summary refs log tree commit diff
path: root/pkgs/tools
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs/tools')
-rw-r--r--pkgs/tools/admin/cli53/default.nix30
-rwxr-xr-xpkgs/tools/admin/google-cloud-sdk/alpha__init__.py23
-rwxr-xr-xpkgs/tools/admin/google-cloud-sdk/beta__init__.py23
-rw-r--r--pkgs/tools/admin/google-cloud-sdk/default.nix15
-rw-r--r--pkgs/tools/archivers/p7zip/default.nix7
-rw-r--r--pkgs/tools/archivers/unzip/default.nix7
-rw-r--r--pkgs/tools/archivers/unzip/dont-hardcode-cc.patch (renamed from pkgs/tools/archivers/unzip/cross-cc.patch)4
-rw-r--r--pkgs/tools/audio/beets/default.nix17
-rw-r--r--pkgs/tools/audio/ezstream/default.nix33
-rw-r--r--pkgs/tools/compression/gzip/default.nix4
-rw-r--r--pkgs/tools/filesystems/btrfs-progs/default.nix4
-rw-r--r--pkgs/tools/filesystems/irods/default.nix2
-rw-r--r--pkgs/tools/filesystems/mergerfs/default.nix12
-rw-r--r--pkgs/tools/filesystems/mtdutils/default.nix4
-rw-r--r--pkgs/tools/filesystems/ntfs-3g/default.nix2
-rw-r--r--pkgs/tools/filesystems/unionfs-fuse/default.nix13
-rw-r--r--pkgs/tools/graphics/optipng/default.nix28
-rw-r--r--pkgs/tools/graphics/pstoedit/default.nix8
-rw-r--r--pkgs/tools/misc/clac/default.nix6
-rw-r--r--pkgs/tools/misc/coreutils/default.nix9
-rw-r--r--pkgs/tools/misc/cpuminer/default.nix4
-rw-r--r--pkgs/tools/misc/ddccontrol/default.nix2
-rw-r--r--pkgs/tools/misc/exa/default.nix6
-rw-r--r--pkgs/tools/misc/fsql/default.nix4
-rw-r--r--pkgs/tools/misc/fzf/default.nix1
-rw-r--r--pkgs/tools/misc/grub/2.0x.nix5
-rw-r--r--pkgs/tools/misc/grub/pvgrub_image/configs/grub-bootstrap.cfg1
-rw-r--r--pkgs/tools/misc/grub/pvgrub_image/configs/grub.cfg10
-rw-r--r--pkgs/tools/misc/grub/pvgrub_image/default.nix42
-rw-r--r--pkgs/tools/misc/hdf4/default.nix77
-rw-r--r--pkgs/tools/misc/kronometer/default.nix4
-rw-r--r--pkgs/tools/misc/megacli/default.nix6
-rw-r--r--pkgs/tools/misc/partition-manager/default.nix4
-rw-r--r--pkgs/tools/misc/peruse/default.nix4
-rw-r--r--pkgs/tools/misc/plowshare/default.nix14
-rw-r--r--pkgs/tools/misc/screen/default.nix4
-rw-r--r--pkgs/tools/misc/tlp/default.nix4
-rw-r--r--pkgs/tools/misc/x11idle/default.nix33
-rw-r--r--pkgs/tools/misc/youtube-dl/default.nix4
-rw-r--r--pkgs/tools/misc/zabbix-cli/default.nix24
-rw-r--r--pkgs/tools/networking/burpsuite/default.nix4
-rw-r--r--pkgs/tools/networking/cjdns/default.nix4
-rw-r--r--pkgs/tools/networking/curl/default.nix1
-rw-r--r--pkgs/tools/networking/email/default.nix2
-rw-r--r--pkgs/tools/networking/iperf/3.nix4
-rw-r--r--pkgs/tools/networking/jnettop/default.nix11
-rw-r--r--pkgs/tools/networking/lldpd/default.nix8
-rw-r--r--pkgs/tools/networking/mailutils/default.nix6
-rw-r--r--pkgs/tools/networking/mitmproxy/default.nix11
-rw-r--r--pkgs/tools/networking/mu/default.nix4
-rw-r--r--pkgs/tools/networking/netselect/default.nix9
-rw-r--r--pkgs/tools/networking/nzbget/default.nix4
-rw-r--r--pkgs/tools/networking/offlineimap/default.nix4
-rw-r--r--pkgs/tools/networking/tcpdump/default.nix6
-rw-r--r--pkgs/tools/networking/ucspi-tcp/default.nix1
-rw-r--r--pkgs/tools/networking/ucspi-tcp/remove-setuid.patch15
-rw-r--r--pkgs/tools/networking/unbound/default.nix4
-rw-r--r--pkgs/tools/package-management/disnix/default.nix6
-rw-r--r--pkgs/tools/package-management/disnix/disnixos/default.nix6
-rw-r--r--pkgs/tools/package-management/elm-github-install/Gemfile2
-rw-r--r--pkgs/tools/package-management/elm-github-install/Gemfile.lock39
-rw-r--r--pkgs/tools/package-management/elm-github-install/default.nix17
-rw-r--r--pkgs/tools/package-management/elm-github-install/gemset.nix114
-rw-r--r--pkgs/tools/package-management/gx/default.nix13
-rw-r--r--pkgs/tools/package-management/gx/deps.nix286
-rw-r--r--pkgs/tools/package-management/gx/go/default.nix6
-rw-r--r--pkgs/tools/package-management/nix/default.nix8
-rw-r--r--pkgs/tools/package-management/nixops/default.nix4
-rw-r--r--pkgs/tools/security/afl/default.nix4
-rw-r--r--pkgs/tools/security/browserpass/default.nix25
-rw-r--r--pkgs/tools/security/certstrap/default.nix23
-rw-r--r--pkgs/tools/security/gen-oath-safe/default.nix41
-rw-r--r--pkgs/tools/security/hologram/default.nix4
-rw-r--r--pkgs/tools/security/jd-gui/default.nix30
-rw-r--r--pkgs/tools/security/opendht/default.nix48
-rw-r--r--pkgs/tools/security/pinentry/default.nix4
-rw-r--r--pkgs/tools/security/sshuttle/default.nix17
-rw-r--r--pkgs/tools/security/tor/default.nix4
-rw-r--r--pkgs/tools/security/vulnix/requirements.nix2
-rw-r--r--pkgs/tools/system/awstats/default.nix4
-rw-r--r--pkgs/tools/system/collectd/default.nix12
-rw-r--r--pkgs/tools/system/ddrescue/default.nix5
-rw-r--r--pkgs/tools/system/mcron/default.nix5
-rw-r--r--pkgs/tools/system/runit/default.nix3
-rw-r--r--pkgs/tools/system/socklog/default.nix4
-rw-r--r--pkgs/tools/system/suid-chroot/default.nix1
-rw-r--r--pkgs/tools/system/tm/default.nix4
-rw-r--r--pkgs/tools/system/ts/default.nix9
-rw-r--r--pkgs/tools/text/gnupatch/default.nix2
-rw-r--r--pkgs/tools/text/groff/default.nix7
-rw-r--r--pkgs/tools/text/groff/site.tmac16
-rw-r--r--pkgs/tools/text/html-tidy/default.nix6
-rw-r--r--pkgs/tools/text/kdiff3/default.nix4
-rw-r--r--pkgs/tools/text/replace/default.nix6
-rw-r--r--pkgs/tools/text/xsv/default.nix6
-rw-r--r--pkgs/tools/typesetting/tex/texlive/bin.nix4
-rw-r--r--pkgs/tools/typesetting/tex/texlive/combine.nix12
-rw-r--r--pkgs/tools/typesetting/tex/texlive/default.nix9
98 files changed, 1137 insertions, 287 deletions
diff --git a/pkgs/tools/admin/cli53/default.nix b/pkgs/tools/admin/cli53/default.nix
index 4e284c461932..23c35dab57c0 100644
--- a/pkgs/tools/admin/cli53/default.nix
+++ b/pkgs/tools/admin/cli53/default.nix
@@ -1,27 +1,21 @@
-{ stdenv, buildGoPackage, fetchFromGitHub }:
+{ lib, python2Packages, fetchurl }:
 
-buildGoPackage rec {
+python2Packages.buildPythonApplication rec {
   name = "cli53-${version}";
-  version = "0.8.8";
+  version = "0.4.4";
 
-  goPackagePath = "github.com/barnybug/cli53";
-
-  src = fetchFromGitHub {
-    owner = "barnybug";
-    repo = "cli53";
-    rev = version;
-    sha256 = "1hbx64rn25qzp2xlfwv8xaqyfcax9b6pl30j9vciw7cb346i84gc";
+  src = fetchurl {
+    url = "mirror://pypi/c/cli53/${name}.tar.gz";
+    sha256 = "0s9jzigq6a16m2c3qklssx2lz16cf13g5zh80vh24kxazaxqzbig";
   };
 
-  buildPhase = ''
-    pushd go/src/${goPackagePath}/cmd/cli53
-    go get .
-    popd
-  '';
-
-  goDeps = ./deps.nix;
+  propagatedBuildInputs = with python2Packages; [
+    argparse
+    boto
+    dns
+  ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "CLI tool for the Amazon Route 53 DNS service";
     homepage = https://github.com/barnybug/cli53;
     license = licenses.mit;
diff --git a/pkgs/tools/admin/google-cloud-sdk/alpha__init__.py b/pkgs/tools/admin/google-cloud-sdk/alpha__init__.py
new file mode 100755
index 000000000000..d120969d8fb8
--- /dev/null
+++ b/pkgs/tools/admin/google-cloud-sdk/alpha__init__.py
@@ -0,0 +1,23 @@
+# Copyright 2013 Google Inc. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Auth for the Google Cloud SDK.
+"""
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+class Alpha(base.Group):
+  """Alpha versions of gcloud commands."""
diff --git a/pkgs/tools/admin/google-cloud-sdk/beta__init__.py b/pkgs/tools/admin/google-cloud-sdk/beta__init__.py
new file mode 100755
index 000000000000..bb52c5a0bc4a
--- /dev/null
+++ b/pkgs/tools/admin/google-cloud-sdk/beta__init__.py
@@ -0,0 +1,23 @@
+# Copyright 2013 Google Inc. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Auth for the Google Cloud SDK.
+"""
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.BETA)
+class Beta(base.Group):
+  """Beta versions of gcloud commands."""
diff --git a/pkgs/tools/admin/google-cloud-sdk/default.nix b/pkgs/tools/admin/google-cloud-sdk/default.nix
index b66c4c041f71..26e63283f8da 100644
--- a/pkgs/tools/admin/google-cloud-sdk/default.nix
+++ b/pkgs/tools/admin/google-cloud-sdk/default.nix
@@ -7,25 +7,26 @@ assert stdenv.system == "i686-linux" || stdenv.system == "x86_64-linux" || stden
 
 stdenv.mkDerivation rec {
   name = "google-cloud-sdk-${version}";
-  version = "155.0.0";
+  version = "161.0.0";
 
   src =
     if stdenv.system == "i686-linux" then
       fetchurl {
         url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/${name}-linux-x86.tar.gz";
-        sha256 = "1xh8xy9p3qqmirvhih7vf96i5xn0z0zr5mmbqr6vfzx16r47bi2z";
+        sha256 = "43a78a9d2c3ee9d9e50200b1e90512cd53ded40b56e05effe31fe9847b1bdd4c";
       }
     else if stdenv.system == "x86_64-darwin" then
       fetchurl {
         url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/${name}-darwin-x86_64.tar.gz";
-        sha256 = "19pr1pld6vdp5ig5i7zddfl1l5xjv9nx5sn00va4l1nnb410ac69";
+        sha256 = "0706dbea1279be2bc98a497d1bfed61a9cc29c305d908a376bcdb4403035b323";
       }
     else
       fetchurl {
         url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/${name}-linux-x86_64.tar.gz";
-        sha256 = "18hnabhdlrprhg8micy2z63jxyah3qr3pv9pgb64i7lbv6lznr2b";
+        sha256 = "7aa6094d1f9c87f4c2c4a6bdad6a1113aac5e72ea673e659d9acbb059dfd037e";
       };
 
+
   buildInputs = [python27 makeWrapper];
 
   phases = [ "installPhase" "fixupPhase" ];
@@ -34,6 +35,12 @@ stdenv.mkDerivation rec {
     mkdir -p "$out"
     tar -xzf "$src" -C "$out" google-cloud-sdk
 
+    mkdir $out/google-cloud-sdk/lib/surface/alpha
+    cp ${./alpha__init__.py} $out/google-cloud-sdk/lib/surface/alpha/__init__.py
+
+    mkdir $out/google-cloud-sdk/lib/surface/beta
+    cp ${./beta__init__.py} $out/google-cloud-sdk/lib/surface/beta/__init__.py
+
     # create wrappers with correct env
     for program in gcloud bq gsutil git-credential-gcloud.sh; do
         programPath="$out/google-cloud-sdk/bin/$program"
diff --git a/pkgs/tools/archivers/p7zip/default.nix b/pkgs/tools/archivers/p7zip/default.nix
index 8e9db09147ed..3550b7d7de36 100644
--- a/pkgs/tools/archivers/p7zip/default.nix
+++ b/pkgs/tools/archivers/p7zip/default.nix
@@ -10,9 +10,10 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
-    (fetchpatch {
-      url = "https://sources.debian.net/data/main/p/p7zip/16.02+dfsg-2/debian/patches/12-CVE-2016-9296.patch";
-      sha256 = "1i7099h27gmb9dv0lb7jnqfm504gs1c3129r6kvi94yb2gzrzk41";
+    (fetchpatch rec {
+      name = "CVE-2016-9296.patch";
+      url = "https://src.fedoraproject.org/cgit/rpms/p7zip.git/plain/${name}?id=4b3973f6a5d";
+      sha256 = "09wbkzai46bwm8zmplsz0m4jck3qn7snr68i9p1gsih300zidj0m";
     })
   ];
 
diff --git a/pkgs/tools/archivers/unzip/default.nix b/pkgs/tools/archivers/unzip/default.nix
index ad484b3d4d97..a35e473ec366 100644
--- a/pkgs/tools/archivers/unzip/default.nix
+++ b/pkgs/tools/archivers/unzip/default.nix
@@ -1,7 +1,6 @@
 { stdenv, fetchurl
 , bzip2
 , enableNLS ? false, libnatspec
-, buildPlatform, hostPlatform
 }:
 
 stdenv.mkDerivation {
@@ -14,6 +13,8 @@ stdenv.mkDerivation {
 
   hardeningDisable = [ "format" ];
 
+  patchFlags = "-p1 -F3";
+
   patches = [
     ./CVE-2014-8139.diff
     ./CVE-2014-8140.diff
@@ -23,13 +24,13 @@ stdenv.mkDerivation {
     ./CVE-2015-7697.diff
     ./CVE-2014-9913.patch
     ./CVE-2016-9844.patch
+    ./dont-hardcode-cc.patch
   ] ++ stdenv.lib.optional enableNLS
     (fetchurl {
       url = "http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/app-arch/unzip/files/unzip-6.0-natspec.patch?revision=1.1";
       name = "unzip-6.0-natspec.patch";
       sha256 = "67ab260ae6adf8e7c5eda2d1d7846929b43562943ec4aff629bd7018954058b1";
-    })
-    ++ stdenv.lib.optional (hostPlatform != buildPlatform) ./cross-cc.patch;
+    });
 
   nativeBuildInputs = [ bzip2 ];
   buildInputs = [ bzip2 ] ++ stdenv.lib.optional enableNLS libnatspec;
diff --git a/pkgs/tools/archivers/unzip/cross-cc.patch b/pkgs/tools/archivers/unzip/dont-hardcode-cc.patch
index 3d38ffdef6e3..15dbbfe4c533 100644
--- a/pkgs/tools/archivers/unzip/cross-cc.patch
+++ b/pkgs/tools/archivers/unzip/dont-hardcode-cc.patch
@@ -1,12 +1,14 @@
 --- a/unix/Makefile
 +++ b/unix/Makefile
-@@ -42,9 +42,7 @@
+@@ -42,9 +42,9 @@
  # such as -DDOSWILD).
  
  # UnZip flags
 -CC = cc#	try using "gcc" target rather than changing this (CC and LD
++CC ?= cc#	try using "gcc" target rather than changing this (CC and LD
  LD = $(CC)#	must match, else "unresolved symbol:  ___main" is possible)
 -AS = as
++AS ?= as
  LOC = $(D_USE_BZ2) $(LOCAL_UNZIP)
  AF = $(LOC)
  CFLAGS = -O
diff --git a/pkgs/tools/audio/beets/default.nix b/pkgs/tools/audio/beets/default.nix
index 35b4557a33cf..ff033e62a8b6 100644
--- a/pkgs/tools/audio/beets/default.nix
+++ b/pkgs/tools/audio/beets/default.nix
@@ -8,7 +8,9 @@
 , enableDiscogs        ? true
 , enableEmbyupdate     ? true
 , enableFetchart       ? true
+, enableGmusic         ? true
 , enableKeyfinder      ? true, keyfinder-cli ? null
+, enableKodiupdate     ? true
 , enableLastfm         ? true
 , enableMpd            ? true
 , enableReplaygain     ? true, bs1770gain ? null
@@ -27,9 +29,10 @@ assert enableBadfiles    -> flac != null && mp3val != null;
 assert enableConvert     -> ffmpeg != null;
 assert enableDiscogs     -> pythonPackages.discogs_client != null;
 assert enableFetchart    -> pythonPackages.responses      != null;
+assert enableGmusic      -> pythonPackages.gmusicapi      != null;
 assert enableKeyfinder   -> keyfinder-cli != null;
 assert enableLastfm      -> pythonPackages.pylast         != null;
-assert enableMpd         -> pythonPackages.mpd            != null;
+assert enableMpd         -> pythonPackages.mpd2           != null;
 assert enableReplaygain  -> bs1770gain                    != null;
 assert enableThumbnails  -> pythonPackages.pyxdg          != null;
 assert enableWeb         -> pythonPackages.flask          != null;
@@ -45,7 +48,9 @@ let
     discogs = enableDiscogs;
     embyupdate = enableEmbyupdate;
     fetchart = enableFetchart;
+    gmusic = enableGmusic;
     keyfinder = enableKeyfinder;
+    kodiupdate = enableKodiupdate;
     lastgenre = enableLastfm;
     lastimport = enableLastfm;
     mpdstats = enableMpd;
@@ -74,13 +79,13 @@ let
 
 in pythonPackages.buildPythonApplication rec {
   name = "beets-${version}";
-  version = "1.4.3";
+  version = "1.4.5";
 
   src = fetchFromGitHub {
     owner = "beetbox";
     repo = "beets";
     rev = "v${version}";
-    sha256 = "0sh2ap7jbqh7p8h63kgrx1ja9lyqlxjpfnh6axxw9p1mh78cgc1v";
+    sha256 = "0fvfp9ckq3dhs4f8abg9fprfppyf0g6mv8br2xz99plg4wnffzmy";
   };
 
   propagatedBuildInputs = [
@@ -99,13 +104,15 @@ in pythonPackages.buildPythonApplication rec {
   ] ++ optional enableAcoustid     pythonPackages.pyacoustid
     ++ optional (enableFetchart
               || enableEmbyupdate
+              || enableKodiupdate
               || enableAcousticbrainz)
                                    pythonPackages.requests
     ++ optional enableConvert      ffmpeg
     ++ optional enableDiscogs      pythonPackages.discogs_client
+    ++ optional enableGmusic       pythonPackages.gmusicapi
     ++ optional enableKeyfinder    keyfinder-cli
     ++ optional enableLastfm       pythonPackages.pylast
-    ++ optional enableMpd          pythonPackages.mpd
+    ++ optional enableMpd          pythonPackages.mpd2
     ++ optional enableThumbnails   pythonPackages.pyxdg
     ++ optional enableWeb          pythonPackages.flask
     ++ optional enableAlternatives (import ./alternatives-plugin.nix {
@@ -146,7 +153,7 @@ in pythonPackages.buildPythonApplication rec {
       s,"mp3val","${mp3val}/bin/mp3val",
     }' beetsplug/badfiles.py
   '' + optionalString enableConvert ''
-    sed -i -e 's,\(util\.command_output(\)\([^)]\+\)),\1[b"${ffmpeg.bin}/bin/ffmpeg" if args[0] == b"ffmpeg" else args[0]] + \2[1:]),' beetsplug/convert.py 
+    sed -i -e 's,\(util\.command_output(\)\([^)]\+\)),\1[b"${ffmpeg.bin}/bin/ffmpeg" if args[0] == b"ffmpeg" else args[0]] + \2[1:]),' beetsplug/convert.py
   '' + optionalString enableReplaygain ''
     sed -i -re '
       s!^( *cmd *= *b?['\'''"])(bs1770gain['\'''"])!\1${bs1770gain}/bin/\2!
diff --git a/pkgs/tools/audio/ezstream/default.nix b/pkgs/tools/audio/ezstream/default.nix
new file mode 100644
index 000000000000..6524bedf9392
--- /dev/null
+++ b/pkgs/tools/audio/ezstream/default.nix
@@ -0,0 +1,33 @@
+{ stdenv, fetchurl, libiconv, libshout, taglib, libxml2, pkgconfig }:
+
+stdenv.mkDerivation rec {
+  name = "ezstream-${version}";
+  version = "0.6.0";
+
+  src = fetchurl {
+    url = "https://ftp.osuosl.org/pub/xiph/releases/ezstream/${name}.tar.gz";
+    sha256 = "f86eb8163b470c3acbc182b42406f08313f85187bd9017afb8b79b02f03635c9";
+  };
+
+  buildInputs = [ libiconv libshout taglib libxml2 ];
+  nativeBuildInputs = [ pkgconfig ];
+
+  doCheck = true;
+
+  meta = with stdenv.lib; {
+    description = "A command line source client for Icecast media streaming servers";
+    longDescription = ''
+      Ezstream is a command line source client for Icecast media
+      streaming servers. It began as the successor of the old "shout"
+      utility, and has since gained a lot of useful features.
+
+      In its basic mode of operation, it streams media files or data
+      from standard input without reencoding and thus requires only
+      very little CPU resources.
+    '';
+    homepage = http://icecast.org/ezstream/;
+    license = licenses.gpl2;
+    maintainers = [ maintainers.barrucadu ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/tools/compression/gzip/default.nix b/pkgs/tools/compression/gzip/default.nix
index 5a27d336c291..cb7dc65c710d 100644
--- a/pkgs/tools/compression/gzip/default.nix
+++ b/pkgs/tools/compression/gzip/default.nix
@@ -15,10 +15,6 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ xz.bin ];
 
-  preConfigure = if stdenv.isCygwin then ''
-    sed -i lib/fpending.h -e 's,include <stdio_ext.h>,,'
-  '' else null;
-
   # In stdenv-linux, prevent a dependency on bootstrap-tools.
   makeFlags = "SHELL=/bin/sh GREP=grep";
 
diff --git a/pkgs/tools/filesystems/btrfs-progs/default.nix b/pkgs/tools/filesystems/btrfs-progs/default.nix
index 525aa2fec28a..d9b01eb5239f 100644
--- a/pkgs/tools/filesystems/btrfs-progs/default.nix
+++ b/pkgs/tools/filesystems/btrfs-progs/default.nix
@@ -21,6 +21,10 @@ stdenv.mkDerivation rec {
   # This should be fine on all platforms so apply universally
   patchPhase = "sed -i s/-O1/-O2/ configure";
 
+  postInstall = ''
+    install -v -m 444 -D btrfs-completion $out/etc/bash_completion.d/btrfs
+  '';
+
   meta = with stdenv.lib; {
     description = "Utilities for the btrfs filesystem";
     homepage = https://btrfs.wiki.kernel.org/;
diff --git a/pkgs/tools/filesystems/irods/default.nix b/pkgs/tools/filesystems/irods/default.nix
index 72118cada9f1..db69fa64c84d 100644
--- a/pkgs/tools/filesystems/irods/default.nix
+++ b/pkgs/tools/filesystems/irods/default.nix
@@ -40,6 +40,8 @@ in rec {
         -DCMAKE_MODULE_LINKER_FLAGS=-Wl,-rpath,$out/lib
         -DCMAKE_SHARED_LINKER_FLAGS=-Wl,-rpath,$out/lib
         "
+
+      substituteInPlace cmake/server.cmake --replace SETUID ""
     '';
 
     meta = common.meta // {
diff --git a/pkgs/tools/filesystems/mergerfs/default.nix b/pkgs/tools/filesystems/mergerfs/default.nix
index 81f82108995d..929c6690a269 100644
--- a/pkgs/tools/filesystems/mergerfs/default.nix
+++ b/pkgs/tools/filesystems/mergerfs/default.nix
@@ -1,18 +1,20 @@
-{ stdenv, fetchgit, fuse, pkgconfig, which, attr, pandoc, git }:
+{ stdenv, fetchgit, autoconf, automake, pkgconfig, gettext, libtool, git, pandoc, which, attr, libiconv }:
 
 stdenv.mkDerivation rec {
   name = "mergerfs-${version}";
-  version = "2.16.1";
+  version = "2.23.0";
 
   # not using fetchFromGitHub because of changelog being built with git log
   src = fetchgit {
     url = "https://github.com/trapexit/mergerfs";
     rev = "refs/tags/${version}";
-    sha256 = "12fqgk54fnnibqiq82p4g2k6qnw3iy6dd64csmlf73yi67za5iwf";
+    sha256 = "0k4nn0f4c355q7hnni7iia8qi9m0khvyd04hx1hmlrnf0zsi9mfw";
     deepClone = true;
+    leaveDotGit = true;
   };
 
-  buildInputs = [ fuse pkgconfig which attr pandoc git ];
+  nativeBuildInputs = [ autoconf automake pkgconfig gettext libtool git pandoc which ];
+  buildInputs = [ attr libiconv ];
 
   makeFlags = [ "PREFIX=$(out)" "XATTR_AVAILABLE=1" ];
 
@@ -21,6 +23,6 @@ stdenv.mkDerivation rec {
     homepage = https://github.com/trapexit/mergerfs;
     license = stdenv.lib.licenses.isc;
     platforms = stdenv.lib.platforms.linux;
-    maintainers = with stdenv.lib.maintainers; [ makefu ];
+    maintainers = with stdenv.lib.maintainers; [ jfrankenau makefu ];
   };
 }
diff --git a/pkgs/tools/filesystems/mtdutils/default.nix b/pkgs/tools/filesystems/mtdutils/default.nix
index ed3850b9fdd6..d0ceaf94a75f 100644
--- a/pkgs/tools/filesystems/mtdutils/default.nix
+++ b/pkgs/tools/filesystems/mtdutils/default.nix
@@ -15,10 +15,6 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ libuuid lzo zlib acl ];
 
-  crossAttrs = {
-    makeFlags = "CC=${stdenv.cross.config}-gcc";
-  };
-
   meta = {
     description = "Tools for MTD filesystems";
     license = stdenv.lib.licenses.gpl2Plus;
diff --git a/pkgs/tools/filesystems/ntfs-3g/default.nix b/pkgs/tools/filesystems/ntfs-3g/default.nix
index a96612c28041..0cf439c9fe95 100644
--- a/pkgs/tools/filesystems/ntfs-3g/default.nix
+++ b/pkgs/tools/filesystems/ntfs-3g/default.nix
@@ -2,7 +2,7 @@
 , crypto ? false, libgcrypt, gnutls, pkgconfig}:
 
 stdenv.mkDerivation rec {
-  pname = "ntfs-3g";
+  pname = "ntfs3g";
   version = "2017.3.23";
   name = "${pname}-${version}";
 
diff --git a/pkgs/tools/filesystems/unionfs-fuse/default.nix b/pkgs/tools/filesystems/unionfs-fuse/default.nix
index b7d7a07a084f..cfe3ff421fe4 100644
--- a/pkgs/tools/filesystems/unionfs-fuse/default.nix
+++ b/pkgs/tools/filesystems/unionfs-fuse/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "unionfs-fuse-${version}";
-  version = "1.0";
+  version = "2.0";
 
   src = fetchFromGitHub {
     owner = "rpodgorny";
     repo = "unionfs-fuse";
     rev = "v${version}";
-    sha256 = "0g2hd6yi6v8iqzmgncg1zi9a7ixy9hsh51rzf6jnmzi79543dihf";
+    sha256 = "0lb8zgdxnjy2fjr2284hvdfn7inc1in44ynzgcr66x54bxzvynj6";
   };
 
   patches =
@@ -34,10 +34,11 @@ stdenv.mkDerivation rec {
     substituteInPlace $out/sbin/mount.unionfs-fuse --replace unionfs $out/bin/unionfs
   '';
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "FUSE UnionFS implementation";
-    homepage = http://podgorny.cz/moin/UnionFsFuse;
-    license = stdenv.lib.licenses.bsd3;
-    platforms = stdenv.lib.platforms.linux;
+    homepage = https://github.com/rpodgorny/unionfs-fuse;
+    license = licenses.bsd3;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ orivej ];
   };
 }
diff --git a/pkgs/tools/graphics/optipng/default.nix b/pkgs/tools/graphics/optipng/default.nix
index 0f7f7e2da2a2..471e8ee8df47 100644
--- a/pkgs/tools/graphics/optipng/default.nix
+++ b/pkgs/tools/graphics/optipng/default.nix
@@ -1,4 +1,6 @@
-{ stdenv, fetchurl, libpng, static ? false }:
+{ stdenv, fetchurl, libpng, static ? false
+, buildPlatform, hostPlatform
+}:
 
 # This package comes with its own copy of zlib, libpng and pngxtern
 
@@ -15,20 +17,16 @@ stdenv.mkDerivation rec {
   buildInputs = [ libpng ];
 
   LDFLAGS = optional static "-static";
-  configureFlags = "--with-system-zlib --with-system-libpng";
-
-  crossAttrs = {
-    CC="${stdenv.cross.config}-gcc";
-    LD="${stdenv.cross.config}-gcc";
-    AR="${stdenv.cross.config}-ar";
-    RANLIB="${stdenv.cross.config}-ranlib";
-    configurePhase = ''
-      ./configure -prefix="$out" --with-system-zlib --with-system-libpng
-    '';
-    postInstall = optional (stdenv.cross.libc == "msvcrt") ''
-      mv "$out"/bin/optipng "$out"/bin/optipng.exe
-    '';
-  };
+  configureFlags = [
+    "--with-system-zlib"
+    "--with-system-libpng"
+  ] ++ stdenv.lib.optionals (hostPlatform != buildPlatform) [
+    #"-prefix=$out"
+  ];
+
+  postInstall = if hostPlatform != buildPlatform && hostPlatform.isWindows then ''
+    mv "$out"/bin/optipng{,.exe}
+  '' else null;
 
   meta = with stdenv.lib; {
     homepage = http://optipng.sourceforge.net/;
diff --git a/pkgs/tools/graphics/pstoedit/default.nix b/pkgs/tools/graphics/pstoedit/default.nix
index 170dfdac2b6b..9fdf0ad0465a 100644
--- a/pkgs/tools/graphics/pstoedit/default.nix
+++ b/pkgs/tools/graphics/pstoedit/default.nix
@@ -13,11 +13,17 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" ];
   nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ zlib ghostscript imagemagick plotutils gd libjpeg libwebp ] 
+  buildInputs = [ zlib ghostscript imagemagick plotutils gd libjpeg libwebp ]
   ++ lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [
     libiconv ApplicationServices
   ]);
 
+  # '@LIBPNG_LDFLAGS@' is no longer substituted by autoconf (the code is commented out)
+  # so we need to remove it from the pkg-config file as well
+  preConfigure = ''
+    substituteInPlace config/pstoedit.pc.in --replace '@LIBPNG_LDFLAGS@' ""
+  '';
+
   meta = with stdenv.lib; {
     description = "Translates PostScript and PDF graphics into other vector formats";
     homepage = https://sourceforge.net/projects/pstoedit/;
diff --git a/pkgs/tools/misc/clac/default.nix b/pkgs/tools/misc/clac/default.nix
index 48f3b613564f..55aa438226f6 100644
--- a/pkgs/tools/misc/clac/default.nix
+++ b/pkgs/tools/misc/clac/default.nix
@@ -2,13 +2,13 @@
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
   pname = "clac";
-  version = "0.0.0.20170416";
+  version = "0.0.0.20170503";
 
   src = fetchFromGitHub {
     owner = "soveran";
     repo = "clac";
-    rev = "828600b01e80166bc435d4d73506f0c3e16f2459";
-    sha256 = "08fhhvjrc7rn5fjjdqlallr76m6ybj3wm5gx407jbgfbky0fj7mb";
+    rev = "e92bd5cbab0d694cef945e3478820c9505e06f04";
+    sha256 = "0j8p1npgq32s377c9lw959h5i2csq4yb27cvg7av17bji46816bv";
   };
 
   buildInputs = [];
diff --git a/pkgs/tools/misc/coreutils/default.nix b/pkgs/tools/misc/coreutils/default.nix
index 71fc791872f8..9a988a2b4311 100644
--- a/pkgs/tools/misc/coreutils/default.nix
+++ b/pkgs/tools/misc/coreutils/default.nix
@@ -32,6 +32,9 @@ stdenv.mkDerivation rec {
     sed '2i echo Skipping cp sparse test && exit 0' -i ./tests/cp/sparse.sh
     sed '2i echo Skipping rm deep-2 test && exit 0' -i ./tests/rm/deep-2.sh
     sed '2i echo Skipping du long-from-unreadable test && exit 0' -i ./tests/du/long-from-unreadable.sh
+    sed '2i echo Skipping chmod setgid test && exit 0' -i ./tests/chmod/setgid.sh
+    substituteInPlace ./tests/install/install-C.sh \
+      --replace 'mode3=2755' 'mode3=1755'
   '';
 
   outputs = [ "out" "info" ];
@@ -67,7 +70,7 @@ stdenv.mkDerivation rec {
     && builtins.storeDir == "/nix/store";
 
   # Prevents attempts of running 'help2man' on cross-built binaries.
-  ${if hostPlatform == buildPlatform then null else "PERL"} = "missing";
+  PERL = if hostPlatform == buildPlatform then null else "missing";
 
   # Saw random failures like ‘help2man: can't get '--help' info from
   # man/sha512sum.td/sha512sum’.
@@ -80,11 +83,11 @@ stdenv.mkDerivation rec {
 
   # Works around a bug with 8.26:
   # Makefile:3440: *** Recursive variable 'INSTALL' references itself (eventually).  Stop.
-  ${if hostPlatform == buildPlatform then null else "preInstall"} = ''
+  preInstall = optionalString (hostPlatform != buildPlatform) ''
     sed -i Makefile -e 's|^INSTALL =.*|INSTALL = ${buildPackages.coreutils}/bin/install -c|'
   '';
 
-  ${if hostPlatform == buildPlatform then null else "postInstall"} = ''
+  postInstall = optionalString (hostPlatform != buildPlatform) ''
     rm $out/share/man/man1/*
     cp ${buildPackages.coreutils}/share/man/man1/* $out/share/man/man1
   '';
diff --git a/pkgs/tools/misc/cpuminer/default.nix b/pkgs/tools/misc/cpuminer/default.nix
index 375aa999e3b9..b4abb3097b98 100644
--- a/pkgs/tools/misc/cpuminer/default.nix
+++ b/pkgs/tools/misc/cpuminer/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "cpuminer-${version}";
-  version = "2.4.5";
+  version = "2.5.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/cpuminer/pooler-${name}.tar.gz";
-    sha256 = "130ab6vcbm9azl9w8n97fzjnjbakm0k2n3wc1bcgy5y5c8s0220h";
+    sha256 = "1xalrfrk5hvh1jh9kbqhib2an82ypd46vl9glaxhz3rbjld7c5pa";
   };
 
   patchPhase = if stdenv.cc.isClang then "${perl}/bin/perl ./nomacro.pl" else null;
diff --git a/pkgs/tools/misc/ddccontrol/default.nix b/pkgs/tools/misc/ddccontrol/default.nix
index ddf9c38ec93a..b3aca778cd9e 100644
--- a/pkgs/tools/misc/ddccontrol/default.nix
+++ b/pkgs/tools/misc/ddccontrol/default.nix
@@ -28,6 +28,8 @@ stdenv.mkDerivation {
       oldPath+="{datadir}\/ddccontrol-db"
       sed "s/$oldPath/$newPath/" <configure.ac.old >configure.ac
       rm configure.ac.old
+
+      sed -e "s/chmod 4711/chmod 0711/" -i src/ddcpci/Makefile*
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/misc/exa/default.nix b/pkgs/tools/misc/exa/default.nix
index 4dd49e02e0ec..110125727bf0 100644
--- a/pkgs/tools/misc/exa/default.nix
+++ b/pkgs/tools/misc/exa/default.nix
@@ -21,15 +21,15 @@ let
   '';
 in buildRustPackage rec {
   name = "exa-${version}";
-  version = "0.6.0";
+  version = "0.7.0";
 
-  depsSha256 = "0c1vyl1c67xq18ss0xs5cjdfn892jpwj6ml51dfppzfyns3namm4";
+  depsSha256 = "0j320hhf2vqaha137pjj4pyiw6d3p5h3nhy3pl9vna1g5mnl1sn7";
 
   src = fetchFromGitHub {
     owner = "ogham";
     repo = "exa";
     rev = "v${version}";
-    sha256 = "0065gj4pbbppbnwp23s6bb7zlz428nrir00d0kz7axydxk6swhyv";
+    sha256 = "0i9psgna2wwv9qyw9cif4qznqiyi16vl763hpm2yr195aj700339";
   };
 
   nativeBuildInputs = [ cmake pkgconfig perl ];
diff --git a/pkgs/tools/misc/fsql/default.nix b/pkgs/tools/misc/fsql/default.nix
index e3a9297c4abf..32deb0c23067 100644
--- a/pkgs/tools/misc/fsql/default.nix
+++ b/pkgs/tools/misc/fsql/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   name = "fsql-${version}";
-  version = "0.2.1";
+  version = "0.3.1";
 
   goPackagePath = "github.com/kshvmdn/fsql";
 
@@ -10,7 +10,7 @@ buildGoPackage rec {
     owner = "kshvmdn";
     repo = "fsql";
     rev = "v${version}";
-    sha256 = "1izcfxm77hjj8z7a2nk9bbwbz4wc2yqzs2ir8v3k822m1hvgwb9a";
+    sha256 = "1accpxryk4744ydfrqc3la5k376ji11yr84n66dz5cx0f3n71vmz";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/misc/fzf/default.nix b/pkgs/tools/misc/fzf/default.nix
index 55f36b5e4462..9d40077e0d68 100644
--- a/pkgs/tools/misc/fzf/default.nix
+++ b/pkgs/tools/misc/fzf/default.nix
@@ -39,6 +39,7 @@ buildGoPackage rec {
     cp -r $src/man/man1 $man/share/man
     mkdir -p $out/share/vim-plugins
     ln -s $out/share/go/src/github.com/junegunn/fzf $out/share/vim-plugins/${name}
+    cp -R $src/shell $out/share/shell
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/misc/grub/2.0x.nix b/pkgs/tools/misc/grub/2.0x.nix
index 7a70f2bdbff3..2bbeea8133e7 100644
--- a/pkgs/tools/misc/grub/2.0x.nix
+++ b/pkgs/tools/misc/grub/2.0x.nix
@@ -3,6 +3,7 @@
 , zfs ? null
 , efiSupport ? false
 , zfsSupport ? true
+, xenSupport ? false
 }:
 
 with stdenv.lib;
@@ -46,6 +47,7 @@ in (
 
 assert efiSupport -> canEfi;
 assert zfsSupport -> zfs != null;
+assert !(efiSupport && xenSupport);
 
 stdenv.mkDerivation rec {
   name = "grub-${version}";
@@ -98,7 +100,8 @@ stdenv.mkDerivation rec {
   patches = [ ./fix-bash-completion.patch ];
 
   configureFlags = optional zfsSupport "--enable-libzfs"
-    ++ optionals efiSupport [ "--with-platform=efi" "--target=${efiSystemsBuild.${stdenv.system}.target}" "--program-prefix=" ];
+    ++ optionals efiSupport [ "--with-platform=efi" "--target=${efiSystemsBuild.${stdenv.system}.target}" "--program-prefix=" ]
+    ++ optionals xenSupport [ "--with-platform=xen" "--target=${efiSystemsBuild.${stdenv.system}.target}"];
 
   # save target that grub is compiled for
   grubTarget = if efiSupport
diff --git a/pkgs/tools/misc/grub/pvgrub_image/configs/grub-bootstrap.cfg b/pkgs/tools/misc/grub/pvgrub_image/configs/grub-bootstrap.cfg
new file mode 100644
index 000000000000..e9883149ab5d
--- /dev/null
+++ b/pkgs/tools/misc/grub/pvgrub_image/configs/grub-bootstrap.cfg
@@ -0,0 +1 @@
+normal (memdisk)/grub.cfg
diff --git a/pkgs/tools/misc/grub/pvgrub_image/configs/grub.cfg b/pkgs/tools/misc/grub/pvgrub_image/configs/grub.cfg
new file mode 100644
index 000000000000..69115b7101c9
--- /dev/null
+++ b/pkgs/tools/misc/grub/pvgrub_image/configs/grub.cfg
@@ -0,0 +1,10 @@
+# The parentheses around ${root} here to match Grub's config file syntax
+if search -s -f /boot/grub/grub.cfg ; then
+        echo "Reading (${root})/boot/grub/grub.cfg"
+	configfile /boot/grub/grub.cfg
+fi
+
+if search -s -f /grub/grub.cfg ; then
+	echo "Reading (${root})/grub/grub.cfg"
+	configfile /grub/grub.cfg
+fi
diff --git a/pkgs/tools/misc/grub/pvgrub_image/default.nix b/pkgs/tools/misc/grub/pvgrub_image/default.nix
new file mode 100644
index 000000000000..ee6e5065f40b
--- /dev/null
+++ b/pkgs/tools/misc/grub/pvgrub_image/default.nix
@@ -0,0 +1,42 @@
+{ stdenv, grub2_xen }:
+
+with stdenv.lib;
+let
+  efiSystemsBuild = {
+    "i686-linux".target = "i386";
+    "x86_64-linux".target = "x86_64";
+    "aarch64-linux".target = "aarch64";
+  };
+
+in (
+
+stdenv.mkDerivation rec {
+  name = "pvgrub-image";
+
+  configs = ./configs;
+
+  buildInputs = [ grub2_xen ];
+
+  buildCommand = ''
+    cp "${configs}"/* .
+    tar -cf memdisk.tar grub.cfg
+    # We include all modules except all_video.mod as otherwise grub will fail printing "no symbol table"
+    # if we include it.
+    grub-mkimage -O "${efiSystemsBuild.${stdenv.system}.target}-xen" -c grub-bootstrap.cfg \
+      -m memdisk.tar -o "grub-${efiSystemsBuild.${stdenv.system}.target}-xen.bin" \
+      $(ls "${grub2_xen}/lib/grub/${efiSystemsBuild.${stdenv.system}.target}-xen/" |grep 'mod''$'|grep -v '^all_video\.mod''$')
+    mkdir -p "$out/lib/grub-xen"
+    cp "grub-${efiSystemsBuild.${stdenv.system}.target}-xen.bin" $out/lib/grub-xen/
+  '';
+
+  meta = with stdenv.lib; {
+    description = "PvGrub image for use for booting PV Xen guests";
+
+    longDescription =
+      '' This package provides a PvGrub image for booting Para-Virtualized (PV)
+         Xen guests
+      '';
+
+    platforms = platforms.gnu;
+  };
+})
diff --git a/pkgs/tools/misc/hdf4/default.nix b/pkgs/tools/misc/hdf4/default.nix
new file mode 100644
index 000000000000..bc8ea769e8be
--- /dev/null
+++ b/pkgs/tools/misc/hdf4/default.nix
@@ -0,0 +1,77 @@
+{ stdenv
+, fetchurl
+, cmake
+, libjpeg
+, zlib
+, szip ? null
+}:
+
+stdenv.mkDerivation rec {
+  name = "hdf-${version}";
+  version = "4.2.12";
+  src = fetchurl {
+    url = "https://support.hdfgroup.org/ftp/HDF/releases/HDF${version}/src/hdf-${version}.tar.bz2";
+    sha256 = "020jh563sjyxsgml8l809d2i1d4ms9shivwj3gbm7n0ilxbll8id";
+  };
+
+  buildInputs = [
+    cmake
+    libjpeg
+    szip
+    zlib
+  ];
+
+  preConfigure = stdenv.lib.optionalString (szip != null) "export SZIP_INSTALL=${szip}";
+
+  cmakeFlags = [
+    "-DBUILD_SHARED_LIBS=ON"
+    "-DBUILD_TESTING=ON"
+    "-DHDF4_BUILD_TOOLS=ON"
+    "-DHDF4_BUILD_UTILS=ON"
+    "-DHDF4_BUILD_WITH_INSTALL_NAME=OFF"
+    "-DHDF4_ENABLE_JPEG_LIB_SUPPORT=ON"
+    "-DHDF4_ENABLE_NETCDF=OFF"
+    "-DHDF4_ENABLE_Z_LIB_SUPPORT=ON"
+    "-DHDF4_BUILD_FORTRAN=OFF"
+    "-DJPEG_DIR=${libjpeg}"
+  ] ++ stdenv.lib.optionals (szip != null) [
+    "-DHDF4_ENABLE_SZIP_ENCODING=ON"
+    "-DHDF4_ENABLE_SZIP_SUPPORT=ON"
+  ];
+
+  doCheck = true;
+
+  preCheck = ''
+    export LD_LIBRARY_PATH=$(pwd)/bin
+  '' + stdenv.lib.optionalString (stdenv.isDarwin) ''
+    export DYLD_LIBRARY_PATH=$(pwd)/bin
+  '';
+
+  excludedTests = [
+    "MFHDF_TEST-hdftest"
+    "MFHDF_TEST-hdftest-shared"
+    "HDP-dumpsds-18"
+    "NC_TEST-nctest"
+  ];
+
+  checkPhase = let excludedTestsRegex = if (excludedTests != [])
+    then "(" + (stdenv.lib.concatStringsSep "|" excludedTests) + ")"
+    else ""; in ''
+    runHook preCheck
+    ctest -E "${excludedTestsRegex}" --output-on-failure
+    runHook postCheck
+  '';
+
+  outputs = [ "bin" "dev" "out" ];
+
+  postInstall = ''
+    moveToOutput bin "$bin"
+  '';
+
+  meta = {
+    description = "Data model, library, and file format for storing and managing data";
+    homepage = https://support.hdfgroup.org/products/hdf4/;
+    maintainers = with stdenv.lib.maintainers; [ knedlsepp ];
+    platforms = stdenv.lib.platforms.unix;
+  };
+}
diff --git a/pkgs/tools/misc/kronometer/default.nix b/pkgs/tools/misc/kronometer/default.nix
index 6db3278fade0..d74e2b4e12a7 100644
--- a/pkgs/tools/misc/kronometer/default.nix
+++ b/pkgs/tools/misc/kronometer/default.nix
@@ -1,7 +1,7 @@
 {
   mkDerivation, fetchurl, lib,
   extra-cmake-modules, kdoctools, wrapGAppsHook,
-  kconfig, kinit
+  kconfig, kcrash, kinit
 }:
 
 let
@@ -21,5 +21,5 @@ mkDerivation rec {
     maintainers = with maintainers; [ peterhoeg ];
   };
   nativeBuildInputs = [ extra-cmake-modules kdoctools wrapGAppsHook ];
-  propagatedBuildInputs = [ kconfig kinit ];
+  propagatedBuildInputs = [ kconfig kcrash kinit ];
 }
diff --git a/pkgs/tools/misc/megacli/default.nix b/pkgs/tools/misc/megacli/default.nix
index cbebd557d77c..5341c9840be8 100644
--- a/pkgs/tools/misc/megacli/default.nix
+++ b/pkgs/tools/misc/megacli/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, rpmextract, ncurses, patchelf, makeWrapper, requireFile, unzip }:
+{ stdenv, rpmextract, ncurses5, patchelf, makeWrapper, requireFile, unzip }:
 
 assert stdenv.system == "x86_64-linux";
 
@@ -12,10 +12,10 @@ stdenv.mkDerivation rec {
       sha256 = "11jzvh25mlygflazd37gi05xv67im4rgq7sbs5nwgw3gxdh4xfjj";
     };
 
-  buildInputs = [rpmextract ncurses unzip makeWrapper];
+  buildInputs = [rpmextract ncurses5 unzip makeWrapper];
   libPath =
     stdenv.lib.makeLibraryPath
-       [ stdenv.cc.cc stdenv.cc.libc ncurses ];
+       [ stdenv.cc.cc stdenv.cc.libc ncurses5 ];
 
   buildCommand = ''
     mkdir -p $out/bin
diff --git a/pkgs/tools/misc/partition-manager/default.nix b/pkgs/tools/misc/partition-manager/default.nix
index 52183a3fff35..a1c1eccdd88a 100644
--- a/pkgs/tools/misc/partition-manager/default.nix
+++ b/pkgs/tools/misc/partition-manager/default.nix
@@ -1,6 +1,6 @@
 { mkDerivation, fetchurl, lib
 , extra-cmake-modules, kdoctools, wrapGAppsHook
-, kconfig, kinit, kpmcore
+, kconfig, kcrash, kinit, kpmcore
 , eject, libatasmart }:
 
 let
@@ -22,5 +22,5 @@ in mkDerivation rec {
   nativeBuildInputs = [ extra-cmake-modules kdoctools wrapGAppsHook ];
   # refer to kpmcore for the use of eject
   buildInputs = [ eject libatasmart ];
-  propagatedBuildInputs = [ kconfig kinit kpmcore ];
+  propagatedBuildInputs = [ kconfig kcrash kinit kpmcore ];
 }
diff --git a/pkgs/tools/misc/peruse/default.nix b/pkgs/tools/misc/peruse/default.nix
index cd872fd966e5..a3fdca001d94 100644
--- a/pkgs/tools/misc/peruse/default.nix
+++ b/pkgs/tools/misc/peruse/default.nix
@@ -1,7 +1,7 @@
 {
   mkDerivation, fetchFromGitHub, fetchurl, lib,
   extra-cmake-modules, kdoctools, wrapGAppsHook,
-  baloo, kconfig, kfilemetadata, kinit, kirigami, knewstuff, plasma-framework
+  baloo, karchive, kconfig, kcrash, kfilemetadata, kinit, kirigami, knewstuff, plasma-framework
 }:
 
 let
@@ -23,7 +23,7 @@ in mkDerivation rec {
 
   nativeBuildInputs = [ extra-cmake-modules kdoctools wrapGAppsHook ];
 
-  propagatedBuildInputs = [ baloo kconfig kfilemetadata kinit kirigami knewstuff plasma-framework ];
+  propagatedBuildInputs = [ baloo karchive kconfig kcrash kfilemetadata kinit kirigami knewstuff plasma-framework ];
 
   pathsToLink = [ "/etc/xdg/peruse.knsrc"];
 
diff --git a/pkgs/tools/misc/plowshare/default.nix b/pkgs/tools/misc/plowshare/default.nix
index d1b5481ad017..8282c2a1cd96 100644
--- a/pkgs/tools/misc/plowshare/default.nix
+++ b/pkgs/tools/misc/plowshare/default.nix
@@ -1,15 +1,15 @@
-{ stdenv, fetchFromGitHub, makeWrapper, curl, spidermonkey }:
+{ stdenv, fetchFromGitHub, makeWrapper, curl, recode, spidermonkey }:
 
 stdenv.mkDerivation rec {
 
-  name = "plowshare4-${version}";
-  version = "1.1.0";
+  name = "plowshare-${version}";
+  version = "2.1.6";
 
   src = fetchFromGitHub {
     owner = "mcrapet";
     repo = "plowshare";
     rev = "v${version}";
-    sha256 = "1xxkdv4q97dfzbcdnmy5079a59fwh8myxlvdr2dlxdv70fb72sq9";
+    sha256 = "116291w0z1r61xm3a3zjlh85f05pk4ng9f1wbj9kv1j3xrjn4v4c";
   };
 
   buildInputs = [ makeWrapper ];
@@ -19,8 +19,8 @@ stdenv.mkDerivation rec {
   installPhase = ''
     make PREFIX="$out" install
 
-    for fn in plow{del,down,list,up}; do
-      wrapProgram "$out/bin/$fn" --prefix PATH : "${stdenv.lib.makeBinPath [ curl spidermonkey ]}"
+    for fn in plow{del,down,list,mod,probe,up}; do
+      wrapProgram "$out/bin/$fn" --prefix PATH : "${stdenv.lib.makeBinPath [ curl recode spidermonkey ]}"
     done
   '';
 
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
       A command-line download/upload tool for popular file sharing websites
     '';
     license = stdenv.lib.licenses.gpl3;
-    maintainers = [ stdenv.lib.maintainers.aforemny ];
+    maintainers = with stdenv.lib.maintainers; [ aforemny jfrankenau ];
     platforms = stdenv.lib.platforms.linux;
   };
 }
diff --git a/pkgs/tools/misc/screen/default.nix b/pkgs/tools/misc/screen/default.nix
index 7af602106ff3..45b04828b30d 100644
--- a/pkgs/tools/misc/screen/default.nix
+++ b/pkgs/tools/misc/screen/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "screen-${version}";
-  version = "4.5.1";
+  version = "4.6.0";
 
   src = fetchurl {
     url = "mirror://gnu/screen/${name}.tar.gz";
-    sha256 = "0bbv16gpxrh64sn4bvjy3qjy7jsxjlqlilyysin02fwnvla23nwp";
+    sha256 = "1m7yd2bs1i623kk27nfy3qa2mgjp5qjqxwj5qz21r51ycmmp0cwl";
   };
 
   configureFlags= [
diff --git a/pkgs/tools/misc/tlp/default.nix b/pkgs/tools/misc/tlp/default.nix
index 9a2f9b65e8c2..ff69fb01cea7 100644
--- a/pkgs/tools/misc/tlp/default.nix
+++ b/pkgs/tools/misc/tlp/default.nix
@@ -14,13 +14,13 @@ let
 
 in stdenv.mkDerivation rec {
   name = "tlp-${version}";
-  version = "0.9";
+  version = "1.0";
 
   src = fetchFromGitHub {
         owner = "linrunner";
         repo = "TLP";
         rev = "${version}";
-        sha256 = "1gwi0h9klhdvqfqvmn297l1vyhj4g9dqvf50lcbswry02mvnd2vn";
+        sha256 = "0gq1y1qnzwyv7cw32g4ymlfssi2ayrbnd04y4l242k6n41d05bij";
       };
 
   makeFlags = [ "DESTDIR=$(out)"
diff --git a/pkgs/tools/misc/x11idle/default.nix b/pkgs/tools/misc/x11idle/default.nix
new file mode 100644
index 000000000000..5876cfb6b74a
--- /dev/null
+++ b/pkgs/tools/misc/x11idle/default.nix
@@ -0,0 +1,33 @@
+{ stdenv, xlibs, fetchgit, libXScrnSaver, libX11 }:
+
+stdenv.mkDerivation {
+  name = "x11idle-unstable-2017-07-01";
+
+  src = fetchgit {
+    url = "git://orgmode.org/org-mode.git";
+    rev = "fbd865941f3105f689f78bf053bb3b353b9b8a23";
+    sha256 = "0ma3m48f4s38xln0gl1ww9i5x28ij0ipxc94kx5h2931zy7lqzvz";
+  };
+
+  buildInputs = [ libXScrnSaver libX11 ];
+
+  unpackPhase = ":";
+
+  installPhase = ''
+    mkdir -p $out/bin
+    gcc -lXss -lX11 $src/contrib/scripts/x11idle.c -o $out/bin/x11idle
+  '';
+
+  meta = with stdenv.lib; {
+    description = ''
+      Compute consecutive idle time for current X11 session with millisecond resolution
+    '';
+    longDescription = ''
+      Idle time passes when the user does not act, i.e. when the user doesn't move the mouse or use the keyboard.
+    '';
+    homepage = "http://orgmode.org/";
+    license = licenses.gpl3;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.swflint ];
+  };
+}
diff --git a/pkgs/tools/misc/youtube-dl/default.nix b/pkgs/tools/misc/youtube-dl/default.nix
index 0af3b72f6aff..b730d45c9e20 100644
--- a/pkgs/tools/misc/youtube-dl/default.nix
+++ b/pkgs/tools/misc/youtube-dl/default.nix
@@ -15,11 +15,11 @@ with stdenv.lib;
 buildPythonApplication rec {
 
   name = "youtube-dl-${version}";
-  version = "2017.06.18";
+  version = "2017.07.09";
 
   src = fetchurl {
     url = "https://yt-dl.org/downloads/${version}/${name}.tar.gz";
-    sha256 = "16az9rwr71hvs2z2xagnk71xqs7si0nb8rkn63r7pfv4rb134ggm";
+    sha256 = "0phrfby2nk5y5x5173bbg3jcr2ajk849al3zji5y39z39dj36ba2";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/misc/zabbix-cli/default.nix b/pkgs/tools/misc/zabbix-cli/default.nix
new file mode 100644
index 000000000000..77c06ea1911d
--- /dev/null
+++ b/pkgs/tools/misc/zabbix-cli/default.nix
@@ -0,0 +1,24 @@
+{ fetchFromGitHub, lib, python2Packages }:
+let
+  pythonPackages = python2Packages;
+
+in pythonPackages.buildPythonApplication rec {
+  name = "zabbix-cli-${version}";
+  version = "1.6.1";
+
+  propagatedBuildInputs = with pythonPackages; [ argparse requests ];
+
+  src = fetchFromGitHub {
+    owner = "usit-gd";
+    repo = "zabbix-cli";
+    rev = version;
+    sha256 = "17ip3s8ifgj264zwxrr857wk02xmzmlsjrr613mdhkgdwizqbcs3";
+  };
+
+  meta = with lib; {
+    description = "Command-line interface for Zabbix";
+    homepage = src.meta.homepage;
+    license = [ licenses.gpl3 ];
+    maintainers = [ maintainers.womfoo ];
+  };
+}
diff --git a/pkgs/tools/networking/burpsuite/default.nix b/pkgs/tools/networking/burpsuite/default.nix
index 6f7e4ba4b695..976285eeee71 100644
--- a/pkgs/tools/networking/burpsuite/default.nix
+++ b/pkgs/tools/networking/burpsuite/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, jre }:
 
 let
-  version = "1.7.06";
+  version = "1.7.23";
   jar = fetchurl {
     name = "burpsuite.jar";
     url = "https://portswigger.net/Burp/Releases/Download?productId=100&version=${version}&type=Jar";
-    sha256 = "13x3x0la2jmm7zr66mvczzlmsy1parfibnl9s4iwi1nls4ikv7kl";
+    sha256 = "1y83qisn9pkn88vphpli7h8nacv8jv3sq0h04zbri25nfkgvl4an";
   };
   launcher = ''
     #!${stdenv.shell}
diff --git a/pkgs/tools/networking/cjdns/default.nix b/pkgs/tools/networking/cjdns/default.nix
index 3f2d81249d11..12a8a1a184fe 100644
--- a/pkgs/tools/networking/cjdns/default.nix
+++ b/pkgs/tools/networking/cjdns/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, fetchpatch, nodejs, which, python27, utillinux }:
 
-let version = "19.1"; in
+let version = "20"; in
 stdenv.mkDerivation {
   name = "cjdns-"+version;
 
   src = fetchurl {
     url = "https://github.com/cjdelisle/cjdns/archive/cjdns-v${version}.tar.gz";
-    sha256 = "53c568a500215b055a9894178eb4477bd93a6e1abf751d0bc5ef2a03ea01a188";
+    sha256 = "1dyqxi9l2pmrgm16a161909rg3vfzvib40frr7p6ddpk8yfh5888";
   };
 
   buildInputs = [ which python27 nodejs ] ++
diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index d1f7c4112c61..daf5a19b01c2 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -29,6 +29,7 @@ stdenv.mkDerivation rec {
   };
 
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
+  separateDebugInfo = stdenv.isLinux;
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/tools/networking/email/default.nix b/pkgs/tools/networking/email/default.nix
index 017da63a1e92..c7a6fbcfd7c7 100644
--- a/pkgs/tools/networking/email/default.nix
+++ b/pkgs/tools/networking/email/default.nix
@@ -8,7 +8,7 @@ let
     sha256 = "1cxxzhm36civ6vjdgrk7mfmlzkih44kdii6l2xgy4r434s8rzcpn";
   };
 
-  srcRoot = "eMail-${eMailSrc.rev}-src";
+  srcRoot = eMailSrc.name;
 
   dlibSrc = fetchFromGitHub {
     owner = "deanproxy";
diff --git a/pkgs/tools/networking/iperf/3.nix b/pkgs/tools/networking/iperf/3.nix
index 0d1e3194bd87..a86e3e04530d 100644
--- a/pkgs/tools/networking/iperf/3.nix
+++ b/pkgs/tools/networking/iperf/3.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "iperf-3.1.7";
+  name = "iperf-3.2";
 
   src = fetchurl {
     url = "http://downloads.es.net/pub/iperf/${name}.tar.gz";
-    sha256 = "0kvk8d0a3dcxc8fisyprbn01y8akxj4sx8ld5dh508p9dx077vx4";
+    sha256 = "07cwrl9q5pmfjlh6ilpk7hm25lpkcaf917zhpmfq918lhrpv61zj";
   };
 
   postInstall = ''
diff --git a/pkgs/tools/networking/jnettop/default.nix b/pkgs/tools/networking/jnettop/default.nix
index a09da684c983..ec2f34f56010 100644
--- a/pkgs/tools/networking/jnettop/default.nix
+++ b/pkgs/tools/networking/jnettop/default.nix
@@ -1,4 +1,4 @@
-{ fetchurl, stdenv, autoconf, libpcap, ncurses, pkgconfig, glib }:
+{ fetchurl, fetchpatch, stdenv, autoconf, libpcap, ncurses, pkgconfig, glib }:
 
 stdenv.mkDerivation rec {
   name = "jnettop-0.13.0";
@@ -10,7 +10,14 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ autoconf libpcap ncurses pkgconfig glib ];
 
-  patches = [ ./no-dns-resolution.patch ];
+  patches = [
+    ./no-dns-resolution.patch
+    (fetchpatch {
+      url = "https://sources.debian.net/data/main/j/jnettop/0.13.0-1/debian/patches/0001-Use-64-bit-integers-for-byte-totals-support-bigger-u.patch";
+      sha256 = "1b0alc12sj8pzcb66f8xslbqlbsvq28kz34v6jfhbb1q25hyr7jg";
+    })
+  ];
+
   preConfigure = '' autoconf '';
 
   meta = {
diff --git a/pkgs/tools/networking/lldpd/default.nix b/pkgs/tools/networking/lldpd/default.nix
index 8e3bd7a82bf3..6b816fc8740a 100644
--- a/pkgs/tools/networking/lldpd/default.nix
+++ b/pkgs/tools/networking/lldpd/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, pkgconfig
+{ stdenv, lib, fetchurl, pkgconfig, removeReferencesTo
 , libevent, readline, net_snmp }:
 
 stdenv.mkDerivation rec {
@@ -16,13 +16,17 @@ stdenv.mkDerivation rec {
     "--with-snmp"
   ];
 
-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ pkgconfig removeReferencesTo ];
   buildInputs = [ libevent readline net_snmp ];
 
   enableParallelBuilding = true;
 
   outputs = [ "out" "dev" "man" "doc" ];
 
+  preFixup = ''
+    find $out -type f -exec remove-references-to -t ${stdenv.cc} '{}' +
+  '';
+
   meta = with lib; {
     description = "802.1ab implementation (LLDP) to help you locate neighbors of all your equipments";
     homepage = "https://vincentbernat.github.io/lldpd/";
diff --git a/pkgs/tools/networking/mailutils/default.nix b/pkgs/tools/networking/mailutils/default.nix
index 0ae993db332e..f83ea004db63 100644
--- a/pkgs/tools/networking/mailutils/default.nix
+++ b/pkgs/tools/networking/mailutils/default.nix
@@ -14,6 +14,12 @@ stdenv.mkDerivation rec {
 
   patches = [ ./path-to-cat.patch ./no-gets.patch ./scm_c_string.patch ];
 
+  postPatch = ''
+    sed -i -e '/chown root:mail/d' \
+           -e 's/chmod [24]755/chmod 0755/' \
+      */Makefile{,.in,.am}
+  '';
+
   configureFlags = [
     "--with-gsasl"
     "--with-gssapi=${gss}"
diff --git a/pkgs/tools/networking/mitmproxy/default.nix b/pkgs/tools/networking/mitmproxy/default.nix
index 36bb9cb791bd..715bc209e979 100644
--- a/pkgs/tools/networking/mitmproxy/default.nix
+++ b/pkgs/tools/networking/mitmproxy/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, python3Packages }:
+{ stdenv, fetchurl, fetchFromGitHub, python3Packages }:
 
 python3Packages.buildPythonPackage rec {
   baseName = "mitmproxy";
@@ -12,6 +12,15 @@ python3Packages.buildPythonPackage rec {
     sha256 = "1x1a28al5clpfd69rjcpw26gjjnpsm1vfl4scrwpdd1jhkw044h9";
   };
 
+  patches = [
+    # Bump pyopenssl dependency
+    # https://github.com/mitmproxy/mitmproxy/pull/2252
+    (fetchurl {
+      url = "https://patch-diff.githubusercontent.com/raw/mitmproxy/mitmproxy/pull/2252.patch";
+      sha256 = "0s3a6lf0wjnxi1r70qlhh0siaxhk5j2cysnv4xfkji3f2v7hhri4";
+    })
+  ];
+
   propagatedBuildInputs = with python3Packages; [
     blinker click certifi construct cryptography
     cssutils editorconfig h2 html2text hyperframe
diff --git a/pkgs/tools/networking/mu/default.nix b/pkgs/tools/networking/mu/default.nix
index 33db7b1cabac..595337906d02 100644
--- a/pkgs/tools/networking/mu/default.nix
+++ b/pkgs/tools/networking/mu/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub, sqlite, pkgconfig, autoreconfHook, pmccabe
 , xapian, glib, gmime, texinfo , emacs, guile
-, gtk3, webkitgtk24x, libsoup, icu
+, gtk3, webkitgtk24x-gtk3, libsoup, icu
 , withMug ? false }:
 
 stdenv.mkDerivation rec {
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   # pmccabe should be a checkInput instead, but configure looks for it
   buildInputs = [
     sqlite xapian glib gmime texinfo emacs guile libsoup icu
-  ] ++ stdenv.lib.optionals withMug [ gtk3 webkitgtk24x ];
+  ] ++ stdenv.lib.optionals withMug [ gtk3 webkitgtk24x-gtk3 ];
   nativeBuildInputs = [ pkgconfig autoreconfHook ];
   checkInputs = [ pmccabe ];
 
diff --git a/pkgs/tools/networking/netselect/default.nix b/pkgs/tools/networking/netselect/default.nix
index f326059d9d77..6015ff9fbc7c 100644
--- a/pkgs/tools/networking/netselect/default.nix
+++ b/pkgs/tools/networking/netselect/default.nix
@@ -8,10 +8,13 @@ stdenv.mkDerivation {
     sha256 = "0y69z59vylj9x9nk5jqn6ihx7dkzg09gpv2w1q1rs8fmi4jr90gy";
   };
 
-  preBuild = "
+  preBuild = ''
     makeFlagsArray=(PREFIX=$out)
-    substituteInPlace Makefile --replace '-o root' '' --replace '-g root' ''
-  ";
+    substituteInPlace Makefile \
+      --replace "-o root" "" \
+      --replace "-g root" "" \
+      --replace "4755"    "0755"
+  '';
   
   meta = {
     homepage = http://alumnit.ca/~apenwarr/netselect/;
diff --git a/pkgs/tools/networking/nzbget/default.nix b/pkgs/tools/networking/nzbget/default.nix
index e7a23b70ce9a..d72ee844c0ec 100644
--- a/pkgs/tools/networking/nzbget/default.nix
+++ b/pkgs/tools/networking/nzbget/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   name = "nzbget-${version}";
-  version = "18.1";
+  version = "19.0";
 
   src = fetchurl {
     url = "http://github.com/nzbget/nzbget/releases/download/v${version}/nzbget-${version}-src.tar.gz";
-    sha256 = "069q75b0s9fzzy15m96dhn83jypgc91yx998rl0nykfcl7nzkxyx";
+    sha256 = "08kgi4zmh4h1pvxh8x4c3ydf9xl2s6ncm579f0wdm2zknvpf0j16";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/tools/networking/offlineimap/default.nix b/pkgs/tools/networking/offlineimap/default.nix
index 70a4bc87b97f..ae0318faaa71 100644
--- a/pkgs/tools/networking/offlineimap/default.nix
+++ b/pkgs/tools/networking/offlineimap/default.nix
@@ -2,7 +2,7 @@
   asciidoc, libxml2, libxslt, docbook_xml_xslt }:
 
 pythonPackages.buildPythonApplication rec {
-  version = "7.1.0";
+  version = "7.1.1";
   name = "offlineimap-${version}";
   namePrefix = "";
 
@@ -10,7 +10,7 @@ pythonPackages.buildPythonApplication rec {
     owner = "OfflineIMAP";
     repo = "offlineimap";
     rev = "v${version}";
-    sha256 = "10hxzp2hwkarvmwhw9mxbp9wkbclxwm6n0d7i4xs8r1s94yiffb3";
+    sha256 = "12fv6fzi3cb0hkvs4h5vj2i440d85wzjjyjl90zvyxvlfy0pmljl";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/networking/tcpdump/default.nix b/pkgs/tools/networking/tcpdump/default.nix
index 42cb3867e05c..a7130a3891b9 100644
--- a/pkgs/tools/networking/tcpdump/default.nix
+++ b/pkgs/tools/networking/tcpdump/default.nix
@@ -1,4 +1,6 @@
-{ stdenv, fetchurl, libpcap, enableStatic ? false }:
+{ stdenv, fetchurl, libpcap, enableStatic ? false
+, hostPlatform
+}:
 
 stdenv.mkDerivation rec {
   name = "tcpdump-${version}";
@@ -15,7 +17,7 @@ stdenv.mkDerivation rec {
   crossAttrs = {
     LDFLAGS = if enableStatic then "-static" else "";
     configureFlags = [ "ac_cv_linux_vers=2" ] ++ (stdenv.lib.optional
-      (stdenv.cross.platform.kernelMajor == "2.4") "--disable-ipv6");
+      (hostPlatform.platform.kernelMajor == "2.4") "--disable-ipv6");
   };
 
   meta = {
diff --git a/pkgs/tools/networking/ucspi-tcp/default.nix b/pkgs/tools/networking/ucspi-tcp/default.nix
index 0bcd35b21ef9..fc46c6a15bc5 100644
--- a/pkgs/tools/networking/ucspi-tcp/default.nix
+++ b/pkgs/tools/networking/ucspi-tcp/default.nix
@@ -14,6 +14,7 @@ stdenv.mkDerivation rec {
       url = "http://ftp.de.debian.org/debian/pool/main/u/ucspi-tcp/ucspi-tcp_0.88-3.diff.gz";
       sha256 = "0mzmhz8hjkrs0khmkzs5i0s1kgmgaqz07h493bd5jj5fm5njxln6";
     })
+    ./remove-setuid.patch
   ];
 
   # Apply Debian patches
diff --git a/pkgs/tools/networking/ucspi-tcp/remove-setuid.patch b/pkgs/tools/networking/ucspi-tcp/remove-setuid.patch
new file mode 100644
index 000000000000..dd6933208046
--- /dev/null
+++ b/pkgs/tools/networking/ucspi-tcp/remove-setuid.patch
@@ -0,0 +1,15 @@
+diff --git a/hier.c b/hier.c
+index 5663ada..1d73b84 100644
+--- a/hier.c
++++ b/hier.c
+@@ -2,8 +2,8 @@
+ 
+ void hier()
+ {
+-  h(auto_home,-1,-1,02755);
+-  d(auto_home,"bin",-1,-1,02755);
++  h(auto_home,-1,-1,0755);
++  d(auto_home,"bin",-1,-1,0755);
+ 
+   c(auto_home,"bin","tcpserver",-1,-1,0755);
+   c(auto_home,"bin","tcprules",-1,-1,0755);
diff --git a/pkgs/tools/networking/unbound/default.nix b/pkgs/tools/networking/unbound/default.nix
index 7fc5fb90173d..e700ea4fb286 100644
--- a/pkgs/tools/networking/unbound/default.nix
+++ b/pkgs/tools/networking/unbound/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "unbound-${version}";
-  version = "1.6.3";
+  version = "1.6.4";
 
   src = fetchurl {
     url = "http://unbound.net/downloads/${name}.tar.gz";
-    sha256 = "0pw4m4z5qspsagxzbjb61xq5bhd57amw26xqvqzi6b8d3mf6azjc";
+    sha256 = "1vbzfzp932nhii5vq7z7rpczdyv624p17sy9hj1cn763ds0qh2nz";
   };
 
   outputs = [ "out" "lib" "man" ]; # "dev" would only split ~20 kB
diff --git a/pkgs/tools/package-management/disnix/default.nix b/pkgs/tools/package-management/disnix/default.nix
index e83f8047f4ba..534f8767a055 100644
--- a/pkgs/tools/package-management/disnix/default.nix
+++ b/pkgs/tools/package-management/disnix/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, pkgconfig, glib, libxml2, libxslt, getopt, nixUnstable, dysnomia, libintlOrEmpty, libiconv }:
 
 stdenv.mkDerivation {
-  name = "disnix-0.7";
+  name = "disnix-0.7.1";
   
   src = fetchurl {
-    url = https://github.com/svanderburg/disnix/files/842828/disnix-0.7.tar.gz;
-    sha256 = "120iaqpj7zcy94dpizzdxjwf8qb2rfrx5394jghmhc6jy88vdp71";
+    url = https://github.com/svanderburg/disnix/releases/download/disnix-0.7.1/disnix-0.7.1.tar.gz;
+    sha256 = "0wxik73bk3hh4xjjj8jcgrwv1722m7cqgpiiwjsgxs346jvhrv2s";
   };
   
   buildInputs = [ pkgconfig glib libxml2 libxslt getopt nixUnstable libintlOrEmpty libiconv dysnomia ];
diff --git a/pkgs/tools/package-management/disnix/disnixos/default.nix b/pkgs/tools/package-management/disnix/disnixos/default.nix
index 81be1549c83c..2a6a0dcc78a3 100644
--- a/pkgs/tools/package-management/disnix/disnixos/default.nix
+++ b/pkgs/tools/package-management/disnix/disnixos/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, dysnomia, disnix, socat, pkgconfig, getopt }:
 
 stdenv.mkDerivation {
-  name = "disnixos-0.6";
+  name = "disnixos-0.6.1";
   
   src = fetchurl {
-    url = https://github.com/svanderburg/disnixos/files/842874/disnixos-0.6.tar.gz;
-    sha256 = "0pgqsk8qndn614z02jq3vbxzpx6fmgsm6pr1g0iqz55pzwamw9j7";
+    url = https://github.com/svanderburg/disnixos/releases/download/disnixos-0.6.1/disnixos-0.6.1.tar.gz;
+    sha256 = "0pqv8n9942vjwmb32m1af29fi0vjlsbwkj2c7h1xs28z6wahr7wa";
   };
   
   buildInputs = [ socat pkgconfig dysnomia disnix getopt ];
diff --git a/pkgs/tools/package-management/elm-github-install/Gemfile b/pkgs/tools/package-management/elm-github-install/Gemfile
new file mode 100644
index 000000000000..b97eab9777d7
--- /dev/null
+++ b/pkgs/tools/package-management/elm-github-install/Gemfile
@@ -0,0 +1,2 @@
+source 'https://rubygems.org'
+gem 'elm_install'
diff --git a/pkgs/tools/package-management/elm-github-install/Gemfile.lock b/pkgs/tools/package-management/elm-github-install/Gemfile.lock
new file mode 100644
index 000000000000..a551368eade1
--- /dev/null
+++ b/pkgs/tools/package-management/elm-github-install/Gemfile.lock
@@ -0,0 +1,39 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    adts (0.1.2)
+    commander (4.4.3)
+      highline (~> 1.7.2)
+    contracts (0.16.0)
+    elm_install (1.0.1)
+      adts (~> 0.1.2)
+      commander (~> 4.4, >= 4.4.2)
+      contracts (~> 0.16.0)
+      git (~> 1.3)
+      git_clone_url (~> 2.0)
+      hashdiff (~> 0.3.1)
+      indentation (~> 0.1.1)
+      smart_colored (~> 1.1, >= 1.1.1)
+      solve (~> 3.1)
+    git (1.3.0)
+    git_clone_url (2.0.0)
+      uri-ssh_git (>= 2.0)
+    hashdiff (0.3.4)
+    highline (1.7.8)
+    indentation (0.1.1)
+    molinillo (0.5.7)
+    semverse (2.0.0)
+    smart_colored (1.1.1)
+    solve (3.1.0)
+      molinillo (>= 0.5)
+      semverse (>= 1.1, < 3.0)
+    uri-ssh_git (2.0.0)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  elm_install
+
+BUNDLED WITH
+   1.14.4
diff --git a/pkgs/tools/package-management/elm-github-install/default.nix b/pkgs/tools/package-management/elm-github-install/default.nix
new file mode 100644
index 000000000000..1f70dc1c8c8c
--- /dev/null
+++ b/pkgs/tools/package-management/elm-github-install/default.nix
@@ -0,0 +1,17 @@
+{ lib, bundlerEnv, ruby }:
+
+bundlerEnv rec {
+  name = "elm-github-install-${version}";
+
+  version = (import ./gemset.nix).elm_install.version;
+  inherit ruby;
+  gemdir = ./.;
+
+  meta = with lib; {
+    description = "Install Elm packages from git repositories.";
+    homepage    = https://github.com/gdotdesign/elm-github-install;
+    license     = licenses.unfree;
+    maintainers = [ maintainers.roberth ];
+    platforms   = platforms.all;
+  };
+}
diff --git a/pkgs/tools/package-management/elm-github-install/gemset.nix b/pkgs/tools/package-management/elm-github-install/gemset.nix
new file mode 100644
index 000000000000..d310b41d7aaf
--- /dev/null
+++ b/pkgs/tools/package-management/elm-github-install/gemset.nix
@@ -0,0 +1,114 @@
+{
+  adts = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1793bfsgg8ca58b70xas9rglnspig41ih0iwqcad62s0grxzrjwz";
+      type = "gem";
+    };
+    version = "0.1.2";
+  };
+  commander = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "01qx76y05v29kgyjsfkai73gwfnqhypp1k8v024m9w7qzpv4mpxf";
+      type = "gem";
+    };
+    version = "4.4.3";
+  };
+  contracts = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "119f5p1n6r5svbx8h09za6a4vrsnj5i1pzr9cqdn9hj3wrxvyl3a";
+      type = "gem";
+    };
+    version = "0.16.0";
+  };
+  elm_install = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0d3fwhj54madabmzamss865kj8czicgaq5fbdll9kpapqvy6a2j5";
+      type = "gem";
+    };
+    version = "1.0.1";
+  };
+  git = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1waikaggw7a1d24nw0sh8fd419gbf7awh000qhsf411valycj6q3";
+      type = "gem";
+    };
+    version = "1.3.0";
+  };
+  git_clone_url = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0qgq7pjl461si3m2gr28vwbx47dcbpyy682mcwra5y1klpkbcvr5";
+      type = "gem";
+    };
+    version = "2.0.0";
+  };
+  hashdiff = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1n6hj7k7b9hazac0j48ypbak2nqi5wy4nh5cjra6xl3a92r8db0a";
+      type = "gem";
+    };
+    version = "0.3.4";
+  };
+  highline = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1nf5lgdn6ni2lpfdn4gk3gi47fmnca2bdirabbjbz1fk9w4p8lkr";
+      type = "gem";
+    };
+    version = "1.7.8";
+  };
+  indentation = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0ix64qgmm91xm1yiqxdcn9bqb1l6gwvkv7322yni34b3bd16lgvc";
+      type = "gem";
+    };
+    version = "0.1.1";
+  };
+  molinillo = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "19h1nks0x2ljwyijs2rd1f9sh05j8xqvjaqk1rslp5nyy6h4a758";
+      type = "gem";
+    };
+    version = "0.5.7";
+  };
+  semverse = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1cf6iv5wgwb7b8jf7il751223k9yahz9aym06s9r0prda5mwddyy";
+      type = "gem";
+    };
+    version = "2.0.0";
+  };
+  smart_colored = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0hccah5iwsvn9rf7zdgl7mdbh0h63vfwy1c6d280cb9qkfj8rdny";
+      type = "gem";
+    };
+    version = "1.1.1";
+  };
+  solve = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0bbzny2bl94mv1xwcfrxbi3fjhxxawlz6la7mip2wwz9kkaf376h";
+      type = "gem";
+    };
+    version = "3.1.0";
+  };
+  uri-ssh_git = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0klyyvivbjll2ry18d8fhm1rbxbzd4kqa9lskxyiha4ndlb22cqj";
+      type = "gem";
+    };
+    version = "2.0.0";
+  };
+}
\ No newline at end of file
diff --git a/pkgs/tools/package-management/gx/default.nix b/pkgs/tools/package-management/gx/default.nix
index b879ef002b12..524dc01cbe72 100644
--- a/pkgs/tools/package-management/gx/default.nix
+++ b/pkgs/tools/package-management/gx/default.nix
@@ -1,24 +1,19 @@
 # This file was generated by go2nix.
-{ stdenv, buildGoPackage, fetchgit, fetchhg, fetchbzr, fetchsvn }:
+{ stdenv, buildGoPackage, fetchgit }:
 
 buildGoPackage rec {
   name = "gx-${version}";
-  version = "20160601-${stdenv.lib.strings.substring 0 7 rev}";
-  rev = "f84ddf792ceb329e20c857731154798e1ce87314";
+  version = "0.12.0";
+  rev = "refs/tags/v${version}";
 
   goPackagePath = "github.com/whyrusleeping/gx";
 
   src = fetchgit {
     inherit rev;
     url = "https://github.com/whyrusleeping/gx";
-    sha256 = "10a6p9ba526jr6m66x3vsa3xsjlnzv7yma8vyp8d0bf0hs44bpih";
+    sha256 = "0pvf0j14xnzy01fxilja8xbki0i0g7h7y20jzw74ds5a7ywsdx8r";
   };
 
-  prePatch = ''
-    substituteInPlace tests/lib/random-dep.go \
-      --replace "github.com/ipfs/go-ipfs/Godeps/_workspace/src/github.com/jbenet/go-random" "github.com/jbenet/go-random"
-  '';
-
   goDeps = ./deps.nix;
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/package-management/gx/deps.nix b/pkgs/tools/package-management/gx/deps.nix
index 19372f807c21..c34d142c3850 100644
--- a/pkgs/tools/package-management/gx/deps.nix
+++ b/pkgs/tools/package-management/gx/deps.nix
@@ -1,56 +1,56 @@
 [
   {
-    goPackagePath = "github.com/anacrolix/missinggo";
+    goPackagePath = "github.com/agl/ed25519";
     fetch = {
       type = "git";
-      url = "https://github.com/anacrolix/missinggo";
-      rev = "e40875155efce3d98562ca9e265e152c364ada3e";
-      sha256 = "1p1qgnb430dz84d2395i6417jqnlvrx9zwg9rq1ri8d5v7dif4fg";
+      url = "https://github.com/agl/ed25519";
+      rev = "5312a61534124124185d41f09206b9fef1d88403";
+      sha256 = "1v8mhkf1m3ga5262s75vabskxvsw5rpqvi5nwhxwiv7gfk6h823i";
     };
   }
   {
-    goPackagePath = "github.com/anacrolix/sync";
+    goPackagePath = "github.com/blang/semver";
     fetch = {
       type = "git";
-      url = "https://github.com/anacrolix/sync";
-      rev = "812602587b72df6a2a4f6e30536adc75394a374b";
-      sha256 = "0pc38wanzws3vzqj0l5pakg3gn2hacqrb4n7pd0sqz083rss5k0l";
+      url = "https://github.com/blang/semver";
+      rev = "4a1e882c79dcf4ec00d2e29fac74b9c8938d5052";
+      sha256 = "07rk2jzmppw1v06qvsn11l1mwkyg6y9y06jfik316zq8glfh8b3m";
     };
   }
   {
-    goPackagePath = "github.com/anacrolix/utp";
+    goPackagePath = "github.com/btcsuite/btcd";
     fetch = {
       type = "git";
-      url = "https://github.com/anacrolix/utp";
-      rev = "d7ad5aff2b8a5fa415d1c1ed00b71cfd8b4c69e0";
-      sha256 = "07piwfny3b4prxf2shc512ai0qmrmrj839lbza9clhgcmj1a75d7";
+      url = "https://github.com/btcsuite/btcd";
+      rev = "9822ffad6802d3b902442b727a238230194d961f";
+      sha256 = "0mk3qxpn29gsbkvk6rj6jzsw3fn2z51afq890wpk4qz029kvip2h";
     };
   }
   {
-    goPackagePath = "github.com/blang/semver";
+    goPackagePath = "github.com/codegangsta/cli";
     fetch = {
       type = "git";
-      url = "https://github.com/blang/semver";
-      rev = "aea32c919a18e5ef4537bbd283ff29594b1b0165";
-      sha256 = "1s80qlij6j6wrh0fhm0l11hbf3qjra67nca5bl7izyfjj4621fcd";
+      url = "https://github.com/codegangsta/cli";
+      rev = "4b90d79a682b4bf685762c7452db20f2a676ecb2";
+      sha256 = "0ls3lfmbfwirm9j95b6yrw41wgh72lfkp1cvs873zw04si4yvaqr";
     };
   }
   {
-    goPackagePath = "github.com/bradfitz/iter";
+    goPackagePath = "github.com/coreos/go-semver";
     fetch = {
       type = "git";
-      url = "https://github.com/bradfitz/iter";
-      rev = "454541ec3da2a73fc34fd049b19ee5777bf19345";
-      sha256 = "0v07zlq2h2rjz5mdvh0rgizyzcj68qa235gci6hvlrai7igyi57i";
+      url = "https://github.com/coreos/go-semver";
+      rev = "1817cd4bea52af76542157eeabd74b057d1a199e";
+      sha256 = "0hfxcg87ag0zdfarbymfx2qmhcdzm8br39sxvhfc7n37rqdcsh9n";
     };
   }
   {
-    goPackagePath = "github.com/codegangsta/cli";
+    goPackagePath = "github.com/gogo/protobuf";
     fetch = {
       type = "git";
-      url = "https://github.com/codegangsta/cli";
-      rev = "e5bef42c62aa7d25aba4880dc02b7624f01e9e19";
-      sha256 = "1g0z2klbaivd0w1fwf1k1dkyk8jbq28qd7fvczjv0yj6hg4vz1wq";
+      url = "https://github.com/gogo/protobuf";
+      rev = "dda3e8acadcc9affc16faf33fbb229db78399245";
+      sha256 = "1f1lm6bgwnrd985n1aagqw0bxfx37z71fwfcijiz9k258vj4wlga";
     };
   }
   {
@@ -58,8 +58,26 @@
     fetch = {
       type = "git";
       url = "https://github.com/ipfs/go-ipfs-api";
-      rev = "7c354892da3abdaafb6ac576c100b259b1a73dac";
-      sha256 = "0n8k9ydn2l362vq0bpbjkciw08div3hpc22qygp6zsrlammizcvc";
+      rev = "2da86eb64d56571c123c02ae82140c7b4b95f72a";
+      sha256 = "1ljlzjig0qv2mjzyk2piid12b4043584qskx6ikbz5i16cnbvqsq";
+    };
+  }
+  {
+    goPackagePath = "github.com/ipfs/go-ipfs-util";
+    fetch = {
+      type = "git";
+      url = "https://github.com/ipfs/go-ipfs-util";
+      rev = "f25fcc891281327394bb48000ef0970d11baff2b";
+      sha256 = "1a79ggx0ma9ny39kjm0gzicrn541gyis4fn7kmkkfjjfaj8v5l3y";
+    };
+  }
+  {
+    goPackagePath = "github.com/ipfs/go-log";
+    fetch = {
+      type = "git";
+      url = "https://github.com/ipfs/go-log";
+      rev = "48d644b006ba26f1793bffc46396e981801078e3";
+      sha256 = "0q2bk2s2v626ikm2pjalq4qg4n53yyf1bb81jbljb23iijxrqsbr";
     };
   }
   {
@@ -72,66 +90,120 @@
     };
   }
   {
-    goPackagePath = "github.com/jbenet/go-multiaddr";
+    goPackagePath = "github.com/jbenet/go-os-rename";
     fetch = {
       type = "git";
-      url = "https://github.com/jbenet/go-multiaddr";
-      rev = "f3dff105e44513821be8fbe91c89ef15eff1b4d4";
-      sha256 = "0rz17cvhslspp2z8jbxah22kndqiq9zl8nlf14ng8hfxdfm1x4n7";
+      url = "https://github.com/jbenet/go-os-rename";
+      rev = "3ac97f61ef67a6b87b95c1282f6c317ed0e693c2";
+      sha256 = "0fmsmmh9h3l7swf5d56spy9jyrnrvw0vnxgh11mpvxmw5hv3lclr";
     };
   }
   {
-    goPackagePath = "github.com/jbenet/go-multiaddr-net";
+    goPackagePath = "github.com/jbenet/goprocess";
     fetch = {
       type = "git";
-      url = "https://github.com/jbenet/go-multiaddr-net";
-      rev = "d4cfd691db9f50e430528f682ca603237b0eaae0";
-      sha256 = "031xb8j5nysw052cm36rjn19c5wkjf8dh8x21vrbyb7220h5zp90";
+      url = "https://github.com/jbenet/goprocess";
+      rev = "b497e2f366b8624394fb2e89c10ab607bebdde0b";
+      sha256 = "1lnvkzki7vnqn5c4m6bigk0k85haicmg27w903kwg30rdvblm82s";
     };
   }
   {
-    goPackagePath = "github.com/jbenet/go-multihash";
+    goPackagePath = "github.com/kr/fs";
     fetch = {
       type = "git";
-      url = "https://github.com/jbenet/go-multihash";
-      rev = "e8d2374934f16a971d1e94a864514a21ac74bf7f";
-      sha256 = "1hlzgmjszn8mfvn848jbnpsvccm9g3m42saavgbh48qdryraqscp";
+      url = "https://github.com/kr/fs";
+      rev = "2788f0dbd16903de03cb8186e5c7d97b69ad387b";
+      sha256 = "1c0fipl4rsh0v5liq1ska1dl83v3llab4k6lm8mvrx9c4dyp71ly";
     };
   }
   {
-    goPackagePath = "github.com/jbenet/go-os-rename";
+    goPackagePath = "github.com/libp2p/go-floodsub";
     fetch = {
       type = "git";
-      url = "https://github.com/jbenet/go-os-rename";
-      rev = "3ac97f61ef67a6b87b95c1282f6c317ed0e693c2";
-      sha256 = "0fmsmmh9h3l7swf5d56spy9jyrnrvw0vnxgh11mpvxmw5hv3lclr";
+      url = "https://github.com/libp2p/go-floodsub";
+      rev = "a922092abea58f07c32eabe303ec817569578740";
+      sha256 = "0wbi67jyfvrzfsb9lkrhjgg9k66yk5sww7nvihhc9rdnblygigs3";
     };
   }
   {
-    goPackagePath = "github.com/jbenet/go-random";
+    goPackagePath = "github.com/libp2p/go-libp2p-crypto";
     fetch = {
       type = "git";
-      url = "https://github.com/jbenet/go-random";
-      rev = "384f606e91f542a98e779e652eed88051618f0f7";
-      sha256 = "0gcshzl9n3apzc0jaxqrjsc038yfrzfyhpdqgbpcnajin83l2msa";
+      url = "https://github.com/libp2p/go-libp2p-crypto";
+      rev = "e89e1de117dd65c6129d99d1d853f48bc847cf17";
+      sha256 = "1lb0qzspx99sqbdxbf9dczwcmmirl4h26q9x3v6ris253zmqcbyw";
     };
   }
   {
-    goPackagePath = "github.com/jbenet/go-random-files";
+    goPackagePath = "github.com/libp2p/go-libp2p-host";
     fetch = {
       type = "git";
-      url = "https://github.com/jbenet/go-random-files";
-      rev = "737479700b40b4b50e914e963ce8d9d44603e3c8";
-      sha256 = "1klpdc4qkrfy31r7qh00fcz42blswzabmcnry9byd5adhszxj9bw";
+      url = "https://github.com/libp2p/go-libp2p-host";
+      rev = "c1fc482de113ce7e4cdc9453a1c1c0fe4164d985";
+      sha256 = "1hiz5j64s248vml7i4gwjvz59g7l08zjfklhrbmk0cjxwhx9ypy0";
     };
   }
   {
-    goPackagePath = "github.com/kr/fs";
+    goPackagePath = "github.com/libp2p/go-libp2p-interface-conn";
     fetch = {
       type = "git";
-      url = "https://github.com/kr/fs";
-      rev = "2788f0dbd16903de03cb8186e5c7d97b69ad387b";
-      sha256 = "1c0fipl4rsh0v5liq1ska1dl83v3llab4k6lm8mvrx9c4dyp71ly";
+      url = "https://github.com/libp2p/go-libp2p-interface-conn";
+      rev = "95afdbf0c900237f3b9104f1f7cfd3d56175a241";
+      sha256 = "0dv0jc08hfzb8gsi14c2ivancq7pxs8d482l4rw89mg04m2pgnaa";
+    };
+  }
+  {
+    goPackagePath = "github.com/libp2p/go-libp2p-net";
+    fetch = {
+      type = "git";
+      url = "https://github.com/libp2p/go-libp2p-net";
+      rev = "2680a9894c7aabada540f728a53d7c1a16a1a44a";
+      sha256 = "1k44dz2dk7ahlfls6vk747jy8kbxmjhqyni8zw2wiz6sfm5hyw10";
+    };
+  }
+  {
+    goPackagePath = "github.com/libp2p/go-libp2p-peer";
+    fetch = {
+      type = "git";
+      url = "https://github.com/libp2p/go-libp2p-peer";
+      rev = "166a39e33e7a2a47a4bf999264f254ecaa4fe232";
+      sha256 = "0kgv1n2c8rfz92vk014sqm1bla7a99w18ydyphjjhc96fmlbrzgl";
+    };
+  }
+  {
+    goPackagePath = "github.com/libp2p/go-libp2p-peerstore";
+    fetch = {
+      type = "git";
+      url = "https://github.com/libp2p/go-libp2p-peerstore";
+      rev = "744a149e48eb42e032540507c8545d12cc3b7f6f";
+      sha256 = "1bcmqkdlvvxdz9dbqrcfmvhx0wnnk94fb2yl9ys1nx7mnqgl64y8";
+    };
+  }
+  {
+    goPackagePath = "github.com/libp2p/go-libp2p-protocol";
+    fetch = {
+      type = "git";
+      url = "https://github.com/libp2p/go-libp2p-protocol";
+      rev = "40488c03777c16bfcd65da2f675b192863cbc2dc";
+      sha256 = "1mvhi8pdfyn3lb1j1y4iz2mggnf0dz7ccbmrbij739v6cpjfwwbb";
+    };
+  }
+  {
+    goPackagePath = "github.com/libp2p/go-libp2p-transport";
+    fetch = {
+      type = "git";
+      url = "https://github.com/libp2p/go-libp2p-transport";
+      rev = "5d3cb5861b59c26052a5fe184e45c381ec17e22d";
+      sha256 = "1v63gavw98f6hs151mqk0bbdl46a9ci9m2pcx807wxdsmfphynar";
+    };
+  }
+  {
+    goPackagePath = "github.com/libp2p/go-maddr-filter";
+    fetch = {
+      type = "git";
+      url = "https://github.com/libp2p/go-maddr-filter";
+      rev = "90aacb5ee155f0d6f3fa8b34d775de842606c0b1";
+      sha256 = "0ijs599hppj78dg2v7rcglqs82pysygq84yabpis5b99fjp9bay0";
     };
   }
   {
@@ -139,8 +211,44 @@
     fetch = {
       type = "git";
       url = "https://github.com/mitchellh/go-homedir";
-      rev = "1111e456ffea841564ac0fa5f69c26ef44dafec9";
-      sha256 = "1ycb1cffgs46jnj4cbpjd46mcl584kxdmldlvfysg0wza9pp4x23";
+      rev = "b8bc1bf767474819792c23f32d8286a45736f1c6";
+      sha256 = "13ry4lylalkh4g2vny9cxwvryslzyzwp9r92z0b10idhdq3wad1q";
+    };
+  }
+  {
+    goPackagePath = "github.com/multiformats/go-multiaddr";
+    fetch = {
+      type = "git";
+      url = "https://github.com/multiformats/go-multiaddr";
+      rev = "33741da7b3f5773a599d4a03c333704fc560ef34";
+      sha256 = "0idhv960k68jvh0frhh28dw46p527m2g67rjwjh6r5va5sd8qjcd";
+    };
+  }
+  {
+    goPackagePath = "github.com/multiformats/go-multiaddr-net";
+    fetch = {
+      type = "git";
+      url = "https://github.com/multiformats/go-multiaddr-net";
+      rev = "a7b93d11855f04f56908e1385991eb6a400fcc43";
+      sha256 = "1q0d8asxxhxhm774xn29n1x6zni6pmm78lvm3652ipyj026y243k";
+    };
+  }
+  {
+    goPackagePath = "github.com/multiformats/go-multihash";
+    fetch = {
+      type = "git";
+      url = "https://github.com/multiformats/go-multihash";
+      rev = "a52a6a4768da72eba89ea7f59f70e9d42ddd3072";
+      sha256 = "0r6fmzvg4vjwc5wzfqn7jjxndcw8n0galdx6f524yd9bcfdlph5b";
+    };
+  }
+  {
+    goPackagePath = "github.com/multiformats/go-multistream";
+    fetch = {
+      type = "git";
+      url = "https://github.com/multiformats/go-multistream";
+      rev = "b8f1996688ab586031517919b49b1967fca8d5d9";
+      sha256 = "0y2hl78lmnd0rbryfmscgxa6kmjdfz00pz60ymhg8k4cifqai0x2";
     };
   }
   {
@@ -148,8 +256,26 @@
     fetch = {
       type = "git";
       url = "https://github.com/sabhiram/go-git-ignore";
-      rev = "228fcfa2a06e870a3ef238d54c45ea847f492a37";
-      sha256 = "0xyj2zsxjjbyd3ppxvs294c8y2ip181dxhvycaxxx6qysbm2nlzj";
+      rev = "87c28ffedb6cb7ff29ae89e0440e9ddee0d95a9e";
+      sha256 = "1qysvwjvbzq1wms09dm0sban58xq22bbkwpd7qnk28r99g6267rl";
+    };
+  }
+  {
+    goPackagePath = "github.com/spaolacci/murmur3";
+    fetch = {
+      type = "git";
+      url = "https://github.com/spaolacci/murmur3";
+      rev = "0d12bf811670bf6a1a63828dfbd003eded177fce";
+      sha256 = "0fv74n0cvgnxpfd04xyiry6ii1ag7mhwwk0kwplpvnbwi8y9yq1x";
+    };
+  }
+  {
+    goPackagePath = "github.com/whyrusleeping/go-logging";
+    fetch = {
+      type = "git";
+      url = "https://github.com/whyrusleeping/go-logging";
+      rev = "0457bb6b88fc1973573aaf6b5145d8d3ae972390";
+      sha256 = "1bl180mhg03hdqhyr5sfjcg16ns2ppal625g9ag5m10l2pvlwnqn";
     };
   }
   {
@@ -166,8 +292,26 @@
     fetch = {
       type = "git";
       url = "https://github.com/whyrusleeping/json-filter";
-      rev = "e9937f5649231265a56d0a419f062530425401a1";
-      sha256 = "1b7czlx57acbi30b9m1w2lvlxnh65c4pmxaa0546pjjip83byb3s";
+      rev = "ff25329a9528f01c5175414f16cc0a6a162a5b8b";
+      sha256 = "0cai0drvx4c8j686l908vpcsz3mw3vxi3ziz94b0f3c5ylpj07j7";
+    };
+  }
+  {
+    goPackagePath = "github.com/whyrusleeping/mafmt";
+    fetch = {
+      type = "git";
+      url = "https://github.com/whyrusleeping/mafmt";
+      rev = "15300f9d3a2d71db61951a8705d5ea8878764837";
+      sha256 = "0fiwrj8pla9y8q0m4ifyrh8gacmrz278h2zihdbqbk2b17b002yr";
+    };
+  }
+  {
+    goPackagePath = "github.com/whyrusleeping/progmeter";
+    fetch = {
+      type = "git";
+      url = "https://github.com/whyrusleeping/progmeter";
+      rev = "974d8fe8cd87585865b1370184050e89d606e817";
+      sha256 = "05njc5minpaxzwb6yg5zjr52ar4ar7qkiml45zsrp2ny92dyx07j";
     };
   }
   {
@@ -189,12 +333,30 @@
     };
   }
   {
+    goPackagePath = "github.com/whyrusleeping/timecache";
+    fetch = {
+      type = "git";
+      url = "https://github.com/whyrusleeping/timecache";
+      rev = "cfcb2f1abfee846c430233aef0b630a946e0a5a6";
+      sha256 = "0nnra7ivq7cj34rj2ib8hgfdpik3smr1hy7x18svhfin8z1xsj2s";
+    };
+  }
+  {
     goPackagePath = "golang.org/x/crypto";
     fetch = {
       type = "git";
       url = "https://go.googlesource.com/crypto";
-      rev = "f3241ce8505855877cc8a9717bd61a0f7c4ea83c";
-      sha256 = "0wxfnbhaq1m3i5jylww9llm2xl9hk33q6nxyz5i475rfrg0p3wsq";
+      rev = "a48ac81e47fd6f9ed1258f3b60ae9e75f93cb7ed";
+      sha256 = "0zpgwc362rghm3fv0s964dqmw6krixzxww2qxhnik9hvf7srapjd";
+    };
+  }
+  {
+    goPackagePath = "leb.io/hashland";
+    fetch = {
+      type = "git";
+      url = "https://github.com/tildeleb/hashland";
+      rev = "e13accbe55f7fa03c73c74ace4cca4c425e47260";
+      sha256 = "1ygfp7kjnm964w2bv61bsyxpw5y6vy6k4pra1lhd5r3nhlxgs31g";
     };
   }
 ]
diff --git a/pkgs/tools/package-management/gx/go/default.nix b/pkgs/tools/package-management/gx/go/default.nix
index aa5acfa22d58..6a9589f9ac2a 100644
--- a/pkgs/tools/package-management/gx/go/default.nix
+++ b/pkgs/tools/package-management/gx/go/default.nix
@@ -5,15 +5,15 @@
 
 buildGoPackage rec {
   name = "gx-go-${version}";
-  version = "20160611-${stdenv.lib.strings.substring 0 7 rev}";
-  rev = "639fc0be1a153c59d8946904cceecf0b66ab2944";
+  version = "1.5.0";
+  rev = "refs/tags/v${version}";
 
   goPackagePath = "github.com/whyrusleeping/gx-go";
 
   src = fetchgit {
     inherit rev;
     url = "https://github.com/whyrusleeping/gx-go";
-    sha256 = "0qxp7gqrx1rhcbqvp4jdb3gj1dlj200bdc4gq8pfklc8fcz1lc6l";
+    sha256 = "0bg4h5lzs293qmlsr9n257vjpr5w6bxb4ampb25gsn3fgy3rvsis";
   };
 
   goDeps = ../deps.nix;
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index 3aa18fad9423..a90f38ccc095 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -2,6 +2,7 @@
 , pkgconfig, boehmgc, perlPackages, libsodium, aws-sdk-cpp, brotli, readline
 , autoreconfHook, autoconf-archive, bison, flex, libxml2, libxslt, docbook5, docbook5_xsl
 , libseccomp, busybox
+, hostPlatform
 , storeDir ? "/nix/store"
 , stateDir ? "/nix/var"
 , confDir ? "/etc"
@@ -78,6 +79,9 @@ let
 
     doInstallCheck = true;
 
+    # socket path becomes too long otherwise
+    preInstallCheck = lib.optional stdenv.isDarwin "export TMPDIR=/tmp";
+
     separateDebugInfo = stdenv.isLinux;
 
     crossAttrs = {
@@ -95,8 +99,8 @@ let
           --disable-init-state
           --enable-gc
         '' + stdenv.lib.optionalString (
-            stdenv.cross ? nix && stdenv.cross.nix ? system
-        ) ''--with-system=${stdenv.cross.nix.system}'';
+            hostPlatform ? nix && hostPlatform.nix ? system
+        ) ''--with-system=${hostPlatform.nix.system}'';
 
       doInstallCheck = false;
     };
diff --git a/pkgs/tools/package-management/nixops/default.nix b/pkgs/tools/package-management/nixops/default.nix
index 820bcbb9a35a..1467faac8e3f 100644
--- a/pkgs/tools/package-management/nixops/default.nix
+++ b/pkgs/tools/package-management/nixops/default.nix
@@ -1,9 +1,9 @@
 { callPackage, fetchurl }:
 
 callPackage ./generic.nix (rec {
-  version = "1.5";
+  version = "1.5.1";
   src = fetchurl {
     url = "http://nixos.org/releases/nixops/nixops-${version}/nixops-${version}.tar.bz2";
-    sha256 = "0z4pzc55wjab8v4bkrff94f8qp1g9ydgxxpl2dvy5130bg1s52wd";
+    sha256 = "0pba9c8ya4hvqmg458p74g69hb06lh0f5bsgw7dsi8pjrcb0624g";
   };
 })
diff --git a/pkgs/tools/security/afl/default.nix b/pkgs/tools/security/afl/default.nix
index 1d6307f807c5..92fd6cd1be03 100644
--- a/pkgs/tools/security/afl/default.nix
+++ b/pkgs/tools/security/afl/default.nix
@@ -9,11 +9,11 @@ let
 in
 stdenv.mkDerivation rec {
   name    = "afl-${version}";
-  version = "2.43b";
+  version = "2.44b";
 
   src = fetchurl {
     url    = "http://lcamtuf.coredump.cx/afl/releases/${name}.tgz";
-    sha256 = "1jv2y9b53k3p8hngm78ikakhcf4vv3yyz6ip17jhg5gsis29gdwx";
+    sha256 = "0wvx4ibr5hhav9mld1gncdvfzb4iky85gam3x8a43ispjddyya6m";
   };
 
   # Note: libcgroup isn't needed for building, just for the afl-cgroup
diff --git a/pkgs/tools/security/browserpass/default.nix b/pkgs/tools/security/browserpass/default.nix
index edc46fee5828..9f8a00c5956d 100644
--- a/pkgs/tools/security/browserpass/default.nix
+++ b/pkgs/tools/security/browserpass/default.nix
@@ -1,17 +1,17 @@
 # This file was generated by https://github.com/kamilchm/go2nix v1.2.0
-{ stdenv, buildGoPackage, fetchgit, fetchhg, fetchbzr, fetchsvn }:
+{ stdenv, buildGoPackage, fetchFromGitHub }:
 
 buildGoPackage rec {
   name = "browserpass-${version}";
-  version = "2017-04-11";
-  rev = "e0fe250ed8fd061125746f5d99a1f9a678d21004";
+  version = "1.0.5";
 
   goPackagePath = "github.com/dannyvankooten/browserpass";
 
-  src = fetchgit {
-    inherit rev;
-    url = "https://github.com/dannyvankooten/browserpass";
-    sha256 = "0khwlh5agdd2mm2yzklg8r2h084n8j7jbjjxsiaj67zm8zz6b39c";
+  src = fetchFromGitHub {
+    repo = "browserpass";
+    owner = "dannyvankooten";
+    rev = version;
+    sha256 = "1r9x1asgblay7pry2jpgfisfgb3423x3cqd3g68q8b98zvc9l9lz";
   };
 
   postInstall = ''
@@ -21,14 +21,15 @@ buildGoPackage rec {
       sed -e "s!%%replace%%!$host_file!" go/src/${goPackagePath}/chrome/host.json > chrome-host.json
       sed -e "s!%%replace%%!$host_file!" go/src/${goPackagePath}/firefox/host.json > firefox-host.json
 
-      install -D chrome-host.json $bin/etc/chrome-host.json
+      install chrome-host.json $bin/etc/
       install -D firefox-host.json $bin/lib/mozilla/native-messaging-hosts/com.dannyvankooten.browserpass.json
+      install go/src/${goPackagePath}/chrome/policy.json $bin/etc/chrome-policy.json
   '';
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "A Chrome & Firefox extension for zx2c4's pass";
-    homepage = "https://github.com/dannyvankooten/browserpass";
-    license = stdenv.lib.licenses.mit;
-    platforms = stdenv.lib.platforms.linux ++ stdenv.lib.platforms.darwin;
+    homepage = https://github.com/dannyvankooten/browserpass;
+    license = licenses.mit;
+    platforms = with platforms; linux ++ darwin ++ openbsd;
   };
 }
diff --git a/pkgs/tools/security/certstrap/default.nix b/pkgs/tools/security/certstrap/default.nix
new file mode 100644
index 000000000000..bf659f19e9be
--- /dev/null
+++ b/pkgs/tools/security/certstrap/default.nix
@@ -0,0 +1,23 @@
+{ stdenv, buildGoPackage, fetchFromGitHub }:
+
+buildGoPackage rec {
+  name = "certstrap-${version}";
+  version = "1.0.1";
+
+  goPackagePath = "github.com/square/certstrap";
+
+  src = fetchFromGitHub {
+    owner = "square";
+    repo = "certstrap";
+    rev = "v${version}";
+    sha256 = "0pw1g6nyb212ayic42rkm6i0cf4n2003f02qym6zp130m6aysb47";
+  };
+
+  meta = with stdenv.lib; {
+    inherit (src.meta) homepage;
+    description = "Tools to bootstrap CAs, certificate requests, and signed certificates";
+    platforms = platforms.all;
+    license = licenses.asl20;
+    maintainers = with maintainers; [ volth ];
+  };
+}
diff --git a/pkgs/tools/security/gen-oath-safe/default.nix b/pkgs/tools/security/gen-oath-safe/default.nix
new file mode 100644
index 000000000000..49770813b2b6
--- /dev/null
+++ b/pkgs/tools/security/gen-oath-safe/default.nix
@@ -0,0 +1,41 @@
+{ coreutils, fetchFromGitHub, libcaca, makeWrapper, python, openssl, qrencode, stdenv, yubikey-manager }:
+
+stdenv.mkDerivation {
+  name = "gen-oath-safe-2017-01-23";
+  src = fetchFromGitHub {
+    owner = "mcepl";
+    repo = "gen-oath-safe";
+    rev = "fb53841";
+    sha256 = "0018kqmhg0861r5xkbis2a1rx49gyn0dxcyj05wap5ms7zz69m0m";
+  };
+
+  buildInputs = [ makeWrapper ];
+
+  buildPhase = ":";
+
+  installPhase =
+    let
+      path = stdenv.lib.makeBinPath [
+        coreutils
+        libcaca.bin
+        openssl.bin
+        python
+        qrencode
+        yubikey-manager
+      ];
+    in
+    ''
+      mkdir -p $out/bin
+      cp gen-oath-safe $out/bin/
+      wrapProgram $out/bin/gen-oath-safe \
+        --prefix PATH : ${path}
+    '';
+  meta = with stdenv.lib; {
+    homepage = https://github.com/mcepl/gen-oath-safe;
+    description = "Script for generating HOTP/TOTP keys (and QR code)";
+    platforms =  platforms.unix;
+    license = licenses.mit;
+    maintainers = [ maintainers.makefu ];
+  };
+
+}
diff --git a/pkgs/tools/security/hologram/default.nix b/pkgs/tools/security/hologram/default.nix
index abdcd5d2d3eb..911c1b12562a 100644
--- a/pkgs/tools/security/hologram/default.nix
+++ b/pkgs/tools/security/hologram/default.nix
@@ -15,6 +15,10 @@ buildGoPackage rec {
 
   goDeps = ./deps.nix;
 
+  preConfigure = ''
+    sed -i 's|cacheTimeout != 3600|cacheTimeout != 0|' cmd/hologram-server/main.go
+  '';
+
   meta = with stdenv.lib; {
     homepage = https://github.com/AdRoll/hologram/;
     description = "Easy, painless AWS credentials on developer laptops.";
diff --git a/pkgs/tools/security/jd-gui/default.nix b/pkgs/tools/security/jd-gui/default.nix
index 106fbf0a150a..32bc1a4d7119 100644
--- a/pkgs/tools/security/jd-gui/default.nix
+++ b/pkgs/tools/security/jd-gui/default.nix
@@ -1,8 +1,22 @@
-{ stdenv, fetchurl, gtk2, atk, gdk_pixbuf, pango, makeWrapper }:
+{ stdenv, fetchurl, gtk2, atk, gdk_pixbuf, glib, pango, fontconfig, zlib, xorg, upx, patchelf }:
 
 let
   dynlibPath = stdenv.lib.makeLibraryPath
-    [ gtk2 atk gdk_pixbuf pango ];
+    ([ gtk2 atk gdk_pixbuf glib pango fontconfig zlib stdenv.cc.cc.lib ]
+    ++ (with xorg; [
+      libX11
+      libXext
+      libXrender
+      libXrandr
+      libSM
+      libXfixes
+      libXdamage
+      libXcursor
+      libXinerama
+      libXi
+      libXcomposite
+      libXxf86vm
+    ]));
 in
 stdenv.mkDerivation rec {
   name    = "jd-gui-${version}";
@@ -13,14 +27,18 @@ stdenv.mkDerivation rec {
     sha256 = "0jrvzs2s836yvqi41c7fq0gfiwf187qg765b9r1il2bjc0mb3dqv";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ upx patchelf ];
 
   phases = "unpackPhase installPhase";
   unpackPhase = "tar xf ${src}";
   installPhase = ''
-    mkdir -p $out/bin && mv jd-gui $out/bin
-    wrapProgram $out/bin/jd-gui \
-      --prefix LD_LIBRARY_PATH ":" "${dynlibPath}"
+    mkdir -p $out/bin
+    upx -d jd-gui -o $out/bin/jd-gui
+
+    patchelf \
+      --set-interpreter $(cat ${stdenv.cc}/nix-support/dynamic-linker) \
+      --set-rpath ${dynlibPath} \
+      $out/bin/jd-gui
   '';
 
   meta = {
diff --git a/pkgs/tools/security/opendht/default.nix b/pkgs/tools/security/opendht/default.nix
new file mode 100644
index 000000000000..75d2b090e711
--- /dev/null
+++ b/pkgs/tools/security/opendht/default.nix
@@ -0,0 +1,48 @@
+{ stdenv
+, fetchFromGitHub
+, autoconf
+, automake
+, libtool
+, pkgconfig
+, nettle
+, gnutls
+, libmsgpack
+, readline
+, libargon2
+}:
+
+stdenv.mkDerivation rec {
+  name = "opendht-${version}";
+  version = "1.3.4";
+
+  src = fetchFromGitHub {
+    owner = "savoirfairelinux";
+    repo = "opendht";
+    rev = "${version}";
+    sha256 = "0karj37f0zq39w0ip8ahrjr6lcrrn9jd6bpzylp1m92jzs8pfki8";
+  };
+
+  buildInputs = [
+    autoconf
+    automake
+    libtool
+    pkgconfig
+    nettle
+    gnutls
+    libmsgpack
+    readline
+    libargon2
+  ];
+
+  preConfigure = ''
+    ./autogen.sh
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A C++11 Kademlia distributed hash table implementation";
+    homepage = https://github.com/savoirfairelinux/opendht;
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ taeer olynch ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/tools/security/pinentry/default.nix b/pkgs/tools/security/pinentry/default.nix
index 97e66a250d7c..25edec9efd4d 100644
--- a/pkgs/tools/security/pinentry/default.nix
+++ b/pkgs/tools/security/pinentry/default.nix
@@ -10,11 +10,11 @@ let
 in
 with stdenv.lib;
 stdenv.mkDerivation rec {
-  name = "pinentry-0.9.7";
+  name = "pinentry-1.0.0";
 
   src = fetchurl {
     url = "mirror://gnupg/pinentry/${name}.tar.bz2";
-    sha256 = "1cp7wjqr6nx31mdclr61s2h84ijqjl0ph99kgj4vyawpjj1j1633";
+    sha256 = "0ni7g4plq6x78p32al7m8h2zsakvg1rhfz0qbc3kdc7yq7nw4whn";
   };
 
   buildInputs = [ libgpgerror libassuan libcap gtk2 ncurses qt4 ];
diff --git a/pkgs/tools/security/sshuttle/default.nix b/pkgs/tools/security/sshuttle/default.nix
index daa02497d0f6..2d663175ec9d 100644
--- a/pkgs/tools/security/sshuttle/default.nix
+++ b/pkgs/tools/security/sshuttle/default.nix
@@ -1,23 +1,28 @@
-{ stdenv, pythonPackages, fetchurl, makeWrapper, pandoc
+{ stdenv, python3Packages, fetchurl, makeWrapper, pandoc
 , coreutils, iptables, nettools, openssh, procps }:
   
-pythonPackages.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   name = "sshuttle-${version}";
-  version = "0.78.0";
+  version = "0.78.3";
 
   src = fetchurl {
-    sha256 = "18hrwi2gyri1n2rq0nghvv7hfhbhh5h67am89524vc1yyx40vn3b";
+    sha256 = "12xyq5h77b57cnkljdk8qyjxzys512b73019s20x6ck5brj1m8wa";
     url = "mirror://pypi/s/sshuttle/${name}.tar.gz";
   };
 
   patches = [ ./sudo.patch ];
 
-  propagatedBuildInputs = with pythonPackages; [ PyXAPI mock pytest ];
-  nativeBuildInputs = [ makeWrapper pandoc pythonPackages.setuptools_scm ];
+  nativeBuildInputs = [ makeWrapper pandoc python3Packages.setuptools_scm ];
   buildInputs =
     [ coreutils openssh ] ++
     stdenv.lib.optionals stdenv.isLinux [ iptables nettools procps ];
 
+  checkInputs = with python3Packages; [ mock pytest pytestrunner ];
+
+  # Tests only run with Python 3. Server-side Python 2 still works if client
+  # uses Python 3, so it should be fine.
+  doCheck = true;
+
   postInstall = let
     mapPath = f: x: stdenv.lib.concatStringsSep ":" (map f x);
   in ''
diff --git a/pkgs/tools/security/tor/default.nix b/pkgs/tools/security/tor/default.nix
index 05dbe6b7d84f..2555aeccea4c 100644
--- a/pkgs/tools/security/tor/default.nix
+++ b/pkgs/tools/security/tor/default.nix
@@ -3,11 +3,11 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "tor-0.3.0.8";
+  name = "tor-0.3.0.9";
 
   src = fetchurl {
     url = "https://dist.torproject.org/${name}.tar.gz";
-    sha256 = "0j0dhq1zp6w6zy7y4kiw7zg1imbgv8nsl7imlzwc0951p2kknfk6";
+    sha256 = "0hhyb1wil8japynqnm07r1f67w3wdnafdg9amzlrrcfcyq5qim28";
   };
 
   outputs = [ "out" "geoip" ];
diff --git a/pkgs/tools/security/vulnix/requirements.nix b/pkgs/tools/security/vulnix/requirements.nix
index c1cbf9c4d3b0..280fc2279b47 100644
--- a/pkgs/tools/security/vulnix/requirements.nix
+++ b/pkgs/tools/security/vulnix/requirements.nix
@@ -26,7 +26,7 @@ rec {
       url = "https://pypi.python.org/packages/52/b3/a96d62711a26d8cfbe546519975dc9ed54d2eb50b3238d2e6de045764796/ZConfig-3.1.0.tar.gz";
       sha256 = "c21fa3a073a56925a8098036d46717392994a92cffea1b3cda3176b70c0a842e";
     };
-    propagatedBuildInputs = [ pythonPackages.zope_testrunner ];
+    propagatedBuildInputs = with pythonPackages; [ zope_testrunner ];
     meta = with stdenv.lib; {
       homepage = "";
       license = licenses.zpt21;
diff --git a/pkgs/tools/system/awstats/default.nix b/pkgs/tools/system/awstats/default.nix
index ecf31d6c9d6e..1b3b694bf787 100644
--- a/pkgs/tools/system/awstats/default.nix
+++ b/pkgs/tools/system/awstats/default.nix
@@ -44,9 +44,9 @@ perlPackages.buildPerlPackage rec {
     mkdir -p "$bin/bin"
     ln -s "$out/wwwroot/cgi-bin/awstats.pl" "$bin/bin/awstats"
 
-    mkdir -p "$doc/share/"
+    mkdir -p "$doc/share/doc"
     mv README.md docs/
-    mv docs "$doc/share/awstats"
+    mv docs "$doc/share/doc/awstats"
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/system/collectd/default.nix b/pkgs/tools/system/collectd/default.nix
index 4aa5aee4c272..824eb74b72e5 100644
--- a/pkgs/tools/system/collectd/default.nix
+++ b/pkgs/tools/system/collectd/default.nix
@@ -52,9 +52,21 @@ stdenv.mkDerivation rec {
 
   # for some reason libsigrok isn't auto-detected
   configureFlags =
+    [ "--localstatedir=/var" ] ++
     stdenv.lib.optional (libsigrok != null) "--with-libsigrok" ++
     stdenv.lib.optional (python != null) "--with-python=${python}/bin/python";
 
+  # do not create directories in /var during installPhase
+  postConfigure = ''
+     substituteInPlace Makefile --replace '$(mkinstalldirs) $(DESTDIR)$(localstatedir)/' '#'
+  '';
+
+  postInstall = ''
+    if [ -d $out/share/collectd/java ]; then
+      mv $out/share/collectd/java $out/share/
+    fi
+  '';
+
   meta = with stdenv.lib; {
     description = "Daemon which collects system performance statistics periodically";
     homepage = https://collectd.org;
diff --git a/pkgs/tools/system/ddrescue/default.nix b/pkgs/tools/system/ddrescue/default.nix
index 0b94f328b84a..5f439ccdb530 100644
--- a/pkgs/tools/system/ddrescue/default.nix
+++ b/pkgs/tools/system/ddrescue/default.nix
@@ -17,11 +17,6 @@ stdenv.mkDerivation rec {
 
   doCheck = hostPlatform == buildPlatform;
 
-  ${if hostPlatform != buildPlatform then "crossPlatforms" else null} = [ ];
-  ${if hostPlatform != buildPlatform then "configureFlags" else null} = [
-    "CXX=${stdenv.cc.prefix}c++"
-  ];
-
   meta = with stdenv.lib; {
     description = "GNU ddrescue, a data recovery tool";
 
diff --git a/pkgs/tools/system/mcron/default.nix b/pkgs/tools/system/mcron/default.nix
index a90d6afdc61f..5863504c7040 100644
--- a/pkgs/tools/system/mcron/default.nix
+++ b/pkgs/tools/system/mcron/default.nix
@@ -10,6 +10,11 @@ stdenv.mkDerivation rec {
 
   patches = [ ./install-vixie-programs.patch ];
 
+  # don't attempt to chmod +s files in the nix store
+  postPatch = ''
+    substituteInPlace makefile.in --replace "rwxs" "rwx"
+  '';
+
   buildInputs = [ guile which ed ];
 
   doCheck = true;
diff --git a/pkgs/tools/system/runit/default.nix b/pkgs/tools/system/runit/default.nix
index 03da7bc657f6..61c61226acd6 100644
--- a/pkgs/tools/system/runit/default.nix
+++ b/pkgs/tools/system/runit/default.nix
@@ -23,6 +23,9 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     sed -i "s,\(#define RUNIT\) .*,\1 \"$out/bin/runit\"," src/runit.h
+    # usernamespace sandbox of nix seems to conflict with runit's assumptions
+    # about unix users. Therefor skip the check
+    sed -i '/.\/chkshsgr/d' src/Makefile
   '' + stdenv.lib.optionalString (!static) ''
     sed -i 's,-static,,g' src/Makefile
   '';
diff --git a/pkgs/tools/system/socklog/default.nix b/pkgs/tools/system/socklog/default.nix
index 0b893bfe0dc3..0b95dcdb193d 100644
--- a/pkgs/tools/system/socklog/default.nix
+++ b/pkgs/tools/system/socklog/default.nix
@@ -37,8 +37,8 @@ stdenv.mkDerivation rec {
       mv man"/"*.$i $man/share/man/man$i
     done
 
-    mkdir -p $doc/share/socklog/html
-    mv doc"/"*.html $doc/share/socklog/html/
+    mkdir -p $doc/share/doc/socklog/html
+    mv doc/*.html $doc/share/doc/socklog/html/
 
     runHook postInstall
   '';
diff --git a/pkgs/tools/system/suid-chroot/default.nix b/pkgs/tools/system/suid-chroot/default.nix
index 1278480973f9..ebedf5f544e6 100644
--- a/pkgs/tools/system/suid-chroot/default.nix
+++ b/pkgs/tools/system/suid-chroot/default.nix
@@ -11,6 +11,7 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     substituteInPlace Makefile --replace /usr $out
+    sed -i -e '/chmod u+s/d' Makefile
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/system/tm/default.nix b/pkgs/tools/system/tm/default.nix
index 3326f535b5f6..3442dbb62b05 100644
--- a/pkgs/tools/system/tm/default.nix
+++ b/pkgs/tools/system/tm/default.nix
@@ -10,10 +10,6 @@ stdenv.mkDerivation {
     sed -i 's@/usr/bin/install@install@g ; s/gcc/cc/g' Makefile
   '';
 
-  crossAttrs = {
-    makeFlags = "CC=${stdenv.cross.config}-gcc";
-  };
-
   src = fetchurl {
     url = http://vicerveza.homeunix.net/~viric/soft/tm/tm-0.4.1.tar.gz;
     sha256 = "3b389bc03b6964ad5ffa57a344b891fdbcf7c9b2604adda723a863f83657c4a0";
diff --git a/pkgs/tools/system/ts/default.nix b/pkgs/tools/system/ts/default.nix
index 97b35378673e..cce18b5d54b4 100644
--- a/pkgs/tools/system/ts/default.nix
+++ b/pkgs/tools/system/ts/default.nix
@@ -1,5 +1,6 @@
-{stdenv, fetchurl,
-sendmailPath ? "/run/wrappers/bin/sendmail" }:
+{ stdenv, fetchurl
+, sendmailPath ? "/run/wrappers/bin/sendmail"
+}:
 
 stdenv.mkDerivation rec {
 
@@ -7,10 +8,6 @@ stdenv.mkDerivation rec {
 
   installPhase=''make install "PREFIX=$out"'';
 
-  crossAttrs = {
-    makeFlags = "CC=${stdenv.cross.config}-gcc";
-  };
-
   patchPhase = ''
     sed -i s,/usr/sbin/sendmail,${sendmailPath}, mail.c ts.1
   '';
diff --git a/pkgs/tools/text/gnupatch/default.nix b/pkgs/tools/text/gnupatch/default.nix
index 57543eb303b0..13579b57e796 100644
--- a/pkgs/tools/text/gnupatch/default.nix
+++ b/pkgs/tools/text/gnupatch/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = stdenv.lib.optional doCheck ed;
 
-  configureFlags = if hostPlatform == buildPlatform then null else [
+  configureFlags = stdenv.lib.optionals (hostPlatform != buildPlatform) [
     "ac_cv_func_strnlen_working=yes"
   ];
 
diff --git a/pkgs/tools/text/groff/default.nix b/pkgs/tools/text/groff/default.nix
index aa9ece8955b4..fc6b1abf24dd 100644
--- a/pkgs/tools/text/groff/default.nix
+++ b/pkgs/tools/text/groff/default.nix
@@ -57,8 +57,11 @@ stdenv.mkDerivation rec {
   # Remove example output with (random?) colors and creation date
   # to avoid non-determinism in the output.
   postInstall = ''
-    rm $doc/share/doc/groff/examples/hdtbl/*color*ps
-    find $doc/share/doc/groff/ -type f -print0 | xargs -0 sed -i -e 's/%%CreationDate: .*//'
+    rm "$doc"/share/doc/groff/examples/hdtbl/*color*ps
+    find "$doc"/share/doc/groff/ -type f -print0 | xargs -0 sed -i -e 's/%%CreationDate: .*//'
+    for f in 'man.local' 'mdoc.local'; do
+        cat '${./site.tmac}' >>"$out/share/groff/site-tmac/$f"
+    done
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/text/groff/site.tmac b/pkgs/tools/text/groff/site.tmac
new file mode 100644
index 000000000000..8ef1040ca4a0
--- /dev/null
+++ b/pkgs/tools/text/groff/site.tmac
@@ -0,0 +1,16 @@
+.
+.if n \{\
+.  \" Character translations for non-keyboard
+.  \" characters - to make them searchable
+.  if '\*[.T]'utf8' \{\
+.    char \- \N'45'
+.    char - \N'45'
+.    char ' \N'39'
+.    char \' \N'39'
+.  \}
+.
+.  \" Shut off SGR by default (groff colors)
+.  \" Require GROFF_SGR envvar defined to turn it on
+.  if '\V[GROFF_SGR]'' \
+.    output x X tty: sgr 0
+.\}
diff --git a/pkgs/tools/text/html-tidy/default.nix b/pkgs/tools/text/html-tidy/default.nix
index 1a264885b485..cc3283cf8541 100644
--- a/pkgs/tools/text/html-tidy/default.nix
+++ b/pkgs/tools/text/html-tidy/default.nix
@@ -1,4 +1,6 @@
-{ stdenv, fetchFromGitHub, cmake, libxslt }:
+{ stdenv, fetchFromGitHub, cmake, libxslt
+, hostPlatform
+}:
 
 stdenv.mkDerivation rec {
   name = "html-tidy-${version}";
@@ -14,7 +16,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake libxslt/*manpage*/ ];
 
   cmakeFlags = stdenv.lib.optional
-    (stdenv.cross.libc or null == "msvcrt") "-DCMAKE_SYSTEM_NAME=Windows";
+    (hostPlatform.libc or null == "msvcrt") "-DCMAKE_SYSTEM_NAME=Windows";
 
   # ATM bin/tidy is statically linked, as upstream provides no other option yet.
   # https://github.com/htacg/tidy-html5/issues/326#issuecomment-160322107
diff --git a/pkgs/tools/text/kdiff3/default.nix b/pkgs/tools/text/kdiff3/default.nix
index e1a2f157085f..38362333cadd 100644
--- a/pkgs/tools/text/kdiff3/default.nix
+++ b/pkgs/tools/text/kdiff3/default.nix
@@ -1,7 +1,7 @@
 {
   mkDerivation, lib, fetchgit, fetchpatch,
   extra-cmake-modules, kdoctools, wrapGAppsHook,
-  kconfig, kinit, kparts
+  kcrash, kconfig, kinit, kparts
 }:
 
 mkDerivation rec {
@@ -32,7 +32,7 @@ mkDerivation rec {
 
   nativeBuildInputs = [ extra-cmake-modules kdoctools wrapGAppsHook ];
 
-  propagatedBuildInputs = [ kconfig kinit kparts ];
+  propagatedBuildInputs = [ kconfig kcrash kinit kparts ];
 
   meta = with lib; {
     homepage = http://kdiff3.sourceforge.net/;
diff --git a/pkgs/tools/text/replace/default.nix b/pkgs/tools/text/replace/default.nix
index 40728c2c3ec5..18ef074c8a52 100644
--- a/pkgs/tools/text/replace/default.nix
+++ b/pkgs/tools/text/replace/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchurl}:
+{ stdenv, fetchurl }:
 
 stdenv.mkDerivation {
   name = "replace-2.24";
@@ -10,10 +10,6 @@ stdenv.mkDerivation {
 
   makeFlags = "TREE=\$(out) MANTREE=\$(TREE)/share/man";
 
-  crossAttrs = {
-    makeFlags = "TREE=\$(out) MANTREE=\$(TREE)/share/man CC=${stdenv.cross.config}-gcc";
-  };
-
   preBuild = ''
     sed -e "s@/bin/mv@$(type -P mv)@" -i replace.h
   '';
diff --git a/pkgs/tools/text/xsv/default.nix b/pkgs/tools/text/xsv/default.nix
index 9e15649133f6..12061b75a9de 100644
--- a/pkgs/tools/text/xsv/default.nix
+++ b/pkgs/tools/text/xsv/default.nix
@@ -4,16 +4,16 @@ with rustPlatform;
 
 buildRustPackage rec {
   name = "xsv-${version}";
-  version = "0.11.0";
+  version = "0.12.1";
 
   src = fetchFromGitHub {
     owner = "BurntSushi";
     repo = "xsv";
     rev = "${version}";
-    sha256 = "169rp4izcjhhlrqrhvlvsbiz7wqfi6g3kjfgrddgvahp0ls29hls";
+    sha256 = "0xmjx5grwjrx2zsqmpblid9pqpwkk9pv468ffqlza3w35n9x5dax";
   };
 
-  depsSha256 = "006sp66l2gybyk1n7lxp645k6drz5cgxcix376k8qr0v9jwadlqa";
+  depsSha256 = "0gdbxgykhy6wm89mbdvl7ck2v0f66hwlm0m1q7r64bkb7i10fmkd";
 
   meta = with stdenv.lib; {
     description = "A fast CSV toolkit written in Rust";
diff --git a/pkgs/tools/typesetting/tex/texlive/bin.nix b/pkgs/tools/typesetting/tex/texlive/bin.nix
index 5591f64cee94..34520e92a9ae 100644
--- a/pkgs/tools/typesetting/tex/texlive/bin.nix
+++ b/pkgs/tools/typesetting/tex/texlive/bin.nix
@@ -20,7 +20,9 @@ let
   common = rec {
     src = fetchurl {
       url = # "ftp://tug.org/historic/systems/texlive/${year}/"
-        "http://lipa.ms.mff.cuni.cz/~cunav5am/nix/texlive-2016" # FIXME: a proper mirror
+      #"http://lipa.ms.mff.cuni.cz/~cunav5am/nix/texlive-2016"
+      # FIXME: a proper mirror, though tarballs.nixos.org saves this case ATM
+        http://146.185.144.154/texlive-2016
         + "/texlive-${year}0523b-source.tar.xz";
       sha256 = "1v91vahxlxkdra0qz3f132vvx5d9cx2jy84yl1hkch0agyj2rcx8";
     };
diff --git a/pkgs/tools/typesetting/tex/texlive/combine.nix b/pkgs/tools/typesetting/tex/texlive/combine.nix
index c783316c6d55..9af1d6a59ffd 100644
--- a/pkgs/tools/typesetting/tex/texlive/combine.nix
+++ b/pkgs/tools/typesetting/tex/texlive/combine.nix
@@ -155,18 +155,24 @@ in buildEnv {
         --prefix PERL5LIB : "$out/share/texmf/scripts/texlive"
 
       # avoid using non-nix shebang in $target by calling interpreter
-      if [[ "$(head -c 2 $target)" = "#!" ]]; then
-        local cmdline="$(head -n 1 $target | sed 's/^\#\! *//;s/ *$//')"
+      if [[ "$(head -c 2 "$target")" = "#!" ]]; then
+        local cmdline="$(head -n 1 "$target" | sed 's/^\#\! *//;s/ *$//')"
         local relative=`basename "$cmdline" | sed 's/^env //' `
         local newInterp=`echo "$relative" | cut -d\  -f1`
         local params=`echo "$relative" | cut -d\  -f2- -s`
-        local newPath="$(type -P $newInterp)"
+        local newPath="$(type -P "$newInterp")"
         if [[ -z "$newPath" ]]; then
           echo " Warning: unknown shebang '$cmdline' in '$target'"
           continue
         fi
         echo " and patching shebang '$cmdline'"
         sed "s|^exec |exec $newPath $params |" -i "$link"
+
+      elif head -n 1 "$target" | grep -q 'exec perl'; then
+        # see #24343 for details of the problem
+        echo " and patching weird perl shebang"
+        sed "s|^exec |exec '${perl}/bin/perl' -w |" -i "$link"
+
       else
         sed 's|^exec |exec -a "$0" |' -i "$link"
         echo
diff --git a/pkgs/tools/typesetting/tex/texlive/default.nix b/pkgs/tools/typesetting/tex/texlive/default.nix
index 701ce7f67b2d..13eb90c77af3 100644
--- a/pkgs/tools/typesetting/tex/texlive/default.nix
+++ b/pkgs/tools/typesetting/tex/texlive/default.nix
@@ -4,7 +4,7 @@
 */
 { stdenv, lib, fetchurl, runCommand, writeText, buildEnv
 , callPackage, ghostscriptX, harfbuzz, poppler_min
-, makeWrapper, perl, python, ruby
+, makeWrapper, perl522, python, ruby
 , useFixedHashes ? true
 , recurseIntoAttrs
 }:
@@ -28,7 +28,8 @@ let
   # function for creating a working environment from a set of TL packages
   combine = import ./combine.nix {
     inherit bin combinePkgs buildEnv fastUnique lib makeWrapper writeText
-      perl stdenv python ruby;
+      stdenv python ruby;
+    perl = perl522; # avoid issues like #26890, probably remove after texlive upgrade
   };
 
   # the set of TeX Live packages, collections, and schemes; using upstream naming
@@ -109,7 +110,9 @@ let
 
       url = args.url or "${urlPrefix}/${urlName}.tar.xz";
       urlPrefix = args.urlPrefix or
-        http://lipa.ms.mff.cuni.cz/~cunav5am/nix/texlive-2016;
+        http://146.185.144.154/texlive-2016
+        #http://lipa.ms.mff.cuni.cz/~cunav5am/nix/texlive-2016
+        ;
       # XXX XXX XXX FIXME: mirror the snapshot XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX
       #  ("${mirror}/pub/tex/historic/systems/texlive/${bin.texliveYear}/tlnet-final/archive");
       #mirror = "http://ftp.math.utah.edu";