Merge remote-tracking branch 'upstream/master' into staging

40 files changed, 560 insertions, 220 deletions

diff --git a/pkgs/tools/X11/xidlehook/default.nix b/pkgs/tools/X11/xidlehook/default.nix
new file mode 100644
index 000000000000..733a8eb630dd
--- /dev/null
+++ b/pkgs/tools/X11/xidlehook/default.nix
@@ -0,0 +1,33 @@
+{ lib, rustPlatform, fetchFromGitHub, x11, xorg, libpulseaudio, pkgconfig, patchelf
+, stdenv}:
+
+rustPlatform.buildRustPackage rec {
+  name = "xidlehook-${version}";
+  version = "0.4.6";
+
+  src = fetchFromGitHub {
+    owner = "jD91mZM2";
+    repo = "xidlehook";
+    rev = version;
+
+    sha256 = "0h84ichm1v2wdmm4w1n7jr70yfb9hhi7kykvd99ppg00h1x9lr7w";
+  };
+
+  cargoSha256 = "0a1bl6fnfw6xy71q3b5zij52p9skylj1ivqj8my44bfsid2qfn7d";
+
+  buildInputs = [ x11 xorg.libXScrnSaver libpulseaudio ];
+  nativeBuildInputs = [ pkgconfig patchelf ];
+
+  postFixup = lib.optionalString stdenv.isLinux ''
+    RPATH="$(patchelf --print-rpath $out/bin/xidlehook)"
+    patchelf --set-rpath "$RPATH:${libpulseaudio}/lib" $out/bin/xidlehook
+  '';
+
+  meta = with lib; {
+    description = "xautolock rewrite in Rust, with a few extra features";
+    homepage = https://github.com/jD91mZM2/xidlehook;
+    license = licenses.mit;
+    maintainers = with maintainers; [ jD91mZM2 ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/tools/admin/bluemix-cli/default.nix b/pkgs/tools/admin/bluemix-cli/default.nix
new file mode 100644
index 000000000000..2c24728fab9f
--- /dev/null
+++ b/pkgs/tools/admin/bluemix-cli/default.nix
@@ -0,0 +1,25 @@
+{ lib, stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  name = "bluemix-cli-${version}";
+  version = "0.6.6";
+
+  src = fetchurl {
+    name = "linux64.tar.gz";
+    url = "https://clis.ng.bluemix.net/download/bluemix-cli/${version}/linux64";
+    sha256 = "1swjawc4szqrl0wgjcb4na1hbxylaqp2mp53lxsbfbk1db0c3y85";
+  };
+
+  installPhase = ''
+    install -m755 -D --target $out/bin bin/bluemix bin/bluemix-analytics bin/cfcli/cf
+  '';
+
+  meta = with lib; {
+    description  = "Administration CLI for IBM BlueMix";
+    homepage     = "https://console.bluemix.net/docs/cli/index.html";
+    downloadPage = "https://console.bluemix.net/docs/cli/reference/bluemix_cli/download_cli.html#download_install";
+    license      = licenses.unfree;
+    maintainers  = [ maintainers.tazjin ];
+    platforms    = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/tools/audio/abcm2ps/default.nix b/pkgs/tools/audio/abcm2ps/default.nix
index f93231d80222..6d782fdba35c 100644
--- a/pkgs/tools/audio/abcm2ps/default.nix
+++ b/pkgs/tools/audio/abcm2ps/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "abcm2ps-${version}";
-  version = "8.13.20";
+  version = "8.13.21";
 
   src = fetchFromGitHub {
     owner = "leesavide";
     repo = "abcm2ps";
     rev = "v${version}";
-    sha256 = "0zgwrclky6b1l1pd07s31azyxf4clwi3cp5x0wjix0wp78b89pbx";
+    sha256 = "03r98xdw2vdwsi726i0zb7p0ljp3fpzjl1nhzfwz57m3zmqvz6r1";
   };
 
   prePatch = ''
diff --git a/pkgs/tools/audio/abcmidi/default.nix b/pkgs/tools/audio/abcmidi/default.nix
index ff6a7af03efe..a0e7b1f906c9 100644
--- a/pkgs/tools/audio/abcmidi/default.nix
+++ b/pkgs/tools/audio/abcmidi/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "abcMIDI-${version}";
-  version = "2018.04.24";
+  version = "2018.05.02";
 
   src = fetchzip {
     url = "http://ifdo.ca/~seymour/runabc/${name}.zip";
-    sha256 = "02n5xnagj1z44b23zmaxdkmn8nisrb34r8hb5xs7cr1wq7m4fmlh";
+    sha256 = "0pva0kwkwdrq4mfgiz389dhaqv66csqjaddirzxmhvvi6qji5d24";
   };
 
   # There is also a file called "makefile" which seems to be preferred by the standard build phase
diff --git a/pkgs/tools/backup/btrbk/default.nix b/pkgs/tools/backup/btrbk/default.nix
index ace543186651..958afa3f6a9c 100644
--- a/pkgs/tools/backup/btrbk/default.nix
+++ b/pkgs/tools/backup/btrbk/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, coreutils, bash, btrfs-progs, openssh, perl, perlPackages
-, asciidoc-full, makeWrapper }:
+, utillinux, asciidoc, makeWrapper }:
 
 stdenv.mkDerivation rec {
   name = "btrbk-${version}";
@@ -10,7 +10,9 @@ stdenv.mkDerivation rec {
     sha256 = "04ahfm52vcf1w0c2km0wdgj2jpffp45bpawczmygcg8fdcm021lp";
   };
 
-  buildInputs = with perlPackages; [ asciidoc-full makeWrapper perl DateCalc ];
+  nativeBuildInputs = [ asciidoc makeWrapper ];
+
+  buildInputs = with perlPackages; [ perl DateCalc ];
 
   preInstall = ''
     for f in $(find . -name Makefile); do
@@ -27,6 +29,10 @@ stdenv.mkDerivation rec {
       --replace "/bin/date" "${coreutils}/bin/date" \
       --replace "/bin/echo" "${coreutils}/bin/echo" \
       --replace '$btrbk' 'btrbk'
+
+    # Fix SSH filter script
+    sed -i '/^export PATH/d' ssh_filter_btrbk.sh
+    substituteInPlace ssh_filter_btrbk.sh --replace logger ${utillinux}/bin/logger
   '';
 
   preFixup = ''
diff --git a/pkgs/tools/backup/mydumper/default.nix b/pkgs/tools/backup/mydumper/default.nix
index da8805bc226e..e87878551254 100644
--- a/pkgs/tools/backup/mydumper/default.nix
+++ b/pkgs/tools/backup/mydumper/default.nix
@@ -2,14 +2,14 @@
 , glib, zlib, pcre, mysql, libressl }:
 
 stdenv.mkDerivation rec {
-  version = "0.9.3";
+  version = "0.9.5";
   name = "mydumper-${version}";
 
   src = fetchFromGitHub {
     owner  = "maxbube";
     repo   = "mydumper";
     rev    = "v${version}";
-    sha256 = "139v6707sxyslg7n1fii8b1ybdq50hbqhc8zf6p1cr3h2hhl6ns9";
+    sha256 = "0vbz0ri5hm6yzkrcgnaj8px6bf59myr5dbhyy7fd4cv44hr685k6";
   };
 
   nativeBuildInputs = [ cmake pkgconfig ];
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
     description = ''High-perfomance MySQL backup tool'';
     homepage = https://github.com/maxbube/mydumper;
     license = licenses.gpl3;
-    platforms = platforms.all;
+    platforms = platforms.linux;
     maintainers = with maintainers; [ izorkin ];
   };
 }
diff --git a/pkgs/tools/bootloaders/refind/default.nix b/pkgs/tools/bootloaders/refind/default.nix
index f305cff0ea25..80add316094c 100644
--- a/pkgs/tools/bootloaders/refind/default.nix
+++ b/pkgs/tools/bootloaders/refind/default.nix
@@ -57,7 +57,7 @@ stdenv.mkDerivation rec {
     install -D -m0644 gptsync/gptsync_${efiPlatform}.efi $out/share/refind/tools_${efiPlatform}/gptsync_${efiPlatform}.efi
 
     # helper scripts
-    install -D -m0755 refind-install $out/share/refind/refind-install
+    install -D -m0755 refind-install $out/bin/refind-install
     install -D -m0755 mkrlconf $out/bin/refind-mkrlconf
     install -D -m0755 mvrefind $out/bin/refind-mvrefind
     install -D -m0755 fonts/mkfont.sh $out/bin/refind-mkfont
@@ -86,21 +86,13 @@ stdenv.mkDerivation rec {
     # keys
     install -D -m0644 keys/* $out/share/refind/keys/
 
-    # The refind-install script assumes that all resource files are
-    # installed under the same directory as the script itself. To avoid
-    # having to patch around this assumption, generate a wrapper that
-    # cds into $out/share/refind and executes the real script from
-    # there.
-    cat >$out/bin/refind-install <<EOF
-#! ${stdenv.shell}
-cd $out/share/refind && exec -a $out/bin/refind-install ./refind-install \$*
-EOF
-    chmod +x $out/bin/refind-install
+    # Fix variable definition of 'RefindDir' which is used to locate ressource files.
+    sed -i "s,\bRefindDir=.*,RefindDir=$out/share/refind,g" $out/bin/refind-install
 
     # Patch uses of `which`.  We could patch in calls to efibootmgr,
     # openssl, convert, and openssl, but that would greatly enlarge
     # refind's closure (from ca 28MB to over 400MB).
-    sed -i 's,`which \(.*\)`,`type -p \1`,g' $out/share/refind/refind-install
+    sed -i 's,`which \(.*\)`,`type -p \1`,g' $out/bin/refind-install
     sed -i 's,`which \(.*\)`,`type -p \1`,g' $out/bin/refind-mvrefind
     sed -i 's,`which \(.*\)`,`type -p \1`,g' $out/bin/refind-mkfont
   '';
diff --git a/pkgs/tools/filesystems/blobfuse/default.nix b/pkgs/tools/filesystems/blobfuse/default.nix
index f847cde98a9e..b5694535e946 100644
--- a/pkgs/tools/filesystems/blobfuse/default.nix
+++ b/pkgs/tools/filesystems/blobfuse/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "blobfuse-${version}";
-  version = "1.0.1-RC-Preview";
+  version = "1.0.2";
 
   src = fetchFromGitHub {
     owner  = "Azure";
     repo   = "azure-storage-fuse";
     rev    = "v${version}";
-    sha256 = "143rxgfmprir4a7frrv8llkv61jxzq50w2v8wn32vx6gl6vci1zs";
+    sha256 = "1qh04z1fsj1l6l12sz9yl2sy9hwlrnzac54hwrr7wvsgv90n9gbp";
   };
 
   buildInputs = [ curl gnutls libgcrypt libuuid fuse ];
@@ -20,4 +20,4 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ jbgi ];
     platforms = platforms.linux;
   };
-}
+}
\ No newline at end of file
diff --git a/pkgs/tools/filesystems/ntfs-3g/default.nix b/pkgs/tools/filesystems/ntfs-3g/default.nix
index 6acf5e221d47..4bcef5a83f04 100644
--- a/pkgs/tools/filesystems/ntfs-3g/default.nix
+++ b/pkgs/tools/filesystems/ntfs-3g/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   patches = [
     (fetchpatch {
-      url = "https://sources.debian.net/data/main/n/ntfs-3g/1:2016.2.22AR.1-4/debian/patches/0003-CVE-2017-0358.patch";
+      url = "https://sources.debian.org/data/main/n/ntfs-3g/1:2016.2.22AR.1+dfsg-1/debian/patches/0003-CVE-2017-0358.patch";
       sha256 = "0hd05q9q06r18k8pmppvch1sslzqln5fvqj51d5r72g4mnpavpj3";
     })
   ];
diff --git a/pkgs/tools/graphics/gnuplot/default.nix b/pkgs/tools/graphics/gnuplot/default.nix
index a177f33bb377..b2b8508640bf 100644
--- a/pkgs/tools/graphics/gnuplot/default.nix
+++ b/pkgs/tools/graphics/gnuplot/default.nix
@@ -20,11 +20,11 @@ let
   withX = libX11 != null && !aquaterm && !stdenv.isDarwin;
 in
 stdenv.mkDerivation rec {
-  name = "gnuplot-5.2.2";
+  name = "gnuplot-5.2.3";
 
   src = fetchurl {
     url = "mirror://sourceforge/gnuplot/${name}.tar.gz";
-    sha256 = "18diyy7aib9mn098x07g25c7jij1x7wbfpicz0z8gwxx08px45m4";
+    sha256 = "0977vgjszjpqhz2jahq07zmcmi0k9d6v7wq70ph2klfrb29qrdgy";
   };
 
   nativeBuildInputs = [ makeWrapper pkgconfig texinfo ] ++ lib.optional withQt qttools;
diff --git a/pkgs/tools/misc/fwup/default.nix b/pkgs/tools/misc/fwup/default.nix
index e334a2a8813e..3903fde3302e 100644
--- a/pkgs/tools/misc/fwup/default.nix
+++ b/pkgs/tools/misc/fwup/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   name = "fwup-${version}";
-  version = "1.0.0";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "fhunleth";
     repo = "fwup";
     rev = "v${version}";
-    sha256 = "1v79q5s4lm8scrz9nmqcszyh40is6k7hkr15r4aljyfbp1gamsfs";
+    sha256 = "1jhl50yj5h6wl3fx1hcqi4vb7633srmbbcpsgajprc5fxscjgapm";
   };
 
   doCheck = true;
diff --git a/pkgs/tools/misc/lolcat/Gemfile.lock b/pkgs/tools/misc/lolcat/Gemfile.lock
index 1ef7e5527961..3c4646ddf48f 100644
--- a/pkgs/tools/misc/lolcat/Gemfile.lock
+++ b/pkgs/tools/misc/lolcat/Gemfile.lock
@@ -1,7 +1,7 @@
 GEM
   remote: http://rubygems.org/
   specs:
-    lolcat (99.9.10)
+    lolcat (99.9.11)
       manpages (~> 0.6.1)
       paint (~> 2.0.0)
       trollop (~> 2.1.2)
diff --git a/pkgs/tools/misc/lolcat/gemset.nix b/pkgs/tools/misc/lolcat/gemset.nix
index 78677edcc34b..86069f7ecc0e 100644
--- a/pkgs/tools/misc/lolcat/gemset.nix
+++ b/pkgs/tools/misc/lolcat/gemset.nix
@@ -3,10 +3,10 @@
     dependencies = ["manpages" "paint" "trollop"];
     source = {
       remotes = ["http://rubygems.org"];
-      sha256 = "0fidwmgywkklxf2a4f4dl82b8mx4w4n73vqm6jqgyqd3nfmgysnl";
+      sha256 = "1z0j354sj2qm2srgz3i28s347fwylvv1j614806cr33zcd1j4mwp";
       type = "gem";
     };
-    version = "99.9.10";
+    version = "99.9.11";
   };
   manpages = {
     source = {
diff --git a/pkgs/tools/misc/powerline-rs/default.nix b/pkgs/tools/misc/powerline-rs/default.nix
new file mode 100644
index 000000000000..e48816db935a
--- /dev/null
+++ b/pkgs/tools/misc/powerline-rs/default.nix
@@ -0,0 +1,31 @@
+{ lib, rustPlatform, fetchFromGitHub, pkgconfig, file, perl, cmake, openssl_1_1_0, libssh2, libgit2, libzip }:
+rustPlatform.buildRustPackage rec {
+  pname = "powerline-rs";
+  name = "${pname}-${version}";
+  version = "0.1.7";
+
+  src = fetchFromGitHub {
+    owner = "jD91mZM2";
+    repo = "powerline-rs";
+    rev = version;
+
+    sha256 = "0ry1axia78sp9vmn6p119l69sj3dqx2san1k71a5npf60rf4gfkc";
+  };
+
+  cargoSha256 = "184s432a6damzvl0lv6jar1iml9dq60r190aqjy44lcg938981zc";
+
+  nativeBuildInputs = [ pkgconfig file perl cmake ];
+  buildInputs = [ openssl_1_1_0 libssh2 libgit2 libzip ];
+
+  postInstall = ''
+    install -Dm 755 "${pname}.bash" "$out/etc/bash_completion.d/${pname}"
+    install -Dm 755 "${pname}.fish" "$out/share/fish/vendor_completions.d/${pname}"
+  '';
+
+  meta = with lib; {
+    description = "powerline-shell rewritten in Rust, inspired by powerline-go";
+    license = licenses.mit;
+    maintainers = with maintainers; [ jD91mZM2 ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/tools/misc/pspg/default.nix b/pkgs/tools/misc/pspg/default.nix
index ddd76a344e01..0a261671872d 100644
--- a/pkgs/tools/misc/pspg/default.nix
+++ b/pkgs/tools/misc/pspg/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "pspg-${version}";
-  version = "1.1.0";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "okbob";
     repo = "pspg";
     rev = "${version}";
-    sha256 = "10r6jfcqw4wclp84f07g3bda844csgm4sh7cjsnk2smmal7nhybs";
+    sha256 = "19jiixanyghasd2awkxx7c224fz01d9v0c4qxn4msvkny39m3gz9";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/tools/misc/termplay/default.nix b/pkgs/tools/misc/termplay/default.nix
new file mode 100644
index 000000000000..5771ec6aff19
--- /dev/null
+++ b/pkgs/tools/misc/termplay/default.nix
@@ -0,0 +1,38 @@
+{ rustPlatform, fetchFromGitHub, lib, makeWrapper, gst_all_1, libsixel }:
+rustPlatform.buildRustPackage rec {
+  name = "termplay-${version}";
+  version = "2.0.4";
+
+  src = fetchFromGitHub {
+    owner = "jD91mZM2";
+    repo = "termplay";
+    rev = version;
+
+    sha256 = "0qgx9xmi8n3sq5n5m6gai777sllw9hyki2kwsj2k4h1ykibzq9r0";
+  };
+
+  cargoBuildFlags = ["--features" "bin"];
+  cargoSha256 = "1ghvp4n6mvckamvn3hk672wh29jlrwmhrd4hv3mh98li1x9ssbmf";
+
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [
+    gst_all_1.gstreamer
+    gst_all_1.gst-plugins-base
+    gst_all_1.gst-plugins-good
+    gst_all_1.gst-plugins-ugly
+    gst_all_1.gst-plugins-bad
+    libsixel
+  ];
+
+  postInstall = ''
+    wrapProgram $out/bin/termplay --prefix GST_PLUGIN_SYSTEM_PATH_1_0 : "$GST_PLUGIN_SYSTEM_PATH_1_0"
+  '';
+
+  meta = with lib; {
+    description = "Play an image/video in your terminal";
+    homepage = https://jd91mzm2.github.io/termplay/;
+    license = licenses.mit;
+    maintainers = with maintainers; [ jD91mZM2 ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/tools/misc/yubikey-personalization-gui/default.nix b/pkgs/tools/misc/yubikey-personalization-gui/default.nix
index e6a1c93d2bb6..d507816dbd38 100644
--- a/pkgs/tools/misc/yubikey-personalization-gui/default.nix
+++ b/pkgs/tools/misc/yubikey-personalization-gui/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, yubikey-personalization, qt4, qmake4Hook, libyubikey }:
+{ stdenv, fetchurl, pkgconfig, yubikey-personalization, qtbase, qmake, libyubikey }:
 
 stdenv.mkDerivation rec {
   name = "yubikey-personalization-gui-3.1.25";
@@ -8,8 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "1knyv5yss8lhzaff6jpfqv12fjf1b8b21mfxzx3qi0hw4nl8n2v8";
   };
 
-  nativeBuildInputs = [ pkgconfig qmake4Hook ];
-  buildInputs = [ yubikey-personalization qt4 libyubikey ];
+  nativeBuildInputs = [ pkgconfig qmake ];
+  buildInputs = [ yubikey-personalization qtbase libyubikey ];
   
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/tools/networking/cjdns/default.nix b/pkgs/tools/networking/cjdns/default.nix
index 817da08c05e3..60fd42962fb7 100644
--- a/pkgs/tools/networking/cjdns/default.nix
+++ b/pkgs/tools/networking/cjdns/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub, nodejs, which, python27, utillinux }:
 
-let version = "20.1"; in
+let version = "20.2"; in
 stdenv.mkDerivation {
   name = "cjdns-"+version;
 
@@ -8,7 +8,7 @@ stdenv.mkDerivation {
     owner = "cjdelisle";
     repo = "cjdns";
     rev = "cjdns-v${version}";
-    sha256 = "033q8av46y0q8vxyqvb4yjh1lz6a17mmk8lhdpwdcqnsws8xjjsw";
+    sha256 = "13zhcfwx8c3vdcf6ifivrgf8q7mgx00vnxcspdz88zk7dh65c6jn";
   };
 
   buildInputs = [ which python27 nodejs ] ++
diff --git a/pkgs/tools/networking/gmrender-resurrect/default.nix b/pkgs/tools/networking/gmrender-resurrect/default.nix
new file mode 100644
index 000000000000..6926f1522c71
--- /dev/null
+++ b/pkgs/tools/networking/gmrender-resurrect/default.nix
@@ -0,0 +1,36 @@
+{ stdenv, fetchFromGitHub, autoconf, automake, pkgconfig, makeWrapper
+, gstreamer, gst-plugins-base, gst-plugins-good, gst-plugins-bad, gst-plugins-ugly, gst-libav, libupnp }:
+
+let version = "4f221e6b85abf85957b547436e982d7a501a1718"; in
+
+stdenv.mkDerivation {
+  name = "gmrender-resurrect-${version}";
+
+  src = fetchFromGitHub {
+    owner = "hzeller";
+    repo = "gmrender-resurrect";
+    rev = "${version}";
+    sha256 = "1dmdhyz27bh74qmvncfd3kw7zqwnd05bhxcfjjav98z5qrxdygj4";
+  };
+
+  preConfigurePhases = "autoconfPhase";
+
+  autoconfPhase = "./autogen.sh";
+
+  buildInputs = [ gstreamer gst-plugins-base gst-plugins-good gst-plugins-bad gst-plugins-ugly gst-libav libupnp ];
+  nativeBuildInputs = [ autoconf automake pkgconfig makeWrapper ];
+
+  postInstall = ''
+    for prog in "$out/bin/"*; do
+        wrapProgram "$prog" --suffix GST_PLUGIN_SYSTEM_PATH : "${gst-plugins-base}/lib/gstreamer-1.0:${gst-plugins-good}/lib/gstreamer-1.0:${gst-plugins-bad}/lib/gstreamer-1.0:${gst-plugins-ugly}/lib/gstreamer-1.0:${gst-libav}/lib/gstreamer-1.0"
+    done
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Resource efficient UPnP/DLNA renderer, optimal for Raspberry Pi, CuBox or a general MediaServer";
+    homepage = https://github.com/hzeller/gmrender-resurrect;
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.koral ];
+  };
+}
diff --git a/pkgs/tools/networking/miniupnpd/default.nix b/pkgs/tools/networking/miniupnpd/default.nix
index 3a1bba4ce8c1..2f907df8dcac 100644
--- a/pkgs/tools/networking/miniupnpd/default.nix
+++ b/pkgs/tools/networking/miniupnpd/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, iptables, libuuid, pkgconfig }:
 
 stdenv.mkDerivation rec {
-  name = "miniupnpd-2.0.20180422";
+  name = "miniupnpd-2.0.20180503";
 
   src = fetchurl {
     url = "http://miniupnp.free.fr/files/download.php?file=${name}.tar.gz";
-    sha256 = "03g9r519p127sj6rl2x535022bwj8vzvdwp4385v7vnjrd4dswzy";
+    sha256 = "031aw66b09ij2yv640xjbp302vkwr8ima5cz7a0951jzhqbfs6xn";
     name = "${name}.tar.gz";
   };
 
diff --git a/pkgs/tools/networking/pacparser/default.nix b/pkgs/tools/networking/pacparser/default.nix
new file mode 100644
index 000000000000..54b3cf8fd81e
--- /dev/null
+++ b/pkgs/tools/networking/pacparser/default.nix
@@ -0,0 +1,27 @@
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  name = "pacparser-${version}";
+  version = "1.3.7";
+
+  src = fetchurl {
+    url = "https://github.com/manugarg/pacparser/releases/download/${version}/${name}.tar.gz";
+    sha256 = "0jfjm8lqyhdy9ny8a8icyd4rhclhfn608cr1i15jml82q8pyqj7b";
+  };
+
+  makeFlags = [ "NO_INTERNET=1" ];
+
+  preConfigure = ''
+    export makeFlags="$makeFlags PREFIX=$out"
+    patchShebangs tests/runtests.sh
+    cd src
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A library to parse proxy auto-config (PAC) files";
+    homepage = http://pacparser.manugarg.com/;
+    license = licenses.lgpl3;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ abbradar ];
+  };
+}
diff --git a/pkgs/tools/networking/wget/default.nix b/pkgs/tools/networking/wget/default.nix
index e2d4712d5bc3..5c1636ddb862 100644
--- a/pkgs/tools/networking/wget/default.nix
+++ b/pkgs/tools/networking/wget/default.nix
@@ -5,11 +5,11 @@
 , openssl ? null }:
 
 stdenv.mkDerivation rec {
-  name = "wget-1.19.4";
+  name = "wget-1.19.5";
 
   src = fetchurl {
     url = "mirror://gnu/wget/${name}.tar.lz";
-    sha256 = "16jmcqcasx3q9k4azssryli9qyxfq0sfijw998g8zp58cnwzzh1g";
+    sha256 = "0xfaxmlnih7dhkyks5wi4vrn0n1xshmy6gx6fb2k1120sprydyr9";
   };
 
   patches = [
diff --git a/pkgs/tools/package-management/nix-pin/default.nix b/pkgs/tools/package-management/nix-pin/default.nix
index bb3a1faa0c3b..6f109cd9f413 100644
--- a/pkgs/tools/package-management/nix-pin/default.nix
+++ b/pkgs/tools/package-management/nix-pin/default.nix
@@ -1,20 +1,22 @@
-{ pkgs, stdenv, fetchFromGitHub, mypy, python3 }:
+{ lib, pkgs, stdenv, fetchFromGitHub, mypy, python3, nix, git, makeWrapper }:
 let self = stdenv.mkDerivation rec {
   name = "nix-pin-${version}";
-  version = "0.2.2";
+  version = "0.3.0";
   src = fetchFromGitHub {
     owner = "timbertson";
     repo = "nix-pin";
-    rev = "version-0.2.2";
-    sha256 = "1kw43kzy4m6lnnif51r2a8i4vcgr7d4vqb1c75p7pk2b9y3jwxsz";
+    rev = "version-0.3.0";
+    sha256 = "1kq50v8m8y1wji63b7y3wh6nv3ahvdxvvbsb07day2zzf5ysy8kj";
   };
-  buildInputs = [ python3 mypy ];
+  buildInputs = [ python3 mypy makeWrapper ];
   buildPhase = ''
     mypy bin/*
   '';
   installPhase = ''
     mkdir "$out"
     cp -r bin share "$out"
+    wrapProgram $out/bin/nix-pin \
+      --prefix PATH : "${lib.makeBinPath [ nix git ]}"
   '';
   passthru =
     let
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index 230994897234..1d15bd11b7fa 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -132,10 +132,10 @@ in rec {
   }) // { perl-bindings = nixStable; };
 
   nixStable = (common rec {
-    name = "nix-2.0.1";
+    name = "nix-2.0.2";
     src = fetchurl {
       url = "http://nixos.org/releases/nix/${name}/${name}.tar.xz";
-      sha256 = "689c33b9885b56b7817bf94aad3bc7ccf50710ebb34b01c5a5a2ac4e472750b1";
+      sha256 = "2d2984410f73d759485526e594ce41b9819fafa4676f4f85a93dbdd5352a1435";
     };
   }) // { perl-bindings = perl-bindings { nix = nixStable; }; };
 
diff --git a/pkgs/tools/security/eid-mw/default.nix b/pkgs/tools/security/eid-mw/default.nix
index a11b70917c8d..eb8861486747 100644
--- a/pkgs/tools/security/eid-mw/default.nix
+++ b/pkgs/tools/security/eid-mw/default.nix
@@ -1,20 +1,30 @@
 { stdenv, fetchFromGitHub
 , autoreconfHook, pkgconfig
-, gtk3, nssTools, pcsclite }:
+, gtk3, nssTools, pcsclite
+, libxml2, libproxy 
+, openssl, curl
+, makeWrapper }:
 
 stdenv.mkDerivation rec {
   name = "eid-mw-${version}";
-  version = "4.1.19";
+  version = "4.4.1";
 
   src = fetchFromGitHub {
-    sha256 = "191c74kxfrfb894v8y4vi2iygyffjy9jjq5fj7cnnddgwai5n3c5";
+    sha256 = "0an7xgj5rzl75kq6qfrmm886v639hhlh7c9yfs8iihc47wghpma8"; 
     rev = "v${version}";
     repo = "eid-mw";
     owner = "Fedict";
   };
 
-  nativeBuildInputs = [ autoreconfHook pkgconfig ];
-  buildInputs = [ gtk3 pcsclite ];
+  nativeBuildInputs = [ autoreconfHook pkgconfig makeWrapper ];
+  buildInputs = [ gtk3 pcsclite libxml2 libproxy curl openssl ];
+  preConfigure = ''
+    mkdir openssl
+    ln -s ${openssl.out}/lib openssl
+    ln -s ${openssl.bin}/bin openssl
+    ln -s ${openssl.dev}/include openssl
+    export SSL_PREFIX=$(realpath openssl)
+    '';
 
   postPatch = ''
     sed 's@m4_esyscmd_s(.*,@[${version}],@' -i configure.ac
@@ -22,41 +32,48 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--enable-dialogs=yes" ];
 
-  enableParallelBuilding = true;
-
-  doCheck = true;
-
   postInstall = ''
     install -D ${./eid-nssdb.in} $out/bin/eid-nssdb
     substituteInPlace $out/bin/eid-nssdb \
       --replace "modutil" "${nssTools}/bin/modutil"
 
-    # Only provides a useless "about-eid-mw.desktop" that segfaults anyway:
-    rm -r $out/share/applications $out/bin/about-eid-mw
+    rm $out/bin/about-eid-mw
+    wrapProgram $out/bin/eid-viewer --prefix XDG_DATA_DIRS : "$out/share/gsettings-schemas/$name" 
   '';
 
+  enableParallelBuilding = true;
+
+  doCheck = true;
+
   meta = with stdenv.lib; {
     description = "Belgian electronic identity card (eID) middleware";
     homepage = http://eid.belgium.be/en/using_your_eid/installing_the_eid_software/linux/;
     license = licenses.lgpl3;
     longDescription = ''
       Allows user authentication and digital signatures with Belgian ID cards.
-      Also requires a running pcscd service and compatible card reader.
+      Also requires a running pcscd service and compatible card reader. 
+
+      eid-viewer is also installed.
 
+      **TO FIX:** 
+      The procedure below did not work for me, I had to install the .so directly in firefox as instructed at
+      https://eid.belgium.be/en/log-eid#7507
+      and specify
+      /run/current-system/sw/lib/libbeidpkcs11.so
+      as the path to the module.
+
+      This package only installs the libraries. To use eIDs in Firefox or
+      Chromium, the eID Belgium add-on must be installed.
       This package only installs the libraries. To use eIDs in NSS-compatible
       browsers like Chrom{e,ium} or Firefox, each user must first execute:
-
         ~$ eid-nssdb add
-
       (Running the script once as root with the --system option enables eID
       support for all users, but will *not* work when using Chrom{e,ium}!)
-
       Before uninstalling this package, it is a very good idea to run
-
         ~$ eid-nssdb [--system] remove
-
       and remove all ~/.pki and/or /etc/pki directories no longer needed.
     '';
     platforms = platforms.linux;
+    maintainers = with maintainers; [ bfortz ];
   };
 }
diff --git a/pkgs/tools/security/eid-viewer/default.nix b/pkgs/tools/security/eid-viewer/default.nix
deleted file mode 100644
index 10cc314fe1db..000000000000
--- a/pkgs/tools/security/eid-viewer/default.nix
+++ /dev/null
@@ -1,42 +0,0 @@
-{ stdenv, fetchurl, makeWrapper, jre, pcsclite }:
-
-stdenv.mkDerivation rec {
-  name = "eid-viewer-${version}";
-  version = "4.1.9";
-
-  src = fetchurl {
-    url = "https://downloads.services.belgium.be/eid/eid-viewer-${version}-v${version}.src.tar.gz";
-    sha256 = "0bq9jl4kl97j0dfhz4crcb1wqhn420z5vpg510zadvrmqjhy1x4g";
-  };
-
-  buildInputs = [ jre pcsclite ];
-  nativeBuildInputs = [ makeWrapper ];
-
-  unpackPhase = "tar -xzf ${src} --strip-components=1";
-
-  preConfigure = ''
-    substituteInPlace eid-viewer.sh.in --replace "exec java" "exec ${jre}/bin/java"
-  '';
-
-  postInstall = ''
-    wrapProgram $out/bin/eid-viewer --suffix LD_LIBRARY_PATH : ${pcsclite}/lib
-    cat >> $out/share/applications/eid-viewer.desktop << EOF
-    # eid-viewer creates XML without a header, making it "plain text":
-    MimeType=application/xml;text/xml;text/plain
-    EOF
-  '';
-
-  doCheck = true;
-
-  meta = with stdenv.lib; {
-    description = "Belgian electronic identity card (eID) viewer";
-    homepage = http://eid.belgium.be/en/using_your_eid/installing_the_eid_software/linux/;
-    license = licenses.lgpl3;
-    longDescription = ''
-      A simple, graphical Java application to view, print and save data from
-      Belgian electronic identity cards. Independent of the eid-mw package,
-      which is required to actually use your eID for authentication or signing.
-    '';
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/tools/security/gopass/default.nix b/pkgs/tools/security/gopass/default.nix
index 743f9136ae53..1bbd4169f2eb 100644
--- a/pkgs/tools/security/gopass/default.nix
+++ b/pkgs/tools/security/gopass/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoPackage, fetchFromGitHub, git, gnupg, makeWrapper }:
+{ stdenv, buildGoPackage, fetchFromGitHub, git, gnupg, xclip, makeWrapper }:
 
 buildGoPackage rec {
   version = "1.6.11";
@@ -18,6 +18,7 @@ buildGoPackage rec {
   wrapperPath = with stdenv.lib; makeBinPath ([
     git
     gnupg
+    xclip
   ]);
 
   postInstall = ''
diff --git a/pkgs/tools/security/john/default.nix b/pkgs/tools/security/john/default.nix
index 7552b21ed333..e55e97656f63 100644
--- a/pkgs/tools/security/john/default.nix
+++ b/pkgs/tools/security/john/default.nix
@@ -69,6 +69,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2;
     homepage = https://github.com/magnumripper/JohnTheRipper/;
     maintainers = with maintainers; [ offline ];
-    platforms = platforms.unix;
+    platforms = [ "x86_64-linux" "x86_64-darwin"];
   };
 }
diff --git a/pkgs/tools/security/lynis/default.nix b/pkgs/tools/security/lynis/default.nix
index e0a11f574181..56a47ea38743 100644
--- a/pkgs/tools/security/lynis/default.nix
+++ b/pkgs/tools/security/lynis/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "lynis";
-  version = "2.6.3";
+  version = "2.6.4";
   name = "${pname}-${version}";
 
   src = fetchFromGitHub {
     owner = "CISOfy";
     repo = "${pname}";
     rev = "${version}";
-    sha256 = "17xfs0jr0rf8xvk860l2wpxg0h1m2c1dq41lqnq6wga9jifxmzqd";
+    sha256 = "1p449gsackcavw5h9yn0ckk1fkakx9d55izi22gh8wfvijdfhw10";
   };
 
   nativeBuildInputs = [ makeWrapper perl ];
diff --git a/pkgs/tools/security/open-ecard/default.nix b/pkgs/tools/security/open-ecard/default.nix
new file mode 100644
index 000000000000..a0af51186edf
--- /dev/null
+++ b/pkgs/tools/security/open-ecard/default.nix
@@ -0,0 +1,64 @@
+{ stdenv, fetchurl, jre, pcsclite, makeDesktopItem, makeWrapper }:
+
+let
+  version = "1.2.4";
+
+  srcs = {
+    richclient = fetchurl {
+      url = "https://jnlp.openecard.org/richclient-${version}-20171212-0958.jar";
+      sha256 = "1ckhyhszp4zhfb5mn67lz603b55z814jh0sz0q5hriqzx017j7nr";
+    };
+    cifs = fetchurl {
+      url = "https://jnlp.openecard.org/cifs-${version}-20171212-0958.jar";
+      sha256 = "0rc862lx3y6sw87r1v5xjmqqpysyr1x6yqhycqmcdrwz0j3wykrr";
+    };
+    logo = fetchurl {
+      url = https://raw.githubusercontent.com/ecsec/open-ecard/1.2.3/gui/graphics/src/main/ext/oec_logo_bg-transparent.svg;
+      sha256 = "0rpmyv10vjx2yfpm03mqliygcww8af2wnrnrppmsazdplksaxkhs";
+    };
+  };
+in stdenv.mkDerivation rec {
+  appName = "open-ecard";
+  name = "${appName}-${version}";
+
+  src = srcs.richclient;
+
+  phases = "installPhase";
+
+  buildInputs = [ makeWrapper ];
+
+  desktopItem = makeDesktopItem {
+    name = appName;
+    desktopName = "Open eCard App";
+    genericName = "eCard App";
+    comment = "Client side implementation of the eCard-API-Framework";
+    icon = "oec_logo_bg-transparent.svg";
+    exec = appName;
+    categories = "Utility;Security;";
+  };
+
+  installPhase = ''
+    mkdir -p $out/share/java
+    cp ${srcs.richclient} $out/share/java/richclient-${version}.jar
+    cp ${srcs.cifs} $out/share/java/cifs-${version}.jar
+
+    mkdir -p $out/share/applications $out/share/pixmaps
+    cp $desktopItem/share/applications/* $out/share/applications
+    cp ${srcs.logo} $out/share/pixmaps/oec_logo_bg-transparent.svg
+
+    mkdir -p $out/bin
+    makeWrapper ${jre}/bin/java $out/bin/${appName} \
+      --add-flags "-cp $out/share/java/cifs-${version}.jar" \
+      --add-flags "-jar $out/share/java/richclient-${version}.jar" \
+      --suffix LD_LIBRARY_PATH ':' ${pcsclite}/lib
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Client side implementation of the eCard-API-Framework (BSI
+      TR-03112) and related international standards, such as ISO/IEC 24727";
+    homepage = https://www.openecard.org/;
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ sephalon ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/tools/security/pass/default.nix b/pkgs/tools/security/pass/default.nix
index 4f9e6c06697c..5ce0ce0dbc21 100644
--- a/pkgs/tools/security/pass/default.nix
+++ b/pkgs/tools/security/pass/default.nix
@@ -1,10 +1,12 @@
-{ stdenv, lib, fetchurl, fetchFromGitHub
+{ stdenv, lib, pkgs, fetchurl, fetchFromGitHub, buildEnv
 , coreutils, gnused, getopt, git, tree, gnupg, which, procps, qrencode
 , makeWrapper
 
 , xclip ? null, xdotool ? null, dmenu ? null
 , x11Support ? !stdenv.isDarwin
-, tombPluginSupport ? false, tomb
+
+# For backwards-compatibility
+, tombPluginSupport ? false
 }:
 
 with lib;
@@ -14,98 +16,100 @@ assert x11Support -> xclip != null
                   && dmenu != null;
 
 let
-  plugins = map (p: (fetchFromGitHub {
-    owner  = "roddhjav";
-    repo   = "pass-${p.name}";
-    inherit (p) rev sha256;
-  }))
-  ([
-    { name = "import";
-      rev = "491935bd275f29ceac2b876b3a288011d1ce31e7";
-      sha256 = "02mbh05ab8h7kc30hz718d1d1vkjz43b96c7p0xnd92610d2q66q"; }
-    { name = "update";
-      rev = "cf576c9036fd18efb9ed29e0e9f811207b556fde";
-      sha256 = "1hhbrg6a2walrvla6q4cd3pgrqbcrf9brzjkb748735shxfn52hd"; }
-    ] ++ stdenv.lib.optional tombPluginSupport {
-      name = "tomb";
-      rev = "3368134898a42c1b758fabac625ec240e125c6be";
-      sha256 = "0qqmxfg4w3r088qhlkhs44036mya82vjflsjjhw2hk8y0wd2i6ds"; }
-  );
-
-in stdenv.mkDerivation rec {
-  version = "1.7.1";
-  name    = "password-store-${version}";
-
-  src = fetchurl {
-    url    = "http://git.zx2c4.com/password-store/snapshot/${name}.tar.xz";
-    sha256 = "0scqkpll2q8jhzcgcsh9kqz0gwdpvynivqjmmbzax2irjfaiklpn";
-  };
+  passExtensions = import ./extensions { inherit pkgs; };
+
+  env = extensions:
+    let
+      selected = extensions passExtensions
+        ++ stdenv.lib.optional tombPluginSupport passExtensions.tomb;
+    in buildEnv {
+      name = "pass-extensions-env";
+      paths = selected;
+      buildInputs = concatMap (x: x.buildInputs) selected;
+    };
+
+  generic = extensionsEnv: extraPassthru: stdenv.mkDerivation rec {
+    version = "1.7.1";
+    name    = "password-store-${version}";
+
+    src = fetchurl {
+      url    = "http://git.zx2c4.com/password-store/snapshot/${name}.tar.xz";
+      sha256 = "0scqkpll2q8jhzcgcsh9kqz0gwdpvynivqjmmbzax2irjfaiklpn";
+    };
+
+    patches = [ ./set-correct-program-name-for-sleep.patch
+              ] ++ stdenv.lib.optional stdenv.isDarwin ./no-darwin-getopt.patch;
+
+    nativeBuildInputs = [ makeWrapper ];
+
+    buildInputs = [ extensionsEnv ];
+
+    installFlags = [ "PREFIX=$(out)" "WITH_ALLCOMP=yes" ];
+
+    postInstall = ''
+      # Install Emacs Mode. NOTE: We can't install the necessary
+      # dependencies (s.el and f.el) here. The user has to do this
+      # himself.
+      mkdir -p "$out/share/emacs/site-lisp"
+      cp "contrib/emacs/password-store.el" "$out/share/emacs/site-lisp/"
+    '' + optionalString x11Support ''
+      cp "contrib/dmenu/passmenu" "$out/bin/"
+    '';
 
-  patches = [ ./set-correct-program-name-for-sleep.patch
-            ] ++ stdenv.lib.optional stdenv.isDarwin ./no-darwin-getopt.patch;
-
-  nativeBuildInputs = [ makeWrapper ];
-
-  installFlags = [ "PREFIX=$(out)" "WITH_ALLCOMP=yes" ];
-
-  postInstall = ''
-    # plugins
-    ${stdenv.lib.concatStringsSep "\n" (map (plugin: ''
-      pushd ${plugin}
-      PREFIX=$out make install
-      popd
-    '') plugins)}
-
-    # Install Emacs Mode. NOTE: We can't install the necessary
-    # dependencies (s.el and f.el) here. The user has to do this
-    # himself.
-    mkdir -p "$out/share/emacs/site-lisp"
-    cp "contrib/emacs/password-store.el" "$out/share/emacs/site-lisp/"
-  '' + optionalString x11Support ''
-    cp "contrib/dmenu/passmenu" "$out/bin/"
-  '';
-
-  wrapperPath = with stdenv.lib; makeBinPath ([
-    coreutils
-    getopt
-    git
-    gnupg
-    gnused
-    tree
-    which
-    qrencode
-    procps
-  ] ++ optional tombPluginSupport tomb
-    ++ ifEnable x11Support [ dmenu xclip xdotool ]);
-
-  postFixup = ''
-    # Fix program name in --help
-    substituteInPlace $out/bin/pass \
-      --replace 'PROGRAM="''${0##*/}"' "PROGRAM=pass"
-
-    # Ensure all dependencies are in PATH
-    wrapProgram $out/bin/pass \
-      --prefix PATH : "${wrapperPath}"
-  '' + stdenv.lib.optionalString x11Support ''
-    # We just wrap passmenu with the same PATH as pass. It doesn't
-    # need all the tools in there but it doesn't hurt either.
-    wrapProgram $out/bin/passmenu \
-      --prefix PATH : "$out/bin:${wrapperPath}"
-  '';
-
-  meta = with stdenv.lib; {
-    description = "Stores, retrieves, generates, and synchronizes passwords securely";
-    homepage    = https://www.passwordstore.org/;
-    license     = licenses.gpl2Plus;
-    maintainers = with maintainers; [ lovek323 the-kenny fpletz ];
-    platforms   = platforms.unix;
-
-    longDescription = ''
-      pass is a very simple password store that keeps passwords inside gpg2
-      encrypted files inside a simple directory tree residing at
-      ~/.password-store. The pass utility provides a series of commands for
-      manipulating the password store, allowing the user to add, remove, edit,
-      synchronize, generate, and manipulate passwords.
+    wrapperPath = with stdenv.lib; makeBinPath ([
+      coreutils
+      getopt
+      git
+      gnupg
+      gnused
+      tree
+      which
+      qrencode
+      procps
+    ] ++ ifEnable x11Support [ dmenu xclip xdotool ]);
+
+    postFixup = ''
+      # Link extensions env
+      rmdir $out/lib/password-store/extensions
+      ln -s ${extensionsEnv}/lib/password-store/extensions $out/lib/password-store/.
+
+      # Fix program name in --help
+      substituteInPlace $out/bin/pass \
+        --replace 'PROGRAM="''${0##*/}"' "PROGRAM=pass"
+
+      # Ensure all dependencies are in PATH
+      wrapProgram $out/bin/pass \
+        --prefix PATH : "${wrapperPath}"
+    '' + stdenv.lib.optionalString x11Support ''
+      # We just wrap passmenu with the same PATH as pass. It doesn't
+      # need all the tools in there but it doesn't hurt either.
+      wrapProgram $out/bin/passmenu \
+        --prefix PATH : "$out/bin:${wrapperPath}"
     '';
+
+    passthru = {
+      extensions = passExtensions;
+    } // extraPassthru;
+
+    meta = with stdenv.lib; {
+      description = "Stores, retrieves, generates, and synchronizes passwords securely";
+      homepage    = https://www.passwordstore.org/;
+      license     = licenses.gpl2Plus;
+      maintainers = with maintainers; [ lovek323 the-kenny fpletz tadfisher ];
+      platforms   = platforms.unix;
+
+      longDescription = ''
+        pass is a very simple password store that keeps passwords inside gpg2
+        encrypted files inside a simple directory tree residing at
+        ~/.password-store. The pass utility provides a series of commands for
+        manipulating the password store, allowing the user to add, remove, edit,
+        synchronize, generate, and manipulate passwords.
+      '';
+    };
   };
+
+in
+
+generic (env (_: [])) {
+  withExtensions = extensions: generic (env extensions) {};
 }
diff --git a/pkgs/tools/security/pass/extensions/default.nix b/pkgs/tools/security/pass/extensions/default.nix
new file mode 100644
index 000000000000..dfb853c0a0bf
--- /dev/null
+++ b/pkgs/tools/security/pass/extensions/default.nix
@@ -0,0 +1,12 @@
+{ pkgs, ... }:
+
+with pkgs;
+
+{
+  pass-import = callPackage ./import.nix {
+    pythonPackages = python3Packages;
+  };
+  pass-otp = callPackage ./otp.nix {};
+  pass-tomb = callPackage ./tomb.nix {};
+  pass-update = callPackage ./update.nix {};
+}
diff --git a/pkgs/tools/security/pass/extensions/import.nix b/pkgs/tools/security/pass/extensions/import.nix
new file mode 100644
index 000000000000..8ba4abc5e3db
--- /dev/null
+++ b/pkgs/tools/security/pass/extensions/import.nix
@@ -0,0 +1,37 @@
+{ stdenv, pass, fetchFromGitHub, pythonPackages, makeWrapper }:
+
+let
+  pythonEnv = pythonPackages.python.withPackages (p: [ p.defusedxml ]);
+
+in stdenv.mkDerivation rec {
+  name = "pass-import-${version}";
+  version = "2.2";
+
+  src = fetchFromGitHub {
+    owner = "roddhjav";
+    repo = "pass-import";
+    rev = "v${version}";
+    sha256 = "189wf2jz2j43k27930cnl53sm2drh1s0nq1nmh4is3rzn8cna6wq";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  buildInputs = [ pythonEnv ];
+
+  dontBuild = true;
+
+  installFlags = [ "PREFIX=$(out)" ];
+
+  postFixup = ''
+    wrapProgram $out/lib/password-store/extensions/import.bash \
+      --prefix PATH : "${pythonEnv}/bin"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Pass extension for importing data from existing password managers";
+    homepage = https://github.com/roddhjav/pass-import;
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ lovek323 the-kenny fpletz tadfisher ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/tools/security/pass-otp/default.nix b/pkgs/tools/security/pass/extensions/otp.nix
index 7f0f44bdfa44..60198675b29d 100644
--- a/pkgs/tools/security/pass-otp/default.nix
+++ b/pkgs/tools/security/pass/extensions/otp.nix
@@ -1,4 +1,5 @@
-{ stdenv, pass, fetchFromGitHub, oathToolkit }:
+{ stdenv, fetchFromGitHub, oathToolkit }:
+
 stdenv.mkDerivation rec {
   name = "pass-otp-${version}";
   version = "1.1.0";
@@ -10,15 +11,15 @@ stdenv.mkDerivation rec {
     sha256 = "1cgj4zc8fq88n3h6c0vkv9i5al785mdprpgpbv5m22dz9p1wqvbb";
   };
 
-  buildInputs = [ pass oathToolkit ];
+  buildInputs = [ oathToolkit ];
+
+  dontBuild = true;
 
   patchPhase = ''
     sed -i -e 's|OATH=\$(which oathtool)|OATH=${oathToolkit}/bin/oathtool|' otp.bash
   '';
 
-  installPhase = ''
-    make PREFIX=$out install
-  '';
+  installFlags = [ "PREFIX=$(out)" ];
 
   meta = with stdenv.lib; {
     description = "A pass extension for managing one-time-password (OTP) tokens";
diff --git a/pkgs/tools/security/pass/extensions/tomb.nix b/pkgs/tools/security/pass/extensions/tomb.nix
new file mode 100644
index 000000000000..b9f458cd4e12
--- /dev/null
+++ b/pkgs/tools/security/pass/extensions/tomb.nix
@@ -0,0 +1,32 @@
+{ stdenv, fetchFromGitHub, tomb }:
+
+stdenv.mkDerivation rec {
+  name = "pass-tomb-${version}";
+  version = "1.1";
+
+  src = fetchFromGitHub {
+    owner = "roddhjav";
+    repo = "pass-tomb";
+    rev = "v${version}";
+    sha256 = "0wxa673yyzasjlkpd5f3yl5zf7bhsw7h1jbhf6sdjz65bypr2596";
+  };
+
+  buildInputs = [ tomb ];
+
+  dontBuild = true;
+
+  installFlags = [ "PREFIX=$(out)" ];
+
+  postFixup = ''
+    substituteInPlace $out/lib/password-store/extensions/tomb.bash \
+      --replace 'TOMB="''${PASSWORD_STORE_TOMB:-tomb}"' 'TOMB="''${PASSWORD_STORE_TOMB:-${tomb}/bin/tomb}"'
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Pass extension that keeps the password store encrypted inside a tomb";
+    homepage = https://github.com/roddhjav/pass-tomb;
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ lovek323 the-kenny fpletz tadfisher ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/tools/security/pass/extensions/update.nix b/pkgs/tools/security/pass/extensions/update.nix
new file mode 100644
index 000000000000..dd145b069720
--- /dev/null
+++ b/pkgs/tools/security/pass/extensions/update.nix
@@ -0,0 +1,25 @@
+{ stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  name = "pass-update-${version}";
+  version = "2.0";
+
+  src = fetchFromGitHub {
+    owner = "roddhjav";
+    repo = "pass-update";
+    rev = "v${version}";
+    sha256 = "0a81q0jfni185zmbislzbcv0qr1rdp0cgr9wf9riygis2xv6rs6k";
+  };
+
+  dontBuild = true;
+
+  installFlags = [ "PREFIX=$(out)" ];
+
+  meta = with stdenv.lib; {
+    description = "Pass extension that provides an easy flow for updating passwords";
+    homepage = https://github.com/roddhjav/pass-update;
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ lovek323 the-kenny fpletz tadfisher ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/tools/security/pgpdump/default.nix b/pkgs/tools/security/pgpdump/default.nix
index 09b5b5f58ca4..82bec2486e81 100644
--- a/pkgs/tools/security/pgpdump/default.nix
+++ b/pkgs/tools/security/pgpdump/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   name = "pgpdump-${version}";
-  version = "0.32";
+  version = "0.33";
 
   src = fetchFromGitHub {
     owner = "kazu-yamamoto";
     repo = "pgpdump";
     rev = "v${version}";
-    sha256 = "1ip7q5sgh3nwdqbrzpp6sllkls5kma98kns53yspw1830xi1n8xc";
+    sha256 = "0pi9qdbmcmi58gmljin51ylbi3zkknl8fm26jm67cpl55hvfsn23";
   };
 
   buildInputs = stdenv.lib.optionals supportCompressedPackets [ zlib bzip2 ];
@@ -27,4 +27,3 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ primeos ];
   };
 }
-
diff --git a/pkgs/tools/system/acpica-tools/default.nix b/pkgs/tools/system/acpica-tools/default.nix
index a8fb57b2fba0..f26142260fef 100644
--- a/pkgs/tools/system/acpica-tools/default.nix
+++ b/pkgs/tools/system/acpica-tools/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "acpica-tools-${version}";
-  version = "20180313";
+  version = "20180427";
 
   src = fetchurl {
     url = "https://acpica.org/sites/acpica/files/acpica-unix-${version}.tar.gz";
-    sha256 = "05ab2xfv9wqwbzjaa9xqgrvvan87rxv29hw48h1gcckpc5smp2wm";
+    sha256 = "05hczn82dpn7irh8zy9m17hm8r3ngwrbmk69zsldr4k1w3cv40df";
   };
 
   NIX_CFLAGS_COMPILE = "-O3";
diff --git a/pkgs/tools/system/freeipmi/default.nix b/pkgs/tools/system/freeipmi/default.nix
index 6996d66abe0c..9c7a5b36c5bd 100644
--- a/pkgs/tools/system/freeipmi/default.nix
+++ b/pkgs/tools/system/freeipmi/default.nix
@@ -1,12 +1,12 @@
 { fetchurl, stdenv, libgcrypt, readline, libgpgerror }:
 
 stdenv.mkDerivation rec {
-  version = "1.6.1";
+  version = "1.6.2";
   name = "freeipmi-${version}";
 
   src = fetchurl {
     url = "mirror://gnu/freeipmi/${name}.tar.gz";
-    sha256 = "0jdm1nwsnkj0nzjmcqprmjk25449mhjj25khwzpq3mpjw440wmd2";
+    sha256 = "0jhjf21gn1m9lhjsc1ard9zymq25mk7rxcyygjfxgy0vb4j36l9i";
   };
 
   buildInputs = [ libgcrypt readline libgpgerror ];
diff --git a/pkgs/tools/text/fanficfare/default.nix b/pkgs/tools/text/fanficfare/default.nix
index cffce8e3b883..2ebab9d63904 100644
--- a/pkgs/tools/text/fanficfare/default.nix
+++ b/pkgs/tools/text/fanficfare/default.nix
@@ -1,13 +1,13 @@
 { stdenv, fetchurl, python27Packages }:
 
 python27Packages.buildPythonApplication rec {
-  version = "2.23.0";
+  version = "2.25.0";
   name = "fanficfare-${version}";
   nameprefix = "";
 
   src = fetchurl {
     url = "https://github.com/JimmXinu/FanFicFare/archive/v${version}.tar.gz";
-    sha256 = "0589b5pg03rfv9x753cnbkz6pz508xs1n2lla3qfpagxc0pyg8i1";
+    sha256 = "1fval2jhrv3w762rmrbhbn8zj161aalvqy8n8q74yr8hzmpcvlwn";
   };
 
   propagatedBuildInputs = with python27Packages; [ beautifulsoup4 chardet html5lib html2text ];