substituteInPlace cmd/fsck-cmd.py --replace "['par2'" "['${par2cmdline}/bin/par2'"
+  '' + optionalString (elem stdenv.system platforms.darwin) ''
+    patch -p1 < ${darwin_10_10_patch}
   '';
 
   dontAddPrefix = true;
diff --git a/pkgs/tools/compression/lz4/default.nix b/pkgs/tools/compression/lz4/default.nix
index 57f0327fa1e..1fefc1dcc83 100644
--- a/pkgs/tools/compression/lz4/default.nix
+++ b/pkgs/tools/compression/lz4/default.nix
@@ -17,9 +17,8 @@ stdenv.mkDerivation rec {
 
   makeFlags = "PREFIX=$(out)";
 
-  doCheck = false;
+  doCheck = false; # tests take a very long time
   checkTarget = "test";
-  checkFlags = "-j1 -C programs"; # -j1 required since version 128, -C should be temporary
 
   meta = with stdenv.lib; {
     description = "Extremely fast compression algorithm";
diff --git a/pkgs/tools/filesystems/duff/default.nix b/pkgs/tools/filesystems/duff/default.nix
index edb69aaef5c..31015334166 100644
--- a/pkgs/tools/filesystems/duff/default.nix
+++ b/pkgs/tools/filesystems/duff/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchFromGitHub, autoreconfHook, gettext }:
 
 let version = "0.5.2"; in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   name = "duff-${version}";
 
   src = fetchFromGitHub {
diff --git a/pkgs/tools/filesystems/encfs/default.nix b/pkgs/tools/filesystems/encfs/default.nix
index d85440c5475..b21054e478d 100644
--- a/pkgs/tools/filesystems/encfs/default.nix
+++ b/pkgs/tools/filesystems/encfs/default.nix
@@ -2,7 +2,7 @@
 , pkgconfig, rlog }:
 
 let version = "1.8.1"; in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   name = "encfs-${version}";
 
   src = fetchFromGitHub {
diff --git a/pkgs/tools/misc/entr/default.nix b/pkgs/tools/misc/entr/default.nix
new file mode 100644
index 00000000000..8770a585887
--- /dev/null
+++ b/pkgs/tools/misc/entr/default.nix
@@ -0,0 +1,32 @@
+{ stdenv, fetchurl, coreutils, ncurses }:
+
+stdenv.mkDerivation rec {
+  name = "entr-${version}";
+  version = "3.2";
+
+  src = fetchurl {
+    url = "http://entrproject.org/code/${name}.tar.gz";
+    sha256 = "0ikigpfzyjmr8j6snwlvxzqamrjbhlv78m8w1h0h7kzczc5f1vmi";
+  };
+
+  postPatch = ''
+    substituteInPlace Makefile.bsd --replace /bin/echo echo
+    substituteInPlace entr.c --replace /bin/cat ${coreutils}/bin/cat
+    substituteInPlace entr.c --replace /usr/bin/clear ${ncurses}/bin/clear
+    substituteInPlace entr.1 --replace /bin/cat cat
+    substituteInPlace entr.1 --replace /usr/bin/clear clear
+  '';
+  dontAddPrefix = true;
+  doCheck = true;
+  checkTarget = "test";
+  installFlags = [ "PREFIX=$(out)" ];
+
+  meta = {
+    homepage = http://entrproject.org/;
+    description = "Run arbitrary commands when files change.";
+
+    license = stdenv.lib.licenses.isc;
+
+    platforms = stdenv.lib.platforms.all;
+  };
+}
diff --git a/pkgs/tools/misc/pipelight/pipelight.patch b/pkgs/tools/misc/pipelight/pipelight.patch
index bde6ecf943d..66dd0fdab4c 100644
--- a/pkgs/tools/misc/pipelight/pipelight.patch
+++ b/pkgs/tools/misc/pipelight/pipelight.patch
@@ -43,7 +43,7 @@ diff -urN pipelight.old/bin/pipelight-plugin.in pipelight.new/bin/pipelight-plug
 -fi
 +download_file()
 +{
-+	curl --cacert /etc/ssl/certs/ca-bundle.crt -o "$1" "$2"
++	curl --cacert /etc/ssl/certs/ca-certificates.crt -o "$1" "$2"
 +}
 
  # Use shasum instead of sha256sum on MacOS / *BSD
@@ -111,7 +111,7 @@ diff -urN pipelight.old/share/install-dependency pipelight.new/share/install-dep
 -fi
 +download_file()
 +{
-+	curl --cacert /etc/ssl/certs/ca-bundle.crt -o "$1" "$2"
++	curl --cacert /etc/ssl/certs/ca-certificates.crt -o "$1" "$2"
 +}
 +get_download_size()
 +{
diff --git a/pkgs/tools/networking/aria2/default.nix b/pkgs/tools/networking/aria2/default.nix
index 8d7f4541cad..e48beb3fe35 100644
--- a/pkgs/tools/networking/aria2/default.nix
+++ b/pkgs/tools/networking/aria2/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, cacert, c-ares, openssl, libxml2, sqlite, zlib }:
+{ stdenv, fetchurl, pkgconfig, c-ares, openssl, libxml2, sqlite, zlib }:
 
 stdenv.mkDerivation rec {
   name = "aria2-${version}";
@@ -11,9 +11,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ pkgconfig c-ares openssl libxml2 sqlite zlib ];
 
-  propagatedBuildInputs = [ cacert ];
-
-  configureFlags = [ "--with-ca-bundle=${cacert}/etc/ssl/certs/ca-bundle.crt" ];
+  configureFlags = [ "--with-ca-bundle=/etc/ssl/certs/ca-certificates.crt" ];
 
   meta = with stdenv.lib; {
     homepage = http://aria2.sourceforge.net/;
diff --git a/pkgs/tools/networking/hans/default.nix b/pkgs/tools/networking/hans/default.nix
index c4f7c8da9d4..31a47d2e441 100644
--- a/pkgs/tools/networking/hans/default.nix
+++ b/pkgs/tools/networking/hans/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchFromGitHub, nettools }:
 
 let version = "0.4.4"; in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   name = "hans-${version}";
 
   src = fetchFromGitHub {
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ nettools ];
 
   postPatch = ''
-    substituteInPlace src/tun.cpp --replace "/sbin/" "/${nettools}/bin/"
+    substituteInPlace src/tun.cpp --replace "/sbin/" "${nettools}/bin/"
   '';
 
   enableParallelBuilding = true;
diff --git a/pkgs/tools/package-management/disnix/dysnomia/default.nix b/pkgs/tools/package-management/disnix/dysnomia/default.nix
index f79250cf018..275c4b6e61f 100644
--- a/pkgs/tools/package-management/disnix/dysnomia/default.nix
+++ b/pkgs/tools/package-management/disnix/dysnomia/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl
-, ejabberd ? null, mysql ? null, postgresql ? null, subversion ? null, mongodb ? null
+, ejabberd ? null, mysql ? null, postgresql ? null, subversion ? null, mongodb ? null, mongodb-tools ? null
 , enableApacheWebApplication ? false
 , enableAxis2WebService ? false
 , enableEjabberdDump ? false
@@ -17,7 +17,7 @@ assert enableMySQLDatabase -> mysql != null;
 assert enablePostgreSQLDatabase -> postgresql != null;
 assert enableSubversionRepository -> subversion != null;
 assert enableEjabberdDump -> ejabberd != null;
-assert enableMongoDatabase -> mongodb != null;
+assert enableMongoDatabase -> (mongodb != null && mongodb-tools != null);
 
 stdenv.mkDerivation {
   name = "dysnomia-0.4";
@@ -45,7 +45,8 @@ stdenv.mkDerivation {
     ++ stdenv.lib.optional enableMySQLDatabase mysql.out
     ++ stdenv.lib.optional enablePostgreSQLDatabase postgresql
     ++ stdenv.lib.optional enableSubversionRepository subversion
-    ++ stdenv.lib.optional enableMongoDatabase mongodb;
+    ++ stdenv.lib.optional enableMongoDatabase mongodb
+    ++ stdenv.lib.optional enableMongoDatabase mongodb-tools;
 
   meta = {
     description = "Automated deployment of mutable components and services for Disnix";
diff --git a/pkgs/tools/security/eid-mw/default.nix b/pkgs/tools/security/eid-mw/default.nix
index e14bc6b9cc4..c039c41314d 100644
--- a/pkgs/tools/security/eid-mw/default.nix
+++ b/pkgs/tools/security/eid-mw/default.nix
@@ -2,7 +2,7 @@
 , pkgconfig }:
 
 let version = "4.1.4"; in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   name = "eid-mw-${version}";
 
   src = fetchFromGitHub {
diff --git a/pkgs/tools/security/eid-viewer/default.nix b/pkgs/tools/security/eid-viewer/default.nix
index f2dfd58a7fb..ad33975a7d9 100644
--- a/pkgs/tools/security/eid-viewer/default.nix
+++ b/pkgs/tools/security/eid-viewer/default.nix
@@ -1,14 +1,16 @@
 { stdenv, fetchurl, jre, makeWrapper, pcsclite }:
 
-stdenv.mkDerivation rec {
+let
   # TODO: find out what the version components actually mean, if anything:
-  package = "eid-viewer-4.0.7-195";
-  build = "tcm406-258907";
-  name = "${package}-${build}";
+  major = "4.1.4-v4.1.4";
+  minor = "tcm406-270732";
+  version = "${major}-${minor}";
+in stdenv.mkDerivation rec {
+  name = "eid-viewer-${version}";
 
   src = fetchurl {
-    url = "http://eid.belgium.be/en/binaries/${package}.src.tar_${build}.gz";
-    sha256 = "e263e6751ef7c185e278a607fdc46c207306d9a56c6ddb2ce6f58fb4464a2893";
+    url = "http://eid.belgium.be/en/binaries/eid-viewer-${major}.src.tar_${minor}.gz";
+    sha256 = "06kda45y7c3wvvqby153zcasgz4jibjypv8gvfwvrwvn4ag2z934";
   };
 
   buildInputs = [ jre pcsclite ];
@@ -31,6 +33,7 @@ stdenv.mkDerivation rec {
   doCheck = true;
 
   meta = with stdenv.lib; {
+    inherit version;
     description = "Belgian electronic identity card (eID) viewer";
     homepage = http://eid.belgium.be/en/using_your_eid/installing_the_eid_software/linux/;
     license = licenses.lgpl3;
diff --git a/pkgs/tools/security/prey/default.nix b/pkgs/tools/security/prey/default.nix
index d04f48c0f31..b36c11cf934 100644
--- a/pkgs/tools/security/prey/default.nix
+++ b/pkgs/tools/security/prey/default.nix
@@ -1,5 +1,4 @@
-{ stdenv, fetchurl, fetchgit, curl, scrot, imagemagick, xawtv, inetutils
-, makeWrapper, coreutils, cacert
+{ stdenv, fetchurl, fetchgit, curl, scrot, imagemagick, xawtv, inetutils, makeWrapper, coreutils
 , apiKey ? ""
 , deviceKey ? "" }:
 
@@ -36,7 +35,7 @@ in stdenv.mkDerivation rec {
     cp -R ${modulesSrc}/* $out/modules/
     wrapProgram "$out/prey.sh" \
       --prefix PATH ":" "${xawtv}/bin:${imagemagick}/bin:${curl}/bin:${scrot}/bin:${inetutils}/bin:${coreutils}/bin" \
-      --set CURL_CA_BUNDLE "${cacert}/etc/ssl/certs/ca-bundle.crt"
+      --set CURL_CA_BUNDLE "/etc/ssl/certs/ca-certificates.crt"
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/security/sudo/default.nix b/pkgs/tools/security/sudo/default.nix
index 8c9d3533346..34e1731778f 100644
--- a/pkgs/tools/security/sudo/default.nix
+++ b/pkgs/tools/security/sudo/default.nix
@@ -1,5 +1,6 @@
 { stdenv, fetchurl, coreutils, pam, groff
 , sendmailPath ? "/var/setuid-wrappers/sendmail"
+, withInsults ? false
 }:
 
 stdenv.mkDerivation rec {
@@ -20,6 +21,9 @@ stdenv.mkDerivation rec {
     "--with-vardir=/var/db/sudo"
     "--with-logpath=/var/log/sudo.log"
     "--with-sendmail=${sendmailPath}"
+  ] ++ stdenv.lib.optional withInsults [
+    "--with-insults"
+    "--with-all-insults"
   ];
 
   configureFlagsArray = [
diff --git a/pkgs/tools/system/stress-ng/default.nix b/pkgs/tools/system/stress-ng/default.nix
index a2cff62e2c8..38f2f2551bf 100644
--- a/pkgs/tools/system/stress-ng/default.nix
+++ b/pkgs/tools/system/stress-ng/default.nix
@@ -1,15 +1,15 @@
-{ stdenv, fetchurl, attr }:
+{ stdenv, fetchurl, attr, keyutils }:
 
-let version = "0.04.12"; in
+let version = "0.04.13"; in
 stdenv.mkDerivation rec {
   name = "stress-ng-${version}";
 
   src = fetchurl {
-    sha256 = "0gc5mai1dzhb7n8wsy2kzx0q85zbsa2ilvc2fpa30ilcwmg28kgm";
+    sha256 = "0h4alfylf15q1rdf9v42fy0bhh4c1s1fagiym445qb3yacf5p9g3";
     url = "http://kernel.ubuntu.com/~cking/tarballs/stress-ng/${name}.tar.gz";
   };
 
-  buildInputs = [ attr ];
+  buildInputs = [ attr keyutils ];
 
   patchPhase = ''
     substituteInPlace Makefile --replace "/usr" ""
diff --git a/pkgs/tools/text/aha/default.nix b/pkgs/tools/text/aha/default.nix
index 4ae8048623c..d1c21e62a66 100644
--- a/pkgs/tools/text/aha/default.nix
+++ b/pkgs/tools/text/aha/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchFromGitHub }:
 
 let version = "0.4.8"; in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   name = "aha-${version}";
 
   src = fetchFromGitHub {
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index baaa1872416..eca3da9b2f2 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1415,6 +1415,8 @@ let
 
   enscript = callPackage ../tools/text/enscript { };
 
+  entr = callPackage ../tools/misc/entr { };
+
   eplot = callPackage ../tools/graphics/eplot { };
 
   ethtool = callPackage ../tools/misc/ethtool { };
@@ -2138,9 +2140,7 @@ let
 
   lshw = callPackage ../tools/system/lshw { };
 
-  lxc = callPackage ../os-specific/linux/lxc {
-    wrapPython = python3Packages.wrapPython;
-  };
+  lxc = callPackage ../os-specific/linux/lxc { };
 
   lzip = callPackage ../tools/compression/lzip { };
 
@@ -9372,6 +9372,7 @@ let
   atop = callPackage ../os-specific/linux/atop { };
 
   audit = callPackage ../os-specific/linux/audit { };
+  libaudit = audit;
 
   b43Firmware_5_1_138 = callPackage ../os-specific/linux/firmware/b43-firmware/5.1.138.nix { };
 
@@ -10873,6 +10874,8 @@ let
 
   clipit = callPackage ../applications/misc/clipit { };
 
+  cmatrix = callPackage ../applications/misc/cmatrix { };
+
   bomi = callPackage ../applications/video/bomi {
     pulseSupport = config.pulseaudio or true;
   };
@@ -12478,6 +12481,24 @@ let
     tag = "-daemon-qt5";
   };
 
+  quassel_kf5 = callPackage ../applications/networking/irc/quassel {
+    monolithic = true;
+    daemon = false;
+    client = false;
+    withKDE = true;
+    useQt5 = true;
+    qt = qt5;
+    kf5 = kf510;
+    dconf = gnome3.dconf;
+    tag = "-kf5";
+  };
+
+  quasselClient_kf5 = quassel_kf5.override {
+    monolithic = false;
+    client = true;
+    tag = "-client-kf5";
+  };
+
   quirc = callPackage ../tools/graphics/quirc {};
 
   quodlibet = callPackage ../applications/audio/quodlibet {
@@ -14824,7 +14845,7 @@ let
 
   polytable = callPackage ../tools/typesetting/tex/polytable { };
 
-  PPSSPP = callPackage ../misc/emulators/ppsspp { };
+  PPSSPP = callPackage ../misc/emulators/ppsspp { SDL = SDL2; };
 
   uae = callPackage ../misc/emulators/uae { };
 
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 8c40152e5ec..8cd7425b274 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -4679,6 +4679,16 @@ let self = _self // overrides; _self = with self; {
     };
   };
 
+  IMAPClient = buildPerlPackage {
+    name = "IMAP-Client-0.13";
+    src = fetchurl {
+      url = mirror://cpan/authors/id/C/CO/CONTEB/IMAP-Client-0.13.tar.gz;
+      sha256 = "15fa4hpw2rqg2iadyz10rnv99hns78wph5qlh3257a3mbfjjyyla";
+    };
+    propagatedBuildInputs = [IOSocketSSL URIIMAP];
+    doCheck = false; # nondeterministic
+  };
+
   ImportInto = buildPerlPackage {
     name = "Import-Into-1.002004";
     src = fetchurl {
@@ -10512,6 +10522,15 @@ let self = _self // overrides; _self = with self; {
     buildInputs = [URI TestMore];
   };
 
+  URIIMAP = buildPerlPackage {
+    name = "URI-imap-1.01";
+    src = fetchurl {
+      url = mirror://cpan/authors/id/C/CW/CWEST/URI-imap-1.01.tar.gz;
+      sha256 = "0bdv6mrdijcq46r3lmz801rscs63f8p9qqliy2safd6fds4rj55v";
+    };
+    propagatedBuildInputs = [URI];
+  };
+
   URINested = buildPerlModule {
     name = "URI-Nested-0.10";
     src = fetchurl {
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index e760380132f..3539d30caf3 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -16790,4 +16790,39 @@ let
       maintainers = with maintainers; [ kamilchm ];
     };
   };
+
+  pafy = buildPythonPackage rec {
+    name = "pafy-${version}";
+    version = "0.3.74";
+
+    src = pkgs.fetchurl {
+      url = "https://pypi.python.org/packages/source/p/pafy/${name}.tar.gz";
+      md5 = "fbf0e7f85914eaf35f87837232eec09c";
+    };
+
+    propagatedBuildInputs = with self; [ youtube-dl ];
+
+    meta = with stdenv.lib; {
+      description = "A library to download YouTube content and retrieve metadata";
+      homepage = http://np1.github.io/pafy/;
+      license = licenses.lgpl3Plus;
+      maintainers = with maintainers; [ odi ];
+    };
+  };
+  
+  suds = buildPythonPackage rec {
+    name = "suds-0.4";
+    
+    src = pkgs.fetchurl {
+      url = "https://pypi.python.org/packages/source/s/suds/suds-0.4.tar.gz";
+      md5 = "b7502de662341ed7275b673e6bd73191";
+    };
+
+    meta = with stdenv.lib; {
+      description = "Lightweight SOAP client";
+      homepage = https://fedorahosted.org/suds;
+      license = licenses.lgpl3Plus;
+    };
+  };
+
 }; in pythonPackages