about summary refs log tree commit diff
path: root/pkgs/tools
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs/tools')
-rw-r--r--pkgs/tools/X11/xnee/default.nix2
-rw-r--r--pkgs/tools/archivers/rpmextract/default.nix1
-rw-r--r--pkgs/tools/archivers/rpmextract/rpmextract.sh2
-rw-r--r--pkgs/tools/archivers/unzip/CVE-2018-18384.patch35
-rw-r--r--pkgs/tools/archivers/unzip/default.nix1
-rw-r--r--pkgs/tools/backup/flockit/default.nix2
-rw-r--r--pkgs/tools/backup/store-backup/default.nix2
-rw-r--r--pkgs/tools/bluetooth/blueman/default.nix4
-rw-r--r--pkgs/tools/filesystems/e2fsprogs/default.nix2
-rw-r--r--pkgs/tools/graphics/briss/default.nix2
-rw-r--r--pkgs/tools/graphics/graphviz/base.nix20
-rw-r--r--pkgs/tools/graphics/lepton/default.nix24
-rw-r--r--pkgs/tools/graphics/povray/default.nix2
-rw-r--r--pkgs/tools/graphics/sng/default.nix2
-rw-r--r--pkgs/tools/misc/aptly/default.nix8
-rw-r--r--pkgs/tools/misc/coreutils/default.nix3
-rw-r--r--pkgs/tools/misc/fzf/default.nix2
-rw-r--r--pkgs/tools/misc/grub/2.0x.nix32
-rw-r--r--pkgs/tools/misc/grub/relocation-not-implemented.diff25
-rw-r--r--pkgs/tools/misc/grub/trusted.nix2
-rw-r--r--pkgs/tools/misc/hashit/default.nix10
-rw-r--r--pkgs/tools/misc/mpdscribble/default.nix2
-rw-r--r--pkgs/tools/misc/multitail/default.nix2
-rw-r--r--pkgs/tools/misc/qjoypad/default.nix2
-rw-r--r--pkgs/tools/misc/skim/default.nix5
-rw-r--r--pkgs/tools/misc/smenu/default.nix2
-rw-r--r--pkgs/tools/misc/vdirsyncer/default.nix2
-rw-r--r--pkgs/tools/misc/vimer/default.nix2
-rw-r--r--pkgs/tools/misc/watchexec/default.nix4
-rw-r--r--pkgs/tools/misc/xfstests/default.nix2
-rw-r--r--pkgs/tools/misc/xsel/default.nix11
-rw-r--r--pkgs/tools/misc/youtube-dl/default.nix4
-rw-r--r--pkgs/tools/networking/airfield/default.nix2
-rw-r--r--pkgs/tools/networking/http-prompt/default.nix2
-rw-r--r--pkgs/tools/networking/lftp/default.nix4
-rw-r--r--pkgs/tools/networking/tcpdump/default.nix2
-rw-r--r--pkgs/tools/networking/zap/default.nix2
-rw-r--r--pkgs/tools/security/eid-mw/default.nix14
-rw-r--r--pkgs/tools/security/ibm-sw-tpm2/default.nix39
-rw-r--r--pkgs/tools/security/pgpdump/default.nix2
-rw-r--r--pkgs/tools/security/rhash/default.nix11
-rw-r--r--pkgs/tools/security/tpm2-tools/default.nix38
-rw-r--r--pkgs/tools/system/gotop/default.nix6
-rw-r--r--pkgs/tools/system/gotop/deps.nix39
-rwxr-xr-xpkgs/tools/typesetting/lout/builder.sh2
-rw-r--r--pkgs/tools/virtualization/google-compute-engine-oslogin/default.nix2
46 files changed, 266 insertions, 120 deletions
diff --git a/pkgs/tools/X11/xnee/default.nix b/pkgs/tools/X11/xnee/default.nix
index 7b7d5d1aeedc..a84f101cdf7b 100644
--- a/pkgs/tools/X11/xnee/default.nix
+++ b/pkgs/tools/X11/xnee/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   patchPhase =
     '' for i in `find cnee/test -name \*.sh`
        do
-         sed -i "$i" -e's|/bin/bash|/bin/sh|g ; s|/usr/bin/env bash|/bin/sh|g'
+         sed -i "$i" -e's|/bin/bash|${stdenv.shell}|g ; s|/usr/bin/env bash|${stdenv.shell}|g'
        done
     '';
 
diff --git a/pkgs/tools/archivers/rpmextract/default.nix b/pkgs/tools/archivers/rpmextract/default.nix
index 8d4d5fd8dddd..6d5041c52d03 100644
--- a/pkgs/tools/archivers/rpmextract/default.nix
+++ b/pkgs/tools/archivers/rpmextract/default.nix
@@ -10,6 +10,7 @@ stdenv.mkDerivation rec {
   script = substituteAll {
     src = ./rpmextract.sh;
     inherit rpm cpio;
+    inherit (stdenv) shell;
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/archivers/rpmextract/rpmextract.sh b/pkgs/tools/archivers/rpmextract/rpmextract.sh
index 04f57f6e6045..6ebfa251955d 100644
--- a/pkgs/tools/archivers/rpmextract/rpmextract.sh
+++ b/pkgs/tools/archivers/rpmextract/rpmextract.sh
@@ -1,4 +1,4 @@
-#!/bin/sh -e
+#!@shell@ -e
 
 if [ "$1" = "" ]; then
   echo "usage: rpmextract package_name..." 1>&2
diff --git a/pkgs/tools/archivers/unzip/CVE-2018-18384.patch b/pkgs/tools/archivers/unzip/CVE-2018-18384.patch
new file mode 100644
index 000000000000..e9320e125cf6
--- /dev/null
+++ b/pkgs/tools/archivers/unzip/CVE-2018-18384.patch
@@ -0,0 +1,35 @@
+--- unzip60/list.c	
++++ unzip60/list.c	
+@@ -97,7 +97,7 @@ int list_files(__G)    /* return PK-type
+ {
+     int do_this_file=FALSE, cfactor, error, error_in_archive=PK_COOL;
+ #ifndef WINDLL
+-    char sgn, cfactorstr[10];
++    char sgn, cfactorstr[1+10+1+1];	/* <sgn><int>%NUL */
+     int longhdr=(uO.vflag>1);
+ #endif
+     int date_format;
+@@ -389,9 +389,9 @@ int list_files(__G)    /* return PK-type
+             }
+ #else /* !WINDLL */
+             if (cfactor == 100)
+-                sprintf(cfactorstr, LoadFarString(CompFactor100));
++                snprintf(cfactorstr, sizeof(cfactorstr), LoadFarString(CompFactor100));
+             else
+-                sprintf(cfactorstr, LoadFarString(CompFactorStr), sgn, cfactor);
++                snprintf(cfactorstr, sizeof(cfactorstr), LoadFarString(CompFactorStr), sgn, cfactor);
+             if (longhdr)
+                 Info(slide, 0, ((char *)slide, LoadFarString(LongHdrStats),
+                   FmZofft(G.crec.ucsize, "8", "u"), methbuf,
+@@ -471,9 +471,9 @@ int list_files(__G)    /* return PK-type
+ 
+ #else /* !WINDLL */
+         if (cfactor == 100)
+-            sprintf(cfactorstr, LoadFarString(CompFactor100));
++            snprintf(cfactorstr, sizeof(cfactorstr), LoadFarString(CompFactor100));
+         else
+-            sprintf(cfactorstr, LoadFarString(CompFactorStr), sgn, cfactor);
++            snprintf(cfactorstr, sizeof(cfactorstr), LoadFarString(CompFactorStr), sgn, cfactor);
+         if (longhdr) {
+             Info(slide, 0, ((char *)slide, LoadFarString(LongFileTrailer),
+               FmZofft(tot_ucsize, "8", "u"), FmZofft(tot_csize, "8", "u"),
diff --git a/pkgs/tools/archivers/unzip/default.nix b/pkgs/tools/archivers/unzip/default.nix
index 7c4bb988b629..cdf189e82df5 100644
--- a/pkgs/tools/archivers/unzip/default.nix
+++ b/pkgs/tools/archivers/unzip/default.nix
@@ -24,6 +24,7 @@ stdenv.mkDerivation {
     ./CVE-2015-7697.diff
     ./CVE-2014-9913.patch
     ./CVE-2016-9844.patch
+    ./CVE-2018-18384.patch
     ./dont-hardcode-cc.patch
   ] ++ stdenv.lib.optional enableNLS
     (fetchurl {
diff --git a/pkgs/tools/backup/flockit/default.nix b/pkgs/tools/backup/flockit/default.nix
index e569d9b6d598..e6284aa42d75 100644
--- a/pkgs/tools/backup/flockit/default.nix
+++ b/pkgs/tools/backup/flockit/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     cp ./libflockit.so $out/lib
 
     (cat <<EOI
-    #!/bin/sh
+    #!${stdenv.shell}
     env LD_PRELOAD="$out/lib/libflockit.so" FLOCKIT_FILE_PREFIX=\$1 \''${@:2}
     EOI
     ) > $out/bin/flockit
diff --git a/pkgs/tools/backup/store-backup/default.nix b/pkgs/tools/backup/store-backup/default.nix
index 5f44e19fdf27..7324f75d95fa 100644
--- a/pkgs/tools/backup/store-backup/default.nix
+++ b/pkgs/tools/backup/store-backup/default.nix
@@ -9,7 +9,7 @@
 
 # known impurity: test cases seem to bu using /tmp/storeBackup.lock ..
 
-let dummyMount = writeScriptBin "mount" "#!/bin/sh";
+let dummyMount = writeScriptBin "mount" "#!${stdenv.shell}";
 in
 
 stdenv.mkDerivation rec {
diff --git a/pkgs/tools/bluetooth/blueman/default.nix b/pkgs/tools/bluetooth/blueman/default.nix
index 63affdde7183..84a2375302f7 100644
--- a/pkgs/tools/bluetooth/blueman/default.nix
+++ b/pkgs/tools/bluetooth/blueman/default.nix
@@ -1,7 +1,7 @@
-{ stdenv, lib, fetchurl, intltool, pkgconfig, python3Packages, bluez, gtk3
+{ config, stdenv, lib, fetchurl, intltool, pkgconfig, python3Packages, bluez, gtk3
 , obex_data_server, xdg_utils, libnotify, dnsmasq, dhcp
 , hicolor-icon-theme, librsvg, wrapGAppsHook, gobject-introspection
-, withPulseAudio ? true, libpulseaudio }:
+, withPulseAudio ? config.pulseaudio or stdenv.isLinux, libpulseaudio }:
 
 let
   pythonPackages = python3Packages;
diff --git a/pkgs/tools/filesystems/e2fsprogs/default.nix b/pkgs/tools/filesystems/e2fsprogs/default.nix
index 2c597ccef35e..806469493900 100644
--- a/pkgs/tools/filesystems/e2fsprogs/default.nix
+++ b/pkgs/tools/filesystems/e2fsprogs/default.nix
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
     homepage = http://e2fsprogs.sourceforge.net/;
     description = "Tools for creating and checking ext2/ext3/ext4 filesystems";
     license = licenses.gpl2;
-    platforms = platforms.linux;
+    platforms = platforms.unix;
     maintainers = [ maintainers.eelco ];
   };
 }
diff --git a/pkgs/tools/graphics/briss/default.nix b/pkgs/tools/graphics/briss/default.nix
index a5045f97b45d..fb9b7cae488f 100644
--- a/pkgs/tools/graphics/briss/default.nix
+++ b/pkgs/tools/graphics/briss/default.nix
@@ -18,7 +18,7 @@ in stdenv.mkDerivation {
     mkdir -p "$out/bin";
     mkdir -p "$out/share";
     install -D -m444 -t "$out/share" *.jar
-    echo "#!/bin/sh" > "$out/bin/briss"
+    echo "#!${stdenv.shell}" > "$out/bin/briss"
     echo "${jre}/bin/java -Xms128m -Xmx1024m -cp \"$out/share/\" -jar \"$out/share/briss-${version}.jar\"" >> "$out/bin/briss"
     chmod +x "$out/bin/briss"
   '';
diff --git a/pkgs/tools/graphics/graphviz/base.nix b/pkgs/tools/graphics/graphviz/base.nix
index 68ff84c7495a..db21df9b5d0d 100644
--- a/pkgs/tools/graphics/graphviz/base.nix
+++ b/pkgs/tools/graphics/graphviz/base.nix
@@ -2,12 +2,26 @@
 
 { stdenv, fetchFromGitLab, autoreconfHook, pkgconfig, cairo, expat, flex
 , fontconfig, gd, gettext, gts, libdevil, libjpeg, libpng, libtool, pango
-, yacc, xorg ? null, ApplicationServices ? null }:
+, yacc, fetchpatch, xorg ? null, ApplicationServices ? null }:
 
 assert stdenv.isDarwin -> ApplicationServices != null;
 
 let
   inherit (stdenv.lib) optionals optionalString;
+  raw_patch =
+    # https://gitlab.com/graphviz/graphviz/issues/1367 CVE-2018-10196
+    fetchpatch {
+      name = "CVE-2018-10196.patch";
+      url = https://gitlab.com/graphviz/graphviz/uploads/30f8f0b00e357c112ac35fb20241604a/p.diff;
+      sha256 = "074qx6ch9blrnlilmz7p96fkiz2va84x2fbqdza5k4808rngirc7";
+      excludes = ["tests/*"]; # we don't run them and they don't apply
+    };
+  # the patch needs a small adaption for older versions
+  patch = if stdenv.lib.versionAtLeast version "2.37" then raw_patch else
+  stdenv.mkDerivation {
+    inherit (raw_patch) name;
+    buildCommand = "sed s/dot_root/agroot/g ${raw_patch} > $out";
+  };
 in
 
 stdenv.mkDerivation rec {
@@ -37,6 +51,10 @@ stdenv.mkDerivation rec {
     "--with-ltdl-include=${libtool}/include"
   ] ++ stdenv.lib.optional (xorg == null) [ "--without-x" ];
 
+  patches = [
+    patch
+  ];
+
   postPatch = ''
     for f in $(find . -name Makefile.in); do
       substituteInPlace $f --replace "-lstdc++" "-lc++"
diff --git a/pkgs/tools/graphics/lepton/default.nix b/pkgs/tools/graphics/lepton/default.nix
new file mode 100644
index 000000000000..fec092db0c52
--- /dev/null
+++ b/pkgs/tools/graphics/lepton/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, fetchFromGitHub, cmake, git, glibc }:
+
+stdenv.mkDerivation rec {
+  version = "1.2.1";
+  name = "lepton-${version}";
+
+  src = fetchFromGitHub {
+    repo = "lepton";
+    owner = "dropbox";
+    rev = "c378cbfa2daaa99e8828be7395013f94cedb1bcc";
+    sha256 = "1f2vyp0crj4yw27bs53vykf2fqk4w57gv3lh9dp89dh3y7wwh1ba";
+  };
+
+  nativeBuildInputs = [ cmake git ];
+  buildInputs = [ glibc.static ];
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/dropbox/lepton;
+    description = "A tool to losslessly compress JPEGs";
+    license = licenses.asl20;
+    platforms = [ "x86_64-linux" ];
+    maintainers = with maintainers; [ artemist ];
+  };
+}
diff --git a/pkgs/tools/graphics/povray/default.nix b/pkgs/tools/graphics/povray/default.nix
index 76829b6b7271..dc9d9630ae5a 100644
--- a/pkgs/tools/graphics/povray/default.nix
+++ b/pkgs/tools/graphics/povray/default.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
   preInstall = ''
     mkdir "$TMP/bin"
     for i in chown chgrp; do
-      echo '#!/bin/sh' >> "$TMP/bin/$i"
+      echo '#!${stdenv.shell}' >> "$TMP/bin/$i"
       chmod +x "$TMP/bin/$i"
       PATH="$TMP/bin:$PATH"
     done
diff --git a/pkgs/tools/graphics/sng/default.nix b/pkgs/tools/graphics/sng/default.nix
index 098721d6b932..182ab5806d7b 100644
--- a/pkgs/tools/graphics/sng/default.nix
+++ b/pkgs/tools/graphics/sng/default.nix
@@ -20,6 +20,6 @@ stdenv.mkDerivation rec {
     homepage = http://sng.sourceforge.net/;
     license = licenses.zlib;
     maintainers = [ maintainers.dezgeg ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/tools/misc/aptly/default.nix b/pkgs/tools/misc/aptly/default.nix
index 168a3f887728..27ee38b34179 100644
--- a/pkgs/tools/misc/aptly/default.nix
+++ b/pkgs/tools/misc/aptly/default.nix
@@ -2,14 +2,14 @@
 
 let
 
-  version = "1.2.0";
+  version = "1.3.0";
   rev = "v${version}";
 
   aptlySrc = fetchFromGitHub {
     inherit rev;
-    owner = "smira";
+    owner = "aptly-dev";
     repo = "aptly";
-    sha256 = "1acnkmgarz9rp0skkh7zzwkhisjlmbl74jqjmqd3mn42y528c34b";
+    sha256 = "032gw8qkxcgc0jyrvzqh7jkbmk4k0gf7j74hyhclfnjmd9548f5l";
   };
 
   aptlyCompletionSrc = fetchFromGitHub {
@@ -26,7 +26,7 @@ buildGoPackage {
 
   src = aptlySrc;
 
-  goPackagePath = "github.com/smira/aptly";
+  goPackagePath = "github.com/aptly-dev/aptly";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/tools/misc/coreutils/default.nix b/pkgs/tools/misc/coreutils/default.nix
index 3a3486503081..84a2735dff8f 100644
--- a/pkgs/tools/misc/coreutils/default.nix
+++ b/pkgs/tools/misc/coreutils/default.nix
@@ -26,8 +26,9 @@ stdenv.mkDerivation rec {
   patches = optional stdenv.hostPlatform.isCygwin ./coreutils-8.23-4.cygwin.patch;
 
   postPatch = ''
-    # The test tends to fail on btrfs and maybe other unusual filesystems.
+    # The test tends to fail on btrfs,f2fs and maybe other unusual filesystems.
     sed '2i echo Skipping dd sparse test && exit 0' -i ./tests/dd/sparse.sh
+    sed '2i echo Skipping du threshold test && exit 0' -i ./tests/du/threshold.sh
     sed '2i echo Skipping cp sparse test && exit 0' -i ./tests/cp/sparse.sh
     sed '2i echo Skipping rm deep-2 test && exit 0' -i ./tests/rm/deep-2.sh
     sed '2i echo Skipping du long-from-unreadable test && exit 0' -i ./tests/du/long-from-unreadable.sh
diff --git a/pkgs/tools/misc/fzf/default.nix b/pkgs/tools/misc/fzf/default.nix
index a882fe9a9ba3..08efe3e6e18b 100644
--- a/pkgs/tools/misc/fzf/default.nix
+++ b/pkgs/tools/misc/fzf/default.nix
@@ -47,7 +47,7 @@ buildGoPackage rec {
 
     cp -R $src/shell $bin/share/fzf
     cat <<SCRIPT > $bin/bin/fzf-share
-    #!/bin/sh
+    #!${stdenv.shell}
     # Run this script to find the fzf shared folder where all the shell
     # integration scripts are living.
     echo $bin/share/fzf
diff --git a/pkgs/tools/misc/grub/2.0x.nix b/pkgs/tools/misc/grub/2.0x.nix
index d50797508596..fa1729b929c0 100644
--- a/pkgs/tools/misc/grub/2.0x.nix
+++ b/pkgs/tools/misc/grub/2.0x.nix
@@ -47,6 +47,21 @@ stdenv.mkDerivation rec {
     sha256 = "03vvdfhdmf16121v7xs8is2krwnv15wpkhkf16a4yf8nsfc3f2w1";
   };
 
+  patches = [
+    ./fix-bash-completion.patch
+    # This patch makes grub compatible with the XFS sparse inode
+    # feature introduced by xfsprogs-4.16.
+    # to be removed in grub-2.03
+    (fetchpatch {
+      url = https://git.savannah.gnu.org/cgit/grub.git/patch/?id=cda0a857dd7a27cd5d621747464bfe71e8727fff;
+      sha256 = "0k9qrkdxwdqk6sz05q9smqwjr6pvgc9adx1mlf0807g4im91xnm0";
+    })
+    ./relocation-not-implemented.diff
+  ];
+  postPatch = ''
+    substituteInPlace ./configure --replace '/usr/share/fonts/unifont' '${unifont}/share/fonts'
+  '';
+
   nativeBuildInputs = [ bison flex python pkgconfig ];
   buildInputs = [ ncurses libusb freetype gettext lvm2 fuse ]
     ++ optional doCheck qemu
@@ -57,14 +72,10 @@ stdenv.mkDerivation rec {
   # Work around a bug in the generated flex lexer (upstream flex bug?)
   NIX_CFLAGS_COMPILE = "-Wno-error";
 
-  postPatch = ''
-    substituteInPlace ./configure --replace '/usr/share/fonts/unifont' '${unifont}/share/fonts'
-  '';
-
   preConfigure =
     '' for i in "tests/util/"*.in
        do
-         sed -i "$i" -e's|/bin/bash|/bin/sh|g'
+         sed -i "$i" -e's|/bin/bash|${stdenv.shell}|g'
        done
 
        # Apparently, the QEMU executable is no longer called
@@ -82,17 +93,6 @@ stdenv.mkDerivation rec {
       unset CPP # setting CPP intereferes with dependency calculation
     '';
 
-  patches = [
-    ./fix-bash-completion.patch
-    # This patch makes grub compatible with the XFS sparse inode
-    # feature introduced by xfsprogs-4.16.
-    # to be removed in grub-2.03
-    (fetchpatch {
-      url = https://git.savannah.gnu.org/cgit/grub.git/patch/?id=cda0a857dd7a27cd5d621747464bfe71e8727fff;
-      sha256 = "0k9qrkdxwdqk6sz05q9smqwjr6pvgc9adx1mlf0807g4im91xnm0";
-    })
-  ];
-
   configureFlags = [ "--enable-grub-mount" ] # dep of os-prober
     ++ optional zfsSupport "--enable-libzfs"
     ++ optionals efiSupport [ "--with-platform=efi" "--target=${efiSystemsBuild.${stdenv.hostPlatform.system}.target}" "--program-prefix=" ]
diff --git a/pkgs/tools/misc/grub/relocation-not-implemented.diff b/pkgs/tools/misc/grub/relocation-not-implemented.diff
new file mode 100644
index 000000000000..0b7bf947d142
--- /dev/null
+++ b/pkgs/tools/misc/grub/relocation-not-implemented.diff
@@ -0,0 +1,25 @@
+https://git.savannah.gnu.org/cgit/grub.git/commit/util?id=842c390469e2c2e10b5
+diff --git a/util/grub-mkimagexx.c b/util/grub-mkimagexx.c
+index a2bb054..39d7efb 100644
+--- a/util/grub-mkimagexx.c
++++ b/util/grub-mkimagexx.c
+@@ -841,6 +841,7 @@ SUFFIX (relocate_addresses) (Elf_Ehdr *e, Elf_Shdr *sections,
+ 		  break;
+ 
+ 		case R_X86_64_PC32:
++		case R_X86_64_PLT32:
+ 		  {
+ 		    grub_uint32_t *t32 = (grub_uint32_t *) target;
+ 		    *t32 = grub_host_to_target64 (grub_target_to_host32 (*t32)
+diff --git a/util/grub-module-verifier.c b/util/grub-module-verifier.c
+index 9179285..a79271f 100644
+--- a/util/grub-module-verifier.c
++++ b/util/grub-module-verifier.c
+@@ -19,6 +19,7 @@ struct grub_module_verifier_arch archs[] = {
+       -1
+     }, (int[]){
+       R_X86_64_PC32,
++      R_X86_64_PLT32,
+       -1
+     }
+   },
diff --git a/pkgs/tools/misc/grub/trusted.nix b/pkgs/tools/misc/grub/trusted.nix
index 94beff8dfe37..ca4e477adce7 100644
--- a/pkgs/tools/misc/grub/trusted.nix
+++ b/pkgs/tools/misc/grub/trusted.nix
@@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
   preConfigure =
     '' for i in "tests/util/"*.in
        do
-         sed -i "$i" -e's|/bin/bash|/bin/sh|g'
+         sed -i "$i" -e's|/bin/bash|${stdenv.shell}|g'
        done
 
        # Apparently, the QEMU executable is no longer called
diff --git a/pkgs/tools/misc/hashit/default.nix b/pkgs/tools/misc/hashit/default.nix
index 0cb839c26ffc..f1f2fd9aa44d 100644
--- a/pkgs/tools/misc/hashit/default.nix
+++ b/pkgs/tools/misc/hashit/default.nix
@@ -1,11 +1,9 @@
-{ stdenv, fetchFromGitHub, meson, ninja, pkgconfig, cmake, vala_0_40, python3, gnome3, gtk3, granite, gobject-introspection, desktop-file-utils, wrapGAppsHook }:
+{ stdenv, fetchFromGitHub, meson, ninja, pkgconfig, cmake, pantheon, python3, gnome3, gtk3, gobject-introspection, desktop-file-utils, wrapGAppsHook }:
 
 stdenv.mkDerivation rec {
   pname = "hashit";
   version = "1.0.0";
 
-  name = "${pname}-${version}";
-
   src = fetchFromGitHub {
     owner = "artemanufrij";
     repo = pname;
@@ -20,14 +18,14 @@ stdenv.mkDerivation rec {
     ninja
     pkgconfig
     python3
-    vala_0_40 # should be `elementary.vala` when elementary attribute set is merged
+    pantheon.vala
     wrapGAppsHook
   ];
 
   buildInputs = [
-    gnome3.defaultIconTheme # should be `elementary.defaultIconTheme`when elementary attribute set is merged
+    pantheon.elementary-icon-theme
     gnome3.libgee
-    granite
+    pantheon.granite
     gtk3
   ];
 
diff --git a/pkgs/tools/misc/mpdscribble/default.nix b/pkgs/tools/misc/mpdscribble/default.nix
index 6913f1c11fdf..ca6808effda5 100644
--- a/pkgs/tools/misc/mpdscribble/default.nix
+++ b/pkgs/tools/misc/mpdscribble/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     description = "A Music Player Daemon (MPD) client which submits information about tracks beeing played to a scrobbler (e.g. last.fm)";
     homepage = http://mpd.wikia.com/wiki/Client:mpdscribble;
     license = licenses.gpl2;
-    maintainers = [ ];
+    maintainers = [ maintainers.matthiasbeyer ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/tools/misc/multitail/default.nix b/pkgs/tools/misc/multitail/default.nix
index 48714a4b6e88..07561d390cd0 100644
--- a/pkgs/tools/misc/multitail/default.nix
+++ b/pkgs/tools/misc/multitail/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   meta = {
     homepage = http://www.vanheusden.com/multitail/;
     description = "tail on Steroids";
-    maintainers = with stdenv.lib.maintainers; [ ];
+    maintainers = with stdenv.lib.maintainers; [ matthiasbeyer ];
     platforms = stdenv.lib.platforms.unix;
     license = stdenv.lib.licenses.gpl2Plus;
   };
diff --git a/pkgs/tools/misc/qjoypad/default.nix b/pkgs/tools/misc/qjoypad/default.nix
index 4d91c184b0ae..4428bf1e625a 100644
--- a/pkgs/tools/misc/qjoypad/default.nix
+++ b/pkgs/tools/misc/qjoypad/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
   NIX_LDFLAGS = [ "-lX11" ];
   patchPhase = ''
     cd src
-    substituteInPlace config --replace /bin/bash /bin/sh
+    substituteInPlace config --replace /bin/bash ${stdenv.shell}
     mkdir -p $out
     export NIX_LDFLAGS="$NIX_LDFLAGS -rpath ${libX11}/lib"
   '';
diff --git a/pkgs/tools/misc/skim/default.nix b/pkgs/tools/misc/skim/default.nix
index f1df06912051..52cc56715315 100644
--- a/pkgs/tools/misc/skim/default.nix
+++ b/pkgs/tools/misc/skim/default.nix
@@ -2,13 +2,13 @@
 
 rustPlatform.buildRustPackage rec {
   name = "skim-${version}";
-  version = "0.5.2";
+  version = "0.5.4";
 
   src = fetchFromGitHub {
     owner = "lotabout";
     repo = "skim";
     rev = "v${version}";
-    sha256 = "1b3l0h69cm70669apsgzp7qw1k5fi2gbk9176hjr9iypbdiwjyir";
+    sha256 = "1mn0wa10f9ik6ddhwjdd1n15gdif10284zpwbrwprya643959aj2";
   };
 
   outputs = [ "out" "vim" ];
@@ -21,6 +21,7 @@ rustPlatform.buildRustPackage rec {
 
   postInstall = ''
     install -D -m 555 bin/sk-tmux -t $out/bin
+    install -D -m 644 shell/skim.1 $out/man/man1/skim.1
     install -D -m 444 shell/* -t $out/share/skim
     install -D -m 444 plugin/skim.vim -t $vim/plugin
 
diff --git a/pkgs/tools/misc/smenu/default.nix b/pkgs/tools/misc/smenu/default.nix
index b5c963307dfd..2b9f83041a42 100644
--- a/pkgs/tools/misc/smenu/default.nix
+++ b/pkgs/tools/misc/smenu/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
       your selection will be sent to standard output.
     '';
     license     = licenses.gpl2;
-    maintainers = [ ];
+    maintainers = [ maintainers.matthiasbeyer ];
     platforms   = platforms.linux;
   };
 }
diff --git a/pkgs/tools/misc/vdirsyncer/default.nix b/pkgs/tools/misc/vdirsyncer/default.nix
index 2212ba870c4a..f538fcbe4ecf 100644
--- a/pkgs/tools/misc/vdirsyncer/default.nix
+++ b/pkgs/tools/misc/vdirsyncer/default.nix
@@ -71,7 +71,7 @@ python3Packages.buildPythonApplication rec {
   meta = with stdenv.lib; {
     homepage = https://github.com/pimutils/vdirsyncer;
     description = "Synchronize calendars and contacts";
-    maintainers = with maintainers; [ jgeerds ];
+    maintainers = with maintainers; [ matthiasbeyer jgeerds ];
     platforms = platforms.all;
     license = licenses.mit;
   };
diff --git a/pkgs/tools/misc/vimer/default.nix b/pkgs/tools/misc/vimer/default.nix
index 7ccc6e9dc271..a655aa9502e5 100644
--- a/pkgs/tools/misc/vimer/default.nix
+++ b/pkgs/tools/misc/vimer/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
       in an existing instance of GVim or MacVim.
     '';
     license = licenses.mit;
-    maintainers = [ ];
+    maintainers = [ maintainers.matthiasbeyer ];
     platforms = platforms.linux;
   };
 
diff --git a/pkgs/tools/misc/watchexec/default.nix b/pkgs/tools/misc/watchexec/default.nix
index 61f1752823d7..ddfdf0f492f7 100644
--- a/pkgs/tools/misc/watchexec/default.nix
+++ b/pkgs/tools/misc/watchexec/default.nix
@@ -2,13 +2,13 @@
 
 rustPlatform.buildRustPackage rec {
   name = "watchexec-${version}";
-  version = "1.10.0";
+  version = "1.10.1";
 
   src = fetchFromGitHub {
     owner = "watchexec";
     repo = "watchexec";
     rev = version;
-    sha256 = "15fnf3r4pvl9gyvq0fy0l7p8xjaz44z9g4dzkn1l0fdhldib6z1c";
+    sha256 = "0azfnqx5v1shsd7jdxzn41awh9dbjykv8h1isrambc86ygr1c1cy";
   };
 
   cargoSha256 = "1xlcfr2q2pw47sav9iryjva7w9chv90g18hszq8s0q0w71sccv6j";
diff --git a/pkgs/tools/misc/xfstests/default.nix b/pkgs/tools/misc/xfstests/default.nix
index e03f84355cad..7305013eb8b7 100644
--- a/pkgs/tools/misc/xfstests/default.nix
+++ b/pkgs/tools/misc/xfstests/default.nix
@@ -78,7 +78,7 @@ stdenv.mkDerivation {
   # wants to write temporary files there. So create a temporary
   # to run from and symlink the runtime files to it.
   wrapperScript = writeScript "xfstests-check" ''
-    #!/bin/sh
+    #!${stdenv.shell}
     set -e
     export RESULT_BASE="$(pwd)/results"
 
diff --git a/pkgs/tools/misc/xsel/default.nix b/pkgs/tools/misc/xsel/default.nix
index 604868f8c490..0ec7d58598f8 100644
--- a/pkgs/tools/misc/xsel/default.nix
+++ b/pkgs/tools/misc/xsel/default.nix
@@ -3,23 +3,18 @@
 stdenv.mkDerivation rec {
   name = "xsel-unstable-${version}";
 
-  version = "2016-09-02";
+  version = "2018-01-10";
 
   src = fetchFromGitHub {
     owner = "kfish";
     repo = "xsel";
-    rev = "aa7f57eed805adb09e9c59c8ea841870e8206b81";
-    sha256 = "04mrc8j0rr7iy1k6brfxnx26pmxm800gh4nqrxn6j2lz6vd5y9m5";
+    rev = "9bfc13d64b5acb92c6648c696a9d9260fcbecc65";
+    sha256 = "05ms34by5hxznnpvmvhgp6llvlkz0zw4sq6c4bgwr82lj140lscm";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
   buildInputs = [ libX11 ];
 
-  # We need a README file, otherwise autoconf complains.
-  postUnpack = ''
-    mv $sourceRoot/README{.md,}
-  '';
-
   meta = with lib; {
     description = "Command-line program for getting and setting the contents of the X selection";
     homepage = http://www.kfish.org/software/xsel;
diff --git a/pkgs/tools/misc/youtube-dl/default.nix b/pkgs/tools/misc/youtube-dl/default.nix
index 0598976ec98e..fbba83d7a33a 100644
--- a/pkgs/tools/misc/youtube-dl/default.nix
+++ b/pkgs/tools/misc/youtube-dl/default.nix
@@ -19,11 +19,11 @@ buildPythonPackage rec {
   # The websites youtube-dl deals with are a very moving target. That means that
   # downloads break constantly. Because of that, updates should always be backported
   # to the latest stable release.
-  version = "2019.01.30.1";
+  version = "2019.02.18";
 
   src = fetchurl {
     url = "https://yt-dl.org/downloads/${version}/${pname}-${version}.tar.gz";
-    sha256 = "0wamv1fs4w8jjx67p60rgrgdi6k04yy0h4p3cwscza5pzhpmvnlf";
+    sha256 = "1sr0f6ixpaqyp3cf29zswx84y3nfabwnk3sljcgvgnmjp73zzfv1";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/networking/airfield/default.nix b/pkgs/tools/networking/airfield/default.nix
index 70005038f99d..94a606f9c782 100644
--- a/pkgs/tools/networking/airfield/default.nix
+++ b/pkgs/tools/networking/airfield/default.nix
@@ -49,7 +49,7 @@ in stdenv.mkDerivation {
   installPhase = ''
     mkdir -p $out/bin
     cat >$out/bin/airfield <<EOF
-      #!${stdenv.shell}/bin/sh
+      #!${stdenv.shell}
       ${nodejs}/bin/node ${src}/airfield.js
     EOF
   '';
diff --git a/pkgs/tools/networking/http-prompt/default.nix b/pkgs/tools/networking/http-prompt/default.nix
index 69b23b3e3a4c..78dc52905d83 100644
--- a/pkgs/tools/networking/http-prompt/default.nix
+++ b/pkgs/tools/networking/http-prompt/default.nix
@@ -29,7 +29,7 @@ pythonPackages.buildPythonApplication rec {
     description = "An interactive command-line HTTP client featuring autocomplete and syntax highlighting";
     homepage = https://github.com/eliangcs/http-prompt;
     license = licenses.mit;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ matthiasbeyer ];
     platforms = platforms.linux; # can only test on linux
   };
 }
diff --git a/pkgs/tools/networking/lftp/default.nix b/pkgs/tools/networking/lftp/default.nix
index bb627f49971b..b4886f58cbb1 100644
--- a/pkgs/tools/networking/lftp/default.nix
+++ b/pkgs/tools/networking/lftp/default.nix
@@ -21,10 +21,14 @@ stdenv.mkDerivation rec {
 
   configureFlags = [
     "--with-readline=${readline.dev}"
+    "--with-zlib=${zlib.dev}"
+    "--without-expat"
   ];
 
   installFlags = [ "PREFIX=$(out)" ];
 
+  enableParallelBuilding = true;
+
   meta = with stdenv.lib; {
     description = "A file transfer program supporting a number of network protocols";
     homepage = https://lftp.tech/;
diff --git a/pkgs/tools/networking/tcpdump/default.nix b/pkgs/tools/networking/tcpdump/default.nix
index 58f020e1bdd8..f1470fc6c148 100644
--- a/pkgs/tools/networking/tcpdump/default.nix
+++ b/pkgs/tools/networking/tcpdump/default.nix
@@ -33,6 +33,6 @@ stdenv.mkDerivation rec {
     homepage = http://www.tcpdump.org/;
     license = "BSD-style";
     maintainers = with stdenv.lib.maintainers; [ jgeerds ];
-    platforms = stdenv.lib.platforms.linux;
+    platforms = stdenv.lib.platforms.unix;
   };
 }
diff --git a/pkgs/tools/networking/zap/default.nix b/pkgs/tools/networking/zap/default.nix
index 7dc0e07f9451..56b54fed61b9 100644
--- a/pkgs/tools/networking/zap/default.nix
+++ b/pkgs/tools/networking/zap/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     mkdir -p "$out/share"
     tar xvf  "ZAP_${version}_Linux.tar.gz" -C "$out/share/"
     mkdir -p "$out/bin"
-    echo "#!/bin/sh" > "$out/bin/zap"
+    echo "#!${stdenv.shell}" > "$out/bin/zap"
     echo \"$out/share/ZAP_${version}/zap.sh\" >> "$out/bin/zap"
     chmod +x "$out/bin/zap"
   '';
diff --git a/pkgs/tools/security/eid-mw/default.nix b/pkgs/tools/security/eid-mw/default.nix
index 6bdc8570982d..9ac62dc334f7 100644
--- a/pkgs/tools/security/eid-mw/default.nix
+++ b/pkgs/tools/security/eid-mw/default.nix
@@ -3,7 +3,8 @@
 , gtk3, nssTools, pcsclite
 , libxml2, libproxy 
 , openssl, curl
-, makeWrapper }:
+, makeWrapper
+, substituteAll }:
 
 stdenv.mkDerivation rec {
   name = "eid-mw-${version}";
@@ -32,8 +33,15 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--enable-dialogs=yes" ];
 
-  postInstall = ''
-    install -D ${./eid-nssdb.in} $out/bin/eid-nssdb
+  postInstall =
+  let
+    eid-nssdb-in = substituteAll {
+      inherit (stdenv) shell;
+      src = ./eid-nssdb.in;
+    };
+  in
+  ''
+    install -D ${eid-nssdb-in} $out/bin/eid-nssdb
     substituteInPlace $out/bin/eid-nssdb \
       --replace "modutil" "${nssTools}/bin/modutil"
 
diff --git a/pkgs/tools/security/ibm-sw-tpm2/default.nix b/pkgs/tools/security/ibm-sw-tpm2/default.nix
new file mode 100644
index 000000000000..cec31cec3771
--- /dev/null
+++ b/pkgs/tools/security/ibm-sw-tpm2/default.nix
@@ -0,0 +1,39 @@
+{ stdenv, fetchurl, lib, openssl }:
+
+stdenv.mkDerivation rec {
+  pname = "ibm-sw-tpm2";
+  version = "1332";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/ibmswtpm2/ibmtpm${version}.tar.gz";
+    sha256 = "1zdhi8acd4jfp1v7ibd86hcv0g39yk8qrnhxjmmgzn8i7npr70cf";
+  };
+
+  buildInputs = [ openssl ];
+
+  sourceRoot = "src";
+
+  prePatch = ''
+    # Fix hardcoded path to GCC.
+    substituteInPlace makefile --replace /usr/bin/gcc "${stdenv.cc}/bin/cc"
+
+    # Remove problematic default CFLAGS.
+    substituteInPlace makefile \
+      --replace -Werror "" \
+      --replace -O0 "" \
+      --replace -ggdb ""
+  '';
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp tpm_server $out/bin
+  '';
+
+  meta = with lib; {
+    description = "IBM's Software TPM 2.0, an implementation of the TCG TPM 2.0 specification";
+    homepage = https://sourceforge.net/projects/ibmswtpm2/;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ delroth ];
+    license = licenses.bsd3;
+  };
+}
diff --git a/pkgs/tools/security/pgpdump/default.nix b/pkgs/tools/security/pgpdump/default.nix
index 82bec2486e81..9c8f47cd2756 100644
--- a/pkgs/tools/security/pgpdump/default.nix
+++ b/pkgs/tools/security/pgpdump/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     '';
     homepage = http://www.mew.org/~kazu/proj/pgpdump/en/;
     license = licenses.bsd3;
-    platforms = platforms.linux;
+    platforms = platforms.unix;
     maintainers = with maintainers; [ primeos ];
   };
 }
diff --git a/pkgs/tools/security/rhash/default.nix b/pkgs/tools/security/rhash/default.nix
index 27f2ca04d710..5e622cf68f35 100644
--- a/pkgs/tools/security/rhash/default.nix
+++ b/pkgs/tools/security/rhash/default.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchFromGitHub, which }:
 
 stdenv.mkDerivation rec {
-  version = "1.3.6";
+  version = "1.3.8";
   name = "rhash-${version}";
 
   src = fetchFromGitHub {
     owner = "rhash";
     repo = "RHash";
     rev = "v${version}";
-    sha256 = "1c8gngjj34ylx1f56hjbvml22bif0bx1b88dx2cyxbix8praxqh7";
+    sha256 = "0i00wl63hn80g0s9gdi772gchbghwgkvn4nbb5227y2wwy30yyi2";
   };
 
   nativeBuildInputs = [ which ];
@@ -16,10 +16,11 @@ stdenv.mkDerivation rec {
   # configure script is not autotools-based, doesn't support these options
   configurePlatforms = [ ];
 
-  doCheck = false; # fails
+  doCheck = true;
 
-  installTargets = [ "install" "install-lib-shared" "install-lib-so-link" ];
-  postInstall = "make -C librhash install-headers";
+  checkTarget = "test-full";
+
+  installTargets = [ "install" "install-lib-shared" "install-lib-so-link" "install-lib-headers" ];
 
   meta = with stdenv.lib; {
     homepage = http://rhash.anz.ru;
diff --git a/pkgs/tools/security/tpm2-tools/default.nix b/pkgs/tools/security/tpm2-tools/default.nix
new file mode 100644
index 000000000000..84369e6ea54d
--- /dev/null
+++ b/pkgs/tools/security/tpm2-tools/default.nix
@@ -0,0 +1,38 @@
+{ stdenv, fetchurl, fetchpatch, lib
+, cmocka, curl, pandoc, pkgconfig, openssl, tpm2-tss }:
+
+stdenv.mkDerivation rec {
+  pname = "tpm2-tools";
+  version = "3.1.3";
+
+  src = fetchurl {
+    url = "https://github.com/tpm2-software/${pname}/releases/download/${version}/${pname}-${version}.tar.gz";
+    sha256 = "05is1adwcg7y2p121yldd8m1gigdnzf9izbjazvsr6yg95pmg5fc";
+  };
+
+  patches = [
+    (fetchpatch {
+      name = "tests-tss-2.2.0-compat.patch";
+      url = "https://patch-diff.githubusercontent.com/raw/tpm2-software/tpm2-tools/pull/1322.patch";
+      sha256 = "0yy5qbgbd13d7cl8pzsji95a6qnwiik5s2cyqj35jd8blymikqxh";
+    })
+  ];
+
+  nativeBuildInputs = [ pandoc pkgconfig ];
+  buildInputs = [
+    curl openssl tpm2-tss
+    # For unit tests.
+    cmocka
+  ];
+
+  configureFlags = [ "--enable-unit" ];
+  doCheck = true;
+
+  meta = with lib; {
+    description = "Command line tools that provide access to a TPM 2.0 compatible device";
+    homepage = https://github.com/tpm2-software/tpm2-tools;
+    license = licenses.bsd3;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ delroth ];
+  };
+}
diff --git a/pkgs/tools/system/gotop/default.nix b/pkgs/tools/system/gotop/default.nix
index 2b918d155817..745139f9e50b 100644
--- a/pkgs/tools/system/gotop/default.nix
+++ b/pkgs/tools/system/gotop/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   name = "gotop-${version}";
-  version = "1.7.1";
+  version = "2.0.1";
 
   goPackagePath = "github.com/cjbassi/gotop";
 
@@ -10,11 +10,9 @@ buildGoPackage rec {
     repo = "gotop";
     owner = "cjbassi";
     rev = version;
-    sha256 = "0dxnhal10kv6ypsg6mildzpz6vi1iw996q47f4rv8hvfyrffhzc9";
+    sha256 = "0xpm8nrn53kz65f93czflgdgr2a33qfi1w0gsgngrmaliq1vlpji";
   };
 
-  goDeps = ./deps.nix;
-
   meta = with stdenv.lib; {
     description = "A terminal based graphical activity monitor inspired by gtop and vtop";
     homepage = https://github.com/cjbassi/gotop;
diff --git a/pkgs/tools/system/gotop/deps.nix b/pkgs/tools/system/gotop/deps.nix
deleted file mode 100644
index ceae7857551f..000000000000
--- a/pkgs/tools/system/gotop/deps.nix
+++ /dev/null
@@ -1,39 +0,0 @@
-# This file was generated by https://github.com/kamilchm/go2nix v1.3.0
-[
-  {
-    goPackagePath = "github.com/cjbassi/termui";
-    fetch = {
-      type = "git";
-      url = "https://github.com/cjbassi/termui";
-      rev = "e8dd23f6146c0e0d80f1be0163b8069abfbb921b";
-      sha256 = "0jds2mpa7whrwaznlkcn2y92q41zbf2rjj5267kl8zqllbia8cbx";
-    };
-  }
-  {
-    goPackagePath = "github.com/docopt/docopt-go";
-    fetch = {
-      type = "git";
-      url = "https://github.com/docopt/docopt-go";
-      rev = "ee0de3bc6815ee19d4a46c7eb90f829db0e014b1";
-      sha256 = "0hlra7rmi5pmd7d93rv56ahiy4qkgmq8a6mz0jpadvbi5qh8lq6j";
-    };
-  }
-  {
-    goPackagePath = "github.com/shirou/gopsutil";
-    fetch = {
-      type = "git";
-      url = "https://github.com/shirou/gopsutil";
-      rev = "51e6519305e4871657c291a6281fcddc6364bbef";
-      sha256 = "1pvvaj51m0w2v6bp5hhhzfy27hbicf4ga7r9m073vqcwjnfyz431";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/sys";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/sys";
-      rev = "9b800f95dbbc54abff0acf7ee32d88ba4e328c89";
-      sha256 = "07v3l7q7y59cwvw0mc85i39v7qjcc1jh4svwi789rmrqqm5nq7q6";
-    };
-  }
-]
diff --git a/pkgs/tools/typesetting/lout/builder.sh b/pkgs/tools/typesetting/lout/builder.sh
index cd3b9c67e3c9..61459e48b7f0 100755
--- a/pkgs/tools/typesetting/lout/builder.sh
+++ b/pkgs/tools/typesetting/lout/builder.sh
@@ -1,5 +1,3 @@
-#!/bin/sh
-
 # Prepare a makefile specifying the appropriate output directories.
 #
 # Written by Ludovic Courtès <ludo@gnu.org>.
diff --git a/pkgs/tools/virtualization/google-compute-engine-oslogin/default.nix b/pkgs/tools/virtualization/google-compute-engine-oslogin/default.nix
index 5096c7f94686..012090ba079d 100644
--- a/pkgs/tools/virtualization/google-compute-engine-oslogin/default.nix
+++ b/pkgs/tools/virtualization/google-compute-engine-oslogin/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     # change sudoers dir from /var/google-sudoers.d to /run/google-sudoers.d (managed through systemd-tmpfiles)
     substituteInPlace pam_module/pam_oslogin_admin.cc --replace /var/google-sudoers.d /run/google-sudoers.d
     # fix "User foo not allowed because shell /bin/bash does not exist"
-    substituteInPlace utils/oslogin_utils.cc --replace /bin/bash /bin/sh
+    substituteInPlace utils/oslogin_utils.cc --replace /bin/bash ${stdenv.shell}
   '';
 
   buildInputs = [ curl.dev pam ];