Merge remote-tracking branch 'upstream/master' into HEAD

2017-09-28 10:51:26 +02:00 · 2017-09-28 10:51:26 +02:00 · 4e22e88b91
commit 4e22e88b91
parent 95b706f0db 82667fee37
63 changed files with 831 additions and 693 deletions
--- a/lib/licenses.nix
+++ b/lib/licenses.nix
@ -281,6 +281,11 @@ lib.mapAttrs (n: v: v // { shortName = n; }) rec {
    url = https://fedoraproject.org/wiki/Licensing/GPL_Classpath_Exception;
  };

+  hpnd = spdx {
+    spdxId = "HPND";
+    fullName = "Historic Permission Notice and Disclaimer";
+  };
+
  # Intel's license, seems free
  iasl = {
    fullName = "iASL";
--- a/nixos/doc/manual/release-notes/rl-1709.xml
+++ b/nixos/doc/manual/release-notes/rl-1709.xml
@ -335,6 +335,13 @@ FLUSH PRIVILEGES;
    was removed and should not be needed anymore.</para>
  </listitem>

+  <listitem>
+    <para>
+      Redis has been updated to version 4 which mandates a cluster
+      mass-restart, due to changes in the network handling, in order
+      to ensure compatibility with networks NATing traffic.
+    </para>
+  </listitem>
 </itemizedlist>

 <para>Other notable improvements:</para>
@ -432,6 +439,16 @@ FLUSH PRIVILEGES;
      version, kernel version and build date of all bootable generations.
    </para>
  </listitem>
+  <listitem>
+    <para>
+      The dnscrypt-proxy service now defaults to using a random upstream resolver,
+      selected from the list of public non-logging resolvers with DNSSEC support.
+      Existing configurations can be migrated to this mode of operation by
+      omitting the <option>services.dnscrypt-proxy.resolverName</option> option
+      or setting it to <literal>"random"</literal>.
+    </para>
+  </listitem>
+
 </itemizedlist>

 </section>
--- a/nixos/modules/hardware/video/nvidia.nix
+++ b/nixos/modules/hardware/video/nvidia.nix
@ -40,6 +40,12 @@ in
 {

  config = mkIf enabled {
+    assertions = [
+      {
+        assertion = services.xserver.displayManager.gdm.wayland;
+        message = "NVidia drivers don't support wayland";
+      }
+    ];

    services.xserver.drivers = singleton
      { name = "nvidia"; modules = [ nvidia_x11.bin ]; libPath = [ nvidia_x11 ]; };
@ -62,11 +68,16 @@ in
    boot.extraModulePackages = [ nvidia_x11.bin ];

    # nvidia-uvm is required by CUDA applications.
-    boot.kernelModules = [ "nvidia-uvm" ];
+    boot.kernelModules = [ "nvidia-uvm" ] ++
+      lib.optionals config.services.xserver.enable [ "nvidia" "nvidia_modeset" "nvidia_drm" ];
+

    # Create /dev/nvidia-uvm when the nvidia-uvm module is loaded.
    services.udev.extraRules =
      ''
+        KERNEL=="nvidia", RUN+="${pkgs.stdenv.shell} -c 'mknod -m 666 /dev/nvidiactl c $(grep nvidia-frontend /proc/devices | cut -d \  -f 1) 255'"
+        KERNEL=="nvidia_modeset", RUN+="${pkgs.stdenv.shell} -c 'mknod -m 666 /dev/nvidia-modeset c $(grep nvidia-frontend /proc/devices | cut -d \  -f 1) 254'"
+        KERNEL=="card*", SUBSYSTEM=="drm", DRIVERS=="nvidia", RUN+="${pkgs.stdenv.shell} -c 'mknod -m 666 /dev/nvidia%n c $(grep nvidia-frontend /proc/devices | cut -d \  -f 1) %n'"
        KERNEL=="nvidia_uvm", RUN+="${pkgs.stdenv.shell} -c 'mknod -m 666 /dev/nvidia-uvm c $(grep nvidia-uvm /proc/devices | cut -d \  -f 1) 0'"
      '';

--- a/nixos/modules/installer/cd-dvd/iso-image.nix
+++ b/nixos/modules/installer/cd-dvd/iso-image.nix
@ -361,6 +361,9 @@ in
        { source = config.isoImage.splashImage;
          target = "/isolinux/background.png";
        }
+        { source = pkgs.writeText "version" config.system.nixosVersion;
+          target = "/version.txt";
+        }
      ] ++ optionals config.isoImage.makeEfiBootable [
        { source = efiImg;
          target = "/boot/efi.img";
--- a/nixos/modules/services/monitoring/monit.nix
+++ b/nixos/modules/services/monitoring/monit.nix
@ -17,20 +17,22 @@ in
      };
      config = mkOption {
        default = "";
-        description = "monit.conf content";
+        description = "monitrc content";
      };
    };
  };

  config = mkIf config.services.monit.enable {

+    environment.systemPackages = [ pkgs.monit ];
+
    environment.etc = [
      {
        source = pkgs.writeTextFile {
-          name = "monit.conf";
+          name = "monitrc";
          text = config.services.monit.config;
        };
-        target = "monit.conf";
+        target = "monitrc";
        mode = "0400";
      }
    ];
@ -40,9 +42,9 @@ in
      after = [ "network.target" ];
      wantedBy = [ "multi-user.target" ];
      serviceConfig = {
-        ExecStart = "${pkgs.monit}/bin/monit -I -c /etc/monit.conf";
-        ExecStop = "${pkgs.monit}/bin/monit -c /etc/monit.conf quit";
-        ExecReload = "${pkgs.monit}/bin/monit -c /etc/monit.conf reload";
+        ExecStart = "${pkgs.monit}/bin/monit -I -c /etc/monitrc";
+        ExecStop = "${pkgs.monit}/bin/monit -c /etc/monitrc quit";
+        ExecReload = "${pkgs.monit}/bin/monit -c /etc/monitrc reload";
        KillMode = "process";
        Restart = "always";
      };
--- a/nixos/modules/services/networking/consul.nix
+++ b/nixos/modules/services/networking/consul.nix
@ -183,6 +183,7 @@ in
          ExecReload = "${cfg.package.bin}/bin/consul reload";
          PermissionsStartOnly = true;
          User = if cfg.dropPrivileges then "consul" else null;
+          Restart = "on-failure";
          TimeoutStartSec = "0";
        } // (optionalAttrs (cfg.leaveOnStop) {
          ExecStop = "${cfg.package.bin}/bin/consul leave";
--- a/nixos/modules/services/networking/tinc.nix
+++ b/nixos/modules/services/networking/tinc.nix
@ -163,6 +163,12 @@ in
        wantedBy = [ "multi-user.target" ];
        after = [ "network.target" ];
        path = [ data.package ];
+        restartTriggers =
+          let
+            drvlist = [ config.environment.etc."tinc/${network}/tinc.conf".source ]
+                        ++ mapAttrsToList (host: _: config.environment.etc."tinc/${network}/hosts/${host}".source) data.hosts;
+          in # drvlist might be too long to be used directly
+            [ (builtins.hashString "sha256" (concatMapStrings (d: d.outPath) drvlist)) ];
        serviceConfig = {
          Type = "simple";
          Restart = "always";
--- a/nixos/modules/services/networking/wpa_supplicant.nix
+++ b/nixos/modules/services/networking/wpa_supplicant.nix
@ -148,6 +148,7 @@ in {
      wants = [ "network.target" ];
      requires = lib.concatMap deviceUnit ifaces;
      wantedBy = [ "multi-user.target" ];
+      stopIfChanged = false;

      path = [ pkgs.wpa_supplicant ];

--- a/nixos/modules/services/networking/znc.nix
+++ b/nixos/modules/services/networking/znc.nix
@ -212,6 +212,14 @@ in
        '';
      };

+      openFirewall = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to open ports in the firewall for ZNC.
+        '';
+      };
+
      zncConf = mkOption {
        default = "";
        example = "See: http://wiki.znc.in/Configuration";
@ -276,14 +284,6 @@ in
          '';
        };

-        openFirewall = mkOption {
-          type = types.bool;
-          default = false;
-          description = ''
-            Whether to open ports in the firewall for ZNC.
-          '';
-        };
-
        passBlock = mkOption {
          example = defaultPassBlock;
          type = types.string;
@ -359,7 +359,7 @@ in
  config = mkIf cfg.enable {

    networking.firewall = mkIf cfg.openFirewall {
-      allowedTCPPorts = [ cfg.port ];
+      allowedTCPPorts = [ cfg.confOptions.port ];
    };

    systemd.services.znc = {
--- a/nixos/modules/services/x11/display-managers/gdm.nix
+++ b/nixos/modules/services/x11/display-managers/gdm.nix
@ -64,6 +64,14 @@ in
        };
      };

+      wayland = mkOption {
+        default = true;
+        description = ''
+          Allow GDM run on Wayland instead of Xserver
+        '';
+        type = types.bool;
+      };
+
    };

  };
@ -94,6 +102,7 @@ in
    # GDM needs different xserverArgs, presumable because using wayland by default.
    services.xserver.tty = null;
    services.xserver.display = null;
+    services.xserver.verbose = null;

    services.xserver.displayManager.job =
      {
@ -139,6 +148,7 @@ in
    # presented and there's a little delay.
    environment.etc."gdm/custom.conf".text = ''
      [daemon]
+      WaylandEnable=${if cfg.gdm.wayland then "true" else "false"}
      ${optionalString cfg.gdm.autoLogin.enable (
        if cfg.gdm.autoLogin.delay > 0 then ''
          TimedLoginEnable=true
--- a/nixos/modules/services/x11/xserver.nix
+++ b/nixos/modules/services/x11/xserver.nix
@ -480,6 +480,15 @@ in
        '';
      };

+      verbose = mkOption {
+        type = types.nullOr types.int;
+        default = 3;
+        example = 7;
+        description = ''
+          Controls verbosity of X logging.
+        '';
+      };
+
      useGlamor = mkOption {
        type = types.bool;
        default = false;
@ -631,10 +640,11 @@ in
      [ "-config ${configFile}"
        "-xkbdir" "${cfg.xkbDir}"
        # Log at the default verbosity level to stderr rather than /var/log/X.*.log.
-        "-verbose" "3" "-logfile" "/dev/null"
+         "-logfile" "/dev/null"
      ] ++ optional (cfg.display != null) ":${toString cfg.display}"
        ++ optional (cfg.tty     != null) "vt${toString cfg.tty}"
        ++ optional (cfg.dpi     != null) "-dpi ${toString cfg.dpi}"
+        ++ optional (cfg.verbose != null) "-verbose ${toString cfg.verbose}"
        ++ optional (!cfg.enableTCP) "-nolisten tcp"
        ++ optional (cfg.autoRepeatDelay != null) "-ardelay ${toString cfg.autoRepeatDelay}"
        ++ optional (cfg.autoRepeatInterval != null) "-arinterval ${toString cfg.autoRepeatInterval}"
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@ -875,7 +875,12 @@ in
    systemd.services.systemd-remount-fs.restartIfChanged = false;
    systemd.services.systemd-update-utmp.restartIfChanged = false;
    systemd.services.systemd-user-sessions.restartIfChanged = false; # Restart kills all active sessions.
-    systemd.services.systemd-logind.restartTriggers = [ config.environment.etc."systemd/logind.conf".source ];
+    # Restarting systemd-logind breaks X11
+    # - upstream commit: https://cgit.freedesktop.org/xorg/xserver/commit/?id=dc48bd653c7e101
+    # - systemd announcement: https://github.com/systemd/systemd/blob/22043e4317ecd2bc7834b48a6d364de76bb26d91/NEWS#L103-L112
+    # - this might be addressed in the future by xorg
+    #systemd.services.systemd-logind.restartTriggers = [ config.environment.etc."systemd/logind.conf".source ];
+    systemd.services.systemd-logind.restartIfChanged = false;
    systemd.services.systemd-logind.stopIfChanged = false;
    systemd.services.systemd-journald.restartTriggers = [ config.environment.etc."systemd/journald.conf".source ];
    systemd.services.systemd-journald.stopIfChanged = false;
--- a/nixos/modules/tasks/kbd.nix
+++ b/nixos/modules/tasks/kbd.nix
@ -98,22 +98,10 @@ in
          '') config.i18n.consoleColors}
        '';

-        /* XXX: systemd-vconsole-setup needs a "main" terminal. By default
-         * /dev/tty0 is used which wouldn't work when the service is restarted
-         * from X11. We set this to /dev/tty1; not ideal because it may also be
-         * owned by X11 or something else.
-         *
-         * See #22470.
-         */
        systemd.services."systemd-vconsole-setup" =
-          { wantedBy = [ "sysinit.target" ];
-            before = [ "display-manager.service" ];
+          { before = [ "display-manager.service" ];
            after = [ "systemd-udev-settle.service" ];
            restartTriggers = [ vconsoleConf kbdEnv ];
-            serviceConfig.ExecStart = [
-              ""
-              "${pkgs.systemd}/lib/systemd/systemd-vconsole-setup /dev/tty1"
-            ];
          };
      }

--- a/nixos/modules/tasks/network-interfaces-scripted.nix
+++ b/nixos/modules/tasks/network-interfaces-scripted.nix
@ -122,24 +122,32 @@ let

                # Set the default gateway.
                ${optionalString (cfg.defaultGateway != null && cfg.defaultGateway.address != "") ''
-                  # FIXME: get rid of "|| true" (necessary to make it idempotent).
-                  ip route add default ${optionalString (cfg.defaultGateway.metric != null)
+                  ${optionalString (cfg.defaultGateway.interface != null) ''
+                    ip route replace ${cfg.defaultGateway.address} dev ${cfg.defaultGateway.interface} ${optionalString (cfg.defaultGateway.metric != null)
+                      "metric ${toString cfg.defaultGateway.metric}"
+                    } proto static
+                  ''}
+                  ip route replace default ${optionalString (cfg.defaultGateway.metric != null)
                      "metric ${toString cfg.defaultGateway.metric}"
                    } via "${cfg.defaultGateway.address}" ${
                    optionalString (cfg.defaultGatewayWindowSize != null)
                      "window ${toString cfg.defaultGatewayWindowSize}"} ${
                    optionalString (cfg.defaultGateway.interface != null)
-                      "dev ${cfg.defaultGateway.interface}"} proto static || true
+                      "dev ${cfg.defaultGateway.interface}"} proto static
                ''}
                ${optionalString (cfg.defaultGateway6 != null && cfg.defaultGateway6.address != "") ''
-                  # FIXME: get rid of "|| true" (necessary to make it idempotent).
-                  ip -6 route add ::/0 ${optionalString (cfg.defaultGateway6.metric != null)
+                  ${optionalString (cfg.defaultGateway6.interface != null) ''
+                    ip -6 route replace ${cfg.defaultGateway6.address} dev ${cfg.defaultGateway6.interface} ${optionalString (cfg.defaultGateway6.metric != null)
+                      "metric ${toString cfg.defaultGateway6.metric}"
+                    } proto static
+                  ''}
+                  ip -6 route replace default ${optionalString (cfg.defaultGateway6.metric != null)
                      "metric ${toString cfg.defaultGateway6.metric}"
                    } via "${cfg.defaultGateway6.address}" ${
                    optionalString (cfg.defaultGatewayWindowSize != null)
                      "window ${toString cfg.defaultGatewayWindowSize}"} ${
                    optionalString (cfg.defaultGateway6.interface != null)
-                      "dev ${cfg.defaultGateway6.interface}"} proto static || true
+                      "dev ${cfg.defaultGateway6.interface}"} proto static
                ''}
              '';
          };
--- a/nixos/tests/mesos.nix
+++ b/nixos/tests/mesos.nix
@ -56,9 +56,7 @@ import ./make-test.nix ({ pkgs, ...} : rec {
    src = ./mesos_test.py;
    phases = [ "installPhase" "fixupPhase" ];
    installPhase = ''
-      mkdir $out
-      cp $src $out/mesos_test.py
-      chmod +x $out/mesos_test.py
+      install -Dvm 0755 $src $out/bin/mesos_test.py

      echo "done" > test.result
      tar czf $out/test.tar.gz test.result
@ -74,18 +72,18 @@ import ./make-test.nix ({ pkgs, ...} : rec {
      $master->waitForOpenPort(5050);
      $slave->waitForOpenPort(5051);

-      # is slave registred? 
+      # is slave registered?
      $master->waitUntilSucceeds("curl -s --fail http://master:5050/master/slaves".
                                 " | grep -q \"\\\"hostname\\\":\\\"slave\\\"\"");

-      # try to run docker image 
+      # try to run docker image
      $master->succeed("${pkgs.mesos}/bin/mesos-execute --master=master:5050".
                       " --resources=\"cpus:0.1;mem:32\" --name=simple-docker".
                       " --containerizer=mesos --docker_image=echo:latest".
                       " --shell=true --command=\"echo done\" | grep -q TASK_FINISHED");

      # simple command with .tar.gz uri
-      $master->succeed("${testFramework}/mesos_test.py master ".
+      $master->succeed("${testFramework}/bin/mesos_test.py master ".
                       "${testFramework}/test.tar.gz");
    '';
 })
--- a/pkgs/applications/altcoins/bitcoin-abc.nix
+++ b/pkgs/applications/altcoins/bitcoin-abc.nix
@ -0,0 +1,43 @@
+{ stdenv, fetchFromGitHub, pkgconfig, autoreconfHook, openssl, db48, boost
+, zlib, miniupnpc, qt5, utillinux, protobuf, qrencode, libevent
+, withGui }:
+
+with stdenv.lib;
+
+stdenv.mkDerivation rec {
+
+  name = "bitcoin" + (toString (optional (!withGui) "d")) + "-abc-" + version;
+  version = "0.15.0";
+
+  src = fetchFromGitHub {
+    owner = "bitcoin-ABC";
+    repo = "bitcoin-abc";
+    rev = "v${version}";
+    sha256 = "1fygn6cc99iasg5g5jyps5ps873hfnn4ln4hsmcwlwiqd591qxyv";
+  };
+
+  patches = [ ./fix-bitcoin-qt-build.patch ];
+
+  nativeBuildInputs = [ pkgconfig autoreconfHook ];
+  buildInputs = [ openssl db48 boost zlib
+                  miniupnpc utillinux protobuf libevent ]
+                  ++ optionals withGui [ qt5.qtbase qt5.qttools qrencode ];
+
+  configureFlags = [ "--with-boost-libdir=${boost.out}/lib" ]
+                     ++ optionals withGui [ "--with-gui=qt5" ];
+
+  meta = {
+    description = "Peer-to-peer electronic cash system (Cash client)";
+    longDescription= ''
+      Bitcoin ABC is the name of open source software which enables the use of Bitcoin.
+      It is designed to facilite a hard fork to increase Bitcoin's block size limit.
+      "ABC" stands for "Adjustable Blocksize Cap".
+
+      Bitcoin ABC is a fork of the Bitcoin Core software project.
+    '';
+    homepage = https://bitcoinabc.org/;
+    maintainers = with maintainers; [ lassulus ];
+    license = licenses.mit;
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/applications/altcoins/default.nix
+++ b/pkgs/applications/altcoins/default.nix
@ -5,6 +5,9 @@ rec {
  bitcoin  = callPackage ./bitcoin.nix { withGui = true; };
  bitcoind = callPackage ./bitcoin.nix { withGui = false; };

+  bitcoin-abc  = callPackage ./bitcoin-abc.nix { withGui = true; };
+  bitcoind-abc = callPackage ./bitcoin-abc.nix { withGui = false; };
+
  bitcoin-unlimited  = callPackage ./bitcoin-unlimited.nix { withGui = true; };
  bitcoind-unlimited = callPackage ./bitcoin-unlimited.nix { withGui = false; };

--- a/pkgs/applications/altcoins/fix-bitcoin-qt-build.patch
+++ b/pkgs/applications/altcoins/fix-bitcoin-qt-build.patch
@ -0,0 +1,15 @@
+--- bitcoin-abc-v0.15.0-src/build-aux/m4/bitcoin_qt.m4	1970-01-01 01:00:01.000000000 +0100
+++ bitcoin-abc-v0.15.0-src.org/build-aux/m4/bitcoin_qt.m4	2017-09-27 23:38:44.748384197 +0100
+@@ -35,11 +35,7 @@
+ dnl Output: $1 is set to the path of $2 if found. $2 are searched in order.
+ AC_DEFUN([BITCOIN_QT_PATH_PROGS],[
+   BITCOIN_QT_CHECK([
+-    if test "x$3" != "x"; then
+-      AC_PATH_PROGS($1,$2,,$3)
+-    else
+-      AC_PATH_PROGS($1,$2)
+-    fi
+    AC_PATH_PROGS($1,$2)
+     if test "x$$1" = "x" && test "x$4" != "xyes"; then
+       BITCOIN_QT_FAIL([$1 not found])
+     fi
--- a/pkgs/applications/misc/mupdf/default.nix
+++ b/pkgs/applications/misc/mupdf/default.nix
@ -1,6 +1,8 @@
-{ stdenv, fetchurl, fetchpatch, pkgconfig
-, zlib, freetype, libjpeg, jbig2dec, openjpeg
-, libX11, libXcursor, libXrandr, libXinerama, libXext, harfbuzz, mesa }:
+{ stdenv, lib, fetchurl, fetchpatch, pkgconfig
+, freetype, harfbuzz, openjpeg, jbig2dec
+, enableX11 ? true, libX11, libXext
+, enableCurl ? true, curl, openssl
+}:

 stdenv.mkDerivation rec {
  version = "1.11";
@ -28,7 +30,9 @@ stdenv.mkDerivation rec {

  makeFlags = [ "prefix=$(out)" ];
  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ zlib libX11 libXcursor libXext harfbuzz mesa libXrandr libXinerama freetype libjpeg jbig2dec openjpeg ];
+  buildInputs = [ freetype harfbuzz openjpeg jbig2dec ]
+                ++ lib.optionals enableX11 [ libX11 libXext ]
+                ++ lib.optionals enableCurl [ curl openssl ];
  outputs = [ "bin" "dev" "out" "man" "doc" ];

  preConfigure = ''
--- a/pkgs/applications/misc/octoprint/m33-fio-one-library.patch
+++ b/pkgs/applications/misc/octoprint/m33-fio-one-library.patch
@ -1,18 +1,18 @@
-From 0defcf6ec155899c414f66524b7df629f59327f0 Mon Sep 17 00:00:00 2001
+From 314bcebfcd1759981ce12255be29d8ae68cd400b Mon Sep 17 00:00:00 2001
 From: Nikolay Amiantov <ab@fmap.me>
 Date: Wed, 23 Nov 2016 00:40:48 +0300
 Subject: [PATCH] Build and use one version of preprocessor library

 ---
- octoprint_m33fio/__init__.py   | 67 ++----------------------------------------
- shared library source/Makefile | 62 +++-----------------------------------
- 2 files changed, 6 insertions(+), 123 deletions(-)
+ octoprint_m33fio/__init__.py   | 73 ++----------------------------------------
+ shared library source/Makefile | 62 +++--------------------------------
+ 2 files changed, 6 insertions(+), 129 deletions(-)

 diff --git a/octoprint_m33fio/__init__.py b/octoprint_m33fio/__init__.py
-index 4b43c59..d1259e4 100755
+index 054870a..4d5ecc1 100755
 --- a/octoprint_m33fio/__init__.py
 +++ b/octoprint_m33fio/__init__.py
-@@ -1062,71 +1062,8 @@ class M33FioPlugin(
+@@ -1189,78 +1189,9 @@ class M33FioPlugin(
 		# Check if using shared library or checking if it is usable
 		if self._settings.get_boolean(["UseSharedLibrary"]) or isUsable :
 	
@ -54,7 +54,9 @@ index 4b43c59..d1259e4 100755
 -
 -			# Otherwise check if running on Windows and using an i386 or x86-64 device
 -			elif platform.uname()[0].startswith("Windows") and (platform.uname()[4].endswith("86") or platform.uname()[4].endswith("64")) :
-
+			# Set shared library
+			self.sharedLibrary = ctypes.cdll.LoadLibrary(self._basefolder.replace('\\', '/') + "/static/libraries/libpreprocessor.so")
+ 
 -				# Check if Python is running as 32-bit
 -				if platform.architecture()[0].startswith("32") :
 -	
@ -81,11 +83,16 @@ index 4b43c59..d1259e4 100755
 -	
 -					# Set shared library
 -					self.sharedLibrary = ctypes.cdll.LoadLibrary(self._basefolder.replace("\\", "/") + "/static/libraries/preprocessor_x86-64.dylib")
-+			# Set shared library
-+			self.sharedLibrary = ctypes.cdll.LoadLibrary(self._basefolder.replace('\\', '/') + "/static/libraries/libpreprocessor.so")
- 
+-			
+-			# Otherwise check if running FreeBSD
+-			elif platform.uname()[0].startswith("FreeBSD") :
+-			
+-				# TODO: Compile FreeBSD shared library pre-processors
+-				pass
+-			
 			# Check if shared library was set
 			if self.sharedLibrary :
+ 
 diff --git a/shared library source/Makefile b/shared library source/Makefile
 index 792b4f4..4c74f5c 100755
 --- a/shared library source/Makefile	
@ -164,5 +171,5 @@ index 792b4f4..4c74f5c 100755
 clean:
 	rm -f ../octoprint_m33fio/static/libraries/$(PROG)
 -- 
-2.11.0
+2.14.1

--- a/pkgs/applications/misc/octoprint/plugins.nix
+++ b/pkgs/applications/misc/octoprint/plugins.nix
@ -12,13 +12,13 @@ let

    m33-fio = buildPlugin rec {
      name = "M33-Fio-${version}";
-      version = "1.20";
+      version = "1.21";

      src = fetchFromGitHub {
        owner = "donovan6000";
        repo = "M33-Fio";
        rev = "V${version}";
-        sha256 = "1ng7lzlkqsjcr1w7wgzwsqkkvcvpajcj2cwqlffh95916sw8n767";
+        sha256 = "1la3611kkqn8yiwjn6cizc45ri8pnk6ckld1na4nk6mqk88jvjq7";
      };

      patches = [
--- a/pkgs/applications/networking/browsers/tor-browser-bundle/default.nix
+++ b/pkgs/applications/networking/browsers/tor-browser-bundle/default.nix
@ -15,7 +15,6 @@
 , noto-fonts-emoji

 # Extensions, common
-, unzip
 , zip

 # HTTPS Everywhere
@ -27,6 +26,7 @@

 # Customization
 , extraPrefs ? ""
+, extraExtensions ? [ ]
 }:

 let
@ -36,144 +36,19 @@ let
    sha256 = "0j37mqldj33fnzghxifvy6v8vdwkcz0i4z81prww64md5s8qcsa9";
  };

-  # Each extension drv produces an output comprising an unpacked .xpi
-  # named after the extension uuid, as it would appear under
-  # `firefox/extensions'.
-  firefoxExtensions = {
-    https-everywhere = stdenv.mkDerivation rec {
-      name = "https-everywhere-${version}";
-      version = "5.2.21";
-
-      extid = "https-everywhere-eff@eff.org";
-
-      src = fetchgit {
-        url = "https://git.torproject.org/https-everywhere.git";
-        rev = "refs/tags/${version}";
-        sha256 = "0z9madihh4b4z4blvfmh6w1hsv8afyi0x7b243nciq9r4w55xgfa";
-      };
-
-      nativeBuildInputs = [
-        git
-        libxml2 # xmllint
-        python27
-        python27Packages.lxml
-        rsync
-        unzip
-        zip
-      ];
-
-      unpackPhase = ''
-        cp -dR --no-preserve=mode "$src" src
-        cd src
-      '';
-
-      # Beware: the build expects translations/ to be non-empty (which it
-      # will be with submodules initialized).
-      buildPhase = ''
-        $shell ./makexpi.sh ${version} --no-recurse
-      '';
-
-      installPhase = ''
-        mkdir $out
-        unzip -d "$out/$extid" "pkg/https-everywhere-$version-eff.xpi"
-      '';
-
-      meta = {
-        homepage = https://gitweb.torproject.org/https-everywhere.git/;
-      };
-    };
-
-    noscript = stdenv.mkDerivation rec {
-      name = "noscript-${version}";
-      version = "5.0.10";
-
-      extid = "{73a6fe31-595d-460b-a920-fcc0f8843232}";
-
-      src = fetchurl {
-        url = "https://secure.informaction.com/download/releases/noscript-${version}.xpi";
-        sha256 = "18k5karbaj5mhd9cyjbqgik6044bw88rjalkh6anjanxbn503j6g";
-      };
-
-      nativeBuildInputs = [ unzip ];
-
-      unpackPhase = ":";
-
-      installPhase = ''
-        mkdir $out
-        unzip -d "$out/$extid" "$src"
-      '';
-    };
-
-    torbutton = stdenv.mkDerivation rec {
-      name = "torbutton-${version}";
-      version = "1.9.8.1";
-
-      extid = "torbutton@torproject.org";
-
-      src = fetchgit {
-        url = "https://git.torproject.org/torbutton.git";
-        rev = "refs/tags/${version}";
-        sha256 = "1amp0c9ky0a7fsa0bcbi6n6ginw7s2g3an4rj7kvc1lxmrcsm65l";
-      };
-
-      nativeBuildInputs = [ unzip zip ];
-
-      unpackPhase = ''
-        cp -dR --no-preserve=mode "$src" src
-        cd src
-      '';
-
-      buildPhase = ''
-        $shell ./makexpi.sh
-      '';
-
-      installPhase = ''
-        mkdir $out
-        unzip -d "$out/$extid" "pkg/torbutton-$version.xpi"
-      '';
-
-      meta = {
-        homepage = https://gitweb.torproject.org/torbutton.git/;
-      };
-    };
-
-    tor-launcher = stdenv.mkDerivation rec {
-      name = "tor-launcher-${version}";
-      version = "0.2.12.3";
-
-      extid = "tor-launcher@torproject.org";
-
-      src = fetchgit {
-        url = "https://git.torproject.org/tor-launcher.git";
-        rev = "refs/tags/${version}";
-        sha256 = "0126x48pjiy2zm4l8jzhk70w24hviaz560ffp4lb9x0ar615bc9q";
-      };
-
-      nativeBuildInputs = [ unzip zip ];
-
-      unpackPhase = ''
-        cp -dR --no-preserve=mode "$src" src
-        cd src
-      '';
-
-      buildPhase = ''
-        make package
-      '';
-
-      installPhase = ''
-        mkdir $out
-        unzip -d "$out/$extid" "pkg/tor-launcher-$version.xpi"
-      '';
-
-      meta = {
-        homepage = https://gitweb.torproject.org/tor-launcher.git/;
-      };
-    };
+  firefoxExtensions = import ./extensions.nix {
+    inherit stdenv fetchurl fetchgit zip
+      git libxml2 python27 python27Packages rsync;
  };

  extensionsEnv = symlinkJoin {
    name = "tor-browser-extensions";
-    paths = with firefoxExtensions; [ https-everywhere noscript torbutton tor-launcher ];
+    paths = with firefoxExtensions; [
+      https-everywhere
+      noscript
+      torbutton
+      tor-launcher
+    ] ++ extraExtensions;
  };

  fontsEnv = symlinkJoin {
--- a/pkgs/applications/networking/browsers/tor-browser-bundle/extensions.nix
+++ b/pkgs/applications/networking/browsers/tor-browser-bundle/extensions.nix
@ -0,0 +1,122 @@
+{ stdenv
+, fetchgit
+, fetchurl
+
+# common
+, zip
+
+# HTTPS Everywhere
+, git
+, libxml2 # xmllint
+, python27
+, python27Packages
+, rsync
+}:
+
+{
+  https-everywhere = stdenv.mkDerivation rec {
+    name = "https-everywhere-${version}";
+    version = "5.2.21";
+
+    extid = "https-everywhere-eff@eff.org";
+
+    src = fetchgit {
+      url = "https://git.torproject.org/https-everywhere.git";
+      rev = "refs/tags/${version}";
+      sha256 = "0z9madihh4b4z4blvfmh6w1hsv8afyi0x7b243nciq9r4w55xgfa";
+    };
+
+    nativeBuildInputs = [
+      git
+      libxml2 # xmllint
+      python27
+      python27Packages.lxml
+      rsync
+      zip
+    ];
+
+    unpackPhase = ''
+      cp -dR --no-preserve=mode "$src" src && cd src
+    '';
+
+    buildPhase = ''
+      $shell ./makexpi.sh ${version} --no-recurse
+    '';
+
+    installPhase = ''
+      install -m 444 -D pkg/https-everywhere-$version-eff.xpi "$out/$extid.xpi"
+    '';
+  };
+
+  noscript = stdenv.mkDerivation rec {
+    name = "noscript-${version}";
+    version = "5.0.10";
+
+    extid = "{73a6fe31-595d-460b-a920-fcc0f8843232}";
+
+    src = fetchurl {
+      url = "https://secure.informaction.com/download/releases/noscript-${version}.xpi";
+      sha256 = "18k5karbaj5mhd9cyjbqgik6044bw88rjalkh6anjanxbn503j6g";
+    };
+
+    unpackPhase = ":";
+
+    installPhase = ''
+      install -m 444 -D $src "$out/$extid.xpi"
+    '';
+  };
+
+  torbutton = stdenv.mkDerivation rec {
+    name = "torbutton-${version}";
+    version = "1.9.8.1";
+
+    extid = "torbutton@torproject.org";
+
+    src = fetchgit {
+      url = "https://git.torproject.org/torbutton.git";
+      rev = "refs/tags/${version}";
+      sha256 = "1amp0c9ky0a7fsa0bcbi6n6ginw7s2g3an4rj7kvc1lxmrcsm65l";
+    };
+
+    nativeBuildInputs = [ zip ];
+
+    unpackPhase = ''
+      cp -dR --no-preserve=mode "$src" src && cd src
+    '';
+
+    buildPhase = ''
+      $shell ./makexpi.sh
+    '';
+
+    installPhase = ''
+      install -m 444 -D pkg/torbutton-$version.xpi "$out/$extid.xpi"
+    '';
+  };
+
+  tor-launcher = stdenv.mkDerivation rec {
+    name = "tor-launcher-${version}";
+    version = "0.2.12.3";
+
+    extid = "tor-launcher@torproject.org";
+
+    src = fetchgit {
+      url = "https://git.torproject.org/tor-launcher.git";
+      rev = "refs/tags/${version}";
+      sha256 = "0126x48pjiy2zm4l8jzhk70w24hviaz560ffp4lb9x0ar615bc9q";
+    };
+
+    nativeBuildInputs = [ zip ];
+
+    unpackPhase = ''
+      cp -dR --no-preserve=mode "$src" src && cd src
+    '';
+
+    buildPhase = ''
+      make package
+    '';
+
+    installPhase = ''
+      install -m 444 -D pkg/tor-launcher-$version.xpi "$out/$extid.xpi"
+    '';
+  };
+}
--- a/pkgs/applications/networking/cluster/mesos/default.nix
+++ b/pkgs/applications/networking/cluster/mesos/default.nix
@ -1,9 +1,9 @@
-{ stdenv, lib, makeWrapper, fetchurl, curl, sasl, openssh, autoconf
-, automake, libtool, unzip, gnutar, jdk, maven, python, wrapPython
+{ stdenv, lib, makeWrapper, fetchurl, curl, sasl, openssh
+, unzip, gnutar, jdk, python, wrapPython
 , setuptools, boto, pythonProtobuf, apr, subversion, gzip, systemd
 , leveldb, glog, perf, utillinux, libnl, iproute, openssl, libevent
-, ethtool, coreutils, which, iptables
-, bash
+, ethtool, coreutils, which, iptables, maven
+, bash, autoreconfHook
 }:

 let
@ -21,7 +21,7 @@ let
  });

 in stdenv.mkDerivation rec {
-  version = "1.1.1";
+  version = "1.4.0";
  name = "mesos-${version}";

  enableParallelBuilding = true;
@ -29,7 +29,7 @@ in stdenv.mkDerivation rec {

  src = fetchurl {
    url = "mirror://apache/mesos/${version}/${name}.tar.gz";
-    sha256 = "0f46ebb130d2d4a9732f95d0a71d80c8c5967f3c172b110f2ece316e05922115";
+    sha256 = "0c08kd226nrjwm2z2drpq4vi97h9r8b1xkdvkgh1114fxg7cyvys";
  };

  patches = [
@ -40,11 +40,13 @@ in stdenv.mkDerivation rec {
    # see https://github.com/cstrahan/mesos/tree/nixos-${version}
    ./nixos.patch
  ];
-
+  nativeBuildInputs = [
+    autoreconfHook
+  ];
  buildInputs = [
-    makeWrapper autoconf automake libtool curl sasl jdk maven
+    makeWrapper curl sasl jdk
    python wrapPython boto setuptools leveldb
-    subversion apr glog openssl libevent
+    subversion apr glog openssl libevent maven
  ] ++ lib.optionals stdenv.isLinux [
    libnl
  ];
@ -52,10 +54,6 @@ in stdenv.mkDerivation rec {
  propagatedBuildInputs = [
    pythonProtobuf
  ];
-
-  # note that we *must* statically link libprotobuf.
-  # if we dynamically link the lib, we get these errors:
-  # https://github.com/NixOS/nixpkgs/pull/19064#issuecomment-255082684
  preConfigure = ''
    # https://issues.apache.org/jira/browse/MESOS-6616
    configureFlagsArray+=(
@ -66,13 +64,10 @@ in stdenv.mkDerivation rec {
    # <sys/types.h> instead of <sys/sysmacros.h>
    sed 1i'#include <sys/sysmacros.h>' -i src/linux/fs.cpp
    sed 1i'#include <sys/sysmacros.h>' -i src/slave/containerizer/mesos/isolators/gpu/isolator.cpp
-
    substituteInPlace 3rdparty/stout/include/stout/os/posix/chown.hpp \
      --subst-var-by chown ${coreutils}/bin/chown

    substituteInPlace 3rdparty/stout/Makefile.am \
-      --replace "-lprotobuf" \
-                "${pythonProtobuf.protobuf}/lib/libprotobuf.so"

    substituteInPlace 3rdparty/stout/include/stout/os/posix/fork.hpp \
      --subst-var-by sh ${bash}/bin/bash
@ -99,8 +94,6 @@ in stdenv.mkDerivation rec {
      --subst-var-by mesos-resolve $out/bin/mesos-resolve

    substituteInPlace src/python/native_common/ext_modules.py.in \
-      --replace "-lprotobuf" \
-                "${pythonProtobuf.protobuf}/lib/libprotobuf.so"

    substituteInPlace src/slave/containerizer/mesos/isolators/gpu/volume.cpp \
      --subst-var-by cp    ${coreutils}/bin/cp \
@ -124,8 +117,6 @@ in stdenv.mkDerivation rec {

    substituteInPlace src/Makefile.am \
      --subst-var-by mavenRepo ${mavenRepo} \
-      --replace "-lprotobuf" \
-                "${pythonProtobuf.protobuf}/lib/libprotobuf.so"

  '' + lib.optionalString stdenv.isLinux ''

@ -179,7 +170,7 @@ in stdenv.mkDerivation rec {
    "--enable-libevent"
    "--with-libevent=${libevent.dev}"
    "--with-protobuf=${pythonProtobuf.protobuf}"
-    "PROTOBUF_JAR=${mavenRepo}/com/google/protobuf/protobuf-java/2.6.1/protobuf-java-2.6.1.jar"
+    "PROTOBUF_JAR=${mavenRepo}/com/google/protobuf/protobuf-java/3.3.0/protobuf-java-3.3.0.jar"
  ] ++ lib.optionals stdenv.isLinux [
    "--with-network-isolator"
    "--with-nl=${libnl.dev}"
--- a/pkgs/applications/networking/cluster/mesos/fetch-mesos-deps.sh
+++ b/pkgs/applications/networking/cluster/mesos/fetch-mesos-deps.sh
@ -1127,10 +1127,12 @@ fetchArtifact org/vafer/jdependency/0.7/jdependency-0.7.pom
 fetchArtifact org/vafer/jdependency/0.7/jdependency-0.7.pom.sha1
 fetchArtifact org/vafer/jdependency/0.7/jdependency-0.7.jar
 fetchArtifact org/vafer/jdependency/0.7/jdependency-0.7.jar.sha1
-fetchArtifact com/google/protobuf/protobuf-java/2.6.1/protobuf-java-2.6.1.pom
-fetchArtifact com/google/protobuf/protobuf-java/2.6.1/protobuf-java-2.6.1.pom.sha1
-fetchArtifact com/google/protobuf/protobuf-java/2.6.1/protobuf-java-2.6.1.jar
-fetchArtifact com/google/protobuf/protobuf-java/2.6.1/protobuf-java-2.6.1.jar.sha1
+fetchArtifact com/google/protobuf/protobuf-java/3.3.0/protobuf-java-3.3.0.pom
+fetchArtifact com/google/protobuf/protobuf-java/3.3.0/protobuf-java-3.3.0.pom.sha1
+fetchArtifact com/google/protobuf/protobuf-java/3.3.0/protobuf-java-3.3.0.jar
+fetchArtifact com/google/protobuf/protobuf-java/3.3.0/protobuf-java-3.3.0.jar.sha1
+fetchArtifact com/google/protobuf/protobuf-parent/3.3.0/protobuf-parent-3.3.0.pom
+fetchArtifact com/google/protobuf/protobuf-parent/3.3.0/protobuf-parent-3.3.0.pom.sha1
 fetchArtifact com/google/google/1/google-1.pom
 fetchArtifact com/google/google/1/google-1.pom.sha1
 fetchArtifact com/google/guava/guava/11.0.2/guava-11.0.2.pom
--- a/pkgs/applications/networking/cluster/mesos/mesos-deps.nix
+++ b/pkgs/applications/networking/cluster/mesos/mesos-deps.nix
@ -6,7 +6,7 @@ stdenv.mkDerivation {

  outputHashAlgo = "sha256";
  outputHashMode = "recursive";
-  outputHash = "066ikswavq3l37x1s3pfdncyj77pvpa0kj14ax5dqb9njmsg0s11";
+  outputHash = "10h0qs7svw0cqjkyxs8z6s3qraa8ga920zfrr59rdlanbwg4klly";

  buildInputs = [ curl ];

--- a/pkgs/applications/networking/cluster/mesos/nixos.patch
+++ b/pkgs/applications/networking/cluster/mesos/nixos.patch
@ -1,20 +1,7 @@
-diff --git a/3rdparty/stout/include/stout/os/posix/chown.hpp b/3rdparty/stout/include/stout/os/posix/chown.hpp
-index c82e2e574..15d332107 100644
--- a/3rdparty/stout/include/stout/os/posix/chown.hpp
-+++ b/3rdparty/stout/include/stout/os/posix/chown.hpp
-@@ -34,7 +34,7 @@ inline Try<Nothing> chown(
-     // TODO(bmahler): Consider walking the file tree instead. We would need
-     // to be careful to not miss dotfiles.
-     std::string command =
-      "chown -R " + stringify(uid) + ':' + stringify(gid) + " '" + path + "'";
-+      "@chown@ -R " + stringify(uid) + ':' + stringify(gid) + " '" + path + "'";
- 
-     int status = os::system(command);
-     if (status != 0) {
-diff --git a/3rdparty/stout/include/stout/os/posix/fork.hpp b/3rdparty/stout/include/stout/os/posix/fork.hpp
-index a29967dcb..290b98b50 100644
--- a/3rdparty/stout/include/stout/os/posix/fork.hpp
-+++ b/3rdparty/stout/include/stout/os/posix/fork.hpp
+diff --git i/3rdparty/stout/include/stout/os/posix/fork.hpp w/3rdparty/stout/include/stout/os/posix/fork.hpp
+index a29967d..290b98b 100644
+--- i/3rdparty/stout/include/stout/os/posix/fork.hpp
+++ w/3rdparty/stout/include/stout/os/posix/fork.hpp
@@ -369,7 +369,7 @@ private:
     if (exec.isSome()) {
       // Execute the command (via '/bin/sh -c command').
@ -24,11 +11,11 @@ index a29967dcb..290b98b50 100644
       EXIT(EXIT_FAILURE)
         << "Failed to execute '" << command << "': " << os::strerror(errno);
     } else if (wait.isSome()) {
-diff --git a/3rdparty/stout/include/stout/posix/os.hpp b/3rdparty/stout/include/stout/posix/os.hpp
-index c37e64db6..d3d87b7f0 100644
--- a/3rdparty/stout/include/stout/posix/os.hpp
-+++ b/3rdparty/stout/include/stout/posix/os.hpp
-@@ -375,7 +375,7 @@ inline Option<std::string> getenv(const std::string& key)
+diff --git i/3rdparty/stout/include/stout/posix/os.hpp w/3rdparty/stout/include/stout/posix/os.hpp
+index 8511dfd..1e7be01 100644
+--- i/3rdparty/stout/include/stout/posix/os.hpp
+++ w/3rdparty/stout/include/stout/posix/os.hpp
+@@ -366,7 +366,7 @@ inline Try<std::set<pid_t>> pids(Option<pid_t> group, Option<pid_t> session)
 inline Try<Nothing> tar(const std::string& path, const std::string& archive)
 {
   Try<std::string> tarOut =
@ -37,11 +24,11 @@ index c37e64db6..d3d87b7f0 100644
 
   if (tarOut.isError()) {
     return Error("Failed to archive " + path + ": " + tarOut.error());
-diff --git a/src/Makefile.am b/src/Makefile.am
-index 3bcc0f2df..e5cbc57e8 100644
--- a/src/Makefile.am
-+++ b/src/Makefile.am
-@@ -1545,7 +1545,7 @@ if HAS_JAVA
+diff --git i/src/Makefile.am w/src/Makefile.am
+index 68fff14..c572f92 100644
+--- i/src/Makefile.am
+++ w/src/Makefile.am
+@@ -1775,7 +1775,7 @@ if HAS_JAVA
 
 $(MESOS_JAR): $(MESOS_JAR_SOURCE) $(MESOS_JAR_GENERATED) java/mesos.pom
 	@echo "Building mesos-$(PACKAGE_VERSION).jar ..."
@ -50,10 +37,10 @@ index 3bcc0f2df..e5cbc57e8 100644
 
 # Convenience library for JNI bindings.
 # TODO(Charles Reiss): We really should be building the Java library
-diff --git a/src/cli/mesos-scp b/src/cli/mesos-scp
-index a71ab0708..1043d1b3c 100755
--- a/src/cli/mesos-scp
-+++ b/src/cli/mesos-scp
+diff --git i/src/cli/mesos-scp w/src/cli/mesos-scp
+index a71ab07..1043d1b 100755
+--- i/src/cli/mesos-scp
+++ w/src/cli/mesos-scp
@@ -19,7 +19,8 @@ if sys.version_info < (2,6,0):
 
 
@ -64,11 +51,11 @@ index a71ab0708..1043d1b3c 100755
     try:
         process = subprocess.Popen(
             cmd,
-diff --git a/src/common/command_utils.cpp b/src/common/command_utils.cpp
-index 09e805140..90bf65896 100644
--- a/src/common/command_utils.cpp
-+++ b/src/common/command_utils.cpp
-@@ -140,7 +140,7 @@ Future<Nothing> tar(
+diff --git i/src/common/command_utils.cpp w/src/common/command_utils.cpp
+index c50be76..388cc53 100644
+--- i/src/common/command_utils.cpp
+++ w/src/common/command_utils.cpp
+@@ -142,7 +142,7 @@ Future<Nothing> tar(
 
   argv.emplace_back(input);
 
@ -77,7 +64,7 @@ index 09e805140..90bf65896 100644
     .then([]() { return Nothing(); });
 }
 
-@@ -162,7 +162,7 @@ Future<Nothing> untar(
+@@ -164,7 +164,7 @@ Future<Nothing> untar(
     argv.emplace_back(directory.get());
   }
 
@ -86,7 +73,7 @@ index 09e805140..90bf65896 100644
     .then([]() { return Nothing(); });
 }
 
-@@ -170,7 +170,7 @@ Future<Nothing> untar(
+@@ -172,7 +172,7 @@ Future<Nothing> untar(
 Future<string> sha512(const Path& input)
 {
 #ifdef __linux__
@ -95,7 +82,7 @@ index 09e805140..90bf65896 100644
   vector<string> argv = {
     cmd,
     input             // Input file to compute shasum.
-@@ -206,7 +206,7 @@ Future<Nothing> gzip(const Path& input)
+@@ -208,7 +208,7 @@ Future<Nothing> gzip(const Path& input)
     input
   };
 
@ -104,7 +91,7 @@ index 09e805140..90bf65896 100644
     .then([]() { return Nothing(); });
 }
 
-@@ -219,7 +219,7 @@ Future<Nothing> decompress(const Path& input)
+@@ -221,7 +221,7 @@ Future<Nothing> decompress(const Path& input)
     input
   };
 
@ -113,41 +100,45 @@ index 09e805140..90bf65896 100644
     .then([]() { return Nothing(); });
 }
 
-diff --git a/src/launcher/fetcher.cpp b/src/launcher/fetcher.cpp
-index 4456c2813..e22c8fc03 100644
--- a/src/launcher/fetcher.cpp
-+++ b/src/launcher/fetcher.cpp
-@@ -68,13 +68,13 @@ static Try<bool> extract(
+diff --git i/src/launcher/fetcher.cpp w/src/launcher/fetcher.cpp
+index 42980f5..3aebeed 100644
+--- i/src/launcher/fetcher.cpp
+++ w/src/launcher/fetcher.cpp
+@@ -80,17 +80,17 @@ static Try<bool> extract(
       strings::endsWith(sourcePath, ".tar.bz2") ||
       strings::endsWith(sourcePath, ".txz") ||
       strings::endsWith(sourcePath, ".tar.xz")) {
-    command = "tar -C '" + destinationDirectory + "' -xf";
-+    command = "@tar@ -C '" + destinationDirectory + "' -xf";
+-    command = {"tar", "-C", destinationDirectory, "-xf", sourcePath};
+    command = {"@tar@", "-C", destinationDirectory, "-xf", sourcePath};
   } else if (strings::endsWith(sourcePath, ".gz")) {
     string pathWithoutExtension = sourcePath.substr(0, sourcePath.length() - 3);
     string filename = Path(pathWithoutExtension).basename();
-    command = "gzip -dc > '" + destinationDirectory + "/" + filename + "' <";
-+    command = "@gzip@ -dc > '" + destinationDirectory + "/" + filename + "' <";
+     string destinationPath = path::join(destinationDirectory, filename);
+ 
+-    command = {"gunzip", "-d", "-c"};
+    command = {"@gunzip@", "-d", "-c"};
+     in = Subprocess::PATH(sourcePath);
+     out = Subprocess::PATH(destinationPath);
   } else if (strings::endsWith(sourcePath, ".zip")) {
-    command = "unzip -o -d '" + destinationDirectory + "'";
-+    command = "@unzip@ -o -d '" + destinationDirectory + "'";
+-    command = {"unzip", "-o", "-d", destinationDirectory, sourcePath};
+    command = {"@unzip@", "-o", "-d", destinationDirectory, sourcePath};
   } else {
     return false;
   }
-@@ -162,7 +162,7 @@ static Try<string> copyFile(
+@@ -193,7 +193,7 @@ static Try<string> copyFile(
     const string& sourcePath,
     const string& destinationPath)
 {
-  const string command = "cp '" + sourcePath + "' '" + destinationPath + "'";
-+  const string command = "@cp@ '" + sourcePath + "' '" + destinationPath + "'";
+-  int status = os::spawn("cp", {"cp", sourcePath, destinationPath});
+  int status = os::spawn("cp", {"@cp@", sourcePath, destinationPath});
 
-   LOG(INFO) << "Copying resource with command:" << command;
- 
-diff --git a/src/linux/perf.cpp b/src/linux/perf.cpp
-index aa31982eb..8b5331b17 100644
--- a/src/linux/perf.cpp
-+++ b/src/linux/perf.cpp
-@@ -127,7 +127,7 @@ private:
+   if (status == -1) {
+     return ErrnoError("Failed to copy '" + sourcePath + "'");
+diff --git i/src/linux/perf.cpp w/src/linux/perf.cpp
+index b301e25..356a2cf 100644
+--- i/src/linux/perf.cpp
+++ w/src/linux/perf.cpp
+@@ -128,7 +128,7 @@ private:
     // NOTE: The supervisor childhook places perf in its own process group
     // and will kill the perf process when the parent dies.
     Try<Subprocess> _perf = subprocess(
@ -156,19 +147,10 @@ index aa31982eb..8b5331b17 100644
         argv,
         Subprocess::PIPE(),
         Subprocess::PIPE(),
-@@ -319,7 +319,7 @@ bool valid(const set<string>& events)
-   ostringstream command;
- 
-   // Log everything to stderr which is then redirected to /dev/null.
-  command << "perf stat --log-fd 2";
-+  command << "@perf@ stat --log-fd 2";
-   foreach (const string& event, events) {
-     command << " --event " << event;
-   }
-diff --git a/src/linux/systemd.cpp b/src/linux/systemd.cpp
-index 6318f48fc..394d88d47 100644
--- a/src/linux/systemd.cpp
-+++ b/src/linux/systemd.cpp
+diff --git i/src/linux/systemd.cpp w/src/linux/systemd.cpp
+index 6318f48..394d88d 100644
+--- i/src/linux/systemd.cpp
+++ w/src/linux/systemd.cpp
@@ -196,13 +196,21 @@ bool exists()
   // This is static as the init system should not change while we are running.
   static const bool exists = []() -> bool {
@ -209,10 +191,10 @@ index 6318f48fc..394d88d47 100644
   Try<string> daemonReload = os::shell("systemctl daemon-reload");
   if (daemonReload.isError()) {
     return Error("Failed to reload systemd daemon: " + daemonReload.error());
-diff --git a/src/python/cli/src/mesos/cli.py b/src/python/cli/src/mesos/cli.py
-index f342992e0..354abf443 100644
--- a/src/python/cli/src/mesos/cli.py
-+++ b/src/python/cli/src/mesos/cli.py
+diff --git i/src/python/cli/src/mesos/cli.py w/src/python/cli/src/mesos/cli.py
+index 4a9b558..c08a8b9 100644
+--- i/src/python/cli/src/mesos/cli.py
+++ w/src/python/cli/src/mesos/cli.py
@@ -40,7 +40,7 @@ def resolve(master):
     import subprocess
 
@ -222,10 +204,10 @@ index f342992e0..354abf443 100644
         stdin=None,
         stdout=subprocess.PIPE,
         stderr=subprocess.PIPE,
-diff --git a/src/slave/containerizer/mesos/isolators/docker/volume/isolator.cpp b/src/slave/containerizer/mesos/isolators/docker/volume/isolator.cpp
-index af9f3736b..f8554d414 100644
--- a/src/slave/containerizer/mesos/isolators/docker/volume/isolator.cpp
-+++ b/src/slave/containerizer/mesos/isolators/docker/volume/isolator.cpp
+diff --git i/src/slave/containerizer/mesos/isolators/docker/volume/isolator.cpp w/src/slave/containerizer/mesos/isolators/docker/volume/isolator.cpp
+index 5b630c1..d63ad69 100644
+--- i/src/slave/containerizer/mesos/isolators/docker/volume/isolator.cpp
+++ w/src/slave/containerizer/mesos/isolators/docker/volume/isolator.cpp
@@ -499,7 +499,7 @@ Future<Option<ContainerLaunchInfo>> DockerVolumeIsolatorProcess::_prepare(
     // unsafe arbitrary commands).
     CommandInfo* command = launchInfo.add_pre_exec_commands();
@ -235,11 +217,11 @@ index af9f3736b..f8554d414 100644
     command->add_arguments("mount");
     command->add_arguments("-n");
     command->add_arguments("--rbind");
-diff --git a/src/slave/containerizer/mesos/isolators/filesystem/linux.cpp b/src/slave/containerizer/mesos/isolators/filesystem/linux.cpp
-index df16b8fee..4a17475bd 100644
--- a/src/slave/containerizer/mesos/isolators/filesystem/linux.cpp
-+++ b/src/slave/containerizer/mesos/isolators/filesystem/linux.cpp
-@@ -159,9 +159,9 @@ Try<Isolator*> LinuxFilesystemIsolatorProcess::create(const Flags& flags)
+diff --git i/src/slave/containerizer/mesos/isolators/filesystem/linux.cpp w/src/slave/containerizer/mesos/isolators/filesystem/linux.cpp
+index d7fe9a8..1361a4e 100644
+--- i/src/slave/containerizer/mesos/isolators/filesystem/linux.cpp
+++ w/src/slave/containerizer/mesos/isolators/filesystem/linux.cpp
+@@ -154,9 +154,9 @@ Try<Isolator*> LinuxFilesystemIsolatorProcess::create(const Flags& flags)
       // here because 'create' will only be invoked during
       // initialization.
       Try<string> mount = os::shell(
@ -252,7 +234,7 @@ index df16b8fee..4a17475bd 100644
           workDir->c_str(),
           workDir->c_str(),
           workDir->c_str(),
-@@ -180,8 +180,8 @@ Try<Isolator*> LinuxFilesystemIsolatorProcess::create(const Flags& flags)
+@@ -175,8 +175,8 @@ Try<Isolator*> LinuxFilesystemIsolatorProcess::create(const Flags& flags)
       LOG(INFO) << "Making '" << workDir.get() << "' a shared mount";
 
       Try<string> mount = os::shell(
@ -263,7 +245,7 @@ index df16b8fee..4a17475bd 100644
           workDir->c_str(),
           workDir->c_str());
 
-@@ -404,7 +404,7 @@ Try<vector<CommandInfo>> LinuxFilesystemIsolatorProcess::getPreExecCommands(
+@@ -422,7 +422,7 @@ Try<vector<CommandInfo>> LinuxFilesystemIsolatorProcess::getPreExecCommands(
 
     CommandInfo command;
     command.set_shell(false);
@ -272,7 +254,7 @@ index df16b8fee..4a17475bd 100644
     command.add_arguments("mount");
     command.add_arguments("-n");
     command.add_arguments("--rbind");
-@@ -569,7 +569,7 @@ Try<vector<CommandInfo>> LinuxFilesystemIsolatorProcess::getPreExecCommands(
+@@ -610,7 +610,7 @@ Try<vector<CommandInfo>> LinuxFilesystemIsolatorProcess::getPreExecCommands(
     // TODO(jieyu): Consider the mode in the volume.
     CommandInfo command;
     command.set_shell(false);
@ -281,11 +263,11 @@ index df16b8fee..4a17475bd 100644
     command.add_arguments("mount");
     command.add_arguments("-n");
     command.add_arguments("--rbind");
-diff --git a/src/slave/containerizer/mesos/isolators/filesystem/shared.cpp b/src/slave/containerizer/mesos/isolators/filesystem/shared.cpp
-index a1283e5ee..a918427bf 100644
--- a/src/slave/containerizer/mesos/isolators/filesystem/shared.cpp
-+++ b/src/slave/containerizer/mesos/isolators/filesystem/shared.cpp
-@@ -207,7 +207,7 @@ Future<Option<ContainerLaunchInfo>> SharedFilesystemIsolatorProcess::prepare(
+diff --git i/src/slave/containerizer/mesos/isolators/filesystem/shared.cpp w/src/slave/containerizer/mesos/isolators/filesystem/shared.cpp
+index 927d95b..576dc63 100644
+--- i/src/slave/containerizer/mesos/isolators/filesystem/shared.cpp
+++ w/src/slave/containerizer/mesos/isolators/filesystem/shared.cpp
+@@ -208,7 +208,7 @@ Future<Option<ContainerLaunchInfo>> SharedFilesystemIsolatorProcess::prepare(
     }
 
     launchInfo.add_pre_exec_commands()->set_value(
@ -294,11 +276,11 @@ index a1283e5ee..a918427bf 100644
   }
 
   return launchInfo;
-diff --git a/src/slave/containerizer/mesos/isolators/gpu/isolator.cpp b/src/slave/containerizer/mesos/isolators/gpu/isolator.cpp
-index e3756c920..cfe458b59 100644
--- a/src/slave/containerizer/mesos/isolators/gpu/isolator.cpp
-+++ b/src/slave/containerizer/mesos/isolators/gpu/isolator.cpp
-@@ -355,7 +355,7 @@ Future<Option<ContainerLaunchInfo>> NvidiaGpuIsolatorProcess::_prepare(
+diff --git i/src/slave/containerizer/mesos/isolators/gpu/isolator.cpp w/src/slave/containerizer/mesos/isolators/gpu/isolator.cpp
+index 25636b5..33ec315 100644
+--- i/src/slave/containerizer/mesos/isolators/gpu/isolator.cpp
+++ w/src/slave/containerizer/mesos/isolators/gpu/isolator.cpp
+@@ -401,7 +401,7 @@ Future<Option<ContainerLaunchInfo>> NvidiaGpuIsolatorProcess::_prepare(
     }
 
     launchInfo.add_pre_exec_commands()->set_value(
@ -307,11 +289,11 @@ index e3756c920..cfe458b59 100644
       volume.HOST_PATH() + " " + target);
   }
 
-diff --git a/src/slave/containerizer/mesos/isolators/gpu/volume.cpp b/src/slave/containerizer/mesos/isolators/gpu/volume.cpp
-index 478752f37..ab527f0cd 100644
--- a/src/slave/containerizer/mesos/isolators/gpu/volume.cpp
-+++ b/src/slave/containerizer/mesos/isolators/gpu/volume.cpp
-@@ -281,7 +281,7 @@ Try<NvidiaVolume> NvidiaVolume::create()
+diff --git i/src/slave/containerizer/mesos/isolators/gpu/volume.cpp w/src/slave/containerizer/mesos/isolators/gpu/volume.cpp
+index 536a3c7..e2819dd 100644
+--- i/src/slave/containerizer/mesos/isolators/gpu/volume.cpp
+++ w/src/slave/containerizer/mesos/isolators/gpu/volume.cpp
+@@ -274,7 +274,7 @@ Try<NvidiaVolume> NvidiaVolume::create()
     string path = path::join(hostPath, "bin", binary);
 
     if (!os::exists(path)) {
@ -320,7 +302,7 @@ index 478752f37..ab527f0cd 100644
       Try<string> which = os::shell(command);
 
       if (which.isSome()) {
-@@ -295,7 +295,7 @@ Try<NvidiaVolume> NvidiaVolume::create()
+@@ -288,7 +288,7 @@ Try<NvidiaVolume> NvidiaVolume::create()
                               : "No such file or directory"));
         }
 
@ -329,7 +311,7 @@ index 478752f37..ab527f0cd 100644
         Try<string> cp = os::shell(command);
         if (cp.isError()) {
           return Error("Failed to os::shell '" + command + "': " + cp.error());
-@@ -367,7 +367,7 @@ Try<NvidiaVolume> NvidiaVolume::create()
+@@ -360,7 +360,7 @@ Try<NvidiaVolume> NvidiaVolume::create()
             Path(realpath.get()).basename());
 
         if (!os::exists(libraryPath)) {
@ -338,11 +320,11 @@ index 478752f37..ab527f0cd 100644
           Try<string> cp = os::shell(command);
           if (cp.isError()) {
             return Error("Failed to os::shell '" + command + "':"
-diff --git a/src/slave/containerizer/mesos/isolators/namespaces/pid.cpp b/src/slave/containerizer/mesos/isolators/namespaces/pid.cpp
-index 0d9ec57d9..a177e4476 100644
--- a/src/slave/containerizer/mesos/isolators/namespaces/pid.cpp
-+++ b/src/slave/containerizer/mesos/isolators/namespaces/pid.cpp
-@@ -94,7 +94,7 @@ Future<Option<ContainerLaunchInfo>> NamespacesPidIsolatorProcess::prepare(
+diff --git i/src/slave/containerizer/mesos/isolators/namespaces/pid.cpp w/src/slave/containerizer/mesos/isolators/namespaces/pid.cpp
+index 42bc2e1..2f9066e 100644
+--- i/src/slave/containerizer/mesos/isolators/namespaces/pid.cpp
+++ w/src/slave/containerizer/mesos/isolators/namespaces/pid.cpp
+@@ -131,7 +131,7 @@ Future<Option<ContainerLaunchInfo>> NamespacesPidIsolatorProcess::prepare(
   //
   // TOOD(jieyu): Consider unmount the existing /proc.
   launchInfo.add_pre_exec_commands()->set_value(
@ -351,11 +333,11 @@ index 0d9ec57d9..a177e4476 100644
 
   return launchInfo;
 }
-diff --git a/src/slave/containerizer/mesos/isolators/network/cni/cni.cpp b/src/slave/containerizer/mesos/isolators/network/cni/cni.cpp
-index c87e6715a..6601cd1b3 100644
--- a/src/slave/containerizer/mesos/isolators/network/cni/cni.cpp
-+++ b/src/slave/containerizer/mesos/isolators/network/cni/cni.cpp
-@@ -262,9 +262,9 @@ Try<Isolator*> NetworkCniIsolatorProcess::create(const Flags& flags)
+diff --git i/src/slave/containerizer/mesos/isolators/network/cni/cni.cpp w/src/slave/containerizer/mesos/isolators/network/cni/cni.cpp
+index fc68f04..267b040 100644
+--- i/src/slave/containerizer/mesos/isolators/network/cni/cni.cpp
+++ w/src/slave/containerizer/mesos/isolators/network/cni/cni.cpp
+@@ -205,9 +205,9 @@ Try<Isolator*> NetworkCniIsolatorProcess::create(const Flags& flags)
       // here because 'create' will only be invoked during
       // initialization.
       Try<string> mount = os::shell(
@ -368,7 +350,7 @@ index c87e6715a..6601cd1b3 100644
           rootDir->c_str(),
           rootDir->c_str(),
           rootDir->c_str(),
-@@ -284,8 +284,8 @@ Try<Isolator*> NetworkCniIsolatorProcess::create(const Flags& flags)
+@@ -227,8 +227,8 @@ Try<Isolator*> NetworkCniIsolatorProcess::create(const Flags& flags)
       LOG(INFO) << "Making '" << rootDir.get() << "' a shared mount";
 
       Try<string> mount = os::shell(
@ -379,11 +361,11 @@ index c87e6715a..6601cd1b3 100644
           rootDir->c_str(),
           rootDir->c_str());
 
-diff --git a/src/slave/containerizer/mesos/isolators/network/cni/plugins/port_mapper/port_mapper.cpp b/src/slave/containerizer/mesos/isolators/network/cni/plugins/port_mapper/port_mapper.cpp
-index b470f0c82..6110a43ee 100644
--- a/src/slave/containerizer/mesos/isolators/network/cni/plugins/port_mapper/port_mapper.cpp
-+++ b/src/slave/containerizer/mesos/isolators/network/cni/plugins/port_mapper/port_mapper.cpp
-@@ -303,7 +303,7 @@ Try<Nothing> PortMapper::addPortMapping(
+diff --git i/src/slave/containerizer/mesos/isolators/network/cni/plugins/port_mapper/port_mapper.cpp w/src/slave/containerizer/mesos/isolators/network/cni/plugins/port_mapper/port_mapper.cpp
+index 43cf3e4..94bad8b 100644
+--- i/src/slave/containerizer/mesos/isolators/network/cni/plugins/port_mapper/port_mapper.cpp
+++ w/src/slave/containerizer/mesos/isolators/network/cni/plugins/port_mapper/port_mapper.cpp
+@@ -301,7 +301,7 @@ Try<Nothing> PortMapper::addPortMapping(
       # Check if the `chain` exists in the iptable. If it does not
       # exist go ahead and install the chain in the iptables NAT
       # table.
@ -392,7 +374,7 @@ index b470f0c82..6110a43ee 100644
       if [ $? -ne 0 ]; then
         # NOTE: When we create the chain, there is a possibility of a
         # race due to which a container launch can fail. This can
-@@ -317,25 +317,25 @@ Try<Nothing> PortMapper::addPortMapping(
+@@ -315,25 +315,25 @@ Try<Nothing> PortMapper::addPortMapping(
         # since it can happen only when the chain is created the first
         # time and two commands for creation of the chain are executed
         # simultaneously.
@ -422,7 +404,7 @@ index b470f0c82..6110a43ee 100644
       chain,
       chain,
       chain,
-@@ -362,7 +362,7 @@ Try<Nothing> PortMapper::delPortMapping()
+@@ -360,7 +360,7 @@ Try<Nothing> PortMapper::delPortMapping()
       # The iptables command searches for the DNAT rules with tag
       # "container_id: <CNI_CONTAINERID>", and if it exists goes ahead
       # and deletes it.
@ -431,11 +413,11 @@ index b470f0c82..6110a43ee 100644
       chain,
       getIptablesRuleTag()).get();
 
-diff --git a/src/slave/containerizer/mesos/isolators/network/port_mapping.cpp b/src/slave/containerizer/mesos/isolators/network/port_mapping.cpp
-index 20fb6ab35..46c160977 100644
--- a/src/slave/containerizer/mesos/isolators/network/port_mapping.cpp
-+++ b/src/slave/containerizer/mesos/isolators/network/port_mapping.cpp
-@@ -1393,19 +1393,19 @@ Try<Isolator*> PortMappingIsolatorProcess::create(const Flags& flags)
+diff --git i/src/slave/containerizer/mesos/isolators/network/port_mapping.cpp w/src/slave/containerizer/mesos/isolators/network/port_mapping.cpp
+index 57d4ccd..68c9577 100644
+--- i/src/slave/containerizer/mesos/isolators/network/port_mapping.cpp
+++ w/src/slave/containerizer/mesos/isolators/network/port_mapping.cpp
+@@ -1394,19 +1394,19 @@ Try<Isolator*> PortMappingIsolatorProcess::create(const Flags& flags)
   // Check the availability of a few Linux commands that we will use.
   // We use the blocking os::shell here because 'create' will only be
   // invoked during initialization.
@ -458,7 +440,7 @@ index 20fb6ab35..46c160977 100644
   if (checkCommandIp.isError()) {
     return Error("Check command 'ip' failed: " + checkCommandIp.error());
   }
-@@ -1925,9 +1925,9 @@ Try<Isolator*> PortMappingIsolatorProcess::create(const Flags& flags)
+@@ -1940,9 +1940,9 @@ Try<Isolator*> PortMappingIsolatorProcess::create(const Flags& flags)
     // visible. It's OK to use the blocking os::shell here because
     // 'create' will only be invoked during initialization.
     Try<string> mount = os::shell(
@ -471,7 +453,7 @@ index 20fb6ab35..46c160977 100644
         bindMountRoot->c_str(),
         bindMountRoot->c_str(),
         bindMountRoot->c_str(),
-@@ -1944,8 +1944,8 @@ Try<Isolator*> PortMappingIsolatorProcess::create(const Flags& flags)
+@@ -1959,8 +1959,8 @@ Try<Isolator*> PortMappingIsolatorProcess::create(const Flags& flags)
       // shared mount yet (possibly due to slave crash while preparing
       // the work directory mount). It's safe to re-do the following.
       Try<string> mount = os::shell(
@ -482,7 +464,7 @@ index 20fb6ab35..46c160977 100644
           bindMountRoot->c_str(),
           bindMountRoot->c_str());
 
-@@ -1964,8 +1964,8 @@ Try<Isolator*> PortMappingIsolatorProcess::create(const Flags& flags)
+@@ -1979,8 +1979,8 @@ Try<Isolator*> PortMappingIsolatorProcess::create(const Flags& flags)
           // so that they are in different peer groups.
           if (entry.shared() == bindMountEntry->shared()) {
             Try<string> mount = os::shell(
@ -493,7 +475,7 @@ index 20fb6ab35..46c160977 100644
                 bindMountRoot->c_str(),
                 bindMountRoot->c_str());
 
-@@ -3911,6 +3911,8 @@ Try<Nothing> PortMappingIsolatorProcess::removeHostIPFilters(
+@@ -3927,6 +3927,8 @@ Try<Nothing> PortMappingIsolatorProcess::removeHostIPFilters(
 // TODO(jieyu): Use the Subcommand abstraction to remove most of the
 // logic here. Completely remove this function once we can assume a
 // newer kernel where 'setns' works for mount namespaces.
@ -502,7 +484,7 @@ index 20fb6ab35..46c160977 100644
 string PortMappingIsolatorProcess::scripts(Info* info)
 {
   ostringstream script;
-@@ -3921,7 +3923,7 @@ string PortMappingIsolatorProcess::scripts(Info* info)
+@@ -3937,7 +3939,7 @@ string PortMappingIsolatorProcess::scripts(Info* info)
   // Mark the mount point PORT_MAPPING_BIND_MOUNT_ROOT() as slave
   // mount so that changes in the container will not be propagated to
   // the host.
@ -511,7 +493,7 @@ index 20fb6ab35..46c160977 100644
 
   // Disable IPv6 when IPv6 module is loaded as IPv6 packets won't be
   // forwarded anyway.
-@@ -3929,7 +3931,7 @@ string PortMappingIsolatorProcess::scripts(Info* info)
+@@ -3945,7 +3947,7 @@ string PortMappingIsolatorProcess::scripts(Info* info)
          << " echo 1 > /proc/sys/net/ipv6/conf/all/disable_ipv6\n";
 
   // Configure lo and eth0.
@ -520,7 +502,7 @@ index 20fb6ab35..46c160977 100644
          << " mtu " << hostEth0MTU << " up\n";
 
   // NOTE: This is mostly a kernel issue: in veth_xmit() the kernel
-@@ -3938,12 +3940,12 @@ string PortMappingIsolatorProcess::scripts(Info* info)
+@@ -3954,12 +3956,12 @@ string PortMappingIsolatorProcess::scripts(Info* info)
   // when we receive a packet with a bad checksum. Disabling rx
   // checksum offloading ensures the TCP layer will checksum and drop
   // it.
@ -537,7 +519,7 @@ index 20fb6ab35..46c160977 100644
 
   // Restrict the ephemeral ports that can be used by the container.
   script << "echo " << info->ephemeralPorts.lower() << " "
-@@ -3972,19 +3974,19 @@ string PortMappingIsolatorProcess::scripts(Info* info)
+@@ -3988,19 +3990,19 @@ string PortMappingIsolatorProcess::scripts(Info* info)
   }
 
   // Set up filters on lo and eth0.
@ -561,7 +543,7 @@ index 20fb6ab35..46c160977 100644
          << " protocol ip"
          << " prio " << Priority(IP_FILTER_PRIORITY, NORMAL).get() << " u32"
          << " flowid ffff:0"
-@@ -3995,7 +3997,7 @@ string PortMappingIsolatorProcess::scripts(Info* info)
+@@ -4011,7 +4013,7 @@ string PortMappingIsolatorProcess::scripts(Info* info)
   foreach (const PortRange& range,
            getPortRanges(info->nonEphemeralPorts + info->ephemeralPorts)) {
     // Local traffic inside a container will not be redirected to eth0.
@ -570,7 +552,7 @@ index 20fb6ab35..46c160977 100644
            << " protocol ip"
            << " prio " << Priority(IP_FILTER_PRIORITY, HIGH).get() << " u32"
            << " flowid ffff:0"
-@@ -4004,7 +4006,7 @@ string PortMappingIsolatorProcess::scripts(Info* info)
+@@ -4020,7 +4022,7 @@ string PortMappingIsolatorProcess::scripts(Info* info)
 
     // Traffic going to host loopback IP and ports assigned to this
     // container will be redirected to lo.
@ -579,7 +561,7 @@ index 20fb6ab35..46c160977 100644
            << " protocol ip"
            << " prio " << Priority(IP_FILTER_PRIORITY, NORMAL).get() << " u32"
            << " flowid ffff:0"
-@@ -4016,14 +4018,14 @@ string PortMappingIsolatorProcess::scripts(Info* info)
+@@ -4032,14 +4034,14 @@ string PortMappingIsolatorProcess::scripts(Info* info)
   }
 
   // Do not forward the ICMP packet if the destination IP is self.
@ -596,8 +578,8 @@ index 20fb6ab35..46c160977 100644
          << " protocol ip"
          << " prio " << Priority(ICMP_FILTER_PRIORITY, NORMAL).get() << " u32"
          << " flowid ffff:0"
-@@ -4032,9 +4034,9 @@ string PortMappingIsolatorProcess::scripts(Info* info)
-          << net::IPNetwork::LOOPBACK_V4().address() << "\n";
+@@ -4048,9 +4050,9 @@ string PortMappingIsolatorProcess::scripts(Info* info)
+          << net::IP::Network::LOOPBACK_V4().address() << "\n";
 
   // Display the filters created on eth0 and lo.
 -  script << "tc filter show dev " << eth0
@ -608,7 +590,7 @@ index 20fb6ab35..46c160977 100644
          << " parent " << ingress::HANDLE << "\n";
 
   // If throughput limit for container egress traffic exists, use HTB
-@@ -4046,9 +4048,9 @@ string PortMappingIsolatorProcess::scripts(Info* info)
+@@ -4062,9 +4064,9 @@ string PortMappingIsolatorProcess::scripts(Info* info)
   // throughput. TBF requires other parameters such as 'burst' that
   // HTB already has default values for.
   if (egressRateLimitPerContainer.isSome()) {
@ -620,7 +602,7 @@ index 20fb6ab35..46c160977 100644
            << CONTAINER_TX_HTB_HANDLE << " classid "
            << CONTAINER_TX_HTB_CLASS_ID << " htb rate "
            << egressRateLimitPerContainer.get().bytes() * 8 << "bit\n";
-@@ -4059,12 +4061,12 @@ string PortMappingIsolatorProcess::scripts(Info* info)
+@@ -4075,12 +4077,12 @@ string PortMappingIsolatorProcess::scripts(Info* info)
     // fq_codel, which has a larger buffer and better control on
     // buffer bloat.
     // TODO(cwang): Verity that fq_codel qdisc is available.
@ -636,24 +618,24 @@ index 20fb6ab35..46c160977 100644
   }
 
   return script.str();
-diff --git a/src/slave/containerizer/mesos/isolators/posix/disk.cpp b/src/slave/containerizer/mesos/isolators/posix/disk.cpp
-index db0583386..542586370 100644
--- a/src/slave/containerizer/mesos/isolators/posix/disk.cpp
-+++ b/src/slave/containerizer/mesos/isolators/posix/disk.cpp
-@@ -540,7 +540,7 @@ private:
+diff --git i/src/slave/containerizer/mesos/isolators/posix/disk.cpp w/src/slave/containerizer/mesos/isolators/posix/disk.cpp
+index eb23025..db268ea 100644
+--- i/src/slave/containerizer/mesos/isolators/posix/disk.cpp
+++ w/src/slave/containerizer/mesos/isolators/posix/disk.cpp
+@@ -572,7 +572,7 @@ private:
     // NOTE: The supervisor childhook will watch the parent process and kill
     // the 'du' process in case that the parent die.
     Try<Subprocess> s = subprocess(
 -        "du",
 +        "@du@",
         command,
-         Subprocess::PATH("/dev/null"),
+         Subprocess::PATH(os::DEV_NULL),
         Subprocess::PIPE(),
-diff --git a/src/slave/containerizer/mesos/isolators/volume/image.cpp b/src/slave/containerizer/mesos/isolators/volume/image.cpp
-index 210e67ad0..60b3a15e4 100644
--- a/src/slave/containerizer/mesos/isolators/volume/image.cpp
-+++ b/src/slave/containerizer/mesos/isolators/volume/image.cpp
-@@ -214,7 +214,7 @@ Future<Option<ContainerLaunchInfo>> VolumeImageIsolatorProcess::_prepare(
+diff --git i/src/slave/containerizer/mesos/isolators/volume/image.cpp w/src/slave/containerizer/mesos/isolators/volume/image.cpp
+index 35966aa..b62fc86 100644
+--- i/src/slave/containerizer/mesos/isolators/volume/image.cpp
+++ w/src/slave/containerizer/mesos/isolators/volume/image.cpp
+@@ -231,7 +231,7 @@ Future<Option<ContainerLaunchInfo>> VolumeImageIsolatorProcess::_prepare(
 
     CommandInfo* command = launchInfo.add_pre_exec_commands();
     command->set_shell(false);
@ -662,11 +644,11 @@ index 210e67ad0..60b3a15e4 100644
     command->add_arguments("mount");
     command->add_arguments("-n");
     command->add_arguments("--rbind");
-diff --git a/src/slave/containerizer/mesos/isolators/volume/sandbox_path.cpp b/src/slave/containerizer/mesos/isolators/volume/sandbox_path.cpp
-index 7b976d292..474dcd486 100644
--- a/src/slave/containerizer/mesos/isolators/volume/sandbox_path.cpp
-+++ b/src/slave/containerizer/mesos/isolators/volume/sandbox_path.cpp
-@@ -240,7 +240,7 @@ Future<Option<ContainerLaunchInfo>> VolumeSandboxPathIsolatorProcess::prepare(
+diff --git i/src/slave/containerizer/mesos/isolators/volume/sandbox_path.cpp w/src/slave/containerizer/mesos/isolators/volume/sandbox_path.cpp
+index b321b86..8ed3e78 100644
+--- i/src/slave/containerizer/mesos/isolators/volume/sandbox_path.cpp
+++ w/src/slave/containerizer/mesos/isolators/volume/sandbox_path.cpp
+@@ -265,7 +265,7 @@ Future<Option<ContainerLaunchInfo>> VolumeSandboxPathIsolatorProcess::prepare(
 
       CommandInfo* command = launchInfo.add_pre_exec_commands();
       command->set_shell(false);
@ -675,58 +657,60 @@ index 7b976d292..474dcd486 100644
       command->add_arguments("mount");
       command->add_arguments("-n");
       command->add_arguments("--rbind");
-diff --git a/src/slave/containerizer/mesos/provisioner/backends/copy.cpp b/src/slave/containerizer/mesos/provisioner/backends/copy.cpp
-index 9c5354e5f..a73a9692e 100644
--- a/src/slave/containerizer/mesos/provisioner/backends/copy.cpp
-+++ b/src/slave/containerizer/mesos/provisioner/backends/copy.cpp
-@@ -147,7 +147,7 @@ Future<Nothing> CopyBackendProcess::_provision(
+diff --git i/src/slave/containerizer/mesos/provisioner/backends/copy.cpp w/src/slave/containerizer/mesos/provisioner/backends/copy.cpp
+index 69faa03..01a3ed6 100644
+--- i/src/slave/containerizer/mesos/provisioner/backends/copy.cpp
+++ w/src/slave/containerizer/mesos/provisioner/backends/copy.cpp
+@@ -266,7 +266,7 @@ Future<Nothing> CopyBackendProcess::_provision(
 #endif // __APPLE__ || __FreeBSD__
 
   Try<Subprocess> s = subprocess(
 -      "cp",
 +      "@cp@",
       args,
-       Subprocess::PATH("/dev/null"),
-       Subprocess::PATH("/dev/null"),
-@@ -180,7 +180,7 @@ Future<bool> CopyBackendProcess::destroy(const string& rootfs)
+       Subprocess::PATH(os::DEV_NULL),
+       Subprocess::PATH(os::DEV_NULL),
+@@ -313,7 +313,7 @@ Future<bool> CopyBackendProcess::destroy(const string& rootfs)
   vector<string> argv{"rm", "-rf", rootfs};
 
   Try<Subprocess> s = subprocess(
 -      "rm",
 +      "@rm@",
       argv,
-       Subprocess::PATH("/dev/null"),
+       Subprocess::PATH(os::DEV_NULL),
       Subprocess::FD(STDOUT_FILENO),
-diff --git a/src/uri/fetchers/copy.cpp b/src/uri/fetchers/copy.cpp
-index 2cfef5ab0..8a62f7699 100644
--- a/src/uri/fetchers/copy.cpp
-+++ b/src/uri/fetchers/copy.cpp
-@@ -97,7 +97,7 @@ Future<Nothing> CopyFetcherPlugin::fetch(
-   const vector<string> argv = {"cp", "-a", uri.path(), directory};
+diff --git i/src/uri/fetchers/copy.cpp w/src/uri/fetchers/copy.cpp
+index 17f69be..831b08a 100644
+--- i/src/uri/fetchers/copy.cpp
+++ w/src/uri/fetchers/copy.cpp
+@@ -97,8 +97,8 @@ Future<Nothing> CopyFetcherPlugin::fetch(
+   VLOG(1) << "Copying '" << uri.path() << "' to '" << directory << "'";
 
-   Try<Subprocess> s = subprocess(
-      "cp",
-+      "@cp@",
-       argv,
-       Subprocess::PATH("/dev/null"),
-       Subprocess::PIPE(),
-diff --git a/src/uri/fetchers/curl.cpp b/src/uri/fetchers/curl.cpp
-index 7b746d619..12bbb04df 100644
--- a/src/uri/fetchers/curl.cpp
-+++ b/src/uri/fetchers/curl.cpp
-@@ -107,7 +107,7 @@ Future<Nothing> CurlFetcherPlugin::fetch(
+ #ifndef __WINDOWS__
+-  const char* copyCommand = "cp";
+-  const vector<string> argv = {"cp", "-a", uri.path(), directory};
+  const char* copyCommand = "@cp@";
+  const vector<string> argv = {"@cp@", "-a", uri.path(), directory};
+ #else // __WINDOWS__
+   const char* copyCommand = os::Shell::name;
+   const vector<string> argv =
+diff --git i/src/uri/fetchers/curl.cpp w/src/uri/fetchers/curl.cpp
+index f34daf2..6a50341 100644
+--- i/src/uri/fetchers/curl.cpp
+++ w/src/uri/fetchers/curl.cpp
+@@ -109,7 +109,7 @@ Future<Nothing> CurlFetcherPlugin::fetch(
   };
 
   Try<Subprocess> s = subprocess(
 -      "curl",
 +      "@curl@",
       argv,
-       Subprocess::PATH("/dev/null"),
+       Subprocess::PATH(os::DEV_NULL),
       Subprocess::PIPE(),
-diff --git a/src/uri/fetchers/docker.cpp b/src/uri/fetchers/docker.cpp
-index 3f38dddfb..fd991ee74 100644
--- a/src/uri/fetchers/docker.cpp
-+++ b/src/uri/fetchers/docker.cpp
+diff --git i/src/uri/fetchers/docker.cpp w/src/uri/fetchers/docker.cpp
+index 91db13b..82a7fc4 100644
+--- i/src/uri/fetchers/docker.cpp
+++ w/src/uri/fetchers/docker.cpp
@@ -114,7 +114,7 @@ static Future<http::Response> curl(
 
   // TODO(jieyu): Kill the process if discard is called.
@ -734,14 +718,14 @@ index 3f38dddfb..fd991ee74 100644
 -      "curl",
 +      "@curl@",
       argv,
-       Subprocess::PATH("/dev/null"),
+       Subprocess::PATH(os::DEV_NULL),
       Subprocess::PIPE(),
-@@ -213,7 +213,7 @@ static Future<int> download(
+@@ -229,7 +229,7 @@ static Future<int> download(
 
   // TODO(jieyu): Kill the process if discard is called.
   Try<Subprocess> s = subprocess(
 -      "curl",
 +      "@curl@",
       argv,
-       Subprocess::PATH("/dev/null"),
+       Subprocess::PATH(os::DEV_NULL),
       Subprocess::PIPE(),
--- a/pkgs/applications/science/biology/freebayes/builder.sh
+++ b/pkgs/applications/science/biology/freebayes/builder.sh
@ -1,11 +0,0 @@
-source $stdenv/setup
-
-unpackPhase
-
-cd freebayes-*
-
-make
-
-mkdir -p $out/bin
-cp bin/freebayes bin/bamleftalign $out/bin
-cp scripts/* $out/bin
--- a/pkgs/applications/science/biology/freebayes/default.nix
+++ b/pkgs/applications/science/biology/freebayes/default.nix
@ -1,21 +1,23 @@
-{ stdenv, fetchFromGitHub, cmake, gcc, zlib}:
+{ stdenv, fetchFromGitHub, cmake, gcc, zlib, bzip2, lzma }:

 stdenv.mkDerivation rec {
  name    = "freebayes-${version}";
-  version = "1.1.0";
+  version = "2017-08-23";

  src = fetchFromGitHub {
    name = "freebayes-${version}-src";
    owner  = "ekg";
    repo   = "freebayes";
-    rev    = "refs/tags/v${version}";
-    sha256 = "0xb8aicb36w9mfs1gq1x7mcp3p82kl7i61d162hfncqzg2npg8rr";
+    rev    = "8d2b3a060da473e1f4f89be04edfce5cba63f1d3";
+    sha256 = "0yyrgk2639lz1yvg4jf0ccahnkic31dy77q05pb3i28rjf37v45z";
    fetchSubmodules = true;
  };

-  buildInputs = [ cmake gcc zlib ];
+  buildInputs = [ zlib bzip2 lzma ];

-  builder = ./builder.sh;
+  installPhase = ''
+    install -vD bin/freebayes bin/bamleftalign scripts/* -t $out/bin
+  '';

  meta = with stdenv.lib; {
    description = "Bayesian haplotype-based polymorphism discovery and genotyping";
--- a/pkgs/applications/window-managers/i3/default.nix
+++ b/pkgs/applications/window-managers/i3/default.nix
@ -5,11 +5,11 @@

 stdenv.mkDerivation rec {
  name = "i3-${version}";
-  version = "4.14";
+  version = "4.14.1";

  src = fetchurl {
    url = "http://i3wm.org/downloads/${name}.tar.bz2";
-    sha256 = "1mm5jazwv4dz3k8vl1lfrcw86agpws5k9lmav1ly51qvmzivsfmf";
+    sha256 = "1cazmfbbx6n8c81h6x6pdayq3mxs2ml3adz165z8vapkc72kl1nh";
  };

  nativeBuildInputs = [ which pkgconfig makeWrapper ];
--- a/pkgs/applications/window-managers/i3/gaps.nix
+++ b/pkgs/applications/window-managers/i3/gaps.nix
@ -3,12 +3,12 @@
 i3.overrideDerivation (super : rec {

  name = "i3-gaps-${version}";
-  version = "4.14";
-  releaseDate = "2017-09-04";
+  version = "4.14.1";
+  releaseDate = "2017-09-24";

  src = fetchurl {
    url = "https://github.com/Airblader/i3/archive/${version}.tar.gz";
-    sha256 = "08y2m0afcm8mbzb92qz286fd1hnqfya2pvhpxbgv83sgjcsg6hlr";
+    sha256 = "11fnkg4halplcnannfw3ishzwwbxbnjafmkxsim199jhlyjjd8j7";
  };

  nativeBuildInputs = super.nativeBuildInputs ++ [ autoreconfHook ];
--- a/pkgs/desktops/lxqt/optional/screengrab/default.nix
+++ b/pkgs/desktops/lxqt/optional/screengrab/default.nix
@ -1,13 +1,14 @@
 { stdenv, fetchFromGitHub, cmake, pkgconfig, qtbase, qttools, qtx11extras, qtsvg, kwindowsystem, libqtxdg, xorg }:

 stdenv.mkDerivation rec {
-  name = "screengrab-unstable-2017-02-18";
+  name = "screengrab-${version}";
+  version = "1.97";

  srcs = fetchFromGitHub {
    owner = "QtDesktop";
    repo = "screengrab";
-    rev = "6fc03c70fe132b89f35d4cef2f62c9d804de3b64";
-    sha256 = "1h3rlpmaqxzysaibcw7s5msbrwaxkg6sz7a8xv6cqzjvggv09my0";
+    rev = version;
+    sha256 = "0qhdxnv1pz745qgvdv5x7kyfx9dz9rrq0wxyfimppzxcszv4pl2z";
  };

  nativeBuildInputs = [ cmake pkgconfig ];
--- a/pkgs/development/compilers/tinycc/default.nix
+++ b/pkgs/development/compilers/tinycc/default.nix
@ -2,9 +2,9 @@
 with stdenv.lib;

 let
-  date = "20170911";
-  rev = "870271ea071971002fa556e09e1873db316fa1a9";
-  sha256 = "1a9djm0p7cd5nzqdhch9y48c4wai76x6d4nwx0bj5jz46ws39bs9";
+  date = "20170924";
+  rev = "1443039416dd02750765efde1af35e31c8d41be3";
+  sha256 = "060l0f77hirq3i5bg294gxcszlvyn89ds2q21jwgy3ryrapfbl8i";
  version = "0.9.27pre-${date}";
 in

--- a/pkgs/development/compilers/urweb/default.nix
+++ b/pkgs/development/compilers/urweb/default.nix
@ -1,5 +1,5 @@
 { stdenv, lib, fetchurl, file, openssl, mlton
-, mysql, postgresql, sqlite
+, mysql, postgresql, sqlite, gcc
 }:

 stdenv.mkDerivation rec {
@ -24,8 +24,10 @@ stdenv.mkDerivation rec {
    export MSHEADER="${lib.getDev mysql.client}/include/mysql/mysql.h";
    export SQHEADER="${sqlite.dev}/include/sqlite3.h";

+    export CC="${gcc}/bin/gcc";
    export CCARGS="-I$out/include \
-                   -L${lib.getLib mysql.client}/lib/mysql \
+                   -L${openssl.out}/lib \
+                   -L${lib.getLib mysql.client}/lib \
                   -L${postgresql.lib}/lib \
                   -L${sqlite.out}/lib";
  '';
@ -37,7 +39,7 @@ stdenv.mkDerivation rec {
    description = "Advanced purely-functional web programming language";
    homepage    = "http://www.impredicative.com/ur/";
    license     = stdenv.lib.licenses.bsd3;
-    platforms   = stdenv.lib.platforms.linux;
+    platforms   = stdenv.lib.platforms.linux ++ stdenv.lib.platforms.darwin;
    maintainers = [ stdenv.lib.maintainers.thoughtpolice stdenv.lib.maintainers.sheganinans ];
  };
 }
--- a/pkgs/development/interpreters/php/default.nix
+++ b/pkgs/development/interpreters/php/default.nix
@ -99,12 +99,12 @@ let
        };

        postgresql = {
-          configureFlags = ["--with-pgsql=${postgresql.dev}"];
+          configureFlags = ["--with-pgsql=${postgresql}"];
          buildInputs = [ postgresql ];
        };

        pdo_pgsql = {
-          configureFlags = ["--with-pdo-pgsql=${postgresql.dev}"];
+          configureFlags = ["--with-pdo-pgsql=${postgresql}"];
          buildInputs = [ postgresql ];
        };

--- a/pkgs/development/libraries/gdal/default.nix
+++ b/pkgs/development/libraries/gdal/default.nix
@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
    "--with-png=${libpng.dev}"      # optional
    "--with-poppler=${poppler.dev}" # optional
    "--with-libz=${zlib.dev}"       # optional
-    "--with-pg=${postgresql.dev}/bin/pg_config"
+    "--with-pg=${postgresql}/bin/pg_config"
    "--with-mysql=${mysql.lib.dev}/bin/mysql_config"
    "--with-geotiff=${libgeotiff}"
    "--with-sqlite3=${sqlite.dev}"
--- a/pkgs/development/libraries/glfw/2.x.nix
+++ b/pkgs/development/libraries/glfw/2.x.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchurl, mesa, libX11 }:
+{ stdenv, fetchurl, mesa_glu, mesa_noglu, libX11, libXext }:

 stdenv.mkDerivation rec {
  name = "glfw-2.7.9";
@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
    sha256 = "17c2msdcb7pn3p8f83805h1c216bmdqnbn9hgzr1j8wnwjcpxx6i";
  };

-  buildInputs = [ mesa libX11 ];
+  buildInputs = [ mesa_glu mesa_noglu libX11 libXext ];

  buildPhase = ''
    make x11
--- a/pkgs/development/libraries/glfw/3.x.nix
+++ b/pkgs/development/libraries/glfw/3.x.nix
@ -1,5 +1,4 @@
-{ stdenv, fetchFromGitHub, cmake, mesa, libXrandr, libXi, libXxf86vm, libXfixes, xlibsWrapper
-, libXinerama, libXcursor
+{ stdenv, lib, fetchFromGitHub, cmake, mesa_noglu, libXrandr, libXinerama, libXcursor, libX11
 , darwin, fixDarwinDylibNames
 }:

@ -16,12 +15,15 @@ stdenv.mkDerivation rec {

  enableParallelBuilding = true;

-  buildInputs = [
-    cmake mesa libXrandr libXi libXxf86vm libXfixes xlibsWrapper
-    libXinerama libXcursor
-  ] ++ stdenv.lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [ Cocoa Kernel fixDarwinDylibNames ]);
+  propagatedBuildInputs = [ mesa_noglu ];

-  cmakeFlags = "-DBUILD_SHARED_LIBS=ON";
+  nativeBuildInputs = [ cmake ];
+
+  buildInputs = [
+    libX11 libXrandr libXinerama libXcursor
+  ] ++ lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [ Cocoa Kernel fixDarwinDylibNames ]);
+
+  cmakeFlags = [ "-DBUILD_SHARED_LIBS=ON" ];

  meta = with stdenv.lib; {
    description = "Multi-platform library for creating OpenGL contexts and managing input, including keyboard, mouse, joystick and time";
--- a/pkgs/development/libraries/liboping/default.nix
+++ b/pkgs/development/libraries/liboping/default.nix
@ -1,11 +1,11 @@
 { stdenv, fetchurl, ncurses ? null, perl ? null }:

 stdenv.mkDerivation rec {
-  name = "liboping-1.9.0";
+  name = "liboping-1.10.0";

  src = fetchurl {
    url = "http://verplant.org/liboping/files/${name}.tar.bz2";
-    sha256 = "0c1mdx9ixqypayhm617jjv9kr6y60nh3mnryafjzv23bnn41vfs4";
+    sha256 = "1n2wkmvw6n80ybdwkjq8ka43z2x8mvxq49byv61b52iyz69slf7b";
  };

  buildInputs = [ ncurses perl ];
@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
    '';
    homepage = http://noping.cc/;
    license = licenses.lgpl21;
-    platforms = platforms.linux;
+    platforms = platforms.unix;
    maintainers = [ maintainers.bjornfor ];
  };
 }
--- a/pkgs/development/libraries/opencascade/6.5.nix
+++ b/pkgs/development/libraries/opencascade/6.5.nix
@ -1,47 +0,0 @@
-{stdenv, fetchurl, mesa, tcl, tk, file, libXmu, automake, autoconf, libtool, qt4,
-ftgl, freetype}:
-
-stdenv.mkDerivation rec {
-  name = "opencascade-6.5.5";
-  src = fetchurl {
-    url = http://files.opencascade.com/OCCT/OCC_6.5.5_release/OpenCASCADE655.tgz;
-    sha256 = "1dnik00adfh6dxvn9kgf35yjda8chbi05f71i9119idmmrcapipm";
-  };
-
-  buildInputs = [ mesa tcl tk file libXmu automake autoconf libtool qt4 ftgl freetype ];
-
-  preUnpack = ''
-    sourceRoot=`pwd`/ros
-  '';
-
-  preConfigure = ''
-    sh ./build_configure
-  '';
-
-  # -fpermissive helps building opencascade, although gcc detects a flaw in the code
-  # and reports an error otherwise. Further versions may fix that.
-  NIX_CFLAGS_COMPILE = "-fpermissive"
-  # https://bugzilla.redhat.com/show_bug.cgi?id=902561
-    + " -DUSE_INTERP_RESULT"
-  # https://bugs.freedesktop.org/show_bug.cgi?id=83631
-    + " -DGLX_GLXEXT_LEGACY";
-
-  hardeningDisable = [ "format" ];
-
-  configureFlags = [ "--with-tcl=${tcl}/lib" "--with-tk=${tk}/lib" "--with-qt=${qt4}" "--with-ftgl=${ftgl}" "--with-freetype=${freetype.dev}" ];
-
-  postInstall = ''
-    mv $out/inc $out/include
-    mkdir -p $out/share/doc/${name}
-    cp -R ../doc $out/share/doc/${name}
-  '';
-
-  enableParallelBuilding = true;
-
-  meta = {
-    description = "Open CASCADE Technology, libraries for 3D modeling and numerical simulation";
-    homepage = http://www.opencascade.org/;
-    maintainers = with stdenv.lib.maintainers; [viric];
-    platforms = with stdenv.lib.platforms; linux;
-  };
-}
--- a/pkgs/development/libraries/opencascade/default.nix
+++ b/pkgs/development/libraries/opencascade/default.nix
@ -1,39 +1,22 @@
-{stdenv, fetchurl, mesa, tcl, tk, file, libXmu, cmake, qt4, freetype}:
+{stdenv, fetchurl, mesa, tcl, tk, file, libXmu, cmake, libtool, qt4,
+ftgl, freetype}:

 stdenv.mkDerivation rec {
-  name = "opencascade-6.6.0";
+  name = "opencascade-oce-0.17.2";
  src = fetchurl {
-    url = http://files.opencascade.com/OCCT/OCC_6.6.0_release/OpenCASCADE660.tgz;
-    sha256 = "0q2xn915w9skv9sj74lxnyv9g3b0yi1j04majyzxk6sv4nra97z3";
+    url = https://github.com/tpaviot/oce/archive/OCE-0.17.2.tar.gz;
+    sha256 = "0vpmnb0k5y2f7lpmwx9pg9yfq24zjvnsak5alzacncfm1hv9b6cd";
  };

-  buildInputs = [ cmake mesa tcl tk file libXmu qt4 freetype ];
+  buildInputs = [ mesa tcl tk file libXmu libtool qt4 ftgl freetype cmake ];

-  sourceRoot = "ros/adm/cmake";
-
-  cmakeFlags = [
-    "-D3RDPARTY_TCL_DIR=${tcl}"
-    "-D3RDPARTY_FREETYPE_DIR=${freetype.dev}"
-
-    # Not used on Linux but must be defined during configuration.
-    "-D3RDPARTY_FREETYPE_DLL=${freetype.dev}"
-  ];
+  preConfigure = ''
+    cmakeFlags="$cmakeFlags -DOCE_INSTALL_PREFIX=$out"
+  '';

  # https://bugs.freedesktop.org/show_bug.cgi?id=83631
  NIX_CFLAGS_COMPILE = "-DGLX_GLXEXT_LEGACY";

-  hardeningDisable = [ "format" ];
-
-  preConfigure = ''
-    cmakeFlags="$cmakeFlags -DINSTALL_DIR=$out"
-  '';
-
-  postInstall = ''
-    mv $out/inc $out/include
-    mkdir -p $out/share/doc/${name}
-    cp -R ../../../doc $out/share/doc/${name}
-  '';
-
  enableParallelBuilding = true;

  meta = {
--- a/pkgs/development/libraries/opencascade/oce.nix
+++ b/pkgs/development/libraries/opencascade/oce.nix
@ -1,28 +0,0 @@
-{stdenv, fetchurl, mesa, tcl, tk, file, libXmu, cmake, libtool, qt4,
-ftgl, freetype}:
-
-stdenv.mkDerivation rec {
-  name = "opencascade-oce-0.17.2";
-  src = fetchurl {
-    url = https://github.com/tpaviot/oce/archive/OCE-0.17.2.tar.gz;
-    sha256 = "0vpmnb0k5y2f7lpmwx9pg9yfq24zjvnsak5alzacncfm1hv9b6cd";
-  };
-
-  buildInputs = [ mesa tcl tk file libXmu libtool qt4 ftgl freetype cmake ];
-
-  preConfigure = ''
-    cmakeFlags="$cmakeFlags -DOCE_INSTALL_PREFIX=$out"
-  '';
-
-  # https://bugs.freedesktop.org/show_bug.cgi?id=83631
-  NIX_CFLAGS_COMPILE = "-DGLX_GLXEXT_LEGACY";
-
-  enableParallelBuilding = true;
-
-  meta = {
-    description = "Open CASCADE Technology, libraries for 3D modeling and numerical simulation";
-    homepage = http://www.opencascade.org/;
-    maintainers = with stdenv.lib.maintainers; [viric];
-    platforms = with stdenv.lib.platforms; linux;
-  };
-}
--- a/pkgs/development/python-modules/pyblake2/default.nix
+++ b/pkgs/development/python-modules/pyblake2/default.nix
@ -0,0 +1,24 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+}:
+
+buildPythonPackage rec {
+  pname = "pyblake2";
+  version = "0.9.3";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "626448e1fe1cc01d2197118954bec9f158378577e12686d5b01979f7f0fa2212";
+  };
+
+  # requires setting up sphinx doctest
+  doCheck = false;
+
+  meta = {
+    description = "BLAKE2 hash function extension module";
+    license = lib.licenses.publicDomain;
+    homepage = https://github.com/dchest/pyblake2;
+  };
+}
--- a/pkgs/development/python-modules/requests-toolbelt/default.nix
+++ b/pkgs/development/python-modules/requests-toolbelt/default.nix
@ -0,0 +1,32 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, requests
+, betamax
+, mock
+, pytest
+}:
+
+buildPythonPackage rec {
+  pname = "requests-toolbelt";
+  version = "0.8.0";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "f6a531936c6fa4c6cfce1b9c10d5c4f498d16528d2a54a22ca00011205a187b5";
+  };
+
+  checkInputs = [ betamax mock pytest ];
+  propagatedBuildInputs = [ requests ];
+
+  checkPhase = ''
+    py.test tests
+  '';
+
+  meta = {
+    description = "A toolbelt of useful classes and functions to be used with python-requests";
+    homepage = http://toolbelt.rtfd.org;
+    maintainers = with lib.maintainers; [ matthiasbeyer jgeerds ];
+  };
+}
--- a/pkgs/development/python-modules/twine/default.nix
+++ b/pkgs/development/python-modules/twine/default.nix
@ -0,0 +1,32 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pkginfo
+, requests
+, requests_toolbelt
+, tqdm
+, pyblake2
+}:
+
+buildPythonPackage rec {
+  pname = "twine";
+  version = "1.9.1";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "caa45b7987fc96321258cd7668e3be2ff34064f5c66d2d975b641adca659c1ab";
+  };
+
+  propagatedBuildInputs = [ pkginfo requests requests_toolbelt tqdm pyblake2 ];
+
+  # Requires network
+  doCheck = false;
+
+  meta = {
+    description = "Collection of utilities for interacting with PyPI";
+    homepage = https://github.com/pypa/twine;
+    license = lib.licenses.asl20;
+    maintainer = with lib.maintainers; [ fridh ];
+  };
+}
--- a/pkgs/development/ruby-modules/gem-config/default.nix
+++ b/pkgs/development/ruby-modules/gem-config/default.nix
@ -183,7 +183,7 @@ in

  pg = attrs: {
    buildFlags = [
-      "--with-pg-config=${postgresql.dev}/bin/pg_config"
+      "--with-pg-config=${postgresql}/bin/pg_config"
    ];
  };

--- a/pkgs/misc/emulators/snes9x-gtk/default.nix
+++ b/pkgs/misc/emulators/snes9x-gtk/default.nix
@ -1,26 +1,26 @@
-{stdenv, fetchurl, nasm, SDL, zlib, libpng, ncurses, mesa, intltool, gtk2, pkgconfig, libxml2, xlibsWrapper, libpulseaudio}:
+{ stdenv, fetchFromGitHub, autoreconfHook, intltool, pkgconfig
+, SDL, zlib, gtk2, libxml2, libXv }:

 stdenv.mkDerivation rec {
  name = "snes9x-gtk-${version}";
-  version = "1.53";
+  version = "1.54.1";

-  src = fetchurl {
-    url = "http://files.ipherswipsite.com/snes9x/snes9x-${version}-src.tar.bz2";
-    sha256 = "9f7c5d2d0fa3fe753611cf94e8879b73b8bb3c0eab97cdbcb6ab7376efa78dc3";
+  src = fetchFromGitHub {
+    owner = "snes9xgit";
+    repo = "snes9x";
+    rev = version;
+    sha256 = "10fqm7lk36zj2gnx0ypps0nlws923f60b0zj4pmq9apawgx8k6rw";
  };

-  buildInputs = [ nasm SDL zlib libpng ncurses mesa intltool gtk2 pkgconfig libxml2 xlibsWrapper libpulseaudio];
+  nativeBuildInputs = [ autoreconfHook intltool pkgconfig ];

-  sourceRoot = "snes9x-${version}-src/gtk";
+  sourceRoot = "snes9x-${version}-src";
+  preAutoreconf = "cd gtk; intltoolize";  
+    
+  buildInputs = [ SDL zlib gtk2 libxml2 libXv ];
+  installPhase = "install -Dt $out/bin snes9x-gtk";

-  configureFlags = "--prefix=$out/ --with-opengl";
-
-  installPhase = ''
-    mkdir -p $out/bin
-    cp snes9x-gtk $out/bin
-  '';
-
-  meta = {
+  meta = with stdenv.lib; {
    description = "A portable, freeware Super Nintendo Entertainment System (SNES) emulator";
    longDescription = ''
      Snes9x is a portable, freeware Super Nintendo Entertainment System (SNES)
@ -28,9 +28,9 @@ stdenv.mkDerivation rec {
      and Super Famicom Nintendo game systems on your PC or Workstation; which
      includes some real gems that were only ever released in Japan.
    '';
-    license = stdenv.lib.licenses.lgpl2;
-    maintainers = [ stdenv.lib.maintainers.qknight ];
+    license = licenses.lgpl2;
+    maintainers = with maintainers; [ qknight ];
    homepage = http://www.snes9x.com/;
-    platforms = stdenv.lib.platforms.linux;
+    platforms = platforms.linux;
  };
 }
--- a/pkgs/os-specific/linux/bluez/default.nix
+++ b/pkgs/os-specific/linux/bluez/default.nix
@ -1,5 +1,5 @@
 { stdenv, fetchurl, pkgconfig, dbus, glib, alsaLib,
-  pythonPackages, readline, libsndfile, udev, libical,
+  pythonPackages, readline, udev, libical,
  systemd, enableWiimote ? false }:

 assert stdenv.isLinux;
@ -15,13 +15,10 @@ stdenv.mkDerivation rec {
  pythonPath = with pythonPackages;
    [ dbus pygobject2 pygobject3 recursivePthLoader ];

-  buildInputs =
-    [ pkgconfig dbus glib alsaLib pythonPackages.python pythonPackages.wrapPython
-      readline libsndfile udev libical
-      # Disables GStreamer; not clear what it gains us other than a
-      # zillion extra dependencies.
-      # gstreamer gst-plugins-base
-    ];
+  buildInputs = [
+    pkgconfig dbus glib alsaLib pythonPackages.python pythonPackages.wrapPython
+    readline udev libical
+  ];

  outputs = [ "out" "dev" "test" ];

@ -51,10 +48,8 @@ stdenv.mkDerivation rec {

  makeFlags = "rulesdir=$(out)/lib/udev/rules.d";

-  # FIXME: Move these into a separate package to prevent Bluez from
-  # depending on Python etc.
  postInstall = ''
-    mkdir -p $test/test
+    mkdir -p $test/{bin,test}
    cp -a test $test
    pushd $test/test
    for a in \
@ -65,7 +60,7 @@ stdenv.mkDerivation rec {
            list-devices \
            monitor-bluetooth \
            ; do
-      ln -s ../test/$a $out/bin/bluez-$a
+      ln -s ../test/$a $test/bin/bluez-$a
    done
    popd
    wrapPythonProgramsIn $test/test "$test/test $pythonPath"
--- a/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/default.nix
@ -6,11 +6,11 @@ in
 {
  # Policy: use the highest stable version as the default (on our master).
  stable = generic {
-    version = "384.69";
-    sha256_32bit = "1zgq9vji0ndadvql3bsnd0a6p7pq0vr8d0yb5c8b22i2h9smhw1v";
-    sha256_64bit = "0l3np6cx2rnb2q89zbnq4lvfcjl2g7i56hxwcb11ggijqm7ridx7";
-    settingsSha256 = "064va75p7dnkhy4hyi9b1gl4wjmrpjksg4cyiwl6n3lkmjnvmnwy";
-    persistencedSha256 = "0ijq25gnihw34qhkba62l5fy6lwkma94i0fxp8084byyilm3fwms";
+    version = "384.90";
+    sha256_32bit = "0mq0h7g56m9zvr42ipy2664ph922754l0pdp8wpsmzfpkzg6g9lp";
+    sha256_64bit = "1ggylpzw1j217w64rspw4fhvq25wz0la0hhy0b1kxjpwy8h6ipqd";
+    settingsSha256 = "023jfbsxsbkjk78i9i6wd0sybv5hib2d7mfvy635w3anjcrsk5il";
+    persistencedSha256 = "166ya8pnv4frvrsp0x5zkg8li85vipags03wy6dlf8s940al92z2";
  };

  beta = generic {
--- a/pkgs/servers/dgraph/default.nix
+++ b/pkgs/servers/dgraph/default.nix
@ -2,7 +2,7 @@

 buildGoPackage rec {
  name = "dgraph-${version}";
-  version = "0.8.1";
+  version = "0.8.2";

  goPackagePath = "github.com/dgraph-io/dgraph";

@ -10,13 +10,13 @@ buildGoPackage rec {
    owner = "dgraph-io";
    repo = "dgraph";
    rev = "v${version}";
-    sha256 = "1gls2pvgcmd364x84gz5fafs7pwkll4k352rg1lmv70wvzyydsdr";
+    sha256 = "0zc5bda8m2srjbk0gy1nnm0bya8if0kmk1szqr1qv3xifdzmi4nf";
  };

  extraOutputsToInstall = [ "dashboard" ];

  goDeps = ./deps.nix;
-  subPackages = [ "cmd/dgraph" "cmd/dgraphloader" ];
+  subPackages = [ "cmd/dgraph" "cmd/dgraphloader" "cmd/bulkloader"];

  # let's move the dashboard to a different output, to prevent $bin from
  # depending on $out
@ -36,6 +36,7 @@ buildGoPackage rec {
    # Removing it fixes cycle between $out and $bin
    install_name_tool -delete_rpath $out/lib $bin/bin/dgraph
    install_name_tool -delete_rpath $out/lib $bin/bin/dgraphloader
+    install_name_tool -delete_rpath $out/lib $bin/bin/bulkloader
  '';
 
  meta = {
--- a/pkgs/servers/dgraph/deps.nix
+++ b/pkgs/servers/dgraph/deps.nix
@ -94,8 +94,8 @@
    fetch = {
      type = "git";
      url = "https://github.com/coreos/etcd";
-      rev = "1ebeef5cbfe69c0dab2bc701ee5307eed7a7d8d2";
-      sha256 = "12lidn1a8nwsk6nlwyfirrxkxhs4lhj53f4cd19xm8w070q0mg19";
+      rev = "9d43462d174c664f5edf313dec0de31e1ef4ed47";
+      sha256 = "0qxqjxhhciaacag1jz2rlncmlgw861ig2yx993ylvfm30jvyj2cj";
    };
  }
  {
@ -112,8 +112,8 @@
    fetch = {
      type = "git";
      url = "https://github.com/dgraph-io/badger";
-      rev = "ad23a425b3c87b8223780cb882bed568ca14b9f0";
-      sha256 = "1xjd05vska1kanmgdhp5cvkn2i6236rqphrc9i4kfjndgwkmas57";
+      rev = "64df7f57d9ee20d7b28de4a3eea90bf8d7310a77";
+      sha256 = "1ikgzn2l62kb238n0wm6s95py5ypv71p09w7zyvzkjf34x675mzz";
    };
  }
  {
@ -139,8 +139,8 @@
    fetch = {
      type = "git";
      url = "https://github.com/golang/geo";
-      rev = "3a42ea109208469f16baf9e090135dd0e82ece5c";
-      sha256 = "1fzlakjj94gv516q7gd9qycn91lij7wmjbdv0vsrh6qnxvgqr8hw";
+      rev = "31fb0106dc4a947e5aaee1fe186e56447f839510";
+      sha256 = "00w4kwm98hrgr3ggfdk1h7qa5gp00z4s0j0iwgwd9rgadb59kb2c";
    };
  }
  {
@ -292,8 +292,8 @@
    fetch = {
      type = "git";
      url = "https://go.googlesource.com/text";
-      rev = "836efe42bb4aa16aaa17b9c155d8813d336ed720";
-      sha256 = "11s7bjk0karl1lx8v4n6dvdnsh702x4f2qlmnqac2qdz8hdswmi1";
+      rev = "1cbadb444a806fd9430d14ad08967ed91da4fa0a";
+      sha256 = "0ih9ysagh4ylj08393497sscf3yziybc6acg4mrh0wa7mld75j56";
    };
  }
  {
@ -301,8 +301,8 @@
    fetch = {
      type = "git";
      url = "https://github.com/google/go-genproto";
-      rev = "b0a3dcfcd1a9bd48e63634bd8802960804cf8315";
-      sha256 = "0lkj73lyr4dzj2pxgmild0i1bl6kdgrxa3c8m44j5ms537pyxcpr";
+      rev = "1e559d0a00eef8a9a43151db4665280bd8dd5886";
+      sha256 = "1dfm8zd9mif1aswks79wgyi7n818s5brbdnnrrlg79whfhaf20hd";
    };
  }
  {
@ -310,8 +310,8 @@
    fetch = {
      type = "git";
      url = "https://github.com/grpc/grpc-go";
-      rev = "2bb318258959db281674bc6fd67b5167b7ff0d65";
-      sha256 = "1g8ir87ksr8549801vdgb0n6rmxws05ky50bkgjv86370h146cqm";
+      rev = "f92cdcd7dcdc69e81b2d7b338479a19a8723cfa3";
+      sha256 = "1li8rn2s4f8qc77npamlm2ijin44scb8vvd8c4cr0l7za2m89jfn";
    };
  }
  {
--- a/pkgs/servers/search/elasticsearch/5.x.nix
+++ b/pkgs/servers/search/elasticsearch/5.x.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchurl, elk5Version, makeWrapper, jre, utillinux, getopt }:
+{ stdenv, fetchurl, elk5Version, makeWrapper, jre_headless, utillinux, getopt }:

 with stdenv.lib;

@ -13,7 +13,7 @@ stdenv.mkDerivation rec {

  patches = [ ./es-home-5.x.patch ./es-classpath-5.x.patch ];

-  buildInputs = [ makeWrapper jre ] ++
+  buildInputs = [ makeWrapper jre_headless ] ++
    (if (!stdenv.isDarwin) then [utillinux] else [getopt]);

  installPhase = ''
@ -27,10 +27,10 @@ stdenv.mkDerivation rec {
      ${if (!stdenv.isDarwin)
        then ''--prefix PATH : "${utillinux}/bin/"''
        else ''--prefix PATH : "${getopt}/bin"''} \
-      --set JAVA_HOME "${jre}" \
+      --set JAVA_HOME "${jre_headless}" \
      --set ES_JVM_OPTIONS "$out/config/jvm.options"

-    wrapProgram $out/bin/elasticsearch-plugin --set JAVA_HOME "${jre}"
+    wrapProgram $out/bin/elasticsearch-plugin --set JAVA_HOME "${jre_headless}"
  '';

  meta = {
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@ -11,7 +11,7 @@ let
      inherit sha256;
    };

-    outputs = [ "out" "dev" "lib" "doc" "man" ];
+    outputs = [ "out" "lib" "doc" "man" ];
    setOutputFlags = false; # $out retains configureFlags :-/

    buildInputs =
@ -46,16 +46,18 @@ let
      let path = if atLeast "9.6" then "src/common/config_info.c" else "src/bin/pg_config/pg_config.c"; in
        ''
          # Hardcode the path to pgxs so pg_config returns the path in $out
-          substituteInPlace "${path}" --replace HARDCODED_PGXS_PATH $dev/lib
+          substituteInPlace "${path}" --replace HARDCODED_PGXS_PATH $out/lib
        '';

    postInstall =
      ''
-        moveToOutput "bin/pg_config" "$dev"
-        moveToOutput "lib/pgxs" "$dev" # looks strange, but not deleting it
+        moveToOutput "lib/pgxs" "$out" # looks strange, but not deleting it
        moveToOutput "lib/*.a" "$out"
        moveToOutput "lib/libecpg*" "$out"

+        # Prevent a retained dependency on gcc-wrapper.
+        substituteInPlace "$out/lib/pgxs/src/Makefile.global" --replace ${stdenv.cc}/bin/ld ld
+
        # Remove static libraries in case dynamic are available.
        for i in $out/lib/*.a; do
          name="$(basename "$i")"
--- a/pkgs/servers/udpt/default.nix
+++ b/pkgs/servers/udpt/default.nix
@ -1,8 +1,8 @@
-{ stdenv, fetchFromGitHub, boost, sqlite }:
+{ stdenv, fetchFromGitHub, boost, sqlite, cmake, gtest }:

 stdenv.mkDerivation rec {
  name = "udpt-${version}";
-  version = "2016-02-20"; # v2.0-rc0 with sample config
+  version = "2017-09-27";

  enableParallelBuilding = true;

@ -12,11 +12,21 @@ stdenv.mkDerivation rec {
  src = fetchFromGitHub {
    owner = "naim94a";
    repo = "udpt";
-    rev = "0790558de8b5bb841bb10a9115bbf72c3b4711b5";
-    sha256 = "0rgkjwvnqwbnqy7pm3dk176d3plb5lypaf12533yr0yfzcp6gnzk";
+    rev = "e0dffc83c8ce76b08a41a4abbd5f8065535d534f";
+    sha256 = "187dw96mzgcmh4k9pvfpb7ckbb8d4vlikamr2x8vkpwzgjs3xd6g";
  };

-  buildInputs = [ boost sqlite ];
+  doCheck = true;
+
+  checkPhase = ''
+    runHook preCheck
+
+    make test
+
+    runHook postCheck
+  '';
+
+  buildInputs = [ boost sqlite cmake gtest ];

  postPatch = ''
    # Enabling optimization (implied by fortify hardening) causes htons
@ -27,7 +37,7 @@ stdenv.mkDerivation rec {
  installPhase = ''
    mkdir -p $out/bin $out/etc/
    cp udpt $out/bin
-    cp udpt.conf $out/etc/
+    cp ../udpt.conf $out/etc/
    # without this, the resulting binary is unstripped.
    runHook postInstall
  '';
--- a/pkgs/tools/X11/xwinwrap/default.nix
+++ b/pkgs/tools/X11/xwinwrap/default.nix
@ -0,0 +1,54 @@
+{ stdenv, fetchbzr, x11 }:
+
+let
+  version = "4";
+in
+stdenv.mkDerivation {
+  name = "xwinwrap-${version}";
+
+  src = fetchbzr {
+    url = https://code.launchpad.net/~shantanu-goel/xwinwrap/devel;
+    rev = version;
+    sha256 = "1annhqc71jcgx5zvcy31c1c488ygx4q1ygrwyy2y0ww743smbchw";
+  };
+
+  buildInputs = [
+    x11
+  ];
+
+  buildPhase = if stdenv.system == "x86_64-linux" then ''
+    make all64
+  '' else if stdenv.system == "i686-linux" then ''
+    make all32
+  '' else throw "xwinwrap is not supported on ${stdenv.system}";
+
+  installPhase = ''
+    mkdir -p $out/bin
+    mv */xwinwrap $out/bin
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A utility that allows you to use an animated X window as the wallpaper";
+    longDescription = ''
+      XWinWrap is a small utility written a loooong time ago that allowed you to
+      stick most of the apps to your desktop background. What this meant was you
+      could use an animated screensaver (like glmatrix, electric sheep, etc) or
+      even a movie, and use it as your wallpaper. But only one version of this
+      app was ever released, and it had a few problems, like:
+
+      - Well, sticking didn’t work. So if you did a “minimize all” or “go to
+      desktop” kind of thing, your “wallpaper” got minimized as well.
+
+      - The geometry option didn’t work, so you could not create, e.g., a small
+      matrix window surrounded by your original wallpaper.
+
+      Seeing no-one picking it up, I decided to give it a bit of polish last
+      weekend by fixing the above problems and also add a few features. And here
+      it is, in its new avatar “Shantz XWinWrap”.
+    '';
+    license = licenses.hpnd;
+    homepage = https://shantanugoel.com/2008/09/03/shantz-xwinwrap/;
+    maintainers = with maintainers; [ infinisil ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/tools/backup/bacula/default.nix
+++ b/pkgs/tools/backup/bacula/default.nix
@ -12,9 +12,9 @@ stdenv.mkDerivation rec {
    # acl relies on attr, which I can't get to build on darwin
    ++ stdenv.lib.optional (!stdenv.isDarwin) acl;

-  configureFlags = [
+  configureFlags = [ 
    "--with-sqlite3=${sqlite.dev}"
-    "--with-postgresql=${postgresql.dev}"
+    "--with-postgresql=${postgresql}"
  ];

  postInstall = ''
--- a/pkgs/tools/misc/hdf5/default.nix
+++ b/pkgs/tools/misc/hdf5/default.nix
@ -1,5 +1,7 @@
 { stdenv
 , fetchurl
+, gcc
+, removeReferencesTo
 , cpp ? false
 , gfortran ? null
 , zlib ? null
@ -30,6 +32,8 @@ stdenv.mkDerivation rec {
    inherit mpi;
  };

+  nativeBuildInputs = [ removeReferencesTo ];
+
  buildInputs = []
    ++ optional (gfortran != null) gfortran
    ++ optional (szip != null) szip;
@ -47,6 +51,10 @@ stdenv.mkDerivation rec {

  patches = [./bin-mv.patch];

+  postInstall = ''
+    find "$out" -type f -exec remove-references-to -t ${stdenv.cc} '{}' +
+  '';
+
  meta = {
    description = "Data model, library, and file format for storing and managing data";
    longDescription = ''
--- a/pkgs/tools/misc/ipxe/default.nix
+++ b/pkgs/tools/misc/ipxe/default.nix
@ -1,8 +1,8 @@
 { stdenv, fetchgit, perl, cdrkit, syslinux, xz, openssl }:

 let
-  date = "20160831";
-  rev = "827dd1bfee67daa683935ce65316f7e0f057fe1c";
+  date = "20170922";
+  rev = "74d90b33f8490adcee2026ece18d8411d93b6a39";
 in

 stdenv.mkDerivation {
@ -12,7 +12,7 @@ stdenv.mkDerivation {

  src = fetchgit {
    url = git://git.ipxe.org/ipxe.git;
-    sha256 = "11w8b0vln3skfn8r1cvzngslz12njdkwmnacyq3qffb96k2dn2ww";
+    sha256 = "12ijrq451fj2x3i7c7xjlxig5mwbhmgzqjvmfl2sza953vfbk4vw";
    inherit rev;
  };

@ -40,6 +40,10 @@ stdenv.mkDerivation {
  installPhase = ''
    mkdir -p $out
    cp bin/ipxe.dsk bin/ipxe.usb bin/ipxe.iso bin/ipxe.lkrn bin/undionly.kpxe $out
+
+    # Some PXE constellations especially with dnsmasq are looking for the file with .0 ending
+    # let's provide it as a symlink to be compatible in this case.
+    ln -s undionly.kpxe $out/undionly.kpxe.0
  '';

  meta = with stdenv.lib;
--- a/pkgs/tools/misc/youtube-dl/default.nix
+++ b/pkgs/tools/misc/youtube-dl/default.nix
@ -15,11 +15,11 @@ with stdenv.lib;
 buildPythonApplication rec {

  name = "youtube-dl-${version}";
-  version = "2017.09.15";
+  version = "2017.09.24";

  src = fetchurl {
    url = "https://yt-dl.org/downloads/${version}/${name}.tar.gz";
-    sha256 = "1kw8pqzvhbpyxcz2jb692j4cgzd3vmd81mra09xvpzkq974jkx7f";
+    sha256 = "0j2m75j0d1n83i7jzpkcj7ir0bkskj024j9b0yi88zipcg740wbx";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/tools/networking/kea/default.nix
+++ b/pkgs/tools/networking/kea/default.nix
@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
  configureFlags = [
    "--localstatedir=/var"
    "--with-botan-config=${botan}/bin/botan-config-1.10"
-    "--with-dhcp-pgsql=${postgresql.dev}/bin/pg_config"
+    "--with-dhcp-pgsql=${postgresql}/bin/pg_config"
    "--with-dhcp-mysql=${mysql.client.dev}/bin/mysql_config"
  ];

--- a/pkgs/tools/networking/lftp/default.nix
+++ b/pkgs/tools/networking/lftp/default.nix
@ -1,8 +1,8 @@
-{ stdenv, fetchurl, gnutls, pkgconfig, readline, zlib, libidn2, gmp, libiconv, gettext }:
+{ stdenv, fetchurl, gnutls, pkgconfig, readline, zlib, libidn2, gmp, libiconv, libunistring, gettext }:

 stdenv.mkDerivation rec {
  name = "lftp-${version}";
-  version = "4.8.0";
+  version = "4.8.2";

  src = fetchurl {
    urls = [
@ -10,12 +10,12 @@ stdenv.mkDerivation rec {
      "ftp://ftp.st.ryukoku.ac.jp/pub/network/ftp/lftp/${name}.tar.bz2"
      "http://lftp.yar.ru/ftp/old/${name}.tar.bz2"
      ];
-    sha256 = "0z2432zxzg808swi72yak9kia976qrjj030grk0v4p54mcib3s34";
+    sha256 = "0a4sp9khqgny1md0b2c9vvg4c7sz0g31w3sfdslxw7dsvijin3mn";
  };

  nativeBuildInputs = [ pkgconfig ];

-  buildInputs = [ gnutls readline zlib libidn2 gmp libiconv ]
+  buildInputs = [ gnutls readline zlib libidn2 gmp libiconv libunistring ]
    ++ stdenv.lib.optional stdenv.isDarwin gettext;

  hardeningDisable = stdenv.lib.optional stdenv.isDarwin "format";
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -5157,6 +5157,8 @@ with pkgs;

  xwinmosaic = callPackage ../tools/X11/xwinmosaic {};

+  xwinwrap = callPackage ../tools/X11/xwinwrap {};
+
  yaft = callPackage ../applications/misc/yaft { };

  yarn = callPackage ../development/tools/yarn  { };
@ -9906,17 +9908,9 @@ with pkgs;

  openbabel = callPackage ../development/libraries/openbabel { };

-  opencascade = callPackage ../development/libraries/opencascade {
-    tcl = tcl-8_5;
-    tk = tk-8_5;
-  };
+  opencascade = callPackage ../development/libraries/opencascade { };

-  opencascade_6_5 = callPackage ../development/libraries/opencascade/6.5.nix {
-    automake = automake111x;
-    ftgl = ftgl212;
-  };
-
-  opencascade_oce = callPackage ../development/libraries/opencascade/oce.nix { };
+  opencascade_oce = opencascade;

  opencl-headers = callPackage ../development/libraries/opencl-headers { };

@ -11123,6 +11117,10 @@ with pkgs;
    go = go_1_8;
  };

+  buildGo19Package = callPackage ../development/go-modules/generic {
+    go = go_1_9;
+  };
+
  buildGoPackage = buildGo18Package;

  go2nix = callPackage ../development/tools/go2nix { };
@ -11684,7 +11682,7 @@ with pkgs;
    libmemcached = null; # Detection is broken upstream
  };

-  postgresql = postgresql95;
+  postgresql = postgresql96;

  inherit (callPackages ../servers/sql/postgresql { })
    postgresql93
@ -14546,7 +14544,6 @@ with pkgs;

  freecad = callPackage ../applications/graphics/freecad {
    boost = boost155;
-    opencascade = opencascade_oce;
  };

  freemind = callPackage ../applications/misc/freemind { };
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -7156,6 +7156,8 @@ in {

  pycassa = callPackage ../development/python-modules/pycassa { };

+  pyblake2 = callPackage ../development/python-modules/pyblake2 { };
+
  pybluez = buildPythonPackage rec {
    version = "unstable-20160819";
    pname = "pybluez";
@ -18428,26 +18430,8 @@ in {

  requests_oauthlib = callPackage ../development/python-modules/requests-oauthlib.nix { };

-  requests_toolbelt = buildPythonPackage rec {
-    version = "0.7.1";
-    name = "requests-toolbelt-${version}";
-
-    src = pkgs.fetchurl {
-      url = "https://github.com/sigmavirus24/requests-toolbelt/archive/${version}.tar.gz";
-      sha256 = "16grklnbgcfwqj3f39gw7fc9afi7xlp9gm7x8w6mi81dzhdxf50y";
-    };
-
-    propagatedBuildInputs = with self; [ requests ];
-
-    buildInputs = with self; [ betamax mock pytest ];
-
-    meta = {
-      description = "A toolbelt of useful classes and functions to be used with python-requests";
-      homepage = http://toolbelt.rtfd.org;
-      maintainers = with maintainers; [ matthiasbeyer jgeerds ];
-    };
-
-  };
+  requests-toolbelt = callPackage ../development/python-modules/requests-toolbelt { };
+  requests_toolbelt = self.requests-toolbelt; # Old attr, 2017-09-26

  retry_decorator = buildPythonPackage rec {
    name = "retry_decorator-1.0.0";
@ -21944,27 +21928,7 @@ in {
    };
  };

-  twine = buildPythonPackage rec {
-    name = "twine-${version}";
-    version = "1.8.1";
-
-    src = pkgs.fetchurl {
-      url    = "mirror://pypi/t/twine/${name}.tar.gz";
-      sha256 = "68b663691a947b844f92853c992d42bb68b6333bffc9ab7f661346b001c1da82";
-    };
-
-    propagatedBuildInputs = with self; [ clint pkginfo requests requests_toolbelt ];
-
-    # Requires network
-    doCheck = false;
-
-    meta = {
-      description = "Collection of utilities for interacting with PyPI";
-      homepage = https://github.com/pypa/twine;
-      license = licenses.asl20;
-      maintainer = with maintainers; [ fridh ];
-    };
-  };
+  twine = callPackage ../development/python-modules/twine { };

  twisted = callPackage ../development/python-modules/twisted { };