Merge branch 'master' into staging

Hydra: ?compare=1401528

31 files changed, 345 insertions, 89 deletions

diff --git a/pkgs/tools/admin/awslogs/default.nix b/pkgs/tools/admin/awslogs/default.nix
index dffef09a5d4a..ec7febaa5985 100644
--- a/pkgs/tools/admin/awslogs/default.nix
+++ b/pkgs/tools/admin/awslogs/default.nix
@@ -2,13 +2,13 @@
 
 pythonPackages.buildPythonApplication rec {
   name = "awslogs-${version}";
-  version = "0.7";
+  version = "0.10";
 
   src = fetchFromGitHub {
     owner = "jorgebastida";
     repo = "awslogs";
     rev = "${version}";
-    sha256 = "0dqf26h595l1fcnagxi8zsdarsxg3smsihxaqrvnki8fshhfdqsm";
+    sha256 = "18s3xxdhhbz96mgj9ipgyrdcax3p9gy8gpmr0rblw8g0grj31dsp";
   };
 
   doCheck = false;
diff --git a/pkgs/tools/admin/intecture/agent.nix b/pkgs/tools/admin/intecture/agent.nix
index 27891614f4b2..4024ab9b91f2 100644
--- a/pkgs/tools/admin/intecture/agent.nix
+++ b/pkgs/tools/admin/intecture/agent.nix
@@ -5,16 +5,16 @@ with rustPlatform;
 
 buildRustPackage rec {
   name = "intecture-agent-${version}";
-  version = "0.3.0";
+  version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "intecture";
     repo = "agent";
     rev = version;
-    sha256 = "0b59ij9c7hv2p4jx96f3acbygw27wiv8cfzzg6sg73l6k244k6l6";
+    sha256 = "0j27qdgyxybaixggh7k57mpm6rifimn4z2vydk463msc8b3kgywj";
   };
 
-  depsSha256 = "1f94j54pg94f2x2lmmyj8dlki8plq6vnppmf3hzk3kd0rp7fzban";
+  depsSha256 = "1n57i9wkak76ram748mwq0dn32d041ajd31laqc13c76pp29agrp";
 
   buildInputs = [ openssl zeromq czmq zlib ];
 
diff --git a/pkgs/tools/admin/intecture/auth.nix b/pkgs/tools/admin/intecture/auth.nix
index 88ef137d841c..c4678c8d4b77 100644
--- a/pkgs/tools/admin/intecture/auth.nix
+++ b/pkgs/tools/admin/intecture/auth.nix
@@ -5,16 +5,16 @@ with rustPlatform;
 
 buildRustPackage rec {
   name = "intecture-auth-${version}";
-  version = "0.1.0";
+  version = "0.1.2";
 
   src = fetchFromGitHub {
     owner = "intecture";
     repo = "auth";
     rev = version;
-    sha256 = "1p3jahha8k139f22ijg050cl8akfzxda4gzvijpqv869hmhc70py";
+    sha256 = "0c7ar3pc7n59lzfy74lwz51p09s2bglc870rfr4c0vmc91jl0pj2";
   };
 
-  depsSha256 = "0mki57yzb29y9fhh16xvpi5gfp6c14r5q3f45f3v8sdj95rjahz1";
+  depsSha256 = "0wzr8hk63gh3nm8f7dbzwj8pgc3cm8p8mr2q7bbgvri1a5i83sfb";
 
   buildInputs = [ openssl zeromq czmq zlib ];
 
diff --git a/pkgs/tools/admin/intecture/cli.nix b/pkgs/tools/admin/intecture/cli.nix
index 0f530f636d78..e98b62bd0ea7 100644
--- a/pkgs/tools/admin/intecture/cli.nix
+++ b/pkgs/tools/admin/intecture/cli.nix
@@ -5,16 +5,16 @@ with rustPlatform;
 
 buildRustPackage rec {
   name = "intecture-cli-${version}";
-  version = "0.3.2";
+  version = "0.3.4";
 
   src = fetchFromGitHub {
     owner = "intecture";
     repo = "cli";
     rev = version;
-    sha256 = "0f5pyrlkxzz4kdfzwambxzqr48g3n06f1pv163h06ggssqa51wbc";
+    sha256 = "16a5fkpyqkf8w20k3ircc1d0qmif7nygkzxj6mzk9609dlb0dmxq";
   };
 
-  depsSha256 = "0f3rhjs5addppva4cjx3ngpa5gz2i2n46hyc3zd4l7lhh8gaggix";
+  depsSha256 = "0nax7h7f5qgalgxsfidrxrv1ybl5xvrpc1k7xc1kmaf955gqmc46";
 
   buildInputs = [ openssl zeromq czmq zlib ];
 
diff --git a/pkgs/tools/admin/salt/default.nix b/pkgs/tools/admin/salt/default.nix
index 5afe14209f64..b50564602256 100644
--- a/pkgs/tools/admin/salt/default.nix
+++ b/pkgs/tools/admin/salt/default.nix
@@ -8,12 +8,12 @@
 
 python2Packages.buildPythonApplication rec {
   pname = "salt";
-  version = "2017.7.1";
+  version = "2017.7.2";
   name = "${pname}-${version}";
 
   src = python2Packages.fetchPypi {
     inherit pname version;
-    sha256 = "079kymgxyzhf47dd42l7f42jp45gx5im4k3g31bj25p1s0aq91py";
+    sha256 = "0h18zwp1w90rgxpmqgrmn9wp31h03f0vak8lpnnbh0dzbbgcffzz";
   };
 
   propagatedBuildInputs = with python2Packages; [
diff --git a/pkgs/tools/archivers/unrar/default.nix b/pkgs/tools/archivers/unrar/default.nix
index 563b21c76d8d..9aedda83fd2c 100644
--- a/pkgs/tools/archivers/unrar/default.nix
+++ b/pkgs/tools/archivers/unrar/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "unrar-${version}";
-  version = "5.5.7";
+  version = "5.5.8";
 
   src = fetchurl {
-    url = "http://www.rarlab.com/rar/unrarsrc-${version}.tar.gz";
-    sha256 = "13rd69ss6jqsa6yxr8kmgs84kb67k822d2mbiz29m75zj46hmvwa";
+    url = "https://www.rarlab.com/rar/unrarsrc-${version}.tar.gz";
+    sha256 = "1x7wnb6zgs09v2bf5xaqz14daba8k7zikadj1qabqi4r78sy8rlv";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/backup/borg/default.nix b/pkgs/tools/backup/borg/default.nix
index 19495b6e1df6..4ff61d1ac954 100644
--- a/pkgs/tools/backup/borg/default.nix
+++ b/pkgs/tools/backup/borg/default.nix
@@ -2,18 +2,18 @@
 
 python3Packages.buildPythonApplication rec {
   name = "borgbackup-${version}";
-  version = "1.0.11";
+  version = "1.1.0";
   namePrefix = "";
 
   src = fetchurl {
     url = "https://github.com/borgbackup/borg/releases/download/"
       + "${version}/${name}.tar.gz";
-    sha256 = "14fjk5dfwmjkn7nmkbhhbrk3g1wfrn8arvqd5r9jaij534nzsvpw";
+    sha256 = "0vwyg0b4kxb0rspqwhvgi5c78dzimgkydf03wif27a40qhh1235l";
   };
 
   nativeBuildInputs = with python3Packages; [
     # For building documentation:
-    sphinx sphinx_rtd_theme
+    sphinx guzzle_sphinx_theme
   ];
   buildInputs = [
     acl lz4 openssl python3Packages.setuptools_scm
diff --git a/pkgs/tools/filesystems/cryfs/default.nix b/pkgs/tools/filesystems/cryfs/default.nix
new file mode 100644
index 000000000000..0469ad54eb13
--- /dev/null
+++ b/pkgs/tools/filesystems/cryfs/default.nix
@@ -0,0 +1,79 @@
+{ stdenv, fetchFromGitHub
+, cmake, pkgconfig, coreutils
+, boost, cryptopp, curl, fuse, openssl, python, spdlog
+}:
+
+stdenv.mkDerivation rec {
+  name = "cryfs-${version}";
+  version = "0.9.7";
+
+  src = fetchFromGitHub {
+    owner  = "cryfs";
+    repo   = "cryfs";
+    rev    = "${version}";
+    sha256 = "1wsv4cyjkyg3cyr6vipw1mj41bln2m69123l3miav8r4mvmkfq8w";
+  };
+
+  prePatch = ''
+    patchShebangs src
+
+    substituteInPlace vendor/scrypt/CMakeLists.txt \
+      --replace /usr/bin/ ""
+
+    # scrypt in nixpkgs only produces a binary so we lift the patching from that so allow
+    # building the vendored version. This is very much NOT DRY.
+    # The proper solution is to have scrypt generate a dev output with the required files and just symlink
+    # into vendor/scrypt
+    for f in Makefile.in autocrap/Makefile.am libcperciva/cpusupport/Build/cpusupport.sh ; do
+      substituteInPlace vendor/scrypt/scrypt-*/scrypt/$f --replace "command -p " ""
+    done
+
+    # cryfs is vendoring an old version of spdlog
+    rm -rf vendor/spdlog/spdlog
+    ln -s ${spdlog} vendor/spdlog/spdlog
+  '';
+
+  buildInputs = [ boost cryptopp curl fuse openssl python spdlog ];
+
+  patches = [
+    ./test-no-network.patch  # Disable tests using external networking
+    ./skip-failing-test-large-malloc.patch
+  ];
+
+  # coreutils is needed for the vendored scrypt
+  nativeBuildInputs = [ cmake coreutils pkgconfig ];
+
+  enableParallelBuilding = true;
+
+  cmakeFlags = [
+    "-DCRYFS_UPDATE_CHECKS=OFF"
+    "-DBoost_USE_STATIC_LIBS=OFF" # this option is case sensitive
+    "-DBUILD_TESTING=ON"
+  ];
+
+  doCheck = true;
+
+  # Cryfs tests are broken on darwin
+  checkPhase = stdenv.lib.optionalString (!stdenv.isDarwin) ''
+    # Skip CMakeFiles directory and tests depending on fuse (does not work well with sandboxing)
+    SKIP_IMPURE_TESTS="CMakeFiles|fspp|cryfs-cli"
+
+    for test in `ls -d test/*/ | egrep -v "$SKIP_IMPURE_TESTS"`; do
+      "./$test`basename $test`-test"
+    done
+  '';
+
+  installPhase = ''
+    # Building with BUILD_TESTING=ON is missing the install target
+    mkdir -p $out/bin
+    install -m 755 ./src/cryfs-cli/cryfs $out/bin/cryfs
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Cryptographic filesystem for the cloud";
+    homepage    = https://www.cryfs.org;
+    license     = licenses.lgpl3;
+    maintainers = with maintainers; [ peterhoeg ];
+    platforms   = with platforms; linux;
+  };
+}
diff --git a/pkgs/tools/filesystems/cryfs/skip-failing-test-large-malloc.patch b/pkgs/tools/filesystems/cryfs/skip-failing-test-large-malloc.patch
new file mode 100644
index 000000000000..feb0ed9cfbb9
--- /dev/null
+++ b/pkgs/tools/filesystems/cryfs/skip-failing-test-large-malloc.patch
@@ -0,0 +1,34 @@
+From ad3f7e9fa2dececfaab43963887a2f03de52d659 Mon Sep 17 00:00:00 2001
+From: adisbladis <adis@blad.is>
+Date: Thu, 12 Oct 2017 21:45:26 +0800
+Subject: [PATCH] Skip failing test: large malloc
+
+---
+ test/cpp-utils/data/DataTest.cpp | 11 -----------
+ 1 file changed, 11 deletions(-)
+
+diff --git a/test/cpp-utils/data/DataTest.cpp b/test/cpp-utils/data/DataTest.cpp
+index 6f9df070..bd426e62 100644
+--- a/test/cpp-utils/data/DataTest.cpp
++++ b/test/cpp-utils/data/DataTest.cpp
+@@ -191,17 +191,6 @@ TEST_F(DataTest, Inequality_DifferentLastByte) {
+   EXPECT_TRUE(data1 != data2);
+ }
+ 
+-#ifdef __x86_64__
+-TEST_F(DataTest, LargesizeSize) {
+-  //Needs 64bit for representation. This value isn't in the size param list, because the list is also used for read/write checks.
+-  uint64_t size = 4.5L*1024*1024*1024;
+-  Data data(size);
+-  EXPECT_EQ(size, data.size());
+-}
+-#else
+-#warning This is not a 64bit architecture. Large size data tests are disabled.
+-#endif
+-
+ TEST_F(DataTest, LoadingNonexistingFile) {
+   TempFile file(false); // Pass false to constructor, so the tempfile is not created
+   EXPECT_FALSE(Data::LoadFromFile(file.path()));
+-- 
+2.14.2
+
diff --git a/pkgs/tools/filesystems/cryfs/test-no-network.patch b/pkgs/tools/filesystems/cryfs/test-no-network.patch
new file mode 100644
index 000000000000..3392d3f855ec
--- /dev/null
+++ b/pkgs/tools/filesystems/cryfs/test-no-network.patch
@@ -0,0 +1,24 @@
+From 8b1808e1278d2cb0dc56a4e98781eceeadfb9718 Mon Sep 17 00:00:00 2001
+From: adisbladis <adis@blad.is>
+Date: Thu, 12 Oct 2017 18:13:28 +0800
+Subject: [PATCH] Disable tests using external networking
+
+---
+ test/cpp-utils/CMakeLists.txt | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/test/cpp-utils/CMakeLists.txt b/test/cpp-utils/CMakeLists.txt
+index 5a2bc9f8..d838edba 100644
+--- a/test/cpp-utils/CMakeLists.txt
++++ b/test/cpp-utils/CMakeLists.txt
+@@ -20,7 +20,6 @@ set(SOURCES
+     tempfile/TempFileIncludeTest.cpp
+     tempfile/TempDirIncludeTest.cpp
+     tempfile/TempDirTest.cpp
+-    network/CurlHttpClientTest.cpp
+     network/FakeHttpClientTest.cpp
+     io/ConsoleIncludeTest.cpp
+     io/ConsoleTest_AskYesNo.cpp
+-- 
+2.14.2
+
diff --git a/pkgs/tools/filesystems/f2fs-tools/default.nix b/pkgs/tools/filesystems/f2fs-tools/default.nix
index fdad877d34cf..53b17f45f9f4 100644
--- a/pkgs/tools/filesystems/f2fs-tools/default.nix
+++ b/pkgs/tools/filesystems/f2fs-tools/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   name = "f2fs-tools-${version}";
-  version = "1.8.0";
+  version = "1.9.0";
 
   src = fetchgit {
     url = "git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs-tools.git";
     rev = "refs/tags/v${version}";
-    sha256 = "0mbpg6mng6jcm5vxq0ivhklgpkwvjbhjwgkhzxr50ln46h5kbd2f";
+    sha256 = "0aj9dbhv7vv19pyb2rhcg99v5v0s66sb9yzrdmi46bmvzz124pal";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
diff --git a/pkgs/tools/filesystems/irods/common.nix b/pkgs/tools/filesystems/irods/common.nix
index 9c5412ddef7c..c7267aca1071 100644
--- a/pkgs/tools/filesystems/irods/common.nix
+++ b/pkgs/tools/filesystems/irods/common.nix
@@ -9,8 +9,6 @@ with stdenv;
 
   buildInputs = [ bzip2 zlib autoconf automake cmake gnumake help2man texinfo libtool cppzmq libarchive avro-cpp jansson zeromq openssl pam libiodbc kerberos gcc boost libcxx which ];
 
-  propagateBuildInputs = [ boost ];
-
   cmakeFlags = [
     "-DIRODS_EXTERNALS_FULLPATH_CLANG=${stdenv.cc}"
     "-DIRODS_EXTERNALS_FULLPATH_CLANG_RUNTIME=${stdenv.cc}"
diff --git a/pkgs/tools/filesystems/irods/default.nix b/pkgs/tools/filesystems/irods/default.nix
index 0714f2901046..523028f5fb2e 100644
--- a/pkgs/tools/filesystems/irods/default.nix
+++ b/pkgs/tools/filesystems/irods/default.nix
@@ -62,8 +62,6 @@ in rec {
 
      buildInputs = common.buildInputs ++ [ irods ];
 
-     propagateBuildInputs = [ boost ];
-
      preConfigure = common.preConfigure + ''
        patchShebangs ./bin
      '';
diff --git a/pkgs/tools/graphics/quirc/default.nix b/pkgs/tools/graphics/quirc/default.nix
index caff97f0e32a..9891ea5e52b0 100644
--- a/pkgs/tools/graphics/quirc/default.nix
+++ b/pkgs/tools/graphics/quirc/default.nix
@@ -10,14 +10,13 @@ let
     rev = "5b262480091d5f84a67a4a56c728fc8b39844339";
     sha256 = "1w5qvjafn14s6jjs7kiwsqirlsqbgv0p152hrsq463pm34hp0lzy";
   };
+in
+stdenv.mkDerivation {
+  inherit (s) name version;
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
     SDL SDL_gfx libjpeg libpng
   ];
-in
-stdenv.mkDerivation {
-  inherit (s) name version;
-  inherit buildInputs;
   src = fetchgit {
     inherit (s) url sha256 rev;
   };
diff --git a/pkgs/tools/inputmethods/ibus-engines/ibus-table/default.nix b/pkgs/tools/inputmethods/ibus-engines/ibus-table/default.nix
index 8c842dbc841e..8c552799432b 100644
--- a/pkgs/tools/inputmethods/ibus-engines/ibus-table/default.nix
+++ b/pkgs/tools/inputmethods/ibus-engines/ibus-table/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
   '';
 
   buildInputs = [
-    dconf gtk3 gobjectIntrospection ibus python3
+    dconf gtk3 gobjectIntrospection ibus (python3.withPackages (pypkgs: with pypkgs; [ pygobject3 ]))
   ];
 
   nativeBuildInputs = [ autoreconfHook docbook2x pkgconfig python3.pkgs.wrapPython ];
diff --git a/pkgs/tools/misc/autorandr/default.nix b/pkgs/tools/misc/autorandr/default.nix
index dc67c96ca1a2..405eb29f6bf9 100644
--- a/pkgs/tools/misc/autorandr/default.nix
+++ b/pkgs/tools/misc/autorandr/default.nix
@@ -1,7 +1,9 @@
 { stdenv
 , python3Packages
 , fetchFromGitHub
-, systemd }:
+, systemd
+, xrandr
+, makeWrapper }:
 
 let
   python = python3Packages.python;
@@ -12,6 +14,7 @@ in
     name = "autorandr-${version}";
 
     buildInputs = [ python ];
+    nativeBuildInputs = [ makeWrapper ];
 
     installPhase = ''
       runHook preInstall
@@ -33,9 +36,15 @@ in
         make install TARGETS='udev' PREFIX=$out DESTDIR=$out \
           UDEV_RULES_DIR=/etc/udev/rules.d
       ''}
+
       runHook postInstall
     '';
 
+    postFixup = ''
+      wrapProgram $out/bin/autorandr \
+        --prefix PATH : ${xrandr}/bin
+    '';
+
     src = fetchFromGitHub {
       owner = "phillipberndt";
       repo = "autorandr";
diff --git a/pkgs/tools/misc/expect/default.nix b/pkgs/tools/misc/expect/default.nix
index 80fb3c6a694c..0d1c81c00a65 100644
--- a/pkgs/tools/misc/expect/default.nix
+++ b/pkgs/tools/misc/expect/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "A tool for automating interactive applications";
-    homepage = http://expect.nist.gov/;
+    homepage = http://expect.sourceforge.net/;
     license = "Expect";
     platforms = platforms.unix;
     maintainers = with maintainers; [ wkennington ];
diff --git a/pkgs/tools/misc/fzf/default.nix b/pkgs/tools/misc/fzf/default.nix
index 4b76b85287a5..e0367dc915d3 100644
--- a/pkgs/tools/misc/fzf/default.nix
+++ b/pkgs/tools/misc/fzf/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   name = "fzf-${version}";
-  version = "0.17.0";
+  version = "0.17.0-2";
   rev = "${version}";
 
   goPackagePath = "github.com/junegunn/fzf";
@@ -11,7 +11,7 @@ buildGoPackage rec {
     inherit rev;
     owner = "junegunn";
     repo = "fzf";
-    sha256 = "0cj9vvrsrxj7752fxww1bkflz9rap0n4hhwd6shs0qbss1awwqk9";
+    sha256 = "0j4m3xf6qxfymfq6y5ml5rgz2rr1glh54k3b5xa9zi4cl5wg43qv";
   };
 
   outputs = [ "bin" "out" "man" ];
diff --git a/pkgs/tools/misc/ttwatch/default.nix b/pkgs/tools/misc/ttwatch/default.nix
index 855baa830607..2924da5f89a9 100644
--- a/pkgs/tools/misc/ttwatch/default.nix
+++ b/pkgs/tools/misc/ttwatch/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "ttwatch-${version}";
-  version = "2017-04-20";
+  version = "2017-09-26";
 
   src = fetchFromGitHub {
     owner = "ryanbinns";
     repo = "ttwatch";
-    rev = "f07a12712ed331f1530db3846828641eb0e2f5c5";
-    sha256 = "0y27bldmp6w02pjhr2cmy9g6n23vi0q26pil3rd7vbg4qjahxz27";
+    rev = "31fb7ca6ac992d131a3f5ea6acf49f0c52a128c5";
+    sha256 = "1sxjx593jqbq45jn2dkjz07zq9kkgsbcj971phimlm6dj6g75wxq";
   };
 
   nativeBuildInputs = [ cmake perl ];
diff --git a/pkgs/tools/networking/badvpn/default.nix b/pkgs/tools/networking/badvpn/default.nix
index 632b52fd1560..c9ebc12b0db8 100644
--- a/pkgs/tools/networking/badvpn/default.nix
+++ b/pkgs/tools/networking/badvpn/default.nix
@@ -10,7 +10,6 @@ let
     sha256="02b1fra43l75mljkhrq45vcrrqv0znicjn15g7nbqx3jppzbpm5z";
   };
 
-  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
     cmake openssl nss nspr
   ];
@@ -18,6 +17,7 @@ let
 in
 stdenv.mkDerivation {
   inherit (s) name version;
+  nativeBuildInputs = [ pkgconfig ];
   inherit buildInputs;
   src = fetchurl {
     inherit (s) url sha256;
diff --git a/pkgs/tools/networking/djbdns/default.nix b/pkgs/tools/networking/djbdns/default.nix
index 7537ab1c47ac..b8a7133e7bc7 100644
--- a/pkgs/tools/networking/djbdns/default.nix
+++ b/pkgs/tools/networking/djbdns/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, glibc } :
+{ stdenv, fetchurl, glibc, dns-root-data } :
 
 let
   version = "1.05";
@@ -18,11 +18,13 @@ stdenv.mkDerivation {
     sha256 = "0j3baf92vkczr5fxww7rp1b7gmczxmmgrqc8w2dy7kgk09m85k9w";
   };
 
-  patches = [ ./hier.patch ];
+  patches = [ ./hier.patch ./fix-nix-usernamespace-build.patch ];
 
   postPatch = ''
     echo gcc -O2 -include ${glibc.dev}/include/errno.h > conf-cc
     echo $out > conf-home
+    # djbdns ships with an outdated list of root servers
+    awk '/^.?.ROOT-SERVERS.NET/ { print $4 }' ${dns-root-data}/root.hints > dnsroots.global
     sed -i "s|/etc/dnsroots.global|$out/etc/dnsroots.global|" dnscache-conf.c
   '';
 
@@ -45,4 +47,4 @@ stdenv.mkDerivation {
     license = licenses.publicDomain;
     maintainers = with maintainers; [ jerith666 ];
   };
-}
\ No newline at end of file
+}
diff --git a/pkgs/tools/networking/djbdns/fix-nix-usernamespace-build.patch b/pkgs/tools/networking/djbdns/fix-nix-usernamespace-build.patch
new file mode 100644
index 000000000000..abd9e756a21f
--- /dev/null
+++ b/pkgs/tools/networking/djbdns/fix-nix-usernamespace-build.patch
@@ -0,0 +1,10 @@
+--- djbdns-1.05.org/chkshsgr.c	2001-02-11 21:11:45.000000000 +0000
++++ djbdns-1.05/chkshsgr.c	2017-10-13 10:06:09.392578927 +0100
+@@ -2,6 +2,7 @@
+ 
+ int main()
+ {
++  return 0;
+   short x[4];
+ 
+   x[0] = x[1] = 0;
diff --git a/pkgs/tools/networking/netalyzr/default.nix b/pkgs/tools/networking/netalyzr/default.nix
index abc6b785c9cb..8f8cf929e9d4 100644
--- a/pkgs/tools/networking/netalyzr/default.nix
+++ b/pkgs/tools/networking/netalyzr/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, jre }:
+{ stdenv, fetchurl, jre, makeWrapper }:
 
 stdenv.mkDerivation rec {
   name = "netalyzr-${version}";
@@ -12,17 +12,13 @@ stdenv.mkDerivation rec {
 
   phases = [ "installPhase" ];
 
+  nativeBuildInputs = [ makeWrapper ];
+
   installPhase = ''
     mkdir -p $out/{bin,share/netalyzr}
     install -m644 $src $out/share/netalyzr/NetalyzrCLI.jar
-    cat <<_EOF >> $out/bin/netalyzr
-    #!${stdenv.shell}
-
-    set -euo pipefail
-
-    exec ${stdenv.lib.getBin jre}/bin/java -jar $out/share/netalyzr/NetalyzrCLI.jar "\$@"
-    _EOF
-    chmod 755 $out/bin/netalyzr
+    makeWrapper ${stdenv.lib.getBin jre}/bin/java $out/bin/netalyzr \
+      --add-flags "-jar $out/share/netalyzr/NetalyzrCLI.jar"
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/networking/pykms/default.nix b/pkgs/tools/networking/pykms/default.nix
new file mode 100644
index 000000000000..97780d546e43
--- /dev/null
+++ b/pkgs/tools/networking/pykms/default.nix
@@ -0,0 +1,82 @@
+{ stdenv, fetchFromGitHub, python2Packages, writeText, writeScript
+, coreutils, sqlite }:
+
+let
+  dbSql = writeText "create_pykms_db.sql" ''
+    CREATE TABLE clients(
+      clientMachineId TEXT,
+      machineName     TEXT,
+      applicationId   TEXT,
+      skuId           TEXT,
+      licenseStatus   TEXT,
+      lastRequestTime INTEGER,
+      kmsEpid         TEXT,
+      requestCount    INTEGER
+    );
+  '';
+
+  dbScript = writeScript "create_pykms_db.sh" (with stdenv.lib; ''
+    #!${stdenv.shell} -eu
+
+    db=$1
+
+    ${getBin coreutils}/bin/install -d $(dirname $db)
+
+    if [ ! -e $db ] ; then
+      ${getBin sqlite}/bin/sqlite3 $db < ${dbSql}
+    fi
+  '');
+
+in python2Packages.buildPythonApplication rec {
+  name = "pykms-${version}";
+  version = "20170719";
+
+  src = fetchFromGitHub {
+    owner  = "ThunderEX";
+    repo   = "py-kms";
+    rev    = "27355d88affd740330174a7c2bae9f50b9efce56";
+    sha256 = "0cpywj73jmyijjc5hs3b00argjsdwpqzmhawbxkx3mc2l4sgzc88";
+  };
+
+  propagatedBuildInputs = with python2Packages; [ argparse pytz ];
+
+  prePatch = ''
+    siteDir=$out/${python2Packages.python.sitePackages}
+
+    substituteInPlace kmsBase.py \
+      --replace "'KmsDataBase.xml'" "'$siteDir/KmsDataBase.xml'"
+  '';
+
+  dontBuild = true;
+
+  # there are no tests
+  doCheck = false;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/{bin,share/doc/pykms} $siteDir
+
+    mv * $siteDir
+    for b in client server ; do
+      chmod 0755 $siteDir/$b.py
+      makeWrapper ${python2Packages.python.interpreter} $out/bin/$b.py \
+        --add-flags $siteDir/$b.py
+    done
+
+    install -m755 ${dbScript} $out/bin/create_pykms_db.sh
+
+    mv $siteDir/README.md $out/share/doc/pykms/
+
+    ${python2Packages.python.interpreter} -m compileall $siteDir
+
+    runHook postInstall
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Windows KMS (Key Management Service) server written in Python";
+    homepage    = https://github.com/ThunderEX/py-kms;
+    license     = licenses.mit;
+    maintainers = with maintainers; [ peterhoeg ];
+  };
+}
diff --git a/pkgs/tools/package-management/nix-bundle/default.nix b/pkgs/tools/package-management/nix-bundle/default.nix
index e3255afe7fe8..7c02d2d9a638 100644
--- a/pkgs/tools/package-management/nix-bundle/default.nix
+++ b/pkgs/tools/package-management/nix-bundle/default.nix
@@ -3,13 +3,13 @@
 stdenv.mkDerivation rec {
   pname = "nix-bundle";
   name = "${pname}-${version}";
-  version = "0.1.3";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "matthewbauer";
     repo = pname;
     rev = "v${version}";
-    sha256 = "15r77pchf4s4cdv4lvw2zw1yic78k8p0n2r954qq370vscw30yac";
+    sha256 = "0klabmygbhzlwxja8p2w8fp8ip3xaa5ym9c15rp9qxzh03hfmdjx";
   };
 
   # coreutils, gnutar is actually needed by nix for bootstrap
@@ -23,6 +23,7 @@ stdenv.mkDerivation rec {
     mkdir -p $out/bin
     makeWrapper $out/share/nix-bundle/nix-bundle.sh $out/bin/nix-bundle \
       --prefix PATH : ${binPath}
+    cp $out/share/nix-bundle/nix-run.sh $out/bin/nix-run
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index e90f71780ebd..ac697be555ac 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -161,12 +161,12 @@ in rec {
 
   nixUnstable = (lib.lowPrio (common rec {
     name = "nix-1.12${suffix}";
-    suffix = "pre5619_346aeee1";
+    suffix = "pre5650_1dd29d7a";
     src = fetchFromGitHub {
       owner = "NixOS";
       repo = "nix";
-      rev = "346aeee1cb21b5cab5ddc3e8658c88321f513761";
-      sha256 = "0lyrs0mqnh89w1nzrqpxvnh7bdjpg8j22xaidql47f1nwbblmn3f";
+      rev = "1dd29d7aebae706f3e90a18bbfae727f2ed03c70";
+      sha256 = "182v2rczm8al1ggbaca8qapvrjyp21li1fd3fiwr5nqgazgr5308";
     };
     fromGit = true;
   })) // { perl-bindings = perl-bindings { nix = nixUnstable; }; };
diff --git a/pkgs/tools/security/modsecurity/Makefile.in.patch b/pkgs/tools/security/modsecurity/Makefile.in.patch
new file mode 100644
index 000000000000..98384c754ce7
--- /dev/null
+++ b/pkgs/tools/security/modsecurity/Makefile.in.patch
@@ -0,0 +1,17 @@
+--- a/apache2/Makefile.in	2017-10-10 09:45:51.000000000 -0400
++++ b/apache2/Makefile.in	2017-10-10 09:46:04.000000000 -0400
+@@ -1208,14 +1208,12 @@
+ @LINUX_TRUE@	for m in $(pkglib_LTLIBRARIES); do \
+ @LINUX_TRUE@	  base=`echo $$m | sed 's/\..*//'`; \
+ @LINUX_TRUE@	  rm -f $(DESTDIR)$(pkglibdir)/$$base.*a; \
+-@LINUX_TRUE@	  install -D -m444 $(DESTDIR)$(pkglibdir)/$$base.so $(DESTDIR)$(APXS_MODULES)/$$base.so; \
+ @LINUX_TRUE@	done
+ @LINUX_FALSE@install-exec-hook: $(pkglib_LTLIBRARIES)
+ @LINUX_FALSE@	@echo "Removing unused static libraries..."; \
+ @LINUX_FALSE@	for m in $(pkglib_LTLIBRARIES); do \
+ @LINUX_FALSE@	  base=`echo $$m | sed 's/\..*//'`; \
+ @LINUX_FALSE@	  rm -f $(DESTDIR)$(pkglibdir)/$$base.*a; \
+-@LINUX_FALSE@	  cp -p $(DESTDIR)$(pkglibdir)/$$base.so $(DESTDIR)$(APXS_MODULES); \
+ @LINUX_FALSE@	done
+ 
+ # Tell versions [3.59,3.63) of GNU make to not export all variables.
diff --git a/pkgs/tools/security/modsecurity/default.nix b/pkgs/tools/security/modsecurity/default.nix
index a5e03eb3fe16..2c02a5dd4736 100644
--- a/pkgs/tools/security/modsecurity/default.nix
+++ b/pkgs/tools/security/modsecurity/default.nix
@@ -1,35 +1,43 @@
 { stdenv, lib, fetchurl, pkgconfig
-, curl, apacheHttpd, pcre, apr, aprutil, libxml2 }:
+, curl, apacheHttpd, pcre, apr, aprutil, libxml2
+, luaSupport ? false, lua5
+}:
 
 with lib;
 
+let luaValue = if luaSupport then lua5 else "no";
+    optional = stdenv.lib.optional;
+in
+
 stdenv.mkDerivation rec {
   name = "modsecurity-${version}";
-  version = "2.9.0";
+  version = "2.9.2";
 
   src = fetchurl {
     url = "https://www.modsecurity.org/tarball/${version}/${name}.tar.gz";
-    sha256 = "e2bbf789966c1f80094d88d9085a81bde082b2054f8e38e0db571ca49208f434";
+    sha256 = "41a8f73476ec891f3a9e8736b98b64ea5c2105f1ce15ea57a1f05b4bf2ffaeb5";
   };
 
   nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ curl apacheHttpd pcre apr aprutil libxml2 ];
-  configureFlags = [
-    "--enable-standalone-module"
-    "--enable-static"
-    "--with-curl=${curl.dev}"
-    "--with-apxs=${apacheHttpd.dev}/bin/apxs"
-    "--with-pcre=${pcre.dev}"
-    "--with-apr=${apr.dev}"
-    "--with-apu=${aprutil.dev}/bin/apu-1-config"
-    "--with-libxml=${libxml2.dev}"
-  ];
+  buildInputs = [  curl apacheHttpd pcre apr aprutil libxml2 ] ++
+    optional luaSupport lua5;
+
+  configureFlags = ''
+    --enable-standalone-module
+    --enable-static
+    --with-curl=${curl.dev}
+    --with-apxs=${apacheHttpd.dev}/bin/apxs
+    --with-pcre=${pcre.dev}
+    --with-apr=${apr.dev}
+    --with-apu=${aprutil.dev}/bin/apu-1-config
+    --with-libxml=${libxml2.dev}
+    --with-lua=${luaValue}
+  '';
 
   outputs = ["out" "nginx"];
-
-  preBuild = ''
-    substituteInPlace apache2/Makefile.in --replace "install -D " "# install -D"
-  '';
+  # by default modsecurity's install script copies compiled output to httpd's modules folder
+  # this patch removes those lines
+  patches = [ ./Makefile.in.patch ];
 
   postInstall = ''
     mkdir -p $nginx
@@ -41,6 +49,6 @@ stdenv.mkDerivation rec {
     license = licenses.asl20;
     homepage = https://www.modsecurity.org/;
     maintainers = with maintainers; [offline];
-    platforms = platforms.linux;
+    platforms   = stdenv.lib.platforms.linux ++ stdenv.lib.platforms.darwin;
   };
 }
diff --git a/pkgs/tools/security/scrypt/default.nix b/pkgs/tools/security/scrypt/default.nix
index 1835dbdb620b..352a81b2727a 100644
--- a/pkgs/tools/security/scrypt/default.nix
+++ b/pkgs/tools/security/scrypt/default.nix
@@ -2,27 +2,26 @@
 
 stdenv.mkDerivation rec {
   name = "scrypt-${version}";
-  version = "1.2.0";
+  version = "1.2.1";
 
   src = fetchurl {
     url = "https://www.tarsnap.com/scrypt/${name}.tgz";
-    sha256 = "1m39hpfby0fdjam842773i5w7pa0qaj7f0r22jnchxsj824vqm0p";
+    sha256 = "0xy5yhrwwv13skv9im9vm76rybh9f29j2dh4hlh2x01gvbkza8a6";
   };
 
   buildInputs = [ openssl ];
 
   patchPhase = ''
-    substituteInPlace Makefile.in \
-      --replace "command -p mv" "mv"
-    substituteInPlace autocrap/Makefile.am \
-      --replace "command -p mv" "mv"
+    for f in Makefile.in autotools/Makefile.am libcperciva/cpusupport/Build/cpusupport.sh ; do
+      substituteInPlace $f --replace "command -p " ""
+    done
   '';
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "Encryption utility";
     homepage    = https://www.tarsnap.com/scrypt.html;
-    license     = stdenv.lib.licenses.bsd2;
-    platforms   = stdenv.lib.platforms.all;
-    maintainers = [ stdenv.lib.maintainers.thoughtpolice ];
+    license     = licenses.bsd2;
+    platforms   = platforms.all;
+    maintainers = with maintainers; [ thoughtpolice ];
   };
 }
diff --git a/pkgs/tools/typesetting/hevea/default.nix b/pkgs/tools/typesetting/hevea/default.nix
index 0e87ef5dacc1..ed6e741b3f9e 100644
--- a/pkgs/tools/typesetting/hevea/default.nix
+++ b/pkgs/tools/typesetting/hevea/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, ocaml }:
+{ stdenv, fetchurl, ocamlPackages }:
 
 stdenv.mkDerivation rec {
   name = "hevea-2.29";
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
     sha256 = "1i7qkar6gjpsxqgdm90xxgp15z7gfyja0rn62n23a9aahc0hpgq6";
   };
 
-  buildInputs = [ ocaml ];
+  buildInputs = with ocamlPackages; [ ocaml ocamlbuild ];
 
   makeFlags = "PREFIX=$(out)";
 
@@ -17,6 +17,6 @@ stdenv.mkDerivation rec {
     homepage = http://pauillac.inria.fr/~maranget/hevea/;
     license = licenses.qpl;
     maintainers = with maintainers; [ pSub ];
-    platforms = with platforms; linux;
+    platforms = with platforms; unix;
   };
 }
diff --git a/pkgs/tools/virtualization/awsebcli/default.nix b/pkgs/tools/virtualization/awsebcli/default.nix
index 91cb148d8fe8..e43bc18ba70e 100644
--- a/pkgs/tools/virtualization/awsebcli/default.nix
+++ b/pkgs/tools/virtualization/awsebcli/default.nix
@@ -67,11 +67,11 @@ let
 in with localPython.pkgs; buildPythonApplication rec {
   name = "${pname}-${version}";
   pname = "awsebcli";
-  version = "3.10.5";
+  version = "3.11.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1g53z2flhp3navdf8lw6rgh99akf3k0ng1zkkqswvh66zswkxnwn";
+    sha256 = "052388annhyirlzdr89hbgif8k7pw7win2zm1ybn4iiisr5l49zi";
   };
 
   checkInputs = [