diff --git a/nixos/modules/config/users-groups.nix b/nixos/modules/config/users-groups.nix
index 0d3273fe0539..773f9b412afe 100644
--- a/nixos/modules/config/users-groups.nix
+++ b/nixos/modules/config/users-groups.nix
@@ -184,7 +184,7 @@ let
         type = with types; uniq (nullOr string);
         default = null;
         description = ''
-          The path to a file that contains the user's password. The password
+          The full path to a file that contains the user's password. The password
           file is read on each system activation. The file should contain
           exactly one line, which should be the password in an encrypted form
           that is suitable for the <literal>chpasswd -e</literal> command.
diff --git a/nixos/modules/services/networking/polipo.nix b/nixos/modules/services/networking/polipo.nix
index 05ded84625d0..51179d9120fe 100644
--- a/nixos/modules/services/networking/polipo.nix
+++ b/nixos/modules/services/networking/polipo.nix
@@ -103,12 +103,8 @@ in
       description = "caching web proxy";
       after = [ "network.target" "nss-lookup.target" ];
       wantedBy = [ "multi-user.target"];
-      preStart = ''
-         ${pkgs.coreutils}/bin/chown polipo:polipo /var/cache/polipo -R
-      '';
       serviceConfig = {
         ExecStart  = "${pkgs.polipo}/bin/polipo -c ${polipoConfig}";
-        ExecReload = "${pkgs.coreutils}/bin/kill -USR1 $MAINPID";
         User = "polipo";
       };
     };
diff --git a/nixos/modules/services/x11/desktop-managers/gnome3.nix b/nixos/modules/services/x11/desktop-managers/gnome3.nix
index b045edcc7842..ccf100686835 100644
--- a/nixos/modules/services/x11/desktop-managers/gnome3.nix
+++ b/nixos/modules/services/x11/desktop-managers/gnome3.nix
@@ -82,7 +82,7 @@ in {
     services.upower.enable = config.powerManagement.enable;
     services.upower.package = gnome3.upower;
 
-    fonts.fonts = [ pkgs.dejavu_fonts ];
+    fonts.fonts = [ pkgs.dejavu_fonts pkgs.cantarell_fonts ];
 
     services.xserver.desktopManager.session = singleton
       { name = "gnome3";
diff --git a/nixos/modules/services/x11/desktop-managers/kde4.nix b/nixos/modules/services/x11/desktop-managers/kde4.nix
index 0af849557804..2061170a21b5 100644
--- a/nixos/modules/services/x11/desktop-managers/kde4.nix
+++ b/nixos/modules/services/x11/desktop-managers/kde4.nix
@@ -148,7 +148,7 @@ in
         ]
       ++ lib.optional config.hardware.pulseaudio.enable pkgs.kde4.kmix  # Perhaps this should always be enabled
       ++ lib.optional config.hardware.bluetooth.enable pkgs.kde4.bluedevil
-      ++ lib.optional config.networking.networkmanager.enable pkgs.kde4.networkmanagement
+      ++ lib.optional config.networking.networkmanager.enable pkgs.kde4.plasma-nm
       ++ [ nepomukConfig ] ++ phononBackendPackages;
 
     environment.pathsToLink = [ "/share" ];
diff --git a/pkgs/applications/editors/leafpad/default.nix b/pkgs/applications/editors/leafpad/default.nix
new file mode 100644
index 000000000000..fc35a993badf
--- /dev/null
+++ b/pkgs/applications/editors/leafpad/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, fetchurl, intltool, pkgconfig, gtk }:
+
+stdenv.mkDerivation rec {
+  version = "0.8.18.1";
+  name = "leafpad-${version}";
+  src = fetchurl {
+    url = "http://download.savannah.gnu.org/releases/leafpad/${name}.tar.gz";
+    sha256 = "0b0az2wvqgvam7w0ns1j8xp2llslm1rx6h7zcsy06a7j0yp257cm";
+  };
+
+  buildInputs = [ intltool pkgconfig gtk ];
+
+  configureFlags = [
+    "--enable-chooser"
+  ];
+
+  meta = with stdenv.lib; {
+    description = "A notepad clone for GTK+ 2.0";
+    homepage = http://tarot.freeshell.org/leafpad;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.flosse ];
+    license = licenses.gpl3;
+  };
+}
diff --git a/pkgs/applications/editors/yi/yi-custom.nix b/pkgs/applications/editors/yi/yi-custom.nix
index 9d63b3808032..894080eb9013 100644
--- a/pkgs/applications/editors/yi/yi-custom.nix
+++ b/pkgs/applications/editors/yi/yi-custom.nix
@@ -24,10 +24,10 @@ cabal.mkDerivation (self: rec {
   noHaddock = true;
   doCheck = false;
 
-  # put custom GHC env in front which stops crap from being picked up
-  # from user database
   postInstall = ''
-    makeWrapper ${yi}/bin/yi $out/bin/yi --prefix PATH : ${wrappedGhc}/bin
+    makeWrapper ${yi}/bin/yi $out/bin/yi \
+      --prefix PATH : ${wrappedGhc}/bin \
+      --suffix GHC_PACKAGE_PATH : $(find ${wrappedGhc} -name '*installedconf' | tr \\n :)
   '';
   meta = {
     homepage = "http://haskell.org/haskellwiki/Yi";
diff --git a/pkgs/applications/misc/dmenu2/default.nix b/pkgs/applications/misc/dmenu2/default.nix
new file mode 100644
index 000000000000..1637586eb477
--- /dev/null
+++ b/pkgs/applications/misc/dmenu2/default.nix
@@ -0,0 +1,29 @@
+{stdenv, fetchhg, libX11, libXinerama, libXft, zlib}:
+
+with stdenv.lib;
+
+stdenv.mkDerivation rec {
+  name = "dmenu2";
+
+  src = fetchhg {
+    url = "https://bitbucket.org/melek/dmenu2";
+    rev = "36cb94a16edf928bdaaa636123392517ed469be0";
+    sha256 = "1b17z5ypg6ij7zz3ncp3irc87raccna10y4w490c872a99lp23lv";
+  };
+
+  buildInputs = [ libX11 libXinerama zlib libXft ];
+
+  postPatch = ''
+    sed -ri -e 's!\<(dmenu|stest)\>!'"$out/bin"'/&!g' dmenu_run
+  '';
+
+  preConfigure = [ ''sed -i "s@PREFIX = /usr/local@PREFIX = $out@g" config.mk'' ];
+
+  meta = {
+      description = "A patched fork of the original dmenu - an efficient dynamic menu for X";
+      homepage = https://bitbucket.org/melek/dmenu2;
+      license = stdenv.lib.licenses.mit;
+      maintainers = with maintainers; [ cstrahan ];
+      platforms = with platforms; all;
+  };
+}
diff --git a/pkgs/applications/misc/girara/default.nix b/pkgs/applications/misc/girara/default.nix
index b25d347ec873..3a7e5da1e737 100644
--- a/pkgs/applications/misc/girara/default.nix
+++ b/pkgs/applications/misc/girara/default.nix
@@ -1,16 +1,19 @@
-{ stdenv, fetchurl, pkgconfig, gtk, gettext }:
+{ stdenv, fetchurl, pkgconfig, gtk, gettext, ncurses }:
 
 stdenv.mkDerivation rec {
-  name = "girara-0.2.2";
+  name = "girara-0.2.3";
 
   src = fetchurl {
     url = "http://pwmt.org/projects/girara/download/${name}.tar.gz";
-    sha256 = "0lv6wqhx2avdxj6yx111jfs4j32r0xzmmkhy7pgzxpf73kgxz0k3";
+    sha256 = "1phfmqp8y17zcy9yi6pm2f80x8ldbk60iswpm4bmjz5217jwqzxh";
   };
 
   buildInputs = [ pkgconfig gtk gettext ];
 
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [
+    "PREFIX=$(out)"
+    "TPUT=${ncurses}/bin/tput"
+  ];
 
   meta = {
     homepage = http://pwmt.org/projects/girara/;
diff --git a/pkgs/applications/misc/rxvt_unicode-plugins/urxvt-perls/default.nix b/pkgs/applications/misc/rxvt_unicode-plugins/urxvt-perls/default.nix
new file mode 100644
index 000000000000..98f2e0d61083
--- /dev/null
+++ b/pkgs/applications/misc/rxvt_unicode-plugins/urxvt-perls/default.nix
@@ -0,0 +1,26 @@
+{ stdenv, fetchgit }:
+
+stdenv.mkDerivation {
+  name = "urxvt-perls";
+
+  src = fetchgit {
+    url = "https://github.com/muennich/urxvt-perls";
+    rev = "4dec629b3631297d17855c35be1b723e2d9e7591";
+    sha256 = "c61bc8819b4e6655ed4a3ce3b347cb6dbebcb484d5d3973cbe9aa7f2c98d372f";
+  };
+
+  installPhase = ''
+    mkdir -p $out/lib/urxvt/perl
+    cp clipboard \
+       keyboard-select \
+       url-select \
+    $out/lib/urxvt/perl
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Perl extensions for the rxvt-unicode terminal emulator";
+    homepage = "https://github.com/muennich/urxvt-perls";
+    license = licenses.gpl2;
+    maintainers = maintainers.abbradar;
+  };
+}
\ No newline at end of file
diff --git a/pkgs/applications/misc/rxvt_unicode-plugins/urxvt-tabbedex/default.nix b/pkgs/applications/misc/rxvt_unicode-plugins/urxvt-tabbedex/default.nix
new file mode 100644
index 000000000000..a636c3bcfe56
--- /dev/null
+++ b/pkgs/applications/misc/rxvt_unicode-plugins/urxvt-tabbedex/default.nix
@@ -0,0 +1,21 @@
+{ stdenv, fetchgit }:
+
+stdenv.mkDerivation {
+  name = "urxvt-tabbedex";
+
+  src = fetchgit {
+    url = "https://github.com/mina86/urxvt-tabbedex";
+    rev = "54c8d6beb4d65278ed6db24693ca56e1ee65bb42";
+    sha256 = "f8734ee289e1cfc517d0699627191c98d32ae3549e0f1935af2a5ccb86d4dc1e";
+  };
+
+  installPhase = ''
+    install -D tabbedex $out/lib/urxvt/perl/tabbedex
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Tabbed plugin for rxvt-unicode with many enhancements (mina86's fork)";
+    homepage = "https://github.com/mina86/urxvt-tabbedex";
+    maintainers = maintainers.abbradar;
+  };
+}
\ No newline at end of file
diff --git a/pkgs/applications/misc/rxvt_unicode/wrapper.nix b/pkgs/applications/misc/rxvt_unicode/wrapper.nix
new file mode 100644
index 000000000000..140113de64a3
--- /dev/null
+++ b/pkgs/applications/misc/rxvt_unicode/wrapper.nix
@@ -0,0 +1,26 @@
+{ stdenv, buildEnv, rxvt_unicode, makeWrapper, plugins }:
+
+let
+  rxvt = rxvt_unicode.override {
+    perlSupport = true;
+  };
+
+  drv = buildEnv {
+    name = "${rxvt.name}-with-plugins";
+
+    paths = [ rxvt ] ++ plugins;
+
+    postBuild = ''
+      # TODO: This could be avoided if buildEnv could be forced to create all directories
+      if [ -L $out/bin ]; then
+        rm $out/bin
+        mkdir $out/bin
+        for i in ${rxvt}/bin/*; do
+          ln -s $i $out/bin
+        done
+      fi
+      wrapProgram $out/bin/urxvt \
+        --suffix-each URXVT_PERL_LIB ':' "$out/lib/urxvt/perl"
+    '';
+  };
+in stdenv.lib.overrideDerivation drv (x : { buildInputs = x.buildInputs ++ [ makeWrapper ]; })
\ No newline at end of file
diff --git a/pkgs/applications/misc/zathura/core/default.nix b/pkgs/applications/misc/zathura/core/default.nix
index 5f44f79ebcdd..718670f569b7 100644
--- a/pkgs/applications/misc/zathura/core/default.nix
+++ b/pkgs/applications/misc/zathura/core/default.nix
@@ -1,17 +1,22 @@
-{ stdenv, fetchurl, pkgconfig, gtk, girara, gettext, docutils, file, makeWrapper, zathura_icon }:
+{ stdenv, fetchurl, pkgconfig, gtk, girara, ncurses, gettext, docutils, file, makeWrapper, zathura_icon }:
 
 stdenv.mkDerivation rec {
-  version = "0.2.9";
+  version = "0.3.1";
   name = "zathura-core-${version}";
 
   src = fetchurl {
     url = "http://pwmt.org/projects/zathura/download/zathura-${version}.tar.gz";
-    sha256 = "17z05skjk95115ajp6459k1djadza1w8kck7jn1qnd697r01s1rc";
+    sha256 = "1wwjj7vnzpkvn83674mapapvl2qsn7y44w17lq63283j1lic00mm";
   };
 
   buildInputs = [ pkgconfig file gtk girara gettext makeWrapper ];
 
-  makeFlags = [ "PREFIX=$(out)" "RSTTOMAN=${docutils}/bin/rst2man.py" "VERBOSE=1" ];
+  makeFlags = [
+    "PREFIX=$(out)"
+    "RSTTOMAN=${docutils}/bin/rst2man.py"
+    "VERBOSE=1"
+    "TPUT=${ncurses}/bin/tput"
+  ];
 
   postInstall = ''
     wrapProgram "$out/bin/zathura" \
diff --git a/pkgs/applications/misc/zathura/default.nix b/pkgs/applications/misc/zathura/default.nix
index 1a4ab3d772c5..6f1b5f400dd1 100644
--- a/pkgs/applications/misc/zathura/default.nix
+++ b/pkgs/applications/misc/zathura/default.nix
@@ -1,7 +1,7 @@
-{ callPackage, pkgs, fetchurl, useMupdf }:
+{ callPackage, pkgs, fetchurl, stdenv, useMupdf }:
 
 rec {
-  inherit (pkgs) stdenv;
+  inherit stdenv;
 
   icon = ./icon.xpm;
 
diff --git a/pkgs/applications/misc/zathura/djvu/default.nix b/pkgs/applications/misc/zathura/djvu/default.nix
index 1a2347f27277..00c5464b7d13 100644
--- a/pkgs/applications/misc/zathura/djvu/default.nix
+++ b/pkgs/applications/misc/zathura/djvu/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, pkgconfig, gtk, zathura_core, girara, djvulibre, gettext }:
 
 stdenv.mkDerivation rec {
-  name = "zathura-djvu-0.2.3";
+  name = "zathura-djvu-0.2.4";
 
   src = fetchurl {
     url = "http://pwmt.org/projects/zathura/plugins/download/${name}.tar.gz";
-    sha256 = "12gd8kb0al5mknh4rlvxzgzwz3vhjggqjh8ws27phaq14paq4vn1";
+    sha256 = "1g1lafmrjbx0xv7fljdmyqxx0k334sq4q6jy4a0q5xfrgz0bh45c";
   };
 
   buildInputs = [ pkgconfig djvulibre gettext zathura_core gtk girara ];
diff --git a/pkgs/applications/misc/zathura/pdf-mupdf/config.patch b/pkgs/applications/misc/zathura/pdf-mupdf/config.patch
index c7d172c92634..6445fab22989 100644
--- a/pkgs/applications/misc/zathura/pdf-mupdf/config.patch
+++ b/pkgs/applications/misc/zathura/pdf-mupdf/config.patch
@@ -1,10 +1,10 @@
---- zathura-pdf-mupdf-0.2.6/config.mk
-+++ zathura-pdf-mupdf-0.2.6/config.mk
+--- zathura-pdf-mupdf-0.2.7/config.mk
++++ zathura-pdf-mupdf-0.2.7/config.mk
 @@ -32,10 +32,11 @@
  OPENSSL_INC ?= $(shell pkg-config --cflags libcrypto)
  OPENSSL_LIB ?= $(shell pkg-config --libs libcrypto)
  
--MUPDF_LIB ?= -lmupdf -lmupdf-js-none
+-MUPDF_LIB ?= -lmupdf -lmujs
 +MUPDF_INC ?= $(shell pkg-config --cflags mupdf)
 +MUPDF_LIB ?= $(shell pkg-config --libs mupdf)
  
diff --git a/pkgs/applications/misc/zathura/pdf-mupdf/default.nix b/pkgs/applications/misc/zathura/pdf-mupdf/default.nix
index 4e585d852a2a..a6f12a64cf00 100644
--- a/pkgs/applications/misc/zathura/pdf-mupdf/default.nix
+++ b/pkgs/applications/misc/zathura/pdf-mupdf/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, pkgconfig, zathura_core, gtk, girara, mupdf, openssl, openjpeg, libjpeg, jbig2dec }:
 
 stdenv.mkDerivation rec {
-  version = "0.2.6";
+  version = "0.2.7";
   name = "zathura-pdf-mupdf-${version}";
 
   src = fetchurl {
     url = "http://pwmt.org/projects/zathura/plugins/download/${name}.tar.gz";
-    sha256 = "5df94b6f906008b5f3bca770a552da6d2917d6b8d3e4b3049cb7001302041b20";
+    sha256 = "0gr5kkk75hn7sz9kmzynhhcdd9xb9sz5gdb8p1iz9g0fjhskyd5i";
   };
 
   buildInputs = [ pkgconfig zathura_core gtk girara openssl mupdf openjpeg libjpeg jbig2dec ];
diff --git a/pkgs/applications/networking/instant-messengers/pidgin/add-search-path.patch b/pkgs/applications/networking/instant-messengers/pidgin/add-search-path.patch
new file mode 100644
index 000000000000..b0758777186a
--- /dev/null
+++ b/pkgs/applications/networking/instant-messengers/pidgin/add-search-path.patch
@@ -0,0 +1,20 @@
+diff --git a/libpurple/plugin.c b/libpurple/plugin.c
+index 4f2b402..fda9add 100644
+--- a/libpurple/plugin.c
++++ b/libpurple/plugin.c
+@@ -1181,8 +1181,15 @@ purple_plugins_get_handle(void) {
+ void
+ purple_plugins_init(void) {
+ 	void *handle = purple_plugins_get_handle();
++	gchar **paths, **p;
+ 
+ 	purple_plugins_add_search_path(LIBDIR);
++	paths = g_strsplit(g_getenv("PURPLE_PLUGIN_PATH"), ":", -1);
++	if (paths) {
++		for (p = paths; *p; ++p)
++			if (**p) purple_plugins_add_search_path(*p);
++	}
++	g_strfreev(paths);
+ 
+ 	purple_signal_register(handle, "plugin-load",
+ 						 purple_marshal_VOID__POINTER,
diff --git a/pkgs/applications/networking/instant-messengers/pidgin/default.nix b/pkgs/applications/networking/instant-messengers/pidgin/default.nix
index 814a191c457a..d5061e6f4314 100644
--- a/pkgs/applications/networking/instant-messengers/pidgin/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pidgin/default.nix
@@ -20,11 +20,14 @@
   , libgcrypt ? null
 } :
 
+# FIXME: clean the mess around choosing the SSL library (nss by default)
+
 stdenv.mkDerivation rec {
-  name = "pidgin-2.10.9";
+  majorVersion = "2";
+  name = "pidgin-${majorVersion}.10.10";
   src = fetchurl {
     url = "mirror://sourceforge/pidgin/${name}.tar.bz2";
-    sha256 = "06gka47myl9f5x0flkq74ml75akkf28rx9sl8pm3wqkzazc2wdnw";
+    sha256 = "0bc2bk2g3w90mpz9sn9j95c71z4i2i3wxaqa2zpmmixf5r8rasyw";
   };
 
   inherit nss ncurses;
@@ -46,7 +49,7 @@ stdenv.mkDerivation rec {
     pkgconfig gtk perl perlXMLParser gettext
   ];
 
-  patches = [./pidgin-makefile.patch ];
+  patches = [./pidgin-makefile.patch ./add-search-path.patch ];
 
   configureFlags="--with-nspr-includes=${nspr}/include/nspr --with-nspr-libs=${nspr}/lib --with-nss-includes=${nss}/include/nss --with-nss-libs=${nss}/lib --with-ncurses-headers=${ncurses}/include --disable-meanwhile --disable-nm --disable-tcl"
   + (lib.optionalString (gnutls != null) " --enable-gnutls=yes --enable-nss=no")
diff --git a/pkgs/applications/networking/instant-messengers/pidgin/wrapper.nix b/pkgs/applications/networking/instant-messengers/pidgin/wrapper.nix
new file mode 100644
index 000000000000..a10eb6864cca
--- /dev/null
+++ b/pkgs/applications/networking/instant-messengers/pidgin/wrapper.nix
@@ -0,0 +1,21 @@
+{ stdenv, buildEnv, pidgin, makeWrapper, plugins }:
+
+let drv = buildEnv {
+  name = "${pidgin.name}-with-plugins";
+
+  paths = [ pidgin ] ++ plugins;
+
+  postBuild = ''
+    # TODO: This could be avoided if buildEnv could be forced to create all directories
+    if [ -L $out/bin ]; then
+      rm $out/bin
+      mkdir $out/bin
+      for i in ${pidgin}/bin/*; do
+        ln -s $i $out/bin
+      done
+    fi
+    wrapProgram $out/bin/pidgin \
+      --suffix-each PURPLE_PLUGIN_PATH ':' "$out/lib/purple-${pidgin.majorVersion} $out/lib/pidgin"
+  '';
+  };
+in stdenv.lib.overrideDerivation drv (x : { buildInputs = x.buildInputs ++ [ makeWrapper ]; })
\ No newline at end of file
diff --git a/pkgs/applications/networking/remote/rdesktop/default.nix b/pkgs/applications/networking/remote/rdesktop/default.nix
index 7d2b7990d3f9..fbbc85108a15 100644
--- a/pkgs/applications/networking/remote/rdesktop/default.nix
+++ b/pkgs/applications/networking/remote/rdesktop/default.nix
@@ -10,6 +10,8 @@ stdenv.mkDerivation (rec {
     sha256 = "0y0s0qjfsflp4drcn75ykx6as7mn13092bcvlp2ibhilkpa27gzv";
   };
 
+  patches = [ ./enable_windows_key.patch ];
+
   buildInputs = [openssl libX11];
 
   configureFlags = [
diff --git a/pkgs/applications/networking/remote/rdesktop/enable_windows_key.patch b/pkgs/applications/networking/remote/rdesktop/enable_windows_key.patch
new file mode 100644
index 000000000000..fff84c599636
--- /dev/null
+++ b/pkgs/applications/networking/remote/rdesktop/enable_windows_key.patch
@@ -0,0 +1,29 @@
+http://sourceforge.net/p/rdesktop/code/1816/
+Fix constant naming and enabled windowskey by default.
+
+Index: trunk/rdesktop.c
+===================================================================
+--- trunk/rdesktop.c	(revision 1815)
++++ trunk/rdesktop.c	(revision 1816)
+@@ -554,7 +554,7 @@
+ 	act.sa_flags = 0;
+ 	sigaction(SIGPIPE, &act, NULL);
+ 
+-	flags = RDP_LOGON_NORMAL;
++	flags = RDP_LOGON_NORMAL | RDP_LOGON_ENABLEWINDOWSKEY;
+ 	prompt_password = False;
+ 	g_seamless_spawn_cmd[0] = domain[0] = g_password[0] = shell[0] = directory[0] = 0;
+ 	g_embed_wnd = 0;
+Index: trunk/constants.h
+===================================================================
+--- trunk/constants.h	(revision 1815)
++++ trunk/constants.h	(revision 1816)
+@@ -321,7 +321,7 @@
+ #define RDP_LOGON_AUTO		0x0008
+ #define RDP_LOGON_NORMAL	0x0033
+ #define RDP_LOGON_COMPRESSION	0x0080	/* mppc compression with 8kB histroy buffer */
+-#define RDP_LOGON_BLOB		0x0100
++#define RDP_LOGON_ENABLEWINDOWSKEY 0x0100
+ #define RDP_LOGON_COMPRESSION2	0x0200	/* rdp5 mppc compression with 64kB history buffer */
+ #define RDP_LOGON_LEAVE_AUDIO	0x2000
+ #define RDP_LOGON_PASSWORD_IS_SC_PIN 0x40000
diff --git a/pkgs/applications/video/byzanz/add-amflags.patch b/pkgs/applications/video/byzanz/add-amflags.patch
new file mode 100644
index 000000000000..aeaa195798a4
--- /dev/null
+++ b/pkgs/applications/video/byzanz/add-amflags.patch
@@ -0,0 +1,12 @@
+diff --git a/Makefile.am b/Makefile.am
+index 6eedb51..7b54313 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -1,5 +1,7 @@
+ SUBDIRS = macros data gifenc src po
+ 
++ACLOCAL_AMFLAGS = -I macros
++
+ EXTRA_DIST = \
+ 	MAINTAINERS \
+ 	depcomp \
diff --git a/pkgs/applications/video/byzanz/default.nix b/pkgs/applications/video/byzanz/default.nix
new file mode 100644
index 000000000000..69b0ffbe1314
--- /dev/null
+++ b/pkgs/applications/video/byzanz/default.nix
@@ -0,0 +1,28 @@
+{ stdenv, fetchgit, which, gnome3_12, glib, intltool, pkgconfig, libtool, cairo, gtk3, gst_all_1 }:
+
+stdenv.mkDerivation rec {
+  version = "0.2.3.alpha";
+  name = "byzanz-${version}";
+
+  src = fetchgit {
+    url = git://github.com/GNOME/byzanz;
+    rev = "1875a7f6a3903b83f6b1d666965800f47db9286a";
+    sha256 = "1b7hyilwj9wf2ri5zq63889bvskagdnqjc91hvyjmx1aj7vdkzd4";
+  };
+
+  patches = [ ./add-amflags.patch ];
+
+  preBuild = ''
+    ./autogen.sh --prefix=$out
+  '';
+
+  buildInputs = [ which gnome3_12.gnome_common glib intltool pkgconfig libtool cairo gtk3 gst_all_1.gstreamer gst_all_1.gst-plugins-base ];
+
+  meta = with stdenv.lib; {
+    description = "Tool to record a running X desktop to an animation suitable for presentation in a web browser";
+    homepage = https://github.com/GNOME/byzanz;
+    license = licenses.gpl3;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.DamienCassou ];
+  };
+}
diff --git a/pkgs/build-support/fetchurl/mirrors.nix b/pkgs/build-support/fetchurl/mirrors.nix
index 080dfea2505f..741c8c0d5460 100644
--- a/pkgs/build-support/fetchurl/mirrors.nix
+++ b/pkgs/build-support/fetchurl/mirrors.nix
@@ -385,4 +385,11 @@ rec {
     http://hdiff.luite.com/packages/archive/package/
   ];
 
+  # Roy marples mirrors
+  roy = [
+    http://roy.marples.name/downloads/
+    http://roy.aydogan.net/
+    http://cflags.cc/roy/
+  ];
+
 }
diff --git a/pkgs/desktops/xfce/applications/xfce4-mixer.nix b/pkgs/desktops/xfce/applications/xfce4-mixer.nix
index f486373ee17d..d9be20150b86 100644
--- a/pkgs/desktops/xfce/applications/xfce4-mixer.nix
+++ b/pkgs/desktops/xfce/applications/xfce4-mixer.nix
@@ -9,6 +9,7 @@ let
   gst_plugins_minimal = gst_plugins_base.override {
     minimalDeps = true;
   };
+  gst_plugins = [ gst_plugins_minimal ];
 
 in
 
@@ -34,6 +35,8 @@ stdenv.mkDerivation rec {
         --prefix GST_PLUGIN_SYSTEM_PATH : "$GST_PLUGIN_SYSTEM_PATH"
     '';
 
+  passthru = { inherit gst_plugins; };
+
   meta = {
     homepage = http://www.xfce.org/projects/xfce4-mixer; # referenced but inactive
     description = "A volume control application for the Xfce desktop environment";
diff --git a/pkgs/desktops/xfce/core/xfce4-panel.nix b/pkgs/desktops/xfce/core/xfce4-panel.nix
index e654b2f7dfbe..7fa8862ea3be 100644
--- a/pkgs/desktops/xfce/core/xfce4-panel.nix
+++ b/pkgs/desktops/xfce/core/xfce4-panel.nix
@@ -1,5 +1,6 @@
 { stdenv, fetchurl, pkgconfig, intltool, gtk, libxfce4util, libxfce4ui
-, libwnck, exo, garcon, xfconf, libstartup_notification }:
+, libwnck, exo, garcon, xfconf, libstartup_notification
+, makeWrapper, xfce4mixer }:
 
 stdenv.mkDerivation rec {
   p_name  = "xfce4-panel";
@@ -17,10 +18,15 @@ stdenv.mkDerivation rec {
 
   buildInputs =
     [ pkgconfig intltool gtk libxfce4util exo libwnck
-      garcon xfconf libstartup_notification
-    ];
+      garcon xfconf libstartup_notification makeWrapper
+    ] ++ xfce4mixer.gst_plugins;
   propagatedBuildInputs = [ libxfce4ui ];
 
+  postInstall = ''
+    wrapProgram "$out/bin/xfce4-panel" \
+      --prefix GST_PLUGIN_SYSTEM_PATH : "$GST_PLUGIN_SYSTEM_PATH"
+  '';
+
   preFixup = "rm $out/share/icons/hicolor/icon-theme.cache";
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/interpreters/elixir/default.nix b/pkgs/development/interpreters/elixir/default.nix
index 7a4251406840..378edfaf3432 100644
--- a/pkgs/development/interpreters/elixir/default.nix
+++ b/pkgs/development/interpreters/elixir/default.nix
@@ -28,8 +28,9 @@ stdenv.mkDerivation {
     # Elixir binaries are shell scripts which run erl. Add some stuff
     # to PATH so the scripts can run without problems.
 
-    for f in $out/bin/*
-    do
+    for f in $out/bin/*; do
+     b=$(basename $f)
+      if [ $b == "mix" ]; then continue; fi
       wrapProgram $f \
       --prefix PATH ":" "${erlang}/bin:${coreutils}/bin:${curl}/bin:${bash}/bin" \
       --set CURL_CA_BUNDLE "${cacert}/etc/ca-bundle.crt"
diff --git a/pkgs/development/interpreters/python/2.6/default.nix b/pkgs/development/interpreters/python/2.6/default.nix
index 97c96133aa5c..c151db8ea18f 100644
--- a/pkgs/development/interpreters/python/2.6/default.nix
+++ b/pkgs/development/interpreters/python/2.6/default.nix
@@ -67,7 +67,14 @@ let
 
     postInstall =
       ''
-        rm -rf "$out/lib/python${majorVersion}/test"
+        # needed for some packages, especially packages that backport
+        # functionality to 2.x from 3.x
+        for item in $out/lib/python${majorVersion}/test/*; do
+          if [[ "$item" != */test_support.py* ]]; then
+            rm -rf "$item"
+          fi
+        done
+        touch $out/lib/python${majorVersion}/test/__init__.py
         ln -s $out/lib/python${majorVersion}/pdb.py $out/bin/pdb
         ln -s $out/lib/python${majorVersion}/pdb.py $out/bin/pdb${majorVersion}
         mv $out/share/man/man1/{python.1,python2.6.1}
diff --git a/pkgs/development/interpreters/python/2.7/default.nix b/pkgs/development/interpreters/python/2.7/default.nix
index e7c5326ddd49..85970641daaf 100644
--- a/pkgs/development/interpreters/python/2.7/default.nix
+++ b/pkgs/development/interpreters/python/2.7/default.nix
@@ -74,7 +74,16 @@ let
 
     postInstall =
       ''
-        rm -rf "$out/lib/python${majorVersion}/test"
+        # needed for some packages, especially packages that backport
+        # functionality to 2.x from 3.x
+        for item in $out/lib/python${majorVersion}/test/*; do
+          if [[ "$item" != */test_support.py* ]]; then
+            rm -rf "$item"
+          else
+            echo $item
+          fi
+        done
+        touch $out/lib/python${majorVersion}/test/__init__.py
         ln -s $out/lib/python${majorVersion}/pdb.py $out/bin/pdb
         ln -s $out/lib/python${majorVersion}/pdb.py $out/bin/pdb${majorVersion}
         ln -s $out/share/man/man1/{python2.7.1.gz,python.1.gz}
diff --git a/pkgs/development/interpreters/python/3.2/default.nix b/pkgs/development/interpreters/python/3.2/default.nix
index dcc90ea5519c..c684266f8225 100644
--- a/pkgs/development/interpreters/python/3.2/default.nix
+++ b/pkgs/development/interpreters/python/3.2/default.nix
@@ -58,8 +58,18 @@ stdenv.mkDerivation {
   setupHook = ./setup-hook.sh;
 
   postInstall = ''
-    rm -rf "$out/lib/python${majorVersion}/test"
+    # needed for some packages, especially packages that backport functionality
+    # to 2.x from 3.x
+    for item in $out/lib/python${majorVersion}/test/*; do
+      if [[ "$item" != */test_support.py* ]]; then
+        rm -rf "$item"
+      else
+        echo $item
+      fi
+    done
+    touch $out/lib/python${majorVersion}/test/__init__.py
     ln -s "$out/include/python${majorVersion}m" "$out/include/python${majorVersion}"
+    paxmark E $out/bin/python${majorVersion}
   '';
 
   passthru = rec {
diff --git a/pkgs/development/interpreters/python/3.3/default.nix b/pkgs/development/interpreters/python/3.3/default.nix
index 450abfa772bc..b9ab82316135 100644
--- a/pkgs/development/interpreters/python/3.3/default.nix
+++ b/pkgs/development/interpreters/python/3.3/default.nix
@@ -53,9 +53,17 @@ stdenv.mkDerivation {
   setupHook = ./setup-hook.sh;
 
   postInstall = ''
-    rm -rf "$out/lib/python${majorVersion}/test"
+    # needed for some packages, especially packages that backport functionality
+    # to 2.x from 3.x
+    for item in $out/lib/python${majorVersion}/test/*; do
+      if [[ "$item" != */test_support.py* ]]; then
+        rm -rf "$item"
+      else
+        echo $item
+      fi
+    done
+    touch $out/lib/python${majorVersion}/test/__init__.py
     ln -s "$out/include/python${majorVersion}m" "$out/include/python${majorVersion}"
-
     paxmark E $out/bin/python${majorVersion}
   '';
 
diff --git a/pkgs/development/interpreters/python/3.4/default.nix b/pkgs/development/interpreters/python/3.4/default.nix
index b76b00047ba6..e585c6c148dd 100644
--- a/pkgs/development/interpreters/python/3.4/default.nix
+++ b/pkgs/development/interpreters/python/3.4/default.nix
@@ -54,9 +54,18 @@ stdenv.mkDerivation {
   setupHook = ./setup-hook.sh;
 
   postInstall = ''
-    rm -rf "$out/lib/python${majorVersion}/test"
-    ln -s "$out/include/python${majorVersion}m" "$out/include/python${majorVersion}"
+    # needed for some packages, especially packages that backport functionality
+    # to 2.x from 3.x
+    for item in $out/lib/python${majorVersion}/test/*; do
+      if [[ "$item" != */test_support.py* ]]; then
+        rm -rf "$item"
+      else
+        echo $item
+      fi
+    done
+    touch $out/lib/python${majorVersion}/test/__init__.py
 
+    ln -s "$out/include/python${majorVersion}m" "$out/include/python${majorVersion}"
     paxmark E $out/bin/python${majorVersion}
   '';
 
diff --git a/pkgs/development/libraries/spice-gtk/default.nix b/pkgs/development/libraries/spice-gtk/default.nix
index f649401c5ca8..e7a048f0a312 100644
--- a/pkgs/development/libraries/spice-gtk/default.nix
+++ b/pkgs/development/libraries/spice-gtk/default.nix
@@ -6,11 +6,11 @@
 with stdenv.lib;
 
 stdenv.mkDerivation rec {
-  name = "spice-gtk-0.24";
+  name = "spice-gtk-0.25";
 
   src = fetchurl {
     url = "http://www.spice-space.org/download/gtk/${name}.tar.bz2";
-    sha256 = "1l8y1pbaqyzb6w8w8xa097dvj4zxhksn85pif1b9847r8l451zkf";
+    sha256 = "11yh593frbafp0ywkk7pfc2k17q1fwrl8zcjclph3xfr1alccc07";
   };
 
   buildInputs = [
diff --git a/pkgs/development/libraries/sqlite/default.nix b/pkgs/development/libraries/sqlite/default.nix
index a460db82b7f6..e1e2be3137bf 100644
--- a/pkgs/development/libraries/sqlite/default.nix
+++ b/pkgs/development/libraries/sqlite/default.nix
@@ -1,21 +1,20 @@
-{ stdenv, fetchurl, readline ? null, ncurses ? null }:
+{ lib, stdenv, fetchurl, interactive ? false, readline ? null, ncurses ? null }:
 
-assert readline != null -> ncurses != null;
+assert interactive -> readline != null && ncurses != null;
 
 stdenv.mkDerivation {
-  name = "sqlite-3.8.6";
+  name = "sqlite-3.8.7";
 
   src = fetchurl {
-    url = "http://www.sqlite.org/2014/sqlite-autoconf-3080600.tar.gz";
-    sha1 = "c4b2911bc4a6e1dc2b411aa21d8c4f524113eb64";
+    url = "http://www.sqlite.org/2014/sqlite-autoconf-3080700.tar.gz";
+    sha1 = "8b773b006db46f3ffcbabe065e927823d13bf5c0";
   };
 
-  buildInputs = [ readline ncurses ];
+  buildInputs = lib.optionals interactive [ readline ncurses ];
 
   configureFlags = "--enable-threadsafe";
 
-  CFLAGS = "-DSQLITE_ENABLE_COLUMN_METADATA=1 -DSQLITE_SECURE_DELETE=1 -DSQLITE_ENABLE_UNLOCK_NOTIFY=1";
-  LDFLAGS = if readline != null then "-lncurses" else "";
+  NIX_CFLAGS_COMPILE = "-DSQLITE_ENABLE_COLUMN_METADATA=1 -DSQLITE_SECURE_DELETE=1 -DSQLITE_ENABLE_UNLOCK_NOTIFY=1";
 
   meta = {
     homepage = http://www.sqlite.org/;
diff --git a/pkgs/development/perl-modules/DBD-SQLite/default.nix b/pkgs/development/perl-modules/DBD-SQLite/default.nix
index 7b1741c3d1e9..fbdcec06d0dd 100644
--- a/pkgs/development/perl-modules/DBD-SQLite/default.nix
+++ b/pkgs/development/perl-modules/DBD-SQLite/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, buildPerlPackage, DBI, sqlite }:
 
 buildPerlPackage rec {
-  name = "DBD-SQLite-1.42";
+  name = "DBD-SQLite-1.44";
 
   src = fetchurl {
     url = "mirror://cpan/authors/id/I/IS/ISHIGAKI/${name}.tar.gz";
-    sha256 = "14x9cjsc8dz8ad1nad0bqiq9cbk1rjfb8h5y0rpk3pdl38y6afxb";
+    sha256 = "10r7wv5x4vzn9zbk3c7mhbx6kz76xxd9p357592c0wamj458qlml";
   };
 
   propagatedBuildInputs = [ DBI ];
diff --git a/pkgs/games/anki/default.nix b/pkgs/games/anki/default.nix
index 7c8c2bd23776..5d50d25194a3 100644
--- a/pkgs/games/anki/default.nix
+++ b/pkgs/games/anki/default.nix
@@ -6,13 +6,16 @@
 
 let
     py = pythonPackages;
-    version = "2.0.29";
+    version = "2.0.31";
 in
 stdenv.mkDerivation rec {
     name = "anki-${version}";
     src = fetchurl {
-      url = "http://ankisrs.net/download/mirror/${name}.tgz";
-      sha256 = "12qw0as5cdgh4hi0vyl0zpdzha93x8rid5xrhpjgiyj5s9fisf40";
+      urls = [
+        "http://ankisrs.net/download/mirror/${name}.tgz"
+        "http://ankisrs.net/download/mirror/archive/${name}.tgz"
+      ];
+      sha256 = "0bxy4pq9yq78g0ffnlkpqj91ri0w4xqgv8mqksddn02v4llrd5jb";
     };
 
     pythonPath = [ pyqt4 py.pysqlite py.sqlalchemy py.pyaudio ]
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index f600f49a1320..0cb305551b64 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -59,6 +59,7 @@ with stdenv.lib;
   ''}
   SCSI_LOWLEVEL y # enable lots of SCSI devices
   SCSI_LOWLEVEL_PCMCIA y
+  SCSI_SAS_ATA y  # added to enable detection of hard drive
   SPI y # needed for many devices
   SPI_MASTER y
   WAN y
diff --git a/pkgs/servers/sql/mysql/5.5.x.nix b/pkgs/servers/sql/mysql/5.5.x.nix
index 7266727fdad8..5987222361ae 100644
--- a/pkgs/servers/sql/mysql/5.5.x.nix
+++ b/pkgs/servers/sql/mysql/5.5.x.nix
@@ -21,7 +21,22 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  cmakeFlags = "-DWITH_SSL=yes -DWITH_READLINE=yes -DWITH_EMBEDDED_SERVER=yes -DWITH_ZLIB=yes -DINSTALL_SCRIPTDIR=bin -DHAVE_IPV6=yes";
+  cmakeFlags = [
+    "-DWITH_SSL=yes"
+    "-DWITH_READLINE=yes"
+    "-DWITH_EMBEDDED_SERVER=yes"
+    "-DWITH_ZLIB=yes"
+    "-DHAVE_IPV6=yes"
+    "-DINSTALL_DOCDIR=share/doc/mysql"
+    "-DINSTALL_DOCREADMEDIR=share/doc/mysql"
+    "-DINSTALL_INCLUDEDIR=include/mysql"
+    "-DINSTALL_INFODIR=share/doc/mysql"
+    "-DINSTALL_MANDIR=share/man"
+    "-DINSTALL_MYSQLSHAREDIR=share/mysql"
+    "-DINSTALL_MYSQLPLUGINDIR=lib/mysql/plugin"
+    "-DINSTALL_SCRIPTDIR=bin"
+    "-DINSTALL_SUPPORTFILESDIR=share/mysql"
+  ];
 
   NIX_LDFLAGS = stdenv.lib.optionalString stdenv.isLinux "-lgcc_s";
 
@@ -30,7 +45,8 @@ stdenv.mkDerivation rec {
   '';
   postInstall = ''
     sed -i -e "s|basedir=\"\"|basedir=\"$out\"|" $out/bin/mysql_install_db
-    rm -rf $out/mysql-test $out/sql-bench
+    rm -r $out/mysql-test $out/sql-bench $out/data
+    rm $out/share/man/man1/mysql-test-run.pl.1
   '';
 
   passthru.mysqlVersion = "5.5";
diff --git a/pkgs/tools/graphics/dmtx-utils/default.nix b/pkgs/tools/graphics/dmtx-utils/default.nix
new file mode 100644
index 000000000000..0fe473f5d634
--- /dev/null
+++ b/pkgs/tools/graphics/dmtx-utils/default.nix
@@ -0,0 +1,29 @@
+{stdenv, fetchurl, libdmtx, pkgconfig}:
+let
+  s = # Generated upstream information
+  rec {
+    baseName="dmtx-utils";
+    version="0.7.4";
+    name="${baseName}-${version}";
+    hash="1di8ymlziy9856abd6rb72z0zqzmrff4r3vql0q9r5sk5ax4s417";
+    url="mirror://sourceforge/project/libdmtx/libdmtx/0.7.4/dmtx-utils-0.7.4.tar.gz";
+    sha256="1di8ymlziy9856abd6rb72z0zqzmrff4r3vql0q9r5sk5ax4s417";
+  };
+  buildInputs = [
+    libdmtx pkgconfig
+  ];
+in
+stdenv.mkDerivation {
+  inherit (s) name version;
+  inherit buildInputs;
+  src = fetchurl {
+    inherit (s) url sha256;
+  };
+  meta = {
+    inherit (s) version;
+    description = "Data matrix command-line utilities";
+    license = stdenv.lib.licenses.lgpl2 ;
+    maintainers = [stdenv.lib.maintainers.raskin];
+    platforms = stdenv.lib.platforms.linux;
+  };
+}
diff --git a/pkgs/tools/graphics/dmtx-utils/default.upstream b/pkgs/tools/graphics/dmtx-utils/default.upstream
new file mode 100644
index 000000000000..8768681642e5
--- /dev/null
+++ b/pkgs/tools/graphics/dmtx-utils/default.upstream
@@ -0,0 +1,4 @@
+url http://sourceforge.net/projects/libdmtx/files/libdmtx/
+SF_version_dir
+version_link 'dmtx-utils-.*[.]tar[.][a-z0-9]+/download$'
+SF_redirect
diff --git a/pkgs/tools/graphics/dmtx/default.nix b/pkgs/tools/graphics/dmtx/default.nix
deleted file mode 100644
index 30b3baa4690b..000000000000
--- a/pkgs/tools/graphics/dmtx/default.nix
+++ /dev/null
@@ -1,31 +0,0 @@
-args :
-let
-  lib = args.lib;
-  fetchurl = args.fetchurl;
-
-  version = lib.attrByPath ["version"] "0.7.4" args;
-  buildInputs = with args; [
-    libpng libtiff libjpeg librsvg imagemagick pkgconfig
-    zlib libX11 bzip2 libtool freetype fontconfig
-    ghostscript jasper xz
-  ];
-in
-rec {
-  src = fetchurl {
-    url = "mirror://sourceforge/libdmtx/libdmtx-${version}.tar.bz2";
-    sha256 = "0xnxx075ycy58n92yfda2z9zgd41h3d4ik5d9l197lzsqim5hb5n";
-  };
-
-  inherit buildInputs;
-  configureFlags = [];
-
-  /* doConfigure should be specified separately */
-  phaseNames = ["doConfigure" "doMakeInstall"];
-
-  name = "dmtx-" + version;
-  meta = {
-    description = "DataMatrix (2D bar code) processing tools";
-    maintainers = [args.lib.maintainers.raskin];
-    platforms = args.lib.platforms.linux;
-  };
-}
diff --git a/pkgs/tools/inputmethods/fcitx/fcitx-configtool.nix b/pkgs/tools/inputmethods/fcitx/fcitx-configtool.nix
new file mode 100644
index 000000000000..8bbd28f82a31
--- /dev/null
+++ b/pkgs/tools/inputmethods/fcitx/fcitx-configtool.nix
@@ -0,0 +1,20 @@
+{ stdenv, fetchurl, pkgconfig, cmake, fcitx, gtk3, isocodes }:
+
+stdenv.mkDerivation rec {
+  name = "fcitx-configtool-0.4.8";
+
+  meta = with stdenv.lib; {
+    description = "GTK-based config tool for Fcitx";
+    license     = licenses.gpl2;
+    platforms   = platforms.linux;
+    maintainers = with maintainers; [ cdepillabout ];
+  };
+
+  src = fetchurl {
+    url = "http://download.fcitx-im.org/fcitx-configtool/${name}.tar.xz";
+    sha256 = "1vaim0namw58bfafbvws1vgd4010p19zwqfbx6bd1zi5sgchdg0f";
+  };
+
+  buildInputs = [ fcitx cmake isocodes pkgconfig gtk3 ];
+}
+
diff --git a/pkgs/tools/misc/grub/trusted.nix b/pkgs/tools/misc/grub/trusted.nix
new file mode 100644
index 000000000000..9f897d7e93a2
--- /dev/null
+++ b/pkgs/tools/misc/grub/trusted.nix
@@ -0,0 +1,26 @@
+{stdenv, fetchgit, autoconf, automake, buggyBiosCDSupport ? true}:
+
+stdenv.mkDerivation {
+  name = "trustedGRUB-1.1.5";
+
+  src = fetchgit {
+     url = "https://github.com/ts468/TrustedGRUB";
+     rev = "954941c17e14c8f7b18e6cd3043ef5f946866f1c";
+     sha256 = "30c21765dc44f02275e66220d6724ec9cd45496226ca28c6db59a9147aa22685";
+  };
+
+  # Autoconf/automake required for the splashimage patch.
+  buildInputs = [autoconf automake];
+
+  preConfigure = ''
+    autoreconf
+  '';
+
+  meta = {
+    homepage = "http://sourceforge.net/projects/trustedgrub/";
+    repositories.git = https://github.com/ts468/TrustedGRUB;
+    description = "Legacy GRUB bootloader extended with TCG support";
+    platforms = stdenv.lib.platforms.linux;
+    maintainers = with stdenv.lib.maintainers; [ tstrobel ];
+  };
+}
diff --git a/pkgs/tools/networking/dhcpcd/default.nix b/pkgs/tools/networking/dhcpcd/default.nix
index 3527b80ec3a2..927d60e81249 100644
--- a/pkgs/tools/networking/dhcpcd/default.nix
+++ b/pkgs/tools/networking/dhcpcd/default.nix
@@ -4,7 +4,7 @@ stdenv.mkDerivation rec {
   name = "dhcpcd-6.5.1";
 
   src = fetchurl {
-    url = "http://roy.marples.name/downloads/dhcpcd/${name}.tar.bz2";
+    url = "mirror://roy/dhcpcd/${name}.tar.bz2";
     sha256 = "0y0falxxlahr2i630ydraq4ldr7d5mg8ar0s5np5ddl76w58dlrp";
   };
 
diff --git a/pkgs/tools/networking/openresolv/default.nix b/pkgs/tools/networking/openresolv/default.nix
index b81c46c0b616..ee5241bfcad8 100644
--- a/pkgs/tools/networking/openresolv/default.nix
+++ b/pkgs/tools/networking/openresolv/default.nix
@@ -4,7 +4,7 @@ stdenv.mkDerivation rec {
   name = "openresolv-3.5.7";
 
   src = fetchurl {
-    url = "http://roy.marples.name/downloads/openresolv/${name}.tar.bz2";
+    url = "mirror://roy/openresolv/${name}.tar.bz2";
     sha256 = "14n51wqnh49zdvx11l79s3fh1jhg7kg9cfny5vk7zsix78spmyx7";
   };
 
diff --git a/pkgs/tools/package-management/nix/unstable.nix b/pkgs/tools/package-management/nix/unstable.nix
index 47b29b61dd9a..23ecf9ac6e03 100644
--- a/pkgs/tools/package-management/nix/unstable.nix
+++ b/pkgs/tools/package-management/nix/unstable.nix
@@ -5,11 +5,11 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "nix-1.8pre3861_bca6d35";
+  name = "nix-1.8pre3866_6062b12";
 
   src = fetchurl {
-    url = http://hydra.nixos.org/build/15940830/download/4/nix-1.8pre3861_bca6d35.tar.xz;
-    sha256 = "f2c5d2669c69a23fc8510d08beb48210da72cb4ec8fe334eff476b93f76d744f";
+    url = http://hydra.nixos.org/build/16392832/download/4/nix-1.8pre3866_6062b12.tar.xz;
+    sha256 = "2038e0285ee4690c80e220642794b02d611b81c578593042ab8557d30a0d0d3b";
   };
 
   nativeBuildInputs = [ perl pkgconfig ];
diff --git a/pkgs/tools/security/aide/default.nix b/pkgs/tools/security/aide/default.nix
new file mode 100644
index 000000000000..c1b6fe197a15
--- /dev/null
+++ b/pkgs/tools/security/aide/default.nix
@@ -0,0 +1,27 @@
+{ stdenv, fetchurl, flex, bison, libmhash, zlib, acl, attr, libselinux }:
+stdenv.mkDerivation rec {
+  name = "aide-${version}";
+  version = "0.16a2";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/aide/devel/0.16a2/aide-${version}.tar.gz";
+    sha256 = "11qvp6l2x4ajq9485lmg722gfdikh8r2wqfw17m0jm68df0m295m";
+  };
+
+  buildInputs = [ flex bison libmhash zlib acl attr libselinux ];
+
+
+  configureFlags = [
+    "--with-posix-acl"
+    "--with-selinux"
+    "--with-xattr"
+    ];
+
+  meta = with stdenv.lib; {
+    homepage = "http://aide.sourceforge.net/";
+    description = "Advanced Intrusion Detection Environment (AIDE) is a file and directory integrity checker";
+    license = licenses.free;
+    maintainers = [ maintainers.tstrobel ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/tools/security/opencryptoki/default.nix b/pkgs/tools/security/opencryptoki/default.nix
new file mode 100644
index 000000000000..9ea9c2f4892b
--- /dev/null
+++ b/pkgs/tools/security/opencryptoki/default.nix
@@ -0,0 +1,38 @@
+{ stdenv, fetchurl, openssl, trousers, automake, autoconf, libtool, bison, flex }:
+
+stdenv.mkDerivation rec {
+  version = "3.2";
+  name = "opencryptoki-${version}";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/opencryptoki/opencryptoki/v${version}/opencryptoki-v${version}.tgz";
+    sha256 = "06r6zp299vxdspl6k65myzgjv0bihg7kc500v7s4jd3mcrkngd6h";
+  };
+
+  buildInputs = [ automake autoconf libtool openssl trousers bison flex ];
+
+  preConfigure = ''
+    substituteInPlace configure.in --replace "chown" "true"
+    substituteInPlace configure.in --replace "chgrp" "true"
+    sh bootstrap.sh --prefix=$out
+  '';
+
+  configureFlags = [ "--disable-ccatok" "--disable-icatok" ];
+
+  makeFlags = "DESTDIR=$(out)";
+
+  # work around the build script of opencryptoki
+  postInstall = ''
+    cp -r $out/$out/* $out
+    rm -r $out/nix
+    '';
+
+  meta = with stdenv.lib; {
+    description = "PKCS#11 implementation for Linux";
+    homepage    = http://opencryptoki.sourceforge.net/;
+    license     = licenses.cpl10;
+    maintainers = [ maintainers.tstrobel ];
+    platforms   = platforms.unix;
+  };
+}
+
diff --git a/pkgs/tools/security/rng-tools/default.nix b/pkgs/tools/security/rng-tools/default.nix
index 446e25772f17..989b84ef957f 100644
--- a/pkgs/tools/security/rng-tools/default.nix
+++ b/pkgs/tools/security/rng-tools/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "rng-tools-4";
+  name = "rng-tools-5";
 
   src = fetchurl {
     url = "mirror://sourceforge/gkernel/${name}.tar.gz";
 
-    sha256 = "15f17j3lxn1v2mhdxvy3pahz41hn1vlnnm81c0qyh19c4bady6xp";
+    sha256 = "13h7lc8wl9khhvkr0i3bl5j9bapf8anhqis1lcnwxg1vc2v058b0";
   };
 
   meta = {
diff --git a/pkgs/tools/security/simple-tpm-pk11/default.nix b/pkgs/tools/security/simple-tpm-pk11/default.nix
new file mode 100644
index 000000000000..811618d66028
--- /dev/null
+++ b/pkgs/tools/security/simple-tpm-pk11/default.nix
@@ -0,0 +1,27 @@
+{ stdenv, fetchgit, trousers, openssl, opencryptoki, automake, autoconf, libtool }:
+
+stdenv.mkDerivation rec {
+  name = "simple-tpm-pk11-2014-09-25";
+
+  src = fetchgit {
+    url = "https://github.com/ThomasHabets/simple-tpm-pk11";
+    rev = "f26f10e11344560ff6e1479e6795dc0e5dc49a26";
+    sha256 = "8c9501ceed0557113ce3facf7b22b8baf6f32ebb092008c089b80334ed03cec9";
+  };
+
+  buildInputs = [ trousers openssl opencryptoki automake autoconf libtool ];
+
+  preConfigure = "sh bootstrap.sh";
+
+  meta = with stdenv.lib; {
+    description = "Simple PKCS11 provider for TPM chips";
+    longDescription = ''
+      A simple library for using the TPM chip to secure SSH keys.
+      '';
+    homepage    = https://github.com/ThomasHabets/simple-tpm-pk11;
+    license     = stdenv.lib.licenses.asl20;
+    maintainers = with stdenv.lib; [ maintainers.tstrobel ];
+    platforms   = platforms.unix;
+  };
+}
+
diff --git a/pkgs/tools/security/tpm-tools/default.nix b/pkgs/tools/security/tpm-tools/default.nix
index 6e7ff75a6a48..a17bff9e32c8 100644
--- a/pkgs/tools/security/tpm-tools/default.nix
+++ b/pkgs/tools/security/tpm-tools/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, trousers, openssl }:
+{ stdenv, fetchurl, trousers, openssl, opencryptoki }:
 
 let
   version = "1.3.8";
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "10za1gi89vi9m2lmm7jfzs281h55x1sbbm2bdgdh692ljpq4zsv6";
   };
 
-  buildInputs = [ trousers openssl ];
+  buildInputs = [ trousers openssl opencryptoki ];
 
   meta = with stdenv.lib; {
     description = "Management tools for TPM hardware";
diff --git a/pkgs/tools/security/wipe/default.nix b/pkgs/tools/security/wipe/default.nix
new file mode 100644
index 000000000000..a7c337dc1222
--- /dev/null
+++ b/pkgs/tools/security/wipe/default.nix
@@ -0,0 +1,21 @@
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  name = "wipe-${version}";
+  version = "2.3.1";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/wipe/${version}/${name}.tar.bz2";
+    sha256 = "180snqvh6k6il6prb19fncflf2jcvkihlb4w84sbndcv1wvicfa6";
+  };
+
+  patches = [ ./fix-install.patch ];
+
+  meta = with stdenv.lib; {
+    description = "Secure file wiping utility";
+    homepage    = http://wipe.sourceforge.net/;
+    license     = licenses.gpl2;
+    platforms   = platforms.linux;
+    maintainers = [ maintainers.abbradar ];
+  };
+}
diff --git a/pkgs/tools/security/wipe/fix-install.patch b/pkgs/tools/security/wipe/fix-install.patch
new file mode 100644
index 000000000000..2df3a1eec6a0
--- /dev/null
+++ b/pkgs/tools/security/wipe/fix-install.patch
@@ -0,0 +1,18 @@
+diff -ru3 wipe-2.3.1/Makefile.in wipe-2.3.1-new/Makefile.in
+--- wipe-2.3.1/Makefile.in	2009-11-02 00:11:30.000000000 +0300
++++ wipe-2.3.1-new/Makefile.in	2014-10-18 02:51:10.088966232 +0400
+@@ -60,12 +60,12 @@
+ 	$(INSTALL_BIN) -d $(bindir)
+ 	$(INSTALL_BIN) -s $(BIN_OUT) $(bindir)
+ 	$(INSTALL) -d $(mandir)/man1
+-	$(INSTALL) -o root -m 0644 wipe.1 $(mandir)/man1/
++	$(INSTALL) -m 0644 wipe.1 $(mandir)/man1/
+ 	rm -rf $(datadir)/doc/wipe*
+ 	$(INSTALL) -d $(datadir)/doc/wipe
+ 
+ 	for file in $(DOCS); do \
+-		$(INSTALL) -o root -m 0644 $$file $(datadir)/doc/wipe/; \
++		$(INSTALL) -m 0644 $$file $(datadir)/doc/wipe/; \
+ 	done
+ 
+ install_home: $(BIN_OUT)
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index a57e7de7c623..a6b6f034c635 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -468,6 +468,8 @@ let
 
   ahcpd = callPackage ../tools/networking/ahcpd { };
 
+  aide = callPackage ../tools/security/aide { };
+
   aircrackng = callPackage ../tools/networking/aircrack-ng { };
 
   airfield = callPackage ../tools/networking/airfield { };
@@ -770,6 +772,8 @@ let
     par2Support = (config.bup.par2Support or false);
   };
 
+  byzanz = callPackage ../applications/video/byzanz {};
+
   ori = callPackage ../tools/backup/ori { };
 
   atool = callPackage ../tools/archivers/atool { };
@@ -1107,6 +1111,8 @@ let
 
   fcitx-anthy = callPackage ../tools/inputmethods/fcitx/fcitx-anthy.nix { };
 
+  fcitx-configtool = callPackage ../tools/inputmethods/fcitx/fcitx-configtool.nix { };
+
   fcron = callPackage ../tools/system/fcron { };
 
   fdm = callPackage ../tools/networking/fdm {};
@@ -1310,6 +1316,10 @@ let
     buggyBiosCDSupport = config.grub.buggyBiosCDSupport or true;
   };
 
+  trustedGrub = callPackage_i686 ../tools/misc/grub/trusted.nix {
+    buggyBiosCDSupport = config.grub.buggyBiosCDSupport or true;
+  };
+
   grub2 = callPackage ../tools/misc/grub/2.0x.nix { };
 
   grub2_efi = grub2.override { efiSupport = true; };
@@ -1537,6 +1547,8 @@ let
 
   ldns = callPackage ../development/libraries/ldns { };
 
+  leafpad = callPackage ../applications/editors/leafpad { };
+
   lftp = callPackage ../tools/networking/lftp { };
 
   libconfig = callPackage ../development/libraries/libconfig { };
@@ -1855,6 +1867,8 @@ let
     inherit (pythonPackages) sqlite3;
   };
 
+  opencryptoki = callPackage ../tools/security/opencryptoki { };
+
   opendbx = callPackage ../development/libraries/opendbx { };
 
   opendkim = callPackage ../development/libraries/opendkim { };
@@ -2639,6 +2653,8 @@ let
 
   wicd = callPackage ../tools/networking/wicd { };
 
+  wipe = callPackage ../tools/security/wipe { };
+
   wkhtmltopdf = callPackage ../tools/graphics/wkhtmltopdf {
     overrideDerivation = lib.overrideDerivation;
     inherit (xlibs) libX11 libXext libXrender;
@@ -4545,6 +4561,8 @@ let
 
   sigrok-cli = callPackage ../development/tools/sigrok-cli { };
 
+  simpleTpmPk11 = callPackage ../tools/security/simple-tpm-pk11 { };
+
   slimerjs = callPackage ../development/tools/slimerjs {};
 
   sloccount = callPackage ../development/tools/misc/sloccount { };
@@ -6657,14 +6675,9 @@ let
 
   srtp_linphone = callPackage ../development/libraries/srtp/linphone.nix { };
 
-  sqlite = lowPrio (callPackage ../development/libraries/sqlite {
-    readline = null;
-    ncurses = null;
-  });
+  sqlite = lowPrio (callPackage ../development/libraries/sqlite { });
 
-  sqliteInteractive = appendToName "interactive" (sqlite.override {
-    inherit readline ncurses;
-  });
+  sqliteInteractive = appendToName "interactive" (sqlite.override { interactive = true; });
 
   sqlcipher = lowPrio (callPackage ../development/libraries/sqlcipher {
     readline = null;
@@ -8953,11 +8966,11 @@ let
     enableXft = config.dmenu.enableXft or false;
   };
 
-  dmtx = builderDefsPackage (import ../tools/graphics/dmtx) {
-    inherit libpng libtiff libjpeg imagemagick librsvg
-      pkgconfig bzip2 zlib libtool freetype fontconfig
-      ghostscript jasper xz;
-    inherit (xlibs) libX11;
+  dmenu2 = callPackage ../applications/misc/dmenu2 { };
+
+  dmtx = dmtx-utils;
+
+  dmtx-utils = callPackage (import ../tools/graphics/dmtx-utils) {
   };
 
   docker = callPackage ../applications/virtualization/docker { };
@@ -10100,6 +10113,10 @@ let
     startupnotification = libstartup_notification;
   };
 
+  pidginWrapper = callPackage ../applications/networking/instant-messengers/pidgin/wrapper.nix {
+    plugins = [];
+  };
+
   pidginlatex = callPackage ../applications/networking/instant-messengers/pidgin-plugins/pidgin-latex {
     imagemagick = imagemagickBig;
   };
@@ -10225,6 +10242,14 @@ let
     unicode3Support = true;
   };
 
+  # urxvt plugins
+  urxvt_perls = callPackage ../applications/misc/rxvt_unicode-plugins/urxvt-perls { };
+  urxvt_tabbedex = callPackage ../applications/misc/rxvt_unicode-plugins/urxvt-tabbedex { };
+
+  rxvt_unicode_with-plugins = callPackage ../applications/misc/rxvt_unicode/wrapper.nix {
+    plugins = [ urxvt_perls urxvt_tabbedex ];
+  };
+
   sakura = callPackage ../applications/misc/sakura {
     inherit (gnome) vte;
   };
@@ -10914,6 +10939,7 @@ let
     (let callPackage = newScope pkgs.zathuraCollection; in
       import ../applications/misc/zathura {
         inherit callPackage pkgs fetchurl;
+        stdenv = overrideGCC stdenv gcc49;
         useMupdf = config.zathura.useMupdf or false;
       });
 
@@ -10925,6 +10951,7 @@ let
 
   girara = callPackage ../applications/misc/girara {
     gtk = gtk3;
+    stdenv = overrideGCC stdenv gcc49;
   };
 
   zgrviewer = callPackage ../applications/graphics/zgrviewer {};
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 8a431617d23d..809e648e9101 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -8608,7 +8608,21 @@ let
       md5 = "754c5ab9f533e764f931136974b618f1";
     };
 
-    doCheck = false;
+    buildInputs = [ pkgs.bash ];
+
+    preConfigure = ''
+      substituteInPlace test_subprocess32.py \
+        --replace '/usr/' '${pkgs.bash}/'
+    '';
+
+    checkPhase = ''
+      TMP_PREFIX=`pwd`/tmp/$name
+      TMP_INSTALL_DIR=$TMP_PREFIX/lib/${pythonPackages.python.libPrefix}/site-packages
+      PYTHONPATH="$TMP_INSTALL_DIR:$PYTHONPATH"
+      mkdir -p $TMP_INSTALL_DIR
+      python setup.py develop --prefix $TMP_PREFIX
+      python test_subprocess32.py
+    '';
 
     meta = {
       homepage = "https://pypi.python.org/pypi/subprocess32";
@@ -9442,7 +9456,11 @@ let
     preConfigure = "export HOME=$TMPDIR";
 
     buildInputs = with self; [ pbr pip pkgs.which ];
-    propagatedBuildInputs = with self; [ stevedore virtualenv virtualenv-clone ];
+    propagatedBuildInputs = with self; [
+      stevedore
+      virtualenv
+      virtualenv-clone
+    ] ++ optional isPy26 argparse;
 
     patchPhase = ''
       substituteInPlace "virtualenvwrapper.sh" --replace "which" "${pkgs.which}/bin/which"