diff --git a/pkgs/applications/version-management/git-and-tools/git/ssl-cert-file.patch b/pkgs/applications/version-management/git-and-tools/git/ssl-cert-file.patch
index bafd65e8c93e..0e0697dfb211 100644
--- a/pkgs/applications/version-management/git-and-tools/git/ssl-cert-file.patch
+++ b/pkgs/applications/version-management/git-and-tools/git/ssl-cert-file.patch
@@ -1,11 +1,14 @@
 diff -ru git-2.7.4-orig/http.c git-2.7.4/http.c
 --- git-2.7.4-orig/http.c	2016-03-17 21:47:59.000000000 +0100
 +++ git-2.7.4/http.c	2016-04-12 11:38:33.187070848 +0200
-@@ -544,6 +544,7 @@
+@@ -544,6 +544,10 @@
  #if LIBCURL_VERSION_NUM >= 0x070908
  	set_from_env(&ssl_capath, "GIT_SSL_CAPATH");
  #endif
-+	set_from_env(&ssl_cainfo, "SSL_CERT_FILE");
++	if (getenv("NIX_SSL_CERT_FILE"))
++	  set_from_env(&ssl_cainfo, "NIX_SSL_CERT_FILE");
++	else
++	  set_from_env(&ssl_cainfo, "SSL_CERT_FILE");
  	set_from_env(&ssl_cainfo, "GIT_SSL_CAINFO");
  
  	set_from_env(&user_agent, "GIT_HTTP_USER_AGENT");
diff --git a/pkgs/applications/version-management/mercurial/default.nix b/pkgs/applications/version-management/mercurial/default.nix
index 034eb5344234..1c97f7252f56 100644
--- a/pkgs/applications/version-management/mercurial/default.nix
+++ b/pkgs/applications/version-management/mercurial/default.nix
@@ -7,8 +7,9 @@ let
   version = "3.9.2";
   name = "mercurial-${version}";
   inherit (python2Packages) docutils hg-git dulwich python;
-in python2Packages.mkPythonDerivation {
+in python2Packages.buildPythonApplication {
   inherit name;
+  format = "other";
 
   src = fetchurl {
     url = "https://mercurial-scm.org/release/${name}.tar.gz";
diff --git a/pkgs/build-support/setup-hooks/make-wrapper.sh b/pkgs/build-support/setup-hooks/make-wrapper.sh
index 4f55493ae483..96e50773138b 100644
--- a/pkgs/build-support/setup-hooks/make-wrapper.sh
+++ b/pkgs/build-support/setup-hooks/make-wrapper.sh
@@ -19,98 +19,100 @@
 #                                   are read first and used as VALS
 # --suffix-contents
 makeWrapper() {
-    local original=$1
-    local wrapper=$2
+    local original="$1"
+    local wrapper="$2"
     local params varName value command separator n fileNames
-    local argv0 flagsBefore flags extraFlagsArray
+    local argv0 flagsBefore flags
 
-    mkdir -p "$(dirname $wrapper)"
+    mkdir -p "$(dirname "$wrapper")"
 
-    echo "#! $SHELL -e" > $wrapper
+    echo "#! $SHELL -e" > "$wrapper"
 
     params=("$@")
     for ((n = 2; n < ${#params[*]}; n += 1)); do
-        p=${params[$n]}
+        p="${params[$n]}"
 
         if test "$p" = "--set"; then
-            varName=${params[$((n + 1))]}
-            value=${params[$((n + 2))]}
+            varName="${params[$((n + 1))]}"
+            value="${params[$((n + 2))]}"
             n=$((n + 2))
-            echo "export $varName=\"$value\"" >> $wrapper
+            echo "export $varName=\"$value\"" >> "$wrapper"
         fi
 
         if test "$p" = "--unset"; then
-            varName=${params[$((n + 1))]}
+            varName="${params[$((n + 1))]}"
             n=$((n + 1))
             echo "unset $varName" >> "$wrapper"
         fi
 
         if test "$p" = "--run"; then
-            command=${params[$((n + 1))]}
+            command="${params[$((n + 1))]}"
             n=$((n + 1))
-            echo "$command" >> $wrapper
+            echo "$command" >> "$wrapper"
         fi
 
         if test "$p" = "--suffix" -o "$p" = "--prefix"; then
-            varName=${params[$((n + 1))]}
-            separator=${params[$((n + 2))]}
-            value=${params[$((n + 3))]}
+            varName="${params[$((n + 1))]}"
+            separator="${params[$((n + 2))]}"
+            value="${params[$((n + 3))]}"
             n=$((n + 3))
             if test -n "$value"; then
                 if test "$p" = "--suffix"; then
-                    echo "export $varName=\$$varName\${$varName:+$separator}$value" >> $wrapper
+                    echo "export $varName=\$$varName\${$varName:+$separator}$value" >> "$wrapper"
                 else
-                    echo "export $varName=$value\${$varName:+$separator}\$$varName" >> $wrapper
+                    echo "export $varName=$value\${$varName:+$separator}\$$varName" >> "$wrapper"
                 fi
             fi
         fi
 
         if test "$p" = "--suffix-each"; then
-            varName=${params[$((n + 1))]}
-            separator=${params[$((n + 2))]}
-            values=${params[$((n + 3))]}
+            varName="${params[$((n + 1))]}"
+            separator="${params[$((n + 2))]}"
+            values="${params[$((n + 3))]}"
             n=$((n + 3))
             for value in $values; do
-                echo "export $varName=\$$varName\${$varName:+$separator}$value" >> $wrapper
+                echo "export $varName=\$$varName\${$varName:+$separator}$value" >> "$wrapper"
             done
         fi
 
         if test "$p" = "--suffix-contents" -o "$p" = "--prefix-contents"; then
-            varName=${params[$((n + 1))]}
-            separator=${params[$((n + 2))]}
-            fileNames=${params[$((n + 3))]}
+            varName="${params[$((n + 1))]}"
+            separator="${params[$((n + 2))]}"
+            fileNames="${params[$((n + 3))]}"
             n=$((n + 3))
             for fileName in $fileNames; do
                 if test "$p" = "--suffix-contents"; then
-                    echo "export $varName=\$$varName\${$varName:+$separator}$(cat $fileName)" >> $wrapper
+                    echo "export $varName=\$$varName\${$varName:+$separator}$(cat "$fileName")" >> "$wrapper"
                 else
-                    echo "export $varName=$(cat $fileName)\${$varName:+$separator}\$$varName" >> $wrapper
+                    echo "export $varName=$(cat "$fileName")\${$varName:+$separator}\$$varName" >> "$wrapper"
                 fi
             done
         fi
 
         if test "$p" = "--add-flags"; then
-            flags=${params[$((n + 1))]}
+            flags="${params[$((n + 1))]}"
             n=$((n + 1))
             flagsBefore="$flagsBefore $flags"
         fi
 
         if test "$p" = "--argv0"; then
-            argv0=${params[$((n + 1))]}
+            argv0="${params[$((n + 1))]}"
             n=$((n + 1))
         fi
     done
 
     # Note: extraFlagsArray is an array containing additional flags
     # that may be set by --run actions.
-    echo exec ${argv0:+-a $argv0} "$original" \
-         $flagsBefore '"${extraFlagsArray[@]}"' '"$@"' >> $wrapper
+    # Silence warning about unexpanded extraFlagsArray:
+    # shellcheck disable=SC2016
+    echo exec ${argv0:+-a \"$argv0\"} \""$original"\" \
+         "$flagsBefore" '"${extraFlagsArray[@]}"' '"$@"' >> "$wrapper"
 
-    chmod +x $wrapper
+    chmod +x "$wrapper"
 }
 
 addSuffix() {
-    suffix=$1
+    suffix="$1"
     shift
     for name in "$@"; do
         echo "$name$suffix"
@@ -128,7 +130,10 @@ filterExisting() {
 # Syntax: wrapProgram <PROGRAM> <MAKE-WRAPPER FLAGS...>
 wrapProgram() {
     local prog="$1"
-    local hidden="$(dirname "$prog")/.$(basename "$prog")"-wrapped
-    mv $prog $hidden
-    makeWrapper $hidden $prog --argv0 '"$0"' "$@"
+    local hidden
+    hidden="$(dirname "$prog")/.$(basename "$prog")"-wrapped
+    mv "$prog" "$hidden"
+    # Silence warning about unexpanded $0:
+    # shellcheck disable=SC2016
+    makeWrapper "$hidden" "$prog" --argv0 '$0' "$@"
 }
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 803fcd8f87a7..eac07ddbfb19 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, fetchpatch
+{ stdenv, fetchurl, fetchpatch, lib
 , pkgconfig, intltool, autoreconfHook, substituteAll
 , file, expat, libdrm, xorg, wayland, openssl
 , llvmPackages, libffi, libomxil-bellagio, libva
@@ -8,9 +8,11 @@
 # Texture floats are patented, see docs/patents.txt, so we don't enable them for full Mesa.
 # It's overridden for mesa_drivers.
 , enableTextureFloats ? false
+, galliumDrivers ? null
+, driDrivers ? null
+, vulkanDrivers ? null
 }:
 
-
 /** Packaging design:
   - The basic mesa ($out) contains headers and libraries (GLU is in mesa_glu now).
     This or the mesa attribute (which also contains GLU) are small (~ 2 MB, mostly headers)
@@ -29,7 +31,41 @@ if ! lists.elem stdenv.system platforms.mesaPlatforms then
 else
 
 let
-  version = "17.0.1";
+  defaultGalliumDrivers =
+    if (stdenv.isArm || stdenv.isAarch64)
+    then ["nouveau" "freedreno" "vc4" "etnaviv"]
+    else ["i915" "ilo" "r300" "r600" "radeonsi" "nouveau"];
+  defaultDriDrivers =
+    if (stdenv.isArm || stdenv.isAarch64)
+    then ["nouveau"]
+    else ["i915" "i965" "nouveau" "radeon" "r200"];
+  defaultVulkanDrivers =
+    if (stdenv.isArm || stdenv.isAarch64)
+    then []
+    else ["intel"] ++ lib.optional enableRadv "radeon";
+in
+
+let gallium_ = galliumDrivers; dri_ = driDrivers; vulkan_ = vulkanDrivers; in
+
+let
+  galliumDrivers =
+    ["svga"]
+    ++ (if gallium_ == null
+          then defaultGalliumDrivers
+          else gallium_)
+    ++ ["swrast"];
+  driDrivers =
+    (if dri_ == null
+      then defaultDriDrivers
+      else dri_) ++ ["swrast"];
+  vulkanDrivers =
+    if vulkan_ == null
+    then defaultVulkanDrivers
+    else vulkan_;
+in
+
+let
+  version = "17.0.2";
   branch  = head (splitString "." version);
   driverLink = "/run/opengl-driver" + optionalString stdenv.isi686 "-32";
 in
@@ -44,7 +80,7 @@ stdenv.mkDerivation {
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
       "https://launchpad.net/mesa/trunk/${version}/+download/mesa-${version}.tar.xz"
     ];
-    sha256 = "96fd70ef5f31d276a17e424e7e1bb79447ccbbe822b56844213ef932e7ad1b0c";
+    sha256 = "f8f191f909e01e65de38d5bdea5fb057f21649a3aed20948be02348e77a689d4";
   };
 
   prePatch = "patchShebangs .";
@@ -66,14 +102,17 @@ stdenv.mkDerivation {
     "--with-dri-driverdir=$(drivers)/lib/dri"
     "--with-dri-searchpath=${driverLink}/lib/dri"
     "--with-egl-platforms=x11,wayland,drm"
-  ] ++ (if stdenv.isArm || stdenv.isAarch64 then [
-      "--with-gallium-drivers=nouveau,freedreno,vc4,etnaviv,swrast"
-      "--with-dri-drivers=nouveau,swrast"
-  ] else [
-      "--with-gallium-drivers=svga,i915,ilo,r300,r600,radeonsi,nouveau,swrast"
-      "--with-dri-drivers=i915,i965,nouveau,radeon,r200,swrast"
-      ("--with-vulkan-drivers=intel" + optionalString enableRadv ",radeon")
-  ]) ++ [
+  ]
+  ++ (optional (galliumDrivers != [])
+      ("--with-gallium-drivers=" +
+        builtins.concatStringsSep "," galliumDrivers))
+  ++ (optional (driDrivers != [])
+      ("--with-dri-drivers=" +
+        builtins.concatStringsSep "," driDrivers))
+  ++ (optional (vulkanDrivers != [])
+      ("--with-vulkan-drivers=" +
+        builtins.concatStringsSep "," vulkanDrivers))
+  ++ [
     (enableFeature enableTextureFloats "texture-float")
     (enableFeature grsecEnabled "glx-rts")
     (enableFeature stdenv.isLinux "dri3")
@@ -146,7 +185,7 @@ stdenv.mkDerivation {
 
     # set the default search path for DRI drivers; used e.g. by X server
     substituteInPlace "$dev/lib/pkgconfig/dri.pc" --replace '$(drivers)' "${driverLink}"
-  '' + optionalString (!(stdenv.isArm || stdenv.isAarch64)) ''
+  '' + optionalString (builtins.elem "intel" vulkanDrivers) ''
     # move share/vulkan/icd.d/
     mv $out/share/ $drivers/
     # Update search path used by Vulkan (it's pointing to $out but
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index 2591a43f1d47..947c0e30f993 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -19,6 +19,7 @@ let
 
     patches =
       (args.patches or [])
+      ++ [ ./nix-ssl-cert-file.patch ]
       ++ optional (versionOlder version "1.1.0") ./use-etc-ssl-certs.patch
       ++ optional stdenv.isCygwin ./1.0.1-cygwin64.patch
       ++ optional
diff --git a/pkgs/development/libraries/openssl/nix-ssl-cert-file.patch b/pkgs/development/libraries/openssl/nix-ssl-cert-file.patch
new file mode 100644
index 000000000000..b615f1482b7c
--- /dev/null
+++ b/pkgs/development/libraries/openssl/nix-ssl-cert-file.patch
@@ -0,0 +1,14 @@
+diff -ru -x '*~' openssl-1.0.2j-orig/crypto/x509/by_file.c openssl-1.0.2j/crypto/x509/by_file.c
+--- openssl-1.0.2j-orig/crypto/x509/by_file.c	2016-09-26 11:49:07.000000000 +0200
++++ openssl-1.0.2j/crypto/x509/by_file.c	2016-10-13 16:54:31.400288302 +0200
+@@ -97,7 +97,9 @@
+     switch (cmd) {
+     case X509_L_FILE_LOAD:
+         if (argl == X509_FILETYPE_DEFAULT) {
+-            file = (char *)getenv(X509_get_default_cert_file_env());
++            file = (char *)getenv("NIX_SSL_CERT_FILE");
++            if (!file)
++                file = (char *)getenv(X509_get_default_cert_file_env());
+             if (file)
+                 ok = (X509_load_cert_crl_file(ctx, file,
+                                               X509_FILETYPE_PEM) != 0);
diff --git a/pkgs/development/python-modules/dbus/default.nix b/pkgs/development/python-modules/dbus/default.nix
index f3f897ac9e79..d2e1d2dc86fd 100644
--- a/pkgs/development/python-modules/dbus/default.nix
+++ b/pkgs/development/python-modules/dbus/default.nix
@@ -1,8 +1,9 @@
-{ lib, fetchurl, mkPythonDerivation, python, pkgconfig, dbus, dbus_glib, dbus_tools, isPyPy
+{ lib, fetchurl, buildPythonPackage, python, pkgconfig, dbus, dbus_glib, dbus_tools, isPyPy
 , ncurses, pygobject3 }:
 
-if isPyPy then throw "dbus-python not supported for interpreter ${python.executable}" else mkPythonDerivation rec {
+if isPyPy then throw "dbus-python not supported for interpreter ${python.executable}" else buildPythonPackage rec {
   name = "dbus-python-1.2.4";
+  format = "other";
 
   src = fetchurl {
     url = "http://dbus.freedesktop.org/releases/dbus-python/${name}.tar.gz";
diff --git a/pkgs/development/python-modules/koji/default.nix b/pkgs/development/python-modules/koji/default.nix
index 262ea74d4a34..28b5e11223ff 100644
--- a/pkgs/development/python-modules/koji/default.nix
+++ b/pkgs/development/python-modules/koji/default.nix
@@ -1,7 +1,8 @@
-{ stdenv, fetchurl, mkPythonDerivation, pycurl }:
+{ stdenv, fetchurl, buildPythonPackage, pycurl }:
 
-mkPythonDerivation rec {
+buildPythonPackage rec {
   name = "koji-1.8";
+  format = "other";
 
   src = fetchurl {
     url = "https://fedorahosted.org/released/koji/koji-1.8.0.tar.bz2";
diff --git a/pkgs/development/python-modules/libsexy/default.nix b/pkgs/development/python-modules/libsexy/default.nix
index fa79cfa3be5c..79eb8ab2f83c 100644
--- a/pkgs/development/python-modules/libsexy/default.nix
+++ b/pkgs/development/python-modules/libsexy/default.nix
@@ -1,8 +1,9 @@
-{ stdenv, fetchurl, mkPythonDerivation, libsexy, pkgconfig, libxml2, pygtk, pango, gtk2, glib }:
+{ stdenv, fetchurl, buildPythonPackage, libsexy, pkgconfig, libxml2, pygtk, pango, gtk2, glib }:
 
-mkPythonDerivation rec {
+buildPythonPackage rec {
   name = "libsexy-${version}";
   version = "0.1.9";
+  format = "other";
 
   src = fetchurl {
     url = "http://releases.chipx86.com/libsexy/sexy-python/sexy-python-${version}.tar.gz";
diff --git a/pkgs/development/python-modules/pycairo/default.nix b/pkgs/development/python-modules/pycairo/default.nix
index e7cf3b4c4489..5d002c096239 100644
--- a/pkgs/development/python-modules/pycairo/default.nix
+++ b/pkgs/development/python-modules/pycairo/default.nix
@@ -1,8 +1,9 @@
-{ lib, fetchurl, fetchpatch, python, mkPythonDerivation, pkgconfig, cairo, xlibsWrapper, isPyPy, isPy35, isPy3k }:
+{ lib, fetchurl, fetchpatch, python, buildPythonPackage, pkgconfig, cairo, xlibsWrapper, isPyPy, isPy35, isPy3k }:
 
-if (isPyPy) then throw "pycairo not supported for interpreter ${python.executable}" else mkPythonDerivation rec {
+if (isPyPy) then throw "pycairo not supported for interpreter ${python.executable}" else buildPythonPackage rec {
   version = "1.10.0";
   name = "pycairo-${version}";
+  format = "other";
   src = if isPy3k
     then fetchurl {
       url = "http://cairographics.org/releases/pycairo-${version}.tar.bz2";
diff --git a/pkgs/development/python-modules/pygobject/3.nix b/pkgs/development/python-modules/pygobject/3.nix
index 33bb1d5a4cab..984b11844342 100644
--- a/pkgs/development/python-modules/pygobject/3.nix
+++ b/pkgs/development/python-modules/pygobject/3.nix
@@ -1,9 +1,10 @@
-{ stdenv, fetchurl, mkPythonDerivation, python, pkgconfig, glib, gobjectIntrospection, pycairo, cairo, which, ncurses}:
+{ stdenv, fetchurl, buildPythonPackage, python, pkgconfig, glib, gobjectIntrospection, pycairo, cairo, which, ncurses}:
 
-mkPythonDerivation rec {
+buildPythonPackage rec {
   major = "3.22";
   minor = "0";
   name = "pygobject-${major}.${minor}";
+  format = "other";
 
   src = fetchurl {
     url = "mirror://gnome/sources/pygobject/${major}/${name}.tar.xz";
diff --git a/pkgs/development/python-modules/pygobject/default.nix b/pkgs/development/python-modules/pygobject/default.nix
index 6723ba6b6a58..b72bd8b9b529 100644
--- a/pkgs/development/python-modules/pygobject/default.nix
+++ b/pkgs/development/python-modules/pygobject/default.nix
@@ -1,8 +1,9 @@
-{ stdenv, fetchurl, python, mkPythonDerivation, pkgconfig, glib }:
+{ stdenv, fetchurl, python, buildPythonPackage, pkgconfig, glib }:
 
-mkPythonDerivation rec {
+buildPythonPackage rec {
   name = "pygobject-${version}";
   version = "2.28.6";
+  format = "other";
 
   src = fetchurl {
     url = "mirror://gnome/sources/pygobject/2.28/${name}.tar.xz";
diff --git a/pkgs/development/python-modules/pygtksourceview/default.nix b/pkgs/development/python-modules/pygtksourceview/default.nix
index 133cbdb34fd2..499634236acd 100644
--- a/pkgs/development/python-modules/pygtksourceview/default.nix
+++ b/pkgs/development/python-modules/pygtksourceview/default.nix
@@ -1,9 +1,10 @@
-{ lib, fetchurl, python, mkPythonDerivation, pkgconfig, pygobject2, glib, pygtk, gnome2 }:
+{ lib, fetchurl, python, buildPythonPackage, pkgconfig, pygobject2, glib, pygtk, gnome2 }:
 
 let version = "2.10.1"; in
 
-mkPythonDerivation {
+buildPythonPackage {
   name = "pygtksourceview-${version}";
+  format = "other";
 
   src = fetchurl {
     url = "http://ftp.gnome.org/pub/gnome/sources/pygtksourceview/2.10/pygtksourceview-${version}.tar.bz2";
diff --git a/pkgs/development/python-modules/pyqt/4.x.nix b/pkgs/development/python-modules/pyqt/4.x.nix
index 73835fedcd42..14bee0a57fdb 100644
--- a/pkgs/development/python-modules/pyqt/4.x.nix
+++ b/pkgs/development/python-modules/pyqt/4.x.nix
@@ -2,9 +2,10 @@
 
 let
   version = "4.11.3";
-  inherit (pythonPackages) mkPythonDerivation python dbus-python sip;
-in mkPythonDerivation {
+  inherit (pythonPackages) buildPythonPackage python dbus-python sip;
+in buildPythonPackage {
   name = "PyQt-x11-gpl-${version}";
+  format = "other";
 
   src = fetchurl {
     url = "mirror://sourceforge/pyqt/PyQt4/PyQt-${version}/PyQt-x11-gpl-${version}.tar.gz";
diff --git a/pkgs/development/python-modules/pyqt/5.x.nix b/pkgs/development/python-modules/pyqt/5.x.nix
index 84da1cf9ebf0..e72de1fa995b 100644
--- a/pkgs/development/python-modules/pyqt/5.x.nix
+++ b/pkgs/development/python-modules/pyqt/5.x.nix
@@ -3,9 +3,10 @@
 
 let
   version = "5.6";
-  inherit (pythonPackages) mkPythonDerivation python dbus-python sip;
-in mkPythonDerivation {
+  inherit (pythonPackages) buildPythonPackage python dbus-python sip;
+in buildPythonPackage {
   name = "PyQt-${version}";
+  format = "other";
 
   meta = with lib; {
     description = "Python bindings for Qt5";
diff --git a/pkgs/development/python-modules/pyside/default.nix b/pkgs/development/python-modules/pyside/default.nix
index 6473ebf22b13..4aff09b8f8f5 100644
--- a/pkgs/development/python-modules/pyside/default.nix
+++ b/pkgs/development/python-modules/pyside/default.nix
@@ -1,8 +1,9 @@
-{ lib, fetchurl, cmake, python, mkPythonDerivation, pysideGeneratorrunner, pysideShiboken, qt4 }:
+{ lib, fetchurl, cmake, python, buildPythonPackage, pysideGeneratorrunner, pysideShiboken, qt4 }:
 
-mkPythonDerivation rec {
+buildPythonPackage rec {
   name = "pyside-${version}";
   version = "1.2.4";
+  format = "other";
 
   src = fetchurl {
     url = "https://github.com/PySide/PySide/archive/${version}.tar.gz";
diff --git a/pkgs/development/python-modules/pyxml/default.nix b/pkgs/development/python-modules/pyxml/default.nix
index abea143d11da..b85b20423697 100644
--- a/pkgs/development/python-modules/pyxml/default.nix
+++ b/pkgs/development/python-modules/pyxml/default.nix
@@ -1,7 +1,8 @@
-{lib, fetchurl, python, mkPythonDerivation, makeWrapper}:
+{lib, fetchurl, python, buildPythonPackage, makeWrapper}:
 
-mkPythonDerivation rec {
+buildPythonPackage rec {
   name = "PyXML-0.8.4";
+  format = "other";
   src = fetchurl {
     url = "mirror://sourceforge/pyxml/${name}.tar.gz";
     sha256 = "04wc8i7cdkibhrldy6j65qp5l75zjxf5lx6qxdxfdf2gb3wndawz";
diff --git a/pkgs/development/python-modules/sip/default.nix b/pkgs/development/python-modules/sip/default.nix
index e44f92ab013d..b39089a529f0 100644
--- a/pkgs/development/python-modules/sip/default.nix
+++ b/pkgs/development/python-modules/sip/default.nix
@@ -1,7 +1,8 @@
-{ lib, fetchurl, mkPythonDerivation, python, isPyPy }:
+{ lib, fetchurl, buildPythonPackage, python, isPyPy }:
 
-if isPyPy then throw "sip not supported for interpreter ${python.executable}" else mkPythonDerivation rec {
+if isPyPy then throw "sip not supported for interpreter ${python.executable}" else buildPythonPackage rec {
   name = "sip-4.18.1";
+  format = "other";
 
   src = fetchurl {
     url = "mirror://sourceforge/pyqt/sip/${name}/${name}.tar.gz";
diff --git a/pkgs/development/tools/documentation/gnome-doc-utils/default.nix b/pkgs/development/tools/documentation/gnome-doc-utils/default.nix
index 18933426db0a..ef339d47ea05 100644
--- a/pkgs/development/tools/documentation/gnome-doc-utils/default.nix
+++ b/pkgs/development/tools/documentation/gnome-doc-utils/default.nix
@@ -1,8 +1,9 @@
 {stdenv, fetchurl, pkgconfig, libxml2Python, libxslt, intltool
 , makeWrapper, python2Packages }:
 
-python2Packages.mkPythonDerivation {
+python2Packages.buildPythonApplication {
   name = "gnome-doc-utils-0.20.10";
+  format = "other";
 
   src = fetchurl {
     url = mirror://gnome/sources/gnome-doc-utils/0.20/gnome-doc-utils-0.20.10.tar.xz;
diff --git a/pkgs/development/tools/misc/d-feet/default.nix b/pkgs/development/tools/misc/d-feet/default.nix
index 2ada782563e5..4fec00a2fd7e 100644
--- a/pkgs/development/tools/misc/d-feet/default.nix
+++ b/pkgs/development/tools/misc/d-feet/default.nix
@@ -4,9 +4,9 @@
 let
   version = "${major}.11";
   major = "0.3";
-in pythonPackages.mkPythonDerivation rec {
+in pythonPackages.buildPythonApplication rec {
   name = "d-feet-${version}";
-  namePrefix = "";
+  format = "other";
 
   src = fetchurl {
     url = "mirror://gnome/sources/d-feet/${major}/d-feet-${version}.tar.xz";
diff --git a/pkgs/misc/drivers/hplip/default.nix b/pkgs/misc/drivers/hplip/default.nix
index c0a6c0a9baa0..1c40493e4ae9 100644
--- a/pkgs/misc/drivers/hplip/default.nix
+++ b/pkgs/misc/drivers/hplip/default.nix
@@ -47,8 +47,9 @@ in
 assert withPlugin -> builtins.elem hplipArch pluginArches
   || throw "HPLIP plugin not supported on ${stdenv.system}";
 
-pythonPackages.mkPythonDerivation {
+pythonPackages.buildPythonApplication {
   inherit name src;
+  format = "other";
 
   buildInputs = [
     libjpeg
diff --git a/pkgs/os-specific/linux/dstat/default.nix b/pkgs/os-specific/linux/dstat/default.nix
index ccedc381504f..366cc9787f28 100644
--- a/pkgs/os-specific/linux/dstat/default.nix
+++ b/pkgs/os-specific/linux/dstat/default.nix
@@ -1,7 +1,8 @@
 { stdenv, fetchurl, python2Packages }:
 
-python2Packages.mkPythonDerivation rec {
+python2Packages.buildPythonApplication rec {
   name = "dstat-${version}";
+  format = "other";
   version = "0.7.3";
 
   src = fetchurl {
diff --git a/pkgs/os-specific/linux/kmod-blacklist-ubuntu/default.nix b/pkgs/os-specific/linux/kmod-blacklist-ubuntu/default.nix
index ca1131146932..8154e37e3d5e 100644
--- a/pkgs/os-specific/linux/kmod-blacklist-ubuntu/default.nix
+++ b/pkgs/os-specific/linux/kmod-blacklist-ubuntu/default.nix
@@ -1,13 +1,14 @@
 { stdenv, fetchurl, gnugrep, findutils }:
+
 let
-  version = "3ubuntu1"; # Saucy
-in
-stdenv.mkDerivation {
+  version = "22-1.1ubuntu1"; # Zesty
+
+in stdenv.mkDerivation {
   name = "kmod-blacklist-${version}";
 
   src = fetchurl {
-    url = "https://launchpad.net/ubuntu/+archive/primary/+files/kmod_9-${version}.debian.tar.gz";
-    sha256 = "0h6h0zw2490iqj9xa2sz4309jyfmcc50jdvkhxa1nw90npxglp67";
+    url = "https://launchpad.net/ubuntu/+archive/primary/+files/kmod_${version}.debian.tar.xz";
+    sha256 = "1k749g707ccb82l4xmrkp53khl71f57cpj9fzd1qyzrz147fjyhi";
   };
 
   installPhase = ''
@@ -25,9 +26,9 @@ stdenv.mkDerivation {
       --replace " xargs " " ${findutils}/bin/xargs "
   '';
 
-  meta = {
-    homepage = http://packages.ubuntu.com/source/saucy/kmod;
+  meta = with stdenv.lib; {
+    homepage = http://packages.ubuntu.com/source/zesty/kmod;
     description = "Linux kernel module blacklists from Ubuntu";
-    platforms = stdenv.lib.platforms.linux;
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/kmod/default.nix b/pkgs/os-specific/linux/kmod/default.nix
index 322df73e404f..138130fa82e4 100644
--- a/pkgs/os-specific/linux/kmod/default.nix
+++ b/pkgs/os-specific/linux/kmod/default.nix
@@ -6,11 +6,11 @@ let
 
 in stdenv.mkDerivation rec {
   name = "kmod-${version}";
-  version = "23";
+  version = "24";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/kernel/kmod/${name}.tar.xz";
-    sha256 = "0mc12sx06p8il1ym3hdmgxxb37apn9yv7xij26gddjdfkx8xa0yk";
+    sha256 = "15xkkkzvca9flvkm48gkh8y8f13vlm3sl7nz9ydc7b3jy4fqs2v1";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig libxslt ];
diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index e9b438a6037b..f2f24bc10c53 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     sha256 = "1s1hyndva0yp62xy96pcp4anzrvw6cl0abjajim17sbmdp00fwhw";
   };
 
-  patches = [ ];
+  patches = [ ./nix-ssl-cert-file.patch ];
 
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
 
diff --git a/pkgs/tools/networking/curl/nix-ssl-cert-file.patch b/pkgs/tools/networking/curl/nix-ssl-cert-file.patch
new file mode 100644
index 000000000000..20c408bfae23
--- /dev/null
+++ b/pkgs/tools/networking/curl/nix-ssl-cert-file.patch
@@ -0,0 +1,14 @@
+diff -ru -x '*~' curl-7.50.3-orig/src/tool_operate.c curl-7.50.3/src/tool_operate.c
+--- curl-7.50.3-orig/src/tool_operate.c	2016-09-06 23:25:06.000000000 +0200
++++ curl-7.50.3/src/tool_operate.c	2016-10-14 11:51:48.999943142 +0200
+@@ -269,7 +269,9 @@
+         capath_from_env = true;
+       }
+       else {
+-        env = curlx_getenv("SSL_CERT_FILE");
++        env = curlx_getenv("NIX_SSL_CERT_FILE");
++        if(!env)
++          env = curlx_getenv("SSL_CERT_FILE");
+         if(env) {
+           config->cacert = strdup(env);
+           if(!config->cacert) {
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 508e1e0cbfff..393d27307cbc 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -7017,9 +7017,10 @@ in {
     buildInputs = with self; [ fudge_9 nose ];
   };
 
-  fedora_cert = mkPythonDerivation rec {
+  fedora_cert = buildPythonPackage rec {
     name = "fedora-cert-0.5.9.2";
     meta.maintainers = with maintainers; [ mornfall ];
+    format = "other";
 
     src = pkgs.fetchurl {
       url = "https://fedorahosted.org/releases/f/e/fedora-packager/fedora-packager-0.5.9.2.tar.bz2";
@@ -21738,8 +21739,9 @@ in {
   };
 
 
-  pysvn = mkPythonDerivation rec {
+  pysvn = buildPythonPackage rec {
     name = "pysvn-1.8.0";
+    format = "other";
 
     src = pkgs.fetchurl {
       url = "http://pysvn.barrys-emacs.org/source_kits/${name}.tar.gz";
@@ -21894,9 +21896,10 @@ in {
   });
 
 
-  pywebkitgtk = mkPythonDerivation rec {
+  pywebkitgtk = buildPythonPackage rec {
     name = "pywebkitgtk-${version}";
     version = "1.1.8";
+    format = "other";
 
     src = pkgs.fetchurl {
       url = "http://pywebkitgtk.googlecode.com/files/${name}.tar.bz2";
@@ -22229,10 +22232,11 @@ in {
 
   qscintilla = if isPy3k || isPyPy
     then throw "qscintilla-${pkgs.qscintilla.version} not supported for interpreter ${python.executable}"
-    else mkPythonDerivation rec {
+    else buildPythonPackage rec {
       # TODO: Qt5 support
       name = "qscintilla-${version}";
       version = pkgs.qscintilla.version;
+      format = "other";
 
       src = pkgs.qscintilla.src;
 
@@ -25768,9 +25772,10 @@ in {
   # Python package.
   tkinter = let
     py = python.override{x11Support=true;};
-  in mkPythonDerivation rec {
+  in buildPythonPackage rec {
     name = "tkinter-${python.version}";
     src = py;
+    format = "other";
 
     disabled = isPy26 || isPyPy;