ocamlPackages: cohttp: 2.5.0 -> 4.0.0; conduit: 2.2.2 -> 4.0.0 (#118144)

* ocamlPackages.x509: 0.12.0 -> 0.13.0

https://github.com/mirleft/ocaml-x509/releases/tag/v0.13.0

* ocamlPackages.tls{,-mirage}: 0.12.8 -> 0.13.1

https://github.com/mirleft/ocaml-tls/releases/tag/v0.13.0
https://github.com/mirleft/ocaml-tls/releases/tag/v0.13.1

* ocamlPackages.ca-certs: 0.2.0 -> 0.2.1

Adds support for NIX_SSL_CERT_FILE, so we can finally run its test
suite! https://github.com/mirage/ca-certs/releases/tag/v0.2.1

* ocamlPackages.dns*: 4.6.3 -> 5.0.0

* jackline: unstable-2020-09-03 -> unstable-2021-04-23

Compatibility with tls >= 0.13.0

* ocamlPackages.ca-certs-nss: init at 3.64.0.1

* ocamlPackages.conduit: 2.2.2 -> 2.3.0

https://github.com/mirage/ocaml-conduit/releases/tag/v2.3.0

* ocamlPackages.curly: fix tests with new ca-certs behavior

* ocamlPackages.cohttp: 2.5.0 -> 4.0.0

ocamlPackages.cohttp-lwt-unix: add description

https://github.com/mirage/ocaml-cohttp/releases/tag/v4.0.0

* ocamlPackages.mirage{,-runtime,-types*}: 3.10.1 -> 3.10.3

Adjust to a few changed dependencies:
https://github.com/mirage/mirage/releases/tag/v3.10.2
https://github.com/mirage/mirage/releases/tag/v3.10.3

* ocamlPackages.conduit*: 2.3.0 -> 4.0.0

https://github.com/mirage/ocaml-conduit/releases/tag/v4.0.0

* ocamlPackages.cohttp-lwt-unix: disable tests

* ocamlPackages.dns*: 5.0.0 -> 5.0.1

https://github.com/mirage/ocaml-dns/releases/tag/v5.0.1

* ocamlPackages.awa*: 0.0.1 -> 0.0.3

https://github.com/mirage/awa-ssh/releases/tag/v0.0.2
https://github.com/mirage/awa-ssh/releases/tag/v0.0.3

* ocamlPackages.optint: 0.0.4 -> 0.1.0

https://github.com/mirage/optint/releases/tag/v0.0.5
https://github.com/mirage/optint/releases/tag/v0.1.0

* ocamlPackages.decompress: 1.3.0 -> 1.4.0

https://github.com/mirage/decompress/releases/tag/v1.4.0

* ocamlPackages.checkseum: 0.2.1 -> 0.3.1

https://github.com/mirage/checkseum/releases/tag/v0.3.0
https://github.com/mirage/checkseum/releases/tag/v0.3.1

* ocamlPackages.checkseum: allow compilation with ocaml-freestanding

* ocamlPackages.carton: 0.4.0 -> 0.4.1

https://github.com/mirage/ocaml-git/releases/tag/carton-v0.4.1

* ocamlPackages.mimic: 0.0.2 -> 0.0.3

* Upstream changed.
* https://github.com/dinosaure/mimic/releases/tag/0.0.3

* ocamlPackages.letsencrypt: 0.2.4 -> 0.2.5

* ocamlPackages.paf: 0.0.1 -> 0.0.3

* ocamlPackages.git-cohttp-mirage: remove at 3.3.3

Will be replaced by git-paf 3.4.0.

* ocamlPackages.git*: 3.3.3 -> 3.4.0

ocamlPackages.git-paf: init at 3.4.0

https://github.com/mirage/ocaml-git/releases/tag/3.4.0

* ocamlPackages.irmin*: 2.5.3 -> 2.6.0

https://github.com/mirage/irmin/releases/tag/2.6.0

38 files changed, 365 insertions, 157 deletions

diff --git a/pkgs/development/ocaml-modules/awa/default.nix b/pkgs/development/ocaml-modules/awa/default.nix
index 49d614cda88..14f99bb6f8d 100644
--- a/pkgs/development/ocaml-modules/awa/default.nix
+++ b/pkgs/development/ocaml-modules/awa/default.nix
@@ -8,14 +8,14 @@
 
 buildDunePackage rec {
   pname = "awa";
-  version = "0.0.1";
+  version = "0.0.3";
 
   minimumOCamlVersion = "4.07";
   useDune2 = true;
 
   src = fetchurl {
     url = "https://github.com/mirage/awa-ssh/releases/download/v${version}/awa-v${version}.tbz";
-    sha256 = "c1d604645517b191184a5800f5c48a6a9a3e5a2fce4a0e2ecfeee74586301400";
+    sha256 = "5a7927363ffe672cccf12d5425386e84f6f553a17ffec2b01ae5dc28180c831a";
   };
 
   nativeBuildInputs = [ ppx_sexp_conv ppx_cstruct ];
diff --git a/pkgs/development/ocaml-modules/ca-certs-nss/default.nix b/pkgs/development/ocaml-modules/ca-certs-nss/default.nix
new file mode 100644
index 00000000000..5e6691a9feb
--- /dev/null
+++ b/pkgs/development/ocaml-modules/ca-certs-nss/default.nix
@@ -0,0 +1,55 @@
+{ lib
+, buildDunePackage
+, fetchurl
+, rresult
+, mirage-crypto
+, mirage-clock
+, x509
+, logs
+, fmt
+, hex
+, bos
+, astring
+, cmdliner
+, alcotest
+}:
+
+buildDunePackage rec {
+  pname = "ca-certs-nss";
+  version = "3.64.0.1";
+
+  minimumOCamlVersion = "4.07";
+
+  src = fetchurl {
+    url = "https://github.com/mirage/ca-certs-nss/releases/download/v${version}/ca-certs-nss-v${version}.tbz";
+    sha256 = "909c64076491647471f785527bfdd9a886a34504edabf88542b43f27b86067f9";
+  };
+
+  useDune2 = true;
+
+  propagatedBuildInputs = [
+    rresult
+    mirage-crypto
+    mirage-clock
+    x509
+  ];
+
+  buildInputs = [
+    logs
+    fmt
+    hex
+    bos
+    astring
+    cmdliner
+  ];
+
+  doCheck = true;
+  checkInputs = [ alcotest ];
+
+  meta = with lib; {
+    license = licenses.isc;
+    description = "X.509 trust anchors extracted from Mozilla's NSS";
+    maintainers = [ maintainers.sternenseemann ];
+    homepage = "https://github.com/mirage/ca-certs-nss";
+  };
+}
diff --git a/pkgs/development/ocaml-modules/ca-certs/default.nix b/pkgs/development/ocaml-modules/ca-certs/default.nix
index dacc181f751..acf869dbd27 100644
--- a/pkgs/development/ocaml-modules/ca-certs/default.nix
+++ b/pkgs/development/ocaml-modules/ca-certs/default.nix
@@ -1,24 +1,28 @@
 { lib, buildDunePackage, fetchurl
 , bos, fpath, rresult, ptime, mirage-crypto, x509, astring, logs
+, cacert, alcotest
 }:
 
 buildDunePackage rec {
   pname = "ca-certs";
-  version = "0.2.0";
+  version = "0.2.1";
 
   minimumOCamlVersion = "4.07";
 
   src = fetchurl {
     url = "https://github.com/mirage/ca-certs/releases/download/v${version}/ca-certs-v${version}.tbz";
-    sha256 = "15jfb5zvahs90jsfs7ridqihlka5198z2xrvplj8ddchxfmpx868";
+    sha256 = "d43109496a5129feff967d557c556af96f8b10456896a405c43b7cf0c35d0af3";
   };
 
   useDune2 = true;
 
   propagatedBuildInputs = [ bos fpath rresult ptime mirage-crypto x509 astring logs ];
 
-  # tests need access to network and systemwide ca cert chain
-  doCheck = false;
+  doCheck = true;
+  checkInputs = [
+    cacert    # for /etc/ssl/certs/ca-bundle.crt
+    alcotest
+  ];
 
   meta = with lib; {
     description = "Detect root CA certificates from the operating system";
diff --git a/pkgs/development/ocaml-modules/carton/default.nix b/pkgs/development/ocaml-modules/carton/default.nix
index 31b864e29d3..c10537d5d50 100644
--- a/pkgs/development/ocaml-modules/carton/default.nix
+++ b/pkgs/development/ocaml-modules/carton/default.nix
@@ -7,19 +7,19 @@
 
 buildDunePackage rec {
   pname = "carton";
-  version = "0.4.0";
+  version = "0.4.1";
 
   useDune2 = true;
   minimumOCamlVersion = "4.08";
 
   src = fetchurl {
     url = "https://github.com/mirage/ocaml-git/releases/download/${pname}-v${version}/${pname}-${pname}-v${version}.tbz";
-    sha256 = "777f9692b83cd63570c17527a32c5045818ab9242d923cbbde72fc23d0da0140";
+    sha256 = "d16aad5560d9ab1e3b4d93d2e8fdea638c216ff47338fb630a8aefd22b452665";
   };
 
   # remove changelogs for mimic and the git* packages
   postPatch = ''
-    rm CHANGES.md CHANGES.mimic.md
+    rm CHANGES.md
   '';
 
   buildInputs = [
diff --git a/pkgs/development/ocaml-modules/checkseum/default.nix b/pkgs/development/ocaml-modules/checkseum/default.nix
index 81009981047..527afec33eb 100644
--- a/pkgs/development/ocaml-modules/checkseum/default.nix
+++ b/pkgs/development/ocaml-modules/checkseum/default.nix
@@ -1,23 +1,46 @@
-{ lib, fetchurl, buildDunePackage, dune-configurator
+{ lib, fetchurl, buildDunePackage, dune-configurator, pkg-config
 , bigarray-compat, optint
-, fmt, rresult
-, alcotest
+, fmt, rresult, bos, fpath, astring, alcotest
+, withFreestanding ? false
+, ocaml-freestanding
 }:
 
 buildDunePackage rec {
-  version = "0.2.1";
+  version = "0.3.1";
   pname = "checkseum";
 
   useDune2 = true;
 
+  minimumOCamlVersion = "4.07";
+
   src = fetchurl {
     url = "https://github.com/mirage/checkseum/releases/download/v${version}/checkseum-v${version}.tbz";
-    sha256 = "1swb44c64pcs4dh9ka9lig6d398qwwkd3kkiajicww6qk7jbh3n5";
+    sha256 = "b9e4d054e17618b1faed8c0eb15afe0614b2f093e58b59a180bda4500a5d2da1";
   };
 
-  buildInputs = [ dune-configurator fmt rresult ];
-  propagatedBuildInputs = [ bigarray-compat optint ];
-  checkInputs = lib.optionals doCheck [ alcotest ];
+  patches = [
+    ./makefile-no-opam.patch
+  ];
+
+  nativeBuildInputs = [
+    dune-configurator
+    pkg-config
+  ];
+  propagatedBuildInputs = [
+    bigarray-compat
+    optint
+  ] ++ lib.optionals withFreestanding [
+    ocaml-freestanding
+  ];
+
+  checkInputs = [
+    alcotest
+    bos
+    astring
+    fmt
+    fpath
+    rresult
+  ];
 
   doCheck = true;
 
diff --git a/pkgs/development/ocaml-modules/checkseum/makefile-no-opam.patch b/pkgs/development/ocaml-modules/checkseum/makefile-no-opam.patch
new file mode 100644
index 00000000000..49fb41b2e00
--- /dev/null
+++ b/pkgs/development/ocaml-modules/checkseum/makefile-no-opam.patch
@@ -0,0 +1,12 @@
+diff --git a/freestanding/Makefile b/freestanding/Makefile
+index d535050..bb286bd 100644
+--- a/freestanding/Makefile
++++ b/freestanding/Makefile
+@@ -1,4 +1,6 @@
+-PKG_CONFIG_PATH := $(shell opam config var prefix)/lib/pkgconfig
++ifneq (, $(shell command -v opam))
++PKG_CONFIG_PATH ?= $(shell opam var prefix)/lib/pkgconfig
++endif
+ 
+ EXISTS := $(shell PKG_CONFIG_PATH=$(PKG_CONFIG_PATH) pkg-config --exists ocaml-freestanding; echo $$?)
+ 
diff --git a/pkgs/development/ocaml-modules/cohttp/async.nix b/pkgs/development/ocaml-modules/cohttp/async.nix
index 21e22533f1b..060d2c6fb6a 100644
--- a/pkgs/development/ocaml-modules/cohttp/async.nix
+++ b/pkgs/development/ocaml-modules/cohttp/async.nix
@@ -1,22 +1,60 @@
-{ lib, buildDunePackage, async, cohttp, conduit-async, uri, ppx_sexp_conv
-, logs, magic-mime }:
+{ lib
+, buildDunePackage
+, ppx_sexp_conv
+, base
+, async
+, async_kernel
+, async_unix
+, cohttp
+, conduit-async
+, uri
+, uri-sexp
+, logs
+, fmt
+, sexplib0
+, ipaddr
+, magic-mime
+, ounit
+, mirage-crypto
+, core
+}:
 
-if !lib.versionAtLeast cohttp.version "0.99" then
-  cohttp
-else if !lib.versionAtLeast async.version "0.13" then
-  throw "cohttp-async needs async-0.13 (hence OCaml >= 4.08)"
-else
+buildDunePackage {
+  pname = "cohttp-async";
 
-  buildDunePackage {
-    pname = "cohttp-async";
-    useDune2 = true;
-    inherit (cohttp) version src;
+  inherit (cohttp)
+    version
+    src
+    minimumOCamlVersion
+    useDune2
+    ;
 
-    buildInputs = [ ppx_sexp_conv ];
+  buildInputs = [ ppx_sexp_conv ];
 
-    propagatedBuildInputs = [ async cohttp conduit-async logs magic-mime uri ];
+  propagatedBuildInputs = [
+    cohttp
+    conduit-async
+    async_kernel
+    async_unix
+    async
+    base
+    magic-mime
+    logs
+    fmt
+    sexplib0
+    uri
+    uri-sexp
+    ipaddr
+  ];
 
-    meta = cohttp.meta // {
-      description = "CoHTTP implementation for the Async concurrency library";
-    };
-  }
+  doCheck = true;
+  checkInputs = [
+    ounit
+    mirage-crypto
+    core
+  ];
+
+  meta = cohttp.meta // {
+    description = "CoHTTP implementation for the Async concurrency library";
+  };
+}
diff --git a/pkgs/development/ocaml-modules/cohttp/default.nix b/pkgs/development/ocaml-modules/cohttp/default.nix
index 1cbc43bc280..c1dc973d0ee 100644
--- a/pkgs/development/ocaml-modules/cohttp/default.nix
+++ b/pkgs/development/ocaml-modules/cohttp/default.nix
@@ -1,25 +1,24 @@
 { lib, fetchurl, buildDunePackage
-, ppx_fields_conv, ppx_sexp_conv, stdlib-shims
-, base64, fieldslib, jsonm, re, stringext, uri-sexp
+, ppx_sexp_conv, base64, jsonm, re, stringext, uri-sexp
 , ocaml, fmt, alcotest
 }:
 
 buildDunePackage rec {
   pname = "cohttp";
-  version = "2.5.5";
+  version = "4.0.0";
 
   useDune2 = true;
 
-  minimumOCamlVersion = "4.04.1";
+  minimumOCamlVersion = "4.08";
 
   src = fetchurl {
     url = "https://github.com/mirage/ocaml-cohttp/releases/download/v${version}/cohttp-v${version}.tbz";
-    sha256 = "0ywmql4lp6ps2gd064ixbjzsdnnn5vk3pipm005sswl553qqwaim";
+    sha256 = "bd7aa4cd2c82744990ed7c49e3ee7a40324c64cb3d8509804809155e2bacd1d2";
   };
 
-  buildInputs = [ jsonm ppx_fields_conv ppx_sexp_conv ];
+  buildInputs = [ jsonm ppx_sexp_conv ];
 
-  propagatedBuildInputs = [ base64 fieldslib re stringext uri-sexp stdlib-shims ];
+  propagatedBuildInputs = [ base64 re stringext uri-sexp ];
 
   doCheck = lib.versionAtLeast ocaml.version "4.05";
   checkInputs = [ fmt alcotest ];
diff --git a/pkgs/development/ocaml-modules/cohttp/lwt-unix.nix b/pkgs/development/ocaml-modules/cohttp/lwt-unix.nix
index 845df2a3f54..57885b0e65e 100644
--- a/pkgs/development/ocaml-modules/cohttp/lwt-unix.nix
+++ b/pkgs/development/ocaml-modules/cohttp/lwt-unix.nix
@@ -1,19 +1,28 @@
 { lib, buildDunePackage, cohttp-lwt
-, conduit-lwt-unix, ppx_sexp_conv
-, cmdliner, fmt, magic-mime
+, conduit-lwt-unix, conduit-lwt, ppx_sexp_conv
+, cmdliner, fmt, logs, magic-mime
+, ounit
+, cacert
 }:
 
-if !lib.versionAtLeast cohttp-lwt.version "0.99"
-then cohttp-lwt
-else
-
 buildDunePackage {
   pname = "cohttp-lwt-unix";
-  inherit (cohttp-lwt) version src meta;
+  inherit (cohttp-lwt) version src;
 
   useDune2 = true;
 
   buildInputs = [ cmdliner ppx_sexp_conv ];
 
-  propagatedBuildInputs = [ cohttp-lwt conduit-lwt-unix fmt magic-mime ];
+  propagatedBuildInputs = [
+    cohttp-lwt conduit-lwt conduit-lwt-unix fmt logs magic-mime
+  ];
+
+  # TODO(@sternenseemann): fail for unknown reason
+  # https://github.com/mirage/ocaml-cohttp/issues/675#issuecomment-830692742
+  doCheck = false;
+  checkInputs = [ ounit cacert ];
+
+  meta = cohttp-lwt.meta // {
+    description = "CoHTTP implementation for Unix and Windows using Lwt";
+  };
 }
diff --git a/pkgs/development/ocaml-modules/cohttp/lwt.nix b/pkgs/development/ocaml-modules/cohttp/lwt.nix
index 36831d94613..158aa3b27b2 100644
--- a/pkgs/development/ocaml-modules/cohttp/lwt.nix
+++ b/pkgs/development/ocaml-modules/cohttp/lwt.nix
@@ -1,16 +1,21 @@
-{ lib, buildDunePackage, cohttp, ocaml_lwt, uri, ppx_sexp_conv, logs }:
-
-if !lib.versionAtLeast cohttp.version "0.99"
-then cohttp
-else if !lib.versionAtLeast ppx_sexp_conv.version "0.13"
-then throw "cohttp-lwt is not available for ppx_sexp_conv version ${ppx_sexp_conv.version}"
-else
+{ lib, buildDunePackage, cohttp, ocaml_lwt, uri, ppx_sexp_conv, logs, sexplib0 }:
 
 buildDunePackage {
   pname = "cohttp-lwt";
-  inherit (cohttp) version src useDune2 meta;
+  inherit (cohttp)
+    version
+    src
+    useDune2
+    minimumOCamlVersion
+    ;
+
+  buildInputs = [ ppx_sexp_conv ];
 
-  buildInputs = [ uri ppx_sexp_conv ];
+  propagatedBuildInputs = [
+    cohttp ocaml_lwt logs sexplib0 uri
+  ];
 
-  propagatedBuildInputs = [ cohttp ocaml_lwt logs ];
+  meta = cohttp.meta // {
+    description = "CoHTTP implementation using the Lwt concurrency library";
+  };
 }
diff --git a/pkgs/development/ocaml-modules/cohttp/mirage.nix b/pkgs/development/ocaml-modules/cohttp/mirage.nix
index e7b172349cb..d2d3e945645 100644
--- a/pkgs/development/ocaml-modules/cohttp/mirage.nix
+++ b/pkgs/development/ocaml-modules/cohttp/mirage.nix
@@ -2,6 +2,7 @@
 , mirage-flow, mirage-channel, mirage-kv
 , conduit, conduit-mirage, lwt
 , astring, magic-mime
+, ppx_sexp_conv
 }:
 
 buildDunePackage {
@@ -9,6 +10,8 @@ buildDunePackage {
 
   inherit (cohttp) version src minimumOCamlVersion useDune2;
 
+  nativeBuildInputs = [ ppx_sexp_conv ];
+
   propagatedBuildInputs = [
     mirage-flow mirage-channel conduit conduit-mirage mirage-kv
     lwt cohttp cohttp-lwt astring magic-mime
diff --git a/pkgs/development/ocaml-modules/conduit/async.nix b/pkgs/development/ocaml-modules/conduit/async.nix
index c15ad0520fb..e78cb2bc516 100644
--- a/pkgs/development/ocaml-modules/conduit/async.nix
+++ b/pkgs/development/ocaml-modules/conduit/async.nix
@@ -1,17 +1,17 @@
-{ lib, buildDunePackage, async, async_ssl, ppx_sexp_conv, conduit }:
-
-if !lib.versionAtLeast conduit.version "1.0"
-then conduit
-else
+{ lib, buildDunePackage, async, async_ssl, ppx_sexp_conv, ppx_here, uri, conduit }:
 
 buildDunePackage {
   pname = "conduit-async";
-  useDune2 = true;
-  inherit (conduit) version src;
+  inherit (conduit)
+    version
+    src
+    minimumOCamlVersion
+    useDune2
+    ;
 
-  buildInputs = [ ppx_sexp_conv ];
+  buildInputs = [ ppx_sexp_conv ppx_here ];
 
-  propagatedBuildInputs = [ async async_ssl conduit ];
+  propagatedBuildInputs = [ async async_ssl conduit uri ];
 
   meta = conduit.meta // {
     description = "A network connection establishment library for Async";
diff --git a/pkgs/development/ocaml-modules/conduit/default.nix b/pkgs/development/ocaml-modules/conduit/default.nix
index 8c9b757f87c..96f5bf43d21 100644
--- a/pkgs/development/ocaml-modules/conduit/default.nix
+++ b/pkgs/development/ocaml-modules/conduit/default.nix
@@ -5,18 +5,18 @@
 
 buildDunePackage rec {
   pname = "conduit";
-  version = "2.2.2";
+  version = "4.0.0";
   useDune2 = true;
 
-  minimumOCamlVersion = "4.07";
+  minimumOCamlVersion = "4.03";
 
   src = fetchurl {
-    url = "https://github.com/mirage/ocaml-conduit/releases/download/v2.2.2/conduit-v2.2.2.tbz";
-    sha256 = "1zb83w2pq9c8xrappfxa6y5q93772f5dj22x78camsm77a2c2z55";
+    url = "https://github.com/mirage/ocaml-conduit/releases/download/v${version}/conduit-v${version}.tbz";
+    sha256 = "74b29d72bf47adc5d5c4cae6130ad5a2a4923118b9c571331bd1cb3c56decd2a";
   };
 
   buildInputs = [ ppx_sexp_conv ];
-  propagatedBuildInputs = [ astring ipaddr ipaddr-sexp sexplib uri ];
+  propagatedBuildInputs = [ astring ipaddr ipaddr-sexp sexplib uri logs ];
 
   meta = {
     description = "A network connection establishment library";
diff --git a/pkgs/development/ocaml-modules/conduit/lwt-unix.nix b/pkgs/development/ocaml-modules/conduit/lwt-unix.nix
index ab6449b50a1..ce6016012d7 100644
--- a/pkgs/development/ocaml-modules/conduit/lwt-unix.nix
+++ b/pkgs/development/ocaml-modules/conduit/lwt-unix.nix
@@ -1,18 +1,31 @@
 { buildDunePackage
-, conduit-lwt, ppx_sexp_conv, ocaml_lwt, uri, ipaddr, ipaddr-sexp
-, lwt_ssl, tls
+, conduit-lwt, ppx_sexp_conv, ocaml_lwt, uri, ipaddr, ipaddr-sexp, ca-certs, logs
+, lwt_ssl, tls, lwt_log, ssl
 }:
 
 buildDunePackage {
   pname = "conduit-lwt-unix";
-  inherit (conduit-lwt) version src minimumOCamlVersion;
-
-  useDune2 = true;
+  inherit (conduit-lwt) version src minimumOCamlVersion useDune2;
 
   buildInputs = [ ppx_sexp_conv ];
 
-  propagatedBuildInputs =
-    [ conduit-lwt ocaml_lwt uri ipaddr ipaddr-sexp tls lwt_ssl ];
+  propagatedBuildInputs = [
+    conduit-lwt
+    ocaml_lwt
+    uri
+    ipaddr
+    ipaddr-sexp
+    tls
+    ca-certs
+    logs
+    lwt_ssl
+  ];
+
+  doCheck = true;
+  checkInputs = [
+    lwt_log
+    ssl
+  ];
 
   meta = conduit-lwt.meta // {
     description = "A network connection establishment library for Lwt_unix";
diff --git a/pkgs/development/ocaml-modules/conduit/mirage.nix b/pkgs/development/ocaml-modules/conduit/mirage.nix
index 6100908f785..d1f636be93c 100644
--- a/pkgs/development/ocaml-modules/conduit/mirage.nix
+++ b/pkgs/development/ocaml-modules/conduit/mirage.nix
@@ -1,7 +1,8 @@
 { buildDunePackage, conduit-lwt
-, ppx_sexp_conv, sexplib, cstruct, mirage-stack, mirage-flow
+, ppx_sexp_conv, sexplib, uri, cstruct, mirage-stack, mirage-flow
 , mirage-flow-combinators, mirage-random, mirage-time, mirage-clock
 , dns-client, vchan, xenstore, tls, tls-mirage, ipaddr, ipaddr-sexp
+, tcpip, ca-certs-nss
 }:
 
 buildDunePackage {
@@ -12,10 +13,10 @@ buildDunePackage {
   nativeBuildInputs = [ ppx_sexp_conv ];
 
   propagatedBuildInputs = [
-    sexplib cstruct mirage-stack mirage-clock mirage-flow
+    sexplib uri cstruct mirage-stack mirage-clock mirage-flow
     mirage-flow-combinators mirage-random mirage-time
     dns-client conduit-lwt vchan xenstore tls tls-mirage
-    ipaddr ipaddr-sexp
+    ipaddr ipaddr-sexp tcpip ca-certs-nss
   ];
 
   meta = conduit-lwt.meta // {
diff --git a/pkgs/development/ocaml-modules/curly/default.nix b/pkgs/development/ocaml-modules/curly/default.nix
index 1c48b509c41..20197e207af 100644
--- a/pkgs/development/ocaml-modules/curly/default.nix
+++ b/pkgs/development/ocaml-modules/curly/default.nix
@@ -1,5 +1,6 @@
 { stdenv, lib, buildDunePackage, fetchurl, ocaml
-, result, alcotest, cohttp-lwt-unix, odoc, curl }:
+, result, alcotest, cohttp-lwt-unix, odoc, curl, cacert
+}:
 
 buildDunePackage rec {
   pname = "curly";
@@ -15,8 +16,9 @@ buildDunePackage rec {
   };
 
   propagatedBuildInputs = [ result ];
-  checkInputs = [ alcotest cohttp-lwt-unix ];
+  checkInputs = [ alcotest cohttp-lwt-unix cacert ];
   # test dependencies are only available for >= 4.08
+  # https://github.com/mirage/ca-certs/issues/16
   doCheck = lib.versionAtLeast ocaml.version "4.08"
     # Some test fails in macOS sandbox
     # > Fatal error: exception Unix.Unix_error(Unix.EPERM, "bind", "")
diff --git a/pkgs/development/ocaml-modules/decompress/default.nix b/pkgs/development/ocaml-modules/decompress/default.nix
index d2cba68d732..505ffe3c425 100644
--- a/pkgs/development/ocaml-modules/decompress/default.nix
+++ b/pkgs/development/ocaml-modules/decompress/default.nix
@@ -4,7 +4,7 @@
 }:
 
 buildDunePackage rec {
-  version = "1.3.0";
+  version = "1.4.0";
   pname = "decompress";
 
   minimumOCamlVersion = "4.07";
@@ -13,7 +13,7 @@ buildDunePackage rec {
 
   src = fetchurl {
     url = "https://github.com/mirage/decompress/releases/download/v${version}/decompress-v${version}.tbz";
-    sha256 = "de149896939be13fedec46a4581121d5ab74850a2241d08e6aa8ae4bb18c52c4";
+    sha256 = "d1669e07446d73dd5e16f020d4a1682abcbb1b7a1e3bf19b805429636c26a19b";
   };
 
   buildInputs = [ cmdliner ];
diff --git a/pkgs/development/ocaml-modules/dns/certify.nix b/pkgs/development/ocaml-modules/dns/certify.nix
index 1835114d707..31b39d18225 100644
--- a/pkgs/development/ocaml-modules/dns/certify.nix
+++ b/pkgs/development/ocaml-modules/dns/certify.nix
@@ -1,6 +1,6 @@
 { buildDunePackage, dns, dns-tsig, dns-mirage, randomconv, x509
 , mirage-random, mirage-time, mirage-clock, mirage-stack
-, logs, mirage-crypto-pk, mirage-crypto-rng, tls, lwt
+, logs, mirage-crypto-pk, mirage-crypto-rng, mirage-crypto-ec, lwt
 }:
 
 buildDunePackage {
@@ -21,7 +21,7 @@ buildDunePackage {
     logs
     mirage-crypto-pk
     mirage-crypto-rng
-    tls
+    mirage-crypto-ec
     lwt
   ];
 
diff --git a/pkgs/development/ocaml-modules/dns/default.nix b/pkgs/development/ocaml-modules/dns/default.nix
index 4f0b95da6cb..8a5115f10f0 100644
--- a/pkgs/development/ocaml-modules/dns/default.nix
+++ b/pkgs/development/ocaml-modules/dns/default.nix
@@ -4,14 +4,14 @@
 
 buildDunePackage rec {
   pname = "dns";
-  version = "4.6.3";
+  version = "5.0.1";
 
   useDune2 = true;
   minimumOCamlVersion = "4.07";
 
   src = fetchurl {
     url = "https://github.com/mirage/ocaml-dns/releases/download/v${version}/dns-v${version}.tbz";
-    sha256 = "0g7xw43jm5hv0w9lsnhhi0w3243mxl615cdsvz29yh39fcqvqsdy";
+    sha256 = "72c0a1a91c8e409bd448c8e0ea28d16d13177c326aea403ee1c30ddcb5969adc";
   };
 
   propagatedBuildInputs = [ rresult astring fmt logs ptime domain-name gmap cstruct ipaddr lru duration metrics ];
diff --git a/pkgs/development/ocaml-modules/git/cohttp-mirage.nix b/pkgs/development/ocaml-modules/git/cohttp-mirage.nix
deleted file mode 100644
index d3088400641..00000000000
--- a/pkgs/development/ocaml-modules/git/cohttp-mirage.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-{ lib, buildDunePackage
-, git, mimic, cohttp-mirage, cohttp, cohttp-lwt
-, fmt, lwt, result, rresult, uri
-}:
-
-buildDunePackage {
-  pname = "git-cohttp-mirage";
-
-  inherit (git) version src minimumOCamlVersion useDune2;
-
-  propagatedBuildInputs = [
-    git mimic cohttp-mirage cohttp cohttp-lwt fmt lwt result rresult uri
-  ];
-
-  meta = git.meta // {
-    description = "A package to use HTTP-based ocaml-git with MirageOS backend";
-  };
-}
diff --git a/pkgs/development/ocaml-modules/git/default.nix b/pkgs/development/ocaml-modules/git/default.nix
index b8d73178d09..954e4956c81 100644
--- a/pkgs/development/ocaml-modules/git/default.nix
+++ b/pkgs/development/ocaml-modules/git/default.nix
@@ -1,30 +1,35 @@
 { stdenv, lib, fetchurl, buildDunePackage
 , alcotest, mtime, mirage-crypto-rng, tls, git-binary
 , angstrom, astring, cstruct, decompress, digestif, encore, duff, fmt, checkseum
-, fpath, ke, logs, lwt, ocamlgraph, uri, rresult, base64
+, fpath, ke, logs, lwt, ocamlgraph, uri, rresult, base64, hxd
 , result, bigstringaf, optint, mirage-flow, domain-name, emile
 , mimic, carton, carton-lwt, carton-git, ipaddr, psq, crowbar, alcotest-lwt
 }:
 
 buildDunePackage rec {
   pname = "git";
-  version = "3.3.3";
+  version = "3.4.0";
 
   minimumOCamlVersion = "4.08";
   useDune2 = true;
 
   src = fetchurl {
     url = "https://github.com/mirage/ocaml-git/releases/download/${version}/git-${version}.tbz";
-    sha256 = "0j8pw9w74bfhrjsqr8zm8g7h1az94z9vg7qgc6z6649zm9yjiax3";
+    sha256 = "6eef1240c7c85a8e495b82ef863c509ad41d75e0c45cf73c34ed1bdafd03413f";
   };
 
+  # remove changelog for the carton package
+  postPatch = ''
+    rm CHANGES.carton.md
+  '';
+
   buildInputs = [
     base64
   ];
   propagatedBuildInputs = [
     angstrom astring checkseum cstruct decompress digestif encore duff fmt fpath
     ke logs lwt ocamlgraph uri rresult result bigstringaf optint mirage-flow
-    domain-name emile mimic carton carton-lwt carton-git ipaddr psq
+    domain-name emile mimic carton carton-lwt carton-git ipaddr psq hxd
   ];
   checkInputs = [
     alcotest alcotest-lwt mtime mirage-crypto-rng tls git-binary crowbar
diff --git a/pkgs/development/ocaml-modules/git/paf.nix b/pkgs/development/ocaml-modules/git/paf.nix
new file mode 100644
index 00000000000..cf0272ddf3b
--- /dev/null
+++ b/pkgs/development/ocaml-modules/git/paf.nix
@@ -0,0 +1,49 @@
+{ lib, buildDunePackage
+, git
+, mimic
+, paf
+, ca-certs-nss
+, cohttp
+, cohttp-lwt
+, fmt
+, ipaddr
+, logs
+, lwt
+, mirage-clock
+, mirage-stack
+, mirage-time
+, result
+, rresult
+, tls
+, uri
+}:
+
+buildDunePackage {
+  pname = "git-paf";
+
+  inherit (git) version src minimumOCamlVersion useDune2;
+
+  propagatedBuildInputs = [
+    git
+    mimic
+    paf
+    ca-certs-nss
+    cohttp
+    cohttp-lwt
+    fmt
+    lwt
+    result
+    rresult
+    ipaddr
+    logs
+    mirage-clock
+    mirage-stack
+    mirage-time
+    tls
+    uri
+  ];
+
+  meta = git.meta // {
+    description = "A package to use HTTP-based ocaml-git with MirageOS backend";
+  };
+}
diff --git a/pkgs/development/ocaml-modules/git/unix.nix b/pkgs/development/ocaml-modules/git/unix.nix
index f4cea472886..3e5f464cea0 100644
--- a/pkgs/development/ocaml-modules/git/unix.nix
+++ b/pkgs/development/ocaml-modules/git/unix.nix
@@ -6,7 +6,8 @@
 , tcpip, awa-mirage, mirage-flow
 , alcotest, alcotest-lwt, base64, cstruct
 , ke, mirage-crypto-rng, ocurl, git-binary
-, ptime
+, ptime, mimic, ca-certs-nss, tls, tls-mirage
+, cacert
 }:
 
 buildDunePackage {
@@ -24,10 +25,14 @@ buildDunePackage {
     fmt bos fpath uri digestif logs lwt
     astring cohttp-lwt-unix decompress
     domain-name ipaddr mtime mirage-flow
+    cstruct ptime mimic ca-certs-nss
+    tls tls-mirage
   ];
   checkInputs = [
-    alcotest alcotest-lwt base64 cstruct ke
-    mirage-crypto-rng ocurl git-binary ptime
+    alcotest alcotest-lwt base64 ke
+    mirage-crypto-rng git-binary
+    cohttp-lwt-unix
+    cacert # sets up NIX_SSL_CERT_FILE
   ];
   doCheck = true;
 
diff --git a/pkgs/development/ocaml-modules/irmin/containers.nix b/pkgs/development/ocaml-modules/irmin/containers.nix
index 761e9bf5619..76383099a41 100644
--- a/pkgs/development/ocaml-modules/irmin/containers.nix
+++ b/pkgs/development/ocaml-modules/irmin/containers.nix
@@ -1,6 +1,6 @@
 { buildDunePackage
 , irmin, irmin-unix, irmin-git, ppx_irmin, lwt, mtime
-, alcotest, alcotest-lwt
+, alcotest, alcotest-lwt, cacert
 }:
 
 buildDunePackage {
@@ -18,7 +18,7 @@ buildDunePackage {
 
   doCheck = true;
   checkInputs = [
-    alcotest alcotest-lwt
+    alcotest alcotest-lwt cacert
   ];
 
   meta = ppx_irmin.meta // {
diff --git a/pkgs/development/ocaml-modules/irmin/git.nix b/pkgs/development/ocaml-modules/irmin/git.nix
index a6c1e8af8fa..d477c932928 100644
--- a/pkgs/development/ocaml-modules/irmin/git.nix
+++ b/pkgs/development/ocaml-modules/irmin/git.nix
@@ -1,7 +1,7 @@
 { lib, buildDunePackage
 , git, irmin, irmin-test, ppx_irmin, git-cohttp-unix, git-unix
 , digestif, cstruct, fmt, astring, fpath, logs, lwt, uri
-, mtime, alcotest
+, mtime, alcotest, cacert
 }:
 
 buildDunePackage {
@@ -26,7 +26,7 @@ buildDunePackage {
     uri
   ];
 
-  checkInputs = [ mtime alcotest git-cohttp-unix git-unix irmin-test ];
+  checkInputs = [ mtime alcotest git-cohttp-unix git-unix irmin-test cacert ];
 
   doCheck = true;
 
diff --git a/pkgs/development/ocaml-modules/irmin/graphql.nix b/pkgs/development/ocaml-modules/irmin/graphql.nix
index ca205cac4e1..03c8f1eca29 100644
--- a/pkgs/development/ocaml-modules/irmin/graphql.nix
+++ b/pkgs/development/ocaml-modules/irmin/graphql.nix
@@ -1,5 +1,5 @@
 { lib, buildDunePackage, cohttp-lwt, graphql-cohttp, graphql-lwt, irmin
-, alcotest, alcotest-lwt, logs, yojson, cohttp-lwt-unix
+, alcotest, alcotest-lwt, logs, yojson, cohttp-lwt-unix, cacert
 }:
 
 buildDunePackage rec {
@@ -19,6 +19,7 @@ buildDunePackage rec {
     logs
     cohttp-lwt-unix
     yojson
+    cacert
   ];
 
   meta = irmin.meta // {
diff --git a/pkgs/development/ocaml-modules/irmin/http.nix b/pkgs/development/ocaml-modules/irmin/http.nix
index b50e0b87345..7bfae998202 100644
--- a/pkgs/development/ocaml-modules/irmin/http.nix
+++ b/pkgs/development/ocaml-modules/irmin/http.nix
@@ -1,5 +1,6 @@
 { lib, buildDunePackage, cohttp-lwt, irmin, webmachine
 , checkseum, git-unix, irmin-git, irmin-test, digestif, git-cohttp-unix
+, cacert
 }:
 
 buildDunePackage rec {
@@ -12,7 +13,9 @@ buildDunePackage rec {
 
   propagatedBuildInputs = [ cohttp-lwt irmin webmachine ];
 
-  checkInputs = [ digestif checkseum git-cohttp-unix git-unix irmin-git irmin-test ];
+  checkInputs = [
+    digestif checkseum git-cohttp-unix git-unix irmin-git irmin-test cacert
+  ];
 
   doCheck = true;
 
diff --git a/pkgs/development/ocaml-modules/irmin/mirage-git.nix b/pkgs/development/ocaml-modules/irmin/mirage-git.nix
index dfa84ff2335..e33b766bd4c 100644
--- a/pkgs/development/ocaml-modules/irmin/mirage-git.nix
+++ b/pkgs/development/ocaml-modules/irmin/mirage-git.nix
@@ -1,6 +1,6 @@
 { buildDunePackage, irmin-mirage, irmin-git
 , mirage-kv, cohttp, conduit-lwt, conduit-mirage
-, git-cohttp-mirage, fmt, git, lwt, mirage-clock, uri
+, git-paf, fmt, git, lwt, mirage-clock, uri
 }:
 
 buildDunePackage {
@@ -15,7 +15,7 @@ buildDunePackage {
     cohttp
     conduit-lwt
     conduit-mirage
-    git-cohttp-mirage
+    git-paf
     fmt
     git
     lwt
diff --git a/pkgs/development/ocaml-modules/irmin/ppx.nix b/pkgs/development/ocaml-modules/irmin/ppx.nix
index 7c59e1eaef3..c7eed70d9d9 100644
--- a/pkgs/development/ocaml-modules/irmin/ppx.nix
+++ b/pkgs/development/ocaml-modules/irmin/ppx.nix
@@ -2,11 +2,11 @@
 
 buildDunePackage rec {
   pname = "ppx_irmin";
-  version = "2.5.3";
+  version = "2.6.0";
 
   src = fetchurl {
     url = "https://github.com/mirage/irmin/releases/download/${version}/irmin-${version}.tbz";
-    sha256 = "2c8ef24cc57379c3a138f121fea350ee7b6077abc22a4fdc6a47d0c81585f3f6";
+    sha256 = "1db134221e82c424260a0e206b640fcb82902be35eea4137af2bcd9c98d3ac0f";
   };
 
   minimumOCamlVersion = "4.08";
diff --git a/pkgs/development/ocaml-modules/irmin/unix.nix b/pkgs/development/ocaml-modules/irmin/unix.nix
index a3dfb5d508c..89cf36979bd 100644
--- a/pkgs/development/ocaml-modules/irmin/unix.nix
+++ b/pkgs/development/ocaml-modules/irmin/unix.nix
@@ -1,7 +1,7 @@
 { lib, buildDunePackage
 , checkseum, cmdliner, git-unix, git-cohttp-unix, yaml, fpath
 , irmin, irmin-fs, irmin-git, irmin-graphql, irmin-http
-, irmin-pack, irmin-watcher, irmin-test
+, irmin-pack, irmin-watcher, irmin-test, cacert
 }:
 
 buildDunePackage rec {
@@ -18,7 +18,9 @@ buildDunePackage rec {
     irmin-pack irmin-watcher git-cohttp-unix
   ];
 
-  checkInputs = lib.optional doCheck irmin-test;
+  checkInputs = [
+    irmin-test cacert
+  ];
 
   doCheck = true;
 
diff --git a/pkgs/development/ocaml-modules/letsencrypt/default.nix b/pkgs/development/ocaml-modules/letsencrypt/default.nix
index b3c0d4f8941..0a70bf30242 100644
--- a/pkgs/development/ocaml-modules/letsencrypt/default.nix
+++ b/pkgs/development/ocaml-modules/letsencrypt/default.nix
@@ -31,11 +31,11 @@
 
 buildDunePackage rec {
   pname = "letsencrypt";
-  version = "0.2.4";
+  version = "0.2.5";
 
   src = fetchurl {
     url = "https://github.com/mmaker/ocaml-letsencrypt/releases/download/v${version}/letsencrypt-v${version}.tbz";
-    sha256 = "91c79828a50243804da29c17563c54d2d528a79207e5b874dce6a3e7fedf7567";
+    sha256 = "6e3bbb5f593823d49e83e698c06cf9ed48818695ec8318507b311ae74731e607";
   };
 
   minimumOCamlVersion = "4.08";
diff --git a/pkgs/development/ocaml-modules/mimic/default.nix b/pkgs/development/ocaml-modules/mimic/default.nix
index 3ddae57e9e8..ea163642703 100644
--- a/pkgs/development/ocaml-modules/mimic/default.nix
+++ b/pkgs/development/ocaml-modules/mimic/default.nix
@@ -1,27 +1,23 @@
 { lib, buildDunePackage, fetchurl
-, fmt, mirage-flow, result, rresult, cstruct, logs, ke
+, fmt, mirage-flow, result, rresult, cstruct, logs, ke, lwt
 , alcotest, alcotest-lwt, bigstringaf, bigarray-compat
 }:
 
 buildDunePackage rec {
   pname = "mimic";
-  version = "0.0.2";
+  version = "0.0.3";
 
   minimumOCamlVersion = "4.08";
   useDune2 = true;
 
   src = fetchurl {
-    url = "https://github.com/mirage/ocaml-git/releases/download/${pname}-v${version}/${pname}-${pname}-v${version}.tbz";
-    sha256 = "3ad5af3caa1120ecfdf022de41ba5be8edfbf50270fc99238b82d3d2d6e7c317";
+    url = "https://github.com/dinosaure/mimic/releases/download/${version}/mimic-${version}.tbz";
+    sha256 = "e4743cd2e4f8242eb1ce9d8086fd2affba0eb6a62131309ffa279108bd3dbbcb";
   };
 
-  # don't install changelogs for other packages
-  postPatch = ''
-    rm -f CHANGES.md CHANGES.carton.md
-  '';
-
   propagatedBuildInputs = [
     fmt
+    lwt
     mirage-flow
     result
     rresult
diff --git a/pkgs/development/ocaml-modules/mirage/runtime.nix b/pkgs/development/ocaml-modules/mirage/runtime.nix
index 50121ad6280..aaa51aa276c 100644
--- a/pkgs/development/ocaml-modules/mirage/runtime.nix
+++ b/pkgs/development/ocaml-modules/mirage/runtime.nix
@@ -3,7 +3,7 @@
 
 buildDunePackage rec {
   pname = "mirage-runtime";
-  version = "3.10.1";
+  version = "3.10.3";
 
   useDune2 = true;
 
@@ -11,7 +11,7 @@ buildDunePackage rec {
 
   src = fetchurl {
     url = "https://github.com/mirage/mirage/releases/download/v${version}/mirage-v${version}.tbz";
-    sha256 = "1glmsz2znhfkk4w6d6nsr7q5jqvivhmi8zwagzw2d8pah0c8bhm4";
+    sha256 = "7c8059ef9e330eaef1ed51c0d89afe17900310f8083a426cd8099602222c2281";
   };
 
   propagatedBuildInputs = [ ipaddr functoria-runtime fmt logs ocaml_lwt ];
diff --git a/pkgs/development/ocaml-modules/optint/default.nix b/pkgs/development/ocaml-modules/optint/default.nix
index 7f8ded5feb6..2227f6e033c 100644
--- a/pkgs/development/ocaml-modules/optint/default.nix
+++ b/pkgs/development/ocaml-modules/optint/default.nix
@@ -1,12 +1,12 @@
 { lib, buildDunePackage, fetchurl }:
 
 buildDunePackage rec {
-  minimumOCamlVersion = "4.03";
-  version = "0.0.4";
+  minimumOCamlVersion = "4.07";
+  version = "0.1.0";
   pname = "optint";
   src = fetchurl {
     url = "https://github.com/mirage/optint/releases/download/v${version}/optint-v${version}.tbz";
-    sha256 = "1a7gabxqmfvii8qnxq1clx43md2h9glskxhac8y8r0rhzblx3s1a";
+    sha256 = "27847660223c16cc7eaf8fcd9d5589a0b802114330a2529578f8007d3b01185d";
   };
 
   useDune2 = true;
diff --git a/pkgs/development/ocaml-modules/paf/default.nix b/pkgs/development/ocaml-modules/paf/default.nix
index 0c91051e243..375ba1c125e 100644
--- a/pkgs/development/ocaml-modules/paf/default.nix
+++ b/pkgs/development/ocaml-modules/paf/default.nix
@@ -5,6 +5,7 @@
 , mirage-stack
 , mirage-time
 , httpaf
+, h2
 , tls-mirage
 , mimic
 , cohttp-lwt
@@ -31,11 +32,11 @@
 
 buildDunePackage rec {
   pname = "paf";
-  version = "0.0.1";
+  version = "0.0.3";
 
   src = fetchurl {
     url = "https://github.com/dinosaure/paf-le-chien/releases/download/${version}/paf-${version}.tbz";
-    sha256 = "7a794c21ce458bda302553b0f5ac128c067579fbb3b7b8fba9b410446c43e790";
+    sha256 = "a0bbb84b19e1f0255337fc4d7017f3ea3611b241746e391b11c1d8b1f5f30a2b";
   };
 
   useDune2 = true;
@@ -45,6 +46,7 @@ buildDunePackage rec {
     mirage-stack
     mirage-time
     httpaf
+    h2
     tls-mirage
     mimic
     cohttp-lwt
diff --git a/pkgs/development/ocaml-modules/tls/default.nix b/pkgs/development/ocaml-modules/tls/default.nix
index 2ee01ed8219..dadeb5a98ea 100644
--- a/pkgs/development/ocaml-modules/tls/default.nix
+++ b/pkgs/development/ocaml-modules/tls/default.nix
@@ -1,17 +1,17 @@
 { lib, fetchurl, buildDunePackage, ppx_sexp_conv, ppx_cstruct, cstruct
 , cstruct-sexp, sexplib, mirage-crypto, mirage-crypto-pk, mirage-crypto-rng
-, x509, domain-name, fmt, cstruct-unix, ounit2, ocaml_lwt, ptime
-, hacl_x25519, fiat-p256, hkdf, logs, alcotest }:
+, x509, domain-name, fmt, cstruct-unix, ounit2, ocaml_lwt, ptime, rresult
+, mirage-crypto-ec, hkdf, logs, alcotest }:
 
 buildDunePackage rec {
   minimumOCamlVersion = "4.08";
 
-  version = "0.12.8";
+  version = "0.13.1";
   pname = "tls";
 
   src = fetchurl {
     url = "https://github.com/mirleft/ocaml-tls/releases/download/v${version}/tls-v${version}.tbz";
-    sha256 = "0sgppvfnamfnsglw1cl801i1xqkxbs33g40kwmmqj2vqjcarm26a";
+    sha256 = "ca95fa59a82f7d38b0b495fc0cd1ff54e7728492a292895d0067c1ba9de81b7b";
   };
 
   useDune2 = true;
@@ -21,8 +21,8 @@ buildDunePackage rec {
 
   propagatedBuildInputs = [ ppx_sexp_conv ppx_cstruct cstruct cstruct-sexp
                             sexplib mirage-crypto mirage-crypto-pk mirage-crypto-rng
-                            x509 domain-name fmt ocaml_lwt ptime hacl_x25519 fiat-p256
-                            hkdf logs ];
+                            x509 domain-name fmt ocaml_lwt ptime mirage-crypto-ec
+                            hkdf logs rresult ];
 
   meta = with lib; {
     homepage = "https://github.com/mirleft/ocaml-tls";
diff --git a/pkgs/development/ocaml-modules/tls/mirage.nix b/pkgs/development/ocaml-modules/tls/mirage.nix
index ad81c03c35d..18d0f08357d 100644
--- a/pkgs/development/ocaml-modules/tls/mirage.nix
+++ b/pkgs/development/ocaml-modules/tls/mirage.nix
@@ -1,6 +1,6 @@
 { buildDunePackage, tls
 , x509, lwt, fmt, mirage-flow, mirage-kv, mirage-clock, ptime
-, mirage-crypto, mirage-crypto-pk, hacl_x25519, fiat-p256
+, mirage-crypto, mirage-crypto-pk, mirage-crypto-ec
 }:
 
 buildDunePackage {
@@ -19,8 +19,7 @@ buildDunePackage {
     ptime
     mirage-crypto
     mirage-crypto-pk
-    hacl_x25519
-    fiat-p256
+    mirage-crypto-ec
   ];
 
   meta = tls.meta // {
diff --git a/pkgs/development/ocaml-modules/x509/default.nix b/pkgs/development/ocaml-modules/x509/default.nix
index 637105361fd..0ce57b07168 100644
--- a/pkgs/development/ocaml-modules/x509/default.nix
+++ b/pkgs/development/ocaml-modules/x509/default.nix
@@ -8,11 +8,11 @@ buildDunePackage rec {
   minimumOCamlVersion = "4.07";
 
   pname = "x509";
-  version = "0.12.0";
+  version = "0.13.0";
 
   src = fetchurl {
     url = "https://github.com/mirleft/ocaml-x509/releases/download/v${version}/x509-v${version}.tbz";
-    sha256 = "04g59j8sn8am0z0a94h8cyvr6cqzd5gkn2lj6g51nb5dkwajj19h";
+    sha256 = "4577c2a616bda45cc777869fc44e272397d63a029135a993df8937bcfd6f6c49";
   };
 
   useDune2 = true;