summary refs log tree commit diff
path: root/pkgs/tools
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs/tools')
-rw-r--r--pkgs/tools/backup/borg/default.nix11
-rw-r--r--pkgs/tools/compression/lrzip/default.nix4
-rw-r--r--pkgs/tools/filesystems/ceph/generic.nix3
-rw-r--r--pkgs/tools/filesystems/glusterfs/default.nix8
-rw-r--r--pkgs/tools/graphics/graphviz/default.nix16
-rw-r--r--pkgs/tools/graphics/netpbm/default.nix4
-rw-r--r--pkgs/tools/misc/bmon/default.nix10
-rw-r--r--pkgs/tools/misc/hhpc/default.nix28
-rw-r--r--pkgs/tools/misc/libbitcoin/libbitcoin-client.nix36
-rw-r--r--pkgs/tools/misc/libbitcoin/libbitcoin-explorer.nix36
-rw-r--r--pkgs/tools/misc/libbitcoin/libbitcoin.nix35
-rw-r--r--pkgs/tools/misc/man-db/default.nix7
-rw-r--r--pkgs/tools/misc/mlocate/default.nix21
-rw-r--r--pkgs/tools/misc/youtube-dl/default.nix4
-rw-r--r--pkgs/tools/networking/dnscrypt-proxy/default.nix20
-rw-r--r--pkgs/tools/networking/i2p/default.nix4
-rw-r--r--pkgs/tools/networking/i2p/i2p.patch34
-rw-r--r--pkgs/tools/networking/miredo/default.nix34
-rw-r--r--pkgs/tools/networking/ndjbdns/default.nix19
-rw-r--r--pkgs/tools/networking/openntpd/default.nix4
-rw-r--r--pkgs/tools/networking/openssh/RH-1380296-NEWKEYS-null-pointer-deref.patch37
-rw-r--r--pkgs/tools/networking/openssh/default.nix12
-rw-r--r--pkgs/tools/networking/openssh/fix-CVE-2016-8858.patch11
-rw-r--r--pkgs/tools/networking/openvpn/default.nix9
-rw-r--r--pkgs/tools/networking/openvpn/systemd-notify.patch14
-rw-r--r--pkgs/tools/networking/strongswan/default.nix5
-rw-r--r--pkgs/tools/networking/zerotierone/default.nix6
-rw-r--r--pkgs/tools/package-management/nix/default.nix4
-rw-r--r--pkgs/tools/security/enpass/data.json12
-rw-r--r--pkgs/tools/security/enpass/default.nix43
-rw-r--r--pkgs/tools/security/gencfsm/default.nix15
-rw-r--r--pkgs/tools/security/gnupg/21.nix4
-rw-r--r--pkgs/tools/security/gorilla-bin/default.nix41
-rw-r--r--pkgs/tools/system/dd_rescue/default.nix4
-rw-r--r--pkgs/tools/system/ipmiutil/default.nix4
-rw-r--r--pkgs/tools/text/codesearch/default.nix26
-rw-r--r--pkgs/tools/text/codesearch/deps.nix3
37 files changed, 413 insertions, 175 deletions
diff --git a/pkgs/tools/backup/borg/default.nix b/pkgs/tools/backup/borg/default.nix
index 09c2dddd515..b27d5c834b1 100644
--- a/pkgs/tools/backup/borg/default.nix
+++ b/pkgs/tools/backup/borg/default.nix
@@ -15,11 +15,12 @@ python3Packages.buildPythonApplication rec {
     # For building documentation:
     sphinx sphinx_rtd_theme
   ];
-  propagatedBuildInputs = [
-    acl lz4 openssl
-  ] ++ (with python3Packages; [
-    cython msgpack llfuse tox detox setuptools_scm
-  ]);
+  buildInputs = [
+    acl lz4 openssl python3Packages.setuptools_scm
+  ];
+  propagatedBuildInputs = with python3Packages; [
+    cython llfuse msgpack
+  ];
 
   preConfigure = ''
     export BORG_OPENSSL_PREFIX="${openssl.dev}"
diff --git a/pkgs/tools/compression/lrzip/default.nix b/pkgs/tools/compression/lrzip/default.nix
index e3a01647afb..083a71f6a75 100644
--- a/pkgs/tools/compression/lrzip/default.nix
+++ b/pkgs/tools/compression/lrzip/default.nix
@@ -1,12 +1,12 @@
 {stdenv, fetchurl, zlib, lzo, bzip2, nasm, perl}:
 
 stdenv.mkDerivation rec {
-  version = "0.630";
+  version = "0.631";
   name = "lrzip-${version}";
 
   src = fetchurl {
     url = "http://ck.kolivas.org/apps/lrzip/${name}.tar.bz2";
-    sha256 = "01ykxliqw4cavx9f2gawxfa9wf52cjy1qx28cnkrh6i3lfzzcq94";
+    sha256 = "0mb449vmmwpkalq732jdyginvql57nxyd31sszb108yps1lf448d";
   };
 
   buildInputs = [ zlib lzo bzip2 nasm perl ];
diff --git a/pkgs/tools/filesystems/ceph/generic.nix b/pkgs/tools/filesystems/ceph/generic.nix
index a5df46b6ba4..d21d790dac8 100644
--- a/pkgs/tools/filesystems/ceph/generic.nix
+++ b/pkgs/tools/filesystems/ceph/generic.nix
@@ -285,6 +285,9 @@ stdenv.mkDerivation {
     license = licenses.lgpl21;
     maintainers = with maintainers; [ ak wkennington ];
     platforms = platforms.unix;
+    # Broken because of https://lwn.net/Vulnerabilities/709844/
+    # and our version is quite out of date.
+    broken = true;
   };
 
   passthru.version = version;
diff --git a/pkgs/tools/filesystems/glusterfs/default.nix b/pkgs/tools/filesystems/glusterfs/default.nix
index 32c87667ee3..745d968cce1 100644
--- a/pkgs/tools/filesystems/glusterfs/default.nix
+++ b/pkgs/tools/filesystems/glusterfs/default.nix
@@ -6,11 +6,11 @@ let
   s = # Generated upstream information 
   rec {
     baseName="glusterfs";
-    version="3.8.4";
+    version="3.9.0";
     name="${baseName}-${version}";
-    hash="0f715r6bf12b37s1l3259qzfbz8l2g3mdsnnh2lflagzazn6jnap";
-    url="http://download.gluster.org/pub/gluster/glusterfs/3.8/3.8.4/glusterfs-3.8.4.tar.gz";
-    sha256="0f715r6bf12b37s1l3259qzfbz8l2g3mdsnnh2lflagzazn6jnap";
+    hash="057vq4f93f1g9sh1sfbqhccsprxrbhwwm898322x25sb8mscc5xl";
+    url="http://download.gluster.org/pub/gluster/glusterfs/3.9/3.9.0/glusterfs-3.9.0.tar.gz";
+    sha256="057vq4f93f1g9sh1sfbqhccsprxrbhwwm898322x25sb8mscc5xl";
   };
   buildInputs = [
     fuse bison flex_2_5_35 openssl python2 ncurses readline
diff --git a/pkgs/tools/graphics/graphviz/default.nix b/pkgs/tools/graphics/graphviz/default.nix
index 1162b338ed7..e815cded09a 100644
--- a/pkgs/tools/graphics/graphviz/default.nix
+++ b/pkgs/tools/graphics/graphviz/default.nix
@@ -4,23 +4,17 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "2.38.0";
+  version = "2.40.1";
   name = "graphviz-${version}";
 
   src = fetchurl {
     url = "http://www.graphviz.org/pub/graphviz/ARCHIVE/${name}.tar.gz";
-    sha256 = "17l5czpvv5ilmg17frg0w4qwf89jzh2aglm9fgx0l0aakn6j7al1";
+    sha256 = "08d4ygkxz2f553bxj6087da56a23kx1khv0j8ycxa102vvx1hlna";
   };
 
   hardeningDisable = [ "fortify" ];
 
-  patches =
-    [ ./0001-vimdot-lookup-vim-in-PATH.patch
-
-      # NOTE: Once this patch is removed, flex can probably be removed from
-      # buildInputs.
-      ./cve-2014-9157.patch
-    ];
+  patches = [ ];
 
   buildInputs =
     [ pkgconfig libpng libjpeg expat yacc libtool fontconfig gd gts libdevil flex pango
@@ -33,11 +27,13 @@ stdenv.mkDerivation rec {
 
   configureFlags = stdenv.lib.optional (xorg == null) "--without-x";
 
-  postPatch = stdenv.lib.optionalString stdenv.isDarwin ''
+  postPatch = (stdenv.lib.optionalString stdenv.isDarwin ''
     for foo in cmd/dot/Makefile.in cmd/edgepaint/Makefile.in \
                     cmd/mingle/Makefile.in plugin/gdiplus/Makefile.in; do
       substituteInPlace "$foo" --replace "-lstdc++" "-lc++"
     done
+  '') + ''
+      substituteInPlace "plugin/xlib/vimdot.sh" --replace "/usr/bin/vim" "\$(command -v vim)"
   '';
 
   preBuild = ''
diff --git a/pkgs/tools/graphics/netpbm/default.nix b/pkgs/tools/graphics/netpbm/default.nix
index d0381e91251..7fafc5218e9 100644
--- a/pkgs/tools/graphics/netpbm/default.nix
+++ b/pkgs/tools/graphics/netpbm/default.nix
@@ -24,7 +24,9 @@ stdenv.mkDerivation rec {
     echo "STATICLIB_TOO = n" >> config.mk
     substituteInPlace "config.mk" \
         --replace "TIFFLIB = NONE" "TIFFLIB = ${libtiff.out}/lib/libtiff.so" \
-        --replace "TIFFHDR_DIR =" "TIFFHDR_DIR = ${libtiff.dev}/include"
+        --replace "TIFFHDR_DIR =" "TIFFHDR_DIR = ${libtiff.dev}/include" \
+        --replace "JPEGLIB = NONE" "JPEGLIB = ${libjpeg.out}/lib/libjpeg.so" \
+        --replace "JPEGHDR_DIR =" "JPEGHDR_DIR = ${libjpeg.dev}/include"
    '' + stdenv.lib.optionalString stdenv.isDarwin ''
     echo "LDSHLIB=-dynamiclib -install_name $out/lib/libnetpbm.\$(MAJ).dylib" >> config.mk
     echo "NETPBMLIBTYPE = dylib" >> config.mk
diff --git a/pkgs/tools/misc/bmon/default.nix b/pkgs/tools/misc/bmon/default.nix
index 30412016e50..9c7eafe351f 100644
--- a/pkgs/tools/misc/bmon/default.nix
+++ b/pkgs/tools/misc/bmon/default.nix
@@ -1,23 +1,21 @@
-{ stdenv, fetchFromGitHub, autoconf, automake, pkgconfig, ncurses, confuse
+{ stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, ncurses, confuse
 , libnl }:
 
 stdenv.mkDerivation rec {
   name = "bmon-${version}";
-  version = "3.9";
+  version = "4.0";
 
   src = fetchFromGitHub {
     owner = "tgraf";
     repo = "bmon";
     rev = "v${version}";
-    sha256 = "1a4sj8pf02392zghr9wa1dc8x38fj093d4hg1fcakzrdjvrg1p2h";
+    sha256 = "1ilba872c09mnlvylslv4hqv6c9cz36l76q74rr99jvis1dg69gf";
   };
 
-  nativeBuildInputs = [ autoconf automake pkgconfig ];
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
 
   buildInputs = [ ncurses confuse libnl ];
 
-  preConfigure = "sh ./autogen.sh";
-
   meta = with stdenv.lib; {
     description = "Network bandwidth monitor";
     homepage = https://github.com/tgraf/bmon;
diff --git a/pkgs/tools/misc/hhpc/default.nix b/pkgs/tools/misc/hhpc/default.nix
new file mode 100644
index 00000000000..b4ee1f2f5c0
--- /dev/null
+++ b/pkgs/tools/misc/hhpc/default.nix
@@ -0,0 +1,28 @@
+{stdenv, fetchFromGitHub, xorg, pkgconfig}:
+
+stdenv.mkDerivation rec {
+  name = "hhpc-${version}";
+  version = "0.3.1";
+
+  src = fetchFromGitHub {
+    owner = "aktau";
+    repo = "hhpc";
+    rev = "v${version}";
+    sha256 = "1djsw1r38mh6zx0rbyn2cfa931hyddib4fl3i27c4z7xinl709ss";
+  };
+
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ xorg.libX11 ];
+
+  installPhase = ''
+      mkdir -p $out/bin
+      cp hhpc $out/bin/
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Hides the mouse pointer in X11";
+    maintainers = with maintainers; [ nico202 ];
+    platforms = platforms.unix;
+    license = stdenv.lib.licenses.bsd3;
+  };
+}
diff --git a/pkgs/tools/misc/libbitcoin/libbitcoin-client.nix b/pkgs/tools/misc/libbitcoin/libbitcoin-client.nix
new file mode 100644
index 00000000000..1f45626855f
--- /dev/null
+++ b/pkgs/tools/misc/libbitcoin/libbitcoin-client.nix
@@ -0,0 +1,36 @@
+{ stdenv, lib, fetchurl, pkgconfig, autoreconfHook
+, boost, libsodium, czmqpp, libbitcoin }:
+
+let
+  pname = "libbitcoin-client";
+  version = "2.2.0";
+
+in stdenv.mkDerivation {
+  name = "${pname}-${version}";
+
+  src = fetchurl {
+    url = "https://github.com/libbitcoin/libbitcoin-client/archive/v${version}.tar.gz";
+    sha256 = "1g79hl6jmf5dam7vq19h4dgdj7gcn19fa7q78vn573mg2rdyal53";
+  };
+
+  buildInputs = [ autoreconfHook pkgconfig ];
+
+  propagatedBuildInputs = [ libsodium czmqpp libbitcoin ];
+
+  configureFlags = [
+    "--with-boost=${boost.dev}"
+    "--with-boost-libdir=${boost.out}/lib"
+    "--with-bash-completiondir=$out/share/bash-completion/completions"
+  ];
+
+  meta = with stdenv.lib; {
+    description = "Bitcoin client query library";
+    homepage = https://github.com/libbitcoin/libbitcoin-client;
+    platforms = platforms.linux ++ platforms.darwin;
+    maintainers = with maintainers; [ chris-martin ];
+
+    # https://wiki.unsystem.net/en/index.php/Libbitcoin/License
+    # AGPL with an additional clause
+    license = licenses.agpl3;
+  };
+}
diff --git a/pkgs/tools/misc/libbitcoin/libbitcoin-explorer.nix b/pkgs/tools/misc/libbitcoin/libbitcoin-explorer.nix
new file mode 100644
index 00000000000..fbfa385fc7f
--- /dev/null
+++ b/pkgs/tools/misc/libbitcoin/libbitcoin-explorer.nix
@@ -0,0 +1,36 @@
+{ stdenv, lib, fetchurl, pkgconfig, autoreconfHook
+, boost, libbitcoin-client }:
+
+let
+  pname = "libbitcoin-explorer";
+  version = "2.2.0";
+
+in stdenv.mkDerivation {
+  name = "${pname}-${version}";
+
+  src = fetchurl {
+    url = "https://github.com/libbitcoin/libbitcoin-explorer/archive/v${version}.tar.gz";
+    sha256 = "00123vw7rxk0ypdfzk0xwk8q55ll31000mkjqdzl915krsbkbfvp";
+  };
+
+  buildInputs = [ autoreconfHook pkgconfig ];
+
+  propagatedBuildInputs = [ libbitcoin-client ];
+
+  configureFlags = [
+    "--with-boost=${boost.dev}"
+    "--with-boost-libdir=${boost.out}/lib"
+    "--with-bash-completiondir=$out/share/bash-completion/completions"
+  ];
+
+  meta = with stdenv.lib; {
+    description = "Bitcoin command line tool";
+    homepage = https://github.com/libbitcoin/libbitcoin-explorer;
+    platforms = platforms.linux ++ platforms.darwin;
+    maintainers = with maintainers; [ chris-martin ];
+
+    # https://wiki.unsystem.net/en/index.php/Libbitcoin/License
+    # AGPL with an additional clause
+    license = licenses.agpl3;
+  };
+}
diff --git a/pkgs/tools/misc/libbitcoin/libbitcoin.nix b/pkgs/tools/misc/libbitcoin/libbitcoin.nix
new file mode 100644
index 00000000000..61c462f7853
--- /dev/null
+++ b/pkgs/tools/misc/libbitcoin/libbitcoin.nix
@@ -0,0 +1,35 @@
+{ stdenv, lib, fetchurl, pkgconfig, autoreconfHook
+, boost, libsodium, czmqpp, secp256k1 }:
+
+let
+  pname = "libbitcoin";
+  version = "2.11.0";
+
+in stdenv.mkDerivation {
+  name = "${pname}-${version}";
+
+  src = fetchurl {
+    url = "https://github.com/libbitcoin/libbitcoin/archive/v${version}.tar.gz";
+    sha256 = "1lpdjm13kgs4fbp579bwfvws8yf9mnr5dw3ph8zxg2gf110h85sy";
+  };
+
+  buildInputs = [ autoreconfHook pkgconfig ];
+
+  propagatedBuildInputs = [ secp256k1 ];
+
+  configureFlags = [
+    "--with-boost=${boost.dev}"
+    "--with-boost-libdir=${boost.out}/lib"
+  ];
+
+  meta = with stdenv.lib; {
+    description = "C++ library for building bitcoin applications";
+    homepage = https://libbitcoin.org/;
+    platforms = platforms.linux ++ platforms.darwin;
+    maintainers = with maintainers; [ chris-martin ];
+
+    # https://wiki.unsystem.net/en/index.php/Libbitcoin/License
+    # AGPL with an additional clause
+    license = licenses.agpl3;
+  };
+}
diff --git a/pkgs/tools/misc/man-db/default.nix b/pkgs/tools/misc/man-db/default.nix
index 9c1dabc7584..8685b89d6d0 100644
--- a/pkgs/tools/misc/man-db/default.nix
+++ b/pkgs/tools/misc/man-db/default.nix
@@ -29,8 +29,11 @@ stdenv.mkDerivation rec {
   ];
 
   postInstall = ''
-    for i in "$out/bin/"*; do
-      wrapProgram "$i" --prefix PATH : "${groff}/bin"
+    # apropos/whatis uses program name to decide whether to act like apropos or whatis
+    # (multi-call binary). `apropos` is actually just a symlink to whatis. So we need to
+    # make sure that we don't wrap symlinks (since that changes argv[0] to the -wrapped name)
+    find "$out/bin" -type f | while read file; do
+      wrapProgram "$file" --prefix PATH : "${groff}/bin"
     done
   '';
 
diff --git a/pkgs/tools/misc/mlocate/default.nix b/pkgs/tools/misc/mlocate/default.nix
new file mode 100644
index 00000000000..6dbd0bcc439
--- /dev/null
+++ b/pkgs/tools/misc/mlocate/default.nix
@@ -0,0 +1,21 @@
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  name = "mlocate-${version}";
+  version = "0.26";
+
+  src = fetchurl {
+    url = "http://fedorahosted.org/releases/m/l/mlocate/${name}.tar.xz";
+    sha256 = "0gi6y52gkakhhlnzy0p6izc36nqhyfx5830qirhvk3qrzrwxyqrh";
+  };
+
+  buildInputs = [ ];
+
+  meta = with stdenv.lib; {
+    description = "Merging locate is an utility to index and quickly search for files";
+    homepage = https://fedorahosted.org/mlocate/;
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ ];
+  };
+}
diff --git a/pkgs/tools/misc/youtube-dl/default.nix b/pkgs/tools/misc/youtube-dl/default.nix
index a1ed2d9657f..2bca4b165fe 100644
--- a/pkgs/tools/misc/youtube-dl/default.nix
+++ b/pkgs/tools/misc/youtube-dl/default.nix
@@ -15,11 +15,11 @@ with stdenv.lib;
 buildPythonApplication rec {
 
   name = "youtube-dl-${version}";
-  version = "2016.12.20";
+  version = "2017.01.02";
 
   src = fetchurl {
     url = "https://yt-dl.org/downloads/${version}/${name}.tar.gz";
-    sha256 = "f80d47d5e2a236ea6c9d8b4636199aea01a041607ce7b544babedb0fe1ce59a5";
+    sha256 = "140de01ea879cdc50bc34240802d5c10231baf448d7a664e6efeb9d5efb74d5b";
   };
 
   buildInputs = [ makeWrapper zip ] ++ optional generateManPage pandoc;
diff --git a/pkgs/tools/networking/dnscrypt-proxy/default.nix b/pkgs/tools/networking/dnscrypt-proxy/default.nix
index 1eac3cf6c02..73dfd3ab9ba 100644
--- a/pkgs/tools/networking/dnscrypt-proxy/default.nix
+++ b/pkgs/tools/networking/dnscrypt-proxy/default.nix
@@ -1,14 +1,14 @@
-{ stdenv, fetchurl, libsodium, pkgconfig, systemd }:
+{ stdenv, fetchurl, pkgconfig, libsodium, systemd }:
 
 with stdenv.lib;
 
 stdenv.mkDerivation rec {
   name = "dnscrypt-proxy-${version}";
-  version = "1.7.0";
+  version = "1.9.0";
 
   src = fetchurl {
     url = "https://download.dnscrypt.org/dnscrypt-proxy/${name}.tar.bz2";
-    sha256 = "1qw2nib0d5ia8581lbdnjxgn9c7pf2qw8vhpnnh1wjcjj3gpgbqx";
+    sha256 = "0v5rsn9zdakzn6rcf2qhjqfd2y4h8q0hj4xr5hwhvaskg213rsyp";
   };
 
   configureFlags = optional stdenv.isLinux "--with-systemd";
@@ -17,7 +17,19 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ libsodium ] ++ optional stdenv.isLinux systemd;
 
-  outputs = [ "out" "man" ];
+  postInstall = ''
+    # Previous versions required libtool files to load plugins; they are
+    # now strictly optional.
+    rm $out/lib/dnscrypt-proxy/*.la
+
+    # The installation ends up copying the same sample configuration
+    # into $out/etc twice, with the expectation that one of them will be
+    # edited by the user.  Since we can't modify the file, it makes more
+    # sense to move only a single copy to the doc directory.
+    mkdir -p $out/share/doc/dnscrypt-proxy
+    mv $out/etc/dnscrypt-proxy.conf.example $out/share/doc/dnscrypt-proxy/
+    rm -rf $out/etc
+  '';
 
   meta = {
     description = "A tool for securing communications between a client and a DNS resolver";
diff --git a/pkgs/tools/networking/i2p/default.nix b/pkgs/tools/networking/i2p/default.nix
index fb2f4358694..d5b9ff665d4 100644
--- a/pkgs/tools/networking/i2p/default.nix
+++ b/pkgs/tools/networking/i2p/default.nix
@@ -1,10 +1,10 @@
 { stdenv, procps, coreutils, fetchurl, jdk, jre, ant, gettext, which }:
 
 stdenv.mkDerivation rec {
-  name = "i2p-0.9.26";
+  name = "i2p-0.9.28";
   src = fetchurl {
     url = "https://github.com/i2p/i2p.i2p/archive/${name}.tar.gz";
-    sha256 = "0h672w69a5xzgcrls64bpss3ga9hgpnrq90dr5lb5912pwwq9pa1";
+    sha256 = "1xagyywnck2c5xalr7bc7cv5ikk4igf7avmc0n28nz9pkais1y1y";
   };
   buildInputs = [ jdk ant gettext which ];
   patches = [ ./i2p.patch ];
diff --git a/pkgs/tools/networking/i2p/i2p.patch b/pkgs/tools/networking/i2p/i2p.patch
index 2ae6446ed28..74031eb7aef 100644
--- a/pkgs/tools/networking/i2p/i2p.patch
+++ b/pkgs/tools/networking/i2p/i2p.patch
@@ -1,6 +1,21 @@
+diff --git a/installer/resources/i2prouter b/installer/resources/i2prouter
+index 365737d89..2ea14db3e 100644
+--- a/installer/resources/i2prouter
++++ b/installer/resources/i2prouter
+@@ -49,7 +49,7 @@ APP_LONG_NAME="I2P Service"
+ 
+ # gettext - we look for it in the path
+ # fallback to echo is below, we can't set it to echo here.
+-GETTEXT=$(which gettext > /dev/null 2>&1)
++GETTEXT=%gettext%
+ 
+ # Where to install the systemd service
+ SYSTEMD_SERVICE="/etc/systemd/system/${APP_NAME}.service"
+diff --git a/installer/resources/runplain.sh b/installer/resources/runplain.sh
+index eb4995dfe..0186cede3 100644
 --- a/installer/resources/runplain.sh
 +++ b/installer/resources/runplain.sh
-@@ -21,7 +21,7 @@
+@@ -25,7 +25,7 @@ CP=
  
  # Try using the Java binary that I2P was installed with.
  # If it's not found, try looking in the system PATH.
@@ -9,10 +24,10 @@
  
  if [ -z $JAVA ] || [ ! -x $JAVA ]; then
      echo "Error: Cannot find java." >&2
-@@ -40,15 +40,4 @@
+@@ -44,15 +44,4 @@ if [ $(uname -s) = "Darwin" ]; then
      export JAVA_TOOL_OPTIONS="-Djava.awt.headless=true"
  fi
- JAVAOPTS="-Djava.net.preferIPv4Stack=${PREFERv4} -Djava.library.path=${I2P}:${I2P}/lib -Di2p.dir.base=${I2P} -DloggerFilenameOverride=logs/log-router-@.txt"
+ JAVAOPTS="${MAXMEMOPT} -Djava.net.preferIPv4Stack=${PREFERv4} -Djava.library.path=${I2P}:${I2P}/lib -Di2p.dir.base=${I2P} -DloggerFilenameOverride=logs/log-router-@.txt"
 -(
 -    nohup ${JAVA} -cp \"${CP}\" ${JAVAOPTS} net.i2p.router.RouterLaunch > /dev/null 2>&1
 -) &
@@ -25,15 +40,4 @@
 -    echo "I2P failed to start." >&2
 -    exit 1
 -fi
-+${JAVA} -cp \"${CP}\" ${JAVAOPTS} net.i2p.router.RouterLaunch
---- a/installer/resources/i2prouter
-+++ b/installer/resources/i2prouter
-@@ -49,7 +49,7 @@
- 
- # gettext - we look for it in the path
- # fallback to echo is below, we can't set it to echo here.
--GETTEXT=$(which gettext > /dev/null 2>&1)
-+GETTEXT=%gettext%
- 
- # Where to install the systemd service
- SYSTEMD_SERVICE="/etc/systemd/system/${APP_NAME}.service"
++exec ${JAVA} -cp \"${CP}\" ${JAVAOPTS} net.i2p.router.RouterLaunch
diff --git a/pkgs/tools/networking/miredo/default.nix b/pkgs/tools/networking/miredo/default.nix
new file mode 100644
index 00000000000..efe2847ae35
--- /dev/null
+++ b/pkgs/tools/networking/miredo/default.nix
@@ -0,0 +1,34 @@
+{ stdenv, fetchurl, nettools, iproute, judy }:
+
+stdenv.mkDerivation rec {
+  version = "1.2.6";
+  name = "miredo-${version}";
+
+  buildInputs = [ judy ];
+
+  src = fetchurl {
+    url = "http://www.remlab.net/files/miredo/miredo-${version}.tar.xz";
+    sha256 = "0j9ilig570snbmj48230hf7ms8kvcwi2wblycqrmhh85lksd49ps";
+  };
+
+  postPatch = ''
+    substituteInPlace misc/client-hook.bsd \
+      --replace '/sbin/route' '${nettools}/bin/route' \
+      --replace '/sbin/ifconfig' '${nettools}/bin/ifconfig'
+    substituteInPlace misc/client-hook.iproute --replace '/sbin/ip' '${iproute}/bin/ip'
+  '';
+
+  configureFlags = [ "--with-Judy" ];
+
+  postInstall = ''
+    rm -rf $out/lib/systemd $out/var $out/etc/miredo/miredo.conf
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Teredo IPv6 Tunneling Daemon";
+    homepage = http://www.remlab.net/miredo/;
+    license = licenses.gpl2;
+    maintainers = [ maintainers.volth ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/tools/networking/ndjbdns/default.nix b/pkgs/tools/networking/ndjbdns/default.nix
index 256f50e5c54..3269f92d7f4 100644
--- a/pkgs/tools/networking/ndjbdns/default.nix
+++ b/pkgs/tools/networking/ndjbdns/default.nix
@@ -1,17 +1,22 @@
-{ stdenv, fetchurl, systemd, pkgconfig }:
+{ stdenv, fetchFromGitHub, autoreconfHook, systemd, pkgconfig }:
+
+with stdenv.lib;
 
 stdenv.mkDerivation rec {
   version = "1.06";
   name = "ndjbdns-${version}";
 
-  src = fetchurl {
-    url = "http://pjp.dgplug.org/ndjbdns/${name}.tar.gz";
-    sha256 = "09qi5a9abqm08iqmxj74fzzq9x1w5lzr1jlbzj2hl8hz0g2sgraw";
+  src = fetchFromGitHub {
+    owner = "pjps";
+    repo = "ndjbdns";
+    rev = "64d371b6f887621de7bf8bd495be10442b2accd0";
+    sha256 = "0gjyvn8r66kp49gasd6sqfvg2pj0c6v67hnq7cqwl04kj69rfy86";
   };
 
-  buildInputs = [ pkgconfig systemd ];
+  buildInputs = [ autoreconfHook pkgconfig ]
+    ++ optional stdenv.isLinux systemd;
 
-  meta = with stdenv.lib; {
+  meta = {
     description = "A brand new release of the Djbdns";
     longDescription = ''
       Djbdns is a fully‐fledged Domain Name System(DNS), originally written by the eminent author of qmail, Dr. D J Bernstein.
@@ -19,7 +24,7 @@ stdenv.mkDerivation rec {
     homepage = http://pjp.dgplug.org/ndjbdns/;
     license = licenses.gpl2;
     maintainers = [ maintainers.msackman ];
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
   };
 
 }
diff --git a/pkgs/tools/networking/openntpd/default.nix b/pkgs/tools/networking/openntpd/default.nix
index 47d1dbbcbe6..6f3aab3082f 100644
--- a/pkgs/tools/networking/openntpd/default.nix
+++ b/pkgs/tools/networking/openntpd/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, openssl
+{ stdenv, fetchurl, libressl
 , privsepPath ? "/var/empty"
 , privsepUser ? "ntp"
 }:
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     "--localstatedir=/var"
   ];
 
-  buildInputs = [ openssl ];
+  buildInputs = [ libressl ];
 
   installFlags = [
     "sysconfdir=\${out}/etc"
diff --git a/pkgs/tools/networking/openssh/RH-1380296-NEWKEYS-null-pointer-deref.patch b/pkgs/tools/networking/openssh/RH-1380296-NEWKEYS-null-pointer-deref.patch
deleted file mode 100644
index 665eff86453..00000000000
--- a/pkgs/tools/networking/openssh/RH-1380296-NEWKEYS-null-pointer-deref.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-diff --git a/kex.c b/kex.c
-index 50c7a0f..823668b 100644
---- a/kex.c
-+++ b/kex.c
-@@ -419,6 +419,8 @@ kex_input_newkeys(int type, u_int32_t seq, void *ctxt)
- 	ssh_dispatch_set(ssh, SSH2_MSG_NEWKEYS, &kex_protocol_error);
- 	if ((r = sshpkt_get_end(ssh)) != 0)
- 		return r;
-+        if ((r = ssh_set_newkeys(ssh, MODE_IN)) != 0)
-+          return r;
- 	kex->done = 1;
- 	sshbuf_reset(kex->peer);
- 	/* sshbuf_reset(kex->my); */
-diff --git a/packet.c b/packet.c
-index d6dad2d..f96566b 100644
---- a/packet.c
-+++ b/packet.c
-@@ -38,7 +38,7 @@
-  */
- 
- #include "includes.h"
-- 
-+
- #include <sys/param.h>	/* MIN roundup */
- #include <sys/types.h>
- #include "openbsd-compat/sys-queue.h"
-@@ -1907,9 +1907,7 @@ ssh_packet_read_poll2(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p)
- 			return r;
- 		return SSH_ERR_PROTOCOL_ERROR;
- 	}
--	if (*typep == SSH2_MSG_NEWKEYS)
--		r = ssh_set_newkeys(ssh, MODE_IN);
--	else if (*typep == SSH2_MSG_USERAUTH_SUCCESS && !state->server_side)
-+	if (*typep == SSH2_MSG_USERAUTH_SUCCESS && !state->server_side)
- 		r = ssh_packet_enable_delayed_compress(ssh);
- 	else
- 		r = 0;
diff --git a/pkgs/tools/networking/openssh/default.nix b/pkgs/tools/networking/openssh/default.nix
index 064f68947b8..1c66900c06b 100644
--- a/pkgs/tools/networking/openssh/default.nix
+++ b/pkgs/tools/networking/openssh/default.nix
@@ -19,8 +19,10 @@ let
 
   # **please** update this patch when you update to a new openssh release.
   gssapiSrc = fetchpatch {
-    url = "https://anonscm.debian.org/cgit/pkg-ssh/openssh.git/plain/debian/patches/gssapi.patch?id=477bb7636238c106f8cd7c868a8c0c5eabcfb3db";
-    sha256 = "1kcx2rw6z7y591vr60ww2m2civ0cx6f6awdpi66p1sric9b65si3";
+    name = "openssh-gssapi.patch";
+    url = "https://anonscm.debian.org/cgit/pkg-ssh/openssh.git/plain/debian"
+        + "/patches/gssapi.patch?id=255b8554a50b5c75fca63f76b1ac837c0d4fb7aa";
+    sha256 = "0yg9iq7vb2fkvy36ar0jxk29pkw0h3dhv5vn8qncc3pgwx3617n2";
   };
 
 in
@@ -29,11 +31,11 @@ stdenv.mkDerivation rec {
   # Please ensure that openssh_with_kerberos still builds when
   # bumping the version here!
   name = "openssh-${version}";
-  version = "7.3p1";
+  version = "7.4p1";
 
   src = fetchurl {
     url = "mirror://openbsd/OpenSSH/portable/${name}.tar.gz";
-    sha256 = "1k5y1wi29d47cgizbryxrhc1fbjsba2x8l5mqfa9b9nadnd9iyrz";
+    sha256 = "1l8r3x4fr2kb6xm95s7kjdif1wp6f94d4kljh4qjj9109shw87qv";
   };
 
   prePatch = optionalString hpnSupport
@@ -44,13 +46,11 @@ stdenv.mkDerivation rec {
 
   patches =
     [
-      ./RH-1380296-NEWKEYS-null-pointer-deref.patch
       ./locale_archive.patch
       ./fix-host-key-algorithms-plus.patch
 
       # See discussion in https://github.com/NixOS/nixpkgs/pull/16966
       ./dont_create_privsep_path.patch
-      ./fix-CVE-2016-8858.patch
     ]
     ++ optional withGssapiPatches gssapiSrc;
 
diff --git a/pkgs/tools/networking/openssh/fix-CVE-2016-8858.patch b/pkgs/tools/networking/openssh/fix-CVE-2016-8858.patch
deleted file mode 100644
index e526161083c..00000000000
--- a/pkgs/tools/networking/openssh/fix-CVE-2016-8858.patch
+++ /dev/null
@@ -1,11 +0,0 @@
-diff -u -r1.126 -r1.127
---- ssh/kex.c	2016/09/28 21:44:52	1.126
-+++ ssh/kex.c	2016/10/10 19:28:48	1.127
-@@ -461,6 +461,7 @@
- 	if (kex == NULL)
- 		return SSH_ERR_INVALID_ARGUMENT;
- 
-+	ssh_dispatch_set(ssh, SSH2_MSG_KEXINIT, NULL);
- 	ptr = sshpkt_ptr(ssh, &dlen);
- 	if ((r = sshbuf_put(kex->peer, ptr, dlen)) != 0)
- 		return r;
diff --git a/pkgs/tools/networking/openvpn/default.nix b/pkgs/tools/networking/openvpn/default.nix
index 13e1c68befd..f609c90ad50 100644
--- a/pkgs/tools/networking/openvpn/default.nix
+++ b/pkgs/tools/networking/openvpn/default.nix
@@ -7,11 +7,12 @@ assert pkcs11Support -> (pkcs11helper != null);
 with stdenv.lib;
 
 stdenv.mkDerivation rec {
-  name = "openvpn-2.3.12";
+  name = "openvpn-${version}";
+  version = "2.4.0";
 
   src = fetchurl {
-    url = "http://swupdate.openvpn.net/community/releases/${name}.tar.gz";
-    sha256 = "1zqwq19xg6yf90nv35yr8r0ljas5f42v4n9hjjmhlnzpan69plzm";
+    url = "http://swupdate.openvpn.net/community/releases/${name}.tar.xz";
+    sha256 = "0zpqnbhjaifdalyxwmvk5kcyd7cpxbcigbn7967nbsyvl54vl8vg";
   };
 
   patches = optional stdenv.isLinux ./systemd-notify.patch;
@@ -39,8 +40,10 @@ stdenv.mkDerivation rec {
   meta = {
     description = "A robust and highly flexible tunneling application";
     homepage = http://openvpn.net/;
+    downloadPage = "https://openvpn.net/index.php/open-source/downloads.html";
     license = stdenv.lib.licenses.gpl2;
     maintainers = [ stdenv.lib.maintainers.viric ];
     platforms = stdenv.lib.platforms.unix;
+    updateWalker = true;
   };
 }
diff --git a/pkgs/tools/networking/openvpn/systemd-notify.patch b/pkgs/tools/networking/openvpn/systemd-notify.patch
index 9291f7a4664..c0ac8ae89d3 100644
--- a/pkgs/tools/networking/openvpn/systemd-notify.patch
+++ b/pkgs/tools/networking/openvpn/systemd-notify.patch
@@ -10,13 +10,13 @@ diff -ru -x '*~' openvpn-2.3.1-orig/src/openvpn/init.c openvpn-2.3.1/src/openvpn
  static struct context *static_context; /* GLOBAL */
  
  /*
-@@ -1241,6 +1243,9 @@
- {
-   static const char message[] = "Initialization Sequence Completed";
+@@ -1375,6 +1375,9 @@
+     /* Reset the unsuccessful connection counter on complete initialisation */
+     c->options.unsuccessful_attempts = 0;
  
-+  /* Tell systemd we're ready. */
-+  sd_notify(0, "READY=1");
++    /* Tell systemd we're ready. */
++    sd_notify(0, "READY=1");
 +
-   /* If we delayed UID/GID downgrade or chroot, do it now */
-   do_uid_gid_chroot (c, true);
+     /* If we delayed UID/GID downgrade or chroot, do it now */
+     do_uid_gid_chroot (c, true);
  
diff --git a/pkgs/tools/networking/strongswan/default.nix b/pkgs/tools/networking/strongswan/default.nix
index 1791abf4a48..7bcbb4fddb6 100644
--- a/pkgs/tools/networking/strongswan/default.nix
+++ b/pkgs/tools/networking/strongswan/default.nix
@@ -37,8 +37,9 @@ stdenv.mkDerivation rec {
       "--enable-eap-mschapv2" "--enable-xauth-eap" "--enable-ext-auth"
       "--enable-forecast" "--enable-connmark" "--enable-acert"
       "--enable-pkcs11" "--enable-eap-sim-pcsc" "--enable-dnscert" "--enable-unbound"
-      "--enable-aesni" "--enable-af-alg" "--enable-rdrand" ]
-    ++ stdenv.lib.optional (stdenv.system == "i686-linux") "--enable-padlock" 
+      "--enable-af-alg" ]
+    ++ stdenv.lib.optional stdenv.isx86_64 [ "--enable-aesni" "--enable-rdrand" ]
+    ++ stdenv.lib.optional (stdenv.system == "i686-linux") "--enable-padlock"
     ++ stdenv.lib.optionals enableTNC [
          "--disable-gmp" "--disable-aes" "--disable-md5" "--disable-sha1" "--disable-sha2" "--disable-fips-prf"
          "--enable-curl" "--enable-openssl"
diff --git a/pkgs/tools/networking/zerotierone/default.nix b/pkgs/tools/networking/zerotierone/default.nix
index d97a6049745..76385312385 100644
--- a/pkgs/tools/networking/zerotierone/default.nix
+++ b/pkgs/tools/networking/zerotierone/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, openssl, lzo, zlib, iproute, which, ronn }:
 
 stdenv.mkDerivation rec {
-  version = "1.1.12";
+  version = "1.1.14";
   name = "zerotierone";
 
   src = fetchurl {
     url = "https://github.com/zerotier/ZeroTierOne/archive/${version}.tar.gz";
-    sha256 = "0mji6bmxjvxy2mhvzfz4vpdz62n1wv6a02rapzbiad8zr2c869cm";
+    sha256 = "1brlyqk2p5h9sws15nbkmm4qhx911aib1v7crmcm2rhwsad0c1nj";
   };
 
   preConfigure = ''
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
     description = "Create flat virtual Ethernet networks of almost unlimited size";
     homepage = https://www.zerotier.com;
     license = licenses.gpl3;
-    maintainers = with maintainers; [ sjmackenzie ];
+    maintainers = with maintainers; [ sjmackenzie zimbatm ];
     platforms = platforms.allBut [ "i686-linux" ];
   };
 }
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index 30c5fc6c4fd..5bfb0b45c1b 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -103,10 +103,10 @@ in rec {
   nix = nixStable;
 
   nixStable = common rec {
-    name = "nix-1.11.4";
+    name = "nix-1.11.5";
     src = fetchurl {
       url = "http://nixos.org/releases/nix/${name}/${name}.tar.xz";
-      sha256 = "937779ed2efaa3dec210250635401980acb99a6fea6d7374fbaea78231b36d34";
+      sha256 = "272361d091c735b0e80627fa23fb7c600957472301dd7e54d237069452f3addb";
     };
   };
 
diff --git a/pkgs/tools/security/enpass/data.json b/pkgs/tools/security/enpass/data.json
index 4e245d1c80f..b3625d928b5 100644
--- a/pkgs/tools/security/enpass/data.json
+++ b/pkgs/tools/security/enpass/data.json
@@ -1,12 +1,12 @@
 {
   "amd64": {
-    "path": "pool/main/e/enpass/enpass_5.3.0_amd64.deb", 
-    "sha256": "d9da061c6456281da836bdd78bdb7baeced4b7f1805bb2495e4f1d15038cf86b", 
-    "version": "5.3.0"
+    "path": "pool/main/e/enpass/enpass_5.4.0-4_amd64.deb", 
+    "sha256": "6b460fed2d7d8473e2b5d069dbe60263195b916c8b79a8fc7c2e8cb953134579", 
+    "version": "5.4.0.post4"
   }, 
   "i386": {
-    "path": "pool/main/e/enpass/enpass_5.3.0_i386.deb", 
-    "sha256": "58d9f3b83c2da477c13976e1826d112236eabd46a389de7e8767ee99ac41f469", 
-    "version": "5.3.0"
+    "path": "pool/main/e/enpass/enpass_5.4.0-4_i386.deb", 
+    "sha256": "1ec8088d5c3b2906d6820f96e1868c473e78dbe882f04e74a7816d19d43e3692", 
+    "version": "5.4.0.post4"
   }
 }
\ No newline at end of file
diff --git a/pkgs/tools/security/enpass/default.nix b/pkgs/tools/security/enpass/default.nix
index b7f7282d292..257af4645f6 100644
--- a/pkgs/tools/security/enpass/default.nix
+++ b/pkgs/tools/security/enpass/default.nix
@@ -1,7 +1,8 @@
 {stdenv, system, fetchurl, dpkg, openssl, xorg
 , glib, mesa, libpulseaudio, zlib, dbus, fontconfig, freetype
 , gtk2, pango, atk, cairo, gdk_pixbuf, jasper, xkeyboardconfig
-, makeWrapper , makeDesktopItem, python, pythonPackages, lib}:
+, makeWrapper , makeDesktopItem, python, pythonPackages, lib
+, libredirect, lsof}:
 assert system == "i686-linux" || system == "x86_64-linux";
 let
   all_data = (with builtins; fromJSON (readFile ./data.json));
@@ -13,7 +14,7 @@ let
   data = (with builtins; getAttr (getAttr system system_map) all_data);
 
   baseUrl = http://repo.sinew.in;
-  
+
   # used of both wrappers and libpath
   libPath = lib.makeLibraryPath (with xorg; [
     openssl
@@ -44,16 +45,6 @@ let
     inherit (data) version;
     name = "enpass-${version}";
 
-    desktopItem = makeDesktopItem {
-      name = "Enpass";
-      exec = "$out/bin/Enpass";
-      #icon = "Enpass";
-      desktopName = "Enpass";
-      genericName = "Password manager";
-      categories = "Application;Security;";
-    };
-
-
     src = fetchurl {
       inherit (data) sha256;
       url = "${baseUrl}/${data.path}";
@@ -74,28 +65,36 @@ let
     installPhase=''
       mkdir $out
       cp -r opt/Enpass/*  $out
+      cp -r usr/* $out
+      rm $out/bin/runenpass.sh
+      cp $out/bin/EnpassHelper/EnpassHelper{,.untampered}
 
-      # Make desktop item
-      mkdir -p "$out"/share/applications
-      cp "$desktopItem"/share/applications/* "$out"/share/applications/
-      mkdir -p "$out"/share/icons
+      sed \
+      	-i s@/opt/Enpass/bin/runenpass.sh@$out/bin/Enpass@ \
+      	$out/share/applications/enpass.desktop
 
-      patchelf  \
-        --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
-        $out/bin/Enpass
+      for i in $out/bin/{Enpass,EnpassHelper/EnpassHelper}; do
+        patchelf --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) $i
+      done
 
+      # The helper's sha256 sum must match, hence the use of libredirect.
+      # Also, lsof must be in the path for proper operation.
       wrapProgram $out/bin/Enpass \
         --set LD_LIBRARY_PATH "${libPath}:$out/lib:$out/plugins/sqldrivers" \
         --set QT_PLUGIN_PATH "$out/plugins" \
         --set QT_QPA_PLATFORM_PLUGIN_PATH "$out/plugins/platforms" \
-        --set QT_XKB_CONFIG_ROOT "${xkeyboardconfig}/share/X11/xkb"
+        --set QT_XKB_CONFIG_ROOT "${xkeyboardconfig}/share/X11/xkb" \
+        --set HIDE_TOOLBAR_LINE 0 \
+        --set LD_PRELOAD "${libredirect}/lib/libredirect.so" \
+        --set NIX_REDIRECTS "$out/bin/EnpassHelper/EnpassHelper=$out/bin/EnpassHelper/EnpassHelper.untampered" \
+        --prefix PATH : ${lsof}/bin
     '';
   };
   updater = {
     update = stdenv.mkDerivation rec {
       name = "enpass-update-script";
       SCRIPT =./update_script.py;
-      
+
       buildInputs = with pythonPackages; [python requests pathlib2 six attrs ];
       shellHook = ''
       exec python $SCRIPT --target pkgs/tools/security/enpass/data.json --repo ${baseUrl}
@@ -103,4 +102,4 @@ let
 
     };
   };
-in (package // {refresh = updater;}) 
+in (package // {refresh = updater;})
diff --git a/pkgs/tools/security/gencfsm/default.nix b/pkgs/tools/security/gencfsm/default.nix
index 871ba1d8b85..fbd32cdc22d 100644
--- a/pkgs/tools/security/gencfsm/default.nix
+++ b/pkgs/tools/security/gencfsm/default.nix
@@ -1,19 +1,18 @@
 { stdenv, fetchurl, autoconf, automake, intltool, libtool, pkgconfig, encfs
-, glib , gnome3, gtk3, libgnome_keyring, vala_0_23, wrapGAppsHook, xorg
-, libgee_0_6
+, glib , gnome3, gtk3, libgnome_keyring, vala, wrapGAppsHook, xorg
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.8.16";
+  version = "1.8.18";
   name = "gnome-encfs-manager-${version}";
 
   src = fetchurl {
-    url = "https://launchpad.net/gencfsm/trunk/1.8/+download/gnome-encfs-manager_${version}.tar.gz";
-    sha256 = "06sz6zcmvxkqww5gx4brcqs4hlpy9d8sal9nmw0pdsvh8k5vmpgn";
+    url = "https://launchpad.net/gencfsm/trunk/1.8/+download/gnome-encfs-manager_${version}.tar.xz";
+    sha256 = "1rpf683lxa78fmxxb0hnq7vdh3yn7qid2gqq67q9mk65sp9vdhdj";
   };
 
-  buildInputs = [ autoconf automake intltool libtool pkgconfig vala_0_23 glib encfs
-    gtk3 libgnome_keyring libgee_0_6 xorg.libSM xorg.libICE
+  buildInputs = [ autoconf automake intltool libtool pkgconfig vala glib encfs
+    gtk3 libgnome_keyring gnome3.libgee xorg.libSM xorg.libICE
     wrapGAppsHook ];
 
   patches = [ ./makefile-mkdir.patch ];
@@ -28,10 +27,10 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     homepage = http://www.libertyzero.com/GEncfsM/;
+    downloadPage = https://launchpad.net/gencfsm/;
     description = "EncFS manager and mounter with GNOME3 integration";
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
     maintainers = [ maintainers.spacefrogg ];
-    broken = true;
   };
 }
diff --git a/pkgs/tools/security/gnupg/21.nix b/pkgs/tools/security/gnupg/21.nix
index e91f91dbdea..b96226d5c3f 100644
--- a/pkgs/tools/security/gnupg/21.nix
+++ b/pkgs/tools/security/gnupg/21.nix
@@ -1,5 +1,5 @@
 { fetchurl, stdenv, pkgconfig, libgcrypt, libassuan, libksba, libiconv, npth
-, gettext, texinfo, pcsclite
+, gettext, texinfo, pcsclite, sqlite
 
 # Each of the dependencies below are optional.
 # Gnupg can be built without them at the cost of reduced functionality.
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     pkgconfig libgcrypt libassuan libksba libiconv npth gettext texinfo
-    readline libusb gnutls adns openldap zlib bzip2
+    readline libusb gnutls adns openldap zlib bzip2 sqlite
   ];
 
   NIX_LDFLAGS = stdenv.lib.optionalString stdenv.isDarwin "-lintl";
diff --git a/pkgs/tools/security/gorilla-bin/default.nix b/pkgs/tools/security/gorilla-bin/default.nix
new file mode 100644
index 00000000000..cbd260455d8
--- /dev/null
+++ b/pkgs/tools/security/gorilla-bin/default.nix
@@ -0,0 +1,41 @@
+{ fetchurl, makeWrapper, patchelf, pkgs, stdenv, libXft, libX11, freetype, fontconfig, libXrender, libXScrnSaver, libXext }:
+
+stdenv.mkDerivation rec {
+  name = "gorilla-bin-${version}";
+  version = "1.5.3.7";
+
+  src = fetchurl {
+    name = "gorilla1537_64.bin";
+    url = "http://gorilla.dp100.com/downloads/gorilla1537_64.bin";
+    sha256 = "19ir6x4c01825hpx2wbbcxkk70ymwbw4j03v8b2xc13ayylwzx0r";
+  };
+
+  buildInputs = [ patchelf makeWrapper ];
+  phases = [ "unpackPhase" "installPhase" ];
+
+  unpackCmd = ''
+    mkdir gorilla;
+    cp $curSrc gorilla/gorilla-${version};
+  '';
+
+  installPhase = let
+    interpreter = "$(< \"$NIX_CC/nix-support/dynamic-linker\")";
+    libPath = stdenv.lib.makeLibraryPath [ libXft libX11 freetype fontconfig libXrender libXScrnSaver libXext ];
+  in ''
+    mkdir -p $out/opt/password-gorilla
+    mkdir -p $out/bin
+    cp gorilla-${version} $out/opt/password-gorilla
+    chmod ugo+x $out/opt/password-gorilla/gorilla-${version}
+    patchelf --set-interpreter "${interpreter}" "$out/opt/password-gorilla/gorilla-${version}"
+    makeWrapper "$out/opt/password-gorilla/gorilla-${version}" "$out/bin/gorilla" \
+      --prefix LD_LIBRARY_PATH : "${libPath}"
+  '';
+
+  meta = {
+    description = "Password Gorilla is a Tk based password manager";
+    homepage = https://github.com/zdia/gorilla/wiki;
+    maintainers = [ stdenv.lib.maintainers.namore ];
+    platforms = [ "x86_64-linux" ];
+    license = stdenv.lib.licenses.gpl2;
+  };
+}
diff --git a/pkgs/tools/system/dd_rescue/default.nix b/pkgs/tools/system/dd_rescue/default.nix
index d98ceb84bc3..69cd8da4aef 100644
--- a/pkgs/tools/system/dd_rescue/default.nix
+++ b/pkgs/tools/system/dd_rescue/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, autoconf }:
 
 stdenv.mkDerivation rec {
-  version = "1.99";
+  version = "1.99.5";
   name = "dd_rescue-${version}";
 
   src = fetchurl {
-    sha256 = "0gkbwssn134fjyyvjvylyvassw4fwv5mbis9gcb969xdc64dfhg1";
+    sha256 = "0db94piwcdyqhnlhgfs0bfp0gp2mqyrcr2l5nljapgni31qk4p8j";
     url="http://www.garloff.de/kurt/linux/ddrescue/${name}.tar.bz2";
   };
 
diff --git a/pkgs/tools/system/ipmiutil/default.nix b/pkgs/tools/system/ipmiutil/default.nix
index 37f5131a037..059a5d9e416 100644
--- a/pkgs/tools/system/ipmiutil/default.nix
+++ b/pkgs/tools/system/ipmiutil/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   baseName = "ipmiutil";
-  version = "3.0.0";
+  version = "3.0.1";
   name = "${baseName}-${version}";
 
   src = fetchurl {
     url = "mirror://sourceforge/project/${baseName}/${name}.tar.gz";
-    sha256 = "0r986mvh6q1f7369qry2vq4rqc6kc4kq957s2g5qsl8m1pyw2mvx";
+    sha256 = "179hvarw0mk3j1z4102q4692q4mx06y259llr891by0pri0bsb3n";
   };
 
   buildInputs = [ openssl ];
diff --git a/pkgs/tools/text/codesearch/default.nix b/pkgs/tools/text/codesearch/default.nix
new file mode 100644
index 00000000000..ccb3f1d9ed9
--- /dev/null
+++ b/pkgs/tools/text/codesearch/default.nix
@@ -0,0 +1,26 @@
+# This file was generated by go2nix.
+{ stdenv, buildGoPackage, fetchgit, fetchhg, fetchbzr, fetchsvn }:
+
+buildGoPackage rec {
+  name = "codesearch-${version}";
+  version = "20150617-${stdenv.lib.strings.substring 0 7 rev}";
+  rev = "a45d81b686e85d01f2838439deaf72126ccd5a96";
+
+  goPackagePath = "github.com/google/codesearch";
+
+  src = fetchgit {
+    inherit rev;
+    url = "https://github.com/google/codesearch";
+    sha256 = "12bv3yz0l3bmsxbasfgv7scm9j719ch6pmlspv4bd4ix7wjpyhny";
+  };
+
+  goDeps = ./deps.nix;
+
+  meta = {
+    description = "Fast, indexed regexp search over large file trees";
+    homepage = "https://github.com/google/codesearch";
+    license = [ stdenv.lib.licenses.bsd3 ];
+    maintainers = [ stdenv.lib.maintainers.bennofs ];
+    platforms = stdenv.lib.platforms.unix;
+  };
+}
diff --git a/pkgs/tools/text/codesearch/deps.nix b/pkgs/tools/text/codesearch/deps.nix
new file mode 100644
index 00000000000..2d1dad70634
--- /dev/null
+++ b/pkgs/tools/text/codesearch/deps.nix
@@ -0,0 +1,3 @@
+# This file was generated by go2nix.
+[
+]