about summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--maintainers/maintainer-list.nix5
-rw-r--r--nixos/maintainers/scripts/ec2/amazon-image.nix11
-rw-r--r--nixos/modules/hardware/wooting.nix12
-rw-r--r--nixos/modules/misc/nixpkgs.nix4
-rw-r--r--nixos/modules/module-list.nix1
-rw-r--r--nixos/modules/services/networking/supplicant.nix2
-rw-r--r--nixos/modules/services/security/fail2ban.nix4
-rw-r--r--pkgs/applications/blockchains/go-ethereum.nix4
-rw-r--r--pkgs/applications/blockchains/lnd.nix8
-rw-r--r--pkgs/applications/blockchains/monero-gui/default.nix29
-rw-r--r--pkgs/applications/blockchains/monero-gui/move-log-file.patch17
-rw-r--r--pkgs/applications/blockchains/monero/default.nix4
-rw-r--r--pkgs/applications/editors/android-studio/default.nix6
-rw-r--r--pkgs/applications/editors/glow/default.nix6
-rw-r--r--pkgs/applications/misc/archiver/default.nix7
-rw-r--r--pkgs/applications/misc/exercism/default.nix4
-rw-r--r--pkgs/applications/misc/geoipupdate/default.nix4
-rw-r--r--pkgs/applications/misc/hugo/default.nix12
-rw-r--r--pkgs/applications/misc/lutris/default.nix14
-rw-r--r--pkgs/applications/misc/todoist/default.nix10
-rw-r--r--pkgs/applications/misc/wtf/default.nix7
-rw-r--r--pkgs/applications/networking/cluster/argo/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/argocd/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/atlantis/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/fluxctl/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/helm/default.nix5
-rw-r--r--pkgs/applications/networking/cluster/helmfile/default.nix22
-rw-r--r--pkgs/applications/networking/cluster/hetzner-kube/default.nix12
-rw-r--r--pkgs/applications/networking/cluster/jx/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/k9s/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/kubeseal/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/kubeval/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/linkerd/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/minikube/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/prow/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/qbec/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/terraform-providers/default.nix2
-rw-r--r--pkgs/applications/networking/cluster/terraform-providers/elasticsearch/default.nix4
-rw-r--r--pkgs/applications/networking/hydroxide/default.nix6
-rw-r--r--pkgs/applications/networking/instant-messengers/gomuks/default.nix4
-rw-r--r--pkgs/applications/networking/ipfs-cluster/default.nix5
-rw-r--r--pkgs/applications/networking/ipfs/default.nix4
-rw-r--r--pkgs/applications/networking/mailreaders/aerc/default.nix5
-rw-r--r--pkgs/applications/networking/p2p/magnetico/default.nix6
-rw-r--r--pkgs/applications/networking/remote/wayvnc/default.nix4
-rw-r--r--pkgs/applications/networking/syncthing/default.nix4
-rw-r--r--pkgs/applications/networking/websocketd/default.nix6
-rw-r--r--pkgs/applications/version-management/git-and-tools/default.nix20
-rw-r--r--pkgs/applications/version-management/git-and-tools/ghq/default.nix4
-rw-r--r--pkgs/applications/version-management/git-and-tools/git-bug/default.nix4
-rw-r--r--pkgs/applications/version-management/git-and-tools/git-subtrac/default.nix6
-rw-r--r--pkgs/applications/version-management/git-and-tools/lab/default.nix4
-rw-r--r--pkgs/applications/version-management/git-and-tools/lefthook/default.nix4
-rw-r--r--pkgs/data/themes/mojave/default.nix28
-rw-r--r--pkgs/desktops/cinnamon/cinnamon-control-center/default.nix4
-rw-r--r--pkgs/desktops/cinnamon/cjs/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/core/gnome-control-center/default.nix3
-rw-r--r--pkgs/desktops/gnome-3/core/gnome-initial-setup/default.nix4
-rw-r--r--pkgs/desktops/gnome-3/core/gnome-shell/default.nix4
-rw-r--r--pkgs/desktops/gnome-3/extensions/draw-on-your-screen/default.nix29
-rw-r--r--pkgs/desktops/gnome-3/games/five-or-more/default.nix6
-rw-r--r--pkgs/desktops/pantheon/apps/switchboard-plugs/network/default.nix3
-rw-r--r--pkgs/desktops/pantheon/desktop/wingpanel-indicators/network/default.nix4
-rw-r--r--pkgs/development/compilers/llvm/10/clang/default.nix4
-rw-r--r--pkgs/development/compilers/llvm/10/compiler-rt.nix2
-rw-r--r--pkgs/development/compilers/llvm/10/default.nix9
-rw-r--r--pkgs/development/compilers/llvm/10/libc++/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/10/libc++abi.nix2
-rw-r--r--pkgs/development/compilers/llvm/10/libunwind.nix2
-rw-r--r--pkgs/development/compilers/llvm/10/lld.nix2
-rw-r--r--pkgs/development/compilers/llvm/10/lldb.nix2
-rw-r--r--pkgs/development/compilers/llvm/10/llvm.nix6
-rw-r--r--pkgs/development/compilers/llvm/10/openmp.nix2
-rw-r--r--pkgs/development/interpreters/joker/default.nix4
-rw-r--r--pkgs/development/libraries/openssl/default.nix4
-rw-r--r--pkgs/development/libraries/packr/default.nix7
-rw-r--r--pkgs/development/libraries/science/math/mongoose/default.nix30
-rw-r--r--pkgs/development/libraries/science/math/suitesparse-graphblas/default.nix32
-rw-r--r--pkgs/development/libraries/science/math/suitesparse/default.nix155
-rw-r--r--pkgs/development/libraries/tiledb/default.nix6
-rw-r--r--pkgs/development/ocaml-modules/parmap/default.nix8
-rw-r--r--pkgs/development/python-modules/cvxopt/default.nix4
-rw-r--r--pkgs/development/tools/analysis/tflint/default.nix6
-rw-r--r--pkgs/development/tools/azcopy/default.nix4
-rw-r--r--pkgs/development/tools/bazelisk/default.nix4
-rw-r--r--pkgs/development/tools/conftest/default.nix6
-rw-r--r--pkgs/development/tools/continuous-integration/drone-cli/default.nix13
-rw-r--r--pkgs/development/tools/continuous-integration/drone/default.nix4
-rw-r--r--pkgs/development/tools/continuous-integration/fly/default.nix6
-rw-r--r--pkgs/development/tools/continuous-integration/gitlab-runner/default.nix8
-rw-r--r--pkgs/development/tools/cue/default.nix4
-rw-r--r--pkgs/development/tools/database/dbmate/default.nix4
-rw-r--r--pkgs/development/tools/database/dbmate/deps.nix84
-rw-r--r--pkgs/development/tools/dive/default.nix5
-rw-r--r--pkgs/development/tools/go-tools/default.nix7
-rw-r--r--pkgs/development/tools/golangci-lint/default.nix6
-rw-r--r--pkgs/development/tools/hcloud/default.nix4
-rw-r--r--pkgs/development/tools/kcli/default.nix4
-rw-r--r--pkgs/development/tools/kubeprompt/default.nix4
-rw-r--r--pkgs/development/tools/kustomize/default.nix6
-rw-r--r--pkgs/development/tools/literate-programming/noweb/default.nix15
-rw-r--r--pkgs/development/tools/misc/act/default.nix6
-rw-r--r--pkgs/development/tools/misc/circleci-cli/default.nix4
-rw-r--r--pkgs/development/tools/misc/drush/default.nix6
-rw-r--r--pkgs/development/tools/misc/editorconfig-checker/default.nix6
-rw-r--r--pkgs/development/tools/misc/go-license-detector/default.nix6
-rw-r--r--pkgs/development/tools/misc/mkcert/default.nix6
-rw-r--r--pkgs/development/tools/misc/reviewdog/default.nix6
-rw-r--r--pkgs/development/tools/misc/terracognita/default.nix6
-rw-r--r--pkgs/development/tools/misc/tokei/default.nix6
-rw-r--r--pkgs/development/tools/mod/default.nix6
-rw-r--r--pkgs/development/tools/pet/default.nix6
-rw-r--r--pkgs/development/tools/proto-contrib/default.nix6
-rw-r--r--pkgs/development/tools/protoc-gen-doc/default.nix6
-rw-r--r--pkgs/development/tools/prototool/default.nix6
-rw-r--r--pkgs/development/web/flyctl/default.nix6
-rw-r--r--pkgs/development/web/minify/default.nix6
-rw-r--r--pkgs/games/nethack/default.nix6
-rw-r--r--pkgs/games/spring/default.nix4
-rw-r--r--pkgs/misc/emulators/retroarch/cores.nix833
-rw-r--r--pkgs/misc/emulators/retroarch/default.nix41
-rw-r--r--pkgs/os-specific/darwin/smimesign/default.nix6
-rw-r--r--pkgs/os-specific/linux/fuse/common.nix11
-rw-r--r--pkgs/os-specific/linux/fuse/default.nix4
-rw-r--r--pkgs/os-specific/linux/fuse/fuse3-Do-not-set-FUSERMOUNT_DIR.patch6
-rw-r--r--pkgs/os-specific/linux/wooting-udev-rules/default.nix23
-rw-r--r--pkgs/os-specific/linux/wooting-udev-rules/wooting.rules9
-rw-r--r--pkgs/servers/caddy/default.nix4
-rw-r--r--pkgs/servers/caddy/v2.nix4
-rw-r--r--pkgs/servers/dns/coredns/default.nix4
-rw-r--r--pkgs/servers/documize-community/default.nix6
-rw-r--r--pkgs/servers/echoip/default.nix6
-rw-r--r--pkgs/servers/gobetween/default.nix8
-rw-r--r--pkgs/servers/gortr/default.nix6
-rw-r--r--pkgs/servers/gotify/default.nix5
-rw-r--r--pkgs/servers/imgproxy/default.nix7
-rw-r--r--pkgs/servers/matterbridge/default.nix4
-rw-r--r--pkgs/servers/mautrix-whatsapp/default.nix4
-rw-r--r--pkgs/servers/minio/default.nix4
-rw-r--r--pkgs/servers/monitoring/grafana/default.nix8
-rw-r--r--pkgs/servers/monitoring/mtail/default.nix6
-rw-r--r--pkgs/servers/monitoring/prometheus/dnsmasq-exporter.nix4
-rw-r--r--pkgs/servers/monitoring/prometheus/mikrotik-exporter.nix4
-rw-r--r--pkgs/servers/monitoring/prometheus/varnish-exporter.nix10
-rw-r--r--pkgs/servers/monitoring/sensu-go/default.nix10
-rw-r--r--pkgs/servers/monitoring/thanos/default.nix4
-rw-r--r--pkgs/servers/nosql/victoriametrics/default.nix7
-rw-r--r--pkgs/servers/sql/dolt/default.nix6
-rw-r--r--pkgs/servers/web-apps/shiori/default.nix4
-rw-r--r--pkgs/shells/elvish/default.nix4
-rw-r--r--pkgs/shells/zsh/zsh-history/default.nix6
-rw-r--r--pkgs/tools/admin/ansible/default.nix6
-rw-r--r--pkgs/tools/admin/aws-vault/default.nix6
-rw-r--r--pkgs/tools/admin/awsweeper/default.nix6
-rw-r--r--pkgs/tools/admin/berglas/default.nix4
-rw-r--r--pkgs/tools/admin/certigo/default.nix4
-rw-r--r--pkgs/tools/admin/clair/default.nix8
-rw-r--r--pkgs/tools/admin/eksctl/default.nix6
-rw-r--r--pkgs/tools/admin/iamy/default.nix6
-rw-r--r--pkgs/tools/admin/lego/default.nix6
-rw-r--r--pkgs/tools/backup/restic/default.nix15
-rw-r--r--pkgs/tools/misc/chezmoi/default.nix4
-rw-r--r--pkgs/tools/misc/docui/default.nix4
-rw-r--r--pkgs/tools/misc/gotify-cli/default.nix6
-rw-r--r--pkgs/tools/misc/kepubify/default.nix6
-rw-r--r--pkgs/tools/misc/mutagen/default.nix6
-rw-r--r--pkgs/tools/misc/pgcenter/default.nix4
-rw-r--r--pkgs/tools/misc/pgmetrics/default.nix4
-rw-r--r--pkgs/tools/misc/wootility/default.nix32
-rw-r--r--pkgs/tools/networking/cassowary/default.nix6
-rw-r--r--pkgs/tools/networking/clash/default.nix4
-rw-r--r--pkgs/tools/networking/corerad/default.nix4
-rw-r--r--pkgs/tools/networking/croc/default.nix5
-rw-r--r--pkgs/tools/networking/dnsproxy/default.nix4
-rw-r--r--pkgs/tools/networking/frp/default.nix6
-rw-r--r--pkgs/tools/networking/grpcui/default.nix6
-rw-r--r--pkgs/tools/networking/hey/default.nix6
-rw-r--r--pkgs/tools/networking/minio-client/default.nix4
-rw-r--r--pkgs/tools/networking/nebula/default.nix6
-rw-r--r--pkgs/tools/networking/network-manager/applet/default.nix80
-rw-r--r--pkgs/tools/networking/network-manager/fortisslvpn/default.nix4
-rw-r--r--pkgs/tools/networking/network-manager/iodine/default.nix4
-rw-r--r--pkgs/tools/networking/network-manager/l2tp/default.nix4
-rw-r--r--pkgs/tools/networking/network-manager/libnma/default.nix89
-rw-r--r--pkgs/tools/networking/network-manager/libnma/hardcode-gsettings.patch (renamed from pkgs/tools/networking/network-manager/applet/hardcode-gsettings.patch)30
-rw-r--r--pkgs/tools/networking/network-manager/openvpn/default.nix4
-rw-r--r--pkgs/tools/networking/network-manager/strongswan/default.nix4
-rw-r--r--pkgs/tools/networking/network-manager/vpnc/default.nix4
-rw-r--r--pkgs/tools/networking/obfs4/default.nix6
-rw-r--r--pkgs/tools/networking/shadowfox/default.nix6
-rw-r--r--pkgs/tools/networking/tendermint/default.nix4
-rw-r--r--pkgs/tools/networking/termshark/default.nix5
-rw-r--r--pkgs/tools/networking/yggdrasil/default.nix6
-rw-r--r--pkgs/tools/package-management/mynewt-newt/default.nix4
-rw-r--r--pkgs/tools/security/age/default.nix6
-rw-r--r--pkgs/tools/security/gobuster/default.nix7
-rw-r--r--pkgs/tools/security/saml2aws/default.nix4
-rw-r--r--pkgs/tools/security/sops/default.nix4
-rw-r--r--pkgs/tools/system/ctop/default.nix6
-rw-r--r--pkgs/tools/system/ioping/default.nix10
-rw-r--r--pkgs/top-level/all-packages.nix513
201 files changed, 1960 insertions, 1130 deletions
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 3893bebb390f..241646310191 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -3948,6 +3948,11 @@
     githubId = 13721712;
     name = "Konrad Langenberg";
   };
+  kolbycrouch = {
+    email = "kjc.devel@gmail.com";
+    github = "kolbycrouch";
+    name = "Kolby Crouch";
+  };
   konimex = {
     email = "herdiansyah@netc.eu";
     github = "konimex";
diff --git a/nixos/maintainers/scripts/ec2/amazon-image.nix b/nixos/maintainers/scripts/ec2/amazon-image.nix
index 31e15537179a..36f3e7af873d 100644
--- a/nixos/maintainers/scripts/ec2/amazon-image.nix
+++ b/nixos/maintainers/scripts/ec2/amazon-image.nix
@@ -8,10 +8,15 @@ in {
 
   imports = [ ../../../modules/virtualisation/amazon-image.nix ];
 
-  # Required to provide good EBS experience,
+  # Amazon recomments setting this to the highest possible value for a good EBS
+  # experience, which prior to 4.15 was 255.
   # https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/nvme-ebs-volumes.html#timeout-nvme-ebs-volumes
-  # TODO change value to 4294967295 when kernel is updated to 4.15 or later
-  config.boot.kernelParams = [ "nvme_core.io_timeout=255" ];
+  config.boot.kernelParams =
+    let timeout =
+      if pkgs.lib.versionAtLeast config.boot.kernelPackages.kernel.version "4.15"
+      then "4294967295"
+      else  "255";
+    in [ "nvme_core.io_timeout=${timeout}" ];
 
   options.amazonImage = {
     name = mkOption {
diff --git a/nixos/modules/hardware/wooting.nix b/nixos/modules/hardware/wooting.nix
new file mode 100644
index 000000000000..ee550cbbf6b8
--- /dev/null
+++ b/nixos/modules/hardware/wooting.nix
@@ -0,0 +1,12 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+{
+  options.hardware.wooting.enable =
+    mkEnableOption "Enable support for Wooting keyboards";
+
+  config = mkIf config.hardware.wooting.enable {
+    environment.systemPackages = [ pkgs.wootility ];
+    services.udev.packages = [ pkgs.wooting-udev-rules ];
+  };
+}
diff --git a/nixos/modules/misc/nixpkgs.nix b/nixos/modules/misc/nixpkgs.nix
index 011d493c1538..4f5a9250eaae 100644
--- a/nixos/modules/misc/nixpkgs.nix
+++ b/nixos/modules/misc/nixpkgs.nix
@@ -236,8 +236,8 @@ in
         let
           nixosExpectedSystem =
             if config.nixpkgs.crossSystem != null
-            then config.nixpkgs.crossSystem.system
-            else config.nixpkgs.localSystem.system;
+            then config.nixpkgs.crossSystem.system or (lib.systems.parse.doubleFromSystem (lib.systems.parse.mkSystemFromString config.nixpkgs.crossSystem.config))
+            else config.nixpkgs.localSystem.system or (lib.systems.parse.doubleFromSystem (lib.systems.parse.mkSystemFromString config.nixpkgs.localSystem.config));
           nixosOption =
             if config.nixpkgs.crossSystem != null
             then "nixpkgs.crossSystem"
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 1ff5f5ff0c25..ccdc39eecd8d 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -64,6 +64,7 @@
   ./hardware/tuxedo-keyboard.nix
   ./hardware/usb-wwan.nix
   ./hardware/onlykey.nix
+  ./hardware/wooting.nix
   ./hardware/video/amdgpu.nix
   ./hardware/video/amdgpu-pro.nix
   ./hardware/video/ati.nix
diff --git a/nixos/modules/services/networking/supplicant.nix b/nixos/modules/services/networking/supplicant.nix
index 35c1e649e2e1..b5b9989ce186 100644
--- a/nixos/modules/services/networking/supplicant.nix
+++ b/nixos/modules/services/networking/supplicant.nix
@@ -39,8 +39,6 @@ let
         bindsTo = deps;
         after = deps;
         before = [ "network.target" ];
-        # Receive restart event after resume
-        partOf = [ "post-resume.target" ];
 
         path = [ pkgs.coreutils ];
 
diff --git a/nixos/modules/services/security/fail2ban.nix b/nixos/modules/services/security/fail2ban.nix
index cb748c93d24e..976b01fd10ee 100644
--- a/nixos/modules/services/security/fail2ban.nix
+++ b/nixos/modules/services/security/fail2ban.nix
@@ -216,6 +216,10 @@ in
 
   config = mkIf cfg.enable {
 
+    warnings = mkIf (config.networking.firewall.enable == false || config.networking.nftables.enable == false) [
+      "fail2ban can not be used without a firewall"
+    ];
+
     environment.systemPackages = [ cfg.package ];
 
     environment.etc = {
diff --git a/pkgs/applications/blockchains/go-ethereum.nix b/pkgs/applications/blockchains/go-ethereum.nix
index d8660967a4e0..80e17cf1138a 100644
--- a/pkgs/applications/blockchains/go-ethereum.nix
+++ b/pkgs/applications/blockchains/go-ethereum.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub, libobjc, IOKit }:
+{ stdenv, buildGoModule, fetchFromGitHub, libobjc, IOKit, CoreServices }:
 
 buildGoModule rec {
   pname = "go-ethereum";
@@ -30,6 +30,8 @@ buildGoModule rec {
     "cmd/wnode"
   ];
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ CoreServices ];
+
   # Fix for usb-related segmentation faults on darwin
   propagatedBuildInputs =
     stdenv.lib.optionals stdenv.isDarwin [ libobjc IOKit ];
diff --git a/pkgs/applications/blockchains/lnd.nix b/pkgs/applications/blockchains/lnd.nix
index dd45746c8df5..4be19beedc39 100644
--- a/pkgs/applications/blockchains/lnd.nix
+++ b/pkgs/applications/blockchains/lnd.nix
@@ -1,4 +1,4 @@
-{ buildGoModule, fetchFromGitHub, lib }:
+{ buildGoModule, fetchFromGitHub, stdenv, Security }:
 
 buildGoModule rec {
   pname = "lnd";
@@ -13,10 +13,12 @@ buildGoModule rec {
 
   modSha256 = "1pvcvpiz6ck8xkgpypchrq9kgkik0jxd7f3jhihbgldsh4zaqiaq";
 
-  meta = with lib; {
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
+  meta = with stdenv.lib; {
     description = "Lightning Network Daemon";
     homepage = "https://github.com/lightningnetwork/lnd";
-    license = lib.licenses.mit;
+    license = licenses.mit;
     maintainers = with maintainers; [ cypherpunk2140 ];
   };
 }
diff --git a/pkgs/applications/blockchains/monero-gui/default.nix b/pkgs/applications/blockchains/monero-gui/default.nix
index 0311169deb24..980e20d04b75 100644
--- a/pkgs/applications/blockchains/monero-gui/default.nix
+++ b/pkgs/applications/blockchains/monero-gui/default.nix
@@ -1,36 +1,35 @@
-{ stdenv, wrapQtAppsHook, makeDesktopItem, fetchFromGitHub
-, qtbase, qmake, qtmultimedia, qttools
-, qtgraphicaleffects, qtdeclarative
-, qtlocation, qtquickcontrols, qtquickcontrols2
-, qtwebchannel, qtwebengine, qtx11extras, qtxmlpatterns
+{ stdenv, wrapQtAppsHook, makeDesktopItem
+, fetchFromGitHub, qmake, qttools, pkgconfig
+, qtbase, qtdeclarative, qtgraphicaleffects
+, qtmultimedia, qtxmlpatterns
+, qtquickcontrols, qtquickcontrols2
 , monero, unbound, readline, boost, libunwind
-, libsodium, pcsclite, zeromq, cppzmq, pkgconfig
-, hidapi, randomx
+, libsodium, pcsclite, zeromq, cppzmq
+, hidapi, libusb, protobuf, randomx
 }:
 
 with stdenv.lib;
 
 stdenv.mkDerivation rec {
   pname = "monero-gui";
-  version = "0.15.0.1";
+  version = "0.15.0.4";
 
   src = fetchFromGitHub {
     owner  = "monero-project";
     repo   = "monero-gui";
     rev    = "v${version}";
-    sha256 = "08j8kkncdn57xql0bhmlzjpjkdfhqbpda1p07r797q8qi0nl4w8n";
+    sha256 = "12m5fgnxkr11q2arx1m5ccpxqm5ljcvm6l547dwqn297zs5jim4z";
   };
 
   nativeBuildInputs = [ qmake pkgconfig wrapQtAppsHook ];
 
   buildInputs = [
-    qtbase qtmultimedia qtgraphicaleffects
-    qtdeclarative qtlocation
-    qtquickcontrols qtquickcontrols2
-    qtwebchannel qtwebengine qtx11extras
-    qtxmlpatterns monero unbound readline
+    qtbase qtdeclarative qtgraphicaleffects
+    qtmultimedia qtquickcontrols qtquickcontrols2
+    qtxmlpatterns
+    monero unbound readline
     boost libunwind libsodium pcsclite zeromq
-    cppzmq hidapi randomx
+    cppzmq hidapi libusb protobuf randomx
   ];
 
   NIX_CFLAGS_COMPILE = [ "-Wno-error=format-security" ];
diff --git a/pkgs/applications/blockchains/monero-gui/move-log-file.patch b/pkgs/applications/blockchains/monero-gui/move-log-file.patch
index e540f1960d6c..6d3313624e37 100644
--- a/pkgs/applications/blockchains/monero-gui/move-log-file.patch
+++ b/pkgs/applications/blockchains/monero-gui/move-log-file.patch
@@ -1,15 +1,14 @@
-diff --git a/main.cpp b/main.cpp
-index a51568d..5a9f683 100644
---- a/main.cpp
-+++ b/main.cpp
-@@ -152,7 +152,9 @@ int main(int argc, char *argv[])
+diff --git a/src/main/main.cpp b/src/main/main.cpp
+index c5210e5f..45794d72 100644
+--- a/src/main/main.cpp
++++ b/src/main/main.cpp
+@@ -220,6 +220,9 @@ int main(int argc, char *argv[])
      QCommandLineOption logPathOption(QStringList() << "l" << "log-file",
          QCoreApplication::translate("main", "Log to specified file"),
          QCoreApplication::translate("main", "file"));
--
 +    logPathOption.setDefaultValue(
 +        QStandardPaths::writableLocation(QStandardPaths::CacheLocation)
 +        + "/monero-wallet-gui.log");
-     parser.addOption(logPathOption);
-     parser.addHelpOption();
-     parser.process(app);
+ 
+     QCommandLineOption testQmlOption("test-qml");
+     testQmlOption.setFlags(QCommandLineOption::HiddenFromHelp);
diff --git a/pkgs/applications/blockchains/monero/default.nix b/pkgs/applications/blockchains/monero/default.nix
index 7eb4238679eb..c942197006c4 100644
--- a/pkgs/applications/blockchains/monero/default.nix
+++ b/pkgs/applications/blockchains/monero/default.nix
@@ -2,7 +2,7 @@
 , cmake, pkgconfig
 , boost, miniupnpc, openssl, unbound, cppzmq
 , zeromq, pcsclite, readline, libsodium, hidapi
-, python3Packages, randomx, rapidjson
+, pythonProtobuf, randomx, rapidjson, libusb
 , CoreData, IOKit, PCSC
 }:
 
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
     boost miniupnpc openssl unbound
     cppzmq zeromq pcsclite readline
     libsodium hidapi randomx rapidjson
-    python3Packages.protobuf
+    pythonProtobuf libusb
   ] ++ stdenv.lib.optionals stdenv.isDarwin [ IOKit CoreData PCSC ];
 
   cmakeFlags = [
diff --git a/pkgs/applications/editors/android-studio/default.nix b/pkgs/applications/editors/android-studio/default.nix
index 39929e5e5275..573eec845027 100644
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@@ -13,9 +13,9 @@ let
     sha256Hash = "1mwzk18224bl8hbw9cdxwzgj5cfain4y70q64cpj4p0snffxqm77";
   };
   betaVersion = {
-    version = "4.0.0.11"; # "Android Studio 4.0 Beta 2"
-    build = "193.6254973";
-    sha256Hash = "0i4n5kxnfxnz3y44ba0x2j8nkmss4gchrzcdnb9wf6xc1jqrjwcm";
+    version = "4.0.0.12"; # "Android Studio 4.0 Beta 3"
+    build = "193.6296804";
+    sha256Hash = "072rvh20xkn7izh6f2r2bspy06jrvcibj2hc12hz76m8cwzf4v0m";
   };
   latestVersion = { # canary & dev
     version = "4.1.0.3"; # "Android Studio 4.1 Canary 3"
diff --git a/pkgs/applications/editors/glow/default.nix b/pkgs/applications/editors/glow/default.nix
index 928291940cfe..80fdcc8a09c1 100644
--- a/pkgs/applications/editors/glow/default.nix
+++ b/pkgs/applications/editors/glow/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "glow";
@@ -13,9 +13,11 @@ buildGoModule rec {
 
   modSha256 = "0r0yq7kgz7i1wf4gxxihdrn1c8mi4wcyhadncxbln24s9c5apxsf";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   buildFlagsArray = [ "-ldflags=" "-X=main.Version=${version}" ];
 
-  meta = with lib; {
+  meta = with stdenv.lib; {
     description = "Render markdown on the CLI";
     homepage = "https://github.com/charmbracelet/glow";
     license = licenses.mit;
diff --git a/pkgs/applications/misc/archiver/default.nix b/pkgs/applications/misc/archiver/default.nix
index 64b592b78714..8c79d867c831 100644
--- a/pkgs/applications/misc/archiver/default.nix
+++ b/pkgs/applications/misc/archiver/default.nix
@@ -1,6 +1,7 @@
 { buildGoModule
 , fetchFromGitHub
-, lib
+, stdenv
+, Security
 }:
 
 buildGoModule rec {
@@ -16,7 +17,9 @@ buildGoModule rec {
 
   modSha256 = "1mrfqhd0zb78rlqlj2ncb0srwjfl7rzhy2p9mwa82pgysvlp08gv";
 
-  meta = with lib; {
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
+  meta = with stdenv.lib; {
     description = "Easily create & extract archives, and compress & decompress files of various formats";
     homepage = "https://github.com/mholt/archiver";
     license = licenses.mit;
diff --git a/pkgs/applications/misc/exercism/default.nix b/pkgs/applications/misc/exercism/default.nix
index a071761599a3..81c2d9782997 100644
--- a/pkgs/applications/misc/exercism/default.nix
+++ b/pkgs/applications/misc/exercism/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "exercism";
@@ -13,6 +13,8 @@ buildGoModule rec {
 
   modSha256 = "0pg0hxrr6jjd03wbjn5y65x02md3h352mnm1gr6vyiv7hn4ws14m";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   subPackages = [ "./exercism" ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/applications/misc/geoipupdate/default.nix b/pkgs/applications/misc/geoipupdate/default.nix
index b7b90448e4bc..71ea8a3d43f4 100644
--- a/pkgs/applications/misc/geoipupdate/default.nix
+++ b/pkgs/applications/misc/geoipupdate/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "geoipupdate";
@@ -13,6 +13,8 @@ buildGoModule rec {
 
   modSha256 = "1bypanvrkcqp8rk84cv2569671irgaf3cy27lcrknyina4pdvir5";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   meta = with stdenv.lib; {
     description = "Automatic GeoIP database updater";
     homepage = "https://github.com/maxmind/geoipupdate";
diff --git a/pkgs/applications/misc/hugo/default.nix b/pkgs/applications/misc/hugo/default.nix
index f1d68b926910..e93812f6c0da 100644
--- a/pkgs/applications/misc/hugo/default.nix
+++ b/pkgs/applications/misc/hugo/default.nix
@@ -1,19 +1,19 @@
-{ stdenv, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "hugo";
-  version = "0.67.1";
-
-  goPackagePath = "github.com/gohugoio/hugo";
+  version = "0.68.0";
 
   src = fetchFromGitHub {
     owner = "gohugoio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0q55f8w0drc1miqziqp8r064h7900hrgj7nixxs71cb1p8ih4cq3";
+    sha256 = "1jdk4mwflxm7n076x4gbqb362z4qriszq8fkc0sjsvd05z613ry6";
   };
 
-  modSha256 = "0s7a13jkhsr6h19a9ysr8877imac5skdray0zg2qgwrapic2nw17";
+  modSha256 = "04vzm65kbj9905z4cf5yh6yc6g3b0pd5vc00lrxw84pwgqgc0ykb";
+
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
 
   buildFlags = [ "-tags" "extended" ];
 
diff --git a/pkgs/applications/misc/lutris/default.nix b/pkgs/applications/misc/lutris/default.nix
index c9ea146f063b..6cd5c6d204ed 100644
--- a/pkgs/applications/misc/lutris/default.nix
+++ b/pkgs/applications/misc/lutris/default.nix
@@ -1,4 +1,4 @@
-{ buildPythonApplication, lib, fetchFromGitHub
+{ buildPythonApplication, lib, fetchFromGitHub, fetchpatch
 , wrapGAppsHook, gobject-introspection, gnome-desktop, libnotify, libgnome-keyring, pango
 , gdk-pixbuf, atk, webkitgtk, gst_all_1
 , evdev, pyyaml, pygobject3, requests, pillow
@@ -31,15 +31,22 @@ let
 
 in buildPythonApplication rec {
   pname = "lutris-original";
-  version = "0.5.3";
+  version = "0.5.4";
 
   src = fetchFromGitHub {
     owner = "lutris";
     repo = "lutris";
     rev = "v${version}";
-    sha256 = "0n6xa3pnwvsvfipinrkbhxwjzfbw2cjpc9igv97nffcmpydmn5xv";
+    sha256 = "0i4i6g3pys1vf2q1pbs1fkywgapj4qfxrjrvim98hzw9al4l06y9";
   };
 
+  patches = [(
+    fetchpatch {
+      url = "https://github.com/lutris/lutris/pull/2558.patch";
+      sha256 = "1wbsplri5ii06gzv6mzhiic61zkgsp9bkjkaknkd83203p0i9b2d";
+    }
+  )];
+
   buildInputs = [
     wrapGAppsHook gobject-introspection gnome-desktop libnotify libgnome-keyring pango
     gdk-pixbuf atk webkitgtk
@@ -63,4 +70,3 @@ in buildPythonApplication rec {
     platforms = platforms.linux;
   };
 }
-
diff --git a/pkgs/applications/misc/todoist/default.nix b/pkgs/applications/misc/todoist/default.nix
index 74b2b770215c..a625c8340558 100644
--- a/pkgs/applications/misc/todoist/default.nix
+++ b/pkgs/applications/misc/todoist/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "todoist";
@@ -13,10 +13,12 @@ buildGoModule rec {
 
   modSha256 = "1nnp5ijz4n34gc97rar4wlvlbx21ndpjyb2mc6gxdk1wzx3mgswp";
 
-  meta = {
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
+  meta = with stdenv.lib; {
     homepage = https://github.com/sachaos/todoist;
     description = "Todoist CLI Client";
-    license = lib.licenses.mit;
-    platforms = lib.platforms.unix;
+    license = licenses.mit;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/applications/misc/wtf/default.nix b/pkgs/applications/misc/wtf/default.nix
index f12f96871c00..8c34baba5828 100644
--- a/pkgs/applications/misc/wtf/default.nix
+++ b/pkgs/applications/misc/wtf/default.nix
@@ -1,8 +1,9 @@
 { buildGoModule
 , fetchFromGitHub
-, lib
+, stdenv
 , makeWrapper
 , ncurses
+, Security
 }:
 
 buildGoModule rec {
@@ -24,12 +25,14 @@ buildGoModule rec {
 
   nativeBuildInputs = [ makeWrapper ];
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   postInstall = ''
     mv "$out/bin/wtf" "$out/bin/wtfutil"
     wrapProgram "$out/bin/wtfutil" --prefix PATH : "${ncurses.dev}/bin"
   '';
 
-  meta = with lib; {
+  meta = with stdenv.lib; {
     description = "The personal information dashboard for your terminal";
     homepage = "https://wtfutil.com/";
     license = licenses.mpl20;
diff --git a/pkgs/applications/networking/cluster/argo/default.nix b/pkgs/applications/networking/cluster/argo/default.nix
index f02b64e92c8b..25fb33399c0d 100644
--- a/pkgs/applications/networking/cluster/argo/default.nix
+++ b/pkgs/applications/networking/cluster/argo/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, buildGoPackage, fetchFromGitHub }:
+{ stdenv, buildGoModule, buildGoPackage, fetchFromGitHub, Security }:
 
 let
   # Argo can package a static server in the CLI using the `staticfiles` go module.
@@ -32,6 +32,8 @@ buildGoModule rec {
 
   subPackages = [ "cmd/argo" ];
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   preBuild = ''
     mkdir -p ui/dist/app
     echo "Built without static files" > ui/dist/app/index.html
@@ -39,7 +41,7 @@ buildGoModule rec {
     ${staticfiles}/bin/staticfiles -o server/static/files.go ui/dist/app
   '';
 
-  meta = with lib; {
+  meta = with stdenv.lib; {
     description = "Container native workflow engine for Kubernetes";
     homepage = https://github.com/argoproj/argo;
     license = licenses.asl20;
diff --git a/pkgs/applications/networking/cluster/argocd/default.nix b/pkgs/applications/networking/cluster/argocd/default.nix
index 7f9ebda93c0a..51635292fa13 100644
--- a/pkgs/applications/networking/cluster/argocd/default.nix
+++ b/pkgs/applications/networking/cluster/argocd/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub, packr }:
+{ stdenv, buildGoModule, fetchFromGitHub, packr, Security }:
 
 buildGoModule rec {
   pname = "argocd";
@@ -16,6 +16,8 @@ buildGoModule rec {
 
   nativeBuildInputs = [ packr ];
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   patches = [ ./use-go-module.patch ];
 
   buildFlagsArray = ''
@@ -31,7 +33,7 @@ buildGoModule rec {
     packr
   '';
   
-  meta = with lib; {
+  meta = with stdenv.lib; {
     description = "Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes";
     homepage = "https://github.com/argoproj/argo";
     license = licenses.asl20;
diff --git a/pkgs/applications/networking/cluster/atlantis/default.nix b/pkgs/applications/networking/cluster/atlantis/default.nix
index cb846060a3de..ce3a1730ae54 100644
--- a/pkgs/applications/networking/cluster/atlantis/default.nix
+++ b/pkgs/applications/networking/cluster/atlantis/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "atlantis";
@@ -15,6 +15,8 @@ buildGoModule rec {
 
   subPackages = [ "." ];
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   meta = with stdenv.lib; {
     homepage = "https://github.com/runatlantis/atlantis";
     description = "Terraform Pull Request Automation";
diff --git a/pkgs/applications/networking/cluster/fluxctl/default.nix b/pkgs/applications/networking/cluster/fluxctl/default.nix
index 982add3d517f..75e097131ea8 100644
--- a/pkgs/applications/networking/cluster/fluxctl/default.nix
+++ b/pkgs/applications/networking/cluster/fluxctl/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "fluxctl";
@@ -13,6 +13,8 @@ buildGoModule rec {
 
   modSha256 = "0ij5q31a0818nmqsdql1ii6rhq6nb0liplnw509qih8py7dk5xkg";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   subPackages = [ "cmd/fluxctl" ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/applications/networking/cluster/helm/default.nix b/pkgs/applications/networking/cluster/helm/default.nix
index 88ca9b3da947..822df7656554 100644
--- a/pkgs/applications/networking/cluster/helm/default.nix
+++ b/pkgs/applications/networking/cluster/helm/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub, installShellFiles }:
+{ stdenv, buildGoModule, fetchFromGitHub, installShellFiles, Security }:
 
 buildGoModule rec {
   pname = "helm";
@@ -16,6 +16,9 @@ buildGoModule rec {
   buildFlagsArray = [ "-ldflags=-w -s -X helm.sh/helm/v3/internal/version.version=v${version}" ];
 
   nativeBuildInputs = [ installShellFiles ];
+
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   postInstall = ''
     $out/bin/helm completion bash > helm.bash
     $out/bin/helm completion zsh > helm.zsh
diff --git a/pkgs/applications/networking/cluster/helmfile/default.nix b/pkgs/applications/networking/cluster/helmfile/default.nix
index ee7c4ab9cbdd..2de07e9fdc7d 100644
--- a/pkgs/applications/networking/cluster/helmfile/default.nix
+++ b/pkgs/applications/networking/cluster/helmfile/default.nix
@@ -1,10 +1,8 @@
-{ lib, buildGoModule, fetchFromGitHub, makeWrapper, kubernetes-helm, ... }:
+{ stdenv, buildGoModule, fetchFromGitHub, makeWrapper, kubernetes-helm, Security }:
 
-let version = "0.102.0"; in
-
-buildGoModule {
+buildGoModule rec {
   pname = "helmfile";
-  inherit version;
+  version = "0.102.0";
 
   src = fetchFromGitHub {
     owner = "roboll";
@@ -13,12 +11,12 @@ buildGoModule {
     sha256 = "0v7mhsnhswiqd62wrmkcpzsg9nfi6wvkh9danngs5rqjiz1zffhy";
   };
 
-  goPackagePath = "github.com/roboll/helmfile";
-
   modSha256 = "0s7j7jbgr8gdc0s9dnl6zjwkpywqj05xyb7mkcank54kgrz0g5vq";
 
   nativeBuildInputs = [ makeWrapper ];
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   buildFlagsArray = ''
     -ldflags=
     -X main.Version=${version}
@@ -26,14 +24,14 @@ buildGoModule {
 
   postInstall = ''
     wrapProgram $out/bin/helmfile \
-      --prefix PATH : ${lib.makeBinPath [ kubernetes-helm ]}
+      --prefix PATH : ${stdenv.lib.makeBinPath [ kubernetes-helm ]}
   '';
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "Deploy Kubernetes Helm charts";
     homepage = "https://github.com/roboll/helmfile";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ pneumaticat yurrriq ];
-    platforms = lib.platforms.unix;
+    license = licenses.mit;
+    maintainers = with maintainers; [ pneumaticat yurrriq ];
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/applications/networking/cluster/hetzner-kube/default.nix b/pkgs/applications/networking/cluster/hetzner-kube/default.nix
index 1d9940c8f318..8a59bf3197a9 100644
--- a/pkgs/applications/networking/cluster/hetzner-kube/default.nix
+++ b/pkgs/applications/networking/cluster/hetzner-kube/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "hetzner-kube";
@@ -13,16 +13,18 @@ buildGoModule rec {
 
   modSha256 = "0jjrk93wdi13wrb5gchhqk7rgwm74kcizrbqsibgkgs2dszwfazh";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   buildFlagsArray = ''
     -ldflags=
     -X github.com/xetys/hetzner-kube/cmd.version=${version}
   '';
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "A CLI tool for provisioning Kubernetes clusters on Hetzner Cloud";
     homepage = "https://github.com/xetys/hetzner-kube";
-    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ eliasp ];
-    platforms = lib.platforms.unix;
+    license = licenses.asl20;
+    maintainers = with maintainers; [ eliasp ];
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/applications/networking/cluster/jx/default.nix b/pkgs/applications/networking/cluster/jx/default.nix
index 88aa8777ee5e..f817a68ced19 100644
--- a/pkgs/applications/networking/cluster/jx/default.nix
+++ b/pkgs/applications/networking/cluster/jx/default.nix
@@ -1,4 +1,4 @@
-{ buildGoModule, fetchFromGitHub, lib }:
+{ buildGoModule, fetchFromGitHub, stdenv, Security }:
 
 buildGoModule rec {
   name = "jx";
@@ -16,6 +16,8 @@ buildGoModule rec {
     ./3321-fix-location-of-thrift.patch
   ];
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   modSha256 = "0ljf0c0c3pc12nmhdbrwflcaj6hs8igzjw5hi6fyhi6n9cy87vac";
 
   subPackages = [ "cmd/jx" ];
@@ -26,7 +28,7 @@ buildGoModule rec {
     -X github.com/jenkins-x/jx/pkg/version.Revision=${version}
   '';
 
-  meta = with lib; {
+  meta = with stdenv.lib; {
     description = "JX is a command line tool for installing and using Jenkins X.";
     homepage = https://jenkins-x.io;
     longDescription = ''
diff --git a/pkgs/applications/networking/cluster/k9s/default.nix b/pkgs/applications/networking/cluster/k9s/default.nix
index 99326a20bfa0..956d7b106b97 100644
--- a/pkgs/applications/networking/cluster/k9s/default.nix
+++ b/pkgs/applications/networking/cluster/k9s/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "k9s";
@@ -22,6 +22,8 @@ buildGoModule rec {
 
   modSha256 = "06m4xgl29zx6zpqx630m9cm52wmljms9cvly5f4pqdb4zicq7n86";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   meta = with stdenv.lib; {
     description = "Kubernetes CLI To Manage Your Clusters In Style.";
     homepage = "https://github.com/derailed/k9s";
diff --git a/pkgs/applications/networking/cluster/kubeseal/default.nix b/pkgs/applications/networking/cluster/kubeseal/default.nix
index 6d35d233d4f4..092cee5f7a27 100644
--- a/pkgs/applications/networking/cluster/kubeseal/default.nix
+++ b/pkgs/applications/networking/cluster/kubeseal/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "kubeseal";
@@ -13,9 +13,11 @@ buildGoModule rec {
 
   modSha256 = "04dmjyz3vi2l0dfpyy42lkp2fv1vlfkvblrxh1dvb37phrkd5lbd";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   subPackages = [ "cmd/kubeseal" ];
 
-  meta = with lib; {
+  meta = with stdenv.lib; {
     description = "A Kubernetes controller and tool for one-way encrypted Secrets";
     homepage = "https://github.com/bitnami-labs/sealed-secrets";
     license = licenses.asl20;
diff --git a/pkgs/applications/networking/cluster/kubeval/default.nix b/pkgs/applications/networking/cluster/kubeval/default.nix
index 54be5956040c..046052f78bef 100644
--- a/pkgs/applications/networking/cluster/kubeval/default.nix
+++ b/pkgs/applications/networking/cluster/kubeval/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, buildGoModule, makeWrapper }:
+{ stdenv, fetchFromGitHub, buildGoModule, Security }:
 
 buildGoModule rec {
   pname = "kubeval";
@@ -13,7 +13,9 @@ buildGoModule rec {
 
   modSha256 = "0y9x44y3bchi8xg0a6jmp2rmi8dybkl6qlywb6nj1viab1s8dd4y";
 
-  meta = with lib; {
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
+  meta = with stdenv.lib; {
     description = "Validate your Kubernetes configuration files";
     homepage = https://github.com/instrumenta/kubeval;
     license = licenses.asl20;
diff --git a/pkgs/applications/networking/cluster/linkerd/default.nix b/pkgs/applications/networking/cluster/linkerd/default.nix
index 8c0265d14914..d52b25c2e015 100644
--- a/pkgs/applications/networking/cluster/linkerd/default.nix
+++ b/pkgs/applications/networking/cluster/linkerd/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, buildGoModule }:
+{ stdenv, fetchFromGitHub, buildGoModule, Security }:
 
 buildGoModule {
   pname = "linkerd-unstablle";
@@ -13,6 +13,8 @@ buildGoModule {
 
   modSha256 = "0gahhywpcj16ww4l8s3wjwvavq24fpy258snhyf94ipy6lb797sl";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   subPackages = [ "cli/cmd" ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/applications/networking/cluster/minikube/default.nix b/pkgs/applications/networking/cluster/minikube/default.nix
index f49f1768ced4..ebd78424f4af 100644
--- a/pkgs/applications/networking/cluster/minikube/default.nix
+++ b/pkgs/applications/networking/cluster/minikube/default.nix
@@ -6,6 +6,10 @@
 , go-bindata
 , libvirt
 , vmnet
+, xpc
+, libobjc
+, Foundation
+, IOKit
 }:
 
 buildGoModule rec {
@@ -27,7 +31,7 @@ buildGoModule rec {
 
   nativeBuildInputs = [ pkgconfig go-bindata makeWrapper ];
   buildInputs = stdenv.lib.optionals stdenv.isLinux [ libvirt ]
-    ++ stdenv.lib.optionals stdenv.isDarwin [ vmnet ];
+    ++ stdenv.lib.optionals stdenv.isDarwin [ vmnet xpc libobjc IOKit Foundation ];
 
   preBuild = ''
     go-bindata -nomemcopy -o pkg/minikube/assets/assets.go -pkg assets deploy/addons/...
diff --git a/pkgs/applications/networking/cluster/prow/default.nix b/pkgs/applications/networking/cluster/prow/default.nix
index 1c802802c096..e3eb24b23746 100644
--- a/pkgs/applications/networking/cluster/prow/default.nix
+++ b/pkgs/applications/networking/cluster/prow/default.nix
@@ -1,4 +1,4 @@
-{ buildGoModule, fetchFromGitHub, lib }:
+{ buildGoModule, fetchFromGitHub, stdenv, Security }:
 
 buildGoModule rec {
   pname = "prow-unstable";
@@ -20,6 +20,8 @@ buildGoModule rec {
 
   modSha256 = "06q1zvhm78k64aj475k1xl38h7nk83mysd0bja0wknja048ymgsq";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   subPackages = [
     "./prow/cmd/admission"
     "./prow/cmd/artifact-uploader"
@@ -54,7 +56,7 @@ buildGoModule rec {
     "./prow/cmd/tot"
   ];
 
-  meta = with lib; {
+  meta = with stdenv.lib; {
     description = "Prow is a Kubernetes based CI/CD system";
     longDescription = ''
       Prow is a Kubernetes based CI/CD system. Jobs can be triggered by various
diff --git a/pkgs/applications/networking/cluster/qbec/default.nix b/pkgs/applications/networking/cluster/qbec/default.nix
index 4a8b2a2e6648..4e475320a613 100644
--- a/pkgs/applications/networking/cluster/qbec/default.nix
+++ b/pkgs/applications/networking/cluster/qbec/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "qbec";
@@ -13,7 +13,9 @@ buildGoModule rec {
 
   modSha256 = "165zqmannlylkzaz9gkmcrlyx8rfhz70ahzhiks4ycgq1qxr0av9";
 
-  meta = with lib; {
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
+  meta = with stdenv.lib; {
     description = "Configure kubernetes objects on multiple clusters using jsonnet https://qbec.io";
     homepage = "https://github.com/splunk/qbec";
     license = licenses.asl20;
diff --git a/pkgs/applications/networking/cluster/terraform-providers/default.nix b/pkgs/applications/networking/cluster/terraform-providers/default.nix
index 6a285d8b38be..5112277a8c40 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-providers/default.nix
@@ -3,6 +3,7 @@
 , fetchFromGitHub
 , callPackage
 , buildGo112Module
+, Security
 }:
 let
   list = import ./data.nix;
@@ -29,6 +30,7 @@ in
       #   verifying git.apache.org/thrift.git@v0.12.0/go.mod: git.apache.org/thrift.git@v0.12.0/go.mod: Get https://sum.golang.org/lookup/git.apache.org/thrift.git@v0.12.0: dial tcp: lookup sum.golang.org on [::1]:53: read udp [::1]:52968->[::1]:53: read: connection refused
       #   verifying github.com/hashicorp/terraform@v0.12.0/go.mod: github.com/hashicorp/terraform@v0.12.0/go.mod: Get https://sum.golang.org/lookup/github.com/hashicorp/terraform@v0.12.0: dial tcp: lookup sum.golang.org on [::1]:53: read udp [::1]:52968->[::1]:53: read: connection refused
       buildGoModule = buildGo112Module;
+      inherit Security;
     };
     gandi = callPackage ./gandi {};
     ibm = callPackage ./ibm {};
diff --git a/pkgs/applications/networking/cluster/terraform-providers/elasticsearch/default.nix b/pkgs/applications/networking/cluster/terraform-providers/elasticsearch/default.nix
index 1aadbbc5ccd3..2f13000c0cde 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/elasticsearch/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-providers/elasticsearch/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, buildGoModule }:
+{ stdenv, fetchFromGitHub, buildGoModule, Security }:
 buildGoModule rec {
   pname = "terraform-provider-elasticsearch";
   version = "0.7.0";
@@ -12,6 +12,8 @@ buildGoModule rec {
 
   modSha256 = "1xk21xswqwpv34j4ba4fj8lcbvfdd12x7rq1hrdyd21mdhmrhw0p";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   subPackages = [ "." ];
 
   # Terraform allow checking the provider versions, but this breaks
diff --git a/pkgs/applications/networking/hydroxide/default.nix b/pkgs/applications/networking/hydroxide/default.nix
index 75c1cdaece96..d3f45f7f0385 100644
--- a/pkgs/applications/networking/hydroxide/default.nix
+++ b/pkgs/applications/networking/hydroxide/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub, fetchpatch }:
+{ stdenv, buildGoModule, fetchFromGitHub, fetchpatch, Security }:
 
 buildGoModule rec {
   pname = "hydroxide";
@@ -13,6 +13,8 @@ buildGoModule rec {
 
   modSha256 = "0b19rcif8yiyvhrsjd3q5nsvr580lklamlphx4dk47n456ckcqfp";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   # FIXME: remove with next release
   patches = [
     (fetchpatch {
@@ -23,7 +25,7 @@ buildGoModule rec {
 
   subPackages = [ "cmd/hydroxide" ];
 
-  meta = with lib; {
+  meta = with stdenv.lib; {
     description = "A third-party, open-source ProtonMail bridge";
     homepage = "https://github.com/emersion/hydroxide";
     license = licenses.mit;
diff --git a/pkgs/applications/networking/instant-messengers/gomuks/default.nix b/pkgs/applications/networking/instant-messengers/gomuks/default.nix
index a36f72c03d08..27790c2c9e08 100644
--- a/pkgs/applications/networking/instant-messengers/gomuks/default.nix
+++ b/pkgs/applications/networking/instant-messengers/gomuks/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "gomuks";
@@ -15,6 +15,8 @@ buildGoModule rec {
 
   modSha256 = "03vbrh50pvx71rp6c23qc2sh0ir4jm1wl0gvi3z1c14ndzhsqky4";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   meta = with stdenv.lib; {
     homepage = "https://maunium.net/go/gomuks/";
     description = "A terminal based Matrix client written in Go";
diff --git a/pkgs/applications/networking/ipfs-cluster/default.nix b/pkgs/applications/networking/ipfs-cluster/default.nix
index a214f222d566..9bf7faf51f3e 100644
--- a/pkgs/applications/networking/ipfs-cluster/default.nix
+++ b/pkgs/applications/networking/ipfs-cluster/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub, fetchgx, gx-go }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "ipfs-cluster";
@@ -14,6 +14,8 @@ buildGoModule rec {
     sha256 = "1jh6ynj50jd4w79widaqrgm3h3yz5h03vq0lbsx717a8d9073blh";
   };
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   meta = with stdenv.lib; {
     description = "Allocate, replicate, and track Pins across a cluster of IPFS daemons";
     homepage = https://cluster.ipfs.io/;
@@ -22,4 +24,3 @@ buildGoModule rec {
     maintainers = with maintainers; [ jglukasik ];
   };
 }
-
diff --git a/pkgs/applications/networking/ipfs/default.nix b/pkgs/applications/networking/ipfs/default.nix
index 4f71fcf3b745..c3a31f4e290f 100644
--- a/pkgs/applications/networking/ipfs/default.nix
+++ b/pkgs/applications/networking/ipfs/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "ipfs";
@@ -18,6 +18,8 @@ buildGoModule rec {
 
   modSha256 = "12m4ind1s8zaa6kssblc28z2cafy20w2jp80kzif39hg5ar9bijm";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   meta = with stdenv.lib; {
     description = "A global, versioned, peer-to-peer filesystem";
     homepage = https://ipfs.io/;
diff --git a/pkgs/applications/networking/mailreaders/aerc/default.nix b/pkgs/applications/networking/mailreaders/aerc/default.nix
index 7b24ed93406e..e0f98208e7ab 100644
--- a/pkgs/applications/networking/mailreaders/aerc/default.nix
+++ b/pkgs/applications/networking/mailreaders/aerc/default.nix
@@ -1,6 +1,6 @@
 { stdenv, buildGoModule, fetchurl
 , go, ncurses, notmuch, scdoc
-, python3, perl, w3m, dante
+, python3, perl, w3m, dante, Security
 }:
 
 let
@@ -29,7 +29,8 @@ in buildGoModule rec {
     python3.pkgs.colorama
   ];
 
-  buildInputs = [ python3 notmuch ];
+  buildInputs = [ python3 notmuch ]
+    ++ stdenv.lib.optionals stdenv.isDarwin [ Security ];
 
   GOFLAGS="-tags=notmuch";
 
diff --git a/pkgs/applications/networking/p2p/magnetico/default.nix b/pkgs/applications/networking/p2p/magnetico/default.nix
index efab9aa992a0..f07db173dbcf 100644
--- a/pkgs/applications/networking/p2p/magnetico/default.nix
+++ b/pkgs/applications/networking/p2p/magnetico/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "magnetico";
-  version = "0.9.0";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner  = "boramalper";
     repo   = "magnetico";
     rev    = "v${version}";
-    sha256 = "1flw7r8igc0hhm288p67lpy9aj1fnywva5b28yfknpw8g97c9r5x";
+    sha256 = "1622xcl5v67lrnkjwbg7g5b5ikrawx7p91jxbj3ixc1za2f3a3fn";
   };
 
-  modSha256 = "1h9fij8mxlxfw7kxix00n10fkhkvmf8529fxbk1n30cxc1bs2szf";
+  modSha256 = "193n323xaypm9xkpray68nqcgyf141x8qzpxzwjnrmsgfz8p6wgk";
 
   nativeBuildInputs = [ go-bindata ];
   buildPhase = ''
diff --git a/pkgs/applications/networking/remote/wayvnc/default.nix b/pkgs/applications/networking/remote/wayvnc/default.nix
index 7cf989de33ec..865710184f93 100644
--- a/pkgs/applications/networking/remote/wayvnc/default.nix
+++ b/pkgs/applications/networking/remote/wayvnc/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "wayvnc";
-  version = "0.1.1";
+  version = "0.1.2";
 
   src = fetchFromGitHub {
     owner = "any1";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1qk8xrqd8ls2hpkj7g4aknr73x3lbzzdjpja16rbp2r0m4iv95ld";
+    sha256 = "0aa12fkbwhzs0g2pqw1b27l33nn5dpbcvsf1z8h88kwsf9xdvb2r";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/networking/syncthing/default.nix b/pkgs/applications/networking/syncthing/default.nix
index 516acab10f8b..0fd3a5ca2801 100644
--- a/pkgs/applications/networking/syncthing/default.nix
+++ b/pkgs/applications/networking/syncthing/default.nix
@@ -1,4 +1,4 @@
-{ buildGoModule, stdenv, lib, procps, fetchFromGitHub }:
+{ buildGoModule, stdenv, lib, procps, fetchFromGitHub, libobjc, CoreServices, Foundation }:
 
 let
   common = { stname, target, postInstall ? "" }:
@@ -15,6 +15,8 @@ let
 
       modSha256 = "1qq0979cm42wd3scy3blyi0hg67mkghis9r5rn2x1lqi2b982wfh";
 
+      buildInputs = stdenv.lib.optionals stdenv.isDarwin [ libobjc CoreServices Foundation ];
+
       patches = [
         ./add-stcli-target.patch
       ];
diff --git a/pkgs/applications/networking/websocketd/default.nix b/pkgs/applications/networking/websocketd/default.nix
index 4160e70b9c44..8d0e92488dbb 100644
--- a/pkgs/applications/networking/websocketd/default.nix
+++ b/pkgs/applications/networking/websocketd/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "websocketd";
@@ -13,7 +13,9 @@ buildGoModule rec {
 
   modSha256 = "18hamj557ln8k3vmvcrpvnydjr1dy7zi9490iacwdldw5vp870xs";
 
-  meta = with lib; {
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
+  meta = with stdenv.lib; {
     description = "Turn any program that uses STDIN/STDOUT into a WebSocket server";
     homepage = "http://websocketd.com/";
     maintainers = [ maintainers.bjornfor ];
diff --git a/pkgs/applications/version-management/git-and-tools/default.nix b/pkgs/applications/version-management/git-and-tools/default.nix
index a4b3ac1a65aa..c4a99cf18584 100644
--- a/pkgs/applications/version-management/git-and-tools/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/default.nix
@@ -34,7 +34,9 @@ let
     inherit (darwin.apple_sdk.frameworks) Security;
   };
 
-  ghq = callPackage ./ghq { };
+  ghq = callPackage ./ghq {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   git = appendToName "minimal" gitBase;
 
@@ -65,7 +67,9 @@ let
 
   git-appraise = callPackage ./git-appraise {};
 
-  git-bug = callPackage ./git-bug { };
+  git-bug = callPackage ./git-bug {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   # support for bugzilla
   git-bz = callPackage ./git-bz { };
@@ -136,7 +140,9 @@ let
 
   git-subrepo = callPackage ./git-subrepo { };
 
-  git-subtrac = callPackage ./git-subtrac { };
+  git-subtrac = callPackage ./git-subtrac {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   git-sync = callPackage ./git-sync { };
 
@@ -177,9 +183,13 @@ let
     inherit (darwin) Security;
   };
 
-  lab = callPackage ./lab { };
+  lab = callPackage ./lab {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
-  lefthook = callPackage ./lefthook { };
+  lefthook = callPackage ./lefthook {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   pass-git-helper = python3Packages.callPackage ./pass-git-helper { };
 
diff --git a/pkgs/applications/version-management/git-and-tools/ghq/default.nix b/pkgs/applications/version-management/git-and-tools/ghq/default.nix
index d0c468ab68ea..34829c14b7bb 100644
--- a/pkgs/applications/version-management/git-and-tools/ghq/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/ghq/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "ghq";
@@ -13,6 +13,8 @@ buildGoModule rec {
 
   modSha256 = "0hlbhky3c6zva9khn73n6xgq57k5p8anskxy3g2m0wzhr72cyc41";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   buildFlagsArray = ''
     -ldflags=
       -X=main.Version=${version}
diff --git a/pkgs/applications/version-management/git-and-tools/git-bug/default.nix b/pkgs/applications/version-management/git-and-tools/git-bug/default.nix
index ed0c8680d753..fdb5a6c53fdf 100644
--- a/pkgs/applications/version-management/git-and-tools/git-bug/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-bug/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "git-bug";
@@ -15,6 +15,8 @@ buildGoModule rec {
 
   modSha256 = "1cfn49cijiarzzczrpd28x1k7ib98xyzlvn3zghwk2ngfgiah3ld";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   buildFlagsArray = ''
     -ldflags= 
       -X ${goPackagePath}/commands.GitCommit=${rev}
diff --git a/pkgs/applications/version-management/git-and-tools/git-subtrac/default.nix b/pkgs/applications/version-management/git-and-tools/git-subtrac/default.nix
index 07c63ea0119b..9ccf3c606a2a 100644
--- a/pkgs/applications/version-management/git-and-tools/git-subtrac/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-subtrac/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "git-subtrac";
@@ -13,7 +13,9 @@ buildGoModule rec {
 
   modSha256 = "147vzllp1gydk2156hif313vwykagrj35vaiqy1swqczxs7p9hhs";
 
-  meta = with lib; {
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
+  meta = with stdenv.lib; {
     description = "Keep the content for your git submodules all in one place: the parent repo";
     homepage = "https://github.com/apenwarr/git-subtrac";
     license = licenses.asl20;
diff --git a/pkgs/applications/version-management/git-and-tools/lab/default.nix b/pkgs/applications/version-management/git-and-tools/lab/default.nix
index 3e47631caf69..8780ce4a2205 100644
--- a/pkgs/applications/version-management/git-and-tools/lab/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/lab/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "lab";
@@ -15,6 +15,8 @@ buildGoModule rec {
 
   modSha256 = "03fqa7s6729g0a6ffiyc61dkldpi7vg8pvvpqak4c0mqi1dycivd";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   buildFlagsArray = [ "-ldflags=-s -w -X main.version=${version}" ];
 
   postInstall = ''
diff --git a/pkgs/applications/version-management/git-and-tools/lefthook/default.nix b/pkgs/applications/version-management/git-and-tools/lefthook/default.nix
index 9fc89d520ae9..c80cff15265e 100644
--- a/pkgs/applications/version-management/git-and-tools/lefthook/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/lefthook/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "lefthook";
@@ -13,6 +13,8 @@ buildGoModule rec {
 
   modSha256 = "0ih11gw2y9dhv3zw1fzjmdfjln5h6zg1bj7sl68cglf6743siqnq";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   meta = with stdenv.lib; {
     description = "Fast and powerful Git hooks manager for any type of projects";
     homepage = "https://github.com/Arkweid/lefthook";
diff --git a/pkgs/data/themes/mojave/default.nix b/pkgs/data/themes/mojave/default.nix
index d560e3fe5838..0bd71b46c0d9 100644
--- a/pkgs/data/themes/mojave/default.nix
+++ b/pkgs/data/themes/mojave/default.nix
@@ -1,15 +1,15 @@
-{ stdenv, fetchFromGitHub, fetchurl, gtk_engines, gtk-engine-murrine }:
+{ stdenv, fetchFromGitHub, fetchurl, glib, gtk-engine-murrine, gtk_engines, inkscape, optipng, sassc, which }:
 
 stdenv.mkDerivation rec {
   pname = "mojave-gtk-theme";
-  version = "2020-02-20";
+  version = "2020-03-19";
 
   srcs = [
     (fetchFromGitHub {
       owner = "vinceliuice";
       repo = pname;
       rev = version;
-      sha256 = "0fbpjfdx53g4qicr97jl1dssykjwwca9xzrfyh53dmd81vr6znpy";
+      sha256 = "1f120sx092i56q4dx2b8d3nnn9pdw67656446nw702rix7zc5jpx";
     })
     (fetchurl {
       url = "https://github.com/vinceliuice/Mojave-gtk-theme/raw/11741a99d96953daf9c27e44c94ae50a7247c0ed/macOS_Mojave_Wallpapers.tar.xz";
@@ -19,12 +19,32 @@ stdenv.mkDerivation rec {
 
   sourceRoot = "source";
 
+  nativeBuildInputs = [ glib inkscape optipng sassc which ];
+
   buildInputs = [ gtk_engines ];
 
   propagatedUserEnvPkgs = [ gtk-engine-murrine ];
 
-  installPhase = ''
+  postPatch = ''
     patchShebangs .
+
+    for f in render-assets.sh \
+             src/assets/gtk-2.0/render-assets.sh \
+             src/assets/gtk-3.0/common-assets/render-assets.sh \
+             src/assets/gtk-3.0/windows-assets/render-assets.sh \
+             src/assets/metacity-1/render-assets.sh \
+             src/assets/xfwm4/render-assets.sh
+    do
+      substituteInPlace $f \
+        --replace /usr/bin/inkscape ${inkscape}/bin/inkscape \
+        --replace /usr/bin/optipng ${optipng}/bin/optipng
+    done
+
+    # Shut up inkscape's warnings
+    export HOME="$NIX_BUILD_ROOT"
+  '';
+
+  installPhase = ''
     name= ./install.sh -d $out/share/themes
     install -D -t $out/share/wallpapers ../"macOS Mojave Wallpapers"/*
   '';
diff --git a/pkgs/desktops/cinnamon/cinnamon-control-center/default.nix b/pkgs/desktops/cinnamon/cinnamon-control-center/default.nix
index e8fa7c7b4e39..454d65335540 100644
--- a/pkgs/desktops/cinnamon/cinnamon-control-center/default.nix
+++ b/pkgs/desktops/cinnamon/cinnamon-control-center/default.nix
@@ -33,7 +33,7 @@
 , wrapGAppsHook
 , tzdata
 , glibc
-, networkmanagerapplet
+, libnma
 , modemmanager
 , xorg
 , gdk-pixbuf
@@ -71,7 +71,7 @@ stdenv.mkDerivation rec {
     gnome-online-accounts
     tzdata
     networkmanager
-    networkmanagerapplet
+    libnma
     modemmanager
     xorg.libXxf86misc
     xorg.libxkbfile
diff --git a/pkgs/desktops/cinnamon/cjs/default.nix b/pkgs/desktops/cinnamon/cjs/default.nix
index 9dbab8fd767e..d67a5d8386a8 100644
--- a/pkgs/desktops/cinnamon/cjs/default.nix
+++ b/pkgs/desktops/cinnamon/cjs/default.nix
@@ -17,7 +17,6 @@
 , libffi
 , gtk3
 , readline
-, networkmanagerapplet
 }:
 
 let
@@ -46,7 +45,6 @@ stdenv.mkDerivation rec {
     keybinder3
     upower
     xapps
-    networkmanagerapplet
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/gnome-3/core/gnome-control-center/default.nix b/pkgs/desktops/gnome-3/core/gnome-control-center/default.nix
index ea38ed883209..4e66a16bf7c5 100644
--- a/pkgs/desktops/gnome-3/core/gnome-control-center/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-control-center/default.nix
@@ -48,6 +48,7 @@
 , mutter
 , networkmanager
 , networkmanagerapplet
+, libnma
 , ninja
 , pkgconfig
 , polkit
@@ -126,7 +127,7 @@ stdenv.mkDerivation rec {
     modemmanager
     mutter # schemas for the keybindings
     networkmanager
-    networkmanagerapplet
+    libnma
     polkit
     samba
     tracker
diff --git a/pkgs/desktops/gnome-3/core/gnome-initial-setup/default.nix b/pkgs/desktops/gnome-3/core/gnome-initial-setup/default.nix
index 4423755f71ce..47d06ddac310 100644
--- a/pkgs/desktops/gnome-3/core/gnome-initial-setup/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-initial-setup/default.nix
@@ -28,7 +28,7 @@
 , polkit
 , webkitgtk
 , systemd
-, networkmanagerapplet
+, libnma
 , tzdata
 , yelp
 , libgnomekbd
@@ -73,7 +73,7 @@ stdenv.mkDerivation rec {
     pango
     polkit
     webkitgtk
-    networkmanagerapplet
+    libnma
   ];
 
   patches = [
diff --git a/pkgs/desktops/gnome-3/core/gnome-shell/default.nix b/pkgs/desktops/gnome-3/core/gnome-shell/default.nix
index 71d47a338a78..26e96b5a3385 100644
--- a/pkgs/desktops/gnome-3/core/gnome-shell/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-shell/default.nix
@@ -3,7 +3,7 @@
 , libstartup_notification, telepathy-glib, telepathy-logger, libXtst, unzip, glibcLocales, shared-mime-info
 , libgweather, libcanberra-gtk3, librsvg, geoclue2, perl, docbook_xml_dtd_42, desktop-file-utils
 , libpulseaudio, libical, gobject-introspection, gstreamer, wrapGAppsHook, libxslt, gcr
-, accountsservice, gdk-pixbuf, gdm, upower, ibus, networkmanagerapplet, libgnomekbd, gnome-desktop
+, accountsservice, gdk-pixbuf, gdm, upower, ibus, libnma, libgnomekbd, gnome-desktop
 , gsettings-desktop-schemas, gnome-keyring, glib, gjs, mutter, evolution-data-server, gtk3
 , sassc, systemd, gst_all_1, adwaita-icon-theme, gnome-bluetooth, gnome-clocks, gnome-settings-daemon
 , gnome-autoar, asciidoc-full }:
@@ -43,7 +43,7 @@ in stdenv.mkDerivation rec {
     gnome-autoar
 
     # not declared at build time, but typelib is needed at runtime
-    libgweather networkmanagerapplet
+    libgweather libnma
   ];
 
   patches = [
diff --git a/pkgs/desktops/gnome-3/extensions/draw-on-your-screen/default.nix b/pkgs/desktops/gnome-3/extensions/draw-on-your-screen/default.nix
new file mode 100644
index 000000000000..5e6f7b89e1d9
--- /dev/null
+++ b/pkgs/desktops/gnome-3/extensions/draw-on-your-screen/default.nix
@@ -0,0 +1,29 @@
+{ stdenv, fetchgit, gettext, gnome3 }:
+
+stdenv.mkDerivation rec {
+  pname = "gnome-shell-extension-draw-on-your-screen";
+  version = "6";
+
+  src = fetchgit {
+    url = "https://framagit.org/abakkk/DrawOnYourScreen/";
+    rev = "v${version}";
+    sha256 = "05i20ii8lv6mg56rz8lng80dx35l6g45j8wr7jgbp591hg0spj1w";
+  };
+
+  uuid = "drawOnYourScreen@abakkk.framagit.org";
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/share/gnome-shell/extensions/${uuid}
+    cp -r . $out/share/gnome-shell/extensions/${uuid}
+    runHook postInstall
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A drawing extension for GNOME Shell";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ ericdallo ];
+    platforms = gnome3.gnome-shell.meta.platforms;
+    homepage = "https://framagit.org/abakkk/DrawOnYourScreen";
+  };
+}
diff --git a/pkgs/desktops/gnome-3/games/five-or-more/default.nix b/pkgs/desktops/gnome-3/games/five-or-more/default.nix
index b4c6eaaec1bf..4d0512f1adbc 100644
--- a/pkgs/desktops/gnome-3/games/five-or-more/default.nix
+++ b/pkgs/desktops/gnome-3/games/five-or-more/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "five-or-more";
-  version = "3.32.0";
+  version = "3.32.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/five-or-more/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0v52i22ygv6y4zqs8nyb1qmacmj9whhqrw7qss6vn7by4nsikhrn";
+    sha256 = "0xw05dd2dwi9vsph9h158b4n89s5k07xrh6bjz1icm0pdmjwhpgk";
   };
 
   nativeBuildInputs = [
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with stdenv.lib; {
-    homepage = https://wiki.gnome.org/Apps/Five_or_more;
+    homepage = "https://wiki.gnome.org/Apps/Five_or_more";
     description = "Remove colored balls from the board by forming lines";
     maintainers = gnome3.maintainers;
     license = licenses.gpl2;
diff --git a/pkgs/desktops/pantheon/apps/switchboard-plugs/network/default.nix b/pkgs/desktops/pantheon/apps/switchboard-plugs/network/default.nix
index 6e050c92d805..1ff1068119b7 100644
--- a/pkgs/desktops/pantheon/apps/switchboard-plugs/network/default.nix
+++ b/pkgs/desktops/pantheon/apps/switchboard-plugs/network/default.nix
@@ -11,6 +11,7 @@
 , gtk3
 , networkmanager
 , networkmanagerapplet
+, libnma
 , switchboard
 }:
 
@@ -43,7 +44,7 @@ stdenv.mkDerivation rec {
     gtk3
     libgee
     networkmanager
-    networkmanagerapplet
+    libnma
     switchboard
   ];
 
diff --git a/pkgs/desktops/pantheon/desktop/wingpanel-indicators/network/default.nix b/pkgs/desktops/pantheon/desktop/wingpanel-indicators/network/default.nix
index fd22de25d63c..cd04e6287b72 100644
--- a/pkgs/desktops/pantheon/desktop/wingpanel-indicators/network/default.nix
+++ b/pkgs/desktops/pantheon/desktop/wingpanel-indicators/network/default.nix
@@ -8,7 +8,7 @@
 , gtk3
 , granite
 , networkmanager
-, networkmanagerapplet
+, libnma
 , wingpanel
 , libgee
 }:
@@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
     gtk3
     libgee
     networkmanager
-    networkmanagerapplet
+    libnma
     wingpanel
   ];
 
diff --git a/pkgs/development/compilers/llvm/10/clang/default.nix b/pkgs/development/compilers/llvm/10/clang/default.nix
index 13fe4bedd46f..dfdc9f74e15b 100644
--- a/pkgs/development/compilers/llvm/10/clang/default.nix
+++ b/pkgs/development/compilers/llvm/10/clang/default.nix
@@ -8,7 +8,7 @@ let
     pname = "clang";
     inherit version;
 
-    src = fetch "clang" "1w7ixr16a9f0g5kv4irvhwq973wn0d418kb0p9rabyfscm05wfmq";
+    src = fetch "clang" "0ap63qhz0j6m63l4njwp055xni4s71dsxqi1w5d2p93hbswaiiw2";
 
     unpackPhase = ''
       unpackFile $src
@@ -36,7 +36,7 @@ let
     ];
 
     patches = [
-      # 10.0.0rc3-only
+      # 10.0.0 only, this should be present in 10.0.1
       ./clang-extension-handling.patch
 
       ./purity.patch
diff --git a/pkgs/development/compilers/llvm/10/compiler-rt.nix b/pkgs/development/compilers/llvm/10/compiler-rt.nix
index 2d71268c6624..8c870a610cc2 100644
--- a/pkgs/development/compilers/llvm/10/compiler-rt.nix
+++ b/pkgs/development/compilers/llvm/10/compiler-rt.nix
@@ -2,7 +2,7 @@
 stdenv.mkDerivation rec {
   pname = "compiler-rt";
   inherit version;
-  src = fetch pname "0qv40mv91630l6f75w9g5y6v97s5shz94n82rms12gcd8mir6qp5";
+  src = fetch pname "1g067yx8qz0bmf00b2xqjqaayqj2xvrjp9smms3a16syj9m0hfri";
 
   nativeBuildInputs = [ cmake python3 llvm ];
   buildInputs = stdenv.lib.optional stdenv.hostPlatform.isDarwin libcxxabi;
diff --git a/pkgs/development/compilers/llvm/10/default.nix b/pkgs/development/compilers/llvm/10/default.nix
index f2a8883a9a7e..574ab5ec4e77 100644
--- a/pkgs/development/compilers/llvm/10/default.nix
+++ b/pkgs/development/compilers/llvm/10/default.nix
@@ -6,7 +6,7 @@
 
 let
   release_version = "10.0.0";
-  candidate = "rc3";
+  candidate = "rc5";
   version = "10.0.0${candidate}"; # differentiating these is important for rc's
 
   fetch = name: sha256: fetchurl {
@@ -14,7 +14,7 @@ let
     inherit sha256;
   };
 
-  clang-tools-extra_src = fetch "clang-tools-extra" "03669c93wzmbmfpv0pyzb7y4z1xc912l95iqywyx01xgdl1xws0r";
+  clang-tools-extra_src = fetch "clang-tools-extra" "0x23q70c0xcwdhj0d66nisr8rqq69qcshrbb4si9pxfsm0zs9h3i";
 
   tools = stdenv.lib.makeExtensible (tools: let
     callPackage = newScope (tools // { inherit stdenv cmake libxml2 python3 isl release_version version fetch; });
@@ -30,16 +30,11 @@ let
   in {
 
     llvm = callPackage ./llvm.nix { };
-    llvm-polly = callPackage ./llvm.nix { enablePolly = true; };
 
     clang-unwrapped = callPackage ./clang {
       inherit (tools) lld;
       inherit clang-tools-extra_src;
     };
-    clang-polly-unwrapped = callPackage ./clang {
-      inherit clang-tools-extra_src;
-      llvm = tools.llvm-polly;
-    };
 
     llvm-manpages = lowPrio (tools.llvm.override {
       enableManpages = true;
diff --git a/pkgs/development/compilers/llvm/10/libc++/default.nix b/pkgs/development/compilers/llvm/10/libc++/default.nix
index 767b1cbbc583..18eae91d3402 100644
--- a/pkgs/development/compilers/llvm/10/libc++/default.nix
+++ b/pkgs/development/compilers/llvm/10/libc++/default.nix
@@ -5,7 +5,7 @@ stdenv.mkDerivation {
   pname = "libc++";
   inherit version;
 
-  src = fetch "libcxx" "1cjxiby8nq95g02rgx08iy86pswpi66b9wmxqjiyga1s92nb19j0";
+  src = fetch "libcxx" "0qw85sy3y1mcdrj8yd1j1gmskh0vs4xdgrx80niigizhr7030vxs";
 
   postUnpack = ''
     unpackFile ${libcxxabi.src}
diff --git a/pkgs/development/compilers/llvm/10/libc++abi.nix b/pkgs/development/compilers/llvm/10/libc++abi.nix
index 8ad52b5ed57f..ba51f0f33f1b 100644
--- a/pkgs/development/compilers/llvm/10/libc++abi.nix
+++ b/pkgs/development/compilers/llvm/10/libc++abi.nix
@@ -5,7 +5,7 @@ stdenv.mkDerivation {
   pname = "libc++abi";
   inherit version;
 
-  src = fetch "libcxxabi" "1xs7dr91qzz7lq9am4q3vcj2jf1gx23ar1jbnhn763011hl94vs0";
+  src = fetch "libcxxabi" "15iclzxjqfjynqxjg8dahyr0gfg83blv9dm7z9hq5ipxw8x2sglf";
 
   nativeBuildInputs = [ cmake ];
   buildInputs = stdenv.lib.optional (!stdenv.isDarwin && !stdenv.isFreeBSD && !stdenv.hostPlatform.isWasm) libunwind;
diff --git a/pkgs/development/compilers/llvm/10/libunwind.nix b/pkgs/development/compilers/llvm/10/libunwind.nix
index 74a8687179fe..6016d0536bff 100644
--- a/pkgs/development/compilers/llvm/10/libunwind.nix
+++ b/pkgs/development/compilers/llvm/10/libunwind.nix
@@ -4,7 +4,7 @@ stdenv.mkDerivation rec {
   pname = "libunwind";
   inherit version;
 
-  src = fetch pname "1dm7l75ajnjy6kbg2157v2g5gfia3n47fc56ayryyp2jdvbgprwl";
+  src = fetch pname "12c2fh63afav8rfmplfs628r74ksfs8fjls655rwjsrg1hk0gy3l";
 
   nativeBuildInputs = [ cmake ];
 
diff --git a/pkgs/development/compilers/llvm/10/lld.nix b/pkgs/development/compilers/llvm/10/lld.nix
index 6323866ae886..ab2dd8caee83 100644
--- a/pkgs/development/compilers/llvm/10/lld.nix
+++ b/pkgs/development/compilers/llvm/10/lld.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
   pname = "lld";
   inherit version;
 
-  src = fetch pname "1w9c9xmzbdnkwgal612hqz2lxj9jgqpfzxr2rllcspmf6v7arvf4";
+  src = fetch pname "08zg546872b432qrx49i7k1c2vdq9yjvc7gnrvy2nywv0d2qf9nc";
 
   nativeBuildInputs = [ cmake ];
   buildInputs = [ llvm libxml2 ];
diff --git a/pkgs/development/compilers/llvm/10/lldb.nix b/pkgs/development/compilers/llvm/10/lldb.nix
index fd318314dea5..12cb43bc504c 100644
--- a/pkgs/development/compilers/llvm/10/lldb.nix
+++ b/pkgs/development/compilers/llvm/10/lldb.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation (rec {
   pname = "lldb";
   inherit version;
 
-  src = fetch pname "06qzh13cr20wrd5925698yq696bhl68zbvm7kjxp7c2rx5swxmg8";
+  src = fetch pname "0swv16n7gm12f399f7hxai1jh89s14h3yg7cci10yaiibpvwk73x";
 
   patches = [ ./lldb-procfs.patch ];
 
diff --git a/pkgs/development/compilers/llvm/10/llvm.nix b/pkgs/development/compilers/llvm/10/llvm.nix
index eb93d8648f9a..0405958070a2 100644
--- a/pkgs/development/compilers/llvm/10/llvm.nix
+++ b/pkgs/development/compilers/llvm/10/llvm.nix
@@ -17,7 +17,7 @@
 , enablePFM ? !(stdenv.isDarwin
   || stdenv.isAarch64 # broken for Ampere eMAG 8180 (c2.large.arm on Packet) #56245
 )
-, enablePolly ? false
+, enablePolly ? true
 }:
 
 let
@@ -31,8 +31,8 @@ in stdenv.mkDerivation (rec {
   pname = "llvm";
   inherit version;
 
-  src = fetch pname "1pa322iwqg071gxdn5wxri263j6aki6ag36xbdzbyi3g8m8v8jci";
-  polly_src = fetch "polly" "0p9dmv4hxwx4f5k1v4r9b5jp7fbi71ajpmrv3xf3vmp6m4i3r0pc";
+  src = fetch pname "1abfi0zqbcwxf68dk00szpjxkcd44589va243af8sg97hljq6709";
+  polly_src = fetch "polly" "1fzg5934km69rwam6vgznk0p4slzhr0icwmj3jibw3p93ppa8k9r";
 
   unpackPhase = ''
     unpackFile $src
diff --git a/pkgs/development/compilers/llvm/10/openmp.nix b/pkgs/development/compilers/llvm/10/openmp.nix
index cff2ad365360..1cdd4cc9bba1 100644
--- a/pkgs/development/compilers/llvm/10/openmp.nix
+++ b/pkgs/development/compilers/llvm/10/openmp.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
   pname = "openmp";
   inherit version;
 
-  src = fetch pname "0axdxar18rvk9r4yx7y55ywqr3070mixag9sg2fcck1jzwfgymjb";
+  src = fetch pname "0swif1plz7drjha6rdw02b60symsz95w62wxpiygbpdwsmhbbgam";
 
   nativeBuildInputs = [ cmake perl ];
   buildInputs = [ llvm ];
diff --git a/pkgs/development/interpreters/joker/default.nix b/pkgs/development/interpreters/joker/default.nix
index ed82f76eec24..1db2dd60197b 100644
--- a/pkgs/development/interpreters/joker/default.nix
+++ b/pkgs/development/interpreters/joker/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "joker";
@@ -13,6 +13,8 @@ buildGoModule rec {
 
   modSha256 = "0i16vf7n1xfz5kp9w3fvyc9y9wgz4h396glgpdaznpxjr12rb43j";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   preBuild = ''
     go generate ./...
   '';
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index 3c952d601654..a2a0c68c316e 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -59,7 +59,9 @@ let
                                      (stdenv.hostPlatform.parsed.cpu.bits != 32)
                                      (toString stdenv.hostPlatform.parsed.cpu.bits)}"
         else if stdenv.hostPlatform.isLinux
-          then "./Configure linux-generic${toString stdenv.hostPlatform.parsed.cpu.bits}"
+          then (if stdenv.hostPlatform.isx86_64
+            then "./Configure linux-x86_64"
+            else "./Configure linux-generic${toString stdenv.hostPlatform.parsed.cpu.bits}")
         else if stdenv.hostPlatform.isiOS
           then "./Configure ios${toString stdenv.hostPlatform.parsed.cpu.bits}-cross"
         else
diff --git a/pkgs/development/libraries/packr/default.nix b/pkgs/development/libraries/packr/default.nix
index 4482a9cd312d..b0c7ac3cab6b 100644
--- a/pkgs/development/libraries/packr/default.nix
+++ b/pkgs/development/libraries/packr/default.nix
@@ -1,6 +1,7 @@
 { buildGoModule
 , fetchFromGitHub
-, lib
+, stdenv
+, Security
 }:
 
 buildGoModule rec {
@@ -16,9 +17,11 @@ buildGoModule rec {
 
   subPackages = [ "packr" "v2/packr2" ];
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   modSha256 = "0afhkvivma16bi8rz3kwcsz9mhmcn4zm6rrymxkvazx6b844hcdv";
 
-  meta = with lib; {
+  meta = with stdenv.lib; {
     description = "The simple and easy way to embed static files into Go binaries";
     homepage = "https://github.com/gobuffalo/packr";
     license = licenses.mit;
diff --git a/pkgs/development/libraries/science/math/mongoose/default.nix b/pkgs/development/libraries/science/math/mongoose/default.nix
new file mode 100644
index 000000000000..36c53b2994f5
--- /dev/null
+++ b/pkgs/development/libraries/science/math/mongoose/default.nix
@@ -0,0 +1,30 @@
+{ stdenv
+, fetchFromGitHub
+, cmake
+}:
+
+stdenv.mkDerivation rec {
+  pname = "mongoose";
+  version = "2.0.4";
+
+  outputs = [ "bin" "out" "dev" ];
+
+  src = fetchFromGitHub {
+    owner = "ScottKolo";
+    repo = "Mongoose";
+    rev = "v${version}";
+    sha256 = "0ymwd4n8p8s0ndh1vcbmjcsm0x2cc2b7v3baww5y6as12873bcrh";
+  };
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  meta = with stdenv.lib; {
+    description = "Graph Coarsening and Partitioning Library";
+    homepage = "https://github.com/ScottKolo/Mongoose";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [];
+    platforms = with platforms; unix;
+  };
+}
diff --git a/pkgs/development/libraries/science/math/suitesparse-graphblas/default.nix b/pkgs/development/libraries/science/math/suitesparse-graphblas/default.nix
new file mode 100644
index 000000000000..599c1be66461
--- /dev/null
+++ b/pkgs/development/libraries/science/math/suitesparse-graphblas/default.nix
@@ -0,0 +1,32 @@
+{ stdenv
+, fetchFromGitHub
+, cmake
+, gnum4
+}:
+
+stdenv.mkDerivation rec {
+  pname = "suitesparse-graphblas";
+  version = "3.2.1";
+
+  outputs = [ "out" "dev" ];
+
+  src = fetchFromGitHub {
+    owner = "DrTimothyAldenDavis";
+    repo = "GraphBLAS";
+    rev = "v${version}";
+    sha256 = "AAwwzrpKFHy40Ldm6hTO6L0FWPYwi3kJj3zrshFwYas=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    gnum4
+  ];
+
+  meta = with stdenv.lib; {
+    description = "Graph algorithms in the language of linear algebra";
+    homepage = "http://faculty.cse.tamu.edu/davis/GraphBLAS.html";
+    license = licenses.asl20;
+    maintainers = with maintainers; [];
+    platforms = with platforms; unix;
+  };
+}
diff --git a/pkgs/development/libraries/science/math/suitesparse/default.nix b/pkgs/development/libraries/science/math/suitesparse/default.nix
index f72574cff583..f4adafd0f387 100644
--- a/pkgs/development/libraries/science/math/suitesparse/default.nix
+++ b/pkgs/development/libraries/science/math/suitesparse/default.nix
@@ -1,96 +1,65 @@
-{ stdenv, fetchurl, gfortran, openblas, cmake, fixDarwinDylibNames
+{ stdenv
+, fetchFromGitHub
+, gfortran
+, openblas
+, metis
+, fixDarwinDylibNames
 , gnum4
-, enableCuda  ? false, cudatoolkit
+, enableCuda ? false
+, cudatoolkit
 }:
 
-let
-  version = "5.4.0";
-  name = "suitesparse-${version}";
-
-  SHLIB_EXT = stdenv.hostPlatform.extensions.sharedLibrary;
-in
 stdenv.mkDerivation rec {
-  inherit name;
-
-  src = fetchurl {
-    url = "http://faculty.cse.tamu.edu/davis/SuiteSparse/SuiteSparse-${version}.tar.gz";
-    sha256 = "1lfvjj787yqyhk25w7brlrkrl7dnnn5dq4ijxws3wrbcd4vd2k9p";
-  };
+  pname = "suitesparse";
+  version = "5.7.1";
 
-  dontUseCmakeConfigure = true;
+  outputs = [ "out" "dev" "doc" ];
 
-  preConfigure = ''
-    mkdir -p $out/lib
-    mkdir -p $out/include
-    mkdir -p $out/share/doc/${name}
-
-    sed -i "SuiteSparse_config/SuiteSparse_config.mk" \
-        -e 's/METIS .*$/METIS =/' \
-        -e 's/METIS_PATH .*$/METIS_PATH =/' \
-        -e '/CHOLMOD_CONFIG/ s/$/-DNPARTITION/'
-  ''
-  + stdenv.lib.optionalString stdenv.isDarwin ''
-    sed -i "SuiteSparse_config/SuiteSparse_config.mk" \
-        -e 's/^[[:space:]]*\(LIB = -lm\) -lrt/\1/'
-  ''
-  + stdenv.lib.optionalString enableCuda ''
-    sed -i "SuiteSparse_config/SuiteSparse_config.mk" \
-        -e 's|^[[:space:]]*\(CUDA_ROOT     =\)|CUDA_ROOT = ${cudatoolkit}|' \
-        -e 's|^[[:space:]]*\(GPU_BLAS_PATH =\)|GPU_BLAS_PATH = $(CUDA_ROOT)|' \
-        -e 's|^[[:space:]]*\(GPU_CONFIG    =\)|GPU_CONFIG = -I$(CUDA_ROOT)/include -DGPU_BLAS -DCHOLMOD_OMP_NUM_THREADS=$(NIX_BUILD_CORES) |' \
-        -e 's|^[[:space:]]*\(CUDA_PATH     =\)|CUDA_PATH = $(CUDA_ROOT)|' \
-        -e 's|^[[:space:]]*\(CUDART_LIB    =\)|CUDART_LIB = $(CUDA_ROOT)/lib64/libcudart.so|' \
-        -e 's|^[[:space:]]*\(CUBLAS_LIB    =\)|CUBLAS_LIB = $(CUDA_ROOT)/lib64/libcublas.so|' \
-        -e 's|^[[:space:]]*\(CUDA_INC_PATH =\)|CUDA_INC_PATH = $(CUDA_ROOT)/include/|' \
-        -e 's|^[[:space:]]*\(NV20          =\)|NV20 = -arch=sm_20 -Xcompiler -fPIC|' \
-        -e 's|^[[:space:]]*\(NV30          =\)|NV30 = -arch=sm_30 -Xcompiler -fPIC|' \
-        -e 's|^[[:space:]]*\(NV35          =\)|NV35 = -arch=sm_35 -Xcompiler -fPIC|' \
-        -e 's|^[[:space:]]*\(NVCC          =\) echo|NVCC = $(CUDA_ROOT)/bin/nvcc|' \
-        -e 's|^[[:space:]]*\(NVCCFLAGS     =\)|NVCCFLAGS = $(NV20) -O3 -gencode=arch=compute_20,code=sm_20 -gencode=arch=compute_30,code=sm_30 -gencode=arch=compute_35,code=sm_35 -gencode=arch=compute_60,code=sm_60|'
-  '';
-
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isDarwin " -DNTIMER";
-
-  buildPhase = ''
-    runHook preBuild
+  src = fetchFromGitHub {
+    owner = "DrTimothyAldenDavis";
+    repo = "SuiteSparse";
+    rev = "v${version}";
+    sha256 = "SA9SQKRDKUI1GilNMuCXljcvovLUwRKBUi/tiQ4dl5w=";
+  };
 
-    # Build individual shared libraries
-    make library        \
-        JOBS=$NIX_BUILD_CORES \
-        BLAS=-lopenblas \
-        LAPACK=""       \
-        ${stdenv.lib.optionalString openblas.blas64 "CFLAGS=-DBLAS64"}
+  nativeBuildInputs = [
+    gnum4
+  ] ++ stdenv.lib.optional stdenv.isDarwin fixDarwinDylibNames;
 
-    # Build libsuitesparse.so which bundles all the individual libraries.
-    # Bundling is done by building the static libraries, extracting objects from
-    # them and combining the objects into one shared library.
-    mkdir -p static
-    make static JOBS=$NIX_BUILD_CORES AR_TARGET=$(pwd)/static/'$(LIBRARY).a'
-    (
-        cd static
-        for i in lib*.a; do
-          ar -x $i
-        done
-    )
-    ${if enableCuda then "${cudatoolkit}/bin/nvcc" else "${stdenv.cc.outPath}/bin/cc"} \
-        static/*.o                                                                     \
-        ${if stdenv.isDarwin then "-dynamiclib" else "--shared"}                       \
-        -o "lib/libsuitesparse${SHLIB_EXT}"                                            \
-        -lopenblas                                                                     \
-        ${stdenv.lib.optionalString enableCuda "-lcublas"}
+  buildInputs = [
+    openblas
+    metis
+    gfortran.cc.lib
+  ] ++ stdenv.lib.optional enableCuda cudatoolkit;
 
-    runHook postBuild
+  preConfigure = ''
+    # Mongoose and GraphBLAS are packaged separately
+    sed -i "Makefile" -e '/GraphBLAS\|Mongoose/d'
   '';
 
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out
-    cp -r lib $out/
-    cp -r include $out/
-    cp -r share $out/
-    ''
-    + stdenv.lib.optionalString stdenv.isDarwin ''
+  makeFlags = [
+    "INSTALL=${placeholder "out"}"
+    "INSTALL_INCLUDE=${placeholder "dev"}/include"
+    "JOBS=$(NIX_BUILD_CORES)"
+    "BLAS=-lopenblas"
+    "MY_METIS_LIB=-lmetis"
+    "LAPACK="
+  ] ++ stdenv.lib.optionals openblas.blas64 [
+    "CFLAGS=-DBLAS64"
+  ] ++ stdenv.lib.optionals enableCuda [
+    "CUDA_PATH=${cudatoolkit}"
+    "CUDART_LIB=${cudatoolkit.lib}/lib/libcudart.so"
+    "CUBLAS_LIB=${cudatoolkit}/lib/libcublas.so"
+  ];
+
+  buildFlags = [
+    # Build individual shared libraries, not demos
+    "library"
+  ];
+
+  # Likely fixed after 5.7.1
+  # https://github.com/DrTimothyAldenDavis/SuiteSparse/commit/f6daae26ee391e475e2295e77c839aa7c1a8b784
+  postInstall = stdenv.lib.optionalString stdenv.isDarwin ''
     # The fixDarwinDylibNames in nixpkgs can't seem to fix all the libraries.
     # We manually fix them up here.
     fixDarwinDylibNames() {
@@ -109,28 +78,10 @@ stdenv.mkDerivation rec {
     }
 
     fixDarwinDylibNames $(find "$out" -name "*.dylib")
-    ''
-    + stdenv.lib.optionalString (!stdenv.isDarwin) ''
-    # Fix rpaths
-    cd $out
-    find -name \*.so\* -type f -exec \
-      patchelf --set-rpath "$out/lib:${stdenv.lib.makeLibraryPath buildInputs}" {} \;
-    ''
-    +
-    ''
-    runHook postInstall
-    '';
-
-  nativeBuildInputs = [
-    cmake
-    gnum4
-  ] ++ stdenv.lib.optional stdenv.isDarwin fixDarwinDylibNames;
-
-  buildInputs = [ openblas gfortran.cc.lib ]
-    ++ stdenv.lib.optional enableCuda cudatoolkit;
+  '';
 
   meta = with stdenv.lib; {
-    homepage = http://faculty.cse.tamu.edu/davis/suitesparse.html;
+    homepage = "http://faculty.cse.tamu.edu/davis/suitesparse.html";
     description = "A suite of sparse matrix algorithms";
     license = with licenses; [ bsd2 gpl2Plus lgpl21Plus ];
     maintainers = with maintainers; [ ttuegel ];
diff --git a/pkgs/development/libraries/tiledb/default.nix b/pkgs/development/libraries/tiledb/default.nix
index d1aea0c82a2c..a20e4383278b 100644
--- a/pkgs/development/libraries/tiledb/default.nix
+++ b/pkgs/development/libraries/tiledb/default.nix
@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation rec {
   pname = "tiledb";
-  version = "1.7.5";
+  version = "1.7.6";
 
   src = fetchFromGitHub {
     owner = "TileDB-Inc";
     repo = "TileDB";
     rev = version;
-    sha256 = "1fx0db4x0vcahzk5lk2p0ls644s48vfz7mf9qgsr72pplyn1kcnc";
+    sha256 = "0khxd1w5piqkxjiibnfvxcpk9lb8pi5x95zll5qs7vpbznn56b18";
   };
 
   nativeBuildInputs = [
@@ -67,7 +67,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "TileDB allows you to manage the massive dense and sparse multi-dimensional array data";
-    homepage = https://github.com/TileDB-Inc/TileDB;
+    homepage = "https://github.com/TileDB-Inc/TileDB";
     license = licenses.mit;
     platforms = [ "x86_64-linux"];
     maintainers = with maintainers; [ rakesh4g ];
diff --git a/pkgs/development/ocaml-modules/parmap/default.nix b/pkgs/development/ocaml-modules/parmap/default.nix
index a37120b2496b..5127dc3b1e6d 100644
--- a/pkgs/development/ocaml-modules/parmap/default.nix
+++ b/pkgs/development/ocaml-modules/parmap/default.nix
@@ -1,12 +1,12 @@
-{ lib, buildDunePackage, fetchzip }:
+{ lib, buildDunePackage, fetchurl }:
 
 buildDunePackage rec {
   pname = "parmap";
-  version = "1.1";
+  version = "1.1.1";
 
-  src = fetchzip {
+  src = fetchurl {
     url = "https://github.com/rdicosmo/${pname}/releases/download/${version}/${pname}-${version}.tbz";
-    sha256 = "13ahqaga1palf0s0dll512cl7k43sllmwvw6r03y70kfmky1j114";
+    sha256 = "1pci7b1jqxkgmrbhr0p5j98i4van5nfmmb3sak8cyvxhwgna93j4";
   };
 
   doCheck = true;
diff --git a/pkgs/development/python-modules/cvxopt/default.nix b/pkgs/development/python-modules/cvxopt/default.nix
index a842baca2289..fd44f49b53c9 100644
--- a/pkgs/development/python-modules/cvxopt/default.nix
+++ b/pkgs/development/python-modules/cvxopt/default.nix
@@ -31,8 +31,8 @@ buildPythonPackage rec {
     export CVXOPT_BLAS_LIB_DIR=${openblasCompat}/lib
     export CVXOPT_BLAS_LIB=openblas
     export CVXOPT_LAPACK_LIB=openblas
-    export CVXOPT_SUITESPARSE_LIB_DIR=${suitesparse}/lib
-    export CVXOPT_SUITESPARSE_INC_DIR=${suitesparse}/include
+    export CVXOPT_SUITESPARSE_LIB_DIR=${lib.getLib suitesparse}/lib
+    export CVXOPT_SUITESPARSE_INC_DIR=${lib.getDev suitesparse}/include
   '' + lib.optionalString withGsl ''
     export CVXOPT_BUILD_GSL=1
     export CVXOPT_GSL_LIB_DIR=${gsl}/lib
diff --git a/pkgs/development/tools/analysis/tflint/default.nix b/pkgs/development/tools/analysis/tflint/default.nix
index 8f370d2e0aa1..475ff662b85a 100644
--- a/pkgs/development/tools/analysis/tflint/default.nix
+++ b/pkgs/development/tools/analysis/tflint/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "tflint";
@@ -13,9 +13,11 @@ buildGoModule rec {
 
   modSha256 = "1jbnsqa0ga372lhbgfnqvx8pdzrm0b2phzzwll4sgd0k1hzv2aqv";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   subPackages = [ "." ];
 
-  meta = with lib; {
+  meta = with stdenv.lib; {
     description = "Terraform linter focused on possible errors, best practices, and so on";
     homepage = "https://github.com/terraform-linters/tflint";
     changelog = "https://github.com/terraform-linters/tflint/releases/tag/v${version}";
diff --git a/pkgs/development/tools/azcopy/default.nix b/pkgs/development/tools/azcopy/default.nix
index 328092feafc5..40741d96f562 100644
--- a/pkgs/development/tools/azcopy/default.nix
+++ b/pkgs/development/tools/azcopy/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, buildGoModule }:
+{ stdenv, fetchFromGitHub, buildGoModule, Security }:
 
 buildGoModule rec {
   pname = "azure-storage-azcopy";
@@ -11,6 +11,8 @@ buildGoModule rec {
     sha256 = "16pdvcgy1d5dfqk3as23j45rkwfrv232n384cj5wfz9qwijkcy5g";
   };
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   subPackages = [ "." ];
 
   modSha256 = "07cy2zi7m2pkbfdcy659x4k5j2w60cmjy8kxv1dcii3dc6ls4bvb";
diff --git a/pkgs/development/tools/bazelisk/default.nix b/pkgs/development/tools/bazelisk/default.nix
index 5780cf4382a7..a737ddbb0fb6 100644
--- a/pkgs/development/tools/bazelisk/default.nix
+++ b/pkgs/development/tools/bazelisk/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "bazelisk";
@@ -13,6 +13,8 @@ buildGoModule rec {
 
   modSha256 = "1w8k659ifapcxbbim0nf7wd7w10bhlagc33q08izh84gcgsh0yyz";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   meta = with stdenv.lib; {
     description = "A user-friendly launcher for Bazel";
     longDescription = ''
diff --git a/pkgs/development/tools/conftest/default.nix b/pkgs/development/tools/conftest/default.nix
index ae35170cd193..fe8d58f76827 100644
--- a/pkgs/development/tools/conftest/default.nix
+++ b/pkgs/development/tools/conftest/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "conftest";
@@ -13,12 +13,14 @@ buildGoModule rec {
 
   modSha256 = "1p7fjg1vcrcxb4f5hd00qxx4fqcl051klcjs6ljn4v46qcpn6dcn";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   buildFlagsArray = ''
     -ldflags=
         -X main.version=${version}
   '';
 
-  meta = with lib; {
+  meta = with stdenv.lib; {
     description = "Write tests against structured configuration data";
     homepage = https://github.com/instrumenta/conftest;
     license = licenses.asl20;
diff --git a/pkgs/development/tools/continuous-integration/drone-cli/default.nix b/pkgs/development/tools/continuous-integration/drone-cli/default.nix
index a3df81d26053..c6e4878d52c4 100644
--- a/pkgs/development/tools/continuous-integration/drone-cli/default.nix
+++ b/pkgs/development/tools/continuous-integration/drone-cli/default.nix
@@ -1,11 +1,8 @@
-{ stdenv, fetchFromGitHub, buildGoModule }:
+{ stdenv, fetchFromGitHub, buildGoModule, Security }:
 
-let version = "1.2.1";
-in buildGoModule rec {
-  inherit version;
+buildGoModule rec {
   pname = "drone-cli";
-  revision = "v${version}";
-  goPackagePath = "github.com/drone/drone-cli";
+  version = "1.2.1";
 
   modSha256 = "0g0vq4vm2hy00r2gjsrhg57xv9sldlqix3wzimiqdli085bcz46b";
 
@@ -16,10 +13,12 @@ in buildGoModule rec {
   src = fetchFromGitHub {
     owner = "drone";
     repo = "drone-cli";
-    rev = revision;
+    rev = "v${version}";
     sha256 = "19icihi5nxcafxlh4w61nl4cd0dhvik9zl8g4gqmazikjqsjms2j";
   };
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   meta = with stdenv.lib; {
     maintainers = with maintainers; [ bricewge ];
     license = licenses.asl20;
diff --git a/pkgs/development/tools/continuous-integration/drone/default.nix b/pkgs/development/tools/continuous-integration/drone/default.nix
index 05257f65af52..e1f0a8de3b87 100644
--- a/pkgs/development/tools/continuous-integration/drone/default.nix
+++ b/pkgs/development/tools/continuous-integration/drone/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, buildGoModule }:
+{ stdenv, fetchFromGitHub, buildGoModule, Security }:
 
 buildGoModule rec {
   name = "drone.io-${version}";
@@ -14,6 +14,8 @@ buildGoModule rec {
     sha256 = "05cgd72qyss836fby0adhrm5p8g7639psk2yslhg6pmz0cqfbq9m";
   };
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   meta = with stdenv.lib; {
     maintainers = with maintainers; [ elohmeier vdemeester ];
     license = licenses.asl20;
diff --git a/pkgs/development/tools/continuous-integration/fly/default.nix b/pkgs/development/tools/continuous-integration/fly/default.nix
index e5454796b7e4..4093e7e01728 100644
--- a/pkgs/development/tools/continuous-integration/fly/default.nix
+++ b/pkgs/development/tools/continuous-integration/fly/default.nix
@@ -1,4 +1,4 @@
-{ buildGoModule, fetchFromGitHub, lib, writeText }:
+{ buildGoModule, fetchFromGitHub, stdenv, writeText, Security }:
 
 buildGoModule rec {
   pname = "fly";
@@ -20,6 +20,8 @@ buildGoModule rec {
       -X github.com/concourse/concourse.Version=${version}
   '';
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   # The fly.bash file included with this derivation can be replaced by a
   # call to `fly completion bash` once the `completion` subcommand has
   # made it into a release. Similarly, `fly completion zsh` will provide
@@ -28,7 +30,7 @@ buildGoModule rec {
     install -D -m 444 ${./fly.bash} $out/share/bash-completion/completions/fly
   '';
 
-  meta = with lib; {
+  meta = with stdenv.lib; {
     description = "A command line interface to Concourse CI";
     homepage = "https://concourse-ci.org";
     license = licenses.asl20;
diff --git a/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix b/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
index 01c6ec0df29e..df1cef6f3f84 100644
--- a/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
+++ b/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
@@ -1,16 +1,16 @@
 { lib, buildGoPackage, fetchFromGitLab, fetchurl }:
 
 let
-  version = "12.8.0";
+  version = "12.9.0";
   # Gitlab runner embeds some docker images these are prebuilt for arm and x86_64
   docker_x86_64 = fetchurl {
     url = "https://gitlab-runner-downloads.s3.amazonaws.com/v${version}/helper-images/prebuilt-x86_64.tar.xz";
-    sha256 = "02k9nzfqlsd78dan522qynbz2i2ggvf960968vmg0wdg6rjv19z2";
+    sha256 = "0kd4zc9rgzsl6imk9vi2yqpaxrgy8ywcz2vvpsfzrhhmm2yx3qh0";
   };
 
   docker_arm = fetchurl {
     url = "https://gitlab-runner-downloads.s3.amazonaws.com/v${version}/helper-images/prebuilt-arm.tar.xz";
-    sha256 = "098g6948w8skbz9z5212ndsxvf3k12aijy0v2a7c86r0zhlga52x";
+    sha256 = "13xwcvw6m3p5ffas5mr55jkqks9s3f7qg1b928vcxkx57j06kb22";
   };
 in
 buildGoPackage rec {
@@ -29,7 +29,7 @@ buildGoPackage rec {
     owner = "gitlab-org";
     repo = "gitlab-runner";
     rev = "v${version}";
-    sha256 = "17cs7bs3dxkj6r7hip6kv7cj7g5lq9x1g3gcl2kjj8djxzkhfc4m";
+    sha256 = "0p9i4z0xsq5rl6gkqjpwpz6hb57vi6wl969gncrsfskjjc1kcifq";
   };
 
   patches = [ ./fix-shell-path.patch ];
diff --git a/pkgs/development/tools/cue/default.nix b/pkgs/development/tools/cue/default.nix
index 98bf5249b626..4950e885e25c 100644
--- a/pkgs/development/tools/cue/default.nix
+++ b/pkgs/development/tools/cue/default.nix
@@ -1,4 +1,4 @@
-{ buildGoModule, fetchgit, stdenv }:
+{ buildGoModule, fetchgit, stdenv, Security }:
 
 buildGoModule rec {
   pname = "cue";
@@ -12,6 +12,8 @@ buildGoModule rec {
 
   modSha256 = "04dapx75zwi8cv1pj3c6266znrhwihv3df4izm3gjk34r2i07q6s";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   subPackages = [ "cmd/cue" ];
 
   buildFlagsArray = [
diff --git a/pkgs/development/tools/database/dbmate/default.nix b/pkgs/development/tools/database/dbmate/default.nix
index efc20b6972be..57aa9c654d7f 100644
--- a/pkgs/development/tools/database/dbmate/default.nix
+++ b/pkgs/development/tools/database/dbmate/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "dbmate";
@@ -13,6 +13,8 @@ buildGoModule rec {
 
   modSha256 = "12x3m5bjyx3blh5i51pd99phv73m96pmm6i3ir4vf2kms3viif9i";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   meta = with stdenv.lib; {
     description = "Database migration tool";
     homepage = https://github.com/amacneil/dbmate;
diff --git a/pkgs/development/tools/database/dbmate/deps.nix b/pkgs/development/tools/database/dbmate/deps.nix
deleted file mode 100644
index 97bfc10b20af..000000000000
--- a/pkgs/development/tools/database/dbmate/deps.nix
+++ /dev/null
@@ -1,84 +0,0 @@
-# file generated from Gopkg.lock using dep2nix (https://github.com/nixcloud/dep2nix)
-[
-  {
-    goPackagePath  = "github.com/davecgh/go-spew";
-    fetch = {
-      type = "git";
-      url = "https://github.com/davecgh/go-spew";
-      rev =  "346938d642f2ec3594ed81d874461961cd0faa76";
-      sha256 = "0d4jfmak5p6lb7n2r6yvf5p1zcw0l8j74kn55ghvr7zr7b7axm6c";
-    };
-  }
-  {
-    goPackagePath  = "github.com/go-sql-driver/mysql";
-    fetch = {
-      type = "git";
-      url = "https://github.com/go-sql-driver/mysql";
-      rev =  "2cc627ac8defc45d65066ae98f898166f580f9a4";
-      sha256 = "0n589y9ak2m6glaqmqlggrfv2hghy5i2906r123svf92ci4r9sww";
-    };
-  }
-  {
-    goPackagePath  = "github.com/joho/godotenv";
-    fetch = {
-      type = "git";
-      url = "https://github.com/joho/godotenv";
-      rev =  "a79fa1e548e2c689c241d10173efd51e5d689d5b";
-      sha256 = "09610yqswxa02905mp9cqgsm50r76saagzddc55sqav4ad04j6qm";
-    };
-  }
-  {
-    goPackagePath  = "github.com/lib/pq";
-    fetch = {
-      type = "git";
-      url = "https://github.com/lib/pq";
-      rev =  "19c8e9ad00952ce0c64489b60e8df88bb16dd514";
-      sha256 = "0lm79ja5id7phf1jwf1vs987azaxis0q7qr69px0r6gqiva0q0vz";
-    };
-  }
-  {
-    goPackagePath  = "github.com/mattn/go-sqlite3";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mattn/go-sqlite3";
-      rev =  "6c771bb9887719704b210e87e934f08be014bdb1";
-      sha256 = "0x6s7hy3ab3qw6dfl81y7ighjva5j4rrzvqhppf1qwz5alpfmpdm";
-    };
-  }
-  {
-    goPackagePath  = "github.com/pmezard/go-difflib";
-    fetch = {
-      type = "git";
-      url = "https://github.com/pmezard/go-difflib";
-      rev =  "792786c7400a136282c1664665ae0a8db921c6c2";
-      sha256 = "0c1cn55m4rypmscgf0rrb88pn58j3ysvc2d0432dp3c6fqg6cnzw";
-    };
-  }
-  {
-    goPackagePath  = "github.com/stretchr/testify";
-    fetch = {
-      type = "git";
-      url = "https://github.com/stretchr/testify";
-      rev =  "b91bfb9ebec76498946beb6af7c0230c7cc7ba6c";
-      sha256 = "178xyfgsbs40jq406aqj0r67ik1b81gdc28z45nbcw6hfhz82rvl";
-    };
-  }
-  {
-    goPackagePath  = "github.com/urfave/cli";
-    fetch = {
-      type = "git";
-      url = "https://github.com/urfave/cli";
-      rev =  "cfb38830724cc34fedffe9a2a29fb54fa9169cd1";
-      sha256 = "0y6f4sbzkiiwrxbl15biivj8c7qwxnvm3zl2dd3mw4wzg4x10ygj";
-    };
-  }
-  {
-    goPackagePath  = "google.golang.org/appengine";
-    fetch = {
-      type = "git";
-      url = "https://github.com/golang/appengine";
-      rev =  "150dc57a1b433e64154302bdc40b6bb8aefa313a";
-      sha256 = "0w3knznv39k8bm85ri62f83czcrxknql7dv6p9hk1a5jx3xljgxq";
-    };
-  }
-]
diff --git a/pkgs/development/tools/dive/default.nix b/pkgs/development/tools/dive/default.nix
index 5d4de99ffdbf..91889e80c044 100644
--- a/pkgs/development/tools/dive/default.nix
+++ b/pkgs/development/tools/dive/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub, pkg-config, btrfs-progs, gpgme, lvm2 }:
+{ stdenv, buildGoModule, fetchFromGitHub, pkg-config, btrfs-progs, gpgme, lvm2, Security }:
 
 buildGoModule rec {
   pname = "dive";
@@ -15,7 +15,8 @@ buildGoModule rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs = stdenv.lib.optionals stdenv.isLinux [ btrfs-progs gpgme lvm2 ];
+  buildInputs = stdenv.lib.optionals stdenv.isLinux [ btrfs-progs gpgme lvm2 ]
+    ++ stdenv.lib.optionals stdenv.isDarwin [ Security ];
 
   buildFlagsArray = [ "-ldflags=-s -w -X main.version=${version}" ];
 
diff --git a/pkgs/development/tools/go-tools/default.nix b/pkgs/development/tools/go-tools/default.nix
index 1fd17060bd4f..b047689b81f9 100644
--- a/pkgs/development/tools/go-tools/default.nix
+++ b/pkgs/development/tools/go-tools/default.nix
@@ -1,6 +1,7 @@
 { buildGoModule
-, lib
+, stdenv
 , fetchFromGitHub
+, Security
 }:
 
 buildGoModule rec {
@@ -16,9 +17,11 @@ buildGoModule rec {
     sha256 = "0pvi1mzhy6zgx4zfgdypbl4zhvgg11hl5qv7blf2qs0a96j2djhf";
   };
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   modSha256 = "03560xjr2531xj87paskfx2zs364fz6y4kpsid8x08s1syq9nq7p";
 
-  meta = with lib; {
+  meta = with stdenv.lib; {
     description = "A collection of tools and libraries for working with Go code, including linters and static analysis";
     homepage = https://staticcheck.io;
     license = licenses.mit;
diff --git a/pkgs/development/tools/golangci-lint/default.nix b/pkgs/development/tools/golangci-lint/default.nix
index 14311b0c7a51..00858e94bc55 100644
--- a/pkgs/development/tools/golangci-lint/default.nix
+++ b/pkgs/development/tools/golangci-lint/default.nix
@@ -1,4 +1,4 @@
-{ buildGoModule, fetchFromGitHub, lib }:
+{ buildGoModule, fetchFromGitHub, stdenv, Security }:
 
 buildGoModule rec {
   pname = "golangci-lint";
@@ -14,7 +14,9 @@ buildGoModule rec {
   modSha256 = "0ab1s8pqkpss15rd9brin39lzx2fqkvq2v3nhk8kfrgpari2addk";
   subPackages = [ "cmd/golangci-lint" ];
 
-  meta = with lib; {
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
+  meta = with stdenv.lib; {
     description = "Linters Runner for Go. 5x faster than gometalinter. Nice colored output.";
     homepage = "https://golangci.com/";
     license = licenses.agpl3;
diff --git a/pkgs/development/tools/hcloud/default.nix b/pkgs/development/tools/hcloud/default.nix
index 477a476dfe78..c20f3b9dc124 100644
--- a/pkgs/development/tools/hcloud/default.nix
+++ b/pkgs/development/tools/hcloud/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "hcloud";
@@ -15,6 +15,8 @@ buildGoModule rec {
 
   modSha256 = "1zy41hi2qzrdmih3pkpng8im576lhkr64zm66w73p7jyvy0kf9sx";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   buildFlagsArray = [ "-ldflags=" "-w -X github.com/hetznercloud/cli/cli.Version=${version}" ];
 
   postInstall = ''
diff --git a/pkgs/development/tools/kcli/default.nix b/pkgs/development/tools/kcli/default.nix
index bbcb10a354cf..0d42df3b5e4d 100644
--- a/pkgs/development/tools/kcli/default.nix
+++ b/pkgs/development/tools/kcli/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "kcli";
@@ -13,6 +13,8 @@ buildGoModule rec {
 
   modSha256 = "1wcqh3306q9wxb6pnl8cpk73vmy36bjv2gil03j7j4pajs1f2lwn";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   subPackages = [ "." ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/tools/kubeprompt/default.nix b/pkgs/development/tools/kubeprompt/default.nix
index 7c6f3f3396cf..0910c061ee50 100644
--- a/pkgs/development/tools/kubeprompt/default.nix
+++ b/pkgs/development/tools/kubeprompt/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "kubeprompt";
@@ -21,6 +21,8 @@ buildGoModule rec {
   goPackagePath = "github.com/jlesquembre/kubeprompt";
   modSha256 = "0rbpdk2dixywn3wcdgz48f3xw3b7fk8xh7mrlx27wz7fq5wj9v8f";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   meta = with stdenv.lib; {
     description = "Kubernetes prompt";
     homepage = "https://github.com/jlesquembre/kubeprompt";
diff --git a/pkgs/development/tools/kustomize/default.nix b/pkgs/development/tools/kustomize/default.nix
index e60181e9bc4c..ce173e89a2c5 100644
--- a/pkgs/development/tools/kustomize/default.nix
+++ b/pkgs/development/tools/kustomize/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub, tree }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "kustomize";
@@ -25,7 +25,9 @@ buildGoModule rec {
 
   modSha256 = "1bas6al14ck0d2ccb4235426a5hldqsm0nf8vi76chz4nahzb71g";
 
-  meta = with lib; {
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
+  meta = with stdenv.lib; {
     description = "Customization of kubernetes YAML configurations";
     longDescription = ''
       kustomize lets you customize raw, template-free YAML files for
diff --git a/pkgs/development/tools/literate-programming/noweb/default.nix b/pkgs/development/tools/literate-programming/noweb/default.nix
index 8806b5a81cd1..11ff50016785 100644
--- a/pkgs/development/tools/literate-programming/noweb/default.nix
+++ b/pkgs/development/tools/literate-programming/noweb/default.nix
@@ -27,16 +27,19 @@ let noweb = stdenv.mkDerivation rec {
     "CC=clang"
   ];
 
+
   installFlags = [
-    "BIN=$(out)/bin"
-    "ELISP=$(out)/share/emacs/site-lisp"
-    "LIB=$(out)/lib/noweb"
-    "MAN=$(out)/share/man"
-    "TEXINPUTS=$(tex)/tex/latex/noweb"
   ];
 
   preInstall = ''
     mkdir -p "$tex/tex/latex/noweb"
+    installFlagsArray+=(                                   \
+        "BIN=${placeholder "out"}/bin"                     \
+        "ELISP=${placeholder "out"}/share/emacs/site-lisp" \
+        "LIB=${placeholder "out"}/lib/noweb"               \
+        "MAN=${placeholder "out"}/share/man"               \
+        "TEXINPUTS=${placeholder "tex"}/tex/latex/noweb"   \
+    )
   '';
 
   installTargets = [ "install-code" "install-tex" "install-elisp" ];
@@ -57,7 +60,7 @@ let noweb = stdenv.mkDerivation rec {
 
     # HACK: This is ugly, but functional.
     PATH=$out/bin:$PATH make -BC xdoc
-    make "''${installFlags[@]} install-man"
+    make "''${installFlagsArray[@]}" install-man
 
     ln -s "$tex" "$out/share/texmf"
   '';
diff --git a/pkgs/development/tools/misc/act/default.nix b/pkgs/development/tools/misc/act/default.nix
index de1cf939e6ae..17ff15265f25 100644
--- a/pkgs/development/tools/misc/act/default.nix
+++ b/pkgs/development/tools/misc/act/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, buildGoModule }:
+{ stdenv, fetchFromGitHub, buildGoModule, Security }:
 
 buildGoModule rec {
   pname = "act";
@@ -11,11 +11,13 @@ buildGoModule rec {
     sha256 = "0l7id483006mnii4rlcff4p0ricd8a2n24sf74a9b387x0akpbsn";
   };
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   modSha256 = "04s4p9j6j7gw1s4v271zwzvdny7dvjaazd2pihmyjfik95xmwx9r";
 
   buildFlagsArray = [ "-ldflags=-s -w -X main.version=${version}" ];
 
-  meta = with lib; {
+  meta = with stdenv.lib; {
     description = "Run your GitHub Actions locally";
     homepage = "https://github.com/nektos/act";
     license = licenses.mit;
diff --git a/pkgs/development/tools/misc/circleci-cli/default.nix b/pkgs/development/tools/misc/circleci-cli/default.nix
index fde1c68d34d0..0ab126b63e73 100644
--- a/pkgs/development/tools/misc/circleci-cli/default.nix
+++ b/pkgs/development/tools/misc/circleci-cli/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, buildGoModule }:
+{ stdenv, fetchFromGitHub, buildGoModule, Security }:
 
 buildGoModule rec {
   pname = "circleci-cli";
@@ -13,6 +13,8 @@ buildGoModule rec {
 
   modSha256 = "199ai38knp50mjjhddjd70qfwx63c69rf7ddw4hpzgx5cm5a04q2";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   buildFlagsArray = [ "-ldflags=-s -w -X github.com/CircleCI-Public/circleci-cli/version.Version=${version}" ];
 
   preBuild = ''
diff --git a/pkgs/development/tools/misc/drush/default.nix b/pkgs/development/tools/misc/drush/default.nix
index f9a640d47038..e0f85c45f290 100644
--- a/pkgs/development/tools/misc/drush/default.nix
+++ b/pkgs/development/tools/misc/drush/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, php, which, makeWrapper, bash, coreutils, ncurses }:
+{ stdenv, fetchurl, php73, which, makeWrapper, bash, coreutils, ncurses }:
 
 stdenv.mkDerivation rec {
   name = "drush-6.1.0";
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     sha256 = "07gbjd7m1fj5dmavr0z20vkqwx1cz2522sj9022p257jifj1yl76";
   };
 
-  buildInputs = [ php which makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     # install libraries
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
     mkdir -p "$out"
     cp -r . "$out/src"
     mkdir "$out/bin"
-    wrapProgram "$out/src/drush" --prefix PATH : "${stdenv.lib.makeBinPath [ which php bash coreutils ncurses ]}"
+    wrapProgram "$out/src/drush" --prefix PATH : "${stdenv.lib.makeBinPath [ which php73 bash coreutils ncurses ]}"
     ln -s "$out/src/drush" "$out/bin/drush"
   '';
 }
diff --git a/pkgs/development/tools/misc/editorconfig-checker/default.nix b/pkgs/development/tools/misc/editorconfig-checker/default.nix
index 88c43a8c42a5..335cd2f25247 100644
--- a/pkgs/development/tools/misc/editorconfig-checker/default.nix
+++ b/pkgs/development/tools/misc/editorconfig-checker/default.nix
@@ -1,4 +1,4 @@
-{ buildGoModule, fetchFromGitHub, lib }:
+{ buildGoModule, fetchFromGitHub, stdenv, Security }:
 
 buildGoModule rec {
   pname = "editorconfig-checker";
@@ -13,7 +13,9 @@ buildGoModule rec {
 
   modSha256 = "1iiv12ginb3ky739z7v8wf4z5lv24gmghbybs3lzay0kqn449n4x";
 
-  meta = with lib; {
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
+  meta = with stdenv.lib; {
     description = "A tool to verify that your files are in harmony with your .editorconfig";
     homepage = "https://editorconfig-checker.github.io/";
     license = licenses.mit;
diff --git a/pkgs/development/tools/misc/go-license-detector/default.nix b/pkgs/development/tools/misc/go-license-detector/default.nix
index 6675f7ed3e25..7ab7ff8b742c 100644
--- a/pkgs/development/tools/misc/go-license-detector/default.nix
+++ b/pkgs/development/tools/misc/go-license-detector/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "go-license-detector";
@@ -13,7 +13,9 @@ buildGoModule rec {
 
   modSha256 = "163f1kiy7kqrnaazb8ydaaiz57lv30jyjkvv6i7pczvcg9yfhmdb";
 
-  meta = with lib; {
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
+  meta = with stdenv.lib; {
     description = "Reliable project licenses detector";
     homepage = "https://github.com/src-d/go-license-detector";
     license = licenses.asl20;
diff --git a/pkgs/development/tools/misc/mkcert/default.nix b/pkgs/development/tools/misc/mkcert/default.nix
index ae0a4a6dfe21..6a114a8de8ba 100644
--- a/pkgs/development/tools/misc/mkcert/default.nix
+++ b/pkgs/development/tools/misc/mkcert/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "mkcert";
@@ -19,7 +19,9 @@ buildGoModule rec {
       -X ${goPackagePath}/main.Version=${version}
   '';
 
-  meta = with lib; {
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
+  meta = with stdenv.lib; {
     homepage = https://github.com/FiloSottile/mkcert;
     description = "A simple tool for making locally-trusted development certificates";
     license = licenses.bsd3;
diff --git a/pkgs/development/tools/misc/reviewdog/default.nix b/pkgs/development/tools/misc/reviewdog/default.nix
index 9af294716ff3..aecd373f09e9 100644
--- a/pkgs/development/tools/misc/reviewdog/default.nix
+++ b/pkgs/development/tools/misc/reviewdog/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "reviewdog";
@@ -13,11 +13,13 @@ buildGoModule rec {
 
   modSha256 = "1jf08g0xr4wknh9x15igq73y02cy2faqjdjs2v842ii4p3n4p9dw";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   subPackages = [ "cmd/reviewdog" ];
 
   buildFlagsArray = [ "-ldflags=-s -w -X github.com/reviewdog/reviewdog/commands.Version=${version}" ];
 
-  meta = with lib; {
+  meta = with stdenv.lib; {
     description = "Automated code review tool integrated with any code analysis tools regardless of programming language";
     homepage = "https://github.com/reviewdog/reviewdog";
     changelog = "https://github.com/reviewdog/reviewdog/releases/tag/v${version}";
diff --git a/pkgs/development/tools/misc/terracognita/default.nix b/pkgs/development/tools/misc/terracognita/default.nix
index 26aa50f7f7a1..67e8df9561ff 100644
--- a/pkgs/development/tools/misc/terracognita/default.nix
+++ b/pkgs/development/tools/misc/terracognita/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "terracognita";
@@ -13,11 +13,13 @@ buildGoModule rec {
 
   modSha256 = "0xlhp8pa5g6an10m56g237pixc4h6ay89hkp1ijdz45iyfn9fk91";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   subPackages = [ "." ];
 
   buildFlagsArray = [ "-ldflags=-s -w -X github.com/cycloidio/terracognita/cmd.Version=${version}" ];
 
-  meta = with lib; {
+  meta = with stdenv.lib; {
     description = "Reads from existing Cloud Providers (reverse Terraform) and generates your infrastructure as code on Terraform configuration";
     homepage = "https://github.com/cycloidio/terracognita";
     license = licenses.mit;
diff --git a/pkgs/development/tools/misc/tokei/default.nix b/pkgs/development/tools/misc/tokei/default.nix
index aaf6efc03aee..a06bf4f248ac 100644
--- a/pkgs/development/tools/misc/tokei/default.nix
+++ b/pkgs/development/tools/misc/tokei/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "tokei";
-  version = "10.1.2";
+  version = "11.0.0";
 
   src = fetchFromGitHub {
     owner = "XAMPPRocky";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1h9vk30wdcjkf6wdv1xdiv94ln5ivwhmfhx5kwdvrxx8cci2m3yx";
+    sha256 = "0as3knld6vlni2s347wgh4g1fg531ky23pg7wx5fzzy6gxl4rgi1";
   };
 
-  cargoSha256 = "11xf2vkhar4y0rb4blq3hk9xlw0ixnig88zzc72hcnkv2yamgkhi";
+  cargoSha256 = "1f385gjym3mm1vsjvss3yq21ixnbjkrx705hp3spyhghffxi00q1";
 
   buildInputs = stdenv.lib.optionals stdenv.isDarwin [
     libiconv darwin.apple_sdk.frameworks.Security
diff --git a/pkgs/development/tools/mod/default.nix b/pkgs/development/tools/mod/default.nix
index 67b829877b04..cc94692c023a 100644
--- a/pkgs/development/tools/mod/default.nix
+++ b/pkgs/development/tools/mod/default.nix
@@ -1,4 +1,4 @@
-{ buildGoModule, fetchFromGitHub, lib }:
+{ buildGoModule, fetchFromGitHub, stdenv, Security }:
 
 buildGoModule rec {
   pname = "mod";
@@ -13,9 +13,11 @@ buildGoModule rec {
 
   modSha256 = "0x7bdhvam9l23cbdqpna8kwg0v6yhgmw0hlbm48bbhjl27lg7svc";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   subPackages = [ "cmd/mod" ];
 
-  meta = with lib; {
+  meta = with stdenv.lib; {
     description = "Automated Semantic Import Versioning Upgrades for Go";
     longDescription = ''
       Command line tool to upgrade/downgrade Semantic Import Versioning in Go
diff --git a/pkgs/development/tools/pet/default.nix b/pkgs/development/tools/pet/default.nix
index e7f4fce3c4d4..f1096e479a78 100644
--- a/pkgs/development/tools/pet/default.nix
+++ b/pkgs/development/tools/pet/default.nix
@@ -1,4 +1,4 @@
-{ buildGoModule, fetchFromGitHub, lib }:
+{ buildGoModule, fetchFromGitHub, stdenv, Security }:
 
 buildGoModule rec {
   pname = "pet";
@@ -13,9 +13,11 @@ buildGoModule rec {
 
   modSha256 = "06ham8lsx5c1vk5jkwp1aa9g4q4g7sfq7gxz2gkffa98x2vlawyf";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   subPackages = [ "." ];
 
-  meta = with lib; {
+  meta = with stdenv.lib; {
     description = "Simple command-line snippet manager, written in Go";
     homepage = https://github.com/knqyf263/pet;
     license = licenses.mit;
diff --git a/pkgs/development/tools/proto-contrib/default.nix b/pkgs/development/tools/proto-contrib/default.nix
index 836683895565..adb0df28ce16 100644
--- a/pkgs/development/tools/proto-contrib/default.nix
+++ b/pkgs/development/tools/proto-contrib/default.nix
@@ -1,4 +1,4 @@
-{ buildGoModule, fetchFromGitHub, lib }:
+{ buildGoModule, fetchFromGitHub, stdenv, Security }:
 
 buildGoModule rec {
   pname = "proto-contrib";
@@ -13,7 +13,9 @@ buildGoModule rec {
 
   modSha256 = "19cqz13jd95d5vibd10420gg69ldgf6afc51mkglhafgmmif56b0";
 
-  meta = with lib; {
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
+  meta = with stdenv.lib; {
     description = "Contributed tools and other packages on top of the Go proto package";
     homepage = https://github.com/emicklei/proto-contrib;
     license = licenses.mit;
diff --git a/pkgs/development/tools/protoc-gen-doc/default.nix b/pkgs/development/tools/protoc-gen-doc/default.nix
index 77c1df6f43e3..c25b2d56fe63 100644
--- a/pkgs/development/tools/protoc-gen-doc/default.nix
+++ b/pkgs/development/tools/protoc-gen-doc/default.nix
@@ -1,4 +1,4 @@
-{ buildGoModule, fetchFromGitHub, lib }:
+{ buildGoModule, fetchFromGitHub, stdenv, Security }:
 
 buildGoModule {
   pname = "protoc-gen-doc-unstable";
@@ -13,7 +13,9 @@ buildGoModule {
 
   modSha256 = "1952ycdkgl00q2s3qmhislhhim15nn6nmlkwbfdvrsfzznqj47rd";
 
-  meta = with lib; {
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
+  meta = with stdenv.lib; {
     description = "Documentation generator plugin for Google Protocol Buffers";
     longDescription = ''
       This is a documentation generator plugin for the Google Protocol Buffers
diff --git a/pkgs/development/tools/prototool/default.nix b/pkgs/development/tools/prototool/default.nix
index 37b0f1fdf8db..15a854e4d86c 100644
--- a/pkgs/development/tools/prototool/default.nix
+++ b/pkgs/development/tools/prototool/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub, makeWrapper, protobuf }:
+{ stdenv, buildGoModule, fetchFromGitHub, makeWrapper, protobuf, Security }:
 
 buildGoModule rec {
   pname = "prototool";
@@ -13,6 +13,8 @@ buildGoModule rec {
 
   nativeBuildInputs = [ makeWrapper ];
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   modSha256 = "1gc8kc9mbi3mlh48zx4lcgpsrf8z879f1qj9wfyr66s7wd1ljazg";
 
   postInstall = ''
@@ -23,7 +25,7 @@ buildGoModule rec {
 
   subPackages = [ "cmd/prototool" ];
 
-  meta = with lib; {
+  meta = with stdenv.lib; {
     homepage = "https://github.com/uber/prototool";
     description = "Your Swiss Army Knife for Protocol Buffers";
     maintainers = [ maintainers.marsam ];
diff --git a/pkgs/development/web/flyctl/default.nix b/pkgs/development/web/flyctl/default.nix
index 85165d501d97..05f07fd02608 100644
--- a/pkgs/development/web/flyctl/default.nix
+++ b/pkgs/development/web/flyctl/default.nix
@@ -1,4 +1,4 @@
-{ buildGoModule, fetchFromGitHub, lib }:
+{ buildGoModule, fetchFromGitHub, stdenv, Security }:
 
 buildGoModule rec {
   pname = "flyctl";
@@ -11,6 +11,8 @@ buildGoModule rec {
     sha256 = "181j248i8j9g7kz5krg0bkbxkvmcwpz2vlknii5q3dy7yhgg19h3";
   };
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   preBuild = ''
     go generate ./...
   '';
@@ -22,7 +24,7 @@ buildGoModule rec {
 
   modSha256 = "1mqkc7hnavvpbqar9f1d2vnm47p4car9abnk2ikyf27jr5glwmsd";
 
-  meta = with lib; {
+  meta = with stdenv.lib; {
     description = "Command line tools for fly.io services";
     homepage = "https://fly.io/";
     license = licenses.asl20;
diff --git a/pkgs/development/web/minify/default.nix b/pkgs/development/web/minify/default.nix
index 3752519d0609..cd602317c70d 100644
--- a/pkgs/development/web/minify/default.nix
+++ b/pkgs/development/web/minify/default.nix
@@ -1,4 +1,4 @@
-{ buildGoModule, fetchFromGitHub, lib }:
+{ buildGoModule, fetchFromGitHub, stdenv, Security }:
 
 buildGoModule rec {
   pname = "minify";
@@ -13,9 +13,11 @@ buildGoModule rec {
 
   modSha256 = "09jk3mxf7n9wf1cgyiw9mhsr55fb12k399dmzhnib3vhd9xav15i";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   buildFlagsArray = [ "-ldflags=-s -w -X main.Version=${version}" ];
 
-  meta = with lib; {
+  meta = with stdenv.lib; {
     description = "Minifiers for web formats";
     license = licenses.mit;
     homepage = "https://go.tacodewolff.nl/minify";
diff --git a/pkgs/games/nethack/default.nix b/pkgs/games/nethack/default.nix
index 9a60abdc1500..280ca090d60e 100644
--- a/pkgs/games/nethack/default.nix
+++ b/pkgs/games/nethack/default.nix
@@ -19,14 +19,14 @@ let
   binPath = lib.makeBinPath [ coreutils less ];
 
 in stdenv.mkDerivation rec {
-  version = "3.6.5";
+  version = "3.6.6";
   name = if x11Mode then "nethack-x11-${version}"
          else if qtMode then "nethack-qt-${version}"
          else "nethack-${version}";
 
   src = fetchurl {
-    url = "https://nethack.org/download/3.6.5/nethack-365-src.tgz";
-    sha256 = "0xifs8pqfffnmkbpmrcd1xf14yakcj06nl2bbhy4dyacg8myysmv";
+    url = "https://nethack.org/download/${version}/nethack-${lib.replaceStrings ["."] [""] version}-src.tgz";
+    sha256 = "1liyckjp34j354qnxc1zn9730lh1p2dabrg1hap24z6xnqx0rpng";
   };
 
   buildInputs = [ ncurses ]
diff --git a/pkgs/games/spring/default.nix b/pkgs/games/spring/default.nix
index 1cfb6c6e4606..e0dd5f53449f 100644
--- a/pkgs/games/spring/default.nix
+++ b/pkgs/games/spring/default.nix
@@ -12,8 +12,8 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "spring";
     repo = "spring";
-    rev = version;
-    sha256 = "1z7c5yxsv0j4nlkmc0limxxkl5mp65jckjfh7nyv3a3zvzhv00zc";
+    rev = "9ee29da876f6d3d23e169185619b58df9c036703";
+    sha256 = "0m94i85k8k5ls1ff9z8djslzhkgr7b7vsbpic2axxjvki6sn2xjv";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/misc/emulators/retroarch/cores.nix b/pkgs/misc/emulators/retroarch/cores.nix
index 2176d53628fa..e055e5a15fae 100644
--- a/pkgs/misc/emulators/retroarch/cores.nix
+++ b/pkgs/misc/emulators/retroarch/cores.nix
@@ -1,28 +1,42 @@
 { stdenv, fetchgit, fetchFromGitHub, fetchFromGitLab, cmake, pkgconfig, makeWrapper, python27, python37, retroarch
-, alsaLib, fluidsynth, curl, hidapi, libGLU, gettext, glib, gtk2, portaudio, SDL, libGL
-, ffmpeg, pcre, libevdev, libpng, libjpeg, udev, libvorbis
-, miniupnpc, sfml, xorg, zlib, nasm, libpcap, boost }:
+, alsaLib, fluidsynth, curl, hidapi, libGLU, gettext, glib, gtk2, portaudio, SDL, SDL_net, SDL2, SDL2_image, libGL
+, ffmpeg, pcre, libevdev, libpng, libjpeg, libzip, udev, libvorbis, snappy, which, hexdump
+, miniupnpc, sfml, xorg, zlib, nasm, libpcap, boost, icu, openssl
+, buildPackages }:
 
 let
 
   d2u = stdenv.lib.replaceChars ["-"] ["_"];
 
-  mkLibRetroCore = ({ core, src, description, license, broken ? false, ... }@a:
-  stdenv.lib.makeOverridable stdenv.mkDerivation rec {
+  mkLibRetroCore = { core, src, description, license, broken ? false, ... }@a:
+  stdenv.lib.makeOverridable stdenv.mkDerivation ((rec {
 
-    name = "libretro-${core}-${version}";
-    version = "2019-09-29";
-    inherit src;
+    name = "libretro-${a.core}-${version}";
+    version = "2020-03-06";
+    inherit (a) src;
 
-    buildInputs = [ makeWrapper retroarch zlib ] ++ a.extraBuildInputs or [];
+    buildInputs = [ zlib ] ++ a.extraBuildInputs or [];
+    nativeBuildInputs = [ makeWrapper ] ++ a.extraNativeBuildInputs or [];
 
     makefile = "Makefile.libretro";
+    makeFlags = [
+      "platform=${{
+        linux = "unix";
+        darwin = "unix";
+        windows = "win";
+      }.${stdenv.hostPlatform.parsed.kernel.name} or stdenv.hostPlatform.parsed.kernel.name}"
+      "ARCH=${{
+        armv7l = "arm";
+        armv6l = "arm";
+        i686 = "x86";
+      }.${stdenv.hostPlatform.parsed.cpu.name} or stdenv.hostPlatform.parsed.cpu.name}"
+    ] ++ (a.makeFlags or []);
 
     installPhase = ''
       COREDIR="$out/lib/retroarch/cores"
       mkdir -p $out/bin
       mkdir -p $COREDIR
-      mv ${d2u core}_libretro${stdenv.hostPlatform.extensions.sharedLibrary} $COREDIR/.
+      mv ${d2u a.core}_libretro${stdenv.hostPlatform.extensions.sharedLibrary} $COREDIR
       makeWrapper ${retroarch}/bin/retroarch $out/bin/retroarch-${core} \
         --add-flags "-L $COREDIR/${d2u core}_libretro${stdenv.hostPlatform.extensions.sharedLibrary} $@"
     '';
@@ -30,18 +44,18 @@ let
     enableParallelBuilding = true;
 
     passthru = {
-      core = core;
+      inherit (a) core;
       libretroCore = "/lib/retroarch/cores";
     };
 
     meta = with stdenv.lib; {
-      inherit description;
+      inherit (a) description license;
+      broken = a.broken or false;
       homepage = https://www.libretro.com/;
-      inherit license;
       maintainers = with maintainers; [ edwtjo hrdinka MP2E ];
       platforms = platforms.unix;
     };
-  } // a);
+  }) // builtins.removeAttrs a ["core" "src" "description" "license" "makeFlags"]);
 
   fetchRetro = { repo, rev, sha256 }:
   fetchgit {
@@ -54,49 +68,32 @@ in with stdenv.lib.licenses;
 
 {
 
-  _4do = (mkLibRetroCore rec {
-    core = "4do";
-    src = fetchRetro {
-      repo = core + "-libretro";
-      rev = "b6ad4bc8548f2f3792cd929ccf26d9078b73a1c0";
-      sha256 = "0j2bd9cnnd5k99l9qr4wd5q9b4ciplia6ywp90xg6422s1im2iw0";
-    };
-    description = "Port of 4DO/libfreedo to libretro";
-    license = "Non-commercial";
-  }).override {
-    makefile = "Makefile";
-    buildPhase = "make";
-  };
-
-  atari800 = (mkLibRetroCore rec {
+  atari800 = mkLibRetroCore rec {
     core = "atari800";
     src = fetchRetro {
       repo = "libretro-" + core;
-      rev = "efc0bc71e3cb8a4f957d07fe808cc002ed9c13b9";
-      sha256 = "150hmazi4p5p18gpjmkrn1k9j719cd9gy7jn0jiy3jbk2cxxsjn6";
+      rev = "f9bf53b864344b8bbe8d425ed2f3c628eb10519c";
+      sha256 = "0sgk93zs423pwiqzvj0x1gfwcn9gacnlrrdq53ps395k64lig6lk";
     };
     description = "Port of Atari800 to libretro";
     license = gpl2;
-  }).override {
     makefile = "Makefile";
-    buildPhase = "make";
+    makeFlags = [ "GIT_VERSION=" ];
   };
 
-  beetle-snes = (mkLibRetroCore rec {
+  beetle-snes = mkLibRetroCore {
     core = "mednafen-snes";
     src = fetchRetro {
       repo = "beetle-bsnes-libretro";
-      rev = "6aee84d454570bb17dff5975df28febdbcb72938";
-      sha256 = "0nk9xlypg3jhpbwd9z5bjbgzlkz842hy9rq14k1nwn0qz6d88kld";
+      rev = "de22d8420ea606f1b2f72afd4dda34619cf2cc20";
+      sha256 = "1nd4f8frmlhp1lyxz9zpxvwwz70x0i0rrp560cn9qlm1jzdv3xvf";
     };
     description = "Port of Mednafen's SNES core to libretro";
     license = gpl2;
-  }).override {
     makefile = "Makefile";
-    buildPhase = "make";
   };
 
-  beetle-gba = (mkLibRetroCore rec {
+  beetle-gba = mkLibRetroCore {
     core = "mednafen-gba";
     src = fetchRetro {
       repo = "beetle-gba-libretro";
@@ -105,155 +102,171 @@ in with stdenv.lib.licenses;
     };
     description = "Port of Mednafen's GameBoy Advance core to libretro";
     license = gpl2;
-  }).override {
     makefile = "Makefile";
-    buildPhase = "make";
   };
 
-  beetle-lynx = (mkLibRetroCore rec {
+  beetle-lynx = mkLibRetroCore {
     core = "mednafen-lynx";
     src = fetchRetro {
       repo = "beetle-lynx-libretro";
-      rev = "928f7cf5b39f0363e55667572ff455e37489998e";
-      sha256 = "0f03wzdr6f0fpy889i9a2834jg5lvcriyl98pajp75m7whm9r9cc";
+      rev = "74dde204c0ec6c4bc4cd7821c14548387fbd9ce8";
+      sha256 = "05kwibjr30laalqzazswvmn9smm3mwqsz1i0z1s0pj7idfdhjfw0";
     };
     description = "Port of Mednafen's Lynx core to libretro";
     license = gpl2;
-  }).override {
     makefile = "Makefile";
-    buildPhase = "make";
   };
 
-  beetle-ngp = (mkLibRetroCore rec {
+  beetle-ngp = mkLibRetroCore {
     core = "mednafen-ngp";
     src = fetchRetro {
       repo = "beetle-ngp-libretro";
-      rev = "6130e4057c3d8f9172f0c49bb9b6c61bd1a572d5";
-      sha256 = "10k7spjrhggjgzb370bwv7fgk0nb6xri9ym6cm4qvnrkcwxm7i9p";
+      rev = "6f15532b6ad17a2d5eb9dc8241d6af62416e796b";
+      sha256 = "05r8mk9rc19nzs3gpfsjr6i7pm6xx3gn3b4xs8ab7v4vcmfg4cn2";
     };
     description = "Port of Mednafen's NeoGeo Pocket core to libretro";
     license = gpl2;
-  }).override {
     makefile = "Makefile";
-    buildPhase = "make";
   };
 
-  beetle-pce-fast = let der = (mkLibRetroCore {
+  beetle-pce-fast = let der = mkLibRetroCore {
     core = "mednafen-pce-fast";
     src = fetchRetro {
       repo = "beetle-pce-fast-libretro";
-      rev = "7bbbdf111c1ce52ab4a97e911ebdaa6836ee881a";
-      sha256 = "1p0kk5a2yi05yl0hspzv9q0n96yx9riaaacbmnq76li0i3ihkf6l";
+      rev = "40a42b7f43f029760c92bf0b2097e7d4b90ed29c";
+      sha256 = "1gr6wg4bd4chm4c39w0c1b5zfzr05zd7234vvlmr1imk0v6m0wj6";
     };
     description = "Port of Mednafen's PC Engine core to libretro";
     license = gpl2;
-  }); in der.override {
     makefile = "Makefile";
-    buildPhase = "make";
+  }; in der.override {
     name = "beetle-pce-fast-${der.version}";
   };
 
-  beetle-pcfx = (mkLibRetroCore rec {
+  beetle-pcfx = mkLibRetroCore rec {
     core = "mednafen-pcfx";
     src = fetchRetro {
       repo = "beetle-pcfx-libretro";
-      rev = "e04f695202a7295e4b6f2122ae947279ac9df007";
-      sha256 = "0pdlz05pjqxp19da13dr3wd20hgxw8z5swhflyf7ksjgvz5rxb4r";
+      rev = "7bba6699d6f903bd701b0aa525d845de8427fee6";
+      sha256 = "1lh7dh96fyi005fcg3xaf7r4ssgkq840p6anldlqy52vfwmglw3p";
     };
     description = "Port of Mednafen's PCFX core to libretro";
     license = gpl2;
-  }).override {
     makefile = "Makefile";
-    buildPhase = "make";
   };
 
   beetle-psx = let der = (mkLibRetroCore {
     core = "mednafen-psx";
     src = fetchRetro {
       repo = "beetle-psx-libretro";
-      rev = "f55db8655408104a6e20af667657423f08566c85";
-      sha256 = "17iz8r2wy8zqh63j78ijwxasdnmg8dh9mmqn1qr4hvf4fj53ckk8";
+      rev = "0f1e7e60827cad49ebba628abdc83ad97652ab89";
+      sha256 = "1j92jgddyl970v775d6gyb50l8md6yfym2fpqhfxcr4gj1b4ivwq";
     };
     description = "Port of Mednafen's PSX Engine core to libretro";
     license = gpl2;
-  }); in der.override {
     makefile = "Makefile";
-    buildPhase = "make";
+    makeFlags = [ "HAVE_HW=0" "HAVE_LIGHTREC=1" ];
+  }); in der.override {
     name = "beetle-psx-${der.version}";
   };
 
+  beetle-psx-hw = let der = (mkLibRetroCore {
+    core = "mednafen-psx-hw";
+    src = fetchRetro {
+      repo = "beetle-psx-libretro";
+      rev = "0f1e7e60827cad49ebba628abdc83ad97652ab89";
+      sha256 = "1j92jgddyl970v775d6gyb50l8md6yfym2fpqhfxcr4gj1b4ivwq";
+    };
+    description = "Port of Mednafen's PSX Engine (with HW accel) core to libretro";
+    license = gpl2;
+    extraBuildInputs = [ libGL libGLU ];
+    makefile = "Makefile";
+    makeFlags = [ "HAVE_VULKAN=1" "HAVE_OPENGL=1" "HAVE_HW=1" "HAVE_LIGHTREC=1" ];
+  }); in der.override {
+    name = "beetle-psx-hw-${der.version}";
+  };
+
   beetle-saturn = let der = (mkLibRetroCore {
     core = "mednafen-saturn";
     src = fetchRetro {
       repo = "beetle-saturn-libretro";
-      rev = "3313cc6760c14cffa9226e0cfd41debc11df8bdd";
-      sha256 = "1z2zfn5cpsr3x6bvr562vqvmp4pjjhv5a6jcp09gfsy2gkyispr2";
+      rev = "8a65943bb7bbc3183eeb0d57c4ac3e663f1bcc11";
+      sha256 = "1f0cd9wmvarsmf4jw0p6h3lbzs6515aja7krrwapja7i4xmgbrnh";
     };
     description = "Port of Mednafen's Saturn core to libretro";
     license = gpl2;
-  }); in der.override {
     makefile = "Makefile";
-    buildPhase = "make";
+    makeFlags = [ "HAVE_HW=0" ];
+    meta.platforms = [ "x86_64-linux" "aarch64-linux" ];
+  }); in der.override {
     name = "beetle-saturn-${der.version}";
+  };
+
+  beetle-saturn-hw = let der = (mkLibRetroCore {
+    core = "mednafen-saturn-hw";
+    src = fetchRetro {
+      repo = "beetle-saturn-libretro";
+      rev = "8a65943bb7bbc3183eeb0d57c4ac3e663f1bcc11";
+      sha256 = "1f0cd9wmvarsmf4jw0p6h3lbzs6515aja7krrwapja7i4xmgbrnh";
+    };
+    description = "Port of Mednafen's Saturn core to libretro";
+    license = gpl2;
+    extraBuildInputs = [ libGL libGLU ];
+    makefile = "Makefile";
+    makeFlags = [ "HAVE_OPENGL=1" "HAVE_HW=1" ];
     meta.platforms = [ "x86_64-linux" "aarch64-linux" ];
+  }); in der.override {
+    name = "beetle-saturn-${der.version}";
   };
 
-  beetle-supergrafx = (mkLibRetroCore rec {
+  beetle-supergrafx = mkLibRetroCore rec {
     core = "mednafen-supergrafx";
     src = fetchRetro {
       repo = "beetle-supergrafx-libretro";
-      rev = "857e41146e3b0a51def3baea49d2eec80f18102b";
-      sha256 = "0r3v4qy4rx4mnr7w4s779f6f2bjyp69m42blimacl1l9f6hmcv5h";
+      rev = "fadef23d59fa5ec17bc99e1e722cfd9e10535695";
+      sha256 = "15rm7p5q38qy3xpyvamhphjnna8h91fsbcqnl9vhzx9cmjg0wf54";
     };
     description = "Port of Mednafen's SuperGrafx core to libretro";
     license = gpl2;
-  }).override {
     makefile = "Makefile";
-    buildPhase = "make";
   };
 
-  beetle-wswan = (mkLibRetroCore rec {
+  beetle-wswan = mkLibRetroCore rec {
     core = "mednafen-wswan";
     src = fetchRetro {
       repo = "beetle-wswan-libretro";
-      rev = "925cb8c77af1678ceab24f04c2790cb95389def1";
-      sha256 = "0kqsqn655z6nnr2s1xdbf37ds99gyhqfd7dx0wmx3sy1fshjg5wm";
+      rev = "5b03d1b09f70dc208387d3c8b59e12e1f0d2692f";
+      sha256 = "1sm6ww3y9m85lhp74dpxbs05yxdhhqqmj2022j9s0m235z29iygc";
     };
     description = "Port of Mednafen's WonderSwan core to libretro";
     license = gpl2;
-  }).override {
     makefile = "Makefile";
-    buildPhase = "make";
   };
 
-  beetle-vb = (mkLibRetroCore rec {
+  beetle-vb = mkLibRetroCore rec {
     core = "mednafen-vb";
     src = fetchRetro {
       repo = "beetle-vb-libretro";
-      rev = "9066cdafa29ac054243a679baded49212661f47b";
-      sha256 = "0gsniz5kk4xdiprcfyqjcss2vkrphi48wbr29gqvpf7l8gpnwx8p";
+      rev = "9a4e604a7320a3c6ed30601989fe0bc417fa9ad3";
+      sha256 = "1gallwbqxn5qbmwxr1vxb41nncksai4rxc739a7vqvp65k5kl0qp";
     };
     description = "Port of Mednafen's VirtualBoy core to libretro";
     license = gpl2;
-  }).override {
     makefile = "Makefile";
-    buildPhase = "make";
   };
 
-  bluemsx = (mkLibRetroCore rec {
+  bluemsx = mkLibRetroCore rec {
     core = "bluemsx";
     src = fetchRetro {
       repo = core + "-libretro";
-      rev = "ddd89ff1fa534816e48521bd930b721f2d39975a";
-      sha256 = "0hiqhc1ckj3ydy0q1v8hwjkkyh2564f7wlqypmshjcc47n296xyf";
+      rev = "7a1d40e750860580ab7cc21fbc244b5bc6db6586";
+      sha256 = "05hnkyr47djccspr8v438zimdfsgym7v0jn1hwpkqc4i5zf70981";
     };
     description = "Port of BlueMSX to libretro";
     license = gpl2;
-  }).override {
-    buildPhase = "make";
   };
 
-  bsnes-mercury = let bname = "bsnes-mercury"; in (mkLibRetroCore {
+  bsnes-mercury = let bname = "bsnes-mercury"; in mkLibRetroCore {
     core = bname + "-accuracy";
     src = fetchRetro {
       repo = bname;
@@ -262,12 +275,36 @@ in with stdenv.lib.licenses;
     };
     description = "Fork of bsnes with HLE DSP emulation restored";
     license = gpl3;
-  }).override {
     makefile = "Makefile";
-    buildPhase = "make && cd out";
+    postBuild = "cd out";
+  };
+
+  citra = mkLibRetroCore rec {
+    core = "citra";
+    src = fetchgit {
+      url = "https://github.com/libretro/citra.git";
+      rev = "84f31e95160b029e6d614053705054ed6a34bb38";
+      sha256 = "0gkgxpwrh0q098cpx56hprvmazi5qi448c23svwa8ar1myh8p248";
+      fetchSubmodules = true;
+      deepClone = true;
+    };
+    description = "Port of Citra to libretro";
+    license = gpl2Plus;
+    extraNativeBuildInputs = [ cmake pkgconfig ];
+    extraBuildInputs = [ libGLU libGL boost ];
+    makefile = "Makefile";
+    cmakeFlags = [
+      "-DENABLE_LIBRETRO=ON"
+      "-DENABLE_QT=OFF"
+      "-DENABLE_SDL2=OFF"
+      "-DENABLE_WEB_SERVICE=OFF"
+      "-DENABLE_DISCORD_PRESENCE=OFF"
+    ];
+    preConfigure = "sed -e '77d' -i externals/cmake-modules/GetGitRevisionDescription.cmake";
+    postBuild = "cd src/citra_libretro";
   };
 
-  desmume = (mkLibRetroCore rec {
+  desmume = mkLibRetroCore rec {
     core = "desmume";
     src = fetchRetro {
       repo = core;
@@ -277,45 +314,43 @@ in with stdenv.lib.licenses;
     description = "libretro wrapper for desmume NDS emulator";
     license = gpl2;
     extraBuildInputs = [ libpcap libGLU libGL xorg.libX11 ];
-  }).override {
-    makefile = "desmume/src/frontend/libretro/Makefile.libretro";
-    configurePhase = "cd desmume/src/frontend/libretro";
-    buildPhase = "make";
+    preBuild = "cd desmume/src/frontend/libretro";
+    makeFlags = stdenv.lib.optional stdenv.hostPlatform.isAarch32 "platform=armv-unix"
+             ++ stdenv.lib.optional (!stdenv.hostPlatform.isx86) "DESMUME_JIT=0";
   };
 
-  desmume2015 = (mkLibRetroCore rec {
+  desmume2015 = mkLibRetroCore rec {
     core = "desmume2015";
     src = fetchRetro {
       repo = core;
-      rev = "c27bb71aa28250f6da1576e069b4b8cc61986beb";
-      sha256 = "1m7g1wwpnnprmki3rixknggjmxbp7d4hwxgkqr041shmrm0rhafd";
+      rev = "93d5789d60f82436e20ccad05ce9cb43c6e3656e";
+      sha256 = "12nii2pbnqgh7f7jkphbwjpr2hiy2mzbwpas3xyhpf9wpy3qiasg";
     };
     description = "libretro wrapper for desmume NDS emulator from 2015";
     license = gpl2;
     extraBuildInputs = [ libpcap libGLU libGL xorg.libX11 ];
-  }).override {
-    makefile = "desmume/Makefile.libretro";
-    configurePhase = "cd desmume";
-    buildPhase = "make";
+    makeFlags = stdenv.lib.optional stdenv.hostPlatform.isAarch32 "platform=armv-unix"
+             ++ stdenv.lib.optional (!stdenv.hostPlatform.isx86) "DESMUME_JIT=0";
+    preBuild = "cd desmume";
   };
 
-  dolphin = (mkLibRetroCore {
+  dolphin = mkLibRetroCore {
     core = "dolphin";
     src = fetchRetro {
       repo = "dolphin";
-      rev = "11a7ed402c7178da1d9d57c6e5e5a05a4dc6a2c8";
-      sha256 = "11jrcczkbyns01rvxb5rd22fbkbfn2h81f6pfxbhi13fl4ljim9x";
+      rev = "1fbd59911d1b718c142d6448dee3ede98152e395";
+      sha256 = "1rymsvs034l1hbxc3w8zi9lhmgka2qaj3jynjy152dccd480nnd4";
     };
     description = "Port of Dolphin to libretro";
     license = gpl2Plus;
-    broken = true;
 
+    extraNativeBuildInputs = [ cmake curl pkgconfig ];
     extraBuildInputs = [
-      cmake curl libGLU libGL pcre pkgconfig sfml
+      libGLU libGL pcre sfml
       gettext hidapi
       libevdev udev
     ] ++ (with xorg; [ libSM libX11 libXi libpthreadstubs libxcb xcbutil libXext libXrandr libXinerama libXxf86vm ]);
-  }).override {
+    makefile = "Makefile";
     cmakeFlags = [
       "-DCMAKE_BUILD_TYPE=Release"
       "-DLIBRETRO=ON"
@@ -325,11 +360,10 @@ in with stdenv.lib.licenses;
       "-DUSE_UPNP=OFF"
       "-DUSE_DISCORD_PRESENCE=OFF"
     ];
-    dontUseCmakeBuildDir = "yes";
-    buildPhase = "make";
+    dontUseCmakeBuildDir = true;
   };
 
-  dosbox = (mkLibRetroCore rec {
+  dosbox = mkLibRetroCore rec {
     core = "dosbox";
     src = fetchRetro {
       repo = core + "-libretro";
@@ -338,60 +372,105 @@ in with stdenv.lib.licenses;
     };
     description = "Port of DOSBox to libretro";
     license = gpl2;
-  }).override {
-    buildPhase = "make";
   };
 
-  fba = (mkLibRetroCore rec {
-    core = "fba";
+  eightyone = mkLibRetroCore rec {
+    core = "81";
     src = fetchRetro {
       repo = core + "-libretro";
-      rev = "89245384c7d181e286d6f34995253419f946becb";
-      sha256 = "1pg351qhbq5x8qmaq6c30v8ynic8jv3gbxy2kq5iknka80g1lkck";
+      rev = "4352130bd2363954262a804b086f86b9d13d97f9";
+      sha256 = "057ynnv85imjqhgixrx7p28wn42v88vsm3fc1lp3mpcfi2bk266h";
     };
-    description = "Port of Final Burn Alpha to libretro";
+    description = "Port of EightyOne to libretro";
+    license = gpl3;
+  };
+
+  fbalpha2012 = mkLibRetroCore rec {
+    core = "fbalpha2012";
+    src = fetchRetro {
+      repo = core;
+      rev = "fa97cd2784a337f8ac774c2ce8a136aee69b5f43";
+      sha256 = "1i75k0r6838hl77bjjmzvan33ka5qjrdpirmclzj20g5j97lmas7";
+    };
+    description = "Port of Final Burn Alpha ~2012 to libretro";
     license = "Non-commercial";
-  }).override {
-    makefile = "svn-current/trunk/makefile.libretro";
-    buildPhase = ''
-      cd svn-current/trunk \
-      && make -f makefile.libretro \
-      && mv fbalpha2012_libretro${stdenv.hostPlatform.extensions.sharedLibrary} fba_libretro${stdenv.hostPlatform.extensions.sharedLibrary}
+    makefile = "makefile.libretro";
+    preBuild = "cd svn-current/trunk";
+  };
+
+  fbneo = mkLibRetroCore rec {
+    core = "fbneo";
+    src = fetchRetro {
+      repo = core;
+      rev = "cf43fdb1755f9f5c886266e86ba40d339bc8f5d7";
+      sha256 = "13g3c6mbwhcf0rp95ga4klszh8dab2d4ahh2vzzlmd57r69lf2lv";
+    };
+    description = "Port of FBNeo to libretro";
+    license = "Non-commercial";
+    makefile = "Makefile";
+    postPatch = ''
+      sed -i -e 's:-Wall:-Wall -Wno-format-security:g' src/burner/libretro/Makefile
     '';
+    preBuild = "cd src/burner/libretro";
+    makeFlags = [ "USE_EXPERIMENTAL_FLAGS=1" ];
   };
 
   fceumm = mkLibRetroCore rec {
     core = "fceumm";
     src = fetchRetro {
       repo = "libretro-" + core;
-      rev = "0e315e0ca0093ebda06a97835cec6ad4af81db7a";
-      sha256 = "12bvvxmvafjvrvwxl5gzr583g48s0isx2fgvjgkrx175vk2amaf4";
+      rev = "9ed22e5a9a1360a7f599a64283af9fe24b858e3d";
+      sha256 = "0rz6iy281jpybmsz5rh06k5xvmd9id9w2q2gd0qdv9a2ylwv7s2j";
     };
     description = "FCEUmm libretro port";
     license = gpl2;
   };
 
-  flycast = (mkLibRetroCore rec {
+  flycast = mkLibRetroCore rec {
     core = "flycast";
     src = fetchRetro {
       repo = core;
-      rev = "45a15205dfc05cfc4df2488cad7c2b4988c5aa0f";
-      sha256 = "18glxd57kddq6p2bwq0qknyq6bv8dxklqks4w2jy2yccvwxdxy2i";
+      rev = "b12f3726d9093acb4e441b1cdcf6cd11403c8644";
+      sha256 = "0nczjhdqr7svq9aflczf7rwz64bih1wqy9q0gyglb55xlslf5jqc";
     };
     description = "Flycast libretro port";
     license = gpl2;
     extraBuildInputs = [ libGL libGLU ];
-  }).override {
     makefile = "Makefile";
-    buildPhase = "make";
+    makeFlags = stdenv.lib.optional stdenv.hostPlatform.isAarch64 [ "platform=arm64" ];
+    meta.platforms = [ "aarch64-linux" "x86_64-linux" ];
+  };
+
+  fmsx = mkLibRetroCore rec {
+    core = "fmsx";
+    src = fetchRetro {
+      repo = core + "-libretro";
+      rev = "3de916bbf15062de1ab322432d38a1fee29d5e68";
+      sha256 = "1krr4lmdiv0d7bxk37fqz5y412znb5bmxapv9g7ci6fp87sr69jq";
+    };
+    description = "FMSX libretro port";
+    license = "Non-commercial";
+    makefile = "Makefile";
+  };
+
+  freeintv = mkLibRetroCore rec {
+    core = "freeintv";
+    src = fetchRetro {
+      repo = core;
+      rev = "45030e10cc1a50cf7a80c5d921aa8cba0aeaca91";
+      sha256 = "10lngk3p012bgrg752426701hfzsiy359h8i0vzsa64pgyjbqlag";
+    };
+    description = "FreeIntv libretro port";
+    license = gpl3;
+    makefile = "Makefile";
   };
 
   gambatte = mkLibRetroCore rec {
     core = "gambatte";
     src = fetchRetro {
       repo = core + "-libretro";
-      rev = "4d9ad7b29946ec0a914b2d6a735b6c2704ed1f23";
-      sha256 = "156pvvlch5izbgbw4ddxhiwgzpp52irr3nqaz813i5f02fiq5wya";
+      rev = "132f36e990dfc6effdafa6cf261373432464f9bf";
+      sha256 = "19w5k9yc1cl99c5hiqbp6j54g6z06xcblpvd3x6nmhxij81yqxy7";
     };
     description = "Gambatte libretro port";
     license = gpl2;
@@ -401,42 +480,50 @@ in with stdenv.lib.licenses;
     core = "genesis-plus-gx";
     src = fetchRetro {
       repo = "Genesis-Plus-GX";
-      rev = "0e4357bd64533d7fd93b5f01620b92595025fab5";
-      sha256 = "1nryy00844h3ra97j40g38lj7036ibm2l8002qid7r5r9kggclqx";
+      rev = "50551066f71f8a5ea782ea3747891fd6d24ebe67";
+      sha256 = "150lgdrv7idcq7jbd1jj7902rcsyixd7kfjs2m5xdinjvl22kihr";
     };
     description = "Enhanced Genesis Plus libretro port";
     license = "Non-commercial";
   };
 
-  gpsp = (mkLibRetroCore rec {
+  gpsp = mkLibRetroCore rec {
     core = "gpsp";
     src = fetchRetro {
       repo = core;
-      rev = "24af89596e6484ff5a7a08efecfa8288cfbc02f3";
-      sha256 = "1jc5i70cab5f23yc9sfv8iyvmwmc4sb33f413il2vlhsfdxklyk7";
+      rev = "3f2f57c982ffead643957db5b26931df4913596f";
+      sha256 = "09fa1c623rmy1w9zx85r75viv8q1vknhbs8fn6xbss9rhpxhivwg";
     };
     description = "Port of gpSP to libretro";
     license = gpl2;
-  }).override {
     makefile = "Makefile";
-    buildPhase = "make";
   };
 
-  handy = (mkLibRetroCore rec {
+  gw = mkLibRetroCore rec {
+    core = "gw";
+    src = fetchRetro {
+      repo = core + "-libretro";
+      rev = "819b1dde560013003eeac86c2069c5be7af25c6d";
+      sha256 = "1jhgfys8hiipvbwq3gc48d7v6wq645d10rbr4w5m6px0fk6csshk";
+    };
+    description = "Port of Game and Watch to libretro";
+    license = stdenv.lib.licenses.zlib;
+    makefile = "Makefile";
+  };
+
+  handy = mkLibRetroCore rec {
     core = "handy";
     src = fetchRetro {
       repo = "libretro-" + core;
-      rev = "6b19a4fad1b394f6a1351c88f60991d4878ff05b";
-      sha256 = "0lhkrwh3rirdidxb8kfcg8wk9gjsc7g6qpkv74h6f09rb4y75w1y";
+      rev = "c9fe65d1a2df454ee11404ac27bdc9be319dd9a2";
+      sha256 = "1l1gi8z68mv2cpdy7a6wvhd86q55khj3mv3drf43ak4kj2ij8cvq";
     };
     description = "Port of Handy to libretro";
     license = "Handy-License";
-  }).override {
     makefile = "Makefile";
-    buildPhase = "make";
   };
 
-  hatari = (mkLibRetroCore rec {
+  hatari = mkLibRetroCore rec {
     core = "hatari";
     src = fetchRetro {
       repo = core;
@@ -445,271 +532,280 @@ in with stdenv.lib.licenses;
     };
     description = "Port of Hatari to libretro";
     license = gpl2;
-    extraBuildInputs = [ cmake SDL ];
-  }).override {
-    makefile = "Makefile.libretro";
-    buildPhase = "make";
-  };
-
-  higan-sfc = (mkLibRetroCore {
-    core = "higan-sfc";
-    src = fetchFromGitLab {
-      owner = "higan";
-      repo = "higan";
-      rev = "d3f592013a27cb78f17d84f90a6be6cf6f6af1d1";
-      sha256 = "19d4cbwg8d085xq5lmql4v5l4ckgwqzc59ha5yfgv3w4qfp4dmij";
-    };
-    description = "Accurate SNES / Super Famicom emulator";
-    license = gpl3;
-    broken = true;
-
-  }).override {
-    makefile = "GNUmakefile";
-    buildPhase = "cd higan && make compiler=g++ target=libretro binary=library && cd out";
+    extraBuildInputs = [ SDL zlib ];
+    extraNativeBuildInputs = [ cmake which ];
+    dontUseCmakeConfigure = true;
+    dontConfigure = true;
+    makeFlags = [ "EXTERNAL_ZLIB=1" ];
+    depsBuildBuild = [ buildPackages.stdenv.cc ];
   };
 
-  mame = (mkLibRetroCore {
+  mame = mkLibRetroCore {
     core = "mame";
     src = fetchRetro {
       repo = "mame";
-      rev = "f4aac49f3d56fbd653628ac456c23ac9a6b857ae";
-      sha256 = "1pjpnwdj73319hgcjhganzrcz2zn4fnjydah989haqh3id5j3zam";
+      rev = "ed987ad07964a938351ff3cc1ad42e02ffd2af6d";
+      sha256 = "0qc66mvraffx6ws972skx3wgblich17q6z42798qn13q1a264p4j";
     };
     description = "Port of MAME to libretro";
     license = gpl2Plus;
 
     extraBuildInputs = [ alsaLib libGLU libGL portaudio python27 xorg.libX11 ];
-  }).override {
     postPatch = ''
       # Prevent the failure during the parallel building of:
       # make -C 3rdparty/genie/build/gmake.linux -f genie.make obj/Release/src/host/lua-5.3.0/src/lgc.o
       mkdir -p 3rdparty/genie/build/gmake.linux/obj/Release/src/host/lua-5.3.0/src
     '';
-    buildPhase = "make -f Makefile.libretro";
+    makefile = "Makefile.libretro";
   };
 
-  mame2000 = (mkLibRetroCore rec {
+  mame2000 = mkLibRetroCore rec {
     core = "mame2000";
     src = fetchRetro {
       repo = core + "-libretro";
-      rev = "0a8a174f5e755cdd476895207003c5d07cfa6af2";
-      sha256 = "03k0cfgd4wfl31dv5xb6xjd4h7sh0k0qw6wbspwi0lgswmhz97bb";
+      rev = "e5d4a934c60adc6d42a3f87319312aad89595a15";
+      sha256 = "1zn63yqyrsnsk196v5f3nm7cx41mvsm3icpis1yxbma2r3dk3f89";
     };
     description = "Port of MAME ~2000 to libretro";
     license = gpl2Plus;
-  }).override {
     makefile = "Makefile";
-    buildPhase = "make";
+    makeFlags = stdenv.lib.optional (!stdenv.hostPlatform.isx86) "IS_X86=0";
   };
 
-  mame2003 = (mkLibRetroCore rec {
+  mame2003 = mkLibRetroCore rec {
     core = "mame2003";
     src = fetchRetro {
       repo = core + "-libretro";
-      rev = "170d5b6490953d40edc39defe69945d005f8ec03";
-      sha256 = "0slsf59sn5lijr1mrx5ffc9z81ra1wcw7810mb52djqyvm15r9zl";
+      rev = "82596014905ad38c80c9eb322ab08c625d1d92cd";
+      sha256 = "17dp2rz6p7q7nr0lajn3vhk9ghngxz16f7c6c87r6wgsy4y3xw0m";
     };
     description = "Port of MAME ~2003 to libretro";
     license = gpl2Plus;
-  }).override {
     makefile = "Makefile";
-    buildPhase = "make";
   };
 
-  mame2003-plus = (mkLibRetroCore rec {
+  mame2003-plus = mkLibRetroCore rec {
     core = "mame2003-plus";
     src = fetchRetro {
       repo = core + "-libretro";
-      rev = "d9a56a3af908ae9100b4c9feebff4b918363f241";
-      sha256 = "1c16chfs4b2j1x1bmrklh8ssqki850k787qwq7b95dyxksj2bpx1";
+      rev = "0134c428b75882aa474f78dbbf2c6ecde49b97b7";
+      sha256 = "0jln2ys6v9hrsrkhqd87jfslwvkca425f40mf7866g6b4pz56mwc";
     };
     description = "Port of MAME ~2003+ to libretro";
     license = gpl2Plus;
-  }).override {
     makefile = "Makefile";
-    buildPhase = "make";
   };
 
-  mame2010 = (mkLibRetroCore rec {
+  mame2010 = mkLibRetroCore rec {
     core = "mame2010";
     src = fetchRetro {
       repo = core + "-libretro";
-      rev = "4ced2c31f1100eefc7f4483b474b8a680a3b3f2b";
-      sha256 = "1a8ijj0sixr6xrqfgimna0ipfj2bb2kvj4mb45hb8a18mwn6y0mc";
+      rev = "d3151837758eade73c85c28c20e7d2a8706f30c6";
+      sha256 = "0hj0yhc8zs32fkzn8j341ybhvrsknv0k6x0z2fv3l9ic7swgb93i";
     };
     description = "Port of MAME ~2010 to libretro";
     license = gpl2Plus;
-  }).override {
     makefile = "Makefile";
-    buildPhase = "make";
+    makeFlags = stdenv.lib.optionals stdenv.hostPlatform.isAarch64 [ "PTR64=1" "ARM_ENABLED=1" "X86_SH2DRC=0" "FORCE_DRC_C_BACKEND=1" ];
   };
 
-  mame2015 = (mkLibRetroCore rec {
+  mame2015 = mkLibRetroCore rec {
     core = "mame2015";
     src = fetchRetro {
       repo = core + "-libretro";
-      rev = "e3a28398f54cd6b2c24b7165d215b046b79c10f5";
-      sha256 = "1fgwi37zgp2s92bkz03gch3ivgyjgdi3xycrd8z7x87gi20a79x9";
+      rev = "37333ed6fda4c798a1d6b055fe4708f9f0dcf5a7";
+      sha256 = "1asldlj1ywgmhabbhaagagg5hn0359122al07802q3l57ns41l64";
     };
     description = "Port of MAME ~2015 to libretro";
     license = gpl2Plus;
-    extraBuildInputs = [ python27 alsaLib ];
-  }).override {
+    extraNativeBuildInputs = [ python27 ];
+    extraBuildInputs = [ alsaLib ];
     makefile = "Makefile";
-    buildPhase = "make";
   };
 
-  mame2016 = (mkLibRetroCore rec {
+  mame2016 = mkLibRetroCore rec {
     core = "mame2016";
     src = fetchRetro {
       repo = core + "-libretro";
-      rev = "ea4c1ffa75eb3fb0096158b71706b8b84d86d12c";
-      sha256 = "1qyvdymmjv5q0k3najgfdxzf1yr6bnysnsl19v753yj29xs4hwzp";
+      rev = "02987af9b81a9c3294af8fb9d5a34f9826a2cf4d";
+      sha256 = "0gl7irmn5d8lk7kf484vgw6kb325fq4ghwsni3il4nm5n2a8yglh";
     };
     description = "Port of MAME ~2016 to libretro";
     license = gpl2Plus;
-    extraBuildInputs = [ python27 alsaLib ];
-  }).override {
+    extraNativeBuildInputs = [ python27 ];
+    extraBuildInputs = [ alsaLib ];
     postPatch = ''
       # Prevent the failure during the parallel building of:
       # make -C 3rdparty/genie/build/gmake.linux -f genie.make obj/Release/src/host/lua-5.3.0/src/lgc.o
       mkdir -p 3rdparty/genie/build/gmake.linux/obj/Release/src/host/lua-5.3.0/src
     '';
-    buildPhase = "make -f Makefile.libretro";
   };
 
-  mesen = (mkLibRetroCore rec {
+  mesen = mkLibRetroCore rec {
     core = "mesen";
     src = fetchFromGitHub {
       owner = "SourMesen";
       repo = core;
-      rev = "942633dd3dbb73cc3abd748f6d5440c78abbea09";
-      sha256 = "0a95wd64vnblksacapxwxla9j2iw8a5hbdm111cldrni12q87iq2";
+      rev = "cfc5bf6976f62ebd42ea30d5a803c138fc357509";
+      sha256 = "0ihlgvzvni1yqcyi5yxdvg36q20fsqd6n67zavwfb2ph09cqv7kz";
     };
     description = "Port of Mesen to libretro";
     license = gpl3;
-  }).override {
-    makefile = "Libretro/Makefile";
-    buildPhase = "cd Libretro && make";
+    makefile = "Makefile";
+    preBuild = "cd Libretro";
+  };
+
+  meteor = mkLibRetroCore rec {
+    core = "meteor";
+    src = fetchRetro {
+      repo = core + "-libretro";
+      rev = "3d21e3b5a7596918bee0fcaca5752ae76624c05e";
+      sha256 = "0fghnxxbdrkdz6zswkd06w2r3dvr4ikvcp8jbr7nb9fc5yzn0avw";
+    };
+    description = "Port of Meteor to libretro";
+    license = gpl3;
+    makefile = "Makefile";
+    preBuild = "cd libretro";
   };
 
   mgba = mkLibRetroCore rec {
     core = "mgba";
     src = fetchRetro {
       repo = core;
-      rev = "4865aaabc2a46c635f218f7b51f8fc5cc2c4c8ac";
-      sha256 = "1mdzwcsl5bafmgqfh0a1bgfgilisffxsygcby0igsq2bgkal47mm";
+      rev = "f87f9ef6cb38537e07dcaedeb82aecac6537d42e";
+      sha256 = "0yixvnzgk7qvcfz12r5y8i85czqxbxx6bvl1c7yms8riqn9ssvb7";
     };
     description = "Port of mGBA to libretro";
     license = mpl20;
   };
 
-  mupen64plus = (mkLibRetroCore rec {
+  mupen64plus = mkLibRetroCore {
     core = "mupen64plus-next";
     src = fetchRetro {
-      repo = "mupen64plus-libretro-nx"; # + "-libretro-nx";
-      rev = "f77c16f9f1dd911fd2254becc8a28adcdafe8aa1";
-      sha256 = "0j6vrkwch9lwmlhyz7fp1ha0bby54gvbwk91hwbv35f6dvs0aw0d";
+      repo = "mupen64plus-libretro-nx";
+      rev = "81a58df0263c90b10b7fc11b6deee04d47e3aa40";
+      sha256 = "1brqyrsdzdq53a68q7ph01q2bx5y4m8b3ymvpp25229imm88lgkn";
     };
     description = "Libretro port of Mupen64 Plus, GL only";
     license = gpl2;
 
     extraBuildInputs = [ libGLU libGL libpng nasm xorg.libX11 ];
-  }).override {
     makefile = "Makefile";
-    buildPhase = "make";
   };
 
-  nestopia = (mkLibRetroCore rec {
+  neocd = mkLibRetroCore rec {
+    core = "neocd";
+    src = fetchRetro {
+      repo = core + "_libretro";
+      rev = "3825848fe7dd7e0ef859729eefcb29e2ea2956b7";
+      sha256 = "018vfmjsx62zk45yx3pwisp4j133yxjbm7fnwwr244gnyms57711";
+    };
+    description = "NeoCD libretro port";
+    license = gpl3;
+    makefile = "Makefile";
+  };
+
+  nestopia = mkLibRetroCore rec {
     core = "nestopia";
     src = fetchRetro {
       repo = core;
-      rev = "7f48c211c281880d122981da119a4455a9bebbde";
-      sha256 = "05p3a559633dzw222rs1fh48v657mdyirl1qfqzkhqiar9rxf31g";
+      rev = "70c53f08c0cc92e90d095d6558ab737ce20431ac";
+      sha256 = "1hlfqml66wy6fn40f1iiy892vq9y9fj20vv3ynd2s3b3qxhwfx73";
     };
-    description = "nestopia undead libretro port";
+    description = "Nestopia libretro port";
     license = gpl2;
-  }).override {
-    makefile = "libretro/Makefile";
-    buildPhase = "cd libretro && make";
+    makefile = "Makefile";
+    preBuild = "cd libretro";
   };
 
-  o2em = (mkLibRetroCore rec {
+  o2em = mkLibRetroCore rec {
     core = "o2em";
     src = fetchRetro {
       repo = "libretro-" + core;
-      rev = "d6731b9b2592654ce4f1b64c1b1da17b32e7c94c";
-      sha256 = "0809qw16y7ablxfayf0lbzvq7wqdmjp0afdb0vcgv193vvhhp58q";
+      rev = "b23a796dd3490e979ff43710317df6d43bd661e1";
+      sha256 = "1pkbq7nig394zdjdic0mzdsvx8xhzamsh53xh2hzznipyj46b7z0";
     };
     description = "Port of O2EM to libretro";
     license = artistic1;
-  }).override {
     makefile = "Makefile";
-    buildPhase = "make";
   };
 
-  parallel-n64 = (mkLibRetroCore rec {
+  opera = mkLibRetroCore rec {
+    core = "opera";
+    src = fetchRetro {
+      repo = core + "-libretro";
+      rev = "27bc2653ed469072a6a95102a8212a35fbb1e590";
+      sha256 = "10cxjpsd35rb4fjc5ycs1h00gvshpn2mxxvwb6xzrfrzva0kjw1l";
+    };
+    description = "Opera is a port of 4DO/libfreedo to libretro";
+    license = "Non-commercial";
+    makefile = "Makefile";
+    makeFlags = [ "CC_PREFIX=${stdenv.cc.targetPrefix}" ];
+  };
+
+  parallel-n64 = mkLibRetroCore rec {
     core = "parallel-n64";
     src = fetchRetro {
       repo = core;
-      rev = "30f4fd3c2456145763eb76aead7485a1b86ba6bd";
-      sha256 = "0kbyzmscmfi6f842clzaff4k6xcb5410fwhv8n6vv42xk6ljfvgh";
+      rev = "8fe07c62a364d0af1e22b7f75e839d42872dae7f";
+      sha256 = "0p3fpldw6w4n4l60bv55c17vhqwq4q39fp36h8iqmnj7c32c61kf";
     };
     description = "Parallel Mupen64plus rewrite for libretro.";
     license = gpl2;
-
     extraBuildInputs = [ libGLU libGL libpng ];
-  }).override {
     makefile = "Makefile";
-    buildPhase = "make";
+    postPatch = stdenv.lib.optionalString stdenv.hostPlatform.isAarch64 ''
+      sed -i -e '1 i\CPUFLAGS += -DARM_FIX -DNO_ASM -DARM_ASM -DDONT_WANT_ARM_OPTIMIZATIONS -DARM64' Makefile \
+      && sed -i -e 's,CPUFLAGS  :=,,g' Makefile
+    '';
   };
 
-  pcsx_rearmed = (mkLibRetroCore rec {
+  pcsx_rearmed = mkLibRetroCore rec {
     core = "pcsx_rearmed";
     src = fetchRetro {
       repo = core;
-      rev = "eb6943ee04b0f30a6f1cebfe399a94bacd1dfb45";
-      sha256 = "0xikdirvjal4mdr5y9dl9gcxhdilqzq43f909b0z8vc069vj1wjz";
+      rev = "8fda5dd0e28fe46621fb1ab57781c316143017da";
+      sha256 = "0k371d0xqzqwy8ishvxssgasm36q83qj7ksn2av110n879n4knwb";
     };
-    description = "Port of PCSX ReARMed to libretro";
+    description = "Port of PCSX ReARMed with GNU lightning to libretro";
     license = gpl2;
-  }).override {
-    configurePhase = "rm configure";
-    buildPhase = "make -f Makefile.libretro";
+    dontConfigure = true;
   };
 
-  picodrive = (mkLibRetroCore rec {
+  picodrive = mkLibRetroCore rec {
     core = "picodrive";
     src = fetchRetro {
       repo = core;
-      rev = "28dcfd6f43434e6828ee647223a0576bfe858c24";
-      sha256 = "19a1b6q8fhf7wxzyf690va1ixzlxlzyslv1zxm0ll5pfsqf2y3gx";
+      rev = "600894ec6eb657586a972a9ecd268f50907a279c";
+      sha256 = "1bxphwnq4b80ssmairy8sfc5cp4m6jyvrcjcj63q1vk7cs6qls7p";
     };
     description = "Fast MegaDrive/MegaCD/32X emulator";
     license = "MAME";
 
     extraBuildInputs = [ libpng SDL ];
-  }).override {
-    patchPhase = "sed -i -e 's,SDL_CONFIG=\".*\",SDL_CONFIG=\"${SDL.dev}/bin/sdl-config\",' configure";
-    configurePhase = "./configure";
+    SDL_CONFIG = "${SDL.dev}/bin/sdl-config";
+    dontAddPrefix = true;
+    configurePlatforms = [];
+    meta.badPlatforms = [ "aarch64-linux" ];
   };
 
-  play = (mkLibRetroCore rec {
+  play = mkLibRetroCore {
     core = "play";
     src = fetchRetro {
       repo = "play-";
-      rev = "fedc1e1c2918a7490a881cdb4ec951a828c19671";
-      sha256 = "0hwxx7h61gd29a2gagwjbvxk2hgwdk1wxg4nx90zrizb8nczwnl6";
+      rev = "884ae3b96c631f235cd18b2643d1f318fa6951fb";
+      sha256 = "0m9pk20jh4y02visgzfw64bpbw93bzs15x3a3bnd19yivm34dbfc";
     };
     description = "Port of Play! to libretro";
     license = bsd2;
-    extraBuildInputs = [ cmake boost ];
-  }).override {
+    extraBuildInputs = [ boost ];
+    extraNativeBuildInputs = [ cmake openssl curl icu libGL libGLU xorg.libX11 ];
+    makefile = "Makefile";
     cmakeFlags = [ "-DBUILD_PLAY=OFF -DBUILD_LIBRETRO_CORE=ON" ];
-    buildPhase = "make";
+    postBuild = "mv Source/ui_libretro/play_libretro${stdenv.hostPlatform.extensions.sharedLibrary} play_libretro${stdenv.hostPlatform.extensions.sharedLibrary}";
   };
 
-  ppsspp = (mkLibRetroCore rec {
+  ppsspp = mkLibRetroCore {
     core = "ppsspp";
     src = fetchgit {
       url = "https://github.com/hrydgard/ppsspp";
@@ -718,214 +814,261 @@ in with stdenv.lib.licenses;
     };
     description = "ppsspp libretro port";
     license = gpl2;
-    extraBuildInputs = [ cmake libGLU libGL ffmpeg python37 xorg.libX11 ];
-  }).override {
-    cmakeFlags = [ "-DLIBRETRO=ON" ];
+    extraNativeBuildInputs = [ cmake pkgconfig ];
+    extraBuildInputs = [ libGLU libGL libzip ffmpeg python37 snappy xorg.libX11 ];
     makefile = "Makefile";
-    buildPhase = ''
-      make \
-      && mv lib/ppsspp_libretro${stdenv.hostPlatform.extensions.sharedLibrary} ppsspp_libretro${stdenv.hostPlatform.extensions.sharedLibrary}
-    '';
+    cmakeFlags = [ "-DLIBRETRO=ON -DUSE_SYSTEM_FFMPEG=ON -DUSE_SYSTEM_SNAPPY=ON -DUSE_SYSTEM_LIBZIP=ON -DOpenGL_GL_PREFERENCE=GLVND" ];
+    postBuild = "mv lib/ppsspp_libretro${stdenv.hostPlatform.extensions.sharedLibrary} ppsspp_libretro${stdenv.hostPlatform.extensions.sharedLibrary}";
   };
 
-  prboom = (mkLibRetroCore rec {
+  prboom = mkLibRetroCore rec {
     core = "prboom";
     src = fetchRetro {
       repo = "libretro-" + core;
-      rev = "4c690eb6b569a276c5b2a87680718f715477eae2";
-      sha256 = "02vkl3y5dmyzifsviphspqv03a2rdyf36zpjpgfg7x0s226f56ja";
+      rev = "991016b3c7a9c8b0e49b2bc9c72f68c60800fc7b";
+      sha256 = "1abv9qgfvh3x84shgyl3y90bjz77mjj17vibag7bg6i8hgjikjgq";
     };
     description = "Prboom libretro port";
     license = gpl2;
-  }).override {
-    buildPhase = "make";
+    makefile = "Makefile";
   };
 
-  prosystem = (mkLibRetroCore rec {
+  prosystem = mkLibRetroCore rec {
     core = "prosystem";
     src = fetchRetro {
       repo = core + "-libretro";
-      rev = "cb4aa3ee72f98b0891a7bac5c9dac458cdba4d34";
-      sha256 = "0yvzmks9zz1hf7mv6cd2qin1p3yx00dbrcxlm0yysy5q5jiigblg";
+      rev = "6f7e34aea89db5ba2fbf674e5ff0ad6fc68a198e";
+      sha256 = "0pqkb0f51s8ma0l4m9xk2y85z2kh3fgay9g4g8fingbgqq1klvzs";
     };
     description = "Port of ProSystem to libretro";
     license = gpl2;
-  }).override {
     makefile = "Makefile";
-    buildPhase = "make";
   };
 
-  quicknes = (mkLibRetroCore rec {
+  quicknes = mkLibRetroCore {
     core = "quicknes";
     src = fetchRetro {
       repo = "QuickNES_Core";
-      rev = "cd302d998d102c9461a924b81817e48b9ea1518f";
-      sha256 = "1sczs1jqcbhpkb5xpcqqdcnxlz7bqmanm4gdnnc12c19snl7999b";
+      rev = "31654810b9ebf8b07f9c4dc27197af7714364ea7";
+      sha256 = "15fr5a9hv7wgndb0fpmr6ws969him41jidzir2ix9xkb0mmvcm86";
     };
     description = "QuickNES libretro port";
     license = lgpl21Plus;
-  }).override {
     makefile = "Makefile";
-    buildPhase = "make";
   };
 
-  scummvm = (mkLibRetroCore rec {
+  sameboy = mkLibRetroCore rec {
+    core = "sameboy";
+    src = fetchRetro {
+      repo = "sameboy";
+      rev = "c9e547c1063fd62c40a4b7a86e7db99dc9089051";
+      sha256 = "0bff6gicm24d7h270aqvgd8il6mi7j689nj5zl9ij0wc77hrrpmq";
+    };
+    description = "SameBoy libretro port";
+    license = mit;
+    extraNativeBuildInputs = [ which hexdump ];
+    preBuild = "cd libretro";
+    makefile = "Makefile";
+  };
+
+  scummvm = mkLibRetroCore rec {
     core = "scummvm";
     src = fetchRetro {
       repo = core;
-      rev = "e07a6ede61c364fb87630fa7507a4f8482d882e0";
-      sha256 = "0i88z53q28lwzmadxincab4m66qbzcbmasgildybj8db0z2z8jm0";
+      rev = "de91bf9bcbf4449f91e2f50fde173496a2b52ee0";
+      sha256 = "06h9xaf2b1cjk85nbslpjj0fm9iy9b2lxr1wf3i09hgs4sh6x464";
     };
     description = "Libretro port of ScummVM";
     license = gpl2;
     extraBuildInputs = [ fluidsynth libjpeg libvorbis libGLU libGL SDL ];
-  }).override {
-    makefile = "backends/platform/libretro/build/Makefile";
-    buildPhase = "cd backends/platform/libretro/build && make";
+    makefile = "Makefile";
+    preConfigure = "cd backends/platform/libretro/build";
+  };
+
+  smsplus-gx = mkLibRetroCore rec {
+    core = "smsplus";
+    src = fetchRetro {
+      repo = core + "-gx";
+      rev = "36c82768c03d889f1cf4b66369edac2297acba32";
+      sha256 = "1f9waikyp7kp2abb76wlv9hmf2jpc76zjmfqyc7wk2pc70ljm3l4";
+    };
+    description = "SMS Plus GX libretro port";
+    license = gpl2Plus;
   };
 
-  snes9x = (mkLibRetroCore rec {
+  snes9x = mkLibRetroCore rec {
     core = "snes9x";
     src = fetchFromGitHub {
       owner = "snes9xgit";
       repo = core;
-      rev = "04692e1ee45cc647423774ee17c63208c2713638";
-      sha256 = "09p9m85fxwrrrapjb08rcxknpgq5d6a87arrm1jn94r56glxlcfa";
+      rev = "6db918cfe32b157239da44096091c212fdfb3b60";
+      sha256 = "0y3jhy50qdhhfglybys9m0fgk9r24ksdcgv5iqpyxy5a4cjvhv8j";
     };
     description = "Port of SNES9x git to libretro";
     license = "Non-commercial";
-  }).override {
-    makefile = "libretro/Makefile";
-    buildPhase = "cd libretro && make";
+    makefile = "Makefile";
+    preBuild = "cd libretro";
   };
 
-  snes9x2002 = (mkLibRetroCore rec {
+  snes9x2002 = mkLibRetroCore rec {
     core = "snes9x2002";
     src = fetchRetro {
       repo = core;
-      rev = "354bcb5acea0aa45b56ae553e0b2b4f10792dfeb";
-      sha256 = "05gvjjxy6ci5pax3frd9g8k9mkqskab5g6rvfjab7cc4zrxrg23f";
+      rev = "a869da7f22c63ee1cb316f79c6dd7691a369da3e";
+      sha256 = "11lcwscnxg6sk9as2xlr4nai051qhidbsymyis4nz3r4dmgzf8j8";
     };
     description = "Optimized port/rewrite of SNES9x 1.39 to Libretro";
     license = "Non-commercial";
-  }).override {
     makefile = "Makefile";
-    buildPhase = "make";
   };
 
-  snes9x2005 = (mkLibRetroCore rec {
+  snes9x2005 = mkLibRetroCore rec {
     core = "snes9x2005";
     src = fetchRetro {
       repo = core;
-      rev = "e5cadd2f21fb64e8c7194ad006b39e6f555c4a5b";
-      sha256 = "1q0xrw3f8zm2k19sva8cz28yx815w8a6y1xsl0i6bb3cai3q1hyx";
+      rev = "c216559b9e0dc3d7f059dcf31b813402ad47fea5";
+      sha256 = "19b2rpj6i32c34ryvlna4yca84y5ypza78w4x9l17qlhp021h9pv";
     };
     description = "Optimized port/rewrite of SNES9x 1.43 to Libretro";
     license = "Non-commercial";
-  }).override {
     makefile = "Makefile";
-    buildPhase = ''
-      make USE_BLARGG_APU=1 \
-      && mv snes9x2005_plus_libretro${stdenv.hostPlatform.extensions.sharedLibrary} snes9x2005_libretro${stdenv.hostPlatform.extensions.sharedLibrary}
-    '';
+    makeFlags = [ "USE_BLARGG_APU=1" ];
+    postBuild = "mv snes9x2005_plus_libretro${stdenv.hostPlatform.extensions.sharedLibrary} snes9x2005_libretro${stdenv.hostPlatform.extensions.sharedLibrary}";
   };
 
-  snes9x2010 = (mkLibRetroCore rec {
+  snes9x2010 = mkLibRetroCore rec {
     core = "snes9x2010";
     src = fetchRetro {
       repo = core;
-      rev = "e945cbae0f8c472e1567a319817c9228b775dd71";
-      sha256 = "1pj5p4a2hy7hk90bzy4vnkz3b6nc8n1niqibgwhyfsc22xlxqsfr";
+      rev = "ba9f2240360f8db270fb6ba5465c79c317070560";
+      sha256 = "00y53sjrsp8sccpp1qqw88iawsz30g6d370cbqcxs4ya1r6awn5x";
     };
     description = "Optimized port/rewrite of SNES9x 1.52+ to Libretro";
     license = "Non-commercial";
-  }).override {
-    buildPhase = ''
-      make -f Makefile.libretro
-    '';
   };
 
-  stella = (mkLibRetroCore rec {
+  stella = mkLibRetroCore rec {
     core = "stella";
+    src = fetchFromGitHub {
+      owner = "stella-emu";
+      repo = core;
+      rev = "506bb0bd0618e676b1959931dcc00a9d0f5f0f3d";
+      sha256 = "09nclx0ksixngnxkkjjcyhf3d0vl4ykm8fx7m307lvag8nxj7z03";
+    };
+    description = "Port of Stella to libretro";
+    license = gpl2;
+    extraBuildInputs = [ libpng pkgconfig SDL ];
+    makefile = "Makefile";
+    preBuild = "cd src/libretro";
+    dontConfigure = true;
+  };
+
+  stella2014 = mkLibRetroCore rec {
+    core = "stella2014";
     src = fetchRetro {
-      repo = core + "2014-libretro";
-      rev = "6d74ad9a0fd779145108cf1213229798d409ed37";
-      sha256 = "0b1nsk92rr64xxj8jc9vpjqgrmm3554096zl031ymr94j5cc87q9";
+      repo = core + "-libretro";
+      rev = "fc87f2c78d3b177f4b9b19698557dce452ac3ce7";
+      sha256 = "0yqzavk1w0d0ngpls32c4wlihii97fz2g6zsgadhm48apwjvn3xx";
     };
     description = "Port of Stella to libretro";
     license = gpl2;
-  }).override {
     makefile = "Makefile";
-    buildPhase = ''
-      make \
-      && mv stella2014_libretro${stdenv.hostPlatform.extensions.sharedLibrary} stella_libretro${stdenv.hostPlatform.extensions.sharedLibrary}
-    '';
+  };
+
+  tgbdual = mkLibRetroCore rec {
+    core = "tgbdual";
+    src = fetchRetro {
+      repo = core + "-libretro";
+      rev = "9be31d373224cbf288db404afc785df41e61b213";
+      sha256 = "19m3f3hj3jyg711z1xq8qn1hgsr593krl6s6hi0r6vf8p5x0zbzw";
+    };
+    description = "Port of TGBDual to libretro";
+    license = gpl2;
+    makefile = "Makefile";
+  };
+
+  tic80 = mkLibRetroCore {
+    core = "tic80";
+    src = fetchRetro {
+      repo = "tic-80";
+      rev = "f43bad908d5f05f2a66d5cd1d6f21b234d4abd2c";
+      sha256 = "0bp34r8qqyw52alws1z4ib9j7bs4d641q6nvqszd07snp9lpvwym";
+    };
+    description = "Port of TIC-80 to libretro";
+    license = mit;
+    extraNativeBuildInputs = [ cmake pkgconfig ];
+    makefile = "Makefile";
+    cmakeFlags = [
+      "-DBUILD_LIBRETRO=ON"
+      "-DBUILD_DEMO_CARTS=OFF"
+      "-DBUILD_PRO=OFF"
+      "-DBUILD_PLAYER=OFF"
+      "-DBUILD_SDL=OFF"
+      "-DBUILD_SOKOL=OFF"
+    ];
+    postBuild = "cd lib";
   };
 
   vba-next = mkLibRetroCore rec {
     core = "vba-next";
     src = fetchRetro {
       repo = core;
-      rev = "3580ae6acb1a90c4e982e57597458da07eca4f41";
-      sha256 = "0fz8z04kf9g1i5x5slyvx5kb07garzxvhcqnwmqn5j574xh1lc6d";
+      rev = "019132daf41e33a9529036b8728891a221a8ce2e";
+      sha256 = "0hab4rhvvcg30jifd9h9jq5q2vqk2hz5i1q456w6v2d10hl1lf15";
     };
     description = "VBA-M libretro port with modifications for speed";
     license = gpl2;
   };
 
-  vba-m = (mkLibRetroCore rec {
+  vba-m = mkLibRetroCore rec {
     core = "vbam";
     src = fetchRetro {
       repo = core + "-libretro";
-      rev = "9ccdeac3aa9db00720bb80eff5c9924362144efa";
-      sha256 = "0rq89i9f483j93shhp2p3vqsnb2abpwz6wdnsycfwxgblczmi22y";
+      rev = "7d88e045a2fe44e56b3f84846beec446b4c4b2d9";
+      sha256 = "04f8adg99a36qkqhij54vkw5z18m5ld33p78lbmv8cxk7k7g7yhy";
     };
     description = "vanilla VBA-M libretro port";
     license = gpl2;
-  }).override {
-    makefile = "src/libretro/Makefile";
-    buildPhase = "cd src/libretro && make";
+    makefile = "Makefile";
+    preBuild = "cd src/libretro";
   };
 
-  vecx = (mkLibRetroCore rec {
+  vecx = mkLibRetroCore rec {
     core = "vecx";
     src = fetchRetro {
       repo = "libretro-" + core;
-      rev = "26585ee701499550e484c11f005db18e926827d9";
-      sha256 = "0vz2aksc8mqnw55f2bvvawj21mxf60fp93r0sr55hdccn9h7355k";
+      rev = "321205271b1c6be5dbdb8d309097a5b5c2032dbd";
+      sha256 = "1w54394yhf2yqmq1b8wi5y7lvixc5hpjxpyiancrdbjd0af7pdvd";
     };
     description = "Port of Vecx to libretro";
     license = gpl3;
-  }).override {
-    buildPhase = "make";
   };
 
-  virtualjaguar = (mkLibRetroCore rec {
+  virtualjaguar = mkLibRetroCore rec {
     core = "virtualjaguar";
     src = fetchRetro {
       repo = core + "-libretro";
-      rev = "7bdd8658880b53bf2bcbae0741323fe18f9041f5";
-      sha256 = "0zbrsfhvx293ijazy1w19qha19hprsi0zv8295sa0gq8kyh0xhyw";
+      rev = "a162fb75926f5509f187e9bfc69958bced40b0a6";
+      sha256 = "06k8xpn5y9rzmi2lwfw0v9v9pz4wvmpalycc608bw9cl39lmz10h";
     };
     description = "Port of VirtualJaguar to libretro";
     license = gpl3;
-  }).override {
     makefile = "Makefile";
-    buildPhase = "make";
   };
 
-  yabause = (mkLibRetroCore rec {
+  yabause = mkLibRetroCore rec {
     core = "yabause";
     src = fetchRetro {
       repo = core;
-      rev = "08d09cb88a69ee4c2986693fb813e0eb58d71481";
-      sha256 = "0z55yam1l7m21kbjwn44sp4md9g7p95b27vcxr7i0v08gnkwwvv1";
+      rev = "9be109f9032afa793d2a79b837c4cc232cea5929";
+      sha256 = "0aj862bs4dmnldy62wdssj5l63ibfkbzqvkxcqa3wyvdz4i367jc";
     };
     description = "Port of Yabause to libretro";
     license = gpl2;
-  }).override {
-    makefile = "yabause/src/libretro/Makefile";
-    buildPhase = "cd yabause/src/libretro && make";
+    makefile = "Makefile";
+    # Disable SSE for non-x86. DYNAREC doesn't build on either Aarch64 or x86_64.
+    makeFlags = stdenv.lib.optional (!stdenv.hostPlatform.isx86) "HAVE_SSE=0";
+    preBuild = "cd yabause/src/libretro";
   };
 
 }
diff --git a/pkgs/misc/emulators/retroarch/default.nix b/pkgs/misc/emulators/retroarch/default.nix
index 3f14258b0c01..02d098654321 100644
--- a/pkgs/misc/emulators/retroarch/default.nix
+++ b/pkgs/misc/emulators/retroarch/default.nix
@@ -19,22 +19,14 @@
 
 with stdenv.lib;
 
-let
-
-  # ibtool is closed source so we have to download the blob
-  osx-MainMenu = fetchurl {
-    url = "https://github.com/matthewbauer/RetroArch/raw/b146a9ac6b2b516652a7bf05a9db5a804eab323d/pkg/apple/OSX/en.lproj/MainMenu.nib";
-    sha256 = "13k1l628wy0rp6wxrpwr4g1m9c997d0q8ks50f8zhmh40l5j2sp8";
-  };
-
-in stdenv.mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "retroarch-bare";
-  version = "1.8.1";
+  version = "1.8.5";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "RetroArch";
-    sha256 = "0y7rcpz7psf8k3agsrq277jdm651vbnn9xpqvmj2in1a786idya7";
+    sha256 = "1pg8j9wvwgrzsv4xdai6i6jgdcc922v0m42rbqxvbghbksrc8la3";
     rev = "v${version}";
   };
 
@@ -50,33 +42,10 @@ in stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  configureFlags = if stdenv.isLinux then [ "--enable-kms" ] else "";
+  configureFlags = stdenv.lib.optionals stdenv.isLinux [ "--enable-kms" "--enable-egl" ];
 
   postInstall = optionalString withVulkan ''
     wrapProgram $out/bin/retroarch --prefix LD_LIBRARY_PATH ':' ${vulkan-loader}/lib
-  '' + optionalString stdenv.targetPlatform.isDarwin ''
-    EXECUTABLE_NAME=RetroArch
-    PRODUCT_NAME=RetroArch
-    MACOSX_DEPLOYMENT_TARGET=10.5
-    app=$out/Applications/$PRODUCT_NAME.app
-
-    install -D pkg/apple/OSX/Info.plist $app/Contents/Info.plist
-    echo "APPL????" > $app/Contents/PkgInfo
-    mkdir -p $app/Contents/MacOS
-    ln -s $out/bin/retroarch $app/Contents/MacOS/$EXECUTABLE_NAME
-
-    # Hack to fill in Info.plist template w/o using xcode
-    sed -i -e 's,''${EXECUTABLE_NAME}'",$EXECUTABLE_NAME," \
-           -e 's,''${MACOSX_DEPLOYMENT_TARGET}'",$MACOSX_DEPLOYMENT_TARGET," \
-           -e 's,''${PRODUCT_NAME}'",$PRODUCT_NAME," \
-           -e 's,''${PRODUCT_NAME:rfc1034identifier}'",$PRODUCT_NAME," \
-           $app/Contents/Info.plist
-
-    install -D ${osx-MainMenu} \
-               $app/Contents/Resources/en.lproj/MainMenu.nib
-    install -D pkg/apple/OSX/en.lproj/InfoPlist.strings \
-               $app/Contents/Resources/en.lproj/InfoPlist.strings
-    install -D media/retroarch.icns $app/Contents/Resources/retroarch.icns
   '';
 
   preFixup = "rm $out/bin/retroarch-cg2glsl";
@@ -86,6 +55,6 @@ in stdenv.mkDerivation rec {
     description = "Multi-platform emulator frontend for libretro cores";
     license = licenses.gpl3;
     platforms = platforms.all;
-    maintainers = with maintainers; [ MP2E edwtjo matthewbauer ];
+    maintainers = with maintainers; [ MP2E edwtjo matthewbauer kolbycrouch ];
   };
 }
diff --git a/pkgs/os-specific/darwin/smimesign/default.nix b/pkgs/os-specific/darwin/smimesign/default.nix
index 9efa230d3b72..6e799f1caaaa 100644
--- a/pkgs/os-specific/darwin/smimesign/default.nix
+++ b/pkgs/os-specific/darwin/smimesign/default.nix
@@ -1,4 +1,4 @@
-{ buildGoModule, fetchFromGitHub, lib }:
+{ buildGoModule, fetchFromGitHub, stdenv, libobjc, Security }:
 
 buildGoModule rec {
   pname = "smimesign";
@@ -13,9 +13,11 @@ buildGoModule rec {
 
   modSha256 = "1k3gnjzblfk14y19zhlvwysx045nbw0xr5nngh7zj1wcqxhhm206";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ libobjc Security ];
+
   buildFlagsArray = "-ldflags=-X main.versionString=${version}";
 
-  meta = with lib; {
+  meta = with stdenv.lib; {
     description = "An S/MIME signing utility for macOS and Windows that is compatible with Git.";
 
     homepage    = https://github.com/github/smimesign;
diff --git a/pkgs/os-specific/linux/fuse/common.nix b/pkgs/os-specific/linux/fuse/common.nix
index 35c91c5ec071..b0f684e6242a 100644
--- a/pkgs/os-specific/linux/fuse/common.nix
+++ b/pkgs/os-specific/linux/fuse/common.nix
@@ -84,8 +84,17 @@ in stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   meta = with stdenv.lib; {
+    description = "Library that allows filesystems to be implemented in user space";
+    longDescription = ''
+      FUSE (Filesystem in Userspace) is an interface for userspace programs to
+      export a filesystem to the Linux kernel. The FUSE project consists of two
+      components: The fuse kernel module (maintained in the regular kernel
+      repositories) and the libfuse userspace library (this package). libfuse
+      provides the reference implementation for communicating with the FUSE
+      kernel module.
+    '';
     inherit (src.meta) homepage;
-    description = "Kernel module and library that allows filesystems to be implemented in user space";
+    changelog = "https://github.com/libfuse/libfuse/releases/tag/fuse-${version}";
     platforms = platforms.linux;
     license = with licenses; [ gpl2 lgpl21 ];
     maintainers = [ maintainers.primeos ];
diff --git a/pkgs/os-specific/linux/fuse/default.nix b/pkgs/os-specific/linux/fuse/default.nix
index 6792e05829d1..415226509b7b 100644
--- a/pkgs/os-specific/linux/fuse/default.nix
+++ b/pkgs/os-specific/linux/fuse/default.nix
@@ -11,7 +11,7 @@ in {
   };
 
   fuse_3 = mkFuse {
-    version = "3.9.0";
-    sha256Hash = "00yppzmv15jqjy3wq5ki9d49jl6bfxrlwr5sfz50ihr40d6dgx9p";
+    version = "3.9.1";
+    sha256Hash = "1i3f4h3vnjxls8hdi6w2n2ksrgbs7brbzj65rvxginyxicykh857";
   };
 }
diff --git a/pkgs/os-specific/linux/fuse/fuse3-Do-not-set-FUSERMOUNT_DIR.patch b/pkgs/os-specific/linux/fuse/fuse3-Do-not-set-FUSERMOUNT_DIR.patch
index 1d41a26b0a4d..903f30325df2 100644
--- a/pkgs/os-specific/linux/fuse/fuse3-Do-not-set-FUSERMOUNT_DIR.patch
+++ b/pkgs/os-specific/linux/fuse/fuse3-Do-not-set-FUSERMOUNT_DIR.patch
@@ -1,12 +1,12 @@
 --- a/lib/meson.build
 +++ b/lib/meson.build
-@@ -36,8 +36,7 @@ libfuse = library('fuse3', libfuse_sources, version: meson.project_version(),
+@@ -37,8 +37,7 @@ libfuse = library('fuse3', libfuse_sources, version: meson.project_version(),
                    soversion: '3', include_directories: include_dirs,
                    dependencies: deps, install: true,
                    link_depends: 'fuse_versionscript',
--                  c_args: [ '-DFUSE_USE_VERSION=34',
+-                  c_args: [ '-DFUSE_USE_VERSION=35',
 -                            '-DFUSERMOUNT_DIR="@0@"'.format(fusermount_path) ],
-+                  c_args: [ '-DFUSE_USE_VERSION=34' ],
++                  c_args: [ '-DFUSE_USE_VERSION=35' ],
                    link_args: ['-Wl,--version-script,' + meson.current_source_dir()
                                + '/fuse_versionscript' ])
  
diff --git a/pkgs/os-specific/linux/wooting-udev-rules/default.nix b/pkgs/os-specific/linux/wooting-udev-rules/default.nix
new file mode 100644
index 000000000000..49da843e3ad9
--- /dev/null
+++ b/pkgs/os-specific/linux/wooting-udev-rules/default.nix
@@ -0,0 +1,23 @@
+{ stdenv }:
+
+stdenv.mkDerivation rec {
+  pname = "wooting-udev-rules";
+  version = "20190601";
+
+  # Source: https://wooting.helpscoutdocs.com/article/68-wootility-configuring-device-access-for-wootility-under-linux-udev-rules
+  src = [ ./wooting.rules ];
+
+  unpackPhase = ":";
+
+  installPhase = ''
+    install -Dpm644 $src $out/lib/udev/rules.d/70-wooting.rules
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = https://wooting.helpscoutdocs.com/article/34-linux-udev-rules;
+    description = "udev rules that give NixOS permission to communicate with Wooting keyboards";
+    platforms = platforms.linux;
+    license = "unknown";
+    maintainers = with maintainers; [ davidtwco ];
+  };
+}
diff --git a/pkgs/os-specific/linux/wooting-udev-rules/wooting.rules b/pkgs/os-specific/linux/wooting-udev-rules/wooting.rules
new file mode 100644
index 000000000000..d906df3d4c6a
--- /dev/null
+++ b/pkgs/os-specific/linux/wooting-udev-rules/wooting.rules
@@ -0,0 +1,9 @@
+# Wooting One
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="03eb", ATTRS{idProduct}=="ff01", MODE:="0660", GROUP="input"
+# Wooting One update mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="03eb", ATTRS{idProduct}=="2402", MODE:="0660", GROUP="input"
+
+# Wooting Two
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="03eb", ATTRS{idProduct}=="ff02", MODE:="0660", GROUP="input"
+# Wooting Two update mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="03eb", ATTRS{idProduct}=="2403", MODE:="0660", GROUP="input"
diff --git a/pkgs/servers/caddy/default.nix b/pkgs/servers/caddy/default.nix
index bcd4b7065b58..8b51e584e3ec 100644
--- a/pkgs/servers/caddy/default.nix
+++ b/pkgs/servers/caddy/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "caddy";
@@ -16,6 +16,8 @@ buildGoModule rec {
   };
   modSha256 = "1gc0xvsihr4zp7hkrdfrplvzkaphz1y4q53rgwn2jhd8s98l57an";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   preBuild = ''
     cat << EOF > caddy/main.go
     package main
diff --git a/pkgs/servers/caddy/v2.nix b/pkgs/servers/caddy/v2.nix
index c0b2134abded..7330388a7859 100644
--- a/pkgs/servers/caddy/v2.nix
+++ b/pkgs/servers/caddy/v2.nix
@@ -1,4 +1,4 @@
-{ stdenv, callPackage, buildGoModule, fetchFromGitHub }:
+{ stdenv, callPackage, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "caddy";
@@ -16,6 +16,8 @@ buildGoModule rec {
   };
   modSha256 = "1sb8w6n84cpya2rjm0zm798kzf5vjpkr5440j1gfnnnr07jl2aqn";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   meta = with stdenv.lib; {
     homepage = "https://caddyserver.com";
     description = "Fast, cross-platform HTTP/2 web server with automatic HTTPS";
diff --git a/pkgs/servers/dns/coredns/default.nix b/pkgs/servers/dns/coredns/default.nix
index 017842f39dc1..8388968298ef 100644
--- a/pkgs/servers/dns/coredns/default.nix
+++ b/pkgs/servers/dns/coredns/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "coredns";
@@ -15,6 +15,8 @@ buildGoModule rec {
 
   modSha256 = "0wlffk6wkcyn2lphw2vmdsmzag0wxljcxrvm7sv3i124x2x3yvy4";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   meta = with stdenv.lib; {
     homepage = "https://coredns.io";
     description = "A DNS server that runs middleware";
diff --git a/pkgs/servers/documize-community/default.nix b/pkgs/servers/documize-community/default.nix
index 7780d900badf..a6477d61e984 100644
--- a/pkgs/servers/documize-community/default.nix
+++ b/pkgs/servers/documize-community/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub, go-bindata, go-bindata-assetfs }:
+{ stdenv, buildGoModule, fetchFromGitHub, go-bindata, go-bindata-assetfs, Security }:
 
 buildGoModule rec {
   pname = "documize-community";
@@ -15,6 +15,8 @@ buildGoModule rec {
 
   nativeBuildInputs = [ go-bindata go-bindata-assetfs ];
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   subPackages = [ "edition/community.go" ];
 
   postInstall = ''
@@ -23,7 +25,7 @@ buildGoModule rec {
     mv $out/bin/community $out/bin/documize
   '';
 
-  meta = with lib; {
+  meta = with stdenv.lib; {
     description = "Open source Confluence alternative for internal & external docs built with Golang + EmberJS";
     license = licenses.agpl3;
     maintainers = with maintainers; [ ma27 elseym ];
diff --git a/pkgs/servers/echoip/default.nix b/pkgs/servers/echoip/default.nix
index b3402933f9fe..ae6057c34697 100644
--- a/pkgs/servers/echoip/default.nix
+++ b/pkgs/servers/echoip/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule {
   pname = "echoip";
@@ -13,6 +13,8 @@ buildGoModule {
 
   modSha256 = "025p891klwpid5fw4z39fimgfkwgkcwqpn5276hflzdp1hfv35ly";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   outputs = [ "out" "index" ];
 
   postInstall = ''
@@ -20,7 +22,7 @@ buildGoModule {
     cp $src/index.html $index/index.html
   '';
 
-  meta = with lib; {
+  meta = with stdenv.lib; {
     homepage = https://github.com/mpolden/echoip;
     license = licenses.bsd3;
     maintainers = with maintainers; [ rvolosatovs ];
diff --git a/pkgs/servers/gobetween/default.nix b/pkgs/servers/gobetween/default.nix
index ff59ad53ed1c..e66d5581b3c8 100644
--- a/pkgs/servers/gobetween/default.nix
+++ b/pkgs/servers/gobetween/default.nix
@@ -1,4 +1,4 @@
-{ buildGoModule, fetchFromGitHub, lib, enableStatic ? false }:
+{ buildGoModule, fetchFromGitHub, stdenv, Security, enableStatic ? false }:
 
 buildGoModule rec {
   pname = "gobetween";
@@ -14,8 +14,10 @@ buildGoModule rec {
   modSha256 =
     "dd91838d20c99c73447590e43edd13c87755276f17ef3e53f24c5df3d0908f78";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   buildPhase = ''
-    make build${lib.optionalString enableStatic "-static"}
+    make build${stdenv.lib.optionalString enableStatic "-static"}
   '';
 
   installPhase = ''
@@ -25,7 +27,7 @@ buildGoModule rec {
     cp -r config $out/share
   '';
 
-  meta = with lib; {
+  meta = with stdenv.lib; {
     description = "Modern & minimalistic load balancer for the Сloud era";
     homepage = "http://gobetween.io";
     license = licenses.mit;
diff --git a/pkgs/servers/gortr/default.nix b/pkgs/servers/gortr/default.nix
index 35c6e1452437..3e5dfc87f0ee 100644
--- a/pkgs/servers/gortr/default.nix
+++ b/pkgs/servers/gortr/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, buildGoModule }:
+{ stdenv, fetchFromGitHub, buildGoModule, Security }:
 
 buildGoModule rec {
   pname = "gortr";
@@ -12,7 +12,9 @@ buildGoModule rec {
   };
   modSha256 = "157dpalfz3z1s3mxq63xy6lrkwzyy9xzmvn7wsxkwznjq4djv1a1";
 
-  meta = with lib; {
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
+  meta = with stdenv.lib; {
     description = "The RPKI-to-Router server used at Cloudflare";
     homepage = "https://github.com/cloudflare/gortr/";
     license = licenses.gpl3;
diff --git a/pkgs/servers/gotify/default.nix b/pkgs/servers/gotify/default.nix
index f2014aac9fdc..275aaa5d68bc 100644
--- a/pkgs/servers/gotify/default.nix
+++ b/pkgs/servers/gotify/default.nix
@@ -1,11 +1,11 @@
 { stdenv
 , buildGoPackage
-, lib
 , fetchFromGitHub
 , buildGoModule
 , packr
 , sqlite
 , callPackage
+, Security
 }:
 
 buildGoModule rec {
@@ -28,7 +28,8 @@ buildGoModule rec {
       --replace 'Version = "unknown"' 'Version = "${version}"'
   '';
 
-  buildInputs = [ sqlite ];
+  buildInputs = [ sqlite ]
+    ++ stdenv.lib.optionals stdenv.isDarwin [ Security ];
 
   nativeBuildInputs = [ packr ];
 
diff --git a/pkgs/servers/imgproxy/default.nix b/pkgs/servers/imgproxy/default.nix
index 4cdfddcff6f4..c7d0d910ac1e 100644
--- a/pkgs/servers/imgproxy/default.nix
+++ b/pkgs/servers/imgproxy/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub, pkg-config, vips, gobject-introspection }:
+{ stdenv, buildGoModule, fetchFromGitHub, pkg-config, vips, gobject-introspection, Security }:
 
 buildGoModule rec {
   pname = "imgproxy";
@@ -15,13 +15,14 @@ buildGoModule rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs = [ gobject-introspection vips ];
+  buildInputs = [ gobject-introspection vips ]
+    ++ stdenv.lib.optionals stdenv.isDarwin [ Security ];
 
   preBuild = ''
     export CGO_LDFLAGS_ALLOW='-(s|w)'
   '';
 
-  meta = with lib; {
+  meta = with stdenv.lib; {
     description = "Fast and secure on-the-fly image processing server written in Go";
     homepage = "https://imgproxy.net";
     license = licenses.mit;
diff --git a/pkgs/servers/matterbridge/default.nix b/pkgs/servers/matterbridge/default.nix
index 556625016f25..2eec5d52bb9c 100644
--- a/pkgs/servers/matterbridge/default.nix
+++ b/pkgs/servers/matterbridge/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchurl }:
+{ stdenv, buildGoModule, fetchurl, Security }:
 
 buildGoModule rec {
   pname = "matterbridge";
@@ -12,6 +12,8 @@ buildGoModule rec {
     sha256 = "15wgjzy9l3xlgih2zb56l4jmval4nhcs42wn9axvz2h7kqfbmw3d";
   };
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   meta = with stdenv.lib; {
     description = "Simple bridge between Mattermost, IRC, XMPP, Gitter, Slack, Discord, Telegram, Rocket.Chat, Hipchat(via xmpp), Matrix and Steam";
     homepage = "https://github.com/42wim/matterbridge";
diff --git a/pkgs/servers/mautrix-whatsapp/default.nix b/pkgs/servers/mautrix-whatsapp/default.nix
index 578f125ee2b5..b94eb00547aa 100644
--- a/pkgs/servers/mautrix-whatsapp/default.nix
+++ b/pkgs/servers/mautrix-whatsapp/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule {
   pname = "mautrix-whatsapp-unstable";
@@ -13,6 +13,8 @@ buildGoModule {
 
   modSha256 = "0ypj79rjwj5bls6aq2cz0d034dnv1sddl43iz51b4fl2bfv0drm9";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   meta = with stdenv.lib; {
     homepage = https://github.com/tulir/mautrix-whatsapp;
     description = "Matrix <-> Whatsapp hybrid puppeting/relaybot bridge";
diff --git a/pkgs/servers/minio/default.nix b/pkgs/servers/minio/default.nix
index 858f8899501d..1fae973066aa 100644
--- a/pkgs/servers/minio/default.nix
+++ b/pkgs/servers/minio/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, CoreServices }:
 
 buildGoModule rec {
   pname = "minio";
@@ -13,6 +13,8 @@ buildGoModule rec {
 
   modSha256 = "0ikid628v673f7lvp3psk05s3liqlyc3arppg33lfi2cmbaf8hmr";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ CoreServices ];
+
   subPackages = [ "." ];
 
   buildFlagsArray = [''-ldflags=
diff --git a/pkgs/servers/monitoring/grafana/default.nix b/pkgs/servers/monitoring/grafana/default.nix
index b96f2c8ce4e1..ff283396e223 100644
--- a/pkgs/servers/monitoring/grafana/default.nix
+++ b/pkgs/servers/monitoring/grafana/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "grafana";
-  version = "6.7.0";
+  version = "6.7.1";
 
   goPackagePath = "github.com/grafana/grafana";
 
@@ -12,12 +12,12 @@ buildGoPackage rec {
     rev = "v${version}";
     owner = "grafana";
     repo = "grafana";
-    sha256 = "013586kaiyrs5b1mxf9vlcfh7va8md5amnh2jj26jph8ns6m0f87";
+    sha256 = "0isidfnny4rds9mq7gfm3qmsjsg9higiqliri5zy5bc68lz1gnbz";
   };
 
   srcStatic = fetchurl {
     url = "https://dl.grafana.com/oss/release/grafana-${version}.linux-amd64.tar.gz";
-    sha256 = "05g6lsl0vmc4q60dkm1404dl0k3wrlf6yy2l2cnaydl6aqz1kh8d";
+    sha256 = "0pa5g9pgifdi49vklcxnip2a156f5x64i9r2pshdg4gxfdqbxkxy";
   };
 
   postPatch = ''
@@ -39,7 +39,7 @@ buildGoPackage rec {
     description = "Gorgeous metric viz, dashboards & editors for Graphite, InfluxDB & OpenTSDB";
     license = licenses.asl20;
     homepage = "https://grafana.com";
-    maintainers = with maintainers; [ offline fpletz willibutz globin ma27 ];
+    maintainers = with maintainers; [ offline fpletz willibutz globin ma27 Frostman ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/servers/monitoring/mtail/default.nix b/pkgs/servers/monitoring/mtail/default.nix
index 64966e183fea..75b58b65a9cc 100644
--- a/pkgs/servers/monitoring/mtail/default.nix
+++ b/pkgs/servers/monitoring/mtail/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, buildGoModule }:
+{ stdenv, fetchFromGitHub, buildGoModule, Security }:
 
 buildGoModule rec {
   pname = "mtail";
@@ -14,6 +14,8 @@ buildGoModule rec {
   modSha256 = "0h3q1qd9a01wlfkk0yv74a4bk5nilpsppq522cv7kl8ysnrjh5yi";
   subPackages = [ "cmd/mtail" ];
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   preBuild = ''
     go generate -x ./internal/vm/
   '';
@@ -22,7 +24,7 @@ buildGoModule rec {
     "-ldflags=-X main.Version=${version}"
   ];
 
-  meta = with lib; {
+  meta = with stdenv.lib; {
     license = licenses.asl20;
     homepage = "https://github.com/google/mtail";
     description = "Tool for extracting metrics from application logs";
diff --git a/pkgs/servers/monitoring/prometheus/dnsmasq-exporter.nix b/pkgs/servers/monitoring/prometheus/dnsmasq-exporter.nix
index c8013e6bc15c..773fddd311bb 100644
--- a/pkgs/servers/monitoring/prometheus/dnsmasq-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/dnsmasq-exporter.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "dnsmasq_exporter";
@@ -13,6 +13,8 @@ buildGoModule rec {
 
   modSha256 = "1ag1k0z35zkazaxj8hh2wxfj73xg63xdybfm1565il2vxs5986dh";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   meta = with stdenv.lib; {
     inherit (src.meta) homepage;
     description = "A dnsmasq exporter for Prometheus";
diff --git a/pkgs/servers/monitoring/prometheus/mikrotik-exporter.nix b/pkgs/servers/monitoring/prometheus/mikrotik-exporter.nix
index 12341eee911e..96526d246a6d 100644
--- a/pkgs/servers/monitoring/prometheus/mikrotik-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/mikrotik-exporter.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "mikrotik-exporter-unstable";
@@ -13,6 +13,8 @@ buildGoModule rec {
 
   modSha256 = "1cqjn6j3dfq51ssjx0qrajprlac1h0lb1r4af44lfpigzmrfyi07";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   meta = with stdenv.lib; {
     inherit (src.meta) homepage;
     description = "Prometheus MikroTik device(s) exporter";
diff --git a/pkgs/servers/monitoring/prometheus/varnish-exporter.nix b/pkgs/servers/monitoring/prometheus/varnish-exporter.nix
index d77675671950..a0e3c6b1783c 100644
--- a/pkgs/servers/monitoring/prometheus/varnish-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/varnish-exporter.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub, makeWrapper, varnish }:
+{ stdenv, buildGoModule, fetchFromGitHub, makeWrapper, varnish, Security }:
 
 buildGoModule rec {
   pname = "prometheus_varnish_exporter";
@@ -15,6 +15,8 @@ buildGoModule rec {
 
   nativeBuildInputs = [ makeWrapper ];
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   postInstall = ''
     wrapProgram $out/bin/prometheus_varnish_exporter \
       --prefix PATH : "${varnish}/bin"
@@ -22,10 +24,10 @@ buildGoModule rec {
 
   doCheck = true;
 
-  meta = {
+  meta = with stdenv.lib; {
     homepage = "https://github.com/jonnenauha/prometheus_varnish_exporter";
     description = "Varnish exporter for Prometheus";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ MostAwesomeDude willibutz ];
+    license = licenses.mit;
+    maintainers = with maintainers; [ MostAwesomeDude willibutz ];
   };
 }
diff --git a/pkgs/servers/monitoring/sensu-go/default.nix b/pkgs/servers/monitoring/sensu-go/default.nix
index f109b08d1a6f..adba0277bf77 100644
--- a/pkgs/servers/monitoring/sensu-go/default.nix
+++ b/pkgs/servers/monitoring/sensu-go/default.nix
@@ -1,4 +1,4 @@
-{ buildGoModule, fetchFromGitHub, lib }:
+{ buildGoModule, fetchFromGitHub, stdenv, Security }:
 
 let
   generic = { subPackages, pname, postInstall ? "" }:
@@ -20,6 +20,8 @@ let
 
       modSha256 = "02h4cav6ivzs3z0qakwxzf5lfy6hzax5c0i2icp0qymqc2789npw";
 
+      buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
       buildFlagsArray = let
         versionPkg = "github.com/sensu/sensu-go/version";
       in ''
@@ -28,11 +30,11 @@ let
           -X ${versionPkg}.BuildSHA=${shortRev}
       '';
 
-      meta = {
+      meta = with stdenv.lib; {
         homepage = "https://sensu.io";
         description = "Open source monitoring tool for ephemeral infrastructure & distributed applications";
-        license = lib.licenses.mit;
-        maintainers = with lib.maintainers; [ thefloweringash ];
+        license = licenses.mit;
+        maintainers = with maintainers; [ thefloweringash ];
       };
     };
 in
diff --git a/pkgs/servers/monitoring/thanos/default.nix b/pkgs/servers/monitoring/thanos/default.nix
index f307032f4141..a246249d7d71 100644
--- a/pkgs/servers/monitoring/thanos/default.nix
+++ b/pkgs/servers/monitoring/thanos/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 buildGoModule rec {
   pname = "thanos";
   version = "0.11.0";
@@ -12,6 +12,8 @@ buildGoModule rec {
 
   modSha256 = "1pdypyyy352l6wy5lr94fv8j890lh863h8zg2hxchiymrs5pgq1c";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   subPackages = "cmd/thanos";
 
   buildFlagsArray = let t = "github.com/prometheus/common/version"; in ''
diff --git a/pkgs/servers/nosql/victoriametrics/default.nix b/pkgs/servers/nosql/victoriametrics/default.nix
index 2d357712096a..f85c4aebd512 100644
--- a/pkgs/servers/nosql/victoriametrics/default.nix
+++ b/pkgs/servers/nosql/victoriametrics/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "VictoriaMetrics";
@@ -12,7 +12,10 @@ buildGoModule rec {
   };
 
   modSha256 = "0qzh3jmj7ps6xmnnmfr8bnq97kdkn58p6dxppmlypanar3zsn7vk";
-  meta = with lib; {
+
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
+  meta = with stdenv.lib; {
     homepage = "https://victoriametrics.com/";
     description = "fast, cost-effective and scalable time series database, long-term remote storage for Prometheus";
     license = licenses.asl20;
diff --git a/pkgs/servers/sql/dolt/default.nix b/pkgs/servers/sql/dolt/default.nix
index dbface601f54..27ab7d444bf1 100644
--- a/pkgs/servers/sql/dolt/default.nix
+++ b/pkgs/servers/sql/dolt/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, lib, buildGoModule }:
+{ stdenv, fetchFromGitHub, buildGoModule, Security }:
 
 buildGoModule rec {
     pname = "dolt";
@@ -15,7 +15,9 @@ buildGoModule rec {
     subPackages = [ "cmd/dolt" "cmd/git-dolt" "cmd/git-dolt-smudge" ];
     modSha256 = "04bsj8mfamnbq3y2aqbx1605azi8v15nbdh1zk5grni0ihlal75a";
 
-    meta = with lib; {
+    buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
+    meta = with stdenv.lib; {
         description = "Relational database with version control and CLI a-la Git.";
         homepage = "https://github.com/liquidata-inc/dolt";
         license = licenses.asl20;
diff --git a/pkgs/servers/web-apps/shiori/default.nix b/pkgs/servers/web-apps/shiori/default.nix
index dd4cdc08287b..bd17f2f267c6 100644
--- a/pkgs/servers/web-apps/shiori/default.nix
+++ b/pkgs/servers/web-apps/shiori/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "shiori";
@@ -13,6 +13,8 @@ buildGoModule rec {
     sha256 = "13and7gh2882khqppwz3wwq44p7az4bfdfjvlnqcpqyi8xa28pmq";
   };
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   meta = with stdenv.lib; {
     description = "Simple bookmark manager built with Go";
     homepage = "https://github.com/go-shiori/shiori";
diff --git a/pkgs/shells/elvish/default.nix b/pkgs/shells/elvish/default.nix
index ad2e845f9bc8..228692efe852 100644
--- a/pkgs/shells/elvish/default.nix
+++ b/pkgs/shells/elvish/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "elvish";
@@ -20,6 +20,8 @@ buildGoModule rec {
 
   modSha256 = "13x4wbfj8049ygm3zbgzyr2bm4sq4x6xddrxx6shr8fydlcf1g8v";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   meta = with stdenv.lib; {
     description = "A friendly and expressive command shell";
     longDescription = ''
diff --git a/pkgs/shells/zsh/zsh-history/default.nix b/pkgs/shells/zsh/zsh-history/default.nix
index ece3c87cb664..382b76916d31 100644
--- a/pkgs/shells/zsh/zsh-history/default.nix
+++ b/pkgs/shells/zsh/zsh-history/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, buildGoModule, installShellFiles, nixosTests }:
+{ stdenv, fetchFromGitHub, buildGoModule, installShellFiles, nixosTests, Security }:
 
 buildGoModule rec {
   pname = "zsh-history";
@@ -13,6 +13,8 @@ buildGoModule rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   modSha256 = "0f10b86gyn7m7lw43c8y1m30mdg0i092a319v3cb2qj05jb9vn42";
   goPackagePath = "github.com/b4b4r07/history";
 
@@ -22,7 +24,7 @@ buildGoModule rec {
     installShellCompletion --zsh --name _history $out/share/zsh/completions/_history
   '';
 
-  meta = with lib; {
+  meta = with stdenv.lib; {
     description = "A CLI to provide enhanced history for your ZSH shell";
     license = licenses.mit;
     homepage = https://github.com/b4b4r07/history;
diff --git a/pkgs/tools/admin/ansible/default.nix b/pkgs/tools/admin/ansible/default.nix
index 7dde0e4764c6..4af031118693 100644
--- a/pkgs/tools/admin/ansible/default.nix
+++ b/pkgs/tools/admin/ansible/default.nix
@@ -5,7 +5,7 @@ rec {
 
   ansible_2_9 = python3Packages.toPythonApplication python3Packages.ansible;
 
-  ansible_2_8 = with python3Packages; toPythonApplication (python3Packages.ansible.overrideAttrs(old: rec {
+  ansible_2_8 = python3Packages.toPythonApplication (python3Packages.ansible.overridePythonAttrs (old: rec {
     pname = "ansible";
     version = "2.8.7";
 
@@ -15,7 +15,7 @@ rec {
     };
   }));
 
-  ansible_2_7 = with python3Packages; toPythonApplication (ansible.overrideAttrs(old: rec {
+  ansible_2_7 = python3Packages.toPythonApplication (python3Packages.ansible.overridePythonAttrs (old: rec {
     pname = "ansible";
     version = "2.7.15";
 
@@ -25,7 +25,7 @@ rec {
     };
   }));
 
-  ansible_2_6 = with python3Packages; toPythonApplication (ansible.overrideAttrs(old: rec {
+  ansible_2_6 = python3Packages.toPythonApplication (python3Packages.ansible.overridePythonAttrs (old: rec {
     pname = "ansible";
     version = "2.6.20";
 
diff --git a/pkgs/tools/admin/aws-vault/default.nix b/pkgs/tools/admin/aws-vault/default.nix
index 48a1de61cd80..3e145f732362 100644
--- a/pkgs/tools/admin/aws-vault/default.nix
+++ b/pkgs/tools/admin/aws-vault/default.nix
@@ -1,4 +1,4 @@
-{ buildGoModule, lib, fetchFromGitHub }:
+{ buildGoModule, stdenv, fetchFromGitHub, Security }:
 buildGoModule rec {
   pname = "aws-vault";
   version = "5.3.2";
@@ -13,13 +13,15 @@ buildGoModule rec {
   modSha256 = "1d3hjfmfmlpw2scfyn597zkzz864w97p0wrsxjp49m9mi0pgmhq9";
   subPackages = [ "." ];
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   # set the version. see: aws-vault's Makefile
   buildFlagsArray = ''
     -ldflags=
     -X main.Version=v${version}
   '';
 
-  meta = with lib; {
+  meta = with stdenv.lib; {
     description =
       "A vault for securely storing and accessing AWS credentials in development environments";
     homepage = "https://github.com/99designs/aws-vault";
diff --git a/pkgs/tools/admin/awsweeper/default.nix b/pkgs/tools/admin/awsweeper/default.nix
index 661747c2fd0d..1ea54953701d 100644
--- a/pkgs/tools/admin/awsweeper/default.nix
+++ b/pkgs/tools/admin/awsweeper/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "awsweeper";
@@ -13,7 +13,9 @@ buildGoModule rec {
 
   modSha256 = "14yvf0svh7xqpc2y7xr94pc6r7d3iv2nsr8qs3f5q29hdc5hv3fs";
 
-  meta = with lib; {
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
+  meta = with stdenv.lib; {
     description = "A tool to clean out your AWS account";
     homepage = "https://github.com/cloudetc/awsweeper/";
     license = licenses.mpl20;
diff --git a/pkgs/tools/admin/berglas/default.nix b/pkgs/tools/admin/berglas/default.nix
index c1c46da41b75..d088184f7a17 100644
--- a/pkgs/tools/admin/berglas/default.nix
+++ b/pkgs/tools/admin/berglas/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "berglas";
@@ -13,6 +13,8 @@ buildGoModule rec {
 
   modSha256 = "0m2bqx102lf6nihdjbl8a08xcwi80rawvh91j1cav0njm9w5vmmm";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   meta = with stdenv.lib; {
     description = "A tool for managing secrets on Google Cloud";
     homepage = "https://github.com/GoogleCloudPlatform/berglas";
diff --git a/pkgs/tools/admin/certigo/default.nix b/pkgs/tools/admin/certigo/default.nix
index 5474cb254298..89c6b8996fa3 100644
--- a/pkgs/tools/admin/certigo/default.nix
+++ b/pkgs/tools/admin/certigo/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "certigo";
@@ -13,6 +13,8 @@ buildGoModule rec {
 
   modSha256 = "1i5n5yh6nvv2i2nm60vqy1gngj8p5w6ma5fcwmp7bl4jxjrzbi83";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   meta = with stdenv.lib; {
     description = "A utility to examine and validate certificates in a variety of formats";
     homepage = "https://github.com/square/certigo";
diff --git a/pkgs/tools/admin/clair/default.nix b/pkgs/tools/admin/clair/default.nix
index 3f4d00736ad9..a12b8abe1206 100644
--- a/pkgs/tools/admin/clair/default.nix
+++ b/pkgs/tools/admin/clair/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub, makeWrapper, rpm, xz }:
+{ stdenv, buildGoModule, fetchFromGitHub, makeWrapper, rpm, xz, Security }:
 
 buildGoModule rec {
   pname = "clair";
@@ -13,14 +13,16 @@ buildGoModule rec {
 
   modSha256 = "0rgkrid58kji39nlmiii95r8shbzr6dwalj5m7qwxy5w1rcaljr5";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   nativeBuildInputs = [ makeWrapper ];
 
   postInstall = ''
     wrapProgram $out/bin/clair \
-      --prefix PATH : "${lib.makeBinPath [ rpm xz ]}"
+      --prefix PATH : "${stdenv.lib.makeBinPath [ rpm xz ]}"
   '';
 
-  meta = with lib; {
+  meta = with stdenv.lib; {
     description = "Vulnerability Static Analysis for Containers";
     homepage = "https://github.com/quay/clair";
     license = licenses.asl20;
diff --git a/pkgs/tools/admin/eksctl/default.nix b/pkgs/tools/admin/eksctl/default.nix
index 4c01383f8986..c700e4f397c7 100644
--- a/pkgs/tools/admin/eksctl/default.nix
+++ b/pkgs/tools/admin/eksctl/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "eksctl";
@@ -13,6 +13,8 @@ buildGoModule rec {
 
   modSha256 = "0f8dlcp3q84fa5dnnzx4347ngb1raw1mxkcqpz2s3zq6d1kv0nvf";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   subPackages = [ "cmd/eksctl" ];
 
   buildFlags = [ "-tags netgo" "-tags release" ];
@@ -25,7 +27,7 @@ buildGoModule rec {
     $out/bin/eksctl completion zsh > "$out/share/zsh/site-functions/_eksctl"
   '';
 
-  meta = with lib; {
+  meta = with stdenv.lib; {
     description = "A CLI for Amazon EKS";
     homepage = "https://github.com/weaveworks/eksctl";
     license = licenses.asl20;
diff --git a/pkgs/tools/admin/iamy/default.nix b/pkgs/tools/admin/iamy/default.nix
index e09cd2f52853..6a1ec948d907 100644
--- a/pkgs/tools/admin/iamy/default.nix
+++ b/pkgs/tools/admin/iamy/default.nix
@@ -1,11 +1,9 @@
-{ stdenv, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "iamy";
   version = "2.3.2";
 
-  goPackagePath = "github.com/99designs/iamy";
-
   src = fetchFromGitHub {
     owner = "99designs";
     repo = "iamy";
@@ -15,6 +13,8 @@ buildGoModule rec {
 
   modSha256 = "0akak573zvz3xg5d7vf0ch2mrmj1jkzcdc29v3kn43f7944c2wcl";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   buildFlagsArray = [''-ldflags=
     -X main.Version=v${version} -s -w
   ''];
diff --git a/pkgs/tools/admin/lego/default.nix b/pkgs/tools/admin/lego/default.nix
index 72c61ceecaf2..0cb614c12d1f 100644
--- a/pkgs/tools/admin/lego/default.nix
+++ b/pkgs/tools/admin/lego/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, buildGoModule }:
+{ stdenv, fetchFromGitHub, buildGoModule, Security }:
 
 buildGoModule rec {
   pname = "lego";
@@ -14,11 +14,13 @@ buildGoModule rec {
   modSha256 = "10n8pcbmzlnk63gzsjb1xnmjwxfhxsqx8ffpcbwdzq9fc5yvjiii";
   subPackages = [ "cmd/lego" ];
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   buildFlagsArray = [
     "-ldflags=-X main.version=${version}"
   ];
 
-  meta = with lib; {
+  meta = with stdenv.lib; {
     description = "Let's Encrypt client and ACME library written in Go";
     license = licenses.mit;
     homepage = "https://go-acme.github.io/lego/";
diff --git a/pkgs/tools/backup/restic/default.nix b/pkgs/tools/backup/restic/default.nix
index 1eb02e9a4834..345d14fd10b9 100644
--- a/pkgs/tools/backup/restic/default.nix
+++ b/pkgs/tools/backup/restic/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoPackage, fetchFromGitHub, nixosTests }:
+{ stdenv, lib, buildGoPackage, fetchFromGitHub, nixosTests}:
 
 buildGoPackage rec {
   pname = "restic";
@@ -13,20 +13,19 @@ buildGoPackage rec {
     sha256 = "0lydll93n1lcn1fl669b9cikmzz9d6vfpc8ky3ng5fi8kj3v1dz7";
   };
 
-  buildPhase = ''
-    cd go/src/${goPackagePath}
-    go run build.go
-  '';
-
   passthru.tests.restic = nixosTests.restic;
 
+  # Use a custom install phase here as by default the
+  # build-release-binaries and prepare-releases binaries are
+  # installed.
   installPhase = ''
+    mkdir -p "$bin/bin"
+    cp go/bin/restic "$bin/bin"
+  '' + lib.optionalString (stdenv.hostPlatform == stdenv.buildPlatform) ''
     mkdir -p \
-      $bin/bin \
       $bin/etc/bash_completion.d \
       $bin/share/zsh/vendor-completions \
       $bin/share/man/man1
-    cp restic $bin/bin/
     $bin/bin/restic generate \
       --bash-completion $bin/etc/bash_completion.d/restic.sh \
       --zsh-completion $bin/share/zsh/vendor-completions/_restic \
diff --git a/pkgs/tools/misc/chezmoi/default.nix b/pkgs/tools/misc/chezmoi/default.nix
index b2fb6925abac..979a658ac022 100644
--- a/pkgs/tools/misc/chezmoi/default.nix
+++ b/pkgs/tools/misc/chezmoi/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub, installShellFiles }:
+{ stdenv, buildGoModule, fetchFromGitHub, installShellFiles, Security }:
 
 buildGoModule rec {
   pname = "chezmoi";
@@ -13,6 +13,8 @@ buildGoModule rec {
 
   modSha256 = "0gh314d3mspqmz2z3m05bgsp62mrhb48m4mwhfy5h62fs7aqymr8";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   buildFlagsArray = [
     "-ldflags=-s -w -X github.com/twpayne/chezmoi/cmd.VersionStr=${version}"
   ];
diff --git a/pkgs/tools/misc/docui/default.nix b/pkgs/tools/misc/docui/default.nix
index 0329c1bc4a69..c8f3dbf8009c 100644
--- a/pkgs/tools/misc/docui/default.nix
+++ b/pkgs/tools/misc/docui/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "docui";
@@ -13,6 +13,8 @@ buildGoModule rec {
 
   modSha256 = "1wyx05kk4f41mgvwnvfc9xk7vd3x96cbn5xb5ph7p443f70ydnak";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   meta = with stdenv.lib; {
     description = "TUI Client for Docker";
     homepage = "https://github.com/skanehira/docui";
diff --git a/pkgs/tools/misc/gotify-cli/default.nix b/pkgs/tools/misc/gotify-cli/default.nix
index a4b9af09712e..56462aa3d303 100644
--- a/pkgs/tools/misc/gotify-cli/default.nix
+++ b/pkgs/tools/misc/gotify-cli/default.nix
@@ -1,4 +1,4 @@
-{ buildGoModule, fetchFromGitHub, lib }:
+{ buildGoModule, fetchFromGitHub, stdenv, Security }:
 
 buildGoModule rec {
   pname = "gotify-cli";
@@ -17,7 +17,9 @@ buildGoModule rec {
     mv $out/bin/cli $out/bin/gotify
   '';
 
-  meta = with lib; {
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
+  meta = with stdenv.lib; {
     license = licenses.mit;
     homepage = https://github.com/gotify/cli;
     description = "A command line interface for pushing messages to gotify/server.";
diff --git a/pkgs/tools/misc/kepubify/default.nix b/pkgs/tools/misc/kepubify/default.nix
index 207492a89449..a7b7da451fb7 100644
--- a/pkgs/tools/misc/kepubify/default.nix
+++ b/pkgs/tools/misc/kepubify/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, buildGoModule }:
+{ stdenv, fetchFromGitHub, buildGoModule, Security }:
 
 buildGoModule rec {
   pname = "kepubify";
@@ -15,9 +15,11 @@ buildGoModule rec {
 
   buildFlagsArray = [ "-ldflags=-s -w -X main.version=${version}" ];
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   subPackages = [ "." "covergen" "seriesmeta" ];
 
-  meta = with lib; {
+  meta = with stdenv.lib; {
     description = "EPUB to KEPUB converter";
     homepage = "https://pgaskin.net/kepubify";
     license = licenses.mit;
diff --git a/pkgs/tools/misc/mutagen/default.nix b/pkgs/tools/misc/mutagen/default.nix
index 8940fef2a0dd..c029f38acb2c 100644
--- a/pkgs/tools/misc/mutagen/default.nix
+++ b/pkgs/tools/misc/mutagen/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, CoreServices }:
 
 buildGoModule rec {
   pname = "mutagen";
@@ -13,9 +13,11 @@ buildGoModule rec {
 
   modSha256 = "1r6b4y6civk75if6nljl66pgv5qm7x05qqby1anf7s7cz7d1rc3g";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ CoreServices ];
+
   subPackages = [ "cmd/mutagen" "cmd/mutagen-agent" ];
 
-  meta = with lib; {
+  meta = with stdenv.lib; {
     description = "Make remote development work with your local tools";
     homepage = "https://mutagen.io/";
     changelog = "https://github.com/mutagen-io/mutagen/releases/tag/v${version}";
diff --git a/pkgs/tools/misc/pgcenter/default.nix b/pkgs/tools/misc/pgcenter/default.nix
index 7cb810b2fe2d..9eed1aaffd8e 100644
--- a/pkgs/tools/misc/pgcenter/default.nix
+++ b/pkgs/tools/misc/pgcenter/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "pgcenter";
@@ -13,6 +13,8 @@ buildGoModule rec {
 
   modSha256 = "0kassq52v07zmffs6l066g0d3kfv6wmrh9g5cgk79bmyq13clqjj";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   meta = with stdenv.lib; {
     homepage = https://pgcenter.org/;
     description = "Command-line admin tool for observing and troubleshooting PostgreSQL";
diff --git a/pkgs/tools/misc/pgmetrics/default.nix b/pkgs/tools/misc/pgmetrics/default.nix
index b702ffc1703d..04e106ca5522 100644
--- a/pkgs/tools/misc/pgmetrics/default.nix
+++ b/pkgs/tools/misc/pgmetrics/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "pgmetrics";
@@ -13,6 +13,8 @@ buildGoModule rec {
 
   modSha256 = "0h375zk0ik06g0b5vmi00b1wn5q2c0r137f7qf6l8k8p886x41h6";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   buildFlagsArray = [ "-ldflags=-s -w -X main.version=${version}" ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/misc/wootility/default.nix b/pkgs/tools/misc/wootility/default.nix
new file mode 100644
index 000000000000..e88322f7f756
--- /dev/null
+++ b/pkgs/tools/misc/wootility/default.nix
@@ -0,0 +1,32 @@
+{ appimageTools, fetchurl, lib, gsettings-desktop-schemas, gtk3, udev, wooting-udev-rules }:
+
+let
+  pname = "wootility";
+  version = "3.3.3";
+in
+appimageTools.wrapType2 rec {
+  name = "${pname}-${version}";
+
+  src = fetchurl {
+    url = "https://s3.eu-west-2.amazonaws.com/wooting-update/wootility-linux-latest/wootility-${version}.AppImage";
+    sha256 = "1qdiacwnvqahqkrhwnblz0jjywn63c6ndl3z450myhx5x55fdcja";
+  };
+
+  profile = ''
+    export LC_ALL=C.UTF-8
+    export XDG_DATA_DIRS="${gsettings-desktop-schemas}/share/gsettings-schemas/${gsettings-desktop-schemas.name}:${gtk3}/share/gsettings-schemas/${gtk3.name}:$XDG_DATA_DIRS"
+  '';
+
+  multiPkgs = extraPkgs;
+  extraPkgs =
+    pkgs: (appimageTools.defaultFhsEnvArgs.multiPkgs pkgs) ++ ([ udev wooting-udev-rules ]);
+  extraInstallCommands = "mv $out/bin/{${name},${pname}}";
+
+  meta = with lib; {
+    homepage = https://wooting.io/wootility;
+    description = "Wootility is customization and management software for Wooting keyboards.";
+    platforms = [ "x86_64-linux" ];
+    license = "unknown";
+    maintainers = with maintainers; [ davidtwco ];
+  };
+}
diff --git a/pkgs/tools/networking/cassowary/default.nix b/pkgs/tools/networking/cassowary/default.nix
index 6156f43b04b8..5b9ba71f8c9b 100644
--- a/pkgs/tools/networking/cassowary/default.nix
+++ b/pkgs/tools/networking/cassowary/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "cassowary";
@@ -13,9 +13,11 @@ buildGoModule rec {
 
   modSha256 = "1iylnnmj5slji89pkb3shp4xqar1zbpl7bzwddbzpp8y52fmsv1c";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   buildFlagsArray = [ "-ldflags=-s -w -X main.version=${version}" ];
 
-  meta = with lib; {
+  meta = with stdenv.lib; {
     homepage = "https://github.com/rogerwelin/cassowary";
     description = "Modern cross-platform HTTP load-testing tool written in Go";
     license = licenses.mit;
diff --git a/pkgs/tools/networking/clash/default.nix b/pkgs/tools/networking/clash/default.nix
index 234fd0b31afa..8e7499caa479 100644
--- a/pkgs/tools/networking/clash/default.nix
+++ b/pkgs/tools/networking/clash/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, buildGoModule }:
+{ stdenv, fetchFromGitHub, buildGoModule, Security }:
 
 buildGoModule rec {
   pname = "clash";
@@ -14,6 +14,8 @@ buildGoModule rec {
   goPackagePath = "github.com/Dreamacro/clash";
   modSha256 = "02bki2iq99lc9iq1mjf9rbxwspalrj7hjlk1h384w3d4s4x4fyxy";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   buildFlagsArray = [
     "-ldflags="
     "-X ${goPackagePath}/constant.Version=${version}"
diff --git a/pkgs/tools/networking/corerad/default.nix b/pkgs/tools/networking/corerad/default.nix
index 96798c1c17e9..0cfaddcf06ae 100644
--- a/pkgs/tools/networking/corerad/default.nix
+++ b/pkgs/tools/networking/corerad/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "corerad";
@@ -13,6 +13,8 @@ buildGoModule rec {
 
   modSha256 = "0vbbpndqwwz1mc59j7liaayxaj53cs8s3javgj3pvhkn4vp65p7c";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   buildFlagsArray = ''
     -ldflags=
     -X github.com/mdlayher/corerad/internal/build.linkTimestamp=1583280117
diff --git a/pkgs/tools/networking/croc/default.nix b/pkgs/tools/networking/croc/default.nix
index 52f9ef9fade8..70ffe180f157 100644
--- a/pkgs/tools/networking/croc/default.nix
+++ b/pkgs/tools/networking/croc/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "croc";
@@ -14,6 +14,9 @@ buildGoModule rec {
   };
 
   modSha256 = "0d4mm840fjsbcyl98zg6d3i7qp1lmjkx07mh91d56jyf9j082g99";
+
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   subPackages = [ "." ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/networking/dnsproxy/default.nix b/pkgs/tools/networking/dnsproxy/default.nix
index 8296600cf3d3..89173e7b4277 100644
--- a/pkgs/tools/networking/dnsproxy/default.nix
+++ b/pkgs/tools/networking/dnsproxy/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, buildGoModule }:
+{ stdenv, fetchFromGitHub, buildGoModule, Security }:
 
 buildGoModule rec {
   pname = "dnsproxy";
@@ -13,6 +13,8 @@ buildGoModule rec {
 
   modSha256 = "0r5ybr4gpcdsldk12b0d4xiih6ckwnqkfwy89c97prv24v14zysv";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   meta = with stdenv.lib; {
     description = "Simple DNS proxy with DoH, DoT, and DNSCrypt support";
     homepage = "https://github.com/AdguardTeam/dnsproxy";
diff --git a/pkgs/tools/networking/frp/default.nix b/pkgs/tools/networking/frp/default.nix
index f44e2208646c..7323c914bfa1 100644
--- a/pkgs/tools/networking/frp/default.nix
+++ b/pkgs/tools/networking/frp/default.nix
@@ -1,4 +1,4 @@
-{ buildGoModule, lib, fetchFromGitHub }:
+{ buildGoModule, stdenv, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "frp";
@@ -13,9 +13,11 @@ buildGoModule rec {
 
   modSha256 = "1v90w5grc0vjpcp0m56d73zi0qnbswgz1rcvcwrjfa3rwqhigbal";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   subPackages = [ "cmd/frpc" "cmd/frps" ];
 
-  meta = with lib; {
+  meta = with stdenv.lib; {
     description = "Fast reverse proxy";
     longDescription = ''
       frp is a fast reverse proxy to help you expose a local server behind a
diff --git a/pkgs/tools/networking/grpcui/default.nix b/pkgs/tools/networking/grpcui/default.nix
index 58e698ed7081..de2b3f787986 100644
--- a/pkgs/tools/networking/grpcui/default.nix
+++ b/pkgs/tools/networking/grpcui/default.nix
@@ -1,4 +1,4 @@
-{ buildGoModule, fetchFromGitHub, lib }:
+{ buildGoModule, fetchFromGitHub, stdenv, Security }:
 
 buildGoModule rec {
   pname = "grpcui";
@@ -13,7 +13,9 @@ buildGoModule rec {
 
   modSha256 = "1yq8484cjxad72nqsrim3zppr8hmn7dc6f8rgkw8fg952lqy5jjb";
 
-  meta = with lib; {
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
+  meta = with stdenv.lib; {
     description = "An interactive web UI for gRPC, along the lines of postman";
     homepage = "https://github.com/fullstorydev/grpcui";
     license = licenses.mit;
diff --git a/pkgs/tools/networking/hey/default.nix b/pkgs/tools/networking/hey/default.nix
index d65d5c9e3235..69cfa4526029 100644
--- a/pkgs/tools/networking/hey/default.nix
+++ b/pkgs/tools/networking/hey/default.nix
@@ -1,4 +1,4 @@
-{ buildGoModule, lib, fetchFromGitHub }:
+{ buildGoModule, stdenv, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "hey";
@@ -13,7 +13,9 @@ buildGoModule rec {
 
   modSha256 = "0a00kcyagqczw0vhl8qs2xs1y8myw080y9kjs4qrcmj6kibdy55q";
 
-  meta = with lib; {
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
+  meta = with stdenv.lib; {
     description = "HTTP load generator, ApacheBench (ab) replacement";
     homepage = "https://github.com/rakyll/hey";
     license = licenses.asl20;
diff --git a/pkgs/tools/networking/minio-client/default.nix b/pkgs/tools/networking/minio-client/default.nix
index 885ffbe91579..b8cf93bc2d3f 100644
--- a/pkgs/tools/networking/minio-client/default.nix
+++ b/pkgs/tools/networking/minio-client/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, CoreServices }:
 
 buildGoModule rec {
   pname = "minio-client";
@@ -13,6 +13,8 @@ buildGoModule rec {
 
   modSha256 = "1qjfsqmcc6i0nixwvdmm3vnnv19yvqaaza096cpdf5rl35knsp5i";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ CoreServices ];
+
   subPackages = [ "." ];
 
   preBuild = ''
diff --git a/pkgs/tools/networking/nebula/default.nix b/pkgs/tools/networking/nebula/default.nix
index 3411aca55519..f78d7129c34a 100644
--- a/pkgs/tools/networking/nebula/default.nix
+++ b/pkgs/tools/networking/nebula/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "nebula";
@@ -13,11 +13,13 @@ buildGoModule rec {
 
   modSha256 = "1sy5mnwn9fxjf3y41lm8gsggid2c0y08iw88m9ng8psaf4qid8ij";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   subPackages = [ "cmd/nebula" "cmd/nebula-cert" ];
 
   buildFlagsArray = [ "-ldflags='-X main.Build=${version}'" ];
 
-  meta = with lib; {
+  meta = with stdenv.lib; {
     description = "A scalable overlay networking tool with a focus on performance, simplicity and security";
     longDescription = ''
       Nebula is a scalable overlay networking tool with a focus on performance,
diff --git a/pkgs/tools/networking/network-manager/applet/default.nix b/pkgs/tools/networking/network-manager/applet/default.nix
index 69b454ea72ee..109c4c8cce15 100644
--- a/pkgs/tools/networking/network-manager/applet/default.nix
+++ b/pkgs/tools/networking/network-manager/applet/default.nix
@@ -1,46 +1,74 @@
-{ stdenv, fetchurl, meson, ninja, intltool, gtk-doc, pkgconfig, networkmanager, gnome3
-, libnotify, libsecret, polkit, isocodes, modemmanager, libxml2, docbook_xsl, docbook_xml_dtd_43
-, mobile-broadband-provider-info, glib-networking, gsettings-desktop-schemas
-, libgudev, jansson, wrapGAppsHook, gobject-introspection, python3, gtk3
-, libappindicator-gtk3, withGnome ? true, gcr, glib }:
+{ stdenv
+, fetchurl
+, meson
+, ninja
+, gettext
+, pkg-config
+, networkmanager
+, gnome3
+, libnotify
+, libsecret
+, polkit
+, modemmanager
+, libnma
+, mobile-broadband-provider-info
+, glib-networking
+, gsettings-desktop-schemas
+, libgudev
+, jansson
+, wrapGAppsHook
+, gobject-introspection
+, python3
+, gtk3
+, libappindicator-gtk3
+, glib
+}:
 
-let
+stdenv.mkDerivation rec {
   pname = "network-manager-applet";
-  version = "1.8.24";
-in stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
+  version = "1.16.0";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "1gzvz4wfqfsfclqg56y954al8x6fmz71cnxlx1i4nqr7a25bp2qi";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
+    sha256 = "1rf3nm0hjcy9f8ajb4vmvwy503w8yj8d4daxkcb7w7i7b92qmyfn";
   };
 
   mesonFlags = [
-    "-Dlibnm_gtk=false" # It is deprecated
     "-Dselinux=false"
     "-Dappindicator=yes"
-    "-Dgcr=${if withGnome then "true" else "false"}"
   ];
 
-  outputs = [ "out" "lib" "dev" "devdoc" "man" ];
+  outputs = [ "out" "man" ];
 
   buildInputs = [
-    gtk3 networkmanager libnotify libsecret gsettings-desktop-schemas
-    polkit isocodes mobile-broadband-provider-info libgudev
-    modemmanager jansson glib-networking
-    libappindicator-gtk3 gnome3.adwaita-icon-theme
-  ] ++ stdenv.lib.optionals withGnome [ gcr ]; # advanced certificate chooser
-
-  nativeBuildInputs = [ meson ninja intltool pkgconfig wrapGAppsHook gobject-introspection python3 gtk-doc docbook_xsl docbook_xml_dtd_43 libxml2 ];
+    libnma
+    gtk3
+    networkmanager
+    libnotify
+    libsecret
+    gsettings-desktop-schemas
+    polkit
+    libgudev
+    modemmanager
+    jansson
+    glib-networking
+    libappindicator-gtk3
+    gnome3.adwaita-icon-theme
+  ];
 
-  # Needed for wingpanel-indicator-network and switchboard-plug-network
-  patches = [ ./hardcode-gsettings.patch ];
+  nativeBuildInputs = [
+    meson
+    ninja
+    gettext
+    pkg-config
+    wrapGAppsHook
+    gobject-introspection
+    python3
+  ];
 
   postPatch = ''
     chmod +x meson_post_install.py # patchShebangs requires executable file
     patchShebangs meson_post_install.py
-
-    substituteInPlace src/wireless-security/eap-method.c --subst-var-by NM_APPLET_GSETTINGS ${glib.makeSchemaPath "$lib" name}
   '';
 
   passthru = {
@@ -51,7 +79,7 @@ in stdenv.mkDerivation rec {
   };
 
   meta = with stdenv.lib; {
-    homepage = https://wiki.gnome.org/Projects/NetworkManager;
+    homepage = "https://gitlab.gnome.org/GNOME/network-manager-applet/";
     description = "NetworkManager control applet for GNOME";
     license = licenses.gpl2;
     maintainers = with maintainers; [ phreedom ];
diff --git a/pkgs/tools/networking/network-manager/fortisslvpn/default.nix b/pkgs/tools/networking/network-manager/fortisslvpn/default.nix
index 94a4c4b362ae..0ce50a3b2d4b 100644
--- a/pkgs/tools/networking/network-manager/fortisslvpn/default.nix
+++ b/pkgs/tools/networking/network-manager/fortisslvpn/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, substituteAll, openfortivpn, intltool, pkgconfig, file, gtk3,
-networkmanager, ppp, libsecret, withGnome ? true, gnome3, fetchpatch, networkmanagerapplet }:
+networkmanager, ppp, libsecret, withGnome ? true, gnome3, fetchpatch, libnma }:
 
 let
   pname = "NetworkManager-fortisslvpn";
@@ -25,7 +25,7 @@ in stdenv.mkDerivation {
   ];
 
   buildInputs = [ openfortivpn networkmanager ppp ]
-    ++ stdenv.lib.optionals withGnome [ gtk3 libsecret networkmanagerapplet ];
+    ++ stdenv.lib.optionals withGnome [ gtk3 libsecret libnma ];
 
   nativeBuildInputs = [ intltool pkgconfig file ];
 
diff --git a/pkgs/tools/networking/network-manager/iodine/default.nix b/pkgs/tools/networking/network-manager/iodine/default.nix
index 9042605caf17..47e5a2f41813 100644
--- a/pkgs/tools/networking/network-manager/iodine/default.nix
+++ b/pkgs/tools/networking/network-manager/iodine/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchFromGitLab, substituteAll, autoreconfHook, iodine, intltool, pkgconfig, networkmanager, libsecret, gtk3
-, withGnome ? true, gnome3, fetchpatch, networkmanagerapplet }:
+, withGnome ? true, gnome3, fetchpatch, libnma }:
 
 let
   pname = "NetworkManager-iodine";
@@ -28,7 +28,7 @@ in stdenv.mkDerivation {
   ];
 
   buildInputs = [ iodine networkmanager ]
-    ++ stdenv.lib.optionals withGnome [ gtk3 libsecret networkmanagerapplet ];
+    ++ stdenv.lib.optionals withGnome [ gtk3 libsecret libnma ];
 
   nativeBuildInputs = [ intltool autoreconfHook pkgconfig ];
 
diff --git a/pkgs/tools/networking/network-manager/l2tp/default.nix b/pkgs/tools/networking/network-manager/l2tp/default.nix
index e4ab74f08e35..09fb0c5977b5 100644
--- a/pkgs/tools/networking/network-manager/l2tp/default.nix
+++ b/pkgs/tools/networking/network-manager/l2tp/default.nix
@@ -1,7 +1,7 @@
 { stdenv, substituteAll, fetchFromGitHub, autoreconfHook, libtool, intltool, pkgconfig
 , file, findutils
 , gtk3, networkmanager, ppp, xl2tpd, strongswan, libsecret
-, withGnome ? true, networkmanagerapplet }:
+, withGnome ? true, libnma }:
 
 stdenv.mkDerivation rec {
   name = "${pname}${if withGnome then "-gnome" else ""}-${version}";
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [ networkmanager ppp ]
-    ++ stdenv.lib.optionals withGnome [ gtk3 libsecret networkmanagerapplet ];
+    ++ stdenv.lib.optionals withGnome [ gtk3 libsecret libnma ];
 
   nativeBuildInputs = [ autoreconfHook libtool intltool pkgconfig file findutils ];
 
diff --git a/pkgs/tools/networking/network-manager/libnma/default.nix b/pkgs/tools/networking/network-manager/libnma/default.nix
new file mode 100644
index 000000000000..727c18e92c10
--- /dev/null
+++ b/pkgs/tools/networking/network-manager/libnma/default.nix
@@ -0,0 +1,89 @@
+{ stdenv
+, fetchurl
+, meson
+, ninja
+, gettext
+, gtk-doc
+, pkg-config
+, vala
+, networkmanager
+, gnome3
+, isocodes
+, libxml2
+, docbook_xsl
+, docbook_xml_dtd_43
+, mobile-broadband-provider-info
+, gobject-introspection
+, gtk3
+, withGnome ? true
+, gcr
+, glib
+, substituteAll
+}:
+
+stdenv.mkDerivation rec {
+  pname = "libnma";
+  version = "1.8.28";
+
+  outputs = [ "out" "dev" "devdoc" ];
+
+  src = fetchurl {
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
+    sha256 = "09mp6k0hfam1vyyv9kcd8j4gb2r58i05ipx2nswb58ris599bxja";
+  };
+
+  patches = [
+    # Needed for wingpanel-indicator-network and switchboard-plug-network
+    ./hardcode-gsettings.patch
+  ];
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    gettext
+    pkg-config
+    gobject-introspection
+    gtk-doc
+    docbook_xsl
+    docbook_xml_dtd_43
+    libxml2
+    vala
+  ];
+
+  buildInputs = [
+    gtk3
+    networkmanager
+    isocodes
+    mobile-broadband-provider-info
+  ] ++ stdenv.lib.optionals withGnome [
+    # advanced certificate chooser
+    gcr
+  ];
+
+  mesonFlags = [
+    "-Dgcr=${if withGnome then "true" else "false"}"
+  ];
+
+  postPatch = ''
+    substituteInPlace src/nma-ws/nma-eap.c --subst-var-by \
+      NM_APPLET_GSETTINGS ${glib.makeSchemaPath "$out" "${pname}-${version}"}
+  '';
+
+  postInstall = ''
+    glib-compile-schemas $out/share/glib-2.0/schemas
+  '';
+
+  passthru = {
+    updateScript = gnome3.updateScript {
+      packageName = pname;
+    };
+  };
+
+  meta = with stdenv.lib; {
+    homepage = "https://gitlab.gnome.org/GNOME/libnma";
+    description = "NetworkManager UI utilities (libnm version)";
+    license = licenses.gpl2Plus; # Mix of GPL and LPGL 2+
+    maintainers = teams.gnome.members;
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/tools/networking/network-manager/applet/hardcode-gsettings.patch b/pkgs/tools/networking/network-manager/libnma/hardcode-gsettings.patch
index a480fd6d91e7..9b2f5366950c 100644
--- a/pkgs/tools/networking/network-manager/applet/hardcode-gsettings.patch
+++ b/pkgs/tools/networking/network-manager/libnma/hardcode-gsettings.patch
@@ -1,32 +1,26 @@
-diff --git a/src/wireless-security/eap-method.c b/src/wireless-security/eap-method.c
-index 2e9daa23..6663b3ce 100644
---- a/src/wireless-security/eap-method.c
-+++ b/src/wireless-security/eap-method.c
-@@ -265,8 +265,11 @@ eap_method_ca_cert_ignore_get (EAPMethod *method, NMConnection *connection)
+--- a/src/nma-ws/nma-eap.c
++++ b/src/nma-ws/nma-eap.c
+@@ -248,11 +248,16 @@ nma_eap_ca_cert_ignore_get (NMAEap *method, NMConnection *connection)
  static GSettings *
  _get_ca_ignore_settings (NMConnection *connection)
  {
-+	GSettingsSchemaSource *schema_source;
++	g_autoptr (GSettingsSchemaSource) *schema_source;
 +	g_autoptr (GSettingsSchema) *schema;
  	GSettings *settings;
--	char *path = NULL;
-+
-+	g_autofree char *path = NULL;
+ 	char *path = NULL;
  	const char *uuid;
- 
+
  	g_return_val_if_fail (connection, NULL);
-@@ -274,9 +277,12 @@ _get_ca_ignore_settings (NMConnection *connection)
- 	uuid = nm_connection_get_uuid (connection);
- 	g_return_val_if_fail (uuid && *uuid, NULL);
- 
+
 +	schema_source = g_settings_schema_source_new_from_directory ("@NM_APPLET_GSETTINGS@", g_settings_schema_source_get_default (), TRUE, NULL);
 +	schema = g_settings_schema_source_lookup (schema_source, "org.gnome.nm-applet.eap", FALSE);
-+	g_settings_schema_source_unref (schema_source);
 +
+ 	uuid = nm_connection_get_uuid (connection);
+ 	g_return_val_if_fail (uuid && *uuid, NULL);
+
  	path = g_strdup_printf ("/org/gnome/nm-applet/eap/%s/", uuid);
 -	settings = g_settings_new_with_path ("org.gnome.nm-applet.eap", path);
--	g_free (path);
 +	settings = g_settings_new_full (schema, NULL, path);
- 
+ 	g_free (path);
+
  	return settings;
- }
diff --git a/pkgs/tools/networking/network-manager/openvpn/default.nix b/pkgs/tools/networking/network-manager/openvpn/default.nix
index 2762b12a364a..13f7eab5cc78 100644
--- a/pkgs/tools/networking/network-manager/openvpn/default.nix
+++ b/pkgs/tools/networking/network-manager/openvpn/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, substituteAll, openvpn, intltool, libxml2, pkgconfig, file, networkmanager, libsecret
-, gtk3, withGnome ? true, gnome3, kmod, fetchpatch, networkmanagerapplet }:
+, gtk3, withGnome ? true, gnome3, kmod, fetchpatch, libnma }:
 
 let
   pname = "NetworkManager-openvpn";
@@ -25,7 +25,7 @@ in stdenv.mkDerivation {
   ];
 
   buildInputs = [ openvpn networkmanager ]
-    ++ stdenv.lib.optionals withGnome [ gtk3 libsecret networkmanagerapplet ];
+    ++ stdenv.lib.optionals withGnome [ gtk3 libsecret libnma ];
 
   nativeBuildInputs = [ intltool pkgconfig file libxml2 ];
 
diff --git a/pkgs/tools/networking/network-manager/strongswan/default.nix b/pkgs/tools/networking/network-manager/strongswan/default.nix
index 843985bfa3e4..4f0a516b4201 100644
--- a/pkgs/tools/networking/network-manager/strongswan/default.nix
+++ b/pkgs/tools/networking/network-manager/strongswan/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, intltool, pkgconfig, networkmanager, strongswanNM
-, gtk3, gnome3, libsecret, networkmanagerapplet }:
+, gtk3, gnome3, libsecret, libnma }:
 
 stdenv.mkDerivation rec {
   pname = "NetworkManager-strongswan";
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     sha256 = "015xcj42pd84apa0j0n9r3fhldp42mj72dqvl2xf4r9gwg5nhfrl";
   };
 
-  buildInputs = [ networkmanager strongswanNM libsecret gtk3 networkmanagerapplet ];
+  buildInputs = [ networkmanager strongswanNM libsecret gtk3 libnma ];
 
   nativeBuildInputs = [ intltool pkgconfig ];
 
diff --git a/pkgs/tools/networking/network-manager/vpnc/default.nix b/pkgs/tools/networking/network-manager/vpnc/default.nix
index 663923255745..9c1d046e4fb6 100644
--- a/pkgs/tools/networking/network-manager/vpnc/default.nix
+++ b/pkgs/tools/networking/network-manager/vpnc/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, substituteAll, vpnc, intltool, pkgconfig, networkmanager, libsecret
-, gtk3, withGnome ? true, gnome3, kmod, file, fetchpatch, networkmanagerapplet }:
+, gtk3, withGnome ? true, gnome3, kmod, file, fetchpatch, libnma }:
 let
   pname = "NetworkManager-vpnc";
   version = "1.2.6";
@@ -24,7 +24,7 @@ in stdenv.mkDerivation {
   ];
 
   buildInputs = [ vpnc networkmanager ]
-    ++ stdenv.lib.optionals withGnome [ gtk3 libsecret networkmanagerapplet ];
+    ++ stdenv.lib.optionals withGnome [ gtk3 libsecret libnma ];
 
   nativeBuildInputs = [ intltool pkgconfig file ];
 
diff --git a/pkgs/tools/networking/obfs4/default.nix b/pkgs/tools/networking/obfs4/default.nix
index 005abb0968b6..93ebdeb0720c 100644
--- a/pkgs/tools/networking/obfs4/default.nix
+++ b/pkgs/tools/networking/obfs4/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchgit, buildGoModule }:
+{ stdenv, fetchgit, buildGoModule, Security }:
 
 buildGoModule rec {
   pname = "obfs4";
@@ -12,7 +12,9 @@ buildGoModule rec {
 
   modSha256 = "150kg22kznrdj5icjxk3qd70g7wpq8zd2zklw1y2fgvrggw8zvyv";
 
-  meta = with lib; {
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
+  meta = with stdenv.lib; {
     description = "A pluggable transport proxy";
     homepage = https://www.torproject.org/projects/obfsproxy;
     repositories.git = https://git.torproject.org/pluggable-transports/obfs4.git;
diff --git a/pkgs/tools/networking/shadowfox/default.nix b/pkgs/tools/networking/shadowfox/default.nix
index f2ae143e1b9e..37d5edaec452 100644
--- a/pkgs/tools/networking/shadowfox/default.nix
+++ b/pkgs/tools/networking/shadowfox/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, buildGoModule }:
+{ stdenv, fetchFromGitHub, buildGoModule, Security }:
 
 buildGoModule rec {
   pname = "shadowfox";
@@ -11,10 +11,10 @@ buildGoModule rec {
     sha256 = "125mw70jidbp436arhv77201jdp6mpgqa2dzmrpmk55f9bf29sg6";
   };
 
-  goPackagePath = "github.com/SrKomodo/shadowfox-updater";
-
   modSha256 = "0hcc87mzacqwbw10l49kx0sxl4mivdr88c40wh6hdfvrbam2w86r";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   buildFlags = [ "--tags" "release" ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/networking/tendermint/default.nix b/pkgs/tools/networking/tendermint/default.nix
index 0b9c254deeb4..91378757af1d 100644
--- a/pkgs/tools/networking/tendermint/default.nix
+++ b/pkgs/tools/networking/tendermint/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, buildGoModule }:
+{ stdenv, fetchFromGitHub, buildGoModule, Security }:
 
 buildGoModule rec {
   pname = "tendermint";
@@ -13,6 +13,8 @@ buildGoModule rec {
 
   modSha256 = "1h51zgvjq3bm09yhm54rk8a86cqa1zma3mx6pb0kq7k72xvhpx0a";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   meta = with stdenv.lib; {
     description = "Byzantine-Fault Tolerant State Machines. Or Blockchain, for short.";
     homepage = https://tendermint.com/;
diff --git a/pkgs/tools/networking/termshark/default.nix b/pkgs/tools/networking/termshark/default.nix
index 35b92e0f653b..a24ff25ef2ba 100644
--- a/pkgs/tools/networking/termshark/default.nix
+++ b/pkgs/tools/networking/termshark/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, makeWrapper, buildGoModule, wireshark-cli }:
+{ stdenv, fetchFromGitHub, makeWrapper, buildGoModule, wireshark-cli, Security }:
 
 buildGoModule rec {
   pname = "termshark";
@@ -12,7 +12,8 @@ buildGoModule rec {
   };
 
   nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ wireshark-cli ];
+  buildInputs = [ wireshark-cli ]
+    ++ stdenv.lib.optionals stdenv.isDarwin [ Security ];
 
   modSha256 = "0lp4gky76di7as78421p3lsirfr7mic3z204ildvj6gf6d15svpr";
 
diff --git a/pkgs/tools/networking/yggdrasil/default.nix b/pkgs/tools/networking/yggdrasil/default.nix
index 3bf3b97c2355..605801b6ab73 100644
--- a/pkgs/tools/networking/yggdrasil/default.nix
+++ b/pkgs/tools/networking/yggdrasil/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Foundation }:
 
 buildGoModule rec {
   pname = "yggdrasil";
@@ -13,6 +13,8 @@ buildGoModule rec {
 
   modSha256 = "057yl3i29kwpd129aa2rb67s5rmz898fi2a7lxv3nfjp7018s9qw";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Foundation ];
+
   # Change the default location of the management socket on Linux
   # systems so that the yggdrasil system service unit does not have to
   # be granted write permission to /run.
@@ -27,7 +29,7 @@ buildGoModule rec {
       -s -w
   '';
 
-  meta = with lib; {
+  meta = with stdenv.lib; {
     description =
       "An experiment in scalable routing as an encrypted IPv6 overlay network";
     homepage = "https://yggdrasil-network.github.io/";
diff --git a/pkgs/tools/package-management/mynewt-newt/default.nix b/pkgs/tools/package-management/mynewt-newt/default.nix
index b40257d42f4b..6afba001e08d 100644
--- a/pkgs/tools/package-management/mynewt-newt/default.nix
+++ b/pkgs/tools/package-management/mynewt-newt/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub, fetchpatch }:
+{ stdenv, buildGoModule, fetchFromGitHub, fetchpatch, Security }:
 
 buildGoModule rec {
   pname = "mynewt-newt";
@@ -24,6 +24,8 @@ buildGoModule rec {
 
   modSha256 = "068r8wa2pgd68jv50x0l1w8n96f97b3mgv7z6f85280ahgywaasq";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   meta = with stdenv.lib; {
     homepage = https://mynewt.apache.org/;
     description = "Build and package management tool for embedded development.";
diff --git a/pkgs/tools/security/age/default.nix b/pkgs/tools/security/age/default.nix
index bde597ba9f30..0448faf53b76 100644
--- a/pkgs/tools/security/age/default.nix
+++ b/pkgs/tools/security/age/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "age";
@@ -18,7 +18,9 @@ buildGoModule rec {
     sha256 = "1n1ww8yjw0mg00dvnfmggww9kwp1hls0a85iv6vx9k89mzv8mdrq";
   };
 
-  meta = with lib; {
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
+  meta = with stdenv.lib; {
     homepage = "https://age-encryption.org/";
     description = "Modern encryption tool with small explicit keys";
     license = licenses.bsd3;
diff --git a/pkgs/tools/security/gobuster/default.nix b/pkgs/tools/security/gobuster/default.nix
index c3426bee965b..c9348b2f23aa 100644
--- a/pkgs/tools/security/gobuster/default.nix
+++ b/pkgs/tools/security/gobuster/default.nix
@@ -1,6 +1,7 @@
 { buildGoModule
 , fetchFromGitHub
-, lib
+, stdenv
+, Security
 }:
 
 buildGoModule rec {
@@ -16,7 +17,9 @@ buildGoModule rec {
 
   modSha256 = "0jq0z5s05vqdvq7v1gdjwlqqwbl1j2rv9f16k52idl50vdiqviql";
 
-  meta = with lib; {
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
+  meta = with stdenv.lib; {
     description = "Tool used to brute-force URIs, DNS subdomains, Virtual Host names on target web servers";
     homepage = "https://github.com/OJ/gobuster";
     license = licenses.asl20;
diff --git a/pkgs/tools/security/saml2aws/default.nix b/pkgs/tools/security/saml2aws/default.nix
index 011747890818..811b95d25245 100644
--- a/pkgs/tools/security/saml2aws/default.nix
+++ b/pkgs/tools/security/saml2aws/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, libobjc, Foundation, IOKit }:
 
 buildGoModule rec {
   pname = "saml2aws";
@@ -13,6 +13,8 @@ buildGoModule rec {
 
   modSha256 = "0qxf2i06spjig3ynixh3xmbxpghh222jhfqcg71i4i79x4ycp5wx";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ libobjc Foundation IOKit ];
+
   subPackages = [ "." "cmd/saml2aws" ];
 
   buildFlagsArray = ''
diff --git a/pkgs/tools/security/sops/default.nix b/pkgs/tools/security/sops/default.nix
index 8aa2e219e7df..d028b9787dba 100644
--- a/pkgs/tools/security/sops/default.nix
+++ b/pkgs/tools/security/sops/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, CoreServices }:
 
 buildGoModule rec {
   pname = "sops";
@@ -13,6 +13,8 @@ buildGoModule rec {
 
   modSha256 = "0vhxd3dschj5i9sig6vpxzbl59cas1qa843akzmjnfjrrafb916y";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ CoreServices ];
+
   meta = with stdenv.lib; {
     homepage = "https://github.com/mozilla/sops";
     description = "Mozilla sops (Secrets OPerationS) is an editor of encrypted files";
diff --git a/pkgs/tools/system/ctop/default.nix b/pkgs/tools/system/ctop/default.nix
index 4f492def1624..b9ea0c04aa85 100644
--- a/pkgs/tools/system/ctop/default.nix
+++ b/pkgs/tools/system/ctop/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, Security }:
 
 buildGoModule rec {
   pname = "ctop";
@@ -13,9 +13,11 @@ buildGoModule rec {
 
   modSha256 = "0wxv6yzlgki7047qszx9p9xpph95bg097jkgaa0b3wbpx8vg7qml";
 
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
+
   buildFlagsArray = [ "-ldflags=-s -w -X main.version=${version} -X main.build=v${version}" ];
 
-  meta = with lib; {
+  meta = with stdenv.lib; {
     description = "Top-like interface for container metrics";
     homepage = "https://ctop.sh/";
     license = licenses.mit;
diff --git a/pkgs/tools/system/ioping/default.nix b/pkgs/tools/system/ioping/default.nix
index 6ffaf23280f4..6acd41046ceb 100644
--- a/pkgs/tools/system/ioping/default.nix
+++ b/pkgs/tools/system/ioping/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub }:
+{ stdenv, fetchFromGitHub, fetchpatch }:
 
 stdenv.mkDerivation rec {
   pname = "ioping";
@@ -11,6 +11,14 @@ stdenv.mkDerivation rec {
     sha256 = "10bv36bqga8sdifxzywzzpjil7vmy62psirz7jbvlsq1bw71aiid";
   };
 
+  patches = [
+    # add netdata support: https://github.com/koct9i/ioping/pull/41
+    (fetchpatch {
+      url = "https://github.com/koct9i/ioping/commit/e7b818457ddb952cbcc13ae732ba0328f6eb73b3.patch";
+      sha256 = "122ivp4rqsnjszjfn33z8li6glcjhy7689bgipi8cgs5q55j99gf";
+    })
+  ];
+
   makeFlags = [ "PREFIX=$(out)" ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 7538ed98b403..3d259a3b023e 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -161,7 +161,9 @@ in
 
   cm256cc = callPackage ../development/libraries/cm256cc {  };
 
-  conftest = callPackage ../development/tools/conftest { };
+  conftest = callPackage ../development/tools/conftest {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   corgi = callPackage ../development/tools/corgi { };
 
@@ -175,9 +177,13 @@ in
 
   hobbes = callPackage ../development/tools/hobbes { stdenv = gcc6Stdenv; }; # GCC 6 is latest currently supported. See https://git.io/JvK6M.
 
-  proto-contrib = callPackage ../development/tools/proto-contrib {};
+  proto-contrib = callPackage ../development/tools/proto-contrib {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
-  protoc-gen-doc = callPackage ../development/tools/protoc-gen-doc {};
+  protoc-gen-doc = callPackage ../development/tools/protoc-gen-doc {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   demoit = callPackage ../servers/demoit { };
 
@@ -191,7 +197,9 @@ in
 
   dieHook = makeSetupHook {} ../build-support/setup-hooks/die.sh;
 
-  archiver = callPackage ../applications/misc/archiver { };
+  archiver = callPackage ../applications/misc/archiver {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   digitalbitbox = libsForQt5.callPackage ../applications/misc/digitalbitbox { };
 
@@ -211,7 +219,9 @@ in
 
   docker-sync = callPackage ../tools/misc/docker-sync { };
 
-  docui = callPackage ../tools/misc/docui { };
+  docui = callPackage ../tools/misc/docui {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   dotfiles = callPackage ../applications/misc/dotfiles { };
 
@@ -288,13 +298,18 @@ in
     # Version 2.6.0 fails to build with go 1.13 due to nested modules:
     #   go: directory v2/packr2 is outside main module
     buildGoModule = buildGo112Module;
+    inherit (darwin.apple_sdk.frameworks) Security;
   };
 
-  pet = callPackage ../development/tools/pet { };
+  pet = callPackage ../development/tools/pet {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   run = callPackage ../development/tools/run { };
 
-  mod = callPackage ../development/tools/mod { };
+  mod = callPackage ../development/tools/mod {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   broadlink-cli = callPackage ../tools/misc/broadlink-cli {};
 
@@ -528,7 +543,9 @@ in
 
   acpica-tools = callPackage ../tools/system/acpica-tools { };
 
-  act = callPackage ../development/tools/misc/act {};
+  act = callPackage ../development/tools/misc/act {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   actdiag = with python3.pkgs; toPythonApplication actdiag;
 
@@ -553,7 +570,9 @@ in
     wxGTK = wxGTK30;
   } // (config.aegisub or {}));
 
-  aerc = callPackage ../applications/networking/mailreaders/aerc { };
+  aerc = callPackage ../applications/networking/mailreaders/aerc {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   aerospike = callPackage ../servers/nosql/aerospike { };
 
@@ -742,19 +761,27 @@ in
 
   aws-sam-cli = callPackage ../development/tools/aws-sam-cli { python = python3; };
 
-  aws-vault = callPackage ../tools/admin/aws-vault { };
+  aws-vault = callPackage ../tools/admin/aws-vault {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
-  iamy = callPackage ../tools/admin/iamy { };
+  iamy = callPackage ../tools/admin/iamy {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   azure-cli = callPackage ../tools/admin/azure-cli { python = python3; };
 
-  azure-storage-azcopy = callPackage ../development/tools/azcopy { };
+  azure-storage-azcopy = callPackage ../development/tools/azcopy {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   azure-vhd-utils  = callPackage ../tools/misc/azure-vhd-utils { };
 
   awless = callPackage ../tools/virtualization/awless { };
 
-  berglas = callPackage ../tools/admin/berglas/default.nix { };
+  berglas = callPackage ../tools/admin/berglas/default.nix {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   brakeman = callPackage ../development/tools/analysis/brakeman { };
 
@@ -826,16 +853,22 @@ in
 
   calls = callPackage ../applications/networking/calls { };
 
-  certigo = callPackage ../tools/admin/certigo { };
+  certigo = callPackage ../tools/admin/certigo {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
-  chezmoi = callPackage ../tools/misc/chezmoi { };
+  chezmoi = callPackage ../tools/misc/chezmoi {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   chipsec = callPackage ../tools/security/chipsec {
     kernel = null;
     withDriver = false;
   };
 
-  clair = callPackage ../tools/admin/clair { };
+  clair = callPackage ../tools/admin/clair {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   cloud-sql-proxy = callPackage ../tools/misc/cloud-sql-proxy { };
 
@@ -867,7 +900,9 @@ in
 
   crc32c = callPackage ../development/libraries/crc32c { };
 
-  cue = callPackage ../development/tools/cue { };
+  cue = callPackage ../development/tools/cue {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   deltachat-electron = callPackage
     ../applications/networking/instant-messengers/deltachat-electron { };
@@ -892,7 +927,9 @@ in
 
   sedutil = callPackage ../tools/security/sedutil { };
 
-  elvish = callPackage ../shells/elvish { };
+  elvish = callPackage ../shells/elvish {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   emplace = callPackage ../tools/package-management/emplace { };
 
@@ -1106,7 +1143,9 @@ in
 
   awstats = callPackage ../tools/system/awstats { };
 
-  awsweeper = callPackage ../tools/admin/awsweeper { };
+  awsweeper = callPackage ../tools/admin/awsweeper {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   axel = callPackage ../tools/networking/axel {
     libssl = openssl;
@@ -1371,8 +1410,12 @@ in
     '';
   });
 
-  caddy = callPackage ../servers/caddy { };
-  caddy2 = callPackage ../servers/caddy/v2.nix { };
+  caddy = callPackage ../servers/caddy {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
+  caddy2 = callPackage ../servers/caddy/v2.nix {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
   traefik = callPackage ../servers/traefik { };
 
   calamares = libsForQt5.callPackage ../tools/misc/calamares {
@@ -1424,9 +1467,13 @@ in
 
   ccnet = callPackage ../tools/networking/ccnet { };
 
-  cassowary = callPackage ../tools/networking/cassowary { };
+  cassowary = callPackage ../tools/networking/cassowary {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
-  croc = callPackage ../tools/networking/croc { };
+  croc = callPackage ../tools/networking/croc {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   cddl = callPackage ../development/tools/cddl { };
 
@@ -1446,7 +1493,9 @@ in
 
   clac = callPackage ../tools/misc/clac {};
 
-  clash = callPackage ../tools/networking/clash { };
+  clash = callPackage ../tools/networking/clash {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   clasp = callPackage ../tools/misc/clasp { };
 
@@ -1711,7 +1760,9 @@ in
 
   eggdrop = callPackage ../tools/networking/eggdrop { };
 
-  eksctl = callPackage ../tools/admin/eksctl { };
+  eksctl = callPackage ../tools/admin/eksctl {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   elementary-xfce-icon-theme = callPackage ../data/icons/elementary-xfce-icon-theme { };
 
@@ -1865,7 +1916,9 @@ in
 
   gosu = callPackage ../tools/misc/gosu { };
 
-  gotify-cli = callPackage ../tools/misc/gotify-cli { };
+  gotify-cli = callPackage ../tools/misc/gotify-cli {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   gping = callPackage ../tools/networking/gping { };
 
@@ -2443,7 +2496,9 @@ in
 
   ciopfs = callPackage ../tools/filesystems/ciopfs { };
 
-  circleci-cli = callPackage ../development/tools/misc/circleci-cli { };
+  circleci-cli = callPackage ../development/tools/misc/circleci-cli {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   circus = callPackage ../tools/networking/circus { };
 
@@ -2614,7 +2669,9 @@ in
     caps2esc = callPackage ../tools/inputmethods/interception-tools/caps2esc.nix { };
   };
 
-  age = callPackage ../tools/security/age { };
+  age = callPackage ../tools/security/age {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   brotli = callPackage ../tools/compression/brotli { };
 
@@ -2839,7 +2896,9 @@ in
 
   dnsmasq = callPackage ../tools/networking/dnsmasq { };
 
-  dnsproxy = callPackage ../tools/networking/dnsproxy { };
+  dnsproxy = callPackage ../tools/networking/dnsproxy {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   dnsperf = callPackage ../tools/networking/dnsperf { };
 
@@ -2942,9 +3001,13 @@ in
 
   driftnet = callPackage ../tools/networking/driftnet {};
 
-  drone = callPackage ../development/tools/continuous-integration/drone { };
+  drone = callPackage ../development/tools/continuous-integration/drone {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
-  drone-cli = callPackage ../development/tools/continuous-integration/drone-cli { };
+  drone-cli = callPackage ../development/tools/continuous-integration/drone-cli {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   dropbear = callPackage ../tools/networking/dropbear { };
 
@@ -3867,6 +3930,7 @@ in
 
   grpcui = callPackage ../tools/networking/grpcui {
     buildGoModule = buildGo112Module;
+    inherit (darwin.apple_sdk.frameworks) Security;
   };
 
   grub = pkgsi686Linux.callPackage ../tools/misc/grub ({
@@ -4093,7 +4157,9 @@ in
   hexd = callPackage ../tools/misc/hexd { };
   pixd = callPackage ../tools/misc/pixd { };
 
-  hey = callPackage ../tools/networking/hey { };
+  hey = callPackage ../tools/networking/hey {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   hhpc = callPackage ../tools/misc/hhpc { };
 
@@ -4291,9 +4357,12 @@ in
     #    go: github.com/go-critic/go-critic@v0.0.0-20181204210945-ee9bf5809ead: invalid pseudo-version: does not match version-control timestamp (2019-02-10T22:04:43Z)
     # This is fixed in master, but release containing the fix does not exist yet.
     buildGoModule = buildGo112Module;
+    inherit (darwin.apple_sdk.frameworks) Security;
   };
   ipfs-migrator = callPackage ../applications/networking/ipfs-migrator { };
-  ipfs-cluster = callPackage ../applications/networking/ipfs-cluster { };
+  ipfs-cluster = callPackage ../applications/networking/ipfs-cluster {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   ipget = callPackage ../applications/networking/ipget { };
 
@@ -4535,7 +4604,9 @@ in
 
   lefthook = gitAndTools.lefthook;
 
-  lego = callPackage ../tools/admin/lego { };
+  lego = callPackage ../tools/admin/lego {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   leocad = callPackage ../applications/graphics/leocad { };
 
@@ -4628,7 +4699,9 @@ in
 
   mautrix-telegram = recurseIntoAttrs (callPackage ../servers/mautrix-telegram { });
 
-  mautrix-whatsapp = callPackage ../servers/mautrix-whatsapp { };
+  mautrix-whatsapp = callPackage ../servers/mautrix-whatsapp {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   mcfly = callPackage ../tools/misc/mcfly {
     inherit (darwin.apple_sdk.frameworks) Security;
@@ -4665,7 +4738,9 @@ in
 
   motion = callPackage ../applications/video/motion { };
 
-  mtail = callPackage ../servers/monitoring/mtail { };
+  mtail = callPackage ../servers/monitoring/mtail {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   multitail = callPackage ../tools/misc/multitail { };
 
@@ -5112,7 +5187,9 @@ in
 
   minetime = callPackage ../applications/office/minetime { };
 
-  minio-client = callPackage ../tools/networking/minio-client { };
+  minio-client = callPackage ../tools/networking/minio-client {
+    inherit (darwin.apple_sdk.frameworks) CoreServices;
+  };
 
   minissdpd = callPackage ../tools/networking/minissdpd { };
 
@@ -5231,7 +5308,9 @@ in
 
   munt = libsForQt5.callPackage ../applications/audio/munt { };
 
-  mutagen = callPackage ../tools/misc/mutagen { };
+  mutagen = callPackage ../tools/misc/mutagen {
+    inherit (pkgs.darwin.apple_sdk.frameworks) CoreServices;
+  };
 
   mycli = callPackage ../tools/admin/mycli { };
 
@@ -5269,7 +5348,9 @@ in
 
   ndppd = callPackage ../applications/networking/ndppd { };
 
-  nebula = callPackage ../tools/networking/nebula { };
+  nebula = callPackage ../tools/networking/nebula {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   nemiver = callPackage ../development/tools/nemiver { };
 
@@ -5346,6 +5427,8 @@ in
 
   networkmanagerapplet = callPackage ../tools/networking/network-manager/applet { };
 
+  libnma = callPackage ../tools/networking/network-manager/libnma { };
+
   networkmanager_dmenu = callPackage ../tools/networking/network-manager/dmenu  { };
 
   nm-tray = libsForQt5.callPackage ../tools/networking/network-manager/tray.nix { };
@@ -5494,7 +5577,9 @@ in
 
   obexd = callPackage ../tools/bluetooth/obexd { };
 
-  obfs4 = callPackage ../tools/networking/obfs4 { };
+  obfs4 = callPackage ../tools/networking/obfs4 {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   oci-image-tool = callPackage ../tools/misc/oci-image-tool { };
 
@@ -5832,9 +5917,13 @@ in
 
   pg_top = callPackage ../tools/misc/pg_top { };
 
-  pgcenter = callPackage ../tools/misc/pgcenter { };
+  pgcenter = callPackage ../tools/misc/pgcenter {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
-  pgmetrics = callPackage ../tools/misc/pgmetrics { };
+  pgmetrics = callPackage ../tools/misc/pgmetrics {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   pdsh = callPackage ../tools/networking/pdsh {
     rsh = true;          # enable internal rsh implementation
@@ -6370,7 +6459,10 @@ in
 
   samim-fonts = callPackage ../data/fonts/samim-fonts {};
 
-  saml2aws = callPackage ../tools/security/saml2aws {};
+  saml2aws = callPackage ../tools/security/saml2aws {
+    inherit (darwin) libobjc;
+    inherit (darwin.apple_sdk.frameworks) Foundation IOKit;
+  };
 
   samplicator = callPackage ../tools/networking/samplicator { };
 
@@ -7297,6 +7389,8 @@ in
 
   woof = callPackage ../tools/misc/woof { };
 
+  wootility = callPackage ../tools/misc/wootility { };
+
   wpscan = callPackage ../tools/security/wpscan { };
 
   wsmancli = callPackage ../tools/system/wsmancli {};
@@ -7667,7 +7761,9 @@ in
     inherit (darwin.apple_sdk.frameworks) IOKit;
   };
 
-  yggdrasil = callPackage ../tools/networking/yggdrasil { };
+  yggdrasil = callPackage ../tools/networking/yggdrasil {
+    inherit (darwin.apple_sdk.frameworks) Foundation;
+  };
 
   # To expose more packages for Yi, override the extraPackages arg.
   yi = callPackage ../applications/editors/yi/wrapper.nix { };
@@ -7718,7 +7814,9 @@ in
 
   zsh-git-prompt = callPackage ../shells/zsh/zsh-git-prompt { };
 
-  zsh-history = callPackage ../shells/zsh/zsh-history { };
+  zsh-history = callPackage ../shells/zsh/zsh-history {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   zsh-history-substring-search = callPackage ../shells/zsh/zsh-history-substring-search { };
 
@@ -8034,7 +8132,9 @@ in
 
   scry = callPackage ../development/tools/scry {};
 
-  dbmate = callPackage ../development/tools/database/dbmate { };
+  dbmate = callPackage ../development/tools/database/dbmate {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   devpi-client = python3Packages.callPackage ../development/tools/devpi-client {};
 
@@ -8062,7 +8162,9 @@ in
   };
   fasm-bin = callPackage ../development/compilers/fasm/bin.nix { };
 
-  flyctl = callPackage ../development/web/flyctl { };
+  flyctl = callPackage ../development/web/flyctl {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   fpc = callPackage ../development/compilers/fpc { };
 
@@ -9233,7 +9335,9 @@ in
 
   jmeter = callPackage ../applications/networking/jmeter {};
 
-  joker = callPackage ../development/interpreters/joker {};
+  joker = callPackage ../development/interpreters/joker {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   davmail = callPackage ../applications/networking/davmail {};
 
@@ -9879,7 +9983,9 @@ in
     go = go_1_12;
   };
 
-  bazelisk = callPackage ../development/tools/bazelisk { };
+  bazelisk = callPackage ../development/tools/bazelisk {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   buildBazelPackage = callPackage ../build-support/build-bazel-package { };
 
@@ -10147,7 +10253,9 @@ in
       binutils = binutils;
     };
 
-  dive = callPackage ../development/tools/dive { };
+  dive = callPackage ../development/tools/dive {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   doclifter = callPackage ../development/tools/misc/doclifter { };
 
@@ -10157,7 +10265,9 @@ in
 
   doit = callPackage ../development/tools/build-managers/doit { };
 
-  dolt = callPackage ../servers/sql/dolt { };
+  dolt = callPackage ../servers/sql/dolt {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   dot2tex = pythonPackages.dot2tex;
 
@@ -10176,7 +10286,9 @@ in
 
   drush = callPackage ../development/tools/misc/drush { };
 
-  editorconfig-checker = callPackage ../development/tools/misc/editorconfig-checker { };
+  editorconfig-checker = callPackage ../development/tools/misc/editorconfig-checker {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   editorconfig-core-c = callPackage ../development/tools/misc/editorconfig-core-c { };
 
@@ -10217,7 +10329,9 @@ in
     inherit (darwin.apple_sdk.frameworks) CoreServices;
   };
 
-  fly = callPackage ../development/tools/continuous-integration/fly { };
+  fly = callPackage ../development/tools/continuous-integration/fly {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   foreman = callPackage ../tools/system/foreman { };
   goreman = callPackage ../tools/system/goreman { };
@@ -10226,7 +10340,9 @@ in
 
   frame = callPackage ../development/libraries/frame { };
 
-  frp = callPackage ../tools/networking/frp { };
+  frp = callPackage ../tools/networking/frp {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   fsatrace = callPackage ../development/tools/misc/fsatrace { };
 
@@ -10295,7 +10411,9 @@ in
 
   gocd-server = callPackage ../development/tools/continuous-integration/gocd-server { };
 
-  gotify-server = callPackage ../servers/gotify { };
+  gotify-server = callPackage ../servers/gotify {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   gotty = callPackage ../servers/gotty { };
 
@@ -10339,7 +10457,9 @@ in
 
   halfempty = callPackage ../development/tools/halfempty {};
 
-  hcloud = callPackage ../development/tools/hcloud { };
+  hcloud = callPackage ../development/tools/hcloud {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   help2man = callPackage ../development/tools/misc/help2man { };
 
@@ -10421,13 +10541,17 @@ in
 
   kube-prompt = callPackage ../development/tools/kube-prompt { };
 
-  kubeprompt = callPackage ../development/tools/kubeprompt { };
+  kubeprompt = callPackage ../development/tools/kubeprompt {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   kubicorn = callPackage ../development/tools/kubicorn {  };
 
   kubie = callPackage ../development/tools/kubie { };
 
-  kustomize = callPackage ../development/tools/kustomize { };
+  kustomize = callPackage ../development/tools/kustomize {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   ktlint = callPackage ../development/tools/ktlint { };
 
@@ -10484,14 +10608,18 @@ in
 
   mdl = callPackage ../development/tools/misc/mdl { };
 
-  minify = callPackage ../development/web/minify { };
+  minify = callPackage ../development/web/minify {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   minizinc = callPackage ../development/tools/minizinc { };
   minizincide = qt5.callPackage ../development/tools/minizinc/ide.nix { };
 
   mk = callPackage ../development/tools/build-managers/mk { };
 
-  mkcert = callPackage ../development/tools/misc/mkcert { };
+  mkcert = callPackage ../development/tools/misc/mkcert {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   mkdocs = callPackage ../development/tools/documentation/mkdocs { };
 
@@ -10671,7 +10799,9 @@ in
     withPEPatterns = true;
   };
 
-  reviewdog = callPackage ../development/tools/misc/reviewdog { };
+  reviewdog = callPackage ../development/tools/misc/reviewdog {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   rman = callPackage ../development/tools/misc/rman { };
 
@@ -10813,7 +10943,9 @@ in
 
   teensy-loader-cli = callPackage ../development/tools/misc/teensy-loader-cli { };
 
-  terracognita = callPackage ../development/tools/misc/terracognita { };
+  terracognita = callPackage ../development/tools/misc/terracognita {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   terraform-lsp = callPackage ../development/tools/misc/terraform-lsp { };
 
@@ -10834,11 +10966,15 @@ in
     inherit (darwin.apple_sdk.frameworks) Security;
   };
 
-  tflint = callPackage ../development/tools/analysis/tflint { };
+  tflint = callPackage ../development/tools/analysis/tflint {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   tfsec = callPackage ../development/tools/analysis/tfsec { };
 
-  todoist = callPackage ../applications/misc/todoist { };
+  todoist = callPackage ../applications/misc/todoist {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   todoist-electron = callPackage ../applications/misc/todoist-electron { };
 
@@ -15462,6 +15598,7 @@ in
 
   gobetween = callPackage ../servers/gobetween {
     buildGoModule = buildGo112Module;
+    inherit (darwin.apple_sdk.frameworks) Security;
   };
 
   h2o = callPackage ../servers/http/h2o { };
@@ -15491,7 +15628,9 @@ in
     theme-spring = callPackage ../servers/icingaweb2/theme-spring { };
   };
 
-  imgproxy = callPackage ../servers/imgproxy { };
+  imgproxy = callPackage ../servers/imgproxy {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   ircdHybrid = callPackage ../servers/irc/ircd-hybrid { };
 
@@ -15530,7 +15669,9 @@ in
 
   mattermost = callPackage ../servers/mattermost { };
   matterircd = callPackage ../servers/mattermost/matterircd.nix { };
-  matterbridge = callPackage ../servers/matterbridge { };
+  matterbridge = callPackage ../servers/matterbridge {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   mattermost-desktop = callPackage ../applications/networking/instant-messengers/mattermost-desktop { };
 
@@ -15544,7 +15685,9 @@ in
 
   micronaut = callPackage ../development/tools/micronaut {};
 
-  minio = callPackage ../servers/minio { };
+  minio = callPackage ../servers/minio {
+    inherit (pkgs.darwin.apple_sdk.frameworks) CoreServices;
+  };
 
   # Backwards compatibility.
   mod_dnssd = pkgs.apacheHttpdPackages.mod_dnssd;
@@ -15873,7 +16016,9 @@ in
   prometheus-collectd-exporter = callPackage ../servers/monitoring/prometheus/collectd-exporter.nix { };
   prometheus-cups-exporter = callPackage ../servers/monitoring/prometheus/cups-exporter.nix { };
   prometheus-consul-exporter = callPackage ../servers/monitoring/prometheus/consul-exporter.nix { };
-  prometheus-dnsmasq-exporter = callPackage ../servers/monitoring/prometheus/dnsmasq-exporter.nix { };
+  prometheus-dnsmasq-exporter = callPackage ../servers/monitoring/prometheus/dnsmasq-exporter.nix {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
   prometheus-dovecot-exporter = callPackage ../servers/monitoring/prometheus/dovecot-exporter.nix { };
   prometheus-fritzbox-exporter = callPackage ../servers/monitoring/prometheus/fritzbox-exporter.nix { };
   prometheus-gitlab-ci-pipelines-exporter = callPackage ../servers/monitoring/prometheus/gitlab-ci-pipelines-exporter.nix { };
@@ -15881,7 +16026,9 @@ in
   prometheus-json-exporter = callPackage ../servers/monitoring/prometheus/json-exporter.nix { };
   prometheus-mail-exporter = callPackage ../servers/monitoring/prometheus/mail-exporter.nix { };
   prometheus-mesos-exporter = callPackage ../servers/monitoring/prometheus/mesos-exporter.nix { };
-  prometheus-mikrotik-exporter = callPackage ../servers/monitoring/prometheus/mikrotik-exporter.nix { };
+  prometheus-mikrotik-exporter = callPackage ../servers/monitoring/prometheus/mikrotik-exporter.nix {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
   prometheus-minio-exporter = callPackage ../servers/monitoring/prometheus/minio-exporter { };
   prometheus-mysqld-exporter = callPackage ../servers/monitoring/prometheus/mysqld-exporter.nix { };
   prometheus-nextcloud-exporter = callPackage ../servers/monitoring/prometheus/nextcloud-exporter.nix { };
@@ -15903,6 +16050,7 @@ in
     # Version 1.5.1 fails to build with go 1.13 due to test failure
     #  FAIL       github.com/jonnenauha/prometheus_varnish_exporter       0.041s
     buildGoModule = buildGo112Module;
+    inherit (darwin.apple_sdk.frameworks) Security;
   };
   prometheus-jmx-httpserver = callPackage ../servers/monitoring/prometheus/jmx-httpserver.nix {  };
   prometheus-wireguard-exporter = callPackage ../servers/monitoring/prometheus/wireguard-exporter.nix {
@@ -16019,7 +16167,9 @@ in
 
   sensu = callPackage ../servers/monitoring/sensu { };
 
-  inherit (callPackages ../servers/monitoring/sensu-go { })
+  inherit (callPackages ../servers/monitoring/sensu-go {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  })
     sensu-go-agent
     sensu-go-backend
     sensu-go-cli;
@@ -16067,7 +16217,9 @@ in
 
   tailscale = callPackage ../servers/tailscale { };
 
-  thanos = callPackage ../servers/monitoring/thanos { };
+  thanos = callPackage ../servers/monitoring/thanos {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   inherit (callPackages ../servers/http/tomcat { })
     tomcat7
@@ -16092,7 +16244,9 @@ in
 
   shaarli-material = callPackage ../servers/web-apps/shaarli/material-theme.nix { };
 
-  shiori = callPackage ../servers/web-apps/shiori { };
+  shiori = callPackage ../servers/web-apps/shiori {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   inherit (callPackages ../servers/web-apps/matomo {})
     matomo
@@ -16105,7 +16259,9 @@ in
     unifiStable;
   unifi = unifiStable;
 
-  victoriametrics = callPackage ../servers/nosql/victoriametrics { };
+  victoriametrics = callPackage ../servers/nosql/victoriametrics {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   virtlyst = libsForQt5.callPackage ../servers/web-apps/virtlyst { };
 
@@ -16306,9 +16462,13 @@ in
 
   conntrack-tools = callPackage ../os-specific/linux/conntrack-tools { };
 
-  coredns = callPackage ../servers/dns/coredns { };
+  coredns = callPackage ../servers/dns/coredns {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
-  corerad = callPackage ../tools/networking/corerad { };
+  corerad = callPackage ../tools/networking/corerad {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   cpufrequtils = callPackage ../os-specific/linux/cpufrequtils { };
 
@@ -17116,7 +17276,9 @@ in
 
   golint = callPackage ../development/tools/golint { };
 
-  golangci-lint = callPackage ../development/tools/golangci-lint { };
+  golangci-lint = callPackage ../development/tools/golangci-lint {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   gocyclo = callPackage ../development/tools/gocyclo { };
 
@@ -17130,7 +17292,9 @@ in
 
   govendor = callPackage ../development/tools/govendor { };
 
-  go-tools = callPackage ../development/tools/go-tools { };
+  go-tools = callPackage ../development/tools/go-tools {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   gotools = callPackage ../development/tools/gotools {
     inherit (darwin.apple_sdk.frameworks) Security;
@@ -17241,7 +17405,9 @@ in
 
   procdump = callPackage ../os-specific/linux/procdump { };
 
-  prototool = callPackage ../development/tools/prototool { };
+  prototool = callPackage ../development/tools/prototool {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   qemu_kvm = lowPrio (qemu.override { hostCpuOnly = true; });
 
@@ -17318,7 +17484,10 @@ in
 
   smem = callPackage ../os-specific/linux/smem { };
 
-  smimesign = callPackage ../os-specific/darwin/smimesign { };
+  smimesign = callPackage ../os-specific/darwin/smimesign {
+    inherit (darwin) libobjc;
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   speedometer = callPackage ../os-specific/linux/speedometer { };
 
@@ -17468,6 +17637,8 @@ in
 
   wirelesstools = callPackage ../os-specific/linux/wireless-tools { };
 
+  wooting-udev-rules = callPackage ../os-specific/linux/wooting-udev-rules { };
+
   wpa_supplicant = callPackage ../os-specific/linux/wpa_supplicant { };
 
   wpa_supplicant_gui = libsForQt5.callPackage ../os-specific/linux/wpa_supplicant/gui.nix { };
@@ -17652,7 +17823,9 @@ in
 
   documentation-highlighter = callPackage ../misc/documentation-highlighter { };
 
-  documize-community = callPackage ../servers/documize-community { };
+  documize-community = callPackage ../servers/documize-community {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   doge = callPackage ../misc/doge { };
 
@@ -17755,7 +17928,9 @@ in
 
   helvetica-neue-lt-std = callPackage ../data/fonts/helvetica-neue-lt-std { };
 
-  hetzner-kube = callPackage ../applications/networking/cluster/hetzner-kube { };
+  hetzner-kube = callPackage ../applications/networking/cluster/hetzner-kube {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   hicolor-icon-theme = callPackage ../data/icons/hicolor-icon-theme { };
 
@@ -18377,9 +18552,13 @@ in
 
   arelle = with python3Packages; toPythonApplication arelle;
 
-  argo = callPackage ../applications/networking/cluster/argo { };
+  argo = callPackage ../applications/networking/cluster/argo {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
-  argocd = callPackage ../applications/networking/cluster/argocd { };
+  argocd = callPackage ../applications/networking/cluster/argocd {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   ario = callPackage ../applications/audio/ario { };
 
@@ -18775,7 +18954,9 @@ in
 
   csdp = callPackage ../applications/science/math/csdp { };
 
-  ctop = callPackage ../tools/system/ctop { };
+  ctop = callPackage ../tools/system/ctop {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   cubicsdr = callPackage ../applications/radio/cubicsdr { wxGTK = wxGTK31; };
 
@@ -18967,7 +19148,9 @@ in
 
   eaglemode = callPackage ../applications/misc/eaglemode { };
 
-  echoip = callPackage ../servers/echoip { };
+  echoip = callPackage ../servers/echoip {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   eclipses = recurseIntoAttrs (callPackage ../applications/editors/eclipse {
     jdk = jdk11;
@@ -19119,7 +19302,9 @@ in
 
   evilvte = callPackage ../applications/misc/evilvte (config.evilvte or {});
 
-  exercism = callPackage ../applications/misc/exercism { };
+  exercism = callPackage ../applications/misc/exercism {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   go-motion = callPackage ../development/tools/go-motion { };
 
@@ -19231,7 +19416,9 @@ in
   geany = callPackage ../applications/editors/geany { };
   geany-with-vte = callPackage ../applications/editors/geany/with-vte.nix { };
 
-  geoipupdate = callPackage ../applications/misc/geoipupdate/default.nix { };
+  geoipupdate = callPackage ../applications/misc/geoipupdate/default.nix {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   ghostwriter = libsForQt5.callPackage ../applications/editors/ghostwriter { };
 
@@ -19270,7 +19457,9 @@ in
     inherit (darwin) libiconv;
   };
 
-  gomuks = callPackage ../applications/networking/instant-messengers/gomuks { };
+  gomuks = callPackage ../applications/networking/instant-messengers/gomuks {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   inherit (ocamlPackages) google-drive-ocamlfuse;
 
@@ -19360,7 +19549,9 @@ in
 
   sngrep = callPackage ../applications/networking/sniffers/sngrep {};
 
-  termshark = callPackage ../tools/networking/termshark { };
+  termshark = callPackage ../tools/networking/termshark {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   fbida = callPackage ../applications/graphics/fbida { };
 
@@ -19591,7 +19782,9 @@ in
     inherit (darwin) IOKit;
   };
 
-  glow = callPackage ../applications/editors/glow { };
+  glow = callPackage ../applications/editors/glow {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   glowing-bear = callPackage ../applications/networking/irc/glowing-bear { };
 
@@ -19769,11 +19962,15 @@ in
     wxGTK = wxGTK30;
   };
 
-  hugo = callPackage ../applications/misc/hugo { };
+  hugo = callPackage ../applications/misc/hugo {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   hydrogen = callPackage ../applications/audio/hydrogen { };
 
-  hydroxide = callPackage ../applications/networking/hydroxide { };
+  hydroxide = callPackage ../applications/networking/hydroxide {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   hyper = callPackage ../applications/misc/hyper { };
 
@@ -20115,7 +20312,9 @@ in
 
   kega-fusion = pkgsi686Linux.callPackage ../misc/emulators/kega-fusion { };
 
-  kepubify = callPackage ../tools/misc/kepubify { };
+  kepubify = callPackage ../tools/misc/kepubify {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   kermit = callPackage ../tools/misc/kermit { };
 
@@ -20176,7 +20375,9 @@ in
 
   kubecfg = callPackage ../applications/networking/cluster/kubecfg { };
 
-  kubeval = callPackage ../applications/networking/cluster/kubeval { };
+  kubeval = callPackage ../applications/networking/cluster/kubeval {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   kubeval-schema = callPackage ../applications/networking/cluster/kubeval/schema.nix { };
 
@@ -20184,19 +20385,29 @@ in
     go = buildPackages.go_1_13;
   };
 
-  kubeseal = callPackage ../applications/networking/cluster/kubeseal { };
+  kubeseal = callPackage ../applications/networking/cluster/kubeseal {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   kubectl = callPackage ../applications/networking/cluster/kubectl { };
 
   kubeless = callPackage ../applications/networking/cluster/kubeless { };
 
-  k9s = callPackage ../applications/networking/cluster/k9s { };
+  k9s = callPackage ../applications/networking/cluster/k9s {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
-  fluxctl = callPackage ../applications/networking/cluster/fluxctl { };
+  fluxctl = callPackage ../applications/networking/cluster/fluxctl {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
-  linkerd = callPackage ../applications/networking/cluster/linkerd { };
+  linkerd = callPackage ../applications/networking/cluster/linkerd {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
-  kubernetes-helm = callPackage ../applications/networking/cluster/helm { };
+  kubernetes-helm = callPackage ../applications/networking/cluster/helm {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   kubetail = callPackage ../applications/networking/cluster/kubetail { } ;
 
@@ -20493,7 +20704,9 @@ in
   minidjvu = callPackage ../applications/graphics/minidjvu { };
 
   minikube = callPackage ../applications/networking/cluster/minikube {
-    inherit (darwin.apple_sdk.frameworks) vmnet;
+    inherit (darwin) libobjc;
+    inherit (darwin.apple_sdk.libs) xpc;
+    inherit (darwin.apple_sdk.frameworks) vmnet Foundation IOKit;
   };
 
   minishift = callPackage ../applications/networking/cluster/minishift { };
@@ -20784,7 +20997,9 @@ in
 
   ptex = callPackage ../development/libraries/ptex {};
 
-  qbec = callPackage ../applications/networking/cluster/qbec { };
+  qbec = callPackage ../applications/networking/cluster/qbec {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   rssguard = libsForQt5.callPackage ../applications/networking/feedreaders/rssguard { };
 
@@ -21573,7 +21788,9 @@ in
 
   sfxr-qt = libsForQt5.callPackage ../applications/audio/sfxr-qt { };
 
-  shadowfox = callPackage ../tools/networking/shadowfox { };
+  shadowfox = callPackage ../tools/networking/shadowfox {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   shfmt = callPackage ../tools/text/shfmt { };
 
@@ -21605,7 +21822,9 @@ in
 
   sooperlooper = callPackage ../applications/audio/sooperlooper { };
 
-  sops = callPackage ../tools/security/sops { };
+  sops = callPackage ../tools/security/sops {
+    inherit (darwin.apple_sdk.frameworks) CoreServices;
+  };
 
   sorcer = callPackage ../applications/audio/sorcer { };
 
@@ -21863,7 +22082,10 @@ in
 
   syncplay = python3.pkgs.callPackage ../applications/networking/syncplay { };
 
-  inherit (callPackages ../applications/networking/syncthing { })
+  inherit (callPackages ../applications/networking/syncthing {
+    inherit (darwin) libobjc;
+    inherit (darwin.apple_sdk.frameworks) CoreServices Foundation;
+  })
     syncthing
     syncthing-cli
     syncthing-discovery
@@ -21950,6 +22172,7 @@ in
 
   tendermint = callPackage ../tools/networking/tendermint {
     buildGoModule = buildGo112Module;
+    inherit (darwin.apple_sdk.frameworks) Security;
   };
 
   termdown = (newScope pythonPackages) ../applications/misc/termdown { };
@@ -22459,7 +22682,6 @@ in
       inherit (lib) optional;
     in with libretro;
       ([ ]
-      ++ optional (cfg.enable4do or false) _4do
       ++ optional (cfg.enableAtari800 or false) atari800
       ++ optional (cfg.enableBeetleGBA or false) beetle-gba
       ++ optional (cfg.enableBeetleLynx or false) beetle-lynx
@@ -22467,26 +22689,33 @@ in
       ++ optional (cfg.enableBeetlePCEFast or false) beetle-pce-fast
       ++ optional (cfg.enableBeetlePCFX or false) beetle-pcfx
       ++ optional (cfg.enableBeetlePSX or false) beetle-psx
+      ++ optional (cfg.enableBeetlePSXHW or false) beetle-psx-hw
       ++ optional (cfg.enableBeetleSaturn or false) beetle-saturn
+      ++ optional (cfg.enableBeetleSaturnHW or false) beetle-saturn-hw
       ++ optional (cfg.enableBeetleSNES or false) beetle-snes
       ++ optional (cfg.enableBeetleSuperGrafx or false) beetle-supergrafx
       ++ optional (cfg.enableBeetleWswan or false) beetle-wswan
       ++ optional (cfg.enableBeetleVB or false) beetle-vb
       ++ optional (cfg.enableBlueMSX or false) bluemsx
       ++ optional (cfg.enableBsnesMercury or false) bsnes-mercury
-      ++ optional (cfg.enableDOSBox or false) dosbox
+      ++ optional (cfg.enableCitra or false) citra
       ++ optional (cfg.enableDesmume or false) desmume
       ++ optional (cfg.enableDesmume2015 or false) desmume2015
       ++ optional (cfg.enableDolphin or false) dolphin
-      ++ optional (cfg.enableFBA or false) fba
+      ++ optional (cfg.enableDOSBox or false) dosbox
+      ++ optional (cfg.enableEightyOne or false) eightyone
+      ++ optional (cfg.enableFBAlpha2012 or false) fbalpha2012
+      ++ optional (cfg.enableFBNeo or false) fbneo
       ++ optional (cfg.enableFceumm or false) fceumm
       ++ optional (cfg.enableFlycast or false) flycast
+      ++ optional (cfg.enableFMSX or false) fmsx
+      ++ optional (cfg.enableFreeIntv or false) freeintv
       ++ optional (cfg.enableGambatte or false) gambatte
       ++ optional (cfg.enableGenesisPlusGX or false) genesis-plus-gx
       ++ optional (cfg.enableGpsp or false) gpsp
+      ++ optional (cfg.enableGW or false) gw
       ++ optional (cfg.enableHandy or false) handy
       ++ optional (cfg.enableHatari or false) hatari
-      ++ optional (cfg.enableHiganSFC or false) higan-sfc
       ++ optional (cfg.enableMAME or false) mame
       ++ optional (cfg.enableMAME2000 or false) mame2000
       ++ optional (cfg.enableMAME2003 or false) mame2003
@@ -22495,10 +22724,13 @@ in
       ++ optional (cfg.enableMAME2015 or false) mame2015
       ++ optional (cfg.enableMAME2016 or false) mame2016
       ++ optional (cfg.enableMesen or false) mesen
+      ++ optional (cfg.enableMeteor or false) meteor
       ++ optional (cfg.enableMGBA or false) mgba
       ++ optional (cfg.enableMupen64Plus or false) mupen64plus
+      ++ optional (cfg.enableNeoCD or false) neocd
       ++ optional (cfg.enableNestopia or false) nestopia
       ++ optional (cfg.enableO2EM or false) o2em
+      ++ optional (cfg.enableOpera or false) opera
       ++ optional (cfg.enableParallelN64 or false) parallel-n64
       ++ optional (cfg.enablePCSXRearmed or false) pcsx_rearmed
       ++ optional (cfg.enablePicodrive or false) picodrive
@@ -22507,24 +22739,22 @@ in
       ++ optional (cfg.enablePrboom or false) prboom
       ++ optional (cfg.enableProSystem or false) prosystem
       ++ optional (cfg.enableQuickNES or false) quicknes
+      ++ optional (cfg.enableSameBoy or false) sameboy
       ++ optional (cfg.enableScummVM or false) scummvm
+      ++ optional (cfg.enableSMSPlusGX or false) smsplus-gx
       ++ optional (cfg.enableSnes9x or false) snes9x
       ++ optional (cfg.enableSnes9x2002 or false) snes9x2002
       ++ optional (cfg.enableSnes9x2005 or false) snes9x2005
       ++ optional (cfg.enableSnes9x2010 or false) snes9x2010
       ++ optional (cfg.enableStella or false) stella
+      ++ optional (cfg.enableStella2014 or false) stella2014
+      ++ optional (cfg.enableTGBDual or false) tgbdual
+      ++ optional (cfg.enableTIC80 or false) tic80
       ++ optional (cfg.enableVbaNext or false) vba-next
       ++ optional (cfg.enableVbaM or false) vba-m
       ++ optional (cfg.enableVecx or false) vecx
       ++ optional (cfg.enableVirtualJaguar or false) virtualjaguar
       ++ optional (cfg.enableYabause or false) yabause
-      # added on 2017-02-25 due #23163
-      ++ optional (cfg.enableMednafenPCEFast or false)
-          (throw "nix config option enableMednafenPCEFast has been renamed to enableBeetlePCEFast")
-      ++ optional (cfg.enableMednafenPSX or false)
-          (throw "nix config option enableMednafenPSX has been renamed to enableBeetlePSX")
-      ++ optional (cfg.enableMednafenSaturn or false)
-          (throw "nix config option enableMednafenSaturn has been renamed to enableBeetleSaturn")
       );
 
   wrapRetroArch = { retroarch }: callPackage ../misc/emulators/retroarch/wrapper.nix {
@@ -22953,7 +23183,7 @@ in
   freicoin = callPackage ../applications/blockchains/freicoin.nix { boost = boost155; };
   go-ethereum = callPackage ../applications/blockchains/go-ethereum.nix {
     inherit (darwin) libobjc;
-    inherit (darwin.apple_sdk.frameworks) IOKit;
+    inherit (darwin.apple_sdk.frameworks) CoreServices IOKit;
   };
 
   ledger_agent = with python3Packages; toPythonApplication ledger_agent;
@@ -22967,14 +23197,17 @@ in
 
   lnd = callPackage ../applications/blockchains/lnd.nix {
     buildGoModule = buildGo112Module;
+    inherit (darwin.apple_sdk.frameworks) Security;
   };
 
   monero = callPackage ../applications/blockchains/monero {
     inherit (darwin.apple_sdk.frameworks) CoreData IOKit PCSC;
+    pythonProtobuf = python3Packages.protobuf.override { protobuf = protobuf3_10; };
   };
 
   monero-gui = libsForQt5.callPackage ../applications/blockchains/monero-gui {
     boost = boost16x;
+    protobuf = protobuf3_10;
   };
 
   masari = callPackage ../applications/blockchains/masari.nix { boost = boost165; };
@@ -23678,7 +23911,6 @@ in
 
   spring = callPackage ../games/spring {
     boost = boost155;
-    cmake = cmake_2_8;
   };
 
   springLobby = callPackage ../games/spring/springlobby.nix { };
@@ -23960,6 +24192,7 @@ in
     clipboard-indicator = callPackage ../desktops/gnome-3/extensions/clipboard-indicator { };
     dash-to-dock = callPackage ../desktops/gnome-3/extensions/dash-to-dock { };
     dash-to-panel = callPackage ../desktops/gnome-3/extensions/dash-to-panel { };
+    draw-on-your-screen = callPackage ../desktops/gnome-3/extensions/draw-on-your-screen { };
     drop-down-terminal = callPackage ../desktops/gnome-3/extensions/drop-down-terminal { };
     gsconnect = callPackage ../desktops/gnome-3/extensions/gsconnect { };
     icon-hider = callPackage ../desktops/gnome-3/extensions/icon-hider { };
@@ -24398,6 +24631,8 @@ in
   suitesparse_5_3 = callPackage ../development/libraries/science/math/suitesparse {};
   suitesparse = suitesparse_5_3;
 
+  suitesparse-graphblas = callPackage ../development/libraries/science/math/suitesparse-graphblas {};
+
   superlu = callPackage ../development/libraries/science/math/superlu {};
 
   symmetrica = callPackage ../applications/science/math/symmetrica {};
@@ -24950,7 +25185,9 @@ in
 
   ataripp = callPackage ../misc/emulators/atari++ { };
 
-  atlantis = callPackage ../applications/networking/cluster/atlantis { };
+  atlantis = callPackage ../applications/networking/cluster/atlantis {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   auctex = callPackage ../tools/typesetting/tex/auctex { };
 
@@ -25138,7 +25375,9 @@ in
     binutils-arm-embedded = pkgsCross.arm-embedded.buildPackages.binutils;
   };
 
-  gobuster = callPackage ../tools/security/gobuster { };
+  gobuster = callPackage ../tools/security/gobuster {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   guetzli = callPackage ../applications/graphics/guetzli { };
 
@@ -25152,7 +25391,9 @@ in
     stdenv = gcc8Stdenv;
   };
 
-  helmfile = callPackage ../applications/networking/cluster/helmfile { };
+  helmfile = callPackage ../applications/networking/cluster/helmfile {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   heptio-ark = callPackage ../applications/networking/cluster/heptio-ark { };
 
@@ -25247,6 +25488,8 @@ in
 
   mongoc = callPackage ../development/libraries/mongoc { };
 
+  mongoose = callPackage ../development/libraries/science/math/mongoose {};
+
   morph = callPackage ../tools/package-management/morph { };
 
   mupen64plus = callPackage ../misc/emulators/mupen64plus { };
@@ -25255,7 +25498,9 @@ in
 
   musly = callPackage ../applications/audio/musly { };
 
-  mynewt-newt = callPackage ../tools/package-management/mynewt-newt { };
+  mynewt-newt = callPackage ../tools/package-management/mynewt-newt {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   inherit (callPackage ../tools/package-management/nix {
       storeDir = config.nix.storeDir or "/nix/store";
@@ -25722,12 +25967,15 @@ in
 
   sqsh = callPackage ../development/tools/sqsh { };
 
-  jx = callPackage ../applications/networking/cluster/jx {};
+  jx = callPackage ../applications/networking/cluster/jx {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   prow = callPackage ../applications/networking/cluster/prow {
     # Version 2019-08-14 fails to build with go 1.13 due to dependencies:
     #   go: golang.org/x/lint@v0.0.0-20190301231843-5614ed5bae6f used for two different module paths (github.com/golang/lint and golang.org/x/lint)
     buildGoModule = buildGo112Module;
+    inherit (darwin.apple_sdk.frameworks) Security;
   };
 
   inherit (callPackage ../applications/networking/cluster/terraform {
@@ -25747,6 +25995,7 @@ in
   terraform-providers = recurseIntoAttrs (
     callPackage ../applications/networking/cluster/terraform-providers {
       inherit buildGo112Module;
+      inherit (darwin.apple_sdk.frameworks) Security;
     }
   );
 
@@ -25867,7 +26116,9 @@ in
 
   webfs = callPackage ../servers/http/webfs { };
 
-  websocketd = callPackage ../applications/networking/websocketd { };
+  websocketd = callPackage ../applications/networking/websocketd {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   wikicurses = callPackage ../applications/misc/wikicurses {
     pythonPackages = python3Packages;
@@ -26087,7 +26338,9 @@ in
 
   zimg = callPackage ../development/libraries/zimg { };
 
-  wtf = callPackage ../applications/misc/wtf { };
+  wtf = callPackage ../applications/misc/wtf {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   zk-shell = callPackage ../applications/misc/zk-shell { };
 
@@ -26251,17 +26504,23 @@ in
 
   sieveshell = with python3.pkgs; toPythonApplication managesieve;
 
-  gortr = callPackage ../servers/gortr {};
+  gortr = callPackage ../servers/gortr {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   sentencepiece = callPackage ../development/libraries/sentencepiece {};
 
-  kcli = callPackage ../development/tools/kcli {};
+  kcli = callPackage ../development/tools/kcli {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   unstick = callPackage ../os-specific/linux/unstick {};
 
   quartus-prime-lite = callPackage ../applications/editors/quartus-prime {};
 
-  go-license-detector = callPackage ../development/tools/misc/go-license-detector { };
+  go-license-detector = callPackage ../development/tools/misc/go-license-detector {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   hashdeep = callPackage ../tools/security/hashdeep { };