diff --git a/pkgs/os-specific/linux/tcp-wrapper/builder.sh b/pkgs/os-specific/linux/tcp-wrapper/builder.sh
index fe8ad8d466e5..6cb91110530c 100644
--- a/pkgs/os-specific/linux/tcp-wrapper/builder.sh
+++ b/pkgs/os-specific/linux/tcp-wrapper/builder.sh
@@ -1,37 +1,39 @@
 source "$stdenv/setup" || exit 1
 
 # Unpack
-unpackPhase &&							\
-cd "$sourceRoot/upstream/tarballs" &&				\
-tar xzvf * &&							\
-cd tcp_wrappers_7.6 &&						\
-								\
+unpackPhase
+cd "$sourceRoot/upstream/tarballs"
+tar xzvf *
+cd tcp_wrappers_7.6
+
 # Patch
+patchPhase
+for patch in debian/patches/*
+do
+  echo "applying Debian patch \`$(basename $patch)'..."
+  patch -p1 < $patch
+done
+
 substituteInPlace "Makefile" --replace				\
    "REAL_DAEMON_DIR=/usr/sbin" "REAL_DAEMON_DIR=$out/sbin"	\
-   --replace "/tmp" '$$TMPDIR' &&				\
-substituteInPlace "scaffold.c" --replace			\
-   'extern char *malloc();' " " &&				\
-substituteInPlace "environ.c" --replace				\
-   'extern char *malloc();' " " &&				\
-								\
-# The `linux' target doesn't work on Linux...
-echo building... &&						\
-make REAL_DAEMON_DIR="$out/sbin" freebsd &&			\
-								\
+   --replace "/tmp" '$$TMPDIR'
+
+echo "building..."
+make REAL_DAEMON_DIR="$out/sbin" linux
+
 # Install
-ensureDir "$out/sbin" &&					\
-cp safe_finger tcpd tcpdchk tcpdmatch try-from "$out/sbin" &&	\
-								\
-ensureDir "$out/lib" &&						\
-cp lib*.a "$out/lib" &&						\
-								\
-ensureDir "$out/include" &&					\
-cp *.h "$out/include" && 					\
-								\
-ensureDir "$out/man" &&						\
-for i in 3 5 8;							\
-do								\
-  ensureDir "$out/man/man$i" &&					\
-  cp *.$i "$out/man/man$i" ;					\
-done								\
+ensureDir "$out/sbin"
+cp -v safe_finger tcpd tcpdchk tcpdmatch try-from "$out/sbin"
+
+ensureDir "$out/lib"
+cp -v shared/lib*.so* "$out/lib"
+
+ensureDir "$out/include"
+cp -v *.h "$out/include"
+
+ensureDir "$out/man"
+for i in 3 5 8;
+do
+  ensureDir "$out/man/man$i"
+  cp *.$i "$out/man/man$i" ;
+done
diff --git a/pkgs/os-specific/linux/tcp-wrapper/default.nix b/pkgs/os-specific/linux/tcp-wrapper/default.nix
index d5984e649a5e..a3f79cd05a85 100644
--- a/pkgs/os-specific/linux/tcp-wrapper/default.nix
+++ b/pkgs/os-specific/linux/tcp-wrapper/default.nix
@@ -7,8 +7,32 @@ stdenv.mkDerivation {
     url = mirror://debian/pool/main/t/tcp-wrappers/tcp-wrappers_7.6.dbs.orig.tar.gz;
     sha256 = "0k68ziinx6biwar5lcb9jvv0rp6b3vmj6861n75bvrz4w1piwkdp";
   };
-  
+
+  patches = [
+    (fetchurl {
+       url = mirror://debian/pool/main/t/tcp-wrappers/tcp-wrappers_7.6.dbs-13.diff.gz;
+       sha256 = "071ir20rh8ckhgrc0y99wgnlbqjgkprf0qwbv84lqw5i6qajbcnh";
+     })
+  ];
+
   builder = ./builder.sh;
 
-  # meta = ...
+  meta = {
+    description = "TCP Wrappers, a network logger, also known as TCPD or LOG_TCP";
+
+    longDescription = ''
+      Wietse Venema's network logger, also known as TCPD or LOG_TCP.
+      These programs log the client host name of incoming telnet, ftp,
+      rsh, rlogin, finger etc. requests.  Security options are: access
+      control per host, domain and/or service; detection of host name
+      spoofing or host address spoofing; booby traps to implement an
+      early-warning system.  The current version supports the System
+      V.4 TLI network programming interface (Solaris, DG/UX) in
+      addition to the traditional BSD sockets.
+    '';
+
+    homepage = ftp://ftp.porcupine.org/pub/security/index.html;
+
+    license = "BSD-style";
+  };
 }