about summary refs log tree commit diff
path: root/nixpkgs/pkgs/tools
diff options
context:
space:
mode:
Diffstat (limited to 'nixpkgs/pkgs/tools')
-rw-r--r--nixpkgs/pkgs/tools/X11/nx-libs/default.nix44
-rw-r--r--nixpkgs/pkgs/tools/X11/xnee/default.nix2
-rw-r--r--nixpkgs/pkgs/tools/admin/certbot/default.nix22
-rw-r--r--nixpkgs/pkgs/tools/admin/nxproxy/default.nix30
-rw-r--r--nixpkgs/pkgs/tools/archivers/rpmextract/default.nix1
-rw-r--r--nixpkgs/pkgs/tools/archivers/rpmextract/rpmextract.sh2
-rw-r--r--nixpkgs/pkgs/tools/archivers/unzip/CVE-2018-18384.patch35
-rw-r--r--nixpkgs/pkgs/tools/archivers/unzip/default.nix1
-rw-r--r--nixpkgs/pkgs/tools/audio/abcmidi/default.nix4
-rw-r--r--nixpkgs/pkgs/tools/backup/easysnap/default.nix6
-rw-r--r--nixpkgs/pkgs/tools/backup/flockit/default.nix2
-rw-r--r--nixpkgs/pkgs/tools/backup/pyznap/default.nix28
-rw-r--r--nixpkgs/pkgs/tools/backup/rdedup/default.nix19
-rw-r--r--nixpkgs/pkgs/tools/backup/rdedup/v3.1.1-fix-Cargo.lock.patch28
-rw-r--r--nixpkgs/pkgs/tools/backup/restic/default.nix4
-rw-r--r--nixpkgs/pkgs/tools/backup/store-backup/default.nix2
-rw-r--r--nixpkgs/pkgs/tools/bluetooth/blueman/default.nix4
-rw-r--r--nixpkgs/pkgs/tools/cd-dvd/brasero/default.nix2
-rw-r--r--nixpkgs/pkgs/tools/cd-dvd/brasero/wrapper.nix7
-rw-r--r--nixpkgs/pkgs/tools/filesystems/bcachefs-tools/default.nix6
-rw-r--r--nixpkgs/pkgs/tools/filesystems/e2fsprogs/default.nix2
-rw-r--r--nixpkgs/pkgs/tools/filesystems/fuse-overlayfs/default.nix44
-rw-r--r--nixpkgs/pkgs/tools/graphics/briss/default.nix2
-rw-r--r--nixpkgs/pkgs/tools/graphics/graphviz/base.nix20
-rw-r--r--nixpkgs/pkgs/tools/graphics/lepton/default.nix24
-rw-r--r--nixpkgs/pkgs/tools/graphics/povray/default.nix2
-rw-r--r--nixpkgs/pkgs/tools/graphics/sng/default.nix2
-rw-r--r--nixpkgs/pkgs/tools/graphics/wkhtmltopdf/default.nix2
-rw-r--r--nixpkgs/pkgs/tools/inputmethods/ibus/wrapper.nix2
-rw-r--r--nixpkgs/pkgs/tools/misc/aptly/default.nix8
-rw-r--r--nixpkgs/pkgs/tools/misc/bashplotlib/default.nix6
-rw-r--r--nixpkgs/pkgs/tools/misc/bbe/default.nix22
-rw-r--r--nixpkgs/pkgs/tools/misc/brltty/default.nix4
-rw-r--r--nixpkgs/pkgs/tools/misc/broot/default.nix23
-rw-r--r--nixpkgs/pkgs/tools/misc/calamares/default.nix4
-rw-r--r--nixpkgs/pkgs/tools/misc/coreutils/default.nix3
-rw-r--r--nixpkgs/pkgs/tools/misc/direnv/default.nix4
-rw-r--r--nixpkgs/pkgs/tools/misc/docker-sync/Gemfile3
-rw-r--r--nixpkgs/pkgs/tools/misc/docker-sync/Gemfile.lock29
-rw-r--r--nixpkgs/pkgs/tools/misc/docker-sync/default.nix18
-rw-r--r--nixpkgs/pkgs/tools/misc/docker-sync/gemset.nix76
-rw-r--r--nixpkgs/pkgs/tools/misc/fd/default.nix19
-rw-r--r--nixpkgs/pkgs/tools/misc/fzf/default.nix2
-rw-r--r--nixpkgs/pkgs/tools/misc/gams/default.nix2
-rw-r--r--nixpkgs/pkgs/tools/misc/gh-ost/default.nix12
-rw-r--r--nixpkgs/pkgs/tools/misc/grub/2.0x.nix32
-rw-r--r--nixpkgs/pkgs/tools/misc/grub/relocation-not-implemented.diff25
-rw-r--r--nixpkgs/pkgs/tools/misc/grub/trusted.nix2
-rw-r--r--nixpkgs/pkgs/tools/misc/hashit/default.nix10
-rw-r--r--nixpkgs/pkgs/tools/misc/mpdscribble/default.nix2
-rw-r--r--nixpkgs/pkgs/tools/misc/multitail/default.nix2
-rw-r--r--nixpkgs/pkgs/tools/misc/papis/default.nix8
-rw-r--r--nixpkgs/pkgs/tools/misc/qjoypad/default.nix2
-rw-r--r--nixpkgs/pkgs/tools/misc/skim/default.nix5
-rw-r--r--nixpkgs/pkgs/tools/misc/slurp/default.nix6
-rw-r--r--nixpkgs/pkgs/tools/misc/smenu/default.nix2
-rw-r--r--nixpkgs/pkgs/tools/misc/txr/default.nix4
-rw-r--r--nixpkgs/pkgs/tools/misc/urjtag/default.nix8
-rw-r--r--nixpkgs/pkgs/tools/misc/usbmuxd/default.nix8
-rw-r--r--nixpkgs/pkgs/tools/misc/vdirsyncer/default.nix2
-rw-r--r--nixpkgs/pkgs/tools/misc/vimer/default.nix2
-rw-r--r--nixpkgs/pkgs/tools/misc/watchexec/default.nix4
-rw-r--r--nixpkgs/pkgs/tools/misc/xfstests/default.nix2
-rw-r--r--nixpkgs/pkgs/tools/misc/xsel/default.nix11
-rw-r--r--nixpkgs/pkgs/tools/misc/youtube-dl/default.nix4
-rw-r--r--nixpkgs/pkgs/tools/misc/yubikey-manager-qt/default.nix78
-rw-r--r--nixpkgs/pkgs/tools/networking/airfield/default.nix2
-rw-r--r--nixpkgs/pkgs/tools/networking/curl/default.nix4
-rw-r--r--nixpkgs/pkgs/tools/networking/flannel/default.nix6
-rw-r--r--nixpkgs/pkgs/tools/networking/getmail/default.nix4
-rw-r--r--nixpkgs/pkgs/tools/networking/http-prompt/default.nix2
-rw-r--r--nixpkgs/pkgs/tools/networking/lftp/default.nix4
-rw-r--r--nixpkgs/pkgs/tools/networking/lldpd/default.nix5
-rw-r--r--nixpkgs/pkgs/tools/networking/netmask/default.nix4
-rw-r--r--nixpkgs/pkgs/tools/networking/network-manager/applet.nix4
-rw-r--r--nixpkgs/pkgs/tools/networking/network-manager/openvpn/default.nix4
-rw-r--r--nixpkgs/pkgs/tools/networking/p2p/tahoe-lafs/default.nix8
-rw-r--r--nixpkgs/pkgs/tools/networking/slirp4netns/default.nix25
-rw-r--r--nixpkgs/pkgs/tools/networking/ssmtp/default.nix2
-rw-r--r--nixpkgs/pkgs/tools/networking/tcpdump/default.nix2
-rw-r--r--nixpkgs/pkgs/tools/networking/zap/default.nix2
-rw-r--r--nixpkgs/pkgs/tools/package-management/disnix/dysnomia/default.nix4
-rw-r--r--nixpkgs/pkgs/tools/package-management/morph/default.nix10
-rw-r--r--nixpkgs/pkgs/tools/package-management/nix-prefetch/default.nix70
-rw-r--r--nixpkgs/pkgs/tools/package-management/nix/default.nix7
-rw-r--r--nixpkgs/pkgs/tools/security/bitwarden-cli/default.nix18
-rw-r--r--nixpkgs/pkgs/tools/security/bitwarden-cli/node-packages-generated.nix549
-rw-r--r--nixpkgs/pkgs/tools/security/bitwarden-cli/node-packages.json3
-rw-r--r--nixpkgs/pkgs/tools/security/bitwarden-cli/node-packages.nix17
-rw-r--r--nixpkgs/pkgs/tools/security/eid-mw/default.nix14
-rw-r--r--nixpkgs/pkgs/tools/security/ibm-sw-tpm2/default.nix39
-rw-r--r--nixpkgs/pkgs/tools/security/lynis/default.nix4
-rw-r--r--nixpkgs/pkgs/tools/security/mkp224o/default.nix47
-rw-r--r--nixpkgs/pkgs/tools/security/pass/rofi-pass.nix4
-rw-r--r--nixpkgs/pkgs/tools/security/pgpdump/default.nix2
-rw-r--r--nixpkgs/pkgs/tools/security/rhash/default.nix11
-rw-r--r--nixpkgs/pkgs/tools/security/tpm2-tools/default.nix38
-rw-r--r--nixpkgs/pkgs/tools/security/vault/default.nix4
-rw-r--r--nixpkgs/pkgs/tools/system/gotop/default.nix6
-rw-r--r--nixpkgs/pkgs/tools/system/gotop/deps.nix39
-rw-r--r--nixpkgs/pkgs/tools/system/osquery/default.nix14
-rwxr-xr-xnixpkgs/pkgs/tools/typesetting/lout/builder.sh2
-rw-r--r--nixpkgs/pkgs/tools/video/mjpegtools/default.nix2
-rw-r--r--nixpkgs/pkgs/tools/virtualization/google-compute-engine-oslogin/default.nix2
104 files changed, 1503 insertions, 284 deletions
diff --git a/nixpkgs/pkgs/tools/X11/nx-libs/default.nix b/nixpkgs/pkgs/tools/X11/nx-libs/default.nix
new file mode 100644
index 000000000000..bd81ab9d8fd7
--- /dev/null
+++ b/nixpkgs/pkgs/tools/X11/nx-libs/default.nix
@@ -0,0 +1,44 @@
+{ stdenv, autoconf, automake, bash, fetchFromGitHub, libgcc, libjpeg_turbo,
+  libpng, libtool, libxml2, pkgconfig, which, xorg }:
+stdenv.mkDerivation rec {
+  name = "nx-libs-${version}";
+  version = "3.5.99.18";
+  src = fetchFromGitHub {
+    owner = "ArcticaProject";
+    repo = "nx-libs";
+    rev = version;
+    sha256 = "07559zk9flzfnyr2ngcdr3nzccga4bl30wghalhrvpgpyljivdyv";
+  };
+
+  nativeBuildInputs = [ autoconf automake libtool pkgconfig which
+    xorg.gccmakedep xorg.imake ];
+  buildInputs = [ libgcc libjpeg_turbo libpng libxml2 xorg.fontutil
+    xorg.libXcomposite xorg.libXdamage xorg.libXdmcp xorg.libXext xorg.libXfont2
+    xorg.libXinerama xorg.libXpm xorg.libXrandr xorg.libXtst xorg.pixman
+    xorg.xkbcomp xorg.xkeyboardconfig ];
+
+  enableParallelBuilding = true;
+
+  postPatch = ''
+    patchShebangs .
+    find . -type f -name Makefile -exec sed -i 's|^\(SHELL:=\)/bin/bash$|\1${stdenv.shell}|g' {} \;
+    ln -s libNX_X11.so.6.3.0
+  '';
+
+  PREFIX=""; # Don't install to $out/usr/local
+  installPhase = ''
+    make DESTDIR="$out" install
+    # See:
+    # - https://salsa.debian.org/debian-remote-team/nx-libs/blob/bcc152100617dc59156015a36603a15db530a64f/debian/rules#L66-72
+    # - https://github.com/ArcticaProject/nx-libs/issues/652
+    patchelf --remove-needed "libX11.so.6" $out/bin/nxagent
+  '';
+
+  meta = {
+    description = "NX X server based on Xnest";
+    homepage = https://github.com/ArcticaProject/nx-libs;
+    license = stdenv.lib.licenses.gpl2;
+    maintainers = with stdenv.lib.maintainers; [ jD91mZM2 ];
+    platforms = stdenv.lib.platforms.linux;
+  };
+}
diff --git a/nixpkgs/pkgs/tools/X11/xnee/default.nix b/nixpkgs/pkgs/tools/X11/xnee/default.nix
index 7b7d5d1aeedc..a84f101cdf7b 100644
--- a/nixpkgs/pkgs/tools/X11/xnee/default.nix
+++ b/nixpkgs/pkgs/tools/X11/xnee/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   patchPhase =
     '' for i in `find cnee/test -name \*.sh`
        do
-         sed -i "$i" -e's|/bin/bash|/bin/sh|g ; s|/usr/bin/env bash|/bin/sh|g'
+         sed -i "$i" -e's|/bin/bash|${stdenv.shell}|g ; s|/usr/bin/env bash|${stdenv.shell}|g'
        done
     '';
 
diff --git a/nixpkgs/pkgs/tools/admin/certbot/default.nix b/nixpkgs/pkgs/tools/admin/certbot/default.nix
index 353abe9c8bca..782af149ed6a 100644
--- a/nixpkgs/pkgs/tools/admin/certbot/default.nix
+++ b/nixpkgs/pkgs/tools/admin/certbot/default.nix
@@ -1,34 +1,32 @@
-{ stdenv, pythonPackages, fetchFromGitHub, dialog }:
+{ stdenv, python3Packages, fetchFromGitHub, dialog }:
 
-# Latest version of certbot supports python3 and python3 version of pythondialog
-
-pythonPackages.buildPythonApplication rec {
-  name = "certbot-${version}";
-  version = "0.24.0";
+python3Packages.buildPythonApplication rec {
+  pname = "certbot";
+  version = "0.31.0";
 
   src = fetchFromGitHub {
-    owner = "certbot";
-    repo = "certbot";
+    owner = pname;
+    repo = pname;
     rev = "v${version}";
-    sha256 = "0gsq4si0bqwzd7ywf87y7bbprqg1m72qdj11h64qmwb5zl4vh444";
+    sha256 = "0rwjxmkpicyc9a5janvj1lfi430nq6ha94nyfgp11ds9fyydbh1s";
   };
 
-  propagatedBuildInputs = with pythonPackages; [
+  propagatedBuildInputs = with python3Packages; [
     ConfigArgParse
     acme
     configobj
     cryptography
+    josepy
     parsedatetime
     psutil
     pyRFC3339
     pyopenssl
-    python2-pythondialog
     pytz
     six
     zope_component
     zope_interface
   ];
-  buildInputs = [ dialog ] ++ (with pythonPackages; [ nose mock gnureadline ]);
+  buildInputs = [ dialog ] ++ (with python3Packages; [ mock gnureadline ]);
 
   patchPhase = ''
     substituteInPlace certbot/notify.py --replace "/usr/sbin/sendmail" "/run/wrappers/bin/sendmail"
diff --git a/nixpkgs/pkgs/tools/admin/nxproxy/default.nix b/nixpkgs/pkgs/tools/admin/nxproxy/default.nix
deleted file mode 100644
index 45ec8bb72e3b..000000000000
--- a/nixpkgs/pkgs/tools/admin/nxproxy/default.nix
+++ /dev/null
@@ -1,30 +0,0 @@
-{ stdenv, fetchurl, autoreconfHook, pkgconfig, libxcomp }:
-
-stdenv.mkDerivation rec {
-  name = "nxproxy-${version}";
-  version = "3.5.99.17-1";
-
-  src = fetchurl {
-    sha256 = "18a7cvjnaf50lf1cc5axx9jmi8n9g75d2i5y4s6q9r3phpwyp918";
-    url = "https://code.x2go.org/releases/source/nx-libs/nx-libs-${version}-lite.tar.gz";
-  };
-
-  buildInputs = [ libxcomp ];
-  nativeBuildInputs = [ autoreconfHook pkgconfig ];
-
-  preAutoreconf = ''
-    cd nxproxy/
-    sed -i 's|-L\$(top_srcdir)/../nxcomp/src/.libs ||' src/Makefile.am
-  '';
-
-  makeFlags = [ "exec_prefix=$(out)" ];
-
-  enableParallelBuilding = true;
-
-  meta = with stdenv.lib; {
-    description = "NX compression proxy";
-    homepage = http://wiki.x2go.org/doku.php/wiki:libs:nx-libs;
-    license = licenses.gpl2;
-    platforms = platforms.linux;
-  };
-}
diff --git a/nixpkgs/pkgs/tools/archivers/rpmextract/default.nix b/nixpkgs/pkgs/tools/archivers/rpmextract/default.nix
index 8d4d5fd8dddd..6d5041c52d03 100644
--- a/nixpkgs/pkgs/tools/archivers/rpmextract/default.nix
+++ b/nixpkgs/pkgs/tools/archivers/rpmextract/default.nix
@@ -10,6 +10,7 @@ stdenv.mkDerivation rec {
   script = substituteAll {
     src = ./rpmextract.sh;
     inherit rpm cpio;
+    inherit (stdenv) shell;
   };
 
   meta = with stdenv.lib; {
diff --git a/nixpkgs/pkgs/tools/archivers/rpmextract/rpmextract.sh b/nixpkgs/pkgs/tools/archivers/rpmextract/rpmextract.sh
index 04f57f6e6045..6ebfa251955d 100644
--- a/nixpkgs/pkgs/tools/archivers/rpmextract/rpmextract.sh
+++ b/nixpkgs/pkgs/tools/archivers/rpmextract/rpmextract.sh
@@ -1,4 +1,4 @@
-#!/bin/sh -e
+#!@shell@ -e
 
 if [ "$1" = "" ]; then
   echo "usage: rpmextract package_name..." 1>&2
diff --git a/nixpkgs/pkgs/tools/archivers/unzip/CVE-2018-18384.patch b/nixpkgs/pkgs/tools/archivers/unzip/CVE-2018-18384.patch
new file mode 100644
index 000000000000..e9320e125cf6
--- /dev/null
+++ b/nixpkgs/pkgs/tools/archivers/unzip/CVE-2018-18384.patch
@@ -0,0 +1,35 @@
+--- unzip60/list.c	
++++ unzip60/list.c	
+@@ -97,7 +97,7 @@ int list_files(__G)    /* return PK-type
+ {
+     int do_this_file=FALSE, cfactor, error, error_in_archive=PK_COOL;
+ #ifndef WINDLL
+-    char sgn, cfactorstr[10];
++    char sgn, cfactorstr[1+10+1+1];	/* <sgn><int>%NUL */
+     int longhdr=(uO.vflag>1);
+ #endif
+     int date_format;
+@@ -389,9 +389,9 @@ int list_files(__G)    /* return PK-type
+             }
+ #else /* !WINDLL */
+             if (cfactor == 100)
+-                sprintf(cfactorstr, LoadFarString(CompFactor100));
++                snprintf(cfactorstr, sizeof(cfactorstr), LoadFarString(CompFactor100));
+             else
+-                sprintf(cfactorstr, LoadFarString(CompFactorStr), sgn, cfactor);
++                snprintf(cfactorstr, sizeof(cfactorstr), LoadFarString(CompFactorStr), sgn, cfactor);
+             if (longhdr)
+                 Info(slide, 0, ((char *)slide, LoadFarString(LongHdrStats),
+                   FmZofft(G.crec.ucsize, "8", "u"), methbuf,
+@@ -471,9 +471,9 @@ int list_files(__G)    /* return PK-type
+ 
+ #else /* !WINDLL */
+         if (cfactor == 100)
+-            sprintf(cfactorstr, LoadFarString(CompFactor100));
++            snprintf(cfactorstr, sizeof(cfactorstr), LoadFarString(CompFactor100));
+         else
+-            sprintf(cfactorstr, LoadFarString(CompFactorStr), sgn, cfactor);
++            snprintf(cfactorstr, sizeof(cfactorstr), LoadFarString(CompFactorStr), sgn, cfactor);
+         if (longhdr) {
+             Info(slide, 0, ((char *)slide, LoadFarString(LongFileTrailer),
+               FmZofft(tot_ucsize, "8", "u"), FmZofft(tot_csize, "8", "u"),
diff --git a/nixpkgs/pkgs/tools/archivers/unzip/default.nix b/nixpkgs/pkgs/tools/archivers/unzip/default.nix
index 7c4bb988b629..cdf189e82df5 100644
--- a/nixpkgs/pkgs/tools/archivers/unzip/default.nix
+++ b/nixpkgs/pkgs/tools/archivers/unzip/default.nix
@@ -24,6 +24,7 @@ stdenv.mkDerivation {
     ./CVE-2015-7697.diff
     ./CVE-2014-9913.patch
     ./CVE-2016-9844.patch
+    ./CVE-2018-18384.patch
     ./dont-hardcode-cc.patch
   ] ++ stdenv.lib.optional enableNLS
     (fetchurl {
diff --git a/nixpkgs/pkgs/tools/audio/abcmidi/default.nix b/nixpkgs/pkgs/tools/audio/abcmidi/default.nix
index ffea29691d69..7a6d4e6d3ab9 100644
--- a/nixpkgs/pkgs/tools/audio/abcmidi/default.nix
+++ b/nixpkgs/pkgs/tools/audio/abcmidi/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "abcMIDI-${version}";
-  version = "2019.01.01";
+  version = "2019.02.08";
 
   src = fetchzip {
     url = "https://ifdo.ca/~seymour/runabc/${name}.zip";
-    sha256 = "10kqxw4vrz7xa8fc9z5cdyrvks8fsr2s9nai9yg1z9p5w7xhagrg";
+    sha256 = "14j2vgcck7c6x8bplhfng7mmqcmh7h98jggi30d5xa0anx1271sb";
   };
 
   # There is also a file called "makefile" which seems to be preferred by the standard build phase
diff --git a/nixpkgs/pkgs/tools/backup/easysnap/default.nix b/nixpkgs/pkgs/tools/backup/easysnap/default.nix
index d8643dbf9074..ceb6feae3962 100644
--- a/nixpkgs/pkgs/tools/backup/easysnap/default.nix
+++ b/nixpkgs/pkgs/tools/backup/easysnap/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "easysnap-${version}";
-  version = "unstable-2018-11-20";
+  version = "unstable-2019-02-17";
 
   src = fetchFromGitHub {
     owner = "sjau";
     repo = "easysnap";
-    rev = "dbf58c06a339cb040dbdcaf7e6ffec5af4add3c7";
-    sha256 = "0rvikmj2k103ffgnvkway8n6ajq0vzwcxb4l5vhka1hqh8047lam";
+    rev = "9ef5d1ff51ccf9939a88b7b32b4959d27cf61ecc";
+    sha256 = "0m0217ni909nham15w5vxg8y7cw2zwjibnhvgnpxxsap8zkhv1m4";
   };
 
   installPhase = ''
diff --git a/nixpkgs/pkgs/tools/backup/flockit/default.nix b/nixpkgs/pkgs/tools/backup/flockit/default.nix
index e569d9b6d598..e6284aa42d75 100644
--- a/nixpkgs/pkgs/tools/backup/flockit/default.nix
+++ b/nixpkgs/pkgs/tools/backup/flockit/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     cp ./libflockit.so $out/lib
 
     (cat <<EOI
-    #!/bin/sh
+    #!${stdenv.shell}
     env LD_PRELOAD="$out/lib/libflockit.so" FLOCKIT_FILE_PREFIX=\$1 \''${@:2}
     EOI
     ) > $out/bin/flockit
diff --git a/nixpkgs/pkgs/tools/backup/pyznap/default.nix b/nixpkgs/pkgs/tools/backup/pyznap/default.nix
new file mode 100644
index 000000000000..e37327c429d5
--- /dev/null
+++ b/nixpkgs/pkgs/tools/backup/pyznap/default.nix
@@ -0,0 +1,28 @@
+{ lib
+, buildPythonApplication
+, fetchPypi
+, paramiko
+, configparser
+}:
+
+buildPythonApplication rec {
+  pname = "pyznap";
+  version = "1.1.2";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "9ac0da5d7f6461d1d6f128362786e297144b415f9e3a2f1835642ab3dda82d55";
+  };
+
+  propagatedBuildInputs = [ configparser paramiko ];
+
+  # tests aren't included in the PyPI packages
+  doCheck = false;
+
+  meta = {
+    homepage = "https://github.com/yboetz/pyznap";
+    description = "ZFS snapshot tool written in python";
+    license = with lib.licenses; [ gpl3 ];
+    maintainers = with lib.maintainers; [ rbrewer ];
+  };
+}
diff --git a/nixpkgs/pkgs/tools/backup/rdedup/default.nix b/nixpkgs/pkgs/tools/backup/rdedup/default.nix
index 10cb1edb62a9..2d18fc5832f6 100644
--- a/nixpkgs/pkgs/tools/backup/rdedup/default.nix
+++ b/nixpkgs/pkgs/tools/backup/rdedup/default.nix
@@ -1,21 +1,27 @@
 { stdenv, fetchFromGitHub, rustPlatform, pkgconfig, openssl, libsodium
-, llvmPackages, clang_39, lzma }:
+, llvmPackages, clang_39, lzma
+, Security }:
 
 rustPlatform.buildRustPackage rec {
   name = "rdedup-${version}";
-  version = "3.0.1";
+  version = "3.1.1";
 
   src = fetchFromGitHub {
     owner = "dpc";
     repo = "rdedup";
-    rev = "e0f26f379a434f76d238c7a5fa6ddd8ae8b32f19";
-    sha256 = "1nhf8ap0w99aa1h0l599cx90lcvfvjaj67nw9flq9bmmzpn53kp9";
+    rev = "rdedup-v${version}";
+    sha256 = "0y34a3mpghdmcb2rx4z62q0s351bfmy1287d75mm07ryfgglgsd7";
   };
 
-  cargoSha256 = "1x6wchlcxb1frww6y04gfx4idxv9h0g9qfxrhgb6g5qy3bqhqq3p";
+  cargoSha256 = "0p19qcz2ph6axfccjwc6z72hrlb48l7sf1n0hc1gfq8hj2s3k2s1";
+
+  patches = [
+    ./v3.1.1-fix-Cargo.lock.patch
+  ];
 
   nativeBuildInputs = [ pkgconfig llvmPackages.libclang clang_39 ];
-  buildInputs = [ openssl libsodium lzma ];
+  buildInputs = [ openssl libsodium lzma ]
+    ++ (stdenv.lib.optional stdenv.isDarwin Security);
 
   configurePhase = ''
     export LIBCLANG_PATH="${llvmPackages.libclang}/lib"
@@ -27,5 +33,6 @@ rustPlatform.buildRustPackage rec {
     license = licenses.mpl20;
     maintainers = with maintainers; [ dywedir ];
     platforms = platforms.all;
+    broken = stdenv.isDarwin;
   };
 }
diff --git a/nixpkgs/pkgs/tools/backup/rdedup/v3.1.1-fix-Cargo.lock.patch b/nixpkgs/pkgs/tools/backup/rdedup/v3.1.1-fix-Cargo.lock.patch
new file mode 100644
index 000000000000..7dafc7765b7d
--- /dev/null
+++ b/nixpkgs/pkgs/tools/backup/rdedup/v3.1.1-fix-Cargo.lock.patch
@@ -0,0 +1,28 @@
+diff --git a/Cargo.lock b/Cargo.lock
+index 96be83a..fe07471 100644
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -880,12 +880,12 @@ dependencies = [
+ 
+ [[package]]
+ name = "rdedup"
+-version = "3.1.0"
++version = "3.1.1"
+ dependencies = [
+  "clap 2.32.0 (registry+https://github.com/rust-lang/crates.io-index)",
+  "hex 0.3.2 (registry+https://github.com/rust-lang/crates.io-index)",
+  "log 0.3.9 (registry+https://github.com/rust-lang/crates.io-index)",
+- "rdedup-lib 3.0.0",
++ "rdedup-lib 3.1.0",
+  "rpassword 2.0.0 (registry+https://github.com/rust-lang/crates.io-index)",
+  "slog 2.3.2 (registry+https://github.com/rust-lang/crates.io-index)",
+  "slog-async 2.3.0 (registry+https://github.com/rust-lang/crates.io-index)",
+@@ -900,7 +900,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
+ 
+ [[package]]
+ name = "rdedup-lib"
+-version = "3.0.0"
++version = "3.1.0"
+ dependencies = [
+  "backblaze-b2 0.1.8 (registry+https://github.com/rust-lang/crates.io-index)",
+  "base64 0.9.2 (registry+https://github.com/rust-lang/crates.io-index)",
diff --git a/nixpkgs/pkgs/tools/backup/restic/default.nix b/nixpkgs/pkgs/tools/backup/restic/default.nix
index 453e31f5d13a..7b039f93a039 100644
--- a/nixpkgs/pkgs/tools/backup/restic/default.nix
+++ b/nixpkgs/pkgs/tools/backup/restic/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   name = "restic-${version}";
-  version = "0.9.2";
+  version = "0.9.4";
 
   goPackagePath = "github.com/restic/restic";
 
@@ -10,7 +10,7 @@ buildGoPackage rec {
     owner = "restic";
     repo = "restic";
     rev = "v${version}";
-    sha256 = "0kl8yk636i3y7f2kd43pydjh4pv7hhq09p5k54jlysnrbf2kjb4h";
+    sha256 = "15lx01w46bwn3hjwpmm8xy71m7ml9wdwddbbfvmk5in61gv1acr5";
   };
 
   buildPhase = ''
diff --git a/nixpkgs/pkgs/tools/backup/store-backup/default.nix b/nixpkgs/pkgs/tools/backup/store-backup/default.nix
index 5f44e19fdf27..7324f75d95fa 100644
--- a/nixpkgs/pkgs/tools/backup/store-backup/default.nix
+++ b/nixpkgs/pkgs/tools/backup/store-backup/default.nix
@@ -9,7 +9,7 @@
 
 # known impurity: test cases seem to bu using /tmp/storeBackup.lock ..
 
-let dummyMount = writeScriptBin "mount" "#!/bin/sh";
+let dummyMount = writeScriptBin "mount" "#!${stdenv.shell}";
 in
 
 stdenv.mkDerivation rec {
diff --git a/nixpkgs/pkgs/tools/bluetooth/blueman/default.nix b/nixpkgs/pkgs/tools/bluetooth/blueman/default.nix
index 63affdde7183..84a2375302f7 100644
--- a/nixpkgs/pkgs/tools/bluetooth/blueman/default.nix
+++ b/nixpkgs/pkgs/tools/bluetooth/blueman/default.nix
@@ -1,7 +1,7 @@
-{ stdenv, lib, fetchurl, intltool, pkgconfig, python3Packages, bluez, gtk3
+{ config, stdenv, lib, fetchurl, intltool, pkgconfig, python3Packages, bluez, gtk3
 , obex_data_server, xdg_utils, libnotify, dnsmasq, dhcp
 , hicolor-icon-theme, librsvg, wrapGAppsHook, gobject-introspection
-, withPulseAudio ? true, libpulseaudio }:
+, withPulseAudio ? config.pulseaudio or stdenv.isLinux, libpulseaudio }:
 
 let
   pythonPackages = python3Packages;
diff --git a/nixpkgs/pkgs/tools/cd-dvd/brasero/default.nix b/nixpkgs/pkgs/tools/cd-dvd/brasero/default.nix
index 753bdd49959c..402073ff5241 100644
--- a/nixpkgs/pkgs/tools/cd-dvd/brasero/default.nix
+++ b/nixpkgs/pkgs/tools/cd-dvd/brasero/default.nix
@@ -2,8 +2,6 @@
 , libcanberra-gtk3, intltool, dvdauthor, libburn, libisofs
 , vcdimager, wrapGAppsHook, hicolor-icon-theme }:
 
-# libdvdcss is "too old" (in fast "too new"), see https://bugs.launchpad.net/ubuntu/+source/brasero/+bug/611590
-
 let
   major = "3.12";
   minor = "2";
diff --git a/nixpkgs/pkgs/tools/cd-dvd/brasero/wrapper.nix b/nixpkgs/pkgs/tools/cd-dvd/brasero/wrapper.nix
index 7f97209a4aa9..8112b0971f3d 100644
--- a/nixpkgs/pkgs/tools/cd-dvd/brasero/wrapper.nix
+++ b/nixpkgs/pkgs/tools/cd-dvd/brasero/wrapper.nix
@@ -1,4 +1,4 @@
-{ lib, symlinkJoin, brasero-original, cdrtools, makeWrapper }:
+{ lib, symlinkJoin, brasero-original, cdrtools, libdvdcss, makeWrapper }:
 
 let
   binPath = lib.makeBinPath [ cdrtools ];
@@ -10,8 +10,9 @@ in symlinkJoin {
 
   postBuild = ''
     wrapProgram $out/bin/brasero \
-      --prefix PATH ':' ${binPath}
+      --prefix PATH ':' ${binPath} \
+      --prefix LD_PRELOAD : ${lib.makeLibraryPath [ libdvdcss ]}/libdvdcss.so
   '';
-  
+
   inherit (brasero-original) meta;
 }
diff --git a/nixpkgs/pkgs/tools/filesystems/bcachefs-tools/default.nix b/nixpkgs/pkgs/tools/filesystems/bcachefs-tools/default.nix
index eefc0beb1fcc..fc55352fa126 100644
--- a/nixpkgs/pkgs/tools/filesystems/bcachefs-tools/default.nix
+++ b/nixpkgs/pkgs/tools/filesystems/bcachefs-tools/default.nix
@@ -3,12 +3,12 @@
 
 stdenv.mkDerivation rec {
   pname = "bcachefs-tools";
-  version = "2019-01-23";
+  version = "2019-02-09";
 
   src = fetchgit {
     url = "https://evilpiepirate.org/git/bcachefs-tools.git";
-    rev = "35fca2f044d375b1590f499cfd34bef38ca0f8f1";
-    sha256 = "1mmpwksszdi4n7zv3fm7qnmfk94m56d65lfw30553bnfm3yaz3k7";
+    rev = "17c5215c1c542dd7b6b4f891a0da16d8c98e0591";
+    sha256 = "1zm2lnvijfmz483m2nhxz1rhk7ghgh0c450nyiwi6wa7lc1y3339";
   };
 
   enableParallelBuilding = true;
diff --git a/nixpkgs/pkgs/tools/filesystems/e2fsprogs/default.nix b/nixpkgs/pkgs/tools/filesystems/e2fsprogs/default.nix
index 2c597ccef35e..806469493900 100644
--- a/nixpkgs/pkgs/tools/filesystems/e2fsprogs/default.nix
+++ b/nixpkgs/pkgs/tools/filesystems/e2fsprogs/default.nix
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
     homepage = http://e2fsprogs.sourceforge.net/;
     description = "Tools for creating and checking ext2/ext3/ext4 filesystems";
     license = licenses.gpl2;
-    platforms = platforms.linux;
+    platforms = platforms.unix;
     maintainers = [ maintainers.eelco ];
   };
 }
diff --git a/nixpkgs/pkgs/tools/filesystems/fuse-overlayfs/default.nix b/nixpkgs/pkgs/tools/filesystems/fuse-overlayfs/default.nix
index 515fdd4e2608..c4d52462906e 100644
--- a/nixpkgs/pkgs/tools/filesystems/fuse-overlayfs/default.nix
+++ b/nixpkgs/pkgs/tools/filesystems/fuse-overlayfs/default.nix
@@ -1,27 +1,25 @@
-{ pkgs, lib, autoreconfHook, pkgconfig, fuse3 }:
+{ stdenv, lib, fetchFromGitHub, autoreconfHook, pkgconfig, fuse3 }:
 
-let
-  version = "0.2";
-in
-  pkgs.stdenv.mkDerivation {
-    name = "fuse-overlayfs-${version}";
+stdenv.mkDerivation rec {
+  name = "fuse-overlayfs-${version}";
+  version = "0.3";
 
-    src = pkgs.fetchFromGitHub {
-      owner = "containers";
-      repo = "fuse-overlayfs";
-      rev = "1e2b65baa2f75eea0e4bab90b5ac81dd8471256c";
-      sha256 = "0a9ix8rqjs5r28jsriyiv4yq7iilmv69x05kf23s1ihzrvrfkl08";
-    };
+  src = fetchFromGitHub {
+    owner = "containers";
+    repo = "fuse-overlayfs";
+    rev = "v${version}";
+    sha256 = "1cch2j397hydrhh62faqa663vas75qbmylqd06fk6nafasa3ri0l";
+  };
 
-    nativeBuildInputs = [ autoreconfHook pkgconfig ];
-    buildInputs = [ fuse3 ];
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  buildInputs = [ fuse3 ];
 
-    meta = with lib; {
-      homepage = https://github.com/containers/fuse-overlayfs;
-      description = "FUSE implementation for overlayfs";
-      longDescription = "An implementation of overlay+shiftfs in FUSE for rootless containers.";
-      license = licenses.gpl3;
-      platforms = platforms.unix;
-      maintainers = [ maintainers.ma9e ];
-    };
-  }
+  meta = with lib; {
+    homepage = https://github.com/containers/fuse-overlayfs;
+    description = "FUSE implementation for overlayfs";
+    longDescription = "An implementation of overlay+shiftfs in FUSE for rootless containers.";
+    license = licenses.gpl3;
+    platforms = platforms.unix;
+    maintainers = [ maintainers.ma9e ];
+  };
+}
diff --git a/nixpkgs/pkgs/tools/graphics/briss/default.nix b/nixpkgs/pkgs/tools/graphics/briss/default.nix
index a5045f97b45d..fb9b7cae488f 100644
--- a/nixpkgs/pkgs/tools/graphics/briss/default.nix
+++ b/nixpkgs/pkgs/tools/graphics/briss/default.nix
@@ -18,7 +18,7 @@ in stdenv.mkDerivation {
     mkdir -p "$out/bin";
     mkdir -p "$out/share";
     install -D -m444 -t "$out/share" *.jar
-    echo "#!/bin/sh" > "$out/bin/briss"
+    echo "#!${stdenv.shell}" > "$out/bin/briss"
     echo "${jre}/bin/java -Xms128m -Xmx1024m -cp \"$out/share/\" -jar \"$out/share/briss-${version}.jar\"" >> "$out/bin/briss"
     chmod +x "$out/bin/briss"
   '';
diff --git a/nixpkgs/pkgs/tools/graphics/graphviz/base.nix b/nixpkgs/pkgs/tools/graphics/graphviz/base.nix
index 68ff84c7495a..db21df9b5d0d 100644
--- a/nixpkgs/pkgs/tools/graphics/graphviz/base.nix
+++ b/nixpkgs/pkgs/tools/graphics/graphviz/base.nix
@@ -2,12 +2,26 @@
 
 { stdenv, fetchFromGitLab, autoreconfHook, pkgconfig, cairo, expat, flex
 , fontconfig, gd, gettext, gts, libdevil, libjpeg, libpng, libtool, pango
-, yacc, xorg ? null, ApplicationServices ? null }:
+, yacc, fetchpatch, xorg ? null, ApplicationServices ? null }:
 
 assert stdenv.isDarwin -> ApplicationServices != null;
 
 let
   inherit (stdenv.lib) optionals optionalString;
+  raw_patch =
+    # https://gitlab.com/graphviz/graphviz/issues/1367 CVE-2018-10196
+    fetchpatch {
+      name = "CVE-2018-10196.patch";
+      url = https://gitlab.com/graphviz/graphviz/uploads/30f8f0b00e357c112ac35fb20241604a/p.diff;
+      sha256 = "074qx6ch9blrnlilmz7p96fkiz2va84x2fbqdza5k4808rngirc7";
+      excludes = ["tests/*"]; # we don't run them and they don't apply
+    };
+  # the patch needs a small adaption for older versions
+  patch = if stdenv.lib.versionAtLeast version "2.37" then raw_patch else
+  stdenv.mkDerivation {
+    inherit (raw_patch) name;
+    buildCommand = "sed s/dot_root/agroot/g ${raw_patch} > $out";
+  };
 in
 
 stdenv.mkDerivation rec {
@@ -37,6 +51,10 @@ stdenv.mkDerivation rec {
     "--with-ltdl-include=${libtool}/include"
   ] ++ stdenv.lib.optional (xorg == null) [ "--without-x" ];
 
+  patches = [
+    patch
+  ];
+
   postPatch = ''
     for f in $(find . -name Makefile.in); do
       substituteInPlace $f --replace "-lstdc++" "-lc++"
diff --git a/nixpkgs/pkgs/tools/graphics/lepton/default.nix b/nixpkgs/pkgs/tools/graphics/lepton/default.nix
new file mode 100644
index 000000000000..fec092db0c52
--- /dev/null
+++ b/nixpkgs/pkgs/tools/graphics/lepton/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, fetchFromGitHub, cmake, git, glibc }:
+
+stdenv.mkDerivation rec {
+  version = "1.2.1";
+  name = "lepton-${version}";
+
+  src = fetchFromGitHub {
+    repo = "lepton";
+    owner = "dropbox";
+    rev = "c378cbfa2daaa99e8828be7395013f94cedb1bcc";
+    sha256 = "1f2vyp0crj4yw27bs53vykf2fqk4w57gv3lh9dp89dh3y7wwh1ba";
+  };
+
+  nativeBuildInputs = [ cmake git ];
+  buildInputs = [ glibc.static ];
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/dropbox/lepton;
+    description = "A tool to losslessly compress JPEGs";
+    license = licenses.asl20;
+    platforms = [ "x86_64-linux" ];
+    maintainers = with maintainers; [ artemist ];
+  };
+}
diff --git a/nixpkgs/pkgs/tools/graphics/povray/default.nix b/nixpkgs/pkgs/tools/graphics/povray/default.nix
index 76829b6b7271..dc9d9630ae5a 100644
--- a/nixpkgs/pkgs/tools/graphics/povray/default.nix
+++ b/nixpkgs/pkgs/tools/graphics/povray/default.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
   preInstall = ''
     mkdir "$TMP/bin"
     for i in chown chgrp; do
-      echo '#!/bin/sh' >> "$TMP/bin/$i"
+      echo '#!${stdenv.shell}' >> "$TMP/bin/$i"
       chmod +x "$TMP/bin/$i"
       PATH="$TMP/bin:$PATH"
     done
diff --git a/nixpkgs/pkgs/tools/graphics/sng/default.nix b/nixpkgs/pkgs/tools/graphics/sng/default.nix
index 098721d6b932..182ab5806d7b 100644
--- a/nixpkgs/pkgs/tools/graphics/sng/default.nix
+++ b/nixpkgs/pkgs/tools/graphics/sng/default.nix
@@ -20,6 +20,6 @@ stdenv.mkDerivation rec {
     homepage = http://sng.sourceforge.net/;
     license = licenses.zlib;
     maintainers = [ maintainers.dezgeg ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
   };
 }
diff --git a/nixpkgs/pkgs/tools/graphics/wkhtmltopdf/default.nix b/nixpkgs/pkgs/tools/graphics/wkhtmltopdf/default.nix
index 14ba0f8c2a9a..237c9bb398b1 100644
--- a/nixpkgs/pkgs/tools/graphics/wkhtmltopdf/default.nix
+++ b/nixpkgs/pkgs/tools/graphics/wkhtmltopdf/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     fontconfig freetype libpng zlib libjpeg openssl
     libX11 libXext libXrender
-    qt5.qtwebkit qt5.qtsvg
+    qt5.qtwebkit qt5.qtsvg qt5.qtxmlpatterns
   ];
 
   prePatch = ''
diff --git a/nixpkgs/pkgs/tools/inputmethods/ibus/wrapper.nix b/nixpkgs/pkgs/tools/inputmethods/ibus/wrapper.nix
index 2b93274b79a2..3196c5b4e8ac 100644
--- a/nixpkgs/pkgs/tools/inputmethods/ibus/wrapper.nix
+++ b/nixpkgs/pkgs/tools/inputmethods/ibus/wrapper.nix
@@ -1,5 +1,5 @@
 { stdenv, runCommand, makeWrapper, lndir
-, dconf, hicolor-icon-theme, ibus, librsvg, plugins
+, dconf, hicolor-icon-theme, ibus, librsvg, plugins ? []
 }:
 
 let
diff --git a/nixpkgs/pkgs/tools/misc/aptly/default.nix b/nixpkgs/pkgs/tools/misc/aptly/default.nix
index 168a3f887728..27ee38b34179 100644
--- a/nixpkgs/pkgs/tools/misc/aptly/default.nix
+++ b/nixpkgs/pkgs/tools/misc/aptly/default.nix
@@ -2,14 +2,14 @@
 
 let
 
-  version = "1.2.0";
+  version = "1.3.0";
   rev = "v${version}";
 
   aptlySrc = fetchFromGitHub {
     inherit rev;
-    owner = "smira";
+    owner = "aptly-dev";
     repo = "aptly";
-    sha256 = "1acnkmgarz9rp0skkh7zzwkhisjlmbl74jqjmqd3mn42y528c34b";
+    sha256 = "032gw8qkxcgc0jyrvzqh7jkbmk4k0gf7j74hyhclfnjmd9548f5l";
   };
 
   aptlyCompletionSrc = fetchFromGitHub {
@@ -26,7 +26,7 @@ buildGoPackage {
 
   src = aptlySrc;
 
-  goPackagePath = "github.com/smira/aptly";
+  goPackagePath = "github.com/aptly-dev/aptly";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/nixpkgs/pkgs/tools/misc/bashplotlib/default.nix b/nixpkgs/pkgs/tools/misc/bashplotlib/default.nix
index c334ee77634c..79f72746f905 100644
--- a/nixpkgs/pkgs/tools/misc/bashplotlib/default.nix
+++ b/nixpkgs/pkgs/tools/misc/bashplotlib/default.nix
@@ -2,13 +2,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "bashplotlib";
-  version = "2017-10-11";
+  version = "2019-01-02";
 
   src = fetchFromGitHub {
     owner = "glamp";
     repo = "bashplotlib";
-    rev = "fdc52be2c1fed13753692eced328143ab1db6f3d";
-    sha256 = "1ycql6j65zywyav2n3c0x1i5cm9w6glzqc3v0cgdvv1bdg4wi0gf";
+    rev = "f7533172c4dc912b5accae42edd5c0f655d7468f";
+    sha256 = "1sifqslvvz2c05spwrl81kcdg792l6jwvfd3ih9q5wjkvkm0plz8";
   };
 
   # No tests
diff --git a/nixpkgs/pkgs/tools/misc/bbe/default.nix b/nixpkgs/pkgs/tools/misc/bbe/default.nix
new file mode 100644
index 000000000000..ecff2459ef26
--- /dev/null
+++ b/nixpkgs/pkgs/tools/misc/bbe/default.nix
@@ -0,0 +1,22 @@
+{ stdenv , fetchurl, autoreconfHook }:
+stdenv.mkDerivation rec {
+  name = "bbe-${version}";
+  version = "0.2.2";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/bbe-/${version}/bbe-${version}.tar.gz";
+    sha256 = "1nyxdqi4425sffjrylh7gl57lrssyk4018afb7mvrnd6fmbszbms";
+  };
+
+  nativeBuildInputs = [ autoreconfHook ];
+
+  outputs = [ "out" "doc" ];
+
+  meta = with stdenv.lib; {
+    description = "A sed-like editor for binary files";
+    homepage = "http://bbe-.sourceforge.net/";
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.hhm ];
+  };
+}
diff --git a/nixpkgs/pkgs/tools/misc/brltty/default.nix b/nixpkgs/pkgs/tools/misc/brltty/default.nix
index 6635f2931955..99ba8e5e5159 100644
--- a/nixpkgs/pkgs/tools/misc/brltty/default.nix
+++ b/nixpkgs/pkgs/tools/misc/brltty/default.nix
@@ -1,4 +1,6 @@
-{ stdenv, fetchurl, pkgconfig, python3, alsaSupport, alsaLib ? null, bluez, systemdSupport, systemd ? null }:
+{ stdenv, fetchurl, pkgconfig, python3, bluez
+, alsaSupport ? stdenv.isLinux, alsaLib ? null
+, systemdSupport ? stdenv.isLinux, systemd ? null }:
 
 assert alsaSupport -> alsaLib != null;
 assert systemdSupport -> systemd != null;
diff --git a/nixpkgs/pkgs/tools/misc/broot/default.nix b/nixpkgs/pkgs/tools/misc/broot/default.nix
new file mode 100644
index 000000000000..d09f313e147d
--- /dev/null
+++ b/nixpkgs/pkgs/tools/misc/broot/default.nix
@@ -0,0 +1,23 @@
+{ stdenv, rustPlatform, fetchFromGitHub }:
+
+rustPlatform.buildRustPackage rec {
+  name = "broot-${version}";
+  version = "0.6.0";
+
+  src = fetchFromGitHub {
+    owner = "Canop";
+    repo = "broot";
+    rev = "v${version}";
+    sha256 = "192qqlqym8lpskh6f7sf5fanybjwhdqs1cgl6mqm35763fa5jrdj";
+  };
+
+  cargoSha256 = "059iylnkjb7lxxs9v2b6h05nidwgcj6kqyhcq58lalkhb63srb1q";
+
+  meta = with stdenv.lib; {
+    description = "An interactive tree view, a fuzzy search, a balanced BFS descent and customizable commands";
+    homepage = "https://github.com/Canop/broot";
+    maintainers = with maintainers; [ magnetophon ];
+    license = with licenses; [ mit ];
+    platforms = platforms.all;
+  };
+}
diff --git a/nixpkgs/pkgs/tools/misc/calamares/default.nix b/nixpkgs/pkgs/tools/misc/calamares/default.nix
index edc6a2e46437..9d3c3a45004a 100644
--- a/nixpkgs/pkgs/tools/misc/calamares/default.nix
+++ b/nixpkgs/pkgs/tools/misc/calamares/default.nix
@@ -7,12 +7,12 @@
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
   pname = "calamares";
-  version = "3.2.2";
+  version = "3.2.4";
 
   # release including submodule
   src = fetchurl {
     url = "https://github.com/${pname}/${pname}/releases/download/v${version}/${name}.tar.gz";
-    sha256 = "14hsv2m0jza33kf68l3rhqfjj7224fmvgvk1kg2qwhvplpjdn16v";
+    sha256 = "0wsr1awmk5dnx2cqpp5sb6xhsq7b1jqwbsi1n39db97iyshah6fb";
   };
 
   buildInputs = [
diff --git a/nixpkgs/pkgs/tools/misc/coreutils/default.nix b/nixpkgs/pkgs/tools/misc/coreutils/default.nix
index 3a3486503081..84a2735dff8f 100644
--- a/nixpkgs/pkgs/tools/misc/coreutils/default.nix
+++ b/nixpkgs/pkgs/tools/misc/coreutils/default.nix
@@ -26,8 +26,9 @@ stdenv.mkDerivation rec {
   patches = optional stdenv.hostPlatform.isCygwin ./coreutils-8.23-4.cygwin.patch;
 
   postPatch = ''
-    # The test tends to fail on btrfs and maybe other unusual filesystems.
+    # The test tends to fail on btrfs,f2fs and maybe other unusual filesystems.
     sed '2i echo Skipping dd sparse test && exit 0' -i ./tests/dd/sparse.sh
+    sed '2i echo Skipping du threshold test && exit 0' -i ./tests/du/threshold.sh
     sed '2i echo Skipping cp sparse test && exit 0' -i ./tests/cp/sparse.sh
     sed '2i echo Skipping rm deep-2 test && exit 0' -i ./tests/rm/deep-2.sh
     sed '2i echo Skipping du long-from-unreadable test && exit 0' -i ./tests/du/long-from-unreadable.sh
diff --git a/nixpkgs/pkgs/tools/misc/direnv/default.nix b/nixpkgs/pkgs/tools/misc/direnv/default.nix
index 2a02b0391aeb..de8130ff3f1f 100644
--- a/nixpkgs/pkgs/tools/misc/direnv/default.nix
+++ b/nixpkgs/pkgs/tools/misc/direnv/default.nix
@@ -2,14 +2,14 @@
 
 buildGoPackage rec {
   name = "direnv-${version}";
-  version = "2.19.0";
+  version = "2.19.2";
   goPackagePath = "github.com/direnv/direnv";
 
   src = fetchFromGitHub {
     owner = "direnv";
     repo = "direnv";
     rev = "v${version}";
-    sha256 = "0v5r07b5r0wmmf8wndi0z1fp979pyqg6xpx7w847bkyn4pvgpscm";
+    sha256 = "1iq9wmc63x1c7g1ixdhd6q3w1sx8xl8kf1bprxwq26n9zpd0g13g";
   };
 
   postConfigure = ''
diff --git a/nixpkgs/pkgs/tools/misc/docker-sync/Gemfile b/nixpkgs/pkgs/tools/misc/docker-sync/Gemfile
new file mode 100644
index 000000000000..2c8125a46165
--- /dev/null
+++ b/nixpkgs/pkgs/tools/misc/docker-sync/Gemfile
@@ -0,0 +1,3 @@
+source 'https://rubygems.org' do
+  gem 'docker-sync'
+end
diff --git a/nixpkgs/pkgs/tools/misc/docker-sync/Gemfile.lock b/nixpkgs/pkgs/tools/misc/docker-sync/Gemfile.lock
new file mode 100644
index 000000000000..ff7aa6b3f9fc
--- /dev/null
+++ b/nixpkgs/pkgs/tools/misc/docker-sync/Gemfile.lock
@@ -0,0 +1,29 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    backticks (1.0.2)
+    daemons (1.3.1)
+    docker-compose (1.1.10)
+      backticks (~> 1.0)
+    docker-sync (0.5.9)
+      daemons (~> 1.2, >= 1.2.3)
+      docker-compose (~> 1.1, >= 1.1.7)
+      dotenv (~> 2.1, >= 2.1.1)
+      gem_update_checker (~> 0.2.0, >= 0.2.0)
+      os
+      terminal-notifier (= 2.0.0)
+      thor (~> 0.20, >= 0.20.0)
+    dotenv (2.6.0)
+    gem_update_checker (0.2.0)
+    os (1.0.0)
+    terminal-notifier (2.0.0)
+    thor (0.20.3)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  docker-sync!
+
+BUNDLED WITH
+   1.16.2
diff --git a/nixpkgs/pkgs/tools/misc/docker-sync/default.nix b/nixpkgs/pkgs/tools/misc/docker-sync/default.nix
new file mode 100644
index 000000000000..e541fc0f0d4f
--- /dev/null
+++ b/nixpkgs/pkgs/tools/misc/docker-sync/default.nix
@@ -0,0 +1,18 @@
+{ lib, ruby, bundlerApp }:
+
+bundlerApp {
+  pname = "docker-sync";
+  gemdir = ./.;
+
+  inherit ruby;
+
+  exes = ["docker-sync"];
+
+  meta = with lib; {
+    description = "Run your application at full speed while syncing your code for development";
+    homepage = http://docker-sync.io;
+    license = licenses.gpl3;
+    maintainers = [ maintainers.manveru ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/nixpkgs/pkgs/tools/misc/docker-sync/gemset.nix b/nixpkgs/pkgs/tools/misc/docker-sync/gemset.nix
new file mode 100644
index 000000000000..739d11c7b5ab
--- /dev/null
+++ b/nixpkgs/pkgs/tools/misc/docker-sync/gemset.nix
@@ -0,0 +1,76 @@
+{
+  backticks = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1vr28l9vckavnrb9pnqrhcmnk3wsvvpas8jjh165w2rzv3sdkws5";
+      type = "gem";
+    };
+    version = "1.0.2";
+  };
+  daemons = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0l5gai3vd4g7aqff0k1mp41j9zcsvm2rbwmqn115a325k9r7pf4w";
+      type = "gem";
+    };
+    version = "1.3.1";
+  };
+  docker-compose = {
+    dependencies = ["backticks"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "00v3y182rmpq34dl91iprvhc50vw8hysy2h7iy3ihmmm9pgg71gc";
+      type = "gem";
+    };
+    version = "1.1.10";
+  };
+  docker-sync = {
+    dependencies = ["daemons" "docker-compose" "dotenv" "gem_update_checker" "os" "terminal-notifier" "thor"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1vrlcggj7k8w30b76f23p64yx4wg7p7mq9lp6lsnh2ysq9n3cjqg";
+      type = "gem";
+    };
+    version = "0.5.9";
+  };
+  dotenv = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0rgl2kqhnxqbjvi9brbvb52iaq1z8yi0pl0bawk4fm6kl9igxr8f";
+      type = "gem";
+    };
+    version = "2.6.0";
+  };
+  gem_update_checker = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0ckbz4q3q59kkv138n0cmsyida0wg45pwscxzf5vshxcrxhmq3x7";
+      type = "gem";
+    };
+    version = "0.2.0";
+  };
+  os = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1s401gvhqgs2r8hh43ia205mxsy1wc0ib4k76wzkdpspfcnfr1rk";
+      type = "gem";
+    };
+    version = "1.0.0";
+  };
+  terminal-notifier = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1slc0y8pjpw30hy21v8ypafi8r7z9jlj4bjbgz03b65b28i2n3bs";
+      type = "gem";
+    };
+    version = "2.0.0";
+  };
+  thor = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1yhrnp9x8qcy5vc7g438amd5j9sw83ih7c30dr6g6slgw9zj3g29";
+      type = "gem";
+    };
+    version = "0.20.3";
+  };
+}
\ No newline at end of file
diff --git a/nixpkgs/pkgs/tools/misc/fd/default.nix b/nixpkgs/pkgs/tools/misc/fd/default.nix
index 75c7897ac842..70bbbea72887 100644
--- a/nixpkgs/pkgs/tools/misc/fd/default.nix
+++ b/nixpkgs/pkgs/tools/misc/fd/default.nix
@@ -2,25 +2,26 @@
 
 rustPlatform.buildRustPackage rec {
   name = "fd-${version}";
-  version = "7.2.0";
+  version = "7.3.0";
 
   src = fetchFromGitHub {
     owner = "sharkdp";
     repo = "fd";
     rev = "v${version}";
-    sha256 = "1h7ar1m7w3vmakg9rp1nfmz7q5pqwvd8yyxwj335ixb49gph1zi5";
+    sha256 = "0y4657w1pi4x9nmbv551dj00dyiv935m8ph7jlv00chwy3hrb3yi";
   };
 
-  cargoSha256 = "0y6xp7fdjfmjfqf9avbq9bdvzvwkf3v1dv7a4k03w5279vxafzi4";
+  cargoSha256 = "0dfv6nia3v3f3rwbjh2h3zdqd48vw8gwilhq0z4n6xvjzk7qydj5";
 
   preFixup = ''
-    mkdir -p "$out/man/man1"
-    cp "$src/doc/fd.1" "$out/man/man1"
+    install -Dm644 "$src/doc/fd.1" "$out/man/man1/fd.1"
 
-    mkdir -p "$out/share/"{bash-completion/completions,fish/vendor_completions.d,zsh/site-functions}
-    cp target/release/build/fd-find-*/out/fd.bash "$out/share/bash-completion/completions/"
-    cp target/release/build/fd-find-*/out/fd.fish "$out/share/fish/vendor_completions.d/"
-    cp target/release/build/fd-find-*/out/_fd "$out/share/zsh/site-functions/"
+    install -Dm644 target/release/build/fd-find-*/out/fd.bash \
+      "$out/share/bash-completion/completions/fd.bash"
+    install -Dm644 target/release/build/fd-find-*/out/fd.fish \
+      "$out/share/fish/vendor_completions.d/fd.fish"
+    install -Dm644 target/release/build/fd-find-*/out/_fd \
+      "$out/share/zsh/site-functions/_fd"
   '';
 
   meta = with stdenv.lib; {
diff --git a/nixpkgs/pkgs/tools/misc/fzf/default.nix b/nixpkgs/pkgs/tools/misc/fzf/default.nix
index a882fe9a9ba3..08efe3e6e18b 100644
--- a/nixpkgs/pkgs/tools/misc/fzf/default.nix
+++ b/nixpkgs/pkgs/tools/misc/fzf/default.nix
@@ -47,7 +47,7 @@ buildGoPackage rec {
 
     cp -R $src/shell $bin/share/fzf
     cat <<SCRIPT > $bin/bin/fzf-share
-    #!/bin/sh
+    #!${stdenv.shell}
     # Run this script to find the fzf shared folder where all the shell
     # integration scripts are living.
     echo $bin/share/fzf
diff --git a/nixpkgs/pkgs/tools/misc/gams/default.nix b/nixpkgs/pkgs/tools/misc/gams/default.nix
index 990282b2d584..011231692f3a 100644
--- a/nixpkgs/pkgs/tools/misc/gams/default.nix
+++ b/nixpkgs/pkgs/tools/misc/gams/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, unzip, file, licenseFile, optgamsFile}:
+{ stdenv, fetchurl, unzip, file, licenseFile ? null, optgamsFile ? null}:
 
 assert licenseFile != null;
 
diff --git a/nixpkgs/pkgs/tools/misc/gh-ost/default.nix b/nixpkgs/pkgs/tools/misc/gh-ost/default.nix
index a5871d2bc33e..709d30050910 100644
--- a/nixpkgs/pkgs/tools/misc/gh-ost/default.nix
+++ b/nixpkgs/pkgs/tools/misc/gh-ost/default.nix
@@ -2,11 +2,11 @@
 
 let
   goPackagePath = "github.com/github/gh-ost";
-  version = "1.0.36";
-  sha256 = "0qa7k50bf87bx7sr6iwqri8l49f811gs0bj3ivslxfibcs1z5d4h";
+  version = "1.0.47";
+  sha256 = "0yyhkqis4j2cl6w2drrjxdy5j8x9zp4j89gsny6w4ql8gm5qgvvk";
 
-in {
-  gh-ost = buildGoPackage ({
+in
+buildGoPackage ({
     name = "gh-ost-${version}";
     inherit goPackagePath;
 
@@ -23,5 +23,5 @@ in {
       license = licenses.mit;
       platforms = platforms.linux;
     };
-  });
-}
+})
+
diff --git a/nixpkgs/pkgs/tools/misc/grub/2.0x.nix b/nixpkgs/pkgs/tools/misc/grub/2.0x.nix
index d50797508596..fa1729b929c0 100644
--- a/nixpkgs/pkgs/tools/misc/grub/2.0x.nix
+++ b/nixpkgs/pkgs/tools/misc/grub/2.0x.nix
@@ -47,6 +47,21 @@ stdenv.mkDerivation rec {
     sha256 = "03vvdfhdmf16121v7xs8is2krwnv15wpkhkf16a4yf8nsfc3f2w1";
   };
 
+  patches = [
+    ./fix-bash-completion.patch
+    # This patch makes grub compatible with the XFS sparse inode
+    # feature introduced by xfsprogs-4.16.
+    # to be removed in grub-2.03
+    (fetchpatch {
+      url = https://git.savannah.gnu.org/cgit/grub.git/patch/?id=cda0a857dd7a27cd5d621747464bfe71e8727fff;
+      sha256 = "0k9qrkdxwdqk6sz05q9smqwjr6pvgc9adx1mlf0807g4im91xnm0";
+    })
+    ./relocation-not-implemented.diff
+  ];
+  postPatch = ''
+    substituteInPlace ./configure --replace '/usr/share/fonts/unifont' '${unifont}/share/fonts'
+  '';
+
   nativeBuildInputs = [ bison flex python pkgconfig ];
   buildInputs = [ ncurses libusb freetype gettext lvm2 fuse ]
     ++ optional doCheck qemu
@@ -57,14 +72,10 @@ stdenv.mkDerivation rec {
   # Work around a bug in the generated flex lexer (upstream flex bug?)
   NIX_CFLAGS_COMPILE = "-Wno-error";
 
-  postPatch = ''
-    substituteInPlace ./configure --replace '/usr/share/fonts/unifont' '${unifont}/share/fonts'
-  '';
-
   preConfigure =
     '' for i in "tests/util/"*.in
        do
-         sed -i "$i" -e's|/bin/bash|/bin/sh|g'
+         sed -i "$i" -e's|/bin/bash|${stdenv.shell}|g'
        done
 
        # Apparently, the QEMU executable is no longer called
@@ -82,17 +93,6 @@ stdenv.mkDerivation rec {
       unset CPP # setting CPP intereferes with dependency calculation
     '';
 
-  patches = [
-    ./fix-bash-completion.patch
-    # This patch makes grub compatible with the XFS sparse inode
-    # feature introduced by xfsprogs-4.16.
-    # to be removed in grub-2.03
-    (fetchpatch {
-      url = https://git.savannah.gnu.org/cgit/grub.git/patch/?id=cda0a857dd7a27cd5d621747464bfe71e8727fff;
-      sha256 = "0k9qrkdxwdqk6sz05q9smqwjr6pvgc9adx1mlf0807g4im91xnm0";
-    })
-  ];
-
   configureFlags = [ "--enable-grub-mount" ] # dep of os-prober
     ++ optional zfsSupport "--enable-libzfs"
     ++ optionals efiSupport [ "--with-platform=efi" "--target=${efiSystemsBuild.${stdenv.hostPlatform.system}.target}" "--program-prefix=" ]
diff --git a/nixpkgs/pkgs/tools/misc/grub/relocation-not-implemented.diff b/nixpkgs/pkgs/tools/misc/grub/relocation-not-implemented.diff
new file mode 100644
index 000000000000..0b7bf947d142
--- /dev/null
+++ b/nixpkgs/pkgs/tools/misc/grub/relocation-not-implemented.diff
@@ -0,0 +1,25 @@
+https://git.savannah.gnu.org/cgit/grub.git/commit/util?id=842c390469e2c2e10b5
+diff --git a/util/grub-mkimagexx.c b/util/grub-mkimagexx.c
+index a2bb054..39d7efb 100644
+--- a/util/grub-mkimagexx.c
++++ b/util/grub-mkimagexx.c
+@@ -841,6 +841,7 @@ SUFFIX (relocate_addresses) (Elf_Ehdr *e, Elf_Shdr *sections,
+ 		  break;
+ 
+ 		case R_X86_64_PC32:
++		case R_X86_64_PLT32:
+ 		  {
+ 		    grub_uint32_t *t32 = (grub_uint32_t *) target;
+ 		    *t32 = grub_host_to_target64 (grub_target_to_host32 (*t32)
+diff --git a/util/grub-module-verifier.c b/util/grub-module-verifier.c
+index 9179285..a79271f 100644
+--- a/util/grub-module-verifier.c
++++ b/util/grub-module-verifier.c
+@@ -19,6 +19,7 @@ struct grub_module_verifier_arch archs[] = {
+       -1
+     }, (int[]){
+       R_X86_64_PC32,
++      R_X86_64_PLT32,
+       -1
+     }
+   },
diff --git a/nixpkgs/pkgs/tools/misc/grub/trusted.nix b/nixpkgs/pkgs/tools/misc/grub/trusted.nix
index 94beff8dfe37..ca4e477adce7 100644
--- a/nixpkgs/pkgs/tools/misc/grub/trusted.nix
+++ b/nixpkgs/pkgs/tools/misc/grub/trusted.nix
@@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
   preConfigure =
     '' for i in "tests/util/"*.in
        do
-         sed -i "$i" -e's|/bin/bash|/bin/sh|g'
+         sed -i "$i" -e's|/bin/bash|${stdenv.shell}|g'
        done
 
        # Apparently, the QEMU executable is no longer called
diff --git a/nixpkgs/pkgs/tools/misc/hashit/default.nix b/nixpkgs/pkgs/tools/misc/hashit/default.nix
index 0cb839c26ffc..f1f2fd9aa44d 100644
--- a/nixpkgs/pkgs/tools/misc/hashit/default.nix
+++ b/nixpkgs/pkgs/tools/misc/hashit/default.nix
@@ -1,11 +1,9 @@
-{ stdenv, fetchFromGitHub, meson, ninja, pkgconfig, cmake, vala_0_40, python3, gnome3, gtk3, granite, gobject-introspection, desktop-file-utils, wrapGAppsHook }:
+{ stdenv, fetchFromGitHub, meson, ninja, pkgconfig, cmake, pantheon, python3, gnome3, gtk3, gobject-introspection, desktop-file-utils, wrapGAppsHook }:
 
 stdenv.mkDerivation rec {
   pname = "hashit";
   version = "1.0.0";
 
-  name = "${pname}-${version}";
-
   src = fetchFromGitHub {
     owner = "artemanufrij";
     repo = pname;
@@ -20,14 +18,14 @@ stdenv.mkDerivation rec {
     ninja
     pkgconfig
     python3
-    vala_0_40 # should be `elementary.vala` when elementary attribute set is merged
+    pantheon.vala
     wrapGAppsHook
   ];
 
   buildInputs = [
-    gnome3.defaultIconTheme # should be `elementary.defaultIconTheme`when elementary attribute set is merged
+    pantheon.elementary-icon-theme
     gnome3.libgee
-    granite
+    pantheon.granite
     gtk3
   ];
 
diff --git a/nixpkgs/pkgs/tools/misc/mpdscribble/default.nix b/nixpkgs/pkgs/tools/misc/mpdscribble/default.nix
index 6913f1c11fdf..ca6808effda5 100644
--- a/nixpkgs/pkgs/tools/misc/mpdscribble/default.nix
+++ b/nixpkgs/pkgs/tools/misc/mpdscribble/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     description = "A Music Player Daemon (MPD) client which submits information about tracks beeing played to a scrobbler (e.g. last.fm)";
     homepage = http://mpd.wikia.com/wiki/Client:mpdscribble;
     license = licenses.gpl2;
-    maintainers = [ ];
+    maintainers = [ maintainers.matthiasbeyer ];
     platforms = platforms.linux;
   };
 }
diff --git a/nixpkgs/pkgs/tools/misc/multitail/default.nix b/nixpkgs/pkgs/tools/misc/multitail/default.nix
index 48714a4b6e88..07561d390cd0 100644
--- a/nixpkgs/pkgs/tools/misc/multitail/default.nix
+++ b/nixpkgs/pkgs/tools/misc/multitail/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   meta = {
     homepage = http://www.vanheusden.com/multitail/;
     description = "tail on Steroids";
-    maintainers = with stdenv.lib.maintainers; [ ];
+    maintainers = with stdenv.lib.maintainers; [ matthiasbeyer ];
     platforms = stdenv.lib.platforms.unix;
     license = stdenv.lib.licenses.gpl2Plus;
   };
diff --git a/nixpkgs/pkgs/tools/misc/papis/default.nix b/nixpkgs/pkgs/tools/misc/papis/default.nix
index 8bccfccfeabf..282d64befb7f 100644
--- a/nixpkgs/pkgs/tools/misc/papis/default.nix
+++ b/nixpkgs/pkgs/tools/misc/papis/default.nix
@@ -1,8 +1,8 @@
 { lib, fetchFromGitHub, fetchpatch
-, python36, xdg_utils
+, python3, xdg_utils
 }:
 
-python36.pkgs.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
   pname = "papis";
   version = "0.7.5";
 
@@ -20,7 +20,7 @@ python36.pkgs.buildPythonApplication rec {
     sha256 = "0cmagfdaaml1pxhnxggifpb47z5g1p231qywnvnqpd3dm93382w1";
   };
 
-  propagatedBuildInputs = with python36.pkgs; [
+  propagatedBuildInputs = with python3.pkgs; [
     click requests filetype pyparsing configparser
     arxiv2bib pyyaml chardet beautifulsoup4 prompt_toolkit
     bibtexparser python-slugify pyparser pylibgen
@@ -33,7 +33,7 @@ python36.pkgs.buildPythonApplication rec {
     install -Dt "$out/etc/bash_completion.d" scripts/shell_completion/build/bash/papis
   '';
 
-  checkInputs = (with python36.pkgs; [
+  checkInputs = (with python3.pkgs; [
     pytest
   ]) ++ [
     xdg_utils
diff --git a/nixpkgs/pkgs/tools/misc/qjoypad/default.nix b/nixpkgs/pkgs/tools/misc/qjoypad/default.nix
index 4d91c184b0ae..4428bf1e625a 100644
--- a/nixpkgs/pkgs/tools/misc/qjoypad/default.nix
+++ b/nixpkgs/pkgs/tools/misc/qjoypad/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
   NIX_LDFLAGS = [ "-lX11" ];
   patchPhase = ''
     cd src
-    substituteInPlace config --replace /bin/bash /bin/sh
+    substituteInPlace config --replace /bin/bash ${stdenv.shell}
     mkdir -p $out
     export NIX_LDFLAGS="$NIX_LDFLAGS -rpath ${libX11}/lib"
   '';
diff --git a/nixpkgs/pkgs/tools/misc/skim/default.nix b/nixpkgs/pkgs/tools/misc/skim/default.nix
index f1df06912051..52cc56715315 100644
--- a/nixpkgs/pkgs/tools/misc/skim/default.nix
+++ b/nixpkgs/pkgs/tools/misc/skim/default.nix
@@ -2,13 +2,13 @@
 
 rustPlatform.buildRustPackage rec {
   name = "skim-${version}";
-  version = "0.5.2";
+  version = "0.5.4";
 
   src = fetchFromGitHub {
     owner = "lotabout";
     repo = "skim";
     rev = "v${version}";
-    sha256 = "1b3l0h69cm70669apsgzp7qw1k5fi2gbk9176hjr9iypbdiwjyir";
+    sha256 = "1mn0wa10f9ik6ddhwjdd1n15gdif10284zpwbrwprya643959aj2";
   };
 
   outputs = [ "out" "vim" ];
@@ -21,6 +21,7 @@ rustPlatform.buildRustPackage rec {
 
   postInstall = ''
     install -D -m 555 bin/sk-tmux -t $out/bin
+    install -D -m 644 shell/skim.1 $out/man/man1/skim.1
     install -D -m 444 shell/* -t $out/share/skim
     install -D -m 444 plugin/skim.vim -t $vim/plugin
 
diff --git a/nixpkgs/pkgs/tools/misc/slurp/default.nix b/nixpkgs/pkgs/tools/misc/slurp/default.nix
index a729ea6381ac..8b7f1d38744d 100644
--- a/nixpkgs/pkgs/tools/misc/slurp/default.nix
+++ b/nixpkgs/pkgs/tools/misc/slurp/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "slurp-${version}";
-  version = "1.0";
+  version = "1.0.1";
 
   src = fetchFromGitHub {
     owner = "emersion";
     repo = "slurp";
     rev = "v${version}";
-    sha256 = "03igv8r8n772xb0y7whhs1pa298l3d94jbnknaxpwp2n4fi04syb";
+    sha256 = "072lkwhpvr753wfqzmd994bnhbrgfavxcgqcyml7abab28sdhs1y";
   };
 
   nativeBuildInputs = [
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
   ];
 
   meta = with stdenv.lib; {
-    description = "Grab images from a Wayland compositor";
+    description = "Select a region in a Wayland compositor";
     homepage = https://github.com/emersion/slurp;
     license = licenses.mit;
     platforms = platforms.linux;
diff --git a/nixpkgs/pkgs/tools/misc/smenu/default.nix b/nixpkgs/pkgs/tools/misc/smenu/default.nix
index b5c963307dfd..2b9f83041a42 100644
--- a/nixpkgs/pkgs/tools/misc/smenu/default.nix
+++ b/nixpkgs/pkgs/tools/misc/smenu/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
       your selection will be sent to standard output.
     '';
     license     = licenses.gpl2;
-    maintainers = [ ];
+    maintainers = [ maintainers.matthiasbeyer ];
     platforms   = platforms.linux;
   };
 }
diff --git a/nixpkgs/pkgs/tools/misc/txr/default.nix b/nixpkgs/pkgs/tools/misc/txr/default.nix
index c7ff9e18238f..368b0f908c76 100644
--- a/nixpkgs/pkgs/tools/misc/txr/default.nix
+++ b/nixpkgs/pkgs/tools/misc/txr/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "txr-${version}";
-  version = "208";
+  version = "209";
 
   src = fetchurl {
     url = "http://www.kylheku.com/cgit/txr/snapshot/${name}.tar.bz2";
-    sha256 = "091yki3a24pscwd0lg2ymy86r223amjnz9c71z4a2kxz5brhl5my";
+    sha256 = "1g236bk5ygh3car4kki3w6n0pwny8q4awg8p86fh2khj52qz6mdl";
   };
 
   nativeBuildInputs = [ bison flex ];
diff --git a/nixpkgs/pkgs/tools/misc/urjtag/default.nix b/nixpkgs/pkgs/tools/misc/urjtag/default.nix
index 60a1ab325b13..545d7c554acc 100644
--- a/nixpkgs/pkgs/tools/misc/urjtag/default.nix
+++ b/nixpkgs/pkgs/tools/misc/urjtag/default.nix
@@ -1,10 +1,10 @@
 { stdenv, autoconf, automake, pkgconfig, gettext, libtool, bison
 , flex, which, subversion, fetchsvn, makeWrapper, libftdi, libusb, readline
 , python3
-, svfSupport ? false
-, bsdlSupport ? false
-, staplSupport ? false
-, jedecSupport ? false
+, svfSupport ? true
+, bsdlSupport ? true
+, staplSupport ? true
+, jedecSupport ? true
 }:
 
 stdenv.mkDerivation rec {
diff --git a/nixpkgs/pkgs/tools/misc/usbmuxd/default.nix b/nixpkgs/pkgs/tools/misc/usbmuxd/default.nix
index 6c26564c9dbb..2dfd4752f07a 100644
--- a/nixpkgs/pkgs/tools/misc/usbmuxd/default.nix
+++ b/nixpkgs/pkgs/tools/misc/usbmuxd/default.nix
@@ -2,15 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "usbmuxd";
-  version = "2018-07-22";
-
-  name = "${pname}-${version}";
+  version = "2018-10-10";
 
   src = fetchFromGitHub {
     owner = "libimobiledevice";
     repo = pname;
-    rev = "ee85938c21043ef5f7cd4dfbc7677f385814d4d8";
-    sha256 = "1qsnxvcagxa92rz0w78m0n2drgaghi0pqpbjdk2080sczzi1g76y";
+    rev = "96e4aabe0b9a46ea9da4955a10c774a8e58fe677";
+    sha256 = "03xnj4y606adbhl829vv46qa78f6w2ik4mjz19a34x9lhkcrqxqi";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
diff --git a/nixpkgs/pkgs/tools/misc/vdirsyncer/default.nix b/nixpkgs/pkgs/tools/misc/vdirsyncer/default.nix
index 2212ba870c4a..f538fcbe4ecf 100644
--- a/nixpkgs/pkgs/tools/misc/vdirsyncer/default.nix
+++ b/nixpkgs/pkgs/tools/misc/vdirsyncer/default.nix
@@ -71,7 +71,7 @@ python3Packages.buildPythonApplication rec {
   meta = with stdenv.lib; {
     homepage = https://github.com/pimutils/vdirsyncer;
     description = "Synchronize calendars and contacts";
-    maintainers = with maintainers; [ jgeerds ];
+    maintainers = with maintainers; [ matthiasbeyer jgeerds ];
     platforms = platforms.all;
     license = licenses.mit;
   };
diff --git a/nixpkgs/pkgs/tools/misc/vimer/default.nix b/nixpkgs/pkgs/tools/misc/vimer/default.nix
index 7ccc6e9dc271..a655aa9502e5 100644
--- a/nixpkgs/pkgs/tools/misc/vimer/default.nix
+++ b/nixpkgs/pkgs/tools/misc/vimer/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
       in an existing instance of GVim or MacVim.
     '';
     license = licenses.mit;
-    maintainers = [ ];
+    maintainers = [ maintainers.matthiasbeyer ];
     platforms = platforms.linux;
   };
 
diff --git a/nixpkgs/pkgs/tools/misc/watchexec/default.nix b/nixpkgs/pkgs/tools/misc/watchexec/default.nix
index 61f1752823d7..ddfdf0f492f7 100644
--- a/nixpkgs/pkgs/tools/misc/watchexec/default.nix
+++ b/nixpkgs/pkgs/tools/misc/watchexec/default.nix
@@ -2,13 +2,13 @@
 
 rustPlatform.buildRustPackage rec {
   name = "watchexec-${version}";
-  version = "1.10.0";
+  version = "1.10.1";
 
   src = fetchFromGitHub {
     owner = "watchexec";
     repo = "watchexec";
     rev = version;
-    sha256 = "15fnf3r4pvl9gyvq0fy0l7p8xjaz44z9g4dzkn1l0fdhldib6z1c";
+    sha256 = "0azfnqx5v1shsd7jdxzn41awh9dbjykv8h1isrambc86ygr1c1cy";
   };
 
   cargoSha256 = "1xlcfr2q2pw47sav9iryjva7w9chv90g18hszq8s0q0w71sccv6j";
diff --git a/nixpkgs/pkgs/tools/misc/xfstests/default.nix b/nixpkgs/pkgs/tools/misc/xfstests/default.nix
index e03f84355cad..7305013eb8b7 100644
--- a/nixpkgs/pkgs/tools/misc/xfstests/default.nix
+++ b/nixpkgs/pkgs/tools/misc/xfstests/default.nix
@@ -78,7 +78,7 @@ stdenv.mkDerivation {
   # wants to write temporary files there. So create a temporary
   # to run from and symlink the runtime files to it.
   wrapperScript = writeScript "xfstests-check" ''
-    #!/bin/sh
+    #!${stdenv.shell}
     set -e
     export RESULT_BASE="$(pwd)/results"
 
diff --git a/nixpkgs/pkgs/tools/misc/xsel/default.nix b/nixpkgs/pkgs/tools/misc/xsel/default.nix
index 604868f8c490..0ec7d58598f8 100644
--- a/nixpkgs/pkgs/tools/misc/xsel/default.nix
+++ b/nixpkgs/pkgs/tools/misc/xsel/default.nix
@@ -3,23 +3,18 @@
 stdenv.mkDerivation rec {
   name = "xsel-unstable-${version}";
 
-  version = "2016-09-02";
+  version = "2018-01-10";
 
   src = fetchFromGitHub {
     owner = "kfish";
     repo = "xsel";
-    rev = "aa7f57eed805adb09e9c59c8ea841870e8206b81";
-    sha256 = "04mrc8j0rr7iy1k6brfxnx26pmxm800gh4nqrxn6j2lz6vd5y9m5";
+    rev = "9bfc13d64b5acb92c6648c696a9d9260fcbecc65";
+    sha256 = "05ms34by5hxznnpvmvhgp6llvlkz0zw4sq6c4bgwr82lj140lscm";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
   buildInputs = [ libX11 ];
 
-  # We need a README file, otherwise autoconf complains.
-  postUnpack = ''
-    mv $sourceRoot/README{.md,}
-  '';
-
   meta = with lib; {
     description = "Command-line program for getting and setting the contents of the X selection";
     homepage = http://www.kfish.org/software/xsel;
diff --git a/nixpkgs/pkgs/tools/misc/youtube-dl/default.nix b/nixpkgs/pkgs/tools/misc/youtube-dl/default.nix
index 0598976ec98e..fbba83d7a33a 100644
--- a/nixpkgs/pkgs/tools/misc/youtube-dl/default.nix
+++ b/nixpkgs/pkgs/tools/misc/youtube-dl/default.nix
@@ -19,11 +19,11 @@ buildPythonPackage rec {
   # The websites youtube-dl deals with are a very moving target. That means that
   # downloads break constantly. Because of that, updates should always be backported
   # to the latest stable release.
-  version = "2019.01.30.1";
+  version = "2019.02.18";
 
   src = fetchurl {
     url = "https://yt-dl.org/downloads/${version}/${pname}-${version}.tar.gz";
-    sha256 = "0wamv1fs4w8jjx67p60rgrgdi6k04yy0h4p3cwscza5pzhpmvnlf";
+    sha256 = "1sr0f6ixpaqyp3cf29zswx84y3nfabwnk3sljcgvgnmjp73zzfv1";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/nixpkgs/pkgs/tools/misc/yubikey-manager-qt/default.nix b/nixpkgs/pkgs/tools/misc/yubikey-manager-qt/default.nix
new file mode 100644
index 000000000000..c8521efb28d6
--- /dev/null
+++ b/nixpkgs/pkgs/tools/misc/yubikey-manager-qt/default.nix
@@ -0,0 +1,78 @@
+{ stdenv
+, fetchurl
+, makeWrapper
+, pcsclite
+, pyotherside
+, pythonPackages
+, python3
+, qmake
+, qtbase
+, qtgraphicaleffects
+, qtquickcontrols
+, qtquickcontrols2
+, qtdeclarative
+, qtsvg
+, yubikey-manager
+, yubikey-personalization
+}:
+
+let
+  qmlPath = qmlLib: "${qmlLib}/${qtbase.qtQmlPrefix}";
+
+  inherit (stdenv) lib;
+
+  qml2ImportPath = lib.concatMapStringsSep ":" qmlPath [
+    qtbase.bin qtdeclarative.bin pyotherside qtquickcontrols qtquickcontrols2.bin qtgraphicaleffects
+  ];
+
+in stdenv.mkDerivation rec {
+  pname = "yubikey-manager-qt";
+  version = "1.1.0";
+
+  src = fetchurl {
+    url = "https://developers.yubico.com/yubikey-manager-qt/Releases/${pname}-${version}.tar.gz";
+    sha256 = "8049a233a8cca07543d745a9f619c0fc3afb324f5d0030b93f037b34ac1c5e66";
+  };
+
+  nativeBuildInputs = [ makeWrapper python3.pkgs.wrapPython qmake ];
+
+  sourceRoot = ".";
+
+  postPatch = ''
+    substituteInPlace ykman-gui/deployment.pri --replace '/usr/bin' "$out/bin"
+  '';
+
+  buildInputs = [ pythonPackages.python qtbase qtgraphicaleffects qtquickcontrols qtquickcontrols2 pyotherside ];
+
+  enableParallelBuilding = true;
+
+  pythonPath = [ yubikey-manager ];
+
+  # Need LD_PRELOAD for libykpers as the Nix cpython disables ctypes.cdll.LoadLibrary
+  # support that the yubicommon library uses to load libykpers
+  postInstall = ''
+    buildPythonPath "$pythonPath"
+
+    wrapProgram $out/bin/ykman-gui \
+      --prefix PYTHONPATH : "$program_PYTHONPATH" \
+      --set QML2_IMPORT_PATH "${qml2ImportPath}" \
+      --set QT_QPA_PLATFORM_PLUGIN_PATH ${qtbase.bin}/lib/qt-*/plugins/platforms \
+      --prefix QT_PLUGIN_PATH : "${qtsvg.bin}/${qtbase.qtPluginPrefix}"
+
+      mkdir -p $out/share/applications
+      cp resources/ykman-gui.desktop $out/share/applications/ykman-gui.desktop
+      mkdir -p $out/share/ykman-gui/icons
+      cp resources/icons/*.{icns,ico,png,xpm} $out/share/ykman-gui/icons
+      substituteInPlace $out/share/applications/ykman-gui.desktop \
+        --replace 'Exec=ykman-gui' "Exec=$out/bin/ykman-gui" \
+  '';
+
+  meta = with lib; {
+    inherit version;
+    description = "Cross-platform application for configuring any YubiKey over all USB interfaces.";
+    homepage = https://developers.yubico.com/yubikey-manager-qt/;
+    license = licenses.bsd2;
+    maintainers = [ maintainers.cbley ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/nixpkgs/pkgs/tools/networking/airfield/default.nix b/nixpkgs/pkgs/tools/networking/airfield/default.nix
index 70005038f99d..94a606f9c782 100644
--- a/nixpkgs/pkgs/tools/networking/airfield/default.nix
+++ b/nixpkgs/pkgs/tools/networking/airfield/default.nix
@@ -49,7 +49,7 @@ in stdenv.mkDerivation {
   installPhase = ''
     mkdir -p $out/bin
     cat >$out/bin/airfield <<EOF
-      #!${stdenv.shell}/bin/sh
+      #!${stdenv.shell}
       ${nodejs}/bin/node ${src}/airfield.js
     EOF
   '';
diff --git a/nixpkgs/pkgs/tools/networking/curl/default.nix b/nixpkgs/pkgs/tools/networking/curl/default.nix
index bf37678d06c9..b165142d85a4 100644
--- a/nixpkgs/pkgs/tools/networking/curl/default.nix
+++ b/nixpkgs/pkgs/tools/networking/curl/default.nix
@@ -24,14 +24,14 @@ assert brotliSupport -> brotli != null;
 assert gssSupport -> libkrb5 != null;
 
 stdenv.mkDerivation rec {
-  name = "curl-7.63.0";
+  name = "curl-7.64.0";
 
   src = fetchurl {
     urls = [
       "https://curl.haxx.se/download/${name}.tar.bz2"
       "https://github.com/curl/curl/releases/download/${lib.replaceStrings ["."] ["_"] name}/${name}.tar.bz2"
     ];
-    sha256 = "1n4dzlbllwks8xkz466j362da0pbnxgwr11d64504xzzxka7xawv";
+    sha256 = "1szj9ia1snbfqzfcsk6hx1j7jhbqsy0f9k5d7x9xiy8w5lfblwym";
   };
 
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
diff --git a/nixpkgs/pkgs/tools/networking/flannel/default.nix b/nixpkgs/pkgs/tools/networking/flannel/default.nix
index e440d35e8210..259225e0b7c8 100644
--- a/nixpkgs/pkgs/tools/networking/flannel/default.nix
+++ b/nixpkgs/pkgs/tools/networking/flannel/default.nix
@@ -4,7 +4,7 @@ with lib;
 
 buildGoPackage rec {
   name = "flannel-${version}";
-  version = "0.6.2";
+  version = "0.11.0";
   rev = "v${version}";
 
   goPackagePath = "github.com/coreos/flannel";
@@ -15,14 +15,14 @@ buildGoPackage rec {
     inherit rev;
     owner = "coreos";
     repo = "flannel";
-    sha256 = "03l0zyv9ajda70zw7jgwlmilw26h849jbb9f4slbycphhvbmpvb9";
+    sha256 = "0akxlrrsm2w51g0qd7dnsdy0hdajx98sdhxw4iknjr2kn7j3gph9";
   };
 
   meta = {
     description = "Network fabric for containers, designed for Kubernetes";
     license = licenses.asl20;
     homepage = https://github.com/coreos/flannel;
-    maintainers = with maintainers; [offline];
+    maintainers = with maintainers; [johanot offline];
     platforms = with platforms; linux;
   };
 }
diff --git a/nixpkgs/pkgs/tools/networking/getmail/default.nix b/nixpkgs/pkgs/tools/networking/getmail/default.nix
index db1f383ac026..7a133a0a0cb1 100644
--- a/nixpkgs/pkgs/tools/networking/getmail/default.nix
+++ b/nixpkgs/pkgs/tools/networking/getmail/default.nix
@@ -2,11 +2,11 @@
 
 python2Packages.buildPythonApplication rec {
   pname = "getmail";
-  version = "5.8";
+  version = "5.10";
 
   src = fetchurl {
     url = "http://pyropus.ca/software/getmail/old-versions/${pname}-${version}.tar.gz";
-    sha256 = "0vl4cc733pd9d21y4pr4jc1ly657d0akxj1bdh1xfjggx33l3541";
+    sha256 = "0qc4gp66mhaxyjj7pfz9v69kxnw76my4zw07hvc4f3kj3balkygx";
   };
 
   doCheck = false;
diff --git a/nixpkgs/pkgs/tools/networking/http-prompt/default.nix b/nixpkgs/pkgs/tools/networking/http-prompt/default.nix
index 69b23b3e3a4c..78dc52905d83 100644
--- a/nixpkgs/pkgs/tools/networking/http-prompt/default.nix
+++ b/nixpkgs/pkgs/tools/networking/http-prompt/default.nix
@@ -29,7 +29,7 @@ pythonPackages.buildPythonApplication rec {
     description = "An interactive command-line HTTP client featuring autocomplete and syntax highlighting";
     homepage = https://github.com/eliangcs/http-prompt;
     license = licenses.mit;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ matthiasbeyer ];
     platforms = platforms.linux; # can only test on linux
   };
 }
diff --git a/nixpkgs/pkgs/tools/networking/lftp/default.nix b/nixpkgs/pkgs/tools/networking/lftp/default.nix
index bb627f49971b..b4886f58cbb1 100644
--- a/nixpkgs/pkgs/tools/networking/lftp/default.nix
+++ b/nixpkgs/pkgs/tools/networking/lftp/default.nix
@@ -21,10 +21,14 @@ stdenv.mkDerivation rec {
 
   configureFlags = [
     "--with-readline=${readline.dev}"
+    "--with-zlib=${zlib.dev}"
+    "--without-expat"
   ];
 
   installFlags = [ "PREFIX=$(out)" ];
 
+  enableParallelBuilding = true;
+
   meta = with stdenv.lib; {
     description = "A file transfer program supporting a number of network protocols";
     homepage = https://lftp.tech/;
diff --git a/nixpkgs/pkgs/tools/networking/lldpd/default.nix b/nixpkgs/pkgs/tools/networking/lldpd/default.nix
index 193f44a62e21..d4ded1142d83 100644
--- a/nixpkgs/pkgs/tools/networking/lldpd/default.nix
+++ b/nixpkgs/pkgs/tools/networking/lldpd/default.nix
@@ -1,5 +1,6 @@
 { stdenv, lib, fetchurl, pkgconfig, removeReferencesTo
-, libevent, readline, net_snmp }:
+, libevent, readline, net_snmp, openssl
+}:
 
 stdenv.mkDerivation rec {
   name = "lldpd-${version}";
@@ -18,7 +19,7 @@ stdenv.mkDerivation rec {
   ];
 
   nativeBuildInputs = [ pkgconfig removeReferencesTo ];
-  buildInputs = [ libevent readline net_snmp ];
+  buildInputs = [ libevent readline net_snmp openssl ];
 
   enableParallelBuilding = true;
 
diff --git a/nixpkgs/pkgs/tools/networking/netmask/default.nix b/nixpkgs/pkgs/tools/networking/netmask/default.nix
index 52727163704b..e9704c4babe6 100644
--- a/nixpkgs/pkgs/tools/networking/netmask/default.nix
+++ b/nixpkgs/pkgs/tools/networking/netmask/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "netmask-${version}";
-  version = "2.4.3";
+  version = "2.4.4";
 
   src = fetchFromGitHub {
     owner = "tlby";
     repo = "netmask";
     rev = "v${version}";
-    sha256 = "1n6b9f60j7hfdbpbppgkhz3lr7pg963bxnfrq95i1d49xmx41f87";
+    sha256 = "1269bmdvl534wr0bamd7cqbnr76pnb14yn8ly4qsfg29kh7hrds6";
   };
 
   buildInputs = [ texinfo ];
diff --git a/nixpkgs/pkgs/tools/networking/network-manager/applet.nix b/nixpkgs/pkgs/tools/networking/network-manager/applet.nix
index f3fe14e4f246..4538728295b1 100644
--- a/nixpkgs/pkgs/tools/networking/network-manager/applet.nix
+++ b/nixpkgs/pkgs/tools/networking/network-manager/applet.nix
@@ -6,13 +6,13 @@
 
 let
   pname = "network-manager-applet";
-  version = "1.8.18";
+  version = "1.8.20";
 in stdenv.mkDerivation rec {
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "0y31g0lxr93370xi74hbpvcy9m81n5wdkdhq8xy2nqp0y4219p13";
+    sha256 = "1v1lvw9ak37gxha11rv49sai1vdyv128hdy0kliibiv6alavn385";
   };
 
   mesonFlags = [
diff --git a/nixpkgs/pkgs/tools/networking/network-manager/openvpn/default.nix b/nixpkgs/pkgs/tools/networking/network-manager/openvpn/default.nix
index 952bbf4999e3..afffedac9eeb 100644
--- a/nixpkgs/pkgs/tools/networking/network-manager/openvpn/default.nix
+++ b/nixpkgs/pkgs/tools/networking/network-manager/openvpn/default.nix
@@ -3,13 +3,13 @@
 
 let
   pname = "NetworkManager-openvpn";
-  version = "1.8.8";
+  version = "1.8.10";
 in stdenv.mkDerivation rec {
   name = "${pname}${if withGnome then "-gnome" else ""}-${version}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "19qdl7x5x7f9mj8vm25mck6gg8ljbixi0dw2rqngwl2nzpcxwg52";
+    sha256 = "1vri49yff4lj13dnzkpq9nx3a4z1bmbrv807r151plj8m1mwhg5g";
   };
 
   patches = [
diff --git a/nixpkgs/pkgs/tools/networking/p2p/tahoe-lafs/default.nix b/nixpkgs/pkgs/tools/networking/p2p/tahoe-lafs/default.nix
index c682100b4384..6d4c77d51987 100644
--- a/nixpkgs/pkgs/tools/networking/p2p/tahoe-lafs/default.nix
+++ b/nixpkgs/pkgs/tools/networking/p2p/tahoe-lafs/default.nix
@@ -6,13 +6,13 @@
 # some loss of functionality because of it.
 
 pythonPackages.buildPythonApplication rec {
-  version = "1.12.1";
+  version = "1.13.0";
   name = "tahoe-lafs-${version}";
   namePrefix = "";
 
   src = fetchurl {
     url = "https://tahoe-lafs.org/downloads/tahoe-lafs-${version}.tar.bz2";
-    sha256 = "0x9f1kjym1188fp6l5sqy0zz8mdb4xw861bni2ccv26q482ynbks";
+    sha256 = "11pfz9yyy6qkkyi0kskxlbn2drfppx6yawqyv4kpkrkj4q7x5m42";
   };
 
   outputs = [ "out" "doc" "info" ];
@@ -56,9 +56,11 @@ pythonPackages.buildPythonApplication rec {
   propagatedBuildInputs = with pythonPackages; [
     twisted foolscap nevow simplejson zfec pycryptopp darcsver
     setuptoolsTrial setuptoolsDarcs pycrypto pyasn1 zope_interface
-    service-identity pyyaml
+    service-identity pyyaml magic-wormhole treq
   ];
 
+  checkInputs = with pythonPackages; [ hypothesis ];
+
   # Install the documentation.
   postInstall = ''
     (
diff --git a/nixpkgs/pkgs/tools/networking/slirp4netns/default.nix b/nixpkgs/pkgs/tools/networking/slirp4netns/default.nix
new file mode 100644
index 000000000000..3515a127510f
--- /dev/null
+++ b/nixpkgs/pkgs/tools/networking/slirp4netns/default.nix
@@ -0,0 +1,25 @@
+{ stdenv, fetchFromGitHub, autoreconfHook }:
+
+stdenv.mkDerivation rec {
+  name = "slirp4netns-${version}";
+  version = "0.3.0-alpha.2";
+
+  src = fetchFromGitHub {
+    owner = "rootless-containers";
+    repo = "slirp4netns";
+    rev = "v${version}";
+    sha256 = "163nwdwi1qigma1c5svm8llgd8pn4sbkchw67ry3v0gfxa9mxibk";
+  };
+
+  nativeBuildInputs = [ autoreconfHook ];
+
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/rootless-containers/slirp4netns;
+    description = "User-mode networking for unprivileged network namespaces";
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ orivej ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/nixpkgs/pkgs/tools/networking/ssmtp/default.nix b/nixpkgs/pkgs/tools/networking/ssmtp/default.nix
index 22f60bfcee55..ebe31dc8b5a9 100644
--- a/nixpkgs/pkgs/tools/networking/ssmtp/default.nix
+++ b/nixpkgs/pkgs/tools/networking/ssmtp/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchurl, tlsSupport ? false, openssl ? null}:
+{stdenv, fetchurl, tlsSupport ? true, openssl ? null}:
 
 assert tlsSupport -> openssl != null;
 
diff --git a/nixpkgs/pkgs/tools/networking/tcpdump/default.nix b/nixpkgs/pkgs/tools/networking/tcpdump/default.nix
index 58f020e1bdd8..f1470fc6c148 100644
--- a/nixpkgs/pkgs/tools/networking/tcpdump/default.nix
+++ b/nixpkgs/pkgs/tools/networking/tcpdump/default.nix
@@ -33,6 +33,6 @@ stdenv.mkDerivation rec {
     homepage = http://www.tcpdump.org/;
     license = "BSD-style";
     maintainers = with stdenv.lib.maintainers; [ jgeerds ];
-    platforms = stdenv.lib.platforms.linux;
+    platforms = stdenv.lib.platforms.unix;
   };
 }
diff --git a/nixpkgs/pkgs/tools/networking/zap/default.nix b/nixpkgs/pkgs/tools/networking/zap/default.nix
index 7dc0e07f9451..56b54fed61b9 100644
--- a/nixpkgs/pkgs/tools/networking/zap/default.nix
+++ b/nixpkgs/pkgs/tools/networking/zap/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     mkdir -p "$out/share"
     tar xvf  "ZAP_${version}_Linux.tar.gz" -C "$out/share/"
     mkdir -p "$out/bin"
-    echo "#!/bin/sh" > "$out/bin/zap"
+    echo "#!${stdenv.shell}" > "$out/bin/zap"
     echo \"$out/share/ZAP_${version}/zap.sh\" >> "$out/bin/zap"
     chmod +x "$out/bin/zap"
   '';
diff --git a/nixpkgs/pkgs/tools/package-management/disnix/dysnomia/default.nix b/nixpkgs/pkgs/tools/package-management/disnix/dysnomia/default.nix
index ab0ce5d75216..14c07df6ffa8 100644
--- a/nixpkgs/pkgs/tools/package-management/disnix/dysnomia/default.nix
+++ b/nixpkgs/pkgs/tools/package-management/disnix/dysnomia/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation {
   };
 
   preConfigure = if enableEjabberdDump then "export PATH=$PATH:${ejabberd}/sbin" else "";
-  
+
   configureFlags = [
      (if enableApacheWebApplication then "--with-apache" else "--without-apache")
      (if enableAxis2WebService then "--with-axis2" else "--without-axis2")
@@ -39,7 +39,7 @@ stdenv.mkDerivation {
      (if enableMongoDatabase then "--with-mongodb" else "--without-mongodb")
      "--with-job-template=${jobTemplate}"
    ];
-  
+
   buildInputs = [ getopt ]
     ++ stdenv.lib.optional enableEjabberdDump ejabberd
     ++ stdenv.lib.optional enableMySQLDatabase mysql.out
diff --git a/nixpkgs/pkgs/tools/package-management/morph/default.nix b/nixpkgs/pkgs/tools/package-management/morph/default.nix
index 27dbad884132..51a963497fa2 100644
--- a/nixpkgs/pkgs/tools/package-management/morph/default.nix
+++ b/nixpkgs/pkgs/tools/package-management/morph/default.nix
@@ -2,13 +2,13 @@
 
 buildGoPackage rec {
   name = "morph-${version}";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "dbcdk";
     repo = "morph";
     rev = "v${version}";
-    sha256 = "0pixm48is9if9d2b4qc5mwwa4lzma6snkib6z2a1d4pmdx1lmpmm";
+    sha256 = "0jhypvj45yjg4cn4rvb2j9091pl6z5j541vcfaln5sb3ds14fkwf";
   };
 
   goPackagePath = "github.com/dbcdk/morph";
@@ -16,6 +16,12 @@ buildGoPackage rec {
 
   buildInputs = [ go-bindata ];
 
+  buildFlagsArray = ''
+    -ldflags=
+    -X
+    main.version=${version}
+  '';
+
   prePatch = ''
     go-bindata -pkg assets -o assets/assets.go data/
   '';
diff --git a/nixpkgs/pkgs/tools/package-management/nix-prefetch/default.nix b/nixpkgs/pkgs/tools/package-management/nix-prefetch/default.nix
new file mode 100644
index 000000000000..96a283a8ea8a
--- /dev/null
+++ b/nixpkgs/pkgs/tools/package-management/nix-prefetch/default.nix
@@ -0,0 +1,70 @@
+{ stdenv, fetchFromGitHub, makeWrapper
+, asciidoc, docbook_xml_dtd_45, docbook_xsl, libxml2, libxslt
+, coreutils, gawk, gnugrep, gnused, jq, nix }:
+
+with stdenv.lib;
+
+stdenv.mkDerivation rec {
+  name = "${pname}-${version}";
+  pname = "nix-prefetch";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "msteen";
+    repo = "nix-prefetch";
+    rev = "f9507a655651b51f3a3ebacde85bb40758853615";
+    sha256 = "0ykrbvbwwpz348424yy2452idgw8dffi3klh7n85n96dfflyyd4s";
+  };
+
+  nativeBuildInputs = [
+    makeWrapper
+    asciidoc docbook_xml_dtd_45 docbook_xsl libxml2 libxslt
+  ];
+
+  configurePhase = ''
+    . configure.sh
+  '';
+
+  buildPhase = ''
+    a2x -f manpage doc/nix-prefetch.1.asciidoc
+  '';
+
+  installPhase = ''
+    lib=$out/lib/${pname}
+    mkdir -p $lib
+    substitute src/main.sh $lib/main.sh \
+      --subst-var-by lib $lib \
+      --subst-var-by version '${version}'
+    chmod +x $lib/main.sh
+    patchShebangs $lib/main.sh
+    cp lib/*.nix $lib/
+
+    mkdir -p $out/bin
+    makeWrapper $lib/main.sh $out/bin/${pname} \
+      --prefix PATH : '${makeBinPath [ coreutils gawk gnugrep gnused jq nix ]}'
+
+    substitute src/tests.sh $lib/tests.sh \
+      --subst-var-by bin $out/bin
+    chmod +x $lib/tests.sh
+    patchShebangs $lib/tests.sh
+
+    mkdir -p $out/share/man/man1
+    substitute doc/nix-prefetch.1 $out/share/man/man1/nix-prefetch.1 \
+      --subst-var-by version '${version}' \
+      --replace '01/01/1970' "$date"
+
+    install -D contrib/nix-prefetch-completion.bash $out/share/bash-completion/completions/nix-prefetch
+    install -D contrib/nix-prefetch-completion.zsh $out/share/zsh/site-functions/_nix_prefetch
+
+    mkdir $out/contrib
+    cp -r contrib/hello_rs $out/contrib/
+  '';
+
+  meta = {
+    description = "Prefetch any fetcher function call, e.g. package sources";
+    homepage = https://github.com/msteen/nix-prefetch;
+    license = licenses.mit;
+    maintainers = with maintainers; [ msteen ];
+    platforms = platforms.all;
+  };
+}
diff --git a/nixpkgs/pkgs/tools/package-management/nix/default.nix b/nixpkgs/pkgs/tools/package-management/nix/default.nix
index d86dfa316193..76d11a03fc44 100644
--- a/nixpkgs/pkgs/tools/package-management/nix/default.nix
+++ b/nixpkgs/pkgs/tools/package-management/nix/default.nix
@@ -13,7 +13,7 @@ let
 
   sh = busybox-sandbox-shell;
 
-  common = { name, suffix ? "", src, fromGit ? false }:
+  common = { name, suffix ? "", src, includesPerl ? false, fromGit ? false }:
     let nix = stdenv.mkDerivation rec {
       inherit name src;
       version = lib.getVersion name;
@@ -113,7 +113,7 @@ let
       passthru = {
         inherit fromGit;
 
-        perl-bindings = stdenv.mkDerivation {
+        perl-bindings = if includesPerl then nix else stdenv.mkDerivation {
           name = "nix-perl-${version}";
 
           inherit src;
@@ -150,6 +150,9 @@ in rec {
       url = "http://nixos.org/releases/nix/${name}/${name}.tar.xz";
       sha256 = "0ca5782fc37d62238d13a620a7b4bff6a200bab1bd63003709249a776162357c";
     };
+
+    # Nix1 has the perl bindings by default, so no need to build the manually.
+    includesPerl = true;
   };
 
   nixStable = common rec {
diff --git a/nixpkgs/pkgs/tools/security/bitwarden-cli/default.nix b/nixpkgs/pkgs/tools/security/bitwarden-cli/default.nix
new file mode 100644
index 000000000000..5c60eb9f4e2f
--- /dev/null
+++ b/nixpkgs/pkgs/tools/security/bitwarden-cli/default.nix
@@ -0,0 +1,18 @@
+{ stdenv, pkgs }:
+
+let
+  # node-packages*.nix generated via:
+  #
+  # % node2nix --input node-packages.json \
+  #            --output node-packages-generated.nix \
+  #            --composition node-packages.nix \
+  #            --node-env ./../../../development/node-packages/node-env.nix
+  #
+  nodePackages = import ./node-packages.nix {
+    inherit pkgs;
+    inherit (stdenv.hostPlatform) system;
+  };
+in pkgs.lib.overrideDerivation nodePackages."@bitwarden/cli" (drv: {
+  # This defaults to "node-_at_bitwarden_slash_cli-1.7.0"
+  name = "bitwarden-cli-${drv.version}";
+})
diff --git a/nixpkgs/pkgs/tools/security/bitwarden-cli/node-packages-generated.nix b/nixpkgs/pkgs/tools/security/bitwarden-cli/node-packages-generated.nix
new file mode 100644
index 000000000000..f709bd3d122d
--- /dev/null
+++ b/nixpkgs/pkgs/tools/security/bitwarden-cli/node-packages-generated.nix
@@ -0,0 +1,549 @@
+# This file has been generated by node2nix 1.6.0. Do not edit!
+
+{nodeEnv, fetchurl, fetchgit, globalBuildInputs ? []}:
+
+let
+  sources = {
+    "ansi-escapes-3.1.0" = {
+      name = "ansi-escapes";
+      packageName = "ansi-escapes";
+      version = "3.1.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/ansi-escapes/-/ansi-escapes-3.1.0.tgz";
+        sha512 = "UgAb8H9D41AQnu/PbWlCofQVcnV4Gs2bBJi9eZPxfU/hgglFh3SMDMENRIqdr7H6XFnXdoknctFByVsCOotTVw==";
+      };
+    };
+    "ansi-regex-3.0.0" = {
+      name = "ansi-regex";
+      packageName = "ansi-regex";
+      version = "3.0.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/ansi-regex/-/ansi-regex-3.0.0.tgz";
+        sha1 = "ed0317c322064f79466c02966bddb605ab37d998";
+      };
+    };
+    "ansi-styles-3.2.1" = {
+      name = "ansi-styles";
+      packageName = "ansi-styles";
+      version = "3.2.1";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/ansi-styles/-/ansi-styles-3.2.1.tgz";
+        sha512 = "VT0ZI6kZRdTh8YyJw3SMbYm/u+NqfsAxEpWO0Pf9sq8/e94WxxOpPKx9FR1FlyCtOVDNOQ+8ntlqFxiRc+r5qA==";
+      };
+    };
+    "asynckit-0.4.0" = {
+      name = "asynckit";
+      packageName = "asynckit";
+      version = "0.4.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/asynckit/-/asynckit-0.4.0.tgz";
+        sha1 = "c79ed97f7f34cb8f2ba1bc9790bcc366474b4b79";
+      };
+    };
+    "big-integer-1.6.36" = {
+      name = "big-integer";
+      packageName = "big-integer";
+      version = "1.6.36";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/big-integer/-/big-integer-1.6.36.tgz";
+        sha512 = "t70bfa7HYEA1D9idDbmuv7YbsbVkQ+Hp+8KFSul4aE5e/i1bjCNIRYJZlA8Q8p0r9T8cF/RVvwUgRA//FydEyg==";
+      };
+    };
+    "chalk-2.4.1" = {
+      name = "chalk";
+      packageName = "chalk";
+      version = "2.4.1";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/chalk/-/chalk-2.4.1.tgz";
+        sha512 = "ObN6h1v2fTJSmUXoS3nMQ92LbDK9be4TV+6G+omQlGJFdcUX5heKi1LZ1YnRMIgwTLEj3E24bT6tYni50rlCfQ==";
+      };
+    };
+    "chardet-0.7.0" = {
+      name = "chardet";
+      packageName = "chardet";
+      version = "0.7.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/chardet/-/chardet-0.7.0.tgz";
+        sha512 = "mT8iDcrh03qDGRRmoA2hmBJnxpllMR+0/0qlzjqZES6NdiWDcZkCNAk4rPFZ9Q85r27unkiNNg8ZOiwZXBHwcA==";
+      };
+    };
+    "cli-cursor-2.1.0" = {
+      name = "cli-cursor";
+      packageName = "cli-cursor";
+      version = "2.1.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/cli-cursor/-/cli-cursor-2.1.0.tgz";
+        sha1 = "b35dac376479facc3e94747d41d0d0f5238ffcb5";
+      };
+    };
+    "cli-width-2.2.0" = {
+      name = "cli-width";
+      packageName = "cli-width";
+      version = "2.2.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/cli-width/-/cli-width-2.2.0.tgz";
+        sha1 = "ff19ede8a9a5e579324147b0c11f0fbcbabed639";
+      };
+    };
+    "color-convert-1.9.3" = {
+      name = "color-convert";
+      packageName = "color-convert";
+      version = "1.9.3";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/color-convert/-/color-convert-1.9.3.tgz";
+        sha512 = "QfAUtd+vFdAtFQcC8CCyYt1fYWxSqAiK2cSD6zDB8N3cpsEBAvRxp9zOGg6G/SHHJYAT88/az/IuDGALsNVbGg==";
+      };
+    };
+    "color-name-1.1.3" = {
+      name = "color-name";
+      packageName = "color-name";
+      version = "1.1.3";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/color-name/-/color-name-1.1.3.tgz";
+        sha1 = "a7d0558bd89c42f795dd42328f740831ca53bc25";
+      };
+    };
+    "combined-stream-1.0.6" = {
+      name = "combined-stream";
+      packageName = "combined-stream";
+      version = "1.0.6";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/combined-stream/-/combined-stream-1.0.6.tgz";
+        sha1 = "723e7df6e801ac5613113a7e445a9b69cb632818";
+      };
+    };
+    "commander-2.18.0" = {
+      name = "commander";
+      packageName = "commander";
+      version = "2.18.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/commander/-/commander-2.18.0.tgz";
+        sha512 = "6CYPa+JP2ftfRU2qkDK+UTVeQYosOg/2GbcjIcKPHfinyOLPVGXu/ovN86RP49Re5ndJK1N0kuiidFFuepc4ZQ==";
+      };
+    };
+    "delayed-stream-1.0.0" = {
+      name = "delayed-stream";
+      packageName = "delayed-stream";
+      version = "1.0.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/delayed-stream/-/delayed-stream-1.0.0.tgz";
+        sha1 = "df3ae199acadfb7d440aaae0b29e2272b24ec619";
+      };
+    };
+    "escape-string-regexp-1.0.5" = {
+      name = "escape-string-regexp";
+      packageName = "escape-string-regexp";
+      version = "1.0.5";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-1.0.5.tgz";
+        sha1 = "1b61c0562190a8dff6ae3bb2cf0200ca130b86d4";
+      };
+    };
+    "external-editor-3.0.3" = {
+      name = "external-editor";
+      packageName = "external-editor";
+      version = "3.0.3";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/external-editor/-/external-editor-3.0.3.tgz";
+        sha512 = "bn71H9+qWoOQKyZDo25mOMVpSmXROAsTJVVVYzrrtol3d4y+AsKjf4Iwl2Q+IuT0kFSQ1qo166UuIwqYq7mGnA==";
+      };
+    };
+    "figures-2.0.0" = {
+      name = "figures";
+      packageName = "figures";
+      version = "2.0.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/figures/-/figures-2.0.0.tgz";
+        sha1 = "3ab1a2d2a62c8bfb431a0c94cb797a2fce27c962";
+      };
+    };
+    "form-data-2.3.2" = {
+      name = "form-data";
+      packageName = "form-data";
+      version = "2.3.2";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/form-data/-/form-data-2.3.2.tgz";
+        sha1 = "4970498be604c20c005d4f5c23aecd21d6b49099";
+      };
+    };
+    "graceful-fs-4.1.15" = {
+      name = "graceful-fs";
+      packageName = "graceful-fs";
+      version = "4.1.15";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.1.15.tgz";
+        sha512 = "6uHUhOPEBgQ24HM+r6b/QwWfZq+yiFcipKFrOFiBEnWdy5sdzYoi+pJeQaPI5qOLRFqWmAXUPQNsielzdLoecA==";
+      };
+    };
+    "has-flag-3.0.0" = {
+      name = "has-flag";
+      packageName = "has-flag";
+      version = "3.0.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/has-flag/-/has-flag-3.0.0.tgz";
+        sha1 = "b5d454dc2199ae225699f3467e5a07f3b955bafd";
+      };
+    };
+    "iconv-lite-0.4.24" = {
+      name = "iconv-lite";
+      packageName = "iconv-lite";
+      version = "0.4.24";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.4.24.tgz";
+        sha512 = "v3MXnZAcvnywkTUEZomIActle7RXXeedOR31wwl7VlyoXO4Qi9arvSenNQWne1TcRwhCL1HwLI21bEqdpj8/rA==";
+      };
+    };
+    "inquirer-6.2.0" = {
+      name = "inquirer";
+      packageName = "inquirer";
+      version = "6.2.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/inquirer/-/inquirer-6.2.0.tgz";
+        sha512 = "QIEQG4YyQ2UYZGDC4srMZ7BjHOmNk1lR2JQj5UknBapklm6WHA+VVH7N+sUdX3A7NeCfGF8o4X1S3Ao7nAcIeg==";
+      };
+    };
+    "is-fullwidth-code-point-2.0.0" = {
+      name = "is-fullwidth-code-point";
+      packageName = "is-fullwidth-code-point";
+      version = "2.0.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-2.0.0.tgz";
+        sha1 = "a3b30a5c4f199183167aaab93beefae3ddfb654f";
+      };
+    };
+    "is-promise-2.1.0" = {
+      name = "is-promise";
+      packageName = "is-promise";
+      version = "2.1.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/is-promise/-/is-promise-2.1.0.tgz";
+        sha1 = "79a2a9ece7f096e80f36d2b2f3bc16c1ff4bf3fa";
+      };
+    };
+    "lodash-4.17.11" = {
+      name = "lodash";
+      packageName = "lodash";
+      version = "4.17.11";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/lodash/-/lodash-4.17.11.tgz";
+        sha512 = "cQKh8igo5QUhZ7lg38DYWAxMvjSAKG0A8wGSVimP07SIUEK2UO+arSRKbRZWtelMtN5V0Hkwh5ryOto/SshYIg==";
+      };
+    };
+    "lowdb-1.0.0" = {
+      name = "lowdb";
+      packageName = "lowdb";
+      version = "1.0.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/lowdb/-/lowdb-1.0.0.tgz";
+        sha512 = "2+x8esE/Wb9SQ1F9IHaYWfsC9FIecLOPrK4g17FGEayjUWH172H6nwicRovGvSE2CPZouc2MCIqCI7h9d+GftQ==";
+      };
+    };
+    "lunr-2.3.3" = {
+      name = "lunr";
+      packageName = "lunr";
+      version = "2.3.3";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/lunr/-/lunr-2.3.3.tgz";
+        sha512 = "rlAEsgU9Bnavca2w1WJ6+6cdeHMXNyadcersyk3ZpuhgWb5HBNj8l4WwJz9PjksAhYDlpQffCVXPctOn+wCIVA==";
+      };
+    };
+    "mime-db-1.37.0" = {
+      name = "mime-db";
+      packageName = "mime-db";
+      version = "1.37.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/mime-db/-/mime-db-1.37.0.tgz";
+        sha512 = "R3C4db6bgQhlIhPU48fUtdVmKnflq+hRdad7IyKhtFj06VPNVdk2RhiYL3UjQIlso8L+YxAtFkobT0VK+S/ybg==";
+      };
+    };
+    "mime-types-2.1.21" = {
+      name = "mime-types";
+      packageName = "mime-types";
+      version = "2.1.21";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/mime-types/-/mime-types-2.1.21.tgz";
+        sha512 = "3iL6DbwpyLzjR3xHSFNFeb9Nz/M8WDkX33t1GFQnFOllWk8pOrh/LSrB5OXlnlW5P9LH73X6loW/eogc+F5lJg==";
+      };
+    };
+    "mimic-fn-1.2.0" = {
+      name = "mimic-fn";
+      packageName = "mimic-fn";
+      version = "1.2.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/mimic-fn/-/mimic-fn-1.2.0.tgz";
+        sha512 = "jf84uxzwiuiIVKiOLpfYk7N46TSy8ubTonmneY9vrpHNAnp0QBt2BxWV9dO3/j+BoVAb+a5G6YDPW3M5HOdMWQ==";
+      };
+    };
+    "mute-stream-0.0.7" = {
+      name = "mute-stream";
+      packageName = "mute-stream";
+      version = "0.0.7";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/mute-stream/-/mute-stream-0.0.7.tgz";
+        sha1 = "3075ce93bc21b8fab43e1bc4da7e8115ed1e7bab";
+      };
+    };
+    "node-fetch-2.2.0" = {
+      name = "node-fetch";
+      packageName = "node-fetch";
+      version = "2.2.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/node-fetch/-/node-fetch-2.2.0.tgz";
+        sha512 = "OayFWziIxiHY8bCUyLX6sTpDH8Jsbp4FfYd1j1f7vZyfgkcOnAyM4oQR16f8a0s7Gl/viMGRey8eScYk4V4EZA==";
+      };
+    };
+    "node-forge-0.7.6" = {
+      name = "node-forge";
+      packageName = "node-forge";
+      version = "0.7.6";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/node-forge/-/node-forge-0.7.6.tgz";
+        sha512 = "sol30LUpz1jQFBjOKwbjxijiE3b6pjd74YwfD0fJOKPjF+fONKb2Yg8rYgS6+bK6VDl+/wfr4IYpC7jDzLUIfw==";
+      };
+    };
+    "onetime-2.0.1" = {
+      name = "onetime";
+      packageName = "onetime";
+      version = "2.0.1";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/onetime/-/onetime-2.0.1.tgz";
+        sha1 = "067428230fd67443b2794b22bba528b6867962d4";
+      };
+    };
+    "os-tmpdir-1.0.2" = {
+      name = "os-tmpdir";
+      packageName = "os-tmpdir";
+      version = "1.0.2";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/os-tmpdir/-/os-tmpdir-1.0.2.tgz";
+        sha1 = "bbe67406c79aa85c5cfec766fe5734555dfa1274";
+      };
+    };
+    "papaparse-4.6.0" = {
+      name = "papaparse";
+      packageName = "papaparse";
+      version = "4.6.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/papaparse/-/papaparse-4.6.0.tgz";
+        sha512 = "ylm8pmgyz9rkS3Ng/ru5tHUF3JxWwKYP0aZZWZ8eCGdSxoqgYiDUXLNQei73mUJOjHw8QNu5ZNCsLoDpkMA6sg==";
+      };
+    };
+    "pify-3.0.0" = {
+      name = "pify";
+      packageName = "pify";
+      version = "3.0.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/pify/-/pify-3.0.0.tgz";
+        sha1 = "e5a4acd2c101fdf3d9a4d07f0dbc4db49dd28176";
+      };
+    };
+    "punycode-1.4.1" = {
+      name = "punycode";
+      packageName = "punycode";
+      version = "1.4.1";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/punycode/-/punycode-1.4.1.tgz";
+        sha1 = "c0d5a63b2718800ad8e1eb0fa5269c84dd41845e";
+      };
+    };
+    "restore-cursor-2.0.0" = {
+      name = "restore-cursor";
+      packageName = "restore-cursor";
+      version = "2.0.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/restore-cursor/-/restore-cursor-2.0.0.tgz";
+        sha1 = "9f7ee287f82fd326d4fd162923d62129eee0dfaf";
+      };
+    };
+    "run-async-2.3.0" = {
+      name = "run-async";
+      packageName = "run-async";
+      version = "2.3.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/run-async/-/run-async-2.3.0.tgz";
+        sha1 = "0371ab4ae0bdd720d4166d7dfda64ff7a445a6c0";
+      };
+    };
+    "rxjs-6.3.3" = {
+      name = "rxjs";
+      packageName = "rxjs";
+      version = "6.3.3";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/rxjs/-/rxjs-6.3.3.tgz";
+        sha512 = "JTWmoY9tWCs7zvIk/CvRjhjGaOd+OVBM987mxFo+OW66cGpdKjZcpmc74ES1sB//7Kl/PAe8+wEakuhG4pcgOw==";
+      };
+    };
+    "safer-buffer-2.1.2" = {
+      name = "safer-buffer";
+      packageName = "safer-buffer";
+      version = "2.1.2";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz";
+        sha512 = "YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==";
+      };
+    };
+    "signal-exit-3.0.2" = {
+      name = "signal-exit";
+      packageName = "signal-exit";
+      version = "3.0.2";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/signal-exit/-/signal-exit-3.0.2.tgz";
+        sha1 = "b5fdc08f1287ea1178628e415e25132b73646c6d";
+      };
+    };
+    "steno-0.4.4" = {
+      name = "steno";
+      packageName = "steno";
+      version = "0.4.4";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/steno/-/steno-0.4.4.tgz";
+        sha1 = "071105bdfc286e6615c0403c27e9d7b5dcb855cb";
+      };
+    };
+    "string-width-2.1.1" = {
+      name = "string-width";
+      packageName = "string-width";
+      version = "2.1.1";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/string-width/-/string-width-2.1.1.tgz";
+        sha512 = "nOqH59deCq9SRHlxq1Aw85Jnt4w6KvLKqWVik6oA9ZklXLNIOlqg4F2yrT1MVaTjAqvVwdfeZ7w7aCvJD7ugkw==";
+      };
+    };
+    "strip-ansi-4.0.0" = {
+      name = "strip-ansi";
+      packageName = "strip-ansi";
+      version = "4.0.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/strip-ansi/-/strip-ansi-4.0.0.tgz";
+        sha1 = "a8479022eb1ac368a871389b635262c505ee368f";
+      };
+    };
+    "supports-color-5.5.0" = {
+      name = "supports-color";
+      packageName = "supports-color";
+      version = "5.5.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/supports-color/-/supports-color-5.5.0.tgz";
+        sha512 = "QjVjwdXIt408MIiAqCX4oUKsgU2EqAGzs2Ppkm4aQYbjm+ZEWEcW4SfFNTr4uMNZma0ey4f5lgLrkB0aX0QMow==";
+      };
+    };
+    "through-2.3.8" = {
+      name = "through";
+      packageName = "through";
+      version = "2.3.8";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/through/-/through-2.3.8.tgz";
+        sha1 = "0dd4c9ffaabc357960b1b724115d7e0e86a2e1f5";
+      };
+    };
+    "tldjs-2.3.1" = {
+      name = "tldjs";
+      packageName = "tldjs";
+      version = "2.3.1";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/tldjs/-/tldjs-2.3.1.tgz";
+        sha512 = "W/YVH/QczLUxVjnQhFC61Iq232NWu3TqDdO0S/MtXVz4xybejBov4ud+CIwN9aYqjOecEqIy0PscGkwpG9ZyTw==";
+      };
+    };
+    "tmp-0.0.33" = {
+      name = "tmp";
+      packageName = "tmp";
+      version = "0.0.33";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/tmp/-/tmp-0.0.33.tgz";
+        sha512 = "jRCJlojKnZ3addtTOjdIqoRuPEKBvNXcGYqzO6zWZX8KfKEpnGY5jfggJQ3EjKuu8D4bJRr0y+cYJFmYbImXGw==";
+      };
+    };
+    "tslib-1.9.3" = {
+      name = "tslib";
+      packageName = "tslib";
+      version = "1.9.3";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/tslib/-/tslib-1.9.3.tgz";
+        sha512 = "4krF8scpejhaOgqzBEcGM7yDIEfi0/8+8zDRZhNZZ2kjmHJ4hv3zCbQWxoJGz1iw5U0Jl0nma13xzHXcncMavQ==";
+      };
+    };
+    "zxcvbn-4.4.2" = {
+      name = "zxcvbn";
+      packageName = "zxcvbn";
+      version = "4.4.2";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/zxcvbn/-/zxcvbn-4.4.2.tgz";
+        sha1 = "28ec17cf09743edcab056ddd8b1b06262cc73c30";
+      };
+    };
+  };
+in
+{
+  "@bitwarden/cli" = nodeEnv.buildNodePackage {
+    name = "_at_bitwarden_slash_cli";
+    packageName = "@bitwarden/cli";
+    version = "1.7.0";
+    src = fetchurl {
+      url = "https://registry.npmjs.org/@bitwarden/cli/-/cli-1.7.0.tgz";
+      sha512 = "rynqUqyfC33dMQ21OlrOu4MQVEvtjyHw1kmu85+l0j9f2CQWEffeqVwoHF5GTtQOXev4PMyqRfSSYI6dRsseag==";
+    };
+    dependencies = [
+      sources."ansi-escapes-3.1.0"
+      sources."ansi-regex-3.0.0"
+      sources."ansi-styles-3.2.1"
+      sources."asynckit-0.4.0"
+      sources."big-integer-1.6.36"
+      sources."chalk-2.4.1"
+      sources."chardet-0.7.0"
+      sources."cli-cursor-2.1.0"
+      sources."cli-width-2.2.0"
+      sources."color-convert-1.9.3"
+      sources."color-name-1.1.3"
+      sources."combined-stream-1.0.6"
+      sources."commander-2.18.0"
+      sources."delayed-stream-1.0.0"
+      sources."escape-string-regexp-1.0.5"
+      sources."external-editor-3.0.3"
+      sources."figures-2.0.0"
+      sources."form-data-2.3.2"
+      sources."graceful-fs-4.1.15"
+      sources."has-flag-3.0.0"
+      sources."iconv-lite-0.4.24"
+      sources."inquirer-6.2.0"
+      sources."is-fullwidth-code-point-2.0.0"
+      sources."is-promise-2.1.0"
+      sources."lodash-4.17.11"
+      sources."lowdb-1.0.0"
+      sources."lunr-2.3.3"
+      sources."mime-db-1.37.0"
+      sources."mime-types-2.1.21"
+      sources."mimic-fn-1.2.0"
+      sources."mute-stream-0.0.7"
+      sources."node-fetch-2.2.0"
+      sources."node-forge-0.7.6"
+      sources."onetime-2.0.1"
+      sources."os-tmpdir-1.0.2"
+      sources."papaparse-4.6.0"
+      sources."pify-3.0.0"
+      sources."punycode-1.4.1"
+      sources."restore-cursor-2.0.0"
+      sources."run-async-2.3.0"
+      sources."rxjs-6.3.3"
+      sources."safer-buffer-2.1.2"
+      sources."signal-exit-3.0.2"
+      sources."steno-0.4.4"
+      sources."string-width-2.1.1"
+      sources."strip-ansi-4.0.0"
+      sources."supports-color-5.5.0"
+      sources."through-2.3.8"
+      sources."tldjs-2.3.1"
+      sources."tmp-0.0.33"
+      sources."tslib-1.9.3"
+      sources."zxcvbn-4.4.2"
+    ];
+    buildInputs = globalBuildInputs;
+    meta = {
+      description = "A secure and free password manager for all of your devices.";
+      homepage = https://bitwarden.com/;
+      license = "GPL-3.0";
+    };
+    production = true;
+    bypassCache = false;
+  };
+}
\ No newline at end of file
diff --git a/nixpkgs/pkgs/tools/security/bitwarden-cli/node-packages.json b/nixpkgs/pkgs/tools/security/bitwarden-cli/node-packages.json
new file mode 100644
index 000000000000..624aa87bcbea
--- /dev/null
+++ b/nixpkgs/pkgs/tools/security/bitwarden-cli/node-packages.json
@@ -0,0 +1,3 @@
+[
+  "@bitwarden/cli"
+]
diff --git a/nixpkgs/pkgs/tools/security/bitwarden-cli/node-packages.nix b/nixpkgs/pkgs/tools/security/bitwarden-cli/node-packages.nix
new file mode 100644
index 000000000000..0b559600b1b4
--- /dev/null
+++ b/nixpkgs/pkgs/tools/security/bitwarden-cli/node-packages.nix
@@ -0,0 +1,17 @@
+# This file has been generated by node2nix 1.6.0. Do not edit!
+
+{pkgs ? import <nixpkgs> {
+    inherit system;
+  }, system ? builtins.currentSystem, nodejs ? pkgs."nodejs-6_x"}:
+
+let
+  nodeEnv = import ../../../development/node-packages/node-env.nix {
+    inherit (pkgs) stdenv python2 utillinux runCommand writeTextFile;
+    inherit nodejs;
+    libtool = if pkgs.stdenv.isDarwin then pkgs.darwin.cctools else null;
+  };
+in
+import ./node-packages-generated.nix {
+  inherit (pkgs) fetchurl fetchgit;
+  inherit nodeEnv;
+}
\ No newline at end of file
diff --git a/nixpkgs/pkgs/tools/security/eid-mw/default.nix b/nixpkgs/pkgs/tools/security/eid-mw/default.nix
index 6bdc8570982d..9ac62dc334f7 100644
--- a/nixpkgs/pkgs/tools/security/eid-mw/default.nix
+++ b/nixpkgs/pkgs/tools/security/eid-mw/default.nix
@@ -3,7 +3,8 @@
 , gtk3, nssTools, pcsclite
 , libxml2, libproxy 
 , openssl, curl
-, makeWrapper }:
+, makeWrapper
+, substituteAll }:
 
 stdenv.mkDerivation rec {
   name = "eid-mw-${version}";
@@ -32,8 +33,15 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--enable-dialogs=yes" ];
 
-  postInstall = ''
-    install -D ${./eid-nssdb.in} $out/bin/eid-nssdb
+  postInstall =
+  let
+    eid-nssdb-in = substituteAll {
+      inherit (stdenv) shell;
+      src = ./eid-nssdb.in;
+    };
+  in
+  ''
+    install -D ${eid-nssdb-in} $out/bin/eid-nssdb
     substituteInPlace $out/bin/eid-nssdb \
       --replace "modutil" "${nssTools}/bin/modutil"
 
diff --git a/nixpkgs/pkgs/tools/security/ibm-sw-tpm2/default.nix b/nixpkgs/pkgs/tools/security/ibm-sw-tpm2/default.nix
new file mode 100644
index 000000000000..cec31cec3771
--- /dev/null
+++ b/nixpkgs/pkgs/tools/security/ibm-sw-tpm2/default.nix
@@ -0,0 +1,39 @@
+{ stdenv, fetchurl, lib, openssl }:
+
+stdenv.mkDerivation rec {
+  pname = "ibm-sw-tpm2";
+  version = "1332";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/ibmswtpm2/ibmtpm${version}.tar.gz";
+    sha256 = "1zdhi8acd4jfp1v7ibd86hcv0g39yk8qrnhxjmmgzn8i7npr70cf";
+  };
+
+  buildInputs = [ openssl ];
+
+  sourceRoot = "src";
+
+  prePatch = ''
+    # Fix hardcoded path to GCC.
+    substituteInPlace makefile --replace /usr/bin/gcc "${stdenv.cc}/bin/cc"
+
+    # Remove problematic default CFLAGS.
+    substituteInPlace makefile \
+      --replace -Werror "" \
+      --replace -O0 "" \
+      --replace -ggdb ""
+  '';
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp tpm_server $out/bin
+  '';
+
+  meta = with lib; {
+    description = "IBM's Software TPM 2.0, an implementation of the TCG TPM 2.0 specification";
+    homepage = https://sourceforge.net/projects/ibmswtpm2/;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ delroth ];
+    license = licenses.bsd3;
+  };
+}
diff --git a/nixpkgs/pkgs/tools/security/lynis/default.nix b/nixpkgs/pkgs/tools/security/lynis/default.nix
index 46c2e6f03b0d..c72f75e24e27 100644
--- a/nixpkgs/pkgs/tools/security/lynis/default.nix
+++ b/nixpkgs/pkgs/tools/security/lynis/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "lynis";
-  version = "2.7.0";
+  version = "2.7.1";
   name = "${pname}-${version}";
 
   src = fetchFromGitHub {
     owner = "CISOfy";
     repo = "${pname}";
     rev = "${version}";
-    sha256 = "0rzc0y8lk22bymf56249jzmllki2lh0rz5in4lkrc5fkmp29c2wv";
+    sha256 = "1nv2dqd2k2n8mcdr6xl5g713xxkgvja6487by1wn4k0b416jij9i";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/nixpkgs/pkgs/tools/security/mkp224o/default.nix b/nixpkgs/pkgs/tools/security/mkp224o/default.nix
new file mode 100644
index 000000000000..b649c57b3462
--- /dev/null
+++ b/nixpkgs/pkgs/tools/security/mkp224o/default.nix
@@ -0,0 +1,47 @@
+{ stdenv, lib, fetchFromGitHub, autoreconfHook, libsodium }:
+
+stdenv.mkDerivation rec {
+  name = "mkp224o-${version}";
+  version = "1.2.0";
+
+  src = fetchFromGitHub {
+    owner = "cathugger";
+    repo = "mkp224o";
+    rev = "v${version}";
+    sha256 = "1m7r0jfm6na6rk75v1kals3bx2cs6jsfxdgpxdljn39j3qr4mxvd";
+  };
+
+  buildCommand =
+    let
+      # compile few variants with different implementation of crypto
+      # the fastest depends on a particular cpu
+      variants = [
+        { suffix = "ref10";         configureFlags = ["--enable-ref10"]; }
+        { suffix = "donna";         configureFlags = ["--enable-donna"]; }
+      ] ++ lib.optionals (stdenv.isi686 || stdenv.isx86_64) [
+        { suffix = "donna-sse2";    configureFlags = ["--enable-donna-sse2"]; }
+      ] ++ lib.optionals stdenv.isx86_64 [
+        { suffix = "amd64-51-30k";  configureFlags = ["--enable-amd64-51-30k"]; }
+        { suffix = "amd64-64-20k";  configureFlags = ["--enable-amd64-64-24k"]; }
+      ];
+    in
+      lib.concatMapStrings ({suffix, configureFlags}: ''
+        install -D ${
+          stdenv.mkDerivation {
+            name = "mkp224o-${suffix}-${version}";
+            inherit version src configureFlags;
+            nativeBuildInputs = [ autoreconfHook ];
+            buildInputs = [ libsodium ];
+            installPhase = "install -D mkp224o $out";
+          }
+        } $out/bin/mkp224o-${suffix}
+      '') variants;
+
+  meta = with lib; {
+    description = "Vanity address generator for tor onion v3 (ed25519) hidden services";
+    homepage = http://cathug2kyi4ilneggumrenayhuhsvrgn6qv2y47bgeet42iivkpynqad.onion/;
+    license = licenses.cc0;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ volth ];
+  };
+}
diff --git a/nixpkgs/pkgs/tools/security/pass/rofi-pass.nix b/nixpkgs/pkgs/tools/security/pass/rofi-pass.nix
index 3928f61fa96a..5a432a8890e4 100644
--- a/nixpkgs/pkgs/tools/security/pass/rofi-pass.nix
+++ b/nixpkgs/pkgs/tools/security/pass/rofi-pass.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   name = "rofi-pass-${version}";
-  version = "2.0.1";
+  version = "2.0.2";
 
   src = fetchFromGitHub {
     owner = "carnager";
     repo = "rofi-pass";
     rev = version;
-    sha256 = "1r5z9g2kc6qf9r2d7vanzdc594apf8fgyn1rh30fvxygl2976yrw";
+    sha256 = "131jpcwyyzgzjn9lx4k1zn95pd68pjw4i41jfzcp9z9fnazyln5n";
   };
 
   buildInputs = [ makeWrapper ];
diff --git a/nixpkgs/pkgs/tools/security/pgpdump/default.nix b/nixpkgs/pkgs/tools/security/pgpdump/default.nix
index 82bec2486e81..9c8f47cd2756 100644
--- a/nixpkgs/pkgs/tools/security/pgpdump/default.nix
+++ b/nixpkgs/pkgs/tools/security/pgpdump/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     '';
     homepage = http://www.mew.org/~kazu/proj/pgpdump/en/;
     license = licenses.bsd3;
-    platforms = platforms.linux;
+    platforms = platforms.unix;
     maintainers = with maintainers; [ primeos ];
   };
 }
diff --git a/nixpkgs/pkgs/tools/security/rhash/default.nix b/nixpkgs/pkgs/tools/security/rhash/default.nix
index 27f2ca04d710..5e622cf68f35 100644
--- a/nixpkgs/pkgs/tools/security/rhash/default.nix
+++ b/nixpkgs/pkgs/tools/security/rhash/default.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchFromGitHub, which }:
 
 stdenv.mkDerivation rec {
-  version = "1.3.6";
+  version = "1.3.8";
   name = "rhash-${version}";
 
   src = fetchFromGitHub {
     owner = "rhash";
     repo = "RHash";
     rev = "v${version}";
-    sha256 = "1c8gngjj34ylx1f56hjbvml22bif0bx1b88dx2cyxbix8praxqh7";
+    sha256 = "0i00wl63hn80g0s9gdi772gchbghwgkvn4nbb5227y2wwy30yyi2";
   };
 
   nativeBuildInputs = [ which ];
@@ -16,10 +16,11 @@ stdenv.mkDerivation rec {
   # configure script is not autotools-based, doesn't support these options
   configurePlatforms = [ ];
 
-  doCheck = false; # fails
+  doCheck = true;
 
-  installTargets = [ "install" "install-lib-shared" "install-lib-so-link" ];
-  postInstall = "make -C librhash install-headers";
+  checkTarget = "test-full";
+
+  installTargets = [ "install" "install-lib-shared" "install-lib-so-link" "install-lib-headers" ];
 
   meta = with stdenv.lib; {
     homepage = http://rhash.anz.ru;
diff --git a/nixpkgs/pkgs/tools/security/tpm2-tools/default.nix b/nixpkgs/pkgs/tools/security/tpm2-tools/default.nix
new file mode 100644
index 000000000000..84369e6ea54d
--- /dev/null
+++ b/nixpkgs/pkgs/tools/security/tpm2-tools/default.nix
@@ -0,0 +1,38 @@
+{ stdenv, fetchurl, fetchpatch, lib
+, cmocka, curl, pandoc, pkgconfig, openssl, tpm2-tss }:
+
+stdenv.mkDerivation rec {
+  pname = "tpm2-tools";
+  version = "3.1.3";
+
+  src = fetchurl {
+    url = "https://github.com/tpm2-software/${pname}/releases/download/${version}/${pname}-${version}.tar.gz";
+    sha256 = "05is1adwcg7y2p121yldd8m1gigdnzf9izbjazvsr6yg95pmg5fc";
+  };
+
+  patches = [
+    (fetchpatch {
+      name = "tests-tss-2.2.0-compat.patch";
+      url = "https://patch-diff.githubusercontent.com/raw/tpm2-software/tpm2-tools/pull/1322.patch";
+      sha256 = "0yy5qbgbd13d7cl8pzsji95a6qnwiik5s2cyqj35jd8blymikqxh";
+    })
+  ];
+
+  nativeBuildInputs = [ pandoc pkgconfig ];
+  buildInputs = [
+    curl openssl tpm2-tss
+    # For unit tests.
+    cmocka
+  ];
+
+  configureFlags = [ "--enable-unit" ];
+  doCheck = true;
+
+  meta = with lib; {
+    description = "Command line tools that provide access to a TPM 2.0 compatible device";
+    homepage = https://github.com/tpm2-software/tpm2-tools;
+    license = licenses.bsd3;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ delroth ];
+  };
+}
diff --git a/nixpkgs/pkgs/tools/security/vault/default.nix b/nixpkgs/pkgs/tools/security/vault/default.nix
index c21064c708d4..35b39196b336 100644
--- a/nixpkgs/pkgs/tools/security/vault/default.nix
+++ b/nixpkgs/pkgs/tools/security/vault/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "vault-${version}";
-  version = "1.0.2";
+  version = "1.0.3";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = "vault";
     rev = "v${version}";
-    sha256 = "1nrqwgxfs6n2bjhjndqvwzn9c62pb5ky9biyh47i0wvbxhdh0hfj";
+    sha256 = "1c5v1m8b6nm28mjwpsgc73n8q475pkzpdvyx46rf3xyrh01rfrnz";
   };
 
   nativeBuildInputs = [ go gox removeReferencesTo ];
diff --git a/nixpkgs/pkgs/tools/system/gotop/default.nix b/nixpkgs/pkgs/tools/system/gotop/default.nix
index 2b918d155817..745139f9e50b 100644
--- a/nixpkgs/pkgs/tools/system/gotop/default.nix
+++ b/nixpkgs/pkgs/tools/system/gotop/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   name = "gotop-${version}";
-  version = "1.7.1";
+  version = "2.0.1";
 
   goPackagePath = "github.com/cjbassi/gotop";
 
@@ -10,11 +10,9 @@ buildGoPackage rec {
     repo = "gotop";
     owner = "cjbassi";
     rev = version;
-    sha256 = "0dxnhal10kv6ypsg6mildzpz6vi1iw996q47f4rv8hvfyrffhzc9";
+    sha256 = "0xpm8nrn53kz65f93czflgdgr2a33qfi1w0gsgngrmaliq1vlpji";
   };
 
-  goDeps = ./deps.nix;
-
   meta = with stdenv.lib; {
     description = "A terminal based graphical activity monitor inspired by gtop and vtop";
     homepage = https://github.com/cjbassi/gotop;
diff --git a/nixpkgs/pkgs/tools/system/gotop/deps.nix b/nixpkgs/pkgs/tools/system/gotop/deps.nix
deleted file mode 100644
index ceae7857551f..000000000000
--- a/nixpkgs/pkgs/tools/system/gotop/deps.nix
+++ /dev/null
@@ -1,39 +0,0 @@
-# This file was generated by https://github.com/kamilchm/go2nix v1.3.0
-[
-  {
-    goPackagePath = "github.com/cjbassi/termui";
-    fetch = {
-      type = "git";
-      url = "https://github.com/cjbassi/termui";
-      rev = "e8dd23f6146c0e0d80f1be0163b8069abfbb921b";
-      sha256 = "0jds2mpa7whrwaznlkcn2y92q41zbf2rjj5267kl8zqllbia8cbx";
-    };
-  }
-  {
-    goPackagePath = "github.com/docopt/docopt-go";
-    fetch = {
-      type = "git";
-      url = "https://github.com/docopt/docopt-go";
-      rev = "ee0de3bc6815ee19d4a46c7eb90f829db0e014b1";
-      sha256 = "0hlra7rmi5pmd7d93rv56ahiy4qkgmq8a6mz0jpadvbi5qh8lq6j";
-    };
-  }
-  {
-    goPackagePath = "github.com/shirou/gopsutil";
-    fetch = {
-      type = "git";
-      url = "https://github.com/shirou/gopsutil";
-      rev = "51e6519305e4871657c291a6281fcddc6364bbef";
-      sha256 = "1pvvaj51m0w2v6bp5hhhzfy27hbicf4ga7r9m073vqcwjnfyz431";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/sys";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/sys";
-      rev = "9b800f95dbbc54abff0acf7ee32d88ba4e328c89";
-      sha256 = "07v3l7q7y59cwvw0mc85i39v7qjcc1jh4svwi789rmrqqm5nq7q6";
-    };
-  }
-]
diff --git a/nixpkgs/pkgs/tools/system/osquery/default.nix b/nixpkgs/pkgs/tools/system/osquery/default.nix
index 32c085e2ec5f..1e2882e1f1fe 100644
--- a/nixpkgs/pkgs/tools/system/osquery/default.nix
+++ b/nixpkgs/pkgs/tools/system/osquery/default.nix
@@ -4,7 +4,7 @@
 , beecrypt, augeas, libxml2, sleuthkit, yara, lldpd, google-gflags
 , thrift, boost, rocksdb_lite, glog, gbenchmark, snappy
 , openssl, file, doxygen
-, gtest, sqlite, fpm, zstd, rdkafka, rapidjson, fetchgit
+, gtest, sqlite, fpm, zstd, rdkafka, rapidjson, fetchgit, fetchurl
 }:
 
 let
@@ -61,6 +61,16 @@ stdenv.mkDerivation rec {
         sha256 = "1ny3srcsxd6kj59zq1cman5myj8kzw010wbyc6mrpk4kp823r5nx";
       };
     });
+
+    # dpkg 1.19.2 dropped api in `<dpkg/dpkg-db.h>` which breaks compilation.
+    dpkg' = dpkg.overrideAttrs (old: rec {
+      name = "dpkg-${version}";
+      version = "1.19.0.5";
+      src = fetchurl {
+        url = "mirror://debian/pool/main/d/dpkg/dpkg_${version}.tar.xz";
+        sha256 = "1dc5kp3fqy1k66fly6jfxkkg7w6d0jy8szddpfyc2xvzga94d041";
+      };
+    });
   in [
     udev audit
 
@@ -69,7 +79,7 @@ stdenv.mkDerivation rec {
       customMemoryManagement = false;
     })
 
-    lvm2' libgcrypt libarchive libgpgerror libuuid iptables dpkg
+    lvm2' libgcrypt libarchive libgpgerror libuuid iptables dpkg'
     lzma bzip2 rpm beecrypt augeas libxml2 sleuthkit
     yara lldpd gflags' thrift boost
     glog gbenchmark snappy openssl
diff --git a/nixpkgs/pkgs/tools/typesetting/lout/builder.sh b/nixpkgs/pkgs/tools/typesetting/lout/builder.sh
index cd3b9c67e3c9..61459e48b7f0 100755
--- a/nixpkgs/pkgs/tools/typesetting/lout/builder.sh
+++ b/nixpkgs/pkgs/tools/typesetting/lout/builder.sh
@@ -1,5 +1,3 @@
-#!/bin/sh
-
 # Prepare a makefile specifying the appropriate output directories.
 #
 # Written by Ludovic Courtès <ludo@gnu.org>.
diff --git a/nixpkgs/pkgs/tools/video/mjpegtools/default.nix b/nixpkgs/pkgs/tools/video/mjpegtools/default.nix
index 197caca0d86c..31d26a6c72a3 100644
--- a/nixpkgs/pkgs/tools/video/mjpegtools/default.nix
+++ b/nixpkgs/pkgs/tools/video/mjpegtools/default.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, fetchurl, gtk2, libdv, libjpeg, libpng, libX11, pkgconfig, SDL, SDL_gfx
-, withMinimal ? false
+, withMinimal ? true
 }:
 
 # TODO:
diff --git a/nixpkgs/pkgs/tools/virtualization/google-compute-engine-oslogin/default.nix b/nixpkgs/pkgs/tools/virtualization/google-compute-engine-oslogin/default.nix
index 5096c7f94686..012090ba079d 100644
--- a/nixpkgs/pkgs/tools/virtualization/google-compute-engine-oslogin/default.nix
+++ b/nixpkgs/pkgs/tools/virtualization/google-compute-engine-oslogin/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     # change sudoers dir from /var/google-sudoers.d to /run/google-sudoers.d (managed through systemd-tmpfiles)
     substituteInPlace pam_module/pam_oslogin_admin.cc --replace /var/google-sudoers.d /run/google-sudoers.d
     # fix "User foo not allowed because shell /bin/bash does not exist"
-    substituteInPlace utils/oslogin_utils.cc --replace /bin/bash /bin/sh
+    substituteInPlace utils/oslogin_utils.cc --replace /bin/bash ${stdenv.shell}
   '';
 
   buildInputs = [ curl.dev pam ];