diff --git a/auth/auth.go b/auth/auth.go
index dfc8fb3..7dd49bd 100644
--- a/auth/auth.go
+++ b/auth/auth.go
@@ -7,6 +7,7 @@
 package auth
 
 import (
+	"context"
 	"fmt"
 	"io/ioutil"
 	"os"
@@ -43,5 +44,5 @@
 	if err != nil {
 		return nil, fmt.Errorf("reading JSON config from %s: %v", fileName, err)
 	}
-	return conf.TokenSource(oauth2.NoContext), nil
+	return conf.TokenSource(context.Background()), nil
 }
diff --git a/buildlet/gce.go b/buildlet/gce.go
index 129739a..fc04e5c 100644
--- a/buildlet/gce.go
+++ b/buildlet/gce.go
@@ -5,6 +5,7 @@
 package buildlet
 
 import (
+	"context"
 	"crypto/tls"
 	"errors"
 	"fmt"
@@ -75,7 +76,7 @@
 // StartNewVM boots a new VM on GCE and returns a buildlet client
 // configured to speak to it.
 func StartNewVM(ts oauth2.TokenSource, instName, hostType string, opts VMOpts) (*Client, error) {
-	computeService, _ := compute.New(oauth2.NewClient(oauth2.NoContext, ts))
+	computeService, _ := compute.New(oauth2.NewClient(context.TODO(), ts))
 
 	hconf, ok := dashboard.Hosts[hostType]
 	if !ok {
@@ -294,7 +295,7 @@
 // currently (2015-01-19) very slow for no good reason. This function
 // returns once it's been requested, not when it's done.
 func DestroyVM(ts oauth2.TokenSource, proj, zone, instance string) error {
-	computeService, _ := compute.New(oauth2.NewClient(oauth2.NoContext, ts))
+	computeService, _ := compute.New(oauth2.NewClient(context.TODO(), ts))
 	apiGate()
 	_, err := computeService.Instances.Delete(proj, zone, instance).Do()
 	return err
@@ -313,7 +314,7 @@
 // ListVMs lists all VMs.
 func ListVMs(ts oauth2.TokenSource, proj, zone string) ([]VM, error) {
 	var vms []VM
-	computeService, _ := compute.New(oauth2.NewClient(oauth2.NoContext, ts))
+	computeService, _ := compute.New(oauth2.NewClient(context.TODO(), ts))
 
 	// TODO(bradfitz): paging over results if more than 500
 	apiGate()
diff --git a/cmd/coordinator/Dockerfile b/cmd/coordinator/Dockerfile
index 2765012..da9fe20 100644
--- a/cmd/coordinator/Dockerfile
+++ b/cmd/coordinator/Dockerfile
@@ -5,13 +5,17 @@
 FROM golang:1.8-wheezy
 LABEL maintainer "golang-dev@googlegroups.com"
 
-RUN go get -d cloud.google.com/go/compute/metadata
-RUN cd /go/src/cloud.google.com/go/compute/metadata && git reset --hard cd0da878c66091060d2e7403abd62192b3e387e0
+# You can verify this list with prdeps:
+# go get github.com/davecheney/prdeps
+# prdeps -d 1 golang.org/x/build/cmd/coordinator
+
+RUN go get -d cloud.google.com/go/compute/metadata cloud.google.com/go/datastore cloud.google.com/go/storage
+RUN cd /go/src/cloud.google.com/go && git reset --hard cd0da878c66091060d2e7403abd62192b3e387e0
 
 RUN go get -d golang.org/x/time/rate
 RUN cd /go/src/golang.org/x/time/rate && git reset --hard f51c12702a4d776e4c1fa9b0fabab841babae631
 
-RUN go get -d golang.org/x/oauth2
+RUN go get -d golang.org/x/oauth2 golang.org/x/oauth2/google
 RUN cd /go/src/golang.org/x/oauth2 && git reset --hard 314dd2c0bf3ebd592ec0d20847d27e79d0dbe8dd
 
 RUN go get -d golang.org/x/crypto/acme/autocert
@@ -23,7 +27,7 @@
 RUN go get -d golang.org/x/net/context
 RUN cd /go/src/golang.org/x/net && git reset --hard f2499483f923065a842d38eb4c7f1927e6fc6e6d
 
-RUN go get -d google.golang.org/api/container/v1
+RUN go get -d google.golang.org/api/container/v1 google.golang.org/api/compute/v1 google.golang.org/api/googleapi
 RUN cd /go/src/google.golang.org/api && git reset --hard dfa61ae24628a06502b9c2805d983b57e89399b5
 
 RUN go get -d google.golang.org/genproto/googleapis/type/latlng
diff --git a/cmd/coordinator/buildongce/create.go b/cmd/coordinator/buildongce/create.go
index 4268952..732bc80 100644
--- a/cmd/coordinator/buildongce/create.go
+++ b/cmd/coordinator/buildongce/create.go
@@ -6,6 +6,7 @@
 
 import (
 	"bytes"
+	"context"
 	"encoding/json"
 	"errors"
 	"flag"
@@ -20,11 +21,9 @@
 	"text/template"
 	"time"
 
-	"go4.org/cloud/google/gceutil"
-
 	"cloud.google.com/go/datastore"
+	"go4.org/cloud/google/gceutil"
 	"golang.org/x/build/buildenv"
-	"golang.org/x/oauth2"
 	"golang.org/x/oauth2/google"
 	compute "google.golang.org/api/compute/v1"
 	dm "google.golang.org/api/deploymentmanager/v2"
@@ -143,7 +142,7 @@
 		os.Setenv("GOOGLE_APPLICATION_CREDENTIALS", keyFile)
 	}
 
-	oauthClient, err = google.DefaultClient(oauth2.NoContext, compute.CloudPlatformScope, compute.ComputeScope, compute.DevstorageFullControlScope)
+	oauthClient, err = google.DefaultClient(context.Background(), compute.CloudPlatformScope, compute.ComputeScope, compute.DevstorageFullControlScope)
 	if err != nil {
 		log.Fatalf("could not create oAuth client: %v", err)
 	}
diff --git a/cmd/gitmirror/Dockerfile b/cmd/gitmirror/Dockerfile
index 8a67c9b..ec4bec2 100644
--- a/cmd/gitmirror/Dockerfile
+++ b/cmd/gitmirror/Dockerfile
@@ -12,31 +12,18 @@
 # then I want to make sure that FROM base is rebuilt always when things in
 # x/build change.
 
+# You can verify this list with prdeps:
+# go get github.com/davecheney/prdeps
+# prdeps -d 1 golang.org/x/build/cmd/coordinator
+
 RUN go get -d cloud.google.com/go/compute/metadata
 RUN cd /go/src/cloud.google.com/go/compute/metadata && git reset --hard cd0da878c66091060d2e7403abd62192b3e387e0
+# Need to rerun because cd0da878 depends on gax-go and tip doesn't.
+RUN go get -d -v cloud.google.com/go/compute/metadata
 
-RUN go get -d golang.org/x/time/rate
-RUN cd /go/src/golang.org/x/time/rate && git reset --hard f51c12702a4d776e4c1fa9b0fabab841babae631
-
-RUN go get -d golang.org/x/oauth2
-RUN cd /go/src/golang.org/x/oauth2 && git reset --hard 314dd2c0bf3ebd592ec0d20847d27e79d0dbe8dd
-
-RUN go get -d go4.org/syncutil
-RUN cd /go/src/go4.org && git reset --hard 7ce08ca145dbe0e66a127c447b80ee7914f3e4f9
-
-RUN go get -d golang.org/x/net/context
+RUN go get -d golang.org/x/net/context golang.org/x/net/context/ctxhttp
 RUN cd /go/src/golang.org/x/net && git reset --hard f2499483f923065a842d38eb4c7f1927e6fc6e6d
 
-RUN go get -d google.golang.org/api/container/v1
-RUN cd /go/src/google.golang.org/api && git reset --hard dfa61ae24628a06502b9c2805d983b57e89399b5
-
-RUN go get -d google.golang.org/genproto/googleapis/type/latlng
-RUN cd /go/src/google.golang.org/genproto  && git reset --hard b3e7c2fb04031add52c4817f53f43757ccbf9c18
-RUN go get -d google.golang.org/genproto/googleapis/datastore/v1
-
-RUN go get -d gopkg.in/inf.v0
-RUN cd /go/src/gopkg.in/inf.v0 && git reset --hard 3887ee99ecf07df5b447e9b00d9c0b2adaa9f3e4
-
 RUN cd /go/src/google.golang.org/grpc && git reset --hard 50955793b0183f9de69bd78e2ec251cf20aab121
 
 COPY /cmd/gitmirror/install-apt-deps.sh /scripts/install-apt-deps.sh
diff --git a/cmd/gomote/push.go b/cmd/gomote/push.go
index d4caf9a..3ff8e6b 100644
--- a/cmd/gomote/push.go
+++ b/cmd/gomote/push.go
@@ -54,7 +54,6 @@
 	}
 
 	haveGo14 := false
-	haveGo := false
 	remote := map[string]buildlet.DirEntry{} // keys like "src/make.bash"
 
 	lsOpts := buildlet.ListDirOpts{
@@ -78,7 +77,6 @@
 			return
 		}
 		if strings.HasPrefix(name, "go/") {
-			haveGo = true
 			remote[name[len("go/"):]] = ent
 		}
 
@@ -95,15 +93,6 @@
 		}
 	}
 
-	// TODO(bradfitz,adg): if !haveGo, then run 'git rev-parse
-	// HEAD' in goroot and see what the user's HEAD is,
-	// approximately. Then tell the buildlet to fetch that tarball
-	// directly from Gerrit as a base. Then do another ListDir to
-	// the buildlet to get the new list, which will result in a
-	// smaller upload payload. This is important when working from
-	// home with a slower network connection to GCE. (upload a few
-	// KB instead of 10-40 MB)
-
 	type fileInfo struct {
 		fi   os.FileInfo
 		sha1 string // if regular file
diff --git a/cmd/pubsubhelper/pubsubhelper.go b/cmd/pubsubhelper/pubsubhelper.go
index cb4f1ed..07ffae0 100644
--- a/cmd/pubsubhelper/pubsubhelper.go
+++ b/cmd/pubsubhelper/pubsubhelper.go
@@ -280,7 +280,7 @@
 	tp := textproto.NewReader(bufio.NewReader(bytes.NewReader(headerBytes)))
 	hdr, err := tp.ReadMIMEHeader()
 	if err != nil {
-		log.Printf("Ignoring ReadMIMEHeader error: %v    from email:\n%s", headerBytes)
+		log.Printf("Ignoring ReadMIMEHeader error: %v    from email:\n%s", err, headerBytes)
 		return nil
 	}
 	changeNum, _ := strconv.Atoi(hdr.Get("X-Gerrit-Change-Number"))
diff --git a/cmd/rundockerbuildlet/rundockerbuildlet.go b/cmd/rundockerbuildlet/rundockerbuildlet.go
index 77daa9c..9bf600e 100644
--- a/cmd/rundockerbuildlet/rundockerbuildlet.go
+++ b/cmd/rundockerbuildlet/rundockerbuildlet.go
@@ -90,7 +90,7 @@
 			continue
 		}
 		log.Printf("Creating %s ...", name)
-		keyFile := fmt.Sprintf("/tmp/buildkey%s/gobuildkey", num)
+		keyFile := fmt.Sprintf("/tmp/buildkey%02d/gobuildkey", num)
 		if err := os.MkdirAll(filepath.Dir(keyFile), 0700); err != nil {
 			return err
 		}
diff --git a/devapp/noappengine.go b/devapp/noappengine.go
index 822ddc2..292a84f 100644
--- a/devapp/noappengine.go
+++ b/devapp/noappengine.go
@@ -155,6 +155,10 @@
 			return
 		}
 		fi, err := os.Stat(filename)
+		if err != nil {
+			githubOnceErr = err
+			return
+		}
 		if fi.Mode()&0077 != 0 {
 			githubOnceErr = fmt.Errorf("reading token: %s mode is %#o, want %#o", shortFilename, fi.Mode()&0777, fi.Mode()&0700)
 			return
diff --git a/maintner/logger.go b/maintner/logger.go
index 6f71f43..f030c37 100644
--- a/maintner/logger.go
+++ b/maintner/logger.go
@@ -171,7 +171,6 @@
 				}
 				select {
 				case ch <- m:
-					break
 				case <-ctx.Done():
 					return ctx.Err()
 				}