diff --git a/lib/maintainers.nix b/lib/maintainers.nix
index a3e397f2173b..ad1ba299a530 100644
--- a/lib/maintainers.nix
+++ b/lib/maintainers.nix
@@ -161,6 +161,7 @@
   ehegnes = "Eric Hegnes <eric.hegnes@gmail.com>";
   ehmry = "Emery Hemingway <emery@vfemail.net>";
   eikek = "Eike Kettner <eike.kettner@posteo.de>";
+  ekleog = "Leo Gaspard <leo@gaspard.io>";
   elasticdog = "Aaron Bull Schaefer <aaron@elasticdog.com>";
   eleanor = "Dejan Lukan <dejan@proteansec.com>";
   elitak = "Eric Litak <elitak@gmail.com>";
diff --git a/nixos/modules/services/networking/tinc.nix b/nixos/modules/services/networking/tinc.nix
index 6cb40185274d..79a0aa953feb 100644
--- a/nixos/modules/services/networking/tinc.nix
+++ b/nixos/modules/services/networking/tinc.nix
@@ -35,7 +35,8 @@ in
               description = ''
                 The name of the node which is used as an identifier when communicating
                 with the remote nodes in the mesh. If null then the hostname of the system
-                is used.
+                is used to derive a name (note that tinc may replace non-alphanumeric characters in
+                hostnames by underscores).
               '';
             };
 
diff --git a/pkgs/applications/misc/dmenu/default.nix b/pkgs/applications/misc/dmenu/default.nix
index 1dc9fe5e2026..8ef4f3ae8974 100644
--- a/pkgs/applications/misc/dmenu/default.nix
+++ b/pkgs/applications/misc/dmenu/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, libX11, libXinerama, libXft, zlib, patches ? null }:
 
 stdenv.mkDerivation rec {
-  name = "dmenu-4.6";
+  name = "dmenu-4.7";
 
   src = fetchurl {
     url = "http://dl.suckless.org/tools/${name}.tar.gz";
-    sha256 = "1cwnvamqqlgczvd5dv5rsgqbhv8kp0ddjnhmavb3q732i8028yja";
+    sha256 = "1fgph549i0yw62x02jhfc8qmqk2rnzcnm46bxq6jig1cvkw3amm7";
   };
 
   buildInputs = [ libX11 libXinerama zlib libXft ];
diff --git a/pkgs/applications/networking/browsers/lynx/default.nix b/pkgs/applications/networking/browsers/lynx/default.nix
index fb4b33ef71ab..42f454191989 100644
--- a/pkgs/applications/networking/browsers/lynx/default.nix
+++ b/pkgs/applications/networking/browsers/lynx/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, ncurses, gzip
+{ stdenv, fetchurl, ncurses, gzip, pkgconfig
 , sslSupport ? true, openssl ? null
 }:
 
@@ -13,14 +13,10 @@ stdenv.mkDerivation rec {
     sha256 = "1cqm1i7d209brkrpzaqqf2x951ra3l67dw8x9yg10vz7rpr9441a";
   };
 
-  configureFlags = []
-    ++ stdenv.lib.optionals sslSupport [ "--with-ssl=${openssl.dev}" ];
+  configureFlags = [ "--enable-widec" ] ++ stdenv.lib.optional sslSupport "--with-ssl";
 
-  buildInputs = [ ncurses gzip ];
-
-  crossAttrs = {
-    configureFlags = configureFlags ++ [ "--enable-widec" ];
-  };
+  nativeBuildInputs = stdenv.lib.optional sslSupport pkgconfig;
+  buildInputs = [ ncurses gzip ] ++ stdenv.lib.optional sslSupport openssl.dev;
 
   meta = with stdenv.lib; {
     homepage = http://lynx.isc.org/;
diff --git a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
index 4443c8480663..2c9661c36fa5 100644
--- a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
+++ b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
@@ -87,12 +87,18 @@ let
 
   srcs = {
     "x86_64-linux" = fetchurl {
-      url = "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz";
+      urls = [
+        "https://github.com/TheTorProject/gettorbrowser/releases/download/v${version}/tor-browser-linux64-${version}_${lang}.tar.xz"
+        "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz"
+      ];
       sha256 = "0jn98arczlgjigpmql1qg5b7izabv4zy4mji6vvcg3b8g1ma108r";
     };
 
     "i686-linux" = fetchurl {
-      url = "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux32-${version}_${lang}.tar.xz";
+      urls = [
+        "https://github.com/TheTorProject/gettorbrowser/releases/download/v${version}/tor-browser-linux32-${version}_${lang}.tar.xz"
+        "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux32-${version}_${lang}.tar.xz"
+      ];
       sha256 = "0micxgkbys0py4bj6csbc8xz4gq0x5v2zirgi38krnm5x5riqj3w";
     };
   };
@@ -105,6 +111,7 @@ stdenv.mkDerivation rec {
   src = srcs."${stdenv.system}" or (throw "unsupported system: ${stdenv.system}");
 
   preferLocalBuild = true;
+  allowSubstitutes = false;
 
   desktopItem = makeDesktopItem {
     name = "torbrowser";
diff --git a/pkgs/applications/office/homebank/default.nix b/pkgs/applications/office/homebank/default.nix
index ac2f71c872da..65a7c9730e9a 100644
--- a/pkgs/applications/office/homebank/default.nix
+++ b/pkgs/applications/office/homebank/default.nix
@@ -2,10 +2,10 @@
 , hicolor_icon_theme, libsoup, gnome3 }:
 
 stdenv.mkDerivation rec {
-  name = "homebank-5.1.4";
+  name = "homebank-5.1.5";
   src = fetchurl {
     url = "http://homebank.free.fr/public/${name}.tar.gz";
-    sha256 = "07zxb9n7d281nfv29gi09fsp7y73fx4w2s48hgdn9s4vij25zwqa";
+    sha256 = "03rkl4bvi1cmb8rqyvmhxhg63bdmb3nzqa3firfimsbphm3x6gsw";
   };
 
   nativeBuildInputs = [ pkgconfig wrapGAppsHook ];
diff --git a/pkgs/applications/version-management/git-and-tools/git-annex-remote-rclone/default.nix b/pkgs/applications/version-management/git-and-tools/git-annex-remote-rclone/default.nix
index d1996b72154d..d38529e92e60 100644
--- a/pkgs/applications/version-management/git-and-tools/git-annex-remote-rclone/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-annex-remote-rclone/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   name = "git-annex-remote-rclone-${version}";
-  version = "0.4";
+  version = "0.5";
   rev = "v${version}";
 
   src = fetchFromGitHub {
     inherit rev;
     owner = "DanielDent";
     repo = "git-annex-remote-rclone";
-    sha256 = "1myk307hqm8dlxhkmwr347rdd28niv5h0gyrxm30y77zlly30ddk";
+    sha256 = "1353b6q3lnxhpdfy9yd2af65v7aypdhyvgn7ziksmsrbi12lb74i";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/build-support/trivial-builders.nix b/pkgs/build-support/trivial-builders.nix
index 1529869aa331..4debd9636396 100644
--- a/pkgs/build-support/trivial-builders.nix
+++ b/pkgs/build-support/trivial-builders.nix
@@ -71,7 +71,7 @@ rec {
       ''
         mkdir -p $out
         for i in $paths; do
-          ${lndir}/bin/lndir $i $out
+          ${lndir}/bin/lndir -silent $i $out
         done
         ${postBuild}
       '';
diff --git a/pkgs/development/compilers/tinycc/default.nix b/pkgs/development/compilers/tinycc/default.nix
index dfbbaa4d4310..fcad6045dbfb 100644
--- a/pkgs/development/compilers/tinycc/default.nix
+++ b/pkgs/development/compilers/tinycc/default.nix
@@ -2,10 +2,10 @@
 with stdenv.lib;
 
 let
-  date = "20170225";
+  date = "20170527";
   version = "0.9.27pre-${date}";
-  rev = "bb93064d7857d887b674999c9b4152b44a628f9a";
-  sha256 = "12wcahj1x4qy9ia931i23lvwkqjmyhaks3wipnzvbnlnc2b03kpr";
+  rev = "53c5fc2246270e0242903de0152a9a5d40f3d679";
+  sha256 = "0z5ayz0kdn5xqm84k730hmd7r9cq0zxxf45g5phgqppdfajrmswz";
 in
 
 stdenv.mkDerivation rec {
diff --git a/pkgs/development/haskell-modules/generic-builder.nix b/pkgs/development/haskell-modules/generic-builder.nix
index 653e5cd245ca..7d21996fe1cd 100644
--- a/pkgs/development/haskell-modules/generic-builder.nix
+++ b/pkgs/development/haskell-modules/generic-builder.nix
@@ -197,13 +197,11 @@ stdenv.mkDerivation ({
     ${jailbreak-cabal}/bin/jailbreak-cabal ${pname}.cabal
   '' + postPatch;
 
-  # for ghcjs, we want to put ghcEnv on PATH so compiler plugins will be available.
-  # TODO(cstrahan): would the same be of benefit to native ghc?
   setupCompilerEnvironmentPhase = ''
     runHook preSetupCompilerEnvironment
 
     echo "Build with ${ghc}."
-    export PATH="${if ghc.isGhcjs or false then ghcEnv else ghc}/bin:$PATH"
+    export PATH="${ghc}/bin:$PATH"
     ${optionalString (hasActiveLibrary && hyperlinkSource) "export PATH=${hscolour}/bin:$PATH"}
 
     packageConfDir="$TMPDIR/package.conf.d"
diff --git a/pkgs/development/libraries/physics/cernlib/default.nix b/pkgs/development/libraries/physics/cernlib/default.nix
new file mode 100644
index 000000000000..dad138c8433a
--- /dev/null
+++ b/pkgs/development/libraries/physics/cernlib/default.nix
@@ -0,0 +1,63 @@
+{ stdenv, fetchurl, gfortran, gnumake, imake, makedepend, motif, xorg }:
+
+stdenv.mkDerivation rec {
+  version = "2006";
+  name = "cernlib-${version}";
+
+  src = fetchurl {
+    url = "http://cernlib.web.cern.ch/cernlib/download/${version}_source/tar/${version}_src.tar.gz";
+    sha256 = "0awla1rl96z82br7slcmg8ks1d2a7slk6dj79ywb871j2ksi3fky";
+  };
+
+  buildInputs = with xorg; [ gfortran motif libX11 libXft libXt ];
+  nativeBuildInputs = [ gnumake imake makedepend ];
+  sourceRoot = ".";
+
+  patches = [ ./patch ];
+
+  postPatch = ''
+    substituteInPlace 2006/src/config/site.def \
+      --replace "# define MakeCmd gmake" "# define MakeCmd make"
+  '';
+
+  configurePhase = ''
+    export CERN=`pwd`
+    export CERN_LEVEL=${version}
+    export CERN_ROOT=$CERN/$CERN_LEVEL
+    export CVSCOSRC=`pwd`/$CERN_LEVEL/src
+    export PATH=$PATH:$CERN_ROOT/bin
+  '';
+
+  buildPhase = ''
+    cd $CERN_ROOT
+    mkdir -p build bin lib
+
+    cd $CERN_ROOT/build
+    $CVSCOSRC/config/imake_boot
+    make bin/kuipc
+    make scripts/Makefile
+    pushd scripts
+    make install.bin
+    popd
+    make
+  '';
+
+  installPhase = ''
+    mkdir "$out"
+    cp -r "$CERN_ROOT/bin" "$out"
+    cp -r "$CERN_ROOT/lib" "$out"
+    mkdir "$out/$CERN_LEVEL"
+    ln -s "$out/bin" "$out/$CERN_LEVEL/bin"
+    ln -s "$out/lib" "$out/$CERN_LEVEL/lib"
+  '';
+
+  setupHook = ./setup-hook.sh;
+
+  meta = {
+    homepage = http://cernlib.web.cern.ch;
+    description = "Legacy collection of libraries and modules for data analysis in high energy physics";
+    platforms = stdenv.lib.platforms.unix;
+    maintainers = with stdenv.lib.maintainers; [ veprbl ];
+    license = stdenv.lib.licenses.gpl2;
+  };
+}
diff --git a/pkgs/development/libraries/physics/cernlib/patch b/pkgs/development/libraries/physics/cernlib/patch
new file mode 100644
index 000000000000..2d75b6bf0f88
--- /dev/null
+++ b/pkgs/development/libraries/physics/cernlib/patch
@@ -0,0 +1,186 @@
+diff --git a/2006/src/config/Imake.tmpl b/2006/src/config/Imake.tmpl
+index 054fb04..a3b3828 100644
+--- a/2006/src/config/Imake.tmpl
++++ b/2006/src/config/Imake.tmpl
+@@ -455,7 +455,7 @@ XCOMM the platform-specific parameters - edit site.def to change
+ #define NoRConst NO /* YES if const for structs of funcs is bad */
+ #endif
+ #ifndef InstPgmFlags
+-#define InstPgmFlags -s
++#define InstPgmFlags
+ #endif
+ #ifndef InstBinFlags
+ #define InstBinFlags -m 0755
+diff --git a/2006/src/config/biglib.rules b/2006/src/config/biglib.rules
+index c90e58a..9173bdc 100644
+--- a/2006/src/config/biglib.rules
++++ b/2006/src/config/biglib.rules
+@@ -368,7 +368,7 @@ define build-object-list						@@\
+ @ (set -e;\							@@\
+ 	 case '${MFLAGS}' in *[i]*) set +e;; esac; \		@@\
+ 	 subdirs=Quote(dirs);\					@@\
+-	 list=`/bin/pwd`/$@;\					@@\
++	 list=`pwd`/$@;\					@@\
+ 	 for dir in $$subdirs; do \				@@\
+ 	  (set -e;cd $$dir;SedCmd -e "\=^[^/]=s=^.=$$dir/&=" $@ >> $$list);\@@\
+ 	 done) || (rm $@; exit 1)				@@\
+diff --git a/2006/src/config/imake_boot b/2006/src/config/imake_boot
+index b52d0d3..69cf1b3 100755
+--- a/2006/src/config/imake_boot
++++ b/2006/src/config/imake_boot
+@@ -10,8 +10,8 @@ if [ "$CVSCOSRC" = "" ] ; then
+ fi
+ if [ -f Imakefile ] ; then
+ 	imake -DUseInstalled -I$CVSCOSRC/config \
+-		-DTOPDIR=`/bin/pwd` -DCURDIR= -fImakefile
++		-DTOPDIR=`pwd` -DCURDIR= -fImakefile
+ else
+ 	imake -DUseInstalled -I$CVSCOSRC/config \
+-		-DTOPDIR=`/bin/pwd` -DCURDIR= -f$CVSCOSRC/Imakefile
++		-DTOPDIR=`pwd` -DCURDIR= -f$CVSCOSRC/Imakefile
+ fi
+diff --git a/2006/src/config/linux-lp64.cf b/2006/src/config/linux-lp64.cf
+index e071b2f..3cc5c3b 100644
+--- a/2006/src/config/linux-lp64.cf
++++ b/2006/src/config/linux-lp64.cf
+@@ -173,7 +173,7 @@
+ #define FortranCmd		g77
+ #define XargsCmd		xargs
+ #define FortranSaveFlags	/* */ /* Everything static !? */
+-#define DefaultFCOptions	-fno-automatic -fno-second-underscore -fugly-complex
++#define DefaultFCOptions	-fno-automatic -fno-second-underscore
+ #define CernlibSystem	        -DCERNLIB_LINUX -DCERNLIB_UNIX -DCERNLIB_LNX -DCERNLIB_QMGLIBC -DCERNLIB_QMLXIA64
+ 
+ # endif
+diff --git a/2006/src/config/linux.cf b/2006/src/config/linux.cf
+index cc0bee5..a8dd954 100644
+--- a/2006/src/config/linux.cf
++++ b/2006/src/config/linux.cf
+@@ -258,7 +258,7 @@ endif									@@\
+ #define FortranCmd		g77
+ #define XargsCmd		xargs
+ #define FortranSaveFlags	/* */ /* Everything static !? */
+-#define DefaultFCOptions	-fno-automatic -fno-second-underscore -fugly-complex
++#define DefaultFCOptions	-fno-automatic -fno-second-underscore
+ #define CernlibSystem	        -DCERNLIB_LINUX -DCERNLIB_UNIX -DCERNLIB_LNX -DCERNLIB_QMGLIBC
+ 
+ # endif
+diff --git a/2006/src/packlib/kuip/code_kuip/kkern.c b/2006/src/packlib/kuip/code_kuip/kkern.c
+index 3a5579f..5f3c352 100644
+--- a/2006/src/packlib/kuip/code_kuip/kkern.c
++++ b/2006/src/packlib/kuip/code_kuip/kkern.c
+@@ -543,24 +543,6 @@ char *str0dup( const char *str )
+ 
+ 
+ /*
+- * like strdup() but string is n characters long and not terminated
+- */
+-char *strndup( const char *str,
+-              size_t len )
+-{
+-  size_t bytes = len + 1;
+-  char *p;
+-
+-  if( bytes < ALLOC_MIN_BYTES )
+-    bytes = ALLOC_MIN_BYTES;
+-
+-  p = strncpy( malloc( bytes ), str, len );
+-  p[len] = '\0';
+-  return p;
+-}
+-
+-
+-/*
+  * strdup() of character representation of integer n
+  */
+ char *stridup( int n )
+diff --git a/2006/src/packlib/kuip/code_kuip/kmenu.c b/2006/src/packlib/kuip/code_kuip/kmenu.c
+index f135b07..23007a8 100644
+--- a/2006/src/packlib/kuip/code_kuip/kmenu.c
++++ b/2006/src/packlib/kuip/code_kuip/kmenu.c
+@@ -1404,7 +1404,7 @@ void interactive_find( char *expr, int keym )
+          printf ("See also:\n    ");
+          for (i = 0; i < nval; i++) {
+              if (i == ncmd) continue;
+-             printf (flis_name[i]);
++             printf ("%s", flis_name[i]);
+              if (i < nval-1)
+                 printf (", ");
+              else
+diff --git a/2006/src/packlib/kuip/kuip/kstring.h b/2006/src/packlib/kuip/kuip/kstring.h
+index 7811f15..12a1344 100644
+--- a/2006/src/packlib/kuip/kuip/kstring.h
++++ b/2006/src/packlib/kuip/kuip/kstring.h
+@@ -21,7 +21,6 @@ extern "C" {
+  */
+ 
+ #ifndef WIN32
+-extern void* memmove( void* dst, const void* src, size_t n );
+ #endif
+ 
+ /* GF. make conform to kkern.c#if !defined(__convexc__)*/
+@@ -46,7 +45,6 @@ extern char* str4dup( const char* str1, const char* str2, const char* str3,
+                      const char* str4 );
+ extern char* str5dup( const char* str1, const char* str2, const char* str3,
+                      const char* str4, const char* str5 );
+-extern char* strndup( const char* buf, size_t n );
+ extern char* stridup( int i );
+ 
+ extern char* mstrcat( char* ptr, const char* str );
+diff --git a/2006/src/pawlib/paw/cpaw/bugrep.c b/2006/src/pawlib/paw/cpaw/bugrep.c
+index d503a45..d26e30f 100644
+--- a/2006/src/pawlib/paw/cpaw/bugrep.c
++++ b/2006/src/pawlib/paw/cpaw/bugrep.c
+@@ -432,51 +432,7 @@ br_add_config( char * tmp_file )
+ 
+ static int
+ br_mail_file( char *addr, char *subj, char *file )
+-#if (defined(CERNLIB_UNIX))&&(!defined(CERNLIB_WINNT))&&(!defined(CERNLIB_MACOSX))
+-{
+-        FILE            *mfp, *fp;
+-        char            line[1024], my_addr[L_cuserid];
+-        time_t          clock;
+-        struct tm       *ts;
+-
+-        fp = fopen( file, "r" );
+-        if ( fp == NULL ) {
+-                printf( "BUGREPORT: cannot (re)open temporary file\n" );
+-                return MAIL_ERROR;
+-        }
+-
+-        cuserid( my_addr );
+-
+-        sprintf( line, "/usr/lib/sendmail -t" );
+-        mfp = popen( line, "w" );
+-
+-        if ( mfp == NULL ) {
+-                printf( "BUGREPORT: cannot run sendmail\n" );
+-                return MAIL_ERROR;
+-        }
+-
+-
+-        clock = time( (time_t *) 0 );
+-        ts = localtime( &clock );
+-        strftime( line, sizeof( line ),
+-                "%a, %d %h %y %H:%M:%S", ts );
+-        fprintf ( mfp, "To: %s\n", addr );
+-        fprintf ( mfp, "Bcc: %s\n", my_addr );
+-        fprintf ( mfp, "Date: %s\n", line );
+-        fprintf ( mfp, "Subject: %s\n", subj );
+-        fprintf ( mfp, "\n" );
+-
+-        while( fgets( line, sizeof( line ), fp ) != NULL ) {
+-                fputs( line, mfp );
+-        }
+-        fclose( fp );
+-
+-        pclose( mfp );
+-
+-        return MAIL_OK;
+-}
+-#endif
+-#if defined(CERNLIB_MACOSX)
++#if (defined(CERNLIB_UNIX))&&(!defined(CERNLIB_WINNT))
+ {
+         FILE            *mfp, *fp;
+         char            line[1024], *my_addr;
diff --git a/pkgs/development/libraries/physics/cernlib/setup-hook.sh b/pkgs/development/libraries/physics/cernlib/setup-hook.sh
new file mode 100644
index 000000000000..d83759327760
--- /dev/null
+++ b/pkgs/development/libraries/physics/cernlib/setup-hook.sh
@@ -0,0 +1,3 @@
+export CERN_LEVEL=@version@
+export CERN=@out@
+export CERN_ROOT=$CERN/$CERN_LEVEL
diff --git a/pkgs/development/ocaml-modules/cmdliner/default.nix b/pkgs/development/ocaml-modules/cmdliner/default.nix
index 8be36a2a408f..9448610a3784 100644
--- a/pkgs/development/ocaml-modules/cmdliner/default.nix
+++ b/pkgs/development/ocaml-modules/cmdliner/default.nix
@@ -1,31 +1,34 @@
-{ stdenv, fetchurl, ocaml, findlib, ocamlbuild, opam }:
+{ stdenv, fetchurl, ocaml, findlib, ocamlbuild, opam, topkg, result }:
 
 let
   pname = "cmdliner";
 in
 
-assert stdenv.lib.versionAtLeast ocaml.version "3.12";
+assert stdenv.lib.versionAtLeast ocaml.version "4.01.0";
 
 stdenv.mkDerivation rec {
-
   name = "ocaml-${pname}-${version}";
-  version = "0.9.8";
+  version = "1.0.0";
 
   src = fetchurl {
     url = "http://erratique.ch/software/${pname}/releases/${pname}-${version}.tbz";
-    sha256 = "0hdxlkgiwjml9dpaa80282a8350if7mc1m6yz2mrd7gci3fszykx";
+    sha256 = "1ryn7qis0izg0wcal8zdlikzzl689l75y6f4zc6blrm93y5agy9x";
   };
 
   unpackCmd = "tar xjf $src";
-  buildInputs = [ ocaml findlib ocamlbuild opam ];
+
+  nativeBuildInputs = [ ocamlbuild opam topkg ];
+  buildInputs = [ ocaml findlib ];
+  propagatedBuildInputs = [ result ];
 
   createFindlibDestdir = true;
 
-  configurePhase = "ocaml pkg/git.ml";
-  buildPhase     = "ocaml pkg/build.ml native=true native-dynlink=true";
-  installPhase   = ''
-    opam-installer --script --prefix=$out ${pname}.install > install.sh
-    sh install.sh
+  buildPhase = ''
+    ocaml -I ${findlib}/lib/ocaml/${ocaml.version}/site-lib pkg/pkg.ml build
+  '';
+
+  installPhase = ''
+    opam-installer --script --prefix=$out | sh
     ln -s $out/lib/${pname} $out/lib/ocaml/${ocaml.version}/site-lib/
   '';
 
@@ -33,7 +36,7 @@ stdenv.mkDerivation rec {
     homepage = http://erratique.ch/software/cmdliner;
     description = "An OCaml module for the declarative definition of command line interfaces";
     license = licenses.bsd3;
-    maintainers = [ maintainers.vbgl ];
     platforms = ocaml.meta.platforms or [];
+    maintainers = [ maintainers.vbgl ];
   };
 }
diff --git a/pkgs/development/python-modules/hypothesis.nix b/pkgs/development/python-modules/hypothesis.nix
index 0927c703fbfd..cb0db6dc2e0c 100644
--- a/pkgs/development/python-modules/hypothesis.nix
+++ b/pkgs/development/python-modules/hypothesis.nix
@@ -1,6 +1,6 @@
 { stdenv, buildPythonPackage, fetchFromGitHub, python
 , pythonOlder, pythonAtLeast, enum34
-, doCheck ? true, pytest, flake8, flaky
+, doCheck ? true, pytest, pytest_xdist, flake8, flaky
 }:
 buildPythonPackage rec {
   # http://hypothesis.readthedocs.org/en/latest/packaging.html
@@ -21,13 +21,14 @@ buildPythonPackage rec {
     sha256 = "1s911pd3y9hvk0hq2fr6i68dqv1ciagryhgp13wgyfqh8hz8j6zv";
   };
 
-  checkInputs = stdenv.lib.optionals doCheck [ pytest flake8 flaky ];
+  checkInputs = stdenv.lib.optionals doCheck [ pytest pytest_xdist flake8 flaky ];
   propagatedBuildInputs = stdenv.lib.optionals (pythonOlder "3.4") [ enum34 ];
 
   inherit doCheck;
 
   # https://github.com/DRMacIver/hypothesis/issues/300
   checkPhase = ''
+    rm tox.ini # This file changes how py.test runs and breaks it
     py.test tests/cover
   '';
 
diff --git a/pkgs/development/python-modules/ldap.nix b/pkgs/development/python-modules/ldap.nix
index dacf714d7665..3e715bbe419a 100644
--- a/pkgs/development/python-modules/ldap.nix
+++ b/pkgs/development/python-modules/ldap.nix
@@ -1,4 +1,4 @@
-{ buildPythonPackage, isPy3k, fetchurl
+{ buildPythonPackage, isPy3k, fetchPypi
 , openldap, cyrus_sasl, openssl }:
 
 buildPythonPackage rec {
@@ -7,8 +7,8 @@ buildPythonPackage rec {
   name = "${pname}-${version}";
   disabled = isPy3k;
 
-  src = fetchurl {
-    url = "mirror://pypi/p/python-ldap/${name}.tar.gz";
+  src = fetchPypi {
+    inherit pname version;
     sha256 = "88bab69e519dd8bd83becbe36bd141c174b0fe309e84936cf1bae685b31be779";
   };
 
diff --git a/pkgs/development/python-modules/pylibmc/default.nix b/pkgs/development/python-modules/pylibmc/default.nix
index ff53e3d304fe..7f57f17efeb1 100644
--- a/pkgs/development/python-modules/pylibmc/default.nix
+++ b/pkgs/development/python-modules/pylibmc/default.nix
@@ -1,11 +1,11 @@
-{ buildPythonPackage, fetchurl, stdenv, libmemcached, zlib }:
+{ buildPythonPackage, fetchPypi, stdenv, libmemcached, zlib }:
 buildPythonPackage rec {
   version = "1.5.2";
   pname = "pylibmc";
   name = "${pname}-${version}";
 
-  src = fetchurl {
-    url = "https://pypi.python.org/packages/source/p/pylibmc/${name}.tar.gz";
+  src = fetchPypi {
+    inherit pname version;
     sha256 = "fc54e28a9f1b5b2ec0c030da29c7ad8a15c2755bd98aaa4142eaf419d5fabb33";
   };
 
diff --git a/pkgs/development/python-modules/pylint/default.nix b/pkgs/development/python-modules/pylint/default.nix
index 2922faafa7f7..130aef60f971 100644
--- a/pkgs/development/python-modules/pylint/default.nix
+++ b/pkgs/development/python-modules/pylint/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, buildPythonPackage, python, astroid, isort,
-  pytest,  mccabe, configparser, backports_functools_lru_cache }:
+  pytest, pytestrunner,  mccabe, configparser, backports_functools_lru_cache }:
 
   buildPythonPackage rec {
     name = "${pname}-${version}";
@@ -11,7 +11,7 @@
       sha256 = "8b4a7ab6cf5062e40e2763c0b4a596020abada1d7304e369578b522e46a6264a";
     };
 
-    buildInputs = [ pytest mccabe configparser backports_functools_lru_cache ];
+    buildInputs = [ pytest pytestrunner mccabe configparser backports_functools_lru_cache ];
 
     propagatedBuildInputs = [ astroid isort ];
 
diff --git a/pkgs/development/python-modules/simplejson/default.nix b/pkgs/development/python-modules/simplejson/default.nix
new file mode 100644
index 000000000000..983d17655215
--- /dev/null
+++ b/pkgs/development/python-modules/simplejson/default.nix
@@ -0,0 +1,28 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+}:
+
+buildPythonPackage rec {
+  pname = "simplejson";
+  version = "3.10.0";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "953be622e88323c6f43fad61ffd05bebe73b9fd9863a46d68b052d2aa7d71ce2";
+  };
+
+  meta = {
+    description = "A simple, fast, extensible JSON encoder/decoder for Python";
+    longDescription = ''
+      simplejson is compatible with Python 2.4 and later with no
+      external dependencies.  It covers the full JSON specification
+      for both encoding and decoding, with unicode support.  By
+      default, encoding is done in an encoding neutral fashion (plain
+      ASCII with \uXXXX escapes for unicode characters).
+    '';
+    homepage = http://code.google.com/p/simplejson/;
+    license = lib.licenses.mit;
+  };
+}
\ No newline at end of file
diff --git a/pkgs/development/tools/analysis/cppcheck/default.nix b/pkgs/development/tools/analysis/cppcheck/default.nix
index a394105faf4b..ce9ca76a43b2 100644
--- a/pkgs/development/tools/analysis/cppcheck/default.nix
+++ b/pkgs/development/tools/analysis/cppcheck/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "cppcheck";
-  version = "1.78";
+  version = "1.79";
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "mirror://sourceforge/${pname}/${name}.tar.bz2";
-    sha256 = "1cc60y2vjq4g88183jkan91ybzqy0n6p5ncs8z5rh6rjsvvrc9p4";
+    sha256 = "0vgh4zx191d7mcmiilkhcbd9jkspfkppl7l4y5451walvs9vd19b";
   };
 
   buildInputs = [ pcre ];
diff --git a/pkgs/development/tools/ocaml/merlin/default.nix b/pkgs/development/tools/ocaml/merlin/default.nix
index 7af1b5ccd7a3..6f0d71d76b18 100644
--- a/pkgs/development/tools/ocaml/merlin/default.nix
+++ b/pkgs/development/tools/ocaml/merlin/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip, ocaml, findlib, yojson, menhir, lib
+{ stdenv, fetchzip, ocaml, findlib, yojson, lib
 , withEmacsMode ? false, emacs }:
 
 assert stdenv.lib.versionAtLeast (stdenv.lib.getVersion ocaml) "4.00";
@@ -8,10 +8,10 @@ let
   then
     "2.3.1"
   else
-    "2.5.3";
+    "2.5.4";
   hashes = {
     "2.3.1" = "192jamcc7rmvadlqqsjkzsl6hlgwhg9my1qc89fxh1lmd4qdsrpn";
-    "2.5.3" = "0qljklgcrpqdxzvcqj7b4785zcz322pjvw9cddbmzla33hagglha";
+    "2.5.4" = "101vk16c5wayd51s8w0mvy99bk7q3gm2gz8i8616wa1lmyszjknh";
   };
 in
 
@@ -24,7 +24,7 @@ stdenv.mkDerivation {
     sha256 = hashes."${version}";
   };
 
-  buildInputs = [ ocaml findlib yojson menhir ]
+  buildInputs = [ ocaml findlib yojson ]
     ++ stdenv.lib.optional withEmacsMode emacs;
 
   preConfigure = "mkdir -p $out/bin";
diff --git a/pkgs/development/tools/ocaml/ocp-indent/default.nix b/pkgs/development/tools/ocaml/ocp-indent/default.nix
index d146dd5e9731..500002bed444 100644
--- a/pkgs/development/tools/ocaml/ocp-indent/default.nix
+++ b/pkgs/development/tools/ocaml/ocp-indent/default.nix
@@ -3,18 +3,21 @@
 let inherit (stdenv.lib) getVersion versionAtLeast; in
 
 assert versionAtLeast (getVersion ocaml) "3.12.1";
+assert versionAtLeast (getVersion cmdliner) "1.0.0";
 assert versionAtLeast (getVersion ocpBuild) "1.99.6-beta";
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
 
-  name = "ocp-indent-1.5.2";
+  name = "ocp-indent-${version}";
+  version = "1.6.0";
 
   src = fetchzip {
-    url = "https://github.com/OCamlPro/ocp-indent/archive/1.5.2.tar.gz";
-    sha256 = "0ynv2yhm7akpvqp72pdabhddwr352s1k85q8m1khsvspgg1mkiqz";
+    url = "https://github.com/OCamlPro/ocp-indent/archive/${version}.tar.gz";
+    sha256 = "1h9y597s3ag8w1z32zzv4dfk3ppq557s55bnlfw5a5wqwvia911f";
   };
 
-  buildInputs = [ ocaml findlib ocpBuild opam cmdliner ];
+  nativeBuildInputs = [ ocpBuild opam ];
+  buildInputs = [ ocaml findlib cmdliner ];
 
   createFindlibDestdir = true;
 
diff --git a/pkgs/games/factorio/default.nix b/pkgs/games/factorio/default.nix
index f0de56b09538..861a44fea8c5 100644
--- a/pkgs/games/factorio/default.nix
+++ b/pkgs/games/factorio/default.nix
@@ -10,7 +10,7 @@ assert releaseType == "alpha" || releaseType == "headless" || releaseType == "de
 
 with stdenv.lib;
 let
-  version = if releaseType != "demo" then "0.15.1" else "0.14.23";
+  version = if releaseType != "demo" then "0.15.16" else "0.14.23";
 
   arch = if stdenv.system == "x86_64-linux" then {
     inUrl = "linux64";
@@ -27,8 +27,8 @@ let
     url = "https://www.factorio.com/get-download/${version}/${releaseType}/${arch.inUrl}";
     name = "factorio_${releaseType}_${arch.inTar}-${version}.${extension}";
     x64 = {
-      headless =           fetchurl { inherit name url; sha256 = "1z84a9yzlld6fv53viwvswp52hlc9fkxzhb2pil7sidzkws3g49l"; };
-      alpha    = authenticatedFetch { inherit name url; sha256 = "11bxasghrhqb2yg1842v1608x3mjdjv3015jgifpv1xmcqak44jp"; };
+      headless =           fetchurl { inherit name url; sha256 = "0ig0nrvqllb9294qn2ci5j5s31ycsjn23bp6hc633xqkgfmklmic"; };
+      alpha    = authenticatedFetch { inherit name url; sha256 = "0bf0z6fi0cpbq487hz4sz8ljapchzhld01sj767wsldakjfkm9g9"; };
       demo     =           fetchurl { inherit name url; sha256 = "10a2lwmspqviwgymn3zhjgpiynsa6dplgnikdirma5sl2hhcfb6s"; };
     };
     i386 = {
diff --git a/pkgs/games/galaxis/default.nix b/pkgs/games/galaxis/default.nix
new file mode 100644
index 000000000000..c0799e8fdf4c
--- /dev/null
+++ b/pkgs/games/galaxis/default.nix
@@ -0,0 +1,47 @@
+{ stdenv, fetchurl, ncurses, xmlto }:
+
+with stdenv.lib;
+stdenv.mkDerivation rec{
+
+  name = "galaxis-${version}";
+  version = "1.9";
+
+  src = fetchurl{
+    url = "http://www.catb.org/~esr/galaxis/${name}.tar.gz";
+    sha256 = "1dsypk5brfbc399pg4fk9myyh5yyln0ljl1aiqkypws8h4nsdphl";
+  };
+
+  buildInputs = [ ncurses xmlto ];
+
+  patchPhase = ''
+    sed -i\
+     -e 's|^install: galaxis\.6 uninstall|install: galaxis.6|'\
+     -e 's|usr/||g' -e 's|ROOT|DESTDIR|g'\
+     -e 's|install -m 755 -o 0 -g 0|install -m 755|' Makefile
+  '';
+
+  dontConfigure = true;
+
+  makeFlags = [ "DESTDIR=$(out)" ];
+
+  meta = {
+    description = "Rescue lifeboats lost in interstellar space";
+    longDescription = ''
+      Lifeboats from a crippled interstellar liner are adrift in a starfield. To
+      find them, you can place probes that look in all eight compass directions
+      and tell you how many lifeboats they see. If you drop a probe directly on
+      a lifeboat it will be revealed immediately. Your objective: find the
+      lifeboats as quickly as possible, before the stranded passengers run out
+      of oxygen!
+
+      This is a UNIX-hosted, curses-based clone of the nifty little Macintosh
+      freeware game Galaxis. It doesn't have the super-simple, point-and-click
+      interface of the original, but compensates by automating away some of the
+      game's simpler deductions.
+    '';
+    homepage = http://catb.org/~esr/galaxis/;
+    license = licenses.gpl2;
+    maintainers = [ maintainers.AndersonTorres ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/servers/http/apache-modules/mod_auth_mellon/default.nix b/pkgs/servers/http/apache-modules/mod_auth_mellon/default.nix
index 67648f9d4f2c..a99f081b24eb 100644
--- a/pkgs/servers/http/apache-modules/mod_auth_mellon/default.nix
+++ b/pkgs/servers/http/apache-modules/mod_auth_mellon/default.nix
@@ -3,13 +3,13 @@
 stdenv.mkDerivation rec {
 
   name = "mod_auth_mellon-${version}";
-  version = "0.12.0";
+  version = "0.13.1";
 
   src = fetchFromGitHub {
     owner = "UNINETT";
     repo = "mod_auth_mellon";
     rev = "v${version}";
-    sha256 = "1p6v6vgrfvgvc5y2ygqyyxi0klpm3nxaw3fg35zmpmw663w8skqn";
+    sha256 = "16b43y5a5p8g1287x04rv923230cy8dfs2j18cx6208n4bv4dvnk";
   };
 
   patches = [
diff --git a/pkgs/servers/mail/dkimproxy/default.nix b/pkgs/servers/mail/dkimproxy/default.nix
new file mode 100644
index 000000000000..9abf95fb6d60
--- /dev/null
+++ b/pkgs/servers/mail/dkimproxy/default.nix
@@ -0,0 +1,36 @@
+{ stdenv, perl, fetchurl, Error, MailDKIM, MIMEtools, NetServer }:
+
+let
+  pkg = "dkimproxy";
+  version = "1.4.1";
+in
+stdenv.mkDerivation rec {
+  name = "${pkg}-${version}";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/dkimproxy/${name}.tar.gz";
+    sha256 = "1gc5c7lg2qrlck7b0lvjfqr824ch6jkrzkpsn0gjvlzg7hfmld75";
+  };
+
+  # Idea taken from pkgs/development/perl-modules/generic/builder.sh
+  preFixup = ''
+    perlFlags=
+    for i in $(IFS=:; echo $PERL5LIB); do
+      perlFlags="$perlFlags -I$i"
+    done
+    for f in $(ls $out/bin); do
+      sed -i $out/bin/$f -e "s|#\!\(.*/perl.*\)$|#\! \1 $perlFlags|"
+    done
+  '';
+
+  buildInputs = [ perl ];
+  propagatedBuildInputs = [ Error MailDKIM MIMEtools NetServer ];
+
+  meta = with stdenv.lib; {
+    description = "SMTP-proxy that signs and/or verifies emails";
+    homepage = http://dkimproxy.sourceforge.net/;
+    license = licenses.gpl2Plus;
+    maintainers = [ maintainers.ekleog ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/servers/radicale/default.nix b/pkgs/servers/radicale/default.nix
index e49e399194de..f36d19bfb209 100644
--- a/pkgs/servers/radicale/default.nix
+++ b/pkgs/servers/radicale/default.nix
@@ -2,11 +2,11 @@
 
 pythonPackages.buildPythonApplication rec {
   name = "radicale-${version}";
-  version = "1.1.1";
+  version = "1.1.2";
 
   src = fetchurl {
     url = "mirror://pypi/R/Radicale/Radicale-${version}.tar.gz";
-    sha256 = "1c5lv8qca21mndkx350wxv34qypqh6gb4rhzms4anr642clq3jg2";
+    sha256 = "1g20p3998f46ywda7swv0py63wjbrhvk0nrafajlbb6wgzxjmqpb";
   };
 
   propagatedBuildInputs = stdenv.lib.optionals (!pythonPackages.isPy3k) [
diff --git a/pkgs/tools/inputmethods/ibus-engines/ibus-m17n/default.nix b/pkgs/tools/inputmethods/ibus-engines/ibus-m17n/default.nix
index 2d25e6bf4304..c53f766cb7d3 100644
--- a/pkgs/tools/inputmethods/ibus-engines/ibus-m17n/default.nix
+++ b/pkgs/tools/inputmethods/ibus-engines/ibus-m17n/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     isIbusEngine = true;
     description  = "m17n engine for ibus";
-    homepage     = https://github.com.com/ibus/ibus-m17n;
+    homepage     = https://github.com/ibus/ibus-m17n;
     license      = licenses.gpl2;
     platforms    = platforms.linux;
     maintainers  = with maintainers; [ ericsagnes ];
diff --git a/pkgs/tools/misc/fsql/default.nix b/pkgs/tools/misc/fsql/default.nix
index 117574c3daa1..ffd3b3f51534 100644
--- a/pkgs/tools/misc/fsql/default.nix
+++ b/pkgs/tools/misc/fsql/default.nix
@@ -2,14 +2,14 @@
 
 buildGoPackage rec {
   name = "fsql-${version}";
-  version = "0.1.0";
+  version = "0.1.1";
 
   goPackagePath = "github.com/kshvmdn/fsql";
 
   src = fetchgit {
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
     url = "https://github.com/kshvmdn/fsql";
-    sha256 = "1wkf9rr6x4b5bvxj9zwfw9hd870c831j7mc6fvd448id653wh122";
+    sha256 = "1zvblhfd15l86dcx0p12yrc2rrmfdpzyd107508pb72r2ar638vh";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/misc/moreutils/default.nix b/pkgs/tools/misc/moreutils/default.nix
index a232028976dc..51ac3249fed8 100644
--- a/pkgs/tools/misc/moreutils/default.nix
+++ b/pkgs/tools/misc/moreutils/default.nix
@@ -1,13 +1,14 @@
-{ stdenv, fetchurl, libxml2, libxslt, docbook-xsl, docbook_xml_dtd_44, perl, IPCRun, TimeDate, TimeDuration, makeWrapper }:
+{ stdenv, fetchgit, libxml2, libxslt, docbook-xsl, docbook_xml_dtd_44, perl, IPCRun, TimeDate, TimeDuration, makeWrapper }:
 
 with stdenv.lib;
 stdenv.mkDerivation rec {
   name = "moreutils-${version}";
-  version = "0.59";
+  version = "0.61";
 
-  src = fetchurl {
-    url = "http://ftp.de.debian.org/debian/pool/main/m/moreutils/moreutils_${version}.orig.tar.gz";
-    sha256 = "1d6ik3j4lwp90vb93p7yv60k6vk2chz448d1z9xrmxvv371i33m4";
+  src = fetchgit {
+    url = "git://git.joeyh.name/moreutils";
+    rev = "refs/tags/${version}";
+    sha256 = "1qvwlq0a2zs7qkjqc9c842979axkjfdr7nic1gsm4zc6jd72y7pr";
   };
 
   preBuild = ''
@@ -25,7 +26,7 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Growing collection of the unix tools that nobody thought to write long ago when unix was young";
     homepage = https://joeyh.name/code/moreutils/;
-    maintainers = with maintainers; [ koral ];
+    maintainers = with maintainers; [ koral pSub ];
     platforms = platforms.all;
   };
 }
diff --git a/pkgs/tools/misc/pick/default.nix b/pkgs/tools/misc/pick/default.nix
index a407a85d1a20..075949f47e1a 100644
--- a/pkgs/tools/misc/pick/default.nix
+++ b/pkgs/tools/misc/pick/default.nix
@@ -2,19 +2,23 @@
 
 stdenv.mkDerivation rec {
   name = "pick-${version}";
-  version = "1.4.0";
+  version = "1.6.1";
 
   src = fetchFromGitHub {
     owner = "thoughtbot";
     repo = "pick";
     rev = "v${version}";
-    sha256 = "113if0jh7svwrwrxhrsbi7h1whfr5707v2ny4dc9kk2sjbv6b9pg";
+    sha256 = "0iw3yqwg8j0pg56xx52xwn7n95vxlqbqh71zrc934v4mq971qlhd";
   };
 
   buildInputs = [ ncurses ];
 
   nativeBuildInputs = [ autoreconfHook ];
 
+  postPatch = ''
+    sed -i -e 's/\[curses]/\[ncurses]/g' configure.ac
+  '';
+
   meta = with stdenv.lib; {
     inherit (src.meta) homepage;
     description = "Fuzzy text selection utility";
diff --git a/pkgs/tools/networking/simpleproxy/default.nix b/pkgs/tools/networking/simpleproxy/default.nix
new file mode 100644
index 000000000000..476e7dc229df
--- /dev/null
+++ b/pkgs/tools/networking/simpleproxy/default.nix
@@ -0,0 +1,21 @@
+{ stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  name = "simpleproxy-${version}";
+  version = "3.5";
+  rev = "v.${version}";
+
+  src = fetchFromGitHub {
+    inherit rev;
+    owner = "vzaliva";
+    repo = "simpleproxy";
+    sha256 = "1my9g4vp19dikx3fsbii4ichid1bs9b9in46bkg05gbljhj340f6";
+  };
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/vzaliva/simpleproxy;
+    description = "A simple TCP proxy";
+    license = licenses.gpl2;
+    maintainers = [ maintainers.montag451 ];
+  };
+}
diff --git a/pkgs/tools/security/cfssl/default.nix b/pkgs/tools/security/cfssl/default.nix
new file mode 100644
index 000000000000..91a5fa4bdd24
--- /dev/null
+++ b/pkgs/tools/security/cfssl/default.nix
@@ -0,0 +1,23 @@
+{ stdenv, lib, buildGoPackage, fetchFromGitHub, pkgs }:
+
+buildGoPackage rec {
+  name = "cfssl-${version}";
+  version = "20170527";
+
+  goPackagePath = "github.com/cloudflare/cfssl";
+
+  src = fetchFromGitHub {
+    owner = "cloudflare";
+    repo = "cfssl";
+    rev = "114dc9691ec7bf3dac49d5953eccf7d91a0e0904";
+    sha256 = "1ijq43mrzrf1gkgj5ssxq7sgy6sd4rl706dzqkq9krqv5f6kwhj1";
+  };
+
+  meta = with stdenv.lib; {
+    homepage = https://cfssl.org/;
+    description = "Cloudflare's PKI and TLS toolkit";
+    platforms = platforms.linux;
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ mbrgm ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 1b30910c743c..3e59d51ef61b 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1386,6 +1386,8 @@ with pkgs;
 
   c14 = callPackage ../applications/networking/c14 { };
 
+  cfssl = callPackage ../tools/security/cfssl { };
+
   checkbashisms = callPackage ../development/tools/misc/checkbashisms { };
 
   clamav = callPackage ../tools/security/clamav { };
@@ -4058,6 +4060,8 @@ with pkgs;
   silver-searcher = callPackage ../tools/text/silver-searcher { };
   ag = self.silver-searcher;
 
+  simpleproxy = callPackage ../tools/networking/simpleproxy { };
+
   simplescreenrecorder = callPackage ../applications/video/simplescreenrecorder { };
 
   sipsak = callPackage ../tools/networking/sipsak { };
@@ -10873,6 +10877,10 @@ with pkgs;
 
   diod = callPackage ../servers/diod { lua = lua5_1; };
 
+  dkimproxy = callPackage ../servers/mail/dkimproxy {
+    inherit (perlPackages) Error MailDKIM MIMEtools NetServer;
+  };
+
   dnschain = callPackage ../servers/dnschain { };
 
   dovecot = callPackage ../servers/mail/dovecot { };
@@ -16933,6 +16941,8 @@ with pkgs;
     wxGTK = wxGTK28.override { unicode = false; };
   };
 
+  galaxis = callPackage ../games/galaxis { };
+
   gambatte = callPackage ../games/gambatte { };
 
   garden-of-coloured-lights = callPackage ../games/garden-of-coloured-lights { allegro = allegro4; };
@@ -18106,6 +18116,8 @@ with pkgs;
     motif = null; # motif or lesstif
   };
 
+  cernlib = callPackage ../development/libraries/physics/cernlib { };
+
   g4py = callPackage ../development/libraries/physics/geant4/g4py { };
 
   hepmc = callPackage ../development/libraries/physics/hepmc { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 3d4a38ff47f6..3f5b20a62d62 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -10195,6 +10195,9 @@ in {
     };
   };
 
+  # This package likely needs an older version of Django.
+  # Override the package set and set e.g. `django = super.django_1_9`.
+  # See the Nixpkgs manual for examples on how to override the package set.
   django_hijack = buildPythonPackage rec {
     name = "django-hijack-${version}";
     version = "2.0.7";
@@ -10204,12 +10207,7 @@ in {
       sha256 = "0rpi1bkfx74xfbb2nk874kfdra1jcqp2vzky1r3z7zidlc9kah04";
     };
 
-    # TODO improve the that multi-override necessity (the fixpoint based python
-    # packages work can be the solution)
-    propagatedBuildInputs = with self; [ django_1_9 (django_compat.override {
-      django = django_1_9;
-      django_nose = django_nose.override { propagatedBuildInputs = [django_1_9 nose]; };
-    }) ];
+    propagatedBuildInputs = with self; [ django django_compat ];
 
     meta = {
       description = "Allows superusers to hijack (=login as) and work on behalf of another user";
@@ -22777,30 +22775,7 @@ in {
     };
   };
 
-  simplejson = buildPythonPackage (rec {
-    name = "simplejson-3.8.1";
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/s/simplejson/${name}.tar.gz";
-      sha256 = "14r4l4rcsyf87p2j4ycsbb017n4vzxfmv285rq2gny4w47rwi2j2";
-    };
-
-    meta = {
-      description = "A simple, fast, extensible JSON encoder/decoder for Python";
-
-      longDescription = ''
-        simplejson is compatible with Python 2.4 and later with no
-        external dependencies.  It covers the full JSON specification
-        for both encoding and decoding, with unicode support.  By
-        default, encoding is done in an encoding neutral fashion (plain
-        ASCII with \uXXXX escapes for unicode characters).
-      '';
-
-      homepage = http://code.google.com/p/simplejson/;
-
-      license = licenses.mit;
-    };
-  });
+  simplejson = callPackage ../development/python-modules/simplejson { };
 
   simpleldap = buildPythonPackage rec {
     version = "0.8";