diff --git a/lib/customisation.nix b/lib/customisation.nix
index 960eebfc79b..91a25055df2 100644
--- a/lib/customisation.nix
+++ b/lib/customisation.nix
@@ -29,8 +29,8 @@ rec {
 
      For another application, see build-support/vm, where this
      function is used to build arbitrary derivations inside a QEMU
-     virtual machine. */
-     
+     virtual machine.
+  */
   overrideDerivation = drv: f:
     let
       newDrv = derivation (drv.drvAttrs // (f drv));
@@ -56,18 +56,17 @@ rec {
   makeOverridable = f: origArgs:
     let
       ff = f origArgs;
+      overrideWith = newArgs: origArgs // (if builtins.isFunction newArgs then newArgs origArgs else newArgs);
     in
       if builtins.isAttrs ff then (ff //
-        { override = newArgs:
-            makeOverridable f (origArgs // (if builtins.isFunction newArgs then newArgs origArgs else newArgs));
+        { override = newArgs: makeOverridable f (overrideWith newArgs);
           deepOverride = newArgs:
             makeOverridable f (lib.overrideExisting (lib.mapAttrs (deepOverrider newArgs) origArgs) newArgs);
           overrideDerivation = fdrv:
             makeOverridable (args: overrideDerivation (f args) fdrv) origArgs;
         })
       else if builtins.isFunction ff then
-        { override = newArgs:
-            makeOverridable f (origArgs // (if builtins.isFunction newArgs then newArgs origArgs else newArgs));
+        { override = newArgs: makeOverridable f (overrideWith newArgs);
           __functor = self: ff;
           deepOverride = throw "deepOverride not yet supported for functors";
           overrideDerivation = throw "overrideDerivation not yet supported for functors";
@@ -102,8 +101,10 @@ rec {
       };
   */
   callPackageWith = autoArgs: fn: args:
-    let f = if builtins.isFunction fn then fn else import fn; in
-    makeOverridable f ((builtins.intersectAttrs (builtins.functionArgs f) autoArgs) // args);
+    let
+      f    = if builtins.isFunction fn then fn else import fn;
+      auto = builtins.intersectAttrs (builtins.functionArgs f) autoArgs;
+    in makeOverridable f (auto // args);
 
 
   /* Add attributes to each output of a derivation without changing the derivation itself */
diff --git a/lib/debug.nix b/lib/debug.nix
index 8852c22981c..2d10d981114 100644
--- a/lib/debug.nix
+++ b/lib/debug.nix
@@ -13,10 +13,11 @@ rec {
 
   addErrorContextToAttrs = lib.mapAttrs (a: v: lib.addErrorContext "while evaluating ${a}" v);
 
+  traceIf = p: msg: x: if p then trace msg x else x;
 
-  traceVal = x: builtins.trace x x;
-  traceXMLVal = x: builtins.trace (builtins.toXML x) x;
-  traceXMLValMarked = str: x: builtins.trace (str + builtins.toXML x) x;
+  traceVal = x: trace x x;
+  traceXMLVal = x: trace (builtins.toXML x) x;
+  traceXMLValMarked = str: x: trace (str + builtins.toXML x) x;
 
   # this can help debug your code as well - designed to not produce thousands of lines
   traceShowVal = x : trace (showVal x) x;
@@ -42,6 +43,7 @@ rec {
   traceCall2 = n : f : a : b : let t = n2 : x : traceShowValMarked "${n} ${n2}:" x; in t "result" (f (t "arg 1" a) (t "arg 2" b));
   traceCall3 = n : f : a : b : c : let t = n2 : x : traceShowValMarked "${n} ${n2}:" x; in t "result" (f (t "arg 1" a) (t "arg 2" b) (t "arg 3" c));
 
+  # FIXME: rename this?
   traceValIfNot = c: x:
     if c x then true else trace (showVal x) false;
 
@@ -106,6 +108,6 @@ rec {
             )
           else
             let r = strict expr;
-            in builtins.trace "${str}\n result:\n${builtins.toXML r}" r
+            in trace "${str}\n result:\n${builtins.toXML r}" r
       );
 }
diff --git a/nixos/modules/services/hardware/udev.nix b/nixos/modules/services/hardware/udev.nix
index 39180f4d37e..a775aed0fda 100644
--- a/nixos/modules/services/hardware/udev.nix
+++ b/nixos/modules/services/hardware/udev.nix
@@ -28,6 +28,7 @@ let
   # Perform substitutions in all udev rules files.
   udevRules = stdenv.mkDerivation {
     name = "udev-rules";
+    preferLocalBuild = true;
     buildCommand = ''
       mkdir -p $out
       shopt -s nullglob
diff --git a/nixos/modules/services/networking/ssh/sshd.nix b/nixos/modules/services/networking/ssh/sshd.nix
index b11f996c63c..b2740bd33b7 100644
--- a/nixos/modules/services/networking/ssh/sshd.nix
+++ b/nixos/modules/services/networking/ssh/sshd.nix
@@ -9,12 +9,6 @@ let
 
   nssModulesPath = config.system.nssModules.path;
 
-  permitRootLoginCheck = v:
-    v == "yes" ||
-    v == "without-password" ||
-    v == "forced-commands-only" ||
-    v == "no";
-
   knownHosts = map (h: getAttr h cfg.knownHosts) (attrNames cfg.knownHosts);
 
   knownHostsText = flip (concatMapStringsSep "\n") knownHosts
@@ -116,12 +110,9 @@ in
 
       permitRootLogin = mkOption {
         default = "without-password";
-        type = types.addCheck types.str permitRootLoginCheck;
+        type = types.enum ["yes" "without-password" "forced-commands-only" "no"];
         description = ''
-          Whether the root user can login using ssh. Valid values are
-          <literal>yes</literal>, <literal>without-password</literal>,
-          <literal>forced-commands-only</literal> or
-          <literal>no</literal>.
+          Whether the root user can login using ssh.
         '';
       };
 
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index f2d51082811..c38636ffac3 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -1,3 +1,21 @@
+/*
+
+  WARNING/NOTE: whenever you want to add an option here you need to
+  either
+
+  * mark it as an optional one with `?` suffix,
+  * or make sure it works for all the versions in nixpkgs,
+  * or check for which kernel versions it will work (using kernel
+    changelog, google or whatever) and mark it with `versionOlder` or
+    `versionAtLeast`.
+
+  Then do test your change by building all the kernels (or at least
+  their configs) in nixpkgs or else you will guarantee lots and lots
+  of pain to users trying to switch to an older kernel because of some
+  hardware problems with a new one.
+
+*/
+
 { stdenv, version, kernelPlatform, extraConfig, features }:
 
 with stdenv.lib;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 3e7ef6a4798..6331aa8cadd 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4262,7 +4262,7 @@ let
   };
   opam = callPackage ../development/tools/ocaml/opam { };
 
-  ocamlnat = let callPackage = newScope pkgs.ocamlPackages_3_12_1; in callPackage ../development/ocaml-modules/ocamlnat { };
+  ocamlnat = newScope pkgs.ocamlPackages_3_12_1 ../development/ocaml-modules/ocamlnat { };
 
   qcmm = callPackage ../development/compilers/qcmm {
     lua   = lua4;
@@ -8699,16 +8699,7 @@ let
 
   cifs_utils = callPackage ../os-specific/linux/cifs-utils { };
 
-  conky = callPackage ../os-specific/linux/conky {
-    mpdSupport   = config.conky.mpdSupport   or true;
-    x11Support   = config.conky.x11Support   or false;
-    xdamage      = config.conky.xdamage      or false;
-    wireless     = config.conky.wireless     or false;
-    luaSupport   = config.conky.luaSupport   or false;
-    rss          = config.conky.rss          or false;
-    weatherMetar = config.conky.weatherMetar or false;
-    weatherXoap  = config.conky.weatherXoap  or false;
-  };
+  conky = callPackage ../os-specific/linux/conky (config.conky or {});
 
   conntrack_tools = callPackage ../os-specific/linux/conntrack-tools { };
 
@@ -10423,9 +10414,7 @@ let
 
   fbreader = callPackage ../applications/misc/fbreader { };
 
-  fetchmail = import ../applications/misc/fetchmail {
-    inherit stdenv fetchurl openssl;
-  };
+  fetchmail = callPackage ../applications/misc/fetchmail { };
 
   fldigi = callPackage ../applications/audio/fldigi { };