diff --git a/maintainers/scripts/travis-nox-review-pr.sh b/maintainers/scripts/travis-nox-review-pr.sh
index 8ff2258162fb..5fc932f10d0e 100755
--- a/maintainers/scripts/travis-nox-review-pr.sh
+++ b/maintainers/scripts/travis-nox-review-pr.sh
@@ -48,7 +48,7 @@ while test -n "$1"; do
             echo "=== Fetching Nox from binary cache"
 
             # build nox silently so it's not in the log
-            nix-build "<nixpkgs>" -A nox
+            nix-build "<nixpkgs>" -A nox -A stdenv
             ;;
 
         pr)
diff --git a/nixos/lib/make-disk-image.nix b/nixos/lib/make-disk-image.nix
index 9f8ec4192564..58d0cb38d75f 100644
--- a/nixos/lib/make-disk-image.nix
+++ b/nixos/lib/make-disk-image.nix
@@ -67,40 +67,24 @@ pkgs.vmTools.runInLinuxVM (
       mkdir /mnt
       mount $rootDisk /mnt
 
-      # The initrd expects these directories to exist.
-      mkdir /mnt/dev /mnt/proc /mnt/sys
-
-      mount -o bind /proc /mnt/proc
-      mount -o bind /dev /mnt/dev
-      mount -o bind /sys /mnt/sys
-
-      # Copy all paths in the closure to the filesystem.
-      storePaths=$(perl ${pkgs.pathsFromGraph} /tmp/xchg/closure)
-
-      mkdir -p /mnt/nix/store
-      echo "copying everything (will take a while)..."
-      set -f
-      cp -prd $storePaths /mnt/nix/store/
-
       # Register the paths in the Nix database.
       printRegistration=1 perl ${pkgs.pathsFromGraph} /tmp/xchg/closure | \
-          chroot /mnt ${config.nix.package.out}/bin/nix-store --load-db --option build-users-group ""
+          ${config.nix.package.out}/bin/nix-store --load-db --option build-users-group ""
 
       # Add missing size/hash fields to the database. FIXME:
       # exportReferencesGraph should provide these directly.
-      chroot /mnt ${config.nix.package.out}/bin/nix-store --verify --check-contents
+      ${config.nix.package.out}/bin/nix-store --verify --check-contents --option build-users-group ""
 
-      # Create the system profile to allow nixos-rebuild to work.
-      chroot /mnt ${config.nix.package.out}/bin/nix-env --option build-users-group "" \
-          -p /nix/var/nix/profiles/system --set ${config.system.build.toplevel}
+      # In case the bootloader tries to write to /dev/sda…
+      ln -s vda /dev/xvda
+      ln -s vda /dev/sda
 
-      # `nixos-rebuild' requires an /etc/NIXOS.
-      mkdir -p /mnt/etc
-      touch /mnt/etc/NIXOS
-
-      # `switch-to-configuration' requires a /bin/sh
-      mkdir -p /mnt/bin
-      ln -s ${config.system.build.binsh}/bin/sh /mnt/bin/sh
+      # Install the closure onto the image
+      USER=root ${config.system.build.nixos-install}/bin/nixos-install \
+        --closure ${config.system.build.toplevel} \
+        --no-channel-copy \
+        --no-root-passwd \
+        ${optionalString (!installBootLoader) "--no-bootloader"}
 
       # Install a configuration.nix.
       mkdir -p /mnt/etc/nixos
@@ -108,12 +92,9 @@ pkgs.vmTools.runInLinuxVM (
         cp ${configFile} /mnt/etc/nixos/configuration.nix
       ''}
 
-      # Generate the GRUB menu.
-      ln -s vda /dev/xvda
-      ln -s vda /dev/sda
-      ${optionalString installBootLoader "chroot /mnt ${config.system.build.toplevel}/bin/switch-to-configuration boot"}
+      # Remove /etc/machine-id so that each machine cloning this image will get its own id
+      rm -f /mnt/etc/machine-id
 
-      umount /mnt/proc /mnt/dev /mnt/sys
       umount /mnt
 
       # Do a fsck to make sure resize2fs works.
diff --git a/nixos/modules/installer/tools/nixos-install.sh b/nixos/modules/installer/tools/nixos-install.sh
index 0247925f4144..0c14e51336e5 100644
--- a/nixos/modules/installer/tools/nixos-install.sh
+++ b/nixos/modules/installer/tools/nixos-install.sh
@@ -24,7 +24,7 @@ fi
 # Parse the command line for the -I flag
 extraBuildFlags=()
 chrootCommand=(/run/current-system/sw/bin/bash)
-bootLoader=1
+buildUsersGroup="nixbld"
 
 while [ "$#" -gt 0 ]; do
     i="$1"; shift 1
@@ -43,6 +43,7 @@ while [ "$#" -gt 0 ]; do
             ;;
         --closure)
             closure="$1"; shift 1
+            buildUsersGroup=""
             ;;
         --no-channel-copy)
             noChannelCopy=1
@@ -51,7 +52,7 @@ while [ "$#" -gt 0 ]; do
             noRootPasswd=1
             ;;
         --no-bootloader)
-            bootLoader=0
+            noBootLoader=1
             ;;
         --show-trace)
             extraBuildFlags+=("$i")
@@ -101,8 +102,8 @@ mount -t tmpfs -o "mode=0755" none $mountPoint/run
 mount -t tmpfs -o "mode=0755" none $mountPoint/var/setuid-wrappers
 rm -rf $mountPoint/var/run
 ln -s /run $mountPoint/var/run
-rm -f $mountPoint/etc/{resolv.conf,hosts}
-cp -Lf /etc/resolv.conf /etc/hosts $mountPoint/etc/
+for f in /etc/resolv.conf /etc/hosts; do rm -f $mountPoint/$f; [ -f "$f" ] && cp -Lf $f $mountPoint/etc/; done
+for f in /etc/passwd /etc/group;      do touch $mountPoint/$f; [ -f "$f" ] && mount --rbind -o ro $f $mountPoint/$f; done
 
 cp -Lf "@cacert@" "$mountPoint/tmp/ca-cert.crt"
 export SSL_CERT_FILE=/tmp/ca-cert.crt
@@ -142,7 +143,7 @@ mkdir -m 0755 -p \
     $mountPoint/nix/var/log/nix/drvs
 
 mkdir -m 1775 -p $mountPoint/nix/store
-chown root:nixbld $mountPoint/nix/store
+chown @root_uid@:@nixbld_gid@ $mountPoint/nix/store
 
 
 # There is no daemon in the chroot.
@@ -155,18 +156,13 @@ export LC_ALL=
 export LC_TIME=
 
 
-# Create a temporary Nix config file that causes the nixbld users to
-# be used.
-echo "build-users-group = nixbld" > $mountPoint/tmp/nix.conf # FIXME: remove in Nix 1.8
-binary_caches=$(@perl@/bin/perl -I @nix@/lib/perl5/site_perl/*/* -e 'use Nix::Config; Nix::Config::readConfig; print $Nix::Config::config{"binary-caches"};')
-if test -n "$binary_caches"; then
-    echo "binary-caches = $binary_caches" >> $mountPoint/tmp/nix.conf
-fi
-export NIX_CONF_DIR=/tmp
+# Builds will use users that are members of this group
+extraBuildFlags+=(--option "build-users-group" "$buildUsersGroup")
 
-touch $mountPoint/etc/passwd $mountPoint/etc/group
-mount --bind -o ro /etc/passwd $mountPoint/etc/passwd
-mount --bind -o ro /etc/group $mountPoint/etc/group
+
+# Inherit binary caches from the host
+binary_caches="$(@perl@/bin/perl -I @nix@/lib/perl5/site_perl/*/* -e 'use Nix::Config; Nix::Config::readConfig; print $Nix::Config::config{"binary-caches"};')"
+extraBuildFlags+=(--option "binary-caches" "$binary_caches")
 
 
 # Copy Nix to the Nix store on the target device, unless it's already there.
@@ -247,7 +243,7 @@ ln -sfn /nix/var/nix/profiles/per-user/root/channels $mountPoint/root/.nix-defex
 
 
 # Get rid of the /etc bind mounts.
-umount $mountPoint/etc/passwd $mountPoint/etc/group
+for f in /etc/passwd /etc/group; do [ -f "$f" ] && umount $mountPoint/$f; done
 
 
 # Grub needs an mtab.
@@ -263,16 +259,17 @@ touch $mountPoint/etc/NIXOS
 # a menu default pointing at the kernel/initrd/etc of the new
 # configuration.
 echo "finalising the installation..."
-NIXOS_INSTALL_GRUB="$bootLoader" chroot $mountPoint \
-    /nix/var/nix/profiles/system/bin/switch-to-configuration boot
-
+if [ -z "$noBootLoader" ]; then
+  NIXOS_INSTALL_GRUB=1 chroot $mountPoint \
+      /nix/var/nix/profiles/system/bin/switch-to-configuration boot
+fi
 
 # Run the activation script.
 chroot $mountPoint /nix/var/nix/profiles/system/activate
 
 
 # Ask the user to set a root password.
-if [ -z "$noRootPasswd" ] && [ "$(chroot $mountPoint /run/current-system/sw/bin/sh -l -c "nix-instantiate --eval '<nixpkgs/nixos>' -A config.users.mutableUsers")" = true ] && [ -t 0 ] ; then
+if [ -z "$noRootPasswd" ] && [ -x $mountPoint/var/setuid-wrappers/passwd ] && [ -t 0 ]; then
     echo "setting root password..."
     chroot $mountPoint /var/setuid-wrappers/passwd
 fi
diff --git a/nixos/modules/installer/tools/tools.nix b/nixos/modules/installer/tools/tools.nix
index a55c03bd9528..fc39a653abdc 100644
--- a/nixos/modules/installer/tools/tools.nix
+++ b/nixos/modules/installer/tools/tools.nix
@@ -24,6 +24,8 @@ let
     inherit (pkgs) perl pathsFromGraph rsync;
     nix = config.nix.package.out;
     cacert = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
+    root_uid = config.ids.uids.root;
+    nixbld_gid = config.ids.gids.nixbld;
 
     nixClosure = pkgs.runCommand "closure"
       { exportReferencesGraph = ["refs" config.nix.package.out]; }
diff --git a/nixos/modules/misc/ids.nix b/nixos/modules/misc/ids.nix
index 83b47728639c..31c93028bc52 100644
--- a/nixos/modules/misc/ids.nix
+++ b/nixos/modules/misc/ids.nix
@@ -274,6 +274,7 @@
       gocd-agent = 251;
       gocd-server = 252;
       terraria = 253;
+      mattermost = 254;
 
       # When adding a uid, make sure it doesn't match an existing gid. And don't use uids above 399!
 
@@ -518,6 +519,7 @@
       gocd-agent = 251;
       gocd-server = 252;
       terraria = 253;
+      mattermost = 254;
 
       # When adding a gid, make sure it doesn't match an existing
       # uid. Users and groups with the same name should have equal
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 57a1e10443ab..a5452d1e998d 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -462,6 +462,7 @@
   ./services/ttys/agetty.nix
   ./services/ttys/gpm.nix
   ./services/ttys/kmscon.nix
+  ./services/web-apps/mattermost.nix
   ./services/web-apps/pump.io.nix
   ./services/web-apps/tt-rss.nix
   ./services/web-servers/apache-httpd/default.nix
diff --git a/nixos/modules/services/misc/gitlab.nix b/nixos/modules/services/misc/gitlab.nix
index df19efb55fdf..33163d9789b2 100644
--- a/nixos/modules/services/misc/gitlab.nix
+++ b/nixos/modules/services/misc/gitlab.nix
@@ -41,6 +41,11 @@ let
       namespace: resque:gitlab
   '';
 
+  secretsYml = ''
+    production:
+      db_key_base: ${cfg.secrets.db_key_base}
+  '';
+
   gitlabConfig = {
     # These are the default settings from config/gitlab.example.yml
     production = flip recursiveUpdate cfg.extraConfig {
@@ -313,6 +318,19 @@ in {
         };
       };
 
+      secrets.db_key_base = mkOption {
+        type = types.str;
+        example = "";
+        description = ''
+          The db_key_base secrets is used to encrypt variables in the DB. If
+          you change or lose this key you will be unable to access variables
+          stored in database.
+
+          Make sure the secret is at least 30 characters and all random,
+          no regular words or you'll be exposed to dictionary attacks.
+        '';
+      };
+
       extraConfig = mkOption {
         type = types.attrs;
         default = {};
@@ -467,6 +485,7 @@ in {
         # JSON is a subset of YAML
         ln -fs ${pkgs.writeText "gitlab.yml" (builtins.toJSON gitlabConfig)} ${cfg.statePath}/config/gitlab.yml
         ln -fs ${pkgs.writeText "database.yml" databaseYml} ${cfg.statePath}/config/database.yml
+        ln -fs ${pkgs.writeText "secrets.yml" secretsYml} ${cfg.statePath}/config/secrets.yml
         ln -fs ${pkgs.writeText "unicorn.rb" unicornConfig} ${cfg.statePath}/config/unicorn.rb
 
         chown -R ${cfg.user}:${cfg.group} ${cfg.statePath}/
diff --git a/nixos/modules/services/misc/gitlab.xml b/nixos/modules/services/misc/gitlab.xml
index a8147b3a74f9..83f715a50b43 100644
--- a/nixos/modules/services/misc/gitlab.xml
+++ b/nixos/modules/services/misc/gitlab.xml
@@ -62,6 +62,7 @@ services.gitlab = {
     address = "localhost";
     port = 25;
   };
+  secrets.db_key_base = "ei3eeP1ohsh0uu3ad4YeeMeeheengah3AiZee2ohl4Ooj5mie4Ohl0vishoghaes";
   extraConfig = {
     gitlab = {
       email_from = "gitlab-no-reply@example.com";
@@ -74,6 +75,12 @@ services.gitlab = {
 </programlisting>
 </para>
 
+<para>If you're setting up a new Gitlab instance, generate a new
+<literal>db_key_base</literal> secret to encrypt sensible data in the
+database. If you're restoring an existing Gitlab instance, you must
+specify the <literal>db_key_base</literal> secret from
+<literal>config/secrets.yml</literal> in your Gitlab state folder.</para>
+
 <para>Refer to <xref linkend="ch-options" /> for all available configuration
 options for the <literal>services.gitlab</literal> module.</para>
 
diff --git a/nixos/modules/services/networking/unifi.nix b/nixos/modules/services/networking/unifi.nix
index cb5a88e67aae..a8cff638d3b2 100644
--- a/nixos/modules/services/networking/unifi.nix
+++ b/nixos/modules/services/networking/unifi.nix
@@ -46,6 +46,18 @@ in
       '';
     };
 
+    services.unifi.openPorts = mkOption {
+      type = types.bool;
+      default = true;
+      description = ''
+        Whether or not to open the minimum required ports on the firewall.
+
+        This is necessary to allow firmware upgrades and device discovery to
+        work. For remote login, you should additionally open (or forward) port
+        8443.
+      '';
+    };
+
   };
 
   config = mkIf cfg.enable {
@@ -56,6 +68,19 @@ in
       home = "${stateDir}";
     };
 
+    networking.firewall = mkIf cfg.openPorts {
+      # https://help.ubnt.com/hc/en-us/articles/204910084-UniFi-Change-Default-Ports-for-Controller-and-UAPs
+      allowedTCPPorts = [
+        8080  # Port for UAP to inform controller.
+        8880  # Port for HTTP portal redirect, if guest portal is enabled.
+        8843  # Port for HTTPS portal redirect, ditto.
+      ];
+      allowedUDPPorts = [
+        3478  # UDP port used for STUN.
+        10001 # UDP port used for device discovery.
+      ];
+    };
+
     # We must create the binary directories as bind mounts instead of symlinks
     # This is because the controller resolves all symlinks to absolute paths
     # to be used as the working directory.
@@ -79,9 +104,9 @@ in
       environment.LD_LIBRARY_PATH = with pkgs.stdenv; "${cc.cc.lib}/lib";
 
       preStart = ''
-        # Ensure privacy of state
-        chown unifi "${stateDir}"
-        chmod 0700 "${stateDir}"
+        # Ensure privacy of state and data.
+        chown unifi "${stateDir}" "${stateDir}/data"
+        chmod 0700 "${stateDir}" "${stateDir}/data"
 
         # Create the volatile webapps
         rm -rf "${stateDir}/webapps"
diff --git a/nixos/modules/services/web-apps/mattermost.nix b/nixos/modules/services/web-apps/mattermost.nix
new file mode 100644
index 000000000000..20d21c008c29
--- /dev/null
+++ b/nixos/modules/services/web-apps/mattermost.nix
@@ -0,0 +1,228 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+
+  cfg = config.services.mattermost;
+
+  defaultConfig = builtins.fromJSON (readFile "${pkgs.mattermost}/config/config.json");
+
+  mattermostConf = foldl recursiveUpdate defaultConfig
+    [ { ServiceSettings.SiteURL = cfg.siteUrl;
+        ServiceSettings.ListenAddress = cfg.listenAddress;
+        TeamSettings.SiteName = cfg.siteName;
+        SqlSettings.DriverName = "postgres";
+        SqlSettings.DataSource = "postgres://${cfg.localDatabaseUser}:${cfg.localDatabasePassword}@localhost:5432/${cfg.localDatabaseName}?sslmode=disable&connect_timeout=10";
+      }
+      cfg.extraConfig
+    ];
+
+  mattermostConfJSON = pkgs.writeText "mattermost-config-raw.json" (builtins.toJSON mattermostConf);
+
+in
+
+{
+  options = {
+    services.mattermost = {
+      enable = mkEnableOption "Mattermost chat platform";
+
+      statePath = mkOption {
+        type = types.str;
+        default = "/var/lib/mattermost";
+        description = "Mattermost working directory";
+      };
+
+      siteUrl = mkOption {
+        type = types.str;
+        example = "https://chat.example.com";
+        description = ''
+          URL this Mattermost instance is reachable under, without trailing slash."
+        '';
+      };
+
+      siteName = mkOption {
+        type = types.str;
+        default = "Mattermost";
+        description = "Name of this Mattermost site.";
+      };
+
+      listenAddress = mkOption {
+        type = types.str;
+        default = ":8065";
+        example = "[::1]:8065";
+        description = ''
+          Address and port this Mattermost instance listens to.
+        '';
+      };
+
+      mutableConfig = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether the Mattermost config.json is writeable by Mattermost.
+
+          Most of the settings can be edited in the system console of
+          Mattermost if this option is enabled. A template config using
+          the options specified in services.mattermost will be generated
+          but won't be overwritten on changes or rebuilds.
+
+          If this option is disabled, changes in the system console won't
+          be possible (default). If an config.json is present, it will be
+          overwritten!
+        '';
+      };
+
+      extraConfig = mkOption {
+        type = types.attrs;
+        default = { };
+        description = ''
+          Addtional configuration options as Nix attribute set in config.json schema.
+        '';
+      };
+
+      localDatabaseCreate = mkOption {
+        type = types.bool;
+        default = true;
+        description = ''
+          Create a local PostgreSQL database for Mattermost automatically.
+        '';
+      };
+
+      localDatabaseName = mkOption {
+        type = types.str;
+        default = "mattermost";
+        description = ''
+          Local Mattermost database name.
+        '';
+      };
+
+      localDatabaseUser = mkOption {
+        type = types.str;
+        default = "mattermost";
+        description = ''
+          Local Mattermost database username.
+        '';
+      };
+
+      localDatabasePassword = mkOption {
+        type = types.str;
+        default = "mmpgsecret";
+        description = ''
+          Password for local Mattermost database user.
+        '';
+      };
+
+      user = mkOption {
+        type = types.str;
+        default = "mattermost";
+        description = ''
+          User which runs the Mattermost service.
+        '';
+      };
+
+      group = mkOption {
+        type = types.str;
+        default = "mattermost";
+        description = ''
+          Group which runs the Mattermost service.
+        '';
+      };
+
+      matterircd = {
+        enable = mkEnableOption "Mattermost IRC bridge";
+        parameters = mkOption {
+          type = types.listOf types.str;
+          default = [ ];
+          example = [ "-mmserver chat.example.com" "-bind [::]:6667" ];
+          description = ''
+            Set commandline parameters to pass to matterircd. See
+            https://github.com/42wim/matterircd#usage for more information.
+          '';
+        };
+      };
+    };
+  };
+
+  config = mkMerge [
+    (mkIf cfg.enable {
+      users.extraUsers = optionalAttrs (cfg.user == "mattermost") (singleton {
+        name = "mattermost";
+        group = cfg.group;
+        uid = config.ids.uids.mattermost;
+        home = cfg.statePath;
+      });
+
+      users.extraGroups = optionalAttrs (cfg.group == "mattermost") (singleton {
+        name = "mattermost";
+        gid = config.ids.gids.mattermost;
+      });
+
+      services.postgresql.enable = cfg.localDatabaseCreate;
+
+      # The systemd service will fail to execute the preStart hook
+      # if the WorkingDirectory does not exist
+      system.activationScripts.mattermost = ''
+        mkdir -p ${cfg.statePath}
+      '';
+
+      systemd.services.mattermost = {
+        description = "Mattermost chat platform service";
+        wantedBy = [ "multi-user.target" ];
+        after = [ "network.target" "postgresql.service" ];
+
+        preStart = ''
+          mkdir -p ${cfg.statePath}/{data,config,logs}
+          ln -sf ${pkgs.mattermost}/{bin,fonts,i18n,templates,webapp} ${cfg.statePath}
+        '' + lib.optionalString (!cfg.mutableConfig) ''
+          ln -sf ${mattermostConfJSON} ${cfg.statePath}/config/config.json
+        '' + lib.optionalString cfg.mutableConfig ''
+          if ! test -e "${cfg.statePath}/config/.initial-created"; then
+            rm -f ${cfg.statePath}/config/config.json
+            cp ${mattermostConfJSON} ${cfg.statePath}/config/config.json
+            touch ${cfg.statePath}/config/.initial-created
+          fi
+        '' + lib.optionalString cfg.localDatabaseCreate ''
+          if ! test -e "${cfg.statePath}/.db-created"; then
+            ${config.services.postgresql.package}/bin/psql postgres -c \
+              "CREATE ROLE ${cfg.localDatabaseUser} WITH LOGIN NOCREATEDB NOCREATEROLE NOCREATEUSER ENCRYPTED PASSWORD '${cfg.localDatabasePassword}'"
+            ${config.services.postgresql.package}/bin/createdb \
+              --owner ${cfg.localDatabaseUser} ${cfg.localDatabaseName}
+            touch ${cfg.statePath}/.db-created
+          fi
+        '' + ''
+          chown ${cfg.user}:${cfg.group} -R ${cfg.statePath}
+          chmod u+rw,g+r,o-rwx -R ${cfg.statePath}
+        '';
+
+        serviceConfig = {
+          PermissionsStartOnly = true;
+          User = cfg.user;
+          Group = cfg.group;
+          ExecStart = "${pkgs.mattermost}/bin/mattermost-platform";
+          WorkingDirectory = "${cfg.statePath}";
+          PrivateTmp = true;
+          Restart = "always";
+          RestartSec = "10";
+          LimitNOFILE = "49152";
+        };
+      };
+    })
+    (mkIf cfg.matterircd.enable {
+      systemd.services.matterircd = {
+        description = "Mattermost IRC bridge service";
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig = {
+          User = "nobody";
+          Group = "nogroup";
+          ExecStart = "${pkgs.matterircd.bin}/bin/matterircd ${concatStringsSep " " cfg.matterircd.parameters}";
+          WorkingDirectory = "/tmp";
+          PrivateTmp = true;
+          Restart = "always";
+          RestartSec = "5";
+        };
+      };
+    })
+  ];
+}
+
diff --git a/nixos/modules/services/x11/redshift.nix b/nixos/modules/services/x11/redshift.nix
index 63ffa29c1997..78a97df98775 100644
--- a/nixos/modules/services/x11/redshift.nix
+++ b/nixos/modules/services/x11/redshift.nix
@@ -108,7 +108,12 @@ in {
         RestartSec = 3;
         Restart = "always";
       };
-      environment = { DISPLAY = ":${toString config.services.xserver.display}"; };
+      environment = {
+        DISPLAY = ":${toString (
+          let display = config.services.xserver.display;
+          in if display != null then display else 0
+        )}";
+      };
     };
   };
 
diff --git a/nixos/modules/system/boot/stage-1.nix b/nixos/modules/system/boot/stage-1.nix
index 70429e9c0a22..baeba1d6b31d 100644
--- a/nixos/modules/system/boot/stage-1.nix
+++ b/nixos/modules/system/boot/stage-1.nix
@@ -198,7 +198,9 @@ let
       preLVMCommands preDeviceCommands postDeviceCommands postMountCommands preFailCommands kernelModules;
 
     resumeDevices = map (sd: if sd ? device then sd.device else "/dev/disk/by-label/${sd.label}")
-                    (filter (sd: (sd ? label || hasPrefix "/dev/" sd.device) && !sd.randomEncryption) config.swapDevices);
+                    (filter (sd: (sd ? label || hasPrefix "/dev/" sd.device) && !sd.randomEncryption 
+                    # Don't include zram devices
+                    && !(hasPrefix "/dev/zram" sd.device)) config.swapDevices);
 
     fsInfo =
       let f = fs: [ fs.mountPoint (if fs.device != null then fs.device else "/dev/disk/by-label/${fs.label}") fs.fsType (builtins.concatStringsSep "," fs.options) ];
diff --git a/nixos/release.nix b/nixos/release.nix
index 4647a02afb1c..70a7ba5af89d 100644
--- a/nixos/release.nix
+++ b/nixos/release.nix
@@ -111,11 +111,20 @@ in rec {
       ];
     }).config.system.build;
   in
-    pkgs.symlinkJoin {name="netboot"; paths=[
-      build.netbootRamdisk
-      build.kernel
-      build.netbootIpxeScript
-    ];};
+    pkgs.symlinkJoin {
+      name="netboot";
+      paths=[
+        build.netbootRamdisk
+        build.kernel
+        build.netbootIpxeScript
+      ];
+      postBuild = ''
+        mkdir -p $out/nix-support
+        echo "file bzImage $out/bzImage" >> $out/nix-support/hydra-build-products
+        echo "file initrd $out/initrd" >> $out/nix-support/hydra-build-products
+        echo "file ipxe $out/netboot.ipxe" >> $out/nix-support/hydra-build-products
+      '';
+    };
 
   iso_minimal = forAllSystems (system: makeIso {
     module = ./modules/installer/cd-dvd/installation-cd-minimal.nix;
diff --git a/pkgs/applications/audio/a2jmidid/default.nix b/pkgs/applications/audio/a2jmidid/default.nix
index 7b0aad152ab3..35954471877a 100644
--- a/pkgs/applications/audio/a2jmidid/default.nix
+++ b/pkgs/applications/audio/a2jmidid/default.nix
@@ -1,7 +1,9 @@
 { stdenv, fetchurl, makeWrapper, pkgconfig, alsaLib, dbus, libjack2
-, python, pythonDBus }:
+, pythonPackages}:
 
-stdenv.mkDerivation rec {
+let
+  inherit (pythonPackages) python dbus-python;
+in stdenv.mkDerivation rec {
   name = "a2jmidid-${version}";
   version = "8";
 
@@ -10,14 +12,14 @@ stdenv.mkDerivation rec {
     sha256 = "0pzm0qk5ilqhwz74pydg1jwrds27vm47185dakdrxidb5bv3b5ia";
   };
 
-  buildInputs = [ makeWrapper pkgconfig alsaLib dbus libjack2 python pythonDBus ];
+  buildInputs = [ makeWrapper pkgconfig alsaLib dbus libjack2 python dbus-python ];
 
-  configurePhase = "python waf configure --prefix=$out";
+  configurePhase = "${python.interpreter} waf configure --prefix=$out";
 
-  buildPhase = "python waf";
+  buildPhase = "${python.interpreter} waf";
 
   installPhase = ''
-    python waf install
+    ${python.interpreter} waf install
     wrapProgram $out/bin/a2j_control --set PYTHONPATH $PYTHONPATH
   '';
 
diff --git a/pkgs/applications/audio/bitwig-studio/default.nix b/pkgs/applications/audio/bitwig-studio/default.nix
new file mode 100644
index 000000000000..efb36abe240b
--- /dev/null
+++ b/pkgs/applications/audio/bitwig-studio/default.nix
@@ -0,0 +1,97 @@
+{ stdenv, fetchurl, alsaLib, bzip2, cairo, dpkg, freetype, gdk_pixbuf
+, glib, gtk, harfbuzz, jdk, lib, libX11, libXau, libXcursor, libXdmcp
+, libXext, libXfixes, libXrender, libbsd, libjack2, libpng, libxcb
+, libxkbcommon, libxkbfile, makeWrapper, pixman, xcbutil, xcbutilwm
+, xdg_utils, zenity, zlib }:
+
+stdenv.mkDerivation rec {
+  name = "bitwig-studio-${version}";
+  version = "1.3.12";
+
+  src = fetchurl {
+    url = "https://downloads.bitwig.com/stable/${version}/bitwig-studio-${version}.deb";
+    sha256 = "01z6yia4a6lfsf3rqq379l7xzqfbpz27mf1mr8sx9z1a8rzzyhld";
+  };
+
+  nativeBuildInputs = [ dpkg makeWrapper ];
+
+  unpackCmd = "mkdir root ; dpkg-deb -x $curSrc root";
+
+  dontBuild = true;
+  dontPatchELF = true;
+  dontStrip = true;
+
+  libPath = lib.makeLibraryPath [
+    alsaLib bzip2.out cairo freetype gdk_pixbuf glib gtk harfbuzz
+    libX11 libXau libXcursor libXdmcp libXext libXfixes libXrender
+    libbsd libjack2 libpng libxcb libxkbfile pixman xcbutil xcbutilwm
+    zlib
+  ];
+
+  binPath = lib.makeBinPath [
+    xdg_utils zenity
+  ];
+
+  installPhase = ''
+    mkdir -p $out
+    cp -r opt/bitwig-studio $out/libexec
+
+    # Use NixOS versions of these libs instead of the bundled ones.
+    (
+      cd $out/libexec/lib/bitwig-studio
+      rm libbz2.so* libxkbfile.so* libXcursor.so* libXau.so* \
+         libXdmcp.so* libpng16.so* libxcb*.so* libharfbuzz.so* \
+         libcairo.so* libfreetype.so*
+      ln -s ${bzip2.out}/lib/libbz2.so.1.0.6 libbz2.so.1.0
+    )
+
+    # Use our OpenJDK instead of Bitwig’s bundled—and commercial!—one.
+    rm -rf $out/libexec/lib/jre
+    ln -s ${jdk.home}/jre $out/libexec/lib/jre
+
+    # Bitwig’s `libx11-windowing-system.so` has several problems:
+    #
+    #   • has some old version of libxkbcommon linked statically (ಠ_ಠ),
+    #
+    #   • hardcodes path to `/usr/share/X11/xkb`,
+    #
+    #   • even if we redirected it with libredirect (after adding
+    #     `eaccess()` to libredirect!), their version of libxkbcommon
+    #     is unable to parse our xkeyboardconfig. Been there, done that.
+    #
+    # However, it suffices to override theirs with our libxkbcommon
+    # in LD_PRELOAD. :-)
+
+    find $out -type f -executable \
+      -not -name '*.so.*' \
+      -not -name '*.so' \
+      -not -path '*/resources/*' | \
+    while IFS= read -r f ; do
+      patchelf \
+        --set-interpreter $(cat ${stdenv.cc}/nix-support/dynamic-linker) \
+        $f && \
+      wrapProgram $f \
+        --prefix PATH : "${binPath}" \
+        --prefix LD_LIBRARY_PATH : "${libPath}" \
+        --set LD_PRELOAD "${libxkbcommon.out}/lib/libxkbcommon.so" || true
+    done
+
+    mkdir -p $out/bin
+    ln -s $out/libexec/bitwig-studio $out/bin/bitwig-studio
+
+    cp -r usr/share $out/share
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A digital audio workstation";
+    longDescription = ''
+      Bitwig Studio is a multi-platform music-creation system for
+      production, performance and DJing, with a focus on flexible
+      editing tools and a super-fast workflow.
+    '';
+    homepage = http://www.bitwig.com/;
+    license = licenses.unfree;
+    platforms = [ "x86_64-linux" ];
+    maintainers = with maintainers; [ michalrus ];
+  };
+}
diff --git a/pkgs/applications/audio/gpodder/default.nix b/pkgs/applications/audio/gpodder/default.nix
index 7b724ca3d019..8e9476cd3d82 100644
--- a/pkgs/applications/audio/gpodder/default.nix
+++ b/pkgs/applications/audio/gpodder/default.nix
@@ -1,11 +1,10 @@
-{ stdenv, fetchurl, buildPythonApplication, pythonPackages, mygpoclient, intltool
+{ stdenv, fetchurl, pythonPackages, mygpoclient, intltool
 , ipodSupport ? true, libgpod
 , gnome3
 }:
 
-buildPythonApplication rec {
+pythonPackages.buildPythonApplication rec {
   name = "gpodder-${version}";
-  namePrefix = "";
 
   version = "3.9.0";
 
@@ -31,7 +30,7 @@ buildPythonApplication rec {
   ];
 
   propagatedBuildInputs = with pythonPackages; [
-    feedparser dbus mygpoclient sqlite3 pygtk eyeD3
+    feedparser dbus-python mygpoclient sqlite3 pygtk eyeD3
   ] ++ stdenv.lib.optional ipodSupport libgpod;
 
   checkPhase = ''
diff --git a/pkgs/applications/audio/mopidy/default.nix b/pkgs/applications/audio/mopidy/default.nix
index 5feabbf42063..af37d859c7f7 100644
--- a/pkgs/applications/audio/mopidy/default.nix
+++ b/pkgs/applications/audio/mopidy/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, pythonPackages, pygobject3, wrapGAppsHook
+{ stdenv, fetchFromGitHub, pythonPackages, wrapGAppsHook
 , gst_all_1, glib_networking, gobjectIntrospection
 }:
 
@@ -22,7 +22,7 @@ pythonPackages.buildPythonApplication rec {
   ];
 
   propagatedBuildInputs = with pythonPackages; [
-    gst-python pygobject3 pykka tornado requests2 dbus
+    gst-python pygobject3 pykka tornado requests2 dbus-python
   ];
 
   # There are no tests
diff --git a/pkgs/applications/audio/quodlibet/default.nix b/pkgs/applications/audio/quodlibet/default.nix
index 5aaa3195c458..a046fe80e13d 100644
--- a/pkgs/applications/audio/quodlibet/default.nix
+++ b/pkgs/applications/audio/quodlibet/default.nix
@@ -1,5 +1,5 @@
-{ stdenv, fetchurl, python, buildPythonApplication, mutagen, pygtk, pygobject, intltool
-, pythonDBus, gst_python, withGstPlugins ? false, gst_plugins_base ? null
+{ stdenv, fetchurl, pythonPackages, intltool
+, gst_python, withGstPlugins ? false, gst_plugins_base ? null
 , gst_plugins_good ? null, gst_plugins_ugly ? null, gst_plugins_bad ? null }:
 
 assert withGstPlugins -> gst_plugins_base != null
@@ -7,12 +7,12 @@ assert withGstPlugins -> gst_plugins_base != null
                          || gst_plugins_ugly != null
                          || gst_plugins_bad != null;
 
-let version = "2.6.3"; in
-
-buildPythonApplication {
+let
+  version = "2.6.3";
+  inherit (pythonPackages) buildPythonApplication python mutagen pygtk pygobject dbus-python;
+in buildPythonApplication {
   # call the package quodlibet and just quodlibet
   name = "quodlibet${stdenv.lib.optionalString withGstPlugins "-with-gst-plugins"}-${version}";
-  namePrefix = "";
 
   # XXX, tests fail
   doCheck = false;
@@ -48,7 +48,7 @@ buildPythonApplication {
   ];
 
   propagatedBuildInputs = [
-    mutagen pygtk pygobject pythonDBus gst_python intltool
+    mutagen pygtk pygobject dbus-python gst_python intltool
   ];
 
   postInstall = stdenv.lib.optionalString withGstPlugins ''
diff --git a/pkgs/applications/audio/sonata/default.nix b/pkgs/applications/audio/sonata/default.nix
index e23a54043682..2acafb0be636 100644
--- a/pkgs/applications/audio/sonata/default.nix
+++ b/pkgs/applications/audio/sonata/default.nix
@@ -1,14 +1,11 @@
-{ pkgs, stdenv, fetchFromGitHub, pkgconfig, intltool, wrapGAppsHook,
-  python, buildPythonApplication, isPy3k,
-  gnome3, gtk3, gobjectIntrospection,
-  dbus, pygobject3, mpd2 }:
+{ lib, stdenv, fetchFromGitHub, pkgconfig, intltool, wrapGAppsHook
+, python3Packages, gnome3, gtk3, gobjectIntrospection}:
 
-with pkgs.lib;
-
-buildPythonApplication rec {
+let
+  inherit (python3Packages) buildPythonApplication python isPy3k dbus-python pygobject3 mpd2;
+in buildPythonApplication rec {
   name = "sonata-${version}";
   version = "1.7b1";
-  namePrefix = "";
 
   src = fetchFromGitHub {
     owner = "multani";
@@ -38,7 +35,7 @@ buildPythonApplication rec {
 
   # The optional tagpy dependency (for editing metadata) is not yet
   # included because it's difficult to build.
-  pythonPath = [ dbus pygobject3 mpd2 ];
+  pythonPath = [ dbus-python pygobject3 mpd2 ];
 
   meta = {
     description = "An elegant client for the Music Player Daemon";
diff --git a/pkgs/applications/audio/ympd/default.nix b/pkgs/applications/audio/ympd/default.nix
new file mode 100644
index 000000000000..54d07e71f42a
--- /dev/null
+++ b/pkgs/applications/audio/ympd/default.nix
@@ -0,0 +1,22 @@
+{ stdenv, fetchFromGitHub, cmake, llvmPackages, pkgconfig, mpd_clientlib, openssl }:
+
+stdenv.mkDerivation rec {
+  name = "ympd-${version}";
+  version = "1.3.0";
+
+  src = fetchFromGitHub {
+    owner = "notandy";
+    repo = "ympd";
+    rev = "v${version}";
+    sha256 = "1nvb19jd556v2h2bi7w4dcl507p3p8xvjkqfzrcsy7ccy3502brq";
+  };
+
+  buildInputs = [ cmake pkgconfig mpd_clientlib openssl ];
+
+  meta = {
+    homepage = "http://www.ympd.org";
+    description = "Standalone MPD Web GUI written in C, utilizing Websockets and Bootstrap/JS";
+    maintainers = [ stdenv.lib.maintainers.siddharthist ];
+    platforms = stdenv.lib.platforms.unix;
+  };
+}
diff --git a/pkgs/applications/misc/batti/default.nix b/pkgs/applications/misc/batti/default.nix
index a2b3c15f0444..14416c24d23e 100644
--- a/pkgs/applications/misc/batti/default.nix
+++ b/pkgs/applications/misc/batti/default.nix
@@ -1,10 +1,11 @@
 { stdenv, fetchurl
-, pkgconfig, gettext, python
-, gtk, pygtk, dbus_python
-, gdk_pixbuf, upower
+, pkgconfig, gettext, pythonPackages
+, gtk, gdk_pixbuf, upower
 , makeWrapper }:
 
-stdenv.mkDerivation rec {
+let
+  inherit (pythonPackages) dbus-python pygtk python;
+in stdenv.mkDerivation rec {
 
   name = "batti-${version}";
   version = "0.3.8";
@@ -15,7 +16,7 @@ stdenv.mkDerivation rec {
   };
 
   buildInputs = with stdenv.lib;
-  [ pkgconfig gettext python gtk pygtk dbus_python gdk_pixbuf upower makeWrapper ];
+  [ pkgconfig gettext python gtk pygtk dbus-python gdk_pixbuf upower makeWrapper ];
 
   configurePhase = "true";
 
diff --git a/pkgs/applications/misc/calibre/default.nix b/pkgs/applications/misc/calibre/default.nix
index 966df509c92d..5f16cb7b9efa 100644
--- a/pkgs/applications/misc/calibre/default.nix
+++ b/pkgs/applications/misc/calibre/default.nix
@@ -5,12 +5,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "2.58.0";
+  version = "2.64.0";
   name = "calibre-${version}";
 
   src = fetchurl {
     url = "https://download.calibre-ebook.com/${version}/${name}.tar.xz";
-    sha256 = "0npqvfjqj1vwa7nmnsyd4d30z40brydw275ldf1jankrp6dr9dyd";
+    sha256 = "0jjbkhd3n7rh5q6cl6yy51hyjbxmgm6xj7i2a1d3h2ggrip1zmr9";
   };
 
   inherit python;
diff --git a/pkgs/applications/misc/calibre/dont_build_unrar_plugin.patch b/pkgs/applications/misc/calibre/dont_build_unrar_plugin.patch
index c910be89a5f1..522b2e6202c0 100644
--- a/pkgs/applications/misc/calibre/dont_build_unrar_plugin.patch
+++ b/pkgs/applications/misc/calibre/dont_build_unrar_plugin.patch
@@ -3,35 +3,25 @@ Description: do not build unrar extension as we strip unrar from the tarball
 Forwarded: not-needed
 Last-Update: 2013-04-04
 
-Index: calibre/setup/extensions.py
+Index: calibre/setup/extensions.json
 ===================================================================
---- calibre.orig/setup/extensions.py	2014-02-02 10:42:14.510954007 +0100
-+++ calibre/setup/extensions.py	2014-02-02 10:42:14.502954007 +0100
-@@ -209,24 +209,6 @@
-                 sip_files=['calibre/ebooks/pdf/render/qt_hack.sip']
-                 ),
- 
--    Extension('unrar',
--              ['unrar/%s.cpp'%(x.partition('.')[0]) for x in '''
--               rar.o strlist.o strfn.o pathfn.o savepos.o smallfn.o global.o file.o
--               filefn.o filcreat.o archive.o arcread.o unicode.o system.o
--               isnt.o crypt.o crc.o rawread.o encname.o resource.o match.o
--               timefn.o rdwrfn.o consio.o options.o ulinks.o errhnd.o rarvm.o
--               secpassword.o rijndael.o getbits.o sha1.o extinfo.o extract.o
--               volume.o list.o find.o unpack.o cmddata.o filestr.o scantree.o
--               '''.split()] + ['calibre/utils/unrar.cpp'],
--              inc_dirs=['unrar'],
--              cflags=[('/' if iswindows else '-') + x for x in (
--                  'DSILENT', 'DRARDLL', 'DUNRAR')] + (
--                  [] if iswindows else ['-D_FILE_OFFSET_BITS=64',
--                                        '-D_LARGEFILE_SOURCE']),
--              optimize_level=2,
--              libraries=['User32', 'Advapi32', 'kernel32', 'Shell32'] if iswindows else []
--              ),
--
-     ]
- 
- 
+--- calibre.orig/setup/extensions.json
++++ calibre/setup/extensions.json
+@@ -211,14 +211,5 @@
+         "sources": "calibre/devices/mtp/unix/devices.c calibre/devices/mtp/unix/libmtp.c",
+         "headers": "calibre/devices/mtp/unix/devices.h calibre/devices/mtp/unix/upstream/music-players.h calibre/devices/mtp/unix/upstream/device-flags.h",
+         "libraries": "mtp"
+-    },
+-    {
+-        "name": "unrar",
+-        "sources": "unrar/rar.cpp unrar/strlist.cpp unrar/strfn.cpp unrar/pathfn.cpp unrar/savepos.cpp unrar/smallfn.cpp unrar/global.cpp unrar/file.cpp unrar/filefn.cpp unrar/filcreat.cpp unrar/archive.cpp unrar/arcread.cpp unrar/unicode.cpp unrar/system.cpp unrar/isnt.cpp unrar/crypt.cpp unrar/crc.cpp unrar/rawread.cpp unrar/encname.cpp unrar/resource.cpp unrar/match.cpp unrar/timefn.cpp unrar/rdwrfn.cpp unrar/consio.cpp unrar/options.cpp unrar/ulinks.cpp unrar/errhnd.cpp unrar/rarvm.cpp unrar/secpassword.cpp unrar/rijndael.cpp unrar/getbits.cpp unrar/sha1.cpp unrar/extinfo.cpp unrar/extract.cpp unrar/volume.cpp unrar/list.cpp unrar/find.cpp unrar/unpack.cpp unrar/cmddata.cpp unrar/filestr.cpp unrar/scantree.cpp calibre/utils/unrar.cpp",
+-        "inc_dirs": "unrar",
+-        "defines": "SILENT RARDLL UNRAR _FILE_OFFSET_BITS=64 _LARGEFILE_SOURCE",
+-        "windows_defines": "SILENT RARDLL UNRAR",
+-        "optimize_level": 2,
+-        "windows_libraries": "User32 Advapi32 kernel32 Shell32"
+     }
+ ]
 Index: calibre/src/calibre/ebooks/metadata/archive.py
 ===================================================================
 --- calibre.orig/src/calibre/ebooks/metadata/archive.py	2014-02-02 10:42:14.510954007 +0100
diff --git a/pkgs/applications/misc/cherrytree/default.nix b/pkgs/applications/misc/cherrytree/default.nix
index 72049c21b121..4198a9f32b25 100644
--- a/pkgs/applications/misc/cherrytree/default.nix
+++ b/pkgs/applications/misc/cherrytree/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, python, pythonPackages, gettext, pygtksourceview, sqlite }:
+{ stdenv, fetchurl, pythonPackages, gettext, sqlite }:
 
 with stdenv.lib;
 stdenv.mkDerivation rec {
@@ -15,10 +15,10 @@ stdenv.mkDerivation rec {
   [ sqlite3 ];
 
   buildInputs = with pythonPackages;
-  [ python gettext wrapPython pygtk dbus pygtksourceview ];
+  [ python gettext wrapPython pygtk dbus-python pygtksourceview ];
 
   pythonPath = with pythonPackages;
-  [ pygtk dbus pygtksourceview ];
+  [ pygtk dbus-python pygtksourceview ];
 
   patches = [ ./subprocess.patch ];
 
diff --git a/pkgs/applications/misc/emem/default.nix b/pkgs/applications/misc/emem/default.nix
index 8063f62341c9..56ea79eb96c8 100644
--- a/pkgs/applications/misc/emem/default.nix
+++ b/pkgs/applications/misc/emem/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "emem";
-  version = "0.2.23";
+  version = "0.2.24";
   name = "${pname}-${version}";
 
   inherit jdk;
 
   src = fetchurl {
     url = "https://github.com/ebzzry/${pname}/releases/download/v${version}/${pname}.jar";
-    sha256 = "0isvhwczbm5fr8bkq45g9i80s50r4vw92b7f3wdzwx7p5sj48pwj";
+    sha256 = "0h20vpd4gkg1m5mn3fkgrmjgf9w640b7w2500nn0pswmvqawrhpi";
   };
 
   buildInputs = [ ];
diff --git a/pkgs/applications/misc/guake/default.nix b/pkgs/applications/misc/guake/default.nix
index d0ec7b704ac4..21a551bd6314 100644
--- a/pkgs/applications/misc/guake/default.nix
+++ b/pkgs/applications/misc/guake/default.nix
@@ -11,12 +11,14 @@ gconftool-2 --recursive-unset /apps/guake
 */
 { stdenv, fetchurl, lib
 , pkgconfig, libtool, intltool, makeWrapper
-, dbus, gtk2, gconf, python2, python2Packages, libutempter, vte, keybinder, gnome2, gnome3 }:
+, dbus, gtk2, gconf, python2Packages, libutempter, vte, keybinder, gnome2, gnome3 }:
 
 with lib;
 
-let inputs = [ dbus gtk2 gconf python2 libutempter vte keybinder gnome3.gnome_common ];
-    pyPath = makeSearchPathOutput "lib" python2.sitePackages (attrVals [ "dbus" "notify" "pyGtkGlade" "pyxdg" ] python2Packages ++ [ gnome2.gnome_python ]);
+let
+  inherit (python2Packages) python;
+  inputs = [ dbus gtk2 gconf python libutempter vte keybinder gnome3.gnome_common ];
+  pyPath = makeSearchPathOutput "lib" python.sitePackages (attrVals [ "dbus-python" "notify" "pyGtkGlade" "pyxdg" ] python2Packages ++ [ gnome2.gnome_python ]);
  in stdenv.mkDerivation rec {
   name = "guake-${version}";
   version = "0.8.3";
@@ -60,11 +62,11 @@ let inputs = [ dbus gtk2 gconf python2 libutempter vte keybinder gnome3.gnome_co
   postFixup = ''
     for bin in $out/bin/{guake,guake-prefs}; do
       substituteInPlace $bin \
-        --replace '/usr/bin/env python2' ${python2}/bin/python2
+        --replace '/usr/bin/env python2' ${python.interpreter}
       wrapProgram $bin \
         --prefix XDG_DATA_DIRS : "$out/share:$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH" \
         --prefix LD_LIBRARY_PATH : ${makeLibraryPath inputs} \
-        --prefix PYTHONPATH : "$out/${python2.sitePackages}:${pyPath}:$PYTHONPATH"
+        --prefix PYTHONPATH : "$out/${python.sitePackages}:${pyPath}:$PYTHONPATH"
     done
   '';
 
diff --git a/pkgs/applications/misc/hamster-time-tracker/default.nix b/pkgs/applications/misc/hamster-time-tracker/default.nix
index 1732a7e1fb07..aa6a4bd689a4 100644
--- a/pkgs/applications/misc/hamster-time-tracker/default.nix
+++ b/pkgs/applications/misc/hamster-time-tracker/default.nix
@@ -1,5 +1,5 @@
-{ stdenv, fetchzip, buildPythonApplication, docbook2x, libxslt, gnome_doc_utils
-, intltool, dbus_glib, pygobject, pygtk, pyxdg, gnome_python, dbus, sqlite3
+{ stdenv, fetchzip, pythonPackages, docbook2x, libxslt, gnome_doc_utils
+, intltool, dbus_glib, gnome_python, dbus
 , hicolor_icon_theme
 }:
 
@@ -8,9 +8,8 @@
 #
 #   WARNING:root:Could not import wnck - workspace tracking will be disabled
 
-buildPythonApplication rec {
+pythonPackages.buildPythonApplication rec {
   name = "hamster-time-tracker-1.04";
-  namePrefix = "";
 
   src = fetchzip {
     name = "${name}-src";
@@ -22,7 +21,7 @@ buildPythonApplication rec {
     docbook2x libxslt gnome_doc_utils intltool dbus_glib hicolor_icon_theme
   ];
 
-  propagatedBuildInputs = [ pygobject pygtk pyxdg gnome_python dbus sqlite3 ];
+  propagatedBuildInputs = with pythonPackages; [ pygobject pygtk pyxdg gnome_python dbus-python sqlite3 ];
 
   configurePhase = ''
     python waf configure --prefix="$out"
diff --git a/pkgs/applications/misc/printrun/default.nix b/pkgs/applications/misc/printrun/default.nix
index 27a55f4464f2..34144e35bd5a 100644
--- a/pkgs/applications/misc/printrun/default.nix
+++ b/pkgs/applications/misc/printrun/default.nix
@@ -11,7 +11,7 @@ python27Packages.buildPythonApplication rec {
   };
 
   propagatedBuildInputs = with python27Packages; [
-    wxPython30 pyserial dbus psutil numpy pyopengl pyglet cython
+    wxPython30 pyserial dbus-python psutil numpy pyopengl pyglet cython
   ];
 
   doCheck = false;
diff --git a/pkgs/applications/misc/translate-shell/default.nix b/pkgs/applications/misc/translate-shell/default.nix
new file mode 100644
index 000000000000..10e1315c1f59
--- /dev/null
+++ b/pkgs/applications/misc/translate-shell/default.nix
@@ -0,0 +1,101 @@
+{ stdenv, fetchFromGitHub, curl, fribidi, mpv, less, rlwrap, gawk, bash, emacs, groff, ncurses, pandoc }:
+
+stdenv.mkDerivation rec {
+  name = "${pname}-${version}";
+  pname = "translate-shell";
+  version = "0.9.4";
+
+  src = fetchFromGitHub {
+    owner = "soimort";
+    repo = "translate-shell";
+    rev = "v" + version;
+    sha256 = "166zhic3k4z37vc8p1fnhc4xx7i7q0j30nr324frmp1mrnwrdib8";
+  };
+
+  phases = [ "buildPhase" "installPhase" "postFixup" ];
+
+  buildPhase = ''
+    mkdir -p $out/bin
+    mkdir -p $out/share
+    mkdir -p $out/share/man/man1
+  '';
+
+  installPhase = ''
+    cp $src/translate $out/bin/trans
+    cp $src/translate $out/bin/translate
+    cp $src/translate $out/bin/translate-shell
+
+    cp $src/translate.awk $out/share/translate.awk
+    cp $src/build.awk $out/share/build.awk
+    cp $src/metainfo.awk $out/share/metainfo.awk
+    cp $src/test.awk $out/share/test.awk
+
+    cp -r $src/include $out/share
+    cp -r $src/test $out/share
+    cp $src/man/trans.1 $out/share/man/man1
+
+    chmod +x $out/bin/translate
+    chmod +x $out/share/translate.awk
+    chmod +x $out/share/build.awk
+    chmod +x $out/share/metainfo.awk
+    chmod +x $out/share/test.awk
+  '';
+
+  postFixup = ''
+    substituteInPlace $out/bin/trans --replace "/bin/sh" "${bash}/bin/bash"
+    substituteInPlace $out/bin/trans --replace "gawk " "${gawk}/bin/gawk "
+    substituteInPlace $out/bin/trans --replace "translate.awk" "$out/share/translate.awk"
+
+    substituteInPlace $out/bin/translate --replace "/bin/sh" "${bash}/bin/bash"
+    substituteInPlace $out/bin/translate --replace "gawk " "${gawk}/bin/gawk "
+    substituteInPlace $out/bin/translate --replace "translate.awk" "$out/share/translate.awk"
+
+    substituteInPlace $out/bin/translate-shell --replace "/bin/sh" "${bash}/bin/bash"
+    substituteInPlace $out/bin/translate-shell --replace "gawk " "${gawk}/bin/gawk "
+    substituteInPlace $out/bin/translate-shell --replace "translate.awk" "$out/share/translate.awk"
+
+    substituteInPlace $out/share/translate.awk --replace "/usr/bin/gawk" "${gawk}/bin/gawk"
+    substituteInPlace $out/share/translate.awk --replace "metainfo" "$out/share/metainfo"
+    substituteInPlace $out/share/translate.awk --replace "include/" "$out/share/include/"
+
+    substituteInPlace $out/share/build.awk --replace "/usr/bin/gawk" "${gawk}/bin/gawk"
+    substituteInPlace $out/share/build.awk --replace "include/" "$out/share/include/"
+    substituteInPlace $out/share/build.awk --replace "metainfo.awk" "$out/share/metainfo.awk"
+
+    substituteInPlace $out/share/metainfo.awk --replace "translate.awk" "$out/share/translate.awk"
+
+    substituteInPlace $out/share/test.awk --replace "/usr/bin/gawk" "${gawk}/bin/gawk"
+    substituteInPlace $out/share/test.awk --replace "include/" "$out/share/include/"
+    substituteInPlace $out/share/test.awk --replace "test/" "$out/share/test/"
+
+    substituteInPlace $out/share/include/Translators/\*.awk --replace "include/" "$out/share/include/"
+
+    substituteInPlace $out/share/test/Test.awk --replace "test/" "$out/share/test/"
+    substituteInPlace $out/share/test/TestUtils.awk --replace "include/" "$out/share/include/"
+    substituteInPlace $out/share/test/TestParser.awk --replace "include/" "$out/share/include/"
+    substituteInPlace $out/share/test/TestCommons.awk --replace "\"gawk\"" "\"${gawk}/bin/gawk\""
+    substituteInPlace $out/share/test/TestCommons.awk --replace "Commons.awk" "$out/share/include/Commons.awk"
+
+    substituteInPlace $out/share/include/Main.awk --replace "\"tput\"" "\"${ncurses}/bin/tput\""
+    substituteInPlace $out/share/include/Help.awk --replace "\"groff\"" "\"${groff}/bin/groff\""
+    substituteInPlace $out/share/include/Utils.awk --replace "\"fribidi\"" "\"${fribidi}/bin/fribidi\""
+    substituteInPlace $out/share/include/Utils.awk --replace "\"fribidi " "\"${fribidi}/bin/fribidi "
+    substituteInPlace $out/share/include/Utils.awk --replace "\"rlwrap\"" "\"${rlwrap}/bin/rlwrap\""
+    substituteInPlace $out/share/include/Utils.awk --replace "\"emacs\"" "\"${emacs}/bin/emacs\""
+    substituteInPlace $out/share/include/Utils.awk --replace "\"curl\"" "\"${curl}/bin/curl\""
+
+    substituteInPlace $out/share/build.awk --replace "\"pandoc " "\"${pandoc}/bin/pandoc "
+
+    substituteInPlace $out/share/include/Translate.awk --replace "\"mpv " "\"${mpv}/bin/mpv "
+    substituteInPlace $out/share/include/Translate.awk --replace "\"less " "\"${less}/bin/less "
+
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = https://www.soimort.org/translate-shell;
+    description = "Command-line translator using Google Translate, Bing Translator, Yandex.Translate, and Apertium";
+    license = licenses.publicDomain;
+    maintainers = [ maintainers.ebzzry ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/applications/networking/dropbox/default.nix b/pkgs/applications/networking/dropbox/default.nix
index b47b2a83de89..eadd85d46487 100644
--- a/pkgs/applications/networking/dropbox/default.nix
+++ b/pkgs/applications/networking/dropbox/default.nix
@@ -23,11 +23,11 @@
 let
   # NOTE: When updating, please also update in current stable,
   # as older versions stop working
-  version = "6.4.14";
+  version = "8.4.19";
   sha256 =
     {
-      "x86_64-linux" = "0wpdib3jf5bq4k8q5xv9g01fdcfjb4l903xjxn32rjw615s1q8bg";
-      "i686-linux" = "1lgc7ryp2mn230cfsbndn9ss71l378kib0lvs89rkn25d5zfgzn4";
+      "x86_64-linux" = "0pm43cklsm41mg463mz0ypvbladm2mz65s7ar9z4k4hgjrhyh67j";
+      "i686-linux" = "0myz8s2xdl034zb4548fgzz2f5gfvzfr1nwp50fh3f3hmf6frgp3";
     }."${stdenv.system}" or (throw "system ${stdenv.system} not supported");
 
   arch =
diff --git a/pkgs/applications/networking/instant-messengers/gajim/default.nix b/pkgs/applications/networking/instant-messengers/gajim/default.nix
index b6adcfc19101..e7ebcf149e19 100644
--- a/pkgs/applications/networking/instant-messengers/gajim/default.nix
+++ b/pkgs/applications/networking/instant-messengers/gajim/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, python, intltool, pkgconfig, libX11, gtk
-, ldns, pythonDBus, pythonPackages
+, ldns, pythonPackages
 
 , enableJingle ? true, farstream ? null, gst_plugins_bad ? null
 ,                      libnice ? null
@@ -58,7 +58,7 @@ stdenv.mkDerivation rec {
     pythonPackages.sqlite3 pythonPackages.pyasn1
     pythonPackages.pyxdg
     pythonPackages.nbxmpp
-    pythonPackages.pyopenssl pythonDBus
+    pythonPackages.pyopenssl pythonPackages.dbus-python
   ] ++ optionals enableJingle [ farstream gst_plugins_bad libnice ]
     ++ optional enableE2E pythonPackages.pycrypto
     ++ optional enableRST pythonPackages.docutils
diff --git a/pkgs/applications/networking/instant-messengers/salut-a-toi/default.nix b/pkgs/applications/networking/instant-messengers/salut-a-toi/default.nix
index 326774dc1fe0..d442addaeaa4 100644
--- a/pkgs/applications/networking/instant-messengers/salut-a-toi/default.nix
+++ b/pkgs/applications/networking/instant-messengers/salut-a-toi/default.nix
@@ -1,5 +1,8 @@
-{stdenv, fetchurl, python, pythonPackages, pygobject, pythonDBus}: 
-stdenv.mkDerivation rec {
+{stdenv, fetchurl, pythonPackages}:
+
+let
+  inherit (pythonPackages) python;
+in stdenv.mkDerivation rec {
   url = "ftp://ftp.goffi.org/sat/sat-0.2.0.tar.bz2";
   name = stdenv.lib.nameFromURL url ".tar";
   src = fetchurl {
@@ -10,28 +13,28 @@ stdenv.mkDerivation rec {
   buildInputs = with pythonPackages; 
     [
       python twisted urwid beautifulsoup wxPython pygobject
-      wokkel pythonDBus pyfeed wrapPython setuptools
+      wokkel dbus-python pyfeed wrapPython setuptools
     ];
 
   configurePhase = ''
     sed -i "/use_setuptools/d" setup.py
     sed -e "s@sys.prefix@'$out'@g" -i setup.py
     sed -e "1aexport PATH=\"\$PATH\":\"$out/bin\":\"${pythonPackages.twisted}/bin\"" -i src/sat.sh
-    sed -e "1aexport PYTHONPATH=\"\$PYTHONPATHPATH\":\"$PYTHONPATH\":"$out/lib/${python.libPrefix}/site-packages"" -i src/sat.sh
+    sed -e "1aexport PYTHONPATH=\"\$PYTHONPATHPATH\":\"$PYTHONPATH\":"$out/${python.sitePackages}"" -i src/sat.sh
 
     echo 'import wokkel.muc' | python 
   '';
 
   buildPhase = ''
-    python setup.py build
+    ${python.interpreter}setup.py build
   '';
 
   installPhase = ''
-    python setup.py install --prefix="$out" 
+    ${python.interpreter} setup.py install --prefix="$out"
 
     for i in "$out/bin"/*; do
       head -n 1 "$i" | grep -E '[/ ]python( |$)' && {
-        wrapProgram "$i" --prefix PYTHONPATH : "$PYTHONPATH:$out/lib/${python.libPrefix}/site-packages"
+        wrapProgram "$i" --prefix PYTHONPATH : "$PYTHONPATH:$out/${python.sitePackages}"
       } || true 
     done
   '';
diff --git a/pkgs/applications/networking/mailreaders/mailnag/default.nix b/pkgs/applications/networking/mailreaders/mailnag/default.nix
index 673856e062a8..bf3f6296acc2 100644
--- a/pkgs/applications/networking/mailreaders/mailnag/default.nix
+++ b/pkgs/applications/networking/mailreaders/mailnag/default.nix
@@ -1,9 +1,9 @@
-{ stdenv, buildPythonApplication, fetchurl, gettext, gtk3, pythonPackages
+{ stdenv, fetchurl, gettext, gtk3, pythonPackages
 , gdk_pixbuf, libnotify, gst_all_1
 , libgnome_keyring3 ? null, networkmanager ? null
 }:
 
-buildPythonApplication rec {
+pythonPackages.buildPythonApplication rec {
   name = "mailnag-${version}";
   version = "1.1.0";
 
@@ -13,7 +13,7 @@ buildPythonApplication rec {
   };
 
   buildInputs = [
-    gettext gtk3 pythonPackages.pygobject3 pythonPackages.dbus
+    gettext gtk3 pythonPackages.pygobject3 pythonPackages.dbus-python
     pythonPackages.pyxdg gdk_pixbuf libnotify gst_all_1.gstreamer
     gst_all_1.gst-plugins-base gst_all_1.gst-plugins-good
     gst_all_1.gst-plugins-bad libgnome_keyring3 networkmanager
diff --git a/pkgs/applications/networking/sync/backintime/common.nix b/pkgs/applications/networking/sync/backintime/common.nix
index c3f8e0f02c66..c1907c44e584 100644
--- a/pkgs/applications/networking/sync/backintime/common.nix
+++ b/pkgs/applications/networking/sync/backintime/common.nix
@@ -1,6 +1,8 @@
-{stdenv, fetchFromGitHub, makeWrapper, gettext, python3, python3Packages, rsync, cron, openssh, sshfsFuse, encfs }:
+{stdenv, fetchFromGitHub, makeWrapper, gettext, python3Packages, rsync, cron, openssh, sshfsFuse, encfs }:
 
-stdenv.mkDerivation rec {
+let
+  inherit (python3Packages) python dbus-python keyring;
+in stdenv.mkDerivation rec {
   version = "1.1.12";
 
   name = "backintime-common-${version}";
@@ -12,7 +14,7 @@ stdenv.mkDerivation rec {
     sha256 = "0n3x48wa8aa7i8fff85h3b5h3xpabk51ld0ymy3pkqh0krfgs59a";
   };
 
-  buildInputs = [ makeWrapper gettext python3 python3Packages.dbus python3Packages.keyring openssh cron rsync sshfsFuse encfs ];
+  buildInputs = [ makeWrapper gettext python dbus-python keyring openssh cron rsync sshfsFuse encfs ];
 
   installFlags = [ "DEST=$(out)" ];
 
diff --git a/pkgs/applications/version-management/gitlab/Gemfile b/pkgs/applications/version-management/gitlab/Gemfile
index f97c99183f22..e0e5143ae385 100644
--- a/pkgs/applications/version-management/gitlab/Gemfile
+++ b/pkgs/applications/version-management/gitlab/Gemfile
@@ -1,6 +1,6 @@
 source 'https://rubygems.org'
 
-gem 'rails', '4.2.7'
+gem 'rails', '4.2.7.1'
 gem 'rails-deprecated_sanitizer', '~> 1.0.3'
 
 # Responders respond_to and respond_with
diff --git a/pkgs/applications/version-management/gitlab/Gemfile.lock b/pkgs/applications/version-management/gitlab/Gemfile.lock
index 1919acecc61a..8d5b2b2e137c 100644
--- a/pkgs/applications/version-management/gitlab/Gemfile.lock
+++ b/pkgs/applications/version-management/gitlab/Gemfile.lock
@@ -3,34 +3,34 @@ GEM
   specs:
     RedCloth (4.3.2)
     ace-rails-ap (4.0.2)
-    actionmailer (4.2.7)
-      actionpack (= 4.2.7)
-      actionview (= 4.2.7)
-      activejob (= 4.2.7)
+    actionmailer (4.2.7.1)
+      actionpack (= 4.2.7.1)
+      actionview (= 4.2.7.1)
+      activejob (= 4.2.7.1)
       mail (~> 2.5, >= 2.5.4)
       rails-dom-testing (~> 1.0, >= 1.0.5)
-    actionpack (4.2.7)
-      actionview (= 4.2.7)
-      activesupport (= 4.2.7)
+    actionpack (4.2.7.1)
+      actionview (= 4.2.7.1)
+      activesupport (= 4.2.7.1)
       rack (~> 1.6)
       rack-test (~> 0.6.2)
       rails-dom-testing (~> 1.0, >= 1.0.5)
       rails-html-sanitizer (~> 1.0, >= 1.0.2)
-    actionview (4.2.7)
-      activesupport (= 4.2.7)
+    actionview (4.2.7.1)
+      activesupport (= 4.2.7.1)
       builder (~> 3.1)
       erubis (~> 2.7.0)
       rails-dom-testing (~> 1.0, >= 1.0.5)
       rails-html-sanitizer (~> 1.0, >= 1.0.2)
-    activejob (4.2.7)
-      activesupport (= 4.2.7)
+    activejob (4.2.7.1)
+      activesupport (= 4.2.7.1)
       globalid (>= 0.3.0)
-    activemodel (4.2.7)
-      activesupport (= 4.2.7)
+    activemodel (4.2.7.1)
+      activesupport (= 4.2.7.1)
       builder (~> 3.1)
-    activerecord (4.2.7)
-      activemodel (= 4.2.7)
-      activesupport (= 4.2.7)
+    activerecord (4.2.7.1)
+      activemodel (= 4.2.7.1)
+      activesupport (= 4.2.7.1)
       arel (~> 6.0)
     activerecord-nulldb-adapter (0.3.3)
       activerecord (>= 2.0.0)
@@ -40,7 +40,7 @@ GEM
       multi_json (~> 1.11, >= 1.11.2)
       rack (>= 1.5.2, < 3)
       railties (>= 4.0, < 5.1)
-    activesupport (4.2.7)
+    activesupport (4.2.7.1)
       i18n (~> 0.7)
       json (~> 1.7, >= 1.7.7)
       minitest (~> 5.1)
@@ -287,7 +287,7 @@ GEM
       omniauth (~> 1.0)
       pyu-ruby-sasl (~> 0.0.3.1)
       rubyntlm (~> 0.3)
-    globalid (0.3.6)
+    globalid (0.3.7)
       activesupport (>= 4.1.0)
     gollum-grit_adapter (1.0.1)
       gitlab-grit (~> 2.7, >= 2.7.1)
@@ -516,16 +516,16 @@ GEM
       rack
     rack-test (0.6.3)
       rack (>= 1.0)
-    rails (4.2.7)
-      actionmailer (= 4.2.7)
-      actionpack (= 4.2.7)
-      actionview (= 4.2.7)
-      activejob (= 4.2.7)
-      activemodel (= 4.2.7)
-      activerecord (= 4.2.7)
-      activesupport (= 4.2.7)
+    rails (4.2.7.1)
+      actionmailer (= 4.2.7.1)
+      actionpack (= 4.2.7.1)
+      actionview (= 4.2.7.1)
+      activejob (= 4.2.7.1)
+      activemodel (= 4.2.7.1)
+      activerecord (= 4.2.7.1)
+      activesupport (= 4.2.7.1)
       bundler (>= 1.3.0, < 2.0)
-      railties (= 4.2.7)
+      railties (= 4.2.7.1)
       sprockets-rails
     rails-deprecated_sanitizer (1.0.3)
       activesupport (>= 4.2.0.alpha)
@@ -535,9 +535,9 @@ GEM
       rails-deprecated_sanitizer (>= 1.0.1)
     rails-html-sanitizer (1.0.3)
       loofah (~> 2.0)
-    railties (4.2.7)
-      actionpack (= 4.2.7)
-      activesupport (= 4.2.7)
+    railties (4.2.7.1)
+      actionpack (= 4.2.7.1)
+      activesupport (= 4.2.7.1)
       rake (>= 0.8.7)
       thor (>= 0.18.1, < 2.0)
     rainbow (2.1.0)
@@ -922,7 +922,7 @@ DEPENDENCIES
   rack-attack (~> 4.3.1)
   rack-cors (~> 0.4.0)
   rack-oauth2 (~> 1.2.1)
-  rails (= 4.2.7)
+  rails (= 4.2.7.1)
   rails-deprecated_sanitizer (~> 1.0.3)
   rainbow (~> 2.1.0)
   rblineprof (~> 0.3.6)
diff --git a/pkgs/applications/version-management/gitlab/default.nix b/pkgs/applications/version-management/gitlab/default.nix
index fadb14dc7829..453bae3613c0 100644
--- a/pkgs/applications/version-management/gitlab/default.nix
+++ b/pkgs/applications/version-management/gitlab/default.nix
@@ -24,7 +24,7 @@ in
 
 stdenv.mkDerivation rec {
   name = "gitlab-${version}";
-  version = "8.10.3";
+  version = "8.10.6";
 
   buildInputs = [ env ruby bundler tzdata git nodejs procps ];
 
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
     owner = "gitlabhq";
     repo = "gitlabhq";
     rev = "v${version}";
-    sha256 = "0fhnwrgrpccc2j9wgdmwwi9h1ym3ll97lhmddq0xfzivc302ri3w";
+    sha256 = "1nk0ak9p5ncqynrm965ypwb9bj7b1r2jy5g4vdb9b0ma1ns2bkzf";
   };
 
   patches = [
@@ -70,6 +70,7 @@ stdenv.mkDerivation rec {
       SKIP_STORAGE_VALIDATION=true \
       rake assets:precompile RAILS_ENV=production
     mv config/gitlab.yml config/gitlab.yml.example
+    rm config/secrets.yml
     mv config config.dist
   '';
 
diff --git a/pkgs/applications/version-management/gitlab/gemset.nix b/pkgs/applications/version-management/gitlab/gemset.nix
index ce7ecd9f030f..b0f6f3ec0491 100644
--- a/pkgs/applications/version-management/gitlab/gemset.nix
+++ b/pkgs/applications/version-management/gitlab/gemset.nix
@@ -10,50 +10,50 @@
   actionmailer = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1fhq3dg3icbi1vrz55xwalzn4wpbrdgm41ma1jkrgbwl4qqqrrsq";
+      sha256 = "0lw1pss1mrjm7x7qcg9pvxv55rz3d994yf3mwmlfg1y12fxq00n3";
       type = "gem";
     };
-    version = "4.2.7";
+    version = "4.2.7.1";
   };
   actionpack = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0swhxylh0mrq7b8am3b90xqnwldvfn52jd2m9zmc27r8hvc0h2fp";
+      sha256 = "1ray5bvlmkimjax011zsw0mz9llfkqrfm7q1avjlp4i0kpcz8zlh";
       type = "gem";
     };
-    version = "4.2.7";
+    version = "4.2.7.1";
   };
   actionview = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0wsxa7zkvacmv4vf528nmid2v5smqy54vh17srj3997bgjyr68f3";
+      sha256 = "11m2x5nlbqrw79fh6h7m444lrka7wwy32b0dvgqg7ilbzih43k0c";
       type = "gem";
     };
-    version = "4.2.7";
+    version = "4.2.7.1";
   };
   activejob = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "19bf6fpl1vw6qnpsqcvdhljrvp67a7j72x1ydz4rj2s7g4xbjas3";
+      sha256 = "0ish5wd8nvmj7f6x1i22aw5ycizy5n1z1c7f3kyxmqwhw7lb0gaz";
       type = "gem";
     };
-    version = "4.2.7";
+    version = "4.2.7.1";
   };
   activemodel = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0v991wipszd5ly1fba8qzfyg86r06k8l8y353dv7438sngwd7slk";
+      sha256 = "0acz0mbmahsc9mn41275fpfnrqwig5k09m3xhz3455kv90fn79v5";
       type = "gem";
     };
-    version = "4.2.7";
+    version = "4.2.7.1";
   };
   activerecord = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0m04absj00hxj4q527ng0w0ydgbfc1cgxlcksjixgnx4j1visibn";
+      sha256 = "1lk8l6i9p7qfl0pg261v5yph0w0sc0vysrdzc6bm5i5rxgi68flj";
       type = "gem";
     };
-    version = "4.2.7";
+    version = "4.2.7.1";
   };
   activerecord-nulldb-adapter = {
     source = {
@@ -74,10 +74,10 @@
   activesupport = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1pm0gw4ykq9137n8i815vayyah0mk2m920clgg02jr3l23w6gsnj";
+      sha256 = "1gds12k7nxrcc09b727a458ndidy1nfcllj9x22jcaj7pppvq6r4";
       type = "gem";
     };
-    version = "4.2.7";
+    version = "4.2.7.1";
   };
   acts-as-taggable-on = {
     dependencies = ["activerecord"];
@@ -958,13 +958,12 @@
     version = "1.2.1";
   };
   globalid = {
-    dependencies = ["activesupport"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "145xrpsfx1qqjy33r6qa588wb16dvdhxzj2aysh755vhg6hgm291";
+      sha256 = "11plkgyl3w9k4y2scc1igvpgwyz4fnmsr63h2q4j8wkb48nlnhak";
       type = "gem";
     };
-    version = "0.3.6";
+    version = "0.3.7";
   };
   gollum-grit_adapter = {
     source = {
@@ -1773,10 +1772,10 @@
   rails = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "033wfvqjzlzkm0nrqrjpxxrp0lwhfm8sjlxn5zdhxhkzmhibrnvn";
+      sha256 = "1avd16ir7qx23dcnz1b3cafq1lja6rq0w222bs658p9n33rbw54l";
       type = "gem";
     };
-    version = "4.2.7";
+    version = "4.2.7.1";
   };
   rails-deprecated_sanitizer = {
     dependencies = ["activesupport"];
@@ -1808,10 +1807,10 @@
   railties = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0psnr9g436k2fkkjlhs7mq090i7vh0cvh7qwwrb8ppzbcr15hhab";
+      sha256 = "04rz7cn64zzvq7lnhc9zqmaqmqkq84q25v0ym9lcw75j1cj1mrq4";
       type = "gem";
     };
-    version = "4.2.7";
+    version = "4.2.7.1";
   };
   rainbow = {
     source = {
diff --git a/pkgs/applications/version-management/gitlab/nulladapter.patch b/pkgs/applications/version-management/gitlab/nulladapter.patch
index 92a3cb55e4d5..e972e1568e3a 100644
--- a/pkgs/applications/version-management/gitlab/nulladapter.patch
+++ b/pkgs/applications/version-management/gitlab/nulladapter.patch
@@ -22,8 +22,8 @@ index e2b3d55..23a5454 100644
 --- a/Gemfile.lock
 +++ b/Gemfile.lock
 @@ -32,6 +32,8 @@ GEM
-       activemodel (= 4.2.7)
-       activesupport (= 4.2.7)
+       activemodel (= 4.2.7.1)
+       activesupport (= 4.2.7.1)
        arel (~> 6.0)
 +    activerecord-nulldb-adapter (0.3.3)
 +      activerecord (>= 2.0.0)
diff --git a/pkgs/applications/version-management/mercurial/default.nix b/pkgs/applications/version-management/mercurial/default.nix
index 682f4cfc6bab..d3f5f39dde04 100644
--- a/pkgs/applications/version-management/mercurial/default.nix
+++ b/pkgs/applications/version-management/mercurial/default.nix
@@ -1,11 +1,12 @@
-{ stdenv, fetchurl, python, makeWrapper, docutils, unzip, hg-git, dulwich
-, guiSupport ? false, tk ? null, curses
+{ stdenv, fetchurl, pythonPackages, makeWrapper, docutils, unzip
+, guiSupport ? false, tk ? null
 , ApplicationServices, cf-private }:
 
 let
   # if you bump version, update pkgs.tortoisehg too or ping maintainer
   version = "3.8.2";
   name = "mercurial-${version}";
+  inherit (pythonPackages) curses docutils hg-git dulwich python;
 in
 
 stdenv.mkDerivation {
diff --git a/pkgs/applications/version-management/rabbitvcs/default.nix b/pkgs/applications/version-management/rabbitvcs/default.nix
index 0f2f7646ac6a..212151b6c4a9 100644
--- a/pkgs/applications/version-management/rabbitvcs/default.nix
+++ b/pkgs/applications/version-management/rabbitvcs/default.nix
@@ -11,7 +11,7 @@ python2Packages.buildPythonApplication rec {
     sha256 = "0964pdylrx4n9c9l8ncwv4q1p63y4hadb5v4pgvm0m2fah2jlkly";
   };
 
-  pythonPath = with python2Packages; [ configobj dbus pygobject pygtk simplejson pysvn dulwich tkinter gvfs xdg_utils ];
+  pythonPath = with python2Packages; [ configobj dbus-python pygobject pygtk simplejson pysvn dulwich tkinter gvfs xdg_utils ];
 
   prePatch = ''
       sed -ie 's|if sys\.argv\[1\] == "install":|if False:|' ./setup.py
diff --git a/pkgs/applications/video/devede/default.nix b/pkgs/applications/video/devede/default.nix
index ce44377260e7..824ef9661b8e 100644
--- a/pkgs/applications/video/devede/default.nix
+++ b/pkgs/applications/video/devede/default.nix
@@ -1,7 +1,7 @@
-{ pkgs, stdenv, fetchurl, pythonPackages, buildPythonApplication, pygtk, ffmpeg, mplayer, vcdimager, cdrkit, dvdauthor }:
+{ pkgs, stdenv, fetchurl, pythonPackages, ffmpeg, mplayer, vcdimager, cdrkit, dvdauthor }:
 
 let
-  inherit (pythonPackages) dbus;
+  inherit (pythonPackages) dbus-python buildPythonApplication pygtk;
 
 in buildPythonApplication rec {
   name = "devede-3.23.0";
@@ -14,7 +14,7 @@ in buildPythonApplication rec {
 
   buildInputs = [ ffmpeg ];
 
-  propagatedBuildInputs = [ pygtk dbus ffmpeg mplayer dvdauthor vcdimager cdrkit ];
+  propagatedBuildInputs = [ pygtk dbus-python ffmpeg mplayer dvdauthor vcdimager cdrkit ];
 
   postPatch = ''
     substituteInPlace devede --replace "/usr/share/devede" "$out/share/devede"
diff --git a/pkgs/applications/video/kazam/default.nix b/pkgs/applications/video/kazam/default.nix
index 6f0a811fe828..9113ff75bfd8 100644
--- a/pkgs/applications/video/kazam/default.nix
+++ b/pkgs/applications/video/kazam/default.nix
@@ -16,11 +16,11 @@ python3Packages.buildPythonApplication rec {
   buildInputs = with python3Packages;
     [ pygobject3 pyxdg pycairo gst_all_1.gstreamer gst_all_1.gst-plugins-base
       gst_all_1.gst-plugins-good gobjectIntrospection gtk3 libwnck3 distutils_extra
-      intltool dbus ];
+      intltool dbus-python ];
 
   # TODO: figure out why PYTHONPATH is not passed automatically for those programs
   pythonPath = with python3Packages;
-    [ pygobject3 pyxdg pycairo dbus ];
+    [ pygobject3 pyxdg pycairo dbus-python ];
 
   patches = [ ./datadir.patch ./bug_1190693.patch ];
   prePatch = ''
diff --git a/pkgs/applications/video/miro/default.nix b/pkgs/applications/video/miro/default.nix
index 266f3978b992..2a45c1a9eb2f 100644
--- a/pkgs/applications/video/miro/default.nix
+++ b/pkgs/applications/video/miro/default.nix
@@ -75,7 +75,7 @@ in buildPythonApplication rec {
   ];
 
   propagatedBuildInputs = with pythonPackages; [
-    pygobject pygtk pycurl sqlite3 mutagen pycairo dbus
+    pygobject pygtk pycurl sqlite3 mutagen pycairo dbus-python
     pywebkitgtk] ++ [ libtorrentRasterbar
     gst_python gst_plugins_base gst_plugins_good gst_ffmpeg
   ] ++ optional enableBonjour avahi;
diff --git a/pkgs/applications/video/pitivi/default.nix b/pkgs/applications/video/pitivi/default.nix
index 4a831fe110f4..d487f07e3d6d 100644
--- a/pkgs/applications/video/pitivi/default.nix
+++ b/pkgs/applications/video/pitivi/default.nix
@@ -43,7 +43,7 @@ in stdenv.mkDerivation rec {
     gst-plugins-bad gst-plugins-ugly gst-libav gst-validate
   ]) ++ (with python3Packages; [
     python pygobject3 gst-python pyxdg numpy pycairo sqlite3 matplotlib
-    dbus
+    dbus-python
   ]);
 
   meta = with stdenv.lib; {
diff --git a/pkgs/applications/virtualization/virt-manager/default.nix b/pkgs/applications/virtualization/virt-manager/default.nix
index 1a0f8f936253..5cda21066b55 100644
--- a/pkgs/applications/virtualization/virt-manager/default.nix
+++ b/pkgs/applications/virtualization/virt-manager/default.nix
@@ -1,5 +1,5 @@
-{ stdenv, fetchurl, pythonPackages, intltool, libxml2Python, curl, python
-, wrapGAppsHook, virtinst, pyGtkGlade, pythonDBus, gnome_python, gtkvnc, vte
+{ stdenv, fetchurl, pythonPackages, intltool, libxml2Python, curl
+, wrapGAppsHook, virtinst, gnome_python, gtkvnc, vte
 , gtk3, gobjectIntrospection, libvirt-glib, gsettings_desktop_schemas, glib
 , avahi, dconf, spiceSupport ? true, spice_gtk, libosinfo, gnome3, system-libvirt
 }:
@@ -21,7 +21,7 @@ buildPythonApplication rec {
     [ eventlet greenlet gflags netaddr carrot routes
       PasteDeploy m2crypto ipy twisted
       distutils_extra simplejson readline glanceclient cheetah lockfile httplib2
-      urlgrabber virtinst pyGtkGlade pythonDBus gnome_python pygobject3
+      urlgrabber virtinst pyGtkGlade dbus-python gnome_python pygobject3
       libvirt libxml2Python ipaddr vte libosinfo gobjectIntrospection gtk3 mox
       gtkvnc libvirt-glib glib gsettings_desktop_schemas gnome3.defaultIconTheme
       wrapGAppsHook
diff --git a/pkgs/applications/virtualization/xen/4.5.0.nix b/pkgs/applications/virtualization/xen/4.5.0.nix
index 48b3ee4d75b1..887734ac6b99 100644
--- a/pkgs/applications/virtualization/xen/4.5.0.nix
+++ b/pkgs/applications/virtualization/xen/4.5.0.nix
@@ -2,12 +2,12 @@
 
 let
   # Xen 4.5.0
-  xenConfig = {
-    name = "xen-4.5.0";
+  xenConfig = rec {
     version = "4.5.0";
+    name = "xen-${version}";
 
     src = fetchurl {
-      url = "http://bits.xensource.com/oss-xen/release/4.5.0/xen-4.5.0.tar.gz";
+      url = "http://bits.xensource.com/oss-xen/release/${version}/${name}.tar.gz";
       sha256 = "0fvg00d596gh6cfm51xr8kj2mghcyivrf6np3dafnbldnbi41nsv";
     };
 
@@ -15,14 +15,14 @@ let
     firmwareGits =
       [ # tag 1.7.5
         { git = { name = "seabios";
-                  url = git://xenbits.xen.org/seabios.git;
+                  url = https://xenbits.xen.org/git-http/seabios.git;
                   rev = "e51488c5f8800a52ac5c8da7a31b85cca5cc95d2";
-                  sha256 = "b96a0b9f31cab0f3993d007dcbe5f1bd69ad02b0a23eb2dc8a3ed1aafe7985cb";
+                  sha256 = "0jk54ybhmw97pzyhpm6jr2x99f702kbn0ipxv5qxcbynflgdazyb";
                 };
           patches = [ ./0000-qemu-seabios-enable-ATA_DMA.patch ];
         }
         { git = { name = "ovmf";
-                  url = git://xenbits.xen.org/ovmf.git;
+                  url = https://xenbits.xen.org/git-http/ovmf.git;
                   rev = "447d264115c476142f884af0be287622cd244423";
                   sha256 = "7086f882495a8be1497d881074e8f1005dc283a5e1686aec06c1913c76a6319b";
                 };
@@ -32,20 +32,20 @@ let
     toolsGits =
       [ # tag qemu-xen-4.5.0
         { git = { name = "qemu-xen";
-                  url = git://xenbits.xen.org/qemu-upstream-4.5-testing.git;
+                  url = https://xenbits.xen.org/git-http/qemu-xen.git;
                   rev = "1ebb75b1fee779621b63e84fefa7b07354c43a99";
-                  sha256 = "1j312q2mqvkvby9adkkxf7f1pn3nz85g5mr9nbg4qpf2y9cg122z";
+                  sha256 = "0yp9vmna3yl28vm5fkirghzhndaihmsm34fjzgr9sl6s46wx5yzg";
                 };
         }
         # tag xen-4.5.0
         { git = { name = "qemu-xen-traditional";
-                  url = git://xenbits.xen.org/qemu-xen-4.5-testing.git;
+                  url = https://xenbits.xen.org/git-http/qemu-xen-traditional.git;
                   rev = "b0d42741f8e9a00854c3b3faca1da84bfc69bf22";
-                  sha256 = "ce52b5108936c30ab85ec0c9554f88d5e7b34896f3acb666d56765b49c86f2af";
+                  sha256 = "1lxlf1s81y5j0rhzzm1f4sbyrnbvd32vxiczs1qjcg6ls866vlki";
                 };
         }
         { git = { name = "xen-libhvm";
-                  url = "https://github.com/ts468/xen-libhvm";
+                  url = https://github.com/ts468/xen-libhvm;
                   rev = "442dcc4f6f4e374a51e4613532468bd6b48bdf63";
                   sha256 = "9ba97c39a00a54c154785716aa06691d312c99be498ebbc00dc3769968178ba8";
                 };
@@ -77,4 +77,3 @@ let
   };
 
 in callPackage ./generic.nix (args // { xenConfig=xenConfig; })
-
diff --git a/pkgs/applications/virtualization/xen/4.5.2.nix b/pkgs/applications/virtualization/xen/4.5.2.nix
index f8f7630189f2..e0b13edb1f23 100644
--- a/pkgs/applications/virtualization/xen/4.5.2.nix
+++ b/pkgs/applications/virtualization/xen/4.5.2.nix
@@ -15,16 +15,16 @@ let
     firmwareGits =
       [ # tag 1.7.5
         { git = { name = "seabios";
-                  url = git://xenbits.xen.org/seabios.git;
+                  url = https://xenbits.xen.org/git-http/seabios.git;
                   rev = "e51488c5f8800a52ac5c8da7a31b85cca5cc95d2";
-                  sha256 = "b96a0b9f31cab0f3993d007dcbe5f1bd69ad02b0a23eb2dc8a3ed1aafe7985cb";
+                  sha256 = "0jk54ybhmw97pzyhpm6jr2x99f702kbn0ipxv5qxcbynflgdazyb";
                 };
           patches = [ ./0000-qemu-seabios-enable-ATA_DMA.patch ];
         }
         { git = { name = "ovmf";
-                  url = git://xenbits.xen.org/ovmf.git;
+                  url = https://xenbits.xen.org/git-http/ovmf.git;
                   rev = "cb9a7ebabcd6b8a49dc0854b2f9592d732b5afbd";
-                  sha256 = "1ncb8dpqzaj3s8am44jvclhby40hwczljz0a1gd282h9yr4k4sk2";
+                  sha256 = "07zmdj90zjrzip74fvd4ss8n8njk6cim85s58mc6snxmqqv7gmcq";
                 };
         }
       ];
@@ -32,20 +32,20 @@ let
     toolsGits =
       [ # tag qemu-xen-4.5.2
         { git = { name = "qemu-xen";
-                  url = git://xenbits.xen.org/qemu-upstream-4.5-testing.git;
+                  url = https://xenbits.xen.org/git-http/qemu-xen.git;
                   rev = "e5a1bb22cfb307db909dbd3404c48e5bbeb9e66d";
-                  sha256 = "1qflb3j8qcvipavybqhi0ql7m2bx51lhzgmf7pdbls8minpvdzg2";
+                  sha256 = "00h6hc1y19y9wafxk01hvwm2j8lysz26wi2dnv8md76zxavg4maa";
                 };
         }
         # tag xen-4.5.2
         { git = { name = "qemu-xen-traditional";
-                  url = git://xenbits.xen.org/qemu-xen-4.5-testing.git;
+                  url = https://xenbits.xen.org/git-http/qemu-xen-traditional.git;
                   rev = "dfe880e8d5fdc863ce6bbcdcaebaf918f8689cc0";
-                  sha256 = "14fxdsnkq729z5glkifdpz26idmn7fl38w1v97xj8cf6ifvk76cz";
+                  sha256 = "07jwpxgk9ls5hma6vv1frnx1aczlvpddlgiyii9qmmlxxwjs21yj";
                 };
         }
         { git = { name = "xen-libhvm";
-                  url = "https://github.com/ts468/xen-libhvm";
+                  url = https://github.com/ts468/xen-libhvm;
                   rev = "442dcc4f6f4e374a51e4613532468bd6b48bdf63";
                   sha256 = "9ba97c39a00a54c154785716aa06691d312c99be498ebbc00dc3769968178ba8";
                 };
diff --git a/pkgs/applications/window-managers/compiz/default.nix b/pkgs/applications/window-managers/compiz/default.nix
index 09c36835dad6..46b8c8affc70 100644
--- a/pkgs/applications/window-managers/compiz/default.nix
+++ b/pkgs/applications/window-managers/compiz/default.nix
@@ -1,17 +1,19 @@
-{stdenv, fetchurl, cmake, pkgconfig
+{ stdenv, fetchurl, cmake, pkgconfig
 , libXrender, renderproto, gtk, libwnck, pango, cairo
 , GConf, libXdamage, damageproto, libxml2, libxslt, glibmm
 , metacity
 , libstartup_notification, libpthreadstubs, libxcb, intltool
 , ORBit2, libXau, libICE, libSM
 , dbus, dbus_glib, librsvg, mesa
-, libXdmcp, libnotify, python
-, hicolor_icon_theme, libjpeg_turbo, libsigcxx, protobuf, pygtk, pythonDBus
+, libXdmcp, libnotify, pythonPackages
+, hicolor_icon_theme, libjpeg_turbo, libsigcxx, protobuf
 , xdg_utils
 , gettext, boost, pyrex
 , makeWrapper
 }:
 let
+  inherit (pythonPackages) python dbus-python pygtk;
+
   s = # Generated upstream information
   rec {
     baseName="compiz";
@@ -29,7 +31,7 @@ let
     ORBit2 libXau libICE libSM
     dbus dbus_glib librsvg mesa
     libXdmcp libnotify python
-    hicolor_icon_theme libjpeg_turbo libsigcxx protobuf pygtk pythonDBus
+    hicolor_icon_theme libjpeg_turbo libsigcxx protobuf pygtk dbus-python
     xdg_utils
     gettext boost pyrex
     makeWrapper 
diff --git a/pkgs/data/fonts/nerdfonts/default.nix b/pkgs/data/fonts/nerdfonts/default.nix
index 1f8d17509f74..894325e5b7fe 100644
--- a/pkgs/data/fonts/nerdfonts/default.nix
+++ b/pkgs/data/fonts/nerdfonts/default.nix
@@ -1,13 +1,13 @@
-{ stdenv, fetchFromGitHub, bash, which }:
+{ stdenv, fetchFromGitHub, bash, which, withFont ? "" }:
 
 stdenv.mkDerivation rec {
-  version = "0.7.0";
+  version = "0.8.0";
   name = "nerdfonts-${version}";
   src = fetchFromGitHub {
     owner = "ryanoasis";
     repo = "nerd-fonts";
     rev = version;
-    sha256 = "0q2h8hpkbid8idi2kvzx5bnhyh65y51k02g7xpv3drjqj08cz7y0";
+    sha256 = "0n7idfk4460j8g0rw73hzz195pdh4c916hpc5r6dxpvgcmvryzc5";
   };
   dontPatchShebangs = true;
   buildInputs = [ which ];
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   '';
   installPhase = ''
     mkdir -p $out/share/fonts/truetype
-    ./install.sh
+    ./install.sh ${withFont}
   '';
   meta = with stdenv.lib; {
     description = "Nerd Fonts is a project that attempts to patch as many developer targeted and/or used fonts as possible. The patch is to specifically add a high number of additional glyphs from popular 'iconic fonts' such as Font Awesome, Devicons, Octicons, and others.";
diff --git a/pkgs/desktops/enlightenment/econnman.nix b/pkgs/desktops/enlightenment/econnman.nix
index 0dabd7f1347f..9cde3cf45943 100644
--- a/pkgs/desktops/enlightenment/econnman.nix
+++ b/pkgs/desktops/enlightenment/econnman.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
   };
 
   buildInputs = [ makeWrapper pkgconfig efl python2Packages.python python2Packages.wrapPython dbus ];
-  pythonPath = [ python2Packages.pythonefl python2Packages.dbus elementary ];
+  pythonPath = [ python2Packages.pythonefl python2Packages.dbus-python elementary ];
   postInstall = ''
     wrapPythonPrograms
   '';
diff --git a/pkgs/desktops/enlightenment/efl.nix b/pkgs/desktops/enlightenment/efl.nix
index 19079d7793d0..fc584b432f10 100644
--- a/pkgs/desktops/enlightenment/efl.nix
+++ b/pkgs/desktops/enlightenment/efl.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     gst_all_1.gst-libav libpulseaudio libsndfile xorg.libXcursor xorg.printproto
     xorg.libX11 udev utillinux systemd ];
 
-  propagatedBuildInputs = [ libxkbcommon python27Packages.dbus dbus libjpeg xorg.libXcomposite
+  propagatedBuildInputs = [ libxkbcommon python27Packages.dbus-python dbus libjpeg xorg.libXcomposite
     xorg.libXdamage xorg.libXinerama xorg.libXp xorg.libXtst xorg.libXi xorg.libXext
     bullet xorg.libXScrnSaver xorg.libXrender xorg.libXfixes xorg.libXrandr
     xorg.libxkbfile xorg.libxcb xorg.xcbutilkeysyms openjpeg doxygen expat luajit
diff --git a/pkgs/desktops/gnome-2/bindings/gnome-python/default.nix b/pkgs/desktops/gnome-2/bindings/gnome-python/default.nix
index 41ca17bd5e49..b019951db5ff 100644
--- a/pkgs/desktops/gnome-2/bindings/gnome-python/default.nix
+++ b/pkgs/desktops/gnome-2/bindings/gnome-python/default.nix
@@ -1,8 +1,10 @@
-{ stdenv, fetchurl, python, pkgconfig, libgnome, GConf, pygobject, pygtk, glib, gtk, pythonDBus,  gnome_vfs}:
+{ stdenv, fetchurl, pythonPackages, pkgconfig, libgnome, GConf, glib, gtk, gnome_vfs}:
 
 with stdenv.lib;
 
-stdenv.mkDerivation rec {
+let
+  inherit (pythonPackages) python pygobject pygtk dbus-python;
+in stdenv.mkDerivation rec {
   version = "2.28";
   name = "gnome-python-${version}.1";
 
@@ -28,7 +30,7 @@ stdenv.mkDerivation rec {
     cp bonobo/*.{py,defs} $out/share/pygtk/2.0/defs/
   '';
 
-  buildInputs = [ python pkgconfig pygobject pygtk glib gtk GConf libgnome pythonDBus gnome_vfs ];
+  buildInputs = [ python pkgconfig pygobject pygtk glib gtk GConf libgnome dbus-python gnome_vfs ];
 
   doCheck = false;
 
diff --git a/pkgs/desktops/gnome-3/3.20/apps/accerciser/default.nix b/pkgs/desktops/gnome-3/3.20/apps/accerciser/default.nix
index a2813e0581b3..f8856ca71307 100644
--- a/pkgs/desktops/gnome-3/3.20/apps/accerciser/default.nix
+++ b/pkgs/desktops/gnome-3/3.20/apps/accerciser/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, pkgconfig, gnome3, gtk3, wrapGAppsHook
-, itstool, libxml2, python3, python3Packages, pyatspi, at_spi2_core
+, itstool, libxml2, python3Packages, at_spi2_core
 , dbus, intltool, libwnck3 }:
 
 stdenv.mkDerivation rec {
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
   };
 
   buildInputs = [
-    pkgconfig gtk3 wrapGAppsHook itstool libxml2 python3 pyatspi
+    pkgconfig gtk3 wrapGAppsHook itstool libxml2 python3Packages.python python3Packages.pyatspi
     python3Packages.pygobject3 python3Packages.ipython
     at_spi2_core dbus intltool libwnck3 gnome3.defaultIconTheme
   ];
diff --git a/pkgs/desktops/gnome-3/3.20/apps/gnome-music/default.nix b/pkgs/desktops/gnome-3/3.20/apps/gnome-music/default.nix
index f48feb205790..ea8f15fd4e59 100644
--- a/pkgs/desktops/gnome-3/3.20/apps/gnome-music/default.nix
+++ b/pkgs/desktops/gnome-3/3.20/apps/gnome-music/default.nix
@@ -1,5 +1,5 @@
 { stdenv, intltool, fetchurl, gdk_pixbuf, tracker
-, python3, libxml2, python3Packages, libnotify, wrapGAppsHook
+, libxml2, python3Packages, libnotify, wrapGAppsHook
 , pkgconfig, gtk3, glib, cairo
 , makeWrapper, itstool, gnome3, librsvg, gst_all_1 }:
 
@@ -9,9 +9,9 @@ stdenv.mkDerivation rec {
   propagatedUserEnvPkgs = [ gnome3.gnome_themes_standard ];
 
   buildInputs = [ pkgconfig gtk3 glib intltool itstool gnome3.libmediaart
-                  gdk_pixbuf gnome3.defaultIconTheme librsvg python3
+                  gdk_pixbuf gnome3.defaultIconTheme librsvg python3Packages.python
                   gnome3.grilo gnome3.grilo-plugins gnome3.totem-pl-parser libxml2 libnotify
-                  python3Packages.pycairo python3Packages.dbus python3Packages.requests2
+                  python3Packages.pycairo python3Packages.dbus-python python3Packages.requests2
                   python3Packages.pygobject3 gst_all_1.gstreamer gst_all_1.gst-plugins-base
                   gst_all_1.gst-plugins-good gst_all_1.gst-plugins-bad wrapGAppsHook
                   gnome3.gsettings_desktop_schemas makeWrapper tracker ];
diff --git a/pkgs/development/compilers/llvm/3.8/llvm.nix b/pkgs/development/compilers/llvm/3.8/llvm.nix
index fb8266480326..fc29d00a5245 100644
--- a/pkgs/development/compilers/llvm/3.8/llvm.nix
+++ b/pkgs/development/compilers/llvm/3.8/llvm.nix
@@ -14,7 +14,7 @@
 , compiler-rt_src
 , libcxxabi
 , debugVersion ? false
-, enableSharedLibraries ? !stdenv.isDarwin
+, enableSharedLibraries ? true
 }:
 
 let
@@ -69,6 +69,11 @@ in stdenv.mkDerivation rec {
     paxmark m bin/{lli,llvm-rtdyld}
   '';
 
+  postInstall = stdenv.lib.optionalString (stdenv.isDarwin && enableSharedLibraries) ''
+    install_name_tool -id $out/lib/libLLVM.dylib $out/lib/libLLVM.dylib
+    ln -s $out/lib/libLLVM.dylib $out/lib/libLLVM-${version}.dylib
+  '';
+
   enableParallelBuilding = true;
 
   passthru.src = src;
diff --git a/pkgs/development/libraries/mlt/default.nix b/pkgs/development/libraries/mlt/default.nix
index 2bb709612b44..2e51492f142e 100644
--- a/pkgs/development/libraries/mlt/default.nix
+++ b/pkgs/development/libraries/mlt/default.nix
@@ -1,19 +1,24 @@
-{ stdenv, fetchurl, SDL, ffmpeg, frei0r, libjack2, libdv, libsamplerate
-, libvorbis, libxml2, makeWrapper, movit, pkgconfig, qt, sox
+{ stdenv, fetchFromGitHub, makeWrapper
+, SDL, ffmpeg, frei0r, libjack2, libdv, libsamplerate
+, libvorbis, libxml2, movit, pkgconfig, sox
+, gtk2
 }:
 
 stdenv.mkDerivation rec {
   name = "mlt-${version}";
-  version = "0.9.6";
+  version = "6.2.0";
 
-  src = fetchurl {
-    url = "https://github.com/mltframework/mlt/archive/v${version}.tar.gz";
-    sha256 = "0s8ypg0q50zfcmq527y8cbdvzxhiqidm1923k28ar8jqmjp45ssh";
+  src = fetchFromGitHub {
+    owner = "mltframework";
+    repo = "mlt";
+    rev = "v${version}";
+    sha256 = "17jwz1lf9ilaxvgvhg7z86dhcsk95m4wlszy4gn7wab2ns5zhdm7";
   };
 
   buildInputs = [
     SDL ffmpeg frei0r libjack2 libdv libsamplerate libvorbis libxml2
-    makeWrapper movit pkgconfig qt sox
+    makeWrapper movit pkgconfig sox
+    gtk2
   ];
 
   # Mostly taken from:
@@ -33,7 +38,7 @@ stdenv.mkDerivation rec {
     description = "Open source multimedia framework, designed for television broadcasting";
     homepage = http://www.mltframework.org/;
     license = licenses.gpl3;
-    maintainers = [ maintainers.goibhniu ];
+    maintainers = [ maintainers.tohl ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/development/libraries/mlt/qt-4.nix b/pkgs/development/libraries/mlt/qt-4.nix
new file mode 100644
index 000000000000..2bb709612b44
--- /dev/null
+++ b/pkgs/development/libraries/mlt/qt-4.nix
@@ -0,0 +1,39 @@
+{ stdenv, fetchurl, SDL, ffmpeg, frei0r, libjack2, libdv, libsamplerate
+, libvorbis, libxml2, makeWrapper, movit, pkgconfig, qt, sox
+}:
+
+stdenv.mkDerivation rec {
+  name = "mlt-${version}";
+  version = "0.9.6";
+
+  src = fetchurl {
+    url = "https://github.com/mltframework/mlt/archive/v${version}.tar.gz";
+    sha256 = "0s8ypg0q50zfcmq527y8cbdvzxhiqidm1923k28ar8jqmjp45ssh";
+  };
+
+  buildInputs = [
+    SDL ffmpeg frei0r libjack2 libdv libsamplerate libvorbis libxml2
+    makeWrapper movit pkgconfig qt sox
+  ];
+
+  # Mostly taken from:
+  # http://www.kdenlive.org/user-manual/downloading-and-installing-kdenlive/installing-source/installing-mlt-rendering-engine
+  configureFlags = [
+    "--avformat-swscale" "--enable-gpl" "--enable-gpl" "--enable-gpl3"
+    "--enable-opengl"
+  ];
+
+  enableParallelBuilding = true;
+
+  postInstall = ''
+    wrapProgram $out/bin/melt --prefix FREI0R_PATH : ${frei0r}/lib/frei0r-1
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Open source multimedia framework, designed for television broadcasting";
+    homepage = http://www.mltframework.org/;
+    license = licenses.gpl3;
+    maintainers = [ maintainers.goibhniu ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/development/libraries/mlt/qt-5.nix b/pkgs/development/libraries/mlt/qt-5.nix
index b279371b2109..259d5a25d15b 100644
--- a/pkgs/development/libraries/mlt/qt-5.nix
+++ b/pkgs/development/libraries/mlt/qt-5.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   name = "mlt-${version}";
-  version = "0.9.8";
+  version = "6.2.0";
 
   src = fetchurl {
     url = "https://github.com/mltframework/mlt/archive/v${version}.tar.gz";
-    sha256 = "0x0hsb05i7g70dh3jll41qlvcylailfgsr0y1dpx7hyigynxc50j";
+    sha256 = "1zwzfgxrcbwkxnkiwv0a1rzxdnnaly90yyarl9wdw84nx11ffbnx";
   };
 
   buildInputs = [
diff --git a/pkgs/development/libraries/protobuf/3.0.nix b/pkgs/development/libraries/protobuf/3.0.nix
index a547dff14cc2..16a39daf7907 100644
--- a/pkgs/development/libraries/protobuf/3.0.nix
+++ b/pkgs/development/libraries/protobuf/3.0.nix
@@ -3,13 +3,13 @@
 stdenv.mkDerivation rec {
   name = "protobuf-${version}";
 
-  version = "3.0.0-beta-3.1";
+  version = "3.0.0";
   # make sure you test also -A pythonPackages.protobuf
   src = fetchFromGitHub {
     owner = "google";
     repo = "protobuf";
     rev = "v${version}";
-    sha256 = "1lj3q1wq821q9h2y2hhbnvyy4nw3gl0x2g0kplyvd6ivrissfcqx";
+    sha256 = "05qkcl96lkdama848m7q3nzzzdckjc158iiyvgmln0zi232xx7g7";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/telepathy/qt/default.nix b/pkgs/development/libraries/telepathy/qt/default.nix
index e3e579eefdb6..6c2713c1ebe6 100644
--- a/pkgs/development/libraries/telepathy/qt/default.nix
+++ b/pkgs/development/libraries/telepathy/qt/default.nix
@@ -1,7 +1,9 @@
-{ stdenv, fetchurl, cmake, qtbase, pkgconfig, python, dbus_glib, dbus_daemon
-, telepathy_farstream, telepathy_glib, pythonDBus, fetchpatch }:
+{ stdenv, fetchurl, cmake, qtbase, pkgconfig, pythonPackages, dbus_glib, dbus_daemon
+, telepathy_farstream, telepathy_glib, fetchpatch }:
 
-stdenv.mkDerivation rec {
+let
+  inherit (pythonPackages) python dbus-python;
+in stdenv.mkDerivation rec {
   name = "telepathy-qt-0.9.6.1";
 
   src = fetchurl {
@@ -30,7 +32,7 @@ stdenv.mkDerivation rec {
     ];
 
   nativeBuildInputs = [ cmake pkgconfig python ];
-  propagatedBuildInputs = [ qtbase dbus_glib telepathy_farstream telepathy_glib pythonDBus ];
+  propagatedBuildInputs = [ qtbase dbus_glib telepathy_farstream telepathy_glib dbus-python ];
 
   buildInputs = stdenv.lib.optional doCheck dbus_daemon;
 
diff --git a/pkgs/development/python-modules/pyqt/4.x.nix b/pkgs/development/python-modules/pyqt/4.x.nix
index ead5c4ffe9d2..0464d64d57b4 100644
--- a/pkgs/development/python-modules/pyqt/4.x.nix
+++ b/pkgs/development/python-modules/pyqt/4.x.nix
@@ -1,8 +1,9 @@
-{ stdenv, fetchurl, python, pythonPackages, qt4, pythonDBus, pkgconfig, lndir, makeWrapper }:
+{ stdenv, fetchurl, pythonPackages, qt4, pkgconfig, lndir, makeWrapper }:
 
-let version = "4.11.3";
-in
-stdenv.mkDerivation {
+let
+  version = "4.11.3";
+  inherit (pythonPackages) python dbus-python;
+in stdenv.mkDerivation {
   name = "${python.libPrefix}-PyQt-x11-gpl-${version}";
 
   src = fetchurl {
@@ -12,7 +13,7 @@ stdenv.mkDerivation {
 
   configurePhase = ''
     mkdir -p $out
-    lndir ${pythonDBus} $out
+    lndir ${dbus-python} $out
 
     export PYTHONPATH=$PYTHONPATH:$out/lib/${python.libPrefix}/site-packages
 
diff --git a/pkgs/development/python-modules/pyqt/5.x.nix b/pkgs/development/python-modules/pyqt/5.x.nix
index 69fb6e266ea5..7418c4785e90 100644
--- a/pkgs/development/python-modules/pyqt/5.x.nix
+++ b/pkgs/development/python-modules/pyqt/5.x.nix
@@ -1,8 +1,10 @@
-{ stdenv, fetchurl, python, pkgconfig, qtbase, qtsvg, qtwebkit, sip, pythonDBus
+{ stdenv, fetchurl, pythonPackages, pkgconfig, qtbase, qtsvg, qtwebkit
 , lndir, makeWrapper, qmakeHook }:
 
 let
   version = "5.5.1";
+  inherit (pythonPackages) python dbus-python;
+  sip = pythonPackages.sip_4_16;
 in stdenv.mkDerivation {
   name = "${python.libPrefix}-PyQt-${version}";
 
@@ -30,7 +32,7 @@ in stdenv.mkDerivation {
     runHook preConfigure
 
     mkdir -p $out
-    lndir ${pythonDBus} $out
+    lndir ${dbus-python} $out
 
     export PYTHONPATH=$PYTHONPATH:$out/lib/${python.libPrefix}/site-packages
 
diff --git a/pkgs/misc/emulators/cdemu/client.nix b/pkgs/misc/emulators/cdemu/client.nix
index b70e21788443..1cea479fb7b1 100644
--- a/pkgs/misc/emulators/cdemu/client.nix
+++ b/pkgs/misc/emulators/cdemu/client.nix
@@ -1,11 +1,11 @@
-{ callPackage, python, dbus_python, intltool, makeWrapper }:
+{ callPackage, pythonPackages, intltool, makeWrapper }:
 let pkg = import ./base.nix {
   version = "3.0.1";
   pkgName = "cdemu-client";
   pkgSha256 = "1kg5m7npdxli93vihhp033hgkvikw5b6fm0qwgvlvdjby7njyyyg";
 };
 in callPackage pkg {
-  buildInputs = [ python dbus_python intltool makeWrapper ];
+  buildInputs = [ pythonPackages.python pythonPackages.dbus-python intltool makeWrapper ];
   drvParams = {
     postFixup = ''
       wrapProgram $out/bin/cdemu \
diff --git a/pkgs/misc/jackaudio/default.nix b/pkgs/misc/jackaudio/default.nix
index 66be12fbc43f..06389c01ce0c 100644
--- a/pkgs/misc/jackaudio/default.nix
+++ b/pkgs/misc/jackaudio/default.nix
@@ -1,8 +1,8 @@
-{ stdenv, fetchFromGitHub, pkgconfig, python, makeWrapper
+{ stdenv, fetchFromGitHub, pkgconfig, pythonPackages, makeWrapper
 , bash, libsamplerate, libsndfile, readline, gcc
 
 # Optional Dependencies
-, dbus ? null, pythonDBus ? null, libffado ? null, alsaLib ? null
+, dbus ? null, libffado ? null, alsaLib ? null
 , libopus ? null
 
 # Extra options
@@ -11,12 +11,13 @@
 
 with stdenv.lib;
 let
+  inherit (pythonPackages) python dbus-python;
   shouldUsePkg = pkg: if pkg != null && stdenv.lib.any (x: x == stdenv.system) pkg.meta.platforms then pkg else null;
 
   libOnly = prefix == "lib";
 
   optDbus = shouldUsePkg dbus;
-  optPythonDBus = if libOnly then null else shouldUsePkg pythonDBus;
+  optPythonDBus = if libOnly then null else shouldUsePkg dbus-python;
   optLibffado = if libOnly then null else shouldUsePkg libffado;
   optAlsaLib = if libOnly then null else shouldUsePkg alsaLib;
   optLibopus = shouldUsePkg libopus;
diff --git a/pkgs/misc/jackaudio/git.nix b/pkgs/misc/jackaudio/git.nix
index fb47128595e2..7deeaadbb10c 100644
--- a/pkgs/misc/jackaudio/git.nix
+++ b/pkgs/misc/jackaudio/git.nix
@@ -1,8 +1,8 @@
-{ stdenv, fetchFromGitHub, pkgconfig, python, makeWrapper
+{ stdenv, fetchFromGitHub, pkgconfig, pythonPackages, makeWrapper
 , bash, libsamplerate, libsndfile, readline
 
 # Optional Dependencies
-, dbus ? null, pythonDBus ? null, libffado ? null, alsaLib ? null
+, dbus ? null, libffado ? null, alsaLib ? null
 , libopus ? null
 
 # Extra options
@@ -11,12 +11,13 @@
 
 with stdenv.lib;
 let
+  inherit (pythonPackages) python dbus-python;
   shouldUsePkg = pkg: if pkg != null && stdenv.lib.any (x: x == stdenv.system) pkg.meta.platforms then pkg else null;
 
   libOnly = prefix == "lib";
 
   optDbus = shouldUsePkg dbus;
-  optPythonDBus = if libOnly then null else shouldUsePkg pythonDBus;
+  optPythonDBus = if libOnly then null else shouldUsePkg dbus-python;
   optLibffado = if libOnly then null else shouldUsePkg libffado;
   optAlsaLib = if libOnly then null else shouldUsePkg alsaLib;
   optLibopus = shouldUsePkg libopus;
diff --git a/pkgs/os-specific/linux/bluez/bluez5.nix b/pkgs/os-specific/linux/bluez/bluez5.nix
index f29acaa13540..c08a04ae5f53 100644
--- a/pkgs/os-specific/linux/bluez/bluez5.nix
+++ b/pkgs/os-specific/linux/bluez/bluez5.nix
@@ -1,5 +1,5 @@
-{ stdenv, fetchurl, pkgconfig, dbus, glib, alsaLib, python,
-  pythonPackages, pythonDBus, readline, libsndfile, udev, libical,
+{ stdenv, fetchurl, pkgconfig, dbus, glib, alsaLib,
+  pythonPackages, readline, libsndfile, udev, libical,
   systemd, enableWiimote ? false }:
 
 assert stdenv.isLinux;
@@ -13,10 +13,10 @@ stdenv.mkDerivation rec {
   };
 
   pythonPath = with pythonPackages;
-    [ pythonDBus pygobject pygobject3 recursivePthLoader ];
+    [ dbus pygobject pygobject3 recursivePthLoader ];
 
   buildInputs =
-    [ pkgconfig dbus glib alsaLib python pythonPackages.wrapPython
+    [ pkgconfig dbus glib alsaLib pythonPackages.python pythonPackages.wrapPython
       readline libsndfile udev libical
       # Disables GStreamer; not clear what it gains us other than a
       # zillion extra dependencies.
diff --git a/pkgs/os-specific/linux/bluez/bluez5_28.nix b/pkgs/os-specific/linux/bluez/bluez5_28.nix
index 68db9345bd0e..829b383e072d 100644
--- a/pkgs/os-specific/linux/bluez/bluez5_28.nix
+++ b/pkgs/os-specific/linux/bluez/bluez5_28.nix
@@ -1,10 +1,12 @@
-{ stdenv, fetchurl, pkgconfig, dbus, glib, alsaLib, python,
-  pythonPackages, pythonDBus, readline, libsndfile, udev, libical,
+{ stdenv, fetchurl, pkgconfig, dbus, glib, alsaLib,
+  pythonPackages, readline, libsndfile, udev, libical,
   systemd, enableWiimote ? false }:
 
 assert stdenv.isLinux;
 
-stdenv.mkDerivation rec {
+let
+  inherit (pythonPackages) python;
+in stdenv.mkDerivation rec {
   name = "bluez-5.28";
    
   src = fetchurl {
@@ -13,7 +15,7 @@ stdenv.mkDerivation rec {
   };
 
   pythonPath = with pythonPackages;
-    [ pythonDBus pygobject pygobject3 recursivePthLoader ];
+    [ dbus pygobject pygobject3 recursivePthLoader ];
 
   buildInputs =
     [ pkgconfig dbus glib alsaLib python pythonPackages.wrapPython
diff --git a/pkgs/os-specific/linux/bluez/default.nix b/pkgs/os-specific/linux/bluez/default.nix
index ea979ed0c22b..9943a1de6d4b 100644
--- a/pkgs/os-specific/linux/bluez/default.nix
+++ b/pkgs/os-specific/linux/bluez/default.nix
@@ -1,14 +1,13 @@
-{ stdenv, fetchurl, pkgconfig, dbus, glib, libusb, alsaLib, python, makeWrapper
-, pythonDBus, pygobject, readline, libsndfile }:
+{ stdenv, fetchurl, pkgconfig, dbus, glib, libusb, alsaLib, pythonPackages, makeWrapper
+, readline, libsndfile }:
 
 assert stdenv.isLinux;
 
 let
-  pythonpath = "${pythonDBus}/lib/${python.libPrefix}/site-packages:"
-    + "${pygobject}/lib/${python.libPrefix}/site-packages";
-in
-   
-stdenv.mkDerivation rec {
+  inherit (pythonPackages) python;
+  pythonpath = "${pythonPackages.dbus}/lib/${python.libPrefix}/site-packages:"
+    + "${pythonPackages.pygobject}/lib/${python.libPrefix}/site-packages";
+in stdenv.mkDerivation rec {
   name = "bluez-4.101";
    
   src = fetchurl {
diff --git a/pkgs/os-specific/linux/ffado/default.nix b/pkgs/os-specific/linux/ffado/default.nix
index b0f545b2171f..ff259dcfbb05 100644
--- a/pkgs/os-specific/linux/ffado/default.nix
+++ b/pkgs/os-specific/linux/ffado/default.nix
@@ -3,7 +3,7 @@
 
 # Optional dependencies
 , libjack2 ? null, dbus ? null, dbus_cplusplus ? null, alsaLib ? null
-, pyqt4 ? null, pythonDBus ? null, xdg_utils ? null
+, pyqt4 ? null, dbus-python ? null, xdg_utils ? null
 
 # Other Flags
 , prefix ? ""
@@ -20,7 +20,7 @@ let
   optDbus_cplusplus = shouldUsePkg dbus_cplusplus;
   optAlsaLib = shouldUsePkg alsaLib;
   optPyqt4 = shouldUsePkg pyqt4;
-  optPythonDBus = shouldUsePkg pythonDBus;
+  optPythonDBus = shouldUsePkg dbus-python;
   optXdg_utils = shouldUsePkg xdg_utils;
 in
 stdenv.mkDerivation rec {
diff --git a/pkgs/os-specific/linux/gradm/default.nix b/pkgs/os-specific/linux/gradm/default.nix
index 52c839bdeddc..7f64ed227719 100644
--- a/pkgs/os-specific/linux/gradm/default.nix
+++ b/pkgs/os-specific/linux/gradm/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   name    = "gradm-${version}";
-  version = "3.1-201607172312";
+  version = "3.1-201608131257";
 
   src  = fetchurl {
     url    = "http://grsecurity.net/stable/${name}.tar.gz";
-    sha256 = "1r3fbrfijj8mbh3gl489q5bj2srj35f9f96i04nfmw427qpcg0a2";
+    sha256 = "0y5565rhil5ciprwz7nx4s4ah7dsxx7zrkg42dbq0mcg8m316xrb";
   };
 
   nativeBuildInputs = [ bison flex ];
diff --git a/pkgs/os-specific/linux/hd-idle/default.nix b/pkgs/os-specific/linux/hd-idle/default.nix
new file mode 100644
index 000000000000..911854384162
--- /dev/null
+++ b/pkgs/os-specific/linux/hd-idle/default.nix
@@ -0,0 +1,25 @@
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  name = "hd-idle-1.05";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/project/hd-idle/${name}.tgz";
+    sha256 = "031sm996s0rhy3z91b9xvyimsj2yd2fhsww2al2hxda5s5wzxzjf";
+  };
+
+  prePatch = ''
+    substituteInPlace Makefile \
+      --replace "-g root -o root" ""
+  '';
+
+  installFlags = [ "TARGET_DIR=$(out)" ];
+
+  meta = with stdenv.lib; {
+    description = "Spins down external disks after a period of idle time";
+    homepage = http://hd-idle.sourceforge.net/;
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.rycee ];
+  };
+}
diff --git a/pkgs/os-specific/linux/kernel/grsecurity-nixos-config.nix b/pkgs/os-specific/linux/kernel/grsecurity-nixos-config.nix
index 67bad8aeb401..4c81cd5b6ad0 100644
--- a/pkgs/os-specific/linux/kernel/grsecurity-nixos-config.nix
+++ b/pkgs/os-specific/linux/kernel/grsecurity-nixos-config.nix
@@ -13,6 +13,8 @@ GRKERNSEC_CONFIG_VIRT_EPT y
 GRKERNSEC_CONFIG_VIRT_KVM y
 GRKERNSEC_CONFIG_PRIORITY_SECURITY y
 
+PAX_SOFTMODE y
+
 PAX_PT_PAX_FLAGS y
 PAX_XATTR_PAX_FLAGS y
 PAX_EI_PAX n
@@ -20,7 +22,7 @@ PAX_EI_PAX n
 GRKERNSEC_PROC_GID 0
 
 PAX_LATENT_ENTROPY n
-PAX_SIZE_OVERFLOW n
+
 GRKERNSEC_HIDESYM n
 GRKERNSEC_RANDSTRUCT n
 GRKERNSEC_PROC n
diff --git a/pkgs/os-specific/linux/kernel/linux-4.1.nix b/pkgs/os-specific/linux/kernel/linux-4.1.nix
index 478e0d7ce242..9b23d3707758 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.1.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.1.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "4.1.27";
+  version = "4.1.30";
   extraMeta.branch = "4.1";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "02gkmn3j15wih6aq94p6mbivv996lr7zcj6vz4wh8wr7wmmy1kmv";
+    sha256 = "1iljmpr3b07fwhzzxkmx0pqz6ja8cnkx4fv52glcjrp6rjpfl8lx";
   };
 
   kernelPatches = args.kernelPatches;
diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix
index 56ab62e95e53..ef2bf8195396 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "4.4.17";
+  version = "4.4.18";
   extraMeta.branch = "4.4";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "10ags1n345irx1bi3fyal326b3m5myndz19v0klbvxhd3i3m350m";
+    sha256 = "0b2pna9l8hl2dc07faii3i0ixy382476pmh50wl1j8v1bz50rfg6";
   };
 
   kernelPatches = args.kernelPatches;
diff --git a/pkgs/os-specific/linux/kernel/linux-4.6.nix b/pkgs/os-specific/linux/kernel/linux-4.6.nix
index c7ea0a95f81c..6bca1bfe718c 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.6.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.6.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "4.6.6";
+  version = "4.6.7";
   extraMeta.branch = "4.6";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1lx00j0z0rasmc87mcvqd1h6r4znb9c2q22jbs2mrissr5w05vgm";
+    sha256 = "107acpq6jk48ng25jlyv905zslrrv77yxwr46mqbq5lxg8rdg7fh";
   };
 
   kernelPatches = args.kernelPatches;
diff --git a/pkgs/os-specific/linux/kernel/linux-4.7.nix b/pkgs/os-specific/linux/kernel/linux-4.7.nix
index 53fa5de5bb63..ad14eb20a634 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.7.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.7.nix
@@ -1,13 +1,12 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "4.7";
-  modDirVersion = "4.7.0";
+  version = "4.7.1";
   extraMeta.branch = "4.7";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "5190c3d1209aeda04168145bf50569dc0984f80467159b1dc50ad731e3285f10";
+    sha256 = "0dl1zc4xb8lwrryrpwfqmbnwciypzpah8vkhsl5nx0l3qcck6n15";
   };
 
   kernelPatches = args.kernelPatches;
diff --git a/pkgs/os-specific/linux/kernel/linux-grsecurity.nix b/pkgs/os-specific/linux/kernel/linux-grsecurity.nix
index be84d5f76da1..ad14eb20a634 100644
--- a/pkgs/os-specific/linux/kernel/linux-grsecurity.nix
+++ b/pkgs/os-specific/linux/kernel/linux-grsecurity.nix
@@ -1,13 +1,12 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "4.7";
-  modDirVersion = "4.7.0";
+  version = "4.7.1";
   extraMeta.branch = "4.7";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "042z53ik3mqaqlfrn5b70kw882fwd42zanqld10s1vcs438w742i";
+    sha256 = "0dl1zc4xb8lwrryrpwfqmbnwciypzpah8vkhsl5nx0l3qcck6n15";
   };
 
   kernelPatches = args.kernelPatches;
diff --git a/pkgs/os-specific/linux/kernel/patches.nix b/pkgs/os-specific/linux/kernel/patches.nix
index 62b70ac67c2a..96fb00a18164 100644
--- a/pkgs/os-specific/linux/kernel/patches.nix
+++ b/pkgs/os-specific/linux/kernel/patches.nix
@@ -93,9 +93,9 @@ rec {
   grsecurity_4_4 = throw "grsecurity stable is no longer supported";
 
   grsecurity_testing = grsecPatch
-    { kver   = "4.7";
-      grrev  = "201608131240";
-      sha256 = "0bcng47xk5nf4xwcl1l6a2nfb54b8v5piwg42nf3d99hy4si8fvd";
+    { kver   = "4.7.1";
+      grrev  = "201608161813";
+      sha256 = "0ppay8gv7ml7kajbin7gclhrpkmc6pggxcbzzngm7qwdjjk5pppj";
     };
 
   # This patch relaxes grsec constraints on the location of usermode helpers,
diff --git a/pkgs/os-specific/linux/pam_usb/default.nix b/pkgs/os-specific/linux/pam_usb/default.nix
index 67d9894a2a04..a96e951bf9b1 100644
--- a/pkgs/os-specific/linux/pam_usb/default.nix
+++ b/pkgs/os-specific/linux/pam_usb/default.nix
@@ -1,8 +1,9 @@
-{stdenv, fetchurl, makeWrapper, useSetUID, dbus, libxml2, pam, pkgconfig, pmount, python, pythonDBus}:
+{stdenv, fetchurl, makeWrapper, useSetUID, dbus, libxml2, pam, pkgconfig, pmount, pythonPackages}:
 
 let
   pmountBin = useSetUID pmount "/bin/pmount";
   pumountBin = useSetUID pmount "/bin/pumount";
+  inherit (pythonPackages) python dbus-python;
 in
 
 stdenv.mkDerivation rec {
@@ -36,7 +37,7 @@ stdenv.mkDerivation rec {
     for prog in $out/bin/pamusb-conf $out/bin/pamusb-agent; do
       substituteInPlace $prog --replace '/usr/bin/env python' '/bin/python'
       wrapProgram $prog \
-        --prefix PYTHONPATH : "$(toPythonPath ${pythonDBus})"
+        --prefix PYTHONPATH : "$(toPythonPath ${dbus-python})"
     done
   '';
 
diff --git a/pkgs/servers/mattermost/default.nix b/pkgs/servers/mattermost/default.nix
new file mode 100644
index 000000000000..977df3967554
--- /dev/null
+++ b/pkgs/servers/mattermost/default.nix
@@ -0,0 +1,29 @@
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  name = "mattermost-${version}";
+  version = "3.3.0";
+
+  src = fetchurl {
+    url = "https://releases.mattermost.com/${version}/mattermost-team-${version}-linux-amd64.tar.gz";
+    sha256 = "16mp75hv4lzkj99lj18c5vyqsmk9kqk5r81hirq41fgb6bdqx509";
+  };
+
+  installPhase = ''
+    mkdir -p $out
+    mv * $out/
+    ln -s ./platform $out/bin/mattermost-platform
+  '';
+
+  postFixup = ''
+    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" $out/bin/platform
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Open-Source, self-hosted Slack-alternative";
+    homepage = "https://www.mattermost.org";
+    license = with licenses; [ agpl3 asl20 ];
+    maintainers = with maintainers; [ fpletz ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/servers/mattermost/matterircd.nix b/pkgs/servers/mattermost/matterircd.nix
new file mode 100644
index 000000000000..f3b20add96d9
--- /dev/null
+++ b/pkgs/servers/mattermost/matterircd.nix
@@ -0,0 +1,23 @@
+{ stdenv, buildGoPackage, fetchFromGitHub }:
+
+buildGoPackage rec {
+  name = "matterircd-${version}";
+  version = "0.9.0";
+
+  src = fetchFromGitHub {
+    owner = "42wim";
+    repo = "matterircd";
+    rev = "v${version}";
+    sha256 = "1sh34vwi8ycmdsgpzqwa7gcjzb0rn46aig6n40hxy6q1lk2l6m3c";
+  };
+
+  goPackagePath = "github.com/42vim/matterircd";
+
+  meta = with stdenv.lib; {
+    inherit (src.meta) homepage;
+    description = "Minimal IRC server bridge to Mattermost";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fpletz ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/servers/neard/default.nix b/pkgs/servers/neard/default.nix
index b96fa684bfae..665e2ee8ed54 100644
--- a/pkgs/servers/neard/default.nix
+++ b/pkgs/servers/neard/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
   };
 
   buildInputs = [ autoreconfHook pkgconfig systemd glib dbus libnl pythonPackages.python pythonPackages.wrapPython ];
-  pythonPath = [ pythonPackages.pygobject pythonPackages.dbus pythonPackages.pygtk ];
+  pythonPath = [ pythonPackages.pygobject pythonPackages.dbus-python pythonPackages.pygtk ];
 
   configureFlags = [ "--disable-debug" "--enable-tools" "--enable-ese" "--with-systemdsystemunitdir=$out/lib/systemd/system" ];
 
diff --git a/pkgs/servers/nosql/influxdb/default.nix b/pkgs/servers/nosql/influxdb/default.nix
index f0eb408cbc12..20c4d699dd43 100644
--- a/pkgs/servers/nosql/influxdb/default.nix
+++ b/pkgs/servers/nosql/influxdb/default.nix
@@ -11,7 +11,7 @@ buildGoPackage rec {
 
   # Generated with the `gdm2nix.rb` script and the `Godeps` file from the
   # influxdb repo root.
-  goDeps = ./deps.json;
+  goDeps = ./. + builtins.toPath "/deps-${version}.json";
 
   meta = with lib; {
     description = "An open-source distributed time series database";
diff --git a/pkgs/servers/nosql/influxdb/deps.json b/pkgs/servers/nosql/influxdb/deps-0.13.0.json
similarity index 100%
rename from pkgs/servers/nosql/influxdb/deps.json
rename to pkgs/servers/nosql/influxdb/deps-0.13.0.json
diff --git a/pkgs/servers/nosql/influxdb/deps-1.0.0-beta3.json b/pkgs/servers/nosql/influxdb/deps-1.0.0-beta3.json
new file mode 100644
index 000000000000..fe72249ea267
--- /dev/null
+++ b/pkgs/servers/nosql/influxdb/deps-1.0.0-beta3.json
@@ -0,0 +1,155 @@
+[
+  {
+    "goPackagePath": "collectd.org",
+    "fetch": {
+      "type": "git",
+      "url": "https://github.com/collectd/go-collectd.git",
+      "rev": "9fc824c70f713ea0f058a07b49a4c563ef2a3b98",
+      "sha256": "0kjal6bsjpnppfnlqbg7g56xwssaj2ani499yykyj817zq56hi0w"
+    }
+  },
+  {
+    "goPackagePath": "github.com/BurntSushi/toml",
+    "fetch": {
+      "type": "git",
+      "url": "https://github.com/BurntSushi/toml.git",
+      "rev": "a4eecd407cf4129fc902ece859a0114e4cf1a7f4",
+      "sha256": "1l74zvd534k2fs73gmaq4mgl48p1i9559k1gwq4vakca727z5sgf"
+    }
+  },
+  {
+    "goPackagePath": "github.com/bmizerany/pat",
+    "fetch": {
+      "type": "git",
+      "url": "https://github.com/bmizerany/pat.git",
+      "rev": "b8a35001b773c267eb260a691f4e5499a3531600",
+      "sha256": "11zxd45rvjm6cn3wzbi18wy9j4vr1r1hgg6gzlqnxffiizkycxmz"
+    }
+  },
+  {
+    "goPackagePath": "github.com/boltdb/bolt",
+    "fetch": {
+      "type": "git",
+      "url": "https://github.com/boltdb/bolt.git",
+      "rev": "2f846c3551b76d7710f159be840d66c3d064abbe",
+      "sha256": "0cvpcgmzlrn87jqrflwf4pciz6i25ri1r83sq7v1z9zry1ah16r5"
+    }
+  },
+  {
+    "goPackagePath": "github.com/davecgh/go-spew",
+    "fetch": {
+      "type": "git",
+      "url": "https://github.com/davecgh/go-spew.git",
+      "rev": "fc32781af5e85e548d3f1abaf0fa3dbe8a72495c",
+      "sha256": "1dwwd4va0qnyr256i7n8d4g24d7yyvwd0975y6v4dy06qpwir232"
+    }
+  },
+  {
+    "goPackagePath": "github.com/dgrijalva/jwt-go",
+    "fetch": {
+      "type": "git",
+      "url": "https://github.com/dgrijalva/jwt-go.git",
+      "rev": "a2c85815a77d0f951e33ba4db5ae93629a1530af",
+      "sha256": "1m7011hdr4qa400awbdagj2m5zwfbvhinq8p5hq7ysn14xpaq5vw"
+    }
+  },
+  {
+    "goPackagePath": "github.com/dgryski/go-bits",
+    "fetch": {
+      "type": "git",
+      "url": "https://github.com/dgryski/go-bits.git",
+      "rev": "86c69b3c986f9d40065df5bd8f765796549eef2e",
+      "sha256": "08i3p8lcisr88gmwvi8qdc8bgksxh5ydjspgfbi4aba9msybp78b"
+    }
+  },
+  {
+    "goPackagePath": "github.com/dgryski/go-bitstream",
+    "fetch": {
+      "type": "git",
+      "url": "https://github.com/dgryski/go-bitstream.git",
+      "rev": "27cd5973303fde7d914860be1ea4b927a6be0c92",
+      "sha256": "12ji4vcfy0cz12yq43cz0w1f1k4c1kg0vwpsk1iy47kc38kzdkc6"
+    }
+  },
+  {
+    "goPackagePath": "github.com/gogo/protobuf",
+    "fetch": {
+      "type": "git",
+      "url": "https://github.com/gogo/protobuf.git",
+      "rev": "74b6e9deaff6ba6da1389ec97351d337f0d08b06",
+      "sha256": "0045fz4bx72rikm2ggx9j1h3yrq518299qwaizrgy5jvxzj1707b"
+    }
+  },
+  {
+    "goPackagePath": "github.com/golang/snappy",
+    "fetch": {
+      "type": "git",
+      "url": "https://github.com/golang/snappy.git",
+      "rev": "5979233c5d6225d4a8e438cdd0b411888449ddab",
+      "sha256": "0i0pvwc2a4xgsns6mr3xbc6p0sra34qsaagd7yf7v1as0z7ydl3s"
+    }
+  },
+  {
+    "goPackagePath": "github.com/influxdata/usage-client",
+    "fetch": {
+      "type": "git",
+      "url": "https://github.com/influxdata/usage-client.git",
+      "rev": "475977e68d79883d9c8d67131c84e4241523f452",
+      "sha256": "0yhywablqqpd2x70rax1kf7yaw1jpvrc2gks8360cwisda57d3qy"
+    }
+  },
+  {
+    "goPackagePath": "github.com/jwilder/encoding",
+    "fetch": {
+      "type": "git",
+      "url": "https://github.com/jwilder/encoding.git",
+      "rev": "b421ab402545ef5a119f4f827784c6551d9bfc37",
+      "sha256": "0sjz2cl8kpni0mh0y4269k417dj06gn2y0ppi25i3wh9p4j4i4fq"
+    }
+  },
+  {
+    "goPackagePath": "github.com/kimor79/gollectd",
+    "fetch": {
+      "type": "git",
+      "url": "https://github.com/kimor79/gollectd.git",
+      "rev": "61d0deeb4ffcc167b2a1baa8efd72365692811bc",
+      "sha256": "0als2v4d5hlw0sqam670p3fi471ikgl3l81bp31mf3s3jssdxwfs"
+    }
+  },
+  {
+    "goPackagePath": "github.com/paulbellamy/ratecounter",
+    "fetch": {
+      "type": "git",
+      "url": "https://github.com/paulbellamy/ratecounter.git",
+      "rev": "5a11f585a31379765c190c033b6ad39956584447",
+      "sha256": "137p62imi91zhkjcjigdd64n7f9z6djjpsxcyifgrcxs41jj9ra0"
+    }
+  },
+  {
+    "goPackagePath": "github.com/peterh/liner",
+    "fetch": {
+      "type": "git",
+      "url": "https://github.com/peterh/liner.git",
+      "rev": "82a939e738b0ee23e84ec7a12d8e216f4d95c53f",
+      "sha256": "1187c1rqmh9k9ap5bz3p9hbjp3ad5hysykh58kgv5clah1jbkg04"
+    }
+  },
+  {
+    "goPackagePath": "github.com/rakyll/statik",
+    "fetch": {
+      "type": "git",
+      "url": "https://github.com/rakyll/statik.git",
+      "rev": "274df120e9065bdd08eb1120e0375e3dc1ae8465",
+      "sha256": "0llk7bxmk66wdiy42h32vj1jfk8zg351xq21hwhrq7gkfljghffp"
+    }
+  },
+  {
+    "goPackagePath": "golang.org/x/crypto",
+    "fetch": {
+      "type": "git",
+      "url": "https://github.com/golang/crypto.git",
+      "rev": "1f22c0103821b9390939b6776727195525381532",
+      "sha256": "1acy12f396sr3lrnbcnym5q72qnlign5bagving41qijzjnc219m"
+    }
+  }
+]
\ No newline at end of file
diff --git a/pkgs/servers/nosql/influxdb/v1.nix b/pkgs/servers/nosql/influxdb/v1.nix
new file mode 100644
index 000000000000..f50d38180e94
--- /dev/null
+++ b/pkgs/servers/nosql/influxdb/v1.nix
@@ -0,0 +1,13 @@
+{ lib, buildGoPackage, fetchFromGitHub }@args:
+
+import ./default.nix (args // rec {
+  
+  version = "1.0.0-beta3";
+
+  src = fetchFromGitHub {
+    owner = "influxdata";
+    repo = "influxdb";
+    rev = "v${version}";
+    sha256 = "1hj9wl2bfd1llc11jrv8bq18wl2y9n6fl3w6052wb530j7gsivsq";
+  };
+}) 
diff --git a/pkgs/servers/sql/postgresql/default.nix b/pkgs/servers/sql/postgresql/default.nix
index baeb30427350..b58ca5f44b9c 100644
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@@ -74,33 +74,33 @@ let
 in {
 
   postgresql91 = common {
-    version = "9.1.21";
+    version = "9.1.23";
     psqlSchema = "9.1";
-    sha256 = "14xkvv7ph7yh399wppqpil9lgh1vw53nyg5ynk5a8j9idw3yjvnn";
+    sha256 = "1mgnfm65fspkq62skfy48rjkprnxcfhydw0x3ipp4sdkngl72x3z";
   };
 
   postgresql92 = common {
-    version = "9.2.16";
+    version = "9.2.18";
     psqlSchema = "9.2";
-    sha256 = "048vfkq58kkhcrw5vj4vplgvxia1k0lrbhbi30b2iy3bf2w4q5nj";
+    sha256 = "1x1mxbwqvgj9s4y8pb4vv6fmmr36z5zl3b2ggb84ckdfhvakganp";
   };
 
   postgresql93 = common {
-    version = "9.3.12";
+    version = "9.3.14";
     psqlSchema = "9.3";
-    sha256 = "0rrf24mw68lwxjjnbbaayizhhcylwnr7ij5d60vpzl467yi9wczk";
+    sha256 = "1783kl0abf9az90mvs08pdh63d33cv2njc1q515zz89bqkqj4hsw";
   };
 
   postgresql94 = common {
-    version = "9.4.7";
+    version = "9.4.9";
     psqlSchema = "9.4";
-    sha256 = "1q41bwwa4x1ff2qzlrsfia25ys5gfrihbqwib1z6j3mk6mn5wyfc";
+    sha256 = "1jg1l6vrfwhfyqrx07bgcpqxb5zcp8zwm8qd2vcj0k11j0pac861";
   };
 
   postgresql95 = common {
-    version = "9.5.3";
+    version = "9.5.4";
     psqlSchema = "9.5";
-    sha256 = "1d500d2qsdzysnis6qi84xchnz5xh8kx8sjfmkbsijwaqlfw11bk";
+    sha256 = "1l3fqxlpxgl6nrcd4h6lpi2hsiv56yg83n3xrn704rmdch8mfpng";
   };
 
 
diff --git a/pkgs/tools/X11/xpra/default.nix b/pkgs/tools/X11/xpra/default.nix
index 27a3deca7368..3a2c460160a7 100644
--- a/pkgs/tools/X11/xpra/default.nix
+++ b/pkgs/tools/X11/xpra/default.nix
@@ -30,7 +30,7 @@ in buildPythonApplication rec {
   ];
 
   propagatedBuildInputs = with pythonPackages; [
-    pillow pygtk pygobject rencode pycrypto cryptography pycups lz4 dbus
+    pillow pygtk pygobject rencode pycrypto cryptography pycups lz4 dbus-python
   ];
 
   preBuild = ''
diff --git a/pkgs/tools/audio/mpdris2/default.nix b/pkgs/tools/audio/mpdris2/default.nix
index 82ddc85fd880..beb69db85815 100644
--- a/pkgs/tools/audio/mpdris2/default.nix
+++ b/pkgs/tools/audio/mpdris2/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, autoreconfHook, intltool
-, python, wrapPython, mpd, pygtk, dbus, pynotify
+, pythonPackages, pythonFull
 }:
 
 stdenv.mkDerivation rec {
@@ -11,9 +11,9 @@ stdenv.mkDerivation rec {
     sha256 = "0zdmamj2ldhr6y3s464w8y2x3yizda784jnlrg3j3myfabssisvz";
   };
 
-  buildInputs = [ intltool autoreconfHook ];
-  propagatedBuildInputs = [ python wrapPython ];
-  pythonPath = [ mpd pygtk dbus pynotify ];
+  buildInputs = [ intltool autoreconfHook pythonPackages.wrapPython ];
+  propagatedBuildInputs = with pythonPackages; [ pythonFull  pygtk dbus-python ];
+  pythonPath = with pythonPackages; [ mpd pygtk dbus-python notify ];
   postInstall = "wrapPythonPrograms";
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/backup/znapzend/default.nix b/pkgs/tools/backup/znapzend/default.nix
index d46581329303..311df9086890 100644
--- a/pkgs/tools/backup/znapzend/default.nix
+++ b/pkgs/tools/backup/znapzend/default.nix
@@ -1,8 +1,8 @@
 { stdenv, fetchFromGitHub, zfs, mbuffer, perl, perlPackages, wget, autoconf, automake }:
 
 let
-  version = "0.15.5";
-  checksum = "09cf9n5i1wxlkhq8ky9npg1a6qiz4blizhbb9390gy0m0wl9l7zw";
+  version = "0.15.7";
+  checksum = "1xb94kxfq9sm3g0s6wpyyz6h2aihgca5gyybg0a5r8sar7yz97j0";
 in
 stdenv.mkDerivation rec {
   name = "znapzend-${version}";
diff --git a/pkgs/tools/bluetooth/blueman/default.nix b/pkgs/tools/bluetooth/blueman/default.nix
index 31020656867b..7edf2ac3e890 100644
--- a/pkgs/tools/bluetooth/blueman/default.nix
+++ b/pkgs/tools/bluetooth/blueman/default.nix
@@ -24,7 +24,7 @@ in stdenv.mkDerivation rec {
     sed -i 's,CDLL(",CDLL("${libpulseaudio}/lib/,g' blueman/main/PulseAudioUtils.py
   '';
 
-  pythonPath = with pythonPackages; [ dbus pygobject3 ];
+  pythonPath = with pythonPackages; [ dbus-python pygobject3 ];
 
   propagatedUserEnvPkgs = [ obex_data_server dconf ];
 
diff --git a/pkgs/tools/misc/system-config-printer/default.nix b/pkgs/tools/misc/system-config-printer/default.nix
index d16fdd4e605c..67ec9585c7ab 100644
--- a/pkgs/tools/misc/system-config-printer/default.nix
+++ b/pkgs/tools/misc/system-config-printer/default.nix
@@ -26,7 +26,7 @@ in stdenv.mkDerivation rec {
     ];
 
   pythonPath = with pythonPackages;
-    [ pycups pycurl dbus pygobject3 requests2 ];
+    [ pycups pycurl dbus-python pygobject3 requests2 ];
 
   configureFlags =
     [ "--with-udev-rules"
diff --git a/pkgs/tools/networking/connman-notify/default.nix b/pkgs/tools/networking/connman-notify/default.nix
index 070666901724..4f70888fca63 100644
--- a/pkgs/tools/networking/connman-notify/default.nix
+++ b/pkgs/tools/networking/connman-notify/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     pythonPackages.python
-    pythonPackages.dbus
+    pythonPackages.dbus-python
     pythonPackages.pygobject
     pythonPackages.pygtk
     pythonPackages.notify
diff --git a/pkgs/tools/networking/wicd/default.nix b/pkgs/tools/networking/wicd/default.nix
index fe6ad74c2362..40acfaf323a2 100644
--- a/pkgs/tools/networking/wicd/default.nix
+++ b/pkgs/tools/networking/wicd/default.nix
@@ -4,7 +4,7 @@
 , locale ? "C" }:
 
 let
-  inherit (pythonPackages) python pygobject dbus pyGtkGlade pycairo;
+  inherit (pythonPackages) python pygobject dbus-python pyGtkGlade pycairo;
 in stdenv.mkDerivation rec {
   name = "wicd-${version}";
   version = "1.7.2.4";
@@ -38,15 +38,15 @@ in stdenv.mkDerivation rec {
     substituteInPlace in/scripts=wicd.in --subst-var-by TEMPLATE-DEFAULT $out/share/other/dhclient.conf.template.default
 
     sed -i "2iexport PATH=${python}/bin:${wpa_supplicant}/sbin:${dhcpcd}/sbin:${dhcp}/sbin:${wirelesstools}/sbin:${nettools}/sbin:${nettools}/bin:${iputils}/bin:${openresolv}/sbin:${iproute}/sbin\$\{PATH:+:\}\$PATH" in/scripts=wicd.in
-    sed -i "3iexport PYTHONPATH=$(toPythonPath $out):$(toPythonPath ${pygobject}):$(toPythonPath ${dbus})\$\{PYTHONPATH:+:\}\$PYTHONPATH" in/scripts=wicd.in
+    sed -i "3iexport PYTHONPATH=$(toPythonPath $out):$(toPythonPath ${pygobject}):$(toPythonPath ${dbus-python})\$\{PYTHONPATH:+:\}\$PYTHONPATH" in/scripts=wicd.in
     sed -i "2iexport PATH=${python}/bin\$\{PATH:+:\}\$PATH" in/scripts=wicd-client.in
-    sed -i "3iexport PYTHONPATH=$(toPythonPath $out):$(toPythonPath ${pyGtkGlade})/gtk-2.0:$(toPythonPath ${pygobject}):$(toPythonPath ${pygobject})/gtk-2.0:$(toPythonPath ${pycairo}):$(toPythonPath ${dbus})\$\{PYTHONPATH:+:\}\$PYTHONPATH" in/scripts=wicd-client.in
+    sed -i "3iexport PYTHONPATH=$(toPythonPath $out):$(toPythonPath ${pyGtkGlade})/gtk-2.0:$(toPythonPath ${pygobject}):$(toPythonPath ${pygobject})/gtk-2.0:$(toPythonPath ${pycairo}):$(toPythonPath ${dbus-python})\$\{PYTHONPATH:+:\}\$PYTHONPATH" in/scripts=wicd-client.in
     sed -i "2iexport PATH=${python}/bin\$\{PATH:+:\}\$PATH" in/scripts=wicd-gtk.in
-    sed -i "3iexport PYTHONPATH=$(toPythonPath $out):$(toPythonPath ${pyGtkGlade})/gtk-2.0:$(toPythonPath ${pygobject}):$(toPythonPath ${pygobject})/gtk-2.0:$(toPythonPath ${pycairo}):$(toPythonPath ${dbus}):$(toPythonPath ${pythonPackages.notify})\$\{PYTHONPATH:+:\}\$PYTHONPATH" in/scripts=wicd-gtk.in
+    sed -i "3iexport PYTHONPATH=$(toPythonPath $out):$(toPythonPath ${pyGtkGlade})/gtk-2.0:$(toPythonPath ${pygobject}):$(toPythonPath ${pygobject})/gtk-2.0:$(toPythonPath ${pycairo}):$(toPythonPath ${dbus-python}):$(toPythonPath ${pythonPackages.notify})\$\{PYTHONPATH:+:\}\$PYTHONPATH" in/scripts=wicd-gtk.in
     sed -i "2iexport PATH=${python}/bin\$\{PATH:+:\}\$PATH" in/scripts=wicd-cli.in
-    sed -i "3iexport PYTHONPATH=$(toPythonPath $out):$(toPythonPath ${pyGtkGlade})/gtk-2.0:$(toPythonPath ${pygobject}):$(toPythonPath ${pycairo}):$(toPythonPath ${dbus})\$\{PYTHONPATH:+:\}\$PYTHONPATH" in/scripts=wicd-cli.in
+    sed -i "3iexport PYTHONPATH=$(toPythonPath $out):$(toPythonPath ${pyGtkGlade})/gtk-2.0:$(toPythonPath ${pygobject}):$(toPythonPath ${pycairo}):$(toPythonPath ${dbus-python})\$\{PYTHONPATH:+:\}\$PYTHONPATH" in/scripts=wicd-cli.in
     sed -i "2iexport PATH=${python}/bin\$\{PATH:+:\}\$PATH" in/scripts=wicd-curses.in
-    sed -i "3iexport PYTHONPATH=$(toPythonPath $out):$(toPythonPath ${pyGtkGlade})/gtk-2.0:$(toPythonPath ${pygobject}):$(toPythonPath ${pycairo}):$(toPythonPath ${dbus}):$(toPythonPath ${pythonPackages.urwid}):$(toPythonPath ${pythonPackages.curses})\$\{PYTHONPATH:+:\}\$PYTHONPATH" in/scripts=wicd-curses.in
+    sed -i "3iexport PYTHONPATH=$(toPythonPath $out):$(toPythonPath ${pyGtkGlade})/gtk-2.0:$(toPythonPath ${pygobject}):$(toPythonPath ${pycairo}):$(toPythonPath ${dbus-python}):$(toPythonPath ${pythonPackages.urwid}):$(toPythonPath ${pythonPackages.curses})\$\{PYTHONPATH:+:\}\$PYTHONPATH" in/scripts=wicd-curses.in
     rm po/ast.po
   '';
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 4117cfc59365..a4dbe1aca1b5 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -843,14 +843,7 @@ in
 
   mpdcron = callPackage ../tools/audio/mpdcron { };
 
-  mpdris2 = callPackage ../tools/audio/mpdris2 {
-    python = pythonFull;
-    wrapPython = pythonPackages.wrapPython;
-    mpd = pythonPackages.mpd;
-    pygtk = pythonPackages.pygtk;
-    dbus = pythonPackages.dbus;
-    pynotify = pythonPackages.notify;
-  };
+  mpdris2 = callPackage ../tools/audio/mpdris2 { };
 
   playerctl = callPackage ../tools/audio/playerctl { };
 
@@ -3188,8 +3181,6 @@ in
 
   pwnat = callPackage ../tools/networking/pwnat { };
 
-  pyatspi = python3Packages.pyatspi;
-
   pycangjie = pythonPackages.pycangjie;
 
   pydb = callPackage ../development/tools/pydb { };
@@ -3198,8 +3189,6 @@ in
 
   pystringtemplate = callPackage ../development/python-modules/stringtemplate { };
 
-  pythonDBus = self.dbus_python;
-
   pythonIRClib = pythonPackages.pythonIRClib;
 
   pythonSexy = callPackage ../development/python-modules/libsexy { };
@@ -3524,9 +3513,7 @@ in
 
   sonarr = callPackage ../servers/sonarr { };
 
-  sonata = callPackage ../applications/audio/sonata {
-    inherit (python3Packages) buildPythonApplication python isPy3k dbus pygobject3 mpd2;
-  };
+  sonata = callPackage ../applications/audio/sonata { };
 
   sparsehash = callPackage ../development/libraries/sparsehash { };
 
@@ -3756,6 +3743,8 @@ in
 
   tracefilesim = callPackage ../development/tools/analysis/garcosim/tracefilesim { };
 
+  translate-shell = callPackage ../applications/misc/translate-shell { };
+
   trash-cli = callPackage ../tools/misc/trash-cli { };
 
   trickle = callPackage ../tools/networking/trickle {};
@@ -7070,7 +7059,6 @@ in
   dbus_cplusplus  = callPackage ../development/libraries/dbus-cplusplus { };
   dbus_glib       = callPackage ../development/libraries/dbus-glib { };
   dbus_java       = callPackage ../development/libraries/java/dbus-java { };
-  dbus_python     = self.pythonPackages.dbus;
 
   dbus-sharp-1_0 = callPackage ../development/libraries/dbus-sharp/dbus-sharp-1.0.nix { };
   dbus-sharp-2_0 = callPackage ../development/libraries/dbus-sharp { };
@@ -8743,7 +8731,9 @@ in
     withGUI = false;
   };
 
-  mlt-qt4 = callPackage ../development/libraries/mlt {
+  mlt = callPackage ../development/libraries/mlt {};
+
+  mlt-qt4 = callPackage ../development/libraries/mlt/qt-4.nix {
     ffmpeg = ffmpeg_2;
     qt = qt4;
   };
@@ -10273,6 +10263,9 @@ in
 
   mailman = callPackage ../servers/mail/mailman { };
 
+  mattermost = callPackage ../servers/mattermost { };
+  matterircd = callPackage ../servers/mattermost/matterircd.nix { };
+
   mediatomb = callPackage ../servers/mediatomb {
     spidermonkey = spidermonkey_185;
   };
@@ -10411,6 +10404,8 @@ in
 
   influxdb = (callPackage ../servers/nosql/influxdb/v0.nix { }).bin // { outputs = [ "bin" ]; };
 
+  influxdb10 = (callPackage ../servers/nosql/influxdb/v1.nix { }).bin // { outputs = [ "bin" ]; }; 
+
   hyperdex = callPackage ../servers/nosql/hyperdex { };
 
   mysql55 = callPackage ../servers/sql/mysql/5.5.x.nix {
@@ -10728,10 +10723,6 @@ in
 
   blktrace = callPackage ../os-specific/linux/blktrace { };
 
-  bluez4 = lowPrio (callPackage ../os-specific/linux/bluez {
-    pygobject = pygobject3;
-  });
-
   bluez5 = callPackage ../os-specific/linux/bluez/bluez5.nix { };
 
   # Needed for LibreOffice
@@ -10881,7 +10872,7 @@ in
   fatrace = callPackage ../os-specific/linux/fatrace { };
 
   ffadoFull = callPackage ../os-specific/linux/ffado {
-    inherit (pythonPackages) python pyqt4;
+    inherit (pythonPackages) python pyqt4 dbus-python;
   };
   libffado = self.ffadoFull.override { prefix = "lib"; };
 
@@ -10917,6 +10908,8 @@ in
     flex = flex_2_5_35;
   };
 
+  hd-idle = callPackage ../os-specific/linux/hd-idle { };
+
   hdparm = callPackage ../os-specific/linux/hdparm { };
 
   hibernate = callPackage ../os-specific/linux/hibernate { };
@@ -11085,7 +11078,6 @@ in
   linux_4_1 = callPackage ../os-specific/linux/kernel/linux-4.1.nix {
     kernelPatches =
       [ kernelPatches.bridge_stp_helper
-        kernelPatches.hiddev_CVE_2016_5829
       ]
       ++ lib.optionals ((platform.kernelArch or null) == "mips")
       [ kernelPatches.mips_fpureg_emu
@@ -12369,6 +12361,10 @@ in
 
   bitmeter = callPackage ../applications/audio/bitmeter { };
 
+  bitwig-studio =  callPackage ../applications/audio/bitwig-studio {
+    inherit (gnome2) zenity;
+  };
+
   bleachbit = callPackage ../applications/misc/bleachbit { };
 
   blender = callPackage  ../applications/misc/blender {
@@ -13383,7 +13379,6 @@ in
   hakuneko = callPackage ../tools/misc/hakuneko { };
 
   hamster-time-tracker = callPackage ../applications/misc/hamster-time-tracker {
-    inherit (pythonPackages) pyxdg pygtk dbus sqlite3;
     inherit (gnome) gnome_python;
   };
 
@@ -13816,7 +13811,6 @@ in
   mendeley = callPackage ../applications/office/mendeley { };
 
   mercurial = callPackage ../applications/version-management/mercurial {
-    inherit (pythonPackages) curses docutils hg-git dulwich;
     inherit (darwin.apple_sdk.frameworks) ApplicationServices;
     inherit (darwin) cf-private;
     guiSupport = false; # use mercurialFull to get hgk GUI
@@ -13939,6 +13933,8 @@ in
 
   ncmpcpp = callPackage ../applications/audio/ncmpcpp { };
 
+  ympd = callPackage ../applications/audio/ympd { };
+
   nload = callPackage ../applications/networking/nload { };
 
   normalize = callPackage ../applications/audio/normalize { };
@@ -14420,12 +14416,9 @@ in
 
   quirc = callPackage ../tools/graphics/quirc {};
 
-  quodlibet = callPackage ../applications/audio/quodlibet {
-    inherit (pythonPackages) mutagen;
-  };
+  quodlibet = callPackage ../applications/audio/quodlibet { };
 
   quodlibet-with-gst-plugins = callPackage ../applications/audio/quodlibet {
-    inherit (pythonPackages) mutagen;
     withGstPlugins = true;
     gst_plugins_bad = null;
   };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index b064618520ab..269db2d555d7 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -191,7 +191,7 @@ in modules // {
     };
   };
 
-  dbus = callPackage ../development/python-modules/dbus {
+  dbus-python = callPackage ../development/python-modules/dbus {
     dbus = pkgs.dbus;
   };
 
@@ -265,14 +265,11 @@ in modules // {
   };
 
   pyqt4 = callPackage ../development/python-modules/pyqt/4.x.nix {
-    pythonDBus = self.dbus;
     pythonPackages = self;
   };
 
   pyqt5 = pkgs.qt55.callPackage ../development/python-modules/pyqt/5.x.nix {
-    sip = self.sip_4_16;
-    pythonDBus = self.dbus;
-    python = self.python;
+    pythonPackages = self;
   };
 
   pyside = callPackage ../development/python-modules/pyside { };
@@ -14612,7 +14609,7 @@ in modules // {
       sha256 = "0yjxwisxpxy3vpnqk9nw5k3db3xx6wyf6sk1px9m94s30glcq2cc";
     };
 
-    propagatedBuildInputs = with self; [ appdirs pyyaml requests2 dbus emoji sleekxmpp mock ];
+    propagatedBuildInputs = with self; [ appdirs pyyaml requests2 dbus-python emoji sleekxmpp mock ];
 
     meta = {
       description = "A utility for sending notifications, on demand and when commands finish";
@@ -17822,13 +17819,17 @@ in modules // {
 
   psutil = buildPythonPackage rec {
     name = "psutil-${version}";
-    version = "4.3.0";
+    version = "3.4.2";
 
     src = pkgs.fetchurl {
       url = "mirror://pypi/p/psutil/${name}.tar.gz";
-      sha256 = "1w4r09fvn6kd80m5mx4ws1wz100brkaq6hzzpwrns8cgjzjpl6c6";
+      sha256 = "b17fa01aa766daa388362d0eda5c215d77e03a8d37676b68971f37bf3913b725";
     };
 
+    # Certain tests fail due to being in a chroot.
+    # See also the older issue: https://code.google.com/p/psutil/issues/detail?id=434
+    doCheck = false;
+
     buildInputs = with self; [ mock ] ++ optionals stdenv.isDarwin [ pkgs.darwin.IOKit ];
 
     meta = {
@@ -22457,7 +22458,7 @@ in modules // {
     # error: invalid command 'test'
     doCheck = false;
 
-    propagatedBuildInputs = with self; [ pkgs.xorg.libX11 pkgs.pythonDBus pygobject ];
+    propagatedBuildInputs = with self; [ pkgs.xorg.libX11 dbus-python pygobject ];
 
     meta = {
       description = "High-level, platform independent Skype API wrapper for Python";
@@ -26724,7 +26725,7 @@ in modules // {
     };
 
     preConfigure = ''
-      export NIX_CFLAGS_COMPILE="$(pkg-config --cflags efl) -I${self.dbus}/include/dbus-1.0 $NIX_CFLAGS_COMPILE"
+      export NIX_CFLAGS_COMPILE="$(pkg-config --cflags efl) -I${self.dbus-python}/include/dbus-1.0 $NIX_CFLAGS_COMPILE"
     '';
     preBuild = "${python}/bin/${python.executable} setup.py build_ext";
     installPhase= "${python}/bin/${python.executable} setup.py install --prefix=$out";
@@ -26794,7 +26795,7 @@ in modules // {
     # no tests available
     doCheck = false;
 
-    propagatedBuildInputs = with self; [ pygobject3 dbus ];
+    propagatedBuildInputs = with self; [ pygobject3 dbus-python ];
 
     meta = {
       homepage = https://github.com/ricardomv/snapper-gui;