summary refs log tree commit diff
path: root/pkgs/tools
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs/tools')
-rw-r--r--pkgs/tools/X11/dragon-drop/default.nix3
-rw-r--r--pkgs/tools/X11/hsetroot/default.nix3
-rw-r--r--pkgs/tools/X11/keynav/default.nix3
-rw-r--r--pkgs/tools/X11/ksuperkey/default.nix3
-rw-r--r--pkgs/tools/X11/obconf/default.nix3
-rw-r--r--pkgs/tools/X11/vdpauinfo/default.nix3
-rw-r--r--pkgs/tools/X11/wmctrl/default.nix3
-rw-r--r--pkgs/tools/X11/xbindkeys-config/default.nix3
-rw-r--r--pkgs/tools/X11/xinput_calibrator/default.nix3
-rw-r--r--pkgs/tools/X11/xpra/default.nix3
-rw-r--r--pkgs/tools/X11/xpra/gtk3.nix3
-rw-r--r--pkgs/tools/X11/xrestop/default.nix3
-rw-r--r--pkgs/tools/X11/xsettingsd/default.nix3
-rw-r--r--pkgs/tools/X11/xtrace/default.nix3
-rw-r--r--pkgs/tools/X11/xwinmosaic/default.nix14
-rw-r--r--pkgs/tools/admin/gtk-vnc/default.nix6
-rw-r--r--pkgs/tools/archivers/cromfs/default.nix3
-rw-r--r--pkgs/tools/archivers/runzip/default.nix3
-rw-r--r--pkgs/tools/archivers/xarchive/default.nix3
-rw-r--r--pkgs/tools/archivers/xarchiver/default.nix3
-rw-r--r--pkgs/tools/audio/acoustid-fingerprinter/default.nix3
-rw-r--r--pkgs/tools/audio/gvolicon/default.nix3
-rw-r--r--pkgs/tools/audio/mpdris2/default.nix3
-rw-r--r--pkgs/tools/audio/pa-applet/default.nix3
-rw-r--r--pkgs/tools/audio/pasystray/default.nix3
-rw-r--r--pkgs/tools/audio/playerctl/default.nix3
-rw-r--r--pkgs/tools/audio/volumeicon/default.nix3
-rw-r--r--pkgs/tools/backup/attic/default.nix3
-rw-r--r--pkgs/tools/backup/btrbk/default.nix4
-rw-r--r--pkgs/tools/backup/partimage/default.nix3
-rw-r--r--pkgs/tools/bluetooth/obex-data-server/default.nix3
-rw-r--r--pkgs/tools/cd-dvd/cdrdao/default.nix3
-rw-r--r--pkgs/tools/cd-dvd/vobsub2srt/default.nix3
-rw-r--r--pkgs/tools/compression/pixz/default.nix3
-rw-r--r--pkgs/tools/filesystems/archivemount/default.nix3
-rw-r--r--pkgs/tools/filesystems/bcache-tools/default.nix3
-rw-r--r--pkgs/tools/filesystems/bcachefs-tools/default.nix3
-rw-r--r--pkgs/tools/filesystems/bindfs/default.nix3
-rw-r--r--pkgs/tools/filesystems/btrfs-progs/4.4.1.nix31
-rw-r--r--pkgs/tools/filesystems/btrfs-progs/default.nix7
-rw-r--r--pkgs/tools/filesystems/ciopfs/default.nix3
-rw-r--r--pkgs/tools/filesystems/curlftpfs/default.nix3
-rw-r--r--pkgs/tools/filesystems/djmount/default.nix3
-rw-r--r--pkgs/tools/filesystems/duperemove/default.nix3
-rw-r--r--pkgs/tools/filesystems/fuse-7z-ng/default.nix3
-rw-r--r--pkgs/tools/filesystems/fuseiso/default.nix3
-rw-r--r--pkgs/tools/filesystems/genimage/default.nix3
-rw-r--r--pkgs/tools/filesystems/gocrypfs/default.nix3
-rw-r--r--pkgs/tools/filesystems/hubicfuse/default.nix3
-rw-r--r--pkgs/tools/filesystems/jmtpfs/default.nix3
-rw-r--r--pkgs/tools/filesystems/mhddfs/default.nix3
-rw-r--r--pkgs/tools/filesystems/mtpfs/default.nix3
-rw-r--r--pkgs/tools/filesystems/netatalk/default.nix3
-rw-r--r--pkgs/tools/filesystems/nixpart/0.4/cryptsetup.nix3
-rw-r--r--pkgs/tools/filesystems/nixpart/0.4/lvm2.nix3
-rw-r--r--pkgs/tools/filesystems/nixpart/0.4/pyparted.nix2
-rw-r--r--pkgs/tools/filesystems/relfs/default.nix3
-rw-r--r--pkgs/tools/filesystems/smbnetfs/default.nix3
-rw-r--r--pkgs/tools/filesystems/snapraid/default.nix3
-rw-r--r--pkgs/tools/filesystems/u3-tool/default.nix22
-rw-r--r--pkgs/tools/filesystems/wdfs/default.nix3
-rw-r--r--pkgs/tools/filesystems/zkfuse/default.nix3
-rw-r--r--pkgs/tools/graphics/dmtx-utils/default.nix5
-rw-r--r--pkgs/tools/graphics/editres/default.nix3
-rw-r--r--pkgs/tools/graphics/exif/default.nix3
-rw-r--r--pkgs/tools/graphics/ggobi/default.nix3
-rw-r--r--pkgs/tools/graphics/glmark2/default.nix3
-rw-r--r--pkgs/tools/graphics/gromit-mpx/default.nix3
-rw-r--r--pkgs/tools/graphics/leela/default.nix3
-rw-r--r--pkgs/tools/graphics/logstalgia/default.nix3
-rw-r--r--pkgs/tools/graphics/pdf2svg/default.nix3
-rw-r--r--pkgs/tools/graphics/pngnq/default.nix3
-rw-r--r--pkgs/tools/graphics/pngquant/default.nix3
-rw-r--r--pkgs/tools/graphics/quirc/default.nix3
-rw-r--r--pkgs/tools/graphics/unpaper/default.nix3
-rw-r--r--pkgs/tools/inputmethods/fcitx-engines/fcitx-anthy/default.nix3
-rw-r--r--pkgs/tools/inputmethods/fcitx-engines/fcitx-chewing/default.nix3
-rw-r--r--pkgs/tools/inputmethods/fcitx-engines/fcitx-cloudpinyin/default.nix3
-rw-r--r--pkgs/tools/inputmethods/fcitx-engines/fcitx-hangul/default.nix3
-rw-r--r--pkgs/tools/inputmethods/fcitx-engines/fcitx-libpinyin/default.nix3
-rw-r--r--pkgs/tools/inputmethods/fcitx-engines/fcitx-m17n/default.nix3
-rw-r--r--pkgs/tools/inputmethods/fcitx-engines/fcitx-unikey/default.nix3
-rw-r--r--pkgs/tools/inputmethods/fcitx/fcitx-configtool.nix3
-rw-r--r--pkgs/tools/inputmethods/ibus-engines/ibus-table-others/default.nix3
-rw-r--r--pkgs/tools/inputmethods/ibus/ibus-qt.nix3
-rw-r--r--pkgs/tools/inputmethods/nabi/default.nix3
-rw-r--r--pkgs/tools/misc/appdata-tools/default.nix3
-rw-r--r--pkgs/tools/misc/blink1-tool/default.nix3
-rw-r--r--pkgs/tools/misc/brltty/default.nix3
-rw-r--r--pkgs/tools/misc/colord-gtk/default.nix3
-rw-r--r--pkgs/tools/misc/colord/default.nix5
-rw-r--r--pkgs/tools/misc/cunit/default.nix3
-rw-r--r--pkgs/tools/misc/dbus-map/default.nix3
-rw-r--r--pkgs/tools/misc/desktop-file-utils/default.nix3
-rw-r--r--pkgs/tools/misc/duc/default.nix3
-rw-r--r--pkgs/tools/misc/eot-utilities/default.nix2
-rw-r--r--pkgs/tools/misc/fontforge/default.nix3
-rw-r--r--pkgs/tools/misc/gbdfed/default.nix3
-rw-r--r--pkgs/tools/misc/goaccess/default.nix2
-rw-r--r--pkgs/tools/misc/grub/default.nix3
-rw-r--r--pkgs/tools/misc/gsmartcontrol/default.nix3
-rw-r--r--pkgs/tools/misc/kalibrate-rtl/default.nix3
-rw-r--r--pkgs/tools/misc/ldapvi/default.nix3
-rw-r--r--pkgs/tools/misc/libbitcoin/libbitcoin-client.nix3
-rw-r--r--pkgs/tools/misc/libbitcoin/libbitcoin-explorer.nix3
-rw-r--r--pkgs/tools/misc/libbitcoin/libbitcoin.nix3
-rw-r--r--pkgs/tools/misc/lnav/default.nix1
-rw-r--r--pkgs/tools/misc/mc/default.nix3
-rw-r--r--pkgs/tools/misc/mdbtools/default.nix3
-rw-r--r--pkgs/tools/misc/mdbtools/git.nix3
-rw-r--r--pkgs/tools/misc/mprime/default.nix3
-rw-r--r--pkgs/tools/misc/pal/default.nix3
-rw-r--r--pkgs/tools/misc/plantuml/default.nix6
-rw-r--r--pkgs/tools/misc/qjoypad/default.nix3
-rw-r--r--pkgs/tools/misc/riemann-c-client/default.nix3
-rw-r--r--pkgs/tools/misc/rmlint/default.nix3
-rw-r--r--pkgs/tools/misc/rpm-ostree/default.nix3
-rw-r--r--pkgs/tools/misc/toilet/default.nix3
-rw-r--r--pkgs/tools/misc/urjtag/default.nix3
-rw-r--r--pkgs/tools/misc/wv/default.nix3
-rw-r--r--pkgs/tools/misc/wv2/default.nix3
-rw-r--r--pkgs/tools/misc/xsel/default.nix3
-rw-r--r--pkgs/tools/misc/yubico-piv-tool/default.nix3
-rw-r--r--pkgs/tools/networking/aircrack-ng/default.nix3
-rw-r--r--pkgs/tools/networking/argus-clients/default.nix3
-rw-r--r--pkgs/tools/networking/argus/default.nix3
-rw-r--r--pkgs/tools/networking/badvpn/default.nix4
-rw-r--r--pkgs/tools/networking/ccnet/default.nix3
-rw-r--r--pkgs/tools/networking/connmanui/default.nix3
-rw-r--r--pkgs/tools/networking/curl/default.nix8
-rw-r--r--pkgs/tools/networking/davix/default.nix3
-rw-r--r--pkgs/tools/networking/dhcpcd/default.nix3
-rw-r--r--pkgs/tools/networking/driftnet/default.nix3
-rw-r--r--pkgs/tools/networking/gftp/default.nix3
-rw-r--r--pkgs/tools/networking/gupnp-tools/default.nix3
-rw-r--r--pkgs/tools/networking/hyenae/default.nix3
-rw-r--r--pkgs/tools/networking/isync/default.nix3
-rw-r--r--pkgs/tools/networking/jnettop/default.nix3
-rw-r--r--pkgs/tools/networking/libreswan/default.nix4
-rw-r--r--pkgs/tools/networking/maildrop/default.nix3
-rw-r--r--pkgs/tools/networking/mitmproxy/default.nix17
-rw-r--r--pkgs/tools/networking/mosh/default.nix3
-rw-r--r--pkgs/tools/networking/ndjbdns/default.nix3
-rw-r--r--pkgs/tools/networking/nss-pam-ldapd/default.nix3
-rw-r--r--pkgs/tools/networking/openconnect/default.nix2
-rw-r--r--pkgs/tools/networking/openfortivpn/default.nix1
-rw-r--r--pkgs/tools/networking/openssh/default.nix3
-rw-r--r--pkgs/tools/networking/p2p/libtorrent/default.nix3
-rw-r--r--pkgs/tools/networking/p2p/rtorrent/default.nix3
-rw-r--r--pkgs/tools/networking/samplicator/default.nix3
-rw-r--r--pkgs/tools/networking/tlspool/default.nix3
-rw-r--r--pkgs/tools/networking/tracebox/default.nix3
-rw-r--r--pkgs/tools/package-management/apt/default.nix4
-rw-r--r--pkgs/tools/package-management/disnix/default.nix3
-rw-r--r--pkgs/tools/package-management/disnix/disnixos/default.nix3
-rw-r--r--pkgs/tools/package-management/nix-index/default.nix3
-rw-r--r--pkgs/tools/package-management/rpm/default.nix3
-rw-r--r--pkgs/tools/security/aespipe/default.nix4
-rw-r--r--pkgs/tools/security/crackxls/default.nix3
-rw-r--r--pkgs/tools/security/ecryptfs/default.nix3
-rw-r--r--pkgs/tools/security/fpm2/default.nix3
-rw-r--r--pkgs/tools/security/gencfsm/default.nix3
-rw-r--r--pkgs/tools/security/gnupg/22.nix3
-rw-r--r--pkgs/tools/security/mfcuk/default.nix3
-rw-r--r--pkgs/tools/security/mfoc/default.nix3
-rw-r--r--pkgs/tools/security/nmap/default.nix3
-rw-r--r--pkgs/tools/security/opensc/default.nix3
-rw-r--r--pkgs/tools/security/qdigidoc/default.nix3
-rw-r--r--pkgs/tools/security/qesteidutil/default.nix3
-rw-r--r--pkgs/tools/security/sbsigntool/default.nix3
-rw-r--r--pkgs/tools/security/stoken/default.nix4
-rw-r--r--pkgs/tools/security/tpm-luks/default.nix3
-rw-r--r--pkgs/tools/security/trousers/default.nix3
-rw-r--r--pkgs/tools/system/bootchart/default.nix3
-rw-r--r--pkgs/tools/system/chase/default.nix3
-rw-r--r--pkgs/tools/system/collectd/default.nix3
-rw-r--r--pkgs/tools/system/das_watchdog/default.nix3
-rw-r--r--pkgs/tools/system/fakechroot/default.nix3
-rw-r--r--pkgs/tools/system/gdmap/default.nix3
-rw-r--r--pkgs/tools/system/hardinfo/default.nix3
-rw-r--r--pkgs/tools/system/illum/default.nix3
-rw-r--r--pkgs/tools/system/lshw/default.nix6
-rw-r--r--pkgs/tools/system/netdata/default.nix3
-rw-r--r--pkgs/tools/system/pciutils/default.nix3
-rw-r--r--pkgs/tools/system/supervise/default.nix27
-rw-r--r--pkgs/tools/system/thermald/default.nix3
-rw-r--r--pkgs/tools/system/vboot_reference/default.nix3
-rw-r--r--pkgs/tools/system/wsmancli/default.nix3
-rw-r--r--pkgs/tools/text/ebook-tools/default.nix3
-rw-r--r--pkgs/tools/text/qshowdiff/default.nix3
-rw-r--r--pkgs/tools/text/silver-searcher/default.nix3
-rw-r--r--pkgs/tools/text/xml/xml2/default.nix3
-rw-r--r--pkgs/tools/text/xml/xmlstarlet/default.nix3
-rw-r--r--pkgs/tools/typesetting/tex/texlive/bin.nix15
-rw-r--r--pkgs/tools/typesetting/xmlroff/default.nix2
-rw-r--r--pkgs/tools/video/mjpegtools/default.nix3
-rw-r--r--pkgs/tools/video/swfmill/default.nix3
197 files changed, 469 insertions, 249 deletions
diff --git a/pkgs/tools/X11/dragon-drop/default.nix b/pkgs/tools/X11/dragon-drop/default.nix
index 3dfc7abbc77d..232c4a636fb8 100644
--- a/pkgs/tools/X11/dragon-drop/default.nix
+++ b/pkgs/tools/X11/dragon-drop/default.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation rec {
     sha256 = "03vdbmqlbmk3j2ay1wy6snrm2y27faxz7qv81vyzjzngj345095a";
   };
 
-  buildInputs = [ gtk pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ gtk ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/tools/X11/hsetroot/default.nix b/pkgs/tools/X11/hsetroot/default.nix
index 9de29da9b44a..5baf6a4b51f8 100644
--- a/pkgs/tools/X11/hsetroot/default.nix
+++ b/pkgs/tools/X11/hsetroot/default.nix
@@ -17,7 +17,8 @@ stdenv.mkDerivation rec {
     sha256 = "1px1p3wz7ji725z9nlwb0x0h6lnnvnpz15sblzzq7zrijl3wz65x";
   };
 
-  buildInputs = [ autoconf automake imlib2 libtool libX11 pkgconfig xproto ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ autoconf automake imlib2 libtool libX11 xproto ];
 
   patches = [ underlinkingPatch ];
 
diff --git a/pkgs/tools/X11/keynav/default.nix b/pkgs/tools/X11/keynav/default.nix
index edddf42d2c55..23e528297eef 100644
--- a/pkgs/tools/X11/keynav/default.nix
+++ b/pkgs/tools/X11/keynav/default.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation rec {
     sha256 = "0v1m8w877fcrk918p6b6q3753dsz8i1f4mb9bi064cp11kh85nq5";
   };
 
-  buildInputs = [ pkgconfig libX11 xextproto libXtst libXi libXext libXinerama
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libX11 xextproto libXtst libXi libXext libXinerama
                   glib cairo xdotool ];
 
   patchPhase = ''
diff --git a/pkgs/tools/X11/ksuperkey/default.nix b/pkgs/tools/X11/ksuperkey/default.nix
index a753f9bd170e..cd80e3286576 100644
--- a/pkgs/tools/X11/ksuperkey/default.nix
+++ b/pkgs/tools/X11/ksuperkey/default.nix
@@ -3,8 +3,9 @@
 stdenv.mkDerivation rec {
   name = "ksuperkey-git-2015-07-21";
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    libX11 libXtst pkgconfig inputproto libXi xproto xextproto
+    libX11 libXtst inputproto libXi xproto xextproto
   ];
 
   src = fetchgit {
diff --git a/pkgs/tools/X11/obconf/default.nix b/pkgs/tools/X11/obconf/default.nix
index e25fa43f1807..2e02338631b4 100644
--- a/pkgs/tools/X11/obconf/default.nix
+++ b/pkgs/tools/X11/obconf/default.nix
@@ -10,8 +10,9 @@ stdenv.mkDerivation rec {
     sha256 = "1fanjdmd8727kk74x5404vi8v7s4kpq48l583d12fsi4xvsfb8vi";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    pkgconfig gtk2 libglade libSM openbox imlib2 libstartup_notification
+    gtk2 libglade libSM openbox imlib2 libstartup_notification
     makeWrapper
   ];
 
diff --git a/pkgs/tools/X11/vdpauinfo/default.nix b/pkgs/tools/X11/vdpauinfo/default.nix
index 7a18a6a98b60..a20b7d69f3dc 100644
--- a/pkgs/tools/X11/vdpauinfo/default.nix
+++ b/pkgs/tools/X11/vdpauinfo/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "1i2b0k9h8r0lnxlrkgqzmrjakgaw3f1ygqqwzx8w6676g85rcm20";
   };
 
-  buildInputs = [ pkgconfig libvdpau ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libvdpau ];
 
   meta = with stdenv.lib; {
     homepage = http://people.freedesktop.org/~aplattner/vdpau/;
diff --git a/pkgs/tools/X11/wmctrl/default.nix b/pkgs/tools/X11/wmctrl/default.nix
index 2e23e7bd4de4..e0118b8b27b4 100644
--- a/pkgs/tools/X11/wmctrl/default.nix
+++ b/pkgs/tools/X11/wmctrl/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "1afclc57b9017a73mfs9w7lbdvdipmf9q0xdk116f61gnvyix2np";
   };
  
-  buildInputs = [ libX11 libXmu glib pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libX11 libXmu glib ];
 
   patches = [ ./64-bit-data.patch ];
 
diff --git a/pkgs/tools/X11/xbindkeys-config/default.nix b/pkgs/tools/X11/xbindkeys-config/default.nix
index cef071bb3b61..e3d9ecd5953e 100644
--- a/pkgs/tools/X11/xbindkeys-config/default.nix
+++ b/pkgs/tools/X11/xbindkeys-config/default.nix
@@ -4,7 +4,8 @@ stdenv.mkDerivation rec {
   name = "xbindkeys-config-${version}";
   version = "0.1.3";
 
-  buildInputs = [ gtk pkgconfig makeWrapper ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ gtk makeWrapper ];
 
   src = fetchurl {
     url = "mirror://debian/pool/main/x/xbindkeys-config/xbindkeys-config_${version}.orig.tar.gz";
diff --git a/pkgs/tools/X11/xinput_calibrator/default.nix b/pkgs/tools/X11/xinput_calibrator/default.nix
index 9b50f00beefc..8376b2041b30 100644
--- a/pkgs/tools/X11/xinput_calibrator/default.nix
+++ b/pkgs/tools/X11/xinput_calibrator/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
 
   preConfigure = "./autogen.sh --with-gui=X11";
 
-  buildInputs = [ inputproto libXi autoconf automake libtool m4 xlibsWrapper pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ inputproto libXi autoconf automake libtool m4 xlibsWrapper ];
 
   meta = {
     homepage = https://github.com/tias/xinput_calibrator;
diff --git a/pkgs/tools/X11/xpra/default.nix b/pkgs/tools/X11/xpra/default.nix
index aa0ae36fdd29..00f28c2c7bab 100644
--- a/pkgs/tools/X11/xpra/default.nix
+++ b/pkgs/tools/X11/xpra/default.nix
@@ -18,8 +18,9 @@ in buildPythonApplication rec {
     sha256 = "09hzgbsj9v5qyh41rbz968ipi7016jk66b60vm6piryna9kbnha3";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    cython pkgconfig
+    cython
 
     xorg.libX11 xorg.renderproto xorg.libXrender xorg.libXi xorg.inputproto xorg.kbproto
     xorg.randrproto xorg.damageproto xorg.compositeproto xorg.xextproto xorg.recordproto
diff --git a/pkgs/tools/X11/xpra/gtk3.nix b/pkgs/tools/X11/xpra/gtk3.nix
index f66b7389f315..92f1827156b6 100644
--- a/pkgs/tools/X11/xpra/gtk3.nix
+++ b/pkgs/tools/X11/xpra/gtk3.nix
@@ -19,9 +19,8 @@ buildPythonApplication rec {
     substituteInPlace xpra/client/gtk3/cairo_workaround.pyx --replace 'pycairo/pycairo.h' 'py3cairo.h'
   '';
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    pkgconfig
-
     xorg.libX11 xorg.renderproto xorg.libXrender xorg.libXi xorg.inputproto xorg.kbproto
     xorg.randrproto xorg.damageproto xorg.compositeproto xorg.xextproto xorg.recordproto
     xorg.xproto xorg.fixesproto xorg.libXtst xorg.libXfixes xorg.libXcomposite xorg.libXdamage
diff --git a/pkgs/tools/X11/xrestop/default.nix b/pkgs/tools/X11/xrestop/default.nix
index 2bd6392456ee..76e502d75985 100644
--- a/pkgs/tools/X11/xrestop/default.nix
+++ b/pkgs/tools/X11/xrestop/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0mz27jpij8am1s32i63mdm58znfijcpfhdqq1npbmvgclyagrhk7";
   };
 
-  buildInputs = [ pkgconfig xorg.libX11 xorg.libXres xorg.libXext ncurses ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ xorg.libX11 xorg.libXres xorg.libXext ncurses ];
 
   meta = {
     platforms = stdenv.lib.platforms.unix;
diff --git a/pkgs/tools/X11/xsettingsd/default.nix b/pkgs/tools/X11/xsettingsd/default.nix
index c05aeff9337c..239b01e1345d 100644
--- a/pkgs/tools/X11/xsettingsd/default.nix
+++ b/pkgs/tools/X11/xsettingsd/default.nix
@@ -15,7 +15,8 @@ stdenv.mkDerivation rec {
     ./SConstruct.patch
   ];
 
-  buildInputs = [ libX11 scons pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libX11 scons ];
   buildPhase = ''
     mkdir -p "$out"
     scons \
diff --git a/pkgs/tools/X11/xtrace/default.nix b/pkgs/tools/X11/xtrace/default.nix
index 35342035c9d5..1905ed9752ca 100644
--- a/pkgs/tools/X11/xtrace/default.nix
+++ b/pkgs/tools/X11/xtrace/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation {
     sha256 = "1g26hr6rl7bbb9cwqk606nbbapslq3wnsy8j28azrgi8hgfqhjfi";
   };
 
-  buildInputs = [ libX11 makeWrapper autoreconfHook ];
+  nativeBuildInputs = [ autoreconfHook ];
+  buildInputs = [ libX11 makeWrapper ];
 
   preConfigure = ''
     ./autogen.sh
diff --git a/pkgs/tools/X11/xwinmosaic/default.nix b/pkgs/tools/X11/xwinmosaic/default.nix
index 40956f2acc4d..e36808db0b8c 100644
--- a/pkgs/tools/X11/xwinmosaic/default.nix
+++ b/pkgs/tools/X11/xwinmosaic/default.nix
@@ -1,18 +1,18 @@
-{stdenv, fetchgit, gtk2, cmake, pkgconfig}:
-let
-  buildInputs = [
-    gtk2 cmake pkgconfig
-  ];
-in
+{ stdenv, fetchgit, gtk2, cmake, pkgconfig }:
+
 stdenv.mkDerivation rec {
   version = "0.4.2";
   name = "xwinmosaic-${version}";
-  inherit buildInputs;
+
   src = fetchgit {
     url = "https://github.com/soulthreads/xwinmosaic/";
     rev = "refs/tags/v0.4.2";
     sha256 = "16qhrpgn84fz0q3nfvaz5sisc82zk6y7c0sbvbr69zfx5fwbs1rr";
   };
+
+  nativeBuildInputs = [ pkgconfig cmake ];
+  buildInputs = [ gtk2 ];
+
   meta = {
     inherit version;
     description = ''X window switcher drawing a colourful grid'';
diff --git a/pkgs/tools/admin/gtk-vnc/default.nix b/pkgs/tools/admin/gtk-vnc/default.nix
index da269049b2ca..59a5ec8d4dad 100644
--- a/pkgs/tools/admin/gtk-vnc/default.nix
+++ b/pkgs/tools/admin/gtk-vnc/default.nix
@@ -15,11 +15,13 @@ in stdenv.mkDerivation rec {
     sha256 = "0gj8dpy3sj4dp810gy67spzh5f0jd8aqg69clcwqjcskj1yawbiw";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    python gnutls cairo libtool pkgconfig glib libffi libgcrypt
+    python gnutls cairo libtool glib libffi libgcrypt
     intltool cyrus_sasl libpulseaudio perl perlPackages.TextCSV
     gobjectIntrospection libogg libgpgerror
-    gtk3 vala_0_32 pygobject3 ];
+    gtk3 vala_0_32 pygobject3
+  ];
 
   NIX_CFLAGS_COMPILE = "-fstack-protector-all";
   configureFlags = [
diff --git a/pkgs/tools/archivers/cromfs/default.nix b/pkgs/tools/archivers/cromfs/default.nix
index 042880b39c9b..00de2c2ec462 100644
--- a/pkgs/tools/archivers/cromfs/default.nix
+++ b/pkgs/tools/archivers/cromfs/default.nix
@@ -18,7 +18,8 @@ stdenv.mkDerivation rec {
     install util/unmkcromfs $out/bin
   '';
 
-  buildInputs = [ pkgconfig fuse perl ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ fuse perl ];
 
   meta = {
     description = "FUSE Compressed ROM filesystem with lzma";
diff --git a/pkgs/tools/archivers/runzip/default.nix b/pkgs/tools/archivers/runzip/default.nix
index 1ed453f0d4f8..f99ee963dbe6 100644
--- a/pkgs/tools/archivers/runzip/default.nix
+++ b/pkgs/tools/archivers/runzip/default.nix
@@ -4,7 +4,8 @@ stdenv.mkDerivation rec {
   version = "1.4";
   name = "runzip-${version}";
 
-  buildInputs = [ libzip autoreconfHook ];
+  nativeBuildInputs = [ autoreconfHook ];
+  buildInputs = [ libzip ];
 
   src = fetchFromGitHub {
     owner = "vlm";
diff --git a/pkgs/tools/archivers/xarchive/default.nix b/pkgs/tools/archivers/xarchive/default.nix
index 0cb4fbbf3f03..07e76ea7f62a 100644
--- a/pkgs/tools/archivers/xarchive/default.nix
+++ b/pkgs/tools/archivers/xarchive/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0chfim7z27s00naf43a61zsngwhvim14mg1p3csbv5i3f6m50xx4";
   };
 
-  buildInputs = [ gtk2 pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ gtk2 ];
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/tools/archivers/xarchiver/default.nix b/pkgs/tools/archivers/xarchiver/default.nix
index 6ed6a7f24021..a257ece48773 100644
--- a/pkgs/tools/archivers/xarchiver/default.nix
+++ b/pkgs/tools/archivers/xarchiver/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "0w9lx8d8r50j48qfhn2r0dlcnwy3pjyy6xjvgpr0qagy5l1q1qj4";
   };
 
-  buildInputs = [ gtk2 pkgconfig intltool ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ gtk2 intltool ];
 
   meta = {
     description = "GTK+ frontend to 7z,zip,rar,tar,bzip2, gzip,arj, lha, rpm and deb (open and extract only)";
diff --git a/pkgs/tools/audio/acoustid-fingerprinter/default.nix b/pkgs/tools/audio/acoustid-fingerprinter/default.nix
index ba029814f392..f68671bc6fba 100644
--- a/pkgs/tools/audio/acoustid-fingerprinter/default.nix
+++ b/pkgs/tools/audio/acoustid-fingerprinter/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
     sha256 = "0ckglwy95qgqvl2l6yd8ilwpd6qs7yzmj8g7lnxb50d12115s5n0";
   };
 
-  buildInputs = [ cmake pkgconfig qt4 taglib chromaprint ffmpeg ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ cmake qt4 taglib chromaprint ffmpeg ];
 
   cmakeFlags = [ "-DTAGLIB_MIN_VERSION=${(builtins.parseDrvName taglib.name).version}" ];
 
diff --git a/pkgs/tools/audio/gvolicon/default.nix b/pkgs/tools/audio/gvolicon/default.nix
index 7354b92aaf94..8fed569f140f 100644
--- a/pkgs/tools/audio/gvolicon/default.nix
+++ b/pkgs/tools/audio/gvolicon/default.nix
@@ -8,8 +8,9 @@ stdenv.mkDerivation {
     sha256 = "1sr9wyy7w898vq63yd003yp3k66hd4vm8b0qsm9zvmwmpiz4wvln";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    pkgconfig makeWrapper alsaLib gnome3.gtk gdk_pixbuf gnome3.defaultIconTheme
+    makeWrapper alsaLib gnome3.gtk gdk_pixbuf gnome3.defaultIconTheme
     librsvg wrapGAppsHook
   ];
 
diff --git a/pkgs/tools/audio/mpdris2/default.nix b/pkgs/tools/audio/mpdris2/default.nix
index c326533ece14..6596f1c34ff5 100644
--- a/pkgs/tools/audio/mpdris2/default.nix
+++ b/pkgs/tools/audio/mpdris2/default.nix
@@ -15,7 +15,8 @@ stdenv.mkDerivation rec {
     intltoolize -f
   '';
 
-  buildInputs = [ intltool autoreconfHook pythonPackages.wrapPython ];
+  nativeBuildInputs = [ autoreconfHook ];
+  buildInputs = [ intltool pythonPackages.wrapPython ];
   propagatedBuildInputs = with pythonPackages; [ python pygtk dbus-python  ];
   pythonPath = with pythonPackages; [ mpd pygtk dbus-python notify mutagen ];
   postInstall = "wrapPythonPrograms";
diff --git a/pkgs/tools/audio/pa-applet/default.nix b/pkgs/tools/audio/pa-applet/default.nix
index 6e3e5617b311..239e4b3fcca3 100644
--- a/pkgs/tools/audio/pa-applet/default.nix
+++ b/pkgs/tools/audio/pa-applet/default.nix
@@ -9,8 +9,9 @@ stdenv.mkDerivation rec {
     sha256 = "1242sdri67wnm1cd0hr40mxarkh7qs7mb9n2m0g9dbz0f4axj6wa";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    gtk3 libpulseaudio glibc pkgconfig automake autoconf libnotify libX11 xf86inputevdev
+    gtk3 libpulseaudio glibc automake autoconf libnotify libX11 xf86inputevdev
   ];
 
   preConfigure = ''
diff --git a/pkgs/tools/audio/pasystray/default.nix b/pkgs/tools/audio/pasystray/default.nix
index 451424fb8661..02235f727c5c 100644
--- a/pkgs/tools/audio/pasystray/default.nix
+++ b/pkgs/tools/audio/pasystray/default.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation rec {
     sha256 = "0k13s7pmz5ks3kli8pwhzd47hcjwv46gd2fgk7i4fbkfwf3z279h";
   };
 
-  buildInputs = [ autoconf automake makeWrapper pkgconfig 
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ autoconf automake makeWrapper 
                   gnome3.defaultIconTheme
                   avahi gtk3 libnotify libpulseaudio xlibsWrapper ];
 
diff --git a/pkgs/tools/audio/playerctl/default.nix b/pkgs/tools/audio/playerctl/default.nix
index 38df702cb16e..b04e449835d4 100644
--- a/pkgs/tools/audio/playerctl/default.nix
+++ b/pkgs/tools/audio/playerctl/default.nix
@@ -12,8 +12,9 @@ stdenv.mkDerivation rec {
     sha256 = "0b4pg5pwblgbf6kvvynzh9dshfikxy5c2ks7733n7wza5wkpgmng";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    which autoconf automake libtool gnome2.gtkdoc glib pkgconfig
+    which autoconf automake libtool gnome2.gtkdoc glib
     gobjectIntrospection
   ];
 
diff --git a/pkgs/tools/audio/volumeicon/default.nix b/pkgs/tools/audio/volumeicon/default.nix
index ea74d83ed9e2..ed9558762502 100644
--- a/pkgs/tools/audio/volumeicon/default.nix
+++ b/pkgs/tools/audio/volumeicon/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "182xl2w8syv6ky2h2bc9imc6ap8pzh0p7rp63hh8nw0xm38c3f14";
   };
 
-  buildInputs = [ gtk3 pkgconfig intltool alsaLib ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ gtk3 intltool alsaLib ];
 
   meta = with stdenv.lib; {
     description = "A lightweight volume control that sits in your systray";
diff --git a/pkgs/tools/backup/attic/default.nix b/pkgs/tools/backup/attic/default.nix
index abfccb97641c..754e12e7f776 100644
--- a/pkgs/tools/backup/attic/default.nix
+++ b/pkgs/tools/backup/attic/default.nix
@@ -10,7 +10,8 @@ let
       url = "mirror://pypi/l/llfuse/${name}.tar.bz2";
       sha256 = "1imlqw9b73086y97izr036f58pgc5akv4ihc2rrf8j5h75jbrlaa";
     };
-    buildInputs = with python3Packages; [ pytest pkgconfig fuse attr which ];
+  nativeBuildInputs = [ pkgconfig ];
+    buildInputs = with python3Packages; [ pytest fuse attr which ];
     propagatedBuildInputs = with python3Packages; [ contextlib2 ];
     checkPhase = ''
       py.test
diff --git a/pkgs/tools/backup/btrbk/default.nix b/pkgs/tools/backup/btrbk/default.nix
index ff542e781a69..f9feaf40ec2f 100644
--- a/pkgs/tools/backup/btrbk/default.nix
+++ b/pkgs/tools/backup/btrbk/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "btrbk-${version}";
-  version = "0.24.0";
+  version = "0.25.1";
 
   src = fetchurl {
     url = "http://digint.ch/download/btrbk/releases/${name}.tar.xz";
-    sha256 = "01jrlswly28h4q4r3qfrzadz0pf0ms6wynmqhwddj1ahj31729h3";
+    sha256 = "02qc9vbd5l0ywnv01p60v9q3dcx2z92dfaf95qf7ccxqaa9zxfr5";
   };
 
   patches = [
diff --git a/pkgs/tools/backup/partimage/default.nix b/pkgs/tools/backup/partimage/default.nix
index b0b9444a2380..c902802abce2 100644
--- a/pkgs/tools/backup/partimage/default.nix
+++ b/pkgs/tools/backup/partimage/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation {
   };
   configureFlags = "--with-ssl-headers=${openssl.dev}/include/openssl";
 
-  buildInputs = [bzip2 zlib newt newt openssl pkgconfig slang
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [bzip2 zlib newt newt openssl slang
     # automake autoconf libtool gettext
   ];
 
diff --git a/pkgs/tools/bluetooth/obex-data-server/default.nix b/pkgs/tools/bluetooth/obex-data-server/default.nix
index 35f46b47bc83..53a193749d3c 100644
--- a/pkgs/tools/bluetooth/obex-data-server/default.nix
+++ b/pkgs/tools/bluetooth/obex-data-server/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "0kq940wqs9j8qjnl58d6l3zhx0jaszci356xprx23l6nvdfld6dk";
   };
 
-  buildInputs = [ pkgconfig libusb glib dbus_glib bluez openobex dbus_libs ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libusb glib dbus_glib bluez openobex dbus_libs ];
 
   patches = [ ./obex-data-server-0.4.6-build-fixes-1.patch ];
 
diff --git a/pkgs/tools/cd-dvd/cdrdao/default.nix b/pkgs/tools/cd-dvd/cdrdao/default.nix
index 95dd58a59b48..3b8040e2b917 100644
--- a/pkgs/tools/cd-dvd/cdrdao/default.nix
+++ b/pkgs/tools/cd-dvd/cdrdao/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation {
 
   makeFlags = "RM=rm LN=ln MV=mv";
 
-  buildInputs = [ lame libvorbis libmad pkgconfig libao ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ lame libvorbis libmad libao ];
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/tools/cd-dvd/vobsub2srt/default.nix b/pkgs/tools/cd-dvd/vobsub2srt/default.nix
index a345972b3737..fe7a1a044149 100644
--- a/pkgs/tools/cd-dvd/vobsub2srt/default.nix
+++ b/pkgs/tools/cd-dvd/vobsub2srt/default.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation {
     sha256 = "1rpanrv8bgdh95v2320qbd44xskncvq6y84cbbfc86gw0qxpd9cb";
   };
 
-  buildInputs = [ cmake libtiff pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ cmake libtiff ];
   propagatedBuildInputs = [ tesseract ];
 
   meta = {
diff --git a/pkgs/tools/compression/pixz/default.nix b/pkgs/tools/compression/pixz/default.nix
index 5ce79cbf4128..2a5250a95aca 100644
--- a/pkgs/tools/compression/pixz/default.nix
+++ b/pkgs/tools/compression/pixz/default.nix
@@ -8,8 +8,9 @@ stdenv.mkDerivation rec {
   version = "1.0.6";
   name = "${baseName}-${version}";
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    autoconf automake libtool pkgconfig asciidoc libxslt libxml2
+    autoconf automake libtool asciidoc libxslt libxml2
     docbook_xml_dtd_45 docbook_xml_xslt
     libarchive lzma
   ];
diff --git a/pkgs/tools/filesystems/archivemount/default.nix b/pkgs/tools/filesystems/archivemount/default.nix
index dff66fe6bde5..f4133f12541f 100644
--- a/pkgs/tools/filesystems/archivemount/default.nix
+++ b/pkgs/tools/filesystems/archivemount/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation {
     sha256 = "1zv1fvik76kpp1q5f2dz01f4fwg1m5a8rl168px47jy9nyl9k277";
   };
 
-  buildInputs = [ pkgconfig fuse libarchive ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ fuse libarchive ];
 
   meta = {
     description = "Gateway between FUSE and libarchive: allows mounting of cpio, .tar.gz, .tar.bz2 archives";
diff --git a/pkgs/tools/filesystems/bcache-tools/default.nix b/pkgs/tools/filesystems/bcache-tools/default.nix
index 61c7f26db1e1..efd48fb87fe7 100644
--- a/pkgs/tools/filesystems/bcache-tools/default.nix
+++ b/pkgs/tools/filesystems/bcache-tools/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
     sha256 = "1gbsh2qw0a7kgck6w0apydiy37nnz5xvdgipa0yqrfmghl86vmv4";
   };
 
-  buildInputs = [ pkgconfig utillinux ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ utillinux ];
 
   # * Remove broken install rules (they ignore $PREFIX) for stuff we don't need
   #   anyway (it's distro specific stuff).
diff --git a/pkgs/tools/filesystems/bcachefs-tools/default.nix b/pkgs/tools/filesystems/bcachefs-tools/default.nix
index 5c5779037ab2..fc4d3f505cdc 100644
--- a/pkgs/tools/filesystems/bcachefs-tools/default.nix
+++ b/pkgs/tools/filesystems/bcachefs-tools/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "05ba1h09rrqj6vjr3q37ybca3nbrmnifmffdyk83622l28fpv350";
   };
 
-  buildInputs = [ pkgconfig attr libuuid libscrypt libsodium keyutils liburcu zlib libaio ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ attr libuuid libscrypt libsodium keyutils liburcu zlib libaio ];
 
   preConfigure = ''
     substituteInPlace cmd_migrate.c --replace /usr/include/dirent.h ${stdenv.lib.getDev stdenv.cc.libc}/include/dirent.h
diff --git a/pkgs/tools/filesystems/bindfs/default.nix b/pkgs/tools/filesystems/bindfs/default.nix
index 80027c7a0474..4d7ee75c0060 100644
--- a/pkgs/tools/filesystems/bindfs/default.nix
+++ b/pkgs/tools/filesystems/bindfs/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
 
   dontStrip = true;
 
-  buildInputs = [ fuse pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ fuse ];
   postFixup = ''
     ln -s $out/bin/bindfs $out/bin/mount.fuse.bindfs
   '';
diff --git a/pkgs/tools/filesystems/btrfs-progs/4.4.1.nix b/pkgs/tools/filesystems/btrfs-progs/4.4.1.nix
deleted file mode 100644
index afafa4ec1743..000000000000
--- a/pkgs/tools/filesystems/btrfs-progs/4.4.1.nix
+++ /dev/null
@@ -1,31 +0,0 @@
-{ stdenv, fetchurl, pkgconfig, attr, acl, zlib, libuuid, e2fsprogs, lzo
-, asciidoc, xmlto, docbook_xml_dtd_45, docbook_xsl, libxslt
-}:
-
-let version = "4.4.1"; in
-
-stdenv.mkDerivation rec {
-  name = "btrfs-progs-${version}";
-
-  src = fetchurl {
-    url = "mirror://kernel/linux/kernel/people/kdave/btrfs-progs/btrfs-progs-v${version}.tar.xz";
-    sha256 = "1z5882zx9jx02vyg067siws0irsl8pg37myx17hr4imn9ypf6r4r";
-  };
-
-  buildInputs = [
-    pkgconfig attr acl zlib libuuid e2fsprogs lzo
-    asciidoc xmlto docbook_xml_dtd_45 docbook_xsl libxslt
-  ];
-
-  # gcc bug with -O1 on ARM with gcc 4.8
-  # This should be fine on all platforms so apply universally
-  patchPhase = "sed -i s/-O1/-O2/ configure";
-
-  meta = with stdenv.lib; {
-    description = "Utilities for the btrfs filesystem";
-    homepage = https://btrfs.wiki.kernel.org/;
-    license = licenses.gpl2;
-    maintainers = with maintainers; [ nckx raskin wkennington ];
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/tools/filesystems/btrfs-progs/default.nix b/pkgs/tools/filesystems/btrfs-progs/default.nix
index d9b01eb5239f..77411e0cc26d 100644
--- a/pkgs/tools/filesystems/btrfs-progs/default.nix
+++ b/pkgs/tools/filesystems/btrfs-progs/default.nix
@@ -2,18 +2,19 @@
 , asciidoc, xmlto, docbook_xml_dtd_45, docbook_xsl, libxslt
 }:
 
-let version = "4.8.2"; in
+let version = "4.13.1"; in
 
 stdenv.mkDerivation rec {
   name = "btrfs-progs-${version}";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/people/kdave/btrfs-progs/btrfs-progs-v${version}.tar.xz";
-    sha256 = "0pswcfmdnfc586770h74abp67gn2xv8fd46vxlimnmn837sj7h41";
+    sha256 = "1clavvrlkswgicqsm2yfsxqw04lsn8dra0db84jqm6j2apz80kz0";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    pkgconfig attr acl zlib libuuid e2fsprogs lzo
+    attr acl zlib libuuid e2fsprogs lzo
     asciidoc xmlto docbook_xml_dtd_45 docbook_xsl libxslt
   ];
 
diff --git a/pkgs/tools/filesystems/ciopfs/default.nix b/pkgs/tools/filesystems/ciopfs/default.nix
index 674f462b967f..4a8c767e44ac 100644
--- a/pkgs/tools/filesystems/ciopfs/default.nix
+++ b/pkgs/tools/filesystems/ciopfs/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "0sr9i9b3qfwbfvzvk00yrrg3x2xqk1njadbldkvn7hwwa4z5bm9l";
   };
 
-  buildInputs = [ pkgconfig fuse glib attr ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ fuse glib attr ];
 
   makeFlags = "DESTDIR=$(out) PREFIX=";
 
diff --git a/pkgs/tools/filesystems/curlftpfs/default.nix b/pkgs/tools/filesystems/curlftpfs/default.nix
index 1897181e4448..8797c21aa235 100644
--- a/pkgs/tools/filesystems/curlftpfs/default.nix
+++ b/pkgs/tools/filesystems/curlftpfs/default.nix
@@ -6,7 +6,8 @@ stdenv.mkDerivation {
     url = mirror://sourceforge/curlftpfs/curlftpfs-0.9.2.tar.gz;
     sha256 = "0n397hmv21jsr1j7zx3m21i7ryscdhkdsyqpvvns12q7qwwlgd2f";
   };
-  buildInputs = [fuse curl pkgconfig glib zlib];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [fuse curl glib zlib];
 
   meta = {
     platforms = stdenv.lib.platforms.linux;
diff --git a/pkgs/tools/filesystems/djmount/default.nix b/pkgs/tools/filesystems/djmount/default.nix
index 7010a60bcbc0..e8deeaf4b470 100644
--- a/pkgs/tools/filesystems/djmount/default.nix
+++ b/pkgs/tools/filesystems/djmount/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "0kqf0cy3h4cfiy5a2sigmisx0lvvsi1n0fbyb9ll5gacmy1b8nxa";
   };
 
-  buildInputs = [ pkgconfig fuse];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ fuse];
 
   meta = {
     homepage = http://djmount.sourceforge.net/;
diff --git a/pkgs/tools/filesystems/duperemove/default.nix b/pkgs/tools/filesystems/duperemove/default.nix
index d333334d394c..613ab7bab1ee 100644
--- a/pkgs/tools/filesystems/duperemove/default.nix
+++ b/pkgs/tools/filesystems/duperemove/default.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation rec {
     sha256 = "1fll0xjg1p3pabgjiddild4ragk9spbdmdzrkq0hv5pxb1qrv7lp";
   };
 
-  buildInputs = [ libgcrypt pkgconfig glib linuxHeaders sqlite ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libgcrypt glib linuxHeaders sqlite ];
 
   makeFlags = [ "DESTDIR=$(out)" "PREFIX=" ];
 
diff --git a/pkgs/tools/filesystems/fuse-7z-ng/default.nix b/pkgs/tools/filesystems/fuse-7z-ng/default.nix
index 8b3df52bcb74..82e2b404b82a 100644
--- a/pkgs/tools/filesystems/fuse-7z-ng/default.nix
+++ b/pkgs/tools/filesystems/fuse-7z-ng/default.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation rec {
     sha256 = "17v1gcmg5q661b047zxjar735i4d3508dimw1x3z1pk4d1zjhp3x";
   };
 
-  buildInputs = [ fuse autoconf automake pkgconfig makeWrapper ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ fuse autoconf automake makeWrapper ];
 
   preConfigure = "./autogen.sh";
 
diff --git a/pkgs/tools/filesystems/fuseiso/default.nix b/pkgs/tools/filesystems/fuseiso/default.nix
index 7165789cf81c..3ca468513063 100644
--- a/pkgs/tools/filesystems/fuseiso/default.nix
+++ b/pkgs/tools/filesystems/fuseiso/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "127xql52dcdhmh7s5m9xc6q39jdlj3zhbjar1j821kb6gl3jw94b";
   };
 
-  buildInputs = [ pkgconfig fuse zlib glib ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ fuse zlib glib ];
 
   patches = let fetchPatchFromDebian = { patch, sha256 }:
     fetchpatch {
diff --git a/pkgs/tools/filesystems/genimage/default.nix b/pkgs/tools/filesystems/genimage/default.nix
index b808573aa5b8..792b2e2c75b4 100644
--- a/pkgs/tools/filesystems/genimage/default.nix
+++ b/pkgs/tools/filesystems/genimage/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0y4h8x8lqxam8m90rdfq8cg5137kvilxr3d1qzddpx7nxpvmmwv9";
   };
 
-  buildInputs = [ pkgconfig libconfuse ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libconfuse ];
 
   postInstall = ''
     # As there is no manpage or built-in --help, add the README file for
diff --git a/pkgs/tools/filesystems/gocrypfs/default.nix b/pkgs/tools/filesystems/gocrypfs/default.nix
index c156cd13244a..b9314015cf55 100644
--- a/pkgs/tools/filesystems/gocrypfs/default.nix
+++ b/pkgs/tools/filesystems/gocrypfs/default.nix
@@ -21,7 +21,8 @@ in buildGoPackage rec {
     sha256 = "0p173x2s0km7a43h6ihir5p19fdlkkb9lc9120k9hccr33iws25z";
   };
 
-  buildInputs = [pkgconfig openssl];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ openssl];
 
   goDeps = ./deps.nix;
 
diff --git a/pkgs/tools/filesystems/hubicfuse/default.nix b/pkgs/tools/filesystems/hubicfuse/default.nix
index 88922d9ce944..e9d3df026b08 100644
--- a/pkgs/tools/filesystems/hubicfuse/default.nix
+++ b/pkgs/tools/filesystems/hubicfuse/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "1y4n63bk9vd6n1l5psjb9xm9h042kw4yh2ni33z7agixkanajv1s";
   };
 
-  buildInputs = [ pkgconfig curl openssl fuse libxml2 json_c file ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ curl openssl fuse libxml2 json_c file ];
   postInstall = ''
     install hubic_token $out/bin
     mkdir -p $out/sbin
diff --git a/pkgs/tools/filesystems/jmtpfs/default.nix b/pkgs/tools/filesystems/jmtpfs/default.nix
index 091270deab66..6044806a34b7 100644
--- a/pkgs/tools/filesystems/jmtpfs/default.nix
+++ b/pkgs/tools/filesystems/jmtpfs/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation {
     owner = "JasonFerrara";
   };
 
-  buildInputs = [ file fuse libmtp pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ file fuse libmtp ];
 
   meta = with stdenv.lib; {
     description = "A FUSE filesystem for MTP devices like Android phones";
diff --git a/pkgs/tools/filesystems/mhddfs/default.nix b/pkgs/tools/filesystems/mhddfs/default.nix
index 54a8f8459152..697256982bbf 100644
--- a/pkgs/tools/filesystems/mhddfs/default.nix
+++ b/pkgs/tools/filesystems/mhddfs/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "14ggmh91vv69fp2qpz0nxp0hprlw2wsijss2k2485hb0ci4cabvh";
   };
 
-  buildInputs = [ fuse pkgconfig attr uthash ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ fuse attr uthash ];
 
   patches = [
     ./fix-format-security-error.patch
diff --git a/pkgs/tools/filesystems/mtpfs/default.nix b/pkgs/tools/filesystems/mtpfs/default.nix
index 7725b0d7af8e..6d2b073d8696 100644
--- a/pkgs/tools/filesystems/mtpfs/default.nix
+++ b/pkgs/tools/filesystems/mtpfs/default.nix
@@ -3,7 +3,8 @@
 stdenv.mkDerivation rec {
   name = "mtpfs-1.1";
 
-  buildInputs = [ pkgconfig fuse libmtp glib libid3tag libmad ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ fuse libmtp glib libid3tag libmad ];
 
   # adding LIBS is a hack, duno why it does not find libid3tag.so by adding buildInputs
   preConfigure = ''
diff --git a/pkgs/tools/filesystems/netatalk/default.nix b/pkgs/tools/filesystems/netatalk/default.nix
index 0214afce6d45..445e724e1a2a 100644
--- a/pkgs/tools/filesystems/netatalk/default.nix
+++ b/pkgs/tools/filesystems/netatalk/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec{
     sha256 = "0wf09fyqzza024qr1s26z5x7rsvh9zb4pv598gw7gm77wjcr6174";
   };
 
-  buildInputs = [ pkgconfig db libgcrypt avahi libiconv pam openssl acl ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ db libgcrypt avahi libiconv pam openssl acl ];
 
   patches = ./omitLocalstatedirCreation.patch;
 
diff --git a/pkgs/tools/filesystems/nixpart/0.4/cryptsetup.nix b/pkgs/tools/filesystems/nixpart/0.4/cryptsetup.nix
index c612512b8cc9..24eec2f0dc46 100644
--- a/pkgs/tools/filesystems/nixpart/0.4/cryptsetup.nix
+++ b/pkgs/tools/filesystems/nixpart/0.4/cryptsetup.nix
@@ -15,7 +15,8 @@ stdenv.mkDerivation rec {
   configureFlags = [ "--enable-cryptsetup-reencrypt" ]
                 ++ stdenv.lib.optional enablePython "--enable-python";
 
-  buildInputs = [ devicemapper libgcrypt libuuid pkgconfig popt ]
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ devicemapper libgcrypt libuuid popt ]
              ++ stdenv.lib.optional enablePython python;
 
   meta = {
diff --git a/pkgs/tools/filesystems/nixpart/0.4/lvm2.nix b/pkgs/tools/filesystems/nixpart/0.4/lvm2.nix
index 6301cbb6842a..df14d7efda4e 100644
--- a/pkgs/tools/filesystems/nixpart/0.4/lvm2.nix
+++ b/pkgs/tools/filesystems/nixpart/0.4/lvm2.nix
@@ -15,7 +15,8 @@ stdenv.mkDerivation {
   configureFlags =
     "--disable-readline --enable-udev_rules --enable-udev_sync --enable-pkgconfig --enable-applib";
 
-  buildInputs = [ pkgconfig systemd ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ systemd ];
 
   preConfigure =
     ''
diff --git a/pkgs/tools/filesystems/nixpart/0.4/pyparted.nix b/pkgs/tools/filesystems/nixpart/0.4/pyparted.nix
index 0d3370c4b1e8..fd6c5b913093 100644
--- a/pkgs/tools/filesystems/nixpart/0.4/pyparted.nix
+++ b/pkgs/tools/filesystems/nixpart/0.4/pyparted.nix
@@ -24,7 +24,7 @@ buildPythonApplication rec {
     PATH="${parted}/sbin:$PATH"
   '';
 
-  buildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
 
   propagatedBuildInputs = [ parted ];
 
diff --git a/pkgs/tools/filesystems/relfs/default.nix b/pkgs/tools/filesystems/relfs/default.nix
index 0c8e1c4ef81a..9a8c3ecb0fc8 100644
--- a/pkgs/tools/filesystems/relfs/default.nix
+++ b/pkgs/tools/filesystems/relfs/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
 		sha256 = "949f8eff7e74ff2666cccf8a1efbfcce8d54bc41bec6ad6db8c029de7ca832a3";
 	};
 
-  buildInputs = [ ocaml fuse postgresql pcre libuuid gnome_vfs pkgconfig GConf ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ ocaml fuse postgresql pcre libuuid gnome_vfs GConf ];
 
   buildPhase = ''
     cd deps
diff --git a/pkgs/tools/filesystems/smbnetfs/default.nix b/pkgs/tools/filesystems/smbnetfs/default.nix
index 3bc13d43a362..fc504b3208de 100644
--- a/pkgs/tools/filesystems/smbnetfs/default.nix
+++ b/pkgs/tools/filesystems/smbnetfs/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "16sikr81ipn8v1a1zrqgnsy2as3zcaxbzkr0bm5vxy012bq0plkd";
   };
 
-  buildInputs = [ fuse samba pkgconfig glib ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ fuse samba glib ];
 
   meta = with stdenv.lib; {
     description = "A FUSE FS for mounting Samba shares";
diff --git a/pkgs/tools/filesystems/snapraid/default.nix b/pkgs/tools/filesystems/snapraid/default.nix
index ccb20e9f1bd0..c9f605ca69f0 100644
--- a/pkgs/tools/filesystems/snapraid/default.nix
+++ b/pkgs/tools/filesystems/snapraid/default.nix
@@ -13,7 +13,8 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  buildInputs = [ autoreconfHook ];
+  nativeBuildInputs = [ autoreconfHook ];
+  buildInputs = [ ];
 
   meta = {
     homepage = http://www.snapraid.it/;
diff --git a/pkgs/tools/filesystems/u3-tool/default.nix b/pkgs/tools/filesystems/u3-tool/default.nix
new file mode 100644
index 000000000000..65eafe76710d
--- /dev/null
+++ b/pkgs/tools/filesystems/u3-tool/default.nix
@@ -0,0 +1,22 @@
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  pname = "u3-tool";
+  version = "0.3";
+  name = "${pname}-${version}";
+
+  enableParallelBuilding = true;
+
+  src = fetchurl {
+    url = "mirror://sourceforge/${pname}/${name}.tar.gz";
+    sha256 = "1p9c9kibd1pdbdfa0nd0i3n7bvzi3xg0chm38jg3xfl8gsn0390f";
+  };
+
+  meta = with stdenv.lib; {
+    description = "Tool for controlling the special features of a 'U3 smart drive' USB Flash disk";
+    homepage = https://sourceforge.net/projects/u3-tool/ ;
+    license = licenses.gpl2;
+    platforms = with platforms; linux;
+    maintainers = with maintainers; [ makefu ];
+  };
+}
diff --git a/pkgs/tools/filesystems/wdfs/default.nix b/pkgs/tools/filesystems/wdfs/default.nix
index a51f2d47172e..dc725b5078f0 100644
--- a/pkgs/tools/filesystems/wdfs/default.nix
+++ b/pkgs/tools/filesystems/wdfs/default.nix
@@ -7,7 +7,8 @@ stdenv.mkDerivation rec
     url = "http://noedler.de/projekte/wdfs/wdfs-1.4.2.tar.gz";
     sha256 = "fcf2e1584568b07c7f3683a983a9be26fae6534b8109e09167e5dff9114ba2e5";
   };
-  buildInputs = [fuse glib neon pkgconfig];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [fuse glib neon];
   meta = {
     homepage = http://noedler.de/projekte/wdfs/;
     description = "User-space filesystem that allows to mount a webdav share";
diff --git a/pkgs/tools/filesystems/zkfuse/default.nix b/pkgs/tools/filesystems/zkfuse/default.nix
index 0738ee84cab7..9dfb2deeaee3 100644
--- a/pkgs/tools/filesystems/zkfuse/default.nix
+++ b/pkgs/tools/filesystems/zkfuse/default.nix
@@ -6,7 +6,8 @@ stdenv.mkDerivation rec {
 
   sourceRoot = "${zookeeper.name}/src/contrib/zkfuse";
 
-  buildInputs = [ autoreconfHook zookeeper_mt log4cxx boost fuse ];
+  nativeBuildInputs = [ autoreconfHook ];
+  buildInputs = [ zookeeper_mt log4cxx boost fuse ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/tools/graphics/dmtx-utils/default.nix b/pkgs/tools/graphics/dmtx-utils/default.nix
index 3e4e3e9312ed..bb816e489404 100644
--- a/pkgs/tools/graphics/dmtx-utils/default.nix
+++ b/pkgs/tools/graphics/dmtx-utils/default.nix
@@ -9,13 +9,14 @@ let
     url="mirror://sourceforge/project/libdmtx/libdmtx/0.7.4/dmtx-utils-0.7.4.tar.gz";
     sha256="1di8ymlziy9856abd6rb72z0zqzmrff4r3vql0q9r5sk5ax4s417";
   };
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    libdmtx pkgconfig imagemagick
+    libdmtx imagemagick
   ];
 in
 stdenv.mkDerivation {
   inherit (s) name version;
-  inherit buildInputs;
+  inherit nativeBuildInputs buildInputs;
   src = fetchurl {
     inherit (s) url sha256;
   };
diff --git a/pkgs/tools/graphics/editres/default.nix b/pkgs/tools/graphics/editres/default.nix
index 86848f958838..91dd85b0757d 100644
--- a/pkgs/tools/graphics/editres/default.nix
+++ b/pkgs/tools/graphics/editres/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "06kv7dmw6pzlqc46dbh8k9xpb6sn4ihh0bcpxq0zpvw2lm66dx45";
   };
 
-  buildInputs = [ pkgconfig libXt libXaw libXres utilmacros ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libXt libXaw libXres utilmacros ];
 
   configureFlags = "--with-appdefaultdir=$(out)/share/X11/app-defaults/editres";
 
diff --git a/pkgs/tools/graphics/exif/default.nix b/pkgs/tools/graphics/exif/default.nix
index 2534a9cbefac..537d1a8c7db9 100644
--- a/pkgs/tools/graphics/exif/default.nix
+++ b/pkgs/tools/graphics/exif/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "1zb9hwdl783d4vd2s2rw642hg8hd6n0mfp6lrbiqmp9jmhlq5rsr";
   };
 
-  buildInputs = [ pkgconfig libexif popt ] ++ libintlOrEmpty;
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libexif popt ] ++ libintlOrEmpty;
 
   meta = {
     homepage = http://libexif.sourceforge.net/;
diff --git a/pkgs/tools/graphics/ggobi/default.nix b/pkgs/tools/graphics/ggobi/default.nix
index e7fb3e773c1d..071c8f360792 100644
--- a/pkgs/tools/graphics/ggobi/default.nix
+++ b/pkgs/tools/graphics/ggobi/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "2c4ddc3ab71877ba184523e47b0637526e6f3701bd9afb6472e6dfc25646aed7";
   };
 
-  buildInputs = [ pkgconfig libxml2 gtk2 ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libxml2 gtk2 ];
 
   configureFlags = "--with-all-plugins";
 
diff --git a/pkgs/tools/graphics/glmark2/default.nix b/pkgs/tools/graphics/glmark2/default.nix
index e37ebb50bf73..0d31f8f1a6f7 100644
--- a/pkgs/tools/graphics/glmark2/default.nix
+++ b/pkgs/tools/graphics/glmark2/default.nix
@@ -12,8 +12,9 @@ stdenv.mkDerivation rec {
     sha256 = "076l75rfl6pnp1wgiwlaihy1vg2advg1z8bi0x84kk259kldgvwn";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    pkgconfig libjpeg libpng xorg.libxcb libX11 mesa libdrm python27 wayland libudev
+    libjpeg libpng xorg.libxcb libX11 mesa libdrm python27 wayland libudev
   ];
 
   buildPhase = ''
diff --git a/pkgs/tools/graphics/gromit-mpx/default.nix b/pkgs/tools/graphics/gromit-mpx/default.nix
index 376d1bc134df..7261326633a1 100644
--- a/pkgs/tools/graphics/gromit-mpx/default.nix
+++ b/pkgs/tools/graphics/gromit-mpx/default.nix
@@ -14,8 +14,9 @@ stdenv.mkDerivation rec {
     sha256 = "1dkmp5rhzp56sz9cfxill2pkdz2anwb8kkxkypvk2xhqi64cvkrs";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    autoconf automake autoreconfHook pkgconfig
+    autoconf automake autoreconfHook
     gtk glib pcre libappindicator libpthreadstubs
     libXdmcp libxkbcommon epoxy at_spi2_core
     dbus libdbusmenu-glib
diff --git a/pkgs/tools/graphics/leela/default.nix b/pkgs/tools/graphics/leela/default.nix
index 333b0f95b722..d1b31f391526 100644
--- a/pkgs/tools/graphics/leela/default.nix
+++ b/pkgs/tools/graphics/leela/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation {
     sha256 = "1k6n758r9dhjmc1pnpk6qzpg0q7pkq2hf18z3b0s2z198jpkg9s3";
   };
 
-  buildInputs = [ pkgconfig poppler ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ poppler ];
 
   installFlags = [ "PREFIX=$(out)" "MANDIR=$(out)/share/man" ];
 
diff --git a/pkgs/tools/graphics/logstalgia/default.nix b/pkgs/tools/graphics/logstalgia/default.nix
index f7f9211b5154..abebc0fc4ca6 100644
--- a/pkgs/tools/graphics/logstalgia/default.nix
+++ b/pkgs/tools/graphics/logstalgia/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
     sha256 = "1qghz1j3jmfj093br2hfyibayg3fmhg8fvp5ix9n9rbvzc1zslsm";
   };
 
-  buildInputs = [ glew SDL2 ftgl pkgconfig libpng libjpeg pcre SDL2_image mesa boost
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ glew SDL2 ftgl libpng libjpeg pcre SDL2_image mesa boost
                   glm freetype ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/graphics/pdf2svg/default.nix b/pkgs/tools/graphics/pdf2svg/default.nix
index dad611868bc2..058900b8e237 100644
--- a/pkgs/tools/graphics/pdf2svg/default.nix
+++ b/pkgs/tools/graphics/pdf2svg/default.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation rec {
     sha256 = "14ffdm4y26imq99wjhkrhy9lp33165xci1l5ndwfia8hz53bl02k";
   };
 
-  buildInputs = [ autoreconfHook cairo pkgconfig poppler gtk2 ];
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  buildInputs = [ cairo poppler gtk2 ];
 
   meta = with stdenv.lib; {
     description = "PDF converter to SVG format";
diff --git a/pkgs/tools/graphics/pngnq/default.nix b/pkgs/tools/graphics/pngnq/default.nix
index 5676b37042d1..e01f3ea2acc5 100644
--- a/pkgs/tools/graphics/pngnq/default.nix
+++ b/pkgs/tools/graphics/pngnq/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "1qmnnl846agg55i7h4vmrn11lgb8kg6gvs8byqz34bdkjh5gwiy1";
   };
 
-  buildInputs = [ pkgconfig libpng zlib ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libpng zlib ];
 
   patchPhase = ''
     sed -i '/png.h/a \#include <zlib.h>' src/rwpng.c
diff --git a/pkgs/tools/graphics/pngquant/default.nix b/pkgs/tools/graphics/pngquant/default.nix
index 78a2a7cb695e..93f57f95e3e2 100644
--- a/pkgs/tools/graphics/pngquant/default.nix
+++ b/pkgs/tools/graphics/pngquant/default.nix
@@ -13,7 +13,8 @@ stdenv.mkDerivation rec {
 
   preConfigure = "patchShebangs .";
 
-  buildInputs = [ pkgconfig libpng zlib lcms2 ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libpng zlib lcms2 ];
 
   meta = with stdenv.lib; {
     homepage = https://pngquant.org/;
diff --git a/pkgs/tools/graphics/quirc/default.nix b/pkgs/tools/graphics/quirc/default.nix
index a801dd8ebda9..caff97f0e32a 100644
--- a/pkgs/tools/graphics/quirc/default.nix
+++ b/pkgs/tools/graphics/quirc/default.nix
@@ -10,8 +10,9 @@ let
     rev = "5b262480091d5f84a67a4a56c728fc8b39844339";
     sha256 = "1w5qvjafn14s6jjs7kiwsqirlsqbgv0p152hrsq463pm34hp0lzy";
   };
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    SDL SDL_gfx libjpeg pkgconfig libpng
+    SDL SDL_gfx libjpeg libpng
   ];
 in
 stdenv.mkDerivation {
diff --git a/pkgs/tools/graphics/unpaper/default.nix b/pkgs/tools/graphics/unpaper/default.nix
index 2b64cbcc1f58..b58114a61a5d 100644
--- a/pkgs/tools/graphics/unpaper/default.nix
+++ b/pkgs/tools/graphics/unpaper/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0c5rbkxbmy9k8vxjh4cv0bgnqd3wqc99yzw215vkyjslvbsq8z13";
   };
 
-  buildInputs = [ pkgconfig libav libxslt ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libav libxslt ];
 
   meta = with stdenv.lib; {
     homepage = https://www.flameeyes.eu/projects/unpaper;
diff --git a/pkgs/tools/inputmethods/fcitx-engines/fcitx-anthy/default.nix b/pkgs/tools/inputmethods/fcitx-engines/fcitx-anthy/default.nix
index 9d8427e533cb..7f09b488c289 100644
--- a/pkgs/tools/inputmethods/fcitx-engines/fcitx-anthy/default.nix
+++ b/pkgs/tools/inputmethods/fcitx-engines/fcitx-anthy/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0ayrzfx95670k86y19bzl6i6w98haaln3x8dxpb39a5dwgz59pf8";
   };
 
-  buildInputs = [ cmake fcitx anthy gettext pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ cmake fcitx anthy gettext ];
 
   preInstall = ''
     substituteInPlace src/cmake_install.cmake \
diff --git a/pkgs/tools/inputmethods/fcitx-engines/fcitx-chewing/default.nix b/pkgs/tools/inputmethods/fcitx-engines/fcitx-chewing/default.nix
index 58695434cb6c..361355d1d688 100644
--- a/pkgs/tools/inputmethods/fcitx-engines/fcitx-chewing/default.nix
+++ b/pkgs/tools/inputmethods/fcitx-engines/fcitx-chewing/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0l548xdx2fvjya1ixp37pn382yak0m4kwfh9lgh7l3y2sblqw9zs";
   };
 
-  buildInputs = [ cmake fcitx gettext libchewing pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ cmake fcitx gettext libchewing ];
 
   preInstall = ''
    substituteInPlace src/cmake_install.cmake \
diff --git a/pkgs/tools/inputmethods/fcitx-engines/fcitx-cloudpinyin/default.nix b/pkgs/tools/inputmethods/fcitx-engines/fcitx-cloudpinyin/default.nix
index acd377441e2c..ebb6627dccae 100644
--- a/pkgs/tools/inputmethods/fcitx-engines/fcitx-cloudpinyin/default.nix
+++ b/pkgs/tools/inputmethods/fcitx-engines/fcitx-cloudpinyin/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "143x9gbswzfngvgfy77zskrzrpywj8qg2d19kisgfwfisk7yhcf1";
   };
 
-  buildInputs = [ cmake pkgconfig fcitx gettext curl ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ cmake fcitx gettext curl ];
 
   preInstall = ''
     substituteInPlace src/cmake_install.cmake \
diff --git a/pkgs/tools/inputmethods/fcitx-engines/fcitx-hangul/default.nix b/pkgs/tools/inputmethods/fcitx-engines/fcitx-hangul/default.nix
index 54b5335d9bb2..41560227bca0 100644
--- a/pkgs/tools/inputmethods/fcitx-engines/fcitx-hangul/default.nix
+++ b/pkgs/tools/inputmethods/fcitx-engines/fcitx-hangul/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "1jq78nczliw6pnhfac8hspffybrry6syk17y0wwcq05j3r3nd2lp";
   };
 
-  buildInputs = [ cmake fcitx libhangul gettext pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ cmake fcitx libhangul gettext ];
 
   preInstall = ''
     substituteInPlace src/cmake_install.cmake \
diff --git a/pkgs/tools/inputmethods/fcitx-engines/fcitx-libpinyin/default.nix b/pkgs/tools/inputmethods/fcitx-engines/fcitx-libpinyin/default.nix
index c441a4964b82..6022bcebc3b2 100644
--- a/pkgs/tools/inputmethods/fcitx-engines/fcitx-libpinyin/default.nix
+++ b/pkgs/tools/inputmethods/fcitx-engines/fcitx-libpinyin/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "19h0p1s8bkw24v7x6v19fg7dqpz2kkjlvvrqhypi5bkkvfswf7xn";
   };
 
-  buildInputs = [ cmake pkgconfig fcitx gettext libpinyin glib pcre dbus qt4 ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ cmake fcitx gettext libpinyin glib pcre dbus qt4 ];
 
   preInstall = ''
     substituteInPlace src/cmake_install.cmake \
diff --git a/pkgs/tools/inputmethods/fcitx-engines/fcitx-m17n/default.nix b/pkgs/tools/inputmethods/fcitx-engines/fcitx-m17n/default.nix
index ff42bbbbcc8e..c0c921f7b18d 100644
--- a/pkgs/tools/inputmethods/fcitx-engines/fcitx-m17n/default.nix
+++ b/pkgs/tools/inputmethods/fcitx-engines/fcitx-m17n/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0ffyhsg7bc6525k94kfhnja1h6ajlfprq72d286dp54cksnakyc4";
   };
 
-  buildInputs = [ cmake fcitx gettext m17n_lib m17n_db pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ cmake fcitx gettext m17n_lib m17n_db ];
 
   preInstall = ''
     substituteInPlace im/cmake_install.cmake \
diff --git a/pkgs/tools/inputmethods/fcitx-engines/fcitx-unikey/default.nix b/pkgs/tools/inputmethods/fcitx-engines/fcitx-unikey/default.nix
index 4581f80a75e0..ddfa41dda318 100644
--- a/pkgs/tools/inputmethods/fcitx-engines/fcitx-unikey/default.nix
+++ b/pkgs/tools/inputmethods/fcitx-engines/fcitx-unikey/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "063vc29v7ycaai98v3z4q319sv9sm91my17pmhblw1vifxnw02wf";
   };
 
-  buildInputs = [ cmake fcitx gettext pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ cmake fcitx gettext ];
 
   NIX_CFLAGS_COMPILE = "-Wno-narrowing";
 
diff --git a/pkgs/tools/inputmethods/fcitx/fcitx-configtool.nix b/pkgs/tools/inputmethods/fcitx/fcitx-configtool.nix
index 830342222617..b5b394c5b6cb 100644
--- a/pkgs/tools/inputmethods/fcitx/fcitx-configtool.nix
+++ b/pkgs/tools/inputmethods/fcitx/fcitx-configtool.nix
@@ -15,7 +15,8 @@ stdenv.mkDerivation rec {
     sha256 = "1ypr2jr3vzs2shqfrvhqy69xvagrn9x507180i9wxy14hb97a82r";
   };
 
-  buildInputs = [ makeWrapper fcitx cmake isocodes pkgconfig gtk3
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ makeWrapper fcitx cmake isocodes gtk3
     gnome3.defaultIconTheme ];
 
   preFixup = ''
diff --git a/pkgs/tools/inputmethods/ibus-engines/ibus-table-others/default.nix b/pkgs/tools/inputmethods/ibus-engines/ibus-table-others/default.nix
index f3e3973a2c3f..328c803e7dbc 100644
--- a/pkgs/tools/inputmethods/ibus-engines/ibus-table-others/default.nix
+++ b/pkgs/tools/inputmethods/ibus-engines/ibus-table-others/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0vmz82il796062jbla5pawsr5dqyhs7ald7xjp84zfccc09dg9kx";
   };
 
-  buildInputs = [ ibus ibus-table pkgconfig python3 ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ ibus ibus-table python3 ];
 
   preBuild = ''
     export HOME=$(mktemp -d)/ibus-table-others
diff --git a/pkgs/tools/inputmethods/ibus/ibus-qt.nix b/pkgs/tools/inputmethods/ibus/ibus-qt.nix
index 95c32532e407..8d02d4edde8e 100644
--- a/pkgs/tools/inputmethods/ibus/ibus-qt.nix
+++ b/pkgs/tools/inputmethods/ibus/ibus-qt.nix
@@ -9,8 +9,9 @@ stdenv.mkDerivation rec {
     sha256 = "1q9g7qghpcf07valc2ni7yf994xqx2pmdffknj7scxfidav6p19g";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    ibus cmake pkgconfig qt4 icu doxygen
+    ibus cmake qt4 icu doxygen
   ];
 
   cmakeFlags = [ "-DQT_PLUGINS_DIR=lib/qt4/plugins" ];
diff --git a/pkgs/tools/inputmethods/nabi/default.nix b/pkgs/tools/inputmethods/nabi/default.nix
index cb33abc3213d..7ca5af555f96 100644
--- a/pkgs/tools/inputmethods/nabi/default.nix
+++ b/pkgs/tools/inputmethods/nabi/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation {
     sha256 = "0craa24pw7b70sh253arv9bg9sy4q3mhsjwfss3bnv5nf0xwnncw";
   };
 
-  buildInputs = [ gtk2 libhangul pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ gtk2 libhangul ];
 
   meta = with stdenv.lib; {
     description = "The Easy Hangul XIM";
diff --git a/pkgs/tools/misc/appdata-tools/default.nix b/pkgs/tools/misc/appdata-tools/default.nix
index cdb5abcf453c..54c78874dd2e 100644
--- a/pkgs/tools/misc/appdata-tools/default.nix
+++ b/pkgs/tools/misc/appdata-tools/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
     sha256 = "1bzqg4gy8gqhbk2qjizsm0b78li9mv84fb3d8qwfpxh7c7p360x8";
   };
 
-  buildInputs = [ pkgconfig autoconf automake m4 intltool glib
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ autoconf automake m4 intltool glib
                   libsoup gdk_pixbuf ];
 
   configureScript = "./autogen.sh";
diff --git a/pkgs/tools/misc/blink1-tool/default.nix b/pkgs/tools/misc/blink1-tool/default.nix
index 29b199e5866b..9a09fba93e69 100644
--- a/pkgs/tools/misc/blink1-tool/default.nix
+++ b/pkgs/tools/misc/blink1-tool/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "05hbnp20cdvyyqf6jr01waz1ycis20qzsd8hn27snmn6qd48igrb";
   };
 
-  buildInputs = [ libusb1 pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libusb1 ];
 
   configurePhase = ''
     cd commandline
diff --git a/pkgs/tools/misc/brltty/default.nix b/pkgs/tools/misc/brltty/default.nix
index af9861ea6ed5..ea1ac6d116b1 100644
--- a/pkgs/tools/misc/brltty/default.nix
+++ b/pkgs/tools/misc/brltty/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "0slrqanwj9cm7ql0rpb296xq676zrc1sjyr13lh5lygp4b8qfpci";
   };
   
-  buildInputs = [ pkgconfig bluez ]
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ bluez ]
     ++ stdenv.lib.optional alsaSupport alsaLib
     ++ stdenv.lib.optional systemdSupport systemd;
   
diff --git a/pkgs/tools/misc/colord-gtk/default.nix b/pkgs/tools/misc/colord-gtk/default.nix
index 96022d01ef7d..c26f835c0ee5 100644
--- a/pkgs/tools/misc/colord-gtk/default.nix
+++ b/pkgs/tools/misc/colord-gtk/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "0i9y3bb5apj6a0f8cx36l6mjzs7xc0k7nf0magmf58vy2mzhpl18";
   };
 
-  buildInputs = [ intltool colord glib gtk3 pkgconfig lcms2 ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ intltool colord glib gtk3 lcms2 ];
 
   meta = {
     homepage = http://www.freedesktop.org/software/colord/intro.html;
diff --git a/pkgs/tools/misc/colord/default.nix b/pkgs/tools/misc/colord/default.nix
index 46f3786a6df3..40ea672296d8 100644
--- a/pkgs/tools/misc/colord/default.nix
+++ b/pkgs/tools/misc/colord/default.nix
@@ -10,7 +10,6 @@ stdenv.mkDerivation rec {
     url = "http://www.freedesktop.org/software/colord/releases/${name}.tar.xz";
     sha256 = "0flcsr148xshjbff030pgyk9ar25an901m9q1pjgjdvaq5j1h96m";
   };
-   nativeBuildInputs = [ autoreconfHook intltool ];
 
   enableParallelBuilding = true;
 
@@ -34,7 +33,9 @@ stdenv.mkDerivation rec {
     sed -e "s|if test -w .*;|if false;|" -i src/Makefile.{am,in}
   '';
 
-  buildInputs = [ glib polkit pkgconfig gusb libusb1 lcms2 sqlite systemd dbus gobjectIntrospection
+  nativeBuildInputs = [ autoreconfHook intltool pkgconfig ];
+
+  buildInputs = [ glib polkit gusb libusb1 lcms2 sqlite systemd dbus gobjectIntrospection
                   bash-completion argyllcms libgudev sane-backends ];
 
   postInstall = ''
diff --git a/pkgs/tools/misc/cunit/default.nix b/pkgs/tools/misc/cunit/default.nix
index dfa6bf71bb44..6bbf049d2445 100644
--- a/pkgs/tools/misc/cunit/default.nix
+++ b/pkgs/tools/misc/cunit/default.nix
@@ -4,7 +4,8 @@ stdenv.mkDerivation rec {
   name = "CUnit-${version}";
   version = "2.1-3";
 
-  buildInputs = [autoconf automake libtool autoreconfHook];
+  nativeBuildInputs = [ autoreconfHook ];
+  buildInputs = [autoconf automake libtool];
 
   src = fetchurl {
     url = "mirror://sourceforge/cunit/CUnit/${version}/${name}.tar.bz2";
diff --git a/pkgs/tools/misc/dbus-map/default.nix b/pkgs/tools/misc/dbus-map/default.nix
index b6f483fb4efd..8dcaecf9851c 100644
--- a/pkgs/tools/misc/dbus-map/default.nix
+++ b/pkgs/tools/misc/dbus-map/default.nix
@@ -9,8 +9,9 @@ stdenv.mkDerivation rec {
     rev = "43703fc5e15743309b67131b5ba457b0d6ea7667";
     sha256 = "1pjqn6w29ci8hfxkn1aynzfc8nvy3pqv3hixbxwr7qx20g4rwvdc";
   };
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    pkgconfig glib procps libxml2
+    glib procps libxml2
   ];
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/tools/misc/desktop-file-utils/default.nix b/pkgs/tools/misc/desktop-file-utils/default.nix
index 039ec27947af..e5e3815481f1 100644
--- a/pkgs/tools/misc/desktop-file-utils/default.nix
+++ b/pkgs/tools/misc/desktop-file-utils/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
     sha256 = "1ianvr2a69yjv4rpyv30w7yjsmnsb23crrka5ndqxycj4rkk4dc4";
   };
 
-  buildInputs = [ pkgconfig glib libintlOrEmpty ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ glib libintlOrEmpty ];
 
   NIX_LDFLAGS = optionalString stdenv.isDarwin "-lintl";
 
diff --git a/pkgs/tools/misc/duc/default.nix b/pkgs/tools/misc/duc/default.nix
index 06862a634238..7e98b7d64d2d 100644
--- a/pkgs/tools/misc/duc/default.nix
+++ b/pkgs/tools/misc/duc/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "1h7vll8a78ijan9bmnimmsviywmc39x8h9iikx8vm98kwyxi4xif";
   };
 
-  buildInputs = [ autoreconfHook pkgconfig tokyocabinet cairo pango ncurses ];
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  buildInputs = [ tokyocabinet cairo pango ncurses ];
 
   meta = with stdenv.lib; {
     homepage = http://duc.zevv.nl/;
diff --git a/pkgs/tools/misc/eot-utilities/default.nix b/pkgs/tools/misc/eot-utilities/default.nix
index f773ae6caac5..b44159be8ce8 100644
--- a/pkgs/tools/misc/eot-utilities/default.nix
+++ b/pkgs/tools/misc/eot-utilities/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     sha256 = "0cb41riabss23hgfg7vxhky09d6zqwjy1nxdvr3l2bh5qzd4kvaf";
   };
 
-  buildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
 
   meta = {
     homepage = http://www.w3.org/Tools/eot-utils/;
diff --git a/pkgs/tools/misc/fontforge/default.nix b/pkgs/tools/misc/fontforge/default.nix
index ee7854c539ed..c7fd29da8ac4 100644
--- a/pkgs/tools/misc/fontforge/default.nix
+++ b/pkgs/tools/misc/fontforge/default.nix
@@ -32,8 +32,9 @@ stdenv.mkDerivation rec {
   # do not use x87's 80-bit arithmetic, rouding errors result in very different font binaries
   NIX_CFLAGS_COMPILE = lib.optionals stdenv.isi686 [ "-msse2" "-mfpmath=sse" ];
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    autoconf automake gnum4 libtool perl pkgconfig gettext uthash
+    autoconf automake gnum4 libtool perl gettext uthash
     python freetype zlib glib libungif libpng libjpeg libtiff libxml2
   ]
     ++ lib.optionals withSpiro [libspiro]
diff --git a/pkgs/tools/misc/gbdfed/default.nix b/pkgs/tools/misc/gbdfed/default.nix
index 1ba4bceb7876..6307d012debd 100644
--- a/pkgs/tools/misc/gbdfed/default.nix
+++ b/pkgs/tools/misc/gbdfed/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0g09k6wim58hngxncq2brr7mwjm92j3famp0vs4b3p48wr65vcjx";
   };
 
-  buildInputs = [ pkgconfig freetype gtk ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ freetype gtk ];
 
   patches = [ ./Makefile.patch ];
 
diff --git a/pkgs/tools/misc/goaccess/default.nix b/pkgs/tools/misc/goaccess/default.nix
index 424a84637a53..8586244b4152 100644
--- a/pkgs/tools/misc/goaccess/default.nix
+++ b/pkgs/tools/misc/goaccess/default.nix
@@ -14,8 +14,8 @@ stdenv.mkDerivation rec {
     "--enable-utf8"
   ];
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    pkgconfig
     geoipWithDatabase
     ncurses
     glib
diff --git a/pkgs/tools/misc/grub/default.nix b/pkgs/tools/misc/grub/default.nix
index a690ef2084b2..bb565bacfe79 100644
--- a/pkgs/tools/misc/grub/default.nix
+++ b/pkgs/tools/misc/grub/default.nix
@@ -34,7 +34,8 @@ stdenv.mkDerivation {
   ] ++ (stdenv.lib.optional buggyBiosCDSupport ./buggybios.patch);
 
   # autoreconfHook required for the splashimage patch.
-  buildInputs = [ autoreconfHook texinfo ];
+  nativeBuildInputs = [ autoreconfHook ];
+  buildInputs = [ texinfo ];
 
   hardeningDisable = [ "stackprotector" ];
 
diff --git a/pkgs/tools/misc/gsmartcontrol/default.nix b/pkgs/tools/misc/gsmartcontrol/default.nix
index f362e7c53a24..d4322f051d0a 100644
--- a/pkgs/tools/misc/gsmartcontrol/default.nix
+++ b/pkgs/tools/misc/gsmartcontrol/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "1ipykzqpfvlr84j38hr7q2cag4imrn1gql10slp8bfrs4h1si3vh";
   };
 
-  buildInputs = [ smartmontools gtkmm2 libglademm pkgconfig pcre ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ smartmontools gtkmm2 libglademm pcre ];
 
   #installTargets = "install datainstall";
 
diff --git a/pkgs/tools/misc/kalibrate-rtl/default.nix b/pkgs/tools/misc/kalibrate-rtl/default.nix
index 19870b8de5b8..19ebd05e23c1 100644
--- a/pkgs/tools/misc/kalibrate-rtl/default.nix
+++ b/pkgs/tools/misc/kalibrate-rtl/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "1spbfflkqnw9s8317ppsf7b1nnkicqsmaqsnz1zf8i49ix70i6kn";
   };
 
-  buildInputs = [ autoreconfHook pkgconfig fftw rtl-sdr libusb1 ];
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  buildInputs = [ fftw rtl-sdr libusb1 ];
 
   meta = with stdenv.lib; {
     description = "Calculate local oscillator frequency offset in RTL-SDR devices";
diff --git a/pkgs/tools/misc/ldapvi/default.nix b/pkgs/tools/misc/ldapvi/default.nix
index d96409809a6e..72c9cecf5406 100644
--- a/pkgs/tools/misc/ldapvi/default.nix
+++ b/pkgs/tools/misc/ldapvi/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
     sha256 = "3ef3103030ecb04d7fe80180e3fd490377cf81fb2af96782323fddabc3225030";
   };
 
-  buildInputs = [ openldap openssl popt glib ncurses readline pkgconfig cyrus_sasl autoconf automake ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ openldap openssl popt glib ncurses readline cyrus_sasl autoconf automake ];
 
   preConfigure = ''
     cd ldapvi
diff --git a/pkgs/tools/misc/libbitcoin/libbitcoin-client.nix b/pkgs/tools/misc/libbitcoin/libbitcoin-client.nix
index 1f45626855f5..989c1f57b6ef 100644
--- a/pkgs/tools/misc/libbitcoin/libbitcoin-client.nix
+++ b/pkgs/tools/misc/libbitcoin/libbitcoin-client.nix
@@ -13,7 +13,8 @@ in stdenv.mkDerivation {
     sha256 = "1g79hl6jmf5dam7vq19h4dgdj7gcn19fa7q78vn573mg2rdyal53";
   };
 
-  buildInputs = [ autoreconfHook pkgconfig ];
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  buildInputs = [ ];
 
   propagatedBuildInputs = [ libsodium czmqpp libbitcoin ];
 
diff --git a/pkgs/tools/misc/libbitcoin/libbitcoin-explorer.nix b/pkgs/tools/misc/libbitcoin/libbitcoin-explorer.nix
index fbfa385fc7fc..7b6da9bdd3ed 100644
--- a/pkgs/tools/misc/libbitcoin/libbitcoin-explorer.nix
+++ b/pkgs/tools/misc/libbitcoin/libbitcoin-explorer.nix
@@ -13,7 +13,8 @@ in stdenv.mkDerivation {
     sha256 = "00123vw7rxk0ypdfzk0xwk8q55ll31000mkjqdzl915krsbkbfvp";
   };
 
-  buildInputs = [ autoreconfHook pkgconfig ];
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  buildInputs = [ ];
 
   propagatedBuildInputs = [ libbitcoin-client ];
 
diff --git a/pkgs/tools/misc/libbitcoin/libbitcoin.nix b/pkgs/tools/misc/libbitcoin/libbitcoin.nix
index 61c462f7853f..6d0c7b4e9c95 100644
--- a/pkgs/tools/misc/libbitcoin/libbitcoin.nix
+++ b/pkgs/tools/misc/libbitcoin/libbitcoin.nix
@@ -13,7 +13,8 @@ in stdenv.mkDerivation {
     sha256 = "1lpdjm13kgs4fbp579bwfvws8yf9mnr5dw3ph8zxg2gf110h85sy";
   };
 
-  buildInputs = [ autoreconfHook pkgconfig ];
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  buildInputs = [ ];
 
   propagatedBuildInputs = [ secp256k1 ];
 
diff --git a/pkgs/tools/misc/lnav/default.nix b/pkgs/tools/misc/lnav/default.nix
index 136951cb7bc5..5ab05c92135a 100644
--- a/pkgs/tools/misc/lnav/default.nix
+++ b/pkgs/tools/misc/lnav/default.nix
@@ -45,6 +45,7 @@ stdenv.mkDerivation rec {
     license = licenses.bsd2;
     version = "0.8.2";
     maintainers = [ maintainers.dochang ];
+    platforms = platforms.unix;
   };
 
 }
diff --git a/pkgs/tools/misc/mc/default.nix b/pkgs/tools/misc/mc/default.nix
index 0828fea81e1c..fb4093d89b86 100644
--- a/pkgs/tools/misc/mc/default.nix
+++ b/pkgs/tools/misc/mc/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
     sha256 = "1pzjq4nfxl2aakxipdjs5hq9n14374ly1l00s40kd2djnnxmd7pb";
   };
 
-  buildInputs = [ pkgconfig perl glib slang zip unzip file gettext libX11 libICE
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ perl glib slang zip unzip file gettext libX11 libICE
     libssh2 openssl ] ++ stdenv.lib.optionals (!stdenv.isDarwin) [ e2fsprogs gpm ];
 
   configureFlags = [ "--enable-vfs-smb" ];
diff --git a/pkgs/tools/misc/mdbtools/default.nix b/pkgs/tools/misc/mdbtools/default.nix
index 165780a5fa19..acb3bd9d3773 100644
--- a/pkgs/tools/misc/mdbtools/default.nix
+++ b/pkgs/tools/misc/mdbtools/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation {
     sha256 = "1lz33lmqifjszad7rl1r7rpxbziprrm5rkb27wmswyl5v98dqsbi";
   };
 
-  buildInputs = [glib readline bison flex pkgconfig];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [glib readline bison flex];
 
   preConfigure = ''
     sed -e 's@static \(GHashTable [*]mdb_backends;\)@\1@' -i src/libmdb/backend.c
diff --git a/pkgs/tools/misc/mdbtools/git.nix b/pkgs/tools/misc/mdbtools/git.nix
index 4f76306ab5f9..6289c35f35a7 100644
--- a/pkgs/tools/misc/mdbtools/git.nix
+++ b/pkgs/tools/misc/mdbtools/git.nix
@@ -10,8 +10,9 @@ stdenv.mkDerivation {
     sha256 = "0hlf5lk86xm0bpdlpk4a1zyfvbim76dhvmybxga2p7mbb1jc825l";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    glib readline bison flex autoreconfHook pkgconfig which txt2man
+    glib readline bison flex autoreconfHook which txt2man
     gnome_doc_utils scrollkeeper libiconv
   ];
 
diff --git a/pkgs/tools/misc/mprime/default.nix b/pkgs/tools/misc/mprime/default.nix
index 9a435622c7d7..2aea2530057c 100644
--- a/pkgs/tools/misc/mprime/default.nix
+++ b/pkgs/tools/misc/mprime/default.nix
@@ -23,7 +23,8 @@ stdenv.mkDerivation {
 
   unpackCmd = "unzip -d src -q $curSrc";
 
-  buildInputs = [ unzip pkgconfig curl ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ unzip curl ];
 
   patches = [ ./makefile.patch ];
 
diff --git a/pkgs/tools/misc/pal/default.nix b/pkgs/tools/misc/pal/default.nix
index f92069e7b9f5..267b458cccc6 100644
--- a/pkgs/tools/misc/pal/default.nix
+++ b/pkgs/tools/misc/pal/default.nix
@@ -14,7 +14,8 @@ stdenv.mkDerivation rec {
 
   makeFlags = "prefix=$(out)";
 
-  buildInputs = [ glib gettext readline pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ glib gettext readline ];
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/tools/misc/plantuml/default.nix b/pkgs/tools/misc/plantuml/default.nix
index f15c452c9550..447ef9dd5ec5 100644
--- a/pkgs/tools/misc/plantuml/default.nix
+++ b/pkgs/tools/misc/plantuml/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, jre, graphviz }:
 
 stdenv.mkDerivation rec {
-  version = "8047";
+  version = "1.2017.18";
   name = "plantuml-${version}";
 
   src = fetchurl {
-    url = "mirror://sourceforge/project/plantuml/plantuml.${version}.jar";
-    sha256 = "11a1qchalymvc7qn9kqxamp8qm8fljpnxmfi4zs8sg75nzddjnlm";
+    url = "mirror://sourceforge/project/plantuml/${version}/plantuml.${version}.jar";
+    sha256 = "0ssfg6lpk41ydhxhi6y6c9ca3hpql6gg3bxjws8vrx9s3s6r5rb0";
   };
 
   # It's only a .jar file and a shell wrapper
diff --git a/pkgs/tools/misc/qjoypad/default.nix b/pkgs/tools/misc/qjoypad/default.nix
index 663c60d28569..6a5e674b698b 100644
--- a/pkgs/tools/misc/qjoypad/default.nix
+++ b/pkgs/tools/misc/qjoypad/default.nix
@@ -5,7 +5,8 @@ stdenv.mkDerivation rec {
     url = "mirror://sourceforge/qjoypad/${name}.tar.gz";
     sha256 = "1jlm7i26nfp185xrl41kz5z6fgvyj51bjpz48cg27xx64y40iamm";
   };
-  buildInputs = [ pkgconfig libX11 libXtst qt4 ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libX11 libXtst qt4 ];
   patchPhase = ''
     cd src
     substituteInPlace config --replace /bin/bash /bin/sh
diff --git a/pkgs/tools/misc/riemann-c-client/default.nix b/pkgs/tools/misc/riemann-c-client/default.nix
index 54e5a3ab17e0..07c14ac76267 100644
--- a/pkgs/tools/misc/riemann-c-client/default.nix
+++ b/pkgs/tools/misc/riemann-c-client/default.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation rec {
     sha256 = "1j3wgf9xigsv6ckmv82gjj4wavi7xjn2zvj1f63fzbaa1rv7pf3s";
   };
 
-  buildInputs = [ autoreconfHook pkgconfig file protobufc ];
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  buildInputs = [ file protobufc ];
 
   meta = with stdenv.lib; {
     homepage = https://github.com/algernon/riemann-c-client;
diff --git a/pkgs/tools/misc/rmlint/default.nix b/pkgs/tools/misc/rmlint/default.nix
index e321670068cf..2ff86f5cbdf6 100644
--- a/pkgs/tools/misc/rmlint/default.nix
+++ b/pkgs/tools/misc/rmlint/default.nix
@@ -15,7 +15,8 @@ stdenv.mkDerivation rec {
 
   configurePhase = "scons config";
 
-  buildInputs = [ gettext glib json_glib libelf pkgconfig scons sphinx utillinux ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ gettext glib json_glib libelf scons sphinx utillinux ];
 
   buildPhase = "scons";
 
diff --git a/pkgs/tools/misc/rpm-ostree/default.nix b/pkgs/tools/misc/rpm-ostree/default.nix
index 3e2953c57334..d6cad51ce753 100644
--- a/pkgs/tools/misc/rpm-ostree/default.nix
+++ b/pkgs/tools/misc/rpm-ostree/default.nix
@@ -28,8 +28,9 @@ in stdenv.mkDerivation {
     sha256 = "0a0wwklzk1kvk3bbxxfvxgk4ck5dn7a7v32shqidb674fr2d5pvb";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    which autoconf automake pkgconfig libtool libcap ostree rpm glib libgsystem gperf
+    which autoconf automake libtool libcap ostree rpm glib libgsystem gperf
     json_glib libarchive libsolv librepo gtk_doc libxslt docbook_xsl docbook_xml_dtd_42
     cmake pcre check python
     # FIXME: get rid of this once libarchive properly propagates this
diff --git a/pkgs/tools/misc/toilet/default.nix b/pkgs/tools/misc/toilet/default.nix
index f9fee08d0dd0..2b240e022d81 100644
--- a/pkgs/tools/misc/toilet/default.nix
+++ b/pkgs/tools/misc/toilet/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "1pl118qb7g0frpgl9ps43w4sd0psjirpmq54yg1kqcclqcqbbm49";
   };
 
-  buildInputs = [ pkgconfig libcaca ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libcaca ];
 
   meta = {
     description = "Display large colourful characters in text mode";
diff --git a/pkgs/tools/misc/urjtag/default.nix b/pkgs/tools/misc/urjtag/default.nix
index 8d9d0073b178..99cd407a9ae4 100644
--- a/pkgs/tools/misc/urjtag/default.nix
+++ b/pkgs/tools/misc/urjtag/default.nix
@@ -17,7 +17,8 @@ stdenv.mkDerivation rec {
     sha256 = "0pyl0y27136nr8mmjdml7zjnfnpbjmgqzkjk99j3hvj38k10wq7f";
   };
 
-  buildInputs = [ gettext pkgconfig autoconf automake libtool bison flex which
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ gettext autoconf automake libtool bison flex which
     subversion makeWrapper readline libftdi libusb python3 ];
 
   configureFlags = ''
diff --git a/pkgs/tools/misc/wv/default.nix b/pkgs/tools/misc/wv/default.nix
index a18c03b126ac..59efcaa18095 100644
--- a/pkgs/tools/misc/wv/default.nix
+++ b/pkgs/tools/misc/wv/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "17f16lkdv1c3amaz2hagiicih59ynpp4786k1m2qa1sw68xhswsc";
   };
 
-  buildInputs = [ zlib imagemagick libpng glib pkgconfig libgsf libxml2 bzip2 ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ zlib imagemagick libpng glib libgsf libxml2 bzip2 ];
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/tools/misc/wv2/default.nix b/pkgs/tools/misc/wv2/default.nix
index f39eaf0b047b..b9a8f70ff71a 100644
--- a/pkgs/tools/misc/wv2/default.nix
+++ b/pkgs/tools/misc/wv2/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
 
   patches = [ ./fix-include.patch ];
 
-  buildInputs = [ pkgconfig cmake libgsf glib libxml2 ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ cmake libgsf glib libxml2 ];
 
   NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2";
 
diff --git a/pkgs/tools/misc/xsel/default.nix b/pkgs/tools/misc/xsel/default.nix
index 350cb89846a7..604868f8c490 100644
--- a/pkgs/tools/misc/xsel/default.nix
+++ b/pkgs/tools/misc/xsel/default.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation rec {
     sha256 = "04mrc8j0rr7iy1k6brfxnx26pmxm800gh4nqrxn6j2lz6vd5y9m5";
   };
 
-  buildInputs = [ libX11 autoreconfHook ];
+  nativeBuildInputs = [ autoreconfHook ];
+  buildInputs = [ libX11 ];
 
   # We need a README file, otherwise autoconf complains.
   postUnpack = ''
diff --git a/pkgs/tools/misc/yubico-piv-tool/default.nix b/pkgs/tools/misc/yubico-piv-tool/default.nix
index 6ff08e4ac3fa..c01e419ab239 100644
--- a/pkgs/tools/misc/yubico-piv-tool/default.nix
+++ b/pkgs/tools/misc/yubico-piv-tool/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "0l9lkzwi2227y5y02i5g1d701bmlyaj8lffv72jks1w4mkh7q7qh";
   };
 
-  buildInputs = [ pkgconfig openssl pcsclite ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ openssl pcsclite ];
 
   configureFlags = [ "--with-backend=pcsc" ];
 
diff --git a/pkgs/tools/networking/aircrack-ng/default.nix b/pkgs/tools/networking/aircrack-ng/default.nix
index 3b7c2926bd49..5a56430c20e9 100644
--- a/pkgs/tools/networking/aircrack-ng/default.nix
+++ b/pkgs/tools/networking/aircrack-ng/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "0dpzx9kddxpgzmgvdpl3rxn0jdaqhm5wxxndp1xd7d75mmmc2fnr";
   };
 
-  buildInputs = [ libpcap openssl zlib libnl pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libpcap openssl zlib libnl ];
 
   patchPhase = ''
     sed -e 's@^prefix.*@prefix = '$out@ -i common.mak
diff --git a/pkgs/tools/networking/argus-clients/default.nix b/pkgs/tools/networking/argus-clients/default.nix
index fe30a1eab826..766ae4116061 100644
--- a/pkgs/tools/networking/argus-clients/default.nix
+++ b/pkgs/tools/networking/argus-clients/default.nix
@@ -19,7 +19,8 @@ stdenv.mkDerivation rec {
 
   configureFlags = "--with-perl=${perl}/bin/perl";
 
-  buildInputs = [ libpcap pkgconfig bison cyrus_sasl tcp_wrappers flex ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libpcap bison cyrus_sasl tcp_wrappers flex ];
 
   meta = with stdenv.lib; {
     description = "Clients for ARGUS";
diff --git a/pkgs/tools/networking/argus/default.nix b/pkgs/tools/networking/argus/default.nix
index 673f98e2f3ad..e5c2aace4006 100644
--- a/pkgs/tools/networking/argus/default.nix
+++ b/pkgs/tools/networking/argus/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "1zzf688dbbcb5z2r9v1p28rddns6znzx35nc05ygza6lp7aknkna";
   };
 
-  buildInputs = [ libpcap pkgconfig bison cyrus_sasl tcp_wrappers flex ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libpcap bison cyrus_sasl tcp_wrappers flex ];
   propagatedBuildInputs = [ procps which wget lsof net_snmp ];
 
   patchPhase = ''
diff --git a/pkgs/tools/networking/badvpn/default.nix b/pkgs/tools/networking/badvpn/default.nix
index 22da8486a80b..632b52fd1560 100644
--- a/pkgs/tools/networking/badvpn/default.nix
+++ b/pkgs/tools/networking/badvpn/default.nix
@@ -9,8 +9,10 @@ let
     url="https://github.com/ambrop72/badvpn/archive/1.999.130.tar.gz";
     sha256="02b1fra43l75mljkhrq45vcrrqv0znicjn15g7nbqx3jppzbpm5z";
   };
+
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    cmake openssl nss pkgconfig nspr
+    cmake openssl nss nspr
   ];
   compileFlags = "-O3 ${stdenv.lib.optionalString (!debug) "-DNDEBUG"}";
 in
diff --git a/pkgs/tools/networking/ccnet/default.nix b/pkgs/tools/networking/ccnet/default.nix
index 22237794f079..24c86f4fa9a6 100644
--- a/pkgs/tools/networking/ccnet/default.nix
+++ b/pkgs/tools/networking/ccnet/default.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation rec
     sha256 = "0q4a102xlcsxlr53h4jr4w8qzkbzvm2f3nk9fsha48h6l2hw34bb";
   };
 
-  buildInputs = [ which automake autoconf pkgconfig libtool vala_0_23 python ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ which automake autoconf libtool vala_0_23 python ];
   propagatedBuildInputs = [ libsearpc libzdb libuuid libevent sqlite openssl ];
 
   preConfigure = ''
diff --git a/pkgs/tools/networking/connmanui/default.nix b/pkgs/tools/networking/connmanui/default.nix
index b5866c2ee130..7c42cc965a00 100644
--- a/pkgs/tools/networking/connmanui/default.nix
+++ b/pkgs/tools/networking/connmanui/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "0ixx8c9cfdp480z21xfjb7n1x27sf1g8gmgbmcfhr0k888dmziyy";
   };
 
-  buildInputs = [ autoconf automake libtool glib gtk3 dbus pkgconfig file intltool connman ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ autoconf automake libtool glib gtk3 dbus file intltool connman ];
 
   preConfigure = ''
     rm m4/intltool.m4
diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index 4ec79af66516..c01dbbaa3a71 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -21,11 +21,11 @@ assert scpSupport -> libssh2 != null;
 assert c-aresSupport -> c-ares != null;
 
 stdenv.mkDerivation rec {
-  name = "curl-7.55.1";
+  name = "curl-7.56.0";
 
   src = fetchurl {
     url = "http://curl.haxx.se/download/${name}.tar.bz2";
-    sha256 = "1yvcn7jbh99gsqhc040nky0h15a1cfh8yic6k0a1zhdhscpakcg5";
+    sha256 = "1pvr2bqfhk46bzq2x2hskmnq3wc8qxlps7apm9q1qiixb9ra8q6y";
   };
 
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
@@ -68,8 +68,8 @@ stdenv.mkDerivation rec {
     ++ stdenv.lib.optional c-aresSupport "--enable-ares=${c-ares}"
     ++ stdenv.lib.optional gssSupport "--with-gssapi=${gss}";
 
-  CXX = "g++";
-  CXXCPP = "g++ -E";
+  CXX = "c++";
+  CXXCPP = "c++ -E";
 
   postInstall = ''
     moveToOutput bin/curl-config "$dev"
diff --git a/pkgs/tools/networking/davix/default.nix b/pkgs/tools/networking/davix/default.nix
index 37226d3dd7b2..3be2b0401bc4 100644
--- a/pkgs/tools/networking/davix/default.nix
+++ b/pkgs/tools/networking/davix/default.nix
@@ -2,7 +2,8 @@
 
 stdenv.mkDerivation rec {
   name = "davix-0.6.4";
-  buildInputs = [ stdenv pkgconfig cmake openssl libxml2 boost ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ stdenv cmake openssl libxml2 boost ];
 
   src = fetchFromGitHub {
     owner = "cern-it-sdc-id";
diff --git a/pkgs/tools/networking/dhcpcd/default.nix b/pkgs/tools/networking/dhcpcd/default.nix
index 7204ddd5e06f..d8316c66203d 100644
--- a/pkgs/tools/networking/dhcpcd/default.nix
+++ b/pkgs/tools/networking/dhcpcd/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "17nnhxmbdcc7k2mh6sgvxisqcqbic5540xbig363ds97gvf795kg";
   };
 
-  buildInputs = [ pkgconfig udev ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ udev ];
 
   configureFlags = [
     "--sysconfdir=/etc"
diff --git a/pkgs/tools/networking/driftnet/default.nix b/pkgs/tools/networking/driftnet/default.nix
index 1f34952ad24b..5b39ca464601 100644
--- a/pkgs/tools/networking/driftnet/default.nix
+++ b/pkgs/tools/networking/driftnet/default.nix
@@ -8,8 +8,9 @@ stdenv.mkDerivation rec {
   name = "driftnet-${version}";
   version = "1.1.5";
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    pkgconfig libpcap libjpeg libungif libpng giflib
+    libpcap libjpeg libungif libpng giflib
     glib gtk2 glib cairo pango gdk_pixbuf atk autoreconfHook
   ];
 
diff --git a/pkgs/tools/networking/gftp/default.nix b/pkgs/tools/networking/gftp/default.nix
index b122f532630d..312906f95100 100644
--- a/pkgs/tools/networking/gftp/default.nix
+++ b/pkgs/tools/networking/gftp/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation {
     sha256 = "1z8b26n23k0sjbxgrix646b06cnpndpq7cbcj0ilsvvdx5ms81jk";
   };
 
-  buildInputs = [ gtk2 readline ncurses gettext openssl pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ gtk2 readline ncurses gettext openssl ];
 
   meta = { 
     description = "GTK+-based FTP client";
diff --git a/pkgs/tools/networking/gupnp-tools/default.nix b/pkgs/tools/networking/gupnp-tools/default.nix
index ea78cdd106ac..fcbf5a4e1b2a 100644
--- a/pkgs/tools/networking/gupnp-tools/default.nix
+++ b/pkgs/tools/networking/gupnp-tools/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "1vbr4iqi7nl7kq982agd3liw10gx67s95idd0pjy5h1jsnwyqgda";
   };
 
-  buildInputs = [gupnp libuuid gssdp pkgconfig gtk3 intltool gupnp_av
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [gupnp libuuid gssdp gtk3 intltool gupnp_av
                  gnome2.gnome_icon_theme makeWrapper];
 
   postInstall = ''
diff --git a/pkgs/tools/networking/hyenae/default.nix b/pkgs/tools/networking/hyenae/default.nix
index a7d42b773172..cbcaee4de784 100644
--- a/pkgs/tools/networking/hyenae/default.nix
+++ b/pkgs/tools/networking/hyenae/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation {
     sha256 = "1f3x4yn9a9p4f4wk4l8pv7hxfjc8q7cv20xzf7ky735sq1hj0xcg";
   };
 
-  buildInputs = [libdnet pkgconfig libpcap];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [libdnet libpcap];
 
   meta = {
     description = "";
diff --git a/pkgs/tools/networking/isync/default.nix b/pkgs/tools/networking/isync/default.nix
index 761dc01d2f98..8b81e0696c23 100644
--- a/pkgs/tools/networking/isync/default.nix
+++ b/pkgs/tools/networking/isync/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "1bij6nm06ghkg98n2pdyacam2fyg5y8f7ajw0d5653m0r4ldw5p7";
   };
 
-  buildInputs = [ openssl pkgconfig db cyrus_sasl ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ openssl db cyrus_sasl ];
 
   meta = with stdenv.lib; {
     homepage = http://isync.sourceforge.net/;
diff --git a/pkgs/tools/networking/jnettop/default.nix b/pkgs/tools/networking/jnettop/default.nix
index ec2f34f56010..19626174ba4c 100644
--- a/pkgs/tools/networking/jnettop/default.nix
+++ b/pkgs/tools/networking/jnettop/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "1855np7c4b0bqzhf1l1dyzxb90fpnvrirdisajhci5am6als31z9";
   };
 
-  buildInputs = [ autoconf libpcap ncurses pkgconfig glib ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ autoconf libpcap ncurses glib ];
 
   patches = [
     ./no-dns-resolution.patch
diff --git a/pkgs/tools/networking/libreswan/default.nix b/pkgs/tools/networking/libreswan/default.nix
index de7f38314fc6..59e33e818702 100644
--- a/pkgs/tools/networking/libreswan/default.nix
+++ b/pkgs/tools/networking/libreswan/default.nix
@@ -24,8 +24,8 @@ stdenv.mkDerivation {
     sha256 = "0zginnakxw7m79zrdvfdvliaiyg78zgqfqkks9z5d1rjj5w13xig";
   };
 
-  nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ pkgconfig bash iproute iptables systemd coreutils gnused gawk gmp unbound bison flex pam libevent
+  nativeBuildInputs = [ makeWrapper pkgconfig ];
+  buildInputs = [ bash iproute iptables systemd coreutils gnused gawk gmp unbound bison flex pam libevent
                   libcap_ng curl nspr nss python ]
                 ++ optional docs xmlto;
 
diff --git a/pkgs/tools/networking/maildrop/default.nix b/pkgs/tools/networking/maildrop/default.nix
index da36ef727c2d..950a6e310ebd 100644
--- a/pkgs/tools/networking/maildrop/default.nix
+++ b/pkgs/tools/networking/maildrop/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "1a94p2b41iy334cwfwmzi19557dn5j61abh0cp2rfc9dkc8ibhdg";
   };
 
-  buildInputs = [ pkgconfig pcre perl ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ pcre perl ];
 
   patches = [ ./maildrop.configure.hack.patch ]; # for building in chroot
 
diff --git a/pkgs/tools/networking/mitmproxy/default.nix b/pkgs/tools/networking/mitmproxy/default.nix
index 583100e0f371..7348cd7f1165 100644
--- a/pkgs/tools/networking/mitmproxy/default.nix
+++ b/pkgs/tools/networking/mitmproxy/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchpatch, fetchFromGitHub, python3, glibcLocales }:
+{ stdenv, fetchpatch, fetchFromGitHub, fetchurl, python3, glibcLocales }:
 
 let
   p = python3.override {
@@ -19,6 +19,19 @@ let
           sha256 = "00daa04c9870345f56605d91d7d4897bc1b16f6fff7c74cb602b08ef16c0fb43";
         };
       });
+      pyopenssl = super.pyopenssl.overridePythonAttrs (oldAttrs: rec {
+        version = "17.0.0";
+        name = "${oldAttrs.pname}-${version}";
+        src = oldAttrs.src.override {
+          inherit version;
+          sha256 = "1pdg1gpmkzj8yasg6cmkhcivxcdp4c12nif88y4qvsxq5ffzxas8";
+        };
+        patches = fetchpatch {
+          url = "https://github.com/pyca/pyopenssl/commit/"
+              + "a40898b5f1d472f9449a344f703fa7f90cddc21d.patch";
+          sha256 = "0bdfrhfvdfxhfknn46s4db23i3hww6ami2r1l5rfrri0pn8b8mh7";
+        };
+      });
     };
   };
 in p.pkgs.buildPythonPackage rec {
@@ -70,6 +83,6 @@ in p.pkgs.buildPythonPackage rec {
     description = "Man-in-the-middle proxy";
     homepage = http://mitmproxy.org/;
     license = licenses.mit;
-    maintainers = with maintainers; [ fpletz ];
+    maintainers = with maintainers; [ fpletz kamilchm ];
   };
 }
diff --git a/pkgs/tools/networking/mosh/default.nix b/pkgs/tools/networking/mosh/default.nix
index 1f465bc4f8a8..e66209c7ce95 100644
--- a/pkgs/tools/networking/mosh/default.nix
+++ b/pkgs/tools/networking/mosh/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "05hjhlp6lk8yjcy59zywpf0r6s0h0b9zxq0lw66dh9x8vxrhaq6s";
   };
 
-  buildInputs = [ autoreconfHook protobuf ncurses zlib pkgconfig IOTty makeWrapper perl openssl ];
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  buildInputs = [ protobuf ncurses zlib IOTty makeWrapper perl openssl ];
 
   patches = [ ./ssh_path.patch ];
   postPatch = ''
diff --git a/pkgs/tools/networking/ndjbdns/default.nix b/pkgs/tools/networking/ndjbdns/default.nix
index 3269f92d7f42..255d430a3a5d 100644
--- a/pkgs/tools/networking/ndjbdns/default.nix
+++ b/pkgs/tools/networking/ndjbdns/default.nix
@@ -13,7 +13,8 @@ stdenv.mkDerivation rec {
     sha256 = "0gjyvn8r66kp49gasd6sqfvg2pj0c6v67hnq7cqwl04kj69rfy86";
   };
 
-  buildInputs = [ autoreconfHook pkgconfig ]
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  buildInputs = [ ]
     ++ optional stdenv.isLinux systemd;
 
   meta = {
diff --git a/pkgs/tools/networking/nss-pam-ldapd/default.nix b/pkgs/tools/networking/nss-pam-ldapd/default.nix
index 9e7282c40bdd..93646d58cd30 100644
--- a/pkgs/tools/networking/nss-pam-ldapd/default.nix
+++ b/pkgs/tools/networking/nss-pam-ldapd/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "1sw36w6zkzvabvjckqick032j5p5xi0qi3sgnh0znzxz31jqvf0d";
   };
   
-  buildInputs = [ makeWrapper pkgconfig python openldap pam ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ makeWrapper python openldap pam ];
 
   preConfigure = ''
     substituteInPlace Makefile.in --replace "install-data-local: " "# install-data-local: "
diff --git a/pkgs/tools/networking/openconnect/default.nix b/pkgs/tools/networking/openconnect/default.nix
index 4fccb107771a..132ae3cf0da0 100644
--- a/pkgs/tools/networking/openconnect/default.nix
+++ b/pkgs/tools/networking/openconnect/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
     "--without-openssl-version-check"
   ];
 
-  buildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
   propagatedBuildInputs = [ vpnc openssl gnutls gmp libxml2 stoken zlib ];
 
   meta = {
diff --git a/pkgs/tools/networking/openfortivpn/default.nix b/pkgs/tools/networking/openfortivpn/default.nix
index 48abd9a33742..b1ecc6cba89b 100644
--- a/pkgs/tools/networking/openfortivpn/default.nix
+++ b/pkgs/tools/networking/openfortivpn/default.nix
@@ -14,6 +14,7 @@ in stdenv.mkDerivation {
     rev = "v${version}";
     sha256 = "0fm0z73afghwmbshpsn5jfbyyfzz1v8s7scwycnvsk2cgv5f4r86";
   };
+
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
   buildInputs = [ openssl ppp ];
 
diff --git a/pkgs/tools/networking/openssh/default.nix b/pkgs/tools/networking/openssh/default.nix
index 8343f23a1a03..79f203f77470 100644
--- a/pkgs/tools/networking/openssh/default.nix
+++ b/pkgs/tools/networking/openssh/default.nix
@@ -56,7 +56,8 @@ stdenv.mkDerivation rec {
       substituteInPlace Makefile.in --replace '$(INSTALL) -m 4711' '$(INSTALL) -m 0711'
     '';
 
-  buildInputs = [ zlib openssl libedit pkgconfig pam ]
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ zlib openssl libedit pam ]
     ++ optional withKerberos kerberos
     ++ optional hpnSupport autoreconfHook;
 
diff --git a/pkgs/tools/networking/p2p/libtorrent/default.nix b/pkgs/tools/networking/p2p/libtorrent/default.nix
index 9646c47a8d71..87785f50e6fa 100644
--- a/pkgs/tools/networking/p2p/libtorrent/default.nix
+++ b/pkgs/tools/networking/p2p/libtorrent/default.nix
@@ -15,7 +15,8 @@ stdenv.mkDerivation rec {
     sha256 = "0y9759sxx5dyamyw8w58dsxq7bmnn57q7s2f4cw2zln2pp5gripw";
   };
 
-  buildInputs = [ pkgconfig libtool autoconf automake cppunit openssl libsigcxx zlib ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libtool autoconf automake cppunit openssl libsigcxx zlib ];
 
   preConfigure = "./autogen.sh";
 
diff --git a/pkgs/tools/networking/p2p/rtorrent/default.nix b/pkgs/tools/networking/p2p/rtorrent/default.nix
index bd3c28504800..6ab462ac5a8c 100644
--- a/pkgs/tools/networking/p2p/rtorrent/default.nix
+++ b/pkgs/tools/networking/p2p/rtorrent/default.nix
@@ -18,8 +18,9 @@ stdenv.mkDerivation rec {
     sha256 = "0cxyakc09bn6wjfj42gh508hc62awx825skzacpizx2bqs6v7xvb";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    pkgconfig libtool autoconf automake cppunit
+    libtool autoconf automake cppunit
     libtorrent ncurses libsigcxx curl zlib openssl xmlrpc_c
   ];
 
diff --git a/pkgs/tools/networking/samplicator/default.nix b/pkgs/tools/networking/samplicator/default.nix
index 1b537870b09d..5cb65b78ee8b 100644
--- a/pkgs/tools/networking/samplicator/default.nix
+++ b/pkgs/tools/networking/samplicator/default.nix
@@ -4,7 +4,8 @@ stdenv.mkDerivation rec {
   name = "samplicator-${version}";
   version = "1.3.8rc1";
 
-  buildInputs = [ autoreconfHook ];
+  nativeBuildInputs = [ autoreconfHook ];
+  buildInputs = [ ];
 
   src = fetchFromGitHub {
     owner = "sleinen";
diff --git a/pkgs/tools/networking/tlspool/default.nix b/pkgs/tools/networking/tlspool/default.nix
index 53465a0242dd..acb5a042ffcc 100644
--- a/pkgs/tools/networking/tlspool/default.nix
+++ b/pkgs/tools/networking/tlspool/default.nix
@@ -19,7 +19,8 @@ stdenv.mkDerivation rec {
   };
 
   propagatedBuildInputs = [ python softhsm openldap p11_kit.dev p11_kit.out gnupg ];
-  buildInputs = [ unbound pkgconfig unzip git libtasn1 db libmemcached cyrus_sasl openssl bash quickder
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ unbound unzip git libtasn1 db libmemcached cyrus_sasl openssl bash quickder
                   libkrb5 ldns libtool swig pkgs.pythonPackages.pip gnutls-kdh ]
                 ++ stdenv.lib.optional useSystemd systemd;
 
diff --git a/pkgs/tools/networking/tracebox/default.nix b/pkgs/tools/networking/tracebox/default.nix
index 8c443282e5cb..c3abdd49e138 100644
--- a/pkgs/tools/networking/tracebox/default.nix
+++ b/pkgs/tools/networking/tracebox/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0gxdapm6b5a41gymi1f0nr2kyz70vllnk10085yz3pq527gp9gns";
   };
 
-  buildInputs = [ autoreconfHook libcrafter lua ];
+  nativeBuildInputs = [ autoreconfHook ];
+  buildInputs = [ libcrafter lua ];
 
   configureFlags = [ "--with-lua=yes" ];
 
diff --git a/pkgs/tools/package-management/apt/default.nix b/pkgs/tools/package-management/apt/default.nix
index 8082565361b9..fe7327e7d855 100644
--- a/pkgs/tools/package-management/apt/default.nix
+++ b/pkgs/tools/package-management/apt/default.nix
@@ -24,8 +24,10 @@ stdenv.mkDerivation rec {
     sha256 = "0ahwhmscrmnpvl1r732wg93dzkhv8c1sph2yrqgsrhr73c1616ix";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
+
   buildInputs = [
-    pkgconfig cmake perl curl gtest lzma bzip2 lz4 db dpkg libxslt.bin
+    cmake perl curl gtest lzma bzip2 lz4 db dpkg libxslt.bin
   ] ++ lib.optionals withDocs [
     doxygen Po4a w3m
   ] ++ lib.optionals withNLS [
diff --git a/pkgs/tools/package-management/disnix/default.nix b/pkgs/tools/package-management/disnix/default.nix
index f260241fe6ba..830c576c4062 100644
--- a/pkgs/tools/package-management/disnix/default.nix
+++ b/pkgs/tools/package-management/disnix/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation {
     sha256 = "1cgf7hgqrwsqgyc77sis0hr7cwgk3vx8cd4msgq11qbwywi3b6id";
   };
   
-  buildInputs = [ pkgconfig glib libxml2 libxslt getopt nixUnstable libintlOrEmpty libiconv dysnomia ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ glib libxml2 libxslt getopt nixUnstable libintlOrEmpty libiconv dysnomia ];
 
   meta = {
     description = "A Nix-based distributed service deployment tool";
diff --git a/pkgs/tools/package-management/disnix/disnixos/default.nix b/pkgs/tools/package-management/disnix/disnixos/default.nix
index 2a6a0dcc78a3..98d1802f881a 100644
--- a/pkgs/tools/package-management/disnix/disnixos/default.nix
+++ b/pkgs/tools/package-management/disnix/disnixos/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation {
     sha256 = "0pqv8n9942vjwmb32m1af29fi0vjlsbwkj2c7h1xs28z6wahr7wa";
   };
   
-  buildInputs = [ socat pkgconfig dysnomia disnix getopt ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ socat dysnomia disnix getopt ];
   
   meta = {
     description = "Provides complementary NixOS infrastructure deployment to Disnix";
diff --git a/pkgs/tools/package-management/nix-index/default.nix b/pkgs/tools/package-management/nix-index/default.nix
index 388942f6ad87..70cd83b87a3b 100644
--- a/pkgs/tools/package-management/nix-index/default.nix
+++ b/pkgs/tools/package-management/nix-index/default.nix
@@ -13,7 +13,8 @@ buildRustPackage rec {
     sha256 = "1lmg65yqkwf2a5qxm3dmv8158kqhnriir062vlgar5wimf409rm5";
   };
   depsSha256 = "0v145fi9bfiwvsdy7hz9lw4m2f2j8sxvixfzmjwfnq4klm51c8yl";
-  buildInputs = [pkgconfig openssl curl];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ openssl curl];
 
   postInstall = ''
     mkdir -p $out/etc/profile.d
diff --git a/pkgs/tools/package-management/rpm/default.nix b/pkgs/tools/package-management/rpm/default.nix
index 78d815eb7c19..860be0e1f791 100644
--- a/pkgs/tools/package-management/rpm/default.nix
+++ b/pkgs/tools/package-management/rpm/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" "man" ];
 
-  buildInputs = [ cpio zlib bzip2 file libarchive nspr nss db xz python lua pkgconfig autoreconfHook ];
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  buildInputs = [ cpio zlib bzip2 file libarchive nspr nss db xz python lua ];
 
   # rpm/rpmlib.h includes popt.h, and then the pkg-config file mentions these as linkage requirements
   propagatedBuildInputs = [ popt elfutils nss db bzip2 libarchive binutils ];
diff --git a/pkgs/tools/security/aespipe/default.nix b/pkgs/tools/security/aespipe/default.nix
index aefd6b7500ce..c67c758b933d 100644
--- a/pkgs/tools/security/aespipe/default.nix
+++ b/pkgs/tools/security/aespipe/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "aespipe-${version}";
-  version = "2.4d";
+  version = "2.4e";
 
   src = fetchurl {
     url = "mirror://sourceforge/loop-aes/aespipe/aespipe-v${version}.tar.bz2";
-    sha256 = "03z5i41xv6p3m79lm04d7msda8878lsppv3324zbjjfy19p6bkn5";
+    sha256 = "0fmr0vk408bf13jydhdmcdhqw31yc9qk329bs9i60alccywapmds";
   };
 
   meta = {
diff --git a/pkgs/tools/security/crackxls/default.nix b/pkgs/tools/security/crackxls/default.nix
index f4c92ac701f4..2a88e4462b6d 100644
--- a/pkgs/tools/security/crackxls/default.nix
+++ b/pkgs/tools/security/crackxls/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "0q5jl7hcds3f0rhly3iy4fhhbyh9cdrfaw7zdrazzf1wswwhyssz";
   };
 
-  buildInputs = [ pkgconfig autoconf automake openssl libgsf gmp ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ autoconf automake openssl libgsf gmp ];
 
   installPhase =
   ''
diff --git a/pkgs/tools/security/ecryptfs/default.nix b/pkgs/tools/security/ecryptfs/default.nix
index f8ef409813cc..91546f1a78f4 100644
--- a/pkgs/tools/security/ecryptfs/default.nix
+++ b/pkgs/tools/security/ecryptfs/default.nix
@@ -33,7 +33,8 @@ stdenv.mkDerivation rec {
     done
   '';
 
-  buildInputs = [ pkgconfig perl nss nspr python2 pam intltool makeWrapper ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ perl nss nspr python2 pam intltool makeWrapper ];
   propagatedBuildInputs = [ coreutils gettext cryptsetup lvm2 rsync keyutils which ];
 
   postInstall = ''
diff --git a/pkgs/tools/security/fpm2/default.nix b/pkgs/tools/security/fpm2/default.nix
index 8bb3cba15c46..69b4b36fb9b3 100644
--- a/pkgs/tools/security/fpm2/default.nix
+++ b/pkgs/tools/security/fpm2/default.nix
@@ -13,7 +13,8 @@ stdenv.mkDerivation rec {
     sha256 = "d55e9ce6be38a44fc1053d82db2d117cf3991a51898bd86d7913bae769f04da7";
   };
 
-  buildInputs = [ pkgconfig gnupg gtk2 libxml2 intltool ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ gnupg gtk2 libxml2 intltool ];
 
   meta = {
     description = "FPM2 is GTK2 port from Figaro's Password Manager originally developed by John Conneely, with some new enhancements.";
diff --git a/pkgs/tools/security/gencfsm/default.nix b/pkgs/tools/security/gencfsm/default.nix
index fbd32cdc22df..c180ca6c7202 100644
--- a/pkgs/tools/security/gencfsm/default.nix
+++ b/pkgs/tools/security/gencfsm/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "1rpf683lxa78fmxxb0hnq7vdh3yn7qid2gqq67q9mk65sp9vdhdj";
   };
 
-  buildInputs = [ autoconf automake intltool libtool pkgconfig vala glib encfs
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ autoconf automake intltool libtool vala glib encfs
     gtk3 libgnome_keyring gnome3.libgee xorg.libSM xorg.libICE
     wrapGAppsHook ];
 
diff --git a/pkgs/tools/security/gnupg/22.nix b/pkgs/tools/security/gnupg/22.nix
index 87686cd52c12..18d784a59bb7 100644
--- a/pkgs/tools/security/gnupg/22.nix
+++ b/pkgs/tools/security/gnupg/22.nix
@@ -22,8 +22,9 @@ stdenv.mkDerivation rec {
     sha256 = "1yv2pwf3vhv9dpbf51fnm0wy03va1cg5r7qaz7rg75cwbgb0rmrl";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    pkgconfig libgcrypt libassuan libksba libiconv npth gettext texinfo
+    libgcrypt libassuan libksba libiconv npth gettext texinfo
     readline libusb gnutls adns openldap zlib bzip2 sqlite
   ];
 
diff --git a/pkgs/tools/security/mfcuk/default.nix b/pkgs/tools/security/mfcuk/default.nix
index 9a593907a533..ebd9a6d5e7ee 100644
--- a/pkgs/tools/security/mfcuk/default.nix
+++ b/pkgs/tools/security/mfcuk/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0m9sy61rsbw63xk05jrrmnyc3xda0c3m1s8pg3sf8ijbbdv9axcp";
   };
 
-  buildInputs = [ pkgconfig libnfc ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libnfc ];
 
   meta = with stdenv.lib; {
     description = "MiFare Classic Universal toolKit";
diff --git a/pkgs/tools/security/mfoc/default.nix b/pkgs/tools/security/mfoc/default.nix
index a223b3e835ae..8a454ca67fde 100644
--- a/pkgs/tools/security/mfoc/default.nix
+++ b/pkgs/tools/security/mfoc/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
 
   patches = [./mf_mini.patch];
 
-  buildInputs = [ pkgconfig libnfc ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libnfc ];
 
   meta = with stdenv.lib; {
     description = "Mifare Classic Offline Cracker";
diff --git a/pkgs/tools/security/nmap/default.nix b/pkgs/tools/security/nmap/default.nix
index b3c1a32f22be..45f995a59350 100644
--- a/pkgs/tools/security/nmap/default.nix
+++ b/pkgs/tools/security/nmap/default.nix
@@ -46,7 +46,8 @@ in stdenv.mkDerivation rec {
       wrapProgram $out/bin/zenmap --prefix PYTHONPATH : "$(toPythonPath $out)" --prefix PYTHONPATH : "$PYTHONPATH" --prefix PYTHONPATH : $(toPythonPath $pygtk)/gtk-2.0 --prefix PYTHONPATH : $(toPythonPath $pygobject)/gtk-2.0 --prefix PYTHONPATH : $(toPythonPath $pycairo)/gtk-2.0
   '';
 
-  buildInputs = with python2Packages; [ libpcap pkgconfig openssl ]
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = with python2Packages; [ libpcap openssl ]
     ++ optionals pythonSupport [ makeWrapper python ]
     ++ optionals graphicalSupport [
       libX11 gtk2 pygtk pysqlite pygobject2 pycairo
diff --git a/pkgs/tools/security/opensc/default.nix b/pkgs/tools/security/opensc/default.nix
index 2b606d505bdc..ce310eec5aed 100644
--- a/pkgs/tools/security/opensc/default.nix
+++ b/pkgs/tools/security/opensc/default.nix
@@ -15,8 +15,9 @@ stdenv.mkDerivation rec {
     sha256 = "16y3ryx606nry2li05hm88bllrragdj3sfl3yh7pf71777n4lsk4";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    autoreconfHook pkgconfig zlib readline openssl pcsclite libassuan
+    autoreconfHook zlib readline openssl pcsclite libassuan
     libXt libxslt libiconv docbook_xml_dtd_412
   ] ++ stdenv.lib.optional stdenv.isDarwin Carbon;
 
diff --git a/pkgs/tools/security/qdigidoc/default.nix b/pkgs/tools/security/qdigidoc/default.nix
index e4141d1a61b6..1e626084ee3a 100644
--- a/pkgs/tools/security/qdigidoc/default.nix
+++ b/pkgs/tools/security/qdigidoc/default.nix
@@ -25,7 +25,8 @@ stdenv.mkDerivation rec {
       --prefix LD_LIBRARY_PATH : ${opensc}/lib/pkcs11/
   '';
 
-  buildInputs = [ cmake ccid qttools pkgconfig pcsclite qttranslations
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ cmake ccid qttools pcsclite qttranslations
                   hicolor_icon_theme libdigidocpp opensc shared_mime_info
                   openldap gettext desktop_file_utils makeWrapper
                 ];
diff --git a/pkgs/tools/security/qesteidutil/default.nix b/pkgs/tools/security/qesteidutil/default.nix
index 04f6cbf6d113..f2a997db05f3 100644
--- a/pkgs/tools/security/qesteidutil/default.nix
+++ b/pkgs/tools/security/qesteidutil/default.nix
@@ -17,7 +17,8 @@ stdenv.mkDerivation rec {
     cd src
   '';
 
-  buildInputs = [ cmake ccid qttools pkgconfig pcsclite qttranslations
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ cmake ccid qttools pcsclite qttranslations
                   hicolor_icon_theme
                 ];
   
diff --git a/pkgs/tools/security/sbsigntool/default.nix b/pkgs/tools/security/sbsigntool/default.nix
index bca93887bd4e..b66564d58cee 100644
--- a/pkgs/tools/security/sbsigntool/default.nix
+++ b/pkgs/tools/security/sbsigntool/default.nix
@@ -15,7 +15,8 @@ stdenv.mkDerivation rec {
 
   prePatch = "patchShebangs .";
 
-  buildInputs = [ autoconf automake utillinux openssl libuuid gnu-efi binutils pkgconfig help2man ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ autoconf automake utillinux openssl libuuid gnu-efi binutils help2man ];
 
   configurePhase = ''
     substituteInPlace configure.ac --replace "@@NIX_GNUEFI@@" "${gnu-efi}"
diff --git a/pkgs/tools/security/stoken/default.nix b/pkgs/tools/security/stoken/default.nix
index 17652e220da6..464f6d215841 100644
--- a/pkgs/tools/security/stoken/default.nix
+++ b/pkgs/tools/security/stoken/default.nix
@@ -20,8 +20,10 @@ stdenv.mkDerivation rec {
     automake --add-missing --copy
     autoconf
   '';
+
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    autoconf automake libtool pkgconfig
+    autoconf automake libtool
     libxml2 nettle
   ] ++ stdenv.lib.optional withGTK3 gtk3;
 
diff --git a/pkgs/tools/security/tpm-luks/default.nix b/pkgs/tools/security/tpm-luks/default.nix
index 40829df56cae..7d0ff797336d 100644
--- a/pkgs/tools/security/tpm-luks/default.nix
+++ b/pkgs/tools/security/tpm-luks/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
     sha256 = "1ms2v57f13r9km6mvf9rha5ndmlmjvrz3mcikai6nzhpj0nrjz0w";
   };
 
-  buildInputs = [ autoreconfHook gawk trousers cryptsetup openssl ];
+  nativeBuildInputs = [ autoreconfHook ];
+  buildInputs = [ gawk trousers cryptsetup openssl ];
 
   installPhase = ''
     mkdir -p $out
diff --git a/pkgs/tools/security/trousers/default.nix b/pkgs/tools/security/trousers/default.nix
index e49f2f8ed0fb..8309390d013b 100644
--- a/pkgs/tools/security/trousers/default.nix
+++ b/pkgs/tools/security/trousers/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "1lvnla1c1ig2w3xvvrqg2w9qm7a1ygzy1j2gg8j7p8c87i58x45v";
   };
 
-  buildInputs = [ openssl pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ openssl ];
 
   patches = [ ./allow-non-tss-config-file-owner.patch ];
 
diff --git a/pkgs/tools/system/bootchart/default.nix b/pkgs/tools/system/bootchart/default.nix
index 34da8d400811..f99d22becdb8 100644
--- a/pkgs/tools/system/bootchart/default.nix
+++ b/pkgs/tools/system/bootchart/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "1abn4amsyys6vwn7csxsxny94n24ycca3xhqxqcmdc4j0dzn3kmb";
   };
 
-  buildInputs = [ pkgconfig glib gtk2 python2Packages.python python2Packages.wrapPython python2Packages.pygtk ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ glib gtk2 python2Packages.python python2Packages.wrapPython python2Packages.pygtk ];
   pythonPath = with python2Packages; [ pygtk pycairo ];
 
   installPhase = ''
diff --git a/pkgs/tools/system/chase/default.nix b/pkgs/tools/system/chase/default.nix
index e1c163f41709..6dcaeed325ae 100644
--- a/pkgs/tools/system/chase/default.nix
+++ b/pkgs/tools/system/chase/default.nix
@@ -4,7 +4,8 @@ stdenv.mkDerivation rec {
   name = "chase-${version}";
   version = "0.5.2";
 
-  buildInputs = [ pkgconfig libatomic_ops boehmgc ] ;
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libatomic_ops boehmgc ] ;
   src = fetchurl {
     url = "mirror://debian/pool/main/c/chase/chase_${version}.orig.tar.gz";
     sha256 = "68d95c2d4dc45553b75790fcea4413b7204a2618dff148116ca9bdb0310d737f";
diff --git a/pkgs/tools/system/collectd/default.nix b/pkgs/tools/system/collectd/default.nix
index 2e12345783d2..6f4b94f826d7 100644
--- a/pkgs/tools/system/collectd/default.nix
+++ b/pkgs/tools/system/collectd/default.nix
@@ -43,8 +43,9 @@ stdenv.mkDerivation rec {
     sha256 = "14p5cc3ys3qfg71xzxfvmxdmz5l4brpbhlmw1fwdda392lia084x";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    pkgconfig curl libdbi libgcrypt libmemcached
+    curl libdbi libgcrypt libmemcached
     cyrus_sasl libnotify gdk_pixbuf liboping libpcap libvirt
     libxml2 libmysql postgresql protobufc rrdtool
     varnish yajl jdk libtool python hiredis libmicrohttpd
diff --git a/pkgs/tools/system/das_watchdog/default.nix b/pkgs/tools/system/das_watchdog/default.nix
index fbca63b0e0a3..bcea40b1193f 100644
--- a/pkgs/tools/system/das_watchdog/default.nix
+++ b/pkgs/tools/system/das_watchdog/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
     sha256 = "02y1vfb3wh4908xjj1kpyf8kgxk29x8dw7yl3pnl220qz2gi99vr";
   };
 
-  buildInputs = [ libgtop xmessage which pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libgtop xmessage which ];
 
   installPhase = ''
     mkdir -p $out/bin/
diff --git a/pkgs/tools/system/fakechroot/default.nix b/pkgs/tools/system/fakechroot/default.nix
index be3a32de251f..25470af9bb30 100644
--- a/pkgs/tools/system/fakechroot/default.nix
+++ b/pkgs/tools/system/fakechroot/default.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation rec {
     sha256 = "1ls3y97qqfcfd3z0balz94xq1gskfk04pg85x6b7wjw8dm4030qd";
   };
 
-  buildInputs = [ autoreconfHook perl ];
+  nativeBuildInputs = [ autoreconfHook ];
+  buildInputs = [ perl ];
 
   meta = with stdenv.lib; {
     homepage = https://github.com/dex4er/fakechroot;
diff --git a/pkgs/tools/system/gdmap/default.nix b/pkgs/tools/system/gdmap/default.nix
index b03ec34972eb..72938216b0a4 100644
--- a/pkgs/tools/system/gdmap/default.nix
+++ b/pkgs/tools/system/gdmap/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "0nr8l88cg19zj585hczj8v73yh21k7j13xivhlzl8jdk0j0cj052";
   };
 
-  buildInputs = [ gtk2 pkgconfig libxml2 intltool gettext ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ gtk2 libxml2 intltool gettext ];
 
   patches = [ ./get_sensitive.patch ./set_flags.patch ];
 
diff --git a/pkgs/tools/system/hardinfo/default.nix b/pkgs/tools/system/hardinfo/default.nix
index 11236b7a9d10..a2bffab3a981 100644
--- a/pkgs/tools/system/hardinfo/default.nix
+++ b/pkgs/tools/system/hardinfo/default.nix
@@ -13,7 +13,8 @@ stdenv.mkDerivation rec {
 
   # Not adding 'hostname' command, the build shouldn't depend on what the build
   # host is called.
-  buildInputs = [ which pkgconfig gtk2 pcre glib libxml2 libsoup ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ which gtk2 pcre glib libxml2 libsoup ];
 
   # Fixes '#error You must compile this program without "-O"'
   hardeningDisable = [ "all" ];
diff --git a/pkgs/tools/system/illum/default.nix b/pkgs/tools/system/illum/default.nix
index d8faeea19d84..03373300a948 100644
--- a/pkgs/tools/system/illum/default.nix
+++ b/pkgs/tools/system/illum/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "05v3hz7n6b1mlhc6zqijblh1vpl0ja1y8y0lafw7mjdz03wxhfdb";
   };
 
-  buildInputs = [ pkgconfig ninja libevdev libev ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ ninja libevdev libev ];
 
   configurePhase = ''
     bash ./configure
diff --git a/pkgs/tools/system/lshw/default.nix b/pkgs/tools/system/lshw/default.nix
index a26237bc045b..499f7c461546 100644
--- a/pkgs/tools/system/lshw/default.nix
+++ b/pkgs/tools/system/lshw/default.nix
@@ -19,14 +19,16 @@ stdenv.mkDerivation rec {
     sha256 = "147wyr5m185f8swsmb4q1ahs9r1rycapbpa2548aqbv298bbish3";
   })];
 
+  nativeBuildInputs = [ pkgconfig ];
+
+  buildInputs = lib.optionals withGUI [ gtk2 sqlite ];
+
   # Fix version info.
   preConfigure = ''
     sed -e "s/return \"unknown\"/return \"${version}\"/" \
         -i src/core/version.cc
   '';
 
-  buildInputs = lib.optionals withGUI [ gtk2 pkgconfig sqlite ];
-
   makeFlags = [ "PREFIX=$(out)" ];
 
   buildFlags = [ "all" ] ++ lib.optional withGUI "gui";
diff --git a/pkgs/tools/system/netdata/default.nix b/pkgs/tools/system/netdata/default.nix
index 236474343b4a..ed177820b644 100644
--- a/pkgs/tools/system/netdata/default.nix
+++ b/pkgs/tools/system/netdata/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec{
     sha256 = "1fv01jnbgwbafsxavlji90zdqizn8m4nfg9ivc4sbi05j036bg6n";
   };
 
-  buildInputs = [ autoreconfHook zlib pkgconfig libuuid ];
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  buildInputs = [ zlib libuuid ];
 
   # Allow UI to load when running as non-root
   patches = [ ./web_access.patch ];
diff --git a/pkgs/tools/system/pciutils/default.nix b/pkgs/tools/system/pciutils/default.nix
index 8a4fe6cb3cff..7508b4fc56c4 100644
--- a/pkgs/tools/system/pciutils/default.nix
+++ b/pkgs/tools/system/pciutils/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "1d62f8fa192f90e61c35a6fc15ff3cb9a7a792f782407acc42ef67817c5939f5";
   };
 
-  buildInputs = [ pkgconfig zlib kmod which ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ zlib kmod which ];
 
   makeFlags = "SHARED=yes PREFIX=\${out}";
 
diff --git a/pkgs/tools/system/supervise/default.nix b/pkgs/tools/system/supervise/default.nix
new file mode 100644
index 000000000000..838663c30720
--- /dev/null
+++ b/pkgs/tools/system/supervise/default.nix
@@ -0,0 +1,27 @@
+{ stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+
+  name = "supervise-${version}";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "catern";
+    repo = "supervise";
+    rev = "v${version}";
+    sha256 = "1cjdxgns3gh2ir4kcmjdmc480w8sm49inws0ihhjmnisjy4100lg";
+  };
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp supervise unlinkwait -t $out/bin
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/catern/supervise;
+    description = "A minimal unprivileged process supervisor making use of modern Linux features";
+    platforms = platforms.linux;
+    license = licenses.gpl3;
+    maintainers = with stdenv.lib.maintainers; [ catern ];
+  };
+}
diff --git a/pkgs/tools/system/thermald/default.nix b/pkgs/tools/system/thermald/default.nix
index 7c81a028810d..a3e90f32c0ab 100644
--- a/pkgs/tools/system/thermald/default.nix
+++ b/pkgs/tools/system/thermald/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "1qzvmzkzdrmwrzfbxb2rz1i39j5zskjxiiv1w9m0xyg08p2wr7h3";
   };
 
-  buildInputs = [ autoconf automake libtool pkgconfig dbus_libs dbus_glib libxml2 ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ autoconf automake libtool dbus_libs dbus_glib libxml2 ];
 
   patchPhase = ''sed -e 's/upstartconfdir = \/etc\/init/upstartconfdir = $(out)\/etc\/init/' -i data/Makefile.am'';
 
diff --git a/pkgs/tools/system/vboot_reference/default.nix b/pkgs/tools/system/vboot_reference/default.nix
index a9a034ebde91..6dfc6d1349d0 100644
--- a/pkgs/tools/system/vboot_reference/default.nix
+++ b/pkgs/tools/system/vboot_reference/default.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation rec {
     sha256 = "14d3a93ha5k4al4ib43nyn1ppx7kgb12xw6mkflhx8nxmx8827nc";
   };
 
-  buildInputs = [ pkgconfig openssl stdenv.cc.libc.static ]
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ openssl stdenv.cc.libc.static ]
     ++ stdenv.lib.optional (libuuid != null)
          (libuuid.overrideAttrs (attrs:
            { configureFlags = attrs.configureFlags ++ [ "--enable-static" ]; }));
diff --git a/pkgs/tools/system/wsmancli/default.nix b/pkgs/tools/system/wsmancli/default.nix
index c1c62718de2d..bd6ec17ceec1 100644
--- a/pkgs/tools/system/wsmancli/default.nix
+++ b/pkgs/tools/system/wsmancli/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "03ay6sa4ii8h6rr3l2qiqqml8xl6gplrlg4v2avdh9y6sihfyvvn";
   };
 
-  buildInputs = [ autoconf automake libtool pkgconfig openwsman openssl ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ autoconf automake libtool openwsman openssl ];
 
   preConfigure = ''
     ./bootstrap
diff --git a/pkgs/tools/text/ebook-tools/default.nix b/pkgs/tools/text/ebook-tools/default.nix
index e9abae3ac849..7dcd94e5363f 100644
--- a/pkgs/tools/text/ebook-tools/default.nix
+++ b/pkgs/tools/text/ebook-tools/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "1bi7wsz3p5slb43kj7lgb3r6lb91lvb6ldi556k4y50ix6b5khyb";
   };
 
-  buildInputs = [ cmake pkgconfig libxml2 libzip ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ cmake libxml2 libzip ];
 
   preConfigure = 
     ''
diff --git a/pkgs/tools/text/qshowdiff/default.nix b/pkgs/tools/text/qshowdiff/default.nix
index 63759184ba47..761a498bcfb6 100644
--- a/pkgs/tools/text/qshowdiff/default.nix
+++ b/pkgs/tools/text/qshowdiff/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "027959xbzvi5c2w9y1x122sr5i26k9mvp43banz2wln6gd860n1a";
   };
 
-  buildInputs = [ qt4 perl pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ qt4 perl ];
 
   configurePhase = ''
     mkdir -p $out/{bin,man/man1}
diff --git a/pkgs/tools/text/silver-searcher/default.nix b/pkgs/tools/text/silver-searcher/default.nix
index 34aa0e9c7ed6..156a8bd8f646 100644
--- a/pkgs/tools/text/silver-searcher/default.nix
+++ b/pkgs/tools/text/silver-searcher/default.nix
@@ -13,7 +13,8 @@ stdenv.mkDerivation rec {
 
   NIX_LDFLAGS = stdenv.lib.optionalString stdenv.isLinux "-lgcc_s";
 
-  buildInputs = [ autoreconfHook pkgconfig pcre zlib lzma ];
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  buildInputs = [ pcre zlib lzma ];
 
   meta = with stdenv.lib; {
     homepage = https://github.com/ggreer/the_silver_searcher/;
diff --git a/pkgs/tools/text/xml/xml2/default.nix b/pkgs/tools/text/xml/xml2/default.nix
index 203f0940990f..e96644b6d3cf 100644
--- a/pkgs/tools/text/xml/xml2/default.nix
+++ b/pkgs/tools/text/xml/xml2/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "01cps980m99y99cnmvydihga9zh3pvdsqag2fi1n6k2x7rfkl873";
   };
 
-  buildInputs = [ pkgconfig libxml2 ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libxml2 ];
 
   meta = with stdenv.lib; {
     homepage = http://ofb.net/~egnor/xml2/;
diff --git a/pkgs/tools/text/xml/xmlstarlet/default.nix b/pkgs/tools/text/xml/xmlstarlet/default.nix
index 5ad62cd7140b..4fe6ad6b3dc9 100644
--- a/pkgs/tools/text/xml/xmlstarlet/default.nix
+++ b/pkgs/tools/text/xml/xmlstarlet/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "1jp737nvfcf6wyb54fla868yrr39kcbijijmjpyk4lrpyg23in0m";
   };
 
-  buildInputs = [ pkgconfig libxml2 libxslt ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libxml2 libxslt ];
 
   preConfigure =
     ''
diff --git a/pkgs/tools/typesetting/tex/texlive/bin.nix b/pkgs/tools/typesetting/tex/texlive/bin.nix
index c15f165013b9..34a689ee9bd6 100644
--- a/pkgs/tools/typesetting/tex/texlive/bin.nix
+++ b/pkgs/tools/typesetting/tex/texlive/bin.nix
@@ -61,8 +61,8 @@ core = stdenv.mkDerivation rec {
 
   outputs = [ "out" "doc" ];
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    pkgconfig
     /*teckit*/ zziplib poppler mpfr gmp
     pixman potrace gd freetype libpng libpaper zlib
     perl
@@ -156,6 +156,7 @@ core-big = stdenv.mkDerivation { #TODO: upmendex
 
   hardeningDisable = [ "format" ];
 
+  inherit (core) nativeBuildInputs;
   buildInputs = core.buildInputs ++ [ core cairo harfbuzz icu graphite2 ];
 
   configureFlags = common.configureFlags
@@ -209,7 +210,8 @@ dvisvgm = stdenv.mkDerivation {
 
   inherit (common) src;
 
-  buildInputs = [ pkgconfig core/*kpathsea*/ ghostscript zlib freetype potrace ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ core/*kpathsea*/ ghostscript zlib freetype potrace ];
 
   preConfigure = "cd texk/dvisvgm";
 
@@ -225,7 +227,8 @@ dvipng = stdenv.mkDerivation {
 
   inherit (common) src;
 
-  buildInputs = [ pkgconfig core/*kpathsea*/ zlib libpng freetype gd ghostscript makeWrapper ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ core/*kpathsea*/ zlib libpng freetype gd ghostscript makeWrapper ];
 
   preConfigure = "cd texk/dvipng";
 
@@ -247,7 +250,8 @@ bibtex8 = stdenv.mkDerivation {
 
   inherit (common) src;
 
-  buildInputs = [ pkgconfig core/*kpathsea*/ icu ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ core/*kpathsea*/ icu ];
 
   preConfigure = "cd texk/bibtex-x";
 
@@ -263,7 +267,8 @@ xdvi = stdenv.mkDerivation {
 
   inherit (common) src;
 
-  buildInputs = [ pkgconfig core/*kpathsea*/ freetype ghostscript ]
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ core/*kpathsea*/ freetype ghostscript ]
     ++ (with xorg; [ libX11 libXaw libXi libXpm libXmu libXaw libXext libXfixes ]);
 
   preConfigure = "cd texk/xdvik";
diff --git a/pkgs/tools/typesetting/xmlroff/default.nix b/pkgs/tools/typesetting/xmlroff/default.nix
index 05ce5057347d..2177937221a1 100644
--- a/pkgs/tools/typesetting/xmlroff/default.nix
+++ b/pkgs/tools/typesetting/xmlroff/default.nix
@@ -10,8 +10,8 @@ stdenv.mkDerivation rec {
     sha256 = "1sczn6xjczsfdxlbjqv4xqlki2a95y2s8ih2nl9v1vhqfk17fiww";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    pkgconfig
     autoconf
     automake
     libxml2
diff --git a/pkgs/tools/video/mjpegtools/default.nix b/pkgs/tools/video/mjpegtools/default.nix
index 3b02f0d3e2ca..197caca0d86c 100644
--- a/pkgs/tools/video/mjpegtools/default.nix
+++ b/pkgs/tools/video/mjpegtools/default.nix
@@ -17,7 +17,8 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "format" ];
 
-  buildInputs = [ libdv libjpeg libpng pkgconfig ]
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libdv libjpeg libpng ]
               ++ lib.optionals (!withMinimal) [ gtk2 libX11 SDL SDL_gfx ];
 
   NIX_CFLAGS_COMPILE = lib.optional (!withMinimal) "-I${SDL.dev}/include/SDL";
diff --git a/pkgs/tools/video/swfmill/default.nix b/pkgs/tools/video/swfmill/default.nix
index 0c8a34c57630..3832f3c3be0c 100644
--- a/pkgs/tools/video/swfmill/default.nix
+++ b/pkgs/tools/video/swfmill/default.nix
@@ -13,7 +13,8 @@ stdenv.mkDerivation rec {
   # Fixes build with GCC 6
   NIX_CFLAGS_COMPILE = "-std=c++03";
 
-  buildInputs = [ pkgconfig libxslt freetype libpng libxml2 ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libxslt freetype libpng libxml2 ];
 
   meta = {
     description = "An xml2swf and swf2xml processor with import functionalities";