Use a hardened stdenv by default

pkgs/tools/archivers/sharutils/default.nix

@@ -8,6 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "1mallg1gprimlggdisfzdmh1xi676jsfdlfyvanlcw72ny8fsj3g";
   };
 
+  noHardening_format = true;
+
   preConfigure = ''
      # Fix for building on Glibc 2.16.  Won't be needed once the
      # gnulib in sharutils is updated.

pkgs/tools/archivers/unzip/default.nix

@@ -9,6 +9,8 @@ stdenv.mkDerivation {
     sha256 = "0dxx11knh3nk95p2gg2ak777dd11pr7jx5das2g49l262scrcv83";
   };
 
+  noHardening_format = true;
+
   patches = [
     ./CVE-2014-8139.diff
     ./CVE-2014-8140.diff

pkgs/tools/archivers/zip/default.nix

@@ -13,6 +13,8 @@ stdenv.mkDerivation {
     sha256 = "0sb3h3067pzf3a7mlxn1hikpcjrsvycjcnj9hl9b1c3ykcgvps7h";
   };
 
+  noHardening_format = true;
+
   makefile = "unix/Makefile";
   buildFlags = if stdenv.isCygwin then "cygwin" else "generic";
   installFlags = "prefix=$(out) INSTALL=cp";