treewide: remove global with lib; in pkgs/tools

46 files changed, 153 insertions, 235 deletions

diff --git a/pkgs/tools/X11/xpra/default.nix b/pkgs/tools/X11/xpra/default.nix
index 05a36726c0c..2f793e31808 100644
--- a/pkgs/tools/X11/xpra/default.nix
+++ b/pkgs/tools/X11/xpra/default.nix
@@ -36,8 +36,6 @@
 , xorgserver
 }:
 
-with lib;
-
 let
   inherit (python3.pkgs) cython buildPythonApplication;
 
@@ -206,7 +204,7 @@ in buildPythonApplication rec {
     updateScript = ./update.sh;
   };
 
-  meta = {
+  meta = with lib; {
     homepage = "https://xpra.org/";
     downloadPage = "https://xpra.org/src/";
     description = "Persistent remote applications for X";
diff --git a/pkgs/tools/admin/pulumi-bin/default.nix b/pkgs/tools/admin/pulumi-bin/default.nix
index 71c61d7a054..9f2f7bd6c71 100644
--- a/pkgs/tools/admin/pulumi-bin/default.nix
+++ b/pkgs/tools/admin/pulumi-bin/default.nix
@@ -1,7 +1,5 @@
 { lib, stdenv, fetchurl, autoPatchelfHook, makeWrapper, installShellFiles }:
 
-with lib;
-
 let
   data = import ./data.nix {};
 in stdenv.mkDerivation {
@@ -16,7 +14,7 @@ in stdenv.mkDerivation {
 
   installPhase = ''
     install -D -t $out/bin/ *
-  '' + optionalString stdenv.isLinux ''
+  '' + lib.optionalString stdenv.isLinux ''
     wrapProgram $out/bin/pulumi --set LD_LIBRARY_PATH "${stdenv.cc.cc.lib}/lib"
   '' + ''
     installShellCompletion --cmd pulumi \
@@ -25,9 +23,9 @@ in stdenv.mkDerivation {
       --zsh  <($out/bin/pulumi completion zsh)
   '';
 
-  nativeBuildInputs = [ installShellFiles ] ++ optionals stdenv.isLinux [ autoPatchelfHook makeWrapper ];
+  nativeBuildInputs = [ installShellFiles ] ++ lib.optionals stdenv.isLinux [ autoPatchelfHook makeWrapper ];
 
-  meta = {
+  meta = with lib; {
     homepage = "https://pulumi.io/";
     description = "Pulumi is a cloud development platform that makes creating cloud programs easy and productive";
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
diff --git a/pkgs/tools/admin/tigervnc/default.nix b/pkgs/tools/admin/tigervnc/default.nix
index 724301854b4..e4933986176 100644
--- a/pkgs/tools/admin/tigervnc/default.nix
+++ b/pkgs/tools/admin/tigervnc/default.nix
@@ -23,8 +23,6 @@
 , nixosTests
 }:
 
-with lib;
-
 stdenv.mkDerivation rec {
   version = "1.12.0";
   pname = "tigervnc";
diff --git a/pkgs/tools/backup/bup/default.nix b/pkgs/tools/backup/bup/default.nix
index 072166f7a5b..86e598ff600 100644
--- a/pkgs/tools/backup/bup/default.nix
+++ b/pkgs/tools/backup/bup/default.nix
@@ -7,8 +7,6 @@ assert par2Support -> par2cmdline != null;
 
 let version = "0.32"; in
 
-with lib;
-
 stdenv.mkDerivation {
   pname = "bup";
   inherit version;
@@ -31,7 +29,7 @@ stdenv.mkDerivation {
   postPatch = ''
     patchShebangs .
     substituteInPlace Makefile --replace "-Werror" ""
-  '' + optionalString par2Support ''
+  '' + lib.optionalString par2Support ''
     substituteInPlace cmd/fsck-cmd.py --replace "'par2'" "'${par2cmdline}/bin/par2'"
   '';
 
@@ -49,7 +47,7 @@ stdenv.mkDerivation {
       --prefix PATH : ${git}/bin
   '';
 
-  meta = {
+  meta = with lib; {
     homepage = "https://github.com/bup/bup";
     description = "Efficient file backup system based on the git packfile format";
     license = licenses.gpl2Plus;
diff --git a/pkgs/tools/backup/luckybackup/default.nix b/pkgs/tools/backup/luckybackup/default.nix
index ad2e237b3fb..61c0c186fe2 100644
--- a/pkgs/tools/backup/luckybackup/default.nix
+++ b/pkgs/tools/backup/luckybackup/default.nix
@@ -3,7 +3,6 @@
 , rsync, ssh
 }:
 
-with lib;
 mkDerivation rec {
   pname = "luckybackup";
   version = "0.5.0";
@@ -26,7 +25,7 @@ mkDerivation rec {
     done
   '';
 
-  meta = {
+  meta = with lib; {
     description = "A powerful, fast and reliable backup & sync tool";
     longDescription = ''
       luckyBackup is an application for data back-up and synchronization
diff --git a/pkgs/tools/bluetooth/bluez-alsa/default.nix b/pkgs/tools/bluetooth/bluez-alsa/default.nix
index e10c82d7201..da87a7b89e5 100644
--- a/pkgs/tools/bluetooth/bluez-alsa/default.nix
+++ b/pkgs/tools/bluetooth/bluez-alsa/default.nix
@@ -9,8 +9,6 @@
 # TODO: aptxSupport
 }:
 
-with lib;
-
 stdenv.mkDerivation rec {
   pname = "bluez-alsa";
   version = "4.0.0";
@@ -28,7 +26,7 @@ stdenv.mkDerivation rec {
     alsa-lib bluez glib sbc dbus
     readline libbsd ncurses
   ]
-  ++ optional aacSupport fdk_aac;
+  ++ lib.optional aacSupport fdk_aac;
 
   configureFlags = [
     "--with-alsaplugindir=${placeholder "out"}/lib/alsa-lib"
@@ -36,9 +34,9 @@ stdenv.mkDerivation rec {
     "--enable-rfcomm"
     "--enable-hcitop"
   ]
-  ++ optional aacSupport "--enable-aac";
+  ++ lib.optional aacSupport "--enable-aac";
 
-  meta = {
+  meta = with lib; {
     description = "Bluez 5 Bluetooth Audio ALSA Backend";
     longDescription = ''
       Bluez-ALSA (BlueALSA) is an ALSA backend for Bluez 5 audio interface.
diff --git a/pkgs/tools/filesystems/squashfuse/default.nix b/pkgs/tools/filesystems/squashfuse/default.nix
index 1b4033ea695..dba2a474ccc 100644
--- a/pkgs/tools/filesystems/squashfuse/default.nix
+++ b/pkgs/tools/filesystems/squashfuse/default.nix
@@ -1,8 +1,6 @@
 { lib, stdenv, fetchFromGitHub, autoreconfHook, libtool, fuse,
   pkg-config, lz4, xz, zlib, lzo, zstd }:
 
-with lib;
-
 stdenv.mkDerivation rec {
 
   pname = "squashfuse";
@@ -22,7 +20,7 @@ stdenv.mkDerivation rec {
     description = "FUSE filesystem to mount squashfs archives";
     homepage = "https://github.com/vasi/squashfuse";
     maintainers = [  ];
-    platforms = platforms.unix;
+    platforms = lib.platforms.unix;
     license = "BSD-2-Clause";
   };
 }
diff --git a/pkgs/tools/graphics/gifsicle/default.nix b/pkgs/tools/graphics/gifsicle/default.nix
index b200f487b23..c21d51dce60 100644
--- a/pkgs/tools/graphics/gifsicle/default.nix
+++ b/pkgs/tools/graphics/gifsicle/default.nix
@@ -3,8 +3,6 @@
 , static ? stdenv.hostPlatform.isStatic
 }:
 
-with lib;
-
 stdenv.mkDerivation rec {
   pname = "gifsicle";
   version = "1.93";
@@ -14,11 +12,11 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-kvZweXMr9MHaCH5q4JBSBYRuWsd3ulyqZtEqc6qUNEc=";
   };
 
-  buildInputs = optionals gifview [ xorgproto libXt libX11 ];
+  buildInputs = lib.optionals gifview [ xorgproto libXt libX11 ];
 
-  configureFlags = optional (!gifview) "--disable-gifview";
+  configureFlags = lib.optional (!gifview) "--disable-gifview";
 
-  LDFLAGS = optionalString static "-static";
+  LDFLAGS = lib.optionalString static "-static";
 
   doCheck = true;
   checkPhase = ''
@@ -29,7 +27,7 @@ stdenv.mkDerivation rec {
     description = "Command-line tool for creating, editing, and getting information about GIF images and animations";
     homepage = "https://www.lcdf.org/gifsicle/";
     license = lib.licenses.gpl2;
-    platforms = platforms.all;
+    platforms = lib.platforms.all;
     maintainers = with lib.maintainers; [ zimbatm ];
   };
 }
diff --git a/pkgs/tools/graphics/ldgallery/viewer/default.nix b/pkgs/tools/graphics/ldgallery/viewer/default.nix
index d1acce2d7f3..bbaed09684e 100644
--- a/pkgs/tools/graphics/ldgallery/viewer/default.nix
+++ b/pkgs/tools/graphics/ldgallery/viewer/default.nix
@@ -1,7 +1,5 @@
 { lib, stdenv, fetchFromGitHub, pkgs, pandoc, CoreServices }:
 
-with lib;
-
 let
   # Note for maintainers:
   # * keep version in sync with the ldgallery compiler
@@ -21,13 +19,13 @@ let
   nodePkg = nodePackages.package.override {
     src = "${sourcePkg}/viewer";
     postInstall = "npm run build";
-    buildInputs = optionals stdenv.isDarwin [ CoreServices ];
+    buildInputs = lib.optionals stdenv.isDarwin [ CoreServices ];
   };
 
 in
 
 # making sure that the source and the node package are in sync
-assert versions.majorMinor nodePkg.version == removePrefix "v" sourcePkg.rev;
+assert lib.versions.majorMinor nodePkg.version == lib.removePrefix "v" sourcePkg.rev;
 
 stdenv.mkDerivation {
   pname = nodePkg.packageName;
diff --git a/pkgs/tools/graphics/optipng/default.nix b/pkgs/tools/graphics/optipng/default.nix
index 7b8ddaf713b..3e9127a9a9a 100644
--- a/pkgs/tools/graphics/optipng/default.nix
+++ b/pkgs/tools/graphics/optipng/default.nix
@@ -4,8 +4,6 @@
 
 # This package comes with its own copy of zlib, libpng and pngxtern
 
-with lib;
-
 stdenv.mkDerivation rec {
   pname = "optipng";
   version = "0.7.7";
@@ -17,7 +15,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ libpng ];
 
-  LDFLAGS = optional static "-static";
+  LDFLAGS = lib.optional static "-static";
   # Workaround for crash in cexcept.h. See
   # https://github.com/NixOS/nixpkgs/issues/28106
   preConfigure = ''
diff --git a/pkgs/tools/graphics/pgf/default.nix b/pkgs/tools/graphics/pgf/default.nix
index 7cac5a8e21b..a2adb7ee61d 100644
--- a/pkgs/tools/graphics/pgf/default.nix
+++ b/pkgs/tools/graphics/pgf/default.nix
@@ -1,6 +1,5 @@
 { lib, stdenv, fetchurl, autoconf, automake, libtool, dos2unix, libpgf, freeimage, doxygen }:
 
-with lib;
 stdenv.mkDerivation rec {
   pname = "pgf";
   version = "6.14.12";
diff --git a/pkgs/tools/inputmethods/ibus/default.nix b/pkgs/tools/inputmethods/ibus/default.nix
index 4037868518f..e3403e334b8 100644
--- a/pkgs/tools/inputmethods/ibus/default.nix
+++ b/pkgs/tools/inputmethods/ibus/default.nix
@@ -34,8 +34,6 @@
 , nixosTests
 }:
 
-with lib;
-
 let
   python3Runtime = python3.withPackages (ps: with ps; [ pygobject3 ]);
   python3BuildEnv = python3.buildEnv.override {
@@ -88,10 +86,10 @@ stdenv.mkDerivation rec {
 
   configureFlags = [
     "--disable-memconf"
-    (enableFeature (dconf != null) "dconf")
-    (enableFeature (libnotify != null) "libnotify")
-    (enableFeature withWayland "wayland")
-    (enableFeature enableUI "ui")
+    (lib.enableFeature (dconf != null) "dconf")
+    (lib.enableFeature (libnotify != null) "libnotify")
+    (lib.enableFeature withWayland "wayland")
+    (lib.enableFeature enableUI "ui")
     "--enable-gtk4"
     "--enable-install-tests"
     "--with-unicode-emoji-dir=${unicode-emoji}/share/unicode/emoji"
@@ -133,7 +131,7 @@ stdenv.mkDerivation rec {
     isocodes
     json-glib
     libnotify
-  ] ++ optionals withWayland [
+  ] ++ lib.optionals withWayland [
     libxkbcommon
     wayland
   ];
@@ -165,7 +163,7 @@ stdenv.mkDerivation rec {
     };
   };
 
-  meta = {
+  meta = with lib; {
     homepage = "https://github.com/ibus/ibus";
     description = "Intelligent Input Bus, input method framework";
     license = licenses.lgpl21Plus;
diff --git a/pkgs/tools/inputmethods/uim/default.nix b/pkgs/tools/inputmethods/uim/default.nix
index e1daecbd10f..cbc978821a0 100644
--- a/pkgs/tools/inputmethods/uim/default.nix
+++ b/pkgs/tools/inputmethods/uim/default.nix
@@ -18,8 +18,6 @@
 , withMisc ? false, libeb ? null
 }:
 
-with lib;
-
 assert withGtk2 -> gtk2 != null;
 assert withGtk3 -> gtk3 != null;
 
@@ -59,18 +57,18 @@ stdenv.mkDerivation rec {
   buildInputs = [
     ncurses m17n_lib m17n_db expat
   ]
-  ++ optional withAnthy anthy
-  ++ optional withGtk2 gtk2
-  ++ optional withGtk3 gtk3
-  ++ optional withQt4 qt4
-  ++ optionals withQt5 [ qt5.qtbase.bin qt5.qtbase.dev ]
-  ++ optional withLibnotify libnotify
-  ++ optional withSqlite sqlite
-  ++ optionals withNetworking [
+  ++ lib.optional withAnthy anthy
+  ++ lib.optional withGtk2 gtk2
+  ++ lib.optional withGtk3 gtk3
+  ++ lib.optional withQt4 qt4
+  ++ lib.optionals withQt5 [ qt5.qtbase.bin qt5.qtbase.dev ]
+  ++ lib.optional withLibnotify libnotify
+  ++ lib.optional withSqlite sqlite
+  ++ lib.optionals withNetworking [
     curl openssl
   ]
-  ++ optional withFFI libffi
-  ++ optional withMisc libeb;
+  ++ lib.optional withFFI libffi
+  ++ lib.optional withMisc libeb;
 
   prePatch = ''
     patchShebangs *.sh */*.sh */*/*.sh
@@ -113,25 +111,25 @@ stdenv.mkDerivation rec {
     "--with-xft"
     "--with-expat=${expat.dev}"
   ]
-  ++ optional withAnthy "--with-anthy-utf8"
-  ++ optional withGtk2 "--with-gtk2"
-  ++ optional withGtk3 "--with-gtk3"
-  ++ optionals withQt4 [
+  ++ lib.optional withAnthy "--with-anthy-utf8"
+  ++ lib.optional withGtk2 "--with-gtk2"
+  ++ lib.optional withGtk3 "--with-gtk3"
+  ++ lib.optionals withQt4 [
     "--with-qt4"
     "--with-qt4-immodule"
   ]
-  ++ optionals withQt5 [
+  ++ lib.optionals withQt5 [
     "--with-qt5"
     "--with-qt5-immodule"
   ]
-  ++ optional withLibnotify "--enable-notify=libnotify"
-  ++ optional withSqlite "--with-sqlite3"
-  ++ optionals withNetworking [
+  ++ lib.optional withLibnotify "--enable-notify=libnotify"
+  ++ lib.optional withSqlite "--with-sqlite3"
+  ++ lib.optionals withNetworking [
     "--with-curl"
     "--with-openssl-dir=${openssl.dev}"
   ]
-  ++ optional withFFI "--with-ffi"
-  ++ optional withMisc "--with-eb";
+  ++ lib.optional withFFI "--with-ffi"
+  ++ lib.optional withMisc "--with-eb";
 
   # TODO: things in `./configure --help`, but not in nixpkgs
   #--with-canna            Use Canna [default=no]
diff --git a/pkgs/tools/misc/catimg/default.nix b/pkgs/tools/misc/catimg/default.nix
index 3f94a559e61..6230b21c387 100644
--- a/pkgs/tools/misc/catimg/default.nix
+++ b/pkgs/tools/misc/catimg/default.nix
@@ -1,7 +1,5 @@
 { lib, stdenv, fetchFromGitHub, cmake } :
 
-with lib;
-
 stdenv.mkDerivation rec {
   pname = "catimg";
   version = "2.7.0";
@@ -15,7 +13,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
 
-  meta = {
+  meta = with lib; {
     license = licenses.mit;
     homepage = "https://github.com/posva/catimg";
     description = "Insanely fast image printing in your terminal";
diff --git a/pkgs/tools/misc/desktop-file-utils/default.nix b/pkgs/tools/misc/desktop-file-utils/default.nix
index af3e907c04a..597eced414f 100644
--- a/pkgs/tools/misc/desktop-file-utils/default.nix
+++ b/pkgs/tools/misc/desktop-file-utils/default.nix
@@ -1,7 +1,5 @@
 { lib, stdenv, fetchurl, pkg-config, meson, ninja, glib, libintl }:
 
-with lib;
-
 stdenv.mkDerivation rec {
   pname = "desktop-file-utils";
   version = "0.26";
@@ -21,7 +19,7 @@ stdenv.mkDerivation rec {
 
   setupHook = ./setup-hook.sh;
 
-  meta = {
+  meta = with lib; {
     homepage = "http://www.freedesktop.org/wiki/Software/desktop-file-utils";
     description = "Command line utilities for working with .desktop files";
     platforms = platforms.linux ++ platforms.darwin;
diff --git a/pkgs/tools/misc/grub/2.0x.nix b/pkgs/tools/misc/grub/2.0x.nix
index 8c625df390a..ca12c1f2588 100644
--- a/pkgs/tools/misc/grub/2.0x.nix
+++ b/pkgs/tools/misc/grub/2.0x.nix
@@ -13,7 +13,6 @@
 , kbdcompSupport ? false, ckbcomp
 }:
 
-with lib;
 let
   pcSystems = {
     i686-linux.target = "i386";
@@ -40,8 +39,8 @@ let
     riscv64-linux.target = "riscv64";
   };
 
-  canEfi = any (system: stdenv.hostPlatform.system == system) (mapAttrsToList (name: _: name) efiSystemsBuild);
-  inPCSystems = any (system: stdenv.hostPlatform.system == system) (mapAttrsToList (name: _: name) pcSystems);
+  canEfi = lib.any (system: stdenv.hostPlatform.system == system) (lib.mapAttrsToList (name: _: name) efiSystemsBuild);
+  inPCSystems = lib.any (system: stdenv.hostPlatform.system == system) (lib.mapAttrsToList (name: _: name) pcSystems);
 
   version = "2.06";
 
@@ -330,8 +329,8 @@ stdenv.mkDerivation rec {
   depsBuildBuild = [ buildPackages.stdenv.cc ];
   nativeBuildInputs = [ bison flex python3 pkg-config gettext freetype autoreconfHook ];
   buildInputs = [ ncurses libusb-compat-0_1 freetype lvm2 fuse libtool bash ]
-    ++ optional doCheck qemu
-    ++ optional zfsSupport zfs;
+    ++ lib.optional doCheck qemu
+    ++ lib.optional zfsSupport zfs;
 
   strictDeps = true;
 
@@ -369,7 +368,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [
     "--enable-grub-mount" # dep of os-prober
-  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+  ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     # grub doesn't do cross-compilation as usual and tries to use unprefixed
     # tools to target the host. Provide toolchain information explicitly for
     # cross builds.
@@ -380,9 +379,9 @@ stdenv.mkDerivation rec {
     "TARGET_OBJCOPY=${stdenv.cc.targetPrefix}objcopy"
     "TARGET_RANLIB=${stdenv.cc.targetPrefix}ranlib"
     "TARGET_STRIP=${stdenv.cc.targetPrefix}strip"
-  ] ++ optional zfsSupport "--enable-libzfs"
-    ++ optionals efiSupport [ "--with-platform=efi" "--target=${efiSystemsBuild.${stdenv.hostPlatform.system}.target}" "--program-prefix=" ]
-    ++ optionals xenSupport [ "--with-platform=xen" "--target=${efiSystemsBuild.${stdenv.hostPlatform.system}.target}"];
+  ] ++ lib.optional zfsSupport "--enable-libzfs"
+    ++ lib.optionals efiSupport [ "--with-platform=efi" "--target=${efiSystemsBuild.${stdenv.hostPlatform.system}.target}" "--program-prefix=" ]
+    ++ lib.optionals xenSupport [ "--with-platform=xen" "--target=${efiSystemsBuild.${stdenv.hostPlatform.system}.target}"];
 
   # save target that grub is compiled for
   grubTarget = if efiSupport
diff --git a/pkgs/tools/misc/grub/pvgrub_image/default.nix b/pkgs/tools/misc/grub/pvgrub_image/default.nix
index d6aba812405..3137c820eea 100644
--- a/pkgs/tools/misc/grub/pvgrub_image/default.nix
+++ b/pkgs/tools/misc/grub/pvgrub_image/default.nix
@@ -1,6 +1,5 @@
 { lib, stdenv, grub2_xen }:
 
-with lib;
 let
   efiSystemsBuild = {
     i686-linux.target = "i386";
diff --git a/pkgs/tools/misc/grub/trusted.nix b/pkgs/tools/misc/grub/trusted.nix
index 4947949ac5b..2d07932dab2 100644
--- a/pkgs/tools/misc/grub/trusted.nix
+++ b/pkgs/tools/misc/grub/trusted.nix
@@ -18,14 +18,13 @@
 , for_HP_laptop ? false
 }:
 
-with lib;
 let
   pcSystems = {
     i686-linux.target = "i386";
     x86_64-linux.target = "i386";
   };
 
-  inPCSystems = any (system: stdenv.hostPlatform.system == system) (mapAttrsToList (name: _: name) pcSystems);
+  inPCSystems = lib.any (system: stdenv.hostPlatform.system == system) (lib.mapAttrsToList (name: _: name) pcSystems);
 
   version = if for_HP_laptop then "1.2.1" else "1.2.0";
 
@@ -59,7 +58,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autogen flex bison python2 autoconf automake ];
   buildInputs = [ ncurses libusb-compat-0_1 freetype gettext lvm2 ]
-    ++ optional doCheck qemu;
+    ++ lib.optional doCheck qemu;
 
   hardeningDisable = [ "stackprotector" "pic" ];
 
diff --git a/pkgs/tools/misc/hexd/default.nix b/pkgs/tools/misc/hexd/default.nix
index e3a3f79f326..510de6a8ee3 100644
--- a/pkgs/tools/misc/hexd/default.nix
+++ b/pkgs/tools/misc/hexd/default.nix
@@ -1,7 +1,5 @@
 { lib, stdenv, fetchFromGitHub }:
 
-with lib;
-
 stdenv.mkDerivation rec {
   pname = "hexd";
   version = "1.1.0";
@@ -15,7 +13,7 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "PREFIX=$(out)" ];
 
-  meta = {
+  meta = with lib; {
     description = "Colourful, human-friendly hexdump tool";
     homepage = "https://github.com/FireyFly/hexd";
     maintainers = [ maintainers.FireyFly ];
diff --git a/pkgs/tools/misc/logstash/6.x.nix b/pkgs/tools/misc/logstash/6.x.nix
index 4de78cf4cbd..ef5d04ee476 100644
--- a/pkgs/tools/misc/logstash/6.x.nix
+++ b/pkgs/tools/misc/logstash/6.x.nix
@@ -7,11 +7,9 @@
 , jre
 }:
 
-with lib;
-
 let this = stdenv.mkDerivation rec {
   version = elk6Version;
-  pname = "logstash${optionalString (!enableUnfree) "-oss"}";
+  pname = "logstash${lib.optionalString (!enableUnfree) "-oss"}";
 
   src = fetchurl {
     url = "https://artifacts.elastic.co/downloads/logstash/${pname}-${version}.tar.gz";
@@ -63,7 +61,7 @@ let this = stdenv.mkDerivation rec {
     maintainers = with maintainers; [ wjlroe offline basvandijk ];
   };
   passthru.tests =
-    optionalAttrs (!enableUnfree) (
+    lib.optionalAttrs (!enableUnfree) (
       assert this.drvPath == nixosTests.elk.ELK-6.elkPackages.logstash.drvPath;
       {
         elk = nixosTests.elk.ELK-6;
diff --git a/pkgs/tools/misc/logstash/7.x.nix b/pkgs/tools/misc/logstash/7.x.nix
index 221c7be83df..cdf810d2a20 100644
--- a/pkgs/tools/misc/logstash/7.x.nix
+++ b/pkgs/tools/misc/logstash/7.x.nix
@@ -9,12 +9,10 @@
 , jre
 }:
 
-with lib;
-
 let
-  info = splitString "-" stdenv.hostPlatform.system;
-  arch = elemAt info 0;
-  plat = elemAt info 1;
+  info = lib.splitString "-" stdenv.hostPlatform.system;
+  arch = lib.elemAt info 0;
+  plat = lib.elemAt info 1;
   shas =
     if enableUnfree
     then {
@@ -29,7 +27,7 @@ let
     };
   this = stdenv.mkDerivation rec {
     version = elk7Version;
-    pname = "logstash${optionalString (!enableUnfree) "-oss"}";
+    pname = "logstash${lib.optionalString (!enableUnfree) "-oss"}";
 
 
     src = fetchurl {
@@ -79,7 +77,7 @@ let
       maintainers = with maintainers; [ wjlroe offline basvandijk ];
     };
     passthru.tests =
-      optionalAttrs (config.allowUnfree && enableUnfree) (
+      lib.optionalAttrs (config.allowUnfree && enableUnfree) (
         assert this.drvPath == nixosTests.elk.unfree.ELK-7.elkPackages.logstash.drvPath;
         {
           elk = nixosTests.elk.unfree.ELK-7;
diff --git a/pkgs/tools/misc/moreutils/default.nix b/pkgs/tools/misc/moreutils/default.nix
index 1f002136ad0..0a7423ec557 100644
--- a/pkgs/tools/misc/moreutils/default.nix
+++ b/pkgs/tools/misc/moreutils/default.nix
@@ -11,7 +11,6 @@
 , darwin
 }:
 
-with lib;
 stdenv.mkDerivation rec {
   pname = "moreutils";
   version = "0.67";
@@ -28,7 +27,7 @@ stdenv.mkDerivation rec {
 
   strictDeps = true;
   nativeBuildInputs = [ makeWrapper perl libxml2 libxslt docbook-xsl docbook_xml_dtd_44 ];
-  buildInputs = optional stdenv.isDarwin darwin.cctools;
+  buildInputs = lib.optional stdenv.isDarwin darwin.cctools;
 
   propagatedBuildInputs = with perlPackages; [ perl IPCRun TimeDate TimeDuration ];
 
@@ -40,7 +39,7 @@ stdenv.mkDerivation rec {
     wrapProgram $out/bin/ts --prefix PERL5LIB : $PERL5LIB
   '';
 
-  meta = {
+  meta = with lib; {
     description = "Growing collection of the unix tools that nobody thought to write long ago when unix was young";
     homepage = "https://joeyh.name/code/moreutils/";
     maintainers = with maintainers; [ koral pSub ];
diff --git a/pkgs/tools/misc/pixd/default.nix b/pkgs/tools/misc/pixd/default.nix
index 8152849d9b5..2e8f552e1a8 100644
--- a/pkgs/tools/misc/pixd/default.nix
+++ b/pkgs/tools/misc/pixd/default.nix
@@ -1,7 +1,5 @@
 { lib, stdenv, fetchFromGitHub }:
 
-with lib;
-
 stdenv.mkDerivation rec {
   pname = "pixd";
   version = "1.0.0";
@@ -15,7 +13,7 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "PREFIX=$(out)" ];
 
-  meta = {
+  meta = with lib; {
     description = "Colourful visualization tool for binary files";
     homepage = "https://github.com/FireyFly/pixd";
     maintainers = [ maintainers.FireyFly ];
diff --git a/pkgs/tools/misc/rmlint/default.nix b/pkgs/tools/misc/rmlint/default.nix
index 8211c5aebc7..850bdb83c89 100644
--- a/pkgs/tools/misc/rmlint/default.nix
+++ b/pkgs/tools/misc/rmlint/default.nix
@@ -20,7 +20,6 @@
 
 assert withGui -> !stdenv.isDarwin;
 
-with lib;
 stdenv.mkDerivation rec {
   pname = "rmlint";
   version = "2.10.1";
@@ -78,7 +77,7 @@ stdenv.mkDerivation rec {
     gappsWrapperArgs+=(--prefix PYTHONPATH : "$(toPythonPath $out):$(toPythonPath ${python3.pkgs.pygobject3}):$(toPythonPath ${python3.pkgs.pycairo})")
   '';
 
-  meta = {
+  meta = with lib; {
     description = "Extremely fast tool to remove duplicates and other lint from your filesystem";
     homepage = "https://rmlint.readthedocs.org";
     platforms = platforms.unix;
diff --git a/pkgs/tools/networking/dnsmasq/default.nix b/pkgs/tools/networking/dnsmasq/default.nix
index 6d4e28f6cb6..766bb68e0f7 100644
--- a/pkgs/tools/networking/dnsmasq/default.nix
+++ b/pkgs/tools/networking/dnsmasq/default.nix
@@ -5,14 +5,13 @@
 , nixosTests
 }:
 
-with lib;
 let
-  copts = concatStringsSep " " ([
+  copts = lib.concatStringsSep " " ([
     "-DHAVE_IDN"
     "-DHAVE_DNSSEC"
-  ] ++ optionals dbusSupport [
+  ] ++ lib.optionals dbusSupport [
     "-DHAVE_DBUS"
-  ] ++ optionals stdenv.isLinux [
+  ] ++ lib.optionals stdenv.isLinux [
     "-DHAVE_CONNTRACK"
   ]);
 in
@@ -43,7 +42,7 @@ stdenv.mkDerivation rec {
 
   hardeningEnable = [ "pie" ];
 
-  postBuild = optionalString stdenv.isLinux ''
+  postBuild = lib.optionalString stdenv.isLinux ''
     make -C contrib/lease-tools
   '';
 
@@ -51,17 +50,17 @@ stdenv.mkDerivation rec {
   # module can create it in Nix-land?
   postInstall = ''
     install -Dm644 trust-anchors.conf $out/share/dnsmasq/trust-anchors.conf
-  '' + optionalString stdenv.isDarwin ''
+  '' + lib.optionalString stdenv.isDarwin ''
     install -Dm644 contrib/MacOSX-launchd/uk.org.thekelleys.dnsmasq.plist \
       $out/Library/LaunchDaemons/uk.org.thekelleys.dnsmasq.plist
     substituteInPlace $out/Library/LaunchDaemons/uk.org.thekelleys.dnsmasq.plist \
       --replace "/usr/local/sbin" "$out/bin"
-  '' + optionalString stdenv.isLinux ''
+  '' + lib.optionalString stdenv.isLinux ''
     install -Dm755 contrib/lease-tools/dhcp_lease_time $out/bin/dhcp_lease_time
     install -Dm755 contrib/lease-tools/dhcp_release $out/bin/dhcp_release
     install -Dm755 contrib/lease-tools/dhcp_release6 $out/bin/dhcp_release6
 
-  '' + optionalString dbusSupport ''
+  '' + lib.optionalString dbusSupport ''
     install -Dm644 dbus/dnsmasq.conf $out/share/dbus-1/system.d/dnsmasq.conf
     mkdir -p $out/share/dbus-1/system-services
     cat <<END > $out/share/dbus-1/system-services/uk.org.thekelleys.dnsmasq.service
@@ -75,8 +74,8 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ nettle libidn ]
-    ++ optionals dbusSupport [ dbus ]
-    ++ optionals stdenv.isLinux [ libnetfilter_conntrack ];
+    ++ lib.optionals dbusSupport [ dbus ]
+    ++ lib.optionals stdenv.isLinux [ libnetfilter_conntrack ];
 
   passthru.tests = {
     prometheus-exporter = nixosTests.prometheus-exporters.dnsmasq;
@@ -87,7 +86,7 @@ stdenv.mkDerivation rec {
     kubernetes-dns-multi = nixosTests.kubernetes.dns-multi-node;
   };
 
-  meta = {
+  meta = with lib; {
     description = "An integrated DNS, DHCP and TFTP server for small networks";
     homepage = "https://www.thekelleys.org.uk/dnsmasq/doc.html";
     license = licenses.gpl2;
diff --git a/pkgs/tools/networking/flannel/default.nix b/pkgs/tools/networking/flannel/default.nix
index 57e75462e3a..873afdea2e8 100644
--- a/pkgs/tools/networking/flannel/default.nix
+++ b/pkgs/tools/networking/flannel/default.nix
@@ -1,7 +1,5 @@
 { lib, buildGoModule, fetchFromGitHub, nixosTests }:
 
-with lib;
-
 buildGoModule rec {
   pname = "flannel";
   version = "0.20.2";
@@ -23,7 +21,7 @@ buildGoModule rec {
 
   passthru.tests = { inherit (nixosTests) flannel; };
 
-  meta = {
+  meta = with lib; {
     description = "Network fabric for containers, designed for Kubernetes";
     license = licenses.asl20;
     homepage = "https://github.com/flannel-io/flannel";
diff --git a/pkgs/tools/networking/logmein-hamachi/default.nix b/pkgs/tools/networking/logmein-hamachi/default.nix
index 74d32b45238..30a400df0a1 100644
--- a/pkgs/tools/networking/logmein-hamachi/default.nix
+++ b/pkgs/tools/networking/logmein-hamachi/default.nix
@@ -1,7 +1,5 @@
 { lib, stdenv, fetchurl }:
 
-with lib;
-
 let
   arch =
     if stdenv.hostPlatform.system == "x86_64-linux" then "x64"
diff --git a/pkgs/tools/networking/ndjbdns/default.nix b/pkgs/tools/networking/ndjbdns/default.nix
index ad3bf675278..6746f456cfe 100644
--- a/pkgs/tools/networking/ndjbdns/default.nix
+++ b/pkgs/tools/networking/ndjbdns/default.nix
@@ -1,7 +1,5 @@
 { lib, stdenv, fetchFromGitHub, autoreconfHook, systemd, pkg-config }:
 
-with lib;
-
 stdenv.mkDerivation {
   version = "1.06";
   pname = "ndjbdns";
@@ -15,9 +13,9 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
   buildInputs = [ ]
-    ++ optional stdenv.isLinux systemd;
+    ++ lib.optional stdenv.isLinux systemd;
 
-  meta = {
+  meta = with lib; {
     description = "A brand new release of the Djbdns";
     longDescription = ''
       Djbdns is a fully‐fledged Domain Name System(DNS), originally written by the eminent author of qmail, Dr. D J Bernstein.
diff --git a/pkgs/tools/networking/ngrok/default.nix b/pkgs/tools/networking/ngrok/default.nix
index f12ae31a541..fb1574bfdc1 100644
--- a/pkgs/tools/networking/ngrok/default.nix
+++ b/pkgs/tools/networking/ngrok/default.nix
@@ -1,7 +1,5 @@
 { lib, stdenv, fetchurl }:
 
-with lib;
-
 let versions = lib.importJSON ./versions.json;
     arch = if stdenv.isi686 then "386"
            else if stdenv.isx86_64 then "amd64"
@@ -37,10 +35,10 @@ stdenv.mkDerivation {
   # Stripping causes SEGFAULT on x86_64-darwin
   dontStrip = true;
 
-  meta = {
+  meta = with lib; {
     description = "Allows you to expose a web server running on your local machine to the internet";
     homepage = "https://ngrok.com/";
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     platforms = [ "i686-linux" "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin" ];
     maintainers = with maintainers; [ bobvanderlinden brodes ];
diff --git a/pkgs/tools/networking/openssh/common.nix b/pkgs/tools/networking/openssh/common.nix
index 2f0b36f4972..c1b2199d0f9 100644
--- a/pkgs/tools/networking/openssh/common.nix
+++ b/pkgs/tools/networking/openssh/common.nix
@@ -30,7 +30,6 @@
 , linkOpenssl ? true
 }:
 
-with lib;
 stdenv.mkDerivation rec {
   inherit pname version src;
 
@@ -57,12 +56,12 @@ stdenv.mkDerivation rec {
     # This is not the same as the libkrb5 from the inputs! pkgs.libkrb5 is
     # needed here to access krb5-config in order to cross compile. See:
     # https://github.com/NixOS/nixpkgs/pull/107606
-    ++ optional withKerberos pkgs.libkrb5
+    ++ lib.optional withKerberos pkgs.libkrb5
     ++ extraNativeBuildInputs;
   buildInputs = [ zlib openssl libedit ]
-    ++ optional withFIDO libfido2
-    ++ optional withKerberos libkrb5
-    ++ optional stdenv.isLinux pam;
+    ++ lib.optional withFIDO libfido2
+    ++ lib.optional withKerberos libkrb5
+    ++ lib.optional stdenv.isLinux pam;
 
   preConfigure = ''
     # Setting LD causes `configure' and `make' to disagree about which linker
@@ -80,11 +79,11 @@ stdenv.mkDerivation rec {
     "--with-libedit=yes"
     "--disable-strip"
     (if stdenv.isLinux then "--with-pam" else "--without-pam")
-  ] ++ optional (etcDir != null) "--sysconfdir=${etcDir}"
-    ++ optional withFIDO "--with-security-key-builtin=yes"
-    ++ optional withKerberos (assert libkrb5 != null; "--with-kerberos5=${libkrb5}")
-    ++ optional stdenv.isDarwin "--disable-libutil"
-    ++ optional (!linkOpenssl) "--without-openssl"
+  ] ++ lib.optional (etcDir != null) "--sysconfdir=${etcDir}"
+    ++ lib.optional withFIDO "--with-security-key-builtin=yes"
+    ++ lib.optional withKerberos (assert libkrb5 != null; "--with-kerberos5=${libkrb5}")
+    ++ lib.optional stdenv.isDarwin "--disable-libutil"
+    ++ lib.optional (!linkOpenssl) "--without-openssl"
     ++ extraConfigureFlags;
 
   ${if stdenv.hostPlatform.isStatic then "NIX_LDFLAGS" else null}= [ "-laudit" ] ++ lib.optionals withKerberos [ "-lkeyutils" ];
@@ -97,7 +96,7 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
   enableParallelChecking = false;
-  nativeCheckInputs = optional (!stdenv.isDarwin) hostname;
+  nativeCheckInputs = lib.optional (!stdenv.isDarwin) hostname;
   preCheck = lib.optionalString (stdenv.hostPlatform == stdenv.buildPlatform) ''
     # construct a dummy HOME
     export HOME=$(realpath ../dummy-home)
@@ -145,7 +144,7 @@ stdenv.mkDerivation rec {
   # integration tests hard to get working on darwin with its shaky
   # sandbox
   # t-exec tests fail on musl
-  checkTarget = optional (!stdenv.isDarwin && !stdenv.hostPlatform.isMusl) "t-exec"
+  checkTarget = lib.optional (!stdenv.isDarwin && !stdenv.hostPlatform.isMusl) "t-exec"
     # other tests are less demanding of the environment
     ++ [ "unit" "file-tests" "interop-tests" ];
 
@@ -165,7 +164,7 @@ stdenv.mkDerivation rec {
     borgbackup-integration = nixosTests.borgbackup;
   };
 
-  meta = {
+  meta = with lib; {
     description = "An implementation of the SSH protocol${extraDesc}";
     homepage = "https://www.openssh.com/";
     changelog = "https://www.openssh.com/releasenotes.html";
diff --git a/pkgs/tools/networking/snabb/default.nix b/pkgs/tools/networking/snabb/default.nix
index 97d9ff33ddf..f58fd9a998b 100644
--- a/pkgs/tools/networking/snabb/default.nix
+++ b/pkgs/tools/networking/snabb/default.nix
@@ -3,8 +3,6 @@
 , fetchFromGitHub
 }:
 
-with lib;
-
 stdenv.mkDerivation rec {
   pname = "snabb";
   version = "2022.10";
@@ -21,7 +19,7 @@ stdenv.mkDerivation rec {
     cp src/snabb $out/bin
   '';
 
-  meta = {
+  meta = with lib; {
     homepage = "https://github.com/SnabbCo/snabbswitch";
     description = "Simple and fast packet networking toolkit";
     longDescription = ''
diff --git a/pkgs/tools/networking/strongswan/default.nix b/pkgs/tools/networking/strongswan/default.nix
index 119f81baf5c..40d2b68c449 100644
--- a/pkgs/tools/networking/strongswan/default.nix
+++ b/pkgs/tools/networking/strongswan/default.nix
@@ -14,8 +14,6 @@
 # strongswan curl plugin may break.
 # See https://wiki.strongswan.org/projects/strongswan/wiki/Curl for more info.
 
-with lib;
-
 stdenv.mkDerivation rec {
   pname = "strongswan";
   version = "5.9.8"; # Make sure to also update <nixpkgs/nixos/modules/services/networking/strongswan-swanctl/swanctl-params.nix> when upgrading!
@@ -32,10 +30,10 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkg-config autoreconfHook perl gperf bison flex ];
   buildInputs =
     [ curl gmp python3 ldns unbound openssl pcsclite ]
-    ++ optionals enableTNC [ trousers sqlite libxml2 ]
-    ++ optionals stdenv.isLinux [ systemd.dev pam iptables ]
-    ++ optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [ SystemConfiguration ])
-    ++ optionals enableNetworkManager [ networkmanager glib ];
+    ++ lib.optionals enableTNC [ trousers sqlite libxml2 ]
+    ++ lib.optionals stdenv.isLinux [ systemd.dev pam iptables ]
+    ++ lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [ SystemConfiguration ])
+    ++ lib.optionals enableNetworkManager [ networkmanager glib ];
 
   patches = [
     ./ext_auth-path.patch
@@ -43,7 +41,7 @@ stdenv.mkDerivation rec {
     ./updown-path.patch
   ];
 
-  postPatch = optionalString stdenv.isLinux ''
+  postPatch = lib.optionalString stdenv.isLinux ''
     # glibc-2.26 reorganized internal includes
     sed '1i#include <stdint.h>' -i src/libstrongswan/utils/utils/memory.h
 
@@ -62,16 +60,16 @@ stdenv.mkDerivation rec {
       "--enable-pkcs11" "--enable-eap-sim-pcsc" "--enable-dnscert" "--enable-unbound"
       "--enable-chapoly"
       "--enable-curl" ]
-    ++ optionals stdenv.isLinux [
+    ++ lib.optionals stdenv.isLinux [
       "--enable-farp" "--enable-dhcp"
       "--enable-systemd" "--with-systemdsystemunitdir=${placeholder "out"}/etc/systemd/system"
       "--enable-xauth-pam"
       "--enable-forecast"
       "--enable-connmark"
       "--enable-af-alg" ]
-    ++ optionals stdenv.isx86_64 [ "--enable-aesni" "--enable-rdrand" ]
-    ++ optional (stdenv.hostPlatform.system == "i686-linux") "--enable-padlock"
-    ++ optionals enableTNC [
+    ++ lib.optionals stdenv.isx86_64 [ "--enable-aesni" "--enable-rdrand" ]
+    ++ lib.optional (stdenv.hostPlatform.system == "i686-linux") "--enable-padlock"
+    ++ lib.optionals enableTNC [
          "--disable-gmp" "--disable-aes" "--disable-md5" "--disable-sha1" "--disable-sha2" "--disable-fips-prf"
          "--enable-eap-tnc" "--enable-eap-ttls" "--enable-eap-dynamic" "--enable-tnccs-20"
          "--enable-tnc-imc" "--enable-imc-os" "--enable-imc-attestation"
@@ -80,11 +78,11 @@ stdenv.mkDerivation rec {
          "--with-tss=trousers"
          "--enable-aikgen"
          "--enable-sqlite" ]
-    ++ optionals enableNetworkManager [
+    ++ lib.optionals enableNetworkManager [
          "--enable-nm"
          "--with-nm-ca-dir=/etc/ssl/certs" ]
     # Taken from: https://wiki.strongswan.org/projects/strongswan/wiki/MacOSX
-    ++ optionals stdenv.isDarwin [
+    ++ lib.optionals stdenv.isDarwin [
       "--disable-systemd"
       "--disable-xauth-pam"
       "--disable-kernel-netlink"
@@ -100,11 +98,11 @@ stdenv.mkDerivation rec {
     echo "include /etc/ipsec.secrets" >> $out/etc/ipsec.secrets
   '';
 
-  NIX_LDFLAGS = optionalString stdenv.cc.isGNU "-lgcc_s" ;
+  NIX_LDFLAGS = lib.optionalString stdenv.cc.isGNU "-lgcc_s" ;
 
   passthru.tests = { inherit (nixosTests) strongswan-swanctl; };
 
-  meta = {
+  meta = with lib; {
     description = "OpenSource IPsec-based VPN Solution";
     homepage = "https://www.strongswan.org";
     license = licenses.gpl2Plus;
diff --git a/pkgs/tools/package-management/nix-serve/default.nix b/pkgs/tools/package-management/nix-serve/default.nix
index d9faea9cea4..20f374b8d10 100644
--- a/pkgs/tools/package-management/nix-serve/default.nix
+++ b/pkgs/tools/package-management/nix-serve/default.nix
@@ -8,8 +8,6 @@
 , nixosTests
 }:
 
-with lib;
-
 let
   rev = "e4675e38ab54942e351c7686e40fabec822120b9";
   sha256 = "1wm24p6pkxl1d7hrvf4ph6mwzawvqi22c60z9xzndn5xfyr4v0yr";
@@ -17,7 +15,7 @@ in
 
 stdenv.mkDerivation {
   pname = "nix-serve";
-  version = "0.2-${substring 0 7 rev}";
+  version = "0.2-${lib.substring 0 7 rev}";
 
   src = fetchFromGitHub {
     owner = "edolstra";
@@ -33,7 +31,7 @@ stdenv.mkDerivation {
     install -Dm0755 nix-serve.psgi $out/libexec/nix-serve/nix-serve.psgi
 
     makeWrapper ${perl.withPackages(p: [ p.DBDSQLite p.Plack p.Starman nix.perl-bindings ])}/bin/starman $out/bin/nix-serve \
-                --prefix PATH : "${makeBinPath [ bzip2 nix ]}" \
+                --prefix PATH : "${lib.makeBinPath [ bzip2 nix ]}" \
                 --add-flags $out/libexec/nix-serve/nix-serve.psgi
   '';
 
@@ -42,7 +40,7 @@ stdenv.mkDerivation {
     nix-serve-ssh = nixosTests.nix-serve-ssh;
   };
 
-  meta = {
+  meta = with lib; {
     homepage = "https://github.com/edolstra/nix-serve";
     description = "A utility for sharing a Nix store as a binary cache";
     maintainers = [ maintainers.eelco ];
diff --git a/pkgs/tools/security/afl/qemu.nix b/pkgs/tools/security/afl/qemu.nix
index e33c4c2fb03..9a8b4b3ca36 100644
--- a/pkgs/tools/security/afl/qemu.nix
+++ b/pkgs/tools/security/afl/qemu.nix
@@ -2,8 +2,6 @@
 , texinfo, libuuid, flex, bison, pixman, autoconf
 }:
 
-with lib;
-
 let
   cpuTarget = if stdenv.hostPlatform.system == "x86_64-linux" then "x86_64-linux-user"
     else if stdenv.hostPlatform.system == "i686-linux" then "i386-linux-user"
diff --git a/pkgs/tools/security/aflplusplus/qemu.nix b/pkgs/tools/security/aflplusplus/qemu.nix
index 1fb613aef2e..cfcaece232c 100644
--- a/pkgs/tools/security/aflplusplus/qemu.nix
+++ b/pkgs/tools/security/aflplusplus/qemu.nix
@@ -2,8 +2,6 @@
 , texinfo, libuuid, flex, bison, pixman, autoconf
 }:
 
-with lib;
-
 let
   qemuName = "qemu-3.1.0";
   cpuTarget = if stdenv.targetPlatform.system == "x86_64-linux" then "x86_64-linux-user"
diff --git a/pkgs/tools/security/b2sum/default.nix b/pkgs/tools/security/b2sum/default.nix
index c209fa82edb..2b08da598fa 100644
--- a/pkgs/tools/security/b2sum/default.nix
+++ b/pkgs/tools/security/b2sum/default.nix
@@ -1,7 +1,5 @@
 { lib, stdenv, fetchFromGitHub, openmp ? null }:
 
-with lib;
-
 stdenv.mkDerivation (finalAttrs: {
   pname = "b2sum";
   version = "20190724";
@@ -24,10 +22,10 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [ openmp ];
 
-  buildFlags = [ (optional (openmp == null) "NO_OPENMP=1") ];
+  buildFlags = [ (lib.optional (openmp == null) "NO_OPENMP=1") ];
   installFlags = [ "PREFIX=$(out)" ];
 
-  meta = {
+  meta = with lib; {
     description = "The b2sum utility is similar to the md5sum or shasum utilities but for BLAKE2";
     homepage = "https://blake2.net";
     license = with licenses; [ asl20 cc0 openssl ];
diff --git a/pkgs/tools/security/john/default.nix b/pkgs/tools/security/john/default.nix
index 8409bd8d2bc..745b027a057 100644
--- a/pkgs/tools/security/john/default.nix
+++ b/pkgs/tools/security/john/default.nix
@@ -2,8 +2,6 @@
 , gcc, python3Packages, perl, perlPackages, makeWrapper, fetchpatch
 }:
 
-with lib;
-
 stdenv.mkDerivation rec {
   pname = "john";
   version = "1.9.0-jumbo-1";
@@ -83,7 +81,7 @@ stdenv.mkDerivation rec {
     done
   '';
 
-  meta = {
+  meta = with lib; {
     description = "John the Ripper password cracker";
     license = licenses.gpl2Plus;
     homepage = "https://github.com/openwall/john/";
diff --git a/pkgs/tools/security/modsecurity/default.nix b/pkgs/tools/security/modsecurity/default.nix
index 0d3b2871671..f8564bfe00f 100644
--- a/pkgs/tools/security/modsecurity/default.nix
+++ b/pkgs/tools/security/modsecurity/default.nix
@@ -3,8 +3,6 @@
 , luaSupport ? false, lua5, perl
 }:
 
-with lib;
-
 let luaValue = if luaSupport then lua5 else "no";
     optional = lib.optional;
 in
@@ -49,7 +47,7 @@ stdenv.mkDerivation rec {
     cp -R * $nginx
   '';
 
-  meta = {
+  meta = with lib; {
     description = "Open source, cross-platform web application firewall (WAF)";
     license = licenses.asl20;
     homepage = "https://www.modsecurity.org/";
diff --git a/pkgs/tools/security/nmap/default.nix b/pkgs/tools/security/nmap/default.nix
index d6276b3cc40..fbabe92b199 100644
--- a/pkgs/tools/security/nmap/default.nix
+++ b/pkgs/tools/security/nmap/default.nix
@@ -6,8 +6,6 @@
 , withLua ? true
 }:
 
-with lib;
-
 stdenv.mkDerivation rec {
   pname = "nmap";
   version = "7.93";
@@ -18,7 +16,7 @@ stdenv.mkDerivation rec {
   };
 
   patches = [ ./zenmap.patch ]
-    ++ optionals stdenv.cc.isClang [(
+    ++ lib.optionals stdenv.cc.isClang [(
       # Fixes a compile error due an ambiguous reference to bind(2) in
       # nping/EchoServer.cc, which is otherwise resolved to std::bind.
       # https://github.com/nmap/nmap/pull/1363
@@ -29,7 +27,7 @@ stdenv.mkDerivation rec {
       }
     )];
 
-  prePatch = optionalString stdenv.isDarwin ''
+  prePatch = lib.optionalString stdenv.isDarwin ''
     substituteInPlace libz/configure \
         --replace /usr/bin/libtool ar \
         --replace 'AR="libtool"' 'AR="ar"' \
@@ -43,7 +41,7 @@ stdenv.mkDerivation rec {
     "--without-zenmap"
   ];
 
-  makeFlags = optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
+  makeFlags = lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
     "AR=${stdenv.cc.bintools.targetPrefix}ar"
     "RANLIB=${stdenv.cc.bintools.targetPrefix}ranlib"
     "CC=${stdenv.cc.targetPrefix}gcc"
@@ -56,7 +54,7 @@ stdenv.mkDerivation rec {
 
   doCheck = false; # fails 3 tests, probably needs the net
 
-  meta = {
+  meta = with lib; {
     description = "A free and open source utility for network discovery and security auditing";
     homepage    = "http://www.nmap.org";
     license     = licenses.gpl2;
diff --git a/pkgs/tools/security/pass/default.nix b/pkgs/tools/security/pass/default.nix
index c856c020d69..498e715a8eb 100644
--- a/pkgs/tools/security/pass/default.nix
+++ b/pkgs/tools/security/pass/default.nix
@@ -11,8 +11,6 @@
 , tombPluginSupport ? false
 }:
 
-with lib;
-
 assert x11Support -> xclip != null;
 assert waylandSupport -> wl-clipboard != null;
 
@@ -35,7 +33,7 @@ let
       name = "pass";
       paths = selected;
       nativeBuildInputs = [ makeWrapper ];
-      buildInputs = concatMap (x: x.buildInputs) selected;
+      buildInputs = lib.concatMap (x: x.buildInputs) selected;
 
       postBuild = ''
         files=$(find $out/bin/ -type f -exec readlink -f {} \;)
@@ -79,7 +77,7 @@ stdenv.mkDerivation rec {
     # dependencies (s.el) here. The user has to do this themselves.
     mkdir -p "$out/share/emacs/site-lisp"
     cp "contrib/emacs/password-store.el" "$out/share/emacs/site-lisp/"
-  '' + optionalString dmenuSupport ''
+  '' + lib.optionalString dmenuSupport ''
     cp "contrib/dmenu/passmenu" "$out/bin/"
   '';
 
diff --git a/pkgs/tools/security/tcpcrypt/default.nix b/pkgs/tools/security/tcpcrypt/default.nix
index 2ad7fe3e909..8b00431b6cb 100644
--- a/pkgs/tools/security/tcpcrypt/default.nix
+++ b/pkgs/tools/security/tcpcrypt/default.nix
@@ -3,8 +3,6 @@
 , libcap, libpcap, libnfnetlink, libnetfilter_conntrack, libnetfilter_queue
 }:
 
-with lib;
-
 stdenv.mkDerivation rec {
   pname = "tcpcrypt";
   version = "0.5";
@@ -21,11 +19,11 @@ stdenv.mkDerivation rec {
   outputs = [ "bin" "dev" "out" ];
   nativeBuildInputs = [ autoreconfHook ];
   buildInputs = [ openssl libpcap ]
-    ++ optionals stdenv.isLinux [ libcap libnfnetlink libnetfilter_conntrack libnetfilter_queue ];
+    ++ lib.optionals stdenv.isLinux [ libcap libnfnetlink libnetfilter_conntrack libnetfilter_queue ];
 
   enableParallelBuilding = true;
 
-  meta = {
+  meta = with lib; {
     broken = stdenv.isDarwin;
     homepage = "http://tcpcrypt.org/";
     description = "Fast TCP encryption";
diff --git a/pkgs/tools/security/tor/update.nix b/pkgs/tools/security/tor/update.nix
index 50353ce32a6..f0106aa26ea 100644
--- a/pkgs/tools/security/tor/update.nix
+++ b/pkgs/tools/security/tor/update.nix
@@ -10,8 +10,6 @@
 , nix
 }:
 
-with lib;
-
 let
   downloadPageUrl = "https://dist.torproject.org";
 
@@ -28,7 +26,7 @@ writeScript "update-tor" ''
 
 set -eu -o pipefail
 
-export PATH=${makeBinPath [
+export PATH=${lib.makeBinPath [
   common-updater-scripts
   coreutils
   curl
@@ -63,7 +61,7 @@ sigFile=''${sigUrl##*/}
 export GNUPGHOME=$PWD/gnupg
 mkdir -m 700 -p "$GNUPGHOME"
 
-gpg --batch --recv-keys ${concatStringsSep " " (map (x: "'${x}'") signingKeys)}
+gpg --batch --recv-keys ${lib.concatStringsSep " " (map (x: "'${x}'") signingKeys)}
 gpg --batch --verify "$sigFile" "$checksumFile"
 
 sha256sum -c "$checksumFile"
diff --git a/pkgs/tools/system/netdata/default.nix b/pkgs/tools/system/netdata/default.nix
index ee9d132de30..a84113fe20b 100644
--- a/pkgs/tools/system/netdata/default.nix
+++ b/pkgs/tools/system/netdata/default.nix
@@ -14,8 +14,6 @@
 , withDebug ? false
 }:
 
-with lib;
-
 let
   go-d-plugin = callPackage ./go.d.plugin.nix {};
 in stdenv.mkDerivation rec {
@@ -34,17 +32,17 @@ in stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook pkg-config makeWrapper protobuf ];
   buildInputs = [ curl jemalloc libuv zlib ]
-    ++ optionals stdenv.isDarwin [ CoreFoundation IOKit libossp_uuid ]
-    ++ optionals (!stdenv.isDarwin) [ libcap libuuid ]
-    ++ optionals withCups [ cups ]
-    ++ optionals withDBengine [ lz4 ]
-    ++ optionals withIpmi [ freeipmi ]
-    ++ optionals withNetfilter [ libmnl libnetfilter_acct ]
-    ++ optionals withCloud [ json_c ]
-    ++ optionals withConnPubSub [ google-cloud-cpp grpc ]
-    ++ optionals withConnPrometheus [ snappy ]
-    ++ optionals (withCloud || withConnPrometheus) [ protobuf ]
-    ++ optionals withSsl [ openssl ];
+    ++ lib.optionals stdenv.isDarwin [ CoreFoundation IOKit libossp_uuid ]
+    ++ lib.optionals (!stdenv.isDarwin) [ libcap libuuid ]
+    ++ lib.optionals withCups [ cups ]
+    ++ lib.optionals withDBengine [ lz4 ]
+    ++ lib.optionals withIpmi [ freeipmi ]
+    ++ lib.optionals withNetfilter [ libmnl libnetfilter_acct ]
+    ++ lib.optionals withCloud [ json_c ]
+    ++ lib.optionals withConnPubSub [ google-cloud-cpp grpc ]
+    ++ lib.optionals withConnPrometheus [ snappy ]
+    ++ lib.optionals (withCloud || withConnPrometheus) [ protobuf ]
+    ++ lib.optionals withSsl [ openssl ];
 
   patches = [
     # required to prevent plugins from relying on /etc
@@ -68,12 +66,12 @@ in stdenv.mkDerivation rec {
   # We pick zlib.dev as a simple canary package with pkg-config input.
   disallowedReferences = [ zlib.dev ];
 
-  NIX_CFLAGS_COMPILE = optionalString withDebug "-O1 -ggdb -DNETDATA_INTERNAL_CHECKS=1";
+  NIX_CFLAGS_COMPILE = lib.optionalString withDebug "-O1 -ggdb -DNETDATA_INTERNAL_CHECKS=1";
 
   postInstall = ''
     ln -s ${go-d-plugin}/lib/netdata/conf.d/* $out/lib/netdata/conf.d
     ln -s ${go-d-plugin}/bin/godplugin $out/libexec/netdata/plugins.d/go.d.plugin
-  '' + optionalString (!stdenv.isDarwin) ''
+  '' + lib.optionalString (!stdenv.isDarwin) ''
     # rename this plugin so netdata will look for setuid wrapper
     mv $out/libexec/netdata/plugins.d/apps.plugin \
        $out/libexec/netdata/plugins.d/apps.plugin.org
@@ -83,13 +81,13 @@ in stdenv.mkDerivation rec {
        $out/libexec/netdata/plugins.d/perf.plugin.org
     mv $out/libexec/netdata/plugins.d/slabinfo.plugin \
        $out/libexec/netdata/plugins.d/slabinfo.plugin.org
-    ${optionalString withIpmi ''
+    ${lib.optionalString withIpmi ''
       mv $out/libexec/netdata/plugins.d/freeipmi.plugin \
          $out/libexec/netdata/plugins.d/freeipmi.plugin.org
     ''}
   '';
 
-  preConfigure = optionalString (!stdenv.isDarwin) ''
+  preConfigure = lib.optionalString (!stdenv.isDarwin) ''
     substituteInPlace collectors/python.d.plugin/python_modules/third_party/lm_sensors.py \
       --replace 'ctypes.util.find_library("sensors")' '"${lm_sensors.out}/lib/libsensors${stdenv.hostPlatform.extensions.sharedLibrary}"'
   '';
@@ -99,9 +97,9 @@ in stdenv.mkDerivation rec {
     "--sysconfdir=/etc"
     "--disable-ebpf"
     "--with-jemalloc=${jemalloc}"
-  ] ++ optionals (!withDBengine) [
+  ] ++ lib.optionals (!withDBengine) [
     "--disable-dbengine"
-  ] ++ optionals (!withCloud) [
+  ] ++ lib.optionals (!withCloud) [
     "--disable-cloud"
   ];
 
@@ -116,7 +114,7 @@ in stdenv.mkDerivation rec {
     tests.netdata = nixosTests.netdata;
   };
 
-  meta = {
+  meta = with lib; {
     broken = stdenv.isDarwin || stdenv.buildPlatform != stdenv.hostPlatform;
     description = "Real-time performance monitoring tool";
     homepage = "https://www.netdata.cloud/";
diff --git a/pkgs/tools/system/socklog/default.nix b/pkgs/tools/system/socklog/default.nix
index 7c40a8f0caf..dc9486a6e3d 100644
--- a/pkgs/tools/system/socklog/default.nix
+++ b/pkgs/tools/system/socklog/default.nix
@@ -1,7 +1,5 @@
 { lib, stdenv, fetchurl }:
 
-with lib;
-
 stdenv.mkDerivation rec {
   pname = "socklog";
   version = "2.1.0";
@@ -49,7 +47,7 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  meta = {
+  meta = with lib; {
     broken = stdenv.isDarwin;
     description = "System and kernel logging services";
     homepage = "http://smarden.org/socklog/";
diff --git a/pkgs/tools/text/ledger2beancount/default.nix b/pkgs/tools/text/ledger2beancount/default.nix
index 32a0f586388..38522293767 100644
--- a/pkgs/tools/text/ledger2beancount/default.nix
+++ b/pkgs/tools/text/ledger2beancount/default.nix
@@ -1,7 +1,5 @@
 { lib, stdenv, fetchFromGitHub, makeWrapper, perlPackages, beancount }:
 
-with lib;
-
 let
   perlDeps = with perlPackages; [
     DateCalc
@@ -44,7 +42,7 @@ in stdenv.mkDerivation rec {
       --set PERL5LIB "${perlPackages.makeFullPerlPath perlDeps}"
   '';
 
-  meta = {
+  meta = with lib; {
     description = "Ledger to Beancount text-based converter";
     longDescription = ''
       A script to automatically convert Ledger-based textual ledgers to Beancount ones.
diff --git a/pkgs/tools/video/rtmpdump/default.nix b/pkgs/tools/video/rtmpdump/default.nix
index 6e05f81fcd8..b6293ffbc53 100644
--- a/pkgs/tools/video/rtmpdump/default.nix
+++ b/pkgs/tools/video/rtmpdump/default.nix
@@ -12,7 +12,6 @@
 
 assert (gnutlsSupport || opensslSupport);
 
-with lib;
 stdenv.mkDerivation {
   pname = "rtmpdump";
   version = "unstable-2021-02-19";
@@ -36,20 +35,20 @@ stdenv.mkDerivation {
     "prefix=$(out)"
     "CROSS_COMPILE=${stdenv.cc.targetPrefix}"
   ]
-    ++ optional gnutlsSupport "CRYPTO=GNUTLS"
-    ++ optional opensslSupport "CRYPTO=OPENSSL"
-    ++ optional stdenv.isDarwin "SYS=darwin"
-    ++ optional stdenv.cc.isClang "CC=clang";
+    ++ lib.optional gnutlsSupport "CRYPTO=GNUTLS"
+    ++ lib.optional opensslSupport "CRYPTO=OPENSSL"
+    ++ lib.optional stdenv.isDarwin "SYS=darwin"
+    ++ lib.optional stdenv.cc.isClang "CC=clang";
 
   propagatedBuildInputs = [ zlib ]
-    ++ optionals gnutlsSupport [ gnutls nettle ]
-    ++ optional opensslSupport openssl;
+    ++ lib.optionals gnutlsSupport [ gnutls nettle ]
+    ++ lib.optional opensslSupport openssl;
 
   outputs = [ "out" "dev" ];
 
   separateDebugInfo = true;
 
-  meta = {
+  meta = with lib; {
     description = "Toolkit for RTMP streams";
     homepage = "https://rtmpdump.mplayerhq.hu/";
     license = licenses.gpl2;