diff --git a/nixos/modules/misc/nixpkgs.nix b/nixos/modules/misc/nixpkgs.nix
index b01f5431909..c3e7ab9a666 100644
--- a/nixos/modules/misc/nixpkgs.nix
+++ b/nixos/modules/misc/nixpkgs.nix
@@ -69,7 +69,6 @@ in
           [ (self: super: {
               openssh = super.openssh.override {
                 hpnSupport = true;
-                withKerberos = true;
                 kerberos = self.libkrb5;
               };
             };
diff --git a/pkgs/applications/science/logic/lean/default.nix b/pkgs/applications/science/logic/lean/default.nix
index b3f0b325927..095aa5a7f8c 100644
--- a/pkgs/applications/science/logic/lean/default.nix
+++ b/pkgs/applications/science/logic/lean/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "0irh9b4haz0pzzxrb4hwcss91a0xb499kjrcrmr2s59p3zq8bbd9";
   };
 
-  buildInputs = [ gmp cmake ];
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ gmp ];
   enableParallelBuilding = true;
 
   preConfigure = ''
diff --git a/pkgs/applications/window-managers/awesome/default.nix b/pkgs/applications/window-managers/awesome/default.nix
index ca596cdfddc..2808c8552ef 100644
--- a/pkgs/applications/window-managers/awesome/default.nix
+++ b/pkgs/applications/window-managers/awesome/default.nix
@@ -41,7 +41,6 @@ with luaPackages; stdenv.mkDerivation rec {
   #cmakeFlags = "-DGENERATE_MANPAGES=ON";
   cmakeFlags = "-DOVERRIDE_VERSION=${version}";
 
-  LD_LIBRARY_PATH = "${stdenv.lib.makeLibraryPath [ cairo pango gobjectIntrospection ]}";
   GI_TYPELIB_PATH = "${pango.out}/lib/girepository-1.0";
   LUA_CPATH = "${lgi}/lib/lua/${lua.luaversion}/?.so";
   LUA_PATH  = "${lgi}/share/lua/${lua.luaversion}/?.lua;${lgi}/share/lua/${lua.luaversion}/lgi/?.lua";
@@ -52,7 +51,6 @@ with luaPackages; stdenv.mkDerivation rec {
       --add-flags '--search ${lgi}/lib/lua/${lua.luaversion}' \
       --add-flags '--search ${lgi}/share/lua/${lua.luaversion}' \
       --prefix GI_TYPELIB_PATH : "$GI_TYPELIB_PATH" \
-      --prefix LD_LIBRARY_PATH : "$LD_LIBRARY_PATH" \
       --prefix PATH : "${stdenv.lib.makeBinPath [ compton unclutter procps iproute coreutils curl alsaUtils findutils xterm ]}"
 
     wrapProgram $out/bin/awesome-client \
diff --git a/pkgs/build-support/setup-hooks/patch-shebangs.sh b/pkgs/build-support/setup-hooks/patch-shebangs.sh
index 4317a5f4dad..1433d1e1f14 100644
--- a/pkgs/build-support/setup-hooks/patch-shebangs.sh
+++ b/pkgs/build-support/setup-hooks/patch-shebangs.sh
@@ -54,7 +54,11 @@ patchShebangs() {
                 echo "$f: interpreter directive changed from \"$oldInterpreterLine\" to \"$newInterpreterLine\""
                 # escape the escape chars so that sed doesn't interpret them
                 escapedInterpreterLine=$(echo "$newInterpreterLine" | sed 's|\\|\\\\|g')
+                # Preserve times, see: https://github.com/NixOS/nixpkgs/pull/33281
+                touch -r "$f" "$f.timestamp"
                 sed -i -e "1 s|.*|#\!$escapedInterpreterLine|" "$f"
+                touch -r "$f.timestamp" "$f"
+                rm "$f.timestamp"
             fi
         fi
     done
diff --git a/pkgs/data/sgml+xml/stylesheets/xslt/docbook-xsl/default.nix b/pkgs/data/sgml+xml/stylesheets/xslt/docbook-xsl/default.nix
index dac9d27f66c..e965882a9c3 100644
--- a/pkgs/data/sgml+xml/stylesheets/xslt/docbook-xsl/default.nix
+++ b/pkgs/data/sgml+xml/stylesheets/xslt/docbook-xsl/default.nix
@@ -1,8 +1,8 @@
-{ lib, stdenv, fetchurl, findXMLCatalogs, writeScriptBin, ruby, bash }:
+{ lib, stdenv, fetchurl, fetchpatch, findXMLCatalogs, writeScriptBin, ruby, bash }:
 
 let
 
-  common = { pname, sha256 }: let self = stdenv.mkDerivation rec {
+  common = { pname, sha256, patches ? [] }: let self = stdenv.mkDerivation rec {
     name = "${pname}-1.79.1";
 
     src = fetchurl {
@@ -10,6 +10,8 @@ let
       inherit sha256;
     };
 
+    inherit patches;
+
     propagatedBuildInputs = [ findXMLCatalogs ];
 
     dontBuild = true;
@@ -44,6 +46,15 @@ in {
   docbook_xsl = common {
     pname = "docbook-xsl";
     sha256 = "0s59lihif2fr7rznckxr2kfyrvkirv76r1zvidp9b5mj28p4apvj";
+
+    patches = [(fetchpatch {
+      name = "potential-infinite-template-recursion.patch";
+      url = "https://src.fedoraproject.org/cgit/rpms/docbook-style-xsl.git/"
+          + "plain/docbook-style-xsl-non-recursive-string-subst.patch?id=bf9e5d16fd";
+      sha256 = "1pfb468bsj3j879ip0950waih0r1s6rzfbm2p70glbz0g3903p7h";
+      stripLen = "1";
+    })];
+
   };
 
   docbook_xsl_ns = common {
diff --git a/pkgs/desktops/plasma-5/kwin/default.nix b/pkgs/desktops/plasma-5/kwin/default.nix
index 289d5a812f7..8b8a5fe72ea 100644
--- a/pkgs/desktops/plasma-5/kwin/default.nix
+++ b/pkgs/desktops/plasma-5/kwin/default.nix
@@ -1,5 +1,5 @@
 {
-  mkDerivation, lib, copyPathsToStore,
+  mkDerivation, lib, copyPathsToStore, fetchpatch,
   extra-cmake-modules, kdoctools,
 
   epoxy,libICE, libSM, libinput, libxkbcommon, udev, wayland, xcb-util-cursor,
@@ -29,7 +29,14 @@ mkDerivation {
     kwayland kwidgetsaddons kwindowsystem kxmlgui plasma-framework
   ];
   outputs = [ "bin" "dev" "out" ];
-  patches = copyPathsToStore (lib.readPathsFromFile ./. ./series);
+  patches = copyPathsToStore (lib.readPathsFromFile ./. ./series)
+    ++ [(fetchpatch {
+        name = "cmake-3.10.diff";
+        # included upstream for kwin >= 5.11.95
+        url = "https://github.com/KDE/kwin/commit/cd544890ced4192.diff";
+        sha256 = "0z5nbcg712v10mskb7r9v0jcx5h8q4ixb7fjbb0kicmzsc266yd5";
+    })]
+    ;
   CXXFLAGS = [
     ''-DNIXPKGS_XWAYLAND=\"${lib.getBin xwayland}/bin/Xwayland\"''
   ];
diff --git a/pkgs/development/compilers/llvm/4/clang/default.nix b/pkgs/development/compilers/llvm/4/clang/default.nix
index a2ba1fe7f4c..77863ab4f1e 100644
--- a/pkgs/development/compilers/llvm/4/clang/default.nix
+++ b/pkgs/development/compilers/llvm/4/clang/default.nix
@@ -37,9 +37,6 @@ let
 
     patches = [ ./purity.patch ];
 
-    # XXX: TODO: This should be removed on next rebuild
-    postBuild = "";
-
     postPatch = ''
       sed -i -e 's/Args.hasArg(options::OPT_nostdlibinc)/true/' lib/Driver/Tools.cpp
       sed -i -e 's/DriverArgs.hasArg(options::OPT_nostdlibinc)/true/' lib/Driver/ToolChains.cpp
diff --git a/pkgs/development/compilers/llvm/4/llvm.nix b/pkgs/development/compilers/llvm/4/llvm.nix
index 711024c7d3c..17a25889e64 100644
--- a/pkgs/development/compilers/llvm/4/llvm.nix
+++ b/pkgs/development/compilers/llvm/4/llvm.nix
@@ -1,8 +1,6 @@
 { stdenv
 , fetch
 , fetchpatch
-, perl
-, groff
 , cmake
 , python
 , libffi
@@ -41,7 +39,7 @@ in stdenv.mkDerivation (rec {
   outputs = [ "out" ]
     ++ stdenv.lib.optional enableSharedLibraries "lib";
 
-  nativeBuildInputs = [ perl groff cmake python ]
+  nativeBuildInputs = [ cmake python ]
     ++ stdenv.lib.optional enableManpages python.pkgs.sphinx;
 
   buildInputs = [ libxml2 libffi ]
diff --git a/pkgs/development/compilers/llvm/5/clang/default.nix b/pkgs/development/compilers/llvm/5/clang/default.nix
index 0ee1404484b..c8eafce4e39 100644
--- a/pkgs/development/compilers/llvm/5/clang/default.nix
+++ b/pkgs/development/compilers/llvm/5/clang/default.nix
@@ -37,9 +37,6 @@ let
 
     patches = [ ./purity.patch ];
 
-    # XXX: TODO: This should be removed on next rebuild
-    postBuild = "";
-
     postPatch = ''
       sed -i -e 's/DriverArgs.hasArg(options::OPT_nostdlibinc)/true/' \
              -e 's/Args.hasArg(options::OPT_nostdlibinc)/true/' \
diff --git a/pkgs/development/compilers/llvm/5/llvm.nix b/pkgs/development/compilers/llvm/5/llvm.nix
index 400ffa34117..1f55e6c54e7 100644
--- a/pkgs/development/compilers/llvm/5/llvm.nix
+++ b/pkgs/development/compilers/llvm/5/llvm.nix
@@ -1,8 +1,6 @@
 { stdenv
 , fetch
 , fetchpatch
-, perl
-, groff
 , cmake
 , python
 , libffi
@@ -41,7 +39,7 @@ in stdenv.mkDerivation (rec {
   outputs = [ "out" ]
     ++ stdenv.lib.optional enableSharedLibraries "lib";
 
-  nativeBuildInputs = [ perl groff cmake python ]
+  nativeBuildInputs = [ cmake python ]
     ++ stdenv.lib.optional enableManpages python.pkgs.sphinx;
 
   buildInputs = [ libxml2 libffi ]
diff --git a/pkgs/development/libraries/aspell/default.nix b/pkgs/development/libraries/aspell/default.nix
index 0f6f5e8dd14..cccd93e5d4d 100644
--- a/pkgs/development/libraries/aspell/default.nix
+++ b/pkgs/development/libraries/aspell/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
     patch -p1 < ${./data-dirs-from-nix-profiles.patch}
   '';
 
-  buildInputs = [ perl ];
+  nativeBuildInputs = [ perl ];
 
   doCheck = true;
 
diff --git a/pkgs/development/libraries/glib/default.nix b/pkgs/development/libraries/glib/default.nix
index 325a6e5bfa9..f68bd138005 100644
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@@ -43,7 +43,7 @@ let
   '';
 
   ver_maj = "2.54";
-  ver_min = "2";
+  ver_min = "3";
 in
 
 stdenv.mkDerivation rec {
@@ -51,7 +51,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/glib/${ver_maj}/${name}.tar.xz";
-    sha256 = "bb89e5c5aad33169a8c7f28b45671c7899c12f74caf707737f784d7102758e6c";
+    sha256 = "963fdc6685dc3da8e5381dfb9f15ca4b5709b28be84d9d05a9bb8e446abac0a8";
   };
 
   patches = optional stdenv.isDarwin ./darwin-compilation.patch
@@ -75,8 +75,15 @@ stdenv.mkDerivation rec {
   # internal pcre would only add <200kB, but it's relatively common
   configureFlags = [ "--with-pcre=system" ]
     ++ optional stdenv.isDarwin "--disable-compile-warnings"
-    ++ optional (stdenv.isFreeBSD || stdenv.isSunOS) "--with-libiconv=gnu"
-    ++ optional stdenv.isSunOS "--disable-dtrace";
+    # glibc inclues GNU libiconv, but Darwin's iconv function is good enonugh.
+    ++ optional (stdenv.hostPlatform.libc != "glibc" && !stdenv.hostPlatform.isDarwin)
+      "--with-libiconv=gnu"
+    ++ optional stdenv.isSunOS "--disable-dtrace"
+    # Can't run this test when cross-compiling
+    ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform)
+       [ "glib_cv_stack_grows=no" "glib_cv_uscore=no" ]
+    # GElf only supports elf64 hosts
+    ++ optional (!stdenv.hostPlatform.is64bit) "--disable-libelf";
 
   NIX_CFLAGS_COMPILE = optional stdenv.isDarwin "-lintl"
     ++ optional stdenv.isSunOS "-DBSD_COMP";
diff --git a/pkgs/development/libraries/gnutls/3.6.nix b/pkgs/development/libraries/gnutls/3.6.nix
index 9dc6d5389d9..35344dfde7d 100644
--- a/pkgs/development/libraries/gnutls/3.6.nix
+++ b/pkgs/development/libraries/gnutls/3.6.nix
@@ -11,9 +11,10 @@ callPackage ./generic.nix (args // rec {
   # Skip two tests introduced in 3.5.11.  Probable reasons of failure:
   #  - pkgconfig: building against the result won't work before installing
   #  - trust-store: default trust store path (/etc/ssl/...) is missing in sandbox
+  # Change p11-kit test to use pkg-config to find p11-kit
   postPatch = ''
     sed '2iexit 77' -i tests/pkgconfig.sh
     sed '/^void doit(void)/,$s/{/{ exit(77);/; t' -i tests/trust-store.c
-    # TODO: remove just this line on some rebuild
+    sed 's:/usr/lib64/pkcs11/ /usr/lib/pkcs11/ /usr/lib/x86_64-linux-gnu/pkcs11/:`pkg-config --variable=p11_module_path p11-kit-1`:' -i tests/p11-kit-trust.sh
   '';
 })
diff --git a/pkgs/development/libraries/gobject-introspection/absolute_gir_path.patch b/pkgs/development/libraries/gobject-introspection/absolute_gir_path.patch
new file mode 100644
index 00000000000..f7e1bedd3e1
--- /dev/null
+++ b/pkgs/development/libraries/gobject-introspection/absolute_gir_path.patch
@@ -0,0 +1,11 @@
+--- a/gir/cairo-1.0.gir.in
++++ b/gir/cairo-1.0.gir.in
+@@ -5,7 +5,7 @@
+             xmlns:glib="http://www.gtk.org/introspection/glib/1.0">
+   <package name="%CAIRO_GIR_PACKAGE%"/>
+   <namespace name="cairo" version="1.0"
+-	     shared-library="%CAIRO_SHARED_LIBRARY%"
++	     shared-library="@cairoLib@/%CAIRO_SHARED_LIBRARY%"
+ 	     c:identifier-prefixes="cairo"
+ 	     c:symbol-prefixes="cairo">
+     <record name="Context" c:type="cairo_t" foreign="1"
diff --git a/pkgs/development/libraries/gobject-introspection/default.nix b/pkgs/development/libraries/gobject-introspection/default.nix
index f629b9a8a3c..870f77686b3 100644
--- a/pkgs/development/libraries/gobject-introspection/default.nix
+++ b/pkgs/development/libraries/gobject-introspection/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, glib, flex, bison, pkgconfig, libffi, python
-, libintlOrEmpty, cctools
+, libintlOrEmpty, cctools, cairo
 , substituteAll, nixStoreDir ? builtins.storeDir
 }:
 # now that gobjectIntrospection creates large .gir files (eg gtk3 case)
@@ -38,10 +38,17 @@ stdenv.mkDerivation rec {
 
   setupHook = ./setup-hook.sh;
 
-  patches = stdenv.lib.singleton (substituteAll {
-    src = ./absolute_shlib_path.patch;
-    inherit nixStoreDir;
-  });
+  patches = [
+    (substituteAll {
+      src = ./absolute_shlib_path.patch;
+      inherit nixStoreDir;
+    })
+    # https://github.com/NixOS/nixpkgs/issues/34080
+    (substituteAll {
+      src = ./absolute_gir_path.patch;
+      cairoLib = "${getLib cairo}/lib";
+    })
+  ];
 
   meta = with stdenv.lib; {
     description = "A middleware layer between C libraries and language bindings";
diff --git a/pkgs/development/libraries/gtk+/2.x.nix b/pkgs/development/libraries/gtk+/2.x.nix
index 169fd119d51..8a3ce884dfd 100644
--- a/pkgs/development/libraries/gtk+/2.x.nix
+++ b/pkgs/development/libraries/gtk+/2.x.nix
@@ -12,11 +12,11 @@ assert cupsSupport -> cups != null;
 with stdenv.lib;
 
 stdenv.mkDerivation rec {
-  name = "gtk+-2.24.31";
+  name = "gtk+-2.24.32";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gtk+/2.24/${name}.tar.xz";
-    sha256 = "68c1922732c7efc08df4656a5366dcc3afdc8791513400dac276009b40954658";
+    sha256 = "b6c8a93ddda5eabe3bfee1eb39636c9a03d2a56c7b62828b359bf197943c582e";
   };
 
   outputs = [ "out" "dev" "devdoc" ];
diff --git a/pkgs/development/libraries/icu/base.nix b/pkgs/development/libraries/icu/base.nix
index 8a7cf8365a5..6d9a9725cc2 100644
--- a/pkgs/development/libraries/icu/base.nix
+++ b/pkgs/development/libraries/icu/base.nix
@@ -34,6 +34,9 @@ stdenv.mkDerivation {
 
   preConfigure = ''
     sed -i -e "s|/bin/sh|${stdenv.shell}|" configure
+
+    # $(includedir) is different from $(prefix)/include due to multiple outputs
+    sed -i -e 's|^\(CPPFLAGS = .*\) -I\$(prefix)/include|\1 -I$(includedir)|' config/Makefile.inc.in
   '' + stdenv.lib.optionalString stdenv.isArm ''
     # From https://archlinuxarm.org/packages/armv7h/icu/files/icudata-stdlibs.patch
     sed -e 's/LDFLAGSICUDT=-nodefaultlibs -nostdlib/LDFLAGSICUDT=/' -i config/mh-linux
@@ -45,6 +48,9 @@ stdenv.mkDerivation {
   # remove dependency on bootstrap-tools in early stdenv build
   postInstall = stdenv.lib.optionalString stdenv.isDarwin ''
     sed -i 's/INSTALL_CMD=.*install/INSTALL_CMD=install/' $out/lib/icu/${version}/pkgdata.inc
+  '' + ''
+    substituteInPlace "$dev/bin/icu-config" \
+      --replace \''${pkglibdir}/Makefile.inc "$dev/lib/icu/Makefile.inc"
   '';
 
   postFixup = ''moveToOutput lib/icu "$dev" '';
diff --git a/pkgs/development/libraries/libdaemon/default.nix b/pkgs/development/libraries/libdaemon/default.nix
index 07d5b77efc4..af832a70a73 100644
--- a/pkgs/development/libraries/libdaemon/default.nix
+++ b/pkgs/development/libraries/libdaemon/default.nix
@@ -8,7 +8,11 @@ stdenv.mkDerivation rec {
     sha256 = "0d5qlq5ab95wh1xc87rqrh1vx6i8lddka1w3f1zcqvcqdxgyn8zx";
   };
 
-  configureFlags = [ "--disable-lynx" ];
+  configureFlags = [ "--disable-lynx" ]
+    ++ stdenv.lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
+    [ # Can't run this test while cross-compiling
+      "ac_cv_func_setpgrp_void=yes"
+    ];
 
   meta = {
     description = "Lightweight C library that eases the writing of UNIX daemons";
diff --git a/pkgs/development/libraries/libedit/default.nix b/pkgs/development/libraries/libedit/default.nix
index c61876713c1..bd230c61028 100644
--- a/pkgs/development/libraries/libedit/default.nix
+++ b/pkgs/development/libraries/libedit/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
   outputs = [ "out" "dev" ];
 
   # Have `configure' avoid `/usr/bin/nroff' in non-chroot builds.
-  NROFF = "${groff}/bin/nroff";
+  # NROFF = "${groff}/bin/nroff";
 
   patches = [ ./01-cygwin.patch ];
 
diff --git a/pkgs/development/libraries/libgpg-error/default.nix b/pkgs/development/libraries/libgpg-error/default.nix
index 56bf9b177b5..9faf7a40458 100644
--- a/pkgs/development/libraries/libgpg-error/default.nix
+++ b/pkgs/development/libraries/libgpg-error/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, gettext }:
+{ stdenv, buildPackages, fetchurl, gettext }:
 
 stdenv.mkDerivation rec {
   name = "libgpg-error-${version}";
@@ -16,7 +16,8 @@ stdenv.mkDerivation rec {
 
   # If architecture-dependent MO files aren't available, they're generated
   # during build, so we need gettext for cross-builds.
-  crossAttrs.buildInputs = [ gettext ];
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
+  nativeBuildInputs = [ gettext ];
 
   postConfigure =
     stdenv.lib.optionalString stdenv.isSunOS
@@ -27,7 +28,7 @@ stdenv.mkDerivation rec {
     # Thus, re-run it with Bash.
       "${stdenv.shell} config.status";
 
-  doCheck = true;
+  doCheck = true; # not cross
 
   meta = with stdenv.lib; {
     homepage = https://www.gnupg.org/related_software/libgpg-error/index.html;
@@ -45,4 +46,3 @@ stdenv.mkDerivation rec {
     maintainers = [ maintainers.fuuzetsu maintainers.vrthra ];
   };
 }
-
diff --git a/pkgs/development/libraries/libinput/default.nix b/pkgs/development/libraries/libinput/default.nix
index a0f7807786e..dc88df31fbf 100644
--- a/pkgs/development/libraries/libinput/default.nix
+++ b/pkgs/development/libraries/libinput/default.nix
@@ -16,11 +16,11 @@ in
 with stdenv.lib;
 stdenv.mkDerivation rec {
   name = "libinput-${version}";
-  version = "1.9.3";
+  version = "1.9.4";
 
   src = fetchurl {
     url = "http://www.freedesktop.org/software/libinput/${name}.tar.xz";
-    sha256 = "09wkc5qqk1k2a68cwfy4x853z8z35wf2qkijh66kacsvc2fjq394";
+    sha256 = "142icwzpirwddl7ghfmynxpnsbjg53rjxpzv4arjsaiw9r6bvk8b";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/libogg/default.nix b/pkgs/development/libraries/libogg/default.nix
index c5cb85d91ba..8bf62890fac 100644
--- a/pkgs/development/libraries/libogg/default.nix
+++ b/pkgs/development/libraries/libogg/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "libogg-1.3.2";
+  name = "libogg-1.3.3";
 
   src = fetchurl {
     url = "http://downloads.xiph.org/releases/ogg/${name}.tar.xz";
-    sha256 = "16z74q422jmprhyvy7c9x909li8cqzmvzyr8cgbm52xcsp6pqs1z";
+    sha256 = "022wjlzn8fx7mfby4pcgyjwx8zir7jr7cizichh3jgaki8bwcgsg";
   };
 
   outputs = [ "out" "dev" "doc" ];
diff --git a/pkgs/development/libraries/libomxil-bellagio/default.nix b/pkgs/development/libraries/libomxil-bellagio/default.nix
index 5140402eacb..28c8a915c63 100644
--- a/pkgs/development/libraries/libomxil-bellagio/default.nix
+++ b/pkgs/development/libraries/libomxil-bellagio/default.nix
@@ -8,7 +8,10 @@ stdenv.mkDerivation rec {
     url = "mirror://sourceforge/omxil/omxil/Bellagio%20${version}/${name}.tar.gz";
     sha256 = "0k6p6h4npn8p1qlgq6z3jbfld6n1bqswzvxzndki937gr0lhfg2r";
   };
-  
+
+  configureFlags =
+    stdenv.lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [ "ac_cv_func_malloc_0_nonnull=yes" ];
+
   patches = [ ./fedora-fixes.patch ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/libraries/libseccomp/default.nix b/pkgs/development/libraries/libseccomp/default.nix
index 3b365c0e971..023c51c2b14 100644
--- a/pkgs/development/libraries/libseccomp/default.nix
+++ b/pkgs/development/libraries/libseccomp/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "libseccomp-${version}";
-  version = "2.3.2";
+  version = "2.3.3";
 
   src = fetchurl {
     url = "https://github.com/seccomp/libseccomp/releases/download/v${version}/libseccomp-${version}.tar.gz";
-    sha256 = "3ddc8c037956c0a5ac19664ece4194743f59e1ccd4adde848f4f0dae7f77bca1";
+    sha256 = "0mdiyfljrkfl50q1m3ws8yfcyfjwf1zgkvcva8ffcwncji18zhkz";
   };
 
   buildInputs = [ getopt makeWrapper ];
diff --git a/pkgs/development/libraries/libtiff/default.nix b/pkgs/development/libraries/libtiff/default.nix
index 0f95b6d34c7..ab1bda9ed29 100644
--- a/pkgs/development/libraries/libtiff/default.nix
+++ b/pkgs/development/libraries/libtiff/default.nix
@@ -1,20 +1,20 @@
 { stdenv, fetchurl, fetchpatch, pkgconfig, zlib, libjpeg, xz }:
 
 let
-  version = "4.0.8";
+  version = "4.0.9";
 in
 stdenv.mkDerivation rec {
   name = "libtiff-${version}";
 
   src = fetchurl {
     url = "http://download.osgeo.org/libtiff/tiff-${version}.tar.gz";
-    sha256 = "0419mh6kkhz5fkyl77gv0in8x4d2jpdpfs147y8mj86rrjlabmsr";
+    sha256 = "1kfg4q01r4mqn7dj63ifhi6pmqzbf4xax6ni6kkk81ri5kndwyvf";
   };
 
-  prePatch =let
+  prePatch = let
       debian = fetchurl {
-        url = http://snapshot.debian.org/archive/debian-debug/20170928T093547Z/pool/main/t/tiff/tiff_4.0.8-5.debian.tar.xz;
-        sha256 = "11qkiliw04dmdvdd5z2lv5hh2fiwa29qbhkxvlvmb4yslnmyywha";
+        url = http://snapshot.debian.org/archive/debian-debug/20180128T155203Z//pool/main/t/tiff/tiff_4.0.9-3.debian.tar.xz;
+        sha256 = "0wya42y7kcq093g3h7ca10cm5sns1mgnkjmdd2qdi59v8arga4y4";
       };
     in ''
       tar xf '${debian}'
diff --git a/pkgs/development/libraries/libwebp/default.nix b/pkgs/development/libraries/libwebp/default.nix
index 673cd7abe7d..79a5bef30fc 100644
--- a/pkgs/development/libraries/libwebp/default.nix
+++ b/pkgs/development/libraries/libwebp/default.nix
@@ -27,11 +27,11 @@ in
 with stdenv.lib;
 stdenv.mkDerivation rec {
   name = "libwebp-${version}";
-  version = "0.6.0";
+  version = "0.6.1";
 
   src = fetchurl {
     url = "http://downloads.webmproject.org/releases/webp/${name}.tar.gz";
-    sha256 = "0h1brwkyxc7lb8lc53aacdks5vc1y9hzngqi41gg7y6l56912a69";
+    sha256 = "1ayq2zq0zbgf5yizbm32zh7p1vb8kibw74am6am1n5cz5mw3ql06";
   };
 
   configureFlags = [
diff --git a/pkgs/development/libraries/libxslt/default.nix b/pkgs/development/libraries/libxslt/default.nix
index 2f913093873..1bb90ee195d 100644
--- a/pkgs/development/libraries/libxslt/default.nix
+++ b/pkgs/development/libraries/libxslt/default.nix
@@ -11,22 +11,15 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   pname = "libxslt";
-  version = "1.1.29";
+  version = "1.1.32";
   name = pname + "-" + version;
 
   src = fetchurl {
     url = "http://xmlsoft.org/sources/${name}.tar.gz";
-    sha256 = "1klh81xbm9ppzgqk339097i39b7fnpmlj8lzn8bpczl3aww6x5xm";
+    sha256 = "0q2l6m56iv3ysxgm2walhg4c9wp7q183jb328687i9zlp85csvjj";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "CVE-2017-5029";
-      url = "https://git.gnome.org/browse/libxslt/"
-        + "patch/?id=08ab2774b870de1c7b5a48693df75e8154addae5";
-      sha256 = "10azfmyffjf9d7b5js4ipxw9f20qi0kw3zq34bpqmbcpq3l338ky";
-    })
-  ] ++ stdenv.lib.optional stdenv.isSunOS ./patch-ah.patch;
+  patches = stdenv.lib.optional stdenv.isSunOS ./patch-ah.patch;
 
   # fixes: can't build x86_64-unknown-cygwin shared library unless -no-undefined is specified
   postPatch = optionalString hostPlatform.isCygwin ''
@@ -40,12 +33,13 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = [ findXMLCatalogs ];
 
-  # TODO move cryptoSupport as last flag, when upgrading libxslt
-  configureFlags = optional (!cryptoSupport) "--without-crypto" ++ [
+  configureFlags = [
+    "--with-libxml-prefix=${libxml2.dev}"
     "--without-debug"
     "--without-mem-debug"
     "--without-debugger"
-  ] ++ optional pythonSupport "--with-python=${python2}";
+  ] ++ optional pythonSupport "--with-python=${python2}"
+    ++ optional (!cryptoSupport) "--without-crypto";
 
   postFixup = ''
     moveToOutput bin/xslt-config "$dev"
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index d343bd1112d..8df248e3e46 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -66,7 +66,7 @@ let
 in
 
 let
-  version = "17.2.8";
+  version = "17.3.3";
   branch  = head (splitString "." version);
   driverLink = "/run/opengl-driver" + optionalString stdenv.isi686 "-32";
 in
@@ -81,7 +81,7 @@ stdenv.mkDerivation {
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
       "https://mesa.freedesktop.org/archive/mesa-${version}.tar.xz"
     ];
-    sha256 = "0pq9kmmyllgd63d936f3x1zsg7sqaswx47khbn0gvbgari2h753f";
+    sha256 = "16rpm4rwmzd4kdgipa1gw262jqg3346gih0y3bsc3bgn1vgcbfj1";
   };
 
   prePatch = "patchShebangs .";
@@ -134,7 +134,7 @@ stdenv.mkDerivation {
     "--enable-shared-glapi"
     "--enable-sysfs"
     "--enable-llvm-shared-libs"
-    "--enable-omx"
+    "--enable-omx-bellagio"
     "--enable-va"
     "--disable-opencl"
   ];
diff --git a/pkgs/development/libraries/p11-kit/default.nix b/pkgs/development/libraries/p11-kit/default.nix
index 34182cd5a84..c5c14ed3b85 100644
--- a/pkgs/development/libraries/p11-kit/default.nix
+++ b/pkgs/development/libraries/p11-kit/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   name = "p11-kit-${version}";
-  version = "0.23.7";
+  version = "0.23.9";
 
   src = fetchFromGitHub {
     owner = "p11-glue";
     repo = "p11-kit";
     rev = version;
-    sha256 = "1l8sg0g74k2mk0y6vz19hc103dzizxa0h579gdhvxifckglb01hy";
+    sha256 = "0lyv6m2jflvs23m0i6l64d470p5a315lz6vs4bflsqv8i1zrrcsh";
   };
 
   outputs = [ "out" "dev"];
diff --git a/pkgs/development/python-modules/backports_functools_lru_cache/default.nix b/pkgs/development/python-modules/backports_functools_lru_cache/default.nix
index 2442e132f1b..0def8a2de2a 100644
--- a/pkgs/development/python-modules/backports_functools_lru_cache/default.nix
+++ b/pkgs/development/python-modules/backports_functools_lru_cache/default.nix
@@ -2,9 +2,10 @@
 , buildPythonPackage
 , fetchPypi
 , setuptools_scm
+, pythonOlder
 }:
 
-buildPythonPackage rec {
+if !(pythonOlder "3.3") then null else buildPythonPackage rec {
   pname = "backports.functools_lru_cache";
   version = "1.4";
 
diff --git a/pkgs/development/python-modules/backports_lzma/default.nix b/pkgs/development/python-modules/backports_lzma/default.nix
index 6f7a45a4fe8..a0643e82ae0 100644
--- a/pkgs/development/python-modules/backports_lzma/default.nix
+++ b/pkgs/development/python-modules/backports_lzma/default.nix
@@ -4,9 +4,10 @@
 , isPy3k
 , lzma
 , python
+, pythonOlder
 }:
 
-buildPythonPackage rec {
+if !(pythonOlder "3.3") then null else buildPythonPackage rec {
   pname = "backports.lzma";
   version = "0.0.9";
 
diff --git a/pkgs/development/python-modules/bootstrapped-pip/default.nix b/pkgs/development/python-modules/bootstrapped-pip/default.nix
index 88209ad3fd1..37c3ea5d72a 100644
--- a/pkgs/development/python-modules/bootstrapped-pip/default.nix
+++ b/pkgs/development/python-modules/bootstrapped-pip/default.nix
@@ -46,7 +46,8 @@ in stdenv.mkDerivation rec {
     mkdir -p $out/bin
   '';
 
-  buildInputs = [ python makeWrapper unzip ];
+  nativeBuildInputs = [ makeWrapper unzip ];
+  buildInputs = [ python ];
 
   installPhase = ''
 
diff --git a/pkgs/development/python-modules/matplotlib/default.nix b/pkgs/development/python-modules/matplotlib/default.nix
index 33505b5f618..49bdfa8dc08 100644
--- a/pkgs/development/python-modules/matplotlib/default.nix
+++ b/pkgs/development/python-modules/matplotlib/default.nix
@@ -8,6 +8,7 @@
 , enableQt ? false, pyqt4
 , libcxx
 , Cocoa
+, pythonOlder
 }:
 
 assert enableGhostscript -> ghostscript != null;
@@ -39,8 +40,8 @@ buildPythonPackage rec {
 
   propagatedBuildInputs =
     [ cycler dateutil nose numpy pyparsing tornado freetype
-      libpng pkgconfig mock pytz backports_functools_lru_cache
-    ]
+      libpng pkgconfig mock pytz ]
+    ++ stdenv.lib.optional (pythonOlder "3.3") backports_functools_lru_cache
     ++ stdenv.lib.optional enableGtk2 pygtk
     ++ stdenv.lib.optionals enableGtk3 [ cairo pycairo gtk3 gobjectIntrospection pygobject3 ]
     ++ stdenv.lib.optionals enableTk [ tcl tk tkinter libX11 ]
diff --git a/pkgs/development/python-modules/setuptools/default.nix b/pkgs/development/python-modules/setuptools/default.nix
index 5535a80fd4a..b8fd011c4ea 100644
--- a/pkgs/development/python-modules/setuptools/default.nix
+++ b/pkgs/development/python-modules/setuptools/default.nix
@@ -17,7 +17,8 @@ stdenv.mkDerivation rec {
     sha256 = "6501fc32f505ec5b3ed36ec65ba48f1b975f52cf2ea101c7b73a08583fd12f75";
   };
 
-  buildInputs = [ python wrapPython unzip ];
+  nativeBuildInputs = [ unzip wrapPython ];
+  buildInputs = [ python ];
   doCheck = false;  # requires pytest
   installPhase = ''
       dst=$out/${python.sitePackages}
diff --git a/pkgs/development/python-modules/tornado/default.nix b/pkgs/development/python-modules/tornado/default.nix
index db513d1c614..ec431a6e85b 100644
--- a/pkgs/development/python-modules/tornado/default.nix
+++ b/pkgs/development/python-modules/tornado/default.nix
@@ -6,6 +6,7 @@
 , backports_ssl_match_hostname
 , certifi
 , singledispatch
+, pythonOlder
 }:
 
 buildPythonPackage rec {
@@ -13,7 +14,8 @@ buildPythonPackage rec {
   version = "4.5.3";
   name = "${pname}-${version}";
 
-  propagatedBuildInputs = [ backports_abc backports_ssl_match_hostname certifi singledispatch ];
+  propagatedBuildInputs = [ backports_abc  certifi singledispatch ]
+    ++ lib.optional (pythonOlder "3.5") backports_ssl_match_hostname;
 
   # We specify the name of the test files to prevent
   # https://github.com/NixOS/nixpkgs/issues/14634
diff --git a/pkgs/development/tools/build-managers/cmake/default.nix b/pkgs/development/tools/build-managers/cmake/default.nix
index a2f5ee0325b..fed88561cf9 100644
--- a/pkgs/development/tools/build-managers/cmake/default.nix
+++ b/pkgs/development/tools/build-managers/cmake/default.nix
@@ -1,5 +1,6 @@
 { stdenv, fetchurl, pkgconfig
 , bzip2, curl, expat, libarchive, xz, zlib, libuv, rhash
+, majorVersion ? "3.10"
 # darwin attributes
 , ps
 , isBootstrap ? false
@@ -14,10 +15,23 @@ assert useQt4 -> withQt5 == false;
 
 with stdenv.lib;
 
+with (
+  {
+    "3.10" = {
+      minorVersion = "2";
+      sha256 = "80d0faad4ab56de07aa21a7fc692c88c4ce6156d42b0579c6962004a70a3218b";
+    };
+    "3.9" = {
+      minorVersion = "6";
+      sha256 = "7410851a783a41b521214ad987bb534a7e4a65e059651a2514e6ebfc8f46b218";
+    };
+
+  }.${majorVersion}
+    or (abort ''Unsupported configuration for cmake: majorVersion = "${majorVersion}";'')
+);
+
 let
   os = stdenv.lib.optionalString;
-  majorVersion = "3.9";
-  minorVersion = "6";
   version = "${majorVersion}.${minorVersion}";
 in
 
@@ -28,8 +42,8 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "${meta.homepage}files/v${majorVersion}/cmake-${version}.tar.gz";
-    # from https://cmake.org/files/v3.9/cmake-3.9.6-SHA-256.txt
-    sha256 = "7410851a783a41b521214ad987bb534a7e4a65e059651a2514e6ebfc8f46b218";
+    # from https://cmake.org/files/v3.10/cmake-3.10.2-SHA-256.txt
+    inherit sha256;
   };
 
   prePatch = optionalString (!useSharedLibraries) ''
diff --git a/pkgs/development/tools/misc/automake/automake-1.15.x.nix b/pkgs/development/tools/misc/automake/automake-1.15.x.nix
index d6399e128a3..507df5def0c 100644
--- a/pkgs/development/tools/misc/automake/automake-1.15.x.nix
+++ b/pkgs/development/tools/misc/automake/automake-1.15.x.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "1bzd9g32dfm4rsbw93ld9x7b5nc1y6i4m6zp032qf1i28a8s6sxg";
   };
 
-  buildInputs = [ perl autoconf ];
+  nativeBuildInputs = [ autoconf perl ];
+  buildInputs = [ autoconf ];
 
   setupHook = ./setup-hook.sh;
 
diff --git a/pkgs/development/tools/misc/libtool/libtool2.nix b/pkgs/development/tools/misc/libtool/libtool2.nix
index bf134c459d9..85821ee2089 100644
--- a/pkgs/development/tools/misc/libtool/libtool2.nix
+++ b/pkgs/development/tools/misc/libtool/libtool2.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "lib" ];
 
-  nativeBuildInputs = [ perl help2man ];
+  nativeBuildInputs = [ perl help2man m4 ];
   propagatedBuildInputs = [ m4 ];
 
   # Don't fixup "#! /bin/sh" in Libtool, otherwise it will use the
diff --git a/pkgs/development/tools/misc/lsof/default.nix b/pkgs/development/tools/misc/lsof/default.nix
index 76c83e2dbeb..aa6bd003ed3 100644
--- a/pkgs/development/tools/misc/lsof/default.nix
+++ b/pkgs/development/tools/misc/lsof/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, ncurses }:
+{ stdenv, fetchurl, buildPackages, ncurses }:
 
 let dialect = with stdenv.lib; last (splitString "-" stdenv.system); in
 
@@ -6,6 +6,7 @@ stdenv.mkDerivation rec {
   name = "lsof-${version}";
   version = "4.89";
 
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
   buildInputs = [ ncurses ];
 
   src = fetchurl {
@@ -31,7 +32,7 @@ stdenv.mkDerivation rec {
 
   # Stop build scripts from searching global include paths
   LSOF_INCLUDE = "${stdenv.cc.libc}/include";
-  configurePhase = "./Configure -n ${dialect}";
+  configurePhase = "LINUX_CONF_CC=$CC_FOR_BUILD LSOF_CC=$CC LSOF_AR=\"$AR cr\" LSOF_RANLIB=$RANLIB ./Configure -n ${dialect}";
   preBuild = ''
     sed -i Makefile -e 's/^CFGF=/&	-DHASIPv6=1/;' -e 's/-lcurses/-lncurses/'
     for filepath in $(find dialects/${dialect} -type f); do
diff --git a/pkgs/development/tools/misc/texinfo/5.2.nix b/pkgs/development/tools/misc/texinfo/5.2.nix
index 571af764fcf..0feb4b943df 100644
--- a/pkgs/development/tools/misc/texinfo/5.2.nix
+++ b/pkgs/development/tools/misc/texinfo/5.2.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, ncurses, perl, xz, procps, interactive ? false }:
+{ stdenv, buildPackages, fetchurl, ncurses, perl, xz, procps, interactive ? false }:
 
 with stdenv.lib;
 
@@ -10,10 +10,17 @@ stdenv.mkDerivation rec {
     sha256 = "1njfwh2z34r2c4r0iqa7v24wmjzvsfyz4vplzry8ln3479lfywal";
   };
 
+  # We need a native compiler to build perl XS extensions
+  # when cross-compiling.
+  depsBuildBuild = [ buildPackages.stdenv.cc perl ];
+
   buildInputs = [ perl xz.bin ]
     ++ optional interactive ncurses
     ++ optional doCheck procps; # for tests
 
+  configureFlags = [ "PERL=${buildPackages.perl}/bin/perl" ]
+    ++ stdenv.lib.optional stdenv.isSunOS "AWK=${gawk}/bin/awk";
+
   preInstall = ''
     installFlags="TEXMF=$out/texmf-dist";
     installTargets="install install-tex";
diff --git a/pkgs/development/tools/misc/texinfo/6.5.nix b/pkgs/development/tools/misc/texinfo/6.5.nix
index 4691df6917b..afa7e9a0a20 100644
--- a/pkgs/development/tools/misc/texinfo/6.5.nix
+++ b/pkgs/development/tools/misc/texinfo/6.5.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, ncurses, perl, xz, libiconv, gawk, procps, interactive ? false }:
+{ stdenv, buildPackages, fetchurl, ncurses, perl, xz, libiconv, gawk, procps, interactive ? false }:
 
 with stdenv.lib;
 
@@ -10,12 +10,17 @@ stdenv.mkDerivation rec {
     sha256 = "0qjzvbvnv9003xdrcpi3jp7y68j4hq2ciw9frh2hghh698zlnxvp";
   };
 
-  buildInputs = [ perl xz ]
+  # We need a native compiler to build perl XS extensions
+  # when cross-compiling.
+  depsBuildBuild = [ buildPackages.stdenv.cc perl ];
+
+  buildInputs = [ xz ]
     ++ optionals stdenv.isSunOS [ libiconv gawk ]
     ++ optional interactive ncurses
     ++ optional doCheck procps; # for tests
 
-  configureFlags = stdenv.lib.optional stdenv.isSunOS "AWK=${gawk}/bin/awk";
+  configureFlags = [ "PERL=${buildPackages.perl}/bin/perl" ]
+    ++ stdenv.lib.optional stdenv.isSunOS "AWK=${gawk}/bin/awk";
 
   preInstall = ''
     installFlags="TEXMF=$out/texmf-dist";
diff --git a/pkgs/development/tools/parsing/flex/default.nix b/pkgs/development/tools/parsing/flex/default.nix
index 4ea11a622ea..17323a06cc1 100644
--- a/pkgs/development/tools/parsing/flex/default.nix
+++ b/pkgs/development/tools/parsing/flex/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, bison, m4
+{ stdenv, buildPackages, fetchurl, bison, m4
 , fetchpatch, autoreconfHook, help2man
 }:
 
@@ -19,28 +19,27 @@ stdenv.mkDerivation rec {
         + "/tools/flex/patches/200-build-AC_USE_SYSTEM_EXTENSIONS-in-configure.ac.patch";
     sha256 = "1aarhcmz7mfrgh15pkj6f7ikxa2m0mllw1i1vscsf1kw5d05lw6f";
   })];
+  postPatch = stdenv.lib.optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
+    substituteInPlace Makefile.in --replace "tests" " "
+
+    substituteInPlace doc/Makefile.am --replace 'flex.1: $(top_srcdir)/configure.ac' 'flex.1: '
+  '';
+
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
   nativeBuildInputs = [ autoreconfHook help2man ];
-
   buildInputs = [ bison ];
-
   propagatedBuildInputs = [ m4 ];
 
+  preConfigure = stdenv.lib.optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
+    export ac_cv_func_malloc_0_nonnull=yes
+    export ac_cv_func_realloc_0_nonnull=yes
+  '';
+
   postConfigure = stdenv.lib.optionalString (stdenv.isDarwin || stdenv.isCygwin) ''
     sed -i Makefile -e 's/-no-undefined//;'
   '';
 
-  crossAttrs = {
-
-    # disable tests which can't run on build machine
-    postPatch = ''
-      substituteInPlace Makefile.in --replace "tests" " ";
-    '';
-
-    preConfigure = ''
-      export ac_cv_func_malloc_0_nonnull=yes
-      export ac_cv_func_realloc_0_nonnull=yes
-    '';
-  };
+  dontDisableStatic = stdenv.buildPlatform != stdenv.hostPlatform;
 
   meta = {
     homepage = https://github.com/westes/flex;
diff --git a/pkgs/os-specific/linux/alsa-utils/default.nix b/pkgs/os-specific/linux/alsa-utils/default.nix
index c9b5b0d2e2d..e2340939fce 100644
--- a/pkgs/os-specific/linux/alsa-utils/default.nix
+++ b/pkgs/os-specific/linux/alsa-utils/default.nix
@@ -17,7 +17,8 @@ stdenv.mkDerivation rec {
       --replace "which" "type -p" \
       --replace "lspci" "${pciutils}/bin/lspci"
   '';
-  buildInputs = [ gettext alsaLib ncurses libsamplerate fftw ];
+  nativeBuildInputs = [ gettext ];
+  buildInputs = [ alsaLib ncurses libsamplerate fftw ];
 
   configureFlags = "--disable-xmlto --with-udev-rules-dir=$(out)/lib/udev/rules.d";
 
diff --git a/pkgs/os-specific/linux/audit/default.nix b/pkgs/os-specific/linux/audit/default.nix
index 0558b42dda3..4adc321d930 100644
--- a/pkgs/os-specific/linux/audit/default.nix
+++ b/pkgs/os-specific/linux/audit/default.nix
@@ -1,5 +1,5 @@
 {
-  stdenv, fetchurl,
+  stdenv, buildPackages, fetchurl,
   enablePython ? false, python ? null,
 }:
 
@@ -15,6 +15,7 @@ stdenv.mkDerivation rec {
 
   outputs = [ "bin" "dev" "out" "man" ];
 
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
   buildInputs = stdenv.lib.optional enablePython python;
 
   configureFlags = [
diff --git a/pkgs/os-specific/linux/net-tools/default.nix b/pkgs/os-specific/linux/net-tools/default.nix
index 9fbf3055715..ce287dc1841 100644
--- a/pkgs/os-specific/linux/net-tools/default.nix
+++ b/pkgs/os-specific/linux/net-tools/default.nix
@@ -1,11 +1,12 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "net-tools-1.60_p20161110235919";
+  name = "net-tools-${version}";
+  version = "1.60_p20170221182432";
 
   src = fetchurl {
     url = "mirror://gentoo/distfiles/${name}.tar.xz";
-    sha256 = "1kbgwkys45kb5wqhchi1kf0sfw93c1cl0hgyw7yhacxzdfxjmdfr";
+    sha256 = "08r4r2a24g5bm8jwgfa998gs1fld7fgbdf7pilrpsw1m974xn04a";
   };
 
   preBuild =
diff --git a/pkgs/os-specific/linux/procps-ng/default.nix b/pkgs/os-specific/linux/procps-ng/default.nix
index 4023ea5c69f..cc5e3dd5190 100644
--- a/pkgs/os-specific/linux/procps-ng/default.nix
+++ b/pkgs/os-specific/linux/procps-ng/default.nix
@@ -16,7 +16,10 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   # Too red
-  configureFlags = [ "--disable-modern-top" ];
+  configureFlags = [ "--disable-modern-top" ]
+    ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform)
+    [ "ac_cv_func_malloc_0_nonnull=yes"
+      "ac_cv_func_realloc_0_nonnull=yes" ];
 
   meta = {
     homepage = https://sourceforge.net/projects/procps-ng/;
diff --git a/pkgs/os-specific/linux/wireless-tools/default.nix b/pkgs/os-specific/linux/wireless-tools/default.nix
index f5a51a4e096..f883bf0d226 100644
--- a/pkgs/os-specific/linux/wireless-tools/default.nix
+++ b/pkgs/os-specific/linux/wireless-tools/default.nix
@@ -1,18 +1,20 @@
 {stdenv, fetchurl}:
 
-stdenv.mkDerivation {
-  name = "wireless-tools-29";
+stdenv.mkDerivation rec {
+  name = "wireless-tools-${version}";
+  version = "30.pre2";
 
   src = fetchurl {
-    url = http://www.hpl.hp.com/personal/Jean_Tourrilhes/Linux/wireless_tools.29.tar.gz;
-    sha256 = "18g5wa3rih89i776nc2n2s50gcds4611gi723h9ki190zqshkf3g";
+    url = "http://www.hpl.hp.com/personal/Jean_Tourrilhes/Linux/wireless_tools.${version}.tar.gz";
+    sha256 = "01lgf592nk8fnk7l5afqvar4szkngwpgcv4xh58qsg9wkkjlhnls";
   };
 
   preBuild = "
-    makeFlagsArray=(PREFIX=$out)
+    makeFlagsArray=(PREFIX=$out CC=$CC LDCONFIG=: AR=$AR RANLIB=$RANLIB)
   ";
 
   meta = {
     platforms = stdenv.lib.platforms.linux;
+    license = stdenv.lib.licenses.gpl2;
   };
 }
diff --git a/pkgs/servers/dns/bind/default.nix b/pkgs/servers/dns/bind/default.nix
index fa00e3edf97..ea4d4f387d8 100644
--- a/pkgs/servers/dns/bind/default.nix
+++ b/pkgs/servers/dns/bind/default.nix
@@ -18,7 +18,8 @@ stdenv.mkDerivation rec {
   patches = [ ./dont-keep-configure-flags.patch ./remove-mkdir-var.patch ] ++
     stdenv.lib.optional stdenv.isDarwin ./darwin-openssl-linking-fix.patch;
 
-  buildInputs = [ openssl libtool perl libxml2 ] ++
+  nativeBuildInputs = [ perl ];
+  buildInputs = [ openssl libtool libxml2 ] ++
     stdenv.lib.optional enableSeccomp libseccomp;
 
   STD_CDEFINES = [ "-DDIG_SIGCHASE=1" ]; # support +sigchase
diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index dbbe45e45f3..e4a77af199b 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -769,7 +769,7 @@ _defaultUnpack() {
         # We can't preserve hardlinks because they may have been
         # introduced by store optimization, which might break things
         # in the build.
-        cp -pr --reflink=auto "$fn" "$(stripHash "$fn")"
+        cp -pr --reflink=auto -- "$fn" "$(stripHash "$fn")"
 
     else
 
diff --git a/pkgs/tools/archivers/unrar/default.nix b/pkgs/tools/archivers/unrar/default.nix
index 9aedda83fd2..15c0837154e 100644
--- a/pkgs/tools/archivers/unrar/default.nix
+++ b/pkgs/tools/archivers/unrar/default.nix
@@ -10,7 +10,10 @@ stdenv.mkDerivation rec {
   };
 
   postPatch = ''
-    sed 's/^CXX=g++/#CXX/' -i makefile
+    substituteInPlace makefile \
+      --replace "CXX=" "#CXX=" \
+      --replace "STRIP=" "#STRIP=" \
+      --replace "AR=" "#AR="
   '';
 
   buildPhase = ''
diff --git a/pkgs/tools/archivers/zip/default.nix b/pkgs/tools/archivers/zip/default.nix
index 3c841aa621f..cb2d29e239d 100644
--- a/pkgs/tools/archivers/zip/default.nix
+++ b/pkgs/tools/archivers/zip/default.nix
@@ -12,6 +12,9 @@ stdenv.mkDerivation {
     ];
     sha256 = "0sb3h3067pzf3a7mlxn1hikpcjrsvycjcnj9hl9b1c3ykcgvps7h";
   };
+  patchPhase = ''
+    substituteInPlace unix/Makefile --replace 'CC = cc' ""
+  '';
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/tools/compression/gzip/default.nix b/pkgs/tools/compression/gzip/default.nix
index bb9555fa600..cfe41d3dfe7 100644
--- a/pkgs/tools/compression/gzip/default.nix
+++ b/pkgs/tools/compression/gzip/default.nix
@@ -2,15 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "gzip-${version}";
-  version = "1.8";
+  version = "1.9";
 
   src = fetchurl {
     url = "mirror://gnu/gzip/${name}.tar.xz";
-    sha256 = "1lxv3p4iyx7833mlihkn5wfwmz4cys5nybwpz3dfawag8kn6f5zz";
+    sha256 = "16h8g4acy7fgfxcjacr3wijjsnixwsfd2jhz3zwdi2qrzi262l5f";
   };
 
-  patches = stdenv.lib.optional hostPlatform.isDarwin stdenv.secure-format-patch;
-
   outputs = [ "out" "man" "info" ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/tools/filesystems/e2fsprogs/default.nix b/pkgs/tools/filesystems/e2fsprogs/default.nix
index e6a83e32632..6326cda3539 100644
--- a/pkgs/tools/filesystems/e2fsprogs/default.nix
+++ b/pkgs/tools/filesystems/e2fsprogs/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, libuuid, gettext, texinfo }:
+{ stdenv, buildPackages, fetchurl, pkgconfig, libuuid, gettext, texinfo }:
 
 stdenv.mkDerivation rec {
   name = "e2fsprogs-1.43.8";
@@ -10,15 +10,10 @@ stdenv.mkDerivation rec {
 
   outputs = [ "bin" "dev" "out" "man" "info" ];
 
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
   nativeBuildInputs = [ pkgconfig texinfo ];
   buildInputs = [ libuuid ] ++ stdenv.lib.optional (!stdenv.isLinux) gettext;
 
-  crossAttrs = {
-    preConfigure = ''
-      export CC=$crossConfig-gcc
-    '';
-  };
-
   configureFlags =
     if stdenv.isLinux then [
       "--enable-elf-shlibs" "--enable-symlink-install" "--enable-relative-symlinks"
diff --git a/pkgs/tools/misc/bc/cross-bc.patch b/pkgs/tools/misc/bc/cross-bc.patch
new file mode 100644
index 00000000000..ba8857abb58
--- /dev/null
+++ b/pkgs/tools/misc/bc/cross-bc.patch
@@ -0,0 +1,169 @@
+commit fdda59736ddc048cf38a2c7103f4f5d9eeaf995e
+Author: Ben Gamari <ben@smart-cactus.org>
+Date:   Tue Oct 17 10:51:34 2017 -0400
+
+    Try implementing cross-compilation
+
+diff --git a/bc/Makefile.am b/bc/Makefile.am
+index d9d412e..fdef633 100644
+--- a/bc/Makefile.am
++++ b/bc/Makefile.am
+@@ -17,6 +17,7 @@ MAINTAINERCLEANFILES = Makefile.in bc.c bc.h scan.c \
+ 
+ AM_CPPFLAGS = -I$(srcdir) -I$(srcdir)/../h
+ LIBBC = ../lib/libbc.a
++LIBBC_HOST = ../lib/libbc_host.a
+ LIBL = @LEXLIB@
+ LDADD = $(LIBBC) $(LIBL) @READLINELIB@
+ 
+@@ -29,12 +30,20 @@ $(PROGRAMS): libmath.h $(LIBBC)
+ scan.o: bc.h
+ global.o: libmath.h
++
++main_host.c : main.c
++	cp $< $@
+ 
+-fbcOBJ = main.o bc.o scan.o execute.o load.o storage.o util.o warranty.o
++fbcOBJ = $(addsuffix _host,main.o bc.o scan.o execute.o load.o storage.o util.o warranty.o)
++
++%.o_host : CC:=$(CC_FOR_BUILD)
++
++%.o_host : %.c
++	$(COMPILE) -c $(CFLAGS) $(INCLUDES) -o $@ $<
+ 
+-libmath.h: libmath.b $(fbcOBJ) $(LIBBC)
++libmath.h: libmath.b $(fbcOBJ) $(LIBBC_HOST)
+ 	echo '{0}' > libmath.h
+-	$(MAKE) global.o
+-	$(LINK) -o fbc $(fbcOBJ) global.o $(LIBBC) $(LIBL) $(READLINELIB) $(LIBS)
++	$(MAKE) global.o_host
++	$(CC_FOR_BUILD) -o fbc $(fbcOBJ) global.o_host $(LIBBC_HOST) $(LIBL) ${READLINELIB} $(LIBS)
+ 	./fbc -c $(srcdir)/libmath.b </dev/null >libmath.h
+ 	$(srcdir)/fix-libmath_h
+ 	rm -f ./fbc ./global.o
+diff --git a/configure.ac b/configure.ac
+index fc74573..5cabb73 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -20,6 +20,7 @@ m4_define([dc_version], 1.4.1)
+ 
+ AC_INIT([bc],[bc_version])
+ AC_CONFIG_SRCDIR(doc/bc.1)
++AC_CONFIG_MACRO_DIR([m4])
+ AM_INIT_AUTOMAKE([dist-bzip2])
+ AC_CONFIG_HEADERS(config.h)
+ 
+@@ -35,6 +36,7 @@ AC_DEFINE([DC_COPYRIGHT],
+ 	  [Define the dc copyright line.])
+ 
+ AC_PROG_CC
++AX_CC_FOR_BUILD
+ AC_USE_SYSTEM_EXTENSIONS
+ 
+ AM_PROG_LEX
+diff --git a/lib/Makefile.am b/lib/Makefile.am
+index ec4bf59..c670f5b 100644
+--- a/lib/Makefile.am
++++ b/lib/Makefile.am
+@@ -1,5 +1,5 @@
+ ## Process this file with automake to produce Makefile.in
+-noinst_LIBRARIES = libbc.a
++noinst_LIBRARIES = libbc.a libbc_host.a
+ 
+ AM_CPPFLAGS = -I. -I.. -I$(srcdir)/../h
+ 
+@@ -24,3 +24,11 @@ testmul: testmul.o number.o
+ 
+ specialnumber: newnumber.o
+ 	cp newnumber.o number.o
++
++%.o_host : CC:=$(CC_FOR_BUILD)
++%.o_host : %.c
++	$(COMPILE) -c $(CFLAGS) $(INCLUDES) -o $@ $<
++
++libbc_host.a : $(addsuffix _host,$(libbc_a_OBJECTS))
++	ar cru $@ $+
++	ranlib $@
+diff --git a/m4/cc_for_build.m4 b/m4/cc_for_build.m4
+new file mode 100644
+index 0000000..c62ffad
+--- /dev/null
++++ b/m4/cc_for_build.m4
+@@ -0,0 +1,77 @@
++# ===========================================================================
++#     https://www.gnu.org/software/autoconf-archive/ax_cc_for_build.html
++# ===========================================================================
++#
++# SYNOPSIS
++#
++#   AX_CC_FOR_BUILD
++#
++# DESCRIPTION
++#
++#   Find a build-time compiler. Sets CC_FOR_BUILD and EXEEXT_FOR_BUILD.
++#
++# LICENSE
++#
++#   Copyright (c) 2010 Reuben Thomas <rrt@sc3d.org>
++#   Copyright (c) 1999 Richard Henderson <rth@redhat.com>
++#
++#   This program is free software: you can redistribute it and/or modify it
++#   under the terms of the GNU General Public License as published by the
++#   Free Software Foundation, either version 3 of the License, or (at your
++#   option) any later version.
++#
++#   This program is distributed in the hope that it will be useful, but
++#   WITHOUT ANY WARRANTY; without even the implied warranty of
++#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
++#   Public License for more details.
++#
++#   You should have received a copy of the GNU General Public License along
++#   with this program. If not, see <https://www.gnu.org/licenses/>.
++#
++#   As a special exception, the respective Autoconf Macro's copyright owner
++#   gives unlimited permission to copy, distribute and modify the configure
++#   scripts that are the output of Autoconf when processing the Macro. You
++#   need not follow the terms of the GNU General Public License when using
++#   or distributing such scripts, even though portions of the text of the
++#   Macro appear in them. The GNU General Public License (GPL) does govern
++#   all other use of the material that constitutes the Autoconf Macro.
++#
++#   This special exception to the GPL applies to versions of the Autoconf
++#   Macro released by the Autoconf Archive. When you make and distribute a
++#   modified version of the Autoconf Macro, you may extend this special
++#   exception to the GPL to apply to your modified version as well.
++
++#serial 3
++
++dnl Get a default for CC_FOR_BUILD to put into Makefile.
++AC_DEFUN([AX_CC_FOR_BUILD],
++[# Put a plausible default for CC_FOR_BUILD in Makefile.
++if test -z "$CC_FOR_BUILD"; then
++  if test "x$cross_compiling" = "xno"; then
++    CC_FOR_BUILD='$(CC)'
++  else
++    CC_FOR_BUILD=gcc
++  fi
++fi
++AC_SUBST(CC_FOR_BUILD)
++# Also set EXEEXT_FOR_BUILD.
++if test "x$cross_compiling" = "xno"; then
++  EXEEXT_FOR_BUILD='$(EXEEXT)'
++else
++  AC_CACHE_CHECK([for build system executable suffix], bfd_cv_build_exeext,
++    [rm -f conftest*
++     echo 'int main () { return 0; }' > conftest.c
++     bfd_cv_build_exeext=
++     ${CC_FOR_BUILD} -o conftest conftest.c 1>&5 2>&5
++     for file in conftest.*; do
++       case $file in
++       *.c | *.o | *.obj | *.ilk | *.pdb) ;;
++       *) bfd_cv_build_exeext=`echo $file | sed -e s/conftest//` ;;
++       esac
++     done
++     rm -f conftest*
++     test x"${bfd_cv_build_exeext}" = x && bfd_cv_build_exeext=no])
++  EXEEXT_FOR_BUILD=""
++  test x"${bfd_cv_build_exeext}" != xno && EXEEXT_FOR_BUILD=${bfd_cv_build_exeext}
++fi
++AC_SUBST(EXEEXT_FOR_BUILD)])dnl
diff --git a/pkgs/tools/misc/bc/default.nix b/pkgs/tools/misc/bc/default.nix
index 2371e91ae2f..fc60a000e36 100644
--- a/pkgs/tools/misc/bc/default.nix
+++ b/pkgs/tools/misc/bc/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchurl, flex, readline, ed, texinfo}:
+{stdenv, autoreconfHook, buildPackages, fetchurl, flex, readline, ed, texinfo}:
 
 stdenv.mkDerivation rec {
   name = "bc-1.07.1";
@@ -9,9 +9,24 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--with-readline" ];
 
-  buildInputs = [flex readline ed texinfo];
+  # As of 1.07 cross-compilation is quite complicated as the build system wants
+  # to build a code generator, bc/fbc, on the build machine.
+  patches = [ ./cross-bc.patch ];
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
+  nativeBuildInputs = [
+    # Tools
+    autoreconfHook ed flex texinfo
+    # Libraries for build
+    buildPackages.readline buildPackages.ncurses
+  ];
+  buildInputs = [ readline ];
 
-  doCheck = true;
+  doCheck = true; # not cross
+
+  # Hack to make sure we never to the relaxation `$PATH` and hooks support for
+  # compatability. This will be replaced with something clearer in a future
+  # masss-rebuild.
+  crossConfig = true;
 
   meta = {
     description = "GNU software calculator";
diff --git a/pkgs/tools/misc/file/default.nix b/pkgs/tools/misc/file/default.nix
index 47d67f91ec7..3765f913430 100644
--- a/pkgs/tools/misc/file/default.nix
+++ b/pkgs/tools/misc/file/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, zlib }:
+{ stdenv, fetchurl, file, zlib }:
 
 stdenv.mkDerivation rec {
   name = "file-${version}";
@@ -12,6 +12,7 @@ stdenv.mkDerivation rec {
     sha256 = "0l1bfa0icng9vdwya00ff48fhvjazi5610ylbhl35qi13d6xqfc6";
   };
 
+  nativeBuildInputs = stdenv.lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) file;
   buildInputs = [ zlib ];
 
   doCheck = true;
diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index be42c4a1381..16b22e3f255 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -24,11 +24,11 @@ assert brotliSupport -> brotli != null;
 assert gssSupport -> kerberos != null;
 
 stdenv.mkDerivation rec {
-  name = "curl-7.57.0";
+  name = "curl-7.58.0";
 
   src = fetchurl {
     url = "http://curl.haxx.se/download/${name}.tar.bz2";
-    sha256 = "09j88lzqmi79rvvg2l7bjcs56330bq388f5p468hgblf6hdf6by9";
+    sha256 = "0cg7klhf1ksnbw5wvwa802qir877zv4y3dj7swz1xh07g3wq3c0w";
   };
 
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
diff --git a/pkgs/tools/networking/jwhois/default.nix b/pkgs/tools/networking/jwhois/default.nix
index 1d7932c7ad3..cd0821ef9ef 100644
--- a/pkgs/tools/networking/jwhois/default.nix
+++ b/pkgs/tools/networking/jwhois/default.nix
@@ -15,6 +15,8 @@ stdenv.mkDerivation {
 
   patches = [ ./connect.patch ./service-name.patch ];
 
+  makeFlags = [ "AR=${stdenv.cc.bintools.targetPrefix}ar" ];
+
   meta = {
     description = "A client for the WHOIS protocol allowing you to query the owner of a domain name";
     homepage = http://www.gnu.org/software/jwhois/;
diff --git a/pkgs/tools/networking/openssh/default.nix b/pkgs/tools/networking/openssh/default.nix
index 663e7be7e5f..1c135cd36f4 100644
--- a/pkgs/tools/networking/openssh/default.nix
+++ b/pkgs/tools/networking/openssh/default.nix
@@ -1,15 +1,12 @@
 { stdenv, fetchurl, fetchpatch, zlib, openssl, perl, libedit, pkgconfig, pam, autoreconfHook
 , etcDir ? null
 , hpnSupport ? false
-, withKerberos ? false
+, withKerberos ? true
 , withGssapiPatches ? false
 , kerberos
 , linkOpenssl? true
 }:
 
-assert withKerberos -> kerberos != null;
-assert withGssapiPatches -> withKerberos;
-
 let
 
   # **please** update this patch when you update to a new openssh release.
@@ -23,8 +20,6 @@ let
 in
 with stdenv.lib;
 stdenv.mkDerivation rec {
-  # Please ensure that openssh_with_kerberos still builds when
-  # bumping the version here!
   name = "openssh-${version}";
   version = if hpnSupport then "7.5p1" else "7.6p1";
 
@@ -47,7 +42,7 @@ stdenv.mkDerivation rec {
       # See discussion in https://github.com/NixOS/nixpkgs/pull/16966
       ./dont_create_privsep_path.patch
     ]
-    ++ optional withGssapiPatches gssapiPatch;
+    ++ optional withGssapiPatches (assert withKerberos; gssapiPatch);
 
   postPatch =
     # On Hydra this makes installation fail (sometimes?),
@@ -59,7 +54,8 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ zlib openssl libedit pam ]
     ++ optional withKerberos kerberos
-    ++ optional hpnSupport autoreconfHook;
+    ++ optional hpnSupport autoreconfHook
+    ;
 
   preConfigure = ''
     # Setting LD causes `configure' and `make' to disagree about which linker
@@ -78,7 +74,7 @@ stdenv.mkDerivation rec {
     "--disable-strip"
     (if pam != null then "--with-pam" else "--without-pam")
   ] ++ optional (etcDir != null) "--sysconfdir=${etcDir}"
-    ++ optional withKerberos "--with-kerberos5=${kerberos}"
+    ++ optional withKerberos (assert kerberos != null; "--with-kerberos5=${kerberos}")
     ++ optional stdenv.isDarwin "--disable-libutil"
     ++ optional (!linkOpenssl) "--without-openssl";
 
diff --git a/pkgs/tools/networking/unbound/default.nix b/pkgs/tools/networking/unbound/default.nix
index b124352fd7b..614447cd5ec 100644
--- a/pkgs/tools/networking/unbound/default.nix
+++ b/pkgs/tools/networking/unbound/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "unbound-${version}";
-  version = "1.6.7";
+  version = "1.6.8";
 
   src = fetchurl {
-    url = "http://unbound.net/downloads/${name}.tar.gz";
-    sha256 = "17qwfmlls0w9kpkya3dlpn44b3kr87wsswzg3gawc13hh8yx8ysf";
+    url = "https://unbound.net/downloads/${name}.tar.gz";
+    sha256 = "0jfxhh4gc5amhndikskz1s7da27ycn442j3l20bm992n7zijid73";
   };
 
   outputs = [ "out" "lib" "man" ]; # "dev" would only split ~20 kB
diff --git a/pkgs/tools/package-management/nix-prefetch-scripts/default.nix b/pkgs/tools/package-management/nix-prefetch-scripts/default.nix
index 95280bf60b3..a2ff38ab300 100644
--- a/pkgs/tools/package-management/nix-prefetch-scripts/default.nix
+++ b/pkgs/tools/package-management/nix-prefetch-scripts/default.nix
@@ -6,7 +6,7 @@ let mkPrefetchScript = tool: src: deps:
   stdenv.mkDerivation {
     name = "nix-prefetch-${tool}";
 
-    buildInputs = [ makeWrapper ];
+    nativeBuildInputs = [ makeWrapper ];
 
     unpackPhase = ":";
 
diff --git a/pkgs/tools/security/mktemp/default.nix b/pkgs/tools/security/mktemp/default.nix
index 8b2a60fd765..a2a4f82f652 100644
--- a/pkgs/tools/security/mktemp/default.nix
+++ b/pkgs/tools/security/mktemp/default.nix
@@ -1,16 +1,21 @@
 { stdenv, fetchurl, groff }:
 
 stdenv.mkDerivation {
-  name = "mktemp-1.6";
+  name = "mktemp-1.7";
 
   # Have `configure' avoid `/usr/bin/nroff' in non-chroot builds.
   NROFF = "${groff}/bin/nroff";
 
+  # Don't use "install -s"
+  postPatch = ''
+    substituteInPlace Makefile.in --replace " 0555 -s " " 0555 "
+  '';
+
   src = fetchurl {
-    url = ftp://ftp.mktemp.org/pub/mktemp/mktemp-1.6.tar.gz;
-    sha256 = "1nfj89b0dv1c2fyqi1pg54fyzs3462cbp7jv7lskqsxvqy4mh9x1";
+    url = ftp://ftp.mktemp.org/pub/mktemp/mktemp-1.7.tar.gz;
+    sha256 = "0x969152znxxjbj7387xb38waslr4yv6bnj5jmhb4rpqxphvk54f";
   };
-  
+
   meta = {
     platforms = stdenv.lib.platforms.unix;
   };
diff --git a/pkgs/tools/security/rhash/default.nix b/pkgs/tools/security/rhash/default.nix
index e33c680b457..68c3edc4cd2 100644
--- a/pkgs/tools/security/rhash/default.nix
+++ b/pkgs/tools/security/rhash/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   # * .h files installed for static library target only
   # * .so.0 -> .so link only created in the static library install target
   buildPhase = ''
-    make lib-shared lib-static build-shared CC=cc PREFIX=$out
+    make lib-shared lib-static build-shared CC=$CC AR=$AR PREFIX=$out
   '';
 
   # we don't actually want the static library, so we remove it after it
diff --git a/pkgs/tools/system/cron/default.nix b/pkgs/tools/system/cron/default.nix
index 4a8babfd630..d6347798053 100644
--- a/pkgs/tools/system/cron/default.nix
+++ b/pkgs/tools/system/cron/default.nix
@@ -14,7 +14,9 @@ stdenv.mkDerivation {
   preBuild = ''
     # do not set sticky bit in /nix/store 
     substituteInPlace Makefile --replace ' -o root' ' ' --replace 111 755 --replace 4755 0755
-    makeFlags="DESTROOT=$out CC=cc"
+    # do not strip during install, broken on cross and we'll do ourselves as needed
+    substituteInPlace Makefile --replace ' -s cron' ' cron'
+    makeFlags="DESTROOT=$out CC=$CC"
 
     # We want to ignore the $glibc/include/paths.h definition of
     # sendmail path.
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 4542411b150..68c4a3c4acb 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -146,6 +146,7 @@ mapAliases (rec {
   rdmd = dtools;  # added 2017-08-19
   robomongo = robo3t; #added 2017-09-28
   rssglx = rss-glx; #added 2015-03-25
+  openssh_with_kerberos = openssh; # added 2018-01-28
   rubygems = throw "deprecated 2016-03-02: rubygems is now bundled with ruby";
   rxvt_unicode_with-plugins = rxvt_unicode-with-plugins; # added 2015-04-02
   samsungUnifiedLinuxDriver = samsung-unified-linux-driver; # added 2016-01-25
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index aea485da5e6..e7a6bfd3ce4 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3890,15 +3890,12 @@ with pkgs;
   openssh =
     callPackage ../tools/networking/openssh {
       hpnSupport = false;
-      withKerberos = stdenv.isDarwin;
       etcDir = "/etc/ssh";
       pam = if stdenv.isLinux then pam else null;
     };
 
   openssh_hpn = pkgs.appendToName "with-hpn" (openssh.override { hpnSupport = true; });
 
-  openssh_with_kerberos = pkgs.appendToName "with-kerberos" (openssh.override { withKerberos = true; });
-
   opensp = callPackage ../tools/text/sgml/opensp { };
 
   opentracker = callPackage ../applications/networking/p2p/opentracker { };
@@ -6360,7 +6357,10 @@ with pkgs;
   llvmPackages_4 = callPackage ../development/compilers/llvm/4 ({
     inherit (stdenvAdapters) overrideCC;
   } // stdenv.lib.optionalAttrs stdenv.isDarwin {
-    cmake = cmake.override { isBootstrap = true; };
+    cmake = cmake.override {
+      isBootstrap = true;
+      majorVersion = "3.9"; # 3.10.2: 'ApplicationServices/ApplicationServices.h' file not found
+    };
     libxml2 = libxml2.override { pythonSupport = false; };
     python2 = callPackage ../development/interpreters/python/cpython/2.7/boot.nix { inherit (darwin) CF configd; };
   });
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 006794fa56d..bddbcea0136 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -11259,7 +11259,8 @@ let self = _self // overrides; _self = with self; {
       url = "https://alioth.debian.org/frs/download.php/file/4142/po4a-0.47.tar.gz";
       sha256 = "5010e1b7df1115cbd475f46587fc05fefc97301f9bba0c2f15106005ca017507";
     };
-    propagatedBuildInputs = [ pkgs.docbook_xml_xslt TextWrapI18N LocaleGettext TermReadKey SGMLSpm ModuleBuild UnicodeLineBreak ModuleBuild ];
+    nativeBuildInputs = [ pkgs.docbook_xml_xslt pkgs.docbook_xsl pkgs.docbook_xsl_ns ];
+    propagatedBuildInputs = [ TextWrapI18N LocaleGettext TermReadKey SGMLSpm ModuleBuild UnicodeLineBreak ModuleBuild ];
     buildInputs = [ pkgs.gettext pkgs.libxslt pkgs.glibcLocales pkgs.docbook_xml_dtd_412 pkgs.docbook_sgml_dtd_41 pkgs.texlive.combined.scheme-basic pkgs.jade ];
     LC_ALL="en_US.UTF-8";
     SGML_CATALOG_FILES = "${pkgs.docbook_xml_dtd_412}/xml/dtd/docbook/catalog.xml";
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index c5f6ac1fb2c..38e7f3e87c4 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1019,7 +1019,7 @@ in {
 
   backports_shutil_get_terminal_size = callPackage ../development/python-modules/backports_shutil_get_terminal_size { };
 
-  backports_ssl_match_hostname_3_4_0_2 = self.buildPythonPackage rec {
+  backports_ssl_match_hostname_3_4_0_2 = if !(pythonOlder "3.5") then null else self.buildPythonPackage rec {
     name = "backports.ssl_match_hostname-3.4.0.2";
 
     src = pkgs.fetchurl {
@@ -1033,7 +1033,7 @@ in {
     };
   };
 
-  backports_ssl_match_hostname = self.buildPythonPackage rec {
+  backports_ssl_match_hostname = if !(pythonOlder "3.5") then null else self.buildPythonPackage rec {
     name = "backports.ssl_match_hostname-${version}";
     version = "3.5.0.1";