summary refs log tree commit diff
path: root/pkgs/tools
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs/tools')
-rw-r--r--pkgs/tools/X11/xsecurelock/default.nix7
-rw-r--r--pkgs/tools/admin/google-cloud-sdk/default.nix2
-rw-r--r--pkgs/tools/archivers/cpio/default.nix5
-rw-r--r--pkgs/tools/archivers/cromfs/default.nix7
-rw-r--r--pkgs/tools/archivers/p7zip/12-CVE-2016-9296.patch23
-rw-r--r--pkgs/tools/archivers/p7zip/13-CVE-2017-17969.patch35
-rw-r--r--pkgs/tools/archivers/p7zip/default.nix14
-rw-r--r--pkgs/tools/backup/dar/default.nix4
-rw-r--r--pkgs/tools/backup/partimage/default.nix2
-rw-r--r--pkgs/tools/compression/lzip/default.nix11
-rw-r--r--pkgs/tools/filesystems/davfs2/default.nix2
-rw-r--r--pkgs/tools/filesystems/ifuse/default.nix36
-rw-r--r--pkgs/tools/filesystems/nixpart/0.4/lvm2.nix9
-rw-r--r--pkgs/tools/graphics/asymptote/default.nix8
-rw-r--r--pkgs/tools/graphics/blockhash/default.nix4
-rw-r--r--pkgs/tools/graphics/dcraw/default.nix9
-rw-r--r--pkgs/tools/graphics/editres/default.nix2
-rw-r--r--pkgs/tools/graphics/ggobi/default.nix2
-rw-r--r--pkgs/tools/graphics/plotutils/default.nix2
-rw-r--r--pkgs/tools/inputmethods/keyfuzz/default.nix2
-rw-r--r--pkgs/tools/inputmethods/m17n-lib/otf.nix19
-rw-r--r--pkgs/tools/misc/bc/default.nix5
-rw-r--r--pkgs/tools/misc/clipster/default.nix4
-rw-r--r--pkgs/tools/misc/cowsay/default.nix23
-rw-r--r--pkgs/tools/misc/dateutils/default.nix4
-rw-r--r--pkgs/tools/misc/debootstrap/default.nix8
-rw-r--r--pkgs/tools/misc/fortune/default.nix5
-rw-r--r--pkgs/tools/misc/grub/default.nix5
-rw-r--r--pkgs/tools/misc/less/default.nix7
-rw-r--r--pkgs/tools/misc/most/default.nix2
-rw-r--r--pkgs/tools/misc/pdd/default.nix4
-rw-r--r--pkgs/tools/misc/pspg/default.nix4
-rw-r--r--pkgs/tools/misc/urjtag/default.nix12
-rw-r--r--pkgs/tools/misc/usbmuxd/default.nix42
-rw-r--r--pkgs/tools/misc/xburst-tools/default.nix7
-rw-r--r--pkgs/tools/misc/you-get/default.nix4
-rw-r--r--pkgs/tools/networking/altermime/default.nix9
-rw-r--r--pkgs/tools/networking/argus-clients/default.nix2
-rw-r--r--pkgs/tools/networking/cadaver/default.nix2
-rw-r--r--pkgs/tools/networking/curl/7_59.nix1
-rw-r--r--pkgs/tools/networking/curl/default.nix3
-rw-r--r--pkgs/tools/networking/dd-agent/5.nix (renamed from pkgs/tools/networking/dd-agent/default.nix)5
-rw-r--r--pkgs/tools/networking/dd-agent/6.nix77
-rw-r--r--pkgs/tools/networking/dd-agent/deps.nix353
-rw-r--r--pkgs/tools/networking/dd-agent/integrations-core.nix91
-rw-r--r--pkgs/tools/networking/infiniband-diags/default.nix2
-rw-r--r--pkgs/tools/networking/mtr/default.nix2
-rw-r--r--pkgs/tools/networking/p2p/amule/default.nix23
-rw-r--r--pkgs/tools/networking/polygraph/default.nix4
-rw-r--r--pkgs/tools/networking/reaver-wps/default.nix2
-rw-r--r--pkgs/tools/networking/slack-cli/default.nix48
-rw-r--r--pkgs/tools/networking/ssmtp/default.nix5
-rw-r--r--pkgs/tools/networking/trickle/default.nix2
-rw-r--r--pkgs/tools/networking/vtun/default.nix9
-rw-r--r--pkgs/tools/networking/webalizer/default.nix9
-rw-r--r--pkgs/tools/networking/wget/default.nix5
-rw-r--r--pkgs/tools/networking/wireguard-tools/default.nix4
-rw-r--r--pkgs/tools/package-management/nix-review/default.nix16
-rw-r--r--pkgs/tools/package-management/nix/default.nix2
-rw-r--r--pkgs/tools/security/aws-iam-authenticator/default.nix27
-rw-r--r--pkgs/tools/security/cfssl/default.nix13
-rw-r--r--pkgs/tools/security/fwknop/default.nix29
-rw-r--r--pkgs/tools/security/gnupg/22.nix4
-rw-r--r--pkgs/tools/security/modsecurity/default.nix22
-rw-r--r--pkgs/tools/security/spectre-meltdown-checker/default.nix12
-rw-r--r--pkgs/tools/security/ssdeep/default.nix21
-rw-r--r--pkgs/tools/security/super/default.nix5
-rw-r--r--pkgs/tools/security/yara/default.nix10
-rw-r--r--pkgs/tools/system/cron/default.nix7
-rw-r--r--pkgs/tools/system/monit/default.nix26
-rw-r--r--pkgs/tools/system/rofi-systemd/default.nix45
-rw-r--r--pkgs/tools/system/sleuthkit/default.nix4
-rw-r--r--pkgs/tools/text/catdoc/default.nix2
-rw-r--r--pkgs/tools/text/diffstat/default.nix4
-rw-r--r--pkgs/tools/text/diffutils/default.nix5
-rw-r--r--pkgs/tools/text/gnupatch/default.nix11
-rw-r--r--pkgs/tools/text/icdiff/default.nix4
-rw-r--r--pkgs/tools/typesetting/xmlroff/default.nix5
-rw-r--r--pkgs/tools/virtualization/cri-tools/default.nix6
79 files changed, 1036 insertions, 243 deletions
diff --git a/pkgs/tools/X11/xsecurelock/default.nix b/pkgs/tools/X11/xsecurelock/default.nix
index 176b9fa0068a..c252894dbfec 100644
--- a/pkgs/tools/X11/xsecurelock/default.nix
+++ b/pkgs/tools/X11/xsecurelock/default.nix
@@ -3,13 +3,14 @@
 , pamtester, xscreensaver }:
 
 stdenv.mkDerivation rec {
-  name = "xsecurelock-git-2018-07-10";
+  name = "xsecurelock-${version}";
+  version = "1.0";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "xsecurelock";
-    rev = "0fa0d7dd87a4cc4bdb402323f95c3fcacc6f5049";
-    sha256 = "071b3gslszql1mgabs53r82jgbk9mn263m5v6adskfxbkamks8g0";
+    rev = "v${version}";
+    sha256 = "0k135hnfnn1j82wvc03b8jkq06wws1xk325x5m25ps6xwsn725sw";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
diff --git a/pkgs/tools/admin/google-cloud-sdk/default.nix b/pkgs/tools/admin/google-cloud-sdk/default.nix
index c3d6faeac527..c2f73cea9558 100644
--- a/pkgs/tools/admin/google-cloud-sdk/default.nix
+++ b/pkgs/tools/admin/google-cloud-sdk/default.nix
@@ -49,7 +49,7 @@ in stdenv.mkDerivation rec {
     cp ${./beta__init__.py} $out/google-cloud-sdk/lib/surface/beta/__init__.py
 
     # create wrappers with correct env
-    for program in gcloud bq gsutil git-credential-gcloud.sh; do
+    for program in gcloud bq gsutil git-credential-gcloud.sh docker-credential-gcloud; do
         programPath="$out/google-cloud-sdk/bin/$program"
         binaryPath="$out/bin/$program"
         wrapProgram "$programPath" \
diff --git a/pkgs/tools/archivers/cpio/default.nix b/pkgs/tools/archivers/cpio/default.nix
index 2313f27f2e54..c38dc7bbfbe7 100644
--- a/pkgs/tools/archivers/cpio/default.nix
+++ b/pkgs/tools/archivers/cpio/default.nix
@@ -31,10 +31,11 @@ in stdenv.mkDerivation {
 
   enableParallelBuilding = true;
 
-  meta = {
+  meta = with stdenv.lib; {
     homepage = http://www.gnu.org/software/cpio/;
     description = "A program to create or extract from cpio archives";
-    platforms = stdenv.lib.platforms.all;
+    license = licenses.gpl3;
+    platforms = platforms.all;
     priority = 6; # resolves collision with gnutar's "libexec/rmt"
   };
 }
diff --git a/pkgs/tools/archivers/cromfs/default.nix b/pkgs/tools/archivers/cromfs/default.nix
index 68f7f02e7413..57a8a8e97380 100644
--- a/pkgs/tools/archivers/cromfs/default.nix
+++ b/pkgs/tools/archivers/cromfs/default.nix
@@ -21,10 +21,11 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ fuse perl ];
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "FUSE Compressed ROM filesystem with lzma";
     homepage = https://bisqwit.iki.fi/source/cromfs.html;
-    maintainers = [ stdenv.lib.maintainers.viric ];
-    platforms = stdenv.lib.platforms.linux;
+    license = licenses.gpl3;
+    maintainers = [ maintainers.viric ];
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/tools/archivers/p7zip/12-CVE-2016-9296.patch b/pkgs/tools/archivers/p7zip/12-CVE-2016-9296.patch
new file mode 100644
index 000000000000..42245c92c0aa
--- /dev/null
+++ b/pkgs/tools/archivers/p7zip/12-CVE-2016-9296.patch
@@ -0,0 +1,23 @@
+From: Robert Luberda <robert@debian.org>
+Date: Sat, 19 Nov 2016 08:48:08 +0100
+Subject: Fix nullptr dereference (CVE-2016-9296)
+
+Patch taken from https://sourceforge.net/p/p7zip/bugs/185/
+---
+ CPP/7zip/Archive/7z/7zIn.cpp | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/CPP/7zip/Archive/7z/7zIn.cpp b/CPP/7zip/Archive/7z/7zIn.cpp
+index b0c6b98..7c6dde2 100644
+--- a/CPP/7zip/Archive/7z/7zIn.cpp
++++ b/CPP/7zip/Archive/7z/7zIn.cpp
+@@ -1097,7 +1097,8 @@ HRESULT CInArchive::ReadAndDecodePackedStreams(
+       if (CrcCalc(data, unpackSize) != folders.FolderCRCs.Vals[i])
+         ThrowIncorrect();
+   }
+-  HeadersSize += folders.PackPositions[folders.NumPackStreams];
++  if (folders.PackPositions)
++      HeadersSize += folders.PackPositions[folders.NumPackStreams];
+   return S_OK;
+ }
+ 
diff --git a/pkgs/tools/archivers/p7zip/13-CVE-2017-17969.patch b/pkgs/tools/archivers/p7zip/13-CVE-2017-17969.patch
new file mode 100644
index 000000000000..a9787c4a9088
--- /dev/null
+++ b/pkgs/tools/archivers/p7zip/13-CVE-2017-17969.patch
@@ -0,0 +1,35 @@
+From: =?utf-8?q?Antoine_Beaupr=C3=A9?= <anarcat@debian.org>
+Date: Fri, 2 Feb 2018 11:11:41 +0100
+Subject: Heap-based buffer overflow in 7zip/Compress/ShrinkDecoder.cpp
+
+Origin: vendor, https://sourceforge.net/p/p7zip/bugs/_discuss/thread/0920f369/27d7/attachment/CVE-2017-17969.patch
+Forwarded: https://sourceforge.net/p/p7zip/bugs/_discuss/thread/0920f369/#27d7
+Bug: https://sourceforge.net/p/p7zip/bugs/204/
+Bug-Debian: https://bugs.debian.org/888297
+Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2017-17969
+Reviewed-by: Salvatore Bonaccorso <carnil@debian.org>
+Last-Update: 2018-02-01
+Applied-Upstream: 18.00-beta
+---
+ CPP/7zip/Compress/ShrinkDecoder.cpp | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/CPP/7zip/Compress/ShrinkDecoder.cpp b/CPP/7zip/Compress/ShrinkDecoder.cpp
+index 80b7e67..ca37764 100644
+--- a/CPP/7zip/Compress/ShrinkDecoder.cpp
++++ b/CPP/7zip/Compress/ShrinkDecoder.cpp
+@@ -121,8 +121,13 @@ HRESULT CDecoder::CodeReal(ISequentialInStream *inStream, ISequentialOutStream *
+     {
+       _stack[i++] = _suffixes[cur];
+       cur = _parents[cur];
++      if (cur >= kNumItems || i >= kNumItems)
++        break;
+     }
+-    
++
++    if (cur >= kNumItems || i >= kNumItems)
++      break;
++
+     _stack[i++] = (Byte)cur;
+     lastChar2 = (Byte)cur;
+ 
diff --git a/pkgs/tools/archivers/p7zip/default.nix b/pkgs/tools/archivers/p7zip/default.nix
index 4d8b2477ed58..4886217211df 100644
--- a/pkgs/tools/archivers/p7zip/default.nix
+++ b/pkgs/tools/archivers/p7zip/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, fetchpatch }:
+{ stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
   name = "p7zip-${version}";
@@ -10,16 +10,8 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
-    (fetchpatch rec {
-      name = "CVE-2016-9296.patch";
-      url = "https://salsa.debian.org/debian/p7zip/raw/debian/${version}+dfsg-6/debian/patches/12-${name}";
-      sha256 = "09wbkzai46bwm8zmplsz0m4jck3qn7snr68i9p1gsih300zidj0m";
-    })
-    (fetchpatch rec {
-      name = "CVE-2017-17969.patch";
-      url = "https://salsa.debian.org/debian/p7zip/raw/debian/${version}+dfsg-6/debian/patches/13-${name}";
-      sha256 = "00pycdwx6gw7w591bg54ym6zhbxgn47p3zhms6mnmaycfzw09mkn";
-    })
+    ./12-CVE-2016-9296.patch
+    ./13-CVE-2017-17969.patch
   ];
 
   # Default makefile is full of impurities on Darwin. The patch doesn't hurt Linux so I'm leaving it unconditional
diff --git a/pkgs/tools/backup/dar/default.nix b/pkgs/tools/backup/dar/default.nix
index e0b4d1fee124..86f8619f101e 100644
--- a/pkgs/tools/backup/dar/default.nix
+++ b/pkgs/tools/backup/dar/default.nix
@@ -3,12 +3,12 @@
 with stdenv.lib;
 
 stdenv.mkDerivation rec {
-  version = "2.5.15";
+  version = "2.5.16";
   name = "dar-${version}";
 
   src = fetchurl {
     url = "mirror://sourceforge/dar/${name}.tar.gz";
-    sha256 = "1h700i2k524w5rf5gr9yxl50ca5jwzqlkifay4ffcbhbkqln1n2q";
+    sha256 = "0fy39y6kfda0lvbymc0dblvzmli5y9bq81q0r8fwjzd105qwjmz9";
   };
 
   buildInputs = [ zlib bzip2 openssl lzo libgcrypt gpgme xz ]
diff --git a/pkgs/tools/backup/partimage/default.nix b/pkgs/tools/backup/partimage/default.nix
index 8781c2d2cada..a2e962d7f855 100644
--- a/pkgs/tools/backup/partimage/default.nix
+++ b/pkgs/tools/backup/partimage/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation {
     url = mirror://sourceforge/partimage/partimage-0.6.9.tar.bz2;
     sha256 = "0db6xiphk6xnlpbxraiy31c5xzj0ql6k4rfkmqzh665yyj0nqfkm";
   };
-  configureFlags = "--with-ssl-headers=${openssl.dev}/include/openssl";
+  configureFlags = [ "--with-ssl-headers=${openssl.dev}/include/openssl" ];
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [bzip2 zlib newt newt openssl slang
diff --git a/pkgs/tools/compression/lzip/default.nix b/pkgs/tools/compression/lzip/default.nix
index 25d09e6e947b..49677e988138 100644
--- a/pkgs/tools/compression/lzip/default.nix
+++ b/pkgs/tools/compression/lzip/default.nix
@@ -4,14 +4,19 @@ stdenv.mkDerivation rec {
   name = "lzip-${version}";
   version = "1.20";
 
-  buildInputs = [ texinfo ];
+  nativeBuildInputs = [ texinfo ];
 
   src = fetchurl {
     url = "mirror://savannah/lzip/${name}.tar.gz";
     sha256 = "0319q59kb8g324wnj7xzbr7vvlx5bcs13lr34j0zb3kqlyjq2fy9";
   };
 
-  configureFlags = "CPPFLAGS=-DNDEBUG CFLAGS=-O3 CXXFLAGS=-O3" + stdenv.lib.optionalString stdenv.isCross " CXX=${stdenv.cc.targetPrefix}c++";
+  configureFlags = [
+    "CPPFLAGS=-DNDEBUG"
+    "CFLAGS=-O3"
+    "CXXFLAGS=-O3"
+  ] ++ stdenv.lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
+    "CXX=${stdenv.cc.targetPrefix}c++";
 
   setupHook = ./lzip-setup-hook.sh;
 
@@ -22,6 +27,6 @@ stdenv.mkDerivation rec {
     homepage = http://www.nongnu.org/lzip/lzip.html;
     description = "A lossless data compressor based on the LZMA algorithm";
     license = stdenv.lib.licenses.gpl3Plus;
-    platforms = stdenv.lib.platforms.unix;
+    platforms = stdenv.lib.platforms.all;
   };
 }
diff --git a/pkgs/tools/filesystems/davfs2/default.nix b/pkgs/tools/filesystems/davfs2/default.nix
index 64934ccb469b..38933c524cc0 100644
--- a/pkgs/tools/filesystems/davfs2/default.nix
+++ b/pkgs/tools/filesystems/davfs2/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   patches = [ ./isdir.patch ./fix-sysconfdir.patch ];
 
-  configureFlags = "--sysconfdir=/etc";
+  configureFlags = [ "--sysconfdir=/etc" ];
 
   makeFlags = ["sbindir=$(out)/sbin" "ssbindir=$(out)/sbin"];
 
diff --git a/pkgs/tools/filesystems/ifuse/default.nix b/pkgs/tools/filesystems/ifuse/default.nix
index 942b6272071c..f9021c5a3aa7 100644
--- a/pkgs/tools/filesystems/ifuse/default.nix
+++ b/pkgs/tools/filesystems/ifuse/default.nix
@@ -1,25 +1,31 @@
-{ stdenv, fetchurl, pkgconfig, usbmuxd, fuse, gnutls, libgcrypt,
-  libplist, libimobiledevice }:
+{ stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, usbmuxd, fuse, libimobiledevice }:
 
 stdenv.mkDerivation rec {
-  name = "ifuse-1.1.3";
+  pname = "ifuse";
+  version = "1.1.3";
 
-  nativeBuildInputs = [ pkgconfig fuse libplist usbmuxd gnutls libgcrypt libimobiledevice ];
+  name = "${pname}-${version}";
 
-  src = fetchurl {
-    url = "${meta.homepage}/downloads/${name}.tar.bz2";
-    sha256 = "1p9a4n36jb194cnp6v57cz2bggwbywaz8pbpb95ch83pzdkdx257";
+  src = fetchFromGitHub {
+    owner = "libimobiledevice";
+    repo = pname;
+    rev = version;
+    sha256 = "0p01rds3vc5864v48swgqw5dv0h937nqnxggryixg9pkvzhc6cx5";
   };
 
-  meta = {
-    homepage = http://www.libimobiledevice.org;
-    license = stdenv.lib.licenses.lgpl21Plus;
+  nativeBuildInputs = [ autoreconfHook pkgconfig fuse usbmuxd libimobiledevice ];
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/libimobiledevice/ifuse;
     description = "A fuse filesystem implementation to access the contents of iOS devices";
     longDescription = ''
-    Mount directories of an iOS device locally using fuse. By default the media
-    directory is mounted, options allow to also mount the sandbox container of an
-    app, an app's documents folder or even the root filesystem on jailbroken
-    devices.'';
-    inherit (usbmuxd.meta) platforms maintainers;
+      Mount directories of an iOS device locally using fuse. By default the media
+      directory is mounted, options allow to also mount the sandbox container of an
+      app, an app's documents folder or even the root filesystem on jailbroken
+      devices.
+    '';
+    license = licenses.lgpl21Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/tools/filesystems/nixpart/0.4/lvm2.nix b/pkgs/tools/filesystems/nixpart/0.4/lvm2.nix
index 1ddcbb2376c5..7c92dc95268e 100644
--- a/pkgs/tools/filesystems/nixpart/0.4/lvm2.nix
+++ b/pkgs/tools/filesystems/nixpart/0.4/lvm2.nix
@@ -12,8 +12,13 @@ stdenv.mkDerivation {
     sha256 = "0nr833bl0q4zq52drjxmmpf7bs6kqxwa5kahwwxm9411khkxz0vc";
   };
 
-  configureFlags =
-    "--disable-readline --enable-udev_rules --enable-udev_sync --enable-pkgconfig --enable-applib";
+  configureFlags = [
+    "--disable-readline"
+    "--enable-udev_rules"
+    "--enable-udev_sync"
+    "--enable-pkgconfig"
+    "--enable-applib"
+  ];
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ systemd ];
diff --git a/pkgs/tools/graphics/asymptote/default.nix b/pkgs/tools/graphics/asymptote/default.nix
index 84940e23f0c1..1aa4fff82241 100644
--- a/pkgs/tools/graphics/asymptote/default.nix
+++ b/pkgs/tools/graphics/asymptote/default.nix
@@ -9,11 +9,11 @@ let
   s = # Generated upstream information
   rec {
     baseName="asymptote";
-    version="2.46";
+    version="2.47";
     name="${baseName}-${version}";
-    hash="06nvvgpyrjwd3pd7q2j6qj5fjv3yvdqb0k9859i1lghjm0bg5kkq";
-    url="https://freefr.dl.sourceforge.net/project/asymptote/2.46/asymptote-2.46.src.tgz";
-    sha256="06nvvgpyrjwd3pd7q2j6qj5fjv3yvdqb0k9859i1lghjm0bg5kkq";
+    hash="0zc24n2vwzxdfmcppqfk3fkqlb4jmvswzi3bz232kxl7dyiyb971";
+    url="https://freefr.dl.sourceforge.net/project/asymptote/2.47/asymptote-2.47.src.tgz";
+    sha256="0zc24n2vwzxdfmcppqfk3fkqlb4jmvswzi3bz232kxl7dyiyb971";
   };
   buildInputs = [
    ghostscriptX imagemagick fftw
diff --git a/pkgs/tools/graphics/blockhash/default.nix b/pkgs/tools/graphics/blockhash/default.nix
index c48b85cedb26..5ddf8185b3cf 100644
--- a/pkgs/tools/graphics/blockhash/default.nix
+++ b/pkgs/tools/graphics/blockhash/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "blockhash-${version}";
-  version = "0.3";
+  version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "commonsmachinery";
     repo = "blockhash";
     rev = "v${version}";
-    sha256 = "15iwljpkykn2711jhls7cwkb23gk6iawlvvk4prl972wic2wlxcj";
+    sha256 = "0m7ikppl42iicgmwsb7baajmag7v0p1ab06xckifvrr0zm21bq9p";
   };
 
   nativeBuildInputs = [ python pkgconfig ];
diff --git a/pkgs/tools/graphics/dcraw/default.nix b/pkgs/tools/graphics/dcraw/default.nix
index dd81c3e4ecc0..e4ceff36f92a 100644
--- a/pkgs/tools/graphics/dcraw/default.nix
+++ b/pkgs/tools/graphics/dcraw/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchurl, libjpeg, lcms2, gettext, jasper }:
+{stdenv, fetchurl, libjpeg, lcms2, gettext, jasper, libiconv }:
 
 stdenv.mkDerivation rec {
   name = "dcraw-9.28.0";
@@ -8,15 +8,18 @@ stdenv.mkDerivation rec {
     sha256 = "1fdl3xa1fbm71xzc3760rsjkvf0x5jdjrvdzyg2l9ka24vdc7418";
   };
 
+  nativeBuildInputs = stdenv.lib.optional stdenv.isDarwin libiconv;
   buildInputs = [ libjpeg lcms2 gettext jasper ];
 
   patchPhase = ''
-    sed -i -e s@/usr/local@$out@ install
+    substituteInPlace install \
+      --replace 'prefix=/usr/local' 'prefix=$out' \
+      --replace gcc '$CC'
   '';
 
   buildPhase = ''
     mkdir -p $out/bin
-    sh install
+    sh -e install
   '';
 
   meta = {
diff --git a/pkgs/tools/graphics/editres/default.nix b/pkgs/tools/graphics/editres/default.nix
index 8bc33fb1b0a4..b8f32c33a530 100644
--- a/pkgs/tools/graphics/editres/default.nix
+++ b/pkgs/tools/graphics/editres/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ libXt libXaw libXres utilmacros ];
 
-  configureFlags = "--with-appdefaultdir=$(out)/share/X11/app-defaults/editres";
+  configureFlags = [ "--with-appdefaultdir=$(out)/share/X11/app-defaults/editres" ];
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/tools/graphics/ggobi/default.nix b/pkgs/tools/graphics/ggobi/default.nix
index 071c8f360792..0ed1855a338c 100644
--- a/pkgs/tools/graphics/ggobi/default.nix
+++ b/pkgs/tools/graphics/ggobi/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ libxml2 gtk2 ];
 
-  configureFlags = "--with-all-plugins";
+  configureFlags = [ "--with-all-plugins" ];
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/tools/graphics/plotutils/default.nix b/pkgs/tools/graphics/plotutils/default.nix
index 780e09ee91cf..0d1890bb6703 100644
--- a/pkgs/tools/graphics/plotutils/default.nix
+++ b/pkgs/tools/graphics/plotutils/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     make -C libplot xmi.h
   '';
 
-  configureFlags = "--enable-libplotter"; # required for pstoedit
+  configureFlags = [ "--enable-libplotter" ]; # required for pstoedit
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/tools/inputmethods/keyfuzz/default.nix b/pkgs/tools/inputmethods/keyfuzz/default.nix
index b930da02acc9..bb179e18e078 100644
--- a/pkgs/tools/inputmethods/keyfuzz/default.nix
+++ b/pkgs/tools/inputmethods/keyfuzz/default.nix
@@ -17,5 +17,5 @@ stdenv.mkDerivation rec {
     sha256 = "0xv9ymivp8fnyc5xcyh1vamxnx90bzw66wlld813fvm6q2gsiknk";
   };
 
-  configureFlags = "--without-initdir --disable-lynx";
+  configureFlags = [ "--without-initdir" "--disable-lynx" ];
 }
diff --git a/pkgs/tools/inputmethods/m17n-lib/otf.nix b/pkgs/tools/inputmethods/m17n-lib/otf.nix
new file mode 100644
index 000000000000..6e13b4a949c4
--- /dev/null
+++ b/pkgs/tools/inputmethods/m17n-lib/otf.nix
@@ -0,0 +1,19 @@
+{ stdenv, fetchurl, libXaw, freetype }:
+stdenv.mkDerivation rec {
+  name = "libotf-0.9.16";
+
+  src = fetchurl {
+    url = "http://download.savannah.gnu.org/releases/m17n/${name}.tar.gz";
+    sha256 = "0sq6g3xaxw388akws6qrllp3kp2sxgk2dv4j79k6mm52rnihrnv8";
+  };
+
+  buildInputs = [ libXaw freetype ];
+
+  meta = {
+    homepage = http://www.nongnu.org/m17n/;
+    description = "Multilingual text processing library (libotf)";
+    license = stdenv.lib.licenses.lgpl21Plus;
+    platforms = stdenv.lib.platforms.linux;
+    maintainers = with stdenv.lib.maintainers; [ bendlas ];
+  };
+}
diff --git a/pkgs/tools/misc/bc/default.nix b/pkgs/tools/misc/bc/default.nix
index 52bd28e9748d..ea8cefd14d3e 100644
--- a/pkgs/tools/misc/bc/default.nix
+++ b/pkgs/tools/misc/bc/default.nix
@@ -1,4 +1,6 @@
-{stdenv, autoreconfHook, buildPackages, fetchurl, flex, readline, ed, texinfo}:
+{ stdenv, autoreconfHook, buildPackages
+, fetchurl, flex, readline, ed, texinfo
+}:
 
 stdenv.mkDerivation rec {
   name = "bc-1.07.1";
@@ -31,6 +33,7 @@ stdenv.mkDerivation rec {
   meta = {
     description = "GNU software calculator";
     homepage = http://www.gnu.org/software/bc/;
+    license = stdenv.lib.licenses.gpl3;
     platforms = stdenv.lib.platforms.all;
   };
 }
diff --git a/pkgs/tools/misc/clipster/default.nix b/pkgs/tools/misc/clipster/default.nix
index bffcc597ea0a..e71ba3bf58ed 100644
--- a/pkgs/tools/misc/clipster/default.nix
+++ b/pkgs/tools/misc/clipster/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation  rec {
   name = "clipster-${version}";
-  version = "2.0.0";
+  version = "2.0.1";
 
   src = fetchFromGitHub {
     owner = "mrichar1";
     repo = "clipster";
     rev = "${version}";
-    sha256 = "0v1412zdkps21i5bw1p7jdv5ydnbw9dcr02318qr5mvk8lwdmsgw";
+    sha256 = "08zs7yjpjc6haddkwx7sq5vyq2ldy455qlcrx1a3vi7krmdwl1q9";
   };
 
   pythonEnv = python3.withPackages(ps: with ps; [ pygobject3 ]);
diff --git a/pkgs/tools/misc/cowsay/default.nix b/pkgs/tools/misc/cowsay/default.nix
index 0a7b079445d5..4d55b70d007b 100644
--- a/pkgs/tools/misc/cowsay/default.nix
+++ b/pkgs/tools/misc/cowsay/default.nix
@@ -1,12 +1,12 @@
-{ stdenv, fetchgit, perl }:
+{ stdenv, fetchurl, perl }:
 
-stdenv.mkDerivation {
-  name = "cowsay-3.03+dfsg1-16";
+stdenv.mkDerivation rec{
+  version = "3.03+dfsg2";
+  name = "cowsay-${version}";
 
-  src = fetchgit {
-    url = https://anonscm.debian.org/git/collab-maint/cowsay.git;
-    rev = "acb946c166fa3b9526b9c471ef1330f9f89f9c8b";
-    sha256 = "1ji66nrdcc8sh79hwils3nbaj897s352r5wp7kzjwiym8bm2azk6";
+  src = fetchurl {
+    url = "http://http.debian.net/debian/pool/main/c/cowsay/cowsay_${version}.orig.tar.gz";
+    sha256 = "0ghqnkp8njc3wyqx4mlg0qv0v0pc996x2nbyhqhz66bbgmf9d29v";
   };
 
   buildInputs = [ perl ];
@@ -15,10 +15,11 @@ stdenv.mkDerivation {
     bash ./install.sh $out
   '';
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "A program which generates ASCII pictures of a cow with a message";
-    homepage = http://www.nog.net/~tony/warez/cowsay.shtml;
-    platforms = stdenv.lib.platforms.all;
-    maintainers = [ stdenv.lib.maintainers.rob ];
+    homepage = https://en.wikipedia.org/wiki/Cowsay;
+    license = licenses.gpl1;
+    platforms = platforms.all;
+    maintainers = [ maintainers.rob ];
   };
 }
diff --git a/pkgs/tools/misc/dateutils/default.nix b/pkgs/tools/misc/dateutils/default.nix
index 7c689211f6ed..9b52d3fd3608 100644
--- a/pkgs/tools/misc/dateutils/default.nix
+++ b/pkgs/tools/misc/dateutils/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  version = "0.4.3";
+  version = "0.4.4";
   name = "dateutils-${version}";
 
   src = fetchurl {
     url = "https://bitbucket.org/hroptatyr/dateutils/downloads/${name}.tar.xz";
-    sha256 = "06lgqp2cyvmh09j04lm3g6ml7yxn1x92rjzgnwzq4my95c37kmdh";
+    sha256 = "0ky8177is4swgxfqczc78d7yjc13w626k515qw517086n7xjxk59";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/misc/debootstrap/default.nix b/pkgs/tools/misc/debootstrap/default.nix
index b3a654be04e4..a11e8a44de92 100644
--- a/pkgs/tools/misc/debootstrap/default.nix
+++ b/pkgs/tools/misc/debootstrap/default.nix
@@ -4,16 +4,16 @@
 # There is also cdebootstrap now. Is that easier to maintain?
 stdenv.mkDerivation rec {
   name = "debootstrap-${version}";
-  version = "1.0.106";
+  version = "1.0.107";
 
   src = fetchurl {
     # git clone git://git.debian.org/d-i/debootstrap.git
     # I'd like to use the source. However it's lacking the lanny script ? (still true?)
     url = "mirror://debian/pool/main/d/debootstrap/debootstrap_${version}.tar.gz";
-    sha256 = "0vn2camhwf6h2ja78km9ihi8df4pfzvm9hnppv6vq32lfwjd3z2g";
+    sha256 = "1gq5r4fa0hrq4c69l2s0ygnfyvr90k2wqaq15s869hayhnssx4g1";
   };
 
-  buildInputs = [ dpkg gettext gawk perl ];
+  buildInputs = [ dpkg gettext gawk perl wget ];
 
   dontBuild = true;
 
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
         --subst-var-by id "$(type -p id)" \
         --subst-var-by perl "$(type -p perl)" \
         --subst-var-by uname "$(type -p uname)" \
-        --subst-var-by wget "${wget}/bin/wget"
+        --subst-var-by wget "$(type -p wget)"
     done
 
 
diff --git a/pkgs/tools/misc/fortune/default.nix b/pkgs/tools/misc/fortune/default.nix
index 59c0396eebea..8e9557335982 100644
--- a/pkgs/tools/misc/fortune/default.nix
+++ b/pkgs/tools/misc/fortune/default.nix
@@ -23,8 +23,9 @@ stdenv.mkDerivation {
     rmdir $out/games
   '';
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "A program that displays a pseudorandom message from a database of quotations";
-    platforms = stdenv.lib.platforms.unix;
+    license = licenses.bsdOriginal;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/tools/misc/grub/default.nix b/pkgs/tools/misc/grub/default.nix
index bb565bacfe79..6ba931ad80d6 100644
--- a/pkgs/tools/misc/grub/default.nix
+++ b/pkgs/tools/misc/grub/default.nix
@@ -50,7 +50,8 @@ stdenv.mkDerivation {
 
   passthru.grubTarget = "";
 
-  meta = {
-    platforms = stdenv.lib.platforms.linux;
+  meta = with stdenv.lib; {
+    license = licenses.gpl2;
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/tools/misc/less/default.nix b/pkgs/tools/misc/less/default.nix
index 57eeb39f5431..c961ea938bab 100644
--- a/pkgs/tools/misc/less/default.nix
+++ b/pkgs/tools/misc/less/default.nix
@@ -13,10 +13,11 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ ncurses ];
 
-  meta = {
+  meta = with stdenv.lib; {
     homepage = http://www.greenwoodsoftware.com/less/;
     description = "A more advanced file pager than ‘more’";
-    platforms = stdenv.lib.platforms.unix;
-    maintainers = [ stdenv.lib.maintainers.eelco ];
+    platforms = platforms.unix;
+    license = licenses.gpl3;
+    maintainers = [ maintainers.eelco ];
   };
 }
diff --git a/pkgs/tools/misc/most/default.nix b/pkgs/tools/misc/most/default.nix
index 61ddec3caaa2..3471016db5b9 100644
--- a/pkgs/tools/misc/most/default.nix
+++ b/pkgs/tools/misc/most/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation {
       -e "s|/bin/rm|rm|"
   '';
 
-  configureFlags = "--with-slang=${slang.dev}";
+  configureFlags = [ "--with-slang=${slang.dev}" ];
 
   buildInputs = [ slang ncurses ];
 
diff --git a/pkgs/tools/misc/pdd/default.nix b/pkgs/tools/misc/pdd/default.nix
index d84f0f966e49..da595e0591a4 100644
--- a/pkgs/tools/misc/pdd/default.nix
+++ b/pkgs/tools/misc/pdd/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonApplication rec {
   pname = "pdd";
-  version = "1.3";
+  version = "1.3.1";
 
   src = fetchFromGitHub {
     owner = "jarun";
     repo = "pdd";
     rev = "v${version}";
-    sha256 = "1r7861qg73jpchgmk8zcz0iki95ic1i3f77sd7j7vf5bvkikv739";
+    sha256 = "0kl6d9nivf6jj1j70alz64iwbp3ip9rg4x506nannii2cfmmx5wr";
   };
 
   format = "other";
diff --git a/pkgs/tools/misc/pspg/default.nix b/pkgs/tools/misc/pspg/default.nix
index f68c87df5ce5..a1492259e8c4 100644
--- a/pkgs/tools/misc/pspg/default.nix
+++ b/pkgs/tools/misc/pspg/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "pspg-${version}";
-  version = "1.2.1";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "okbob";
     repo = "pspg";
     rev = "${version}";
-    sha256 = "172kphgy6rjs4np1azxldi6mcknjaksj7vfjs3ijldkzz87i7w95";
+    sha256 = "1m63bhhglrpc2g68i5bigrzlpvg98qs83jgvf2gsbc4gnx9hywk5";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/tools/misc/urjtag/default.nix b/pkgs/tools/misc/urjtag/default.nix
index 48edb601a43f..60a1ab325b13 100644
--- a/pkgs/tools/misc/urjtag/default.nix
+++ b/pkgs/tools/misc/urjtag/default.nix
@@ -21,12 +21,12 @@ stdenv.mkDerivation rec {
   buildInputs = [ gettext autoconf automake libtool bison flex which
     subversion makeWrapper readline libftdi libusb python3 ];
 
-  configureFlags = ''
-    ${if svfSupport then "--enable-svf" else "--disable-svf"}
-    ${if bsdlSupport then "--enable-bsdl" else "--disable-bsdl"}
-    ${if staplSupport then "--enable-stapl" else "--disable-stapl"}
-    ${if jedecSupport then "--enable-jedec-exp" else "--disable-jedec-exp"}
-  '';
+  configureFlags = [
+    (stdenv.lib.enableFeature svfSupport   "svf")
+    (stdenv.lib.enableFeature bsdlSupport  "bsdl")
+    (stdenv.lib.enableFeature staplSupport "stapl")
+    (stdenv.lib.enableFeature jedecSupport "jedec-exp")
+  ];
 
   preConfigure = "./autogen.sh";
 
diff --git a/pkgs/tools/misc/usbmuxd/default.nix b/pkgs/tools/misc/usbmuxd/default.nix
index 2a792669ba8b..6c26564c9dbb 100644
--- a/pkgs/tools/misc/usbmuxd/default.nix
+++ b/pkgs/tools/misc/usbmuxd/default.nix
@@ -1,30 +1,40 @@
-{ stdenv, fetchurl, libplist, libusb1, pkgconfig, libimobiledevice }:
+{ stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, libusb1, libimobiledevice }:
 
 stdenv.mkDerivation rec {
-  name = "usbmuxd-${version}";
-  version = "1.1.0";
+  pname = "usbmuxd";
+  version = "2018-07-22";
 
-  src = fetchurl {
-    url = "https://www.libimobiledevice.org/downloads/${name}.tar.bz2";
-    sha256 = "0bdlc7a8plvglqqx39qqampqm6y0hcdws76l9dffwl22zss4i29y";
+  name = "${pname}-${version}";
+
+  src = fetchFromGitHub {
+    owner = "libimobiledevice";
+    repo = pname;
+    rev = "ee85938c21043ef5f7cd4dfbc7677f385814d4d8";
+    sha256 = "1qsnxvcagxa92rz0w78m0n2drgaghi0pqpbjdk2080sczzi1g76y";
   };
 
-  nativeBuildInputs = [ pkgconfig ];
-  propagatedBuildInputs = [ libusb1 libplist libimobiledevice ];
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  propagatedBuildInputs = [ libimobiledevice libusb1 ];
 
   preConfigure = ''
     configureFlags="$configureFlags --with-udevrulesdir=$out/lib/udev/rules.d"
     configureFlags="$configureFlags --with-systemdsystemunitdir=$out/lib/systemd/system"
   '';
 
-  meta = {
-    homepage = http://marcansoft.com/blog/iphonelinux/usbmuxd/;
-    description = "USB Multiplex Daemon (for talking to iPhone or iPod)";
+  meta = with stdenv.lib; {
+    homepage = https://github.com/libimobiledevice/usbmuxd;
+    description = "A socket daemon to multiplex connections from and to iOS devices";
     longDescription = ''
-      usbmuxd: USB Multiplex Daemon. This bit of software is in charge of
-      talking to your iPhone or iPod Touch over USB and coordinating access to
-      its services by other applications.'';
-    platforms = stdenv.lib.platforms.linux;
-    maintainers = [ ];
+      usbmuxd stands for "USB multiplexing daemon". This daemon is in charge of
+      multiplexing connections over USB to an iOS device. To users, it means
+      you can sync your music, contacts, photos, etc. over USB. To developers, it
+      means you can connect to any listening localhost socket on the device. usbmuxd
+      is not used for tethering data transfer which uses a dedicated USB interface as
+      a virtual network device. Multiple connections to different TCP ports can happen
+      in parallel. The higher-level layers are handled by libimobiledevice.
+    '';
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/tools/misc/xburst-tools/default.nix b/pkgs/tools/misc/xburst-tools/default.nix
index b25be6418976..ca642035a0bb 100644
--- a/pkgs/tools/misc/xburst-tools/default.nix
+++ b/pkgs/tools/misc/xburst-tools/default.nix
@@ -18,9 +18,10 @@ stdenv.mkDerivation {
     sh autogen.sh
   '';
 
-  configureFlags = if gccCross != null then
-    "--enable-firmware CROSS_COMPILE=${gccCross.targetPrefix}"
-    else "";
+  configureFlags = stdenv.lib.optionals (gccCross != null) [
+    "--enable-firmware"
+    "CROSS_COMPILE=${gccCross.targetPrefix}"
+  ];
 
   hardeningDisable = [ "pic" "stackprotector" ];
 
diff --git a/pkgs/tools/misc/you-get/default.nix b/pkgs/tools/misc/you-get/default.nix
index e9cd23f5bbc4..5254d1091680 100644
--- a/pkgs/tools/misc/you-get/default.nix
+++ b/pkgs/tools/misc/you-get/default.nix
@@ -2,7 +2,7 @@
 
 buildPythonApplication rec {
   pname = "you-get";
-  version = "0.4.1099";
+  version = "0.4.1128";
 
   # Tests aren't packaged, but they all hit the real network so
   # probably aren't suitable for a build environment anyway.
@@ -10,7 +10,7 @@ buildPythonApplication rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1z9zhxv2vgbb20hgjiksyqm2zglwq71azbp27na1779hbqc467ik";
+    sha256 = "0i0wspmgblxwvvbm3q8zz4l450fs3bccqxxfm0ysfgprgcy8fp3l";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/networking/altermime/default.nix b/pkgs/tools/networking/altermime/default.nix
index f1e85487d8fc..fee133b1d736 100644
--- a/pkgs/tools/networking/altermime/default.nix
+++ b/pkgs/tools/networking/altermime/default.nix
@@ -21,12 +21,11 @@ stdenv.mkDerivation rec {
     mkdir -p "$out/bin"
   '';
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "MIME alteration tool";
-    maintainers = with stdenv.lib.maintainers; [
-      raskin
-    ];
-    platforms = with stdenv.lib.platforms; linux;
+    maintainers = [ maintainers.raskin ];
+    platforms = platforms.linux;
+    license.fullName = "alterMIME LICENSE";
     downloadPage = "http://www.pldaniels.com/altermime/";
   };
 }
diff --git a/pkgs/tools/networking/argus-clients/default.nix b/pkgs/tools/networking/argus-clients/default.nix
index 766ae4116061..dccab1796fbc 100644
--- a/pkgs/tools/networking/argus-clients/default.nix
+++ b/pkgs/tools/networking/argus-clients/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     done
     '';
 
-  configureFlags = "--with-perl=${perl}/bin/perl";
+  configureFlags = [ "--with-perl=${perl}/bin/perl" ];
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ libpcap bison cyrus_sasl tcp_wrappers flex ];
diff --git a/pkgs/tools/networking/cadaver/default.nix b/pkgs/tools/networking/cadaver/default.nix
index 6bc96a5b8c72..75a05108b8bf 100644
--- a/pkgs/tools/networking/cadaver/default.nix
+++ b/pkgs/tools/networking/cadaver/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  configureFlags = "--with-ssl";
+  configureFlags = [ "--with-ssl" ];
 
   buildInputs = [ openssl ];
 
diff --git a/pkgs/tools/networking/curl/7_59.nix b/pkgs/tools/networking/curl/7_59.nix
index 71a87a8e9d15..0482bcf52629 100644
--- a/pkgs/tools/networking/curl/7_59.nix
+++ b/pkgs/tools/networking/curl/7_59.nix
@@ -101,6 +101,7 @@ stdenv.mkDerivation rec {
     description = "A command line tool for transferring files with URL syntax";
     homepage    = https://curl.haxx.se/;
     maintainers = with maintainers; [ lovek323 ];
+    license = licenses.curl;
     platforms   = platforms.all;
   };
 }
diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index d15e6084a8b9..d42cdcd4a347 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -105,6 +105,7 @@ stdenv.mkDerivation rec {
     description = "A command line tool for transferring files with URL syntax";
     homepage    = https://curl.haxx.se/;
     maintainers = with maintainers; [ lovek323 ];
-    platforms   = platforms.all;
+    license = licenses.curl;
+    platforms = platforms.all;
   };
 }
diff --git a/pkgs/tools/networking/dd-agent/default.nix b/pkgs/tools/networking/dd-agent/5.nix
index ff4a24fb7810..d3c4a2af7652 100644
--- a/pkgs/tools/networking/dd-agent/default.nix
+++ b/pkgs/tools/networking/dd-agent/5.nix
@@ -89,7 +89,10 @@ in stdenv.mkDerivation rec {
   '';
 
   meta = {
-    description = "Event collector for the DataDog analysis service";
+    description = ''
+      Event collector for the DataDog analysis service
+      -- v5 Python implementation
+    '';
     homepage    = https://www.datadoghq.com;
     license     = stdenv.lib.licenses.bsd3;
     platforms   = stdenv.lib.platforms.all;
diff --git a/pkgs/tools/networking/dd-agent/6.nix b/pkgs/tools/networking/dd-agent/6.nix
new file mode 100644
index 000000000000..56a71595cea7
--- /dev/null
+++ b/pkgs/tools/networking/dd-agent/6.nix
@@ -0,0 +1,77 @@
+{ stdenv, fetchFromGitHub, buildGoPackage, makeWrapper, pythonPackages, pkgconfig }:
+
+let
+  # keep this in sync with github.com/DataDog/agent-payload dependency
+  payloadVersion = "4.7";
+
+in buildGoPackage rec {
+  name = "datadog-agent-${version}";
+  version = "6.1.4";
+  owner   = "DataDog";
+  repo    = "datadog-agent";
+
+  src = fetchFromGitHub {
+    inherit owner repo;
+    rev    = "a8ee76deb11fa334470d9b8f2356214999980894";
+    sha256 = "06grcwwbfvcw1k1d4nqrasrf76qkpik1gsw60zwafllfd9ffhl1v";
+  };
+
+  subPackages = [
+    "cmd/agent"
+    "cmd/dogstatsd"
+    "cmd/py-launcher"
+    "cmd/cluster-agent"
+  ];
+  goDeps = ./deps.nix;
+  goPackagePath = "github.com/${owner}/${repo}";
+
+  # Explicitly set this here to allow it to be overridden.
+  python = pythonPackages.python;
+
+  nativeBuildInputs = [ pkgconfig makeWrapper ];
+  PKG_CONFIG_PATH = "${python}/lib/pkgconfig";
+
+  buildFlagsArray = let
+    ldFlags = stdenv.lib.concatStringsSep " " [
+      "-X ${goPackagePath}/pkg/version.Commit=${src.rev}"
+      "-X ${goPackagePath}/pkg/version.AgentVersion=${version}"
+      "-X ${goPackagePath}/pkg/serializer.AgentPayloadVersion=${payloadVersion}"
+      "-X ${goPackagePath}/pkg/collector/py.pythonHome=${python}"
+      "-r ${python}/lib"
+    ];
+  in [
+    "-ldflags=${ldFlags}"
+  ];
+  buildFlags = "-tags cpython";
+
+  # DataDog use paths relative to the agent binary, so fix these.
+  postPatch = ''
+    sed -e "s|PyChecksPath =.*|PyChecksPath = \"$bin/${python.sitePackages}\"|" \
+        -e "s|distPath =.*|distPath = \"$bin/share/datadog-agent\"|" \
+        -i cmd/agent/common/common_nix.go
+  '';
+
+  # Install the config files and python modules from the "dist" dir
+  # into standard paths.
+  postInstall = ''
+    mkdir -p $bin/${python.sitePackages} $bin/share/datadog-agent
+    cp -R $src/cmd/agent/dist/{conf.d,trace-agent.conf} $bin/share/datadog-agent
+    cp -R $src/cmd/agent/dist/{checks,utils,config.py} $bin/${python.sitePackages}
+
+    cp -R $src/pkg/status/dist/templates $bin/share/datadog-agent
+
+    wrapProgram "$bin/bin/agent" \
+        --set PYTHONPATH "$bin/${python.sitePackages}"
+  '';
+
+  meta = with stdenv.lib; {
+    description = ''
+      Event collector for the DataDog analysis service
+      -- v6 new golang implementation.
+    '';
+    homepage    = https://www.datadoghq.com;
+    license     = licenses.bsd3;
+    platforms   = platforms.all;
+    maintainers = with maintainers; [ thoughtpolice domenkozar rvl ];
+  };
+}
diff --git a/pkgs/tools/networking/dd-agent/deps.nix b/pkgs/tools/networking/dd-agent/deps.nix
new file mode 100644
index 000000000000..7a8fc69b2a42
--- /dev/null
+++ b/pkgs/tools/networking/dd-agent/deps.nix
@@ -0,0 +1,353 @@
+[
+  {
+    goPackagePath = "github.com/DataDog/agent-payload";
+    fetch = {
+      type = "git";
+      url = "https://github.com/DataDog/agent-payload";
+      rev = "3b793015ecfa5b829e8a466bd7cce836891502cc";
+      sha256 = "0lg7c1whmvk4a13mrivdjfzfxqan07kvs2calgylncy7yf4szdp6";
+    };
+  }
+  {
+    goPackagePath = "github.com/DataDog/gohai";
+    fetch = {
+      type = "git";
+      url = "https://github.com/DataDog/gohai";
+      rev = "d80d0f562a71fa2380fbeccc93ba5a2e325606e4";
+      sha256 = "1frslms7f5i8dc8n0v9pb64mf4zdj3q2c005qxajl8j8i9nhj7yb";
+    };
+  }
+  {
+    goPackagePath = "github.com/DataDog/mmh3";
+    fetch = {
+      type = "git";
+      url = "https://github.com/DataDog/mmh3";
+      rev = "2cfb68475274527a10701355c739f31dd404718c";
+      sha256 = "09jgzxi08pkxllxk3f5qwipz96jxrw5v035fj2bkid1d4akn8y0b";
+    };
+  }
+  {
+    goPackagePath = "github.com/beevik/ntp";
+    fetch = {
+      type = "git";
+      url = "https://github.com/beevik/ntp";
+      rev = "cb3dae3a7588ae35829eb5724df611cd75152fba";
+      sha256 = "0nc6f7d0xw23y18z9qxrmm8kvnywihassyk706mn9v4makmhalnz";
+    };
+  }
+  {
+    goPackagePath = "github.com/cihub/seelog";
+    fetch = {
+      type = "git";
+      url = "https://github.com/cihub/seelog";
+      rev = "f561c5e57575bb1e0a2167028b7339b3a8d16fb4";
+      sha256 = "0r3228hvgljgpaggj6b9mvxfsizfw25q2c1761wsvcif8gz49cvl";
+    };
+  }
+  {
+    goPackagePath = "github.com/docker/docker";
+    fetch = {
+      type = "git";
+      url = "https://github.com/docker/docker";
+      rev = "092cba3727bb9b4a2f0e922cd6c0f93ea270e363";
+      sha256 = "0l9kjibnpwcgk844sibxk9ppyqniw9r0np1mzp95f8f461jb0iar";
+    };
+  }
+  {
+    goPackagePath = "github.com/dsnet/compress";
+    fetch = {
+      type = "git";
+      url = "https://github.com/dsnet/compress";
+      rev = "cc9eb1d7ad760af14e8f918698f745e80377af4f";
+      sha256 = "159liclywmyb6zx88ga5gn42hfl4cpk1660zss87fkx31hdq9fgx";
+    };
+  }
+  {
+    goPackagePath = "github.com/fatih/color";
+    fetch = {
+      type = "git";
+      url = "https://github.com/fatih/color";
+      rev = "507f6050b8568533fb3f5504de8e5205fa62a114";
+      sha256 = "0k1v9dkhrxiqhg48yqkwzpd7x40xx38gv2pgknswbsy4r8w644i7";
+    };
+  }
+  {
+    goPackagePath = "github.com/fsnotify/fsnotify";
+    fetch = {
+      type = "git";
+      url = "https://github.com/fsnotify/fsnotify";
+      rev = "c2828203cd70a50dcccfb2761f8b1f8ceef9a8e9";
+      sha256 = "07va9crci0ijlivbb7q57d2rz9h27zgn2fsm60spjsqpdbvyrx4g";
+    };
+  }
+  {
+    goPackagePath = "github.com/go-ini/ini";
+    fetch = {
+      type = "git";
+      url = "https://github.com/go-ini/ini";
+      rev = "bda519ae5f4cbc60d391ff8610711627a08b86ae";
+      sha256 = "05vcc3ssxyrk8g3sr4gs888vllgjqfq11na63qz2pvaiy7m0rqrs";
+    };
+  }
+  {
+    goPackagePath = "github.com/gogo/protobuf";
+    fetch = {
+      type = "git";
+      url = "https://github.com/gogo/protobuf";
+      rev = "1ef32a8b9fc3f8ec940126907cedb5998f6318e4";
+      sha256 = "0zk2n0n35ksskr5cd83k5k8wg21ckrcggjy88bym2s21ngj5w4fh";
+    };
+  }
+  {
+    goPackagePath = "github.com/golang/snappy";
+    fetch = {
+      type = "git";
+      url = "https://github.com/golang/snappy";
+      rev = "553a641470496b2327abcac10b36396bd98e45c9";
+      sha256 = "0kssxnih1l722hx9219c7javganjqkqhvl3i0hp0hif6xm6chvqk";
+    };
+  }
+  {
+    goPackagePath = "github.com/gorilla/mux";
+    fetch = {
+      type = "git";
+      url = "https://github.com/gorilla/mux";
+      rev = "ded0c29b24f96f46cf349e6701b099db601cf8ec";
+      sha256 = "125dxfxs7his95fd2r28bn1rpb78pldfgm3lmw84ha1c0v5gfh33";
+    };
+  }
+  {
+    goPackagePath = "github.com/hashicorp/hcl";
+    fetch = {
+      type = "git";
+      url = "https://github.com/hashicorp/hcl";
+      rev = "ef8a98b0bbce4a65b5aa4c368430a80ddc533168";
+      sha256 = "1qalfsc31fra7hcw2lc3s20aj7al62fq3j5fn5kga3mg99b82nyr";
+    };
+  }
+  {
+    goPackagePath = "github.com/kardianos/osext";
+    fetch = {
+      type = "git";
+      url = "https://github.com/kardianos/osext";
+      rev = "ae77be60afb1dcacde03767a8c37337fad28ac14";
+      sha256 = "056dkgxrqjj5r18bnc3knlpgdz5p3yvp12y4y978hnsfhwaqvbjz";
+    };
+  }
+  {
+    goPackagePath = "github.com/magiconair/properties";
+    fetch = {
+      type = "git";
+      url = "https://github.com/magiconair/properties";
+      rev = "2c9e9502788518c97fe44e8955cd069417ee89df";
+      sha256 = "1w0rl9rla61m0qbha75jg48yiq1vs91sfy96rgqa6nags9v9b1rl";
+    };
+  }
+  {
+    goPackagePath = "github.com/mholt/archiver";
+    fetch = {
+      type = "git";
+      url = "https://github.com/mholt/archiver";
+      rev = "e4ef56d48eb029648b0e895bb0b6a393ef0829c3";
+      sha256 = "1krxyh6iq0s0rwhz7gg6dn795j9qq64rsgq9nivav7fhrqpgr6hb";
+    };
+  }
+  {
+    goPackagePath = "github.com/mitchellh/mapstructure";
+    fetch = {
+      type = "git";
+      url = "https://github.com/mitchellh/mapstructure";
+      rev = "00c29f56e2386353d58c599509e8dc3801b0d716";
+      sha256 = "1vw8fvhax0d567amgvxr7glcl12lvzg2sbzs007q5k5bbwn1szyb";
+    };
+  }
+  {
+    goPackagePath = "github.com/nwaples/rardecode";
+    fetch = {
+      type = "git";
+      url = "https://github.com/nwaples/rardecode";
+      rev = "e06696f847aeda6f39a8f0b7cdff193b7690aef6";
+      sha256 = "1aj7l8ii7hxnn3q4wzxlx3f92b1aspck6ncyqgb4h2g228phcibw";
+    };
+  }
+  {
+    goPackagePath = "github.com/patrickmn/go-cache";
+    fetch = {
+      type = "git";
+      url = "https://github.com/patrickmn/go-cache";
+      rev = "a3647f8e31d79543b2d0f0ae2fe5c379d72cedc0";
+      sha256 = "10020inkzrm931r4bixf8wqr9n39wcrb78vfyxmbvjavvw4zybgs";
+    };
+  }
+  {
+    goPackagePath = "github.com/pelletier/go-toml";
+    fetch = {
+      type = "git";
+      url = "https://github.com/pelletier/go-toml";
+      rev = "66540cf1fcd2c3aee6f6787dfa32a6ae9a870f12";
+      sha256 = "1n8na0yg90gm0rpifmzrby5r385vvd62cdam3ls7ssy02bjvfw15";
+    };
+  }
+  {
+    goPackagePath = "github.com/pierrec/lz4";
+    fetch = {
+      type = "git";
+      url = "https://github.com/pierrec/lz4";
+      rev = "ed8d4cc3b461464e69798080a0092bd028910298";
+      sha256 = "0flsn2ka108lb63gkxfzl90bkhndh1znnscv4v1k6j5h2s3zksls";
+    };
+  }
+  {
+    goPackagePath = "github.com/pierrec/xxHash";
+    fetch = {
+      type = "git";
+      url = "https://github.com/pierrec/xxHash";
+      rev = "a0006b13c722f7f12368c00a3d3c2ae8a999a0c6";
+      sha256 = "1hf7hqrqx0cbgx0alfwnqs0mrxg9rnwsijn5d0lv06w6vzqbvnzj";
+    };
+  }
+  {
+    goPackagePath = "github.com/shirou/gopsutil";
+    fetch = {
+      type = "git";
+      url = "https://github.com/shirou/gopsutil";
+      rev = "57f370e13068146efe1cb7129f79e5d51da8a242";
+      sha256 = "1ij0bbnfjj65afin8vhccr3cxvg6r0awmvcvb2ilza5wbbsslggb";
+    };
+  }
+  {
+    goPackagePath = "github.com/spf13/afero";
+    fetch = {
+      type = "git";
+      url = "https://github.com/spf13/afero";
+      rev = "63644898a8da0bc22138abf860edaf5277b6102e";
+      sha256 = "13piahaq4vw1y1sklq5scrsflqx0a8hzmdqfz1fy4871kf2gl8qw";
+    };
+  }
+  {
+    goPackagePath = "github.com/spf13/cast";
+    fetch = {
+      type = "git";
+      url = "https://github.com/spf13/cast";
+      rev = "8965335b8c7107321228e3e3702cab9832751bac";
+      sha256 = "177bk7lq40jbgv9p9r80aydpaccfk8ja3a7jjhfwiwk9r1pa4rr2";
+    };
+  }
+  {
+    goPackagePath = "github.com/spf13/cobra";
+    fetch = {
+      type = "git";
+      url = "https://github.com/spf13/cobra";
+      rev = "ef82de70bb3f60c65fb8eebacbb2d122ef517385";
+      sha256 = "1q1nsx05svyv9fv3fy6xv6gs9ffimkyzsfm49flvl3wnvf1ncrkd";
+    };
+  }
+  {
+    goPackagePath = "github.com/spf13/jwalterweatherman";
+    fetch = {
+      type = "git";
+      url = "https://github.com/spf13/jwalterweatherman";
+      rev = "7c0cea34c8ece3fbeb2b27ab9b59511d360fb394";
+      sha256 = "132p84i20b9s5r6fs597lsa6648vd415ch7c0d018vm8smzqpd0h";
+    };
+  }
+  {
+    goPackagePath = "github.com/spf13/pflag";
+    fetch = {
+      type = "git";
+      url = "https://github.com/spf13/pflag";
+      rev = "583c0c0531f06d5278b7d917446061adc344b5cd";
+      sha256 = "0nr4mdpfhhk94hq4ymn5b2sxc47b29p1akxd8b0hx4dvdybmipb5";
+    };
+  }
+  {
+    goPackagePath = "github.com/spf13/viper";
+    fetch = {
+      type = "git";
+      url = "https://github.com/spf13/viper";
+      rev = "8dc2790b029dc41e2b8ff772c63c26adbb1db70d";
+      sha256 = "147zq6v34pgb79r4m0m2mwm8739jxwawxs8mpqvvhq7gxwvhng40";
+    };
+  }
+  {
+    goPackagePath = "github.com/stretchr/testify";
+    fetch = {
+      type = "git";
+      url = "https://github.com/stretchr/testify";
+      rev = "c679ae2cc0cb27ec3293fea7e254e47386f05d69";
+      sha256 = "1rrdn7k83j492rzhqwkh6956sj8m2nbk44d7r1xa9nsn3hfwj691";
+    };
+  }
+  {
+    goPackagePath = "github.com/ulikunitz/xz";
+    fetch = {
+      type = "git";
+      url = "https://github.com/ulikunitz/xz";
+      rev = "0c6b41e72360850ca4f98dc341fd999726ea007f";
+      sha256 = "0a6l7sp67ipxim093qh6fvw8knbxj24l7bj5lykcddi5gwfi78n3";
+    };
+  }
+  {
+    goPackagePath = "github.com/urfave/negroni";
+    fetch = {
+      type = "git";
+      url = "https://github.com/urfave/negroni";
+      rev = "22c5532ea862c34fdad414e90f8cc00b4f6f4cab";
+      sha256 = "0jxd10cr3imm96xa01mdgyad4nq6mc7yr49z830fv3vywfr7bac8";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/net";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/net";
+      rev = "640f4622ab692b87c2f3a94265e6f579fe38263d";
+      sha256 = "097m4qhcljhp180171j5fjhq4740iirfkkajfd7yrxqhp4s9hljx";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/sys";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/sys";
+      rev = "6f686a352de66814cdd080d970febae7767857a3";
+      sha256 = "1z3pwvxlzq8kghjdsd9xmf184iiz13h8h66ipp626k4rc7kydr03";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/text";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/text";
+      rev = "7922cc490dd5a7dbaa7fd5d6196b49db59ac042f";
+      sha256 = "06sicjc24hv7v9p1l6psaq87w4lycx3mjixd6gsd1wnd4jhqvlnr";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/yaml.v2";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/yaml.v2";
+      rev = "5420a8b6744d3b0345ab293f6fcba19c978f1183";
+      sha256 = "0dwjrs2lp2gdlscs7bsrmyc5yf6mm4fvgw71bzr9mv2qrd2q73s1";
+    };
+  }
+  {
+    goPackagePath = "github.com/sbinet/go-python";
+    fetch = {
+      type = "git";
+      url = "https://github.com/sbinet/go-python";
+      rev = "6d13f941744b9332d6ed00dc2cd2722acd79a47e";
+      sha256 = "0x5q4nyv6gck9q33g54gy2ajmyjksxjmzh0jfqqn97jpgf4qfaym";
+    };
+  }
+  {
+    goPackagePath = "github.com/mitchellh/reflectwalk";
+    fetch = {
+      type = "git";
+      url = "https://github.com/mitchellh/reflectwalk";
+      rev = "63d60e9d0dbc60cf9164e6510889b0db6683d98c";
+      sha256 = "1hpq6sjr6l1h25x68mz13q7sd52dv1mjfxbl5p7m3j7cv85khnvc";
+    };
+  }
+]
diff --git a/pkgs/tools/networking/dd-agent/integrations-core.nix b/pkgs/tools/networking/dd-agent/integrations-core.nix
new file mode 100644
index 000000000000..9212209e775b
--- /dev/null
+++ b/pkgs/tools/networking/dd-agent/integrations-core.nix
@@ -0,0 +1,91 @@
+# The declarations in this file build the Datadog agent's core
+# integrations. These integrations are tracked in a separate
+# repository[1] outside of the agent's primary repository and provide
+# checks for various kinds of services.
+#
+# Not all services are relevant for all users, however. As some of
+# them depend on various tools and Python packages it is nonsensical
+# to build *all* integrations by default.
+#
+# A set of default integrations is defined and built either way.
+# Additional integrations can be specified by overriding
+# `extraIntegrations` in datadog-integrations-core.
+#
+# In practice the syntax for using this with additional integrations
+# is not the most beautiful, but it works. For example to use
+# datadog-agent from the top-level with the `ntp`-integration
+# included, one could say:
+#
+# let
+#   integrationsWithNtp = datadog-integrations-core {
+#     # Extra integrations map from the integration name (as in the
+#     # integrations-core repository) to a function that receives the
+#     # Python package set and returns the required dependencies.g
+#     ntp = (ps: [ ps.ntplib ]);
+#   };
+#
+# in ddAgentWithNtp = datadog-agent.overrideAttrs(_ : {
+#   python = integrationsWithNtp.python;
+# });
+#
+# The NixOS module 'datadog-agent' provides a simplified interface to
+# this. Please see the module itself for more information.
+#
+# [1]: https://github.com/DataDog/integrations-core
+
+{ pkgs, python, extraIntegrations ? {} }:
+
+with pkgs.lib;
+
+let
+  src = pkgs.fetchFromGitHub {
+    owner = "DataDog";
+    repo = "integrations-core";
+    rev = "7be76e73969a8b9c993903681b300e1dd32f4b4d";
+    sha256 = "1qsqzm5iswgv9jrflh5mvbz9a7js7jf42cb28lzdzsp45iwfs2aa";
+  };
+  version = "git-2018-05-27";
+
+  # Build helper to build a single datadog integration package.
+  buildIntegration = { pname, ... }@args: python.pkgs.buildPythonPackage (args // {
+    inherit src version;
+    name = "datadog-integration-${pname}-${version}";
+
+    postPatch = ''
+      # jailbreak install_requires
+      sed -i 's/==.*//' requirements.in
+      cp requirements.in requirements.txt
+    '';
+    sourceRoot = "source/${args.sourceRoot or pname}";
+    doCheck = false;
+  });
+
+  # Base package depended on by all other integrations.
+  datadog_checks_base = buildIntegration {
+    pname = "checks-base";
+    sourceRoot = "datadog_checks_base";
+    propagatedBuildInputs = with python.pkgs; [
+      requests protobuf prometheus_client uuid simplejson uptime
+    ];
+  };
+
+  # Default integrations that should be built:
+  defaultIntegrations = {
+    disk     = (ps: [ ps.psutil ]);
+    mongo    = (ps: [ ps.pymongo ]);
+    network  = (ps: [ ps.psutil ]);
+    nginx    = (ps: []);
+    postgres = (ps: with ps; [ pg8000 psycopg2 ]);
+  };
+
+  # All integrations (default + extra):
+  integrations = defaultIntegrations // extraIntegrations;
+  builtIntegrations = mapAttrs (pname: fdeps: buildIntegration {
+    inherit pname;
+    propagatedBuildInputs = (fdeps python.pkgs) ++ [ datadog_checks_base ];
+  }) integrations;
+
+in builtIntegrations // {
+  inherit datadog_checks_base;
+  python = python.withPackages (_: (attrValues builtIntegrations));
+}
diff --git a/pkgs/tools/networking/infiniband-diags/default.nix b/pkgs/tools/networking/infiniband-diags/default.nix
index f769a3fcffac..2ed5346b5519 100644
--- a/pkgs/tools/networking/infiniband-diags/default.nix
+++ b/pkgs/tools/networking/infiniband-diags/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     ./autogen.sh
   '';
 
-  configureFlags = "--with-perl-installdir=\${out}/lib/perl5/site_perl --sbindir=\${out}/bin";
+  configureFlags = [ "--with-perl-installdir=\${out}/lib/perl5/site_perl" "--sbindir=\${out}/bin" ];
 
   postInstall = ''
     rmdir $out/var/run $out/var
diff --git a/pkgs/tools/networking/mtr/default.nix b/pkgs/tools/networking/mtr/default.nix
index 8932360c7176..3c2ced1712fd 100644
--- a/pkgs/tools/networking/mtr/default.nix
+++ b/pkgs/tools/networking/mtr/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     substituteInPlace Makefile.in --replace ' install-exec-hook' ""
   '';
 
-  configureFlags = stdenv.lib.optionalString (!withGtk) "--without-gtk";
+  configureFlags = stdenv.lib.optional (!withGtk) "--without-gtk";
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
 
diff --git a/pkgs/tools/networking/p2p/amule/default.nix b/pkgs/tools/networking/p2p/amule/default.nix
index ac440fc6d338..a74242ba5e17 100644
--- a/pkgs/tools/networking/p2p/amule/default.nix
+++ b/pkgs/tools/networking/p2p/amule/default.nix
@@ -8,10 +8,7 @@
 assert httpServer -> libpng != null;
 assert client -> libX11 != null;
 with stdenv;
-let
-  # Enable/Disable Feature
-  edf = enabled: flag: if enabled then "--enable-" + flag else "--disable-" + flag;
-in
+
 mkDerivation rec {
   name = "aMule-2.3.2";
 
@@ -27,15 +24,15 @@ mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  configureFlags = ''
-    --with-crypto-prefix=${cryptopp}
-    --disable-debug
-    --enable-optimize
-    ${edf monolithic "monolithic"}
-    ${edf daemon "amule-daemon"}
-    ${edf client "amule-gui"}
-    ${edf httpServer "webserver"}
-  '';
+  configureFlags = [
+    "--with-crypto-prefix=${cryptopp}"
+    "--disable-debug"
+    "--enable-optimize"
+    (stdenv.lib.enableFeature monolithic "monolithic")
+    (stdenv.lib.enableFeature daemon "amule-daemon")
+    (stdenv.lib.enableFeature client "amule-gui")
+    (stdenv.lib.enableFeature httpServer "webserver")
+  ];
 
   postConfigure = ''
     sed -i "src/libs/ec/file_generator.pl"     \
diff --git a/pkgs/tools/networking/polygraph/default.nix b/pkgs/tools/networking/polygraph/default.nix
index 46680ab47af4..c05e44fb1c07 100644
--- a/pkgs/tools/networking/polygraph/default.nix
+++ b/pkgs/tools/networking/polygraph/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, openssl, zlib, ncurses }:
 
 stdenv.mkDerivation rec {
-  name = "polygraph-4.11.0";
+  name = "polygraph-4.12.0";
 
   src = fetchurl {
     url = "http://www.web-polygraph.org/downloads/srcs/${name}-src.tgz";
-    sha256 = "1ii60yl3p89qawvl19sd1bkpkw39fz8kpvmc3cawa32nxzbm9pbs";
+    sha256 = "1anrdc30yi9pb67642flmn7w82q37cnc45r9bh15mpbc66yk3kzz";
   };
 
   buildInputs = [ openssl zlib ncurses ];
diff --git a/pkgs/tools/networking/reaver-wps/default.nix b/pkgs/tools/networking/reaver-wps/default.nix
index 6cbee7d2a851..ed48feabb85a 100644
--- a/pkgs/tools/networking/reaver-wps/default.nix
+++ b/pkgs/tools/networking/reaver-wps/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     sourceRoot=$(echo */src)
   '';
 
-  configureFlags = "--sysconfdir=${confdir}";
+  configureFlags = [ "--sysconfdir=${confdir}" ];
 
   installPhase = ''
     mkdir -p $out/{bin,etc}
diff --git a/pkgs/tools/networking/slack-cli/default.nix b/pkgs/tools/networking/slack-cli/default.nix
new file mode 100644
index 000000000000..18f192d3535f
--- /dev/null
+++ b/pkgs/tools/networking/slack-cli/default.nix
@@ -0,0 +1,48 @@
+# slack-cli must be configured using the SLACK_CLI_TOKEN environment variable.
+# Using `slack init` will not work because it tries to write to the Nix store.
+#
+# There is no reason that we couldn't change the file path that slack-cli uses
+# for token storage, except that it would make the Nix package inconsistent with
+# upstream and other distributions.
+
+{ stdenv, lib, writeShellScriptBin, fetchFromGitHub, curl, jq }:
+
+stdenv.mkDerivation rec {
+  name = "slack-cli-${version}";
+  version = "0.18.0";
+
+  src = fetchFromGitHub {
+    owner = "rockymadden";
+    repo = "slack-cli";
+    rev = "v${version}";
+    sha256 = "022yr3cpfg0v7cxi62zzk08vp0l3w851qpfh6amyfgjiynnfyddl";
+  };
+
+  dontBuild = true;
+
+  installPhase = ''
+    mkdir -p "$out/bin"
+    cp src/slack "$out/bin/.slack-wrapped"
+
+    cat <<-WRAPPER > "$out/bin/slack"
+    #!${stdenv.shell}
+    [ "\$1" = "init" -a -z "\$SLACK_CLI_TOKEN" ] && cat <<-'MESSAGE' >&2
+    WARNING: slack-cli must be configured using the SLACK_CLI_TOKEN
+    environment variable. Using \`slack init\` will not work because it tries
+    to write to the Nix store.
+
+    MESSAGE
+
+    export PATH=${lib.makeBinPath [ curl jq ]}:"\$PATH"
+    exec "$out/bin/.slack-wrapped" "\$@"
+    WRAPPER
+
+    chmod +x "$out/bin/slack"
+  '';
+
+  meta = {
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.qyliss ];
+    platforms = lib.platforms.unix;
+  };
+}
diff --git a/pkgs/tools/networking/ssmtp/default.nix b/pkgs/tools/networking/ssmtp/default.nix
index 5f6e955f8e4d..24e96491f9d8 100644
--- a/pkgs/tools/networking/ssmtp/default.nix
+++ b/pkgs/tools/networking/ssmtp/default.nix
@@ -14,7 +14,10 @@ stdenv.mkDerivation {
   # See: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=858781
   patches = [ ./ssmtp_support_AuthPassFile_parameter.patch ];
 
-  configureFlags = "--sysconfdir=/etc ${if tlsSupport then "--enable-ssl" else ""}";
+  configureFlags = [
+    "--sysconfdir=/etc"
+    (stdenv.lib.enableFeature tlsSupport "ssl")
+  ];
 
   postConfigure =
     ''
diff --git a/pkgs/tools/networking/trickle/default.nix b/pkgs/tools/networking/trickle/default.nix
index f6c88bb66b7c..7a4adc14c2df 100644
--- a/pkgs/tools/networking/trickle/default.nix
+++ b/pkgs/tools/networking/trickle/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
 
   LDFLAGS = "-levent";
 
-  configureFlags = "--with-libevent";
+  configureFlags = [ "--with-libevent" ];
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/tools/networking/vtun/default.nix b/pkgs/tools/networking/vtun/default.nix
index fb0ee64cc2c0..d2cbb5d8a4ee 100644
--- a/pkgs/tools/networking/vtun/default.nix
+++ b/pkgs/tools/networking/vtun/default.nix
@@ -20,10 +20,11 @@ stdenv.mkDerivation rec {
   '';
   buildInputs = [ lzo openssl zlib yacc flex ];
 
-  configureFlags = ''
-    --with-lzo-headers=${lzo}/include/lzo
-    --with-ssl-headers=${openssl.dev}/include/openssl
-    --with-blowfish-headers=${openssl.dev}/include/openssl'';
+  configureFlags = [
+    "--with-lzo-headers=${lzo}/include/lzo"
+    "--with-ssl-headers=${openssl.dev}/include/openssl"
+    "--with-blowfish-headers=${openssl.dev}/include/openssl"
+  ];
 
   meta = with stdenv.lib; {
       description = "Virtual Tunnels over TCP/IP with traffic shaping, compression and encryption";
diff --git a/pkgs/tools/networking/webalizer/default.nix b/pkgs/tools/networking/webalizer/default.nix
index 5d31d35bd634..67a95f32b619 100644
--- a/pkgs/tools/networking/webalizer/default.nix
+++ b/pkgs/tools/networking/webalizer/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchurl, zlib, libpng, gd, geoip, db}:
+{ stdenv, fetchurl, zlib, libpng, gd, geoip, db }:
 
 stdenv.mkDerivation {
   name = "webalizer-2.23-05";
@@ -16,7 +16,12 @@ stdenv.mkDerivation {
 
   buildInputs = [zlib libpng gd geoip db]; 
 
-  configureFlags = "--enable-dns --enable-geoip --disable-static --enable-shared";
+  configureFlags = [
+    "--enable-dns"
+    "--enable-geoip"
+    "--disable-static"
+    "--enable-shared"
+  ];
 
   meta = {
     platforms = stdenv.lib.platforms.unix;
diff --git a/pkgs/tools/networking/wget/default.nix b/pkgs/tools/networking/wget/default.nix
index 5c1636ddb862..0bd99c635961 100644
--- a/pkgs/tools/networking/wget/default.nix
+++ b/pkgs/tools/networking/wget/default.nix
@@ -34,8 +34,9 @@ stdenv.mkDerivation rec {
     ++ stdenv.lib.optional (libpsl != null) libpsl
     ++ stdenv.lib.optional stdenv.isDarwin perl;
 
-  configureFlags =
-    if openssl != null then "--with-ssl=openssl" else "--without-ssl";
+  configureFlags = [
+    (stdenv.lib.withFeatureAs (openssl != null) "ssl" "openssl")
+  ];
 
   doCheck = false;
 
diff --git a/pkgs/tools/networking/wireguard-tools/default.nix b/pkgs/tools/networking/wireguard-tools/default.nix
index d2b124bf1a18..96e2a094ac0a 100644
--- a/pkgs/tools/networking/wireguard-tools/default.nix
+++ b/pkgs/tools/networking/wireguard-tools/default.nix
@@ -4,11 +4,11 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   name = "wireguard-tools-${version}";
-  version = "0.0.20180802";
+  version = "0.0.20180809";
 
   src = fetchzip {
     url = "https://git.zx2c4.com/WireGuard/snapshot/WireGuard-${version}.tar.xz";
-    sha256 = "1bz9hk3h57r160hxzwa942xkczhgrpwni9sr7gswrkfv3n0as3fa";
+    sha256 = "07sbaignf8l4lndfxypgacaf2qmgyfkv1j5z7kn0cw5mgfsphmkx";
   };
 
   sourceRoot = "source/src/tools";
diff --git a/pkgs/tools/package-management/nix-review/default.nix b/pkgs/tools/package-management/nix-review/default.nix
index d27fe50ab581..70fd3f3369a1 100644
--- a/pkgs/tools/package-management/nix-review/default.nix
+++ b/pkgs/tools/package-management/nix-review/default.nix
@@ -3,27 +3,23 @@
 , fetchFromGitHub
 , nix
 , git
-, makeWrapper
+, lib
 }:
 
 python3.pkgs.buildPythonApplication rec {
   pname = "nix-review";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "Mic92";
     repo = "nix-review";
     rev = version;
-    sha256 = "0lfwikcxnjjb10ssawkfgq7k8i86lsdcn0c0plwi9hgpxl2b52mp";
+    sha256 = "0ncifmp90870v6r651p92wbvpayfblm5k9nxikryjaj1fnvd2np3";
   };
 
-  buildInputs = [ makeWrapper ];
-
-  preFixup = ''
-    wrapProgram $out/bin/nix-review --prefix PATH : ${stdenv.lib.makeBinPath [
-      git nix
-    ]}
-  '';
+  makeWrapperArgs = [
+    "--prefix" "PATH" ":" "${lib.makeBinPath [ nix git ]}"
+  ];
 
   meta = with stdenv.lib; {
     description = "Review pull-requests on https://github.com/NixOS/nixpkgs";
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index 2302476eb918..56bfdb046a8c 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -132,7 +132,7 @@ in rec {
       url = "http://nixos.org/releases/nix/${name}/${name}.tar.xz";
       sha256 = "0ca5782fc37d62238d13a620a7b4bff6a200bab1bd63003709249a776162357c";
     };
-  }) // { perl-bindings = nixStable; };
+  }) // { perl-bindings = nix1; };
 
   nixStable = (common rec {
     name = "nix-2.0.4";
diff --git a/pkgs/tools/security/aws-iam-authenticator/default.nix b/pkgs/tools/security/aws-iam-authenticator/default.nix
new file mode 100644
index 000000000000..39c0c02890bd
--- /dev/null
+++ b/pkgs/tools/security/aws-iam-authenticator/default.nix
@@ -0,0 +1,27 @@
+# This file was generated by https://github.com/kamilchm/go2nix v1.2.1
+{ stdenv, buildGoPackage, fetchgit }:
+
+buildGoPackage rec {
+  name = "aws-iam-authenticator-${version}";
+  # This is meant to be a stable release, but since the rename from
+  # heptio, there has been no release. Please pin this to an actual
+  # release once that happens.
+  version = "2018-07-29";
+  rev = "01dd27d77ec1e2ec640a010970f00b2f8074b0b5";
+
+  goPackagePath = "github.com/kubernetes-sigs/aws-iam-authenticator";
+
+  src = fetchgit {
+    inherit rev;
+    url = "https://github.com/kubernetes-sigs/aws-iam-authenticator";
+    sha256 = "1n7khd2qvl527x3ac6f89smf12za92g08d9v2j393i7n9l1rgw38";
+  };
+
+  meta = {
+    homepage = "https://github.com/kubernetes-sigs/aws-iam-authenticator";
+    description = "AWS IAM credentials for Kubernetes authentication";
+    license = stdenv.lib.licenses.asl20;
+    platforms = stdenv.lib.platforms.all;
+    maintainers = [ stdenv.lib.maintainers.srhb ];
+  };
+}
diff --git a/pkgs/tools/security/cfssl/default.nix b/pkgs/tools/security/cfssl/default.nix
index cce3370aeda1..2391ea1b859b 100644
--- a/pkgs/tools/security/cfssl/default.nix
+++ b/pkgs/tools/security/cfssl/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoPackage, fetchFromGitHub }:
+{ stdenv, buildGoPackage, fetchFromGitHub, fetchpatch }:
 
 buildGoPackage rec {
   name = "cfssl-${version}";
@@ -13,6 +13,17 @@ buildGoPackage rec {
     sha256 = "0j2gz2vl2pf7ir7sc7jrwmjnr67hk4qhxw09cjx132jbk337jc9x";
   };
 
+  # The following patch ensures that the auth-key decoder doesn't break,
+  # if the auth-key file contains leading or trailing whitespaces.
+  # https://github.com/cloudflare/cfssl/pull/923 is merged
+  # remove patch when it becomes part of a release.
+  patches = [
+    (fetchpatch {
+      url    = "https://github.com/cloudflare/cfssl/commit/7e13f60773c96644db9dd8d342d42fe3a4d26f36.patch";
+      sha256 = "1z2v2i8yj7qpj8zj5f2q739nhrr9s59jwzfzk52wfgssl4vv5mn5";
+    })
+  ];
+
   meta = with stdenv.lib; {
     homepage = https://cfssl.org/;
     description = "Cloudflare's PKI and TLS toolkit";
diff --git a/pkgs/tools/security/fwknop/default.nix b/pkgs/tools/security/fwknop/default.nix
index 3a4bdcd529ef..812c032230c1 100644
--- a/pkgs/tools/security/fwknop/default.nix
+++ b/pkgs/tools/security/fwknop/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, autoreconfHook, lib
+{ stdenv, fetchFromGitHub, autoreconfHook
 , libpcap, texinfo
 , iptables
 , gnupgSupport ? true, gnupg, gpgme # Increases dependencies!
@@ -23,21 +23,18 @@ stdenv.mkDerivation rec {
     ++ stdenv.lib.optional gnupgSupport [ gnupg gpgme.dev ]
     ++ stdenv.lib.optional wgetSupport [ wget ];
 
-  configureFlags = ''
-    --sysconfdir=/etc
-    --localstatedir=/run
-    --with-iptables=${iptables}/sbin/iptables
-    ${lib.optionalString (!buildServer) "--disable-server"}
-    ${lib.optionalString (!buildClient) "--disable-client"}
-    ${lib.optionalString gnupgSupport ''
-      --with-gpgme
-      --with-gpgme-prefix=${gpgme.dev}
-      --with-gpg=${gnupg}
-    ''}
-    ${lib.optionalString wgetSupport ''
-      --with-wget=${wget}/bin/wget
-    ''}
-  '';
+  configureFlags = [
+    "--sysconfdir=/etc"
+    "--localstatedir=/run"
+    "--with-iptables=${iptables}/sbin/iptables"
+    (stdenv.lib.enableFeature buildServer "server")
+    (stdenv.lib.enableFeature buildClient "client")
+    (stdenv.lib.withFeatureAs wgetSupport "wget" "${wget}/bin/wget")
+  ] ++ stdenv.lib.optionalString gnupgSupport [
+    "--with-gpgme"
+    "--with-gpgme-prefix=${gpgme.dev}"
+    "--with-gpg=${gnupg}"
+  ];
 
   # Temporary hack to copy the example configuration files into the nix-store,
   # this'll probably be helpful until there's a NixOS module for that (feel free
diff --git a/pkgs/tools/security/gnupg/22.nix b/pkgs/tools/security/gnupg/22.nix
index fd773da4adea..ded07cb5dad3 100644
--- a/pkgs/tools/security/gnupg/22.nix
+++ b/pkgs/tools/security/gnupg/22.nix
@@ -15,11 +15,11 @@ assert guiSupport -> pinentry != null;
 stdenv.mkDerivation rec {
   name = "gnupg-${version}";
 
-  version = "2.2.8";
+  version = "2.2.9";
 
   src = fetchurl {
     url = "mirror://gnupg/gnupg/${name}.tar.bz2";
-    sha256 = "1k8dnnfs9888yp713l7kg2jg110lw47s4krx0njna6fjrsw4qyvp";
+    sha256 = "0r11mx8nkh7ysrnshs560amha5csx8zcaggb5kxcksx1zymyly32";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/tools/security/modsecurity/default.nix b/pkgs/tools/security/modsecurity/default.nix
index 2c02a5dd4736..09f8c63973c7 100644
--- a/pkgs/tools/security/modsecurity/default.nix
+++ b/pkgs/tools/security/modsecurity/default.nix
@@ -22,17 +22,17 @@ stdenv.mkDerivation rec {
   buildInputs = [  curl apacheHttpd pcre apr aprutil libxml2 ] ++
     optional luaSupport lua5;
 
-  configureFlags = ''
-    --enable-standalone-module
-    --enable-static
-    --with-curl=${curl.dev}
-    --with-apxs=${apacheHttpd.dev}/bin/apxs
-    --with-pcre=${pcre.dev}
-    --with-apr=${apr.dev}
-    --with-apu=${aprutil.dev}/bin/apu-1-config
-    --with-libxml=${libxml2.dev}
-    --with-lua=${luaValue}
-  '';
+  configureFlags = [
+    "--enable-standalone-module"
+    "--enable-static"
+    "--with-curl=${curl.dev}"
+    "--with-apxs=${apacheHttpd.dev}/bin/apxs"
+    "--with-pcre=${pcre.dev}"
+    "--with-apr=${apr.dev}"
+    "--with-apu=${aprutil.dev}/bin/apu-1-config"
+    "--with-libxml=${libxml2.dev}"
+    "--with-lua=${luaValue}"
+  ];
 
   outputs = ["out" "nginx"];
   # by default modsecurity's install script copies compiled output to httpd's modules folder
diff --git a/pkgs/tools/security/spectre-meltdown-checker/default.nix b/pkgs/tools/security/spectre-meltdown-checker/default.nix
index 4d90289f3f35..c406316940e4 100644
--- a/pkgs/tools/security/spectre-meltdown-checker/default.nix
+++ b/pkgs/tools/security/spectre-meltdown-checker/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "spectre-meltdown-checker-${version}";
-  version = "0.38";
+  version = "0.39";
 
   src = fetchFromGitHub {
     owner = "speed47";
     repo = "spectre-meltdown-checker";
     rev = "v${version}";
-    sha256 = "151w68i0bhryij79s9xny8wh2256zayc5gyrj0s5nwnhl9yxz0f1";
+    sha256 = "1llp6iyvbykn9w7vnz1jklmy6gmbksk234b46mzjfvg7mvg91dc5";
   };
 
   prePatch = ''
@@ -19,16 +19,20 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ makeWrapper ];
 
   installPhase = with stdenv.lib; ''
-    install -D spectre-meltdown-checker.sh $out/bin/spectre-meltdown-checker
+    runHook preInstall
+
+    install -Dm755 spectre-meltdown-checker.sh $out/bin/spectre-meltdown-checker
     wrapProgram $out/bin/spectre-meltdown-checker \
       --prefix PATH : ${makeBinPath [ binutils-unwrapped ]}
+
+    runHook postInstall
   '';
 
   meta = with stdenv.lib; {
     description = "Spectre & Meltdown vulnerability/mitigation checker for Linux";
     homepage = https://github.com/speed47/spectre-meltdown-checker;
     license = licenses.gpl3;
-    platforms = platforms.linux;
     maintainers = with maintainers; [ dotlambda ];
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/tools/security/ssdeep/default.nix b/pkgs/tools/security/ssdeep/default.nix
index 50b16ad58399..1ff9c73d8b58 100644
--- a/pkgs/tools/security/ssdeep/default.nix
+++ b/pkgs/tools/security/ssdeep/default.nix
@@ -1,24 +1,21 @@
-{ stdenv, fetchurl }:
+{ stdenv, fetchFromGitHub, autoreconfHook }:
 
 stdenv.mkDerivation rec {
   name    = "ssdeep-${version}";
-  version = "2.13";
+  version = "2.14.1";
 
-  src = fetchurl {
-    url    = "mirror://sourceforge/ssdeep/${name}.tar.gz";
-    sha256 = "1igqy0j7jrklb8fdlrm6ald4cyl1fda5ipfl8crzyl6bax2ajk3f";
+  src = fetchFromGitHub {
+    owner = "ssdeep-project";
+    repo = "ssdeep";
+    rev = "release-${version}";
+    sha256 = "1yx6yjkggshw5yl89m4kvyzarjdg2l3hs0bbjbrfzwp1lkfd8i0c";
   };
 
+  nativeBuildInputs = [ autoreconfHook ];
+
   # Hack to avoid TMPDIR in RPATHs.
   preFixup = ''rm -rf "$(pwd)" '';
 
-  # For some reason (probably a build system bug), the binary isn't
-  # properly linked to $out/lib to find libfuzzy.so
-  postFixup = stdenv.lib.optionalString (!stdenv.isDarwin) ''
-    rp=$(patchelf --print-rpath $out/bin/ssdeep)
-    patchelf --set-rpath $rp:$out/lib $out/bin/ssdeep
-  '';
-
   meta = {
     description = "A program for calculating fuzzy hashes";
     homepage    = "http://www.ssdeep.sf.net";
diff --git a/pkgs/tools/security/super/default.nix b/pkgs/tools/security/super/default.nix
index 688521e1401a..2b4173a51af1 100644
--- a/pkgs/tools/security/super/default.nix
+++ b/pkgs/tools/security/super/default.nix
@@ -24,7 +24,10 @@ stdenv.mkDerivation rec {
 
   NIX_CFLAGS_COMPILE = "-D_GNU_SOURCE";
 
-  configureFlags = "--sysconfdir=/etc --localstatedir=/var";
+  configureFlags = [
+    "--sysconfdir=/etc"
+    "--localstatedir=/var"
+  ];
 
   installFlags = "sysconfdir=$(out)/etc localstatedir=$(TMPDIR)";
 
diff --git a/pkgs/tools/security/yara/default.nix b/pkgs/tools/security/yara/default.nix
index 166f20dd7d6d..e273b2c19091 100644
--- a/pkgs/tools/security/yara/default.nix
+++ b/pkgs/tools/security/yara/default.nix
@@ -41,11 +41,11 @@ stdenv.mkDerivation rec {
 
   preConfigure = "./bootstrap.sh";
 
-  configureFlags = ""
-    + stdenv.lib.optionalString withCrypto "--with-crypto "
-    + stdenv.lib.optionalString enableMagic "--enable-magic "
-    + stdenv.lib.optionalString enableCuckoo "--enable-cuckoo "
-  ;
+  configureFlags = [
+    (stdenv.lib.withFeature withCrypto "crypto")
+    (stdenv.lib.enableFeature enableMagic "magic")
+    (stdenv.lib.enableFeature enableCuckoo "cuckoo")
+  ];
 
   meta = with stdenv.lib; {
     description = "The pattern matching swiss knife for malware researchers";
diff --git a/pkgs/tools/system/cron/default.nix b/pkgs/tools/system/cron/default.nix
index d6347798053b..374f0ac19d89 100644
--- a/pkgs/tools/system/cron/default.nix
+++ b/pkgs/tools/system/cron/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
   hardeningEnable = [ "pie" ];
 
   preBuild = ''
-    # do not set sticky bit in /nix/store 
+    # do not set sticky bit in /nix/store
     substituteInPlace Makefile --replace ' -o root' ' ' --replace 111 755 --replace 4755 0755
     # do not strip during install, broken on cross and we'll do ourselves as needed
     substituteInPlace Makefile --replace ' -s cron' ' cron'
@@ -36,8 +36,9 @@ stdenv.mkDerivation {
 
   preInstall = "mkdir -p $out/bin $out/sbin $out/share/man/man1 $out/share/man/man5 $out/share/man/man8";
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "Daemon for running commands at specific times (Vixie Cron)";
-    platforms = with stdenv.lib.platforms; linux ++ darwin;
+    license = licenses.bsd0;
+    platforms = with platforms; linux ++ darwin;
   };
 }
diff --git a/pkgs/tools/system/monit/default.nix b/pkgs/tools/system/monit/default.nix
index 17e472b8d2be..362545285ede 100644
--- a/pkgs/tools/system/monit/default.nix
+++ b/pkgs/tools/system/monit/default.nix
@@ -1,7 +1,10 @@
-{stdenv, fetchurl, openssl, bison, flex, pam, zlib, usePAM ? stdenv.isLinux
- , buildPlatform, hostPlatform }:
-let useSSL = (openssl != null);
-    isCross = ( buildPlatform != hostPlatform ) ; in
+{ stdenv
+, fetchurl, bison, flex
+, zlib
+, usePAM ? stdenv.hostPlatform.isLinux, pam
+, useSSL ? true, openssl
+}:
+
 stdenv.mkDerivation rec {
   name = "monit-5.25.2";
 
@@ -15,15 +18,18 @@ stdenv.mkDerivation rec {
     stdenv.lib.optionals useSSL [ openssl ] ++
     stdenv.lib.optionals usePAM [ pam ];
 
-  configureFlags =
-    if useSSL then [
+  configureFlags = [
+    (stdenv.lib.withFeature usePAM "pam")
+  ] ++ (if useSSL then [
       "--with-ssl-incl-dir=${openssl.dev}/include"
       "--with-ssl-lib-dir=${openssl.out}/lib"
-    ] else [ "--without-ssl" ] ++
-    stdenv.lib.optionals (! usePAM) [ "--without-pam" ] ++
+    ] else [
+      "--without-ssl"
+  ]) ++ stdenv.lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     # will need to check both these are true for musl
-    stdenv.lib.optionals isCross [ "libmonit_cv_setjmp_available=yes"
-                                   "libmonit_cv_vsnprintf_c99_conformant=yes"];
+    "libmonit_cv_setjmp_available=yes"
+    "libmonit_cv_vsnprintf_c99_conformant=yes"
+  ];
 
   meta = {
     homepage = http://mmonit.com/monit/;
diff --git a/pkgs/tools/system/rofi-systemd/default.nix b/pkgs/tools/system/rofi-systemd/default.nix
new file mode 100644
index 000000000000..ee7626d27126
--- /dev/null
+++ b/pkgs/tools/system/rofi-systemd/default.nix
@@ -0,0 +1,45 @@
+{ stdenv, fetchFromGitHub, rofi, systemd, coreutils, utillinux, gawk, makeWrapper
+}:
+
+stdenv.mkDerivation rec {
+  name = "rofi-systemd-${version}";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "IvanMalison";
+    repo = "rofi-systemd";
+    rev = "v${version}";
+    sha256 = "1dbygq3qaj1f73hh3njdnmibq7vi6zbyzdc6c0j989c0r1ksv0zi";
+  };
+
+  buildInputs = [ makeWrapper ];
+
+  dontBuild = true;
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp -a rofi-systemd $out/bin/rofi-systemd
+  '';
+
+  wrapperPath = with stdenv.lib; makeBinPath [
+    rofi
+    coreutils
+    utillinux
+    gawk
+    systemd
+  ];
+
+  fixupPhase = ''
+    patchShebangs $out/bin
+
+    wrapProgram $out/bin/rofi-systemd --prefix PATH : "${wrapperPath}"
+  '';
+
+  meta = {
+    description = "Control your systemd units using rofi";
+    homepage = https://github.com/IvanMalison/rofi-systemd;
+    maintainers = with stdenv.lib.maintainers; [ imalison ];
+    license = stdenv.lib.licenses.gpl3;
+    platforms = with stdenv.lib.platforms; linux;
+  };
+}
diff --git a/pkgs/tools/system/sleuthkit/default.nix b/pkgs/tools/system/sleuthkit/default.nix
index ad16746a2666..7e781223b572 100644
--- a/pkgs/tools/system/sleuthkit/default.nix
+++ b/pkgs/tools/system/sleuthkit/default.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchFromGitHub, autoreconfHook, libewf, afflib, openssl, zlib }:
 
 stdenv.mkDerivation rec {
-  version = "4.6.1";
+  version = "4.6.2";
   name = "sleuthkit-${version}";
 
   src = fetchFromGitHub {
     owner = "sleuthkit";
     repo = "sleuthkit";
     rev = name;
-    sha256 = "1hf783mwa5ws9qvjpj6zgvivi0cfhs8r8m1869ajz5m80lv8fggw";
+    sha256 = "1ykl6ijf15mjfvmkk9b4gj18kspdairn7ms4wsi2v9kb25776skx";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/text/catdoc/default.nix b/pkgs/tools/text/catdoc/default.nix
index 2a06b25b11da..8a8eb3117f03 100644
--- a/pkgs/tools/text/catdoc/default.nix
+++ b/pkgs/tools/text/catdoc/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  configureFlags = "--disable-wordview";
+  configureFlags = [ "--disable-wordview" ];
 
   meta = with stdenv.lib; {
     description = "MS-Word/Excel/PowerPoint to text converter";
diff --git a/pkgs/tools/text/diffstat/default.nix b/pkgs/tools/text/diffstat/default.nix
index d106d140a67e..1490f0900b9d 100644
--- a/pkgs/tools/text/diffstat/default.nix
+++ b/pkgs/tools/text/diffstat/default.nix
@@ -1,14 +1,14 @@
 { fetchurl, stdenv }:
 
 stdenv.mkDerivation rec {
-  name = "diffstat-1.61";
+  name = "diffstat-1.62";
 
   src = fetchurl {
     urls = [
       "ftp://ftp.invisible-island.net/diffstat/${name}.tgz"
       "https://invisible-mirror.net/archives/diffstat/${name}.tgz"
     ];
-    sha256 = "1vjmda2zfjxg0qkaj8hfqa8g6bfwnn1ja8696rxrjgqq4w69wd95";
+    sha256 = "07sr482y6iw7n7ddkba0w51kbjc99snvnijkn5ba2xzd8hv1h2bz";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/text/diffutils/default.nix b/pkgs/tools/text/diffutils/default.nix
index 60628e2139ce..fff81fbc860a 100644
--- a/pkgs/tools/text/diffutils/default.nix
+++ b/pkgs/tools/text/diffutils/default.nix
@@ -20,9 +20,10 @@ stdenv.mkDerivation rec {
     stdenv.lib.optional (coreutils != null) "PR_PROGRAM=${coreutils}/bin/pr"
     ++ stdenv.lib.optional (stdenv.buildPlatform != stdenv.hostPlatform) "gl_cv_func_getopt_gnu=yes";
 
-  meta = {
+  meta = with stdenv.lib; {
     homepage = http://www.gnu.org/software/diffutils/diffutils.html;
     description = "Commands for showing the differences between files (diff, cmp, etc.)";
-    platforms = stdenv.lib.platforms.unix;
+    license = licenses.gpl3;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/tools/text/gnupatch/default.nix b/pkgs/tools/text/gnupatch/default.nix
index c83eab2e2ef6..0ad2a18236f6 100644
--- a/pkgs/tools/text/gnupatch/default.nix
+++ b/pkgs/tools/text/gnupatch/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl
-, ed
+, ed, autoreconfHook
 , buildPlatform, hostPlatform
 }:
 
@@ -14,9 +14,18 @@ stdenv.mkDerivation rec {
   patches = [
     # https://git.savannah.gnu.org/cgit/patch.git/patch/?id=f290f48a621867084884bfff87f8093c15195e6a
     ./CVE-2018-6951.patch
+    (fetchurl {
+      url = https://sources.debian.org/data/main/p/patch/2.7.6-2/debian/patches/Allow_input_files_to_be_missing_for_ed-style_patches.patch;
+      sha256 = "0iw0lk0yhnhvfjzal48ij6zdr92mgb84jq7fwryy1hdhi47hhq64";
+    })
+    (fetchurl { # CVE-2018-1000156
+      url = https://sources.debian.org/data/main/p/patch/2.7.6-2/debian/patches/Fix_arbitrary_command_execution_in_ed-style_patches.patch;
+      sha256 = "1bpy16n3hm5nv9xkrn6c4wglzsdzj3ss1biq16w9kfv48p4hx2vg";
+    })
   ];
 
   buildInputs = stdenv.lib.optional doCheck ed;
+  nativeBuildInputs = [ autoreconfHook ];
 
   configureFlags = stdenv.lib.optionals (hostPlatform != buildPlatform) [
     "ac_cv_func_strnlen_working=yes"
diff --git a/pkgs/tools/text/icdiff/default.nix b/pkgs/tools/text/icdiff/default.nix
index 85888dbbf0df..949a9c89e9af 100644
--- a/pkgs/tools/text/icdiff/default.nix
+++ b/pkgs/tools/text/icdiff/default.nix
@@ -2,13 +2,13 @@
 
 pythonPackages.buildPythonApplication rec {
   name = "icdiff-${version}";
-  version = "1.9.1";
+  version = "1.9.3";
 
   src = fetchFromGitHub {
     owner = "jeffkaufman";
     repo = "icdiff";
     rev = "release-${version}";
-    sha256 = "0ffn5kq7dwvrimxgpj9ksym36c18md8nsdps82qzhm1xq7p9w9yb";
+    sha256 = "10hv09sg7m8gzjf1v785kvim9ps81akzyx7ws6ypylyxc0l2fdcl";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/typesetting/xmlroff/default.nix b/pkgs/tools/typesetting/xmlroff/default.nix
index f8b0ddbfac56..523a34c0b569 100644
--- a/pkgs/tools/typesetting/xmlroff/default.nix
+++ b/pkgs/tools/typesetting/xmlroff/default.nix
@@ -26,7 +26,10 @@ stdenv.mkDerivation rec {
 
   configureScript = "./autogen.sh";
 
-  configureFlags = "--disable-pangoxsl --disable-gp";
+  configureFlags = [
+    "--disable-pangoxsl"
+    "--disable-gp"
+  ];
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/tools/virtualization/cri-tools/default.nix b/pkgs/tools/virtualization/cri-tools/default.nix
index 120727f3873d..f57befce3081 100644
--- a/pkgs/tools/virtualization/cri-tools/default.nix
+++ b/pkgs/tools/virtualization/cri-tools/default.nix
@@ -1,4 +1,4 @@
-{ buildGoPackage, fetchurl }:
+{ buildGoPackage, fetchurl, lib }:
 
 buildGoPackage
   { name = "cri-tools-1.0.0-alpha.0";
@@ -10,6 +10,10 @@ buildGoPackage
     goPackagePath = "github.com/kubernetes-incubator/cri-tools";
     subPackages = [ "cmd/crictl" "cmd/critest" ];
 
+    meta = {
+      license = lib.licenses.asl20;
+    };
+
     goDeps = ./deps.nix;
   }