Merge branch 'master' into staging

24 files changed, 243 insertions, 50 deletions

diff --git a/pkgs/tools/admin/google-cloud-sdk/default.nix b/pkgs/tools/admin/google-cloud-sdk/default.nix
index 4a30b68ecaf0..d13bcecb9933 100644
--- a/pkgs/tools/admin/google-cloud-sdk/default.nix
+++ b/pkgs/tools/admin/google-cloud-sdk/default.nix
@@ -7,23 +7,23 @@ assert stdenv.system == "i686-linux" || stdenv.system == "x86_64-linux" || stden
 
 stdenv.mkDerivation rec {
   name = "google-cloud-sdk-${version}";
-  version = "159.0.0";
+  version = "161.0.0";
 
   src =
     if stdenv.system == "i686-linux" then
       fetchurl {
         url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/${name}-linux-x86.tar.gz";
-        sha256 = "12mksd9fj1106zj6k2knlfc3knzm5kkf0s85l5l9zr6f7n0jabpd";
+        sha256 = "43a78a9d2c3ee9d9e50200b1e90512cd53ded40b56e05effe31fe9847b1bdd4c";
       }
     else if stdenv.system == "x86_64-darwin" then
       fetchurl {
         url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/${name}-darwin-x86_64.tar.gz";
-        sha256 = "160zdf7rr2f43qv12yr9c682kk0dh3rlcdqzb2ahpqpajqmcz4qw";
+        sha256 = "0706dbea1279be2bc98a497d1bfed61a9cc29c305d908a376bcdb4403035b323";
       }
     else
       fetchurl {
         url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/${name}-linux-x86_64.tar.gz";
-        sha256 = "0ai2rvk47gsb96k80w6wim04cjxyj5lhrg8kv6dgj53m81sqah2v";
+        sha256 = "7aa6094d1f9c87f4c2c4a6bdad6a1113aac5e72ea673e659d9acbb059dfd037e";
       };
 
   buildInputs = [python27 makeWrapper];
diff --git a/pkgs/tools/archivers/p7zip/default.nix b/pkgs/tools/archivers/p7zip/default.nix
index 8e9db09147ed..3550b7d7de36 100644
--- a/pkgs/tools/archivers/p7zip/default.nix
+++ b/pkgs/tools/archivers/p7zip/default.nix
@@ -10,9 +10,10 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
-    (fetchpatch {
-      url = "https://sources.debian.net/data/main/p/p7zip/16.02+dfsg-2/debian/patches/12-CVE-2016-9296.patch";
-      sha256 = "1i7099h27gmb9dv0lb7jnqfm504gs1c3129r6kvi94yb2gzrzk41";
+    (fetchpatch rec {
+      name = "CVE-2016-9296.patch";
+      url = "https://src.fedoraproject.org/cgit/rpms/p7zip.git/plain/${name}?id=4b3973f6a5d";
+      sha256 = "09wbkzai46bwm8zmplsz0m4jck3qn7snr68i9p1gsih300zidj0m";
     })
   ];
 
diff --git a/pkgs/tools/filesystems/irods/default.nix b/pkgs/tools/filesystems/irods/default.nix
index 72118cada9f1..db69fa64c84d 100644
--- a/pkgs/tools/filesystems/irods/default.nix
+++ b/pkgs/tools/filesystems/irods/default.nix
@@ -40,6 +40,8 @@ in rec {
         -DCMAKE_MODULE_LINKER_FLAGS=-Wl,-rpath,$out/lib
         -DCMAKE_SHARED_LINKER_FLAGS=-Wl,-rpath,$out/lib
         "
+
+      substituteInPlace cmake/server.cmake --replace SETUID ""
     '';
 
     meta = common.meta // {
diff --git a/pkgs/tools/misc/ddccontrol/default.nix b/pkgs/tools/misc/ddccontrol/default.nix
index ddf9c38ec93a..b3aca778cd9e 100644
--- a/pkgs/tools/misc/ddccontrol/default.nix
+++ b/pkgs/tools/misc/ddccontrol/default.nix
@@ -28,6 +28,8 @@ stdenv.mkDerivation {
       oldPath+="{datadir}\/ddccontrol-db"
       sed "s/$oldPath/$newPath/" <configure.ac.old >configure.ac
       rm configure.ac.old
+
+      sed -e "s/chmod 4711/chmod 0711/" -i src/ddcpci/Makefile*
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/misc/fsql/default.nix b/pkgs/tools/misc/fsql/default.nix
index e3a9297c4abf..32deb0c23067 100644
--- a/pkgs/tools/misc/fsql/default.nix
+++ b/pkgs/tools/misc/fsql/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   name = "fsql-${version}";
-  version = "0.2.1";
+  version = "0.3.1";
 
   goPackagePath = "github.com/kshvmdn/fsql";
 
@@ -10,7 +10,7 @@ buildGoPackage rec {
     owner = "kshvmdn";
     repo = "fsql";
     rev = "v${version}";
-    sha256 = "1izcfxm77hjj8z7a2nk9bbwbz4wc2yqzs2ir8v3k822m1hvgwb9a";
+    sha256 = "1accpxryk4744ydfrqc3la5k376ji11yr84n66dz5cx0f3n71vmz";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/misc/fzf/default.nix b/pkgs/tools/misc/fzf/default.nix
index 55f36b5e4462..9d40077e0d68 100644
--- a/pkgs/tools/misc/fzf/default.nix
+++ b/pkgs/tools/misc/fzf/default.nix
@@ -39,6 +39,7 @@ buildGoPackage rec {
     cp -r $src/man/man1 $man/share/man
     mkdir -p $out/share/vim-plugins
     ln -s $out/share/go/src/github.com/junegunn/fzf $out/share/vim-plugins/${name}
+    cp -R $src/shell $out/share/shell
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/misc/hdf4/default.nix b/pkgs/tools/misc/hdf4/default.nix
new file mode 100644
index 000000000000..a227030f0bc4
--- /dev/null
+++ b/pkgs/tools/misc/hdf4/default.nix
@@ -0,0 +1,76 @@
+{ stdenv
+, fetchurl
+, cmake
+, libjpeg
+, szip
+, zlib
+}:
+
+stdenv.mkDerivation rec {
+  name = "hdf-${version}";
+  version = "4.2.12";
+  src = fetchurl {
+    url = "https://support.hdfgroup.org/ftp/HDF/releases/HDF${version}/src/hdf-${version}.tar.bz2";
+    sha256 = "020jh563sjyxsgml8l809d2i1d4ms9shivwj3gbm7n0ilxbll8id";
+  };
+
+  buildInputs = [
+    cmake
+    libjpeg
+    szip
+    zlib
+  ];
+
+  preConfigure = "export SZIP_INSTALL=${szip}";
+
+  cmakeFlags = [
+    "-DBUILD_SHARED_LIBS=ON"
+    "-DBUILD_TESTING=ON"
+    "-DHDF4_BUILD_TOOLS=ON"
+    "-DHDF4_BUILD_UTILS=ON"
+    "-DHDF4_BUILD_WITH_INSTALL_NAME=OFF"
+    "-DHDF4_ENABLE_JPEG_LIB_SUPPORT=ON"
+    "-DHDF4_ENABLE_NETCDF=OFF"
+    "-DHDF4_ENABLE_SZIP_ENCODING=ON"
+    "-DHDF4_ENABLE_SZIP_SUPPORT=ON"
+    "-DHDF4_ENABLE_Z_LIB_SUPPORT=ON"
+    "-DHDF4_BUILD_FORTRAN=OFF"
+    "-DJPEG_DIR=${libjpeg}"
+  ];
+
+  doCheck = true;
+
+  preCheck = ''
+    export LD_LIBRARY_PATH=$(pwd)/bin
+  '' + stdenv.lib.optionalString (stdenv.isDarwin) ''
+    export DYLD_LIBRARY_PATH=$(pwd)/bin
+  '';
+
+  excludedTests = [
+    "MFHDF_TEST-hdftest"
+    "MFHDF_TEST-hdftest-shared"
+    "HDP-dumpsds-18"
+    "NC_TEST-nctest"
+  ];
+
+  checkPhase = let excludedTestsRegex = if (excludedTests != [])
+    then "(" + (stdenv.lib.concatStringsSep "|" excludedTests) + ")"
+    else ""; in ''
+    runHook preCheck
+    ctest -E "${excludedTestsRegex}" --output-on-failure
+    runHook postCheck
+  '';
+
+  outputs = [ "bin" "dev" "out" ];
+
+  postInstall = ''
+    moveToOutput bin "$bin"
+  '';
+
+  meta = {
+    description = "Data model, library, and file format for storing and managing data";
+    homepage = https://support.hdfgroup.org/products/hdf4/;
+    maintainers = with stdenv.lib.maintainers; [ knedlsepp ];
+    platforms = stdenv.lib.platforms.unix;
+  };
+}
diff --git a/pkgs/tools/misc/megacli/default.nix b/pkgs/tools/misc/megacli/default.nix
index cbebd557d77c..5341c9840be8 100644
--- a/pkgs/tools/misc/megacli/default.nix
+++ b/pkgs/tools/misc/megacli/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, rpmextract, ncurses, patchelf, makeWrapper, requireFile, unzip }:
+{ stdenv, rpmextract, ncurses5, patchelf, makeWrapper, requireFile, unzip }:
 
 assert stdenv.system == "x86_64-linux";
 
@@ -12,10 +12,10 @@ stdenv.mkDerivation rec {
       sha256 = "11jzvh25mlygflazd37gi05xv67im4rgq7sbs5nwgw3gxdh4xfjj";
     };
 
-  buildInputs = [rpmextract ncurses unzip makeWrapper];
+  buildInputs = [rpmextract ncurses5 unzip makeWrapper];
   libPath =
     stdenv.lib.makeLibraryPath
-       [ stdenv.cc.cc stdenv.cc.libc ncurses ];
+       [ stdenv.cc.cc stdenv.cc.libc ncurses5 ];
 
   buildCommand = ''
     mkdir -p $out/bin
diff --git a/pkgs/tools/misc/plowshare/default.nix b/pkgs/tools/misc/plowshare/default.nix
index d1b5481ad017..8282c2a1cd96 100644
--- a/pkgs/tools/misc/plowshare/default.nix
+++ b/pkgs/tools/misc/plowshare/default.nix
@@ -1,15 +1,15 @@
-{ stdenv, fetchFromGitHub, makeWrapper, curl, spidermonkey }:
+{ stdenv, fetchFromGitHub, makeWrapper, curl, recode, spidermonkey }:
 
 stdenv.mkDerivation rec {
 
-  name = "plowshare4-${version}";
-  version = "1.1.0";
+  name = "plowshare-${version}";
+  version = "2.1.6";
 
   src = fetchFromGitHub {
     owner = "mcrapet";
     repo = "plowshare";
     rev = "v${version}";
-    sha256 = "1xxkdv4q97dfzbcdnmy5079a59fwh8myxlvdr2dlxdv70fb72sq9";
+    sha256 = "116291w0z1r61xm3a3zjlh85f05pk4ng9f1wbj9kv1j3xrjn4v4c";
   };
 
   buildInputs = [ makeWrapper ];
@@ -19,8 +19,8 @@ stdenv.mkDerivation rec {
   installPhase = ''
     make PREFIX="$out" install
 
-    for fn in plow{del,down,list,up}; do
-      wrapProgram "$out/bin/$fn" --prefix PATH : "${stdenv.lib.makeBinPath [ curl spidermonkey ]}"
+    for fn in plow{del,down,list,mod,probe,up}; do
+      wrapProgram "$out/bin/$fn" --prefix PATH : "${stdenv.lib.makeBinPath [ curl recode spidermonkey ]}"
     done
   '';
 
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
       A command-line download/upload tool for popular file sharing websites
     '';
     license = stdenv.lib.licenses.gpl3;
-    maintainers = [ stdenv.lib.maintainers.aforemny ];
+    maintainers = with stdenv.lib.maintainers; [ aforemny jfrankenau ];
     platforms = stdenv.lib.platforms.linux;
   };
 }
diff --git a/pkgs/tools/misc/screen/default.nix b/pkgs/tools/misc/screen/default.nix
index 7af602106ff3..45b04828b30d 100644
--- a/pkgs/tools/misc/screen/default.nix
+++ b/pkgs/tools/misc/screen/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "screen-${version}";
-  version = "4.5.1";
+  version = "4.6.0";
 
   src = fetchurl {
     url = "mirror://gnu/screen/${name}.tar.gz";
-    sha256 = "0bbv16gpxrh64sn4bvjy3qjy7jsxjlqlilyysin02fwnvla23nwp";
+    sha256 = "1m7yd2bs1i623kk27nfy3qa2mgjp5qjqxwj5qz21r51ycmmp0cwl";
   };
 
   configureFlags= [
diff --git a/pkgs/tools/misc/x11idle/default.nix b/pkgs/tools/misc/x11idle/default.nix
new file mode 100644
index 000000000000..5876cfb6b74a
--- /dev/null
+++ b/pkgs/tools/misc/x11idle/default.nix
@@ -0,0 +1,33 @@
+{ stdenv, xlibs, fetchgit, libXScrnSaver, libX11 }:
+
+stdenv.mkDerivation {
+  name = "x11idle-unstable-2017-07-01";
+
+  src = fetchgit {
+    url = "git://orgmode.org/org-mode.git";
+    rev = "fbd865941f3105f689f78bf053bb3b353b9b8a23";
+    sha256 = "0ma3m48f4s38xln0gl1ww9i5x28ij0ipxc94kx5h2931zy7lqzvz";
+  };
+
+  buildInputs = [ libXScrnSaver libX11 ];
+
+  unpackPhase = ":";
+
+  installPhase = ''
+    mkdir -p $out/bin
+    gcc -lXss -lX11 $src/contrib/scripts/x11idle.c -o $out/bin/x11idle
+  '';
+
+  meta = with stdenv.lib; {
+    description = ''
+      Compute consecutive idle time for current X11 session with millisecond resolution
+    '';
+    longDescription = ''
+      Idle time passes when the user does not act, i.e. when the user doesn't move the mouse or use the keyboard.
+    '';
+    homepage = "http://orgmode.org/";
+    license = licenses.gpl3;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.swflint ];
+  };
+}
diff --git a/pkgs/tools/networking/mailutils/default.nix b/pkgs/tools/networking/mailutils/default.nix
index 0ae993db332e..f83ea004db63 100644
--- a/pkgs/tools/networking/mailutils/default.nix
+++ b/pkgs/tools/networking/mailutils/default.nix
@@ -14,6 +14,12 @@ stdenv.mkDerivation rec {
 
   patches = [ ./path-to-cat.patch ./no-gets.patch ./scm_c_string.patch ];
 
+  postPatch = ''
+    sed -i -e '/chown root:mail/d' \
+           -e 's/chmod [24]755/chmod 0755/' \
+      */Makefile{,.in,.am}
+  '';
+
   configureFlags = [
     "--with-gsasl"
     "--with-gssapi=${gss}"
diff --git a/pkgs/tools/networking/netselect/default.nix b/pkgs/tools/networking/netselect/default.nix
index f326059d9d77..6015ff9fbc7c 100644
--- a/pkgs/tools/networking/netselect/default.nix
+++ b/pkgs/tools/networking/netselect/default.nix
@@ -8,10 +8,13 @@ stdenv.mkDerivation {
     sha256 = "0y69z59vylj9x9nk5jqn6ihx7dkzg09gpv2w1q1rs8fmi4jr90gy";
   };
 
-  preBuild = "
+  preBuild = ''
     makeFlagsArray=(PREFIX=$out)
-    substituteInPlace Makefile --replace '-o root' '' --replace '-g root' ''
-  ";
+    substituteInPlace Makefile \
+      --replace "-o root" "" \
+      --replace "-g root" "" \
+      --replace "4755"    "0755"
+  '';
   
   meta = {
     homepage = http://alumnit.ca/~apenwarr/netselect/;
diff --git a/pkgs/tools/networking/nzbget/default.nix b/pkgs/tools/networking/nzbget/default.nix
index e7a23b70ce9a..d72ee844c0ec 100644
--- a/pkgs/tools/networking/nzbget/default.nix
+++ b/pkgs/tools/networking/nzbget/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   name = "nzbget-${version}";
-  version = "18.1";
+  version = "19.0";
 
   src = fetchurl {
     url = "http://github.com/nzbget/nzbget/releases/download/v${version}/nzbget-${version}-src.tar.gz";
-    sha256 = "069q75b0s9fzzy15m96dhn83jypgc91yx998rl0nykfcl7nzkxyx";
+    sha256 = "08kgi4zmh4h1pvxh8x4c3ydf9xl2s6ncm579f0wdm2zknvpf0j16";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/tools/networking/offlineimap/default.nix b/pkgs/tools/networking/offlineimap/default.nix
index 70a4bc87b97f..ae0318faaa71 100644
--- a/pkgs/tools/networking/offlineimap/default.nix
+++ b/pkgs/tools/networking/offlineimap/default.nix
@@ -2,7 +2,7 @@
   asciidoc, libxml2, libxslt, docbook_xml_xslt }:
 
 pythonPackages.buildPythonApplication rec {
-  version = "7.1.0";
+  version = "7.1.1";
   name = "offlineimap-${version}";
   namePrefix = "";
 
@@ -10,7 +10,7 @@ pythonPackages.buildPythonApplication rec {
     owner = "OfflineIMAP";
     repo = "offlineimap";
     rev = "v${version}";
-    sha256 = "10hxzp2hwkarvmwhw9mxbp9wkbclxwm6n0d7i4xs8r1s94yiffb3";
+    sha256 = "12fv6fzi3cb0hkvs4h5vj2i440d85wzjjyjl90zvyxvlfy0pmljl";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/security/browserpass/default.nix b/pkgs/tools/security/browserpass/default.nix
index edc46fee5828..9f8a00c5956d 100644
--- a/pkgs/tools/security/browserpass/default.nix
+++ b/pkgs/tools/security/browserpass/default.nix
@@ -1,17 +1,17 @@
 # This file was generated by https://github.com/kamilchm/go2nix v1.2.0
-{ stdenv, buildGoPackage, fetchgit, fetchhg, fetchbzr, fetchsvn }:
+{ stdenv, buildGoPackage, fetchFromGitHub }:
 
 buildGoPackage rec {
   name = "browserpass-${version}";
-  version = "2017-04-11";
-  rev = "e0fe250ed8fd061125746f5d99a1f9a678d21004";
+  version = "1.0.5";
 
   goPackagePath = "github.com/dannyvankooten/browserpass";
 
-  src = fetchgit {
-    inherit rev;
-    url = "https://github.com/dannyvankooten/browserpass";
-    sha256 = "0khwlh5agdd2mm2yzklg8r2h084n8j7jbjjxsiaj67zm8zz6b39c";
+  src = fetchFromGitHub {
+    repo = "browserpass";
+    owner = "dannyvankooten";
+    rev = version;
+    sha256 = "1r9x1asgblay7pry2jpgfisfgb3423x3cqd3g68q8b98zvc9l9lz";
   };
 
   postInstall = ''
@@ -21,14 +21,15 @@ buildGoPackage rec {
       sed -e "s!%%replace%%!$host_file!" go/src/${goPackagePath}/chrome/host.json > chrome-host.json
       sed -e "s!%%replace%%!$host_file!" go/src/${goPackagePath}/firefox/host.json > firefox-host.json
 
-      install -D chrome-host.json $bin/etc/chrome-host.json
+      install chrome-host.json $bin/etc/
       install -D firefox-host.json $bin/lib/mozilla/native-messaging-hosts/com.dannyvankooten.browserpass.json
+      install go/src/${goPackagePath}/chrome/policy.json $bin/etc/chrome-policy.json
   '';
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "A Chrome & Firefox extension for zx2c4's pass";
-    homepage = "https://github.com/dannyvankooten/browserpass";
-    license = stdenv.lib.licenses.mit;
-    platforms = stdenv.lib.platforms.linux ++ stdenv.lib.platforms.darwin;
+    homepage = https://github.com/dannyvankooten/browserpass;
+    license = licenses.mit;
+    platforms = with platforms; linux ++ darwin ++ openbsd;
   };
 }
diff --git a/pkgs/tools/security/gen-oath-safe/default.nix b/pkgs/tools/security/gen-oath-safe/default.nix
new file mode 100644
index 000000000000..49770813b2b6
--- /dev/null
+++ b/pkgs/tools/security/gen-oath-safe/default.nix
@@ -0,0 +1,41 @@
+{ coreutils, fetchFromGitHub, libcaca, makeWrapper, python, openssl, qrencode, stdenv, yubikey-manager }:
+
+stdenv.mkDerivation {
+  name = "gen-oath-safe-2017-01-23";
+  src = fetchFromGitHub {
+    owner = "mcepl";
+    repo = "gen-oath-safe";
+    rev = "fb53841";
+    sha256 = "0018kqmhg0861r5xkbis2a1rx49gyn0dxcyj05wap5ms7zz69m0m";
+  };
+
+  buildInputs = [ makeWrapper ];
+
+  buildPhase = ":";
+
+  installPhase =
+    let
+      path = stdenv.lib.makeBinPath [
+        coreutils
+        libcaca.bin
+        openssl.bin
+        python
+        qrencode
+        yubikey-manager
+      ];
+    in
+    ''
+      mkdir -p $out/bin
+      cp gen-oath-safe $out/bin/
+      wrapProgram $out/bin/gen-oath-safe \
+        --prefix PATH : ${path}
+    '';
+  meta = with stdenv.lib; {
+    homepage = https://github.com/mcepl/gen-oath-safe;
+    description = "Script for generating HOTP/TOTP keys (and QR code)";
+    platforms =  platforms.unix;
+    license = licenses.mit;
+    maintainers = [ maintainers.makefu ];
+  };
+
+}
diff --git a/pkgs/tools/security/tor/default.nix b/pkgs/tools/security/tor/default.nix
index 05dbe6b7d84f..2555aeccea4c 100644
--- a/pkgs/tools/security/tor/default.nix
+++ b/pkgs/tools/security/tor/default.nix
@@ -3,11 +3,11 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "tor-0.3.0.8";
+  name = "tor-0.3.0.9";
 
   src = fetchurl {
     url = "https://dist.torproject.org/${name}.tar.gz";
-    sha256 = "0j0dhq1zp6w6zy7y4kiw7zg1imbgv8nsl7imlzwc0951p2kknfk6";
+    sha256 = "0hhyb1wil8japynqnm07r1f67w3wdnafdg9amzlrrcfcyq5qim28";
   };
 
   outputs = [ "out" "geoip" ];
diff --git a/pkgs/tools/system/collectd/default.nix b/pkgs/tools/system/collectd/default.nix
index 4aa5aee4c272..824eb74b72e5 100644
--- a/pkgs/tools/system/collectd/default.nix
+++ b/pkgs/tools/system/collectd/default.nix
@@ -52,9 +52,21 @@ stdenv.mkDerivation rec {
 
   # for some reason libsigrok isn't auto-detected
   configureFlags =
+    [ "--localstatedir=/var" ] ++
     stdenv.lib.optional (libsigrok != null) "--with-libsigrok" ++
     stdenv.lib.optional (python != null) "--with-python=${python}/bin/python";
 
+  # do not create directories in /var during installPhase
+  postConfigure = ''
+     substituteInPlace Makefile --replace '$(mkinstalldirs) $(DESTDIR)$(localstatedir)/' '#'
+  '';
+
+  postInstall = ''
+    if [ -d $out/share/collectd/java ]; then
+      mv $out/share/collectd/java $out/share/
+    fi
+  '';
+
   meta = with stdenv.lib; {
     description = "Daemon which collects system performance statistics periodically";
     homepage = https://collectd.org;
diff --git a/pkgs/tools/system/mcron/default.nix b/pkgs/tools/system/mcron/default.nix
index a90d6afdc61f..5863504c7040 100644
--- a/pkgs/tools/system/mcron/default.nix
+++ b/pkgs/tools/system/mcron/default.nix
@@ -10,6 +10,11 @@ stdenv.mkDerivation rec {
 
   patches = [ ./install-vixie-programs.patch ];
 
+  # don't attempt to chmod +s files in the nix store
+  postPatch = ''
+    substituteInPlace makefile.in --replace "rwxs" "rwx"
+  '';
+
   buildInputs = [ guile which ed ];
 
   doCheck = true;
diff --git a/pkgs/tools/system/runit/default.nix b/pkgs/tools/system/runit/default.nix
index 03da7bc657f6..61c61226acd6 100644
--- a/pkgs/tools/system/runit/default.nix
+++ b/pkgs/tools/system/runit/default.nix
@@ -23,6 +23,9 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     sed -i "s,\(#define RUNIT\) .*,\1 \"$out/bin/runit\"," src/runit.h
+    # usernamespace sandbox of nix seems to conflict with runit's assumptions
+    # about unix users. Therefor skip the check
+    sed -i '/.\/chkshsgr/d' src/Makefile
   '' + stdenv.lib.optionalString (!static) ''
     sed -i 's,-static,,g' src/Makefile
   '';
diff --git a/pkgs/tools/text/xsv/default.nix b/pkgs/tools/text/xsv/default.nix
index 9e15649133f6..12061b75a9de 100644
--- a/pkgs/tools/text/xsv/default.nix
+++ b/pkgs/tools/text/xsv/default.nix
@@ -4,16 +4,16 @@ with rustPlatform;
 
 buildRustPackage rec {
   name = "xsv-${version}";
-  version = "0.11.0";
+  version = "0.12.1";
 
   src = fetchFromGitHub {
     owner = "BurntSushi";
     repo = "xsv";
     rev = "${version}";
-    sha256 = "169rp4izcjhhlrqrhvlvsbiz7wqfi6g3kjfgrddgvahp0ls29hls";
+    sha256 = "0xmjx5grwjrx2zsqmpblid9pqpwkk9pv468ffqlza3w35n9x5dax";
   };
 
-  depsSha256 = "006sp66l2gybyk1n7lxp645k6drz5cgxcix376k8qr0v9jwadlqa";
+  depsSha256 = "0gdbxgykhy6wm89mbdvl7ck2v0f66hwlm0m1q7r64bkb7i10fmkd";
 
   meta = with stdenv.lib; {
     description = "A fast CSV toolkit written in Rust";
diff --git a/pkgs/tools/typesetting/tex/texlive/combine.nix b/pkgs/tools/typesetting/tex/texlive/combine.nix
index c783316c6d55..9af1d6a59ffd 100644
--- a/pkgs/tools/typesetting/tex/texlive/combine.nix
+++ b/pkgs/tools/typesetting/tex/texlive/combine.nix
@@ -155,18 +155,24 @@ in buildEnv {
         --prefix PERL5LIB : "$out/share/texmf/scripts/texlive"
 
       # avoid using non-nix shebang in $target by calling interpreter
-      if [[ "$(head -c 2 $target)" = "#!" ]]; then
-        local cmdline="$(head -n 1 $target | sed 's/^\#\! *//;s/ *$//')"
+      if [[ "$(head -c 2 "$target")" = "#!" ]]; then
+        local cmdline="$(head -n 1 "$target" | sed 's/^\#\! *//;s/ *$//')"
         local relative=`basename "$cmdline" | sed 's/^env //' `
         local newInterp=`echo "$relative" | cut -d\  -f1`
         local params=`echo "$relative" | cut -d\  -f2- -s`
-        local newPath="$(type -P $newInterp)"
+        local newPath="$(type -P "$newInterp")"
         if [[ -z "$newPath" ]]; then
           echo " Warning: unknown shebang '$cmdline' in '$target'"
           continue
         fi
         echo " and patching shebang '$cmdline'"
         sed "s|^exec |exec $newPath $params |" -i "$link"
+
+      elif head -n 1 "$target" | grep -q 'exec perl'; then
+        # see #24343 for details of the problem
+        echo " and patching weird perl shebang"
+        sed "s|^exec |exec '${perl}/bin/perl' -w |" -i "$link"
+
       else
         sed 's|^exec |exec -a "$0" |' -i "$link"
         echo
diff --git a/pkgs/tools/typesetting/tex/texlive/default.nix b/pkgs/tools/typesetting/tex/texlive/default.nix
index 701ce7f67b2d..692f6b1772c7 100644
--- a/pkgs/tools/typesetting/tex/texlive/default.nix
+++ b/pkgs/tools/typesetting/tex/texlive/default.nix
@@ -4,7 +4,7 @@
 */
 { stdenv, lib, fetchurl, runCommand, writeText, buildEnv
 , callPackage, ghostscriptX, harfbuzz, poppler_min
-, makeWrapper, perl, python, ruby
+, makeWrapper, perl522, python, ruby
 , useFixedHashes ? true
 , recurseIntoAttrs
 }:
@@ -28,7 +28,8 @@ let
   # function for creating a working environment from a set of TL packages
   combine = import ./combine.nix {
     inherit bin combinePkgs buildEnv fastUnique lib makeWrapper writeText
-      perl stdenv python ruby;
+      stdenv python ruby;
+    perl = perl522; # avoid issues like #26890, probably remove after texlive upgrade
   };
 
   # the set of TeX Live packages, collections, and schemes; using upstream naming