Merge branch 'master' into staging

2016-01-25 10:02:15 +01:00 · 2016-01-25 10:02:15 +01:00 · 2af19df364
parent 9b980baa9d 7362936cd6
commit 2af19df364
371 changed files with 109156 additions and 80425 deletions
--- a/doc/erlang-users-guide.xml
+++ b/doc/erlang-users-guide.xml
@ -3,6 +3,23 @@
         xml:id="users-guide-to-the-erlang-infrastructure">

 <title>User's Guide to the Erlang Infrastructure</title>
+<section xml:id="build-tools">
+  <title>Build Tools</title>
+  <para>
+    By default Rebar3 wants to manage it's own dependencies. In the
+    normal non-Nix, this is perfectly acceptable. In the Nix world it
+    is not. To support this we have created two versions of rebar3,
+    <literal>rebar3</literal> and <literal>rebar3-open</literal>. The
+    <literal>rebar3</literal> version has been patched to remove the
+    ability to download anything from it. If you are not running it a
+    nix-shell or a nix-build then its probably not going to work for
+    you. <literal>rebar3-open</literal> is the normal, un-modified
+    rebar3. It should work exactly as would any other version of
+    rebar3. Any Erlang package should rely on
+    <literal>rebar3</literal> and thats really what you should be
+    using too.
+  </para>
+</section>

 <section xml:id="how-to-install-erlang-packages">
  <title>How to install Erlang packages</title>
--- a/doc/stdenv.xml
+++ b/doc/stdenv.xml
@ -224,6 +224,63 @@ genericBuild

 </variablelist>

+<variablelist>
+  <title>Variables affecting build properties</title>
+
+  <varlistentry>
+    <term><varname>enableParallelBuilding</varname></term>
+    <listitem><para>If set, <literal>stdenv</literal> will pass specific
+    flags to <literal>make</literal> and other build tools to enable
+    parallel building with up to <literal>build-cores</literal>
+    workers.</para></listitem>
+  </varlistentry>
+
+  <varlistentry>
+    <term><varname>preferLocalBuild</varname></term>
+    <listitem><para>If set, specifies that the package is so lightweight
+    in terms of build operations (e.g. write a text file from a Nix string
+    to the store) that there's no need to look for it in binary caches --
+    it's faster to just build it locally. It also tells Hydra and other
+    facilities that this package doesn't need to be exported in binary
+    caches (noone would use it, after all).</para></listitem>
+  </varlistentry>
+
+</variablelist>
+
+<variablelist>
+  <title>Special variables</title>
+
+  <varlistentry>
+    <term><varname>passthru</varname></term>
+    <listitem><para>This is an attribute set which can be filled with arbitrary
+    values. For example:
+
+<programlisting>
+passthru = {
+  foo = "bar";
+  baz = {
+    value1 = 4;
+    value2 = 5;
+  };
+}
+</programlisting>
+
+</para>
+
+    <para>Values inside it are not passed to the builder, so you can change
+    them without triggering a rebuild. However, they can be accessed outside of a
+    derivation directly, as if they were set inside a derivation itself, e.g.
+    <literal>hello.baz.value1</literal>. We don't specify any usage or
+    schema of <literal>passthru</literal> - it is meant for values that would be
+    useful outside the derivation in other parts of a Nix expression (e.g. in other
+    derivations). An example would be to convey some specific dependency of your
+    derivation which contains a program with plugins support.  Later, others who
+    make derivations with plugins can use passed-through dependency to ensure that
+    their plugin would be binary-compatible with built program.</para></listitem>
+  </varlistentry>
+
+</variablelist>
+
 </section>


@ -1186,6 +1243,14 @@ echo @foo@
    environment variable.</para></listitem>
  </varlistentry>

+  <varlistentry>
+    <term>Autoconf</term>
+    <listitem><para>The <varname>autoreconfHook</varname> derivation adds
+    <varname>autoreconfPhase</varname>, which runs autoreconf, libtoolize and
+    automake, essentially preparing the configure script in autotools-based
+    builds.</para></listitem>
+  </varlistentry>
+
  <varlistentry>
    <term>libxml2</term>
    <listitem><para>Adds every file named
--- a/lib/maintainers.nix
+++ b/lib/maintainers.nix
@ -7,6 +7,7 @@
     so it's easy to ping a package @maintainer.
  */

+  aaronschif = "Aaron Schif <aaronschif@gmail.com>";
  a1russell = "Adam Russell <adamlr6+pub@gmail.com>";
  abaldeau = "Andreas Baldeau <andreas@baldeau.net>";
  abbradar = "Nikolay Amiantov <ab@fmap.me>";
@ -65,6 +66,7 @@
  chattered = "Phil Scott <me@philscotted.com>";
  christopherpoole = "Christopher Mark Poole <mail@christopherpoole.net>";
  coconnor = "Corey O'Connor <coreyoconnor@gmail.com>";
+  codsl = "codsl <codsl@riseup.net>";
  codyopel = "Cody Opel <codyopel@gmail.com>";
  copumpkin = "Dan Peebles <pumpkingod@gmail.com>";
  coroa = "Jonas Hörsch <jonas@chaoflow.net>";
@ -288,6 +290,7 @@
  smironov = "Sergey Mironov <ierton@gmail.com>";
  spacefrogg = "Michael Raitza <spacefrogg-nixos@meterriblecrew.net>";
  spencerjanssen = "Spencer Janssen <spencerjanssen@gmail.com>";
+  spinus = "Tomasz Czyż <tomasz.czyz@gmail.com>";
  sprock = "Roger Mason <rmason@mun.ca>";
  spwhitt = "Spencer Whitt <sw@swhitt.me>";
  stephenmw = "Stephen Weinberg <stephen@q5comm.com>";
@ -338,6 +341,7 @@
  zagy = "Christian Zagrodnick <cz@flyingcircus.io>";
  zef = "Zef Hemel <zef@zef.me>";
  zimbatm = "zimbatm <zimbatm@zimbatm.com>";
+  zohl = "Al Zohali <zohl@fmap.me>";
  zoomulator = "Kim Simmons <zoomulator@gmail.com>";
  Gonzih = "Max Gonzih <gonzih@gmail.com>";
 }
--- a/nixos/doc/manual/configuration/user-mgmt.xml
+++ b/nixos/doc/manual/configuration/user-mgmt.xml
@ -65,6 +65,14 @@ account named <literal>alice</literal>:
 <screen>
 $ useradd -m alice</screen>

+To make all nix tools available to this new user use `su - USER` which 
+opens a login shell (==shell that loads the profile) for given user. 
+This will create the ~/.nix-defexpr symlink. So run:
+
+<screen>
+$ su - alice -c "true"</screen>
+
+
 The flag <option>-m</option> causes the creation of a home directory
 for the new user, which is generally what you want.  The user does not
 have an initial password and therefore cannot log in.  A password can
--- a/nixos/doc/manual/development/writing-modules.xml
+++ b/nixos/doc/manual/development/writing-modules.xml
@ -107,12 +107,12 @@ the file system.  This module declares two options that can be defined
 by other modules (typically the user’s
 <filename>configuration.nix</filename>):
 <option>services.locate.enable</option> (whether the database should
-be updated) and <option>services.locate.period</option> (when the
+be updated) and <option>services.locate.interval</option> (when the
 update should be done).  It implements its functionality by defining
 two options declared by other modules:
 <option>systemd.services</option> (the set of all systemd services)
-and <option>services.cron.systemCronJobs</option> (the list of
-commands to be executed periodically by <command>cron</command>).</para>
+and <option>systemd.timers</option> (the list of commands to be
+executed periodically by <command>systemd</command>).</para>

 <example xml:id='locate-example'><title>NixOS Module for the “locate” Service</title>
 <programlisting>
@ -120,53 +120,59 @@ commands to be executed periodically by <command>cron</command>).</para>

 with lib;

-let locatedb = "/var/cache/locatedb"; in
-
-{
-  options = {
-
-    services.locate = {
-
-      enable = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          If enabled, NixOS will periodically update the database of
-          files used by the <command>locate</command> command.
-        '';
-      };
-
-      period = mkOption {
-        type = types.str;
-        default = "15 02 * * *";
-        description = ''
-          This option defines (in the format used by cron) when the
-          locate database is updated.  The default is to update at
-          02:15 at night every day.
-        '';
-      };
-
+let
+  cfg = config.services.locate;
+in {
+  options.services.locate = {
+    enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        If enabled, NixOS will periodically update the database of
+        files used by the <command>locate</command> command.
+      '';
    };

+    interval = mkOption {
+      type = types.str;
+      default = "02:15";
+      example = "hourly";
+      description = ''
+        Update the locate database at this interval. Updates by
+        default at 2:15 AM every day.
+
+        The format is described in
+        <citerefentry><refentrytitle>systemd.time</refentrytitle>
+        <manvolnum>7</manvolnum></citerefentry>.
+      '';
+    };
+
+    # Other options omitted for documentation
  };

  config = {
-
    systemd.services.update-locatedb =
      { description = "Update Locate Database";
        path  = [ pkgs.su ];
        script =
          ''
-            mkdir -m 0755 -p $(dirname ${locatedb})
-            exec updatedb --localuser=nobody --output=${locatedb} --prunepaths='/tmp /var/tmp /run'
+            mkdir -m 0755 -p $(dirname ${toString cfg.output})
+            exec updatedb \
+              --localuser=${cfg.localuser} \
+              ${optionalString (!cfg.includeStore) "--prunepaths='/nix/store'"} \
+              --output=${toString cfg.output} ${concatStringsSep " " cfg.extraFlags}
          '';
      };

-    services.cron.systemCronJobs = optional config.services.locate.enable
-      "${config.services.locate.period} root ${config.systemd.package}/bin/systemctl start update-locatedb.service";
-
+    systemd.timers.update-locatedb = mkIf cfg.enable
+      { description = "Update timer for locate database";
+        partOf      = [ "update-locatedb.service" ];
+        wantedBy    = [ "timers.target" ];
+        timerConfig.OnCalendar = cfg.interval;
+      };
  };
-}</programlisting>
+}
+</programlisting>
 </example>

 <xi:include href="option-declarations.xml" />
--- a/nixos/doc/manual/release-notes/rl-unstable.xml
+++ b/nixos/doc/manual/release-notes/rl-unstable.xml
@ -146,6 +146,15 @@ nginx.override {
    </para>
  </listitem>

+  <listitem>
+    <para>Data directory for Postfix MTA server is moved from
+    <filename>/var/postfix</filename> to <filename>/var/lib/postfix</filename>.
+    Old configurations are migrated automatically. <literal>service.postfix</literal>
+    module has also received many improvements, such as correct directories' access
+    rights, new <literal>aliasFiles</literal> and <literal>mapFiles</literal>
+    options and more.</para>
+  </listitem>
+
  <listitem>
    <para>CUPS, installed by <literal>services.printing</literal> module, now
    has its data directory in <filename>/var/lib/cups</filename>. Old
@ -178,6 +187,11 @@ nginx.override {
    <command>nix-shell</command> (without installing anything). </para>
  </listitem>

+  <listitem>
+    <para><literal>ejabberd</literal> module is brought back and now works on
+    NixOS.</para>
+  </listitem>
+
 </itemizedlist></para>

 </section>
--- a/nixos/modules/config/networking.nix
+++ b/nixos/modules/config/networking.nix
@ -39,6 +39,17 @@ in
      '';
    };

+    networking.dnsExtensionMechanism = lib.mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Enable the <code>edns0</code> option in <filename>resolv.conf</filename>. With
+        that option set, <code>glibc</code> supports use of the extension mechanisms for
+        DNS (EDNS) specified in RFC 2671. The most popular user of that feature is DNSSEC,
+        which does not work without it.
+      '';
+    };
+
    networking.extraResolvconfConf = lib.mkOption {
      type = types.lines;
      default = "";
@ -162,7 +173,10 @@ in
              libc_restart='${pkgs.systemd}/bin/systemctl try-restart --no-block nscd.service 2> /dev/null'
            '' + optionalString cfg.dnsSingleRequest ''
              # only send one DNS request at a time
-              resolv_conf_options='single-request'
+              resolv_conf_options+=' single-request'
+            '' + optionalString cfg.dnsExtensionMechanism ''
+              # enable extension mechanisms for DNS
+              resolv_conf_options+=' edns0'
            '' + optionalString hasLocalResolver ''
              # This hosts runs a full-blown DNS resolver.
              name_servers='127.0.0.1'
--- a/nixos/modules/installer/tools/nixos-generate-config.pl
+++ b/nixos/modules/installer/tools/nixos-generate-config.pl
@ -148,7 +148,7 @@ sub pciCheck {
         $device eq "0x4331" || $device eq "0x43a0" || $device eq "0x43b1"
        ) )
     {
-        push @modulePackages, "\${config.boot.kernelPackages.broadcom_sta}";
+        push @modulePackages, "config.boot.kernelPackages.broadcom_sta";
        push @kernelModules, "wl";
     }

@ -422,13 +422,20 @@ EOF

 # Generate the hardware configuration file.

-sub toNixExpr {
+sub toNixStringList {
    my $res = "";
    foreach my $s (@_) {
        $res .= " \"$s\"";
    }
    return $res;
 }
+sub toNixList {
+    my $res = "";
+    foreach my $s (@_) {
+        $res .= " $s";
+    }
+    return $res;
+}

 sub multiLineList {
    my $indent = shift;
@ -444,9 +451,9 @@ sub multiLineList {
    return $res;
 }

-my $initrdAvailableKernelModules = toNixExpr(uniq @initrdAvailableKernelModules);
-my $kernelModules = toNixExpr(uniq @kernelModules);
-my $modulePackages = toNixExpr(uniq @modulePackages);
+my $initrdAvailableKernelModules = toNixStringList(uniq @initrdAvailableKernelModules);
+my $kernelModules = toNixStringList(uniq @kernelModules);
+my $modulePackages = toNixList(uniq @modulePackages);

 my $fsAndSwap = "";
 if (!$noFilesystems) {
--- a/nixos/modules/installer/tools/nixos-rebuild.sh
+++ b/nixos/modules/installer/tools/nixos-rebuild.sh
@ -19,6 +19,8 @@ rollback=
 upgrade=
 repair=
 profile=/nix/var/nix/profiles/system
+buildHost=
+targetHost=

 while [ "$#" -gt 0 ]; do
    i="$1"; shift 1
@ -73,6 +75,14 @@ while [ "$#" -gt 0 ]; do
        fi
        shift 1
        ;;
+      --build-host|h)
+        buildHost="$1"
+        shift 1
+        ;;
+      --target-host|t)
+        targetHost="$1"
+        shift 1
+        ;;
      *)
        echo "$0: unknown option \`$i'"
        exit 1
@ -80,6 +90,90 @@ while [ "$#" -gt 0 ]; do
    esac
 done

+
+if [ -z "$buildHost" -a -n "$targetHost" ]; then
+    buildHost="$targetHost"
+fi
+if [ "$targetHost" = localhost ]; then
+    targetHost=
+fi
+if [ "$buildHost" = localhost ]; then
+    buildHost=
+fi
+
+buildHostCmd() {
+    if [ -z "$buildHost" ]; then
+        "$@"
+    elif [ -n "$remoteNix" ]; then
+        ssh $SSHOPTS "$buildHost" PATH="$remoteNix:$PATH" "$@"
+    else
+        ssh $SSHOPTS "$buildHost" "$@"
+    fi
+}
+
+targetHostCmd() {
+    if [ -z "$targetHost" ]; then
+        "$@"
+    else
+        ssh $SSHOPTS "$targetHost" "$@"
+    fi
+}
+
+copyToTarget() {
+    if ! [ "$targetHost" = "$buildHost" ]; then
+        if [ -z "$targetHost" ]; then
+            NIX_SSHOPTS=$SSH_OPTS nix-copy-closure --from "$buildHost" "$1"
+        elif [ -z "$buildHost" ]; then
+            NIX_SSHOPTS=$SSH_OPTS nix-copy-closure --to "$targetHost" "$1"
+        else
+            buildHostCmd nix-copy-closure --to "$targetHost" "$1"
+        fi
+    fi
+}
+
+nixBuild() {
+    if [ -z "$buildHost" ]; then
+        nix-build "$@"
+    else
+        local instArgs=()
+        local buildArgs=()
+
+        while [ "$#" -gt 0 ]; do
+            local i="$1"; shift 1
+            case "$i" in
+              -o)
+                local out="$1"; shift 1
+                buildArgs+=("--add-root" "$out" "--indirect")
+                ;;
+              -A)
+                local j="$1"; shift 1
+                instArgs+=("$i" "$j")
+                ;;
+              -I)
+                # We don't want this in buildArgs
+                shift 1
+                ;;
+              "<"*) # nix paths
+                instArgs+=("$i")
+                ;;
+              *)
+                buildArgs+=("$i")
+                ;;
+            esac
+        done
+
+        local drv="$(nix-instantiate "${instArgs[@]}" "${extraBuildFlags[@]}")"
+        if [ -a "$drv" ]; then
+            NIX_SSHOPTS=$SSH_OPTS nix-copy-closure --to "$buildHost" "$drv"
+            buildHostCmd nix-store -r "$drv" "${buildArgs[@]}"
+        else
+            echo "nix-instantiate failed"
+            exit 1
+        fi
+  fi
+}
+
+
 if [ -z "$action" ]; then showSyntax; fi

 # Only run shell scripts from the Nixpkgs tree if the action is
@ -128,7 +222,16 @@ fi


 tmpDir=$(mktemp -t -d nixos-rebuild.XXXXXX)
-trap 'rm -rf "$tmpDir"' EXIT
+SSHOPTS="$NIX_SSHOPTS -o ControlMaster=auto -o ControlPath=$tmpDir/ssh-%n -o ControlPersist=60"
+
+cleanup() {
+    for ctrl in "$tmpDir"/ssh-*; do
+        ssh -o ControlPath="$ctrl" -O exit dummyhost 2>/dev/null || true
+    done
+    rm -rf "$tmpDir"
+}
+trap cleanup EXIT
+


 # If the Nix daemon is running, then use it.  This allows us to use
@ -150,30 +253,56 @@ if [ -n "$rollback" -o "$action" = dry-build ]; then
    buildNix=
 fi

+prebuiltNix() {
+    machine="$1"
+    if [ "$machine" = x86_64 ]; then
+        return /nix/store/xryr9g56h8yjddp89d6dw12anyb4ch7c-nix-1.10
+    elif [[ "$machine" =~ i.86 ]]; then
+        return /nix/store/2w92k5wlpspf0q2k9mnf2z42prx3bwmv-nix-1.10
+    else
+        echo "$0: unsupported platform"
+        exit 1
+    fi
+}
+
+remotePATH=
+
 if [ -n "$buildNix" ]; then
    echo "building Nix..." >&2
-    if ! nix-build '<nixpkgs/nixos>' -A config.nix.package -o $tmpDir/nix "${extraBuildFlags[@]}" > /dev/null; then
-        if ! nix-build '<nixpkgs/nixos>' -A nixFallback -o $tmpDir/nix "${extraBuildFlags[@]}" > /dev/null; then
-            if ! nix-build '<nixpkgs>' -A nix -o $tmpDir/nix "${extraBuildFlags[@]}" > /dev/null; then
-                machine="$(uname -m)"
-                if [ "$machine" = x86_64 ]; then
-                    nixStorePath=/nix/store/xryr9g56h8yjddp89d6dw12anyb4ch7c-nix-1.10
-                elif [[ "$machine" =~ i.86 ]]; then
-                    nixStorePath=/nix/store/2w92k5wlpspf0q2k9mnf2z42prx3bwmv-nix-1.10
-                else
-                    echo "$0: unsupported platform"
-                    exit 1
-                fi
+    nixDrv=
+    if ! nixDrv="$(nix-instantiate '<nixpkgs/nixos>' --add-root $tmpDir/nix.drv --indirect -A config.nix.package "${extraBuildFlags[@]}")"; then
+        if ! nixDrv="$(nix-instantiate '<nixpkgs/nixos>' --add-root $tmpDir/nix.drv --indirect -A nixFallback "${extraBuildFlags[@]}")"; then
+            if ! nixDrv="$(nix-instantiate '<nixpkgs>' --add-root $tmpDir/nix.drv --indirect -A nix "${extraBuildFlags[@]}")"; then
+                nixStorePath="$(prebuiltNix "$(uname -m)")"
                if ! nix-store -r $nixStorePath --add-root $tmpDir/nix --indirect \
                    --option extra-binary-caches https://cache.nixos.org/; then
                    echo "warning: don't know how to get latest Nix" >&2
                fi
                # Older version of nix-store -r don't support --add-root.
                [ -e $tmpDir/nix ] || ln -sf $nixStorePath $tmpDir/nix
+                if [ -n "$buildHost" ]; then
+                    remoteNixStorePath="$(prebuiltNix "$(buildHostCmd uname -m)")"
+                    remoteNix="$remoteNixStorePath/bin"
+                    if ! buildHostCmd nix-store -r $remoteNixStorePath \
+                      --option extra-binary-caches https://cache.nixos.org/ >/dev/null; then
+                        remoteNix=
+                        echo "warning: don't know how to get latest Nix" >&2
+                    fi
+                fi
            fi
        fi
    fi
-    PATH=$tmpDir/nix/bin:$PATH
+    if [ -a "$nixDrv" ]; then
+        nix-store -r "$nixDrv"'!'"out" --add-root $tmpDir/nix --indirect >/dev/null
+        if [ -n "$buildHost" ]; then
+            nix-copy-closure --to "$buildHost" "$nixDrv"
+            # The nix build produces multiple outputs, we add them all to the remote path
+            for p in $(buildHostCmd nix-store -r "$(readlink "$nixDrv")" "${buildArgs[@]}"); do
+                remoteNix="$remoteNix${remoteNix:+:}$p/bin"
+            done
+        fi
+    fi
+    PATH="$tmpDir/nix/bin:$PATH"
 fi


@ -200,31 +329,35 @@ fi
 if [ -z "$rollback" ]; then
    echo "building the system configuration..." >&2
    if [ "$action" = switch -o "$action" = boot ]; then
-        nix-env "${extraBuildFlags[@]}" -p "$profile" -f '<nixpkgs/nixos>' --set -A system
-        pathToConfig="$profile"
+        pathToConfig="$(nixBuild '<nixpkgs/nixos>' -A system "${extraBuildFlags[@]}")"
+        copyToTarget "$pathToConfig"
+        targetHostCmd nix-env -p "$profile" --set "$pathToConfig"
    elif [ "$action" = test -o "$action" = build -o "$action" = dry-build -o "$action" = dry-activate ]; then
-        nix-build '<nixpkgs/nixos>' -A system -k "${extraBuildFlags[@]}" > /dev/null
-        pathToConfig=./result
+        pathToConfig="$(nixBuild '<nixpkgs/nixos>' -A system -k "${extraBuildFlags[@]}")"
    elif [ "$action" = build-vm ]; then
-        nix-build '<nixpkgs/nixos>' -A vm -k "${extraBuildFlags[@]}" > /dev/null
-        pathToConfig=./result
+        pathToConfig="$(nixBuild '<nixpkgs/nixos>' -A vm -k "${extraBuildFlags[@]}")"
    elif [ "$action" = build-vm-with-bootloader ]; then
-        nix-build '<nixpkgs/nixos>' -A vmWithBootLoader -k "${extraBuildFlags[@]}" > /dev/null
-        pathToConfig=./result
+        pathToConfig="$(nixBuild '<nixpkgs/nixos>' -A vmWithBootLoader -k "${extraBuildFlags[@]}")"
    else
        showSyntax
    fi
+    # Copy build to target host if we haven't already done it
+    if ! [ "$action" = switch -o "$action" = boot ]; then
+        copyToTarget "$pathToConfig"
+    fi
 else # [ -n "$rollback" ]
    if [ "$action" = switch -o "$action" = boot ]; then
-        nix-env --rollback -p "$profile"
+        targetHostCmd nix-env --rollback -p "$profile"
        pathToConfig="$profile"
    elif [ "$action" = test -o "$action" = build ]; then
        systemNumber=$(
-            nix-env -p "$profile" --list-generations |
+            targetHostCmd nix-env -p "$profile" --list-generations |
            sed -n '/current/ {g; p;}; s/ *\([0-9]*\).*/\1/; h'
        )
-        ln -sT "$profile"-${systemNumber}-link ./result
-        pathToConfig=./result
+        pathToConfig="$profile"-${systemNumber}-link
+        if [ -z "$targetHost" ]; then
+            ln -sT "$pathToConfig" ./result
+        fi
    else
        showSyntax
    fi
@ -234,7 +367,7 @@ fi
 # If we're not just building, then make the new configuration the boot
 # default and/or activate it now.
 if [ "$action" = switch -o "$action" = boot -o "$action" = test -o "$action" = dry-activate ]; then
-    if ! $pathToConfig/bin/switch-to-configuration "$action"; then
+    if ! targetHostCmd $pathToConfig/bin/switch-to-configuration "$action"; then
        echo "warning: error(s) occurred while switching to the new configuration" >&2
        exit 1
    fi
--- a/nixos/modules/misc/locate.nix
+++ b/nixos/modules/misc/locate.nix
@ -1,76 +1,74 @@
-{ config, lib, pkgs, ... }:
+{ config, options, lib, pkgs, ... }:

 with lib;

 let
  cfg = config.services.locate;
 in {
-
-  ###### interface
-
-  options = {
-
-    services.locate = {
-
-      enable = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          If enabled, NixOS will periodically update the database of
-          files used by the <command>locate</command> command.
-        '';
-      };
-
-      period = mkOption {
-        type = types.str;
-        default = "15 02 * * *";
-        description = ''
-          This option defines (in the format used by cron) when the
-          locate database is updated.
-          The default is to update at 02:15 at night every day.
-        '';
-      };
-
-      extraFlags = mkOption {
-        type = types.listOf types.str;
-        default = [ ];
-        description = ''
-          Extra flags to pass to <command>updatedb</command>.
-        '';
-      };
-
-      output = mkOption {
-        type = types.path;
-        default = "/var/cache/locatedb";
-        description = ''
-          The database file to build.
-        '';
-      };
-
-      localuser = mkOption {
-        type = types.str;
-        default = "nobody";
-        description = ''
-          The user to search non-network directories as, using
-          <command>su</command>.
-        '';
-      };
-
-      includeStore = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          Whether to include <filename>/nix/store</filename> in the locate database.
-        '';
-      };
-
+  options.services.locate = {
+    enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        If enabled, NixOS will periodically update the database of
+        files used by the <command>locate</command> command.
+      '';
    };

+    interval = mkOption {
+      type = types.str;
+      default = "02:15";
+      example = "hourly";
+      description = ''
+        Update the locate database at this interval. Updates by
+        default at 2:15 AM every day.
+
+        The format is described in
+        <citerefentry><refentrytitle>systemd.time</refentrytitle>
+        <manvolnum>7</manvolnum></citerefentry>.
+      '';
+    };
+
+    # This is no longer supported, but we keep it to give a better warning below
+    period = mkOption { visible = false; };
+
+    extraFlags = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      description = ''
+        Extra flags to pass to <command>updatedb</command>.
+      '';
+    };
+
+    output = mkOption {
+      type = types.path;
+      default = "/var/cache/locatedb";
+      description = ''
+        The database file to build.
+      '';
+    };
+
+    localuser = mkOption {
+      type = types.str;
+      default = "nobody";
+      description = ''
+        The user to search non-network directories as, using
+        <command>su</command>.
+      '';
+    };
+
+    includeStore = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Whether to include <filename>/nix/store</filename> in the locate database.
+      '';
+    };
  };

-  ###### implementation
-
  config = {
+    warnings = let opt = options.services.locate.period; in optional opt.isDefined "The `period` definition in ${showFiles opt.files} has been removed; please replace it with `interval`, using the new systemd.time interval specifier.";
+
    systemd.services.update-locatedb =
      { description = "Update Locate Database";
        path  = [ pkgs.su ];
@ -84,11 +82,18 @@ in {
          '';
        serviceConfig.Nice = 19;
        serviceConfig.IOSchedulingClass = "idle";
+        serviceConfig.PrivateTmp = "yes";
+        serviceConfig.PrivateNetwork = "yes";
+        serviceConfig.NoNewPrivileges = "yes";
+        serviceConfig.ReadOnlyDirectories = "/";
+        serviceConfig.ReadWriteDirectories = cfg.output;
      };

-    services.cron.systemCronJobs = optional config.services.locate.enable
-      "${config.services.locate.period} root ${config.systemd.package}/bin/systemctl start update-locatedb.service";
-
+    systemd.timers.update-locatedb = mkIf cfg.enable
+      { description = "Update timer for locate database";
+        partOf      = [ "update-locatedb.service" ];
+        wantedBy    = [ "timers.target" ];
+        timerConfig.OnCalendar = cfg.interval;
+      };
  };
-
 }
--- a/nixos/modules/services/mail/dovecot.nix
+++ b/nixos/modules/services/mail/dovecot.nix
@ -9,16 +9,10 @@ let
  baseDir = "/run/dovecot2";
  stateDir = "/var/lib/dovecot";

-  protocols = concatStrings [
-    (optionalString cfg.enableImap "imap")
-    (optionalString cfg.enablePop3 "pop3")
-    (optionalString cfg.enableLmtp "lmtp")
-  ];
-
  dovecotConf = concatStrings [
    ''
      base_dir = ${baseDir}
-      protocols = ${protocols}
+      protocols = ${concatStringsSep " " cfg.protocols}
    ''

    (if isNull cfg.sslServerCert then ''
@ -33,6 +27,8 @@ let

    ''
      default_internal_user = ${cfg.user}
+      ${optionalString (cfg.mailUser != null) "mail_uid = ${cfg.mailUser}"}
+      ${optionalString (cfg.mailGroup != null) "mail_gid = ${cfg.mailGroup}"}

      mail_location = ${cfg.mailLocation}

@ -57,11 +53,17 @@ let
      }
    '')

+    (optionalString (cfg.sieveScripts != {}) ''
+      plugin {
+        ${concatStringsSep "\n" (mapAttrsToList (to: from: "sieve_${to} = ${stateDir}/sieve/${to}") cfg.sieveScripts)}
+      }
+    '')
+
    cfg.extraConfig
  ];

  modulesDir = pkgs.symlinkJoin "dovecot-modules"
-    (map (module: "${module}/lib/dovecot") cfg.modules);
+    (map (pkg: "${pkg}/lib/dovecot") ([ dovecotPkg ] ++ map (module: module.override { dovecot = dovecotPkg; }) cfg.modules));

 in
 {
@ -87,6 +89,12 @@ in
      description = "Start the LMTP listener (when Dovecot is enabled).";
    };

+    protocols = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      description = "Additional listeners to start when Dovecot is enabled.";
+    };
+
    package = mkOption {
      type = types.package;
      default = pkgs.dovecot22;
@ -129,13 +137,25 @@ in
      '';
    };

+    mailUser = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      description = "Default user to store mail for virtual users.";
+    };
+
+    mailGroup = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      description = "Default group to store mail for virtual users.";
+    };
+
    modules = mkOption {
      type = types.listOf types.package;
      default = [];
      example = literalExample "[ pkgs.dovecot_pigeonhole ]";
      description = ''
        Symlinks the contents of lib/dovecot of every given package into
-        /var/lib/dovecot/modules. This will make the given modules available
+        /etc/dovecot/modules. This will make the given modules available
        if a dovecot package with the module_dir patch applied (like
        pkgs.dovecot22, the default) is being used.
      '';
@ -162,7 +182,13 @@ in
    enablePAM = mkOption {
      type = types.bool;
      default = true;
-      description = "Wether to create a own Dovecot PAM service and configure PAM user logins.";
+      description = "Whether to create a own Dovecot PAM service and configure PAM user logins.";
+    };
+
+    sieveScripts = mkOption {
+      type = types.attrsOf types.path;
+      default = {};
+      description = "Sieve scripts to be executed. Key is a sequence, e.g. 'before2', 'after' etc.";
    };

    showPAMFailure = mkOption {
@ -177,23 +203,31 @@ in

    security.pam.services.dovecot2 = mkIf cfg.enablePAM {};

+    services.dovecot2.protocols =
+     optional cfg.enableImap "imap"
+     ++ optional cfg.enablePop3 "pop3"
+     ++ optional cfg.enableLmtp "lmtp";
+
    users.extraUsers = [
-      { name = cfg.user;
-        uid = config.ids.uids.dovecot2;
-        description = "Dovecot user";
-        group = cfg.group;
-      }
      { name = "dovenull";
        uid = config.ids.uids.dovenull2;
        description = "Dovecot user for untrusted logins";
        group = cfg.group;
      }
-    ];
+    ] ++ optional (cfg.user == "dovecot2")
+         { name = "dovecot2";
+           uid = config.ids.uids.dovecot2;
+           description = "Dovecot user";
+           group = cfg.group;
+         };

-    users.extraGroups = singleton {
-      name = cfg.group;
-      gid = config.ids.gids.dovecot2;
-    };
+    users.extraGroups = optional (cfg.group == "dovecot2")
+      { name = "dovecot2";
+        gid = config.ids.gids.dovecot2;
+      };
+
+    environment.etc."dovecot/modules".source = modulesDir;
+    environment.etc."dovecot/dovecot.conf".source = cfg.configFile;

    systemd.services.dovecot2 = {
      description = "Dovecot IMAP/POP3 server";
@ -201,26 +235,38 @@ in
      after = [ "keys.target" "network.target" ];
      wants = [ "keys.target" ];
      wantedBy = [ "multi-user.target" ];
-
-      preStart = ''
-        mkdir -p "${baseDir}/login"
-        chown -R ${cfg.user}:${cfg.group} "${baseDir}"
-        rm -f "${stateDir}/modules"
-        ln -s "${modulesDir}" "${stateDir}/modules"
-      '';
+      restartTriggers = [ cfg.configFile ];

      serviceConfig = {
-        ExecStart = "${dovecotPkg}/sbin/dovecot -F -c ${cfg.configFile}";
+        ExecStart = "${dovecotPkg}/sbin/dovecot -F";
+        ExecReload = "${dovecotPkg}/sbin/doveadm reload";
        Restart = "on-failure";
        RestartSec = "1s";
        StartLimitInterval = "1min";
+        RuntimeDirectory = [ "dovecot2" ];
      };
+
+      preStart = ''
+        rm -rf ${stateDir}/sieve
+      '' + optionalString (cfg.sieveScripts != {}) ''
+        mkdir -p ${stateDir}/sieve
+        ${concatStringsSep "\n" (mapAttrsToList (to: from: ''
+          if [ -d '${from}' ]; then
+            mkdir '${stateDir}/sieve/${to}'
+            cp ${from}/*.sieve '${stateDir}/sieve/${to}'
+          else
+            cp '${from}' '${stateDir}/sieve/${to}'
+          fi
+           ${pkgs.dovecot_pigeonhole}/bin/sievec '${stateDir}/sieve/${to}'
+        '') cfg.sieveScripts)}
+        chown -R '${cfg.mailUser}:${cfg.mailGroup}' '${stateDir}/sieve'
+      '';
    };

    environment.systemPackages = [ dovecotPkg ];

    assertions = [
-      { assertion = cfg.enablePop3 || cfg.enableImap;
+      { assertion = intersectLists cfg.protocols [ "pop3" "imap" ] != [];
        message = "dovecot needs at least one of the IMAP or POP3 listeners enabled";
      }
      { assertion = isNull cfg.sslServerCert == isNull cfg.sslServerKey
--- a/nixos/modules/services/mail/postfix.nix
+++ b/nixos/modules/services/mail/postfix.nix
@ -20,6 +20,23 @@ let
      mail_owner = ${user}
      default_privs = nobody

+      # NixOS specific locations
+      data_directory = /var/lib/postfix/data
+      queue_directory = /var/lib/postfix/queue
+
+      # Default location of everything in package
+      meta_directory = ${pkgs.postfix}/etc/postfix
+      command_directory = ${pkgs.postfix}/bin
+      sample_directory = /etc/postfix
+      newaliases_path = ${pkgs.postfix}/bin/newaliases
+      mailq_path = ${pkgs.postfix}/bin/mailq
+      readme_directory = no
+      sendmail_path = ${pkgs.postfix}/bin/sendmail
+      daemon_directory = ${pkgs.postfix}/libexec/postfix
+      manpage_directory = ${pkgs.postfix}/share/man
+      html_directory = ${pkgs.postfix}/share/postfix/doc/html
+      shlib_directory = no
+
    ''
    + optionalString config.networking.enableIPv6 ''
      inet_protocols = all
@ -435,31 +452,35 @@ in
              mkdir -p /var/lib
              mv /var/postfix /var/lib/postfix
            fi
-            mkdir -p /var/lib/postfix/data /var/lib/postfix/queue/{pid,public,maildrop}

-            chown -R ${user}:${group} /var/lib/postfix
-            chown root /var/lib/postfix/queue
-            chown root /var/lib/postfix/queue/pid
-            chgrp -R ${setgidGroup} /var/lib/postfix/queue/{public,maildrop}
-            chmod 770 /var/lib/postfix/queue/{public,maildrop}
+            # All permissions set according ${pkgs.postfix}/etc/postfix/postfix-files script
+            mkdir -p /var/lib/postfix /var/lib/postfix/queue/{pid,public,maildrop}
+            chmod 0755 /var/lib/postfix
+            chown root:root /var/lib/postfix

            rm -rf /var/lib/postfix/conf
            mkdir -p /var/lib/postfix/conf
+            chmod 0755 /var/lib/postfix/conf
+            ln -sf ${pkgs.postfix}/etc/postfix/postfix-files
            ln -sf ${mainCfFile} /var/lib/postfix/conf/main.cf
            ln -sf ${masterCfFile} /var/lib/postfix/conf/master.cf
+
            ${concatStringsSep "\n" (mapAttrsToList (to: from: ''
              ln -sf ${from} /var/lib/postfix/conf/${to}
-              postalias /var/lib/postfix/conf/${to}
+              ${pkgs.postfix}/bin/postalias /var/lib/postfix/conf/${to}
            '') cfg.aliasFiles)}
            ${concatStringsSep "\n" (mapAttrsToList (to: from: ''
              ln -sf ${from} /var/lib/postfix/conf/${to}
-              postmap /var/lib/postfix/conf/${to}
+              ${pkgs.postfix}/bin/postmap /var/lib/postfix/conf/${to}
            '') cfg.mapFiles)}

            mkdir -p /var/spool/mail
            chown root:root /var/spool/mail
            chmod a+rwxt /var/spool/mail
            ln -sf /var/spool/mail /var/
+
+            #Finally delegate to postfix checking remain directories in /var/lib/postfix and set permissions on them
+            ${pkgs.postfix}/bin/postfix set-permissions config_directory=/var/lib/postfix/conf
          '';
        };
    }
--- a/nixos/modules/services/misc/ihaskell.nix
+++ b/nixos/modules/services/misc/ihaskell.nix
@ -6,7 +6,6 @@ let

  cfg = config.services.ihaskell;
  ihaskell = pkgs.ihaskell.override {
-    inherit (cfg.haskellPackages) ihaskell ghcWithPackages;
    packages = self: cfg.extraPackages self;
  };

@ -22,7 +21,6 @@ in
      };

      haskellPackages = mkOption {
-        type = types.attrsOf types.package;
        default = pkgs.haskellPackages;
        defaultText = "pkgs.haskellPackages";
        example = literalExample "pkgs.haskell.packages.ghc784";
--- a/nixos/modules/services/monitoring/bosun.nix
+++ b/nixos/modules/services/monitoring/bosun.nix
@ -129,17 +129,19 @@ in {
      description = "bosun metrics collector (part of Bosun)";
      wantedBy = [ "multi-user.target" ];

-      preStart =
-        ''
-        mkdir -p `dirname ${cfg.stateFile}`;
-        touch ${cfg.stateFile}
-        touch ${cfg.stateFile}.tmp
+      preStart = ''
+        mkdir -p "$(dirname "${cfg.stateFile}")";
+        touch "${cfg.stateFile}"
+        touch "${cfg.stateFile}.tmp"
+
+        mkdir -p "${cfg.ledisDir}";

        if [ "$(id -u)" = 0 ]; then
-          chown ${cfg.user}:${cfg.group} ${cfg.stateFile}
-          chown ${cfg.user}:${cfg.group} ${cfg.stateFile}.tmp
+          chown ${cfg.user}:${cfg.group} "${cfg.stateFile}"
+          chown ${cfg.user}:${cfg.group} "${cfg.stateFile}.tmp"
+          chown ${cfg.user}:${cfg.group} "${cfg.ledisDir}"
        fi
-        '';
+      '';

      serviceConfig = {
        PermissionsStartOnly = true;
--- a/nixos/modules/services/networking/gale.nix
+++ b/nixos/modules/services/networking/gale.nix
@ -76,7 +76,7 @@ in

       system.activationScripts.gale = mkIf cfg.enable (
         stringAfter [ "users" "groups" ] ''
-           chmod -R 755 ${home}
+           chmod 755 ${home}
           mkdir -m 0777 -p ${home}/auth/cache
           mkdir -m 1777 -p ${home}/auth/local # GALE_DOMAIN.gpub
           mkdir -m 0700 -p ${home}/auth/private # ROOT.gpub
@ -86,7 +86,8 @@ in
           mkdir -m 0700 -p ${home}/.gale/auth/private # GALE_DOMAIN.gpri

           ln -sf ${pkgs.gale}/etc/gale/auth/trusted/ROOT "${home}/auth/trusted/ROOT"
-           chown -R ${cfg.user}:${cfg.group} ${home}
+           chown ${cfg.user}:${cfg.group} ${home} ${home}/auth ${home}/auth/*
+           chown ${cfg.user}:${cfg.group} ${home}/.gale ${home}/.gale/auth ${home}/.gale/auth/private
         ''
       );

@ -149,10 +150,9 @@ in
         after = [ "network.target" ];

         preStart = ''
-           install -m 0640 ${keyPath}/${cfg.domain}.gpri "${home}/.gale/auth/private/"
-           install -m 0644 ${gpubFile} "${home}/.gale/auth/private/${cfg.domain}.gpub"
-           install -m 0644 ${gpubFile} "${home}/auth/local/${cfg.domain}.gpub"
-           chown -R ${cfg.user}:${cfg.group} ${home}
+           install -m 0640 -o ${cfg.user} -g ${cfg.group} ${keyPath}/${cfg.domain}.gpri "${home}/.gale/auth/private/"
+           install -m 0644 -o ${cfg.user} -g ${cfg.group} ${gpubFile} "${home}/.gale/auth/private/${cfg.domain}.gpub"
+           install -m 0644 -o ${cfg.user} -g ${cfg.group} ${gpubFile} "${home}/auth/local/${cfg.domain}.gpub"
         '';

         serviceConfig = {
--- a/nixos/modules/services/networking/softether.nix
+++ b/nixos/modules/services/networking/softether.nix
@ -61,11 +61,14 @@ in
            dataDir = cfg.dataDir;
          }))
        ];
-      systemd.services.softether = {
-        description = "SoftEther VPN services initial job";
-        after = [ "network-interfaces.target" ];
-        wantedBy = [ "multi-user.target" ];
-        preStart = ''
+      systemd.services."softether-init" = {
+        description = "SoftEther VPN services initial task";
+        wantedBy = [ "network-interfaces.target" ];
+        serviceConfig = {
+          Type = "oneshot";
+          RemainAfterExit = false;
+        };
+        script = ''
            for d in vpnserver vpnbridge vpnclient vpncmd; do
                if ! test -e ${cfg.dataDir}/$d; then
                    ${pkgs.coreutils}/bin/mkdir -m0700 -p ${cfg.dataDir}/$d
@ -81,12 +84,12 @@ in
    (mkIf (cfg.vpnserver.enable) {
      systemd.services.vpnserver = {
        description = "SoftEther VPN Server";
-        after = [ "network-interfaces.target" ];
-        wantedBy = [ "multi-user.target" ];
+        after = [ "softether-init.service" ];
+        wantedBy = [ "network-interfaces.target" ];
        serviceConfig = {
+          Type = "forking";
          ExecStart = "${pkg}/bin/vpnserver start";
          ExecStop = "${pkg}/bin/vpnserver stop";
-          Type = "forking";
        };
        preStart = ''
            rm -rf ${cfg.dataDir}/vpnserver/vpnserver
@ -101,12 +104,12 @@ in
    (mkIf (cfg.vpnbridge.enable) {
      systemd.services.vpnbridge = {
        description = "SoftEther VPN Bridge";
-        after = [ "network-interfaces.target" ];
-        wantedBy = [ "multi-user.target" ];
+        after = [ "softether-init.service" ];
+        wantedBy = [ "network-interfaces.target" ];
        serviceConfig = {
+          Type = "forking";
          ExecStart = "${pkg}/bin/vpnbridge start";
          ExecStop = "${pkg}/bin/vpnbridge stop";
-          Type = "forking";
        };
        preStart = ''
            rm -rf ${cfg.dataDir}/vpnbridge/vpnbridge
@ -121,12 +124,12 @@ in
    (mkIf (cfg.vpnclient.enable) {
      systemd.services.vpnclient = {
        description = "SoftEther VPN Client";
-        after = [ "network-interfaces.target" ];
-        wantedBy = [ "multi-user.target" ];
+        after = [ "softether-init.service" ];
+        wantedBy = [ "network-interfaces.target" ];
        serviceConfig = {
+          Type = "forking";
          ExecStart = "${pkg}/bin/vpnclient start";
          ExecStop = "${pkg}/bin/vpnclient stop";
-          Type = "forking";
        };
        preStart = ''
            rm -rf ${cfg.dataDir}/vpnclient/vpnclient
--- a/nixos/modules/services/search/elasticsearch.nix
+++ b/nixos/modules/services/search/elasticsearch.nix
@ -128,6 +128,7 @@ in {
      description = "Elasticsearch Daemon";
      wantedBy = [ "multi-user.target" ];
      after = [ "network-interfaces.target" ];
+      path = [ pkgs.inetutils ];
      environment = { ES_HOME = cfg.dataDir; };
      serviceConfig = {
        ExecStart = "${cfg.package}/bin/elasticsearch -Des.path.conf=${configDir} ${toString cfg.extraCmdLineOptions}";
@ -139,8 +140,7 @@ in {
        if [ "$(id -u)" = 0 ]; then chown -R elasticsearch ${cfg.dataDir}; fi

        # Install plugins
-        rm ${cfg.dataDir}/plugins || true
-        ln -s ${esPlugins}/plugins ${cfg.dataDir}/plugins
+        ln -sfT ${esPlugins}/plugins ${cfg.dataDir}/plugins
      '';
      postStart = mkBefore ''
        until ${pkgs.curl}/bin/curl -s -o /dev/null ${cfg.listenAddress}:${toString cfg.port}; do
--- a/nixos/modules/services/system/uptimed.nix
+++ b/nixos/modules/services/system/uptimed.nix
@ -1,66 +1,55 @@
-{pkgs, config, lib, ...}:
+{ config, lib, pkgs, ... }:
+
+with lib;

 let
-
-  inherit (lib) mkOption mkIf singleton;
-
-  inherit (pkgs) uptimed;
-
+  cfg = config.services.uptimed;
  stateDir = "/var/spool/uptimed";
-
-  uptimedUser = "uptimed";
-
 in
-
 {
-
-  ###### interface
-
  options = {
-
    services.uptimed = {
-
      enable = mkOption {
        default = false;
        description = ''
-          Uptimed allows you to track your highest uptimes.
+          Enable <literal>uptimed</literal>, allowing you to track
+          your highest uptimes.
        '';
      };
-
    };
-
  };

-
-  ###### implementation
-
-  config = mkIf config.services.uptimed.enable {
-
-    environment.systemPackages = [ uptimed ];
-
-    users.extraUsers = singleton
-      { name = uptimedUser;
-        uid = config.ids.uids.uptimed;
-        description = "Uptimed daemon user";
-        home = stateDir;
-      };
+  config = mkIf cfg.enable {
+    users.extraUsers.uptimed = {
+      description = "Uptimed daemon user";
+      home        = stateDir;
+      createHome  = true;
+      uid         = config.ids.uids.uptimed;
+    };

    systemd.services.uptimed = {
-      description = "Uptimed daemon";
-      wantedBy = [ "multi-user.target" ];
+      unitConfig.Documentation = "man:uptimed(8) man:uprecords(1)";
+      description = "uptimed service";
+      wantedBy    = [ "multi-user.target" ];
+
+      serviceConfig = {
+        Restart                 = "on-failure";
+        User                    = "uptimed";
+        Nice                    = 19;
+        IOSchedulingClass       = "idle";
+        PrivateTmp              = "yes";
+        PrivateNetwork          = "yes";
+        NoNewPrivileges         = "yes";
+        ReadWriteDirectories    = stateDir;
+        InaccessibleDirectories = "/home";
+        ExecStart               = "${pkgs.uptimed}/sbin/uptimed -f -p ${stateDir}/pid";
+      };

      preStart = ''
-        mkdir -m 0755 -p ${stateDir}
-        chown ${uptimedUser} ${stateDir}
-
        if ! test -f ${stateDir}/bootid ; then
-          ${uptimed}/sbin/uptimed -b
+          ${pkgs.uptimed}/sbin/uptimed -b
        fi
      '';
-
-      script = "${uptimed}/sbin/uptimed";
    };
-
  };
-
 }
--- a/nixos/modules/services/x11/window-managers/i3.nix
+++ b/nixos/modules/services/x11/window-managers/i3.nix
@ -34,6 +34,6 @@ in
        '';
      }];
    };
-    environment.systemPackages = [ pkgs.i3 ];
+    environment.systemPackages = with pkgs; [ i3 i3status dmenu ];
  };
 }
--- a/nixos/modules/system/activation/activation-script.nix
+++ b/nixos/modules/system/activation/activation-script.nix
@ -94,6 +94,18 @@ in

    };

+    environment.usrbinenv = mkOption {
+      default = "${pkgs.coreutils}/bin/env";
+      example = literalExample ''
+        "''${pkgs.busybox}/bin/env"
+      '';
+      type = types.nullOr types.path;
+      visible = false;
+      description = ''
+        The env(1) executable that is linked system-wide to
+        <literal>/usr/bin/env</literal>.
+      '';
+    };
  };


@ -128,11 +140,15 @@ in
        mkdir -m 0555 -p /var/empty
      '';

-    system.activationScripts.usrbinenv =
-      ''
+    system.activationScripts.usrbinenv = if config.environment.usrbinenv != null
+      then ''
        mkdir -m 0755 -p /usr/bin
-        ln -sfn ${pkgs.coreutils}/bin/env /usr/bin/.env.tmp
+        ln -sfn ${config.environment.usrbinenv} /usr/bin/.env.tmp
        mv /usr/bin/.env.tmp /usr/bin/env # atomically replace /usr/bin/env
+      ''
+      else ''
+        rm -f /usr/bin/env
+        rmdir --ignore-fail-on-non-empty /usr/bin /usr
      '';

    system.activationScripts.tmpfs =
--- a/nixos/modules/system/boot/networkd.nix
+++ b/nixos/modules/system/boot/networkd.nix
@ -93,11 +93,13 @@ let

  checkNetwork = checkUnitConfig "Network" [
    (assertOnlyFields [
-      "Description" "DHCP" "DHCPServer" "IPv4LL" "IPv4LLRoute"
+      "Description" "DHCP" "DHCPServer" "IPForward" "IPMasquerade" "IPv4LL" "IPv4LLRoute"
      "LLMNR" "Domains" "Bridge" "Bond"
    ])
    (assertValueOneOf "DHCP" ["both" "none" "v4" "v6"])
    (assertValueOneOf "DHCPServer" boolValues)
+    (assertValueOneOf "IPForward" ["yes" "no" "ipv4" "ipv6"])
+    (assertValueOneOf "IPMasquerade" boolValues)
    (assertValueOneOf "IPv4LL" boolValues)
    (assertValueOneOf "IPv4LLRoute" boolValues)
    (assertValueOneOf "LLMNR" boolValues)
@ -129,6 +131,16 @@ let
    (assertValueOneOf "RequestBroadcast" boolValues)
  ];

+  checkDhcpServer = checkUnitConfig "DHCPServer" [
+    (assertOnlyFields [
+      "PoolOffset" "PoolSize" "DefaultLeaseTimeSec" "MaxLeaseTimeSec"
+      "EmitDNS" "DNS" "EmitNTP" "NTP" "EmitTimezone" "Timezone"
+    ])
+    (assertValueOneOf "EmitDNS" boolValues)
+    (assertValueOneOf "EmitNTP" boolValues)
+    (assertValueOneOf "EmitTimezone" boolValues)
+  ];
+
  commonNetworkOptions = {

    enable = mkOption {
@ -341,6 +353,18 @@ let
      '';
    };

+    dhcpServerConfig = mkOption {
+      default = {};
+      example = { PoolOffset = 50; EmitDNS = false; };
+      type = types.addCheck (types.attrsOf unitOption) checkDhcpServer;
+      description = ''
+        Each attribute in this set specifies an option in the
+        <literal>[DHCPServer]</literal> section of the unit.  See
+        <citerefentry><refentrytitle>systemd.network</refentrytitle>
+        <manvolnum>5</manvolnum></citerefentry> for details.
+      '';
+    };
+
    name = mkOption {
      type = types.nullOr types.str;
      default = null;
@ -565,6 +589,11 @@ let
            [DHCP]
            ${attrsToSection def.dhcpConfig}

+          ''}
+          ${optionalString (def.dhcpServerConfig != { }) ''
+            [DHCPServer]
+            ${attrsToSection def.dhcpServerConfig}
+
          ''}
          ${flip concatMapStrings def.addresses (x: ''
            [Address]
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@ -61,6 +61,8 @@ let
      "systemd-user-sessions.service"
      "dbus-org.freedesktop.login1.service"
      "dbus-org.freedesktop.machine1.service"
+      "org.freedesktop.login1.busname"
+      "org.freedesktop.machine1.busname"
      "user@.service"

      # Journal.
@ -147,10 +149,14 @@ let
      "systemd-tmpfiles-setup-dev.service"

      # Misc.
+      "org.freedesktop.systemd1.busname"
      "systemd-sysctl.service"
      "dbus-org.freedesktop.timedate1.service"
      "dbus-org.freedesktop.locale1.service"
      "dbus-org.freedesktop.hostname1.service"
+      "org.freedesktop.timedate1.busname"
+      "org.freedesktop.locale1.busname"
+      "org.freedesktop.hostname1.busname"
      "systemd-timedated.service"
      "systemd-localed.service"
      "systemd-hostnamed.service"
--- a/nixos/modules/virtualisation/nixos-container.pl
+++ b/nixos/modules/virtualisation/nixos-container.pl
@ -97,10 +97,10 @@ if ($action eq "create") {
    if ($ensureUniqueName) {
        my $base = $containerName;
        for (my $nr = 0; ; $nr++) {
-            $containerName = "$base-$nr";
            $confFile = "/etc/containers/$containerName.conf";
            $root = "/var/lib/containers/$containerName";
            last unless -e $confFile || -e $root;
+            $containerName = "$base-$nr";
        }
    }

--- a/nixos/modules/virtualisation/nova.nix
+++ b/nixos/modules/virtualisation/nova.nix
@ -146,7 +146,7 @@ in

        path =
          [ pkgs.sudo pkgs.vlan pkgs.nettools pkgs.iptables pkgs.qemu_kvm
-            pkgs.e2fsprogs pkgs.utillinux pkgs.multipath_tools pkgs.iproute
+            pkgs.e2fsprogs pkgs.utillinux pkgs.multipath-tools pkgs.iproute
            pkgs.bridge-utils
          ];

--- a/nixos/modules/virtualisation/rkt.nix
+++ b/nixos/modules/virtualisation/rkt.nix
@ -58,5 +58,7 @@ in
        ExecStart = "${pkgs.rkt}/bin/rkt gc ${cfg.gc.options}";
      };
    };
+
+    users.extraGroups.rkt = {};
  };
 }
--- a/nixos/release.nix
+++ b/nixos/release.nix
@ -230,6 +230,7 @@ in rec {
  #tests.gitlab = callTest tests/gitlab.nix {};
  tests.gnome3 = callTest tests/gnome3.nix {};
  tests.gnome3-gdm = callTest tests/gnome3-gdm.nix {};
+  tests.grsecurity = callTest tests/grsecurity.nix {};
  tests.i3wm = callTest tests/i3wm.nix {};
  tests.installer.grub1 = forAllSystems (system: hydraJob (import tests/installer.nix { inherit system; }).grub1.test);
  tests.installer.lvm = forAllSystems (system: hydraJob (import tests/installer.nix { inherit system; }).lvm.test);
@ -287,6 +288,7 @@ in rec {
  tests.openssh = callTest tests/openssh.nix {};
  tests.panamax = hydraJob (import tests/panamax.nix { system = "x86_64-linux"; });
  tests.peerflix = callTest tests/peerflix.nix {};
+  tests.postgresql = callTest tests/postgresql.nix {};
  tests.printing = callTest tests/printing.nix {};
  tests.proxy = callTest tests/proxy.nix {};
  tests.pumpio = callTest tests/pump.io.nix {};
--- a/nixos/tests/grsecurity.nix
+++ b/nixos/tests/grsecurity.nix
@ -0,0 +1,19 @@
+# Basic test to make sure grsecurity works
+
+import ./make-test.nix ({ pkgs, ...} : {
+  name = "grsecurity";
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ copumpkin ];
+  };
+
+  machine = { config, pkgs, ... }:
+    { boot.kernelPackages = pkgs.linuxPackages_grsec_testing_server; };
+
+  testScript =
+    ''
+      $machine->succeed("uname -a") =~ /grsec/;
+      # FIXME: this seems to hang the whole test. Unclear why, but let's fix it
+      # $machine->succeed("${pkgs.paxtest}/bin/paxtest blackhat");
+    '';
+})
+
--- a/nixos/tests/postgresql.nix
+++ b/nixos/tests/postgresql.nix
@ -0,0 +1,26 @@
+import ./make-test.nix ({ pkgs, ...} : {
+  name = "postgresql";
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ zagy ];
+  };
+
+  nodes = {
+    master =
+      { pkgs, config, ... }:
+
+      {
+        services.postgresql.enable = true;
+        services.postgresql.initialScript =  pkgs.writeText "postgresql-init.sql"
+          ''
+          CREATE ROLE postgres WITH superuser login createdb;
+          '';
+      };
+  };
+
+  testScript = ''
+    startAll;
+    $master->waitForUnit("postgresql");
+    $master->sleep(10); # Hopefully this is long enough!!
+    $master->succeed("echo 'select 1' | sudo -u postgres psql");
+  '';
+})
--- a/pkgs/applications/audio/fldigi/default.nix
+++ b/pkgs/applications/audio/fldigi/default.nix
@ -2,13 +2,13 @@
  libsamplerate, libpulseaudio, libXinerama, gettext, pkgconfig, alsaLib }:

 stdenv.mkDerivation rec {
-  version = "3.22.02";
+  version = "3.23.07";
  pname = "fldigi";
  name = "${pname}-${version}";

  src = fetchurl {
-    url = "http://www.w1hkj.com/downloads/${pname}/${name}.tar.gz";
-    sha256 = "1gry3r133j2x99h0ji56v6yjxzvbi0hb18p1lbkr9djzjvf591j3";
+    url = "mirror://sourceforge/${pname}/${name}.tar.gz";
+    sha256 = "0v78sk9bllxw640wxd4q2qy0h8z2j1d077nxhmpkjpf6mn6vwcda";
  };

  buildInputs = [ libXinerama gettext hamlib fltk13 libjpeg libpng portaudio
@ -16,9 +16,9 @@ stdenv.mkDerivation rec {

  meta = {
    description = "Digital modem program";
-    homepage = http://www.w1hkj.com/Fldigi.html;
+    homepage = http://sourceforge.net/projects/fldigi/;
    license = stdenv.lib.licenses.gpl3Plus;
-    maintainers = with stdenv.lib.maintainers; [ relrod ];
+    maintainers = with stdenv.lib.maintainers; [ relrod ftrvxmtrx ];
    platforms = stdenv.lib.platforms.linux;
  };
 }
--- a/pkgs/applications/audio/mixxx/default.nix
+++ b/pkgs/applications/audio/mixxx/default.nix
@ -1,20 +1,22 @@
-{ stdenv, fetchurl, scons, pkgconfig, qt4, portaudio, portmidi, libusb1
-, libmad, protobuf, libvorbis, taglib, libid3tag, flac, libsndfile, libshout
-, fftw, vampSDK
+{ stdenv, fetchurl, chromaprint, fftw, flac, libid3tag, libmad
+, libopus, libshout, libsndfile, libusb1, libvorbis, pkgconfig
+, portaudio, portmidi, protobuf, qt4, rubberband, scons, sqlite
+, taglib, vampSDK
 }:

 stdenv.mkDerivation rec {
  name = "mixxx-${version}";
-  version = "1.11.0";
+  version = "2.0.0";

  src = fetchurl {
    url = "http://downloads.mixxx.org/${name}/${name}-src.tar.gz";
-    sha256 = "0c833gf4169xvpfn7car9vzvwfwl9d3xwmbfsy36cv8ydifip5h0";
+    sha256 = "0vb71w1yq0xwwsclrn2jj9bk8w4n14rfv5c0aw46c11mp8xz7f71";
  };

  buildInputs = [
-    scons pkgconfig qt4 portaudio portmidi libusb1 libmad protobuf libvorbis
-    taglib libid3tag flac libsndfile libshout fftw vampSDK
+    chromaprint fftw flac libid3tag libmad libopus libshout libsndfile
+    libusb1 libvorbis pkgconfig portaudio portmidi protobuf qt4
+    rubberband scons sqlite taglib vampSDK
  ];

  sconsFlags = [
@ -22,10 +24,6 @@ stdenv.mkDerivation rec {
    "qtdir=${qt4}"
  ];

-  postPatch = ''
-    sed -i -e 's/"which /"type -P /' build/depends.py
-  '';
-
  buildPhase = ''
    runHook preBuild
    mkdir -p "$out"
@ -41,11 +39,11 @@ stdenv.mkDerivation rec {
    runHook postInstall
  '';

-  meta = {
-    homepage = "http://mixxx.org/";
+  meta = with stdenv.lib; {
+    homepage = http://mixxx.org;
    description = "Digital DJ mixing software";
-    license = stdenv.lib.licenses.gpl2Plus;
-    maintainers = [ stdenv.lib.maintainers.aszlig ];
-    platforms = stdenv.lib.platforms.linux;
+    license = licenses.gpl2Plus;
+    maintainers = [ maintainers.aszlig maintainers.goibhniu ];
+    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/audio/mopidy/default.nix
+++ b/pkgs/applications/audio/mopidy/default.nix
@ -1,27 +1,30 @@
-{ stdenv, fetchurl, pythonPackages, pygobject, gst_python
-, gst_plugins_good, gst_plugins_base, gst_plugins_ugly
+{ stdenv, fetchurl, pythonPackages, pygobject, gst_python, wrapGAppsHook
+, glib_networking, gst_plugins_good, gst_plugins_base, gst_plugins_ugly
 }:

 pythonPackages.buildPythonPackage rec {
  name = "mopidy-${version}";

-  version = "1.1.1";
+  version = "1.1.2";

  src = fetchurl {
    url = "https://github.com/mopidy/mopidy/archive/v${version}.tar.gz";
-    sha256 = "1xfyg8xqgnrb98wx7a4fzr4vlzkffjhkc1s36ka63rwmx86vqhyw";
+    sha256 = "1vn4knpmnp3krmn627iv1r7xa50zl816ac6b24b8ph50cq2sqjfv";
  };

+  buildInputs = [
+    wrapGAppsHook gst_plugins_base gst_plugins_good gst_plugins_ugly glib_networking
+  ];
+
  propagatedBuildInputs = with pythonPackages; [
-    gst_python pygobject pykka tornado requests2 gst_plugins_base gst_plugins_good gst_plugins_ugly
+    gst_python pygobject pykka tornado requests2
  ];

  # There are no tests
  doCheck = false;

-  postInstall = ''
-    wrapProgram $out/bin/mopidy \
-      --prefix GST_PLUGIN_SYSTEM_PATH : "$GST_PLUGIN_SYSTEM_PATH"
+  preFixup = ''
+    gappsWrapperArgs+=(--prefix GST_PLUGIN_SYSTEM_PATH : "$GST_PLUGIN_SYSTEM_PATH")
  '';

  meta = with stdenv.lib; {
@ -31,7 +34,7 @@ pythonPackages.buildPythonPackage rec {
      SoundCloud, Google Play Music, and more
    '';
    license = licenses.asl20;
-    maintainers = [ maintainers.rickynils ];
+    maintainers = with maintainers; [ rickynils fpletz ];
    hydraPlatforms = [];
  };
 }
--- a/pkgs/applications/audio/ncmpcpp/default.nix
+++ b/pkgs/applications/audio/ncmpcpp/default.nix
@ -15,11 +15,11 @@ assert taglibSupport -> (taglib != null);
 with stdenv.lib;
 stdenv.mkDerivation rec {
  name = "ncmpcpp-${version}";
-  version = "0.7";
+  version = "0.7.2";

  src = fetchurl {
    url = "http://ncmpcpp.rybczak.net/stable/${name}.tar.bz2";
-    sha256 = "0xzz0g9whqjcjaaqmsw5ph1zvpi2j5v3i5k73g7916rca3q4z4jh";
+    sha256 = "0fq9nk796cp7gs0gwrabb6wp7f5h7pph10hrkrik1wf4k3mzb4k3";
  };

  configureFlags = [ "BOOST_LIB_SUFFIX=" ]
--- a/pkgs/applications/editors/eclipse/build-eclipse.nix
+++ b/pkgs/applications/editors/eclipse/build-eclipse.nix
@ -0,0 +1,54 @@
+{ stdenv, makeDesktopItem, freetype, fontconfig, libX11, libXrender, zlib, jre, glib, gtk, libXtst, webkitgtk2, makeWrapper, ... }:
+
+{ name, src ? builtins.getAttr stdenv.system sources, sources ? null, description }:
+
+stdenv.mkDerivation rec {
+  inherit name src;
+
+  desktopItem = makeDesktopItem {
+    name = "Eclipse";
+    exec = "eclipse";
+    icon = "eclipse";
+    comment = "Integrated Development Environment";
+    desktopName = "Eclipse IDE";
+    genericName = "Integrated Development Environment";
+    categories = "Application;Development;";
+  };
+
+  buildInputs = [ makeWrapper ];
+
+  buildCommand = ''
+    # Unpack tarball.
+    mkdir -p $out
+    tar xfvz $src -C $out
+
+    # Patch binaries.
+    interpreter=$(echo ${stdenv.glibc}/lib/ld-linux*.so.2)
+    libCairo=$out/eclipse/libcairo-swt.so
+    patchelf --set-interpreter $interpreter $out/eclipse/eclipse
+    [ -f $libCairo ] && patchelf --set-rpath ${freetype}/lib:${fontconfig}/lib:${libX11}/lib:${libXrender}/lib:${zlib}/lib $libCairo
+
+    # Create wrapper script.  Pass -configuration to store
+    # settings in ~/.eclipse/org.eclipse.platform_<version> rather
+    # than ~/.eclipse/org.eclipse.platform_<version>_<number>.
+    productId=$(sed 's/id=//; t; d' $out/eclipse/.eclipseproduct)
+    productVersion=$(sed 's/version=//; t; d' $out/eclipse/.eclipseproduct)
+
+    makeWrapper $out/eclipse/eclipse $out/bin/eclipse \
+      --prefix PATH : ${jre}/bin \
+      --prefix LD_LIBRARY_PATH : ${glib}/lib:${gtk}/lib:${libXtst}/lib${stdenv.lib.optionalString (webkitgtk2 != null) ":${webkitgtk2}/lib"} \
+      --add-flags "-configuration \$HOME/.eclipse/''${productId}_$productVersion/configuration"
+
+    # Create desktop item.
+    mkdir -p $out/share/applications
+    cp ${desktopItem}/share/applications/* $out/share/applications
+    mkdir -p $out/share/pixmaps
+    ln -s $out/eclipse/icon.xpm $out/share/pixmaps/eclipse.xpm
+  ''; # */
+
+  meta = {
+    homepage = http://www.eclipse.org/;
+    inherit description;
+  };
+
+}
--- a/pkgs/applications/editors/eclipse/default.nix
+++ b/pkgs/applications/editors/eclipse/default.nix
@ -4,67 +4,13 @@
 , webkitgtk2 ? null  # for internal web browser
 , buildEnv, writeText, runCommand
 , callPackage
-}:
+} @ args:

 assert stdenv ? glibc;

-let
+rec {

-  buildEclipse =
-    { name, src ? builtins.getAttr stdenv.system sources, sources ? null, description }:
-
-    stdenv.mkDerivation rec {
-      inherit name src;
-
-      desktopItem = makeDesktopItem {
-        name = "Eclipse";
-        exec = "eclipse";
-        icon = "eclipse";
-        comment = "Integrated Development Environment";
-        desktopName = "Eclipse IDE";
-        genericName = "Integrated Development Environment";
-        categories = "Application;Development;";
-      };
-
-      buildInputs = [ makeWrapper ];
-
-      buildCommand = ''
-        # Unpack tarball.
-        mkdir -p $out
-        tar xfvz $src -C $out
-
-        # Patch binaries.
-        interpreter=$(echo ${stdenv.glibc}/lib/ld-linux*.so.2)
-        libCairo=$out/eclipse/libcairo-swt.so
-        patchelf --set-interpreter $interpreter $out/eclipse/eclipse
-        [ -f $libCairo ] && patchelf --set-rpath ${freetype}/lib:${fontconfig}/lib:${libX11}/lib:${libXrender}/lib:${zlib}/lib $libCairo
-
-        # Create wrapper script.  Pass -configuration to store
-        # settings in ~/.eclipse/org.eclipse.platform_<version> rather
-        # than ~/.eclipse/org.eclipse.platform_<version>_<number>.
-        productId=$(sed 's/id=//; t; d' $out/eclipse/.eclipseproduct)
-        productVersion=$(sed 's/version=//; t; d' $out/eclipse/.eclipseproduct)
-        
-        makeWrapper $out/eclipse/eclipse $out/bin/eclipse \
-          --prefix PATH : ${jre}/bin \
-          --prefix LD_LIBRARY_PATH : ${glib}/lib:${gtk}/lib:${libXtst}/lib${stdenv.lib.optionalString (webkitgtk2 != null) ":${webkitgtk2}/lib"} \
-          --add-flags "-configuration \$HOME/.eclipse/''${productId}_$productVersion/configuration"
-
-        # Create desktop item.
-        mkdir -p $out/share/applications
-        cp ${desktopItem}/share/applications/* $out/share/applications
-        mkdir -p $out/share/pixmaps
-        ln -s $out/eclipse/icon.xpm $out/share/pixmaps/eclipse.xpm
-      ''; # */
-
-      meta = {
-        homepage = http://www.eclipse.org/;
-        inherit description;
-      };
-
-    };
-    
-in {
+  buildEclipse = import ./build-eclipse.nix args;

  eclipse_sdk_35 = buildEclipse {
    name = "eclipse-sdk-3.5.2";
@ -312,7 +258,6 @@ in {
      "x86_64-linux" = fetchurl {
          url = http://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops4/R-4.4.2-201502041700/eclipse-SDK-4.4.2-linux-gtk-x86_64.tar.gz;
          sha256 = "0g00alsixfaakmn4khr0m9fxvkrbhbg6qqfa27xr6a9np6gzg98l";
-
        };
      "i686-linux" = fetchurl {
          url = http://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops4/R-4.4.2-201502041700/eclipse-SDK-4.4.2-linux-gtk.tar.gz;
@ -328,7 +273,6 @@ in {
      "x86_64-linux" = fetchurl {
          url = http://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops4/R-4.5-201506032000/eclipse-SDK-4.5-linux-gtk-x86_64.tar.gz;
          sha256 = "0vfql4gh263ms8bg7sgn05gnjajplx304cn3nr03jlacgr3pkarf";
-
        };
      "i686-linux" = fetchurl {
          url = http://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops4/R-4.5-201506032000/eclipse-SDK-4.5-linux-gtk.tar.gz;
@ -337,22 +281,53 @@ in {
    };
  };

-  eclipse-platform = buildEclipse {
+  eclipse_sdk_451 = buildEclipse {
+    name = "eclipse-sdk-4.5.1";
+    description = "Eclipse Mars Classic";
+    sources = {
+      "x86_64-linux" = fetchurl {
+          url = http://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops4/R-4.5.1-201509040015/eclipse-SDK-4.5.1-linux-gtk-x86_64.tar.gz;
+          sha256 = "b56503ab4b86f54e1cdc93084ef8c32fb1eaabc6f6dad9ef636153b14c928e02";
+        };
+      "i686-linux" = fetchurl {
+          url = http://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops4/R-4.5.1-201509040015/eclipse-SDK-4.5.1-linux-gtk.tar.gz;
+          sha256 = "f2e41da52e138276f8f121fd4d57c3f98839817836b56f8424e99b63c9b1b025";
+        };
+    };
+  };
+
+  eclipse-platform = eclipse-platform-451;
+
+  eclipse-platform-45 = buildEclipse {
    name = "eclipse-platform-4.5";
    description = "Eclipse platform";
    sources = {
      "x86_64-linux" = fetchurl {
-          url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops4/R-4.5-201506032000/eclipse-platform-4.5-linux-gtk-x86_64.tar.gz";
+          url = https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops4/R-4.5-201506032000/eclipse-platform-4.5-linux-gtk-x86_64.tar.gz;
          sha256 = "1510j41yr86pbzwf48kjjdd46nkpkh8zwn0hna0cqvsw1gk2vqcg";
-
        };
      "i686-linux" = fetchurl {
-          url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops4/R-4.5-201506032000/eclipse-platform-4.5-linux-gtk.tar.gz";
+          url = https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops4/R-4.5-201506032000/eclipse-platform-4.5-linux-gtk.tar.gz;
          sha256 = "1f97jd3qbi3830y3djk8bhwzd9whsq8gzfdk996chxc55prn0qbd";
        };
    };
  };

+  eclipse-platform-451 = buildEclipse {
+    name = "eclipse-platform-4.5.1";
+    description = "Eclipse platform";
+    sources = {
+      "x86_64-linux" = fetchurl {
+          url = https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops4/R-4.5.1-201509040015/eclipse-platform-4.5.1-linux-gtk-x86_64.tar.gz;
+          sha256 = "1m7bzyi20yss6cz74d7hvhxj1cddcpgzxjia5wcjycsvq33kkny0";
+        };
+      "i686-linux" = fetchurl {
+          url = https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops4/R-4.5.1-201509040015/eclipse-platform-4.5.1-linux-gtk.tar.gz;
+          sha256 = "17x8w4k0rba0c0v9ghxdl0zqfadla5c1aakfd5k0q9q3x3qi6rxp";
+        };
+    };
+  };
+
  eclipseWithPlugins = { eclipse, plugins ? [], jvmArgs ? [] }:
    let
      # Gather up the desired plugins.
@ -369,21 +344,20 @@ in {
      dropinProp = "-D${dropinPropName}=${pluginEnv}/eclipse/dropins";
      jvmArgsText = stdenv.lib.concatStringsSep "\n" (jvmArgs ++ [dropinProp]);

-      # Prepare an eclipse.ini with the plugin directory.
-      origEclipseIni = builtins.readFile "${eclipse}/eclipse/eclipse.ini";
-      eclipseIniFile = writeText "eclipse.ini" ''
-        ${origEclipseIni}
-        ${jvmArgsText}
-      '';
-
      # Base the derivation name on the name of the underlying
      # Eclipse.
      name = (stdenv.lib.meta.appendToName "with-plugins" eclipse).name;
    in
      runCommand name { buildInputs = [ makeWrapper ]; } ''
-        mkdir -p $out/bin
+        mkdir -p $out/bin $out/etc
+
+        # Prepare an eclipse.ini with the plugin directory.
+        cat ${eclipse}/eclipse/eclipse.ini - > $out/etc/eclipse.ini <<EOF
+        ${jvmArgsText}
+        EOF
+
        makeWrapper ${eclipse}/bin/eclipse $out/bin/eclipse \
-          --add-flags "--launcher.ini ${eclipseIniFile}"
+          --add-flags "--launcher.ini $out/etc/eclipse.ini"

        ln -s ${eclipse}/share $out/
      '';
--- a/pkgs/applications/editors/eclipse/plugins.nix
+++ b/pkgs/applications/editors/eclipse/plugins.nix
@ -152,12 +152,12 @@ rec {

  cdt = buildEclipseUpdateSite rec {
    name = "cdt-${version}";
-    version = "8.7.0";
+    version = "8.8.0";

    src = fetchzip {
      stripRoot = false;
-      url = "http://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/tools/cdt/releases/8.7/${name}.zip";
-      sha256 = "0qpcjcl6n98x7ys4qz8p1x5hhk2ydrgh8w3r1kqk0zc7liqrx7vg";
+      url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/tools/cdt/releases/8.8/${name}.zip";
+      sha256 = "1i1m7g5128q21njgrkiw71y4vi4aqzz8xdd4iv80j3nsvhbv6cnm";
    };

    meta = with stdenv.lib; {
@ -298,12 +298,12 @@ rec {

  jdt = buildEclipseUpdateSite rec {
    name = "jdt-${version}";
-    version = "4.5";
+    version = "4.5.1";

    src = fetchzip {
      stripRoot = false;
-      url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops4/R-4.5-201506032000/org.eclipse.jdt-4.5.zip";
-      sha256 = "0zrdn26f7qsms2xfiyc049bhhh0czsbf989pgyq736b8hfmmh9iy";
+      url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops4/R-4.5.1-201509040015/org.eclipse.jdt-4.5.1.zip";
+      sha256 = "0nxi552vvpjalnsqhc0zi6fgaj9p22amxsiczpv7za4kr7m47x73";
    };

    meta = with stdenv.lib; {
--- a/pkgs/applications/editors/emacs-modes/elpa-generated.nix
+++ b/pkgs/applications/editors/emacs-modes/elpa-generated.nix
--- a/pkgs/applications/editors/emacs-modes/elpa-packages.json
+++ b/pkgs/applications/editors/emacs-modes/elpa-packages.json
--- a/pkgs/applications/editors/emacs-modes/elpa-packages.nix
+++ b/pkgs/applications/editors/emacs-modes/elpa-packages.nix
@ -13,46 +13,17 @@ To update the list of packages from ELPA,

 { fetchurl, lib, stdenv, texinfo }:

-let
-
-  inherit (lib) makeScope mapAttrs;
-
-  json = builtins.readFile ./elpa-packages.json;
-  manifest = builtins.fromJSON json;
-
-  mkPackage = self: name: recipe:
-    let drv =
-          { elpaBuild, stdenv, fetchurl }:
-          let
-            unknownFetcher =
-              abort "emacs-${name}: unknown fetcher '${recipe.fetch.tag}'";
-            fetch =
-              { inherit fetchurl; }."${recipe.fetch.tag}"
-              or unknownFetcher;
-            args = builtins.removeAttrs recipe.fetch [ "tag" ];
-            src = fetch args;
-          in elpaBuild {
-            pname = name;
-            inherit (recipe) version;
-            inherit src;
-            packageRequires =
-              let lookupDep = d: self."${d}" or null;
-              in map lookupDep recipe.deps;
-            meta = {
-              homepage = "http://elpa.gnu.org/packages/${name}.html";
-              license = stdenv.lib.licenses.free;
-            };
-          };
-    in self.callPackage drv {};
-
-in
-
 self:

  let
-    super = removeAttrs (mapAttrs (mkPackage self) manifest) [ "dash" ];

-    elpaBuild = import ../../../build-support/emacs/melpa.nix {
+    imported = import ./elpa-generated.nix {
+      inherit (self) callPackage;
+    };
+
+    super = removeAttrs imported [ "dash" ];
+
+    elpaBuild = import ../../../build-support/emacs/elpa.nix {
      inherit fetchurl lib stdenv texinfo;
      inherit (self) emacs;
    };
@ -63,11 +34,14 @@ self:
      });
    };

-    elpaPackages = super // {
+    overrides = {
      # These packages require emacs-25
      el-search = markBroken super.el-search;
      iterators = markBroken super.iterators;
      midi-kbd = markBroken super.midi-kbd;
      stream = markBroken super.stream;
    };
+
+    elpaPackages = super // overrides;
+
  in elpaPackages // { inherit elpaBuild elpaPackages; }
--- a/pkgs/applications/editors/emacs-modes/melpa-generated.nix
+++ b/pkgs/applications/editors/emacs-modes/melpa-generated.nix
--- a/pkgs/applications/editors/emacs-modes/melpa-packages.json
+++ b/pkgs/applications/editors/emacs-modes/melpa-packages.json
--- a/pkgs/applications/editors/emacs-modes/melpa-packages.nix
+++ b/pkgs/applications/editors/emacs-modes/melpa-packages.nix
@ -14,62 +14,174 @@ To update the list of packages from MELPA,

 { lib }:

-let
-
-  inherit (lib) makeScope mapAttrs;
-
-  json = builtins.readFile ./melpa-packages.json;
-  manifest = builtins.fromJSON json;
-
-  mkPackage = self: name: recipe:
-    let drv =
-          { melpaBuild, stdenv, fetchbzr, fetchcvs, fetchFromGitHub, fetchFromGitLab
-          , fetchgit, fetchhg, fetchsvn, fetchurl }:
-          let
-            unknownFetcher =
-              abort "emacs-${name}: unknown fetcher '${recipe.fetch.tag}'";
-            fetch =
-              {
-                inherit fetchbzr fetchcvs fetchFromGitHub fetchFromGitLab fetchgit fetchhg
-                        fetchsvn fetchurl;
-              }."${recipe.fetch.tag}"
-              or unknownFetcher;
-            args = builtins.removeAttrs recipe.fetch [ "tag" ];
-            src = fetch args;
-            recipeFile = fetchurl {
-              url = "https://raw.githubusercontent.com/milkypostman/melpa/${recipe.recipe.commit}/recipes/${name}";
-              inherit (recipe.recipe) sha256;
-            };
-          in melpaBuild {
-            pname = name;
-            inherit (recipe) version;
-            inherit recipeFile src;
-            packageRequires =
-              let lookupDep = d: self."${d}" or null;
-              in map lookupDep recipe.deps;
-            meta = {
-              homepage = "http://melpa.org/#/${name}";
-              license = stdenv.lib.licenses.free;
-            };
-          };
-    in self.callPackage drv {};
-
-in
-
 self:

  let
-    super = mapAttrs (mkPackage self) manifest;
+    imported = import ./melpa-generated.nix { inherit (self) callPackage; };
+    super = builtins.removeAttrs imported [
+      "swbuff-x" # required dependency swbuff is missing
+    ];

-    markBroken = pkg: pkg.override {
-      melpaBuild = args: self.melpaBuild (args // {
-        meta = (args.meta or {}) // { broken = true; };
+    dontConfigure = pkg: pkg.override (args: {
+      melpaBuild = drv: args.melpaBuild (drv // {
+        configureScript = "true";
      });
+    });
+
+    markBroken = pkg: pkg.override (args: {
+      melpaBuild = drv: args.melpaBuild (drv // {
+        meta = (drv.meta or {}) // { broken = true; };
+      });
+    });
+
+    overrides = {
+      ac-php = super.ac-php.override {
+        inherit (self.melpaPackages) company popup;
+      };
+
+      # upstream issue: mismatched filename
+      ack-menu = markBroken super.ack-menu;
+
+      airline-themes = super.airline-themes.override {
+        inherit (self.melpaPackages) powerline;
+      };
+
+      # upstream issue: missing file header
+      bufshow = markBroken super.bufshow;
+
+      # part of a larger package
+      # upstream issue: missing package version
+      cmake-mode = markBroken (dontConfigure super.cmake-mode);
+
+      # upstream issue: missing file header
+      cn-outline = markBroken super.cn-outline;
+
+      # upstream issue: missing file header
+      connection = markBroken super.connection;
+
+      # upstream issue: missing file header
+      crux = markBroken super.crux;
+
+      # upstream issue: missing file header
+      dictionary = markBroken super.dictionary;
+
+      easy-kill-extras = super.easy-kill-extras.override {
+        inherit (self.melpaPackages) easy-kill;
+      };
+
+      # missing git
+      egg = markBroken super.egg;
+
+      # upstream issue: missing file header
+      elmine = markBroken super.elmine;
+
+      ess-R-data-view = super.ess-R-data-view.override {
+        inherit (self.melpaPackages) ess ctable popup;
+      };
+
+      ess-R-object-popup = super.ess-R-object-popup.override {
+        inherit (self.melpaPackages) ess popup;
+      };
+
+      # missing OCaml
+      flycheck-ocaml = markBroken super.flycheck-ocaml;
+
+      # upstream issue: missing file header
+      fold-dwim = markBroken super.fold-dwim;
+
+      # build timeout
+      graphene = markBroken super.graphene;
+
+      # upstream issue: mismatched filename
+      helm-lobsters = markBroken super.helm-lobsters;
+
+      # upstream issue: missing file header
+      helm-words = markBroken super.helm-words;
+
+      # upstream issue: missing file header
+      ido-complete-space-or-hyphen = markBroken super.ido-complete-space-or-hyphen;
+
+      # upstream issue: missing file header
+      initsplit = markBroken super.initsplit;
+
+      # upstream issue: missing file header
+      jsfmt = markBroken super.jsfmt;
+
+      # upstream issue: missing file header
+      link = markBroken super.link;
+
+      # upstream issue: mismatched filename
+      link-hint = markBroken super.link-hint;
+
+      # part of a larger package
+      llvm-mode = dontConfigure super.llvm-mode;
+
+      # upstream issue: missing file header
+      maxframe = markBroken super.maxframe;
+
+      # missing OCaml
+      merlin = markBroken super.merlin;
+
+      mhc = super.mhc.override {
+        inherit (self.melpaPackages) calfw;
+      };
+
+      # missing .NET
+      nemerle = markBroken super.nemerle;
+
+      # part of a larger package
+      notmuch = dontConfigure super.notmuch;
+
+      # missing OCaml
+      ocp-indent = markBroken super.ocp-indent;
+
+      # upstream issue: missing file header
+      perl-completion = markBroken super.perl-completion;
+
+      # upstream issue: truncated file
+      powershell = markBroken super.powershell;
+
+      # upstream issue: mismatched filename
+      processing-snippets = markBroken super.processing-snippets;
+
+      # upstream issue: missing file header
+      qiita = markBroken super.qiita;
+
+      # upstream issue: missing package version
+      quack = markBroken super.quack;
+
+      # upstream issue: missing file header
+      railgun = markBroken super.railgun;
+
+      # upstream issue: missing file footer
+      seoul256-theme = markBroken super.seoul256-theme;
+
+      spaceline = super.spaceline.override {
+        inherit (self.melpaPackages) powerline;
+      };
+
+      # upstream issue: missing file header
+      speech-tagger = markBroken super.speech-tagger;
+
+      # upstream issue: missing file header
+      stgit = markBroken super.stgit;
+
+      # upstream issue: missing file header
+      textmate = markBroken super.textmate;
+
+      # missing OCaml
+      utop = markBroken super.utop;
+
+      # upstream issue: missing file header
+      voca-builder = markBroken super.voca-builder;
+
+      # upstream issue: missing file header
+      window-numbering = markBroken super.window-numbering;
+
+      # upstream issue: missing file header
+      zeitgeist = markBroken super.zeitgeist;
    };

-    melpaPackages = super // {
-      # broken upstream
-      ack-menu = markBroken super.ack-menu;
-    };
+    melpaPackages = super // overrides;
  in
    melpaPackages // { inherit melpaPackages; }
--- a/pkgs/applications/editors/emacs-modes/melpa-stable-generated.nix
+++ b/pkgs/applications/editors/emacs-modes/melpa-stable-generated.nix
--- a/pkgs/applications/editors/emacs-modes/melpa-stable-packages.json
+++ b/pkgs/applications/editors/emacs-modes/melpa-stable-packages.json
--- a/pkgs/applications/editors/emacs-modes/melpa-stable-packages.nix
+++ b/pkgs/applications/editors/emacs-modes/melpa-stable-packages.nix
@ -16,62 +16,149 @@ To update the list of packages from MELPA Stable,

 { lib }:

-let
-
-  inherit (lib) makeScope mapAttrs;
-
-  json = builtins.readFile ./melpa-stable-packages.json;
-  manifest = builtins.fromJSON json;
-
-  mkPackage = self: name: recipe:
-    let drv =
-          { melpaBuild, stdenv, fetchbzr, fetchcvs, fetchFromGitHub, fetchFromGitLab
-          , fetchgit, fetchhg, fetchsvn, fetchurl }:
-          let
-            unknownFetcher =
-              abort "emacs-${name}: unknown fetcher '${recipe.fetch.tag}'";
-            fetch =
-              {
-                inherit fetchbzr fetchcvs fetchFromGitHub fetchFromGitLab fetchgit fetchhg
-                        fetchsvn fetchurl;
-              }."${recipe.fetch.tag}"
-              or unknownFetcher;
-            args = builtins.removeAttrs recipe.fetch [ "tag" ];
-            src = fetch args;
-            recipeFile = fetchurl {
-              url = "https://raw.githubusercontent.com/milkypostman/melpa/${recipe.recipe.commit}/recipes/${name}";
-              inherit (recipe.recipe) sha256;
-            };
-          in melpaBuild {
-            pname = name;
-            inherit (recipe) version;
-            inherit recipeFile src;
-            packageRequires =
-              let lookupDep = d: self."${d}" or null;
-              in map lookupDep recipe.deps;
-            meta = {
-              homepage = "http://stable.melpa.org/#/${name}";
-              license = stdenv.lib.licenses.free;
-            };
-          };
-    in self.callPackage drv {};
-
-in
-
 self:

  let
-    super = mapAttrs (mkPackage self) manifest;
+    imported = import ./melpa-stable-generated.nix { inherit (self) callPackage; };

-    markBroken = pkg: pkg.override {
-      melpaBuild = args: self.melpaBuild (args // {
-        meta = (args.meta or {}) // { broken = true; };
+    super = imported;
+
+    dontConfigure = pkg: pkg.override (args: {
+      melpaBuild = drv: args.melpaBuild (drv // {
+        configureScript = "true";
      });
+    });
+
+    markBroken = pkg: pkg.override (args: {
+      melpaBuild = drv: args.melpaBuild (drv // {
+        meta = (drv.meta or {}) // { broken = true; };
+      });
+    });
+
+    overrides = {
+      ac-php = super.ac-php.override {
+        inherit (self.melpaPackages) company popup;
+      };
+
+      # upstream issue: mismatched filename
+      ack-menu = markBroken super.ack-menu;
+
+      airline-themes = super.airline-themes.override {
+        inherit (self.melpaPackages) powerline;
+      };
+
+      # upstream issue: missing file header
+      bufshow = markBroken super.bufshow;
+
+      # part of a larger package
+      # upstream issue: missing package version
+      cmake-mode = markBroken (dontConfigure super.cmake-mode);
+
+      # upstream issue: missing file header
+      connection = markBroken super.connection;
+
+      # upstream issue: missing file header
+      crux = markBroken super.crux;
+
+      # upstream issue: missing file header
+      dictionary = markBroken super.dictionary;
+
+      easy-kill-extras = super.easy-kill-extras.override {
+        inherit (self.melpaPackages) easy-kill;
+      };
+
+      # missing git
+      egg = markBroken super.egg;
+
+      # upstream issue: missing file header
+      elmine = markBroken super.elmine;
+
+      ess-R-data-view = super.ess-R-data-view.override {
+        inherit (self.melpaPackages) ess ctable popup;
+      };
+
+      ess-R-object-popup = super.ess-R-object-popup.override {
+        inherit (self.melpaPackages) ess popup;
+      };
+
+      # missing OCaml
+      flycheck-ocaml = markBroken super.flycheck-ocaml;
+
+      # upstream issue: missing file header
+      fold-dwim = markBroken super.fold-dwim;
+
+      # build timeout
+      graphene = markBroken super.graphene;
+
+      # upstream issue: mismatched filename
+      helm-lobsters = markBroken super.helm-lobsters;
+
+      # upstream issue: missing file header
+      ido-complete-space-or-hyphen = markBroken super.ido-complete-space-or-hyphen;
+
+      # upstream issue: missing file header
+      initsplit = markBroken super.initsplit;
+
+      # upstream issue: missing file header
+      jsfmt = markBroken super.jsfmt;
+
+      # upstream issue: missing file header
+      link = markBroken super.link;
+
+      # upstream issue: mismatched filename
+      link-hint = markBroken super.link-hint;
+
+      # upstream issue: missing file header
+      maxframe = markBroken super.maxframe;
+
+      # missing OCaml
+      merlin = markBroken super.merlin;
+
+      mhc = super.mhc.override {
+        inherit (self.melpaPackages) calfw;
+      };
+
+      # missing .NET
+      nemerle = markBroken super.nemerle;
+
+      # part of a larger package
+      notmuch = dontConfigure super.notmuch;
+
+      # missing OCaml
+      ocp-indent = markBroken super.ocp-indent;
+
+      # upstream issue: truncated file
+      powershell = markBroken super.powershell;
+
+      # upstream issue: mismatched filename
+      processing-snippets = markBroken super.processing-snippets;
+
+      # upstream issue: missing file header
+      qiita = markBroken super.qiita;
+
+      spaceline = super.spaceline.override {
+        inherit (self.melpaPackages) powerline;
+      };
+
+      # upstream issue: missing file header
+      speech-tagger = markBroken super.speech-tagger;
+
+      # upstream issue: missing file header
+      stgit = markBroken super.stgit;
+
+      # upstream issue: missing file header
+      textmate = markBroken super.textmate;
+
+      # missing OCaml
+      utop = markBroken super.utop;
+
+      # upstream issue: missing file header
+      voca-builder = markBroken super.voca-builder;
+
+      # upstream issue: missing file header
+      window-numbering = markBroken super.window-numbering;
    };

-    melpaStablePackages = super // {
-      # broken upstream
-      ack-menu = markBroken super.ack-menu;
-    };
+    melpaStablePackages = super // overrides;
  in
    melpaStablePackages // { inherit melpaStablePackages; }
--- a/pkgs/applications/editors/idea/common.nix
+++ b/pkgs/applications/editors/idea/common.nix
@ -1,7 +1,7 @@
 { stdenv, fetchurl, makeDesktopItem, makeWrapper, patchelf, p7zip
-, coreutils, gnugrep, which, git, python, unzip, androidsdk }:
+, coreutils, gnugrep, which, git, python, unzip, jdk }:

-{ name, product, version, build, src, meta, jdk } @ attrs:
+{ name, product, version, build, src, meta } @ attrs:

 with stdenv.lib;

--- a/pkgs/applications/editors/idea/default.nix
+++ b/pkgs/applications/editors/idea/default.nix
@ -1,6 +1,6 @@
 { stdenv, callPackage, fetchurl, makeDesktopItem, makeWrapper, patchelf
 , coreutils, gnugrep, which, git, python, unzip, p7zip
-, androidsdk, jdk, oraclejdk8
+, androidsdk, jdk
 }:

 assert stdenv.isLinux;
@ -8,12 +8,7 @@ assert stdenv.isLinux;
 let

  bnumber = with stdenv.lib; build: last (splitString "-" build);
-  mkIdeaProduct' = callPackage ./common.nix { };
-  mkIdeaProduct = attrs: mkIdeaProduct' ({
-      # After IDEA 15 we can no longer use OpenJDK.
-      # https://youtrack.jetbrains.com/issue/IDEA-147272
-      jdk = if (bnumber attrs.build) < "143" then jdk else oraclejdk8;
-  } // attrs);
+  mkIdeaProduct = callPackage ./common.nix { };

  buildAndroidStudio = { name, version, build, src, license, description }:
    let drv = (mkIdeaProduct rec {
@ -166,13 +161,13 @@ in

  clion = buildClion rec {
    name = "clion-${version}";
-    version = "1.0.4";
-    build = "141.874";
+    version = "1.2.4";
+    build = "143.1186";
    description  = "C/C++ IDE. New. Intelligent. Cross-platform";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/cpp/${name}.tar.gz";
-      sha256 = "1cz59h2znzjy7zncc049f2w30kc89rvmk7l51a1y6ymf9s7cj4cm";
+      sha256 = "0asjgfshbximjk6i57fz3d2ykby5qw5x6nhw91cpzrzszc59dmm2";
    };
  };

@ -190,25 +185,25 @@ in

  idea-community = buildIdea rec {
    name = "idea-community-${version}";
-    version = "15.0.2";
-    build = "IC-143.1184";
+    version = "15.0.3";
+    build = "IC-143.1821";
    description = "Integrated Development Environment (IDE) by Jetbrains, community edition";
    license = stdenv.lib.licenses.asl20;
    src = fetchurl {
      url = "https://download.jetbrains.com/idea/ideaIC-${version}.tar.gz";
-      sha256 = "0y8rrbsb87avn1dhw5r1xb4axpbm1qvgcd0aysir9bqzhx8qg64c";
+      sha256 = "15hj4kqlpg3b4xp2v4f4iidascrc8s97mq8022nvbcs879gpajqa";
    };
  };

  idea-ultimate = buildIdea rec {
    name = "idea-ultimate-${version}";
-    version = "15.0.2";
-    build = "IU-143.1184";
+    version = "15.0.3";
+    build = "IU-143.1821";
    description = "Integrated Development Environment (IDE) by Jetbrains, requires paid license";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/idea/ideaIU-${version}.tar.gz";
-      sha256 = "1r8gw7mv1b0k223k76ib08f4yrrgrw24qmhkbx88rknmls5nsgss";
+      sha256 = "02v8v2a7p620l4mlk7jqw9sl2455a1nya1dy84y23h9vq20aihlh";
    };
  };

--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@ -15,7 +15,11 @@ stdenv.mkDerivation rec {
  version = "6.9.2-0";

  src = fetchurl {
-    url = "mirror://imagemagick/releases/ImageMagick-${version}.tar.xz";
+    urls = [
+      "mirror://imagemagick/releases/ImageMagick-${version}.tar.xz"
+      # the original source above removes tarballs quickly
+      "http://distfiles.macports.org/ImageMagick/ImageMagick-${version}.tar.xz"
+    ];
    sha256 = "17ir8bw1j7g7srqmsz3rx780sgnc21zfn0kwyj78iazrywldx8h7";
  };

--- a/pkgs/applications/graphics/inkscape/configure-python-libs.patch
+++ b/pkgs/applications/graphics/inkscape/configure-python-libs.patch
@ -1,15 +0,0 @@
-Work around Python misdetection and set `PYTHON_LIBS' to
-"-L/nix/store/... -lpython2.4" instead of "/nix/store/.../libpython2.4.so".
-Changed to 2.5.
-
--- inkscape-0.45.1/configure	2007-03-20 14:56:43.000000000 +0100
-+++ inkscape-0.45.1/configure	2008-02-22 16:19:10.000000000 +0100
-@@ -10202,7 +10202,7 @@ if test "x$with_python" = "xyes"; then
-     if test "$?" -gt "0"; then
-         with_python="no"
-     else
-        checkPYTHON_LIBS=`python -c "import distutils.sysconfig ; print '%s/%s %s' % (distutils.sysconfig.get_config_var('LIBPL'),distutils.sysconfig.get_config_var('LDLIBRARY'),distutils.sysconfig.get_config_var('LIBS'))" 2>/dev/null`
-+        checkPYTHON_LIBS=`python -c "import distutils.sysconfig ; print '-L%s -lpython2.5 %s' % (distutils.sysconfig.get_config_var('LIBDIR'),distutils.sysconfig.get_config_var('LIBS'))" 2>/dev/null`
-         if test "$?" -gt "0"; then
-             with_python="no"
-         else
--- a/pkgs/applications/graphics/openimageio/default.nix
+++ b/pkgs/applications/graphics/openimageio/default.nix
@ -4,11 +4,11 @@

 stdenv.mkDerivation rec {
  name = "openimageio-${version}";
-  version = "1.4.16";
+  version = "1.6.9";

  src = fetchurl {
    url = "https://github.com/OpenImageIO/oiio/archive/Release-${version}.zip";
-    sha256 = "0f9gspsjhniz992c04dm4lvffzz7zjqn1n34nqn6c32r498kimcj";
+    sha256 = "0942xj877875f4dpfg7aqwyw015y82vkhaqap7yhybmvzsfj7wki";
  };

  buildInputs = [
--- a/pkgs/applications/graphics/photoqt/default.nix
+++ b/pkgs/applications/graphics/photoqt/default.nix
@ -17,7 +17,9 @@ stdenv.mkDerivation rec {
    sha256 = "0j2kvxfb5pd9abciv161nkcsyam6n8kfqs8ymwj2mxiqflwbmfl1";
  };

-  buildInputs = [ cmake makeWrapper qtbase qttools exiv2 graphicsmagick ];
+  buildInputs = [
+    cmake makeWrapper qtbase qtquickcontrols qttools exiv2 graphicsmagick
+  ];

  preConfigure = ''
    export MAGICK_LOCATION="${graphicsmagick}/include/GraphicsMagick"
--- a/pkgs/applications/graphics/sane/backends/generic.nix
+++ b/pkgs/applications/graphics/sane/backends/generic.nix
@ -1,5 +1,5 @@
 { stdenv, fetchurl
-, avahi, libusb1, libv4l, net_snmp
+, avahi, libjpeg, libusb1, libv4l, net_snmp
 , gettext, pkgconfig

 # List of { src name backend } attibute sets - see installFirmware below:
@ -50,6 +50,9 @@ stdenv.mkDerivation {
    mkdir -p $out/etc/udev/rules.d/
    ./tools/sane-desc -m udev > $out/etc/udev/rules.d/49-libsane.rules || \
    cp tools/udev/libsane.rules $out/etc/udev/rules.d/49-libsane.rules
+
+    substituteInPlace $out/lib/libsane.la \
+      --replace "-ljpeg" "-L${libjpeg}/lib -ljpeg"
  '' + stdenv.lib.concatStrings (builtins.map installFirmware compatFirmware);

  meta = with stdenv.lib; {
--- a/pkgs/applications/graphics/sane/backends/git.nix
+++ b/pkgs/applications/graphics/sane/backends/git.nix
@ -1,10 +1,10 @@
 { callPackage, fetchgit, ... } @ args:

 callPackage ./generic.nix (args // {
-  version = "2016-01-09";
+  version = "2016-01-25";
  src = fetchgit {
-    sha256 = "440f88a4126841cfd139b17902ceb940bbf189defe21b208e93bfd474cfb16e8";
-    rev = "f78e85cad666492fadd5612af77fa7c84e270a12";
+    sha256 = "db1fecd671bd8b3a777138bb4815285b4364ee3ad01ab05424b4aa0c20ed9919";
+    rev = "056f590f2d147099554d97a89dd5e0ddfa8d6dda";
    url = "git://alioth.debian.org/git/sane/sane-backends.git";
  };
 })
--- a/pkgs/applications/kde-apps-15.12/kdelibs/polkit-install.patch
+++ b/pkgs/applications/kde-apps-15.12/kdelibs/polkit-install.patch
@ -1,12 +0,0 @@
-diff -ru -x '*~' kdelibs-4.6.90-orig/kdecore/auth/ConfigureChecks.cmake kdelibs-4.6.90/kdecore/auth/ConfigureChecks.cmake
--- kdelibs-4.6.90-orig/kdecore/auth/ConfigureChecks.cmake	2011-05-20 22:24:54.000000000 +0200
-+++ kdelibs-4.6.90/kdecore/auth/ConfigureChecks.cmake	2011-07-12 14:03:00.000000000 +0200
-@@ -139,7 +139,7 @@
-         ${CMAKE_INSTALL_PREFIX} _KDE4_AUTH_POLICY_FILES_INSTALL_DIR
-         ${POLKITQT-1_POLICY_FILES_INSTALL_DIR})
- 
-    set(KDE4_AUTH_POLICY_FILES_INSTALL_DIR ${_KDE4_AUTH_POLICY_FILES_INSTALL_DIR} CACHE STRING 
-+    set(KDE4_AUTH_POLICY_FILES_INSTALL_DIR "\${CMAKE_INSTALL_PREFIX}/share/polkit-1/actions" CACHE STRING 
-         "Where policy files generated by KAuth will be installed" FORCE)
- elseif(KDE4_AUTH_BACKEND_NAME STREQUAL "FAKE")
-     set (KAUTH_COMPILING_FAKE_BACKEND TRUE)
--- a/pkgs/applications/misc/albert/default.nix
+++ b/pkgs/applications/misc/albert/default.nix
@ -0,0 +1,26 @@
+{ stdenv, fetchFromGitHub, qtbase, qtx11extras, makeQtWrapper, muparser, cmake }:
+
+stdenv.mkDerivation rec {
+  name    = "albert-${version}";
+  version = "0.8.0";
+
+  src = fetchFromGitHub {
+    owner  = "manuelschneid3r";
+    repo   = "albert";
+    rev    = "v${version}";
+    sha256 = "0lzj1gbcc5sp2x1c0d3s21y55kcnnn4dmy8d205mrgnyavjrak7n";
+  };
+
+  buildInputs = [ cmake qtbase qtx11extras muparser makeQtWrapper ];
+
+  fixupPhase = ''
+    wrapQtProgram $out/bin/albert
+  '';
+
+  meta = {
+    homepage    = https://github.com/manuelSchneid3r/albert;
+    description = "Desktop agnostic launcher";
+    license     = stdenv.lib.licenses.gpl3Plus;
+    maintainers = [ stdenv.lib.maintainers.ericsagnes ];
+  };
+}
--- a/pkgs/applications/misc/direwolf/default.nix
+++ b/pkgs/applications/misc/direwolf/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchurl, unzip, alsaLib }:
+{ stdenv, fetchFromGitHub, unzip, alsaLib }:
 let
  version = "1.2";
 in
@ -6,9 +6,11 @@ stdenv.mkDerivation rec {
  name = "direwolf-${version}";
  inherit version;

-  src = fetchurl {
-    url = "http://home.comcast.net/~wb2osz/Version%201.2/direwolf-${version}-src.zip";
-    sha256 = "0csl6harx7gmjmamxy0ylzhbamppphffisk8j33dc6g08k6rc77f";
+  src = fetchFromGitHub {
+    owner = "wb2osz";
+    repo = "direwolf";
+    rev = "8b81a32";
+    sha256 = "0r4fgdxghh292bzhqshr7zl5cg2lfsvlgmy4d5vqcli7x6qa1gcs";
  };

  buildInputs = [
--- a/pkgs/applications/misc/get_iplayer/default.nix
+++ b/pkgs/applications/misc/get_iplayer/default.nix
@ -1,23 +1,28 @@
 {stdenv, fetchurl, flvstreamer, ffmpeg, makeWrapper, perl, buildPerlPackage, perlPackages, vlc, rtmpdump}:
 buildPerlPackage {
-  name = "get_iplayer-2.86";
+  name = "get_iplayer-2.94";

  buildInputs = [makeWrapper perl];
-  propagatedBuildInputs = with perlPackages; [HTMLParser HTTPCookies LWP];
+  propagatedBuildInputs = with perlPackages; [HTMLParser HTTPCookies LWP XMLSimple];

  preConfigure = "touch Makefile.PL";
  doCheck = false;

+  patchPhase = ''
+    sed -e 's|^update_script|#update_script|' \
+        -e '/WARNING.*updater/d' \
+        -i get_iplayer
+  '';
+
  installPhase = '' 
    mkdir -p $out/bin
    cp get_iplayer $out/bin
-    sed -i 's|^update_script|#update_script|' $out/bin/get_iplayer
    wrapProgram $out/bin/get_iplayer --suffix PATH : ${ffmpeg}/bin:${flvstreamer}/bin:${vlc}/bin:${rtmpdump}/bin --prefix PERL5LIB : $PERL5LIB
  '';  
  
  src = fetchurl {
-    url = ftp://ftp.infradead.org/pub/get_iplayer/get_iplayer-2.86.tar.gz;
-    sha256 = "0zhcw0ikxrrz1jayx7jjgxmdf7gzk4pmzfvpraxmv64xwzgc1sc1";
+    url = ftp://ftp.infradead.org/pub/get_iplayer/get_iplayer-2.94.tar.gz;
+    sha256 = "16p0bw879fl8cs6rp37g1hgrcai771z6rcqk2nvm49kk39dx1zi4";
  };
  
 }
--- a/pkgs/applications/misc/guake/default.nix
+++ b/pkgs/applications/misc/guake/default.nix
@ -0,0 +1,77 @@
+/* Beware!
+After starting Guake it will give the error message "Guake can not init! Gconf Error. Have you installed guake.schemas properly?",
+which will have to be resolved manually, because I have not found a way to automate this, without being impure.
+
+If you have Guake installed, you can use `nix-build -A gnome3.guake` to get the path to the build directory in the nix store,
+which then can be used in the following command to install the schemas file of Guake:
+gconftool-2 --install-schema-file /path/returned/by/nix-build/share/gconf/schemas/guake.schemas
+
+It can be removed again by the following command:
+gconftool-2 --recursive-unset /apps/guake
+*/
+{ stdenv, fetchurl, lib
+, pkgconfig, libtool, intltool, makeWrapper
+, dbus, gtk2, gconf, python2, python2Packages, libutempter, vte, keybinder, gnome2, gnome3 }:
+
+with lib;
+
+let inputs = [ dbus gtk2 gconf python2 libutempter vte keybinder gnome3.gnome_common ];
+    pySubDir = "lib/${python2.libPrefix}/site-packages";
+    pyPath = makeSearchPath pySubDir (attrVals [ "dbus" "notify" "pyGtkGlade" "pyxdg" ] python2Packages ++ [ gnome2.gnome_python ]);
+ in stdenv.mkDerivation rec {
+  name = "guake-${version}";
+  version = "0.8.3";
+
+  src = fetchurl {
+    url = "https://github.com/Guake/guake/archive/${version}.tar.gz";
+    sha256 = "1lbmdz3i9a97840h8239s360hd37nmhy3hs6kancxbzl1512ak1y";
+  };
+
+  nativeBuildInputs = [ pkgconfig libtool intltool makeWrapper ];
+
+  buildInputs = inputs ++ (with python2Packages; [ pyGtkGlade pyxdg ]);
+
+  patchPhase = ''
+    patchShebangs .
+  '';
+
+  configureScript = "./autogen.sh";
+
+  configureFlags = [
+    "--sysconfdir=/etc"
+    "--localstatedir=/var"
+    "--disable-schemas-install"
+  ];
+
+  installFlags = [
+    # Configuring the installation to not install gconf schemas is not always supported,
+    # therefore gconftool-2 has this variable, which will make gconftool-2 not update any of the databases.
+    "GCONF_DISABLE_MAKEFILE_SCHEMA_INSTALL=1"
+    "sysconfdir=\${out}/etc"
+    "localstatedir=\${TMPDIR}"
+  ];
+
+  postInstall = ''
+    mkdir -p $out/share/gconf/schemas
+    cp data/guake.schemas $out/share/gconf/schemas
+  '';
+
+  postFixup = ''
+    for bin in $out/bin/{guake,guake-prefs}; do
+      substituteInPlace $bin \
+        --replace '/usr/bin/env python2' ${python2}/bin/python2
+      wrapProgram $bin \
+        --prefix XDG_DATA_DIRS : "$out/share:$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH" \
+        --prefix LD_LIBRARY_PATH : ${makeLibraryPath inputs} \
+        --prefix PYTHONPATH : "$out/${pySubDir}:${pyPath}:$PYTHONPATH"
+    done
+  '';
+
+  meta = {
+    description = "Drop-down terminal for GNOME";
+    homepage = http://guake-project.org;
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.msteen ];
+  };
+}
--- a/pkgs/applications/misc/ipmiview/default.nix
+++ b/pkgs/applications/misc/ipmiview/default.nix
@ -0,0 +1,34 @@
+{ stdenv, fetchurl, patchelf, makeWrapper, xorg, gcc }:
+
+assert stdenv.isLinux;
+
+stdenv.mkDerivation rec {
+   name = "IPMIView-${version}";
+   version = "20151223";
+
+   src = fetchurl {
+     url = "ftp://ftp.supermicro.com/utility/IPMIView/Linux/IPMIView_V2.11.0_bundleJRE_Linux_x64_${version}.tar.gz";
+     sha256 = "1rv9j0id7i2ipm25n60bpfdm1gj44xg2aj8rnx4s6id3ln90q121";
+   };
+
+   buildInputs = [ patchelf makeWrapper ];
+
+   buildPhase = with xorg; ''
+     patchelf --set-rpath "${libX11}/lib:${libXext}/lib:${libXrender}/lib:${libXtst}/lib:${libXi}/lib" ./jre/lib/amd64/xawt/libmawt.so
+     patchelf --set-rpath "${gcc.cc}/lib" ./libiKVM64.so
+     patchelf --set-rpath "${libXcursor}/lib:${libX11}/lib:${libXext}/lib:${libXrender}/lib:${libXtst}/lib:${libXi}/lib" --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" ./jre/bin/javaws
+     patchelf --set-rpath "${gcc.cc}/lib:$out/jre/lib/amd64/jli" --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" ./jre/bin/java
+   '';
+
+   installPhase = ''
+     mkdir -p $out/bin
+     cp -R . $out/
+     echo "$out/jre/bin/java -jar $out/IPMIView20.jar" > $out/bin/IPMIView
+     chmod +x $out/bin/IPMIView
+   '';
+
+   meta = with stdenv.lib; {
+    license = licenses.unfree;
+   };
+  }
+
--- a/pkgs/applications/misc/kdbplus/default.nix
+++ b/pkgs/applications/misc/kdbplus/default.nix
@ -8,17 +8,17 @@ let
 in
 stdenv.mkDerivation rec {
  name    = "kdbplus-${version}";
-  version = "3.2";
+  version = "3.3";

  src = requireFile {
    message = ''
      Nix can't download kdb+ for you automatically. Go to
      http://kx.com and download the free, 32-bit version for
      Linux. Then run "nix-prefetch-url file:///linux.zip" in the
-      directory where you saved it. Note you need version 3.2.
+      directory where you saved it. Note you need version 3.3.
    '';
    name   = "linux.zip";
-    sha256 = "0ah1kfvxnrck1kg8j7rpzgj6amji62zbm4ya6q55l54gm3qq6q0r";
+    sha256 = "5fd0837599e24f0f437a8314510888a86ab0787684120a8fcf592299800aa940";
  };

  dontStrip = true;
--- a/pkgs/applications/misc/quicksynergy/default.nix
+++ b/pkgs/applications/misc/quicksynergy/default.nix
@ -0,0 +1,35 @@
+{stdenv, fetchurl, pkgconfig, gtk2, synergy}:
+
+stdenv.mkDerivation rec {
+  name = "quicksynergy-${version}";
+  version = "0.9.0";
+  src = fetchurl {
+    url = "http://downloads.sourceforge.net/project/quicksynergy/Linux/${version}/quicksynergy-${version}.tar.gz";
+    sha256 = "1pi8503bg8q1psw50y6d780i33nnvfjqiy9vnr3v52pdcfip8pix";
+  };
+  buildInputs = [
+    pkgconfig
+    gtk2
+    synergy
+  ];
+  preBuild = "
+    sed -i 's@/usr/bin@${synergy.out}/bin@' src/synergy_config.c
+  ";
+  meta = {
+    description = "GUI application to share mouse and keyboard between computers";
+    longDescription = "
+      QuickSynergy is a graphical interface (GUI) for easily configuring
+      Synergy2, an application that allows the user to share his mouse and
+      keyboard between two or more computers.
+
+      Without the need for any external hardware, Synergy2 uses the TCP-IP
+      protocol to share the resources, even between machines with diferent
+      operating systems, such as Mac OS, Linux and Windows.
+
+      Remember to open port 24800 (used by synergys program) if you want to
+      host mouse and keyboard.";
+    homepage = https://code.google.com/p/quicksynergy/;
+    license = stdenv.lib.licenses.gpl2;
+    maintainers = [ stdenv.lib.maintainers.spinus ];
+  };
+}
--- a/pkgs/applications/misc/scim/default.nix
+++ b/pkgs/applications/misc/scim/default.nix
@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
  name = "scim-${version}";

  src = fetchurl {
-    url = "https://github.com/andmarti1424/scim/archive/v${version}.tar.gz";
+    url = "https://github.com/andmarti1424/sc-im/archive/v${version}.tar.gz";
    sha256 = "00rjz344acw0bxv78x1w9jz8snl9lb9qhr9z22phxinidnd3vaaz";
  };

--- a/pkgs/applications/misc/slic3r/fix-no-display.patch
+++ b/pkgs/applications/misc/slic3r/fix-no-display.patch
@ -1,59 +0,0 @@
-diff --git a/Build.PL b/Build.PL
-index 8b21c15..fd3aff0 100644
--- a/Build.PL
-+++ b/Build.PL
-@@ -33,9 +33,6 @@ my $sudo    = grep { $_ eq '--sudo' } @ARGV;
- my $gui     = grep { $_ eq '--gui' } @ARGV;
- my $xs_only = grep { $_ eq '--xs' }  @ARGV;
- if ($gui) {
-    %prereqs = qw(
-    Wx                              0.9918
-    );
-     %recommends = qw(
-     Growl::GNTP                     0.15
-     Wx::GLCanvas                    0
-diff --git a/lib/Slic3r/GUI.pm b/lib/Slic3r/GUI.pm
-index 842ff44..ea0af64 100644
--- a/lib/Slic3r/GUI.pm
-+++ b/lib/Slic3r/GUI.pm
-@@ -26,7 +26,7 @@ use Slic3r::GUI::OptionsGroup::Field;
- use Slic3r::GUI::SimpleTab;
- use Slic3r::GUI::Tab;
- 
-our $have_OpenGL = eval "use Slic3r::GUI::PreviewCanvas; 1";
-+our $have_OpenGL = 0;
- 
- use Wx 0.9901 qw(:bitmap :dialog :icon :id :misc :systemsettings :toplevelwindow
-     :filedialog);
-diff --git a/lib/Slic3r/GUI/Plater/2DToolpaths.pm b/lib/Slic3r/GUI/Plater/2DToolpaths.pm
-index 8e48a72..7bed973 100644
--- a/lib/Slic3r/GUI/Plater/2DToolpaths.pm
-+++ b/lib/Slic3r/GUI/Plater/2DToolpaths.pm
-@@ -90,18 +90,20 @@ sub set_z {
- package Slic3r::GUI::Plater::2DToolpaths::Canvas;
- 
- use Wx::Event qw(EVT_PAINT EVT_SIZE EVT_ERASE_BACKGROUND EVT_IDLE EVT_MOUSEWHEEL EVT_MOUSE_EVENTS);
-use OpenGL qw(:glconstants :glfunctions :glufunctions);
-use base qw(Wx::GLCanvas Class::Accessor);
-use Wx::GLCanvas qw(:all);
- use List::Util qw(min first);
- use Slic3r::Geometry qw(scale unscale epsilon);
- 
- __PACKAGE__->mk_accessors(qw(print z layers color init dirty bb));
- 
-# make OpenGL::Array thread-safe
-{
-    no warnings 'redefine';
-    *OpenGL::Array::CLONE_SKIP = sub { 1 };
-+if ($Slic3r::GUI::have_OpenGL) {
-+    use OpenGL qw(:glconstants :glfunctions :glufunctions);
-+    use Wx::GLCanvas qw(:all);
-+    use base qw(Wx::GLCanvas Class::Accessor);
-+    # make OpenGL::Array thread-safe
-+    {
-+        no warnings 'redefine';
-+        *OpenGL::Array::CLONE_SKIP = sub { 1 };
-+    }
- }
- 
- sub new {
--- a/pkgs/applications/misc/solaar/default.nix
+++ b/pkgs/applications/misc/solaar/default.nix
@ -0,0 +1,43 @@
+{fetchurl, stdenv, makeWrapper, gtk3, python3Packages}:
+let
+  version = "0.9.2";
+in
+stdenv.mkDerivation {
+  name = "solaar-${version}";
+  src = fetchurl {
+    sha256 = "0954grz2adggfzcj4df4mpr4d7qyl7w8rb4j2s0f9ymawl92i05j";
+    url = "https://github.com/pwr/Solaar/archive/${version}.tar.gz";
+  };
+
+  buildInputs = [gtk3 python3Packages.pygobject3 python3Packages.pyudev];
+  enableParallelBuilding = true;
+  installPhase = ''
+    mkdir -p "$out";
+  '';
+  postInstall = ''
+    wrapProgram "$out/bin/solaar" \
+      --prefix PYTHONPATH : "$PYTHONPATH" \
+      --prefix GI_TYPELIB_PATH : "$GI_TYPELIB_PATH"
+    wrapProgram "$out/bin/solaar-cli" \
+      --prefix PYTHONPATH : "$PYTHONPATH" \
+      --prefix GI_TYPELIB_PATH : "$GI_TYPELIB_PATH"
+  '';
+  meta = with stdenv.lib; {
+    description = "Linux devices manager for the Logitech Unifying Receiver";
+    longDescription = ''
+      Solaar is a Linux device manager for Logitech’s Unifying Receiver
+      peripherals. It is able to pair/unpair devices to the receiver, and for
+      most devices read battery status.
+
+      It comes in two flavors, command-line and GUI. Both are able to list the
+      devices paired to a Unifying Receiver, show detailed info for each
+      device, and also pair/unpair supported devices with the receiver.
+
+      To be able to use it, make sure you have access to /dev/hidraw* files.
+    '';
+    license = licenses.gpl2;
+    homepage = https://pwr.github.io/Solaar/;
+    platforms = platforms.linux;
+    maintainers = [maintainers.spinus];
+  };
+}
--- a/pkgs/applications/misc/termite/default.nix
+++ b/pkgs/applications/misc/termite/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchgit, pkgconfig, vte, gtk, ncurses }:
+{ stdenv, fetchgit, pkgconfig, vte, gtk3, ncurses }:

 stdenv.mkDerivation rec {
  name = "termite-${version}";
@ -10,11 +10,9 @@ stdenv.mkDerivation rec {
    sha256 = "107v59x8q2m1cx1x3i5ciibw4nl1qbq7p58bfw0irkhp7sl7kjk2";
  };

-  makeFlags = "VERSION=v${version}";
+  makeFlags = [ "VERSION=v${version}" "PREFIX=$(out)" ];

-  buildInputs = [pkgconfig vte gtk ncurses];
-
-  installFlags = "PREFIX=$(out)";
+  buildInputs = [ pkgconfig vte gtk3 ncurses ];

  meta = with stdenv.lib; {
    description = "A simple VTE-based terminal";
--- a/pkgs/applications/misc/yakuake/default.nix
+++ b/pkgs/applications/misc/yakuake/default.nix
@ -3,23 +3,21 @@

 let
  pname = "yakuake";
-  version = "2.9.8";
+  version = "2.9.9";
 in
 stdenv.mkDerivation {
  name = "${pname}-${version}";

  src = fetchurl {
-    url = "mirror://kde/stable/${pname}/${version}/src/${pname}-${version}.tar.bz2";
-    sha256 = "0a9x3nmala8nl4xl3h7rcd76f5j7b7r74jc5cfbayc6jgkjdynd3";
+    url = "mirror://kde/stable/${pname}/${version}/src/${pname}-${version}.tar.xz";
+    sha256 = "0e0e4994c568f8091c9424e4aab35645436a9ff341c00b1cd1eab0ada0bf61ce";
  };

  buildInputs = [ kdelibs ];

  nativeBuildInputs = [ automoc4 cmake gettext perl pkgconfig ];

-  patchPhase = ''
-    substituteInPlace app/terminal.cpp --replace \"konsolepart\" "\"${konsole}/lib/kde4/libkonsolepart.so\""
-  '';
+  propagatedUserEnvPkgs = [ konsole ];

  meta = {
    homepage = http://yakuake.kde.org;
--- a/pkgs/applications/networking/browsers/firefox-bin/default.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/default.nix
@ -60,7 +60,7 @@ let
 in

 stdenv.mkDerivation {
-  name = "firefox-bin-${version}";
+  name = "firefox-bin-unwrapped-${version}";

  src = fetchurl {
    url = "http://download-installer.cdn.mozilla.net/pub/firefox/releases/${version}/${source.arch}/${source.locale}/firefox-${version}.tar.bz2";
--- a/pkgs/applications/networking/browsers/mozilla-plugins/fribid/emulated-version.patch
+++ b/pkgs/applications/networking/browsers/mozilla-plugins/fribid/emulated-version.patch
@ -1,12 +0,0 @@
--- a/common/defines.h  2012-11-14 18:02:43.000000000 +0100
-+++ b/common/defines.h  2013-09-20 19:17:45.669290630 +0200
-@@ -39,7 +39,7 @@
- #define RELEASE_TIME        1352912534
- #define IPCVERSION          "10"
- 
-#define EMULATED_VERSION    "4.15.0.14"
-+#define EMULATED_VERSION    "4.17.0.11" // Was 4.15.0.14
- #define DNSVERSION          "2"
- #define STATUSDOMAIN        ".status.fribid.se"
- 
-
--- a/pkgs/applications/networking/browsers/mozilla-plugins/mplayerplug-in/icecat3-idldir.patch
+++ b/pkgs/applications/networking/browsers/mozilla-plugins/mplayerplug-in/icecat3-idldir.patch
@ -1,16 +0,0 @@
-We have to run `xpidl', but we need to provide it with the right IDL
-directory.  With GNU IceCat 3 (and possibly Firefox 3), this happens to be
-"$(pkg-config --variable=idldir libxul)/stable".
-
--- mplayerplug-in-3.55/Makefile.in	2008-01-03 01:20:33.000000000 +0100
-+++ mplayerplug-in-3.55/Makefile.in	2008-09-29 22:47:20.000000000 +0200
-@@ -46,7 +46,7 @@ datadir=@datadir@
- LOCALEDIR=$(datadir)/locale
- MOZILLA_HOME=@MOZILLA_HOME@
- GECKO_XPIDL=@GECKO_XPIDL@
-GECKO_IDLDIR=@GECKO_IDLDIR@
-+GECKO_IDLDIR=@GECKO_IDLDIR@/stable
- 
- PIXMAPS=pixmaps/logo.xpm pixmaps/progress_left.xpm pixmaps/progress_right.xpm \
- 	pixmaps/progress_fill.xpm pixmaps/progress_middle.xpm
-
--- a/pkgs/applications/networking/browsers/qutebrowser/default.nix
+++ b/pkgs/applications/networking/browsers/qutebrowser/default.nix
@ -2,7 +2,7 @@
 , jinja2, pygments, pyyaml, pypeg2, gst-plugins-base, gst-plugins-good
 , gst-plugins-bad, gst-libav, wrapGAppsHook, glib_networking }:

-let version = "0.5.0"; in
+let version = "0.5.1"; in

 buildPythonPackage rec {
  name = "qutebrowser-${version}";
@ -10,7 +10,7 @@ buildPythonPackage rec {

  src = fetchurl {
    url = "https://github.com/The-Compiler/qutebrowser/releases/download/v${version}/${name}.tar.gz";
-    sha256 = "16cyw0jg6qg9ksr6xwgnkm1a2bwgii2s35nrgk3g705ywfsf02j7";
+    sha256 = "1pxgap04rv94kgcp9a05xx2kwg3j6jv8f6d3ww7hqs2xnkj8wzqb";
  };

  # Needs tox
--- a/pkgs/applications/networking/instant-messengers/freetalk/01_callbacks_const_fix.diff
+++ b/pkgs/applications/networking/instant-messengers/freetalk/01_callbacks_const_fix.diff
@ -1,25 +0,0 @@
-Description: Patch to fix FTBFS due to a modified const in src/callbacks.cc
-Forwarded: yes
-Origin: Ubuntu,
-https://bugs.launchpad.net/ubuntu/+source/freetalk/+bug/443241
-Bug-Debian: http://bugs.debian.org/560535
-Author: Jon Bernard <bernardj@gmail.com>
--- 3.2-1.orig/src/callbacks.cc	2008-11-15 10:41:22.000000000 +0000
-+++ 3.2-1/src/callbacks.cc	2009-10-21 15:50:49.000000000 +0100
-@@ -116,13 +116,13 @@ ft_msg_msg_handler (LmMessageHandler *ha
- 		    LmMessage *msg, gpointer user_data)
- {
-   LmMessageNode *root, *body, *x;
-  const char *from, *msg_str, *type;
-  char *ts = NULL;
-+  const char *msg_str, *type;
-+  char *from, *ts = NULL;
- 
-   root = lm_message_get_node (msg);
-   body = lm_message_node_get_child (root, "body");
- 
-  from = lm_message_node_get_attribute (msg->node, "from");
-+  from = (char *) lm_message_node_get_attribute (msg->node, "from");
- 
-   /* since the file-transfer happens in-band with messages, we can no longer
-    * ignore messages with no 'body' */
--- a/pkgs/applications/networking/instant-messengers/fuze/default.nix
+++ b/pkgs/applications/networking/instant-messengers/fuze/default.nix
@ -1,53 +0,0 @@
-{ stdenv, fetchurl, dpkg, openssl, alsaLib, libXext, libXfixes, libXrandr
-, libjpeg, curl, libX11, libXmu, libXv, libXtst, qt4, mesa, zlib
-, gnome, libidn, rtmpdump, c-ares, openldap, makeWrapper
-}:
-assert stdenv.system == "x86_64-linux";
-let
-  curl_custom =
-    stdenv.lib.overrideDerivation curl (args: { 
-      configureFlags = args.configureFlags ++ ["--with-ca-bundle=/etc/ssl/certs/ca-certificates.crt"] ; 
-    } );
-in
-stdenv.mkDerivation {
-  name = "fuze-1.0.5";
-  src = fetchurl {
-    url = http://apt.fuzebox.com/apt/pool/lucid/main/f/fuzelinuxclient/fuzelinuxclient_1.0.5.lucid_amd64.deb;
-    sha256 = "0gvxc8qj526cigr1lif8vdn1aawj621camkc8kvps23r7zijhnqv";
-  };
-  buildInputs = [ dpkg makeWrapper ];
-  libPath =
-    stdenv.lib.makeLibraryPath [
-      openssl alsaLib libXext libXfixes libXrandr libjpeg curl_custom
-      libX11 libXmu libXv qt4 libXtst mesa stdenv.cc.cc zlib
-      gnome.GConf libidn rtmpdump c-ares openldap
-    ];
-  buildCommand = ''
-    dpkg-deb -x $src .
-    mkdir -p $out/lib $out/bin
-    cp -R usr/lib/fuzebox $out/lib
-
-    patchelf \
-      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-      --set-rpath $out/lib/fuzebox:$libPath \
-      $out/lib/fuzebox/FuzeLinuxApp
-
-    wrapProgram $out/lib/fuzebox/FuzeLinuxApp --prefix LD_LIBRARY_PATH : $libPath
-    for f in $out/lib/fuzebox/*.so.*; do
-      patchelf \
-        --set-rpath $out/lib/fuzebox:$libPath \
-        $f
-    done
-
-    ln -s ${openssl}/lib/libssl.so.1.0.0 $out/lib/fuzebox/libssl.so.0.9.8
-    ln -s ${openssl}/lib/libcrypto.so.1.0.0 $out/lib/fuzebox/libcrypto.so.0.9.8
-
-    ln -s $out/lib/fuzebox/FuzeLinuxApp $out/bin/fuze
-  '';
-
-  meta = {
-    description = "Internet and mobile based unified communications solutions (Linux client)";
-    homepage = http://www.fuzebox.com;
-    license = "unknown";
-  };
-}
--- a/pkgs/applications/networking/instant-messengers/ricochet/default.nix
+++ b/pkgs/applications/networking/instant-messengers/ricochet/default.nix
@ -0,0 +1,58 @@
+{ stdenv, fetchurl, pkgconfig, makeDesktopItem, unzip
+, qtbase, qttools, makeQtWrapper, qtmultimedia, qtquick1, qtquickcontrols
+, openssl, protobuf
+}:
+
+stdenv.mkDerivation rec {
+  name = "ricochet-${version}";
+  version = "1.1.1";
+
+  src = fetchurl {
+    url = "https://github.com/ricochet-im/ricochet/archive/v${version}.tar.gz";
+    sha256 = "0y79igzgl9xn00981zcyxdlks7vnqxhb4rq3x8gwxm0yr98p39ms";
+  };
+
+  desktopItem = makeDesktopItem {
+    name = "ricochet";
+    exec = "ricochet";
+    icon = "ricochet";
+    desktopName = "Ricochet";
+    genericName = "Ricochet";
+    comment = meta.description;
+    categories = "Office;Email;";
+  };
+
+  buildInputs = [
+    qtbase qttools qtmultimedia qtquick1 qtquickcontrols
+    openssl protobuf
+  ];
+
+  nativeBuildInputs = [ pkgconfig makeQtWrapper ];
+
+  preConfigure = ''
+    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE $(pkg-config --cflags openssl)"
+  '';
+
+  configureScript = "qmake";
+  dontAddPrefix = true;
+  configureFlags = [ "PREFIX=$(out)" "DEFINES+=RICOCHET_NO_PORTABLE" ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp ricochet $out/bin
+    wrapQtProgram $out/bin/ricochet
+
+    mkdir -p $out/share/applications
+    cp $desktopItem/share/applications"/"* $out/share/applications
+
+    mkdir -p $out/share/pixmaps
+    cp icons/ricochet.png $out/share/pixmaps/ricochet.png
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Anonymous peer-to-peer instant messaging";
+    homepage = "https://ricochet.im";
+    license = licenses.bsd3;
+    maintainers = [ maintainers.codsl maintainers.jgillich ];
+  };
+}
--- a/pkgs/applications/networking/instant-messengers/silc-client/server_setup.patch
+++ b/pkgs/applications/networking/instant-messengers/silc-client/server_setup.patch
@ -1,28 +0,0 @@
-Add function to replace the behaviour of server_setup_find_port which was removed from irssi on revision 5125. Fixes bug #577501.
--- a/apps/irssi/src/silc/core/client_ops.c
-+++ b/apps/irssi/src/silc/core/client_ops.c
-@@ -2790,6 +2790,15 @@
-   silc_free(a);
- }
- 
-+/* helper function to emulate server_setup_find_port */
-+static SERVER_SETUP_REC *silc_server_setup_find_port(const char *address,
-+						     int port) {
-+  SERVER_SETUP_REC *rec;
-+
-+  rec = server_setup_find(address, port, NULL);
-+  return (rec == NULL || rec->port != port) ? NULL : rec;
-+}
-+
- /* Find authentication data by hostname and port. The hostname may be IP
-    address as well.*/
- 
-@@ -2811,7 +2820,7 @@
- 
-   /* Check whether we find the password for this server in our
-      configuration.  If it's set, always send it server. */
-  setup = server_setup_find_port(hostname, port);
-+  setup = silc_server_setup_find_port(hostname, port);
-   if (setup && setup->password) {
-     completion(SILC_AUTH_PASSWORD, setup->password, strlen(setup->password),
- 	       context);
--- a/pkgs/applications/networking/irc/konversation/1.6.nix
+++ b/pkgs/applications/networking/irc/konversation/1.6.nix
@ -0,0 +1,84 @@
+{ stdenv
+, lib
+, fetchurl
+, cmake
+, extra-cmake-modules
+, kbookmarks
+, karchive
+, kconfig
+, kconfigwidgets
+, kcoreaddons
+, kdbusaddons
+, kdoctools
+, kemoticons
+, kglobalaccel
+, ki18n
+, kiconthemes
+, kidletime
+, kitemviews
+, knotifications
+, knotifyconfig
+, kio
+, kparts
+, kwallet
+, makeQtWrapper
+, solid
+, sonnet
+, phonon}:
+
+let
+  pn = "konversation";
+  v = "1.6";
+in
+
+stdenv.mkDerivation rec {
+  name = "${pn}-${v}";
+
+  src = fetchurl {
+    url = "mirror://kde/stable/${pn}/${v}/src/${name}.tar.xz";
+    sha256 = "789fd75644bf54606778971310433dbe2bc01ac0917b34bc4e8cac88e204d5b6";
+  };
+
+  buildInputs = [
+    cmake
+    extra-cmake-modules
+    kbookmarks
+    karchive
+    kconfig
+    kconfigwidgets
+    kcoreaddons
+    kdbusaddons
+    kdoctools
+    kemoticons
+    kglobalaccel
+    ki18n
+    kiconthemes
+    kidletime
+    kitemviews
+    knotifications
+    knotifyconfig
+    kio
+    kparts
+    kwallet
+    solid
+    sonnet
+    phonon
+  ];
+
+  nativeBuildInputs = [
+    extra-cmake-modules
+    kdoctools
+    makeQtWrapper
+  ];
+
+  postInstall = ''
+    wrapQtProgram "$out/bin/konversation"
+  '';
+
+  meta = {
+    description = "Integrated IRC client for KDE";
+    license = with lib.licenses; [ gpl2 ];
+    maintainers = with lib.maintainers; [ fridh ];
+    homepage = https://konversation.kde.org;
+  };
+}
--- a/pkgs/applications/networking/irc/weechat/default.nix
+++ b/pkgs/applications/networking/irc/weechat/default.nix
@ -4,12 +4,12 @@
 , extraBuildInputs ? [] }:

 stdenv.mkDerivation rec {
-  version = "1.3";
+  version = "1.4";
  name = "weechat-${version}";

  src = fetchurl {
    url = "http://weechat.org/files/src/weechat-${version}.tar.bz2";
-    sha256 = "0j2ic1c69ksf78wi0cmc4yi5348x6c92g6annsx928sayxqxfgbh";
+    sha256 = "1m6xq6izcac5186xvvmm8znfjzrg9hq42p69jabdvv7cri4rjvg0";
  };

  cmakeFlags = stdenv.lib.optional stdenv.isDarwin
--- a/pkgs/applications/networking/p2p/qbittorrent/default.nix
+++ b/pkgs/applications/networking/p2p/qbittorrent/default.nix
@ -10,11 +10,11 @@ assert guiSupport -> (dbus_libs != null);
 with stdenv.lib;
 stdenv.mkDerivation rec {
  name = "qbittorrent-${version}";
-  version = "3.3.1";
+  version = "3.3.3";

  src = fetchurl {
    url = "mirror://sourceforge/qbittorrent/${name}.tar.xz";
-    sha256 = "1li9law732n4vc7sn6i92pwxn8li7ypqaxcmfpm17kk978immlfs";
+    sha256 = "0lyv230vqwb77isjqm6fwwgv8hdap88zir9yrccj0qxj7zf8p3cw";
  };

  nativeBuildInputs = [ pkgconfig which ];
--- a/pkgs/applications/networking/p2p/qbittorrent/fix-lrelease.patch
+++ b/pkgs/applications/networking/p2p/qbittorrent/fix-lrelease.patch
@ -1,12 +1,17 @@
 diff --git a/qm_gen.pri b/qm_gen.pri
-index ed29b76..2d5990c 100644
+index 5454440..2d5990c 100644
 --- a/qm_gen.pri
 +++ b/qm_gen.pri
-@@ -5,7 +5,7 @@ isEmpty(QMAKE_LRELEASE) {
+@@ -5,12 +5,7 @@ isEmpty(QMAKE_LRELEASE) {
     win32|os2:QMAKE_LRELEASE = $$[QT_INSTALL_BINS]\\lrelease.exe
     else:QMAKE_LRELEASE = $$[QT_INSTALL_BINS]/lrelease
     unix {
+-      equals(QT_MAJOR_VERSION, 4) {
 -        !exists($$QMAKE_LRELEASE) { QMAKE_LRELEASE = lrelease-qt4 }
+-      } 
+-      equals(QT_MAJOR_VERSION, 5) {
+-        !exists($$QMAKE_LRELEASE) { QMAKE_LRELEASE = lrelease-qt5 }
+-      }
 +        !exists($$QMAKE_LRELEASE) { QMAKE_LRELEASE = lrelease }
     } else {
         !exists($$QMAKE_LRELEASE) { QMAKE_LRELEASE = lrelease }
--- a/pkgs/applications/networking/sync/lsyncd/configure-a2x-fix.patch
+++ b/pkgs/applications/networking/sync/lsyncd/configure-a2x-fix.patch
@ -1,18 +0,0 @@
-diff -aur lsyncd-release-2.1.5.orig/configure.ac lsyncd-release-2.1.5/configure.ac
--- lsyncd-release-2.1.5.orig/configure.ac	2013-06-07 18:24:02.000000000 +0600
-+++ lsyncd-release-2.1.5/configure.ac	2014-03-04 13:24:15.390350812 +0600
-@@ -15,10 +15,10 @@
- AC_PROG_INSTALL
- AC_PROG_MAKE_SET
- 
-#AC_PATH_PROG([A2X], [a2x], [no])
-#if test x${A2X} = xno ; then
-#	AC_MSG_ERROR([Program 'a2x' (package asciidoc) is required])
-#fi
-+AC_PATH_PROG([A2X], [a2x], [no])
-+if test x${A2X} = xno ; then
-+	AC_MSG_ERROR([Program 'a2x' (package asciidoc) is required])
-+fi
- 
- ###
- # Checks for Lua
--- a/pkgs/applications/office/ib/controller/default.nix
+++ b/pkgs/applications/office/ib/controller/default.nix
@ -0,0 +1,162 @@
+{ stdenv, fetchurl, unzip, jdk, ib-tws, xpra }:
+
+stdenv.mkDerivation rec {
+  version = "2.14.0";
+  name = "ib-controller-${version}";
+
+  src = fetchurl {
+    url = "https://github.com/ib-controller/ib-controller/archive/${version}.tar.gz";
+    sha256 = "17a8bcgg9z3b4y38k035hm2lgvhmf8srlz59c7n2q3fdw2i95i68";
+  };
+
+  phases = [ "unpackPhase" "installPhase" ];
+
+  buildInputs = [ unzip jdk ib-tws ];
+
+  installPhase = ''
+    mkdir -p $out $out/bin $out/etc/ib/controller $out/share/IBController
+    cp resources/*.jar $out/share/IBController/.
+    cp resources/*.ini $out/etc/ib/controller/.
+    classpath=""
+    for jar in ${ib-tws}/share/IBJts/*.jar; do
+      classpath="$classpath:$jar"
+    done
+    for jar in $out/share/IBController/*.jar; do
+      classpath="$classpath:$jar"
+    done
+    # strings to use below; separated to avoid nix specific substitutions
+    javaOptions={JAVA_OPTIONS:--Xmx1024M}
+    ibProfileDir={IB_PROFILE_DIR:-~/IB/}
+    cat<<EOF > $out/bin/ib-tws-c
+    #!$SHELL
+    if [[ \$1 == /* ]] || [[ \$1 == ./* ]]; then
+      IB_USER_PROFILE=\`realpath \$1\`
+      IB_USER_PROFILE_TITLE=\`basename \$1\`
+    else
+      if [[ x\$1 != "x" ]] && [[ \$1 != -* ]]; then
+        IB_USER_PROFILE=\`realpath \$$ibProfileDir\$1\`
+        IB_USER_PROFILE_TITLE=\$1
+      else
+        echo "ERROR: \"\$1\" is not a valid name of a profile."
+        exit 1
+      fi
+    fi
+    shift
+    if [ ! -e \$IB_USER_PROFILE ]; then mkdir -p \$IB_USER_PROFILE; fi
+    if [ ! -d \$IB_USER_PROFILE ]; then echo "ERROR: \$IB_USER_PROFILE must be a directory!" && echo 1; fi
+    if [ ! -e \$IB_USER_PROFILE/jts.ini ]; then cp ${ib-tws}/etc/ib/tws/jts.ini \$IB_USER_PROFILE/. && chmod +w \$IB_USER_PROFILE/jts.ini; fi
+    if [ ! -e \$IB_USER_PROFILE/IBController.ini ]; then cp $out/etc/ib/controller/IBController.ini \$IB_USER_PROFILE/. && chmod +w \$IB_USER_PROFILE/IBController.ini; fi
+    if [[ \$1 == "-q" ]]; then
+      if [ -f \$IB_USER_PROFILE/xpra/run ]; then
+        ${xpra}/bin/xpra stop \`cat \$IB_USER_PROFILE/xpra/run\` --socket-dir=\$IB_USER_PROFILE/xpra/ &> /dev/null
+      fi
+      exit 0
+    fi
+    if [[ \$1 == "-d" ]] && [ ! -f \$IB_USER_PROFILE/xpra/run ]; then
+      ( sleep infinity ) &
+      WAIT_DUMMY_PID=\$!
+      ( trap "" INT;
+        DISPLAYNUM=100
+        while [ -f /tmp/.X\$DISPLAYNUM-lock ]; do DISPLAYNUM=\$((\$DISPLAYNUM + 1)); done
+        mkdir -p \$IB_USER_PROFILE/xpra
+        cd \$IB_USER_PROFILE
+        nohup ${xpra}/bin/xpra start :\$DISPLAYNUM \
+          --socket-dir=\$IB_USER_PROFILE/xpra/ \
+          --start-child="echo -n :\$DISPLAYNUM > \$IB_USER_PROFILE/xpra/run \
+                         && kill \$WAIT_DUMMY_PID &> /dev/null \
+                         && ${jdk}/bin/java -cp $classpath \$$javaOptions ibcontroller.IBController \$IB_USER_PROFILE/IBController.ini" \
+          --exit-with-children \
+          --no-pulseaudio \
+          --no-mdns \
+          --no-notification \
+          --no-daemon \
+          &> \$IB_USER_PROFILE/xpra/server.log
+        rm -f \$IB_USER_PROFILE/xpra/run
+        rm -f /tmp/.X\$DISPLAYNUM-lock
+      ) &
+      wait \$WAIT_DUMMY_PID
+      exit 0
+    fi
+    if [ -f \$IB_USER_PROFILE/xpra/run ]; then
+      ${xpra}/bin/xpra attach \`cat \$IB_USER_PROFILE/xpra/run\` --socket-dir=\$IB_USER_PROFILE/xpra/ \
+      --windows \
+      --no-speaker \
+      --no-microphone \
+      --no-tray \
+      --title="\$IB_USER_PROFILE_TITLE: @title@" \
+      &> \$IB_USER_PROFILE/xpra/client.log
+    fi
+    EOF
+    chmod u+x $out/bin/ib-tws-c
+    cat<<EOF > $out/bin/ib-gw-c
+    #!$SHELL
+    if [[ \$1 == /* ]] || [[ \$1 == ./* ]]; then
+      IB_USER_PROFILE=\`realpath \$1\`
+      IB_USER_PROFILE_TITLE=\`basename \$1\`
+    else
+      if [[ x\$1 != "x" ]] && [[ \$1 != -* ]]; then
+        IB_USER_PROFILE=\`realpath \$$ibProfileDir\$1\`
+        IB_USER_PROFILE_TITLE=\$1
+      else
+        echo "ERROR: \"\$1\" is not a valid name of a profile."
+        exit 1
+      fi
+    fi
+    shift
+    if [ ! -e \$IB_USER_PROFILE ]; then mkdir -p \$IB_USER_PROFILE; fi
+    if [ ! -d \$IB_USER_PROFILE ]; then echo "ERROR: \$IB_USER_PROFILE must be a directory!" && echo 1; fi
+    if [ ! -e \$IB_USER_PROFILE/jts.ini ]; then cp ${ib-tws}/etc/ib/tws/jts.ini \$IB_USER_PROFILE/. && chmod +w \$IB_USER_PROFILE/jts.ini; fi
+    if [ ! -e \$IB_USER_PROFILE/IBController.ini ]; then cp $out/etc/ib/controller/IBController.ini \$IB_USER_PROFILE/. && chmod +w \$IB_USER_PROFILE/IBController.ini; fi
+    if [[ \$1 == "-q" ]]; then
+      if [ -f \$IB_USER_PROFILE/xpra/run ]; then
+        ${xpra}/bin/xpra stop \`cat \$IB_USER_PROFILE/xpra/run\` --socket-dir=\$IB_USER_PROFILE/xpra/ &> /dev/null
+      fi
+      exit 0
+    fi
+    if [[ \$1 == "-d" ]] && [ ! -f \$IB_USER_PROFILE/xpra/run ]; then
+      ( sleep infinity ) &
+      WAIT_DUMMY_PID=\$!
+      ( trap "" INT;
+        DISPLAYNUM=100
+        while [ -f /tmp/.X\$DISPLAYNUM-lock ]; do DISPLAYNUM=\$((\$DISPLAYNUM + 1)); done
+        mkdir -p \$IB_USER_PROFILE/xpra
+        cd \$IB_USER_PROFILE
+        nohup ${xpra}/bin/xpra start :\$DISPLAYNUM \
+          --socket-dir=\$IB_USER_PROFILE/xpra/ \
+          --start-child="echo -n :\$DISPLAYNUM > \$IB_USER_PROFILE/xpra/run \
+                         && kill \$WAIT_DUMMY_PID &> /dev/null \
+                         && ${jdk}/bin/java -cp $classpath \$$javaOptions ibcontroller.IBGatewayController \$IB_USER_PROFILE/IBController.ini" \
+          --exit-with-children \
+          --no-pulseaudio \
+          --no-mdns \
+          --no-notification \
+          --no-daemon \
+          &> \$IB_USER_PROFILE/xpra/server.log
+        rm -f \$IB_USER_PROFILE/xpra/run
+        rm -f /tmp/.X\$DISPLAYNUM-lock
+      ) &
+      wait \$WAIT_DUMMY_PID
+      exit 0
+    fi
+    if [ -f \$IB_USER_PROFILE/xpra/run ]; then
+      ${xpra}/bin/xpra attach \`cat \$IB_USER_PROFILE/xpra/run\` --socket-dir=\$IB_USER_PROFILE/xpra/ \
+      --windows \
+      --no-speaker \
+      --no-microphone \
+      --no-tray \
+      --title="\$IB_USER_PROFILE_TITLE: @title@" \
+      &> \$IB_USER_PROFILE/xpra/client.log
+    fi
+    EOF
+    chmod u+x $out/bin/ib-gw-c
+    '';
+
+
+  meta = with stdenv.lib; {
+    description = "Automation Controller for the Trader Work Station of Interactive Brokers";
+    homepage = https://github.com/ib-controller/ib-controller;
+    license = licenses.gpl3;
+    maintainers = [ maintainers.tstrobel ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/office/ib/tws/default.nix
+++ b/pkgs/applications/office/ib/tws/default.nix
@ -0,0 +1,96 @@
+{ stdenv, requireFile, jdk }:
+
+stdenv.mkDerivation rec {
+  version = "9542";
+  name = "ib-tws-${version}";
+
+  src = requireFile rec {
+    name = "ibtws_${version}.jar";
+    message = ''
+      This nix expression requires that ${name} is already part of the store.
+      Download the TWS from
+      https://download2.interactivebrokers.com/download/unixmacosx_latest.jar,
+      rename the file to ${name}, and add it to the nix store with
+      "nix-prefetch-url file://${name}".
+    '';
+    sha256 = "1a2jiwwnr5g3xfba1a89c257bdbnq4zglri8hz021vk7f6s4rlrf";
+  };
+
+  phases = [ "unpackPhase" "buildPhase" "installPhase" ];
+
+  buildInputs = [ jdk ];
+
+  buildPhase = ''
+    jar -xf IBJts/jts.jar
+    cp trader/common/images/ibapp_icon.gif ibtws_icon.gif
+    '';
+
+  unpackPhase = ''
+    jar xf ${src}
+    '';
+
+  installPhase = ''
+    mkdir -p $out $out/bin $out/etc/ib/tws $out/share/IBJts $out/share/icons
+    cp IBJts/*.jar $out/share/IBJts/.
+    cp IBJts/*.ini $out/etc/ib/tws/.
+    cp ibtws_icon.gif $out/share/icons/.
+    classpath=""
+    for jar in $out/share/IBJts/*.jar; do
+      classpath="$classpath:$jar"
+    done
+    # strings to use below; separated to avoid nix specific substitutions
+    javaOptions={JAVA_OPTIONS:-'-Xmx1024M -Dawt.useSystemAAFontSettings=lcd -Dsun.java2d.xrender=True -Dsun.java2d.opengl=False'}
+    # OTHER JAVA_OPTIONS: -Dawt.useSystemAAFontSettings=on -Dswing.aatext=true -Dswing.defaultlaf=com.sun.java
+    ibProfileDir={IB_PROFILE_DIR:-~/IB/}
+    cat<<EOF > $out/bin/ib-tws
+    #!$SHELL
+    if [[ \$1 == /* ]] || [[ \$1 == ./* ]]; then
+      IB_USER_PROFILE=\`realpath \$1\`
+      IB_USER_PROFILE_TITLE=\`basename \$1\`
+    else
+      if [[ x\$1 != "x" ]] && [[ \$1 != -* ]]; then
+        IB_USER_PROFILE=\`realpath \$$ibProfileDir\$1\`
+        IB_USER_PROFILE_TITLE=\$1
+      else
+        echo "ERROR: \"\$1\" is not a valid name of a profile."
+        exit 1
+      fi
+    fi
+    shift
+    if [ ! -e \$IB_USER_PROFILE ]; then mkdir -p \$IB_USER_PROFILE; fi
+    if [ ! -d \$IB_USER_PROFILE ]; then echo "ERROR: \$IB_USER_PROFILE must be a directory!" && echo 1; fi
+    if [ ! -e \$IB_USER_PROFILE/jts.ini ]; then cp $out/etc/ib/tws/jts.ini \$IB_USER_PROFILE/. && chmod +w \$IB_USER_PROFILE/jts.ini; fi
+    ${jdk}/bin/java -cp $classpath \$$javaOptions jclient.LoginFrame \$IB_USER_PROFILE
+    EOF
+    chmod u+x $out/bin/ib-tws
+    cat<<EOF > $out/bin/ib-gw
+    #!$SHELL
+    if [[ \$1 == /* ]] || [[ \$1 == ./* ]]; then
+      IB_USER_PROFILE=\`realpath \$1\`
+      IB_USER_PROFILE_TITLE=\`basename \$1\`
+    else
+      if [[ x\$1 != "x" ]] && [[ \$1 != -* ]]; then
+        IB_USER_PROFILE=\`realpath \$$ibProfileDir\$1\`
+        IB_USER_PROFILE_TITLE=\$1
+      else
+        echo "ERROR: \"\$1\" is not a valid name of a profile."
+        exit 1
+      fi
+    fi
+    shift
+    if [ ! -e \$IB_USER_PROFILE ]; then mkdir -p \$IB_USER_PROFILE; fi
+    if [ ! -d \$IB_USER_PROFILE ]; then echo "ERROR: \$IB_USER_PROFILE must be a directory!" && echo 1; fi
+    if [ ! -e \$IB_USER_PROFILE/jts.ini ]; then cp $out/etc/ib/tws/jts.ini \$IB_USER_PROFILE/. && chmod +w \$IB_USER_PROFILE/jts.ini; fi
+    ${jdk}/bin/java -cp $classpath -Dsun.java2d.noddraw=true \$$javaOptions ibgateway.GWClient \$IB_USER_PROFILE
+    EOF
+    chmod u+x $out/bin/ib-gw
+    '';
+
+  meta = with stdenv.lib; {
+    description = "Trader Work Station of Interactive Brokers";
+    homepage = https://www.interactivebrokers.com;
+    license = licenses.unfree;
+    maintainers = [ maintainers.tstrobel ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/office/libreoffice/generate-libreoffice-srcs.sh
+++ b/pkgs/applications/office/libreoffice/generate-libreoffice-srcs.sh
@ -1,7 +1,11 @@
 #!/run/current-system/sw/bin/bash

+# Ideally we would move as much as possible into derivation dependencies
+
 # Take the list of files from the main package, ooo.lst.in

+# This script wants an argument: download list file
+
 cat <<EOF
 [
 EOF
@ -11,11 +15,18 @@ write_entry(){
  echo "  name = \"${name}\";"
  echo "  md5 = \"${md5}\";"
  echo "  brief = ${brief};"
+  eval "echo -n \"\$additions_${name%%[-_.]*}\""
+  eval "test -n \"\$additions_${name%%[-_.]*}\" && echo"
  echo '}'
 }

+cat "$(dirname "$0")/libreoffice-srcs-additions.sh" "$@" |
 while read line; do
  case "$line" in
+    EVAL\ *)
+      echo "${line#* }" >&2;
+      eval "${line#* }";
+      ;;
    \#*)
      echo Skipping comment: "$line" >&2;
      ;;
@ -42,6 +53,7 @@ while read line; do
      line="${line#,}"
      md5=${line:0:32};
      name=${line:33};
+      name="${name%)}"
      brief=false;
      write_entry;
      ;;
--- a/pkgs/applications/office/libreoffice/libreoffice-srcs-additions.sh
+++ b/pkgs/applications/office/libreoffice/libreoffice-srcs-additions.sh
@ -0,0 +1 @@
+EVAL additions_libgltf='  subDir = "libgltf/";'
--- a/pkgs/applications/office/libreoffice/libreoffice-srcs.nix
+++ b/pkgs/applications/office/libreoffice/libreoffice-srcs.nix
@ -323,6 +323,7 @@
  name = "libgltf-0.0.2.tar.bz2";
  md5 = "d63a9f47ab048f5009d90693d6aa6424";
  brief = true;
+  subDir = "libgltf/";
 }
 {
  name = "liblangtag-0.5.1.tar.bz2";
--- a/pkgs/applications/science/electronics/qucs/tr1-complex.patch
+++ b/pkgs/applications/science/electronics/qucs/tr1-complex.patch
@ -1,10 +0,0 @@
--- qucs-core/configure.orig	2011-07-03 07:34:09.069218113 -0500
-+++ qucs-core/configure	2011-07-03 07:34:46.618990497 -0500
-@@ -5884,7 +5884,6 @@
- 
-  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
- /* end confdefs.h.  */
-#include <tr1/complex>
- using namespace std;
- using namespace std::tr1;
- int
--- a/pkgs/applications/science/logic/isabelle/settings.patch
+++ b/pkgs/applications/science/logic/isabelle/settings.patch
@ -1,33 +0,0 @@
-diff -Nuar Isabelle2011/etc/settings Isabelle2011-fix/etc/settings
--- Isabelle2011/etc/settings	2011-01-30 13:02:18.000000000 +0100
-+++ Isabelle2011-fix/etc/settings	2011-05-14 22:56:04.000000000 +0200
-@@ -17,13 +17,7 @@
- 
- # Poly/ML 5.x (automated settings)
- ML_PLATFORM="$ISABELLE_PLATFORM"
-ML_HOME="$(choosefrom \
-  "$ISABELLE_HOME/contrib/polyml/$ML_PLATFORM" \
-  "$ISABELLE_HOME/../polyml/$ML_PLATFORM" \
-  "/usr/local/polyml/$ML_PLATFORM" \
-  "/usr/share/polyml/$ML_PLATFORM" \
-  "/opt/polyml/$ML_PLATFORM" \
-  "")"
-+ML_HOME=@ML_HOME@
- ML_SYSTEM=$("$ISABELLE_HOME/lib/scripts/polyml-version")
- ML_OPTIONS="-H 200"
- ML_SOURCES="$ML_HOME/../src"
-@@ -175,13 +169,7 @@
- ###
- 
- # Proof General home, look in a variety of places
-PROOFGENERAL_HOME="$(choosefrom \
-  "$ISABELLE_HOME/contrib/ProofGeneral" \
-  "$ISABELLE_HOME/../ProofGeneral" \
-  "/usr/local/ProofGeneral" \
-  "/usr/share/ProofGeneral" \
-  "/opt/ProofGeneral" \
-  "")"
-+PROOFGENERAL_HOME=@PROOFGENERAL_HOME@
- 
- PROOFGENERAL_OPTIONS=""
- #PROOFGENERAL_OPTIONS="-m no_brackets -m no_type_brackets"
--- a/pkgs/applications/science/logic/metis-prover/default.nix
+++ b/pkgs/applications/science/logic/metis-prover/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name = "metis-prover-${version}";
-  version = "2.3.20160101";
+  version = "2.3.20160102";

  src = fetchurl {
    url = "http://www.gilith.com/software/metis/metis.tar.gz";
-    sha256 = "0wkh506ggwmfacwl19n84n1xi6ak4xhrc96d9pdkpk8zdwh5w58l";
+    sha256 = "13csr90i9lsxdyzxqiwgi98pa7phfl28drjcv4qdjhzi71wcdc66";
  };

  nativeBuildInputs = [ perl ];
--- a/pkgs/applications/science/logic/z3/default.nix
+++ b/pkgs/applications/science/logic/z3/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  name = "z3-${version}";
-  version = "4.4.0";
+  version = "4.4.1";

  src = fetchFromGitHub {
    owner  = "Z3Prover";
    repo   = "z3";
-    rev    = "7f6ef0b6c0813f2e9e8f993d45722c0e5b99e152";
-    sha256 = "1xllvq9fcj4cz34biq2a9dn2sj33bdgrzyzkj26hqw70wkzv1kzx";
+    rev    = "z3-${version}";
+    sha256 = "1ix100r1h00iph1bk5qx5963gpqaxmmx42r2vb5zglynchjif07c";
  };

  buildInputs = [ python ];
--- a/pkgs/applications/virtualization/rkt/default.nix
+++ b/pkgs/applications/virtualization/rkt/default.nix
@ -1,15 +1,15 @@
-{ stdenv, lib, autoconf, automake, go, file, git, wget, gnupg1, squashfsTools, cpio
-, fetchurl, fetchFromGitHub }:
+{ stdenv, lib, autoreconfHook, acl, go, file, git, wget, gnupg1, squashfsTools,
+  cpio, fetchurl, fetchFromGitHub, iptables, systemd, makeWrapper }:

 let
  coreosImageRelease = "794.1.0";
  coreosImageSystemdVersion = "222";

  # TODO: track https://github.com/coreos/rkt/issues/1758 to allow "host" flavor.
-  stage1Flavours = [ "coreos" "fly" ];
+  stage1Flavours = [ "coreos" "fly" "host" ];

 in stdenv.mkDerivation rec {
-  version = "0.14.0";
+  version = "0.15.0";
  name = "rkt-${version}";
  BUILDDIR="build-${name}";

@ -17,7 +17,7 @@ in stdenv.mkDerivation rec {
      rev = "v${version}";
      owner = "coreos";
      repo = "rkt";
-      sha256 = "0dmgs9s40xhan2rh9f5n0k5gv8p2dn946zffq02sq35qqvi67s71";
+      sha256 = "1pw14r38p8sdkma37xx0yy3zx5yxqc12zj35anmlbmrgw4vdgavf";
  };

  stage1BaseImage = fetchurl {
@ -25,7 +25,10 @@ in stdenv.mkDerivation rec {
    sha256 = "05nzl3av6cawr8v203a8c95c443g6h1nfy2n4jmgvn0j4iyy44ym";
  };

-  buildInputs = [ autoconf automake go file git wget gnupg1 squashfsTools cpio ];
+  buildInputs = [
+    autoreconfHook go file git wget gnupg1 squashfsTools cpio acl systemd
+    makeWrapper
+  ];

  preConfigure = ''
    ./autogen.sh
@ -45,6 +48,9 @@ in stdenv.mkDerivation rec {
  installPhase = ''
    mkdir -p $out/bin
    cp -Rv $BUILDDIR/bin/* $out/bin
+    wrapProgram $out/bin/rkt \
+      --prefix LD_LIBRARY_PATH : ${systemd}/lib \
+      --prefix PATH : ${iptables}/bin
  '';

  meta = with lib; {
--- a/pkgs/applications/virtualization/virtualbox/default.nix
+++ b/pkgs/applications/virtualization/virtualbox/default.nix
@ -18,7 +18,7 @@ let
  # revision/hash as well. See
  # http://download.virtualbox.org/virtualbox/${version}/SHA256SUMS
  # for hashes.
-  version = "5.0.10";
+  version = "5.0.12";

  forEachModule = action: ''
    for mod in \
@ -39,12 +39,12 @@ let
  '';

  # See https://github.com/NixOS/nixpkgs/issues/672 for details
-  extpackRevision = "104061";
+  extpackRevision = "104815";
  extensionPack = requireFile rec {
    name = "Oracle_VM_VirtualBox_Extension_Pack-${version}-${extpackRevision}.vbox-extpack";
    # IMPORTANT: Hash must be base16 encoded because it's used as an input to
    # VBoxExtPackHelperApp!
-    sha256 = "c846fa26fec8587e57180c85c408cad377c48ad26830b0dc839ebf9025e3d29c";
+    sha256 = "ac1bc8452b7fdf183325272149e9f18b9810cc07adf18e48755385a9cd1b236d";
    message = ''
      In order to use the extension pack, you need to comply with the VirtualBox Personal Use
      and Evaluation License (PUEL) by downloading the related binaries from:
@ -63,7 +63,7 @@ in stdenv.mkDerivation {

  src = fetchurl {
    url = "http://download.virtualbox.org/virtualbox/${version}/VirtualBox-${version}.tar.bz2";
-    sha256 = "56eafae439b91ea3c3748f2128b2969ba76983acf821acaa08e043c129b45a89";
+    sha256 = "de0362b1d404d1ca0298db1984acb6f0f1c6210313aeb744fea345ad9201e86e";
  };

  buildInputs =
--- a/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix
+++ b/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix
@ -12,7 +12,7 @@ stdenv.mkDerivation {

  src = fetchurl {
    url = "http://download.virtualbox.org/virtualbox/${version}/VBoxGuestAdditions_${version}.iso";
-    sha256 = "8f7ffee3fac75793e48d1859b65a95879b3ed5bc1c3164c967e85d69244c594b";
+    sha256 = "61a19c9ec4b449cbc6bb41b636b03a16bf5a47ffa4943423d262863017e8bc9b";
  };

  KERN_DIR = "${kernel.dev}/lib/modules/*/build";
--- a/pkgs/applications/virtualization/xen/generic.nix
+++ b/pkgs/applications/virtualization/xen/generic.nix
@ -5,7 +5,7 @@
 , flex, cmake, ocaml, ocamlPackages, figlet, libaio, yajl
 , checkpolicy, transfig, glusterfs, acl, fetchgit, xz, spice
 , spice_protocol, usbredir, alsaLib, quilt
-, coreutils, gawk, gnused, gnugrep, diffutils, multipath_tools
+, coreutils, gawk, gnused, gnugrep, diffutils, multipath-tools
 , inetutils, iptables, openvswitch, nbd, drbd, xenConfig
 , xenserverPatched ? false, ... }:

@ -51,7 +51,7 @@ let
    ];

  scriptEnvPath = stdenv.lib.concatStrings (stdenv.lib.intersperse ":" (map (x: "${x}/bin")
-    [ coreutils gawk gnused gnugrep which perl diffutils utillinux multipath_tools
+    [ coreutils gawk gnused gnugrep which perl diffutils utillinux multipath-tools
      iproute inetutils iptables bridge-utils openvswitch nbd drbd ]));
 in

--- a/pkgs/applications/window-managers/awesome/default.nix
+++ b/pkgs/applications/window-managers/awesome/default.nix
@ -7,7 +7,7 @@
 }:

 let
-  version = "3.5.6";
+  version = "3.5.7";
 in with luaPackages;

 stdenv.mkDerivation rec {
@ -15,7 +15,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url    = "http://awesome.naquadah.org/download/awesome-${version}.tar.xz";
-    sha256 = "1ms6a3l1i2jdhzrd1zr25cqckznmb44qgz4n635jam42hzhrvx1p";
+    sha256 = "ba7f92b0ab8b729c569b19b098b0a08339d8654e3c040d07ad02cf99641ceecf";
  };

  meta = with stdenv.lib; {
--- a/pkgs/build-support/build-fhs-userenv/default.nix
+++ b/pkgs/build-support/build-fhs-userenv/default.nix
@ -12,6 +12,8 @@ let
  '';

  init = run: writeText "${name}-init" ''
+    source /etc/profile
+
    # Make /tmp directory
    mkdir -m 1777 /tmp

@ -44,7 +46,7 @@ in runCommand name {
  cat <<EOF >$out/bin/${name}
  #! ${stdenv.shell}
  export CHROOTENV_EXTRA_BINDS="${lib.concatStringsSep ":" extraBindMounts}:\$CHROOTENV_EXTRA_BINDS"
-  exec ${chroot-user}/bin/chroot-user ${env} ${bash'} -l ${init runScript} "\$(pwd)" "\$@"
+  exec ${chroot-user}/bin/chroot-user ${env} ${bash'} ${init runScript} "\$(pwd)" "\$@"
  EOF
  chmod +x $out/bin/${name}
  ${extraInstallCommands}
--- a/pkgs/build-support/buildenv/builder.pl
+++ b/pkgs/build-support/buildenv/builder.pl
@ -5,6 +5,7 @@ use Cwd 'abs_path';
 use IO::Handle;
 use File::Path;
 use File::Basename;
+use File::Compare;
 use JSON::PP;

 STDOUT->autoflush(1);
@ -38,7 +39,7 @@ for my $p (@pathsToLink) {
 sub findFiles;

 sub findFilesInDir {
-    my ($relName, $target, $ignoreCollisions, $priority) = @_;
+    my ($relName, $target, $ignoreCollisions, $checkCollisionContents, $priority) = @_;

    opendir DIR, "$target" or die "cannot open `$target': $!";
    my @names = readdir DIR or die;
@ -46,12 +47,28 @@ sub findFilesInDir {

    foreach my $name (@names) {
        next if $name eq "." || $name eq "..";
-        findFiles("$relName/$name", "$target/$name", $name, $ignoreCollisions, $priority);
+        findFiles("$relName/$name", "$target/$name", $name, $ignoreCollisions, $checkCollisionContents, $priority);
    }
 }

+sub checkCollision {
+    my ($path1, $path2) = @_;
+
+    my $stat1 = (stat($path1))[2];
+    my $stat2 = (stat($path2))[2];
+
+    if ($stat1 != $stat2) {
+        warn "different permissions in `$path1' and `$path2': "
+           . sprintf("%04o", $stat1 & 07777) . " <-> "
+           . sprintf("%04o", $stat2 & 07777);
+        return 0;
+    }
+
+    return compare($path1, $path2) == 0;
+}
+
 sub findFiles {
-    my ($relName, $target, $baseName, $ignoreCollisions, $priority) = @_;
+    my ($relName, $target, $baseName, $ignoreCollisions, $checkCollisionContents, $priority) = @_;

    # Urgh, hacky...
    return if
@ -82,13 +99,15 @@ sub findFiles {
        if ($ignoreCollisions) {
            warn "collision between `$target' and `$oldTarget'\n" if $ignoreCollisions == 1;
            return;
+        } elsif ($checkCollisionContents && checkCollision($oldTarget, $target)) {
+            return;
        } else {
            die "collision between `$target' and `$oldTarget'\n";
        }
    }

-    findFilesInDir($relName, $oldTarget, $ignoreCollisions, $oldPriority) unless $oldTarget eq "";
-    findFilesInDir($relName, $target, $ignoreCollisions, $priority);
+    findFilesInDir($relName, $oldTarget, $ignoreCollisions, $checkCollisionContents, $oldPriority) unless $oldTarget eq "";
+    findFilesInDir($relName, $target, $ignoreCollisions, $checkCollisionContents, $priority);

    $symlinks{$relName} = ["", $priority]; # denotes directory
 }
@ -98,12 +117,12 @@ my %done;
 my %postponed;

 sub addPkg {
-    my ($pkgDir, $ignoreCollisions, $priority)  = @_;
+    my ($pkgDir, $ignoreCollisions, $checkCollisionContents, $priority)  = @_;

    return if (defined $done{$pkgDir});
    $done{$pkgDir} = 1;

-    findFiles("", $pkgDir, "", $ignoreCollisions, $priority);
+    findFiles("", $pkgDir, "", $ignoreCollisions, $checkCollisionContents, $priority);

    my $propagatedFN = "$pkgDir/nix-support/propagated-user-env-packages";
    if (-e $propagatedFN) {
@ -132,7 +151,11 @@ if (exists $ENV{"pkgsPath"}) {
 # user.
 for my $pkg (@{decode_json $pkgs}) {
    for my $path (@{$pkg->{paths}}) {
-        addPkg($path, $ENV{"ignoreCollisions"} eq "1", $pkg->{priority}) if -e $path;
+        addPkg($path,
+               $ENV{"ignoreCollisions"} eq "1",
+               $ENV{"checkCollisionContents"} eq "1",
+               $pkg->{priority})
+           if -e $path;
    }
 }

--- a/pkgs/build-support/buildenv/default.nix
+++ b/pkgs/build-support/buildenv/default.nix
@ -16,6 +16,10 @@
 , # Whether to ignore collisions or abort.
  ignoreCollisions ? false

+, # If there is a collision, check whether the contents and permissions match
+  # and only if not, throw a collision error.
+  checkCollisionContents ? true
+
 , # The paths (relative to each element of `paths') that we want to
  # symlink (e.g., ["/bin"]).  Any file not inside any of the
  # directories in the list is not symlinked.
@ -39,7 +43,9 @@
 }:

 runCommand name
-  rec { inherit manifest ignoreCollisions passthru meta pathsToLink extraPrefix postBuild buildInputs;
+  rec {
+    inherit manifest ignoreCollisions checkCollisionContents passthru
+            meta pathsToLink extraPrefix postBuild buildInputs;
    pkgs = builtins.toJSON (map (drv: {
      paths =
        [ drv ]
--- a/pkgs/build-support/emacs/elpa.nix
+++ b/pkgs/build-support/emacs/elpa.nix
@ -0,0 +1,30 @@
+# builder for Emacs packages built for packages.el
+
+{ lib, stdenv, fetchurl, emacs, texinfo }:
+
+with lib;
+
+{ pname
+, version
+, src
+, ...
+}@args:
+
+import ./generic.nix { inherit lib stdenv emacs texinfo; } ({
+
+  phases = "installPhase fixupPhase distPhase";
+
+  installPhase = ''
+    runHook preInstall
+
+    emacs --batch -Q -l ${./elpa2nix.el} \
+        -f elpa2nix-install-package \
+        "${src}" "$out/share/emacs/site-lisp/elpa"
+
+    runHook postInstall
+  '';
+}
+
+// removeAttrs args [ "files" "fileSpecs"
+                      "meta"
+                    ])
--- a/pkgs/build-support/emacs/elpa2nix.el
+++ b/pkgs/build-support/emacs/elpa2nix.el
@ -0,0 +1,30 @@
+(require 'package)
+(package-initialize)
+
+(defun elpa2nix-install-package ()
+  (if (not noninteractive)
+      (error "`elpa2nix-install-package' is to be used only with -batch"))
+  (pcase command-line-args-left
+    (`(,archive ,elpa)
+     (progn (setq package-user-dir elpa)
+            (elpa2nix-install-file archive)))))
+
+(defun elpa2nix-install-from-buffer ()
+  "Install a package from the current buffer."
+  (let ((pkg-desc (if (derived-mode-p 'tar-mode)
+                      (package-tar-file-info)
+                    (package-buffer-info))))
+    ;; Install the package itself.
+    (package-unpack pkg-desc)
+    pkg-desc))
+
+(defun elpa2nix-install-file (file)
+  "Install a package from a file.
+The file can either be a tar file or an Emacs Lisp file."
+  (let ((is-tar (string-match "\\.tar\\'" file)))
+    (with-temp-buffer
+      (if is-tar
+          (insert-file-contents-literally file)
+        (insert-file-contents file))
+      (when is-tar (tar-mode))
+      (elpa2nix-install-from-buffer))))
--- a/pkgs/build-support/emacs/generic.nix
+++ b/pkgs/build-support/emacs/generic.nix
@ -32,8 +32,11 @@ stdenv.mkDerivation ({
  unpackCmd = ''
    case "$curSrc" in
      *.el)
-        cp $curSrc $pname.el
-        chmod +w $pname.el
+        # keep original source filename without the hash
+        local filename=$(basename "$curSrc")
+        filename="''${filename:33}"
+        cp $curSrc $filename
+        chmod +w $filename
        sourceRoot="."
        ;;
      *)
--- a/pkgs/build-support/emacs/melpa.nix
+++ b/pkgs/build-support/emacs/melpa.nix
@ -28,8 +28,6 @@ let
    sha256 = "1biwg2pqmmdz5iwqbjdszljazqymvgyyjcnc255nr6qz8mhnx67j";
  };

-  fname = "${pname}-${version}";
-
  targets = concatStringsSep " " (if files == null then fileSpecs else files);

  defaultMeta = {
@ -41,31 +39,33 @@ in
 import ./generic.nix { inherit lib stdenv emacs texinfo; } ({
  inherit packageBuild;

-  buildPhase = ''
-    runHook preBuild
+  buildPhase =
+    if recipeFile == null
+      then ''
+        runHook preBuild

-    emacs --batch -Q -l $packageBuild -l ${./melpa2nix.el} \
-    ${if recipeFile == null
-      then
-      ''
-      -f melpa2nix-build-package \
-      ${pname} ${version} ${targets}
-      ''
-      else
-      ''
-      -f melpa2nix-build-package-from-recipe \
-      ${pname} ${version} ${recipeFile}
-      ''}
+        export archive=$(emacs --batch -Q -l $packageBuild -l ${./melpa2nix.el} \
+            -f melpa2nix-build-package \
+            ${pname} ${version} ${targets})

-    runHook postBuild
-  '';
+        runHook postBuild
+      ''
+      else ''
+        runHook preBuild
+
+        export archive=$(emacs --batch -Q -l $packageBuild -l ${./melpa2nix.el} \
+            -f melpa2nix-build-package-from-recipe \
+            ${recipeFile} ${version})
+
+        runHook postBuild
+      '';

  installPhase = ''
    runHook preInstall

-    emacs --batch -Q -l $packageBuild -l ${./melpa2nix.el} \
-      -f melpa2nix-install-package \
-      ${fname}.* $out/share/emacs/site-lisp/elpa
+    emacs --batch -Q -l ${./elpa2nix.el} \
+        -f elpa2nix-install-package \
+        "$archive" "$out/share/emacs/site-lisp/elpa"

    runHook postInstall
  '';
--- a/pkgs/build-support/emacs/melpa2nix.el
+++ b/pkgs/build-support/emacs/melpa2nix.el
@ -6,14 +6,6 @@
 (setq package-build-working-dir (expand-file-name ".")
      package-build-archive-dir (expand-file-name "."))

-(defun melpa2nix-install-package ()
-  (if (not noninteractive)
-      (error "`melpa2nix-install-package' is to be used only with -batch"))
-  (pcase command-line-args-left
-    (`(,archive ,elpa)
-     (progn (setq package-user-dir elpa)
-            (package-install-file archive)))))
-
 (defun melpa2nix-build-package ()
  (if (not noninteractive)
      (error "`melpa2nix-build-package' is to be used only with -batch"))
@ -25,8 +17,10 @@
  (if (not noninteractive)
      (error "`melpa2nix-build-package' is to be used only with -batch"))
  (pcase command-line-args-left
-    (`(,package ,version ,recipe-file)
-     (let* ((rcp (cdr (package-build--read-from-file recipe-file)))
+    (`(,recipe-file ,version)
+     (let* ((recipe (package-build--read-from-file recipe-file))
+            (rcp (cdr recipe))
+            (package (car recipe))
            (files (package-build--config-file-list rcp)))
       (melpa2nix-package-build-archive package version files)))))

@ -38,8 +32,11 @@
                                               version
                                               files
                                               package-build-working-dir
-                                               package-build-archive-dir)))
+                                               package-build-archive-dir))
+         (archive-file (package-build--archive-file-name archive-entry)))

-    (package-build--message "Built in %.3fs, finished at %s"
+    (progn
+      (package-build--message "Built in %.3fs, finished at %s"
                            (time-to-seconds (time-since start-time))
-                            (current-time-string))))
+                            (current-time-string))
+      (princ (format "%s\n" archive-file)))))
--- a/Show More
+++ b/Show More
				`@ -0,0 +1 @@`
				`EVAL additions_libgltf=' subDir = "libgltf/";'`