Merge branch 'master' into staging

25 files changed, 157 insertions, 45 deletions

diff --git a/pkgs/tools/X11/bumblebee/default.nix b/pkgs/tools/X11/bumblebee/default.nix
index 0429faab2ef8..eac44efdf273 100644
--- a/pkgs/tools/X11/bumblebee/default.nix
+++ b/pkgs/tools/X11/bumblebee/default.nix
@@ -18,7 +18,7 @@
 
 { stdenv, lib, fetchurl, fetchpatch, pkgconfig, help2man, makeWrapper
 , glib, libbsd
-, libX11, libXext, xorgserver, xkbcomp, kmod, xkeyboard_config, xf86videonouveau
+, libX11, libXext, xorgserver, xkbcomp, kmod, xf86videonouveau
 , nvidia_x11, virtualgl, primusLib
 , automake111x, autoconf
 # The below should only be non-null in a x86_64 system. On a i686
@@ -125,7 +125,6 @@ in stdenv.mkDerivation rec {
 
   CFLAGS = [
     "-DX_MODULE_APPENDS=\\\"${xmodules}\\\""
-    "-DX_XKB_DIR=\\\"${xkeyboard_config}/etc/X11/xkb\\\""
   ];
 
   postInstall = ''
diff --git a/pkgs/tools/X11/bumblebee/nixos.patch b/pkgs/tools/X11/bumblebee/nixos.patch
index 00fb8ad7a535..cf6ee5add98f 100644
--- a/pkgs/tools/X11/bumblebee/nixos.patch
+++ b/pkgs/tools/X11/bumblebee/nixos.patch
@@ -49,12 +49,11 @@ index 71a6b73..a682d8a 100644
      char *x_argv[] = {
        XORG_BINARY,
        bb_config.x_display,
-@@ -153,24 +170,25 @@ bool start_secondary(bool need_secondary) {
+@@ -153,24 +170,24 @@ bool start_secondary(bool need_secondary) {
        "-sharevts",
        "-nolisten", "tcp",
        "-noreset",
 +      "-logfile", "/var/log/X.bumblebee.log",
-+      "-xkbdir", X_XKB_DIR,
        "-verbose", "3",
        "-isolateDevice", pci_id,
 -      "-modulepath", bb_config.mod_path, // keep last
diff --git a/pkgs/tools/X11/xpra/default.nix b/pkgs/tools/X11/xpra/default.nix
index 4ae367abf612..eadae7ad3c45 100644
--- a/pkgs/tools/X11/xpra/default.nix
+++ b/pkgs/tools/X11/xpra/default.nix
@@ -1,6 +1,6 @@
 { stdenv, lib, fetchurl, python2Packages, pkgconfig
 , xorg, gtk2, glib, pango, cairo, gdk_pixbuf, atk
-, makeWrapper, xkbcomp, xorgserver, getopt, xauth, utillinux, which, fontsConf, xkeyboard_config
+, makeWrapper, xkbcomp, xorgserver, getopt, xauth, utillinux, which, fontsConf
 , ffmpeg, x264, libvpx, libwebp
 , libfakeXinerama
 , gst_all_1, pulseaudioLight, gobjectIntrospection }:
diff --git a/pkgs/tools/X11/xpra/gtk3.nix b/pkgs/tools/X11/xpra/gtk3.nix
index a9ba93507364..f66b7389f315 100644
--- a/pkgs/tools/X11/xpra/gtk3.nix
+++ b/pkgs/tools/X11/xpra/gtk3.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchurl, buildPythonApplication
 , python, cython, pkgconfig
 , xorg, gtk3, glib, pango, cairo, gdk_pixbuf, atk, pygobject3, pycairo, gobjectIntrospection
-, makeWrapper, xkbcomp, xorgserver, getopt, xauth, utillinux, which, fontsConf, xkeyboard_config
+, makeWrapper, xkbcomp, xorgserver, getopt, xauth, utillinux, which, fontsConf
 , ffmpeg, x264, libvpx, libwebp
 , libfakeXinerama }:
 
diff --git a/pkgs/tools/compression/gzip/default.nix b/pkgs/tools/compression/gzip/default.nix
index 31a67b1baf94..5a27d336c291 100644
--- a/pkgs/tools/compression/gzip/default.nix
+++ b/pkgs/tools/compression/gzip/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  buildInputs = [ xz.bin ];
+  nativeBuildInputs = [ xz.bin ];
 
   preConfigure = if stdenv.isCygwin then ''
     sed -i lib/fpending.h -e 's,include <stdio_ext.h>,,'
diff --git a/pkgs/tools/graphics/graphviz/2.32.nix b/pkgs/tools/graphics/graphviz/2.32.nix
index a09d60f788c7..c4a0981dbb3c 100644
--- a/pkgs/tools/graphics/graphviz/2.32.nix
+++ b/pkgs/tools/graphics/graphviz/2.32.nix
@@ -1,5 +1,6 @@
 { stdenv, fetchurl, pkgconfig, libpng, libjpeg, expat, libXaw
 , yacc, libtool, fontconfig, pango, gd, xorg, gts, gettext, cairo
+, ApplicationServices
 }:
 
 stdenv.mkDerivation rec {
@@ -15,7 +16,7 @@ stdenv.mkDerivation rec {
     [ pkgconfig libpng libjpeg expat libXaw yacc libtool fontconfig
       pango gd gts
     ] ++ stdenv.lib.optionals (xorg != null) [ xorg.xlibsWrapper xorg.libXrender ]
-    ++ stdenv.lib.optional (stdenv.system == "x86_64-darwin") gettext;
+    ++ stdenv.lib.optionals stdenv.isDarwin [ ApplicationServices gettext ];
 
   CPPFLAGS = stdenv.lib.optionalString (stdenv.system == "x86_64-darwin") "-I${cairo.dev}/include/cairo";
 
diff --git a/pkgs/tools/graphics/graphviz/default.nix b/pkgs/tools/graphics/graphviz/default.nix
index e815cded09a1..b0ccc5428bb8 100644
--- a/pkgs/tools/graphics/graphviz/default.nix
+++ b/pkgs/tools/graphics/graphviz/default.nix
@@ -1,6 +1,7 @@
 { stdenv, fetchurl, pkgconfig, libpng, libjpeg, expat
 , yacc, libtool, fontconfig, pango, gd, xorg, gts, libdevil, gettext, cairo
 , flex
+, ApplicationServices
 }:
 
 stdenv.mkDerivation rec {
@@ -20,9 +21,9 @@ stdenv.mkDerivation rec {
     [ pkgconfig libpng libjpeg expat yacc libtool fontconfig gd gts libdevil flex pango
     ] ++ stdenv.lib.optionals (xorg != null)
       (with xorg; [ xlibsWrapper libXrender libXaw libXpm ])
-    ++ stdenv.lib.optional (stdenv.system == "x86_64-darwin") gettext;
+    ++ stdenv.lib.optionals (stdenv.isDarwin) [ ApplicationServices gettext ];
 
-  CPPFLAGS = stdenv.lib.optionalString (xorg != null && stdenv.system == "x86_64-darwin")
+  CPPFLAGS = stdenv.lib.optionalString (xorg != null && stdenv.isDarwin)
     "-I${cairo.dev}/include/cairo";
 
   configureFlags = stdenv.lib.optional (xorg == null) "--without-x";
diff --git a/pkgs/tools/graphics/icoutils/default.nix b/pkgs/tools/graphics/icoutils/default.nix
index 300e05023b1b..70f9e29d0f5d 100644
--- a/pkgs/tools/graphics/icoutils/default.nix
+++ b/pkgs/tools/graphics/icoutils/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, libpng, perl, perlPackages, makeWrapper }:
 
 stdenv.mkDerivation rec {
-  name = "icoutils-0.31.0";
+  name = "icoutils-0.31.1";
 
   src = fetchurl {
     url = "mirror://savannah/icoutils/${name}.tar.bz2";
-    sha256 = "0wdgyfb1clrn3maq84vi4vkwjydy72p5hzk6kb9nb3a19bbxk5d8";
+    sha256 = "14rhd7p7v0rvxsfnrgxf5l4rl6n52h2aq09583glqpgjg0y9vqi6";
   };
 
   buildInputs = [ makeWrapper libpng perl ];
diff --git a/pkgs/tools/misc/ckb/ckb-animations-location.patch b/pkgs/tools/misc/ckb/ckb-animations-location.patch
new file mode 100644
index 000000000000..07dcfab86be8
--- /dev/null
+++ b/pkgs/tools/misc/ckb/ckb-animations-location.patch
@@ -0,0 +1,12 @@
+diff --git a/src/ckb/animscript.cpp b/src/ckb/animscript.cpp
+index d0b7f46..d7a3459 100644
+--- a/src/ckb/animscript.cpp
++++ b/src/ckb/animscript.cpp
+@@ -30,7 +30,7 @@ QString AnimScript::path(){
+ #ifdef __APPLE__
+     return QDir(QApplication::applicationDirPath() + "/../Resources").absoluteFilePath("ckb-animations");
+ #else
+-    return QDir(QApplication::applicationDirPath()).absoluteFilePath("ckb-animations");
++    return QDir(QApplication::applicationDirPath() + "/../libexec").absoluteFilePath("ckb-animations");
+ #endif
+ }
diff --git a/pkgs/tools/misc/ckb/default.nix b/pkgs/tools/misc/ckb/default.nix
new file mode 100644
index 000000000000..f2dc5150bbd7
--- /dev/null
+++ b/pkgs/tools/misc/ckb/default.nix
@@ -0,0 +1,43 @@
+{ stdenv, fetchFromGitHub, libudev, pkgconfig, qtbase, qmakeHook, zlib }:
+
+stdenv.mkDerivation rec {
+  version = "0.2.6";
+  name = "ckb-${version}";
+
+  src = fetchFromGitHub {
+    owner = "ccMSC";
+    repo = "ckb";
+    rev = "v${version}";
+    sha256 = "04h50qdzsbi77mj62jghr52i35vxvmhnvsb7pdfdq95ryry8bnwm";
+  };
+
+  buildInputs = [
+    libudev
+    qtbase
+    zlib
+  ];
+
+  nativeBuildInputs = [
+    pkgconfig
+    qmakeHook
+  ];
+
+  patches = [
+    ./ckb-animations-location.patch
+  ];
+
+  doCheck = false;
+
+  installPhase = ''
+    install -D --mode 0755 --target-directory $out/bin bin/ckb-daemon bin/ckb
+    install -D --mode 0755 --target-directory $out/libexec/ckb-animations bin/ckb-animations/*
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Driver and configuration tool for Corsair keyboards and mice";
+    homepage = https://github.com/ccMSC/ckb;
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ kierdavis ];
+  };
+}
diff --git a/pkgs/tools/misc/clipster/default.nix b/pkgs/tools/misc/clipster/default.nix
index 711e601234de..445b486c8510 100644
--- a/pkgs/tools/misc/clipster/default.nix
+++ b/pkgs/tools/misc/clipster/default.nix
@@ -1,21 +1,22 @@
-{fetchFromGitHub , stdenv, makeWrapper, python, gtk3,  libwnck3 }:
+{fetchFromGitHub , stdenv, makeWrapper, python3, gtk3, libwnck3 }:
 
 stdenv.mkDerivation  rec {
   name = "clipster-unstable-${version}";
-  version = "2016-12-08";
+  version = "2017-01-12";
 
   src = fetchFromGitHub {
     owner = "mrichar1";
     repo = "clipster";
-    rev = "7a3511d89dbbb4157118eec15f1e9e6fd0ad1a6b";
-    sha256 = "005akgk1wn3z5vxfjii202zzwz85zydimfgm69ml68imj5vbhkg1";
+    rev = "d66fbb098149bef687f062bfa111a21c9121851f";
+    sha256 = "0yncjfl0822v2b7f9g7a6ihb99g5hd1s8bfpr2r9nqga6m11k90q";
   };
 
-  pythonEnv = python.withPackages(ps: with ps; [ dbus-python pygtk pygobject3 ]);
+  pythonEnv = python3.withPackages(ps: with ps; [ pygobject3 ]);
 
   buildInputs =  [ pythonEnv gtk3 libwnck3 makeWrapper ];
 
   installPhase = ''
+    sed -i 's/python/python3/g' clipster
     mkdir -p $out/bin/
     cp clipster $out/bin/
     wrapProgram "$out/bin/clipster" \
diff --git a/pkgs/tools/misc/cloc/default.nix b/pkgs/tools/misc/cloc/default.nix
index b58ae6505dc9..fb1c79d250a0 100644
--- a/pkgs/tools/misc/cloc/default.nix
+++ b/pkgs/tools/misc/cloc/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "cloc-${version}";
-  version = "1.70";
+  version = "1.72";
 
   src = fetchFromGitHub {
     owner = "AlDanial";
     repo = "cloc";
     rev = "v${version}";
-    sha256 = "1abkfkjn4fxplq33cwqjmgxabk2x6ij2klqn0w4a0lj82a7xx10x";
+    sha256 = "192z3fzib71y3sjic03ll67xv51igdlpvfhx12yv9wnzkir7lx02";
   };
 
   sourceRoot = "cloc-v${version}-src/Unix";
diff --git a/pkgs/tools/misc/fsmon/default.nix b/pkgs/tools/misc/fsmon/default.nix
new file mode 100644
index 000000000000..d3a1a7124669
--- /dev/null
+++ b/pkgs/tools/misc/fsmon/default.nix
@@ -0,0 +1,25 @@
+{ stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  name = "fsmon-${version}";
+  version = "1.4";
+
+  src = fetchFromGitHub {
+    owner = "nowsecure";
+    repo = "fsmon";
+    rev = "${version}";
+    sha256 = "0sqld41jn142d4zbqmylzrnx1km7xs6r8dnmf453gyhi3yzdbr1j";
+  };
+
+  installPhase = ''
+    make install PREFIX=$out
+  '';
+
+  meta = with stdenv.lib; {
+    description = "FileSystem Monitor utility";
+    homepage = https://github.com/nowsecure/fsmon;
+    license = licenses.mit;
+    maintainers = [ maintainers.dezgeg ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/tools/misc/xvfb-run/default.nix b/pkgs/tools/misc/xvfb-run/default.nix
index c33f09529a56..8bcbf4951d12 100644
--- a/pkgs/tools/misc/xvfb-run/default.nix
+++ b/pkgs/tools/misc/xvfb-run/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, makeWrapper, xkbcomp, xorgserver, getopt, xkeyboard_config
+{ stdenv, fetchurl, makeWrapper, xkbcomp, xorgserver, getopt
 , xauth, utillinux, which, fontsConf, gawk, coreutils }:
 let
   xvfb_run = fetchurl {
@@ -12,7 +12,6 @@ stdenv.mkDerivation {
   buildCommand = ''
     mkdir -p $out/bin
     cp ${xvfb_run} $out/bin/xvfb-run
-    sed -i 's|XVFBARGS="|XVFBARGS="-xkbdir ${xkeyboard_config}/etc/X11/xkb |' $out/bin/xvfb-run
 
     chmod a+x $out/bin/xvfb-run
     wrapProgram $out/bin/xvfb-run \
diff --git a/pkgs/tools/misc/youtube-dl/default.nix b/pkgs/tools/misc/youtube-dl/default.nix
index 8e1519ec1898..ef2164b5a142 100644
--- a/pkgs/tools/misc/youtube-dl/default.nix
+++ b/pkgs/tools/misc/youtube-dl/default.nix
@@ -15,11 +15,11 @@ with stdenv.lib;
 buildPythonApplication rec {
 
   name = "youtube-dl-${version}";
-  version = "2017.01.08";
+  version = "2017.01.14";
 
   src = fetchurl {
     url = "https://yt-dl.org/downloads/${version}/${name}.tar.gz";
-    sha256 = "ac2942d001003575858ff044dd1c1c264ab08527efa1af7036f773ea82b25fd6";
+    sha256 = "76c8bd77db6c820bfa72f1e2a873101ca736fd1d9954ccebf349fa7caef99cca";
   };
 
   buildInputs = [ makeWrapper zip ] ++ optional generateManPage pandoc;
diff --git a/pkgs/tools/networking/fping/default.nix b/pkgs/tools/networking/fping/default.nix
index 83899c2380c3..11e019dfec3b 100644
--- a/pkgs/tools/networking/fping/default.nix
+++ b/pkgs/tools/networking/fping/default.nix
@@ -1,13 +1,15 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "fping-3.13";
+  name = "fping-3.15";
 
   src = fetchurl {
     url = "http://www.fping.org/dist/${name}.tar.gz";
-    sha256 = "082pis2c2ad6kkj35zmsf6xb2lm8v8hdrnjiwl529ldk3kyqxcjb";
+    sha256 = "072jhm9wpz1bvwnwgvz24ijw0xwwnn3z3zan4mgr5s5y6ml8z54n";
   };
 
+  configureFlags = [ "--enable-ipv6" "--enable-ipv4" ];
+
   meta = {
     homepage = "http://fping.org/";
     description = "Send ICMP echo probes to network hosts";
diff --git a/pkgs/tools/networking/offlineimap/default.nix b/pkgs/tools/networking/offlineimap/default.nix
index a11b34ef9914..bed9bba16b06 100644
--- a/pkgs/tools/networking/offlineimap/default.nix
+++ b/pkgs/tools/networking/offlineimap/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchFromGitHub, pythonPackages, }:
 
 pythonPackages.buildPythonApplication rec {
-  version = "7.0.9";
+  version = "7.0.12";
   name = "offlineimap-${version}";
   namePrefix = "";
 
@@ -9,7 +9,7 @@ pythonPackages.buildPythonApplication rec {
     owner = "OfflineIMAP";
     repo = "offlineimap";
     rev = "v${version}";
-    sha256 = "1jrg6n4fpww98vj7gfp2li9ab4pbnrpb249cqa1bs8jjwpmrsqac";
+    sha256 = "1i83p40lxjqnvh88x623iydrwnsxib1k91qbl9myc4hi5i4fnr6x";
   };
 
   doCheck = false;
diff --git a/pkgs/tools/networking/radvd/default.nix b/pkgs/tools/networking/radvd/default.nix
index 1c8ef67a7830..6c74b52b45f5 100644
--- a/pkgs/tools/networking/radvd/default.nix
+++ b/pkgs/tools/networking/radvd/default.nix
@@ -1,16 +1,16 @@
 { stdenv, fetchurl, pkgconfig, libdaemon, bison, flex, check }:
 
 stdenv.mkDerivation rec {
-  name = "radvd-2.13";
+  name = "radvd-${version}";
+  version = "2.15";
 
   src = fetchurl {
     url = "http://www.litech.org/radvd/dist/${name}.tar.xz";
-    sha256 = "1lzgg6zpizcldb78n5gkykjnpr7sqm4r1xy9bm4ig0chbrink4ka";
+    sha256 = "09spyj4f05rjx21v8vmyqmmj0fz1wx810s63md1vf05hyzd0v8dk";
   };
 
-  buildInputs = [ pkgconfig libdaemon bison flex check ];
-
-  hardeningEnable = [ "pie" ];
+  nativeBuildInputs = [ pkgconfig bison flex check ];
+  buildInputs = [ libdaemon ];
 
   meta = with stdenv.lib; {
     homepage = http://www.litech.org/radvd/;
diff --git a/pkgs/tools/networking/strongswan/default.nix b/pkgs/tools/networking/strongswan/default.nix
index 7bcbb4fddb6b..7da47e339d08 100644
--- a/pkgs/tools/networking/strongswan/default.nix
+++ b/pkgs/tools/networking/strongswan/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchurl, gmp, pkgconfig, python, autoreconfHook
 , curl, trousers, sqlite, iptables, libxml2, openresolv
-, ldns, unbound, pcsclite, openssl
+, ldns, unbound, pcsclite, openssl, systemd
 , enableTNC ? false }:
 
 stdenv.mkDerivation rec {
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   dontPatchELF = true;
 
   buildInputs =
-    [ gmp pkgconfig python autoreconfHook iptables ldns unbound openssl pcsclite ]
+    [ gmp pkgconfig python autoreconfHook iptables ldns unbound openssl pcsclite systemd.dev ]
     ++ stdenv.lib.optionals enableTNC [ curl trousers sqlite libxml2 ];
 
   patches = [
@@ -26,10 +26,21 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     substituteInPlace src/libcharon/plugins/resolve/resolve_handler.c --replace "/sbin/resolvconf" "${openresolv}/sbin/resolvconf"
+
+    # swanctl can be configured by files in SWANCTLDIR which defaults to
+    # $out/etc/swanctl. Since that directory is in the nix store users can't
+    # modify it. Ideally swanctl accepts a command line option for specifying
+    # the configuration files. In the absence of that we patch swanctl to look
+    # for configuration files in /etc/swanctl.
+    substituteInPlace src/swanctl/swanctl.h --replace "SWANCTLDIR" "\"/etc/swanctl\""
     '';
 
+  preConfigure = ''
+    configureFlagsArray+=("--with-systemdsystemunitdir=$out/etc/systemd/system")
+  '';
+
   configureFlags =
-    [ "--enable-swanctl" "--enable-cmd"
+    [ "--enable-swanctl" "--enable-cmd" "--enable-systemd"
       "--enable-farp" "--enable-dhcp"
       "--enable-eap-sim" "--enable-eap-sim-file" "--enable-eap-simaka-pseudonym"
       "--enable-eap-simaka-reauth" "--enable-eap-identity" "--enable-eap-md5"
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index 5bfb0b45c1ba..069eab421ec8 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -103,10 +103,10 @@ in rec {
   nix = nixStable;
 
   nixStable = common rec {
-    name = "nix-1.11.5";
+    name = "nix-1.11.6";
     src = fetchurl {
       url = "http://nixos.org/releases/nix/${name}/${name}.tar.xz";
-      sha256 = "272361d091c735b0e80627fa23fb7c600957472301dd7e54d237069452f3addb";
+      sha256 = "e729d55a9276756108a56bc1cbe2e182ee2e4be2b59b1c77d5f0e3edd879b2a3";
     };
   };
 
diff --git a/pkgs/tools/security/pcsclite/default.nix b/pkgs/tools/security/pcsclite/default.nix
index 8116d0dfe9f9..5a40837f1d9d 100644
--- a/pkgs/tools/security/pcsclite/default.nix
+++ b/pkgs/tools/security/pcsclite/default.nix
@@ -3,11 +3,13 @@
 
 stdenv.mkDerivation rec {
   name = "pcsclite-${version}";
-  version = "1.8.17";
+  version = "1.8.20";
 
   src = fetchurl {
-    url = "https://alioth.debian.org/frs/download.php/file/4173/pcsc-lite-${version}.tar.bz2";
-    sha256 = "0vq2291kvnbg8czlakqahxrdhsvp74fqy3z75lfjlkq2aj36yayp";
+    # This URL changes in unpredictable ways, so it is not sensicle
+    # to put a version variable in there.
+    url = "https://alioth.debian.org/frs/download.php/file/4203/pcsc-lite-1.8.20.tar.bz2";
+    sha256 = "1ckb0jf4n585a4j26va3jm2nrv3c1y38974514f8qy3c04a02zgc";
   };
 
   patches = [ ./no-dropdir-literals.patch ];
diff --git a/pkgs/tools/text/gawk/default.nix b/pkgs/tools/text/gawk/default.nix
index c7e0857c2ca4..271a89b784d9 100644
--- a/pkgs/tools/text/gawk/default.nix
+++ b/pkgs/tools/text/gawk/default.nix
@@ -22,8 +22,9 @@ stdenv.mkDerivation rec {
     || stdenv.isFreeBSD
   );
 
-  buildInputs = [ xz.bin ]
-    ++ stdenv.lib.optional (stdenv.system != "x86_64-cygwin") libsigsegv
+  nativeBuildInputs = [ xz.bin ];
+  buildInputs =
+       stdenv.lib.optional (stdenv.system != "x86_64-cygwin") libsigsegv
     ++ stdenv.lib.optional interactive readline
     ++ stdenv.lib.optional stdenv.isDarwin locale;
 
diff --git a/pkgs/tools/text/gnused/default.nix b/pkgs/tools/text/gnused/default.nix
index aa25101636e0..ca038b3ccb49 100644
--- a/pkgs/tools/text/gnused/default.nix
+++ b/pkgs/tools/text/gnused/default.nix
@@ -14,6 +14,14 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ perl ];
   preConfigure = "patchShebangs ./build-aux/help2man";
 
+  crossAttrs = {
+    # The tarball ships with a fine prebuilt manpage, but the make rules try to rebuild it,
+    # which won't work when cross compiling as help2man needs to execute the binaries.
+    postConfigure = ''
+      sed -i Makefile -e 's|doc/sed\.1:|dummy:|'
+    '';
+  };
+
   meta = {
     homepage = http://www.gnu.org/software/sed/;
     description = "GNU sed, a batch stream editor";
diff --git a/pkgs/tools/text/unrtf/default.nix b/pkgs/tools/text/unrtf/default.nix
index 34eea38eb733..c1b4aa1cf2c6 100644
--- a/pkgs/tools/text/unrtf/default.nix
+++ b/pkgs/tools/text/unrtf/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, autoconf, automake, libiconv }:
+{ stdenv, fetchurl, fetchpatch, autoconf, automake, libiconv }:
 
 stdenv.mkDerivation rec {
   name = "unrtf-${version}";
@@ -9,6 +9,14 @@ stdenv.mkDerivation rec {
     sha256 = "1pcdzf2h1prn393dkvg93v80vh38q0v817xnbwrlwxbdz4k7i8r2";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2016-10091-0001-convert.c-Use-safe-buffer-size-and-snprintf.patch";
+      url = "https://bugs.debian.org/cgi-bin/bugreport.cgi?att=1;bug=849705;filename=0001-convert.c-Use-safe-buffer-size-and-snprintf.patch;msg=20";
+      sha256 = "0s0fjvm3zdm9967sijlipfrwjs0h23n2n8fa6f40xxp8y5qq5a0b";
+    })
+  ];
+
   nativeBuildInputs = [ autoconf automake ];
 
   buildInputs = [ ] ++ stdenv.lib.optional stdenv.isDarwin libiconv;
diff --git a/pkgs/tools/typesetting/tex/auctex/default.nix b/pkgs/tools/typesetting/tex/auctex/default.nix
index b910be76b851..a0c6a66634b0 100644
--- a/pkgs/tools/typesetting/tex/auctex/default.nix
+++ b/pkgs/tools/typesetting/tex/auctex/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchurl, emacs, texlive, ghostscript }:
  
 let auctex = stdenv.mkDerivation ( rec {
-  version = "11.89";
+  version = "11.90";
   name = "${pname}-${version}";
 
   # Make this a valid tex(live-new) package;
@@ -14,7 +14,7 @@ let auctex = stdenv.mkDerivation ( rec {
 
   src = fetchurl {
     url = "mirror://gnu/${pname}/${name}.tar.gz";
-    sha256 = "1cf9fkkmzjxa4jvk6c01zgxdikr4zzb5pcx8i4r0hwdk0xljkbwq";
+    sha256 = "13zimbyar3159arrcklmnmjxjvibrjpkac6d53mfv03pwpc2y8rw";
   };
 
   buildInputs = [ emacs texlive.combined.scheme-basic ghostscript ];