Merge branch 'master' into staging

24 files changed, 236 insertions, 112 deletions

diff --git a/pkgs/tools/admin/salt/default.nix b/pkgs/tools/admin/salt/default.nix
index 8ea3e648c311..0e927dfe1c7a 100644
--- a/pkgs/tools/admin/salt/default.nix
+++ b/pkgs/tools/admin/salt/default.nix
@@ -8,13 +8,13 @@
 
 pythonPackages.buildPythonApplication rec {
   name = "salt-${version}";
-  version = "2015.8.8";
+  version = "2016.3.3";
 
   disabled = pythonPackages.isPy3k;
 
   src = fetchurl {
     url = "mirror://pypi/s/salt/${name}.tar.gz";
-    sha256 = "1xcfcs50pyammb60myph4f8bi2r6iwkxwsnnhrjwvkv2ymxwxv5j";
+    sha256 = "1djjglnh6203y8dirziz5w6zh2lgszxp8ivi86nb7fgijj2h61jr";
   };
 
   propagatedBuildInputs = with pythonPackages; [
@@ -26,7 +26,6 @@ pythonPackages.buildPythonApplication rec {
     pyyaml
     pyzmq
     requests
-    salttesting
     tornado
   ] ++ extraInputs;
 
diff --git a/pkgs/tools/admin/salt/testing.nix b/pkgs/tools/admin/salt/testing.nix
index 14105dc2f98c..ab5897fab6ca 100644
--- a/pkgs/tools/admin/salt/testing.nix
+++ b/pkgs/tools/admin/salt/testing.nix
@@ -2,17 +2,13 @@
 
 pythonPackages.buildPythonApplication rec {
   name = "SaltTesting-${version}";
-  version = "2015.7.10";
+  version = "2016.9.7";
 
   disabled = pythonPackages.isPy3k;
 
-  propagatedBuildInputs = with pythonPackages; [
-    six
-  ];
-
   src = fetchurl {
     url = "mirror://pypi/S/SaltTesting/${name}.tar.gz";
-    sha256 = "0p0y8kb77pis18rcig1kf9dnns4bnfa3mr91q40lq4mw63l1b34h";
+    sha256 = "0vcw1b1176qm9nkic3sbxh6vnv9kpd9kgyqz5fpsp5jnb2hsf1qx";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/audio/pnmixer/default.nix b/pkgs/tools/audio/pnmixer/default.nix
index b9c602dd7670..34946355d108 100644
--- a/pkgs/tools/audio/pnmixer/default.nix
+++ b/pkgs/tools/audio/pnmixer/default.nix
@@ -1,36 +1,29 @@
-{ stdenv, fetchFromGitHub, alsaLib, pkgconfig, gtk3, glibc, autoconf, automake, libnotify, libX11, intltool }:
+{ stdenv, fetchFromGitHub, pkgconfig, intltool, autoconf, automake, alsaLib, gtk3, glibc, libnotify, libX11 }:
 
 stdenv.mkDerivation rec {
   name = "pnmixer-${version}";
-  version = "2016-04-23";
+  version = "0.7";
 
   src = fetchFromGitHub {
     owner = "nicklan";
     repo = "pnmixer";
-    rev = "cb20096716dbb5440b6560d81108d9c8f7188c48";
-    sha256 = "17gl5fb3hpdgxyys8h5k3nraw7qdyqv9k9kz8ykr5h7gg29nxy66";
+    rev = "v${version}";
+    sha256 = "077l28qhr82ifqfwc2nqi5q1hmi6dyqqbhmjcsn27p4y433f3rpb";
   };
 
-  nativeBuildInputs = [
-    pkgconfig autoconf automake intltool
-  ];
+  nativeBuildInputs = [ pkgconfig autoconf automake intltool ];
 
-  buildInputs = [
-    alsaLib gtk3 glibc libnotify libX11
-  ];
+  buildInputs = [ alsaLib gtk3 glibc libnotify libX11 ];
 
   preConfigure = ''
     ./autogen.sh
   '';
 
-  # work around a problem related to gtk3 updates
-  NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
-
   meta = with stdenv.lib; {
     homepage = https://github.com/nicklan/pnmixer;
     description = "ALSA mixer for the system tray";
     license = licenses.gpl3;
-    maintainers = with maintainers; [ campadrenalin ];
     platforms = platforms.linux;
+    maintainers = with maintainers; [ campadrenalin romildo ];
   };
 }
diff --git a/pkgs/tools/graphics/gmic/default.nix b/pkgs/tools/graphics/gmic/default.nix
index 408539561c7e..606e049703df 100644
--- a/pkgs/tools/graphics/gmic/default.nix
+++ b/pkgs/tools/graphics/gmic/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "gmic-${version}";
-  version = "1.7.4";
+  version = "1.7.7";
 
   src = fetchurl {
     url = "http://gmic.eu/files/source/gmic_${version}.tar.gz";
-    sha256 = "1k4swqi1adq479b6zdpvy5kdpkvjkfihkj9iwgw9mgi0xdqikjry";
+    sha256 = "0shcxgq8nc391c0y0zh3l87g3p7fvsmgshi1x1jvvwwq1b9nf6vp";
   };
 
   buildInputs = [ fftw zlib libjpeg libtiff libpng ];
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   preBuild = ''
     buildFlagsArray=( \
       CURL_CFLAGS= CURL_LIBS= \
-      EXR_CFLAGS= EXR_LIBS= \
+      OPENEXR_CFLAGS= OPENEXR_LIBS= \
       OPENCV_CFLAGS= OPENCV_LIBS= \
       X11_CFLAGS="-Dcimg_display=0" X11_LIBS= \
       cli \
@@ -36,6 +36,6 @@ stdenv.mkDerivation rec {
     homepage = http://gmic.eu/;
     license = licenses.cecill20;
     maintainers = [ maintainers.rycee ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/tools/inputmethods/ibus-engines/ibus-uniemoji/default.nix b/pkgs/tools/inputmethods/ibus-engines/ibus-uniemoji/default.nix
new file mode 100644
index 000000000000..3ca6f3ffcfe6
--- /dev/null
+++ b/pkgs/tools/inputmethods/ibus-engines/ibus-uniemoji/default.nix
@@ -0,0 +1,34 @@
+{ stdenv, fetchFromGitHub
+, python3Packages
+}:
+
+stdenv.mkDerivation rec {
+  name = "ibus-uniemoji-${version}";
+  version = "2016-09-20";
+
+  src = fetchFromGitHub {
+    owner = "salty-horse";
+    repo = "ibus-uniemoji";
+    rev = "c8931a4807a721168e45463ecba00805adb3fe8d";
+    sha256 = "0fydxkdjsbfbrbb8238rfnshmhp11c38hsa7y2gp1ii6mkjngb1j";
+  };
+
+  propagatedBuildInputs = with python3Packages; [ pyxdg python-Levenshtein ];
+
+  makeFlags = [ "PREFIX=$(out)" "SYSCONFDIR=$(out)/etc"
+                "PYTHON=${python3Packages.python.interpreter}" ];
+
+  postPatch = ''
+    sed -i "s,/etc/xdg/,$out/etc/xdg/," uniemoji.py
+    sed -i "s,/usr/share/,$out/share/,g" uniemoji.xml.in
+  '';
+
+  meta = with stdenv.lib; {
+    isIbusEngine = true;
+    description  = "Input method (ibus) for entering unicode symbols and emoji by name";
+    homepage     = "https://github.com/salty-horse/ibus-uniemoji";
+    license      = with licenses; [ gpl3 mit ];
+    platforms    = platforms.linux;
+    maintainers  = with maintainers; [ aske ];
+  };
+}
diff --git a/pkgs/tools/misc/docbook2mdoc/default.nix b/pkgs/tools/misc/docbook2mdoc/default.nix
new file mode 100644
index 000000000000..fbe1cc22376e
--- /dev/null
+++ b/pkgs/tools/misc/docbook2mdoc/default.nix
@@ -0,0 +1,23 @@
+{ stdenv, fetchurl, expat }:
+
+stdenv.mkDerivation rec {
+  name = "docbook2mdoc-${version}";
+  version = "0.0.9";
+
+  src = fetchurl {
+    url = "http://mdocml.bsd.lv/docbook2mdoc/snapshots/${name}.tgz";
+    sha256 = "07il80sg89xf6ym4bry6hxdacfzqgbwkxzyf7bjaihmw5jj0lclk";
+  };
+
+  buildInputs = [ expat.dev ];
+
+  makeFlags = [ "PREFIX=$(out)" ];
+
+  meta = with stdenv.lib; {
+    homepage = "http://mdocml.bsd.lv/";
+    description = "converter from DocBook V4.x and v5.x XML into mdoc";
+    license = licenses.isc;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ ramkromberg ];
+  };
+}
diff --git a/pkgs/tools/misc/fzf/default.nix b/pkgs/tools/misc/fzf/default.nix
index 60a7007db195..3cb5c5680386 100644
--- a/pkgs/tools/misc/fzf/default.nix
+++ b/pkgs/tools/misc/fzf/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   name = "fzf-${version}";
-  version = "0.13.5";
+  version = "0.15.1";
   rev = "${version}";
 
   goPackagePath = "github.com/junegunn/fzf";
@@ -11,7 +11,7 @@ buildGoPackage rec {
     inherit rev;
     owner = "junegunn";
     repo = "fzf";
-    sha256 = "1zfl53nv0b2wsmgbsf850yafqkx9pplpx339iiw4037msdjqhi19";
+    sha256 = "0wj5nhrrgx4nkiqwjp5wpfzdyikrjv4qr5x39s5094yc4p2k30b1";
   };
 
   buildInputs = [ ncurses ];
@@ -23,12 +23,19 @@ buildGoPackage rec {
     sed -i -e "s|expand('<sfile>:h:h').'/bin/fzf-tmux'|'$bin/bin/fzf-tmux'|" plugin/fzf.vim
   '';
 
-  postInstall= ''
+  postInstall = ''
     cp $src/bin/fzf-tmux $bin/bin
     mkdir -p $out/share/vim-plugins
     ln -s $out/share/go/src/github.com/junegunn/fzf $out/share/vim-plugins/${name}
   '';
 
+  preFixup = stdenv.lib.optionalString stdenv.isDarwin ''
+    # fixes cycle between $out and $bin
+    # otool -l shows that the binary includes an LC_RPATH to $out/lib
+    # it seems safe to remove that since but the directory does not exist.
+    install_name_tool -delete_rpath $out/lib $bin/bin/fzf
+  '';
+
   meta = with stdenv.lib; {
     homepage = https://github.com/junegunn/fzf;
     description = "A command-line fuzzy finder written in Go";
diff --git a/pkgs/tools/misc/pod2mdoc/default.nix b/pkgs/tools/misc/pod2mdoc/default.nix
new file mode 100644
index 000000000000..0c96908401b5
--- /dev/null
+++ b/pkgs/tools/misc/pod2mdoc/default.nix
@@ -0,0 +1,26 @@
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  name = "pod2mdoc-${version}";
+  version = "0.0.10";
+
+  src = fetchurl {
+    url = "http://mdocml.bsd.lv/pod2mdoc/snapshots/${name}.tgz";
+    sha256 = "0nwa9zv9gmfi5ysz1wfm60kahc7nv0133n3dfc2vh2y3gj8mxr4f";
+  };
+
+  installPhase = ''
+    mkdir -p $out/bin
+    mkdir -p $out/share/man/man1
+    install -m 0755 pod2mdoc $out/bin
+    install -m 0444 pod2mdoc.1 $out/share/man/man1
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = "http://mdocml.bsd.lv/";
+    description = "converter from POD into mdoc";
+    license = licenses.isc;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ ramkromberg ];
+  };
+}
diff --git a/pkgs/tools/misc/texi2mdoc/default.nix b/pkgs/tools/misc/texi2mdoc/default.nix
new file mode 100644
index 000000000000..2404ab9da899
--- /dev/null
+++ b/pkgs/tools/misc/texi2mdoc/default.nix
@@ -0,0 +1,21 @@
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  name = "texi2mdoc-${version}";
+  version = "0.1.2";
+
+  src = fetchurl {
+    url = "http://mdocml.bsd.lv/texi2mdoc/snapshots/${name}.tgz";
+    sha256 = "1zjb61ymwfkw6z5g0aqmsn6qpw895zdxv7fv3059gj3wqa3zsibs";
+  };
+
+  makeFlags = [ "PREFIX=$(out)" ];
+
+  meta = with stdenv.lib; {
+    homepage = "http://mdocml.bsd.lv/";
+    description = "converter from Texinfo into mdoc";
+    license = licenses.isc;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ ramkromberg ];
+  };
+}
diff --git a/pkgs/tools/misc/xflux/gui.nix b/pkgs/tools/misc/xflux/gui.nix
index 8300c8ef30af..2b18d4e910d5 100644
--- a/pkgs/tools/misc/xflux/gui.nix
+++ b/pkgs/tools/misc/xflux/gui.nix
@@ -1,22 +1,17 @@
-{ stdenv, fetchFromGitHub, buildPythonPackage,
-  pexpect,
-  pyGtkGlade,
-  pygobject,
-  pyxdg,
-  gnome_python,
-  libappindicator-gtk2,
-  xflux,
-  python
+{ stdenv, fetchFromGitHub, buildPythonPackage
+, pexpect, pyGtkGlade, pygobject, pyxdg
+, gnome_python, python
+, libappindicator-gtk2, xflux, librsvg, wrapGAppsHook
 }:
 buildPythonPackage rec {
   name = "xflux-gui-${version}";
-  version = "2016-08-08";
+  version = "2016-09-21";
 
   src = fetchFromGitHub {
     repo = "xflux-gui";
     owner = "xflux-gui";
-    rev = "4125e70b6ad0aeda7de46b3a7083a26c392555dc";
-    sha256 = "1l56f59hnjyi7nn8wn3dfdx6lw2qjbrhdlcfz0qvwj6b0953f2s7";
+    rev = "0b56204477494b473a390e8b0db043437ec14f32";
+    sha256 = "15pr8f31jnhqjlpvasnj6cmm6hw5gljphh2pxzav3zd9bp4yl56r";
   };
 
   # not sure if these need to be propagated or not?
@@ -29,15 +24,17 @@ buildPythonPackage rec {
     gnome_python
   ];
 
-  buildInputs = [
-    xflux
-  ];
+  buildInputs = [ xflux librsvg ];
+
+  nativeBuildInputs = [ wrapGAppsHook ];
 
   postPatch = ''
      substituteInPlace src/fluxgui/xfluxcontroller.py --replace "pexpect.spawn(\"xflux\"" "pexpect.spawn(\"${xflux}/bin/xflux\""
   '';
 
   postFixup = ''
+    wrapGAppsHook
+    makeWrapperArgs="''${gappsWrapperArgs[@]}"
     wrapPythonPrograms
     patchPythonScript $out/${python.sitePackages}/fluxgui/fluxapp.py
   '';
diff --git a/pkgs/tools/misc/yle-dl/default.nix b/pkgs/tools/misc/yle-dl/default.nix
index c6efac3ffe60..a7f2d445bca5 100644
--- a/pkgs/tools/misc/yle-dl/default.nix
+++ b/pkgs/tools/misc/yle-dl/default.nix
@@ -2,20 +2,17 @@
 
 stdenv.mkDerivation rec {
   name = "yle-dl-${version}";
-  version = "2.9.1";
+  version = "2.11";
 
   src = fetchFromGitHub {
     owner = "aajanki";
     repo = "yle-dl";
     rev = version;
-    sha256 = "1irpcp9iw2cw85sj1kzndmrw8350p9q7cfghjx2xkh2czk9k7whq";
+    sha256 = "1fa2a25j3wwk3m6q1alilklwhqf337ch8rj6bwricc5zqb58qivc";
   };
 
   patchPhase = ''
     substituteInPlace yle-dl --replace '/usr/local/share/' "$out/share/"
-
-    # HACK: work around https://github.com/NixOS/nixpkgs/issues/9593
-    substituteInPlace yle-dl --replace '/usr/bin/env python2' '/usr/bin/env python'
   '';
 
   buildInputs = [ pythonPackages.wrapPython ];
diff --git a/pkgs/tools/networking/aria2/default.nix b/pkgs/tools/networking/aria2/default.nix
index 105ddd1552f2..19e87d3a88b7 100644
--- a/pkgs/tools/networking/aria2/default.nix
+++ b/pkgs/tools/networking/aria2/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   name = "aria2-${version}";
-  version = "1.26.1";
+  version = "1.27.1";
 
   src = fetchFromGitHub {
     owner = "aria2";
     repo = "aria2";
     rev = "release-${version}";
-    sha256 = "1nf7z55cc6ljpz7zzb8ppg8ybg531gfbhyggya7lnr5ka74h87b5";
+    sha256 = "003m80gdcqfxi5jjzwiszql5y8lrj7a59gjygy0ya72fa9j4l9mi";
   };
 
   nativeBuildInputs = [ pkgconfig autoreconfHook ];
diff --git a/pkgs/tools/networking/chrony/default.nix b/pkgs/tools/networking/chrony/default.nix
index f5b5893d5437..d405d08e0abd 100644
--- a/pkgs/tools/networking/chrony/default.nix
+++ b/pkgs/tools/networking/chrony/default.nix
@@ -5,11 +5,11 @@ assert stdenv.isLinux -> libcap != null;
 stdenv.mkDerivation rec {
   name = "chrony-${version}";
 
-  version = "2.3";
+  version = "2.4";
 
   src = fetchurl {
     url = "http://download.tuxfamily.org/chrony/${name}.tar.gz";
-    sha256 = "1cncjapm98hv1nyrqlanjpz8k5ny6rp4vnf0gjl0zyqj619gpgsq";
+    sha256 = "07rrys5axrz4grfy7fj3ds0r9ny1qcwiswsb2318jciklb6yf14d";
   };
 
   buildInputs = [ readline texinfo nss nspr ] ++ stdenv.lib.optional stdenv.isLinux libcap;
diff --git a/pkgs/tools/networking/davix/default.nix b/pkgs/tools/networking/davix/default.nix
index 748e28407b26..37226d3dd7b2 100644
--- a/pkgs/tools/networking/davix/default.nix
+++ b/pkgs/tools/networking/davix/default.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchFromGitHub, cmake, pkgconfig, openssl, libxml2, boost }:
 
 stdenv.mkDerivation rec {
-  name = "davix-0.4.0";
+  name = "davix-0.6.4";
   buildInputs = [ stdenv pkgconfig cmake openssl libxml2 boost ];
 
   src = fetchFromGitHub {
     owner = "cern-it-sdc-id";
     repo = "davix";
-    rev = "R_0_4_0-1";
-    sha256 = "0i6ica7rmpc3hbybjql5mr500cd43w4qzc69cj1djkc6bqqb752v";
+    rev = "R_0_6_4";
+    sha256 = "10hg7rs6aams96d4ghldgkrrnikskdpmn8vy6hj5j0s17a2yms6q";
   };
 
 
diff --git a/pkgs/tools/networking/htpdate/default.nix b/pkgs/tools/networking/htpdate/default.nix
new file mode 100644
index 000000000000..10ed8f34e3a6
--- /dev/null
+++ b/pkgs/tools/networking/htpdate/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, fetchurl, coreutils, binutils }:
+
+stdenv.mkDerivation rec {
+  version = "1.1.3";
+  name = "htpdate-${version}";
+
+  src = fetchurl {
+    url = "http://twekkel.home.xs4all.nl/htp/htpdate-${version}.tar.gz";
+    sha256 = "0hfg4qrsmpqw03m9qwf3zgi4brbf65w6wd3w30nkamc7x8b4vn5i";
+  };
+
+  installFlags = [
+    "INSTALL=${coreutils}/bin/install"
+    "STRIP=${binutils}/bin/strip"
+    "prefix=$(out)"
+  ];
+
+  meta = {
+    description = "Utility to fetch time and set the system clock over HTTP";
+    homepage = http://www.vervest.org/htp/;
+    platforms = stdenv.lib.platforms.linux;
+    license = stdenv.lib.licenses.gpl2Plus;
+  };
+}
diff --git a/pkgs/tools/networking/openvpn/default.nix b/pkgs/tools/networking/openvpn/default.nix
index 3f4f1244e1b7..73d10014bbfc 100644
--- a/pkgs/tools/networking/openvpn/default.nix
+++ b/pkgs/tools/networking/openvpn/default.nix
@@ -7,11 +7,11 @@ assert pkcs11Support -> (pkcs11helper != null);
 with stdenv.lib;
 
 stdenv.mkDerivation rec {
-  name = "openvpn-2.3.11";
+  name = "openvpn-2.3.12";
 
   src = fetchurl {
     url = "http://swupdate.openvpn.net/community/releases/${name}.tar.gz";
-    sha256 = "0qv1flcz4q4mb7zpkxsnlmpvrv3s9gw7xvprjk7n2pnk9x1s85wi";
+    sha256 = "1zqwq19xg6yf90nv35yr8r0ljas5f42v4n9hjjmhlnzpan69plzm";
   };
 
   patches = optional stdenv.isLinux ./systemd-notify.patch;
diff --git a/pkgs/tools/security/pass/rofi-pass.nix b/pkgs/tools/security/pass/rofi-pass.nix
index b834cc6adc53..64c12dc6e5e3 100644
--- a/pkgs/tools/security/pass/rofi-pass.nix
+++ b/pkgs/tools/security/pass/rofi-pass.nix
@@ -1,15 +1,16 @@
-{ stdenv, fetchgit
-, pass, rofi, coreutils, utillinux, xdotool, gnugrep, pwgen, findutils, gawk
-, makeWrapper }:
+{ stdenv, fetchFromGitHub, pass, rofi, coreutils, utillinux, xdotool, gnugrep
+, libnotify, pwgen, findutils, gawk, gnused, xclip, makeWrapper
+}:
 
 stdenv.mkDerivation rec {
   name = "rofi-pass-${version}";
-  version = "1.3.2";
+  version = "1.4.3";
 
-  src = fetchgit {
-    url = "https://github.com/carnager/rofi-pass";
-    rev = "refs/tags/${version}";
-    sha256 = "1xqp8s0yyjs2ca9mf8lbz8viwl9xzxf5kk1v68v9hqdgxj26wgls";
+  src = fetchFromGitHub {
+    owner = "carnager";
+    repo = "rofi-pass";
+    rev = version;
+    sha256 = "09wpkxg5b7xicdisgbhlfr8vs1iv7z9sc58pjl0p198yap57khq5";
   };
 
   buildInputs = [ makeWrapper ];
@@ -18,22 +19,25 @@ stdenv.mkDerivation rec {
 
   installPhase = ''
     mkdir -p $out/bin
-    cp -a $src/rofi-pass $out/bin/rofi-pass
+    cp -a rofi-pass $out/bin/rofi-pass
 
     mkdir -p $out/share/doc/rofi-pass/
-    cp -a $src/config.example $out/share/doc/rofi-pass/config.example
+    cp -a config.example $out/share/doc/rofi-pass/config.example
   '';
 
   wrapperPath = with stdenv.lib; makeBinPath [
     coreutils
     findutils
+    gawk
     gnugrep
+    gnused
+    libnotify
     pass
     pwgen
     rofi
     utillinux
+    xclip
     xdotool
-    gawk
   ];
 
   fixupPhase = ''
diff --git a/pkgs/tools/security/sudo/default.nix b/pkgs/tools/security/sudo/default.nix
index e2c69377df5a..b31d60247d8d 100644
--- a/pkgs/tools/security/sudo/default.nix
+++ b/pkgs/tools/security/sudo/default.nix
@@ -4,14 +4,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "sudo-1.8.17p1";
+  name = "sudo-1.8.18";
 
   src = fetchurl {
     urls =
       [ "ftp://ftp.sudo.ws/pub/sudo/${name}.tar.gz"
         "ftp://ftp.sudo.ws/pub/sudo/OLD/${name}.tar.gz"
       ];
-    sha256 = "c690d707fb561b3ecdf6a6de5563bc0b769388eff201c851edbace408bb155cc";
+    sha256 = "04xywg2f9x2kfw81abdf8gsraldaz5v0w0x2zi8aqlgsjygfj6c5";
   };
 
   configureFlags = [
diff --git a/pkgs/tools/security/tor/default.nix b/pkgs/tools/security/tor/default.nix
index 533cb0dcd8eb..0e69729a2262 100644
--- a/pkgs/tools/security/tor/default.nix
+++ b/pkgs/tools/security/tor/default.nix
@@ -3,11 +3,11 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "tor-0.2.8.7";
+  name = "tor-0.2.8.8";
 
   src = fetchurl {
     url = "https://archive.torproject.org/tor-package-archive/${name}.tar.gz";
-    sha256 = "1iigfi8ljl88s8b5y1g4ak8im57simazscl467zvfbg8k6vf4i5f";
+    sha256 = "1pp3h0a1cl25fv04b3j6wp8aw1sfpbd2lmag397dpp2k2b305bxi";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/tools/security/vault/default.nix b/pkgs/tools/security/vault/default.nix
index 4ede689bf972..9118bd3c18fb 100644
--- a/pkgs/tools/security/vault/default.nix
+++ b/pkgs/tools/security/vault/default.nix
@@ -2,15 +2,26 @@
 
 buildGoPackage rec {
   name = "vault-${version}";
-  version = "0.6.0";
-  rev = "v${version}";
+  version = "0.6.1";
 
   goPackagePath = "github.com/hashicorp/vault";
 
   src = fetchFromGitHub {
-    inherit rev;
     owner = "hashicorp";
     repo = "vault";
-    sha256 = "0byb91nqrhl7w0rq0ilml1ybamh8w1qga47a790kggsmjhcj9ybx";
+    rev = "v${version}";
+    sha256 = "06xf2dpn0q398qb6wbh9j1wjl5smqq9nrrn2039g48haqm8853jx";
+  };
+
+  buildFlagsArray = ''
+    -ldflags=
+      -X github.com/hashicorp/vault/version.GitCommit=${version}
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = https://www.vaultproject.io;
+    description = "A tool for managing secrets";
+    license = licenses.mpl20;
+    maintainers = [ maintainers.rushmorem ];
   };
 }
diff --git a/pkgs/tools/system/collectd/default.nix b/pkgs/tools/system/collectd/default.nix
index b0c6b0730296..2aa5f9fb4c4e 100644
--- a/pkgs/tools/system/collectd/default.nix
+++ b/pkgs/tools/system/collectd/default.nix
@@ -30,21 +30,23 @@
 , varnish ? null
 , yajl ? null
 , net_snmp ? null
+, hiredis ? null
+, libmnl ? null
 }:
 stdenv.mkDerivation rec {
-  version = "5.5.2";
+  version = "5.6.0";
   name = "collectd-${version}";
 
   src = fetchurl {
     url = "http://collectd.org/files/${name}.tar.bz2";
-    sha256 = "03w2pawbshl2wrl4cmyw8alsi0pvamb6ibxni96mjzhqc903lzq1";
+    sha256 = "08w6fjzczi2psk7va0xkjh9pigpar6sbjx2a6ayq4dmc3zcvpzzh";
   };
 
   buildInputs = [
     pkgconfig curl iptables libatasmart libcredis libdbi libgcrypt libmemcached
     cyrus_sasl libmodbus libnotify gdk_pixbuf liboping libpcap libsigrok libvirt
     lm_sensors libxml2 lvm2 libmysql postgresql protobufc rabbitmq-c rrdtool
-    varnish yajl jdk libtool python udev net_snmp
+    varnish yajl jdk libtool python udev net_snmp hiredis libmnl
   ];
 
   # for some reason libsigrok isn't auto-detected
@@ -52,14 +54,11 @@ stdenv.mkDerivation rec {
     stdenv.lib.optional (libsigrok != null) "--with-libsigrok" ++
     stdenv.lib.optional (python != null) "--with-python=${python}/bin/python";
 
-  # Fix build on Glibc 2.24.
-  NIX_CFLAGS_COMPILE = "-Wno-error=cpp -Wno-error=deprecated-declarations";
-
   meta = with stdenv.lib; {
     description = "Daemon which collects system performance statistics periodically";
     homepage = http://collectd.org;
     license = licenses.gpl2;
     platforms = platforms.linux;
-    maintainers = [ maintainers.bjornfor ];
+    maintainers = with maintainers; [ bjornfor fpletz ];
   };
 }
diff --git a/pkgs/tools/text/a2ps/default.nix b/pkgs/tools/text/a2ps/default.nix
index c7476d9f3391..e38de5e6bd89 100644
--- a/pkgs/tools/text/a2ps/default.nix
+++ b/pkgs/tools/text/a2ps/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, libpaper, gperf, file }:
+{ stdenv, fetchurl, fetchpatch, libpaper, gperf, file, perl }:
 
 stdenv.mkDerivation rec {
   name = "a2ps-4.14";
@@ -7,14 +7,28 @@ stdenv.mkDerivation rec {
     sha256 = "195k78m1h03m961qn7jr120z815iyb93gwi159p1p9348lyqvbpk";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://sources.debian.net/data/main/a/a2ps/1:4.14-1.3/debian/patches/09_CVE-2001-1593.diff";
+      sha256 = "1hrfmvb21zlklmg2fqikgywhqgc4qnvbhx517w87faafrhzhlnh0";
+    })
+    (fetchpatch {
+      url = "https://sources.debian.net/data/main/a/a2ps/1:4.14-1.3/debian/patches/CVE-2014-0466.diff";
+      sha256 = "0grqqsc3m45niac56m19m5gx7gc0m8zvia5iman1l4rlq31shf8s";
+    })
+    (fetchpatch {
+      url = "https://sources.debian.net/data/main/a/a2ps/1:4.14-1.3/debian/patches/fix-format-security.diff";
+      sha256 = "0pq7zl41gf2kc6ahwyjnzn93vbxb4jc2c5g8j20isp4vw6dqrnwv";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace afm/make_fonts_map.sh --replace "/bin/rm" "rm"
     substituteInPlace tests/defs.in --replace "/bin/rm" "rm"
   '';
 
-  buildInputs = [ libpaper gperf file ];
-
-  hardeningDisable = [ "format" ];
+  nativeBuildInputs = [ file perl ];
+  buildInputs = [ libpaper gperf ];
 
   meta = with stdenv.lib; {
     description = "An Anything to PostScript converter and pretty-printer";
diff --git a/pkgs/tools/virtualization/nixos-container/default.nix b/pkgs/tools/virtualization/nixos-container/default.nix
index 0763536533f0..19394ea45d30 100644
--- a/pkgs/tools/virtualization/nixos-container/default.nix
+++ b/pkgs/tools/virtualization/nixos-container/default.nix
@@ -6,8 +6,6 @@ substituteAll {
     isExecutable = true;
     src = ./nixos-container.pl;
     perl = "${perl}/bin/perl -I${perlPackages.FileSlurp}/lib/perl5/site_perl";
-    su = "${shadow.su}/bin/su";
-    inherit utillinux;
 
     postInstall = ''
       t=$out/etc/bash_completion.d
diff --git a/pkgs/tools/virtualization/nixos-container/nixos-container.pl b/pkgs/tools/virtualization/nixos-container/nixos-container.pl
index 1dfe4567d8df..5cb7e3b560b8 100755
--- a/pkgs/tools/virtualization/nixos-container/nixos-container.pl
+++ b/pkgs/tools/virtualization/nixos-container/nixos-container.pl
@@ -8,9 +8,6 @@ use Fcntl ':flock';
 use Getopt::Long qw(:config gnu_getopt);
 use Cwd 'abs_path';
 
-my $nsenter = "@utillinux@/bin/nsenter";
-my $su = "@su@";
-
 # Ensure a consistent umask.
 umask 0022;
 
@@ -220,22 +217,6 @@ sub stopContainer {
         or die "$0: failed to stop container\n";
 }
 
-# Return the PID of the init process of the container.
-sub getLeader {
-    my $s = `machinectl show "$containerName" -p Leader`;
-    chomp $s;
-    $s =~ /^Leader=(\d+)$/ or die "unable to get container's main PID\n";
-    return int($1);
-}
-
-# Run a command in the container.
-sub runInContainer {
-    my @args = @_;
-    my $leader = getLeader;
-    exec($nsenter, "-t", $leader, "-m", "-u", "-i", "-n", "-p", "--", @args);
-    die "cannot run ‘nsenter’: $!\n";
-}
-
 # Remove a directory while recursively unmounting all mounted filesystems within
 # that directory and unmounting/removing that directory afterwards as well.
 #
@@ -309,14 +290,14 @@ elsif ($action eq "login") {
 }
 
 elsif ($action eq "root-login") {
-    runInContainer("@su@", "root", "-l");
+    exec("machinectl", "shell", $containerName, "/bin/sh", "-l");
 }
 
 elsif ($action eq "run") {
     shift @ARGV; shift @ARGV;
     # Escape command.
     my $s = join(' ', map { s/'/'\\''/g; "'$_'" } @ARGV);
-    runInContainer("@su@", "root", "-l", "-c", "exec " . $s);
+    exec("machinectl", "--quiet", "shell", $containerName, "/bin/sh", "-l", "-c", $s);
 }
 
 elsif ($action eq "show-ip") {