summary refs log tree commit diff
path: root/pkgs/tools
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs/tools')
-rw-r--r--pkgs/tools/X11/dragon-drop/default.nix3
-rw-r--r--pkgs/tools/X11/hsetroot/default.nix3
-rw-r--r--pkgs/tools/X11/keynav/default.nix3
-rw-r--r--pkgs/tools/X11/ksuperkey/default.nix3
-rw-r--r--pkgs/tools/X11/obconf/default.nix3
-rw-r--r--pkgs/tools/X11/vdpauinfo/default.nix3
-rw-r--r--pkgs/tools/X11/wmctrl/default.nix3
-rw-r--r--pkgs/tools/X11/xbindkeys-config/default.nix3
-rw-r--r--pkgs/tools/X11/xinput_calibrator/default.nix3
-rw-r--r--pkgs/tools/X11/xpra/default.nix3
-rw-r--r--pkgs/tools/X11/xpra/gtk3.nix3
-rw-r--r--pkgs/tools/X11/xrestop/default.nix3
-rw-r--r--pkgs/tools/X11/xsettingsd/default.nix3
-rw-r--r--pkgs/tools/X11/xtrace/default.nix3
-rw-r--r--pkgs/tools/X11/xwinmosaic/default.nix14
-rw-r--r--pkgs/tools/admin/awslogs/default.nix4
-rw-r--r--pkgs/tools/admin/fastlane/Gemfile2
-rw-r--r--pkgs/tools/admin/fastlane/Gemfile.lock139
-rw-r--r--pkgs/tools/admin/fastlane/default.nix17
-rw-r--r--pkgs/tools/admin/fastlane/gemset.nix469
-rw-r--r--pkgs/tools/admin/gtk-vnc/default.nix6
-rw-r--r--pkgs/tools/admin/intecture/agent.nix6
-rw-r--r--pkgs/tools/admin/intecture/auth.nix6
-rw-r--r--pkgs/tools/admin/intecture/cli.nix6
-rw-r--r--pkgs/tools/admin/salt/default.nix4
-rw-r--r--pkgs/tools/admin/tigervnc/default.nix3
-rw-r--r--pkgs/tools/archivers/cromfs/default.nix3
-rw-r--r--pkgs/tools/archivers/runzip/default.nix3
-rw-r--r--pkgs/tools/archivers/unrar/default.nix6
-rw-r--r--pkgs/tools/archivers/xarchive/default.nix3
-rw-r--r--pkgs/tools/archivers/xarchiver/default.nix3
-rw-r--r--pkgs/tools/audio/acoustid-fingerprinter/default.nix3
-rw-r--r--pkgs/tools/audio/gvolicon/default.nix3
-rw-r--r--pkgs/tools/audio/mpdris2/default.nix3
-rw-r--r--pkgs/tools/audio/pa-applet/default.nix3
-rw-r--r--pkgs/tools/audio/pasystray/default.nix3
-rw-r--r--pkgs/tools/audio/playerctl/default.nix3
-rw-r--r--pkgs/tools/audio/volumeicon/default.nix3
-rw-r--r--pkgs/tools/backup/attic/default.nix3
-rw-r--r--pkgs/tools/backup/borg/default.nix6
-rw-r--r--pkgs/tools/backup/btrbk/default.nix4
-rw-r--r--pkgs/tools/backup/duplicity/default.nix2
-rw-r--r--pkgs/tools/backup/partimage/default.nix3
-rw-r--r--pkgs/tools/bluetooth/obex-data-server/default.nix3
-rw-r--r--pkgs/tools/cd-dvd/cdrdao/default.nix3
-rw-r--r--pkgs/tools/cd-dvd/vobsub2srt/default.nix3
-rw-r--r--pkgs/tools/compression/pixz/default.nix3
-rw-r--r--pkgs/tools/filesystems/archivemount/default.nix3
-rw-r--r--pkgs/tools/filesystems/bcache-tools/default.nix3
-rw-r--r--pkgs/tools/filesystems/bcachefs-tools/default.nix3
-rw-r--r--pkgs/tools/filesystems/bindfs/default.nix3
-rw-r--r--pkgs/tools/filesystems/btrfs-progs/4.4.1.nix31
-rw-r--r--pkgs/tools/filesystems/btrfs-progs/default.nix7
-rw-r--r--pkgs/tools/filesystems/ciopfs/default.nix3
-rw-r--r--pkgs/tools/filesystems/cryfs/default.nix79
-rw-r--r--pkgs/tools/filesystems/cryfs/skip-failing-test-large-malloc.patch34
-rw-r--r--pkgs/tools/filesystems/cryfs/test-no-network.patch24
-rw-r--r--pkgs/tools/filesystems/curlftpfs/default.nix3
-rw-r--r--pkgs/tools/filesystems/djmount/default.nix3
-rw-r--r--pkgs/tools/filesystems/duperemove/default.nix3
-rw-r--r--pkgs/tools/filesystems/f2fs-tools/default.nix4
-rw-r--r--pkgs/tools/filesystems/fuse-7z-ng/default.nix3
-rw-r--r--pkgs/tools/filesystems/fuseiso/default.nix3
-rw-r--r--pkgs/tools/filesystems/genimage/default.nix3
-rw-r--r--pkgs/tools/filesystems/go-mtpfs/default.nix4
-rw-r--r--pkgs/tools/filesystems/gocrypfs/default.nix3
-rw-r--r--pkgs/tools/filesystems/hubicfuse/default.nix3
-rw-r--r--pkgs/tools/filesystems/irods/common.nix2
-rw-r--r--pkgs/tools/filesystems/irods/default.nix2
-rw-r--r--pkgs/tools/filesystems/jmtpfs/default.nix3
-rw-r--r--pkgs/tools/filesystems/mhddfs/default.nix3
-rw-r--r--pkgs/tools/filesystems/mtpfs/default.nix3
-rw-r--r--pkgs/tools/filesystems/netatalk/default.nix3
-rw-r--r--pkgs/tools/filesystems/nixpart/0.4/cryptsetup.nix3
-rw-r--r--pkgs/tools/filesystems/nixpart/0.4/lvm2.nix3
-rw-r--r--pkgs/tools/filesystems/nixpart/0.4/pyparted.nix2
-rw-r--r--pkgs/tools/filesystems/relfs/default.nix3
-rw-r--r--pkgs/tools/filesystems/smbnetfs/default.nix3
-rw-r--r--pkgs/tools/filesystems/snapraid/default.nix3
-rw-r--r--pkgs/tools/filesystems/u3-tool/default.nix22
-rw-r--r--pkgs/tools/filesystems/wdfs/default.nix3
-rw-r--r--pkgs/tools/filesystems/zkfuse/default.nix3
-rw-r--r--pkgs/tools/graphics/dmtx-utils/default.nix5
-rw-r--r--pkgs/tools/graphics/editres/default.nix3
-rw-r--r--pkgs/tools/graphics/escrotum/default.nix25
-rw-r--r--pkgs/tools/graphics/exif/default.nix3
-rw-r--r--pkgs/tools/graphics/ggobi/default.nix3
-rw-r--r--pkgs/tools/graphics/glmark2/default.nix3
-rw-r--r--pkgs/tools/graphics/gromit-mpx/default.nix3
-rw-r--r--pkgs/tools/graphics/leela/default.nix3
-rw-r--r--pkgs/tools/graphics/logstalgia/default.nix3
-rw-r--r--pkgs/tools/graphics/pdf2svg/default.nix3
-rw-r--r--pkgs/tools/graphics/pngnq/default.nix3
-rw-r--r--pkgs/tools/graphics/pngquant/default.nix3
-rw-r--r--pkgs/tools/graphics/quirc/default.nix8
-rw-r--r--pkgs/tools/graphics/unpaper/default.nix3
-rw-r--r--pkgs/tools/inputmethods/fcitx-engines/fcitx-anthy/default.nix3
-rw-r--r--pkgs/tools/inputmethods/fcitx-engines/fcitx-chewing/default.nix3
-rw-r--r--pkgs/tools/inputmethods/fcitx-engines/fcitx-cloudpinyin/default.nix3
-rw-r--r--pkgs/tools/inputmethods/fcitx-engines/fcitx-hangul/default.nix3
-rw-r--r--pkgs/tools/inputmethods/fcitx-engines/fcitx-libpinyin/default.nix3
-rw-r--r--pkgs/tools/inputmethods/fcitx-engines/fcitx-m17n/default.nix3
-rw-r--r--pkgs/tools/inputmethods/fcitx-engines/fcitx-unikey/default.nix3
-rw-r--r--pkgs/tools/inputmethods/fcitx/fcitx-configtool.nix3
-rw-r--r--pkgs/tools/inputmethods/ibus-engines/ibus-table-others/default.nix3
-rw-r--r--pkgs/tools/inputmethods/ibus-engines/ibus-table/default.nix2
-rw-r--r--pkgs/tools/inputmethods/ibus/ibus-qt.nix3
-rw-r--r--pkgs/tools/inputmethods/nabi/default.nix3
-rw-r--r--pkgs/tools/misc/appdata-tools/default.nix3
-rw-r--r--pkgs/tools/misc/autorandr/default.nix11
-rw-r--r--pkgs/tools/misc/blink1-tool/default.nix3
-rw-r--r--pkgs/tools/misc/brltty/default.nix3
-rw-r--r--pkgs/tools/misc/colord-gtk/default.nix3
-rw-r--r--pkgs/tools/misc/colord/default.nix5
-rw-r--r--pkgs/tools/misc/cunit/default.nix3
-rw-r--r--pkgs/tools/misc/dbus-map/default.nix3
-rw-r--r--pkgs/tools/misc/desktop-file-utils/default.nix3
-rw-r--r--pkgs/tools/misc/direnv/default.nix8
-rw-r--r--pkgs/tools/misc/duc/default.nix3
-rw-r--r--pkgs/tools/misc/eot-utilities/default.nix2
-rw-r--r--pkgs/tools/misc/expect/default.nix2
-rw-r--r--pkgs/tools/misc/fd/default.nix6
-rw-r--r--pkgs/tools/misc/fontforge/default.nix3
-rw-r--r--pkgs/tools/misc/fzf/default.nix4
-rw-r--r--pkgs/tools/misc/gbdfed/default.nix3
-rw-r--r--pkgs/tools/misc/goaccess/default.nix2
-rw-r--r--pkgs/tools/misc/grub/default.nix3
-rw-r--r--pkgs/tools/misc/gsmartcontrol/default.nix3
-rw-r--r--pkgs/tools/misc/kalibrate-rtl/default.nix3
-rw-r--r--pkgs/tools/misc/lbdb/add-methods-to-rc.patch11
-rw-r--r--pkgs/tools/misc/lbdb/default.nix32
-rw-r--r--pkgs/tools/misc/ldapvi/default.nix3
-rw-r--r--pkgs/tools/misc/libbitcoin/libbitcoin-client.nix3
-rw-r--r--pkgs/tools/misc/libbitcoin/libbitcoin-explorer.nix3
-rw-r--r--pkgs/tools/misc/libbitcoin/libbitcoin.nix3
-rw-r--r--pkgs/tools/misc/lnav/default.nix1
-rw-r--r--pkgs/tools/misc/mc/default.nix3
-rw-r--r--pkgs/tools/misc/mdbtools/default.nix3
-rw-r--r--pkgs/tools/misc/mdbtools/git.nix3
-rw-r--r--pkgs/tools/misc/mprime/default.nix3
-rw-r--r--pkgs/tools/misc/pal/default.nix3
-rw-r--r--pkgs/tools/misc/plantuml/default.nix6
-rw-r--r--pkgs/tools/misc/qjoypad/default.nix3
-rw-r--r--pkgs/tools/misc/riemann-c-client/default.nix3
-rw-r--r--pkgs/tools/misc/rmlint/default.nix3
-rw-r--r--pkgs/tools/misc/rpm-ostree/default.nix3
-rw-r--r--pkgs/tools/misc/tmux/default.nix4
-rw-r--r--pkgs/tools/misc/toilet/default.nix3
-rw-r--r--pkgs/tools/misc/ttwatch/default.nix6
-rw-r--r--pkgs/tools/misc/unicode/default.nix1
-rw-r--r--pkgs/tools/misc/urjtag/default.nix3
-rw-r--r--pkgs/tools/misc/wv/default.nix3
-rw-r--r--pkgs/tools/misc/wv2/default.nix3
-rw-r--r--pkgs/tools/misc/xsel/default.nix3
-rw-r--r--pkgs/tools/misc/yubico-piv-tool/default.nix3
-rw-r--r--pkgs/tools/networking/aircrack-ng/default.nix3
-rw-r--r--pkgs/tools/networking/argus-clients/default.nix3
-rw-r--r--pkgs/tools/networking/argus/default.nix3
-rw-r--r--pkgs/tools/networking/assh/default.nix4
-rw-r--r--pkgs/tools/networking/badvpn/default.nix4
-rw-r--r--pkgs/tools/networking/ccnet/default.nix3
-rw-r--r--pkgs/tools/networking/connmanui/default.nix3
-rw-r--r--pkgs/tools/networking/curl/default.nix8
-rw-r--r--pkgs/tools/networking/davix/default.nix3
-rw-r--r--pkgs/tools/networking/dhcpcd/default.nix3
-rw-r--r--pkgs/tools/networking/djbdns/default.nix8
-rw-r--r--pkgs/tools/networking/djbdns/fix-nix-usernamespace-build.patch10
-rw-r--r--pkgs/tools/networking/dnstracer/default.nix23
-rw-r--r--pkgs/tools/networking/driftnet/default.nix3
-rw-r--r--pkgs/tools/networking/fastd/default.nix5
-rw-r--r--pkgs/tools/networking/gftp/default.nix3
-rw-r--r--pkgs/tools/networking/goklp/default.nix24
-rw-r--r--pkgs/tools/networking/goklp/deps.nix56
-rw-r--r--pkgs/tools/networking/gupnp-tools/default.nix3
-rw-r--r--pkgs/tools/networking/httpie/default.nix1
-rw-r--r--pkgs/tools/networking/hyenae/default.nix3
-rw-r--r--pkgs/tools/networking/isync/default.nix3
-rw-r--r--pkgs/tools/networking/jnettop/default.nix3
-rw-r--r--pkgs/tools/networking/libreswan/default.nix4
-rw-r--r--pkgs/tools/networking/maildrop/default.nix3
-rw-r--r--pkgs/tools/networking/mitmproxy/default.nix17
-rw-r--r--pkgs/tools/networking/mosh/default.nix3
-rw-r--r--pkgs/tools/networking/ndjbdns/default.nix3
-rw-r--r--pkgs/tools/networking/netalyzr/default.nix14
-rw-r--r--pkgs/tools/networking/nss-pam-ldapd/default.nix3
-rw-r--r--pkgs/tools/networking/openconnect/default.nix2
-rw-r--r--pkgs/tools/networking/openfortivpn/default.nix1
-rw-r--r--pkgs/tools/networking/openssh/default.nix3
-rw-r--r--pkgs/tools/networking/p2p/libtorrent/default.nix3
-rw-r--r--pkgs/tools/networking/p2p/rtorrent/default.nix3
-rw-r--r--pkgs/tools/networking/pykms/default.nix82
-rw-r--r--pkgs/tools/networking/samplicator/default.nix3
-rw-r--r--pkgs/tools/networking/tlspool/default.nix3
-rw-r--r--pkgs/tools/networking/tracebox/default.nix3
-rw-r--r--pkgs/tools/package-management/apt/default.nix15
-rw-r--r--pkgs/tools/package-management/disnix/default.nix3
-rw-r--r--pkgs/tools/package-management/disnix/disnixos/default.nix3
-rw-r--r--pkgs/tools/package-management/nix-bundle/default.nix5
-rw-r--r--pkgs/tools/package-management/nix-index/default.nix3
-rw-r--r--pkgs/tools/package-management/nix/default.nix6
-rw-r--r--pkgs/tools/package-management/rpm/default.nix3
-rw-r--r--pkgs/tools/security/aespipe/default.nix4
-rw-r--r--pkgs/tools/security/ccid/default.nix2
-rw-r--r--pkgs/tools/security/crackxls/default.nix3
-rw-r--r--pkgs/tools/security/ecryptfs/default.nix3
-rw-r--r--pkgs/tools/security/enpass/data.json12
-rw-r--r--pkgs/tools/security/fpm2/default.nix3
-rw-r--r--pkgs/tools/security/gencfsm/default.nix3
-rw-r--r--pkgs/tools/security/gnupg/22.nix3
-rw-r--r--pkgs/tools/security/kbfs/default.nix8
-rw-r--r--pkgs/tools/security/keybase-gui/default.nix4
-rw-r--r--pkgs/tools/security/keybase/default.nix8
-rw-r--r--pkgs/tools/security/mfcuk/default.nix3
-rw-r--r--pkgs/tools/security/mfoc/default.nix3
-rw-r--r--pkgs/tools/security/modsecurity/Makefile.in.patch17
-rw-r--r--pkgs/tools/security/modsecurity/default.nix46
-rw-r--r--pkgs/tools/security/nmap/default.nix3
-rw-r--r--pkgs/tools/security/opensc/default.nix3
-rw-r--r--pkgs/tools/security/qdigidoc/default.nix3
-rw-r--r--pkgs/tools/security/qesteidutil/default.nix3
-rw-r--r--pkgs/tools/security/sbsigntool/default.nix3
-rw-r--r--pkgs/tools/security/scrypt/default.nix19
-rw-r--r--pkgs/tools/security/stoken/default.nix4
-rw-r--r--pkgs/tools/security/sudolikeaboss/default.nix4
-rw-r--r--pkgs/tools/security/tpm-luks/default.nix3
-rw-r--r--pkgs/tools/security/trousers/default.nix3
-rw-r--r--pkgs/tools/system/bootchart/default.nix3
-rw-r--r--pkgs/tools/system/chase/default.nix3
-rw-r--r--pkgs/tools/system/collectd/default.nix3
-rw-r--r--pkgs/tools/system/das_watchdog/default.nix3
-rw-r--r--pkgs/tools/system/fakechroot/default.nix3
-rw-r--r--pkgs/tools/system/gdmap/default.nix3
-rw-r--r--pkgs/tools/system/hardinfo/default.nix3
-rw-r--r--pkgs/tools/system/illum/default.nix3
-rw-r--r--pkgs/tools/system/lshw/default.nix6
-rw-r--r--pkgs/tools/system/netdata/default.nix3
-rw-r--r--pkgs/tools/system/pciutils/default.nix3
-rw-r--r--pkgs/tools/system/proot/default.nix12
-rw-r--r--pkgs/tools/system/supervise/default.nix27
-rw-r--r--pkgs/tools/system/thermald/default.nix3
-rw-r--r--pkgs/tools/system/vboot_reference/default.nix3
-rw-r--r--pkgs/tools/system/wsmancli/default.nix3
-rw-r--r--pkgs/tools/text/ebook-tools/default.nix3
-rw-r--r--pkgs/tools/text/qshowdiff/default.nix3
-rw-r--r--pkgs/tools/text/sift/default.nix4
-rw-r--r--pkgs/tools/text/silver-searcher/default.nix3
-rw-r--r--pkgs/tools/text/xml/xml2/default.nix3
-rw-r--r--pkgs/tools/text/xml/xmlstarlet/default.nix3
-rw-r--r--pkgs/tools/typesetting/hevea/default.nix6
-rw-r--r--pkgs/tools/typesetting/tex/texlive/bin.nix15
-rw-r--r--pkgs/tools/typesetting/xmlroff/default.nix2
-rw-r--r--pkgs/tools/video/mjpegtools/default.nix3
-rw-r--r--pkgs/tools/video/swfmill/default.nix3
-rw-r--r--pkgs/tools/virtualization/awsebcli/default.nix4
254 files changed, 1649 insertions, 400 deletions
diff --git a/pkgs/tools/X11/dragon-drop/default.nix b/pkgs/tools/X11/dragon-drop/default.nix
index 3dfc7abbc77..232c4a636fb 100644
--- a/pkgs/tools/X11/dragon-drop/default.nix
+++ b/pkgs/tools/X11/dragon-drop/default.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation rec {
     sha256 = "03vdbmqlbmk3j2ay1wy6snrm2y27faxz7qv81vyzjzngj345095a";
   };
 
-  buildInputs = [ gtk pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ gtk ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/tools/X11/hsetroot/default.nix b/pkgs/tools/X11/hsetroot/default.nix
index 9de29da9b44..5baf6a4b51f 100644
--- a/pkgs/tools/X11/hsetroot/default.nix
+++ b/pkgs/tools/X11/hsetroot/default.nix
@@ -17,7 +17,8 @@ stdenv.mkDerivation rec {
     sha256 = "1px1p3wz7ji725z9nlwb0x0h6lnnvnpz15sblzzq7zrijl3wz65x";
   };
 
-  buildInputs = [ autoconf automake imlib2 libtool libX11 pkgconfig xproto ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ autoconf automake imlib2 libtool libX11 xproto ];
 
   patches = [ underlinkingPatch ];
 
diff --git a/pkgs/tools/X11/keynav/default.nix b/pkgs/tools/X11/keynav/default.nix
index edddf42d2c5..23e528297ee 100644
--- a/pkgs/tools/X11/keynav/default.nix
+++ b/pkgs/tools/X11/keynav/default.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation rec {
     sha256 = "0v1m8w877fcrk918p6b6q3753dsz8i1f4mb9bi064cp11kh85nq5";
   };
 
-  buildInputs = [ pkgconfig libX11 xextproto libXtst libXi libXext libXinerama
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libX11 xextproto libXtst libXi libXext libXinerama
                   glib cairo xdotool ];
 
   patchPhase = ''
diff --git a/pkgs/tools/X11/ksuperkey/default.nix b/pkgs/tools/X11/ksuperkey/default.nix
index a753f9bd170..cd80e328657 100644
--- a/pkgs/tools/X11/ksuperkey/default.nix
+++ b/pkgs/tools/X11/ksuperkey/default.nix
@@ -3,8 +3,9 @@
 stdenv.mkDerivation rec {
   name = "ksuperkey-git-2015-07-21";
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    libX11 libXtst pkgconfig inputproto libXi xproto xextproto
+    libX11 libXtst inputproto libXi xproto xextproto
   ];
 
   src = fetchgit {
diff --git a/pkgs/tools/X11/obconf/default.nix b/pkgs/tools/X11/obconf/default.nix
index e25fa43f180..2e02338631b 100644
--- a/pkgs/tools/X11/obconf/default.nix
+++ b/pkgs/tools/X11/obconf/default.nix
@@ -10,8 +10,9 @@ stdenv.mkDerivation rec {
     sha256 = "1fanjdmd8727kk74x5404vi8v7s4kpq48l583d12fsi4xvsfb8vi";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    pkgconfig gtk2 libglade libSM openbox imlib2 libstartup_notification
+    gtk2 libglade libSM openbox imlib2 libstartup_notification
     makeWrapper
   ];
 
diff --git a/pkgs/tools/X11/vdpauinfo/default.nix b/pkgs/tools/X11/vdpauinfo/default.nix
index 7a18a6a98b6..a20b7d69f3d 100644
--- a/pkgs/tools/X11/vdpauinfo/default.nix
+++ b/pkgs/tools/X11/vdpauinfo/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "1i2b0k9h8r0lnxlrkgqzmrjakgaw3f1ygqqwzx8w6676g85rcm20";
   };
 
-  buildInputs = [ pkgconfig libvdpau ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libvdpau ];
 
   meta = with stdenv.lib; {
     homepage = http://people.freedesktop.org/~aplattner/vdpau/;
diff --git a/pkgs/tools/X11/wmctrl/default.nix b/pkgs/tools/X11/wmctrl/default.nix
index 2e23e7bd4de..e0118b8b27b 100644
--- a/pkgs/tools/X11/wmctrl/default.nix
+++ b/pkgs/tools/X11/wmctrl/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "1afclc57b9017a73mfs9w7lbdvdipmf9q0xdk116f61gnvyix2np";
   };
  
-  buildInputs = [ libX11 libXmu glib pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libX11 libXmu glib ];
 
   patches = [ ./64-bit-data.patch ];
 
diff --git a/pkgs/tools/X11/xbindkeys-config/default.nix b/pkgs/tools/X11/xbindkeys-config/default.nix
index cef071bb3b6..e3d9ecd5953 100644
--- a/pkgs/tools/X11/xbindkeys-config/default.nix
+++ b/pkgs/tools/X11/xbindkeys-config/default.nix
@@ -4,7 +4,8 @@ stdenv.mkDerivation rec {
   name = "xbindkeys-config-${version}";
   version = "0.1.3";
 
-  buildInputs = [ gtk pkgconfig makeWrapper ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ gtk makeWrapper ];
 
   src = fetchurl {
     url = "mirror://debian/pool/main/x/xbindkeys-config/xbindkeys-config_${version}.orig.tar.gz";
diff --git a/pkgs/tools/X11/xinput_calibrator/default.nix b/pkgs/tools/X11/xinput_calibrator/default.nix
index 9b50f00beef..8376b2041b3 100644
--- a/pkgs/tools/X11/xinput_calibrator/default.nix
+++ b/pkgs/tools/X11/xinput_calibrator/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
 
   preConfigure = "./autogen.sh --with-gui=X11";
 
-  buildInputs = [ inputproto libXi autoconf automake libtool m4 xlibsWrapper pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ inputproto libXi autoconf automake libtool m4 xlibsWrapper ];
 
   meta = {
     homepage = https://github.com/tias/xinput_calibrator;
diff --git a/pkgs/tools/X11/xpra/default.nix b/pkgs/tools/X11/xpra/default.nix
index aa0ae36fdd2..00f28c2c7ba 100644
--- a/pkgs/tools/X11/xpra/default.nix
+++ b/pkgs/tools/X11/xpra/default.nix
@@ -18,8 +18,9 @@ in buildPythonApplication rec {
     sha256 = "09hzgbsj9v5qyh41rbz968ipi7016jk66b60vm6piryna9kbnha3";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    cython pkgconfig
+    cython
 
     xorg.libX11 xorg.renderproto xorg.libXrender xorg.libXi xorg.inputproto xorg.kbproto
     xorg.randrproto xorg.damageproto xorg.compositeproto xorg.xextproto xorg.recordproto
diff --git a/pkgs/tools/X11/xpra/gtk3.nix b/pkgs/tools/X11/xpra/gtk3.nix
index f66b7389f31..92f1827156b 100644
--- a/pkgs/tools/X11/xpra/gtk3.nix
+++ b/pkgs/tools/X11/xpra/gtk3.nix
@@ -19,9 +19,8 @@ buildPythonApplication rec {
     substituteInPlace xpra/client/gtk3/cairo_workaround.pyx --replace 'pycairo/pycairo.h' 'py3cairo.h'
   '';
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    pkgconfig
-
     xorg.libX11 xorg.renderproto xorg.libXrender xorg.libXi xorg.inputproto xorg.kbproto
     xorg.randrproto xorg.damageproto xorg.compositeproto xorg.xextproto xorg.recordproto
     xorg.xproto xorg.fixesproto xorg.libXtst xorg.libXfixes xorg.libXcomposite xorg.libXdamage
diff --git a/pkgs/tools/X11/xrestop/default.nix b/pkgs/tools/X11/xrestop/default.nix
index 2bd6392456e..76e502d7598 100644
--- a/pkgs/tools/X11/xrestop/default.nix
+++ b/pkgs/tools/X11/xrestop/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0mz27jpij8am1s32i63mdm58znfijcpfhdqq1npbmvgclyagrhk7";
   };
 
-  buildInputs = [ pkgconfig xorg.libX11 xorg.libXres xorg.libXext ncurses ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ xorg.libX11 xorg.libXres xorg.libXext ncurses ];
 
   meta = {
     platforms = stdenv.lib.platforms.unix;
diff --git a/pkgs/tools/X11/xsettingsd/default.nix b/pkgs/tools/X11/xsettingsd/default.nix
index c05aeff9337..239b01e1345 100644
--- a/pkgs/tools/X11/xsettingsd/default.nix
+++ b/pkgs/tools/X11/xsettingsd/default.nix
@@ -15,7 +15,8 @@ stdenv.mkDerivation rec {
     ./SConstruct.patch
   ];
 
-  buildInputs = [ libX11 scons pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libX11 scons ];
   buildPhase = ''
     mkdir -p "$out"
     scons \
diff --git a/pkgs/tools/X11/xtrace/default.nix b/pkgs/tools/X11/xtrace/default.nix
index 35342035c9d..1905ed9752c 100644
--- a/pkgs/tools/X11/xtrace/default.nix
+++ b/pkgs/tools/X11/xtrace/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation {
     sha256 = "1g26hr6rl7bbb9cwqk606nbbapslq3wnsy8j28azrgi8hgfqhjfi";
   };
 
-  buildInputs = [ libX11 makeWrapper autoreconfHook ];
+  nativeBuildInputs = [ autoreconfHook ];
+  buildInputs = [ libX11 makeWrapper ];
 
   preConfigure = ''
     ./autogen.sh
diff --git a/pkgs/tools/X11/xwinmosaic/default.nix b/pkgs/tools/X11/xwinmosaic/default.nix
index 40956f2acc4..e36808db0b8 100644
--- a/pkgs/tools/X11/xwinmosaic/default.nix
+++ b/pkgs/tools/X11/xwinmosaic/default.nix
@@ -1,18 +1,18 @@
-{stdenv, fetchgit, gtk2, cmake, pkgconfig}:
-let
-  buildInputs = [
-    gtk2 cmake pkgconfig
-  ];
-in
+{ stdenv, fetchgit, gtk2, cmake, pkgconfig }:
+
 stdenv.mkDerivation rec {
   version = "0.4.2";
   name = "xwinmosaic-${version}";
-  inherit buildInputs;
+
   src = fetchgit {
     url = "https://github.com/soulthreads/xwinmosaic/";
     rev = "refs/tags/v0.4.2";
     sha256 = "16qhrpgn84fz0q3nfvaz5sisc82zk6y7c0sbvbr69zfx5fwbs1rr";
   };
+
+  nativeBuildInputs = [ pkgconfig cmake ];
+  buildInputs = [ gtk2 ];
+
   meta = {
     inherit version;
     description = ''X window switcher drawing a colourful grid'';
diff --git a/pkgs/tools/admin/awslogs/default.nix b/pkgs/tools/admin/awslogs/default.nix
index dffef09a5d4..ec7febaa598 100644
--- a/pkgs/tools/admin/awslogs/default.nix
+++ b/pkgs/tools/admin/awslogs/default.nix
@@ -2,13 +2,13 @@
 
 pythonPackages.buildPythonApplication rec {
   name = "awslogs-${version}";
-  version = "0.7";
+  version = "0.10";
 
   src = fetchFromGitHub {
     owner = "jorgebastida";
     repo = "awslogs";
     rev = "${version}";
-    sha256 = "0dqf26h595l1fcnagxi8zsdarsxg3smsihxaqrvnki8fshhfdqsm";
+    sha256 = "18s3xxdhhbz96mgj9ipgyrdcax3p9gy8gpmr0rblw8g0grj31dsp";
   };
 
   doCheck = false;
diff --git a/pkgs/tools/admin/fastlane/Gemfile b/pkgs/tools/admin/fastlane/Gemfile
new file mode 100644
index 00000000000..1fa8dbca63b
--- /dev/null
+++ b/pkgs/tools/admin/fastlane/Gemfile
@@ -0,0 +1,2 @@
+source 'https://rubygems.org'
+gem 'fastlane'
diff --git a/pkgs/tools/admin/fastlane/Gemfile.lock b/pkgs/tools/admin/fastlane/Gemfile.lock
new file mode 100644
index 00000000000..5f15a9d0455
--- /dev/null
+++ b/pkgs/tools/admin/fastlane/Gemfile.lock
@@ -0,0 +1,139 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    CFPropertyList (2.3.5)
+    addressable (2.5.2)
+      public_suffix (>= 2.0.2, < 4.0)
+    babosa (1.0.2)
+    claide (1.0.2)
+    colored (1.2)
+    colored2 (3.1.2)
+    commander-fastlane (4.4.5)
+      highline (~> 1.7.2)
+    declarative (0.0.10)
+    declarative-option (0.1.0)
+    domain_name (0.5.20170404)
+      unf (>= 0.0.5, < 1.0.0)
+    dotenv (2.2.1)
+    excon (0.59.0)
+    faraday (0.13.1)
+      multipart-post (>= 1.2, < 3)
+    faraday-cookie_jar (0.0.6)
+      faraday (>= 0.7.4)
+      http-cookie (~> 1.0.0)
+    faraday_middleware (0.12.2)
+      faraday (>= 0.7.4, < 1.0)
+    fastimage (2.1.0)
+    fastlane (2.60.1)
+      CFPropertyList (>= 2.3, < 3.0.0)
+      addressable (>= 2.3, < 3.0.0)
+      babosa (>= 1.0.2, < 2.0.0)
+      bundler (>= 1.12.0, < 2.0.0)
+      colored
+      commander-fastlane (>= 4.4.5, < 5.0.0)
+      dotenv (>= 2.1.1, < 3.0.0)
+      excon (>= 0.45.0, < 1.0.0)
+      faraday (~> 0.9)
+      faraday-cookie_jar (~> 0.0.6)
+      faraday_middleware (~> 0.9)
+      fastimage (>= 2.1.0, < 3.0.0)
+      gh_inspector (>= 1.0.1, < 2.0.0)
+      google-api-client (>= 0.13.1, < 0.14.0)
+      highline (>= 1.7.2, < 2.0.0)
+      json (< 3.0.0)
+      mini_magick (~> 4.5.1)
+      multi_json
+      multi_xml (~> 0.5)
+      multipart-post (~> 2.0.0)
+      plist (>= 3.1.0, < 4.0.0)
+      public_suffix (~> 2.0.0)
+      rubyzip (>= 1.1.0, < 2.0.0)
+      security (= 0.1.3)
+      slack-notifier (>= 1.3, < 2.0.0)
+      terminal-notifier (>= 1.6.2, < 2.0.0)
+      terminal-table (>= 1.4.5, < 2.0.0)
+      tty-screen (~> 0.5.0)
+      word_wrap (~> 1.0.0)
+      xcodeproj (>= 1.5.0, < 2.0.0)
+      xcpretty (>= 0.2.4, < 1.0.0)
+      xcpretty-travis-formatter (>= 0.0.3)
+    gh_inspector (1.0.3)
+    google-api-client (0.13.6)
+      addressable (~> 2.5, >= 2.5.1)
+      googleauth (~> 0.5)
+      httpclient (>= 2.8.1, < 3.0)
+      mime-types (~> 3.0)
+      representable (~> 3.0)
+      retriable (>= 2.0, < 4.0)
+    googleauth (0.5.3)
+      faraday (~> 0.12)
+      jwt (~> 1.4)
+      logging (~> 2.0)
+      memoist (~> 0.12)
+      multi_json (~> 1.11)
+      os (~> 0.9)
+      signet (~> 0.7)
+    highline (1.7.8)
+    http-cookie (1.0.3)
+      domain_name (~> 0.5)
+    httpclient (2.8.3)
+    json (2.1.0)
+    jwt (1.5.6)
+    little-plugger (1.1.4)
+    logging (2.2.2)
+      little-plugger (~> 1.1)
+      multi_json (~> 1.10)
+    memoist (0.16.0)
+    mime-types (3.1)
+      mime-types-data (~> 3.2015)
+    mime-types-data (3.2016.0521)
+    mini_magick (4.5.1)
+    multi_json (1.12.2)
+    multi_xml (0.6.0)
+    multipart-post (2.0.0)
+    nanaimo (0.2.3)
+    os (0.9.6)
+    plist (3.3.0)
+    public_suffix (2.0.5)
+    representable (3.0.4)
+      declarative (< 0.1.0)
+      declarative-option (< 0.2.0)
+      uber (< 0.2.0)
+    retriable (3.1.1)
+    rouge (2.0.7)
+    rubyzip (1.2.1)
+    security (0.1.3)
+    signet (0.7.3)
+      addressable (~> 2.3)
+      faraday (~> 0.9)
+      jwt (~> 1.5)
+      multi_json (~> 1.10)
+    slack-notifier (1.5.1)
+    terminal-notifier (1.8.0)
+    terminal-table (1.8.0)
+      unicode-display_width (~> 1.1, >= 1.1.1)
+    tty-screen (0.5.0)
+    uber (0.1.0)
+    unf (0.1.4)
+      unf_ext
+    unf_ext (0.0.7.4)
+    unicode-display_width (1.3.0)
+    word_wrap (1.0.0)
+    xcodeproj (1.5.2)
+      CFPropertyList (~> 2.3.3)
+      claide (>= 1.0.2, < 2.0)
+      colored2 (~> 3.1)
+      nanaimo (~> 0.2.3)
+    xcpretty (0.2.8)
+      rouge (~> 2.0.7)
+    xcpretty-travis-formatter (0.0.4)
+      xcpretty (~> 0.2, >= 0.0.7)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  fastlane
+
+BUNDLED WITH
+   1.14.6
diff --git a/pkgs/tools/admin/fastlane/default.nix b/pkgs/tools/admin/fastlane/default.nix
new file mode 100644
index 00000000000..b9008c919bf
--- /dev/null
+++ b/pkgs/tools/admin/fastlane/default.nix
@@ -0,0 +1,17 @@
+{ lib, bundlerEnv, ruby }:
+
+bundlerEnv rec {
+  inherit ruby;
+  pname = "fastlane";
+  gemdir = ./.;
+
+  meta = with lib; {
+    description     = "A tool to automate building and releasing iOS and Android apps";
+    longDescription = "fastlane is a tool for iOS and Android developers to automate tedious tasks like generating screenshots, dealing with provisioning profiles, and releasing your application.";
+    homepage        = https://github.com/fastlane/fastlane;
+    license         = licenses.mit;
+    maintainers     = with maintainers; [
+      peterromfeldhk
+    ];
+  };
+}
diff --git a/pkgs/tools/admin/fastlane/gemset.nix b/pkgs/tools/admin/fastlane/gemset.nix
new file mode 100644
index 00000000000..0d9c1f55835
--- /dev/null
+++ b/pkgs/tools/admin/fastlane/gemset.nix
@@ -0,0 +1,469 @@
+{
+  addressable = {
+    dependencies = ["public_suffix"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0viqszpkggqi8hq87pqp0xykhvz60g99nwmkwsb0v45kc2liwxvk";
+      type = "gem";
+    };
+    version = "2.5.2";
+  };
+  babosa = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "05rgxg4pz4bc4xk34w5grv0yp1j94wf571w84lf3xgqcbs42ip2f";
+      type = "gem";
+    };
+    version = "1.0.2";
+  };
+  CFPropertyList = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "06dddgcai6nay552h8wmnb2m93xx5hni48s16vkbf9vbym4nfw5x";
+      type = "gem";
+    };
+    version = "2.3.5";
+  };
+  claide = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0az54rp691hc42yl1xyix2cxv58byhaaf4gxbpghvvq29l476rzc";
+      type = "gem";
+    };
+    version = "1.0.2";
+  };
+  colored = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0b0x5jmsyi0z69bm6sij1k89z7h0laag3cb4mdn7zkl9qmxb90lx";
+      type = "gem";
+    };
+    version = "1.2";
+  };
+  colored2 = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0jlbqa9q4mvrm73aw9mxh23ygzbjiqwisl32d8szfb5fxvbjng5i";
+      type = "gem";
+    };
+    version = "3.1.2";
+  };
+  commander-fastlane = {
+    dependencies = ["highline"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "04gpg733wv878acvrzp4kc3k934v10l3v8bcz3fjq5imjsrjdnbp";
+      type = "gem";
+    };
+    version = "4.4.5";
+  };
+  declarative = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0642xvwzzbgi3kp1bg467wma4g3xqrrn0sk369hjam7w579gnv5j";
+      type = "gem";
+    };
+    version = "0.0.10";
+  };
+  declarative-option = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1g4ibxq566f1frnhdymzi9hxxcm4g2gw4n21mpjk2mhwym4q6l0p";
+      type = "gem";
+    };
+    version = "0.1.0";
+  };
+  domain_name = {
+    dependencies = ["unf"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "12hs8yijhak7p2hf1xkh98g0mnp5phq3mrrhywzaxpwz1gw5r3kf";
+      type = "gem";
+    };
+    version = "0.5.20170404";
+  };
+  dotenv = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1pgzlvs0sswnqlgfm9gkz2hlhkc0zd3vnlp2vglb1wbgnx37pjjv";
+      type = "gem";
+    };
+    version = "2.2.1";
+  };
+  excon = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0mnc9lqlzwqj5ayp0lh7impisqm55mdg3mw5q4gi9yjic5sidc40";
+      type = "gem";
+    };
+    version = "0.59.0";
+  };
+  faraday = {
+    dependencies = ["multipart-post"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1gyqsj7vlqynwvivf9485zwmcj04v1z7gq362z0b8zw2zf4ag0hw";
+      type = "gem";
+    };
+    version = "0.13.1";
+  };
+  faraday-cookie_jar = {
+    dependencies = ["faraday" "http-cookie"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1di4gx6446a6zdkrpj679m5k515i53wvb4yxcsqvy8d8zacxiiv6";
+      type = "gem";
+    };
+    version = "0.0.6";
+  };
+  faraday_middleware = {
+    dependencies = ["faraday"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1p7icfl28nvl8qqdsngryz1snqic9l8x6bk0dxd7ygn230y0k41d";
+      type = "gem";
+    };
+    version = "0.12.2";
+  };
+  fastimage = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1fh80nwjxm63phcdg55haz9q877fxgvnkazjihaqbf8ginn6g00v";
+      type = "gem";
+    };
+    version = "2.1.0";
+  };
+  fastlane = {
+    dependencies = ["CFPropertyList" "addressable" "babosa" "colored" "commander-fastlane" "dotenv" "excon" "faraday" "faraday-cookie_jar" "faraday_middleware" "fastimage" "gh_inspector" "google-api-client" "highline" "json" "mini_magick" "multi_json" "multi_xml" "multipart-post" "plist" "public_suffix" "rubyzip" "security" "slack-notifier" "terminal-notifier" "terminal-table" "tty-screen" "word_wrap" "xcodeproj" "xcpretty" "xcpretty-travis-formatter"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1sg8xh1rjigiq438knkpdq685kyw34ki3h7baj65qh9mkkc8drxy";
+      type = "gem";
+    };
+    version = "2.60.1";
+  };
+  gh_inspector = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1lxvp8xpjd2cazzcp90phy567spp4v41bnk9awgx8absndv70k1x";
+      type = "gem";
+    };
+    version = "1.0.3";
+  };
+  google-api-client = {
+    dependencies = ["addressable" "googleauth" "httpclient" "mime-types" "representable" "retriable"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0ac9qa0kwnirkvwz2w9zf07lqcgbmnvgd1wg8xxyjbadwsbpyf1y";
+      type = "gem";
+    };
+    version = "0.13.6";
+  };
+  googleauth = {
+    dependencies = ["faraday" "jwt" "logging" "memoist" "multi_json" "os" "signet"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1xpmvrzhczak25nm0k3r9aa083lmfnzi94mir3g1xyrgzz66vxli";
+      type = "gem";
+    };
+    version = "0.5.3";
+  };
+  highline = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1nf5lgdn6ni2lpfdn4gk3gi47fmnca2bdirabbjbz1fk9w4p8lkr";
+      type = "gem";
+    };
+    version = "1.7.8";
+  };
+  http-cookie = {
+    dependencies = ["domain_name"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "004cgs4xg5n6byjs7qld0xhsjq3n6ydfh897myr2mibvh6fjc49g";
+      type = "gem";
+    };
+    version = "1.0.3";
+  };
+  httpclient = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "19mxmvghp7ki3klsxwrlwr431li7hm1lczhhj8z4qihl2acy8l99";
+      type = "gem";
+    };
+    version = "2.8.3";
+  };
+  json = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "01v6jjpvh3gnq6sgllpfqahlgxzj50ailwhj9b3cd20hi2dx0vxp";
+      type = "gem";
+    };
+    version = "2.1.0";
+  };
+  jwt = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "124zz1142bi2if7hl5pcrcamwchv4icyr5kaal9m2q6wqbdl6aw4";
+      type = "gem";
+    };
+    version = "1.5.6";
+  };
+  little-plugger = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1frilv82dyxnlg8k1jhrvyd73l6k17mxc5vwxx080r4x1p04gwym";
+      type = "gem";
+    };
+    version = "1.1.4";
+  };
+  logging = {
+    dependencies = ["little-plugger" "multi_json"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "06j6iaj89h9jhkx1x3hlswqrfnqds8br05xb1qra69dpvbdmjcwn";
+      type = "gem";
+    };
+    version = "2.2.2";
+  };
+  memoist = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0pq8fhqh8w25qcw9v3vzfb0i6jp0k3949ahxc3wrwz2791dpbgbh";
+      type = "gem";
+    };
+    version = "0.16.0";
+  };
+  mime-types = {
+    dependencies = ["mime-types-data"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0087z9kbnlqhci7fxh9f6il63hj1k02icq2rs0c6cppmqchr753m";
+      type = "gem";
+    };
+    version = "3.1";
+  };
+  mime-types-data = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "04my3746hwa4yvbx1ranhfaqkgf6vavi1kyijjnw8w3dy37vqhkm";
+      type = "gem";
+    };
+    version = "3.2016.0521";
+  };
+  mini_magick = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1a59k5l29vj060yscaqk370rg5vyr132kbw6x3zar7khzjqjqd8p";
+      type = "gem";
+    };
+    version = "4.5.1";
+  };
+  multi_json = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1raim9ddjh672m32psaa9niw67ywzjbxbdb8iijx3wv9k5b0pk2x";
+      type = "gem";
+    };
+    version = "1.12.2";
+  };
+  multi_xml = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0lmd4f401mvravi1i1yq7b2qjjli0yq7dfc4p1nj5nwajp7r6hyj";
+      type = "gem";
+    };
+    version = "0.6.0";
+  };
+  multipart-post = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "09k0b3cybqilk1gwrwwain95rdypixb2q9w65gd44gfzsd84xi1x";
+      type = "gem";
+    };
+    version = "2.0.0";
+  };
+  nanaimo = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0z6rbji02x75vm5jw4hbpp75khp4z5yfgbaz1h9l8aa00hqf0fxd";
+      type = "gem";
+    };
+    version = "0.2.3";
+  };
+  os = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1llv8w3g2jwggdxr5a5cjkrnbbfnvai3vxacxxc0fy84xmz3hymz";
+      type = "gem";
+    };
+    version = "0.9.6";
+  };
+  plist = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0k0pyqrjcz9kn1b3ahsfs9aqym7s7yzz0vavya0zn0mca3jw2zqc";
+      type = "gem";
+    };
+    version = "3.3.0";
+  };
+  public_suffix = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "040jf98jpp6w140ghkhw2hvc1qx41zvywx5gj7r2ylr1148qnj7q";
+      type = "gem";
+    };
+    version = "2.0.5";
+  };
+  representable = {
+    dependencies = ["declarative" "declarative-option" "uber"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0qm9rgi1j5a6nv726ka4mmixivlxfsg91h8rpp72wwd4vqbkkm07";
+      type = "gem";
+    };
+    version = "3.0.4";
+  };
+  retriable = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0pnriyn9zh120hxm92vb12hfsf7c98nawyims1shxj3ldpl0l3ar";
+      type = "gem";
+    };
+    version = "3.1.1";
+  };
+  rouge = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0sfikq1q8xyqqx690iiz7ybhzx87am4w50w8f2nq36l3asw4x89d";
+      type = "gem";
+    };
+    version = "2.0.7";
+  };
+  rubyzip = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "06js4gznzgh8ac2ldvmjcmg9v1vg9llm357yckkpylaj6z456zqz";
+      type = "gem";
+    };
+    version = "1.2.1";
+  };
+  security = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1ryjxs0j66wrbky2c08yf0mllwalvpg12rpxzbdx2rdhj3cbrlxa";
+      type = "gem";
+    };
+    version = "0.1.3";
+  };
+  signet = {
+    dependencies = ["addressable" "faraday" "jwt" "multi_json"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "149668991xqibvm8kvl10kzy891yd6f994b4gwlx6c3vl24v5jq6";
+      type = "gem";
+    };
+    version = "0.7.3";
+  };
+  slack-notifier = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0xavibxh00gy62mm79l6id9l2fldjmdqifk8alqfqy5z38ffwah6";
+      type = "gem";
+    };
+    version = "1.5.1";
+  };
+  terminal-notifier = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0vy75sbq236v1p83jj6r3a9d52za5lqj2vj24np9lrszdczm9zcb";
+      type = "gem";
+    };
+    version = "1.8.0";
+  };
+  terminal-table = {
+    dependencies = ["unicode-display_width"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1512cngw35hsmhvw4c05rscihc59mnj09m249sm9p3pik831ydqk";
+      type = "gem";
+    };
+    version = "1.8.0";
+  };
+  tty-screen = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "005rpl9l1r9i7wypb4kv057y01fxqvanznx62msx6z451cfjsfn3";
+      type = "gem";
+    };
+    version = "0.5.0";
+  };
+  uber = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1p1mm7mngg40x05z52md3mbamkng0zpajbzqjjwmsyw0zw3v9vjv";
+      type = "gem";
+    };
+    version = "0.1.0";
+  };
+  unf = {
+    dependencies = ["unf_ext"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0bh2cf73i2ffh4fcpdn9ir4mhq8zi50ik0zqa1braahzadx536a9";
+      type = "gem";
+    };
+    version = "0.1.4";
+  };
+  unf_ext = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "14hr2dzqh33kqc0xchs8l05pf3kjcayvad4z1ip5rdjxrkfk8glb";
+      type = "gem";
+    };
+    version = "0.0.7.4";
+  };
+  unicode-display_width = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "12pi0gwqdnbx1lv5136v3vyr0img9wr0kxcn4wn54ipq4y41zxq8";
+      type = "gem";
+    };
+    version = "1.3.0";
+  };
+  word_wrap = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1iyc5bc7dbgsd8j3yk1i99ral39f23l6wapi0083fbl19hid8mpm";
+      type = "gem";
+    };
+    version = "1.0.0";
+  };
+  xcodeproj = {
+    dependencies = ["CFPropertyList" "claide" "colored2" "nanaimo"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0v40167wxhjfczjqp7axvblivrzgbmqldaj9vb15pw45qh6xly51";
+      type = "gem";
+    };
+    version = "1.5.2";
+  };
+  xcpretty = {
+    dependencies = ["rouge"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1b8x9m53a1hbw0lamffjm4m1ydigj3azl97jc5w7prv1bm27s2y3";
+      type = "gem";
+    };
+    version = "0.2.8";
+  };
+  xcpretty-travis-formatter = {
+    dependencies = ["xcpretty"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1wn5pcxja1jkc8y5b6s3pks5inc1vmjkq7fqmlbkl39z8l1vdis2";
+      type = "gem";
+    };
+    version = "0.0.4";
+  };
+}
\ No newline at end of file
diff --git a/pkgs/tools/admin/gtk-vnc/default.nix b/pkgs/tools/admin/gtk-vnc/default.nix
index da269049b2c..59a5ec8d4da 100644
--- a/pkgs/tools/admin/gtk-vnc/default.nix
+++ b/pkgs/tools/admin/gtk-vnc/default.nix
@@ -15,11 +15,13 @@ in stdenv.mkDerivation rec {
     sha256 = "0gj8dpy3sj4dp810gy67spzh5f0jd8aqg69clcwqjcskj1yawbiw";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    python gnutls cairo libtool pkgconfig glib libffi libgcrypt
+    python gnutls cairo libtool glib libffi libgcrypt
     intltool cyrus_sasl libpulseaudio perl perlPackages.TextCSV
     gobjectIntrospection libogg libgpgerror
-    gtk3 vala_0_32 pygobject3 ];
+    gtk3 vala_0_32 pygobject3
+  ];
 
   NIX_CFLAGS_COMPILE = "-fstack-protector-all";
   configureFlags = [
diff --git a/pkgs/tools/admin/intecture/agent.nix b/pkgs/tools/admin/intecture/agent.nix
index 27891614f4b..4024ab9b91f 100644
--- a/pkgs/tools/admin/intecture/agent.nix
+++ b/pkgs/tools/admin/intecture/agent.nix
@@ -5,16 +5,16 @@ with rustPlatform;
 
 buildRustPackage rec {
   name = "intecture-agent-${version}";
-  version = "0.3.0";
+  version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "intecture";
     repo = "agent";
     rev = version;
-    sha256 = "0b59ij9c7hv2p4jx96f3acbygw27wiv8cfzzg6sg73l6k244k6l6";
+    sha256 = "0j27qdgyxybaixggh7k57mpm6rifimn4z2vydk463msc8b3kgywj";
   };
 
-  depsSha256 = "1f94j54pg94f2x2lmmyj8dlki8plq6vnppmf3hzk3kd0rp7fzban";
+  depsSha256 = "1n57i9wkak76ram748mwq0dn32d041ajd31laqc13c76pp29agrp";
 
   buildInputs = [ openssl zeromq czmq zlib ];
 
diff --git a/pkgs/tools/admin/intecture/auth.nix b/pkgs/tools/admin/intecture/auth.nix
index 88ef137d841..c4678c8d4b7 100644
--- a/pkgs/tools/admin/intecture/auth.nix
+++ b/pkgs/tools/admin/intecture/auth.nix
@@ -5,16 +5,16 @@ with rustPlatform;
 
 buildRustPackage rec {
   name = "intecture-auth-${version}";
-  version = "0.1.0";
+  version = "0.1.2";
 
   src = fetchFromGitHub {
     owner = "intecture";
     repo = "auth";
     rev = version;
-    sha256 = "1p3jahha8k139f22ijg050cl8akfzxda4gzvijpqv869hmhc70py";
+    sha256 = "0c7ar3pc7n59lzfy74lwz51p09s2bglc870rfr4c0vmc91jl0pj2";
   };
 
-  depsSha256 = "0mki57yzb29y9fhh16xvpi5gfp6c14r5q3f45f3v8sdj95rjahz1";
+  depsSha256 = "0wzr8hk63gh3nm8f7dbzwj8pgc3cm8p8mr2q7bbgvri1a5i83sfb";
 
   buildInputs = [ openssl zeromq czmq zlib ];
 
diff --git a/pkgs/tools/admin/intecture/cli.nix b/pkgs/tools/admin/intecture/cli.nix
index 0f530f636d7..e98b62bd0ea 100644
--- a/pkgs/tools/admin/intecture/cli.nix
+++ b/pkgs/tools/admin/intecture/cli.nix
@@ -5,16 +5,16 @@ with rustPlatform;
 
 buildRustPackage rec {
   name = "intecture-cli-${version}";
-  version = "0.3.2";
+  version = "0.3.4";
 
   src = fetchFromGitHub {
     owner = "intecture";
     repo = "cli";
     rev = version;
-    sha256 = "0f5pyrlkxzz4kdfzwambxzqr48g3n06f1pv163h06ggssqa51wbc";
+    sha256 = "16a5fkpyqkf8w20k3ircc1d0qmif7nygkzxj6mzk9609dlb0dmxq";
   };
 
-  depsSha256 = "0f3rhjs5addppva4cjx3ngpa5gz2i2n46hyc3zd4l7lhh8gaggix";
+  depsSha256 = "0nax7h7f5qgalgxsfidrxrv1ybl5xvrpc1k7xc1kmaf955gqmc46";
 
   buildInputs = [ openssl zeromq czmq zlib ];
 
diff --git a/pkgs/tools/admin/salt/default.nix b/pkgs/tools/admin/salt/default.nix
index 5afe14209f6..b5056460225 100644
--- a/pkgs/tools/admin/salt/default.nix
+++ b/pkgs/tools/admin/salt/default.nix
@@ -8,12 +8,12 @@
 
 python2Packages.buildPythonApplication rec {
   pname = "salt";
-  version = "2017.7.1";
+  version = "2017.7.2";
   name = "${pname}-${version}";
 
   src = python2Packages.fetchPypi {
     inherit pname version;
-    sha256 = "079kymgxyzhf47dd42l7f42jp45gx5im4k3g31bj25p1s0aq91py";
+    sha256 = "0h18zwp1w90rgxpmqgrmn9wp31h03f0vak8lpnnbh0dzbbgcffzz";
   };
 
   propagatedBuildInputs = with python2Packages; [
diff --git a/pkgs/tools/admin/tigervnc/default.nix b/pkgs/tools/admin/tigervnc/default.nix
index bb585f6eb64..5ba53c75371 100644
--- a/pkgs/tools/admin/tigervnc/default.nix
+++ b/pkgs/tools/admin/tigervnc/default.nix
@@ -87,7 +87,8 @@ stdenv.mkDerivation rec {
     glproto mesa_glu
   ] ++ xorgserver.buildInputs;
 
-  nativeBuildInputs = [ cmake zlib gettext libtool ] ++ xorg.xorgserver.nativeBuildInputs;
+  nativeBuildInputs = with xorg; [ cmake zlib gettext libtool utilmacros fontutil ]
+    ++ xorg.xorgserver.nativeBuildInputs;
 
   propagatedBuildInputs = xorg.xorgserver.propagatedBuildInputs;
 
diff --git a/pkgs/tools/archivers/cromfs/default.nix b/pkgs/tools/archivers/cromfs/default.nix
index 042880b39c9..00de2c2ec46 100644
--- a/pkgs/tools/archivers/cromfs/default.nix
+++ b/pkgs/tools/archivers/cromfs/default.nix
@@ -18,7 +18,8 @@ stdenv.mkDerivation rec {
     install util/unmkcromfs $out/bin
   '';
 
-  buildInputs = [ pkgconfig fuse perl ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ fuse perl ];
 
   meta = {
     description = "FUSE Compressed ROM filesystem with lzma";
diff --git a/pkgs/tools/archivers/runzip/default.nix b/pkgs/tools/archivers/runzip/default.nix
index 1ed453f0d4f..f99ee963dbe 100644
--- a/pkgs/tools/archivers/runzip/default.nix
+++ b/pkgs/tools/archivers/runzip/default.nix
@@ -4,7 +4,8 @@ stdenv.mkDerivation rec {
   version = "1.4";
   name = "runzip-${version}";
 
-  buildInputs = [ libzip autoreconfHook ];
+  nativeBuildInputs = [ autoreconfHook ];
+  buildInputs = [ libzip ];
 
   src = fetchFromGitHub {
     owner = "vlm";
diff --git a/pkgs/tools/archivers/unrar/default.nix b/pkgs/tools/archivers/unrar/default.nix
index 563b21c76d8..9aedda83fd2 100644
--- a/pkgs/tools/archivers/unrar/default.nix
+++ b/pkgs/tools/archivers/unrar/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "unrar-${version}";
-  version = "5.5.7";
+  version = "5.5.8";
 
   src = fetchurl {
-    url = "http://www.rarlab.com/rar/unrarsrc-${version}.tar.gz";
-    sha256 = "13rd69ss6jqsa6yxr8kmgs84kb67k822d2mbiz29m75zj46hmvwa";
+    url = "https://www.rarlab.com/rar/unrarsrc-${version}.tar.gz";
+    sha256 = "1x7wnb6zgs09v2bf5xaqz14daba8k7zikadj1qabqi4r78sy8rlv";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/archivers/xarchive/default.nix b/pkgs/tools/archivers/xarchive/default.nix
index 0cb4fbbf3f0..07e76ea7f62 100644
--- a/pkgs/tools/archivers/xarchive/default.nix
+++ b/pkgs/tools/archivers/xarchive/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0chfim7z27s00naf43a61zsngwhvim14mg1p3csbv5i3f6m50xx4";
   };
 
-  buildInputs = [ gtk2 pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ gtk2 ];
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/tools/archivers/xarchiver/default.nix b/pkgs/tools/archivers/xarchiver/default.nix
index 6ed6a7f2402..a257ece4877 100644
--- a/pkgs/tools/archivers/xarchiver/default.nix
+++ b/pkgs/tools/archivers/xarchiver/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "0w9lx8d8r50j48qfhn2r0dlcnwy3pjyy6xjvgpr0qagy5l1q1qj4";
   };
 
-  buildInputs = [ gtk2 pkgconfig intltool ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ gtk2 intltool ];
 
   meta = {
     description = "GTK+ frontend to 7z,zip,rar,tar,bzip2, gzip,arj, lha, rpm and deb (open and extract only)";
diff --git a/pkgs/tools/audio/acoustid-fingerprinter/default.nix b/pkgs/tools/audio/acoustid-fingerprinter/default.nix
index ba029814f39..f68671bc6fb 100644
--- a/pkgs/tools/audio/acoustid-fingerprinter/default.nix
+++ b/pkgs/tools/audio/acoustid-fingerprinter/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
     sha256 = "0ckglwy95qgqvl2l6yd8ilwpd6qs7yzmj8g7lnxb50d12115s5n0";
   };
 
-  buildInputs = [ cmake pkgconfig qt4 taglib chromaprint ffmpeg ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ cmake qt4 taglib chromaprint ffmpeg ];
 
   cmakeFlags = [ "-DTAGLIB_MIN_VERSION=${(builtins.parseDrvName taglib.name).version}" ];
 
diff --git a/pkgs/tools/audio/gvolicon/default.nix b/pkgs/tools/audio/gvolicon/default.nix
index 7354b92aaf9..8fed569f140 100644
--- a/pkgs/tools/audio/gvolicon/default.nix
+++ b/pkgs/tools/audio/gvolicon/default.nix
@@ -8,8 +8,9 @@ stdenv.mkDerivation {
     sha256 = "1sr9wyy7w898vq63yd003yp3k66hd4vm8b0qsm9zvmwmpiz4wvln";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    pkgconfig makeWrapper alsaLib gnome3.gtk gdk_pixbuf gnome3.defaultIconTheme
+    makeWrapper alsaLib gnome3.gtk gdk_pixbuf gnome3.defaultIconTheme
     librsvg wrapGAppsHook
   ];
 
diff --git a/pkgs/tools/audio/mpdris2/default.nix b/pkgs/tools/audio/mpdris2/default.nix
index c326533ece1..6596f1c34ff 100644
--- a/pkgs/tools/audio/mpdris2/default.nix
+++ b/pkgs/tools/audio/mpdris2/default.nix
@@ -15,7 +15,8 @@ stdenv.mkDerivation rec {
     intltoolize -f
   '';
 
-  buildInputs = [ intltool autoreconfHook pythonPackages.wrapPython ];
+  nativeBuildInputs = [ autoreconfHook ];
+  buildInputs = [ intltool pythonPackages.wrapPython ];
   propagatedBuildInputs = with pythonPackages; [ python pygtk dbus-python  ];
   pythonPath = with pythonPackages; [ mpd pygtk dbus-python notify mutagen ];
   postInstall = "wrapPythonPrograms";
diff --git a/pkgs/tools/audio/pa-applet/default.nix b/pkgs/tools/audio/pa-applet/default.nix
index 6e3e5617b31..239e4b3fcca 100644
--- a/pkgs/tools/audio/pa-applet/default.nix
+++ b/pkgs/tools/audio/pa-applet/default.nix
@@ -9,8 +9,9 @@ stdenv.mkDerivation rec {
     sha256 = "1242sdri67wnm1cd0hr40mxarkh7qs7mb9n2m0g9dbz0f4axj6wa";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    gtk3 libpulseaudio glibc pkgconfig automake autoconf libnotify libX11 xf86inputevdev
+    gtk3 libpulseaudio glibc automake autoconf libnotify libX11 xf86inputevdev
   ];
 
   preConfigure = ''
diff --git a/pkgs/tools/audio/pasystray/default.nix b/pkgs/tools/audio/pasystray/default.nix
index 451424fb866..02235f727c5 100644
--- a/pkgs/tools/audio/pasystray/default.nix
+++ b/pkgs/tools/audio/pasystray/default.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation rec {
     sha256 = "0k13s7pmz5ks3kli8pwhzd47hcjwv46gd2fgk7i4fbkfwf3z279h";
   };
 
-  buildInputs = [ autoconf automake makeWrapper pkgconfig 
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ autoconf automake makeWrapper 
                   gnome3.defaultIconTheme
                   avahi gtk3 libnotify libpulseaudio xlibsWrapper ];
 
diff --git a/pkgs/tools/audio/playerctl/default.nix b/pkgs/tools/audio/playerctl/default.nix
index 38df702cb16..b04e449835d 100644
--- a/pkgs/tools/audio/playerctl/default.nix
+++ b/pkgs/tools/audio/playerctl/default.nix
@@ -12,8 +12,9 @@ stdenv.mkDerivation rec {
     sha256 = "0b4pg5pwblgbf6kvvynzh9dshfikxy5c2ks7733n7wza5wkpgmng";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    which autoconf automake libtool gnome2.gtkdoc glib pkgconfig
+    which autoconf automake libtool gnome2.gtkdoc glib
     gobjectIntrospection
   ];
 
diff --git a/pkgs/tools/audio/volumeicon/default.nix b/pkgs/tools/audio/volumeicon/default.nix
index ea74d83ed9e..ed955876250 100644
--- a/pkgs/tools/audio/volumeicon/default.nix
+++ b/pkgs/tools/audio/volumeicon/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "182xl2w8syv6ky2h2bc9imc6ap8pzh0p7rp63hh8nw0xm38c3f14";
   };
 
-  buildInputs = [ gtk3 pkgconfig intltool alsaLib ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ gtk3 intltool alsaLib ];
 
   meta = with stdenv.lib; {
     description = "A lightweight volume control that sits in your systray";
diff --git a/pkgs/tools/backup/attic/default.nix b/pkgs/tools/backup/attic/default.nix
index abfccb97641..754e12e7f77 100644
--- a/pkgs/tools/backup/attic/default.nix
+++ b/pkgs/tools/backup/attic/default.nix
@@ -10,7 +10,8 @@ let
       url = "mirror://pypi/l/llfuse/${name}.tar.bz2";
       sha256 = "1imlqw9b73086y97izr036f58pgc5akv4ihc2rrf8j5h75jbrlaa";
     };
-    buildInputs = with python3Packages; [ pytest pkgconfig fuse attr which ];
+  nativeBuildInputs = [ pkgconfig ];
+    buildInputs = with python3Packages; [ pytest fuse attr which ];
     propagatedBuildInputs = with python3Packages; [ contextlib2 ];
     checkPhase = ''
       py.test
diff --git a/pkgs/tools/backup/borg/default.nix b/pkgs/tools/backup/borg/default.nix
index 19495b6e1df..4ff61d1ac95 100644
--- a/pkgs/tools/backup/borg/default.nix
+++ b/pkgs/tools/backup/borg/default.nix
@@ -2,18 +2,18 @@
 
 python3Packages.buildPythonApplication rec {
   name = "borgbackup-${version}";
-  version = "1.0.11";
+  version = "1.1.0";
   namePrefix = "";
 
   src = fetchurl {
     url = "https://github.com/borgbackup/borg/releases/download/"
       + "${version}/${name}.tar.gz";
-    sha256 = "14fjk5dfwmjkn7nmkbhhbrk3g1wfrn8arvqd5r9jaij534nzsvpw";
+    sha256 = "0vwyg0b4kxb0rspqwhvgi5c78dzimgkydf03wif27a40qhh1235l";
   };
 
   nativeBuildInputs = with python3Packages; [
     # For building documentation:
-    sphinx sphinx_rtd_theme
+    sphinx guzzle_sphinx_theme
   ];
   buildInputs = [
     acl lz4 openssl python3Packages.setuptools_scm
diff --git a/pkgs/tools/backup/btrbk/default.nix b/pkgs/tools/backup/btrbk/default.nix
index ff542e781a6..f9feaf40ec2 100644
--- a/pkgs/tools/backup/btrbk/default.nix
+++ b/pkgs/tools/backup/btrbk/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "btrbk-${version}";
-  version = "0.24.0";
+  version = "0.25.1";
 
   src = fetchurl {
     url = "http://digint.ch/download/btrbk/releases/${name}.tar.xz";
-    sha256 = "01jrlswly28h4q4r3qfrzadz0pf0ms6wynmqhwddj1ahj31729h3";
+    sha256 = "02qc9vbd5l0ywnv01p60v9q3dcx2z92dfaf95qf7ccxqaa9zxfr5";
   };
 
   patches = [
diff --git a/pkgs/tools/backup/duplicity/default.nix b/pkgs/tools/backup/duplicity/default.nix
index 313167b1ae2..d55783f7f2c 100644
--- a/pkgs/tools/backup/duplicity/default.nix
+++ b/pkgs/tools/backup/duplicity/default.nix
@@ -11,7 +11,7 @@ python2Packages.buildPythonApplication rec {
 
   buildInputs = [ librsync makeWrapper python2Packages.wrapPython ];
   propagatedBuildInputs = with python2Packages; [
-    boto cffi cryptography ecdsa enum idna
+    boto cffi cryptography ecdsa enum idna pygobject3
     ipaddress lockfile paramiko pyasn1 pycrypto six
   ];
   checkInputs = with python2Packages; [ lockfile mock pexpect ];
diff --git a/pkgs/tools/backup/partimage/default.nix b/pkgs/tools/backup/partimage/default.nix
index b0b9444a238..c902802abce 100644
--- a/pkgs/tools/backup/partimage/default.nix
+++ b/pkgs/tools/backup/partimage/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation {
   };
   configureFlags = "--with-ssl-headers=${openssl.dev}/include/openssl";
 
-  buildInputs = [bzip2 zlib newt newt openssl pkgconfig slang
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [bzip2 zlib newt newt openssl slang
     # automake autoconf libtool gettext
   ];
 
diff --git a/pkgs/tools/bluetooth/obex-data-server/default.nix b/pkgs/tools/bluetooth/obex-data-server/default.nix
index 35f46b47bc8..53a193749d3 100644
--- a/pkgs/tools/bluetooth/obex-data-server/default.nix
+++ b/pkgs/tools/bluetooth/obex-data-server/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "0kq940wqs9j8qjnl58d6l3zhx0jaszci356xprx23l6nvdfld6dk";
   };
 
-  buildInputs = [ pkgconfig libusb glib dbus_glib bluez openobex dbus_libs ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libusb glib dbus_glib bluez openobex dbus_libs ];
 
   patches = [ ./obex-data-server-0.4.6-build-fixes-1.patch ];
 
diff --git a/pkgs/tools/cd-dvd/cdrdao/default.nix b/pkgs/tools/cd-dvd/cdrdao/default.nix
index 95dd58a59b4..3b8040e2b91 100644
--- a/pkgs/tools/cd-dvd/cdrdao/default.nix
+++ b/pkgs/tools/cd-dvd/cdrdao/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation {
 
   makeFlags = "RM=rm LN=ln MV=mv";
 
-  buildInputs = [ lame libvorbis libmad pkgconfig libao ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ lame libvorbis libmad libao ];
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/tools/cd-dvd/vobsub2srt/default.nix b/pkgs/tools/cd-dvd/vobsub2srt/default.nix
index a345972b373..fe7a1a04414 100644
--- a/pkgs/tools/cd-dvd/vobsub2srt/default.nix
+++ b/pkgs/tools/cd-dvd/vobsub2srt/default.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation {
     sha256 = "1rpanrv8bgdh95v2320qbd44xskncvq6y84cbbfc86gw0qxpd9cb";
   };
 
-  buildInputs = [ cmake libtiff pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ cmake libtiff ];
   propagatedBuildInputs = [ tesseract ];
 
   meta = {
diff --git a/pkgs/tools/compression/pixz/default.nix b/pkgs/tools/compression/pixz/default.nix
index 5ce79cbf412..2a5250a95ac 100644
--- a/pkgs/tools/compression/pixz/default.nix
+++ b/pkgs/tools/compression/pixz/default.nix
@@ -8,8 +8,9 @@ stdenv.mkDerivation rec {
   version = "1.0.6";
   name = "${baseName}-${version}";
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    autoconf automake libtool pkgconfig asciidoc libxslt libxml2
+    autoconf automake libtool asciidoc libxslt libxml2
     docbook_xml_dtd_45 docbook_xml_xslt
     libarchive lzma
   ];
diff --git a/pkgs/tools/filesystems/archivemount/default.nix b/pkgs/tools/filesystems/archivemount/default.nix
index dff66fe6bde..f4133f12541 100644
--- a/pkgs/tools/filesystems/archivemount/default.nix
+++ b/pkgs/tools/filesystems/archivemount/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation {
     sha256 = "1zv1fvik76kpp1q5f2dz01f4fwg1m5a8rl168px47jy9nyl9k277";
   };
 
-  buildInputs = [ pkgconfig fuse libarchive ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ fuse libarchive ];
 
   meta = {
     description = "Gateway between FUSE and libarchive: allows mounting of cpio, .tar.gz, .tar.bz2 archives";
diff --git a/pkgs/tools/filesystems/bcache-tools/default.nix b/pkgs/tools/filesystems/bcache-tools/default.nix
index 61c7f26db1e..efd48fb87fe 100644
--- a/pkgs/tools/filesystems/bcache-tools/default.nix
+++ b/pkgs/tools/filesystems/bcache-tools/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
     sha256 = "1gbsh2qw0a7kgck6w0apydiy37nnz5xvdgipa0yqrfmghl86vmv4";
   };
 
-  buildInputs = [ pkgconfig utillinux ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ utillinux ];
 
   # * Remove broken install rules (they ignore $PREFIX) for stuff we don't need
   #   anyway (it's distro specific stuff).
diff --git a/pkgs/tools/filesystems/bcachefs-tools/default.nix b/pkgs/tools/filesystems/bcachefs-tools/default.nix
index 5c5779037ab..fc4d3f505cd 100644
--- a/pkgs/tools/filesystems/bcachefs-tools/default.nix
+++ b/pkgs/tools/filesystems/bcachefs-tools/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "05ba1h09rrqj6vjr3q37ybca3nbrmnifmffdyk83622l28fpv350";
   };
 
-  buildInputs = [ pkgconfig attr libuuid libscrypt libsodium keyutils liburcu zlib libaio ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ attr libuuid libscrypt libsodium keyutils liburcu zlib libaio ];
 
   preConfigure = ''
     substituteInPlace cmd_migrate.c --replace /usr/include/dirent.h ${stdenv.lib.getDev stdenv.cc.libc}/include/dirent.h
diff --git a/pkgs/tools/filesystems/bindfs/default.nix b/pkgs/tools/filesystems/bindfs/default.nix
index 80027c7a047..4d7ee75c006 100644
--- a/pkgs/tools/filesystems/bindfs/default.nix
+++ b/pkgs/tools/filesystems/bindfs/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
 
   dontStrip = true;
 
-  buildInputs = [ fuse pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ fuse ];
   postFixup = ''
     ln -s $out/bin/bindfs $out/bin/mount.fuse.bindfs
   '';
diff --git a/pkgs/tools/filesystems/btrfs-progs/4.4.1.nix b/pkgs/tools/filesystems/btrfs-progs/4.4.1.nix
deleted file mode 100644
index afafa4ec174..00000000000
--- a/pkgs/tools/filesystems/btrfs-progs/4.4.1.nix
+++ /dev/null
@@ -1,31 +0,0 @@
-{ stdenv, fetchurl, pkgconfig, attr, acl, zlib, libuuid, e2fsprogs, lzo
-, asciidoc, xmlto, docbook_xml_dtd_45, docbook_xsl, libxslt
-}:
-
-let version = "4.4.1"; in
-
-stdenv.mkDerivation rec {
-  name = "btrfs-progs-${version}";
-
-  src = fetchurl {
-    url = "mirror://kernel/linux/kernel/people/kdave/btrfs-progs/btrfs-progs-v${version}.tar.xz";
-    sha256 = "1z5882zx9jx02vyg067siws0irsl8pg37myx17hr4imn9ypf6r4r";
-  };
-
-  buildInputs = [
-    pkgconfig attr acl zlib libuuid e2fsprogs lzo
-    asciidoc xmlto docbook_xml_dtd_45 docbook_xsl libxslt
-  ];
-
-  # gcc bug with -O1 on ARM with gcc 4.8
-  # This should be fine on all platforms so apply universally
-  patchPhase = "sed -i s/-O1/-O2/ configure";
-
-  meta = with stdenv.lib; {
-    description = "Utilities for the btrfs filesystem";
-    homepage = https://btrfs.wiki.kernel.org/;
-    license = licenses.gpl2;
-    maintainers = with maintainers; [ nckx raskin wkennington ];
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/tools/filesystems/btrfs-progs/default.nix b/pkgs/tools/filesystems/btrfs-progs/default.nix
index d9b01eb5239..77411e0cc26 100644
--- a/pkgs/tools/filesystems/btrfs-progs/default.nix
+++ b/pkgs/tools/filesystems/btrfs-progs/default.nix
@@ -2,18 +2,19 @@
 , asciidoc, xmlto, docbook_xml_dtd_45, docbook_xsl, libxslt
 }:
 
-let version = "4.8.2"; in
+let version = "4.13.1"; in
 
 stdenv.mkDerivation rec {
   name = "btrfs-progs-${version}";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/people/kdave/btrfs-progs/btrfs-progs-v${version}.tar.xz";
-    sha256 = "0pswcfmdnfc586770h74abp67gn2xv8fd46vxlimnmn837sj7h41";
+    sha256 = "1clavvrlkswgicqsm2yfsxqw04lsn8dra0db84jqm6j2apz80kz0";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    pkgconfig attr acl zlib libuuid e2fsprogs lzo
+    attr acl zlib libuuid e2fsprogs lzo
     asciidoc xmlto docbook_xml_dtd_45 docbook_xsl libxslt
   ];
 
diff --git a/pkgs/tools/filesystems/ciopfs/default.nix b/pkgs/tools/filesystems/ciopfs/default.nix
index 674f462b967..4a8c767e44a 100644
--- a/pkgs/tools/filesystems/ciopfs/default.nix
+++ b/pkgs/tools/filesystems/ciopfs/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "0sr9i9b3qfwbfvzvk00yrrg3x2xqk1njadbldkvn7hwwa4z5bm9l";
   };
 
-  buildInputs = [ pkgconfig fuse glib attr ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ fuse glib attr ];
 
   makeFlags = "DESTDIR=$(out) PREFIX=";
 
diff --git a/pkgs/tools/filesystems/cryfs/default.nix b/pkgs/tools/filesystems/cryfs/default.nix
new file mode 100644
index 00000000000..0469ad54eb1
--- /dev/null
+++ b/pkgs/tools/filesystems/cryfs/default.nix
@@ -0,0 +1,79 @@
+{ stdenv, fetchFromGitHub
+, cmake, pkgconfig, coreutils
+, boost, cryptopp, curl, fuse, openssl, python, spdlog
+}:
+
+stdenv.mkDerivation rec {
+  name = "cryfs-${version}";
+  version = "0.9.7";
+
+  src = fetchFromGitHub {
+    owner  = "cryfs";
+    repo   = "cryfs";
+    rev    = "${version}";
+    sha256 = "1wsv4cyjkyg3cyr6vipw1mj41bln2m69123l3miav8r4mvmkfq8w";
+  };
+
+  prePatch = ''
+    patchShebangs src
+
+    substituteInPlace vendor/scrypt/CMakeLists.txt \
+      --replace /usr/bin/ ""
+
+    # scrypt in nixpkgs only produces a binary so we lift the patching from that so allow
+    # building the vendored version. This is very much NOT DRY.
+    # The proper solution is to have scrypt generate a dev output with the required files and just symlink
+    # into vendor/scrypt
+    for f in Makefile.in autocrap/Makefile.am libcperciva/cpusupport/Build/cpusupport.sh ; do
+      substituteInPlace vendor/scrypt/scrypt-*/scrypt/$f --replace "command -p " ""
+    done
+
+    # cryfs is vendoring an old version of spdlog
+    rm -rf vendor/spdlog/spdlog
+    ln -s ${spdlog} vendor/spdlog/spdlog
+  '';
+
+  buildInputs = [ boost cryptopp curl fuse openssl python spdlog ];
+
+  patches = [
+    ./test-no-network.patch  # Disable tests using external networking
+    ./skip-failing-test-large-malloc.patch
+  ];
+
+  # coreutils is needed for the vendored scrypt
+  nativeBuildInputs = [ cmake coreutils pkgconfig ];
+
+  enableParallelBuilding = true;
+
+  cmakeFlags = [
+    "-DCRYFS_UPDATE_CHECKS=OFF"
+    "-DBoost_USE_STATIC_LIBS=OFF" # this option is case sensitive
+    "-DBUILD_TESTING=ON"
+  ];
+
+  doCheck = true;
+
+  # Cryfs tests are broken on darwin
+  checkPhase = stdenv.lib.optionalString (!stdenv.isDarwin) ''
+    # Skip CMakeFiles directory and tests depending on fuse (does not work well with sandboxing)
+    SKIP_IMPURE_TESTS="CMakeFiles|fspp|cryfs-cli"
+
+    for test in `ls -d test/*/ | egrep -v "$SKIP_IMPURE_TESTS"`; do
+      "./$test`basename $test`-test"
+    done
+  '';
+
+  installPhase = ''
+    # Building with BUILD_TESTING=ON is missing the install target
+    mkdir -p $out/bin
+    install -m 755 ./src/cryfs-cli/cryfs $out/bin/cryfs
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Cryptographic filesystem for the cloud";
+    homepage    = https://www.cryfs.org;
+    license     = licenses.lgpl3;
+    maintainers = with maintainers; [ peterhoeg ];
+    platforms   = with platforms; linux;
+  };
+}
diff --git a/pkgs/tools/filesystems/cryfs/skip-failing-test-large-malloc.patch b/pkgs/tools/filesystems/cryfs/skip-failing-test-large-malloc.patch
new file mode 100644
index 00000000000..feb0ed9cfbb
--- /dev/null
+++ b/pkgs/tools/filesystems/cryfs/skip-failing-test-large-malloc.patch
@@ -0,0 +1,34 @@
+From ad3f7e9fa2dececfaab43963887a2f03de52d659 Mon Sep 17 00:00:00 2001
+From: adisbladis <adis@blad.is>
+Date: Thu, 12 Oct 2017 21:45:26 +0800
+Subject: [PATCH] Skip failing test: large malloc
+
+---
+ test/cpp-utils/data/DataTest.cpp | 11 -----------
+ 1 file changed, 11 deletions(-)
+
+diff --git a/test/cpp-utils/data/DataTest.cpp b/test/cpp-utils/data/DataTest.cpp
+index 6f9df070..bd426e62 100644
+--- a/test/cpp-utils/data/DataTest.cpp
++++ b/test/cpp-utils/data/DataTest.cpp
+@@ -191,17 +191,6 @@ TEST_F(DataTest, Inequality_DifferentLastByte) {
+   EXPECT_TRUE(data1 != data2);
+ }
+ 
+-#ifdef __x86_64__
+-TEST_F(DataTest, LargesizeSize) {
+-  //Needs 64bit for representation. This value isn't in the size param list, because the list is also used for read/write checks.
+-  uint64_t size = 4.5L*1024*1024*1024;
+-  Data data(size);
+-  EXPECT_EQ(size, data.size());
+-}
+-#else
+-#warning This is not a 64bit architecture. Large size data tests are disabled.
+-#endif
+-
+ TEST_F(DataTest, LoadingNonexistingFile) {
+   TempFile file(false); // Pass false to constructor, so the tempfile is not created
+   EXPECT_FALSE(Data::LoadFromFile(file.path()));
+-- 
+2.14.2
+
diff --git a/pkgs/tools/filesystems/cryfs/test-no-network.patch b/pkgs/tools/filesystems/cryfs/test-no-network.patch
new file mode 100644
index 00000000000..3392d3f855e
--- /dev/null
+++ b/pkgs/tools/filesystems/cryfs/test-no-network.patch
@@ -0,0 +1,24 @@
+From 8b1808e1278d2cb0dc56a4e98781eceeadfb9718 Mon Sep 17 00:00:00 2001
+From: adisbladis <adis@blad.is>
+Date: Thu, 12 Oct 2017 18:13:28 +0800
+Subject: [PATCH] Disable tests using external networking
+
+---
+ test/cpp-utils/CMakeLists.txt | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/test/cpp-utils/CMakeLists.txt b/test/cpp-utils/CMakeLists.txt
+index 5a2bc9f8..d838edba 100644
+--- a/test/cpp-utils/CMakeLists.txt
++++ b/test/cpp-utils/CMakeLists.txt
+@@ -20,7 +20,6 @@ set(SOURCES
+     tempfile/TempFileIncludeTest.cpp
+     tempfile/TempDirIncludeTest.cpp
+     tempfile/TempDirTest.cpp
+-    network/CurlHttpClientTest.cpp
+     network/FakeHttpClientTest.cpp
+     io/ConsoleIncludeTest.cpp
+     io/ConsoleTest_AskYesNo.cpp
+-- 
+2.14.2
+
diff --git a/pkgs/tools/filesystems/curlftpfs/default.nix b/pkgs/tools/filesystems/curlftpfs/default.nix
index 1897181e444..8797c21aa23 100644
--- a/pkgs/tools/filesystems/curlftpfs/default.nix
+++ b/pkgs/tools/filesystems/curlftpfs/default.nix
@@ -6,7 +6,8 @@ stdenv.mkDerivation {
     url = mirror://sourceforge/curlftpfs/curlftpfs-0.9.2.tar.gz;
     sha256 = "0n397hmv21jsr1j7zx3m21i7ryscdhkdsyqpvvns12q7qwwlgd2f";
   };
-  buildInputs = [fuse curl pkgconfig glib zlib];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [fuse curl glib zlib];
 
   meta = {
     platforms = stdenv.lib.platforms.linux;
diff --git a/pkgs/tools/filesystems/djmount/default.nix b/pkgs/tools/filesystems/djmount/default.nix
index 7010a60bcbc..e8deeaf4b47 100644
--- a/pkgs/tools/filesystems/djmount/default.nix
+++ b/pkgs/tools/filesystems/djmount/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "0kqf0cy3h4cfiy5a2sigmisx0lvvsi1n0fbyb9ll5gacmy1b8nxa";
   };
 
-  buildInputs = [ pkgconfig fuse];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ fuse];
 
   meta = {
     homepage = http://djmount.sourceforge.net/;
diff --git a/pkgs/tools/filesystems/duperemove/default.nix b/pkgs/tools/filesystems/duperemove/default.nix
index d333334d394..613ab7bab1e 100644
--- a/pkgs/tools/filesystems/duperemove/default.nix
+++ b/pkgs/tools/filesystems/duperemove/default.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation rec {
     sha256 = "1fll0xjg1p3pabgjiddild4ragk9spbdmdzrkq0hv5pxb1qrv7lp";
   };
 
-  buildInputs = [ libgcrypt pkgconfig glib linuxHeaders sqlite ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libgcrypt glib linuxHeaders sqlite ];
 
   makeFlags = [ "DESTDIR=$(out)" "PREFIX=" ];
 
diff --git a/pkgs/tools/filesystems/f2fs-tools/default.nix b/pkgs/tools/filesystems/f2fs-tools/default.nix
index fdad877d34c..53b17f45f9f 100644
--- a/pkgs/tools/filesystems/f2fs-tools/default.nix
+++ b/pkgs/tools/filesystems/f2fs-tools/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   name = "f2fs-tools-${version}";
-  version = "1.8.0";
+  version = "1.9.0";
 
   src = fetchgit {
     url = "git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs-tools.git";
     rev = "refs/tags/v${version}";
-    sha256 = "0mbpg6mng6jcm5vxq0ivhklgpkwvjbhjwgkhzxr50ln46h5kbd2f";
+    sha256 = "0aj9dbhv7vv19pyb2rhcg99v5v0s66sb9yzrdmi46bmvzz124pal";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
diff --git a/pkgs/tools/filesystems/fuse-7z-ng/default.nix b/pkgs/tools/filesystems/fuse-7z-ng/default.nix
index 8b3df52bcb7..82e2b404b82 100644
--- a/pkgs/tools/filesystems/fuse-7z-ng/default.nix
+++ b/pkgs/tools/filesystems/fuse-7z-ng/default.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation rec {
     sha256 = "17v1gcmg5q661b047zxjar735i4d3508dimw1x3z1pk4d1zjhp3x";
   };
 
-  buildInputs = [ fuse autoconf automake pkgconfig makeWrapper ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ fuse autoconf automake makeWrapper ];
 
   preConfigure = "./autogen.sh";
 
diff --git a/pkgs/tools/filesystems/fuseiso/default.nix b/pkgs/tools/filesystems/fuseiso/default.nix
index 7165789cf81..3ca46851306 100644
--- a/pkgs/tools/filesystems/fuseiso/default.nix
+++ b/pkgs/tools/filesystems/fuseiso/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "127xql52dcdhmh7s5m9xc6q39jdlj3zhbjar1j821kb6gl3jw94b";
   };
 
-  buildInputs = [ pkgconfig fuse zlib glib ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ fuse zlib glib ];
 
   patches = let fetchPatchFromDebian = { patch, sha256 }:
     fetchpatch {
diff --git a/pkgs/tools/filesystems/genimage/default.nix b/pkgs/tools/filesystems/genimage/default.nix
index b808573aa5b..792b2e2c75b 100644
--- a/pkgs/tools/filesystems/genimage/default.nix
+++ b/pkgs/tools/filesystems/genimage/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0y4h8x8lqxam8m90rdfq8cg5137kvilxr3d1qzddpx7nxpvmmwv9";
   };
 
-  buildInputs = [ pkgconfig libconfuse ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libconfuse ];
 
   postInstall = ''
     # As there is no manpage or built-in --help, add the README file for
diff --git a/pkgs/tools/filesystems/go-mtpfs/default.nix b/pkgs/tools/filesystems/go-mtpfs/default.nix
index f46dd74b266..028aef6024b 100644
--- a/pkgs/tools/filesystems/go-mtpfs/default.nix
+++ b/pkgs/tools/filesystems/go-mtpfs/default.nix
@@ -16,9 +16,5 @@ buildGoPackage rec {
     sha256 = "1jcqp9n8fd9psfsnhfj6w97yp0zmyxplsig8pyp2gqzh4lnb5fqm";
   };
 
-  preFixup = stdenv.lib.optionalString stdenv.isDarwin ''
-    install_name_tool -delete_rpath "$out/lib" $bin/bin/go-mtpfs
-  '';
-
   goDeps = ./deps.nix;
 }
diff --git a/pkgs/tools/filesystems/gocrypfs/default.nix b/pkgs/tools/filesystems/gocrypfs/default.nix
index c156cd13244..b9314015cf5 100644
--- a/pkgs/tools/filesystems/gocrypfs/default.nix
+++ b/pkgs/tools/filesystems/gocrypfs/default.nix
@@ -21,7 +21,8 @@ in buildGoPackage rec {
     sha256 = "0p173x2s0km7a43h6ihir5p19fdlkkb9lc9120k9hccr33iws25z";
   };
 
-  buildInputs = [pkgconfig openssl];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ openssl];
 
   goDeps = ./deps.nix;
 
diff --git a/pkgs/tools/filesystems/hubicfuse/default.nix b/pkgs/tools/filesystems/hubicfuse/default.nix
index 88922d9ce94..e9d3df026b0 100644
--- a/pkgs/tools/filesystems/hubicfuse/default.nix
+++ b/pkgs/tools/filesystems/hubicfuse/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "1y4n63bk9vd6n1l5psjb9xm9h042kw4yh2ni33z7agixkanajv1s";
   };
 
-  buildInputs = [ pkgconfig curl openssl fuse libxml2 json_c file ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ curl openssl fuse libxml2 json_c file ];
   postInstall = ''
     install hubic_token $out/bin
     mkdir -p $out/sbin
diff --git a/pkgs/tools/filesystems/irods/common.nix b/pkgs/tools/filesystems/irods/common.nix
index 9c5412ddef7..c7267aca107 100644
--- a/pkgs/tools/filesystems/irods/common.nix
+++ b/pkgs/tools/filesystems/irods/common.nix
@@ -9,8 +9,6 @@ with stdenv;
 
   buildInputs = [ bzip2 zlib autoconf automake cmake gnumake help2man texinfo libtool cppzmq libarchive avro-cpp jansson zeromq openssl pam libiodbc kerberos gcc boost libcxx which ];
 
-  propagateBuildInputs = [ boost ];
-
   cmakeFlags = [
     "-DIRODS_EXTERNALS_FULLPATH_CLANG=${stdenv.cc}"
     "-DIRODS_EXTERNALS_FULLPATH_CLANG_RUNTIME=${stdenv.cc}"
diff --git a/pkgs/tools/filesystems/irods/default.nix b/pkgs/tools/filesystems/irods/default.nix
index 0714f290104..523028f5fb2 100644
--- a/pkgs/tools/filesystems/irods/default.nix
+++ b/pkgs/tools/filesystems/irods/default.nix
@@ -62,8 +62,6 @@ in rec {
 
      buildInputs = common.buildInputs ++ [ irods ];
 
-     propagateBuildInputs = [ boost ];
-
      preConfigure = common.preConfigure + ''
        patchShebangs ./bin
      '';
diff --git a/pkgs/tools/filesystems/jmtpfs/default.nix b/pkgs/tools/filesystems/jmtpfs/default.nix
index 091270deab6..6044806a34b 100644
--- a/pkgs/tools/filesystems/jmtpfs/default.nix
+++ b/pkgs/tools/filesystems/jmtpfs/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation {
     owner = "JasonFerrara";
   };
 
-  buildInputs = [ file fuse libmtp pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ file fuse libmtp ];
 
   meta = with stdenv.lib; {
     description = "A FUSE filesystem for MTP devices like Android phones";
diff --git a/pkgs/tools/filesystems/mhddfs/default.nix b/pkgs/tools/filesystems/mhddfs/default.nix
index 54a8f845915..697256982bb 100644
--- a/pkgs/tools/filesystems/mhddfs/default.nix
+++ b/pkgs/tools/filesystems/mhddfs/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "14ggmh91vv69fp2qpz0nxp0hprlw2wsijss2k2485hb0ci4cabvh";
   };
 
-  buildInputs = [ fuse pkgconfig attr uthash ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ fuse attr uthash ];
 
   patches = [
     ./fix-format-security-error.patch
diff --git a/pkgs/tools/filesystems/mtpfs/default.nix b/pkgs/tools/filesystems/mtpfs/default.nix
index 7725b0d7af8..6d2b073d869 100644
--- a/pkgs/tools/filesystems/mtpfs/default.nix
+++ b/pkgs/tools/filesystems/mtpfs/default.nix
@@ -3,7 +3,8 @@
 stdenv.mkDerivation rec {
   name = "mtpfs-1.1";
 
-  buildInputs = [ pkgconfig fuse libmtp glib libid3tag libmad ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ fuse libmtp glib libid3tag libmad ];
 
   # adding LIBS is a hack, duno why it does not find libid3tag.so by adding buildInputs
   preConfigure = ''
diff --git a/pkgs/tools/filesystems/netatalk/default.nix b/pkgs/tools/filesystems/netatalk/default.nix
index 0214afce6d4..445e724e1a2 100644
--- a/pkgs/tools/filesystems/netatalk/default.nix
+++ b/pkgs/tools/filesystems/netatalk/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec{
     sha256 = "0wf09fyqzza024qr1s26z5x7rsvh9zb4pv598gw7gm77wjcr6174";
   };
 
-  buildInputs = [ pkgconfig db libgcrypt avahi libiconv pam openssl acl ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ db libgcrypt avahi libiconv pam openssl acl ];
 
   patches = ./omitLocalstatedirCreation.patch;
 
diff --git a/pkgs/tools/filesystems/nixpart/0.4/cryptsetup.nix b/pkgs/tools/filesystems/nixpart/0.4/cryptsetup.nix
index c612512b8cc..24eec2f0dc4 100644
--- a/pkgs/tools/filesystems/nixpart/0.4/cryptsetup.nix
+++ b/pkgs/tools/filesystems/nixpart/0.4/cryptsetup.nix
@@ -15,7 +15,8 @@ stdenv.mkDerivation rec {
   configureFlags = [ "--enable-cryptsetup-reencrypt" ]
                 ++ stdenv.lib.optional enablePython "--enable-python";
 
-  buildInputs = [ devicemapper libgcrypt libuuid pkgconfig popt ]
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ devicemapper libgcrypt libuuid popt ]
              ++ stdenv.lib.optional enablePython python;
 
   meta = {
diff --git a/pkgs/tools/filesystems/nixpart/0.4/lvm2.nix b/pkgs/tools/filesystems/nixpart/0.4/lvm2.nix
index 6301cbb6842..df14d7efda4 100644
--- a/pkgs/tools/filesystems/nixpart/0.4/lvm2.nix
+++ b/pkgs/tools/filesystems/nixpart/0.4/lvm2.nix
@@ -15,7 +15,8 @@ stdenv.mkDerivation {
   configureFlags =
     "--disable-readline --enable-udev_rules --enable-udev_sync --enable-pkgconfig --enable-applib";
 
-  buildInputs = [ pkgconfig systemd ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ systemd ];
 
   preConfigure =
     ''
diff --git a/pkgs/tools/filesystems/nixpart/0.4/pyparted.nix b/pkgs/tools/filesystems/nixpart/0.4/pyparted.nix
index 0d3370c4b1e..fd6c5b91309 100644
--- a/pkgs/tools/filesystems/nixpart/0.4/pyparted.nix
+++ b/pkgs/tools/filesystems/nixpart/0.4/pyparted.nix
@@ -24,7 +24,7 @@ buildPythonApplication rec {
     PATH="${parted}/sbin:$PATH"
   '';
 
-  buildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
 
   propagatedBuildInputs = [ parted ];
 
diff --git a/pkgs/tools/filesystems/relfs/default.nix b/pkgs/tools/filesystems/relfs/default.nix
index 0c8e1c4ef81..9a8c3ecb0fc 100644
--- a/pkgs/tools/filesystems/relfs/default.nix
+++ b/pkgs/tools/filesystems/relfs/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
 		sha256 = "949f8eff7e74ff2666cccf8a1efbfcce8d54bc41bec6ad6db8c029de7ca832a3";
 	};
 
-  buildInputs = [ ocaml fuse postgresql pcre libuuid gnome_vfs pkgconfig GConf ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ ocaml fuse postgresql pcre libuuid gnome_vfs GConf ];
 
   buildPhase = ''
     cd deps
diff --git a/pkgs/tools/filesystems/smbnetfs/default.nix b/pkgs/tools/filesystems/smbnetfs/default.nix
index 3bc13d43a36..fc504b3208d 100644
--- a/pkgs/tools/filesystems/smbnetfs/default.nix
+++ b/pkgs/tools/filesystems/smbnetfs/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "16sikr81ipn8v1a1zrqgnsy2as3zcaxbzkr0bm5vxy012bq0plkd";
   };
 
-  buildInputs = [ fuse samba pkgconfig glib ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ fuse samba glib ];
 
   meta = with stdenv.lib; {
     description = "A FUSE FS for mounting Samba shares";
diff --git a/pkgs/tools/filesystems/snapraid/default.nix b/pkgs/tools/filesystems/snapraid/default.nix
index ccb20e9f1bd..c9f605ca69f 100644
--- a/pkgs/tools/filesystems/snapraid/default.nix
+++ b/pkgs/tools/filesystems/snapraid/default.nix
@@ -13,7 +13,8 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  buildInputs = [ autoreconfHook ];
+  nativeBuildInputs = [ autoreconfHook ];
+  buildInputs = [ ];
 
   meta = {
     homepage = http://www.snapraid.it/;
diff --git a/pkgs/tools/filesystems/u3-tool/default.nix b/pkgs/tools/filesystems/u3-tool/default.nix
new file mode 100644
index 00000000000..65eafe76710
--- /dev/null
+++ b/pkgs/tools/filesystems/u3-tool/default.nix
@@ -0,0 +1,22 @@
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  pname = "u3-tool";
+  version = "0.3";
+  name = "${pname}-${version}";
+
+  enableParallelBuilding = true;
+
+  src = fetchurl {
+    url = "mirror://sourceforge/${pname}/${name}.tar.gz";
+    sha256 = "1p9c9kibd1pdbdfa0nd0i3n7bvzi3xg0chm38jg3xfl8gsn0390f";
+  };
+
+  meta = with stdenv.lib; {
+    description = "Tool for controlling the special features of a 'U3 smart drive' USB Flash disk";
+    homepage = https://sourceforge.net/projects/u3-tool/ ;
+    license = licenses.gpl2;
+    platforms = with platforms; linux;
+    maintainers = with maintainers; [ makefu ];
+  };
+}
diff --git a/pkgs/tools/filesystems/wdfs/default.nix b/pkgs/tools/filesystems/wdfs/default.nix
index a51f2d47172..dc725b5078f 100644
--- a/pkgs/tools/filesystems/wdfs/default.nix
+++ b/pkgs/tools/filesystems/wdfs/default.nix
@@ -7,7 +7,8 @@ stdenv.mkDerivation rec
     url = "http://noedler.de/projekte/wdfs/wdfs-1.4.2.tar.gz";
     sha256 = "fcf2e1584568b07c7f3683a983a9be26fae6534b8109e09167e5dff9114ba2e5";
   };
-  buildInputs = [fuse glib neon pkgconfig];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [fuse glib neon];
   meta = {
     homepage = http://noedler.de/projekte/wdfs/;
     description = "User-space filesystem that allows to mount a webdav share";
diff --git a/pkgs/tools/filesystems/zkfuse/default.nix b/pkgs/tools/filesystems/zkfuse/default.nix
index 0738ee84cab..9dfb2deeaee 100644
--- a/pkgs/tools/filesystems/zkfuse/default.nix
+++ b/pkgs/tools/filesystems/zkfuse/default.nix
@@ -6,7 +6,8 @@ stdenv.mkDerivation rec {
 
   sourceRoot = "${zookeeper.name}/src/contrib/zkfuse";
 
-  buildInputs = [ autoreconfHook zookeeper_mt log4cxx boost fuse ];
+  nativeBuildInputs = [ autoreconfHook ];
+  buildInputs = [ zookeeper_mt log4cxx boost fuse ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/tools/graphics/dmtx-utils/default.nix b/pkgs/tools/graphics/dmtx-utils/default.nix
index 3e4e3e9312e..bb816e48940 100644
--- a/pkgs/tools/graphics/dmtx-utils/default.nix
+++ b/pkgs/tools/graphics/dmtx-utils/default.nix
@@ -9,13 +9,14 @@ let
     url="mirror://sourceforge/project/libdmtx/libdmtx/0.7.4/dmtx-utils-0.7.4.tar.gz";
     sha256="1di8ymlziy9856abd6rb72z0zqzmrff4r3vql0q9r5sk5ax4s417";
   };
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    libdmtx pkgconfig imagemagick
+    libdmtx imagemagick
   ];
 in
 stdenv.mkDerivation {
   inherit (s) name version;
-  inherit buildInputs;
+  inherit nativeBuildInputs buildInputs;
   src = fetchurl {
     inherit (s) url sha256;
   };
diff --git a/pkgs/tools/graphics/editres/default.nix b/pkgs/tools/graphics/editres/default.nix
index 86848f95883..91dd85b0757 100644
--- a/pkgs/tools/graphics/editres/default.nix
+++ b/pkgs/tools/graphics/editres/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "06kv7dmw6pzlqc46dbh8k9xpb6sn4ihh0bcpxq0zpvw2lm66dx45";
   };
 
-  buildInputs = [ pkgconfig libXt libXaw libXres utilmacros ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libXt libXaw libXres utilmacros ];
 
   configureFlags = "--with-appdefaultdir=$(out)/share/X11/app-defaults/editres";
 
diff --git a/pkgs/tools/graphics/escrotum/default.nix b/pkgs/tools/graphics/escrotum/default.nix
new file mode 100644
index 00000000000..2a4f3c9cbff
--- /dev/null
+++ b/pkgs/tools/graphics/escrotum/default.nix
@@ -0,0 +1,25 @@
+{ lib, fetchFromGitHub, buildPythonApplication
+, pygtk
+, numpy ? null
+}:
+
+buildPythonApplication {
+  name = "escrotum-2017-01-28";
+
+  src = fetchFromGitHub {
+    owner  = "Roger";
+    repo   = "escrotum";
+    rev    = "a51e330f976c1c9e1ac6932c04c41381722d2171";
+    sha256 = "0vbpyihqgm0fyh22ashy4lhsrk67n31nw3bs14d1wr7ky0l3rdnj";
+  };
+
+  propagatedBuildInputs = [ pygtk numpy ];
+
+  meta = with lib; {
+    homepage = https://github.com/Roger/escrotum;
+    description = "Linux screen capture using pygtk, inspired by scrot";
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ rasendubi ];
+    license = licenses.gpl3;
+  };
+}
diff --git a/pkgs/tools/graphics/exif/default.nix b/pkgs/tools/graphics/exif/default.nix
index 2534a9cbefa..537d1a8c7db 100644
--- a/pkgs/tools/graphics/exif/default.nix
+++ b/pkgs/tools/graphics/exif/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "1zb9hwdl783d4vd2s2rw642hg8hd6n0mfp6lrbiqmp9jmhlq5rsr";
   };
 
-  buildInputs = [ pkgconfig libexif popt ] ++ libintlOrEmpty;
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libexif popt ] ++ libintlOrEmpty;
 
   meta = {
     homepage = http://libexif.sourceforge.net/;
diff --git a/pkgs/tools/graphics/ggobi/default.nix b/pkgs/tools/graphics/ggobi/default.nix
index e7fb3e773c1..071c8f36079 100644
--- a/pkgs/tools/graphics/ggobi/default.nix
+++ b/pkgs/tools/graphics/ggobi/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "2c4ddc3ab71877ba184523e47b0637526e6f3701bd9afb6472e6dfc25646aed7";
   };
 
-  buildInputs = [ pkgconfig libxml2 gtk2 ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libxml2 gtk2 ];
 
   configureFlags = "--with-all-plugins";
 
diff --git a/pkgs/tools/graphics/glmark2/default.nix b/pkgs/tools/graphics/glmark2/default.nix
index e37ebb50bf7..0d31f8f1a6f 100644
--- a/pkgs/tools/graphics/glmark2/default.nix
+++ b/pkgs/tools/graphics/glmark2/default.nix
@@ -12,8 +12,9 @@ stdenv.mkDerivation rec {
     sha256 = "076l75rfl6pnp1wgiwlaihy1vg2advg1z8bi0x84kk259kldgvwn";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    pkgconfig libjpeg libpng xorg.libxcb libX11 mesa libdrm python27 wayland libudev
+    libjpeg libpng xorg.libxcb libX11 mesa libdrm python27 wayland libudev
   ];
 
   buildPhase = ''
diff --git a/pkgs/tools/graphics/gromit-mpx/default.nix b/pkgs/tools/graphics/gromit-mpx/default.nix
index 376d1bc134d..7261326633a 100644
--- a/pkgs/tools/graphics/gromit-mpx/default.nix
+++ b/pkgs/tools/graphics/gromit-mpx/default.nix
@@ -14,8 +14,9 @@ stdenv.mkDerivation rec {
     sha256 = "1dkmp5rhzp56sz9cfxill2pkdz2anwb8kkxkypvk2xhqi64cvkrs";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    autoconf automake autoreconfHook pkgconfig
+    autoconf automake autoreconfHook
     gtk glib pcre libappindicator libpthreadstubs
     libXdmcp libxkbcommon epoxy at_spi2_core
     dbus libdbusmenu-glib
diff --git a/pkgs/tools/graphics/leela/default.nix b/pkgs/tools/graphics/leela/default.nix
index 333b0f95b72..d1b31f39152 100644
--- a/pkgs/tools/graphics/leela/default.nix
+++ b/pkgs/tools/graphics/leela/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation {
     sha256 = "1k6n758r9dhjmc1pnpk6qzpg0q7pkq2hf18z3b0s2z198jpkg9s3";
   };
 
-  buildInputs = [ pkgconfig poppler ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ poppler ];
 
   installFlags = [ "PREFIX=$(out)" "MANDIR=$(out)/share/man" ];
 
diff --git a/pkgs/tools/graphics/logstalgia/default.nix b/pkgs/tools/graphics/logstalgia/default.nix
index f7f9211b515..abebc0fc4ca 100644
--- a/pkgs/tools/graphics/logstalgia/default.nix
+++ b/pkgs/tools/graphics/logstalgia/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
     sha256 = "1qghz1j3jmfj093br2hfyibayg3fmhg8fvp5ix9n9rbvzc1zslsm";
   };
 
-  buildInputs = [ glew SDL2 ftgl pkgconfig libpng libjpeg pcre SDL2_image mesa boost
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ glew SDL2 ftgl libpng libjpeg pcre SDL2_image mesa boost
                   glm freetype ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/graphics/pdf2svg/default.nix b/pkgs/tools/graphics/pdf2svg/default.nix
index dad611868bc..058900b8e23 100644
--- a/pkgs/tools/graphics/pdf2svg/default.nix
+++ b/pkgs/tools/graphics/pdf2svg/default.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation rec {
     sha256 = "14ffdm4y26imq99wjhkrhy9lp33165xci1l5ndwfia8hz53bl02k";
   };
 
-  buildInputs = [ autoreconfHook cairo pkgconfig poppler gtk2 ];
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  buildInputs = [ cairo poppler gtk2 ];
 
   meta = with stdenv.lib; {
     description = "PDF converter to SVG format";
diff --git a/pkgs/tools/graphics/pngnq/default.nix b/pkgs/tools/graphics/pngnq/default.nix
index 5676b37042d..e01f3ea2acc 100644
--- a/pkgs/tools/graphics/pngnq/default.nix
+++ b/pkgs/tools/graphics/pngnq/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "1qmnnl846agg55i7h4vmrn11lgb8kg6gvs8byqz34bdkjh5gwiy1";
   };
 
-  buildInputs = [ pkgconfig libpng zlib ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libpng zlib ];
 
   patchPhase = ''
     sed -i '/png.h/a \#include <zlib.h>' src/rwpng.c
diff --git a/pkgs/tools/graphics/pngquant/default.nix b/pkgs/tools/graphics/pngquant/default.nix
index 78a2a7cb695..93f57f95e3e 100644
--- a/pkgs/tools/graphics/pngquant/default.nix
+++ b/pkgs/tools/graphics/pngquant/default.nix
@@ -13,7 +13,8 @@ stdenv.mkDerivation rec {
 
   preConfigure = "patchShebangs .";
 
-  buildInputs = [ pkgconfig libpng zlib lcms2 ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libpng zlib lcms2 ];
 
   meta = with stdenv.lib; {
     homepage = https://pngquant.org/;
diff --git a/pkgs/tools/graphics/quirc/default.nix b/pkgs/tools/graphics/quirc/default.nix
index a801dd8ebda..9891ea5e52b 100644
--- a/pkgs/tools/graphics/quirc/default.nix
+++ b/pkgs/tools/graphics/quirc/default.nix
@@ -10,13 +10,13 @@ let
     rev = "5b262480091d5f84a67a4a56c728fc8b39844339";
     sha256 = "1w5qvjafn14s6jjs7kiwsqirlsqbgv0p152hrsq463pm34hp0lzy";
   };
-  buildInputs = [
-    SDL SDL_gfx libjpeg pkgconfig libpng
-  ];
 in
 stdenv.mkDerivation {
   inherit (s) name version;
-  inherit buildInputs;
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [
+    SDL SDL_gfx libjpeg libpng
+  ];
   src = fetchgit {
     inherit (s) url sha256 rev;
   };
diff --git a/pkgs/tools/graphics/unpaper/default.nix b/pkgs/tools/graphics/unpaper/default.nix
index 2b64cbcc1f5..b58114a61a5 100644
--- a/pkgs/tools/graphics/unpaper/default.nix
+++ b/pkgs/tools/graphics/unpaper/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0c5rbkxbmy9k8vxjh4cv0bgnqd3wqc99yzw215vkyjslvbsq8z13";
   };
 
-  buildInputs = [ pkgconfig libav libxslt ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libav libxslt ];
 
   meta = with stdenv.lib; {
     homepage = https://www.flameeyes.eu/projects/unpaper;
diff --git a/pkgs/tools/inputmethods/fcitx-engines/fcitx-anthy/default.nix b/pkgs/tools/inputmethods/fcitx-engines/fcitx-anthy/default.nix
index 9d8427e533c..7f09b488c28 100644
--- a/pkgs/tools/inputmethods/fcitx-engines/fcitx-anthy/default.nix
+++ b/pkgs/tools/inputmethods/fcitx-engines/fcitx-anthy/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0ayrzfx95670k86y19bzl6i6w98haaln3x8dxpb39a5dwgz59pf8";
   };
 
-  buildInputs = [ cmake fcitx anthy gettext pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ cmake fcitx anthy gettext ];
 
   preInstall = ''
     substituteInPlace src/cmake_install.cmake \
diff --git a/pkgs/tools/inputmethods/fcitx-engines/fcitx-chewing/default.nix b/pkgs/tools/inputmethods/fcitx-engines/fcitx-chewing/default.nix
index 58695434cb6..361355d1d68 100644
--- a/pkgs/tools/inputmethods/fcitx-engines/fcitx-chewing/default.nix
+++ b/pkgs/tools/inputmethods/fcitx-engines/fcitx-chewing/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0l548xdx2fvjya1ixp37pn382yak0m4kwfh9lgh7l3y2sblqw9zs";
   };
 
-  buildInputs = [ cmake fcitx gettext libchewing pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ cmake fcitx gettext libchewing ];
 
   preInstall = ''
    substituteInPlace src/cmake_install.cmake \
diff --git a/pkgs/tools/inputmethods/fcitx-engines/fcitx-cloudpinyin/default.nix b/pkgs/tools/inputmethods/fcitx-engines/fcitx-cloudpinyin/default.nix
index acd377441e2..ebb6627dcca 100644
--- a/pkgs/tools/inputmethods/fcitx-engines/fcitx-cloudpinyin/default.nix
+++ b/pkgs/tools/inputmethods/fcitx-engines/fcitx-cloudpinyin/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "143x9gbswzfngvgfy77zskrzrpywj8qg2d19kisgfwfisk7yhcf1";
   };
 
-  buildInputs = [ cmake pkgconfig fcitx gettext curl ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ cmake fcitx gettext curl ];
 
   preInstall = ''
     substituteInPlace src/cmake_install.cmake \
diff --git a/pkgs/tools/inputmethods/fcitx-engines/fcitx-hangul/default.nix b/pkgs/tools/inputmethods/fcitx-engines/fcitx-hangul/default.nix
index 54b5335d9bb..41560227bca 100644
--- a/pkgs/tools/inputmethods/fcitx-engines/fcitx-hangul/default.nix
+++ b/pkgs/tools/inputmethods/fcitx-engines/fcitx-hangul/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "1jq78nczliw6pnhfac8hspffybrry6syk17y0wwcq05j3r3nd2lp";
   };
 
-  buildInputs = [ cmake fcitx libhangul gettext pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ cmake fcitx libhangul gettext ];
 
   preInstall = ''
     substituteInPlace src/cmake_install.cmake \
diff --git a/pkgs/tools/inputmethods/fcitx-engines/fcitx-libpinyin/default.nix b/pkgs/tools/inputmethods/fcitx-engines/fcitx-libpinyin/default.nix
index c441a4964b8..6022bcebc3b 100644
--- a/pkgs/tools/inputmethods/fcitx-engines/fcitx-libpinyin/default.nix
+++ b/pkgs/tools/inputmethods/fcitx-engines/fcitx-libpinyin/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "19h0p1s8bkw24v7x6v19fg7dqpz2kkjlvvrqhypi5bkkvfswf7xn";
   };
 
-  buildInputs = [ cmake pkgconfig fcitx gettext libpinyin glib pcre dbus qt4 ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ cmake fcitx gettext libpinyin glib pcre dbus qt4 ];
 
   preInstall = ''
     substituteInPlace src/cmake_install.cmake \
diff --git a/pkgs/tools/inputmethods/fcitx-engines/fcitx-m17n/default.nix b/pkgs/tools/inputmethods/fcitx-engines/fcitx-m17n/default.nix
index ff42bbbbcc8..c0c921f7b18 100644
--- a/pkgs/tools/inputmethods/fcitx-engines/fcitx-m17n/default.nix
+++ b/pkgs/tools/inputmethods/fcitx-engines/fcitx-m17n/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0ffyhsg7bc6525k94kfhnja1h6ajlfprq72d286dp54cksnakyc4";
   };
 
-  buildInputs = [ cmake fcitx gettext m17n_lib m17n_db pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ cmake fcitx gettext m17n_lib m17n_db ];
 
   preInstall = ''
     substituteInPlace im/cmake_install.cmake \
diff --git a/pkgs/tools/inputmethods/fcitx-engines/fcitx-unikey/default.nix b/pkgs/tools/inputmethods/fcitx-engines/fcitx-unikey/default.nix
index 4581f80a75e..ddfa41dda31 100644
--- a/pkgs/tools/inputmethods/fcitx-engines/fcitx-unikey/default.nix
+++ b/pkgs/tools/inputmethods/fcitx-engines/fcitx-unikey/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "063vc29v7ycaai98v3z4q319sv9sm91my17pmhblw1vifxnw02wf";
   };
 
-  buildInputs = [ cmake fcitx gettext pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ cmake fcitx gettext ];
 
   NIX_CFLAGS_COMPILE = "-Wno-narrowing";
 
diff --git a/pkgs/tools/inputmethods/fcitx/fcitx-configtool.nix b/pkgs/tools/inputmethods/fcitx/fcitx-configtool.nix
index 83034222261..b5b394c5b6c 100644
--- a/pkgs/tools/inputmethods/fcitx/fcitx-configtool.nix
+++ b/pkgs/tools/inputmethods/fcitx/fcitx-configtool.nix
@@ -15,7 +15,8 @@ stdenv.mkDerivation rec {
     sha256 = "1ypr2jr3vzs2shqfrvhqy69xvagrn9x507180i9wxy14hb97a82r";
   };
 
-  buildInputs = [ makeWrapper fcitx cmake isocodes pkgconfig gtk3
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ makeWrapper fcitx cmake isocodes gtk3
     gnome3.defaultIconTheme ];
 
   preFixup = ''
diff --git a/pkgs/tools/inputmethods/ibus-engines/ibus-table-others/default.nix b/pkgs/tools/inputmethods/ibus-engines/ibus-table-others/default.nix
index f3e3973a2c3..328c803e7db 100644
--- a/pkgs/tools/inputmethods/ibus-engines/ibus-table-others/default.nix
+++ b/pkgs/tools/inputmethods/ibus-engines/ibus-table-others/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0vmz82il796062jbla5pawsr5dqyhs7ald7xjp84zfccc09dg9kx";
   };
 
-  buildInputs = [ ibus ibus-table pkgconfig python3 ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ ibus ibus-table python3 ];
 
   preBuild = ''
     export HOME=$(mktemp -d)/ibus-table-others
diff --git a/pkgs/tools/inputmethods/ibus-engines/ibus-table/default.nix b/pkgs/tools/inputmethods/ibus-engines/ibus-table/default.nix
index 8c842dbc841..8c552799432 100644
--- a/pkgs/tools/inputmethods/ibus-engines/ibus-table/default.nix
+++ b/pkgs/tools/inputmethods/ibus-engines/ibus-table/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
   '';
 
   buildInputs = [
-    dconf gtk3 gobjectIntrospection ibus python3
+    dconf gtk3 gobjectIntrospection ibus (python3.withPackages (pypkgs: with pypkgs; [ pygobject3 ]))
   ];
 
   nativeBuildInputs = [ autoreconfHook docbook2x pkgconfig python3.pkgs.wrapPython ];
diff --git a/pkgs/tools/inputmethods/ibus/ibus-qt.nix b/pkgs/tools/inputmethods/ibus/ibus-qt.nix
index 95c32532e40..8d02d4edde8 100644
--- a/pkgs/tools/inputmethods/ibus/ibus-qt.nix
+++ b/pkgs/tools/inputmethods/ibus/ibus-qt.nix
@@ -9,8 +9,9 @@ stdenv.mkDerivation rec {
     sha256 = "1q9g7qghpcf07valc2ni7yf994xqx2pmdffknj7scxfidav6p19g";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    ibus cmake pkgconfig qt4 icu doxygen
+    ibus cmake qt4 icu doxygen
   ];
 
   cmakeFlags = [ "-DQT_PLUGINS_DIR=lib/qt4/plugins" ];
diff --git a/pkgs/tools/inputmethods/nabi/default.nix b/pkgs/tools/inputmethods/nabi/default.nix
index cb33abc3213..7ca5af555f9 100644
--- a/pkgs/tools/inputmethods/nabi/default.nix
+++ b/pkgs/tools/inputmethods/nabi/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation {
     sha256 = "0craa24pw7b70sh253arv9bg9sy4q3mhsjwfss3bnv5nf0xwnncw";
   };
 
-  buildInputs = [ gtk2 libhangul pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ gtk2 libhangul ];
 
   meta = with stdenv.lib; {
     description = "The Easy Hangul XIM";
diff --git a/pkgs/tools/misc/appdata-tools/default.nix b/pkgs/tools/misc/appdata-tools/default.nix
index cdb5abcf453..54c78874dd2 100644
--- a/pkgs/tools/misc/appdata-tools/default.nix
+++ b/pkgs/tools/misc/appdata-tools/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
     sha256 = "1bzqg4gy8gqhbk2qjizsm0b78li9mv84fb3d8qwfpxh7c7p360x8";
   };
 
-  buildInputs = [ pkgconfig autoconf automake m4 intltool glib
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ autoconf automake m4 intltool glib
                   libsoup gdk_pixbuf ];
 
   configureScript = "./autogen.sh";
diff --git a/pkgs/tools/misc/autorandr/default.nix b/pkgs/tools/misc/autorandr/default.nix
index dc67c96ca1a..405eb29f6bf 100644
--- a/pkgs/tools/misc/autorandr/default.nix
+++ b/pkgs/tools/misc/autorandr/default.nix
@@ -1,7 +1,9 @@
 { stdenv
 , python3Packages
 , fetchFromGitHub
-, systemd }:
+, systemd
+, xrandr
+, makeWrapper }:
 
 let
   python = python3Packages.python;
@@ -12,6 +14,7 @@ in
     name = "autorandr-${version}";
 
     buildInputs = [ python ];
+    nativeBuildInputs = [ makeWrapper ];
 
     installPhase = ''
       runHook preInstall
@@ -33,9 +36,15 @@ in
         make install TARGETS='udev' PREFIX=$out DESTDIR=$out \
           UDEV_RULES_DIR=/etc/udev/rules.d
       ''}
+
       runHook postInstall
     '';
 
+    postFixup = ''
+      wrapProgram $out/bin/autorandr \
+        --prefix PATH : ${xrandr}/bin
+    '';
+
     src = fetchFromGitHub {
       owner = "phillipberndt";
       repo = "autorandr";
diff --git a/pkgs/tools/misc/blink1-tool/default.nix b/pkgs/tools/misc/blink1-tool/default.nix
index 29b199e5866..9a09fba93e6 100644
--- a/pkgs/tools/misc/blink1-tool/default.nix
+++ b/pkgs/tools/misc/blink1-tool/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "05hbnp20cdvyyqf6jr01waz1ycis20qzsd8hn27snmn6qd48igrb";
   };
 
-  buildInputs = [ libusb1 pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libusb1 ];
 
   configurePhase = ''
     cd commandline
diff --git a/pkgs/tools/misc/brltty/default.nix b/pkgs/tools/misc/brltty/default.nix
index af9861ea6ed..ea1ac6d116b 100644
--- a/pkgs/tools/misc/brltty/default.nix
+++ b/pkgs/tools/misc/brltty/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "0slrqanwj9cm7ql0rpb296xq676zrc1sjyr13lh5lygp4b8qfpci";
   };
   
-  buildInputs = [ pkgconfig bluez ]
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ bluez ]
     ++ stdenv.lib.optional alsaSupport alsaLib
     ++ stdenv.lib.optional systemdSupport systemd;
   
diff --git a/pkgs/tools/misc/colord-gtk/default.nix b/pkgs/tools/misc/colord-gtk/default.nix
index 96022d01ef7..c26f835c0ee 100644
--- a/pkgs/tools/misc/colord-gtk/default.nix
+++ b/pkgs/tools/misc/colord-gtk/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "0i9y3bb5apj6a0f8cx36l6mjzs7xc0k7nf0magmf58vy2mzhpl18";
   };
 
-  buildInputs = [ intltool colord glib gtk3 pkgconfig lcms2 ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ intltool colord glib gtk3 lcms2 ];
 
   meta = {
     homepage = http://www.freedesktop.org/software/colord/intro.html;
diff --git a/pkgs/tools/misc/colord/default.nix b/pkgs/tools/misc/colord/default.nix
index 46f3786a6df..40ea672296d 100644
--- a/pkgs/tools/misc/colord/default.nix
+++ b/pkgs/tools/misc/colord/default.nix
@@ -10,7 +10,6 @@ stdenv.mkDerivation rec {
     url = "http://www.freedesktop.org/software/colord/releases/${name}.tar.xz";
     sha256 = "0flcsr148xshjbff030pgyk9ar25an901m9q1pjgjdvaq5j1h96m";
   };
-   nativeBuildInputs = [ autoreconfHook intltool ];
 
   enableParallelBuilding = true;
 
@@ -34,7 +33,9 @@ stdenv.mkDerivation rec {
     sed -e "s|if test -w .*;|if false;|" -i src/Makefile.{am,in}
   '';
 
-  buildInputs = [ glib polkit pkgconfig gusb libusb1 lcms2 sqlite systemd dbus gobjectIntrospection
+  nativeBuildInputs = [ autoreconfHook intltool pkgconfig ];
+
+  buildInputs = [ glib polkit gusb libusb1 lcms2 sqlite systemd dbus gobjectIntrospection
                   bash-completion argyllcms libgudev sane-backends ];
 
   postInstall = ''
diff --git a/pkgs/tools/misc/cunit/default.nix b/pkgs/tools/misc/cunit/default.nix
index dfa6bf71bb4..6bbf049d244 100644
--- a/pkgs/tools/misc/cunit/default.nix
+++ b/pkgs/tools/misc/cunit/default.nix
@@ -4,7 +4,8 @@ stdenv.mkDerivation rec {
   name = "CUnit-${version}";
   version = "2.1-3";
 
-  buildInputs = [autoconf automake libtool autoreconfHook];
+  nativeBuildInputs = [ autoreconfHook ];
+  buildInputs = [autoconf automake libtool];
 
   src = fetchurl {
     url = "mirror://sourceforge/cunit/CUnit/${version}/${name}.tar.bz2";
diff --git a/pkgs/tools/misc/dbus-map/default.nix b/pkgs/tools/misc/dbus-map/default.nix
index b6f483fb4ef..8dcaecf9851 100644
--- a/pkgs/tools/misc/dbus-map/default.nix
+++ b/pkgs/tools/misc/dbus-map/default.nix
@@ -9,8 +9,9 @@ stdenv.mkDerivation rec {
     rev = "43703fc5e15743309b67131b5ba457b0d6ea7667";
     sha256 = "1pjqn6w29ci8hfxkn1aynzfc8nvy3pqv3hixbxwr7qx20g4rwvdc";
   };
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    pkgconfig glib procps libxml2
+    glib procps libxml2
   ];
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/tools/misc/desktop-file-utils/default.nix b/pkgs/tools/misc/desktop-file-utils/default.nix
index 039ec27947a..e5e3815481f 100644
--- a/pkgs/tools/misc/desktop-file-utils/default.nix
+++ b/pkgs/tools/misc/desktop-file-utils/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
     sha256 = "1ianvr2a69yjv4rpyv30w7yjsmnsb23crrka5ndqxycj4rkk4dc4";
   };
 
-  buildInputs = [ pkgconfig glib libintlOrEmpty ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ glib libintlOrEmpty ];
 
   NIX_LDFLAGS = optionalString stdenv.isDarwin "-lintl";
 
diff --git a/pkgs/tools/misc/direnv/default.nix b/pkgs/tools/misc/direnv/default.nix
index 1606fffe397..f36a6d51b36 100644
--- a/pkgs/tools/misc/direnv/default.nix
+++ b/pkgs/tools/misc/direnv/default.nix
@@ -2,14 +2,14 @@
 
 buildGoPackage rec {
   name = "direnv-${version}";
-  version = "2.12.2";
+  version = "2.13.1";
   goPackagePath = "github.com/direnv/direnv";
 
   src = fetchFromGitHub {
     owner = "direnv";
     repo = "direnv";
     rev = "v${version}";
-    sha256 = "0i8fnxhcl1zin714wxk93x8fi36z4fibapfn4jl3qkwbczkj8c8b";
+    sha256 = "1j2jkxzd6rh4ms39izqfm4w8h12dg0ccvqsj0z1z4hb3f1jqcgbz";
   };
 
   postConfigure = ''
@@ -25,8 +25,6 @@ buildGoPackage rec {
     make install DESTDIR=$bin
     mkdir -p $bin/share/fish/vendor_conf.d
     echo "eval ($bin/bin/direnv hook fish)" > $bin/share/fish/vendor_conf.d/direnv.fish
-  '' + stdenv.lib.optionalString (stdenv.isDarwin) ''
-    install_name_tool -delete_rpath $out/lib $bin/bin/direnv
   '';
 
   meta = with stdenv.lib; {
@@ -42,7 +40,7 @@ buildGoPackage rec {
       In short, this little tool allows you to have project-specific
       environment variables.
     '';
-    homepage = http://direnv.net;
+    homepage = https://direnv.net;
     license = licenses.mit;
     maintainers = with maintainers; [ zimbatm ];
   };
diff --git a/pkgs/tools/misc/duc/default.nix b/pkgs/tools/misc/duc/default.nix
index 06862a63423..7e98b7d64d2 100644
--- a/pkgs/tools/misc/duc/default.nix
+++ b/pkgs/tools/misc/duc/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "1h7vll8a78ijan9bmnimmsviywmc39x8h9iikx8vm98kwyxi4xif";
   };
 
-  buildInputs = [ autoreconfHook pkgconfig tokyocabinet cairo pango ncurses ];
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  buildInputs = [ tokyocabinet cairo pango ncurses ];
 
   meta = with stdenv.lib; {
     homepage = http://duc.zevv.nl/;
diff --git a/pkgs/tools/misc/eot-utilities/default.nix b/pkgs/tools/misc/eot-utilities/default.nix
index f773ae6caac..b44159be8ce 100644
--- a/pkgs/tools/misc/eot-utilities/default.nix
+++ b/pkgs/tools/misc/eot-utilities/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     sha256 = "0cb41riabss23hgfg7vxhky09d6zqwjy1nxdvr3l2bh5qzd4kvaf";
   };
 
-  buildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
 
   meta = {
     homepage = http://www.w3.org/Tools/eot-utils/;
diff --git a/pkgs/tools/misc/expect/default.nix b/pkgs/tools/misc/expect/default.nix
index 80fb3c6a694..0d1c81c00a6 100644
--- a/pkgs/tools/misc/expect/default.nix
+++ b/pkgs/tools/misc/expect/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "A tool for automating interactive applications";
-    homepage = http://expect.nist.gov/;
+    homepage = http://expect.sourceforge.net/;
     license = "Expect";
     platforms = platforms.unix;
     maintainers = with maintainers; [ wkennington ];
diff --git a/pkgs/tools/misc/fd/default.nix b/pkgs/tools/misc/fd/default.nix
index c46566aeabe..07d8a661d7b 100644
--- a/pkgs/tools/misc/fd/default.nix
+++ b/pkgs/tools/misc/fd/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   name = "fd-${version}";
-  version = "3.1.0";
+  version = "4.0.0";
 
   src = fetchFromGitHub {
     owner = "sharkdp";
     repo = "fd";
     rev = "v${version}";
-    sha256 = "0sv7iwl44a86n92i3mib2vlzd44q9ncif34yh1s0vqffai5s1rr6";
+    sha256 = "1aw4pgsmvzzqlvbxzv5jnw42nf316qfhvr50b58iqi2dxy8z8cmv";
   };
 
-  depsSha256 = "1irfx78k899qphzj8i8vr34pb6zaf9p5nx5c4zpgsrbknvn0ag5l";
+  depsSha256 = "17fjlmdwp8582dvv68b5h3zzvmd71yd9sw9xalyrrww46h7fd84g";
 
   meta = {
     description = "A simple, fast and user-friendly alternative to find";
diff --git a/pkgs/tools/misc/fontforge/default.nix b/pkgs/tools/misc/fontforge/default.nix
index ee7854c539e..c7fd29da8ac 100644
--- a/pkgs/tools/misc/fontforge/default.nix
+++ b/pkgs/tools/misc/fontforge/default.nix
@@ -32,8 +32,9 @@ stdenv.mkDerivation rec {
   # do not use x87's 80-bit arithmetic, rouding errors result in very different font binaries
   NIX_CFLAGS_COMPILE = lib.optionals stdenv.isi686 [ "-msse2" "-mfpmath=sse" ];
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    autoconf automake gnum4 libtool perl pkgconfig gettext uthash
+    autoconf automake gnum4 libtool perl gettext uthash
     python freetype zlib glib libungif libpng libjpeg libtiff libxml2
   ]
     ++ lib.optionals withSpiro [libspiro]
diff --git a/pkgs/tools/misc/fzf/default.nix b/pkgs/tools/misc/fzf/default.nix
index 4b76b85287a..e0367dc915d 100644
--- a/pkgs/tools/misc/fzf/default.nix
+++ b/pkgs/tools/misc/fzf/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   name = "fzf-${version}";
-  version = "0.17.0";
+  version = "0.17.0-2";
   rev = "${version}";
 
   goPackagePath = "github.com/junegunn/fzf";
@@ -11,7 +11,7 @@ buildGoPackage rec {
     inherit rev;
     owner = "junegunn";
     repo = "fzf";
-    sha256 = "0cj9vvrsrxj7752fxww1bkflz9rap0n4hhwd6shs0qbss1awwqk9";
+    sha256 = "0j4m3xf6qxfymfq6y5ml5rgz2rr1glh54k3b5xa9zi4cl5wg43qv";
   };
 
   outputs = [ "bin" "out" "man" ];
diff --git a/pkgs/tools/misc/gbdfed/default.nix b/pkgs/tools/misc/gbdfed/default.nix
index 1ba4bceb787..6307d012deb 100644
--- a/pkgs/tools/misc/gbdfed/default.nix
+++ b/pkgs/tools/misc/gbdfed/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0g09k6wim58hngxncq2brr7mwjm92j3famp0vs4b3p48wr65vcjx";
   };
 
-  buildInputs = [ pkgconfig freetype gtk ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ freetype gtk ];
 
   patches = [ ./Makefile.patch ];
 
diff --git a/pkgs/tools/misc/goaccess/default.nix b/pkgs/tools/misc/goaccess/default.nix
index 424a84637a5..8586244b415 100644
--- a/pkgs/tools/misc/goaccess/default.nix
+++ b/pkgs/tools/misc/goaccess/default.nix
@@ -14,8 +14,8 @@ stdenv.mkDerivation rec {
     "--enable-utf8"
   ];
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    pkgconfig
     geoipWithDatabase
     ncurses
     glib
diff --git a/pkgs/tools/misc/grub/default.nix b/pkgs/tools/misc/grub/default.nix
index a690ef2084b..bb565bacfe7 100644
--- a/pkgs/tools/misc/grub/default.nix
+++ b/pkgs/tools/misc/grub/default.nix
@@ -34,7 +34,8 @@ stdenv.mkDerivation {
   ] ++ (stdenv.lib.optional buggyBiosCDSupport ./buggybios.patch);
 
   # autoreconfHook required for the splashimage patch.
-  buildInputs = [ autoreconfHook texinfo ];
+  nativeBuildInputs = [ autoreconfHook ];
+  buildInputs = [ texinfo ];
 
   hardeningDisable = [ "stackprotector" ];
 
diff --git a/pkgs/tools/misc/gsmartcontrol/default.nix b/pkgs/tools/misc/gsmartcontrol/default.nix
index f362e7c53a2..d4322f051d0 100644
--- a/pkgs/tools/misc/gsmartcontrol/default.nix
+++ b/pkgs/tools/misc/gsmartcontrol/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "1ipykzqpfvlr84j38hr7q2cag4imrn1gql10slp8bfrs4h1si3vh";
   };
 
-  buildInputs = [ smartmontools gtkmm2 libglademm pkgconfig pcre ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ smartmontools gtkmm2 libglademm pcre ];
 
   #installTargets = "install datainstall";
 
diff --git a/pkgs/tools/misc/kalibrate-rtl/default.nix b/pkgs/tools/misc/kalibrate-rtl/default.nix
index 19870b8de5b..19ebd05e23c 100644
--- a/pkgs/tools/misc/kalibrate-rtl/default.nix
+++ b/pkgs/tools/misc/kalibrate-rtl/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "1spbfflkqnw9s8317ppsf7b1nnkicqsmaqsnz1zf8i49ix70i6kn";
   };
 
-  buildInputs = [ autoreconfHook pkgconfig fftw rtl-sdr libusb1 ];
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  buildInputs = [ fftw rtl-sdr libusb1 ];
 
   meta = with stdenv.lib; {
     description = "Calculate local oscillator frequency offset in RTL-SDR devices";
diff --git a/pkgs/tools/misc/lbdb/add-methods-to-rc.patch b/pkgs/tools/misc/lbdb/add-methods-to-rc.patch
new file mode 100644
index 00000000000..d388467559a
--- /dev/null
+++ b/pkgs/tools/misc/lbdb/add-methods-to-rc.patch
@@ -0,0 +1,11 @@
+--- a/lbdb.rc.in
++++ b/lbdb.rc.in
+@@ -40,7 +40,7 @@
+ # - m_vcf        search a vcard (according to RFC2426) file.
+ # - m_khard      search a CardDAV address book via khard
+ 
+-METHODS="m_inmail m_passwd m_finger"
++METHODS="@MODULES@"
+ 
+ 
+ #
diff --git a/pkgs/tools/misc/lbdb/default.nix b/pkgs/tools/misc/lbdb/default.nix
index e81ad349874..35cc95cb2cf 100644
--- a/pkgs/tools/misc/lbdb/default.nix
+++ b/pkgs/tools/misc/lbdb/default.nix
@@ -1,17 +1,39 @@
-{ stdenv, fetchurl, perl, finger_bsd }:
+{ stdenv, fetchurl, perl, perlPackages, finger_bsd, makeWrapper
+, abook ? null
+, gnupg ? null
+, goobook ? null
+, khard ? null
+}:
 
 let
-  version = "0.38";
+  version = "0.44";
 in
-
+with stdenv.lib;
+with perlPackages;
 stdenv.mkDerivation {
   name = "lbdb-${version}";
   src = fetchurl {
     url = "http://www.spinnaker.de/debian/lbdb_${version}.tar.gz";
-    sha256 = "1279ssfrh4cqrjzq5q47xbdlw5qx3aazxjshi86ljm4cw6xxvgar";
+    sha256 = "0kjz3n2ilrg6yrz8z40714ppdprgwhbgvzcsjzs822l6da4qxna3";
   };
 
-  buildInputs = [ perl ] ++ stdenv.lib.optional (!stdenv.isDarwin) finger_bsd;
+  buildInputs = [ goobook makeWrapper perl ConvertASN1 NetLDAP AuthenSASL ]
+    ++ optional (!stdenv.isDarwin) finger_bsd
+    ++ optional   (abook != null) abook
+    ++ optional   (gnupg != null) gnupg
+    ++ optional (goobook != null) goobook
+    ++ optional   (khard != null) khard;
+  configureFlags = [ ]
+    ++ optional   (abook != null) "--with-abook"
+    ++ optional   (gnupg != null) "--with-gpg"
+    ++ optional (goobook != null) "--with-goobook"
+    ++ optional   (khard != null) "--with-khard";
+
+  patches = [ ./add-methods-to-rc.patch ];
+  postFixup = "wrapProgram $out/lib/mutt_ldap_query --prefix PERL5LIB : "
+    + "${AuthenSASL}/${perl.libPrefix}"
+    + ":${ConvertASN1}/${perl.libPrefix}"
+    + ":${NetLDAP}/${perl.libPrefix}";
 
   meta = {
     homepage = http://www.spinnaker.de/lbdb/;
diff --git a/pkgs/tools/misc/ldapvi/default.nix b/pkgs/tools/misc/ldapvi/default.nix
index d96409809a6..72c9cecf540 100644
--- a/pkgs/tools/misc/ldapvi/default.nix
+++ b/pkgs/tools/misc/ldapvi/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
     sha256 = "3ef3103030ecb04d7fe80180e3fd490377cf81fb2af96782323fddabc3225030";
   };
 
-  buildInputs = [ openldap openssl popt glib ncurses readline pkgconfig cyrus_sasl autoconf automake ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ openldap openssl popt glib ncurses readline cyrus_sasl autoconf automake ];
 
   preConfigure = ''
     cd ldapvi
diff --git a/pkgs/tools/misc/libbitcoin/libbitcoin-client.nix b/pkgs/tools/misc/libbitcoin/libbitcoin-client.nix
index 1f45626855f..989c1f57b6e 100644
--- a/pkgs/tools/misc/libbitcoin/libbitcoin-client.nix
+++ b/pkgs/tools/misc/libbitcoin/libbitcoin-client.nix
@@ -13,7 +13,8 @@ in stdenv.mkDerivation {
     sha256 = "1g79hl6jmf5dam7vq19h4dgdj7gcn19fa7q78vn573mg2rdyal53";
   };
 
-  buildInputs = [ autoreconfHook pkgconfig ];
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  buildInputs = [ ];
 
   propagatedBuildInputs = [ libsodium czmqpp libbitcoin ];
 
diff --git a/pkgs/tools/misc/libbitcoin/libbitcoin-explorer.nix b/pkgs/tools/misc/libbitcoin/libbitcoin-explorer.nix
index fbfa385fc7f..7b6da9bdd3e 100644
--- a/pkgs/tools/misc/libbitcoin/libbitcoin-explorer.nix
+++ b/pkgs/tools/misc/libbitcoin/libbitcoin-explorer.nix
@@ -13,7 +13,8 @@ in stdenv.mkDerivation {
     sha256 = "00123vw7rxk0ypdfzk0xwk8q55ll31000mkjqdzl915krsbkbfvp";
   };
 
-  buildInputs = [ autoreconfHook pkgconfig ];
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  buildInputs = [ ];
 
   propagatedBuildInputs = [ libbitcoin-client ];
 
diff --git a/pkgs/tools/misc/libbitcoin/libbitcoin.nix b/pkgs/tools/misc/libbitcoin/libbitcoin.nix
index 61c462f7853..6d0c7b4e9c9 100644
--- a/pkgs/tools/misc/libbitcoin/libbitcoin.nix
+++ b/pkgs/tools/misc/libbitcoin/libbitcoin.nix
@@ -13,7 +13,8 @@ in stdenv.mkDerivation {
     sha256 = "1lpdjm13kgs4fbp579bwfvws8yf9mnr5dw3ph8zxg2gf110h85sy";
   };
 
-  buildInputs = [ autoreconfHook pkgconfig ];
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  buildInputs = [ ];
 
   propagatedBuildInputs = [ secp256k1 ];
 
diff --git a/pkgs/tools/misc/lnav/default.nix b/pkgs/tools/misc/lnav/default.nix
index 136951cb7bc..5ab05c92135 100644
--- a/pkgs/tools/misc/lnav/default.nix
+++ b/pkgs/tools/misc/lnav/default.nix
@@ -45,6 +45,7 @@ stdenv.mkDerivation rec {
     license = licenses.bsd2;
     version = "0.8.2";
     maintainers = [ maintainers.dochang ];
+    platforms = platforms.unix;
   };
 
 }
diff --git a/pkgs/tools/misc/mc/default.nix b/pkgs/tools/misc/mc/default.nix
index 0828fea81e1..fb4093d89b8 100644
--- a/pkgs/tools/misc/mc/default.nix
+++ b/pkgs/tools/misc/mc/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
     sha256 = "1pzjq4nfxl2aakxipdjs5hq9n14374ly1l00s40kd2djnnxmd7pb";
   };
 
-  buildInputs = [ pkgconfig perl glib slang zip unzip file gettext libX11 libICE
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ perl glib slang zip unzip file gettext libX11 libICE
     libssh2 openssl ] ++ stdenv.lib.optionals (!stdenv.isDarwin) [ e2fsprogs gpm ];
 
   configureFlags = [ "--enable-vfs-smb" ];
diff --git a/pkgs/tools/misc/mdbtools/default.nix b/pkgs/tools/misc/mdbtools/default.nix
index 165780a5fa1..acb3bd9d377 100644
--- a/pkgs/tools/misc/mdbtools/default.nix
+++ b/pkgs/tools/misc/mdbtools/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation {
     sha256 = "1lz33lmqifjszad7rl1r7rpxbziprrm5rkb27wmswyl5v98dqsbi";
   };
 
-  buildInputs = [glib readline bison flex pkgconfig];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [glib readline bison flex];
 
   preConfigure = ''
     sed -e 's@static \(GHashTable [*]mdb_backends;\)@\1@' -i src/libmdb/backend.c
diff --git a/pkgs/tools/misc/mdbtools/git.nix b/pkgs/tools/misc/mdbtools/git.nix
index 4f76306ab5f..6289c35f35a 100644
--- a/pkgs/tools/misc/mdbtools/git.nix
+++ b/pkgs/tools/misc/mdbtools/git.nix
@@ -10,8 +10,9 @@ stdenv.mkDerivation {
     sha256 = "0hlf5lk86xm0bpdlpk4a1zyfvbim76dhvmybxga2p7mbb1jc825l";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    glib readline bison flex autoreconfHook pkgconfig which txt2man
+    glib readline bison flex autoreconfHook which txt2man
     gnome_doc_utils scrollkeeper libiconv
   ];
 
diff --git a/pkgs/tools/misc/mprime/default.nix b/pkgs/tools/misc/mprime/default.nix
index 9a435622c7d..2aea2530057 100644
--- a/pkgs/tools/misc/mprime/default.nix
+++ b/pkgs/tools/misc/mprime/default.nix
@@ -23,7 +23,8 @@ stdenv.mkDerivation {
 
   unpackCmd = "unzip -d src -q $curSrc";
 
-  buildInputs = [ unzip pkgconfig curl ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ unzip curl ];
 
   patches = [ ./makefile.patch ];
 
diff --git a/pkgs/tools/misc/pal/default.nix b/pkgs/tools/misc/pal/default.nix
index f92069e7b9f..267b458cccc 100644
--- a/pkgs/tools/misc/pal/default.nix
+++ b/pkgs/tools/misc/pal/default.nix
@@ -14,7 +14,8 @@ stdenv.mkDerivation rec {
 
   makeFlags = "prefix=$(out)";
 
-  buildInputs = [ glib gettext readline pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ glib gettext readline ];
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/tools/misc/plantuml/default.nix b/pkgs/tools/misc/plantuml/default.nix
index f15c452c955..447ef9dd5ec 100644
--- a/pkgs/tools/misc/plantuml/default.nix
+++ b/pkgs/tools/misc/plantuml/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, jre, graphviz }:
 
 stdenv.mkDerivation rec {
-  version = "8047";
+  version = "1.2017.18";
   name = "plantuml-${version}";
 
   src = fetchurl {
-    url = "mirror://sourceforge/project/plantuml/plantuml.${version}.jar";
-    sha256 = "11a1qchalymvc7qn9kqxamp8qm8fljpnxmfi4zs8sg75nzddjnlm";
+    url = "mirror://sourceforge/project/plantuml/${version}/plantuml.${version}.jar";
+    sha256 = "0ssfg6lpk41ydhxhi6y6c9ca3hpql6gg3bxjws8vrx9s3s6r5rb0";
   };
 
   # It's only a .jar file and a shell wrapper
diff --git a/pkgs/tools/misc/qjoypad/default.nix b/pkgs/tools/misc/qjoypad/default.nix
index 663c60d2856..6a5e674b698 100644
--- a/pkgs/tools/misc/qjoypad/default.nix
+++ b/pkgs/tools/misc/qjoypad/default.nix
@@ -5,7 +5,8 @@ stdenv.mkDerivation rec {
     url = "mirror://sourceforge/qjoypad/${name}.tar.gz";
     sha256 = "1jlm7i26nfp185xrl41kz5z6fgvyj51bjpz48cg27xx64y40iamm";
   };
-  buildInputs = [ pkgconfig libX11 libXtst qt4 ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libX11 libXtst qt4 ];
   patchPhase = ''
     cd src
     substituteInPlace config --replace /bin/bash /bin/sh
diff --git a/pkgs/tools/misc/riemann-c-client/default.nix b/pkgs/tools/misc/riemann-c-client/default.nix
index 54e5a3ab17e..07c14ac7626 100644
--- a/pkgs/tools/misc/riemann-c-client/default.nix
+++ b/pkgs/tools/misc/riemann-c-client/default.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation rec {
     sha256 = "1j3wgf9xigsv6ckmv82gjj4wavi7xjn2zvj1f63fzbaa1rv7pf3s";
   };
 
-  buildInputs = [ autoreconfHook pkgconfig file protobufc ];
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  buildInputs = [ file protobufc ];
 
   meta = with stdenv.lib; {
     homepage = https://github.com/algernon/riemann-c-client;
diff --git a/pkgs/tools/misc/rmlint/default.nix b/pkgs/tools/misc/rmlint/default.nix
index e321670068c..2ff86f5cbdf 100644
--- a/pkgs/tools/misc/rmlint/default.nix
+++ b/pkgs/tools/misc/rmlint/default.nix
@@ -15,7 +15,8 @@ stdenv.mkDerivation rec {
 
   configurePhase = "scons config";
 
-  buildInputs = [ gettext glib json_glib libelf pkgconfig scons sphinx utillinux ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ gettext glib json_glib libelf scons sphinx utillinux ];
 
   buildPhase = "scons";
 
diff --git a/pkgs/tools/misc/rpm-ostree/default.nix b/pkgs/tools/misc/rpm-ostree/default.nix
index 3e2953c5733..d6cad51ce75 100644
--- a/pkgs/tools/misc/rpm-ostree/default.nix
+++ b/pkgs/tools/misc/rpm-ostree/default.nix
@@ -28,8 +28,9 @@ in stdenv.mkDerivation {
     sha256 = "0a0wwklzk1kvk3bbxxfvxgk4ck5dn7a7v32shqidb674fr2d5pvb";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    which autoconf automake pkgconfig libtool libcap ostree rpm glib libgsystem gperf
+    which autoconf automake libtool libcap ostree rpm glib libgsystem gperf
     json_glib libarchive libsolv librepo gtk_doc libxslt docbook_xsl docbook_xml_dtd_42
     cmake pcre check python
     # FIXME: get rid of this once libarchive properly propagates this
diff --git a/pkgs/tools/misc/tmux/default.nix b/pkgs/tools/misc/tmux/default.nix
index a749f250c11..61370ff890b 100644
--- a/pkgs/tools/misc/tmux/default.nix
+++ b/pkgs/tools/misc/tmux/default.nix
@@ -13,7 +13,7 @@ in
 
 stdenv.mkDerivation rec {
   name = "tmux-${version}";
-  version = "2.5";
+  version = "2.6";
 
   outputs = [ "out" "man" ];
 
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     owner = "tmux";
     repo = "tmux";
     rev = version;
-    sha256 = "0zwjngfaqrlwwbzicc5pq5pyws8f1qghcajvj0hwkipj51hqyswf";
+    sha256 = "0605y0nwfmf0mnq075vk80897c2cvhxxvxinqq7hvrpjf2ph5mww";
   };
 
   nativeBuildInputs = [ pkgconfig autoreconfHook ];
diff --git a/pkgs/tools/misc/toilet/default.nix b/pkgs/tools/misc/toilet/default.nix
index f9fee08d0dd..2b240e022d8 100644
--- a/pkgs/tools/misc/toilet/default.nix
+++ b/pkgs/tools/misc/toilet/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "1pl118qb7g0frpgl9ps43w4sd0psjirpmq54yg1kqcclqcqbbm49";
   };
 
-  buildInputs = [ pkgconfig libcaca ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libcaca ];
 
   meta = {
     description = "Display large colourful characters in text mode";
diff --git a/pkgs/tools/misc/ttwatch/default.nix b/pkgs/tools/misc/ttwatch/default.nix
index 855baa83060..2924da5f89a 100644
--- a/pkgs/tools/misc/ttwatch/default.nix
+++ b/pkgs/tools/misc/ttwatch/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "ttwatch-${version}";
-  version = "2017-04-20";
+  version = "2017-09-26";
 
   src = fetchFromGitHub {
     owner = "ryanbinns";
     repo = "ttwatch";
-    rev = "f07a12712ed331f1530db3846828641eb0e2f5c5";
-    sha256 = "0y27bldmp6w02pjhr2cmy9g6n23vi0q26pil3rd7vbg4qjahxz27";
+    rev = "31fb7ca6ac992d131a3f5ea6acf49f0c52a128c5";
+    sha256 = "1sxjx593jqbq45jn2dkjz07zq9kkgsbcj971phimlm6dj6g75wxq";
   };
 
   nativeBuildInputs = [ cmake perl ];
diff --git a/pkgs/tools/misc/unicode/default.nix b/pkgs/tools/misc/unicode/default.nix
index d2a4ed39e9a..58f5e54fc3a 100644
--- a/pkgs/tools/misc/unicode/default.nix
+++ b/pkgs/tools/misc/unicode/default.nix
@@ -26,5 +26,6 @@ python3Packages.buildPythonApplication rec {
     homepage = https://github.com/garabik/unicode;
     license = licenses.gpl3;
     maintainers = [ maintainers.woffs ];
+    platforms = platforms.all;
   };
 }
diff --git a/pkgs/tools/misc/urjtag/default.nix b/pkgs/tools/misc/urjtag/default.nix
index 8d9d0073b17..99cd407a9ae 100644
--- a/pkgs/tools/misc/urjtag/default.nix
+++ b/pkgs/tools/misc/urjtag/default.nix
@@ -17,7 +17,8 @@ stdenv.mkDerivation rec {
     sha256 = "0pyl0y27136nr8mmjdml7zjnfnpbjmgqzkjk99j3hvj38k10wq7f";
   };
 
-  buildInputs = [ gettext pkgconfig autoconf automake libtool bison flex which
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ gettext autoconf automake libtool bison flex which
     subversion makeWrapper readline libftdi libusb python3 ];
 
   configureFlags = ''
diff --git a/pkgs/tools/misc/wv/default.nix b/pkgs/tools/misc/wv/default.nix
index a18c03b126a..59efcaa1809 100644
--- a/pkgs/tools/misc/wv/default.nix
+++ b/pkgs/tools/misc/wv/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "17f16lkdv1c3amaz2hagiicih59ynpp4786k1m2qa1sw68xhswsc";
   };
 
-  buildInputs = [ zlib imagemagick libpng glib pkgconfig libgsf libxml2 bzip2 ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ zlib imagemagick libpng glib libgsf libxml2 bzip2 ];
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/tools/misc/wv2/default.nix b/pkgs/tools/misc/wv2/default.nix
index f39eaf0b047..b9a8f70ff71 100644
--- a/pkgs/tools/misc/wv2/default.nix
+++ b/pkgs/tools/misc/wv2/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
 
   patches = [ ./fix-include.patch ];
 
-  buildInputs = [ pkgconfig cmake libgsf glib libxml2 ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ cmake libgsf glib libxml2 ];
 
   NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2";
 
diff --git a/pkgs/tools/misc/xsel/default.nix b/pkgs/tools/misc/xsel/default.nix
index 350cb89846a..604868f8c49 100644
--- a/pkgs/tools/misc/xsel/default.nix
+++ b/pkgs/tools/misc/xsel/default.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation rec {
     sha256 = "04mrc8j0rr7iy1k6brfxnx26pmxm800gh4nqrxn6j2lz6vd5y9m5";
   };
 
-  buildInputs = [ libX11 autoreconfHook ];
+  nativeBuildInputs = [ autoreconfHook ];
+  buildInputs = [ libX11 ];
 
   # We need a README file, otherwise autoconf complains.
   postUnpack = ''
diff --git a/pkgs/tools/misc/yubico-piv-tool/default.nix b/pkgs/tools/misc/yubico-piv-tool/default.nix
index 6ff08e4ac3f..c01e419ab23 100644
--- a/pkgs/tools/misc/yubico-piv-tool/default.nix
+++ b/pkgs/tools/misc/yubico-piv-tool/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "0l9lkzwi2227y5y02i5g1d701bmlyaj8lffv72jks1w4mkh7q7qh";
   };
 
-  buildInputs = [ pkgconfig openssl pcsclite ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ openssl pcsclite ];
 
   configureFlags = [ "--with-backend=pcsc" ];
 
diff --git a/pkgs/tools/networking/aircrack-ng/default.nix b/pkgs/tools/networking/aircrack-ng/default.nix
index 3b7c2926bd4..5a56430c20e 100644
--- a/pkgs/tools/networking/aircrack-ng/default.nix
+++ b/pkgs/tools/networking/aircrack-ng/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "0dpzx9kddxpgzmgvdpl3rxn0jdaqhm5wxxndp1xd7d75mmmc2fnr";
   };
 
-  buildInputs = [ libpcap openssl zlib libnl pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libpcap openssl zlib libnl ];
 
   patchPhase = ''
     sed -e 's@^prefix.*@prefix = '$out@ -i common.mak
diff --git a/pkgs/tools/networking/argus-clients/default.nix b/pkgs/tools/networking/argus-clients/default.nix
index fe30a1eab82..766ae411606 100644
--- a/pkgs/tools/networking/argus-clients/default.nix
+++ b/pkgs/tools/networking/argus-clients/default.nix
@@ -19,7 +19,8 @@ stdenv.mkDerivation rec {
 
   configureFlags = "--with-perl=${perl}/bin/perl";
 
-  buildInputs = [ libpcap pkgconfig bison cyrus_sasl tcp_wrappers flex ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libpcap bison cyrus_sasl tcp_wrappers flex ];
 
   meta = with stdenv.lib; {
     description = "Clients for ARGUS";
diff --git a/pkgs/tools/networking/argus/default.nix b/pkgs/tools/networking/argus/default.nix
index 673f98e2f3a..e5c2aace400 100644
--- a/pkgs/tools/networking/argus/default.nix
+++ b/pkgs/tools/networking/argus/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "1zzf688dbbcb5z2r9v1p28rddns6znzx35nc05ygza6lp7aknkna";
   };
 
-  buildInputs = [ libpcap pkgconfig bison cyrus_sasl tcp_wrappers flex ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libpcap bison cyrus_sasl tcp_wrappers flex ];
   propagatedBuildInputs = [ procps which wget lsof net_snmp ];
 
   patchPhase = ''
diff --git a/pkgs/tools/networking/assh/default.nix b/pkgs/tools/networking/assh/default.nix
index 1de87e07e04..e3a147b20b1 100644
--- a/pkgs/tools/networking/assh/default.nix
+++ b/pkgs/tools/networking/assh/default.nix
@@ -9,9 +9,7 @@ buildGoPackage rec {
 
   nativeBuildInputs = [ makeWrapper ];
 
-  postInstall = stdenv.lib.optionalString (stdenv.isDarwin) ''
-    install_name_tool -delete_rpath $out/lib $bin/bin/assh
-  '' + ''
+  postInstall = ''
     wrapProgram "$bin/bin/assh" \
       --prefix PATH : ${openssh}/bin
   '';
diff --git a/pkgs/tools/networking/badvpn/default.nix b/pkgs/tools/networking/badvpn/default.nix
index 22da8486a80..c9ebc12b0db 100644
--- a/pkgs/tools/networking/badvpn/default.nix
+++ b/pkgs/tools/networking/badvpn/default.nix
@@ -9,13 +9,15 @@ let
     url="https://github.com/ambrop72/badvpn/archive/1.999.130.tar.gz";
     sha256="02b1fra43l75mljkhrq45vcrrqv0znicjn15g7nbqx3jppzbpm5z";
   };
+
   buildInputs = [
-    cmake openssl nss pkgconfig nspr
+    cmake openssl nss nspr
   ];
   compileFlags = "-O3 ${stdenv.lib.optionalString (!debug) "-DNDEBUG"}";
 in
 stdenv.mkDerivation {
   inherit (s) name version;
+  nativeBuildInputs = [ pkgconfig ];
   inherit buildInputs;
   src = fetchurl {
     inherit (s) url sha256;
diff --git a/pkgs/tools/networking/ccnet/default.nix b/pkgs/tools/networking/ccnet/default.nix
index 22237794f07..24c86f4fa9a 100644
--- a/pkgs/tools/networking/ccnet/default.nix
+++ b/pkgs/tools/networking/ccnet/default.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation rec
     sha256 = "0q4a102xlcsxlr53h4jr4w8qzkbzvm2f3nk9fsha48h6l2hw34bb";
   };
 
-  buildInputs = [ which automake autoconf pkgconfig libtool vala_0_23 python ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ which automake autoconf libtool vala_0_23 python ];
   propagatedBuildInputs = [ libsearpc libzdb libuuid libevent sqlite openssl ];
 
   preConfigure = ''
diff --git a/pkgs/tools/networking/connmanui/default.nix b/pkgs/tools/networking/connmanui/default.nix
index b5866c2ee13..7c42cc965a0 100644
--- a/pkgs/tools/networking/connmanui/default.nix
+++ b/pkgs/tools/networking/connmanui/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "0ixx8c9cfdp480z21xfjb7n1x27sf1g8gmgbmcfhr0k888dmziyy";
   };
 
-  buildInputs = [ autoconf automake libtool glib gtk3 dbus pkgconfig file intltool connman ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ autoconf automake libtool glib gtk3 dbus file intltool connman ];
 
   preConfigure = ''
     rm m4/intltool.m4
diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index 4ec79af6651..c01dbbaa3a7 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -21,11 +21,11 @@ assert scpSupport -> libssh2 != null;
 assert c-aresSupport -> c-ares != null;
 
 stdenv.mkDerivation rec {
-  name = "curl-7.55.1";
+  name = "curl-7.56.0";
 
   src = fetchurl {
     url = "http://curl.haxx.se/download/${name}.tar.bz2";
-    sha256 = "1yvcn7jbh99gsqhc040nky0h15a1cfh8yic6k0a1zhdhscpakcg5";
+    sha256 = "1pvr2bqfhk46bzq2x2hskmnq3wc8qxlps7apm9q1qiixb9ra8q6y";
   };
 
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
@@ -68,8 +68,8 @@ stdenv.mkDerivation rec {
     ++ stdenv.lib.optional c-aresSupport "--enable-ares=${c-ares}"
     ++ stdenv.lib.optional gssSupport "--with-gssapi=${gss}";
 
-  CXX = "g++";
-  CXXCPP = "g++ -E";
+  CXX = "c++";
+  CXXCPP = "c++ -E";
 
   postInstall = ''
     moveToOutput bin/curl-config "$dev"
diff --git a/pkgs/tools/networking/davix/default.nix b/pkgs/tools/networking/davix/default.nix
index 37226d3dd7b..3be2b0401bc 100644
--- a/pkgs/tools/networking/davix/default.nix
+++ b/pkgs/tools/networking/davix/default.nix
@@ -2,7 +2,8 @@
 
 stdenv.mkDerivation rec {
   name = "davix-0.6.4";
-  buildInputs = [ stdenv pkgconfig cmake openssl libxml2 boost ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ stdenv cmake openssl libxml2 boost ];
 
   src = fetchFromGitHub {
     owner = "cern-it-sdc-id";
diff --git a/pkgs/tools/networking/dhcpcd/default.nix b/pkgs/tools/networking/dhcpcd/default.nix
index 7204ddd5e06..d8316c66203 100644
--- a/pkgs/tools/networking/dhcpcd/default.nix
+++ b/pkgs/tools/networking/dhcpcd/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "17nnhxmbdcc7k2mh6sgvxisqcqbic5540xbig363ds97gvf795kg";
   };
 
-  buildInputs = [ pkgconfig udev ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ udev ];
 
   configureFlags = [
     "--sysconfdir=/etc"
diff --git a/pkgs/tools/networking/djbdns/default.nix b/pkgs/tools/networking/djbdns/default.nix
index 7537ab1c47a..b8a7133e7bc 100644
--- a/pkgs/tools/networking/djbdns/default.nix
+++ b/pkgs/tools/networking/djbdns/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, glibc } :
+{ stdenv, fetchurl, glibc, dns-root-data } :
 
 let
   version = "1.05";
@@ -18,11 +18,13 @@ stdenv.mkDerivation {
     sha256 = "0j3baf92vkczr5fxww7rp1b7gmczxmmgrqc8w2dy7kgk09m85k9w";
   };
 
-  patches = [ ./hier.patch ];
+  patches = [ ./hier.patch ./fix-nix-usernamespace-build.patch ];
 
   postPatch = ''
     echo gcc -O2 -include ${glibc.dev}/include/errno.h > conf-cc
     echo $out > conf-home
+    # djbdns ships with an outdated list of root servers
+    awk '/^.?.ROOT-SERVERS.NET/ { print $4 }' ${dns-root-data}/root.hints > dnsroots.global
     sed -i "s|/etc/dnsroots.global|$out/etc/dnsroots.global|" dnscache-conf.c
   '';
 
@@ -45,4 +47,4 @@ stdenv.mkDerivation {
     license = licenses.publicDomain;
     maintainers = with maintainers; [ jerith666 ];
   };
-}
\ No newline at end of file
+}
diff --git a/pkgs/tools/networking/djbdns/fix-nix-usernamespace-build.patch b/pkgs/tools/networking/djbdns/fix-nix-usernamespace-build.patch
new file mode 100644
index 00000000000..abd9e756a21
--- /dev/null
+++ b/pkgs/tools/networking/djbdns/fix-nix-usernamespace-build.patch
@@ -0,0 +1,10 @@
+--- djbdns-1.05.org/chkshsgr.c	2001-02-11 21:11:45.000000000 +0000
++++ djbdns-1.05/chkshsgr.c	2017-10-13 10:06:09.392578927 +0100
+@@ -2,6 +2,7 @@
+ 
+ int main()
+ {
++  return 0;
+   short x[4];
+ 
+   x[0] = x[1] = 0;
diff --git a/pkgs/tools/networking/dnstracer/default.nix b/pkgs/tools/networking/dnstracer/default.nix
new file mode 100644
index 00000000000..bb7c688480f
--- /dev/null
+++ b/pkgs/tools/networking/dnstracer/default.nix
@@ -0,0 +1,23 @@
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  version = "1.9";
+  name = "dnstracer";
+
+  src = fetchurl {
+    url = "http://www.mavetju.org/download/dnstracer-${version}.tar.gz";
+    sha256 = "177y58smnq2xhx9lbmj1gria371iv3r1d132l2gjvflkjsphig1f";
+  };
+
+  outputs = [ "out" "man" ];
+
+  setOutputFlags = false;
+
+  meta = with stdenv.lib; {
+    description = "Dnstracer determines where a given Domain Name Server (DNS) gets its information from, and follows the chain of DNS servers back to the servers which know the data.";
+    homepage = http://www.mavetju.org/unix/general.php;
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ andir ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/tools/networking/driftnet/default.nix b/pkgs/tools/networking/driftnet/default.nix
index 1f34952ad24..5b39ca46460 100644
--- a/pkgs/tools/networking/driftnet/default.nix
+++ b/pkgs/tools/networking/driftnet/default.nix
@@ -8,8 +8,9 @@ stdenv.mkDerivation rec {
   name = "driftnet-${version}";
   version = "1.1.5";
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    pkgconfig libpcap libjpeg libungif libpng giflib
+    libpcap libjpeg libungif libpng giflib
     glib gtk2 glib cairo pango gdk_pixbuf atk autoreconfHook
   ];
 
diff --git a/pkgs/tools/networking/fastd/default.nix b/pkgs/tools/networking/fastd/default.nix
index 3a99adb4a9e..ef356935c56 100644
--- a/pkgs/tools/networking/fastd/default.nix
+++ b/pkgs/tools/networking/fastd/default.nix
@@ -11,6 +11,11 @@ stdenv.mkDerivation rec {
     sha256 = "0c9v3igv3812b3jr7jk75a2np658yy00b3i4kpbpdjgvqzc1jrq8";
   };
 
+  postPatch = ''
+    substituteInPlace src/crypto/cipher/CMakeLists.txt \
+      --replace 'add_subdirectory(aes128_ctr)' ""
+  '';
+
   nativeBuildInputs = [ pkgconfig bison cmake ];
   buildInputs = [ libuecc libsodium libcap json_c ];
 
diff --git a/pkgs/tools/networking/gftp/default.nix b/pkgs/tools/networking/gftp/default.nix
index b122f532630..312906f9510 100644
--- a/pkgs/tools/networking/gftp/default.nix
+++ b/pkgs/tools/networking/gftp/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation {
     sha256 = "1z8b26n23k0sjbxgrix646b06cnpndpq7cbcj0ilsvvdx5ms81jk";
   };
 
-  buildInputs = [ gtk2 readline ncurses gettext openssl pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ gtk2 readline ncurses gettext openssl ];
 
   meta = { 
     description = "GTK+-based FTP client";
diff --git a/pkgs/tools/networking/goklp/default.nix b/pkgs/tools/networking/goklp/default.nix
new file mode 100644
index 00000000000..88a6b74686c
--- /dev/null
+++ b/pkgs/tools/networking/goklp/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, buildGoPackage, fetchFromGitHub }:
+
+buildGoPackage rec {
+  name = "goklp-${version}";
+  version = "1.6";
+
+  goPackagePath = "github.com/AppliedTrust/goklp";
+
+  src = fetchFromGitHub {
+    owner = "AppliedTrust";
+    repo = "goklp";
+    rev = "v${version}";
+    sha256 = "054qmwfaih8qbvdyy4rqbb1ip3jpnm547n390hgab8yc3bdd840c";
+  };
+
+  goDeps = ./deps.nix;
+
+  meta = with stdenv.lib; {
+    description = "Golang OpenSSH Keys Ldap Provider for AuthorizedKeysCommand";
+    homepage = https://github.com/AppliedTrust/goklp;
+    maintainers = with maintainers; [ disassembler ];
+    license = licenses.bsd2;
+  };
+}
diff --git a/pkgs/tools/networking/goklp/deps.nix b/pkgs/tools/networking/goklp/deps.nix
new file mode 100644
index 00000000000..2f6481f237f
--- /dev/null
+++ b/pkgs/tools/networking/goklp/deps.nix
@@ -0,0 +1,56 @@
+[
+  {
+    goPackagePath = "github.com/asaskevich/govalidator";
+    fetch = {
+      type = "git";
+      url = "https://github.com/asaskevich/govalidator";
+      rev = "ca5f9e638c83bac66bfac70ded5bded1503135a7";
+      sha256 = "0lk4irlf4a4q8qharwjxl71y1s2cf5bjpg9cv5jlyp574331pn1w";
+    };
+  }
+  {
+    goPackagePath = "github.com/docopt/docopt-go";
+    fetch = {
+      type = "git";
+      url = "https://github.com/docopt/docopt-go";
+      rev = "784ddc588536785e7299f7272f39101f7faccc3f";
+      sha256 = "0wwz48jl9fvl1iknvn9dqr4gfy1qs03gxaikrxxp9gry6773v3sj";
+    };
+  }
+  {
+    goPackagePath = "github.com/kardianos/osext";
+    fetch = {
+      type = "git";
+      url = "https://github.com/kardianos/osext";
+      rev = "ae77be60afb1dcacde03767a8c37337fad28ac14";
+      sha256 = "056dkgxrqjj5r18bnc3knlpgdz5p3yvp12y4y978hnsfhwaqvbjz";
+    };
+  }
+  {
+    goPackagePath = "github.com/vaughan0/go-ini";
+    fetch = {
+      type = "git";
+      url = "https://github.com/vaughan0/go-ini";
+      rev = "a98ad7ee00ec53921f08832bc06ecf7fd600e6a1";
+      sha256 = "1l1isi3czis009d9k5awsj4xdxgbxn4n9yqjc1ac7f724x6jacfa";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/asn1-ber.v1";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/asn1-ber.v1";
+      rev = "379148ca0225df7a432012b8df0355c2a2063ac0";
+      sha256 = "1y8bvzbxpw0lfnn7pbcdwzqj4l90qj6xf88dvv9pxd9yl5g6cskx";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/ldap.v2";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/ldap.v2";
+      rev = "8168ee085ee43257585e50c6441aadf54ecb2c9f";
+      sha256 = "1w0993i8bl8sap01gwm1v6hjp0rsanj2mbpyabwcwnns2g79n895";
+    };
+  }
+]
diff --git a/pkgs/tools/networking/gupnp-tools/default.nix b/pkgs/tools/networking/gupnp-tools/default.nix
index ea78cdd106a..fcbf5a4e1b2 100644
--- a/pkgs/tools/networking/gupnp-tools/default.nix
+++ b/pkgs/tools/networking/gupnp-tools/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "1vbr4iqi7nl7kq982agd3liw10gx67s95idd0pjy5h1jsnwyqgda";
   };
 
-  buildInputs = [gupnp libuuid gssdp pkgconfig gtk3 intltool gupnp_av
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [gupnp libuuid gssdp gtk3 intltool gupnp_av
                  gnome2.gnome_icon_theme makeWrapper];
 
   postInstall = ''
diff --git a/pkgs/tools/networking/httpie/default.nix b/pkgs/tools/networking/httpie/default.nix
index b445dd93c4c..ef50c0ce084 100644
--- a/pkgs/tools/networking/httpie/default.nix
+++ b/pkgs/tools/networking/httpie/default.nix
@@ -2,7 +2,6 @@
 
 pythonPackages.buildPythonApplication rec {
   name = "httpie-0.9.9";
-  namePrefix = "";
 
   src = fetchurl {
     url = "mirror://pypi/h/httpie/${name}.tar.gz";
diff --git a/pkgs/tools/networking/hyenae/default.nix b/pkgs/tools/networking/hyenae/default.nix
index a7d42b77317..cbcaee4de78 100644
--- a/pkgs/tools/networking/hyenae/default.nix
+++ b/pkgs/tools/networking/hyenae/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation {
     sha256 = "1f3x4yn9a9p4f4wk4l8pv7hxfjc8q7cv20xzf7ky735sq1hj0xcg";
   };
 
-  buildInputs = [libdnet pkgconfig libpcap];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [libdnet libpcap];
 
   meta = {
     description = "";
diff --git a/pkgs/tools/networking/isync/default.nix b/pkgs/tools/networking/isync/default.nix
index 761dc01d2f9..8b81e0696c2 100644
--- a/pkgs/tools/networking/isync/default.nix
+++ b/pkgs/tools/networking/isync/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "1bij6nm06ghkg98n2pdyacam2fyg5y8f7ajw0d5653m0r4ldw5p7";
   };
 
-  buildInputs = [ openssl pkgconfig db cyrus_sasl ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ openssl db cyrus_sasl ];
 
   meta = with stdenv.lib; {
     homepage = http://isync.sourceforge.net/;
diff --git a/pkgs/tools/networking/jnettop/default.nix b/pkgs/tools/networking/jnettop/default.nix
index ec2f34f5601..19626174ba4 100644
--- a/pkgs/tools/networking/jnettop/default.nix
+++ b/pkgs/tools/networking/jnettop/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "1855np7c4b0bqzhf1l1dyzxb90fpnvrirdisajhci5am6als31z9";
   };
 
-  buildInputs = [ autoconf libpcap ncurses pkgconfig glib ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ autoconf libpcap ncurses glib ];
 
   patches = [
     ./no-dns-resolution.patch
diff --git a/pkgs/tools/networking/libreswan/default.nix b/pkgs/tools/networking/libreswan/default.nix
index de7f38314fc..59e33e81870 100644
--- a/pkgs/tools/networking/libreswan/default.nix
+++ b/pkgs/tools/networking/libreswan/default.nix
@@ -24,8 +24,8 @@ stdenv.mkDerivation {
     sha256 = "0zginnakxw7m79zrdvfdvliaiyg78zgqfqkks9z5d1rjj5w13xig";
   };
 
-  nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ pkgconfig bash iproute iptables systemd coreutils gnused gawk gmp unbound bison flex pam libevent
+  nativeBuildInputs = [ makeWrapper pkgconfig ];
+  buildInputs = [ bash iproute iptables systemd coreutils gnused gawk gmp unbound bison flex pam libevent
                   libcap_ng curl nspr nss python ]
                 ++ optional docs xmlto;
 
diff --git a/pkgs/tools/networking/maildrop/default.nix b/pkgs/tools/networking/maildrop/default.nix
index da36ef727c2..950a6e310eb 100644
--- a/pkgs/tools/networking/maildrop/default.nix
+++ b/pkgs/tools/networking/maildrop/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "1a94p2b41iy334cwfwmzi19557dn5j61abh0cp2rfc9dkc8ibhdg";
   };
 
-  buildInputs = [ pkgconfig pcre perl ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ pcre perl ];
 
   patches = [ ./maildrop.configure.hack.patch ]; # for building in chroot
 
diff --git a/pkgs/tools/networking/mitmproxy/default.nix b/pkgs/tools/networking/mitmproxy/default.nix
index 583100e0f37..7348cd7f116 100644
--- a/pkgs/tools/networking/mitmproxy/default.nix
+++ b/pkgs/tools/networking/mitmproxy/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchpatch, fetchFromGitHub, python3, glibcLocales }:
+{ stdenv, fetchpatch, fetchFromGitHub, fetchurl, python3, glibcLocales }:
 
 let
   p = python3.override {
@@ -19,6 +19,19 @@ let
           sha256 = "00daa04c9870345f56605d91d7d4897bc1b16f6fff7c74cb602b08ef16c0fb43";
         };
       });
+      pyopenssl = super.pyopenssl.overridePythonAttrs (oldAttrs: rec {
+        version = "17.0.0";
+        name = "${oldAttrs.pname}-${version}";
+        src = oldAttrs.src.override {
+          inherit version;
+          sha256 = "1pdg1gpmkzj8yasg6cmkhcivxcdp4c12nif88y4qvsxq5ffzxas8";
+        };
+        patches = fetchpatch {
+          url = "https://github.com/pyca/pyopenssl/commit/"
+              + "a40898b5f1d472f9449a344f703fa7f90cddc21d.patch";
+          sha256 = "0bdfrhfvdfxhfknn46s4db23i3hww6ami2r1l5rfrri0pn8b8mh7";
+        };
+      });
     };
   };
 in p.pkgs.buildPythonPackage rec {
@@ -70,6 +83,6 @@ in p.pkgs.buildPythonPackage rec {
     description = "Man-in-the-middle proxy";
     homepage = http://mitmproxy.org/;
     license = licenses.mit;
-    maintainers = with maintainers; [ fpletz ];
+    maintainers = with maintainers; [ fpletz kamilchm ];
   };
 }
diff --git a/pkgs/tools/networking/mosh/default.nix b/pkgs/tools/networking/mosh/default.nix
index 1f465bc4f8a..e66209c7ce9 100644
--- a/pkgs/tools/networking/mosh/default.nix
+++ b/pkgs/tools/networking/mosh/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "05hjhlp6lk8yjcy59zywpf0r6s0h0b9zxq0lw66dh9x8vxrhaq6s";
   };
 
-  buildInputs = [ autoreconfHook protobuf ncurses zlib pkgconfig IOTty makeWrapper perl openssl ];
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  buildInputs = [ protobuf ncurses zlib IOTty makeWrapper perl openssl ];
 
   patches = [ ./ssh_path.patch ];
   postPatch = ''
diff --git a/pkgs/tools/networking/ndjbdns/default.nix b/pkgs/tools/networking/ndjbdns/default.nix
index 3269f92d7f4..255d430a3a5 100644
--- a/pkgs/tools/networking/ndjbdns/default.nix
+++ b/pkgs/tools/networking/ndjbdns/default.nix
@@ -13,7 +13,8 @@ stdenv.mkDerivation rec {
     sha256 = "0gjyvn8r66kp49gasd6sqfvg2pj0c6v67hnq7cqwl04kj69rfy86";
   };
 
-  buildInputs = [ autoreconfHook pkgconfig ]
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  buildInputs = [ ]
     ++ optional stdenv.isLinux systemd;
 
   meta = {
diff --git a/pkgs/tools/networking/netalyzr/default.nix b/pkgs/tools/networking/netalyzr/default.nix
index abc6b785c9c..8f8cf929e9d 100644
--- a/pkgs/tools/networking/netalyzr/default.nix
+++ b/pkgs/tools/networking/netalyzr/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, jre }:
+{ stdenv, fetchurl, jre, makeWrapper }:
 
 stdenv.mkDerivation rec {
   name = "netalyzr-${version}";
@@ -12,17 +12,13 @@ stdenv.mkDerivation rec {
 
   phases = [ "installPhase" ];
 
+  nativeBuildInputs = [ makeWrapper ];
+
   installPhase = ''
     mkdir -p $out/{bin,share/netalyzr}
     install -m644 $src $out/share/netalyzr/NetalyzrCLI.jar
-    cat <<_EOF >> $out/bin/netalyzr
-    #!${stdenv.shell}
-
-    set -euo pipefail
-
-    exec ${stdenv.lib.getBin jre}/bin/java -jar $out/share/netalyzr/NetalyzrCLI.jar "\$@"
-    _EOF
-    chmod 755 $out/bin/netalyzr
+    makeWrapper ${stdenv.lib.getBin jre}/bin/java $out/bin/netalyzr \
+      --add-flags "-jar $out/share/netalyzr/NetalyzrCLI.jar"
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/networking/nss-pam-ldapd/default.nix b/pkgs/tools/networking/nss-pam-ldapd/default.nix
index 9e7282c40bd..93646d58cd3 100644
--- a/pkgs/tools/networking/nss-pam-ldapd/default.nix
+++ b/pkgs/tools/networking/nss-pam-ldapd/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "1sw36w6zkzvabvjckqick032j5p5xi0qi3sgnh0znzxz31jqvf0d";
   };
   
-  buildInputs = [ makeWrapper pkgconfig python openldap pam ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ makeWrapper python openldap pam ];
 
   preConfigure = ''
     substituteInPlace Makefile.in --replace "install-data-local: " "# install-data-local: "
diff --git a/pkgs/tools/networking/openconnect/default.nix b/pkgs/tools/networking/openconnect/default.nix
index 4fccb107771..132ae3cf0da 100644
--- a/pkgs/tools/networking/openconnect/default.nix
+++ b/pkgs/tools/networking/openconnect/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
     "--without-openssl-version-check"
   ];
 
-  buildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
   propagatedBuildInputs = [ vpnc openssl gnutls gmp libxml2 stoken zlib ];
 
   meta = {
diff --git a/pkgs/tools/networking/openfortivpn/default.nix b/pkgs/tools/networking/openfortivpn/default.nix
index 48abd9a3374..b1ecc6cba89 100644
--- a/pkgs/tools/networking/openfortivpn/default.nix
+++ b/pkgs/tools/networking/openfortivpn/default.nix
@@ -14,6 +14,7 @@ in stdenv.mkDerivation {
     rev = "v${version}";
     sha256 = "0fm0z73afghwmbshpsn5jfbyyfzz1v8s7scwycnvsk2cgv5f4r86";
   };
+
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
   buildInputs = [ openssl ppp ];
 
diff --git a/pkgs/tools/networking/openssh/default.nix b/pkgs/tools/networking/openssh/default.nix
index 8343f23a1a0..79f203f7747 100644
--- a/pkgs/tools/networking/openssh/default.nix
+++ b/pkgs/tools/networking/openssh/default.nix
@@ -56,7 +56,8 @@ stdenv.mkDerivation rec {
       substituteInPlace Makefile.in --replace '$(INSTALL) -m 4711' '$(INSTALL) -m 0711'
     '';
 
-  buildInputs = [ zlib openssl libedit pkgconfig pam ]
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ zlib openssl libedit pam ]
     ++ optional withKerberos kerberos
     ++ optional hpnSupport autoreconfHook;
 
diff --git a/pkgs/tools/networking/p2p/libtorrent/default.nix b/pkgs/tools/networking/p2p/libtorrent/default.nix
index 9646c47a8d7..87785f50e6f 100644
--- a/pkgs/tools/networking/p2p/libtorrent/default.nix
+++ b/pkgs/tools/networking/p2p/libtorrent/default.nix
@@ -15,7 +15,8 @@ stdenv.mkDerivation rec {
     sha256 = "0y9759sxx5dyamyw8w58dsxq7bmnn57q7s2f4cw2zln2pp5gripw";
   };
 
-  buildInputs = [ pkgconfig libtool autoconf automake cppunit openssl libsigcxx zlib ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libtool autoconf automake cppunit openssl libsigcxx zlib ];
 
   preConfigure = "./autogen.sh";
 
diff --git a/pkgs/tools/networking/p2p/rtorrent/default.nix b/pkgs/tools/networking/p2p/rtorrent/default.nix
index bd3c2850480..6ab462ac5a8 100644
--- a/pkgs/tools/networking/p2p/rtorrent/default.nix
+++ b/pkgs/tools/networking/p2p/rtorrent/default.nix
@@ -18,8 +18,9 @@ stdenv.mkDerivation rec {
     sha256 = "0cxyakc09bn6wjfj42gh508hc62awx825skzacpizx2bqs6v7xvb";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    pkgconfig libtool autoconf automake cppunit
+    libtool autoconf automake cppunit
     libtorrent ncurses libsigcxx curl zlib openssl xmlrpc_c
   ];
 
diff --git a/pkgs/tools/networking/pykms/default.nix b/pkgs/tools/networking/pykms/default.nix
new file mode 100644
index 00000000000..97780d546e4
--- /dev/null
+++ b/pkgs/tools/networking/pykms/default.nix
@@ -0,0 +1,82 @@
+{ stdenv, fetchFromGitHub, python2Packages, writeText, writeScript
+, coreutils, sqlite }:
+
+let
+  dbSql = writeText "create_pykms_db.sql" ''
+    CREATE TABLE clients(
+      clientMachineId TEXT,
+      machineName     TEXT,
+      applicationId   TEXT,
+      skuId           TEXT,
+      licenseStatus   TEXT,
+      lastRequestTime INTEGER,
+      kmsEpid         TEXT,
+      requestCount    INTEGER
+    );
+  '';
+
+  dbScript = writeScript "create_pykms_db.sh" (with stdenv.lib; ''
+    #!${stdenv.shell} -eu
+
+    db=$1
+
+    ${getBin coreutils}/bin/install -d $(dirname $db)
+
+    if [ ! -e $db ] ; then
+      ${getBin sqlite}/bin/sqlite3 $db < ${dbSql}
+    fi
+  '');
+
+in python2Packages.buildPythonApplication rec {
+  name = "pykms-${version}";
+  version = "20170719";
+
+  src = fetchFromGitHub {
+    owner  = "ThunderEX";
+    repo   = "py-kms";
+    rev    = "27355d88affd740330174a7c2bae9f50b9efce56";
+    sha256 = "0cpywj73jmyijjc5hs3b00argjsdwpqzmhawbxkx3mc2l4sgzc88";
+  };
+
+  propagatedBuildInputs = with python2Packages; [ argparse pytz ];
+
+  prePatch = ''
+    siteDir=$out/${python2Packages.python.sitePackages}
+
+    substituteInPlace kmsBase.py \
+      --replace "'KmsDataBase.xml'" "'$siteDir/KmsDataBase.xml'"
+  '';
+
+  dontBuild = true;
+
+  # there are no tests
+  doCheck = false;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/{bin,share/doc/pykms} $siteDir
+
+    mv * $siteDir
+    for b in client server ; do
+      chmod 0755 $siteDir/$b.py
+      makeWrapper ${python2Packages.python.interpreter} $out/bin/$b.py \
+        --add-flags $siteDir/$b.py
+    done
+
+    install -m755 ${dbScript} $out/bin/create_pykms_db.sh
+
+    mv $siteDir/README.md $out/share/doc/pykms/
+
+    ${python2Packages.python.interpreter} -m compileall $siteDir
+
+    runHook postInstall
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Windows KMS (Key Management Service) server written in Python";
+    homepage    = https://github.com/ThunderEX/py-kms;
+    license     = licenses.mit;
+    maintainers = with maintainers; [ peterhoeg ];
+  };
+}
diff --git a/pkgs/tools/networking/samplicator/default.nix b/pkgs/tools/networking/samplicator/default.nix
index 1b537870b09..5cb65b78ee8 100644
--- a/pkgs/tools/networking/samplicator/default.nix
+++ b/pkgs/tools/networking/samplicator/default.nix
@@ -4,7 +4,8 @@ stdenv.mkDerivation rec {
   name = "samplicator-${version}";
   version = "1.3.8rc1";
 
-  buildInputs = [ autoreconfHook ];
+  nativeBuildInputs = [ autoreconfHook ];
+  buildInputs = [ ];
 
   src = fetchFromGitHub {
     owner = "sleinen";
diff --git a/pkgs/tools/networking/tlspool/default.nix b/pkgs/tools/networking/tlspool/default.nix
index 53465a0242d..acb5a042ffc 100644
--- a/pkgs/tools/networking/tlspool/default.nix
+++ b/pkgs/tools/networking/tlspool/default.nix
@@ -19,7 +19,8 @@ stdenv.mkDerivation rec {
   };
 
   propagatedBuildInputs = [ python softhsm openldap p11_kit.dev p11_kit.out gnupg ];
-  buildInputs = [ unbound pkgconfig unzip git libtasn1 db libmemcached cyrus_sasl openssl bash quickder
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ unbound unzip git libtasn1 db libmemcached cyrus_sasl openssl bash quickder
                   libkrb5 ldns libtool swig pkgs.pythonPackages.pip gnutls-kdh ]
                 ++ stdenv.lib.optional useSystemd systemd;
 
diff --git a/pkgs/tools/networking/tracebox/default.nix b/pkgs/tools/networking/tracebox/default.nix
index 8c443282e5c..c3abdd49e13 100644
--- a/pkgs/tools/networking/tracebox/default.nix
+++ b/pkgs/tools/networking/tracebox/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0gxdapm6b5a41gymi1f0nr2kyz70vllnk10085yz3pq527gp9gns";
   };
 
-  buildInputs = [ autoreconfHook libcrafter lua ];
+  nativeBuildInputs = [ autoreconfHook ];
+  buildInputs = [ libcrafter lua ];
 
   configureFlags = [ "--with-lua=yes" ];
 
diff --git a/pkgs/tools/package-management/apt/default.nix b/pkgs/tools/package-management/apt/default.nix
index 8082565361b..8077fb1d93d 100644
--- a/pkgs/tools/package-management/apt/default.nix
+++ b/pkgs/tools/package-management/apt/default.nix
@@ -24,10 +24,12 @@ stdenv.mkDerivation rec {
     sha256 = "0ahwhmscrmnpvl1r732wg93dzkhv8c1sph2yrqgsrhr73c1616ix";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
+
   buildInputs = [
-    pkgconfig cmake perl curl gtest lzma bzip2 lz4 db dpkg libxslt.bin
+    cmake perl curl gtest lzma bzip2 lz4 db dpkg libxslt.bin
   ] ++ lib.optionals withDocs [
-    doxygen Po4a w3m
+    doxygen Po4a w3m docbook_xml_dtd_45
   ] ++ lib.optionals withNLS [
     gettext
   ];
@@ -42,15 +44,6 @@ stdenv.mkDerivation rec {
       -DWITH_DOC=${if withDocs then "ON" else "OFF"}
       -DUSE_NLS=${if withNLS then "ON" else "OFF"}
     )
-
-    for f in doc/*; do
-      if [[ -f "$f" ]]; then
-        substituteInPlace "$f" \
-          --replace \
-            "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" \
-            "${docbook_xml_dtd_45}/xml/dtd/docbook/docbookx.dtd"
-      fi
-    done
   '';
 
   enableParallelBuilding = true;
diff --git a/pkgs/tools/package-management/disnix/default.nix b/pkgs/tools/package-management/disnix/default.nix
index f260241fe6b..830c576c406 100644
--- a/pkgs/tools/package-management/disnix/default.nix
+++ b/pkgs/tools/package-management/disnix/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation {
     sha256 = "1cgf7hgqrwsqgyc77sis0hr7cwgk3vx8cd4msgq11qbwywi3b6id";
   };
   
-  buildInputs = [ pkgconfig glib libxml2 libxslt getopt nixUnstable libintlOrEmpty libiconv dysnomia ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ glib libxml2 libxslt getopt nixUnstable libintlOrEmpty libiconv dysnomia ];
 
   meta = {
     description = "A Nix-based distributed service deployment tool";
diff --git a/pkgs/tools/package-management/disnix/disnixos/default.nix b/pkgs/tools/package-management/disnix/disnixos/default.nix
index 2a6a0dcc78a..98d1802f881 100644
--- a/pkgs/tools/package-management/disnix/disnixos/default.nix
+++ b/pkgs/tools/package-management/disnix/disnixos/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation {
     sha256 = "0pqv8n9942vjwmb32m1af29fi0vjlsbwkj2c7h1xs28z6wahr7wa";
   };
   
-  buildInputs = [ socat pkgconfig dysnomia disnix getopt ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ socat dysnomia disnix getopt ];
   
   meta = {
     description = "Provides complementary NixOS infrastructure deployment to Disnix";
diff --git a/pkgs/tools/package-management/nix-bundle/default.nix b/pkgs/tools/package-management/nix-bundle/default.nix
index e3255afe7fe..7c02d2d9a63 100644
--- a/pkgs/tools/package-management/nix-bundle/default.nix
+++ b/pkgs/tools/package-management/nix-bundle/default.nix
@@ -3,13 +3,13 @@
 stdenv.mkDerivation rec {
   pname = "nix-bundle";
   name = "${pname}-${version}";
-  version = "0.1.3";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "matthewbauer";
     repo = pname;
     rev = "v${version}";
-    sha256 = "15r77pchf4s4cdv4lvw2zw1yic78k8p0n2r954qq370vscw30yac";
+    sha256 = "0klabmygbhzlwxja8p2w8fp8ip3xaa5ym9c15rp9qxzh03hfmdjx";
   };
 
   # coreutils, gnutar is actually needed by nix for bootstrap
@@ -23,6 +23,7 @@ stdenv.mkDerivation rec {
     mkdir -p $out/bin
     makeWrapper $out/share/nix-bundle/nix-bundle.sh $out/bin/nix-bundle \
       --prefix PATH : ${binPath}
+    cp $out/share/nix-bundle/nix-run.sh $out/bin/nix-run
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/package-management/nix-index/default.nix b/pkgs/tools/package-management/nix-index/default.nix
index 388942f6ad8..70cd83b87a3 100644
--- a/pkgs/tools/package-management/nix-index/default.nix
+++ b/pkgs/tools/package-management/nix-index/default.nix
@@ -13,7 +13,8 @@ buildRustPackage rec {
     sha256 = "1lmg65yqkwf2a5qxm3dmv8158kqhnriir062vlgar5wimf409rm5";
   };
   depsSha256 = "0v145fi9bfiwvsdy7hz9lw4m2f2j8sxvixfzmjwfnq4klm51c8yl";
-  buildInputs = [pkgconfig openssl curl];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ openssl curl];
 
   postInstall = ''
     mkdir -p $out/etc/profile.d
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index e90f71780eb..ac697be555a 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -161,12 +161,12 @@ in rec {
 
   nixUnstable = (lib.lowPrio (common rec {
     name = "nix-1.12${suffix}";
-    suffix = "pre5619_346aeee1";
+    suffix = "pre5650_1dd29d7a";
     src = fetchFromGitHub {
       owner = "NixOS";
       repo = "nix";
-      rev = "346aeee1cb21b5cab5ddc3e8658c88321f513761";
-      sha256 = "0lyrs0mqnh89w1nzrqpxvnh7bdjpg8j22xaidql47f1nwbblmn3f";
+      rev = "1dd29d7aebae706f3e90a18bbfae727f2ed03c70";
+      sha256 = "182v2rczm8al1ggbaca8qapvrjyp21li1fd3fiwr5nqgazgr5308";
     };
     fromGit = true;
   })) // { perl-bindings = perl-bindings { nix = nixUnstable; }; };
diff --git a/pkgs/tools/package-management/rpm/default.nix b/pkgs/tools/package-management/rpm/default.nix
index 78d815eb7c1..860be0e1f79 100644
--- a/pkgs/tools/package-management/rpm/default.nix
+++ b/pkgs/tools/package-management/rpm/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" "man" ];
 
-  buildInputs = [ cpio zlib bzip2 file libarchive nspr nss db xz python lua pkgconfig autoreconfHook ];
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  buildInputs = [ cpio zlib bzip2 file libarchive nspr nss db xz python lua ];
 
   # rpm/rpmlib.h includes popt.h, and then the pkg-config file mentions these as linkage requirements
   propagatedBuildInputs = [ popt elfutils nss db bzip2 libarchive binutils ];
diff --git a/pkgs/tools/security/aespipe/default.nix b/pkgs/tools/security/aespipe/default.nix
index aefd6b7500c..c67c758b933 100644
--- a/pkgs/tools/security/aespipe/default.nix
+++ b/pkgs/tools/security/aespipe/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "aespipe-${version}";
-  version = "2.4d";
+  version = "2.4e";
 
   src = fetchurl {
     url = "mirror://sourceforge/loop-aes/aespipe/aespipe-v${version}.tar.bz2";
-    sha256 = "03z5i41xv6p3m79lm04d7msda8878lsppv3324zbjjfy19p6bkn5";
+    sha256 = "0fmr0vk408bf13jydhdmcdhqw31yc9qk329bs9i60alccywapmds";
   };
 
   meta = {
diff --git a/pkgs/tools/security/ccid/default.nix b/pkgs/tools/security/ccid/default.nix
index e450cf5952e..9eb5858b057 100644
--- a/pkgs/tools/security/ccid/default.nix
+++ b/pkgs/tools/security/ccid/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "0dyikpmhsph36ndgd61bs4yx437v5y0bmm8ahjacp1k9c1ly4q56";
   };
 
-  patchPhase = ''
+  postPatch = ''
     patchShebangs .
     substituteInPlace src/Makefile.in --replace /bin/echo echo
   '';
diff --git a/pkgs/tools/security/crackxls/default.nix b/pkgs/tools/security/crackxls/default.nix
index f4c92ac701f..2a88e4462b6 100644
--- a/pkgs/tools/security/crackxls/default.nix
+++ b/pkgs/tools/security/crackxls/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "0q5jl7hcds3f0rhly3iy4fhhbyh9cdrfaw7zdrazzf1wswwhyssz";
   };
 
-  buildInputs = [ pkgconfig autoconf automake openssl libgsf gmp ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ autoconf automake openssl libgsf gmp ];
 
   installPhase =
   ''
diff --git a/pkgs/tools/security/ecryptfs/default.nix b/pkgs/tools/security/ecryptfs/default.nix
index f8ef409813c..91546f1a78f 100644
--- a/pkgs/tools/security/ecryptfs/default.nix
+++ b/pkgs/tools/security/ecryptfs/default.nix
@@ -33,7 +33,8 @@ stdenv.mkDerivation rec {
     done
   '';
 
-  buildInputs = [ pkgconfig perl nss nspr python2 pam intltool makeWrapper ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ perl nss nspr python2 pam intltool makeWrapper ];
   propagatedBuildInputs = [ coreutils gettext cryptsetup lvm2 rsync keyutils which ];
 
   postInstall = ''
diff --git a/pkgs/tools/security/enpass/data.json b/pkgs/tools/security/enpass/data.json
index b3625d928b5..28d568d30ae 100644
--- a/pkgs/tools/security/enpass/data.json
+++ b/pkgs/tools/security/enpass/data.json
@@ -1,12 +1,12 @@
 {
   "amd64": {
-    "path": "pool/main/e/enpass/enpass_5.4.0-4_amd64.deb", 
-    "sha256": "6b460fed2d7d8473e2b5d069dbe60263195b916c8b79a8fc7c2e8cb953134579", 
-    "version": "5.4.0.post4"
+    "path": "pool/main/e/enpass/enpass_5.6.0_amd64.deb", 
+    "sha256": "129ae4b4bfb8e0b4fa9acdfb3aebac3dd894364f2f31e9cd3bd5d3567e3a13b7", 
+    "version": "5.6.0"
   }, 
   "i386": {
-    "path": "pool/main/e/enpass/enpass_5.4.0-4_i386.deb", 
-    "sha256": "1ec8088d5c3b2906d6820f96e1868c473e78dbe882f04e74a7816d19d43e3692", 
-    "version": "5.4.0.post4"
+    "path": "pool/main/e/enpass/enpass_5.6.0_i386.deb", 
+    "sha256": "c456002194c0be08a2c0da68ecf224425e35c46de5292098208e4e2b1f6d88ae", 
+    "version": "5.6.0"
   }
 }
\ No newline at end of file
diff --git a/pkgs/tools/security/fpm2/default.nix b/pkgs/tools/security/fpm2/default.nix
index 8bb3cba15c4..69b4b36fb9b 100644
--- a/pkgs/tools/security/fpm2/default.nix
+++ b/pkgs/tools/security/fpm2/default.nix
@@ -13,7 +13,8 @@ stdenv.mkDerivation rec {
     sha256 = "d55e9ce6be38a44fc1053d82db2d117cf3991a51898bd86d7913bae769f04da7";
   };
 
-  buildInputs = [ pkgconfig gnupg gtk2 libxml2 intltool ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ gnupg gtk2 libxml2 intltool ];
 
   meta = {
     description = "FPM2 is GTK2 port from Figaro's Password Manager originally developed by John Conneely, with some new enhancements.";
diff --git a/pkgs/tools/security/gencfsm/default.nix b/pkgs/tools/security/gencfsm/default.nix
index fbd32cdc22d..c180ca6c720 100644
--- a/pkgs/tools/security/gencfsm/default.nix
+++ b/pkgs/tools/security/gencfsm/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "1rpf683lxa78fmxxb0hnq7vdh3yn7qid2gqq67q9mk65sp9vdhdj";
   };
 
-  buildInputs = [ autoconf automake intltool libtool pkgconfig vala glib encfs
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ autoconf automake intltool libtool vala glib encfs
     gtk3 libgnome_keyring gnome3.libgee xorg.libSM xorg.libICE
     wrapGAppsHook ];
 
diff --git a/pkgs/tools/security/gnupg/22.nix b/pkgs/tools/security/gnupg/22.nix
index 87686cd52c1..18d784a59bb 100644
--- a/pkgs/tools/security/gnupg/22.nix
+++ b/pkgs/tools/security/gnupg/22.nix
@@ -22,8 +22,9 @@ stdenv.mkDerivation rec {
     sha256 = "1yv2pwf3vhv9dpbf51fnm0wy03va1cg5r7qaz7rg75cwbgb0rmrl";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    pkgconfig libgcrypt libassuan libksba libiconv npth gettext texinfo
+    libgcrypt libassuan libksba libiconv npth gettext texinfo
     readline libusb gnutls adns openldap zlib bzip2 sqlite
   ];
 
diff --git a/pkgs/tools/security/kbfs/default.nix b/pkgs/tools/security/kbfs/default.nix
index 7b3e7d99a43..ba024328ba5 100644
--- a/pkgs/tools/security/kbfs/default.nix
+++ b/pkgs/tools/security/kbfs/default.nix
@@ -2,18 +2,18 @@
 
 buildGoPackage rec {
   name = "kbfs-${version}";
-  version = "20170922.f76290";
+  version = "20171004.40555d";
 
   goPackagePath = "github.com/keybase/kbfs";
-  subPackages = [ "kbfsfuse" ];
+  subPackages = [ "kbfsfuse" "kbfsgit/git-remote-keybase" ];
 
   dontRenameImports = true;
 
   src = fetchFromGitHub {
     owner = "keybase";
     repo = "kbfs";
-    rev = "f76290f6e1a8cbaa6046980c67c548fbff9e123a";
-    sha256 = "1v086wmc0hly4b91y6xndfdhj981n2yr6nnb3rl6f4kwx291ih54";
+    rev = "40555dbc9c93a05f3a82053860df30e45c7bd779";
+    sha256 = "08wj8fh1ja8kfzvbza5csy9mpfy39lifnzvfrnbj7vyyv88qc3h0";
   };
 
   buildFlags = [ "-tags production" ];
diff --git a/pkgs/tools/security/keybase-gui/default.nix b/pkgs/tools/security/keybase-gui/default.nix
index a45a6ea2a04..ce98740e89b 100644
--- a/pkgs/tools/security/keybase-gui/default.nix
+++ b/pkgs/tools/security/keybase-gui/default.nix
@@ -37,10 +37,10 @@ let
 in
 stdenv.mkDerivation rec {
   name = "keybase-gui-${version}";
-  version = "1.0.25-20170714172717.73f9070";
+  version = "1.0.33-20171003193427.d9ceb86ac";
   src = fetchurl {
     url = "https://s3.amazonaws.com/prerelease.keybase.io/linux_binaries/deb/keybase_${version}_amd64.deb";
-    sha256 = "0yrq18rrc30f7ymajvd71r29z1by7h6abyaxx2gmrg648qgc6zv4";
+    sha256 = "0sqani2fy5jzqmz35md1bdw2vwpx91l87b6s3x9z53halzq7vfy6";
   };
   phases = ["unpackPhase" "installPhase" "fixupPhase"];
   unpackPhase = ''
diff --git a/pkgs/tools/security/keybase/default.nix b/pkgs/tools/security/keybase/default.nix
index 229a45b8731..7f095a3225b 100644
--- a/pkgs/tools/security/keybase/default.nix
+++ b/pkgs/tools/security/keybase/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   name = "keybase-${version}";
-  version = "1.0.30";
+  version = "1.0.33";
 
   goPackagePath = "github.com/keybase/client";
   subPackages = [ "go/keybase" ];
@@ -13,13 +13,9 @@ buildGoPackage rec {
     owner  = "keybase";
     repo   = "client";
     rev    = "v${version}";
-    sha256 = "0vivc71xfi4y3ydd29b17qxzi10r3a1ppmjjws6vrs0gz58bz1j8";
+    sha256 = "1zgvriyir2ga0p4ah9ia1sbl9ydnrnw5ggq4c1ya8gcfgn8vzdsf";
   };
 
-  postInstall = stdenv.lib.optionalString stdenv.isDarwin ''
-    install_name_tool -delete_rpath $out/lib $bin/bin/keybase
-  '';
-
   buildFlags = [ "-tags production" ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/security/mfcuk/default.nix b/pkgs/tools/security/mfcuk/default.nix
index 9a593907a53..ebd9a6d5e7e 100644
--- a/pkgs/tools/security/mfcuk/default.nix
+++ b/pkgs/tools/security/mfcuk/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0m9sy61rsbw63xk05jrrmnyc3xda0c3m1s8pg3sf8ijbbdv9axcp";
   };
 
-  buildInputs = [ pkgconfig libnfc ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libnfc ];
 
   meta = with stdenv.lib; {
     description = "MiFare Classic Universal toolKit";
diff --git a/pkgs/tools/security/mfoc/default.nix b/pkgs/tools/security/mfoc/default.nix
index a223b3e835a..8a454ca67fd 100644
--- a/pkgs/tools/security/mfoc/default.nix
+++ b/pkgs/tools/security/mfoc/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
 
   patches = [./mf_mini.patch];
 
-  buildInputs = [ pkgconfig libnfc ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libnfc ];
 
   meta = with stdenv.lib; {
     description = "Mifare Classic Offline Cracker";
diff --git a/pkgs/tools/security/modsecurity/Makefile.in.patch b/pkgs/tools/security/modsecurity/Makefile.in.patch
new file mode 100644
index 00000000000..98384c754ce
--- /dev/null
+++ b/pkgs/tools/security/modsecurity/Makefile.in.patch
@@ -0,0 +1,17 @@
+--- a/apache2/Makefile.in	2017-10-10 09:45:51.000000000 -0400
++++ b/apache2/Makefile.in	2017-10-10 09:46:04.000000000 -0400
+@@ -1208,14 +1208,12 @@
+ @LINUX_TRUE@	for m in $(pkglib_LTLIBRARIES); do \
+ @LINUX_TRUE@	  base=`echo $$m | sed 's/\..*//'`; \
+ @LINUX_TRUE@	  rm -f $(DESTDIR)$(pkglibdir)/$$base.*a; \
+-@LINUX_TRUE@	  install -D -m444 $(DESTDIR)$(pkglibdir)/$$base.so $(DESTDIR)$(APXS_MODULES)/$$base.so; \
+ @LINUX_TRUE@	done
+ @LINUX_FALSE@install-exec-hook: $(pkglib_LTLIBRARIES)
+ @LINUX_FALSE@	@echo "Removing unused static libraries..."; \
+ @LINUX_FALSE@	for m in $(pkglib_LTLIBRARIES); do \
+ @LINUX_FALSE@	  base=`echo $$m | sed 's/\..*//'`; \
+ @LINUX_FALSE@	  rm -f $(DESTDIR)$(pkglibdir)/$$base.*a; \
+-@LINUX_FALSE@	  cp -p $(DESTDIR)$(pkglibdir)/$$base.so $(DESTDIR)$(APXS_MODULES); \
+ @LINUX_FALSE@	done
+ 
+ # Tell versions [3.59,3.63) of GNU make to not export all variables.
diff --git a/pkgs/tools/security/modsecurity/default.nix b/pkgs/tools/security/modsecurity/default.nix
index a5e03eb3fe1..2c02a5dd473 100644
--- a/pkgs/tools/security/modsecurity/default.nix
+++ b/pkgs/tools/security/modsecurity/default.nix
@@ -1,35 +1,43 @@
 { stdenv, lib, fetchurl, pkgconfig
-, curl, apacheHttpd, pcre, apr, aprutil, libxml2 }:
+, curl, apacheHttpd, pcre, apr, aprutil, libxml2
+, luaSupport ? false, lua5
+}:
 
 with lib;
 
+let luaValue = if luaSupport then lua5 else "no";
+    optional = stdenv.lib.optional;
+in
+
 stdenv.mkDerivation rec {
   name = "modsecurity-${version}";
-  version = "2.9.0";
+  version = "2.9.2";
 
   src = fetchurl {
     url = "https://www.modsecurity.org/tarball/${version}/${name}.tar.gz";
-    sha256 = "e2bbf789966c1f80094d88d9085a81bde082b2054f8e38e0db571ca49208f434";
+    sha256 = "41a8f73476ec891f3a9e8736b98b64ea5c2105f1ce15ea57a1f05b4bf2ffaeb5";
   };
 
   nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ curl apacheHttpd pcre apr aprutil libxml2 ];
-  configureFlags = [
-    "--enable-standalone-module"
-    "--enable-static"
-    "--with-curl=${curl.dev}"
-    "--with-apxs=${apacheHttpd.dev}/bin/apxs"
-    "--with-pcre=${pcre.dev}"
-    "--with-apr=${apr.dev}"
-    "--with-apu=${aprutil.dev}/bin/apu-1-config"
-    "--with-libxml=${libxml2.dev}"
-  ];
+  buildInputs = [  curl apacheHttpd pcre apr aprutil libxml2 ] ++
+    optional luaSupport lua5;
+
+  configureFlags = ''
+    --enable-standalone-module
+    --enable-static
+    --with-curl=${curl.dev}
+    --with-apxs=${apacheHttpd.dev}/bin/apxs
+    --with-pcre=${pcre.dev}
+    --with-apr=${apr.dev}
+    --with-apu=${aprutil.dev}/bin/apu-1-config
+    --with-libxml=${libxml2.dev}
+    --with-lua=${luaValue}
+  '';
 
   outputs = ["out" "nginx"];
-
-  preBuild = ''
-    substituteInPlace apache2/Makefile.in --replace "install -D " "# install -D"
-  '';
+  # by default modsecurity's install script copies compiled output to httpd's modules folder
+  # this patch removes those lines
+  patches = [ ./Makefile.in.patch ];
 
   postInstall = ''
     mkdir -p $nginx
@@ -41,6 +49,6 @@ stdenv.mkDerivation rec {
     license = licenses.asl20;
     homepage = https://www.modsecurity.org/;
     maintainers = with maintainers; [offline];
-    platforms = platforms.linux;
+    platforms   = stdenv.lib.platforms.linux ++ stdenv.lib.platforms.darwin;
   };
 }
diff --git a/pkgs/tools/security/nmap/default.nix b/pkgs/tools/security/nmap/default.nix
index b3c1a32f22b..45f995a5935 100644
--- a/pkgs/tools/security/nmap/default.nix
+++ b/pkgs/tools/security/nmap/default.nix
@@ -46,7 +46,8 @@ in stdenv.mkDerivation rec {
       wrapProgram $out/bin/zenmap --prefix PYTHONPATH : "$(toPythonPath $out)" --prefix PYTHONPATH : "$PYTHONPATH" --prefix PYTHONPATH : $(toPythonPath $pygtk)/gtk-2.0 --prefix PYTHONPATH : $(toPythonPath $pygobject)/gtk-2.0 --prefix PYTHONPATH : $(toPythonPath $pycairo)/gtk-2.0
   '';
 
-  buildInputs = with python2Packages; [ libpcap pkgconfig openssl ]
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = with python2Packages; [ libpcap openssl ]
     ++ optionals pythonSupport [ makeWrapper python ]
     ++ optionals graphicalSupport [
       libX11 gtk2 pygtk pysqlite pygobject2 pycairo
diff --git a/pkgs/tools/security/opensc/default.nix b/pkgs/tools/security/opensc/default.nix
index 2b606d505bd..ce310eec5ae 100644
--- a/pkgs/tools/security/opensc/default.nix
+++ b/pkgs/tools/security/opensc/default.nix
@@ -15,8 +15,9 @@ stdenv.mkDerivation rec {
     sha256 = "16y3ryx606nry2li05hm88bllrragdj3sfl3yh7pf71777n4lsk4";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    autoreconfHook pkgconfig zlib readline openssl pcsclite libassuan
+    autoreconfHook zlib readline openssl pcsclite libassuan
     libXt libxslt libiconv docbook_xml_dtd_412
   ] ++ stdenv.lib.optional stdenv.isDarwin Carbon;
 
diff --git a/pkgs/tools/security/qdigidoc/default.nix b/pkgs/tools/security/qdigidoc/default.nix
index e4141d1a61b..1e626084ee3 100644
--- a/pkgs/tools/security/qdigidoc/default.nix
+++ b/pkgs/tools/security/qdigidoc/default.nix
@@ -25,7 +25,8 @@ stdenv.mkDerivation rec {
       --prefix LD_LIBRARY_PATH : ${opensc}/lib/pkcs11/
   '';
 
-  buildInputs = [ cmake ccid qttools pkgconfig pcsclite qttranslations
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ cmake ccid qttools pcsclite qttranslations
                   hicolor_icon_theme libdigidocpp opensc shared_mime_info
                   openldap gettext desktop_file_utils makeWrapper
                 ];
diff --git a/pkgs/tools/security/qesteidutil/default.nix b/pkgs/tools/security/qesteidutil/default.nix
index 04f6cbf6d11..f2a997db05f 100644
--- a/pkgs/tools/security/qesteidutil/default.nix
+++ b/pkgs/tools/security/qesteidutil/default.nix
@@ -17,7 +17,8 @@ stdenv.mkDerivation rec {
     cd src
   '';
 
-  buildInputs = [ cmake ccid qttools pkgconfig pcsclite qttranslations
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ cmake ccid qttools pcsclite qttranslations
                   hicolor_icon_theme
                 ];
   
diff --git a/pkgs/tools/security/sbsigntool/default.nix b/pkgs/tools/security/sbsigntool/default.nix
index bca93887bd4..b66564d58ce 100644
--- a/pkgs/tools/security/sbsigntool/default.nix
+++ b/pkgs/tools/security/sbsigntool/default.nix
@@ -15,7 +15,8 @@ stdenv.mkDerivation rec {
 
   prePatch = "patchShebangs .";
 
-  buildInputs = [ autoconf automake utillinux openssl libuuid gnu-efi binutils pkgconfig help2man ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ autoconf automake utillinux openssl libuuid gnu-efi binutils help2man ];
 
   configurePhase = ''
     substituteInPlace configure.ac --replace "@@NIX_GNUEFI@@" "${gnu-efi}"
diff --git a/pkgs/tools/security/scrypt/default.nix b/pkgs/tools/security/scrypt/default.nix
index 1835dbdb620..352a81b2727 100644
--- a/pkgs/tools/security/scrypt/default.nix
+++ b/pkgs/tools/security/scrypt/default.nix
@@ -2,27 +2,26 @@
 
 stdenv.mkDerivation rec {
   name = "scrypt-${version}";
-  version = "1.2.0";
+  version = "1.2.1";
 
   src = fetchurl {
     url = "https://www.tarsnap.com/scrypt/${name}.tgz";
-    sha256 = "1m39hpfby0fdjam842773i5w7pa0qaj7f0r22jnchxsj824vqm0p";
+    sha256 = "0xy5yhrwwv13skv9im9vm76rybh9f29j2dh4hlh2x01gvbkza8a6";
   };
 
   buildInputs = [ openssl ];
 
   patchPhase = ''
-    substituteInPlace Makefile.in \
-      --replace "command -p mv" "mv"
-    substituteInPlace autocrap/Makefile.am \
-      --replace "command -p mv" "mv"
+    for f in Makefile.in autotools/Makefile.am libcperciva/cpusupport/Build/cpusupport.sh ; do
+      substituteInPlace $f --replace "command -p " ""
+    done
   '';
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "Encryption utility";
     homepage    = https://www.tarsnap.com/scrypt.html;
-    license     = stdenv.lib.licenses.bsd2;
-    platforms   = stdenv.lib.platforms.all;
-    maintainers = [ stdenv.lib.maintainers.thoughtpolice ];
+    license     = licenses.bsd2;
+    platforms   = platforms.all;
+    maintainers = with maintainers; [ thoughtpolice ];
   };
 }
diff --git a/pkgs/tools/security/stoken/default.nix b/pkgs/tools/security/stoken/default.nix
index 17652e220da..464f6d21584 100644
--- a/pkgs/tools/security/stoken/default.nix
+++ b/pkgs/tools/security/stoken/default.nix
@@ -20,8 +20,10 @@ stdenv.mkDerivation rec {
     automake --add-missing --copy
     autoconf
   '';
+
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    autoconf automake libtool pkgconfig
+    autoconf automake libtool
     libxml2 nettle
   ] ++ stdenv.lib.optional withGTK3 gtk3;
 
diff --git a/pkgs/tools/security/sudolikeaboss/default.nix b/pkgs/tools/security/sudolikeaboss/default.nix
index 066fef39a82..15f76741589 100644
--- a/pkgs/tools/security/sudolikeaboss/default.nix
+++ b/pkgs/tools/security/sudolikeaboss/default.nix
@@ -22,10 +22,6 @@ buildGoPackage rec {
     fixDarwinDylibNames
   ];
 
-  postInstall = ''
-    install_name_tool -delete_rpath $out/lib -add_rpath $bin $bin/bin/sudolikeaboss
-  '';
-
   meta = with stdenv.lib; {
     inherit version;
     inherit (src.meta) homepage;
diff --git a/pkgs/tools/security/tpm-luks/default.nix b/pkgs/tools/security/tpm-luks/default.nix
index 40829df56ca..7d0ff797336 100644
--- a/pkgs/tools/security/tpm-luks/default.nix
+++ b/pkgs/tools/security/tpm-luks/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
     sha256 = "1ms2v57f13r9km6mvf9rha5ndmlmjvrz3mcikai6nzhpj0nrjz0w";
   };
 
-  buildInputs = [ autoreconfHook gawk trousers cryptsetup openssl ];
+  nativeBuildInputs = [ autoreconfHook ];
+  buildInputs = [ gawk trousers cryptsetup openssl ];
 
   installPhase = ''
     mkdir -p $out
diff --git a/pkgs/tools/security/trousers/default.nix b/pkgs/tools/security/trousers/default.nix
index e49f2f8ed0f..8309390d013 100644
--- a/pkgs/tools/security/trousers/default.nix
+++ b/pkgs/tools/security/trousers/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "1lvnla1c1ig2w3xvvrqg2w9qm7a1ygzy1j2gg8j7p8c87i58x45v";
   };
 
-  buildInputs = [ openssl pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ openssl ];
 
   patches = [ ./allow-non-tss-config-file-owner.patch ];
 
diff --git a/pkgs/tools/system/bootchart/default.nix b/pkgs/tools/system/bootchart/default.nix
index 34da8d40081..f99d22becdb 100644
--- a/pkgs/tools/system/bootchart/default.nix
+++ b/pkgs/tools/system/bootchart/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "1abn4amsyys6vwn7csxsxny94n24ycca3xhqxqcmdc4j0dzn3kmb";
   };
 
-  buildInputs = [ pkgconfig glib gtk2 python2Packages.python python2Packages.wrapPython python2Packages.pygtk ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ glib gtk2 python2Packages.python python2Packages.wrapPython python2Packages.pygtk ];
   pythonPath = with python2Packages; [ pygtk pycairo ];
 
   installPhase = ''
diff --git a/pkgs/tools/system/chase/default.nix b/pkgs/tools/system/chase/default.nix
index e1c163f4170..6dcaeed325a 100644
--- a/pkgs/tools/system/chase/default.nix
+++ b/pkgs/tools/system/chase/default.nix
@@ -4,7 +4,8 @@ stdenv.mkDerivation rec {
   name = "chase-${version}";
   version = "0.5.2";
 
-  buildInputs = [ pkgconfig libatomic_ops boehmgc ] ;
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libatomic_ops boehmgc ] ;
   src = fetchurl {
     url = "mirror://debian/pool/main/c/chase/chase_${version}.orig.tar.gz";
     sha256 = "68d95c2d4dc45553b75790fcea4413b7204a2618dff148116ca9bdb0310d737f";
diff --git a/pkgs/tools/system/collectd/default.nix b/pkgs/tools/system/collectd/default.nix
index 2e12345783d..6f4b94f826d 100644
--- a/pkgs/tools/system/collectd/default.nix
+++ b/pkgs/tools/system/collectd/default.nix
@@ -43,8 +43,9 @@ stdenv.mkDerivation rec {
     sha256 = "14p5cc3ys3qfg71xzxfvmxdmz5l4brpbhlmw1fwdda392lia084x";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    pkgconfig curl libdbi libgcrypt libmemcached
+    curl libdbi libgcrypt libmemcached
     cyrus_sasl libnotify gdk_pixbuf liboping libpcap libvirt
     libxml2 libmysql postgresql protobufc rrdtool
     varnish yajl jdk libtool python hiredis libmicrohttpd
diff --git a/pkgs/tools/system/das_watchdog/default.nix b/pkgs/tools/system/das_watchdog/default.nix
index fbca63b0e0a..bcea40b1193 100644
--- a/pkgs/tools/system/das_watchdog/default.nix
+++ b/pkgs/tools/system/das_watchdog/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
     sha256 = "02y1vfb3wh4908xjj1kpyf8kgxk29x8dw7yl3pnl220qz2gi99vr";
   };
 
-  buildInputs = [ libgtop xmessage which pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libgtop xmessage which ];
 
   installPhase = ''
     mkdir -p $out/bin/
diff --git a/pkgs/tools/system/fakechroot/default.nix b/pkgs/tools/system/fakechroot/default.nix
index be3a32de251..25470af9bb3 100644
--- a/pkgs/tools/system/fakechroot/default.nix
+++ b/pkgs/tools/system/fakechroot/default.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation rec {
     sha256 = "1ls3y97qqfcfd3z0balz94xq1gskfk04pg85x6b7wjw8dm4030qd";
   };
 
-  buildInputs = [ autoreconfHook perl ];
+  nativeBuildInputs = [ autoreconfHook ];
+  buildInputs = [ perl ];
 
   meta = with stdenv.lib; {
     homepage = https://github.com/dex4er/fakechroot;
diff --git a/pkgs/tools/system/gdmap/default.nix b/pkgs/tools/system/gdmap/default.nix
index b03ec34972e..72938216b0a 100644
--- a/pkgs/tools/system/gdmap/default.nix
+++ b/pkgs/tools/system/gdmap/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "0nr8l88cg19zj585hczj8v73yh21k7j13xivhlzl8jdk0j0cj052";
   };
 
-  buildInputs = [ gtk2 pkgconfig libxml2 intltool gettext ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ gtk2 libxml2 intltool gettext ];
 
   patches = [ ./get_sensitive.patch ./set_flags.patch ];
 
diff --git a/pkgs/tools/system/hardinfo/default.nix b/pkgs/tools/system/hardinfo/default.nix
index 11236b7a9d1..a2bffab3a98 100644
--- a/pkgs/tools/system/hardinfo/default.nix
+++ b/pkgs/tools/system/hardinfo/default.nix
@@ -13,7 +13,8 @@ stdenv.mkDerivation rec {
 
   # Not adding 'hostname' command, the build shouldn't depend on what the build
   # host is called.
-  buildInputs = [ which pkgconfig gtk2 pcre glib libxml2 libsoup ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ which gtk2 pcre glib libxml2 libsoup ];
 
   # Fixes '#error You must compile this program without "-O"'
   hardeningDisable = [ "all" ];
diff --git a/pkgs/tools/system/illum/default.nix b/pkgs/tools/system/illum/default.nix
index d8faeea19d8..03373300a94 100644
--- a/pkgs/tools/system/illum/default.nix
+++ b/pkgs/tools/system/illum/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "05v3hz7n6b1mlhc6zqijblh1vpl0ja1y8y0lafw7mjdz03wxhfdb";
   };
 
-  buildInputs = [ pkgconfig ninja libevdev libev ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ ninja libevdev libev ];
 
   configurePhase = ''
     bash ./configure
diff --git a/pkgs/tools/system/lshw/default.nix b/pkgs/tools/system/lshw/default.nix
index a26237bc045..499f7c46154 100644
--- a/pkgs/tools/system/lshw/default.nix
+++ b/pkgs/tools/system/lshw/default.nix
@@ -19,14 +19,16 @@ stdenv.mkDerivation rec {
     sha256 = "147wyr5m185f8swsmb4q1ahs9r1rycapbpa2548aqbv298bbish3";
   })];
 
+  nativeBuildInputs = [ pkgconfig ];
+
+  buildInputs = lib.optionals withGUI [ gtk2 sqlite ];
+
   # Fix version info.
   preConfigure = ''
     sed -e "s/return \"unknown\"/return \"${version}\"/" \
         -i src/core/version.cc
   '';
 
-  buildInputs = lib.optionals withGUI [ gtk2 pkgconfig sqlite ];
-
   makeFlags = [ "PREFIX=$(out)" ];
 
   buildFlags = [ "all" ] ++ lib.optional withGUI "gui";
diff --git a/pkgs/tools/system/netdata/default.nix b/pkgs/tools/system/netdata/default.nix
index 236474343b4..ed177820b64 100644
--- a/pkgs/tools/system/netdata/default.nix
+++ b/pkgs/tools/system/netdata/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec{
     sha256 = "1fv01jnbgwbafsxavlji90zdqizn8m4nfg9ivc4sbi05j036bg6n";
   };
 
-  buildInputs = [ autoreconfHook zlib pkgconfig libuuid ];
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  buildInputs = [ zlib libuuid ];
 
   # Allow UI to load when running as non-root
   patches = [ ./web_access.patch ];
diff --git a/pkgs/tools/system/pciutils/default.nix b/pkgs/tools/system/pciutils/default.nix
index 8a4fe6cb3cf..7508b4fc56c 100644
--- a/pkgs/tools/system/pciutils/default.nix
+++ b/pkgs/tools/system/pciutils/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "1d62f8fa192f90e61c35a6fc15ff3cb9a7a792f782407acc42ef67817c5939f5";
   };
 
-  buildInputs = [ pkgconfig zlib kmod which ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ zlib kmod which ];
 
   makeFlags = "SHARED=yes PREFIX=\${out}";
 
diff --git a/pkgs/tools/system/proot/default.nix b/pkgs/tools/system/proot/default.nix
index 5d65267311f..640750b4f2d 100644
--- a/pkgs/tools/system/proot/default.nix
+++ b/pkgs/tools/system/proot/default.nix
@@ -1,4 +1,5 @@
-{ stdenv, fetchFromGitHub, talloc, docutils
+{ stdenv, fetchFromGitHub, fetchpatch
+, talloc, docutils
 , enableStatic ? false }:
 
 stdenv.mkDerivation rec {
@@ -17,6 +18,13 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  patches = [
+    (fetchpatch { # debian patch for aarch64 build
+      sha256 = "18milpzjkbfy5ab789ia3m4pyjyr9mfzbw6kbjhkj4vx9jc39svv";
+      url = "https://sources.debian.net/data/main/p/proot/5.1.0-1.2/debian/patches/arm64.patch";
+    })
+  ];
+
   preBuild = stdenv.lib.optionalString enableStatic ''
     export LDFLAGS="-static"
   '';
@@ -38,6 +46,6 @@ stdenv.mkDerivation rec {
     description = "User-space implementation of chroot, mount --bind and binfmt_misc";
     platforms = platforms.linux;
     license = licenses.gpl2;
-    maintainers = with maintainers; [ ianwookim nckx ];
+    maintainers = with maintainers; [ ianwookim nckx makefu ];
   };
 }
diff --git a/pkgs/tools/system/supervise/default.nix b/pkgs/tools/system/supervise/default.nix
new file mode 100644
index 00000000000..838663c3072
--- /dev/null
+++ b/pkgs/tools/system/supervise/default.nix
@@ -0,0 +1,27 @@
+{ stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+
+  name = "supervise-${version}";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "catern";
+    repo = "supervise";
+    rev = "v${version}";
+    sha256 = "1cjdxgns3gh2ir4kcmjdmc480w8sm49inws0ihhjmnisjy4100lg";
+  };
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp supervise unlinkwait -t $out/bin
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/catern/supervise;
+    description = "A minimal unprivileged process supervisor making use of modern Linux features";
+    platforms = platforms.linux;
+    license = licenses.gpl3;
+    maintainers = with stdenv.lib.maintainers; [ catern ];
+  };
+}
diff --git a/pkgs/tools/system/thermald/default.nix b/pkgs/tools/system/thermald/default.nix
index 7c81a028810..a3e90f32c0a 100644
--- a/pkgs/tools/system/thermald/default.nix
+++ b/pkgs/tools/system/thermald/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "1qzvmzkzdrmwrzfbxb2rz1i39j5zskjxiiv1w9m0xyg08p2wr7h3";
   };
 
-  buildInputs = [ autoconf automake libtool pkgconfig dbus_libs dbus_glib libxml2 ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ autoconf automake libtool dbus_libs dbus_glib libxml2 ];
 
   patchPhase = ''sed -e 's/upstartconfdir = \/etc\/init/upstartconfdir = $(out)\/etc\/init/' -i data/Makefile.am'';
 
diff --git a/pkgs/tools/system/vboot_reference/default.nix b/pkgs/tools/system/vboot_reference/default.nix
index a9a034ebde9..6dfc6d1349d 100644
--- a/pkgs/tools/system/vboot_reference/default.nix
+++ b/pkgs/tools/system/vboot_reference/default.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation rec {
     sha256 = "14d3a93ha5k4al4ib43nyn1ppx7kgb12xw6mkflhx8nxmx8827nc";
   };
 
-  buildInputs = [ pkgconfig openssl stdenv.cc.libc.static ]
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ openssl stdenv.cc.libc.static ]
     ++ stdenv.lib.optional (libuuid != null)
          (libuuid.overrideAttrs (attrs:
            { configureFlags = attrs.configureFlags ++ [ "--enable-static" ]; }));
diff --git a/pkgs/tools/system/wsmancli/default.nix b/pkgs/tools/system/wsmancli/default.nix
index c1c62718de2..bd6ec17ceec 100644
--- a/pkgs/tools/system/wsmancli/default.nix
+++ b/pkgs/tools/system/wsmancli/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "03ay6sa4ii8h6rr3l2qiqqml8xl6gplrlg4v2avdh9y6sihfyvvn";
   };
 
-  buildInputs = [ autoconf automake libtool pkgconfig openwsman openssl ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ autoconf automake libtool openwsman openssl ];
 
   preConfigure = ''
     ./bootstrap
diff --git a/pkgs/tools/text/ebook-tools/default.nix b/pkgs/tools/text/ebook-tools/default.nix
index e9abae3ac84..7dcd94e5363 100644
--- a/pkgs/tools/text/ebook-tools/default.nix
+++ b/pkgs/tools/text/ebook-tools/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "1bi7wsz3p5slb43kj7lgb3r6lb91lvb6ldi556k4y50ix6b5khyb";
   };
 
-  buildInputs = [ cmake pkgconfig libxml2 libzip ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ cmake libxml2 libzip ];
 
   preConfigure = 
     ''
diff --git a/pkgs/tools/text/qshowdiff/default.nix b/pkgs/tools/text/qshowdiff/default.nix
index 63759184ba4..761a498bcfb 100644
--- a/pkgs/tools/text/qshowdiff/default.nix
+++ b/pkgs/tools/text/qshowdiff/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "027959xbzvi5c2w9y1x122sr5i26k9mvp43banz2wln6gd860n1a";
   };
 
-  buildInputs = [ qt4 perl pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ qt4 perl ];
 
   configurePhase = ''
     mkdir -p $out/{bin,man/man1}
diff --git a/pkgs/tools/text/sift/default.nix b/pkgs/tools/text/sift/default.nix
index 1e688942a49..fd4cef27ba1 100644
--- a/pkgs/tools/text/sift/default.nix
+++ b/pkgs/tools/text/sift/default.nix
@@ -16,10 +16,6 @@ buildGoPackage rec {
 
   goDeps = ./deps.nix;
 
-  postInstall = lib.optionalString stdenv.isDarwin ''
-    install_name_tool -delete_rpath $out/lib -add_rpath $bin $bin/bin/sift
-  '';
-
   meta = with lib; {
     description = "sift is a fast and powerful alternative to grep";
     homepage = https://sift-tool.org;
diff --git a/pkgs/tools/text/silver-searcher/default.nix b/pkgs/tools/text/silver-searcher/default.nix
index 34aa0e9c7ed..156a8bd8f64 100644
--- a/pkgs/tools/text/silver-searcher/default.nix
+++ b/pkgs/tools/text/silver-searcher/default.nix
@@ -13,7 +13,8 @@ stdenv.mkDerivation rec {
 
   NIX_LDFLAGS = stdenv.lib.optionalString stdenv.isLinux "-lgcc_s";
 
-  buildInputs = [ autoreconfHook pkgconfig pcre zlib lzma ];
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  buildInputs = [ pcre zlib lzma ];
 
   meta = with stdenv.lib; {
     homepage = https://github.com/ggreer/the_silver_searcher/;
diff --git a/pkgs/tools/text/xml/xml2/default.nix b/pkgs/tools/text/xml/xml2/default.nix
index 203f0940990..e96644b6d3c 100644
--- a/pkgs/tools/text/xml/xml2/default.nix
+++ b/pkgs/tools/text/xml/xml2/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "01cps980m99y99cnmvydihga9zh3pvdsqag2fi1n6k2x7rfkl873";
   };
 
-  buildInputs = [ pkgconfig libxml2 ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libxml2 ];
 
   meta = with stdenv.lib; {
     homepage = http://ofb.net/~egnor/xml2/;
diff --git a/pkgs/tools/text/xml/xmlstarlet/default.nix b/pkgs/tools/text/xml/xmlstarlet/default.nix
index 5ad62cd7140..4fe6ad6b3dc 100644
--- a/pkgs/tools/text/xml/xmlstarlet/default.nix
+++ b/pkgs/tools/text/xml/xmlstarlet/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "1jp737nvfcf6wyb54fla868yrr39kcbijijmjpyk4lrpyg23in0m";
   };
 
-  buildInputs = [ pkgconfig libxml2 libxslt ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libxml2 libxslt ];
 
   preConfigure =
     ''
diff --git a/pkgs/tools/typesetting/hevea/default.nix b/pkgs/tools/typesetting/hevea/default.nix
index 0e87ef5dacc..ed6e741b3f9 100644
--- a/pkgs/tools/typesetting/hevea/default.nix
+++ b/pkgs/tools/typesetting/hevea/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, ocaml }:
+{ stdenv, fetchurl, ocamlPackages }:
 
 stdenv.mkDerivation rec {
   name = "hevea-2.29";
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
     sha256 = "1i7qkar6gjpsxqgdm90xxgp15z7gfyja0rn62n23a9aahc0hpgq6";
   };
 
-  buildInputs = [ ocaml ];
+  buildInputs = with ocamlPackages; [ ocaml ocamlbuild ];
 
   makeFlags = "PREFIX=$(out)";
 
@@ -17,6 +17,6 @@ stdenv.mkDerivation rec {
     homepage = http://pauillac.inria.fr/~maranget/hevea/;
     license = licenses.qpl;
     maintainers = with maintainers; [ pSub ];
-    platforms = with platforms; linux;
+    platforms = with platforms; unix;
   };
 }
diff --git a/pkgs/tools/typesetting/tex/texlive/bin.nix b/pkgs/tools/typesetting/tex/texlive/bin.nix
index c15f165013b..34a689ee9bd 100644
--- a/pkgs/tools/typesetting/tex/texlive/bin.nix
+++ b/pkgs/tools/typesetting/tex/texlive/bin.nix
@@ -61,8 +61,8 @@ core = stdenv.mkDerivation rec {
 
   outputs = [ "out" "doc" ];
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    pkgconfig
     /*teckit*/ zziplib poppler mpfr gmp
     pixman potrace gd freetype libpng libpaper zlib
     perl
@@ -156,6 +156,7 @@ core-big = stdenv.mkDerivation { #TODO: upmendex
 
   hardeningDisable = [ "format" ];
 
+  inherit (core) nativeBuildInputs;
   buildInputs = core.buildInputs ++ [ core cairo harfbuzz icu graphite2 ];
 
   configureFlags = common.configureFlags
@@ -209,7 +210,8 @@ dvisvgm = stdenv.mkDerivation {
 
   inherit (common) src;
 
-  buildInputs = [ pkgconfig core/*kpathsea*/ ghostscript zlib freetype potrace ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ core/*kpathsea*/ ghostscript zlib freetype potrace ];
 
   preConfigure = "cd texk/dvisvgm";
 
@@ -225,7 +227,8 @@ dvipng = stdenv.mkDerivation {
 
   inherit (common) src;
 
-  buildInputs = [ pkgconfig core/*kpathsea*/ zlib libpng freetype gd ghostscript makeWrapper ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ core/*kpathsea*/ zlib libpng freetype gd ghostscript makeWrapper ];
 
   preConfigure = "cd texk/dvipng";
 
@@ -247,7 +250,8 @@ bibtex8 = stdenv.mkDerivation {
 
   inherit (common) src;
 
-  buildInputs = [ pkgconfig core/*kpathsea*/ icu ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ core/*kpathsea*/ icu ];
 
   preConfigure = "cd texk/bibtex-x";
 
@@ -263,7 +267,8 @@ xdvi = stdenv.mkDerivation {
 
   inherit (common) src;
 
-  buildInputs = [ pkgconfig core/*kpathsea*/ freetype ghostscript ]
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ core/*kpathsea*/ freetype ghostscript ]
     ++ (with xorg; [ libX11 libXaw libXi libXpm libXmu libXaw libXext libXfixes ]);
 
   preConfigure = "cd texk/xdvik";
diff --git a/pkgs/tools/typesetting/xmlroff/default.nix b/pkgs/tools/typesetting/xmlroff/default.nix
index 05ce5057347..2177937221a 100644
--- a/pkgs/tools/typesetting/xmlroff/default.nix
+++ b/pkgs/tools/typesetting/xmlroff/default.nix
@@ -10,8 +10,8 @@ stdenv.mkDerivation rec {
     sha256 = "1sczn6xjczsfdxlbjqv4xqlki2a95y2s8ih2nl9v1vhqfk17fiww";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    pkgconfig
     autoconf
     automake
     libxml2
diff --git a/pkgs/tools/video/mjpegtools/default.nix b/pkgs/tools/video/mjpegtools/default.nix
index 3b02f0d3e2c..197caca0d86 100644
--- a/pkgs/tools/video/mjpegtools/default.nix
+++ b/pkgs/tools/video/mjpegtools/default.nix
@@ -17,7 +17,8 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "format" ];
 
-  buildInputs = [ libdv libjpeg libpng pkgconfig ]
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libdv libjpeg libpng ]
               ++ lib.optionals (!withMinimal) [ gtk2 libX11 SDL SDL_gfx ];
 
   NIX_CFLAGS_COMPILE = lib.optional (!withMinimal) "-I${SDL.dev}/include/SDL";
diff --git a/pkgs/tools/video/swfmill/default.nix b/pkgs/tools/video/swfmill/default.nix
index 0c8a34c5763..3832f3c3be0 100644
--- a/pkgs/tools/video/swfmill/default.nix
+++ b/pkgs/tools/video/swfmill/default.nix
@@ -13,7 +13,8 @@ stdenv.mkDerivation rec {
   # Fixes build with GCC 6
   NIX_CFLAGS_COMPILE = "-std=c++03";
 
-  buildInputs = [ pkgconfig libxslt freetype libpng libxml2 ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libxslt freetype libpng libxml2 ];
 
   meta = {
     description = "An xml2swf and swf2xml processor with import functionalities";
diff --git a/pkgs/tools/virtualization/awsebcli/default.nix b/pkgs/tools/virtualization/awsebcli/default.nix
index 91cb148d8fe..e43bc18ba70 100644
--- a/pkgs/tools/virtualization/awsebcli/default.nix
+++ b/pkgs/tools/virtualization/awsebcli/default.nix
@@ -67,11 +67,11 @@ let
 in with localPython.pkgs; buildPythonApplication rec {
   name = "${pname}-${version}";
   pname = "awsebcli";
-  version = "3.10.5";
+  version = "3.11.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1g53z2flhp3navdf8lw6rgh99akf3k0ng1zkkqswvh66zswkxnwn";
+    sha256 = "052388annhyirlzdr89hbgif8k7pw7win2zm1ybn4iiisr5l49zi";
   };
 
   checkInputs = [