Merge remote-tracking branch 'origin/master' into gcc-7

46 files changed, 429 insertions, 114 deletions

diff --git a/pkgs/tools/X11/grobi/default.nix b/pkgs/tools/X11/grobi/default.nix
new file mode 100644
index 000000000000..42f3bbdb0194
--- /dev/null
+++ b/pkgs/tools/X11/grobi/default.nix
@@ -0,0 +1,22 @@
+{ stdenv, fetchFromGitHub, buildGoPackage }:
+
+buildGoPackage rec {
+  version = "0.3.0";
+  name = "grobi-${version}";
+
+  goPackagePath = "github.com/fd0/grobi";
+
+  src = fetchFromGitHub {
+    rev = "78a0639ffad765933a5233a1c94d2626e24277b8";
+    owner = "fd0";
+    repo = "grobi";
+    sha256 = "16q7vnhb1p6ds561832sfdszvlafww67bjn3lc0d18v7lyak2l3i";
+  };
+
+   meta = with stdenv.lib; {
+    homepage = https://github.com/fd0/grobi;
+    description = "Automatically configure monitors/outputs for Xorg via RANDR";
+    license = with licenses; [ bsd2 ];
+    platforms   = platforms.linux;
+  };
+}
diff --git a/pkgs/tools/archivers/p7zip/default.nix b/pkgs/tools/archivers/p7zip/default.nix
index 3550b7d7de36..886ed8179091 100644
--- a/pkgs/tools/archivers/p7zip/default.nix
+++ b/pkgs/tools/archivers/p7zip/default.nix
@@ -15,6 +15,11 @@ stdenv.mkDerivation rec {
       url = "https://src.fedoraproject.org/cgit/rpms/p7zip.git/plain/${name}?id=4b3973f6a5d";
       sha256 = "09wbkzai46bwm8zmplsz0m4jck3qn7snr68i9p1gsih300zidj0m";
     })
+    (fetchpatch rec {
+      name = "CVE-2017-17969.patch";
+      url = "https://anonscm.debian.org/cgit/users/robert/p7zip.git/plain/debian/patches/13-${name}?h=debian/16.02%2bdfsg-5";
+      sha256 = "16lbf6rgyl7xwxfjgg1243jvi39yb3i5pgqfnxswyc0jzhxv81d7";
+    })
   ];
 
   # Default makefile is full of impurities on Darwin. The patch doesn't hurt Linux so I'm leaving it unconditional
diff --git a/pkgs/tools/archivers/unrar/default.nix b/pkgs/tools/archivers/unrar/default.nix
index 9aedda83fd2c..15c0837154e6 100644
--- a/pkgs/tools/archivers/unrar/default.nix
+++ b/pkgs/tools/archivers/unrar/default.nix
@@ -10,7 +10,10 @@ stdenv.mkDerivation rec {
   };
 
   postPatch = ''
-    sed 's/^CXX=g++/#CXX/' -i makefile
+    substituteInPlace makefile \
+      --replace "CXX=" "#CXX=" \
+      --replace "STRIP=" "#STRIP=" \
+      --replace "AR=" "#AR="
   '';
 
   buildPhase = ''
diff --git a/pkgs/tools/archivers/zip/default.nix b/pkgs/tools/archivers/zip/default.nix
index 3c841aa621fe..cb2d29e239dc 100644
--- a/pkgs/tools/archivers/zip/default.nix
+++ b/pkgs/tools/archivers/zip/default.nix
@@ -12,6 +12,9 @@ stdenv.mkDerivation {
     ];
     sha256 = "0sb3h3067pzf3a7mlxn1hikpcjrsvycjcnj9hl9b1c3ykcgvps7h";
   };
+  patchPhase = ''
+    substituteInPlace unix/Makefile --replace 'CC = cc' ""
+  '';
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/tools/audio/beets/alternatives-beets-1.4.6.patch b/pkgs/tools/audio/beets/alternatives-beets-1.4.6.patch
new file mode 100644
index 000000000000..652e0e4a94b0
--- /dev/null
+++ b/pkgs/tools/audio/beets/alternatives-beets-1.4.6.patch
@@ -0,0 +1,30 @@
+diff --git a/test/helper.py b/test/helper.py
+index c216226..d409c09 100644
+--- a/test/helper.py
++++ b/test/helper.py
+@@ -11,6 +11,7 @@ import beets
+ from beets import plugins
+ from beets import ui
+ from beets.library import Item
++from beets.util import MoveOperation
+ 
+ from beetsplug import alternatives
+ from beetsplug import convert
+@@ -183,7 +184,7 @@ class TestHelper(Assertions):
+         item = Item.from_path(os.path.join(self.fixture_dir, 'min.' + ext))
+         item.add(self.lib)
+         item.update(values)
+-        item.move(copy=True)
++        item.move(operation=MoveOperation.COPY)
+         item.write()
+         album = self.lib.add_album([item])
+         album.albumartist = item.artist
+@@ -201,7 +202,7 @@ class TestHelper(Assertions):
+         item = Item.from_path(os.path.join(self.fixture_dir, 'min.mp3'))
+         item.add(self.lib)
+         item.update(values)
+-        item.move(copy=True)
++        item.move(operation=MoveOperation.COPY)
+         item.write()
+         return item
+ 
diff --git a/pkgs/tools/audio/beets/alternatives-plugin.nix b/pkgs/tools/audio/beets/alternatives-plugin.nix
index 27be81733d3b..f808e90281e6 100644
--- a/pkgs/tools/audio/beets/alternatives-plugin.nix
+++ b/pkgs/tools/audio/beets/alternatives-plugin.nix
@@ -11,6 +11,8 @@ pythonPackages.buildPythonApplication rec {
     sha256 = "10za6h59pxa13y8i4amqhc6392csml0dl771lssv6b6a98kamsy7";
   };
 
+  patches = [ ./alternatives-beets-1.4.6.patch ];
+
   postPatch = ''
     sed -i -e '/install_requires/,/\]/{/beets/d}' setup.py
     sed -i -e '/test_suite/d' setup.py
diff --git a/pkgs/tools/backup/btrbk/default.nix b/pkgs/tools/backup/btrbk/default.nix
index e68bf8463637..3565d8cbeb20 100644
--- a/pkgs/tools/backup/btrbk/default.nix
+++ b/pkgs/tools/backup/btrbk/default.nix
@@ -29,9 +29,7 @@ stdenv.mkDerivation rec {
       --replace '$btrbk' 'btrbk'
   '';
 
-  fixupPhase = ''
-    patchShebangs $out/
-
+  preFixup = ''
     wrapProgram $out/sbin/btrbk \
       --set PERL5LIB $PERL5LIB \
       --prefix PATH ':' "${stdenv.lib.makeBinPath [ btrfs-progs bash openssh ]}"
diff --git a/pkgs/tools/compression/gzip/default.nix b/pkgs/tools/compression/gzip/default.nix
index bb9555fa600c..cfe41d3dfe7a 100644
--- a/pkgs/tools/compression/gzip/default.nix
+++ b/pkgs/tools/compression/gzip/default.nix
@@ -2,15 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "gzip-${version}";
-  version = "1.8";
+  version = "1.9";
 
   src = fetchurl {
     url = "mirror://gnu/gzip/${name}.tar.xz";
-    sha256 = "1lxv3p4iyx7833mlihkn5wfwmz4cys5nybwpz3dfawag8kn6f5zz";
+    sha256 = "16h8g4acy7fgfxcjacr3wijjsnixwsfd2jhz3zwdi2qrzi262l5f";
   };
 
-  patches = stdenv.lib.optional hostPlatform.isDarwin stdenv.secure-format-patch;
-
   outputs = [ "out" "man" "info" ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/tools/filesystems/e2fsprogs/default.nix b/pkgs/tools/filesystems/e2fsprogs/default.nix
index e6a83e32632c..6326cda35397 100644
--- a/pkgs/tools/filesystems/e2fsprogs/default.nix
+++ b/pkgs/tools/filesystems/e2fsprogs/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, libuuid, gettext, texinfo }:
+{ stdenv, buildPackages, fetchurl, pkgconfig, libuuid, gettext, texinfo }:
 
 stdenv.mkDerivation rec {
   name = "e2fsprogs-1.43.8";
@@ -10,15 +10,10 @@ stdenv.mkDerivation rec {
 
   outputs = [ "bin" "dev" "out" "man" "info" ];
 
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
   nativeBuildInputs = [ pkgconfig texinfo ];
   buildInputs = [ libuuid ] ++ stdenv.lib.optional (!stdenv.isLinux) gettext;
 
-  crossAttrs = {
-    preConfigure = ''
-      export CC=$crossConfig-gcc
-    '';
-  };
-
   configureFlags =
     if stdenv.isLinux then [
       "--enable-elf-shlibs" "--enable-symlink-install" "--enable-relative-symlinks"
diff --git a/pkgs/tools/filesystems/exfat/default.nix b/pkgs/tools/filesystems/exfat/default.nix
index f404d06eda46..831594973e21 100644
--- a/pkgs/tools/filesystems/exfat/default.nix
+++ b/pkgs/tools/filesystems/exfat/default.nix
@@ -2,22 +2,23 @@
 
 stdenv.mkDerivation rec {
   name = "exfat-${version}";
-  version = "1.2.4";
+  version = "1.2.7";
 
   src = fetchFromGitHub {
-    sha256 = "0x8wjvvlqmp0g2361m6d24csi1p4df8za2cqhyys03s1hv1qmy0k";
-    rev = "v${version}";
-    repo = "exfat";
     owner = "relan";
+    repo = "exfat";
+    rev = "v${version}";
+    sha256 = "1sk4z133djh8sdvx2vvmd8kf4qfly2i3hdar4zpg0s41jpbzdx69";
   };
 
-  buildInputs = [ fuse ];
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  buildInputs = [ fuse ];
 
   meta = with stdenv.lib; {
-    inherit (src.meta) homepage;
     description = "Free exFAT file system implementation";
-    platforms = platforms.linux;
+    inherit (src.meta) homepage;
     license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ dywedir ];
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/tools/graphics/ditaa/default.nix b/pkgs/tools/graphics/ditaa/default.nix
index 56c1c9763621..c8c330d80e5b 100644
--- a/pkgs/tools/graphics/ditaa/default.nix
+++ b/pkgs/tools/graphics/ditaa/default.nix
@@ -1,27 +1,20 @@
-{ stdenv, fetchurl, unzip, jre }:
+{ stdenv, fetchurl, jre }:
 
 stdenv.mkDerivation rec {
-  name = "ditaa-0.9";
+  name = "ditaa-0.11.0";
 
   src = fetchurl {
-    name = "${name}.zip";
-    url = "mirror://sourceforge/project/ditaa/ditaa/0.9/ditaa0_9.zip";
-    sha256 = "12g6k3hacvyw3s9pijli7vfnkspyp37qkr29qgbmq1hbp0ryk2fn";
+    url = https://github.com/stathissideris/ditaa/releases/download/v0.11.0/ditaa-0.11.0-standalone.jar;
+    sha256 = "1acnl7khz8aasg230nbsx9dyf8716scgb5l3679cb2bdzxisl64l";
   };
 
-  buildInputs = [ unzip ];
-
   phases = [ "installPhase" ];
 
   installPhase = ''
-    unzip "$src"
-    
     mkdir -p "$out/bin"
     mkdir -p "$out/lib"
-    mkdir -p "$out/share/ditaa"
 
-    cp dita*.jar "$out/lib/ditaa.jar"
-    cp COPYING HISTORY "$out/share/ditaa"
+    cp ${src} "$out/lib/ditaa.jar"
 
     cat > "$out/bin/ditaa" << EOF
     #!${stdenv.shell}
@@ -33,8 +26,8 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "Convert ascii art diagrams into proper bitmap graphics";
-    homepage = http://ditaa.sourceforge.net/;
-    license = licenses.gpl2;
+    homepage = https://github.com/stathissideris/ditaa;
+    license = licenses.lgpl3;
     platforms = platforms.unix;
     maintainers = [ maintainers.bjornfor ];
   };
diff --git a/pkgs/tools/graphics/fim/default.nix b/pkgs/tools/graphics/fim/default.nix
index c7a22f00dce7..066c181f53c2 100644
--- a/pkgs/tools/graphics/fim/default.nix
+++ b/pkgs/tools/graphics/fim/default.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   name = "fim-${version}";
-  version = "0.5rc3";
+  version = "0.6";
 
   src = fetchurl {
-    url = mirror://savannah/fbi-improved/fim-0.5-rc3.tar.gz;
-    sha256 = "12aka85h469zfj0zcx3xdpan70gq8nf5rackgb1ldcl9mqjn50c2";
+    url = "mirror://savannah/fbi-improved/${name}-trunk.tar.gz";
+    sha256 = "124b7c4flx5ygmy5sqq0gpvxqzafnknbcj6f45ddnbdxik9lazzp";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/misc/bc/cross-bc.patch b/pkgs/tools/misc/bc/cross-bc.patch
new file mode 100644
index 000000000000..ba8857abb581
--- /dev/null
+++ b/pkgs/tools/misc/bc/cross-bc.patch
@@ -0,0 +1,169 @@
+commit fdda59736ddc048cf38a2c7103f4f5d9eeaf995e
+Author: Ben Gamari <ben@smart-cactus.org>
+Date:   Tue Oct 17 10:51:34 2017 -0400
+
+    Try implementing cross-compilation
+
+diff --git a/bc/Makefile.am b/bc/Makefile.am
+index d9d412e..fdef633 100644
+--- a/bc/Makefile.am
++++ b/bc/Makefile.am
+@@ -17,6 +17,7 @@ MAINTAINERCLEANFILES = Makefile.in bc.c bc.h scan.c \
+ 
+ AM_CPPFLAGS = -I$(srcdir) -I$(srcdir)/../h
+ LIBBC = ../lib/libbc.a
++LIBBC_HOST = ../lib/libbc_host.a
+ LIBL = @LEXLIB@
+ LDADD = $(LIBBC) $(LIBL) @READLINELIB@
+ 
+@@ -29,12 +30,20 @@ $(PROGRAMS): libmath.h $(LIBBC)
+ scan.o: bc.h
+ global.o: libmath.h
++
++main_host.c : main.c
++	cp $< $@
+ 
+-fbcOBJ = main.o bc.o scan.o execute.o load.o storage.o util.o warranty.o
++fbcOBJ = $(addsuffix _host,main.o bc.o scan.o execute.o load.o storage.o util.o warranty.o)
++
++%.o_host : CC:=$(CC_FOR_BUILD)
++
++%.o_host : %.c
++	$(COMPILE) -c $(CFLAGS) $(INCLUDES) -o $@ $<
+ 
+-libmath.h: libmath.b $(fbcOBJ) $(LIBBC)
++libmath.h: libmath.b $(fbcOBJ) $(LIBBC_HOST)
+ 	echo '{0}' > libmath.h
+-	$(MAKE) global.o
+-	$(LINK) -o fbc $(fbcOBJ) global.o $(LIBBC) $(LIBL) $(READLINELIB) $(LIBS)
++	$(MAKE) global.o_host
++	$(CC_FOR_BUILD) -o fbc $(fbcOBJ) global.o_host $(LIBBC_HOST) $(LIBL) ${READLINELIB} $(LIBS)
+ 	./fbc -c $(srcdir)/libmath.b </dev/null >libmath.h
+ 	$(srcdir)/fix-libmath_h
+ 	rm -f ./fbc ./global.o
+diff --git a/configure.ac b/configure.ac
+index fc74573..5cabb73 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -20,6 +20,7 @@ m4_define([dc_version], 1.4.1)
+ 
+ AC_INIT([bc],[bc_version])
+ AC_CONFIG_SRCDIR(doc/bc.1)
++AC_CONFIG_MACRO_DIR([m4])
+ AM_INIT_AUTOMAKE([dist-bzip2])
+ AC_CONFIG_HEADERS(config.h)
+ 
+@@ -35,6 +36,7 @@ AC_DEFINE([DC_COPYRIGHT],
+ 	  [Define the dc copyright line.])
+ 
+ AC_PROG_CC
++AX_CC_FOR_BUILD
+ AC_USE_SYSTEM_EXTENSIONS
+ 
+ AM_PROG_LEX
+diff --git a/lib/Makefile.am b/lib/Makefile.am
+index ec4bf59..c670f5b 100644
+--- a/lib/Makefile.am
++++ b/lib/Makefile.am
+@@ -1,5 +1,5 @@
+ ## Process this file with automake to produce Makefile.in
+-noinst_LIBRARIES = libbc.a
++noinst_LIBRARIES = libbc.a libbc_host.a
+ 
+ AM_CPPFLAGS = -I. -I.. -I$(srcdir)/../h
+ 
+@@ -24,3 +24,11 @@ testmul: testmul.o number.o
+ 
+ specialnumber: newnumber.o
+ 	cp newnumber.o number.o
++
++%.o_host : CC:=$(CC_FOR_BUILD)
++%.o_host : %.c
++	$(COMPILE) -c $(CFLAGS) $(INCLUDES) -o $@ $<
++
++libbc_host.a : $(addsuffix _host,$(libbc_a_OBJECTS))
++	ar cru $@ $+
++	ranlib $@
+diff --git a/m4/cc_for_build.m4 b/m4/cc_for_build.m4
+new file mode 100644
+index 0000000..c62ffad
+--- /dev/null
++++ b/m4/cc_for_build.m4
+@@ -0,0 +1,77 @@
++# ===========================================================================
++#     https://www.gnu.org/software/autoconf-archive/ax_cc_for_build.html
++# ===========================================================================
++#
++# SYNOPSIS
++#
++#   AX_CC_FOR_BUILD
++#
++# DESCRIPTION
++#
++#   Find a build-time compiler. Sets CC_FOR_BUILD and EXEEXT_FOR_BUILD.
++#
++# LICENSE
++#
++#   Copyright (c) 2010 Reuben Thomas <rrt@sc3d.org>
++#   Copyright (c) 1999 Richard Henderson <rth@redhat.com>
++#
++#   This program is free software: you can redistribute it and/or modify it
++#   under the terms of the GNU General Public License as published by the
++#   Free Software Foundation, either version 3 of the License, or (at your
++#   option) any later version.
++#
++#   This program is distributed in the hope that it will be useful, but
++#   WITHOUT ANY WARRANTY; without even the implied warranty of
++#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
++#   Public License for more details.
++#
++#   You should have received a copy of the GNU General Public License along
++#   with this program. If not, see <https://www.gnu.org/licenses/>.
++#
++#   As a special exception, the respective Autoconf Macro's copyright owner
++#   gives unlimited permission to copy, distribute and modify the configure
++#   scripts that are the output of Autoconf when processing the Macro. You
++#   need not follow the terms of the GNU General Public License when using
++#   or distributing such scripts, even though portions of the text of the
++#   Macro appear in them. The GNU General Public License (GPL) does govern
++#   all other use of the material that constitutes the Autoconf Macro.
++#
++#   This special exception to the GPL applies to versions of the Autoconf
++#   Macro released by the Autoconf Archive. When you make and distribute a
++#   modified version of the Autoconf Macro, you may extend this special
++#   exception to the GPL to apply to your modified version as well.
++
++#serial 3
++
++dnl Get a default for CC_FOR_BUILD to put into Makefile.
++AC_DEFUN([AX_CC_FOR_BUILD],
++[# Put a plausible default for CC_FOR_BUILD in Makefile.
++if test -z "$CC_FOR_BUILD"; then
++  if test "x$cross_compiling" = "xno"; then
++    CC_FOR_BUILD='$(CC)'
++  else
++    CC_FOR_BUILD=gcc
++  fi
++fi
++AC_SUBST(CC_FOR_BUILD)
++# Also set EXEEXT_FOR_BUILD.
++if test "x$cross_compiling" = "xno"; then
++  EXEEXT_FOR_BUILD='$(EXEEXT)'
++else
++  AC_CACHE_CHECK([for build system executable suffix], bfd_cv_build_exeext,
++    [rm -f conftest*
++     echo 'int main () { return 0; }' > conftest.c
++     bfd_cv_build_exeext=
++     ${CC_FOR_BUILD} -o conftest conftest.c 1>&5 2>&5
++     for file in conftest.*; do
++       case $file in
++       *.c | *.o | *.obj | *.ilk | *.pdb) ;;
++       *) bfd_cv_build_exeext=`echo $file | sed -e s/conftest//` ;;
++       esac
++     done
++     rm -f conftest*
++     test x"${bfd_cv_build_exeext}" = x && bfd_cv_build_exeext=no])
++  EXEEXT_FOR_BUILD=""
++  test x"${bfd_cv_build_exeext}" != xno && EXEEXT_FOR_BUILD=${bfd_cv_build_exeext}
++fi
++AC_SUBST(EXEEXT_FOR_BUILD)])dnl
diff --git a/pkgs/tools/misc/bc/default.nix b/pkgs/tools/misc/bc/default.nix
index 2371e91ae2fc..fc60a000e36e 100644
--- a/pkgs/tools/misc/bc/default.nix
+++ b/pkgs/tools/misc/bc/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchurl, flex, readline, ed, texinfo}:
+{stdenv, autoreconfHook, buildPackages, fetchurl, flex, readline, ed, texinfo}:
 
 stdenv.mkDerivation rec {
   name = "bc-1.07.1";
@@ -9,9 +9,24 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--with-readline" ];
 
-  buildInputs = [flex readline ed texinfo];
+  # As of 1.07 cross-compilation is quite complicated as the build system wants
+  # to build a code generator, bc/fbc, on the build machine.
+  patches = [ ./cross-bc.patch ];
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
+  nativeBuildInputs = [
+    # Tools
+    autoreconfHook ed flex texinfo
+    # Libraries for build
+    buildPackages.readline buildPackages.ncurses
+  ];
+  buildInputs = [ readline ];
 
-  doCheck = true;
+  doCheck = true; # not cross
+
+  # Hack to make sure we never to the relaxation `$PATH` and hooks support for
+  # compatability. This will be replaced with something clearer in a future
+  # masss-rebuild.
+  crossConfig = true;
 
   meta = {
     description = "GNU software calculator";
diff --git a/pkgs/tools/misc/bonfire/default.nix b/pkgs/tools/misc/bonfire/default.nix
index 7937a212951f..16b2169769f1 100644
--- a/pkgs/tools/misc/bonfire/default.nix
+++ b/pkgs/tools/misc/bonfire/default.nix
@@ -19,7 +19,7 @@ buildPythonApplication rec {
   postPatch = ''
     # https://github.com/blue-yonder/bonfire/pull/24
     substituteInPlace requirements.txt \
-      --replace "arrow>=0.5.4,<0.8" "arrow>=0.5.4,<0.11" \
+      --replace "arrow>=0.5.4,<0.8" "arrow>=0.5.4,<0.13" \
       --replace "keyring>=9,<10"    "keyring>=9,<11"
     # pip fails when encountering the git hash for the package version
     substituteInPlace setup.py \
diff --git a/pkgs/tools/misc/ethtool/default.nix b/pkgs/tools/misc/ethtool/default.nix
index 85672619d61c..2527c34feebb 100644
--- a/pkgs/tools/misc/ethtool/default.nix
+++ b/pkgs/tools/misc/ethtool/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "ethtool-${version}";
-  version = "4.13";
+  version = "4.15";
 
   src = fetchurl {
     url = "mirror://kernel/software/network/ethtool/${name}.tar.xz";
-    sha256 = "1flwz4x76ajxigadq9knxgwr778g03y3qfx6c7rflc3x020a7hdp";
+    sha256 = "06pr3s7wg2pbvfbf7js61bgh3caff4qf50nqqk3cgz9z90rgvxvi";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/misc/file/default.nix b/pkgs/tools/misc/file/default.nix
index 47d67f91ec73..3765f9134308 100644
--- a/pkgs/tools/misc/file/default.nix
+++ b/pkgs/tools/misc/file/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, zlib }:
+{ stdenv, fetchurl, file, zlib }:
 
 stdenv.mkDerivation rec {
   name = "file-${version}";
@@ -12,6 +12,7 @@ stdenv.mkDerivation rec {
     sha256 = "0l1bfa0icng9vdwya00ff48fhvjazi5610ylbhl35qi13d6xqfc6";
   };
 
+  nativeBuildInputs = stdenv.lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) file;
   buildInputs = [ zlib ];
 
   doCheck = true;
diff --git a/pkgs/tools/misc/moreutils/default.nix b/pkgs/tools/misc/moreutils/default.nix
index dbb80067e6db..a8d08018c747 100644
--- a/pkgs/tools/misc/moreutils/default.nix
+++ b/pkgs/tools/misc/moreutils/default.nix
@@ -3,12 +3,12 @@
 with stdenv.lib;
 stdenv.mkDerivation rec {
   name = "moreutils-${version}";
-  version = "0.61";
+  version = "0.62";
 
   src = fetchgit {
     url = "git://git.joeyh.name/moreutils";
     rev = "refs/tags/${version}";
-    sha256 = "1qvwlq0a2zs7qkjqc9c842979axkjfdr7nic1gsm4zc6jd72y7pr";
+    sha256 = "0sk7rgqsqbdwr69mh7y4v9lv4v0nfmsrqgvbpy2gvy82snhfzar2";
   };
 
   preBuild = ''
diff --git a/pkgs/tools/misc/ncdu/default.nix b/pkgs/tools/misc/ncdu/default.nix
index 1cb71ce9dd67..330210269d57 100644
--- a/pkgs/tools/misc/ncdu/default.nix
+++ b/pkgs/tools/misc/ncdu/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "ncdu-${version}";
-  version = "1.12";
+  version = "1.13";
 
   src = fetchurl {
     url = "http://dev.yorhel.nl/download/${name}.tar.gz";
-    sha256 = "16j9fyw73y1lk05a35i4q9i66laklgsx41lz5rxfr8m28x3lw3l2";
+    sha256 = "0ni56ymlii577src4dzfbrq1mznbf6i0nka4bvh2sb1971f2ingl";
   };
 
   buildInputs = [ ncurses ];
diff --git a/pkgs/tools/misc/pick/default.nix b/pkgs/tools/misc/pick/default.nix
index 747c98376410..0afd28b3c91b 100644
--- a/pkgs/tools/misc/pick/default.nix
+++ b/pkgs/tools/misc/pick/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "pick-${version}";
-  version = "1.9.0";
+  version = "2.0.1";
 
   src = fetchFromGitHub {
     owner = "calleerlandsson";
     repo = "pick";
     rev = "v${version}";
-    sha256 = "0s0mn9iz17ldhvahggh9rsmgfrjh0kvk5bh4p9xhxcn7rcp0h5ka";
+    sha256 = "0ypawbzpw188rxgv8x044iib3a517j5grgqnxy035ax5zzjavsrr";
   };
 
   buildInputs = [ ncurses ];
diff --git a/pkgs/tools/misc/picocom/default.nix b/pkgs/tools/misc/picocom/default.nix
index dfd81bd97423..57be275d32af 100644
--- a/pkgs/tools/misc/picocom/default.nix
+++ b/pkgs/tools/misc/picocom/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "picocom-${version}";
-  version = "3.0";
+  version = "3.1";
 
   src = fetchFromGitHub {
     owner = "npat-efault";
     repo = "picocom";
     rev = version;
-    sha256 = "1i75ksm44la8kn82v71hzq0q5642y108rascdb94zilhagdhilk2";
+    sha256 = "1vvjydqf0ax47nvdyyl67jafw5b3sfsav00xid6qpgia1gs2r72n";
   };
 
   buildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/misc/tlp/default.nix b/pkgs/tools/misc/tlp/default.nix
index 3614ec3bc68a..91eeb6b0a511 100644
--- a/pkgs/tools/misc/tlp/default.nix
+++ b/pkgs/tools/misc/tlp/default.nix
@@ -14,13 +14,13 @@ let
 
 in stdenv.mkDerivation rec {
   name = "tlp-${version}";
-  version = "1.0";
+  version = "1.1";
 
   src = fetchFromGitHub {
         owner = "linrunner";
         repo = "TLP";
         rev = "${version}";
-        sha256 = "0gq1y1qnzwyv7cw32g4ymlfssi2ayrbnd04y4l242k6n41d05bij";
+        sha256 = "01bhb9hdsck1g2s5jvafr3ywml9k2qz7x2cf42a3z8g5d23pdfpy";
       };
 
   makeFlags = [ "DESTDIR=$(out)"
diff --git a/pkgs/tools/misc/ttwatch/default.nix b/pkgs/tools/misc/ttwatch/default.nix
index b816b5225ca4..d7e1171064c6 100644
--- a/pkgs/tools/misc/ttwatch/default.nix
+++ b/pkgs/tools/misc/ttwatch/default.nix
@@ -1,19 +1,22 @@
-{ stdenv, fetchFromGitHub, cmake, perl, openssl, curl, libusb1 }:
+{ stdenv, fetchFromGitHub, cmake, perl, openssl, curl, libusb1
+, enableUnsafe ? false }:
 
 stdenv.mkDerivation rec {
   name = "ttwatch-${version}";
-  version = "2017-12-31";
+  version = "2018-02-01";
 
   src = fetchFromGitHub {
     owner = "ryanbinns";
     repo = "ttwatch";
-    rev = "a261851d91e3304a47a04995758f6940747bc54a";
-    sha256 = "0llcai1yxikh8nvzry71rr1zz365rg0k0lwp24np5w74kzza3kwx";
+    rev = "b5c54647ed9b640584e53c4c15ee12d210790021";
+    sha256 = "136sskz9hnbwp49gxp983mswzgpl8yfc25ni79csbsnwp0k4lb94";
   };
 
   nativeBuildInputs = [ cmake perl ];
   buildInputs = [ openssl curl libusb1 ];
 
+  cmakeFlags = stdenv.lib.optional enableUnsafe [ "-Dunsafe=on" ];
+
   preFixup = ''
     chmod +x $out/bin/ttbin2mysports
   '';
diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index be42c4a1381a..16b22e3f2554 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -24,11 +24,11 @@ assert brotliSupport -> brotli != null;
 assert gssSupport -> kerberos != null;
 
 stdenv.mkDerivation rec {
-  name = "curl-7.57.0";
+  name = "curl-7.58.0";
 
   src = fetchurl {
     url = "http://curl.haxx.se/download/${name}.tar.bz2";
-    sha256 = "09j88lzqmi79rvvg2l7bjcs56330bq388f5p468hgblf6hdf6by9";
+    sha256 = "0cg7klhf1ksnbw5wvwa802qir877zv4y3dj7swz1xh07g3wq3c0w";
   };
 
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
diff --git a/pkgs/tools/networking/eternal-terminal/default.nix b/pkgs/tools/networking/eternal-terminal/default.nix
new file mode 100644
index 000000000000..8941494e316e
--- /dev/null
+++ b/pkgs/tools/networking/eternal-terminal/default.nix
@@ -0,0 +1,26 @@
+{ stdenv, fetchFromGitHub, cmake, gflags, glog, libsodium, protobuf }:
+
+stdenv.mkDerivation rec {
+  name = "eternal-terminal-${version}";
+  version = "4.1.2";
+
+  src = fetchFromGitHub {
+    owner = "MisterTea";
+    repo = "EternalTCP";
+    rev = "refs/tags/et-v${version}";
+    sha256 = "1zy30ccsddgs2wqwxphnx5i00j4gf69lr68mzg9x6imqfz0sbcjz";
+  };
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ gflags glog libsodium protobuf ];
+
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
+    description = "Remote shell that automatically reconnects without interrupting the session";
+    license = licenses.asl20;
+    homepage = https://mistertea.github.io/EternalTCP/;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.dezgeg ];
+  };
+}
diff --git a/pkgs/tools/networking/i2p/default.nix b/pkgs/tools/networking/i2p/default.nix
index d66ff70180ac..ec268d5d77f6 100644
--- a/pkgs/tools/networking/i2p/default.nix
+++ b/pkgs/tools/networking/i2p/default.nix
@@ -27,10 +27,10 @@ let wrapper = stdenv.mkDerivation rec {
 in
 
 stdenv.mkDerivation rec {
-  name = "i2p-0.9.32";
+  name = "i2p-0.9.33";
   src = fetchurl {
     url = "https://github.com/i2p/i2p.i2p/archive/${name}.tar.gz";
-    sha256 = "1c82yckwzp51wqrr8qhww3sifm1a9nzrymsf9qv99ngsxq4n5l6i";
+    sha256 = "1hlildi34p34xgpm0gqh09r2jb6nsa7a52gr074r6203xkl2racw";
   };
   buildInputs = [ jdk ant gettext which ];
   patches = [ ./i2p.patch ];
diff --git a/pkgs/tools/networking/i2pd/default.nix b/pkgs/tools/networking/i2pd/default.nix
index bd98eca53543..dad00cfd9ee1 100644
--- a/pkgs/tools/networking/i2pd/default.nix
+++ b/pkgs/tools/networking/i2pd/default.nix
@@ -11,13 +11,13 @@ stdenv.mkDerivation rec {
 
   name = pname + "-" + version;
   pname = "i2pd";
-  version = "2.17.0";
+  version = "2.18.0";
 
   src = fetchFromGitHub {
     owner = "PurpleI2P";
     repo = pname;
     rev = version;
-    sha256 = "1yl5h7mls50vkg7x5510mljmgsm02arqhcanwkrqw4ilwvcp1mgz";
+    sha256 = "019psm86n4k7nzxhw7cnbw144gqni59sf35wiy58a6x6dabmvq8h";
   };
 
   buildInputs = with stdenv.lib; [ boost zlib openssl ]
diff --git a/pkgs/tools/networking/jwhois/default.nix b/pkgs/tools/networking/jwhois/default.nix
index 1d7932c7ad38..cd0821ef9ef5 100644
--- a/pkgs/tools/networking/jwhois/default.nix
+++ b/pkgs/tools/networking/jwhois/default.nix
@@ -15,6 +15,8 @@ stdenv.mkDerivation {
 
   patches = [ ./connect.patch ./service-name.patch ];
 
+  makeFlags = [ "AR=${stdenv.cc.bintools.targetPrefix}ar" ];
+
   meta = {
     description = "A client for the WHOIS protocol allowing you to query the owner of a domain name";
     homepage = http://www.gnu.org/software/jwhois/;
diff --git a/pkgs/tools/networking/openssh/default.nix b/pkgs/tools/networking/openssh/default.nix
index 663e7be7e5f3..1c135cd36f48 100644
--- a/pkgs/tools/networking/openssh/default.nix
+++ b/pkgs/tools/networking/openssh/default.nix
@@ -1,15 +1,12 @@
 { stdenv, fetchurl, fetchpatch, zlib, openssl, perl, libedit, pkgconfig, pam, autoreconfHook
 , etcDir ? null
 , hpnSupport ? false
-, withKerberos ? false
+, withKerberos ? true
 , withGssapiPatches ? false
 , kerberos
 , linkOpenssl? true
 }:
 
-assert withKerberos -> kerberos != null;
-assert withGssapiPatches -> withKerberos;
-
 let
 
   # **please** update this patch when you update to a new openssh release.
@@ -23,8 +20,6 @@ let
 in
 with stdenv.lib;
 stdenv.mkDerivation rec {
-  # Please ensure that openssh_with_kerberos still builds when
-  # bumping the version here!
   name = "openssh-${version}";
   version = if hpnSupport then "7.5p1" else "7.6p1";
 
@@ -47,7 +42,7 @@ stdenv.mkDerivation rec {
       # See discussion in https://github.com/NixOS/nixpkgs/pull/16966
       ./dont_create_privsep_path.patch
     ]
-    ++ optional withGssapiPatches gssapiPatch;
+    ++ optional withGssapiPatches (assert withKerberos; gssapiPatch);
 
   postPatch =
     # On Hydra this makes installation fail (sometimes?),
@@ -59,7 +54,8 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ zlib openssl libedit pam ]
     ++ optional withKerberos kerberos
-    ++ optional hpnSupport autoreconfHook;
+    ++ optional hpnSupport autoreconfHook
+    ;
 
   preConfigure = ''
     # Setting LD causes `configure' and `make' to disagree about which linker
@@ -78,7 +74,7 @@ stdenv.mkDerivation rec {
     "--disable-strip"
     (if pam != null then "--with-pam" else "--without-pam")
   ] ++ optional (etcDir != null) "--sysconfdir=${etcDir}"
-    ++ optional withKerberos "--with-kerberos5=${kerberos}"
+    ++ optional withKerberos (assert kerberos != null; "--with-kerberos5=${kerberos}")
     ++ optional stdenv.isDarwin "--disable-libutil"
     ++ optional (!linkOpenssl) "--without-openssl";
 
diff --git a/pkgs/tools/networking/unbound/default.nix b/pkgs/tools/networking/unbound/default.nix
index b124352fd7b9..614447cd5ecf 100644
--- a/pkgs/tools/networking/unbound/default.nix
+++ b/pkgs/tools/networking/unbound/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "unbound-${version}";
-  version = "1.6.7";
+  version = "1.6.8";
 
   src = fetchurl {
-    url = "http://unbound.net/downloads/${name}.tar.gz";
-    sha256 = "17qwfmlls0w9kpkya3dlpn44b3kr87wsswzg3gawc13hh8yx8ysf";
+    url = "https://unbound.net/downloads/${name}.tar.gz";
+    sha256 = "0jfxhh4gc5amhndikskz1s7da27ycn442j3l20bm992n7zijid73";
   };
 
   outputs = [ "out" "lib" "man" ]; # "dev" would only split ~20 kB
diff --git a/pkgs/tools/networking/urlwatch/default.nix b/pkgs/tools/networking/urlwatch/default.nix
index 6a322f649ac4..0c37043de9bb 100644
--- a/pkgs/tools/networking/urlwatch/default.nix
+++ b/pkgs/tools/networking/urlwatch/default.nix
@@ -2,13 +2,13 @@
 
 python3Packages.buildPythonApplication rec {
   name = "urlwatch-${version}";
-  version = "2.7";
+  version = "2.8";
 
   src = fetchFromGitHub {
     owner  = "thp";
     repo   = "urlwatch";
     rev    = version;
-    sha256 = "0fx964z73yv08b1lpymmjsigf6929zx9ax5bp34rcf2c5gk11l5m";
+    sha256 = "1nja7n6pc45azd3l1xyvav89855lvcgwabrvf34rps81dbl8cnl4";
   };
 
   propagatedBuildInputs = with python3Packages; [
diff --git a/pkgs/tools/package-management/nix-prefetch-scripts/default.nix b/pkgs/tools/package-management/nix-prefetch-scripts/default.nix
index 95280bf60b30..a2ff38ab3004 100644
--- a/pkgs/tools/package-management/nix-prefetch-scripts/default.nix
+++ b/pkgs/tools/package-management/nix-prefetch-scripts/default.nix
@@ -6,7 +6,7 @@ let mkPrefetchScript = tool: src: deps:
   stdenv.mkDerivation {
     name = "nix-prefetch-${tool}";
 
-    buildInputs = [ makeWrapper ];
+    nativeBuildInputs = [ makeWrapper ];
 
     unpackPhase = ":";
 
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index d67aebb52360..81031c0a547c 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -26,7 +26,7 @@ let
     inherit name src;
     version = lib.getVersion name;
 
-    is112 = lib.versionAtLeast version "1.12pre";
+    is20 = lib.versionAtLeast version "2.0pre";
 
     VERSION_SUFFIX = lib.optionalString fromGit suffix;
 
@@ -34,14 +34,14 @@ let
 
     nativeBuildInputs =
       [ pkgconfig ]
-      ++ lib.optionals (!is112) [ perl ]
+      ++ lib.optionals (!is20) [ perl ]
       ++ lib.optionals fromGit [ autoreconfHook autoconf-archive bison flex libxml2 libxslt docbook5 docbook5_xsl ];
 
     buildInputs = [ curl openssl sqlite xz ]
       ++ lib.optional (stdenv.isLinux || stdenv.isDarwin) libsodium
       ++ lib.optionals fromGit [ brotli ] # Since 1.12
       ++ lib.optional stdenv.isLinux libseccomp
-      ++ lib.optional ((stdenv.isLinux || stdenv.isDarwin) && is112)
+      ++ lib.optional ((stdenv.isLinux || stdenv.isDarwin) && is20)
           (aws-sdk-cpp.override {
             apis = ["s3"];
             customMemoryManagement = false;
@@ -65,11 +65,11 @@ let
         "--disable-init-state"
         "--enable-gc"
       ]
-      ++ lib.optionals (!is112) [
+      ++ lib.optionals (!is20) [
         "--with-dbi=${perlPackages.DBI}/${perl.libPrefix}"
         "--with-dbd-sqlite=${perlPackages.DBDSQLite}/${perl.libPrefix}"
         "--with-www-curl=${perlPackages.WWWCurl}/${perl.libPrefix}"
-      ] ++ lib.optionals (is112 && stdenv.isLinux) [
+      ] ++ lib.optionals (is20 && stdenv.isLinux) [
         "--with-sandbox-shell=${sh}/bin/busybox"
       ];
 
@@ -160,13 +160,13 @@ in rec {
   }) // { perl-bindings = nixStable; };
 
   nixUnstable = (lib.lowPrio (common rec {
-    name = "nix-unstable-1.12${suffix}";
-    suffix = "pre5873_b76e282d";
+    name = "nix-2.0${suffix}";
+    suffix = "pre5889_c287d731";
     src = fetchFromGitHub {
       owner = "NixOS";
       repo = "nix";
-      rev = "b76e282da8824b679368370e43c994e588994a9a";
-      sha256 = "11clfc8fh8q8s3k4canmn36xhh3zcl2zd8wwddp4pdvdal16b5n6";
+      rev = "c287d7312103bae5e154c0c4dd493371a22ea207";
+      sha256 = "1dwhz93dlk62prh3wfwf8vxfcqjdn21wk0ms65kf5r8ahkfgpgq4";
     };
     fromGit = true;
   })) // { perl-bindings = perl-bindings { nix = nixUnstable; }; };
diff --git a/pkgs/tools/security/mktemp/default.nix b/pkgs/tools/security/mktemp/default.nix
index 8b2a60fd7657..a2a4f82f652c 100644
--- a/pkgs/tools/security/mktemp/default.nix
+++ b/pkgs/tools/security/mktemp/default.nix
@@ -1,16 +1,21 @@
 { stdenv, fetchurl, groff }:
 
 stdenv.mkDerivation {
-  name = "mktemp-1.6";
+  name = "mktemp-1.7";
 
   # Have `configure' avoid `/usr/bin/nroff' in non-chroot builds.
   NROFF = "${groff}/bin/nroff";
 
+  # Don't use "install -s"
+  postPatch = ''
+    substituteInPlace Makefile.in --replace " 0555 -s " " 0555 "
+  '';
+
   src = fetchurl {
-    url = ftp://ftp.mktemp.org/pub/mktemp/mktemp-1.6.tar.gz;
-    sha256 = "1nfj89b0dv1c2fyqi1pg54fyzs3462cbp7jv7lskqsxvqy4mh9x1";
+    url = ftp://ftp.mktemp.org/pub/mktemp/mktemp-1.7.tar.gz;
+    sha256 = "0x969152znxxjbj7387xb38waslr4yv6bnj5jmhb4rpqxphvk54f";
   };
-  
+
   meta = {
     platforms = stdenv.lib.platforms.unix;
   };
diff --git a/pkgs/tools/security/rhash/default.nix b/pkgs/tools/security/rhash/default.nix
index e33c680b4578..68c3edc4cd25 100644
--- a/pkgs/tools/security/rhash/default.nix
+++ b/pkgs/tools/security/rhash/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   # * .h files installed for static library target only
   # * .so.0 -> .so link only created in the static library install target
   buildPhase = ''
-    make lib-shared lib-static build-shared CC=cc PREFIX=$out
+    make lib-shared lib-static build-shared CC=$CC AR=$AR PREFIX=$out
   '';
 
   # we don't actually want the static library, so we remove it after it
diff --git a/pkgs/tools/security/signing-party/default.nix b/pkgs/tools/security/signing-party/default.nix
index 3ec6abc3eb1c..fc7639b1d5a7 100644
--- a/pkgs/tools/security/signing-party/default.nix
+++ b/pkgs/tools/security/signing-party/default.nix
@@ -14,12 +14,12 @@ let
   ];
 in stdenv.mkDerivation rec {
   pname = "signing-party";
-  version = "2.6";
+  version = "2.7";
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "mirror://debian/pool/main/s/${pname}/${pname}_${version}.orig.tar.gz";
-    sha256 = "1n5bpcfpl9vg1xp6r1jhbyahrgdyxp05b5pria1rh4m0qnv8sifr";
+    sha256 = "0znklgvxn7k7p6q7r8chcj86zmzildjamr3qlqfxkj5m7yziqr21";
   };
 
   sourceRoot = ".";
diff --git a/pkgs/tools/security/spectre-meltdown-checker/default.nix b/pkgs/tools/security/spectre-meltdown-checker/default.nix
index 39770433ff36..d03c387a7c6c 100644
--- a/pkgs/tools/security/spectre-meltdown-checker/default.nix
+++ b/pkgs/tools/security/spectre-meltdown-checker/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "spectre-meltdown-checker-${version}";
-  version = "0.33";
+  version = "0.34";
 
   src = fetchFromGitHub {
     owner = "speed47";
     repo = "spectre-meltdown-checker";
     rev = "v${version}";
-    sha256 = "0a0vbzjfmvcvak804y2s0301f9bcnr0nwg2piafx6i6ibisp917y";
+    sha256 = "0jlqxzii883yl5iqmywqqqjlhgswn033566a3vpspycj3sr8zrd2";
   };
 
   prePatch = ''
diff --git a/pkgs/tools/system/awstats/default.nix b/pkgs/tools/system/awstats/default.nix
index 9f0e50642acc..aaf5bf136cb5 100644
--- a/pkgs/tools/system/awstats/default.nix
+++ b/pkgs/tools/system/awstats/default.nix
@@ -41,6 +41,9 @@ perlPackages.buildPerlPackage rec {
     mv wwwroot "$out/wwwroot"
     rm -r "$out/wwwroot/classes/src/"
 
+    mkdir -p "$out/share/awstats"
+    mv tools "$out/share/awstats/tools"
+
     mkdir -p "$bin/bin"
     ln -s "$out/wwwroot/cgi-bin/awstats.pl" "$bin/bin/awstats"
 
diff --git a/pkgs/tools/system/cron/default.nix b/pkgs/tools/system/cron/default.nix
index 4a8babfd6302..d6347798053b 100644
--- a/pkgs/tools/system/cron/default.nix
+++ b/pkgs/tools/system/cron/default.nix
@@ -14,7 +14,9 @@ stdenv.mkDerivation {
   preBuild = ''
     # do not set sticky bit in /nix/store 
     substituteInPlace Makefile --replace ' -o root' ' ' --replace 111 755 --replace 4755 0755
-    makeFlags="DESTROOT=$out CC=cc"
+    # do not strip during install, broken on cross and we'll do ourselves as needed
+    substituteInPlace Makefile --replace ' -s cron' ' cron'
+    makeFlags="DESTROOT=$out CC=$CC"
 
     # We want to ignore the $glibc/include/paths.h definition of
     # sendmail path.
diff --git a/pkgs/tools/system/facter/default.nix b/pkgs/tools/system/facter/default.nix
index b74f99484184..57cbb44cebff 100644
--- a/pkgs/tools/system/facter/default.nix
+++ b/pkgs/tools/system/facter/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   name = "facter-${version}";
-  version = "3.9.0";
+  version = "3.9.3";
 
   src = fetchFromGitHub {
-    sha256 = "1picxrmvka57ph4zqgwqdsqvz3mqppg41wkj8dx37hscwwlbdw0s";
+    sha256 = "1qd0xsw49nbj22czddxk90di31gx43hacvnmh08gp3001a8g0qcj";
     rev = version;
     repo = "facter";
     owner = "puppetlabs";
diff --git a/pkgs/tools/system/freeipmi/default.nix b/pkgs/tools/system/freeipmi/default.nix
index 038393399263..fd70dce4edf3 100644
--- a/pkgs/tools/system/freeipmi/default.nix
+++ b/pkgs/tools/system/freeipmi/default.nix
@@ -1,15 +1,15 @@
-{ fetchurl, stdenv, libgcrypt, readline }:
+{ fetchurl, stdenv, libgcrypt, readline, libgpgerror }:
 
 stdenv.mkDerivation rec {
-  version = "1.5.7";
+  version = "1.6.1";
   name = "freeipmi-${version}";
 
   src = fetchurl {
     url = "mirror://gnu/freeipmi/${name}.tar.gz";
-    sha256 = "1rdxs33klk6956rg8mn2dxwkk43y5yilvgvbcka8g6v4x0r98v5l";
+    sha256 = "0jdm1nwsnkj0nzjmcqprmjk25449mhjj25khwzpq3mpjw440wmd2";
   };
 
-  buildInputs = [ libgcrypt readline ];
+  buildInputs = [ libgcrypt readline libgpgerror ];
 
   doCheck = true;
 
diff --git a/pkgs/tools/system/supervise/default.nix b/pkgs/tools/system/supervise/default.nix
index b6e0700e47f9..c264b73b5023 100644
--- a/pkgs/tools/system/supervise/default.nix
+++ b/pkgs/tools/system/supervise/default.nix
@@ -3,11 +3,11 @@
 stdenv.mkDerivation rec {
 
   name = "supervise-${version}";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchzip {
     url = "https://github.com/catern/supervise/releases/download/v${version}/supervise-${version}.tar.gz";
-    sha256 = "0i20znchvydk8ww31ka4b0wjkaizz38racwgvqj32idwhqgar5x2";
+    sha256 = "07v3197nf3jbx2w6jxzyk9b8p5qjj9irpr4jvv5lkfbi7s6rav3k";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/text/highlight/default.nix b/pkgs/tools/text/highlight/default.nix
index 90d7c2f4aa81..1fcfdd85e7ae 100644
--- a/pkgs/tools/text/highlight/default.nix
+++ b/pkgs/tools/text/highlight/default.nix
@@ -4,13 +4,13 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   name = "highlight-${version}";
-  version = "3.41";
+  version = "3.42";
 
   src = fetchFromGitHub {
     owner = "andre-simon";
     repo = "highlight";
     rev = "${version}";
-    sha256 = "163ghkyv3v6v200pskajlsz6sbq3hi31qx7abjcbwc0dajqfngvj";
+    sha256 = "1fxx827igzqjn5rri57b8980hnd3ixz3j7smfxwi1ivfhlfznzgr";
   };
 
   nativeBuildInputs = [ pkgconfig ] ++ optional stdenv.isDarwin  gcc ;
diff --git a/pkgs/tools/typesetting/pdf2djvu/default.nix b/pkgs/tools/typesetting/pdf2djvu/default.nix
index 847477809406..9a7dac0a0ca1 100644
--- a/pkgs/tools/typesetting/pdf2djvu/default.nix
+++ b/pkgs/tools/typesetting/pdf2djvu/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, pkgconfig, djvulibre, poppler, fontconfig, libjpeg }:
 
 stdenv.mkDerivation rec {
-  version = "0.9.7";
+  version = "0.9.8";
   name = "pdf2djvu-${version}";
 
   src = fetchurl {
     url = "https://github.com/jwilk/pdf2djvu/releases/download/${version}/${name}.tar.xz";
-    sha256 = "1h92f9prx69wz9h57lncxj8ddh2xg6q7hjhlqqzzf30k59il4zcy";
+    sha256 = "0kc3n4lm9dd13w66ng7l637ha241q89xrv9da0wzsdg6v0gp6ifg";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/tools/typesetting/tex/texlive/default.nix b/pkgs/tools/typesetting/tex/texlive/default.nix
index a6b1ac6c9f42..dc8f0908ea89 100644
--- a/pkgs/tools/typesetting/tex/texlive/default.nix
+++ b/pkgs/tools/typesetting/tex/texlive/default.nix
@@ -37,8 +37,10 @@ let
     /* # beware: the URL below changes contents continuously
       curl http://mirror.ctan.org/tex-archive/systems/texlive/tlnet/tlpkg/texlive.tlpdb.xz \
         | xzcat | uniq -u | sed -rn -f ./tl2nix.sed > ./pkgs.nix */
-    orig = import ./pkgs.nix tl; # XXX XXX XXX FIXME: the file is probably too big now XXX XXX XXX XXX XXX XXX
-    removeSelfDep = lib.mapAttrs (n: p: if p ? deps then p // { deps = lib.filterAttrs (dn: _: n != dn) p.deps; } else p);
+    orig = import ./pkgs.nix tl;
+    removeSelfDep = lib.mapAttrs
+      (n: p: if p ? deps then p // { deps = lib.filterAttrs (dn: _: n != dn) p.deps; }
+                         else p);
     clean = removeSelfDep (orig // {
       # overrides of texlive.tlpdb
 
@@ -112,6 +114,10 @@ let
       urls = args.urls or (if args ? url then [ args.url ] else
               map (up: "${up}/${urlName}.tar.xz") urlPrefixes
             );
+
+      # Upstream refuses to distribute stable tarballs, so we host snapshots on IPFS.
+      # Common packages should get served from the binary cache anyway.
+      # See discussions, e.g. https://github.com/NixOS/nixpkgs/issues/24683
       urlPrefixes = args.urlPrefixes or [
         http://146.185.144.154/texlive-2017
         # IPFS GW is second, as it doesn't have a good time-outing behavior
diff --git a/pkgs/tools/virtualization/udocker/default.nix b/pkgs/tools/virtualization/udocker/default.nix
new file mode 100644
index 000000000000..cad6b9866171
--- /dev/null
+++ b/pkgs/tools/virtualization/udocker/default.nix
@@ -0,0 +1,37 @@
+{ stdenv, fetchFromGitHub, proot, patchelf, fakechroot, runc, simplejson, pycurl, coreutils, nose, mock, buildPythonApplication }:
+
+buildPythonApplication rec {
+
+  version = "1.1.1";
+  pname = "udocker";
+
+  src = fetchFromGitHub rec {
+    owner = "indigo-dc";
+    repo = "udocker" ;
+    rev = "v${version}";
+    sha256 = "134xk7rfj0xki9znryk5qf1nsfa318ahrrsi1k6ia7kipp7i3hb4";
+  };
+
+  buildInputs = [ proot patchelf fakechroot runc simplejson pycurl coreutils nose mock ];
+
+  postPatch = ''
+      substituteInPlace udocker.py --replace /usr/sbin:/sbin:/usr/bin:/bin $PATH
+      substituteInPlace udocker.py --replace /bin/chmod ${coreutils}/bin/chmod
+      substituteInPlace udocker.py --replace /bin/rm ${coreutils}/bin/rm
+      substituteInPlace tests/unit_tests.py --replace /bin/rm ${coreutils}/bin/rm
+      substituteInPlace udocker.py --replace "autoinstall = True" "autoinstall = False"
+  '';
+
+  checkPhase = ''
+    NOSE_EXCLUDE=test_03_create_repo,test_04_is_repo,test_02__get_group_from_host nosetests -v tests/unit_tests.py
+  '';
+
+  meta = with stdenv.lib; {
+    description = "basic user tool to execute simple docker containers in user space without root privileges";
+    homepage = https://www.gitbook.com/book/indigo-dc/udocker;
+    license = licenses.asl20;
+    maintainers = [ maintainers.bzizou ];
+    platforms = platforms.linux;
+  };
+
+}