Merge branch 'master' into closure-size

TODO: there was more significant refactoring of qtbase and plasma 5.5
on master, and I'm deferring pointing to correct outputs to later.

82 files changed, 982 insertions, 316 deletions

diff --git a/pkgs/tools/X11/xprintidle-ng/default.nix b/pkgs/tools/X11/xprintidle-ng/default.nix
new file mode 100644
index 0000000000000..7ddab964436bd
--- /dev/null
+++ b/pkgs/tools/X11/xprintidle-ng/default.nix
@@ -0,0 +1,36 @@
+{ stdenv, fetchFromGitHub, libX11, libXScrnSaver, libXext, gnulib
+  , autoconf, automake, libtool, gettext, pkgconfig
+  , git, perl, texinfo, help2man
+}:
+stdenv.mkDerivation rec {
+  version = "git-2015-09-01";
+  name = "${baseName}-${version}";
+  baseName = "xprintidle-ng";
+
+  buildInputs = [
+    libX11 libXScrnSaver libXext gnulib
+    autoconf automake libtool gettext pkgconfig  git perl 
+    texinfo help2man
+    ];
+  src = fetchFromGitHub {
+    owner = "taktoa";
+    repo = "${baseName}";
+    rev = "9083ba284d9222541ce7da8dc87d5a27ef5cc592";
+    sha256 = "0a5024vimpfrpj6w60j1ad8qvjkrmxiy8w1yijxfwk917ag9rkpq";
+  };
+
+  configurePhase = ''
+    cp -r "${gnulib}" gnulib
+    chmod a+rX,u+w -R gnulib
+    ./bootstrap --gnulib-srcdir=gnulib
+    ./configure --prefix="$out"
+  '';
+
+  meta = {
+    inherit  version;
+    description = ''A command-line tool to print idle time from libXss'';
+    license = stdenv.lib.licenses.gpl2 ;
+    maintainers = [stdenv.lib.maintainers.raskin];
+    platforms = stdenv.lib.platforms.linux;
+  };
+}
diff --git a/pkgs/tools/admin/simp_le/default.nix b/pkgs/tools/admin/simp_le/default.nix
index 5f945309aac0e..43e361ba6471b 100644
--- a/pkgs/tools/admin/simp_le/default.nix
+++ b/pkgs/tools/admin/simp_le/default.nix
@@ -1,16 +1,16 @@
 { stdenv, fetchFromGitHub, pythonPackages }:
 
 pythonPackages.buildPythonPackage rec {
-  name = "simp_le-20151205";
+  name = "simp_le-20151207";
 
   src = fetchFromGitHub {
     owner = "kuba";
     repo = "simp_le";
-    rev = "976a33830759e66610970f92f6ec1a656a2c8335";
-    sha256 = "0bfa5081rmjjg9sii6pn2dskd1wh0dgrf9ic9hpisawrk0y0739i";
+    rev = "ac836bc0af988cb14dc0a83dc2039e7fa541b677";
+    sha256 = "0r07mlis81n0pmj74wjcvjpi6i3lkzs6hz8iighhk8yymn1a8rbn";
   };
 
-  propagatedBuildInputs = with pythonPackages; [ acme cryptography pytz requests2 ];
+  propagatedBuildInputs = with pythonPackages; [ acme ];
 
   meta = with stdenv.lib; {
     homepage = https://github.com/kuba/simp_le;
diff --git a/pkgs/tools/archivers/runzip/default.nix b/pkgs/tools/archivers/runzip/default.nix
new file mode 100644
index 0000000000000..9b2fd0eda5942
--- /dev/null
+++ b/pkgs/tools/archivers/runzip/default.nix
@@ -0,0 +1,23 @@
+{stdenv, fetchFromGitHub, libzip, autoconf, automake, libtool, m4}:
+stdenv.mkDerivation rec {
+  baseName = "runzip";
+  version = "1.4";
+  name = "${baseName}-${version}";
+  buildInputs = [libzip autoconf automake libtool m4];
+  src = fetchFromGitHub {
+    owner = "vlm";
+    repo = "zip-fix-filename-encoding";
+    rev = "v${version}";
+    sha256 = "0l5zbb5hswxczigvyal877j0aiq3fc01j3gv88bvy7ikyvw3lc07";
+  };
+  preConfigure = ''
+    autoreconf -iv
+  '';
+  meta = {
+    inherit version;
+    description = ''A tool to convert filename encoding inside a ZIP archive'';
+    license = stdenv.lib.licenses.bsd2 ;
+    maintainers = [stdenv.lib.maintainers.raskin];
+    platforms = stdenv.lib.platforms.linux;
+  };
+}
diff --git a/pkgs/tools/archivers/zip/default.nix b/pkgs/tools/archivers/zip/default.nix
index e4da0236cdfe9..585bc72ad967e 100644
--- a/pkgs/tools/archivers/zip/default.nix
+++ b/pkgs/tools/archivers/zip/default.nix
@@ -13,11 +13,9 @@ stdenv.mkDerivation {
     sha256 = "0sb3h3067pzf3a7mlxn1hikpcjrsvycjcnj9hl9b1c3ykcgvps7h";
   };
 
-  # should be makeFlags on all archs, not changed yet to prevent rebuild
-  buildFlags="-f unix/Makefile generic";
-  makeFlags = if stdenv.isCygwin then "-f unix/Makefile ${if stdenv.isCygwin then "cygwin" else "generic"}" else null;
-
-  installFlags="-f unix/Makefile prefix=$(out) INSTALL=cp";
+  makefile = "unix/Makefile";
+  buildFlags = if stdenv.isCygwin then "cygwin" else "generic";
+  installFlags = "prefix=$(out) INSTALL=cp";
 
   patches = if (enableNLS && !stdenv.isCygwin) then [ ./natspec-gentoo.patch.bz2 ] else [];
 
diff --git a/pkgs/tools/audio/beets/alternatives-plugin.nix b/pkgs/tools/audio/beets/alternatives-plugin.nix
new file mode 100644
index 0000000000000..1b0c9b3992b97
--- /dev/null
+++ b/pkgs/tools/audio/beets/alternatives-plugin.nix
@@ -0,0 +1,25 @@
+{ stdenv, buildPythonPackage, fetchFromGitHub, pythonPackages }:
+
+buildPythonPackage rec {
+  name = "beets-alternatives-${version}";
+  version = "0.8.2";
+
+  src = fetchFromGitHub {
+    repo = "beets-alternatives";
+    owner = "geigerzaehler";
+    rev = "v${version}";
+    sha256 = "10za6h59pxa13y8i4amqhc6392csml0dl771lssv6b6a98kamsy7";
+  };
+
+  postPatch = ''
+    sed -i -e '/install_requires/,/\]/{/beets/d}' setup.py
+  '';
+
+  propagatedBuildInputs = with pythonPackages; [ futures ];
+
+  meta = {
+    description = "Beets plugin to manage external files";
+    homepage = "https://github.com/geigerzaehler/beets-alternatives";
+    license = stdenv.lib.licenses.mit;
+  };
+}
diff --git a/pkgs/tools/audio/beets/default.nix b/pkgs/tools/audio/beets/default.nix
index 123b183f2d30b..35a69262acdef 100644
--- a/pkgs/tools/audio/beets/default.nix
+++ b/pkgs/tools/audio/beets/default.nix
@@ -8,10 +8,13 @@
 , enableFetchart   ? true
 , enableLastfm     ? true
 , enableMpd        ? true
-, enableReplaygain ? true
+, enableReplaygain ? true, bs1770gain ? null
 , enableThumbnails ? true
 , enableWeb        ? true
 
+# External plugins
+, enableAlternatives ? false
+
 , bashInteractive, bashCompletion
 }:
 
@@ -22,7 +25,7 @@ assert enableEchonest    -> pythonPackages.pyechonest     != null;
 assert enableFetchart    -> pythonPackages.responses      != null;
 assert enableLastfm      -> pythonPackages.pylast         != null;
 assert enableMpd         -> pythonPackages.mpd            != null;
-assert enableReplaygain  -> pythonPackages.audiotools     != null;
+assert enableReplaygain  -> bs1770gain                    != null;
 assert enableThumbnails  -> pythonPackages.pyxdg          != null;
 assert enableWeb         -> pythonPackages.flask          != null;
 
@@ -90,9 +93,11 @@ in buildPythonPackage rec {
     ++ optional enableEchonest   pythonPackages.pyechonest
     ++ optional enableLastfm     pythonPackages.pylast
     ++ optional enableMpd        pythonPackages.mpd
-    ++ optional enableReplaygain pythonPackages.audiotools
     ++ optional enableThumbnails pythonPackages.pyxdg
-    ++ optional enableWeb        pythonPackages.flask;
+    ++ optional enableWeb        pythonPackages.flask
+    ++ optional enableAlternatives (import ./alternatives-plugin.nix {
+      inherit stdenv buildPythonPackage pythonPackages fetchFromGitHub;
+    });
 
   buildInputs = with pythonPackages; [
     beautifulsoup4
@@ -104,7 +109,7 @@ in buildPythonPackage rec {
   ];
 
   patches = [
-    ./replaygain-default-audiotools.patch
+    ./replaygain-default-bs1770gain.patch
   ];
 
   postPatch = ''
@@ -119,6 +124,12 @@ in buildPythonPackage rec {
       s,"flac","${flac}/bin/flac",
       s,"mp3val","${mp3val}/bin/mp3val",
     }' beetsplug/badfiles.py
+  '' + optionalString enableReplaygain ''
+    sed -i -re '
+      s!^( *cmd *= *b?['\'''"])(bs1770gain['\'''"])!\1${bs1770gain}/bin/\2!
+    ' beetsplug/replaygain.py
+    sed -i -e 's/if has_program.*bs1770gain.*:/if True:/' \
+      test/test_replaygain.py
   '';
 
   doCheck = true;
diff --git a/pkgs/tools/audio/beets/replaygain-default-audiotools.patch b/pkgs/tools/audio/beets/replaygain-default-bs1770gain.patch
index d852ea6fecaa7..538f9e9330398 100644
--- a/pkgs/tools/audio/beets/replaygain-default-audiotools.patch
+++ b/pkgs/tools/audio/beets/replaygain-default-bs1770gain.patch
@@ -11,7 +11,7 @@ index 40b3a3a..9b54a5a 100644
              'overwrite': False,
              'auto': True,
 -            'backend': u'command',
-+            'backend': u'audiotools',
++            'backend': u'bs1770gain',
              'targetlevel': 89,
          })
  
diff --git a/pkgs/tools/cd-dvd/brasero/default.nix b/pkgs/tools/cd-dvd/brasero/default.nix
index d7773b0ba0cce..3185242f5ce4d 100644
--- a/pkgs/tools/cd-dvd/brasero/default.nix
+++ b/pkgs/tools/cd-dvd/brasero/default.nix
@@ -1,15 +1,11 @@
 { stdenv, fetchurl, pkgconfig, gtk3, itstool, gst_all_1, libxml2, libnotify
-, libcanberra_gtk3, intltool, gnome3, makeWrapper, dvdauthor, cdrdao
-, dvdplusrwtools, cdrtools, libdvdcss }:
+, libcanberra_gtk3, intltool, makeWrapper, dvdauthor, cdrdao
+, dvdplusrwtools, cdrtools, libdvdcss, wrapGAppsHook }:
 
 let
   major = "3.12";
   minor = "0";
-  GST_PLUGIN_PATH = stdenv.lib.makeSearchPath "lib/gstreamer-1.0" [
-    gst_all_1.gst-plugins-base
-    gst_all_1.gst-plugins-good
-    gst_all_1.gst-plugins-bad
-    gst_all_1.gst-libav ];
+  binpath = stdenv.lib.makeSearchPath "bin" [ dvdauthor cdrdao dvdplusrwtools cdrtools ];
 
 in stdenv.mkDerivation rec {
   version = "${major}.${minor}";
@@ -20,13 +16,12 @@ in stdenv.mkDerivation rec {
     sha256 = "68fef2699b772fa262d855dac682100dbfea05563a7e4056eff8fe6447aec2fc";
   };
 
-  propagatedUserEnvPkgs = [ gnome3.gnome_themes_standard dvdauthor
-    cdrdao dvdplusrwtools cdrtools ];
+  nativeBuildInputs = [ pkgconfig itstool intltool wrapGAppsHook ];
 
-  buildInputs = [ pkgconfig gtk3 itstool libxml2 libnotify libcanberra_gtk3
-                  intltool gnome3.gsettings_desktop_schemas makeWrapper libdvdcss
-                  gst_all_1.gstreamer gst_all_1.gst-plugins-base gnome3.dconf
-                  gst_all_1.gst-plugins-good gst_all_1.gst-plugins-bad ];
+  buildInputs = [ gtk3 libxml2 libnotify libcanberra_gtk3 libdvdcss
+                  gst_all_1.gstreamer gst_all_1.gst-plugins-base
+                  gst_all_1.gst-plugins-good gst_all_1.gst-plugins-bad
+                  gst_all_1.gst-plugins-ugly gst_all_1.gst-libav ];
 
   # brasero checks that the applications it uses aren't symlinks, but this
   # will obviously not work on nix
@@ -36,16 +31,10 @@ in stdenv.mkDerivation rec {
     "--with-girdir=$out/share/gir-1.0"
     "--with-typelibdir=$out/lib/girepository-1.0" ];
 
+  NIX_CFLAGS_LINK = [ "-ldvdcss" ];
+
   preFixup = ''
-    for f in $out/bin/* $out/libexec/*; do
-      wrapProgram "$f" \
-        --prefix XDG_DATA_DIRS : "${gnome3.gnome_themes_standard}/share:$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH" \
-        --prefix GST_PLUGIN_SYSTEM_PATH_1_0 : "$GST_PLUGIN_SYSTEM_PATH_1_0" \
-        --prefix GST_PLUGIN_PATH : "${GST_PLUGIN_PATH}" \
-        --prefix GIO_EXTRA_MODULES : "${gnome3.dconf}/lib/gio/modules" \
-        --prefix LD_LIBRARY_PATH : ${libdvdcss}/lib
-    done
-    rm $out/share/icons/hicolor/icon-theme.cache
+    gappsWrapperArgs+=(--prefix PATH : "${binpath}")
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/cd-dvd/dvdisaster/default.nix b/pkgs/tools/cd-dvd/dvdisaster/default.nix
index 101d69c0903b5..a98ce2088bd0e 100644
--- a/pkgs/tools/cd-dvd/dvdisaster/default.nix
+++ b/pkgs/tools/cd-dvd/dvdisaster/default.nix
@@ -1,16 +1,20 @@
-{ stdenv, fetchurl, pkgconfig, which, gettext, intltool
+{ stdenv, fetchurl, pkgconfig, gettext, which
 , glib, gtk2
 , enableSoftening ? true
 }:
 
+let version = "0.79.5"; in
 stdenv.mkDerivation rec {
-  name = "dvdisaster-0.72.6";
+  name = "dvdisaster-${version}";
 
   src = fetchurl {
     url = "http://dvdisaster.net/downloads/${name}.tar.bz2";
-    sha256 = "e9787dea39aeafa38b26604752561bc895083c17b588489d857ac05c58be196b";
+    sha256 = "0f8gjnia2fxcbmhl8b3qkr5b7idl8m855dw7xw2fnmbqwvcm6k4w";
   };
 
+  nativeBuildInputs = [ gettext pkgconfig which ];
+  buildInputs = [ glib gtk2 ];
+
   patches = stdenv.lib.optional enableSoftening [
     ./encryption.patch
     ./dvdrom.patch
@@ -21,13 +25,38 @@ stdenv.mkDerivation rec {
     sed -i 's/dvdisaster48.png/dvdisaster/' contrib/dvdisaster.desktop
   '';
 
-  # Explicit --docdir= is required for on-line help to work:
-  configureFlags = [ "--docdir=$out/share/doc" ];
+  configureFlags = [
+    # Explicit --docdir= is required for on-line help to work:
+    "--docdir=$out/share/doc"
+    "--with-nls=yes"
+    "--with-embedded-src-path=no"
+  ] ++ stdenv.lib.optional (builtins.elem stdenv.system
+      stdenv.lib.platforms.x86_64) "--with-sse2=yes";
 
-  buildInputs = [
-    pkgconfig which gettext intltool
-    glib gtk2
-  ];
+  enableParallelBuilding = true;
+
+  doCheck = true;
+  checkPhase = ''
+    pushd regtest
+
+    mkdir -p "$TMP"/{log,regtest}
+    substituteInPlace common.bash \
+      --replace /dev/shm "$TMP/log" \
+      --replace /var/tmp "$TMP"
+
+    for test in *.bash; do
+      case "$test" in
+      common.bash)
+        echo "Skipping $test"
+        continue ;;
+      *)
+        echo "Running $test"
+        ./"$test"
+      esac
+    done
+
+    popd
+  '';
 
   postInstall = ''
     mkdir -pv $out/share/applications
@@ -35,11 +64,13 @@ stdenv.mkDerivation rec {
 
     for size in 16 24 32 48 64; do
       mkdir -pv $out/share/icons/hicolor/"$size"x"$size"/apps/
-      cp contrib/dvdisaster"$size".png $out/share/icons/hicolor/"$size"x"$size"/apps/dvdisaster.png
+      cp contrib/dvdisaster"$size".png \
+        $out/share/icons/hicolor/"$size"x"$size"/apps/dvdisaster.png
     done
   '';
 
   meta = with stdenv.lib; {
+    inherit version;
     homepage = http://dvdisaster.net/;
     description = "Data loss/scratch/aging protection for CD/DVD media";
     longDescription = ''
@@ -48,8 +79,8 @@ stdenv.mkDerivation rec {
       data which is used to recover unreadable sectors if the disc becomes
       damaged at a later time.
     '';
-    license = licenses.gpl2;
+    license = licenses.gpl3Plus;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ jgeerds ];
+    maintainers = with maintainers; [ jgeerds nckx ];
   };
 }
diff --git a/pkgs/tools/cd-dvd/dvdisaster/encryption.patch b/pkgs/tools/cd-dvd/dvdisaster/encryption.patch
index a9383cb13cfe4..21e35889382dc 100644
--- a/pkgs/tools/cd-dvd/dvdisaster/encryption.patch
+++ b/pkgs/tools/cd-dvd/dvdisaster/encryption.patch
@@ -1,21 +1,19 @@
 Author: n/a
 Description: Disables to skip on encrypted disks (e.g. DVD with CSS-Encryption).
 
-Index: dvdisaster/scsi-layer.c
-===================================================================
---- dvdisaster.orig/scsi-layer.c	2012-04-08 21:51:10.995588783 +0900
-+++ dvdisaster/scsi-layer.c	2012-04-08 21:51:29.259678075 +0900
-@@ -2693,11 +2693,12 @@
-        	 return NULL;
+diff -Naur dvdisaster-0.79.5.orig/scsi-layer.c dvdisaster-0.79.5/scsi-layer.c
+--- dvdisaster-0.79.5.orig/scsi-layer.c	2015-10-28 21:56:57.000000000 +0100
++++ dvdisaster-0.79.5/scsi-layer.c	2015-12-27 06:19:32.012253661 +0100
+@@ -2712,12 +2712,6 @@
        }
     }
--
-+/*
-    if(dh->mainType == DVD && query_copyright(dh))
-    {  CloseDevice(dh);
-       Stop(_("This software does not support encrypted media.\n"));
-    }
-+*/
  
+-   if(dh->mainType == DVD && query_copyright(dh))
+-   {  CloseImage(image);
+-      Stop(_("This software does not support encrypted media.\n"));
+-      return NULL;
+-   }
+-
     /* Create the bitmap of simulated defects */
  
+    if(Closure->simulateDefects)
diff --git a/pkgs/tools/cd-dvd/xorriso/default.nix b/pkgs/tools/cd-dvd/xorriso/default.nix
index 29d483f725fae..8dd4c709b016d 100644
--- a/pkgs/tools/cd-dvd/xorriso/default.nix
+++ b/pkgs/tools/cd-dvd/xorriso/default.nix
@@ -1,11 +1,11 @@
 { fetchurl, stdenv, libcdio, zlib, bzip2, readline, acl, attr }:
 
 stdenv.mkDerivation rec {
-  name = "xorriso-1.4.0";
+  name = "xorriso-1.4.2";
 
   src = fetchurl {
     url = "mirror://gnu/xorriso/${name}.tar.gz";
-    sha256 = "0mhfxn2idkrw1i65a5y4gnb1fig85zpnszb9ax7w4a2v062y1l8b";
+    sha256 = "1cq4a0904lnz6nygbgarnlq49cz4qnfdyvz90s3nfk5as7gbwhr8";
   };
 
   doCheck = true;
diff --git a/pkgs/tools/compression/pixz/default.nix b/pkgs/tools/compression/pixz/default.nix
new file mode 100644
index 0000000000000..8572221572c1b
--- /dev/null
+++ b/pkgs/tools/compression/pixz/default.nix
@@ -0,0 +1,36 @@
+{ 
+  stdenv, fetchFromGitHub, autoconf, automake, libtool, pkgconfig
+  , asciidoc, libxslt, libxml2, docbook_xml_dtd_45, docbook_xml_xslt
+  , libarchive, lzma
+}:
+stdenv.mkDerivation rec {
+  baseName = "pixz";
+  version = "1.0.6";
+  name = "${baseName}-${version}";
+
+  buildInputs = [
+    autoconf automake libtool pkgconfig asciidoc libxslt libxml2
+    docbook_xml_dtd_45 docbook_xml_xslt
+    libarchive lzma
+  ];
+  preBuild = ''
+    echo "XML_CATALOG_FILES='$XML_CATALOG_FILES'"
+  '';
+  src = fetchFromGitHub {
+    owner = "vasi";
+    repo = baseName;
+    rev = "v${version}";
+    sha256 = "0q61wqg2yxrgd4nc7256mf7izp92is29ll3rax1cxr6fj9jrd8b7";
+  };
+  preConfigure = ''
+    ./autogen.sh
+  '';
+
+  meta = {
+    inherit version;
+    description = ''A parallel compressor/decompressor for xz format'';
+    license = stdenv.lib.licenses.bsd2;
+    maintainers = [stdenv.lib.maintainers.raskin];
+    platforms = stdenv.lib.platforms.linux;
+  };
+}
diff --git a/pkgs/tools/filesystems/9pfs/default.nix b/pkgs/tools/filesystems/9pfs/default.nix
new file mode 100644
index 0000000000000..c75cc45170af1
--- /dev/null
+++ b/pkgs/tools/filesystems/9pfs/default.nix
@@ -0,0 +1,30 @@
+{ lib, stdenv, fetchFromGitHub, fuse }:
+
+stdenv.mkDerivation rec {
+  name = "9pfs";
+
+  src = fetchFromGitHub {
+    owner = "spewspew";
+    repo = "9pfs";
+    rev = "7f4ca4cd750d650c1215b92ac3cc2a28041960e4";
+    sha256 = "007s2idsn6bspmfxv1qabj39ggkgvn6gwdbhczwn04lb4c6gh3xc";
+  };
+
+  preConfigure =
+    ''
+      substituteInPlace Makefile --replace '-g bin' ""
+      installFlagsArray+=(BIN=$out/bin MAN=$out/share/man/man1)
+      mkdir -p $out/bin $out/share/man/man1
+    '';
+
+  buildInputs = [ fuse ];
+
+  enableParallelBuilding = true;
+
+  meta = {
+    homepage = https://github.com/spewspew/9pfs;
+    description = "FUSE-based client of the 9P network filesystem protocol";
+    maintainers = [ lib.maintainers.eelco ];
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/tools/filesystems/duperemove/default.nix b/pkgs/tools/filesystems/duperemove/default.nix
index 4836e39d43938..146414a47e108 100644
--- a/pkgs/tools/filesystems/duperemove/default.nix
+++ b/pkgs/tools/filesystems/duperemove/default.nix
@@ -1,17 +1,18 @@
-{ lib, stdenv, fetchFromGitHub, libgcrypt, pkgconfig, glib, linuxHeaders }:
+{ lib, stdenv, fetchFromGitHub, libgcrypt
+, pkgconfig, glib, linuxHeaders, sqlite }:
 
 stdenv.mkDerivation rec {
   name = "duperemove-${version}";
-  version = "0.09.4";
+  version = "0.10";
 
   src = fetchFromGitHub {
     owner = "markfasheh";
     repo = "duperemove";
     rev = "v${version}";
-    sha256 = "1d586k6rbfqb5557i1p5xq8ngbppbwpxlkw8wqm7d900a3hp36nl";
+    sha256 = "1fll0xjg1p3pabgjiddild4ragk9spbdmdzrkq0hv5pxb1qrv7lp";
   };
 
-  buildInputs = [ libgcrypt pkgconfig glib linuxHeaders ];
+  buildInputs = [ libgcrypt pkgconfig glib linuxHeaders sqlite ];
 
   makeFlags = [ "DESTDIR=$(out)" "PREFIX=" ];
 
@@ -19,8 +20,7 @@ stdenv.mkDerivation rec {
     description = "A simple tool for finding duplicated extents and submitting them for deduplication";
     homepage = https://github.com/markfasheh/duperemove;
     license = lib.licenses.gpl2;
-
-    maintainers = [ lib.maintainers.bluescreen303 ];
+    maintainers = with lib.maintainers; [ bluescreen303 thoughtpolice ];
     platforms = lib.platforms.all;
   };
 }
diff --git a/pkgs/tools/filesystems/exfat/default.nix b/pkgs/tools/filesystems/exfat/default.nix
index f8a0d09bc52a8..507c5e7a6c0ec 100644
--- a/pkgs/tools/filesystems/exfat/default.nix
+++ b/pkgs/tools/filesystems/exfat/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, fuse }:
 
-let version = "1.2.2"; in
+let version = "1.2.3"; in
 stdenv.mkDerivation rec {
   name = "exfat-${version}";
 
   src = fetchFromGitHub {
-    sha256 = "17yyd988l4r5w3q3h3hjlxprbw74wdg4n759lzg325smh96qk7p1";
+    sha256 = "147s11sqmn5flbvz2hwpl6kdfqi2gnm1c2nsn5fxygyw7qyhpzda";
     rev = "v${version}";
     repo = "exfat";
     owner = "relan";
diff --git a/pkgs/tools/filesystems/ntfs-3g/default.nix b/pkgs/tools/filesystems/ntfs-3g/default.nix
index f10e05ac48618..fd714b8905468 100644
--- a/pkgs/tools/filesystems/ntfs-3g/default.nix
+++ b/pkgs/tools/filesystems/ntfs-3g/default.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     homepage = http://www.tuxera.com/community/;
-    description = "FUSE-base NTFS driver with full write support";
+    description = "FUSE-based NTFS driver with full write support";
     maintainers = [ maintainers.urkud ];
     platforms = platforms.linux;
     license = licenses.gpl2Plus; # and (lib)fuse-lite under LGPL2+
diff --git a/pkgs/tools/graphics/gnuplot/default.nix b/pkgs/tools/graphics/gnuplot/default.nix
index 08799d3e712b0..2b78f1fba4056 100644
--- a/pkgs/tools/graphics/gnuplot/default.nix
+++ b/pkgs/tools/graphics/gnuplot/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, zlib, gd, texinfo4, makeWrapper, readline
-, withTeXLive ? false, texLive
+, withTeXLive ? false, texlive
 , withLua ? false, lua
 , emacs ? null
 , libX11 ? null
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
 
   buildInputs =
     [ zlib gd texinfo4 readline pango cairo pkgconfig makeWrapper ]
-    ++ lib.optional withTeXLive texLive
+    ++ lib.optional withTeXLive (texlive.combine { inherit (texlive) scheme-small; })
     ++ lib.optional withLua lua
     ++ lib.optionals withX [ libX11 libXpm libXt libXaw ]
     ++ lib.optional withQt [ qt ]
diff --git a/pkgs/tools/graphics/jhead/default.nix b/pkgs/tools/graphics/jhead/default.nix
index ee44ff975bb3d..470a2efdf6bac 100644
--- a/pkgs/tools/graphics/jhead/default.nix
+++ b/pkgs/tools/graphics/jhead/default.nix
@@ -1,25 +1,38 @@
-{stdenv, fetchurl}:
+{ stdenv, fetchurl }:
 
-stdenv.mkDerivation {
-  name = "jhead-2.87";
+stdenv.mkDerivation rec {
+  name = "jhead-${version}";
+  version = "3.00";
 
   src = fetchurl {
-    url = http://www.sentex.net/~mwandel/jhead/jhead-2.87.tar.gz;
-    sha256 = "0vpp5jz49w5qzjzq3vllrbff7fr906jy8a8sq12yq8kw6qwbjjsl";
+    url = "http://www.sentex.net/~mwandel/jhead/${name}.tar.gz";
+    sha256 = "0pl9s9ssb2a9di82f3ypin2hd098ns8kzdsxw3i2y94f07d03k48";
   };
 
   patchPhase = ''
-    sed -i s@/usr/bin@$out/bin@ makefile
+    substituteInPlace makefile \
+      --replace /usr/local/bin $out/bin
+
+    substituteInPlace jhead.c \
+      --replace "\"   Compiled: \"__DATE__" ""
   '';
 
-  preInstall = ''
-    mkdir -p $out/bin
+  installPhase = ''
+    mkdir -p \
+      $out/bin \
+      $out/man/man1 \
+      $out/share/doc/${name}
+
+    cp -v jhead $out/bin
+    cp -v jhead.1 $out/man/man1
+    cp -v *.txt $out/share/doc/${name}
   '';
 
-  meta = {
+  meta = with stdenv.lib; {
     homepage = http://www.sentex.net/~mwandel/jhead/;
     description = "Exif Jpeg header manipulation tool";
-    license = stdenv.lib.licenses.free;
-    maintainers = with stdenv.lib.maintainers; [viric];
+    license = licenses.publicDomain;
+    maintainers = with maintainers; [ viric rycee ];
+    platforms = platforms.all;
   };
 }
diff --git a/pkgs/tools/graphics/kst/default.nix b/pkgs/tools/graphics/kst/default.nix
index 01fb5d8299479..9b983450f4804 100644
--- a/pkgs/tools/graphics/kst/default.nix
+++ b/pkgs/tools/graphics/kst/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, cmake, pkgconfig
-, qt5, gsl, getdata, netcdf, muparser, matio
+, qtbase, gsl, getdata, netcdf, muparser, matio
 }:
 stdenv.mkDerivation rec {
   name = "Kst-2.0.8";
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ cmake pkgconfig ];
-  buildInputs = [ qt5.base gsl getdata netcdf muparser matio ];
+  buildInputs = [ qtbase gsl getdata netcdf muparser matio ];
 
   cmakeFlags = "-Dkst_qt5=1 -Dkst_release=1";
 
diff --git a/pkgs/tools/graphics/pdf2svg/default.nix b/pkgs/tools/graphics/pdf2svg/default.nix
index 10309d208d819..52ca99b976455 100644
--- a/pkgs/tools/graphics/pdf2svg/default.nix
+++ b/pkgs/tools/graphics/pdf2svg/default.nix
@@ -1,20 +1,24 @@
-{ stdenv, fetchurl, pkgconfig, cairo, gtk, poppler }:
+{ stdenv, fetchFromGitHub, autoreconfHook, pkgconfig
+, cairo, gtk, poppler }:
 
-stdenv.mkDerivation {
-  name = "pdf2svg-0.2.2";
+stdenv.mkDerivation rec {
+  name = "pdf2svg-${version}";
+  version = "0.2.3";
 
-  src = fetchurl {
-    url = "http://www.cityinthesky.co.uk/wp-content/uploads/2013/10/pdf2svg-0.2.2.tar.gz" ; 
-    sha256 = "1jy6iqwwvd7drcybmdlmnc8m970f82fd7fisa8ha5zh13p49r8n2";
+  src = fetchFromGitHub {
+    owner = "db9052";
+    repo = "pdf2svg";
+    rev = "v${version}";
+    sha256 = "14ffdm4y26imq99wjhkrhy9lp33165xci1l5ndwfia8hz53bl02k";
   };
 
-  buildInputs = [ cairo pkgconfig poppler gtk ];
+  buildInputs = [ autoreconfHook cairo pkgconfig poppler gtk ];
 
-  meta = { 
+  meta = with stdenv.lib; {
     description = "PDF converter to SVG format";
     homepage = http://www.cityinthesky.co.uk/opensource/pdf2svg;
-    license = stdenv.lib.licenses.gpl2;
-    maintainers = [ stdenv.lib.maintainers.ianwookim ];
-    platforms = stdenv.lib.platforms.unix;
+    license = licenses.gpl2;
+    maintainers = [ maintainers.ianwookim ];
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/tools/graphics/vips/default.nix b/pkgs/tools/graphics/vips/default.nix
index a411080c3908b..153611e058747 100644
--- a/pkgs/tools/graphics/vips/default.nix
+++ b/pkgs/tools/graphics/vips/default.nix
@@ -4,11 +4,11 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "vips-8.0.2";
+  name = "vips-8.1.1";
 
   src = fetchurl {
     url = "http://www.vips.ecs.soton.ac.uk/supported/current/${name}.tar.gz";
-    sha256 = "0fpshv71sxbkbycxgd2hvwn7fyq9rm0rsgq0b1zld1an88mi0v8y";
+    sha256 = "014sgpqj832vl5k212jv25sjakrsifnspjfclywpmn7cwaqwjlvx";
   };
 
   buildInputs =
diff --git a/pkgs/tools/misc/antimicro/default.nix b/pkgs/tools/misc/antimicro/default.nix
index a2eed91393064..1d7984ac11da4 100644
--- a/pkgs/tools/misc/antimicro/default.nix
+++ b/pkgs/tools/misc/antimicro/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, cmake, pkgconfig, SDL2, qt5, xorg, fetchzip }:
+{ stdenv, cmake, pkgconfig, SDL2, qtbase, qttools, xorg, fetchzip }:
 
 stdenv.mkDerivation rec {
   name = "antimicro-${version}";
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
   };
 
   buildInputs = [
-    cmake pkgconfig SDL2 qt5.base qt5.tools xorg.libXtst
+    cmake pkgconfig SDL2 qtbase qttools xorg.libXtst
   ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/misc/bdf2psf/default.nix b/pkgs/tools/misc/bdf2psf/default.nix
index 342c014faaaef..192aed7489d3e 100644
--- a/pkgs/tools/misc/bdf2psf/default.nix
+++ b/pkgs/tools/misc/bdf2psf/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "bdf2psf-${version}";
-  version = "1.132";
+  version = "1.134";
 
   src = fetchurl {
     url = "mirror://debian/pool/main/c/console-setup/bdf2psf_${version}_all.deb";
-    sha256 = "01r8v6qi6klsgi66ld86c78cdz308mywrm9j101d73nsxgx6qhzz";
+    sha256 = "1am5ka5qrbh60jjihzqac03ii3ydprvqm3w54dc55a0zwl61njsz";
   };
 
   buildInputs = [ dpkg ];
@@ -21,12 +21,14 @@ stdenv.mkDerivation rec {
     cp -r . $out
   ";
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "BDF to PSF converter";
     homepage = https://packages.debian.org/sid/bdf2psf;
     longDescription = ''
       Font converter to generate console fonts from BDF source fonts
     '';
-    license = stdenv.lib.licenses.gpl2;
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ rnhmjoj ];
+    platforms = platforms.unix;
   };
-}
\ No newline at end of file
+}
diff --git a/pkgs/tools/misc/calamares/default.nix b/pkgs/tools/misc/calamares/default.nix
index e2b8c70c6e278..ab00d52c7779b 100644
--- a/pkgs/tools/misc/calamares/default.nix
+++ b/pkgs/tools/misc/calamares/default.nix
@@ -1,6 +1,6 @@
-{ stdenv, fetchgit, cmake, qt5, polkit_qt5, libyamlcpp, python, boost, parted
+{ stdenv, fetchgit, cmake, polkit-qt, libyamlcpp, python, boost, parted
 , extra-cmake-modules, kconfig, ki18n, kcoreaddons, solid, utillinux, libatasmart
-, ckbcomp, glibc, tzdata, xkeyboard_config }:
+, ckbcomp, glibc, tzdata, xkeyboard_config, qtbase, qtquick1, qtsvg, qttools }:
 
 stdenv.mkDerivation rec {
   name = "calamares-${version}";
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   };
 
   buildInputs = [
-    cmake qt5.base qt5.tools libyamlcpp python boost polkit_qt5 parted
+    cmake qtbase qtquick1 qtsvg qttools libyamlcpp python boost polkit-qt parted
     extra-cmake-modules kconfig ki18n kcoreaddons solid utillinux libatasmart
   ];
 
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
   '';
 
   preInstall = ''
-    substituteInPlace cmake_install.cmake --replace "${polkit_qt5}" "$out"
+    substituteInPlace cmake_install.cmake --replace "${polkit-qt}" "$out"
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/misc/diffoscope/default.nix b/pkgs/tools/misc/diffoscope/default.nix
index e6c672d83441d..7fe21e8b3474b 100644
--- a/pkgs/tools/misc/diffoscope/default.nix
+++ b/pkgs/tools/misc/diffoscope/default.nix
@@ -1,37 +1,34 @@
 { stdenv, fetchgit, pythonPackages, docutils
-, acl, binutils, bzip2, cdrkit, cpio, diffutils, e2fsprogs, file, gettext
-, gnupg, gzip, pdftk, poppler_utils, rpm, sqlite, squashfsTools, unzip, vim, xz
+, acl, binutils, bzip2, cbfstool, cdrkit, cpio, diffutils, e2fsprogs, file, fpc, gettext, ghc, gnupg1
+, gzip, jdk, libcaca, mono, pdftk, poppler_utils, rpm, sng, sqlite, squashfsTools, unzip, vim, xz
 }:
 
 pythonPackages.buildPythonPackage rec {
   name = "diffoscope-${version}";
-  version = "29";
+  version = "44";
 
   namePrefix = "";
 
   src = fetchgit {
     url = "git://anonscm.debian.org/reproducible/diffoscope.git";
     rev = "refs/tags/${version}";
-    sha256 = "0q7hx2wm9gvzl1f7iilr9pjwpv8i2anscqan7cgk80v90s2pakrf";
+    sha256 = "1sisdmh1bl62b16yfjy9mxxdfzhskrabp0l3pl1kxn7db0c4vpac";
   };
 
   postPatch = ''
-    # Different pkg name in debian
-    sed -i setup.py -e "s@'magic'@'Magic-file-extensions'@"
-
     # Upstream doesn't provide a PKG-INFO file
-    sed -i setup.py -e "/'rpm',/d"
+    sed -i setup.py -e "/'rpm-python',/d"
   '';
 
-  # Still missing these tools: ghc javap showttf sng
-  propagatedBuildInputs = (with pythonPackages; [ debian libarchive-c magic ssdeep ]) ++
-    [ acl binutils bzip2 cdrkit cpio diffutils e2fsprogs file gettext gnupg
-      gzip pdftk poppler_utils rpm sqlite squashfsTools unzip vim xz ];
+  # Still missing these tools: enjarify otool(maybe OS X only) showttf
+  # Also these libraries: python3-guestfs
+  propagatedBuildInputs = (with pythonPackages; [ debian libarchive-c python_magic tlsh ]) ++
+    [ acl binutils bzip2 cbfstool cdrkit cpio diffutils e2fsprogs file fpc gettext ghc gnupg1
+      gzip jdk libcaca mono pdftk poppler_utils rpm sng sqlite squashfsTools unzip vim xz ];
 
   doCheck = false; # Calls 'mknod' in squashfs tests, which needs root
 
   postInstall = ''
-    mv $out/bin/diffoscope.py $out/bin/diffoscope
     mkdir -p $out/share/man/man1
     ${docutils}/bin/rst2man.py debian/diffoscope.1.rst $out/share/man/man1/diffoscope.1
   '';
diff --git a/pkgs/tools/misc/dynamic-colors/default.nix b/pkgs/tools/misc/dynamic-colors/default.nix
new file mode 100644
index 0000000000000..b587afb645c22
--- /dev/null
+++ b/pkgs/tools/misc/dynamic-colors/default.nix
@@ -0,0 +1,37 @@
+{ stdenv, fetchFromGitHub, makeWrapper, tmux, vim }:
+
+stdenv.mkDerivation rec {
+  name = "dynamic-colors-git-${version}";
+  version = "2013-12-28";
+
+  src = fetchFromGitHub {
+    owner = "sos4nt";
+    repo = "dynamic-colors";
+    rev = "35325f43620c5ee11a56db776b8f828bc5ae1ddd";
+    sha256 = "1xsjanqyvjlcj1fb8x4qafskxp7aa9b43ba9gyjgzr7yz8hkl4iz";
+  };
+
+  buildInputs = [ makeWrapper ];
+
+  patches = [ ./separate-config-and-dynamic-root-path.patch ];
+
+  installPhase = ''
+    mkdir -p $out/bin $out/etc/bash_completion.d $out/share/dynamic-colors
+    cp bin/dynamic-colors $out/bin/
+    cp completions/dynamic-colors.bash $out/etc/bash_completion.d/
+    cp -r colorschemes $out/share/dynamic-colors/
+
+    sed -e 's|\<tmux\>|${tmux}/bin/tmux|g' \
+        -e 's|/usr/bin/vim|${vim}/bin/vim|g' \
+        -i "$out/bin/dynamic-colors"
+
+    wrapProgram $out/bin/dynamic-colors --set DYNAMIC_COLORS_ROOT "$out/share/dynamic-colors"
+  '';
+
+  meta = {
+    homepage = https://github.com/sos4nt/dynamic-colors;
+    license = stdenv.lib.licenses.mit;
+    description = "Change terminal colors on the fly";
+    platforms = stdenv.lib.platforms.unix;
+  };
+}
diff --git a/pkgs/tools/misc/dynamic-colors/separate-config-and-dynamic-root-path.patch b/pkgs/tools/misc/dynamic-colors/separate-config-and-dynamic-root-path.patch
new file mode 100644
index 0000000000000..7462ed0e3afad
--- /dev/null
+++ b/pkgs/tools/misc/dynamic-colors/separate-config-and-dynamic-root-path.patch
@@ -0,0 +1,58 @@
+From ee44b859003972275d8e469ab41b9900420295e0 Mon Sep 17 00:00:00 2001
+From: Malte Rohde <malte.rohde@flavoursys.com>
+Date: Fri, 9 Jan 2015 13:10:41 +0100
+Subject: [PATCH] Store user configuration in appropriate config location.
+
+So that the dynamic-colors source can live somewhere else
+(e.g., /usr/local/dynamic-colors) and multiple users
+can use the same script.
+---
+ bin/dynamic-colors | 21 ++++++++++++++++-----
+ 1 file changed, 16 insertions(+), 5 deletions(-)
+
+diff --git a/bin/dynamic-colors b/bin/dynamic-colors
+index a669221..5d6bce7 100755
+--- a/bin/dynamic-colors
++++ b/bin/dynamic-colors
+@@ -84,16 +84,27 @@ else
+ fi
+ COLORSCHEMES="${DYNAMIC_COLORS_ROOT}/colorschemes"
+ 
++if [ -z "${DYNAMIC_COLORS_HOME}" ]; then
++  if [ -d "${HOME}/.dynamic-colors" ] || [ -z "${XDG_CONFIG_HOME}" ]; then
++    DYNAMIC_COLORS_HOME="${HOME}/.dynamic-colors"
++  else
++    DYNAMIC_COLORS_HOME="${XDG_CONFIG_HOME}/dynamic-colors"
++  fi
++else
++  DYNAMIC_COLORS_HOME="${DYNAMIC_COLORS_HOME%/}"
++fi
++
+ write_colorscheme_name () {
+-  echo "$1" > "${DYNAMIC_COLORS_ROOT}/colorscheme"
++  [ ! -d "${DYNAMIC_COLORS_HOME}" ] && mkdir -p "${DYNAMIC_COLORS_HOME}"
++  echo "$1" > "${DYNAMIC_COLORS_HOME}/colorscheme"
+ }
+ 
+ load_colorscheme_name () {
+-  head -1 "${DYNAMIC_COLORS_ROOT}/colorscheme"
++  head -1 "${DYNAMIC_COLORS_HOME}/colorscheme"
+ }
+ 
+ init () {
+-  [ ! -f "${DYNAMIC_COLORS_ROOT}/colorscheme" ] && return
++  [ ! -f "${DYNAMIC_COLORS_HOME}/colorscheme" ] && return
+   colorscheme_name=$(load_colorscheme_name)
+   load_colorscheme "$colorscheme_name"
+   set_colors
+@@ -142,8 +153,8 @@ audit () {
+ }
+ 
+ cycle() {
+-    if [ -f "${DYNAMIC_COLORS_ROOT}/colorscheme" ]; then
+-        current=`head -1 "${DYNAMIC_COLORS_ROOT}/colorscheme"`
++    if [ -f "${DYNAMIC_COLORS_HOME}/colorscheme" ]; then
++        current=$(load_colorscheme_name)
+         found=false
+         cd "$COLORSCHEMES"
+         for file in *.sh; do
diff --git a/pkgs/tools/misc/fontforge/default.nix b/pkgs/tools/misc/fontforge/default.nix
index 3ecb886419f28..9ee3eb23e0e95 100644
--- a/pkgs/tools/misc/fontforge/default.nix
+++ b/pkgs/tools/misc/fontforge/default.nix
@@ -29,10 +29,9 @@ stdenv.mkDerivation {
   buildInputs = [
     git autoconf automake gnum4 libtool perl pkgconfig gettext uthash
     python freetype zlib glib libungif libpng libjpeg libtiff libxml2
+    pango
   ]
-    ++ lib.optionals withGTK [ gtk2 ]
-    # I'm not sure why pango doesn't seem necessary on Linux
-    ++ lib.optionals stdenv.isDarwin [ pango ];
+    ++ lib.optionals withGTK [ gtk2 ];
 
   configureFlags =
     lib.optionals (!withPython) [ "--disable-python-scripting" "--disable-python-extension" ]
diff --git a/pkgs/tools/misc/gibo/default.nix b/pkgs/tools/misc/gibo/default.nix
new file mode 100644
index 0000000000000..67c8449469203
--- /dev/null
+++ b/pkgs/tools/misc/gibo/default.nix
@@ -0,0 +1,34 @@
+{ stdenv, fetchFromGitHub, coreutils, findutils, git }:
+
+stdenv.mkDerivation rec {
+  name = "gibo-${version}";
+  version = "1.0.4";
+
+  src = fetchFromGitHub {
+    owner = "simonwhitaker";
+    repo = "gibo";
+    rev = version;
+    sha256 = "1vzchggxv660c1cj5v0hlmln7yda48wjy2cv0qwi619cmr5hwbgh";
+  };
+
+  phases = [ "unpackPhase" "installPhase" "fixupPhase" ];
+
+  installPhase = ''
+    mkdir -p $out/bin $out/etc/bash_completion.d
+    cp gibo $out/bin
+    cp gibo-completion.bash $out/etc/bash_completion.d
+
+    sed -e 's|\<git |${git}/bin/git |g' \
+        -e 's|\<basename |${coreutils}/bin/basename |g' \
+        -i "$out/bin/gibo"
+    sed -e 's|\<find |${findutils}/bin/find |g' \
+        -i "$out/etc/bash_completion.d/gibo-completion.bash"
+  '';
+
+  meta = {
+    homepage = https://github.com/simonwhitaker/gibo;
+    license = stdenv.lib.licenses.publicDomain;
+    description = "A shell script for easily accessing gitignore boilerplates";
+    platforms = stdenv.lib.platforms.unix;
+  };
+}
diff --git a/pkgs/tools/misc/grub/trusted.nix b/pkgs/tools/misc/grub/trusted.nix
index 87c551db4e387..694f45599f30a 100644
--- a/pkgs/tools/misc/grub/trusted.nix
+++ b/pkgs/tools/misc/grub/trusted.nix
@@ -1,5 +1,6 @@
 { stdenv, fetchurl, fetchgit, autogen, flex, bison, python, autoconf, automake
 , gettext, ncurses, libusb, freetype, qemu, devicemapper
+, for_HP_laptop ? false
 }:
 
 with stdenv.lib;
@@ -11,7 +12,7 @@ let
 
   inPCSystems = any (system: stdenv.system == system) (mapAttrsToList (name: _: name) pcSystems);
 
-  version = "1.2.1";
+  version = if for_HP_laptop then "1.2.1" else "1.2.0";
 
   unifont_bdf = fetchurl {
     url = "http://unifoundry.com/unifont-5.1.20080820.bdf.gz";
@@ -25,16 +26,22 @@ let
 
   };
 
-in (
+in
 
 stdenv.mkDerivation rec {
   name = "trustedGRUB2-${version}";
 
-  src = fetchgit {
-    url = "https://github.com/Sirrix-AG/TrustedGRUB2";
-    rev = "ab483d389bda3115ca0ae4202fd71f2e4a31ad41";
-    sha256 = "4b715837f8632278720d8b29aec06332f5302c6ba78183ced5f48d3c376d89c0";
-  };
+  src = if for_HP_laptop
+        then fetchgit {
+          url = "https://github.com/Sirrix-AG/TrustedGRUB2";
+          rev = "ab483d389bda3115ca0ae4202fd71f2e4a31ad41";
+          sha256 = "4b715837f8632278720d8b29aec06332f5302c6ba78183ced5f48d3c376d89c0";
+        }
+        else fetchgit {
+          url = "https://github.com/Sirrix-AG/TrustedGRUB2";
+          rev = "1ff54a5fbe02ea01df5a7de59b1e0201e08d4f76";
+          sha256 = "8c17bd7e14dd96ae9c4e98723f4e18ec6b21d45ac486ecf771447649829d0b34";
+        };
 
   nativeBuildInputs = [ autogen flex bison python autoconf automake ];
   buildInputs = [ ncurses libusb freetype gettext devicemapper ]
@@ -89,4 +96,4 @@ stdenv.mkDerivation rec {
     license = licenses.gpl3Plus;
     platforms = platforms.gnu;
   };
-})
+}
diff --git a/pkgs/tools/misc/ipad_charge/default.nix b/pkgs/tools/misc/ipad_charge/default.nix
index df987ed86c1c8..73fee38cbf206 100644
--- a/pkgs/tools/misc/ipad_charge/default.nix
+++ b/pkgs/tools/misc/ipad_charge/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, libusb }:
+{ stdenv, fetchFromGitHub, libusb1 }:
 
 let version = "2015-02-03"; in
 stdenv.mkDerivation rec {
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     owner = "mkorenkov";
   };
 
-  buildInputs = [ libusb ];
+  buildInputs = [ libusb1 ];
 
   postPatch = ''
     substituteInPlace Makefile \
diff --git a/pkgs/tools/misc/man-db/default.nix b/pkgs/tools/misc/man-db/default.nix
index 3ec429269a347..d77b7ff48128e 100644
--- a/pkgs/tools/misc/man-db/default.nix
+++ b/pkgs/tools/misc/man-db/default.nix
@@ -9,12 +9,18 @@ stdenv.mkDerivation rec {
   };
   
   buildInputs = [ pkgconfig libpipeline db groff ];
-  
+
   configureFlags = [
     "--disable-setuid"
     "--sysconfdir=/etc"
     "--localstatedir=/var"
     "--with-systemdtmpfilesdir=\${out}/lib/tmpfiles.d"
+    "--with-eqn=${groff}/bin/eqn"
+    "--with-neqn=${groff}/bin/neqn"
+    "--with-nroff=${groff}/bin/nroff"
+    "--with-pic=${groff}/bin/pic"
+    "--with-refer=${groff}/bin/refer"
+    "--with-tbl=${groff}/bin/tbl"
   ];
 
   installFlags = [ "DESTDIR=\${out}" ];
diff --git a/pkgs/tools/misc/mssys/default.nix b/pkgs/tools/misc/ms-sys/default.nix
index d1f76a10130cd..376d0ea6ad5c1 100644
--- a/pkgs/tools/misc/mssys/default.nix
+++ b/pkgs/tools/misc/ms-sys/default.nix
@@ -1,21 +1,20 @@
-{stdenv, fetchurl, gettext}:
+{ stdenv, fetchurl, gettext }:
 
+let version = "2.5.1"; in
 stdenv.mkDerivation rec {
   name = "ms-sys-${version}";
-  version = "2.4.1";
-  
+ 
   src = fetchurl {
     url = "mirror://sourceforge/ms-sys/${name}.tar.gz";
-    sha256 = "0qccv67fc2q97218b9wm6qpmx0nc0ssca391i0q15351y1na78nc";
+    sha256 = "1vw8yvcqb6iccs4x7rgk09mqrazkalmpxxxsxmvxn32jzdzl5b26";
   };
 
-  buildInputs = [gettext];
+  buildInputs = [ gettext ];
 
-  preBuild = ''
-    makeFlags=(PREFIX=$out)
-  '';
+  makeFlags = [ "PREFIX=$(out)" ];
 
   meta = {
+    inherit version;
     homepage = http://ms-sys.sourceforge.net/;
     license = stdenv.lib.licenses.gpl2;
     description = "A program for writing Microsoft compatible boot records";
diff --git a/pkgs/tools/misc/rmlint/default.nix b/pkgs/tools/misc/rmlint/default.nix
index 967efd3fae3eb..3c3f8c864396d 100644
--- a/pkgs/tools/misc/rmlint/default.nix
+++ b/pkgs/tools/misc/rmlint/default.nix
@@ -4,11 +4,11 @@
 with stdenv.lib;
 stdenv.mkDerivation rec {
   name = "rmlint-${version}";
-  version = "2.4.1";
+  version = "2.4.2";
 
   src = fetchurl {
     url = "https://github.com/sahib/rmlint/archive/v${version}.tar.gz";
-    sha256 = "1ja73r6ijklvw34yv0fgflc1ps58xnd559rjnxkqfmi33xjwx7f0";
+    sha256 = "0rfgzamrw89z67jxg8b5jqjmvql00304n0ai4a81bfl90gybyncf";
   };
 
   configurePhase = "scons config";
diff --git a/pkgs/tools/misc/screen/default.nix b/pkgs/tools/misc/screen/default.nix
index 8c132d5ba02fe..de9836422e661 100644
--- a/pkgs/tools/misc/screen/default.nix
+++ b/pkgs/tools/misc/screen/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, ncurses, pam ? null }:
+{ stdenv, fetchurl, fetchpatch, ncurses, utmp, pam ? null }:
 
 stdenv.mkDerivation rec {
   name = "screen-4.3.1";
@@ -13,13 +13,21 @@ stdenv.mkDerivation rec {
     sed -i -e "s|/usr/local|/non-existent|g" -e "s|/usr|/non-existent|g" configure Makefile.in */Makefile.in
   '';
 
-  # TODO: remove when updating the version of screen. Only a patch for 4.3.1
-  patches = stdenv.lib.optional stdenv.isDarwin (fetchurl {
+  # TODO: remove when updating the version of screen. Only patches for 4.3.1
+  patches = [
+    (fetchpatch {
+      name = "CVE-2015-6806.patch";
+      stripLen = 1;
+      url = "http://git.savannah.gnu.org/cgit/screen.git/patch/?id=b7484c224738247b510ed0d268cd577076958f1b";
+      sha256 = "160zhpzi80qkvwib78jdvx4jcm2c2h59q5ap7hgnbz4xbkb3k37l";
+    })
+  ] ++ stdenv.lib.optional stdenv.isDarwin (fetchurl {
     url = "http://savannah.gnu.org/file/screen-utmp.patch\?file_id=34815";
     sha256 = "192dsa8hm1zw8m638avzhwhnrddgizhyrwaxgwa96zr9vwai2nvc";
   });
 
-  buildInputs = [ ncurses ] ++ stdenv.lib.optional stdenv.isLinux pam;
+  buildInputs = [ ncurses ] ++ stdenv.lib.optional stdenv.isLinux pam
+                            ++ stdenv.lib.optional stdenv.isDarwin utmp;
 
   doCheck = true;
 
diff --git a/pkgs/tools/misc/units/default.nix b/pkgs/tools/misc/units/default.nix
index 6a7c3b130bd0b..3fc015c770433 100644
--- a/pkgs/tools/misc/units/default.nix
+++ b/pkgs/tools/misc/units/default.nix
@@ -1,4 +1,5 @@
-{stdenv, fetchurl}:
+{ stdenv, fetchurl, readline }:
+
 stdenv.mkDerivation rec {
   name = "units-${version}";
   version = "2.12";
@@ -8,8 +9,14 @@ stdenv.mkDerivation rec {
     sha256 = "1jxvjknz2jhq773jrwx9gc1df3gfy73yqmkjkygqxzpi318yls3q";
   };
 
-  meta = {
+  buildInputs = [ readline ];
+
+  doCheck = true;
+
+  meta = with stdenv.lib; {
     description = "Unit conversion tool";
-    platforms = stdenv.lib.platforms.linux;
+    homepage = https://www.gnu.org/software/units/;
+    license = [ licenses.gpl3Plus ];
+    platforms = stdenv.lib.platforms.all;
   };
 }
diff --git a/pkgs/tools/misc/vmtouch/default.nix b/pkgs/tools/misc/vmtouch/default.nix
index 767a61c2bb50b..34328b339fc74 100644
--- a/pkgs/tools/misc/vmtouch/default.nix
+++ b/pkgs/tools/misc/vmtouch/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "vmtouch";
-  version = "git-20150310";
-  name = "${pname}-${version}";
+  version = "1.0.2";
+  name = "${pname}-git-${version}";
 
   src = fetchFromGitHub {
     owner = "hoytech";
     repo = "vmtouch";
-    rev = "4e1b106e59942678c1e6e490e2c7ca7df50eb7a3";
-    sha256 = "1m37gvlypyfizd33mfyfha4hhwiyfzsj8gb2h5im6wzis4j15d0y";
+    rev = "vmtouch-${version}";
+    sha256 = "0m4s1am1r3qp8si3rnc8j2qc7sbf1k3gxvxr6fnpbf8fcfhh6cay";
   };
 
   buildInputs = [perl];
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Portable file system cache diagnostics and control";
     longDescription = "vmtouch is a tool for learning about and controlling the file system cache of unix and unix-like systems.";
-    homepage = "http://hoytech.com/vmtouch/vmtouch.html";
+    homepage = "http://hoytech.com/vmtouch/";
     license = stdenv.lib.licenses.bsd3;
     maintainers = [ stdenv.lib.maintainers.garrison ];
     platforms = stdenv.lib.platforms.all;
diff --git a/pkgs/tools/misc/yle-dl/default.nix b/pkgs/tools/misc/yle-dl/default.nix
new file mode 100644
index 0000000000000..c6efac3ffe600
--- /dev/null
+++ b/pkgs/tools/misc/yle-dl/default.nix
@@ -0,0 +1,36 @@
+{ stdenv, fetchFromGitHub, rtmpdump, php, pythonPackages }:
+
+stdenv.mkDerivation rec {
+  name = "yle-dl-${version}";
+  version = "2.9.1";
+
+  src = fetchFromGitHub {
+    owner = "aajanki";
+    repo = "yle-dl";
+    rev = version;
+    sha256 = "1irpcp9iw2cw85sj1kzndmrw8350p9q7cfghjx2xkh2czk9k7whq";
+  };
+
+  patchPhase = ''
+    substituteInPlace yle-dl --replace '/usr/local/share/' "$out/share/"
+
+    # HACK: work around https://github.com/NixOS/nixpkgs/issues/9593
+    substituteInPlace yle-dl --replace '/usr/bin/env python2' '/usr/bin/env python'
+  '';
+
+  buildInputs = [ pythonPackages.wrapPython ];
+  pythonPath = [ rtmpdump php ] ++ (with pythonPackages; [ pycrypto ]);
+
+  installPhase = ''
+    make install prefix=$out
+    wrapPythonPrograms
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Downloads videos from Yle (Finnish Broadcasting Company) servers";
+    homepage = https://aajanki.github.io/yle-dl/;
+    license = licenses.gpl3;
+    maintainers = [ maintainers.dezgeg ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/tools/misc/zsh-navigation-tools/default.nix b/pkgs/tools/misc/zsh-navigation-tools/default.nix
index 8f335d7cf5865..ae4774c0e1235 100644
--- a/pkgs/tools/misc/zsh-navigation-tools/default.nix
+++ b/pkgs/tools/misc/zsh-navigation-tools/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "zsh-navigation-tools-${version}";
-  version = "1.3.2";
+  version = "1.4";
 
   src = fetchFromGitHub {
     owner = "psprint";
     repo = "zsh-navigation-tools";
     rev = "v${version}";
-    sha256 = "1xj1jakcrf0sfkiq6l1drg6vzylhkk0kmhs7nz08dv18pgx9jy36";
+    sha256 = "1r24mpx57jyn201mdhd793rlhlr5r83n9137aafkgf86282ghr7y";
   };
 
   dontBuild = true;
diff --git a/pkgs/tools/networking/autossh/default.nix b/pkgs/tools/networking/autossh/default.nix
index 5addf30c32244..9ff0376c8bcf8 100644
--- a/pkgs/tools/networking/autossh/default.nix
+++ b/pkgs/tools/networking/autossh/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = http://www.harding.motd.ca/autossh/;
     description = "Automatically restart SSH sessions and tunnels";
-    platforms = platforms.linux;
+    platforms = platforms.unix;
     maintainers = with maintainers; [ pSub ];
   };
 }
diff --git a/pkgs/tools/networking/cmst/default.nix b/pkgs/tools/networking/cmst/default.nix
index 3bfa65cb4724d..1b5767653fe29 100644
--- a/pkgs/tools/networking/cmst/default.nix
+++ b/pkgs/tools/networking/cmst/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchgit, qt5, makeWrapper, libX11 }:
+{ stdenv, fetchgit, qtbase, makeWrapper, libX11 }:
 
 stdenv.mkDerivation rec {
   name = "cmst-2014.12.05";
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "070rxv3kyn41ra7nnk1wbqvy6fjg38h7hrdv4dn71b201kmzd194";
   };
 
-  buildInputs = [ qt5.base makeWrapper ];
+  buildInputs = [ qtbase makeWrapper ];
 
   configurePhase = ''
     substituteInPlace ./cmst.pro \
diff --git a/pkgs/tools/networking/corkscrew/default.nix b/pkgs/tools/networking/corkscrew/default.nix
index 96747e82cee90..d66a4890afec9 100644
--- a/pkgs/tools/networking/corkscrew/default.nix
+++ b/pkgs/tools/networking/corkscrew/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl }:
+{ stdenv, fetchurl, automake }:
 
 stdenv.mkDerivation rec {
   name = "corkscrew-2.0";
@@ -8,6 +8,11 @@ stdenv.mkDerivation rec {
     sha256 = "0d0fcbb41cba4a81c4ab494459472086f377f9edb78a2e2238ed19b58956b0be";
   };
 
+  preConfigure = ''
+    ln -sf ${automake}/share/automake-*/config.sub config.sub
+    ln -sf ${automake}/share/automake-*/config.guess config.guess
+  '';
+
   meta = with stdenv.lib; {
     homepage    = http://agroman.net/corkscrew/;
     description = "A tool for tunneling SSH through HTTP proxies";
diff --git a/pkgs/tools/networking/dhcpcd/default.nix b/pkgs/tools/networking/dhcpcd/default.nix
index dfe2de9b96d33..856f75f063335 100644
--- a/pkgs/tools/networking/dhcpcd/default.nix
+++ b/pkgs/tools/networking/dhcpcd/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, pkgconfig, udev }:
 
 stdenv.mkDerivation rec {
-  name = "dhcpcd-6.9.3";
+  name = "dhcpcd-6.9.4";
 
   src = fetchurl {
     url = "mirror://roy/dhcpcd/${name}.tar.xz";
-    sha256 = "0lxfis066ijjlqha2mf49v8mydmnnjb6nijihfn65ylmsqg4g2b0";
+    sha256 = "184vpid8m5175xa2nkh6mmvk8b6z4isfm6nvf4g8l5ggfdsgzwy3";
   };
 
   buildInputs = [ pkgconfig udev ];
diff --git a/pkgs/tools/networking/dnsmasq/default.nix b/pkgs/tools/networking/dnsmasq/default.nix
index 35cd7ae466134..63720faf70786 100644
--- a/pkgs/tools/networking/dnsmasq/default.nix
+++ b/pkgs/tools/networking/dnsmasq/default.nix
@@ -3,10 +3,10 @@
 with stdenv.lib;
 let
   copts = concatStringsSep " " ([
-    "-DHAVE_DBUS"
     "-DHAVE_IDN"
     "-DHAVE_DNSSEC"
   ] ++ optionals stdenv.isLinux [
+    "-DHAVE_DBUS"
     "-DHAVE_CONNTRACK"
   ]);
 in
@@ -29,13 +29,16 @@ stdenv.mkDerivation rec {
     "LOCALEDIR=$(out)/share/locale"
   ];
 
-  postBuild = ''
+  postBuild = optionalString stdenv.isLinux ''
     make -C contrib/wrt
   '';
 
+  # XXX: Does the systemd service definition really belong here when our NixOS
+  # module can create it in Nix-land?
   postInstall = ''
-    install -Dm644 dbus/dnsmasq.conf $out/etc/dbus-1/system.d/dnsmasq.conf
     install -Dm644 trust-anchors.conf $out/share/dnsmasq/trust-anchors.conf
+  '' + optionalString stdenv.isLinux ''
+    install -Dm644 dbus/dnsmasq.conf $out/etc/dbus-1/system.d/dnsmasq.conf
     install -Dm755 contrib/wrt/dhcp_lease_time $out/bin/dhcp_lease_time
     install -Dm755 contrib/wrt/dhcp_release $out/bin/dhcp_release
 
@@ -50,8 +53,8 @@ stdenv.mkDerivation rec {
   '';
 
   nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ dbus_libs nettle libidn ]
-    ++ optional stdenv.isLinux libnetfilter_conntrack;
+  buildInputs = [ nettle libidn ]
+    ++ optionals stdenv.isLinux [ dbus_libs libnetfilter_conntrack ];
 
   meta = {
     description = "An integrated DNS, DHCP and TFTP server for small networks";
diff --git a/pkgs/tools/networking/i2pd/default.nix b/pkgs/tools/networking/i2pd/default.nix
index 4007ec4add19d..a11f0347ce56c 100644
--- a/pkgs/tools/networking/i2pd/default.nix
+++ b/pkgs/tools/networking/i2pd/default.nix
@@ -4,24 +4,20 @@ stdenv.mkDerivation rec {
 
   name = pname + "-" + version;
   pname = "i2pd";
-  version = "2.1.0";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "PurpleI2P";
     repo = pname;
     rev = version;
-    sha256 = "06y6pi0wlxpasncm4qq30sh0cavwl2f4gdz0hss70if8mr6z9hyq";
+    sha256 = "0slrfmgrf9b689wpsdpvsnmhbqsygcy558dz259k6xcf50f7lfqh";
   };
 
   buildInputs = [ boost zlib openssl ];
   makeFlags = "USE_AESNI=no";
-  patches = [ (fetchpatch {
-    url = https://github.com/PurpleI2P/i2pd/commit/4109ab1590791f3c1bf4e9eceec2d43be7b5ea47.patch;
-    sha256 = "17zg9iah59icy8nn1nwfnsnbzpafgrsasz1pmb2q4iywb7wbnkzi";
-  }) ];
 
   installPhase = ''
-    install -D i2p $out/bin/i2pd
+    install -D i2pd $out/bin/i2pd
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/networking/miniupnpd/default.nix b/pkgs/tools/networking/miniupnpd/default.nix
index 0d852573eab80..91306b4ae6daa 100644
--- a/pkgs/tools/networking/miniupnpd/default.nix
+++ b/pkgs/tools/networking/miniupnpd/default.nix
@@ -3,11 +3,11 @@
 assert stdenv.isLinux;
 
 stdenv.mkDerivation rec {
-  name = "miniupnpd-1.9.20150721";
+  name = "miniupnpd-1.9.20151212";
 
   src = fetchurl {
     url = "http://miniupnp.free.fr/files/download.php?file=${name}.tar.gz";
-    sha256 = "0w2422wfcir333qd300swkdvmksdfdllspplnz8vbv13a1724h4k";
+    sha256 = "1ay7dw1y5fqgjrqa9s8av8ndmw7wkjm39xnnzzw8pxbv70d6b12j";
     name = "${name}.tar.gz";
   };
 
diff --git a/pkgs/tools/networking/network-manager/default.nix b/pkgs/tools/networking/network-manager/default.nix
index 464461194daaf..538777ae11a99 100644
--- a/pkgs/tools/networking/network-manager/default.nix
+++ b/pkgs/tools/networking/network-manager/default.nix
@@ -1,7 +1,8 @@
 { stdenv, fetchurl, intltool, wirelesstools, pkgconfig, dbus_glib, xz
 , systemd, libgudev, libnl, libuuid, polkit, gnutls, ppp, dhcp, dhcpcd, iptables
 , libgcrypt, dnsmasq, avahi, bind, perl, bluez5, substituteAll, readline
-, gobjectIntrospection, modemmanager, openresolv, libndp, newt, libsoup }:
+, gobjectIntrospection, modemmanager, openresolv, libndp, newt, libsoup
+, ethtool, gnused }:
 
 stdenv.mkDerivation rec {
   name = "network-manager-${version}";
@@ -16,6 +17,10 @@ stdenv.mkDerivation rec {
     substituteInPlace tools/glib-mkenums --replace /usr/bin/perl ${perl}/bin/perl
     substituteInPlace src/ppp-manager/nm-ppp-manager.c --replace /sbin/modprobe /run/current-system/sw/sbin/modprobe
     substituteInPlace src/devices/nm-device.c --replace /sbin/modprobe /run/current-system/sw/sbin/modprobe
+    substituteInPlace data/85-nm-unmanaged.rules \
+      --replace /bin/sh ${stdenv.shell} \
+      --replace /usr/sbin/ethtool ${ethtool}/sbin/ethtool \
+      --replace /bin/sed ${gnused}/bin/sed
     configureFlags="$configureFlags --with-udev-dir=$out/lib/udev"
   '';
 
diff --git a/pkgs/tools/networking/nzbget/default.nix b/pkgs/tools/networking/nzbget/default.nix
index 733e12d1e9b1e..78ef6998e3a15 100644
--- a/pkgs/tools/networking/nzbget/default.nix
+++ b/pkgs/tools/networking/nzbget/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   name = "nzbget-${version}";
-  version = "16.3";
+  version = "16.4";
 
   src = fetchurl {
     url = "http://github.com/nzbget/nzbget/releases/download/v${version}/${name}-src.tar.gz";
-    sha256 = "03xzrvgqh90wx183sjrcyn7yilip92g2x5wffnw956ywxb3nsy2g";
+    sha256 = "03sdzxxsjpxp82jpk593xls96yk29989z05j73jah21dbpkkx7lf";
   };
 
   buildInputs = [ pkgconfig libxml2 ncurses libsigcxx libpar2 gnutls
diff --git a/pkgs/tools/networking/openssh/default.nix b/pkgs/tools/networking/openssh/default.nix
index 2004e453a0d95..67bf5be7d5b73 100644
--- a/pkgs/tools/networking/openssh/default.nix
+++ b/pkgs/tools/networking/openssh/default.nix
@@ -39,6 +39,7 @@ stdenv.mkDerivation rec {
   # properly when cross building.
   configureFlags = [
     "--localstatedir=/var"
+    "--with-pid-dir=/run"
     "--with-mantype=man"
     "--with-libedit=yes"
     "--disable-strip"
@@ -61,6 +62,7 @@ stdenv.mkDerivation rec {
     cp contrib/ssh-copy-id.1 $out/share/man/man1/
   '';
 
+  installTargets = [ "install-nokeys" ];
   installFlags = [
     "sysconfdir=\${out}/etc/ssh"
   ];
diff --git a/pkgs/tools/networking/p2p/tahoe-lafs/default.nix b/pkgs/tools/networking/p2p/tahoe-lafs/default.nix
index 836f3e1e60ca7..1f935c2f83b04 100644
--- a/pkgs/tools/networking/p2p/tahoe-lafs/default.nix
+++ b/pkgs/tools/networking/p2p/tahoe-lafs/default.nix
@@ -32,12 +32,12 @@ buildPythonPackage rec {
   '';
 
   # Some tests want this + http://tahoe-lafs.org/source/tahoe-lafs/deps/tahoe-dep-sdists/mock-0.6.0.tar.bz2
-  buildInputs = [ unzip numpy mock ];
+  buildInputs = [ unzip numpy ];
 
   # The `backup' command requires `sqlite3'.
   propagatedBuildInputs =
     [ twisted foolscap nevow simplejson zfec pycryptopp sqlite3
-      darcsver setuptoolsTrial setuptoolsDarcs pycrypto pyasn1 zope_interface
+      darcsver setuptoolsTrial setuptoolsDarcs pycrypto pyasn1 zope_interface mock
     ];
 
   postInstall = ''
diff --git a/pkgs/tools/networking/redir/default.nix b/pkgs/tools/networking/redir/default.nix
new file mode 100644
index 0000000000000..1fcb73e00dc46
--- /dev/null
+++ b/pkgs/tools/networking/redir/default.nix
@@ -0,0 +1,23 @@
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  name = "redir-2.2.1";
+
+  src = fetchurl {
+    url = "http://sammy.net/~sammy/hacks/${name}.tar.gz";
+    sha256 = "0v0f14br00rrmd1ss644adsby4gm29sn7a2ccy7l93ik6pw099by";
+  };
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp redir $out/bin
+  '';
+
+  meta = {
+    description = "A port redirector";
+    homepage = http://sammy.net/~sammy/hacks/;
+    license = stdenv.lib.licenses.gpl2;
+    maintainers = with stdenv.lib.maintainers; [ globin ];
+    platforms = stdenv.lib.platforms.linux;
+  };
+}
diff --git a/pkgs/tools/networking/socat/2.x.nix b/pkgs/tools/networking/socat/2.x.nix
index 2d4438b5759d4..a1cea03483679 100644
--- a/pkgs/tools/networking/socat/2.x.nix
+++ b/pkgs/tools/networking/socat/2.x.nix
@@ -12,12 +12,14 @@ stdenv.mkDerivation rec {
 
   configureFlags = stdenv.lib.optionalString stdenv.isDarwin "--disable-ip6";
 
-  meta = {
+  patches = stdenv.lib.singleton ./libressl-fixes.patch ;
+
+  meta = with stdenv.lib; {
     description = "A utility for bidirectional data transfer between two independent data channels";
     homepage = http://www.dest-unreach.org/socat/;
     repositories.git = git://repo.or.cz/socat.git;
-    platforms = stdenv.lib.platforms.unix;
-    license = stdenv.lib.licenses.gpl2;
-    maintainers = [ stdenv.lib.maintainers.eelco ];
+    platforms = platforms.unix;
+    license = licenses.gpl2;
+    maintainers = [ maintainers.eelco ];
   };
 }
diff --git a/pkgs/tools/networking/socat/default.nix b/pkgs/tools/networking/socat/default.nix
index 65d3b01e89cf7..c672801262bed 100644
--- a/pkgs/tools/networking/socat/default.nix
+++ b/pkgs/tools/networking/socat/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ openssl ];
 
-  patches = [ ./enable-ecdhe.patch ];
+  patches = [ ./enable-ecdhe.patch ./libressl-fixes.patch ];
 
   meta = {
     description = "A utility for bidirectional data transfer between two independent data channels";
diff --git a/pkgs/tools/networking/socat/libressl-fixes.patch b/pkgs/tools/networking/socat/libressl-fixes.patch
new file mode 100644
index 0000000000000..cf66033584eb6
--- /dev/null
+++ b/pkgs/tools/networking/socat/libressl-fixes.patch
@@ -0,0 +1,173 @@
+Patch from OpenBSD
+--- a/sslcls.c	Sat Jan 24 03:15:22 2015
++++ b/sslcls.c	Sat Jul 18 20:01:59 2015
+@@ -55,6 +55,7 @@ const SSL_METHOD *sycSSLv2_server_method(void) {
+ }
+ #endif
+ 
++#ifdef HAVE_SSLv3_client_method
+ const SSL_METHOD *sycSSLv3_client_method(void) {
+    const SSL_METHOD *result;
+    Debug("SSLv3_client_method()");
+@@ -62,7 +63,9 @@ const SSL_METHOD *sycSSLv3_client_method(void) {
+    Debug1("SSLv3_client_method() -> %p", result);
+    return result;
+ }
++#endif
+ 
++#ifdef HAVE_SSLv3_server_method
+ const SSL_METHOD *sycSSLv3_server_method(void) {
+    const SSL_METHOD *result;
+    Debug("SSLv3_server_method()");
+@@ -70,6 +73,7 @@ const SSL_METHOD *sycSSLv3_server_method(void) {
+    Debug1("SSLv3_server_method() -> %p", result);
+    return result;
+ }
++#endif
+ 
+ const SSL_METHOD *sycSSLv23_client_method(void) {
+    const SSL_METHOD *result;
+@@ -331,14 +335,6 @@ void sycSSL_free(SSL *ssl) {
+    return;
+ }
+ 
+-int sycRAND_egd(const char *path) {
+-   int result;
+-   Debug1("RAND_egd(\"%s\")", path);
+-   result = RAND_egd(path);
+-   Debug1("RAND_egd() -> %d", result);
+-   return result;
+-}
+-
+ DH *sycPEM_read_bio_DHparams(BIO *bp, DH **x, pem_password_cb *cb, void *u) {
+    DH *result;
+    Debug4("PEM_read_bio_DHparams(%p, %p, %p, %p)",
+@@ -375,7 +371,7 @@ int sycFIPS_mode_set(int onoff) {
+ }
+ #endif /* WITH_FIPS */
+ 
+-#if OPENSSL_VERSION_NUMBER >= 0x00908000L
++#if (OPENSSL_VERSION_NUMBER >= 0x00908000L) && !defined(OPENSSL_NO_COMP)
+ const COMP_METHOD *sycSSL_get_current_compression(SSL *ssl) {
+    const COMP_METHOD *result;
+    Debug1("SSL_get_current_compression(%p)", ssl);
+--- a/sslcls.h	Sat Jan 24 11:15:22 2015
++++ b/sslcls.h	Mon Apr 13 15:06:25 2015
+@@ -47,7 +47,6 @@ X509 *sycSSL_get_peer_certificate(SSL *ssl);
+ int sycSSL_shutdown(SSL *ssl);
+ void sycSSL_CTX_free(SSL_CTX *ctx);
+ void sycSSL_free(SSL *ssl);
+-int sycRAND_egd(const char *path);
+ 
+ DH *sycPEM_read_bio_DHparams(BIO *bp, DH **x, pem_password_cb *cb, void *u);
+ 
+@@ -55,7 +54,7 @@ BIO *sycBIO_new_file(const char *filename, const char 
+ 
+ int sycFIPS_mode_set(int onoff);
+ 
+-#if OPENSSL_VERSION_NUMBER >= 0x00908000L
++#if (OPENSSL_VERSION_NUMBER >= 0x00908000L) && !defined(OPENSSL_NO_COMP)
+ const COMP_METHOD *sycSSL_get_current_compression(SSL *ssl);
+ const COMP_METHOD *sycSSL_get_current_expansion(SSL *ssl);
+ const char *sycSSL_COMP_get_name(const COMP_METHOD *comp);
+@@ -98,7 +97,6 @@ const char *sycSSL_COMP_get_name(const COMP_METHOD *co
+ #define sycSSL_shutdown(s) SSL_shutdown(s)
+ #define sycSSL_CTX_free(c) SSL_CTX_free(c)
+ #define sycSSL_free(s) SSL_free(s)
+-#define sycRAND_egd(p) RAND_egd(p)
+ 
+ #define sycPEM_read_bio_DHparams(b,x,p,u) PEM_read_bio_DHparams(b,x,p,u)
+ 
+--- a/xio-openssl.c	Sat Jan 24 15:33:42 2015
++++ b/xio-openssl.c	Mon Apr 13 14:59:12 2015
+@@ -108,7 +108,6 @@ const struct optdesc opt_openssl_key         = { "open
+ const struct optdesc opt_openssl_dhparam     = { "openssl-dhparam",     "dh",    OPT_OPENSSL_DHPARAM,     GROUP_OPENSSL, PH_SPEC, TYPE_FILENAME, OFUNC_SPEC };
+ const struct optdesc opt_openssl_cafile      = { "openssl-cafile",     "cafile", OPT_OPENSSL_CAFILE,      GROUP_OPENSSL, PH_SPEC, TYPE_FILENAME, OFUNC_SPEC };
+ const struct optdesc opt_openssl_capath      = { "openssl-capath",     "capath", OPT_OPENSSL_CAPATH,      GROUP_OPENSSL, PH_SPEC, TYPE_FILENAME, OFUNC_SPEC };
+-const struct optdesc opt_openssl_egd         = { "openssl-egd",        "egd",    OPT_OPENSSL_EGD,         GROUP_OPENSSL, PH_SPEC, TYPE_FILENAME, OFUNC_SPEC };
+ const struct optdesc opt_openssl_pseudo      = { "openssl-pseudo",     "pseudo", OPT_OPENSSL_PSEUDO,      GROUP_OPENSSL, PH_SPEC, TYPE_BOOL,     OFUNC_SPEC };
+ #if OPENSSL_VERSION_NUMBER >= 0x00908000L
+ const struct optdesc opt_openssl_compress    = { "openssl-compress",   "compress", OPT_OPENSSL_COMPRESS,  GROUP_OPENSSL, PH_SPEC, TYPE_STRING,   OFUNC_SPEC };
+@@ -147,7 +146,7 @@ int xio_reset_fips_mode(void) {
+ static void openssl_conn_loginfo(SSL *ssl) {
+    Notice1("SSL connection using %s", SSL_get_cipher(ssl));
+ 
+-#if OPENSSL_VERSION_NUMBER >= 0x00908000L
++#if (OPENSSL_VERSION_NUMBER >= 0x00908000L) && !defined(OPENSSL_NO_COMP)
+    {
+       const COMP_METHOD *comp, *expansion;
+ 
+@@ -722,7 +721,6 @@ int
+    char *opt_dhparam = NULL;	/* file name of DH params */
+    char *opt_cafile = NULL;	/* certificate authority file */
+    char *opt_capath = NULL;	/* certificate authority directory */
+-   char *opt_egd = NULL;	/* entropy gathering daemon socket path */
+ #if OPENSSL_VERSION_NUMBER >= 0x00908000L
+    char *opt_compress = NULL;	/* compression method */
+ #endif
+@@ -741,7 +739,6 @@ int
+    retropt_string(opts, OPT_OPENSSL_CAPATH, &opt_capath);
+    retropt_string(opts, OPT_OPENSSL_KEY, &opt_key);
+    retropt_string(opts, OPT_OPENSSL_DHPARAM, &opt_dhparam);
+-   retropt_string(opts, OPT_OPENSSL_EGD, &opt_egd);
+    retropt_bool(opts,OPT_OPENSSL_PSEUDO, &opt_pseudo);
+ #if OPENSSL_VERSION_NUMBER >= 0x00908000L
+    retropt_string(opts, OPT_OPENSSL_COMPRESS, &opt_compress);
+@@ -877,10 +874,6 @@ int
+       }
+    }
+ 
+-   if (opt_egd) {
+-      sycRAND_egd(opt_egd);
+-   }
+-
+    if (opt_pseudo) {
+       long int randdata;
+       /* initialize libc random from actual microseconds */
+@@ -1098,7 +1091,7 @@ static int openssl_SSL_ERROR_SSL(int level, const char
+       if (e == ((ERR_LIB_RAND<<24)|
+ 		(RAND_F_SSLEAY_RAND_BYTES<<12)|
+ 		(RAND_R_PRNG_NOT_SEEDED)) /*0x24064064*/) {
+-	 Error("too few entropy; use options \"egd\" or \"pseudo\"");
++	 Error("too few entropy; use option \"pseudo\"");
+ 	 stat = STAT_NORETRY;
+       } else {
+ 	 Msg2(level, "%s(): %s", funcname, ERR_error_string(e, buf));
+--- a/xio-openssl.h	Sun Jun 23 07:16:48 2013
++++ b/xio-openssl.h	Sat Apr 19 15:58:21 2014
+@@ -21,7 +21,6 @@ extern const struct optdesc opt_openssl_key;
+ extern const struct optdesc opt_openssl_dhparam;
+ extern const struct optdesc opt_openssl_cafile;
+ extern const struct optdesc opt_openssl_capath;
+-extern const struct optdesc opt_openssl_egd;
+ extern const struct optdesc opt_openssl_pseudo;
+ #if OPENSSL_VERSION_NUMBER >= 0x00908000L
+ extern const struct optdesc opt_openssl_compress;
+--- a/xioopts.c	Sat Jan 24 11:15:22 2015
++++ b/xioopts.c	Mon Apr 13 15:06:25 2015
+@@ -412,7 +412,6 @@ const struct optname optionnames[] = {
+ #ifdef ECHOPRT
+ 	IF_TERMIOS("echoprt",	&opt_echoprt)
+ #endif
+-	IF_OPENSSL("egd",	&opt_openssl_egd)
+ 	IF_ANY    ("end-close",	&opt_end_close)
+ 	IF_TERMIOS("eof",	&opt_veof)
+ 	IF_TERMIOS("eol",	&opt_veol)
+@@ -1102,7 +1101,6 @@ const struct optname optionnames[] = {
+ 	IF_OPENSSL("openssl-compress",	&opt_openssl_compress)
+ #endif
+ 	IF_OPENSSL("openssl-dhparam",	&opt_openssl_dhparam)
+-	IF_OPENSSL("openssl-egd",	&opt_openssl_egd)
+ #if WITH_FIPS
+ 	IF_OPENSSL("openssl-fips",	&opt_openssl_fips)
+ #endif
+--- a/xioopts.h	Sat Jan 24 11:15:22 2015
++++ b/xioopts.h	Mon Apr 13 15:06:25 2015
+@@ -478,7 +478,6 @@ enum e_optcode {
+    OPT_OPENSSL_COMPRESS,
+ #endif
+    OPT_OPENSSL_DHPARAM,
+-   OPT_OPENSSL_EGD,
+    OPT_OPENSSL_FIPS,
+    OPT_OPENSSL_KEY,
+    OPT_OPENSSL_METHOD,
diff --git a/pkgs/tools/networking/wget/default.nix b/pkgs/tools/networking/wget/default.nix
index 941acbc016ff8..b9e8a5f4a75de 100644
--- a/pkgs/tools/networking/wget/default.nix
+++ b/pkgs/tools/networking/wget/default.nix
@@ -3,11 +3,11 @@
 , libiconv, libpsl, openssl ? null }:
 
 stdenv.mkDerivation rec {
-  name = "wget-1.17";
+  name = "wget-1.17.1";
 
   src = fetchurl {
     url = "mirror://gnu/wget/${name}.tar.xz";
-    sha256 = "11xvs919a8xr595hs6hk323rkk7yshyfdfyfdhlahagkrcxdcsdx";
+    sha256 = "1jcpvl5sxb2ag8yahpy370c5jlfb097a21k2mhsidh4wxdhrnmgy";
   };
 
   patches = [ ./remove-runtime-dep-on-openssl-headers.patch ];
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index 9006785c3fcc5..0bbb70bef116d 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -97,10 +97,10 @@ in rec {
    };
 
    nixUnstable = lib.lowPrio (common rec {
-     name = "nix-1.11pre4334_7431932";
+     name = "nix-1.11pre4345_b8258a4";
      src = fetchurl {
-       url = "http://hydra.nixos.org/build/28747184/download/4/${name}.tar.xz";
-       sha256 = "ccb0c5be03b9af1bf89e79758868b0cd62c79fd7a0f0791cdb99df86e4240fc4";
+       url = "http://hydra.nixos.org/build/29615957/download/4/${name}.tar.xz";
+       sha256 = "06944da78e46d8f2cbeeb02c1ab3127a06935e984bcf7a972041c7d91814f0f2";
      };
    });
 
diff --git a/pkgs/tools/package-management/nixops/default.nix b/pkgs/tools/package-management/nixops/default.nix
index 12e1989525d9a..4388cbc5b3da6 100644
--- a/pkgs/tools/package-management/nixops/default.nix
+++ b/pkgs/tools/package-management/nixops/default.nix
@@ -1,43 +1,9 @@
-{ lib, pythonPackages, fetchurl, libxslt, docbook5_xsl, openssh }:
-
-pythonPackages.buildPythonPackage rec {
-  name = "nixops-1.3";
-  namePrefix = "";
+{ callPackage, fetchurl }:
 
+callPackage ./generic.nix (rec {
+  version = "1.3";
   src = fetchurl {
-    url = "http://nixos.org/releases/nixops/${name}/${name}.tar.bz2";
+    url = "http://nixos.org/releases/nixops/nixops/nixops-${version}.tar.bz2";
     sha256 = "d80b0fe3bb31bb84a8545f9ea804ec8137172c8df44f03326ed7639e5a4bad55";
   };
-
-  buildInputs = [ libxslt ];
-
-  pythonPath =
-    [ pythonPackages.prettytable
-      pythonPackages.boto
-      pythonPackages.sqlite3
-      pythonPackages.hetzner
-      pythonPackages.libcloud
-    ];
-
-  doCheck = false;
-
-  postInstall =
-    ''
-      make -C doc/manual install nixops.1 docbookxsl=${docbook5_xsl}/xml/xsl/docbook \
-        docdir=$out/share/doc/nixops mandir=$out/share/man
-
-      mkdir -p $out/share/nix/nixops
-      cp -av "nix/"* $out/share/nix/nixops
-
-      # Add openssh to nixops' PATH. On some platforms, e.g. CentOS and RHEL
-      # the version of openssh is causing errors when have big networks (40+)
-      wrapProgram $out/bin/nixops --prefix PATH : "${openssh}/bin"
-    '';
-
-  meta = {
-    homepage = https://github.com/NixOS/nixops;
-    description = "NixOS cloud provisioning and deployment tool";
-    maintainers = [ lib.maintainers.eelco lib.maintainers.rob ];
-    platforms = lib.platforms.unix;
-  };
-}
+})
diff --git a/pkgs/tools/package-management/nixops/generic.nix b/pkgs/tools/package-management/nixops/generic.nix
new file mode 100644
index 0000000000000..b9b9eee8d1604
--- /dev/null
+++ b/pkgs/tools/package-management/nixops/generic.nix
@@ -0,0 +1,43 @@
+{ lib, pythonPackages, fetchurl, libxslt, docbook5_xsl, openssh
+# version args
+, src, version
+}:
+
+pythonPackages.buildPythonPackage {
+  name = "nixops-${version}";
+  namePrefix = "";
+
+  src = src;
+
+  buildInputs = [ libxslt ];
+
+  pythonPath =
+    [ pythonPackages.prettytable
+      pythonPackages.boto
+      pythonPackages.sqlite3
+      pythonPackages.hetzner
+      pythonPackages.libcloud
+    ];
+
+  doCheck = false;
+
+  postInstall =
+    ''
+      make -C doc/manual install nixops.1 docbookxsl=${docbook5_xsl}/xml/xsl/docbook \
+        docdir=$out/share/doc/nixops mandir=$out/share/man
+
+      mkdir -p $out/share/nix/nixops
+      cp -av "nix/"* $out/share/nix/nixops
+
+      # Add openssh to nixops' PATH. On some platforms, e.g. CentOS and RHEL
+      # the version of openssh is causing errors when have big networks (40+)
+      wrapProgram $out/bin/nixops --prefix PATH : "${openssh}/bin"
+    '';
+
+  meta = {
+    homepage = https://github.com/NixOS/nixops;
+    description = "NixOS cloud provisioning and deployment tool";
+    maintainers = [ lib.maintainers.eelco lib.maintainers.rob ];
+    platforms = lib.platforms.unix;
+  };
+}
diff --git a/pkgs/tools/package-management/nixops/unstable.nix b/pkgs/tools/package-management/nixops/unstable.nix
new file mode 100644
index 0000000000000..40d56518b3dce
--- /dev/null
+++ b/pkgs/tools/package-management/nixops/unstable.nix
@@ -0,0 +1,9 @@
+{ callPackage, fetchurl }:
+
+callPackage ./generic.nix (rec {
+  version = "2015-12-18";
+  src = fetchurl {
+    url = "http://hydra.nixos.org/build/29118371/download/2/nixops-1.3.1pre1673_a0d5681.tar.bz2";
+    sha256 = "177lnlfz32crcc0gjmh1gn5y2xs142kmb4b68k4raxcxxw118kw9";
+  };
+})
diff --git a/pkgs/tools/package-management/rpm/default.nix b/pkgs/tools/package-management/rpm/default.nix
index 0397723a2252d..24346fb0eb70a 100644
--- a/pkgs/tools/package-management/rpm/default.nix
+++ b/pkgs/tools/package-management/rpm/default.nix
@@ -16,6 +16,11 @@ stdenv.mkDerivation rec {
 
   NIX_CFLAGS_LINK = "-L${elfutils}/lib";
 
+  postPatch = ''
+    # For Python3, the original expression evaluates as 'python3.4' but we want 'python3.4m' here
+    substituteInPlace configure --replace 'python''${PYTHON_VERSION}' ${python.executable}
+  '';
+
   configureFlags = "--with-external-db --without-lua --enable-python";
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/security/eid-mw/default.nix b/pkgs/tools/security/eid-mw/default.nix
index 7823a9e0307a5..eba1bef18704e 100644
--- a/pkgs/tools/security/eid-mw/default.nix
+++ b/pkgs/tools/security/eid-mw/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchFromGitHub, autoreconfHook, gtk3, nssTools, pcsclite
 , pkgconfig }:
 
-let version = "4.1.9"; in
+let version = "4.1.11"; in
 stdenv.mkDerivation {
   name = "eid-mw-${version}";
 
   src = fetchFromGitHub {
-    sha256 = "03hf3bkawhr4kpjcv71xhja3d947qvxmjf0lkyjmv7i3fw3j8jqs";
+    sha256 = "09rp4x1vg0j4rb2dl74f8a7szqx73saacjz09jkih1sz6vwi0j0w";
     rev = "v${version}";
     repo = "eid-mw";
     owner = "Fedict";
diff --git a/pkgs/tools/security/eid-viewer/default.nix b/pkgs/tools/security/eid-viewer/default.nix
index c96632537615f..ac6dee4beaa35 100644
--- a/pkgs/tools/security/eid-viewer/default.nix
+++ b/pkgs/tools/security/eid-viewer/default.nix
@@ -1,16 +1,12 @@
-{ stdenv, fetchurl, jre, makeWrapper, pcsclite }:
-
-let
-  # TODO: find out what the version components actually mean, if anything:
-  major = "4.1.4-v4.1.4";
-  minor = "tcm406-270732";
-  version = "${major}-${minor}";
-in stdenv.mkDerivation rec {
+{ stdenv, fetchurl, makeWrapper, jre, pcsclite }:
+
+let version = "4.1.9"; in
+stdenv.mkDerivation rec {
   name = "eid-viewer-${version}";
 
   src = fetchurl {
-    url = "http://eid.belgium.be/en/binaries/eid-viewer-${major}.src.tar_${minor}.gz";
-    sha256 = "06kda45y7c3wvvqby153zcasgz4jibjypv8gvfwvrwvn4ag2z934";
+    url = "https://downloads.services.belgium.be/eid/eid-viewer-${version}-v${version}.src.tar.gz";
+    sha256 = "0bq9jl4kl97j0dfhz4crcb1wqhn420z5vpg510zadvrmqjhy1x4g";
   };
 
   buildInputs = [ jre pcsclite ];
diff --git a/pkgs/tools/security/fail2ban/default.nix b/pkgs/tools/security/fail2ban/default.nix
index 184f8a59d28c8..667157978a38d 100644
--- a/pkgs/tools/security/fail2ban/default.nix
+++ b/pkgs/tools/security/fail2ban/default.nix
@@ -1,6 +1,6 @@
-{ stdenv, fetchzip, python, pythonPackages, unzip, systemd, gamin }:
+{ stdenv, fetchzip, python, pythonPackages, unzip, gamin }:
 
-let version = "0.9.1"; in
+let version = "0.9.3"; in
 
 pythonPackages.buildPythonPackage {
   name = "fail2ban-${version}";
@@ -9,23 +9,15 @@ pythonPackages.buildPythonPackage {
   src = fetchzip {
     name   = "fail2ban-${version}-src";
     url    = "https://github.com/fail2ban/fail2ban/archive/${version}.tar.gz";
-    sha256 = "111xvy2gxwn868kn0zy2fmdfa423z6fk57i7wsfrc0l74p1cdvs5";
+    sha256 = "1pwgr56i6l6wh2ap8b5vknxgsscfzjqy2nmd1c3vzdii5kf72j0f";
   };
 
   buildInputs = [ unzip ];
 
-  pythonPath = (stdenv.lib.optional stdenv.isLinux systemd)
-    ++ [ python.modules.sqlite3 gamin ];
+  propagatedBuildInputs = [ python.modules.sqlite3 gamin ]
+    ++ (stdenv.lib.optional stdenv.isLinux pythonPackages.systemd);
 
   preConfigure = ''
-    substituteInPlace setup.cfg \
-      --replace /usr $out
-
-    substituteInPlace setup.py \
-      --replace /usr $out \
-      --replace /etc $out/etc \
-      --replace /var $TMPDIR/var \
-
     for i in fail2ban-client fail2ban-regex fail2ban-server; do
       substituteInPlace $i \
         --replace /usr/share/fail2ban $out/share/fail2ban
@@ -40,6 +32,18 @@ pythonPackages.buildPythonPackage {
 
   doCheck = false;
 
+  preInstall = ''
+    # see https://github.com/NixOS/nixpkgs/issues/4968
+    ${python}/bin/${python.executable} setup.py install_data --install-dir=$out --root=$out
+  '';
+
+  postInstall = let
+    sitePackages = "$out/lib/${python.libPrefix}/site-packages";
+  in ''
+    # see https://github.com/NixOS/nixpkgs/issues/4968
+    rm -rf ${sitePackages}/etc ${sitePackages}/usr ${sitePackages}/var;
+  '';
+
   meta = with stdenv.lib; {
     homepage    = http://www.fail2ban.org/;
     description = "A program that scans log files for repeated failing login attempts and bans IP addresses";
diff --git a/pkgs/tools/security/gnupg/1.nix b/pkgs/tools/security/gnupg/1.nix
index d5045806e0c91..8593fe69733ac 100644
--- a/pkgs/tools/security/gnupg/1.nix
+++ b/pkgs/tools/security/gnupg/1.nix
@@ -1,15 +1,13 @@
 { stdenv, fetchurl, readline, bzip2 }:
 
 stdenv.mkDerivation rec {
-  name = "gnupg-1.4.19";
+  name = "gnupg-1.4.20";
 
   src = fetchurl {
     url = "mirror://gnupg/gnupg/${name}.tar.bz2";
-    sha256 = "7f09319d044b0f6ee71fe3587bb873be701723ac0952cff5069046a78de8fd86";
+    sha256 = "1k7d6zi0zznqsmcjic0yrgfhqklqz3qgd3yac7wxsa7s6088p604";
   };
 
-  patches = [ ./remove-debug-message.patch ];
-
   buildInputs = [ readline bzip2 ];
 
   doCheck = true;
diff --git a/pkgs/tools/security/gnupg/20.nix b/pkgs/tools/security/gnupg/20.nix
index 36c877620f19d..117fc41c1abea 100644
--- a/pkgs/tools/security/gnupg/20.nix
+++ b/pkgs/tools/security/gnupg/20.nix
@@ -23,7 +23,9 @@ stdenv.mkDerivation rec {
     = [ readline zlib libgpgerror libgcrypt libassuan libksba pth
         openldap bzip2 libusb curl libiconv ];
 
-  patchPhase = ''
+  patches = [ ./gpgkey2ssh-20.patch ];
+
+  prePatch = ''
     find tests -type f | xargs sed -e 's@/bin/pwd@${coreutils}&@g' -i
   '' + stdenv.lib.optionalString stdenv.isLinux ''
     sed -i 's,"libpcsclite\.so[^"]*","${pcsclite}/lib/libpcsclite.so",g' scd/scdaemon.c
@@ -35,6 +37,8 @@ stdenv.mkDerivation rec {
 
   configureFlags = optional x11Support "--with-pinentry-pgm=${pinentry}/bin/pinentry";
 
+  postConfigure = "substituteAllInPlace tools/gpgkey2ssh.c";
+
   checkPhase="GNUPGHOME=`pwd` ./agent/gpg-agent --daemon make check";
 
   doCheck = true;
diff --git a/pkgs/tools/security/gnupg/21.nix b/pkgs/tools/security/gnupg/21.nix
index 9390207e14ade..bafcd88f1b90c 100644
--- a/pkgs/tools/security/gnupg/21.nix
+++ b/pkgs/tools/security/gnupg/21.nix
@@ -20,10 +20,14 @@ stdenv.mkDerivation rec {
     sha256 = "1ybcsazjm21i2ys1wh49cz4azmqz7ghx5rb6hm4gm93i2zc5igck";
   };
 
+  patches = [ ./gpgkey2ssh-21.patch ];
+
   postPatch = stdenv.lib.optionalString stdenv.isLinux ''
     sed -i 's,"libpcsclite\.so[^"]*","${pcsclite}/lib/libpcsclite.so",g' scd/scdaemon.c
   ''; #" fix Emacs syntax highlighting :-(
 
+  postConfigure = "substituteAllInPlace tools/gpgkey2ssh.c";
+
   buildInputs = [
     pkgconfig libgcrypt libassuan libksba libiconv npth
     autoreconfHook gettext texinfo
diff --git a/pkgs/tools/security/gnupg/gpgkey2ssh-20.patch b/pkgs/tools/security/gnupg/gpgkey2ssh-20.patch
new file mode 100644
index 0000000000000..b536a4fe50e3a
--- /dev/null
+++ b/pkgs/tools/security/gnupg/gpgkey2ssh-20.patch
@@ -0,0 +1,14 @@
+diff --git a/tools/gpgkey2ssh.c b/tools/gpgkey2ssh.c
+index 903fb5b..d5611dc 100644
+--- a/tools/gpgkey2ssh.c
++++ b/tools/gpgkey2ssh.c
+@@ -266,7 +266,7 @@ main (int argc, char **argv)
+   keyid = argv[1];
+ 
+   ret = asprintf (&command,
+-		  "gpg --list-keys --with-colons --with-key-data '%s'",
++		  "@out@/bin/gpg2 --list-keys --with-colons --with-key-data '%s'",
+ 		  keyid);
+   assert (ret > 0);
+ 
+
diff --git a/pkgs/tools/security/gnupg/gpgkey2ssh-21.patch b/pkgs/tools/security/gnupg/gpgkey2ssh-21.patch
new file mode 100644
index 0000000000000..198869423e5cb
--- /dev/null
+++ b/pkgs/tools/security/gnupg/gpgkey2ssh-21.patch
@@ -0,0 +1,13 @@
+diff --git a/tools/gpgkey2ssh.c b/tools/gpgkey2ssh.c
+index f12c5f4..2e3f2ac 100644
+--- a/tools/gpgkey2ssh.c
++++ b/tools/gpgkey2ssh.c
+@@ -281,7 +281,7 @@ main (int argc, char **argv)
+   keyid = argv[1];
+ 
+   asprintf (&command,
+-            "gpg2 --list-keys --with-colons --with-key-data '%s'",
++            "@out@/bin/gpg2 --list-keys --with-colons --with-key-data '%s'",
+             keyid);
+   if (! command)
+     {
diff --git a/pkgs/tools/security/gnupg/remove-debug-message.patch b/pkgs/tools/security/gnupg/remove-debug-message.patch
deleted file mode 100644
index 92fc6f2cfcacc..0000000000000
--- a/pkgs/tools/security/gnupg/remove-debug-message.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-commit 936416690e6c889505d84fe96983a66983beae5e
-Author: Werner Koch <wk@gnupg.org>
-Date:   Thu Feb 26 09:38:58 2015 +0100
-
-    gpg: Remove left-over debug message.
-
-    * g10/armor.c (check_input): Remove log_debug.
-
-diff --git a/g10/armor.c b/g10/armor.c
-index 6c0013d..de1726d 100644
---- a/g10/armor.c
-+++ b/g10/armor.c
-@@ -534,9 +534,6 @@ check_input( armor_filter_context_t *afx, IOBUF a )
-             /* This is probably input from a keyserver helper and we
-                have not yet seen an error line.  */
-             afx->key_failed_code = parse_key_failed_line (line+4, len-4);
--            log_debug ("armor-keys-failed (%.*s) ->%d\n",
--                       (int)len, line,
--                       afx->key_failed_code);
-           }
-       if( i >= 0 && !(afx->only_keyblocks && i != 1 && i != 5 && i != 6 )) {
-           hdr_line = i;
diff --git a/pkgs/tools/security/lastpass-cli/default.nix b/pkgs/tools/security/lastpass-cli/default.nix
index 92c7a027d69ff..01495156810b7 100644
--- a/pkgs/tools/security/lastpass-cli/default.nix
+++ b/pkgs/tools/security/lastpass-cli/default.nix
@@ -3,13 +3,13 @@
 stdenv.mkDerivation rec {
   name = "lastpass-cli-${version}";
 
-  version = "0.5.1";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "lastpass";
     repo = "lastpass-cli";
     rev = "v${version}";
-    sha256 = "0k2dbfizd6gwd4s8badm50qg2djrh22szd932l1a96mn79q8zb70";
+    sha256 = "18dn4sx173666w6aaqhwcya5x2z3q0fmhg8h76lgdmx8adrhzdzc";
   };
 
   buildInputs = [
diff --git a/pkgs/tools/security/logkeys/default.nix b/pkgs/tools/security/logkeys/default.nix
index ba875c04e2ba6..b856308712f81 100644
--- a/pkgs/tools/security/logkeys/default.nix
+++ b/pkgs/tools/security/logkeys/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   name = "logkeys-${version}";
-  version = "5ef6b0dcb9e3";
+  version = "2015-11-10";
 
   src = fetchgit {
     url = https://github.com/kernc/logkeys;
-    rev = "5ef6b0dcb9e38e6137ad1579d624ec12107c56c3";
-    sha256 = "02p0l92l0fq069g31ks6xbqavzxa9njj9460vw2jsa7livcn2z9d";
+    rev = "78321c6e70f61c1e7e672fa82daa664017c9e69d";
+    sha256 = "1b1fa1rblyfsg6avqyls03y0rq0favipn5fha770rsirzg4r637q";
   };
 
   buildInputs = [ which procps kbd ];
diff --git a/pkgs/tools/security/nmap/default.nix b/pkgs/tools/security/nmap/default.nix
index c7d927bdb4486..351654b60326a 100644
--- a/pkgs/tools/security/nmap/default.nix
+++ b/pkgs/tools/security/nmap/default.nix
@@ -13,11 +13,11 @@
 with stdenv.lib;
 stdenv.mkDerivation rec {
   name = "nmap${optionalString graphicalSupport "-graphical"}-${version}";
-  version = "7.00";
+  version = "7.01";
 
   src = fetchurl {
     url = "http://nmap.org/dist/nmap-${version}.tar.bz2";
-    sha256 = "1bh25200jidhb2ig206ibiwv1ngyrl2ka743hnihiihmqq0j6i4z";
+    sha256 = "01bpc820fmjl1vd08a3j9fpa84psaa7c3cxc8wpzabms8ckcs7yg";
   };
 
   patches = ./zenmap.patch;
diff --git a/pkgs/tools/security/polkit-gnome/default.nix b/pkgs/tools/security/polkit-gnome/default.nix
index c06aac204a1c6..38d47e742a292 100644
--- a/pkgs/tools/security/polkit-gnome/default.nix
+++ b/pkgs/tools/security/polkit-gnome/default.nix
@@ -1,17 +1,20 @@
 { stdenv, fetchurl, polkit, gtk3, pkgconfig, intltool }:
 
-stdenv.mkDerivation {
-  name = "polkit-gnome-0.105";
+let
+  version = "0.105";
+
+in stdenv.mkDerivation rec {
+  name = "polkit-gnome-${version}";
 
   src = fetchurl {
-    url = mirror://gnome/sources/polkit-gnome/0.105/polkit-gnome-0.105.tar.xz;
+    url = "mirror://gnome/sources/polkit-gnome/${version}/${name}.tar.xz";
     sha256 = "0sckmcbxyj6sbrnfc5p5lnw27ccghsid6v6wxq09mgxqcd4lk10p";
   };
 
   buildInputs = [ polkit gtk3 ];
   nativeBuildInputs = [ pkgconfig intltool ];
 
-  configureFlags = "--disable-introspection";
+  configureFlags = [ "--disable-introspection" ];
 
   # Desktop file from Debian
   postInstall = ''
@@ -24,5 +27,6 @@ stdenv.mkDerivation {
     description = "A dbus session bus service that is used to bring up authentication dialogs";
     license = stdenv.lib.licenses.gpl2;
     maintainers = with stdenv.lib.maintainers; [ urkud phreedom ];
+    platforms = stdenv.lib.platforms.linux;
   };
 }
diff --git a/pkgs/tools/security/signing-party/default.nix b/pkgs/tools/security/signing-party/default.nix
index 21e0bb4c4a974..dfd5cd6c7d7cf 100644
--- a/pkgs/tools/security/signing-party/default.nix
+++ b/pkgs/tools/security/signing-party/default.nix
@@ -1,12 +1,12 @@
 {stdenv, fetchurl, gnupg, perl, automake111x, autoconf}:
 
 stdenv.mkDerivation rec {
-  version = "2.0";
+  version = "2.1";
   basename = "signing-party";
   name = "${basename}-${version}";
   src = fetchurl {
     url = "mirror://debian/pool/main/s/${basename}/${basename}_${version}.orig.tar.gz";
-    sha256 = "0vn15sb2yyzd57xdblw48p5hi6fnpvgy83mqyz5ygph65y5y88yc";
+    sha256 = "0pcni3mf92503bqknwlsvv1f5gz23dmzwas2j8g2fk7afjd891ya";
   };
 
   sourceRoot = ".";
diff --git a/pkgs/tools/security/tor/default.nix b/pkgs/tools/security/tor/default.nix
index 9e73c7d4053f9..7ff1cd9cca569 100644
--- a/pkgs/tools/security/tor/default.nix
+++ b/pkgs/tools/security/tor/default.nix
@@ -1,17 +1,18 @@
 { stdenv, fetchurl, libevent, openssl, zlib, torsocks, libseccomp }:
 
 stdenv.mkDerivation rec {
-  name = "tor-0.2.7.5";
+  name = "tor-0.2.7.6";
 
   src = fetchurl {
     url = "https://archive.torproject.org/tor-package-archive/${name}.tar.gz";
-    sha256 = "0pxayvcab4cb107ynbpzx4g0qyr1mjfba2an76wdx6dxn56rwakx";
+    sha256 = "0p8hjlfi8dwghlyjif5s0q98cmpgz9kn9jja25430l04z5wqcfj9";
   };
 
   # Note: torsocks is specified as a dependency, as the distributed
   # 'torify' wrapper attempts to use it; although there is no
   # ./configure time check for any of this.
-  buildInputs = [ libevent openssl zlib torsocks libseccomp ];
+  buildInputs = [ libevent openssl zlib torsocks ] ++
+    stdenv.lib.optional stdenv.isLinux libseccomp;
 
   NIX_CFLAGS_LINK = stdenv.lib.optionalString stdenv.cc.isGNU "-lgcc_s";
 
diff --git a/pkgs/tools/security/tor/torbrowser.nix b/pkgs/tools/security/tor/torbrowser.nix
index 3ff4ce724b800..e6ce333cc9153 100644
--- a/pkgs/tools/security/tor/torbrowser.nix
+++ b/pkgs/tools/security/tor/torbrowser.nix
@@ -16,13 +16,13 @@ let
 
 in stdenv.mkDerivation rec {
   name = "tor-browser-${version}";
-  version = "5.0.4";
+  version = "5.0.6";
 
   src = fetchurl {
     url = "https://archive.torproject.org/tor-package-archive/torbrowser/${version}/tor-browser-linux${if stdenv.is64bit then "64" else "32"}-${version}_en-US.tar.xz";
     sha256 = if stdenv.is64bit then
-      "03vn1wkkpgr6wzd6iiyqs7zv7yxl9q99j755n8l2579bd10w1xcn" else
-      "1yc13cykr4fafz6r8hnjccl0s33sk297c779cknbdbhj3z3yn163";
+      "1ix05760l9j6bwbswd2fnk4b6nrrzxp3b8abvm4y4979pkkmasfw" else
+      "1q5mf91xxj1xs4ajj9i6mdhnzqycbdvprkzskx8pl6j9ll2hlsyh";
   };
 
   patchPhase = ''
diff --git a/pkgs/tools/system/freeipmi/default.nix b/pkgs/tools/system/freeipmi/default.nix
index 7e3ec2358c707..3a88267f6c4f0 100644
--- a/pkgs/tools/system/freeipmi/default.nix
+++ b/pkgs/tools/system/freeipmi/default.nix
@@ -1,12 +1,12 @@
 { fetchurl, stdenv, libgcrypt, readline }:
 
 stdenv.mkDerivation rec {
-  version = "1.4.9";
+  version = "1.5.1";
   name = "freeipmi-${version}";
 
   src = fetchurl {
     url = "mirror://gnu/freeipmi/${name}.tar.gz";
-    sha256 = "0v2xfwik2mv6z8066raiypc4xymjvr8pb0mv3mc3g4ym4km132qp";
+    sha256 = "0lhjxlha4j5rx11d81y1rgp9j18rlpxsjc0flsmj6bm60awmm627";
   };
 
   buildInputs = [ libgcrypt readline ];
diff --git a/pkgs/tools/text/colordiff/default.nix b/pkgs/tools/text/colordiff/default.nix
index 9b041ae4b2bec..53e683561fb82 100644
--- a/pkgs/tools/text/colordiff/default.nix
+++ b/pkgs/tools/text/colordiff/default.nix
@@ -4,7 +4,10 @@ stdenv.mkDerivation rec {
   name = "colordiff-1.0.16";
 
   src = fetchurl {
-    url = "http://www.colordiff.org/${name}.tar.gz";
+    urls = [
+      "http://www.colordiff.org/${name}.tar.gz"
+      "http://www.colordiff.org/archive/${name}.tar.gz"
+    ];
     sha256 = "12qkkw13261dra8pg7mzx4r8p9pb0ajb090bib9j1s6hgphwzwga";
   };
 
diff --git a/pkgs/tools/typesetting/djvu2pdf/default.nix b/pkgs/tools/typesetting/djvu2pdf/default.nix
index 5455df5f106e7..512efe497fa0f 100644
--- a/pkgs/tools/typesetting/djvu2pdf/default.nix
+++ b/pkgs/tools/typesetting/djvu2pdf/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchurl, pkgconfig, djvulibre, ghostscript }:
+{ stdenv, makeWrapper, fetchurl, djvulibre, ghostscript, which }:
 
 stdenv.mkDerivation rec {
   version = "0.9.2";
@@ -9,12 +9,13 @@ stdenv.mkDerivation rec {
     sha256 = "0v2ax30m7j1yi4m02nzn9rc4sn4vzqh5vywdh96r64j4pwvn5s5g";
   };
 
-  buildInputs = [ pkgconfig ];
-  propagatedUserEnvPkgs = [ djvulibre ghostscript ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     mkdir -p $out/bin
     cp -p djvu2pdf $out/bin
+    wrapProgram $out/bin/djvu2pdf --prefix PATH : ${ghostscript}/bin:${djvulibre}/bin:${which}/bin
+
     mkdir -p $out/man/man1
     cp -p djvu2pdf.1.gz $out/man/man1
   '';
@@ -23,6 +24,7 @@ stdenv.mkDerivation rec {
     description = "Creates djvu files from PDF files";
     homepage = http://0x2a.at/s/projects/djvu2pdf;
     license = stdenv.lib.licenses.gpl2;
+    platforms = stdenv.lib.platforms.all;
     inherit version;
   };
 }
diff --git a/pkgs/tools/typesetting/hevea/default.nix b/pkgs/tools/typesetting/hevea/default.nix
index 0626ec84fbe54..3343579bbab2a 100644
--- a/pkgs/tools/typesetting/hevea/default.nix
+++ b/pkgs/tools/typesetting/hevea/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, ocaml }:
 
 stdenv.mkDerivation rec {
-  name = "hevea-2.25";
+  name = "hevea-2.26";
 
   src = fetchurl {
     url = "http://pauillac.inria.fr/~maranget/hevea/distri/${name}.tar.gz";
-    sha256 = "0kn99v92xsfy12r9gfvwgs0xf3s9s6frfg86a8q6damj1dampiz4";
+    sha256 = "173v6z2li12pah6315dfpwhqrdljkhsff82gj7sql812zwjkvd2f";
   };
 
   buildInputs = [ ocaml ];
diff --git a/pkgs/tools/typesetting/tex/texlive-new/bin.nix b/pkgs/tools/typesetting/tex/texlive-new/bin.nix
index 7ed9b58d14d74..f833cc2f82b13 100644
--- a/pkgs/tools/typesetting/tex/texlive-new/bin.nix
+++ b/pkgs/tools/typesetting/tex/texlive-new/bin.nix
@@ -8,6 +8,8 @@
 , makeWrapper
 }:
 
+# Useful resource covering build options:
+# http://tug.org/texlive/doc/tlbuild.html
 
 let
   withSystemLibs = map (libname: "--with-system-${libname}");
@@ -222,5 +224,28 @@ bibtex8 = stdenv.mkDerivation {
 };
 
 
+xdvi = stdenv.mkDerivation {
+  name = "texlive-xdvi.bin-${version}";
+
+  inherit (common) src;
+
+  buildInputs = [ pkgconfig core/*kpathsea*/ freetype ghostscript ]
+    ++ (with xorg; [ libX11 libXaw libXi libXpm libXmu libXaw libXext libXfixes ]);
+
+  preConfigure = "cd texk/xdvik";
+
+  configureFlags = common.configureFlags
+    ++ [ "--with-system-kpathsea" "--with-system-libgs" ];
+
+  enableParallelBuilding = true;
+
+  postInstall = ''
+    substituteInPlace "$out/bin/xdvi" \
+      --replace "exec xdvi-xaw" "exec '$out/bin/xdvi-xaw'"
+  '';
+  # TODO: it's suspicious that mktexpk generates fonts into ~/.texlive2014
+};
+
+
 } # un-indented
 
diff --git a/pkgs/tools/typesetting/tex/texlive-new/default.nix b/pkgs/tools/typesetting/tex/texlive-new/default.nix
index a084c973b780e..5fe52ba07baf5 100644
--- a/pkgs/tools/typesetting/tex/texlive-new/default.nix
+++ b/pkgs/tools/typesetting/tex/texlive-new/default.nix
@@ -84,6 +84,10 @@ let
       latex = orig.latex // {
         deps = removeAttrs orig.latex.deps [ "luatex" ];
       };
+
+      xdvi = orig.xdvi // { # it seems to need it to transform fonts
+        deps = (orig.xdvi.deps or {}) // { inherit (tl) metafont; };
+      };
     }; # overrides
 
     # tl =