9 files changed, 57 insertions, 23 deletions
diff --git a/pkgs/tools/security/clamav/default.nix b/pkgs/tools/security/clamav/default.nix
index 0cb34b2e73c9..88df4d78d26b 100644
--- a/pkgs/tools/security/clamav/default.nix
+++ b/pkgs/tools/security/clamav/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, zlib, bzip2, libiconv, libxml2, openssl, ncurses, curl
-, libmilter, pcre, freshclamConf ? null }:
+, libmilter, pcre }:
 
 stdenv.mkDerivation rec {
   name = "clamav-${version}";
@@ -10,9 +10,17 @@ stdenv.mkDerivation rec {
     sha256 = "0yh2q318bnmf2152g2h1yvzgqbswn0wvbzb8p4kf7v057shxcyqn";
   };
 
-  buildInputs = [ zlib bzip2 libxml2 openssl ncurses curl libiconv libmilter pcre ];
+  # don't install sample config files into the absolute sysconfdir folder
+  postPatch = ''
+    substituteInPlace Makefile.in --replace ' etc ' ' '
+  '';
+
+  buildInputs = [
+    zlib bzip2 libxml2 openssl ncurses curl libiconv libmilter pcre
+  ];
 
   configureFlags = [
+    "--sysconfdir=/etc/clamav"
     "--with-zlib=${zlib.dev}"
     "--with-libbz2-prefix=${bzip2.dev}"
     "--with-iconv-dir=${libiconv}"
@@ -22,10 +30,12 @@ stdenv.mkDerivation rec {
     "--with-libcurl=${curl.dev}"
     "--with-pcre=${pcre.dev}"
     "--enable-milter"
-    "--disable-clamav"
   ];
 
-  fixupPhase = if (freshclamConf != null) then ''echo "${freshclamConf}" > $out/etc/freshclam.conf'' else "";
+  postInstall = ''
+    mkdir $out/etc
+    cp etc/*.sample $out/etc
+  '';
 
   meta = with stdenv.lib; {
     homepage = http://www.clamav.net;
diff --git a/pkgs/tools/security/eid-mw/default.nix b/pkgs/tools/security/eid-mw/default.nix
index 5ee630539b69..f26b2d3308b7 100644
--- a/pkgs/tools/security/eid-mw/default.nix
+++ b/pkgs/tools/security/eid-mw/default.nix
@@ -4,10 +4,10 @@
 
 stdenv.mkDerivation rec {
   name = "eid-mw-${version}";
-  version = "4.1.18";
+  version = "4.1.19";
 
   src = fetchFromGitHub {
-    sha256 = "049rxrlcwcb9yir8q2inmqlslp49alpgm4pccl138xl34cg1hyhl";
+    sha256 = "191c74kxfrfb894v8y4vi2iygyffjy9jjq5fj7cnnddgwai5n3c5";
     rev = "v${version}";
     repo = "eid-mw";
     owner = "Fedict";
diff --git a/pkgs/tools/security/fprintd/default.nix b/pkgs/tools/security/fprintd/default.nix
index fb72782abee6..e5bf5a08afc7 100644
--- a/pkgs/tools/security/fprintd/default.nix
+++ b/pkgs/tools/security/fprintd/default.nix
@@ -2,11 +2,12 @@
 , libfprint, glib, dbus_glib, polkit, nss, pam, systemd }:
 
 stdenv.mkDerivation rec {
-  name = "fprintd-0.6.0";
+  name = "fprintd-${version}";
+  version = "0.7.0";
 
   src = fetchurl {
     url = "http://people.freedesktop.org/~hadess/${name}.tar.xz";
-    sha256 = "1by6nvlrqkwzcz2v2kyq6avi3h384vmlr42vj9s2yzcinkp64m1z";
+    sha256 = "05915i0bv7q62fqrs5diqwr8dz3pwqa1c1ivcgggkjyw0xk4ldp5";
   };
 
   buildInputs = [ libfprint glib dbus_glib polkit nss pam systemd ];
diff --git a/pkgs/tools/security/gnupg/21.nix b/pkgs/tools/security/gnupg/21.nix
index b7a71332e772..a4b47843583f 100644
--- a/pkgs/tools/security/gnupg/21.nix
+++ b/pkgs/tools/security/gnupg/21.nix
@@ -15,11 +15,11 @@ assert guiSupport -> pinentry != null;
 stdenv.mkDerivation rec {
   name = "gnupg-${version}";
 
-  version = "2.1.15";
+  version = "2.1.16";
 
   src = fetchurl {
     url = "mirror://gnupg/gnupg/${name}.tar.bz2";
-    sha256 = "1pgz02gd84ab94w4xdg67p9z8kvkyr9d523bvcxxd2hviwh1m362";
+    sha256 = "0i483m9q032a0s50f1izb213g4h5i7pcgn395m6hvl3sg2kadfa9";
   };
 
   buildInputs = [
@@ -27,6 +27,8 @@ stdenv.mkDerivation rec {
     readline libusb gnutls adns openldap zlib bzip2
   ];
 
+  NIX_LDFLAGS = stdenv.lib.optionalString stdenv.isDarwin "-lintl";
+
   patches = [ ./fix-libusb-include-path.patch ];
   postPatch = stdenv.lib.optionalString stdenv.isLinux ''
     sed -i 's,"libpcsclite\.so[^"]*","${pcsclite}/lib/libpcsclite.so",g' scd/scdaemon.c
diff --git a/pkgs/tools/security/kbfs/default.nix b/pkgs/tools/security/kbfs/default.nix
index fb7b8cc9fe74..a38e70df6323 100644
--- a/pkgs/tools/security/kbfs/default.nix
+++ b/pkgs/tools/security/kbfs/default.nix
@@ -1,8 +1,8 @@
 { stdenv, buildGoPackage, fetchFromGitHub }:
 
 buildGoPackage rec {
-  name = "kbfs-2016-08-02-git";
-  version = "1.0.16";
+  name = "kbfs-2016-11-18-git";
+  version = "1.0.2";
 
   goPackagePath = "github.com/keybase/kbfs";
   subPackages = [ "kbfsfuse" ];
@@ -12,8 +12,8 @@ buildGoPackage rec {
   src = fetchFromGitHub {
     owner = "keybase";
     repo = "kbfs";
-    rev = "a8f0714536d15668e0f561ec4d3324762c8cf030";
-    sha256 = "0m4k55akd8cv5k8mfpm3rb3fz13z31l49pml7mgviv0hi3mnisqd";
+    rev = "aac615d7c50e7512a51a133c14cb699d9941ba8c";
+    sha256 = "0vah6x37g2w1f7mb5x16f1815608mvv2d1mrpkpnhz2gz7qzz6bv";
   };
 
   buildFlags = [ "-tags production" ];
diff --git a/pkgs/tools/security/keybase/default.nix b/pkgs/tools/security/keybase/default.nix
index c4d0f20d6c2d..fbed233b090d 100644
--- a/pkgs/tools/security/keybase/default.nix
+++ b/pkgs/tools/security/keybase/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   name = "keybase-${version}";
-  version = "1.0.17";
+  version = "1.0.18";
   rev = "v${version}";
 
   goPackagePath = "github.com/keybase/client";
@@ -14,7 +14,7 @@ buildGoPackage rec {
     owner = "keybase";
     repo = "client";
     inherit rev;
-    sha256 = "14cj0npsvnc3whw7gashgd7lhj3lvjdkivsnvsjg7dp3hifvqxnx";
+    sha256 = "16n9fwx8v3jradp1l2564872akq6npib794jadfl5d122cll0n7h";
   };
 
   buildFlags = [ "-tags production" ];
diff --git a/pkgs/tools/security/phrasendrescher/default.nix b/pkgs/tools/security/phrasendrescher/default.nix
new file mode 100644
index 000000000000..814bc0d85302
--- /dev/null
+++ b/pkgs/tools/security/phrasendrescher/default.nix
@@ -0,0 +1,21 @@
+{ stdenv, fetchurl, openssl }:
+
+stdenv.mkDerivation rec {
+  name = "phrasendrescher-${version}";
+  version = "1.0";
+
+  src = fetchurl {
+    url = "http://leidecker.info/projects/phrasendrescher/${name}.tar.gz";
+    sha256 = "1r0j7ms3i324p6if9cg8i0q900zqfjpvfr8pwj181x8ascysbbf2";
+  };
+
+  buildInputs = [ openssl ];
+
+  meta = with stdenv.lib; {
+    description = "Cracking tool that finds passphrases of SSH keys";
+    homepage = "http://leidecker.info/projects/phrasendrescher.shtml";
+    license = licenses.gpl2Plus;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ bjornfor ];
+  };
+}
diff --git a/pkgs/tools/security/softhsm/default.nix b/pkgs/tools/security/softhsm/default.nix
index 4bd199686763..5f282dd378a5 100644
--- a/pkgs/tools/security/softhsm/default.nix
+++ b/pkgs/tools/security/softhsm/default.nix
@@ -21,11 +21,11 @@ stdenv.mkDerivation rec {
 
   postInstall = "rm -rf $out/var";
 
-  meta = {
+  meta = with stdenv.lib; {
     homepage = https://www.opendnssec.org/softhsm;
     description = "Cryptographic store accessible through a PKCS #11 interface";
-    license = stdenv.lib.licenses.bsd2;
-    maintainers = stdenv.lib.maintainers.leenaars;
-    platforms = stdenv.lib.platforms.linux;
+    license = licenses.bsd2;
+    maintainers = [ maintainers.leenaars ];
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/tools/security/tor/torbrowser.nix b/pkgs/tools/security/tor/torbrowser.nix
index 900ad39ecb23..be93b291dcc2 100644
--- a/pkgs/tools/security/tor/torbrowser.nix
+++ b/pkgs/tools/security/tor/torbrowser.nix
@@ -12,13 +12,13 @@ in
 
 stdenv.mkDerivation rec {
   name = "tor-browser-${version}";
-  version = "6.0.5";
+  version = "6.0.6";
 
   src = fetchurl {
     url = "https://archive.torproject.org/tor-package-archive/torbrowser/${version}/tor-browser-linux${if stdenv.is64bit then "64" else "32"}-${version}_en-US.tar.xz";
     sha256 = if stdenv.is64bit then
-      "fc917bd702b1275cae3f7fa8036c3c44af9b4f003f3d4a8fbb9f6c0974277ad4" else
-      "e0c3ce406b6de082692ce3db52b6e04053e205194b26fbf0eee9014be543d98d";
+      "0ydcbkpyrdwsqn841cxzpbr05nzly720xhsin89gjc1sirvmlxmx" else
+      "0q8ygkgs47wjq12l37kwm93v1420gzrlacwqc0yz4b3b58aa1d4z";
   };
 
   desktopItem = makeDesktopItem {