Merge commit 'ab77a6bb1e7d2ff475210ad392f1a9bd1bb6ba3a' into gcc-simplify-flags

658 files changed, 7461 insertions, 3264 deletions

diff --git a/pkgs/tools/X11/dragon-drop/default.nix b/pkgs/tools/X11/dragon-drop/default.nix
index 3dfc7abbc77d..232c4a636fb8 100644
--- a/pkgs/tools/X11/dragon-drop/default.nix
+++ b/pkgs/tools/X11/dragon-drop/default.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation rec {
     sha256 = "03vdbmqlbmk3j2ay1wy6snrm2y27faxz7qv81vyzjzngj345095a";
   };
 
-  buildInputs = [ gtk pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ gtk ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/tools/X11/hsetroot/default.nix b/pkgs/tools/X11/hsetroot/default.nix
index 9de29da9b44a..5baf6a4b51f8 100644
--- a/pkgs/tools/X11/hsetroot/default.nix
+++ b/pkgs/tools/X11/hsetroot/default.nix
@@ -17,7 +17,8 @@ stdenv.mkDerivation rec {
     sha256 = "1px1p3wz7ji725z9nlwb0x0h6lnnvnpz15sblzzq7zrijl3wz65x";
   };
 
-  buildInputs = [ autoconf automake imlib2 libtool libX11 pkgconfig xproto ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ autoconf automake imlib2 libtool libX11 xproto ];
 
   patches = [ underlinkingPatch ];
 
diff --git a/pkgs/tools/X11/keynav/default.nix b/pkgs/tools/X11/keynav/default.nix
index edddf42d2c55..23e528297eef 100644
--- a/pkgs/tools/X11/keynav/default.nix
+++ b/pkgs/tools/X11/keynav/default.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation rec {
     sha256 = "0v1m8w877fcrk918p6b6q3753dsz8i1f4mb9bi064cp11kh85nq5";
   };
 
-  buildInputs = [ pkgconfig libX11 xextproto libXtst libXi libXext libXinerama
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libX11 xextproto libXtst libXi libXext libXinerama
                   glib cairo xdotool ];
 
   patchPhase = ''
diff --git a/pkgs/tools/X11/ksuperkey/default.nix b/pkgs/tools/X11/ksuperkey/default.nix
index a753f9bd170e..cd80e3286576 100644
--- a/pkgs/tools/X11/ksuperkey/default.nix
+++ b/pkgs/tools/X11/ksuperkey/default.nix
@@ -3,8 +3,9 @@
 stdenv.mkDerivation rec {
   name = "ksuperkey-git-2015-07-21";
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    libX11 libXtst pkgconfig inputproto libXi xproto xextproto
+    libX11 libXtst inputproto libXi xproto xextproto
   ];
 
   src = fetchgit {
diff --git a/pkgs/tools/X11/obconf/default.nix b/pkgs/tools/X11/obconf/default.nix
index e25fa43f1807..2e02338631b4 100644
--- a/pkgs/tools/X11/obconf/default.nix
+++ b/pkgs/tools/X11/obconf/default.nix
@@ -10,8 +10,9 @@ stdenv.mkDerivation rec {
     sha256 = "1fanjdmd8727kk74x5404vi8v7s4kpq48l583d12fsi4xvsfb8vi";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    pkgconfig gtk2 libglade libSM openbox imlib2 libstartup_notification
+    gtk2 libglade libSM openbox imlib2 libstartup_notification
     makeWrapper
   ];
 
diff --git a/pkgs/tools/X11/sct/DISPLAY-segfault.patch b/pkgs/tools/X11/sct/DISPLAY-segfault.patch
new file mode 100644
index 000000000000..6b83afa332ba
--- /dev/null
+++ b/pkgs/tools/X11/sct/DISPLAY-segfault.patch
@@ -0,0 +1,10 @@
+--- a/sct.c	2017-09-22 00:44:20.270421881 +0000
++++ b/sct.c	2017-09-26 10:50:38.964562740 +0000
+@@ -36,6 +36,7 @@
+ main(int argc, char **argv)
+ {
+ 	Display *dpy = XOpenDisplay(NULL);
++	if (!dpy) exit(1);
+ 	int screen = DefaultScreen(dpy);
+ 	Window root = RootWindow(dpy, screen);
+ 
diff --git a/pkgs/tools/X11/sct/default.nix b/pkgs/tools/X11/sct/default.nix
index 1890e9c5266b..9f45bbe30871 100644
--- a/pkgs/tools/X11/sct/default.nix
+++ b/pkgs/tools/X11/sct/default.nix
@@ -1,31 +1,26 @@
-{stdenv, fetchurl, libX11, libXrandr}:
+{ stdenv, fetchurl, libX11, libXrandr }:
+
 stdenv.mkDerivation rec {
   name = "sct";
-  buildInputs = [libX11 libXrandr];
+
   src = fetchurl {
     url = http://www.tedunangst.com/flak/files/sct.c;
     sha256 = "01f3ndx3s6d2qh2xmbpmhd4962dyh8yp95l87xwrs4plqdz6knhd";
-    
-    # Discussion regarding the checksum and the source code can be found in issue #17163 
-    # The code seems unmaintained, yet an unknown (probably small change) in the code caused 
-    # failed builds as the checksum had changed.
-    # The checksum is updated for now, however, this is unpractical and potentially unsafe 
-    # so any future changes might warrant a fork of the (feature complete) project. 
-    # The code is under public domain.
-    
   };
-  phases = ["patchPhase" "buildPhase" "installPhase"];
-  patchPhase = ''
-    sed -re "/Xlibint/d" ${src} > sct.c 
-  '';
-  buildPhase = "gcc -std=c99 sct.c -o sct -lX11 -lXrandr -lm";
-  installPhase = ''
-    mkdir -p "$out/bin"
-    cp sct "$out/bin"
-  '';
-  meta = {
-    description = ''A minimal utility to set display colour temperature'';
-    maintainers = [stdenv.lib.maintainers.raskin];
-    platforms = with stdenv.lib.platforms; linux ++ freebsd ++ openbsd;
+
+  unpackPhase = "cat ${src} > sct.c";
+  patches = [ ./DISPLAY-segfault.patch ];
+
+  buildInputs = [ libX11 libXrandr ];
+  buildPhase = "cc sct.c -o sct -lm -lX11 -lXrandr";
+
+  installPhase = "install -Dt $out/bin sct";
+
+  meta = with stdenv.lib; {
+    homepage = https://www.tedunangst.com/flak/post/sct-set-color-temperature;
+    description = "A minimal utility to set display colour temperature";
+    maintainers = [ maintainers.raskin ];
+    license = licenses.publicDomain;
+    platforms = with platforms; linux ++ freebsd ++ openbsd;
   };
 }
diff --git a/pkgs/tools/X11/vdpauinfo/default.nix b/pkgs/tools/X11/vdpauinfo/default.nix
index 7a18a6a98b60..a20b7d69f3dc 100644
--- a/pkgs/tools/X11/vdpauinfo/default.nix
+++ b/pkgs/tools/X11/vdpauinfo/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "1i2b0k9h8r0lnxlrkgqzmrjakgaw3f1ygqqwzx8w6676g85rcm20";
   };
 
-  buildInputs = [ pkgconfig libvdpau ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libvdpau ];
 
   meta = with stdenv.lib; {
     homepage = http://people.freedesktop.org/~aplattner/vdpau/;
diff --git a/pkgs/tools/X11/wmctrl/default.nix b/pkgs/tools/X11/wmctrl/default.nix
index 2e23e7bd4de4..e0118b8b27b4 100644
--- a/pkgs/tools/X11/wmctrl/default.nix
+++ b/pkgs/tools/X11/wmctrl/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "1afclc57b9017a73mfs9w7lbdvdipmf9q0xdk116f61gnvyix2np";
   };
  
-  buildInputs = [ libX11 libXmu glib pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libX11 libXmu glib ];
 
   patches = [ ./64-bit-data.patch ];
 
diff --git a/pkgs/tools/X11/xbindkeys-config/default.nix b/pkgs/tools/X11/xbindkeys-config/default.nix
index cef071bb3b61..e3d9ecd5953e 100644
--- a/pkgs/tools/X11/xbindkeys-config/default.nix
+++ b/pkgs/tools/X11/xbindkeys-config/default.nix
@@ -4,7 +4,8 @@ stdenv.mkDerivation rec {
   name = "xbindkeys-config-${version}";
   version = "0.1.3";
 
-  buildInputs = [ gtk pkgconfig makeWrapper ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ gtk makeWrapper ];
 
   src = fetchurl {
     url = "mirror://debian/pool/main/x/xbindkeys-config/xbindkeys-config_${version}.orig.tar.gz";
diff --git a/pkgs/tools/X11/xdg-user-dirs/default.nix b/pkgs/tools/X11/xdg-user-dirs/default.nix
index 8829427b79c1..0af945317530 100644
--- a/pkgs/tools/X11/xdg-user-dirs/default.nix
+++ b/pkgs/tools/X11/xdg-user-dirs/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, libxslt, docbook_xsl, makeWrapper }:
 
 stdenv.mkDerivation rec {
-  name = "xdg-user-dirs-0.15";
-  
+  name = "xdg-user-dirs-0.16";
+
   src = fetchurl {
     url = "http://user-dirs.freedesktop.org/releases/${name}.tar.gz";
-    sha256 = "20b4a751f41d0554bce3e0ce5e8d934be98cc62d48f0b90a894c3e1916552786";
+    sha256 = "1rp3c94hxjlfsryvwajklynfnrcvxplhwnjqc7395l89i0nb83vp";
   };
 
   buildInputs = [ libxslt docbook_xsl makeWrapper ];
diff --git a/pkgs/tools/X11/xdg-utils/default.nix b/pkgs/tools/X11/xdg-utils/default.nix
index a1d3a059a830..717ad327c676 100644
--- a/pkgs/tools/X11/xdg-utils/default.nix
+++ b/pkgs/tools/X11/xdg-utils/default.nix
@@ -17,11 +17,11 @@ in
 
 stdenv.mkDerivation rec {
   name = "xdg-utils-${version}";
-  version = "1.1.1";
+  version = "1.1.2";
 
   src = fetchurl {
     url = "https://portland.freedesktop.org/download/${name}.tar.gz";
-    sha256 = "09a1pk3ifsndc5qz2kcd1557i137gpgnv3d739pv22vfayi67pdh";
+    sha256 = "1k4b4m3aiyqn9k12a0ihcdahzlspl3zhskmm1d7228dvqvi546cm";
   };
 
   # just needed when built from git
@@ -46,6 +46,9 @@ stdenv.mkDerivation rec {
     substituteInPlace $out/bin/xdg-mime \
       --replace "/usr/bin/file" "${file}/bin/file"
 
+    substituteInPlace $out/bin/xdg-email \
+      --replace "/bin/echo" "${coreutils}/bin/echo"
+
     sed 's# which # type -P #g' -i "$out"/bin/*
   '';
 
diff --git a/pkgs/tools/X11/xinput_calibrator/default.nix b/pkgs/tools/X11/xinput_calibrator/default.nix
index 9b50f00beefc..8376b2041b30 100644
--- a/pkgs/tools/X11/xinput_calibrator/default.nix
+++ b/pkgs/tools/X11/xinput_calibrator/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
 
   preConfigure = "./autogen.sh --with-gui=X11";
 
-  buildInputs = [ inputproto libXi autoconf automake libtool m4 xlibsWrapper pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ inputproto libXi autoconf automake libtool m4 xlibsWrapper ];
 
   meta = {
     homepage = https://github.com/tias/xinput_calibrator;
diff --git a/pkgs/tools/X11/xmacro/default.nix b/pkgs/tools/X11/xmacro/default.nix
index 758bf1729b17..e986b46aa487 100644
--- a/pkgs/tools/X11/xmacro/default.nix
+++ b/pkgs/tools/X11/xmacro/default.nix
@@ -1,21 +1,15 @@
 { stdenv, fetchurl, libX11, libXtst, xextproto, libXi, inputproto }:
 
-stdenv.mkDerivation {
-  name = "xmacro-0.3pre20000911";
+stdenv.mkDerivation rec {
+  name = "xmacro-${version}";
+  version = "0.4.6";
 
   src = fetchurl {
-    url = mirror://sourceforge/xmacro/xmacro-pre0.3-20000911.tar.gz;
-    sha256 = "04gzgxhp8bx98zrcvmsm7mn72r9g9588skbf64cqvkp4yz6kfqhb";
+    url = "http://download.sarine.nl/xmacro/${name}.tar.gz";
+    sha256 = "1p9jljxyn4j6piljiyi2xv6f8jhjbzhabprp8p0qmqxaxgdipi61";
   };
 
-  preBuild = ''
-    sed -e 's/-pedantic//g' -i Makefile
-    sed -e 's/iostream[.]h/iostream/' -i *.cpp
-    sed -e 's/iomanip[.]h/iomanip/' -i *.cpp
-    sed -e '1iusing namespace std;' -i *.cpp
-  '';
-
-  preInstall = "echo -e 'install:\n	mkdir \${out}/bin;\n	cp xmacrorec xmacrorec2 xmacroplay \${out}/bin;' >>Makefile; ";
+  preInstall = "echo -e 'install:\n	mkdir \${out}/bin;\n	cp xmacrorec2 xmacroplay \${out}/bin;' >>Makefile; ";
 
   buildInputs = [ libX11 libXtst xextproto libXi inputproto ];
 
diff --git a/pkgs/tools/X11/xosview2/default.nix b/pkgs/tools/X11/xosview2/default.nix
new file mode 100644
index 000000000000..c8b658d4350e
--- /dev/null
+++ b/pkgs/tools/X11/xosview2/default.nix
@@ -0,0 +1,41 @@
+{ stdenv, fetchurl, libX11 }:
+
+stdenv.mkDerivation rec {
+  name = "xosview2-${version}";
+  version = "2.2.2";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/xosview/${name}.tar.gz";
+    sha256 = "3502e119a5305ff2396f559340132910807351c7d4e375f13b5c338404990406";
+  };
+
+  # The software failed to buid with this enabled; it seemed tests were not implemented
+  doCheck = false;
+
+  buildInputs = [ libX11 ];
+
+  meta = with stdenv.lib; {
+    description = "Lightweight program that gathers information from your operating system and displays it in graphical form";
+    longDescription = ''
+      xosview is a lightweight program that gathers information from your
+      operating system and displays it in graphical form. It attempts to show
+      you in a quick glance an overview of how your system resources are being
+      utilized.
+
+      It can be configured to be nothing more than a small strip showing a
+      couple of parameters on a desktop task bar. Or it can display dozens of
+      meters and rolling graphical charts over your entire screen.
+
+      Since xosview renders all graphics with core X11 drawing methods, you can
+      run it on one machine and display it on another. This works even if your
+      other host is an operating system not running an X server inside a
+      virtual machine running on a physically different host. If you can
+      connect to it on a network, then you can popup an xosview instance and
+      monitor what is going on.
+    '';
+    homepage = "http://xosview.sourceforge.net/index.html";
+    license = licenses.gpl1;
+    maintainers = [ maintainers.SeanZicari ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/tools/X11/xpointerbarrier/default.nix b/pkgs/tools/X11/xpointerbarrier/default.nix
new file mode 100644
index 000000000000..5eb1faafe2ef
--- /dev/null
+++ b/pkgs/tools/X11/xpointerbarrier/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, xorg, fetchFromGitHub }:
+stdenv.mkDerivation rec {
+  name = "xpointerbarrier-${version}";
+  version = "17.10";
+
+  src = fetchFromGitHub {
+    owner = "vain";
+    repo = "xpointerbarrier";
+    rev = "v${version}";
+    sha256 = "0p4qc7ggndf74d2xdf38659prx3r3lfi5jc8nmqx52c9fqdshcrk";
+  };
+
+  buildInputs = [ xorg.libX11 xorg.libXfixes xorg.libXrandr ];
+
+  makeFlags = "prefix=$(out)";
+
+  meta = {
+    homepage = https://github.com/vain/xpointerbarrier;
+    description = "Create X11 pointer barriers around your working area";
+    license = stdenv.lib.licenses.mit;
+    maintainers = stdenv.lib.maintainers.xzfc;
+    platforms = stdenv.lib.platforms.linux;
+  };
+}
diff --git a/pkgs/tools/X11/xpra/default.nix b/pkgs/tools/X11/xpra/default.nix
index aa0ae36fdd29..a3aa7a0aa234 100644
--- a/pkgs/tools/X11/xpra/default.nix
+++ b/pkgs/tools/X11/xpra/default.nix
@@ -11,15 +11,17 @@ with lib;
 let
   inherit (python2Packages) python cython buildPythonApplication;
 in buildPythonApplication rec {
-  name = "xpra-2.0.2";
-  namePrefix = "";
+  name = "xpra-${version}";
+  version = "2.1.3";
+
   src = fetchurl {
     url = "http://xpra.org/src/${name}.tar.xz";
-    sha256 = "09hzgbsj9v5qyh41rbz968ipi7016jk66b60vm6piryna9kbnha3";
+    sha256 = "0r0l3p59q05fmvkp3jv8vmny2v8m1vyhqkg6b9r2qgxn1kcxx7rm";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    cython pkgconfig
+    cython
 
     xorg.libX11 xorg.renderproto xorg.libXrender xorg.libXi xorg.inputproto xorg.kbproto
     xorg.randrproto xorg.damageproto xorg.compositeproto xorg.xextproto xorg.recordproto
@@ -49,7 +51,7 @@ in buildPythonApplication rec {
 
   preBuild = ''
     export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE $(pkg-config --cflags gtk+-2.0) $(pkg-config --cflags pygtk-2.0) $(pkg-config --cflags xtst)"
-    substituteInPlace xpra/server/auth/pam.py --replace "/lib/libpam.so.1" "${pam}/lib/libpam.so"
+    substituteInPlace xpra/server/auth/pam_auth.py --replace "/lib/libpam.so.1" "${pam}/lib/libpam.so"
   '';
   setupPyBuildFlags = ["--with-Xdummy" "--without-strict"];
 
@@ -73,6 +75,8 @@ in buildPythonApplication rec {
 
   meta = {
     homepage = http://xpra.org/;
+    downloadPage = "https://xpra.org/src/";
+    downloadURLRegexp = "xpra-.*[.]tar[.]xz$";
     description = "Persistent remote applications for X";
     platforms = platforms.linux;
     maintainers = with maintainers; [ tstrobel offline ];
diff --git a/pkgs/tools/X11/xpra/gtk3.nix b/pkgs/tools/X11/xpra/gtk3.nix
index f66b7389f315..629c10f867fa 100644
--- a/pkgs/tools/X11/xpra/gtk3.nix
+++ b/pkgs/tools/X11/xpra/gtk3.nix
@@ -3,15 +3,15 @@
 , xorg, gtk3, glib, pango, cairo, gdk_pixbuf, atk, pygobject3, pycairo, gobjectIntrospection
 , makeWrapper, xkbcomp, xorgserver, getopt, xauth, utillinux, which, fontsConf
 , ffmpeg, x264, libvpx, libwebp
-, libfakeXinerama }:
+, libfakeXinerama, pam }:
 
 buildPythonApplication rec {
-  name = "xpra-0.16.2";
-  namePrefix = "";
+  name = "xpra-${version}";
+  version = "2.1.3";
 
   src = fetchurl {
     url = "http://xpra.org/src/${name}.tar.xz";
-    sha256 = "0h55rv46byzv2g8g77bm0a0py8jpz3gbr5fhr5jy9sisyr0vk6ff";
+    sha256 = "0r0l3p59q05fmvkp3jv8vmny2v8m1vyhqkg6b9r2qgxn1kcxx7rm";
   };
 
   patchPhase = ''
@@ -19,9 +19,8 @@ buildPythonApplication rec {
     substituteInPlace xpra/client/gtk3/cairo_workaround.pyx --replace 'pycairo/pycairo.h' 'py3cairo.h'
   '';
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    pkgconfig
-
     xorg.libX11 xorg.renderproto xorg.libXrender xorg.libXi xorg.inputproto xorg.kbproto
     xorg.randrproto xorg.damageproto xorg.compositeproto xorg.xextproto xorg.recordproto
     xorg.xproto xorg.fixesproto xorg.libXtst xorg.libXfixes xorg.libXcomposite xorg.libXdamage
@@ -32,6 +31,8 @@ buildPythonApplication rec {
     ffmpeg libvpx x264 libwebp
 
     makeWrapper
+
+    pam
   ];
 
   propagatedBuildInputs = [
@@ -40,6 +41,7 @@ buildPythonApplication rec {
 
   preBuild = ''
     export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE $(pkg-config --cflags gtk+-3.0) $(pkg-config --cflags xtst)"
+    substituteInPlace xpra/server/auth/pam_auth.py --replace "/lib/libpam.so.1" "${pam}/lib/libpam.so"
   '';
   setupPyBuildFlags = [ "--without-strict" "--with-gtk3" "--without-gtk2" "--with-Xdummy" ];
 
@@ -68,6 +70,8 @@ buildPythonApplication rec {
 
   meta = {
     homepage = http://xpra.org/;
+    downloadPage = "https://xpra.org/src/";
+    downloadURLRegexp = "xpra-.*[.]tar[.]xz$";
     description = "Persistent remote applications for X";
     platforms = stdenv.lib.platforms.linux;
   };
diff --git a/pkgs/tools/X11/xrestop/default.nix b/pkgs/tools/X11/xrestop/default.nix
index 2bd6392456ee..76e502d75985 100644
--- a/pkgs/tools/X11/xrestop/default.nix
+++ b/pkgs/tools/X11/xrestop/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0mz27jpij8am1s32i63mdm58znfijcpfhdqq1npbmvgclyagrhk7";
   };
 
-  buildInputs = [ pkgconfig xorg.libX11 xorg.libXres xorg.libXext ncurses ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ xorg.libX11 xorg.libXres xorg.libXext ncurses ];
 
   meta = {
     platforms = stdenv.lib.platforms.unix;
diff --git a/pkgs/tools/X11/xsettingsd/default.nix b/pkgs/tools/X11/xsettingsd/default.nix
index c05aeff9337c..239b01e1345d 100644
--- a/pkgs/tools/X11/xsettingsd/default.nix
+++ b/pkgs/tools/X11/xsettingsd/default.nix
@@ -15,7 +15,8 @@ stdenv.mkDerivation rec {
     ./SConstruct.patch
   ];
 
-  buildInputs = [ libX11 scons pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libX11 scons ];
   buildPhase = ''
     mkdir -p "$out"
     scons \
diff --git a/pkgs/tools/X11/xtrace/default.nix b/pkgs/tools/X11/xtrace/default.nix
index 35342035c9d5..1905ed9752ca 100644
--- a/pkgs/tools/X11/xtrace/default.nix
+++ b/pkgs/tools/X11/xtrace/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation {
     sha256 = "1g26hr6rl7bbb9cwqk606nbbapslq3wnsy8j28azrgi8hgfqhjfi";
   };
 
-  buildInputs = [ libX11 makeWrapper autoreconfHook ];
+  nativeBuildInputs = [ autoreconfHook ];
+  buildInputs = [ libX11 makeWrapper ];
 
   preConfigure = ''
     ./autogen.sh
diff --git a/pkgs/tools/X11/xwinmosaic/default.nix b/pkgs/tools/X11/xwinmosaic/default.nix
index 40956f2acc4d..e36808db0b8c 100644
--- a/pkgs/tools/X11/xwinmosaic/default.nix
+++ b/pkgs/tools/X11/xwinmosaic/default.nix
@@ -1,18 +1,18 @@
-{stdenv, fetchgit, gtk2, cmake, pkgconfig}:
-let
-  buildInputs = [
-    gtk2 cmake pkgconfig
-  ];
-in
+{ stdenv, fetchgit, gtk2, cmake, pkgconfig }:
+
 stdenv.mkDerivation rec {
   version = "0.4.2";
   name = "xwinmosaic-${version}";
-  inherit buildInputs;
+
   src = fetchgit {
     url = "https://github.com/soulthreads/xwinmosaic/";
     rev = "refs/tags/v0.4.2";
     sha256 = "16qhrpgn84fz0q3nfvaz5sisc82zk6y7c0sbvbr69zfx5fwbs1rr";
   };
+
+  nativeBuildInputs = [ pkgconfig cmake ];
+  buildInputs = [ gtk2 ];
+
   meta = {
     inherit version;
     description = ''X window switcher drawing a colourful grid'';
diff --git a/pkgs/tools/X11/xwinwrap/default.nix b/pkgs/tools/X11/xwinwrap/default.nix
new file mode 100644
index 000000000000..6ea24ad2c6aa
--- /dev/null
+++ b/pkgs/tools/X11/xwinwrap/default.nix
@@ -0,0 +1,54 @@
+{ stdenv, fetchbzr, x11 }:
+
+let
+  version = "4";
+in
+stdenv.mkDerivation {
+  name = "xwinwrap-${version}";
+
+  src = fetchbzr {
+    url = https://code.launchpad.net/~shantanu-goel/xwinwrap/devel;
+    rev = version;
+    sha256 = "1annhqc71jcgx5zvcy31c1c488ygx4q1ygrwyy2y0ww743smbchw";
+  };
+
+  buildInputs = [
+    x11
+  ];
+
+  buildPhase = if stdenv.system == "x86_64-linux" then ''
+    make all64
+  '' else if stdenv.system == "i686-linux" then ''
+    make all32
+  '' else throw "xwinwrap is not supported on ${stdenv.system}";
+
+  installPhase = ''
+    mkdir -p $out/bin
+    mv */xwinwrap $out/bin
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A utility that allows you to use an animated X window as the wallpaper";
+    longDescription = ''
+      XWinWrap is a small utility written a loooong time ago that allowed you to
+      stick most of the apps to your desktop background. What this meant was you
+      could use an animated screensaver (like glmatrix, electric sheep, etc) or
+      even a movie, and use it as your wallpaper. But only one version of this
+      app was ever released, and it had a few problems, like:
+
+      - Well, sticking didn’t work. So if you did a “minimize all” or “go to
+      desktop” kind of thing, your “wallpaper” got minimized as well.
+
+      - The geometry option didn’t work, so you could not create, e.g., a small
+      matrix window surrounded by your original wallpaper.
+
+      Seeing no-one picking it up, I decided to give it a bit of polish last
+      weekend by fixing the above problems and also add a few features. And here
+      it is, in its new avatar “Shantz XWinWrap”.
+    '';
+    license = licenses.hpnd;
+    homepage = https://shantanugoel.com/2008/09/03/shantz-xwinwrap/;
+    maintainers = with maintainers; [ infinisil ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/tools/admin/ansible/2.1.nix b/pkgs/tools/admin/ansible/2.1.nix
new file mode 100644
index 000000000000..6232e4ad95ba
--- /dev/null
+++ b/pkgs/tools/admin/ansible/2.1.nix
@@ -0,0 +1,52 @@
+{ stdenv
+, fetchurl
+, pythonPackages
+, windowsSupport ? false
+}:
+
+with pythonPackages;
+
+let
+  jinja = jinja2.overridePythonAttrs (old: rec {
+    version = "2.8.1";
+    name = "${old.pname}-${version}";
+    src = old.src.override {
+      inherit version;
+      sha256 = "35341f3a97b46327b3ef1eb624aadea87a535b8f50863036e085e7c426ac5891";
+    };
+  });
+in buildPythonPackage rec {
+  pname = "ansible";
+  version = "2.1.4.0";
+  name = "${pname}-${version}";
+
+
+  src = fetchurl {
+    url = "http://releases.ansible.com/ansible/${name}.tar.gz";
+    sha256 = "05nc68900qrzqp88970j2lmyvclgrjki66xavcpzyzamaqrh7wg9";
+  };
+
+  prePatch = ''
+    sed -i "s,/usr/,$out," lib/ansible/constants.py
+  '';
+
+  doCheck = false;
+  dontStrip = true;
+  dontPatchELF = true;
+  dontPatchShebangs = false;
+
+  propagatedBuildInputs = [
+    pycrypto paramiko jinja pyyaml httplib2 boto six netaddr dns
+  ] ++ stdenv.lib.optional windowsSupport pywinrm;
+
+  meta = with stdenv.lib; {
+    homepage = http://www.ansible.com;
+    description = "A simple automation tool";
+    license = with licenses; [ gpl3] ;
+    maintainers = with maintainers; [
+      jgeerds
+      joamaki
+    ];
+    platforms = with platforms; linux ++ darwin;
+  };
+}
diff --git a/pkgs/tools/admin/ansible/2.2.nix b/pkgs/tools/admin/ansible/2.2.nix
new file mode 100644
index 000000000000..02392d7ac89f
--- /dev/null
+++ b/pkgs/tools/admin/ansible/2.2.nix
@@ -0,0 +1,54 @@
+{ stdenv
+, fetchurl
+, pythonPackages
+, windowsSupport ? false
+}:
+
+with pythonPackages;
+
+let
+  # Shouldn't be needed anymore in next version
+  # https://github.com/NixOS/nixpkgs/pull/22345#commitcomment-20718521
+  jinja = jinja2.overridePythonAttrs (old: rec {
+    version = "2.8.1";
+    name = "${old.pname}-${version}";
+    src = old.src.override {
+      inherit version;
+      sha256 = "35341f3a97b46327b3ef1eb624aadea87a535b8f50863036e085e7c426ac5891";
+    };
+  });
+in buildPythonPackage rec {
+  pname = "ansible";
+  version = "2.2.1.0";
+  name = "${pname}-${version}";
+
+
+  src = fetchurl {
+    url = "http://releases.ansible.com/ansible/${name}.tar.gz";
+    sha256 = "0gz9i30pdmkchi936ijy873k8di6fmf3v5rv551hxyf0hjkjx8b3";
+  };
+
+  prePatch = ''
+    sed -i "s,/usr/,$out," lib/ansible/constants.py
+  '';
+
+  doCheck = false;
+  dontStrip = true;
+  dontPatchELF = true;
+  dontPatchShebangs = false;
+
+  propagatedBuildInputs = [
+    pycrypto paramiko jinja pyyaml httplib2 boto six netaddr dns
+  ] ++ stdenv.lib.optional windowsSupport pywinrm;
+
+  meta = with stdenv.lib; {
+    homepage = http://www.ansible.com;
+    description = "A simple automation tool";
+    license = with licenses; [ gpl3] ;
+    maintainers = with maintainers; [
+      jgeerds
+      joamaki
+    ];
+    platforms = with platforms; linux ++ darwin;
+  };
+}
diff --git a/pkgs/tools/admin/ansible/2.3.nix b/pkgs/tools/admin/ansible/2.3.nix
new file mode 100644
index 000000000000..7330b7d0858b
--- /dev/null
+++ b/pkgs/tools/admin/ansible/2.3.nix
@@ -0,0 +1,40 @@
+{ stdenv
+, fetchurl
+, pythonPackages
+, windowsSupport ? false
+}:
+
+pythonPackages.buildPythonPackage rec {
+  pname = "ansible";
+  version = "2.3.2.0";
+  name = "${pname}-${version}";
+
+  src = fetchurl {
+    url = "http://releases.ansible.com/ansible/${name}.tar.gz";
+    sha256 = "1sv8666vw6fi93jlgkwd4lxkfn75yqczfvk129zlh8ll4wjv8qq5";
+  };
+
+  prePatch = ''
+    sed -i "s,/usr/,$out," lib/ansible/constants.py
+  '';
+
+  doCheck = false;
+  dontStrip = true;
+  dontPatchELF = true;
+  dontPatchShebangs = false;
+
+  propagatedBuildInputs = with pythonPackages; [
+    pycrypto paramiko jinja2 pyyaml httplib2 boto six netaddr dns
+  ] ++ stdenv.lib.optional windowsSupport pywinrm;
+
+  meta = with stdenv.lib; {
+    homepage = http://www.ansible.com;
+    description = "A simple automation tool";
+    license = with licenses; [ gpl3 ] ;
+    maintainers = with maintainers; [
+      jgeerds
+      joamaki
+    ];
+    platforms = with platforms; linux ++ darwin;
+  };
+}
diff --git a/pkgs/tools/admin/ansible/2.4.nix b/pkgs/tools/admin/ansible/2.4.nix
new file mode 100644
index 000000000000..80bd33bc7769
--- /dev/null
+++ b/pkgs/tools/admin/ansible/2.4.nix
@@ -0,0 +1,40 @@
+{ stdenv
+, fetchurl
+, pythonPackages
+, windowsSupport ? false
+}:
+
+pythonPackages.buildPythonPackage rec {
+  pname = "ansible";
+  version = "2.4.1.0";
+  name = "${pname}-${version}";
+
+  src = fetchurl {
+    url = "http://releases.ansible.com/ansible/${name}.tar.gz";
+    sha256 = "0spv0kjaicwss4q52s727b6grdizcxpa0bbsfg26pgf5kjrayqfs";
+  };
+
+  prePatch = ''
+    sed -i "s,/usr/,$out," lib/ansible/constants.py
+  '';
+
+  doCheck = false;
+  dontStrip = true;
+  dontPatchELF = true;
+  dontPatchShebangs = false;
+
+  propagatedBuildInputs = with pythonPackages; [
+    pycrypto paramiko jinja2 pyyaml httplib2 boto six netaddr dns
+  ] ++ stdenv.lib.optional windowsSupport pywinrm;
+
+  meta = with stdenv.lib; {
+    homepage = http://www.ansible.com;
+    description = "A simple automation tool";
+    license = with licenses; [ gpl3 ];
+    maintainers = with maintainers; [
+      jgeerds
+      joamaki
+    ];
+    platforms = with platforms; linux ++ darwin;
+  };
+}
diff --git a/pkgs/tools/admin/aws_shell/default.nix b/pkgs/tools/admin/aws_shell/default.nix
new file mode 100644
index 000000000000..6eee98269481
--- /dev/null
+++ b/pkgs/tools/admin/aws_shell/default.nix
@@ -0,0 +1,42 @@
+{ stdenv
+, buildPythonPackage
+, fetchPypi
+, awscli
+, prompt_toolkit
+, boto3
+, configobj
+, pygments
+}:
+
+buildPythonPackage rec {
+  pname = "aws-shell";
+  version = "0.1.1";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1pw9lrdjl24n6lrs6lnqpyiyic8bdxgvhyqvb2rx6kkbjrfhhgv5";
+  };
+
+  # Why does it propagate packages that are used for testing?
+  propagatedBuildInputs = [
+    awscli
+    prompt_toolkit
+    boto3
+    configobj
+    pygments
+  ];
+
+  #Checks are failing due to missing TTY, which won't exist.
+  doCheck = false;
+  preCheck = ''
+    mkdir -p check-phase
+    export HOME=$(pwd)/check-phase
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/awslabs/aws-shell;
+    description = "An integrated shell for working with the AWS CLI";
+    license = licenses.asl20;
+    maintainers = [ ];
+  };
+}
diff --git a/pkgs/tools/admin/awscli/default.nix b/pkgs/tools/admin/awscli/default.nix
new file mode 100644
index 000000000000..8061cbfded80
--- /dev/null
+++ b/pkgs/tools/admin/awscli/default.nix
@@ -0,0 +1,68 @@
+{ stdenv
+, buildPythonPackage
+, fetchPypi
+, botocore
+, bcdoc
+, s3transfer
+, six
+, colorama
+, docutils
+, rsa
+, pyyaml
+, groff
+, less
+}:
+
+let
+  colorama_3_7 = colorama.overrideAttrs (old: rec {
+    name = "${pname}-${version}";
+    pname = "colorama";
+    version = "0.3.7";
+    src = fetchPypi {
+      inherit pname version;
+      sha256 = "0avqkn6362v7k2kg3afb35g4sfdvixjgy890clip4q174p9whhz0";
+    };
+  });
+
+in buildPythonPackage rec {
+  name = "${pname}-${version}";
+  pname = "awscli";
+  version = "1.11.185";
+  namePrefix = "";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "18rskl6sla456z4hkq2gmmm03fqc4rqw5pfiqdyc7a2v9kljv4ah";
+  };
+
+  # No tests included
+  doCheck = false;
+
+  propagatedBuildInputs = [
+    botocore
+    bcdoc
+    s3transfer
+    six
+    colorama_3_7
+    docutils
+    rsa
+    pyyaml
+    groff
+    less
+  ];
+
+  postInstall = ''
+    mkdir -p $out/etc/bash_completion.d
+    echo "complete -C $out/bin/aws_completer aws" > $out/etc/bash_completion.d/awscli
+    mkdir -p $out/share/zsh/site-functions
+    mv $out/bin/aws_zsh_completer.sh $out/share/zsh/site-functions
+    rm $out/bin/aws.cmd
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = https://aws.amazon.com/cli/;
+    description = "Unified tool to manage your AWS services";
+    license = stdenv.lib.licenses.asl20;
+    maintainers = with maintainers; [ muflax ];
+  };
+}
diff --git a/pkgs/tools/admin/awslogs/default.nix b/pkgs/tools/admin/awslogs/default.nix
index dffef09a5d4a..ec7febaa5985 100644
--- a/pkgs/tools/admin/awslogs/default.nix
+++ b/pkgs/tools/admin/awslogs/default.nix
@@ -2,13 +2,13 @@
 
 pythonPackages.buildPythonApplication rec {
   name = "awslogs-${version}";
-  version = "0.7";
+  version = "0.10";
 
   src = fetchFromGitHub {
     owner = "jorgebastida";
     repo = "awslogs";
     rev = "${version}";
-    sha256 = "0dqf26h595l1fcnagxi8zsdarsxg3smsihxaqrvnki8fshhfdqsm";
+    sha256 = "18s3xxdhhbz96mgj9ipgyrdcax3p9gy8gpmr0rblw8g0grj31dsp";
   };
 
   doCheck = false;
diff --git a/pkgs/tools/admin/bubblewrap/default.nix b/pkgs/tools/admin/bubblewrap/default.nix
index bda3cb83cf7e..4ccdbc204f0a 100644
--- a/pkgs/tools/admin/bubblewrap/default.nix
+++ b/pkgs/tools/admin/bubblewrap/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "bubblewrap-${version}";
-  version = "0.1.8";
+  version = "0.2.0";
 
   src = fetchurl {
     url = "https://github.com/projectatomic/bubblewrap/releases/download/v${version}/${name}.tar.xz";
-    sha256 = "1gyy7paqwdrfgxamxya991588ryj9q9c3rhdh31qldqyh9qpy72c";
+    sha256 = "0ahw30ngpclk3ssa81cb7ydc6a4xc5dpqn6kmxfpc9xr30vimdnc";
   };
 
   nativeBuildInputs = [ libcap libxslt docbook_xsl ];
diff --git a/pkgs/tools/admin/fastlane/Gemfile b/pkgs/tools/admin/fastlane/Gemfile
new file mode 100644
index 000000000000..1fa8dbca63b1
--- /dev/null
+++ b/pkgs/tools/admin/fastlane/Gemfile
@@ -0,0 +1,2 @@
+source 'https://rubygems.org'
+gem 'fastlane'
diff --git a/pkgs/tools/admin/fastlane/Gemfile.lock b/pkgs/tools/admin/fastlane/Gemfile.lock
new file mode 100644
index 000000000000..30c75f19fbf8
--- /dev/null
+++ b/pkgs/tools/admin/fastlane/Gemfile.lock
@@ -0,0 +1,139 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    CFPropertyList (2.3.5)
+    addressable (2.5.2)
+      public_suffix (>= 2.0.2, < 4.0)
+    babosa (1.0.2)
+    claide (1.0.2)
+    colored (1.2)
+    colored2 (3.1.2)
+    commander-fastlane (4.4.5)
+      highline (~> 1.7.2)
+    declarative (0.0.10)
+    declarative-option (0.1.0)
+    domain_name (0.5.20170404)
+      unf (>= 0.0.5, < 1.0.0)
+    dotenv (2.2.1)
+    excon (0.59.0)
+    faraday (0.13.1)
+      multipart-post (>= 1.2, < 3)
+    faraday-cookie_jar (0.0.6)
+      faraday (>= 0.7.4)
+      http-cookie (~> 1.0.0)
+    faraday_middleware (0.12.2)
+      faraday (>= 0.7.4, < 1.0)
+    fastimage (2.1.0)
+    fastlane (2.63.0)
+      CFPropertyList (>= 2.3, < 3.0.0)
+      addressable (>= 2.3, < 3.0.0)
+      babosa (>= 1.0.2, < 2.0.0)
+      bundler (>= 1.12.0, < 2.0.0)
+      colored
+      commander-fastlane (>= 4.4.5, < 5.0.0)
+      dotenv (>= 2.1.1, < 3.0.0)
+      excon (>= 0.45.0, < 1.0.0)
+      faraday (~> 0.9)
+      faraday-cookie_jar (~> 0.0.6)
+      faraday_middleware (~> 0.9)
+      fastimage (>= 2.1.0, < 3.0.0)
+      gh_inspector (>= 1.0.1, < 2.0.0)
+      google-api-client (>= 0.13.1, < 0.14.0)
+      highline (>= 1.7.2, < 2.0.0)
+      json (< 3.0.0)
+      mini_magick (~> 4.5.1)
+      multi_json
+      multi_xml (~> 0.5)
+      multipart-post (~> 2.0.0)
+      plist (>= 3.1.0, < 4.0.0)
+      public_suffix (~> 2.0.0)
+      rubyzip (>= 1.1.0, < 2.0.0)
+      security (= 0.1.3)
+      slack-notifier (>= 1.3, < 2.0.0)
+      terminal-notifier (>= 1.6.2, < 2.0.0)
+      terminal-table (>= 1.4.5, < 2.0.0)
+      tty-screen (~> 0.5.0)
+      word_wrap (~> 1.0.0)
+      xcodeproj (>= 1.5.0, < 2.0.0)
+      xcpretty (>= 0.2.4, < 1.0.0)
+      xcpretty-travis-formatter (>= 0.0.3)
+    gh_inspector (1.0.3)
+    google-api-client (0.13.6)
+      addressable (~> 2.5, >= 2.5.1)
+      googleauth (~> 0.5)
+      httpclient (>= 2.8.1, < 3.0)
+      mime-types (~> 3.0)
+      representable (~> 3.0)
+      retriable (>= 2.0, < 4.0)
+    googleauth (0.6.1)
+      faraday (~> 0.12)
+      jwt (>= 1.4, < 3.0)
+      logging (~> 2.0)
+      memoist (~> 0.12)
+      multi_json (~> 1.11)
+      os (~> 0.9)
+      signet (~> 0.7)
+    highline (1.7.8)
+    http-cookie (1.0.3)
+      domain_name (~> 0.5)
+    httpclient (2.8.3)
+    json (2.1.0)
+    jwt (2.1.0)
+    little-plugger (1.1.4)
+    logging (2.2.2)
+      little-plugger (~> 1.1)
+      multi_json (~> 1.10)
+    memoist (0.16.0)
+    mime-types (3.1)
+      mime-types-data (~> 3.2015)
+    mime-types-data (3.2016.0521)
+    mini_magick (4.5.1)
+    multi_json (1.12.2)
+    multi_xml (0.6.0)
+    multipart-post (2.0.0)
+    nanaimo (0.2.3)
+    os (0.9.6)
+    plist (3.3.0)
+    public_suffix (2.0.5)
+    representable (3.0.4)
+      declarative (< 0.1.0)
+      declarative-option (< 0.2.0)
+      uber (< 0.2.0)
+    retriable (3.1.1)
+    rouge (2.0.7)
+    rubyzip (1.2.1)
+    security (0.1.3)
+    signet (0.8.1)
+      addressable (~> 2.3)
+      faraday (~> 0.9)
+      jwt (>= 1.5, < 3.0)
+      multi_json (~> 1.10)
+    slack-notifier (1.5.1)
+    terminal-notifier (1.8.0)
+    terminal-table (1.8.0)
+      unicode-display_width (~> 1.1, >= 1.1.1)
+    tty-screen (0.5.1)
+    uber (0.1.0)
+    unf (0.1.4)
+      unf_ext
+    unf_ext (0.0.7.4)
+    unicode-display_width (1.3.0)
+    word_wrap (1.0.0)
+    xcodeproj (1.5.3)
+      CFPropertyList (~> 2.3.3)
+      claide (>= 1.0.2, < 2.0)
+      colored2 (~> 3.1)
+      nanaimo (~> 0.2.3)
+    xcpretty (0.2.8)
+      rouge (~> 2.0.7)
+    xcpretty-travis-formatter (1.0.0)
+      xcpretty (~> 0.2, >= 0.0.7)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  fastlane
+
+BUNDLED WITH
+   1.14.6
diff --git a/pkgs/tools/admin/fastlane/default.nix b/pkgs/tools/admin/fastlane/default.nix
new file mode 100644
index 000000000000..b9008c919bf3
--- /dev/null
+++ b/pkgs/tools/admin/fastlane/default.nix
@@ -0,0 +1,17 @@
+{ lib, bundlerEnv, ruby }:
+
+bundlerEnv rec {
+  inherit ruby;
+  pname = "fastlane";
+  gemdir = ./.;
+
+  meta = with lib; {
+    description     = "A tool to automate building and releasing iOS and Android apps";
+    longDescription = "fastlane is a tool for iOS and Android developers to automate tedious tasks like generating screenshots, dealing with provisioning profiles, and releasing your application.";
+    homepage        = https://github.com/fastlane/fastlane;
+    license         = licenses.mit;
+    maintainers     = with maintainers; [
+      peterromfeldhk
+    ];
+  };
+}
diff --git a/pkgs/tools/admin/fastlane/gemset.nix b/pkgs/tools/admin/fastlane/gemset.nix
new file mode 100644
index 000000000000..8dd51a5733e6
--- /dev/null
+++ b/pkgs/tools/admin/fastlane/gemset.nix
@@ -0,0 +1,469 @@
+{
+  addressable = {
+    dependencies = ["public_suffix"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0viqszpkggqi8hq87pqp0xykhvz60g99nwmkwsb0v45kc2liwxvk";
+      type = "gem";
+    };
+    version = "2.5.2";
+  };
+  babosa = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "05rgxg4pz4bc4xk34w5grv0yp1j94wf571w84lf3xgqcbs42ip2f";
+      type = "gem";
+    };
+    version = "1.0.2";
+  };
+  CFPropertyList = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "06dddgcai6nay552h8wmnb2m93xx5hni48s16vkbf9vbym4nfw5x";
+      type = "gem";
+    };
+    version = "2.3.5";
+  };
+  claide = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0az54rp691hc42yl1xyix2cxv58byhaaf4gxbpghvvq29l476rzc";
+      type = "gem";
+    };
+    version = "1.0.2";
+  };
+  colored = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0b0x5jmsyi0z69bm6sij1k89z7h0laag3cb4mdn7zkl9qmxb90lx";
+      type = "gem";
+    };
+    version = "1.2";
+  };
+  colored2 = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0jlbqa9q4mvrm73aw9mxh23ygzbjiqwisl32d8szfb5fxvbjng5i";
+      type = "gem";
+    };
+    version = "3.1.2";
+  };
+  commander-fastlane = {
+    dependencies = ["highline"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "04gpg733wv878acvrzp4kc3k934v10l3v8bcz3fjq5imjsrjdnbp";
+      type = "gem";
+    };
+    version = "4.4.5";
+  };
+  declarative = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0642xvwzzbgi3kp1bg467wma4g3xqrrn0sk369hjam7w579gnv5j";
+      type = "gem";
+    };
+    version = "0.0.10";
+  };
+  declarative-option = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1g4ibxq566f1frnhdymzi9hxxcm4g2gw4n21mpjk2mhwym4q6l0p";
+      type = "gem";
+    };
+    version = "0.1.0";
+  };
+  domain_name = {
+    dependencies = ["unf"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "12hs8yijhak7p2hf1xkh98g0mnp5phq3mrrhywzaxpwz1gw5r3kf";
+      type = "gem";
+    };
+    version = "0.5.20170404";
+  };
+  dotenv = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1pgzlvs0sswnqlgfm9gkz2hlhkc0zd3vnlp2vglb1wbgnx37pjjv";
+      type = "gem";
+    };
+    version = "2.2.1";
+  };
+  excon = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0mnc9lqlzwqj5ayp0lh7impisqm55mdg3mw5q4gi9yjic5sidc40";
+      type = "gem";
+    };
+    version = "0.59.0";
+  };
+  faraday = {
+    dependencies = ["multipart-post"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1gyqsj7vlqynwvivf9485zwmcj04v1z7gq362z0b8zw2zf4ag0hw";
+      type = "gem";
+    };
+    version = "0.13.1";
+  };
+  faraday-cookie_jar = {
+    dependencies = ["faraday" "http-cookie"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1di4gx6446a6zdkrpj679m5k515i53wvb4yxcsqvy8d8zacxiiv6";
+      type = "gem";
+    };
+    version = "0.0.6";
+  };
+  faraday_middleware = {
+    dependencies = ["faraday"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1p7icfl28nvl8qqdsngryz1snqic9l8x6bk0dxd7ygn230y0k41d";
+      type = "gem";
+    };
+    version = "0.12.2";
+  };
+  fastimage = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1fh80nwjxm63phcdg55haz9q877fxgvnkazjihaqbf8ginn6g00v";
+      type = "gem";
+    };
+    version = "2.1.0";
+  };
+  fastlane = {
+    dependencies = ["CFPropertyList" "addressable" "babosa" "colored" "commander-fastlane" "dotenv" "excon" "faraday" "faraday-cookie_jar" "faraday_middleware" "fastimage" "gh_inspector" "google-api-client" "highline" "json" "mini_magick" "multi_json" "multi_xml" "multipart-post" "plist" "public_suffix" "rubyzip" "security" "slack-notifier" "terminal-notifier" "terminal-table" "tty-screen" "word_wrap" "xcodeproj" "xcpretty" "xcpretty-travis-formatter"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1al75bb3zq0y9r1ilrbhks198zmvwykmqnn2675jd9i2ijcbxv78";
+      type = "gem";
+    };
+    version = "2.63.0";
+  };
+  gh_inspector = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1lxvp8xpjd2cazzcp90phy567spp4v41bnk9awgx8absndv70k1x";
+      type = "gem";
+    };
+    version = "1.0.3";
+  };
+  google-api-client = {
+    dependencies = ["addressable" "googleauth" "httpclient" "mime-types" "representable" "retriable"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0ac9qa0kwnirkvwz2w9zf07lqcgbmnvgd1wg8xxyjbadwsbpyf1y";
+      type = "gem";
+    };
+    version = "0.13.6";
+  };
+  googleauth = {
+    dependencies = ["faraday" "jwt" "logging" "memoist" "multi_json" "os" "signet"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "13laklpf99m3qzq9n3vnc9dblgw7q05n1r16jlxsh4lxlaijr0sf";
+      type = "gem";
+    };
+    version = "0.6.1";
+  };
+  highline = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1nf5lgdn6ni2lpfdn4gk3gi47fmnca2bdirabbjbz1fk9w4p8lkr";
+      type = "gem";
+    };
+    version = "1.7.8";
+  };
+  http-cookie = {
+    dependencies = ["domain_name"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "004cgs4xg5n6byjs7qld0xhsjq3n6ydfh897myr2mibvh6fjc49g";
+      type = "gem";
+    };
+    version = "1.0.3";
+  };
+  httpclient = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "19mxmvghp7ki3klsxwrlwr431li7hm1lczhhj8z4qihl2acy8l99";
+      type = "gem";
+    };
+    version = "2.8.3";
+  };
+  json = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "01v6jjpvh3gnq6sgllpfqahlgxzj50ailwhj9b3cd20hi2dx0vxp";
+      type = "gem";
+    };
+    version = "2.1.0";
+  };
+  jwt = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1w0kaqrbl71cq9sbnixc20x5lqah3hs2i93xmhlfdg2y3by7yzky";
+      type = "gem";
+    };
+    version = "2.1.0";
+  };
+  little-plugger = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1frilv82dyxnlg8k1jhrvyd73l6k17mxc5vwxx080r4x1p04gwym";
+      type = "gem";
+    };
+    version = "1.1.4";
+  };
+  logging = {
+    dependencies = ["little-plugger" "multi_json"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "06j6iaj89h9jhkx1x3hlswqrfnqds8br05xb1qra69dpvbdmjcwn";
+      type = "gem";
+    };
+    version = "2.2.2";
+  };
+  memoist = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0pq8fhqh8w25qcw9v3vzfb0i6jp0k3949ahxc3wrwz2791dpbgbh";
+      type = "gem";
+    };
+    version = "0.16.0";
+  };
+  mime-types = {
+    dependencies = ["mime-types-data"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0087z9kbnlqhci7fxh9f6il63hj1k02icq2rs0c6cppmqchr753m";
+      type = "gem";
+    };
+    version = "3.1";
+  };
+  mime-types-data = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "04my3746hwa4yvbx1ranhfaqkgf6vavi1kyijjnw8w3dy37vqhkm";
+      type = "gem";
+    };
+    version = "3.2016.0521";
+  };
+  mini_magick = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1a59k5l29vj060yscaqk370rg5vyr132kbw6x3zar7khzjqjqd8p";
+      type = "gem";
+    };
+    version = "4.5.1";
+  };
+  multi_json = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1raim9ddjh672m32psaa9niw67ywzjbxbdb8iijx3wv9k5b0pk2x";
+      type = "gem";
+    };
+    version = "1.12.2";
+  };
+  multi_xml = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0lmd4f401mvravi1i1yq7b2qjjli0yq7dfc4p1nj5nwajp7r6hyj";
+      type = "gem";
+    };
+    version = "0.6.0";
+  };
+  multipart-post = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "09k0b3cybqilk1gwrwwain95rdypixb2q9w65gd44gfzsd84xi1x";
+      type = "gem";
+    };
+    version = "2.0.0";
+  };
+  nanaimo = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0z6rbji02x75vm5jw4hbpp75khp4z5yfgbaz1h9l8aa00hqf0fxd";
+      type = "gem";
+    };
+    version = "0.2.3";
+  };
+  os = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1llv8w3g2jwggdxr5a5cjkrnbbfnvai3vxacxxc0fy84xmz3hymz";
+      type = "gem";
+    };
+    version = "0.9.6";
+  };
+  plist = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0k0pyqrjcz9kn1b3ahsfs9aqym7s7yzz0vavya0zn0mca3jw2zqc";
+      type = "gem";
+    };
+    version = "3.3.0";
+  };
+  public_suffix = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "040jf98jpp6w140ghkhw2hvc1qx41zvywx5gj7r2ylr1148qnj7q";
+      type = "gem";
+    };
+    version = "2.0.5";
+  };
+  representable = {
+    dependencies = ["declarative" "declarative-option" "uber"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0qm9rgi1j5a6nv726ka4mmixivlxfsg91h8rpp72wwd4vqbkkm07";
+      type = "gem";
+    };
+    version = "3.0.4";
+  };
+  retriable = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0pnriyn9zh120hxm92vb12hfsf7c98nawyims1shxj3ldpl0l3ar";
+      type = "gem";
+    };
+    version = "3.1.1";
+  };
+  rouge = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0sfikq1q8xyqqx690iiz7ybhzx87am4w50w8f2nq36l3asw4x89d";
+      type = "gem";
+    };
+    version = "2.0.7";
+  };
+  rubyzip = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "06js4gznzgh8ac2ldvmjcmg9v1vg9llm357yckkpylaj6z456zqz";
+      type = "gem";
+    };
+    version = "1.2.1";
+  };
+  security = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1ryjxs0j66wrbky2c08yf0mllwalvpg12rpxzbdx2rdhj3cbrlxa";
+      type = "gem";
+    };
+    version = "0.1.3";
+  };
+  signet = {
+    dependencies = ["addressable" "faraday" "jwt" "multi_json"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0js81lxqirdza8gf2f6avh11fny49ygmxfi1qx7jp8l9wrhznbkv";
+      type = "gem";
+    };
+    version = "0.8.1";
+  };
+  slack-notifier = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0xavibxh00gy62mm79l6id9l2fldjmdqifk8alqfqy5z38ffwah6";
+      type = "gem";
+    };
+    version = "1.5.1";
+  };
+  terminal-notifier = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0vy75sbq236v1p83jj6r3a9d52za5lqj2vj24np9lrszdczm9zcb";
+      type = "gem";
+    };
+    version = "1.8.0";
+  };
+  terminal-table = {
+    dependencies = ["unicode-display_width"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1512cngw35hsmhvw4c05rscihc59mnj09m249sm9p3pik831ydqk";
+      type = "gem";
+    };
+    version = "1.8.0";
+  };
+  tty-screen = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "12qkjwpkgznvhwbywq2y7l5mcq2f4z404b0ip7xm4byg3827lh4h";
+      type = "gem";
+    };
+    version = "0.5.1";
+  };
+  uber = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1p1mm7mngg40x05z52md3mbamkng0zpajbzqjjwmsyw0zw3v9vjv";
+      type = "gem";
+    };
+    version = "0.1.0";
+  };
+  unf = {
+    dependencies = ["unf_ext"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0bh2cf73i2ffh4fcpdn9ir4mhq8zi50ik0zqa1braahzadx536a9";
+      type = "gem";
+    };
+    version = "0.1.4";
+  };
+  unf_ext = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "14hr2dzqh33kqc0xchs8l05pf3kjcayvad4z1ip5rdjxrkfk8glb";
+      type = "gem";
+    };
+    version = "0.0.7.4";
+  };
+  unicode-display_width = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "12pi0gwqdnbx1lv5136v3vyr0img9wr0kxcn4wn54ipq4y41zxq8";
+      type = "gem";
+    };
+    version = "1.3.0";
+  };
+  word_wrap = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1iyc5bc7dbgsd8j3yk1i99ral39f23l6wapi0083fbl19hid8mpm";
+      type = "gem";
+    };
+    version = "1.0.0";
+  };
+  xcodeproj = {
+    dependencies = ["CFPropertyList" "claide" "colored2" "nanaimo"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1gvnd5ixa4wbn1cpc6jp6i9z0dxhcwlxny47irzbr6zr8wpj3ww7";
+      type = "gem";
+    };
+    version = "1.5.3";
+  };
+  xcpretty = {
+    dependencies = ["rouge"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1b8x9m53a1hbw0lamffjm4m1ydigj3azl97jc5w7prv1bm27s2y3";
+      type = "gem";
+    };
+    version = "0.2.8";
+  };
+  xcpretty-travis-formatter = {
+    dependencies = ["xcpretty"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "15b5c0lxz2blmichfdlabzlbyw5nlh1ci898pxwb661m9bahz3ml";
+      type = "gem";
+    };
+    version = "1.0.0";
+  };
+}
\ No newline at end of file
diff --git a/pkgs/tools/admin/fastlane/update b/pkgs/tools/admin/fastlane/update
new file mode 100755
index 000000000000..22d1e52e2977
--- /dev/null
+++ b/pkgs/tools/admin/fastlane/update
@@ -0,0 +1,10 @@
+#!/usr/bin/env nix-shell
+#! nix-shell -i bash -p bash ruby bundler bundix
+
+rm Gemfile.lock
+bundler install
+bundix
+
+if [ "clean" == "$1" ]; then
+  rm -r ~/.gem
+fi
diff --git a/pkgs/tools/admin/google-cloud-sdk/default.nix b/pkgs/tools/admin/google-cloud-sdk/default.nix
index d31f3023c969..3622b981cc4f 100644
--- a/pkgs/tools/admin/google-cloud-sdk/default.nix
+++ b/pkgs/tools/admin/google-cloud-sdk/default.nix
@@ -1,33 +1,34 @@
-{stdenv, fetchurl, python27, python27Packages, makeWrapper}:
-
-with python27Packages;
+{ stdenv, lib, fetchurl, python, cffi, cryptography, pyopenssl, crcmod, google-compute-engine, makeWrapper }:
 
 # other systems not supported yet
-assert stdenv.system == "i686-linux" || stdenv.system == "x86_64-linux" || stdenv.system == "x86_64-darwin";
-
-stdenv.mkDerivation rec {
+let
+  pythonInputs = [ cffi cryptography pyopenssl crcmod google-compute-engine ];
+  pythonPath = lib.makeSearchPath python.sitePackages pythonInputs;
+
+  sources = name: system: {
+    i686-linux = {
+      url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/${name}-linux-x86.tar.gz";
+      sha256 = "0aq938s1w9mzj60avmcc68kgll54pl7635vl2mi89f6r56n0xslp";
+    };
+
+    x86_64-darwin = {
+      url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/${name}-darwin-x86_64.tar.gz";
+      sha256 = "13k2i1svry9q800s1jgf8jss0rzfxwk6qci3hsy1wrb9b2mwlz5g";
+    };
+
+    x86_64-linux = {
+      url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/${name}-linux-x86_64.tar.gz";
+      sha256 = "1kvaz8p1iflsi85wwi7lb6km6frj70xsricyz1ah0sw3q71zyqmc";
+    };
+  }.${system};
+
+in stdenv.mkDerivation rec {
   name = "google-cloud-sdk-${version}";
-  version = "161.0.0";
-
-  src =
-    if stdenv.system == "i686-linux" then
-      fetchurl {
-        url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/${name}-linux-x86.tar.gz";
-        sha256 = "43a78a9d2c3ee9d9e50200b1e90512cd53ded40b56e05effe31fe9847b1bdd4c";
-      }
-    else if stdenv.system == "x86_64-darwin" then
-      fetchurl {
-        url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/${name}-darwin-x86_64.tar.gz";
-        sha256 = "0706dbea1279be2bc98a497d1bfed61a9cc29c305d908a376bcdb4403035b323";
-      }
-    else
-      fetchurl {
-        url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/${name}-linux-x86_64.tar.gz";
-        sha256 = "7aa6094d1f9c87f4c2c4a6bdad6a1113aac5e72ea673e659d9acbb059dfd037e";
-      };
-
-
-  buildInputs = [python27 makeWrapper];
+  version = "177.0.0";
+
+  src = fetchurl (sources name stdenv.system);
+
+  buildInputs = [ python makeWrapper ];
 
   phases = [ "installPhase" "fixupPhase" ];
 
@@ -46,16 +47,13 @@ stdenv.mkDerivation rec {
         programPath="$out/google-cloud-sdk/bin/$program"
         binaryPath="$out/bin/$program"
         wrapProgram "$programPath" \
-            --set CLOUDSDK_PYTHON "${python27}/bin/python" \
-            --prefix PYTHONPATH : "$(toPythonPath ${cffi}):$(toPythonPath ${cryptography}):$(toPythonPath ${pyopenssl}):$(toPythonPath ${crcmod})"
+            --set CLOUDSDK_PYTHON "${python}/bin/python" \
+            --prefix PYTHONPATH : "${pythonPath}"
 
         mkdir -p $out/bin
         ln -s $programPath $binaryPath
     done
 
-    # install man pages
-    mv "$out/google-cloud-sdk/help/man" "$out"
-
     # setup bash completion
     mkdir -p "$out/etc/bash_completion.d/"
     mv "$out/google-cloud-sdk/completion.bash.inc" "$out/etc/bash_completion.d/gcloud.inc"
@@ -68,11 +66,10 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     description = "Tools for the google cloud platform";
     longDescription = "The Google Cloud SDK. This package has the programs: gcloud, gsutil, and bq";
-    version = version;
     # This package contains vendored dependencies. All have free licenses.
     license = licenses.free;
-    homepage = https://cloud.google.com/sdk/;
-    maintainers = with maintainers; [stephenmw zimbatm];
-    platforms = with platforms; linux ++ darwin;
+    homepage = "https://cloud.google.com/sdk/";
+    maintainers = with maintainers; [ stephenmw zimbatm ];
+    platforms = [ "i686-linux" "x86_64-linux" "x86_64-darwin" ];
   };
 }
diff --git a/pkgs/tools/admin/gtk-vnc/default.nix b/pkgs/tools/admin/gtk-vnc/default.nix
index da269049b2ca..59a5ec8d4dad 100644
--- a/pkgs/tools/admin/gtk-vnc/default.nix
+++ b/pkgs/tools/admin/gtk-vnc/default.nix
@@ -15,11 +15,13 @@ in stdenv.mkDerivation rec {
     sha256 = "0gj8dpy3sj4dp810gy67spzh5f0jd8aqg69clcwqjcskj1yawbiw";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    python gnutls cairo libtool pkgconfig glib libffi libgcrypt
+    python gnutls cairo libtool glib libffi libgcrypt
     intltool cyrus_sasl libpulseaudio perl perlPackages.TextCSV
     gobjectIntrospection libogg libgpgerror
-    gtk3 vala_0_32 pygobject3 ];
+    gtk3 vala_0_32 pygobject3
+  ];
 
   NIX_CFLAGS_COMPILE = "-fstack-protector-all";
   configureFlags = [
diff --git a/pkgs/tools/admin/intecture/agent.nix b/pkgs/tools/admin/intecture/agent.nix
index 27891614f4b2..2b663cd3bcee 100644
--- a/pkgs/tools/admin/intecture/agent.nix
+++ b/pkgs/tools/admin/intecture/agent.nix
@@ -5,16 +5,16 @@ with rustPlatform;
 
 buildRustPackage rec {
   name = "intecture-agent-${version}";
-  version = "0.3.0";
+  version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "intecture";
     repo = "agent";
     rev = version;
-    sha256 = "0b59ij9c7hv2p4jx96f3acbygw27wiv8cfzzg6sg73l6k244k6l6";
+    sha256 = "0j27qdgyxybaixggh7k57mpm6rifimn4z2vydk463msc8b3kgywj";
   };
 
-  depsSha256 = "1f94j54pg94f2x2lmmyj8dlki8plq6vnppmf3hzk3kd0rp7fzban";
+  cargoSha256 = "1fcl2nnplcic729cmvall2k7wf3jdm7dspvlbxji99bn813ackig";
 
   buildInputs = [ openssl zeromq czmq zlib ];
 
diff --git a/pkgs/tools/admin/intecture/auth.nix b/pkgs/tools/admin/intecture/auth.nix
index 88ef137d841c..759230c6a293 100644
--- a/pkgs/tools/admin/intecture/auth.nix
+++ b/pkgs/tools/admin/intecture/auth.nix
@@ -5,16 +5,16 @@ with rustPlatform;
 
 buildRustPackage rec {
   name = "intecture-auth-${version}";
-  version = "0.1.0";
+  version = "0.1.2";
 
   src = fetchFromGitHub {
     owner = "intecture";
     repo = "auth";
     rev = version;
-    sha256 = "1p3jahha8k139f22ijg050cl8akfzxda4gzvijpqv869hmhc70py";
+    sha256 = "0c7ar3pc7n59lzfy74lwz51p09s2bglc870rfr4c0vmc91jl0pj2";
   };
 
-  depsSha256 = "0mki57yzb29y9fhh16xvpi5gfp6c14r5q3f45f3v8sdj95rjahz1";
+  cargoSha256 = "0q3mrcvl1yyrx4a88kanjlfcx6slf7r79i0dh4w81sj6gp07sssm";
 
   buildInputs = [ openssl zeromq czmq zlib ];
 
diff --git a/pkgs/tools/admin/intecture/cli.nix b/pkgs/tools/admin/intecture/cli.nix
index 0f530f636d78..a4ac74e9f2da 100644
--- a/pkgs/tools/admin/intecture/cli.nix
+++ b/pkgs/tools/admin/intecture/cli.nix
@@ -5,16 +5,16 @@ with rustPlatform;
 
 buildRustPackage rec {
   name = "intecture-cli-${version}";
-  version = "0.3.2";
+  version = "0.3.4";
 
   src = fetchFromGitHub {
     owner = "intecture";
     repo = "cli";
     rev = version;
-    sha256 = "0f5pyrlkxzz4kdfzwambxzqr48g3n06f1pv163h06ggssqa51wbc";
+    sha256 = "16a5fkpyqkf8w20k3ircc1d0qmif7nygkzxj6mzk9609dlb0dmxq";
   };
 
-  depsSha256 = "0f3rhjs5addppva4cjx3ngpa5gz2i2n46hyc3zd4l7lhh8gaggix";
+  cargoSha256 = "0qwbgwxrjc0dvjbpqa59jixy5nq7lng2c1z91rw48qc91v7fa664";
 
   buildInputs = [ openssl zeromq czmq zlib ];
 
diff --git a/pkgs/tools/admin/mycli/default.nix b/pkgs/tools/admin/mycli/default.nix
new file mode 100644
index 000000000000..bd0f051bd845
--- /dev/null
+++ b/pkgs/tools/admin/mycli/default.nix
@@ -0,0 +1,38 @@
+{ lib
+, python
+}:
+
+with python.pkgs;
+
+buildPythonApplication rec {
+  pname = "mycli";
+  version = "1.6.0";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0qg4b62kizyb16kk0cvpk70bfs3gg4q4hj2b15nnc7a3gqqfp67j";
+  };
+
+  propagatedBuildInputs = [
+    pymysql configobj sqlparse prompt_toolkit pygments click pycrypto
+  ];
+
+  postPatch = ''
+    substituteInPlace setup.py --replace "==" ">="
+  '';
+
+  # No tests in archive. Newer versions do include tests
+  doCheck = false;
+
+  meta = {
+    inherit version;
+    description = "Command-line interface for MySQL";
+    longDescription = ''
+      Rich command-line interface for MySQL with auto-completion and
+      syntax highlighting.
+    '';
+    homepage = http://mycli.net;
+    license = lib.licenses.bsd3;
+  };
+}
diff --git a/pkgs/tools/admin/salt/default.nix b/pkgs/tools/admin/salt/default.nix
index 7fdef68f30f7..b50564602256 100644
--- a/pkgs/tools/admin/salt/default.nix
+++ b/pkgs/tools/admin/salt/default.nix
@@ -8,12 +8,12 @@
 
 python2Packages.buildPythonApplication rec {
   pname = "salt";
-  version = "2016.11.5";
+  version = "2017.7.2";
   name = "${pname}-${version}";
 
   src = python2Packages.fetchPypi {
     inherit pname version;
-    sha256 = "1gpq6s87vy782z4b5h6s7zwndcxnllbdr2wldxr9hyp4lfj2f55q";
+    sha256 = "0h18zwp1w90rgxpmqgrmn9wp31h03f0vak8lpnnbh0dzbbgcffzz";
   };
 
   propagatedBuildInputs = with python2Packages; [
diff --git a/pkgs/tools/admin/salt/fix-libcrypto-loading.patch b/pkgs/tools/admin/salt/fix-libcrypto-loading.patch
index fa2c5c0aa521..f7560b1fc56d 100644
--- a/pkgs/tools/admin/salt/fix-libcrypto-loading.patch
+++ b/pkgs/tools/admin/salt/fix-libcrypto-loading.patch
@@ -1,11 +1,14 @@
 diff --git a/salt/utils/rsax931.py b/salt/utils/rsax931.py
-index 9eb1f4a..d764f7a 100644
+index f827cc6db8..b728595186 100644
 --- a/salt/utils/rsax931.py
 +++ b/salt/utils/rsax931.py
-@@ -36,7 +36,6 @@ def _load_libcrypto():
-                 'libcrypto.so*'))
+@@ -47,6 +47,9 @@ def _load_libcrypto():
              lib = lib[0] if len(lib) > 0 else None
--        if lib:
--            return cdll.LoadLibrary(lib)
-+        return cdll.LoadLibrary('@libcrypto@')
+         if lib:
+             return cdll.LoadLibrary(lib)
++        else:
++            return cdll.LoadLibrary('@libcrypto@')
++
          raise OSError('Cannot locate OpenSSL libcrypto')
+ 
+ 
diff --git a/pkgs/tools/admin/scaleway-cli/default.nix b/pkgs/tools/admin/scaleway-cli/default.nix
new file mode 100644
index 000000000000..0e8aacea4ef2
--- /dev/null
+++ b/pkgs/tools/admin/scaleway-cli/default.nix
@@ -0,0 +1,23 @@
+{ stdenv, fetchFromGitHub, buildGoPackage }:
+
+buildGoPackage rec{
+  name = "scaleway-cli-${version}";
+  version = "1.14";
+
+  goPackagePath = "github.com/scaleway/scaleway-cli";
+
+  src = fetchFromGitHub {
+    owner = "scaleway";
+    repo = "scaleway-cli";
+    rev = "v${version}";
+    sha256 = "09rqw82clfdiixa9m3hphxh5v7w1gks3wicz1dvpay2sx28bpddr";
+  };
+
+  meta = with stdenv.lib; {
+    description = "Interact with Scaleway API from the command line";
+    homepage = https://github.com/scaleway/scaleway-cli;
+    license = licenses.mit;
+    maintainers = with maintainers; [ nickhu ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/tools/admin/tigervnc/default.nix b/pkgs/tools/admin/tigervnc/default.nix
index 3df01dccced8..5ba53c75371e 100644
--- a/pkgs/tools/admin/tigervnc/default.nix
+++ b/pkgs/tools/admin/tigervnc/default.nix
@@ -5,7 +5,7 @@
 , cmake, gettext, libtool
 , glproto, mesa_glu
 , gnutls, pam, nettle
-, xterm }:
+, xterm, openssh }:
 
 with stdenv.lib;
 
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
 
   inherit fontDirectories;
 
-  patchPhase = ''
+  postPatch = ''
     sed -i -e '/^\$cmd \.= " -pn";/a$cmd .= " -xkbdir ${xkeyboard_config}/etc/X11/xkb";' unix/vncserver
     fontPath=
     for i in $fontDirectories; do
@@ -31,6 +31,8 @@ stdenv.mkDerivation rec {
       done
     done
     sed -i -e '/^\$cmd \.= " -pn";/a$cmd .= " -fp '"$fontPath"'";' unix/vncserver
+    substituteInPlace vncviewer/vncviewer.cxx \
+       --replace '"/usr/bin/ssh' '"${openssh}/bin/ssh'
   '';
 
   dontUseCmakeBuildDir = true;
@@ -85,9 +87,10 @@ stdenv.mkDerivation rec {
     glproto mesa_glu
   ] ++ xorgserver.buildInputs;
 
-  nativeBuildInputs = [ cmake zlib gettext libtool ] ++ xorg.xorgserver.nativeBuildInputs;
+  nativeBuildInputs = with xorg; [ cmake zlib gettext libtool utilmacros fontutil ]
+    ++ xorg.xorgserver.nativeBuildInputs;
 
-  propagatedNativeBuildInputs = xorg.xorgserver.propagatedNativeBuildInputs;
+  propagatedBuildInputs = xorg.xorgserver.propagatedBuildInputs;
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/tools/archivers/cromfs/default.nix b/pkgs/tools/archivers/cromfs/default.nix
index 042880b39c9b..00de2c2ec462 100644
--- a/pkgs/tools/archivers/cromfs/default.nix
+++ b/pkgs/tools/archivers/cromfs/default.nix
@@ -18,7 +18,8 @@ stdenv.mkDerivation rec {
     install util/unmkcromfs $out/bin
   '';
 
-  buildInputs = [ pkgconfig fuse perl ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ fuse perl ];
 
   meta = {
     description = "FUSE Compressed ROM filesystem with lzma";
diff --git a/pkgs/tools/archivers/runzip/default.nix b/pkgs/tools/archivers/runzip/default.nix
index 1ed453f0d4f8..f99ee963dbe6 100644
--- a/pkgs/tools/archivers/runzip/default.nix
+++ b/pkgs/tools/archivers/runzip/default.nix
@@ -4,7 +4,8 @@ stdenv.mkDerivation rec {
   version = "1.4";
   name = "runzip-${version}";
 
-  buildInputs = [ libzip autoreconfHook ];
+  nativeBuildInputs = [ autoreconfHook ];
+  buildInputs = [ libzip ];
 
   src = fetchFromGitHub {
     owner = "vlm";
diff --git a/pkgs/tools/archivers/sharutils/default.nix b/pkgs/tools/archivers/sharutils/default.nix
index 77ab8a1cb033..11072fc28dea 100644
--- a/pkgs/tools/archivers/sharutils/default.nix
+++ b/pkgs/tools/archivers/sharutils/default.nix
@@ -13,6 +13,16 @@ stdenv.mkDerivation rec {
   # GNU Gettext is needed on non-GNU platforms.
   buildInputs = [ coreutils gettext ];
 
+  # These tests try to hit /etc/passwd to find out your username if pass in a submitter
+  # name on the command line. Since we block access to /etc/passwd on the Darwin sandbox
+  # that cause shar to just segfault. It isn't a problem on Linux because their sandbox
+  # remaps /etc/passwd to a trivial file, but we can't do that on Darwin so I do this
+  # instead. In this case, I pass in the very imaginative "submitter" as the submitter name
+  patchPhase = ''
+    substituteInPlace tests/shar-1 --replace '$''\{SHAR}' '$''\{SHAR} -s submitter'
+    substituteInPlace tests/shar-2 --replace '$''\{SHAR}' '$''\{SHAR} -s submitter'
+  '';
+
   doCheck = true;
 
   crossAttrs = {
diff --git a/pkgs/tools/archivers/unrar/default.nix b/pkgs/tools/archivers/unrar/default.nix
index a1454229a1c8..9aedda83fd2c 100644
--- a/pkgs/tools/archivers/unrar/default.nix
+++ b/pkgs/tools/archivers/unrar/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "unrar-${version}";
-  version = "5.5.5";
+  version = "5.5.8";
 
   src = fetchurl {
-    url = "http://www.rarlab.com/rar/unrarsrc-${version}.tar.gz";
-    sha256 = "1vv1s1pa0pf1r0h7dw89ha9y68x7hdm82csnkh6ms0igrcwkhmd4";
+    url = "https://www.rarlab.com/rar/unrarsrc-${version}.tar.gz";
+    sha256 = "1x7wnb6zgs09v2bf5xaqz14daba8k7zikadj1qabqi4r78sy8rlv";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/archivers/xarchive/default.nix b/pkgs/tools/archivers/xarchive/default.nix
index 0cb4fbbf3f03..07e76ea7f62a 100644
--- a/pkgs/tools/archivers/xarchive/default.nix
+++ b/pkgs/tools/archivers/xarchive/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0chfim7z27s00naf43a61zsngwhvim14mg1p3csbv5i3f6m50xx4";
   };
 
-  buildInputs = [ gtk2 pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ gtk2 ];
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/tools/archivers/xarchiver/default.nix b/pkgs/tools/archivers/xarchiver/default.nix
index 6ed6a7f24021..1c8d8367793a 100644
--- a/pkgs/tools/archivers/xarchiver/default.nix
+++ b/pkgs/tools/archivers/xarchiver/default.nix
@@ -1,17 +1,18 @@
-{ stdenv, fetchFromGitHub, gtk2, pkgconfig, intltool }:
+{ stdenv, fetchFromGitHub, gtk3, pkgconfig, intltool, libxslt }:
 
 stdenv.mkDerivation rec {
-  version = "0.5.4.7";
+  version = "0.5.4.12";
   name = "xarchiver-${version}";
 
   src = fetchFromGitHub {
     owner = "ib";
     repo = "xarchiver";
-    rev = "${name}";
-    sha256 = "0w9lx8d8r50j48qfhn2r0dlcnwy3pjyy6xjvgpr0qagy5l1q1qj4";
+    rev = "${version}";
+    sha256 = "13d8slcx3frz0dhl1w4llj7001n57cjjb8r7dlaw5qacaas3xfwi";
   };
 
-  buildInputs = [ gtk2 pkgconfig intltool ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ gtk3 intltool libxslt ];
 
   meta = {
     description = "GTK+ frontend to 7z,zip,rar,tar,bzip2, gzip,arj, lha, rpm and deb (open and extract only)";
diff --git a/pkgs/tools/audio/abcm2ps/default.nix b/pkgs/tools/audio/abcm2ps/default.nix
new file mode 100644
index 000000000000..6fad1f755aa9
--- /dev/null
+++ b/pkgs/tools/audio/abcm2ps/default.nix
@@ -0,0 +1,30 @@
+{ stdenv, fetchFromGitHub, pkgconfig, which, freetype, pango }:
+
+stdenv.mkDerivation rec {
+  name = "abcm2ps-${version}";
+  version = "8.13.15";
+
+  src = fetchFromGitHub {
+    owner = "leesavide";
+    repo = "abcm2ps";
+    rev = "v${version}";
+    sha256 = "04j1s4ycd8siidj7xn7s0vwm5sj0qrhqr5qzpila2g8kjc4ldxml";
+  };
+
+  patchPhase = ''
+    chmod +x configure
+  '';
+
+  configureFlags = [
+    "--INSTALL=install"
+  ];
+
+  buildInputs = [ which pkgconfig freetype pango ];
+
+  meta = with stdenv.lib; {
+    homepage = http://moinejf.free.fr/;
+    license = licenses.gpl3;
+    description = "abcm2ps is a command line program which converts ABC to music sheet in PostScript or SVG format";
+    maintainers = [ maintainers.dotlambda ];
+  };
+}
diff --git a/pkgs/tools/audio/abcmidi/default.nix b/pkgs/tools/audio/abcmidi/default.nix
new file mode 100644
index 000000000000..cbb674f3801c
--- /dev/null
+++ b/pkgs/tools/audio/abcmidi/default.nix
@@ -0,0 +1,23 @@
+{ stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  name = "abcMIDI-${version}";
+  version = "2017.06.10";
+
+  src = fetchFromGitHub {
+    owner = "leesavide";
+    repo = "abcmidi";
+    rev = name;
+    sha256 = "0y92m3mj63vvy79ksq4z5hgkz6w50drg9a4bmbk6jylny0l0bdpy";
+  };
+
+  # There is also a file called "makefile" which seems to be preferred by the standard build phase
+  makefile = "Makefile";
+
+  meta = with stdenv.lib; {
+    homepage = http://abc.sourceforge.net/abcMIDI/;
+    license = licenses.gpl2Plus;
+    description = "abc <-> MIDI conversion utilities";
+    maintainers = [ maintainers.dotlambda ];
+  };
+}
diff --git a/pkgs/tools/audio/acoustid-fingerprinter/default.nix b/pkgs/tools/audio/acoustid-fingerprinter/default.nix
index ba029814f392..f68671bc6fba 100644
--- a/pkgs/tools/audio/acoustid-fingerprinter/default.nix
+++ b/pkgs/tools/audio/acoustid-fingerprinter/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
     sha256 = "0ckglwy95qgqvl2l6yd8ilwpd6qs7yzmj8g7lnxb50d12115s5n0";
   };
 
-  buildInputs = [ cmake pkgconfig qt4 taglib chromaprint ffmpeg ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ cmake qt4 taglib chromaprint ffmpeg ];
 
   cmakeFlags = [ "-DTAGLIB_MIN_VERSION=${(builtins.parseDrvName taglib.name).version}" ];
 
diff --git a/pkgs/tools/audio/beets/alternatives-plugin.nix b/pkgs/tools/audio/beets/alternatives-plugin.nix
index 116281e0a052..27be81733d3b 100644
--- a/pkgs/tools/audio/beets/alternatives-plugin.nix
+++ b/pkgs/tools/audio/beets/alternatives-plugin.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, pythonPackages }:
+{ stdenv, fetchFromGitHub, beets, pythonPackages }:
 
 pythonPackages.buildPythonApplication rec {
   name = "beets-alternatives-${version}";
@@ -13,8 +13,13 @@ pythonPackages.buildPythonApplication rec {
 
   postPatch = ''
     sed -i -e '/install_requires/,/\]/{/beets/d}' setup.py
+    sed -i -e '/test_suite/d' setup.py
   '';
 
+  nativeBuildInputs = [ beets pythonPackages.nose ];
+
+  checkPhase = "nosetests";
+
   propagatedBuildInputs = with pythonPackages; [ futures ];
 
   meta = {
diff --git a/pkgs/tools/audio/beets/copyartifacts-plugin.nix b/pkgs/tools/audio/beets/copyartifacts-plugin.nix
index fdd70db4e640..6f84e98d23e8 100644
--- a/pkgs/tools/audio/beets/copyartifacts-plugin.nix
+++ b/pkgs/tools/audio/beets/copyartifacts-plugin.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, pythonPackages }:
+{ stdenv, fetchFromGitHub, beets, pythonPackages, glibcLocales }:
 
 pythonPackages.buildPythonApplication rec {
   name = "beets-copyartifacts";
@@ -6,16 +6,25 @@ pythonPackages.buildPythonApplication rec {
   src = fetchFromGitHub {
     repo = "beets-copyartifacts";
     owner = "sbarakat";
-    rev = "dac4a1605111e24bb5b498aa84cead7c87480834";
-    sha256 = "0p5cskfgqinzh48a58hw56f96g9lar3k3g2p0ip1m9kawzf6axng";
+    rev = "4a5d347c858d25641c8a0eb7d8cb1a2cac10252a";
+    sha256 = "0bn6fci480ilghrdhpsjxxq29dxgni22sv1qalz770xy130g1zk3";
   };
 
   postPatch = ''
     sed -i -e '/install_requires/,/\]/{/beets/d}' setup.py
     sed -i -e '/namespace_packages/d' setup.py
     printf 'from pkgutil import extend_path\n__path__ = extend_path(__path__, __name__)\n' >beetsplug/__init__.py
+
+    # Skip test which is already failing upstream.
+    sed -i -e '1i import unittest' \
+           -e 's/\(^ *\)# failing/\1@unittest.skip/' \
+           tests/test_reimport.py
   '';
 
+  nativeBuildInputs = [ beets pythonPackages.nose glibcLocales ];
+
+  checkPhase = "LANG=en_US.UTF-8 nosetests";
+
   meta = {
     description = "Beets plugin to move non-music files during the import process";
     homepage = https://github.com/sbarakat/beets-copyartifacts;
diff --git a/pkgs/tools/audio/beets/default.nix b/pkgs/tools/audio/beets/default.nix
index ff033e62a8b6..7e9d0ff9d860 100644
--- a/pkgs/tools/audio/beets/default.nix
+++ b/pkgs/tools/audio/beets/default.nix
@@ -1,6 +1,9 @@
 { stdenv, fetchFromGitHub, writeScript, glibcLocales, diffPlugins
 , pythonPackages, imagemagick, gobjectIntrospection, gst_all_1
 
+# Attributes needed for tests of the external plugins
+, callPackage, beets
+
 , enableAcousticbrainz ? true
 , enableAcoustid       ? true
 , enableBadfiles       ? true, flac ? null, mp3val ? null
@@ -77,6 +80,19 @@ let
   testShell = "${bashInteractive}/bin/bash --norc";
   completion = "${bash-completion}/share/bash-completion/bash_completion";
 
+  # This is a stripped down beets for testing of the external plugins.
+  externalTestArgs.beets = (beets.override {
+    enableAlternatives = false;
+    enableCopyArtifacts = false;
+  }).overrideAttrs (stdenv.lib.const {
+    doInstallCheck = false;
+  });
+
+  plugins = {
+    alternatives = callPackage ./alternatives-plugin.nix externalTestArgs;
+    copyartifacts = callPackage ./copyartifacts-plugin.nix externalTestArgs;
+  };
+
 in pythonPackages.buildPythonApplication rec {
   name = "beets-${version}";
   version = "1.4.5";
@@ -101,26 +117,22 @@ in pythonPackages.buildPythonApplication rec {
     pythonPackages.gst-python
     pythonPackages.pygobject3
     gobjectIntrospection
-  ] ++ optional enableAcoustid     pythonPackages.pyacoustid
+  ] ++ optional enableAcoustid      pythonPackages.pyacoustid
     ++ optional (enableFetchart
               || enableEmbyupdate
               || enableKodiupdate
               || enableAcousticbrainz)
-                                   pythonPackages.requests
-    ++ optional enableConvert      ffmpeg
-    ++ optional enableDiscogs      pythonPackages.discogs_client
-    ++ optional enableGmusic       pythonPackages.gmusicapi
-    ++ optional enableKeyfinder    keyfinder-cli
-    ++ optional enableLastfm       pythonPackages.pylast
-    ++ optional enableMpd          pythonPackages.mpd2
-    ++ optional enableThumbnails   pythonPackages.pyxdg
-    ++ optional enableWeb          pythonPackages.flask
-    ++ optional enableAlternatives (import ./alternatives-plugin.nix {
-      inherit stdenv pythonPackages fetchFromGitHub;
-    })
-    ++ optional enableCopyArtifacts (import ./copyartifacts-plugin.nix {
-      inherit stdenv pythonPackages fetchFromGitHub;
-    });
+                                    pythonPackages.requests
+    ++ optional enableConvert       ffmpeg
+    ++ optional enableDiscogs       pythonPackages.discogs_client
+    ++ optional enableGmusic        pythonPackages.gmusicapi
+    ++ optional enableKeyfinder     keyfinder-cli
+    ++ optional enableLastfm        pythonPackages.pylast
+    ++ optional enableMpd           pythonPackages.mpd2
+    ++ optional enableThumbnails    pythonPackages.pyxdg
+    ++ optional enableWeb           pythonPackages.flask
+    ++ optional enableAlternatives  plugins.alternatives
+    ++ optional enableCopyArtifacts plugins.copyartifacts;
 
   buildInputs = with pythonPackages; [
     beautifulsoup4
diff --git a/pkgs/tools/audio/gvolicon/default.nix b/pkgs/tools/audio/gvolicon/default.nix
index 7354b92aaf94..8fed569f140f 100644
--- a/pkgs/tools/audio/gvolicon/default.nix
+++ b/pkgs/tools/audio/gvolicon/default.nix
@@ -8,8 +8,9 @@ stdenv.mkDerivation {
     sha256 = "1sr9wyy7w898vq63yd003yp3k66hd4vm8b0qsm9zvmwmpiz4wvln";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    pkgconfig makeWrapper alsaLib gnome3.gtk gdk_pixbuf gnome3.defaultIconTheme
+    makeWrapper alsaLib gnome3.gtk gdk_pixbuf gnome3.defaultIconTheme
     librsvg wrapGAppsHook
   ];
 
diff --git a/pkgs/tools/audio/liquidsoap/full.nix b/pkgs/tools/audio/liquidsoap/full.nix
index 318bb2859e54..eb544fc693e4 100644
--- a/pkgs/tools/audio/liquidsoap/full.nix
+++ b/pkgs/tools/audio/liquidsoap/full.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, which, pkgconfig
-, ocaml, ocamlPackages
+, ocamlPackages
 , libao, portaudio, alsaLib, libpulseaudio, libjack2
 , libsamplerate, libmad, taglib, lame, libogg
 , libvorbis, speex, libtheora, libopus, fdk_aac
@@ -26,7 +26,7 @@ stdenv.mkDerivation {
   configureFlags = [ "--localstatedir=/var" ];
 
   buildInputs =
-    [ which ocaml ocamlPackages.findlib pkgconfig
+    [ which ocamlPackages.ocaml ocamlPackages.findlib pkgconfig
       libao portaudio alsaLib libpulseaudio libjack2
       libsamplerate libmad taglib lame libogg
       libvorbis speex libtheora libopus fdk_aac
@@ -40,6 +40,6 @@ stdenv.mkDerivation {
     homepage = http://liquidsoap.fm/;
     maintainers = with maintainers; [ ehmry ];
     license = licenses.gpl2;
-    platforms = ocaml.meta.platforms or [];
+    platforms = ocamlPackages.ocaml.meta.platforms or [];
   };
 }
diff --git a/pkgs/tools/audio/mpdas/default.nix b/pkgs/tools/audio/mpdas/default.nix
new file mode 100644
index 000000000000..70ae1f846430
--- /dev/null
+++ b/pkgs/tools/audio/mpdas/default.nix
@@ -0,0 +1,27 @@
+{ stdenv, fetchFromGitHub, pkgconfig, mpd_clientlib, curl }:
+
+stdenv.mkDerivation rec {
+  name = "mpdas-${version}";
+  version = "0.4.4";
+
+  src = fetchFromGitHub {
+    owner = "hrkfdn";
+    repo = "mpdas";
+    rev = version;
+    sha256 = "1i6i36jd582y3nm5plcrswqljf528hd23whp8zw06hwqnsgca5b6";
+  };
+
+  nativeBuildInputs = [ pkgconfig ];
+
+  buildInputs = [ mpd_clientlib curl ];
+
+  makeFlags = [ "CONFIG=/etc" "DESTDIR=" "PREFIX=$(out)" ];
+
+  meta = with stdenv.lib; {
+    description = "Music Player Daemon AudioScrobbler";
+    homepage = http://50hz.ws/mpdas/;
+    license = licenses.bsd3;
+    maintainers = [ maintainers.taketwo ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/tools/audio/mpdris2/default.nix b/pkgs/tools/audio/mpdris2/default.nix
index c326533ece14..6596f1c34ff5 100644
--- a/pkgs/tools/audio/mpdris2/default.nix
+++ b/pkgs/tools/audio/mpdris2/default.nix
@@ -15,7 +15,8 @@ stdenv.mkDerivation rec {
     intltoolize -f
   '';
 
-  buildInputs = [ intltool autoreconfHook pythonPackages.wrapPython ];
+  nativeBuildInputs = [ autoreconfHook ];
+  buildInputs = [ intltool pythonPackages.wrapPython ];
   propagatedBuildInputs = with pythonPackages; [ python pygtk dbus-python  ];
   pythonPath = with pythonPackages; [ mpd pygtk dbus-python notify mutagen ];
   postInstall = "wrapPythonPrograms";
diff --git a/pkgs/tools/audio/pa-applet/default.nix b/pkgs/tools/audio/pa-applet/default.nix
index 6e3e5617b311..239e4b3fcca3 100644
--- a/pkgs/tools/audio/pa-applet/default.nix
+++ b/pkgs/tools/audio/pa-applet/default.nix
@@ -9,8 +9,9 @@ stdenv.mkDerivation rec {
     sha256 = "1242sdri67wnm1cd0hr40mxarkh7qs7mb9n2m0g9dbz0f4axj6wa";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    gtk3 libpulseaudio glibc pkgconfig automake autoconf libnotify libX11 xf86inputevdev
+    gtk3 libpulseaudio glibc automake autoconf libnotify libX11 xf86inputevdev
   ];
 
   preConfigure = ''
diff --git a/pkgs/tools/audio/pasystray/default.nix b/pkgs/tools/audio/pasystray/default.nix
index 451424fb8661..02235f727c5c 100644
--- a/pkgs/tools/audio/pasystray/default.nix
+++ b/pkgs/tools/audio/pasystray/default.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation rec {
     sha256 = "0k13s7pmz5ks3kli8pwhzd47hcjwv46gd2fgk7i4fbkfwf3z279h";
   };
 
-  buildInputs = [ autoconf automake makeWrapper pkgconfig 
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ autoconf automake makeWrapper 
                   gnome3.defaultIconTheme
                   avahi gtk3 libnotify libpulseaudio xlibsWrapper ];
 
diff --git a/pkgs/tools/audio/playerctl/default.nix b/pkgs/tools/audio/playerctl/default.nix
index 38df702cb16e..b04e449835d4 100644
--- a/pkgs/tools/audio/playerctl/default.nix
+++ b/pkgs/tools/audio/playerctl/default.nix
@@ -12,8 +12,9 @@ stdenv.mkDerivation rec {
     sha256 = "0b4pg5pwblgbf6kvvynzh9dshfikxy5c2ks7733n7wza5wkpgmng";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    which autoconf automake libtool gnome2.gtkdoc glib pkgconfig
+    which autoconf automake libtool gnome2.gtkdoc glib
     gobjectIntrospection
   ];
 
diff --git a/pkgs/tools/audio/pulsemixer/default.nix b/pkgs/tools/audio/pulsemixer/default.nix
new file mode 100644
index 000000000000..f07bf7d3fc51
--- /dev/null
+++ b/pkgs/tools/audio/pulsemixer/default.nix
@@ -0,0 +1,36 @@
+{ stdenv, fetchFromGitHub, python3, libpulseaudio }:
+
+stdenv.mkDerivation rec {
+  name = "${pname}-${version}";
+  pname = "pulsemixer";
+  version = "1.3.0-license";
+
+  src = fetchFromGitHub {
+    owner = "GeorgeFilipkin";
+    repo = pname;
+    rev = version;
+    sha256 = "186xbzyn35w2j58l68mccj0cnf0wxj93zb7s0r26zj4cppwszn90";
+  };
+
+  inherit libpulseaudio;
+
+  buildInputs = [ python3 ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    install pulsemixer $out/bin/
+  '';
+
+  postFixup = ''
+    substituteInPlace "$out/bin/pulsemixer" \
+      --replace "libpulse.so.0" "$libpulseaudio/lib/libpulse.so.0"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Cli and curses mixer for pulseaudio";
+    homepage = https://github.com/GeorgeFilipkin/pulsemixer;
+    license = licenses.mit;
+    maintainers = [ maintainers.woffs ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/tools/audio/volumeicon/default.nix b/pkgs/tools/audio/volumeicon/default.nix
index ea74d83ed9e2..ed9558762502 100644
--- a/pkgs/tools/audio/volumeicon/default.nix
+++ b/pkgs/tools/audio/volumeicon/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "182xl2w8syv6ky2h2bc9imc6ap8pzh0p7rp63hh8nw0xm38c3f14";
   };
 
-  buildInputs = [ gtk3 pkgconfig intltool alsaLib ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ gtk3 intltool alsaLib ];
 
   meta = with stdenv.lib; {
     description = "A lightweight volume control that sits in your systray";
diff --git a/pkgs/tools/backup/attic/default.nix b/pkgs/tools/backup/attic/default.nix
index abfccb97641c..754e12e7f776 100644
--- a/pkgs/tools/backup/attic/default.nix
+++ b/pkgs/tools/backup/attic/default.nix
@@ -10,7 +10,8 @@ let
       url = "mirror://pypi/l/llfuse/${name}.tar.bz2";
       sha256 = "1imlqw9b73086y97izr036f58pgc5akv4ihc2rrf8j5h75jbrlaa";
     };
-    buildInputs = with python3Packages; [ pytest pkgconfig fuse attr which ];
+  nativeBuildInputs = [ pkgconfig ];
+    buildInputs = with python3Packages; [ pytest fuse attr which ];
     propagatedBuildInputs = with python3Packages; [ contextlib2 ];
     checkPhase = ''
       py.test
diff --git a/pkgs/tools/backup/borg/default.nix b/pkgs/tools/backup/borg/default.nix
index dcea9c9435b9..6395b91fa73a 100644
--- a/pkgs/tools/backup/borg/default.nix
+++ b/pkgs/tools/backup/borg/default.nix
@@ -1,19 +1,19 @@
-{ stdenv, fetchurl, python3Packages, acl, lz4, openssl }:
+{ stdenv, fetchurl, python3Packages, acl, lz4, openssl, openssh }:
 
 python3Packages.buildPythonApplication rec {
   name = "borgbackup-${version}";
-  version = "1.0.11";
+  version = "1.1.1";
   namePrefix = "";
 
   src = fetchurl {
     url = "https://github.com/borgbackup/borg/releases/download/"
       + "${version}/${name}.tar.gz";
-    sha256 = "14fjk5dfwmjkn7nmkbhhbrk3g1wfrn8arvqd5r9jaij534nzsvpw";
+    sha256 = "0iik5lq349cl87imlwra2pp0j36wjhpn8r1d3778azvvqpyjq2d5";
   };
 
   nativeBuildInputs = with python3Packages; [
     # For building documentation:
-    sphinx sphinx_rtd_theme
+    sphinx guzzle_sphinx_theme
   ];
   buildInputs = [
     acl lz4 openssl python3Packages.setuptools_scm
@@ -27,6 +27,10 @@ python3Packages.buildPythonApplication rec {
     export BORG_LZ4_PREFIX="${lz4.dev}"
   '';
 
+  makeWrapperArgs = [
+    ''--prefix PATH ':' "${openssh}/bin"''
+  ];
+
   postInstall = ''
     make -C docs singlehtml
     mkdir -p $out/share/doc/borg
@@ -37,11 +41,14 @@ python3Packages.buildPythonApplication rec {
     cp -R docs/_build/man $out/share/man/man1
   '';
 
+  # tests fail due to missing test command in nix_run_setup.py
+  doCheck = false;
+
   meta = with stdenv.lib; {
     description = "A deduplicating backup program (attic fork)";
     homepage = https://borgbackup.github.io/;
     license = licenses.bsd3;
     platforms = platforms.unix; # Darwin and FreeBSD mentioned on homepage
-    maintainers = with maintainers; [ nckx ];
+    maintainers = with maintainers; [ nckx flokli ];
   };
 }
diff --git a/pkgs/tools/backup/btrbk/default.nix b/pkgs/tools/backup/btrbk/default.nix
index ff542e781a69..f9feaf40ec2f 100644
--- a/pkgs/tools/backup/btrbk/default.nix
+++ b/pkgs/tools/backup/btrbk/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "btrbk-${version}";
-  version = "0.24.0";
+  version = "0.25.1";
 
   src = fetchurl {
     url = "http://digint.ch/download/btrbk/releases/${name}.tar.xz";
-    sha256 = "01jrlswly28h4q4r3qfrzadz0pf0ms6wynmqhwddj1ahj31729h3";
+    sha256 = "02qc9vbd5l0ywnv01p60v9q3dcx2z92dfaf95qf7ccxqaa9zxfr5";
   };
 
   patches = [
diff --git a/pkgs/tools/backup/duplicity/default.nix b/pkgs/tools/backup/duplicity/default.nix
index 313167b1ae27..d55783f7f2ce 100644
--- a/pkgs/tools/backup/duplicity/default.nix
+++ b/pkgs/tools/backup/duplicity/default.nix
@@ -11,7 +11,7 @@ python2Packages.buildPythonApplication rec {
 
   buildInputs = [ librsync makeWrapper python2Packages.wrapPython ];
   propagatedBuildInputs = with python2Packages; [
-    boto cffi cryptography ecdsa enum idna
+    boto cffi cryptography ecdsa enum idna pygobject3
     ipaddress lockfile paramiko pyasn1 pycrypto six
   ];
   checkInputs = with python2Packages; [ lockfile mock pexpect ];
diff --git a/pkgs/tools/backup/httrack/default.nix b/pkgs/tools/backup/httrack/default.nix
index 02265bbc683f..ecd6a3209f4f 100644
--- a/pkgs/tools/backup/httrack/default.nix
+++ b/pkgs/tools/backup/httrack/default.nix
@@ -1,21 +1,23 @@
 { stdenv, fetchurl, zlib, openssl, libiconv }:
 
 stdenv.mkDerivation rec {
-  version = "3.48.22";
+  version = "3.49.2";
   name = "httrack-${version}";
 
   src = fetchurl {
     url = "http://mirror.httrack.com/httrack-${version}.tar.gz";
-    sha256 = "13y4m4rhvmgbbpc3lig9hzmzi86a5fkyi79sz1ckk4wfnkbim0xj";
+    sha256 = "09a0gm67nml86qby1k1gh7rdxamnrnzwr6l9r5iiq94favjs0xrl";
   };
 
   buildInputs = [ zlib openssl ] ++ stdenv.lib.optional stdenv.isDarwin libiconv;
 
-  meta = {
-    homepage = http://www.httrack.com;
-    description = "Easy-to-use offline browser utility";
-    license = stdenv.lib.licenses.gpl3;
-    maintainers = with stdenv.lib.maintainers; [ the-kenny ];
-    platforms = with stdenv.lib.platforms; unix;
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
+    description = "Easy-to-use offline browser / website mirroring utility";
+    homepage    = http://www.httrack.com;
+    license     = licenses.gpl3;
+    maintainers = with maintainers; [ the-kenny ];
+    platforms   = with platforms; unix;
   };
 }
diff --git a/pkgs/tools/backup/httrack/qt.nix b/pkgs/tools/backup/httrack/qt.nix
new file mode 100644
index 000000000000..e29acc6f3c85
--- /dev/null
+++ b/pkgs/tools/backup/httrack/qt.nix
@@ -0,0 +1,40 @@
+{ stdenv, fetchurl, cmake, pkgconfig, makeWrapper
+, httrack, qtbase, qtmultimedia }:
+
+stdenv.mkDerivation rec {
+  name = "httraqt-${version}";
+  version = "1.4.9";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/httraqt/${name}.tar.gz";
+    sha256 = "0pjxqnqchpbla4xiq4rklc06484n46cpahnjy03n9rghwwcad25b";
+  };
+
+  buildInputs = [ httrack qtbase qtmultimedia ];
+
+  nativeBuildInputs = [ cmake makeWrapper pkgconfig ];
+
+  enableParallelBuilding = true;
+
+  prePatch = ''
+    substituteInPlace cmake/HTTRAQTFindHttrack.cmake \
+      --replace /usr/include/httrack/ ${httrack}/include/httrack/
+
+    substituteInPlace distribution/posix/CMakeLists.txt \
+      --replace /usr/share $out/share
+
+    substituteInPlace desktop/httraqt.desktop \
+      --replace Exec=httraqt Exec=$out/bin/httraqt
+
+    substituteInPlace sources/main/httraqt.cpp \
+      --replace /usr/share/httraqt/ $out/share/httraqt
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Easy-to-use offline browser / website mirroring utility - QT frontend";
+    homepage    = http://www.httrack.com;
+    license     = licenses.gpl3;
+    maintainers = with maintainers; [ peterhoeg ];
+    platforms   = with platforms; unix;
+  };
+}
diff --git a/pkgs/tools/backup/obnam/default.nix b/pkgs/tools/backup/obnam/default.nix
index 06c44aa2cd96..5e1d1ab30687 100644
--- a/pkgs/tools/backup/obnam/default.nix
+++ b/pkgs/tools/backup/obnam/default.nix
@@ -2,11 +2,11 @@
 
 pythonPackages.buildPythonApplication rec {
   name = "obnam-${version}";
-  version = "1.21";
+  version = "1.22";
 
   src = fetchurl rec {
     url = "http://code.liw.fi/debian/pool/main/o/obnam/obnam_${version}.orig.tar.xz";
-    sha256 = "0qlipsq50hca71zc0dp1mg9zs12qm0sbblw7qfzl0hj6mk2rv1by";
+    sha256 = "0z3absbcpdk8zmmi6n3vwmwyv0pnzy7lp1rcsymb292p04alcn3x";
   };
 
   buildInputs = [ pythonPackages.sphinx attr ];
diff --git a/pkgs/tools/backup/partclone/default.nix b/pkgs/tools/backup/partclone/default.nix
index 54756a29cd6d..681999e35d07 100644
--- a/pkgs/tools/backup/partclone/default.nix
+++ b/pkgs/tools/backup/partclone/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   name = "partclone-${version}";
-  version = "0.2.89";
+  version = "0.3.11";
 
   src = fetchFromGitHub {
     owner = "Thomas-Tsai";
     repo = "partclone";
     rev = version;
-    sha256 = "0gw47pchqshhm00yf34qgxh6bh2jfryv0sm7ghwn77bv5gzwr481";
+    sha256 = "0bv15i0gxym4dv48rgaavh8p94waryn1l6viis6qh5zm9cd08skg";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
diff --git a/pkgs/tools/backup/partimage/default.nix b/pkgs/tools/backup/partimage/default.nix
index b0b9444a2380..c902802abce2 100644
--- a/pkgs/tools/backup/partimage/default.nix
+++ b/pkgs/tools/backup/partimage/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation {
   };
   configureFlags = "--with-ssl-headers=${openssl.dev}/include/openssl";
 
-  buildInputs = [bzip2 zlib newt newt openssl pkgconfig slang
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [bzip2 zlib newt newt openssl slang
     # automake autoconf libtool gettext
   ];
 
diff --git a/pkgs/tools/bluetooth/blueman/default.nix b/pkgs/tools/bluetooth/blueman/default.nix
index bb2ed0c2c268..9027bdf9c5fc 100644
--- a/pkgs/tools/bluetooth/blueman/default.nix
+++ b/pkgs/tools/bluetooth/blueman/default.nix
@@ -31,10 +31,11 @@ in stdenv.mkDerivation rec {
 
   configureFlags = [ (lib.enableFeature withPulseAudio "pulseaudio") ];
 
-  preFixup = ''
+  postFixup = ''
     makeWrapperArgs="--prefix PATH ':' ${binPath}"
-    wrapPythonProgramsIn "$out/bin" "$pythonPath"
-    wrapPythonProgramsIn "$out/libexec" "$pythonPath"
+    # This mimics ../../../development/interpreters/python/wrap.sh
+    wrapPythonProgramsIn "$out/bin" "$out $pythonPath"
+    wrapPythonProgramsIn "$out/libexec" "$out $pythonPath"
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/bluetooth/obex-data-server/default.nix b/pkgs/tools/bluetooth/obex-data-server/default.nix
index 35f46b47bc83..53a193749d3c 100644
--- a/pkgs/tools/bluetooth/obex-data-server/default.nix
+++ b/pkgs/tools/bluetooth/obex-data-server/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "0kq940wqs9j8qjnl58d6l3zhx0jaszci356xprx23l6nvdfld6dk";
   };
 
-  buildInputs = [ pkgconfig libusb glib dbus_glib bluez openobex dbus_libs ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libusb glib dbus_glib bluez openobex dbus_libs ];
 
   patches = [ ./obex-data-server-0.4.6-build-fixes-1.patch ];
 
diff --git a/pkgs/tools/cd-dvd/bchunk/CVE-2017-15953.patch b/pkgs/tools/cd-dvd/bchunk/CVE-2017-15953.patch
new file mode 100644
index 000000000000..f78bb7178af2
--- /dev/null
+++ b/pkgs/tools/cd-dvd/bchunk/CVE-2017-15953.patch
@@ -0,0 +1,25 @@
+--- a/bchunk.c	2017-10-30 18:03:58.658741629 +0000
++++ b/bchunk.c	2017-10-30 19:40:25.558131619 +0000
+@@ -18,6 +18,7 @@
+   *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+   */
+
++#define _GNU_SOURCE
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include <string.h>
+@@ -271,11 +272,10 @@
+ 	int16_t i;
+ 	float fl;
+ 	
+-	if (!(fname = malloc(strlen(bname) + 8))) {
+-		fprintf(stderr, "main(): malloc() failed, out of memory\n");
++	if (asprintf(&fname, "%s%2.2d.%s", bname, track->num, track->extension) == -1) {
++		fprintf(stderr, "writetrack(): asprintf() failed, out of memory\n");
+ 		exit(4);
+ 	}
+-	sprintf(fname, "%s%2.2d.%s", bname, track->num, track->extension);
+ 	
+ 	printf("%2d: %s ", track->num, fname);
+ 	
+
diff --git a/pkgs/tools/cd-dvd/bchunk/CVE-2017-15955.patch b/pkgs/tools/cd-dvd/bchunk/CVE-2017-15955.patch
new file mode 100644
index 000000000000..80930ac69bc3
--- /dev/null
+++ b/pkgs/tools/cd-dvd/bchunk/CVE-2017-15955.patch
@@ -0,0 +1,33 @@
+diff -urNZ bchunk-1.2.0.orig/bchunk.c bchunk-1.2.0/bchunk.c
+--- a/bchunk.c	2017-10-30 18:03:58.658741629 +0000
++++ b/bchunk.c	2017-10-30 19:17:36.732855884 +0000
+@@ -426,11 +426,11 @@
+ 			printf("\nTrack ");
+ 			if (!(p = strchr(p, ' '))) {
+ 				fprintf(stderr, "... ouch, no space after TRACK.\n");
+-				continue;
++				exit(3);
+ 			}
+ 			p++;
+ 			if (!(t = strchr(p, ' '))) {
+ 				fprintf(stderr, "... ouch, no space after track number.\n");
+-				continue;
++				exit(3);
+ 			}
+ 			*t = '\0';
+
+@@ -460,12 +460,12 @@
+ 		} else if ((p = strstr(s, "INDEX"))) {
+ 			if (!(p = strchr(p, ' '))) {
+ 				printf("... ouch, no space after INDEX.\n");
+-				continue;
++				exit(3);
+ 			}
+ 			p++;
+ 			if (!(t = strchr(p, ' '))) {
+ 				printf("... ouch, no space after index number.\n");
+-				continue;
++				exit(3);
+ 			}
+ 			*t = '\0';
+ 			t++;
\ No newline at end of file
diff --git a/pkgs/tools/cd-dvd/bchunk/default.nix b/pkgs/tools/cd-dvd/bchunk/default.nix
index 4b8510773a3d..ea4046f31f8c 100644
--- a/pkgs/tools/cd-dvd/bchunk/default.nix
+++ b/pkgs/tools/cd-dvd/bchunk/default.nix
@@ -8,20 +8,16 @@ stdenv.mkDerivation rec {
     sha256 = "0pcbyx3689cbl23dcij497hb3q5f1wmki7cxic5nzldx71g9vp5g";
   };
 
-  preConfigure =
-    ''
-      substituteInPlace Makefile \
-        --replace "-o root -g root" "" \
-        --replace "-o bin -g bin" ""
-    '';
+  patches = [ ./CVE-2017-15953.patch ./CVE-2017-15955.patch ];
 
-  makeFlags = "PREFIX=$(out) MAN_DIR=$(out)/share/man";
+  installPhase = ''
+    install -Dt $out/bin bchunk
+    install -Dt $out/share/man/man1 bchunk.1    
+  '';
 
-  preInstall = "mkdir -p $out/bin $out/share/man/man1";
-
-  meta = {
+  meta = with stdenv.lib; {
     homepage = http://he.fi/bchunk/;
-    description = "A program that converts CD-ROM images in BIN/CUE format into a set of ISO and CDR tracks";
-    platforms = stdenv.lib.platforms.linux;
+    description = "A program that converts CD images in BIN/CUE format into a set of ISO and CDR tracks";
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/tools/cd-dvd/cdrdao/default.nix b/pkgs/tools/cd-dvd/cdrdao/default.nix
index 95dd58a59b48..25d94593f5ef 100644
--- a/pkgs/tools/cd-dvd/cdrdao/default.nix
+++ b/pkgs/tools/cd-dvd/cdrdao/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchurl, lame, libvorbis, libmad, pkgconfig, libao}:
+{stdenv, fetchurl, libvorbis, libmad, pkgconfig, libao}:
 
 stdenv.mkDerivation {
   name = "cdrdao-1.2.3";
@@ -10,7 +10,8 @@ stdenv.mkDerivation {
 
   makeFlags = "RM=rm LN=ln MV=mv";
 
-  buildInputs = [ lame libvorbis libmad pkgconfig libao ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libvorbis libmad libao ];
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/tools/cd-dvd/cdrkit/default.nix b/pkgs/tools/cd-dvd/cdrkit/default.nix
index 36382c9e8c9f..81bd4f60f43e 100644
--- a/pkgs/tools/cd-dvd/cdrkit/default.nix
+++ b/pkgs/tools/cd-dvd/cdrkit/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchurl, cmake, libcap, zlib, bzip2}:
+{stdenv, fetchurl, cmake, libcap, zlib, bzip2, perl}:
 
 stdenv.mkDerivation rec {
   name = "cdrkit-1.1.11";
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
     sha256 = "1nj7iv3xrq600i37na9a5idd718piiiqbs4zxvpjs66cdrsk1h6i";
   };
 
-  buildInputs = [cmake libcap zlib bzip2];
+  buildInputs = [cmake libcap zlib bzip2 perl];
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/tools/cd-dvd/lsdvd/default.nix b/pkgs/tools/cd-dvd/lsdvd/default.nix
index 7cec791ecc5a..7d0fc5969bf2 100644
--- a/pkgs/tools/cd-dvd/lsdvd/default.nix
+++ b/pkgs/tools/cd-dvd/lsdvd/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ pkgconfig ];
 
   meta = {
-    homepage = http://sourceforge.net/projects/lsdvd/;
+    homepage = https://sourceforge.net/projects/lsdvd/;
     shortDescription = "Display information about audio, video, and subtitle tracks on a DVD";
     platforms = stdenv.lib.platforms.linux;
   };
diff --git a/pkgs/tools/cd-dvd/nrg2iso/default.nix b/pkgs/tools/cd-dvd/nrg2iso/default.nix
index 35414f6e776a..98853d1ba61a 100644
--- a/pkgs/tools/cd-dvd/nrg2iso/default.nix
+++ b/pkgs/tools/cd-dvd/nrg2iso/default.nix
@@ -5,7 +5,7 @@ stdenv.mkDerivation rec {
   version = "0.4";
 
   src = fetchurl {
-    url = "gregory.kokanosky.free.fr/v4/linux/${name}.tar.gz";
+    url = "http://gregory.kokanosky.free.fr/v4/linux/${name}.tar.gz";
     sha256 = "18sam7yy50rbfhjixwd7wx7kmfn1x1y5j80vwfxi5v408s39s115";
   };
 
diff --git a/pkgs/tools/cd-dvd/unetbootin/default.nix b/pkgs/tools/cd-dvd/unetbootin/default.nix
index 4d6ddd546dbc..7deac71f1512 100644
--- a/pkgs/tools/cd-dvd/unetbootin/default.nix
+++ b/pkgs/tools/cd-dvd/unetbootin/default.nix
@@ -3,16 +3,18 @@
 
 stdenv.mkDerivation rec {
   name = "unetbootin-${version}";
-  version = "655";
+  version = "657";
 
   src = fetchFromGitHub {
     owner  = "unetbootin";
     repo   = "unetbootin";
     rev    = version;
-    sha256 = "1gis75vy172k7lgh8bwgap74s259y9x1wg3rkqhhqncl2vv0w1py";
+    sha256 = "18bbcrjk6ladr46kl3dvqz5pq2xcv4nnwmajqllb4sl3k1xqsngy";
   };
 
-  sourceRoot = "${name}-src/src/unetbootin";
+  setSourceRoot = ''
+    sourceRoot=$(echo */src/unetbootin)
+  '';
 
   buildInputs = [ qt4 ];
   nativeBuildInputs = [ makeWrapper qmake4Hook ];
@@ -42,18 +44,17 @@ stdenv.mkDerivation rec {
   '';
 
   installPhase = ''
-    mkdir -p $out/bin
-    cp unetbootin $out/bin
-
-    mkdir -p $out/share/unetbootin
-    cp unetbootin_*.qm  $out/share/unetbootin
+    runHook preInstall
 
-    mkdir -p $out/share/applications
-    cp unetbootin.desktop $out/share/applications
+    install -Dm755 -t $out/bin                unetbootin
+    install -Dm644 -t $out/share/unetbootin   unetbootin_*.qm
+    install -Dm644 -t $out/share/applications unetbootin.desktop
 
     wrapProgram $out/bin/unetbootin \
       --prefix PATH : ${stdenv.lib.makeBinPath [ mtools p7zip which ]} \
       --set QT_X11_NO_MITSHM 1
+
+    runHook postInstall
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/cd-dvd/vobsub2srt/default.nix b/pkgs/tools/cd-dvd/vobsub2srt/default.nix
index a345972b3737..fe7a1a044149 100644
--- a/pkgs/tools/cd-dvd/vobsub2srt/default.nix
+++ b/pkgs/tools/cd-dvd/vobsub2srt/default.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation {
     sha256 = "1rpanrv8bgdh95v2320qbd44xskncvq6y84cbbfc86gw0qxpd9cb";
   };
 
-  buildInputs = [ cmake libtiff pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ cmake libtiff ];
   propagatedBuildInputs = [ tesseract ];
 
   meta = {
diff --git a/pkgs/tools/cd-dvd/xorriso/default.nix b/pkgs/tools/cd-dvd/xorriso/default.nix
index d0d220b1de80..8f2577c43442 100644
--- a/pkgs/tools/cd-dvd/xorriso/default.nix
+++ b/pkgs/tools/cd-dvd/xorriso/default.nix
@@ -1,17 +1,17 @@
-{ fetchurl, stdenv, libcdio, zlib, bzip2, readline, acl, attr }:
+{ fetchurl, stdenv, libcdio, zlib, bzip2, readline, acl, attr, libiconv }:
 
 stdenv.mkDerivation rec {
-  name = "xorriso-1.4.6";
+  name = "xorriso-1.4.8";
 
   src = fetchurl {
     url = "mirror://gnu/xorriso/${name}.tar.gz";
-    sha256 = "112p0ghwzxrcjbsir1n2jxhq103ckrw93wzvd55qqvzfgs674vsj";
+    sha256 = "10c44yr3dpmwxa7rf23mwfsy1bahny3jpcg9ig0xjv090jg0d0pc";
   };
 
   doCheck = true;
 
-  buildInputs = [ libcdio zlib bzip2 readline attr ]
-    ++ stdenv.lib.optional stdenv.isLinux acl;
+  buildInputs = [ libcdio zlib bzip2 readline libiconv ]
+    ++ stdenv.lib.optionals stdenv.isLinux [ acl attr ];
 
   meta = with stdenv.lib; {
     description = "ISO 9660 Rock Ridge file system manipulator";
diff --git a/pkgs/tools/compression/advancecomp/default.nix b/pkgs/tools/compression/advancecomp/default.nix
index 23acf7446b17..31ce1a986fb0 100644
--- a/pkgs/tools/compression/advancecomp/default.nix
+++ b/pkgs/tools/compression/advancecomp/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   name = "advancecomp-${version}";
-  version = "1.23";
+  version = "2.0";
 
   src = fetchFromGitHub {
     owner = "amadvance";
     repo = "advancecomp";
     rev = "v${version}";
-    sha256 = "1mrgmpjd9f7x16g847h1588mgryl26hlzfl40bc611259bb0bq7w"; 
+    sha256 = "1lvrcxcxbxac47j0ml11nikx38zan7bbr3dfjssm52r5v4cmh8j9";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/pkgs/tools/compression/bsc/default.nix b/pkgs/tools/compression/bsc/default.nix
index be512e2ae689..4c88e58e6c10 100644
--- a/pkgs/tools/compression/bsc/default.nix
+++ b/pkgs/tools/compression/bsc/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl } :
+{ stdenv, fetchurl, openmp ? null }:
 
 stdenv.mkDerivation rec {
   name = "bsc-${version}";
@@ -11,6 +11,13 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  buildInputs = stdenv.lib.optional stdenv.isDarwin openmp;
+
+  prePatch = ''
+    substituteInPlace makefile \
+        --replace 'g++' '$(CXX)'
+  '';
+
   preInstall = ''
     makeFlagsArray+=("PREFIX=$out")
   '';
diff --git a/pkgs/tools/compression/lz4/default.nix b/pkgs/tools/compression/lz4/default.nix
index 4b2f0276d78c..bc8666a26907 100644
--- a/pkgs/tools/compression/lz4/default.nix
+++ b/pkgs/tools/compression/lz4/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
       multiple GB/s per core, typically reaching RAM speed limits on
       multi-core systems.
     '';
-    homepage = https://code.google.com/p/lz4/;
+    homepage = https://lz4.github.io/lz4/;
     license = with licenses; [ bsd2 gpl2Plus ];
     platforms = platforms.unix;
     maintainers = with maintainers; [ nckx ];
diff --git a/pkgs/tools/compression/pixz/default.nix b/pkgs/tools/compression/pixz/default.nix
index 5ce79cbf4128..2a5250a95aca 100644
--- a/pkgs/tools/compression/pixz/default.nix
+++ b/pkgs/tools/compression/pixz/default.nix
@@ -8,8 +8,9 @@ stdenv.mkDerivation rec {
   version = "1.0.6";
   name = "${baseName}-${version}";
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    autoconf automake libtool pkgconfig asciidoc libxslt libxml2
+    autoconf automake libtool asciidoc libxslt libxml2
     docbook_xml_dtd_45 docbook_xml_xslt
     libarchive lzma
   ];
diff --git a/pkgs/tools/compression/rzip/default.nix b/pkgs/tools/compression/rzip/default.nix
index 2737966b83e5..ad1b80410419 100644
--- a/pkgs/tools/compression/rzip/default.nix
+++ b/pkgs/tools/compression/rzip/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchurl, bzip2}:
+{stdenv, fetchurl, fetchpatch, bzip2}:
 
 stdenv.mkDerivation {
   name = "rzip-2.1";
@@ -8,6 +8,14 @@ stdenv.mkDerivation {
   };
   buildInputs = [ bzip2 ];
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2017-8364-fill-buffer.patch";
+      url = https://sources.debian.net/data/main/r/rzip/2.1-4.1/debian/patches/80-CVE-2017-8364-fill-buffer.patch;
+      sha256 = "0jcjlx9ksdvxvjyxmyzscx9ar9992iy5icw0sc3n0p09qi4d6x1r";
+    })
+  ];
+
   meta = {
     homepage = http://rzip.samba.org/;
     description = "Compression program";
diff --git a/pkgs/tools/compression/xar/default.nix b/pkgs/tools/compression/xar/default.nix
index 0bb4a1fb2ae4..c62eead3cb73 100644
--- a/pkgs/tools/compression/xar/default.nix
+++ b/pkgs/tools/compression/xar/default.nix
@@ -1,18 +1,18 @@
 { stdenv, fetchurl, libxml2, openssl, zlib, bzip2 }:
 
 stdenv.mkDerivation rec {
-  version = "1.5.2";
+  version = "1.6.1";
   name    = "xar-${version}";
 
   src = fetchurl {
-    url    = "https://xar.googlecode.com/files/${name}.tar.gz";
-    sha256 = "1rp3va6akzlh35yqrapfqnbxaxa0zi8wyr93swbapprwh215cpac";
+    url    = "https://github.com/downloads/mackyle/xar/${name}.tar.gz";
+    sha256 = "0ghmsbs6xwg1092v7pjcibmk5wkyifwxw6ygp08gfz25d2chhipf";
   };
 
   buildInputs = [ libxml2 openssl zlib bzip2 ];
 
   meta = {
-    homepage    = https://code.google.com/p/xar/;
+    homepage    = https://mackyle.github.io/xar/;
     description = "Extensible Archiver";
 
     longDescription =
diff --git a/pkgs/tools/compression/xz/default.nix b/pkgs/tools/compression/xz/default.nix
index 55ab89993c7c..48c58434acd8 100644
--- a/pkgs/tools/compression/xz/default.nix
+++ b/pkgs/tools/compression/xz/default.nix
@@ -17,9 +17,6 @@ stdenv.mkDerivation rec {
 
   postInstall = "rm -rf $out/share/doc";
 
-  # FIXME needs gcc 4.9 in bootstrap tools
-  hardeningDisable = [ "stackprotector" ];
-
   meta = with stdenv.lib; {
     homepage = http://tukaani.org/xz/;
     description = "XZ, general-purpose data compression software, successor of LZMA";
diff --git a/pkgs/tools/compression/zstd/default.nix b/pkgs/tools/compression/zstd/default.nix
index 2be3bf167dad..aad9421305eb 100644
--- a/pkgs/tools/compression/zstd/default.nix
+++ b/pkgs/tools/compression/zstd/default.nix
@@ -3,10 +3,10 @@
 
 stdenv.mkDerivation rec {
   name = "zstd-${version}";
-  version = "1.3.0";
+  version = "1.3.2";
 
   src = fetchFromGitHub {
-    sha256 = "1rnxfhcmg8zsagyf70hiwm32mam60hq58pzgy7jn8c3iwv24mpz5";
+    sha256 = "1hwh6pw1z3y5kpwcwxrk8cwc83anigiqhy3z06ywy1jll8im57pz";
     rev = "v${version}";
     repo = "zstd";
     owner = "facebook";
diff --git a/pkgs/tools/compression/zstdmt/default.nix b/pkgs/tools/compression/zstdmt/default.nix
index 5cf88e68c64b..b723c107936c 100644
--- a/pkgs/tools/compression/zstdmt/default.nix
+++ b/pkgs/tools/compression/zstdmt/default.nix
@@ -11,7 +11,9 @@ stdenv.mkDerivation rec {
     owner = "mcmilk";
   };
 
-  sourceRoot = "zstdmt-v${version}-src/unix";
+  setSourceRoot = ''
+    sourceRoot=$(echo */unix)
+  '';
 
   buildInputs = [
     zstd lz4
diff --git a/pkgs/tools/filesystems/9pfs/default.nix b/pkgs/tools/filesystems/9pfs/default.nix
index c75cc45170af..5ad54adc08ad 100644
--- a/pkgs/tools/filesystems/9pfs/default.nix
+++ b/pkgs/tools/filesystems/9pfs/default.nix
@@ -4,7 +4,7 @@ stdenv.mkDerivation rec {
   name = "9pfs";
 
   src = fetchFromGitHub {
-    owner = "spewspew";
+    owner = "mischief";
     repo = "9pfs";
     rev = "7f4ca4cd750d650c1215b92ac3cc2a28041960e4";
     sha256 = "007s2idsn6bspmfxv1qabj39ggkgvn6gwdbhczwn04lb4c6gh3xc";
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   meta = {
-    homepage = https://github.com/spewspew/9pfs;
+    #homepage = https://github.com/spewspew/9pfs; # the account apparently doesn't exist
     description = "FUSE-based client of the 9P network filesystem protocol";
     maintainers = [ lib.maintainers.eelco ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/tools/filesystems/archivemount/default.nix b/pkgs/tools/filesystems/archivemount/default.nix
index dff66fe6bde5..f4133f12541f 100644
--- a/pkgs/tools/filesystems/archivemount/default.nix
+++ b/pkgs/tools/filesystems/archivemount/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation {
     sha256 = "1zv1fvik76kpp1q5f2dz01f4fwg1m5a8rl168px47jy9nyl9k277";
   };
 
-  buildInputs = [ pkgconfig fuse libarchive ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ fuse libarchive ];
 
   meta = {
     description = "Gateway between FUSE and libarchive: allows mounting of cpio, .tar.gz, .tar.bz2 archives";
diff --git a/pkgs/tools/filesystems/avfs/default.nix b/pkgs/tools/filesystems/avfs/default.nix
index f1faf69ed589..3f596947f883 100644
--- a/pkgs/tools/filesystems/avfs/default.nix
+++ b/pkgs/tools/filesystems/avfs/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   name = "avfs-${version}";
-  version = "1.0.4";
+  version = "1.0.5";
   src = fetchurl {
     url = "mirror://sourceforge/avf/${version}/${name}.tar.bz2";
-    sha256 = "005iw01ppjslfzbbx52dhmp1f7a8d071s5pxvjlk11zdv4h22rbb";
+    sha256 = "0xh1wpd8z3m5jmmv24fg4pvqhpnhygs2385qn5473hwk84gnpkp5";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/tools/filesystems/bcache-tools/default.nix b/pkgs/tools/filesystems/bcache-tools/default.nix
index 61c7f26db1e1..efd48fb87fe7 100644
--- a/pkgs/tools/filesystems/bcache-tools/default.nix
+++ b/pkgs/tools/filesystems/bcache-tools/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
     sha256 = "1gbsh2qw0a7kgck6w0apydiy37nnz5xvdgipa0yqrfmghl86vmv4";
   };
 
-  buildInputs = [ pkgconfig utillinux ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ utillinux ];
 
   # * Remove broken install rules (they ignore $PREFIX) for stuff we don't need
   #   anyway (it's distro specific stuff).
diff --git a/pkgs/tools/filesystems/bcachefs-tools/default.nix b/pkgs/tools/filesystems/bcachefs-tools/default.nix
index 56d132907a0b..fc4d3f505cdc 100644
--- a/pkgs/tools/filesystems/bcachefs-tools/default.nix
+++ b/pkgs/tools/filesystems/bcachefs-tools/default.nix
@@ -1,18 +1,19 @@
 { stdenv, pkgs, fetchgit, pkgconfig, attr, libuuid, libscrypt, libsodium, keyutils, liburcu, zlib, libaio }:
 
 stdenv.mkDerivation rec {
-  name = "bcachefs-tools-unstable-2016-05-13";
+  name = "bcachefs-tools-unstable-2017-08-28";
 
   src = fetchgit {
     url = "https://evilpiepirate.org/git/bcachefs-tools.git";
-    rev = "565b4a74d6c25c78b0d2b82d9529595fc6269308";
-    sha256 = "1wnis26hq67vxqkxzck6wm6caq4c1rfmy9blmmgkzlhdd2nzisbx";
+    rev = "b1814f2dd0c6b61a12a2ebb67a13d406d126b227";
+    sha256 = "05ba1h09rrqj6vjr3q37ybca3nbrmnifmffdyk83622l28fpv350";
   };
 
-  buildInputs = [ pkgconfig attr libuuid libscrypt libsodium keyutils liburcu zlib libaio ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ attr libuuid libscrypt libsodium keyutils liburcu zlib libaio ];
 
   preConfigure = ''
-    substituteInPlace cmd_migrate.c --replace /usr/include/dirent.h ${stdenv.glibc.dev}/include/dirent.h
+    substituteInPlace cmd_migrate.c --replace /usr/include/dirent.h ${stdenv.lib.getDev stdenv.cc.libc}/include/dirent.h
   '';
 
   installFlags = [ "PREFIX=$(out)" ];
diff --git a/pkgs/tools/filesystems/bindfs/default.nix b/pkgs/tools/filesystems/bindfs/default.nix
index 80027c7a0474..4d7ee75c0060 100644
--- a/pkgs/tools/filesystems/bindfs/default.nix
+++ b/pkgs/tools/filesystems/bindfs/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
 
   dontStrip = true;
 
-  buildInputs = [ fuse pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ fuse ];
   postFixup = ''
     ln -s $out/bin/bindfs $out/bin/mount.fuse.bindfs
   '';
diff --git a/pkgs/tools/filesystems/btrfs-dedupe/default.nix b/pkgs/tools/filesystems/btrfs-dedupe/default.nix
index 4c22268a1c8d..d2a82dc357b5 100644
--- a/pkgs/tools/filesystems/btrfs-dedupe/default.nix
+++ b/pkgs/tools/filesystems/btrfs-dedupe/default.nix
@@ -12,7 +12,7 @@ buildRustPackage rec {
     sha256 = "0qy1g4crhfgs2f5cmrsjv6qscg3r66gb8n6sxhimm9ksivhjyyjp";
   };
 
-  depsSha256 = "04jlz7nzsmg86i73w75i8rmlbk635xrg8m1dfac8h17dwb29yj6a";
+  cargoSha256 = "0dmn9bccicxhqcj9zrsxxp0vb5ma12a1hs9brpc22n4g1qy4yzcn";
 
   buildInputs = [ lzo zlib ];
 
diff --git a/pkgs/tools/filesystems/btrfs-progs/4.4.1.nix b/pkgs/tools/filesystems/btrfs-progs/4.4.1.nix
deleted file mode 100644
index afafa4ec1743..000000000000
--- a/pkgs/tools/filesystems/btrfs-progs/4.4.1.nix
+++ /dev/null
@@ -1,31 +0,0 @@
-{ stdenv, fetchurl, pkgconfig, attr, acl, zlib, libuuid, e2fsprogs, lzo
-, asciidoc, xmlto, docbook_xml_dtd_45, docbook_xsl, libxslt
-}:
-
-let version = "4.4.1"; in
-
-stdenv.mkDerivation rec {
-  name = "btrfs-progs-${version}";
-
-  src = fetchurl {
-    url = "mirror://kernel/linux/kernel/people/kdave/btrfs-progs/btrfs-progs-v${version}.tar.xz";
-    sha256 = "1z5882zx9jx02vyg067siws0irsl8pg37myx17hr4imn9ypf6r4r";
-  };
-
-  buildInputs = [
-    pkgconfig attr acl zlib libuuid e2fsprogs lzo
-    asciidoc xmlto docbook_xml_dtd_45 docbook_xsl libxslt
-  ];
-
-  # gcc bug with -O1 on ARM with gcc 4.8
-  # This should be fine on all platforms so apply universally
-  patchPhase = "sed -i s/-O1/-O2/ configure";
-
-  meta = with stdenv.lib; {
-    description = "Utilities for the btrfs filesystem";
-    homepage = https://btrfs.wiki.kernel.org/;
-    license = licenses.gpl2;
-    maintainers = with maintainers; [ nckx raskin wkennington ];
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/tools/filesystems/btrfs-progs/default.nix b/pkgs/tools/filesystems/btrfs-progs/default.nix
index d9b01eb5239f..77411e0cc26d 100644
--- a/pkgs/tools/filesystems/btrfs-progs/default.nix
+++ b/pkgs/tools/filesystems/btrfs-progs/default.nix
@@ -2,18 +2,19 @@
 , asciidoc, xmlto, docbook_xml_dtd_45, docbook_xsl, libxslt
 }:
 
-let version = "4.8.2"; in
+let version = "4.13.1"; in
 
 stdenv.mkDerivation rec {
   name = "btrfs-progs-${version}";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/people/kdave/btrfs-progs/btrfs-progs-v${version}.tar.xz";
-    sha256 = "0pswcfmdnfc586770h74abp67gn2xv8fd46vxlimnmn837sj7h41";
+    sha256 = "1clavvrlkswgicqsm2yfsxqw04lsn8dra0db84jqm6j2apz80kz0";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    pkgconfig attr acl zlib libuuid e2fsprogs lzo
+    attr acl zlib libuuid e2fsprogs lzo
     asciidoc xmlto docbook_xml_dtd_45 docbook_xsl libxslt
   ];
 
diff --git a/pkgs/tools/filesystems/ciopfs/default.nix b/pkgs/tools/filesystems/ciopfs/default.nix
index 674f462b967f..4a8c767e44ac 100644
--- a/pkgs/tools/filesystems/ciopfs/default.nix
+++ b/pkgs/tools/filesystems/ciopfs/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "0sr9i9b3qfwbfvzvk00yrrg3x2xqk1njadbldkvn7hwwa4z5bm9l";
   };
 
-  buildInputs = [ pkgconfig fuse glib attr ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ fuse glib attr ];
 
   makeFlags = "DESTDIR=$(out) PREFIX=";
 
diff --git a/pkgs/tools/filesystems/cryfs/default.nix b/pkgs/tools/filesystems/cryfs/default.nix
new file mode 100644
index 000000000000..0469ad54eb13
--- /dev/null
+++ b/pkgs/tools/filesystems/cryfs/default.nix
@@ -0,0 +1,79 @@
+{ stdenv, fetchFromGitHub
+, cmake, pkgconfig, coreutils
+, boost, cryptopp, curl, fuse, openssl, python, spdlog
+}:
+
+stdenv.mkDerivation rec {
+  name = "cryfs-${version}";
+  version = "0.9.7";
+
+  src = fetchFromGitHub {
+    owner  = "cryfs";
+    repo   = "cryfs";
+    rev    = "${version}";
+    sha256 = "1wsv4cyjkyg3cyr6vipw1mj41bln2m69123l3miav8r4mvmkfq8w";
+  };
+
+  prePatch = ''
+    patchShebangs src
+
+    substituteInPlace vendor/scrypt/CMakeLists.txt \
+      --replace /usr/bin/ ""
+
+    # scrypt in nixpkgs only produces a binary so we lift the patching from that so allow
+    # building the vendored version. This is very much NOT DRY.
+    # The proper solution is to have scrypt generate a dev output with the required files and just symlink
+    # into vendor/scrypt
+    for f in Makefile.in autocrap/Makefile.am libcperciva/cpusupport/Build/cpusupport.sh ; do
+      substituteInPlace vendor/scrypt/scrypt-*/scrypt/$f --replace "command -p " ""
+    done
+
+    # cryfs is vendoring an old version of spdlog
+    rm -rf vendor/spdlog/spdlog
+    ln -s ${spdlog} vendor/spdlog/spdlog
+  '';
+
+  buildInputs = [ boost cryptopp curl fuse openssl python spdlog ];
+
+  patches = [
+    ./test-no-network.patch  # Disable tests using external networking
+    ./skip-failing-test-large-malloc.patch
+  ];
+
+  # coreutils is needed for the vendored scrypt
+  nativeBuildInputs = [ cmake coreutils pkgconfig ];
+
+  enableParallelBuilding = true;
+
+  cmakeFlags = [
+    "-DCRYFS_UPDATE_CHECKS=OFF"
+    "-DBoost_USE_STATIC_LIBS=OFF" # this option is case sensitive
+    "-DBUILD_TESTING=ON"
+  ];
+
+  doCheck = true;
+
+  # Cryfs tests are broken on darwin
+  checkPhase = stdenv.lib.optionalString (!stdenv.isDarwin) ''
+    # Skip CMakeFiles directory and tests depending on fuse (does not work well with sandboxing)
+    SKIP_IMPURE_TESTS="CMakeFiles|fspp|cryfs-cli"
+
+    for test in `ls -d test/*/ | egrep -v "$SKIP_IMPURE_TESTS"`; do
+      "./$test`basename $test`-test"
+    done
+  '';
+
+  installPhase = ''
+    # Building with BUILD_TESTING=ON is missing the install target
+    mkdir -p $out/bin
+    install -m 755 ./src/cryfs-cli/cryfs $out/bin/cryfs
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Cryptographic filesystem for the cloud";
+    homepage    = https://www.cryfs.org;
+    license     = licenses.lgpl3;
+    maintainers = with maintainers; [ peterhoeg ];
+    platforms   = with platforms; linux;
+  };
+}
diff --git a/pkgs/tools/filesystems/cryfs/skip-failing-test-large-malloc.patch b/pkgs/tools/filesystems/cryfs/skip-failing-test-large-malloc.patch
new file mode 100644
index 000000000000..feb0ed9cfbb9
--- /dev/null
+++ b/pkgs/tools/filesystems/cryfs/skip-failing-test-large-malloc.patch
@@ -0,0 +1,34 @@
+From ad3f7e9fa2dececfaab43963887a2f03de52d659 Mon Sep 17 00:00:00 2001
+From: adisbladis <adis@blad.is>
+Date: Thu, 12 Oct 2017 21:45:26 +0800
+Subject: [PATCH] Skip failing test: large malloc
+
+---
+ test/cpp-utils/data/DataTest.cpp | 11 -----------
+ 1 file changed, 11 deletions(-)
+
+diff --git a/test/cpp-utils/data/DataTest.cpp b/test/cpp-utils/data/DataTest.cpp
+index 6f9df070..bd426e62 100644
+--- a/test/cpp-utils/data/DataTest.cpp
++++ b/test/cpp-utils/data/DataTest.cpp
+@@ -191,17 +191,6 @@ TEST_F(DataTest, Inequality_DifferentLastByte) {
+   EXPECT_TRUE(data1 != data2);
+ }
+ 
+-#ifdef __x86_64__
+-TEST_F(DataTest, LargesizeSize) {
+-  //Needs 64bit for representation. This value isn't in the size param list, because the list is also used for read/write checks.
+-  uint64_t size = 4.5L*1024*1024*1024;
+-  Data data(size);
+-  EXPECT_EQ(size, data.size());
+-}
+-#else
+-#warning This is not a 64bit architecture. Large size data tests are disabled.
+-#endif
+-
+ TEST_F(DataTest, LoadingNonexistingFile) {
+   TempFile file(false); // Pass false to constructor, so the tempfile is not created
+   EXPECT_FALSE(Data::LoadFromFile(file.path()));
+-- 
+2.14.2
+
diff --git a/pkgs/tools/filesystems/cryfs/test-no-network.patch b/pkgs/tools/filesystems/cryfs/test-no-network.patch
new file mode 100644
index 000000000000..3392d3f855ec
--- /dev/null
+++ b/pkgs/tools/filesystems/cryfs/test-no-network.patch
@@ -0,0 +1,24 @@
+From 8b1808e1278d2cb0dc56a4e98781eceeadfb9718 Mon Sep 17 00:00:00 2001
+From: adisbladis <adis@blad.is>
+Date: Thu, 12 Oct 2017 18:13:28 +0800
+Subject: [PATCH] Disable tests using external networking
+
+---
+ test/cpp-utils/CMakeLists.txt | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/test/cpp-utils/CMakeLists.txt b/test/cpp-utils/CMakeLists.txt
+index 5a2bc9f8..d838edba 100644
+--- a/test/cpp-utils/CMakeLists.txt
++++ b/test/cpp-utils/CMakeLists.txt
+@@ -20,7 +20,6 @@ set(SOURCES
+     tempfile/TempFileIncludeTest.cpp
+     tempfile/TempDirIncludeTest.cpp
+     tempfile/TempDirTest.cpp
+-    network/CurlHttpClientTest.cpp
+     network/FakeHttpClientTest.cpp
+     io/ConsoleIncludeTest.cpp
+     io/ConsoleTest_AskYesNo.cpp
+-- 
+2.14.2
+
diff --git a/pkgs/tools/filesystems/curlftpfs/default.nix b/pkgs/tools/filesystems/curlftpfs/default.nix
index 1897181e4448..8797c21aa235 100644
--- a/pkgs/tools/filesystems/curlftpfs/default.nix
+++ b/pkgs/tools/filesystems/curlftpfs/default.nix
@@ -6,7 +6,8 @@ stdenv.mkDerivation {
     url = mirror://sourceforge/curlftpfs/curlftpfs-0.9.2.tar.gz;
     sha256 = "0n397hmv21jsr1j7zx3m21i7ryscdhkdsyqpvvns12q7qwwlgd2f";
   };
-  buildInputs = [fuse curl pkgconfig glib zlib];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [fuse curl glib zlib];
 
   meta = {
     platforms = stdenv.lib.platforms.linux;
diff --git a/pkgs/tools/filesystems/disorderfs/default.nix b/pkgs/tools/filesystems/disorderfs/default.nix
index ce44d7d6d4ed..0551198cded3 100644
--- a/pkgs/tools/filesystems/disorderfs/default.nix
+++ b/pkgs/tools/filesystems/disorderfs/default.nix
@@ -2,15 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "disorderfs-${version}";
-  version = "0.5.1";
+  version = "0.5.2";
 
   src = fetchurl {
-    url = "http://http.debian.net/debian/pool/main/d/disorderfs/disorderfs_${version}.orig.tar.gz";
-    sha256 = "0nnxk0qqww16ra52mi5giw50zpssvan62nkig5dcxvgcvv51akik";
+    url = "http://http.debian.net/debian/pool/main/d/disorderfs/disorderfs_${version}.orig.tar.bz2";
+    sha256 = "0jdadb1ppd5qrnngpjv14az32gwslag2wwv1k8rs29iqlfy38cjf";
   };
 
-  sourceRoot = ".";
-
   nativeBuildInputs = [ pkgconfig asciidoc ];
 
   buildInputs = [ fuse attr ];
diff --git a/pkgs/tools/filesystems/djmount/default.nix b/pkgs/tools/filesystems/djmount/default.nix
index 7010a60bcbc0..e8deeaf4b470 100644
--- a/pkgs/tools/filesystems/djmount/default.nix
+++ b/pkgs/tools/filesystems/djmount/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "0kqf0cy3h4cfiy5a2sigmisx0lvvsi1n0fbyb9ll5gacmy1b8nxa";
   };
 
-  buildInputs = [ pkgconfig fuse];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ fuse];
 
   meta = {
     homepage = http://djmount.sourceforge.net/;
diff --git a/pkgs/tools/filesystems/duperemove/default.nix b/pkgs/tools/filesystems/duperemove/default.nix
index d333334d394c..613ab7bab1ee 100644
--- a/pkgs/tools/filesystems/duperemove/default.nix
+++ b/pkgs/tools/filesystems/duperemove/default.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation rec {
     sha256 = "1fll0xjg1p3pabgjiddild4ragk9spbdmdzrkq0hv5pxb1qrv7lp";
   };
 
-  buildInputs = [ libgcrypt pkgconfig glib linuxHeaders sqlite ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libgcrypt glib linuxHeaders sqlite ];
 
   makeFlags = [ "DESTDIR=$(out)" "PREFIX=" ];
 
diff --git a/pkgs/tools/filesystems/e2fsprogs/default.nix b/pkgs/tools/filesystems/e2fsprogs/default.nix
index 7c3ab92fa88a..22dc9e747233 100644
--- a/pkgs/tools/filesystems/e2fsprogs/default.nix
+++ b/pkgs/tools/filesystems/e2fsprogs/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, pkgconfig, libuuid, gettext, texinfo }:
 
 stdenv.mkDerivation rec {
-  name = "e2fsprogs-1.43.4";
+  name = "e2fsprogs-1.43.7";
 
   src = fetchurl {
     url = "mirror://sourceforge/e2fsprogs/${name}.tar.gz";
-    sha256 = "a648a90a513f1b25113c7f981af978b8a19f832b3a32bd10707af3ff682ba66d";
+    sha256 = "1i51w5l45zhz3i98k92xbbvkqklvjrvw3zvqky3gk9cdmqp5y0w7";
   };
 
   outputs = [ "bin" "dev" "out" "man" "info" ];
diff --git a/pkgs/tools/filesystems/encfs/default.nix b/pkgs/tools/filesystems/encfs/default.nix
index 518edbb3ea4e..3df76d828318 100644
--- a/pkgs/tools/filesystems/encfs/default.nix
+++ b/pkgs/tools/filesystems/encfs/default.nix
@@ -5,10 +5,10 @@
 
 stdenv.mkDerivation rec {
   name = "encfs-${version}";
-  version = "1.9.1";
+  version = "1.9.2";
 
   src = fetchFromGitHub {
-    sha256 = "1pyldd802db987m13jfmy491mp8mnsv2mwki0ra4wbnngbqgalhv";
+    sha256 = "0isx7n4r8znk02464s0wvlzk6ry5mlnq3kgnd0rapnhjwdvwqr5y";
     rev = "v${version}";
     repo = "encfs";
     owner = "vgough";
diff --git a/pkgs/tools/filesystems/f2fs-tools/default.nix b/pkgs/tools/filesystems/f2fs-tools/default.nix
index fdad877d34cf..53b17f45f9f4 100644
--- a/pkgs/tools/filesystems/f2fs-tools/default.nix
+++ b/pkgs/tools/filesystems/f2fs-tools/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   name = "f2fs-tools-${version}";
-  version = "1.8.0";
+  version = "1.9.0";
 
   src = fetchgit {
     url = "git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs-tools.git";
     rev = "refs/tags/v${version}";
-    sha256 = "0mbpg6mng6jcm5vxq0ivhklgpkwvjbhjwgkhzxr50ln46h5kbd2f";
+    sha256 = "0aj9dbhv7vv19pyb2rhcg99v5v0s66sb9yzrdmi46bmvzz124pal";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
diff --git a/pkgs/tools/filesystems/fatresize/default.nix b/pkgs/tools/filesystems/fatresize/default.nix
index f20f9aa2bab1..f929f354766c 100644
--- a/pkgs/tools/filesystems/fatresize/default.nix
+++ b/pkgs/tools/filesystems/fatresize/default.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
   
   meta = {
     description = "The FAT16/FAT32 non-destructive resizer";
-    homepage = http://sourceforge.net/projects/fatresize;
+    homepage = https://sourceforge.net/projects/fatresize;
     platforms = stdenv.lib.platforms.linux;
   };
 }
diff --git a/pkgs/tools/filesystems/fuse-7z-ng/default.nix b/pkgs/tools/filesystems/fuse-7z-ng/default.nix
index 8b3df52bcb74..82e2b404b82a 100644
--- a/pkgs/tools/filesystems/fuse-7z-ng/default.nix
+++ b/pkgs/tools/filesystems/fuse-7z-ng/default.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation rec {
     sha256 = "17v1gcmg5q661b047zxjar735i4d3508dimw1x3z1pk4d1zjhp3x";
   };
 
-  buildInputs = [ fuse autoconf automake pkgconfig makeWrapper ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ fuse autoconf automake makeWrapper ];
 
   preConfigure = "./autogen.sh";
 
diff --git a/pkgs/tools/filesystems/fuseiso/default.nix b/pkgs/tools/filesystems/fuseiso/default.nix
index 7165789cf81c..8a417cfe397d 100644
--- a/pkgs/tools/filesystems/fuseiso/default.nix
+++ b/pkgs/tools/filesystems/fuseiso/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "127xql52dcdhmh7s5m9xc6q39jdlj3zhbjar1j821kb6gl3jw94b";
   };
 
-  buildInputs = [ pkgconfig fuse zlib glib ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ fuse zlib glib ];
 
   patches = let fetchPatchFromDebian = { patch, sha256 }:
     fetchpatch {
@@ -31,7 +32,7 @@ stdenv.mkDerivation rec {
   ];
 
   meta = {
-    homepage = http://sourceforge.net/projects/fuseiso;
+    homepage = https://sourceforge.net/projects/fuseiso;
     description = "FUSE module to mount ISO filesystem images";
     platforms = stdenv.lib.platforms.linux;
     license = stdenv.lib.licenses.gpl2;
diff --git a/pkgs/tools/filesystems/gcsfuse/default.nix b/pkgs/tools/filesystems/gcsfuse/default.nix
index 086f0e0f790c..215f02ccdd4e 100644
--- a/pkgs/tools/filesystems/gcsfuse/default.nix
+++ b/pkgs/tools/filesystems/gcsfuse/default.nix
@@ -3,15 +3,15 @@
 
 buildGoPackage rec {
   name = "gcsfuse-${version}";
-  version = "v0.19.0";
-  rev = "81281027c0093e3f916a6e611a128ec5c3a12ece";
+  version = "0.23.0";
+  rev = "v${version}";
 
   goPackagePath = "github.com/googlecloudplatform/gcsfuse";
 
   src = fetchgit {
     inherit rev;
     url = "https://github.com/googlecloudplatform/gcsfuse";
-    sha256 = "1lj9czippsgkhr8y3r7vwxgc8i952v76v1shdv10p43gsxwyyi9a";
+    sha256 = "1qxbpsmz22l5w4b7wbgfdq4v85cfc9ka9i8h4c56nals1x5lcsnx";
   };
 
   meta = {
diff --git a/pkgs/tools/filesystems/genimage/default.nix b/pkgs/tools/filesystems/genimage/default.nix
index b808573aa5b8..792b2e2c75b4 100644
--- a/pkgs/tools/filesystems/genimage/default.nix
+++ b/pkgs/tools/filesystems/genimage/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0y4h8x8lqxam8m90rdfq8cg5137kvilxr3d1qzddpx7nxpvmmwv9";
   };
 
-  buildInputs = [ pkgconfig libconfuse ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libconfuse ];
 
   postInstall = ''
     # As there is no manpage or built-in --help, add the README file for
diff --git a/pkgs/tools/filesystems/glusterfs/default.nix b/pkgs/tools/filesystems/glusterfs/default.nix
index af76e429d31c..dc15866f3cda 100644
--- a/pkgs/tools/filesystems/glusterfs/default.nix
+++ b/pkgs/tools/filesystems/glusterfs/default.nix
@@ -15,10 +15,10 @@ let
     #       The command
     #         find /nix/store/...-glusterfs-.../ -name '*.py' -executable
     #       can help with finding new Python scripts.
-    version = "3.10.2";
+    version = "3.12.1";
     name="${baseName}-${version}";
     url="https://github.com/gluster/glusterfs/archive/v${version}.tar.gz";
-    sha256 = "09hpvw42sc77nc3bfv7395wjn7fxvp0n8qnmrlyxq83hf0w81gfs";
+    sha256 = "14l6p2zyjsrnjvf0lipq32p517zk813nqv06pjq6kcqkmy038wdv";
   };
   buildInputs = [
     fuse bison flex_2_5_35 openssl ncurses readline
@@ -28,7 +28,7 @@ let
       pkgs.flask
       pkgs.prettytable
       pkgs.requests
-      pkgs.xattr
+      pkgs.pyxattr
     ]))
     # NOTE: `python2` has to be *AFTER* the above `python2.withPackages`,
     #       to ensure that the packages are available but the `toPythonPath`
@@ -71,8 +71,10 @@ rec {
 
   patches = [
     ./glusterfs-use-PATH-instead-of-hardcodes.patch
-    ./glusterfs-fix-unsubstituted-autoconf-macros.patch
     ./glusterfs-python-remove-find_library.patch
+    # Remove when https://bugzilla.redhat.com/show_bug.cgi?id=1489610 is fixed
+    ./glusterfs-fix-bug-1489610-glusterfind-var-data-under-prefix.patch
+    ./glusterfs-glusterfind-log-remote-node_cmd-error.patch
   ];
 
    # Note that the VERSION file is something that is present in release tarballs
@@ -136,8 +138,14 @@ rec {
     # Luckily, `libexec` scripts are never supposed to be invoked straight from PATH,
     # instead they are invoked directly from `gluster` or `glusterd`, which is why it is
     # sufficient to set PYTHONPATH for those executables.
+    #
+    # Exceptions to these rules are the `glusterfind` `brickfind.py` and `changelog.py`
+    # crawlers, which are directly invoked on other gluster nodes using a remote SSH command
+    # issues by `glusterfind`.
 
     wrapProgram $out/share/glusterfs/scripts/eventsdash.py --set PATH "$GLUSTER_PATH" --set PYTHONPATH "$GLUSTER_PYTHONPATH" --set LD_LIBRARY_PATH "$GLUSTER_LD_LIBRARY_PATH"
+    wrapProgram $out/libexec/glusterfs/glusterfind/brickfind.py --set PATH "$GLUSTER_PATH" --set PYTHONPATH "$GLUSTER_PYTHONPATH" --set LD_LIBRARY_PATH "$GLUSTER_LD_LIBRARY_PATH"
+    wrapProgram $out/libexec/glusterfs/glusterfind/changelog.py --set PATH "$GLUSTER_PATH" --set PYTHONPATH "$GLUSTER_PYTHONPATH" --set LD_LIBRARY_PATH "$GLUSTER_LD_LIBRARY_PATH"
     '';
 
   doInstallCheck = true;
diff --git a/pkgs/tools/filesystems/glusterfs/default.upstream b/pkgs/tools/filesystems/glusterfs/default.upstream
deleted file mode 100644
index 29494eab87b9..000000000000
--- a/pkgs/tools/filesystems/glusterfs/default.upstream
+++ /dev/null
@@ -1,5 +0,0 @@
-url http://download.gluster.org/pub/gluster/glusterfs/
-version_link '/[0-9.]+/$'
-version_link '/[0-9.]+/$'
-version_link 'glusterfs-[0-9.]+[.]tar[.]'
-minimize_overwrite
diff --git a/pkgs/tools/filesystems/glusterfs/glusterfs-fix-bug-1489610-glusterfind-var-data-under-prefix.patch b/pkgs/tools/filesystems/glusterfs/glusterfs-fix-bug-1489610-glusterfind-var-data-under-prefix.patch
new file mode 100644
index 000000000000..f679fb8f4c1b
--- /dev/null
+++ b/pkgs/tools/filesystems/glusterfs/glusterfs-fix-bug-1489610-glusterfind-var-data-under-prefix.patch
@@ -0,0 +1,27 @@
+From f523afac49e24ecc0fa4ad85195135689cf445f0 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Niklas=20Hamb=C3=BCchen?= <mail@nh2.me>
+Date: Wed, 27 Sep 2017 21:36:41 +0200
+Subject: [PATCH] Fix "glusterfind saves var data under $prefix instead of
+ localstatedir". Fixes #1489610
+
+Change-Id: Id2362c20f34346c37acfb9eb1ad105d0b7b8b60f
+---
+ configure.ac | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/configure.ac b/configure.ac
+index f87d8a454..b4d3f5d10 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -1118,7 +1118,7 @@ if test "x$exec_prefix" = xNONE; then
+ 	exec_prefix="$(eval echo $prefix)"
+ fi
+ GLUSTERFS_LIBEXECDIR="$(eval echo $libexecdir)/glusterfs"
+-GLUSTERFSD_MISCDIR="$(eval echo $prefix)/var/lib/misc/glusterfsd"
++GLUSTERFSD_MISCDIR="$(eval echo $localstatedir)/var/lib/misc/glusterfsd"
+ prefix=$old_prefix
+ exec_prefix=$old_exec_prefix
+ 
+-- 
+2.12.0
+
diff --git a/pkgs/tools/filesystems/glusterfs/glusterfs-fix-unsubstituted-autoconf-macros.patch b/pkgs/tools/filesystems/glusterfs/glusterfs-fix-unsubstituted-autoconf-macros.patch
deleted file mode 100644
index de3c2fa9f62e..000000000000
--- a/pkgs/tools/filesystems/glusterfs/glusterfs-fix-unsubstituted-autoconf-macros.patch
+++ /dev/null
@@ -1,236 +0,0 @@
-From b37e0222a6a60505868a6fbb8591608cdc4bba57 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Niklas=20Hamb=C3=BCchen?= <mail@nh2.me>
-Date: Sat, 13 May 2017 15:33:27 +0200
-Subject: [PATCH] Revert "build/packaging: Debian and Ubuntu don't have
- /usr/libexec". Fixes #1450588
-
-This reverts commit 18509e436f8a728ef522f3e76e2f2dc30e1bd8ac.
-
-This fixes autoconf unsubstituted strings to appear in generated source code.
----
- cli/src/Makefile.am                      |  2 +-
- configure.ac                             | 12 ++++++------
- events/src/Makefile.am                   |  8 ++++----
- extras/Makefile.am                       |  2 +-
- geo-replication/src/Makefile.am          |  8 ++++----
- geo-replication/syncdaemon/Makefile.am   |  2 +-
- tools/gfind_missing_files/Makefile.am    |  4 ++--
- tools/glusterfind/Makefile.am            |  4 ++--
- tools/glusterfind/src/Makefile.am        |  2 +-
- xlators/features/ganesha/src/Makefile.am |  2 +-
- xlators/mgmt/glusterd/src/Makefile.am    |  2 +-
- 11 files changed, 24 insertions(+), 24 deletions(-)
-
-diff --git a/cli/src/Makefile.am b/cli/src/Makefile.am
-index 5ef9389..f5b8d00 100644
---- a/cli/src/Makefile.am
-+++ b/cli/src/Makefile.am
-@@ -18,7 +18,7 @@ AM_CPPFLAGS = $(GF_CPPFLAGS) \
- 	-I$(top_builddir)/rpc/xdr/src\
- 	-DDATADIR=\"$(localstatedir)\" \
- 	-DCONFDIR=\"$(sysconfdir)/glusterfs\" \
--	-DGSYNCD_PREFIX=\"$(GLUSTERFS_LIBEXECDIR)\"\
-+	-DGSYNCD_PREFIX=\"$(libexecdir)/glusterfs\"\
- 	-DSYNCDAEMON_COMPILE=$(SYNCDAEMON_COMPILE) -DSBIN_DIR=\"$(sbindir)\"\
- 	$(XML_CPPFLAGS)
- 
-diff --git a/configure.ac b/configure.ac
-index c9742e2..0c3a386 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -1056,24 +1056,24 @@ old_prefix=$prefix
- if test "x$prefix" = xNONE; then
- 	prefix=$ac_default_prefix
- fi
--GLUSTERFS_LIBEXECDIR="$libexecdir/glusterfs"
--GLUSTERFSD_MISCDIR="$prefix/var/lib/misc/glusterfsd"
-+GLUSTERFS_LIBEXECDIR="$(eval echo $prefix)/libexec/glusterfs"
-+GLUSTERFSD_MISCDIR="$(eval echo $prefix)/var/lib/misc/glusterfsd"
- prefix=$old_prefix
- 
- ### Dirty hacky stuff to make LOCALSTATEDIR work
- if test "x$prefix" = xNONE; then
--   test $localstatedir = '$prefix/var' && localstatedir=$ac_default_prefix/var
-+   test $localstatedir = '${prefix}/var' && localstatedir=$ac_default_prefix/var
-    localstatedir=/var
--   LOCALSTATEDIR=$localstatedir
-+   LOCALSTATEDIR=$(eval echo ${localstatedir})
- else
--   LOCALSTATEDIR=$localstatedir
-+   LOCALSTATEDIR=$(eval echo ${localstatedir})
- fi
- 
- old_prefix=$prefix
- if test "x$prefix" = xNONE; then
-     prefix=$ac_default_prefix
- fi
--GLUSTERD_VOLFILE="$sysconfdir/glusterfs/glusterd.vol"
-+GLUSTERD_VOLFILE="$(eval echo ${sysconfdir})/glusterfs/glusterd.vol"
- prefix=$old_prefix
- 
- 
-diff --git a/events/src/Makefile.am b/events/src/Makefile.am
-index 8493abd..87282c6 100644
---- a/events/src/Makefile.am
-+++ b/events/src/Makefile.am
-@@ -5,7 +5,7 @@ EXTRA_DIST = glustereventsd.py __init__.py  eventsapiconf.py.in \
- BUILT_SOURCES = eventtypes.py
- CLEANFILES = eventtypes.py
- 
--eventsdir = $(GLUSTERFS_LIBEXECDIR)/events
-+eventsdir = $(libexecdir)/glusterfs/events
- events_PYTHON = __init__.py gf_event.py eventsapiconf.py eventtypes.py \
- 	utils.py
- 
-@@ -13,7 +13,7 @@ eventtypes.py: $(top_srcdir)/events/eventskeygen.py
- 	$(PYTHON) $(top_srcdir)/events/eventskeygen.py PY_HEADER
- 
- if BUILD_EVENTS
--eventspeerscriptdir = $(GLUSTERFS_LIBEXECDIR)
-+eventspeerscriptdir = $(libexecdir)/glusterfs
- eventsconfdir = $(sysconfdir)/glusterfs
- eventsconf_DATA = eventsconfig.json
- 
-@@ -24,10 +24,10 @@ eventspeerscript_SCRIPTS = peer_eventsapi.py
- install-exec-hook:
- 	$(mkdir_p) $(DESTDIR)$(sbindir)
- 	rm -f $(DESTDIR)$(sbindir)/glustereventsd
--	ln -s $(GLUSTERFS_LIBEXECDIR)/events/glustereventsd.py \
-+	ln -s $(libexecdir)/glusterfs/events/glustereventsd.py \
- 		$(DESTDIR)$(sbindir)/glustereventsd
- 	rm -f $(DESTDIR)$(sbindir)/gluster-eventsapi
--	ln -s $(GLUSTERFS_LIBEXECDIR)/peer_eventsapi.py \
-+	ln -s $(libexecdir)/glusterfs/peer_eventsapi.py \
- 		$(DESTDIR)$(sbindir)/gluster-eventsapi
- 
- uninstall-hook:
-diff --git a/extras/Makefile.am b/extras/Makefile.am
-index 9dfc93d..53ac476 100644
---- a/extras/Makefile.am
-+++ b/extras/Makefile.am
-@@ -1,4 +1,4 @@
--addonexecdir = $(GLUSTERFS_LIBEXECDIR)
-+addonexecdir = $(libexecdir)/glusterfs
- addonexec_SCRIPTS = peer_add_secret_pub
- 
- EditorModedir = $(docdir)
-diff --git a/geo-replication/src/Makefile.am b/geo-replication/src/Makefile.am
-index 9937a0b..87435d5 100644
---- a/geo-replication/src/Makefile.am
-+++ b/geo-replication/src/Makefile.am
-@@ -1,4 +1,4 @@
--gsyncddir = $(GLUSTERFS_LIBEXECDIR)
-+gsyncddir = $(libexecdir)/glusterfs
- 
- gsyncd_SCRIPTS = gverify.sh peer_gsec_create \
- 	set_geo_rep_pem_keys.sh peer_mountbroker peer_mountbroker.py \
-@@ -21,7 +21,7 @@ noinst_HEADERS = procdiggy.h
- 
- AM_CPPFLAGS = $(GF_CPPFLAGS) -I$(top_srcdir)/libglusterfs/src \
- 	-I$(top_srcdir)/rpc/xdr/src -I$(top_builddir)/rpc/xdr/src \
--	-DGSYNCD_PREFIX=\"$(GLUSTERFS_LIBEXECDIR)\" -DUSE_LIBGLUSTERFS \
-+	-DGSYNCD_PREFIX=\"$(libexecdir)/glusterfs\" -DUSE_LIBGLUSTERFS \
- 	-DSBIN_DIR=\"$(sbindir)\" -DPYTHON=\"$(PYTHON)\"
- 
- AM_CFLAGS = -Wall $(GF_CFLAGS)
-@@ -35,11 +35,11 @@ $(top_builddir)/libglusterfs/src/libglusterfs.la:
- install-exec-hook:
- 	$(mkdir_p) $(DESTDIR)$(sbindir)
- 	rm -f $(DESTDIR)$(sbindir)/gluster-mountbroker
--	ln -s $(GLUSTERFS_LIBEXECDIR)/peer_mountbroker.py \
-+	ln -s $(libexecdir)/glusterfs/peer_mountbroker.py \
- 		$(DESTDIR)$(sbindir)/gluster-mountbroker
- 
- 	rm -f $(DESTDIR)$(sbindir)/gluster-georep-sshkey
--	ln -s $(GLUSTERFS_LIBEXECDIR)/peer_georep-sshkey.py \
-+	ln -s $(libexecdir)/glusterfs/peer_georep-sshkey.py \
- 		$(DESTDIR)$(sbindir)/gluster-georep-sshkey
- 
- 
-diff --git a/geo-replication/syncdaemon/Makefile.am b/geo-replication/syncdaemon/Makefile.am
-index f80fb26..7cdaf45 100644
---- a/geo-replication/syncdaemon/Makefile.am
-+++ b/geo-replication/syncdaemon/Makefile.am
-@@ -1,4 +1,4 @@
--syncdaemondir = $(GLUSTERFS_LIBEXECDIR)/python/syncdaemon
-+syncdaemondir = $(libexecdir)/glusterfs/python/syncdaemon
- 
- syncdaemon_PYTHON = gconf.py gsyncd.py __init__.py master.py README.md repce.py \
- 	resource.py configinterface.py syncdutils.py monitor.py libcxattr.py \
-diff --git a/tools/gfind_missing_files/Makefile.am b/tools/gfind_missing_files/Makefile.am
-index f77f789..043c34c 100644
---- a/tools/gfind_missing_files/Makefile.am
-+++ b/tools/gfind_missing_files/Makefile.am
-@@ -1,4 +1,4 @@
--gfindmissingfilesdir = $(GLUSTERFS_LIBEXECDIR)/gfind_missing_files
-+gfindmissingfilesdir = $(libexecdir)/glusterfs/gfind_missing_files
- 
- gfindmissingfiles_SCRIPTS = gfind_missing_files.sh gfid_to_path.sh \
- 	gfid_to_path.py
-@@ -21,6 +21,6 @@ uninstall-local:
- 
- install-data-local:
- 	rm -f $(DESTDIR)$(sbindir)/gfind_missing_files
--	ln -s $(GLUSTERFS_LIBEXECDIR)/gfind_missing_files/gfind_missing_files.sh $(DESTDIR)$(sbindir)/gfind_missing_files
-+	ln -s $(libexecdir)/glusterfs/gfind_missing_files/gfind_missing_files.sh $(DESTDIR)$(sbindir)/gfind_missing_files
- 
- CLEANFILES =
-diff --git a/tools/glusterfind/Makefile.am b/tools/glusterfind/Makefile.am
-index 92fa614..37f23be 100644
---- a/tools/glusterfind/Makefile.am
-+++ b/tools/glusterfind/Makefile.am
-@@ -6,7 +6,7 @@ bin_SCRIPTS = glusterfind
- 
- CLEANFILES = $(bin_SCRIPTS)
- 
--deletehookscriptsdir = $(GLUSTERFS_LIBEXECDIR)/glusterfind/
-+deletehookscriptsdir = $(libexecdir)/glusterfs/glusterfind/
- deletehookscripts_SCRIPTS = S57glusterfind-delete-post.py
- 
- uninstall-local:
-@@ -16,5 +16,5 @@ install-data-local:
- 	$(mkdir_p) $(DESTDIR)$(GLUSTERD_WORKDIR)/glusterfind/.keys
- 	$(mkdir_p) $(DESTDIR)$(GLUSTERD_WORKDIR)/hooks/1/delete/post/
- 	rm -f $(DESTDIR)$(GLUSTERD_WORKDIR)/hooks/1/delete/post/S57glusterfind-delete-post
--	ln -s $(GLUSTERFS_LIBEXECDIR)/glusterfind/S57glusterfind-delete-post.py \
-+	ln -s $(libexecdir)/glusterfs/glusterfind/S57glusterfind-delete-post.py \
- 		$(DESTDIR)$(GLUSTERD_WORKDIR)/hooks/1/delete/post/S57glusterfind-delete-post
-diff --git a/tools/glusterfind/src/Makefile.am b/tools/glusterfind/src/Makefile.am
-index e4469c1..541ff94 100644
---- a/tools/glusterfind/src/Makefile.am
-+++ b/tools/glusterfind/src/Makefile.am
-@@ -1,4 +1,4 @@
--glusterfinddir = $(GLUSTERFS_LIBEXECDIR)/glusterfind
-+glusterfinddir = $(libexecdir)/glusterfs/glusterfind
- 
- glusterfind_PYTHON = conf.py utils.py __init__.py \
- 	main.py libgfchangelog.py changelogdata.py
-diff --git a/xlators/features/ganesha/src/Makefile.am b/xlators/features/ganesha/src/Makefile.am
-index 78715d6..54cfcb3 100644
---- a/xlators/features/ganesha/src/Makefile.am
-+++ b/xlators/features/ganesha/src/Makefile.am
-@@ -12,7 +12,7 @@ AM_CPPFLAGS = $(GF_CPPFLAGS) -I$(top_srcdir)/libglusterfs/src \
- 	-fPIC -D_FILE_OFFSET_BITS=64 -D_GNU_SOURCE -D$(GF_HOST_OS)\
- 	-I$(top_srcdir)/rpc/xdr/src -I$(top_builddir)/rpc/xdr/src \
- 	-DGANESHA_DIR=\"$(sysconfdir)/ganesha\" \
--	-DGYSNCD_PREFIX=\"$(GLUSTERFS_LIBEXECDIR)\"
-+	-DGYSNCD_PREFIX=\"$(libexecdir)/glusterfs\"
- 
- AM_CFLAGS = -Wall $(GF_CFLAGS)
- 
-diff --git a/xlators/mgmt/glusterd/src/Makefile.am b/xlators/mgmt/glusterd/src/Makefile.am
-index 23ebf37..4f2fffd 100644
---- a/xlators/mgmt/glusterd/src/Makefile.am
-+++ b/xlators/mgmt/glusterd/src/Makefile.am
-@@ -47,7 +47,7 @@ AM_CPPFLAGS = $(GF_CPPFLAGS) -I$(top_srcdir)/libglusterfs/src \
- 	-I$(CONTRIBDIR)/rbtree -I$(top_srcdir)/rpc/rpc-lib/src \
- 	-I$(CONTRIBDIR)/mount -I$(CONTRIBDIR)/userspace-rcu \
- 	-DSBIN_DIR=\"$(sbindir)\" -DDATADIR=\"$(localstatedir)\" \
--	-DGSYNCD_PREFIX=\"$(GLUSTERFS_LIBEXECDIR)\" \
-+	-DGSYNCD_PREFIX=\"$(libexecdir)/glusterfs\" \
- 	-DCONFDIR=\"$(localstatedir)/run/gluster/shared_storage/nfs-ganesha\" \
- 	-DGANESHA_PREFIX=\"$(libexecdir)/ganesha\" \
- 	-DSYNCDAEMON_COMPILE=$(SYNCDAEMON_COMPILE) $(XML_CPPFLAGS)
--- 
-2.7.4
-
diff --git a/pkgs/tools/filesystems/glusterfs/glusterfs-glusterfind-log-remote-node_cmd-error.patch b/pkgs/tools/filesystems/glusterfs/glusterfs-glusterfind-log-remote-node_cmd-error.patch
new file mode 100644
index 000000000000..8bc00fdbf75c
--- /dev/null
+++ b/pkgs/tools/filesystems/glusterfs/glusterfs-glusterfind-log-remote-node_cmd-error.patch
@@ -0,0 +1,49 @@
+From 92a6b84a37e7e2e0ec0655ca45cedb64ab72080e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Niklas=20Hamb=C3=BCchen?= <mail@nh2.me>
+Date: Fri, 8 Sep 2017 02:40:01 +0200
+Subject: [PATCH] glusterfind: Log remote stderr on `node_cmd` error.
+
+The problem of lost stderr was introduced in
+commit feea851fad4f89b48bfe89fe3b75250cc7bd6501.
+
+Change-Id: Ic98f9bc9682ae3bd9c3ebea3855667fc8ba2843d
+---
+ tools/glusterfind/src/main.py | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/tools/glusterfind/src/main.py b/tools/glusterfind/src/main.py
+index c125f970a..6fffce4b3 100644
+--- a/tools/glusterfind/src/main.py
++++ b/tools/glusterfind/src/main.py
+@@ -75,12 +75,27 @@ def node_cmd(host, host_uuid, task, cmd, args, opts):
+             cmd = ["ssh",
+                    "-oNumberOfPasswordPrompts=0",
+                    "-oStrictHostKeyChecking=no",
++                   # We force TTY allocation (-t -t) so that Ctrl+C is handed
++                   # through; see:
++                   #   https://bugzilla.redhat.com/show_bug.cgi?id=1382236
++                   # Note that this turns stderr of the remote `cmd`
++                   # into stdout locally.
+                    "-t",
+                    "-t",
+                    "-i", pem_key_path,
+                    "root@%s" % host] + cmd
+ 
+-        execute(cmd, exit_msg="%s - %s failed" % (host, task), logger=logger)
++        (returncode, err, out) = execute(cmd, logger=logger)
++        if returncode != 0:
++            # Because the `-t -t` above turns the remote stderr into
++            # local stdout, we need to log both stderr and stdout
++            # here to print all error messages.
++            fail("%s - %s failed; stdout (including remote stderr):\n"
++                 "%s\n"
++                 "stderr:\n"
++                 "%s" % (host, task, out, err),
++                 returncode,
++                 logger=logger)
+ 
+         if opts.get("copy_outfile", False) and not localdir:
+             cmd_copy = ["scp",
+-- 
+2.12.0
+
diff --git a/pkgs/tools/filesystems/glusterfs/glusterfs-use-PATH-instead-of-hardcodes.patch b/pkgs/tools/filesystems/glusterfs/glusterfs-use-PATH-instead-of-hardcodes.patch
index eb4bd5b7d56f..acb15464e48f 100644
--- a/pkgs/tools/filesystems/glusterfs/glusterfs-use-PATH-instead-of-hardcodes.patch
+++ b/pkgs/tools/filesystems/glusterfs/glusterfs-use-PATH-instead-of-hardcodes.patch
@@ -41,29 +41,6 @@ index e9f80fe81..6380dd867 100644
                                 progname, strerror (errno));
  #endif /* GF_LINUX_HOST_OS */
                  exit (1);
-diff --git a/xlators/mgmt/glusterd/src/glusterd-ganesha.c b/xlators/mgmt/glusterd/src/glusterd-ganesha.c
-index da1fee066..dcb9e5725 100644
---- a/xlators/mgmt/glusterd/src/glusterd-ganesha.c
-+++ b/xlators/mgmt/glusterd/src/glusterd-ganesha.c
-@@ -122,15 +122,15 @@ manage_service (char *action)
-         int     i               = 0;
-         int     ret             = 0;
-         struct service_command sc_list[] = {
--                { .binary  = "/bin/systemctl",
-+                { .binary  = "systemctl",
-                   .service = "nfs-ganesha",
-                   .action  = sc_systemctl_action
-                 },
--                { .binary  = "/sbin/invoke-rc.d",
-+                { .binary  = "invoke-rc.d",
-                   .service = "nfs-ganesha",
-                   .action  = sc_service_action
-                 },
--                { .binary  = "/sbin/service",
-+                { .binary  = "service",
-                   .service = "nfs-ganesha",
-                   .action  = sc_service_action
-                 },
 diff --git a/xlators/mgmt/glusterd/src/glusterd-quota.c b/xlators/mgmt/glusterd/src/glusterd-quota.c
 index 0e6629cf0..fcb4738b7 100644
 --- a/xlators/mgmt/glusterd/src/glusterd-quota.c
diff --git a/pkgs/tools/filesystems/gocrypfs/default.nix b/pkgs/tools/filesystems/gocrypfs/default.nix
index c156cd13244a..b9314015cf55 100644
--- a/pkgs/tools/filesystems/gocrypfs/default.nix
+++ b/pkgs/tools/filesystems/gocrypfs/default.nix
@@ -21,7 +21,8 @@ in buildGoPackage rec {
     sha256 = "0p173x2s0km7a43h6ihir5p19fdlkkb9lc9120k9hccr33iws25z";
   };
 
-  buildInputs = [pkgconfig openssl];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ openssl];
 
   goDeps = ./deps.nix;
 
diff --git a/pkgs/tools/filesystems/grive/default.nix b/pkgs/tools/filesystems/grive/default.nix
index 4e4a139f9adc..9f4472c27f19 100644
--- a/pkgs/tools/filesystems/grive/default.nix
+++ b/pkgs/tools/filesystems/grive/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchgit, cmake, libgcrypt, json_c, curl, expat, boost, binutils }:
+{ stdenv, fetchgit, cmake, libgcrypt, json_c, curl, expat, boost, libiberty }:
 
 stdenv.mkDerivation rec {
   version = "0.3.0";
@@ -10,10 +10,10 @@ stdenv.mkDerivation rec {
     sha256 = "11cqfcjl128nfg1rjvpvr9x1x2ch3kyliw4vi14n51zqp82f9ysb";
   };
 
-  buildInputs = [cmake libgcrypt json_c curl expat stdenv binutils boost];
+  buildInputs = [cmake libgcrypt json_c curl expat stdenv libiberty boost];
 
-  # work around new binutils headers, see
-  # http://stackoverflow.com/questions/11748035/binutils-bfd-h-wants-config-h-now
+  # work around new libiberty headers, see
+  # http://stackoverflow.com/questions/11748035/libiberty-bfd-h-wants-config-h-now
   prePatch = ''
     sed -i '1i#define PACKAGE "grive"\n#define PACKAGE_VERSION "${version}"' \
       libgrive/src/bfd/SymbolInfo.cc
diff --git a/pkgs/tools/filesystems/grive2/default.nix b/pkgs/tools/filesystems/grive2/default.nix
index a3ee1b67bab2..f4bb5592abdb 100644
--- a/pkgs/tools/filesystems/grive2/default.nix
+++ b/pkgs/tools/filesystems/grive2/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, pkgconfig, fetchurl, yajl, cmake, libgcrypt, curl, expat, boost, binutils }:
+{ stdenv, fetchFromGitHub, pkgconfig, fetchurl, yajl, cmake, libgcrypt, curl, expat, boost, libiberty }:
 
 stdenv.mkDerivation rec {
   version = "0.5.0";
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake pkgconfig ];
 
-  buildInputs = [ libgcrypt yajl curl expat stdenv boost binutils ];
+  buildInputs = [ libgcrypt yajl curl expat stdenv boost libiberty ];
 
   meta = with stdenv.lib; {
     description = "A console Google Drive client";
diff --git a/pkgs/tools/filesystems/hubicfuse/default.nix b/pkgs/tools/filesystems/hubicfuse/default.nix
index 88922d9ce944..e9d3df026b08 100644
--- a/pkgs/tools/filesystems/hubicfuse/default.nix
+++ b/pkgs/tools/filesystems/hubicfuse/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "1y4n63bk9vd6n1l5psjb9xm9h042kw4yh2ni33z7agixkanajv1s";
   };
 
-  buildInputs = [ pkgconfig curl openssl fuse libxml2 json_c file ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ curl openssl fuse libxml2 json_c file ];
   postInstall = ''
     install hubic_token $out/bin
     mkdir -p $out/sbin
diff --git a/pkgs/tools/filesystems/irods/common.nix b/pkgs/tools/filesystems/irods/common.nix
index 9c5412ddef7c..c7267aca1071 100644
--- a/pkgs/tools/filesystems/irods/common.nix
+++ b/pkgs/tools/filesystems/irods/common.nix
@@ -9,8 +9,6 @@ with stdenv;
 
   buildInputs = [ bzip2 zlib autoconf automake cmake gnumake help2man texinfo libtool cppzmq libarchive avro-cpp jansson zeromq openssl pam libiodbc kerberos gcc boost libcxx which ];
 
-  propagateBuildInputs = [ boost ];
-
   cmakeFlags = [
     "-DIRODS_EXTERNALS_FULLPATH_CLANG=${stdenv.cc}"
     "-DIRODS_EXTERNALS_FULLPATH_CLANG_RUNTIME=${stdenv.cc}"
diff --git a/pkgs/tools/filesystems/irods/default.nix b/pkgs/tools/filesystems/irods/default.nix
index b5f178d59fc0..523028f5fb2e 100644
--- a/pkgs/tools/filesystems/irods/default.nix
+++ b/pkgs/tools/filesystems/irods/default.nix
@@ -53,17 +53,15 @@ in rec {
 
   # icommands (CLI) package, depends on the irods package
   irods-icommands = stdenv.mkDerivation (common // rec {
-     version = "4.2.0";
+     version = "4.2.1";
      name = "irods-icommands-${version}";
      src = fetchurl {
        url = "http://github.com/irods/irods_client_icommands/archive/${version}.tar.gz";
-       sha256 = "b581067c8139b5ef7897f15fc1fc79f69d2e784a0f36d96e8fa3cb260b6378ce";
+       sha256 = "1kg07frv2rf32nf53a1nxscwzgr0rpgxvp5fkmh5439knby10fqw";
      };
 
      buildInputs = common.buildInputs ++ [ irods ];
 
-     propagateBuildInputs = [ boost ];
-
      preConfigure = common.preConfigure + ''
        patchShebangs ./bin
      '';
diff --git a/pkgs/tools/filesystems/jmtpfs/default.nix b/pkgs/tools/filesystems/jmtpfs/default.nix
index 091270deab66..6044806a34b7 100644
--- a/pkgs/tools/filesystems/jmtpfs/default.nix
+++ b/pkgs/tools/filesystems/jmtpfs/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation {
     owner = "JasonFerrara";
   };
 
-  buildInputs = [ file fuse libmtp pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ file fuse libmtp ];
 
   meta = with stdenv.lib; {
     description = "A FUSE filesystem for MTP devices like Android phones";
diff --git a/pkgs/tools/filesystems/lizardfs/default.nix b/pkgs/tools/filesystems/lizardfs/default.nix
index a50d8341f6b0..0c8f05d6904d 100644
--- a/pkgs/tools/filesystems/lizardfs/default.nix
+++ b/pkgs/tools/filesystems/lizardfs/default.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation rec {
   name = "lizardfs-${version}";
-  version = "3.10.2";
+  version = "3.11.3";
 
   src = fetchFromGitHub {
     owner = "lizardfs";
     repo = "lizardfs";
     rev = "v${version}";
-    sha256 = "0xw6skprxw0wcbqh4yx8f8a4q00x0sfz42llqgd047bcbga1k5zg";
+    sha256 = "1njgj242vgpdqb1di321jfqk4al5lk72x2iyp0nldy7h6r98l2ww";
   };
 
   buildInputs = 
diff --git a/pkgs/tools/filesystems/mhddfs/default.nix b/pkgs/tools/filesystems/mhddfs/default.nix
index 54a8f8459152..697256982bbf 100644
--- a/pkgs/tools/filesystems/mhddfs/default.nix
+++ b/pkgs/tools/filesystems/mhddfs/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "14ggmh91vv69fp2qpz0nxp0hprlw2wsijss2k2485hb0ci4cabvh";
   };
 
-  buildInputs = [ fuse pkgconfig attr uthash ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ fuse attr uthash ];
 
   patches = [
     ./fix-format-security-error.patch
diff --git a/pkgs/tools/filesystems/mtpfs/default.nix b/pkgs/tools/filesystems/mtpfs/default.nix
index 7725b0d7af8e..ac1a7c1c1485 100644
--- a/pkgs/tools/filesystems/mtpfs/default.nix
+++ b/pkgs/tools/filesystems/mtpfs/default.nix
@@ -3,7 +3,8 @@
 stdenv.mkDerivation rec {
   name = "mtpfs-1.1";
 
-  buildInputs = [ pkgconfig fuse libmtp glib libid3tag libmad ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ fuse libmtp glib libid3tag libmad ];
 
   # adding LIBS is a hack, duno why it does not find libid3tag.so by adding buildInputs
   preConfigure = ''
@@ -18,7 +19,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = {
-    homepage = https://code.google.com/p/mtpfs/;
+    homepage = https://github.com/cjd/mtpfs;
     description = "FUSE Filesystem providing access to MTP devices";
     platforms = stdenv.lib.platforms.all;
     maintainers = [ stdenv.lib.maintainers.qknight ];
diff --git a/pkgs/tools/filesystems/netatalk/default.nix b/pkgs/tools/filesystems/netatalk/default.nix
index 0214afce6d45..33b473df5a22 100644
--- a/pkgs/tools/filesystems/netatalk/default.nix
+++ b/pkgs/tools/filesystems/netatalk/default.nix
@@ -1,20 +1,28 @@
-{ fetchurl, stdenv, pkgconfig, db, libgcrypt, avahi, libiconv, pam, openssl, acl, ed, glibc }:
+{ fetchurl, stdenv, autoreconfHook, pkgconfig, perl, python
+, db, libgcrypt, avahi, libiconv, pam, openssl, acl
+, ed, glibc
+}:
 
 stdenv.mkDerivation rec{
-  name = "netatalk-3.1.7";
+  name = "netatalk-3.1.11";
 
   src = fetchurl {
     url = "mirror://sourceforge/netatalk/netatalk/${name}.tar.bz2";
-    sha256 = "0wf09fyqzza024qr1s26z5x7rsvh9zb4pv598gw7gm77wjcr6174";
+    sha256 = "3434472ba96d3bbe3b024274438daad83b784ced720f7662a4c1d0a1078799a6";
   };
 
-  buildInputs = [ pkgconfig db libgcrypt avahi libiconv pam openssl acl ];
+  patches = [
+    ./no-suid.patch
+    ./omitLocalstatedirCreation.patch
+  ];
+
+  nativeBuildInputs = [ autoreconfHook pkgconfig perl python python.pkgs.wrapPython ];
 
-  patches = ./omitLocalstatedirCreation.patch;
+  buildInputs = [ db libgcrypt avahi libiconv pam openssl acl ];
 
   configureFlags = [
     "--with-bdb=${db}"
-    "--with-openssl=${openssl.dev}"
+    "--with-ssl-dir=${openssl.dev}"
     "--with-lockfile=/run/lock/netatalk"
     "--localstatedir=/var/lib"
   ];
@@ -35,6 +43,11 @@ stdenv.mkDerivation rec{
     EOF
   '';
 
+  postInstall = ''
+    buildPythonPath ${python.pkgs.dbus-python}
+    patchPythonScript $out/bin/afpstats
+  '';
+
   enableParallelBuilding = true;
 
   meta = {
diff --git a/pkgs/tools/filesystems/netatalk/no-suid.patch b/pkgs/tools/filesystems/netatalk/no-suid.patch
new file mode 100644
index 000000000000..194c1f5fac9f
--- /dev/null
+++ b/pkgs/tools/filesystems/netatalk/no-suid.patch
@@ -0,0 +1,11 @@
+diff --git a/bin/afppasswd/Makefile.am b/bin/afppasswd/Makefile.am
+index 578eac1..d17aa22 100644
+--- a/bin/afppasswd/Makefile.am
++++ b/bin/afppasswd/Makefile.am
+@@ -16,5 +16,5 @@ AM_CFLAGS = @SSL_CFLAGS@ -I$(top_srcdir)/sys \
+ 
+ install-exec-hook:
+ if HAVE_OPENSSL
+-	chmod u+s $(DESTDIR)$(bindir)/afppasswd
++#	chmod u+s $(DESTDIR)$(bindir)/afppasswd
+ endif
diff --git a/pkgs/tools/filesystems/netatalk/omitLocalstatedirCreation.patch b/pkgs/tools/filesystems/netatalk/omitLocalstatedirCreation.patch
index d1a9dcb0b3bf..01c4ee9ba478 100644
--- a/pkgs/tools/filesystems/netatalk/omitLocalstatedirCreation.patch
+++ b/pkgs/tools/filesystems/netatalk/omitLocalstatedirCreation.patch
@@ -1,35 +1,19 @@
-diff -ur netatalk-3.1.7-old/config/Makefile.in netatalk-3.1.7-new/config/Makefile.in 
---- netatalk-3.1.7-old/config/Makefile.in	2014-08-29 03:33:35.000000000 -0700
-+++ netatalk-3.1.7-new/config/Makefile.in	2015-08-13 20:52:35.000000000 -0700
-@@ -699,7 +699,7 @@
- 
- info-am:
- 
--install-data-am: install-data-local install-dbusserviceDATA
-+install-data-am: install-dbusserviceDATA
- 
- install-dvi: install-dvi-recursive
- 
-@@ -754,7 +754,7 @@
- 	cscopelist cscopelist-recursive ctags ctags-recursive \
- 	distclean distclean-generic distclean-libtool distclean-tags \
- 	distdir dvi dvi-am html html-am info info-am install \
--	install-am install-data install-data-am install-data-local \
-+	install-am install-data install-data-am \
- 	install-dbusserviceDATA install-dvi install-dvi-am \
- 	install-exec install-exec-am install-html install-html-am \
- 	install-info install-info-am install-man install-pdf \
-@@ -782,12 +782,6 @@
- # install configuration files
+diff --git a/config/Makefile.am b/config/Makefile.am
+index c98a2ab..58b7f0a 100644
+--- a/config/Makefile.am
++++ b/config/Makefile.am
+@@ -36,10 +36,10 @@ endif
  #
  
--install-data-local: install-config-files
+ install-data-local: install-config-files
 -	mkdir -pm 0755 $(DESTDIR)$(localstatedir)/netatalk/
 -	mkdir -pm 0755 $(DESTDIR)$(localstatedir)/netatalk/CNID/
 -	$(INSTALL_DATA) $(srcdir)/README $(DESTDIR)$(localstatedir)/netatalk/
 -	$(INSTALL_DATA) $(srcdir)/README $(DESTDIR)$(localstatedir)/netatalk/CNID/
--
++#	mkdir -pm 0755 $(DESTDIR)$(localstatedir)/netatalk/
++#	mkdir -pm 0755 $(DESTDIR)$(localstatedir)/netatalk/CNID/
++#	$(INSTALL_DATA) $(srcdir)/README $(DESTDIR)$(localstatedir)/netatalk/
++#	$(INSTALL_DATA) $(srcdir)/README $(DESTDIR)$(localstatedir)/netatalk/CNID/
+ 
  uninstall-local:
  	@for f in $(CONFFILES) $(GENFILES); do \
- 		echo rm -f $(DESTDIR)$(pkgconfdir)/$$f; \
-
diff --git a/pkgs/tools/filesystems/nilfs-utils/default.nix b/pkgs/tools/filesystems/nilfs-utils/default.nix
index c5cc4f053a23..977add39b94b 100644
--- a/pkgs/tools/filesystems/nilfs-utils/default.nix
+++ b/pkgs/tools/filesystems/nilfs-utils/default.nix
@@ -1,9 +1,9 @@
 { stdenv, fetchurl, libuuid, libselinux }:
 let 
   sourceInfo = rec {
-    version = "2.2.6";
+    version = "2.2.7";
     url = "http://nilfs.sourceforge.net/download/nilfs-utils-${version}.tar.bz2";
-    sha256 = "1rjj6pv7yx5wm7b3w6hv88v6r53jqaam5nrnkw2and4ifhsprf3y";
+    sha256 = "01f09bvjk2crx65pxmxiw362wkkl3v2v144dfn3i7bk5gz253xic";
     baseName = "nilfs-utils";
     name = "${baseName}-${version}";
   };
@@ -23,8 +23,14 @@ stdenv.mkDerivation rec {
     sed -e 's@/sbin/@'"$out"'/sbin/@' -i ./lib/cleaner*.c
   '';
 
-  # FIXME: Remove after https://github.com/NixOS/patchelf/pull/98 is in
-  dontPatchELF = true;
+  # FIXME: https://github.com/NixOS/patchelf/pull/98 is in, but stdenv
+  # still doesn't use it
+  #
+  # To make sure patchelf doesn't mistakenly keep the reference via
+  # build directory
+  postInstall = ''
+    find . -name .libs | xargs rm -rf
+  '';
 
   meta = {
     description = "NILFS utilities";
diff --git a/pkgs/tools/filesystems/nixpart/0.4/cryptsetup.nix b/pkgs/tools/filesystems/nixpart/0.4/cryptsetup.nix
index c612512b8cc9..24eec2f0dc46 100644
--- a/pkgs/tools/filesystems/nixpart/0.4/cryptsetup.nix
+++ b/pkgs/tools/filesystems/nixpart/0.4/cryptsetup.nix
@@ -15,7 +15,8 @@ stdenv.mkDerivation rec {
   configureFlags = [ "--enable-cryptsetup-reencrypt" ]
                 ++ stdenv.lib.optional enablePython "--enable-python";
 
-  buildInputs = [ devicemapper libgcrypt libuuid pkgconfig popt ]
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ devicemapper libgcrypt libuuid popt ]
              ++ stdenv.lib.optional enablePython python;
 
   meta = {
diff --git a/pkgs/tools/filesystems/nixpart/0.4/lvm2.nix b/pkgs/tools/filesystems/nixpart/0.4/lvm2.nix
index 6301cbb6842a..df14d7efda4e 100644
--- a/pkgs/tools/filesystems/nixpart/0.4/lvm2.nix
+++ b/pkgs/tools/filesystems/nixpart/0.4/lvm2.nix
@@ -15,7 +15,8 @@ stdenv.mkDerivation {
   configureFlags =
     "--disable-readline --enable-udev_rules --enable-udev_sync --enable-pkgconfig --enable-applib";
 
-  buildInputs = [ pkgconfig systemd ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ systemd ];
 
   preConfigure =
     ''
diff --git a/pkgs/tools/filesystems/nixpart/0.4/pyparted.nix b/pkgs/tools/filesystems/nixpart/0.4/pyparted.nix
index 0d3370c4b1e8..fd6c5b913093 100644
--- a/pkgs/tools/filesystems/nixpart/0.4/pyparted.nix
+++ b/pkgs/tools/filesystems/nixpart/0.4/pyparted.nix
@@ -24,7 +24,7 @@ buildPythonApplication rec {
     PATH="${parted}/sbin:$PATH"
   '';
 
-  buildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
 
   propagatedBuildInputs = [ parted ];
 
diff --git a/pkgs/tools/filesystems/rdfind/default.nix b/pkgs/tools/filesystems/rdfind/default.nix
index 853654c0f790..b421a768b3dc 100644
--- a/pkgs/tools/filesystems/rdfind/default.nix
+++ b/pkgs/tools/filesystems/rdfind/default.nix
@@ -2,20 +2,20 @@
 
 stdenv.mkDerivation rec {
   name = "rdfind-${version}";
-  version = "1.3.4";
+  version = "1.3.5";
 
   src = fetchurl {
-    url = "http://rdfind.pauldreik.se/${name}.tar.gz";
-    sha256 = "0zfc5whh6j5xfbxr6wvznk62qs1mkd3r7jcq72wjgnck43vv7w55";
+    url = "https://rdfind.pauldreik.se/${name}.tar.gz";
+    sha256 = "0i63f2lwwkiq5m8shi3wwi59i1s25r6dx6flsgqxs1jvlcg0lvn3";
   };
 
   buildInputs = [ nettle ];
 
-  meta = {
-    homepage = http://rdfind.pauldreik.se/;
+  meta = with stdenv.lib; {
+    homepage = https://rdfind.pauldreik.se/;
     description = "Removes or hardlinks duplicate files very swiftly";
     license = stdenv.lib.licenses.gpl2;
-    maintainers = with stdenv.lib.maintainers; [ wmertens ];
-    platforms = with stdenv.lib.platforms; all;
+    maintainers = [ maintainers.wmertens ];
+    platforms = platforms.all;
   };
 }
diff --git a/pkgs/tools/filesystems/relfs/default.nix b/pkgs/tools/filesystems/relfs/default.nix
index 0c8e1c4ef81a..9a8c3ecb0fc8 100644
--- a/pkgs/tools/filesystems/relfs/default.nix
+++ b/pkgs/tools/filesystems/relfs/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
 		sha256 = "949f8eff7e74ff2666cccf8a1efbfcce8d54bc41bec6ad6db8c029de7ca832a3";
 	};
 
-  buildInputs = [ ocaml fuse postgresql pcre libuuid gnome_vfs pkgconfig GConf ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ ocaml fuse postgresql pcre libuuid gnome_vfs GConf ];
 
   buildPhase = ''
     cd deps
diff --git a/pkgs/tools/filesystems/s3backer/default.nix b/pkgs/tools/filesystems/s3backer/default.nix
index cc31a6680597..b39be214d89f 100644
--- a/pkgs/tools/filesystems/s3backer/default.nix
+++ b/pkgs/tools/filesystems/s3backer/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with stdenv.lib; {
-    homepage = http://code.google.com/p/s3backer/;
+    homepage = https://github.com/archiecobbs/s3backer;
     description = "FUSE-based single file backing store via Amazon S3";
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ nckx ];
diff --git a/pkgs/tools/filesystems/s3fs/default.nix b/pkgs/tools/filesystems/s3fs/default.nix
index fa975790d4a6..9d7e9eaee95e 100644
--- a/pkgs/tools/filesystems/s3fs/default.nix
+++ b/pkgs/tools/filesystems/s3fs/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "s3fs-fuse-${version}";
-  version = "1.80";
+  version = "1.82";
 
   src = fetchFromGitHub {
     owner  = "s3fs-fuse";
     repo   = "s3fs-fuse";
     rev    = "v${version}";
-    sha256 = "0yikqpdyjibbb36rj4118lv9nxgp9f5jhydzxijzxrzw29ypvw76";
+    sha256 = "0bammbb8h10n51qk5141gabsd5p91qbaqq7cwa1q8yf5qglwlp10";
   };
 
   buildInputs = [ curl openssl libxml2 fuse ];
diff --git a/pkgs/tools/filesystems/smbnetfs/default.nix b/pkgs/tools/filesystems/smbnetfs/default.nix
index 3bc13d43a362..7ff42c4d1f99 100644
--- a/pkgs/tools/filesystems/smbnetfs/default.nix
+++ b/pkgs/tools/filesystems/smbnetfs/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "16sikr81ipn8v1a1zrqgnsy2as3zcaxbzkr0bm5vxy012bq0plkd";
   };
 
-  buildInputs = [ fuse samba pkgconfig glib ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ fuse samba glib ];
 
   meta = with stdenv.lib; {
     description = "A FUSE FS for mounting Samba shares";
@@ -18,6 +19,6 @@ stdenv.mkDerivation rec {
     downloadPage = "http://sourceforge.net/projects/smbnetfs/files/smbnetfs";
     updateWalker = true;
     inherit version;
-    homepage = http://sourceforge.net/projects/smbnetfs/;
+    homepage = https://sourceforge.net/projects/smbnetfs/;
   };
 }
diff --git a/pkgs/tools/filesystems/snapraid/default.nix b/pkgs/tools/filesystems/snapraid/default.nix
index ccb20e9f1bd0..597be1b0f42f 100644
--- a/pkgs/tools/filesystems/snapraid/default.nix
+++ b/pkgs/tools/filesystems/snapraid/default.nix
@@ -8,12 +8,13 @@ stdenv.mkDerivation rec {
     owner = "amadvance";
     repo = "snapraid";
     rev = "v${version}";
-    sha256 = "13v0gz22ng09gs87f7900z2sk2hg5543njl32rfn4cxxp0jncs3r";
+    sha256 = "1vgyiagn6qvyyz4jkf8pzlg0w9apb6mzza97a9x03p82fav2afx0";
   };
 
   doCheck = true;
 
-  buildInputs = [ autoreconfHook ];
+  nativeBuildInputs = [ autoreconfHook ];
+  buildInputs = [ ];
 
   meta = {
     homepage = http://www.snapraid.it/;
diff --git a/pkgs/tools/filesystems/sshfs-fuse/build-man-pages.patch b/pkgs/tools/filesystems/sshfs-fuse/build-man-pages.patch
new file mode 100644
index 000000000000..fba1d250c42b
--- /dev/null
+++ b/pkgs/tools/filesystems/sshfs-fuse/build-man-pages.patch
@@ -0,0 +1,11 @@
+--- a/meson.build	2017-09-23 22:02:57.770555382 +0200
++++ b/meson.build	2017-09-23 23:11:28.258095182 +0200
+@@ -25,7 +25,7 @@
+ endif
+ 
+ 
+-rst2man = find_program('rst2man', required: false)
++rst2man = find_program('rst2man.py', required: true)
+   
+ cfg = configuration_data()
+ 
diff --git a/pkgs/tools/filesystems/sshfs-fuse/default.nix b/pkgs/tools/filesystems/sshfs-fuse/default.nix
index c1502a3227d2..eebe3076c98a 100644
--- a/pkgs/tools/filesystems/sshfs-fuse/default.nix
+++ b/pkgs/tools/filesystems/sshfs-fuse/default.nix
@@ -1,17 +1,28 @@
-{ stdenv, fetchFromGitHub, pkgconfig, glib, fuse, autoreconfHook }:
+{ stdenv, fetchFromGitHub, meson, pkgconfig, ninja, glib, fuse3
+, buildManPages ? true, docutils
+}:
 
-stdenv.mkDerivation rec {
-  version = "2.10"; # Temporary (need to add libfuse 3.x first)
+let
+  inherit (stdenv.lib) optional;
+in stdenv.mkDerivation rec {
+  version = "3.3.1";
   name = "sshfs-fuse-${version}";
-  
+
   src = fetchFromGitHub {
     owner = "libfuse";
     repo = "sshfs";
     rev = "sshfs-${version}";
-    sha256 = "1dmw4kx6vyawcywiv8drrajnam0m29mxfswcp4209qafzx3mjlp1";
+    sha256 = "15z1mlad09llckkadvjfzmbv14fbq218xmb4axkmi7kzixbi41hv";
   };
-  
-  buildInputs = [ pkgconfig glib fuse autoreconfHook ];
+
+  patches = optional buildManPages ./build-man-pages.patch;
+
+  nativeBuildInputs = [ meson pkgconfig ninja ];
+  buildInputs = [ fuse3 glib ] ++ optional buildManPages docutils;
+
+  NIX_CFLAGS_COMPILE = stdenv.lib.optional
+    (stdenv.system == "i686-linux")
+    "-D_FILE_OFFSET_BITS=64";
 
   postInstall = ''
     mkdir -p $out/sbin
diff --git a/pkgs/tools/filesystems/u3-tool/default.nix b/pkgs/tools/filesystems/u3-tool/default.nix
new file mode 100644
index 000000000000..65eafe76710d
--- /dev/null
+++ b/pkgs/tools/filesystems/u3-tool/default.nix
@@ -0,0 +1,22 @@
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  pname = "u3-tool";
+  version = "0.3";
+  name = "${pname}-${version}";
+
+  enableParallelBuilding = true;
+
+  src = fetchurl {
+    url = "mirror://sourceforge/${pname}/${name}.tar.gz";
+    sha256 = "1p9c9kibd1pdbdfa0nd0i3n7bvzi3xg0chm38jg3xfl8gsn0390f";
+  };
+
+  meta = with stdenv.lib; {
+    description = "Tool for controlling the special features of a 'U3 smart drive' USB Flash disk";
+    homepage = https://sourceforge.net/projects/u3-tool/ ;
+    license = licenses.gpl2;
+    platforms = with platforms; linux;
+    maintainers = with maintainers; [ makefu ];
+  };
+}
diff --git a/pkgs/tools/filesystems/wdfs/default.nix b/pkgs/tools/filesystems/wdfs/default.nix
index a51f2d47172e..dc725b5078f0 100644
--- a/pkgs/tools/filesystems/wdfs/default.nix
+++ b/pkgs/tools/filesystems/wdfs/default.nix
@@ -7,7 +7,8 @@ stdenv.mkDerivation rec
     url = "http://noedler.de/projekte/wdfs/wdfs-1.4.2.tar.gz";
     sha256 = "fcf2e1584568b07c7f3683a983a9be26fae6534b8109e09167e5dff9114ba2e5";
   };
-  buildInputs = [fuse glib neon pkgconfig];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [fuse glib neon];
   meta = {
     homepage = http://noedler.de/projekte/wdfs/;
     description = "User-space filesystem that allows to mount a webdav share";
diff --git a/pkgs/tools/filesystems/xfsprogs/4.3.0-sharedlibs.patch b/pkgs/tools/filesystems/xfsprogs/4.3.0-sharedlibs.patch
deleted file mode 100644
index 622708f7b9c9..000000000000
--- a/pkgs/tools/filesystems/xfsprogs/4.3.0-sharedlibs.patch
+++ /dev/null
@@ -1,89 +0,0 @@
---- xfsprogs-4.3.0/include/buildmacros
-+++ xfsprogs-4.3.0/include/buildmacros
-@@ -70,18 +70,9 @@
- # /usr/lib.
- ifeq ($(ENABLE_SHARED),yes)
- INSTALL_LTLIB_DEV = \
--	cd $(TOPDIR)/$(LIBNAME)/.libs; \
--	../$(INSTALL) -m 755 -d $(PKG_LIB_DIR); \
--	../$(INSTALL) -m 644 -T old_lib $(LIBNAME).lai $(PKG_LIB_DIR); \
--	../$(INSTALL) -m 644 $(LIBNAME).lai $(PKG_LIB_DIR)/$(LIBNAME).la ; \
--	../$(INSTALL) -m 755 -d $(PKG_ROOT_LIB_DIR); \
--	../$(INSTALL) -T so_base $(LIBNAME).lai $(PKG_ROOT_LIB_DIR); \
--	if [ "x$(shell readlink -f $(PKG_LIB_DIR))" != \
--	     "x$(shell readlink -f $(PKG_ROOT_LIB_DIR))" ]; then \
--		../$(INSTALL) -S $(PKG_LIB_DIR)/$(LIBNAME).a $(PKG_ROOT_LIB_DIR)/$(LIBNAME).a; \
--		../$(INSTALL) -S $(PKG_LIB_DIR)/$(LIBNAME).la $(PKG_ROOT_LIB_DIR)/$(LIBNAME).la; \
--		../$(INSTALL) -S $(PKG_ROOT_LIB_DIR)/$(LIBNAME).so $(PKG_LIB_DIR)/$(LIBNAME).so; \
--	fi
-+	set -e; cd $(TOPDIR)/$(LIBNAME); \
-+	$(INSTALL) -m 755 -d $(PKG_LIB_DIR); \
-+	env -uDIST_ROOT $(LTINSTALL) $(TOPDIR)/$(LIBNAME)/$(LIBNAME).la $(DIST_ROOT)$(PKG_LIB_DIR)/$(LIBNAME).la
- else
- INSTALL_LTLIB_DEV = $(INSTALL_LTLIB_STATIC)
- endif
---- xfsprogs-4.3.0/libxcmd/Makefile
-+++ xfsprogs-4.3.0/libxcmd/Makefile
-@@ -34,6 +34,9 @@
- 
- include $(BUILDRULES)
- 
--install install-dev: default
-+install: default
-+
-+install-dev: default
-+	$(INSTALL_LTLIB_DEV)
- 
- -include .ltdep
---- xfsprogs-4.3.0/libxfs/Makefile
-+++ xfsprogs-4.3.0/libxfs/Makefile
-@@ -138,6 +138,7 @@
- 
- install-dev: install
- 	$(INSTALL) -m 644 $(PKGHFILES) $(PKG_INC_DIR)
-+	$(INSTALL_LTLIB_DEV)
- 
- # We need to install the headers before building the dependencies.  If we
- # include the .ltdep file, the makefile decides that it needs to build the
---- xfsprogs-4.3.0/libxlog/Makefile
-+++ xfsprogs-4.3.0/libxlog/Makefile
-@@ -12,6 +12,8 @@
- 
- CFILES = xfs_log_recover.c util.c
- 
-+LTLIBS = $(LIBUUID) $(LIBXFS)
-+
- # don't want to link xfs_repair with a debug libxlog.
- DEBUG = -DNDEBUG
- 
-@@ -19,6 +21,9 @@
- 
- include $(BUILDRULES)
- 
--install install-dev: default
-+install: default
-+
-+install-dev: default
-+	$(INSTALL_LTLIB_DEV)
- 
- -include .ltdep
---- xfsprogs-4.3.0/quota/Makefile
-+++ xfsprogs-4.3.0/quota/Makefile
-@@ -16,7 +16,6 @@ LSRCFILES = $(shell echo $(PCFILES) | sed -e "s/$(PKG_PLATFORM).c//g")
- 
- LLDLIBS = $(LIBXCMD)
- LTDEPENDENCIES = $(LIBXCMD)
--LLDFLAGS = -static
- 
- ifeq ($(ENABLE_READLINE),yes)
- LLDLIBS += $(LIBREADLINE) $(LIBTERMCAP)
---- xfsprogs-4.3.0/mdrestore/Makefile
-+++ xfsprogs-4.3.0/mdrestore/Makefile
-@@ -10,7 +10,6 @@ CFILES = xfs_mdrestore.c
- 
- LLDLIBS = $(LIBXFS) $(LIBRT) $(LIBPTHREAD) $(LIBUUID)
- LTDEPENDENCIES = $(LIBXFS)
--LLDFLAGS = -static
- 
- default: depend $(LTCOMMAND)
- 
diff --git a/pkgs/tools/filesystems/xfsprogs/default.nix b/pkgs/tools/filesystems/xfsprogs/default.nix
index eaea921c6f5c..3170eb964171 100644
--- a/pkgs/tools/filesystems/xfsprogs/default.nix
+++ b/pkgs/tools/filesystems/xfsprogs/default.nix
@@ -2,19 +2,19 @@
 
 let
   gentooPatch = name: sha256: fetchpatch {
-    url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/sys-fs/xfsprogs/files/${name}?id=8293574ab30c85e2965fb2b7dd890b44841b8404";
+    url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/sys-fs/xfsprogs/files/${name}?id=f4055adc94e11d182033a71e32f97b357c034aff";
     inherit sha256;
   };
 in
 
 stdenv.mkDerivation rec {
   name = "xfsprogs-${version}";
-  version = "4.11.0";
+  version = "4.13.1";
 
   src = fetchgit {
     url = "git://git.kernel.org/pub/scm/fs/xfs/xfsprogs-dev.git";
     rev = "refs/tags/v${version}";
-    sha256 = "0icliinacg6c3ziaqzyyxfz9jykn80njj9fdv3milhsf81yhnrpn";
+    sha256 = "0h4wb8pp8wdcyqpz2ixlghz9yfd2sp9xa20s435g5rfp6ljrh6zb";
   };
 
   outputs = [ "bin" "dev" "out" "doc" ];
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
 
   # Why is all this garbage needed? Why? Why?
   patches = [
-    (gentooPatch "xfsprogs-4.7.0-sharedlibs.patch" "1s83ihaccmjrw4zm0nbdwqk3jx4wc1rijpsqrg7ir71ln7qknwzz")
+    (gentooPatch "xfsprogs-4.12.0-sharedlibs.patch" "1i081749x91jvlrw84l4a3r081vqcvn6myqhnqbnfcfhd64h12bq")
     (gentooPatch "xfsprogs-4.7.0-libxcmd-link.patch" "1lvy1ajzml39a631a7jqficnzsd40bzkca7hkxv1ybiqyp8sf55s")
     (gentooPatch "xfsprogs-4.9.0-underlinking.patch" "1r7l8jphspy14i43zbfnjrnyrdm4cpgyfchblascxylmans0gci7")
   ];
diff --git a/pkgs/tools/filesystems/zkfuse/default.nix b/pkgs/tools/filesystems/zkfuse/default.nix
index 0738ee84cab7..9dfb2deeaee3 100644
--- a/pkgs/tools/filesystems/zkfuse/default.nix
+++ b/pkgs/tools/filesystems/zkfuse/default.nix
@@ -6,7 +6,8 @@ stdenv.mkDerivation rec {
 
   sourceRoot = "${zookeeper.name}/src/contrib/zkfuse";
 
-  buildInputs = [ autoreconfHook zookeeper_mt log4cxx boost fuse ];
+  nativeBuildInputs = [ autoreconfHook ];
+  buildInputs = [ zookeeper_mt log4cxx boost fuse ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/tools/graphics/asymptote/default.nix b/pkgs/tools/graphics/asymptote/default.nix
index de3ba3621a88..6c6a93dc73ac 100644
--- a/pkgs/tools/graphics/asymptote/default.nix
+++ b/pkgs/tools/graphics/asymptote/default.nix
@@ -50,6 +50,8 @@ stdenv.mkDerivation {
     sed -i -e 's|(asymptote/asymptote)|(asymptote)|' $out/share/info/asymptote.info
     rmdir $out/share/info/asymptote
     rm $out/share/info/dir
+
+    rm -rf "$out"/share/texmf
   '';
 
   enableParallelBuilding = true;
diff --git a/pkgs/tools/graphics/cuneiform/default.nix b/pkgs/tools/graphics/cuneiform/default.nix
index 6ae6df35a511..0a48e947a48e 100644
--- a/pkgs/tools/graphics/cuneiform/default.nix
+++ b/pkgs/tools/graphics/cuneiform/default.nix
@@ -9,12 +9,24 @@ stdenv.mkDerivation rec {
     sha256 = "1bdvppyfx2184zmzcylskd87cxv56d8f32jf7g1qc8779l2hszjp";
   };
 
-  buildInputs = [
-    cmake imagemagick
+  patches = [
+  (fetchurl {
+    url = "https://git.archlinux.org/svntogit/community.git/plain/cuneiform/trunk/build-fix.patch?id=a2ec92f05de006b56d16ac6a6c370d54a554861a";
+    sha256 = "19cmrlx4khn30qqrpyayn7bicg8yi0wpz1x1bvqqrbvr3kwldxyj";
+  })
   ];
 
+  postPatch = ''
+    rm cuneiform_src/Kern/hhh/tigerh/h/strings.h
+  '';
+
+  buildInputs = [ imagemagick ];
+
+  nativeBuildInputs = [ cmake ];
+
   meta = {
     description = "Multi-language OCR system";
     platforms = stdenv.lib.platforms.linux;
+    maintainers = with stdenv.lib.maintainers; [raskin];
   };
 }
diff --git a/pkgs/tools/graphics/dmtx-utils/default.nix b/pkgs/tools/graphics/dmtx-utils/default.nix
index 3e4e3e9312ed..bb816e489404 100644
--- a/pkgs/tools/graphics/dmtx-utils/default.nix
+++ b/pkgs/tools/graphics/dmtx-utils/default.nix
@@ -9,13 +9,14 @@ let
     url="mirror://sourceforge/project/libdmtx/libdmtx/0.7.4/dmtx-utils-0.7.4.tar.gz";
     sha256="1di8ymlziy9856abd6rb72z0zqzmrff4r3vql0q9r5sk5ax4s417";
   };
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    libdmtx pkgconfig imagemagick
+    libdmtx imagemagick
   ];
 in
 stdenv.mkDerivation {
   inherit (s) name version;
-  inherit buildInputs;
+  inherit nativeBuildInputs buildInputs;
   src = fetchurl {
     inherit (s) url sha256;
   };
diff --git a/pkgs/tools/graphics/editres/default.nix b/pkgs/tools/graphics/editres/default.nix
index 86848f958838..91dd85b0757d 100644
--- a/pkgs/tools/graphics/editres/default.nix
+++ b/pkgs/tools/graphics/editres/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "06kv7dmw6pzlqc46dbh8k9xpb6sn4ihh0bcpxq0zpvw2lm66dx45";
   };
 
-  buildInputs = [ pkgconfig libXt libXaw libXres utilmacros ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libXt libXaw libXres utilmacros ];
 
   configureFlags = "--with-appdefaultdir=$(out)/share/X11/app-defaults/editres";
 
diff --git a/pkgs/tools/graphics/escrotum/default.nix b/pkgs/tools/graphics/escrotum/default.nix
new file mode 100644
index 000000000000..2a4f3c9cbff7
--- /dev/null
+++ b/pkgs/tools/graphics/escrotum/default.nix
@@ -0,0 +1,25 @@
+{ lib, fetchFromGitHub, buildPythonApplication
+, pygtk
+, numpy ? null
+}:
+
+buildPythonApplication {
+  name = "escrotum-2017-01-28";
+
+  src = fetchFromGitHub {
+    owner  = "Roger";
+    repo   = "escrotum";
+    rev    = "a51e330f976c1c9e1ac6932c04c41381722d2171";
+    sha256 = "0vbpyihqgm0fyh22ashy4lhsrk67n31nw3bs14d1wr7ky0l3rdnj";
+  };
+
+  propagatedBuildInputs = [ pygtk numpy ];
+
+  meta = with lib; {
+    homepage = https://github.com/Roger/escrotum;
+    description = "Linux screen capture using pygtk, inspired by scrot";
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ rasendubi ];
+    license = licenses.gpl3;
+  };
+}
diff --git a/pkgs/tools/graphics/exif/default.nix b/pkgs/tools/graphics/exif/default.nix
index 2534a9cbefac..537d1a8c7db9 100644
--- a/pkgs/tools/graphics/exif/default.nix
+++ b/pkgs/tools/graphics/exif/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "1zb9hwdl783d4vd2s2rw642hg8hd6n0mfp6lrbiqmp9jmhlq5rsr";
   };
 
-  buildInputs = [ pkgconfig libexif popt ] ++ libintlOrEmpty;
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libexif popt ] ++ libintlOrEmpty;
 
   meta = {
     homepage = http://libexif.sourceforge.net/;
diff --git a/pkgs/tools/graphics/fim/default.nix b/pkgs/tools/graphics/fim/default.nix
new file mode 100644
index 000000000000..c7a22f00dce7
--- /dev/null
+++ b/pkgs/tools/graphics/fim/default.nix
@@ -0,0 +1,52 @@
+{ stdenv, fetchurl, autoconf, automake, pkgconfig
+, perl, flex, bison, readline, libexif
+, x11Support ? true, SDL
+, svgSupport ? true, inkscape
+, asciiArtSupport ? true, aalib
+, gifSupport ? true, giflib
+, tiffSupport ? true, libtiff
+, jpegSupport ? true, libjpeg
+, pngSupport ? true, libpng
+}:
+
+stdenv.mkDerivation rec {
+  name = "fim-${version}";
+  version = "0.5rc3";
+
+  src = fetchurl {
+    url = mirror://savannah/fbi-improved/fim-0.5-rc3.tar.gz;
+    sha256 = "12aka85h469zfj0zcx3xdpan70gq8nf5rackgb1ldcl9mqjn50c2";
+  };
+
+  postPatch = ''
+   substituteInPlace doc/vim2html.pl \
+     --replace /usr/bin/perl ${perl}/bin/perl
+  '';
+
+  nativeBuildInputs = [ autoconf automake pkgconfig ];
+
+  buildInputs = with stdenv.lib;
+    [ perl flex bison readline libexif ]
+    ++ optional x11Support SDL
+    ++ optional svgSupport inkscape
+    ++ optional asciiArtSupport aalib
+    ++ optional gifSupport giflib
+    ++ optional tiffSupport libtiff
+    ++ optional jpegSupport libjpeg
+    ++ optional pngSupport libpng;
+
+  NIX_CFLAGS_COMPILE = stdenv.lib.optional x11Support "-lSDL";
+
+  meta = with stdenv.lib; {
+    description = "A lightweight, highly customizable and scriptable image viewer";
+    longDescription = ''
+      FIM (Fbi IMproved) is a lightweight, console based image viewer that aims
+      to be a highly customizable and scriptable for users who are comfortable
+      with software like the VIM text editor or the Mutt mail user agent.
+    '';
+    homepage = http://www.nongnu.org/fbi-improved/;
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ primeos ];
+  };
+}
diff --git a/pkgs/tools/graphics/ggobi/default.nix b/pkgs/tools/graphics/ggobi/default.nix
index e7fb3e773c1d..071c8f360792 100644
--- a/pkgs/tools/graphics/ggobi/default.nix
+++ b/pkgs/tools/graphics/ggobi/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "2c4ddc3ab71877ba184523e47b0637526e6f3701bd9afb6472e6dfc25646aed7";
   };
 
-  buildInputs = [ pkgconfig libxml2 gtk2 ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libxml2 gtk2 ];
 
   configureFlags = "--with-all-plugins";
 
diff --git a/pkgs/tools/graphics/gifsicle/default.nix b/pkgs/tools/graphics/gifsicle/default.nix
index 4404a8b6440c..7c5f9eaf5de6 100644
--- a/pkgs/tools/graphics/gifsicle/default.nix
+++ b/pkgs/tools/graphics/gifsicle/default.nix
@@ -4,11 +4,11 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   name = "gifsicle-${version}";
-  version = "1.88";
+  version = "1.90";
 
   src = fetchurl {
     url = "http://www.lcdf.org/gifsicle/${name}.tar.gz";
-    sha256 = "4585d2e683d7f68eb8fcb15504732d71d7ede48ab5963e61915201f9e68305be";
+    sha256 = "0kc35g99fygzjj7qjcy87rdb8mbgmacr2mga9ihgln1dfnbb0wrd";
   };
 
   buildInputs = optional gifview [ xproto libXt libX11 ];
diff --git a/pkgs/tools/graphics/glmark2/default.nix b/pkgs/tools/graphics/glmark2/default.nix
index b794d7ffbef2..0d31f8f1a6f7 100644
--- a/pkgs/tools/graphics/glmark2/default.nix
+++ b/pkgs/tools/graphics/glmark2/default.nix
@@ -1,18 +1,20 @@
-{ stdenv, fetchFromGitHub, pkgconfig, libjpeg, libpng, xorg, libX11, mesa, libdrm, python27, wayland }:
+{ stdenv, fetchFromGitHub, pkgconfig, libjpeg, libpng, xorg, libX11, mesa, libdrm,
+  python27, wayland, libudev }:
 
 stdenv.mkDerivation rec {
   name = "glmark2-${version}";
-  version = "2015-06-11";
+  version = "2017-09-01";
 
   src = fetchFromGitHub {
     owner = "glmark2";
     repo = "glmark2";
-    rev = "fa71af2dfab711fac87b9504b6fc9862f44bf72a";
-    sha256 = "1razwrmwk94wf8y7rnqpas9520gidixzcwa65pg946n823105znw";
+    rev = "7265e8e6c77c4f60302507eca0e18560b1117a86";
+    sha256 = "076l75rfl6pnp1wgiwlaihy1vg2advg1z8bi0x84kk259kldgvwn";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    pkgconfig libjpeg libpng xorg.libxcb libX11 mesa libdrm python27 wayland
+    libjpeg libpng xorg.libxcb libX11 mesa libdrm python27 wayland libudev
   ];
 
   buildPhase = ''
diff --git a/pkgs/tools/graphics/gnuplot/default.nix b/pkgs/tools/graphics/gnuplot/default.nix
index 6100573153ba..7594474538d0 100644
--- a/pkgs/tools/graphics/gnuplot/default.nix
+++ b/pkgs/tools/graphics/gnuplot/default.nix
@@ -21,11 +21,11 @@ let
   withX = libX11 != null && !aquaterm && !stdenv.isDarwin;
 in
 stdenv.mkDerivation rec {
-  name = "gnuplot-5.0.6";
+  name = "gnuplot-5.2.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/gnuplot/${name}.tar.gz";
-    sha256 = "0q5lr6nala3ln6f3yp6g17ziymb9r9gx9zylnw1y3hjmwl9lggjv";
+    sha256 = "123yh0ysahn71nlibsz5qkq18rlf18qqfhrlkvl925ijdgxv1ikx";
   };
 
   buildInputs =
diff --git a/pkgs/tools/graphics/gromit-mpx/default.nix b/pkgs/tools/graphics/gromit-mpx/default.nix
index 376d1bc134df..7261326633a1 100644
--- a/pkgs/tools/graphics/gromit-mpx/default.nix
+++ b/pkgs/tools/graphics/gromit-mpx/default.nix
@@ -14,8 +14,9 @@ stdenv.mkDerivation rec {
     sha256 = "1dkmp5rhzp56sz9cfxill2pkdz2anwb8kkxkypvk2xhqi64cvkrs";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    autoconf automake autoreconfHook pkgconfig
+    autoconf automake autoreconfHook
     gtk glib pcre libappindicator libpthreadstubs
     libXdmcp libxkbcommon epoxy at_spi2_core
     dbus libdbusmenu-glib
diff --git a/pkgs/tools/graphics/leela/default.nix b/pkgs/tools/graphics/leela/default.nix
index 333b0f95b722..d1b31f391526 100644
--- a/pkgs/tools/graphics/leela/default.nix
+++ b/pkgs/tools/graphics/leela/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation {
     sha256 = "1k6n758r9dhjmc1pnpk6qzpg0q7pkq2hf18z3b0s2z198jpkg9s3";
   };
 
-  buildInputs = [ pkgconfig poppler ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ poppler ];
 
   installFlags = [ "PREFIX=$(out)" "MANDIR=$(out)/share/man" ];
 
diff --git a/pkgs/tools/graphics/logstalgia/default.nix b/pkgs/tools/graphics/logstalgia/default.nix
index f7f9211b5154..2f18857b2a16 100644
--- a/pkgs/tools/graphics/logstalgia/default.nix
+++ b/pkgs/tools/graphics/logstalgia/default.nix
@@ -10,11 +10,12 @@ stdenv.mkDerivation rec {
     sha256 = "1qghz1j3jmfj093br2hfyibayg3fmhg8fvp5ix9n9rbvzc1zslsm";
   };
 
-  buildInputs = [ glew SDL2 ftgl pkgconfig libpng libjpeg pcre SDL2_image mesa boost
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ glew SDL2 ftgl libpng libjpeg pcre SDL2_image mesa boost
                   glm freetype ];
 
   meta = with stdenv.lib; {
-    homepage = http://code.google.com/p/logstalgia;
+    homepage = http://logstalgia.io/;
     description = "Website traffic visualization tool";
     license = licenses.gpl3Plus;
 
diff --git a/pkgs/tools/graphics/lprof/default.nix b/pkgs/tools/graphics/lprof/default.nix
index 6e09dc191acc..d3a8d19dfe29 100644
--- a/pkgs/tools/graphics/lprof/default.nix
+++ b/pkgs/tools/graphics/lprof/default.nix
@@ -19,31 +19,20 @@ stdenv.mkDerivation {
     sha256 = "0q8x24fm5yyvm151xrl3l03p7hvvciqnkbviprfnvlr0lyg9wsrn";
   };
 
-  # The sed commands disable header checks and add LDFLAGS NIX_CFLAGS_COMPILE
-  # to the gcc environment
   buildPhase = ''
     mkdir -p $out
     export CXX=g++
-    sed -i  SConstruct \
-     -e 's/def CheckForQt(context):/def CheckForQt(context):\n  return 1/' \
-     -e "s/not config.CheckHeader('lcms.h')/False/" \
-     -e "s/not config.CheckHeader('tiff.h')/False/" \
-     -e "s/not config.CheckCXXHeader('vigra\/impex.hxx')/False/" \
-     \
-     -e "s/^\(      'LDFLAGS'.*\)/\1\n,'hardeningDisable' : os.environ['hardeningDisable']/" \
-     -e "s/^\(      'LDFLAGS'.*\)/\1\n,'NIX_CFLAGS_COMPILE' : os.environ['NIX_CFLAGS_COMPILE']/" \
-     -e "s/^\(      'LDFLAGS'.*\)/\1\n,'NIX_LDFLAGS' : os.environ['NIX_LDFLAGS']/"
 
     scons PREFIX=$out SYSLIBS=1 install
   '';
 
   installPhase = ":";
 
-  patches = [ ./lcms-1.17.patch ];
+  patches = [ ./lcms-1.17.patch  ./keep-environment.patch ];
 
   meta = {
     description = "Little CMS ICC profile construction set";
-    homepage = http://sourceforge.net/projects/lprof;
+    homepage = https://sourceforge.net/projects/lprof;
     license = stdenv.lib.licenses.gpl2;
     platforms = stdenv.lib.platforms.linux;
   };
diff --git a/pkgs/tools/graphics/lprof/keep-environment.patch b/pkgs/tools/graphics/lprof/keep-environment.patch
new file mode 100644
index 000000000000..4dcb5b0448dd
--- /dev/null
+++ b/pkgs/tools/graphics/lprof/keep-environment.patch
@@ -0,0 +1,16 @@
+--- lprof-1.11.4.1.org/SConstruct	2006-06-06 02:11:32.000000000 +0100
++++ lprof-1.11.4.1/SConstruct	2017-08-29 12:56:13.425654683 +0100
+@@ -22,12 +22,7 @@
+ # opts.Add(BoolOption('qt-mt-lib', 'Flag used to set QT library to either qt-mt or qt. Value of 1 = qt-mt, 0 = qt.', 'yes'))
+ 
+ # setup base environemnt 
+-env = Environment(
+-    ENV = {
+-      'PATH' : os.environ[ 'PATH' ],
+-      'HOME' : os.environ[ 'HOME' ], # required for distcc
+-      'LDFLAGS' : ''
+-    }, options = opts)
++env = Environment(ENV = os.environ, options = opts)
+ 
+ opts.Update(env)
+ opts.Save('lprof.conf', env) # Save, so user doesn't have to 
diff --git a/pkgs/tools/graphics/nifskope/default.nix b/pkgs/tools/graphics/nifskope/default.nix
index f66d01ef7aa3..19aa7f00f14a 100644
--- a/pkgs/tools/graphics/nifskope/default.nix
+++ b/pkgs/tools/graphics/nifskope/default.nix
@@ -4,10 +4,12 @@ stdenv.mkDerivation rec {
   name = "nifskope-1.1.3";
 
   src = fetchurl {
-    url = "mirror://sourceforge/niftools/${name}.tar.bz2";
+    url = "https://github.com/niftools/nifskope/releases/download/${name}/${name}.tar.bz2";
     sha256 = "0fcvrcjyvivww10sjhxamcip797b9ykbf5p3rm2k24xhkwdaqp72";
   };
 
+  patches = [ ./gcc-6.patch ];
+
   buildInputs = [ qt4 ];
 
   nativeBuildInputs = [ qmake4Hook ];
@@ -46,7 +48,7 @@ stdenv.mkDerivation rec {
     ''; # */
 
   meta = {
-    homepage = http://niftools.sourceforge.net/;
+    homepage = https://github.com/niftools/nifskope/;
     description = "A tool for analyzing and editing NetImmerse/Gamebryo '*.nif' files";
     maintainers = [ stdenv.lib.maintainers.eelco ];
     platforms = stdenv.lib.platforms.linux;
diff --git a/pkgs/tools/graphics/nifskope/gcc-6.patch b/pkgs/tools/graphics/nifskope/gcc-6.patch
new file mode 100644
index 000000000000..2bb8af9cfe4c
--- /dev/null
+++ b/pkgs/tools/graphics/nifskope/gcc-6.patch
@@ -0,0 +1,123 @@
+Based on https://github.com/niftools/nifskope/commit/7261b0a119a549b11006d8e41ba990d706171f1c
+
+diff -ru -x '*~' nifskope-1.1.3-orig/gl/dds/ColorBlock.cpp nifskope-1.1.3/gl/dds/ColorBlock.cpp
+--- nifskope-1.1.3-orig/gl/dds/ColorBlock.cpp	2012-11-17 23:40:31.000000000 +0100
++++ nifskope-1.1.3/gl/dds/ColorBlock.cpp	2017-09-10 10:50:36.766909836 +0200
+@@ -78,8 +78,8 @@
+ 

+ void ColorBlock::init(const Image * img, uint x, uint y)

+ {

+-	const uint bw = min(img->width() - x, 4U);

+-	const uint bh = min(img->height() - y, 4U);

++	const uint bw = std::min(img->width() - x, 4U);

++	const uint bh = std::min(img->height() - y, 4U);

+ 

+ 	static int remainder[] = {

+ 		0, 0, 0, 0,

+diff -ru -x '*~' nifskope-1.1.3-orig/gl/dds/Common.h nifskope-1.1.3/gl/dds/Common.h
+--- nifskope-1.1.3-orig/gl/dds/Common.h	2012-11-17 23:40:31.000000000 +0100
++++ nifskope-1.1.3/gl/dds/Common.h	2017-09-10 10:48:08.462099032 +0200
+@@ -33,14 +33,10 @@
+ #ifndef _DDS_COMMON_H

+ #define _DDS_COMMON_H

+ 

+-#ifndef min

+-#define min(a,b) ((a) <= (b) ? (a) : (b))

+-#endif

+-#ifndef max

+-#define max(a,b) ((a) >= (b) ? (a) : (b))

+-#endif

++#include <algorithm>

++

+ #ifndef clamp

+-#define clamp(x,a,b) min(max((x), (a)), (b))

++#define clamp(x,a,b) std::min( std::max( (x), (a) ), (b) )

+ #endif

+ 

+ template<typename T>

+diff -ru -x '*~' nifskope-1.1.3-orig/gl/dds/DirectDrawSurface.cpp nifskope-1.1.3/gl/dds/DirectDrawSurface.cpp
+--- nifskope-1.1.3-orig/gl/dds/DirectDrawSurface.cpp	2012-11-17 23:40:31.000000000 +0100
++++ nifskope-1.1.3/gl/dds/DirectDrawSurface.cpp	2017-09-10 10:48:45.912056969 +0200
+@@ -63,6 +63,7 @@
+ #include "DirectDrawSurface.h"

+ #include "BlockDXT.h"

+ #include "PixelFormat.h"

++#include "Common.h"

+ 

+ #include <stdio.h> // printf

+ #include <math.h>  // sqrt

+@@ -685,8 +686,8 @@
+ 	// Compute width and height.

+ 	for (uint m = 0; m < mipmap; m++)

+ 	{

+-		w = max(1U, w / 2);

+-		h = max(1U, h / 2);

++		w = std::max(1U, w / 2);

++		h = std::max(1U, h / 2);

+ 	}

+ 	

+ 	img->allocate(w, h);

+@@ -787,9 +788,9 @@
+ 			readBlock(&block);

+ 			

+ 			// Write color block.

+-			for (uint y = 0; y < min(4U, h-4*by); y++)

++			for (uint y = 0; y < std::min(4U, h-4*by); y++)

+ 			{

+-				for (uint x = 0; x < min(4U, w-4*bx); x++)

++				for (uint x = 0; x < std::min(4U, w-4*bx); x++)

+ 				{

+ 					img->pixel(4*bx+x, 4*by+y) = block.color(x, y);

+ 				}

+@@ -909,9 +910,9 @@
+ 	

+ 	for (uint m = 0; m < mipmap; m++)

+ 	{

+-		w = max(1U, w / 2);

+-		h = max(1U, h / 2);

+-		d = max(1U, d / 2);

++		w = std::max(1U, w / 2);

++		h = std::max(1U, h / 2);

++		d = std::max(1U, d / 2);

+ 	}

+ 

+ 	if (header.pf.flags & DDPF_FOURCC)

+diff -ru -x '*~' nifskope-1.1.3-orig/gl/gltexloaders.cpp nifskope-1.1.3/gl/gltexloaders.cpp
+--- nifskope-1.1.3-orig/gl/gltexloaders.cpp	2012-11-17 23:40:31.000000000 +0100
++++ nifskope-1.1.3/gl/gltexloaders.cpp	2017-09-10 10:51:23.586839810 +0200
+@@ -1736,8 +1736,8 @@
+ 			

+ 			// generate next offset, resize

+ 			mipmapOffset += mipmapWidth * mipmapHeight * 4;

+-			mipmapWidth = max( 1, mipmapWidth / 2 );

+-			mipmapHeight = max( 1, mipmapHeight / 2 );

++			mipmapWidth = std::max( 1, mipmapWidth / 2 );

++			mipmapHeight = std::max( 1, mipmapHeight / 2 );

+ 		}

+ 		

+ 		// set total pixel size

+@@ -1932,11 +1932,11 @@
+ 			{

+ 				if ( ddsHeader.ddsPixelFormat.dwFourCC == FOURCC_DXT1 )

+ 				{

+-					mipmapOffset += max( 8, ( mipmapWidth * mipmapHeight / 2 ) );

++					mipmapOffset += std::max( 8, ( mipmapWidth * mipmapHeight / 2 ) );

+ 				}

+ 				else if ( ddsHeader.ddsPixelFormat.dwFourCC == FOURCC_DXT5 )

+ 				{

+-					mipmapOffset += max( 16, ( mipmapWidth * mipmapHeight ) );

++					mipmapOffset += std::max( 16, ( mipmapWidth * mipmapHeight ) );

+ 				}

+ 			}

+ 			else if ( ddsHeader.ddsPixelFormat.dwBPP == 24 )

+@@ -1947,8 +1947,8 @@
+ 			{

+ 				mipmapOffset += ( mipmapWidth * mipmapHeight * 4 );

+ 			}

+-			mipmapWidth = max( 1, mipmapWidth / 2 );

+-			mipmapHeight = max( 1, mipmapHeight / 2 );

++			mipmapWidth = std::max( 1, mipmapWidth / 2 );

++			mipmapHeight = std::max( 1, mipmapHeight / 2 );

+ 		}

+ 		

+ 		nif->set<quint32>( iData, "Num Pixels", mipmapOffset );

diff --git a/pkgs/tools/graphics/pdf2svg/default.nix b/pkgs/tools/graphics/pdf2svg/default.nix
index dad611868bc2..058900b8e237 100644
--- a/pkgs/tools/graphics/pdf2svg/default.nix
+++ b/pkgs/tools/graphics/pdf2svg/default.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation rec {
     sha256 = "14ffdm4y26imq99wjhkrhy9lp33165xci1l5ndwfia8hz53bl02k";
   };
 
-  buildInputs = [ autoreconfHook cairo pkgconfig poppler gtk2 ];
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  buildInputs = [ cairo poppler gtk2 ];
 
   meta = with stdenv.lib; {
     description = "PDF converter to SVG format";
diff --git a/pkgs/tools/graphics/pdfread/default.nix b/pkgs/tools/graphics/pdfread/default.nix
index 3c43935e950d..8733b2c1caa0 100644
--- a/pkgs/tools/graphics/pdfread/default.nix
+++ b/pkgs/tools/graphics/pdfread/default.nix
@@ -44,7 +44,7 @@ stdenv.mkDerivation {
 
   meta = with stdenv.lib; {
     description = "PDF/DJVU to ebook format converter";
-    homepage = http://www.mobileread.com/forums/showthread.php?t=21906;
+    homepage = https://www.mobileread.com/forums/showthread.php?t=21906;
     license = licenses.mit;
   };
 }
diff --git a/pkgs/tools/graphics/pngnq/default.nix b/pkgs/tools/graphics/pngnq/default.nix
index 5676b37042d1..e01f3ea2acc5 100644
--- a/pkgs/tools/graphics/pngnq/default.nix
+++ b/pkgs/tools/graphics/pngnq/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "1qmnnl846agg55i7h4vmrn11lgb8kg6gvs8byqz34bdkjh5gwiy1";
   };
 
-  buildInputs = [ pkgconfig libpng zlib ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libpng zlib ];
 
   patchPhase = ''
     sed -i '/png.h/a \#include <zlib.h>' src/rwpng.c
diff --git a/pkgs/tools/graphics/pngquant/default.nix b/pkgs/tools/graphics/pngquant/default.nix
index 78a2a7cb695e..93f57f95e3e2 100644
--- a/pkgs/tools/graphics/pngquant/default.nix
+++ b/pkgs/tools/graphics/pngquant/default.nix
@@ -13,7 +13,8 @@ stdenv.mkDerivation rec {
 
   preConfigure = "patchShebangs .";
 
-  buildInputs = [ pkgconfig libpng zlib lcms2 ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libpng zlib lcms2 ];
 
   meta = with stdenv.lib; {
     homepage = https://pngquant.org/;
diff --git a/pkgs/tools/graphics/povray/default.nix b/pkgs/tools/graphics/povray/default.nix
index 6bdff06699b9..7284ee95a909 100644
--- a/pkgs/tools/graphics/povray/default.nix
+++ b/pkgs/tools/graphics/povray/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   name = "povray-${version}";
-  version = "3.7.0.3";
+  version = "3.7.0.4";
 
   src = fetchFromGitHub {
     owner = "POV-Ray";
     repo = "povray";
     rev = "v${version}";
-    sha256 = "0mzkgk3gn8jfrw1fq0z3kqbysdfq8nwdl8a28l18v8gzb31bblhq";
+    sha256 = "1wkwb43w5r9pa79yazy4w4s8n6g280igag97hgl7dyi289q39n0q";
   };
 
 
diff --git a/pkgs/tools/graphics/quirc/default.nix b/pkgs/tools/graphics/quirc/default.nix
index a801dd8ebda9..9891ea5e52b0 100644
--- a/pkgs/tools/graphics/quirc/default.nix
+++ b/pkgs/tools/graphics/quirc/default.nix
@@ -10,13 +10,13 @@ let
     rev = "5b262480091d5f84a67a4a56c728fc8b39844339";
     sha256 = "1w5qvjafn14s6jjs7kiwsqirlsqbgv0p152hrsq463pm34hp0lzy";
   };
-  buildInputs = [
-    SDL SDL_gfx libjpeg pkgconfig libpng
-  ];
 in
 stdenv.mkDerivation {
   inherit (s) name version;
-  inherit buildInputs;
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [
+    SDL SDL_gfx libjpeg libpng
+  ];
   src = fetchgit {
     inherit (s) url sha256 rev;
   };
diff --git a/pkgs/tools/graphics/scrot/default.nix b/pkgs/tools/graphics/scrot/default.nix
index 5e4fd3ff0624..49bd74ea412f 100644
--- a/pkgs/tools/graphics/scrot/default.nix
+++ b/pkgs/tools/graphics/scrot/default.nix
@@ -2,23 +2,21 @@
 
 let
   debPatch = fetchzip {
-    url = mirror://debian/pool/main/s/scrot/scrot_0.8-17.debian.tar.xz;
-    sha256 = "0ydsr3vah5wkcbnp91knkdbil4hx0cn0iy57frl03azqzc29bkw5";
+    url = mirror://debian/pool/main/s/scrot/scrot_0.8-18.debian.tar.xz;
+    sha256 = "1m8m8ad0idf3nzw0k57f6rfbw8n7dza69a7iikriqgbrpyvxqybx";
   };
 in
 stdenv.mkDerivation rec {
-  name = "scrot-0.8-17";
+  name = "scrot-0.8-18";
 
   src = fetchurl {
     url = "http://linuxbrit.co.uk/downloads/${name}.tar.gz";
     sha256 = "1wll744rhb49lvr2zs6m93rdmiq59zm344jzqvijrdn24ksiqgb1";
   };
 
-  inherit debPatch;
-
   postPatch = ''
-    for patch in $(cat $debPatch/patches/series); do
-      patch -p1 < "$debPatch/patches/$patch"
+    for patch in $(cat ${debPatch}/patches/series); do
+      patch -p1 < "${debPatch}/patches/$patch"
     done
   '';
 
diff --git a/pkgs/tools/graphics/svgcleaner/default.nix b/pkgs/tools/graphics/svgcleaner/default.nix
new file mode 100644
index 000000000000..4c7c5f1c3858
--- /dev/null
+++ b/pkgs/tools/graphics/svgcleaner/default.nix
@@ -0,0 +1,25 @@
+{ stdenv, fetchFromGitHub, rustPlatform }:
+
+with rustPlatform;
+
+buildRustPackage rec {
+  name = "svgcleaner-${version}";
+  version = "0.9.1";
+
+  src = fetchFromGitHub {
+    owner = "RazrFalcon";
+    repo = "svgcleaner";
+    rev = "v${version}";
+    sha256 = "0l75a2kqh2syl14pmywrkxhr19fcnfpzjj9gj3503aw0r800g16m";
+  };
+
+  cargoSha256 = "1hl04wqdgspajf2w664i00vgp13yi0sxvjjpfs5vfhm641z3j69y";
+
+  meta = with stdenv.lib; {
+    description = "A tool for tidying and optimizing SVGs";
+    homepage = "https://github.com/RazrFalcon/svgcleaner";
+    license = licenses.gpl2;
+    platforms = platforms.all;
+    maintainer = [ maintainers.mehandes ];
+  };
+}
diff --git a/pkgs/tools/graphics/transfig/builder.sh b/pkgs/tools/graphics/transfig/builder.sh
deleted file mode 100644
index c466f759446c..000000000000
--- a/pkgs/tools/graphics/transfig/builder.sh
+++ /dev/null
@@ -1,38 +0,0 @@
-source $stdenv/setup
-
-patchPhase() {
-    for i in $patches; do
-        header "applying patch $i" 3
-        patch -p0 < $i
-        stopNest
-    done
-
-    configureImakefiles "s:__PREFIX_PNG:$libpng:"
-    configureImakefiles "s:__PREFIX:$out:"
-}
-
-configureImakefiles() {
-    local sedcmd=$1
-
-    sed "${sedcmd}" fig2dev/Imakefile > tmpsed
-    cp tmpsed fig2dev/Imakefile
-
-    sed "${sedcmd}" fig2dev/dev/Imakefile > tmpsed
-    cp tmpsed fig2dev/dev/Imakefile
-
-    sed "${sedcmd}" transfig/Imakefile > tmpsed
-    cp tmpsed transfig/Imakefile
-}
-
-buildPhase() {
-    xmkmf
-    make Makefiles
-    make
-}
-
-preInstall() {
-    mkdir -p $out
-    mkdir -p $out/lib
-}
-
-genericBuild
diff --git a/pkgs/tools/graphics/transfig/default.nix b/pkgs/tools/graphics/transfig/default.nix
index 948bba6d459f..cb3f0edff0f8 100644
--- a/pkgs/tools/graphics/transfig/default.nix
+++ b/pkgs/tools/graphics/transfig/default.nix
@@ -2,33 +2,62 @@
 
 stdenv.mkDerivation rec {
   name = "transfig-3.2.4";
-  builder = ./builder.sh;
   src = fetchurl {
     url = ftp://ftp.tex.ac.uk/pub/archive/graphics/transfig/transfig.3.2.4.tar.gz;
     sha256 = "0429snhp5acbz61pvblwlrwv8nxr6gf12p37f9xxwrkqv4ir7dd4";
   };
 
   buildInputs = [zlib libjpeg libpng imake];
-  inherit libpng;
 
-  hardeningDisable = [ "format" ];
+  patches = [
+    ./patch-fig2dev-dev-Imakefile
+    ./patch-fig2dev-Imakefile
+    ./patch-transfig-Imakefile
+    ./patch-fig2dev-fig2dev.h
+    ./patch-fig2dev-dev-gensvg.c
+  ];
+
+  patchPhase = ''
+    runHook prePatch
+
+    configureImakefiles() {
+        local sedcmd=$1
+
+        sed "$sedcmd" fig2dev/Imakefile > tmpsed
+        cp tmpsed fig2dev/Imakefile
 
-  patches = [prefixPatch1 prefixPatch2 prefixPatch3 varargsPatch gensvgPatch];
+        sed "$sedcmd" fig2dev/dev/Imakefile > tmpsed
+        cp tmpsed fig2dev/dev/Imakefile
 
-  prefixPatch1 =
-    ./patch-fig2dev-dev-Imakefile;
+        sed "$sedcmd" transfig/Imakefile > tmpsed
+        cp tmpsed transfig/Imakefile
+    }
 
-  prefixPatch2 =
-    ./patch-fig2dev-Imakefile;
+    for i in $patches; do
+        header "applying patch $i" 3
+        patch -p0 < $i
+        stopNest
+    done
 
-  prefixPatch3 =
-    ./patch-transfig-Imakefile;
+    configureImakefiles "s:__PREFIX_PNG:${libpng}:"
+    configureImakefiles "s:__PREFIX:$out:"
 
-  varargsPatch =
-    ./patch-fig2dev-fig2dev.h;
+    runHook postPatch
+  '';
 
-  gensvgPatch =
-    ./patch-fig2dev-dev-gensvg.c;
+  preBuild = ''
+    xmkmf
+    make Makefiles
+  '';
+
+  makeFlags = [ "CC=cc" ];
+
+  preInstall = ''
+    mkdir -p $out
+    mkdir -p $out/lib
+  '';
+
+  hardeningDisable = [ "format" ];
 
   meta = {
     platforms = stdenv.lib.platforms.unix;
diff --git a/pkgs/tools/graphics/unpaper/default.nix b/pkgs/tools/graphics/unpaper/default.nix
index 2b64cbcc1f58..b58114a61a5d 100644
--- a/pkgs/tools/graphics/unpaper/default.nix
+++ b/pkgs/tools/graphics/unpaper/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0c5rbkxbmy9k8vxjh4cv0bgnqd3wqc99yzw215vkyjslvbsq8z13";
   };
 
-  buildInputs = [ pkgconfig libav libxslt ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libav libxslt ];
 
   meta = with stdenv.lib; {
     homepage = https://www.flameeyes.eu/projects/unpaper;
diff --git a/pkgs/tools/inputmethods/fcitx-engines/fcitx-anthy/default.nix b/pkgs/tools/inputmethods/fcitx-engines/fcitx-anthy/default.nix
index 9d8427e533cb..7f09b488c289 100644
--- a/pkgs/tools/inputmethods/fcitx-engines/fcitx-anthy/default.nix
+++ b/pkgs/tools/inputmethods/fcitx-engines/fcitx-anthy/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0ayrzfx95670k86y19bzl6i6w98haaln3x8dxpb39a5dwgz59pf8";
   };
 
-  buildInputs = [ cmake fcitx anthy gettext pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ cmake fcitx anthy gettext ];
 
   preInstall = ''
     substituteInPlace src/cmake_install.cmake \
diff --git a/pkgs/tools/inputmethods/fcitx-engines/fcitx-chewing/default.nix b/pkgs/tools/inputmethods/fcitx-engines/fcitx-chewing/default.nix
index 58695434cb6c..361355d1d688 100644
--- a/pkgs/tools/inputmethods/fcitx-engines/fcitx-chewing/default.nix
+++ b/pkgs/tools/inputmethods/fcitx-engines/fcitx-chewing/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0l548xdx2fvjya1ixp37pn382yak0m4kwfh9lgh7l3y2sblqw9zs";
   };
 
-  buildInputs = [ cmake fcitx gettext libchewing pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ cmake fcitx gettext libchewing ];
 
   preInstall = ''
    substituteInPlace src/cmake_install.cmake \
diff --git a/pkgs/tools/inputmethods/fcitx-engines/fcitx-cloudpinyin/default.nix b/pkgs/tools/inputmethods/fcitx-engines/fcitx-cloudpinyin/default.nix
index acd377441e2c..ebb6627dccae 100644
--- a/pkgs/tools/inputmethods/fcitx-engines/fcitx-cloudpinyin/default.nix
+++ b/pkgs/tools/inputmethods/fcitx-engines/fcitx-cloudpinyin/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "143x9gbswzfngvgfy77zskrzrpywj8qg2d19kisgfwfisk7yhcf1";
   };
 
-  buildInputs = [ cmake pkgconfig fcitx gettext curl ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ cmake fcitx gettext curl ];
 
   preInstall = ''
     substituteInPlace src/cmake_install.cmake \
diff --git a/pkgs/tools/inputmethods/fcitx-engines/fcitx-hangul/default.nix b/pkgs/tools/inputmethods/fcitx-engines/fcitx-hangul/default.nix
index 54b5335d9bb2..41560227bca0 100644
--- a/pkgs/tools/inputmethods/fcitx-engines/fcitx-hangul/default.nix
+++ b/pkgs/tools/inputmethods/fcitx-engines/fcitx-hangul/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "1jq78nczliw6pnhfac8hspffybrry6syk17y0wwcq05j3r3nd2lp";
   };
 
-  buildInputs = [ cmake fcitx libhangul gettext pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ cmake fcitx libhangul gettext ];
 
   preInstall = ''
     substituteInPlace src/cmake_install.cmake \
diff --git a/pkgs/tools/inputmethods/fcitx-engines/fcitx-libpinyin/default.nix b/pkgs/tools/inputmethods/fcitx-engines/fcitx-libpinyin/default.nix
index c441a4964b82..6022bcebc3b2 100644
--- a/pkgs/tools/inputmethods/fcitx-engines/fcitx-libpinyin/default.nix
+++ b/pkgs/tools/inputmethods/fcitx-engines/fcitx-libpinyin/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "19h0p1s8bkw24v7x6v19fg7dqpz2kkjlvvrqhypi5bkkvfswf7xn";
   };
 
-  buildInputs = [ cmake pkgconfig fcitx gettext libpinyin glib pcre dbus qt4 ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ cmake fcitx gettext libpinyin glib pcre dbus qt4 ];
 
   preInstall = ''
     substituteInPlace src/cmake_install.cmake \
diff --git a/pkgs/tools/inputmethods/fcitx-engines/fcitx-m17n/default.nix b/pkgs/tools/inputmethods/fcitx-engines/fcitx-m17n/default.nix
index ff42bbbbcc8e..c0c921f7b18d 100644
--- a/pkgs/tools/inputmethods/fcitx-engines/fcitx-m17n/default.nix
+++ b/pkgs/tools/inputmethods/fcitx-engines/fcitx-m17n/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0ffyhsg7bc6525k94kfhnja1h6ajlfprq72d286dp54cksnakyc4";
   };
 
-  buildInputs = [ cmake fcitx gettext m17n_lib m17n_db pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ cmake fcitx gettext m17n_lib m17n_db ];
 
   preInstall = ''
     substituteInPlace im/cmake_install.cmake \
diff --git a/pkgs/tools/inputmethods/fcitx-engines/fcitx-mozc/default.nix b/pkgs/tools/inputmethods/fcitx-engines/fcitx-mozc/default.nix
index 596b3ce15652..170ac4c6a26f 100644
--- a/pkgs/tools/inputmethods/fcitx-engines/fcitx-mozc/default.nix
+++ b/pkgs/tools/inputmethods/fcitx-engines/fcitx-mozc/default.nix
@@ -33,7 +33,7 @@ in clangStdenv.mkDerivation rec {
   '';
 
   patch_version = "2.18.2612.102.1";
-  patches = [ 
+  patches = [
     (fetchpatch rec {
       name   = "fcitx-mozc-${patch_version}.patch";
       url    = "https://download.fcitx-im.org/fcitx-mozc/${name}";
@@ -43,7 +43,7 @@ in clangStdenv.mkDerivation rec {
 
   postPatch = ''
     substituteInPlace src/unix/fcitx/mozc.conf \
-      --replace "/usr/share/fcitx/mozc/icon/mozc.png" "mozc" 
+      --replace "/usr/share/fcitx/mozc/icon/mozc.png" "mozc"
   '';
 
   configurePhase = ''
@@ -91,7 +91,7 @@ in clangStdenv.mkDerivation rec {
   meta = with clangStdenv.lib; {
     isFcitxEngine = true;
     description   = "Fcitx engine for Google japanese input method";
-    homepage      = http://code.google.com/p/mozc/;
+    homepage      = https://github.com/google/mozc;
     downloadPage  = "http://download.fcitx-im.org/fcitx-mozc/";
     license       = licenses.free;
     platforms     = platforms.linux;
diff --git a/pkgs/tools/inputmethods/fcitx-engines/fcitx-rime/default.nix b/pkgs/tools/inputmethods/fcitx-engines/fcitx-rime/default.nix
new file mode 100644
index 000000000000..e9e2e29f7fad
--- /dev/null
+++ b/pkgs/tools/inputmethods/fcitx-engines/fcitx-rime/default.nix
@@ -0,0 +1,35 @@
+{ stdenv, fetchurl, cmake, pkgconfig, fcitx, librime, brise, hicolor_icon_theme }:
+
+stdenv.mkDerivation rec {
+  name = "fcitx-rime-${version}";
+  version = "0.3.2";
+
+  src = fetchurl {
+    url = "https://download.fcitx-im.org/fcitx-rime/${name}.tar.xz";
+    sha256 = "0bd8snfa6jr8dhnm0s0z021iryh5pbaf7p15rhkgbigw2pssczpr";
+  };
+
+  buildInputs = [ cmake pkgconfig fcitx librime brise hicolor_icon_theme ];
+
+  # cmake cannont automatically find our nonstandard brise install location
+  cmakeFlags = [ "-DRIME_DATA_DIR=${brise}/share/rime-data" ];
+
+  preInstall = ''
+    substituteInPlace src/cmake_install.cmake \
+       --replace ${fcitx} $out
+    substituteInPlace data/cmake_install.cmake \
+       --replace ${fcitx} $out
+  '';
+
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
+    isFcitxEngine = true;
+    homepage      = https://github.com/fcitx/fcitx-rime;
+    downloadPage  = https://download.fcitx-im.org/fcitx-rime/;
+    description   = "Rime support for Fcitx";
+    license       = licenses.gpl2;
+    platforms     = platforms.linux;
+    maintainers   = with maintainers; [ sifmelcara ];
+  };
+}
diff --git a/pkgs/tools/inputmethods/fcitx-engines/fcitx-unikey/default.nix b/pkgs/tools/inputmethods/fcitx-engines/fcitx-unikey/default.nix
index b2cd71d1816e..ddfa41dda318 100644
--- a/pkgs/tools/inputmethods/fcitx-engines/fcitx-unikey/default.nix
+++ b/pkgs/tools/inputmethods/fcitx-engines/fcitx-unikey/default.nix
@@ -9,7 +9,10 @@ stdenv.mkDerivation rec {
     sha256 = "063vc29v7ycaai98v3z4q319sv9sm91my17pmhblw1vifxnw02wf";
   };
 
-  buildInputs = [ cmake fcitx gettext pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ cmake fcitx gettext ];
+
+  NIX_CFLAGS_COMPILE = "-Wno-narrowing";
 
   preInstall = ''
     substituteInPlace src/cmake_install.cmake \
@@ -28,4 +31,4 @@ stdenv.mkDerivation rec {
     maintainers   = with maintainers; [ ericsagnes ];
   };
 
-}
\ No newline at end of file
+}
diff --git a/pkgs/tools/inputmethods/fcitx/fcitx-configtool.nix b/pkgs/tools/inputmethods/fcitx/fcitx-configtool.nix
index 830342222617..b5b394c5b6cb 100644
--- a/pkgs/tools/inputmethods/fcitx/fcitx-configtool.nix
+++ b/pkgs/tools/inputmethods/fcitx/fcitx-configtool.nix
@@ -15,7 +15,8 @@ stdenv.mkDerivation rec {
     sha256 = "1ypr2jr3vzs2shqfrvhqy69xvagrn9x507180i9wxy14hb97a82r";
   };
 
-  buildInputs = [ makeWrapper fcitx cmake isocodes pkgconfig gtk3
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ makeWrapper fcitx cmake isocodes gtk3
     gnome3.defaultIconTheme ];
 
   preFixup = ''
diff --git a/pkgs/tools/inputmethods/ibus-engines/ibus-anthy/default.nix b/pkgs/tools/inputmethods/ibus-engines/ibus-anthy/default.nix
index 5d130d7ad807..53b2a3abf28e 100644
--- a/pkgs/tools/inputmethods/ibus-engines/ibus-anthy/default.nix
+++ b/pkgs/tools/inputmethods/ibus-engines/ibus-anthy/default.nix
@@ -4,7 +4,7 @@
 
 stdenv.mkDerivation rec {
   name = "ibus-anthy-${version}";
-  version = "1.5.8";
+  version = "1.5.9";
 
   meta = with stdenv.lib; {
     isIbusEngine = true;
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   configureFlags = [ "--with-anthy-zipcode=${anthy}/share/anthy/zipcode.t" ];
 
   buildInputs = [
-    anthy glib gobjectIntrospection gtk3 ibus python3
+    anthy glib gobjectIntrospection gtk3 ibus (python3.withPackages (ps: [ps.pygobject3]))
   ];
 
   nativeBuildInputs = [ intltool pkgconfig python3.pkgs.wrapPython ];
@@ -30,6 +30,6 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://github.com/ibus/ibus-anthy/releases/download/${version}/${name}.tar.gz";
-    sha256 = "1aj7vnfky7izl23xyjky78z3qas3q72l3kr8dnql2lnivsrb8q1y";
+    sha256 = "1y8sf837rmp662bv6zakny0xcm7c9c5qda7f9kq9riv9ywpcbw6x";
   };
 }
diff --git a/pkgs/tools/inputmethods/ibus-engines/ibus-hangul/default.nix b/pkgs/tools/inputmethods/ibus-engines/ibus-hangul/default.nix
index 74253fa09fc0..f70c7d02e9f0 100644
--- a/pkgs/tools/inputmethods/ibus-engines/ibus-hangul/default.nix
+++ b/pkgs/tools/inputmethods/ibus-engines/ibus-hangul/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "120p9w7za6hi521hz8q235fkl4i3p1qqr8nqm4a3kxr0pcq40bd2";
   };
 
-  buildInputs = [ gtk3 ibus libhangul ];
+  buildInputs = [ gtk3 ibus libhangul python3 ];
 
   nativeBuildInputs = [ intltool pkgconfig python3.pkgs.wrapPython ];
 
diff --git a/pkgs/tools/inputmethods/ibus-engines/ibus-mozc/default.nix b/pkgs/tools/inputmethods/ibus-engines/ibus-mozc/default.nix
index 2e32075992c9..fd924cdd2a2b 100644
--- a/pkgs/tools/inputmethods/ibus-engines/ibus-mozc/default.nix
+++ b/pkgs/tools/inputmethods/ibus-engines/ibus-mozc/default.nix
@@ -15,7 +15,7 @@ in clangStdenv.mkDerivation rec {
   meta = with clangStdenv.lib; {
     isIbusEngine = true;
     description  = "Japanese input method from Google";
-    homepage     = http://code.google.com/p/mozc/;
+    homepage     = https://github.com/google/mozc;
     license      = licenses.free;
     platforms    = platforms.linux;
     maintainers  = with maintainers; [ gebner ericsagnes ];
diff --git a/pkgs/tools/inputmethods/ibus-engines/ibus-table-others/default.nix b/pkgs/tools/inputmethods/ibus-engines/ibus-table-others/default.nix
index f3e3973a2c3f..328c803e7dbc 100644
--- a/pkgs/tools/inputmethods/ibus-engines/ibus-table-others/default.nix
+++ b/pkgs/tools/inputmethods/ibus-engines/ibus-table-others/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0vmz82il796062jbla5pawsr5dqyhs7ald7xjp84zfccc09dg9kx";
   };
 
-  buildInputs = [ ibus ibus-table pkgconfig python3 ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ ibus ibus-table python3 ];
 
   preBuild = ''
     export HOME=$(mktemp -d)/ibus-table-others
diff --git a/pkgs/tools/inputmethods/ibus-engines/ibus-table/default.nix b/pkgs/tools/inputmethods/ibus-engines/ibus-table/default.nix
index 8c842dbc841e..8c552799432b 100644
--- a/pkgs/tools/inputmethods/ibus-engines/ibus-table/default.nix
+++ b/pkgs/tools/inputmethods/ibus-engines/ibus-table/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
   '';
 
   buildInputs = [
-    dconf gtk3 gobjectIntrospection ibus python3
+    dconf gtk3 gobjectIntrospection ibus (python3.withPackages (pypkgs: with pypkgs; [ pygobject3 ]))
   ];
 
   nativeBuildInputs = [ autoreconfHook docbook2x pkgconfig python3.pkgs.wrapPython ];
diff --git a/pkgs/tools/inputmethods/ibus/default.nix b/pkgs/tools/inputmethods/ibus/default.nix
index d392777dfd44..3fd29d65f369 100644
--- a/pkgs/tools/inputmethods/ibus/default.nix
+++ b/pkgs/tools/inputmethods/ibus/default.nix
@@ -10,11 +10,11 @@ let
     srcs = {
       data = fetchurl {
         url = "http://unicode.org/Public/emoji/5.0/emoji-data.txt";
-        sha256 = "0zfn3z61xy76yah3d24dd745qjssrib009m4nvqpnx4sf1r13i2x";
+        sha256 = "11jfz5rrvyc2ixliqfcjgmch4cn9mfy0x96qnpfcyz5fy1jvfyxf";
       };
       sequences = fetchurl {
         url = "http://unicode.org/Public/emoji/5.0/emoji-sequences.txt";
-        sha256 = "0xzk7hi2a8macx9s5gj2pb36d38y8fa9001sj71g6kw25c2h94cn";
+        sha256 = "09bii7f5mmladg0kl3n80fa9qaix6bv5ylm92x52j7wygzv0szb1";
       };
       variation-sequences = fetchurl {
         url = "http://unicode.org/Public/emoji/5.0/emoji-variation-sequences.txt";
@@ -22,11 +22,11 @@ let
       };
       zwj-sequences = fetchurl {
         url = "http://unicode.org/Public/emoji/5.0/emoji-zwj-sequences.txt";
-        sha256 = "0rrnk94mhm3k9vs74pvyvs4ir7f31f1libx7c196fmdqvp1qfafw";
+        sha256 = "16gvzv76mjv9g81lm1m6cr3rpfqyn2k4hb9a62xd329252dhl25q";
       };
       test = fetchurl {
         url = "http://unicode.org/Public/emoji/5.0/emoji-test.txt";
-        sha256 = "1dvxw5xp1xiy13c1p1c7l2xc9q8f8znk47kb7q8g7bbgbi21cq5m";
+        sha256 = "031qk2v8xdnba7hfinmgrmpglc9l8ll2hds6mw885p0hngdb3dgw";
       };
     };
   in stdenv.mkDerivation {
@@ -48,6 +48,15 @@ let
       sha256 = "1a3qzsab7vzjqpdialp1g8ppr21x05v0ph8ngyq9pyjkx4vzcdi7";
     };
   };
+  pyEnv = python3.buildEnv.override {
+    extraLibs = [ python3.pkgs.pygobject3 ];
+
+    # ImportError: No module named site
+    postBuild = ''
+      makeWrapper '${glib.dev}/bin/glib-genmarshal' "$out"/bin/glib-genmarshal \
+        --unset PYTHONPATH
+    '';
+  };
 in stdenv.mkDerivation rec {
   name = "ibus-${version}";
   version = "1.5.16";
@@ -77,16 +86,16 @@ in stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    python3
+    pyEnv
     intltool isocodes pkgconfig
     gtk2 gtk3 dconf
     json_glib
     dbus libnotify gobjectIntrospection wayland
   ];
 
-  propagatedBuildInputs = [ glib python3.pkgs.pygobject3 ];
+  propagatedBuildInputs = [ glib ];
 
-  nativeBuildInputs = [ wrapGAppsHook python3.pkgs.wrapPython ];
+  nativeBuildInputs = [ wrapGAppsHook ];
 
   outputs = [ "out" "dev" ];
 
@@ -104,14 +113,13 @@ in stdenv.mkDerivation rec {
     substituteInPlace data/dconf/Makefile.in --replace "dconf update" "echo"
   '';
 
-  postFixup = ''
-    buildPythonPath $out
-    patchPythonScript $out/share/ibus/setup/main.py
-  '';
-
   doInstallCheck = true;
   installCheckPhase = "$out/bin/ibus version";
 
+  postInstall = ''
+    moveToOutput "bin/ibus-setup" "$dev"
+  '';
+
   meta = with stdenv.lib; {
     homepage = https://github.com/ibus/ibus;
     description = "Intelligent Input Bus for Linux / Unix OS";
diff --git a/pkgs/tools/inputmethods/ibus/ibus-qt.nix b/pkgs/tools/inputmethods/ibus/ibus-qt.nix
index 95c32532e407..8d02d4edde8e 100644
--- a/pkgs/tools/inputmethods/ibus/ibus-qt.nix
+++ b/pkgs/tools/inputmethods/ibus/ibus-qt.nix
@@ -9,8 +9,9 @@ stdenv.mkDerivation rec {
     sha256 = "1q9g7qghpcf07valc2ni7yf994xqx2pmdffknj7scxfidav6p19g";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    ibus cmake pkgconfig qt4 icu doxygen
+    ibus cmake qt4 icu doxygen
   ];
 
   cmakeFlags = [ "-DQT_PLUGINS_DIR=lib/qt4/plugins" ];
diff --git a/pkgs/tools/inputmethods/ibus/wrapper.nix b/pkgs/tools/inputmethods/ibus/wrapper.nix
index 13035698827f..d41ba1e791f9 100644
--- a/pkgs/tools/inputmethods/ibus/wrapper.nix
+++ b/pkgs/tools/inputmethods/ibus/wrapper.nix
@@ -21,7 +21,7 @@ let
         done
     done
 
-    for prog in ibus ibus-setup; do
+    for prog in ibus; do
         wrapProgram "$out/bin/$prog" \
           --set GDK_PIXBUF_MODULE_FILE ${librsvg.out}/lib/gdk-pixbuf-2.0/2.10.0/loaders.cache \
           --prefix GI_TYPELIB_PATH : "$GI_TYPELIB_PATH:$out/lib/girepository-1.0" \
diff --git a/pkgs/tools/inputmethods/interception-tools/caps2esc.nix b/pkgs/tools/inputmethods/interception-tools/caps2esc.nix
new file mode 100644
index 000000000000..b31a24b0c837
--- /dev/null
+++ b/pkgs/tools/inputmethods/interception-tools/caps2esc.nix
@@ -0,0 +1,23 @@
+{ stdenv, fetchurl, cmake }:
+
+let
+  version = "0.1.0";
+  pname = "interception-tools-caps2esc";
+in stdenv.mkDerivation {
+  name = "${pname}-${version}";
+
+  src = fetchurl {
+    url = "https://gitlab.com/interception/linux/plugins/caps2esc/repository/v${version}/archive.tar.gz";
+    sha256 = "1fdxqp54gwsrm2c63168l256nfwdk4mvgr7nlwdv62wd3l7zzrg8";
+  };
+
+  buildInputs = [ cmake ];
+
+  meta = {
+    homepage = "https://gitlab.com/interception/linux/plugins/caps2esc";
+    description = "Transforming the most useless key ever into the most useful one";
+    license = stdenv.lib.licenses.mit;
+    maintainers = stdenv.lib.maintainers.vyp;
+    platforms = stdenv.lib.platforms.linux;
+  };
+}
diff --git a/pkgs/tools/inputmethods/interception-tools/default.nix b/pkgs/tools/inputmethods/interception-tools/default.nix
new file mode 100644
index 000000000000..ba54d4954c58
--- /dev/null
+++ b/pkgs/tools/inputmethods/interception-tools/default.nix
@@ -0,0 +1,33 @@
+{ stdenv, fetchurl, fetchFromGitHub, pkgconfig, cmake, libyamlcppWithoutBoost,
+  libevdev, libudev }:
+
+let
+  version = "0.1.1";
+  baseName = "interception-tools";
+in stdenv.mkDerivation {
+  name = "${baseName}-${version}";
+
+  src = fetchurl {
+    url = "https://gitlab.com/interception/linux/tools/repository/v${version}/archive.tar.gz";
+    sha256 = "14g4pphvylqdb922va322z1pbp12ap753hcf7zf9sii1ikvif83j";
+  };
+
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ cmake libevdev libudev libyamlcppWithoutBoost ];
+
+  prePatch = ''
+    substituteInPlace CMakeLists.txt --replace \
+      '"/usr/include/libevdev-1.0"' \
+      "\"$(pkg-config --cflags libevdev | cut -c 3-)\""
+  '';
+
+  patches = [ ./fix-udevmon-configuration-job-path.patch ];
+
+  meta = {
+    description = "A minimal composable infrastructure on top of libudev and libevdev";
+    homepage = "https://gitlab.com/interception/linux/tools";
+    license = stdenv.lib.licenses.gpl3;
+    maintainers = stdenv.lib.maintainers.vyp;
+    platforms = stdenv.lib.platforms.linux;
+  };
+}
diff --git a/pkgs/tools/inputmethods/interception-tools/fix-udevmon-configuration-job-path.patch b/pkgs/tools/inputmethods/interception-tools/fix-udevmon-configuration-job-path.patch
new file mode 100644
index 000000000000..469c96647d69
--- /dev/null
+++ b/pkgs/tools/inputmethods/interception-tools/fix-udevmon-configuration-job-path.patch
@@ -0,0 +1,32 @@
+From d3a5d661b80f3597368f517ebaeddfdfaafc1bf2 Mon Sep 17 00:00:00 2001
+From: xd1le <elisp.vim@gmail.com>
+Date: Mon, 28 Aug 2017 00:19:09 +1000
+Subject: [PATCH] fix udevmon configuration job path
+
+For some reason, the udevmon job $PATH seems to be empty (or otherwise
+seems to point to `/no-such-path`). This commit fixes that by setting
+its $PATH to the same $PATH that the parent udevmon process has.
+---
+ udevmon.cpp | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/udevmon.cpp b/udevmon.cpp
+index ebdd909..b523efd 100644
+--- a/udevmon.cpp
++++ b/udevmon.cpp
+@@ -237,8 +237,11 @@ private:
+             case 0: {
+                 char *command[] = {(char *)"sh", (char *)"-c",
+                                    (char *)job.c_str(), nullptr};
++                std::string path = getenv("PATH");
+                 std::string variables = "DEVNODE=" + devnode;
+-                char *environment[]   = {(char *)variables.c_str(), nullptr};
++                std::string pathenv = "PATH=" + path;
++                char *environment[] = {(char *)variables.c_str(),
++                                       (char *)pathenv.c_str(), nullptr};
+                 execvpe(command[0], command, environment);
+                 std::fprintf(stderr,
+                              R"(exec failed for devnode %s, job "%s" )"
+-- 
+2.14.1
+
diff --git a/pkgs/tools/inputmethods/nabi/default.nix b/pkgs/tools/inputmethods/nabi/default.nix
index cb33abc3213d..b93c59d9789b 100644
--- a/pkgs/tools/inputmethods/nabi/default.nix
+++ b/pkgs/tools/inputmethods/nabi/default.nix
@@ -4,15 +4,16 @@ stdenv.mkDerivation {
   name = "nabi-1.0.0";
 
   src = fetchurl {
-    url = "http://nabi.googlecode.com/files/nabi-1.0.0.tar.gz";
+    url = "https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/nabi/nabi-1.0.0.tar.gz";
     sha256 = "0craa24pw7b70sh253arv9bg9sy4q3mhsjwfss3bnv5nf0xwnncw";
   };
 
-  buildInputs = [ gtk2 libhangul pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ gtk2 libhangul ];
 
   meta = with stdenv.lib; {
     description = "The Easy Hangul XIM";
-    homepage = https://code.google.com/p/nabi;
+    homepage = https://github.com/choehwanjin/nabi;
     license = licenses.gpl2;
     maintainers = [ maintainers.ianwookim ];
     platforms = platforms.linux;
diff --git a/pkgs/tools/inputmethods/skk/skktools/default.nix b/pkgs/tools/inputmethods/skk/skktools/default.nix
new file mode 100644
index 000000000000..8661da66b92a
--- /dev/null
+++ b/pkgs/tools/inputmethods/skk/skktools/default.nix
@@ -0,0 +1,45 @@
+{ stdenv, fetchFromGitHub, pkgconfig, gdbm, glib }:
+
+# Note (2017-10-24, yuriaisaka):
+# - Version 1.3.3 dates from Jul. 19, 2013.
+# - The latest commit to the github repo dates from Mar. 05, 2017
+# - The repo since appears to have become a kitchen sink place to keep
+#   misc tools to handle SKK dictionaries, and these tools have runtime
+#   dependencies on a Ruby interpreter etc.
+# - We for the moment do not package them to keep the dependencies slim.
+#   Probably, shall package the newer tools as skktools-extra in the future.
+stdenv.mkDerivation rec {
+  name = "skktools-${version}";
+  version = "1.3.3";
+  src = fetchFromGitHub {
+    owner = "skk-dev";
+    repo = "skktools";
+    rev = "c8816fe720604d4fd79f3552e99e0430ca6f2769";
+    sha256 = "11v1i5gkxvfsipigc1w1m16ijzh85drpl694kg6ih4jfam1q4vdh";
+  };
+  # # See "12.2. Package naming"
+  # name = "skktools-unstable-${version}";
+  # version = "2017-03-05";
+  # src = fetchFromGitHub {
+  #   owner = "skk-dev";
+  #   repo = "skktools";
+  #   rev = "e14d98e734d2fdff611385c7df65826e94d929db";
+  #   sha256 = "1k9zxqybl1l5h0a8px2awc920qrdyp1qls50h3kfrj3g65d08aq2";
+  # };
+
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ gdbm glib ];
+
+  meta = {
+    description = "A collection of tools to edit SKK dictionaries";
+    longDescription = ''
+      This package provides a collection of tools to manipulate
+      (merge, sort etc.) the dictionaries formatted for SKK Japanese
+      input method.
+    '';
+    homepage = https://github.com/skk-dev/skktools;
+    license = stdenv.lib.licenses.gpl2Plus;
+    maintainers = with stdenv.lib.maintainers; [ yuriaisaka ];
+    platforms = with stdenv.lib.platforms; linux ++ darwin;
+  };
+}
diff --git a/pkgs/tools/inputmethods/touchegg/default.nix b/pkgs/tools/inputmethods/touchegg/default.nix
index b32d0c78a1b7..bdcbc939a07b 100644
--- a/pkgs/tools/inputmethods/touchegg/default.nix
+++ b/pkgs/tools/inputmethods/touchegg/default.nix
@@ -4,7 +4,7 @@ stdenv.mkDerivation rec {
   name = "touchegg-${version}";
   version = "1.1.1";
   src = fetchurl {
-    url = "https://touchegg.googlecode.com/files/${name}.tar.gz";
+    url = "https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/touchegg/${name}.tar.gz";
     sha256 = "95734815c7219d9a71282f3144b3526f2542b4fa270a8e69d644722d024b4038";
   };
 
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = {
-    homepage = https://code.google.com/p/touchegg/;
+    homepage = https://github.com/JoseExposito/touchegg;
     description = "Macro binding for touch surfaces";
     license = stdenv.lib.licenses.gpl2;
     platforms = stdenv.lib.platforms.linux;
diff --git a/pkgs/tools/inputmethods/uim/default.nix b/pkgs/tools/inputmethods/uim/default.nix
index 9af5de0476a7..3f37c1a2ab0c 100644
--- a/pkgs/tools/inputmethods/uim/default.nix
+++ b/pkgs/tools/inputmethods/uim/default.nix
@@ -38,12 +38,12 @@ stdenv.mkDerivation rec {
   dontUseCmakeConfigure = true;
 
   src = fetchurl {
-    url = "http://uim.googlecode.com/files/uim-${version}.tar.bz2";
+    url = "https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/uim/uim-${version}.tar.bz2";
     sha1 = "43b9dbdead6797880e6cfc9c032ecb2d37d42777";
   };
 
   meta = with stdenv.lib; {
-    homepage    = "http://code.google.com/p/uim/";
+    homepage    = "https://github.com/uim/uim";
     description = "A multilingual input method framework";
     license     = stdenv.lib.licenses.bsd3;
     platforms   = stdenv.lib.platforms.linux;
diff --git a/pkgs/tools/inputmethods/zinnia/default.nix b/pkgs/tools/inputmethods/zinnia/default.nix
index 62e9f6798b1f..60f3a0feb55b 100644
--- a/pkgs/tools/inputmethods/zinnia/default.nix
+++ b/pkgs/tools/inputmethods/zinnia/default.nix
@@ -2,16 +2,18 @@
 
 stdenv.mkDerivation rec {
   name = "zinnia-${version}";
-  version = "2015-03-15";
+  version = "2016-08-28";
 
   src = fetchFromGitHub {
     owner = "taku910";
     repo = "zinnia";
-    rev = "d8de1180d5175d7579e6c41b000f1ab4dd9cd697";
-    sha256 = "ac09a16c04c5ef9b46626984e627250dc717d85711d14f1bbfa7f1ca0ca713dc";
+    rev = "fd74d8c8680bb3df8692279151ea6339ab68e32b";
+    sha256 = "1izjy5qw6swg0rs2ym2i72zndb90mwrfbd1iv8xbpwckbm4899lg";
   };
 
-  setSourceRoot = "export sourceRoot=$(echo zinnia-*/zinnia/)";
+  setSourceRoot = ''
+    sourceRoot=$(echo */zinnia)
+  '';
 
   meta = with stdenv.lib; {
     description = "Online hand recognition system with machine learning";
diff --git a/pkgs/tools/misc/appdata-tools/default.nix b/pkgs/tools/misc/appdata-tools/default.nix
index cdb5abcf453c..54c78874dd2e 100644
--- a/pkgs/tools/misc/appdata-tools/default.nix
+++ b/pkgs/tools/misc/appdata-tools/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
     sha256 = "1bzqg4gy8gqhbk2qjizsm0b78li9mv84fb3d8qwfpxh7c7p360x8";
   };
 
-  buildInputs = [ pkgconfig autoconf automake m4 intltool glib
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ autoconf automake m4 intltool glib
                   libsoup gdk_pixbuf ];
 
   configureScript = "./autogen.sh";
diff --git a/pkgs/tools/misc/aptly/default.nix b/pkgs/tools/misc/aptly/default.nix
index 2398d9019dc3..6214bc216f8b 100644
--- a/pkgs/tools/misc/aptly/default.nix
+++ b/pkgs/tools/misc/aptly/default.nix
@@ -2,18 +2,18 @@
 
 let
 
-  version = "1.0.1";
+  version = "1.1.1";
   rev = "v${version}";
 
   aptlySrc = fetchFromGitHub {
     inherit rev;
     owner = "smira";
     repo = "aptly";
-    sha256 = "0rqxdhy2mlwndxhqb447gz626q92zd09rpvhysr2g1rx9nxa039p";
+    sha256 = "197a7nh8li20slqxgn8s8xm13x5b8ansmabk8rx32sngb73hp4av";
   };
 
   aptlyCompletionSrc = fetchFromGitHub {
-    rev = version;
+    rev = "1.0.1";
     owner = "aptly-dev";
     repo = "aptly-bash-completion";
     sha256 = "0dkc4z687yk912lpv8rirv0nby7iny1zgdvnhdm5b47qmjr1sm5q";
diff --git a/pkgs/tools/misc/arp-scan/default.nix b/pkgs/tools/misc/arp-scan/default.nix
index f8adedc7c241..760757190c32 100644
--- a/pkgs/tools/misc/arp-scan/default.nix
+++ b/pkgs/tools/misc/arp-scan/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
       Arp-scan is a command-line tool that uses the ARP protocol to discover
       and fingerprint IP hosts on the local network.
     '';
-    homepage = http://www.nta-monitor.com/tools-resources/security-tools/arp-scan;
+    homepage = http://www.nta-monitor.com/wiki/index.php/Arp-scan_Documentation;
     license = licenses.gpl3;
     platforms = platforms.linux;
     maintainers = [ maintainers.bjornfor ];
diff --git a/pkgs/tools/misc/aspcud/default.nix b/pkgs/tools/misc/aspcud/default.nix
index f3d2cbca6516..974b7691cb93 100644
--- a/pkgs/tools/misc/aspcud/default.nix
+++ b/pkgs/tools/misc/aspcud/default.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     description = "Solver for package problems in CUDF format using ASP";
     homepage = http://potasssco.sourceforge.net/;
-    platforms = platforms.linux;
+    platforms = platforms.all;
     maintainers = [ maintainers.hakuch ];
     license = licenses.gpl3Plus;
   };
diff --git a/pkgs/tools/misc/autorandr/default.nix b/pkgs/tools/misc/autorandr/default.nix
index dc67c96ca1a2..405eb29f6bf9 100644
--- a/pkgs/tools/misc/autorandr/default.nix
+++ b/pkgs/tools/misc/autorandr/default.nix
@@ -1,7 +1,9 @@
 { stdenv
 , python3Packages
 , fetchFromGitHub
-, systemd }:
+, systemd
+, xrandr
+, makeWrapper }:
 
 let
   python = python3Packages.python;
@@ -12,6 +14,7 @@ in
     name = "autorandr-${version}";
 
     buildInputs = [ python ];
+    nativeBuildInputs = [ makeWrapper ];
 
     installPhase = ''
       runHook preInstall
@@ -33,9 +36,15 @@ in
         make install TARGETS='udev' PREFIX=$out DESTDIR=$out \
           UDEV_RULES_DIR=/etc/udev/rules.d
       ''}
+
       runHook postInstall
     '';
 
+    postFixup = ''
+      wrapProgram $out/bin/autorandr \
+        --prefix PATH : ${xrandr}/bin
+    '';
+
     src = fetchFromGitHub {
       owner = "phillipberndt";
       repo = "autorandr";
diff --git a/pkgs/tools/misc/bdf2psf/default.nix b/pkgs/tools/misc/bdf2psf/default.nix
index bf1377419a5c..b8b01a7c0fc7 100644
--- a/pkgs/tools/misc/bdf2psf/default.nix
+++ b/pkgs/tools/misc/bdf2psf/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "bdf2psf-${version}";
-  version = "1.158";
+  version = "1.170";
 
   src = fetchurl {
     url = "mirror://debian/pool/main/c/console-setup/bdf2psf_${version}_all.deb";
-    sha256 = "12zaj7hi5gzdh9r7rcyqnkwik1ljw1qzj6j7rw80bgw6fn611rs9";
+    sha256 = "0xh743cr21qk8cmc6ijp59d61dqra4ggdlgbin9v991xqa0mqdxb";
   };
 
   buildInputs = [ dpkg ];
diff --git a/pkgs/tools/misc/bepasty/default.nix b/pkgs/tools/misc/bepasty/default.nix
new file mode 100644
index 000000000000..be1df0510d7b
--- /dev/null
+++ b/pkgs/tools/misc/bepasty/default.nix
@@ -0,0 +1,34 @@
+{ python
+, lib
+}:
+
+with python.pkgs;
+
+buildPythonApplication rec {
+  pname = "bepasty";
+  version = "0.4.0";
+  name = "${pname}-${version}";
+
+  propagatedBuildInputs = [
+    flask
+    pygments
+    xstatic
+    xstatic-bootbox
+    xstatic-bootstrap
+    xstatic-jquery
+    xstatic-jquery-file-upload
+    xstatic-jquery-ui
+    xstatic-pygments
+  ];
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0bs79pgrjlnkmjfyj2hllbx3rw757va5w2g2aghi9cydmsl7gyi4";
+  };
+
+  meta = {
+    homepage = https://github.com/bepasty/bepasty-server;
+    description = "Binary pastebin server";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.makefu ];
+  };
+}
\ No newline at end of file
diff --git a/pkgs/tools/misc/bibutils/default.nix b/pkgs/tools/misc/bibutils/default.nix
index 65a5b718e5f4..eaa2c6e4942f 100644
--- a/pkgs/tools/misc/bibutils/default.nix
+++ b/pkgs/tools/misc/bibutils/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     description = "Bibliography format interconversion";
     longDescription = "The bibutils program set interconverts between various bibliography formats using a common MODS-format XML intermediate. For example, one can convert RIS-format files to Bibtex by doing two transformations: RIS->MODS->Bibtex. By using a common intermediate for N formats, only 2N programs are required and not N²-N. These programs operate on the command line and are styled after standard UNIX-like filters.";
-    homepage = http://sourceforge.net/p/bibutils/home/Bibutils/;
+    homepage = https://sourceforge.net/p/bibutils/home/Bibutils/;
     license = licenses.gpl2;
     maintainers = [ maintainers.garrison ];
     platforms = platforms.linux;
diff --git a/pkgs/tools/misc/blink1-tool/default.nix b/pkgs/tools/misc/blink1-tool/default.nix
index 29b199e5866b..9a09fba93e69 100644
--- a/pkgs/tools/misc/blink1-tool/default.nix
+++ b/pkgs/tools/misc/blink1-tool/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "05hbnp20cdvyyqf6jr01waz1ycis20qzsd8hn27snmn6qd48igrb";
   };
 
-  buildInputs = [ libusb1 pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libusb1 ];
 
   configurePhase = ''
     cd commandline
diff --git a/pkgs/tools/misc/bonfire/default.nix b/pkgs/tools/misc/bonfire/default.nix
new file mode 100644
index 000000000000..7937a212951f
--- /dev/null
+++ b/pkgs/tools/misc/bonfire/default.nix
@@ -0,0 +1,44 @@
+{ stdenv, python3Packages, fetchFromGitHub }:
+
+with python3Packages;
+
+buildPythonApplication rec {
+  version = "2017-01-19";
+  pname = "bonfire";
+  name = "${pname}-unstable-${version}";
+
+  # use latest git version with --endpoint flag
+  # https://github.com/blue-yonder/bonfire/pull/18
+  src = fetchFromGitHub {
+    owner = "blue-yonder";
+    repo = "${pname}";
+    rev = "d0af9ca10394f366cfa3c60f0741f1f0918011c2";
+    sha256 = "193zcvzbhxwwkwbgmnlihhhazwkajycxf4r71jz1m12w301sjhq5";
+  };
+
+  postPatch = ''
+    # https://github.com/blue-yonder/bonfire/pull/24
+    substituteInPlace requirements.txt \
+      --replace "arrow>=0.5.4,<0.8" "arrow>=0.5.4,<0.11" \
+      --replace "keyring>=9,<10"    "keyring>=9,<11"
+    # pip fails when encountering the git hash for the package version
+    substituteInPlace setup.py \
+      --replace "version=version," "version='${version}',"
+    # remove extraneous files  
+    substituteInPlace setup.cfg \
+      --replace "data_files = *.rst, *.txt" ""
+  '';
+
+  buildInputs = [ httpretty pytest pytestcov ];
+
+  propagatedBuildInputs = [ arrow click keyring parsedatetime requests six termcolor ];
+
+  meta = with stdenv.lib; {
+    homepage = https://pypi.python.org/pypi/bonfire;
+    description = "CLI Graylog Client with Follow Mode";
+    license = licenses.bsd3;
+    maintainers = [ maintainers.womfoo ];
+    platforms = platforms.linux;
+  };
+
+}
diff --git a/pkgs/tools/misc/brltty/default.nix b/pkgs/tools/misc/brltty/default.nix
index af9861ea6ed5..ea1ac6d116b1 100644
--- a/pkgs/tools/misc/brltty/default.nix
+++ b/pkgs/tools/misc/brltty/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "0slrqanwj9cm7ql0rpb296xq676zrc1sjyr13lh5lygp4b8qfpci";
   };
   
-  buildInputs = [ pkgconfig bluez ]
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ bluez ]
     ++ stdenv.lib.optional alsaSupport alsaLib
     ++ stdenv.lib.optional systemdSupport systemd;
   
diff --git a/pkgs/tools/misc/cloc/default.nix b/pkgs/tools/misc/cloc/default.nix
index fb1c79d250a0..a1c04f06d144 100644
--- a/pkgs/tools/misc/cloc/default.nix
+++ b/pkgs/tools/misc/cloc/default.nix
@@ -2,16 +2,18 @@
 
 stdenv.mkDerivation rec {
   name = "cloc-${version}";
-  version = "1.72";
+  version = "1.74";
 
   src = fetchFromGitHub {
     owner = "AlDanial";
     repo = "cloc";
-    rev = "v${version}";
-    sha256 = "192z3fzib71y3sjic03ll67xv51igdlpvfhx12yv9wnzkir7lx02";
+    rev = version;
+    sha256 = "1ihma4f6f92jp1mvzr4rjrgyh9m5wzrlxngaxfn7g0a8r2kyi65b";
   };
 
-  sourceRoot = "cloc-v${version}-src/Unix";
+  setSourceRoot = ''
+    sourceRoot=$(echo */Unix)
+  '';
 
   buildInputs = [ makeWrapper perl AlgorithmDiff RegexpCommon ];
 
@@ -24,6 +26,6 @@ stdenv.mkDerivation rec {
     homepage = https://github.com/AlDanial/cloc;
     license = stdenv.lib.licenses.gpl2;
     platforms = stdenv.lib.platforms.all;
-    maintainers = with stdenv.lib.maintainers; [ fuuzetsu ];
+    maintainers = with stdenv.lib.maintainers; [ fuuzetsu rycee ];
   };
 }
diff --git a/pkgs/tools/misc/cloud-utils/default.nix b/pkgs/tools/misc/cloud-utils/default.nix
index af518e7efa98..9894813d9556 100644
--- a/pkgs/tools/misc/cloud-utils/default.nix
+++ b/pkgs/tools/misc/cloud-utils/default.nix
@@ -1,27 +1,34 @@
-{ stdenv, fetchurl, makeWrapper, gawk, gnused, utillinux }:
+{ stdenv, fetchurl, makeWrapper
+, gawk, gnused, utillinux, file
+, wget, python3, qemu, euca2ools
+, e2fsprogs, cdrkit }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   # NOTICE: if you bump this, make sure to run
   # $ nix-build nixos/release-combined.nix -A nixos.tests.ec2-nixops
-  name = "cloud-utils-0.29";
+  # growpart is needed in initrd in nixos/modules/virtualisation/grow-partition.nix
+  name = "cloud-utils-${version}";
+  version = "0.30";
   src = fetchurl {
-    url = "https://launchpad.net/cloud-utils/trunk/0.29/+download/cloud-utils-0.29.tar.gz";
-    sha256 = "0z15gs8gmpy5gqxl7yiyjj7a6s8iw44djj6axvbci627b9pvd8cy";
+    url = "https://launchpad.net/cloud-utils/trunk/0.3/+download/cloud-utils-${version}.tar.gz";
+    sha256 = "19ca9ckwwsvlqrjz19bc93rq4gv3y4ak7551li2qk95caqyxsq3k";
   };
-  buildInputs = [ makeWrapper ];
-  buildPhase = ''
-    mkdir -p $out/bin
-    cp bin/growpart $out/bin/growpart
-    sed -i 's|awk|gawk|' $out/bin/growpart
-    sed -i 's|sed|gnused|' $out/bin/growpart
-    ln -s sed $out/bin/gnused
-    wrapProgram $out/bin/growpart --prefix PATH : "${stdenv.lib.makeBinPath [ gnused gawk utillinux ]}:$out/bin"
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ python3 ];
+  installFlags = [ "LIBDIR=$(out)/lib" "BINDIR=$(out)/bin" "MANDIR=$(out)/man/man1" "DOCDIR=$(out)/doc" ];
+
+  # according to https://packages.ubuntu.com/source/zesty/cloud-utils
+  binDeps = [
+    wget e2fsprogs file gnused gawk utillinux qemu euca2ools cdrkit
+  ];
+
+  postFixup = ''
+    for i in $out/bin/*; do
+      wrapProgram $i --prefix PATH : "${stdenv.lib.makeBinPath binDeps}:$out/bin"
+    done
   '';
-  dontInstall = true;
-  dontPatchShebangs = true;
-  dontStrip = true;
 
-  meta = {
-    platforms = stdenv.lib.platforms.unix;
-  };
+  dontBuild = true;
+
+  meta.platforms = stdenv.lib.platforms.unix;
 }
diff --git a/pkgs/tools/misc/cloud-utils/growpart-util-linux-2.26.patch b/pkgs/tools/misc/cloud-utils/growpart-util-linux-2.26.patch
deleted file mode 100644
index c782c2d7e4bd..000000000000
--- a/pkgs/tools/misc/cloud-utils/growpart-util-linux-2.26.patch
+++ /dev/null
@@ -1,88 +0,0 @@
-From 1895d10a7539d055a4e0206af1e7a9e5ea32a4f7 Mon Sep 17 00:00:00 2001
-From: Juerg Haefliger <juerg.haefliger@hp.com>
-Date: Wed, 25 Mar 2015 13:59:20 +0100
-Subject: [PATCH] Support new sfdisk version 2.26
-
-The sfdisk usage with version 2.26 changed. Specifically, the option
---show-pt-geometry and functionality for CHS have been removed.
-Also, restoring a backup MBR now needs to be done using dd.
----
- bin/growpart | 28 ++++++++++------------------
- 1 file changed, 10 insertions(+), 18 deletions(-)
-
-diff --git a/bin/growpart b/bin/growpart
-index 595c40b..d4c995b 100755
---- a/bin/growpart
-+++ b/bin/growpart
-@@ -28,7 +28,6 @@ PART=""
- PT_UPDATE=false
- DRY_RUN=0
- 
--MBR_CHS=""
- MBR_BACKUP=""
- GPT_BACKUP=""
- _capture=""
-@@ -133,7 +132,8 @@ bad_Usage() {
- }
- 
- mbr_restore() {
--	sfdisk --no-reread "${DISK}" ${MBR_CHS} -I "${MBR_BACKUP}"
-+	dd if="${MBR_BACKUP}-${DISK#/dev/}-0x00000000.bak" of="${DISK}" bs=1 \
-+		conv=notrunc
- }
- 
- sfdisk_worked_but_blkrrpart_failed() {
-@@ -148,34 +148,26 @@ sfdisk_worked_but_blkrrpart_failed() {
- 
- mbr_resize() {
- 	RESTORE_HUMAN="${TEMP_D}/recovery"
--	MBR_BACKUP="${TEMP_D}/orig.save"
-+	MBR_BACKUP="${TEMP_D}/backup"
- 
- 	local change_out=${TEMP_D}/change.out
- 	local dump_out=${TEMP_D}/dump.out
- 	local new_out=${TEMP_D}/new.out
- 	local dump_mod=${TEMP_D}/dump.mod
--	local tmp="${TEMP_D}/tmp.out"
--	local err="${TEMP_D}/err.out"
- 
--	local _devc cyl _w1 heads _w2 sectors _w3 tot dpart
-+	local tot dpart
- 	local pt_start pt_size pt_end max_end new_size change_info
- 
--	# --show-pt-geometry outputs something like
--	#     /dev/sda: 164352 cylinders, 4 heads, 32 sectors/track
--	rqe sfd_geom sfdisk "${DISK}" --show-pt-geometry >"${tmp}" &&
--		read _devc cyl _w1 heads _w2 sectors _w3 <"${tmp}" &&
--		MBR_CHS="-C ${cyl} -H ${heads} -S ${sectors}" ||
--		fail "failed to get CHS from ${DISK}"
-+	tot=$(sfdisk --list "${DISK}" | awk '{ print $(NF-1) ; exit }') ||
-+		fail "failed to get total number of sectors from ${DISK}"
- 
--	tot=$((${cyl}*${heads}*${sectors}))
-+	debug 1 "total number of sectors of ${DISK} is ${tot}"
- 
--	debug 1 "geometry is ${MBR_CHS}. total size=${tot}"
--	rqe sfd_dump sfdisk ${MBR_CHS} --unit=S --dump "${DISK}" \
-+	rqe sfd_dump sfdisk --dump "${DISK}" \
- 		>"${dump_out}" ||
- 		fail "failed to dump sfdisk info for ${DISK}"
--
- 	{
--		echo "## sfdisk ${MBR_CHS} --unit=S --dump ${DISK}"
-+		echo "## sfdisk --dump ${DISK}"
- 		cat "${dump_out}"
- 	}  >"${RESTORE_HUMAN}"
- 	[ $? -eq 0 ] || fail "failed to save sfdisk -d output"
-@@ -237,7 +229,7 @@ mbr_resize() {
- 		exit 0
- 	fi
- 
--	LANG=C sfdisk --no-reread "${DISK}" ${MBR_CHS} --force \
-+	LANG=C sfdisk --no-reread "${DISK}" --force \
- 		-O "${MBR_BACKUP}" <"${new_out}" >"${change_out}" 2>&1
- 	ret=$?
- 	[ $ret -eq 0 ] || RESTORE_FUNC="mbr_restore"
--- 
-2.1.4
-
diff --git a/pkgs/tools/misc/colord-gtk/default.nix b/pkgs/tools/misc/colord-gtk/default.nix
index 96022d01ef7d..c26f835c0ee5 100644
--- a/pkgs/tools/misc/colord-gtk/default.nix
+++ b/pkgs/tools/misc/colord-gtk/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "0i9y3bb5apj6a0f8cx36l6mjzs7xc0k7nf0magmf58vy2mzhpl18";
   };
 
-  buildInputs = [ intltool colord glib gtk3 pkgconfig lcms2 ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ intltool colord glib gtk3 lcms2 ];
 
   meta = {
     homepage = http://www.freedesktop.org/software/colord/intro.html;
diff --git a/pkgs/tools/misc/colord/default.nix b/pkgs/tools/misc/colord/default.nix
index 222b04db0d0c..020599e17a81 100644
--- a/pkgs/tools/misc/colord/default.nix
+++ b/pkgs/tools/misc/colord/default.nix
@@ -1,42 +1,44 @@
 { stdenv, fetchurl, bash-completion
-, glib, polkit, pkgconfig, intltool, gusb, libusb1, lcms2, sqlite, systemd, dbus
-, gtk_doc, gobjectIntrospection, argyllcms
+, glib, polkit, pkgconfig, gettext, gusb, lcms2, sqlite, systemd, dbus
+, gobjectIntrospection, argyllcms, meson, ninja, libxml2, vala_0_38
 , libgudev, sane-backends }:
 
 stdenv.mkDerivation rec {
-  name = "colord-1.2.12";
+  name = "colord-1.4.1";
 
   src = fetchurl {
     url = "http://www.freedesktop.org/software/colord/releases/${name}.tar.xz";
-    sha256 = "0flcsr148xshjbff030pgyk9ar25an901m9q1pjgjdvaq5j1h96m";
+    sha256 = "0m854clp8szvq38z16jpazzlqfb3lb3icxcfnsisfrc25748y1ib";
   };
 
   enableParallelBuilding = true;
 
-  configureFlags = [
-    "--enable-sane"
-    "--with-udevrulesdir=$(out)/lib/udev/rules.d"
-    "--with-systemdsystemunitdir=$(out)/etc/systemd/system"
+  mesonFlags = [
+    "-Denable-sane=true"
+    "-Denable-vala=true"
     "--localstatedir=/var"
-    "--disable-bash-completion"
+    "-Denable-bash-completion=true"
+    # TODO: man page cannot be build with docbook2x
+    "-Denable-man=false"
+    "-Denable-docs=false"
   ];
 
-  # don't touch /var at install time, colord creates what it needs at runtime
-  postPatch = ''
-    sed -e "s|if test -w .*;|if false;|" -i src/Makefile.{am,in}
-  '';
+  patches = [
+    ./fix-build-paths.patch
+  ];
+
+  nativeBuildInputs = [ meson pkgconfig vala_0_38 ninja gettext libxml2 gobjectIntrospection ];
 
-  buildInputs = [ glib polkit pkgconfig intltool gusb libusb1 lcms2 sqlite systemd dbus gobjectIntrospection
+  buildInputs = [ glib polkit gusb lcms2 sqlite systemd dbus
                   bash-completion argyllcms libgudev sane-backends ];
 
   postInstall = ''
-    mkdir -p $out/etc/bash_completion.d
-    cp -v data/colormgr $out/etc/bash_completion.d
+    glib-compile-schemas $out/share/glib-2.0/schemas
   '';
 
   meta = {
     description = "System service to manage, install and generate color profiles to accurately color manage input and output devices";
-    homepage = http://www.freedesktop.org/software/colord/intro.html;
+    homepage = https://www.freedesktop.org/software/colord/;
     license = stdenv.lib.licenses.lgpl2Plus;
     maintainers = [stdenv.lib.maintainers.marcweber];
     platforms = stdenv.lib.platforms.linux;
diff --git a/pkgs/tools/misc/colord/fix-build-paths.patch b/pkgs/tools/misc/colord/fix-build-paths.patch
new file mode 100644
index 000000000000..7eb66a0b34be
--- /dev/null
+++ b/pkgs/tools/misc/colord/fix-build-paths.patch
@@ -0,0 +1,56 @@
+--- a/contrib/session-helper/meson.build
++++ b/contrib/session-helper/meson.build
+@@ -21,7 +21,7 @@
+     output : 'colord-session.service',
+     configuration : con2,
+     install: true,
+-    install_dir: systemd.get_pkgconfig_variable('systemduserunitdir'),
++    install_dir: join_paths(get_option('prefix'), 'etc', 'systemd', 'user'),
+   )
+ endif
+ 
+--- a/data/meson.build
++++ b/data/meson.build
+@@ -8,13 +8,13 @@
+ 
+ if get_option('enable-systemd')
+   install_data('colord.conf',
+-    install_dir: systemd.get_pkgconfig_variable('tmpfilesdir')
++    install_dir: join_paths(get_option('prefix'), 'lib', 'tmpfiles.d')
+   )
+ endif
+ 
+ if get_option('enable-bash-completion')
+   install_data('colormgr',
+-    install_dir: bash_completion.get_pkgconfig_variable('completionsdir')
++    install_dir: join_paths(get_option('prefix'), 'etc', 'bash_completion.d')
+   )
+ endif
+ 
+@@ -31,7 +31,7 @@
+     output : 'colord.service',
+     configuration : con2,
+     install: true,
+-    install_dir: systemd.get_pkgconfig_variable('systemdsystemunitdir'),
++    install_dir: join_paths(get_option('prefix'), 'etc', 'systemd', 'system'),
+   )
+ endif
+ 
+--- a/meson.build
++++ b/meson.build
+@@ -258,6 +258,3 @@
+ subdir('policy')
+ subdir('rules')
+ subdir('src')
+-
+-meson.add_install_script('meson_post_install.sh',
+-                         localstatedir, get_option('with-daemon-user'))
+--- a/rules/meson.build
++++ b/rules/meson.build
+@@ -9,5 +9,5 @@
+     sensor_rules_in,
+     '95-cd-devices.rules',
+   ],
+-  install_dir : join_paths(udev.get_pkgconfig_variable('udevdir'), 'rules.d')
++  install_dir : join_paths(get_option('prefix'), 'lib', 'udev', 'rules.d')
+ )
diff --git a/pkgs/tools/misc/coreutils/default.nix b/pkgs/tools/misc/coreutils/default.nix
index 48bcf143bb6f..9a422a96d703 100644
--- a/pkgs/tools/misc/coreutils/default.nix
+++ b/pkgs/tools/misc/coreutils/default.nix
@@ -14,18 +14,14 @@ assert selinuxSupport -> libselinux != null && libsepol != null;
 with lib;
 
 stdenv.mkDerivation rec {
-  name = "coreutils-8.27";
+  name = "coreutils-8.28";
 
   src = fetchurl {
     url = "mirror://gnu/coreutils/${name}.tar.xz";
-    sha256 = "0sv547572iq8ayy8klir4hnngnx92a9nsazmf1wgzfc7xr4x74c8";
+    sha256 = "0r8c1bgm68kl70j1lgd0rv12iykw6143k4m9a56xip9rc2hv25qi";
   };
 
-  # FIXME needs gcc 4.9 in bootstrap tools
-  hardeningDisable = [ "stackprotector" ];
-
-  patches = optional hostPlatform.isCygwin ./coreutils-8.23-4.cygwin.patch
-    ++ optional hostPlatform.isDarwin stdenv.secure-format-patch;
+  patches = optional hostPlatform.isCygwin ./coreutils-8.23-4.cygwin.patch;
 
   # The test tends to fail on btrfs and maybe other unusual filesystems.
   postPatch = optionalString (!hostPlatform.isDarwin) ''
@@ -80,8 +76,6 @@ stdenv.mkDerivation rec {
   NIX_LDFLAGS = optionalString selinuxSupport "-lsepol";
   FORCE_UNSAFE_CONFIGURE = optionalString hostPlatform.isSunOS "1";
 
-  makeFlags = optionalString hostPlatform.isDarwin "CFLAGS=-D_FORTIFY_SOURCE=0";
-
   # Works around a bug with 8.26:
   # Makefile:3440: *** Recursive variable 'INSTALL' references itself (eventually).  Stop.
   preInstall = optionalString (hostPlatform != buildPlatform) ''
diff --git a/pkgs/tools/misc/cunit/default.nix b/pkgs/tools/misc/cunit/default.nix
index dfa6bf71bb44..6bbf049d2445 100644
--- a/pkgs/tools/misc/cunit/default.nix
+++ b/pkgs/tools/misc/cunit/default.nix
@@ -4,7 +4,8 @@ stdenv.mkDerivation rec {
   name = "CUnit-${version}";
   version = "2.1-3";
 
-  buildInputs = [autoconf automake libtool autoreconfHook];
+  nativeBuildInputs = [ autoreconfHook ];
+  buildInputs = [autoconf automake libtool];
 
   src = fetchurl {
     url = "mirror://sourceforge/cunit/CUnit/${version}/${name}.tar.bz2";
diff --git a/pkgs/tools/misc/datamash/default.nix b/pkgs/tools/misc/datamash/default.nix
index b1e0bb52a513..9b9735cbfcdc 100644
--- a/pkgs/tools/misc/datamash/default.nix
+++ b/pkgs/tools/misc/datamash/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "datamash-${version}";
-  version = "1.1.1";
+  version = "1.2";
 
   src = fetchurl {
     url = "mirror://gnu/datamash/${name}.tar.gz";
-    sha256 = "06w0pc828qsabmrlh7bc2zwc823xzxy89paaf37f6bipsyrij222";
+    sha256 = "15jrv3ly0vgvwwi2qjmhi39n7wrklwifdk961wwfaxyc5jr6zm78";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/misc/dbus-map/default.nix b/pkgs/tools/misc/dbus-map/default.nix
index b6f483fb4efd..8dcaecf9851c 100644
--- a/pkgs/tools/misc/dbus-map/default.nix
+++ b/pkgs/tools/misc/dbus-map/default.nix
@@ -9,8 +9,9 @@ stdenv.mkDerivation rec {
     rev = "43703fc5e15743309b67131b5ba457b0d6ea7667";
     sha256 = "1pjqn6w29ci8hfxkn1aynzfc8nvy3pqv3hixbxwr7qx20g4rwvdc";
   };
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    pkgconfig glib procps libxml2
+    glib procps libxml2
   ];
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/tools/misc/ddcutil/default.nix b/pkgs/tools/misc/ddcutil/default.nix
index c45c85e4271d..53755c8a19d2 100644
--- a/pkgs/tools/misc/ddcutil/default.nix
+++ b/pkgs/tools/misc/ddcutil/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   name = "ddcutil-${version}";
-  version = "0.8.2";
+  version = "0.8.4";
 
   src = fetchFromGitHub {
     owner  = "rockowitz";
     repo   = "ddcutil";
     rev    = "v${version}";
-    sha256 = "1hcdg54xyb1pfl03iqll14y9yglwmyvxyvhbql87hd9q0dywah6m";
+    sha256 = "1w9bkrlxlgc58rpf03xfd2qbkj73rlbiqrhy8nhwxqqhsj1kkdb0";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
diff --git a/pkgs/tools/misc/debianutils/default.nix b/pkgs/tools/misc/debianutils/default.nix
index e22539827886..6575c19391c0 100644
--- a/pkgs/tools/misc/debianutils/default.nix
+++ b/pkgs/tools/misc/debianutils/default.nix
@@ -1,16 +1,12 @@
 { stdenv, fetchurl }:
 
-let
-  checksums = {
-    "4.8.1" = "09phylg8ih1crgxjadkdb8idbpj9ap62a7cbh8qdx2gyvh5mqf9c";
-  };
-in stdenv.mkDerivation rec {
-  version = "4.8.1";
+stdenv.mkDerivation rec {
+  version = "4.8.2";
   name = "debianutils-${version}";
 
   src = fetchurl {
     url = "mirror://debian/pool/main/d/debianutils/debianutils_${version}.tar.xz";
-    sha256 = checksums."${version}";
+    sha256 = "0s3w3svcsh984zinkxvpzxi7dc0ginqk0nk299fkrr6k7wlmzssd";
   };
 
   meta = {
diff --git a/pkgs/tools/misc/debootstrap/default.nix b/pkgs/tools/misc/debootstrap/default.nix
index e70efe6c4f11..a65862a78451 100644
--- a/pkgs/tools/misc/debootstrap/default.nix
+++ b/pkgs/tools/misc/debootstrap/default.nix
@@ -4,13 +4,13 @@
 # There is also cdebootstrap now. Is that easier to maintain?
 stdenv.mkDerivation rec {
   name = "debootstrap-${version}";
-  version = "1.0.87";
+  version = "1.0.92";
 
   src = fetchurl {
     # git clone git://git.debian.org/d-i/debootstrap.git
     # I'd like to use the source. However it's lacking the lanny script ? (still true?)
     url = "mirror://debian/pool/main/d/debootstrap/debootstrap_${version}.tar.gz";
-    sha256 = "1amk3wghx4f7zfp7d8r0hgqn5gvph50qa6nvh32q2j8aihdr7374";
+    sha256 = "06gp6ivmfh0ks4mibx1mz0pwzjyxqas319s741pp9b3k091jkip1";
   };
 
   buildInputs = [ dpkg gettext gawk perl ];
diff --git a/pkgs/tools/misc/desktop-file-utils/default.nix b/pkgs/tools/misc/desktop-file-utils/default.nix
index 039ec27947af..e5e3815481f1 100644
--- a/pkgs/tools/misc/desktop-file-utils/default.nix
+++ b/pkgs/tools/misc/desktop-file-utils/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
     sha256 = "1ianvr2a69yjv4rpyv30w7yjsmnsb23crrka5ndqxycj4rkk4dc4";
   };
 
-  buildInputs = [ pkgconfig glib libintlOrEmpty ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ glib libintlOrEmpty ];
 
   NIX_LDFLAGS = optionalString stdenv.isDarwin "-lintl";
 
diff --git a/pkgs/tools/misc/diffoscope/default.nix b/pkgs/tools/misc/diffoscope/default.nix
index 6472f1ea09c8..5b42c811bd20 100644
--- a/pkgs/tools/misc/diffoscope/default.nix
+++ b/pkgs/tools/misc/diffoscope/default.nix
@@ -1,38 +1,40 @@
-{ lib, stdenv, fetchgit, fetchpatch, python3, docutils
-, acl, binutils, bzip2, cbfstool, cdrkit, colord, cpio, diffutils, e2fsprogs, file, fpc, gettext, ghc
-, gnupg1, gzip, jdk, libcaca, mono, pdftk, poppler_utils, sng, sqlite, squashfsTools, unzip, vim, xz
-, colordiff
+{ lib, stdenv, fetchgit, python3Packages, docutils
+, acl, apktool, libbfd, bzip2, cbfstool, cdrkit, colord, colordiff, coreutils, cpio, diffutils, dtc
+, e2fsprogs, file, findutils, fontforge-fonttools, fpc, gettext, ghc, ghostscriptX, giflib, gnupg1, gnutar
+, gzip, imagemagick, jdk, libarchive, libcaca, llvm, mono, openssh, pdftk, pgpdump, poppler_utils, sng, sqlite
+, squashfsTools, tcpdump, unoconv, unzip, xxd, xz
 , enableBloat ? false
 }:
 
-python3.pkgs.buildPythonApplication rec {
-  pname = "diffoscope";
-  name = "${pname}-${version}";
-  version = "77";
+python3Packages.buildPythonApplication rec {
+  name = "diffoscope-${version}";
+  version = "87";
 
   src = fetchgit {
-    url = "git://anonscm.debian.org/reproducible/diffoscope.git";
-    rev = "refs/tags/${version}";
-    sha256 = "0l5q24sqb88qkz62cz85bq65myfqig3z3m1lj2s92hdlqip9946b";
+    url    = "git://anonscm.debian.org/reproducible/diffoscope.git";
+    rev    = "refs/tags/${version}";
+    sha256 = "0j3pljwmggrpaghbamvr24x4cg5yj7hl2ll27405p7970scnpngv";
   };
 
-  patches =
-    [ # Ignore different link counts.
-      ./ignore_links.patch
-    ];
+  patches = [
+    ./ignore_links.patch
+  ];
 
   postPatch = ''
     # Upstream doesn't provide a PKG-INFO file
     sed -i setup.py -e "/'rpm-python',/d"
   '';
 
-  # Still missing these tools: enjarify, otool & lipo (maybe macOS only), showttf
+  # Still missing these tools: docx2txt enjarify js-beautify oggDump Rscript
   # Also these libraries: python3-guestfs
-  # FIXME: move xxd into a separate package so we don't have to pull in all of vim.
-  pythonPath = with python3.pkgs;
-    [ debian libarchive-c python_magic tlsh rpm cdrkit acl binutils bzip2 cbfstool cpio diffutils e2fsprogs file gettext
-      gzip libcaca poppler_utils sng sqlite squashfsTools unzip vim xz colordiff
-    ] ++ lib.optionals enableBloat [ colord fpc ghc gnupg1 jdk mono pdftk ];
+  pythonPath = with python3Packages; [ debian libarchive-c python_magic tlsh rpm ] ++ [
+      acl libbfd bzip2 cdrkit colordiff coreutils cpio diffutils dtc e2fsprogs file findutils
+      fontforge-fonttools gettext gnutar gzip libarchive libcaca pgpdump sng sqlite
+      squashfsTools unzip xxd xz
+    ] ++ lib.optionals enableBloat [
+      apktool cbfstool colord fpc ghc ghostscriptX giflib gnupg1 imagemagick
+      llvm jdk mono openssh pdftk poppler_utils tcpdump unoconv
+    ];
 
   doCheck = false; # Calls 'mknod' in squashfs tests, which needs root
 
@@ -53,9 +55,9 @@ python3.pkgs.buildPythonApplication rec {
       diffoscope is developed as part of the "reproducible builds" Debian
       project and was formerly known as "debbindiff".
     '';
-    homepage = https://wiki.debian.org/ReproducibleBuilds;
-    license = licenses.gpl3Plus;
-    maintainers = [ maintainers.dezgeg ];
-    platforms = platforms.linux;
+    homepage    = https://wiki.debian.org/ReproducibleBuilds;
+    license     = licenses.gpl3Plus;
+    maintainers = with maintainers; [ dezgeg ];
+    platforms   = platforms.linux;
   };
 }
diff --git a/pkgs/tools/misc/diffoscope/ignore_links.patch b/pkgs/tools/misc/diffoscope/ignore_links.patch
index ceea0dc94d4e..b0841ce0bb57 100644
--- a/pkgs/tools/misc/diffoscope/ignore_links.patch
+++ b/pkgs/tools/misc/diffoscope/ignore_links.patch
@@ -1,19 +1,32 @@
-diff -ru -x '*~' diffoscope-orig/diffoscope/comparators/directory.py diffoscope/diffoscope/comparators/directory.py
---- diffoscope-orig/diffoscope/comparators/directory.py	1970-01-01 01:00:01.000000000 +0100
-+++ diffoscope/diffoscope/comparators/directory.py	2016-12-08 17:37:55.000315157 +0100
-@@ -49,6 +49,7 @@
-     FILE_RE = re.compile(r'^\s*File:.*$')
-     DEVICE_RE = re.compile(r'Device: [0-9a-f]+h/[0-9]+d\s+')
-     INODE_RE = re.compile(r'Inode: [0-9]+\s+')
-+    LINKS_RE = re.compile(r'Links: [0-9]+\s+')
-     ACCESS_TIME_RE = re.compile(r'^Access: [0-9]{4}-[0-9]{2}-[0-9]{2}.*$')
-     CHANGE_TIME_RE = re.compile(r'^Change: [0-9]{4}-[0-9]{2}-[0-9]{2}.*$')
+From a33e8018092e4a91dbc45e15bbeff760b3418512 Mon Sep 17 00:00:00 2001
+From: Tuomas Tynkkynen <tuomas.tynkkynen@iki.fi>
+Date: Wed, 13 Sep 2017 16:53:38 +0300
+Subject: [PATCH] Ignore hard link counts
+
+---
+ diffoscope/comparators/directory.py | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/diffoscope/comparators/directory.py b/diffoscope/comparators/directory.py
+index 3b195bc..9071bb3 100644
+--- a/diffoscope/comparators/directory.py
++++ b/diffoscope/comparators/directory.py
+@@ -66,6 +66,7 @@ else:
+         FILE_RE = re.compile(r'^\s*File:.*$')
+         DEVICE_RE = re.compile(r'Device: [0-9a-f]+h/[0-9]+d\s+')
+         INODE_RE = re.compile(r'Inode: [0-9]+\s+')
++        LINKS_RE = re.compile(r'Links: [0-9]+\s+')
+         ACCESS_TIME_RE = re.compile(r'^Access: [0-9]{4}-[0-9]{2}-[0-9]{2}.*$')
+         CHANGE_TIME_RE = re.compile(r'^Change: [0-9]{4}-[0-9]{2}-[0-9]{2}.*$')
  
-@@ -57,6 +58,7 @@
-         line = Stat.FILE_RE.sub('', line)
-         line = Stat.DEVICE_RE.sub('', line)
-         line = Stat.INODE_RE.sub('', line)
-+        line = Stat.LINKS_RE.sub('', line)
-         line = Stat.ACCESS_TIME_RE.sub('', line)
-         line = Stat.CHANGE_TIME_RE.sub('', line)
-         return line.encode('utf-8')
+@@ -74,6 +75,7 @@ else:
+             line = Stat.FILE_RE.sub('', line)
+             line = Stat.DEVICE_RE.sub('', line)
+             line = Stat.INODE_RE.sub('', line)
++            line = Stat.LINKS_RE.sub('', line)
+             line = Stat.ACCESS_TIME_RE.sub('', line)
+             line = Stat.CHANGE_TIME_RE.sub('', line)
+             return line.encode('utf-8')
+-- 
+2.13.0
+
diff --git a/pkgs/tools/misc/diffoscope/locale.patch b/pkgs/tools/misc/diffoscope/locale.patch
deleted file mode 100644
index 408d3ba2ce04..000000000000
--- a/pkgs/tools/misc/diffoscope/locale.patch
+++ /dev/null
@@ -1,14 +0,0 @@
-diff -ru -x '*~' diffoscope-orig/diffoscope/__init__.py diffoscope/diffoscope/__init__.py
---- diffoscope-orig/diffoscope/__init__.py	1970-01-01 01:00:01.000000000 +0100
-+++ diffoscope/diffoscope/__init__.py	2016-12-08 17:48:51.732122110 +0100
-@@ -81,8 +81,8 @@
-     for var in ['LANG', 'LC_NUMERIC', 'LC_TIME', 'LC_COLLATE', 'LC_MONETARY',
-                 'LC_MESSAGES', 'LC_PAPER', 'LC_NAME', 'LC_ADDRESS',
-                 'LC_TELEPHONE', 'LC_MEASUREMENT', 'LC_IDENTIFICATION']:
--        os.environ[var] = 'C'
--    os.environ['LC_CTYPE'] = 'C.UTF-8'
-+        os.environ[var] = 'en_US'
-+    os.environ['LC_CTYPE'] = 'en_US.UTF-8'
-     os.environ['TZ'] = 'UTC'
- 
- 
diff --git a/pkgs/tools/misc/ding-libs/default.nix b/pkgs/tools/misc/ding-libs/default.nix
index e5daee11b593..61c8a8370d7f 100644
--- a/pkgs/tools/misc/ding-libs/default.nix
+++ b/pkgs/tools/misc/ding-libs/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "ding-libs-${version}";
-  version = "0.6.0";
+  version = "0.6.1";
 
   src = fetchurl {
     url = "https://fedorahosted.org/released/ding-libs/ding-libs-${version}.tar.gz";
-    sha1 = "c8ec86cb93a26e013a13b12a7b0b3fbc1bca16c1";
+    sha256 = "1h97mx2jdv4caiz4r7y8rxfsq78fx0k4jjnfp7x2s7xqvqks66d3";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/tools/misc/direnv/default.nix b/pkgs/tools/misc/direnv/default.nix
index 1606fffe397b..f36a6d51b360 100644
--- a/pkgs/tools/misc/direnv/default.nix
+++ b/pkgs/tools/misc/direnv/default.nix
@@ -2,14 +2,14 @@
 
 buildGoPackage rec {
   name = "direnv-${version}";
-  version = "2.12.2";
+  version = "2.13.1";
   goPackagePath = "github.com/direnv/direnv";
 
   src = fetchFromGitHub {
     owner = "direnv";
     repo = "direnv";
     rev = "v${version}";
-    sha256 = "0i8fnxhcl1zin714wxk93x8fi36z4fibapfn4jl3qkwbczkj8c8b";
+    sha256 = "1j2jkxzd6rh4ms39izqfm4w8h12dg0ccvqsj0z1z4hb3f1jqcgbz";
   };
 
   postConfigure = ''
@@ -25,8 +25,6 @@ buildGoPackage rec {
     make install DESTDIR=$bin
     mkdir -p $bin/share/fish/vendor_conf.d
     echo "eval ($bin/bin/direnv hook fish)" > $bin/share/fish/vendor_conf.d/direnv.fish
-  '' + stdenv.lib.optionalString (stdenv.isDarwin) ''
-    install_name_tool -delete_rpath $out/lib $bin/bin/direnv
   '';
 
   meta = with stdenv.lib; {
@@ -42,7 +40,7 @@ buildGoPackage rec {
       In short, this little tool allows you to have project-specific
       environment variables.
     '';
-    homepage = http://direnv.net;
+    homepage = https://direnv.net;
     license = licenses.mit;
     maintainers = with maintainers; [ zimbatm ];
   };
diff --git a/pkgs/tools/misc/duc/default.nix b/pkgs/tools/misc/duc/default.nix
index ba1abb7c86df..7e98b7d64d2d 100644
--- a/pkgs/tools/misc/duc/default.nix
+++ b/pkgs/tools/misc/duc/default.nix
@@ -2,16 +2,17 @@
 
 stdenv.mkDerivation rec {
   name = "duc-${version}";
-  version = "1.4.1";
+  version = "1.4.3";
 
   src = fetchFromGitHub {
     owner = "zevv";
     repo = "duc";
     rev = "${version}";
-    sha256 = "0rnar2zacsb9rvdmp1a62xixhy69s5vh0nwgrklqxhb19qkzhdp7";
+    sha256 = "1h7vll8a78ijan9bmnimmsviywmc39x8h9iikx8vm98kwyxi4xif";
   };
 
-  buildInputs = [ autoreconfHook pkgconfig tokyocabinet cairo pango ncurses ];
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  buildInputs = [ tokyocabinet cairo pango ncurses ];
 
   meta = with stdenv.lib; {
     homepage = http://duc.zevv.nl/;
diff --git a/pkgs/tools/misc/entr/default.nix b/pkgs/tools/misc/entr/default.nix
index a68e2be6aebe..d37655134c55 100644
--- a/pkgs/tools/misc/entr/default.nix
+++ b/pkgs/tools/misc/entr/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "entr-${version}";
-  version = "3.7";
+  version = "3.9";
 
   src = fetchurl {
     url = "http://entrproject.org/code/${name}.tar.gz";
-    sha256 = "0bx2ivx9hwixjwmk7aqlx20mwmn3cvryppnmc285d7byiw6dbvwl";
+    sha256 = "0xk8y8asy0wxi5jx03c521p9919gjr8053lxpfzn83jkmqc8zmq2";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/misc/eot-utilities/default.nix b/pkgs/tools/misc/eot-utilities/default.nix
index f773ae6caac5..b44159be8ce8 100644
--- a/pkgs/tools/misc/eot-utilities/default.nix
+++ b/pkgs/tools/misc/eot-utilities/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     sha256 = "0cb41riabss23hgfg7vxhky09d6zqwjy1nxdvr3l2bh5qzd4kvaf";
   };
 
-  buildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
 
   meta = {
     homepage = http://www.w3.org/Tools/eot-utils/;
diff --git a/pkgs/tools/misc/esptool/default.nix b/pkgs/tools/misc/esptool/default.nix
index 04ba5788cd91..33624302ebcc 100644
--- a/pkgs/tools/misc/esptool/default.nix
+++ b/pkgs/tools/misc/esptool/default.nix
@@ -1,19 +1,18 @@
-{ stdenv, fetchFromGitHub, python3 }:
+{ stdenv, fetchFromGitHub, python3, openssl }:
 
 python3.pkgs.buildPythonApplication rec {
   name = "esptool-${version}";
-  version = "1.3";
+  version = "2.1";
 
   src = fetchFromGitHub {
     owner = "espressif";
     repo = "esptool";
     rev = "v${version}";
-    sha256 = "0112fybkz4259gyvhcs18wa6938jp6w7clk66kpd0d1dg70lz1h6";
+    sha256 = "137p0kcscly95qpjzgx1yxm8k2wf5y9v3srvlhp2ajniirgv8ijv";
   };
 
-  propagatedBuildInputs = with python3.pkgs; [ pyserial ];
-
-  doCheck = false; # FIXME: requires packaging some new deps
+  buildInputs = with python3.pkgs; [ flake8 flake8-future-import ];
+  propagatedBuildInputs = with python3.pkgs; [ pyserial pyaes ecdsa openssl ];
 
   meta = with stdenv.lib; {
     description = "ESP8266 and ESP32 serial bootloader utility";
diff --git a/pkgs/tools/misc/ethtool/default.nix b/pkgs/tools/misc/ethtool/default.nix
index ae6ea6e3f538..85672619d61c 100644
--- a/pkgs/tools/misc/ethtool/default.nix
+++ b/pkgs/tools/misc/ethtool/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "ethtool-${version}";
-  version = "4.11";
+  version = "4.13";
 
   src = fetchurl {
     url = "mirror://kernel/software/network/ethtool/${name}.tar.xz";
-    sha256 = "1cp132kk2xd2cwn1ysjv0cl8i9lnq3n4zi4wy676p5k4h2mfvn0j";
+    sha256 = "1flwz4x76ajxigadq9knxgwr778g03y3qfx6c7rflc3x020a7hdp";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/misc/exa/default.nix b/pkgs/tools/misc/exa/default.nix
index 110125727bf0..cb77edf0d29a 100644
--- a/pkgs/tools/misc/exa/default.nix
+++ b/pkgs/tools/misc/exa/default.nix
@@ -2,34 +2,17 @@
 
 with rustPlatform;
 
-let
-  # check for updates
-  zoneinfo_compiled = fetchFromGitHub {
-    owner = "rust-datetime";
-    repo = "zoneinfo-compiled";
-    rev = "f56921ea5e9f7cf065b1480ff270a1757c1f742f";
-    sha256 = "1xmw7c5f5n45lkxnyxp4llfv1bnqhc876w98165ccdbbiylfkw26";
-  };
-  cargoPatch = ''
-    # use non-git dependencies
-    patch Cargo.toml <<EOF
-    46c46
-    < git = "https://github.com/rust-datetime/zoneinfo-compiled.git"
-    ---
-    > path = "${zoneinfo_compiled}"
-    EOF
-  '';
-in buildRustPackage rec {
+buildRustPackage rec {
   name = "exa-${version}";
-  version = "0.7.0";
+  version = "0.8.0";
 
-  depsSha256 = "0j320hhf2vqaha137pjj4pyiw6d3p5h3nhy3pl9vna1g5mnl1sn7";
+  cargoSha256 = "08zzn3a32xfjkmpawcjppn1mr26ws3iv40cckiz8ldz4qc8y9gdh";
 
   src = fetchFromGitHub {
     owner = "ogham";
     repo = "exa";
     rev = "v${version}";
-    sha256 = "0i9psgna2wwv9qyw9cif4qznqiyi16vl763hpm2yr195aj700339";
+    sha256 = "0jy11a3xfnfnmyw1kjmv4ffavhijs8c940kw24vafklnacx5n88m";
   };
 
   nativeBuildInputs = [ cmake pkgconfig perl ];
@@ -38,15 +21,6 @@ in buildRustPackage rec {
   # Some tests fail, but Travis ensures a proper build
   doCheck = false;
 
-  cargoUpdateHook = ''
-    ${cargoPatch}
-  '';
-  cargoDepsHook = ''
-    pushd $sourceRoot
-    ${cargoPatch}
-    popd
-  '';
-
   meta = with stdenv.lib; {
     description = "Replacement for 'ls' written in Rust";
     longDescription = ''
@@ -57,7 +31,7 @@ in buildRustPackage rec {
       for a directory, or recursing into directories with a tree view. exa is
       written in Rust, so it’s small, fast, and portable.
     '';
-    homepage = http://the.exa.website;
+    homepage = https://the.exa.website;
     license = licenses.mit;
     maintainer = [ maintainers.ehegnes ];
   };
diff --git a/pkgs/tools/misc/expect/default.nix b/pkgs/tools/misc/expect/default.nix
index 80fb3c6a694c..0d1c81c00a65 100644
--- a/pkgs/tools/misc/expect/default.nix
+++ b/pkgs/tools/misc/expect/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "A tool for automating interactive applications";
-    homepage = http://expect.nist.gov/;
+    homepage = http://expect.sourceforge.net/;
     license = "Expect";
     platforms = platforms.unix;
     maintainers = with maintainers; [ wkennington ];
diff --git a/pkgs/tools/misc/fd/default.nix b/pkgs/tools/misc/fd/default.nix
index 763ca668d181..09debd461dc4 100644
--- a/pkgs/tools/misc/fd/default.nix
+++ b/pkgs/tools/misc/fd/default.nix
@@ -2,18 +2,23 @@
 
 rustPlatform.buildRustPackage rec {
   name = "fd-${version}";
-  version = "2.0.0";
+  version = "5.0.0";
 
   src = fetchFromGitHub {
     owner = "sharkdp";
     repo = "fd";
     rev = "v${version}";
-    sha256 = "1xs4y9zf5m0ykl95787jv98xg0a60gkcyyh7kg7qg4xrcgf4qz4j";
+    sha256 = "17y2fr3faaf32lv171ppkgi55v5zxq97jiilsgmjcn00rd9i6v0j";
   };
 
-  depsSha256 = "1hxf3j4584jgpwrwykx6yil6q6ka9l81qvx6zrbprdxk3pslp049";
+  cargoSha256 = "17f4plyj6mnz0d9f4ykgbmddsdp6c3f6q4kmgj406p49xsf0jjkc";
 
-  meta = {
+  preFixup = ''
+    mkdir -p "$out/man/man1"
+    cp "$src/doc/fd.1" "$out/man/man1"
+  '';
+
+  meta = with stdenv.lib; {
     description = "A simple, fast and user-friendly alternative to find";
     longDescription = ''
       `fd` is a simple, fast and user-friendly alternative to `find`.
@@ -22,7 +27,7 @@ rustPlatform.buildRustPackage rec {
       it provides sensible (opinionated) defaults for 80% of the use cases.
     '';
     homepage = "https://github.com/sharkdp/fd";
-    license = stdenv.lib.licenses.mit;
-    platforms = stdenv.lib.platforms.all;
+    license = with licenses; [ asl20 /* or */ mit ];
+    platforms = platforms.all;
   };
 }
diff --git a/pkgs/tools/misc/file/default.nix b/pkgs/tools/misc/file/default.nix
index 779256046e58..47d67f91ec73 100644
--- a/pkgs/tools/misc/file/default.nix
+++ b/pkgs/tools/misc/file/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   name = "file-${version}";
-  version = "5.31";
+  version = "5.32";
 
   src = fetchurl {
     urls = [
       "ftp://ftp.astron.com/pub/file/${name}.tar.gz"
       "https://distfiles.macports.org/file/${name}.tar.gz"
     ];
-    sha256 = "1vp4zihaxkhi85chkjgd4r4zdg4k2wa3c6pmajhbmx6gr7d8ii89";
+    sha256 = "0l1bfa0icng9vdwya00ff48fhvjazi5610ylbhl35qi13d6xqfc6";
   };
 
   buildInputs = [ zlib ];
diff --git a/pkgs/tools/misc/fontforge/default.nix b/pkgs/tools/misc/fontforge/default.nix
index ee7854c539ed..c7fd29da8ac4 100644
--- a/pkgs/tools/misc/fontforge/default.nix
+++ b/pkgs/tools/misc/fontforge/default.nix
@@ -32,8 +32,9 @@ stdenv.mkDerivation rec {
   # do not use x87's 80-bit arithmetic, rouding errors result in very different font binaries
   NIX_CFLAGS_COMPILE = lib.optionals stdenv.isi686 [ "-msse2" "-mfpmath=sse" ];
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    autoconf automake gnum4 libtool perl pkgconfig gettext uthash
+    autoconf automake gnum4 libtool perl gettext uthash
     python freetype zlib glib libungif libpng libjpeg libtiff libxml2
   ]
     ++ lib.optionals withSpiro [libspiro]
diff --git a/pkgs/tools/misc/fontforge/fontforge-fonttools.nix b/pkgs/tools/misc/fontforge/fontforge-fonttools.nix
index c65d8ed375d2..551fc71b7a74 100644
--- a/pkgs/tools/misc/fontforge/fontforge-fonttools.nix
+++ b/pkgs/tools/misc/fontforge/fontforge-fonttools.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchFromGitHub, zlib}:
+{ stdenv, fetchFromGitHub, zlib }:
 
 stdenv.mkDerivation rec {
   version = "20160404";
@@ -11,14 +11,14 @@ stdenv.mkDerivation rec {
     sha256 = "15nacq84n9gvlzp3slpmfrrbh57kfb6lbdlc46i7aqgci4qv6fg0";
   };
 
-  buildInputs = [zlib];
+  buildInputs = [ zlib ];
 
   setSourceRoot = ''export sourceRoot="$(echo */contrib/fonttools)"'';
 
   installPhase = ''
     mkdir -p "$out"/{bin,share/doc/fontforge-fonttools}
     for i in *.c; do
-      gcc "$i" -lz -lm --std=c99 -o "$out"/bin/$(basename "$i" .c)
+      $CC "$i" -lz -lm --std=c99 -o "$out"/bin/$(basename "$i" .c)
     done
     cp README* "$out/share/doc/fontforge-fonttools"
   '';
diff --git a/pkgs/tools/misc/fpart/default.nix b/pkgs/tools/misc/fpart/default.nix
new file mode 100644
index 000000000000..b29e76413104
--- /dev/null
+++ b/pkgs/tools/misc/fpart/default.nix
@@ -0,0 +1,42 @@
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  name = "fpart-${version}";
+  version = "0.9.3";
+
+  src = fetchurl {
+    url = "http://contribs.martymac.org/fpart/${name}.tar.gz";
+    sha256 = "0f1vm7c7v9nrd0mnz6qivpnngni6y53b11kvniclqfd25hhw6ggq";
+  };
+
+  postInstall = ''
+    sed "s|^FPART_BIN=.*|FPART_BIN=\"$out/bin/fpart\"|" \
+        -i "$out/bin/fpsync"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Split file trees into bags (called \"partitions\")";
+    longDescription = ''
+      Fpart is a tool that helps you sort file trees and pack them into bags
+      (called "partitions").
+
+      It splits a list of directories and file trees into a certain number of
+      partitions, trying to produce partitions with the same size and number of
+      files. It can also produce partitions with a given number of files or a
+      limited size.
+
+      Once generated, partitions are either printed as file lists to stdout
+      (default) or to files. Those lists can then be used by third party programs.
+
+      Fpart also includes a live mode, which allows it to crawl very large
+      filesystems and produce partitions in live. Hooks are available to act on
+      those partitions (e.g. immediatly start a transfer using rsync(1))
+      without having to wait for the filesystem traversal job to be finished.
+      Used this way, fpart can be seen as a powerful data migration tool.
+    '';
+    homepage = "http://contribs.martymac.org/";
+    license = licenses.bsd2;
+    platforms = platforms.unix;
+    maintainers = [ maintainers.bjornfor ];
+  };
+}
diff --git a/pkgs/tools/misc/fwup/default.nix b/pkgs/tools/misc/fwup/default.nix
index 8937de88c38d..82b3a1d963d4 100644
--- a/pkgs/tools/misc/fwup/default.nix
+++ b/pkgs/tools/misc/fwup/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   name = "fwup-${version}";
-  version = "0.14.3";
+  version = "0.16.1";
 
   src = fetchFromGitHub {
     owner = "fhunleth";
     repo = "fwup";
     rev = "v${version}";
-    sha256 = "15sjpxw1llpipshriivpha6470lkvhcgs5wh5mlaabjbvrgxygqh";
+    sha256 = "1hphgpwxzdbfswzxbx0jm7lma1xkkwxvm8ll3jp2ljmimqzzb7jf";
   };
 
   doCheck = true;
diff --git a/pkgs/tools/misc/fzf/default.nix b/pkgs/tools/misc/fzf/default.nix
index 5bf42fae9ea1..830f9cb878be 100644
--- a/pkgs/tools/misc/fzf/default.nix
+++ b/pkgs/tools/misc/fzf/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   name = "fzf-${version}";
-  version = "0.16.11";
+  version = "0.17.1";
   rev = "${version}";
 
   goPackagePath = "github.com/junegunn/fzf";
@@ -11,7 +11,7 @@ buildGoPackage rec {
     inherit rev;
     owner = "junegunn";
     repo = "fzf";
-    sha256 = "1jm7v482ad85l627k7a265p2clzy2yk88hqqbjsihi53mj8agxa0";
+    sha256 = "0zxav6kfifppj49kif8917djq1vqjznqzmviqj4iiar8jmyrn2fy";
   };
 
   outputs = [ "bin" "out" "man" ];
diff --git a/pkgs/tools/misc/fzy/default.nix b/pkgs/tools/misc/fzy/default.nix
index 66f02bcc7bcc..f1b049ba2cee 100644
--- a/pkgs/tools/misc/fzy/default.nix
+++ b/pkgs/tools/misc/fzy/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "fzy-${version}";
-  version = "0.7";
+  version = "0.9";
 
   src = fetchFromGitHub {
     owner = "jhawthorn";
     repo = "fzy";
     rev = version;
-    sha256 = "11sc92j9fx23byxv5y4rq0jxp55vc9mrn5hx9lb162vdrl8a4222";
+    sha256 = "1f1sh88ivdgnqaqha5ircfd9vb0xmss976qns022n0ddb91k5ka6";
   };
 
   makeFlags = "PREFIX=$(out)";
diff --git a/pkgs/tools/misc/gbdfed/default.nix b/pkgs/tools/misc/gbdfed/default.nix
index 1ba4bceb7876..6307d012debd 100644
--- a/pkgs/tools/misc/gbdfed/default.nix
+++ b/pkgs/tools/misc/gbdfed/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0g09k6wim58hngxncq2brr7mwjm92j3famp0vs4b3p48wr65vcjx";
   };
 
-  buildInputs = [ pkgconfig freetype gtk ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ freetype gtk ];
 
   patches = [ ./Makefile.patch ];
 
diff --git a/pkgs/tools/misc/git-fire/default.nix b/pkgs/tools/misc/git-fire/default.nix
new file mode 100644
index 000000000000..0b5deccaa904
--- /dev/null
+++ b/pkgs/tools/misc/git-fire/default.nix
@@ -0,0 +1,29 @@
+{ stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation {
+  name = "git-fire-unstable-2017-08-27";
+
+  src = fetchFromGitHub {
+    owner = "qw3rtman";
+    repo = "git-fire";
+    rev = "d72b68ed356f726c77c60294f9220275f16c9931";
+    sha256 = "1hdwkhyjjx31y0lpjkhbb4f5y9f7g70fnd4c2246cmk2rbsvj5b2";
+  };
+
+  installPhase = ''
+    install -D -m755 $src/git-fire $out/bin/git-fire
+  '';
+
+  meta = with stdenv.lib; {
+    description = ''
+      Push ALL changes in a git repository
+    '';
+    longDescription = ''
+      In the event of an emergency (fire, etc.), automatically commit all changes/files in a repository, pushing to all known remotes all commits and stashes.
+    '';
+    homepage = "https://github.com/qw3rtman/git-fire";
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.swflint ];
+  };
+}
diff --git a/pkgs/tools/misc/goaccess/default.nix b/pkgs/tools/misc/goaccess/default.nix
index 424a84637a53..8586244b4152 100644
--- a/pkgs/tools/misc/goaccess/default.nix
+++ b/pkgs/tools/misc/goaccess/default.nix
@@ -14,8 +14,8 @@ stdenv.mkDerivation rec {
     "--enable-utf8"
   ];
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    pkgconfig
     geoipWithDatabase
     ncurses
     glib
diff --git a/pkgs/tools/misc/gosu/default.nix b/pkgs/tools/misc/gosu/default.nix
new file mode 100644
index 000000000000..81606e1ca7f8
--- /dev/null
+++ b/pkgs/tools/misc/gosu/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, buildGoPackage, fetchgit, fetchhg, fetchbzr, fetchsvn }:
+
+buildGoPackage rec {
+  name = "gosu-${version}";
+  version = "2017-05-09";
+  rev = "e87cf95808a7b16208515c49012aa3410bc5bba8";
+
+  goPackagePath = "github.com/tianon/gosu";
+
+  src = fetchgit {
+    inherit rev;
+    url = "https://github.com/tianon/gosu";
+    sha256 = "1qp1cfx0hrr4qlnh7rhjb4xlxv9697flmgzzl6jcdkrpk1f0bz8m";
+  };
+
+  goDeps = ./deps.nix;
+
+  meta = {
+    description= "Tool that avoids TTY and signal-forwarding behavior of sudo and su";
+    homepage = "https://github.com/tianon/gosu";
+    licence = stdenv.lib.licenses.gpl3;
+    platforms = stdenv.lib.platforms.linux;
+  };
+}
diff --git a/pkgs/tools/misc/gosu/deps.nix b/pkgs/tools/misc/gosu/deps.nix
new file mode 100644
index 000000000000..9bdfa3923401
--- /dev/null
+++ b/pkgs/tools/misc/gosu/deps.nix
@@ -0,0 +1,11 @@
+[
+  {
+    goPackagePath = "github.com/opencontainers/runc";
+    fetch = {
+      type = "git";
+      url = "https://github.com/opencontainers/runc";
+      rev = "5274430fee9bc930598cfd9c9dbd33213f79f96e";
+      sha256 = "149057gm2y1mc45s7bh43c1ngjg1m54jkpaxw534ir9v5mb1zsxx";
+    };
+  }
+]
diff --git a/pkgs/tools/misc/gparted/default.nix b/pkgs/tools/misc/gparted/default.nix
index 67e5a7848b2e..76bfb8c661ed 100644
--- a/pkgs/tools/misc/gparted/default.nix
+++ b/pkgs/tools/misc/gparted/default.nix
@@ -4,10 +4,10 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "gparted-0.28.1";
+  name = "gparted-0.29.0";
 
   src = fetchurl {
-    sha256 = "0cyk8lpimm6wani8khw0szwqkgw5wpq2mfnfxkbgfm2774a1z2bn";
+    sha256 = "1kf3ly7m3bikyzapjw8q1rlia0kg5zzgp59akhabx1rnnimvyl12";
     url = "mirror://sourceforge/gparted/${name}.tar.gz";
   };
 
diff --git a/pkgs/tools/misc/graylog/default.nix b/pkgs/tools/misc/graylog/default.nix
index 00cb6fd44f2e..11cbd87024f1 100644
--- a/pkgs/tools/misc/graylog/default.nix
+++ b/pkgs/tools/misc/graylog/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  version = "2.3.0";
+  version = "2.3.2";
   name = "graylog-${version}";
 
   src = fetchurl {
     url = "https://packages.graylog2.org/releases/graylog/graylog-${version}.tgz";
-    sha256 = "03jv8l5hj3hw91vk69pxhc2zvxyzc5sfvxf700rq83wsjh6gb5iz";
+    sha256 = "0mzrhzbyblspia3qp85hvv5kdc7v3aird02q2pxrxbwca6wjlxcs";
   };
 
   dontBuild = true;
diff --git a/pkgs/tools/misc/graylog/plugins.nix b/pkgs/tools/misc/graylog/plugins.nix
index 8ea86d1a7a57..dfaefc2b2e22 100644
--- a/pkgs/tools/misc/graylog/plugins.nix
+++ b/pkgs/tools/misc/graylog/plugins.nix
@@ -25,10 +25,10 @@ in {
   aggregates = glPlugin rec {
     name = "graylog-aggregates-${version}";
     pluginName = "graylog-plugin-aggregates";
-    version = "1.1.1";
+    version = "2.0.0";
     src = fetchurl {
       url = "https://github.com/cvtienhoven/${pluginName}/releases/download/${version}/${pluginName}-${version}.jar";
-      sha256 = "1wx5i8ls7dgffsy35i91gkrj6p9nh2jbar9pgas190lfb9yk45bx";
+      sha256 = "0crgb49msjkvfpksbfhq2hlkc904j184wm1wp6q0x6lzhn07hm8y";
     };
     meta = {
       homepage = https://github.com/cvtienhoven/graylog-plugin-aggregates;
@@ -48,13 +48,39 @@ in {
       description = "SSO support for Graylog through trusted HTTP headers set by load balancers or authentication proxies";
     };
   };
+  dnsresolver = glPlugin rec {
+    name = "graylog-dnsresolver-${version}";
+    pluginName = "graylog-plugin-dnsresolver";
+    version = "1.1.2";
+    src = fetchurl {
+      url = "https://github.com/graylog-labs/${pluginName}/releases/download/${version}/${pluginName}-${version}.jar";
+      sha256 = "01s7wm6bwcpmdrl35gjp6rrqxixs2s9km2bdgzhv8pn25j5qnw28";
+    };
+    meta = {
+      homepage = https://github.com/graylog-labs/graylog-plugin-dnsresolver;
+      description = "Message filter plugin can be used to do DNS lookups for the source field in Graylog messages";
+    };
+  };
+  filter-messagesize = glPlugin rec {
+    name = "graylog-filter-messagesize-${version}";
+    pluginName = "graylog-plugin-filter-messagesize";
+    version = "0.0.2";
+    src = fetchurl {
+      url = "https://github.com/graylog-labs/${pluginName}/releases/download/${version}/${pluginName}-${version}.jar";
+      sha256 = "1vx62yikd6d3lbwsfiyf9j6kx8drvn4xhffwv27fw5jzhfqr61ji";
+    };
+    meta = {
+      homepage = https://github.com/graylog-labs/graylog-plugin-filter-messagesize;
+      description = "Prints out all messages that have an estimated size crossing a configured threshold during processing";
+    };
+  };
   internal-logs = glPlugin rec {
     name = "graylog-internal-logs-${version}";
     pluginName = "graylog-plugin-internal-logs";
-    version = "1.0.0";
+    version = "2.3.0";
     src = fetchurl {
       url = "https://github.com/graylog-labs/${pluginName}/releases/download/${version}/${pluginName}-${version}.jar";
-      sha256 = "1abl7wwr59k9vvr2fmrlrx4ipsjjl8xryqy19fy5irxhpwp93ixl";
+      sha256 = "05r4m2gf1hj1b889rmpb6b5a6q2xd0qkl1rpj107yd219j2grzf4";
     };
     meta = {
       homepage = https://github.com/graylog-labs/graylog-plugin-internal-logs;
@@ -66,11 +92,11 @@ in {
     pluginName = "graylog-plugin-ipanonymizer";
     version = "1.1.2";
     src = fetchurl {
-      url = "https://github.com/Graylog2/${pluginName}/releases/download/${version}/${pluginName}-${version}.jar";
+      url = "https://github.com/graylog-labs/${pluginName}/releases/download/${version}/${pluginName}-${version}.jar";
       sha256 = "0hd66751hp97ddkn29s1cmjmc2h1nrp431bq7d2wq16iyxxlygri";
     };
     meta = {
-      homepage = https://github.com/Graylog2/graylog-plugin-ipanonymizer;
+      homepage = https://github.com/graylog-labs/graylog-plugin-ipanonymizer;
       description = "A graylog-server plugin that replaces the last octet of IP addresses in messages with xxx";
     };
   };
@@ -87,6 +113,19 @@ in {
       description = "Jabber Alarmcallback Plugin for Graylog";
     };
   };
+  metrics = glPlugin rec {
+    name = "graylog-metrics-${version}";
+    pluginName = "graylog-plugin-metrics";
+    version = "1.3.0";
+    src = fetchurl {
+      url = "https://github.com/graylog-labs/${pluginName}/releases/download/${version}/${pluginName}-${version}.jar";
+      sha256 = "1v1yzmqp43kxigh3fymdwki7pn21sk2ym3kk4nn4qv4zzkhz59vp";
+    };
+    meta = {
+      homepage = https://github.com/graylog-labs/graylog-plugin-metrics;
+      description = "An output plugin for integrating Graphite, Ganglia and StatsD with Graylog";
+    };
+  };
   mongodb-profiler = glPlugin rec {
     name = "graylog-mongodb-profiler-${version}";
     pluginName = "graylog-plugin-mongodb-profiler";
@@ -113,6 +152,19 @@ in {
       description = "Graylog NetFlow plugin";
     };
   };
+  pagerduty = glPlugin rec {
+    name = "graylog-pagerduty-${version}";
+    pluginName = "graylog-plugin-pagerduty";
+    version = "1.3.0";
+    src = fetchurl {
+      url = "https://github.com/graylog-labs/${pluginName}/releases/download/${version}/${pluginName}-${version}.jar";
+      sha256 = "1g63c6rm5pkz7f0d73wb2lmk4zm430jqnhihbyq112cm4i7ymglh";
+    };
+    meta = {
+      homepage = https://github.com/graylog-labs/graylog-plugin-pagerduty;
+      description = "An alarm callback plugin for integrating PagerDuty into Graylog";
+    };
+  };
   redis = glPlugin rec {
     name = "graylog-redis-${version}";
     pluginName = "graylog-plugin-redis";
@@ -126,16 +178,29 @@ in {
       description = "Redis plugin for Graylog";
     };
   };
+  slack = glPlugin rec {
+    name = "graylog-slack-${version}";
+    pluginName = "graylog-plugin-slack";
+    version = "2.4.0";
+    src = fetchurl {
+      url = "https://github.com/graylog-labs/${pluginName}/releases/download/${version}/${pluginName}-${version}.jar";
+      sha256 = "0v8ilfhs8bnx87pjxg1i3p2vxw61rwpg4k3zhga7slavx70y986p";
+    };
+    meta = {
+      homepage = https://github.com/graylog-labs/graylog-plugin-slack;
+      description = "Can notify Slack or Mattermost channels about triggered alerts in Graylog (Alarm Callback)";
+    };
+  };
   spaceweather = glPlugin rec {
     name = "graylog-spaceweather-${version}";
     pluginName = "graylog-plugin-spaceweather";
     version = "1.0";
     src = fetchurl {
-      url = "https://github.com/Graylog2/${pluginName}/releases/download/${version}/spaceweather-input.jar";
+      url = "https://github.com/graylog-labs/${pluginName}/releases/download/${version}/spaceweather-input.jar";
       sha256 = "1mwqy3fhyy4zdwyrzvbr565xwf96xs9d3l70l0khmrm848xf8wz4";
     };
     meta = {
-      homepage = https://github.com/Graylog2/graylog-plugin-spaceweather;
+      homepage = https://github.com/graylog-labs/graylog-plugin-spaceweather;
       description = "Correlate proton density to the response time of your app and the ion temperature to your exception rate.";
     };
   };
@@ -152,16 +217,29 @@ in {
       description = "Graylog Processing Pipeline functions to enrich log messages with IoC information from threat intelligence databases";
     };
   };
+  twiliosms = glPlugin rec {
+    name = "graylog-twiliosms-${version}";
+    pluginName = "graylog-plugin-twiliosms";
+    version = "1.0.0";
+    src = fetchurl {
+      url = "https://github.com/graylog-labs/${pluginName}/releases/download/${version}/${pluginName}-${version}.jar";
+      sha256 = "0kwfv1zfj0fmxh9i6413bcsaxrn1vdwrzb6dphvg3dx27wxn1j1a";
+    };
+    meta = {
+      homepage = https://github.com/graylog-labs/graylog-plugin-twiliosms;
+      description = "An alarm callback plugin for integrating the Twilio SMS API into Graylog";
+    };
+  };
   twitter = glPlugin rec {
     name = "graylog-twitter-${version}";
     pluginName = "graylog-plugin-twitter";
     version = "2.0.0";
     src = fetchurl {
-      url = "https://github.com/Graylog2/${pluginName}/releases/download/${version}/${pluginName}-${version}.jar";
+      url = "https://github.com/graylog-labs/${pluginName}/releases/download/${version}/${pluginName}-${version}.jar";
       sha256 = "1pi34swy9nzq35a823zzvqrjhb6wsg302z31vk2y656sw6ljjxyh";
     };
     meta = {
-      homepage = https://github.com/Graylog2/graylog-plugin-twitter;
+      homepage = https://github.com/graylog-labs/graylog-plugin-twitter;
       description = "Graylog input plugin that reads Twitter messages based on keywords in realtime";
     };
   };
diff --git a/pkgs/tools/misc/gringo/default.nix b/pkgs/tools/misc/gringo/default.nix
index 00879d9505b8..76c60023c063 100644
--- a/pkgs/tools/misc/gringo/default.nix
+++ b/pkgs/tools/misc/gringo/default.nix
@@ -1,5 +1,6 @@
 { stdenv, fetchurl,
-  bison, re2c, scons
+  bison, re2c, scons,
+  libcxx
 }:
 
 let
@@ -21,6 +22,23 @@ stdenv.mkDerivation rec {
     ./gringo-4.5.4-to_string.patch
   ];
 
+  patchPhase = stdenv.lib.optionalString stdenv.isDarwin ''
+    substituteInPlace ./SConstruct \
+      --replace \
+        "env['CXX']            = 'g++'" \
+        "env['CXX']            = '$CXX'"
+
+    substituteInPlace ./SConstruct \
+      --replace \
+        "env['CPPPATH']        = []" \
+        "env['CPPPATH']        = ['${libcxx}/include/c++/v1']"
+
+    substituteInPlace ./SConstruct \
+      --replace \
+        "env['LIBPATH']        = []" \
+        "env['LIBPATH']        = ['${libcxx}/lib']"
+  '';
+
   buildPhase = ''
     scons WITH_PYTHON= --build-dir=release
   '';
@@ -33,7 +51,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     description = "Converts input programs with first-order variables to equivalent ground programs";
     homepage = http://potassco.sourceforge.net/;
-    platforms = platforms.linux;
+    platforms = platforms.all;
     maintainers = [ maintainers.hakuch ];
     license = licenses.gpl3Plus;
   };
diff --git a/pkgs/tools/misc/grub/default.nix b/pkgs/tools/misc/grub/default.nix
index a690ef2084b2..bb565bacfe79 100644
--- a/pkgs/tools/misc/grub/default.nix
+++ b/pkgs/tools/misc/grub/default.nix
@@ -34,7 +34,8 @@ stdenv.mkDerivation {
   ] ++ (stdenv.lib.optional buggyBiosCDSupport ./buggybios.patch);
 
   # autoreconfHook required for the splashimage patch.
-  buildInputs = [ autoreconfHook texinfo ];
+  nativeBuildInputs = [ autoreconfHook ];
+  buildInputs = [ texinfo ];
 
   hardeningDisable = [ "stackprotector" ];
 
diff --git a/pkgs/tools/misc/gsmartcontrol/default.nix b/pkgs/tools/misc/gsmartcontrol/default.nix
index f362e7c53a24..d4322f051d0a 100644
--- a/pkgs/tools/misc/gsmartcontrol/default.nix
+++ b/pkgs/tools/misc/gsmartcontrol/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "1ipykzqpfvlr84j38hr7q2cag4imrn1gql10slp8bfrs4h1si3vh";
   };
 
-  buildInputs = [ smartmontools gtkmm2 libglademm pkgconfig pcre ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ smartmontools gtkmm2 libglademm pcre ];
 
   #installTargets = "install datainstall";
 
diff --git a/pkgs/tools/misc/hdf5/default.nix b/pkgs/tools/misc/hdf5/default.nix
index ea71def36195..1b979bae0900 100644
--- a/pkgs/tools/misc/hdf5/default.nix
+++ b/pkgs/tools/misc/hdf5/default.nix
@@ -1,5 +1,7 @@
 { stdenv
 , fetchurl
+, gcc
+, removeReferencesTo
 , cpp ? false
 , gfortran ? null
 , zlib ? null
@@ -30,6 +32,8 @@ stdenv.mkDerivation rec {
     inherit mpi;
   };
 
+  nativeBuildInputs = [ removeReferencesTo ];
+
   buildInputs = []
     ++ optional (gfortran != null) gfortran
     ++ optional (szip != null) szip;
@@ -47,6 +51,10 @@ stdenv.mkDerivation rec {
 
   patches = [./bin-mv.patch];
 
+  postInstall = ''
+    find "$out" -type f -exec remove-references-to -t ${stdenv.cc} '{}' +
+  '';
+
   meta = {
     description = "Data model, library, and file format for storing and managing data";
     longDescription = ''
@@ -55,7 +63,9 @@ stdenv.mkDerivation rec {
       applications to evolve in their use of HDF5. The HDF5 Technology suite includes tools and 
       applications for managing, manipulating, viewing, and analyzing data in the HDF5 format.
     '';
+    license = stdenv.lib.licenses.free; # BSD-like
     homepage = https://www.hdfgroup.org/HDF5/;
     platforms = stdenv.lib.platforms.unix;
+    broken = (gfortran != null) && stdenv.isDarwin;
   };
 }
diff --git a/pkgs/tools/misc/hdfjava/default.nix b/pkgs/tools/misc/hdfjava/default.nix
new file mode 100644
index 000000000000..553e78c58a7f
--- /dev/null
+++ b/pkgs/tools/misc/hdfjava/default.nix
@@ -0,0 +1,27 @@
+{ stdenv, fetchurl, cmake, javac }:
+
+stdenv.mkDerivation rec {
+  name = "hdf-java-${version}";
+  version = "3.3.2";
+
+  src = fetchurl {
+    url = "http://www.hdfgroup.org/ftp/HDF5/releases/HDF-JAVA/hdfjni-${version}/src/CMake-hdfjava-${version}.tar.gz";
+    sha256 = "0m1gp2aspcblqzmpqbdpfp6giskws85ds6p5gz8sx7asyp7wznpr";
+  };
+
+  nativeBuildInputs = [ cmake javac ];
+
+  configurePhase = "true";
+  buildPhase = "./build-hdfjava-unix.sh";
+  installPhase = ''
+    mkdir -p $out
+    cp -r build/_CPack_Packages/Linux/TGZ/HDFJava-3.3.2-Linux/HDF_Group/HDFJava/${version}/* $out/
+  '';
+
+  meta = {
+    description = "A Java package that implements HDF4 and HDF5 data objects in an object-oriented form";
+    license = stdenv.lib.licenses.free; # BSD-like
+    homepage = https://support.hdfgroup.org/products/java/index.html;
+    platforms = stdenv.lib.platforms.linux;
+  };
+}
diff --git a/pkgs/tools/misc/hdfview/default.nix b/pkgs/tools/misc/hdfview/default.nix
new file mode 100644
index 000000000000..405e19e75bf9
--- /dev/null
+++ b/pkgs/tools/misc/hdfview/default.nix
@@ -0,0 +1,39 @@
+{ stdenv, fetchurl, cmake, ant, javac, hdf_java }:
+
+stdenv.mkDerivation rec {
+  name = "hdfview-${version}";
+  version = "2.14";
+
+  src = fetchurl {
+    url = "http://support.hdfgroup.org/ftp/HDF5/hdf-java/current/src/${name}.tar.gz";
+    sha256 = "0lv9djfm7hnp14mcyzbiax3xjb8vkbzhh7bdl6cvgy53pc08784p";
+  };
+
+  nativeBuildInputs = [ ant javac ];
+
+  HDFLIBS = hdf_java;
+
+  buildPhase = ''
+    ant run
+    ant package
+  '';
+
+  installPhase = ''
+    mkdir $out
+    # exclude jre
+    cp -r build/HDF_Group/HDFView/*/{lib,share} $out/
+    mkdir $out/bin
+    cp -r build/HDF_Group/HDFView/*/hdfview.sh $out/bin/hdfview
+    chmod +x $out/bin/hdfview
+    substituteInPlace $out/bin/hdfview \
+      --replace "@JAVABIN@" "${javac}/bin/" \
+      --replace "@INSTALLDIR@" "$out"
+  '';
+
+  meta = {
+    description = "A visual tool for browsing and editing HDF4 and HDF5 files";
+    license = stdenv.lib.licenses.free; # BSD-like
+    homepage = https://support.hdfgroup.org/products/java/index.html;
+    platforms = stdenv.lib.platforms.linux;
+  };
+}
diff --git a/pkgs/tools/misc/heatseeker/default.nix b/pkgs/tools/misc/heatseeker/default.nix
index 499b4a87bc43..e7ddcf572aed 100644
--- a/pkgs/tools/misc/heatseeker/default.nix
+++ b/pkgs/tools/misc/heatseeker/default.nix
@@ -13,7 +13,7 @@ buildRustPackage rec {
     sha256 = "1fcrbjwnhcz71i70ppy0rcgk5crwwmbkm9nrk1kapvks33pv0az7";
   };
 
-  depsSha256 = "05mj84a5k65ai492grwg03c3wq6ardhs114bv951fgysc9rs07p5";
+  cargoSha256 = "0kqkzjd90v19qvl3iv1vv2fi8h0z75b0yn0z5jq8w4m94fvh0p95";
 
   # some tests require a tty, this variable turns them off for Travis CI,
   # which we can also make use of
diff --git a/pkgs/tools/misc/ipxe/default.nix b/pkgs/tools/misc/ipxe/default.nix
index 6cd451264ab4..2d36ad17eec7 100644
--- a/pkgs/tools/misc/ipxe/default.nix
+++ b/pkgs/tools/misc/ipxe/default.nix
@@ -1,8 +1,8 @@
 { stdenv, fetchgit, perl, cdrkit, syslinux, xz, openssl }:
 
 let
-  date = "20160831";
-  rev = "827dd1bfee67daa683935ce65316f7e0f057fe1c";
+  date = "20170922";
+  rev = "74d90b33f8490adcee2026ece18d8411d93b6a39";
 in
 
 stdenv.mkDerivation {
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
 
   src = fetchgit {
     url = git://git.ipxe.org/ipxe.git;
-    sha256 = "11w8b0vln3skfn8r1cvzngslz12njdkwmnacyq3qffb96k2dn2ww";
+    sha256 = "12ijrq451fj2x3i7c7xjlxig5mwbhmgzqjvmfl2sza953vfbk4vw";
     inherit rev;
   };
 
@@ -40,6 +40,10 @@ stdenv.mkDerivation {
   installPhase = ''
     mkdir -p $out
     cp bin/ipxe.dsk bin/ipxe.usb bin/ipxe.iso bin/ipxe.lkrn bin/undionly.kpxe $out
+
+    # Some PXE constellations especially with dnsmasq are looking for the file with .0 ending
+    # let's provide it as a symlink to be compatible in this case.
+    ln -s undionly.kpxe $out/undionly.kpxe.0
   '';
 
   meta = with stdenv.lib;
diff --git a/pkgs/tools/misc/kalibrate-rtl/default.nix b/pkgs/tools/misc/kalibrate-rtl/default.nix
index 19870b8de5b8..19ebd05e23c1 100644
--- a/pkgs/tools/misc/kalibrate-rtl/default.nix
+++ b/pkgs/tools/misc/kalibrate-rtl/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "1spbfflkqnw9s8317ppsf7b1nnkicqsmaqsnz1zf8i49ix70i6kn";
   };
 
-  buildInputs = [ autoreconfHook pkgconfig fftw rtl-sdr libusb1 ];
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  buildInputs = [ fftw rtl-sdr libusb1 ];
 
   meta = with stdenv.lib; {
     description = "Calculate local oscillator frequency offset in RTL-SDR devices";
diff --git a/pkgs/tools/misc/kargo/default.nix b/pkgs/tools/misc/kargo/default.nix
index 4c390f1e80e2..cb2109e195ea 100644
--- a/pkgs/tools/misc/kargo/default.nix
+++ b/pkgs/tools/misc/kargo/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, python2Packages }:
+{ stdenv, fetchurl, python2Packages, ansible2 }:
 
 python2Packages.buildPythonApplication rec {
   version = "0.4.6";
diff --git a/pkgs/tools/misc/kdecoration-viewer/default.nix b/pkgs/tools/misc/kdecoration-viewer/default.nix
index 33ccf28cb0da..62783bb30dff 100644
--- a/pkgs/tools/misc/kdecoration-viewer/default.nix
+++ b/pkgs/tools/misc/kdecoration-viewer/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "1cc4xxv72a82p1w9r76090xba7g069r41bi4zx32k4gz3vyl1am6";
   };
 
-  buildInputs = [ cmake extra-cmake-modules qtquickcontrols kconfigwidgets kdeclarative kdecoration ];
+  nativeBuildInputs = [ cmake extra-cmake-modules ];
+  buildInputs = [ qtquickcontrols kconfigwidgets kdeclarative kdecoration ];
 
   meta = with stdenv.lib; {
     description = "Allows to preview a KDecoration plugin";
diff --git a/pkgs/tools/misc/kisslicer/default.nix b/pkgs/tools/misc/kisslicer/default.nix
new file mode 100644
index 000000000000..588511638bea
--- /dev/null
+++ b/pkgs/tools/misc/kisslicer/default.nix
@@ -0,0 +1,58 @@
+{ fetchzip
+, libX11
+, mesa
+, makeWrapper
+, stdenv
+}:
+
+let
+
+  libPath = stdenv.lib.makeLibraryPath [
+    mesa
+    stdenv.cc.cc
+    libX11
+  ];
+
+  inidir = "\\\${XDG_CONFIG_HOME:-\\$HOME/.config}/kisslicer";
+
+in
+
+stdenv.mkDerivation rec {
+  name = "kisslicer-1.6.2";
+
+  src = fetchzip {
+    url = "http://www.kisslicer.com/uploads/1/5/3/8/15381852/kisslicer_linux64_1.6.2_release.zip";
+    sha256 = "0fb7hzic78skq3ykc37srnjsw0yri7m0pb3arlz076ws7jrcbr0f";
+    stripRoot = false;
+  };
+
+  phases = [ "unpackPhase" "installPhase" "fixupPhase" ];
+
+  buildInputs = [
+    makeWrapper
+    mesa
+    libX11
+  ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp -p * $out/bin
+  '';
+
+  fixupPhase = ''
+    chmod 755 $out/bin/KISSlicer
+    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      --set-rpath ${libPath}   $out/bin/KISSlicer
+    wrapProgram $out/bin/KISSlicer \
+      --add-flags "-inidir ${inidir}" \
+      --run "mkdir -p ${inidir}"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Convert STL files into Gcode";
+    homepage = http://www.kisslicer.com;
+    license = licenses.unfree;
+    maintainers = [ maintainers.cransom ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/tools/misc/kt/default.nix b/pkgs/tools/misc/kt/default.nix
index 738eceb20a0e..eb0f78e787ab 100644
--- a/pkgs/tools/misc/kt/default.nix
+++ b/pkgs/tools/misc/kt/default.nix
@@ -2,13 +2,13 @@
 
 buildGoPackage rec {
   name = "kt-${version}";
-  version = "11.1.0";
+  version = "12.1.0";
 
   src = fetchFromGitHub {
     owner = "fgeller";
     repo = "kt";
     rev = "v${version}";
-    sha256 = "1ymygd3l5pfbnjmdjcrspj520v29hnv3bdgxpim38dpv3qj518vq";
+    sha256 = "014q39bg88vg1xdq1bz6wj982zb148sip3a42hbrinh8qj41y4yg";
   };
 
   goPackagePath = "github.com/fgeller/kt";
diff --git a/pkgs/tools/misc/lbdb/add-methods-to-rc.patch b/pkgs/tools/misc/lbdb/add-methods-to-rc.patch
new file mode 100644
index 000000000000..d388467559a4
--- /dev/null
+++ b/pkgs/tools/misc/lbdb/add-methods-to-rc.patch
@@ -0,0 +1,11 @@
+--- a/lbdb.rc.in
++++ b/lbdb.rc.in
+@@ -40,7 +40,7 @@
+ # - m_vcf        search a vcard (according to RFC2426) file.
+ # - m_khard      search a CardDAV address book via khard
+ 
+-METHODS="m_inmail m_passwd m_finger"
++METHODS="@MODULES@"
+ 
+ 
+ #
diff --git a/pkgs/tools/misc/lbdb/default.nix b/pkgs/tools/misc/lbdb/default.nix
index e81ad349874b..35cc95cb2cf7 100644
--- a/pkgs/tools/misc/lbdb/default.nix
+++ b/pkgs/tools/misc/lbdb/default.nix
@@ -1,17 +1,39 @@
-{ stdenv, fetchurl, perl, finger_bsd }:
+{ stdenv, fetchurl, perl, perlPackages, finger_bsd, makeWrapper
+, abook ? null
+, gnupg ? null
+, goobook ? null
+, khard ? null
+}:
 
 let
-  version = "0.38";
+  version = "0.44";
 in
-
+with stdenv.lib;
+with perlPackages;
 stdenv.mkDerivation {
   name = "lbdb-${version}";
   src = fetchurl {
     url = "http://www.spinnaker.de/debian/lbdb_${version}.tar.gz";
-    sha256 = "1279ssfrh4cqrjzq5q47xbdlw5qx3aazxjshi86ljm4cw6xxvgar";
+    sha256 = "0kjz3n2ilrg6yrz8z40714ppdprgwhbgvzcsjzs822l6da4qxna3";
   };
 
-  buildInputs = [ perl ] ++ stdenv.lib.optional (!stdenv.isDarwin) finger_bsd;
+  buildInputs = [ goobook makeWrapper perl ConvertASN1 NetLDAP AuthenSASL ]
+    ++ optional (!stdenv.isDarwin) finger_bsd
+    ++ optional   (abook != null) abook
+    ++ optional   (gnupg != null) gnupg
+    ++ optional (goobook != null) goobook
+    ++ optional   (khard != null) khard;
+  configureFlags = [ ]
+    ++ optional   (abook != null) "--with-abook"
+    ++ optional   (gnupg != null) "--with-gpg"
+    ++ optional (goobook != null) "--with-goobook"
+    ++ optional   (khard != null) "--with-khard";
+
+  patches = [ ./add-methods-to-rc.patch ];
+  postFixup = "wrapProgram $out/lib/mutt_ldap_query --prefix PERL5LIB : "
+    + "${AuthenSASL}/${perl.libPrefix}"
+    + ":${ConvertASN1}/${perl.libPrefix}"
+    + ":${NetLDAP}/${perl.libPrefix}";
 
   meta = {
     homepage = http://www.spinnaker.de/lbdb/;
diff --git a/pkgs/tools/misc/ldapvi/default.nix b/pkgs/tools/misc/ldapvi/default.nix
index d96409809a6e..72c9cecf5406 100644
--- a/pkgs/tools/misc/ldapvi/default.nix
+++ b/pkgs/tools/misc/ldapvi/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
     sha256 = "3ef3103030ecb04d7fe80180e3fd490377cf81fb2af96782323fddabc3225030";
   };
 
-  buildInputs = [ openldap openssl popt glib ncurses readline pkgconfig cyrus_sasl autoconf automake ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ openldap openssl popt glib ncurses readline cyrus_sasl autoconf automake ];
 
   preConfigure = ''
     cd ldapvi
diff --git a/pkgs/tools/misc/less/default.nix b/pkgs/tools/misc/less/default.nix
index b3370a3cab1f..49796c5f2292 100644
--- a/pkgs/tools/misc/less/default.nix
+++ b/pkgs/tools/misc/less/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, ncurses, lessSecure ? false }:
 
 stdenv.mkDerivation rec {
-  name = "less-487";
+  name = "less-520";
 
   src = fetchurl {
     url = "http://www.greenwoodsoftware.com/less/${name}.tar.gz";
-    sha256 = "01i7n6jaxwmww3pasy3hg38zc6x7jw0w05mqqvh6caqbrdaq9p7k";
+    sha256 = "12wh0j07971j53v7irfcv0vkb7wpi7f83jll4mwjy92wc27fm2bv";
   };
 
   configureFlags = [ "--sysconfdir=/etc" ] # Look for ‘sysless’ in /etc.
diff --git a/pkgs/tools/misc/lf/default.nix b/pkgs/tools/misc/lf/default.nix
index 503f24946443..f8b687a5c8ba 100644
--- a/pkgs/tools/misc/lf/default.nix
+++ b/pkgs/tools/misc/lf/default.nix
@@ -2,13 +2,13 @@
 
 buildGoPackage rec {
   name = "lf-unstable-${version}";
-  version = "2017-05-15";
+  version = "2017-10-30";
 
   src = fetchFromGitHub {
     owner = "gokcehan";
     repo = "lf";
-    rev = "9962b378a816c2f792dcbfe9e3f58ae16d5969dd"; # nightly
-    sha256 = "1ln14ma2iajlp9klj4bhrq0y9955rpw9aggvj7hcj1m5yqa0sdqn";
+    rev = "3f7bd0a62d1a243562e182d9051ebb54f3414aaa"; # nightly
+    sha256 = "0g6wf4j3dfy3yfkby3wlqajryv4kffqvhljq2q0x482fsrl4vipz";
   };
 
   goPackagePath = "github.com/gokcehan/lf";
diff --git a/pkgs/tools/misc/lf/deps.nix b/pkgs/tools/misc/lf/deps.nix
index bb136e98d66d..91a0c368d5f9 100644
--- a/pkgs/tools/misc/lf/deps.nix
+++ b/pkgs/tools/misc/lf/deps.nix
@@ -4,8 +4,8 @@
     fetch = {
       type = "git";
       url = "https://github.com/nsf/termbox-go";
-      rev = "7994c181db7761ca3c67a217068cf31826113f5f"; # master
-      sha256 = "0ssc54wamn3h8z68kv4fdgvk3kjii95psi2kk0slsilmg5v6jzhj";
+      rev = "10cefba34bc5e7a6e5df0836a42513c28a10e074"; # master
+      sha256 = "05jy6dpva2a1xfsv3yajavbx41gx8hhh5k3k901dnk0118hnyd0w";
     };
   }
   {
diff --git a/pkgs/tools/misc/libbitcoin/libbitcoin-client.nix b/pkgs/tools/misc/libbitcoin/libbitcoin-client.nix
index 1f45626855f5..989c1f57b6ef 100644
--- a/pkgs/tools/misc/libbitcoin/libbitcoin-client.nix
+++ b/pkgs/tools/misc/libbitcoin/libbitcoin-client.nix
@@ -13,7 +13,8 @@ in stdenv.mkDerivation {
     sha256 = "1g79hl6jmf5dam7vq19h4dgdj7gcn19fa7q78vn573mg2rdyal53";
   };
 
-  buildInputs = [ autoreconfHook pkgconfig ];
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  buildInputs = [ ];
 
   propagatedBuildInputs = [ libsodium czmqpp libbitcoin ];
 
diff --git a/pkgs/tools/misc/libbitcoin/libbitcoin-explorer.nix b/pkgs/tools/misc/libbitcoin/libbitcoin-explorer.nix
index fbfa385fc7fc..7b6da9bdd3ed 100644
--- a/pkgs/tools/misc/libbitcoin/libbitcoin-explorer.nix
+++ b/pkgs/tools/misc/libbitcoin/libbitcoin-explorer.nix
@@ -13,7 +13,8 @@ in stdenv.mkDerivation {
     sha256 = "00123vw7rxk0ypdfzk0xwk8q55ll31000mkjqdzl915krsbkbfvp";
   };
 
-  buildInputs = [ autoreconfHook pkgconfig ];
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  buildInputs = [ ];
 
   propagatedBuildInputs = [ libbitcoin-client ];
 
diff --git a/pkgs/tools/misc/libbitcoin/libbitcoin.nix b/pkgs/tools/misc/libbitcoin/libbitcoin.nix
index 61c462f7853f..6d0c7b4e9c95 100644
--- a/pkgs/tools/misc/libbitcoin/libbitcoin.nix
+++ b/pkgs/tools/misc/libbitcoin/libbitcoin.nix
@@ -13,7 +13,8 @@ in stdenv.mkDerivation {
     sha256 = "1lpdjm13kgs4fbp579bwfvws8yf9mnr5dw3ph8zxg2gf110h85sy";
   };
 
-  buildInputs = [ autoreconfHook pkgconfig ];
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  buildInputs = [ ];
 
   propagatedBuildInputs = [ secp256k1 ];
 
diff --git a/pkgs/tools/misc/lnav/default.nix b/pkgs/tools/misc/lnav/default.nix
index 136951cb7bc5..5ab05c92135a 100644
--- a/pkgs/tools/misc/lnav/default.nix
+++ b/pkgs/tools/misc/lnav/default.nix
@@ -45,6 +45,7 @@ stdenv.mkDerivation rec {
     license = licenses.bsd2;
     version = "0.8.2";
     maintainers = [ maintainers.dochang ];
+    platforms = platforms.unix;
   };
 
 }
diff --git a/pkgs/tools/misc/logstash/5.x.nix b/pkgs/tools/misc/logstash/5.x.nix
index 2628c777140d..4ecc0be783eb 100644
--- a/pkgs/tools/misc/logstash/5.x.nix
+++ b/pkgs/tools/misc/logstash/5.x.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://artifacts.elastic.co/downloads/logstash/${name}.tar.gz";
-    sha256 = "1z3rwpwafrn6h0rzdsmripnwj8ad33v92ryxq8xf9y7331rqb2gs";
+    sha256 = "11qg8i0svsccr1wd0yj0ivfzpza2hd68221g38v88shvj0bb737f";
   };
 
   dontBuild         = true;
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
 
   installPhase = ''
     mkdir -p $out
-    cp -r {Gemfile*,vendor,lib,bin,config,data,logstash-core,logstash-core-plugin-api} $out
+    cp -r {Gemfile*,modules,vendor,lib,bin,config,data,logstash-core,logstash-core-plugin-api} $out
 
     wrapProgram $out/bin/logstash \
        --set JAVA_HOME "${jre}"
diff --git a/pkgs/tools/misc/mbuffer/default.nix b/pkgs/tools/misc/mbuffer/default.nix
index 51c0ebc82aeb..4c4204badb19 100644
--- a/pkgs/tools/misc/mbuffer/default.nix
+++ b/pkgs/tools/misc/mbuffer/default.nix
@@ -3,19 +3,19 @@
  } :
 
 stdenv.mkDerivation rec {
-  version = "20160613";
+  version = "20170806";
   name = "mbuffer-${version}";
 
   src = fetchurl {
     url = "http://www.maier-komor.de/software/mbuffer/mbuffer-${version}.tgz";
-    sha256 = "1za9yqfn23axnp4zymdsrjkqcci3wxywqw3bv4dxms57q1ljiab7";
+    sha256 = "0kbvxrd1k0509whgyl7w20cmqn5q16vjjh7d9glpl2j4lfd66ljw";
   };
 
   buildInputs = [ openssl ];
 
   meta = {
     homepage = http://www.maier-komor.de/mbuffer.html;
-    description  = "mbuffer is a tool for buffering data streams with a large set of unique features";
+    description  = "A tool for buffering data streams with a large set of unique features";
     license = stdenv.lib.licenses.gpl3;
     maintainers = with stdenv.lib.maintainers; [ tokudan ];
     platforms = with stdenv.lib.platforms; allBut darwin;
diff --git a/pkgs/tools/misc/mc/default.nix b/pkgs/tools/misc/mc/default.nix
index 0828fea81e1c..fb4093d89b86 100644
--- a/pkgs/tools/misc/mc/default.nix
+++ b/pkgs/tools/misc/mc/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
     sha256 = "1pzjq4nfxl2aakxipdjs5hq9n14374ly1l00s40kd2djnnxmd7pb";
   };
 
-  buildInputs = [ pkgconfig perl glib slang zip unzip file gettext libX11 libICE
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ perl glib slang zip unzip file gettext libX11 libICE
     libssh2 openssl ] ++ stdenv.lib.optionals (!stdenv.isDarwin) [ e2fsprogs gpm ];
 
   configureFlags = [ "--enable-vfs-smb" ];
diff --git a/pkgs/tools/misc/mdbtools/default.nix b/pkgs/tools/misc/mdbtools/default.nix
index 165780a5fa19..acb3bd9d3773 100644
--- a/pkgs/tools/misc/mdbtools/default.nix
+++ b/pkgs/tools/misc/mdbtools/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation {
     sha256 = "1lz33lmqifjszad7rl1r7rpxbziprrm5rkb27wmswyl5v98dqsbi";
   };
 
-  buildInputs = [glib readline bison flex pkgconfig];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [glib readline bison flex];
 
   preConfigure = ''
     sed -e 's@static \(GHashTable [*]mdb_backends;\)@\1@' -i src/libmdb/backend.c
diff --git a/pkgs/tools/misc/mdbtools/git.nix b/pkgs/tools/misc/mdbtools/git.nix
index 4f76306ab5f9..6289c35f35a7 100644
--- a/pkgs/tools/misc/mdbtools/git.nix
+++ b/pkgs/tools/misc/mdbtools/git.nix
@@ -10,8 +10,9 @@ stdenv.mkDerivation {
     sha256 = "0hlf5lk86xm0bpdlpk4a1zyfvbim76dhvmybxga2p7mbb1jc825l";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    glib readline bison flex autoreconfHook pkgconfig which txt2man
+    glib readline bison flex autoreconfHook which txt2man
     gnome_doc_utils scrollkeeper libiconv
   ];
 
diff --git a/pkgs/tools/misc/memtest86+/compile-fix.patch b/pkgs/tools/misc/memtest86+/compile-fix.patch
deleted file mode 100644
index f178259f9e03..000000000000
--- a/pkgs/tools/misc/memtest86+/compile-fix.patch
+++ /dev/null
@@ -1,20 +0,0 @@
---- memtest86+-5.01/io.h~	2013-08-10 02:01:58.000000000 +0000
-+++ memtest86+-5.01/io.h	2014-01-08 01:29:12.404465515 +0000
-@@ -31,7 +31,7 @@
-  */
- 
- #define __OUT1(s,x) \
--extern inline void __out##s(unsigned x value, unsigned short port) {
-+static inline void __out##s(unsigned x value, unsigned short port) {
- 
- #define __OUT2(s,s1,s2) \
- __asm__ __volatile__ ("out" #s " %" s1 "0,%" s2 "1"
-@@ -43,7 +43,7 @@
- __OUT1(s##c_p,x) __OUT2(s,s1,"") : : "a" (value), "id" (port)); SLOW_DOWN_IO; }
- 
- #define __IN1(s) \
--extern inline RETURN_TYPE __in##s(unsigned short port) { RETURN_TYPE _v;
-+static inline RETURN_TYPE __in##s(unsigned short port) { RETURN_TYPE _v;
- 
- #define __IN2(s,s1,s2) \
- __asm__ __volatile__ ("in" #s " %" s2 "1,%" s1 "0"
diff --git a/pkgs/tools/misc/memtest86+/crash-fix.patch b/pkgs/tools/misc/memtest86+/crash-fix.patch
deleted file mode 100644
index de7c86bac353..000000000000
--- a/pkgs/tools/misc/memtest86+/crash-fix.patch
+++ /dev/null
@@ -1,99 +0,0 @@
-diff --git a/controller.c b/controller.c
-index f4f7371..183e9c3 100644
---- a/controller.c
-+++ b/controller.c
-@@ -2,6 +2,8 @@
-  * MemTest86+ V5 Specific code (GPL V2.0)
-  * By Samuel DEMEULEMEESTER, sdemeule@memtest.org
-  * http://www.canardpc.com - http://www.memtest.org
-+ *
-+ * Edited by David McInnis Oct 4, 2014
-  */
- 
- //#include "defs.h"
-@@ -292,7 +294,7 @@ static void setup_nhm(void)
- 
- 	/* First, locate the PCI bus where the MCH is located */
- 
--	for(i = 0; i < sizeof(possible_nhm_bus); i++) {
-+	for(i = 0; i < sizeof(possible_nhm_bus) / sizeof(possible_nhm_bus[0]); i++) {
- 		pci_conf_read( possible_nhm_bus[i], 3, 4, 0x00, 2, &vid);
- 		pci_conf_read( possible_nhm_bus[i], 3, 4, 0x02, 2, &did);
- 		vid &= 0xFFFF;
-@@ -327,7 +329,7 @@ static void setup_nhm32(void)
- 	ctrl.mode = ECC_NONE;
- 
- 	/* First, locate the PCI bus where the MCH is located */
--	for(i = 0; i < sizeof(possible_nhm_bus); i++) {
-+	for(i = 0; i < sizeof(possible_nhm_bus) / sizeof(possible_nhm_bus[0]); i++) {
- 		pci_conf_read( possible_nhm_bus[i], 3, 4, 0x00, 2, &vid);
- 		pci_conf_read( possible_nhm_bus[i], 3, 4, 0x02, 2, &did);
- 		vid &= 0xFFFF;
-@@ -1424,7 +1426,7 @@ static void poll_fsb_amd64(void) {
- 	unsigned long dramchr;
- 	float clockratio;
- 	double dramclock;
--	unsigned int dummy[3];
-+	unsigned int dummy[4];
- 	int ram_type;
- 
- 	float coef = 10;
-@@ -2851,13 +2853,13 @@ static void poll_timings_nf4ie(void) {
- 
- static void poll_timings_i875(void) {
- 
--	ulong dev6, dev62;
-+	ulong dev6;
- 	ulong temp;
- 	float cas;
- 	int rcd, rp, ras, chan;
- 	long *ptr, *ptr2;
- 
--	pci_conf_read( 0, 6, 0, 0x40, 4, &dev62);
-+	pci_conf_read( 0, 6, 0, 0x40, 4, &dev6);
- 	ptr2=(long*)(dev6+0x68);
- 
- 	/* Read the MMR Base Address & Define the pointer */
-diff --git a/init.c b/init.c
-index 754b8d7..5bd8b4f 100644
---- a/init.c
-+++ b/init.c
-@@ -7,6 +7,8 @@
-  *
-  * Released under version 2 of the Gnu Public License.
-  * By Chris Brady
-+ *
-+ * Edited by David McInnis October 4, 2014
-  */
-  
- 
-@@ -914,7 +916,6 @@ void cpu_type(void)
- 			default:
- 				cprint(0, COL_MID, "Unknown Intel");
-  				break;
--			break;
- 		    }
- 
- 		}
-diff --git a/main.c b/main.c
-index 0bc7ca0..613f811 100644
---- a/main.c
-+++ b/main.c
-@@ -422,7 +422,7 @@ void test_start(void)
- 		//initialise_cpus();
- 		btrace(my_cpu_num, __LINE__, "BeforeInit", 1, 0, 0);
- 		/* Draw the screen and get system information */
--	  init();
-+		init();
- 
- 		/* Set defaults and initialize variables */
- 		set_defaults();
-@@ -737,7 +737,7 @@ void test_start(void)
- 			    /* Do the same test for each CPU */
- 			    if (++cpu_sel >= act_cpus) 
- 			    	{
--	            cpu_sel = 0;
-+				cpu_sel = 0;
- 			        next_test();
- 			    	} else {
- 			        continue;
diff --git a/pkgs/tools/misc/memtest86+/default.nix b/pkgs/tools/misc/memtest86+/default.nix
index 5b4044f1891c..0a02f8fb4f73 100644
--- a/pkgs/tools/misc/memtest86+/default.nix
+++ b/pkgs/tools/misc/memtest86+/default.nix
@@ -8,8 +8,28 @@ stdenv.mkDerivation rec {
     sha256 = "0fch1l55753y6jkk0hj8f6vw4h1kinkn9ysp22dq5g9zjnvjf88l";
   };
 
-  # Patch incompatiblity with GCC. Source: http://koji.fedoraproject.org/koji/buildinfo?buildID=586907
-  patches = [ ./compile-fix.patch ./crash-fix.patch ./no-optimization.patch ];
+  patches = [
+    (fetchurl {
+      url = "https://sources.debian.net/data/main/m/memtest86+/5.01-3/debian/patches/doc-serialconsole";
+      sha256 = "1qh2byj9bmpchym8iq20n4hqmy10nrl6bi0d9pgdqikkmw9m38jq";
+    })
+    (fetchurl {
+      url = "https://sources.debian.net/data/main/m/memtest86+/5.01-3/debian/patches/multiboot";
+      sha256 = "0nq61307ah5b41ff5nqs99wjzjzlajvfv6k9c9d0gqvhx8r4dvmy";
+    })
+    (fetchurl {
+      url = "https://sources.debian.net/data/main/m/memtest86+/5.01-3/debian/patches/memtest86+-5.01-O0.patch";
+      sha256 = "1xmj3anq1fr0cxwv8lqfp5cr5f58v7glwc6z0v8hx8aib8yj1wl2";
+    })
+    (fetchurl {
+      url = "https://sources.debian.net/data/main/m/memtest86+/5.01-3/debian/patches/memtest86+-5.01-array-size.patch";
+      sha256 = "0yxlzpfs6313s91y984p7rlf5rgybcjhg7i9zqy4wqhm3j90f1kb";
+    })
+    (fetchurl {
+      url = "https://sources.debian.net/data/main/m/memtest86+/5.01-3/debian/patches/gcc-5";
+      sha256 = "13xfy6sn8qbj1hx4vms2cz24dsa3bl8n2iblz185hkn11y7141sc";
+    })
+  ];
 
   preBuild = ''
     # Really dirty hack to get Memtest to build without needing a Glibc
diff --git a/pkgs/tools/misc/memtest86+/no-optimization.patch b/pkgs/tools/misc/memtest86+/no-optimization.patch
deleted file mode 100644
index 76815a931704..000000000000
--- a/pkgs/tools/misc/memtest86+/no-optimization.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- memtest86+-5.01/Makefile~	2014-01-08 01:30:11.355900076 +0000
-+++ memtest86+-5.01/Makefile	2014-01-08 01:31:19.387555469 +0000
-@@ -12,7 +12,7 @@
- AS=as -32
- CC=gcc
- 
--CFLAGS= -Wall -march=i486 -m32 -O1 -fomit-frame-pointer -fno-builtin \
-+CFLAGS= -Wall -march=i486 -m32 -O0 -fomit-frame-pointer -fno-builtin \
- 	-ffreestanding -fPIC $(SMP_FL) -fno-stack-protector 
- 	
- OBJS= head.o reloc.o main.o test.o init.o lib.o patn.o screen_buffer.o \
diff --git a/pkgs/tools/misc/mht2htm/default.nix b/pkgs/tools/misc/mht2htm/default.nix
new file mode 100644
index 000000000000..930fd1e5d3ec
--- /dev/null
+++ b/pkgs/tools/misc/mht2htm/default.nix
@@ -0,0 +1,43 @@
+{ stdenv, fetchurl, unzip, fpc, lazarus }:
+
+let
+  date = "07.apr.2016";
+
+in stdenv.mkDerivation rec {
+  name = "mht2mht-${version}";
+  version = "1.8.1.35";
+
+  src = fetchurl {
+    # there is a disconnect between the directory name date and file name date
+    # you should verify if that is still then case when the next version is released
+    url    = "mirror://sourceforge/mht2htm/mht2htm/1.8.1%20%2805.apr.2016%29/mht2htmcl-${version}_${date}.source.zip";
+    sha256 = "16r6zkihp84yqllp2hyaf0nvymdn9ji3g30mc5scfwycdfanja6f";
+  };
+
+  sourceRoot = ".";
+
+  buildInputs = [ fpc lazarus ];
+
+  nativeBuildInputs = [ unzip ];
+
+  buildPhase = ''
+    runHook preBuild
+    lazbuild --lazarusdir=${lazarus}/share/lazarus mht2htmcl.lpi
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm755 -t $out/bin               mht2htmcl
+    install -Dm644 -t $out/share/doc/mht2htm CHANGELOG COPYING README
+    runHook postInstall
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Convert .mht files to .html";
+    homepage    = http://pgm.bpalanka.com/mht2htm.html;
+    license     = licenses.gpl3;
+    maintainers = with maintainers; [ peterhoeg ];
+    platforms   = platforms.all;
+  };
+}
diff --git a/pkgs/tools/misc/minicom/default.nix b/pkgs/tools/misc/minicom/default.nix
index d731e856790d..5796f6335c0b 100644
--- a/pkgs/tools/misc/minicom/default.nix
+++ b/pkgs/tools/misc/minicom/default.nix
@@ -1,32 +1,46 @@
-{ stdenv, fetchurl, ncurses }:
+{ stdenv, fetchurl, autoreconfHook, pkgconfig
+, ncurses }:
 
 stdenv.mkDerivation rec {
-  name = "minicom-2.7";
+  name = "minicom-2.7.1";
 
   src = fetchurl {
-    url = "http://alioth.debian.org/frs/download.php/file/3977/${name}.tar.gz";
-    sha256 = "1x04m4k7c71j5cnhzpjrbz43dd96k4mpkd0l87v5skrgp1isdhws";
+    url    = "https://alioth.debian.org/frs/download.php/latestfile/3/${name}.tar.gz";
+    sha256 = "1wa1l36fa4npd21xa9nz60yrqwkk5cq713fa3p5v0zk7g9mq6bsk";
   };
 
-  buildInputs = [ncurses];
+  buildInputs = [ ncurses ];
 
-  configureFlags = [ "--sysconfdir=/etc" "--enable-lock-dir=/var/lock" ];
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
 
-  preConfigure =
-    # Have `configure' assume that the lock directory exists.
-    '' sed -i "configure" -e's/test -d \$UUCPLOCK/true/g'
-    '';
+  enableParallelBuilding = true;
 
-  meta = {
-    description = "Modem control and terminal emulation program";
-    homepage = http://alioth.debian.org/projects/minicom/;
+  configureFlags = [
+    "--sysconfdir=/etc"
+    "--enable-lock-dir=/var/lock"
+  ];
+
+  patches = [ ./xminicom_terminal_paths.patch ];
 
-    longDescription =
-      '' Minicom is a menu driven communications program.  It emulates ANSI
-         and VT102 terminals.  It has a dialing directory and auto zmodem
-         download.
-      '';
+  preConfigure = ''
+    # Have `configure' assume that the lock directory exists.
+    substituteInPlace configure \
+      --replace 'test -d $UUCPLOCK' true
+
+    substituteInPlace src/rwconf.c \
+      --replace /usr/bin/ascii-xfr $out/bin/ascii-xfr
+  '';
 
-    platforms = stdenv.lib.platforms.gnu;  # arbitrary choice
+  meta = with stdenv.lib; {
+    description = "Modem control and terminal emulation program";
+    homepage = https://alioth.debian.org/projects/minicom/;
+    license = licenses.gpl2;
+    longDescription = ''
+      Minicom is a menu driven communications program.  It emulates ANSI
+      and VT102 terminals.  It has a dialing directory and auto zmodem
+      download.
+    '';
+    maintainers = with maintainers; [ peterhoeg ];
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/tools/misc/minicom/xminicom_terminal_paths.patch b/pkgs/tools/misc/minicom/xminicom_terminal_paths.patch
new file mode 100644
index 000000000000..18535253d9f5
--- /dev/null
+++ b/pkgs/tools/misc/minicom/xminicom_terminal_paths.patch
@@ -0,0 +1,79 @@
+diff --git a/src/xminicom b/src/xminicom
+index a59aa08..cef153b 100755
+--- a/src/xminicom
++++ b/src/xminicom
+@@ -7,57 +7,39 @@
+ #
+ # version	$Id: xminicom,v 1.4 2008-06-09 20:48:35 al-guest Exp $
+
+-findcmd()
+-{
+-  IFS=:
+-  for i in $PATH
+-  do
+-	if [ -x $i\/$1 ]
+-	then
+-		result=$i\/$1
+-		IFS=
+-		return 0
+-	fi
+-  done
+-  result=
+-  IFS=
+-  return 1
++findcmd() {
++  result=$(command -v $1)
+ }
+
+-if findcmd x-terminal-emulator
+-then
++if findcmd x-terminal-emulator ; then
+   exec $result -T minicom -e "if ! minicom -m -c on $*; then echo Press ENTER to continue...; read; fi"
+   exit 1
+ fi
+
+-if findcmd color_xterm
+-then
++if findcmd konsole ; then
++  exec $result -T minicom -geometry 80x25 -e minicom -m -c on "$@"
++  exit 1
++fi
++
++if findcmd gnome-terminal ; then
++  exec $result -T minicom -geometry 80x25 -e "if ! minicom -m -c on $*; then echo Press ENTER to continue...; read; fi"
++  exit 1
++fi
++
++if findcmd color_xterm ; then
+   exec $result -T minicom -bg black -fg grey -n minicom -geometry 80x25 -e "if ! minicom -m -c on $*; then echo Press ENTER to continue...; read; fi"
+   exit 1
+ fi
+
+-if findcmd rxvt
+-then
++if findcmd rxvt ; then
+   exec $result -bg black -fg grey -n minicom -T minicom -sl 0 -geometry 80x25 -e "if ! minicom -m -c on $*; then echo Press ENTER to continue...; read; fi"
+   exit 1
+ fi
+
+-if findcmd kterm
+-then
++if findcmd xterm ; then
+   exec $result -T minicom -n minicom -geometry 80x25 -e "if ! minicom -m -c on $*; then echo Press ENTER to continue...; read; fi"
+   exit 1
+ fi
+
+-if findcmd xterm
+-then
+-  if [ -f /etc/debian_version ]
+-  then
+-  exec $result -T minicom -n minicom -bg black -fg grey -geometry 80x25 -e "if ! minicom -m -c on $*; then echo Press ENTER to continue...; read; fi"
+-  else
+-  exec $result -T minicom -n minicom -geometry 80x25 -e "if ! minicom -m -c on $*; then echo Press ENTER to continue...; read; fi"
+-  fi
+-  exit 1
+-fi
+-
+-echo "xminicom: rxvt, color_xterm or xterm NOT found!" 1>&2
++echo "xminicom: konsole, gnome-terminal, rxvt, color_xterm or xterm NOT found!" 1>&2
+ exit 1
diff --git a/pkgs/tools/misc/mmake/default.nix b/pkgs/tools/misc/mmake/default.nix
new file mode 100644
index 000000000000..ce8ad76ba829
--- /dev/null
+++ b/pkgs/tools/misc/mmake/default.nix
@@ -0,0 +1,25 @@
+{ stdenv, buildGoPackage, fetchFromGitHub, fetchhg, fetchbzr, fetchsvn }:
+
+buildGoPackage rec {
+  name = "mmake-${version}";
+  version = "1.2.0";
+
+  goPackagePath = "github.com/tj/mmake";
+
+  src = fetchFromGitHub {
+    owner = "tj";
+    repo = "mmake";
+    rev = "v${version}";
+    sha256 = "1pyqgk04v0f7a28cwq9c40bd2cgrkrv4wqcijdzpgn4bqhrqab4f";
+  };
+
+  goDeps = ./deps.nix;
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/tj/mmake;
+    description = "Mmake is a small program which wraps make to provide additional functionality, such as user-friendly help output, remote includes, and eventually more. It otherwise acts as a pass-through to standard make.";
+    license = licenses.mit;
+    platforms = platforms.all;
+    maintainers = [ maintainers.gabesoft ];
+  };
+}
diff --git a/pkgs/tools/misc/mmake/deps.nix b/pkgs/tools/misc/mmake/deps.nix
new file mode 100644
index 000000000000..0721ad0af608
--- /dev/null
+++ b/pkgs/tools/misc/mmake/deps.nix
@@ -0,0 +1,30 @@
+# This file was generated by https://github.com/kamilchm/go2nix v1.2.1
+[
+  {
+    goPackagePath = "github.com/apex/log";
+    fetch = {
+      type = "git";
+      url = "https://github.com/apex/log";
+      rev = "0296d6eb16bb28f8a0c55668affcf4876dc269be";
+      sha256 = "067px84y73h60bai1yy6xqf2l05gq6zsp64fn58d4fwzk04aa16v";
+    };
+  }
+  {
+    goPackagePath = "github.com/pkg/errors";
+    fetch = {
+      type = "git";
+      url = "https://github.com/pkg/errors";
+      rev = "c605e284fe17294bda444b34710735b29d1a9d90";
+      sha256 = "1izjk4msnc6wn1mclg0ypa6i31zfwb1r3032k8q4jfbd57hp0bz6";
+    };
+  }
+  {
+    goPackagePath = "github.com/segmentio/go-env";
+    fetch = {
+      type = "git";
+      url = "https://github.com/segmentio/go-env";
+      rev = "ea0600a7760cd15ccca9057be4a87d68e95ee876";
+      sha256 = "0rgclbi0na5042cirr52lriwyb5a2rdpqx211zfwyrrvc3zq4lwq";
+    };
+  }
+]
diff --git a/pkgs/tools/misc/mongodb-tools/default.nix b/pkgs/tools/misc/mongodb-tools/default.nix
index f67fd383f18d..7e24c955a806 100644
--- a/pkgs/tools/misc/mongodb-tools/default.nix
+++ b/pkgs/tools/misc/mongodb-tools/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, buildGoPackage, fetchFromGitHub }:
+{ stdenv, buildGoPackage, fetchFromGitHub, openssl_1_0_2, pkgconfig, libpcap }:
 
 let
   tools = [
@@ -6,9 +6,12 @@ let
     "mongooplog" "mongorestore" "mongostat" "mongotop"
   ];
 in
+
+with stdenv.lib;
+
 buildGoPackage rec {
   name = "mongo-tools-${version}";
-  version = "3.0.12";
+  version = "3.5.13";
   rev = "r${version}";
 
   goPackagePath = "github.com/mongodb/mongo-tools";
@@ -18,20 +21,27 @@ buildGoPackage rec {
     inherit rev;
     owner = "mongodb";
     repo = "mongo-tools";
-    sha256 = "142vxgniri1mfy2xmfgxhbdp6k6h8c5milv454krv1b51v43hsbm";
+    sha256 = "00klm4pyx5k39nn4pmfrpnkqxdhbzm7lprgwxszpirzrarh2g164";
   };
 
   goDeps = ./deps.nix;
 
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ openssl_1_0_2 libpcap ];
+
   # Mongodb incorrectly names all of their binaries main
   # Let's work around this with our own installer
-  preInstall = ''
-    mkdir -p $bin/bin
-  '' + toString (map (t: ''
-      go install $goPackagePath/${t}/main
-      mv go/bin/main $bin/bin/${t}
-  ''
-  ) tools) + ''  
-    rm -r go/bin
+  buildPhase = ''
+    runHook preBuild
+    ${stdenv.lib.concatMapStrings (t: ''
+      go build -o "$bin/bin/${t}" -tags ssl -ldflags "-s -w" $goPackagePath/${t}/main
+    '') tools}
+    runHook postBuild
   '';
+
+  meta = {
+    homepage = https://github.com/mongodb/mongo-tools;
+    description = "Tools for the MongoDB";
+    license = licenses.asl20;
+  };
 }
diff --git a/pkgs/tools/misc/mongodb-tools/deps.nix b/pkgs/tools/misc/mongodb-tools/deps.nix
index 437dcd649373..30de006db6f7 100644
--- a/pkgs/tools/misc/mongodb-tools/deps.nix
+++ b/pkgs/tools/misc/mongodb-tools/deps.nix
@@ -1,11 +1,20 @@
 [
   {
+    goPackagePath = "golang.org/x/sys";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/sys";
+      rev = "314a259e304ff91bd6985da2a7149bbf91237993";
+      sha256 = "0vya62c3kmhmqx6awlxx8hc84987xkym9rhs0q28vlhwk9kczdaa";
+    };
+  }
+  {
     goPackagePath = "golang.org/x/crypto";
     fetch = {
       type = "git";
-      url = "https://go.googlesource.com/crypto";
-      rev = "575fdbe86e5dd89229707ebec0575ce7d088a4a6";
-      sha256 = "1kgv1mkw9y404pk3lcwbs0vgl133mwyp294i18jg9hp10s5d56xa";
+      url = "https://github.com/golang/crypto";
+      rev = "1f22c0103821b9390939b6776727195525381532";
+      sha256 = "1acy12f396sr3lrnbcnym5q72qnlign5bagving41qijzjnc219m";
     };
   }
   {
@@ -13,17 +22,62 @@
     fetch = {
       type = "git";
       url = "https://github.com/howeyc/gopass";
-      rev = "2c70fa70727c953c51695f800f25d6b44abb368e";
-      sha256 = "152lrkfxk205rlxiign0w5wb0fmfh910yz4jhlv4f4l1qr1h2lx8";
+      rev = "bf9dde6d0d2c004a008c27aaee91170c786f6db8";
+      sha256 = "1jxzyfnqi0h1fzlsvlkn10bncic803bfhslyijcxk55mgh297g45";
     };
   }
   {
     goPackagePath = "gopkg.in/mgo.v2";
     fetch = {
       type = "git";
-      url = "https://gopkg.in/mgo.v2";
-      rev = "c6a7dce14133ccac2dcac3793f1d6e2ef048503a";
-      sha256 = "0rg232q1bkq3y3kd5816hgk1jpf7i38aha5q5ia7j6p9xashz7vj";
+      url = "https://github.com/10gen/mgo";
+      rev = "39b4000d99037e917f3a3b9d2dcab667a9ef284a";
+      sha256 = "1m0xgd3y32g15fhl204g2caarfi5rn41m8pyym0i2gl3jnv5zw99";
+    };
+  }
+  {
+    goPackagePath = "github.com/google/gopacket";
+    fetch = {
+      type = "git";
+      url = "https://github.com/google/gopacket";
+      rev = "93b782132903d1846aab74cb1f62e6138564949f";
+      sha256 = "0l5m5a8dnqbkhphyfq7anj5zv59s74q2l7i6w9r7xwysfiqyq335";
+    };
+  }
+  {
+    goPackagePath = "github.com/patrickmn/go-cache";
+    fetch = {
+      type = "git";
+      url = "https://github.com/patrickmn/go-cache";
+      rev = "1881a9bccb818787f68c52bfba648c6cf34c34fa";
+      sha256 = "1nd0kqijx6mrxb8wlh20bx73mwj0fqzla2sr68y6j6lz3fsy1fw2";
+    };
+  }
+  {
+    goPackagePath = "github.com/spacemonkeygo/openssl";
+    fetch = {
+      type = "git";
+      url = "https://github.com/10gen/openssl";
+      rev = "2692b9f6fa95e72c75f8d9ba76e49c5dfd2cf8e4";
+      sha256 = "16x2mx51977jrqw8d9hqhqmx892v2qf1k5xb01hhfklh58f527k2";
+    };
+  }
+  {
+    goPackagePath = "github.com/jtolds/gls";
+    fetch = {
+      type = "git";
+      url = "https://github.com/jtolds/gls";
+      rev = "8ddce2a84170772b95dd5d576c48d517b22cac63";
+      sha256 = "11rp9wbzkd71640rq0nwmgsddskx3qac8wzqz71ksdb7ixjj5fmj";
+    };
+  }
+  {
+    goPackagePath = "github.com/spacemonkeygo/spacelog";
+    fetch = {
+      type = "git";
+      url = "https://github.com/spacemonkeygo/spacelog";
+      rev = "f936fb050dc6b5fe4a96b485a6f069e8bdc59aeb";
+      sha256 = "00an6zlhjk5l0vk1zjzshhswsd0h4syi48n50hv0fcnbmpxc5hv2";
     };
   }
   {
@@ -36,12 +90,93 @@
     };
   }
   {
+    goPackagePath = "github.com/jtolds/gls";
+    fetch = {
+      type = "git";
+      url = "https://github.com/jtolds/gls";
+      rev = "8ddce2a84170772b95dd5d576c48d517b22cac63";
+      sha256 = "11rp9wbzkd71640rq0nwmgsddskx3qac8wzqz71ksdb7ixjj5fmj";
+    };
+  }
+  {
+    goPackagePath = "github.com/smartystreets/assertions";
+    fetch = {
+      type = "git";
+      url = "https://github.com/smartystreets/assertions";
+      rev = "287b4346dc4e71a038c346375a9d572453bc469b";
+      sha256 = "1nw9j9aircra68lbkp5bq4l8ayq4g3fvbb2x8qd2hg0vwgn5yaij";
+    };
+  }
+  {
+    goPackagePath = "github.com/smartystreets/goconvey";
+    fetch = {
+      type = "git";
+      url = "https://github.com/smartystreets/goconvey";
+      rev = "bf58a9a1291224109919756b4dcc469c670cc7e4";
+      sha256 = "1k8k6vvlpl5a19dbrywxjmcia36macjbajx2hb6ci64rdfyf5kz5";
+    };
+  }
+  {
+    goPackagePath = "github.com/jacobsa/oglematchers";
+    fetch = {
+      type = "git";
+      url = "https://github.com/jacobsa/oglematchers";
+      rev = "3ecefc49db07722beca986d9bb71ddd026b133f0";
+      sha256 = "0vrk5sfs1ymkg0gv5n5dn9x0kqiaw8gaapljj8q75mgrr1p5149y";
+    };
+  }
+  {
+    goPackagePath = "github.com/3rf/mongo-lint";
+    fetch = {
+      type = "git";
+      url = "https://github.com/3rf/mongo-lint";
+      rev = "3550fdcf1f43b89aaeabaa4559eaae6dc4407e42";
+      sha256 = "19b60a3i6kzssd15dg57y4bg49sw41idrsjdi8vr4j5lr5d7gviv";
+    };
+  }
+  {
+    goPackagePath = "github.com/mattn/go-runewidth";
+    fetch = {
+      type = "git";
+      url = "https://github.com/mattn/go-runewidth";
+      rev = "d6bea18f789704b5f83375793155289da36a3c7f";
+      sha256 = "1hnigpn7rjbwd1ircxkyx9hvi0xmxr32b2jdy2jzw6b3jmcnz1fs";
+    };
+  }
+  {
+    goPackagePath = "github.com/10gen/escaper";
+    fetch = {
+      type = "git";
+      url = "https://github.com/10gen/escaper";
+      rev = "17fe61c658dcbdcbf246c783f4f7dc97efde3a8b";
+      sha256 = "1iw86lg8ad5gdm46ryf4v431ix834l52lrjvcahq3c4dw1ylnbvl";
+    };
+  }
+  {
+    goPackagePath = "github.com/golang/snappy";
+    fetch = {
+      type = "git";
+      url = "https://github.com/golang/snappy";
+      rev = "d9eb7a3d35ec988b8585d4a0068e462c27d28380";
+      sha256 = "0wynarlr1y8sm9y9l29pm9dgflxriiialpwn01066snzjxnpmbyn";
+    };
+  }
+  {
+    goPackagePath = "github.com/nsf/termbox-go";
+    fetch = {
+      type = "git";
+      url = "https://github.com/nsf/termbox-go";
+      rev = "0723e7c3d0a317dea811f0fbe4d6edd81908c971";
+      sha256 = "1ak35nhlgjpbpnh7v9qvjyfsq52liz3niqfqva76p7a68pblwbr7";
+    };
+  }
+  {
     goPackagePath = "github.com/jessevdk/go-flags";
     fetch = {
       type = "git";
       url = "https://github.com/jessevdk/go-flags";
-      rev = "1b89bf73cd2c3a911d7b2a279ab085c4a18cf539";
-      sha256 = "027nglc5xx1cm03z9sisg0iqrhwcj6gh5z254rrpl8p4fwrxx680";
+      rev = "97448c91aac742cbca3d020b3e769013a420a06f";
+      sha256 = "0fv3yxvq8m3639a279hq4pf0c52ngqfl5n1vklcfympndrb7zjzj";
     };
   }
 ]
diff --git a/pkgs/tools/misc/mpdscribble/default.nix b/pkgs/tools/misc/mpdscribble/default.nix
index 1acdf6d7ddb8..56684848ebaa 100644
--- a/pkgs/tools/misc/mpdscribble/default.nix
+++ b/pkgs/tools/misc/mpdscribble/default.nix
@@ -10,12 +10,8 @@ stdenv.mkDerivation rec {
     sha256 = "0hgb7xh3w455m00lpldwkyrc5spjn3q1pl2ry3kf7w3hiigjpphw";
   };
 
-  buildInputs = [ mpd_clientlib curl glib pkgconfig ];
-
-  preConfigure = ''
-    export LIBMPDCLIENT_LIBS=${mpd_clientlib}/lib/libmpdclient.so.${mpd_clientlib.majorVersion}.0.${mpd_clientlib.minorVersion}
-    export LIBMPDCLIENT_CFLAGS=${mpd_clientlib}
-  '';
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ mpd_clientlib curl glib ];
 
   meta = with stdenv.lib; {
     description = "A Music Player Daemon (MPD) client which submits information about tracks beeing played to a scrobbler (e.g. last.fm)";
diff --git a/pkgs/tools/misc/mprime/default.nix b/pkgs/tools/misc/mprime/default.nix
index 9a435622c7d7..2aea2530057c 100644
--- a/pkgs/tools/misc/mprime/default.nix
+++ b/pkgs/tools/misc/mprime/default.nix
@@ -23,7 +23,8 @@ stdenv.mkDerivation {
 
   unpackCmd = "unzip -d src -q $curSrc";
 
-  buildInputs = [ unzip pkgconfig curl ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ unzip curl ];
 
   patches = [ ./makefile.patch ];
 
diff --git a/pkgs/tools/misc/ncdu/default.nix b/pkgs/tools/misc/ncdu/default.nix
index c309c8229747..1cb71ce9dd67 100644
--- a/pkgs/tools/misc/ncdu/default.nix
+++ b/pkgs/tools/misc/ncdu/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "Ncurses disk usage analyzer";
-    homepage = http://dev.yorhel.nl/ncdu;
+    homepage = https://dev.yorhel.nl/ncdu;
     license = licenses.mit;
     platforms = platforms.all;
     maintainers = with maintainers; [ pSub ];
diff --git a/pkgs/tools/misc/neofetch/default.nix b/pkgs/tools/misc/neofetch/default.nix
index ea2b863cd776..de4a22ee9e47 100644
--- a/pkgs/tools/misc/neofetch/default.nix
+++ b/pkgs/tools/misc/neofetch/default.nix
@@ -2,26 +2,14 @@
 
 stdenv.mkDerivation rec {
   name = "neofetch-${version}";
-  version = "3.2.0";
+  version = "3.3.0";
   src = fetchFromGitHub {
     owner = "dylanaraps";
     repo = "neofetch";
     rev = version;
-    sha256 = "1skkclvkqayqsbywja2fhv18l4rn9kg2da6bkip82zrwd713akl3";
+    sha256 = "1f1hvd635wv81qg802jdi0yggi4631w9nlznipaxkvk4y1zpdq5j";
   };
 
-  # This patch is only needed so that Neofetch 3.2.0 can look for
-  # configuration file, w3m directory (for fetching images) and ASCII
-  # directory properly. It won't be needed in subsequent releases.
-  patches = [
-    (fetchpatch {
-      name = "nixos.patch";
-      url = "https://github.com/konimex/neofetch/releases/download/3.2.0/nixos.patch";
-      sha256 = "0c6vsa74bxq6qlgbv3rrkhzkpvnq4304s6y2r1bl0sachyakaljy";
-    })
-  ];
-
-
   dontBuild = true;
 
 
diff --git a/pkgs/tools/misc/notify-desktop/default.nix b/pkgs/tools/misc/notify-desktop/default.nix
new file mode 100644
index 000000000000..661f4f4f435e
--- /dev/null
+++ b/pkgs/tools/misc/notify-desktop/default.nix
@@ -0,0 +1,33 @@
+{ stdenv, fetchFromGitHub, dbus, pkgconfig }:
+
+stdenv.mkDerivation rec {
+  name = "notify-desktop";
+  version = "0.2.0";
+
+  src = fetchFromGitHub {
+    owner = "nowrep";
+    repo = "notify-desktop";
+    rev = "9863919fb4ce7820810ac14a09a46ee73c3d56cc";
+    sha256 = "1brcvl2fx0yzxj9mc8hzfl32zdka1f1bxpzsclcsjplyakyinr1a";
+  };
+
+  buildInputs = [ dbus pkgconfig ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    install -m 755 bin/notify-desktop $out/bin/notify-desktop
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Little application that lets you send desktop notifications with one command";
+    longDescription = ''
+      It's basically clone of notify-send from libnotify,
+      but it supports reusing notifications on screen by passing its ID.
+      It also does not use any external dependencies (except from libdbus of course).
+    '';
+    homepage = "https://github.com/nowrep/notify-desktop";
+    license = licenses.gpl2;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ ylwghst ];
+  };
+}
diff --git a/pkgs/tools/misc/osm2pgsql/default.nix b/pkgs/tools/misc/osm2pgsql/default.nix
index 98489358738c..67e0c2b21d83 100644
--- a/pkgs/tools/misc/osm2pgsql/default.nix
+++ b/pkgs/tools/misc/osm2pgsql/default.nix
@@ -23,6 +23,6 @@ stdenv.mkDerivation rec {
     version = "0.92.1-unstable";
     homepage = https://github.com/openstreetmap/osm2pgsql;
     license = stdenv.lib.licenses.gpl2;
-    platforms = stdenv.lib.platforms.unix;
+    platforms = stdenv.lib.platforms.linux;
   };
 }
diff --git a/pkgs/tools/misc/ostree/default.nix b/pkgs/tools/misc/ostree/default.nix
index 82abb5c9bbcf..a8332ad494da 100644
--- a/pkgs/tools/misc/ostree/default.nix
+++ b/pkgs/tools/misc/ostree/default.nix
@@ -1,24 +1,24 @@
 { stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, gtk_doc, gobjectIntrospection
 , libgsystem, xz, e2fsprogs, libsoup, gpgme, which, autoconf, automake, libtool, fuse
-, libcap, yacc, libxslt, docbook_xsl, docbook_xml_dtd_42
+, libarchive, libcap, bzip2, yacc, libxslt, docbook_xsl, docbook_xml_dtd_42
 }:
 
 let
   libglnx-src = fetchFromGitHub {
     owner  = "GNOME";
     repo   = "libglnx";
-    rev    = "50a0feaba03ffa5a1980d3a14487276b8f49f8a6";
-    sha256 = "1rn5jdh84y1yfpqmvidx82lkm0jr7scjzdrps57r37ksxvrk3ibs";
+    rev    = "5362f6bc3ff3e30f379e767b203d15c9e56d6f08";
+    sha256 = "1l4vm7bx3cf4q44n3a1i2gszyryqyimcxvx54gna72q7dw130mrr";
   };
 
   bsdiff-src = fetchFromGitHub {
     owner  = "mendsley";
     repo   = "bsdiff";
-    rev    = "7d70d8f4ff48345bc76e314c9d98da91f78873fa";
-    sha256 = "0ai2kykj8i4bqcy3gry36r3n4ax0fldncfhksl5b293nf2fihnws";
+    rev    = "1edf9f656850c0c64dae260960fabd8249ea9c60";
+    sha256 = "1h71d2h2d3anp4msvpaff445rnzdxii3id2yglqk7af9i43kdsn1";
   };
 
-  version = "2017.9";
+  version = "2017.12";
 in stdenv.mkDerivation {
   name = "ostree-${version}";
 
@@ -26,7 +26,7 @@ in stdenv.mkDerivation {
     rev    = "v${version}";
     owner  = "ostreedev";
     repo   = "ostree";
-    sha256 = "1040xcw8qcs6xq8x4wg47hha3915qzb6lndb38wjyn6wzl1680q3";
+    sha256 = "0gxvpzwz7z4zihz5hkn6ajv7f6gas4zi2pznhi5v6wy7cw06if68";
   };
 
   nativeBuildInputs = [
@@ -34,7 +34,7 @@ in stdenv.mkDerivation {
     libxslt docbook_xsl docbook_xml_dtd_42
   ];
 
-  buildInputs = [ libgsystem xz e2fsprogs libsoup gpgme fuse libcap ];
+  buildInputs = [ libgsystem xz e2fsprogs libsoup gpgme fuse libarchive libcap bzip2 ];
 
   prePatch = ''
     rmdir libglnx bsdiff
@@ -50,7 +50,7 @@ in stdenv.mkDerivation {
 
   meta = with stdenv.lib; {
     description = "Git for operating system binaries";
-    homepage    = "http://live.gnome.org/OSTree/";
+    homepage    = https://ostree.readthedocs.io/en/latest/;
     license     = licenses.lgpl2Plus;
     platforms   = platforms.linux;
     maintainers = with maintainers; [ copumpkin ];
diff --git a/pkgs/tools/misc/pal/default.nix b/pkgs/tools/misc/pal/default.nix
index f92069e7b9f5..267b458cccc6 100644
--- a/pkgs/tools/misc/pal/default.nix
+++ b/pkgs/tools/misc/pal/default.nix
@@ -14,7 +14,8 @@ stdenv.mkDerivation rec {
 
   makeFlags = "prefix=$(out)";
 
-  buildInputs = [ glib gettext readline pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ glib gettext readline ];
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/tools/misc/parallel/default.nix b/pkgs/tools/misc/parallel/default.nix
index 648d09b42654..676db3ab69c8 100644
--- a/pkgs/tools/misc/parallel/default.nix
+++ b/pkgs/tools/misc/parallel/default.nix
@@ -1,11 +1,11 @@
 { fetchurl, stdenv, perl, makeWrapper, procps }:
 
 stdenv.mkDerivation rec {
-  name = "parallel-20170722";
+  name = "parallel-20171022";
 
   src = fetchurl {
     url = "mirror://gnu/parallel/${name}.tar.bz2";
-    sha256 = "117g50bx1kcbrqix0f1539z5rzhvgsni2wddjv939wcxkrdb1idx";
+    sha256 = "18pq10npl7g764ww7cy9r5n5s3kiy984jclf932qfgndcxsbpqpp";
   };
 
   nativeBuildInputs = [ makeWrapper perl ];
diff --git a/pkgs/tools/misc/pick/default.nix b/pkgs/tools/misc/pick/default.nix
index 5fda26bacad1..747c98376410 100644
--- a/pkgs/tools/misc/pick/default.nix
+++ b/pkgs/tools/misc/pick/default.nix
@@ -1,23 +1,19 @@
-{ stdenv, fetchFromGitHub, autoreconfHook, ncurses }:
+{ stdenv, fetchFromGitHub, autoreconfHook, ncurses, pkgconfig }:
 
 stdenv.mkDerivation rec {
   name = "pick-${version}";
-  version = "1.7.0";
+  version = "1.9.0";
 
   src = fetchFromGitHub {
     owner = "calleerlandsson";
     repo = "pick";
     rev = "v${version}";
-    sha256 = "1x7ql530rj4yj50dzp8526mz92g4hhqxnig1qgiq3h3k815p31qb";
+    sha256 = "0s0mn9iz17ldhvahggh9rsmgfrjh0kvk5bh4p9xhxcn7rcp0h5ka";
   };
 
   buildInputs = [ ncurses ];
 
-  nativeBuildInputs = [ autoreconfHook ];
-
-  postPatch = ''
-    sed -i -e 's/\[curses]/\[ncurses]/g' configure.ac
-  '';
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
 
   meta = with stdenv.lib; {
     inherit (src.meta) homepage;
diff --git a/pkgs/tools/misc/plantuml/default.nix b/pkgs/tools/misc/plantuml/default.nix
index f15c452c9550..447ef9dd5ec5 100644
--- a/pkgs/tools/misc/plantuml/default.nix
+++ b/pkgs/tools/misc/plantuml/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, jre, graphviz }:
 
 stdenv.mkDerivation rec {
-  version = "8047";
+  version = "1.2017.18";
   name = "plantuml-${version}";
 
   src = fetchurl {
-    url = "mirror://sourceforge/project/plantuml/plantuml.${version}.jar";
-    sha256 = "11a1qchalymvc7qn9kqxamp8qm8fljpnxmfi4zs8sg75nzddjnlm";
+    url = "mirror://sourceforge/project/plantuml/${version}/plantuml.${version}.jar";
+    sha256 = "0ssfg6lpk41ydhxhi6y6c9ca3hpql6gg3bxjws8vrx9s3s6r5rb0";
   };
 
   # It's only a .jar file and a shell wrapper
diff --git a/pkgs/tools/misc/ponysay/default.nix b/pkgs/tools/misc/ponysay/default.nix
index a09dfb4d4e47..0f5c15241439 100644
--- a/pkgs/tools/misc/ponysay/default.nix
+++ b/pkgs/tools/misc/ponysay/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Cowsay reimplemention for ponies";
-    homepage = http://terse.tk/ponysay/;
+    homepage = http://erkin.co/ponysay/;
     license = stdenv.lib.licenses.gpl3;
     maintainers = with stdenv.lib.maintainers; [ bodil ];
     platforms = with stdenv.lib.platforms; unix;
diff --git a/pkgs/tools/misc/qjoypad/default.nix b/pkgs/tools/misc/qjoypad/default.nix
index 663c60d28569..6a5e674b698b 100644
--- a/pkgs/tools/misc/qjoypad/default.nix
+++ b/pkgs/tools/misc/qjoypad/default.nix
@@ -5,7 +5,8 @@ stdenv.mkDerivation rec {
     url = "mirror://sourceforge/qjoypad/${name}.tar.gz";
     sha256 = "1jlm7i26nfp185xrl41kz5z6fgvyj51bjpz48cg27xx64y40iamm";
   };
-  buildInputs = [ pkgconfig libX11 libXtst qt4 ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libX11 libXtst qt4 ];
   patchPhase = ''
     cd src
     substituteInPlace config --replace /bin/bash /bin/sh
diff --git a/pkgs/tools/misc/qt5ct/default.nix b/pkgs/tools/misc/qt5ct/default.nix
index 86750518bb5a..9da2ebc07fc0 100644
--- a/pkgs/tools/misc/qt5ct/default.nix
+++ b/pkgs/tools/misc/qt5ct/default.nix
@@ -1,5 +1,7 @@
 { stdenv, fetchurl, qtbase, qtsvg, qttools, qmake }:
 
+let inherit (stdenv.lib) getDev; in
+
 stdenv.mkDerivation rec {
   name = "qt5ct-${version}";
   version = "0.33";
@@ -14,6 +16,8 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ qtbase qtsvg ];
 
+  qmakeFlags = [ ''LRELEASE_EXECUTABLE=${getDev qttools}/bin/lrelease'' ];
+
   preConfigure = ''
     qmakeFlags="$qmakeFlags PLUGINDIR=$out/$qtPluginPrefix"
   '';
diff --git a/pkgs/tools/misc/quota/default.nix b/pkgs/tools/misc/quota/default.nix
index 9ba138bf0e9d..a13f7160aa69 100644
--- a/pkgs/tools/misc/quota/default.nix
+++ b/pkgs/tools/misc/quota/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "Tools to manage kernel-level quotas in Linux";
-    homepage = http://sourceforge.net/projects/linuxquota/;
+    homepage = https://sourceforge.net/projects/linuxquota/;
     license = licenses.gpl2; # With some files being BSD as an exception
     platforms = platforms.linux;
     maintainers = [ maintainers.dezgeg ];
diff --git a/pkgs/tools/misc/riemann-c-client/default.nix b/pkgs/tools/misc/riemann-c-client/default.nix
index 54e5a3ab17e0..07c14ac76267 100644
--- a/pkgs/tools/misc/riemann-c-client/default.nix
+++ b/pkgs/tools/misc/riemann-c-client/default.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation rec {
     sha256 = "1j3wgf9xigsv6ckmv82gjj4wavi7xjn2zvj1f63fzbaa1rv7pf3s";
   };
 
-  buildInputs = [ autoreconfHook pkgconfig file protobufc ];
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  buildInputs = [ file protobufc ];
 
   meta = with stdenv.lib; {
     homepage = https://github.com/algernon/riemann-c-client;
diff --git a/pkgs/tools/misc/rkflashtool/default.nix b/pkgs/tools/misc/rkflashtool/default.nix
index 5c56f9accfc1..ff606c6b72bb 100644
--- a/pkgs/tools/misc/rkflashtool/default.nix
+++ b/pkgs/tools/misc/rkflashtool/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = {
-    homepage = http://sourceforge.net/projects/rkflashtool/;
+    homepage = https://sourceforge.net/projects/rkflashtool/;
     description = "Tools for flashing Rockchip devices";
     platforms = stdenv.lib.platforms.linux;
     maintainers = [ stdenv.lib.maintainers.viric ];
diff --git a/pkgs/tools/misc/rlwrap/default.nix b/pkgs/tools/misc/rlwrap/default.nix
index 86d81fd25856..bd60e786036f 100644
--- a/pkgs/tools/misc/rlwrap/default.nix
+++ b/pkgs/tools/misc/rlwrap/default.nix
@@ -1,11 +1,12 @@
 { stdenv, fetchurl, readline }:
 
 stdenv.mkDerivation rec {
-  name = "rlwrap-0.42";
+  name = "rlwrap-${version}";
+  version = "0.43";
 
   src = fetchurl {
-    url = "http://utopia.knoware.nl/~hlub/uck/rlwrap/${name}.tar.gz";
-    sha256 = "0i3yz303wscrysyzpdq04h4nrl9ajz9dbwi80risdl5rkm3dhw2s";
+    url = "https://github.com/hanslub42/rlwrap/releases/download/v${version}/${name}.tar.gz";
+    sha256 = "0bzb7ylk2770iv59v2d0gypb21y2xn87m299s9rqm6rdi2vx11lf";
   };
 
   buildInputs = [ readline ];
@@ -17,7 +18,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Readline wrapper for console programs";
-    homepage = http://utopia.knoware.nl/~hlub/uck/rlwrap/;
+    homepage = https://github.com/hanslub42/rlwrap;
     license = stdenv.lib.licenses.gpl2Plus;
     platforms = stdenv.lib.platforms.unix;
     maintainers = with stdenv.lib.maintainers; [ fuuzetsu ];
diff --git a/pkgs/tools/misc/rmlint/default.nix b/pkgs/tools/misc/rmlint/default.nix
index e321670068cf..2ff86f5cbdf6 100644
--- a/pkgs/tools/misc/rmlint/default.nix
+++ b/pkgs/tools/misc/rmlint/default.nix
@@ -15,7 +15,8 @@ stdenv.mkDerivation rec {
 
   configurePhase = "scons config";
 
-  buildInputs = [ gettext glib json_glib libelf pkgconfig scons sphinx utillinux ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ gettext glib json_glib libelf scons sphinx utillinux ];
 
   buildPhase = "scons";
 
diff --git a/pkgs/tools/misc/rockbox-utility/default.nix b/pkgs/tools/misc/rockbox-utility/default.nix
index f84b9563967f..32f5a551dfe3 100644
--- a/pkgs/tools/misc/rockbox-utility/default.nix
+++ b/pkgs/tools/misc/rockbox-utility/default.nix
@@ -2,6 +2,8 @@
 , qtbase, qttools, makeWrapper, qmake
 , withEspeak ? false, espeak ? null }:
 
+let inherit (stdenv.lib) getDev; in
+
 stdenv.mkDerivation  rec {
   name = "rockbox-utility-${version}";
   version = "1.4.0";
@@ -15,6 +17,11 @@ stdenv.mkDerivation  rec {
     ++ stdenv.lib.optional withEspeak espeak;
   nativeBuildInputs = [ makeWrapper pkgconfig qmake ];
 
+  postPatch = ''
+    sed -i rbutil/rbutilqt/rbutilqt.pro \
+        -e '/^lrelease.commands =/ s|$$\[QT_INSTALL_BINS\]/lrelease -silent|${getDev qttools}/bin/lrelease|'
+  '';
+
   preConfigure = ''
     cd rbutil/rbutilqt
   '';
diff --git a/pkgs/tools/misc/routino/default.nix b/pkgs/tools/misc/routino/default.nix
new file mode 100644
index 000000000000..e3e174e0204a
--- /dev/null
+++ b/pkgs/tools/misc/routino/default.nix
@@ -0,0 +1,27 @@
+{ stdenv, fetchurl, perl, zlib, bzip2 }:
+
+stdenv.mkDerivation rec {
+  name = "routino-${version}";
+  version = "3.2";
+
+  src = fetchurl {
+    url = "http://routino.org/download/${name}.tgz";
+    sha256 = "0lkmpi8gn7qf40cx93jcp7nxa9dfwi1d6rjrhcqbdymszzm33972";
+  };
+
+  nativeBuildInputs = [ perl ];
+
+  buildInputs = [ zlib bzip2 ];
+
+  outputs = [ "out" "doc" ];
+
+  makeFlags = [ "prefix=$(out)" ];
+
+  meta = with stdenv.lib; {
+    homepage = http://www.routino.org/;
+    description = "OpenStreetMap Routing Software";
+    license = licenses.agpl3;
+    maintainter = with maintainers; [ dotlambda ];
+    platforms = with platforms; linux;
+  };
+}
diff --git a/pkgs/tools/misc/rpm-ostree/default.nix b/pkgs/tools/misc/rpm-ostree/default.nix
index 3e2953c57334..d6cad51ce753 100644
--- a/pkgs/tools/misc/rpm-ostree/default.nix
+++ b/pkgs/tools/misc/rpm-ostree/default.nix
@@ -28,8 +28,9 @@ in stdenv.mkDerivation {
     sha256 = "0a0wwklzk1kvk3bbxxfvxgk4ck5dn7a7v32shqidb674fr2d5pvb";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    which autoconf automake pkgconfig libtool libcap ostree rpm glib libgsystem gperf
+    which autoconf automake libtool libcap ostree rpm glib libgsystem gperf
     json_glib libarchive libsolv librepo gtk_doc libxslt docbook_xsl docbook_xml_dtd_42
     cmake pcre check python
     # FIXME: get rid of this once libarchive properly propagates this
diff --git a/pkgs/tools/misc/rrdtool/default.nix b/pkgs/tools/misc/rrdtool/default.nix
index ee5c37ef6bb1..671dba0d548b 100644
--- a/pkgs/tools/misc/rrdtool/default.nix
+++ b/pkgs/tools/misc/rrdtool/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with stdenv.lib; {
-    homepage = http://oss.oetiker.ch/rrdtool/;
+    homepage = https://oss.oetiker.ch/rrdtool/;
     description = "High performance logging in Round Robin Databases";
     license = licenses.gpl2;
     platforms = platforms.linux ++ platforms.darwin;
diff --git a/pkgs/tools/misc/screen/default.nix b/pkgs/tools/misc/screen/default.nix
index 6ef042abb159..156db640acdf 100644
--- a/pkgs/tools/misc/screen/default.nix
+++ b/pkgs/tools/misc/screen/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "screen-${version}";
-  version = "4.6.1";
+  version = "4.6.2";
 
   src = fetchurl {
     url = "mirror://gnu/screen/${name}.tar.gz";
-    sha256 = "0r3wpfxnr5kw73b8ndja26jk03nfbks06iyfmgb5aqb2rdkazadb";
+    sha256 = "0fps0fsipfbh7c2cnp7rjw9n79j0ysq21mk8hzifa33a1r924s8v";
   };
 
   configureFlags= [
diff --git a/pkgs/tools/misc/shallot/default.nix b/pkgs/tools/misc/shallot/default.nix
new file mode 100644
index 000000000000..6c757ca224a9
--- /dev/null
+++ b/pkgs/tools/misc/shallot/default.nix
@@ -0,0 +1,32 @@
+{ 
+  stdenv, fetchFromGitHub,
+  openssl
+}:
+
+let 
+  version = "0.0.3";
+in stdenv.mkDerivation {
+  name = "shallot-${version}";
+
+  src = fetchFromGitHub {
+    owner = "katmagic";
+    repo = "Shallot";
+    rev = "shallot-${version}";
+    sha256 = "0cjafdxvjkwb9vyifhh11mw0la7yfqswqwqmrfp1fy9jl7m0il9k";
+  };
+
+  buildInputs = [ openssl ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp ./shallot $out/bin/
+  '';
+
+  meta = {
+    description = "Shallot allows you to create customized .onion addresses for your hidden service";
+
+    license = stdenv.lib.licenses.mit;
+    homepage = https://github.com/katmagic/Shallot;
+    platforms = stdenv.lib.platforms.linux;
+  };
+}
diff --git a/pkgs/tools/misc/snapper/default.nix b/pkgs/tools/misc/snapper/default.nix
index 5f482d68dd9a..4b7857d60e7b 100644
--- a/pkgs/tools/misc/snapper/default.nix
+++ b/pkgs/tools/misc/snapper/default.nix
@@ -1,19 +1,27 @@
-{ stdenv, fetchFromGitHub
+{ stdenv, fetchFromGitHub, fetchpatch
 , autoreconfHook, pkgconfig, docbook_xsl, libxslt, docbook_xml_dtd_45
 , acl, attr, boost, btrfs-progs, dbus_libs, diffutils, e2fsprogs, libxml2
 , lvm2, pam, python, utillinux }:
 
 stdenv.mkDerivation rec {
   name = "snapper-${version}";
-  version = "0.3.3";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "openSUSE";
     repo = "snapper";
     rev = "v${version}";
-    sha256 = "12c2ygaanr4gny4ixnly4vpi0kv7snbg3khr3i5zwridhmdzz9hm";
+    sha256 = "14hrv23film4iihyclcvc2r2dgxl8w3as50r81xjjc85iyp6yxkm";
   };
 
+  patches = [
+    # Fix build with new Boost
+    (fetchpatch {
+      url = "https://github.com/openSUSE/snapper/commit/2e3812d2c1d1f54861fb79f5c2b0197de96a00a3.patch";
+      sha256 = "0yrzss1v7lmcvkajmchz917yqsvlsdfz871szzw790v6pql1322s";
+    })
+  ];
+
   nativeBuildInputs = [
     autoreconfHook pkgconfig
     docbook_xsl libxslt docbook_xml_dtd_45
diff --git a/pkgs/tools/misc/svtplay-dl/default.nix b/pkgs/tools/misc/svtplay-dl/default.nix
index a652243a9d60..5999fa316223 100644
--- a/pkgs/tools/misc/svtplay-dl/default.nix
+++ b/pkgs/tools/misc/svtplay-dl/default.nix
@@ -5,13 +5,13 @@ let
   inherit (pythonPackages) python nose pycrypto requests mock;
 in stdenv.mkDerivation rec {
   name = "svtplay-dl-${version}";
-  version = "1.9.4";
+  version = "1.9.6";
 
   src = fetchFromGitHub {
     owner = "spaam";
     repo = "svtplay-dl";
     rev = version;
-    sha256 = "15vjaia1qbs49gplpfi8sj5scl9mb4qg8n2z4zyzjs5461lx5qqv";
+    sha256 = "11xw4whh60k61i8akd7avb254mmffaig72kb7w6prk1kjq05js2s";
   };
 
   pythonPaths = [ pycrypto requests ];
diff --git a/pkgs/tools/misc/system-config-printer/default.nix b/pkgs/tools/misc/system-config-printer/default.nix
index fbef31fb5467..72d45c90f106 100644
--- a/pkgs/tools/misc/system-config-printer/default.nix
+++ b/pkgs/tools/misc/system-config-printer/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ wrapGAppsHook ];
 
   pythonPath = with pythonPackages;
-    [ pycups pycurl dbus-python pygobject3 requests pycairo pythonPackages.pycurl ];
+    [ pycups pycurl dbus-python pygobject3 requests pycairo pysmbc ];
 
   configureFlags =
     [ "--with-udev-rules"
diff --git a/pkgs/tools/misc/t1utils/default.nix b/pkgs/tools/misc/t1utils/default.nix
index d68ab942e494..a256b8e4fdb3 100644
--- a/pkgs/tools/misc/t1utils/default.nix
+++ b/pkgs/tools/misc/t1utils/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "t1utils-1.39";
+  name = "t1utils-1.41";
 
   src = fetchurl {
     url = "http://www.lcdf.org/type/${name}.tar.gz";
-    sha256 = "1i6ln194ns2g4j5zjlj4bfzxpkfpnxvy37n9baq3hywjqkjz7bhg";
+    sha256 = "09rlc837dr69hyiiicha3il37mchsvz84qw8hnvb60lrh9zdsppw";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/misc/time/default.nix b/pkgs/tools/misc/time/default.nix
index 911f0ff50bf3..cce7614b904e 100644
--- a/pkgs/tools/misc/time/default.nix
+++ b/pkgs/tools/misc/time/default.nix
@@ -1,15 +1,14 @@
 {stdenv, fetchurl}:
 
-stdenv.mkDerivation {
-  name = "time-1.7";
+stdenv.mkDerivation rec {
+  name = "time-${version}";
+  version = "1.8";
 
   src = fetchurl {
-    url = mirror://gnu/time/time-1.7.tar.gz;
-    sha256 = "0va9063fcn7xykv658v2s9gilj2fq4rcdxx2mn2mmy1v4ndafzp3";
+    url = "mirror://gnu/time/${name}.tar.gz";
+    sha256 = "06rfg8dn0q2r8pdq8i6brrs6rqrsgvkwbbl4kfx3a6lnal0m8bwa";
   };
 
-  patches = [ ./max-resident.patch ];
-
   meta = {
     description = "Tool that runs programs and summarizes the system resources they use";
 
@@ -27,7 +26,7 @@ stdenv.mkDerivation {
       `time' reports unavailable information as zero values.
     '';
 
-    license = stdenv.lib.licenses.gpl2Plus;
+    license = stdenv.lib.licenses.gpl3Plus;
     homepage = http://www.gnu.org/software/time/;
     platforms = stdenv.lib.platforms.unix;
   };
diff --git a/pkgs/tools/misc/time/max-resident.patch b/pkgs/tools/misc/time/max-resident.patch
deleted file mode 100644
index e593d833d5e4..000000000000
--- a/pkgs/tools/misc/time/max-resident.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-Fix the "max resident" size reported by ‘time’ being off by a factor of 4. 
-
-From http://lists.gnu.org/archive/html/help-gnu-utils/2010-10/msg00002.html
-
-diff -ru -x '*~' time-1.7-orig/time.c time-1.7/time.c
---- time-1.7-orig/time.c	1996-06-13 15:38:21.000000000 -0400
-+++ time-1.7/time.c	2011-10-31 10:40:27.000000000 -0400
-@@ -392,7 +392,7 @@
- 		       ptok ((UL) resp->ru.ru_ixrss) / MSEC_TO_TICKS (v));
- 	      break;
- 	    case 'M':		/* Maximum resident set size.  */
--	      fprintf (fp, "%lu", ptok ((UL) resp->ru.ru_maxrss));
-+              fprintf (fp, "%lu", (UL) resp->ru.ru_maxrss);
- 	      break;
- 	    case 'O':		/* Outputs.  */
- 	      fprintf (fp, "%ld", resp->ru.ru_oublock);
diff --git a/pkgs/tools/misc/timidity/default.nix b/pkgs/tools/misc/timidity/default.nix
index 24a7e8d3f714..f30fdb1f1192 100644
--- a/pkgs/tools/misc/timidity/default.nix
+++ b/pkgs/tools/misc/timidity/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation {
   '';
 
   meta = with stdenv.lib; {
-    homepage = http://sourceforge.net/projects/timidity/;
+    homepage = https://sourceforge.net/projects/timidity/;
     license = licenses.gpl2;
     description = "A software MIDI renderer";
     maintainers = [ maintainers.marcweber ];
diff --git a/pkgs/tools/misc/tmux/default.nix b/pkgs/tools/misc/tmux/default.nix
index a749f250c11d..61370ff890bc 100644
--- a/pkgs/tools/misc/tmux/default.nix
+++ b/pkgs/tools/misc/tmux/default.nix
@@ -13,7 +13,7 @@ in
 
 stdenv.mkDerivation rec {
   name = "tmux-${version}";
-  version = "2.5";
+  version = "2.6";
 
   outputs = [ "out" "man" ];
 
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     owner = "tmux";
     repo = "tmux";
     rev = version;
-    sha256 = "0zwjngfaqrlwwbzicc5pq5pyws8f1qghcajvj0hwkipj51hqyswf";
+    sha256 = "0605y0nwfmf0mnq075vk80897c2cvhxxvxinqq7hvrpjf2ph5mww";
   };
 
   nativeBuildInputs = [ pkgconfig autoreconfHook ];
diff --git a/pkgs/tools/misc/tmuxinator/default.nix b/pkgs/tools/misc/tmuxinator/default.nix
index 5bf7dd49143e..b41f38905380 100644
--- a/pkgs/tools/misc/tmuxinator/default.nix
+++ b/pkgs/tools/misc/tmuxinator/default.nix
@@ -8,8 +8,8 @@ buildRubyGem rec {
   inherit ruby;
   name = "${gemName}-${version}";
   gemName = "tmuxinator";
-  version = "0.9.0";
-  sha256 = "13p8rvf1naknjin1n97370ifyj475lyyh60cbw2v6gczi9rs84p3";
+  version = "0.10.0";
+  sha256 = "199pq15qknpcafw8ryb9kk1jsrwnncg6k5l9d4n0nmms4knxlqlf";
 
   erubis = buildRubyGem rec {
     inherit ruby;
@@ -27,7 +27,15 @@ buildRubyGem rec {
     sha256 = "08p5gx18yrbnwc6xc0mxvsfaxzgy2y9i78xq7ds0qmdm67q39y4z";
   };
 
-  propagatedBuildInputs = [ erubis thor ];
+  xdg = buildRubyGem rec {
+    inherit ruby;
+    name = "ruby${ruby.version}-${gemName}-${version}";
+    gemName = "xdg";
+    version = "2.2.3";
+    sha256 = "1bn47fdbwxqbdvjcfg86i32hmwm36k0xl876kb85f5da5v84lzmq";
+  };
+
+  propagatedBuildInputs = [ erubis thor xdg ];
 
   meta = with lib; {
     description = "Manage complex tmux sessions easily";
diff --git a/pkgs/tools/misc/tmuxp/default.nix b/pkgs/tools/misc/tmuxp/default.nix
index 9faa36c13f02..24486980b4ba 100644
--- a/pkgs/tools/misc/tmuxp/default.nix
+++ b/pkgs/tools/misc/tmuxp/default.nix
@@ -2,13 +2,13 @@
 
 pythonPackages.buildPythonApplication rec {
   name = "tmuxp-${version}";
-  version = "1.3.1";
+  version = "1.3.4";
 
   namePrefix = "";
 
   src = fetchurl {
     url = "mirror://pypi/t/tmuxp/${name}.tar.gz";
-    sha256 = "189mxnb2pxj3wjijn56j8y5x1r23fil00fn2q7d6bd13vgr0f85s";
+    sha256 = "149n35rr27n2c6yna1bla20x3w1zz9gxnjj3m3xxdfp4fbsd2y31";
   };
 
   patchPhase = ''
diff --git a/pkgs/tools/misc/toilet/default.nix b/pkgs/tools/misc/toilet/default.nix
index f9fee08d0dd0..2b240e022d81 100644
--- a/pkgs/tools/misc/toilet/default.nix
+++ b/pkgs/tools/misc/toilet/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "1pl118qb7g0frpgl9ps43w4sd0psjirpmq54yg1kqcclqcqbbm49";
   };
 
-  buildInputs = [ pkgconfig libcaca ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libcaca ];
 
   meta = {
     description = "Display large colourful characters in text mode";
diff --git a/pkgs/tools/misc/ttwatch/default.nix b/pkgs/tools/misc/ttwatch/default.nix
new file mode 100644
index 000000000000..2924da5f89a9
--- /dev/null
+++ b/pkgs/tools/misc/ttwatch/default.nix
@@ -0,0 +1,28 @@
+{ stdenv, fetchFromGitHub, cmake, perl, openssl, curl, libusb1 }:
+
+stdenv.mkDerivation rec {
+  name = "ttwatch-${version}";
+  version = "2017-09-26";
+
+  src = fetchFromGitHub {
+    owner = "ryanbinns";
+    repo = "ttwatch";
+    rev = "31fb7ca6ac992d131a3f5ea6acf49f0c52a128c5";
+    sha256 = "1sxjx593jqbq45jn2dkjz07zq9kkgsbcj971phimlm6dj6g75wxq";
+  };
+
+  nativeBuildInputs = [ cmake perl ];
+  buildInputs = [ openssl curl libusb1 ];
+
+  preFixup = ''
+    chmod +x $out/bin/ttbin2mysports
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/ryanbinns/ttwatch;
+    description = "Linux TomTom GPS Watch Utilities";
+    maintainers = with maintainers; [ dotlambda ];
+    license = licenses.mit;
+    platforms = with platforms; linux;
+  };
+}
diff --git a/pkgs/tools/misc/unicode/default.nix b/pkgs/tools/misc/unicode/default.nix
new file mode 100644
index 000000000000..58f5e54fc3a0
--- /dev/null
+++ b/pkgs/tools/misc/unicode/default.nix
@@ -0,0 +1,31 @@
+{ stdenv, fetchFromGitHub, fetchurl, python3Packages }:
+
+python3Packages.buildPythonApplication rec {
+  name = "unicode-${version}";
+  version = "2.5";
+
+  src = fetchFromGitHub {
+    owner = "garabik";
+    repo = "unicode";
+    rev = "v${version}";
+    sha256 = "0vg1zshlzgdva8gzw6fya28fc4jhypjkj743x3q0yabx6934k0g2";
+  };
+
+  ucdtxt = fetchurl {
+    url = http://www.unicode.org/Public/10.0.0/ucd/UnicodeData.txt;
+    sha256 = "1cfak1j753zcrbgixwgppyxhm4w8vda8vxhqymi7n5ljfi6kwhjj";
+  };
+
+  postFixup = ''
+    substituteInPlace "$out/bin/.unicode-wrapped" \
+      --replace "/usr/share/unicode/UnicodeData.txt" "$ucdtxt"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Display unicode character properties";
+    homepage = https://github.com/garabik/unicode;
+    license = licenses.gpl3;
+    maintainers = [ maintainers.woffs ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/tools/misc/urjtag/default.nix b/pkgs/tools/misc/urjtag/default.nix
index 8d9d0073b178..99cd407a9ae4 100644
--- a/pkgs/tools/misc/urjtag/default.nix
+++ b/pkgs/tools/misc/urjtag/default.nix
@@ -17,7 +17,8 @@ stdenv.mkDerivation rec {
     sha256 = "0pyl0y27136nr8mmjdml7zjnfnpbjmgqzkjk99j3hvj38k10wq7f";
   };
 
-  buildInputs = [ gettext pkgconfig autoconf automake libtool bison flex which
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ gettext autoconf automake libtool bison flex which
     subversion makeWrapper readline libftdi libusb python3 ];
 
   configureFlags = ''
diff --git a/pkgs/tools/misc/vdirsyncer/default.nix b/pkgs/tools/misc/vdirsyncer/default.nix
index 731a194cc6a2..382b69722a42 100644
--- a/pkgs/tools/misc/vdirsyncer/default.nix
+++ b/pkgs/tools/misc/vdirsyncer/default.nix
@@ -6,18 +6,19 @@ let
   pythonPackages = python3Packages;
 in
 pythonPackages.buildPythonApplication rec {
-  version = "0.15.0";
+  version = "0.16.3";
   name = "vdirsyncer-${version}";
 
   src = fetchurl {
     url = "mirror://pypi/v/vdirsyncer/${name}.tar.gz";
-    sha256 = "08aa5yxcj7ziz2r0hz4p554q8hgpfl2bh8r6r85f4g24mg6arxsj";
+    sha256 = "0dpwbfi97ksijqng191659m8k0v215y8ld95w8gb126m4m96qpzw";
   };
 
   propagatedBuildInputs = with pythonPackages; [
     click click-log click-threading
     requests_toolbelt
     requests
+    requests_oauthlib # required for google oauth sync
     atomicwrites
   ];
 
diff --git a/pkgs/tools/misc/vorbisgain/default.nix b/pkgs/tools/misc/vorbisgain/default.nix
index 567783f63138..1c108af27f88 100644
--- a/pkgs/tools/misc/vorbisgain/default.nix
+++ b/pkgs/tools/misc/vorbisgain/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with stdenv.lib; {
-    homepage = http://sjeng.org/vorbisgain.html;
+    homepage = https://sjeng.org/vorbisgain.html;
     description = "A utility that corrects the volume of an Ogg Vorbis file to a predefined standardized loudness";
     license = licenses.gpl2;
     platforms = platforms.linux;
diff --git a/pkgs/tools/misc/wakatime/default.nix b/pkgs/tools/misc/wakatime/default.nix
index 0e7cd49b543d..c1091d47c5a8 100644
--- a/pkgs/tools/misc/wakatime/default.nix
+++ b/pkgs/tools/misc/wakatime/default.nix
@@ -1,17 +1,14 @@
-{ stdenv, pythonPackages, fetchFromGitHub }:
+{ stdenv, buildPythonApplication, fetchFromGitHub }:
 
-with pythonPackages;
-
-buildPythonPackage rec {
-  namePrefix = "";
+buildPythonApplication rec {
   name = "wakatime-${version}";
-  version = "7.0.4";
+  version = "10.0.1";
 
   src = fetchFromGitHub {
-    sha256 = "1cddabx9x11d2nxxcqlf4piysjnpfici0n5qy3n9gw81asz1djhf";
-    rev = version;
-    repo = "wakatime";
     owner = "wakatime";
+    repo = "wakatime";
+    rev = version;
+    sha256 = "1bg8fzd3rdc6na0a7z1d55m2gbnfq6d72mf2jlyzc817r6dr4bfx";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/misc/wv/default.nix b/pkgs/tools/misc/wv/default.nix
index a18c03b126ac..59efcaa18095 100644
--- a/pkgs/tools/misc/wv/default.nix
+++ b/pkgs/tools/misc/wv/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "17f16lkdv1c3amaz2hagiicih59ynpp4786k1m2qa1sw68xhswsc";
   };
 
-  buildInputs = [ zlib imagemagick libpng glib pkgconfig libgsf libxml2 bzip2 ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ zlib imagemagick libpng glib libgsf libxml2 bzip2 ];
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/tools/misc/wv2/default.nix b/pkgs/tools/misc/wv2/default.nix
index f39eaf0b047b..b9a8f70ff71a 100644
--- a/pkgs/tools/misc/wv2/default.nix
+++ b/pkgs/tools/misc/wv2/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
 
   patches = [ ./fix-include.patch ];
 
-  buildInputs = [ pkgconfig cmake libgsf glib libxml2 ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ cmake libgsf glib libxml2 ];
 
   NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2";
 
diff --git a/pkgs/tools/misc/xdo/default.nix b/pkgs/tools/misc/xdo/default.nix
index 72b42cdc3b97..b3c97207b1d6 100644
--- a/pkgs/tools/misc/xdo/default.nix
+++ b/pkgs/tools/misc/xdo/default.nix
@@ -1,19 +1,19 @@
-{ stdenv, fetchFromGitHub, libxcb, xcbutilwm }:
+{ stdenv, fetchFromGitHub, libxcb, xcbutil, xcbutilwm }:
 
 stdenv.mkDerivation rec {
    name = "xdo-${version}";
-   version = "0.5.5";
+   version = "0.5.6";
 
    src = fetchFromGitHub {
      owner = "baskerville";
      repo = "xdo";
      rev = version;
-     sha256 = "17i7ym4jrrbsiqs0jnm6k49hp9qn32hswad4j0lavwgv4wawachz";
+     sha256 = "1i8xlsp36ji7cvyh66ajqsf59hxpwm0xvnn9laq7nbajcx3qqlnh";
    };
-   
+
    makeFlags = "PREFIX=$(out)";
 
-   buildInputs = [ libxcb xcbutilwm ];
+   buildInputs = [ libxcb xcbutilwm xcbutil ];
 
    meta = with stdenv.lib; {
      description = "Small X utility to perform elementary actions on windows";
diff --git a/pkgs/tools/misc/xflux/gui.nix b/pkgs/tools/misc/xflux/gui.nix
index 1fd3b3d8371f..d8959687945a 100644
--- a/pkgs/tools/misc/xflux/gui.nix
+++ b/pkgs/tools/misc/xflux/gui.nix
@@ -4,13 +4,13 @@
 }:
 pythonPackages.buildPythonApplication rec {
   name = "xflux-gui-${version}";
-  version = "2016-09-21";
+  version = "1.1.10";
 
   src = fetchFromGitHub {
     repo = "xflux-gui";
     owner = "xflux-gui";
-    rev = "0b56204477494b473a390e8b0db043437ec14f32";
-    sha256 = "15pr8f31jnhqjlpvasnj6cmm6hw5gljphh2pxzav3zd9bp4yl56r";
+    rev = "v${version}";
+    sha256 = "1k67qg9y4c0n9ih0syx81ixbdl2x89gd4arwh71316cshskn0rc8";
   };
 
   propagatedBuildInputs = with pythonPackages; [
@@ -32,7 +32,6 @@ pythonPackages.buildPythonApplication rec {
 
   postFixup = ''
     wrapGAppsHook
-    makeWrapperArgs="''${gappsWrapperArgs[@]}"
     wrapPythonPrograms
     patchPythonScript $out/${pythonPackages.python.sitePackages}/fluxgui/fluxapp.py
   '';
diff --git a/pkgs/tools/misc/xsel/default.nix b/pkgs/tools/misc/xsel/default.nix
index 350cb89846a7..604868f8c490 100644
--- a/pkgs/tools/misc/xsel/default.nix
+++ b/pkgs/tools/misc/xsel/default.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation rec {
     sha256 = "04mrc8j0rr7iy1k6brfxnx26pmxm800gh4nqrxn6j2lz6vd5y9m5";
   };
 
-  buildInputs = [ libX11 autoreconfHook ];
+  nativeBuildInputs = [ autoreconfHook ];
+  buildInputs = [ libX11 ];
 
   # We need a README file, otherwise autoconf complains.
   postUnpack = ''
diff --git a/pkgs/tools/misc/youtube-dl/default.nix b/pkgs/tools/misc/youtube-dl/default.nix
index bf05cd9bf5cd..13d5dec91cee 100644
--- a/pkgs/tools/misc/youtube-dl/default.nix
+++ b/pkgs/tools/misc/youtube-dl/default.nix
@@ -15,11 +15,11 @@ with stdenv.lib;
 buildPythonApplication rec {
 
   name = "youtube-dl-${version}";
-  version = "2017.07.30.1";
+  version = "2017.11.06";
 
   src = fetchurl {
     url = "https://yt-dl.org/downloads/${version}/${name}.tar.gz";
-    sha256 = "1m1n5d06xh8hnild6kssiv9yaq2sm7vy0c8h506v3nff7i9wf0a7";
+    sha256 = "1djq3sf16il6y7n175gv7xwdz2s9lvsvzs38k95cj579l4k0433d";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/misc/yubico-piv-tool/default.nix b/pkgs/tools/misc/yubico-piv-tool/default.nix
index 6ff08e4ac3fa..29e527fe862d 100644
--- a/pkgs/tools/misc/yubico-piv-tool/default.nix
+++ b/pkgs/tools/misc/yubico-piv-tool/default.nix
@@ -1,14 +1,15 @@
 { stdenv, fetchurl, pkgconfig, openssl, pcsclite }:
 
 stdenv.mkDerivation rec {
-  name = "yubico-piv-tool-1.3.0";
+  name = "yubico-piv-tool-1.4.4";
 
   src = fetchurl {
     url = "https://developers.yubico.com/yubico-piv-tool/Releases/${name}.tar.gz";
-    sha256 = "0l9lkzwi2227y5y02i5g1d701bmlyaj8lffv72jks1w4mkh7q7qh";
+    sha256 = "0s9pib3g4lmxw9rjjd5h3ad401150kb1wqrzf8w1bq79g0zsq3mb";
   };
 
-  buildInputs = [ pkgconfig openssl pcsclite ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ openssl pcsclite ];
 
   configureFlags = [ "--with-backend=pcsc" ];
 
diff --git a/pkgs/tools/misc/yubikey-manager/default.nix b/pkgs/tools/misc/yubikey-manager/default.nix
index 820f193e5e25..c7fbeddd13a4 100644
--- a/pkgs/tools/misc/yubikey-manager/default.nix
+++ b/pkgs/tools/misc/yubikey-manager/default.nix
@@ -2,11 +2,11 @@
   yubikey-personalization, libu2f-host, libusb1 }:
 
 pythonPackages.buildPythonPackage rec {
-  name = "yubikey-manager-0.3.1";
+  name = "yubikey-manager-0.4.0";
 
   srcs = fetchurl {
     url = "https://developers.yubico.com/yubikey-manager/Releases/${name}.tar.gz";
-    sha256 = "0vrhaqb8yc1qjq25k9dv8gmqxhbf6aa047i6dvz1lcraq6zwnq6g";
+    sha256 = "0dc0mqg8r6kjh0s2rmrggfxbx9imslajjrj80rffcvg64a2vgsgb";
   };
 
   propagatedBuildInputs =
@@ -16,6 +16,7 @@ pythonPackages.buildPythonPackage rec {
       cryptography
       pyscard
       pyusb
+      pyopenssl
       six
     ] ++ [
       libu2f-host
@@ -32,6 +33,9 @@ pythonPackages.buildPythonPackage rec {
     _YKMAN_COMPLETE=source $out/bin/ykman > $out/etc/bash_completion.d/ykman.sh ||true
   '';
 
+  # See https://github.com/NixOS/nixpkgs/issues/29169
+  doCheck = false;
+
   meta = with lib; {
     homepage = https://developers.yubico.com/yubikey-manager;
     description = "Command line tool for configuring any YubiKey over all USB transports.";
diff --git a/pkgs/tools/networking/aircrack-ng/default.nix b/pkgs/tools/networking/aircrack-ng/default.nix
index 3b7c2926bd49..5a56430c20e9 100644
--- a/pkgs/tools/networking/aircrack-ng/default.nix
+++ b/pkgs/tools/networking/aircrack-ng/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "0dpzx9kddxpgzmgvdpl3rxn0jdaqhm5wxxndp1xd7d75mmmc2fnr";
   };
 
-  buildInputs = [ libpcap openssl zlib libnl pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libpcap openssl zlib libnl ];
 
   patchPhase = ''
     sed -e 's@^prefix.*@prefix = '$out@ -i common.mak
diff --git a/pkgs/tools/networking/argus-clients/default.nix b/pkgs/tools/networking/argus-clients/default.nix
index fe30a1eab826..766ae4116061 100644
--- a/pkgs/tools/networking/argus-clients/default.nix
+++ b/pkgs/tools/networking/argus-clients/default.nix
@@ -19,7 +19,8 @@ stdenv.mkDerivation rec {
 
   configureFlags = "--with-perl=${perl}/bin/perl";
 
-  buildInputs = [ libpcap pkgconfig bison cyrus_sasl tcp_wrappers flex ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libpcap bison cyrus_sasl tcp_wrappers flex ];
 
   meta = with stdenv.lib; {
     description = "Clients for ARGUS";
diff --git a/pkgs/tools/networking/argus/default.nix b/pkgs/tools/networking/argus/default.nix
index 673f98e2f3ad..e5c2aace4006 100644
--- a/pkgs/tools/networking/argus/default.nix
+++ b/pkgs/tools/networking/argus/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "1zzf688dbbcb5z2r9v1p28rddns6znzx35nc05ygza6lp7aknkna";
   };
 
-  buildInputs = [ libpcap pkgconfig bison cyrus_sasl tcp_wrappers flex ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libpcap bison cyrus_sasl tcp_wrappers flex ];
   propagatedBuildInputs = [ procps which wget lsof net_snmp ];
 
   patchPhase = ''
diff --git a/pkgs/tools/networking/aria2/default.nix b/pkgs/tools/networking/aria2/default.nix
index 8e37b85275d1..079beedcc07c 100644
--- a/pkgs/tools/networking/aria2/default.nix
+++ b/pkgs/tools/networking/aria2/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   name = "aria2-${version}";
-  version = "1.32.0";
+  version = "1.33.0";
 
   src = fetchFromGitHub {
     owner = "aria2";
     repo = "aria2";
     rev = "release-${version}";
-    sha256 = "098ahj7nyf5c70221aq5q3aqllb94frz9lzig8rkhqfsa4mmslg5";
+    sha256 = "07i9wrj7bs9770ppx943zgn8j9zvffxg2pib4w5ljxapqldhwrsq";
   };
 
   nativeBuildInputs = [ pkgconfig autoreconfHook ];
diff --git a/pkgs/tools/networking/assh/default.nix b/pkgs/tools/networking/assh/default.nix
new file mode 100644
index 000000000000..e3a147b20b17
--- /dev/null
+++ b/pkgs/tools/networking/assh/default.nix
@@ -0,0 +1,31 @@
+{ stdenv, lib, buildGoPackage, fetchFromGitHub, openssh, makeWrapper }:
+
+buildGoPackage rec {
+  name = "assh-${version}";
+  version = "2.6.0";
+
+  goPackagePath = "github.com/moul/advanced-ssh-config";
+  subPackages = [ "cmd/assh" ];
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  postInstall = ''
+    wrapProgram "$bin/bin/assh" \
+      --prefix PATH : ${openssh}/bin
+  '';
+
+  src = fetchFromGitHub {
+    repo = "advanced-ssh-config";
+    owner = "moul";
+    rev = "v${version}";
+    sha256 = "1vv98dz5822k51xklnmky0lwfjw8nc6ryvn8lmv9n63ppwh9s2s6";
+  };
+
+  meta = with stdenv.lib; {
+    description = "Advanced SSH config - Regex, aliases, gateways, includes and dynamic hosts";
+    homepage = https://github.com/moul/advanced-ssh-config;
+    license = licenses.mit;
+    maintainers = with maintainers; [ zzamboni ];
+    platforms = with platforms; linux ++ darwin;
+  };
+}
diff --git a/pkgs/tools/networking/axel/default.nix b/pkgs/tools/networking/axel/default.nix
index 322a1a06289e..b19d4cca315d 100644
--- a/pkgs/tools/networking/axel/default.nix
+++ b/pkgs/tools/networking/axel/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "axel-${version}";
-  version = "2.13.1";
+  version = "2.15";
 
   src = fetchurl {
     url = "mirror://debian/pool/main/a/axel/axel_${version}.orig.tar.gz";
-    sha256 = "15bi5wx6fyf9k0y03dy5mk2rv06mrfgiyrlh44add9n07wi574p1";
+    sha256 = "0wm16s129615i7rw48422q3x3ixr4v2p9942p0s6qk2fjlc3y8hf";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/pkgs/tools/networking/badvpn/default.nix b/pkgs/tools/networking/badvpn/default.nix
index 22da8486a80b..c9ebc12b0db8 100644
--- a/pkgs/tools/networking/badvpn/default.nix
+++ b/pkgs/tools/networking/badvpn/default.nix
@@ -9,13 +9,15 @@ let
     url="https://github.com/ambrop72/badvpn/archive/1.999.130.tar.gz";
     sha256="02b1fra43l75mljkhrq45vcrrqv0znicjn15g7nbqx3jppzbpm5z";
   };
+
   buildInputs = [
-    cmake openssl nss pkgconfig nspr
+    cmake openssl nss nspr
   ];
   compileFlags = "-O3 ${stdenv.lib.optionalString (!debug) "-DNDEBUG"}";
 in
 stdenv.mkDerivation {
   inherit (s) name version;
+  nativeBuildInputs = [ pkgconfig ];
   inherit buildInputs;
   src = fetchurl {
     inherit (s) url sha256;
diff --git a/pkgs/tools/networking/bgpdump/default.nix b/pkgs/tools/networking/bgpdump/default.nix
new file mode 100644
index 000000000000..55b168a21aec
--- /dev/null
+++ b/pkgs/tools/networking/bgpdump/default.nix
@@ -0,0 +1,21 @@
+{ stdenv, fetchzip, autoreconfHook, zlib, bzip2 }:
+
+stdenv.mkDerivation rec {
+  name = "bgpdump-2017-09-29";
+
+  src = fetchzip {
+    url = "https://bitbucket.org/ripencc/bgpdump/get/94a0e724b335.zip";
+    sha256 = "09g9vz2zc4nyzl669w1j7fxw21ifja6dxbp0xbqh6n7w3gpx2g88";
+  };
+
+  nativeBuildInputs = [ autoreconfHook ];
+  buildInputs = [ zlib bzip2 ];
+
+  meta = {
+    homepage = https://bitbucket.org/ripencc/bgpdump/wiki/Home;
+    description = ''Analyze dump files produced by Zebra/Quagga or MRT'';
+    license = stdenv.lib.licenses.hpnd;
+    maintainers = with stdenv.lib.maintainers; [ lewo ];
+    platforms = with stdenv.lib.platforms; linux;
+  };
+}
diff --git a/pkgs/tools/networking/bully/default.nix b/pkgs/tools/networking/bully/default.nix
index 3410d0e2c5c9..81dd294d786a 100644
--- a/pkgs/tools/networking/bully/default.nix
+++ b/pkgs/tools/networking/bully/default.nix
@@ -1,13 +1,15 @@
-{stdenv, fetchFromGitHub, openssl, libpcap}:
+{ stdenv, fetchFromGitHub, openssl, libpcap }:
 
 stdenv.mkDerivation rec {
+
   name = "bully-${version}";
-  version = "1.0-22";
+  version = "1.1";
+
   src = fetchFromGitHub {
-    sha256 = "0wk9jmcibd03gspnnr2qvfkw57rg94cwmi0kjpy1mgi05s6vlw1y";
-    rev = "v${version}";
+    sha256 = "1qvbbf72ryd85bp4v62fk93ag2sn25rj7kipgagbv22hnq8yl3zd";
+    rev = version;
     repo = "bully";
-    owner = "HorayNarea";
+    owner = "aanarchyy";
   };
   buildInputs = [ openssl libpcap ];
 
@@ -21,11 +23,11 @@ stdenv.mkDerivation rec {
     mv bully $out/bin
   '';
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "Retrieve WPA/WPA2 passphrase from a WPS enabled access point";
-    homepage = https://github.com/Lrs121/bully;
-    maintainers = [ stdenv.lib.maintainers.edwtjo ];
-    license = stdenv.lib.licenses.gpl3;
-    platforms = stdenv.lib.platforms.linux;
+    homepage = https://github.com/aanarchyy/bully;
+    maintainers = with maintainers; [ edwtjo ];
+    license = licenses.gpl3;
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/tools/networking/ccnet/default.nix b/pkgs/tools/networking/ccnet/default.nix
index 22237794f079..24c86f4fa9a6 100644
--- a/pkgs/tools/networking/ccnet/default.nix
+++ b/pkgs/tools/networking/ccnet/default.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation rec
     sha256 = "0q4a102xlcsxlr53h4jr4w8qzkbzvm2f3nk9fsha48h6l2hw34bb";
   };
 
-  buildInputs = [ which automake autoconf pkgconfig libtool vala_0_23 python ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ which automake autoconf libtool vala_0_23 python ];
   propagatedBuildInputs = [ libsearpc libzdb libuuid libevent sqlite openssl ];
 
   preConfigure = ''
diff --git a/pkgs/tools/networking/chrony/default.nix b/pkgs/tools/networking/chrony/default.nix
index b805a4bfcf32..5ddb663a4ae5 100644
--- a/pkgs/tools/networking/chrony/default.nix
+++ b/pkgs/tools/networking/chrony/default.nix
@@ -6,11 +6,11 @@ assert stdenv.isLinux -> libcap != null;
 stdenv.mkDerivation rec {
   name = "chrony-${version}";
 
-  version = "3.1";
+  version = "3.2";
 
   src = fetchurl {
     url = "http://download.tuxfamily.org/chrony/${name}.tar.gz";
-    sha256 = "0xb03dya1zhcn1gch2v2ynifxw95g8m3plr9q4ys0s3pvgf0g4cx";
+    sha256 = "05j17i1zlg19v8jkzlp710kbdgnb4541zgkqxqzcwglcvlc6g7rj";
   };
 
   buildInputs = [ readline texinfo nss nspr ]
diff --git a/pkgs/tools/networking/cjdns/default.nix b/pkgs/tools/networking/cjdns/default.nix
index 12a8a1a184fe..d5819639fa2c 100644
--- a/pkgs/tools/networking/cjdns/default.nix
+++ b/pkgs/tools/networking/cjdns/default.nix
@@ -1,12 +1,14 @@
-{ stdenv, fetchurl, fetchpatch, nodejs, which, python27, utillinux }:
+{ stdenv, fetchFromGitHub, nodejs, which, python27, utillinux }:
 
 let version = "20"; in
 stdenv.mkDerivation {
   name = "cjdns-"+version;
 
-  src = fetchurl {
-    url = "https://github.com/cjdelisle/cjdns/archive/cjdns-v${version}.tar.gz";
-    sha256 = "1dyqxi9l2pmrgm16a161909rg3vfzvib40frr7p6ddpk8yfh5888";
+  src = fetchFromGitHub {
+    owner = "cjdelisle";
+    repo = "cjdns";
+    rev = "cjdns-v${version}";
+    sha256 = "0gqcspiz1n0j711vwq807cy456dkcf03r376l04qc92173g2fzrx";
   };
 
   buildInputs = [ which python27 nodejs ] ++
@@ -31,6 +33,6 @@ stdenv.mkDerivation {
     description = "Encrypted networking for regular people";
     license = licenses.gpl3;
     maintainers = with maintainers; [ ehmry ];
-    platforms = platforms.unix;
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/tools/networking/connman/default.nix b/pkgs/tools/networking/connman/default.nix
index 5e4966a374bd..0dc3d02d154b 100644
--- a/pkgs/tools/networking/connman/default.nix
+++ b/pkgs/tools/networking/connman/default.nix
@@ -4,10 +4,10 @@
 
 stdenv.mkDerivation rec {
   name = "connman-${version}";
-  version = "1.34";
+  version = "1.35";
   src = fetchurl {
     url = "mirror://kernel/linux/network/connman/${name}.tar.xz";
-    sha256 = "07n71wcy1c4cc01ca4dl9k1jpdqr5nsyr33dqf7k87wwfa681859";
+    sha256 = "1apj5j25kj7v1bsfv3nh54aiq873nfrsjfbj85p5qm3ihfwxxmv6";
   };
 
   buildInputs = [ openconnect polkit
diff --git a/pkgs/tools/networking/connmanui/default.nix b/pkgs/tools/networking/connmanui/default.nix
index b5866c2ee130..7c42cc965a00 100644
--- a/pkgs/tools/networking/connmanui/default.nix
+++ b/pkgs/tools/networking/connmanui/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "0ixx8c9cfdp480z21xfjb7n1x27sf1g8gmgbmcfhr0k888dmziyy";
   };
 
-  buildInputs = [ autoconf automake libtool glib gtk3 dbus pkgconfig file intltool connman ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ autoconf automake libtool glib gtk3 dbus file intltool connman ];
 
   preConfigure = ''
     rm m4/intltool.m4
diff --git a/pkgs/tools/networking/curl-unix-socket/default.nix b/pkgs/tools/networking/curl-unix-socket/default.nix
index 985cb0c3015a..d145e1e12c3a 100644
--- a/pkgs/tools/networking/curl-unix-socket/default.nix
+++ b/pkgs/tools/networking/curl-unix-socket/default.nix
@@ -11,8 +11,8 @@ stdenv.mkDerivation {
   };
 
   buildInputs = [ go ];
-  buildPhase = "go build";
-  installPhase = "install -D curl-unix-socket* $out/bin/curl-unix-socket";
+  buildPhase = "go build -o curl-unix-socket";
+  installPhase = "install -D curl-unix-socket $out/bin/curl-unix-socket";
 
   meta = with stdenv.lib; {
     description = "Run HTTP requests over UNIX socket";
diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index 4d292abc9acf..d67b34371fe2 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -21,11 +21,11 @@ assert scpSupport -> libssh2 != null;
 assert c-aresSupport -> c-ares != null;
 
 stdenv.mkDerivation rec {
-  name = "curl-7.55.0";
+  name = "curl-7.56.1";
 
   src = fetchurl {
     url = "http://curl.haxx.se/download/${name}.tar.bz2";
-    sha256 = "1cg5h0klsx887qd4wpkk5bpkbw1bfc4q7adsrai71zhmdzn6j7dg";
+    sha256 = "142zidvlmrz31yx480nrhh47hl01d7jbaagin23pspl7cw1ng515";
   };
 
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
@@ -68,14 +68,10 @@ stdenv.mkDerivation rec {
     ++ stdenv.lib.optional c-aresSupport "--enable-ares=${c-ares}"
     ++ stdenv.lib.optional gssSupport "--with-gssapi=${gss}";
 
-  CXX = "g++";
-  CXXCPP = "g++ -E";
+  CXX = "c++";
+  CXXCPP = "c++ -E";
 
   postInstall = ''
-    pushd docs/libcurl
-    make install
-    popd
-
     moveToOutput bin/curl-config "$dev"
     sed '/^dependency_libs/s|${libssh2.dev}|${libssh2.out}|' -i "$out"/lib/*.la
   '' + stdenv.lib.optionalString gnutlsSupport ''
diff --git a/pkgs/tools/networking/davix/default.nix b/pkgs/tools/networking/davix/default.nix
index 37226d3dd7b2..3be2b0401bc4 100644
--- a/pkgs/tools/networking/davix/default.nix
+++ b/pkgs/tools/networking/davix/default.nix
@@ -2,7 +2,8 @@
 
 stdenv.mkDerivation rec {
   name = "davix-0.6.4";
-  buildInputs = [ stdenv pkgconfig cmake openssl libxml2 boost ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ stdenv cmake openssl libxml2 boost ];
 
   src = fetchFromGitHub {
     owner = "cern-it-sdc-id";
diff --git a/pkgs/tools/networking/dhcpcd/default.nix b/pkgs/tools/networking/dhcpcd/default.nix
index 7204ddd5e06f..d8316c66203d 100644
--- a/pkgs/tools/networking/dhcpcd/default.nix
+++ b/pkgs/tools/networking/dhcpcd/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "17nnhxmbdcc7k2mh6sgvxisqcqbic5540xbig363ds97gvf795kg";
   };
 
-  buildInputs = [ pkgconfig udev ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ udev ];
 
   configureFlags = [
     "--sysconfdir=/etc"
diff --git a/pkgs/tools/networking/dibbler/default.nix b/pkgs/tools/networking/dibbler/default.nix
index 82ef3b218d08..fd306a0bcca3 100644
--- a/pkgs/tools/networking/dibbler/default.nix
+++ b/pkgs/tools/networking/dibbler/default.nix
@@ -13,6 +13,8 @@ stdenv.mkDerivation rec {
     "--enable-resolvconf"
   ];
 
+  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isDarwin "-D__APPLE_USE_RFC_2292=1";
+
   meta = with stdenv.lib; {
     description = "Portable DHCPv6 implementation";
     homepage = http://www.klub.com.pl/dhcpv6/;
diff --git a/pkgs/tools/networking/djbdns/default.nix b/pkgs/tools/networking/djbdns/default.nix
new file mode 100644
index 000000000000..b8a7133e7bc7
--- /dev/null
+++ b/pkgs/tools/networking/djbdns/default.nix
@@ -0,0 +1,50 @@
+{ stdenv, fetchurl, glibc, dns-root-data } :
+
+let
+  version = "1.05";
+
+  manSrc = fetchurl {
+    url = "http://smarden.org/pape/djb/manpages/djbdns-${version}-man-20031023.tar.gz";
+    sha256 = "0sg51gjy6j1hnrra406q1qhf5kvk1m00y8qqhs6r0a699gqmh75s";
+  };
+
+in
+
+stdenv.mkDerivation {
+  name = "djbdns-${version}";
+
+  src = fetchurl {
+    url = "https://cr.yp.to/djbdns/djbdns-${version}.tar.gz";
+    sha256 = "0j3baf92vkczr5fxww7rp1b7gmczxmmgrqc8w2dy7kgk09m85k9w";
+  };
+
+  patches = [ ./hier.patch ./fix-nix-usernamespace-build.patch ];
+
+  postPatch = ''
+    echo gcc -O2 -include ${glibc.dev}/include/errno.h > conf-cc
+    echo $out > conf-home
+    # djbdns ships with an outdated list of root servers
+    awk '/^.?.ROOT-SERVERS.NET/ { print $4 }' ${dns-root-data}/root.hints > dnsroots.global
+    sed -i "s|/etc/dnsroots.global|$out/etc/dnsroots.global|" dnscache-conf.c
+  '';
+
+  installPhase = ''
+    mkdir -pv $out/etc;
+    make setup
+    cd $out;
+    tar xzvf ${manSrc};
+    for n in 1 5 8; do
+      mkdir -p man/man$n;
+      mv -iv djbdns-man/*.$n man/man$n;
+    done;
+    rm -rv djbdns-man;
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A collection of Domain Name System tools";
+    longDescription = "Includes software for all the fundamental DNS operations: DNS cache: finding addresses of Internet hosts; DNS server: publishing addresses of Internet hosts; and DNS client: talking to a DNS cache.";
+    homepage = https://cr.yp.to/djbdns.html;
+    license = licenses.publicDomain;
+    maintainers = with maintainers; [ jerith666 ];
+  };
+}
diff --git a/pkgs/tools/networking/djbdns/fix-nix-usernamespace-build.patch b/pkgs/tools/networking/djbdns/fix-nix-usernamespace-build.patch
new file mode 100644
index 000000000000..abd9e756a21f
--- /dev/null
+++ b/pkgs/tools/networking/djbdns/fix-nix-usernamespace-build.patch
@@ -0,0 +1,10 @@
+--- djbdns-1.05.org/chkshsgr.c	2001-02-11 21:11:45.000000000 +0000
++++ djbdns-1.05/chkshsgr.c	2017-10-13 10:06:09.392578927 +0100
+@@ -2,6 +2,7 @@
+ 
+ int main()
+ {
++  return 0;
+   short x[4];
+ 
+   x[0] = x[1] = 0;
diff --git a/pkgs/tools/networking/djbdns/hier.patch b/pkgs/tools/networking/djbdns/hier.patch
new file mode 100644
index 000000000000..7fddd1213834
--- /dev/null
+++ b/pkgs/tools/networking/djbdns/hier.patch
@@ -0,0 +1,15 @@
+--- a/hier.c	2016-04-19 21:22:21.992192405 -0400
++++ b/hier.c	2016-04-19 21:22:33.160229778 -0400
+@@ -2,9 +2,9 @@
+ 
+ void hier()
+ {
+-  c("/","etc","dnsroots.global",-1,-1,0644);
++  c(auto_home,"etc","dnsroots.global",-1,-1,0644);
+ 
+-  h(auto_home,-1,-1,02755);
+-  d(auto_home,"bin",-1,-1,02755);
++  h(auto_home,-1,-1,0755);
++  d(auto_home,"bin",-1,-1,0755);
+ 
+   c(auto_home,"bin","dnscache-conf",-1,-1,0755);
diff --git a/pkgs/tools/networking/dnscrypt-wrapper/default.nix b/pkgs/tools/networking/dnscrypt-wrapper/default.nix
index 9e7167989e48..1282c72452f4 100644
--- a/pkgs/tools/networking/dnscrypt-wrapper/default.nix
+++ b/pkgs/tools/networking/dnscrypt-wrapper/default.nix
@@ -2,15 +2,17 @@
 
 stdenv.mkDerivation rec {
   name = "dnscrypt-wrapper-${version}";
-  version = "0.2.2";
+  version = "0.3";
 
   src = fetchFromGitHub {
     owner = "Cofyc";
     repo = "dnscrypt-wrapper";
     rev = "v${version}";
-    sha256 = "0ip205safbpkmk1z7qf3hshqlc2q2zwhsm3i705m0y7rxc4200ms";
+    sha256 = "0wnkgn0ajx1qmfyb264jvpqxlbravdcq4m485iaa3wjp82g8xlca";
   };
 
+  enableParallelBuilding = true;
+
   nativeBuildInputs = [ pkgconfig autoreconfHook ];
   buildInputs = [ libsodium libevent ];
 
diff --git a/pkgs/tools/networking/dnsmasq/default.nix b/pkgs/tools/networking/dnsmasq/default.nix
index 801d41c852b8..badf33074465 100644
--- a/pkgs/tools/networking/dnsmasq/default.nix
+++ b/pkgs/tools/networking/dnsmasq/default.nix
@@ -11,11 +11,11 @@ let
   ]);
 in
 stdenv.mkDerivation rec {
-  name = "dnsmasq-2.77";
+  name = "dnsmasq-2.78";
 
   src = fetchurl {
     url = "http://www.thekelleys.org.uk/dnsmasq/${name}.tar.xz";
-    sha256 = "12lbbwpy1wxi6n5dngv30x8g8v13apdnvjgq7w71f9dfa0f3pb3f";
+    sha256 = "0ar5h5v3kas2qx2wgy5iqin15gc4jhqrqs067xacgc3lii1rz549";
   };
 
   preBuild = ''
diff --git a/pkgs/tools/networking/dnstracer/default.nix b/pkgs/tools/networking/dnstracer/default.nix
new file mode 100644
index 000000000000..6d5e826c7d75
--- /dev/null
+++ b/pkgs/tools/networking/dnstracer/default.nix
@@ -0,0 +1,27 @@
+{ stdenv, fetchurl, libresolv }:
+
+stdenv.mkDerivation rec {
+  version = "1.9";
+  name = "dnstracer";
+
+  src = fetchurl {
+    url = "http://www.mavetju.org/download/dnstracer-${version}.tar.gz";
+    sha256 = "177y58smnq2xhx9lbmj1gria371iv3r1d132l2gjvflkjsphig1f";
+  };
+
+  outputs = [ "out" "man" ];
+
+  setOutputFlags = false;
+
+  buildInputs = [] ++ stdenv.lib.optionals stdenv.isDarwin [ libresolv ];
+
+  NIX_LDFLAGS = stdenv.lib.optionalString stdenv.isDarwin "-lresolv";
+
+  meta = with stdenv.lib; {
+    description = "Dnstracer determines where a given Domain Name Server (DNS) gets its information from, and follows the chain of DNS servers back to the servers which know the data.";
+    homepage = http://www.mavetju.org/unix/general.php;
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ andir ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/tools/networking/driftnet/default.nix b/pkgs/tools/networking/driftnet/default.nix
index 1f34952ad24b..5b39ca464601 100644
--- a/pkgs/tools/networking/driftnet/default.nix
+++ b/pkgs/tools/networking/driftnet/default.nix
@@ -8,8 +8,9 @@ stdenv.mkDerivation rec {
   name = "driftnet-${version}";
   version = "1.1.5";
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    pkgconfig libpcap libjpeg libungif libpng giflib
+    libpcap libjpeg libungif libpng giflib
     glib gtk2 glib cairo pango gdk_pixbuf atk autoreconfHook
   ];
 
diff --git a/pkgs/tools/networking/eggdrop/default.nix b/pkgs/tools/networking/eggdrop/default.nix
index a9f2419b1368..12d9da87b39b 100644
--- a/pkgs/tools/networking/eggdrop/default.nix
+++ b/pkgs/tools/networking/eggdrop/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
   '';
 
   configureFlags = [
-    "--with-tcllib=${tcl}/lib/lib${tcl.libPrefix}.so"
+    "--with-tcllib=${tcl}/lib/lib${tcl.libPrefix}${stdenv.hostPlatform.extensions.sharedLibrary}"
     "--with-tclinc=${tcl}/include/tcl.h"
   ];
 
diff --git a/pkgs/tools/networking/envoy/default.nix b/pkgs/tools/networking/envoy/default.nix
index 79a24ea1f8dd..83af542b8ad4 100644
--- a/pkgs/tools/networking/envoy/default.nix
+++ b/pkgs/tools/networking/envoy/default.nix
@@ -1,6 +1,6 @@
 { stdenv, lib, fetchFromGitHub, pkgconfig, bazel, c-ares, backward-cpp
 , libevent, gtest, gperftools, http-parser, lightstep-tracer-cpp
-, nghttp2, protobuf3_2, tclap, rapidjson, spdlog, boringssl, buildEnv
+, nghttp2, protobuf, tclap, rapidjson, spdlog, boringssl, buildEnv
 }:
 
 let
@@ -85,7 +85,7 @@ let
     };
 
     protobuf = {
-      pkg = protobuf3_2;
+      pkg = protobuf;
       srcs = ''glob(["lib/libproto*.so"])'';
       hdrs = ''glob(["include/google/protobuf/**/*.h"])'';
       includes = ''["include"]'';
@@ -201,7 +201,7 @@ let
     http-parser
     lightstep-tracer-cpp
     nghttp2
-    protobuf3_2
+    protobuf
     tclap
     rapidjson
     spdlog
@@ -233,7 +233,7 @@ stdenv.mkDerivation rec {
 
   patches = [ ./nixos.patch ];
 
-  hardeningDisable = "all";
+  hardeningDisable = [ "all" ];
   dontPatchELF = true;
   dontStrip = true;
 
diff --git a/pkgs/tools/networking/fastd/default.nix b/pkgs/tools/networking/fastd/default.nix
index 3a99adb4a9ef..ef356935c56a 100644
--- a/pkgs/tools/networking/fastd/default.nix
+++ b/pkgs/tools/networking/fastd/default.nix
@@ -11,6 +11,11 @@ stdenv.mkDerivation rec {
     sha256 = "0c9v3igv3812b3jr7jk75a2np658yy00b3i4kpbpdjgvqzc1jrq8";
   };
 
+  postPatch = ''
+    substituteInPlace src/crypto/cipher/CMakeLists.txt \
+      --replace 'add_subdirectory(aes128_ctr)' ""
+  '';
+
   nativeBuildInputs = [ pkgconfig bison cmake ];
   buildInputs = [ libuecc libsodium libcap json_c ];
 
diff --git a/pkgs/tools/networking/fdm/default.nix b/pkgs/tools/networking/fdm/default.nix
index 0061620b58d1..3984922abe28 100644
--- a/pkgs/tools/networking/fdm/default.nix
+++ b/pkgs/tools/networking/fdm/default.nix
@@ -1,45 +1,31 @@
-{ stdenv, fetchurl
-  , openssl, tdb, zlib, flex, bison
-  }:
-let 
-  buildInputs = [ openssl tdb zlib flex bison ];
-  sourceInfo = rec {
-    baseName="fdm";
-    version = "1.8";
-    name="${baseName}-${version}";
-    url="mirror://sourceforge/${baseName}/${baseName}/${name}.tar.gz";
-    sha256 = "0hi39f31ipv8f9wxb41pajvl61w6vaapl39wq8v1kl9c7q6h0k2g";
-  };
+{ stdenv, fetchFromGitHub, autoreconfHook, openssl, tdb, zlib, flex, bison }:
+
+let
+
+  baseName = "fdm";
+  version = "1.9.0.20170124";
+
 in
-stdenv.mkDerivation {
-  src = fetchurl {
-    inherit (sourceInfo) url sha256;
+
+stdenv.mkDerivation rec {
+  name = "${baseName}-${version}";
+
+  src = fetchFromGitHub {
+    owner = "nicm";
+    repo = baseName;
+    rev = "cae4ea37b6b296d1b2e48f62934ea3a7f6085e33";
+    sha256 = "048191wdv1yprwinipmx2152gvd2iq1ssv7xfb1bzh6zirh1ya3n";
   };
 
-  inherit (sourceInfo) name version;
-  inherit buildInputs;
-
-  preBuild = ''
-    export makeFlags="$makeFlags PREFIX=$out"
-    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -Dbool=int"
-
-    sed -i */Makefile -i Makefile -e 's@ -g bin @ @'
-    sed -i */Makefile -i Makefile -e 's@ -o root @ @'
-    sed -i GNUmakefile -e 's@ -g $(BIN_OWNER) @ @'
-    sed -i GNUmakefile -e 's@ -o $(BIN_GROUP) @ @'
-    sed -i */Makefile -i Makefile -i GNUmakefile -e 's@-I-@@g'
-  '';
-      
-  meta = {
+  nativeBuildInputs = [ autoreconfHook ];
+  buildInputs = [ openssl tdb zlib flex bison ];
+
+
+  meta = with stdenv.lib; {
     description = "Mail fetching and delivery tool - should do the job of getmail and procmail";
-    maintainers = with stdenv.lib.maintainers;
-    [
-      raskin
-    ];
-    platforms = with stdenv.lib.platforms;
-      linux;
-    homepage = http://fdm.sourceforge.net/;
-    inherit (sourceInfo) version;
-    updateWalker = true;
+    maintainers = with maintainers; [ raskin ];
+    platforms = with platforms; linux;
+    homepage = https://github.com/nicm/fdm;
+    downloadPage = https://github.com/nicm/fdm/releases;
   };
 }
diff --git a/pkgs/tools/networking/ferm/default.nix b/pkgs/tools/networking/ferm/default.nix
index 454605893823..a0b298f3f4ec 100644
--- a/pkgs/tools/networking/ferm/default.nix
+++ b/pkgs/tools/networking/ferm/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, makeWrapper, perl, ebtables, ipset, iptables }:
 
 stdenv.mkDerivation rec {
-  version = "2.3.1";
+  version = "2.4.1";
   name = "ferm-${version}";
 
   src = fetchurl {
-    url = "http://ferm.foo-projects.org/download/2.3/ferm-${version}.tar.gz";
-    sha256 = "1scdnd2jk4787jyr6fxav2598g0x7hjic5b8bj77j8s0hki48m4a";
+    url = "http://ferm.foo-projects.org/download/2.4/ferm-${version}.tar.xz";
+    sha256 = "1fv8wk513yysp4q0i65rl2m0hg2lxwwgk9ppprsca1xcxrdpsvwa";
   };
 
   buildInputs = [ perl ipset ebtables iptables makeWrapper ];
diff --git a/pkgs/tools/networking/getmail/default.nix b/pkgs/tools/networking/getmail/default.nix
index b8bd9c0910a4..ff5a6c1eaeea 100644
--- a/pkgs/tools/networking/getmail/default.nix
+++ b/pkgs/tools/networking/getmail/default.nix
@@ -1,13 +1,13 @@
 { stdenv, fetchurl, python2Packages }:
 
 python2Packages.buildPythonApplication rec {
-  version = "4.54.0";
+  version = "5.4";
   name = "getmail-${version}";
   namePrefix = "";
 
   src = fetchurl {
     url = "http://pyropus.ca/software/getmail/old-versions/${name}.tar.gz";
-    sha256 = "0r9s91zrdm6xklnj1fwzz74cxhkbmrgrrp86n62qgijkafa5fmnl";
+    sha256 = "1iwss9z94p165gxr2yw7s9q12a0bn71fcdbikzkykr5s7xxnz2ds";
   };
 
   doCheck = false;
diff --git a/pkgs/tools/networking/gftp/default.nix b/pkgs/tools/networking/gftp/default.nix
index b122f532630d..312906f95100 100644
--- a/pkgs/tools/networking/gftp/default.nix
+++ b/pkgs/tools/networking/gftp/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation {
     sha256 = "1z8b26n23k0sjbxgrix646b06cnpndpq7cbcj0ilsvvdx5ms81jk";
   };
 
-  buildInputs = [ gtk2 readline ncurses gettext openssl pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ gtk2 readline ncurses gettext openssl ];
 
   meta = { 
     description = "GTK+-based FTP client";
diff --git a/pkgs/tools/networking/gmvault/default.nix b/pkgs/tools/networking/gmvault/default.nix
index ba22d1d679c9..06eb196c7a7e 100644
--- a/pkgs/tools/networking/gmvault/default.nix
+++ b/pkgs/tools/networking/gmvault/default.nix
@@ -21,6 +21,7 @@ pythonPackages.buildPythonApplication rec {
     cat ${startScript} > etc/scripts/gmvault
     chmod +x etc/scripts/gmvault
     substituteInPlace setup.py --replace "==" ">="
+    substituteInPlace setup.py --replace "argparse" ""
   '';
 
   meta = {
diff --git a/pkgs/tools/networking/goklp/default.nix b/pkgs/tools/networking/goklp/default.nix
new file mode 100644
index 000000000000..88a6b74686c2
--- /dev/null
+++ b/pkgs/tools/networking/goklp/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, buildGoPackage, fetchFromGitHub }:
+
+buildGoPackage rec {
+  name = "goklp-${version}";
+  version = "1.6";
+
+  goPackagePath = "github.com/AppliedTrust/goklp";
+
+  src = fetchFromGitHub {
+    owner = "AppliedTrust";
+    repo = "goklp";
+    rev = "v${version}";
+    sha256 = "054qmwfaih8qbvdyy4rqbb1ip3jpnm547n390hgab8yc3bdd840c";
+  };
+
+  goDeps = ./deps.nix;
+
+  meta = with stdenv.lib; {
+    description = "Golang OpenSSH Keys Ldap Provider for AuthorizedKeysCommand";
+    homepage = https://github.com/AppliedTrust/goklp;
+    maintainers = with maintainers; [ disassembler ];
+    license = licenses.bsd2;
+  };
+}
diff --git a/pkgs/tools/networking/goklp/deps.nix b/pkgs/tools/networking/goklp/deps.nix
new file mode 100644
index 000000000000..2f6481f237f8
--- /dev/null
+++ b/pkgs/tools/networking/goklp/deps.nix
@@ -0,0 +1,56 @@
+[
+  {
+    goPackagePath = "github.com/asaskevich/govalidator";
+    fetch = {
+      type = "git";
+      url = "https://github.com/asaskevich/govalidator";
+      rev = "ca5f9e638c83bac66bfac70ded5bded1503135a7";
+      sha256 = "0lk4irlf4a4q8qharwjxl71y1s2cf5bjpg9cv5jlyp574331pn1w";
+    };
+  }
+  {
+    goPackagePath = "github.com/docopt/docopt-go";
+    fetch = {
+      type = "git";
+      url = "https://github.com/docopt/docopt-go";
+      rev = "784ddc588536785e7299f7272f39101f7faccc3f";
+      sha256 = "0wwz48jl9fvl1iknvn9dqr4gfy1qs03gxaikrxxp9gry6773v3sj";
+    };
+  }
+  {
+    goPackagePath = "github.com/kardianos/osext";
+    fetch = {
+      type = "git";
+      url = "https://github.com/kardianos/osext";
+      rev = "ae77be60afb1dcacde03767a8c37337fad28ac14";
+      sha256 = "056dkgxrqjj5r18bnc3knlpgdz5p3yvp12y4y978hnsfhwaqvbjz";
+    };
+  }
+  {
+    goPackagePath = "github.com/vaughan0/go-ini";
+    fetch = {
+      type = "git";
+      url = "https://github.com/vaughan0/go-ini";
+      rev = "a98ad7ee00ec53921f08832bc06ecf7fd600e6a1";
+      sha256 = "1l1isi3czis009d9k5awsj4xdxgbxn4n9yqjc1ac7f724x6jacfa";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/asn1-ber.v1";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/asn1-ber.v1";
+      rev = "379148ca0225df7a432012b8df0355c2a2063ac0";
+      sha256 = "1y8bvzbxpw0lfnn7pbcdwzqj4l90qj6xf88dvv9pxd9yl5g6cskx";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/ldap.v2";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/ldap.v2";
+      rev = "8168ee085ee43257585e50c6441aadf54ecb2c9f";
+      sha256 = "1w0993i8bl8sap01gwm1v6hjp0rsanj2mbpyabwcwnns2g79n895";
+    };
+  }
+]
diff --git a/pkgs/tools/networking/gupnp-tools/default.nix b/pkgs/tools/networking/gupnp-tools/default.nix
index ea78cdd106ac..fcbf5a4e1b2a 100644
--- a/pkgs/tools/networking/gupnp-tools/default.nix
+++ b/pkgs/tools/networking/gupnp-tools/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "1vbr4iqi7nl7kq982agd3liw10gx67s95idd0pjy5h1jsnwyqgda";
   };
 
-  buildInputs = [gupnp libuuid gssdp pkgconfig gtk3 intltool gupnp_av
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [gupnp libuuid gssdp gtk3 intltool gupnp_av
                  gnome2.gnome_icon_theme makeWrapper];
 
   postInstall = ''
diff --git a/pkgs/tools/networking/haproxy/default.nix b/pkgs/tools/networking/haproxy/default.nix
index 332edce45cd4..06c595f7c6d4 100644
--- a/pkgs/tools/networking/haproxy/default.nix
+++ b/pkgs/tools/networking/haproxy/default.nix
@@ -10,13 +10,13 @@ assert usePcre -> pcre != null;
 stdenv.mkDerivation rec {
   pname = "haproxy";
   majorVersion = "1.7";
-  minorVersion = "8";
+  minorVersion = "9";
   version = "${majorVersion}.${minorVersion}";
   name = "${pname}-${version}";
 
   src = fetchurl {
-    url = "http://www.haproxy.org/download/${majorVersion}/src/${name}.tar.gz";
-    sha256 = "0hp1k957idaphhmw4m0x8cdzdw9ga1mzgsnk2m0as86xrqy1b47c";
+    url = "https://www.haproxy.org/download/${majorVersion}/src/${name}.tar.gz";
+    sha256 = "1072337e54fa188dc6e0cfe3ba4c2200b07082e321cbfe5a0882d85d54db068e";
   };
 
   buildInputs = [ openssl zlib ]
diff --git a/pkgs/tools/networking/htpdate/default.nix b/pkgs/tools/networking/htpdate/default.nix
index 10ed8f34e3a6..47163b94dc52 100644
--- a/pkgs/tools/networking/htpdate/default.nix
+++ b/pkgs/tools/networking/htpdate/default.nix
@@ -1,24 +1,26 @@
-{ stdenv, fetchurl, coreutils, binutils }:
+{ stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  version = "1.1.3";
+  version = "1.2.0";
   name = "htpdate-${version}";
 
   src = fetchurl {
-    url = "http://twekkel.home.xs4all.nl/htp/htpdate-${version}.tar.gz";
-    sha256 = "0hfg4qrsmpqw03m9qwf3zgi4brbf65w6wd3w30nkamc7x8b4vn5i";
+    url = "http://www.vervest.org/htp/archive/c/${name}.tar.xz";
+    sha256 = "00xwppq3aj951m0srjvxmr17kiaaflyjmbfkvpnfs3jvqhzczci2";
   };
 
-  installFlags = [
-    "INSTALL=${coreutils}/bin/install"
-    "STRIP=${binutils}/bin/strip"
+  makeFlags = [
+    "INSTALL=install"
+    "STRIP=${stdenv.cc.bintools.prefix}strip"
     "prefix=$(out)"
   ];
 
-  meta = {
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
     description = "Utility to fetch time and set the system clock over HTTP";
     homepage = http://www.vervest.org/htp/;
-    platforms = stdenv.lib.platforms.linux;
-    license = stdenv.lib.licenses.gpl2Plus;
+    platforms = platforms.unix;
+    license = licenses.gpl2Plus;
   };
 }
diff --git a/pkgs/tools/networking/http-prompt/default.nix b/pkgs/tools/networking/http-prompt/default.nix
index 5f6f0466f630..83ad64a66a4a 100644
--- a/pkgs/tools/networking/http-prompt/default.nix
+++ b/pkgs/tools/networking/http-prompt/default.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchFromGitHub, pythonPackages, httpie }:
 
 pythonPackages.buildPythonApplication rec {
-  version = "0.10.2";
+  version = "0.11.0";
   name = "http-prompt";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     repo = "http-prompt";
     owner = "eliangcs";
-    sha256 = "0c03n1ll61zd4f60kzih3skl0hspck5hhpcf74h5l6v5as7qdbi2";
+    sha256 = "0arl85880nnyfx8cvpzm6cr8nalhyrkz5zqfr628p487rwqv45ip";
   };
 
   propagatedBuildInputs = with pythonPackages; [
diff --git a/pkgs/tools/networking/httpie/default.nix b/pkgs/tools/networking/httpie/default.nix
index b445dd93c4c0..ef50c0ce0847 100644
--- a/pkgs/tools/networking/httpie/default.nix
+++ b/pkgs/tools/networking/httpie/default.nix
@@ -2,7 +2,6 @@
 
 pythonPackages.buildPythonApplication rec {
   name = "httpie-0.9.9";
-  namePrefix = "";
 
   src = fetchurl {
     url = "mirror://pypi/h/httpie/${name}.tar.gz";
diff --git a/pkgs/tools/networking/hyenae/default.nix b/pkgs/tools/networking/hyenae/default.nix
index a7d42b773172..cbcaee4de784 100644
--- a/pkgs/tools/networking/hyenae/default.nix
+++ b/pkgs/tools/networking/hyenae/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation {
     sha256 = "1f3x4yn9a9p4f4wk4l8pv7hxfjc8q7cv20xzf7ky735sq1hj0xcg";
   };
 
-  buildInputs = [libdnet pkgconfig libpcap];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [libdnet libpcap];
 
   meta = {
     description = "";
diff --git a/pkgs/tools/networking/i2p/default.nix b/pkgs/tools/networking/i2p/default.nix
index e13ada5994cd..cf26ec61139b 100644
--- a/pkgs/tools/networking/i2p/default.nix
+++ b/pkgs/tools/networking/i2p/default.nix
@@ -27,10 +27,10 @@ let wrapper = stdenv.mkDerivation rec {
 in
 
 stdenv.mkDerivation rec {
-  name = "i2p-0.9.30";
+  name = "i2p-0.9.31";
   src = fetchurl {
     url = "https://github.com/i2p/i2p.i2p/archive/${name}.tar.gz";
-    sha256 = "03hrirmah3ba9ygql487jy233nsxkfjyz82mmyppazi0mcgiass1";
+    sha256 = "1v2my5jqcj8zidxij34h0lpa533rr6ianzz8yld01sxi6gg41w28";
   };
   buildInputs = [ jdk ant gettext which ];
   patches = [ ./i2p.patch ];
diff --git a/pkgs/tools/networking/i2pd/default.nix b/pkgs/tools/networking/i2pd/default.nix
index 8d2ac5ce9d73..66057e5c76e7 100644
--- a/pkgs/tools/networking/i2pd/default.nix
+++ b/pkgs/tools/networking/i2pd/default.nix
@@ -4,13 +4,13 @@ stdenv.mkDerivation rec {
 
   name = pname + "-" + version;
   pname = "i2pd";
-  version = "2.14.0";
+  version = "2.15.0";
 
   src = fetchFromGitHub {
     owner = "PurpleI2P";
     repo = pname;
     rev = version;
-    sha256 = "1nlnzvb4n351zwg4vd15qjmm8xvbmn2350vfnd249q06va62fqjk";
+    sha256 = "02nyk76q2ag0495ph62i0jij27nxpy6qvryjp25wah8f69k7bgfs";
   };
 
   buildInputs = [ boost zlib openssl ];
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = https://i2pd.website;
     description = "Minimal I2P router written in C++";
-    license = licenses.gpl2;
+    license = licenses.bsd3;
     maintainers = with maintainers; [ edwtjo ];
     platforms = platforms.linux;
   };
diff --git a/pkgs/tools/networking/ifstat-legacy/default.nix b/pkgs/tools/networking/ifstat-legacy/default.nix
new file mode 100644
index 000000000000..8b7f4e1c2a04
--- /dev/null
+++ b/pkgs/tools/networking/ifstat-legacy/default.nix
@@ -0,0 +1,30 @@
+{ stdenv, fetchurl, autoreconfHook, net_snmp }:
+
+stdenv.mkDerivation rec {
+  name = "ifstat-legacy-${version}";
+  version = "1.1";
+
+  src = fetchurl {
+    url = "http://gael.roualland.free.fr/ifstat/ifstat-${version}.tar.gz";
+    sha256 = "01zmv6vk5kh5xmd563xws8a1qnxjb6b6kv59yzz9r3rrghxhd6c5";
+  };
+
+  buildInputs = [ net_snmp ];
+
+  nativeBuildInputs = [ autoreconfHook ];
+
+  enableParallelBuilding = true;
+
+  postInstall = ''
+    mv $out/bin/ifstat $out/bin/ifstat-legacy
+    mv $out/share/man/man1/ifstat.1 $out/share/man/man1/ifstat-legacy.1
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Report network interfaces bandwith just like vmstat/iostat do for other system counters - legacy version";
+    homepage    = http://gael.roualland.free.fr/ifstat/;
+    maintainers = with maintainers; [ peterhoeg ];
+    platforms   = platforms.unix;
+    license     = licenses.gpl2;
+  };
+}
diff --git a/pkgs/tools/networking/iouyap/default.nix b/pkgs/tools/networking/iouyap/default.nix
new file mode 100644
index 000000000000..c37b409cdfb5
--- /dev/null
+++ b/pkgs/tools/networking/iouyap/default.nix
@@ -0,0 +1,28 @@
+{ stdenv, fetchFromGitHub, bison, flex }:
+
+stdenv.mkDerivation rec {
+  name = "${pname}-${version}";
+  pname = "iouyap";
+  version = "0.97";
+
+  src = fetchFromGitHub {
+    owner = "GNS3";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "028s9kx67b9x7gwzg0fhc6546diw4n0x4kk1xhl3v7hbsz3wdh6s";
+  };
+
+  buildInputs = [ bison flex ];
+
+  installPhase = ''
+    install -D -m555 iouyap $out/bin/iouyap;
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Bridge IOU to UDP, TAP and Ethernet";
+    inherit (src.meta) homepage;
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ primeos ];
+  };
+}
diff --git a/pkgs/tools/networking/isync/default.nix b/pkgs/tools/networking/isync/default.nix
index 761dc01d2f98..7dcfc6b512fb 100644
--- a/pkgs/tools/networking/isync/default.nix
+++ b/pkgs/tools/networking/isync/default.nix
@@ -1,14 +1,15 @@
-{ fetchurl, stdenv, openssl, pkgconfig, db, cyrus_sasl }:
+{ fetchurl, stdenv, openssl, pkgconfig, db, cyrus_sasl, perl }:
 
 stdenv.mkDerivation rec {
-  name = "isync-1.2.1";
+  name = "isync-1.3.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/isync/${name}.tar.gz";
-    sha256 = "1bij6nm06ghkg98n2pdyacam2fyg5y8f7ajw0d5653m0r4ldw5p7";
+    sha256 = "173wd7x8y5sp94slzwlnb7zhgs32r57zl9xspl2rf4g3fqwmhpwd";
   };
 
-  buildInputs = [ openssl pkgconfig db cyrus_sasl ];
+  nativeBuildInputs = [ pkgconfig perl ];
+  buildInputs = [ openssl db cyrus_sasl ];
 
   meta = with stdenv.lib; {
     homepage = http://isync.sourceforge.net/;
diff --git a/pkgs/tools/networking/jnettop/default.nix b/pkgs/tools/networking/jnettop/default.nix
index ec2f34f56010..19626174ba4c 100644
--- a/pkgs/tools/networking/jnettop/default.nix
+++ b/pkgs/tools/networking/jnettop/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "1855np7c4b0bqzhf1l1dyzxb90fpnvrirdisajhci5am6als31z9";
   };
 
-  buildInputs = [ autoconf libpcap ncurses pkgconfig glib ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ autoconf libpcap ncurses glib ];
 
   patches = [
     ./no-dns-resolution.patch
diff --git a/pkgs/tools/networking/kea/default.nix b/pkgs/tools/networking/kea/default.nix
index e1829bcaf7d8..68fb72ff7d9e 100644
--- a/pkgs/tools/networking/kea/default.nix
+++ b/pkgs/tools/networking/kea/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, autoreconfHook, pkgconfig, openssl, botan, log4cplus
+{ stdenv, fetchurl, autoreconfHook, pkgconfig, openssl, botan2, log4cplus
 , boost, python3, postgresql, mysql, gmp, bzip2 }:
 
 stdenv.mkDerivation rec {
@@ -20,7 +20,6 @@ stdenv.mkDerivation rec {
 
   configureFlags = [
     "--localstatedir=/var"
-    "--with-botan-config=${botan}/bin/botan-config-1.10"
     "--with-dhcp-pgsql=${postgresql}/bin/pg_config"
     "--with-dhcp-mysql=${mysql.client.dev}/bin/mysql_config"
   ];
@@ -28,7 +27,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
   buildInputs = [
     openssl log4cplus boost python3 mysql.client
-    botan gmp bzip2
+    botan2 gmp bzip2
   ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/tools/networking/lftp/default.nix b/pkgs/tools/networking/lftp/default.nix
index 67181d8aec36..3e4f1eaeeefe 100644
--- a/pkgs/tools/networking/lftp/default.nix
+++ b/pkgs/tools/networking/lftp/default.nix
@@ -1,20 +1,24 @@
-{ stdenv, fetchurl, gnutls, pkgconfig, readline, zlib, libidn, gmp, libiconv }:
+{ stdenv, fetchurl, gnutls, pkgconfig, readline, zlib, libidn2, gmp, libiconv, libunistring, gettext }:
 
 stdenv.mkDerivation rec {
   name = "lftp-${version}";
-  version = "4.8.0";
+  version = "4.8.3";
 
   src = fetchurl {
     urls = [
-      "https://lftp.tech/ftp/${name}.tar.bz2"
-      "ftp://ftp.st.ryukoku.ac.jp/pub/network/ftp/lftp/${name}.tar.bz2"
-      "http://lftp.yar.ru/ftp/old/${name}.tar.bz2"
+      "https://lftp.tech/ftp/${name}.tar.xz"
+      "https://ftp.st.ryukoku.ac.jp/pub/network/ftp/lftp/${name}.tar.xz"
+      "http://lftp.yar.ru/ftp/${name}.tar.xz"
       ];
-    sha256 = "0z2432zxzg808swi72yak9kia976qrjj030grk0v4p54mcib3s34";
+    sha256 = "12y77jlfs4x4zvcah92mw2h2sb4j0bvbaxkh3wwsm8gs392ywyny";
   };
 
   nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ gnutls readline zlib libidn gmp libiconv ];
+
+  buildInputs = [ gnutls readline zlib libidn2 gmp libiconv libunistring ]
+    ++ stdenv.lib.optional stdenv.isDarwin gettext;
+
+  hardeningDisable = stdenv.lib.optional stdenv.isDarwin "format";
 
   configureFlags = [
     "--with-readline=${readline.dev}"
@@ -24,7 +28,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "A file transfer program supporting a number of network protocols";
-    homepage = http://lftp.tech/;
+    homepage = https://lftp.tech/;
     license = licenses.gpl3;
     platforms = platforms.unix;
     maintainers = [ maintainers.bjornfor ];
diff --git a/pkgs/tools/networking/libreswan/default.nix b/pkgs/tools/networking/libreswan/default.nix
index de7f38314fc6..59e33e818702 100644
--- a/pkgs/tools/networking/libreswan/default.nix
+++ b/pkgs/tools/networking/libreswan/default.nix
@@ -24,8 +24,8 @@ stdenv.mkDerivation {
     sha256 = "0zginnakxw7m79zrdvfdvliaiyg78zgqfqkks9z5d1rjj5w13xig";
   };
 
-  nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ pkgconfig bash iproute iptables systemd coreutils gnused gawk gmp unbound bison flex pam libevent
+  nativeBuildInputs = [ makeWrapper pkgconfig ];
+  buildInputs = [ bash iproute iptables systemd coreutils gnused gawk gmp unbound bison flex pam libevent
                   libcap_ng curl nspr nss python ]
                 ++ optional docs xmlto;
 
diff --git a/pkgs/tools/networking/lldpd/default.nix b/pkgs/tools/networking/lldpd/default.nix
index 5a97f2219ce6..1ce9f7cb3230 100644
--- a/pkgs/tools/networking/lldpd/default.nix
+++ b/pkgs/tools/networking/lldpd/default.nix
@@ -3,17 +3,18 @@
 
 stdenv.mkDerivation rec {
   name = "lldpd-${version}";
-  version = "0.9.7";
+  version = "0.9.8";
 
   src = fetchurl {
     url = "https://media.luffy.cx/files/lldpd/${name}.tar.gz";
-    sha256 = "1f0d5s4643pjmgycc5ssgl1pggyq5a7navhabkyhcg0aqdah6dmr";
+    sha256 = "0kwck17cr2f1a395a8bfmj7fz1n4i1hv429cbdbkhff33glr9r4y";
   };
 
   configureFlags = [
     "--localstatedir=/var"
     "--enable-pie"
     "--with-snmp"
+    "--with-systemdsystemunitdir=\${out}/lib/systemd/system"
   ];
 
   nativeBuildInputs = [ pkgconfig removeReferencesTo ];
diff --git a/pkgs/tools/networking/maildrop/default.nix b/pkgs/tools/networking/maildrop/default.nix
index da36ef727c2d..950a6e310ebd 100644
--- a/pkgs/tools/networking/maildrop/default.nix
+++ b/pkgs/tools/networking/maildrop/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "1a94p2b41iy334cwfwmzi19557dn5j61abh0cp2rfc9dkc8ibhdg";
   };
 
-  buildInputs = [ pkgconfig pcre perl ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ pcre perl ];
 
   patches = [ ./maildrop.configure.hack.patch ]; # for building in chroot
 
diff --git a/pkgs/tools/networking/minidlna/default.nix b/pkgs/tools/networking/minidlna/default.nix
index 9e8e0c180d7e..56a101b31573 100644
--- a/pkgs/tools/networking/minidlna/default.nix
+++ b/pkgs/tools/networking/minidlna/default.nix
@@ -1,13 +1,13 @@
 { stdenv, fetchurl, ffmpeg, flac, libvorbis, libogg, libid3tag, libexif, libjpeg, sqlite, gettext }:
 
-let version = "1.1.5"; in
+let version = "1.2.1"; in
 
 stdenv.mkDerivation {
   name = "minidlna-${version}";
 
   src = fetchurl {
     url = "mirror://sourceforge/project/minidlna/minidlna/${version}/minidlna-${version}.tar.gz";
-    sha256 = "16xb2nz8g1dwcail1zmpj8s426pygz0fdpd6ip6zaamv2q2asxw4";
+    sha256 = "1v1ffhmaqxpvf2vv4yyvjsks4skr9y088853awsh7ixh7ai8nf37";
   };
 
   preConfigure = ''
@@ -28,7 +28,7 @@ stdenv.mkDerivation {
       MiniDLNA (aka ReadyDLNA) is server software with the aim of being fully
       compliant with DLNA/UPnP-AV clients.
     '';
-    homepage = http://sourceforge.net/projects/minidlna/;
+    homepage = https://sourceforge.net/projects/minidlna/;
     license = licenses.gpl2;
     platforms = platforms.linux;
   };
diff --git a/pkgs/tools/networking/mitmproxy/default.nix b/pkgs/tools/networking/mitmproxy/default.nix
index 7d36b6b4ac77..f96987a1300b 100644
--- a/pkgs/tools/networking/mitmproxy/default.nix
+++ b/pkgs/tools/networking/mitmproxy/default.nix
@@ -1,41 +1,38 @@
-{ stdenv, fetchpatch, fetchFromGitHub, python3Packages }:
+{ stdenv, fetchpatch, fetchFromGitHub, fetchurl, python3, glibcLocales }:
 
-python3Packages.buildPythonPackage rec {
+python3.pkgs.buildPythonPackage rec {
   baseName = "mitmproxy";
-  name = "${baseName}-${version}";
-  version = "2.0.2";
+  name = "${baseName}-unstable-2017-10-31";
 
   src = fetchFromGitHub {
     owner = baseName;
     repo = baseName;
-    rev = "v${version}";
-    sha256 = "1x1a28al5clpfd69rjcpw26gjjnpsm1vfl4scrwpdd1jhkw044h9";
+    rev = "80a8eaa708ea31dd9c5e7e1ab6b02c69079039c0";
+    sha256 = "0rvwm11yryzlp3c1i42rk2iv1m38yn6r83k41jb51hwg6wzbwzvw";
   };
 
-  patches = [
-    # Bump pyopenssl dependency
-    # https://github.com/mitmproxy/mitmproxy/pull/2252
-    (fetchpatch {
-      url = "https://patch-diff.githubusercontent.com/raw/mitmproxy/mitmproxy/pull/2252.patch";
-      sha256 = "1smld21df79249qbh412w8gi2agcf4zjhxnlawy19yjl1fk2h67c";
-    })
-  ];
+  checkPhase = ''
+    export HOME=$(mktemp -d)
+    # test_echo resolves hostnames
+    LC_CTYPE=en_US.UTF-8 pytest -k 'not test_echo and not test_find_unclaimed_URLs '
+  '';
 
-  propagatedBuildInputs = with python3Packages; [
-    blinker click certifi construct cryptography
-    cssutils editorconfig h2 html2text hyperframe
-    jsbeautifier kaitaistruct passlib pyasn1 pyopenssl
+  propagatedBuildInputs = with python3.pkgs; [
+    blinker click certifi cryptography
+    h2 hyperframe
+    kaitaistruct passlib pyasn1 pyopenssl
     pyparsing pyperclip requests ruamel_yaml tornado
-    urwid watchdog brotlipy sortedcontainers
+    urwid brotlipy sortedcontainers ldap3
   ];
 
-  # Tests fail due to an error with a decorator
-  doCheck = false;
+  buildInputs = with python3.pkgs; [
+    beautifulsoup4 flask pytest pytestrunner glibcLocales
+  ];
 
   meta = with stdenv.lib; {
     description = "Man-in-the-middle proxy";
     homepage = http://mitmproxy.org/;
     license = licenses.mit;
-    maintainers = with maintainers; [ fpletz ];
+    maintainers = with maintainers; [ fpletz kamilchm ];
   };
 }
diff --git a/pkgs/tools/networking/mitmproxy/tornado-4.6.patch b/pkgs/tools/networking/mitmproxy/tornado-4.6.patch
new file mode 100644
index 000000000000..879b8a4c3794
--- /dev/null
+++ b/pkgs/tools/networking/mitmproxy/tornado-4.6.patch
@@ -0,0 +1,11 @@
+--- mitmproxy-v2.0.2-src.org/setup.py	2017-08-28 07:31:51.727424688 +0100
++++ mitmproxy-v2.0.2-src/setup.py	2017-08-28 07:35:55.608919302 +0100
+@@ -78,7 +78,7 @@
+         "pyperclip>=1.5.22, <1.6",
+         "requests>=2.9.1, <3",
+         "ruamel.yaml>=0.13.2, <0.14",
+-        "tornado>=4.3, <4.5",
++        "tornado>=4.3, <4.6",
+         "urwid>=1.3.1, <1.4",
+         "watchdog>=0.8.3, <0.9",
+         "brotlipy>=0.5.1, <0.7",
diff --git a/pkgs/tools/networking/modemmanager/default.nix b/pkgs/tools/networking/modemmanager/default.nix
index dc4e246c02fb..36c56ac98477 100644
--- a/pkgs/tools/networking/modemmanager/default.nix
+++ b/pkgs/tools/networking/modemmanager/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   name = "ModemManager-${version}";
-  version = "1.6.2";
+  version = "1.6.8";
 
   src = fetchurl {
     url = "http://www.freedesktop.org/software/ModemManager/${name}.tar.xz";
-    sha256 = "14v31j916h63z7af107rias1zbb2y94p3jg77zhzhrn1v6c46m74";
+    sha256 = "0xj3ng7qcqxkib5qkprwghcivaz0mn449fw08l67h1zbpz23bh7z";
   };
 
   nativeBuildInputs = [ intltool pkgconfig ];
diff --git a/pkgs/tools/networking/mosh/default.nix b/pkgs/tools/networking/mosh/default.nix
index 1f465bc4f8a8..e66209c7ce95 100644
--- a/pkgs/tools/networking/mosh/default.nix
+++ b/pkgs/tools/networking/mosh/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "05hjhlp6lk8yjcy59zywpf0r6s0h0b9zxq0lw66dh9x8vxrhaq6s";
   };
 
-  buildInputs = [ autoreconfHook protobuf ncurses zlib pkgconfig IOTty makeWrapper perl openssl ];
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  buildInputs = [ protobuf ncurses zlib IOTty makeWrapper perl openssl ];
 
   patches = [ ./ssh_path.patch ];
   postPatch = ''
diff --git a/pkgs/tools/networking/mtr/default.nix b/pkgs/tools/networking/mtr/default.nix
index 03a0c99c4213..8932360c7176 100644
--- a/pkgs/tools/networking/mtr/default.nix
+++ b/pkgs/tools/networking/mtr/default.nix
@@ -1,34 +1,40 @@
-{stdenv, fetchurl, autoreconfHook, pkgconfig, ncurses
-, withGtk ? false, gtk2 ? null}:
+{ stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, ncurses
+, withGtk ? false, gtk2 ? null }:
 
 assert withGtk -> gtk2 != null;
 
-with stdenv.lib;
 stdenv.mkDerivation rec {
-  baseName="mtr";
-  version="0.87";
-  name="${baseName}-${version}";
-
-  src = fetchurl {
-    url="ftp://ftp.bitwizard.nl/${baseName}/${name}.tar.gz";
-    sha256 = "17zi99n8bdqrwrnbfyjn327jz4gxx287wrq3vk459c933p34ff8r";
+  name="mtr-${version}";
+  version="0.92";
+
+  src = fetchFromGitHub {
+    owner  = "traviscross";
+    repo   = "mtr";
+    rev    = "v${version}";
+    sha256 = "0ca2ml846cv0zzkpd8y7ah6i9b3czrr8wlxja3cray94ybwb294d";
   };
 
-  preConfigure = "substituteInPlace Makefile.in --replace ' install-exec-hook' ''";
+  preConfigure = ''
+    echo ${version} > .tarball-version
+
+    ./bootstrap.sh
+
+    substituteInPlace Makefile.in --replace ' install-exec-hook' ""
+  '';
 
-  configureFlags = optionalString (!withGtk) "--without-gtk";
+  configureFlags = stdenv.lib.optionalString (!withGtk) "--without-gtk";
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
 
-  buildInputs = [ ncurses ] ++ optional withGtk gtk2;
+  buildInputs = [ ncurses ] ++ stdenv.lib.optional withGtk gtk2;
 
   enableParallelBuilding = true;
 
-  meta = {
-    homepage = http://www.bitwizard.nl/mtr/;
+  meta = with stdenv.lib; {
     description = "A network diagnostics tool";
+    homepage    = http://www.bitwizard.nl/mtr/;
+    license     = licenses.gpl2;
     maintainers = with maintainers; [ koral orivej raskin ];
-    platforms = platforms.unix;
-    license = licenses.gpl2;
+    platforms   = platforms.unix;
   };
 }
diff --git a/pkgs/tools/networking/nat-traverse/default.nix b/pkgs/tools/networking/nat-traverse/default.nix
new file mode 100644
index 000000000000..a352596eed05
--- /dev/null
+++ b/pkgs/tools/networking/nat-traverse/default.nix
@@ -0,0 +1,37 @@
+{ stdenv, fetchurl, perl }:
+
+stdenv.mkDerivation rec {
+  name = "nat-traverse-${version}";
+  version = "0.7";
+
+  src = fetchurl {
+    url = "https://www.speicherleck.de/iblech/nat-traverse/nat-traverse-${version}.tar.bz2";
+    sha256 = "0knwnqsjwv7sa5wjb863ghabs7s269a73qwkmxpsbngjw9s0j2ih";
+  };
+
+  nativeBuildInputs = [ perl ];
+
+  installPhase = ''
+    mkdir -p $out/bin $out/share/man/man1
+    cp nat-traverse $out/bin
+    gzip -c nat-traverse.1 > $out/share/man/man1/nat-traverse.1.gz
+  '';
+
+  meta = with stdenv.lib; {
+    description = "NAT gateway traversal utility";
+    longDescription = ''
+      nat-traverse establishes direct connections between nodes which are
+      behind NAT gateways, i.e. hosts which do not have public IP addresses.
+      This is done using an UDP NAT traversal technique. Additionally, it's
+      possible to setup a small VPN by using pppd on top of nat-traverse.
+
+      nat-traverse does not need an external server on the Internet, and it
+      isn't necessary to reconfigure the involved NAT gateways, either.
+      nat-traverse works out-of-the-box.
+    '';
+    homepage = https://www.speicherleck.de/iblech/nat-traverse/;
+    license = licenses.gpl3Plus;
+    platforms = platforms.all;
+    maintainers = [ maintainers.iblech ];
+  };
+}
diff --git a/pkgs/tools/networking/ndjbdns/default.nix b/pkgs/tools/networking/ndjbdns/default.nix
index 3269f92d7f42..255d430a3a5d 100644
--- a/pkgs/tools/networking/ndjbdns/default.nix
+++ b/pkgs/tools/networking/ndjbdns/default.nix
@@ -13,7 +13,8 @@ stdenv.mkDerivation rec {
     sha256 = "0gjyvn8r66kp49gasd6sqfvg2pj0c6v67hnq7cqwl04kj69rfy86";
   };
 
-  buildInputs = [ autoreconfHook pkgconfig ]
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  buildInputs = [ ]
     ++ optional stdenv.isLinux systemd;
 
   meta = {
diff --git a/pkgs/tools/networking/netalyzr/default.nix b/pkgs/tools/networking/netalyzr/default.nix
new file mode 100644
index 000000000000..8f8cf929e9d4
--- /dev/null
+++ b/pkgs/tools/networking/netalyzr/default.nix
@@ -0,0 +1,30 @@
+{ stdenv, fetchurl, jre, makeWrapper }:
+
+stdenv.mkDerivation rec {
+  name = "netalyzr-${version}";
+  version = "57861";
+
+  # unfortunately there is not a version specific download URL
+  src = fetchurl {
+    url    = "http://netalyzr.icsi.berkeley.edu/NetalyzrCLI.jar";
+    sha256 = "0fa3gvgp05p1nf1d711052wgvnp0xnvhj2h2bwk1mh1ih8qn50xb";
+  };
+
+  phases = [ "installPhase" ];
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  installPhase = ''
+    mkdir -p $out/{bin,share/netalyzr}
+    install -m644 $src $out/share/netalyzr/NetalyzrCLI.jar
+    makeWrapper ${stdenv.lib.getBin jre}/bin/java $out/bin/netalyzr \
+      --add-flags "-jar $out/share/netalyzr/NetalyzrCLI.jar"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Network debugging and analysis tool";
+    homepage    = http://netalyzr.icsi.berkeley.edu;
+    maintainers = with maintainers; [ peterhoeg ];
+    platforms   = platforms.all;
+  };
+}
diff --git a/pkgs/tools/networking/netcat-openbsd/default.nix b/pkgs/tools/networking/netcat-openbsd/default.nix
index 2ac9c5cf6e97..7c22891ab7a3 100644
--- a/pkgs/tools/networking/netcat-openbsd/default.nix
+++ b/pkgs/tools/networking/netcat-openbsd/default.nix
@@ -1,17 +1,18 @@
 {stdenv, fetchurl, pkgconfig, libbsd}:
 
 stdenv.mkDerivation rec {
-  name = "netcat-openbsd-1.105";
-  version = "1.105";
+  version = "1.130";
+  deb-version = "${version}-3";
+  name = "netcat-openbsd-${version}";
 
   srcs = [
     (fetchurl {
-      url = "mirror://debian/pool/main/n/netcat-openbsd/netcat-openbsd_1.105.orig.tar.gz";
-      sha256 = "07i1vcz8ycnfwsvz356rqmim8akfh8yhjzmhc5mqf5hmdkk3yra0";
+      url = "mirror://debian/pool/main/n/netcat-openbsd/netcat-openbsd_${version}.orig.tar.gz";
+      sha256 = "0nqy14yvclgzs98gv0fwp6jlfpfy2kk367zka648jiqbbl30awpx";
     })
     (fetchurl {
-      url = "mirror://debian/pool/main/n/netcat-openbsd/netcat-openbsd_1.105-7.debian.tar.gz";
-      sha256 = "0qxkhbwcifrps34s5mzzg79cmkvz3f96gphd3pl978pygwr5krzf";
+      url = "mirror://debian/pool/main/n/netcat-openbsd/netcat-openbsd_${deb-version}.debian.tar.xz";
+      sha256 = "0f9409vjm6v8a7m1zf5sr7wj6v5v8414i5vvxx1r45c11h69hh9a";
     })
   ];
 
@@ -26,10 +27,11 @@ stdenv.mkDerivation rec {
     install -Dm0644 nc.1 $out/share/man/man1/nc.1
   '';
 
-  meta = {
-    homepage = http://packages.debian.org/netcat-openbsd;
+  meta = with stdenv.lib; {
+    homepage = https://packages.debian.org/netcat-openbsd;
     description = "TCP/IP swiss army knife, OpenBSD variant";
-    platforms = stdenv.lib.platforms.linux;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ willibutz ];
   };
 
 }
diff --git a/pkgs/tools/networking/netmask/default.nix b/pkgs/tools/networking/netmask/default.nix
new file mode 100644
index 000000000000..52727163704b
--- /dev/null
+++ b/pkgs/tools/networking/netmask/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, fetchFromGitHub, autoreconfHook, texinfo }:
+
+stdenv.mkDerivation rec {
+  name = "netmask-${version}";
+  version = "2.4.3";
+
+  src = fetchFromGitHub {
+    owner = "tlby";
+    repo = "netmask";
+    rev = "v${version}";
+    sha256 = "1n6b9f60j7hfdbpbppgkhz3lr7pg963bxnfrq95i1d49xmx41f87";
+  };
+
+  buildInputs = [ texinfo ];
+  nativeBuildInputs = [ autoreconfHook ];
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/tlby/netmask;
+    description = "An IP address formatting tool ";
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.jensbin ];
+  };
+}
diff --git a/pkgs/tools/networking/netsniff-ng/default.nix b/pkgs/tools/networking/netsniff-ng/default.nix
index 5ca3079a084f..b0921375849d 100644
--- a/pkgs/tools/networking/netsniff-ng/default.nix
+++ b/pkgs/tools/networking/netsniff-ng/default.nix
@@ -14,6 +14,8 @@ stdenv.mkDerivation rec {
     sha256 = "1lz4hwgwdq3znlqjmvl7cw3g3ilbayn608h0hwqdf7v2jq6n67kg";
   };
 
+  patches = [ ./glibc-2.26.patch ];
+
   buildInputs = [ bison flex geoip geolite-legacy libcli libnet libnl
     libnetfilter_conntrack libpcap libsodium liburcu ncurses perl
     pkgconfig zlib ];
diff --git a/pkgs/tools/networking/netsniff-ng/glibc-2.26.patch b/pkgs/tools/networking/netsniff-ng/glibc-2.26.patch
new file mode 100644
index 000000000000..2ee7b478e9b2
--- /dev/null
+++ b/pkgs/tools/networking/netsniff-ng/glibc-2.26.patch
@@ -0,0 +1,24 @@
+diff --git a/built_in.h b/built_in.h
+index da04dbd..7acc183 100644
+--- a/built_in.h
++++ b/built_in.h
+@@ -10,6 +10,7 @@
+ #include <endian.h>
+ #include <byteswap.h>
+ #include <asm/byteorder.h>
++#include <string.h>
+ 
+ typedef uint64_t	u64;
+ typedef uint32_t	u32;
+diff --git a/staging/tools.c b/staging/tools.c
+index 9d2d1be..909b059 100644
+--- a/staging/tools.c
++++ b/staging/tools.c
+@@ -55,6 +55,7 @@
+ ////////////////////////////////////////////////////////////////////////////////////////////
+ 
+ #include "mz.h"
++#include <stdint.h>
+ 
+ #define CMP_INT(a, b) ((a) < (b) ? -1 : (a) > (b))
+ #define IPV6_MAX_RANGE_LEN strlen("ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff-ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff/128")
diff --git a/pkgs/tools/networking/network-manager-applet/default.nix b/pkgs/tools/networking/network-manager-applet/default.nix
index c596ea63f4d3..fc320ba2fb96 100644
--- a/pkgs/tools/networking/network-manager-applet/default.nix
+++ b/pkgs/tools/networking/network-manager-applet/default.nix
@@ -1,30 +1,36 @@
 { stdenv, fetchurl, intltool, pkgconfig, libglade, networkmanager, gnome3
-, libnotify, libsecret, polkit, isocodes, modemmanager, librsvg
+, libnotify, libsecret, polkit, isocodes, modemmanager
 , mobile_broadband_provider_info, glib_networking, gsettings_desktop_schemas
-, makeWrapper, udev, libgudev, hicolor_icon_theme, jansson, wrapGAppsHook, webkitgtk }:
+, udev, libgudev, hicolor_icon_theme, jansson, wrapGAppsHook, webkitgtk
+, withGnome ? false }:
 
 stdenv.mkDerivation rec {
   name    = "${pname}-${major}.${minor}";
   pname   = "network-manager-applet";
-  major   = "1.4";
-  minor   = "6";
+  major   = "1.8";
+  minor   = "2";
 
   src = fetchurl {
     url    = "mirror://gnome/sources/${pname}/${major}/${name}.tar.xz";
-    sha256 = "0xpcdwqmnwiqqqsd5rx1gh5rvv5m2skj59bqxhccy1k2ikzgr9hh";
+    sha256 = "09f9hjpn9nkhw57mk6pi7q1bq3lhf5hvmwas0fknscssak7yjmry";
   };
 
-  configureFlags = [ "--sysconfdir=/etc" ];
+  configureFlags = [
+    "--sysconfdir=/etc"
+    "--without-selinux"
+  ];
+
+  outputs = [ "out" "dev" ];
 
   buildInputs = [
     gnome3.gtk libglade networkmanager libnotify libsecret gsettings_desktop_schemas
-    polkit isocodes makeWrapper udev libgudev gnome3.gconf gnome3.libgnome_keyring
-    modemmanager jansson librsvg glib_networking gnome3.dconf webkitgtk
-  ];
+    polkit isocodes udev libgudev gnome3.libgnome_keyring
+    modemmanager jansson glib_networking
+  ] ++ stdenv.lib.optional withGnome webkitgtk;
 
   nativeBuildInputs = [ intltool pkgconfig wrapGAppsHook ];
 
-  propagatedUserEnvPkgs = [ gnome3.gconf gnome3.gnome_keyring hicolor_icon_theme ];
+  propagatedUserEnvPkgs = [ gnome3.gnome_keyring hicolor_icon_theme ];
 
   makeFlags = [
     ''CFLAGS=-DMOBILE_BROADBAND_PROVIDER_INFO=\"${mobile_broadband_provider_info}/share/mobile-broadband-provider-info/serviceproviders.xml\"''
diff --git a/pkgs/tools/networking/network-manager/default.nix b/pkgs/tools/networking/network-manager/default.nix
index d2a51b3acc86..ace568d6900b 100644
--- a/pkgs/tools/networking/network-manager/default.nix
+++ b/pkgs/tools/networking/network-manager/default.nix
@@ -3,19 +3,17 @@
 , libgcrypt, dnsmasq, bluez5, readline
 , gobjectIntrospection, modemmanager, openresolv, libndp, newt, libsoup
 , ethtool, iputils, gnused, coreutils, file, inetutils, kmod, jansson, libxslt
-, python3Packages, docbook_xsl, fetchpatch, openconnect }:
+, python3Packages, docbook_xsl, fetchpatch, openconnect, curl, autoreconfHook }:
 
 stdenv.mkDerivation rec {
   name    = "network-manager-${version}";
   pname   = "NetworkManager";
-  major   = "1.6";
+  major   = "1.8";
   version = "${major}.2";
-  # FIXME: this problem is fixed upstream (commit 6a77258f4ec2), remove when upgrading ^^^
-  hardeningDisable = [ "format" ];
 
   src = fetchurl {
     url    = "mirror://gnome/sources/${pname}/${major}/${pname}-${version}.tar.xz";
-    sha256 = "1y96k82rav8if334jl500zc024d210c4pgprh94yqyz3rmanyaxj";
+    sha256 = "1x0vzxvrck0snga2n3pc7g74m20zz74cr4r8gfspl8sckv6yz9bi";
   };
 
   outputs = [ "out" "dev" ];
@@ -46,13 +44,15 @@ stdenv.mkDerivation rec {
       --subst-var-by modprobeBinPath ${kmod}/bin/modprobe
     # to enable link-local connections
     configureFlags="$configureFlags --with-udev-dir=$out/lib/udev"
+
+    # Fixes: error: po/Makefile.in.in was not created by intltoolize.
+    intltoolize --automake --copy --force
   '';
 
   # Right now we hardcode quite a few paths at build time. Probably we should
   # patch networkmanager to allow passing these path in config file. This will
   # remove unneeded build-time dependencies.
   configureFlags = [
-    "--with-distro=exherbo"
     "--with-dhclient=${dhcp}/bin/dhclient"
     "--with-dnsmasq=${dnsmasq}/bin/dnsmasq"
     # Upstream prefers dhclient, so don't add dhcpcd to the closure
@@ -69,26 +69,21 @@ stdenv.mkDerivation rec {
     "--with-session-tracking=systemd"
     "--with-modem-manager-1"
     "--with-nmtui"
-    "--with-libsoup=yes"
+    "--disable-gtk-doc"
   ];
 
   patches = [
     ./PppdPath.patch
-    (fetchpatch {
-      sha256 = "1n90j5rwg97xkrhlldyr92filc2dmycl9pr0svky9hlcn9csk2z6";
-      name = "null-dereference.patch";
-      url = "https://github.com/NetworkManager/NetworkManager/commit/4e8eddd100bbc8429806a70620c90b72cfd29cb1.patch";
-    })
     ./openconnect_helper_path.patch
     ./modprobe.patch
   ];
 
-  buildInputs = [ systemd libgudev libnl libuuid polkit ppp libndp
+  buildInputs = [ systemd libgudev libnl libuuid polkit ppp libndp curl
                   bluez5 dnsmasq gobjectIntrospection modemmanager readline newt libsoup jansson ];
 
   propagatedBuildInputs = [ dbus_glib gnutls libgcrypt python3Packages.pygobject3 ];
 
-  nativeBuildInputs = [ intltool pkgconfig libxslt docbook_xsl ];
+  nativeBuildInputs = [ autoreconfHook intltool pkgconfig libxslt docbook_xsl ];
 
   preInstall = ''
     installFlagsArray=( "sysconfdir=$out/etc" "localstatedir=$out/var" "runstatedir=$out/var/run" )
diff --git a/pkgs/tools/networking/network-manager/iodine.nix b/pkgs/tools/networking/network-manager/iodine.nix
new file mode 100644
index 000000000000..154b54952f2d
--- /dev/null
+++ b/pkgs/tools/networking/network-manager/iodine.nix
@@ -0,0 +1,36 @@
+{ stdenv, fetchurl, iodine, intltool, pkgconfig, networkmanager, libsecret
+, withGnome ? true, gnome3 }:
+
+stdenv.mkDerivation rec {
+  name    = "${pname}${if withGnome then "-gnome" else ""}-${version}";
+  pname   = "NetworkManager-iodine";
+  major   = "1.2";
+  version = "${major}.0";
+
+  src = fetchurl {
+    url    = "mirror://gnome/sources/${pname}/${major}/${pname}-${version}.tar.xz";
+    sha256 = "0njdigakidji6mfmbsp8lfi8wl88z1dk8cljbva2w0xazyddbwyh";
+  };
+
+  buildInputs = [ iodine networkmanager libsecret ]
+    ++ stdenv.lib.optionals withGnome [ gnome3.gtk gnome3.libgnome_keyring
+                                        gnome3.networkmanagerapplet ];
+
+  nativeBuildInputs = [ intltool pkgconfig ];
+
+  configureFlags = [
+    "${if withGnome then "--with-gnome" else "--without-gnome"}"
+    "--disable-static"
+    "--localstatedir=/" # needed for the management socket under /run/NetworkManager
+  ];
+
+  preConfigure = ''
+     substituteInPlace "src/nm-iodine-service.c" \
+       --replace "/usr/bin/iodine" "${iodine}/bin/iodine"
+  '';
+
+  meta = {
+    description = "NetworkManager's iodine plugin";
+    inherit (networkmanager.meta) maintainers platforms;
+  };
+}
diff --git a/pkgs/tools/networking/network-manager/openvpn.nix b/pkgs/tools/networking/network-manager/openvpn.nix
index 3edbe7dba6ed..47dca561d6cb 100644
--- a/pkgs/tools/networking/network-manager/openvpn.nix
+++ b/pkgs/tools/networking/network-manager/openvpn.nix
@@ -4,12 +4,12 @@
 stdenv.mkDerivation rec {
   name    = "${pname}${if withGnome then "-gnome" else ""}-${version}";
   pname   = "NetworkManager-openvpn";
-  major   = "1.2";
-  version = "${major}.8";
+  major   = "1.8";
+  version = "${major}.0";
 
   src = fetchurl {
     url    = "mirror://gnome/sources/${pname}/${major}/${pname}-${version}.tar.xz";
-    sha256 = "0m06sg2rnz764psvpsrx0pvll11nfn9hypgbp3s6vna8y83l02ry";
+    sha256 = "1973n89g66a3jfx8r45a811fga4kadh6r1w35cb25cz1mlii2vhn";
   };
 
   buildInputs = [ openvpn networkmanager libsecret ]
diff --git a/pkgs/tools/networking/ngrok/default.nix b/pkgs/tools/networking/ngrok-1/default.nix
index e354ad223b8c..e354ad223b8c 100644
--- a/pkgs/tools/networking/ngrok/default.nix
+++ b/pkgs/tools/networking/ngrok-1/default.nix
diff --git a/pkgs/tools/networking/ngrok/deps.nix b/pkgs/tools/networking/ngrok-1/deps.nix
index 1db3c3e65191..1db3c3e65191 100644
--- a/pkgs/tools/networking/ngrok/deps.nix
+++ b/pkgs/tools/networking/ngrok-1/deps.nix
diff --git a/pkgs/tools/networking/ngrok-2/default.nix b/pkgs/tools/networking/ngrok-2/default.nix
new file mode 100644
index 000000000000..031161da4d57
--- /dev/null
+++ b/pkgs/tools/networking/ngrok-2/default.nix
@@ -0,0 +1,31 @@
+{ stdenv, fetchurl, unzip }:
+
+stdenv.mkDerivation rec {
+  name = "ngrok-${version}";
+  version = "2.2.8";
+
+  src = if stdenv.system == "i686-linux" then fetchurl {
+    url = "https://bin.equinox.io/c/4VmDzA7iaHb/ngrok-stable-linux-i386.tgz";
+    sha256 = "0s5ymlaxrvm13q3mlvfirh74sx60qh56c5sgdma2r7q5qlsq41xg";
+  } else if stdenv.system == "x86_64-linux" then fetchurl {
+    url = "https://bin.equinox.io/c/4VmDzA7iaHb/ngrok-stable-linux-amd64.tgz";
+    sha256 = "1mn9iwgy6xzrjihikwc2k2j59igqmph0cwx17qp0ziap9lp5xxad";
+  } else throw "platform ${stdenv.system} not supported!";
+
+  sourceRoot = ".";
+
+  installPhase = ''
+    install -D ngrok $out/bin/ngrok
+  '';
+
+  meta = with stdenv.lib; {
+    description = "ngrok";
+    longDescription = ''
+      Allows you to expose a web server running on your local machine to the internet.
+    '';
+    homepage = https://ngrok.com/;
+    license = stdenv.lib.licenses.unfree;
+    platforms = [ "i686-linux" "x86_64-linux" ];
+    maintainers = [ maintainers.bobvanderlinden ];
+  };
+}
diff --git a/pkgs/tools/networking/nss-pam-ldapd/default.nix b/pkgs/tools/networking/nss-pam-ldapd/default.nix
index 9e7282c40bdd..93646d58cd30 100644
--- a/pkgs/tools/networking/nss-pam-ldapd/default.nix
+++ b/pkgs/tools/networking/nss-pam-ldapd/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "1sw36w6zkzvabvjckqick032j5p5xi0qi3sgnh0znzxz31jqvf0d";
   };
   
-  buildInputs = [ makeWrapper pkgconfig python openldap pam ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ makeWrapper python openldap pam ];
 
   preConfigure = ''
     substituteInPlace Makefile.in --replace "install-data-local: " "# install-data-local: "
diff --git a/pkgs/tools/networking/offlineimap/default.nix b/pkgs/tools/networking/offlineimap/default.nix
index 8cf144140fad..c167851086e6 100644
--- a/pkgs/tools/networking/offlineimap/default.nix
+++ b/pkgs/tools/networking/offlineimap/default.nix
@@ -2,7 +2,7 @@
   asciidoc, libxml2, libxslt, docbook_xml_xslt }:
 
 pythonPackages.buildPythonApplication rec {
-  version = "7.1.1";
+  version = "7.1.2";
   name = "offlineimap-${version}";
   namePrefix = "";
 
@@ -10,7 +10,7 @@ pythonPackages.buildPythonApplication rec {
     owner = "OfflineIMAP";
     repo = "offlineimap";
     rev = "v${version}";
-    sha256 = "12fv6fzi3cb0hkvs4h5vj2i440d85wzjjyjl90zvyxvlfy0pmljl";
+    sha256 = "1bvlbw3bsx3qs8np1qdqbhpdr9qykzsql9684gm7gg84gw51i667";
   };
 
   postPatch = ''
@@ -21,7 +21,7 @@ pythonPackages.buildPythonApplication rec {
   doCheck = false;
 
   nativeBuildInputs = [ asciidoc libxml2 libxslt docbook_xml_xslt ];
-  propagatedBuildInputs = [ pythonPackages.six ];
+  propagatedBuildInputs = [ pythonPackages.six pythonPackages.kerberos ];
 
   postInstall = ''
     make -C docs man
diff --git a/pkgs/tools/networking/openconnect/default.nix b/pkgs/tools/networking/openconnect/default.nix
index 5e38aee7f833..132ae3cf0da0 100644
--- a/pkgs/tools/networking/openconnect/default.nix
+++ b/pkgs/tools/networking/openconnect/default.nix
@@ -1,10 +1,6 @@
 { stdenv, fetchurl, pkgconfig, vpnc, openssl ? null, gnutls ? null, gmp, libxml2, stoken, zlib } :
 
-let
-  xor = a: b: (a || b) && (!(a && b));
-in
-
-assert xor (openssl != null) (gnutls != null);
+assert (openssl != null) == (gnutls == null);
 
 stdenv.mkDerivation rec {
   name = "openconnect-7.08";
@@ -16,6 +12,8 @@ stdenv.mkDerivation rec {
     sha256 = "00wacb79l2c45f94gxs63b9z25wlciarasvjrb8jb8566wgyqi0w";
   };
 
+  outputs = [ "out" "dev" ];
+
   preConfigure = ''
       export PKG_CONFIG=${pkgconfig}/bin/pkg-config
       export LIBXML2_CFLAGS="-I ${libxml2.dev}/include/libxml2"
@@ -28,7 +26,7 @@ stdenv.mkDerivation rec {
     "--without-openssl-version-check"
   ];
 
-  buildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
   propagatedBuildInputs = [ vpnc openssl gnutls gmp libxml2 stoken zlib ];
 
   meta = {
diff --git a/pkgs/tools/networking/openfortivpn/default.nix b/pkgs/tools/networking/openfortivpn/default.nix
index 3854d94f9093..b1ecc6cba89b 100644
--- a/pkgs/tools/networking/openfortivpn/default.nix
+++ b/pkgs/tools/networking/openfortivpn/default.nix
@@ -1,9 +1,9 @@
-{ stdenv, fetchFromGitHub, autoreconfHook, openssl, ppp }:
+{ stdenv, fetchFromGitHub, autoreconfHook, openssl, ppp, pkgconfig }:
 
 with stdenv.lib;
 
 let repo = "openfortivpn";
-    version = "1.2.0";
+    version = "1.5.0";
 
 in stdenv.mkDerivation {
   name = "${repo}-${version}";
@@ -12,10 +12,11 @@ in stdenv.mkDerivation {
     owner = "adrienverge";
     inherit repo;
     rev = "v${version}";
-    sha256 = "1a1l9f6zivfyxg9g2x7kzkvcyh84s7l6v0kimihhrd19zl0m41jn";
+    sha256 = "0fm0z73afghwmbshpsn5jfbyyfzz1v8s7scwycnvsk2cgv5f4r86";
   };
 
-  buildInputs = [ openssl ppp autoreconfHook ];
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  buildInputs = [ openssl ppp ];
 
   NIX_CFLAGS_COMPILE = "-Wno-error=unused-function";
 
diff --git a/pkgs/tools/networking/openntpd/default.nix b/pkgs/tools/networking/openntpd/default.nix
index 2b2b441f2f98..7e1c257ec4b6 100644
--- a/pkgs/tools/networking/openntpd/default.nix
+++ b/pkgs/tools/networking/openntpd/default.nix
@@ -17,6 +17,7 @@ stdenv.mkDerivation rec {
     "--with-privsep-user=${privsepUser}"
     "--sysconfdir=/etc"
     "--localstatedir=/var"
+    "--with-cacert=/etc/ssl/certs/ca-certificates.crt"
   ];
 
   buildInputs = [ libressl ];
diff --git a/pkgs/tools/networking/openssh/default.nix b/pkgs/tools/networking/openssh/default.nix
index f358f47bcd64..663e7be7e5f3 100644
--- a/pkgs/tools/networking/openssh/default.nix
+++ b/pkgs/tools/networking/openssh/default.nix
@@ -13,11 +13,11 @@ assert withGssapiPatches -> withKerberos;
 let
 
   # **please** update this patch when you update to a new openssh release.
-  gssapiSrc = fetchpatch {
+  gssapiPatch = fetchpatch {
     name = "openssh-gssapi.patch";
     url = "https://anonscm.debian.org/cgit/pkg-ssh/openssh.git/plain/debian"
-        + "/patches/gssapi.patch?id=a18d56bd84f04292ec9178b4b17ef6d56a0c7aef";
-    sha256 = "1sb929lfc3s45km2vpylmlbb6mpqcbr74xl6gx2s4cgnsrfd9kp3";
+        + "/patches/gssapi.patch?id=1e0d55f9163793742d20eaadd4784db16fd3459d";
+    sha256 = "130phj87q87p9crigd6852nnaqsqkfg09h45a32lk4524h9kkxgb";
   };
 
 in
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
   # Please ensure that openssh_with_kerberos still builds when
   # bumping the version here!
   name = "openssh-${version}";
-  version = "7.5p1";
+  version = if hpnSupport then "7.5p1" else "7.6p1";
 
   src = if hpnSupport then
       fetchurl {
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
     else
       fetchurl {
         url = "mirror://openbsd/OpenSSH/portable/${name}.tar.gz";
-        sha256 = "1w7rb5gbrikxdkp8w7zxnci4549gk4bw1lml01s59w5rzb2y6ilq";
+        sha256 = "08qpsb8mrzcx8wgvz9insiyvq7sbg26yj5nvl2m5n57yvppcl8x3";
       };
 
   patches =
@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
       # See discussion in https://github.com/NixOS/nixpkgs/pull/16966
       ./dont_create_privsep_path.patch
     ]
-    ++ optional withGssapiPatches gssapiSrc;
+    ++ optional withGssapiPatches gssapiPatch;
 
   postPatch =
     # On Hydra this makes installation fail (sometimes?),
@@ -56,7 +56,8 @@ stdenv.mkDerivation rec {
       substituteInPlace Makefile.in --replace '$(INSTALL) -m 4711' '$(INSTALL) -m 0711'
     '';
 
-  buildInputs = [ zlib openssl libedit pkgconfig pam ]
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ zlib openssl libedit pam ]
     ++ optional withKerberos kerberos
     ++ optional hpnSupport autoreconfHook;
 
diff --git a/pkgs/tools/networking/openvpn/default.nix b/pkgs/tools/networking/openvpn/default.nix
index 78f21e78277d..ddcdfd31c260 100644
--- a/pkgs/tools/networking/openvpn/default.nix
+++ b/pkgs/tools/networking/openvpn/default.nix
@@ -8,11 +8,11 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   name = "openvpn-${version}";
-  version = "2.4.3";
+  version = "2.4.4";
 
   src = fetchurl {
     url = "http://swupdate.openvpn.net/community/releases/${name}.tar.xz";
-    sha256 = "0w85915nvdws1n1zsn8zcy9wg23jsx782nvrx1a3x4mqlmkn3a3s";
+    sha256 = "102an395nv8l7qfx3syydzhmd9xfbycd6gvwy0h2kjz8w67ipkcn";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/tools/networking/openvpn/openvpn-auth-ldap.nix b/pkgs/tools/networking/openvpn/openvpn-auth-ldap.nix
new file mode 100644
index 000000000000..3d1055be02b8
--- /dev/null
+++ b/pkgs/tools/networking/openvpn/openvpn-auth-ldap.nix
@@ -0,0 +1,76 @@
+{ stdenv, lib, fetchFromGitHub, fetchpatch,
+  autoreconfHook, re2c, openldap, openvpn, gnustep, check
+}:
+
+let
+  srcName = "openvpn-auth-ldap";
+  srcVersion = "2.0.3";
+  debianRev = "6.1";
+
+  fetchPatchFromDebian =
+    {patch, sha256}:
+    fetchpatch {
+      inherit sha256;
+      url = "http://sources.debian.net/data/main/o/${srcName}/${srcVersion}-${debianRev}/debian/patches/${patch}";
+    };
+in
+
+stdenv.mkDerivation rec {
+  name = "${srcName}-${version}";
+  version = "${srcVersion}+deb${debianRev}";
+
+  srcs = fetchFromGitHub {
+    owner = "threerings";
+    repo = srcName;
+    rev = "auth-ldap-${version}";
+    sha256 = "1v635ylzf5x3l3lirf3n6173q1w8g0ssjjkf27qqw98c3iqp63sq";
+  };
+
+  patches = map fetchPatchFromDebian [
+    {patch = "STARTTLS_before_auth.patch";
+     sha256 = "14d2vy366rhzggxb1zb3ld00wmaqxi2gq885vxhlldnwpgig0jx0";}
+    {patch = "gobjc_4.7_runtime.patch";
+     sha256 = "11hpmd4i1cm3m27x8c77d9jrwxpir4cy5d74k2kxq0q77rawnxcm";}
+    {patch = "openvpn_ldap_simpler_add_handler_4";
+     sha256 = "0qj7v2w921489c18mfrs5bmipzn1mcjj9avyp15x4531ss0lyanb";}
+    {patch = "auth-ldap-gnustep.patch";
+     sha256 = "0cz3jgyzgzi2p9bavd4lh69pnlnf4s7n9ihwg6zmmh6vqsynqss3";}
+  ];
+
+  nativeBuildInputs = [
+    autoreconfHook
+  ];
+
+  buildInputs = [
+    check
+    gnustep.base
+    gnustep.libobjc
+    gnustep.make
+    openldap
+    openvpn
+    re2c
+  ];
+
+  configureFlags = [
+    "--with-objc-runtime=modern"
+    "--with-openvpn=${openvpn}/include"
+    "--libdir=$(out)/lib/openvpn"
+  ];
+
+  preInstall = ''
+    mkdir -p $out/lib/openvpn $out/share/doc/openvpn/examples
+    cp README $out/share/doc/openvpn/
+    cp auth-ldap.conf $out/share/doc/openvpn/examples/
+  '';
+
+  meta = with lib; {
+    description = "LDAP authentication plugin for OpenVPN";
+    homepage = https://github.com/threerings/openvpn-auth-ldap;
+    license = [
+      licenses.asl20
+      licenses.bsd3
+    ];
+    maintainers = [ maintainers.benley ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/tools/networking/p2p/gtk-gnutella/default.nix b/pkgs/tools/networking/p2p/gtk-gnutella/default.nix
index 901d84b46926..f63c1d474c05 100644
--- a/pkgs/tools/networking/p2p/gtk-gnutella/default.nix
+++ b/pkgs/tools/networking/p2p/gtk-gnutella/default.nix
@@ -13,8 +13,8 @@ stdenv.mkDerivation {
     sha256 = "1zvadgsskmpm82id9mbj24a2lyq38qv768ixv7nmfjl3d4wr2biv";
   };
 
-  nativeBuildInputs = [ bison binutils gettext pkgconfig ];
-  buildInputs = [ glib gnutls gtk2 libxml2 zlib ];
+  nativeBuildInputs = [ bison gettext pkgconfig ];
+  buildInputs = [ binutils glib gnutls gtk2 libxml2 zlib ];
 
   hardeningDisable = [ "bindnow" "fortify" "pic" "relro" ];
 
diff --git a/pkgs/tools/networking/p2p/libtorrent/default.nix b/pkgs/tools/networking/p2p/libtorrent/default.nix
index d1827a6045d8..87785f50e6fa 100644
--- a/pkgs/tools/networking/p2p/libtorrent/default.nix
+++ b/pkgs/tools/networking/p2p/libtorrent/default.nix
@@ -6,21 +6,22 @@
 
 stdenv.mkDerivation rec {
   name = "libtorrent-${version}";
-  version = "0.13.6";
+  version = "20161212";
 
-  src = fetchFromGitHub rec {
+  src = fetchFromGitHub {
     owner = "rakshasa";
     repo = "libtorrent";
-    rev = "${version}";
-    sha256 = "1rvrxgb131snv9r6ksgzmd74rd9z7q46bhky0zazz7dwqqywffcp";
+    rev = "c167c5a9e0bcf0df23ae5efd91396aae0e37eb87";
+    sha256 = "0y9759sxx5dyamyw8w58dsxq7bmnn57q7s2f4cw2zln2pp5gripw";
   };
 
-  buildInputs = [ pkgconfig libtool autoconf automake cppunit openssl libsigcxx zlib ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libtool autoconf automake cppunit openssl libsigcxx zlib ];
 
   preConfigure = "./autogen.sh";
 
   meta = with stdenv.lib; {
-    homepage = http://www.libtorrent.org/;
+    homepage = "http://rtorrent.net/downloads/";
     description = "A BitTorrent library written in C++ for *nix, with focus on high performance and good code";
 
     platforms = platforms.linux;
diff --git a/pkgs/tools/networking/p2p/rtorrent/default.nix b/pkgs/tools/networking/p2p/rtorrent/default.nix
index 2883043f8b76..6ab462ac5a8c 100644
--- a/pkgs/tools/networking/p2p/rtorrent/default.nix
+++ b/pkgs/tools/networking/p2p/rtorrent/default.nix
@@ -9,17 +9,18 @@
 
 stdenv.mkDerivation rec {
   name = "rtorrent-${version}";
-  version = "0.9.6";
+  version = "20161023";
 
   src = fetchFromGitHub {
     owner = "rakshasa";
     repo = "rtorrent";
-    rev = "${version}";
-    sha256 = "0iyxmjr1984vs7hrnxkfwgrgckacqml0kv4bhj185w9bhjqvgfnf";
+    rev = "226e670decf92e7adaa845a6982aca4f164ea740";
+    sha256 = "0cxyakc09bn6wjfj42gh508hc62awx825skzacpizx2bqs6v7xvb";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    pkgconfig libtool autoconf automake cppunit
+    libtool autoconf automake cppunit
     libtorrent ncurses libsigcxx curl zlib openssl xmlrpc_c
   ];
 
diff --git a/pkgs/tools/networking/packetdrill/default.nix b/pkgs/tools/networking/packetdrill/default.nix
index 75007b5ed681..d770a51dc820 100644
--- a/pkgs/tools/networking/packetdrill/default.nix
+++ b/pkgs/tools/networking/packetdrill/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     description = "Quick, precise tests for entire TCP/UDP/IPv4/IPv6 network stacks";
     homepage = https://github.com/google/packetdrill;
     license = stdenv.lib.licenses.gpl2;
-    platforms = stdenv.lib.platforms.unix;
+    platforms = stdenv.lib.platforms.linux;
     maintainers = with stdenv.lib.maintainers; [ dmjio cleverca22 ];
   };
 }
diff --git a/pkgs/tools/networking/pdsh/default.nix b/pkgs/tools/networking/pdsh/default.nix
index 0c8ca56024bf..5633061c7212 100644
--- a/pkgs/tools/networking/pdsh/default.nix
+++ b/pkgs/tools/networking/pdsh/default.nix
@@ -7,7 +7,7 @@ stdenv.mkDerivation {
   inherit name;
 
   src = fetchurl {
-    url = "http://pdsh.googlecode.com/files/${name}.tar.bz2";
+    url = "https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/pdsh/${name}.tar.bz2";
     sha256 = "1kvzz01fyaxfqmbh53f4ljfsgvxdykh5jyr6fh4f1bw2ywxr1w2p";
   };
 
@@ -34,7 +34,7 @@ stdenv.mkDerivation {
   '';
 
   meta = {
-    homepage = http://code.google.com/p/pdsh/;
+    homepage = https://github.com/chaos/pdsh;
     description = "High-performance, parallel remote shell utility";
     license = stdenv.lib.licenses.gpl2;
 
diff --git a/pkgs/tools/networking/pirate-get/default.nix b/pkgs/tools/networking/pirate-get/default.nix
index bd7e87e2c10a..6e50b11568e6 100644
--- a/pkgs/tools/networking/pirate-get/default.nix
+++ b/pkgs/tools/networking/pirate-get/default.nix
@@ -5,13 +5,13 @@ with python3Packages;
 buildPythonApplication rec {
   name = "${pname}-${version}";
   pname = "pirate-get";
-  version = "0.2.10";
+  version = "0.2.12";
 
   doCheck = false;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "04gsilbyq2plldzi495dcf19h5xfldfyn6zdczj2fdki1m29jyr0";
+    sha256 = "1q6hvavj0gswgw3x756h18nmmpnxlgg08qvxphpbzlwd43xrnza3";
   };
 
   propagatedBuildInputs = [ colorama veryprettytable beautifulsoup4 ];
diff --git a/pkgs/tools/networking/polygraph/default.nix b/pkgs/tools/networking/polygraph/default.nix
index 09357e87da01..46680ab47af4 100644
--- a/pkgs/tools/networking/polygraph/default.nix
+++ b/pkgs/tools/networking/polygraph/default.nix
@@ -1,21 +1,19 @@
 { stdenv, fetchurl, openssl, zlib, ncurses }:
 
 stdenv.mkDerivation rec {
-  name = "polygraph-4.3.2";
+  name = "polygraph-4.11.0";
 
   src = fetchurl {
     url = "http://www.web-polygraph.org/downloads/srcs/${name}-src.tgz";
-    sha256 = "1fv9jpcicfsgsmghkykqif6l6w7nwvk5xbdmpv72jbrwzx44845h";
+    sha256 = "1ii60yl3p89qawvl19sd1bkpkw39fz8kpvmc3cawa32nxzbm9pbs";
   };
 
   buildInputs = [ openssl zlib ncurses ];
   
-  patches = [ ./fix_build.patch ];
-
   meta = with stdenv.lib; {
     homepage = http://www.web-polygraph.org;
     description = "Performance testing tool for caching proxies, origin server accelerators, L4/7 switches, content filters, and other Web intermediaries";
     platforms = platforms.linux;
     maintainers = [ maintainers.lethalman ];
   };
-}
\ No newline at end of file
+}
diff --git a/pkgs/tools/networking/polygraph/fix_build.patch b/pkgs/tools/networking/polygraph/fix_build.patch
deleted file mode 100644
index 96832d72037a..000000000000
--- a/pkgs/tools/networking/polygraph/fix_build.patch
+++ /dev/null
@@ -1,77 +0,0 @@
-Description: Fix ftbfs with GCC-4.7.
-Author: Mònica Ramírez Arceda <monica@debian.org>
-Bug-Debian: http://bugs.debian.org/667326
-Last-Update: 2012-05-11
-
---- a/src/xstd/Heap.h
-+++ b/src/xstd/Heap.h
-@@ -23,7 +23,7 @@
- 		const Item &top() const { return this->theItems[1]; }
- 		Item &at(int idx) { return this->theItems[idx+1]; }
- 
--		void add(Item v) { append(v); floatUp(++theCnt); }
-+		void add(Item v) { this->append(v); floatUp(++theCnt); }
- 		void skip() { this->theItems[1] = this->theItems[theCnt--]; this->theCount--; sinkDown(1); }
- 		Item shift() { const Item v = this->theItems[1]; skip(); return v; }
- 
---- a/src/xstd/Ring.h
-+++ b/src/xstd/Ring.h
-@@ -22,11 +22,11 @@
- 		int size() const { return Array<Item>::size(); }
- 		bool empty() const { return this->theInOff <= this->theOutOff; }
- 		bool full() const { return count() >= this->theCapacity; }
--		const Item &top(int off = 0) const { return item((this->theOutOff+off) % this->theCapacity); }
-+		const Item &top(int off = 0) const { return this->item((this->theOutOff+off) % this->theCapacity); }
- 
--		Item &top(int off = 0) { return item((this->theOutOff+off) % this->theCapacity); }
--		void enqueue(Item i) { Assert(!full()); item(this->theInOff++ % this->theCapacity) = i; check(); }
--		Item dequeue() { return item(this->theOutOff++ % this->theCapacity); }
-+		Item &top(int off = 0) { return this->item((this->theOutOff+off) % this->theCapacity); }
-+		void enqueue(Item i) { Assert(!full()); this->item(this->theInOff++ % this->theCapacity) = i; check(); }
-+		Item dequeue() { return this->item(this->theOutOff++ % this->theCapacity); }
- 
- 		void reset() { this->theInOff = this->theOutOff = 0; }
- 		inline void resize(int aCap);
---- a/src/runtime/StatPhase.cc
-+++ b/src/runtime/StatPhase.cc
-@@ -413,12 +413,12 @@
- 						break;
- 				}
- 		} else {
--			static CompoundXactInfo &compound = *CompoundXactInfo::Create();
--			compound.exchanges = 1;
--			compound.reqSize = reqSize;
--			compound.repSize = repSize;
--			compound.lifeTime = repTime;
--			compound.record(rec.theIsolated);
-+			static CompoundXactInfo &compound2 = *CompoundXactInfo::Create();
-+			compound2.exchanges = 1;
-+			compound2.reqSize = reqSize;
-+			compound2.repSize = repSize;
-+			compound2.lifeTime = repTime;
-+			compound2.record(rec.theIsolated);
- 		}
- 
- 		if (x->cookiesSent() > 0)
---- a/src/cache/CacheEntryHash.cc
-+++ b/src/cache/CacheEntryHash.cc
-@@ -14,7 +14,7 @@
- 
- CacheEntryHash::CacheEntryHash(int aCapacity): theCount(0) {
- 	theCapacity = (aCapacity + aCapacity/3 + 7) | 1;
--	theIndex = new (CacheEntry*[theCapacity]);
-+	theIndex = new (CacheEntry*[this->theCapacity]);
- 	memset(theIndex, 0, sizeof(CacheEntry*)*theCapacity);
- }
- 
---- a/src/tools/IntIntHash.cc
-+++ b/src/tools/IntIntHash.cc
-@@ -13,7 +13,7 @@
- 
- IntIntHash::IntIntHash(int aCapacity): theHashCap(0) {
- 	theHashCap = (aCapacity + aCapacity/3 + 7) | 1;
--	theIndex = new (IntIntHashItem*[theHashCap]);
-+	theIndex = new (IntIntHashItem*[this->theHashCap]);
- 	memset(theIndex, 0, sizeof(IntIntHashItem*)*theHashCap);
- }
- 
\ No newline at end of file
diff --git a/pkgs/tools/networking/pptp/default.nix b/pkgs/tools/networking/pptp/default.nix
index c2c41d92acbe..6185f66b80e4 100644
--- a/pkgs/tools/networking/pptp/default.nix
+++ b/pkgs/tools/networking/pptp/default.nix
@@ -12,12 +12,12 @@ stdenv.mkDerivation rec {
   patchPhase =
     ''
       sed -e 's/install -o root/install/' -i Makefile
-      sed -e 's,/bin/ip,${iproute}/sbin/ip,' -i routing.c
     '';
   preConfigure =
     ''
-      makeFlagsArray=( PPPD=${ppp}/sbin/pppd BINDIR=$out/sbin \
-          MANDIR=$out/share/man/man8 PPPDIR=$out/etc/ppp )
+      makeFlagsArray=( IP=${iproute}/bin/ip PPPD=${ppp}/sbin/pppd \
+                       BINDIR=$out/sbin MANDIR=$out/share/man/man8 \
+                       PPPDIR=$out/etc/ppp )
     '';
 
   nativeBuildInputs = [ perl which ];
diff --git a/pkgs/tools/networking/pykms/default.nix b/pkgs/tools/networking/pykms/default.nix
new file mode 100644
index 000000000000..97780d546e43
--- /dev/null
+++ b/pkgs/tools/networking/pykms/default.nix
@@ -0,0 +1,82 @@
+{ stdenv, fetchFromGitHub, python2Packages, writeText, writeScript
+, coreutils, sqlite }:
+
+let
+  dbSql = writeText "create_pykms_db.sql" ''
+    CREATE TABLE clients(
+      clientMachineId TEXT,
+      machineName     TEXT,
+      applicationId   TEXT,
+      skuId           TEXT,
+      licenseStatus   TEXT,
+      lastRequestTime INTEGER,
+      kmsEpid         TEXT,
+      requestCount    INTEGER
+    );
+  '';
+
+  dbScript = writeScript "create_pykms_db.sh" (with stdenv.lib; ''
+    #!${stdenv.shell} -eu
+
+    db=$1
+
+    ${getBin coreutils}/bin/install -d $(dirname $db)
+
+    if [ ! -e $db ] ; then
+      ${getBin sqlite}/bin/sqlite3 $db < ${dbSql}
+    fi
+  '');
+
+in python2Packages.buildPythonApplication rec {
+  name = "pykms-${version}";
+  version = "20170719";
+
+  src = fetchFromGitHub {
+    owner  = "ThunderEX";
+    repo   = "py-kms";
+    rev    = "27355d88affd740330174a7c2bae9f50b9efce56";
+    sha256 = "0cpywj73jmyijjc5hs3b00argjsdwpqzmhawbxkx3mc2l4sgzc88";
+  };
+
+  propagatedBuildInputs = with python2Packages; [ argparse pytz ];
+
+  prePatch = ''
+    siteDir=$out/${python2Packages.python.sitePackages}
+
+    substituteInPlace kmsBase.py \
+      --replace "'KmsDataBase.xml'" "'$siteDir/KmsDataBase.xml'"
+  '';
+
+  dontBuild = true;
+
+  # there are no tests
+  doCheck = false;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/{bin,share/doc/pykms} $siteDir
+
+    mv * $siteDir
+    for b in client server ; do
+      chmod 0755 $siteDir/$b.py
+      makeWrapper ${python2Packages.python.interpreter} $out/bin/$b.py \
+        --add-flags $siteDir/$b.py
+    done
+
+    install -m755 ${dbScript} $out/bin/create_pykms_db.sh
+
+    mv $siteDir/README.md $out/share/doc/pykms/
+
+    ${python2Packages.python.interpreter} -m compileall $siteDir
+
+    runHook postInstall
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Windows KMS (Key Management Service) server written in Python";
+    homepage    = https://github.com/ThunderEX/py-kms;
+    license     = licenses.mit;
+    maintainers = with maintainers; [ peterhoeg ];
+  };
+}
diff --git a/pkgs/tools/networking/radsecproxy/default.nix b/pkgs/tools/networking/radsecproxy/default.nix
new file mode 100644
index 000000000000..0ed1150159d2
--- /dev/null
+++ b/pkgs/tools/networking/radsecproxy/default.nix
@@ -0,0 +1,27 @@
+{ stdenv, fetchurl, openssl }:
+
+stdenv.mkDerivation rec {
+  name = "radsecproxy-${version}";
+  version = "1.6.9";
+
+  src = fetchurl {
+    url = "https://software.nordu.net/radsecproxy/radsecproxy-${version}.tar.xz";
+    sha256 = "6f2c7030236c222782c9ac2c52778baa63540a1865b75a7a6d8c1280ce6ad816";
+  };
+
+  buildInputs = [ openssl ];
+
+  configureFlags = [
+     "--with-ssl=${openssl.dev}"
+     "--sysconfdir=/etc"
+     "--localstatedir=/var"
+  ];
+
+  meta = with stdenv.lib; {
+    homepage = https://software.nordu.net/radsecproxy/;
+    description = "A generic RADIUS proxy that supports both UDP and TLS (RadSec) RADIUS transports.";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ sargon ];
+    platforms = with platforms; linux;
+  };
+}
diff --git a/pkgs/tools/networking/reaver-wps-t6x/default.nix b/pkgs/tools/networking/reaver-wps-t6x/default.nix
index 6e4a5561f07a..dd8347717319 100644
--- a/pkgs/tools/networking/reaver-wps-t6x/default.nix
+++ b/pkgs/tools/networking/reaver-wps-t6x/default.nix
@@ -1,31 +1,24 @@
-{ stdenv, fetchFromGitHub, libpcap, sqlite, pixiewps, makeWrapper }:
+{ stdenv, fetchFromGitHub, libpcap, pixiewps, makeWrapper }:
 
 stdenv.mkDerivation rec {
-  version = "1.5.2";
+  version = "1.6.3";
   name = "reaver-wps-t6x-${version}";
-  confdir = "/var/db/${name}"; # the sqlite database is at "${confdir}/reaver/reaver.db"
 
   src = fetchFromGitHub {
     owner = "t6x";
     repo = "reaver-wps-fork-t6x";
     rev = "v${version}";
-    sha256 = "0zhlms89ncqz1f1hc22yw9x1s837yv76f1zcjizhgn5h7vp17j4b";
+    sha256 = "1bccwp67q1q0h5m38gqxn9imq5rb75jbmv7fjr2n38v10jcga2pb";
   };
 
   nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ libpcap sqlite pixiewps ];
+  buildInputs = [ libpcap pixiewps ];
 
-  sourceRoot = "reaver-wps-fork-t6x-v${version}-src/src";
-
-  configureFlags = "--sysconfdir=${confdir}";
+  preConfigure = "cd src";
 
   installPhase = ''
-    mkdir -p $out/{bin,etc}
-    cp reaver.db $out/etc/
+    mkdir -p $out/bin
     cp reaver wash $out/bin/
-
-    wrapProgram $out/bin/reaver --run "[ -s ${confdir}/reaver/reaver.db ] || install -D $out/etc/reaver.db ${confdir}/reaver/reaver.db"
-    wrapProgram $out/bin/wash   --run "[ -s ${confdir}/reaver/reaver.db ] || install -D $out/etc/reaver.db ${confdir}/reaver/reaver.db"
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/networking/reaver-wps/default.nix b/pkgs/tools/networking/reaver-wps/default.nix
index c9bd3fbaa853..6cbee7d2a851 100644
--- a/pkgs/tools/networking/reaver-wps/default.nix
+++ b/pkgs/tools/networking/reaver-wps/default.nix
@@ -13,7 +13,10 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ makeWrapper ];
   buildInputs = [ libpcap sqlite ];
 
-  sourceRoot = "reaver-${version}/src";
+
+  setSourceRoot = ''
+    sourceRoot=$(echo */src)
+  '';
 
   configureFlags = "--sysconfdir=${confdir}";
 
@@ -28,7 +31,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "Brute force attack against Wifi Protected Setup";
-    homepage = http://code.google.com/p/reaver-wps;
+    homepage = https://code.google.com/archive/p/reaver-wps/;
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
     maintainers = with maintainers; [ nico202 volth ];
diff --git a/pkgs/tools/networking/redsocks/default.nix b/pkgs/tools/networking/redsocks/default.nix
index e9aced067286..981ecdb03550 100644
--- a/pkgs/tools/networking/redsocks/default.nix
+++ b/pkgs/tools/networking/redsocks/default.nix
@@ -28,6 +28,6 @@ stdenv.mkDerivation rec {
     homepage = http://darkk.net.ru/redsocks/;
     license = stdenv.lib.licenses.asl20;
     maintainers = [ ];
-    platforms = stdenv.lib.platforms.all;
+    platforms = stdenv.lib.platforms.linux;
   };
 }
diff --git a/pkgs/tools/networking/samplicator/default.nix b/pkgs/tools/networking/samplicator/default.nix
index 1b537870b09d..5cb65b78ee8b 100644
--- a/pkgs/tools/networking/samplicator/default.nix
+++ b/pkgs/tools/networking/samplicator/default.nix
@@ -4,7 +4,8 @@ stdenv.mkDerivation rec {
   name = "samplicator-${version}";
   version = "1.3.8rc1";
 
-  buildInputs = [ autoreconfHook ];
+  nativeBuildInputs = [ autoreconfHook ];
+  buildInputs = [ ];
 
   src = fetchFromGitHub {
     owner = "sleinen";
diff --git a/pkgs/tools/networking/slimrat/default.nix b/pkgs/tools/networking/slimrat/default.nix
index 14283c279e46..ef2c91ee2fab 100644
--- a/pkgs/tools/networking/slimrat/default.nix
+++ b/pkgs/tools/networking/slimrat/default.nix
@@ -3,7 +3,7 @@
 stdenv.mkDerivation {
   name = "slimrat-1.0";
   src = fetchurl {
-    url = http://slimrat.googlecode.com/files/slimrat-1.0.tar.bz2;
+    url = "https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/slimrat/slimrat-1.0.tar.bz2";
     sha256 = "139b71d45k4b1y47iq62a9732cnaqqbh8s4knkrgq2hx0jxpsk5a";
   };
 
@@ -24,9 +24,10 @@ stdenv.mkDerivation {
   '';
 
   meta = {
-    homepage = http://code.google.com/p/slimrat/;
+    homepage = https://code.google.com/archive/p/slimrat/;
     description = "Linux Rapidshare downloader";
     license = stdenv.lib.licenses.mit;
     platforms = stdenv.lib.platforms.unix;
+    broken = true; # officially abandonned upstream
   };
 }
diff --git a/pkgs/tools/networking/sshpass/default.nix b/pkgs/tools/networking/sshpass/default.nix
index f87cecaf4d27..aedb89ce4891 100644
--- a/pkgs/tools/networking/sshpass/default.nix
+++ b/pkgs/tools/networking/sshpass/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = {
-    homepage = http://sourceforge.net/projects/sshpass/;
+    homepage = https://sourceforge.net/projects/sshpass/;
     description = "Non-interactive ssh password auth";
     maintainers = [ stdenv.lib.maintainers.madjar ];
     platforms = stdenv.lib.platforms.unix;
diff --git a/pkgs/tools/networking/statsd/default.nix b/pkgs/tools/networking/statsd/default.nix
deleted file mode 100644
index 6f909a915ae3..000000000000
--- a/pkgs/tools/networking/statsd/default.nix
+++ /dev/null
@@ -1,13 +0,0 @@
-{ recurseIntoAttrs, callPackage, nodejs
-}:
-
-let
-  self = recurseIntoAttrs (
-    callPackage ../../../top-level/node-packages.nix {
-      inherit nodejs self;
-      generated = callPackage ./node-packages.nix { inherit self; };
-      overrides = {
-        "statsd" = { passthru.nodePackages = self; };
-      };
-    });
-in self.statsd
diff --git a/pkgs/tools/networking/statsd/node-packages.json b/pkgs/tools/networking/statsd/node-packages.json
deleted file mode 100644
index f75224e79f92..000000000000
--- a/pkgs/tools/networking/statsd/node-packages.json
+++ /dev/null
@@ -1,6 +0,0 @@
-[
-  "statsd"
-, "statsd-librato-backend"
-, "stackdriver-statsd-backend"
-, "statsd-influxdb-backend"
-]
diff --git a/pkgs/tools/networking/statsd/node-packages.nix b/pkgs/tools/networking/statsd/node-packages.nix
deleted file mode 100644
index fd196c249ae1..000000000000
--- a/pkgs/tools/networking/statsd/node-packages.nix
+++ /dev/null
@@ -1,284 +0,0 @@
-{ self, fetchurl, fetchgit ? null, lib }:
-
-{
-  by-spec."commander"."1.3.1" =
-    self.by-version."commander"."1.3.1";
-  by-version."commander"."1.3.1" = self.buildNodePackage {
-    name = "commander-1.3.1";
-    version = "1.3.1";
-    bin = false;
-    src = fetchurl {
-      url = "https://registry.npmjs.org/commander/-/commander-1.3.1.tgz";
-      name = "commander-1.3.1.tgz";
-      sha1 = "02443e02db96f4b32b674225451abb6e9510000e";
-    };
-    deps = {
-      "keypress-0.1.0" = self.by-version."keypress"."0.1.0";
-    };
-    optionalDependencies = {
-    };
-    peerDependencies = [];
-    os = [ ];
-    cpu = [ ];
-  };
-  by-spec."connection-parse"."0.0.x" =
-    self.by-version."connection-parse"."0.0.7";
-  by-version."connection-parse"."0.0.7" = self.buildNodePackage {
-    name = "connection-parse-0.0.7";
-    version = "0.0.7";
-    bin = false;
-    src = fetchurl {
-      url = "https://registry.npmjs.org/connection-parse/-/connection-parse-0.0.7.tgz";
-      name = "connection-parse-0.0.7.tgz";
-      sha1 = "18e7318aab06a699267372b10c5226d25a1c9a69";
-    };
-    deps = {
-    };
-    optionalDependencies = {
-    };
-    peerDependencies = [];
-    os = [ ];
-    cpu = [ ];
-  };
-  by-spec."generic-pool"."2.2.0" =
-    self.by-version."generic-pool"."2.2.0";
-  by-version."generic-pool"."2.2.0" = self.buildNodePackage {
-    name = "generic-pool-2.2.0";
-    version = "2.2.0";
-    bin = false;
-    src = fetchurl {
-      url = "https://registry.npmjs.org/generic-pool/-/generic-pool-2.2.0.tgz";
-      name = "generic-pool-2.2.0.tgz";
-      sha1 = "8b465c1a7588ea9dd2bb133bda0bb66bfef8a63e";
-    };
-    deps = {
-    };
-    optionalDependencies = {
-    };
-    peerDependencies = [];
-    os = [ ];
-    cpu = [ ];
-  };
-  by-spec."hashring"."3.2.0" =
-    self.by-version."hashring"."3.2.0";
-  by-version."hashring"."3.2.0" = self.buildNodePackage {
-    name = "hashring-3.2.0";
-    version = "3.2.0";
-    bin = false;
-    src = fetchurl {
-      url = "https://registry.npmjs.org/hashring/-/hashring-3.2.0.tgz";
-      name = "hashring-3.2.0.tgz";
-      sha1 = "fda4efde8aa22cdb97fb1d2a65e88401e1c144ce";
-    };
-    deps = {
-      "connection-parse-0.0.7" = self.by-version."connection-parse"."0.0.7";
-      "simple-lru-cache-0.0.2" = self.by-version."simple-lru-cache"."0.0.2";
-    };
-    optionalDependencies = {
-    };
-    peerDependencies = [];
-    os = [ ];
-    cpu = [ ];
-  };
-  by-spec."keypress"."0.1.x" =
-    self.by-version."keypress"."0.1.0";
-  by-version."keypress"."0.1.0" = self.buildNodePackage {
-    name = "keypress-0.1.0";
-    version = "0.1.0";
-    bin = false;
-    src = fetchurl {
-      url = "https://registry.npmjs.org/keypress/-/keypress-0.1.0.tgz";
-      name = "keypress-0.1.0.tgz";
-      sha1 = "4a3188d4291b66b4f65edb99f806aa9ae293592a";
-    };
-    deps = {
-    };
-    optionalDependencies = {
-    };
-    peerDependencies = [];
-    os = [ ];
-    cpu = [ ];
-  };
-  by-spec."modern-syslog"."1.1.2" =
-    self.by-version."modern-syslog"."1.1.2";
-  by-version."modern-syslog"."1.1.2" = self.buildNodePackage {
-    name = "modern-syslog-1.1.2";
-    version = "1.1.2";
-    bin = false;
-    src = fetchurl {
-      url = "https://registry.npmjs.org/modern-syslog/-/modern-syslog-1.1.2.tgz";
-      name = "modern-syslog-1.1.2.tgz";
-      sha1 = "f1fa58899f3f452d788f1573401212a4ef898de5";
-    };
-    deps = {
-      "nan-2.4.0" = self.by-version."nan"."2.4.0";
-    };
-    optionalDependencies = {
-    };
-    peerDependencies = [];
-    os = [ "!win32" ];
-    cpu = [ ];
-  };
-  by-spec."nan"."^2.0.5" =
-    self.by-version."nan"."2.4.0";
-  by-version."nan"."2.4.0" = self.buildNodePackage {
-    name = "nan-2.4.0";
-    version = "2.4.0";
-    bin = false;
-    src = fetchurl {
-      url = "https://registry.npmjs.org/nan/-/nan-2.4.0.tgz";
-      name = "nan-2.4.0.tgz";
-      sha1 = "fb3c59d45fe4effe215f0b890f8adf6eb32d2232";
-    };
-    deps = {
-    };
-    optionalDependencies = {
-    };
-    peerDependencies = [];
-    os = [ ];
-    cpu = [ ];
-  };
-  by-spec."sequence"."2.2.1" =
-    self.by-version."sequence"."2.2.1";
-  by-version."sequence"."2.2.1" = self.buildNodePackage {
-    name = "sequence-2.2.1";
-    version = "2.2.1";
-    bin = false;
-    src = fetchurl {
-      url = "https://registry.npmjs.org/sequence/-/sequence-2.2.1.tgz";
-      name = "sequence-2.2.1.tgz";
-      sha1 = "7f5617895d44351c0a047e764467690490a16b03";
-    };
-    deps = {
-    };
-    optionalDependencies = {
-    };
-    peerDependencies = [];
-    os = [ ];
-    cpu = [ ];
-  };
-  by-spec."simple-lru-cache"."0.0.x" =
-    self.by-version."simple-lru-cache"."0.0.2";
-  by-version."simple-lru-cache"."0.0.2" = self.buildNodePackage {
-    name = "simple-lru-cache-0.0.2";
-    version = "0.0.2";
-    bin = false;
-    src = fetchurl {
-      url = "https://registry.npmjs.org/simple-lru-cache/-/simple-lru-cache-0.0.2.tgz";
-      name = "simple-lru-cache-0.0.2.tgz";
-      sha1 = "d59cc3a193c1a5d0320f84ee732f6e4713e511dd";
-    };
-    deps = {
-    };
-    optionalDependencies = {
-    };
-    peerDependencies = [];
-    os = [ ];
-    cpu = [ ];
-  };
-  by-spec."stackdriver-statsd-backend"."*" =
-    self.by-version."stackdriver-statsd-backend"."0.2.3";
-  by-version."stackdriver-statsd-backend"."0.2.3" = self.buildNodePackage {
-    name = "stackdriver-statsd-backend-0.2.3";
-    version = "0.2.3";
-    bin = false;
-    src = fetchurl {
-      url = "https://registry.npmjs.org/stackdriver-statsd-backend/-/stackdriver-statsd-backend-0.2.3.tgz";
-      name = "stackdriver-statsd-backend-0.2.3.tgz";
-      sha1 = "6ffead71e5655d4d787c39da8d1c9eaaa59c91d7";
-    };
-    deps = {
-    };
-    optionalDependencies = {
-    };
-    peerDependencies = [];
-    os = [ ];
-    cpu = [ ];
-  };
-  "stackdriver-statsd-backend" = self.by-version."stackdriver-statsd-backend"."0.2.3";
-  by-spec."statsd"."*" =
-    self.by-version."statsd"."0.8.0";
-  by-version."statsd"."0.8.0" = self.buildNodePackage {
-    name = "statsd-0.8.0";
-    version = "0.8.0";
-    bin = true;
-    src = fetchurl {
-      url = "https://registry.npmjs.org/statsd/-/statsd-0.8.0.tgz";
-      name = "statsd-0.8.0.tgz";
-      sha1 = "92041479e174a214df7147f2fab1348af0839052";
-    };
-    deps = {
-      "generic-pool-2.2.0" = self.by-version."generic-pool"."2.2.0";
-    };
-    optionalDependencies = {
-      "modern-syslog-1.1.2" = self.by-version."modern-syslog"."1.1.2";
-      "hashring-3.2.0" = self.by-version."hashring"."3.2.0";
-      "winser-0.1.6" = self.by-version."winser"."0.1.6";
-    };
-    peerDependencies = [];
-    os = [ ];
-    cpu = [ ];
-  };
-  "statsd" = self.by-version."statsd"."0.8.0";
-  by-spec."statsd-influxdb-backend"."*" =
-    self.by-version."statsd-influxdb-backend"."0.6.0";
-  by-version."statsd-influxdb-backend"."0.6.0" = self.buildNodePackage {
-    name = "statsd-influxdb-backend-0.6.0";
-    version = "0.6.0";
-    bin = false;
-    src = fetchurl {
-      url = "https://registry.npmjs.org/statsd-influxdb-backend/-/statsd-influxdb-backend-0.6.0.tgz";
-      name = "statsd-influxdb-backend-0.6.0.tgz";
-      sha1 = "25fb83cf0b3af923dfc7d506eb1208def8790d78";
-    };
-    deps = {
-    };
-    optionalDependencies = {
-    };
-    peerDependencies = [];
-    os = [ ];
-    cpu = [ ];
-  };
-  "statsd-influxdb-backend" = self.by-version."statsd-influxdb-backend"."0.6.0";
-  by-spec."statsd-librato-backend"."*" =
-    self.by-version."statsd-librato-backend"."0.1.7";
-  by-version."statsd-librato-backend"."0.1.7" = self.buildNodePackage {
-    name = "statsd-librato-backend-0.1.7";
-    version = "0.1.7";
-    bin = false;
-    src = fetchurl {
-      url = "https://registry.npmjs.org/statsd-librato-backend/-/statsd-librato-backend-0.1.7.tgz";
-      name = "statsd-librato-backend-0.1.7.tgz";
-      sha1 = "270dc406481c0e6a6f4e72957681a73015f478f6";
-    };
-    deps = {
-    };
-    optionalDependencies = {
-    };
-    peerDependencies = [];
-    os = [ ];
-    cpu = [ ];
-  };
-  "statsd-librato-backend" = self.by-version."statsd-librato-backend"."0.1.7";
-  by-spec."winser"."=0.1.6" =
-    self.by-version."winser"."0.1.6";
-  by-version."winser"."0.1.6" = self.buildNodePackage {
-    name = "winser-0.1.6";
-    version = "0.1.6";
-    bin = true;
-    src = fetchurl {
-      url = "https://registry.npmjs.org/winser/-/winser-0.1.6.tgz";
-      name = "winser-0.1.6.tgz";
-      sha1 = "08663dc32878a12bbce162d840da5097b48466c9";
-    };
-    deps = {
-      "sequence-2.2.1" = self.by-version."sequence"."2.2.1";
-      "commander-1.3.1" = self.by-version."commander"."1.3.1";
-    };
-    optionalDependencies = {
-    };
-    peerDependencies = [];
-    os = [ ];
-    cpu = [ ];
-  };
-}
diff --git a/pkgs/tools/networking/strongswan/default.nix b/pkgs/tools/networking/strongswan/default.nix
index 2c0352152d55..89019986bca2 100644
--- a/pkgs/tools/networking/strongswan/default.nix
+++ b/pkgs/tools/networking/strongswan/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   name = "strongswan-${version}";
-  version = "5.5.3";
+  version = "5.6.0";
 
   src = fetchurl {
     url = "http://download.strongswan.org/${name}.tar.bz2";
-    sha256 = "1m7qq0l5pwj1wy0f7h2b7msb1d98rx78z6xg27g0hiqpk6qm9sn5";
+    sha256 = "04vvha2zgsg1cq05cnn6sf7a4hq9ndnsfxpw1drm5v9l4vcw0kd1";
   };
 
   dontPatchELF = true;
@@ -35,6 +35,8 @@ stdenv.mkDerivation rec {
     # the configuration files. In the absence of that we patch swanctl to look
     # for configuration files in /etc/swanctl.
     substituteInPlace src/swanctl/swanctl.h --replace "SWANCTLDIR" "\"/etc/swanctl\""
+    # glibc-2.26 reorganized internal includes
+    sed '1i#include <stdint.h>' -i src/libstrongswan/utils/utils/memory.h
     '';
 
   preConfigure = ''
@@ -44,10 +46,11 @@ stdenv.mkDerivation rec {
   configureFlags =
     [ "--enable-swanctl" "--enable-cmd" "--enable-systemd"
       "--enable-farp" "--enable-dhcp"
+      "--enable-openssl"
       "--enable-eap-sim" "--enable-eap-sim-file" "--enable-eap-simaka-pseudonym"
       "--enable-eap-simaka-reauth" "--enable-eap-identity" "--enable-eap-md5"
       "--enable-eap-gtc" "--enable-eap-aka" "--enable-eap-aka-3gpp2"
-      "--enable-eap-mschapv2" "--enable-xauth-eap" "--enable-ext-auth"
+      "--enable-eap-mschapv2" "--enable-eap-radius" "--enable-xauth-eap" "--enable-ext-auth"
       "--enable-forecast" "--enable-connmark" "--enable-acert"
       "--enable-pkcs11" "--enable-eap-sim-pcsc" "--enable-dnscert" "--enable-unbound"
       "--enable-af-alg" "--enable-xauth-pam" "--enable-chapoly" ]
@@ -55,7 +58,7 @@ stdenv.mkDerivation rec {
     ++ stdenv.lib.optional (stdenv.system == "i686-linux") "--enable-padlock"
     ++ stdenv.lib.optionals enableTNC [
          "--disable-gmp" "--disable-aes" "--disable-md5" "--disable-sha1" "--disable-sha2" "--disable-fips-prf"
-         "--enable-curl" "--enable-openssl"
+         "--enable-curl"
          "--enable-eap-tnc" "--enable-eap-ttls" "--enable-eap-dynamic" "--enable-tnccs-20"
          "--enable-tnc-imc" "--enable-imc-os" "--enable-imc-attestation"
          "--enable-tnc-imv" "--enable-imv-attestation"
diff --git a/pkgs/tools/networking/tcpdump/default.nix b/pkgs/tools/networking/tcpdump/default.nix
index 77e74569ee55..8dba4b373a32 100644
--- a/pkgs/tools/networking/tcpdump/default.nix
+++ b/pkgs/tools/networking/tcpdump/default.nix
@@ -1,17 +1,22 @@
-{ stdenv, fetchFromGitHub, libpcap, enableStatic ? false
+{ stdenv, fetchurl, fetchpatch, libpcap, enableStatic ? false
 , hostPlatform
 }:
 
 stdenv.mkDerivation rec {
   name = "tcpdump-${version}";
-  version = "4.9.1";
+  version = "4.9.2";
 
-  src = fetchFromGitHub rec {
-    owner = "the-tcpdump-group";
-    repo = "tcpdump";
-    rev = "${repo}-${version}";
-    sha256 = "1vzrvn1q7x28h18yskqc390y357pzpg5xd3pzzj4xz3llnvsr64p";
+  # leaked embargoed security update
+  src = fetchurl {
+    url = "https://src.fedoraproject.org/lookaside/pkgs/tcpdump/tcpdump-4.9.2.tar.gz/sha512/e1bc19a5867d6e3628f3941bdf3ec831bf13784f1233ca1bccc46aac1702f47ee9357d7ff0ca62cddf211b3c8884488c21144cabddd92c861e32398cd8f7c44b/tcpdump-4.9.2.tar.gz";
+    sha256 = "0ygy0layzqaj838r5xd613iraz09wlfgpyh7pc6cwclql8v3b2vr";
   };
+  # src = fetchFromGitHub rec {
+  #   owner = "the-tcpdump-group";
+  #   repo = "tcpdump";
+  #   rev = "${repo}-${version}";
+  #   sha256 = "1vzrvn1q7x28h18yskqc390y357pzpg5xd3pzzj4xz3llnvsr64p";
+  # };
 
   buildInputs = [ libpcap ];
 
diff --git a/pkgs/tools/networking/tcpflow/default.nix b/pkgs/tools/networking/tcpflow/default.nix
index 52727f1c49e7..1df0f2c37fc2 100644
--- a/pkgs/tools/networking/tcpflow/default.nix
+++ b/pkgs/tools/networking/tcpflow/default.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ openssl zlib libpcap boost automake autoconf ] ++ lib.optional useCairo cairo;
 
   postUnpack = ''
-    pushd tcpflow-*-src/src
+    pushd "$sourceRoot/src"
     cp -rv ${be13_api}/* be13_api/
     cp -rv ${dfxml}/* dfxml/
     cp -rv ${httpparser}/* http-parser/
diff --git a/pkgs/tools/networking/telepresence/default.nix b/pkgs/tools/networking/telepresence/default.nix
new file mode 100644
index 000000000000..1f94702e8308
--- /dev/null
+++ b/pkgs/tools/networking/telepresence/default.nix
@@ -0,0 +1,47 @@
+{ lib, stdenv, fetchgit, fetchFromGitHub, makeWrapper, git
+, python3, sshfs-fuse, torsocks, sshuttle, conntrack_tools }:
+
+let
+  sshuttle-telepresence = lib.overrideDerivation sshuttle (p: {
+    src = fetchgit {
+      url = "https://github.com/datawire/sshuttle.git";
+      rev = "8f881d131a0d5cb203c5a530d233996077f1da1e";
+      sha256 = "0c760xhblz5mpcn5ddqpvivvgn0ixqbhpjsy50dkhgn6lymrx9bx";
+      leaveDotGit = true;
+    };
+
+    buildInputs = p.buildInputs ++ [ git ];
+    postPatch = "rm sshuttle/tests/client/test_methods_nat.py";
+    postInstall = "mv $out/bin/sshuttle $out/bin/sshuttle-telepresence";
+  });
+in stdenv.mkDerivation rec {
+  pname = "telepresence";
+  version = "0.65";
+  name = "${pname}-${version}";
+
+  src = fetchFromGitHub {
+    owner = "datawire";
+    repo = "telepresence";
+    rev = version;
+    sha256 = "01hwaybhdmfzmyzvwdx19nc5px2grf4k1vbbj9jdmsh5pmzfrby4";
+  };
+
+  buildInputs = [ makeWrapper ];
+
+  phases = ["unpackPhase" "installPhase"];
+
+  installPhase = ''
+    mkdir -p $out/libexec $out/bin
+    cp cli/telepresence $out/libexec/telepresence
+
+    makeWrapper $out/libexec/telepresence $out/bin/telepresence \
+      --prefix PATH : ${lib.makeBinPath [python3 sshfs-fuse torsocks conntrack_tools sshuttle-telepresence]}
+  '';
+
+  meta = {
+    homepage = https://www.telepresence.io/;
+    description = "Local development against a remote Kubernetes or OpenShift cluster";
+    license = with lib.licenses; [ asl20 ];
+    maintainers = with lib.maintainers; [ offline ];
+  };
+}
diff --git a/pkgs/tools/networking/tinc/default.nix b/pkgs/tools/networking/tinc/default.nix
index c025fba4921b..508816dbfa81 100644
--- a/pkgs/tools/networking/tinc/default.nix
+++ b/pkgs/tools/networking/tinc/default.nix
@@ -1,12 +1,12 @@
 {stdenv, fetchurl, lzo, openssl, zlib}:
 
 stdenv.mkDerivation rec {
-  version = "1.0.31";
+  version = "1.0.32";
   name = "tinc-${version}";
 
   src = fetchurl {
     url = "http://www.tinc-vpn.org/packages/tinc-${version}.tar.gz";
-    sha256 = "d3cbc82e6e07975a2ccc0b369d07e30fc3324e71e240dca8781ce9a4f629519b";
+    sha256 = "11smq1h6jyp6x2cwrv2zxck9phzdz3svi95pxnvvpd4dzzm4zcjd";
   };
 
   buildInputs = [ lzo openssl zlib ];
diff --git a/pkgs/tools/networking/tinc/pre.nix b/pkgs/tools/networking/tinc/pre.nix
index 38ba5accbb33..0f5fd2836921 100644
--- a/pkgs/tools/networking/tinc/pre.nix
+++ b/pkgs/tools/networking/tinc/pre.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   name = "tinc-${version}";
-  version = "1.1pre14";
+  version = "1.1pre15";
 
   src = fetchgit {
     rev = "refs/tags/release-${version}";
     url = "git://tinc-vpn.org/tinc";
-    sha256 = "05an2vj0a3wjv5w672wgzyixbydin5jpja5zv6x81bc72dms0ymc";
+    sha256 = "1msym63jpipvzb5dn8yn8yycrii43ncfq6xddxh2ifrakr48l6y5";
   };
 
   outputs = [ "out" "man" "info" ];
@@ -15,18 +15,14 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ autoreconfHook texinfo ];
   buildInputs = [ ncurses readline zlib lzo openssl ];
 
+  # needed so the build doesn't need to run git to find out the version.
   prePatch = ''
     substituteInPlace configure.ac --replace UNKNOWN ${version}
+    echo "${version}" > configure-version
+    echo "https://tinc-vpn.org/git/browse?p=tinc;a=log;h=refs/tags/release-${version}" > ChangeLog
+    sed -i '/AC_INIT/s/m4_esyscmd_s.*/${version})/' configure.ac
   '';
 
-  patches = [
-    # Avoid infinite loop with "Error while reading from Linux tun/tap device (tun mode) /dev/net/tun: File descriptor in bad state" on network restart
-    (fetchpatch {
-      url = https://github.com/gsliepen/tinc/compare/acefa66...e4544db.patch;
-      sha256 = "1jz7anqqzk7j96l5ifggc2knp14fmbsjdzfrbncxx0qhb6ihdcvn";
-    })
-  ];
-
   postInstall = ''
     rm $out/bin/tinc-gui
   '';
@@ -47,6 +43,6 @@ stdenv.mkDerivation rec {
     homepage="http://www.tinc-vpn.org/";
     license = licenses.gpl2Plus;
     platforms = platforms.unix;
-    maintainers = with maintainers; [ wkennington fpletz ];
+    maintainers = with maintainers; [ wkennington fpletz lassulus ];
   };
 }
diff --git a/pkgs/tools/networking/tlspool/default.nix b/pkgs/tools/networking/tlspool/default.nix
index 53465a0242dd..acb5a042ffcc 100644
--- a/pkgs/tools/networking/tlspool/default.nix
+++ b/pkgs/tools/networking/tlspool/default.nix
@@ -19,7 +19,8 @@ stdenv.mkDerivation rec {
   };
 
   propagatedBuildInputs = [ python softhsm openldap p11_kit.dev p11_kit.out gnupg ];
-  buildInputs = [ unbound pkgconfig unzip git libtasn1 db libmemcached cyrus_sasl openssl bash quickder
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ unbound unzip git libtasn1 db libmemcached cyrus_sasl openssl bash quickder
                   libkrb5 ldns libtool swig pkgs.pythonPackages.pip gnutls-kdh ]
                 ++ stdenv.lib.optional useSystemd systemd;
 
diff --git a/pkgs/tools/networking/tracebox/default.nix b/pkgs/tools/networking/tracebox/default.nix
index 8c443282e5cb..c3abdd49e138 100644
--- a/pkgs/tools/networking/tracebox/default.nix
+++ b/pkgs/tools/networking/tracebox/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0gxdapm6b5a41gymi1f0nr2kyz70vllnk10085yz3pq527gp9gns";
   };
 
-  buildInputs = [ autoreconfHook libcrafter lua ];
+  nativeBuildInputs = [ autoreconfHook ];
+  buildInputs = [ libcrafter lua ];
 
   configureFlags = [ "--with-lua=yes" ];
 
diff --git a/pkgs/tools/networking/udptunnel/default.nix b/pkgs/tools/networking/udptunnel/default.nix
index b12ce573d1c4..4ee4fa418335 100644
--- a/pkgs/tools/networking/udptunnel/default.nix
+++ b/pkgs/tools/networking/udptunnel/default.nix
@@ -4,8 +4,8 @@ stdenv.mkDerivation {
   name = "udptunnel-19";
 
   src = fetchurl {
-    url = http://udptunnel.googlecode.com/files/udptunnel-r19.tar.gz;
-    sha1 = "51edec3b63b659229bcf92f6157568d3b074ede0";
+    url = "https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/udptunnel/udptunnel-r19.tar.gz";
+    sha256 = "1hkrn153rdyrp9g15z4d5dq44cqlnby2bfplp6z0g3862lnv7m3l";
   };
 
   installPhase = ''
@@ -15,7 +15,7 @@ stdenv.mkDerivation {
   '';
 
   meta = {
-    homepage = http://code.google.com/p/udptunnel/;
+    homepage = https://code.google.com/archive/p/udptunnel/;
     description = "Tunnels TCP over UDP packets";
     license = stdenv.lib.licenses.gpl3Plus;
     maintainers = with stdenv.lib.maintainers; [viric];
diff --git a/pkgs/tools/networking/uget/default.nix b/pkgs/tools/networking/uget/default.nix
index d38772604502..7d3e4ba1c61b 100644
--- a/pkgs/tools/networking/uget/default.nix
+++ b/pkgs/tools/networking/uget/default.nix
@@ -1,32 +1,37 @@
-{ stdenv, fetchurl, pkgconfig, intltool, openssl, curl, libnotify, gstreamer,
-  gst-plugins-base, gst-plugins-good, gnome3, makeWrapper, aria2 ? null }:
+{ stdenv, fetchurl, pkgconfig, intltool, openssl, curl, libnotify,
+  libappindicator-gtk3, gst_all_1, gnome3, wrapGAppsHook, aria2 ? null
+}:
 
 stdenv.mkDerivation rec {
   name = "uget-${version}";
-  version = "2.0.8";
+  version = "2.0.10";
 
   src = fetchurl {
     url = "mirror://sourceforge/urlget/${name}.tar.gz";
-    sha256 = "0919cf7lfk1djdl003cahqjvafdliv7v2l8r5wg95n4isqggdk75";
+    sha256 = "1zldsiy83xxpm8jdh1i9h7zrh8ak52srgy38fiyszysfapl8nx8a";
   };
 
-  nativeBuildInputs = [ pkgconfig intltool makeWrapper ];
+  nativeBuildInputs = [
+    pkgconfig
+    intltool
+    wrapGAppsHook
+  ];
   
   buildInputs = [
-    openssl curl libnotify gstreamer gst-plugins-base gst-plugins-good
-    gnome3.gtk (stdenv.lib.getLib gnome3.dconf)
+    openssl
+    curl
+    libnotify
+    libappindicator-gtk3
+    gnome3.gtk
+    (stdenv.lib.getLib gnome3.dconf)
   ]
+  ++ (with gst_all_1; [ gstreamer gst-plugins-base gst-plugins-good ])
   ++ (stdenv.lib.optional (aria2 != null) aria2);
 
   enableParallelBuilding = true;
-  
-  preFixup = ''
-    wrapProgram $out/bin/uget-gtk \
-      ${stdenv.lib.optionalString (aria2 != null) ''--suffix PATH : "${aria2}/bin"''} \
-      --prefix XDG_DATA_DIRS : "$out/share:$GSETTINGS_SCHEMAS_PATH" \
-      --prefix GST_PLUGIN_SYSTEM_PATH : "$GST_PLUGIN_SYSTEM_PATH" \
-      --prefix GIO_EXTRA_MODULES : "${stdenv.lib.getLib gnome3.dconf}/lib/gio/modules"
-  '';
+
+  preFixup = stdenv.lib.optionalString (aria2 != null)
+               ''gappsWrapperArgs+=(--suffix PATH : "${aria2}/bin")'';
 
   meta = with stdenv.lib; {
     description = "Download manager using gtk+ and libcurl";
@@ -37,9 +42,9 @@ stdenv.mkDerivation rec {
       thinking that it "might be too powerful" because remember power is good
       and lightweight power is uGet!
     '';
-    license = licenses.lgpl21;
     homepage = http://www.ugetdm.com;
-    maintainers = with maintainers; [ romildo ];
+    license = licenses.lgpl21;
     platforms = platforms.unix;
+    maintainers = with maintainers; [ romildo ];
   };
 }
diff --git a/pkgs/tools/networking/unbound/default.nix b/pkgs/tools/networking/unbound/default.nix
index 5b6b2ee7ba70..b124352fd7b9 100644
--- a/pkgs/tools/networking/unbound/default.nix
+++ b/pkgs/tools/networking/unbound/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "unbound-${version}";
-  version = "1.6.4";
+  version = "1.6.7";
 
   src = fetchurl {
     url = "http://unbound.net/downloads/${name}.tar.gz";
-    sha256 = "1vbzfzp932nhii5vq7z7rpczdyv624p17sy9hj1cn763ds0qh2nz";
+    sha256 = "17qwfmlls0w9kpkya3dlpn44b3kr87wsswzg3gawc13hh8yx8ysf";
   };
 
   outputs = [ "out" "lib" "man" ]; # "dev" would only split ~20 kB
diff --git a/pkgs/tools/networking/uqmi/default.nix b/pkgs/tools/networking/uqmi/default.nix
new file mode 100644
index 000000000000..010d6a7f8e85
--- /dev/null
+++ b/pkgs/tools/networking/uqmi/default.nix
@@ -0,0 +1,27 @@
+{ stdenv, lib, fetchgit, cmake, perl, libubox, json_c }:
+
+stdenv.mkDerivation {
+  name = "uqmi-2016-12-19";
+
+  src = fetchgit {
+    url = "https://git.openwrt.org/project/uqmi.git";
+    rev = "8ceeab690d8c6f1e3afbd4bcaee7bc2ba3fbe165";
+    sha256 = "1fw9r36d024iiq6bq2cikaq5pams5pnbc4z6pcmcny2k4l5cdb6m";
+  };
+
+  postPatch = ''
+    substituteInPlace data/gen-header.pl --replace /usr/bin/env ""
+    patchShebangs .
+  '';
+
+  nativeBuildInputs = [ cmake perl ];
+  buildInputs = [ libubox json_c ];
+
+  meta = with lib; {
+    description = "Tiny QMI command line utility";
+    homepage = "https://git.openwrt.org/?p=project/uqmi.git;a=summary";
+    license = licenses.gpl2Plus;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ fpletz ];
+  };
+}
diff --git a/pkgs/tools/networking/urlwatch/default.nix b/pkgs/tools/networking/urlwatch/default.nix
index 8161f700ce18..6a322f649ac4 100644
--- a/pkgs/tools/networking/urlwatch/default.nix
+++ b/pkgs/tools/networking/urlwatch/default.nix
@@ -2,19 +2,21 @@
 
 python3Packages.buildPythonApplication rec {
   name = "urlwatch-${version}";
-  version = "2.5";
+  version = "2.7";
 
   src = fetchFromGitHub {
     owner  = "thp";
     repo   = "urlwatch";
     rev    = version;
-    sha256 = "0irz54nvyq3cxa3fvjc5k2836a5nmly4wiiy4s5cwib1rnwg6r94";
+    sha256 = "0fx964z73yv08b1lpymmjsigf6929zx9ax5bp34rcf2c5gk11l5m";
   };
 
   propagatedBuildInputs = with python3Packages; [
+    appdirs
     keyring
     minidb
     pyyaml
+    pycodestyle
     requests
   ];
 
diff --git a/pkgs/tools/networking/wget/default.nix b/pkgs/tools/networking/wget/default.nix
index 1a260f910e20..b6bbae65e695 100644
--- a/pkgs/tools/networking/wget/default.nix
+++ b/pkgs/tools/networking/wget/default.nix
@@ -1,24 +1,19 @@
 { stdenv, fetchurl, gettext, pkgconfig, perl
 , libidn2, zlib, pcre, libuuid, libiconv
-, IOSocketSSL, LWP, python3
+, IOSocketSSL, LWP, python3, lzip
 , libpsl ? null
 , openssl ? null }:
 
 stdenv.mkDerivation rec {
-  name = "wget-1.19.1";
+  name = "wget-1.19.2";
 
   src = fetchurl {
-    url = "mirror://gnu/wget/${name}.tar.xz";
-    sha256 = "1ljcfhbkdsd0zjfm520rbl1ai62fc34i7c45sfj244l8f6b0p58c";
+    url = "mirror://gnu/wget/${name}.tar.lz";
+    sha256 = "01yzal7xm85543x02bij3capnigr063d6c5vc039f8n5s9d796nm";
   };
 
   patches = [
     ./remove-runtime-dep-on-openssl-headers.patch
-    (fetchurl {
-      name = "CVE-2017-6508";
-      url = "http://git.savannah.gnu.org/cgit/wget.git/patch/?id=4d729e322fae359a1aefaafec1144764a54e8ad4";
-      sha256 = "14r0c5y3w3gavxp2d9yq8xji82izi5sx0sjv6jpmk6zp6cnr7cjf";
-    })
   ];
 
   preConfigure = ''
@@ -34,7 +29,7 @@ stdenv.mkDerivation rec {
     export LIBS="-liconv -lintl"
   '';
 
-  nativeBuildInputs = [ gettext pkgconfig perl ];
+  nativeBuildInputs = [ gettext pkgconfig perl lzip ];
   buildInputs = [ libidn2 libiconv zlib pcre libuuid ]
     ++ stdenv.lib.optionals doCheck [ IOSocketSSL LWP python3 ]
     ++ stdenv.lib.optional (openssl != null) openssl
diff --git a/pkgs/tools/networking/whois/default.nix b/pkgs/tools/networking/whois/default.nix
index e6f251768645..ed8f2eebc75f 100644
--- a/pkgs/tools/networking/whois/default.nix
+++ b/pkgs/tools/networking/whois/default.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchFromGitHub, perl, gettext }:
 
 stdenv.mkDerivation rec {
-  version = "5.2.17";
+  version = "5.2.18";
   name = "whois-${version}";
 
   src = fetchFromGitHub {
     owner = "rfc1036";
     repo = "whois";
     rev = "v${version}";
-    sha256 = "15jnzk0js8wxiapz1bw7jnck0fl3mcli56f9635z9x7vk63ss68z";
+    sha256 = "0jzyq1rj6balc6a28swzgspv55xhkc75dw6wsn159in4ap61bzmi";
   };
 
   buildInputs = [ perl gettext ];
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
       select the appropriate WHOIS server for most queries.
     '';
 
-    homepage = http://packages.qa.debian.org/w/whois.html;
+    homepage = https://packages.qa.debian.org/w/whois.html;
     license = licenses.gpl2;
     maintainers = with maintainers; [ fpletz ];
     platforms = platforms.linux;
diff --git a/pkgs/tools/networking/wrk/default.nix b/pkgs/tools/networking/wrk/default.nix
index 7c72c2cd210c..05dcf6dc594c 100644
--- a/pkgs/tools/networking/wrk/default.nix
+++ b/pkgs/tools/networking/wrk/default.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
   
   meta = with stdenv.lib; {
     description = "HTTP benchmarking tool";
-    homepage = http://github.com/wg/wrk;
+    homepage = https://github.com/wg/wrk;
     longDescription = ''
       wrk is a modern HTTP benchmarking tool capable of generating
       significant load when run on a single multi-core CPU. It
diff --git a/pkgs/tools/networking/xl2tpd/default.nix b/pkgs/tools/networking/xl2tpd/default.nix
index c032ee7dd6b5..e50f208e95fe 100644
--- a/pkgs/tools/networking/xl2tpd/default.nix
+++ b/pkgs/tools/networking/xl2tpd/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "xl2tpd-${version}";
-  version = "1.3.7";
+  version = "1.3.10";
 
   src = fetchFromGitHub {
     owner = "xelerance";
     repo = "xl2tpd";
     rev = "v${version}";
-    sha256 = "0wjkj2b5rkxhx522wmkml5s0zdp68hkvrh7npx839dvsr79fji7k";
+    sha256 = "1z8a33hz82nla1342lfxdihssbhw9lzkgavdhl275im5byj8qgkg";
   };
 
   buildInputs = [ libpcap ];
diff --git a/pkgs/tools/nix/info/default.nix b/pkgs/tools/nix/info/default.nix
new file mode 100644
index 000000000000..e60c4eecbaf6
--- /dev/null
+++ b/pkgs/tools/nix/info/default.nix
@@ -0,0 +1,44 @@
+{ stdenv, lib, coreutils, findutils, gnugrep, darwin, shellcheck
+, doCheck ? false # Avoid having GHC in the build-time closure of all NixOS configuratinos
+}:
+
+stdenv.mkDerivation {
+  name = "nix-info";
+  src = ./info.sh;
+
+  nativeBuildInputs = lib.optionals doCheck [
+    shellcheck
+  ];
+
+  path = lib.makeBinPath ([
+    coreutils findutils gnugrep
+  ] ++ (if stdenv.isDarwin then [ darwin.DarwinTools ] else []));
+  is_darwin = if stdenv.isDarwin then "yes" else "no";
+
+  sandboxtest = ./sandbox.nix;
+  relaxedsandboxtest = ./relaxedsandbox.nix;
+  multiusertest = ./multiuser.nix;
+
+  unpackCmd = ''
+    mkdir nix-info
+    cp $src ./nix-info/nix-info
+  '';
+
+  buildPhase  = ''
+    substituteAllInPlace ./nix-info
+  '';
+
+  inherit doCheck;
+  checkPhase = ''
+    shellcheck ./nix-info
+  '';
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp ./nix-info $out/bin/nix-info
+  '';
+
+  meta = {
+    platforms = lib.platforms.all;
+  };
+}
diff --git a/pkgs/tools/nix/info/info.sh b/pkgs/tools/nix/info/info.sh
new file mode 100755
index 000000000000..473e035b8e0a
--- /dev/null
+++ b/pkgs/tools/nix/info/info.sh
@@ -0,0 +1,169 @@
+#!/bin/bash
+
+PATH="@path@:$PATH"
+IS_DARWIN="@is_darwin@"
+
+set -eu
+set -o pipefail
+
+DEBUG=0
+MARKDOWN=0
+HOST_OS=0
+SANDBOX=0
+while true; do
+    case "${1:-}" in
+        "")
+            break
+            ;;
+        -d | --debug)
+            set -x
+            DEBUG=1
+            shift
+            ;;
+        -m | --markdown)
+            MARKDOWN=1
+            HOST_OS=1
+            SANDBOX=1
+            shift
+            ;;
+        --host-os)
+            HOST_OS=1
+            shift
+            ;;
+        --sandbox)
+            SANDBOX=1
+            shift
+            ;;
+
+        * )
+            cat <<EOF
+nix-info - get high level info to help with debugging
+
+Options:
+
+ -m, --markdown   formatting for a GitHub issue
+                  implies: --host-os, --sandbox
+
+     --sandbox    include sandbox configuration
+     --host-os    include host OS details
+
+ -h, --help       show this message
+ -d, --debug      debug mode
+
+EOF
+            exit 1
+            ;;
+
+    esac
+done
+
+debuglog() {
+    if [ $DEBUG -eq 1 ]; then
+        cat >&2
+    else
+        cat > /dev/null
+    fi
+}
+
+nixev() {
+    nix-instantiate --eval --strict -E "$1"
+}
+
+desc_system() {
+    nixev '(import <nixpkgs> {}).system'
+}
+
+desc_host_os() {
+    printf "%s" "$(uname -sr)"
+
+    if [ "$IS_DARWIN" = "yes" ]; then
+        printf ", macOS %s" "$(sw_vers -productVersion)"
+    fi
+
+    if [ -f /etc/os-release ]; then
+        (
+            # shellcheck disable=SC1091
+            . /etc/os-release
+            printf ", %s, %s" "${NAME:-$(uname -v)}" "${VERSION:-noversion}"
+        )
+    fi
+}
+
+desc_multi_user() {
+    if nix-build --no-out-link  @multiusertest@ 2>&1 | debuglog; then
+        printf "yes"
+    else
+        printf "no"
+    fi
+}
+
+desc_nixpkgs_path() {
+    nixev '<nixpkgs>'
+}
+
+channel_facts() {
+    find /nix/var/nix/profiles/per-user \
+         -mindepth 2 \
+         -maxdepth 2 \
+         -name channels \
+         -print0 \
+    |\
+    while  IFS= read -r -d '' userchannelset; do
+        manifest="$userchannelset/manifest.nix"
+
+        if [ -e "$manifest" ]; then
+            userchannels=$(nixev \
+                           "builtins.concatStringsSep \", \"
+                             (map (ch: ch.name)
+                               (import \"$manifest\"))")
+
+            fact "channels($(echo "$manifest" | cut -d/ -f7))" \
+                 "$userchannels"
+        fi
+    done
+}
+
+desc_sandbox() {
+    if nix-build --no-out-link @sandboxtest@ 2>&1 | debuglog; then
+        printf "no"
+    elif nix-build --no-out-link @relaxedsandboxtest@ 2>&1 | debuglog; then
+        printf "relaxed"
+    else
+        printf "yes"
+    fi
+}
+
+fact() {
+    name="${1:-0}"
+    value="${2:-0}"
+    last="${3:-1}"
+    if [ $MARKDOWN -eq 0 ]; then
+        printf "%s: %s" "$name" "$value"
+        if [ "$last" -eq 1 ]; then
+            printf ", "
+        fi
+    else
+        printf " - %s: \`%s\`\n" "$name" "$value"
+    fi
+
+    if [ "$last" -eq 0 ]; then
+        echo ""
+    fi
+}
+
+last_fact() {
+    fact "$1" "$2" 0
+}
+
+fact "system" "$(desc_system)"
+if [ $HOST_OS -eq 1 ]; then
+    fact "host os" "$(desc_host_os)"
+fi
+fact "multi-user?" "$(desc_multi_user)"
+if [ $SANDBOX -eq 1 ]; then
+    fact "sandbox" "$(desc_sandbox)"
+fi
+
+fact "version" "$(nix-env --version)"
+channel_facts
+last_fact "nixpkgs" "$(desc_nixpkgs_path)"
diff --git a/pkgs/tools/nix/info/multiuser.nix b/pkgs/tools/nix/info/multiuser.nix
new file mode 100644
index 000000000000..827d52987673
--- /dev/null
+++ b/pkgs/tools/nix/info/multiuser.nix
@@ -0,0 +1,12 @@
+let
+  pkgs = import <nixpkgs> {};
+in pkgs.runCommand "diagnostics-multiuser"
+  {  }
+  ''
+    set -x
+    # no cache: ${toString builtins.currentTime}
+    # For reproducibility, nix always uses nixbld group:
+    # https://github.com/NixOS/nix/blob/1dd29d7aebae706f3e90a18bbfae727f2ed03c70/src/libstore/build.cc#L1896-L1908
+    test "$(groups)" == "nixbld"
+    touch $out
+  ''
diff --git a/pkgs/tools/nix/info/relaxedsandbox.nix b/pkgs/tools/nix/info/relaxedsandbox.nix
new file mode 100644
index 000000000000..625a6ecc39e0
--- /dev/null
+++ b/pkgs/tools/nix/info/relaxedsandbox.nix
@@ -0,0 +1,12 @@
+let
+  pkgs = import <nixpkgs> {};
+in pkgs.runCommand "diagnostics-sandbox"
+  {
+    __noChroot = true;
+  }
+  ''
+    set -x
+    # no cache: ${toString builtins.currentTime}
+    test -d "$(dirname "$out")/../var/nix"
+    touch $out
+  ''
diff --git a/pkgs/tools/nix/info/sandbox.nix b/pkgs/tools/nix/info/sandbox.nix
new file mode 100644
index 000000000000..fa4288c2f944
--- /dev/null
+++ b/pkgs/tools/nix/info/sandbox.nix
@@ -0,0 +1,10 @@
+let
+  pkgs = import <nixpkgs> {};
+in pkgs.runCommand "diagnostics-sandbox"
+  { }
+  ''
+    set -x
+    # no cache: ${toString builtins.currentTime}
+    test -d "$(dirname "$out")/../var/nix"
+    touch $out
+  ''
diff --git a/pkgs/tools/package-management/apt/default.nix b/pkgs/tools/package-management/apt/default.nix
index 8082565361b9..8077fb1d93d0 100644
--- a/pkgs/tools/package-management/apt/default.nix
+++ b/pkgs/tools/package-management/apt/default.nix
@@ -24,10 +24,12 @@ stdenv.mkDerivation rec {
     sha256 = "0ahwhmscrmnpvl1r732wg93dzkhv8c1sph2yrqgsrhr73c1616ix";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
+
   buildInputs = [
-    pkgconfig cmake perl curl gtest lzma bzip2 lz4 db dpkg libxslt.bin
+    cmake perl curl gtest lzma bzip2 lz4 db dpkg libxslt.bin
   ] ++ lib.optionals withDocs [
-    doxygen Po4a w3m
+    doxygen Po4a w3m docbook_xml_dtd_45
   ] ++ lib.optionals withNLS [
     gettext
   ];
@@ -42,15 +44,6 @@ stdenv.mkDerivation rec {
       -DWITH_DOC=${if withDocs then "ON" else "OFF"}
       -DUSE_NLS=${if withNLS then "ON" else "OFF"}
     )
-
-    for f in doc/*; do
-      if [[ -f "$f" ]]; then
-        substituteInPlace "$f" \
-          --replace \
-            "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" \
-            "${docbook_xml_dtd_45}/xml/dtd/docbook/docbookx.dtd"
-      fi
-    done
   '';
 
   enableParallelBuilding = true;
diff --git a/pkgs/tools/package-management/cargo-edit/default.nix b/pkgs/tools/package-management/cargo-edit/default.nix
index 4a34e62322d2..ecb0708eb307 100644
--- a/pkgs/tools/package-management/cargo-edit/default.nix
+++ b/pkgs/tools/package-management/cargo-edit/default.nix
@@ -15,7 +15,7 @@ buildRustPackage rec {
 
   buildInputs = [ zlib openssl ];
 
-  depsSha256 = "1v7ir56j6biximnnhyvadd98azcj3i5hc8aky0am2nf0swq0jimq";
+  cargoSha256 = "1m4yb7472g1n900dh3xqvdcywk3v01slj3bkk7bk7a9p5x1kyjfn";
 
   meta = with stdenv.lib; {
     description = "A utility for managing cargo dependencies from the command line";
@@ -23,5 +23,6 @@ buildRustPackage rec {
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ jb55 ];
     platforms = platforms.all;
+    broken = true;
   };
 }
diff --git a/pkgs/tools/package-management/disnix/default.nix b/pkgs/tools/package-management/disnix/default.nix
index f260241fe6ba..830c576c4062 100644
--- a/pkgs/tools/package-management/disnix/default.nix
+++ b/pkgs/tools/package-management/disnix/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation {
     sha256 = "1cgf7hgqrwsqgyc77sis0hr7cwgk3vx8cd4msgq11qbwywi3b6id";
   };
   
-  buildInputs = [ pkgconfig glib libxml2 libxslt getopt nixUnstable libintlOrEmpty libiconv dysnomia ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ glib libxml2 libxslt getopt nixUnstable libintlOrEmpty libiconv dysnomia ];
 
   meta = {
     description = "A Nix-based distributed service deployment tool";
diff --git a/pkgs/tools/package-management/disnix/disnixos/default.nix b/pkgs/tools/package-management/disnix/disnixos/default.nix
index 2a6a0dcc78a3..98d1802f881a 100644
--- a/pkgs/tools/package-management/disnix/disnixos/default.nix
+++ b/pkgs/tools/package-management/disnix/disnixos/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation {
     sha256 = "0pqv8n9942vjwmb32m1af29fi0vjlsbwkj2c7h1xs28z6wahr7wa";
   };
   
-  buildInputs = [ socat pkgconfig dysnomia disnix getopt ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ socat dysnomia disnix getopt ];
   
   meta = {
     description = "Provides complementary NixOS infrastructure deployment to Disnix";
diff --git a/pkgs/tools/package-management/dpkg/default.nix b/pkgs/tools/package-management/dpkg/default.nix
index 53c39003483d..63431e29facb 100644
--- a/pkgs/tools/package-management/dpkg/default.nix
+++ b/pkgs/tools/package-management/dpkg/default.nix
@@ -1,12 +1,12 @@
-{ stdenv, fetchurl, perl, zlib, bzip2, xz, makeWrapper }:
+{ stdenv, fetchurl, perl, zlib, bzip2, xz, makeWrapper, coreutils }:
 
 stdenv.mkDerivation rec {
   name = "dpkg-${version}";
-  version = "1.18.24";
+  version = "1.19.0.4";
 
   src = fetchurl {
     url = "mirror://debian/pool/main/d/dpkg/dpkg_${version}.tar.xz";
-    sha256 = "1d6p22vk1b9v16q96mwaz9w2xr4ly28yamkh49md9gq67qfhhlyq";
+    sha256 = "02lrwrkl2g1jwj71088rwswx07a1zq1jkq7193lbvy8jj2qnp9lq";
   };
 
   configureFlags = [
@@ -31,6 +31,24 @@ stdenv.mkDerivation rec {
     done
   '';
 
+  patchPhase = ''
+    patchShebangs .
+
+    # Dpkg commands sometimes calls out to shell commands
+    substituteInPlace lib/dpkg/dpkg.h \
+       --replace '"dpkg-deb"' \"$out/bin/dpkg-deb\" \
+       --replace '"dpkg-split"' \"$out/bin/dpkg-split\" \
+       --replace '"dpkg-query"' \"$out/bin/dpkg-query\" \
+       --replace '"dpkg-divert"' \"$out/bin/dpkg-divert\" \
+       --replace '"dpkg-statoverride"' \"$out/bin/dpkg-statoverride\" \
+       --replace '"dpkg-trigger"' \"$out/bin/dpkg-trigger\" \
+       --replace '"dpkg"' \"$out/bin/dpkg\" \
+       --replace '"debsig-verify"' \"$out/bin/debsig-verify\" \
+       --replace '"rm"' \"${coreutils}/bin/rm\" \
+       --replace '"cat"' \"${coreutils}/bin/cat\" \
+       --replace '"diff"' \"${coreutils}/bin/diff\"
+  '';
+
   buildInputs = [ perl zlib bzip2 xz ];
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/tools/package-management/fpm/Gemfile b/pkgs/tools/package-management/fpm/Gemfile
index ea498ca78355..17ed0a0cb2af 100644
--- a/pkgs/tools/package-management/fpm/Gemfile
+++ b/pkgs/tools/package-management/fpm/Gemfile
@@ -1,4 +1,3 @@
 source 'https://rubygems.org'
 
-gem 'archive-tar-minitar', '>= 0.5.2.1', github: 'peterhoeg/archive-tar-minitar'
 gem 'fpm'
diff --git a/pkgs/tools/package-management/fpm/Gemfile.lock b/pkgs/tools/package-management/fpm/Gemfile.lock
index 16d7a8250ec9..e0c12dcce31a 100644
--- a/pkgs/tools/package-management/fpm/Gemfile.lock
+++ b/pkgs/tools/package-management/fpm/Gemfile.lock
@@ -1,22 +1,16 @@
-GIT
-  remote: git://github.com/peterhoeg/archive-tar-minitar.git
-  revision: dae32ca550a87dba32597115ae18805db4782ebe
-  specs:
-    archive-tar-minitar (0.5.2.1)
-
 GEM
   remote: https://rubygems.org/
   specs:
     arr-pm (0.0.10)
       cabin (> 0)
-    backports (3.6.8)
-    cabin (0.8.1)
-    childprocess (0.5.9)
+    backports (3.10.3)
+    cabin (0.9.0)
+    childprocess (0.8.0)
       ffi (~> 1.0, >= 1.0.11)
-    clamp (1.0.0)
-    ffi (1.9.14)
-    fpm (1.6.2)
-      archive-tar-minitar
+    clamp (1.0.1)
+    dotenv (2.2.1)
+    ffi (1.9.18)
+    fpm (1.9.3)
       arr-pm (~> 0.0.10)
       backports (>= 2.6.2)
       cabin (>= 0.6.0)
@@ -24,29 +18,30 @@ GEM
       clamp (~> 1.0.0)
       ffi
       json (>= 1.7.7, < 2.0)
-      pleaserun (~> 0.0.24)
+      pleaserun (~> 0.0.29)
       ruby-xz
+      stud
     insist (1.0.0)
     io-like (0.3.0)
-    json (1.8.3)
+    json (1.8.6)
     mustache (0.99.8)
-    pleaserun (0.0.24)
+    pleaserun (0.0.30)
       cabin (> 0)
       clamp
+      dotenv
       insist
       mustache (= 0.99.8)
       stud
     ruby-xz (0.2.3)
       ffi (~> 1.9)
       io-like (~> 0.3)
-    stud (0.0.22)
+    stud (0.0.23)
 
 PLATFORMS
   ruby
 
 DEPENDENCIES
-  archive-tar-minitar (>= 0.5.2.1)!
   fpm
 
 BUNDLED WITH
-   1.14.3
+   1.14.6
diff --git a/pkgs/tools/package-management/fpm/gemset.nix b/pkgs/tools/package-management/fpm/gemset.nix
index 4243651dd25d..26450bc36122 100644
--- a/pkgs/tools/package-management/fpm/gemset.nix
+++ b/pkgs/tools/package-management/fpm/gemset.nix
@@ -1,15 +1,6 @@
 {
-  archive-tar-minitar = {
-    source = {
-      fetchSubmodules = false;
-      rev = "dae32ca550a87dba32597115ae18805db4782ebe";
-      sha256 = "0fvxacbcb52fm5dis451kdd7dv74z8p6nm4vnfqf7jg2aghcxdkd";
-      type = "git";
-      url = "git://github.com/peterhoeg/archive-tar-minitar.git";
-    };
-    version = "0.5.2.1";
-  };
   arr-pm = {
+    dependencies = ["cabin"];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "07yx1g1nh4zdy38i2id1xyp42fvj4vl6i196jn7szvjfm0jx98hg";
@@ -20,50 +11,60 @@
   backports = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1zcgqw7m7jb8n7b2jwla5cq0nw9wsgddxfmn0a9v89ihzd4i1a5k";
+      sha256 = "1agsk23kfr194s690jnrpijh9pf3hq4a9yy66j1wzzj2x19ss9y0";
       type = "gem";
     };
-    version = "3.6.8";
+    version = "3.10.3";
   };
   cabin = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "06b5ri2629ad9xjc419xswz17zli90v8x640k2sd6v2yb90zkr1b";
+      sha256 = "0b3b8j3iqnagjfn1261b9ncaac9g44zrx1kcg81yg4z9i513kici";
       type = "gem";
     };
-    version = "0.8.1";
+    version = "0.9.0";
   };
   childprocess = {
+    dependencies = ["ffi"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1is253wm9k2s325nfryjnzdqv9flq8bm4y2076mhdrncxamrh7r2";
+      sha256 = "081hxbgrqjxha0jz0p0wkncdqawdvlsxb3awsx195g0pgkpqrcms";
       type = "gem";
     };
-    version = "0.5.9";
+    version = "0.8.0";
   };
   clamp = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0vy6ghz9l84qazlza30z0dwwrlifc5c7akgrl1v72ivmmjga45hw";
+      sha256 = "0jb6l4scp69xifhicb5sffdixqkw8wgkk9k2q57kh2y36x1px9az";
       type = "gem";
     };
-    version = "1.0.0";
+    version = "1.0.1";
+  };
+  dotenv = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1pgzlvs0sswnqlgfm9gkz2hlhkc0zd3vnlp2vglb1wbgnx37pjjv";
+      type = "gem";
+    };
+    version = "2.2.1";
   };
   ffi = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1nkcrmxqr0vb1y4rwliclwlj2ajsi4ddpdx2gvzjy0xbkk5iqzfp";
+      sha256 = "034f52xf7zcqgbvwbl20jwdyjwznvqnwpbaps9nk18v9lgb1dpx0";
       type = "gem";
     };
-    version = "1.9.14";
+    version = "1.9.18";
   };
   fpm = {
+    dependencies = ["arr-pm" "backports" "cabin" "childprocess" "clamp" "ffi" "json" "pleaserun" "ruby-xz" "stud"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1ids20mcs6w8nf4bpjj749ayc7h637kqx0pdw5d5a0yzik34daaj";
+      sha256 = "0yvp9cifzfrxv3pr1kvcvvnyrcz8vxf6yd43hg5blaick50sbm23";
       type = "gem";
     };
-    version = "1.6.2";
+    version = "1.9.3";
   };
   insist = {
     source = {
@@ -84,10 +85,10 @@
   json = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1nsby6ry8l9xg3yw4adlhk2pnc7i0h0rznvcss4vk3v74qg0k8lc";
+      sha256 = "0qmj7fypgb9vag723w1a49qihxrcf5shzars106ynw2zk352gbv5";
       type = "gem";
     };
-    version = "1.8.3";
+    version = "1.8.6";
   };
   mustache = {
     source = {
@@ -98,14 +99,16 @@
     version = "0.99.8";
   };
   pleaserun = {
+    dependencies = ["cabin" "clamp" "dotenv" "insist" "mustache" "stud"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0s26216ip6skzbdl48z8wbrzqbvwq1q4s6sm8r209zvvlp0rinkw";
+      sha256 = "0hgnrl67zkqaxmfkwbyscawj4wqjm7h8khpbj58s6iw54wp3408p";
       type = "gem";
     };
-    version = "0.0.24";
+    version = "0.0.30";
   };
   ruby-xz = {
+    dependencies = ["ffi" "io-like"];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "11bgpvvk0098ghvlxr4i713jmi2izychalgikwvdwmpb452r3ndw";
@@ -116,9 +119,9 @@
   stud = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1raavxgn5k4bxap5wqdl7zmfw5k4ndl8aagnajlfg4f0bmm8yni7";
+      sha256 = "0qpb57cbpm9rwgsygqxifca0zma87drnlacv49cqs2n5iyi6z8kb";
       type = "gem";
     };
-    version = "0.0.22";
+    version = "0.0.23";
   };
 }
\ No newline at end of file
diff --git a/pkgs/tools/package-management/fpm/update b/pkgs/tools/package-management/fpm/update
new file mode 100755
index 000000000000..22d1e52e2977
--- /dev/null
+++ b/pkgs/tools/package-management/fpm/update
@@ -0,0 +1,10 @@
+#!/usr/bin/env nix-shell
+#! nix-shell -i bash -p bash ruby bundler bundix
+
+rm Gemfile.lock
+bundler install
+bundix
+
+if [ "clean" == "$1" ]; then
+  rm -r ~/.gem
+fi
diff --git a/pkgs/tools/package-management/librepo/default.nix b/pkgs/tools/package-management/librepo/default.nix
index 99a5013e217e..622d095d4613 100644
--- a/pkgs/tools/package-management/librepo/default.nix
+++ b/pkgs/tools/package-management/librepo/default.nix
@@ -1,21 +1,16 @@
 { stdenv, fetchFromGitHub, cmake, python2, pkgconfig, expat, glib, pcre, openssl, curl, check, attr, gpgme }:
 
 stdenv.mkDerivation rec {
-  version = "1.7.20";
+  version = "1.8.1";
   name = "librepo-${version}";
 
   src = fetchFromGitHub {
     owner  = "rpm-software-management";
     repo   = "librepo";
-    rev    = name;
-    sha256 = "17fgj2wifn2qxmh1p285fbwys0xbvwbnmxsdfvqyr5njpyl2s99h";
+    rev    = version;
+    sha256 = "11rypnxjgsc2klyg294ndxy1cyp0nyk00zpjhcvqkhp58vvkkv12";
   };
 
-  patchPhase = ''
-    substituteInPlace librepo/python/python2/CMakeLists.txt \
-      --replace ' ''${PYTHON_INSTALL_DIR}' " $out/lib/python2.7/site-packages"
-  '';
-
   nativeBuildInputs = [ cmake pkgconfig ];
 
   buildInputs = [ python2 expat glib pcre openssl curl check attr gpgme ];
@@ -25,9 +20,9 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "Library providing C and Python (libcURL like) API for downloading linux repository metadata and packages";
+    homepage    = https://rpm-software-management.github.io/librepo/;
     license     = licenses.lgpl2Plus;
     platforms   = platforms.linux;
     maintainers = with maintainers; [ copumpkin ];
   };
 }
-
diff --git a/pkgs/tools/package-management/niff/default.nix b/pkgs/tools/package-management/niff/default.nix
new file mode 100644
index 000000000000..8c6a72cf131e
--- /dev/null
+++ b/pkgs/tools/package-management/niff/default.nix
@@ -0,0 +1,34 @@
+{ stdenv
+, python3
+, fetchFromGitHub
+}:
+
+let
+  pname = "niff";
+  version = "0.1";
+in stdenv.mkDerivation {
+  name = "${pname}-${version}";
+
+  src = fetchFromGitHub {
+    owner = "FRidh";
+    repo = "niff";
+    rev = "v${version}";
+    sha256 = "1ziv5r57jzg2qg61izvkkyq1bz4p5nb6652dzwykfj3l2r3db4bi";
+  };
+
+  buildInputs = [ python3 ];
+
+  dontBuild = true;
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp niff $out/bin/niff
+  '';
+
+  meta = {
+    description = "A program that compares two Nix expressions and determines which attributes changed";
+    homepage = https://github.com/FRidh/niff;
+    license = stdenv.lib.licenses.mit;
+    maintainers = [ stdenv.lib.maintainers.fridh ];
+  };
+}
\ No newline at end of file
diff --git a/pkgs/tools/package-management/nix-bundle/default.nix b/pkgs/tools/package-management/nix-bundle/default.nix
index e3255afe7fe8..7c02d2d9a638 100644
--- a/pkgs/tools/package-management/nix-bundle/default.nix
+++ b/pkgs/tools/package-management/nix-bundle/default.nix
@@ -3,13 +3,13 @@
 stdenv.mkDerivation rec {
   pname = "nix-bundle";
   name = "${pname}-${version}";
-  version = "0.1.3";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "matthewbauer";
     repo = pname;
     rev = "v${version}";
-    sha256 = "15r77pchf4s4cdv4lvw2zw1yic78k8p0n2r954qq370vscw30yac";
+    sha256 = "0klabmygbhzlwxja8p2w8fp8ip3xaa5ym9c15rp9qxzh03hfmdjx";
   };
 
   # coreutils, gnutar is actually needed by nix for bootstrap
@@ -23,6 +23,7 @@ stdenv.mkDerivation rec {
     mkdir -p $out/bin
     makeWrapper $out/share/nix-bundle/nix-bundle.sh $out/bin/nix-bundle \
       --prefix PATH : ${binPath}
+    cp $out/share/nix-bundle/nix-run.sh $out/bin/nix-run
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/package-management/nix-index/default.nix b/pkgs/tools/package-management/nix-index/default.nix
index 388942f6ad87..df5a39d6a031 100644
--- a/pkgs/tools/package-management/nix-index/default.nix
+++ b/pkgs/tools/package-management/nix-index/default.nix
@@ -12,8 +12,9 @@ buildRustPackage rec {
     rev = "v${version}";
     sha256 = "1lmg65yqkwf2a5qxm3dmv8158kqhnriir062vlgar5wimf409rm5";
   };
-  depsSha256 = "0v145fi9bfiwvsdy7hz9lw4m2f2j8sxvixfzmjwfnq4klm51c8yl";
-  buildInputs = [pkgconfig openssl curl];
+  cargoSha256 = "0cxdrzjmqq3ywdh0f5mzkcf50hbbgd3bak4398v2ls5gy5s9fcz2";
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ openssl curl];
 
   postInstall = ''
     mkdir -p $out/etc/profile.d
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index 56324f4073db..fe7818691779 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchurl, fetchFromGitHub, perl, curl, bzip2, sqlite, openssl ? null, xz
 , pkgconfig, boehmgc, perlPackages, libsodium, aws-sdk-cpp, brotli, readline
 , autoreconfHook, autoconf-archive, bison, flex, libxml2, libxslt, docbook5, docbook5_xsl
-, libseccomp, busybox
+, libseccomp, busybox, nlohmann_json
 , hostPlatform
 , storeDir ? "/nix/store"
 , stateDir ? "/nix/var"
@@ -39,7 +39,7 @@ let
 
     buildInputs = [ curl openssl sqlite xz ]
       ++ lib.optional (stdenv.isLinux || stdenv.isDarwin) libsodium
-      ++ lib.optionals fromGit [ brotli readline ] # Since 1.12
+      ++ lib.optionals fromGit [ brotli readline nlohmann_json ] # Since 1.12
       ++ lib.optional stdenv.isLinux libseccomp
       ++ lib.optional ((stdenv.isLinux || stdenv.isDarwin) && is112)
           (aws-sdk-cpp.override {
@@ -116,7 +116,7 @@ let
         a package, multi-user package management and easy setup of build
         environments.
       '';
-      homepage = http://nixos.org/;
+      homepage = https://nixos.org/;
       license = stdenv.lib.licenses.lgpl2Plus;
       maintainers = [ stdenv.lib.maintainers.eelco ];
       platforms = stdenv.lib.platforms.all;
@@ -152,21 +152,21 @@ in rec {
   nix = nixStable;
 
   nixStable = (common rec {
-    name = "nix-1.11.13";
+    name = "nix-1.11.15";
     src = fetchurl {
       url = "http://nixos.org/releases/nix/${name}/${name}.tar.xz";
-      sha256 = "0913975e262f8069fde6e71a5fae757bb3aef558c51d1711034c525146ea5913";
+      sha256 = "d20f20e45d519f54fae5c61d55eadcf53e6d7cdbde9870eeec80d499f9805165";
     };
   }) // { perl-bindings = nixStable; };
 
   nixUnstable = (lib.lowPrio (common rec {
-    name = "nix-1.12${suffix}";
-    suffix = "pre5511_c94f3d55";
+    name = "nix-unstable-1.12${suffix}";
+    suffix = "pre5732_fd10f6f2";
     src = fetchFromGitHub {
       owner = "NixOS";
       repo = "nix";
-      rev = "c94f3d5575d7af5403274d1e9e2f3c9d72989751";
-      sha256 = "1akfzzm4f07wj6l7za916xv5rnh71pk3vl8dphgradjfqb37bv18";
+      rev = "fd10f6f2414521947ca60b9d1508d909f50e9faa";
+      sha256 = "17561jll94c8hdpxnyvdbjslnwr9g7ii4wqvrla7gfza236j9hff";
     };
     fromGit = true;
   })) // { perl-bindings = perl-bindings { nix = nixUnstable; }; };
diff --git a/pkgs/tools/package-management/nixops/default.nix b/pkgs/tools/package-management/nixops/default.nix
index 1467faac8e3f..daecb8746eaf 100644
--- a/pkgs/tools/package-management/nixops/default.nix
+++ b/pkgs/tools/package-management/nixops/default.nix
@@ -1,9 +1,9 @@
 { callPackage, fetchurl }:
 
 callPackage ./generic.nix (rec {
-  version = "1.5.1";
+  version = "1.5.2";
   src = fetchurl {
     url = "http://nixos.org/releases/nixops/nixops-${version}/nixops-${version}.tar.bz2";
-    sha256 = "0pba9c8ya4hvqmg458p74g69hb06lh0f5bsgw7dsi8pjrcb0624g";
+    sha256 = "00y2arc5rffvy6xmx4p6ibpjyc61k8dkiabq7ccwwjgckz1d2dpb";
   };
 })
diff --git a/pkgs/tools/package-management/nixui/generate.sh b/pkgs/tools/package-management/nixui/generate.sh
index 915497208fac..e3a7d9f69e4f 100755
--- a/pkgs/tools/package-management/nixui/generate.sh
+++ b/pkgs/tools/package-management/nixui/generate.sh
@@ -1,3 +1,3 @@
 #!/bin/sh -e
 
-node2nix -i pkg.json -c nixui.nix -e ../../../development/node-packages/node-env.nix
+node2nix -i pkg.json -c nixui.nix -e ../../../development/node-packages/node-env.nix --no-copy-node-env
diff --git a/pkgs/tools/package-management/nox/default.nix b/pkgs/tools/package-management/nox/default.nix
index bba7c3d7fa69..f6c5c7b53e13 100644
--- a/pkgs/tools/package-management/nox/default.nix
+++ b/pkgs/tools/package-management/nox/default.nix
@@ -2,14 +2,16 @@
 
 pythonPackages.buildPythonApplication rec {
   name = "nox-${version}";
-  version = "0.0.5";
+  version = "0.0.6";
   namePrefix = "";
 
   src = fetchurl {
     url = "mirror://pypi/n/nix-nox/nix-nox-${version}.tar.gz";
-    sha256 = "1kwrkp7njxn2sqmmzy5d33d07gawbw2ab2bmfjz0y1r23z9iadf2";
+    sha256 = "1qcbhdnhdhhv7q6cqdgv0q55ic8fk18526zn2yb12x9r1s0lfp9z";
   };
 
+  patches = [ ./nox-review-wip.patch ];
+
   buildInputs = [ pythonPackages.pbr git ];
 
   propagatedBuildInputs = with pythonPackages; [
@@ -23,6 +25,7 @@ pythonPackages.buildPythonApplication rec {
     homepage = https://github.com/madjar/nox;
     description = "Tools to make nix nicer to use";
     maintainers = [ lib.maintainers.madjar ];
+    license = lib.licenses.mit;
     platforms = lib.platforms.all;
   };
 }
diff --git a/pkgs/tools/package-management/nox/nox-review-wip.patch b/pkgs/tools/package-management/nox/nox-review-wip.patch
new file mode 100644
index 000000000000..e82dc7a2c266
--- /dev/null
+++ b/pkgs/tools/package-management/nox/nox-review-wip.patch
@@ -0,0 +1,11 @@
+--- a/nox/review.py	2017-09-23 04:04:37.322484753 +0200
++++ a/nox/review.py	2017-09-23 04:18:31.582692181 +0200
+@@ -84,7 +84,7 @@
+     ctx.obj['dry_run'] = dry_run
+ 
+ 
+-@cli.command(short_help='difference between working tree and a commit')
++@cli.command('wip', short_help='difference between working tree and a commit')
+ @click.option('--against', default='HEAD')
+ @click.pass_context
+ @setup_nixpkgs_config
diff --git a/pkgs/tools/package-management/opkg/default.nix b/pkgs/tools/package-management/opkg/default.nix
index e1e57a84b555..a0368b0df89e 100644
--- a/pkgs/tools/package-management/opkg/default.nix
+++ b/pkgs/tools/package-management/opkg/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "A lightweight package management system based upon ipkg";
-    homepage = http://code.google.com/p/opkg/;
+    homepage = https://git.yoctoproject.org/cgit/cgit.cgi/opkg/;
     license = licenses.gpl2;
     platforms = platforms.linux;
     maintainers = with maintainers; [ pSub ];
diff --git a/pkgs/tools/package-management/packagekit/default.nix b/pkgs/tools/package-management/packagekit/default.nix
index 180395571b22..d4e6885d8f36 100644
--- a/pkgs/tools/package-management/packagekit/default.nix
+++ b/pkgs/tools/package-management/packagekit/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub, lib
 , intltool, glib, pkgconfig, polkit, python, sqlite, systemd
-, gobjectIntrospection, vala_0_23, gtk_doc, autoreconfHook, autoconf-archive
+, gobjectIntrospection, vala_0_38, gtk_doc, autoreconfHook, autoconf-archive
 # TODO: set enableNixBackend to true, as soon as it builds
 , nix, enableNixBackend ? false, boost
 , enableCommandNotFound ? false
@@ -8,16 +8,16 @@
 
 stdenv.mkDerivation rec {
   name = "packagekit-${version}";
-  version = "1.1.3";
+  version = "1.1.7";
 
   src = fetchFromGitHub {
     owner = "hughsie";
     repo = "PackageKit";
     rev = "PACKAGEKIT_${lib.replaceStrings ["."] ["_"] version}";
-    sha256 = "150mpar7bhlvwfpwsr6zrjn3yggvklzr6nlhk0shaxnrfkfxvvb6";
+    sha256 = "076rrczmyhapj87pxqldsar5pbz4mid6cm9l1n91zh2q403chdkb";
   };
 
-  buildInputs = [ glib polkit systemd python gobjectIntrospection vala_0_23 ]
+  buildInputs = [ glib polkit systemd python gobjectIntrospection vala_0_38 ]
                   ++ lib.optional enableBashCompletion bash-completion;
   propagatedBuildInputs = [ sqlite nix boost ];
   nativeBuildInputs = [ intltool pkgconfig autoreconfHook autoconf-archive gtk_doc ];
diff --git a/pkgs/tools/package-management/rpm/default.nix b/pkgs/tools/package-management/rpm/default.nix
index 78d815eb7c19..25fcb8bc27e3 100644
--- a/pkgs/tools/package-management/rpm/default.nix
+++ b/pkgs/tools/package-management/rpm/default.nix
@@ -1,20 +1,24 @@
-{ stdenv, fetchurl, cpio, zlib, bzip2, file, elfutils, libarchive, nspr, nss, popt, db, xz, python, lua, pkgconfig, binutils, autoreconfHook }:
+{ stdenv
+, pkgconfig, autoreconfHook
+, fetchurl, cpio, zlib, bzip2, file, elfutils, libbfd, libarchive, nspr, nss, popt, db, xz, python, lua
+}:
 
 stdenv.mkDerivation rec {
   name = "rpm-${version}";
-  version = "4.13.0.1";
+  version = "4.14.0";
 
   src = fetchurl {
-    url = "http://ftp.rpm.org/releases/rpm-4.13.x/rpm-${version}.tar.bz2";
-    sha256 = "27fc7ba7d419622b1ce34d6507aa70b0808bc344021d298072a0c2ec165f9b0d";
+    url = "http://ftp.rpm.org/releases/rpm-4.14.x/rpm-${version}.tar.bz2";
+    sha256 = "053396glswgszzg6wizn76vc8zc5m2bicw025vj44g0dc1aav806";
   };
 
   outputs = [ "out" "dev" "man" ];
 
-  buildInputs = [ cpio zlib bzip2 file libarchive nspr nss db xz python lua pkgconfig autoreconfHook ];
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  buildInputs = [ cpio zlib bzip2 file libarchive nspr nss db xz python lua ];
 
   # rpm/rpmlib.h includes popt.h, and then the pkg-config file mentions these as linkage requirements
-  propagatedBuildInputs = [ popt elfutils nss db bzip2 libarchive binutils ];
+  propagatedBuildInputs = [ popt elfutils nss db bzip2 libarchive libbfd ];
 
   NIX_CFLAGS_COMPILE = "-I${nspr.dev}/include/nspr -I${nss.dev}/include/nss";
 
@@ -26,8 +30,6 @@ stdenv.mkDerivation rec {
     "--sharedstatedir=/com"
   ];
 
-  patches = [ ./rpm-4.13.0.1-bfd-config.patch ];
-
   postPatch = ''
     # For Python3, the original expression evaluates as 'python3.4' but we want 'python3.4m' here
     substituteInPlace configure.ac --replace 'python''${PYTHON_VERSION}' ${python.executable}
diff --git a/pkgs/tools/package-management/rpm/rpm-4.13.0.1-bfd-config.patch b/pkgs/tools/package-management/rpm/rpm-4.13.0.1-bfd-config.patch
deleted file mode 100644
index b8192b24f134..000000000000
--- a/pkgs/tools/package-management/rpm/rpm-4.13.0.1-bfd-config.patch
+++ /dev/null
@@ -1,11 +0,0 @@
-diff -ru rpm-4.13.0.1/tools/sepdebugcrcfix.c rpm-4.13.0.1.new/tools/sepdebugcrcfix.c
---- rpm-4.13.0.1/tools/sepdebugcrcfix.c	2017-02-16 10:40:09.988649399 +0100
-+++ rpm-4.13.0.1.new/tools/sepdebugcrcfix.c	2017-04-15 00:02:21.151359876 +0200
-@@ -28,6 +28,7 @@
- #include <error.h>
- #include <libelf.h>
- #include <gelf.h>
-+#include <config.h>
- #include <bfd.h>
- 
- #define _(x) x
diff --git a/pkgs/tools/security/aespipe/default.nix b/pkgs/tools/security/aespipe/default.nix
index aefd6b7500ce..c67c758b933d 100644
--- a/pkgs/tools/security/aespipe/default.nix
+++ b/pkgs/tools/security/aespipe/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "aespipe-${version}";
-  version = "2.4d";
+  version = "2.4e";
 
   src = fetchurl {
     url = "mirror://sourceforge/loop-aes/aespipe/aespipe-v${version}.tar.bz2";
-    sha256 = "03z5i41xv6p3m79lm04d7msda8878lsppv3324zbjjfy19p6bkn5";
+    sha256 = "0fmr0vk408bf13jydhdmcdhqw31yc9qk329bs9i60alccywapmds";
   };
 
   meta = {
diff --git a/pkgs/tools/security/afl/default.nix b/pkgs/tools/security/afl/default.nix
index 4c3dfe4d07cc..ae80b5ec0b50 100644
--- a/pkgs/tools/security/afl/default.nix
+++ b/pkgs/tools/security/afl/default.nix
@@ -1,5 +1,6 @@
 { stdenv, fetchurl, bash, callPackage, makeWrapper
-, clang, llvm, which, libcgroup }:
+, clang, llvm, which, libcgroup
+}:
 
 let
   afl-qemu = callPackage ./qemu.nix {};
@@ -7,13 +8,14 @@ let
     else if stdenv.system == "i686-linux" then "qemu-i386"
     else throw "afl: no support for ${stdenv.system}!";
 in
+
 stdenv.mkDerivation rec {
   name    = "afl-${version}";
-  version = "2.48b";
+  version = "2.51b";
 
   src = fetchurl {
     url    = "http://lcamtuf.coredump.cx/afl/releases/${name}.tgz";
-    sha256 = "00x7p8lqrpx60hwynl5dqwn6isr8yhl263avcwfw3dqc7v9lwhrz";
+    sha256 = "15xvjma2lpawg1wasnja9wmgrpss5mnm3f5xmh5yli5q6m5vjdfl";
   };
 
   # Note: libcgroup isn't needed for building, just for the afl-cgroup
@@ -23,7 +25,7 @@ stdenv.mkDerivation rec {
   buildPhase   = ''
     make PREFIX=$out
     cd llvm_mode
-    make PREFIX=$out CC=${clang}/bin/clang CXX=${clang}/bin/clang++
+    make PREFIX=$out
     cd ..
   '';
   installPhase = ''
diff --git a/pkgs/tools/security/bash-supergenpass/default.nix b/pkgs/tools/security/bash-supergenpass/default.nix
new file mode 100644
index 000000000000..f85d847f5f95
--- /dev/null
+++ b/pkgs/tools/security/bash-supergenpass/default.nix
@@ -0,0 +1,39 @@
+{ stdenv, fetchFromGitHub, makeWrapper, openssl, coreutils, gnugrep }:
+
+stdenv.mkDerivation rec {
+  name = "bash-supergenpass-unstable-${version}";
+  version = "2012-11-02";
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  src = fetchFromGitHub {
+    owner = "lanzz";
+    repo = "bash-supergenpass";
+    rev = "c84eaa22fb59ab6c390e7f2de7984513347e3a9a";
+    sha256 = "0d3l55kdrf6arb98vwwz9ww55ing5w323fg7546v56hlq3hs5qc9";
+  };
+
+  installPhase = ''
+    install -m755 -D supergenpass.sh "$out/bin/supergenpass"
+    wrapProgram "$out/bin/supergenpass" --prefix PATH : "${stdenv.lib.makeBinPath [ openssl coreutils gnugrep ]}"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Bash shell-script implementation of SuperGenPass password generation";
+    longDescription = ''
+      Bash shell-script implementation of SuperGenPass password generation
+      Usage: ./supergenpass.sh <domain> [ <length> ]
+
+      Default <length> is 10, which is also the original SuperGenPass default length.
+
+      The <domain> parameter is also optional, but it does not make much sense to omit it.
+
+      supergenpass will ask for your master password interactively, and it will not be displayed on your terminal.
+    '';
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ fgaz ];
+    homepage = https://github.com/lanzz/bash-supergenpass;
+  };
+}
+
diff --git a/pkgs/tools/security/browserpass/default.nix b/pkgs/tools/security/browserpass/default.nix
index c078c3a21c5a..7230d30c7955 100644
--- a/pkgs/tools/security/browserpass/default.nix
+++ b/pkgs/tools/security/browserpass/default.nix
@@ -3,15 +3,17 @@
 
 buildGoPackage rec {
   name = "browserpass-${version}";
-  version = "1.0.6";
+  version = "2.0.7";
 
   goPackagePath = "github.com/dannyvankooten/browserpass";
 
+  goDeps = ./deps.nix;
+
   src = fetchFromGitHub {
     repo = "browserpass";
     owner = "dannyvankooten";
     rev = version;
-    sha256 = "07wkvwb9klzxnlrm9a07kxzj3skpy0lymc9ijr8ykfbz6l0bpbqy";
+    sha256 = "1dbp5za5qh6xmgh3w2cx5fbw13mh1szgj2y7ilmq0jh2ik09fbnd";
   };
 
   postInstall = ''
diff --git a/pkgs/tools/security/browserpass/deps.nix b/pkgs/tools/security/browserpass/deps.nix
new file mode 100644
index 000000000000..4a86966a9fc0
--- /dev/null
+++ b/pkgs/tools/security/browserpass/deps.nix
@@ -0,0 +1,30 @@
+# This file was generated by https://github.com/kamilchm/go2nix v1.2.1
+[
+  {
+    goPackagePath = "github.com/gokyle/twofactor";
+    fetch = {
+      type = "git";
+      url = "https://github.com/gokyle/twofactor";
+      rev = "eaad1884d40f9cabff98a57a524c17afd00c9fe7";
+      sha256 = "07kvga6f2b56kpy52a3xk16garvlqz950s350dax97x7cayba95g";
+    };
+  }
+  {
+    goPackagePath = "github.com/mattn/go-zglob";
+    fetch = {
+      type = "git";
+      url = "https://github.com/mattn/go-zglob";
+      rev = "4b74c24375b3b1ee226867156e01996f4e19a8d6";
+      sha256 = "1qc502an4q3wgvrd9zw6zprgm28d90d2f98bdamdf4js03jj22xn";
+    };
+  }
+  {
+    goPackagePath = "rsc.io/qr";
+    fetch = {
+      type = "git";
+      url = "https://github.com/rsc/qr";
+      rev = "48b2ede4844e13f1a2b7ce4d2529c9af7e359fc5";
+      sha256 = "1npxy32glnkvsp0871972jzjzgkwaqmbv6jsj9wgqsa1s2jr004p";
+    };
+  }
+]
diff --git a/pkgs/tools/security/bruteforce-luks/default.nix b/pkgs/tools/security/bruteforce-luks/default.nix
index 85773953af0f..7b505722efaf 100644
--- a/pkgs/tools/security/bruteforce-luks/default.nix
+++ b/pkgs/tools/security/bruteforce-luks/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   name = "bruteforce-luks-${version}";
-  version = "1.2.1";
+  version = "1.3.1";
 
   src = fetchFromGitHub {
-    sha256 = "1i3qr2qgqdx3a5kjl0wrjh9kw8fx2indrj57z6911nx747pmda0n";
+    sha256 = "14ckm31wbzf3lnk472bywjjlh9kysb793nsh2gp04aa5hp5lym58";
     rev = version;
     repo = "bruteforce-luks";
     owner = "glv2";
diff --git a/pkgs/tools/security/ccid/default.nix b/pkgs/tools/security/ccid/default.nix
index e450cf5952ee..9eb5858b0573 100644
--- a/pkgs/tools/security/ccid/default.nix
+++ b/pkgs/tools/security/ccid/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "0dyikpmhsph36ndgd61bs4yx437v5y0bmm8ahjacp1k9c1ly4q56";
   };
 
-  patchPhase = ''
+  postPatch = ''
     patchShebangs .
     substituteInPlace src/Makefile.in --replace /bin/echo echo
   '';
diff --git a/pkgs/tools/security/clamav/default.nix b/pkgs/tools/security/clamav/default.nix
index da469771c6ec..83a2a1fd85ea 100644
--- a/pkgs/tools/security/clamav/default.nix
+++ b/pkgs/tools/security/clamav/default.nix
@@ -23,6 +23,7 @@ stdenv.mkDerivation rec {
     "--sysconfdir=/etc/clamav"
     "--with-zlib=${zlib.dev}"
     "--disable-zlib-vcheck" # it fails to recognize that 1.2.10 >= 1.2.2
+    "--disable-llvm" # enabling breaks the build at the moment
     "--with-libbz2-prefix=${bzip2.dev}"
     "--with-iconv-dir=${libiconv}"
     "--with-xml=${libxml2.dev}"
diff --git a/pkgs/tools/security/crackxls/default.nix b/pkgs/tools/security/crackxls/default.nix
index f4c92ac701f4..2a88e4462b6d 100644
--- a/pkgs/tools/security/crackxls/default.nix
+++ b/pkgs/tools/security/crackxls/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "0q5jl7hcds3f0rhly3iy4fhhbyh9cdrfaw7zdrazzf1wswwhyssz";
   };
 
-  buildInputs = [ pkgconfig autoconf automake openssl libgsf gmp ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ autoconf automake openssl libgsf gmp ];
 
   installPhase =
   ''
diff --git a/pkgs/tools/security/doas/default.nix b/pkgs/tools/security/doas/default.nix
new file mode 100644
index 000000000000..55335927b36a
--- /dev/null
+++ b/pkgs/tools/security/doas/default.nix
@@ -0,0 +1,31 @@
+{ stdenv, lib, fetchFromGitHub, bison, pam }:
+
+stdenv.mkDerivation rec {
+  name = "doas-${version}";
+
+  version = "6.0";
+
+  src = fetchFromGitHub {
+    owner = "Duncaen";
+    repo = "OpenDoas";
+    rev = "v${version}";
+    sha256 = "1j50l3jvbgvg8vmp1nx6vrjxkbj5bvfh3m01bymzfn25lkwwhz1x";
+  };
+
+  # otherwise confuses ./configure
+  dontDisableStatic = true;
+
+  postPatch = ''
+    sed -i '/\(chown\|chmod\)/d' bsd.prog.mk
+  '';
+
+  buildInputs = [ bison pam ];
+
+  meta = with lib; {
+    description = "Executes the given command as another user";
+    homepage = "https://github.com/Duncaen/OpenDoas";
+    license = licenses.isc;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ cstrahan ];
+  };
+}
diff --git a/pkgs/tools/security/ecdsautils/default.nix b/pkgs/tools/security/ecdsautils/default.nix
new file mode 100644
index 000000000000..2766c2c07a4f
--- /dev/null
+++ b/pkgs/tools/security/ecdsautils/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, pkgs }:
+
+stdenv.mkDerivation rec {
+  version = "0.4.0";
+  name = "ecdsautils-${version}";
+
+  src = pkgs.fetchFromGitHub {
+    owner = "tcatm";
+    repo = "ecdsautils";
+    rev = "07538893fb6c2a9539678c45f9dbbf1e4f222b46";
+    sha256 = "18sr8x3qiw8s9l5pfi7r9i3ayplz4jqdml75ga9y933vj7vs0k4d";
+  };
+
+  nativeBuildInputs = with pkgs; [ cmake pkgconfig doxygen ];
+  buildInputs = with pkgs; [ libuecc  ];
+
+  meta = with stdenv.lib; {
+    description = "Tiny collection of programs used for ECDSA (keygen, sign, verify)";
+    homepage = https://github.com/tcatm/ecdsautils/;
+    license = with licenses; [ mit bsd2 ];
+    maintainers = with maintainers; [ andir ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/tools/security/ecryptfs/default.nix b/pkgs/tools/security/ecryptfs/default.nix
index f8ef409813cc..91546f1a78f4 100644
--- a/pkgs/tools/security/ecryptfs/default.nix
+++ b/pkgs/tools/security/ecryptfs/default.nix
@@ -33,7 +33,8 @@ stdenv.mkDerivation rec {
     done
   '';
 
-  buildInputs = [ pkgconfig perl nss nspr python2 pam intltool makeWrapper ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ perl nss nspr python2 pam intltool makeWrapper ];
   propagatedBuildInputs = [ coreutils gettext cryptsetup lvm2 rsync keyutils which ];
 
   postInstall = ''
diff --git a/pkgs/tools/security/enchive/default.nix b/pkgs/tools/security/enchive/default.nix
new file mode 100644
index 000000000000..d045450f9480
--- /dev/null
+++ b/pkgs/tools/security/enchive/default.nix
@@ -0,0 +1,27 @@
+{ stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  name = "enchive-${version}";
+  version = "3.3";
+  src = fetchFromGitHub {
+    owner = "skeeto";
+    repo = "enchive";
+    rev = version;
+    sha256 = "0i3b0v5dqz56m5ppzm3332yxkw17dxs2zpvf48769ljgjy74irfl";
+  };
+
+  makeFlags = ["PREFIX=$(out)"];
+
+  postInstall = ''
+    mkdir -p $out/share/emacs/site-lisp/
+    cp -v "$src/enchive-mode.el" "$out/share/emacs/site-lisp/"
+  '';
+
+  meta = {
+    description = "Encrypted personal archives";
+    homepage = https://github.com/skeeto/enchive;
+    license = stdenv.lib.licenses.unlicense;
+    platforms = stdenv.lib.platforms.unix;
+    maintainers = [ stdenv.lib.maintainers.nico202 ];
+  };
+}
diff --git a/pkgs/tools/security/enpass/data.json b/pkgs/tools/security/enpass/data.json
index b3625d928b5f..28d568d30ae8 100644
--- a/pkgs/tools/security/enpass/data.json
+++ b/pkgs/tools/security/enpass/data.json
@@ -1,12 +1,12 @@
 {
   "amd64": {
-    "path": "pool/main/e/enpass/enpass_5.4.0-4_amd64.deb", 
-    "sha256": "6b460fed2d7d8473e2b5d069dbe60263195b916c8b79a8fc7c2e8cb953134579", 
-    "version": "5.4.0.post4"
+    "path": "pool/main/e/enpass/enpass_5.6.0_amd64.deb", 
+    "sha256": "129ae4b4bfb8e0b4fa9acdfb3aebac3dd894364f2f31e9cd3bd5d3567e3a13b7", 
+    "version": "5.6.0"
   }, 
   "i386": {
-    "path": "pool/main/e/enpass/enpass_5.4.0-4_i386.deb", 
-    "sha256": "1ec8088d5c3b2906d6820f96e1868c473e78dbe882f04e74a7816d19d43e3692", 
-    "version": "5.4.0.post4"
+    "path": "pool/main/e/enpass/enpass_5.6.0_i386.deb", 
+    "sha256": "c456002194c0be08a2c0da68ecf224425e35c46de5292098208e4e2b1f6d88ae", 
+    "version": "5.6.0"
   }
 }
\ No newline at end of file
diff --git a/pkgs/tools/security/fpm2/default.nix b/pkgs/tools/security/fpm2/default.nix
index 8bb3cba15c46..69b4b36fb9b3 100644
--- a/pkgs/tools/security/fpm2/default.nix
+++ b/pkgs/tools/security/fpm2/default.nix
@@ -13,7 +13,8 @@ stdenv.mkDerivation rec {
     sha256 = "d55e9ce6be38a44fc1053d82db2d117cf3991a51898bd86d7913bae769f04da7";
   };
 
-  buildInputs = [ pkgconfig gnupg gtk2 libxml2 intltool ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ gnupg gtk2 libxml2 intltool ];
 
   meta = {
     description = "FPM2 is GTK2 port from Figaro's Password Manager originally developed by John Conneely, with some new enhancements.";
diff --git a/pkgs/tools/security/gencfsm/default.nix b/pkgs/tools/security/gencfsm/default.nix
index fbd32cdc22df..c180ca6c7202 100644
--- a/pkgs/tools/security/gencfsm/default.nix
+++ b/pkgs/tools/security/gencfsm/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "1rpf683lxa78fmxxb0hnq7vdh3yn7qid2gqq67q9mk65sp9vdhdj";
   };
 
-  buildInputs = [ autoconf automake intltool libtool pkgconfig vala glib encfs
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ autoconf automake intltool libtool vala glib encfs
     gtk3 libgnome_keyring gnome3.libgee xorg.libSM xorg.libICE
     wrapGAppsHook ];
 
diff --git a/pkgs/tools/security/gnupg/21.nix b/pkgs/tools/security/gnupg/22.nix
index 1523f3e159ce..18d784a59bb7 100644
--- a/pkgs/tools/security/gnupg/21.nix
+++ b/pkgs/tools/security/gnupg/22.nix
@@ -15,15 +15,16 @@ assert guiSupport -> pinentry != null;
 stdenv.mkDerivation rec {
   name = "gnupg-${version}";
 
-  version = "2.1.23";
+  version = "2.2.1";
 
   src = fetchurl {
     url = "mirror://gnupg/gnupg/${name}.tar.bz2";
-    sha256 = "0xqd5nm4j3w9lwk35vg57gl2i8bfkmx7d24i44gkbscm2lwpci59";
+    sha256 = "1yv2pwf3vhv9dpbf51fnm0wy03va1cg5r7qaz7rg75cwbgb0rmrl";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    pkgconfig libgcrypt libassuan libksba libiconv npth gettext texinfo
+    libgcrypt libassuan libksba libiconv npth gettext texinfo
     readline libusb gnutls adns openldap zlib bzip2 sqlite
   ];
 
@@ -45,6 +46,9 @@ stdenv.mkDerivation rec {
       substitute $f $out/lib/systemd/user/$(basename $f) \
         --replace /usr/bin $out/bin
     done
+
+    # add gpg2 symlink to make sure git does not break when signing commits
+    ln -s $out/bin/gpg $out/bin/gpg2
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/security/hashcat/default.nix b/pkgs/tools/security/hashcat/default.nix
index 298dd336be1f..81c92415c509 100644
--- a/pkgs/tools/security/hashcat/default.nix
+++ b/pkgs/tools/security/hashcat/default.nix
@@ -1,40 +1,39 @@
-{ stdenv, fetchurl, gmp }:
+{ stdenv, fetchurl, makeWrapper, opencl-headers, ocl-icd }:
 
-assert stdenv.isLinux;
-
-let
-  bits = if stdenv.system == "x86_64-linux" then "64" else "32";
-in
 stdenv.mkDerivation rec {
   name    = "hashcat-${version}";
-  version = "2.00";
+  version = "4.0.0";
 
   src = fetchurl {
-    name = "${name}.tar.gz";
-    url = "https://codeload.github.com/hashcat/hashcat/tar.gz/${version}";
-    sha256 = "0i2l4i1jkdhj9bkvycgd2nf809kki3jp83y0vrd4iwsdbbbyc9b3";
+    url = "https://hashcat.net/files/hashcat-${version}.tar.gz";
+    sha256 = "0l1vq4h1gfxc2yclxkvy6gfz6sii2vyzip8pw6ifq930y8dvi34y";
   };
 
-  buildInputs = [ gmp ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ opencl-headers ];
 
-  buildFlags = [ "posix${bits}" ]
-    ++ stdenv.lib.optionals (bits == "64") [ "posixXOP" "posixAVX" ];
+  makeFlags = [
+    "OPENCL_HEADERS_KHRONOS=${opencl-headers}/include"
+    "COMPTIME=1337"
+    "VERSION_TAG=${version}"
+  ];
 
-  # Upstream Makefile doesn't have 'install' target
-  installPhase = ''
-    mkdir -p $out/bin $out/libexec
-    cp -R * $out/libexec
+  # $out is not known until the build has started.
+  configurePhase = ''
+    runHook preConfigure
+    makeFlags="$makeFlags PREFIX=$out"
+    runHook postConfigure
+  '';
 
-    ln -s $out/libexec/hashcat-cli${bits}.bin $out/bin/hashcat
-    ln -s $out/libexec/hashcat-cliXOP.bin $out/bin/hashcat-xop
-    ln -s $out/libexec/hashcat-cliAVX.bin $out/bin/hashcat-avx
+  postFixup = ''
+    wrapProgram $out/bin/hashcat --prefix LD_LIBRARY_PATH : ${ocl-icd}/lib
   '';
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "Fast password cracker";
-    homepage    = "https://hashcat.net/hashcat/";
-    license     = stdenv.lib.licenses.mit;
-    platforms   = stdenv.lib.platforms.linux;
-    maintainers = [ stdenv.lib.maintainers.thoughtpolice ];
+    homepage    = https://hashcat.net/hashcat/;
+    license     = licenses.mit;
+    platforms   = platforms.linux;
+    maintainers = with maintainers; [ kierdavis zimbatm ];
   };
 }
diff --git a/pkgs/tools/security/hashcat/hashcat3/default.nix b/pkgs/tools/security/hashcat/hashcat3/default.nix
deleted file mode 100644
index 7a0d7241bbf9..000000000000
--- a/pkgs/tools/security/hashcat/hashcat3/default.nix
+++ /dev/null
@@ -1,37 +0,0 @@
-{ stdenv, fetchurl, makeWrapper, opencl-headers, ocl-icd }:
-
-assert stdenv.isLinux;
-
-stdenv.mkDerivation rec {
-  name    = "hashcat-${version}";
-  version = "3.6.0";
-
-  src = fetchurl {
-    url = "https://hashcat.net/files/hashcat-${version}.tar.gz";
-    sha256 = "127hdvq6ikah7r5vch63jnnkcsj7y61f9h8x79c3w25x9w55bxry";
-  };
-
-  nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ opencl-headers ];
-
-  makeFlags = [ "OPENCL_HEADERS_KHRONOS=${opencl-headers}/include" ];
-
-  # $out is not known until the build has started.
-  configurePhase = ''
-    runHook preConfigure
-    makeFlags="$makeFlags PREFIX=$out"
-    runHook postConfigure
-  '';
-
-  postFixup = ''
-    wrapProgram $out/bin/hashcat --prefix LD_LIBRARY_PATH : ${ocl-icd}/lib
-  '';
-
-  meta = {
-    description = "Fast password cracker";
-    homepage    = https://hashcat.net/hashcat/;
-    license     = stdenv.lib.licenses.mit;
-    platforms   = stdenv.lib.platforms.linux;
-    maintainers = [ stdenv.lib.maintainers.kierdavis ];
-  };
-}
diff --git a/pkgs/tools/security/john/default.nix b/pkgs/tools/security/john/default.nix
index f5d253af9ff3..37946b940cf1 100644
--- a/pkgs/tools/security/john/default.nix
+++ b/pkgs/tools/security/john/default.nix
@@ -26,7 +26,13 @@ stdenv.mkDerivation rec {
     }' run/*.conf
   '';
 
-  preConfigure = "cd src";
+  preConfigure = ''
+    cd src
+    # Makefile.in depends on AS and LD being set to CC, which is set by default in configure.ac.
+    # This ensures we override the environment variables set in cc-wrapper/setup-hook.sh
+    export AS=$CC
+    export LD=$CC
+  '';
   configureFlags = [ "--disable-native-macro" ];
 
   buildInputs = [ openssl nss nspr kerberos gmp zlib libpcap re2 gcc ];
diff --git a/pkgs/tools/security/kbfs/default.nix b/pkgs/tools/security/kbfs/default.nix
index 28c6caae6c33..ba024328ba5f 100644
--- a/pkgs/tools/security/kbfs/default.nix
+++ b/pkgs/tools/security/kbfs/default.nix
@@ -2,18 +2,18 @@
 
 buildGoPackage rec {
   name = "kbfs-${version}";
-  version = "20170429.44efa06";
+  version = "20171004.40555d";
 
   goPackagePath = "github.com/keybase/kbfs";
-  subPackages = [ "kbfsfuse" ];
+  subPackages = [ "kbfsfuse" "kbfsgit/git-remote-keybase" ];
 
   dontRenameImports = true;
 
   src = fetchFromGitHub {
     owner = "keybase";
     repo = "kbfs";
-    rev = "44efa0682d931d8489f5e84542e8d00baeb12592";
-    sha256 = "1q6hklyr6zq3xr1azz1c6rlpsjc036f222cd20vf79m58dn906n5";
+    rev = "40555dbc9c93a05f3a82053860df30e45c7bd779";
+    sha256 = "08wj8fh1ja8kfzvbza5csy9mpfy39lifnzvfrnbj7vyyv88qc3h0";
   };
 
   buildFlags = [ "-tags production" ];
diff --git a/pkgs/tools/security/keybase-gui/default.nix b/pkgs/tools/security/keybase-gui/default.nix
index a45a6ea2a04c..ce98740e89bd 100644
--- a/pkgs/tools/security/keybase-gui/default.nix
+++ b/pkgs/tools/security/keybase-gui/default.nix
@@ -37,10 +37,10 @@ let
 in
 stdenv.mkDerivation rec {
   name = "keybase-gui-${version}";
-  version = "1.0.25-20170714172717.73f9070";
+  version = "1.0.33-20171003193427.d9ceb86ac";
   src = fetchurl {
     url = "https://s3.amazonaws.com/prerelease.keybase.io/linux_binaries/deb/keybase_${version}_amd64.deb";
-    sha256 = "0yrq18rrc30f7ymajvd71r29z1by7h6abyaxx2gmrg648qgc6zv4";
+    sha256 = "0sqani2fy5jzqmz35md1bdw2vwpx91l87b6s3x9z53halzq7vfy6";
   };
   phases = ["unpackPhase" "installPhase" "fixupPhase"];
   unpackPhase = ''
diff --git a/pkgs/tools/security/keybase/default.nix b/pkgs/tools/security/keybase/default.nix
index 5294f32864d1..7f095a3225bb 100644
--- a/pkgs/tools/security/keybase/default.nix
+++ b/pkgs/tools/security/keybase/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   name = "keybase-${version}";
-  version = "1.0.28";
+  version = "1.0.33";
 
   goPackagePath = "github.com/keybase/client";
   subPackages = [ "go/keybase" ];
@@ -13,7 +13,7 @@ buildGoPackage rec {
     owner  = "keybase";
     repo   = "client";
     rev    = "v${version}";
-    sha256 = "03ldg7r0d9glccbx2xb3g3xyla82j5hkmmwfvzdqg43740l51mci";
+    sha256 = "1zgvriyir2ga0p4ah9ia1sbl9ydnrnw5ggq4c1ya8gcfgn8vzdsf";
   };
 
   buildFlags = [ "-tags production" ];
@@ -21,7 +21,7 @@ buildGoPackage rec {
   meta = with stdenv.lib; {
     homepage = https://www.keybase.io/;
     description = "The Keybase official command-line utility and service.";
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
     maintainers = with maintainers; [ carlsverre np rvolosatovs ];
   };
 }
diff --git a/pkgs/tools/security/lastpass-cli/default.nix b/pkgs/tools/security/lastpass-cli/default.nix
index e40422399056..ce59ddca7c07 100644
--- a/pkgs/tools/security/lastpass-cli/default.nix
+++ b/pkgs/tools/security/lastpass-cli/default.nix
@@ -4,13 +4,13 @@
 stdenv.mkDerivation rec {
   name = "lastpass-cli-${version}";
 
-  version = "1.1.1";
+  version = "1.2.1";
 
   src = fetchFromGitHub {
     owner = "lastpass";
     repo = "lastpass-cli";
     rev = "v${version}";
-    sha256 = "1slqrv877c1bhivgd2i9cr1lsd72371dpz6a3h6s56l3qbyk28sa";
+    sha256 = "0nrsrd5cqyv2zydzzl1vryrnj1p0x17cx1rmrp4kmzh83bzgcfvv";
   };
 
   nativeBuildInputs = [ cmake pkgconfig ];
diff --git a/pkgs/tools/security/masscan/default.nix b/pkgs/tools/security/masscan/default.nix
index 46c90481628d..22a452ccabdd 100644
--- a/pkgs/tools/security/masscan/default.nix
+++ b/pkgs/tools/security/masscan/default.nix
@@ -1,17 +1,17 @@
-{ stdenv, fetchFromGitHub, libpcap }:
+{ stdenv, fetchFromGitHub, makeWrapper, libpcap }:
 
 stdenv.mkDerivation rec {
   name = "masscan-${version}";
-  version = "2016-11-03";
+  version = "1.0.4";
 
   src = fetchFromGitHub {
     owner  = "robertdavidgraham";
     repo   = "masscan";
-    rev    = "dc88677a11dc3d9a5f6aa55cc1377bc17dba1496";
-    sha256 = "1mdjqkn4gnbwr5nci6i6xn7qzkjgq7dx37fzd6gghv87xgw7cdbg";
+    rev    = "39061a5e9ef158dde1e6618f6fbf379739934a73";
+    sha256 = "0mjvwh4i0ncsa3ywavw2s55v5bfv7pyga028c8m8xfash9764wwf";
   };
 
-  buildInputs = [ libpcap ];
+  buildInputs = [ makeWrapper ];
 
   makeFlags = [ "PREFIX=$(out)" "CC=cc" "-j" ];
 
@@ -24,13 +24,15 @@ stdenv.mkDerivation rec {
     cp -t $out/share/doc/masscan doc/algorithm.js doc/howto-afl.md doc/bot.hml
     cp doc/masscan.8 $out/share/man/man8/masscan.8
     cp LICENSE $out/share/licenses/masscan/LICENSE
+
+    wrapProgram $out/bin/masscan --prefix LD_LIBRARY_PATH : "${libpcap}/lib"
   '';
 
   meta = with stdenv.lib; {
     description = "Fast scan of the Internet";
     homepage    = https://github.com/robertdavidgraham/masscan;
     license     = licenses.agpl3;
-    platforms   = with platforms; allBut darwin;
+    platforms   = platforms.unix;
     maintainers = with maintainers; [ rnhmjoj ];
   };
 }
diff --git a/pkgs/tools/security/metasploit/Gemfile b/pkgs/tools/security/metasploit/Gemfile
index de44760bde74..99d7556db2db 100644
--- a/pkgs/tools/security/metasploit/Gemfile
+++ b/pkgs/tools/security/metasploit/Gemfile
@@ -1,4 +1,4 @@
 # frozen_string_literal: true
 source "https://rubygems.org"
 
-gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/4.14.25"
+gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/4.16.1"
diff --git a/pkgs/tools/security/metasploit/Gemfile.lock b/pkgs/tools/security/metasploit/Gemfile.lock
index d3a88a50aeca..d15df5e56c2b 100644
--- a/pkgs/tools/security/metasploit/Gemfile.lock
+++ b/pkgs/tools/security/metasploit/Gemfile.lock
@@ -1,15 +1,17 @@
 GIT
   remote: https://github.com/rapid7/metasploit-framework
-  revision: 8a194207f07c2b8c91c1a72e57c25683d4e9f744
-  ref: refs/tags/4.14.25
+  revision: dbec1c2d2ae4bd77276cbfb3c6ee2902048b9453
+  ref: refs/tags/4.16.1
   specs:
-    metasploit-framework (4.14.25)
+    metasploit-framework (4.16.1)
       actionpack (~> 4.2.6)
       activerecord (~> 4.2.6)
       activesupport (~> 4.2.6)
       backports
       bcrypt
+      bcrypt_pbkdf
       bit-struct
+      dnsruby
       filesize
       jsobfu
       json
@@ -17,9 +19,9 @@ GIT
       metasploit-concern
       metasploit-credential
       metasploit-model
-      metasploit-payloads (= 1.2.32)
+      metasploit-payloads (= 1.3.1)
       metasploit_data_models
-      metasploit_payloads-mettle (= 0.1.9)
+      metasploit_payloads-mettle (= 0.2.0)
       msgpack
       nessus_rest
       net-ssh
@@ -32,9 +34,12 @@ GIT
       packetfu
       patch_finder
       pcaprub
-      pg
+      pdf-reader
+      pg (= 0.20.0)
       railties
       rb-readline
+      rbnacl (< 5.0.0)
+      rbnacl-libsodium
       recog
       redcarpet
       rex-arch
@@ -46,7 +51,7 @@ GIT
       rex-mime
       rex-nop
       rex-ole
-      rex-powershell
+      rex-powershell (< 0.1.73)
       rex-random_identifier
       rex-registry
       rex-rop_builder
@@ -64,62 +69,69 @@ GIT
       tzinfo
       tzinfo-data
       windows_error
+      xdr
       xmlrpc
 
 GEM
   remote: https://rubygems.org/
   specs:
-    actionpack (4.2.8)
-      actionview (= 4.2.8)
-      activesupport (= 4.2.8)
+    Ascii85 (1.0.2)
+    actionpack (4.2.9)
+      actionview (= 4.2.9)
+      activesupport (= 4.2.9)
       rack (~> 1.6)
       rack-test (~> 0.6.2)
       rails-dom-testing (~> 1.0, >= 1.0.5)
       rails-html-sanitizer (~> 1.0, >= 1.0.2)
-    actionview (4.2.8)
-      activesupport (= 4.2.8)
+    actionview (4.2.9)
+      activesupport (= 4.2.9)
       builder (~> 3.1)
       erubis (~> 2.7.0)
       rails-dom-testing (~> 1.0, >= 1.0.5)
       rails-html-sanitizer (~> 1.0, >= 1.0.3)
-    activemodel (4.2.8)
-      activesupport (= 4.2.8)
+    activemodel (4.2.9)
+      activesupport (= 4.2.9)
       builder (~> 3.1)
-    activerecord (4.2.8)
-      activemodel (= 4.2.8)
-      activesupport (= 4.2.8)
+    activerecord (4.2.9)
+      activemodel (= 4.2.9)
+      activesupport (= 4.2.9)
       arel (~> 6.0)
-    activesupport (4.2.8)
+    activesupport (4.2.9)
       i18n (~> 0.7)
       minitest (~> 5.1)
       thread_safe (~> 0.3, >= 0.3.4)
       tzinfo (~> 1.1)
     addressable (2.5.1)
       public_suffix (~> 2.0, >= 2.0.2)
+    afm (0.2.2)
     arel (6.0.4)
     arel-helpers (2.4.0)
       activerecord (>= 3.1.0, < 6)
     backports (3.8.0)
     bcrypt (3.1.11)
+    bcrypt_pbkdf (1.0.0)
     bindata (2.4.0)
     bit-struct (0.16)
     builder (3.2.3)
+    dnsruby (1.60.2)
     erubis (2.7.0)
-    faraday (0.12.1)
+    faraday (0.13.1)
       multipart-post (>= 1.2, < 3)
+    ffi (1.9.18)
     filesize (0.1.1)
-    i18n (0.8.4)
+    hashery (2.1.2)
+    i18n (0.8.6)
     jsobfu (0.4.2)
       rkelly-remix
     json (2.1.0)
     loofah (2.0.3)
       nokogiri (>= 1.5.9)
     metasm (1.0.3)
-    metasploit-concern (2.0.4)
+    metasploit-concern (2.0.5)
       activemodel (~> 4.2.6)
       activesupport (~> 4.2.6)
       railties (~> 4.2.6)
-    metasploit-credential (2.0.10)
+    metasploit-credential (2.0.12)
       metasploit-concern
       metasploit-model
       metasploit_data_models
@@ -132,8 +144,8 @@ GEM
       activemodel (~> 4.2.6)
       activesupport (~> 4.2.6)
       railties (~> 4.2.6)
-    metasploit-payloads (1.2.32)
-    metasploit_data_models (2.0.14)
+    metasploit-payloads (1.3.1)
+    metasploit_data_models (2.0.15)
       activerecord (~> 4.2.6)
       activesupport (~> 4.2.6)
       arel-helpers
@@ -143,15 +155,15 @@ GEM
       postgres_ext
       railties (~> 4.2.6)
       recog (~> 2.0)
-    metasploit_payloads-mettle (0.1.9)
+    metasploit_payloads-mettle (0.2.0)
     mini_portile2 (2.2.0)
-    minitest (5.10.2)
+    minitest (5.10.3)
     msgpack (1.1.0)
     multipart-post (2.0.0)
     nessus_rest (0.1.6)
     net-ssh (4.1.0)
     network_interface (0.0.1)
-    nexpose (6.0.0)
+    nexpose (6.1.1)
     nokogiri (1.8.0)
       mini_portile2 (~> 2.2.0)
     octokit (4.7.0)
@@ -162,6 +174,12 @@ GEM
       pcaprub
     patch_finder (1.0.2)
     pcaprub (0.12.4)
+    pdf-reader (2.0.0)
+      Ascii85 (~> 1.0.0)
+      afm (~> 0.2.1)
+      hashery (~> 2.0)
+      ruby-rc4
+      ttfunk
     pg (0.20.0)
     pg_array_parser (0.0.9)
     postgres_ext (3.0.0)
@@ -180,25 +198,29 @@ GEM
       rails-deprecated_sanitizer (>= 1.0.1)
     rails-html-sanitizer (1.0.3)
       loofah (~> 2.0)
-    railties (4.2.8)
-      actionpack (= 4.2.8)
-      activesupport (= 4.2.8)
+    railties (4.2.9)
+      actionpack (= 4.2.9)
+      activesupport (= 4.2.9)
       rake (>= 0.8.7)
       thor (>= 0.18.1, < 2.0)
     rake (12.0.0)
-    rb-readline (0.5.4)
-    recog (2.1.8)
+    rb-readline (0.5.5)
+    rbnacl (4.0.2)
+      ffi
+    rbnacl-libsodium (1.0.13)
+      rbnacl (>= 3.0.1)
+    recog (2.1.12)
       nokogiri
     redcarpet (3.4.0)
-    rex-arch (0.1.8)
+    rex-arch (0.1.11)
       rex-text
-    rex-bin_tools (0.1.3)
+    rex-bin_tools (0.1.4)
       metasm
       rex-arch
       rex-core
       rex-struct2
       rex-text
-    rex-core (0.1.10)
+    rex-core (0.1.12)
     rex-encoder (0.1.4)
       metasm
       rex-arch
@@ -226,9 +248,10 @@ GEM
       metasm
       rex-core
       rex-text
-    rex-socket (0.1.6)
+    rex-socket (0.1.8)
+      rex-core
+    rex-sslscan (0.1.5)
       rex-core
-    rex-sslscan (0.1.4)
       rex-socket
       rex-text
     rex-struct2 (0.1.2)
@@ -237,6 +260,7 @@ GEM
       rex-text
     rkelly-remix (0.0.7)
     robots (0.10.1)
+    ruby-rc4 (0.1.5)
     ruby_smb (0.0.18)
       bindata
       rubyntlm
@@ -248,13 +272,17 @@ GEM
       faraday (~> 0.8, < 1.0)
     sqlite3 (1.3.13)
     sshkey (1.9.0)
-    thor (0.19.4)
+    thor (0.20.0)
     thread_safe (0.3.6)
+    ttfunk (1.5.1)
     tzinfo (1.2.3)
       thread_safe (~> 0.1)
     tzinfo-data (1.2017.2)
       tzinfo (>= 1.0.0)
     windows_error (0.1.2)
+    xdr (2.0.0)
+      activemodel (>= 4.2.7)
+      activesupport (>= 4.2.7)
     xmlrpc (0.3.0)
 
 PLATFORMS
@@ -264,4 +292,4 @@ DEPENDENCIES
   metasploit-framework!
 
 BUNDLED WITH
-   1.14.6
+   1.15.0
diff --git a/pkgs/tools/security/metasploit/default.nix b/pkgs/tools/security/metasploit/default.nix
index 4cc287c40f27..37796fef1747 100644
--- a/pkgs/tools/security/metasploit/default.nix
+++ b/pkgs/tools/security/metasploit/default.nix
@@ -4,6 +4,10 @@
 # 1. increment version number in expression and in Gemfile
 # 2. run $ nix-shell --command "bundler install && bundix"
 #    in metasploit in nixpkgs
+# 3. run $ sed -i '/[ ]*dependencies =/d' gemset.nix
+# 4. run $ nix-build -A metasploit ../../../../
+# 5. update sha256sum in expression
+# 6. run step 3 again
 
 let
   env = bundlerEnv {
@@ -13,13 +17,13 @@ let
   };
 in stdenv.mkDerivation rec {
   name = "metasploit-framework-${version}";
-  version = "4.14.25";
+  version = "4.16.1";
 
   src = fetchFromGitHub {
     owner = "rapid7";
     repo = "metasploit-framework";
     rev = version;
-    sha256 = "0cp1ybq29a0r7kabg4p2yj0qm90hjvr4xxp0pynb2g406sbyycjm";
+    sha256 = "1vilyy0dqzp8kbbpvs2zrv2ac7s39w2vv7mrbzgcjgh2bj7c6bg1";
   };
 
   buildInputs = [ makeWrapper ];
@@ -31,14 +35,14 @@ in stdenv.mkDerivation rec {
 
     cp -r * $out/share/msf
 
-    for i in $out/share/msf/msf*; do
-      bin=$out/bin/$(basename $i)
-      cat > $bin <<EOF
-#!/bin/sh -e
-exec ${env}/bin/bundle exec ${ruby}/bin/ruby $i "\$@"
-EOF
-      chmod +x $bin
-    done
+    (
+      cd $out/share/msf/
+      for i in msf*; do
+        makeWrapper ${env}/bin/bundle $out/bin/$i \
+          --add-flags "exec ${ruby}/bin/ruby $out/share/msf/$i"
+      done
+    )
+
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/security/metasploit/gemset.nix b/pkgs/tools/security/metasploit/gemset.nix
index ff3e4d5d832e..4262e64efb04 100644
--- a/pkgs/tools/security/metasploit/gemset.nix
+++ b/pkgs/tools/security/metasploit/gemset.nix
@@ -2,42 +2,42 @@
   actionpack = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "09fbazl0ja80na2wadfp3fzmdmdy1lsb4wd2yg7anbj0zk0ap7a9";
+      sha256 = "1kgrq74gp2czzxr0f2sqrc98llz03lgq498300z2z5n4khgznwc4";
       type = "gem";
     };
-    version = "4.2.8";
+    version = "4.2.9";
   };
   actionview = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1mg4a8143q2wjhjq4mngl69jkv249z5jvg0jkdribdv4zkg586rp";
+      sha256 = "04kgp4gmahw31miz8xdq1pns14qmvvzd14fgfv7fg9klkw3bxyyp";
       type = "gem";
     };
-    version = "4.2.8";
+    version = "4.2.9";
   };
   activemodel = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "11vhh7zmp92880s5sx8r32v2p0b7xg039mfr92pjynpkz4q901ld";
+      sha256 = "1qxmivny0ka5s3iyap08sn9bp2bd9wrhqp2njfw26hr9wsjk5kfv";
       type = "gem";
     };
-    version = "4.2.8";
+    version = "4.2.9";
   };
   activerecord = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1kk4dhn8jfhqfsf1dmb3a183gix6k46xr6cjkxj0rp51w2za1ns0";
+      sha256 = "18i790dfhi4ndypd1pj9pv08knpxr2sayvvwfq7axj5jfwgpmrqb";
       type = "gem";
     };
-    version = "4.2.8";
+    version = "4.2.9";
   };
   activesupport = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0wibdzd2f5l5rlsw1a1y3j3fhw2imrrbkxggdraa6q9qbdnc66hi";
+      sha256 = "1d0a362p3m2m2kljichar2pwq0qm4vblc3njy1rdzm09ckzd45sp";
       type = "gem";
     };
-    version = "4.2.8";
+    version = "4.2.9";
   };
   addressable = {
     source = {
@@ -47,6 +47,14 @@
     };
     version = "2.5.1";
   };
+  afm = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "06kj9hgd0z8pj27bxp2diwqh6fv7qhwwm17z64rhdc4sfn76jgn8";
+      type = "gem";
+    };
+    version = "0.2.2";
+  };
   arel = {
     source = {
       remotes = ["https://rubygems.org"];
@@ -63,6 +71,14 @@
     };
     version = "2.4.0";
   };
+  Ascii85 = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0j95sbxd18kc8rhcnvl1w37kflqpax1r12h1x47gh4xxn3mz4m7q";
+      type = "gem";
+    };
+    version = "1.0.2";
+  };
   backports = {
     source = {
       remotes = ["https://rubygems.org"];
@@ -79,6 +95,14 @@
     };
     version = "3.1.11";
   };
+  bcrypt_pbkdf = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0cj4k13c7qvvck7y25i3xarvyqq8d27vl61jddifkc7llnnap1hv";
+      type = "gem";
+    };
+    version = "1.0.0";
+  };
   bindata = {
     source = {
       remotes = ["https://rubygems.org"];
@@ -103,6 +127,14 @@
     };
     version = "3.2.3";
   };
+  dnsruby = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0qfvpkka69f8vnmda3zhkr54fjpf7pwgmbx0gcsxg3jd6c7sjs1d";
+      type = "gem";
+    };
+    version = "1.60.2";
+  };
   erubis = {
     source = {
       remotes = ["https://rubygems.org"];
@@ -114,10 +146,18 @@
   faraday = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1wkx9844vacsk2229xbc27djf6zw15kqd60ifr78whf9mp9v6l03";
+      sha256 = "1gyqsj7vlqynwvivf9485zwmcj04v1z7gq362z0b8zw2zf4ag0hw";
       type = "gem";
     };
-    version = "0.12.1";
+    version = "0.13.1";
+  };
+  ffi = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "034f52xf7zcqgbvwbl20jwdyjwznvqnwpbaps9nk18v9lgb1dpx0";
+      type = "gem";
+    };
+    version = "1.9.18";
   };
   filesize = {
     source = {
@@ -127,13 +167,21 @@
     };
     version = "0.1.1";
   };
+  hashery = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0qj8815bf7q6q7llm5rzdz279gzmpqmqqicxnzv066a020iwqffj";
+      type = "gem";
+    };
+    version = "2.1.2";
+  };
   i18n = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1j491wrfzham4nk8q4bifah3lx7nr8wp9ahfb7vd3hxn71v7kic7";
+      sha256 = "1i3aqvzfsj786kwjj70jsjpxm6ffw5pwhalzr2abjfv2bdc7k9kw";
       type = "gem";
     };
-    version = "0.8.4";
+    version = "0.8.6";
   };
   jsobfu = {
     source = {
@@ -170,28 +218,28 @@
   metasploit-concern = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0kqby5ycxhr0jfzvjqkdgjbqqjrg8jlmcxw8myrm0875hybyl1mq";
+      sha256 = "0v9lm225fhzhnbjcc0vwb38ybikxwzlv8116rrrkndzs8qy79297";
       type = "gem";
     };
-    version = "2.0.4";
+    version = "2.0.5";
   };
   metasploit-credential = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1zblyy2yv31zap6dzf3lpkhvnafkwbzdvr6nsqmyh95ci8yy1q6r";
+      sha256 = "1flahrcl5hf4bncqs40mry6pkffvmir85kqzkad22x3dh6crw50i";
       type = "gem";
     };
-    version = "2.0.10";
+    version = "2.0.12";
   };
   metasploit-framework = {
     source = {
       fetchSubmodules = false;
-      rev = "8a194207f07c2b8c91c1a72e57c25683d4e9f744";
-      sha256 = "0q7iv9wd65ji1cay6am4dskrlibvp3wyn66gvld8p1nfnnvn5vmq";
+      rev = "dbec1c2d2ae4bd77276cbfb3c6ee2902048b9453";
+      sha256 = "06a2dc64wl8w02zimf44hch4cap7ckw42kg1x01lmcwaa8d5q09w";
       type = "git";
       url = "https://github.com/rapid7/metasploit-framework";
     };
-    version = "4.14.25";
+    version = "4.16.1";
   };
   metasploit-model = {
     source = {
@@ -204,26 +252,26 @@
   metasploit-payloads = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1dqnyzp60da6f8kgnbpjmv5xsg1hvyyd2jkkzbh69sgwp4nw3i9g";
+      sha256 = "0icha08z4c5rnyp66xcyn9c8lbv43gx7hgs9rsm3539gj8c40znx";
       type = "gem";
     };
-    version = "1.2.32";
+    version = "1.3.1";
   };
   metasploit_data_models = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0hb2wsz3d4xgjf6dlf7nzxlv6q7rcdgn1pj79xs3g8al38zi129g";
+      sha256 = "0j3ijxn6n3ack9572a74cwknijymy41c8rx34njyhg25lx4hbvah";
       type = "gem";
     };
-    version = "2.0.14";
+    version = "2.0.15";
   };
   metasploit_payloads-mettle = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "058ijqznh4xqx3d6dph5gwdsmj96z4n46rl1mm85fyxpgpkifqd1";
+      sha256 = "1y2nfzgs17pq3xvlw14jgjcksr4h8p4miypxk9a87l1h7xv7dcgn";
       type = "gem";
     };
-    version = "0.1.9";
+    version = "0.2.0";
   };
   mini_portile2 = {
     source = {
@@ -236,10 +284,10 @@
   minitest = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "11my86fnihvpndyknn3c14hc82nhsgggnhlxh8h3bdjpmfsvl0my";
+      sha256 = "05521clw19lrksqgvg2kmm025pvdhdaniix52vmbychrn2jm7kz2";
       type = "gem";
     };
-    version = "5.10.2";
+    version = "5.10.3";
   };
   msgpack = {
     source = {
@@ -284,10 +332,10 @@
   nexpose = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0jdhhzzs3b3rav6imx8jn9920cjj83yjvz35q169y0ppla2xzqbg";
+      sha256 = "0jnyvj09z8r3chhj930fdnashbfcfv0vw2drjvsrcnm7firdhdzb";
       type = "gem";
     };
-    version = "6.0.0";
+    version = "6.1.1";
   };
   nokogiri = {
     source = {
@@ -345,6 +393,14 @@
     };
     version = "0.12.4";
   };
+  pdf-reader = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0nlammdpjy3padmzxhsql7mw31jyqp88n6bdffiarv5kzl4s3y7p";
+      type = "gem";
+    };
+    version = "2.0.0";
+  };
   pg = {
     source = {
       remotes = ["https://rubygems.org"];
@@ -420,10 +476,10 @@
   railties = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0bavl4hj7bnl3ryqi9rvykm410kflplgingkcxasfv1gdilddh4g";
+      sha256 = "1g5jnk1zllm2fr06lixq7gv8l2cwqc99akv7886gz6lshijpfyxd";
       type = "gem";
     };
-    version = "4.2.8";
+    version = "4.2.9";
   };
   rake = {
     source = {
@@ -436,18 +492,34 @@
   rb-readline = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "170m6d2298s9kfbd4y3zzj4irsnd15qlbgi6kk93m88lkh9qzy3a";
+      sha256 = "14w79a121czmvk1s953qfzww30mqjb2zc0k9qhi0ivxxk3hxg6wy";
+      type = "gem";
+    };
+    version = "0.5.5";
+  };
+  rbnacl = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "08dkigw8wdx53hviw1zqrs7rcrzqcwh9jd3dvwr72013z9fmyp48";
       type = "gem";
     };
-    version = "0.5.4";
+    version = "4.0.2";
+  };
+  rbnacl-libsodium = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1323fli41m01af13xz5xvabsjnz09si1b9l4qd2p802kq0dr61gd";
+      type = "gem";
+    };
+    version = "1.0.13";
   };
   recog = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0d12889rx9ylm0jybg9n5sqx0v413hy9zjqs9rd9qjd1kjva7y87";
+      sha256 = "0h023ykrrra74bpbibkyg083kafaswvraw4naw9p1ghcjzn9ggj3";
       type = "gem";
     };
-    version = "2.1.8";
+    version = "2.1.12";
   };
   redcarpet = {
     source = {
@@ -460,26 +532,26 @@
   rex-arch = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "13dyic499iblhddmy7w01ajr5l5rm6szagy6vz7sx138y21d1y6f";
+      sha256 = "1izzalmjwdyib8y0xlgys8qb60di6xyjk485ylgh14p47wkyc6yp";
       type = "gem";
     };
-    version = "0.1.8";
+    version = "0.1.11";
   };
   rex-bin_tools = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0skrbpyal6anh4g1nsaf9ypg5sd2ghxxmghasxw4p1s1i1xbmhwr";
+      sha256 = "01hi1cjr68adp47nxbjfprvn0r3b72r4ib82x9j33bf2pny6nvaw";
       type = "gem";
     };
-    version = "0.1.3";
+    version = "0.1.4";
   };
   rex-core = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "09xbslrwbc9d0rp24y1pdgc6650ciwicq4q7skjz74rprr9wj16f";
+      sha256 = "16dwf4pw7bpx8xvlv241imxvwhvjfv0cw9kl7ipsv40yazy5lzpk";
       type = "gem";
     };
-    version = "0.1.10";
+    version = "0.1.12";
   };
   rex-encoder = {
     source = {
@@ -564,18 +636,18 @@
   rex-socket = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0r39782f2qpq83wsi72213v344gq4rccch98i376fx8bayh0dygh";
+      sha256 = "0bkr64qrfy2mcv6cpp2z2rn9npgn9s0yyagzjh7kawbm80ldwf2h";
       type = "gem";
     };
-    version = "0.1.6";
+    version = "0.1.8";
   };
   rex-sslscan = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0r5cy1kng1ggjycn7a8vpval7clhr0yxhd7rgn2hasxl2p3c7i8v";
+      sha256 = "06gbx45q653ajcx099p0yxdqqxazfznbrqshd4nwiwg1p498lmyx";
       type = "gem";
     };
-    version = "0.1.4";
+    version = "0.1.5";
   };
   rex-struct2 = {
     source = {
@@ -617,6 +689,14 @@
     };
     version = "0.10.1";
   };
+  ruby-rc4 = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "00vci475258mmbvsdqkmqadlwn6gj9m01sp7b5a3zd90knil1k00";
+      type = "gem";
+    };
+    version = "0.1.5";
+  };
   ruby_smb = {
     source = {
       remotes = ["https://rubygems.org"];
@@ -668,10 +748,10 @@
   thor = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "01n5dv9kql60m6a00zc0r66jvaxx98qhdny3klyj0p3w34pad2ns";
+      sha256 = "0nmqpyj642sk4g16nkbq6pj856adpv91lp4krwhqkh2iw63aszdl";
       type = "gem";
     };
-    version = "0.19.4";
+    version = "0.20.0";
   };
   thread_safe = {
     source = {
@@ -681,6 +761,14 @@
     };
     version = "0.3.6";
   };
+  ttfunk = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1mgrnqla5n51v4ivn844albsajkck7k6lviphfqa8470r46c58cd";
+      type = "gem";
+    };
+    version = "1.5.1";
+  };
   tzinfo = {
     source = {
       remotes = ["https://rubygems.org"];
@@ -705,6 +793,14 @@
     };
     version = "0.1.2";
   };
+  xdr = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0c5cp1k4ij3xq1q6fb0f6xv5b65wy18y7bhwvsdx8wd0zyg3x96m";
+      type = "gem";
+    };
+    version = "2.0.0";
+  };
   xmlrpc = {
     source = {
       remotes = ["https://rubygems.org"];
@@ -713,4 +809,4 @@
     };
     version = "0.3.0";
   };
-}
\ No newline at end of file
+}
diff --git a/pkgs/tools/security/mfcuk/default.nix b/pkgs/tools/security/mfcuk/default.nix
index 9a593907a533..3d4bdd2edf17 100644
--- a/pkgs/tools/security/mfcuk/default.nix
+++ b/pkgs/tools/security/mfcuk/default.nix
@@ -5,16 +5,17 @@ stdenv.mkDerivation rec {
   version = "0.3.8";
 
   src = fetchurl {
-    url = "http://mfcuk.googlecode.com/files/mfcuk-0.3.8.tar.gz";
+    url = "https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/mfcuk/mfcuk-0.3.8.tar.gz";
     sha256 = "0m9sy61rsbw63xk05jrrmnyc3xda0c3m1s8pg3sf8ijbbdv9axcp";
   };
 
-  buildInputs = [ pkgconfig libnfc ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libnfc ];
 
   meta = with stdenv.lib; {
     description = "MiFare Classic Universal toolKit";
     license = licenses.gpl2;
-    homepage = http://code.google.com/p/mfcuk/;
+    homepage = https://github.com/nfc-tools/mfcuk;
     maintainers = with maintainers; [ offline ];
     platforms = platforms.unix;
   };
diff --git a/pkgs/tools/security/mfoc/default.nix b/pkgs/tools/security/mfoc/default.nix
index a223b3e835ae..278818e88b54 100644
--- a/pkgs/tools/security/mfoc/default.nix
+++ b/pkgs/tools/security/mfoc/default.nix
@@ -5,18 +5,19 @@ stdenv.mkDerivation rec {
   version = "0.10.6";
 
   src = fetchurl {
-    url = "http://mfoc.googlecode.com/files/${name}.tar.gz";
+    url = "https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/mfoc/${name}.tar.gz";
     sha1 = "3adce3029dce9124ff3bc7d0fad86fa0c374a9e3";
   };
 
   patches = [./mf_mini.patch];
 
-  buildInputs = [ pkgconfig libnfc ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libnfc ];
 
   meta = with stdenv.lib; {
     description = "Mifare Classic Offline Cracker";
     license = licenses.gpl2;
-    homepage = http://code.google.com/p/mfoc/;
+    homepage = https://github.com/nfc-tools/mfoc;
     maintainers = with maintainers; [ offline ];
     platforms = platforms.unix;
   };
diff --git a/pkgs/tools/security/modsecurity/Makefile.in.patch b/pkgs/tools/security/modsecurity/Makefile.in.patch
new file mode 100644
index 000000000000..98384c754ce7
--- /dev/null
+++ b/pkgs/tools/security/modsecurity/Makefile.in.patch
@@ -0,0 +1,17 @@
+--- a/apache2/Makefile.in	2017-10-10 09:45:51.000000000 -0400
++++ b/apache2/Makefile.in	2017-10-10 09:46:04.000000000 -0400
+@@ -1208,14 +1208,12 @@
+ @LINUX_TRUE@	for m in $(pkglib_LTLIBRARIES); do \
+ @LINUX_TRUE@	  base=`echo $$m | sed 's/\..*//'`; \
+ @LINUX_TRUE@	  rm -f $(DESTDIR)$(pkglibdir)/$$base.*a; \
+-@LINUX_TRUE@	  install -D -m444 $(DESTDIR)$(pkglibdir)/$$base.so $(DESTDIR)$(APXS_MODULES)/$$base.so; \
+ @LINUX_TRUE@	done
+ @LINUX_FALSE@install-exec-hook: $(pkglib_LTLIBRARIES)
+ @LINUX_FALSE@	@echo "Removing unused static libraries..."; \
+ @LINUX_FALSE@	for m in $(pkglib_LTLIBRARIES); do \
+ @LINUX_FALSE@	  base=`echo $$m | sed 's/\..*//'`; \
+ @LINUX_FALSE@	  rm -f $(DESTDIR)$(pkglibdir)/$$base.*a; \
+-@LINUX_FALSE@	  cp -p $(DESTDIR)$(pkglibdir)/$$base.so $(DESTDIR)$(APXS_MODULES); \
+ @LINUX_FALSE@	done
+ 
+ # Tell versions [3.59,3.63) of GNU make to not export all variables.
diff --git a/pkgs/tools/security/modsecurity/default.nix b/pkgs/tools/security/modsecurity/default.nix
index a5e03eb3fe16..2c02a5dd4736 100644
--- a/pkgs/tools/security/modsecurity/default.nix
+++ b/pkgs/tools/security/modsecurity/default.nix
@@ -1,35 +1,43 @@
 { stdenv, lib, fetchurl, pkgconfig
-, curl, apacheHttpd, pcre, apr, aprutil, libxml2 }:
+, curl, apacheHttpd, pcre, apr, aprutil, libxml2
+, luaSupport ? false, lua5
+}:
 
 with lib;
 
+let luaValue = if luaSupport then lua5 else "no";
+    optional = stdenv.lib.optional;
+in
+
 stdenv.mkDerivation rec {
   name = "modsecurity-${version}";
-  version = "2.9.0";
+  version = "2.9.2";
 
   src = fetchurl {
     url = "https://www.modsecurity.org/tarball/${version}/${name}.tar.gz";
-    sha256 = "e2bbf789966c1f80094d88d9085a81bde082b2054f8e38e0db571ca49208f434";
+    sha256 = "41a8f73476ec891f3a9e8736b98b64ea5c2105f1ce15ea57a1f05b4bf2ffaeb5";
   };
 
   nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ curl apacheHttpd pcre apr aprutil libxml2 ];
-  configureFlags = [
-    "--enable-standalone-module"
-    "--enable-static"
-    "--with-curl=${curl.dev}"
-    "--with-apxs=${apacheHttpd.dev}/bin/apxs"
-    "--with-pcre=${pcre.dev}"
-    "--with-apr=${apr.dev}"
-    "--with-apu=${aprutil.dev}/bin/apu-1-config"
-    "--with-libxml=${libxml2.dev}"
-  ];
+  buildInputs = [  curl apacheHttpd pcre apr aprutil libxml2 ] ++
+    optional luaSupport lua5;
+
+  configureFlags = ''
+    --enable-standalone-module
+    --enable-static
+    --with-curl=${curl.dev}
+    --with-apxs=${apacheHttpd.dev}/bin/apxs
+    --with-pcre=${pcre.dev}
+    --with-apr=${apr.dev}
+    --with-apu=${aprutil.dev}/bin/apu-1-config
+    --with-libxml=${libxml2.dev}
+    --with-lua=${luaValue}
+  '';
 
   outputs = ["out" "nginx"];
-
-  preBuild = ''
-    substituteInPlace apache2/Makefile.in --replace "install -D " "# install -D"
-  '';
+  # by default modsecurity's install script copies compiled output to httpd's modules folder
+  # this patch removes those lines
+  patches = [ ./Makefile.in.patch ];
 
   postInstall = ''
     mkdir -p $nginx
@@ -41,6 +49,6 @@ stdenv.mkDerivation rec {
     license = licenses.asl20;
     homepage = https://www.modsecurity.org/;
     maintainers = with maintainers; [offline];
-    platforms = platforms.linux;
+    platforms   = stdenv.lib.platforms.linux ++ stdenv.lib.platforms.darwin;
   };
 }
diff --git a/pkgs/tools/security/mpw/default.nix b/pkgs/tools/security/mpw/default.nix
index e30866021da6..3e1e3a882839 100644
--- a/pkgs/tools/security/mpw/default.nix
+++ b/pkgs/tools/security/mpw/default.nix
@@ -1,50 +1,39 @@
-{ stdenv, fetchzip, autoconf, automake, openssl, libxml2, fetchFromGitHub, ncurses }:
+{ stdenv, cmake, fetchFromGitHub, ncurses, libsodium, json_c }:
 
-let
-  scrypt_src = fetchzip {
-    url = "http://www.tarsnap.com/scrypt/scrypt-1.2.0.tgz";
-    sha256 = "0ahylib2pimlhjcm566kpim6n16jci5v749xwdkr9ivgfjrv3xn4";
-  };
-
-in stdenv.mkDerivation {
-  name = "mpw-2.1-6834f36";
+stdenv.mkDerivation rec {
+  name = "mpw-2.6-f8043ae";
 
   src = fetchFromGitHub {
     owner = "Lyndir";
     repo = "MasterPassword";
-    rev = "6834f3689f5dfd4e59ad6959961d349c224977ee";
-    sha256 = "0zlpx3hb1y2l60hg961h05lb9yf3xb5phnyycvazah2674gkwb2p";
+    rev = "f8043ae16d73ddfb205aadd25c35cd9c5e95b228";
+    sha256 = "0hy02ri7y3sca85z3ff5i68crwav5cjd7rrdqj7jrnpp1bw4yapi";
   };
 
   postUnpack = ''
-    sourceRoot+=/MasterPassword/C
+    sourceRoot+=/platform-independent/cli-c
   '';
 
-  prePatch = ''
-    patchShebangs .
-    mkdir lib/scrypt/src
-    cp -R --no-preserve=ownership ${scrypt_src}/* lib/scrypt/src
-    chmod +w -R lib/scrypt/src
-    substituteInPlace lib/scrypt/src/libcperciva/cpusupport/Build/cpusupport.sh \
-      --replace dirname "$(type -P dirname)"
-    substituteInPlace lib/scrypt/src/Makefile.in --replace "command -p mv" "mv"
+  preConfigure = ''
+    substituteInPlace CMakeLists.txt --replace curses ncurses
+    echo ${name} > VERSION
   '';
 
-  NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2";
+  dontUseCmakeBuildDir = true;
 
-  buildInputs = [ autoconf automake openssl libxml2 ncurses ];
+  nativeBuildInputs = [ cmake ];
 
-  buildPhase = ''
-    substituteInPlace build --replace '"curses"' '"ncurses"'
-    targets="mpw mpw-tests" ./build
-  '';
+  buildInputs = [ ncurses libsodium json_c ];
 
   installPhase = ''
     mkdir -p $out/bin
     mv mpw $out/bin/mpw
   '';
 
-  meta = {
-    platforms = stdenv.lib.platforms.unix;
+  meta = with stdenv.lib; {
+    homepage = http://masterpasswordapp.com/;
+    description = "A stateless password management solution";
+    license = licenses.gpl3;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/tools/security/nmap/default.nix b/pkgs/tools/security/nmap/default.nix
index cce737af9c1e..45f995a59350 100644
--- a/pkgs/tools/security/nmap/default.nix
+++ b/pkgs/tools/security/nmap/default.nix
@@ -28,6 +28,13 @@ in stdenv.mkDerivation rec {
 
   patches = ./zenmap.patch;
 
+  prePatch = optionalString stdenv.isDarwin ''
+    substituteInPlace libz/configure \
+        --replace /usr/bin/libtool ar \
+        --replace 'AR="libtool"' 'AR="ar"' \
+        --replace 'ARFLAGS="-o"' 'ARFLAGS="-r"'
+  '';
+
   configureFlags = []
     ++ optional (!pythonSupport) "--without-ndiff"
     ++ optional (!graphicalSupport) "--without-zenmap"
@@ -39,7 +46,8 @@ in stdenv.mkDerivation rec {
       wrapProgram $out/bin/zenmap --prefix PYTHONPATH : "$(toPythonPath $out)" --prefix PYTHONPATH : "$PYTHONPATH" --prefix PYTHONPATH : $(toPythonPath $pygtk)/gtk-2.0 --prefix PYTHONPATH : $(toPythonPath $pygobject)/gtk-2.0 --prefix PYTHONPATH : $(toPythonPath $pycairo)/gtk-2.0
   '';
 
-  buildInputs = with python2Packages; [ libpcap pkgconfig openssl ]
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = with python2Packages; [ libpcap openssl ]
     ++ optionals pythonSupport [ makeWrapper python ]
     ++ optionals graphicalSupport [
       libX11 gtk2 pygtk pysqlite pygobject2 pycairo
diff --git a/pkgs/tools/security/nsjail/default.nix b/pkgs/tools/security/nsjail/default.nix
index 3e4ddcd880e9..8f087ef3d93c 100644
--- a/pkgs/tools/security/nsjail/default.nix
+++ b/pkgs/tools/security/nsjail/default.nix
@@ -1,30 +1,33 @@
-{ stdenv, fetchgit }:
+{ stdenv, fetchFromGitHub, autoconf, pkgconfig, libtool
+, bison, flex, libnl, protobuf, protobufc }:
 
 stdenv.mkDerivation rec {
-  name = "nsjail-git-2015-08-10";
+  name = "nsjail-${version}";
+  version = "2.2";
 
-  src = fetchgit {
-    url = https://github.com/google/nsjail;
-    rev = "8b951e6c2827386786cde4a124cd1846d25b9404";
-    sha256 = "02bmwd48l6ngp0nc65flw395mpj66brx3808d5xd19qn5524lnni";
+  src = fetchFromGitHub {
+    owner           = "google";
+    repo            = "nsjail";
+    rev             = version;
+    fetchSubmodules = true;
+    sha256          = "11323j5wd02nm8ibvzbzq7dla70bmcldc71lv5bpk4x7h64ai14v";
   };
 
+  nativeBuildInputs = [ autoconf libtool pkgconfig ];
+  buildInputs = [ bison flex libnl protobuf protobufc ];
+  enableParallelBuilding = true;
+
   installPhase = ''
-    mkdir -p $out/bin
-    cp nsjail $out/bin
+    mkdir -p $out/bin $out/share/man/man1
+    install nsjail $out/bin/
+    install nsjail.1 $out/share/man/man1/
   '';
 
-  meta = {
-    description = ''
-      A light-weight process isolation tool, making use of Linux namespaces
-      and seccomp-bpf syscall filters
-      '';
-    homepage = http://google.github.io/nsjail;
-
-    license = stdenv.lib.licenses.apsl20;
-
-    maintainers = [ stdenv.lib.maintainers.bosu ];
-
-    platforms = stdenv.lib.platforms.linux;
+  meta = with stdenv.lib; {
+    description = "A light-weight process isolation tool, making use of Linux namespaces and seccomp-bpf syscall filters";
+    homepage    = http://nsjail.com/;
+    license     = licenses.asl20;
+    maintainers = with maintainers; [ bosu c0bw3b ];
+    platforms   = platforms.linux;
   };
 }
diff --git a/pkgs/tools/security/oath-toolkit/default.nix b/pkgs/tools/security/oath-toolkit/default.nix
index 98635f8cc85d..965ecda164be 100644
--- a/pkgs/tools/security/oath-toolkit/default.nix
+++ b/pkgs/tools/security/oath-toolkit/default.nix
@@ -6,14 +6,14 @@ let
     else pam;
 in
 stdenv.mkDerivation rec {
-  name = "oath-toolkit-2.6.1";
+  name = "oath-toolkit-2.6.2";
 
   src = fetchurl {
     url = "mirror://savannah/oath-toolkit/${name}.tar.gz";
-    sha256 = "0ybg0gnddmhxga0jwdipyz8jv5mxs0kiiflhvzffl9mw0wcq6mww";
+    sha256 = "182ah8vfbg0yhv6mh1b6ap944d0na6x7lpfkwkmzb6jl9gx4cd5h";
   };
 
-  
+
   buildInputs = [ securityDependency ];
 
   meta = {
diff --git a/pkgs/tools/security/omapd/default.nix b/pkgs/tools/security/omapd/default.nix
index 9e01e8f0a9f3..91df7f3fbb0a 100644
--- a/pkgs/tools/security/omapd/default.nix
+++ b/pkgs/tools/security/omapd/default.nix
@@ -5,7 +5,7 @@ stdenv.mkDerivation rec {
   version = "0.9.2";
 
   src = fetchurl {
-    url = "http://omapd.googlecode.com/files/${name}.tgz";
+    url = "https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/omapd/${name}.tgz";
     sha256 = "0d7lgv957jhbsav60j50jhdy3rpcqgql74qsniwnnpm3yqj9p0xc";
   };
 
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with stdenv.lib; {
-    homepage = http://code.google.com/p/omapd;
+    homepage = https://code.google.com/archive/p/omapd/;
     description = "IF-MAP Server that implements the IF-MAP v1.1 and v2.0 specifications published by the Trusted Computing Group (TCG)";
     license = licenses.gpl3;
     maintainers = [ maintainers.tstrobel ];
diff --git a/pkgs/tools/security/opensc/default.nix b/pkgs/tools/security/opensc/default.nix
index 302a5e251b03..ce310eec5aed 100644
--- a/pkgs/tools/security/opensc/default.nix
+++ b/pkgs/tools/security/opensc/default.nix
@@ -1,6 +1,7 @@
 { stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, zlib, readline, openssl
 , libiconv, pcsclite, libassuan, libXt
 , docbook_xsl, libxslt, docbook_xml_dtd_412
+, Carbon
 }:
 
 stdenv.mkDerivation rec {
@@ -14,10 +15,11 @@ stdenv.mkDerivation rec {
     sha256 = "16y3ryx606nry2li05hm88bllrragdj3sfl3yh7pf71777n4lsk4";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    autoreconfHook pkgconfig zlib readline openssl pcsclite libassuan
+    autoreconfHook zlib readline openssl pcsclite libassuan
     libXt libxslt libiconv docbook_xml_dtd_412
-  ];
+  ] ++ stdenv.lib.optional stdenv.isDarwin Carbon;
 
   configureFlags = [
     "--enable-zlib"
@@ -37,8 +39,6 @@ stdenv.mkDerivation rec {
     "sysconfdir=$(out)/etc"
   ];
 
-  
-
   meta = with stdenv.lib; {
     description = "Set of libraries and utilities to access smart cards";
     homepage = https://github.com/OpenSC/OpenSC/wiki;
diff --git a/pkgs/tools/security/pass/rofi-pass.nix b/pkgs/tools/security/pass/rofi-pass.nix
index 2f3fab6de816..61f51973ed32 100644
--- a/pkgs/tools/security/pass/rofi-pass.nix
+++ b/pkgs/tools/security/pass/rofi-pass.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   name = "rofi-pass-${version}";
-  version = "1.5.0";
+  version = "1.5.3";
 
   src = fetchFromGitHub {
     owner = "carnager";
     repo = "rofi-pass";
     rev = version;
-    sha256 = "08chbn966140p3gmgalkhhm01ym64fvb6d2w5mbwpyl0986m89ba";
+    sha256 = "1fn1j2rf3abc5qb44zfc8z8ffw6rva4xfp7597hwr1g3szacazpq";
   };
 
   buildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/security/pgpdump/default.nix b/pkgs/tools/security/pgpdump/default.nix
index 93b53c3ad4a3..09b5b5f58ca4 100644
--- a/pkgs/tools/security/pgpdump/default.nix
+++ b/pkgs/tools/security/pgpdump/default.nix
@@ -1,4 +1,6 @@
-{ stdenv, fetchFromGitHub }:
+{ stdenv, fetchFromGitHub
+, supportCompressedPackets ? true, zlib, bzip2
+}:
 
 stdenv.mkDerivation rec {
   name = "pgpdump-${version}";
@@ -11,6 +13,8 @@ stdenv.mkDerivation rec {
     sha256 = "1ip7q5sgh3nwdqbrzpp6sllkls5kma98kns53yspw1830xi1n8xc";
   };
 
+  buildInputs = stdenv.lib.optionals supportCompressedPackets [ zlib bzip2 ];
+
   meta = with stdenv.lib; {
     description = "A PGP packet visualizer";
     longDescription = ''
diff --git a/pkgs/tools/security/pinentry-mac/default.nix b/pkgs/tools/security/pinentry-mac/default.nix
index cd0060cbcb97..074d71c08308 100644
--- a/pkgs/tools/security/pinentry-mac/default.nix
+++ b/pkgs/tools/security/pinentry-mac/default.nix
@@ -6,8 +6,8 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "matthewbauer";
     repo = "pinentry-mac";
-    rev = "d60aa902644a1f0126ec50e79937423a3a7c3bc4";
-    sha256 = "0xp4rdyj0mw6gg1z1wraggb1qlkjb5845mibrz3nj0l692da52nq";
+    rev = "6dfef256c8ea32d642fea847f27d800f024cf51e";
+    sha256 = "0g75302697gqcxyf2hyqzvcbd5pyss1bl2xvfd40wqav7dlyvj83";
   };
 
   buildInputs = [ xcbuild libiconv Cocoa ncurses ];
diff --git a/pkgs/tools/security/pinentry/default.nix b/pkgs/tools/security/pinentry/default.nix
index 667831373c55..0d957fc97e08 100644
--- a/pkgs/tools/security/pinentry/default.nix
+++ b/pkgs/tools/security/pinentry/default.nix
@@ -1,12 +1,11 @@
 { fetchurl, fetchpatch, stdenv, lib, pkgconfig
-, libgpgerror, libassuan, libcap ? null, ncurses ? null, gtk2 ? null, qt4 ? null
+, libgpgerror, libassuan, libcap ? null, libsecret ? null, ncurses ? null, gtk2 ? null, gcr ? null, qt4 ? null
 }:
 
 let
   mkFlag = pfxTrue: pfxFalse: cond: name: "--${if cond then pfxTrue else pfxFalse}-${name}";
   mkEnable = mkFlag "enable" "disable";
   mkWith = mkFlag "with" "without";
-  hasX = gtk2 != null || qt4 != null;
 in
 with stdenv.lib;
 stdenv.mkDerivation rec {
@@ -17,7 +16,7 @@ stdenv.mkDerivation rec {
     sha256 = "0ni7g4plq6x78p32al7m8h2zsakvg1rhfz0qbc3kdc7yq7nw4whn";
   };
 
-  buildInputs = [ libgpgerror libassuan libcap gtk2 ncurses qt4 ];
+  buildInputs = [ libgpgerror libassuan libcap libsecret gtk2 gcr ncurses qt4 ];
 
   prePatch = ''
     substituteInPlace pinentry/pinentry-curses.c --replace ncursesw ncurses
@@ -39,12 +38,13 @@ stdenv.mkDerivation rec {
   '';
 
   configureFlags = [
-    (mkWith   (libcap != null)  "libcap")
-    (mkWith   (hasX)            "x")
-    (mkEnable (ncurses != null) "pinentry-curses")
-    (mkEnable true              "pinentry-tty")
-    (mkEnable (gtk2 != null)    "pinentry-gtk2")
-    (mkEnable (qt4 != null)     "pinentry-qt4")
+    (mkWith   (libcap != null)    "libcap")
+    (mkEnable (libsecret != null) "libsecret")
+    (mkEnable (ncurses != null)   "pinentry-curses")
+    (mkEnable true                "pinentry-tty")
+    (mkEnable (gtk2 != null)      "pinentry-gtk2")
+    (mkEnable (gcr != null)       "pinentry-gnome3")
+    (mkEnable (qt4 != null)       "pinentry-qt")
   ];
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/tools/security/pius/default.nix b/pkgs/tools/security/pius/default.nix
index af27fb6cd01f..5e0c87c2f7d5 100644
--- a/pkgs/tools/security/pius/default.nix
+++ b/pkgs/tools/security/pius/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation {
   '';
 
   meta = {
-    homepage = http://www.phildev.net/pius/;
+    homepage = https://www.phildev.net/pius/;
 
     description = "PGP Individual UID Signer (PIUS), quickly and easily sign UIDs on a set of PGP keys";
 
diff --git a/pkgs/tools/security/pwgen/default.nix b/pkgs/tools/security/pwgen/default.nix
index b793219f6497..79e8fb071b37 100644
--- a/pkgs/tools/security/pwgen/default.nix
+++ b/pkgs/tools/security/pwgen/default.nix
@@ -1,11 +1,14 @@
-{stdenv, fetchurl}:
+{stdenv, fetchurl, autoreconfHook}:
 stdenv.mkDerivation {
-  name = "pwgen-2.07";
+  name = "pwgen-2.08";
 
   src = fetchurl {
-    url = mirror://sourceforge/pwgen/pwgen-2.07.tar.gz;
-    sha256 = "0mhmw700kkh238fzivcwnwi94bj9f3h36yfh3k3j2v19b0zmjx7b";
+    url = https://github.com/tytso/pwgen/archive/v2.08.tar.gz;
+    sha256 = "8d6e94f28655e61d6126290e3eafad4d17d7fba0d0d354239522a740a270bb2f";
   };
+
+  nativeBuildInputs = [ autoreconfHook ];
+
   meta = {
     description = "Password generator which creates passwords which can be easily memorized by a human";
     platforms = stdenv.lib.platforms.all;
diff --git a/pkgs/tools/security/qdigidoc/default.nix b/pkgs/tools/security/qdigidoc/default.nix
index e4141d1a61b6..87c9fc59a5bd 100644
--- a/pkgs/tools/security/qdigidoc/default.nix
+++ b/pkgs/tools/security/qdigidoc/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     sha256 = "1a7nsi28q57ic99hrb6x83qlvpqvzvk6acbfl6ncny2j4yaxa4jl";
   };
 
-  patches = [ ./certs.patch ];
+  patches = [ ./certs.patch ./glibc-2_26.patch ];
 
   unpackPhase = ''
     mkdir src
@@ -25,11 +25,14 @@ stdenv.mkDerivation rec {
       --prefix LD_LIBRARY_PATH : ${opensc}/lib/pkcs11/
   '';
 
-  buildInputs = [ cmake ccid qttools pkgconfig pcsclite qttranslations
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ cmake ccid qttools pcsclite qttranslations
                   hicolor_icon_theme libdigidocpp opensc shared_mime_info
                   openldap gettext desktop_file_utils makeWrapper
                 ];
-  
+
+  enableParallelBuilding = true;
+
   meta = with stdenv.lib; {
     description = "Qt based UI application for verifying and signing digital signatures";
     homepage = http://www.id.ee/;
diff --git a/pkgs/tools/security/qdigidoc/glibc-2_26.patch b/pkgs/tools/security/qdigidoc/glibc-2_26.patch
new file mode 100644
index 000000000000..1d99538e72d9
--- /dev/null
+++ b/pkgs/tools/security/qdigidoc/glibc-2_26.patch
@@ -0,0 +1,221 @@
+diff --git a/common/google-breakpad/src/client/linux/dump_writer_common/ucontext_reader.cc b/common/google-breakpad/src/client/linux/dump_writer_common/ucontext_reader.cc
+index b20a68b..38f1375 100644
+--- a/common/google-breakpad/src/client/linux/dump_writer_common/ucontext_reader.cc
++++ b/common/google-breakpad/src/client/linux/dump_writer_common/ucontext_reader.cc
+@@ -36,19 +36,19 @@ namespace google_breakpad {
+ 
+ // Minidump defines register structures which are different from the raw
+ // structures which we get from the kernel. These are platform specific
+-// functions to juggle the ucontext and user structures into minidump format.
++// functions to juggle the ucontext_t and user structures into minidump format.
+ 
+ #if defined(__i386__)
+ 
+-uintptr_t UContextReader::GetStackPointer(const struct ucontext* uc) {
++uintptr_t UContextReader::GetStackPointer(const ucontext_t* uc) {
+   return uc->uc_mcontext.gregs[REG_ESP];
+ }
+ 
+-uintptr_t UContextReader::GetInstructionPointer(const struct ucontext* uc) {
++uintptr_t UContextReader::GetInstructionPointer(const ucontext_t* uc) {
+   return uc->uc_mcontext.gregs[REG_EIP];
+ }
+ 
+-void UContextReader::FillCPUContext(RawContextCPU *out, const ucontext *uc,
++void UContextReader::FillCPUContext(RawContextCPU *out, const ucontext_t *uc,
+                                     const struct _libc_fpstate* fp) {
+   const greg_t* regs = uc->uc_mcontext.gregs;
+ 
+@@ -88,15 +88,15 @@ void UContextReader::FillCPUContext(RawContextCPU *out, const ucontext *uc,
+ 
+ #elif defined(__x86_64)
+ 
+-uintptr_t UContextReader::GetStackPointer(const struct ucontext* uc) {
++uintptr_t UContextReader::GetStackPointer(const ucontext_t* uc) {
+   return uc->uc_mcontext.gregs[REG_RSP];
+ }
+ 
+-uintptr_t UContextReader::GetInstructionPointer(const struct ucontext* uc) {
++uintptr_t UContextReader::GetInstructionPointer(const ucontext_t* uc) {
+   return uc->uc_mcontext.gregs[REG_RIP];
+ }
+ 
+-void UContextReader::FillCPUContext(RawContextCPU *out, const ucontext *uc,
++void UContextReader::FillCPUContext(RawContextCPU *out, const ucontext_t *uc,
+                                     const struct _libc_fpstate* fpregs) {
+   const greg_t* regs = uc->uc_mcontext.gregs;
+ 
+@@ -145,15 +145,15 @@ void UContextReader::FillCPUContext(RawContextCPU *out, const ucontext *uc,
+ 
+ #elif defined(__ARM_EABI__)
+ 
+-uintptr_t UContextReader::GetStackPointer(const struct ucontext* uc) {
++uintptr_t UContextReader::GetStackPointer(const ucontext_t* uc) {
+   return uc->uc_mcontext.arm_sp;
+ }
+ 
+-uintptr_t UContextReader::GetInstructionPointer(const struct ucontext* uc) {
++uintptr_t UContextReader::GetInstructionPointer(const ucontext_t* uc) {
+   return uc->uc_mcontext.arm_pc;
+ }
+ 
+-void UContextReader::FillCPUContext(RawContextCPU *out, const ucontext *uc) {
++void UContextReader::FillCPUContext(RawContextCPU *out, const ucontext_t *uc) {
+   out->context_flags = MD_CONTEXT_ARM_FULL;
+ 
+   out->iregs[0] = uc->uc_mcontext.arm_r0;
+@@ -184,15 +184,15 @@ void UContextReader::FillCPUContext(RawContextCPU *out, const ucontext *uc) {
+ 
+ #elif defined(__aarch64__)
+ 
+-uintptr_t UContextReader::GetStackPointer(const struct ucontext* uc) {
++uintptr_t UContextReader::GetStackPointer(const ucontext_t* uc) {
+   return uc->uc_mcontext.sp;
+ }
+ 
+-uintptr_t UContextReader::GetInstructionPointer(const struct ucontext* uc) {
++uintptr_t UContextReader::GetInstructionPointer(const ucontext_t* uc) {
+   return uc->uc_mcontext.pc;
+ }
+ 
+-void UContextReader::FillCPUContext(RawContextCPU *out, const ucontext *uc,
++void UContextReader::FillCPUContext(RawContextCPU *out, const ucontext_t *uc,
+                                     const struct fpsimd_context* fpregs) {
+   out->context_flags = MD_CONTEXT_ARM64_FULL;
+ 
+@@ -210,15 +210,15 @@ void UContextReader::FillCPUContext(RawContextCPU *out, const ucontext *uc,
+ 
+ #elif defined(__mips__)
+ 
+-uintptr_t UContextReader::GetStackPointer(const struct ucontext* uc) {
++uintptr_t UContextReader::GetStackPointer(const ucontext_t* uc) {
+   return uc->uc_mcontext.gregs[MD_CONTEXT_MIPS_REG_SP];
+ }
+ 
+-uintptr_t UContextReader::GetInstructionPointer(const struct ucontext* uc) {
++uintptr_t UContextReader::GetInstructionPointer(const ucontext_t* uc) {
+   return uc->uc_mcontext.pc;
+ }
+ 
+-void UContextReader::FillCPUContext(RawContextCPU *out, const ucontext *uc) {
++void UContextReader::FillCPUContext(RawContextCPU *out, const ucontext_t *uc) {
+   out->context_flags = MD_CONTEXT_MIPS_FULL;
+ 
+   for (int i = 0; i < MD_CONTEXT_MIPS_GPR_COUNT; ++i)
+diff --git a/common/google-breakpad/src/client/linux/dump_writer_common/ucontext_reader.h b/common/google-breakpad/src/client/linux/dump_writer_common/ucontext_reader.h
+index b6e77b4..2de80b7 100644
+--- a/common/google-breakpad/src/client/linux/dump_writer_common/ucontext_reader.h
++++ b/common/google-breakpad/src/client/linux/dump_writer_common/ucontext_reader.h
+@@ -39,23 +39,23 @@
+ 
+ namespace google_breakpad {
+ 
+-// Wraps platform-dependent implementations of accessors to ucontext structs.
++// Wraps platform-dependent implementations of accessors to ucontext_t structs.
+ struct UContextReader {
+-  static uintptr_t GetStackPointer(const struct ucontext* uc);
++  static uintptr_t GetStackPointer(const ucontext_t* uc);
+ 
+-  static uintptr_t GetInstructionPointer(const struct ucontext* uc);
++  static uintptr_t GetInstructionPointer(const ucontext_t* uc);
+ 
+-  // Juggle a arch-specific ucontext into a minidump format
++  // Juggle a arch-specific ucontext_t into a minidump format
+   //   out: the minidump structure
+   //   info: the collection of register structures.
+ #if defined(__i386__) || defined(__x86_64)
+-  static void FillCPUContext(RawContextCPU *out, const ucontext *uc,
++  static void FillCPUContext(RawContextCPU *out, const ucontext_t *uc,
+                              const struct _libc_fpstate* fp);
+ #elif defined(__aarch64__)
+-  static void FillCPUContext(RawContextCPU *out, const ucontext *uc,
++  static void FillCPUContext(RawContextCPU *out, const ucontext_t *uc,
+                              const struct fpsimd_context* fpregs);
+ #else
+-  static void FillCPUContext(RawContextCPU *out, const ucontext *uc);
++  static void FillCPUContext(RawContextCPU *out, const ucontext_t *uc);
+ #endif
+ };
+ 
+diff --git a/common/google-breakpad/src/client/linux/handler/exception_handler.cc b/common/google-breakpad/src/client/linux/handler/exception_handler.cc
+index 3e2d196..b6d02ef 100644
+--- a/common/google-breakpad/src/client/linux/handler/exception_handler.cc
++++ b/common/google-breakpad/src/client/linux/handler/exception_handler.cc
+@@ -404,9 +404,9 @@ bool ExceptionHandler::HandleSignal(int sig, siginfo_t* info, void* uc) {
+   // Fill in all the holes in the struct to make Valgrind happy.
+   memset(&context, 0, sizeof(context));
+   memcpy(&context.siginfo, info, sizeof(siginfo_t));
+-  memcpy(&context.context, uc, sizeof(struct ucontext));
++  memcpy(&context.context, uc, sizeof(ucontext_t));
+ #if defined(__aarch64__)
+-  struct ucontext *uc_ptr = (struct ucontext*)uc;
++  ucontext_t* uc_ptr = (ucontext_t*)uc;
+   struct fpsimd_context *fp_ptr =
+       (struct fpsimd_context*)&uc_ptr->uc_mcontext.__reserved;
+   if (fp_ptr->head.magic == FPSIMD_MAGIC) {
+@@ -414,9 +414,9 @@ bool ExceptionHandler::HandleSignal(int sig, siginfo_t* info, void* uc) {
+   }
+ #elif !defined(__ARM_EABI__)  && !defined(__mips__)
+   // FP state is not part of user ABI on ARM Linux.
+-  // In case of MIPS Linux FP state is already part of struct ucontext
++  // In case of MIPS Linux FP state is already part of ucontext_t
+   // and 'float_state' is not a member of CrashContext.
+-  struct ucontext *uc_ptr = (struct ucontext*)uc;
++  ucontext_t* uc_ptr = (ucontext_t*)uc;
+   if (uc_ptr->uc_mcontext.fpregs) {
+     memcpy(&context.float_state,
+            uc_ptr->uc_mcontext.fpregs,
+@@ -440,7 +440,7 @@ bool ExceptionHandler::SimulateSignalDelivery(int sig) {
+   // ExceptionHandler::HandleSignal().
+   siginfo.si_code = SI_USER;
+   siginfo.si_pid = getpid();
+-  struct ucontext context;
++  ucontext_t context;
+   getcontext(&context);
+   return HandleSignal(sig, &siginfo, &context);
+ }
+diff --git a/common/google-breakpad/src/client/linux/handler/exception_handler.h b/common/google-breakpad/src/client/linux/handler/exception_handler.h
+index 591c310..42f4055 100644
+--- a/common/google-breakpad/src/client/linux/handler/exception_handler.h
++++ b/common/google-breakpad/src/client/linux/handler/exception_handler.h
+@@ -191,11 +191,11 @@ class ExceptionHandler {
+   struct CrashContext {
+     siginfo_t siginfo;
+     pid_t tid;  // the crashing thread.
+-    struct ucontext context;
++    ucontext_t context;
+ #if !defined(__ARM_EABI__) && !defined(__mips__)
+     // #ifdef this out because FP state is not part of user ABI for Linux ARM.
+-    // In case of MIPS Linux FP state is already part of struct
+-    // ucontext so 'float_state' is not required.
++    // In case of MIPS Linux FP state is already part of ucontext_t so
++    // 'float_state' is not required.
+     fpstate_t float_state;
+ #endif
+   };
+diff --git a/common/google-breakpad/src/client/linux/microdump_writer/microdump_writer.cc b/common/google-breakpad/src/client/linux/microdump_writer/microdump_writer.cc
+index 494e2a2..c00436b 100644
+--- a/common/google-breakpad/src/client/linux/microdump_writer/microdump_writer.cc
++++ b/common/google-breakpad/src/client/linux/microdump_writer/microdump_writer.cc
+@@ -328,7 +328,7 @@ class MicrodumpWriter {
+ 
+   void* Alloc(unsigned bytes) { return dumper_->allocator()->Alloc(bytes); }
+ 
+-  const struct ucontext* const ucontext_;
++  const ucontext_t* const ucontext_;
+ #if !defined(__ARM_EABI__) && !defined(__mips__)
+   const google_breakpad::fpstate_t* const float_state_;
+ #endif
+diff --git a/common/google-breakpad/src/client/linux/minidump_writer/minidump_writer.cc b/common/google-breakpad/src/client/linux/minidump_writer/minidump_writer.cc
+index 8406ffe..7e6fe52 100644
+--- a/common/google-breakpad/src/client/linux/minidump_writer/minidump_writer.cc
++++ b/common/google-breakpad/src/client/linux/minidump_writer/minidump_writer.cc
+@@ -1221,7 +1221,7 @@ class MinidumpWriter {
+   const int fd_;  // File descriptor where the minidum should be written.
+   const char* path_;  // Path to the file where the minidum should be written.
+ 
+-  const struct ucontext* const ucontext_;  // also from the signal handler
++  const ucontext_t* const ucontext_;  // also from the signal handler
+ #if !defined(__ARM_EABI__) && !defined(__mips__)
+   const google_breakpad::fpstate_t* const float_state_;  // ditto
+ #endif
diff --git a/pkgs/tools/security/qesteidutil/default.nix b/pkgs/tools/security/qesteidutil/default.nix
index 04f6cbf6d113..f2a997db05f3 100644
--- a/pkgs/tools/security/qesteidutil/default.nix
+++ b/pkgs/tools/security/qesteidutil/default.nix
@@ -17,7 +17,8 @@ stdenv.mkDerivation rec {
     cd src
   '';
 
-  buildInputs = [ cmake ccid qttools pkgconfig pcsclite qttranslations
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ cmake ccid qttools pcsclite qttranslations
                   hicolor_icon_theme
                 ];
   
diff --git a/pkgs/tools/security/radamsa/default.nix b/pkgs/tools/security/radamsa/default.nix
index 4a770f86e5cb..3a6c09b9291d 100644
--- a/pkgs/tools/security/radamsa/default.nix
+++ b/pkgs/tools/security/radamsa/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   meta = {
     description = "A general purpose fuzzer";
     longDescription = "Radamsa is a general purpose data fuzzer. It reads data from given sample files, or standard input if none are given, and outputs modified data. It is usually used to generate malformed data for testing programs.";
-    homepage = http://github.com/aoh/radamsa;
+    homepage = https://github.com/aoh/radamsa;
     maintainers = [ stdenv.lib.maintainers.markWot ];
     platforms = stdenv.lib.platforms.all;
   };
diff --git a/pkgs/tools/security/rng-tools/default.nix b/pkgs/tools/security/rng-tools/default.nix
index 75a865917ec1..1885940e7f31 100644
--- a/pkgs/tools/security/rng-tools/default.nix
+++ b/pkgs/tools/security/rng-tools/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   meta = {
     description = "A random number generator daemon";
 
-    homepage = http://sourceforge.net/projects/gkernel;
+    homepage = https://sourceforge.net/projects/gkernel;
 
     license = stdenv.lib.licenses.gpl2;
 
diff --git a/pkgs/tools/security/sbsigntool/default.nix b/pkgs/tools/security/sbsigntool/default.nix
index bca93887bd4e..bcf1a5c1f792 100644
--- a/pkgs/tools/security/sbsigntool/default.nix
+++ b/pkgs/tools/security/sbsigntool/default.nix
@@ -1,5 +1,7 @@
-{ stdenv, fetchgit, autoconf, automake, utillinux, openssl, libuuid, gnu-efi
-, binutils, pkgconfig, help2man }:
+{ stdenv
+, fetchgit, autoconf, automake, pkgconfig, help2man
+, utillinux, openssl, libuuid, gnu-efi, libbfd
+}:
 
 stdenv.mkDerivation rec {
   name = "sbsigntool-${version}";
@@ -15,7 +17,8 @@ stdenv.mkDerivation rec {
 
   prePatch = "patchShebangs .";
 
-  buildInputs = [ autoconf automake utillinux openssl libuuid gnu-efi binutils pkgconfig help2man ];
+  nativeBuildInputs = [ autoconf automake pkgconfig help2man ];
+  buildInputs = [ utillinux openssl libuuid gnu-efi libbfd ];
 
   configurePhase = ''
     substituteInPlace configure.ac --replace "@@NIX_GNUEFI@@" "${gnu-efi}"
diff --git a/pkgs/tools/security/scrypt/default.nix b/pkgs/tools/security/scrypt/default.nix
index 1835dbdb620b..352a81b2727a 100644
--- a/pkgs/tools/security/scrypt/default.nix
+++ b/pkgs/tools/security/scrypt/default.nix
@@ -2,27 +2,26 @@
 
 stdenv.mkDerivation rec {
   name = "scrypt-${version}";
-  version = "1.2.0";
+  version = "1.2.1";
 
   src = fetchurl {
     url = "https://www.tarsnap.com/scrypt/${name}.tgz";
-    sha256 = "1m39hpfby0fdjam842773i5w7pa0qaj7f0r22jnchxsj824vqm0p";
+    sha256 = "0xy5yhrwwv13skv9im9vm76rybh9f29j2dh4hlh2x01gvbkza8a6";
   };
 
   buildInputs = [ openssl ];
 
   patchPhase = ''
-    substituteInPlace Makefile.in \
-      --replace "command -p mv" "mv"
-    substituteInPlace autocrap/Makefile.am \
-      --replace "command -p mv" "mv"
+    for f in Makefile.in autotools/Makefile.am libcperciva/cpusupport/Build/cpusupport.sh ; do
+      substituteInPlace $f --replace "command -p " ""
+    done
   '';
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "Encryption utility";
     homepage    = https://www.tarsnap.com/scrypt.html;
-    license     = stdenv.lib.licenses.bsd2;
-    platforms   = stdenv.lib.platforms.all;
-    maintainers = [ stdenv.lib.maintainers.thoughtpolice ];
+    license     = licenses.bsd2;
+    platforms   = platforms.all;
+    maintainers = with maintainers; [ thoughtpolice ];
   };
 }
diff --git a/pkgs/tools/security/sha1collisiondetection/default.nix b/pkgs/tools/security/sha1collisiondetection/default.nix
index de1796f431d3..38da14484147 100644
--- a/pkgs/tools/security/sha1collisiondetection/default.nix
+++ b/pkgs/tools/security/sha1collisiondetection/default.nix
@@ -1,15 +1,14 @@
 { stdenv, fetchFromGitHub, libtool, which }:
 
 stdenv.mkDerivation  rec {
-  pname = "sha1collisiondetection";
-  version = "1.0.1";
-  name = "${pname}-${version}";
+  name = "sha1collisiondetection-${version}";
+  version = "1.0.3";
 
   src = fetchFromGitHub {
     owner = "cr-marcstevens";
-    repo = pname;
-    rev = "development-v${version}";
-    sha256 = "09vd5mgclcdx7yq3kwzxy1z7pbxcp0xljfly7hy4ixahmnn290h6";
+    repo = "sha1collisiondetection";
+    rev = "stable-v${version}";
+    sha256 = "0xn31hkkqs0kj9203rzx6w4nr0lq8fnrlm5i76g0px3q4v2dzw1s";
   };
 
   makeFlags = [ "PREFIX=$(out)" ];
diff --git a/pkgs/tools/security/softhsm/default.nix b/pkgs/tools/security/softhsm/default.nix
index 42b6024fb214..6caf88973a61 100644
--- a/pkgs/tools/security/softhsm/default.nix
+++ b/pkgs/tools/security/softhsm/default.nix
@@ -3,11 +3,11 @@
 stdenv.mkDerivation rec {
 
   name = "softhsm-${version}";
-  version = "2.2.0";
+  version = "2.3.0";
 
   src = fetchurl {
     url = "https://dist.opendnssec.org/source/${name}.tar.gz";
-    sha256 = "1xw53zkv5xb9pxa8q84kh505yd6pkavxd12x2fjgqi6s12p2hsgb";
+    sha256 = "09y1ladg7j0j5n780b1hdzwd2g2b5j5c54pfs7bzjviskb409mjy";
   };
 
   configureFlags = [
diff --git a/pkgs/tools/security/sshguard/default.nix b/pkgs/tools/security/sshguard/default.nix
index bb165e53c73d..6db16c95fc88 100644
--- a/pkgs/tools/security/sshguard/default.nix
+++ b/pkgs/tools/security/sshguard/default.nix
@@ -1,13 +1,12 @@
 { stdenv, fetchurl, autoreconfHook, yacc, flex}:
 
-
 stdenv.mkDerivation rec {
-  version = "2.0.0";
+  version = "2.1.0";
   name = "sshguard-${version}";
 
   src = fetchurl {
-    url = "mirror://sourceforge/sshguard/sshguard-2.0.0.tar.gz";
-    sha256 = "e87c6c4a6dddf06f440ea76464eb6197869c0293f0a60ffa51f8a6a0d7b0cb06";
+    url = "mirror://sourceforge/sshguard/${name}.tar.gz";
+    sha256 = "12h2rx40lf3p3kgazmgakkgajjk2d3sdvr2f73ghi15d6i42l991";
   };
 
   doCheck = true;
@@ -16,8 +15,6 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--sysconfdir=/etc" ];
 
-  patches = [ ./0001-Remove-the-unnecessary-from-ipset-cmds.patch ];
-
   meta = with stdenv.lib; {
     description = "SSHGuard protects hosts from brute-force attacks";
     longDescription = ''
diff --git a/pkgs/tools/security/sshuttle/default.nix b/pkgs/tools/security/sshuttle/default.nix
index 2d663175ec9d..960d11521a74 100644
--- a/pkgs/tools/security/sshuttle/default.nix
+++ b/pkgs/tools/security/sshuttle/default.nix
@@ -1,6 +1,6 @@
 { stdenv, python3Packages, fetchurl, makeWrapper, pandoc
-, coreutils, iptables, nettools, openssh, procps }:
-  
+, coreutils, iptables, nettools, openssh, procps, fetchpatch }:
+
 python3Packages.buildPythonApplication rec {
   name = "sshuttle-${version}";
   version = "0.78.3";
@@ -10,7 +10,13 @@ python3Packages.buildPythonApplication rec {
     url = "mirror://pypi/s/sshuttle/${name}.tar.gz";
   };
 
-  patches = [ ./sudo.patch ];
+  patches = [
+    ./sudo.patch
+    (fetchpatch {
+      url = "https://github.com/sshuttle/sshuttle/commit/91aa6ff625f7c89a19e6f8702425cfead44a146f.patch";
+      sha256 = "0sqcc6kj53wlas2d3klbyilhns6vakzwbbp8y7j9wlmbnc530pks";
+    })
+  ];
 
   nativeBuildInputs = [ makeWrapper pandoc python3Packages.setuptools_scm ];
   buildInputs =
@@ -29,7 +35,7 @@ python3Packages.buildPythonApplication rec {
   wrapProgram $out/bin/sshuttle \
     --prefix PATH : "${mapPath (x: "${x}/bin") buildInputs}" \
   '';
-  
+
   meta = with stdenv.lib; {
     homepage = https://github.com/sshuttle/sshuttle/;
     description = "Transparent proxy server that works as a poor man's VPN";
diff --git a/pkgs/tools/security/stoken/default.nix b/pkgs/tools/security/stoken/default.nix
index 17652e220da6..464f6d215841 100644
--- a/pkgs/tools/security/stoken/default.nix
+++ b/pkgs/tools/security/stoken/default.nix
@@ -20,8 +20,10 @@ stdenv.mkDerivation rec {
     automake --add-missing --copy
     autoconf
   '';
+
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    autoconf automake libtool pkgconfig
+    autoconf automake libtool
     libxml2 nettle
   ] ++ stdenv.lib.optional withGTK3 gtk3;
 
diff --git a/pkgs/tools/security/sudo/default.nix b/pkgs/tools/security/sudo/default.nix
index 6f662206350f..1b32ad710071 100644
--- a/pkgs/tools/security/sudo/default.nix
+++ b/pkgs/tools/security/sudo/default.nix
@@ -1,6 +1,7 @@
-{ stdenv, fetchurl, coreutils, pam, groff
+{ stdenv, fetchurl, coreutils, pam, groff, sssd
 , sendmailPath ? "/run/wrappers/bin/sendmail"
 , withInsults ? false
+, withSssd ? false
 }:
 
 stdenv.mkDerivation rec {
@@ -30,6 +31,9 @@ stdenv.mkDerivation rec {
   ] ++ stdenv.lib.optional withInsults [
     "--with-insults"
     "--with-all-insults"
+  ] ++ stdenv.lib.optional withSssd [
+    "--with-sssd"
+    "--with-sssd-lib=${sssd}/lib"
   ];
 
   configureFlagsArray = [
diff --git a/pkgs/tools/security/sudolikeaboss/default.nix b/pkgs/tools/security/sudolikeaboss/default.nix
index 066fef39a82a..15f767415890 100644
--- a/pkgs/tools/security/sudolikeaboss/default.nix
+++ b/pkgs/tools/security/sudolikeaboss/default.nix
@@ -22,10 +22,6 @@ buildGoPackage rec {
     fixDarwinDylibNames
   ];
 
-  postInstall = ''
-    install_name_tool -delete_rpath $out/lib -add_rpath $bin $bin/bin/sudolikeaboss
-  '';
-
   meta = with stdenv.lib; {
     inherit version;
     inherit (src.meta) homepage;
diff --git a/pkgs/tools/security/tmin/default.nix b/pkgs/tools/security/tmin/default.nix
deleted file mode 100644
index 2c16e936a695..000000000000
--- a/pkgs/tools/security/tmin/default.nix
+++ /dev/null
@@ -1,24 +0,0 @@
-{ stdenv, fetchurl, bash }:
-
-stdenv.mkDerivation rec {
-  name    = "tmin-${version}";
-  version = "0.05";
-
-  src = fetchurl {
-    url    = "https://tmin.googlecode.com/files/${name}.tar.gz";
-    sha256 = "0166kcfs4b0da4hs2aqyn41f5l09i8rwxpi20k7x17qsxbmjbpd5";
-  };
-
-  buildPhase   = ''
-    gcc -O3 -funroll-loops -fno-strict-aliasing -Wno-pointer-sign tmin.c -o tmin
-  '';
-  installPhase = "mkdir -p $out/bin && mv tmin $out/bin";
-
-  meta = {
-    description = "Fuzzing tool test-case optimizer";
-    homepage    = "https://code.google.com/p/tmin";
-    license     = stdenv.lib.licenses.asl20;
-    platforms   = stdenv.lib.platforms.linux;
-    maintainers = [ stdenv.lib.maintainers.thoughtpolice ];
-  };
-}
diff --git a/pkgs/tools/security/tor/default.nix b/pkgs/tools/security/tor/default.nix
index 62438d1843bd..576189d9a85a 100644
--- a/pkgs/tools/security/tor/default.nix
+++ b/pkgs/tools/security/tor/default.nix
@@ -3,15 +3,17 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "tor-0.3.0.10";
+  name = "tor-0.3.1.8";
 
   src = fetchurl {
     url = "https://dist.torproject.org/${name}.tar.gz";
-    sha256 = "1cas30wk4bhcivi6l9dj7wwlz6pc2jj883x1vijax3b8l54nx3ls";
+    sha256 = "18dinpj03d036rashlad16lv7j2hba8gg742z07l37x5c242kxkx";
   };
 
   outputs = [ "out" "geoip" ];
 
+  enableParallelBuilding = true;
+
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ libevent openssl zlib ] ++
     stdenv.lib.optionals stdenv.isLinux [ libseccomp systemd libcap ];
diff --git a/pkgs/tools/security/tor/torsocks.nix b/pkgs/tools/security/tor/torsocks.nix
index 466dc4b4e46c..ebc567f54cea 100644
--- a/pkgs/tools/security/tor/torsocks.nix
+++ b/pkgs/tools/security/tor/torsocks.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description      = "Wrapper to safely torify applications";
-    homepage         = http://code.google.com/p/torsocks/;
+    homepage         = https://github.com/dgoulet/torsocks;
     repositories.git = https://git.torproject.org/torsocks.git;
     license          = stdenv.lib.licenses.gpl2;
     platforms        = stdenv.lib.platforms.unix;
diff --git a/pkgs/tools/security/tpm-luks/default.nix b/pkgs/tools/security/tpm-luks/default.nix
index 40829df56cae..7d0ff797336d 100644
--- a/pkgs/tools/security/tpm-luks/default.nix
+++ b/pkgs/tools/security/tpm-luks/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
     sha256 = "1ms2v57f13r9km6mvf9rha5ndmlmjvrz3mcikai6nzhpj0nrjz0w";
   };
 
-  buildInputs = [ autoreconfHook gawk trousers cryptsetup openssl ];
+  nativeBuildInputs = [ autoreconfHook ];
+  buildInputs = [ gawk trousers cryptsetup openssl ];
 
   installPhase = ''
     mkdir -p $out
diff --git a/pkgs/tools/security/tpm-tools/03-fix-bool-error-parseStringWithValues.patch b/pkgs/tools/security/tpm-tools/03-fix-bool-error-parseStringWithValues.patch
deleted file mode 100644
index 87f7b8e815b3..000000000000
--- a/pkgs/tools/security/tpm-tools/03-fix-bool-error-parseStringWithValues.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-Title: Fix boolean comparison error (and FTBFS with gcc-5)
-Date: 2015-06-28
-Author: Pierre Chifflier <pollux@debian.org>
-Bug-Debian: http://bugs.debian.org/778147
-Index: tpm-tools/src/tpm_mgmt/tpm_nvcommon.c
-===================================================================
---- tpm-tools.orig/src/tpm_mgmt/tpm_nvcommon.c
-+++ tpm-tools/src/tpm_mgmt/tpm_nvcommon.c
-@@ -140,8 +140,8 @@ int parseStringWithValues(const char *aA
-						 aArg);
-					return -1;
-				}
--				if (!aArg[offset+numbytes] == '|' &&
--				    !aArg[offset+numbytes] == 0) {
-+				if (!(aArg[offset+numbytes] == '|' ||
-+				      aArg[offset+numbytes] == 0)) {
-					logError(_("Illegal character following "
-                                                    "hexadecimal number in %s\n"),
-						 aArg + offset);
-@@ -164,8 +164,8 @@ int parseStringWithValues(const char *aA
-				return -1;
-			}
-
--			if (!aArg[offset+numbytes] == '|' &&
--			    !aArg[offset+numbytes] == 0) {
-+			if (!(aArg[offset+numbytes] == '|' ||
-+			      aArg[offset+numbytes] == 0)) {
-				logError(_("Illegal character following decimal "
-				           "number in %s\n"),
-					 aArg + offset);
diff --git a/pkgs/tools/security/tpm-tools/default.nix b/pkgs/tools/security/tpm-tools/default.nix
index 264beae9dc4b..8c68787db25f 100644
--- a/pkgs/tools/security/tpm-tools/default.nix
+++ b/pkgs/tools/security/tpm-tools/default.nix
@@ -1,19 +1,20 @@
-{ stdenv, fetchurl, trousers, openssl, opencryptoki }:
+{ stdenv, fetchurl, trousers, openssl, opencryptoki, perl }:
 
 let
-  version = "1.3.8";
+  version = "1.3.9.1";
 in
 stdenv.mkDerivation rec {
   name = "tpm-tools-${version}";
 
   src = fetchurl {
     url = "mirror://sourceforge/trousers/tpm-tools/${version}/${name}.tar.gz";
-    sha256 = "10za1gi89vi9m2lmm7jfzs281h55x1sbbm2bdgdh692ljpq4zsv6";
+    sha256 = "0s7srgghykxnlb1g4izabzf2gfb1knxc0nzn6bly49h8cpi19dww";
   };
 
-  buildInputs = [ trousers openssl opencryptoki ];
+  sourceRoot = ".";
 
-  patches = [ ./03-fix-bool-error-parseStringWithValues.patch ];
+  nativeBuildInputs = [ perl ];
+  buildInputs = [ trousers openssl opencryptoki ];
 
   meta = with stdenv.lib; {
     description = "Management tools for TPM hardware";
diff --git a/pkgs/tools/security/trousers/default.nix b/pkgs/tools/security/trousers/default.nix
index d57aa8c63a92..8309390d013b 100644
--- a/pkgs/tools/security/trousers/default.nix
+++ b/pkgs/tools/security/trousers/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "1lvnla1c1ig2w3xvvrqg2w9qm7a1ygzy1j2gg8j7p8c87i58x45v";
   };
 
-  buildInputs = [ openssl pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ openssl ];
 
   patches = [ ./allow-non-tss-config-file-owner.patch ];
 
@@ -29,7 +30,7 @@ stdenv.mkDerivation rec {
     homepage    = http://trousers.sourceforge.net/;
     license     = licenses.cpl10;
     maintainers = [ maintainers.ak ];
-    platforms   = platforms.unix;
+    platforms   = platforms.linux;
   };
 }
 
diff --git a/pkgs/tools/security/vault/default.nix b/pkgs/tools/security/vault/default.nix
index 9de6216ea594..bfb0dd11b8ed 100644
--- a/pkgs/tools/security/vault/default.nix
+++ b/pkgs/tools/security/vault/default.nix
@@ -9,23 +9,26 @@ let
   };
 in stdenv.mkDerivation rec {
   name = "vault-${version}";
-  version = "0.7.3";
+  version = "0.8.3";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = "vault";
     rev = "v${version}";
-    sha256 = "15wj1pfgzwzjfrqy7b5bx4y9f0hbpqlfif58l5xamwm88229qk4m";
+    sha256 = "1dcmqbcdkj42614am2invb6wf8v29z4sp4d354a4d83rwhyb0qly";
   };
 
   nativeBuildInputs = [ go gox removeReferencesTo ];
 
   buildPhase = ''
+    patchShebangs ./
     substituteInPlace scripts/build.sh --replace 'git rev-parse HEAD' 'echo ${src.rev}'
 
     mkdir -p src/github.com/hashicorp
     ln -s $(pwd) src/github.com/hashicorp/vault
 
+    mkdir -p .git/hooks
+
     GOPATH=$(pwd) make
   '';
 
diff --git a/pkgs/tools/security/vidalia/default.nix b/pkgs/tools/security/vidalia/default.nix
deleted file mode 100644
index fc1d98806f08..000000000000
--- a/pkgs/tools/security/vidalia/default.nix
+++ /dev/null
@@ -1,24 +0,0 @@
-{ stdenv, fetchurl, cmake, qt4, doxygen }:
-stdenv.mkDerivation rec {
-
-  name = "vidalia-${version}";
-  version = "0.3.1";
-
-  src = fetchurl {
-    url = "https://www.torproject.org/dist/vidalia/${name}.tar.gz";
-    sha256 = "1mw3wnlh18rj20qjv7jxjk3a8mf75p5wzv358qfs3sm3lqgd68qm";
-  };
-
-  buildInputs = [ cmake qt4 doxygen ];
-
-  patches = [ ./gcc-4.7.patch ];
-
-  meta = with stdenv.lib; {
-    homepage = https://www.torproject.org/projects/vidalia.html.en;
-    repositories.git = https://git.torproject.org/vidalia;
-    description = "A cross-platform graphical controller for the Tor software, built using the Qt framework";
-    license = licenses.gpl2Plus;
-    maintainers = [ maintainers.phreedom ];
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/tools/security/vidalia/gcc-4.7.patch b/pkgs/tools/security/vidalia/gcc-4.7.patch
deleted file mode 100644
index 4c163af760c6..000000000000
--- a/pkgs/tools/security/vidalia/gcc-4.7.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff -ru vidalia-0.3.1_orig/src/vidalia/plugin/PluginEngine.cpp vidalia-0.3.1/src/vidalia/plugin/PluginEngine.cpp
---- vidalia-0.3.1_orig/src/vidalia/plugin/PluginEngine.cpp	2012-08-08 18:02:01.901732270 +0200
-+++ vidalia-0.3.1/src/vidalia/plugin/PluginEngine.cpp	2012-08-08 18:03:26.241677875 +0200
-@@ -20,6 +20,8 @@
- 
- #include "Vidalia.h"
- 
-+#include <unistd.h>
-+
- PluginEngine::PluginEngine(QObject *parent)
-   : QScriptEngine(parent)
- {
diff --git a/pkgs/tools/security/vulnix/default.nix b/pkgs/tools/security/vulnix/default.nix
index 1beb2268fc6c..c86891d8ccd8 100644
--- a/pkgs/tools/security/vulnix/default.nix
+++ b/pkgs/tools/security/vulnix/default.nix
@@ -3,19 +3,15 @@
 pythonPackages.buildPythonApplication rec {
   name = "${pname}-${version}";
   pname = "vulnix";
-  version = "1.2.2";
+  version = "1.3.4";
 
   src = pythonPackages.fetchPypi {
     inherit pname version;
-    sha256 = "1ia9plziwach0bxnlcd33q30kcsf8sv0nf2jc78gsmrqnxjabr12";
+    sha256 = "1js1i86pgkkqc9yzp1rck7rmaz79klv4048r9z7v56fam0a6sg05";
   };
 
   buildInputs = with pythonPackages; [ flake8 pytest pytestcov ];
 
-  postPatch = ''
-    sed -i -e 's/==\([^=]\+\)/>=\1/g' setup.py
-  '';
-
   propagatedBuildInputs = [
     nix
   ] ++ (with pythonPackages; [
@@ -27,12 +23,16 @@ pythonPackages.buildPythonApplication rec {
     zodb
   ]);
 
+  postPatch = ''
+    sed -i -e 's/==\([^=]\+\)/>=\1/g' setup.py
+  '';
+
   checkPhase = "py.test";
 
   meta = with stdenv.lib; {
     description = "NixOS vulnerability scanner";
     homepage = https://github.com/flyingcircusio/vulnix;
     license = licenses.bsd2;
-    maintainers = with maintainers; [ plumps ];
+    maintainers = with maintainers; [ ckauhaus plumps ];
   };
 }
diff --git a/pkgs/tools/security/yara/default.nix b/pkgs/tools/security/yara/default.nix
index 21e5c3ffcef4..7423c2d435bf 100644
--- a/pkgs/tools/security/yara/default.nix
+++ b/pkgs/tools/security/yara/default.nix
@@ -5,32 +5,28 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "3.6.0";
+  version = "3.6.3";
   name = "yara-${version}";
 
   src = fetchFromGitHub {
     owner = "VirusTotal";
     repo = "yara";
     rev = "v${version}";
-    sha256 = "05nadqpvihdyxym11mn6n02rzv2ng8ga7j9l0g5gnjx366gcai42";
+    sha256 = "13znbdwin9lvql43wpms5hh13h8rk5x5wajgmphz18rxwp8h7j78";
   };
 
   # FIXME: this is probably not the right way to make it work
   # make[2]: *** No rule to make target 'libyara/.libs/libyara.a', needed by 'yara'.  Stop.
-  dynamic_library_extension = ""
-    + stdenv.lib.optionalString stdenv.isLinux "so"
-    + stdenv.lib.optionalString stdenv.isDarwin "dylib"
-  ;
   prePatch = ''
     cat >staticlibrary.patch <<EOF
     --- a/Makefile.am 2015-11-01 11:39:12.000000000 +0100
     +++ b/Makefile.am 2015-11-01 11:45:32.000000000 +0100
     @@ -12 +12 @@
     -yara_LDADD = libyara/.libs/libyara.a
-    +yara_LDADD = libyara/.libs/libyara.${dynamic_library_extension}
+    +yara_LDADD = libyara/.libs/libyara${stdenv.hostPlatform.extensions.sharedLibrary}
     @@ -15 +15 @@
     -yarac_LDADD = libyara/.libs/libyara.a
-    +yarac_LDADD = libyara/.libs/libyara.${dynamic_library_extension}
+    +yarac_LDADD = libyara/.libs/libyara${stdenv.hostPlatform.extensions.sharedLibrary}
     EOF
   '';
   patches = [
diff --git a/pkgs/tools/system/amtterm/default.nix b/pkgs/tools/system/amtterm/default.nix
index a4c29cd6a299..a31fdd08c60d 100644
--- a/pkgs/tools/system/amtterm/default.nix
+++ b/pkgs/tools/system/amtterm/default.nix
@@ -4,7 +4,7 @@
 stdenv.mkDerivation rec {
   name = "amtterm-${version}";
   version = "1.6-1";
-  
+
   buildInputs = with perlPackages; [ perl SOAPLite ];
   nativeBuildInputs = [ makeWrapper ];
 
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     sha256 = "1jxcsqkag2bxmrnr4m6g88sln1j2d9liqlna57fj8kkc85316vlc";
   };
 
-  makeFlags = [ "prefix=$(out)" ];
+  makeFlags = [ "prefix=$(out)" "STRIP=" ];
 
   postInstall =
     "wrapProgram $out/bin/amttool --prefix PERL5LIB : $PERL5LIB";
diff --git a/pkgs/tools/system/at/default.nix b/pkgs/tools/system/at/default.nix
index 4c1a5431f3eb..cc4ccdd40f09 100644
--- a/pkgs/tools/system/at/default.nix
+++ b/pkgs/tools/system/at/default.nix
@@ -1,12 +1,16 @@
-{ fetchurl, stdenv, bison, flex, pam, sendmailPath ? "/run/wrappers/bin/sendmail" }:
+{ fetchurl, stdenv, bison, flex, pam
+, sendmailPath ? "/run/wrappers/bin/sendmail"
+, atWrapperPath ? "/run/wrappers/bin/at"
+}:
 
-stdenv.mkDerivation {
-  name = "at-3.1.16";
+stdenv.mkDerivation rec {
+  name = "at-${version}";
+  version = "3.1.20";
 
   src = fetchurl {
     # Debian is apparently the last location where it can be found.
-    url = mirror://debian/pool/main/a/at/at_3.1.16.orig.tar.gz;
-    sha256 = "1hfmnhgi95vsfaa69qlakpwd22al0m0rhqms6sawxvaldafgb6nb";
+    url = "mirror://debian/pool/main/a/at/at_${version}.orig.tar.gz";
+    sha256 = "1fgsrqpx0r6qcjxmlsqnwilydhfxn976c870mjc0n1bkmcy94w88";
   };
 
   patches = [ ./install.patch ];
@@ -29,6 +33,13 @@ stdenv.mkDerivation {
        --with-daemon_username=atd --with-daemon_groupname=atd
     '';
 
+  # Ensure that "batch" can invoke the setuid "at" wrapper, if it exists, or
+  # else we get permission errors (on NixOS). "batch" is a shell script, so
+  # when the kernel executes it it drops setuid perms.
+  postInstall = ''
+    sed -i "6i test -x ${atWrapperPath} && exec ${atWrapperPath} -qb now  # exec doesn't return" "$out/bin/batch"
+  '';
+
   meta = {
     description = ''The classical Unix `at' job scheduling command'';
     license = stdenv.lib.licenses.gpl2Plus;
diff --git a/pkgs/tools/system/augeas/default.nix b/pkgs/tools/system/augeas/default.nix
index e3f743766140..fb1806b850e1 100644
--- a/pkgs/tools/system/augeas/default.nix
+++ b/pkgs/tools/system/augeas/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "augeas-${version}";
-  version = "1.8.0";
+  version = "1.8.1";
 
   src = fetchurl {
     url = "http://download.augeas.net/${name}.tar.gz";
-    sha256 = "1iac5lwi1q10r343ii9v5p2fdplvh06yv9svsi8zz6cd2c2fjp2i";
+    sha256 = "1yf93fqwav1zsl8dpyfkf0g11w05mmfckqy6qsjy5zkklnspbkv5";
   };
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ readline libxml2 ];
diff --git a/pkgs/tools/system/bootchart/default.nix b/pkgs/tools/system/bootchart/default.nix
index 34da8d400811..f99d22becdb8 100644
--- a/pkgs/tools/system/bootchart/default.nix
+++ b/pkgs/tools/system/bootchart/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "1abn4amsyys6vwn7csxsxny94n24ycca3xhqxqcmdc4j0dzn3kmb";
   };
 
-  buildInputs = [ pkgconfig glib gtk2 python2Packages.python python2Packages.wrapPython python2Packages.pygtk ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ glib gtk2 python2Packages.python python2Packages.wrapPython python2Packages.pygtk ];
   pythonPath = with python2Packages; [ pygtk pycairo ];
 
   installPhase = ''
diff --git a/pkgs/tools/system/chase/default.nix b/pkgs/tools/system/chase/default.nix
index e1c163f41709..6dcaeed325ae 100644
--- a/pkgs/tools/system/chase/default.nix
+++ b/pkgs/tools/system/chase/default.nix
@@ -4,7 +4,8 @@ stdenv.mkDerivation rec {
   name = "chase-${version}";
   version = "0.5.2";
 
-  buildInputs = [ pkgconfig libatomic_ops boehmgc ] ;
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libatomic_ops boehmgc ] ;
   src = fetchurl {
     url = "mirror://debian/pool/main/c/chase/chase_${version}.orig.tar.gz";
     sha256 = "68d95c2d4dc45553b75790fcea4413b7204a2618dff148116ca9bdb0310d737f";
diff --git a/pkgs/tools/system/collectd/default.nix b/pkgs/tools/system/collectd/default.nix
index 824eb74b72e5..ddfd8cbbc01f 100644
--- a/pkgs/tools/system/collectd/default.nix
+++ b/pkgs/tools/system/collectd/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl
+{ stdenv, fetchurl, darwin
 # optional:
 , pkgconfig ? null  # most of the extra deps need pkgconfig to be found
 , curl ? null
@@ -43,17 +43,27 @@ stdenv.mkDerivation rec {
     sha256 = "14p5cc3ys3qfg71xzxfvmxdmz5l4brpbhlmw1fwdda392lia084x";
   };
 
+  # on 5.7.2: lvm2app.h:21:2: error: #warning "liblvm2app is deprecated, use D-Bus API instead." [-Werror=cpp]
+  NIX_CFLAGS_COMPILE = "-Wno-error=cpp";
+
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    pkgconfig curl iptables libatasmart libcredis libdbi libgcrypt libmemcached
-    cyrus_sasl libmodbus libnotify gdk_pixbuf liboping libpcap libsigrok libvirt
-    lm_sensors libxml2 lvm2 libmysql postgresql protobufc rabbitmq-c rrdtool
-    varnish yajl jdk libtool python udev net_snmp hiredis libmnl libmicrohttpd
+    curl libdbi libgcrypt libmemcached
+    cyrus_sasl libnotify gdk_pixbuf liboping libpcap libvirt
+    libxml2 libmysql postgresql protobufc rrdtool
+    varnish yajl jdk libtool python hiredis libmicrohttpd
+  ] ++ stdenv.lib.optionals stdenv.isLinux [
+    iptables libatasmart libcredis libmodbus libsigrok
+    lm_sensors lvm2 rabbitmq-c udev net_snmp libmnl
+  ] ++ stdenv.lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.IOKit
+    darwin.apple_sdk.frameworks.ApplicationServices
   ];
 
   # for some reason libsigrok isn't auto-detected
   configureFlags =
     [ "--localstatedir=/var" ] ++
-    stdenv.lib.optional (libsigrok != null) "--with-libsigrok" ++
+    stdenv.lib.optional (stdenv.isLinux && libsigrok != null) "--with-libsigrok" ++
     stdenv.lib.optional (python != null) "--with-python=${python}/bin/python";
 
   # do not create directories in /var during installPhase
@@ -71,7 +81,7 @@ stdenv.mkDerivation rec {
     description = "Daemon which collects system performance statistics periodically";
     homepage = https://collectd.org;
     license = licenses.gpl2;
-    platforms = platforms.linux;
+    platforms = platforms.unix;
     maintainers = with maintainers; [ bjornfor fpletz ];
   };
 }
diff --git a/pkgs/tools/system/das_watchdog/default.nix b/pkgs/tools/system/das_watchdog/default.nix
index fbca63b0e0a3..bcea40b1193f 100644
--- a/pkgs/tools/system/das_watchdog/default.nix
+++ b/pkgs/tools/system/das_watchdog/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
     sha256 = "02y1vfb3wh4908xjj1kpyf8kgxk29x8dw7yl3pnl220qz2gi99vr";
   };
 
-  buildInputs = [ libgtop xmessage which pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libgtop xmessage which ];
 
   installPhase = ''
     mkdir -p $out/bin/
diff --git a/pkgs/tools/system/datefudge/default.nix b/pkgs/tools/system/datefudge/default.nix
index 13c2938f63bc..2c2d778697a4 100644
--- a/pkgs/tools/system/datefudge/default.nix
+++ b/pkgs/tools/system/datefudge/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "datefudge";
-  version = "1.2.1";
+  version = "1.22";
   name = "${pname}-${version}";
 
   src = fetchgit {
-    sha256 = "0l83kn6c3jr3wzs880zfa64rw81cqjjk55gjxz71rjf2balp64ps";
+    sha256 = "1fmd05r00wx4zc90lbi804jl7xwdl11jq2a1kp5lqimk3yyvfw4c";
     url = "git://anonscm.debian.org/users/robert/datefudge.git";
-    rev = "cd141c63bebe9b579109b2232b5e83db18f222c2";
+    rev = "fe27db47a0f250fb56164114fff8ae8d5af47ab6";
   };
 
   patchPhase = ''
diff --git a/pkgs/tools/system/dd_rescue/default.nix b/pkgs/tools/system/dd_rescue/default.nix
index 69cd8da4aefe..ee82af1a4707 100644
--- a/pkgs/tools/system/dd_rescue/default.nix
+++ b/pkgs/tools/system/dd_rescue/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, autoconf }:
 
 stdenv.mkDerivation rec {
-  version = "1.99.5";
+  version = "1.99.7";
   name = "dd_rescue-${version}";
 
   src = fetchurl {
-    sha256 = "0db94piwcdyqhnlhgfs0bfp0gp2mqyrcr2l5nljapgni31qk4p8j";
+    sha256 = "0d318i1i5d7hbj06wmb3xag14x542cv7fpkh5zjf5ccm64nyzir4";
     url="http://www.garloff.de/kurt/linux/ddrescue/${name}.tar.bz2";
   };
 
diff --git a/pkgs/tools/system/evemu/default.nix b/pkgs/tools/system/evemu/default.nix
index 873abd4812cb..b6f1af7b23fe 100644
--- a/pkgs/tools/system/evemu/default.nix
+++ b/pkgs/tools/system/evemu/default.nix
@@ -4,14 +4,14 @@
 
 stdenv.mkDerivation rec {
   name = "evemu-${version}";
-  version = "2.4.0";
+  version = "2.6.0";
 
   # We could have downloaded a release tarball from cgit, but it changes hash
   # each time it is downloaded :/
   src = fetchgit {
     url = git://git.freedesktop.org/git/evemu;
     rev = "refs/tags/v${version}";
-    sha256 = "07iha13xrpf4z59rzl9cm2h1zkc5xhyipbd3ajd3c1d4hhpn9w9s";
+    sha256 = "1m38fxwy2s82vb2qm9aqxinws12akmqqq7q66is931lc3awqkbah";
   };
 
   nativeBuildInputs = [ pkgconfig autoreconfHook ];
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "Records and replays device descriptions and events to emulate input devices through the kernel's input system";
-    homepage = http://www.freedesktop.org/wiki/Evemu/;
+    homepage = https://www.freedesktop.org/wiki/Evemu/;
     repositories.git = git://git.freedesktop.org/git/evemu;
     license = licenses.gpl2;
     maintainers = [ maintainers.amorsillo ];
diff --git a/pkgs/tools/system/facter/default.nix b/pkgs/tools/system/facter/default.nix
index 56ac33ba23c6..b74f99484184 100644
--- a/pkgs/tools/system/facter/default.nix
+++ b/pkgs/tools/system/facter/default.nix
@@ -1,11 +1,11 @@
-{ stdenv, fetchFromGitHub, boost, cmake, cpp-hocon, curl, leatherman, libyamlcpp, openssl, ruby, utillinux }:
+{ stdenv, fetchFromGitHub, boost, cmake, cpp-hocon, curl, leatherman, libwhereami, libyamlcpp, openssl, ruby, utillinux }:
 
 stdenv.mkDerivation rec {
   name = "facter-${version}";
-  version = "3.7.1";
+  version = "3.9.0";
 
   src = fetchFromGitHub {
-    sha256 = "0v5g7qlqqixgvc2hf9440a8sfh8jvgzynwk5ipcb505hi00ddq7a";
+    sha256 = "1picxrmvka57ph4zqgwqdsqvz3mqppg41wkj8dx37hscwwlbdw0s";
     rev = version;
     repo = "facter";
     owner = "puppetlabs";
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   # since we cant expand $out in cmakeFlags
   preConfigure = "cmakeFlags+=\" -DRUBY_LIB_INSTALL=$out/lib/ruby\"";
 
-  buildInputs = [ boost cmake cpp-hocon curl leatherman libyamlcpp openssl ruby utillinux ];
+  buildInputs = [ boost cmake cpp-hocon curl leatherman libwhereami libyamlcpp openssl ruby utillinux ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/tools/system/fakechroot/default.nix b/pkgs/tools/system/fakechroot/default.nix
index be3a32de251f..25470af9bb30 100644
--- a/pkgs/tools/system/fakechroot/default.nix
+++ b/pkgs/tools/system/fakechroot/default.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation rec {
     sha256 = "1ls3y97qqfcfd3z0balz94xq1gskfk04pg85x6b7wjw8dm4030qd";
   };
 
-  buildInputs = [ autoreconfHook perl ];
+  nativeBuildInputs = [ autoreconfHook ];
+  buildInputs = [ perl ];
 
   meta = with stdenv.lib; {
     homepage = https://github.com/dex4er/fakechroot;
diff --git a/pkgs/tools/system/fio/default.nix b/pkgs/tools/system/fio/default.nix
index e0c3fdfeec51..807169a58f02 100644
--- a/pkgs/tools/system/fio/default.nix
+++ b/pkgs/tools/system/fio/default.nix
@@ -1,8 +1,8 @@
 { stdenv, fetchFromGitHub, libaio, python, zlib }:
 
 let
-  version = "2.99";
-  sha256 = "0fj8fk2w06ahcn35z8pj88sx12yrx1yfd38j6k5aigj4dfj3f3zy";
+  version = "3.1";
+  sha256 = "09rsfhzpi089cwpg07c8kgvs4d2n77a7mn1vj8iwjjzacs3fbllx";
 in
 
 stdenv.mkDerivation rec {
diff --git a/pkgs/tools/system/gdmap/default.nix b/pkgs/tools/system/gdmap/default.nix
index 1d33e5fb09fe..72938216b0a4 100644
--- a/pkgs/tools/system/gdmap/default.nix
+++ b/pkgs/tools/system/gdmap/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "0nr8l88cg19zj585hczj8v73yh21k7j13xivhlzl8jdk0j0cj052";
   };
 
-  buildInputs = [ gtk2 pkgconfig libxml2 intltool gettext ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ gtk2 libxml2 intltool gettext ];
 
   patches = [ ./get_sensitive.patch ./set_flags.patch ];
 
@@ -18,7 +19,7 @@ stdenv.mkDerivation rec {
     homepage = http://gdmap.sourceforge.net;
     description = "Recursive rectangle map of disk usage";
     license = licenses.gpl2;
-    platforms = platforms.all;
+    platforms = platforms.linux;
     maintainers = [ maintainers.bjornfor ];
   };
 }
diff --git a/pkgs/tools/system/gptfdisk/default.nix b/pkgs/tools/system/gptfdisk/default.nix
index 0b034819651d..f5ab6276c818 100644
--- a/pkgs/tools/system/gptfdisk/default.nix
+++ b/pkgs/tools/system/gptfdisk/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "gptfdisk-${version}";
-  version = "1.0.1";
+  version = "1.0.3";
 
   src = fetchurl {
     # http://www.rodsbooks.com/gdisk/${name}.tar.gz also works, but the home
     # page clearly implies a preference for using SourceForge's bandwidth:
     url = "mirror://sourceforge/gptfdisk/${name}.tar.gz";
-    sha256 = "1izazbyv5n2d81qdym77i8mg9m870hiydmq4d0s51npx5vp8lk46";
+    sha256 = "0p0vr67lnqdsgdv2y144xmjqa1a2nijrrd3clc8dc2f46pn5mzc9";
   };
 
   patchPhase = stdenv.lib.optionalString stdenv.isDarwin ''
diff --git a/pkgs/tools/system/hardinfo/default.nix b/pkgs/tools/system/hardinfo/default.nix
index 11236b7a9d10..a2bffab3a981 100644
--- a/pkgs/tools/system/hardinfo/default.nix
+++ b/pkgs/tools/system/hardinfo/default.nix
@@ -13,7 +13,8 @@ stdenv.mkDerivation rec {
 
   # Not adding 'hostname' command, the build shouldn't depend on what the build
   # host is called.
-  buildInputs = [ which pkgconfig gtk2 pcre glib libxml2 libsoup ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ which gtk2 pcre glib libxml2 libsoup ];
 
   # Fixes '#error You must compile this program without "-O"'
   hardeningDisable = [ "all" ];
diff --git a/pkgs/tools/system/hardlink/default.nix b/pkgs/tools/system/hardlink/default.nix
index b85ad32ca37c..ea062115402d 100644
--- a/pkgs/tools/system/hardlink/default.nix
+++ b/pkgs/tools/system/hardlink/default.nix
@@ -1,29 +1,33 @@
-{ fetchurl, stdenv, unzip }:
+{ stdenv, fetchurl, pcre2 }:
 
-let
-  rev = "3ec908d539";
-in
-stdenv.mkDerivation {
-  name = "hardlink-2012.9.${rev}";
+
+stdenv.mkDerivation rec {
+  name = "hardlink-${version}";
+  version = "1.3-4";
 
   src = fetchurl {
-    url = "http://pkgs.fedoraproject.org/cgit/hardlink.git/snapshot/hardlink-${rev}.zip";
-    sha256 = "fea1803170b538d5fecf6a8d312ded1d25d516e9386a3797441a247487551647";
-    name = "hardlink-${rev}.zip";
+    url = "http://pkgs.fedoraproject.org/cgit/rpms/hardlink.git/snapshot/hardlink-aa6325ac4e8100b8ac7d38c7f0bc2708e69bd855.tar.xz";
+    sha256 = "0g4hyrnd9hpykbf06qvvp3s4yyk7flbd95gilkf7r3w9vqiagvs2";
   };
 
+  buildInputs = [ pcre2 ];
+  NIX_CFLAGS_LINK = "-lpcre2-8";
+
+  buildPhase = ''
+    $CC -O2 hardlink.c -o hardlink $NIX_CFLAGS_LINK
+  '';
+
   installPhase = ''
     mkdir -p $out/bin $out/share/man/man1
-    cc -O2 hardlink.c -o $out/bin/hardlink
-    mv hardlink.1 $out/share/man/man1/hardlink.1
+    cp -f hardlink $out/bin/hardlink
+    cp -f hardlink.1 $out/share/man/man1/hardlink.1
   '';
 
-  buildInputs = [ unzip ];
-
-  meta = {
-    homepage = http://pkgs.fedoraproject.org/cgit/hardlink.git/;
+  meta = with stdenv.lib; {
     description = "Consolidate duplicate files via hardlinks";
-    license = stdenv.lib.licenses.gpl2Plus;
-    platforms = stdenv.lib.platforms.unix;
+    homepage = https://pagure.io/hardlink;
+    repositories.git = http://pkgs.fedoraproject.org/cgit/rpms/hardlink.git;
+    license = licenses.gpl2Plus;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/tools/system/illum/default.nix b/pkgs/tools/system/illum/default.nix
index 4cdfeec12b79..03373300a948 100644
--- a/pkgs/tools/system/illum/default.nix
+++ b/pkgs/tools/system/illum/default.nix
@@ -11,16 +11,13 @@ stdenv.mkDerivation rec {
     sha256 = "05v3hz7n6b1mlhc6zqijblh1vpl0ja1y8y0lafw7mjdz03wxhfdb";
   };
 
-  buildInputs = [ pkgconfig ninja libevdev libev ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ ninja libevdev libev ];
 
   configurePhase = ''
     bash ./configure
   '';
 
-  buildPhase = ''
-    ninja
-  '';
-
   installPhase = ''
     mkdir -p $out/bin
     mv illum-d $out/bin
diff --git a/pkgs/tools/system/ipmiutil/default.nix b/pkgs/tools/system/ipmiutil/default.nix
index 90feb381ae57..ae8a1b449374 100644
--- a/pkgs/tools/system/ipmiutil/default.nix
+++ b/pkgs/tools/system/ipmiutil/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   baseName = "ipmiutil";
-  version = "3.0.5";
+  version = "3.0.7";
   name = "${baseName}-${version}";
 
   src = fetchurl {
     url = "mirror://sourceforge/project/${baseName}/${name}.tar.gz";
-    sha256 = "0ppfxh04c0aj9dxpkzj3xv1kylc17k1kvqabp8r7h70k6ljzgmxj";
+    sha256 = "0bsl4czbwmz1f42b15y0fabys50bbfll4z73nm9xk161i2njzz6y";
   };
 
   buildInputs = [ openssl ];
diff --git a/pkgs/tools/system/journalbeat/default.nix b/pkgs/tools/system/journalbeat/default.nix
index de4687a6a57f..b914ffaa0cb6 100644
--- a/pkgs/tools/system/journalbeat/default.nix
+++ b/pkgs/tools/system/journalbeat/default.nix
@@ -7,7 +7,7 @@ let
 in buildGoPackage rec {
 
   name = "journalbeat-${version}";
-  version = "5.5.0";
+  version = "5.6.0";
 
   goPackagePath = "github.com/mheese/journalbeat";
 
@@ -15,6 +15,7 @@ in buildGoPackage rec {
 
   postInstall = ''
     wrapProgram $bin/bin/journalbeat \
+      --argv0 journalbeat \
       --prefix LD_LIBRARY_PATH : ${libPath}
   '';
 
@@ -22,7 +23,7 @@ in buildGoPackage rec {
     owner = "mheese";
     repo = "journalbeat";
     rev = "v${version}";
-    sha256 = "134n1kg6nx5yycn2cyldiayaqm8zps94hz4zfz9klp2jzq68m35y";
+    sha256 = "0b5yqzw1h945mwwyy7cza6bc7kzv3x1p9w2xkzmvr7rw3pd32r06";
   };
 
   meta = with lib; {
diff --git a/pkgs/tools/system/lr/default.nix b/pkgs/tools/system/lr/default.nix
index 5510ec0e9486..d638a1c16b5d 100644
--- a/pkgs/tools/system/lr/default.nix
+++ b/pkgs/tools/system/lr/default.nix
@@ -2,22 +2,22 @@
 
 stdenv.mkDerivation rec {
   name = "lr-${version}";
-  version = "0.4";
+  version = "1.1";
 
   src = fetchFromGitHub {
     owner = "chneukirchen";
     repo = "lr";
     rev = "v${version}";
-    sha256 = "16qp0791s652yi86x472wwr62w6nhiyb1i662d85y5zyfagdf7dd";
+    sha256 = "171h353238s9wmhirvs2yc1151vds83a71p7wgn96wa3jpl248by";
   };
 
   makeFlags = "PREFIX=$(out)";
 
-  meta = {
-    homepage = http://github.com/chneukirchen/lr;
+  meta = with stdenv.lib; {
+    homepage = https://github.com/chneukirchen/lr;
     description = "List files recursively";
-    license = stdenv.lib.licenses.mit;
-    platforms = stdenv.lib.platforms.all;
-    maintainers = [ stdenv.lib.maintainers.globin ];
+    license = licenses.mit;
+    platforms = platforms.all;
+    maintainers = [ maintainers.globin ];
   };
 }
diff --git a/pkgs/tools/system/lshw/default.nix b/pkgs/tools/system/lshw/default.nix
index dc5b75b0f4a2..499f7c461546 100644
--- a/pkgs/tools/system/lshw/default.nix
+++ b/pkgs/tools/system/lshw/default.nix
@@ -19,7 +19,15 @@ stdenv.mkDerivation rec {
     sha256 = "147wyr5m185f8swsmb4q1ahs9r1rycapbpa2548aqbv298bbish3";
   })];
 
-  buildInputs = lib.optionals withGUI [ gtk2 pkgconfig sqlite ];
+  nativeBuildInputs = [ pkgconfig ];
+
+  buildInputs = lib.optionals withGUI [ gtk2 sqlite ];
+
+  # Fix version info.
+  preConfigure = ''
+    sed -e "s/return \"unknown\"/return \"${version}\"/" \
+        -i src/core/version.cc
+  '';
 
   makeFlags = [ "PREFIX=$(out)" ];
 
diff --git a/pkgs/tools/system/netdata/default.nix b/pkgs/tools/system/netdata/default.nix
index df04ef48730d..ed177820b644 100644
--- a/pkgs/tools/system/netdata/default.nix
+++ b/pkgs/tools/system/netdata/default.nix
@@ -1,17 +1,18 @@
 { stdenv, fetchFromGitHub, autoreconfHook, zlib, pkgconfig, libuuid }:
 
 stdenv.mkDerivation rec{
-  version = "1.5.0";
+  version = "1.7.0";
   name = "netdata-${version}";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "firehol";
     repo = "netdata";
-    sha256 = "1nsv0s11ai1kvig9xr4cz2f2lalvilpbfjpd8fdfqk9fak690zhz";
+    sha256 = "1fv01jnbgwbafsxavlji90zdqizn8m4nfg9ivc4sbi05j036bg6n";
   };
 
-  buildInputs = [ autoreconfHook zlib pkgconfig libuuid ];
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  buildInputs = [ zlib libuuid ];
 
   # Allow UI to load when running as non-root
   patches = [ ./web_access.patch ];
diff --git a/pkgs/tools/system/netdata/web_access.patch b/pkgs/tools/system/netdata/web_access.patch
index f1e4bd64cbb5..ae4d29185de4 100644
--- a/pkgs/tools/system/netdata/web_access.patch
+++ b/pkgs/tools/system/netdata/web_access.patch
@@ -1,7 +1,7 @@
 --- a/src/web_client.c.orig
 +++ b/src/web_client.c
-@@ -331,7 +331,7 @@
-         buffer_sprintf(w->response.data, "File '%s' does not exist, or is not accessible.", webfilename);
+@@ -302,7 +302,7 @@
+         buffer_strcat_htmlescape(w->response.data, webfilename);
          return 404;
      }
 -
@@ -9,8 +9,8 @@
      // check if the file is owned by expected user
      if(stat.st_uid != web_files_uid()) {
          error("%llu: File '%s' is owned by user %u (expected user %u). Access Denied.", w->id, webfilename, stat.st_uid, web_files_uid());
-@@ -345,7 +345,7 @@
-         buffer_sprintf(w->response.data, "Access to file '%s' is not permitted.", webfilename);
+@@ -320,7 +320,7 @@
+         buffer_strcat_htmlescape(w->response.data, webfilename);
          return 403;
      }
 -
diff --git a/pkgs/tools/system/pciutils/default.nix b/pkgs/tools/system/pciutils/default.nix
index 8a4fe6cb3cff..7508b4fc56c4 100644
--- a/pkgs/tools/system/pciutils/default.nix
+++ b/pkgs/tools/system/pciutils/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "1d62f8fa192f90e61c35a6fc15ff3cb9a7a792f782407acc42ef67817c5939f5";
   };
 
-  buildInputs = [ pkgconfig zlib kmod which ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ zlib kmod which ];
 
   makeFlags = "SHARED=yes PREFIX=\${out}";
 
diff --git a/pkgs/tools/system/procodile/Gemfile b/pkgs/tools/system/procodile/Gemfile
new file mode 100644
index 000000000000..77e4bb430e96
--- /dev/null
+++ b/pkgs/tools/system/procodile/Gemfile
@@ -0,0 +1,2 @@
+source 'https://rubygems.org'
+gem 'procodile'
diff --git a/pkgs/tools/system/procodile/Gemfile.lock b/pkgs/tools/system/procodile/Gemfile.lock
new file mode 100644
index 000000000000..51ab44a762ab
--- /dev/null
+++ b/pkgs/tools/system/procodile/Gemfile.lock
@@ -0,0 +1,15 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    json (2.1.0)
+    procodile (1.0.17)
+      json
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  procodile
+
+BUNDLED WITH
+   1.14.6
diff --git a/pkgs/tools/system/procodile/default.nix b/pkgs/tools/system/procodile/default.nix
new file mode 100644
index 000000000000..3a5cb1b4965d
--- /dev/null
+++ b/pkgs/tools/system/procodile/default.nix
@@ -0,0 +1,22 @@
+{ lib, bundlerEnv, ruby, stdenv }:
+
+bundlerEnv rec {
+  name = "procodile-${version}";
+
+  gemfile = ./Gemfile;
+  lockfile = ./Gemfile.lock;
+  gemset = ./gemset.nix;
+
+  version = (import gemset).procodile.version;
+  inherit ruby;
+
+  gemdir = ./.;
+
+  meta = with lib; {
+    description = "Run processes in the background (and foreground) on Mac & Linux from a Procfile (for production and/or development environments)";
+    homepage    = https://adam.ac/procodile;
+    license     = with licenses; mit;
+    maintainers = [ maintainers.ravloony ];
+    platforms   = platforms.unix;
+  };
+}
diff --git a/pkgs/tools/system/procodile/gemset.nix b/pkgs/tools/system/procodile/gemset.nix
new file mode 100644
index 000000000000..8216159ad940
--- /dev/null
+++ b/pkgs/tools/system/procodile/gemset.nix
@@ -0,0 +1,19 @@
+{
+  json = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "01v6jjpvh3gnq6sgllpfqahlgxzj50ailwhj9b3cd20hi2dx0vxp";
+      type = "gem";
+    };
+    version = "2.1.0";
+  };
+  procodile = {
+    dependencies = ["json"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1gfms2h4k9zqq7jn04nphibcsjykgxiqwdyyz2r4kq428a25kqsf";
+      type = "gem";
+    };
+    version = "1.0.17";
+  };
+}
\ No newline at end of file
diff --git a/pkgs/tools/system/proot/default.nix b/pkgs/tools/system/proot/default.nix
index 87c463bdac9a..8cf7f81381ff 100644
--- a/pkgs/tools/system/proot/default.nix
+++ b/pkgs/tools/system/proot/default.nix
@@ -1,13 +1,13 @@
-{ stdenv, fetchFromGitHub, talloc, docutils
-, enableStatic ? false }:
+{ stdenv, fetchFromGitHub, fetchpatch
+, talloc, docutils
+, enableStatic ? true }:
 
-stdenv.mkDerivation rec {
+({ version, rev, sha256, patches }: stdenv.mkDerivation {
   name = "proot-${version}";
-  version = "5.1.0";
+  inherit version;
 
   src = fetchFromGitHub {
-    sha256 = "0azsqis99gxldmbcg43girch85ysg4hwzf0h1b44bmapnsm89fbz";
-    rev = "v${version}";
+    inherit rev sha256;
     repo = "proot";
     owner = "cedric-vincent";
   };
@@ -17,6 +17,8 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  inherit patches;
+
   preBuild = stdenv.lib.optionalString enableStatic ''
     export LDFLAGS="-static"
   '';
@@ -34,11 +36,26 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with stdenv.lib; {
-    homepage = http://proot.me;
+    homepage = http://proot-me.github.io;
     description = "User-space implementation of chroot, mount --bind and binfmt_misc";
     platforms = platforms.linux;
     license = licenses.gpl2;
-    maintainers = with maintainers; [ ianwookim nckx ];
+    maintainers = with maintainers; [ ianwookim nckx makefu ];
   };
-}
-
+})
+(if stdenv.isAarch64 then rec {
+  version = "5.1.0";
+  sha256 = "0azsqis99gxldmbcg43girch85ysg4hwzf0h1b44bmapnsm89fbz";
+  rev = "v${version}";
+  patches = [
+    (fetchpatch { # debian patch for aarch64 build
+      sha256 = "18milpzjkbfy5ab789ia3m4pyjyr9mfzbw6kbjhkj4vx9jc39svv";
+      url = "https://sources.debian.net/data/main/p/proot/5.1.0-1.2/debian/patches/arm64.patch";
+    })
+  ];
+} else {
+  version = "5.1.0.20171015";
+  sha256 = "0jam87msh5jx8vpb19n6xwxw1xlig5amdcqif7gn2rc8nhswpxif";
+  rev = "0bf2ee17daafeeadfed079cec97fe1ac781e696a";
+  patches = [];
+})
diff --git a/pkgs/tools/system/s-tui/default.nix b/pkgs/tools/system/s-tui/default.nix
new file mode 100644
index 000000000000..6d6a3461f771
--- /dev/null
+++ b/pkgs/tools/system/s-tui/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, pythonPackages }:
+
+pythonPackages.buildPythonPackage rec {
+  name = "${pname}-${version}";
+  pname = "s-tui";
+  version = "0.6.2";
+
+  src = pythonPackages.fetchPypi {
+    inherit pname version;
+    sha256 = "0fijk26sm51bnxf7plzd1fn2k4f8mdqd7j9zqc3d8zri7228vik2";
+  };
+
+  propagatedBuildInputs = with pythonPackages; [
+    urwid
+    psutil
+  ];
+
+  meta = with stdenv.lib; {
+    homepage = https://amanusk.github.io/s-tui/;
+    descrption = "Stress-Terminal UI monitoring tool";
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ infinisil ];
+  };
+}
diff --git a/pkgs/tools/system/smartmontools/default.nix b/pkgs/tools/system/smartmontools/default.nix
index 26d84ae0320e..5fa55b275fe1 100644
--- a/pkgs/tools/system/smartmontools/default.nix
+++ b/pkgs/tools/system/smartmontools/default.nix
@@ -2,14 +2,14 @@
 , IOKit ? null , ApplicationServices ? null }:
 
 let
-  version = "6.5";
+  version = "6.6";
 
-  dbrev = "4394";
+  dbrev = "4548";
   drivedbBranch = "RELEASE_${builtins.replaceStrings ["."] ["_"] version}_DRIVEDB";
   driverdb = fetchurl {
-    url = "http://sourceforge.net/p/smartmontools/code/${dbrev}/tree/branches/${drivedbBranch}/smartmontools/drivedb.h?format=raw";
-    sha256 = "1kdpgbl1az0xhqn7j613cx366n7amra8xz3391jpzzrd3vlga393";
-    name = "smartmontools-drivedb.h";
+    url    = "http://sourceforge.net/p/smartmontools/code/${dbrev}/tree/branches/${drivedbBranch}/smartmontools/drivedb.h?format=raw";
+    sha256 = "0nwk4ir0c40b01frqm7a0lvljh5k9yhslc3j4485zjsx3v5w269f";
+    name   = "smartmontools-drivedb.h";
   };
 
 in stdenv.mkDerivation rec {
@@ -17,7 +17,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://sourceforge/smartmontools/${name}.tar.gz";
-    sha256 = "1g25r6sx85b5lay5n6sbnqv05qxzj6xsafsp93hnrg1h044bps49";
+    sha256 = "0m1hllbb78rr6cxkbalmz1gqkl0psgq8rrmv4gwcmz34n07kvx2i";
   };
 
   patches = [ ./smartmontools.patch ];
diff --git a/pkgs/tools/system/socklog/default.nix b/pkgs/tools/system/socklog/default.nix
index 0b95dcdb193d..15a18a453f00 100644
--- a/pkgs/tools/system/socklog/default.nix
+++ b/pkgs/tools/system/socklog/default.nix
@@ -16,7 +16,13 @@ stdenv.mkDerivation rec {
   outputs = [ "out" "man" "doc" ];
 
   postPatch = ''
-    sed -i src/TARGETS -e '/^chkshsgr/d'
+    # Fails to run as user without supplementary groups
+    echo "int main() { return 0; }" >src/chkshsgr.c
+
+    # Fixup implicit function declarations
+    sed -i src/pathexec_run.c -e '1i#include <unistd.h>'
+    sed -i src/prot.c -e '1i#include <unistd.h>' -e '2i#include <grp.h>'
+    sed -i src/seek_set.c -e '1i#include <unistd.h>'
   '';
 
   configurePhase = ''
@@ -27,8 +33,6 @@ stdenv.mkDerivation rec {
   buildPhase = ''package/compile'';
 
   installPhase = ''
-    runHook preInstall
-
     mkdir -p $out/bin
     mv command"/"* $out/bin
 
@@ -39,8 +43,6 @@ stdenv.mkDerivation rec {
 
     mkdir -p $doc/share/doc/socklog/html
     mv doc/*.html $doc/share/doc/socklog/html/
-
-    runHook postInstall
   '';
 
   checkPhase = ''package/check'';
diff --git a/pkgs/tools/system/supervise/default.nix b/pkgs/tools/system/supervise/default.nix
new file mode 100644
index 000000000000..838663c30720
--- /dev/null
+++ b/pkgs/tools/system/supervise/default.nix
@@ -0,0 +1,27 @@
+{ stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+
+  name = "supervise-${version}";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "catern";
+    repo = "supervise";
+    rev = "v${version}";
+    sha256 = "1cjdxgns3gh2ir4kcmjdmc480w8sm49inws0ihhjmnisjy4100lg";
+  };
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp supervise unlinkwait -t $out/bin
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/catern/supervise;
+    description = "A minimal unprivileged process supervisor making use of modern Linux features";
+    platforms = platforms.linux;
+    license = licenses.gpl3;
+    maintainers = with stdenv.lib.maintainers; [ catern ];
+  };
+}
diff --git a/pkgs/tools/system/syslog-ng-incubator/default.nix b/pkgs/tools/system/syslog-ng-incubator/default.nix
index 3fd529b0a50a..ef92bdfe47e0 100644
--- a/pkgs/tools/system/syslog-ng-incubator/default.nix
+++ b/pkgs/tools/system/syslog-ng-incubator/default.nix
@@ -1,22 +1,22 @@
 { stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, glib, syslogng
-, eventlog, perl, python, yacc, protobufc, libivykis
+, eventlog, perl, python, yacc, protobufc, libivykis, libcap, czmq
 }:
 
 stdenv.mkDerivation rec {
   name = "syslog-ng-incubator-${version}";
-  version = "0.5.0";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "balabit";
     repo = "syslog-ng-incubator";
     rev = name;
-    sha256 = "00j123ya0xfj1jicaqnk1liffx07mhhf0r406pabxjjj97gy8nlk";
+    sha256 = "1wiv289lc5kxsd3ydyn1zvvgjrj1mv2jghv0cm425wsdsfr7fjb0";
   };
 
   nativeBuildInputs = [ pkgconfig autoreconfHook yacc ];
 
   buildInputs = [
-    glib syslogng eventlog perl python protobufc libivykis
+    glib syslogng eventlog perl python protobufc libivykis libcap czmq
   ];
 
   configureFlags = [
@@ -29,6 +29,5 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2;
     maintainers = [ maintainers.rickynils ];
     platforms = platforms.linux;
-    broken = true; # does not work with our new syslog-ng version yet
   };
 }
diff --git a/pkgs/tools/system/syslog-ng/default.nix b/pkgs/tools/system/syslog-ng/default.nix
index 812fab65ef63..397ba053841d 100644
--- a/pkgs/tools/system/syslog-ng/default.nix
+++ b/pkgs/tools/system/syslog-ng/default.nix
@@ -9,11 +9,11 @@ in
 
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
-  version = "3.9.1";
+  version = "3.11.1";
 
   src = fetchurl {
     url = "https://github.com/balabit/${pname}/releases/download/${name}/${name}.tar.gz";
-    sha256 = "05qaqw115py5iz55vmc0j1xcwcpr8wa9vpmbixhr1rqaamm8ay2n";
+    sha256 = "1sa51bh3rs4gq4zpgkyv94lqcx3qvxa41d2dsa7hyxidkp1rs2b4";
   };
 
   nativeBuildInputs = [ pkgconfig which ];
diff --git a/pkgs/tools/system/thermald/default.nix b/pkgs/tools/system/thermald/default.nix
index 7c81a028810d..a3e90f32c0ab 100644
--- a/pkgs/tools/system/thermald/default.nix
+++ b/pkgs/tools/system/thermald/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "1qzvmzkzdrmwrzfbxb2rz1i39j5zskjxiiv1w9m0xyg08p2wr7h3";
   };
 
-  buildInputs = [ autoconf automake libtool pkgconfig dbus_libs dbus_glib libxml2 ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ autoconf automake libtool dbus_libs dbus_glib libxml2 ];
 
   patchPhase = ''sed -e 's/upstartconfdir = \/etc\/init/upstartconfdir = $(out)\/etc\/init/' -i data/Makefile.am'';
 
diff --git a/pkgs/tools/system/vboot_reference/default.nix b/pkgs/tools/system/vboot_reference/default.nix
index a9a034ebde91..e410ef1cee50 100644
--- a/pkgs/tools/system/vboot_reference/default.nix
+++ b/pkgs/tools/system/vboot_reference/default.nix
@@ -1,41 +1,35 @@
-{ stdenv, fetchgit, pkgconfig, libuuid, openssl }:
+{ stdenv, fetchgit, pkgconfig, libuuid, openssl, libyaml, lzma }:
 
 stdenv.mkDerivation rec {
-  version = "20130507";
-  checkout = "25/50225/2";
+  version = "20171023";
+  checkout = "8122e0b8b13794";
 
   name = "vboot_reference-${version}";
 
   src = fetchgit {
     url = https://chromium.googlesource.com/chromiumos/platform/vboot_reference;
-    rev = "refs/changes/${checkout}";
-    sha256 = "14d3a93ha5k4al4ib43nyn1ppx7kgb12xw6mkflhx8nxmx8827nc";
+    rev = "${checkout}";
+    sha256 = "0qxm3qlvm2fgjrn9b3n8rdccw2f5pdi7z542m2hdfddflx7jz1w7";
   };
 
-  buildInputs = [ pkgconfig openssl stdenv.cc.libc.static ]
-    ++ stdenv.lib.optional (libuuid != null)
-         (libuuid.overrideAttrs (attrs:
-           { configureFlags = attrs.configureFlags ++ [ "--enable-static" ]; }));
-
-  arch = if stdenv.system == "x86_64-linux" then "x86_64"
-    else if stdenv.system == "i686-linux" then "x86"
-    else throw "vboot_reference for: ${stdenv.system} not supported!";
-
-  buildPhase = ''
-    make ARCH=${arch} `pwd`/build/cgpt/cgpt
-    make ARCH=${arch} `pwd`/build/utility/vbutil_kernel
-    make ARCH=${arch} `pwd`/build/utility/vbutil_key
-    make ARCH=${arch} `pwd`/build/utility/vbutil_keyblock
-    make ARCH=${arch} `pwd`/build/utility/vbutil_firmware
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ openssl libuuid libyaml lzma ];
+
+  enableParallelBuilding = true;
+
+  patches = [ ./dont_static_link.patch ];
+
+  preBuild = ''
+    patchShebangs scripts
   '';
 
-  installPhase = ''
-    mkdir -p $out/bin
-    cp build/cgpt/cgpt $out/bin
-    cp build/utility/vbutil_kernel $out/bin
-    cp build/utility/vbutil_key $out/bin
-    cp build/utility/vbutil_keyblock $out/bin
-    cp build/utility/vbutil_firmware $out/bin
+  makeFlags = [
+    "DESTDIR=$(out)"
+  ];
+
+  postInstall = ''
+    mkdir -p $out/share/vboot
+    cp -r tests/devkeys* $out/share/vboot/
   '';
 
   meta = {
diff --git a/pkgs/tools/system/vboot_reference/dont_static_link.patch b/pkgs/tools/system/vboot_reference/dont_static_link.patch
new file mode 100644
index 000000000000..506b942e246e
--- /dev/null
+++ b/pkgs/tools/system/vboot_reference/dont_static_link.patch
@@ -0,0 +1,30 @@
+---
+--- a/Makefile
++++ b/Makefile
+@@ -964,7 +964,7 @@ ${UTILLIB21}: ${UTILLIB21_OBJS} ${FWLIB2
+ # Link tests for external repos
+ ${BUILD}/host/linktest/extern: ${HOSTLIB}
+ ${BUILD}/host/linktest/extern: LIBS = ${HOSTLIB}
+-${BUILD}/host/linktest/extern: LDLIBS += -static
++#${BUILD}/host/linktest/extern: LDLIBS += -static
+ TEST_OBJS += ${BUILD}/host/linktest/extern.o
+ 
+ .PHONY: hostlib
+@@ -1056,7 +1056,7 @@ ${UTIL_BINS} ${UTIL_BINS_STATIC}: ${UTIL
+ ${UTIL_BINS} ${UTIL_BINS_STATIC}: LIBS = ${UTILLIB}
+ 
+ # Utilities for auto-update toolkits must be statically linked.
+-${UTIL_BINS_STATIC}: LDFLAGS += -static
++${UTIL_BINS_STATIC}:
+ 
+ 
+ .PHONY: utils
+@@ -1089,7 +1089,7 @@ futil: ${FUTIL_STATIC_BIN} ${FUTIL_BIN}
+ 
+ ${FUTIL_STATIC_BIN}: ${FUTIL_STATIC_OBJS} ${UTILLIB}
+ 	@${PRINTF} "    LD            $(subst ${BUILD}/,,$@)\n"
+-	${Q}${LD} -o $@ ${CFLAGS} ${LDFLAGS} -static $^ ${LDLIBS}
++	${Q}${LD} -o $@ ${CFLAGS} ${LDFLAGS} $^ ${LDLIBS}
+ 
+ ${FUTIL_BIN}: LDLIBS += ${CRYPTO_LIBS}
+ ${FUTIL_BIN}: ${FUTIL_OBJS} ${UTILLIB}
diff --git a/pkgs/tools/system/which/default.nix b/pkgs/tools/system/which/default.nix
index fc0889012c2e..870e1b3a398f 100644
--- a/pkgs/tools/system/which/default.nix
+++ b/pkgs/tools/system/which/default.nix
@@ -8,9 +8,6 @@ stdenv.mkDerivation rec {
     sha256 = "1bgafvy3ypbhhfznwjv1lxmd6mci3x1byilnnkc7gcr486wlb8pl";
   };
 
-  # FIXME needs gcc 4.9 in bootstrap tools
-  hardeningDisable = [ "stackprotector" ];
-
   meta = with stdenv.lib; {
     homepage = http://ftp.gnu.org/gnu/which/;
     platforms = platforms.all;
diff --git a/pkgs/tools/system/wsmancli/default.nix b/pkgs/tools/system/wsmancli/default.nix
index c1c62718de2d..bd6ec17ceec1 100644
--- a/pkgs/tools/system/wsmancli/default.nix
+++ b/pkgs/tools/system/wsmancli/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "03ay6sa4ii8h6rr3l2qiqqml8xl6gplrlg4v2avdh9y6sihfyvvn";
   };
 
-  buildInputs = [ autoconf automake libtool pkgconfig openwsman openssl ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ autoconf automake libtool openwsman openssl ];
 
   preConfigure = ''
     ./bootstrap
diff --git a/pkgs/tools/text/a2ps/default.nix b/pkgs/tools/text/a2ps/default.nix
index 2535354aa229..f423bd7ea1c4 100644
--- a/pkgs/tools/text/a2ps/default.nix
+++ b/pkgs/tools/text/a2ps/default.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
       (page number, printing date, file name or supplied header), line numbering, symbol substitution as
       well as pretty printing for a wide range of programming languages.
     '';
-    homepage = http://www.inf.enst.fr/~demaille/a2ps/index.html;
+    homepage = https://www.gnu.org/software/a2ps/;
     license = licenses.gpl3Plus;
     maintainers = [ maintainers.bennofs ];
     platforms = platforms.linux;
diff --git a/pkgs/tools/text/ascii/default.nix b/pkgs/tools/text/ascii/default.nix
index 4cc033938553..20777f990e26 100644
--- a/pkgs/tools/text/ascii/default.nix
+++ b/pkgs/tools/text/ascii/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "ascii-${version}";
-  version = "3.15";
+  version = "3.18";
 
   src = fetchurl {
     url = "http://www.catb.org/~esr/ascii/${name}.tar.gz";
-    sha256 = "0pzzfljg2ijnnys3fzj3f2p288sl5cgk83a2mpcm679pcj5xpqdc";
+    sha256 = "0b87vy06s8s3a8q70pqavsbk4m4ff034sdml2xxa6qfsykaj513j";
   };
 
   prePatch = ''
diff --git a/pkgs/tools/text/ebook-tools/default.nix b/pkgs/tools/text/ebook-tools/default.nix
index e9abae3ac849..7dcd94e5363f 100644
--- a/pkgs/tools/text/ebook-tools/default.nix
+++ b/pkgs/tools/text/ebook-tools/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "1bi7wsz3p5slb43kj7lgb3r6lb91lvb6ldi556k4y50ix6b5khyb";
   };
 
-  buildInputs = [ cmake pkgconfig libxml2 libzip ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ cmake libxml2 libzip ];
 
   preConfigure = 
     ''
diff --git a/pkgs/tools/text/fanficfare/default.nix b/pkgs/tools/text/fanficfare/default.nix
index 9e273d3c69b7..37447d0fb2ae 100644
--- a/pkgs/tools/text/fanficfare/default.nix
+++ b/pkgs/tools/text/fanficfare/default.nix
@@ -1,13 +1,13 @@
 { stdenv, fetchurl, python27Packages }:
 
 python27Packages.buildPythonApplication rec {
-  version = "2.9.0";
+  version = "2.16.0";
   name = "fanficfare-${version}";
   nameprefix = "";
 
   src = fetchurl {
     url = "https://github.com/JimmXinu/FanFicFare/archive/v${version}.tar.gz";
-    sha256 = "781e9095d8152345a6106135e87c46eb306ff234b847de5073faca2f78544398";
+    sha256 = "0c31z7w4b3wz5nahsmnfhvp3srprfsqbp3zyngw4cqw3dm17kvvi";
   };
 
   propagatedBuildInputs = with python27Packages; [ beautifulsoup4 chardet html5lib html2text ];
diff --git a/pkgs/tools/text/gawk/default.nix b/pkgs/tools/text/gawk/default.nix
index dec7af045251..65d0a1e4c00a 100644
--- a/pkgs/tools/text/gawk/default.nix
+++ b/pkgs/tools/text/gawk/default.nix
@@ -1,48 +1,56 @@
-{ stdenv, fetchurl, xz, libsigsegv, readline, interactive ? false
-, locale ? null }:
+{ stdenv, fetchurl
+# TODO: links -lsigsegv but loses the reference for some reason
+, withSigsegv ? (false && stdenv.system != "x86_64-cygwin"), libsigsegv
+, interactive ? false, readline
+
+/* Test suite broke on:
+       stdenv.isCygwin # XXX: `test-dup2' segfaults on Cygwin 6.1
+    || stdenv.isDarwin # XXX: `locale' segfaults
+    || stdenv.isSunOS  # XXX: `_backsmalls1' fails, locale stuff?
+    || stdenv.isFreeBSD
+*/
+, doCheck ? (interactive && stdenv.isLinux), glibcLocales ? null
+, locale ? null
+}:
+
+assert (doCheck && stdenv.isLinux) -> glibcLocales != null;
 
 let
   inherit (stdenv.lib) optional;
 in
 stdenv.mkDerivation rec {
-  name = "gawk-4.1.4";
+  name = "gawk-4.2.0";
 
   src = fetchurl {
     url = "mirror://gnu/gawk/${name}.tar.xz";
-    sha256 = "0rn2mmjxm767zliqzd67j7h2ncjn4j0321c60y9fy3grs3i89qak";
+    sha256 = "1wm9lqj77y7xz07zi0n187aqm8zavzxzpm1j53ahxz81q0qwvwyl";
   };
 
   # When we do build separate interactive version, it makes sense to always include man.
-  outputs = [ "out" "info" ] ++ stdenv.lib.optional (!interactive) "man";
+  outputs = [ "out" "info" ] ++ optional (!interactive) "man";
 
-  # FIXME: 4.1.4 testsuite breaks when only C locales are available
-  doCheck = false /*!(
-       stdenv.isCygwin # XXX: `test-dup2' segfaults on Cygwin 6.1
-    || stdenv.isDarwin # XXX: `locale' segfaults
-    || stdenv.isSunOS  # XXX: `_backsmalls1' fails, locale stuff?
-    || stdenv.isFreeBSD
-  )*/;
+  nativeBuildInputs = optional (doCheck && stdenv.isLinux) glibcLocales;
 
-  nativeBuildInputs = [ xz.bin ];
   buildInputs =
-       stdenv.lib.optional (stdenv.system != "x86_64-cygwin") libsigsegv
-    ++ stdenv.lib.optional interactive readline
-    ++ stdenv.lib.optional stdenv.isDarwin locale;
-
-  configureFlags = stdenv.lib.optional (stdenv.system != "x86_64-cygwin") "--with-libsigsegv-prefix=${libsigsegv}"
-    ++ [(if interactive then "--with-readline=${readline.dev}" else "--without-readline")];
-
-  postInstall =
-    if interactive then
-      ''
-        rm "$out"/bin/gawk-*
-        ln -s gawk.1 "''${!outputMan}"/share/man/man1/awk.1
-      ''
-    else # TODO: remove this other branch on a stdenv rebuild
-      ''
-        rm $out/bin/gawk-*
-        ln -s $man/share/man/man1/gawk.1 $man/share/man/man1/awk.1
-      '';
+       optional withSigsegv libsigsegv
+    ++ optional interactive readline
+    ++ optional stdenv.isDarwin locale;
+
+  configureFlags = [
+    (if withSigsegv then "--with-libsigsegv-prefix=${libsigsegv}" else "--without-libsigsegv")
+    (if interactive then "--with-readline=${readline.dev}" else "--without-readline")
+  ];
+
+  inherit doCheck;
+
+  postInstall = ''
+    rm "$out"/bin/gawk-*
+    ln -s gawk.1 "''${!outputMan}"/share/man/man1/awk.1
+  '';
+
+  passthru = {
+    libsigsegv = if withSigsegv then libsigsegv else null; # for stdenv bootstrap
+  };
 
   meta = with stdenv.lib; {
     homepage = http://www.gnu.org/software/gawk/;
diff --git a/pkgs/tools/text/highlight/default.nix b/pkgs/tools/text/highlight/default.nix
index f452a98a4db6..275d65e7c370 100644
--- a/pkgs/tools/text/highlight/default.nix
+++ b/pkgs/tools/text/highlight/default.nix
@@ -1,14 +1,16 @@
-{ stdenv, fetchurl, getopt, lua, boost, pkgconfig, gcc }:
+{ stdenv, fetchFromGitHub, getopt, lua, boost, pkgconfig, gcc }:
 
 with stdenv.lib;
 
 stdenv.mkDerivation rec {
   name = "highlight-${version}";
-  version = "3.35";
+  version = "3.40";
 
-  src = fetchurl {
-    url = "http://www.andre-simon.de/zip/${name}.tar.bz2";
-    sha256 = "8a14b49f5e0c07daa9f40b4ce674baa00bb20061079473a5d386656f6d236d05";
+  src = fetchFromGitHub {
+    owner = "andre-simon";
+    repo = "highlight";
+    rev = "${version}";
+    sha256 = "0bkywhz4y10qcajimdha1ck5mvn7fsrv3yn8nd6rqbva39gbfmfd";
   };
 
   nativeBuildInputs = [ pkgconfig ] ++ optional stdenv.isDarwin  gcc ;
@@ -28,6 +30,6 @@ stdenv.mkDerivation rec {
     description = "Source code highlighting tool";
     homepage = http://www.andre-simon.de/doku/highlight/en/highlight.php;
     platforms = platforms.unix;
-    maintainers = [ maintainers.ndowens ];
+    maintainers = with maintainers; [ ndowens willibutz ];
   };
 }
diff --git a/pkgs/tools/text/html2text/default.nix b/pkgs/tools/text/html2text/default.nix
index 586b34621a92..194484755481 100644
--- a/pkgs/tools/text/html2text/default.nix
+++ b/pkgs/tools/text/html2text/default.nix
@@ -9,7 +9,9 @@ stdenv.mkDerivation {
   };
 
   preConfigure = ''
-    sed -i s,/bin/echo,echo, configure
+    substituteInPlace configure \
+        --replace /bin/echo echo \
+        --replace CXX=unknown ':'
   '';
 
   # the --prefix has no effect
diff --git a/pkgs/tools/text/jsawk/default.nix b/pkgs/tools/text/jsawk/default.nix
new file mode 100644
index 000000000000..46d290b79ffb
--- /dev/null
+++ b/pkgs/tools/text/jsawk/default.nix
@@ -0,0 +1,28 @@
+{ stdenv, fetchFromGitHub, makeWrapper, spidermonkey }:
+
+stdenv.mkDerivation rec {
+  name = "jsawk-${version}";
+  version = "1.5-pre";
+  src = fetchFromGitHub {
+    owner = "micha";
+    repo = "jsawk";
+    rev = "5a14c4af3c7b59807701b70a954ecefc6f77e978";
+    sha256 = "0z3vdr3c8nvdrrxkjv9b4xg47mdb2hsknxpimw6shgwbigihapyr";
+  };
+  dontBuild = true;
+  buildInputs = [ makeWrapper ];
+  installPhase = ''
+    mkdir -p $out/bin
+    cp $src/jsawk $out/bin/
+    wrapProgram $out/bin/jsawk \
+      --prefix PATH : "${spidermonkey}/bin"
+  '';
+
+  meta = {
+    description = "Jsawk is like awk, but for JSON";
+    homepage = https://github.com/micha/jsawk;
+    license = stdenv.lib.licenses.publicDomain;
+    maintainers = with stdenv.lib.maintainers; [ puffnfresh ];
+    platforms = stdenv.lib.platforms.unix;
+  };
+}
diff --git a/pkgs/tools/text/languagetool/default.nix b/pkgs/tools/text/languagetool/default.nix
index 8aed674a644a..4f3f8af3256d 100644
--- a/pkgs/tools/text/languagetool/default.nix
+++ b/pkgs/tools/text/languagetool/default.nix
@@ -20,6 +20,11 @@ stdenv.mkDerivation rec {
     EXE
     chmod +x $out/bin/$lt
     done
+    cat > $out/bin/languagetool-http-server <<EXE
+    #!${stdenv.shell}
+    ${jdk}/bin/java -cp $out/share/languagetool-server.jar org.languagetool.server.HTTPServer "\$@"
+    EXE
+    chmod +x $out/bin/languagetool-http-server
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/text/mawk/default.nix b/pkgs/tools/text/mawk/default.nix
index 8840130dde50..a8657c3ea2f9 100644
--- a/pkgs/tools/text/mawk/default.nix
+++ b/pkgs/tools/text/mawk/default.nix
@@ -1,11 +1,14 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "mawk-1.3.4-20161120";
+  name = "mawk-1.3.4-20171017";
 
   src = fetchurl {
-    url = "ftp://invisible-island.net/mawk/${name}.tgz";
-    sha256 = "07hc33g2ip7463dravsiz0zwfc8vy4y4jxqvp7rz3hb896xw27in";
+    urls = [
+      "https://invisible-mirror.net/archives/mawk/${name}.tgz"
+      "ftp://invisible-island.net/mawk/${name}.tgz"
+    ];
+    sha256 = "0nwyxhipn4jx7j695lih1xggxm6cp4fjk4wbgihd33ni3rfi25yv";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/text/nawk/default.nix b/pkgs/tools/text/nawk/default.nix
index d3056735b8d1..a746c4544350 100644
--- a/pkgs/tools/text/nawk/default.nix
+++ b/pkgs/tools/text/nawk/default.nix
@@ -36,6 +36,6 @@ stdenv.mkDerivation rec {
     homepage = https://www.cs.princeton.edu/~bwk/btl.mirror/;
     license = stdenv.lib.licenses.mit;
     maintainers = [ stdenv.lib.maintainers.konimex ];
-    platforms = stdenv.lib.platforms.all;
+    platforms = stdenv.lib.platforms.linux;
   };
 }
diff --git a/pkgs/tools/text/opencc/default.nix b/pkgs/tools/text/opencc/default.nix
index 62206c6c7914..a2a02049d267 100644
--- a/pkgs/tools/text/opencc/default.nix
+++ b/pkgs/tools/text/opencc/default.nix
@@ -9,10 +9,14 @@ stdenv.mkDerivation {
 
   buildInputs = [ cmake python ];
 
-  cmakeFlags = [
-    "-DBUILD_SHARED_LIBS=OFF"
+  makeFlags = [
+    # let intermediate tools find intermediate library
+    "LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$(CURDIR)/src"
   ];
 
+  # Parallel building occasionaly fails with: Error copying file "/tmp/nix-build-opencc-1.0.5.drv-0/OpenCC-ver.1.0.5/build/src/libopencc.so.1.0.0" to "/tmp/nix-build-opencc-1.0.5.drv-0/OpenCC-ver.1.0.5/build/src/tools".
+  enableParallelBuilding = false;
+
   meta = with stdenv.lib; {
     homepage = https://github.com/BYVoid/OpenCC;
     license = licenses.asl20;
@@ -23,7 +27,7 @@ stdenv.mkDerivation {
       phrase-level conversion, variant conversion and regional idioms among Mainland China,
       Taiwan and Hong kong.
     '';
-    maintainers = [ maintainers.mingchuan ];
+    maintainers = [ maintainers.sifmelcara ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/tools/text/peco/default.nix b/pkgs/tools/text/peco/default.nix
index a58cb87d1db1..9f181094ea00 100644
--- a/pkgs/tools/text/peco/default.nix
+++ b/pkgs/tools/text/peco/default.nix
@@ -1,56 +1,20 @@
-{ stdenv, go, fetchgit }:
+{ stdenv, buildGoPackage, fetchFromGitHub }:
 
-let
-  go-flags = fetchgit {
-    url = "git://github.com/jessevdk/go-flags";
-    rev = "ef51ed2000ee1721c7153e958511907b844b4a9c";
-    sha256 = "1abzc7ksglicaz6g6nry006vwvflsidvyzyig85pi3p852z6sc2j";
-  };
-  go-runewidth = fetchgit {
-    url = "git://github.com/mattn/go-runewidth";
-    rev = "63c378b851290989b19ca955468386485f118c65";
-    sha256 = "1z5mhfrpqdssn3603vwd95w69z28igwq96lh7b9rrdcx440i822d";
-  };
-  termbox-go = fetchgit {
-    url = "git://github.com/nsf/termbox-go";
-    rev = "bb19a81afd4bc2729799d1fedb19f7bd7ee284cf";
-    sha256 = "1zc8pb594l16yipis6xg2ra84bg315p63wqxa5abyam1y0333sn0";
-  };
-in stdenv.mkDerivation rec {
+buildGoPackage rec {
   name = "peco-${version}";
-  version = "0.2.10";
-
-  src = fetchgit {
-    url = "git://github.com/peco/peco";
-    rev = "4952013023ae1d92c10d826e6970c5a68959678d";
-    sha256 = "15blxy6a9ph6hm5wn14p025qidbspjy6hhmp4zbbgpxx2l1x8fpg";
-  };
-
-  buildInputs = [ go ];
+  version = "0.5.1";
 
-  sourceRoot = ".";
+  goPackagePath = "github.com/peco/peco";
+  subPackages = [ "cmd/peco" ];
 
-  buildPhase = ''
-    mkdir -p src/github.com/jessevdk/go-flags/
-    ln -s ${go-flags}/* src/github.com/jessevdk/go-flags
-
-    mkdir -p src/github.com/mattn/go-runewidth/
-    ln -s ${go-runewidth}/* src/github.com/mattn/go-runewidth
-
-    mkdir -p src/github.com/nsf/termbox-go/
-    ln -s ${termbox-go}/* src/github.com/nsf/termbox-go
-
-    mkdir -p src/github.com/peco/peco
-    ln -s ${src}/* src/github.com/peco/peco
-
-    export GOPATH=$PWD
-    go build -v -o peco src/github.com/peco/peco/cmd/peco/peco.go
-  ''; # */
+  src = fetchFromGitHub {
+    owner = "peco";
+    repo = "peco";
+    rev = "v${version}";
+    sha256 = "0jnlpr3nxx8xmjb6w4jlwshzz0p9hlww9919qbkm66afv16k0vm8";
+  };
 
-  installPhase = ''
-    ensureDir $out/bin
-    cp peco $out/bin
-  '';
+  goDeps = ./deps.nix;
 
   meta = with stdenv.lib; {
     description = "Simplistic interactive filtering tool";
diff --git a/pkgs/tools/text/peco/deps.nix b/pkgs/tools/text/peco/deps.nix
new file mode 100644
index 000000000000..1b884ef995e8
--- /dev/null
+++ b/pkgs/tools/text/peco/deps.nix
@@ -0,0 +1,57 @@
+# This file was generated by https://github.com/kamilchm/go2nix v1.2.1
+[
+  {
+    goPackagePath = "github.com/google/btree";
+    fetch = {
+      type = "git";
+      url = "https://github.com/google/btree";
+      rev = "0c3044bc8bada22db67b93f5760fe3f05d6a5c25";
+      sha256 = "05rdnf2c9r0yicg17zsq58i0sm32p0lk8zdnb7nhr0v5hqldvps4";
+    };
+  }
+  {
+    goPackagePath = "github.com/jessevdk/go-flags";
+    fetch = {
+      type = "git";
+      url = "https://github.com/jessevdk/go-flags";
+      rev = "8bc97d602c3bfeb5fc6fc9b5a9c898f245495637";
+      sha256 = "1h3il3ycgd54flbyqys4hm4gzx1lyn5ja1k79f2y7zbs6y0mf1lz";
+    };
+  }
+  {
+    goPackagePath = "github.com/lestrrat/go-pdebug";
+    fetch = {
+      type = "git";
+      url = "https://github.com/lestrrat/go-pdebug";
+      rev = "2e6eaaa5717f81bda41d27070d3c966f40a1e75f";
+      sha256 = "05dx1f1yln47nazyi50zix82xbnyva3hily4gh5gaz021h01npax";
+    };
+  }
+  {
+    goPackagePath = "github.com/mattn/go-runewidth";
+    fetch = {
+      type = "git";
+      url = "https://github.com/mattn/go-runewidth";
+      rev = "737072b4e32b7a5018b4a7125da8d12de90e8045";
+      sha256 = "09ni8bmj6p2b774bdh6mfcxl03bh5sqk860z03xpb6hv6yfxqkjm";
+    };
+  }
+  {
+    goPackagePath = "github.com/nsf/termbox-go";
+    fetch = {
+      type = "git";
+      url = "https://github.com/nsf/termbox-go";
+      rev = "abe82ce5fb7a42fbd6784a5ceb71aff977e09ed8";
+      sha256 = "156i8apkga8b3272kjhapyqwspgcfkrr9kpqwc5lii43k4swghpv";
+    };
+  }
+  {
+    goPackagePath = "github.com/pkg/errors";
+    fetch = {
+      type = "git";
+      url = "https://github.com/pkg/errors";
+      rev = "248dadf4e9068a0b3e79f02ed0a610d935de5302";
+      sha256 = "03l80r0i9bxl0vz363w62k4a8apzglgbrz6viwym3044sxkl1qks";
+    };
+  }
+]
diff --git a/pkgs/tools/text/qshowdiff/default.nix b/pkgs/tools/text/qshowdiff/default.nix
index 63759184ba47..761a498bcfb6 100644
--- a/pkgs/tools/text/qshowdiff/default.nix
+++ b/pkgs/tools/text/qshowdiff/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "027959xbzvi5c2w9y1x122sr5i26k9mvp43banz2wln6gd860n1a";
   };
 
-  buildInputs = [ qt4 perl pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ qt4 perl ];
 
   configurePhase = ''
     mkdir -p $out/{bin,man/man1}
diff --git a/pkgs/tools/text/ripgrep/default.nix b/pkgs/tools/text/ripgrep/default.nix
index da7c5b593e3a..9a93ec2d7674 100644
--- a/pkgs/tools/text/ripgrep/default.nix
+++ b/pkgs/tools/text/ripgrep/default.nix
@@ -4,16 +4,16 @@ with rustPlatform;
 
 buildRustPackage rec {
   name = "ripgrep-${version}";
-  version = "0.5.2";
+  version = "0.7.1";
 
   src = fetchFromGitHub {
     owner = "BurntSushi";
     repo = "ripgrep";
     rev = "${version}";
-    sha256 = "128sfczms14zgfbhgmf84jjlivd4q6i581rxirhz3kmpnnby18rz";
+    sha256 = "0z3f83vhy464k93bc55i9lr6z41163q96if938p9ndhx2q3a20ql";
   };
 
-  depsSha256 = "1kjmv4bn5sicx8g5gyzq2zhxmqsqlgckhcg4ypvnjmcyq1ifiv2m";
+  cargoSha256 = "1d6s01gmyfzb0vdf7flq6nvlapwcgbj0mzcprzyg4nj5gjkvznrn";
 
   preFixup = ''
     mkdir -p "$out/man/man1"
@@ -23,7 +23,7 @@ buildRustPackage rec {
   meta = with stdenv.lib; {
     description = "A utility that combines the usability of The Silver Searcher with the raw speed of grep";
     homepage = https://github.com/BurntSushi/ripgrep;
-    license = with licenses; [ unlicense ];
+    license = with licenses; [ unlicense /* or */ mit ];
     maintainers = [ maintainers.tailhook ];
     platforms = platforms.all;
   };
diff --git a/pkgs/tools/text/rpl/default.nix b/pkgs/tools/text/rpl/default.nix
new file mode 100644
index 000000000000..bdbc97124433
--- /dev/null
+++ b/pkgs/tools/text/rpl/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, fetchFromGitHub, pythonPackages }:
+
+pythonPackages.buildPythonApplication rec {
+  name = "${pname}-${version}";
+  pname = "rpl";
+  version = "1.5.7";
+
+  # Tests not included in pip package.
+  doCheck = false;
+
+  src = fetchFromGitHub {
+    owner  = "kcoyner";
+    repo   = "rpl";
+    rev    = "v${version}";
+    sha256 = "1xhpgcmq91ivy9ijfyz5ilg51m7fz8ar2077r7gq246j8gbf8ggr";
+  };
+
+  meta = with stdenv.lib; {
+    description = "Replace strings in files";
+    homepage    = "https://github.com/kcoyner/rpl";
+    license     = licenses.gpl2;
+    maintainers = with maintainers; [ teto ];
+  };
+}
diff --git a/pkgs/tools/text/sift/default.nix b/pkgs/tools/text/sift/default.nix
index 1e688942a49e..fd4cef27ba17 100644
--- a/pkgs/tools/text/sift/default.nix
+++ b/pkgs/tools/text/sift/default.nix
@@ -16,10 +16,6 @@ buildGoPackage rec {
 
   goDeps = ./deps.nix;
 
-  postInstall = lib.optionalString stdenv.isDarwin ''
-    install_name_tool -delete_rpath $out/lib -add_rpath $bin $bin/bin/sift
-  '';
-
   meta = with lib; {
     description = "sift is a fast and powerful alternative to grep";
     homepage = https://sift-tool.org;
diff --git a/pkgs/tools/text/silver-searcher/default.nix b/pkgs/tools/text/silver-searcher/default.nix
index 146808963125..156a8bd8f646 100644
--- a/pkgs/tools/text/silver-searcher/default.nix
+++ b/pkgs/tools/text/silver-searcher/default.nix
@@ -2,18 +2,19 @@
 
 stdenv.mkDerivation rec {
   name = "silver-searcher-${version}";
-  version = "2.0.0";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "ggreer";
     repo = "the_silver_searcher";
     rev = "${version}";
-    sha256 = "074ll6l0486ak4ijvfzhwsp6fp8w55x4yjviql5kb8qpisi9ll7y";
+    sha256 = "0wcw4kyivb10m9b173183jrj46a0gisd35yqxi1mr9hw5l5dhkpa";
   };
 
   NIX_LDFLAGS = stdenv.lib.optionalString stdenv.isLinux "-lgcc_s";
 
-  buildInputs = [ autoreconfHook pkgconfig pcre zlib lzma ];
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  buildInputs = [ pcre zlib lzma ];
 
   meta = with stdenv.lib; {
     homepage = https://github.com/ggreer/the_silver_searcher/;
diff --git a/pkgs/tools/text/staccato/default.nix b/pkgs/tools/text/staccato/default.nix
index 34e1413150f2..973585abc81f 100644
--- a/pkgs/tools/text/staccato/default.nix
+++ b/pkgs/tools/text/staccato/default.nix
@@ -11,9 +11,10 @@ rustPlatform.buildRustPackage rec {
     sha256 = "1zbd1gx0ik2r7bavcid776j37g6rzd3f6cs94kq1qar4gyf1gqjm";
   };
 
-  depsSha256 = "1gwfkh3ck8n3zcy43ch2mnc28a6y10p3srhnx9dh8gwnwbpb733c";
+  cargoSha256 = "074mfyanwdykg6wci2ia63wcnnyik741g8n624pac215sg4i95h7";
 
   meta = {
+    broken = true;
     description = "A command line program that lets you compute statistics from values from a file or standard input";
     longDescription = ''
       Staccato (`st` for short) is a command line program that lets you
diff --git a/pkgs/tools/text/xml/basex/default.nix b/pkgs/tools/text/xml/basex/default.nix
index 4a7a478a12ac..0650270bb6a0 100644
--- a/pkgs/tools/text/xml/basex/default.nix
+++ b/pkgs/tools/text/xml/basex/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "basex-${version}";
-  version = "8.6.4";
+  version = "8.6.6";
 
   src = fetchurl {
-    url = "http://files.basex.org/releases/${version}/BaseX864.zip";
-    sha256 = "14320hfw53m0zl1v4377p0vcjvdnwfpa4gkj2y2wlrplma76y0w7";
+    url = "http://files.basex.org/releases/${version}/BaseX866.zip";
+    sha256 = "1kws6swisdaa17yhijjvkh2ikwz9rd5cw8mdjvkqw6vlcp1nq6m4";
   };
 
   buildInputs = [ unzip jre ];
diff --git a/pkgs/tools/text/xml/jing-trang/default.nix b/pkgs/tools/text/xml/jing-trang/default.nix
index 162f7e1a397b..3c2b4f5e8854 100644
--- a/pkgs/tools/text/xml/jing-trang/default.nix
+++ b/pkgs/tools/text/xml/jing-trang/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "jing-trang-${version}";
-  version = "20150603";
+  version = "20151127";
 
   src = fetchFromGitHub {
     owner = "relaxng";
     repo = "jing-trang";
-    rev = "54b9b1f4e67cd79c7987750d8c9dcfc014af98c3"; # needed to compile with jdk8
-    sha256 = "0wa569xjb7ihhcaazz32y2b0dv092lisjz77isz1gfb1wvf53di5";
+    rev = "47a0cbdaec2d48824b78a1c19879ac7875509598"; # needed to compile with jdk8
+    sha256 = "1hhn52z9mv1x9nyvyqnmzg5yrs2lzm9xac7i15izppv02wp32qha";
   };
 
   buildInputs = [ jdk ant saxon ];
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     description = "A RELAX NG validator in Java";
     # The homepage is www.thaiopensource.com, but it links to googlecode.com
     # for downloads and call it the "project site".
-    homepage = http://www.thaiopensource.com/relaxng/jing.html;
+    homepage = "http://www.thaiopensource.com/relaxng/trang.html";
     platforms = platforms.unix;
     maintainers = [ maintainers.bjornfor ];
   };
diff --git a/pkgs/tools/text/xml/xml2/default.nix b/pkgs/tools/text/xml/xml2/default.nix
index 203f0940990f..e96644b6d3cf 100644
--- a/pkgs/tools/text/xml/xml2/default.nix
+++ b/pkgs/tools/text/xml/xml2/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "01cps980m99y99cnmvydihga9zh3pvdsqag2fi1n6k2x7rfkl873";
   };
 
-  buildInputs = [ pkgconfig libxml2 ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libxml2 ];
 
   meta = with stdenv.lib; {
     homepage = http://ofb.net/~egnor/xml2/;
diff --git a/pkgs/tools/text/xml/xmlstarlet/default.nix b/pkgs/tools/text/xml/xmlstarlet/default.nix
index 5ad62cd7140b..4fe6ad6b3dc9 100644
--- a/pkgs/tools/text/xml/xmlstarlet/default.nix
+++ b/pkgs/tools/text/xml/xmlstarlet/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "1jp737nvfcf6wyb54fla868yrr39kcbijijmjpyk4lrpyg23in0m";
   };
 
-  buildInputs = [ pkgconfig libxml2 libxslt ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libxml2 libxslt ];
 
   preConfigure =
     ''
diff --git a/pkgs/tools/text/xsv/default.nix b/pkgs/tools/text/xsv/default.nix
index 12061b75a9de..23f172f4ebe1 100644
--- a/pkgs/tools/text/xsv/default.nix
+++ b/pkgs/tools/text/xsv/default.nix
@@ -4,16 +4,16 @@ with rustPlatform;
 
 buildRustPackage rec {
   name = "xsv-${version}";
-  version = "0.12.1";
+  version = "0.12.2";
 
   src = fetchFromGitHub {
     owner = "BurntSushi";
     repo = "xsv";
     rev = "${version}";
-    sha256 = "0xmjx5grwjrx2zsqmpblid9pqpwkk9pv468ffqlza3w35n9x5dax";
+    sha256 = "0z1z3b6nzaid510jaikkawvpmv4kjphzz84p0hppq6vcp5jy00s2";
   };
 
-  depsSha256 = "0gdbxgykhy6wm89mbdvl7ck2v0f66hwlm0m1q7r64bkb7i10fmkd";
+  cargoSha256 = "0pdzh2xr40dgwravh3i58g602bpszj6c8inggzgmq2kfk8ck6rgj";
 
   meta = with stdenv.lib; {
     description = "A fast CSV toolkit written in Rust";
diff --git a/pkgs/tools/text/zimreader/default.nix b/pkgs/tools/text/zimreader/default.nix
index 1c508a9cf7ec..f9debaaf0615 100644
--- a/pkgs/tools/text/zimreader/default.nix
+++ b/pkgs/tools/text/zimreader/default.nix
@@ -23,7 +23,9 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
   buildInputs = [ automake autoconf libtool zimlib cxxtools tntnet ];
-  setSourceRoot = "cd openzim-*/zimreader; export sourceRoot=`pwd`";
+  setSourceRoot = ''
+    sourceRoot=$(echo */zimreader)
+  '';
   preConfigure = "./autogen.sh";
 
   meta = {
diff --git a/pkgs/tools/text/zimwriterfs/default.nix b/pkgs/tools/text/zimwriterfs/default.nix
index 6fcbf5061d1d..5a5757bf2f2d 100644
--- a/pkgs/tools/text/zimwriterfs/default.nix
+++ b/pkgs/tools/text/zimwriterfs/default.nix
@@ -28,7 +28,9 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ automake autoconf libtool pkgconfig ];
   buildInputs = [ file icu libgumbo lzma zimlib zlib xapian ];
-  setSourceRoot = "cd openzim-*/zimwriterfs; export sourceRoot=`pwd`";
+  setSourceRoot = ''
+    sourceRoot=$(echo */zimwriterfs)
+  '';
   preConfigure = "./autogen.sh";
 
   meta = {
diff --git a/pkgs/tools/typesetting/asciidoctor/Gemfile.lock b/pkgs/tools/typesetting/asciidoctor/Gemfile.lock
index 34ed4a975a10..25800ed3a1ca 100644
--- a/pkgs/tools/typesetting/asciidoctor/Gemfile.lock
+++ b/pkgs/tools/typesetting/asciidoctor/Gemfile.lock
@@ -5,7 +5,7 @@ GEM
     addressable (2.5.0)
       public_suffix (~> 2.0, >= 2.0.2)
     afm (0.2.2)
-    asciidoctor (1.5.5)
+    asciidoctor (1.5.6.1)
     asciidoctor-bespoke (1.0.0.alpha.1)
       asciidoctor (>= 1.5.0)
       slim (~> 3.0.6)
@@ -16,7 +16,7 @@ GEM
       asciidoctor (~> 1.5, >= 1.5.2)
       htmlentities (~> 4.3)
       opal (~> 0.6.3)
-    asciidoctor-pdf (1.5.0.alpha.13)
+    asciidoctor-pdf (1.5.0.alpha.16)
       asciidoctor (>= 1.5.0)
       prawn (>= 1.3.0, < 3.0.0)
       prawn-icon (= 1.2.0)
diff --git a/pkgs/tools/typesetting/asciidoctor/gemset.nix b/pkgs/tools/typesetting/asciidoctor/gemset.nix
index c436d6f97518..43011b22b76a 100644
--- a/pkgs/tools/typesetting/asciidoctor/gemset.nix
+++ b/pkgs/tools/typesetting/asciidoctor/gemset.nix
@@ -26,10 +26,10 @@
   asciidoctor = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0kj2lls8f83nlhfkdkmbf7k5q9c9kk1cc15b1a4dy6arx4yzmvw7";
+      sha256 = "c4371c419306d69152809eb896c291ca09969dc26ca34be36f4eab82914fceca";
       type = "gem";
     };
-    version = "1.5.5";
+    version = "1.5.6.1";
   };
   asciidoctor-bespoke = {
     source = {
@@ -58,10 +58,10 @@
   asciidoctor-pdf = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0lp1q1yxy4y9k3znxxgj6pl0cbymz0yk5hsif73sg2bnpk62id9i";
+      sha256 = "0f6b2a1533577dfba218de5dd886771447e4d1cb670b81d2c3bf3a180e6029a1";
       type = "gem";
     };
-    version = "1.5.0.alpha.13";
+    version = "1.5.0.alpha.16";
   };
   concurrent-ruby = {
     source = {
@@ -287,4 +287,4 @@
     };
     version = "1.4.0";
   };
-}
\ No newline at end of file
+}
diff --git a/pkgs/tools/typesetting/djvu2pdf/default.nix b/pkgs/tools/typesetting/djvu2pdf/default.nix
index ce8a60dca869..eb560003a2cb 100644
--- a/pkgs/tools/typesetting/djvu2pdf/default.nix
+++ b/pkgs/tools/typesetting/djvu2pdf/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = {
-    description = "Creates djvu files from PDF files";
+    description = "Convert DjVu files to PDF files";
     homepage = http://0x2a.at/s/projects/djvu2pdf;
     license = stdenv.lib.licenses.gpl2;
     platforms = stdenv.lib.platforms.all;
diff --git a/pkgs/tools/typesetting/hevea/default.nix b/pkgs/tools/typesetting/hevea/default.nix
index 0e87ef5dacc1..e125c8e7f2fe 100644
--- a/pkgs/tools/typesetting/hevea/default.nix
+++ b/pkgs/tools/typesetting/hevea/default.nix
@@ -1,14 +1,14 @@
-{ stdenv, fetchurl, ocaml }:
+{ stdenv, fetchurl, ocamlPackages }:
 
 stdenv.mkDerivation rec {
-  name = "hevea-2.29";
+  name = "hevea-2.31";
 
   src = fetchurl {
     url = "http://pauillac.inria.fr/~maranget/hevea/distri/${name}.tar.gz";
-    sha256 = "1i7qkar6gjpsxqgdm90xxgp15z7gfyja0rn62n23a9aahc0hpgq6";
+    sha256 = "15xrnnqlacz8dpr09h7jgijm65wss99rmy9mb1zmapplmwhavmzv";
   };
 
-  buildInputs = [ ocaml ];
+  buildInputs = with ocamlPackages; [ ocaml ocamlbuild ];
 
   makeFlags = "PREFIX=$(out)";
 
@@ -17,6 +17,6 @@ stdenv.mkDerivation rec {
     homepage = http://pauillac.inria.fr/~maranget/hevea/;
     license = licenses.qpl;
     maintainers = with maintainers; [ pSub ];
-    platforms = with platforms; linux;
+    platforms = with platforms; unix;
   };
 }
diff --git a/pkgs/tools/typesetting/pdf2djvu/default.nix b/pkgs/tools/typesetting/pdf2djvu/default.nix
index 2318a146f62f..e4613802892e 100644
--- a/pkgs/tools/typesetting/pdf2djvu/default.nix
+++ b/pkgs/tools/typesetting/pdf2djvu/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, pkgconfig, djvulibre, poppler, fontconfig, libjpeg }:
 
 stdenv.mkDerivation rec {
-  version = "0.9.5";
+  version = "0.9.7";
   name = "pdf2djvu-${version}";
 
   src = fetchurl {
     url = "https://github.com/jwilk/pdf2djvu/releases/download/${version}/${name}.tar.xz";
-    sha256 = "0fr8b44rsqll2m6qnh9id1lfc980k7rj3aq975mwba4y57rwnlnc";
+    sha256 = "1h92f9prx69wz9h57lncxj8ddh2xg6q7hjhlqqzzf30k59il4zcy";
   };
 
   nativeBuildInputs = [ pkgconfig ];
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "Creates djvu files from PDF files";
-    homepage = http://code.google.com/p/pdf2djvu/;
+    homepage = https://jwilk.net/software/pdf2djvu;
     license = licenses.gpl2;
     maintainers = with maintainers; [ pSub ];
     inherit version;
diff --git a/pkgs/tools/typesetting/pdf2odt/default.nix b/pkgs/tools/typesetting/pdf2odt/default.nix
index 4f798702101b..902cf9a5f836 100644
--- a/pkgs/tools/typesetting/pdf2odt/default.nix
+++ b/pkgs/tools/typesetting/pdf2odt/default.nix
@@ -1,21 +1,7 @@
 { stdenv, lib, makeWrapper, fetchFromGitHub
 , bc, coreutils, file, gawk, ghostscript, gnused, imagemagick, zip }:
 
-stdenv.mkDerivation rec {
-  version = "2014-12-17";
-  name = "pdf2odt-${version}";
-
-  src = fetchFromGitHub {
-    owner = "gutschke";
-    repo = "pdf2odt";
-    rev = "master";
-    sha256 = "14f9r5f0g6jzanl54jv86ls0frvspka1p9c8dy3fnriqpm584j0r";
-  };
-
-  dontStrip = true;
-
-  nativeBuildInputs = [ makeWrapper ];
-
+let
   path = lib.makeBinPath [
     bc
     coreutils
@@ -27,24 +13,36 @@ stdenv.mkDerivation rec {
     zip
   ];
 
+in stdenv.mkDerivation rec {
+  name = "pdf2odt-${version}";
+  version = "20170207";
+
+  src = fetchFromGitHub {
+    owner  = "gutschke";
+    repo   = "pdf2odt";
+    rev    = "4533bd14306c30c085001db59dbb8114ea09c360";
+    sha256 = "14f9r5f0g6jzanl54jv86ls0frvspka1p9c8dy3fnriqpm584j0r";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+
   patches = [ ./use_mktemp.patch ];
 
   installPhase = ''
-    mkdir -p $out/bin $out/share/doc
+    install -Dm0755 pdf2odt           -t $out/bin
+    install -Dm0644 README.md LICENSE -t $out/share/doc/pdf2odt
 
-    install -m0755 pdf2odt $out/bin/pdf2odt
     ln -rs $out/bin/pdf2odt $out/bin/pdf2ods
 
-    install -m0644 README.md LICENSE -t $out/share/doc
-
-    wrapProgram $out/bin/pdf2odt --prefix PATH : ${path}
+    wrapProgram $out/bin/pdf2odt \
+      --prefix PATH : ${path}
   '';
 
   meta = with stdenv.lib; {
     description = "PDF to ODT format converter";
-    homepage = http://github.com/gutschke/pdf2odt;
-    license = licenses.mit;
-    platforms = platforms.all;
+    homepage    = http://github.com/gutschke/pdf2odt;
+    license     = licenses.mit;
+    platforms   = platforms.all;
     maintainers = with maintainers; [ peterhoeg ];
     inherit version;
   };
diff --git a/pkgs/tools/typesetting/pygmentex/default.nix b/pkgs/tools/typesetting/pygmentex/default.nix
index c19447cc0c4a..fef6c9087c53 100644
--- a/pkgs/tools/typesetting/pygmentex/default.nix
+++ b/pkgs/tools/typesetting/pygmentex/default.nix
@@ -1,12 +1,14 @@
-{ stdenv, fetchzip, python2Packages }:
+{ stdenv, fetchFromBitbucket, python2Packages }:
 
 python2Packages.buildPythonApplication rec {
   name = "pygmentex-${version}";
   version = "0.8";
 
-  src = fetchzip {
-      url = "http://mirrors.ctan.org/macros/latex/contrib/pygmentex.zip";
-      sha256 = "1nm19pvhlv51mv2sdankndhw64ys9r7ch6szzd6i4jz8zr86kn9v";
+  src = fetchFromBitbucket {
+    owner = "romildo";
+    repo = "pygmentex";
+    rev = version;
+    sha256 = "07dnv7hgppy15bda2kcbrlvfqzl6lhza80klc7133dwg8q92hm6m";
   };
 
   pythonPath = [ python2Packages.pygments python2Packages.chardet ];
@@ -38,7 +40,7 @@ python2Packages.buildPythonApplication rec {
       texlive.combine.
     '';
     license = licenses.lppl13c;
-    maintainers = with maintainers; [ romildo ];
     platforms = platforms.unix;
+    maintainers = with maintainers; [ romildo ];
   };
 }
diff --git a/pkgs/tools/typesetting/sshlatex/default.nix b/pkgs/tools/typesetting/sshlatex/default.nix
new file mode 100644
index 000000000000..bfc1a8eb162e
--- /dev/null
+++ b/pkgs/tools/typesetting/sshlatex/default.nix
@@ -0,0 +1,38 @@
+{ stdenv, fetchFromGitHub, inotify-tools, openssh, perl, gnutar, bash, makeWrapper }:
+
+stdenv.mkDerivation rec {
+  name = "sshlatex-${version}";
+  version = "0.7";
+
+  src = fetchFromGitHub {
+    owner = "iblech";
+    repo = "sshlatex";
+    rev = "${version}";
+    sha256 = "02h81i8n3skg9jnlfrisyg5bhqicrn6svq64kp20f70p64s3d7ix";
+  };
+
+  buildInputs = [ makeWrapper ];
+
+  installPhase = let
+    binPath = stdenv.lib.makeBinPath [ openssh perl gnutar bash inotify-tools ];
+  in ''
+    mkdir -p $out/bin
+    cp sshlatex $out/bin
+    wrapProgram $out/bin/sshlatex --prefix PATH : "${binPath}"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A collection of hacks to efficiently run LaTeX via ssh";
+    longDescription = ''
+      sshlatex is a tool which uploads LaTeX source files to a remote, runs
+      LaTeX there, and streams the resulting PDF file to the local host.
+      Because sshlatex prestarts LaTeX with the previous run's preamble,
+      thereby preloading the required LaTeX packages, it is also useful in a
+      purely local setting.
+    '';
+    homepage = https://github.com/iblech/sshlatex;
+    license = stdenv.lib.licenses.gpl3Plus;  # actually dual-licensed gpl3Plus | lppl13cplus
+    platforms = stdenv.lib.platforms.all;
+    maintainers = [ maintainers.iblech ];
+  };
+}
diff --git a/pkgs/tools/typesetting/tectonic/default.nix b/pkgs/tools/typesetting/tectonic/default.nix
new file mode 100644
index 000000000000..3fdebd19f3cb
--- /dev/null
+++ b/pkgs/tools/typesetting/tectonic/default.nix
@@ -0,0 +1,33 @@
+{ stdenv, fetchFromGitHub, rustPlatform, makeWrapper
+, fontconfig, harfbuzz-icu, openssl, pkgconfig }:
+
+with rustPlatform;
+
+buildRustPackage rec {
+  name = "tectonic-${version}";
+  version = "0.1.6";
+
+  src = fetchFromGitHub {
+    owner = "tectonic-typesetting";
+    repo = "tectonic";
+    rev = "v${version}";
+    sha256 = "0k5vkn112bjwh4wnxryzqz79dlja64k7s105mf3yaik136hqnmqv";
+  };
+
+  cargoSha256 = "03bqhgz8c4ipdkd3g448bcrr6d188h87vskcfcc3mqlcxg77b8q5";
+
+  nativeBuildInputs = [ pkgconfig ];
+
+  buildInputs = [ fontconfig harfbuzz-icu openssl ];
+
+  # tests fail due to read-only nix store
+  doCheck = false;
+
+  meta = with stdenv.lib; {
+    description = "Modernized, complete, self-contained TeX/LaTeX engine, powered by XeTeX and TeXLive";
+    homepage = https://tectonic-typesetting.github.io/;
+    license = with licenses; [ mit ];
+    maintainers = [ maintainers.lluchs ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/tools/typesetting/tex/texlive/bin.nix b/pkgs/tools/typesetting/tex/texlive/bin.nix
index c15f165013b9..30979e312fc5 100644
--- a/pkgs/tools/typesetting/tex/texlive/bin.nix
+++ b/pkgs/tools/typesetting/tex/texlive/bin.nix
@@ -61,8 +61,8 @@ core = stdenv.mkDerivation rec {
 
   outputs = [ "out" "doc" ];
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    pkgconfig
     /*teckit*/ zziplib poppler mpfr gmp
     pixman potrace gd freetype libpng libpaper zlib
     perl
@@ -156,6 +156,7 @@ core-big = stdenv.mkDerivation { #TODO: upmendex
 
   hardeningDisable = [ "format" ];
 
+  inherit (core) nativeBuildInputs;
   buildInputs = core.buildInputs ++ [ core cairo harfbuzz icu graphite2 ];
 
   configureFlags = common.configureFlags
@@ -186,6 +187,7 @@ core-big = stdenv.mkDerivation { #TODO: upmendex
   '';
 
   preBuild = "cd texk/web2c";
+  CXXFLAGS = "-std=c++11 -Wno-reserved-user-defined-literal"; # TODO: remove once texlive 2017 is out?
   enableParallelBuilding = true;
 
   # now distribute stuff into outputs, roughly as upstream TL
@@ -209,7 +211,8 @@ dvisvgm = stdenv.mkDerivation {
 
   inherit (common) src;
 
-  buildInputs = [ pkgconfig core/*kpathsea*/ ghostscript zlib freetype potrace ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ core/*kpathsea*/ ghostscript zlib freetype potrace ];
 
   preConfigure = "cd texk/dvisvgm";
 
@@ -225,7 +228,8 @@ dvipng = stdenv.mkDerivation {
 
   inherit (common) src;
 
-  buildInputs = [ pkgconfig core/*kpathsea*/ zlib libpng freetype gd ghostscript makeWrapper ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ core/*kpathsea*/ zlib libpng freetype gd ghostscript makeWrapper ];
 
   preConfigure = "cd texk/dvipng";
 
@@ -247,7 +251,8 @@ bibtex8 = stdenv.mkDerivation {
 
   inherit (common) src;
 
-  buildInputs = [ pkgconfig core/*kpathsea*/ icu ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ core/*kpathsea*/ icu ];
 
   preConfigure = "cd texk/bibtex-x";
 
@@ -263,7 +268,8 @@ xdvi = stdenv.mkDerivation {
 
   inherit (common) src;
 
-  buildInputs = [ pkgconfig core/*kpathsea*/ freetype ghostscript ]
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ core/*kpathsea*/ freetype ghostscript ]
     ++ (with xorg; [ libX11 libXaw libXi libXpm libXmu libXaw libXext libXfixes ]);
 
   preConfigure = "cd texk/xdvik";
diff --git a/pkgs/tools/typesetting/tex/texlive/combine.nix b/pkgs/tools/typesetting/tex/texlive/combine.nix
index 9af1d6a59ffd..390b7b9e5e00 100644
--- a/pkgs/tools/typesetting/tex/texlive/combine.nix
+++ b/pkgs/tools/typesetting/tex/texlive/combine.nix
@@ -15,7 +15,10 @@ let
   pkgList = rec {
     all = lib.filter pkgFilter (combinePkgs pkgSet);
     splitBin = lib.partition (p: p.tlType == "bin") all;
-    bin = mkUniquePkgs splitBin.right;
+    bin = mkUniquePkgs splitBin.right
+      ++ lib.optional
+          (lib.any (p: p.tlType == "run" && p.pname == "pdfcrop") splitBin.wrong)
+          (lib.getBin ghostscript);
     nonbin = mkUniquePkgs splitBin.wrong;
 
     # extra interpreters needed for shebangs, based on 2015 schemes "medium" and "tetex"
diff --git a/pkgs/tools/typesetting/tex/texlive/default.nix b/pkgs/tools/typesetting/tex/texlive/default.nix
index 13eb90c77af3..7665d277e38f 100644
--- a/pkgs/tools/typesetting/tex/texlive/default.nix
+++ b/pkgs/tools/typesetting/tex/texlive/default.nix
@@ -30,6 +30,7 @@ let
     inherit bin combinePkgs buildEnv fastUnique lib makeWrapper writeText
       stdenv python ruby;
     perl = perl522; # avoid issues like #26890, probably remove after texlive upgrade
+    ghostscript = ghostscriptX; # could be without X, probably, but we use X above
   };
 
   # the set of TeX Live packages, collections, and schemes; using upstream naming
diff --git a/pkgs/tools/typesetting/xmlroff/default.nix b/pkgs/tools/typesetting/xmlroff/default.nix
index 05ce5057347d..2177937221a1 100644
--- a/pkgs/tools/typesetting/xmlroff/default.nix
+++ b/pkgs/tools/typesetting/xmlroff/default.nix
@@ -10,8 +10,8 @@ stdenv.mkDerivation rec {
     sha256 = "1sczn6xjczsfdxlbjqv4xqlki2a95y2s8ih2nl9v1vhqfk17fiww";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    pkgconfig
     autoconf
     automake
     libxml2
diff --git a/pkgs/tools/video/dvgrab/default.nix b/pkgs/tools/video/dvgrab/default.nix
index 73986b5be05d..cec4fc1ce8bf 100644
--- a/pkgs/tools/video/dvgrab/default.nix
+++ b/pkgs/tools/video/dvgrab/default.nix
@@ -1,34 +1,39 @@
-{ fetchurl, stdenv, libunwind, libraw1394, libjpeg, libiec61883, libdv
-, libavc1394, pkgconfig }:
+{ fetchFromGitHub, stdenv, libunwind, libraw1394, libjpeg, libiec61883, libdv
+, libavc1394, pkgconfig, autoreconfHook }:
 
 stdenv.mkDerivation rec {
-  name = "dvgrab-3.5";
+  name = "dvgrab-2016-05-16";
 
-  src = fetchurl {
-    url = "mirror://sourceforge/kino/${name}.tar.gz";
-    sha256 = "1y8arv14nc9sf8njfcxf96pb4nyimpsly1fnhcbj406k54s1h42r";
+  src = fetchFromGitHub {
+    # mirror of original project with some build fixes
+    owner = "ddennedy";
+    repo = "dvgrab";
+    rev = "e46042e0c7b3523b6854ee547b0534e8310b7460";
+    sha256 = "17qy76fjpzrbxm4pj0ljx5lbimxryv24fvr13jwkh24j85dxailn";
   };
 
-  buildInputs =
-    [ libunwind libraw1394 libjpeg libiec61883 libdv libavc1394
-      pkgconfig
-    ];
+  buildInputs = [
+    libunwind libraw1394 libjpeg libiec61883 libdv libavc1394
+  ];
 
-  meta = {
+  nativeBuildInputs = [
+    autoreconfHook pkgconfig
+  ];
+
+  meta = with stdenv.lib; {
     description = "Receive and store audio & video over IEEE1394";
 
-    longDescription =
-      '' dvgrab receives audio and video data from a digital camcorder via an
-         IEEE1394 (widely known as FireWire) or USB link and stores them into
-         one of several file formats. It features autosplit of long video
-         sequences, and supports saving the data as raw frames, AVI type 1,
-         AVI type 2, Quicktime DV, a series of JPEG stills or MPEG2-TS.
-      '';
+    longDescription = ''
+      dvgrab receives audio and video data from a digital camcorder via an
+      IEEE1394 (widely known as FireWire) or USB link and stores them into
+      one of several file formats. It features autosplit of long video
+      sequences, and supports saving the data as raw frames, AVI type 1,
+      AVI type 2, Quicktime DV, a series of JPEG stills or MPEG2-TS.
+    '';
 
     homepage = http://kinodv.org/;
 
-    license = stdenv.lib.licenses.gpl2Plus;
-    platforms = stdenv.lib.platforms.gnu;
-    maintainers = [ ];
+    license = licenses.gpl2Plus;
+    platforms = platforms.gnu;
   };
 }
diff --git a/pkgs/tools/video/mjpegtools/default.nix b/pkgs/tools/video/mjpegtools/default.nix
index 3b02f0d3e2ca..197caca0d86c 100644
--- a/pkgs/tools/video/mjpegtools/default.nix
+++ b/pkgs/tools/video/mjpegtools/default.nix
@@ -17,7 +17,8 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "format" ];
 
-  buildInputs = [ libdv libjpeg libpng pkgconfig ]
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libdv libjpeg libpng ]
               ++ lib.optionals (!withMinimal) [ gtk2 libX11 SDL SDL_gfx ];
 
   NIX_CFLAGS_COMPILE = lib.optional (!withMinimal) "-I${SDL.dev}/include/SDL";
diff --git a/pkgs/tools/video/swfmill/default.nix b/pkgs/tools/video/swfmill/default.nix
index 4df4e3f5428f..3832f3c3be0c 100644
--- a/pkgs/tools/video/swfmill/default.nix
+++ b/pkgs/tools/video/swfmill/default.nix
@@ -10,7 +10,11 @@ stdenv.mkDerivation rec {
     sha256 = "15mcpql448vvgsbxs7wd0vdk1ln6rdcpnif6i2zjm5l4xng55s7r";
   };
 
-  buildInputs = [ pkgconfig libxslt freetype libpng libxml2 ];
+  # Fixes build with GCC 6
+  NIX_CFLAGS_COMPILE = "-std=c++03";
+
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libxslt freetype libpng libxml2 ];
 
   meta = {
     description = "An xml2swf and swf2xml processor with import functionalities";
diff --git a/pkgs/tools/virtualization/awsebcli/default.nix b/pkgs/tools/virtualization/awsebcli/default.nix
new file mode 100644
index 000000000000..7439af275608
--- /dev/null
+++ b/pkgs/tools/virtualization/awsebcli/default.nix
@@ -0,0 +1,109 @@
+{ stdenv, python }:
+let
+
+  localPython = python.override {
+    packageOverrides = self: super: rec {
+      cement = super.cement.overridePythonAttrs (oldAttrs: rec {
+        version = "2.8.2";
+
+        src = super.fetchPypi {
+          inherit (oldAttrs) pname;
+          inherit version;
+          sha256 = "1li2whjzfhbpg6fjb6r1r92fb3967p1xv6hqs3j787865h2ysrc7";
+        };
+      });
+
+      colorama = super.colorama.overridePythonAttrs (oldAttrs: rec {
+        version = "0.3.7";
+
+        src = super.fetchPypi {
+          inherit (oldAttrs) pname;
+          inherit version;
+          sha256 = "0avqkn6362v7k2kg3afb35g4sfdvixjgy890clip4q174p9whhz0";
+        };
+      });
+
+      docker = super.docker.overridePythonAttrs (oldAttrs: rec {
+          pname = "docker-py";
+          version = "1.7.2";
+          name = "${pname}-${version}";
+
+          src = super.fetchPypi {
+            inherit pname version;
+            sha256 = "0k6hm3vmqh1d3wr9rryyif5n4rzvcffdlb1k4jvzp7g4996d3ccm";
+          };
+        });
+
+      pathspec = super.pathspec.overridePythonAttrs (oldAttrs: rec {
+        version = "0.5.0";
+
+        src = super.fetchPypi {
+          inherit (oldAttrs) pname;
+          inherit version;
+          sha256 = "07yx1gxj9v1iyyiy5fhq2wsmh4qfbrx158wi7jb0nx6lah80ffma";
+        };
+      });
+
+      requests = super.requests.overridePythonAttrs (oldAttrs: rec {
+        version = "2.9.1";
+
+        src = super.fetchPypi {
+          inherit (oldAttrs) pname;
+          inherit version;
+          sha256 = "0zsqrzlybf25xscgi7ja4s48y2abf9wvjkn47wh984qgs1fq2xy5";
+        };
+      });
+
+      semantic-version = super.semantic-version.overridePythonAttrs (oldAttrs: rec {
+        version = "2.5.0";
+
+        src = super.fetchPypi {
+          inherit (oldAttrs) pname; inherit version;
+          sha256 = "0p5n3d6blgkncxdz00yxqav0cis87fisdkirjm0ljjh7rdfx7aiv";
+        };
+      });
+
+      tabulate = super.tabulate.overridePythonAttrs (oldAttrs: rec {
+        version = "0.7.5";
+
+        src = super.fetchPypi {
+          inherit (oldAttrs) pname;
+          inherit version;
+          sha256 = "03l1r7ddd1a0j2snv1yd0hlnghjad3fg1an1jr8936ksv75slwch";
+        };
+      });
+    };
+  };
+in with localPython.pkgs; buildPythonApplication rec {
+  name = "${pname}-${version}";
+  pname = "awsebcli";
+  version = "3.12.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0ljras4bgxpmk1l3plialmhi7jsm2cpzx0dcs9411ijykzkamdkd";
+  };
+
+  checkInputs = [
+    pytest mock nose pathspec colorama requests docutils
+  ];
+
+  doCheck = false;
+
+  propagatedBuildInputs = [
+    blessed botocore cement colorama docker dockerpty docopt pathspec pyyaml
+    requests semantic-version setuptools tabulate termcolor websocket_client
+  ];
+
+  postInstall = ''
+    mkdir -p $out/etc/bash_completion.d
+    mv $out/bin/eb_completion.bash $out/etc/bash_completion.d
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = http://aws.amazon.com/elasticbeanstalk/;
+    description = "A command line interface for Elastic Beanstalk.";
+    maintainers = with maintainers; [ eqyiel ];
+    license = licenses.asl20;
+  };
+}
diff --git a/pkgs/tools/virtualization/google-compute-engine/0001-allow-nologin-other-paths.patch b/pkgs/tools/virtualization/google-compute-engine/0001-allow-nologin-other-paths.patch
deleted file mode 100644
index 650e80c24fbe..000000000000
--- a/pkgs/tools/virtualization/google-compute-engine/0001-allow-nologin-other-paths.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From 2e9ac201af238b742c7032962b9b12a8b66bab0c Mon Sep 17 00:00:00 2001
-From: zimbatm <zimbatm@zimbatm.com>
-Date: Mon, 29 May 2017 22:36:15 +0100
-Subject: [PATCH] allow nologin on other paths
-
----
- google_compute_engine/accounts/accounts_utils.py | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/google_compute_engine/accounts/accounts_utils.py b/google_compute_engine/accounts/accounts_utils.py
-index 57e62be..d7eda06 100644
---- a/google_compute_engine/accounts/accounts_utils.py
-+++ b/google_compute_engine/accounts/accounts_utils.py
-@@ -295,8 +295,8 @@ class AccountsUtils(object):
-     # logins. This helps avoid problems caused by operator and root sharing
-     # a home directory in CentOS and RHEL.
-     pw_entry = self._GetUser(user)
--    if pw_entry and pw_entry.pw_shell == '/sbin/nologin':
--      message = 'Not updating user %s. User set /sbin/nologin as login shell.'
-+    if pw_entry and os.path.basename(pw_entry.pw_shell) == 'nologin':
-+      message = 'Not updating user %s. User set `nologin` as login shell.'
-       self.logger.debug(message, user)
-       return True
- 
--- 
-2.13.0
-
diff --git a/pkgs/tools/virtualization/google-compute-engine/default.nix b/pkgs/tools/virtualization/google-compute-engine/default.nix
index 7a5350fe2eb9..bd766d7c5a9f 100644
--- a/pkgs/tools/virtualization/google-compute-engine/default.nix
+++ b/pkgs/tools/virtualization/google-compute-engine/default.nix
@@ -1,27 +1,26 @@
 { lib
 , fetchFromGitHub
-, pythonPackages
+, buildPythonApplication
 , bash
 , shadow
 , systemd
 , utillinux
+, boto
+, setuptools
 }:
-let
-  version = "20170523";
-in
-pythonPackages.buildPythonApplication {
+
+buildPythonApplication rec {
   name = "google-compute-engine-${version}";
+  version = "20170914";
   namePrefix = "";
 
   src = fetchFromGitHub {
     owner = "GoogleCloudPlatform";
     repo = "compute-image-packages";
     rev = version;
-    sha256 = "1qxyj3lj9in6m8yi6y6wcmc3662h9z4qax07v97rdnay99mxdv68";
+    sha256 = "0hlzcrf6yhzan25f4wzy1vbncak9whhqzrzza026ly3sq0smmjpg";
   };
 
-  patches = [ ./0001-allow-nologin-other-paths.patch ];
-
   postPatch = ''
     for file in $(find google_compute_engine -type f); do
       substituteInPlace "$file" \
@@ -44,11 +43,11 @@ pythonPackages.buildPythonApplication {
     cp -r google_config/udev/*.rules $out/lib/udev/rules.d
   '';
 
-  propagatedBuildInputs = with pythonPackages; [ boto setuptools ];
+  propagatedBuildInputs = [ boto setuptools ];
 
   meta = with lib; {
     description = "Google Compute Engine tools and services";
-    homepage = https://github.com/GoogleCloudPlatform/compute-image-packages;
+    homepage = "https://github.com/GoogleCloudPlatform/compute-image-packages";
     license = licenses.asl20;
     maintainers = with maintainers; [ zimbatm ];
   };