Merge remote-tracking branch 'upstream/staging' into deps-reorg

65 files changed, 682 insertions, 258 deletions

diff --git a/pkgs/tools/X11/sct/DISPLAY-segfault.patch b/pkgs/tools/X11/sct/DISPLAY-segfault.patch
new file mode 100644
index 000000000000..6b83afa332ba
--- /dev/null
+++ b/pkgs/tools/X11/sct/DISPLAY-segfault.patch
@@ -0,0 +1,10 @@
+--- a/sct.c	2017-09-22 00:44:20.270421881 +0000
++++ b/sct.c	2017-09-26 10:50:38.964562740 +0000
+@@ -36,6 +36,7 @@
+ main(int argc, char **argv)
+ {
+ 	Display *dpy = XOpenDisplay(NULL);
++	if (!dpy) exit(1);
+ 	int screen = DefaultScreen(dpy);
+ 	Window root = RootWindow(dpy, screen);
+ 
diff --git a/pkgs/tools/X11/sct/default.nix b/pkgs/tools/X11/sct/default.nix
index 1890e9c5266b..9f45bbe30871 100644
--- a/pkgs/tools/X11/sct/default.nix
+++ b/pkgs/tools/X11/sct/default.nix
@@ -1,31 +1,26 @@
-{stdenv, fetchurl, libX11, libXrandr}:
+{ stdenv, fetchurl, libX11, libXrandr }:
+
 stdenv.mkDerivation rec {
   name = "sct";
-  buildInputs = [libX11 libXrandr];
+
   src = fetchurl {
     url = http://www.tedunangst.com/flak/files/sct.c;
     sha256 = "01f3ndx3s6d2qh2xmbpmhd4962dyh8yp95l87xwrs4plqdz6knhd";
-    
-    # Discussion regarding the checksum and the source code can be found in issue #17163 
-    # The code seems unmaintained, yet an unknown (probably small change) in the code caused 
-    # failed builds as the checksum had changed.
-    # The checksum is updated for now, however, this is unpractical and potentially unsafe 
-    # so any future changes might warrant a fork of the (feature complete) project. 
-    # The code is under public domain.
-    
   };
-  phases = ["patchPhase" "buildPhase" "installPhase"];
-  patchPhase = ''
-    sed -re "/Xlibint/d" ${src} > sct.c 
-  '';
-  buildPhase = "gcc -std=c99 sct.c -o sct -lX11 -lXrandr -lm";
-  installPhase = ''
-    mkdir -p "$out/bin"
-    cp sct "$out/bin"
-  '';
-  meta = {
-    description = ''A minimal utility to set display colour temperature'';
-    maintainers = [stdenv.lib.maintainers.raskin];
-    platforms = with stdenv.lib.platforms; linux ++ freebsd ++ openbsd;
+
+  unpackPhase = "cat ${src} > sct.c";
+  patches = [ ./DISPLAY-segfault.patch ];
+
+  buildInputs = [ libX11 libXrandr ];
+  buildPhase = "cc sct.c -o sct -lm -lX11 -lXrandr";
+
+  installPhase = "install -Dt $out/bin sct";
+
+  meta = with stdenv.lib; {
+    homepage = https://www.tedunangst.com/flak/post/sct-set-color-temperature;
+    description = "A minimal utility to set display colour temperature";
+    maintainers = [ maintainers.raskin ];
+    license = licenses.publicDomain;
+    platforms = with platforms; linux ++ freebsd ++ openbsd;
   };
 }
diff --git a/pkgs/tools/X11/xwinwrap/default.nix b/pkgs/tools/X11/xwinwrap/default.nix
new file mode 100644
index 000000000000..6ea24ad2c6aa
--- /dev/null
+++ b/pkgs/tools/X11/xwinwrap/default.nix
@@ -0,0 +1,54 @@
+{ stdenv, fetchbzr, x11 }:
+
+let
+  version = "4";
+in
+stdenv.mkDerivation {
+  name = "xwinwrap-${version}";
+
+  src = fetchbzr {
+    url = https://code.launchpad.net/~shantanu-goel/xwinwrap/devel;
+    rev = version;
+    sha256 = "1annhqc71jcgx5zvcy31c1c488ygx4q1ygrwyy2y0ww743smbchw";
+  };
+
+  buildInputs = [
+    x11
+  ];
+
+  buildPhase = if stdenv.system == "x86_64-linux" then ''
+    make all64
+  '' else if stdenv.system == "i686-linux" then ''
+    make all32
+  '' else throw "xwinwrap is not supported on ${stdenv.system}";
+
+  installPhase = ''
+    mkdir -p $out/bin
+    mv */xwinwrap $out/bin
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A utility that allows you to use an animated X window as the wallpaper";
+    longDescription = ''
+      XWinWrap is a small utility written a loooong time ago that allowed you to
+      stick most of the apps to your desktop background. What this meant was you
+      could use an animated screensaver (like glmatrix, electric sheep, etc) or
+      even a movie, and use it as your wallpaper. But only one version of this
+      app was ever released, and it had a few problems, like:
+
+      - Well, sticking didn’t work. So if you did a “minimize all” or “go to
+      desktop” kind of thing, your “wallpaper” got minimized as well.
+
+      - The geometry option didn’t work, so you could not create, e.g., a small
+      matrix window surrounded by your original wallpaper.
+
+      Seeing no-one picking it up, I decided to give it a bit of polish last
+      weekend by fixing the above problems and also add a few features. And here
+      it is, in its new avatar “Shantz XWinWrap”.
+    '';
+    license = licenses.hpnd;
+    homepage = https://shantanugoel.com/2008/09/03/shantz-xwinwrap/;
+    maintainers = with maintainers; [ infinisil ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/tools/admin/google-cloud-sdk/default.nix b/pkgs/tools/admin/google-cloud-sdk/default.nix
index d31f3023c969..f1165f6172b2 100644
--- a/pkgs/tools/admin/google-cloud-sdk/default.nix
+++ b/pkgs/tools/admin/google-cloud-sdk/default.nix
@@ -1,33 +1,33 @@
-{stdenv, fetchurl, python27, python27Packages, makeWrapper}:
-
-with python27Packages;
+{ stdenv, lib, fetchurl, python, cffi, cryptography, pyopenssl, crcmod, google-compute-engine, makeWrapper }:
 
 # other systems not supported yet
-assert stdenv.system == "i686-linux" || stdenv.system == "x86_64-linux" || stdenv.system == "x86_64-darwin";
+let
+  pythonInputs = [ cffi cryptography pyopenssl crcmod google-compute-engine ];
+  pythonPath = lib.makeSearchPath python.sitePackages pythonInputs;
 
-stdenv.mkDerivation rec {
+in stdenv.mkDerivation rec {
   name = "google-cloud-sdk-${version}";
-  version = "161.0.0";
+  version = "171.0.0";
 
   src =
     if stdenv.system == "i686-linux" then
       fetchurl {
         url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/${name}-linux-x86.tar.gz";
-        sha256 = "43a78a9d2c3ee9d9e50200b1e90512cd53ded40b56e05effe31fe9847b1bdd4c";
+        sha256 = "0scp9nhd46mrnd02bw7skm5fa04i7azf68g08js8kawvjgbwq0sb";
       }
     else if stdenv.system == "x86_64-darwin" then
       fetchurl {
         url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/${name}-darwin-x86_64.tar.gz";
-        sha256 = "0706dbea1279be2bc98a497d1bfed61a9cc29c305d908a376bcdb4403035b323";
+        sha256 = "0xvrqsg0vqws9n20lvipxilb45aln5p9iy0ldjfxx8vvi0s42298";
       }
     else
       fetchurl {
         url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/${name}-linux-x86_64.tar.gz";
-        sha256 = "7aa6094d1f9c87f4c2c4a6bdad6a1113aac5e72ea673e659d9acbb059dfd037e";
+        sha256 = "0b9rqhwd30hn5l82a2x10rz86jz1j03b19di7bc3bqn4x041qii5";
       };
 
 
-  buildInputs = [python27 makeWrapper];
+  buildInputs = [ python makeWrapper ];
 
   phases = [ "installPhase" "fixupPhase" ];
 
@@ -46,16 +46,13 @@ stdenv.mkDerivation rec {
         programPath="$out/google-cloud-sdk/bin/$program"
         binaryPath="$out/bin/$program"
         wrapProgram "$programPath" \
-            --set CLOUDSDK_PYTHON "${python27}/bin/python" \
-            --prefix PYTHONPATH : "$(toPythonPath ${cffi}):$(toPythonPath ${cryptography}):$(toPythonPath ${pyopenssl}):$(toPythonPath ${crcmod})"
+            --set CLOUDSDK_PYTHON "${python}/bin/python" \
+            --prefix PYTHONPATH : "${pythonPath}"
 
         mkdir -p $out/bin
         ln -s $programPath $binaryPath
     done
 
-    # install man pages
-    mv "$out/google-cloud-sdk/help/man" "$out"
-
     # setup bash completion
     mkdir -p "$out/etc/bash_completion.d/"
     mv "$out/google-cloud-sdk/completion.bash.inc" "$out/etc/bash_completion.d/gcloud.inc"
@@ -68,11 +65,10 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     description = "Tools for the google cloud platform";
     longDescription = "The Google Cloud SDK. This package has the programs: gcloud, gsutil, and bq";
-    version = version;
     # This package contains vendored dependencies. All have free licenses.
     license = licenses.free;
-    homepage = https://cloud.google.com/sdk/;
-    maintainers = with maintainers; [stephenmw zimbatm];
-    platforms = with platforms; linux ++ darwin;
+    homepage = "https://cloud.google.com/sdk/";
+    maintainers = with maintainers; [ stephenmw zimbatm ];
+    platforms = [ "i686-linux" "x86_64-linux" "x86_64-darwin" ];
   };
 }
diff --git a/pkgs/tools/admin/salt/default.nix b/pkgs/tools/admin/salt/default.nix
index 7fdef68f30f7..5afe14209f64 100644
--- a/pkgs/tools/admin/salt/default.nix
+++ b/pkgs/tools/admin/salt/default.nix
@@ -8,12 +8,12 @@
 
 python2Packages.buildPythonApplication rec {
   pname = "salt";
-  version = "2016.11.5";
+  version = "2017.7.1";
   name = "${pname}-${version}";
 
   src = python2Packages.fetchPypi {
     inherit pname version;
-    sha256 = "1gpq6s87vy782z4b5h6s7zwndcxnllbdr2wldxr9hyp4lfj2f55q";
+    sha256 = "079kymgxyzhf47dd42l7f42jp45gx5im4k3g31bj25p1s0aq91py";
   };
 
   propagatedBuildInputs = with python2Packages; [
diff --git a/pkgs/tools/admin/salt/fix-libcrypto-loading.patch b/pkgs/tools/admin/salt/fix-libcrypto-loading.patch
index fa2c5c0aa521..f7560b1fc56d 100644
--- a/pkgs/tools/admin/salt/fix-libcrypto-loading.patch
+++ b/pkgs/tools/admin/salt/fix-libcrypto-loading.patch
@@ -1,11 +1,14 @@
 diff --git a/salt/utils/rsax931.py b/salt/utils/rsax931.py
-index 9eb1f4a..d764f7a 100644
+index f827cc6db8..b728595186 100644
 --- a/salt/utils/rsax931.py
 +++ b/salt/utils/rsax931.py
-@@ -36,7 +36,6 @@ def _load_libcrypto():
-                 'libcrypto.so*'))
+@@ -47,6 +47,9 @@ def _load_libcrypto():
              lib = lib[0] if len(lib) > 0 else None
--        if lib:
--            return cdll.LoadLibrary(lib)
-+        return cdll.LoadLibrary('@libcrypto@')
+         if lib:
+             return cdll.LoadLibrary(lib)
++        else:
++            return cdll.LoadLibrary('@libcrypto@')
++
          raise OSError('Cannot locate OpenSSL libcrypto')
+ 
+ 
diff --git a/pkgs/tools/filesystems/encfs/default.nix b/pkgs/tools/filesystems/encfs/default.nix
index 518edbb3ea4e..3df76d828318 100644
--- a/pkgs/tools/filesystems/encfs/default.nix
+++ b/pkgs/tools/filesystems/encfs/default.nix
@@ -5,10 +5,10 @@
 
 stdenv.mkDerivation rec {
   name = "encfs-${version}";
-  version = "1.9.1";
+  version = "1.9.2";
 
   src = fetchFromGitHub {
-    sha256 = "1pyldd802db987m13jfmy491mp8mnsv2mwki0ra4wbnngbqgalhv";
+    sha256 = "0isx7n4r8znk02464s0wvlzk6ry5mlnq3kgnd0rapnhjwdvwqr5y";
     rev = "v${version}";
     repo = "encfs";
     owner = "vgough";
diff --git a/pkgs/tools/filesystems/sshfs-fuse/build-man-pages.patch b/pkgs/tools/filesystems/sshfs-fuse/build-man-pages.patch
new file mode 100644
index 000000000000..fba1d250c42b
--- /dev/null
+++ b/pkgs/tools/filesystems/sshfs-fuse/build-man-pages.patch
@@ -0,0 +1,11 @@
+--- a/meson.build	2017-09-23 22:02:57.770555382 +0200
++++ b/meson.build	2017-09-23 23:11:28.258095182 +0200
+@@ -25,7 +25,7 @@
+ endif
+ 
+ 
+-rst2man = find_program('rst2man', required: false)
++rst2man = find_program('rst2man.py', required: true)
+   
+ cfg = configuration_data()
+ 
diff --git a/pkgs/tools/filesystems/sshfs-fuse/default.nix b/pkgs/tools/filesystems/sshfs-fuse/default.nix
index 488e2de07a68..eace7c2783e1 100644
--- a/pkgs/tools/filesystems/sshfs-fuse/default.nix
+++ b/pkgs/tools/filesystems/sshfs-fuse/default.nix
@@ -1,24 +1,39 @@
-{ stdenv, fetchFromGitHub, pkgconfig, glib, fuse, autoreconfHook }:
+{ stdenv, fetchFromGitHub, meson, pkgconfig, ninja, glib, fuse3
+, buildManPages ? true, docutils
+}:
 
-stdenv.mkDerivation rec {
-  version = "2.10"; # Temporary (need to add libfuse 3.x first)
+let
+  inherit (stdenv.lib) optional;
+  rpath = stdenv.lib.makeLibraryPath [ fuse3 glib ];
+in stdenv.mkDerivation rec {
+  version = "3.3.0";
   name = "sshfs-fuse-${version}";
-  
+
   src = fetchFromGitHub {
     owner = "libfuse";
     repo = "sshfs";
     rev = "sshfs-${version}";
-    sha256 = "1dmw4kx6vyawcywiv8drrajnam0m29mxfswcp4209qafzx3mjlp1";
+    sha256 = "1hn5c0059ppjqygdhvapxm7lrqm5bnpwaxgjylskz04c0vr8nygp";
   };
-  
-  nativeBuildInputs = [ autoreconfHook pkgconfig ];
-  buildInputs = [ glib fuse ];
+
+  patches = optional buildManPages ./build-man-pages.patch;
+
+  nativeBuildInputs = [ meson pkgconfig ninja ];
+  buildInputs = [ fuse3 glib ] ++ optional buildManPages docutils;
+
+  NIX_CFLAGS_COMPILE = stdenv.lib.optional
+    (stdenv.system == "i686-linux")
+    "-D_FILE_OFFSET_BITS=64";
 
   postInstall = ''
     mkdir -p $out/sbin
     ln -sf $out/bin/sshfs $out/sbin/mount.sshfs
   '';
 
+  postFixup = ''
+       patchelf --set-rpath '${rpath}' "$out/bin/sshfs"
+  '';
+
   meta = with stdenv.lib; {
     inherit (src.meta) homepage;
     description = "FUSE-based filesystem that allows remote filesystems to be mounted over SSH";
diff --git a/pkgs/tools/graphics/asymptote/default.nix b/pkgs/tools/graphics/asymptote/default.nix
index de3ba3621a88..6c6a93dc73ac 100644
--- a/pkgs/tools/graphics/asymptote/default.nix
+++ b/pkgs/tools/graphics/asymptote/default.nix
@@ -50,6 +50,8 @@ stdenv.mkDerivation {
     sed -i -e 's|(asymptote/asymptote)|(asymptote)|' $out/share/info/asymptote.info
     rmdir $out/share/info/asymptote
     rm $out/share/info/dir
+
+    rm -rf "$out"/share/texmf
   '';
 
   enableParallelBuilding = true;
diff --git a/pkgs/tools/graphics/fim/default.nix b/pkgs/tools/graphics/fim/default.nix
new file mode 100644
index 000000000000..c7a22f00dce7
--- /dev/null
+++ b/pkgs/tools/graphics/fim/default.nix
@@ -0,0 +1,52 @@
+{ stdenv, fetchurl, autoconf, automake, pkgconfig
+, perl, flex, bison, readline, libexif
+, x11Support ? true, SDL
+, svgSupport ? true, inkscape
+, asciiArtSupport ? true, aalib
+, gifSupport ? true, giflib
+, tiffSupport ? true, libtiff
+, jpegSupport ? true, libjpeg
+, pngSupport ? true, libpng
+}:
+
+stdenv.mkDerivation rec {
+  name = "fim-${version}";
+  version = "0.5rc3";
+
+  src = fetchurl {
+    url = mirror://savannah/fbi-improved/fim-0.5-rc3.tar.gz;
+    sha256 = "12aka85h469zfj0zcx3xdpan70gq8nf5rackgb1ldcl9mqjn50c2";
+  };
+
+  postPatch = ''
+   substituteInPlace doc/vim2html.pl \
+     --replace /usr/bin/perl ${perl}/bin/perl
+  '';
+
+  nativeBuildInputs = [ autoconf automake pkgconfig ];
+
+  buildInputs = with stdenv.lib;
+    [ perl flex bison readline libexif ]
+    ++ optional x11Support SDL
+    ++ optional svgSupport inkscape
+    ++ optional asciiArtSupport aalib
+    ++ optional gifSupport giflib
+    ++ optional tiffSupport libtiff
+    ++ optional jpegSupport libjpeg
+    ++ optional pngSupport libpng;
+
+  NIX_CFLAGS_COMPILE = stdenv.lib.optional x11Support "-lSDL";
+
+  meta = with stdenv.lib; {
+    description = "A lightweight, highly customizable and scriptable image viewer";
+    longDescription = ''
+      FIM (Fbi IMproved) is a lightweight, console based image viewer that aims
+      to be a highly customizable and scriptable for users who are comfortable
+      with software like the VIM text editor or the Mutt mail user agent.
+    '';
+    homepage = http://www.nongnu.org/fbi-improved/;
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ primeos ];
+  };
+}
diff --git a/pkgs/tools/graphics/transfig/builder.sh b/pkgs/tools/graphics/transfig/builder.sh
deleted file mode 100644
index c466f759446c..000000000000
--- a/pkgs/tools/graphics/transfig/builder.sh
+++ /dev/null
@@ -1,38 +0,0 @@
-source $stdenv/setup
-
-patchPhase() {
-    for i in $patches; do
-        header "applying patch $i" 3
-        patch -p0 < $i
-        stopNest
-    done
-
-    configureImakefiles "s:__PREFIX_PNG:$libpng:"
-    configureImakefiles "s:__PREFIX:$out:"
-}
-
-configureImakefiles() {
-    local sedcmd=$1
-
-    sed "${sedcmd}" fig2dev/Imakefile > tmpsed
-    cp tmpsed fig2dev/Imakefile
-
-    sed "${sedcmd}" fig2dev/dev/Imakefile > tmpsed
-    cp tmpsed fig2dev/dev/Imakefile
-
-    sed "${sedcmd}" transfig/Imakefile > tmpsed
-    cp tmpsed transfig/Imakefile
-}
-
-buildPhase() {
-    xmkmf
-    make Makefiles
-    make
-}
-
-preInstall() {
-    mkdir -p $out
-    mkdir -p $out/lib
-}
-
-genericBuild
diff --git a/pkgs/tools/graphics/transfig/default.nix b/pkgs/tools/graphics/transfig/default.nix
index 948bba6d459f..cb3f0edff0f8 100644
--- a/pkgs/tools/graphics/transfig/default.nix
+++ b/pkgs/tools/graphics/transfig/default.nix
@@ -2,33 +2,62 @@
 
 stdenv.mkDerivation rec {
   name = "transfig-3.2.4";
-  builder = ./builder.sh;
   src = fetchurl {
     url = ftp://ftp.tex.ac.uk/pub/archive/graphics/transfig/transfig.3.2.4.tar.gz;
     sha256 = "0429snhp5acbz61pvblwlrwv8nxr6gf12p37f9xxwrkqv4ir7dd4";
   };
 
   buildInputs = [zlib libjpeg libpng imake];
-  inherit libpng;
 
-  hardeningDisable = [ "format" ];
+  patches = [
+    ./patch-fig2dev-dev-Imakefile
+    ./patch-fig2dev-Imakefile
+    ./patch-transfig-Imakefile
+    ./patch-fig2dev-fig2dev.h
+    ./patch-fig2dev-dev-gensvg.c
+  ];
+
+  patchPhase = ''
+    runHook prePatch
+
+    configureImakefiles() {
+        local sedcmd=$1
+
+        sed "$sedcmd" fig2dev/Imakefile > tmpsed
+        cp tmpsed fig2dev/Imakefile
 
-  patches = [prefixPatch1 prefixPatch2 prefixPatch3 varargsPatch gensvgPatch];
+        sed "$sedcmd" fig2dev/dev/Imakefile > tmpsed
+        cp tmpsed fig2dev/dev/Imakefile
 
-  prefixPatch1 =
-    ./patch-fig2dev-dev-Imakefile;
+        sed "$sedcmd" transfig/Imakefile > tmpsed
+        cp tmpsed transfig/Imakefile
+    }
 
-  prefixPatch2 =
-    ./patch-fig2dev-Imakefile;
+    for i in $patches; do
+        header "applying patch $i" 3
+        patch -p0 < $i
+        stopNest
+    done
 
-  prefixPatch3 =
-    ./patch-transfig-Imakefile;
+    configureImakefiles "s:__PREFIX_PNG:${libpng}:"
+    configureImakefiles "s:__PREFIX:$out:"
 
-  varargsPatch =
-    ./patch-fig2dev-fig2dev.h;
+    runHook postPatch
+  '';
 
-  gensvgPatch =
-    ./patch-fig2dev-dev-gensvg.c;
+  preBuild = ''
+    xmkmf
+    make Makefiles
+  '';
+
+  makeFlags = [ "CC=cc" ];
+
+  preInstall = ''
+    mkdir -p $out
+    mkdir -p $out/lib
+  '';
+
+  hardeningDisable = [ "format" ];
 
   meta = {
     platforms = stdenv.lib.platforms.unix;
diff --git a/pkgs/tools/inputmethods/ibus-engines/ibus-anthy/default.nix b/pkgs/tools/inputmethods/ibus-engines/ibus-anthy/default.nix
index f93edffa7bde..53b2a3abf28e 100644
--- a/pkgs/tools/inputmethods/ibus-engines/ibus-anthy/default.nix
+++ b/pkgs/tools/inputmethods/ibus-engines/ibus-anthy/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   configureFlags = [ "--with-anthy-zipcode=${anthy}/share/anthy/zipcode.t" ];
 
   buildInputs = [
-    anthy glib gobjectIntrospection gtk3 ibus python3
+    anthy glib gobjectIntrospection gtk3 ibus (python3.withPackages (ps: [ps.pygobject3]))
   ];
 
   nativeBuildInputs = [ intltool pkgconfig python3.pkgs.wrapPython ];
diff --git a/pkgs/tools/inputmethods/ibus-engines/ibus-hangul/default.nix b/pkgs/tools/inputmethods/ibus-engines/ibus-hangul/default.nix
index 74253fa09fc0..f70c7d02e9f0 100644
--- a/pkgs/tools/inputmethods/ibus-engines/ibus-hangul/default.nix
+++ b/pkgs/tools/inputmethods/ibus-engines/ibus-hangul/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "120p9w7za6hi521hz8q235fkl4i3p1qqr8nqm4a3kxr0pcq40bd2";
   };
 
-  buildInputs = [ gtk3 ibus libhangul ];
+  buildInputs = [ gtk3 ibus libhangul python3 ];
 
   nativeBuildInputs = [ intltool pkgconfig python3.pkgs.wrapPython ];
 
diff --git a/pkgs/tools/inputmethods/ibus/default.nix b/pkgs/tools/inputmethods/ibus/default.nix
index 66d61b8c5e9d..3b076bb8ff6c 100644
--- a/pkgs/tools/inputmethods/ibus/default.nix
+++ b/pkgs/tools/inputmethods/ibus/default.nix
@@ -110,6 +110,10 @@ in stdenv.mkDerivation rec {
   doInstallCheck = true;
   installCheckPhase = "$out/bin/ibus version";
 
+  postInstall = ''
+    moveToOutput "bin/ibus-setup" "$dev"
+  '';
+
   meta = with stdenv.lib; {
     homepage = https://github.com/ibus/ibus;
     description = "Intelligent Input Bus for Linux / Unix OS";
diff --git a/pkgs/tools/inputmethods/ibus/wrapper.nix b/pkgs/tools/inputmethods/ibus/wrapper.nix
index 13035698827f..d41ba1e791f9 100644
--- a/pkgs/tools/inputmethods/ibus/wrapper.nix
+++ b/pkgs/tools/inputmethods/ibus/wrapper.nix
@@ -21,7 +21,7 @@ let
         done
     done
 
-    for prog in ibus ibus-setup; do
+    for prog in ibus; do
         wrapProgram "$out/bin/$prog" \
           --set GDK_PIXBUF_MODULE_FILE ${librsvg.out}/lib/gdk-pixbuf-2.0/2.10.0/loaders.cache \
           --prefix GI_TYPELIB_PATH : "$GI_TYPELIB_PATH:$out/lib/girepository-1.0" \
diff --git a/pkgs/tools/misc/coreutils/default.nix b/pkgs/tools/misc/coreutils/default.nix
index c3f4863fe6f5..9a422a96d703 100644
--- a/pkgs/tools/misc/coreutils/default.nix
+++ b/pkgs/tools/misc/coreutils/default.nix
@@ -76,8 +76,6 @@ stdenv.mkDerivation rec {
   NIX_LDFLAGS = optionalString selinuxSupport "-lsepol";
   FORCE_UNSAFE_CONFIGURE = optionalString hostPlatform.isSunOS "1";
 
-  makeFlags = optionalString hostPlatform.isDarwin "CFLAGS=-D_FORTIFY_SOURCE=0";
-
   # Works around a bug with 8.26:
   # Makefile:3440: *** Recursive variable 'INSTALL' references itself (eventually).  Stop.
   preInstall = optionalString (hostPlatform != buildPlatform) ''
diff --git a/pkgs/tools/misc/entr/default.nix b/pkgs/tools/misc/entr/default.nix
index a68e2be6aebe..582e01c6f2fe 100644
--- a/pkgs/tools/misc/entr/default.nix
+++ b/pkgs/tools/misc/entr/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "entr-${version}";
-  version = "3.7";
+  version = "3.8";
 
   src = fetchurl {
     url = "http://entrproject.org/code/${name}.tar.gz";
-    sha256 = "0bx2ivx9hwixjwmk7aqlx20mwmn3cvryppnmc285d7byiw6dbvwl";
+    sha256 = "1g969gw92q8pd3zfbx37w14l92xd3nzi24083x47dns8v69ygcgb";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/misc/esptool/default.nix b/pkgs/tools/misc/esptool/default.nix
index 427ddea2f36e..33624302ebcc 100644
--- a/pkgs/tools/misc/esptool/default.nix
+++ b/pkgs/tools/misc/esptool/default.nix
@@ -11,7 +11,7 @@ python3.pkgs.buildPythonApplication rec {
     sha256 = "137p0kcscly95qpjzgx1yxm8k2wf5y9v3srvlhp2ajniirgv8ijv";
   };
 
-  buildInputs = with python3.pkgs; [ flake8 ];
+  buildInputs = with python3.pkgs; [ flake8 flake8-future-import ];
   propagatedBuildInputs = with python3.pkgs; [ pyserial pyaes ecdsa openssl ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/misc/hdf5/default.nix b/pkgs/tools/misc/hdf5/default.nix
index eb29e7d914c5..257ade407279 100644
--- a/pkgs/tools/misc/hdf5/default.nix
+++ b/pkgs/tools/misc/hdf5/default.nix
@@ -1,5 +1,7 @@
 { stdenv
 , fetchurl
+, gcc
+, removeReferencesTo
 , cpp ? false
 , gfortran ? null
 , zlib ? null
@@ -30,6 +32,8 @@ stdenv.mkDerivation rec {
     inherit mpi;
   };
 
+  nativeBuildInputs = [ removeReferencesTo ];
+
   buildInputs = []
     ++ optional (gfortran != null) gfortran
     ++ optional (szip != null) szip;
@@ -47,6 +51,10 @@ stdenv.mkDerivation rec {
 
   patches = [./bin-mv.patch];
 
+  postInstall = ''
+    find "$out" -type f -exec remove-references-to -t ${stdenv.cc} '{}' +
+  '';
+
   meta = {
     description = "Data model, library, and file format for storing and managing data";
     longDescription = ''
diff --git a/pkgs/tools/misc/ipxe/default.nix b/pkgs/tools/misc/ipxe/default.nix
index 6cd451264ab4..2d36ad17eec7 100644
--- a/pkgs/tools/misc/ipxe/default.nix
+++ b/pkgs/tools/misc/ipxe/default.nix
@@ -1,8 +1,8 @@
 { stdenv, fetchgit, perl, cdrkit, syslinux, xz, openssl }:
 
 let
-  date = "20160831";
-  rev = "827dd1bfee67daa683935ce65316f7e0f057fe1c";
+  date = "20170922";
+  rev = "74d90b33f8490adcee2026ece18d8411d93b6a39";
 in
 
 stdenv.mkDerivation {
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
 
   src = fetchgit {
     url = git://git.ipxe.org/ipxe.git;
-    sha256 = "11w8b0vln3skfn8r1cvzngslz12njdkwmnacyq3qffb96k2dn2ww";
+    sha256 = "12ijrq451fj2x3i7c7xjlxig5mwbhmgzqjvmfl2sza953vfbk4vw";
     inherit rev;
   };
 
@@ -40,6 +40,10 @@ stdenv.mkDerivation {
   installPhase = ''
     mkdir -p $out
     cp bin/ipxe.dsk bin/ipxe.usb bin/ipxe.iso bin/ipxe.lkrn bin/undionly.kpxe $out
+
+    # Some PXE constellations especially with dnsmasq are looking for the file with .0 ending
+    # let's provide it as a symlink to be compatible in this case.
+    ln -s undionly.kpxe $out/undionly.kpxe.0
   '';
 
   meta = with stdenv.lib;
diff --git a/pkgs/tools/misc/logstash/5.x.nix b/pkgs/tools/misc/logstash/5.x.nix
index d796b3952f68..4ecc0be783eb 100644
--- a/pkgs/tools/misc/logstash/5.x.nix
+++ b/pkgs/tools/misc/logstash/5.x.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://artifacts.elastic.co/downloads/logstash/${name}.tar.gz";
-    sha256 = "04nrw7ikcjp02cmwvaa1swj0b66l91n9d8qbdicsa023js4mp14m";
+    sha256 = "11qg8i0svsccr1wd0yj0ivfzpza2hd68221g38v88shvj0bb737f";
   };
 
   dontBuild         = true;
diff --git a/pkgs/tools/misc/osm2pgsql/default.nix b/pkgs/tools/misc/osm2pgsql/default.nix
index 98489358738c..67e0c2b21d83 100644
--- a/pkgs/tools/misc/osm2pgsql/default.nix
+++ b/pkgs/tools/misc/osm2pgsql/default.nix
@@ -23,6 +23,6 @@ stdenv.mkDerivation rec {
     version = "0.92.1-unstable";
     homepage = https://github.com/openstreetmap/osm2pgsql;
     license = stdenv.lib.licenses.gpl2;
-    platforms = stdenv.lib.platforms.unix;
+    platforms = stdenv.lib.platforms.linux;
   };
 }
diff --git a/pkgs/tools/misc/pick/default.nix b/pkgs/tools/misc/pick/default.nix
index 5fda26bacad1..747c98376410 100644
--- a/pkgs/tools/misc/pick/default.nix
+++ b/pkgs/tools/misc/pick/default.nix
@@ -1,23 +1,19 @@
-{ stdenv, fetchFromGitHub, autoreconfHook, ncurses }:
+{ stdenv, fetchFromGitHub, autoreconfHook, ncurses, pkgconfig }:
 
 stdenv.mkDerivation rec {
   name = "pick-${version}";
-  version = "1.7.0";
+  version = "1.9.0";
 
   src = fetchFromGitHub {
     owner = "calleerlandsson";
     repo = "pick";
     rev = "v${version}";
-    sha256 = "1x7ql530rj4yj50dzp8526mz92g4hhqxnig1qgiq3h3k815p31qb";
+    sha256 = "0s0mn9iz17ldhvahggh9rsmgfrjh0kvk5bh4p9xhxcn7rcp0h5ka";
   };
 
   buildInputs = [ ncurses ];
 
-  nativeBuildInputs = [ autoreconfHook ];
-
-  postPatch = ''
-    sed -i -e 's/\[curses]/\[ncurses]/g' configure.ac
-  '';
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
 
   meta = with stdenv.lib; {
     inherit (src.meta) homepage;
diff --git a/pkgs/tools/misc/shallot/default.nix b/pkgs/tools/misc/shallot/default.nix
index 279de83e817a..6c757ca224a9 100644
--- a/pkgs/tools/misc/shallot/default.nix
+++ b/pkgs/tools/misc/shallot/default.nix
@@ -27,6 +27,6 @@ in stdenv.mkDerivation {
 
     license = stdenv.lib.licenses.mit;
     homepage = https://github.com/katmagic/Shallot;
-    platforms = stdenv.lib.platforms.unix;
+    platforms = stdenv.lib.platforms.linux;
   };
 }
diff --git a/pkgs/tools/misc/snapper/default.nix b/pkgs/tools/misc/snapper/default.nix
index 5f482d68dd9a..9895fff3ba8f 100644
--- a/pkgs/tools/misc/snapper/default.nix
+++ b/pkgs/tools/misc/snapper/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   name = "snapper-${version}";
-  version = "0.3.3";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "openSUSE";
     repo = "snapper";
     rev = "v${version}";
-    sha256 = "12c2ygaanr4gny4ixnly4vpi0kv7snbg3khr3i5zwridhmdzz9hm";
+    sha256 = "14hrv23film4iihyclcvc2r2dgxl8w3as50r81xjjc85iyp6yxkm";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/misc/svtplay-dl/default.nix b/pkgs/tools/misc/svtplay-dl/default.nix
index a652243a9d60..5999fa316223 100644
--- a/pkgs/tools/misc/svtplay-dl/default.nix
+++ b/pkgs/tools/misc/svtplay-dl/default.nix
@@ -5,13 +5,13 @@ let
   inherit (pythonPackages) python nose pycrypto requests mock;
 in stdenv.mkDerivation rec {
   name = "svtplay-dl-${version}";
-  version = "1.9.4";
+  version = "1.9.6";
 
   src = fetchFromGitHub {
     owner = "spaam";
     repo = "svtplay-dl";
     rev = version;
-    sha256 = "15vjaia1qbs49gplpfi8sj5scl9mb4qg8n2z4zyzjs5461lx5qqv";
+    sha256 = "11xw4whh60k61i8akd7avb254mmffaig72kb7w6prk1kjq05js2s";
   };
 
   pythonPaths = [ pycrypto requests ];
diff --git a/pkgs/tools/misc/ttwatch/default.nix b/pkgs/tools/misc/ttwatch/default.nix
new file mode 100644
index 000000000000..855baa830607
--- /dev/null
+++ b/pkgs/tools/misc/ttwatch/default.nix
@@ -0,0 +1,28 @@
+{ stdenv, fetchFromGitHub, cmake, perl, openssl, curl, libusb1 }:
+
+stdenv.mkDerivation rec {
+  name = "ttwatch-${version}";
+  version = "2017-04-20";
+
+  src = fetchFromGitHub {
+    owner = "ryanbinns";
+    repo = "ttwatch";
+    rev = "f07a12712ed331f1530db3846828641eb0e2f5c5";
+    sha256 = "0y27bldmp6w02pjhr2cmy9g6n23vi0q26pil3rd7vbg4qjahxz27";
+  };
+
+  nativeBuildInputs = [ cmake perl ];
+  buildInputs = [ openssl curl libusb1 ];
+
+  preFixup = ''
+    chmod +x $out/bin/ttbin2mysports
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/ryanbinns/ttwatch;
+    description = "Linux TomTom GPS Watch Utilities";
+    maintainers = with maintainers; [ dotlambda ];
+    license = licenses.mit;
+    platforms = with platforms; linux;
+  };
+}
diff --git a/pkgs/tools/misc/youtube-dl/default.nix b/pkgs/tools/misc/youtube-dl/default.nix
index 3af0c5435604..c364935b12cb 100644
--- a/pkgs/tools/misc/youtube-dl/default.nix
+++ b/pkgs/tools/misc/youtube-dl/default.nix
@@ -15,11 +15,11 @@ with stdenv.lib;
 buildPythonApplication rec {
 
   name = "youtube-dl-${version}";
-  version = "2017.09.15";
+  version = "2017.09.24";
 
   src = fetchurl {
     url = "https://yt-dl.org/downloads/${version}/${name}.tar.gz";
-    sha256 = "1kw8pqzvhbpyxcz2jb692j4cgzd3vmd81mra09xvpzkq974jkx7f";
+    sha256 = "0j2m75j0d1n83i7jzpkcj7ir0bkskj024j9b0yi88zipcg740wbx";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/networking/assh/default.nix b/pkgs/tools/networking/assh/default.nix
new file mode 100644
index 000000000000..1de87e07e049
--- /dev/null
+++ b/pkgs/tools/networking/assh/default.nix
@@ -0,0 +1,33 @@
+{ stdenv, lib, buildGoPackage, fetchFromGitHub, openssh, makeWrapper }:
+
+buildGoPackage rec {
+  name = "assh-${version}";
+  version = "2.6.0";
+
+  goPackagePath = "github.com/moul/advanced-ssh-config";
+  subPackages = [ "cmd/assh" ];
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  postInstall = stdenv.lib.optionalString (stdenv.isDarwin) ''
+    install_name_tool -delete_rpath $out/lib $bin/bin/assh
+  '' + ''
+    wrapProgram "$bin/bin/assh" \
+      --prefix PATH : ${openssh}/bin
+  '';
+
+  src = fetchFromGitHub {
+    repo = "advanced-ssh-config";
+    owner = "moul";
+    rev = "v${version}";
+    sha256 = "1vv98dz5822k51xklnmky0lwfjw8nc6ryvn8lmv9n63ppwh9s2s6";
+  };
+
+  meta = with stdenv.lib; {
+    description = "Advanced SSH config - Regex, aliases, gateways, includes and dynamic hosts";
+    homepage = https://github.com/moul/advanced-ssh-config;
+    license = licenses.mit;
+    maintainers = with maintainers; [ zzamboni ];
+    platforms = with platforms; linux ++ darwin;
+  };
+}
diff --git a/pkgs/tools/networking/axel/default.nix b/pkgs/tools/networking/axel/default.nix
index 322a1a06289e..99c225ec259f 100644
--- a/pkgs/tools/networking/axel/default.nix
+++ b/pkgs/tools/networking/axel/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "axel-${version}";
-  version = "2.13.1";
+  version = "2.14.1";
 
   src = fetchurl {
     url = "mirror://debian/pool/main/a/axel/axel_${version}.orig.tar.gz";
-    sha256 = "15bi5wx6fyf9k0y03dy5mk2rv06mrfgiyrlh44add9n07wi574p1";
+    sha256 = "0fayfpyc9cs6yp474400nyjbix6aywicz6pw17rzm4m7k06q5xmc";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/pkgs/tools/networking/cjdns/default.nix b/pkgs/tools/networking/cjdns/default.nix
index 12a8a1a184fe..11f65ea82b03 100644
--- a/pkgs/tools/networking/cjdns/default.nix
+++ b/pkgs/tools/networking/cjdns/default.nix
@@ -31,6 +31,6 @@ stdenv.mkDerivation {
     description = "Encrypted networking for regular people";
     license = licenses.gpl3;
     maintainers = with maintainers; [ ehmry ];
-    platforms = platforms.unix;
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/tools/networking/djbdns/default.nix b/pkgs/tools/networking/djbdns/default.nix
new file mode 100644
index 000000000000..7537ab1c47ac
--- /dev/null
+++ b/pkgs/tools/networking/djbdns/default.nix
@@ -0,0 +1,48 @@
+{ stdenv, fetchurl, glibc } :
+
+let
+  version = "1.05";
+
+  manSrc = fetchurl {
+    url = "http://smarden.org/pape/djb/manpages/djbdns-${version}-man-20031023.tar.gz";
+    sha256 = "0sg51gjy6j1hnrra406q1qhf5kvk1m00y8qqhs6r0a699gqmh75s";
+  };
+
+in
+
+stdenv.mkDerivation {
+  name = "djbdns-${version}";
+
+  src = fetchurl {
+    url = "https://cr.yp.to/djbdns/djbdns-${version}.tar.gz";
+    sha256 = "0j3baf92vkczr5fxww7rp1b7gmczxmmgrqc8w2dy7kgk09m85k9w";
+  };
+
+  patches = [ ./hier.patch ];
+
+  postPatch = ''
+    echo gcc -O2 -include ${glibc.dev}/include/errno.h > conf-cc
+    echo $out > conf-home
+    sed -i "s|/etc/dnsroots.global|$out/etc/dnsroots.global|" dnscache-conf.c
+  '';
+
+  installPhase = ''
+    mkdir -pv $out/etc;
+    make setup
+    cd $out;
+    tar xzvf ${manSrc};
+    for n in 1 5 8; do
+      mkdir -p man/man$n;
+      mv -iv djbdns-man/*.$n man/man$n;
+    done;
+    rm -rv djbdns-man;
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A collection of Domain Name System tools";
+    longDescription = "Includes software for all the fundamental DNS operations: DNS cache: finding addresses of Internet hosts; DNS server: publishing addresses of Internet hosts; and DNS client: talking to a DNS cache.";
+    homepage = https://cr.yp.to/djbdns.html;
+    license = licenses.publicDomain;
+    maintainers = with maintainers; [ jerith666 ];
+  };
+}
\ No newline at end of file
diff --git a/pkgs/tools/networking/djbdns/hier.patch b/pkgs/tools/networking/djbdns/hier.patch
new file mode 100644
index 000000000000..7fddd1213834
--- /dev/null
+++ b/pkgs/tools/networking/djbdns/hier.patch
@@ -0,0 +1,15 @@
+--- a/hier.c	2016-04-19 21:22:21.992192405 -0400
++++ b/hier.c	2016-04-19 21:22:33.160229778 -0400
+@@ -2,9 +2,9 @@
+ 
+ void hier()
+ {
+-  c("/","etc","dnsroots.global",-1,-1,0644);
++  c(auto_home,"etc","dnsroots.global",-1,-1,0644);
+ 
+-  h(auto_home,-1,-1,02755);
+-  d(auto_home,"bin",-1,-1,02755);
++  h(auto_home,-1,-1,0755);
++  d(auto_home,"bin",-1,-1,0755);
+ 
+   c(auto_home,"bin","dnscache-conf",-1,-1,0755);
diff --git a/pkgs/tools/networking/ferm/default.nix b/pkgs/tools/networking/ferm/default.nix
index 454605893823..a0b298f3f4ec 100644
--- a/pkgs/tools/networking/ferm/default.nix
+++ b/pkgs/tools/networking/ferm/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, makeWrapper, perl, ebtables, ipset, iptables }:
 
 stdenv.mkDerivation rec {
-  version = "2.3.1";
+  version = "2.4.1";
   name = "ferm-${version}";
 
   src = fetchurl {
-    url = "http://ferm.foo-projects.org/download/2.3/ferm-${version}.tar.gz";
-    sha256 = "1scdnd2jk4787jyr6fxav2598g0x7hjic5b8bj77j8s0hki48m4a";
+    url = "http://ferm.foo-projects.org/download/2.4/ferm-${version}.tar.xz";
+    sha256 = "1fv8wk513yysp4q0i65rl2m0hg2lxwwgk9ppprsca1xcxrdpsvwa";
   };
 
   buildInputs = [ perl ipset ebtables iptables makeWrapper ];
diff --git a/pkgs/tools/networking/lftp/default.nix b/pkgs/tools/networking/lftp/default.nix
index b6d8baeee7ec..aa5a7b514cb8 100644
--- a/pkgs/tools/networking/lftp/default.nix
+++ b/pkgs/tools/networking/lftp/default.nix
@@ -1,8 +1,8 @@
-{ stdenv, fetchurl, gnutls, pkgconfig, readline, zlib, libidn2, gmp, libiconv, gettext }:
+{ stdenv, fetchurl, gnutls, pkgconfig, readline, zlib, libidn2, gmp, libiconv, libunistring, gettext }:
 
 stdenv.mkDerivation rec {
   name = "lftp-${version}";
-  version = "4.8.0";
+  version = "4.8.2";
 
   src = fetchurl {
     urls = [
@@ -10,12 +10,12 @@ stdenv.mkDerivation rec {
       "ftp://ftp.st.ryukoku.ac.jp/pub/network/ftp/lftp/${name}.tar.bz2"
       "http://lftp.yar.ru/ftp/old/${name}.tar.bz2"
       ];
-    sha256 = "0z2432zxzg808swi72yak9kia976qrjj030grk0v4p54mcib3s34";
+    sha256 = "0a4sp9khqgny1md0b2c9vvg4c7sz0g31w3sfdslxw7dsvijin3mn";
   };
 
   nativeBuildInputs = [ pkgconfig ];
 
-  buildInputs = [ gnutls readline zlib libidn2 gmp libiconv ]
+  buildInputs = [ gnutls readline zlib libidn2 gmp libiconv libunistring ]
     ++ stdenv.lib.optional stdenv.isDarwin gettext;
 
   hardeningDisable = stdenv.lib.optional stdenv.isDarwin "format";
diff --git a/pkgs/tools/networking/network-manager-applet/default.nix b/pkgs/tools/networking/network-manager-applet/default.nix
index c596ea63f4d3..3220aebdfe49 100644
--- a/pkgs/tools/networking/network-manager-applet/default.nix
+++ b/pkgs/tools/networking/network-manager-applet/default.nix
@@ -1,26 +1,32 @@
 { stdenv, fetchurl, intltool, pkgconfig, libglade, networkmanager, gnome3
 , libnotify, libsecret, polkit, isocodes, modemmanager, librsvg
 , mobile_broadband_provider_info, glib_networking, gsettings_desktop_schemas
-, makeWrapper, udev, libgudev, hicolor_icon_theme, jansson, wrapGAppsHook, webkitgtk }:
+, makeWrapper, udev, libgudev, hicolor_icon_theme, jansson, wrapGAppsHook, webkitgtk
+, withGnome ? false }:
 
 stdenv.mkDerivation rec {
   name    = "${pname}-${major}.${minor}";
   pname   = "network-manager-applet";
-  major   = "1.4";
-  minor   = "6";
+  major   = "1.8";
+  minor   = "2";
 
   src = fetchurl {
     url    = "mirror://gnome/sources/${pname}/${major}/${name}.tar.xz";
-    sha256 = "0xpcdwqmnwiqqqsd5rx1gh5rvv5m2skj59bqxhccy1k2ikzgr9hh";
+    sha256 = "09f9hjpn9nkhw57mk6pi7q1bq3lhf5hvmwas0fknscssak7yjmry";
   };
 
-  configureFlags = [ "--sysconfdir=/etc" ];
+  configureFlags = [
+    "--sysconfdir=/etc"
+    "--without-selinux"
+  ];
+
+  outputs = [ "out" "dev" ];
 
   buildInputs = [
     gnome3.gtk libglade networkmanager libnotify libsecret gsettings_desktop_schemas
     polkit isocodes makeWrapper udev libgudev gnome3.gconf gnome3.libgnome_keyring
-    modemmanager jansson librsvg glib_networking gnome3.dconf webkitgtk
-  ];
+    modemmanager jansson librsvg glib_networking gnome3.dconf
+  ] ++ stdenv.lib.optional withGnome webkitgtk;
 
   nativeBuildInputs = [ intltool pkgconfig wrapGAppsHook ];
 
diff --git a/pkgs/tools/networking/network-manager/default.nix b/pkgs/tools/networking/network-manager/default.nix
index d2a51b3acc86..ace568d6900b 100644
--- a/pkgs/tools/networking/network-manager/default.nix
+++ b/pkgs/tools/networking/network-manager/default.nix
@@ -3,19 +3,17 @@
 , libgcrypt, dnsmasq, bluez5, readline
 , gobjectIntrospection, modemmanager, openresolv, libndp, newt, libsoup
 , ethtool, iputils, gnused, coreutils, file, inetutils, kmod, jansson, libxslt
-, python3Packages, docbook_xsl, fetchpatch, openconnect }:
+, python3Packages, docbook_xsl, fetchpatch, openconnect, curl, autoreconfHook }:
 
 stdenv.mkDerivation rec {
   name    = "network-manager-${version}";
   pname   = "NetworkManager";
-  major   = "1.6";
+  major   = "1.8";
   version = "${major}.2";
-  # FIXME: this problem is fixed upstream (commit 6a77258f4ec2), remove when upgrading ^^^
-  hardeningDisable = [ "format" ];
 
   src = fetchurl {
     url    = "mirror://gnome/sources/${pname}/${major}/${pname}-${version}.tar.xz";
-    sha256 = "1y96k82rav8if334jl500zc024d210c4pgprh94yqyz3rmanyaxj";
+    sha256 = "1x0vzxvrck0snga2n3pc7g74m20zz74cr4r8gfspl8sckv6yz9bi";
   };
 
   outputs = [ "out" "dev" ];
@@ -46,13 +44,15 @@ stdenv.mkDerivation rec {
       --subst-var-by modprobeBinPath ${kmod}/bin/modprobe
     # to enable link-local connections
     configureFlags="$configureFlags --with-udev-dir=$out/lib/udev"
+
+    # Fixes: error: po/Makefile.in.in was not created by intltoolize.
+    intltoolize --automake --copy --force
   '';
 
   # Right now we hardcode quite a few paths at build time. Probably we should
   # patch networkmanager to allow passing these path in config file. This will
   # remove unneeded build-time dependencies.
   configureFlags = [
-    "--with-distro=exherbo"
     "--with-dhclient=${dhcp}/bin/dhclient"
     "--with-dnsmasq=${dnsmasq}/bin/dnsmasq"
     # Upstream prefers dhclient, so don't add dhcpcd to the closure
@@ -69,26 +69,21 @@ stdenv.mkDerivation rec {
     "--with-session-tracking=systemd"
     "--with-modem-manager-1"
     "--with-nmtui"
-    "--with-libsoup=yes"
+    "--disable-gtk-doc"
   ];
 
   patches = [
     ./PppdPath.patch
-    (fetchpatch {
-      sha256 = "1n90j5rwg97xkrhlldyr92filc2dmycl9pr0svky9hlcn9csk2z6";
-      name = "null-dereference.patch";
-      url = "https://github.com/NetworkManager/NetworkManager/commit/4e8eddd100bbc8429806a70620c90b72cfd29cb1.patch";
-    })
     ./openconnect_helper_path.patch
     ./modprobe.patch
   ];
 
-  buildInputs = [ systemd libgudev libnl libuuid polkit ppp libndp
+  buildInputs = [ systemd libgudev libnl libuuid polkit ppp libndp curl
                   bluez5 dnsmasq gobjectIntrospection modemmanager readline newt libsoup jansson ];
 
   propagatedBuildInputs = [ dbus_glib gnutls libgcrypt python3Packages.pygobject3 ];
 
-  nativeBuildInputs = [ intltool pkgconfig libxslt docbook_xsl ];
+  nativeBuildInputs = [ autoreconfHook intltool pkgconfig libxslt docbook_xsl ];
 
   preInstall = ''
     installFlagsArray=( "sysconfdir=$out/etc" "localstatedir=$out/var" "runstatedir=$out/var/run" )
diff --git a/pkgs/tools/networking/network-manager/openvpn.nix b/pkgs/tools/networking/network-manager/openvpn.nix
index 3edbe7dba6ed..47dca561d6cb 100644
--- a/pkgs/tools/networking/network-manager/openvpn.nix
+++ b/pkgs/tools/networking/network-manager/openvpn.nix
@@ -4,12 +4,12 @@
 stdenv.mkDerivation rec {
   name    = "${pname}${if withGnome then "-gnome" else ""}-${version}";
   pname   = "NetworkManager-openvpn";
-  major   = "1.2";
-  version = "${major}.8";
+  major   = "1.8";
+  version = "${major}.0";
 
   src = fetchurl {
     url    = "mirror://gnome/sources/${pname}/${major}/${pname}-${version}.tar.xz";
-    sha256 = "0m06sg2rnz764psvpsrx0pvll11nfn9hypgbp3s6vna8y83l02ry";
+    sha256 = "1973n89g66a3jfx8r45a811fga4kadh6r1w35cb25cz1mlii2vhn";
   };
 
   buildInputs = [ openvpn networkmanager libsecret ]
diff --git a/pkgs/tools/networking/openconnect/default.nix b/pkgs/tools/networking/openconnect/default.nix
index 0f1e45a10a70..132ae3cf0da0 100644
--- a/pkgs/tools/networking/openconnect/default.nix
+++ b/pkgs/tools/networking/openconnect/default.nix
@@ -1,10 +1,6 @@
 { stdenv, fetchurl, pkgconfig, vpnc, openssl ? null, gnutls ? null, gmp, libxml2, stoken, zlib } :
 
-let
-  xor = a: b: (a || b) && (!(a && b));
-in
-
-assert xor (openssl != null) (gnutls != null);
+assert (openssl != null) == (gnutls == null);
 
 stdenv.mkDerivation rec {
   name = "openconnect-7.08";
@@ -16,6 +12,8 @@ stdenv.mkDerivation rec {
     sha256 = "00wacb79l2c45f94gxs63b9z25wlciarasvjrb8jb8566wgyqi0w";
   };
 
+  outputs = [ "out" "dev" ];
+
   preConfigure = ''
       export PKG_CONFIG=${pkgconfig}/bin/pkg-config
       export LIBXML2_CFLAGS="-I ${libxml2.dev}/include/libxml2"
diff --git a/pkgs/tools/networking/openfortivpn/default.nix b/pkgs/tools/networking/openfortivpn/default.nix
index 1927d47582da..b1ecc6cba89b 100644
--- a/pkgs/tools/networking/openfortivpn/default.nix
+++ b/pkgs/tools/networking/openfortivpn/default.nix
@@ -1,9 +1,9 @@
-{ stdenv, fetchFromGitHub, autoreconfHook, openssl, ppp }:
+{ stdenv, fetchFromGitHub, autoreconfHook, openssl, ppp, pkgconfig }:
 
 with stdenv.lib;
 
 let repo = "openfortivpn";
-    version = "1.2.0";
+    version = "1.5.0";
 
 in stdenv.mkDerivation {
   name = "${repo}-${version}";
@@ -12,10 +12,10 @@ in stdenv.mkDerivation {
     owner = "adrienverge";
     inherit repo;
     rev = "v${version}";
-    sha256 = "1a1l9f6zivfyxg9g2x7kzkvcyh84s7l6v0kimihhrd19zl0m41jn";
+    sha256 = "0fm0z73afghwmbshpsn5jfbyyfzz1v8s7scwycnvsk2cgv5f4r86";
   };
 
-  nativeBuildInputs = [ autoreconfHook ];
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
   buildInputs = [ openssl ppp ];
 
   NIX_CFLAGS_COMPILE = "-Wno-error=unused-function";
diff --git a/pkgs/tools/networking/p2p/libtorrent/default.nix b/pkgs/tools/networking/p2p/libtorrent/default.nix
index 0690fe18bdea..87785f50e6fa 100644
--- a/pkgs/tools/networking/p2p/libtorrent/default.nix
+++ b/pkgs/tools/networking/p2p/libtorrent/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   name = "libtorrent-${version}";
-  version = "0.13.6";
+  version = "20161212";
 
-  src = fetchFromGitHub rec {
+  src = fetchFromGitHub {
     owner = "rakshasa";
     repo = "libtorrent";
-    rev = "${version}";
-    sha256 = "1rvrxgb131snv9r6ksgzmd74rd9z7q46bhky0zazz7dwqqywffcp";
+    rev = "c167c5a9e0bcf0df23ae5efd91396aae0e37eb87";
+    sha256 = "0y9759sxx5dyamyw8w58dsxq7bmnn57q7s2f4cw2zln2pp5gripw";
   };
 
   nativeBuildInputs = [ pkgconfig ];
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   preConfigure = "./autogen.sh";
 
   meta = with stdenv.lib; {
-    homepage = http://www.libtorrent.org/;
+    homepage = "http://rtorrent.net/downloads/";
     description = "A BitTorrent library written in C++ for *nix, with focus on high performance and good code";
 
     platforms = platforms.linux;
diff --git a/pkgs/tools/networking/p2p/rtorrent/default.nix b/pkgs/tools/networking/p2p/rtorrent/default.nix
index d96b5fe49a98..6ab462ac5a8c 100644
--- a/pkgs/tools/networking/p2p/rtorrent/default.nix
+++ b/pkgs/tools/networking/p2p/rtorrent/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   name = "rtorrent-${version}";
-  version = "0.9.6";
+  version = "20161023";
 
   src = fetchFromGitHub {
     owner = "rakshasa";
     repo = "rtorrent";
-    rev = "${version}";
-    sha256 = "0iyxmjr1984vs7hrnxkfwgrgckacqml0kv4bhj185w9bhjqvgfnf";
+    rev = "226e670decf92e7adaa845a6982aca4f164ea740";
+    sha256 = "0cxyakc09bn6wjfj42gh508hc62awx825skzacpizx2bqs6v7xvb";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/tools/networking/packetdrill/default.nix b/pkgs/tools/networking/packetdrill/default.nix
index 75007b5ed681..d770a51dc820 100644
--- a/pkgs/tools/networking/packetdrill/default.nix
+++ b/pkgs/tools/networking/packetdrill/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     description = "Quick, precise tests for entire TCP/UDP/IPv4/IPv6 network stacks";
     homepage = https://github.com/google/packetdrill;
     license = stdenv.lib.licenses.gpl2;
-    platforms = stdenv.lib.platforms.unix;
+    platforms = stdenv.lib.platforms.linux;
     maintainers = with stdenv.lib.maintainers; [ dmjio cleverca22 ];
   };
 }
diff --git a/pkgs/tools/networking/radsecproxy/default.nix b/pkgs/tools/networking/radsecproxy/default.nix
new file mode 100644
index 000000000000..0ed1150159d2
--- /dev/null
+++ b/pkgs/tools/networking/radsecproxy/default.nix
@@ -0,0 +1,27 @@
+{ stdenv, fetchurl, openssl }:
+
+stdenv.mkDerivation rec {
+  name = "radsecproxy-${version}";
+  version = "1.6.9";
+
+  src = fetchurl {
+    url = "https://software.nordu.net/radsecproxy/radsecproxy-${version}.tar.xz";
+    sha256 = "6f2c7030236c222782c9ac2c52778baa63540a1865b75a7a6d8c1280ce6ad816";
+  };
+
+  buildInputs = [ openssl ];
+
+  configureFlags = [
+     "--with-ssl=${openssl.dev}"
+     "--sysconfdir=/etc"
+     "--localstatedir=/var"
+  ];
+
+  meta = with stdenv.lib; {
+    homepage = https://software.nordu.net/radsecproxy/;
+    description = "A generic RADIUS proxy that supports both UDP and TLS (RadSec) RADIUS transports.";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ sargon ];
+    platforms = with platforms; linux;
+  };
+}
diff --git a/pkgs/tools/networking/redsocks/default.nix b/pkgs/tools/networking/redsocks/default.nix
index e9aced067286..981ecdb03550 100644
--- a/pkgs/tools/networking/redsocks/default.nix
+++ b/pkgs/tools/networking/redsocks/default.nix
@@ -28,6 +28,6 @@ stdenv.mkDerivation rec {
     homepage = http://darkk.net.ru/redsocks/;
     license = stdenv.lib.licenses.asl20;
     maintainers = [ ];
-    platforms = stdenv.lib.platforms.all;
+    platforms = stdenv.lib.platforms.linux;
   };
 }
diff --git a/pkgs/tools/networking/tinc/default.nix b/pkgs/tools/networking/tinc/default.nix
index c025fba4921b..508816dbfa81 100644
--- a/pkgs/tools/networking/tinc/default.nix
+++ b/pkgs/tools/networking/tinc/default.nix
@@ -1,12 +1,12 @@
 {stdenv, fetchurl, lzo, openssl, zlib}:
 
 stdenv.mkDerivation rec {
-  version = "1.0.31";
+  version = "1.0.32";
   name = "tinc-${version}";
 
   src = fetchurl {
     url = "http://www.tinc-vpn.org/packages/tinc-${version}.tar.gz";
-    sha256 = "d3cbc82e6e07975a2ccc0b369d07e30fc3324e71e240dca8781ce9a4f629519b";
+    sha256 = "11smq1h6jyp6x2cwrv2zxck9phzdz3svi95pxnvvpd4dzzm4zcjd";
   };
 
   buildInputs = [ lzo openssl zlib ];
diff --git a/pkgs/tools/networking/unbound/default.nix b/pkgs/tools/networking/unbound/default.nix
index a65ccb0541c8..cb462a2cedd2 100644
--- a/pkgs/tools/networking/unbound/default.nix
+++ b/pkgs/tools/networking/unbound/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "unbound-${version}";
-  version = "1.6.5";
+  version = "1.6.6";
 
   src = fetchurl {
     url = "http://unbound.net/downloads/${name}.tar.gz";
-    sha256 = "0khhrj11yhh6a0h578w29yw2j7yzvaqkr4p44jzjapq1549am5z2";
+    sha256 = "145kska9a63yf32y3jg91y5ikcmsb7qvbcm7a8k6fgh96gf18awp";
   };
 
   outputs = [ "out" "lib" "man" ]; # "dev" would only split ~20 kB
diff --git a/pkgs/tools/package-management/nox/default.nix b/pkgs/tools/package-management/nox/default.nix
index f12af074d412..ed7ec74483f3 100644
--- a/pkgs/tools/package-management/nox/default.nix
+++ b/pkgs/tools/package-management/nox/default.nix
@@ -10,6 +10,8 @@ pythonPackages.buildPythonApplication rec {
     sha256 = "1qcbhdnhdhhv7q6cqdgv0q55ic8fk18526zn2yb12x9r1s0lfp9z";
   };
 
+  patches = [ ./nox-review-wip.patch ];
+
   buildInputs = [ pythonPackages.pbr git ];
 
   propagatedBuildInputs = with pythonPackages; [
diff --git a/pkgs/tools/package-management/nox/nox-review-wip.patch b/pkgs/tools/package-management/nox/nox-review-wip.patch
new file mode 100644
index 000000000000..e82dc7a2c266
--- /dev/null
+++ b/pkgs/tools/package-management/nox/nox-review-wip.patch
@@ -0,0 +1,11 @@
+--- a/nox/review.py	2017-09-23 04:04:37.322484753 +0200
++++ a/nox/review.py	2017-09-23 04:18:31.582692181 +0200
+@@ -84,7 +84,7 @@
+     ctx.obj['dry_run'] = dry_run
+ 
+ 
+-@cli.command(short_help='difference between working tree and a commit')
++@cli.command('wip', short_help='difference between working tree and a commit')
+ @click.option('--against', default='HEAD')
+ @click.pass_context
+ @setup_nixpkgs_config
diff --git a/pkgs/tools/security/bash-supergenpass/default.nix b/pkgs/tools/security/bash-supergenpass/default.nix
new file mode 100644
index 000000000000..f85d847f5f95
--- /dev/null
+++ b/pkgs/tools/security/bash-supergenpass/default.nix
@@ -0,0 +1,39 @@
+{ stdenv, fetchFromGitHub, makeWrapper, openssl, coreutils, gnugrep }:
+
+stdenv.mkDerivation rec {
+  name = "bash-supergenpass-unstable-${version}";
+  version = "2012-11-02";
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  src = fetchFromGitHub {
+    owner = "lanzz";
+    repo = "bash-supergenpass";
+    rev = "c84eaa22fb59ab6c390e7f2de7984513347e3a9a";
+    sha256 = "0d3l55kdrf6arb98vwwz9ww55ing5w323fg7546v56hlq3hs5qc9";
+  };
+
+  installPhase = ''
+    install -m755 -D supergenpass.sh "$out/bin/supergenpass"
+    wrapProgram "$out/bin/supergenpass" --prefix PATH : "${stdenv.lib.makeBinPath [ openssl coreutils gnugrep ]}"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Bash shell-script implementation of SuperGenPass password generation";
+    longDescription = ''
+      Bash shell-script implementation of SuperGenPass password generation
+      Usage: ./supergenpass.sh <domain> [ <length> ]
+
+      Default <length> is 10, which is also the original SuperGenPass default length.
+
+      The <domain> parameter is also optional, but it does not make much sense to omit it.
+
+      supergenpass will ask for your master password interactively, and it will not be displayed on your terminal.
+    '';
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ fgaz ];
+    homepage = https://github.com/lanzz/bash-supergenpass;
+  };
+}
+
diff --git a/pkgs/tools/security/gnupg/22.nix b/pkgs/tools/security/gnupg/22.nix
index 7bba249db936..18d784a59bb7 100644
--- a/pkgs/tools/security/gnupg/22.nix
+++ b/pkgs/tools/security/gnupg/22.nix
@@ -15,11 +15,11 @@ assert guiSupport -> pinentry != null;
 stdenv.mkDerivation rec {
   name = "gnupg-${version}";
 
-  version = "2.2.0";
+  version = "2.2.1";
 
   src = fetchurl {
     url = "mirror://gnupg/gnupg/${name}.tar.bz2";
-    sha256 = "1rj538kp3wsdq7rhl8sy1wpwhlsbxcch0cwk64kgz8gpw05lllfl";
+    sha256 = "1yv2pwf3vhv9dpbf51fnm0wy03va1cg5r7qaz7rg75cwbgb0rmrl";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/tools/security/kbfs/default.nix b/pkgs/tools/security/kbfs/default.nix
index 28c6caae6c33..7b3e7d99a437 100644
--- a/pkgs/tools/security/kbfs/default.nix
+++ b/pkgs/tools/security/kbfs/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   name = "kbfs-${version}";
-  version = "20170429.44efa06";
+  version = "20170922.f76290";
 
   goPackagePath = "github.com/keybase/kbfs";
   subPackages = [ "kbfsfuse" ];
@@ -12,8 +12,8 @@ buildGoPackage rec {
   src = fetchFromGitHub {
     owner = "keybase";
     repo = "kbfs";
-    rev = "44efa0682d931d8489f5e84542e8d00baeb12592";
-    sha256 = "1q6hklyr6zq3xr1azz1c6rlpsjc036f222cd20vf79m58dn906n5";
+    rev = "f76290f6e1a8cbaa6046980c67c548fbff9e123a";
+    sha256 = "1v086wmc0hly4b91y6xndfdhj981n2yr6nnb3rl6f4kwx291ih54";
   };
 
   buildFlags = [ "-tags production" ];
diff --git a/pkgs/tools/security/keybase/default.nix b/pkgs/tools/security/keybase/default.nix
index 8f19b2577475..229a45b87314 100644
--- a/pkgs/tools/security/keybase/default.nix
+++ b/pkgs/tools/security/keybase/default.nix
@@ -16,12 +16,16 @@ buildGoPackage rec {
     sha256 = "0vivc71xfi4y3ydd29b17qxzi10r3a1ppmjjws6vrs0gz58bz1j8";
   };
 
+  postInstall = stdenv.lib.optionalString stdenv.isDarwin ''
+    install_name_tool -delete_rpath $out/lib $bin/bin/keybase
+  '';
+
   buildFlags = [ "-tags production" ];
 
   meta = with stdenv.lib; {
     homepage = https://www.keybase.io/;
     description = "The Keybase official command-line utility and service.";
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
     maintainers = with maintainers; [ carlsverre np rvolosatovs ];
   };
 }
diff --git a/pkgs/tools/security/metasploit/default.nix b/pkgs/tools/security/metasploit/default.nix
index 15a30db522eb..37796fef1747 100644
--- a/pkgs/tools/security/metasploit/default.nix
+++ b/pkgs/tools/security/metasploit/default.nix
@@ -35,14 +35,14 @@ in stdenv.mkDerivation rec {
 
     cp -r * $out/share/msf
 
-    for i in $out/share/msf/msf*; do
-      bin=$out/bin/$(basename $i)
-      cat > $bin <<EOF
-#!/bin/sh -e
-exec ${env}/bin/bundle exec ${ruby}/bin/ruby $i "\$@"
-EOF
-      chmod +x $bin
-    done
+    (
+      cd $out/share/msf/
+      for i in msf*; do
+        makeWrapper ${env}/bin/bundle $out/bin/$i \
+          --add-flags "exec ${ruby}/bin/ruby $out/share/msf/$i"
+      done
+    )
+
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/security/oath-toolkit/default.nix b/pkgs/tools/security/oath-toolkit/default.nix
index 98635f8cc85d..965ecda164be 100644
--- a/pkgs/tools/security/oath-toolkit/default.nix
+++ b/pkgs/tools/security/oath-toolkit/default.nix
@@ -6,14 +6,14 @@ let
     else pam;
 in
 stdenv.mkDerivation rec {
-  name = "oath-toolkit-2.6.1";
+  name = "oath-toolkit-2.6.2";
 
   src = fetchurl {
     url = "mirror://savannah/oath-toolkit/${name}.tar.gz";
-    sha256 = "0ybg0gnddmhxga0jwdipyz8jv5mxs0kiiflhvzffl9mw0wcq6mww";
+    sha256 = "182ah8vfbg0yhv6mh1b6ap944d0na6x7lpfkwkmzb6jl9gx4cd5h";
   };
 
-  
+
   buildInputs = [ securityDependency ];
 
   meta = {
diff --git a/pkgs/tools/security/sshuttle/default.nix b/pkgs/tools/security/sshuttle/default.nix
index 2d663175ec9d..960d11521a74 100644
--- a/pkgs/tools/security/sshuttle/default.nix
+++ b/pkgs/tools/security/sshuttle/default.nix
@@ -1,6 +1,6 @@
 { stdenv, python3Packages, fetchurl, makeWrapper, pandoc
-, coreutils, iptables, nettools, openssh, procps }:
-  
+, coreutils, iptables, nettools, openssh, procps, fetchpatch }:
+
 python3Packages.buildPythonApplication rec {
   name = "sshuttle-${version}";
   version = "0.78.3";
@@ -10,7 +10,13 @@ python3Packages.buildPythonApplication rec {
     url = "mirror://pypi/s/sshuttle/${name}.tar.gz";
   };
 
-  patches = [ ./sudo.patch ];
+  patches = [
+    ./sudo.patch
+    (fetchpatch {
+      url = "https://github.com/sshuttle/sshuttle/commit/91aa6ff625f7c89a19e6f8702425cfead44a146f.patch";
+      sha256 = "0sqcc6kj53wlas2d3klbyilhns6vakzwbbp8y7j9wlmbnc530pks";
+    })
+  ];
 
   nativeBuildInputs = [ makeWrapper pandoc python3Packages.setuptools_scm ];
   buildInputs =
@@ -29,7 +35,7 @@ python3Packages.buildPythonApplication rec {
   wrapProgram $out/bin/sshuttle \
     --prefix PATH : "${mapPath (x: "${x}/bin") buildInputs}" \
   '';
-  
+
   meta = with stdenv.lib; {
     homepage = https://github.com/sshuttle/sshuttle/;
     description = "Transparent proxy server that works as a poor man's VPN";
diff --git a/pkgs/tools/security/tor/default.nix b/pkgs/tools/security/tor/default.nix
index ad94192d14f5..3daf30d2ff0a 100644
--- a/pkgs/tools/security/tor/default.nix
+++ b/pkgs/tools/security/tor/default.nix
@@ -12,6 +12,8 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "geoip" ];
 
+  enableParallelBuilding = true;
+
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ libevent openssl zlib ] ++
     stdenv.lib.optionals stdenv.isLinux [ libseccomp systemd libcap ];
diff --git a/pkgs/tools/security/trousers/default.nix b/pkgs/tools/security/trousers/default.nix
index d9bee3de7f38..8309390d013b 100644
--- a/pkgs/tools/security/trousers/default.nix
+++ b/pkgs/tools/security/trousers/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     homepage    = http://trousers.sourceforge.net/;
     license     = licenses.cpl10;
     maintainers = [ maintainers.ak ];
-    platforms   = platforms.unix;
+    platforms   = platforms.linux;
   };
 }
 
diff --git a/pkgs/tools/system/gdmap/default.nix b/pkgs/tools/system/gdmap/default.nix
index a74ded1fed0a..72938216b0a4 100644
--- a/pkgs/tools/system/gdmap/default.nix
+++ b/pkgs/tools/system/gdmap/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     homepage = http://gdmap.sourceforge.net;
     description = "Recursive rectangle map of disk usage";
     license = licenses.gpl2;
-    platforms = platforms.all;
+    platforms = platforms.linux;
     maintainers = [ maintainers.bjornfor ];
   };
 }
diff --git a/pkgs/tools/text/nawk/default.nix b/pkgs/tools/text/nawk/default.nix
index d3056735b8d1..a746c4544350 100644
--- a/pkgs/tools/text/nawk/default.nix
+++ b/pkgs/tools/text/nawk/default.nix
@@ -36,6 +36,6 @@ stdenv.mkDerivation rec {
     homepage = https://www.cs.princeton.edu/~bwk/btl.mirror/;
     license = stdenv.lib.licenses.mit;
     maintainers = [ stdenv.lib.maintainers.konimex ];
-    platforms = stdenv.lib.platforms.all;
+    platforms = stdenv.lib.platforms.linux;
   };
 }
diff --git a/pkgs/tools/virtualization/awsebcli/default.nix b/pkgs/tools/virtualization/awsebcli/default.nix
new file mode 100644
index 000000000000..91cb148d8fe8
--- /dev/null
+++ b/pkgs/tools/virtualization/awsebcli/default.nix
@@ -0,0 +1,99 @@
+ { stdenv, python }:
+let
+
+  localPython = python.override {
+    packageOverrides = self: super: rec {
+      colorama = super.colorama.overridePythonAttrs (oldAttrs: rec {
+        version = "0.3.7";
+
+        src = super.fetchPypi {
+          inherit (oldAttrs) pname;
+          inherit version;
+          sha256 = "0avqkn6362v7k2kg3afb35g4sfdvixjgy890clip4q174p9whhz0";
+        };
+      });
+
+      docker = super.docker.overridePythonAttrs (oldAttrs: rec {
+          pname = "docker-py";
+          version = "1.7.2";
+          name = "${pname}-${version}";
+
+          src = super.fetchPypi {
+            inherit pname version;
+            sha256 = "0k6hm3vmqh1d3wr9rryyif5n4rzvcffdlb1k4jvzp7g4996d3ccm";
+          };
+        });
+
+      pathspec = super.pathspec.overridePythonAttrs (oldAttrs: rec {
+        version = "0.5.0";
+
+        src = super.fetchPypi {
+          inherit (oldAttrs) pname;
+          inherit version;
+          sha256 = "07yx1gxj9v1iyyiy5fhq2wsmh4qfbrx158wi7jb0nx6lah80ffma";
+        };
+      });
+
+      requests = super.requests.overridePythonAttrs (oldAttrs: rec {
+        version = "2.9.1";
+
+        src = super.fetchPypi {
+          inherit (oldAttrs) pname;
+          inherit version;
+          sha256 = "0zsqrzlybf25xscgi7ja4s48y2abf9wvjkn47wh984qgs1fq2xy5";
+        };
+      });
+
+      semantic-version = super.semantic-version.overridePythonAttrs (oldAttrs: rec {
+        version = "2.5.0";
+
+        src = super.fetchPypi {
+          inherit (oldAttrs) pname; inherit version;
+          sha256 = "0p5n3d6blgkncxdz00yxqav0cis87fisdkirjm0ljjh7rdfx7aiv";
+        };
+      });
+
+      tabulate = super.tabulate.overridePythonAttrs (oldAttrs: rec {
+        version = "0.7.5";
+
+        src = super.fetchPypi {
+          inherit (oldAttrs) pname;
+          inherit version;
+          sha256 = "03l1r7ddd1a0j2snv1yd0hlnghjad3fg1an1jr8936ksv75slwch";
+        };
+      });
+    };
+  };
+in with localPython.pkgs; buildPythonApplication rec {
+  name = "${pname}-${version}";
+  pname = "awsebcli";
+  version = "3.10.5";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1g53z2flhp3navdf8lw6rgh99akf3k0ng1zkkqswvh66zswkxnwn";
+  };
+
+  checkInputs = [
+    pytest mock nose pathspec colorama requests docutils
+  ];
+
+  doCheck = false;
+
+  propagatedBuildInputs = [
+    blessed botocore cement colorama docker dockerpty docopt pathspec pyyaml
+    requests semantic-version setuptools tabulate termcolor websocket_client
+  ];
+
+  postInstall = ''
+    mkdir -p $out/etc/bash_completion.d
+    mv $out/bin/eb_completion.bash $out/etc/bash_completion.d
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = http://aws.amazon.com/elasticbeanstalk/;
+    description = "A command line interface for Elastic Beanstalk.";
+    maintainers = with maintainers; [ eqyiel ];
+    license = licenses.asl20;
+  };
+}
diff --git a/pkgs/tools/virtualization/google-compute-engine/0001-allow-nologin-other-paths.patch b/pkgs/tools/virtualization/google-compute-engine/0001-allow-nologin-other-paths.patch
deleted file mode 100644
index 650e80c24fbe..000000000000
--- a/pkgs/tools/virtualization/google-compute-engine/0001-allow-nologin-other-paths.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From 2e9ac201af238b742c7032962b9b12a8b66bab0c Mon Sep 17 00:00:00 2001
-From: zimbatm <zimbatm@zimbatm.com>
-Date: Mon, 29 May 2017 22:36:15 +0100
-Subject: [PATCH] allow nologin on other paths
-
----
- google_compute_engine/accounts/accounts_utils.py | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/google_compute_engine/accounts/accounts_utils.py b/google_compute_engine/accounts/accounts_utils.py
-index 57e62be..d7eda06 100644
---- a/google_compute_engine/accounts/accounts_utils.py
-+++ b/google_compute_engine/accounts/accounts_utils.py
-@@ -295,8 +295,8 @@ class AccountsUtils(object):
-     # logins. This helps avoid problems caused by operator and root sharing
-     # a home directory in CentOS and RHEL.
-     pw_entry = self._GetUser(user)
--    if pw_entry and pw_entry.pw_shell == '/sbin/nologin':
--      message = 'Not updating user %s. User set /sbin/nologin as login shell.'
-+    if pw_entry and os.path.basename(pw_entry.pw_shell) == 'nologin':
-+      message = 'Not updating user %s. User set `nologin` as login shell.'
-       self.logger.debug(message, user)
-       return True
- 
--- 
-2.13.0
-
diff --git a/pkgs/tools/virtualization/google-compute-engine/default.nix b/pkgs/tools/virtualization/google-compute-engine/default.nix
index 7a5350fe2eb9..bd766d7c5a9f 100644
--- a/pkgs/tools/virtualization/google-compute-engine/default.nix
+++ b/pkgs/tools/virtualization/google-compute-engine/default.nix
@@ -1,27 +1,26 @@
 { lib
 , fetchFromGitHub
-, pythonPackages
+, buildPythonApplication
 , bash
 , shadow
 , systemd
 , utillinux
+, boto
+, setuptools
 }:
-let
-  version = "20170523";
-in
-pythonPackages.buildPythonApplication {
+
+buildPythonApplication rec {
   name = "google-compute-engine-${version}";
+  version = "20170914";
   namePrefix = "";
 
   src = fetchFromGitHub {
     owner = "GoogleCloudPlatform";
     repo = "compute-image-packages";
     rev = version;
-    sha256 = "1qxyj3lj9in6m8yi6y6wcmc3662h9z4qax07v97rdnay99mxdv68";
+    sha256 = "0hlzcrf6yhzan25f4wzy1vbncak9whhqzrzza026ly3sq0smmjpg";
   };
 
-  patches = [ ./0001-allow-nologin-other-paths.patch ];
-
   postPatch = ''
     for file in $(find google_compute_engine -type f); do
       substituteInPlace "$file" \
@@ -44,11 +43,11 @@ pythonPackages.buildPythonApplication {
     cp -r google_config/udev/*.rules $out/lib/udev/rules.d
   '';
 
-  propagatedBuildInputs = with pythonPackages; [ boto setuptools ];
+  propagatedBuildInputs = [ boto setuptools ];
 
   meta = with lib; {
     description = "Google Compute Engine tools and services";
-    homepage = https://github.com/GoogleCloudPlatform/compute-image-packages;
+    homepage = "https://github.com/GoogleCloudPlatform/compute-image-packages";
     license = licenses.asl20;
     maintainers = with maintainers; [ zimbatm ];
   };