Merge remote-tracking branch 'origin/master' into gcc-7

42 files changed, 322 insertions, 152 deletions

diff --git a/pkgs/tools/X11/xcalib/default.nix b/pkgs/tools/X11/xcalib/default.nix
index 65868a3b6b0d..2f925b11ba5c 100644
--- a/pkgs/tools/X11/xcalib/default.nix
+++ b/pkgs/tools/X11/xcalib/default.nix
@@ -1,14 +1,16 @@
-{ stdenv, fetchurl, libX11, libXxf86vm, libXext }:
+{ stdenv, fetchFromGitHub, libX11, libXxf86vm, libXext, libXrandr }:
 
 stdenv.mkDerivation rec {
-  name = "xcalib-0.8";
+  name = "xcalib-0.10";
 
-  src = fetchurl {
-    url = "mirror://sourceforge/xcalib/xcalib-source-0.8.tar.gz";
-    sha256 = "8a112ee710e5446f6c36e62345b2066f10639d500259db8c48bf1716caea06e6";
+  src = fetchFromGitHub {
+    owner = "OpenICC";
+    repo = "xcalib";
+    rev = "f95abc1a551d7c695a8b142c4d9d5035368d482d";
+    sha256 = "05fzdjmhiafgi2jf0k41i3nm0837a78sb6yv59cwc23nla8g0bhr";
   };
 
-  buildInputs = [ libX11 libXxf86vm libXext ];
+  buildInputs = [ libX11 libXxf86vm libXext libXrandr ];
 
   installPhase = ''
     mkdir -p $out/bin
@@ -16,7 +18,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with stdenv.lib; {
-    homepage = http://xcalib.sourceforge.net/;
+    inherit (src.meta) homepage;
     description = "A tiny monitor calibration loader for X and MS-Windows";
     license = licenses.gpl2;
     maintainers = [ maintainers.rickynils ];
diff --git a/pkgs/tools/audio/beets/default.nix b/pkgs/tools/audio/beets/default.nix
index c711881d528f..899845a044c6 100644
--- a/pkgs/tools/audio/beets/default.nix
+++ b/pkgs/tools/audio/beets/default.nix
@@ -195,7 +195,7 @@ in pythonPackages.buildPythonApplication rec {
     BASH_COMPLETION_SCRIPT="${completion}" \
     HOME="$(mktemp -d)" \
       # Exclude failing test https://github.com/beetbox/beets/issues/2652
-      nosetests -v --exclude="test_single_month_nonmatch_"
+      nosetests -v --exclude=test_single_month_nonmatch_ --exclude=test_asciify_variable --exclude=test_asciify_character_expanding_to_slash
 
     runHook postCheck
   '';
diff --git a/pkgs/tools/filesystems/cryfs/default.nix b/pkgs/tools/filesystems/cryfs/default.nix
index 0469ad54eb13..7bbfafef819d 100644
--- a/pkgs/tools/filesystems/cryfs/default.nix
+++ b/pkgs/tools/filesystems/cryfs/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   name = "cryfs-${version}";
-  version = "0.9.7";
+  version = "0.9.8";
 
   src = fetchFromGitHub {
     owner  = "cryfs";
     repo   = "cryfs";
     rev    = "${version}";
-    sha256 = "1wsv4cyjkyg3cyr6vipw1mj41bln2m69123l3miav8r4mvmkfq8w";
+    sha256 = "1lrzmzjakv08qjq09a3krllfw5vrgblfxzijpf3lm3yjgih63r1k";
   };
 
   prePatch = ''
diff --git a/pkgs/tools/graphics/optipng/default.nix b/pkgs/tools/graphics/optipng/default.nix
index f9b82a38344e..fd0b0caea4ca 100644
--- a/pkgs/tools/graphics/optipng/default.nix
+++ b/pkgs/tools/graphics/optipng/default.nix
@@ -7,11 +7,11 @@
 with stdenv.lib;
 
 stdenv.mkDerivation rec {
-  name = "optipng-0.7.6";
+  name = "optipng-0.7.7";
 
   src = fetchurl {
     url = "mirror://sourceforge/optipng/${name}.tar.gz";
-    sha256 = "105yk5qykvhiahzag67gm36s2kplxf6qn5hay02md0nkrcgn6w28";
+    sha256 = "0lj4clb851fzpaq446wgj0sfy922zs5l5misbpwv6w7qrqrz4cjg";
   };
 
   buildInputs = [ libpng ];
diff --git a/pkgs/tools/graphics/pngcrush/default.nix b/pkgs/tools/graphics/pngcrush/default.nix
index 3bcbc5d5eade..fce1f3f913cf 100644
--- a/pkgs/tools/graphics/pngcrush/default.nix
+++ b/pkgs/tools/graphics/pngcrush/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, libpng }:
 
 stdenv.mkDerivation rec {
-  name = "pngcrush-1.8.1";
+  name = "pngcrush-1.8.13";
 
   src = fetchurl {
     url = "mirror://sourceforge/pmt/${name}-nolib.tar.xz";
-    sha256 = "1h3sibmmiq4ynvf8hrpksfrbcmszxh4bqpkqy5c0m8828c7drpr9";
+    sha256 = "0l43c59d6v9l0g07z3q3ywhb8xb3vz74llv3mna0izk9bj6aqkiv";
   };
 
   makeFlags = [ "CC=cc" "LD=cc" ];      # gcc and/or clang compat
diff --git a/pkgs/tools/inputmethods/fcitx-engines/fcitx-libpinyin/default.nix b/pkgs/tools/inputmethods/fcitx-engines/fcitx-libpinyin/default.nix
index 6022bcebc3b2..f2610efd2eb4 100644
--- a/pkgs/tools/inputmethods/fcitx-engines/fcitx-libpinyin/default.nix
+++ b/pkgs/tools/inputmethods/fcitx-engines/fcitx-libpinyin/default.nix
@@ -1,16 +1,16 @@
-{ stdenv, fetchurl, cmake, pkgconfig, fcitx, gettext, libpinyin, glib, pcre, dbus, qt4 }:
+{ stdenv, fetchurl, cmake, pkgconfig, fcitx, gettext, libpinyin, glib, pcre, dbus, qtwebengine, qtbase, fcitx-qt5 }:
 
 stdenv.mkDerivation rec {
   name = "fcitx-libpinyin-${version}";
-  version = "0.3.91";
+  version = "0.5.3";
 
   src = fetchurl {
     url = "http://download.fcitx-im.org/fcitx-libpinyin/${name}.tar.xz";
-    sha256 = "19h0p1s8bkw24v7x6v19fg7dqpz2kkjlvvrqhypi5bkkvfswf7xn";
+    sha256 = "196c229ckib3xvafkk4n3n3jk9rpksfcjsbbwka6a9k2f34qrjj6";
   };
 
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ cmake fcitx gettext libpinyin glib pcre dbus qt4 ];
+  nativeBuildInputs = [ pkgconfig  ];
+  buildInputs = [ fcitx-qt5 qtbase qtwebengine.dev cmake fcitx gettext libpinyin glib pcre dbus ];
 
   preInstall = ''
     substituteInPlace src/cmake_install.cmake \
@@ -24,13 +24,14 @@ stdenv.mkDerivation rec {
   '';
 
   preBuild = let
+    ZHUYIN_DATA_FILE_NAME = "model.text.20161206.tar.gz";
     store_path = fetchurl {
-      url = https://download.fcitx-im.org/data/model.text.20130308.tar.gz;
-      sha256 = "0s8sazix29z1ilxmkw2f0bv6i349awd89ibylf9ixy615s1vb5a5";
+      url = "https://download.fcitx-im.org/data/${ZHUYIN_DATA_FILE_NAME}";
+      sha256 = "017p11si1b7bkwx36xaybq5a9icq1pd7x1jbymqw92akfgjj8w2w";
     };
   in
     ''
-      cp -rv ${store_path} $NIX_BUILD_TOP/$name/data/model.text.20130308.tar.gz
+      cp -rv ${store_path} $NIX_BUILD_TOP/$name/data/${ZHUYIN_DATA_FILE_NAME}
     '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/inputmethods/fcitx/fcitx-qt5.nix b/pkgs/tools/inputmethods/fcitx/fcitx-qt5.nix
index b0da0034ef96..7617d544d296 100644
--- a/pkgs/tools/inputmethods/fcitx/fcitx-qt5.nix
+++ b/pkgs/tools/inputmethods/fcitx/fcitx-qt5.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "fcitx-qt5-${version}";
-  version = "1.1.0";
+  version = "1.2.1";
 
   src = fetchurl {
     url = "http://download.fcitx-im.org/fcitx-qt5/${name}.tar.xz";
-    sha256 = "0r8c5k0qin3mz2p1mdciip6my0x58662sx5z50zs4c5pkdg21qwv";
+    sha256 = "0z8ax0dxk88byic41mfaiahjdv1k8ciwn97xfjkkgr4ijgscdr8c";
   };
 
   nativeBuildInputs = [ cmake extra-cmake-modules pkgconfig ];
@@ -16,10 +16,12 @@ stdenv.mkDerivation rec {
   preInstall = ''
     substituteInPlace platforminputcontext/cmake_install.cmake \
       --replace ${qtbase.out} $out
+    substituteInPlace quickphrase-editor/cmake_install.cmake \
+      --replace ${fcitx} $out
   '';
 
   meta = with stdenv.lib; {
-    homepage    = "https://github.com/fcitx/fcitx-qt5";
+    homepage    = http://github.com/fcitx/fcitx-qt5;
     description = "Qt5 IM Module for Fcitx";
     license     = licenses.gpl2;
     platforms   = platforms.linux;
diff --git a/pkgs/tools/inputmethods/fcitx/unwrapped.nix b/pkgs/tools/inputmethods/fcitx/unwrapped.nix
index c489b3e4ed74..27eb35ce6ae5 100644
--- a/pkgs/tools/inputmethods/fcitx/unwrapped.nix
+++ b/pkgs/tools/inputmethods/fcitx/unwrapped.nix
@@ -2,27 +2,75 @@
 , libxml2, enchant, isocodes, icu, libpthreadstubs
 , pango, cairo, libxkbfile, libXau, libXdmcp, libxkbcommon
 , dbus, gtk2, gtk3, qt4, extra-cmake-modules
+, xkeyboard_config, pcre, libuuid, curl, cacert
+, withPinyin ? true
+, fetchFromGitHub
 }:
 
+let
+  # releases at http://download.fcitx-im.org/fcitx/${name}_dict.tar.xz
+  # contains all data but if we want to compile from source, we need to
+  # fetch them ourselves
+  # to update the urls and where to unpack these, look into the
+  # src/module/*/data/CMakeLists.txt files
+  # fcitx_download tgt_name url output)
+  dicts = let SPELL_EN_DICT_VER="20121020"; in fetchurl {
+      url = "http://download.fcitx-im.org/data/en_dict-${SPELL_EN_DICT_VER}.tar.gz";
+      sha256 = "1svcb97sq7nrywp5f2ws57cqvlic8j6p811d9ngflplj8xw5sjn4";
+  };
+  table = fetchurl {
+      url = http://download.fcitx-im.org/data/table.tar.gz;
+      sha256 = "1dw7mgbaidv3vqy0sh8dbfv8631d2zwv5mlb7npf69a1f8y0b5k1";
+  };
+  pystroke-data = let PY_STROKE_VER="20121124"; in fetchurl {
+      url = "http://download.fcitx-im.org/data/py_stroke-${PY_STROKE_VER}.tar.gz";
+      sha256 = "0j72ckmza5d671n2zg0psg7z9iils4gyxz7jgkk54fd4pyljiccf";
+  };
+  pytable-data = let PY_TABLE_VER="20121124"; in fetchurl {
+      url = "http://download.fcitx-im.org/data/py_table-${PY_TABLE_VER}.tar.gz";
+      sha256 = "011cg7wssssm6hm564cwkrrnck2zj5rxi7p9z5akvhg6gp4nl522";
+  };
+  pinyin-data = fetchurl {
+      url = http://download.fcitx-im.org/data/pinyin.tar.gz;
+      sha256 = "1qfq5dy4czvd1lvdnxzyaiir9x8b1m46jjny11y0i33m9ar2jf2q";
+  };
+in
 stdenv.mkDerivation rec {
   name = "fcitx-${version}";
-  version = "4.2.9.1";
+  version = "4.2.9.5";
 
-  src = fetchurl {
-    url    = "http://download.fcitx-im.org/fcitx/${name}_dict.tar.xz";
-    sha256 = "0xvcmm4yi7kagf55d0yl3ql5ssbkm9410fwbz3kd988pchichdsk";
+  src = fetchFromGitHub {
+    owner = "fcitx";
+    repo = "fcitx";
+    rev = version;
+    sha256 = "0rv69bacdvblka85dakz4ldpznrgwj59nqcccp5mkkn1rab4zh1r";
   };
 
+  # put data at the correct locations else cmake tries to fetch them,
+  # which fails in sandboxed mode
+  prePatch = ''
+    cp ${dicts} src/module/spell/dict/$(stripHash ${dicts})
+    cp ${table} src/im/table/data/$(stripHash ${table})
+  ''
+  + stdenv.lib.optionalString withPinyin ''
+    cp ${pystroke-data} src/module/pinyin-enhance/data/$(stripHash ${pystroke-data})
+    cp ${pytable-data} src/module/pinyin-enhance/data/$(stripHash ${pytable-data})
+    cp ${pinyin-data} src/im/pinyin/data/$(stripHash ${pinyin-data})
+  ''
+  ;
+
   postPatch = ''
     substituteInPlace src/frontend/qt/CMakeLists.txt \
       --replace $\{QT_PLUGINS_DIR} $out/lib/qt4/plugins
+
+    patchShebangs cmake/
   '';
 
-  nativeBuildInputs = [ cmake extra-cmake-modules intltool pkgconfig ];
+  nativeBuildInputs = [ cmake extra-cmake-modules intltool pkgconfig pcre ];
 
   buildInputs = [
-    enchant gettext isocodes icu libpthreadstubs libXau libXdmcp libxkbfile
-    libxkbcommon libxml2 dbus cairo gtk2 gtk3 pango qt4
+    xkeyboard_config enchant gettext isocodes icu libpthreadstubs libXau libXdmcp libxkbfile
+    libxkbcommon libxml2 dbus cairo gtk2 gtk3 pango qt4 libuuid
   ];
 
   cmakeFlags = ''
@@ -33,10 +81,15 @@ stdenv.mkDerivation rec {
     -DENABLE_OPENCC=OFF
     -DENABLE_PRESAGE=OFF
     -DENABLE_XDGAUTOSTART=OFF
-  '';
+    -DENABLE_PINYIN=${if withPinyin then "ON" else "OFF"}
+    -DENABLE_TABLE=ON
+    -DENABLE_SPELL=ON
+    -DENABLE_QT_GUI=ON
+    -DXKB_RULES_XML_FILE='${xkeyboard_config}/share/X11/xkb/rules/evdev.xml'
+    '';
 
   meta = with stdenv.lib; {
-    homepage    = "https://github.com/fcitx/fcitx";
+    homepage    = http://github.com/fcitx/fcitx;
     description = "A Flexible Input Method Framework";
     license     = licenses.gpl2;
     platforms   = platforms.linux;
diff --git a/pkgs/tools/inputmethods/ibus-engines/ibus-libpinyin/default.nix b/pkgs/tools/inputmethods/ibus-engines/ibus-libpinyin/default.nix
index 6293fa30d7a7..85399bffd3fe 100644
--- a/pkgs/tools/inputmethods/ibus-engines/ibus-libpinyin/default.nix
+++ b/pkgs/tools/inputmethods/ibus-engines/ibus-libpinyin/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   name = "ibus-libpinyin-${version}";
-  version = "1.8.0";
+  version = "1.9.2";
 
   src = fetchFromGitHub {
     owner  = "libpinyin";
     repo   = "ibus-libpinyin";
     rev    = version;
-    sha256 = "1d85kzlhav0ay798i88yqyrjbkv3y7w2aiadpmcjgscyd5ccsnnz";
+    sha256 = "067w926gcf0kwwn71yshhjmyzkad0qsdm1dsi2xwz1j633qd4xlb";
   };
 
   buildInputs = [ ibus glib sqlite libpinyin python3 gtk3 db ];
diff --git a/pkgs/tools/misc/debianutils/default.nix b/pkgs/tools/misc/debianutils/default.nix
index 6575c19391c0..d93cc479a803 100644
--- a/pkgs/tools/misc/debianutils/default.nix
+++ b/pkgs/tools/misc/debianutils/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  version = "4.8.2";
+  version = "4.8.4";
   name = "debianutils-${version}";
 
   src = fetchurl {
     url = "mirror://debian/pool/main/d/debianutils/debianutils_${version}.tar.xz";
-    sha256 = "0s3w3svcsh984zinkxvpzxi7dc0ginqk0nk299fkrr6k7wlmzssd";
+    sha256 = "1chypq3dbkgvl16lgzdvqvlr7cdm3814nqmp8ch8j7x6mscsnqf0";
   };
 
   meta = {
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
     longDescription = ''
        This package provides a number of small utilities which are used primarily by the installation scripts of Debian packages, although you may use them directly.
 
-       The specific utilities included are: add-shell installkernel ischroot remove-shell run-parts savelog tempfile which 
+       The specific utilities included are: add-shell installkernel ischroot remove-shell run-parts savelog tempfile which
     '';
     downloadPage = https://packages.debian.org/sid/debianutils;
     license = with stdenv.lib.licenses; [ gpl2Plus publicDomain smail ];
diff --git a/pkgs/tools/misc/diffoscope/default.nix b/pkgs/tools/misc/diffoscope/default.nix
index 5b42c811bd20..418d5e38fd75 100644
--- a/pkgs/tools/misc/diffoscope/default.nix
+++ b/pkgs/tools/misc/diffoscope/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchgit, python3Packages, docutils
+{ lib, stdenv, fetchgit, python3Packages, docutils, help2man
 , acl, apktool, libbfd, bzip2, cbfstool, cdrkit, colord, colordiff, coreutils, cpio, diffutils, dtc
 , e2fsprogs, file, findutils, fontforge-fonttools, fpc, gettext, ghc, ghostscriptX, giflib, gnupg1, gnutar
 , gzip, imagemagick, jdk, libarchive, libcaca, llvm, mono, openssh, pdftk, pgpdump, poppler_utils, sng, sqlite
@@ -8,12 +8,12 @@
 
 python3Packages.buildPythonApplication rec {
   name = "diffoscope-${version}";
-  version = "87";
+  version = "90";
 
   src = fetchgit {
     url    = "git://anonscm.debian.org/reproducible/diffoscope.git";
     rev    = "refs/tags/${version}";
-    sha256 = "0j3pljwmggrpaghbamvr24x4cg5yj7hl2ll27405p7970scnpngv";
+    sha256 = "1w16667j6ag2iim1xcy8y9v9965mq50k64wnf693mivddll62704";
   };
 
   patches = [
@@ -25,6 +25,8 @@ python3Packages.buildPythonApplication rec {
     sed -i setup.py -e "/'rpm-python',/d"
   '';
 
+  nativeBuildInputs = [ docutils help2man ];
+
   # Still missing these tools: docx2txt enjarify js-beautify oggDump Rscript
   # Also these libraries: python3-guestfs
   pythonPath = with python3Packages; [ debian libarchive-c python_magic tlsh rpm ] ++ [
@@ -37,10 +39,12 @@ python3Packages.buildPythonApplication rec {
     ];
 
   doCheck = false; # Calls 'mknod' in squashfs tests, which needs root
+  checkInputs = with python3Packages; [ pytest ];
 
   postInstall = ''
+    make -C doc
     mkdir -p $out/share/man/man1
-    ${docutils}/bin/rst2man.py debian/diffoscope.1.rst $out/share/man/man1/diffoscope.1
+    cp doc/diffoscope.1 $out/share/man/man1/diffoscope.1
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/misc/flameshot/default.nix b/pkgs/tools/misc/flameshot/default.nix
new file mode 100644
index 000000000000..55aa146d301d
--- /dev/null
+++ b/pkgs/tools/misc/flameshot/default.nix
@@ -0,0 +1,39 @@
+{ stdenv, fetchFromGitHub, qtbase, qmake, qttools }:
+
+stdenv.mkDerivation rec {
+  name = "flameshot-${version}";
+  version = "0.5.0";
+
+  nativeBuildInputs = [ qmake qttools ];
+  buildInputs = [ qtbase ];
+
+  qmakeFlags = [
+    # flameshot.pro assumes qmake is being run in a git checkout and uses it
+    # to determine the version being built. Let's replace that.
+    "VERSION=${version}"
+    "PREFIX=/"
+  ];
+  patchPhase = ''
+    sed -i 's/VERSION =/#VERSION =/g' flameshot.pro
+    sed -i 's,USRPATH = /usr/local,USRPATH = /,g' flameshot.pro
+  '';
+
+  installFlags = [ "INSTALL_ROOT=$(out)" ];
+
+  src = fetchFromGitHub {
+    owner = "lupoDharkael";
+    repo = "flameshot";
+    rev = "v${version}";
+    sha256 = "1fy4il7rdj294l9cs642hx23bry25j9phn37274r2b87hwzy1rrv";
+  };
+
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
+    description = "Powerful yet simple to use screenshot software";
+    homepage = https://github.com/lupoDharkael/flameshot;
+    maintainers = [ maintainers.scode ];
+    license = stdenv.lib.licenses.gpl3;
+    platforms = stdenv.lib.platforms.all;
+  };
+}
diff --git a/pkgs/tools/misc/flashrom/default.nix b/pkgs/tools/misc/flashrom/default.nix
index 2047b77144a8..b1e093126584 100644
--- a/pkgs/tools/misc/flashrom/default.nix
+++ b/pkgs/tools/misc/flashrom/default.nix
@@ -1,6 +1,6 @@
-{ stdenv, fetchurl, pkgconfig, libftdi, pciutils }:
+{ lib, stdenv, fetchurl, pkgconfig, libftdi, pciutils }:
 
-let version = "0.9.9"; in
+let version = "1.0"; in
 stdenv.mkDerivation rec {
   name = "flashrom-${version}";
 
@@ -14,11 +14,11 @@ stdenv.mkDerivation rec {
 
   preConfigure = "export PREFIX=$out";
 
-  meta = {
+  meta = with lib; {
     homepage = http://www.flashrom.org;
     description = "Utility for reading, writing, erasing and verifying flash ROM chips";
-    license = stdenv.lib.licenses.gpl2;
-    maintainers = [ stdenv.lib.maintainers.funfunctor ];
-    platforms = with stdenv.lib.platforms; linux;
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ funfunctor fpletz ];
+    platforms = with platforms; linux;
   };
 }
diff --git a/pkgs/tools/misc/graylog/default.nix b/pkgs/tools/misc/graylog/default.nix
index 5c868ae5e2f6..d4acc063b4de 100644
--- a/pkgs/tools/misc/graylog/default.nix
+++ b/pkgs/tools/misc/graylog/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  version = "2.4.0";
+  version = "2.4.1";
   name = "graylog-${version}";
 
   src = fetchurl {
     url = "https://packages.graylog2.org/releases/graylog/graylog-${version}.tgz";
-    sha256 = "12ipp1bji0ss0d20dpqx8d6x3p3h38qdfdy98qy37mjy0fi22vpq";
+    sha256 = "1dps1vvv8b154ayamhjxdgiq101qs4w0nk79j3zb41pdyn2fji4j";
   };
 
   dontBuild = true;
diff --git a/pkgs/tools/misc/testdisk/default.nix b/pkgs/tools/misc/testdisk/default.nix
index b428205fcd05..80cbf3661da8 100644
--- a/pkgs/tools/misc/testdisk/default.nix
+++ b/pkgs/tools/misc/testdisk/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, ncurses, libjpeg, e2fsprogs, zlib, openssl, libuuid, ntfs3g }:
 
 stdenv.mkDerivation {
-  name = "testdisk-7.0";
+  name = "testdisk-7.1";
 
   src = fetchurl {
     url = http://www.cgsecurity.org/testdisk-7.0.tar.bz2;
-    sha256 = "00bb3b6b22e6aba88580eeb887037aef026968c21a87b5f906c6652cbee3442d";
+    sha256 = "0ba4wfz2qrf60vwvb1qsq9l6j0pgg81qgf7fh22siaz649mkpfq0";
   };
 
   buildInputs = [ ncurses libjpeg zlib openssl libuuid ]
diff --git a/pkgs/tools/misc/tmuxinator/default.nix b/pkgs/tools/misc/tmuxinator/default.nix
index 35bdcf1b8231..938092c23872 100644
--- a/pkgs/tools/misc/tmuxinator/default.nix
+++ b/pkgs/tools/misc/tmuxinator/default.nix
@@ -8,8 +8,8 @@ buildRubyGem rec {
   inherit ruby;
   name = "${gemName}-${version}";
   gemName = "tmuxinator";
-  version = "0.10.0";
-  source.sha256 = "199pq15qknpcafw8ryb9kk1jsrwnncg6k5l9d4n0nmms4knxlqlf";
+  version = "0.10.1";
+  source.sha256 = "0rjy2glqwbz07ci0snycq19myfczd2pry2iw4g0nqsw37wclm1vi";
 
   erubis = buildRubyGem rec {
     inherit ruby;
@@ -23,8 +23,8 @@ buildRubyGem rec {
     inherit ruby;
     name = "ruby${ruby.version}-${gemName}-${version}";
     gemName = "thor";
-    version = "0.19.1";
-    source.sha256 = "08p5gx18yrbnwc6xc0mxvsfaxzgy2y9i78xq7ds0qmdm67q39y4z";
+    version = "0.20.0";
+    source.sha256 = "0nmqpyj642sk4g16nkbq6pj856adpv91lp4krwhqkh2iw63aszdl";
   };
 
   xdg = buildRubyGem rec {
diff --git a/pkgs/tools/misc/units/default.nix b/pkgs/tools/misc/units/default.nix
index 90758e909e5b..f66f6c3642e7 100644
--- a/pkgs/tools/misc/units/default.nix
+++ b/pkgs/tools/misc/units/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "units-${version}";
-  version = "2.14";
+  version = "2.16";
 
   src = fetchurl {
     url = "mirror://gnu/units/${name}.tar.gz";
-    sha256 = "9d33893d82f3ddd831d5822992007c40bcd0826ae67d3cbc96539951fb0a82e8";
+    sha256 = "11hnp3gcmcc5kci2caxw4hs6m08h2mhqs3xzqq7iafx1ha2ggwyw";
   };
 
   buildInputs = [ readline ];
diff --git a/pkgs/tools/misc/youtube-dl/default.nix b/pkgs/tools/misc/youtube-dl/default.nix
index 0080c073fd16..c4595a1a94e1 100644
--- a/pkgs/tools/misc/youtube-dl/default.nix
+++ b/pkgs/tools/misc/youtube-dl/default.nix
@@ -16,11 +16,11 @@ with stdenv.lib;
 buildPythonApplication rec {
 
   name = "youtube-dl-${version}";
-  version = "2018.01.21";
+  version = "2018.01.27";
 
   src = fetchurl {
     url = "https://yt-dl.org/downloads/${version}/${name}.tar.gz";
-    sha256 = "14ggjxnhc2sxc93h7d5k3z4n35n5q3ffsif97np0ar93x5z3zgn5";
+    sha256 = "14vbm8pr6xdrdbk8j9k4v82rnalbdpk2lcm7n9wj6z6d441ymji9";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/misc/yubikey-personalization/default.nix b/pkgs/tools/misc/yubikey-personalization/default.nix
index 36dd8339f26e..c3bb28bc1a5c 100644
--- a/pkgs/tools/misc/yubikey-personalization/default.nix
+++ b/pkgs/tools/misc/yubikey-personalization/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "yubikey-personalization-${version}";
-  version = "1.18.0";
+  version = "1.18.1";
 
   src = fetchurl {
     url = "https://developers.yubico.com/yubikey-personalization/Releases/ykpers-${version}.tar.gz";
-    sha256 = "1bc2z6y2x7bbqn7ink2dg3wrgqzlcq2zxxg0cdcxy6jm7c9kwcyg";
+    sha256 = "0mjjkk6p8d0kblj6vzld4v188y40ynprvd2hnfh7m1hs28wbkzcz";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/tools/networking/inadyn/default.nix b/pkgs/tools/networking/inadyn/default.nix
index 219a993b8a29..99997eb927f2 100644
--- a/pkgs/tools/networking/inadyn/default.nix
+++ b/pkgs/tools/networking/inadyn/default.nix
@@ -3,7 +3,7 @@
 
 stdenv.mkDerivation rec {
   name = "inadyn-${version}";
-  version = "2.2.1";
+  version = "2.3";
 
   src = fetchFromGitHub {
     owner = "troglobit";
diff --git a/pkgs/tools/networking/iperf/2.nix b/pkgs/tools/networking/iperf/2.nix
index 6f2ca96d120f..94be3c25d1fc 100644
--- a/pkgs/tools/networking/iperf/2.nix
+++ b/pkgs/tools/networking/iperf/2.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "iperf-2.0.9";
+  name = "iperf-2.0.10";
 
   src = fetchurl {
     url = "mirror://sourceforge/iperf2/files/${name}.tar.gz";
-    sha256 = "1gzh8dk2myqgxznxrryib4zsw23ffvx0s5j7sa780vk86lgr20nv";
+    sha256 = "1whyi7lxrkllmbs7i1avc6jq8fvirn64mhx9197bf4x3rj6k9r3z";
   };
 
   hardeningDisable = [ "format" ];
diff --git a/pkgs/tools/networking/kea/default.nix b/pkgs/tools/networking/kea/default.nix
index f33fe7a7105c..67428664556a 100644
--- a/pkgs/tools/networking/kea/default.nix
+++ b/pkgs/tools/networking/kea/default.nix
@@ -4,11 +4,11 @@
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
   pname = "kea";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchurl {
     url = "https://ftp.isc.org/isc/${pname}/${version}/${name}.tar.gz";
-    sha256 = "0afiab6c8cw0w3m0l4hrc4g8bs9y3z59fdr16xnba01nn52mkl92";
+    sha256 = "14f32lsdd1824cx9a4l4pfbhq1d4jik6l6hxd911ihi64nzwvpvf";
   };
 
   patches = [ ./dont-create-var.patch ];
diff --git a/pkgs/tools/networking/lldpd/default.nix b/pkgs/tools/networking/lldpd/default.nix
index 1ce9f7cb3230..20e65c5ea3ca 100644
--- a/pkgs/tools/networking/lldpd/default.nix
+++ b/pkgs/tools/networking/lldpd/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   name = "lldpd-${version}";
-  version = "0.9.8";
+  version = "0.9.9";
 
   src = fetchurl {
     url = "https://media.luffy.cx/files/lldpd/${name}.tar.gz";
-    sha256 = "0kwck17cr2f1a395a8bfmj7fz1n4i1hv429cbdbkhff33glr9r4y";
+    sha256 = "1nq2z03hbs5qc3kdk3rdxcwcsrxilhcqx7xw3iipc4yj03shi7jy";
   };
 
   configureFlags = [
diff --git a/pkgs/tools/networking/network-manager-applet/default.nix b/pkgs/tools/networking/network-manager-applet/default.nix
index d0881c5ac5e5..f2c0bb13afe8 100644
--- a/pkgs/tools/networking/network-manager-applet/default.nix
+++ b/pkgs/tools/networking/network-manager-applet/default.nix
@@ -8,11 +8,11 @@ stdenv.mkDerivation rec {
   name    = "${pname}-${major}.${minor}";
   pname   = "network-manager-applet";
   major   = "1.8";
-  minor   = "2";
+  minor   = "6";
 
   src = fetchurl {
     url    = "mirror://gnome/sources/${pname}/${major}/${name}.tar.xz";
-    sha256 = "09f9hjpn9nkhw57mk6pi7q1bq3lhf5hvmwas0fknscssak7yjmry";
+    sha256 = "0c4wxwxpa7wlskvnqaqfa7mmc0c6a2pj7jcvymcchjnq4wn9wx01";
   };
 
   configureFlags = [
diff --git a/pkgs/tools/networking/network-manager/default.nix b/pkgs/tools/networking/network-manager/default.nix
index 6005314ea97b..b6201e308d9a 100644
--- a/pkgs/tools/networking/network-manager/default.nix
+++ b/pkgs/tools/networking/network-manager/default.nix
@@ -9,11 +9,11 @@ stdenv.mkDerivation rec {
   name    = "network-manager-${version}";
   pname   = "NetworkManager";
   major   = "1.10";
-  version = "${major}.0";
+  version = "${major}.2";
 
   src = fetchurl {
     url    = "mirror://gnome/sources/${pname}/${major}/${pname}-${version}.tar.xz";
-    sha256 = "1ph45rqpl8p9k4rirhss0hpf104clm8fp322p6kh6q75y06ddfwa";
+    sha256 = "0nv2jm2lsidlrzn4dkbc5rpj8ma4cpzjqz8z8dmwkqvh0zsk970n";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/tools/networking/network-manager/iodine.nix b/pkgs/tools/networking/network-manager/iodine.nix
index 154b54952f2d..0cfc8bbba7db 100644
--- a/pkgs/tools/networking/network-manager/iodine.nix
+++ b/pkgs/tools/networking/network-manager/iodine.nix
@@ -18,6 +18,9 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ intltool pkgconfig ];
 
+  # Fixes deprecation errors with networkmanager 1.10.2
+  NIX_CFLAGS_COMPILE = "-Wno-deprecated-declarations";
+
   configureFlags = [
     "${if withGnome then "--with-gnome" else "--without-gnome"}"
     "--disable-static"
diff --git a/pkgs/tools/networking/network-manager/strongswan.nix b/pkgs/tools/networking/network-manager/strongswan.nix
index f26571874644..365aec88a7d6 100644
--- a/pkgs/tools/networking/network-manager/strongswan.nix
+++ b/pkgs/tools/networking/network-manager/strongswan.nix
@@ -21,6 +21,9 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ intltool pkgconfig ];
 
+  # Fixes deprecation errors with networkmanager 1.10.2
+  NIX_CFLAGS_COMPILE = "-Wno-deprecated-declarations";
+
   preConfigure = ''
      substituteInPlace "configure" \
        --replace "/sbin/sysctl" "${procps}/bin/sysctl"
diff --git a/pkgs/tools/networking/ngrep/default.nix b/pkgs/tools/networking/ngrep/default.nix
index dcc0e8596e9f..ca5e0b7c4f5d 100644
--- a/pkgs/tools/networking/ngrep/default.nix
+++ b/pkgs/tools/networking/ngrep/default.nix
@@ -1,39 +1,35 @@
-{ stdenv, fetchurl, fetchpatch, libpcap, gnumake3, pcre }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, autoreconfHook, libpcap, gnumake3, pcre }:
 
 stdenv.mkDerivation rec {
-  name = "ngrep-1.45";
+  name = "ngrep-${version}";
+  version = "1.47";
 
-  src = fetchurl {
-    url = "mirror://sourceforge/ngrep/${name}.tar.bz2";
-    sha256 = "19rg8339z5wscw877mz0422wbsadds3mnfsvqx3ihy58glrxv9mf";
+  src = fetchFromGitHub {
+    owner = "jpr5";
+    repo = "ngrep";
+    rev = "V${lib.replaceStrings ["."] ["_"] version}";
+    sha256 = "1x2fyd7wdqlj1r76ilal06cl2wmbz0ws6i3ys204sbjh1cj6dcl7";
   };
 
   patches = [
     (fetchpatch {
-      url = "https://anonscm.debian.org/cgit/users/rfrancoise/ngrep.git/plain/debian/patches/10_debian-build.diff?h=debian/1.45.ds2-14";
-      sha256 = "1p359k54xjbh6r0d0lv1l679n250wxk6j8yyz23gn54kwdc29zfy";
-    })
-    (fetchpatch {
-      url = "https://anonscm.debian.org/cgit/users/rfrancoise/ngrep.git/plain/debian/patches/10_man-fixes.diff?h=debian/1.45.ds2-14";
-      sha256 = "1b66zfbsrsvg60j988i6ga9iif1c34fsbq3dp1gi993xy4va8m5k";
-    })
-    (fetchpatch {
-      url = "https://anonscm.debian.org/cgit/users/rfrancoise/ngrep.git/plain/debian/patches/20_setlocale.diff?h=debian/1.45.ds2-14";
-      sha256 = "16xbmnmvw5sjidz2qhay68k3xad05g74nrccflavxbi0jba52fdq";
-    })
-    (fetchpatch {
-      url = "https://anonscm.debian.org/cgit/users/rfrancoise/ngrep.git/plain/debian/patches/40_ipv6-offsets.diff?h=debian/1.45.ds2-14";
-      sha256 = "0fjlk1sav5nnjapvsa8mvdwjkhgm3kgc6dw7r9h1qx6d3b8cgl76";
+      url = "https://patch-diff.githubusercontent.com/raw/jpr5/ngrep/pull/11.patch";
+      sha256 = "0k5qzvj8j3r1409qwwvzp7m3clgs2g7hs4q68bhrqbrsvvb2h5dh";
     })
   ];
 
-  buildInputs = [ gnumake3 libpcap pcre ];
+  nativeBuildInputs = [ autoreconfHook gnumake3 ];
+  buildInputs = [ libpcap pcre ];
+
+  configureFlags = [
+    "--enable-ipv6"
+    "--enable-pcre"
+    "--disable-pcap-restart"
+    "--with-pcap-includes=${libpcap}/include"
+  ];
 
   preConfigure = ''
-    # Fix broken test for BPF header file
     sed -i "s|BPF=.*|BPF=${libpcap}/include/pcap/bpf.h|" configure
-
-    configureFlags="$configureFlags --enable-ipv6 --enable-pcre --disable-pcap-restart --with-pcap-includes=${libpcap}/include"
   '';
 
   meta = with stdenv.lib; {
@@ -47,7 +43,7 @@ stdenv.mkDerivation rec {
       null interfaces, and understands BPF filter logic in the same fashion as
       more common packet sniffing tools, such as tcpdump and snoop.
     '';
-    homepage = http://ngrep.sourceforge.net/;
+    homepage = https://github.com/jpr5/ngrep/;
     # <ngrep>/doc/README.txt says that ngrep itself is licensed under a
     # 'BSD-like' license but that the 'regex' library (in the ngrep tarball) is
     # GPLv2.
diff --git a/pkgs/tools/networking/offlineimap/default.nix b/pkgs/tools/networking/offlineimap/default.nix
index 4295151516d8..86a029bcb3de 100644
--- a/pkgs/tools/networking/offlineimap/default.nix
+++ b/pkgs/tools/networking/offlineimap/default.nix
@@ -2,7 +2,7 @@
   asciidoc, libxml2, libxslt, docbook_xml_xslt }:
 
 pythonPackages.buildPythonApplication rec {
-  version = "7.1.4";
+  version = "7.1.5";
   name = "offlineimap-${version}";
   namePrefix = "";
 
@@ -10,7 +10,7 @@ pythonPackages.buildPythonApplication rec {
     owner = "OfflineIMAP";
     repo = "offlineimap";
     rev = "v${version}";
-    sha256 = "04y2bsgmxykkhcjh3540y2a43xrwfkzd7wks1wvl6av0vjaqa5gm";
+    sha256 = "0qm5vhzm8hkab2zs2l8ffg754wkws2nyd4pwb332v3zckf11flzd";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/networking/pykms/default.nix b/pkgs/tools/networking/pykms/default.nix
index 97780d546e43..a0bac7854c1d 100644
--- a/pkgs/tools/networking/pykms/default.nix
+++ b/pkgs/tools/networking/pykms/default.nix
@@ -1,6 +1,8 @@
-{ stdenv, fetchFromGitHub, python2Packages, writeText, writeScript
+{ stdenv, fetchFromGitHub, python3Packages, writeText, writeScript
 , coreutils, sqlite }:
 
+with python3Packages;
+
 let
   dbSql = writeText "create_pykms_db.sql" ''
     CREATE TABLE clients(
@@ -27,21 +29,21 @@ let
     fi
   '');
 
-in python2Packages.buildPythonApplication rec {
+in buildPythonApplication rec {
   name = "pykms-${version}";
-  version = "20170719";
+  version = "20171224";
 
   src = fetchFromGitHub {
     owner  = "ThunderEX";
     repo   = "py-kms";
-    rev    = "27355d88affd740330174a7c2bae9f50b9efce56";
-    sha256 = "0cpywj73jmyijjc5hs3b00argjsdwpqzmhawbxkx3mc2l4sgzc88";
+    rev    = "885f67904f002042d7758e38f9c5426461c5cdc7";
+    sha256 = "155khy1285f8xkzi6bsqm9vzz043jsjmp039va1qsh675gz3q9ha";
   };
 
-  propagatedBuildInputs = with python2Packages; [ argparse pytz ];
+  propagatedBuildInputs = [ argparse pytz ];
 
   prePatch = ''
-    siteDir=$out/${python2Packages.python.sitePackages}
+    siteDir=$out/${python.sitePackages}
 
     substituteInPlace kmsBase.py \
       --replace "'KmsDataBase.xml'" "'$siteDir/KmsDataBase.xml'"
@@ -60,7 +62,7 @@ in python2Packages.buildPythonApplication rec {
     mv * $siteDir
     for b in client server ; do
       chmod 0755 $siteDir/$b.py
-      makeWrapper ${python2Packages.python.interpreter} $out/bin/$b.py \
+      makeWrapper ${python.interpreter} $out/bin/$b.py \
         --add-flags $siteDir/$b.py
     done
 
@@ -68,7 +70,7 @@ in python2Packages.buildPythonApplication rec {
 
     mv $siteDir/README.md $out/share/doc/pykms/
 
-    ${python2Packages.python.interpreter} -m compileall $siteDir
+    ${python.interpreter} -m compileall $siteDir
 
     runHook postInstall
   '';
diff --git a/pkgs/tools/networking/whois/default.nix b/pkgs/tools/networking/whois/default.nix
index 30ecf617873a..6f37e88f4f6d 100644
--- a/pkgs/tools/networking/whois/default.nix
+++ b/pkgs/tools/networking/whois/default.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchFromGitHub, perl, gettext, pkgconfig, libidn2, libiconv }:
 
 stdenv.mkDerivation rec {
-  version = "5.2.20";
+  version = "5.3.0";
   name = "whois-${version}";
 
   src = fetchFromGitHub {
     owner = "rfc1036";
     repo = "whois";
     rev = "v${version}";
-    sha256 = "1aamasivfnghr9my1j6c1rf0dfal45axjcjf3mpv0g942bkxqp5b";
+    sha256 = "01pfl1ap62hc27574sx1a4yaaf7hr2zkksspn5z97sgacl6h1rnf";
   };
 
   nativeBuildInputs = [ perl gettext pkgconfig ];
diff --git a/pkgs/tools/security/clamav/default.nix b/pkgs/tools/security/clamav/default.nix
index 506d6fc3fce8..976c58eb1e32 100644
--- a/pkgs/tools/security/clamav/default.nix
+++ b/pkgs/tools/security/clamav/default.nix
@@ -1,44 +1,35 @@
-{ stdenv, fetchurl, fetchpatch, zlib, bzip2, libiconv, libxml2, openssl, ncurses, curl
-, libmilter, pcre }:
+{ stdenv, fetchurl, fetchpatch, pkgconfig
+, zlib, bzip2, libiconv, libxml2, openssl, ncurses, curl, libmilter, pcre
+}:
 
 stdenv.mkDerivation rec {
   name = "clamav-${version}";
-  version = "0.99.2";
+  version = "0.99.3";
 
   src = fetchurl {
     url = "https://www.clamav.net/downloads/production/${name}.tar.gz";
-    sha256 = "0yh2q318bnmf2152g2h1yvzgqbswn0wvbzb8p4kf7v057shxcyqn";
+    sha256 = "114f7qk3h0klgm0zzn2394n5spcn91vjc9mq6m03l2p0ls955yh0";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "CVE-2017-6420.patch";
-      url = "https://github.com/vrtadmin/clamav-devel/commit/dfc00cd3301a42b571454b51a6102eecf58407bc.patch";
-      sha256 = "08w3p3a4pmi0cmcmyxkagsbn3g0jgx1jqlc34pn141x0qzrlqr60";
-    })
-  ];
-
   # don't install sample config files into the absolute sysconfdir folder
   postPatch = ''
     substituteInPlace Makefile.in --replace ' etc ' ' '
   '';
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
     zlib bzip2 libxml2 openssl ncurses curl libiconv libmilter pcre
   ];
 
+  patches = [ ./fd-leak.patch ];
+
   configureFlags = [
     "--sysconfdir=/etc/clamav"
-    "--with-zlib=${zlib.dev}"
-    "--disable-zlib-vcheck" # it fails to recognize that 1.2.10 >= 1.2.2
     "--disable-llvm" # enabling breaks the build at the moment
-    "--with-libbz2-prefix=${bzip2.dev}"
-    "--with-iconv-dir=${libiconv}"
+    "--with-zlib=${zlib.dev}"
     "--with-xml=${libxml2.dev}"
     "--with-openssl=${openssl.dev}"
-    "--with-libncurses-prefix=${ncurses.dev}"
     "--with-libcurl=${curl.dev}"
-    "--with-pcre=${pcre.dev}"
     "--enable-milter"
   ];
 
@@ -51,7 +42,7 @@ stdenv.mkDerivation rec {
     homepage = http://www.clamav.net;
     description = "Antivirus engine designed for detecting Trojans, viruses, malware and other malicious threats";
     license = licenses.gpl2;
-    maintainers = with maintainers; [ phreedom robberer qknight ];
+    maintainers = with maintainers; [ phreedom robberer qknight fpletz ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/tools/security/clamav/fd-leak.patch b/pkgs/tools/security/clamav/fd-leak.patch
new file mode 100644
index 000000000000..2c147901e446
--- /dev/null
+++ b/pkgs/tools/security/clamav/fd-leak.patch
@@ -0,0 +1,49 @@
+--- a/libclamav/scanners.c	2018-01-26 16:59:00.820231425 +0100
++++ b/libclamav/scanners.c	2018-01-26 17:39:07.523633805 +0100
+@@ -1366,12 +1366,14 @@
+ 
+ 	if ((ret = cli_ac_initdata(&tmdata, troot?troot->ac_partsigs:0, troot?troot->ac_lsigs:0, troot?troot->ac_reloff_num:0, CLI_DEFAULT_AC_TRACKLEN))) {
+ 		free(tmpname);
++		free(normalized);
+ 		return ret;
+ 	}
+ 
+ 	if ((ret = cli_ac_initdata(&gmdata, groot->ac_partsigs, groot->ac_lsigs, groot->ac_reloff_num, CLI_DEFAULT_AC_TRACKLEN))) {
+ 		cli_ac_freedata(&tmdata);
+ 		free(tmpname);
++		free(normalized);
+ 		return ret;
+ 	}
+ 
+@@ -1390,6 +1392,7 @@
+ 				cli_errmsg("cli_scanscript: can't write to file %s\n",tmpname);
+ 				close(ofd);
+ 				free(tmpname);
++				free(normalized);
+ 				return CL_EWRITE;
+ 			}
+ 			text_normalize_reset(&state);
+@@ -1424,6 +1427,8 @@
+ 			if (ret) {
+ 				cli_ac_freedata(&tmdata);
+ 				free(tmpname);
++				free(normalized);
++				close(ofd);
+ 				return ret;
+ 			}
+ 		}
+@@ -1466,11 +1471,9 @@
+ 
+ 	}
+ 
+-	if(ctx->engine->keeptmp) {
+-		free(tmpname);
+-		if (ofd >= 0)
+-			close(ofd);
+-	}
++	if (ofd >= 0)
++		close(ofd);
++	free(tmpname);
+ 	free(normalized);
+ 
+ 	if(ret != CL_VIRUS || SCAN_ALL)  {
diff --git a/pkgs/tools/security/fail2ban/default.nix b/pkgs/tools/security/fail2ban/default.nix
index ca9cdcc8d6c0..a8de8742dd5c 100644
--- a/pkgs/tools/security/fail2ban/default.nix
+++ b/pkgs/tools/security/fail2ban/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub, python, pythonPackages, gamin }:
 
-let version = "0.10.1"; in
+let version = "0.10.2"; in
 
 pythonPackages.buildPythonApplication {
   name = "fail2ban-${version}";
@@ -9,7 +9,7 @@ pythonPackages.buildPythonApplication {
     owner  = "fail2ban";
     repo   = "fail2ban";
     rev    = version;
-    sha256 = "05ngnjxrwvfdd233s5n2wd8w4ndkpgrgymlfzn6i2fjlwf4hdikj";
+    sha256 = "1asn9gp0ybz6fak991vki9vln4ijramvr13rbwpxyj5wfmnh05r5";
   };
 
   propagatedBuildInputs = [ gamin ]
diff --git a/pkgs/tools/security/gnupg/1.nix b/pkgs/tools/security/gnupg/1.nix
index 6acaacd1467e..fa4555dcafb9 100644
--- a/pkgs/tools/security/gnupg/1.nix
+++ b/pkgs/tools/security/gnupg/1.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, readline, bzip2 }:
 
 stdenv.mkDerivation rec {
-  name = "gnupg-1.4.21";
+  name = "gnupg-1.4.22";
 
   src = fetchurl {
     url = "mirror://gnupg/gnupg/${name}.tar.bz2";
-    sha256 = "0xi2mshq8f6zbarb5f61c9w2qzwrdbjm4q8fqsrwlzc51h8a6ivb";
+    sha256 = "1d1hz4szh1kvwhsw7w2zxa6q5ndrk3qy6hj289l1b8k3xi5s554m";
   };
 
   buildInputs = [ readline bzip2 ];
diff --git a/pkgs/tools/security/spectre-meltdown-checker/default.nix b/pkgs/tools/security/spectre-meltdown-checker/default.nix
index 9fa6307ebdec..39770433ff36 100644
--- a/pkgs/tools/security/spectre-meltdown-checker/default.nix
+++ b/pkgs/tools/security/spectre-meltdown-checker/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "spectre-meltdown-checker-${version}";
-  version = "0.32";
+  version = "0.33";
 
   src = fetchFromGitHub {
     owner = "speed47";
     repo = "spectre-meltdown-checker";
     rev = "v${version}";
-    sha256 = "1qd3cwmg3p309czmghczlacygiyngp2wcwdghacg0y4l9vrndg8c";
+    sha256 = "0a0vbzjfmvcvak804y2s0301f9bcnr0nwg2piafx6i6ibisp917y";
   };
 
   prePatch = ''
diff --git a/pkgs/tools/security/sudo/default.nix b/pkgs/tools/security/sudo/default.nix
index 1238a9207603..5192f57582c7 100644
--- a/pkgs/tools/security/sudo/default.nix
+++ b/pkgs/tools/security/sudo/default.nix
@@ -5,14 +5,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "sudo-1.8.21p2";
+  name = "sudo-1.8.22";
 
   src = fetchurl {
     urls =
       [ "ftp://ftp.sudo.ws/pub/sudo/${name}.tar.gz"
         "ftp://ftp.sudo.ws/pub/sudo/OLD/${name}.tar.gz"
       ];
-    sha256 = "0s33szq6q59v5s377l4v6ybsdy7pfq6sz7y364j4x09ssdn79ibl";
+    sha256 = "00pxp74xkwdcmrjwy55j0k8p684jk1zx3nzdc11v30q8q8kwnmkj";
   };
 
   prePatch = ''
diff --git a/pkgs/tools/security/yara/default.nix b/pkgs/tools/security/yara/default.nix
index ee1b9d844706..166f20dd7d6d 100644
--- a/pkgs/tools/security/yara/default.nix
+++ b/pkgs/tools/security/yara/default.nix
@@ -5,14 +5,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "3.7.0";
+  version = "3.7.1";
   name = "yara-${version}";
 
   src = fetchFromGitHub {
     owner = "VirusTotal";
     repo = "yara";
     rev = "v${version}";
-    sha256 = "1giq5677j0vh5vw0nsv5qcqddcif6jckqaxyqg13j0j54n1p6xyj";
+    sha256 = "05smkn4ii8irx6ccnzrhwa39pkmrjyxjmfrwh6mhdd8iz51v5cgz";
   };
 
   # FIXME: this is probably not the right way to make it work
diff --git a/pkgs/tools/system/augeas/default.nix b/pkgs/tools/system/augeas/default.nix
index fb1806b850e1..dca6d37d9af3 100644
--- a/pkgs/tools/system/augeas/default.nix
+++ b/pkgs/tools/system/augeas/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "augeas-${version}";
-  version = "1.8.1";
+  version = "1.10.0";
 
   src = fetchurl {
     url = "http://download.augeas.net/${name}.tar.gz";
-    sha256 = "1yf93fqwav1zsl8dpyfkf0g11w05mmfckqy6qsjy5zkklnspbkv5";
+    sha256 = "04q2hr3xj71rdbjdj3jiygi8dbiq1x4szlyavxj1xjiw9jcgd41a";
   };
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ readline libxml2 ];
diff --git a/pkgs/tools/system/sleuthkit/default.nix b/pkgs/tools/system/sleuthkit/default.nix
index b63d60633c3d..c4347da44607 100644
--- a/pkgs/tools/system/sleuthkit/default.nix
+++ b/pkgs/tools/system/sleuthkit/default.nix
@@ -1,16 +1,23 @@
-{ stdenv, fetchurl, libewf, afflib, openssl, zlib }:
+{ stdenv, fetchFromGitHub, autoreconfHook, libewf, afflib, openssl, zlib }:
 
 stdenv.mkDerivation rec {
-  version = "4.2.0";
+  version = "4.5.0";
   name = "sleuthkit-${version}";
 
-  src = fetchurl {
-    url = "mirror://sourceforge/sleuthkit/${name}.tar.gz";
-    sha256 = "08s7c1jwn2rjq2jm8859ywaiq12adrl02m61hc04iblqjzqqgcli";
+  src = fetchFromGitHub {
+    owner = "sleuthkit";
+    repo = "sleuthkit";
+    rev = name;
+    sha256 = "0h9l9yl5ibbgriq12gizg8k0r6jw6bnii3iljjp4p963wc0ms9b9";
   };
 
+  postPatch = ''
+    substituteInPlace tsk/img/ewf.c --replace libewf_handle_read_random libewf_handle_read_buffer_at_offset
+  '';
+
   enableParallelBuilding = true;
 
+  nativeBuildInputs = [ autoreconfHook ];
   buildInputs = [ libewf afflib openssl zlib ];
 
   # Hack to fix the RPATH.
@@ -18,6 +25,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "A forensic/data recovery tool";
+    homepage = https://www.sleuthkit.org/;
     maintainers = [ stdenv.lib.maintainers.raskin ];
     platforms = stdenv.lib.platforms.linux;
     license = stdenv.lib.licenses.ipl10;
diff --git a/pkgs/tools/system/sleuthkit/default.upstream b/pkgs/tools/system/sleuthkit/default.upstream
deleted file mode 100644
index f8ffe9352ede..000000000000
--- a/pkgs/tools/system/sleuthkit/default.upstream
+++ /dev/null
@@ -1,5 +0,0 @@
-url http://sourceforge.net/projects/sleuthkit/files/sleuthkit/
-SF_version_dir
-SF_version_tarball
-SF_redirect
-minimize_overwrite
diff --git a/pkgs/tools/text/hyx/default.nix b/pkgs/tools/text/hyx/default.nix
new file mode 100644
index 000000000000..1ba3534e3f8a
--- /dev/null
+++ b/pkgs/tools/text/hyx/default.nix
@@ -0,0 +1,22 @@
+{ lib, stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  name = "hyx-0.1.4";
+
+  src = fetchurl {
+    url = "https://yx7.cc/code/hyx/${name}.tar.xz";
+    sha256 = "049r610hyrrfa62vpiqyb3rh99bpy8cnqy4nd4sih01733cmdhyx";
+  };
+
+  installPhase = ''
+    install -vD hyx $out/bin/hyx
+  '';
+
+  meta = with lib; {
+    description = "minimalistic but powerful Linux console hex editor";
+    homepage = https://yx7.cc/code/;
+    license = licenses.mit;
+    maintainers = with maintainers; [ fpletz ];
+    platforms = platforms.all;
+  };
+}