treewide: with stdenv.lib; in meta -> with lib;

Part of: https://github.com/NixOS/nixpkgs/issues/108938

meta = with stdenv.lib;

is a widely used pattern. We want to slowly remove
the `stdenv.lib` indirection and encourage people
to use `lib` directly. Thus let’s start with the meta
field.

This used a rewriting script to mostly automatically
replace all occurances of this pattern, and add the
`lib` argument to the package header if it doesn’t
exist yet.

The script in its current form is available at
https://cs.tvl.fyi/depot@2f807d7f141068d2d60676a89213eaa5353ca6e0/-/blob/users/Profpatsch/nixpkgs-rewriter/default.nix

195 files changed, 377 insertions, 377 deletions

diff --git a/pkgs/tools/security/1password-gui/default.nix b/pkgs/tools/security/1password-gui/default.nix
index 667a21343e6..d9f7a7c7d33 100644
--- a/pkgs/tools/security/1password-gui/default.nix
+++ b/pkgs/tools/security/1password-gui/default.nix
@@ -1,4 +1,4 @@
-{ stdenv
+{ lib, stdenv
 , fetchurl
 , appimageTools
 , makeWrapper
@@ -53,7 +53,7 @@ stdenv.mkDerivation rec {
 
   passthru.updateScript = ./update.sh;
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Multi-platform password manager";
     longDescription = ''
       1Password is a multi-platform package manager.
diff --git a/pkgs/tools/security/2fa/default.nix b/pkgs/tools/security/2fa/default.nix
index 7b6048660c4..41e4439eeb3 100644
--- a/pkgs/tools/security/2fa/default.nix
+++ b/pkgs/tools/security/2fa/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoPackage, fetchFromGitHub }:
+{ lib, stdenv, buildGoPackage, fetchFromGitHub }:
 
 buildGoPackage rec {
   version = "1.1.0";
@@ -13,7 +13,7 @@ buildGoPackage rec {
     sha256 = "0827vl2bxd6m2rbj00x7857cs7cic3mlg5nlhqzd0n73dm5vk2za";
   };
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "https://rsc.io/2fa";
     description = "Two-factor authentication on the command line";
     maintainers = with maintainers; [ rvolosatovs ];
diff --git a/pkgs/tools/security/acsccid/default.nix b/pkgs/tools/security/acsccid/default.nix
index 53842cbb1fc..df30d18edfc 100644
--- a/pkgs/tools/security/acsccid/default.nix
+++ b/pkgs/tools/security/acsccid/default.nix
@@ -1,4 +1,4 @@
-{ stdenv
+{ lib, stdenv
 , fetchFromGitHub
 , autoconf
 , automake
@@ -60,7 +60,7 @@ stdenv.mkDerivation rec {
     autoconf
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A PC/SC driver for Linux/Mac OS X and it supports ACS CCID smart card readers";
     longDescription = ''
       acsccid is a PC/SC driver for Linux/Mac OS X and it supports ACS CCID smart card
diff --git a/pkgs/tools/security/aespipe/default.nix b/pkgs/tools/security/aespipe/default.nix
index e25416e55b8..f0a1dbbf7ac 100644
--- a/pkgs/tools/security/aespipe/default.nix
+++ b/pkgs/tools/security/aespipe/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, sharutils, makeWrapper }:
+{ lib, stdenv, fetchurl, sharutils, makeWrapper }:
 
 stdenv.mkDerivation rec {
   pname = "aespipe";
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
      --prefix PATH : $out/bin:${stdenv.lib.makeBinPath [ sharutils ]}
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "AES encrypting or decrypting pipe";
     homepage = "http://loop-aes.sourceforge.net/aespipe.README";
     license = licenses.gpl2;
diff --git a/pkgs/tools/security/afl/libdislocator.nix b/pkgs/tools/security/afl/libdislocator.nix
index 103786d1244..1c22c7d1d24 100644
--- a/pkgs/tools/security/afl/libdislocator.nix
+++ b/pkgs/tools/security/afl/libdislocator.nix
@@ -1,4 +1,4 @@
-{ stdenv, afl}:
+{ lib, stdenv, afl}:
 
 stdenv.mkDerivation {
   version = stdenv.lib.getVersion afl;
@@ -21,7 +21,7 @@ stdenv.mkDerivation {
     chmod +x $out/bin/get-libdislocator-so
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "https://lcamtuf.coredump.cx/afl/";
     description = ''
       Drop-in replacement for the libc allocator which improves
diff --git a/pkgs/tools/security/afl/qemu.nix b/pkgs/tools/security/afl/qemu.nix
index 3af44763a8a..31aac2430b8 100644
--- a/pkgs/tools/security/afl/qemu.nix
+++ b/pkgs/tools/security/afl/qemu.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, afl, python2, zlib, pkgconfig, glib, perl
+{ lib, stdenv, fetchurl, afl, python2, zlib, pkgconfig, glib, perl
 , texinfo, libuuid, flex, bison, pixman, autoconf
 }:
 
@@ -69,7 +69,7 @@ stdenv.mkDerivation {
       "--localstatedir=/var"
     ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "http://www.qemu.org/";
     description = "Fork of QEMU with AFL instrumentation support";
     license = licenses.gpl2Plus;
diff --git a/pkgs/tools/security/aflplusplus/libdislocator.nix b/pkgs/tools/security/aflplusplus/libdislocator.nix
index 6f947a7280a..99f9d51ea7e 100644
--- a/pkgs/tools/security/aflplusplus/libdislocator.nix
+++ b/pkgs/tools/security/aflplusplus/libdislocator.nix
@@ -1,4 +1,4 @@
-{ stdenv, aflplusplus}:
+{ lib, stdenv, aflplusplus}:
 
 stdenv.mkDerivation {
   version = stdenv.lib.getVersion aflplusplus;
@@ -24,7 +24,7 @@ stdenv.mkDerivation {
     chmod +x $out/bin/get-libdislocator-so
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "https://github.com/vanhauser-thc/AFLplusplus";
     description = ''
       Drop-in replacement for the libc allocator which improves
diff --git a/pkgs/tools/security/aflplusplus/libtokencap.nix b/pkgs/tools/security/aflplusplus/libtokencap.nix
index 9421ee0d1e2..87e06ed9aeb 100644
--- a/pkgs/tools/security/aflplusplus/libtokencap.nix
+++ b/pkgs/tools/security/aflplusplus/libtokencap.nix
@@ -1,4 +1,4 @@
-{ stdenv, aflplusplus}:
+{ lib, stdenv, aflplusplus}:
 
 stdenv.mkDerivation {
   version = stdenv.lib.getVersion aflplusplus;
@@ -23,7 +23,7 @@ stdenv.mkDerivation {
     chmod +x $out/bin/get-libtokencap-so
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "https://github.com/vanhauser-thc/AFLplusplus";
     description = "strcmp & memcmp token capture library";
     license = stdenv.lib.licenses.asl20;
diff --git a/pkgs/tools/security/aflplusplus/qemu.nix b/pkgs/tools/security/aflplusplus/qemu.nix
index c51c839afe8..cc6bf3a83ef 100644
--- a/pkgs/tools/security/aflplusplus/qemu.nix
+++ b/pkgs/tools/security/aflplusplus/qemu.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, aflplusplus, python2, zlib, pkgconfig, glib, perl
+{ lib, stdenv, fetchurl, aflplusplus, python2, zlib, pkgconfig, glib, perl
 , texinfo, libuuid, flex, bison, pixman, autoconf
 }:
 
@@ -73,7 +73,7 @@ stdenv.mkDerivation {
       "--localstatedir=/var"
     ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "https://www.qemu.org/";
     description = "Fork of QEMU with AFL++ instrumentation support";
     license = licenses.gpl2Plus;
diff --git a/pkgs/tools/security/aide/default.nix b/pkgs/tools/security/aide/default.nix
index 59b72320758..49291775e37 100644
--- a/pkgs/tools/security/aide/default.nix
+++ b/pkgs/tools/security/aide/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, flex, bison, libmhash, zlib, acl, attr, libselinux, pcre }:
+{ lib, stdenv, fetchurl, flex, bison, libmhash, zlib, acl, attr, libselinux, pcre }:
 
 stdenv.mkDerivation rec {
   pname = "aide";
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     "--with-xattr"
     ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "https://aide.github.io/";
     description = "A file and directory integrity checker";
     license = licenses.gpl2Plus;
diff --git a/pkgs/tools/security/asc-key-to-qr-code-gif/default.nix b/pkgs/tools/security/asc-key-to-qr-code-gif/default.nix
index ee5fa924cb6..b0e3a644959 100644
--- a/pkgs/tools/security/asc-key-to-qr-code-gif/default.nix
+++ b/pkgs/tools/security/asc-key-to-qr-code-gif/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, imagemagick, qrencode
+{ lib, stdenv, fetchFromGitHub, imagemagick, qrencode
 , testQR ? false, zbar ? null
 }:
 
@@ -36,7 +36,7 @@ stdenv.mkDerivation {
     cp * $out/bin/
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "https://github.com/yishilin14/asc-key-to-qr-code-gif";
     description = "Convert ASCII-armored PGP keys to animated QR code";
     platforms = platforms.linux;
diff --git a/pkgs/tools/security/aws-iam-authenticator/default.nix b/pkgs/tools/security/aws-iam-authenticator/default.nix
index 44282d5f964..851eed43ade 100644
--- a/pkgs/tools/security/aws-iam-authenticator/default.nix
+++ b/pkgs/tools/security/aws-iam-authenticator/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoPackage, fetchFromGitHub }:
+{ lib, stdenv, buildGoPackage, fetchFromGitHub }:
 
 buildGoPackage rec {
   pname = "aws-iam-authenticator";
@@ -13,7 +13,7 @@ buildGoPackage rec {
     sha256 = "1ghl2vms9wmvczdl2raqhy0gffxmk24h158gjb5mlw7rggzvb7bg";
   };
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "https://github.com/kubernetes-sigs/aws-iam-authenticator";
     description = "AWS IAM credentials for Kubernetes authentication";
     license = licenses.asl20;
diff --git a/pkgs/tools/security/aws-okta/default.nix b/pkgs/tools/security/aws-okta/default.nix
index 340c2cd971c..de84e43b5aa 100644
--- a/pkgs/tools/security/aws-okta/default.nix
+++ b/pkgs/tools/security/aws-okta/default.nix
@@ -1,4 +1,4 @@
-{ buildGoPackage, fetchFromGitHub, libusb1, pkgconfig, stdenv, libiconv }:
+{ buildGoPackage, fetchFromGitHub, libusb1, pkgconfig, lib, stdenv, libiconv }:
 
 buildGoPackage rec {
   pname = "aws-okta";
@@ -20,7 +20,7 @@ buildGoPackage rec {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ libusb1  libiconv ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     inherit version;
     description = "aws-vault like tool for Okta authentication";
     license = licenses.mit;
diff --git a/pkgs/tools/security/bash-supergenpass/default.nix b/pkgs/tools/security/bash-supergenpass/default.nix
index 53bc45acf8f..cbacf8b33a4 100644
--- a/pkgs/tools/security/bash-supergenpass/default.nix
+++ b/pkgs/tools/security/bash-supergenpass/default.nix
@@ -1,4 +1,4 @@
-{ stdenv
+{ lib, stdenv
 , fetchFromGitHub
 , unstableGitUpdater
 , makeWrapper
@@ -26,7 +26,7 @@ stdenv.mkDerivation {
 
   passthru.updateScript = unstableGitUpdater { };
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Bash shell-script implementation of SuperGenPass password generation";
     longDescription = ''
       Bash shell-script implementation of SuperGenPass password generation
diff --git a/pkgs/tools/security/bettercap/default.nix b/pkgs/tools/security/bettercap/default.nix
index 17cb0308a16..3b0a6ca6264 100644
--- a/pkgs/tools/security/bettercap/default.nix
+++ b/pkgs/tools/security/bettercap/default.nix
@@ -1,4 +1,4 @@
-{ stdenv
+{ lib, stdenv
 , buildGoModule
 , fetchFromGitHub
 , pkg-config
@@ -27,7 +27,7 @@ buildGoModule rec {
   buildInputs = [ libpcap libusb1 ]
     ++ stdenv.lib.optionals stdenv.isLinux [ libnfnetlink libnetfilter_queue ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A man in the middle tool";
     longDescription = ''
       BetterCAP is a powerful, flexible and portable tool created to perform various types of MITM attacks against a network, manipulate HTTP, HTTPS and TCP traffic in realtime, sniff for credentials and much more.
diff --git a/pkgs/tools/security/bitwarden/default.nix b/pkgs/tools/security/bitwarden/default.nix
index c35a4d60e9e..9bbcdab6bf7 100644
--- a/pkgs/tools/security/bitwarden/default.nix
+++ b/pkgs/tools/security/bitwarden/default.nix
@@ -24,7 +24,7 @@ let
     x86_64-linux = "1z1r8327xymqf2h98wb2fb02s41pxc6fh5w4bxmdgpx7k1jx5kvg";
   }.${system} or "";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A secure and free password manager for all of your devices";
     homepage = "https://bitwarden.com";
     license = licenses.gpl3;
diff --git a/pkgs/tools/security/bitwarden_rs/default.nix b/pkgs/tools/security/bitwarden_rs/default.nix
index 57e865ef596..482ba400e63 100644
--- a/pkgs/tools/security/bitwarden_rs/default.nix
+++ b/pkgs/tools/security/bitwarden_rs/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, rustPlatform, fetchFromGitHub, nixosTests
+{ lib, stdenv, rustPlatform, fetchFromGitHub, nixosTests
 , pkgconfig, openssl
 , Security, CoreServices
 , dbBackend ? "sqlite", libmysqlclient, postgresql }:
@@ -37,7 +37,7 @@ in rustPlatform.buildRustPackage rec {
 
   passthru.tests = nixosTests.bitwarden;
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Unofficial Bitwarden compatible server written in Rust";
     homepage = "https://github.com/dani-garcia/bitwarden_rs";
     license = licenses.gpl3;
diff --git a/pkgs/tools/security/bitwarden_rs/vault.nix b/pkgs/tools/security/bitwarden_rs/vault.nix
index 786ff578455..a6e238f9085 100644
--- a/pkgs/tools/security/bitwarden_rs/vault.nix
+++ b/pkgs/tools/security/bitwarden_rs/vault.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, nixosTests }:
+{ lib, stdenv, fetchurl, nixosTests }:
 
 stdenv.mkDerivation rec {
   pname = "bitwarden_rs-vault";
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   passthru.tests = nixosTests.bitwarden;
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Integrates the web vault into bitwarden_rs";
     homepage = "https://github.com/dani-garcia/bw_web_builds";
     platforms = platforms.all;
diff --git a/pkgs/tools/security/bmrsa/11.nix b/pkgs/tools/security/bmrsa/11.nix
index c7d4c4d0174..c8188fe4216 100644
--- a/pkgs/tools/security/bmrsa/11.nix
+++ b/pkgs/tools/security/bmrsa/11.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, unzip }:
+{ lib, stdenv, fetchurl, unzip }:
 
 stdenv.mkDerivation rec {
   pname = "bmrsa";
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
     echo -e 'install:\n\tcp bmrsa '$out'/bin' >> Makefile
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "RSA utility";
     homepage = "http://bmrsa.sourceforge.net/";
     license = licenses.gpl1;
diff --git a/pkgs/tools/security/bruteforce-luks/default.nix b/pkgs/tools/security/bruteforce-luks/default.nix
index cfa27a5c686..084368c105b 100644
--- a/pkgs/tools/security/bruteforce-luks/default.nix
+++ b/pkgs/tools/security/bruteforce-luks/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, autoreconfHook, cryptsetup }:
+{ lib, stdenv, fetchFromGitHub, autoreconfHook, cryptsetup }:
 
 stdenv.mkDerivation rec {
   pname = "bruteforce-luks";
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     inherit (src.meta) homepage;
     description = "Cracks passwords of LUKS encrypted volumes";
     longDescription = ''
diff --git a/pkgs/tools/security/brutespray/default.nix b/pkgs/tools/security/brutespray/default.nix
index 78dd789047d..69d8dbc9623 100644
--- a/pkgs/tools/security/brutespray/default.nix
+++ b/pkgs/tools/security/brutespray/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, python3, fetchFromGitHub, makeWrapper, medusa }:
+{ lib, stdenv, python3, fetchFromGitHub, makeWrapper, medusa }:
 
 stdenv.mkDerivation rec {
   pname = "brutespray";
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
     cp -r wordlist/ $out/share/brutespray/wordlist
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "https://github.com/x90skysn3k/brutespray";
     description = "Brute-Forcing from Nmap output - Automatically attempts default creds on found services";
     license = licenses.mit;
diff --git a/pkgs/tools/security/ccid/default.nix b/pkgs/tools/security/ccid/default.nix
index b7f408e748f..1be561dae54 100644
--- a/pkgs/tools/security/ccid/default.nix
+++ b/pkgs/tools/security/ccid/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pcsclite, pkgconfig, libusb1, perl }:
+{ lib, stdenv, fetchurl, pcsclite, pkgconfig, libusb1, perl }:
 
 stdenv.mkDerivation rec {
   pname = "ccid";
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig perl ];
   buildInputs = [ pcsclite libusb1 ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "ccid drivers for pcsclite";
     homepage = "https://ccid.apdu.fr/";
     license = licenses.gpl2Plus;
diff --git a/pkgs/tools/security/certmgr/default.nix b/pkgs/tools/security/certmgr/default.nix
index be3f891cc8b..47848b25b43 100644
--- a/pkgs/tools/security/certmgr/default.nix
+++ b/pkgs/tools/security/certmgr/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoPackage, fetchFromGitHub, fetchpatch }:
+{ lib, stdenv, buildGoPackage, fetchFromGitHub, fetchpatch }:
 
 let
   generic = { patches ? [] }:
@@ -17,7 +17,7 @@ let
 
       inherit patches;
 
-      meta = with stdenv.lib; {
+      meta = with lib; {
         homepage = "https://cfssl.org/";
         description = "Cloudflare's certificate manager";
         platforms = platforms.linux;
diff --git a/pkgs/tools/security/certstrap/default.nix b/pkgs/tools/security/certstrap/default.nix
index 99ba5c9e29b..f0c756f54f9 100644
--- a/pkgs/tools/security/certstrap/default.nix
+++ b/pkgs/tools/security/certstrap/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoPackage, fetchFromGitHub }:
+{ lib, stdenv, buildGoPackage, fetchFromGitHub }:
 
 buildGoPackage rec {
   pname = "certstrap";
@@ -13,7 +13,7 @@ buildGoPackage rec {
     sha256 = "1ymchnn7c9g3pq7rw4lrwsd6z3wfjx90g7qgrw6r5hssl77mnscj";
   };
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     inherit (src.meta) homepage;
     description = "Tools to bootstrap CAs, certificate requests, and signed certificates";
     license = licenses.asl20;
diff --git a/pkgs/tools/security/cfssl/default.nix b/pkgs/tools/security/cfssl/default.nix
index d926aaca68f..835c5daa72c 100644
--- a/pkgs/tools/security/cfssl/default.nix
+++ b/pkgs/tools/security/cfssl/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub, go-rice }:
+{ lib, stdenv, buildGoModule, fetchFromGitHub, go-rice }:
 
 buildGoModule rec {
   pname = "cfssl";
@@ -40,7 +40,7 @@ buildGoModule rec {
       -X github.com/cloudflare/cfssl/cli/version.version=v${version}
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "https://cfssl.org/";
     description = "Cloudflare's PKI and TLS toolkit";
     license = licenses.bsd2;
diff --git a/pkgs/tools/security/chaps/default.nix b/pkgs/tools/security/chaps/default.nix
index decc9ba3126..0200fca8ff3 100644
--- a/pkgs/tools/security/chaps/default.nix
+++ b/pkgs/tools/security/chaps/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitiles, fetchFromGitHub, fetchurl, trousers, leveldb, unzip
+{ lib, stdenv, fetchFromGitiles, fetchFromGitHub, fetchurl, trousers, leveldb, unzip
 , scons, pkgconfig, glib, dbus_cplusplus, dbus, protobuf, openssl, snappy, pam
 }:
 
@@ -80,7 +80,7 @@ stdenv.mkDerivation rec {
     cp ${name}/man/* $out/usr/share/man/man8/.
     '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "PKCS #11 implementation based on trusted platform module (TPM)";
     homepage = "https://www.chromium.org/developers/design-documents/chaps-technical-design";
     maintainers = [ maintainers.tstrobel ];
diff --git a/pkgs/tools/security/chipsec/default.nix b/pkgs/tools/security/chipsec/default.nix
index 0f162347cc8..45d6349af40 100644
--- a/pkgs/tools/security/chipsec/default.nix
+++ b/pkgs/tools/security/chipsec/default.nix
@@ -25,7 +25,7 @@ pythonPackages.buildPythonApplication rec {
 
   KERNEL_SRC_DIR = lib.optionalString withDriver "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Platform Security Assessment Framework";
     longDescription = ''
       CHIPSEC is a framework for analyzing the security of PC platforms
diff --git a/pkgs/tools/security/chkrootkit/default.nix b/pkgs/tools/security/chkrootkit/default.nix
index 864d73aaa97..5753784542d 100644
--- a/pkgs/tools/security/chkrootkit/default.nix
+++ b/pkgs/tools/security/chkrootkit/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl }:
+{ lib, stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
   name = "chkrootkit-0.53";
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     cp check_wtmpx chkdirs chklastlog chkproc chkrootkit chkutmp chkwtmp ifpromisc strings-static $out/sbin
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Locally checks for signs of a rootkit";
     homepage = "http://www.chkrootkit.org/";
     license = licenses.bsd2;
diff --git a/pkgs/tools/security/chntpw/default.nix b/pkgs/tools/security/chntpw/default.nix
index 0a44c463eb7..d0b75bdd42b 100644
--- a/pkgs/tools/security/chntpw/default.nix
+++ b/pkgs/tools/security/chntpw/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, unzip }:
+{ lib, stdenv, fetchurl, unzip }:
 
 stdenv.mkDerivation rec {
   pname = "chntpw";
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     make install PREFIX=$out
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "http://pogostick.net/~pnh/ntpasswd/";
     description = "An utility to reset the password of any user that has a valid local account on a Windows system";
     maintainers = with stdenv.lib.maintainers; [ deepfire ];
diff --git a/pkgs/tools/security/chrome-token-signing/default.nix b/pkgs/tools/security/chrome-token-signing/default.nix
index 0065758e1c3..134f916f043 100644
--- a/pkgs/tools/security/chrome-token-signing/default.nix
+++ b/pkgs/tools/security/chrome-token-signing/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, mkDerivation, fetchFromGitHub, qmake, pcsclite, pkgconfig, opensc }:
+{ lib, stdenv, mkDerivation, fetchFromGitHub, qmake, pcsclite, pkgconfig, opensc }:
 
 mkDerivation rec {
   pname = "chrome-token-signing";
@@ -28,7 +28,7 @@ mkDerivation rec {
     install -D -t $out/lib/mozilla/native-messaging-hosts host-linux/ff/ee.ria.esteid.json
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Chrome and Firefox extension for signing with your eID on the web";
     homepage = "https://github.com/open-eid/chrome-token-signing/wiki";
     license = licenses.lgpl21;
diff --git a/pkgs/tools/security/clamav/default.nix b/pkgs/tools/security/clamav/default.nix
index e3c57cbc9e9..4b3048223f7 100644
--- a/pkgs/tools/security/clamav/default.nix
+++ b/pkgs/tools/security/clamav/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkg-config
+{ lib, stdenv, fetchurl, pkg-config
 , zlib, bzip2, libiconv, libxml2, openssl, ncurses, curl, libmilter, pcre2
 , libmspack, systemd, Foundation, json_c, check
 }:
@@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
   hardeningDisable = [ "format" ];
   doCheck = true;
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "https://www.clamav.net";
     description = "Antivirus engine designed for detecting Trojans, viruses, malware and other malicious threats";
     license = licenses.gpl2;
diff --git a/pkgs/tools/security/cloudbrute/default.nix b/pkgs/tools/security/cloudbrute/default.nix
index 20f4a9a0d07..06f0dd413a5 100644
--- a/pkgs/tools/security/cloudbrute/default.nix
+++ b/pkgs/tools/security/cloudbrute/default.nix
@@ -1,6 +1,6 @@
 { buildGoModule
 , fetchFromGitHub
-, stdenv
+, lib, stdenv
 }:
 
 buildGoModule rec {
@@ -16,7 +16,7 @@ buildGoModule rec {
 
   vendorSha256 = "0f3n0wrmg9d2qyn8hlnhf9lsfqd9443myzr04p48v68m8n83j6a9";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Cloud enumeration tool";
     longDescription = ''
       A tool to find a company (target) infrastructure, files, and apps on
diff --git a/pkgs/tools/security/crackxls/default.nix b/pkgs/tools/security/crackxls/default.nix
index aff6bbd028a..33a219e8621 100644
--- a/pkgs/tools/security/crackxls/default.nix
+++ b/pkgs/tools/security/crackxls/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, pkgconfig, autoconf, automake, openssl, libgsf, gmp }:
+{ lib, stdenv, fetchFromGitHub, pkgconfig, autoconf, automake, openssl, libgsf, gmp }:
 
 stdenv.mkDerivation rec {
 
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     cp crackxls2003 $out/bin/
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "https://github.com/GavinSmith0123/crackxls2003/";
     description = "Used to break the encryption on old Microsoft Excel and Microsoft Word files";
     platforms = platforms.linux;
diff --git a/pkgs/tools/security/creddump/default.nix b/pkgs/tools/security/creddump/default.nix
index ffa2fd2311c..7a936408433 100644
--- a/pkgs/tools/security/creddump/default.nix
+++ b/pkgs/tools/security/creddump/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitLab, python2, python2Packages }:
+{ lib, stdenv, fetchFromGitLab, python2, python2Packages }:
 
 python2Packages.buildPythonApplication rec {
   pname = "creddump";
@@ -24,7 +24,7 @@ python2Packages.buildPythonApplication rec {
     cp lsadump.py ${placeholder "out"}/bin/lsadump
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Python tool to extract various credentials and secrets from Windows registry hives";
     homepage = "https://gitlab.com/kalilinux/packages/creddump";
     license = licenses.gpl3;
diff --git a/pkgs/tools/security/crowbar/default.nix b/pkgs/tools/security/crowbar/default.nix
index cd4e7db8718..2f197421e1f 100644
--- a/pkgs/tools/security/crowbar/default.nix
+++ b/pkgs/tools/security/crowbar/default.nix
@@ -3,7 +3,7 @@
 , nmap
 , openvpn
 , python3Packages
-, stdenv
+, lib, stdenv
 , tigervnc
 }:
 
@@ -33,7 +33,7 @@ python3Packages.buildPythonApplication rec {
     $out/bin/crowbar --help > /dev/null
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "https://github.com/galkan/crowbar";
     description = "A brute forcing tool that can be used during penetration tests";
     license = licenses.mit;
diff --git a/pkgs/tools/security/crunch/default.nix b/pkgs/tools/security/crunch/default.nix
index b53ead1c852..2422a2278bb 100644
--- a/pkgs/tools/security/crunch/default.nix
+++ b/pkgs/tools/security/crunch/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, which }:
+{ lib, stdenv, fetchurl, which }:
 
 stdenv.mkDerivation  rec {
   pname = "crunch";
@@ -20,7 +20,7 @@ stdenv.mkDerivation  rec {
 
   makeFlags = [ "PREFIX=$(out)" ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Wordlist generator";
     homepage = "https://sourceforge.net/projects/crunch-wordlist/";
     platforms = platforms.unix;
diff --git a/pkgs/tools/security/ctmg/default.nix b/pkgs/tools/security/ctmg/default.nix
index a30523c3bbc..b08af06825e 100644
--- a/pkgs/tools/security/ctmg/default.nix
+++ b/pkgs/tools/security/ctmg/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, stdenv, fetchzip }:
 
 stdenv.mkDerivation rec {
   pname = "ctmg";
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   installPhase = "install -D ctmg.sh $out/bin/ctmg";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "An encrypted container manager for Linux using cryptsetup";
     homepage = "https://git.zx2c4.com/ctmg/about/";
     license = licenses.isc;
diff --git a/pkgs/tools/security/deepsea/default.nix b/pkgs/tools/security/deepsea/default.nix
index 5cd7ed48aa3..855549bb0c8 100644
--- a/pkgs/tools/security/deepsea/default.nix
+++ b/pkgs/tools/security/deepsea/default.nix
@@ -1,6 +1,6 @@
 { buildGoModule
 , fetchFromGitHub
-, stdenv
+, lib, stdenv
 }:
 
 buildGoModule rec {
@@ -16,7 +16,7 @@ buildGoModule rec {
 
   vendorSha256 = "0vpkzykfg1rq4qi1v5lsa0drpil9i6ccfw96k48ppi9hiwzpq94w";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Phishing tool for red teams and pentesters";
     longDescription = ''
       DeepSea phishing gear aims to help RTOs and pentesters with the
diff --git a/pkgs/tools/security/dnsenum/default.nix b/pkgs/tools/security/dnsenum/default.nix
index 3374c827d75..a24fc96621f 100644
--- a/pkgs/tools/security/dnsenum/default.nix
+++ b/pkgs/tools/security/dnsenum/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, makeWrapper, perl, perlPackages }:
+{ lib, stdenv, fetchFromGitHub, makeWrapper, perl, perlPackages }:
 
 stdenv.mkDerivation rec {
   pname = "dnsenum";
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     install -vD dns.txt -t $out/share
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "https://github.com/fwaeytens/dnsenum";
     description = "A tool to enumerate DNS information";
     maintainers = with maintainers; [ c0bw3b ];
diff --git a/pkgs/tools/security/dnsrecon/default.nix b/pkgs/tools/security/dnsrecon/default.nix
index 2575636aeca..65b18c5c822 100644
--- a/pkgs/tools/security/dnsrecon/default.nix
+++ b/pkgs/tools/security/dnsrecon/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, python3 }:
+{ lib, stdenv, fetchFromGitHub, python3 }:
 
 python3.pkgs.buildPythonApplication rec {
   pname = "dnsrecon";
@@ -34,7 +34,7 @@ python3.pkgs.buildPythonApplication rec {
     runHook postInstall
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "DNS Enumeration Script";
     homepage = "https://github.com/darkoperator/dnsrecon";
     license = licenses.gpl2;
diff --git a/pkgs/tools/security/dnsx/default.nix b/pkgs/tools/security/dnsx/default.nix
index 21bf7d4664c..1a82467201d 100644
--- a/pkgs/tools/security/dnsx/default.nix
+++ b/pkgs/tools/security/dnsx/default.nix
@@ -1,6 +1,6 @@
 { buildGoModule
 , fetchFromGitHub
-, stdenv
+, lib, stdenv
 }:
 
 buildGoModule rec {
@@ -16,7 +16,7 @@ buildGoModule rec {
 
   vendorSha256 = "0j2cqvskzxbyfrvsv4gm4qwfjm0digizcg157z5iignnknddajax";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Fast and multi-purpose DNS toolkit";
     longDescription = ''
       dnsx is a fast and multi-purpose DNS toolkit allow to run multiple
diff --git a/pkgs/tools/security/doona/default.nix b/pkgs/tools/security/doona/default.nix
index 5e1233f308c..e0f459ad745 100644
--- a/pkgs/tools/security/doona/default.nix
+++ b/pkgs/tools/security/doona/default.nix
@@ -1,5 +1,5 @@
 { fetchFromGitHub
-, stdenv
+, lib, stdenv
 , perl
 }:
 
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     chmod +x $out/bin/doona
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "https://github.com/wireghoul/doona";
     description = "A fork of the Bruteforce Exploit Detector Tool (BED)";
     longDescription = ''
diff --git a/pkgs/tools/security/ecdsatool/default.nix b/pkgs/tools/security/ecdsatool/default.nix
index b1a86fe7e64..0498b758c1d 100644
--- a/pkgs/tools/security/ecdsatool/default.nix
+++ b/pkgs/tools/security/ecdsatool/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, pkgs }:
+{ lib, stdenv, pkgs }:
 
 stdenv.mkDerivation {
   version = "0.0.1";
@@ -19,7 +19,7 @@ stdenv.mkDerivation {
   nativeBuildInputs = with pkgs; [openssl autoconf automake];
   buildInputs = with pkgs; [libuecc];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Create and manipulate ECC NISTP256 keypairs";
     homepage = "https://github.com/kaniini/ecdsatool/";
     license = with licenses; [free];
diff --git a/pkgs/tools/security/ecdsautils/default.nix b/pkgs/tools/security/ecdsautils/default.nix
index f5ead317f4e..adf1a74f42a 100644
--- a/pkgs/tools/security/ecdsautils/default.nix
+++ b/pkgs/tools/security/ecdsautils/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, pkgs }:
+{ lib, stdenv, pkgs }:
 
 stdenv.mkDerivation {
   version = "0.4.0";
@@ -14,7 +14,7 @@ stdenv.mkDerivation {
   nativeBuildInputs = with pkgs; [ cmake pkgconfig doxygen ];
   buildInputs = with pkgs; [ libuecc  ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Tiny collection of programs used for ECDSA (keygen, sign, verify)";
     homepage = "https://github.com/tcatm/ecdsautils/";
     license = with licenses; [ mit bsd2 ];
diff --git a/pkgs/tools/security/ecryptfs/default.nix b/pkgs/tools/security/ecryptfs/default.nix
index 1a8329885ba..dbec36cb12b 100644
--- a/pkgs/tools/security/ecryptfs/default.nix
+++ b/pkgs/tools/security/ecryptfs/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, perl, util-linux, keyutils, nss, nspr, python2, pam, enablePython ? false
+{ lib, stdenv, fetchurl, pkgconfig, perl, util-linux, keyutils, nss, nspr, python2, pam, enablePython ? false
 , intltool, makeWrapper, coreutils, bash, gettext, cryptsetup, lvm2, rsync, which, lsof }:
 
 stdenv.mkDerivation rec {
@@ -58,7 +58,7 @@ stdenv.mkDerivation rec {
     done
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Enterprise-class stacked cryptographic filesystem";
     license     = licenses.gpl2Plus;
     maintainers = with maintainers; [ obadz ];
diff --git a/pkgs/tools/security/ecryptfs/helper.nix b/pkgs/tools/security/ecryptfs/helper.nix
index fcb8d091d93..ecd12a2738d 100644
--- a/pkgs/tools/security/ecryptfs/helper.nix
+++ b/pkgs/tools/security/ecryptfs/helper.nix
@@ -1,4 +1,4 @@
-{ stdenv
+{ lib, stdenv
 , fetchurl
 , makeWrapper
 , python2
@@ -24,7 +24,7 @@ stdenv.mkDerivation {
     makeWrapper "${python2.interpreter}" "$out/bin/ecryptfs-helper" --add-flags "$out/libexec/ecryptfs-helper.py"
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description    = "Helper script to create/mount/unemount encrypted directories using eCryptfs without needing root permissions";
     license        = licenses.gpl2Plus;
     maintainers    = with maintainers; [ obadz ];
diff --git a/pkgs/tools/security/efitools/default.nix b/pkgs/tools/security/efitools/default.nix
index 33b6c3b672d..60bb3627cc9 100644
--- a/pkgs/tools/security/efitools/default.nix
+++ b/pkgs/tools/security/efitools/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, gnu-efi, openssl, sbsigntool, perl, perlPackages,
+{ lib, stdenv, gnu-efi, openssl, sbsigntool, perl, perlPackages,
 help2man, fetchgit }:
 stdenv.mkDerivation rec {
   pname = "efitools";
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     patchShebangs .
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Tools for manipulating UEFI secure boot platforms";
     homepage = "https://git.kernel.org/cgit/linux/kernel/git/jejb/efitools.git";
     license = licenses.gpl2;
diff --git a/pkgs/tools/security/eid-mw/default.nix b/pkgs/tools/security/eid-mw/default.nix
index a55c1d8db66..116add24314 100644
--- a/pkgs/tools/security/eid-mw/default.nix
+++ b/pkgs/tools/security/eid-mw/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub
+{ lib, stdenv, fetchFromGitHub
 , autoreconfHook, pkgconfig
 , gtk3, nssTools, pcsclite
 , libxml2, libproxy
@@ -56,7 +56,7 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Belgian electronic identity card (eID) middleware";
     homepage = "https://eid.belgium.be/en/using_your_eid/installing_the_eid_software/linux/";
     license = licenses.lgpl3;
diff --git a/pkgs/tools/security/encryptr/default.nix b/pkgs/tools/security/encryptr/default.nix
index 62311a41da3..0cbfd79296d 100644
--- a/pkgs/tools/security/encryptr/default.nix
+++ b/pkgs/tools/security/encryptr/default.nix
@@ -47,7 +47,7 @@ in stdenv.mkDerivation rec {
   # its application and shows a generic page
   dontStrip = true;
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "https://spideroak.com/solutions/encryptr";
     description = "Free, private and secure password management tool and e-wallet";
     license = licenses.unfree;
diff --git a/pkgs/tools/security/enpass/default.nix b/pkgs/tools/security/enpass/default.nix
index be2e5b06246..3b25dd58b34 100644
--- a/pkgs/tools/security/enpass/default.nix
+++ b/pkgs/tools/security/enpass/default.nix
@@ -51,7 +51,7 @@ let
       url = "${baseUrl}/${data.path}";
     };
 
-    meta = with stdenv.lib; {
+    meta = with lib; {
       description = "A well known password manager";
       homepage = "https://www.enpass.io/";
       license = licenses.unfree;
diff --git a/pkgs/tools/security/enum4linux/default.nix b/pkgs/tools/security/enum4linux/default.nix
index 9a7d1861d9b..4fe567d1ed0 100644
--- a/pkgs/tools/security/enum4linux/default.nix
+++ b/pkgs/tools/security/enum4linux/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, makeWrapper, samba, perl, openldap }:
+{ lib, stdenv, fetchurl, makeWrapper, samba, perl, openldap }:
 
 stdenv.mkDerivation rec {
   pname = "enum4linux";
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
       --prefix PATH : ${stdenv.lib.makeBinPath [ samba openldap ]}
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A tool for enumerating information from Windows and Samba systems";
     homepage = "https://labs.portcullis.co.uk/tools/enum4linux/";
     license = licenses.gpl2;
diff --git a/pkgs/tools/security/eschalot/default.nix b/pkgs/tools/security/eschalot/default.nix
index 28df3a28442..04675061615 100644
--- a/pkgs/tools/security/eschalot/default.nix
+++ b/pkgs/tools/security/eschalot/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, openssl }:
+{ lib, stdenv, fetchFromGitHub, openssl }:
 
 stdenv.mkDerivation rec {
   pname = "eschalot";
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     install -D -t $out/bin eschalot worgen
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Tor hidden service name generator";
     homepage = src.meta.homepage;
     license = licenses.isc;
diff --git a/pkgs/tools/security/fail2ban/default.nix b/pkgs/tools/security/fail2ban/default.nix
index c27f82d7053..45bea0ae99f 100644
--- a/pkgs/tools/security/fail2ban/default.nix
+++ b/pkgs/tools/security/fail2ban/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, python3 }:
+{ lib, stdenv, fetchFromGitHub, python3 }:
 
 let version = "0.11.1"; in
 
@@ -49,7 +49,7 @@ python3.pkgs.buildPythonApplication {
     rm -rf ${sitePackages}/etc ${sitePackages}/usr ${sitePackages}/var;
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage    = "https://www.fail2ban.org/";
     description = "A program that scans log files for repeated failing login attempts and bans IP addresses";
     license     = licenses.gpl2Plus;
diff --git a/pkgs/tools/security/fcrackzip/default.nix b/pkgs/tools/security/fcrackzip/default.nix
index 15510f7b709..31d0b44fb71 100644
--- a/pkgs/tools/security/fcrackzip/default.nix
+++ b/pkgs/tools/security/fcrackzip/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchurl}:
+{lib, stdenv, fetchurl}:
 
 stdenv.mkDerivation rec {
   pname = "fcrackzip";
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   # Do not clash with unizp/zipinfo
   postInstall = "mv $out/bin/zipinfo $out/bin/fcrackzip-zipinfo";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "zip password cracker, similar to fzc, zipcrack and others";
     homepage = "http://oldhome.schmorp.de/marc/fcrackzip.html";
     license = licenses.gpl2;
diff --git a/pkgs/tools/security/ffuf/default.nix b/pkgs/tools/security/ffuf/default.nix
index 77a286df4c6..084601a4122 100644
--- a/pkgs/tools/security/ffuf/default.nix
+++ b/pkgs/tools/security/ffuf/default.nix
@@ -1,6 +1,6 @@
 { buildGoModule
 , fetchFromGitHub
-, stdenv
+, lib, stdenv
 }:
 
 buildGoModule rec {
@@ -20,7 +20,7 @@ buildGoModule rec {
   # https://github.com/ffuf/ffuf/issues/367
   doCheck = false;
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Fast web fuzzer written in Go";
     longDescription = ''
       FFUF, or “Fuzz Faster you Fool” is an open source web fuzzing tool,
diff --git a/pkgs/tools/security/fido2luks/default.nix b/pkgs/tools/security/fido2luks/default.nix
index d2a5d91467a..e0dcdadb7b0 100644
--- a/pkgs/tools/security/fido2luks/default.nix
+++ b/pkgs/tools/security/fido2luks/default.nix
@@ -1,4 +1,4 @@
-{ stdenv
+{ lib, stdenv
 , rustPlatform
 , fetchFromGitHub
 , cryptsetup
@@ -27,7 +27,7 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "19drjql13z8bw257z10kjppxm25jlfgrpc9g1jf68ka5j2b3nx7k";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Decrypt your LUKS partition using a FIDO2 compatible authenticator";
     homepage = "https://github.com/shimunn/fido2luks";
     license = licenses.gpl3;
diff --git a/pkgs/tools/security/fierce/default.nix b/pkgs/tools/security/fierce/default.nix
index 13146c3373e..3d6472cbb44 100644
--- a/pkgs/tools/security/fierce/default.nix
+++ b/pkgs/tools/security/fierce/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, python3 }:
+{ lib, stdenv, fetchFromGitHub, python3 }:
 
 python3.pkgs.buildPythonApplication rec {
   pname = "fierce";
@@ -21,7 +21,7 @@ python3.pkgs.buildPythonApplication rec {
   doCheck = false;
   pythonImportsCheck = [ "fierce" ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "https://github.com/mschwager/fierce";
     description = "DNS reconnaissance tool for locating non-contiguous IP space";
     license = licenses.gpl3Plus;
diff --git a/pkgs/tools/security/fprintd/default.nix b/pkgs/tools/security/fprintd/default.nix
index b14aff386ab..368f49d944d 100644
--- a/pkgs/tools/security/fprintd/default.nix
+++ b/pkgs/tools/security/fprintd/default.nix
@@ -1,4 +1,4 @@
-{ stdenv
+{ lib, stdenv
 , fetchFromGitLab
 , fetchpatch
 , pkgconfig
@@ -106,7 +106,7 @@ stdenv.mkDerivation rec {
     patchShebangs po/check-translations.sh
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "https://fprint.freedesktop.org/";
     description = "D-Bus daemon that offers libfprint functionality over the D-Bus interprocess communication bus";
     license = licenses.gpl2;
diff --git a/pkgs/tools/security/fprot/default.nix b/pkgs/tools/security/fprot/default.nix
index 12b47694db3..22779327a9b 100644
--- a/pkgs/tools/security/fprot/default.nix
+++ b/pkgs/tools/security/fprot/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl }:
+{ lib, stdenv, fetchurl }:
 
 stdenv.mkDerivation {
 
@@ -32,7 +32,7 @@ stdenv.mkDerivation {
     cp doc/man/fpupdate.8 $out/share/man/man8
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "http://www.f-prot.com";
     description = "A popular proprietary antivirus program";
     license = licenses.unfree;
diff --git a/pkgs/tools/security/fwknop/default.nix b/pkgs/tools/security/fwknop/default.nix
index 0f1c37aa797..d3787f834d0 100644
--- a/pkgs/tools/security/fwknop/default.nix
+++ b/pkgs/tools/security/fwknop/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, autoreconfHook
+{ lib, stdenv, fetchFromGitHub, autoreconfHook
 , libpcap, texinfo
 , iptables
 , gnupgSupport ? true, gnupg, gpgme # Increases dependencies!
@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
       "wknopddir = $out/etc/fwknop"
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description =
       "Single Packet Authorization (and Port Knocking) server/client";
     longDescription = ''
diff --git a/pkgs/tools/security/gau/default.nix b/pkgs/tools/security/gau/default.nix
index cfbae951526..98045a107e5 100644
--- a/pkgs/tools/security/gau/default.nix
+++ b/pkgs/tools/security/gau/default.nix
@@ -1,6 +1,6 @@
 { buildGoModule
 , fetchFromGitHub
-, stdenv
+, lib, stdenv
 }:
 
 buildGoModule rec {
@@ -16,7 +16,7 @@ buildGoModule rec {
 
   vendorSha256 = "17ag2wvaxv2dyx3yx3fvlf36ww4a44660pn4gvpbrwacsan9as5s";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Tool to fetch known URLs";
     longDescription = ''
       getallurls (gau) fetches known URLs from various sources for any
diff --git a/pkgs/tools/security/gen-oath-safe/default.nix b/pkgs/tools/security/gen-oath-safe/default.nix
index 68536a519aa..670b9631f21 100644
--- a/pkgs/tools/security/gen-oath-safe/default.nix
+++ b/pkgs/tools/security/gen-oath-safe/default.nix
@@ -1,4 +1,4 @@
-{ coreutils, fetchFromGitHub, file, libcaca, makeWrapper, python, openssl, qrencode, stdenv, yubikey-manager }:
+{ coreutils, fetchFromGitHub, file, libcaca, makeWrapper, python, openssl, qrencode, lib, stdenv, yubikey-manager }:
 
 stdenv.mkDerivation rec {
   pname = "gen-oath-safe";
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
       wrapProgram $out/bin/gen-oath-safe \
         --prefix PATH : ${path}
     '';
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "https://github.com/mcepl/gen-oath-safe";
     description = "Script for generating HOTP/TOTP keys (and QR code)";
     platforms =  platforms.unix;
diff --git a/pkgs/tools/security/gencfsm/default.nix b/pkgs/tools/security/gencfsm/default.nix
index e56c9e20fd4..a41c995ab40 100644
--- a/pkgs/tools/security/gencfsm/default.nix
+++ b/pkgs/tools/security/gencfsm/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, autoconf, automake, intltool, libtool, pkgconfig, encfs
+{ lib, stdenv, fetchurl, autoconf, automake, intltool, libtool, pkgconfig, encfs
 , glib , gnome3, gtk3, libgnome-keyring, vala, wrapGAppsHook, xorg, gobject-introspection
 }:
 
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "http://www.libertyzero.com/GEncfsM/";
     downloadPage = "https://launchpad.net/gencfsm/";
     description = "EncFS manager and mounter with GNOME3 integration";
diff --git a/pkgs/tools/security/genpass/default.nix b/pkgs/tools/security/genpass/default.nix
index 6818af194b3..88d6604be83 100644
--- a/pkgs/tools/security/genpass/default.nix
+++ b/pkgs/tools/security/genpass/default.nix
@@ -1,4 +1,4 @@
-{ stdenv
+{ lib, stdenv
 , fetchgit
 , rustPlatform
 , CoreFoundation
@@ -19,7 +19,7 @@ rustPlatform.buildRustPackage rec {
 
   buildInputs = stdenv.lib.optionals stdenv.isDarwin [ CoreFoundation libiconv Security ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A simple yet robust commandline random password generator";
     homepage = "https://sr.ht/~cyplo/genpass/";
     license = licenses.agpl3;
diff --git a/pkgs/tools/security/gnome-keysign/default.nix b/pkgs/tools/security/gnome-keysign/default.nix
index 4b9a6fb0e32..db0e88a805b 100644
--- a/pkgs/tools/security/gnome-keysign/default.nix
+++ b/pkgs/tools/security/gnome-keysign/default.nix
@@ -1,4 +1,4 @@
-{ stdenv
+{ lib, stdenv
 , fetchFromGitLab
 , fetchpatch
 , python3
@@ -73,7 +73,7 @@ python3.pkgs.buildPythonApplication rec {
   # bunch of linting
   doCheck = false;
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "GTK/GNOME application to use GnuPG for signing other peoples’ keys";
     homepage = "https://wiki.gnome.org/Apps/Keysign";
     license = licenses.gpl3Plus;
diff --git a/pkgs/tools/security/gnupg-pkcs11-scd/default.nix b/pkgs/tools/security/gnupg-pkcs11-scd/default.nix
index 04af88e3335..eb0553ed083 100644
--- a/pkgs/tools/security/gnupg-pkcs11-scd/default.nix
+++ b/pkgs/tools/security/gnupg-pkcs11-scd/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, libgpgerror, libassuan, libgcrypt, pkcs11helper,
+{ lib, stdenv, fetchurl, libgpgerror, libassuan, libgcrypt, pkcs11helper,
   pkgconfig, openssl }:
 
 stdenv.mkDerivation rec {
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     "--with-libgcrypt-prefix=${libgcrypt.dev}"
   ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A smart-card daemon to enable the use of PKCS#11 tokens with GnuPG";
     longDescription = ''
     gnupg-pkcs11 is a project to implement a BSD-licensed smart-card
diff --git a/pkgs/tools/security/gnupg/1.nix b/pkgs/tools/security/gnupg/1.nix
index 20ecd7c92fb..66b05384c6b 100644
--- a/pkgs/tools/security/gnupg/1.nix
+++ b/pkgs/tools/security/gnupg/1.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, readline, bzip2 }:
+{ lib, stdenv, fetchurl, readline, bzip2 }:
 
 stdenv.mkDerivation rec {
   name = "gnupg-1.4.23";
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "https://gnupg.org";
     description = "Classic (1.4) release of the GNU Privacy Guard, a GPL OpenPGP implementation";
     license = licenses.gpl3Plus;
diff --git a/pkgs/tools/security/gnupg/22.nix b/pkgs/tools/security/gnupg/22.nix
index c2861574c2b..94e62c03ad3 100644
--- a/pkgs/tools/security/gnupg/22.nix
+++ b/pkgs/tools/security/gnupg/22.nix
@@ -1,4 +1,4 @@
-{ fetchurl, fetchpatch, stdenv, pkgconfig, libgcrypt, libassuan, libksba
+{ fetchurl, fetchpatch, lib, stdenv, pkgconfig, libgcrypt, libassuan, libksba
 , libgpgerror, libiconv, npth, gettext, texinfo, buildPackages
 
 # Each of the dependencies below are optional.
@@ -76,7 +76,7 @@ stdenv.mkDerivation rec {
     ln -s -t $out/bin $out/libexec/*
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "https://gnupg.org";
     description = "Modern (2.1) release of the GNU Privacy Guard, a GPL OpenPGP implementation";
     license = licenses.gpl3Plus;
diff --git a/pkgs/tools/security/gopass/default.nix b/pkgs/tools/security/gopass/default.nix
index ff855cce240..943bebf41c7 100644
--- a/pkgs/tools/security/gopass/default.nix
+++ b/pkgs/tools/security/gopass/default.nix
@@ -1,4 +1,4 @@
-{ stdenv
+{ lib, stdenv
 , makeWrapper
 , buildGoModule
 , fetchFromGitHub
@@ -55,7 +55,7 @@ buildGoModule rec {
     done
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "The slightly more awesome Standard Unix Password Manager for Teams. Written in Go";
     homepage = "https://www.gopass.pw/";
     license = licenses.mit;
diff --git a/pkgs/tools/security/gospider/default.nix b/pkgs/tools/security/gospider/default.nix
index b7c94c94023..ef3184a0422 100644
--- a/pkgs/tools/security/gospider/default.nix
+++ b/pkgs/tools/security/gospider/default.nix
@@ -1,6 +1,6 @@
 { buildGoModule
 , fetchFromGitHub
-, stdenv
+, lib, stdenv
 }:
 
 buildGoModule rec {
@@ -19,7 +19,7 @@ buildGoModule rec {
   # tests require internet access and API keys
   doCheck = false;
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Fast web spider written in Go";
     longDescription = ''
       GoSpider is a fast web crawler that parses sitemap.xml and robots.txt file.
diff --git a/pkgs/tools/security/gpgstats/default.nix b/pkgs/tools/security/gpgstats/default.nix
index 80153b857c4..c9a178cff42 100644
--- a/pkgs/tools/security/gpgstats/default.nix
+++ b/pkgs/tools/security/gpgstats/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, ncurses, gpgme }:
+{ lib, stdenv, fetchurl, ncurses, gpgme }:
 
 stdenv.mkDerivation rec {
   pname = "gpgstats";
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
   NIX_CFLAGS_COMPILE = stdenv.lib.optionalString (!stdenv.is64bit)
     "-D_FILE_OFFSET_BITS=64 -DLARGEFILE_SOURCE=1";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Calculates statistics on the keys in your gpg key-ring";
     longDescription = ''
     GPGstats calculates statistics on the keys in your key-ring.
diff --git a/pkgs/tools/security/grype/default.nix b/pkgs/tools/security/grype/default.nix
index 9786fd41663..49530213985 100644
--- a/pkgs/tools/security/grype/default.nix
+++ b/pkgs/tools/security/grype/default.nix
@@ -1,7 +1,7 @@
 { buildGoModule
 , docker
 , fetchFromGitHub
-, stdenv
+, lib, stdenv
 }:
 
 buildGoModule rec {
@@ -22,7 +22,7 @@ buildGoModule rec {
   # tests require a running Docker instance
   doCheck = false;
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Vulnerability scanner for container images and filesystems";
     longDescription = ''
       As a vulnerability scanner is grype abale to scan the contents of a container
diff --git a/pkgs/tools/security/hash_extender/default.nix b/pkgs/tools/security/hash_extender/default.nix
index dc8ea8b2c9b..5baeb71ce89 100644
--- a/pkgs/tools/security/hash_extender/default.nix
+++ b/pkgs/tools/security/hash_extender/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, openssl }:
+{ lib, stdenv, fetchFromGitHub, openssl }:
 
 stdenv.mkDerivation {
   pname = "hash_extender";
@@ -21,7 +21,7 @@ stdenv.mkDerivation {
     cp hash_extender $out/bin
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Tool to automate hash length extension attacks";
     homepage = "https://github.com/iagox86/hash_extender";
     license = licenses.bsd3;
diff --git a/pkgs/tools/security/hashcash/default.nix b/pkgs/tools/security/hashcash/default.nix
index bb8fba33e1d..b13425b7205 100644
--- a/pkgs/tools/security/hashcash/default.nix
+++ b/pkgs/tools/security/hashcash/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, openssl }:
+{ lib, stdenv, fetchurl, openssl }:
 
 stdenv.mkDerivation rec {
   pname = "hashcash";
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     "DOC_INSTALL_PATH=${placeholder "out"}/share/doc/hashcash-$(version)"
   ];
   
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Proof-of-work algorithm used as spam and denial-of-service counter measure";
     homepage = "http://hashcash.org";
     license = licenses.gpl2;
diff --git a/pkgs/tools/security/hashcat-utils/default.nix b/pkgs/tools/security/hashcat-utils/default.nix
index 7dcfff038a8..8b91a53db01 100644
--- a/pkgs/tools/security/hashcat-utils/default.nix
+++ b/pkgs/tools/security/hashcat-utils/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub }:
+{ lib, stdenv, fetchFromGitHub }:
 
 stdenv.mkDerivation rec {
   pname = "hashcat-utils";
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Small utilities that are useful in advanced password cracking";
     homepage = "https://github.com/hashcat/hashcat-utils";
     license = licenses.mit;
diff --git a/pkgs/tools/security/hashcat/default.nix b/pkgs/tools/security/hashcat/default.nix
index b156cda99ac..20b5aed3932 100644
--- a/pkgs/tools/security/hashcat/default.nix
+++ b/pkgs/tools/security/hashcat/default.nix
@@ -1,4 +1,4 @@
-{ stdenv
+{ lib, stdenv
 , fetchurl
 , makeWrapper
 , opencl-headers
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     wrapProgram $out/bin/hashcat --prefix LD_LIBRARY_PATH : ${ocl-icd}/lib
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Fast password cracker";
     homepage    = "https://hashcat.net/hashcat/";
     license     = licenses.mit;
diff --git a/pkgs/tools/security/hashdeep/default.nix b/pkgs/tools/security/hashdeep/default.nix
index 4ad656462b1..2f0a40dfc5e 100644
--- a/pkgs/tools/security/hashdeep/default.nix
+++ b/pkgs/tools/security/hashdeep/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, autoreconfHook }:
+{ lib, stdenv, fetchFromGitHub, autoreconfHook }:
 
 let version = "4.4";
 in stdenv.mkDerivation {
@@ -13,7 +13,7 @@ in stdenv.mkDerivation {
 
   nativeBuildInputs = [ autoreconfHook ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A set of cross-platform tools to compute hashes";
     homepage = "https://github.com/jessek/hashdeep";
     license = licenses.gpl2;
diff --git a/pkgs/tools/security/hcxdumptool/default.nix b/pkgs/tools/security/hcxdumptool/default.nix
index afc08d88a59..082ebac7f6f 100644
--- a/pkgs/tools/security/hcxdumptool/default.nix
+++ b/pkgs/tools/security/hcxdumptool/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   installFlags = [ "PREFIX=$(out)" ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "https://github.com/ZerBea/hcxdumptool";
     description = "Small tool to capture packets from wlan devices";
     license = licenses.mit;
diff --git a/pkgs/tools/security/hcxtools/default.nix b/pkgs/tools/security/hcxtools/default.nix
index a81c1ef75cf..a1ba32b35ed 100644
--- a/pkgs/tools/security/hcxtools/default.nix
+++ b/pkgs/tools/security/hcxtools/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, curl, openssl, zlib }:
+{ lib, stdenv, fetchFromGitHub, curl, openssl, zlib }:
 
 stdenv.mkDerivation rec {
   pname = "hcxtools";
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     "PREFIX=${placeholder "out"}"
   ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Tools for capturing wlan traffic and conversion to hashcat and John the Ripper formats";
     homepage = "https://github.com/ZerBea/hcxtools";
     license = licenses.mit;
diff --git a/pkgs/tools/security/hologram/default.nix b/pkgs/tools/security/hologram/default.nix
index 9a8722ac263..6ec4d7776e1 100644
--- a/pkgs/tools/security/hologram/default.nix
+++ b/pkgs/tools/security/hologram/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoPackage, fetchFromGitHub }:
+{ lib, stdenv, buildGoPackage, fetchFromGitHub }:
 
 buildGoPackage rec {
   name = "hologram-2018-03-19";
@@ -17,7 +17,7 @@ buildGoPackage rec {
     sed -i 's|cacheTimeout != 3600|cacheTimeout != 0|' cmd/hologram-server/main.go
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "https://github.com/AdRoll/hologram/";
     description = "Easy, painless AWS credentials on developer laptops";
     maintainers = with maintainers; [ nand0p ];
diff --git a/pkgs/tools/security/httpx/default.nix b/pkgs/tools/security/httpx/default.nix
index c7d83075e9d..7135baab375 100644
--- a/pkgs/tools/security/httpx/default.nix
+++ b/pkgs/tools/security/httpx/default.nix
@@ -1,6 +1,6 @@
 { buildGoModule
 , fetchFromGitHub
-, stdenv
+, lib, stdenv
 }:
 
 buildGoModule rec {
@@ -16,7 +16,7 @@ buildGoModule rec {
 
   vendorSha256 = "0fg93vhwpx113fpw8qg4ram4bdh6a8x3a36pr1c962s4vhrabwy2";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Fast and multi-purpose HTTP toolkit";
     longDescription = ''
       httpx is a fast and multi-purpose HTTP toolkit allow to run multiple
diff --git a/pkgs/tools/security/ifdnfc/default.nix b/pkgs/tools/security/ifdnfc/default.nix
index bab6527f415..648774c5867 100644
--- a/pkgs/tools/security/ifdnfc/default.nix
+++ b/pkgs/tools/security/ifdnfc/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub , pkgconfig
+{ lib, stdenv, fetchFromGitHub , pkgconfig
 , pcsclite
 , autoreconfHook
 , libnfc
@@ -20,7 +20,7 @@ stdenv.mkDerivation {
   configureFlags = [ "--prefix=$(out)" ];
   makeFlags = [ "DESTDIR=/" "usbdropdir=$(out)/pcsc/drivers" ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "PC/SC IFD Handler based on libnfc";
     longDescription =
     '' libnfc Interface Plugin to be used in <code>services.pcscd.plugins</code>.
diff --git a/pkgs/tools/security/ipscan/default.nix b/pkgs/tools/security/ipscan/default.nix
index 4963f577487..8440b0b6ec9 100644
--- a/pkgs/tools/security/ipscan/default.nix
+++ b/pkgs/tools/security/ipscan/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, jdk, jre, swt, makeWrapper, xorg, dpkg }:
+{ lib, stdenv, fetchurl, jdk, jre, swt, makeWrapper, xorg, dpkg }:
 
 stdenv.mkDerivation rec {
   pname = "ipscan";
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     cp usr/share/pixmaps/ipscan.png $out/share/pixmaps/ipscan.png
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Fast and friendly network scanner";
     homepage = "https://angryip.org";
     license = licenses.gpl2;
diff --git a/pkgs/tools/security/jadx/default.nix b/pkgs/tools/security/jadx/default.nix
index 770062736bf..02533f7f6f5 100644
--- a/pkgs/tools/security/jadx/default.nix
+++ b/pkgs/tools/security/jadx/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, gradle, jdk, makeWrapper, perl }:
+{ lib, stdenv, fetchFromGitHub, gradle, jdk, makeWrapper, perl }:
 
 let
   pname = "jadx";
@@ -90,7 +90,7 @@ in stdenv.mkDerivation {
     done
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Dex to Java decompiler";
     longDescription = ''
       Command line and GUI tools for produce Java source code from Android Dex
diff --git a/pkgs/tools/security/jd-gui/default.nix b/pkgs/tools/security/jd-gui/default.nix
index 91c092922f0..046abed36f0 100644
--- a/pkgs/tools/security/jd-gui/default.nix
+++ b/pkgs/tools/security/jd-gui/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, jre, jdk, gradle_5, makeDesktopItem, copyDesktopItems, perl, writeText, runtimeShell }:
+{ lib, stdenv, fetchFromGitHub, jre, jdk, gradle_5, makeDesktopItem, copyDesktopItems, perl, writeText, runtimeShell }:
 
 let
   pname = "jd-gui";
@@ -99,7 +99,7 @@ in stdenv.mkDerivation rec {
 
   desktopItems = [ desktopItem ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Fast Java Decompiler with powerful GUI";
     homepage    = "https://java-decompiler.github.io/";
     license     = licenses.gpl3;
diff --git a/pkgs/tools/security/jwt-cli/default.nix b/pkgs/tools/security/jwt-cli/default.nix
index db73bb958eb..b607cabf916 100644
--- a/pkgs/tools/security/jwt-cli/default.nix
+++ b/pkgs/tools/security/jwt-cli/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, rustPlatform, Security, fetchpatch }:
+{ lib, stdenv, fetchFromGitHub, rustPlatform, Security, fetchpatch }:
 
 rustPlatform.buildRustPackage rec {
   pname = "jwt-cli";
@@ -18,7 +18,7 @@ rustPlatform.buildRustPackage rec {
   doInstallCheck = true;
   installCheckPhase = "$out/bin/jwt --version";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Super fast CLI tool to decode and encode JWTs";
     homepage = "https://github.com/mike-engel/jwt-cli";
     license = with licenses; [ mit ];
diff --git a/pkgs/tools/security/kbs2/default.nix b/pkgs/tools/security/kbs2/default.nix
index a13e7214cbb..e7b1c95126a 100644
--- a/pkgs/tools/security/kbs2/default.nix
+++ b/pkgs/tools/security/kbs2/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, rustPlatform, fetchFromGitHub, installShellFiles, python3, libxcb, AppKit }:
+{ lib, stdenv, rustPlatform, fetchFromGitHub, installShellFiles, python3, libxcb, AppKit }:
 
 rustPlatform.buildRustPackage rec {
   pname = "kbs2";
@@ -36,7 +36,7 @@ rustPlatform.buildRustPackage rec {
     done
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A secret manager backed by age";
     homepage = "https://github.com/woodruffw/kbs2";
     changelog = "https://github.com/woodruffw/kbs2/blob/v${version}/CHANGELOG.md";
diff --git a/pkgs/tools/security/keybase/default.nix b/pkgs/tools/security/keybase/default.nix
index ddc83ce0ce6..ba9649f36ab 100644
--- a/pkgs/tools/security/keybase/default.nix
+++ b/pkgs/tools/security/keybase/default.nix
@@ -31,7 +31,7 @@ buildGoPackage rec {
   buildInputs = stdenv.lib.optionals stdenv.isDarwin [ AVFoundation AudioToolbox ImageIO CoreMedia Foundation CoreGraphics MediaToolbox ];
   buildFlags = [ "-tags production" ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "https://www.keybase.io/";
     description = "The Keybase official command-line utility and service";
     platforms = platforms.linux ++ platforms.darwin;
diff --git a/pkgs/tools/security/keybase/gui.nix b/pkgs/tools/security/keybase/gui.nix
index 13a1fed2e30..54be692b007 100644
--- a/pkgs/tools/security/keybase/gui.nix
+++ b/pkgs/tools/security/keybase/gui.nix
@@ -105,7 +105,7 @@ stdenv.mkDerivation rec {
       --replace run_keybase $out/bin/keybase-gui
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "https://www.keybase.io/";
     description = "The Keybase official GUI";
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/tools/security/keybase/kbfs.nix b/pkgs/tools/security/keybase/kbfs.nix
index e9284e7230f..6916d6b99bd 100644
--- a/pkgs/tools/security/keybase/kbfs.nix
+++ b/pkgs/tools/security/keybase/kbfs.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoPackage, fetchFromGitHub, keybase }:
+{ lib, stdenv, buildGoPackage, fetchFromGitHub, keybase }:
 
 buildGoPackage {
   pname = "kbfs";
@@ -12,7 +12,7 @@ buildGoPackage {
 
   buildFlags = [ "-tags production" ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "https://keybase.io/docs/kbfs";
     description = "The Keybase filesystem";
     platforms = platforms.unix;
diff --git a/pkgs/tools/security/knockknock/default.nix b/pkgs/tools/security/knockknock/default.nix
index 9478bb4ca23..7a00f183f15 100644
--- a/pkgs/tools/security/knockknock/default.nix
+++ b/pkgs/tools/security/knockknock/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, python2Packages, hping }:
+{ lib, stdenv, fetchFromGitHub, python2Packages, hping }:
 let
   rev  = "bf14bbff";
 in python2Packages.buildPythonApplication rec {
@@ -23,7 +23,7 @@ in python2Packages.buildPythonApplication rec {
     substituteInPlace knockknock.py --replace 'existsInPath("hping3")' '"${hping}/bin/hping3"'
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Simple, secure port knocking daemon and client written in Python";
     homepage    = "http://www.thoughtcrime.org/software/knockknock/";
     license     = licenses.gpl3;
diff --git a/pkgs/tools/security/kpcli/default.nix b/pkgs/tools/security/kpcli/default.nix
index 12e2bb03d38..a0dd8c7fc8b 100644
--- a/pkgs/tools/security/kpcli/default.nix
+++ b/pkgs/tools/security/kpcli/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, makeWrapper, perl, perlPackages }:
+{ lib, stdenv, fetchurl, makeWrapper, perl, perlPackages }:
 
 stdenv.mkDerivation rec {
   version = "3.6";
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
   '';
 
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "KeePass Command Line Interface";
     longDescription = ''
       KeePass Command Line Interface (CLI) / interactive shell. 
diff --git a/pkgs/tools/security/lesspass-cli/default.nix b/pkgs/tools/security/lesspass-cli/default.nix
index 5bf7358fa76..20473d1003e 100644
--- a/pkgs/tools/security/lesspass-cli/default.nix
+++ b/pkgs/tools/security/lesspass-cli/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, python3, fetchFromGitHub }:
+{ lib, stdenv, python3, fetchFromGitHub }:
 
 let
   inherit (python3.pkgs) buildPythonApplication pytest mock pexpect;
@@ -30,7 +30,7 @@ buildPythonApplication rec {
     pytest tests
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Stateless password manager";
     homepage = "https://lesspass.com";
     maintainers = with maintainers; [ jasoncarr ];
diff --git a/pkgs/tools/security/libacr38u/default.nix b/pkgs/tools/security/libacr38u/default.nix
index b56c15af3d6..126cfedd157 100644
--- a/pkgs/tools/security/libacr38u/default.nix
+++ b/pkgs/tools/security/libacr38u/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, pcsclite , libusb-compat-0_1 }:
+{ lib, stdenv, fetchurl, pkgconfig, pcsclite , libusb-compat-0_1 }:
 
 stdenv.mkDerivation {
   version = "1.7.11";
@@ -18,7 +18,7 @@ stdenv.mkDerivation {
     makeFlagsArray=(usbdropdir="$out/pcsc/drivers");
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "ACR38U smartcard reader driver for pcsclite";
     longDescription = ''
       A PC/SC IFD handler implementation for the ACS ACR38U
diff --git a/pkgs/tools/security/libmodsecurity/default.nix b/pkgs/tools/security/libmodsecurity/default.nix
index 01e9a384792..5735263206e 100644
--- a/pkgs/tools/security/libmodsecurity/default.nix
+++ b/pkgs/tools/security/libmodsecurity/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, autoreconfHook, pkgconfig
+{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkgconfig
 , doxygen, perl, valgrind
 , curl, geoip, libxml2, lmdb, lua, pcre, yajl }:
 
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = ''
       ModSecurity v3 library component.
     '';
diff --git a/pkgs/tools/security/logkeys/default.nix b/pkgs/tools/security/logkeys/default.nix
index f3ea25d7160..7cd6b5fd194 100644
--- a/pkgs/tools/security/logkeys/default.nix
+++ b/pkgs/tools/security/logkeys/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, autoconf, automake, which, procps, kbd }:
+{ lib, stdenv, fetchFromGitHub, autoconf, automake, which, procps, kbd }:
 
 stdenv.mkDerivation {
   pname = "logkeys";
@@ -21,7 +21,7 @@ stdenv.mkDerivation {
 
   preConfigure = "./autogen.sh";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A GNU/Linux keylogger that works!";
     license = licenses.gpl3;
     homepage = "https://github.com/kernc/logkeys";
diff --git a/pkgs/tools/security/lynis/default.nix b/pkgs/tools/security/lynis/default.nix
index 9bbbc455b9b..6533c9e96fd 100644
--- a/pkgs/tools/security/lynis/default.nix
+++ b/pkgs/tools/security/lynis/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, makeWrapper, fetchFromGitHub, gawk, installShellFiles }:
+{ lib, stdenv, makeWrapper, fetchFromGitHub, gawk, installShellFiles }:
 
 stdenv.mkDerivation rec {
   pname = "lynis";
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
       extras/bash_completion.d/lynis
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Security auditing tool for Linux, macOS, and UNIX-based systems";
     homepage = "https://cisofy.com/lynis/";
     license = licenses.gpl3;
diff --git a/pkgs/tools/security/masscan/default.nix b/pkgs/tools/security/masscan/default.nix
index 6acfec9f3be..0f45edcff6c 100644
--- a/pkgs/tools/security/masscan/default.nix
+++ b/pkgs/tools/security/masscan/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, makeWrapper, libpcap }:
+{ lib, stdenv, fetchFromGitHub, makeWrapper, libpcap }:
 
 stdenv.mkDerivation rec {
   pname = "masscan";
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
     wrapProgram $out/bin/masscan --prefix LD_LIBRARY_PATH : "${libpcap}/lib"
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Fast scan of the Internet";
     homepage    = "https://github.com/robertdavidgraham/masscan";
     license     = licenses.agpl3;
diff --git a/pkgs/tools/security/medusa/default.nix b/pkgs/tools/security/medusa/default.nix
index bc18f165be7..43a30aad825 100644
--- a/pkgs/tools/security/medusa/default.nix
+++ b/pkgs/tools/security/medusa/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, pkg-config, freerdp, openssl, libssh2 }:
+{ lib, stdenv, fetchFromGitHub, pkg-config, freerdp, openssl, libssh2 }:
 
 stdenv.mkDerivation rec {
   pname = "medusa-unstable";
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ freerdp openssl libssh2 ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "https://github.com/jmk-foofus/medusa";
     description = "A speedy, parallel, and modular, login brute-forcer";
     license = licenses.gpl2;
diff --git a/pkgs/tools/security/metasploit/default.nix b/pkgs/tools/security/metasploit/default.nix
index a2a0a28bbff..1260584a3a7 100644
--- a/pkgs/tools/security/metasploit/default.nix
+++ b/pkgs/tools/security/metasploit/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, makeWrapper, ruby, bundlerEnv }:
+{ lib, stdenv, fetchFromGitHub, makeWrapper, ruby, bundlerEnv }:
 
 let
   env = bundlerEnv {
@@ -39,7 +39,7 @@ in stdenv.mkDerivation rec {
   # run with: nix-shell maintainers/scripts/update.nix --argstr path metasploit
   passthru.updateScript = ./update.sh;
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Metasploit Framework - a collection of exploits";
     homepage = "https://github.com/rapid7/metasploit-framework/wiki";
     platforms = platforms.unix;
diff --git a/pkgs/tools/security/mfcuk/default.nix b/pkgs/tools/security/mfcuk/default.nix
index 59908f2a9ce..006e89871c7 100644
--- a/pkgs/tools/security/mfcuk/default.nix
+++ b/pkgs/tools/security/mfcuk/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, libnfc }:
+{ lib, stdenv, fetchurl, pkgconfig, libnfc }:
 
 stdenv.mkDerivation {
   pname = "mfcuk";
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ libnfc ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "MiFare Classic Universal toolKit";
     license = licenses.gpl2;
     homepage = "https://github.com/nfc-tools/mfcuk";
diff --git a/pkgs/tools/security/mfoc/default.nix b/pkgs/tools/security/mfoc/default.nix
index fb622ad8249..1d2478b6bae 100644
--- a/pkgs/tools/security/mfoc/default.nix
+++ b/pkgs/tools/security/mfoc/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, fetchpatch, autoreconfHook, pkgconfig, libnfc }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, autoreconfHook, pkgconfig, libnfc }:
 
 stdenv.mkDerivation rec {
   pname = "mfoc";
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
   buildInputs = [ libnfc ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Mifare Classic Offline Cracker";
     license = licenses.gpl2;
     homepage = "https://github.com/nfc-tools/mfoc";
diff --git a/pkgs/tools/security/minisign/default.nix b/pkgs/tools/security/minisign/default.nix
index b67b65b0cf8..1fb1d6893a9 100644
--- a/pkgs/tools/security/minisign/default.nix
+++ b/pkgs/tools/security/minisign/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, cmake, pkg-config, libsodium }:
+{ lib, stdenv, fetchFromGitHub, cmake, pkg-config, libsodium }:
 
 stdenv.mkDerivation rec {
   pname = "minisign";
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake pkg-config ];
   buildInputs = [ libsodium ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A simple tool for signing files and verifying signatures";
     longDescription = ''
       minisign uses public key cryptography to help facilitate secure (but not
diff --git a/pkgs/tools/security/mkpasswd/default.nix b/pkgs/tools/security/mkpasswd/default.nix
index b88852966ee..e001239f313 100644
--- a/pkgs/tools/security/mkpasswd/default.nix
+++ b/pkgs/tools/security/mkpasswd/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, whois, perl }:
+{ lib, stdenv, whois, perl }:
 
 stdenv.mkDerivation {
   name = "mkpasswd-${whois.version}";
@@ -11,7 +11,7 @@ stdenv.mkDerivation {
   buildPhase = "make mkpasswd";
   installPhase = "make install-mkpasswd";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "https://packages.qa.debian.org/w/whois.html";
     description = "Overfeatured front-end to crypt, from the Debian whois package";
     license = licenses.gpl2;
diff --git a/pkgs/tools/security/mktemp/default.nix b/pkgs/tools/security/mktemp/default.nix
index 0732adecc45..dc3f2a8904b 100644
--- a/pkgs/tools/security/mktemp/default.nix
+++ b/pkgs/tools/security/mktemp/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, groff }:
+{ lib, stdenv, fetchurl, groff }:
 
 stdenv.mkDerivation {
   name = "mktemp-1.7";
@@ -16,7 +16,7 @@ stdenv.mkDerivation {
     sha256 = "0x969152znxxjbj7387xb38waslr4yv6bnj5jmhb4rpqxphvk54f";
   };
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Simple tool to make temporary file handling in shells scripts safe and simple";
     homepage = "https://www.mktemp.org";
     license = licenses.isc;
diff --git a/pkgs/tools/security/monkeysphere/default.nix b/pkgs/tools/security/monkeysphere/default.nix
index 4b1f7569887..e5dca7721ac 100644
--- a/pkgs/tools/security/monkeysphere/default.nix
+++ b/pkgs/tools/security/monkeysphere/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, makeWrapper
+{ lib, stdenv, fetchurl, makeWrapper
 , perl, libassuan, libgcrypt
 , perlPackages, lockfileProgs, gnupg, coreutils
 # For the tests:
@@ -84,7 +84,7 @@ in stdenv.mkDerivation rec {
         done
       '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "http://web.monkeysphere.info/";
     description = "Leverage the OpenPGP web of trust for SSH and TLS authentication";
     longDescription = ''
diff --git a/pkgs/tools/security/mpw/default.nix b/pkgs/tools/security/mpw/default.nix
index 9d25daf29a6..3973ed51343 100644
--- a/pkgs/tools/security/mpw/default.nix
+++ b/pkgs/tools/security/mpw/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, cmake, fetchFromGitLab
+{ lib, stdenv, cmake, fetchFromGitLab
 , json_c, libsodium, libxml2, ncurses }:
 
 let
@@ -53,7 +53,7 @@ in stdenv.mkDerivation rec {
     runHook postCheck
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A stateless password management solution";
     homepage = "https://masterpasswordapp.com/";
     license = licenses.gpl3;
diff --git a/pkgs/tools/security/munge/default.nix b/pkgs/tools/security/munge/default.nix
index ee1858ad284..0462db8859c 100644
--- a/pkgs/tools/security/munge/default.nix
+++ b/pkgs/tools/security/munge/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, autoreconfHook, gawk, gnused, libgcrypt, zlib, bzip2 }:
+{ lib, stdenv, fetchFromGitHub, autoreconfHook, gawk, gnused, libgcrypt, zlib, bzip2 }:
 
 stdenv.mkDerivation rec {
   name = "munge-0.5.14";
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     "--localstatedir=/var"
   ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = ''
       An authentication service for creating and validating credentials
     '';
diff --git a/pkgs/tools/security/nasty/default.nix b/pkgs/tools/security/nasty/default.nix
index 7f423860100..b3b19c9268b 100644
--- a/pkgs/tools/security/nasty/default.nix
+++ b/pkgs/tools/security/nasty/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, gpgme }:
+{ lib, stdenv, fetchurl, gpgme }:
 
 stdenv.mkDerivation rec {
   pname = "nasty";
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
     cp nasty $out/bin
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Recover the passphrase of your PGP or GPG-key";
     longDescription = ''
     Nasty is a program that helps you to recover the passphrase of your PGP or GPG-key
diff --git a/pkgs/tools/security/ncrack/default.nix b/pkgs/tools/security/ncrack/default.nix
index e377d974864..e1504eb12b4 100644
--- a/pkgs/tools/security/ncrack/default.nix
+++ b/pkgs/tools/security/ncrack/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, openssl, zlib }:
+{ lib, stdenv, fetchFromGitHub, openssl, zlib }:
 
 stdenv.mkDerivation rec {
   pname = "ncrack";
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ openssl zlib ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Network authentication tool";
     homepage = "https://nmap.org/ncrack/";
     license = licenses.gpl2Only;
diff --git a/pkgs/tools/security/neopg/default.nix b/pkgs/tools/security/neopg/default.nix
index 8c0d31853ff..93c12c15828 100644
--- a/pkgs/tools/security/neopg/default.nix
+++ b/pkgs/tools/security/neopg/default.nix
@@ -1,4 +1,4 @@
-{ stdenv
+{ lib, stdenv
 , fetchFromGitHub
 , cmake
 , sqlite
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$(pwd)/3rdparty/googletest/googletest:$(pwd)/neopg
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "https://neopg.io/";
     description = "Modern replacement for GnuPG 2";
     license = licenses.gpl3;
diff --git a/pkgs/tools/security/nitrokey-app/default.nix b/pkgs/tools/security/nitrokey-app/default.nix
index a4936d763b6..1da54526a61 100644
--- a/pkgs/tools/security/nitrokey-app/default.nix
+++ b/pkgs/tools/security/nitrokey-app/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, bash-completion, cmake, fetchFromGitHub, hidapi, libusb1, pkgconfig
+{ lib, stdenv, bash-completion, cmake, fetchFromGitHub, hidapi, libusb1, pkgconfig
 , qtbase, qttranslations, qtsvg, wrapQtAppsHook }:
 
 stdenv.mkDerivation rec {
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
   ];
   cmakeFlags = [ "-DCMAKE_BUILD_TYPE=Release" ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description      = "Provides extra functionality for the Nitrokey Pro and Storage";
     longDescription  = ''
        The nitrokey-app provides a QT system tray widget with wich you can
diff --git a/pkgs/tools/security/nmap/qt.nix b/pkgs/tools/security/nmap/qt.nix
index befd6108919..39026c400d0 100644
--- a/pkgs/tools/security/nmap/qt.nix
+++ b/pkgs/tools/security/nmap/qt.nix
@@ -1,4 +1,4 @@
-{ stdenv
+{ lib, stdenv
 , fetchFromGitHub
 , cmake
 , pkgconfig
@@ -51,7 +51,7 @@ stdenv.mkDerivation rec {
     done
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Qt frontend for nmap";
     license = licenses.gpl2;
     maintainers = with maintainers; [ peterhoeg ];
diff --git a/pkgs/tools/security/notary/default.nix b/pkgs/tools/security/notary/default.nix
index 020f37c836b..fa3db0c3623 100644
--- a/pkgs/tools/security/notary/default.nix
+++ b/pkgs/tools/security/notary/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, buildGoPackage, libtool }:
+{ lib, stdenv, fetchFromGitHub, buildGoPackage, libtool }:
 
 buildGoPackage rec {
   pname = "notary";
@@ -35,7 +35,7 @@ buildGoPackage rec {
     make test PKGS=github.com/theupdateframework/notary/cmd/notary
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A project that allows anyone to have trust over arbitrary collections of data";
     longDescription = ''
       The Notary project comprises a server and a client for running and
diff --git a/pkgs/tools/security/nsjail/default.nix b/pkgs/tools/security/nsjail/default.nix
index 4522d0e897a..deab1b929c9 100644
--- a/pkgs/tools/security/nsjail/default.nix
+++ b/pkgs/tools/security/nsjail/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, autoconf, bison, flex, libtool, pkgconfig, which
+{ lib, stdenv, fetchFromGitHub, autoconf, bison, flex, libtool, pkgconfig, which
 , libnl, protobuf, protobufc, shadow
 }:
 
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     install nsjail.1 $out/share/man/man1/
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A light-weight process isolation tool, making use of Linux namespaces and seccomp-bpf syscall filters";
     homepage    = "http://nsjail.com/";
     license     = licenses.asl20;
diff --git a/pkgs/tools/security/nuclei/default.nix b/pkgs/tools/security/nuclei/default.nix
index 22013352a38..7e9d3d52e56 100644
--- a/pkgs/tools/security/nuclei/default.nix
+++ b/pkgs/tools/security/nuclei/default.nix
@@ -1,6 +1,6 @@
 { buildGoModule
 , fetchFromGitHub
-, stdenv
+, lib, stdenv
 }:
 
 buildGoModule rec {
@@ -20,7 +20,7 @@ buildGoModule rec {
     mv v2/* .
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Tool for configurable targeted scanning";
     longDescription = ''
       Nuclei is used to send requests across targets based on a template
diff --git a/pkgs/tools/security/nwipe/default.nix b/pkgs/tools/security/nwipe/default.nix
index c72ada86761..53d8abc6100 100644
--- a/pkgs/tools/security/nwipe/default.nix
+++ b/pkgs/tools/security/nwipe/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, ncurses, parted, automake, autoconf, pkgconfig }:
+{ lib, stdenv, fetchFromGitHub, ncurses, parted, automake, autoconf, pkgconfig }:
 
 stdenv.mkDerivation rec {
   version = "0.28";
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ automake autoconf pkgconfig ];
   buildInputs = [ ncurses parted ];
   preConfigure = "sh init.sh || :";
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Securely erase disks";
     homepage = "https://github.com/martijnvanbrummelen/nwipe";
     license = licenses.gpl2;
diff --git a/pkgs/tools/security/oath-toolkit/default.nix b/pkgs/tools/security/oath-toolkit/default.nix
index 22327c6a38f..5fb7fadbc5c 100644
--- a/pkgs/tools/security/oath-toolkit/default.nix
+++ b/pkgs/tools/security/oath-toolkit/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitLab, fetchpatch, pam, xmlsec, autoreconfHook, pkgconfig, libxml2, gtk-doc, perl, gengetopt, bison, help2man }:
+{ lib, stdenv, fetchFromGitLab, fetchpatch, pam, xmlsec, autoreconfHook, pkgconfig, libxml2, gtk-doc, perl, gengetopt, bison, help2man }:
 
 let
   securityDependency =
@@ -40,7 +40,7 @@ in stdenv.mkDerivation {
     touch ChangeLog
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Components for building one-time password authentication systems";
     homepage = "https://www.nongnu.org/oath-toolkit/";
     platforms = with platforms; linux ++ darwin;
diff --git a/pkgs/tools/security/omapd/default.nix b/pkgs/tools/security/omapd/default.nix
index 8ed23864ced..7ce377e601a 100644
--- a/pkgs/tools/security/omapd/default.nix
+++ b/pkgs/tools/security/omapd/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, qt4, gdb, zlib }:
+{ lib, stdenv, fetchurl, qt4, gdb, zlib }:
 
 stdenv.mkDerivation rec {
   pname = "omapd";
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
     ln -s $out/usr/lib/omapd/plugins $out/bin/plugins
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "https://code.google.com/archive/p/omapd/";
     description = "IF-MAP Server that implements the IF-MAP v1.1 and v2.0 specifications published by the Trusted Computing Group (TCG)";
     license = licenses.gpl3;
diff --git a/pkgs/tools/security/onesixtyone/default.nix b/pkgs/tools/security/onesixtyone/default.nix
index 4eed52b07f0..374d1322246 100644
--- a/pkgs/tools/security/onesixtyone/default.nix
+++ b/pkgs/tools/security/onesixtyone/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub }:
+{ lib, stdenv, fetchFromGitHub }:
 
 stdenv.mkDerivation rec {
   pname = "onesixtyone";
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     install -D onesixtyone $out/bin/onesixtyone
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Fast SNMP Scanner";
     homepage = "https://github.com/trailofbits/onesixtyone";
     license = licenses.gpl2Plus;
diff --git a/pkgs/tools/security/onioncircuits/default.nix b/pkgs/tools/security/onioncircuits/default.nix
index 92888a8de2a..bdaf087004a 100644
--- a/pkgs/tools/security/onioncircuits/default.nix
+++ b/pkgs/tools/security/onioncircuits/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchgit, python3, intltool, gtk3, gobject-introspection, gnome3 }:
+{ lib, stdenv, fetchgit, python3, intltool, gtk3, gobject-introspection, gnome3 }:
 
 python3.pkgs.buildPythonApplication rec {
   pname = "onioncircuits";
@@ -20,7 +20,7 @@ python3.pkgs.buildPythonApplication rec {
       --prefix XDG_DATA_DIRS : "$out/share:${gnome3.adwaita-icon-theme}/share"
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "https://tails.boum.org";
     description = "GTK application to display Tor circuits and streams";
     license = licenses.gpl3;
diff --git a/pkgs/tools/security/open-ecard/default.nix b/pkgs/tools/security/open-ecard/default.nix
index bac036e6790..0dfdba804c0 100644
--- a/pkgs/tools/security/open-ecard/default.nix
+++ b/pkgs/tools/security/open-ecard/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, jre, pcsclite, makeDesktopItem, makeWrapper }:
+{ lib, stdenv, fetchurl, jre, pcsclite, makeDesktopItem, makeWrapper }:
 
 let
   version = "1.2.4";
@@ -53,7 +53,7 @@ in stdenv.mkDerivation rec {
       --suffix LD_LIBRARY_PATH ':' ${stdenv.lib.getLib pcsclite}/lib
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Client side implementation of the eCard-API-Framework (BSI
       TR-03112) and related international standards, such as ISO/IEC 24727";
     homepage = "https://www.openecard.org/";
diff --git a/pkgs/tools/security/opencryptoki/default.nix b/pkgs/tools/security/opencryptoki/default.nix
index 1eb4aab66b4..0825708f71f 100644
--- a/pkgs/tools/security/opencryptoki/default.nix
+++ b/pkgs/tools/security/opencryptoki/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, openssl, trousers, autoreconfHook, libtool, bison, flex }:
+{ lib, stdenv, fetchFromGitHub, openssl, trousers, autoreconfHook, libtool, bison, flex }:
 
 stdenv.mkDerivation rec {
   pname = "opencryptoki";
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "PKCS#11 implementation for Linux";
     homepage    = "https://github.com/opencryptoki/opencryptoki";
     license     = licenses.cpl10;
diff --git a/pkgs/tools/security/opensc/default.nix b/pkgs/tools/security/opensc/default.nix
index 735f7558e7a..f623e3a2f6f 100644
--- a/pkgs/tools/security/opensc/default.nix
+++ b/pkgs/tools/security/opensc/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, zlib, readline, openssl
+{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, zlib, readline, openssl
 , libiconv, pcsclite, libassuan, libXt
 , docbook_xsl, libxslt, docbook_xml_dtd_412
 , Carbon, PCSC, buildPackages
@@ -55,7 +55,7 @@ stdenv.mkDerivation rec {
     "completiondir=$(out)/etc"
   ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Set of libraries and utilities to access smart cards";
     homepage = "https://github.com/OpenSC/OpenSC/wiki";
     license = licenses.lgpl21Plus;
diff --git a/pkgs/tools/security/pamtester/default.nix b/pkgs/tools/security/pamtester/default.nix
index a1055dadc6c..1944e5187d2 100644
--- a/pkgs/tools/security/pamtester/default.nix
+++ b/pkgs/tools/security/pamtester/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pam }:
+{ lib, stdenv, fetchurl, pam }:
 
 stdenv.mkDerivation rec {
   name = "pamtester-0.1.2";
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ pam ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Utility program to test the PAM facility";
     homepage = "http://pamtester.sourceforge.net/";
     license = licenses.bsd3;
diff --git a/pkgs/tools/security/paperkey/default.nix b/pkgs/tools/security/paperkey/default.nix
index dc3582b7369..766b570a074 100644
--- a/pkgs/tools/security/paperkey/default.nix
+++ b/pkgs/tools/security/paperkey/default.nix
@@ -1,4 +1,4 @@
-{ fetchurl, stdenv }:
+{ fetchurl, lib, stdenv }:
 
 stdenv.mkDerivation rec {
   pname = "paperkey";
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Store OpenPGP or GnuPG on paper";
     longDescription = ''
       A reasonable way to achieve a long term backup of OpenPGP (GnuPG, PGP, etc)
diff --git a/pkgs/tools/security/pass/default.nix b/pkgs/tools/security/pass/default.nix
index 354437a9bd5..e2b163445ce 100644
--- a/pkgs/tools/security/pass/default.nix
+++ b/pkgs/tools/security/pass/default.nix
@@ -149,7 +149,7 @@ stdenv.mkDerivation rec {
     withExtensions = env;
   };
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Stores, retrieves, generates, and synchronizes passwords securely";
     homepage    = "https://www.passwordstore.org/";
     license     = licenses.gpl2Plus;
diff --git a/pkgs/tools/security/pass/extensions/audit/default.nix b/pkgs/tools/security/pass/extensions/audit/default.nix
index ec0f23ddc38..415a4b9e79d 100644
--- a/pkgs/tools/security/pass/extensions/audit/default.nix
+++ b/pkgs/tools/security/pass/extensions/audit/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, pass, fetchFromGitHub, pythonPackages, makeWrapper, gnupg }:
+{ lib, stdenv, pass, fetchFromGitHub, pythonPackages, makeWrapper, gnupg }:
 
 let
   pythonEnv = pythonPackages.python.withPackages (p: [ p.requests p.setuptools p.zxcvbn ]);
@@ -43,7 +43,7 @@ in stdenv.mkDerivation rec {
       --prefix PYTHONPATH : "$out/lib/${pythonEnv.libPrefix}/site-packages"
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Pass extension for auditing your password repository.";
     homepage = "https://github.com/roddhjav/pass-audit";
     license = licenses.gpl3Plus;
diff --git a/pkgs/tools/security/pass/extensions/checkup.nix b/pkgs/tools/security/pass/extensions/checkup.nix
index 83a1d7a8872..bafaabba843 100644
--- a/pkgs/tools/security/pass/extensions/checkup.nix
+++ b/pkgs/tools/security/pass/extensions/checkup.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub
+{ lib, stdenv, fetchFromGitHub
 , curl, findutils, gnugrep, gnused }:
 
 stdenv.mkDerivation rec {
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
     install -D -m755 checkup.bash $out/lib/password-store/extensions/checkup.bash
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A pass extension to check against the Have I been pwned API to see if your passwords are publicly leaked or not";
     homepage = "https://github.com/etu/pass-checkup";
     license = licenses.gpl3;
diff --git a/pkgs/tools/security/pass/extensions/genphrase.nix b/pkgs/tools/security/pass/extensions/genphrase.nix
index d45e35d9bbc..dff64d7f185 100644
--- a/pkgs/tools/security/pass/extensions/genphrase.nix
+++ b/pkgs/tools/security/pass/extensions/genphrase.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub }:
+{ lib, stdenv, fetchFromGitHub }:
 
 stdenv.mkDerivation rec {
   pname = "pass-genphrase";
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
       --replace '$EXTENSIONS' "$out/lib/password-store/extensions/"
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Pass extension that generates memorable passwords";
     homepage = "https://github.com/congma/pass-genphrase";
     license = licenses.gpl3;
diff --git a/pkgs/tools/security/pass/extensions/import.nix b/pkgs/tools/security/pass/extensions/import.nix
index 885dd05110f..0fd14901d0d 100644
--- a/pkgs/tools/security/pass/extensions/import.nix
+++ b/pkgs/tools/security/pass/extensions/import.nix
@@ -1,4 +1,4 @@
-{ stdenv, pass, fetchFromGitHub, pythonPackages, makeWrapper, fetchpatch }:
+{ lib, stdenv, pass, fetchFromGitHub, pythonPackages, makeWrapper, fetchpatch }:
 
 let
   pythonEnv = pythonPackages.python.withPackages (p: [
@@ -39,7 +39,7 @@ in stdenv.mkDerivation rec {
       --prefix PYTHONPATH : "$out/${pythonPackages.python.sitePackages}"
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Pass extension for importing data from existing password managers";
     homepage = "https://github.com/roddhjav/pass-import";
     license = licenses.gpl3Plus;
diff --git a/pkgs/tools/security/pass/extensions/otp.nix b/pkgs/tools/security/pass/extensions/otp.nix
index 835e693c2c5..8d9b350543d 100644
--- a/pkgs/tools/security/pass/extensions/otp.nix
+++ b/pkgs/tools/security/pass/extensions/otp.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, oathToolkit }:
+{ lib, stdenv, fetchFromGitHub, oathToolkit }:
 
 stdenv.mkDerivation rec {
   pname = "pass-otp";
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
                    "BASHCOMPDIR=$(out)/share/bash-completion/completions"
                  ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A pass extension for managing one-time-password (OTP) tokens";
     homepage = "https://github.com/tadfisher/pass-otp";
     license = licenses.gpl3;
diff --git a/pkgs/tools/security/pass/extensions/tomb.nix b/pkgs/tools/security/pass/extensions/tomb.nix
index 43c74a9029b..74f8694f224 100644
--- a/pkgs/tools/security/pass/extensions/tomb.nix
+++ b/pkgs/tools/security/pass/extensions/tomb.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, tomb }:
+{ lib, stdenv, fetchFromGitHub, tomb }:
 
 stdenv.mkDerivation rec {
   pname = "pass-tomb";
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
       --replace 'TOMB="''${PASSWORD_STORE_TOMB:-tomb}"' 'TOMB="''${PASSWORD_STORE_TOMB:-${tomb}/bin/tomb}"'
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Pass extension that keeps the password store encrypted inside a tomb";
     homepage = "https://github.com/roddhjav/pass-tomb";
     license = licenses.gpl3Plus;
diff --git a/pkgs/tools/security/pass/extensions/update.nix b/pkgs/tools/security/pass/extensions/update.nix
index c364c341bda..50a4c49b90d 100644
--- a/pkgs/tools/security/pass/extensions/update.nix
+++ b/pkgs/tools/security/pass/extensions/update.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub }:
+{ lib, stdenv, fetchFromGitHub }:
 
 stdenv.mkDerivation rec {
   pname = "pass-update";
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
 
   installFlags = [ "PREFIX=$(out)" ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Pass extension that provides an easy flow for updating passwords";
     homepage = "https://github.com/roddhjav/pass-update";
     license = licenses.gpl3Plus;
diff --git a/pkgs/tools/security/passff-host/default.nix b/pkgs/tools/security/passff-host/default.nix
index 0bdb04b7612..fb348800f5a 100644
--- a/pkgs/tools/security/passff-host/default.nix
+++ b/pkgs/tools/security/passff-host/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, python3, pass }:
+{ lib, stdenv, fetchFromGitHub, python3, pass }:
 
 stdenv.mkDerivation rec {
   pname = "passff-host";
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
     done
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Host app for the WebExtension PassFF";
     homepage = "https://github.com/passff/passff-host";
     license = licenses.gpl2;
diff --git a/pkgs/tools/security/pbis/default.nix b/pkgs/tools/security/pbis/default.nix
index 176ef7f7616..25e945a082d 100644
--- a/pkgs/tools/security/pbis/default.nix
+++ b/pkgs/tools/security/pbis/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, autoconf, automake, libtool, perl, flex, bison, curl,
+{ lib, stdenv, fetchFromGitHub, autoconf, automake, libtool, perl, flex, bison, curl,
   pam, popt, libiconv, libuuid, openssl_1_0_2, cyrus_sasl, sqlite, tdb, libxml2 }:
 
 stdenv.mkDerivation rec {
@@ -61,7 +61,7 @@ stdenv.mkDerivation rec {
   '';
   outputs = [ "out" "sys" ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "BeyondTrust AD Bridge Open simplifies the process of joining non-Microsoft hosts to Active Directory domains";
     homepage = "https://github.com/BeyondTrust/pbis-open";
     license = with licenses; [ gpl2 lgpl21 ];
diff --git a/pkgs/tools/security/pcsc-cyberjack/default.nix b/pkgs/tools/security/pcsc-cyberjack/default.nix
index 015e3938c3e..65446e6fc44 100644
--- a/pkgs/tools/security/pcsc-cyberjack/default.nix
+++ b/pkgs/tools/security/pcsc-cyberjack/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, autoreconfHook, pkgconfig, libusb1, pcsclite }:
+{ lib, stdenv, fetchurl, autoreconfHook, pkgconfig, libusb1, pcsclite }:
 
 let
   version = "3.99.5";
@@ -32,7 +32,7 @@ in stdenv.mkDerivation rec {
 
   postInstall = "make -C tools/cjflash install";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "REINER SCT cyberJack USB chipcard reader user space driver";
     homepage = "https://www.reiner-sct.com/";
     license = licenses.gpl2Plus;
diff --git a/pkgs/tools/security/pcsc-scm-scl011/default.nix b/pkgs/tools/security/pcsc-scm-scl011/default.nix
index 02e38bbe249..a9697718e3c 100644
--- a/pkgs/tools/security/pcsc-scm-scl011/default.nix
+++ b/pkgs/tools/security/pcsc-scm-scl011/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, unzip, libusb-compat-0_1 }:
+{ lib, stdenv, fetchurl, unzip, libusb-compat-0_1 }:
 
 let
   arch = if stdenv.hostPlatform.system == "i686-linux" then "32"
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
       $out/pcsc/drivers/SCLGENERIC.bundle/Contents/Linux/libSCLGENERIC.so.${version};
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "SCM Microsystems SCL011 chipcard reader user space driver";
     homepage = "https://www.scm-pc-card.de/index.php?lang=en&page=product&function=show_product&product_id=630";
     downloadPage = "https://support.identiv.com/scl010-scl011/";
diff --git a/pkgs/tools/security/pcsclite/default.nix b/pkgs/tools/security/pcsclite/default.nix
index 98a3e8797fb..8a4ae089440 100644
--- a/pkgs/tools/security/pcsclite/default.nix
+++ b/pkgs/tools/security/pcsclite/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, udev, dbus, perl, python3
+{ lib, stdenv, fetchurl, pkgconfig, udev, dbus, perl, python3
 , IOKit ? null }:
 
 stdenv.mkDerivation rec {
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ python3 ] ++ stdenv.lib.optionals stdenv.isLinux [ udev dbus ]
              ++ stdenv.lib.optionals stdenv.isDarwin [ IOKit ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Middleware to access a smart card using SCard API (PC/SC)";
     homepage = "https://pcsclite.apdu.fr/";
     license = licenses.bsd3;
diff --git a/pkgs/tools/security/pgpdump/default.nix b/pkgs/tools/security/pgpdump/default.nix
index cd421224fa6..89ee6a9eab2 100644
--- a/pkgs/tools/security/pgpdump/default.nix
+++ b/pkgs/tools/security/pgpdump/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub
+{ lib, stdenv, fetchFromGitHub
 , supportCompressedPackets ? true, zlib, bzip2
 }:
 
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = stdenv.lib.optionals supportCompressedPackets [ zlib bzip2 ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A PGP packet visualizer";
     longDescription = ''
       pgpdump is a PGP packet visualizer which displays the packet format of
diff --git a/pkgs/tools/security/phrasendrescher/default.nix b/pkgs/tools/security/phrasendrescher/default.nix
index f62288c062b..7e8c87f6e82 100644
--- a/pkgs/tools/security/phrasendrescher/default.nix
+++ b/pkgs/tools/security/phrasendrescher/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, openssl, libssh2, gpgme }:
+{ lib, stdenv, fetchurl, openssl, libssh2, gpgme }:
 
 stdenv.mkDerivation rec {
   pname = "phrasendrescher";
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--with-plugins" ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A modular and multi processing pass phrase cracking tool";
     homepage = "https://leidecker.info/projects/phrasendrescher/index.shtml";
     license = licenses.gpl2Plus;
diff --git a/pkgs/tools/security/pinentry/default.nix b/pkgs/tools/security/pinentry/default.nix
index a72e8f9f5b2..cac245bb256 100644
--- a/pkgs/tools/security/pinentry/default.nix
+++ b/pkgs/tools/security/pinentry/default.nix
@@ -89,7 +89,7 @@ pinentryMkDerivation rec {
 
   passthru = { flavors = enabledFlavors; };
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "http://gnupg.org/aegypten2/";
     description = "GnuPG’s interface to passphrase input";
     license = licenses.gpl2Plus;
diff --git a/pkgs/tools/security/proxmark3/default.nix b/pkgs/tools/security/proxmark3/default.nix
index 304ba041b46..4cc831eda39 100644
--- a/pkgs/tools/security/proxmark3/default.nix
+++ b/pkgs/tools/security/proxmark3/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, pkgconfig, ncurses, readline, pcsclite, qt5
+{ lib, stdenv, fetchFromGitHub, pkgconfig, ncurses, readline, pcsclite, qt5
 , gcc-arm-embedded }:
 
 let
@@ -33,7 +33,7 @@ let
         install -Dt $out/firmware bootrom/obj/bootrom.elf armsrc/obj/fullimage.elf
       '';
 
-      meta = with stdenv.lib; {
+      meta = with lib; {
         description = "Client for proxmark3, powerful general purpose RFID tool";
         homepage = "http://www.proxmark.org";
         license = licenses.gpl2Plus;
diff --git a/pkgs/tools/security/pyrit/default.nix b/pkgs/tools/security/pyrit/default.nix
index 93ae86416e1..ead55036425 100644
--- a/pkgs/tools/security/pyrit/default.nix
+++ b/pkgs/tools/security/pyrit/default.nix
@@ -32,7 +32,7 @@ python2Packages.buildPythonApplication rec {
   buildInputs = [ openssl zlib libpcap ];
   propagatedBuildInputs = [ cpyrit_opencl ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "https://github.com/JPaulMora/Pyrit";
     description = "GPGPU-driven WPA/WPA2-PSK key cracker";
     license = licenses.gpl3;
diff --git a/pkgs/tools/security/qdigidoc/default.nix b/pkgs/tools/security/qdigidoc/default.nix
index fcbc166689e..51ddad0634f 100644
--- a/pkgs/tools/security/qdigidoc/default.nix
+++ b/pkgs/tools/security/qdigidoc/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, mkDerivation, fetchgit, fetchurl, cmake, darkhttpd, gettext, makeWrapper, pkgconfig
+{ lib, stdenv, mkDerivation, fetchgit, fetchurl, cmake, darkhttpd, gettext, makeWrapper, pkgconfig
 , libdigidocpp, opensc, openldap, openssl, pcsclite, qtbase, qttranslations, qtsvg }:
 
 mkDerivation rec {
@@ -40,7 +40,7 @@ mkDerivation rec {
       --prefix LD_LIBRARY_PATH : ${opensc}/lib/pkcs11/
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Qt-based UI for signing and verifying DigiDoc documents";
     homepage = "https://www.id.ee/";
     license = licenses.lgpl21Plus;
diff --git a/pkgs/tools/security/rage/default.nix b/pkgs/tools/security/rage/default.nix
index 69ea8c0f9c2..5cf38cb756d 100644
--- a/pkgs/tools/security/rage/default.nix
+++ b/pkgs/tools/security/rage/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, rustPlatform, fetchFromGitHub, installShellFiles
+{ lib, stdenv, rustPlatform, fetchFromGitHub, installShellFiles
 , Foundation, Security }:
 
 rustPlatform.buildRustPackage rec {
@@ -31,7 +31,7 @@ rustPlatform.buildRustPackage rec {
     installShellCompletion target/completions/*.{bash,fish,zsh}
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A simple, secure and modern encryption tool with small explicit keys, no config options, and UNIX-style composability";
     homepage = "https://github.com/str4d/rage";
     changelog = "https://github.com/str4d/rage/releases/tag/v${version}";
diff --git a/pkgs/tools/security/rarcrack/default.nix b/pkgs/tools/security/rarcrack/default.nix
index 9749d825168..e5bbb7e8421 100644
--- a/pkgs/tools/security/rarcrack/default.nix
+++ b/pkgs/tools/security/rarcrack/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchFromGitHub, libxml2, file, p7zip, unrar, unzip}:
+{lib, stdenv, fetchFromGitHub, libxml2, file, p7zip, unrar, unzip}:
 
 stdenv.mkDerivation {
   pname = "rarcrack";
@@ -23,7 +23,7 @@ stdenv.mkDerivation {
     mkdir -p $out/bin
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "This program can crack zip,7z and rar file passwords";
     longDescription = ''
     If you forget your password for compressed archive (rar, 7z, zip), this program is the solution.
diff --git a/pkgs/tools/security/rhash/default.nix b/pkgs/tools/security/rhash/default.nix
index 394dd89484f..f4cc65f5d8e 100644
--- a/pkgs/tools/security/rhash/default.nix
+++ b/pkgs/tools/security/rhash/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, which }:
+{ lib, stdenv, fetchFromGitHub, which }:
 
 stdenv.mkDerivation rec {
   version = "1.4.0";
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
 
   installTargets = [ "install" "install-lib-shared" "install-lib-so-link" "install-lib-headers" ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "http://rhash.sourceforge.net/";
     description = "Console utility and library for computing and verifying hash sums of files";
     license = licenses.bsd0;
diff --git a/pkgs/tools/security/ripasso/cursive.nix b/pkgs/tools/security/ripasso/cursive.nix
index 29229bff002..24e11463464 100644
--- a/pkgs/tools/security/ripasso/cursive.nix
+++ b/pkgs/tools/security/ripasso/cursive.nix
@@ -29,7 +29,7 @@ buildRustPackage rec {
     rm $out/bin/ripasso-man
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A simple password manager written in Rust";
     homepage = "https://github.com/cortex/ripasso";
     license = licenses.gpl3;
diff --git a/pkgs/tools/security/rustscan/default.nix b/pkgs/tools/security/rustscan/default.nix
index 43b6a3a0afd..3d84900f18e 100644
--- a/pkgs/tools/security/rustscan/default.nix
+++ b/pkgs/tools/security/rustscan/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, rustPlatform, nmap, Security }:
+{ lib, stdenv, fetchFromGitHub, rustPlatform, nmap, Security }:
 
 rustPlatform.buildRustPackage rec {
   pname = "rustscan";
@@ -29,7 +29,7 @@ rustPlatform.buildRustPackage rec {
     "--skip=run_python_script"
   ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Faster Nmap Scanning with Rust";
     homepage = "https://github.com/RustScan/RustScan";
     license = licenses.gpl3Only;
diff --git a/pkgs/tools/security/safe/default.nix b/pkgs/tools/security/safe/default.nix
index 43d791e19db..2f0f4501fd2 100644
--- a/pkgs/tools/security/safe/default.nix
+++ b/pkgs/tools/security/safe/default.nix
@@ -1,4 +1,4 @@
-{ stdenv
+{ lib, stdenv
 , buildGoPackage
 , fetchFromGitHub
 }:
@@ -22,7 +22,7 @@ buildGoPackage rec {
     buildFlagsArray+=("-ldflags" "-X main.Version=${version}")
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A Vault CLI";
     homepage = "https://github.com/starkandwayne/safe";
     license = licenses.mit;
diff --git a/pkgs/tools/security/saml2aws/default.nix b/pkgs/tools/security/saml2aws/default.nix
index 68721bbdebc..2e617a8de8a 100644
--- a/pkgs/tools/security/saml2aws/default.nix
+++ b/pkgs/tools/security/saml2aws/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub }:
+{ lib, stdenv, buildGoModule, fetchFromGitHub }:
 
 buildGoModule rec {
   pname = "saml2aws";
@@ -22,7 +22,7 @@ buildGoModule rec {
     -ldflags=-X main.Version=${version}
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "CLI tool which enables you to login and retrieve AWS temporary credentials using a SAML IDP";
     homepage    = "https://github.com/Versent/saml2aws";
     license     = licenses.mit;
diff --git a/pkgs/tools/security/sbsigntool/default.nix b/pkgs/tools/security/sbsigntool/default.nix
index 1a42ddf8bec..36e75094c59 100644
--- a/pkgs/tools/security/sbsigntool/default.nix
+++ b/pkgs/tools/security/sbsigntool/default.nix
@@ -1,4 +1,4 @@
-{ stdenv
+{ lib, stdenv
 , fetchgit, autoconf, automake, pkgconfig, help2man
 , openssl, libuuid, gnu-efi, libbfd
 }:
@@ -42,7 +42,7 @@ stdenv.mkDerivation {
     make install
     '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Tools for maintaining UEFI signature databases";
     homepage    = "http://jk.ozlabs.org/docs/sbkeysync-maintaing-uefi-key-databases";
     maintainers = [ maintainers.tstrobel ];
diff --git a/pkgs/tools/security/scallion/default.nix b/pkgs/tools/security/scallion/default.nix
index 1395b8e1061..91b92071fe7 100644
--- a/pkgs/tools/security/scallion/default.nix
+++ b/pkgs/tools/security/scallion/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, makeWrapper, mono, openssl_1_0_2, ocl-icd }:
+{ lib, stdenv, fetchFromGitHub, makeWrapper, mono, openssl_1_0_2, ocl-icd }:
 
 stdenv.mkDerivation rec {
   version = "2.1";
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
       --add-flags $out/share/scallion.exe
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "GPU-based tor hidden service name generator";
     homepage = src.meta.homepage;
     license = licenses.mit;
diff --git a/pkgs/tools/security/scrypt/default.nix b/pkgs/tools/security/scrypt/default.nix
index e230b2ee457..89ff50e0a8a 100644
--- a/pkgs/tools/security/scrypt/default.nix
+++ b/pkgs/tools/security/scrypt/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, openssl, util-linux, getconf }:
+{ lib, stdenv, fetchurl, openssl, util-linux, getconf }:
 
 stdenv.mkDerivation rec {
   pname = "scrypt";
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
   checkTarget = "test";
   checkInputs = [ util-linux ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Encryption utility";
     homepage    = "https://www.tarsnap.com/scrypt.html";
     license     = licenses.bsd2;
diff --git a/pkgs/tools/security/secp256k1/default.nix b/pkgs/tools/security/secp256k1/default.nix
index d3b43d6adf6..55b02d7a8c3 100644
--- a/pkgs/tools/security/secp256k1/default.nix
+++ b/pkgs/tools/security/secp256k1/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, autoreconfHook, jdk
+{ lib, stdenv, fetchFromGitHub, autoreconfHook, jdk
 
 # Enable ECDSA pubkey recovery module
 , enableRecovery ? true
@@ -42,7 +42,7 @@ stdenv.mkDerivation {
   doCheck = true;
   checkPhase = "./tests";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Optimized C library for EC operations on curve secp256k1";
     longDescription = ''
       Optimized C library for EC operations on curve secp256k1. Part of
diff --git a/pkgs/tools/security/sedutil/default.nix b/pkgs/tools/security/sedutil/default.nix
index 4877a8adfce..6ed4a23af1d 100644
--- a/pkgs/tools/security/sedutil/default.nix
+++ b/pkgs/tools/security/sedutil/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, autoreconfHook }:
+{ lib, stdenv, fetchFromGitHub, autoreconfHook }:
 
 stdenv.mkDerivation rec {
   pname = "sedutil";
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "DTA sedutil Self encrypting drive software";
     homepage    = "https://www.drivetrust.com";
     license     = licenses.gpl3;
diff --git a/pkgs/tools/security/sequoia/default.nix b/pkgs/tools/security/sequoia/default.nix
index 201b4c56f2b..706c9edc481 100644
--- a/pkgs/tools/security/sequoia/default.nix
+++ b/pkgs/tools/security/sequoia/default.nix
@@ -97,7 +97,7 @@ rustPlatform.buildRustPackage rec {
   checkPhase = null;
   installPhase = null;
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A cool new OpenPGP implementation";
     homepage = "https://sequoia-pgp.org/";
     license = licenses.gpl3;
diff --git a/pkgs/tools/security/sha1collisiondetection/default.nix b/pkgs/tools/security/sha1collisiondetection/default.nix
index 8c6a026a612..07c9ed9b240 100644
--- a/pkgs/tools/security/sha1collisiondetection/default.nix
+++ b/pkgs/tools/security/sha1collisiondetection/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, libtool, which }:
+{ lib, stdenv, fetchFromGitHub, libtool, which }:
 
 stdenv.mkDerivation  rec {
   pname = "sha1collisiondetection";
@@ -17,7 +17,7 @@ stdenv.mkDerivation  rec {
 
   nativeBuildInputs = [ libtool which ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Library and command line tool to detect SHA-1 collision";
     longDescription = ''
       This library and command line tool were designed as near drop-in
diff --git a/pkgs/tools/security/shc/default.nix b/pkgs/tools/security/shc/default.nix
index 3705d2c7ed1..f9bdf66ed86 100644
--- a/pkgs/tools/security/shc/default.nix
+++ b/pkgs/tools/security/shc/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub }:
+{ lib, stdenv, fetchFromGitHub }:
 
 stdenv.mkDerivation rec {
   pname = "shc";
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     sha256 = "0bfn404plsssa14q89k9l3s5lxq3df0sny5lis4j2w75qrkqx694";
   };
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "https://neurobin.org/projects/softwares/unix/shc/";
     description = "Shell Script Compiler";
     platforms = stdenv.lib.platforms.linux;
diff --git a/pkgs/tools/security/signify/default.nix b/pkgs/tools/security/signify/default.nix
index 3ec260a7c0c..1b59db540a2 100644
--- a/pkgs/tools/security/signify/default.nix
+++ b/pkgs/tools/security/signify/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, libbsd, pkgconfig }:
+{ lib, stdenv, fetchFromGitHub, libbsd, pkgconfig }:
 
 stdenv.mkDerivation rec {
   pname = "signify";
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
     export PREFIX=$out
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "OpenBSD signing tool";
     longDescription = ''
       OpenBSDs signing tool, which uses the Ed25519 public key signature system
diff --git a/pkgs/tools/security/signing-party/default.nix b/pkgs/tools/security/signing-party/default.nix
index 17c65d28884..c2a51f3bdf5 100644
--- a/pkgs/tools/security/signing-party/default.nix
+++ b/pkgs/tools/security/signing-party/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitLab, autoconf, automake, makeWrapper
+{ lib, stdenv, fetchFromGitLab, autoconf, automake, makeWrapper
 , python3, perl, perlPackages
 , libmd, gnupg, which, getopt, libpaper, nettools, qprint
 , sendmailPath ? "/run/wrappers/bin/sendmail" }:
@@ -196,7 +196,7 @@ in stdenv.mkDerivation rec {
       ${with perlPackages; makePerlPath [ GD ]}
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "https://salsa.debian.org/signing-party-team/signing-party";
     description = "A collection of several projects relating to OpenPGP";
     longDescription = ''
diff --git a/pkgs/tools/security/simple-tpm-pk11/default.nix b/pkgs/tools/security/simple-tpm-pk11/default.nix
index 2a360b4321c..4d5c020ad42 100644
--- a/pkgs/tools/security/simple-tpm-pk11/default.nix
+++ b/pkgs/tools/security/simple-tpm-pk11/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, trousers, openssl, opencryptoki, autoreconfHook, libtool }:
+{ lib, stdenv, fetchFromGitHub, trousers, openssl, opencryptoki, autoreconfHook, libtool }:
 
 stdenv.mkDerivation rec {
   pname = "simple-tpm-pk11";
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Simple PKCS11 provider for TPM chips";
     longDescription = ''
       A simple library for using the TPM chip to secure SSH keys.
diff --git a/pkgs/tools/security/snow/default.nix b/pkgs/tools/security/snow/default.nix
index db52d853b7a..6d264c09ade 100644
--- a/pkgs/tools/security/snow/default.nix
+++ b/pkgs/tools/security/snow/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl }:
+{ lib, stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
   pname = "snow";
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
     install -Dm755 snow -t $out/bin
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Conceal messages in ASCII text by appending whitespace to the end of lines";
     homepage = "http://www.darkside.com.au/snow/";
     license = licenses.apsl20;
diff --git a/pkgs/tools/security/softhsm/default.nix b/pkgs/tools/security/softhsm/default.nix
index 61afb9082d0..5ba0bd11f82 100644
--- a/pkgs/tools/security/softhsm/default.nix
+++ b/pkgs/tools/security/softhsm/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, botan2, libobjc, Security }:
+{ lib, stdenv, fetchurl, botan2, libobjc, Security }:
 
 stdenv.mkDerivation rec {
 
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
 
   postInstall = "rm -rf $out/var";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "https://www.opendnssec.org/softhsm";
     description = "Cryptographic store accessible through a PKCS #11 interface";
     longDescription = "
diff --git a/pkgs/tools/security/sops/default.nix b/pkgs/tools/security/sops/default.nix
index 7557fa6a6d3..9eddc308a4f 100644
--- a/pkgs/tools/security/sops/default.nix
+++ b/pkgs/tools/security/sops/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub }:
+{ lib, stdenv, buildGoModule, fetchFromGitHub }:
 
 buildGoModule rec {
   pname = "sops";
@@ -15,7 +15,7 @@ buildGoModule rec {
 
   doCheck = false;
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "https://github.com/mozilla/sops";
     description = "Mozilla sops (Secrets OPerationS) is an editor of encrypted files";
     maintainers = [ maintainers.marsam ];
diff --git a/pkgs/tools/security/spectre-meltdown-checker/default.nix b/pkgs/tools/security/spectre-meltdown-checker/default.nix
index b8f4eeea338..53797ef9851 100644
--- a/pkgs/tools/security/spectre-meltdown-checker/default.nix
+++ b/pkgs/tools/security/spectre-meltdown-checker/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, makeWrapper, coreutils, binutils-unwrapped }:
+{ lib, stdenv, fetchFromGitHub, makeWrapper, coreutils, binutils-unwrapped }:
 
 stdenv.mkDerivation rec {
   pname = "spectre-meltdown-checker";
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Spectre & Meltdown vulnerability/mitigation checker for Linux";
     homepage = "https://github.com/speed47/spectre-meltdown-checker";
     license = licenses.gpl3;
diff --git a/pkgs/tools/security/srm/default.nix b/pkgs/tools/security/srm/default.nix
index 853ad4f280a..587d7782e76 100644
--- a/pkgs/tools/security/srm/default.nix
+++ b/pkgs/tools/security/srm/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl }:
+{ lib, stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
 
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     sha256 = "10sjarhprs6s4zandndg720528rcnd4xk8dl48pjj7li1q9c30vm";
   };
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Delete files securely";
     longDescription = ''
       srm (secure rm) is a command-line compatible rm(1) which
diff --git a/pkgs/tools/security/sshguard/default.nix b/pkgs/tools/security/sshguard/default.nix
index 6bae0fddc23..88e726bc863 100644
--- a/pkgs/tools/security/sshguard/default.nix
+++ b/pkgs/tools/security/sshguard/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, autoreconfHook, yacc, flex}:
+{ lib, stdenv, fetchurl, autoreconfHook, yacc, flex}:
 
 stdenv.mkDerivation rec {
   version = "2.4.1";
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--sysconfdir=/etc" ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Protects hosts from brute-force attacks";
     longDescription = ''
       SSHGuard can read log messages from various input sources. Log messages are parsed, line-by-line, for recognized patterns.
diff --git a/pkgs/tools/security/sshuttle/default.nix b/pkgs/tools/security/sshuttle/default.nix
index 6f620904872..4a24e459697 100644
--- a/pkgs/tools/security/sshuttle/default.nix
+++ b/pkgs/tools/security/sshuttle/default.nix
@@ -1,4 +1,4 @@
-{ stdenv
+{ lib, stdenv
 , python3Packages
 , makeWrapper
 , coreutils
@@ -30,7 +30,7 @@ python3Packages.buildPythonApplication rec {
       --prefix PATH : "${stdenv.lib.makeBinPath runtimeDeps}" \
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "https://github.com/sshuttle/sshuttle/";
     description = "Transparent proxy server that works as a poor man's VPN";
     longDescription = ''
diff --git a/pkgs/tools/security/sslscan/default.nix b/pkgs/tools/security/sslscan/default.nix
index 68efa7a17d1..fcf9c4c1ac2 100644
--- a/pkgs/tools/security/sslscan/default.nix
+++ b/pkgs/tools/security/sslscan/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, openssl }:
+{ lib, stdenv, fetchFromGitHub, openssl }:
 
 stdenv.mkDerivation rec {
   pname = "sslscan";
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "PREFIX=$(out)" "CC=cc" ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Tests SSL/TLS services and discover supported cipher suites";
     homepage = "https://github.com/rbsec/sslscan";
     license = licenses.gpl3;
diff --git a/pkgs/tools/security/steghide/default.nix b/pkgs/tools/security/steghide/default.nix
index 5ac40e0a047..cb2a0473cf1 100644
--- a/pkgs/tools/security/steghide/default.nix
+++ b/pkgs/tools/security/steghide/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, libjpeg, libmcrypt, zlib, libmhash, gettext, libtool}:
+{ lib, stdenv, fetchurl, libjpeg, libmcrypt, zlib, libmhash, gettext, libtool}:
 
 stdenv.mkDerivation rec {
   buildInputs = [ libjpeg libmcrypt zlib libmhash gettext libtool ];
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     export AM_CXXFLAGS="$CXXFLAGS -std=c++0x"
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "http://steghide.sourceforge.net/";
     description = "Steganography program that is able to hide data in various kinds of image- and audio-files";
     license = licenses.gpl2;
diff --git a/pkgs/tools/security/stegseek/default.nix b/pkgs/tools/security/stegseek/default.nix
index b3d518a719f..d2fb825b529 100644
--- a/pkgs/tools/security/stegseek/default.nix
+++ b/pkgs/tools/security/stegseek/default.nix
@@ -1,4 +1,4 @@
-{ stdenv
+{ lib, stdenv
 , cmake
 , fetchFromGitHub
 , libjpeg
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Tool to crack steganography";
     longDescription = ''
       Stegseek is a lightning fast steghide cracker that can be
diff --git a/pkgs/tools/security/stoken/default.nix b/pkgs/tools/security/stoken/default.nix
index 22dc5e476e7..497d3816a76 100644
--- a/pkgs/tools/security/stoken/default.nix
+++ b/pkgs/tools/security/stoken/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, autoconf, automake, libtool, pkgconfig
+{ lib, stdenv, fetchFromGitHub, autoconf, automake, libtool, pkgconfig
 , libxml2, nettle
 , withGTK3 ? true, gtk3 }:
 
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
     libxml2 nettle
   ] ++ stdenv.lib.optional withGTK3 gtk3;
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Software Token for Linux/UNIX";
     homepage = "https://github.com/cernekee/stoken";
     license = licenses.lgpl21Plus;
diff --git a/pkgs/tools/security/su-exec/default.nix b/pkgs/tools/security/su-exec/default.nix
index 8ff33ee1ec9..0e26d2430cb 100644
--- a/pkgs/tools/security/su-exec/default.nix
+++ b/pkgs/tools/security/su-exec/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub }:
+{ lib, stdenv, fetchFromGitHub }:
 
 stdenv.mkDerivation rec {
   pname = "su-exec";
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     cp -a su-exec $out/bin/su-exec
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "switch user and group id and exec";
     homepage    = "https://github.com/ncopa/su-exec";
     license     = licenses.mit;
diff --git a/pkgs/tools/security/subjs/default.nix b/pkgs/tools/security/subjs/default.nix
index ad10ef5eaf2..5b9a237d49c 100644
--- a/pkgs/tools/security/subjs/default.nix
+++ b/pkgs/tools/security/subjs/default.nix
@@ -1,6 +1,6 @@
 { buildGoModule
 , fetchFromGitHub
-, stdenv
+, lib, stdenv
 }:
 
 buildGoModule rec {
@@ -18,7 +18,7 @@ buildGoModule rec {
 
   buildFlagsArray = [ "-ldflags=-s -w -X main.AppVersion=${version}" ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Fetcher for Javascript files";
     longDescription = ''
       subjs fetches Javascript files from a list of URLs or subdomains.
diff --git a/pkgs/tools/security/sudolikeaboss/default.nix b/pkgs/tools/security/sudolikeaboss/default.nix
index 639926578c7..a1376463823 100644
--- a/pkgs/tools/security/sudolikeaboss/default.nix
+++ b/pkgs/tools/security/sudolikeaboss/default.nix
@@ -1,5 +1,5 @@
 # This file was generated by go2nix, then modified by hand for Darwin support.
-{ stdenv, buildGoPackage, fetchFromGitHub, darwin }:
+{ lib, stdenv, buildGoPackage, fetchFromGitHub, darwin }:
 
 buildGoPackage rec {
   pname = "sudolikeaboss-unstable";
@@ -21,7 +21,7 @@ buildGoPackage rec {
     Cocoa
   ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     inherit version;
     inherit (src.meta) homepage;
     description = "Get 1password access from iterm2";
diff --git a/pkgs/tools/security/tboot/default.nix b/pkgs/tools/security/tboot/default.nix
index 38f467fb441..bf13fe7822e 100644
--- a/pkgs/tools/security/tboot/default.nix
+++ b/pkgs/tools/security/tboot/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, trousers, openssl, zlib }:
+{ lib, stdenv, fetchurl, trousers, openssl, zlib }:
 
 stdenv.mkDerivation rec {
   pname = "tboot";
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
 
   installFlags = [ "DESTDIR=$(out)" ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A pre-kernel/VMM module that uses Intel(R) TXT to perform a measured and verified launch of an OS kernel/VMM";
     homepage    = "https://sourceforge.net/projects/tboot/";
     license     = licenses.bsd3;
diff --git a/pkgs/tools/security/teler/default.nix b/pkgs/tools/security/teler/default.nix
index 37866375859..1acb9e5609e 100644
--- a/pkgs/tools/security/teler/default.nix
+++ b/pkgs/tools/security/teler/default.nix
@@ -1,6 +1,6 @@
 { buildGoModule
 , fetchFromGitHub
-, stdenv
+, lib, stdenv
 }:
 
 buildGoModule rec {
@@ -19,7 +19,7 @@ buildGoModule rec {
   # test require internet access
   doCheck = false;
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Real-time HTTP Intrusion Detection";
     longDescription = ''
       teler is an real-time intrusion detection and threat alert
diff --git a/pkgs/tools/security/thc-hydra/default.nix b/pkgs/tools/security/thc-hydra/default.nix
index f83d2675c6a..81086e77483 100644
--- a/pkgs/tools/security/thc-hydra/default.nix
+++ b/pkgs/tools/security/thc-hydra/default.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
       --add-flags --hydra-path --add-flags "$out/bin/hydra"
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A very fast network logon cracker which support many different services";
     homepage = "https://www.thc.org/thc-hydra/";
     license = licenses.agpl3;
diff --git a/pkgs/tools/security/thc-ipv6/default.nix b/pkgs/tools/security/thc-ipv6/default.nix
index b8175ef6dba..6e7f4fb2891 100644
--- a/pkgs/tools/security/thc-ipv6/default.nix
+++ b/pkgs/tools/security/thc-ipv6/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, libpcap, openssl, libnetfilter_queue, libnfnetlink }:
+{ lib, stdenv, fetchFromGitHub, libpcap, openssl, libnetfilter_queue, libnfnetlink }:
 stdenv.mkDerivation rec {
   pname = "thc-ipv6";
   version = "3.8";
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     "PREFIX=$(out)"
   ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "IPv6 attack toolkit";
     homepage = "https://github.com/vanhauser-thc/thc-ipv6";
     maintainers = with maintainers; [ ajs124 ];
diff --git a/pkgs/tools/security/tor/default.nix b/pkgs/tools/security/tor/default.nix
index e46fd4790a3..038f4040d31 100644
--- a/pkgs/tools/security/tor/default.nix
+++ b/pkgs/tools/security/tor/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, libevent, openssl, zlib, torsocks
+{ lib, stdenv, fetchurl, pkgconfig, libevent, openssl, zlib, torsocks
 , libseccomp, systemd, libcap, lzma, zstd, scrypt, nixosTests
 , writeShellScript
 
@@ -88,7 +88,7 @@ stdenv.mkDerivation rec {
     };
   };
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "https://www.torproject.org/";
     repositories.git = "https://git.torproject.org/git/tor";
     description = "Anonymizing overlay network";
diff --git a/pkgs/tools/security/tpm-luks/default.nix b/pkgs/tools/security/tpm-luks/default.nix
index fc1931fa4ba..25e28f15831 100644
--- a/pkgs/tools/security/tpm-luks/default.nix
+++ b/pkgs/tools/security/tpm-luks/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchgit, autoreconfHook, gawk, trousers, cryptsetup, openssl }:
+{ lib, stdenv, fetchgit, autoreconfHook, gawk, trousers, cryptsetup, openssl }:
 
 stdenv.mkDerivation {
   pname = "tpm-luks";
@@ -25,7 +25,7 @@ stdenv.mkDerivation {
     rm -r $out/nix
     '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "LUKS key storage in TPM NVRAM";
     homepage    = "https://github.com/shpedoikal/tpm-luks/";
     maintainers = [ maintainers.tstrobel ];
diff --git a/pkgs/tools/security/tpm-quote-tools/default.nix b/pkgs/tools/security/tpm-quote-tools/default.nix
index a652867a0d0..94da17fabec 100644
--- a/pkgs/tools/security/tpm-quote-tools/default.nix
+++ b/pkgs/tools/security/tpm-quote-tools/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, trousers, openssl }:
+{ lib, stdenv, fetchurl, trousers, openssl }:
 
 stdenv.mkDerivation rec { 
   pname = "tpm-quote-tools";
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
       $out/bin/tpm_mkaik
   '';
 
-  meta = with stdenv.lib; { 
+  meta = with lib; { 
     description = "A collection of programs that provide support for TPM based attestation using the TPM quote mechanism";
     longDescription = ''
       The TPM Quote Tools is a collection of programs that provide support
diff --git a/pkgs/tools/security/tpm-tools/default.nix b/pkgs/tools/security/tpm-tools/default.nix
index 5e0b4e6d94f..c0e2941323a 100644
--- a/pkgs/tools/security/tpm-tools/default.nix
+++ b/pkgs/tools/security/tpm-tools/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, trousers, openssl, opencryptoki, perl }:
+{ lib, stdenv, fetchurl, trousers, openssl, opencryptoki, perl }:
 
 let
   version = "1.3.9.1";
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ perl ];
   buildInputs = [ trousers openssl opencryptoki ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Management tools for TPM hardware";
     longDescription = ''
       tpm-tools is an open-source package designed to enable user and
diff --git a/pkgs/tools/security/trousers/default.nix b/pkgs/tools/security/trousers/default.nix
index 2cc702cf6f2..76a3443d076 100644
--- a/pkgs/tools/security/trousers/default.nix
+++ b/pkgs/tools/security/trousers/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, openssl, pkgconfig }:
+{ lib, stdenv, fetchurl, openssl, pkgconfig }:
 
 stdenv.mkDerivation rec {
   pname = "trousers";
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   NIX_CFLAGS_COMPILE = [ "-DALLOW_NON_TSS_CONFIG_FILE" ];
   enableParallelBuilding = true;
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Trusted computing software stack";
     homepage    = "http://trousers.sourceforge.net/";
     license     = licenses.bsd3;
diff --git a/pkgs/tools/security/urlhunter/default.nix b/pkgs/tools/security/urlhunter/default.nix
index 239eabbe8b3..3364b622ad6 100644
--- a/pkgs/tools/security/urlhunter/default.nix
+++ b/pkgs/tools/security/urlhunter/default.nix
@@ -1,6 +1,6 @@
 { buildGoModule
 , fetchFromGitHub
-, stdenv
+, lib, stdenv
 }:
 
 buildGoModule rec {
@@ -16,7 +16,7 @@ buildGoModule rec {
 
   vendorSha256 = "165kplaqigis0anafvzfqzwc3jjhsn2mwgf4phb4ck75n3yf85ys";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Recon tool that allows searching shortened URLs";
     longDescription = ''
       urlhunter is a recon tool that allows searching on URLs that are
diff --git a/pkgs/tools/security/vault/default.nix b/pkgs/tools/security/vault/default.nix
index d1d16a89d46..3af00b9a22b 100644
--- a/pkgs/tools/security/vault/default.nix
+++ b/pkgs/tools/security/vault/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, buildGoPackage, installShellFiles, nixosTests }:
+{ lib, stdenv, fetchFromGitHub, buildGoPackage, installShellFiles, nixosTests }:
 
 buildGoPackage rec {
   pname = "vault";
@@ -26,7 +26,7 @@ buildGoPackage rec {
 
   passthru.tests.vault = nixosTests.vault;
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "https://www.vaultproject.io/";
     description = "A tool for managing secrets";
     changelog = "https://github.com/hashicorp/vault/blob/v${version}/CHANGELOG.md";
diff --git a/pkgs/tools/security/vault/vault-bin.nix b/pkgs/tools/security/vault/vault-bin.nix
index 01bb80f518a..775bd8c6951 100644
--- a/pkgs/tools/security/vault/vault-bin.nix
+++ b/pkgs/tools/security/vault/vault-bin.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, unzip }:
+{ lib, stdenv, fetchurl, unzip }:
 
 let
   version = "1.6.1";
@@ -40,7 +40,7 @@ in stdenv.mkDerivation {
     echo "complete -C $out/bin/vault vault" > $out/share/bash-completion/completions/vault
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "https://www.vaultproject.io";
     description = "A tool for managing secrets, this binary includes the UI";
     platforms = [ "x86_64-linux" "i686-linux" "x86_64-darwin" "aarch64-linux" ];
diff --git a/pkgs/tools/security/volatility/default.nix b/pkgs/tools/security/volatility/default.nix
index 4f1e90eb910..8ffdfc4e2b0 100644
--- a/pkgs/tools/security/volatility/default.nix
+++ b/pkgs/tools/security/volatility/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, pythonPackages }:
+{ lib, stdenv, fetchFromGitHub, pythonPackages }:
 
 pythonPackages.buildPythonApplication rec {
   pname = "volatility";
@@ -15,7 +15,7 @@ pythonPackages.buildPythonApplication rec {
 
   propagatedBuildInputs = [ pythonPackages.pycrypto pythonPackages.distorm3 ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "https://www.volatilityfoundation.org/";
     description = "Advanced memory forensics framework";
     maintainers = with maintainers; [ bosu ];
diff --git a/pkgs/tools/security/vulnix/default.nix b/pkgs/tools/security/vulnix/default.nix
index d4a3a0c621a..e95adf3e1e6 100644
--- a/pkgs/tools/security/vulnix/default.nix
+++ b/pkgs/tools/security/vulnix/default.nix
@@ -1,4 +1,4 @@
-{ stdenv
+{ lib, stdenv
 , python3Packages
 , nix
 , ronn
@@ -48,7 +48,7 @@ python3Packages.buildPythonApplication rec {
 
   dontStrip = true;
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "NixOS vulnerability scanner";
     homepage = "https://github.com/flyingcircusio/vulnix";
     license = licenses.bsd3;
diff --git a/pkgs/tools/security/wipe/default.nix b/pkgs/tools/security/wipe/default.nix
index 6b84803d2c4..2c3c9376f67 100644
--- a/pkgs/tools/security/wipe/default.nix
+++ b/pkgs/tools/security/wipe/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl }:
+{ lib, stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
   pname = "wipe";
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   patches = [ ./fix-install.patch ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Secure file wiping utility";
     homepage    = "http://wipe.sourceforge.net/";
     license     = licenses.gpl2;
diff --git a/pkgs/tools/security/yara/default.nix b/pkgs/tools/security/yara/default.nix
index 8a119535023..19d409e03ee 100644
--- a/pkgs/tools/security/yara/default.nix
+++ b/pkgs/tools/security/yara/default.nix
@@ -1,4 +1,4 @@
-{ stdenv
+{ lib, stdenv
 , fetchFromGitHub
 , autoreconfHook
 , pcre
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
     (stdenv.lib.enableFeature enableCuckoo "cuckoo")
   ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "The pattern matching swiss knife for malware researchers";
     homepage = "http://Virustotal.github.io/yara/";
     license = licenses.asl20;
diff --git a/pkgs/tools/security/zmap/default.nix b/pkgs/tools/security/zmap/default.nix
index e2350b67c7d..fdcb5ed5ce9 100644
--- a/pkgs/tools/security/zmap/default.nix
+++ b/pkgs/tools/security/zmap/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, cmake, pkgconfig, libjson, json_c, gengetopt, flex, byacc, gmp
+{ lib, stdenv, fetchFromGitHub, cmake, pkgconfig, libjson, json_c, gengetopt, flex, byacc, gmp
 , libpcap
 }:
 
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "man" ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "https://zmap.io/";
     license = licenses.asl20;
     description = "Fast single packet network scanner designed for Internet-wide network surveys";
diff --git a/pkgs/tools/security/zzuf/default.nix b/pkgs/tools/security/zzuf/default.nix
index 428f1ec1d09..e7d12d8a68e 100644
--- a/pkgs/tools/security/zzuf/default.nix
+++ b/pkgs/tools/security/zzuf/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, autoconf, automake, libtool, pkgconfig }:
+{ lib, stdenv, fetchFromGitHub, autoconf, automake, libtool, pkgconfig }:
 
 stdenv.mkDerivation rec {
   pname = "zzuf";
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   preConfigure = "./bootstrap";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Transparent application input fuzzer";
     homepage = "http://caca.zoy.org/wiki/zzuf";
     license = licenses.wtfpl;