summary refs log tree commit diff
path: root/pkgs/os-specific
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs/os-specific')
-rw-r--r--pkgs/os-specific/bsd/default.nix2
-rw-r--r--pkgs/os-specific/bsd/netbsd/default.nix10
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/Librpcsvc/default.nix2
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix2
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/basic_cmds/default.nix2
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/developer_cmds/default.nix2
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/file_cmds/default.nix2
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/network_cmds/default.nix2
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/shell_cmds/default.nix2
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/system_cmds/default.nix2
-rw-r--r--pkgs/os-specific/darwin/lsusb/default.nix2
-rw-r--r--pkgs/os-specific/darwin/osxfuse/default.nix2
-rw-r--r--pkgs/os-specific/darwin/qes/default.nix2
-rw-r--r--pkgs/os-specific/darwin/xcode/sdk-pkgs.nix6
-rw-r--r--pkgs/os-specific/linux/acpid/default.nix4
-rw-r--r--pkgs/os-specific/linux/anbox/kmod.nix2
-rw-r--r--pkgs/os-specific/linux/batman-adv/default.nix2
-rw-r--r--pkgs/os-specific/linux/beegfs/default.nix2
-rw-r--r--pkgs/os-specific/linux/bpftool/default.nix2
-rw-r--r--pkgs/os-specific/linux/can-isotp/default.nix2
-rw-r--r--pkgs/os-specific/linux/can-utils/default.nix2
-rw-r--r--pkgs/os-specific/linux/checkpolicy/default.nix4
-rw-r--r--pkgs/os-specific/linux/devmem2/default.nix2
-rw-r--r--pkgs/os-specific/linux/directvnc/default.nix2
-rw-r--r--pkgs/os-specific/linux/dstat/default.nix2
-rw-r--r--pkgs/os-specific/linux/fbterm/default.nix2
-rw-r--r--pkgs/os-specific/linux/firmware/fwupd/default.nix162
-rw-r--r--pkgs/os-specific/linux/firmware/raspberrypi-wireless/default.nix2
-rw-r--r--pkgs/os-specific/linux/firmware/raspberrypi/tools.nix2
-rw-r--r--pkgs/os-specific/linux/flashbench/default.nix2
-rw-r--r--pkgs/os-specific/linux/freefall/default.nix2
-rw-r--r--pkgs/os-specific/linux/fscrypt/default.nix8
-rw-r--r--pkgs/os-specific/linux/fscrypt/deps.nix66
-rw-r--r--pkgs/os-specific/linux/fwts/default.nix6
-rw-r--r--pkgs/os-specific/linux/gpu-switch/default.nix2
-rw-r--r--pkgs/os-specific/linux/hdapsd/default.nix2
-rw-r--r--pkgs/os-specific/linux/hibernate/default.nix2
-rw-r--r--pkgs/os-specific/linux/hyperv-daemons/default.nix4
-rw-r--r--pkgs/os-specific/linux/kbd/keymaps.nix2
-rw-r--r--pkgs/os-specific/linux/kernel-headers/default.nix3
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.14.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.19.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.4.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.9.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-5.2.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-rpi.nix8
-rw-r--r--pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix2
-rw-r--r--pkgs/os-specific/linux/kernel/patches.nix6
-rw-r--r--pkgs/os-specific/linux/kmscube/default.nix2
-rw-r--r--pkgs/os-specific/linux/ledger-udev-rules/default.nix2
-rw-r--r--pkgs/os-specific/linux/libselinux/default.nix9
-rw-r--r--pkgs/os-specific/linux/libsemanage/default.nix24
-rw-r--r--pkgs/os-specific/linux/libsepol/default.nix8
-rw-r--r--pkgs/os-specific/linux/logitech-udev-rules/default.nix2
-rw-r--r--pkgs/os-specific/linux/lsiutil/default.nix2
-rw-r--r--pkgs/os-specific/linux/mba6x_bl/default.nix2
-rw-r--r--pkgs/os-specific/linux/microcode/amd.nix2
-rw-r--r--pkgs/os-specific/linux/miraclecast/default.nix2
-rw-r--r--pkgs/os-specific/linux/mmc-utils/default.nix2
-rw-r--r--pkgs/os-specific/linux/nftables/default.nix4
-rwxr-xr-xpkgs/os-specific/linux/nvidia-x11/builder.sh3
-rw-r--r--pkgs/os-specific/linux/nvidia-x11/persistenced.nix2
-rw-r--r--pkgs/os-specific/linux/nvidia-x11/settings.nix2
-rw-r--r--pkgs/os-specific/linux/pipework/default.nix2
-rw-r--r--pkgs/os-specific/linux/policycoreutils/default.nix19
-rw-r--r--pkgs/os-specific/linux/rewritefs/default.nix2
-rw-r--r--pkgs/os-specific/linux/selinux-python/default.nix28
-rw-r--r--pkgs/os-specific/linux/selinux-sandbox/default.nix16
-rw-r--r--pkgs/os-specific/linux/semodule-utils/default.nix4
-rw-r--r--pkgs/os-specific/linux/syscall_limiter/default.nix2
-rw-r--r--pkgs/os-specific/linux/sysdig/default.nix4
-rw-r--r--pkgs/os-specific/linux/syslinux/default.nix2
-rw-r--r--pkgs/os-specific/linux/systemd/default.nix12
-rw-r--r--pkgs/os-specific/linux/trace-cmd/default.nix2
-rw-r--r--pkgs/os-specific/linux/trace-cmd/kernelshark.nix2
-rw-r--r--pkgs/os-specific/linux/upower/default.nix2
-rw-r--r--pkgs/os-specific/linux/usbguard/default.nix22
-rw-r--r--pkgs/os-specific/linux/usbip/default.nix2
-rw-r--r--pkgs/os-specific/linux/uvcdynctrl/default.nix2
-rw-r--r--pkgs/os-specific/linux/v4l-utils/default.nix22
-rw-r--r--pkgs/os-specific/linux/wireguard/default.nix2
-rw-r--r--pkgs/os-specific/linux/zfs/default.nix4
-rw-r--r--pkgs/os-specific/windows/pthread-w32/default.nix2
83 files changed, 393 insertions, 197 deletions
diff --git a/pkgs/os-specific/bsd/default.nix b/pkgs/os-specific/bsd/default.nix
index a75c132b55a..ee7158e2a8c 100644
--- a/pkgs/os-specific/bsd/default.nix
+++ b/pkgs/os-specific/bsd/default.nix
@@ -1,5 +1,5 @@
 { callPackages, recurseIntoAttrs }:
 
-rec {
+{
   netbsd = recurseIntoAttrs (callPackages ./netbsd {});
 }
diff --git a/pkgs/os-specific/bsd/netbsd/default.nix b/pkgs/os-specific/bsd/netbsd/default.nix
index 93b6f4a6209..7370901f319 100644
--- a/pkgs/os-specific/bsd/netbsd/default.nix
+++ b/pkgs/os-specific/bsd/netbsd/default.nix
@@ -38,14 +38,14 @@ let
     HOST_SH = "${buildPackages.bash}/bin/sh";
 
     MACHINE_ARCH = {
-      "i686" = "i386";
+      i686 = "i386";
     }.${stdenv'.hostPlatform.parsed.cpu.name}
       or stdenv'.hostPlatform.parsed.cpu.name;
 
     MACHINE = {
-      "x86_64" = "amd64";
-      "aarch64" = "evbarm64";
-      "i686" = "i386";
+      x86_64 = "amd64";
+      aarch64 = "evbarm64";
+      i686 = "i386";
     }.${stdenv'.hostPlatform.parsed.cpu.name}
       or stdenv'.hostPlatform.parsed.cpu.name;
 
@@ -79,7 +79,7 @@ let
   ##
   ## START BOOTSTRAPPING
   ##
-  makeMinimal = mkDerivation rec {
+  makeMinimal = mkDerivation {
     path = "tools/make";
     sha256 = "1xbzfd4i7allrkk1if74a8ymgpizyj0gkvdigzzj37qar7la7nc1";
     version = "8.0";
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Librpcsvc/default.nix b/pkgs/os-specific/darwin/apple-source-releases/Librpcsvc/default.nix
index 7002f82fe56..a7b2bd7d981 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/Librpcsvc/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/Librpcsvc/default.nix
@@ -1,6 +1,6 @@
 { stdenv, appleDerivation, developer_cmds }:
 
-appleDerivation rec {
+appleDerivation {
   buildInputs = [ developer_cmds ];
 
   installPhase = ''
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix
index 7b19194be96..99d67002803 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix
@@ -3,7 +3,7 @@
 , copyfile, removefile, libresolv, Libnotify, libplatform, libpthread
 , mDNSResponder, launchd, libutil, hfs, darling }:
 
-appleDerivation rec {
+appleDerivation {
   dontBuild = true;
   dontFixup = true;
 
diff --git a/pkgs/os-specific/darwin/apple-source-releases/basic_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/basic_cmds/default.nix
index 4a0180dda7a..eadf18e028e 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/basic_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/basic_cmds/default.nix
@@ -1,6 +1,6 @@
 { stdenv, appleDerivation, xcbuildHook }:
 
-appleDerivation rec {
+appleDerivation {
   nativeBuildInputs = [ xcbuildHook ];
 
   # These PBXcp calls should be patched in xcbuild to allow them to
diff --git a/pkgs/os-specific/darwin/apple-source-releases/developer_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/developer_cmds/default.nix
index b2d8522f326..21971ea2e28 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/developer_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/developer_cmds/default.nix
@@ -1,6 +1,6 @@
 { stdenv, appleDerivation, xcbuildHook }:
 
-appleDerivation rec {
+appleDerivation {
   nativeBuildInputs = [ xcbuildHook ];
 
   patchPhase = ''
diff --git a/pkgs/os-specific/darwin/apple-source-releases/file_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/file_cmds/default.nix
index f0394a20c2c..5de84d2a6e5 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/file_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/file_cmds/default.nix
@@ -1,6 +1,6 @@
 { stdenv, appleDerivation, xcbuildHook, zlib, bzip2, lzma, ncurses, libutil }:
 
-appleDerivation rec {
+appleDerivation {
   nativeBuildInputs = [ xcbuildHook ];
   buildInputs = [ zlib bzip2 lzma ncurses libutil ];
 
diff --git a/pkgs/os-specific/darwin/apple-source-releases/network_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/network_cmds/default.nix
index 9ca0f3b4e56..82be7dc860e 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/network_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/network_cmds/default.nix
@@ -1,7 +1,7 @@
 { stdenv, appleDerivation, xcbuildHook
 , openssl_1_0_2, Librpcsvc, xnu, libpcap, developer_cmds }:
 
-appleDerivation rec {
+appleDerivation {
   nativeBuildInputs = [ xcbuildHook ];
   buildInputs = [ openssl_1_0_2 xnu Librpcsvc libpcap developer_cmds ];
 
diff --git a/pkgs/os-specific/darwin/apple-source-releases/shell_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/shell_cmds/default.nix
index 5b2322915dc..b87dadd391d 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/shell_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/shell_cmds/default.nix
@@ -1,6 +1,6 @@
 { stdenv, appleDerivation, xcbuildHook }:
 
-appleDerivation rec {
+appleDerivation {
   nativeBuildInputs = [ xcbuildHook ];
 
   patchPhase = ''
diff --git a/pkgs/os-specific/darwin/apple-source-releases/system_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/system_cmds/default.nix
index 39c903a2e7b..03556296ca1 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/system_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/system_cmds/default.nix
@@ -1,7 +1,7 @@
 { stdenv, appleDerivation, lib
 , Librpcsvc, apple_sdk, pam, CF, openbsm }:
 
-appleDerivation rec {
+appleDerivation {
   # xcbuild fails with:
   # /nix/store/fc0rz62dh8vr648qi7hnqyik6zi5sqx8-xcbuild-wrapper/nix-support/setup-hook: line 1:  9083 Segmentation fault: 11  xcodebuild OTHER_CFLAGS="$NIX_CFLAGS_COMPILE" OTHER_CPLUSPLUSFLAGS="$NIX_CFLAGS_COMPILE" OTHER_LDFLAGS="$NIX_LDFLAGS" build
   # see issue facebook/xcbuild#188
diff --git a/pkgs/os-specific/darwin/lsusb/default.nix b/pkgs/os-specific/darwin/lsusb/default.nix
index cb81c2e8149..02821fe61ef 100644
--- a/pkgs/os-specific/darwin/lsusb/default.nix
+++ b/pkgs/os-specific/darwin/lsusb/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   version = "1.0";
   pname = "lsusb";
 
diff --git a/pkgs/os-specific/darwin/osxfuse/default.nix b/pkgs/os-specific/darwin/osxfuse/default.nix
index 77e63c779b9..e1a00c71cb8 100644
--- a/pkgs/os-specific/darwin/osxfuse/default.nix
+++ b/pkgs/os-specific/darwin/osxfuse/default.nix
@@ -16,7 +16,7 @@ let
   '';
 in
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
 
   pname = "osxfuse";
   inherit version;
diff --git a/pkgs/os-specific/darwin/qes/default.nix b/pkgs/os-specific/darwin/qes/default.nix
index 19ab34145e8..21b0d605021 100644
--- a/pkgs/os-specific/darwin/qes/default.nix
+++ b/pkgs/os-specific/darwin/qes/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub, Carbon }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "qes";
   version = "0.0.2";
 
diff --git a/pkgs/os-specific/darwin/xcode/sdk-pkgs.nix b/pkgs/os-specific/darwin/xcode/sdk-pkgs.nix
index bb9dc0a03b5..d25edff4956 100644
--- a/pkgs/os-specific/darwin/xcode/sdk-pkgs.nix
+++ b/pkgs/os-specific/darwin/xcode/sdk-pkgs.nix
@@ -14,9 +14,9 @@ let
 minSdkVersion = "9.0";
 
 iosPlatformArch = { parsed, ... }: {
-  "armv7a"  = "armv7";
-  "aarch64" = "arm64";
-  "x86_64"  = "x86_64";
+  armv7a  = "armv7";
+  aarch64 = "arm64";
+  x86_64  = "x86_64";
 }.${parsed.cpu.name};
 
 in
diff --git a/pkgs/os-specific/linux/acpid/default.nix b/pkgs/os-specific/linux/acpid/default.nix
index 99d1cf38f0a..d58aec4a97c 100644
--- a/pkgs/os-specific/linux/acpid/default.nix
+++ b/pkgs/os-specific/linux/acpid/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, autoreconfHook }:
 
 stdenv.mkDerivation rec {
-  name = "acpid-2.0.31";
+  name = "acpid-2.0.32";
 
   src = fetchurl {
     url = "mirror://sourceforge/acpid2/${name}.tar.xz";
-    sha256 = "1hrc0xm6q12knbgzhq0i8g2rfrkwcvh1asd7k9rs3nc5xmlwd7gw";
+    sha256 = "0zhmxnhnhg4v1viw82yjr22kram6k5k1ixznhayk8cnw7q5x7lpj";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/pkgs/os-specific/linux/anbox/kmod.nix b/pkgs/os-specific/linux/anbox/kmod.nix
index 2f5c392c173..fee8d1e7a42 100644
--- a/pkgs/os-specific/linux/anbox/kmod.nix
+++ b/pkgs/os-specific/linux/anbox/kmod.nix
@@ -1,6 +1,6 @@
 { stdenv, kernel, fetchFromGitHub }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "anbox-modules";
   version = "2019-07-13-" + kernel.version;
 
diff --git a/pkgs/os-specific/linux/batman-adv/default.nix b/pkgs/os-specific/linux/batman-adv/default.nix
index d7d25e69664..456872cdbd4 100644
--- a/pkgs/os-specific/linux/batman-adv/default.nix
+++ b/pkgs/os-specific/linux/batman-adv/default.nix
@@ -2,7 +2,7 @@
 
 let base = "batman-adv-2019.2"; in
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   name = "${base}-${kernel.version}";
 
   src = fetchurl {
diff --git a/pkgs/os-specific/linux/beegfs/default.nix b/pkgs/os-specific/linux/beegfs/default.nix
index 205d788da6e..7ce2fea6924 100644
--- a/pkgs/os-specific/linux/beegfs/default.nix
+++ b/pkgs/os-specific/linux/beegfs/default.nix
@@ -26,7 +26,7 @@ let
     "upgrade/beegfs_mirror_md/build"
   ];
 
-in stdenv.mkDerivation rec {
+in stdenv.mkDerivation {
   pname = "beegfs";
   inherit version;
 
diff --git a/pkgs/os-specific/linux/bpftool/default.nix b/pkgs/os-specific/linux/bpftool/default.nix
index ac444c28d75..c54e3e38e9b 100644
--- a/pkgs/os-specific/linux/bpftool/default.nix
+++ b/pkgs/os-specific/linux/bpftool/default.nix
@@ -3,7 +3,7 @@
 , linuxPackages_latest
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "bpftool";
   inherit (linuxPackages_latest.kernel) version src;
 
diff --git a/pkgs/os-specific/linux/can-isotp/default.nix b/pkgs/os-specific/linux/can-isotp/default.nix
index 0149398bfa3..7f16ecb9e6d 100644
--- a/pkgs/os-specific/linux/can-isotp/default.nix
+++ b/pkgs/os-specific/linux/can-isotp/default.nix
@@ -1,6 +1,6 @@
 { stdenv, kernel, fetchFromGitHub }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "can-isotp";
   version = "20180629";
 
diff --git a/pkgs/os-specific/linux/can-utils/default.nix b/pkgs/os-specific/linux/can-utils/default.nix
index 7913c703b5b..6e26ef4bbce 100644
--- a/pkgs/os-specific/linux/can-utils/default.nix
+++ b/pkgs/os-specific/linux/can-utils/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "can-utils";
   # There are no releases (source archives or git tags), so use the date of the
   # latest commit in git master as version number.
diff --git a/pkgs/os-specific/linux/checkpolicy/default.nix b/pkgs/os-specific/linux/checkpolicy/default.nix
index b724112af88..fc2faa5b8f5 100644
--- a/pkgs/os-specific/linux/checkpolicy/default.nix
+++ b/pkgs/os-specific/linux/checkpolicy/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "checkpolicy";
-  version = "2.7";
+  version = "2.9";
   inherit (libsepol) se_release se_url;
 
   src = fetchurl {
     url = "${se_url}/${se_release}/checkpolicy-${version}.tar.gz";
-    sha256 = "009j9jc0hi4l7k8f21hn8fm25n0mqgzdpd4nk30nds6d3nglf4sl";
+    sha256 = "13jz6f8zdrijvn5w1j102b36fs41z0q8ii74axw48cj550mw6im9";
   };
 
   nativeBuildInputs = [ bison flex ];
diff --git a/pkgs/os-specific/linux/devmem2/default.nix b/pkgs/os-specific/linux/devmem2/default.nix
index cd1400b41fc..77fa7fe3b1b 100644
--- a/pkgs/os-specific/linux/devmem2/default.nix
+++ b/pkgs/os-specific/linux/devmem2/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchurl }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   name = "devmem2-2004-08-05";
 
   src = fetchurl {
diff --git a/pkgs/os-specific/linux/directvnc/default.nix b/pkgs/os-specific/linux/directvnc/default.nix
index 5896262ac21..a880f699b69 100644
--- a/pkgs/os-specific/linux/directvnc/default.nix
+++ b/pkgs/os-specific/linux/directvnc/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, directfb, zlib, libjpeg, xorgproto }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "directvnc";
   version = "0.7.7.2015-04-16";
 
diff --git a/pkgs/os-specific/linux/dstat/default.nix b/pkgs/os-specific/linux/dstat/default.nix
index 63b766b21a5..25d0eb1fd02 100644
--- a/pkgs/os-specific/linux/dstat/default.nix
+++ b/pkgs/os-specific/linux/dstat/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchurl, python2Packages }:
 
 python2Packages.buildPythonApplication rec {
-  name = "dstat-${version}";
+  pname = "dstat";
   format = "other";
   version = "0.7.3";
 
diff --git a/pkgs/os-specific/linux/fbterm/default.nix b/pkgs/os-specific/linux/fbterm/default.nix
index defb45d7a86..c8fc633f8bd 100644
--- a/pkgs/os-specific/linux/fbterm/default.nix
+++ b/pkgs/os-specific/linux/fbterm/default.nix
@@ -1,7 +1,7 @@
 {stdenv, lib, fetchurl, gpm, freetype, fontconfig, pkgconfig, ncurses, libx86}:
 let
   s = # Generated upstream information
-  rec {
+  {
     baseName="fbterm";
     version="1.7.0";
     name="fbterm-1.7.0";
diff --git a/pkgs/os-specific/linux/firmware/fwupd/default.nix b/pkgs/os-specific/linux/firmware/fwupd/default.nix
index b4d5d54137c..c688d8c6ab3 100644
--- a/pkgs/os-specific/linux/firmware/fwupd/default.nix
+++ b/pkgs/os-specific/linux/firmware/fwupd/default.nix
@@ -1,18 +1,68 @@
-{ stdenv, fetchurl, substituteAll, gtk-doc, pkgconfig, gobject-introspection, intltool
-, libgudev, polkit, libxmlb, gusb, sqlite, libarchive, glib-networking
-, libsoup, help2man, gpgme, libxslt, elfutils, libsmbios, efivar, gnu-efi
-, libyaml, valgrind, meson, libuuid, colord, docbook_xml_dtd_43, docbook_xsl
-, ninja, gcab, gnutls, python3, wrapGAppsHook, json-glib, bash-completion
-, shared-mime-info, umockdev, vala, makeFontsConf, freefont_ttf
-, cairo, freetype, fontconfig, pango
-, bubblewrap, efibootmgr, flashrom, tpm2-tools
-}:
-
 # Updating? Keep $out/etc synchronized with passthru.filesInstalledToEtc
 
+{ stdenv
+, fetchurl
+, substituteAll
+, gtk-doc
+, pkgconfig
+, gobject-introspection
+, intltool
+, libgudev
+, polkit
+, libxmlb
+, gusb
+, sqlite
+, libarchive
+, glib-networking
+, libsoup
+, help2man
+, gpgme
+, libxslt
+, elfutils
+, libsmbios
+, efivar
+, gnu-efi
+, libyaml
+, valgrind
+, meson
+, libuuid
+, colord
+, docbook_xml_dtd_43
+, docbook_xsl
+, ninja
+, gcab
+, gnutls
+, python3
+, wrapGAppsHook
+, json-glib
+, bash-completion
+, shared-mime-info
+, umockdev
+, vala
+, makeFontsConf
+, freefont_ttf
+, cairo
+, freetype
+, fontconfig
+, pango
+, bubblewrap
+, efibootmgr
+, flashrom
+, tpm2-tools
+, nixosTests
+}:
+
 let
-  python = python3.withPackages (p: with p; [ pygobject3 pycairo pillow ]);
-  installedTestsPython = python3.withPackages (p: with p; [ pygobject3 requests ]);
+  python = python3.withPackages (p: with p; [
+    pygobject3
+    pycairo
+    pillow
+  ]);
+
+  installedTestsPython = python3.withPackages (p: with p; [
+    pygobject3
+    requests
+  ]);
 
   fontsConf = makeFontsConf {
     fontDirectories = [ freefont_ttf ];
@@ -26,30 +76,70 @@ let
   # only redfish for x86_64
   haveRedfish = stdenv.isx86_64;
 
-  # Currently broken on Aarch64
-  haveFlashrom = isx86;
+  # # Currently broken on Aarch64
+  # haveFlashrom = isx86;
+  # Experimental in 1.2.10
+  haveFlashrom = false;
 
-in stdenv.mkDerivation rec {
+in
+
+stdenv.mkDerivation rec {
   pname = "fwupd";
-  version = "1.2.8";
+  version = "1.2.10";
 
   src = fetchurl {
     url = "https://people.freedesktop.org/~hughsient/releases/fwupd-${version}.tar.xz";
-    sha256 = "0qbvq52c0scn1h99i1rf2la6rrhckin6gb02k7l0v3g07mxs20wc";
+    sha256 = "0inngs7i48akm9c7fmdsf9zjif595rkaba69rl76jfwfv8r21vjb";
   };
 
   outputs = [ "out" "lib" "dev" "devdoc" "man" "installedTests" ];
 
   nativeBuildInputs = [
-    meson ninja gtk-doc pkgconfig gobject-introspection intltool shared-mime-info
-    valgrind gcab docbook_xml_dtd_43 docbook_xsl help2man libxslt python wrapGAppsHook vala
+    meson
+    ninja
+    gtk-doc
+    pkgconfig
+    gobject-introspection
+    intltool
+    shared-mime-info
+    valgrind
+    gcab
+    docbook_xml_dtd_43
+    docbook_xsl
+    help2man
+    libxslt
+    python
+    wrapGAppsHook
+    vala
   ];
 
   buildInputs = [
-    polkit libxmlb gusb sqlite libarchive libsoup elfutils gnu-efi libyaml
-    libgudev colord gpgme libuuid gnutls glib-networking json-glib umockdev
-    bash-completion cairo freetype fontconfig pango efivar
-  ] ++ stdenv.lib.optionals haveDell [ libsmbios ];
+    polkit
+    libxmlb
+    gusb
+    sqlite
+    libarchive
+    libsoup
+    elfutils
+    gnu-efi
+    libyaml
+    libgudev
+    colord
+    gpgme
+    libuuid
+    gnutls
+    glib-networking
+    json-glib
+    umockdev
+    bash-completion
+    cairo
+    freetype
+    fontconfig
+    pango
+    efivar
+  ] ++ stdenv.lib.optionals haveDell [
+    libsmbios
+  ];
 
   patches = [
     ./fix-paths.patch
@@ -65,7 +155,12 @@ in stdenv.mkDerivation rec {
   ];
 
   postPatch = ''
-    patchShebangs .
+    patchShebangs \
+      libfwupd/generate-version-script.py \
+      meson_post_install.sh \
+      po/make-images \
+      po/make-images.sh \
+      po/test-deps
 
     # we cannot use placeholder in substituteAll
     # https://github.com/NixOS/nix/issues/1846
@@ -85,9 +180,12 @@ in stdenv.mkDerivation rec {
   # doCheck = true;
 
   preFixup = let
-    binPath = [ efibootmgr bubblewrap tpm2-tools ] ++ stdenv.lib.optional haveFlashrom flashrom;
-  in
-  ''
+    binPath = [
+      efibootmgr
+      bubblewrap
+      tpm2-tools
+    ] ++ stdenv.lib.optional haveFlashrom flashrom;
+  in ''
     gappsWrapperArgs+=(
       --prefix XDG_DATA_DIRS : "${shared-mime-info}/share"
       # See programs reached with fu_common_find_program_in_path in source
@@ -128,6 +226,10 @@ in stdenv.mkDerivation rec {
 
   FONTCONFIG_FILE = fontsConf; # Fontconfig error: Cannot load default config file
 
+  # error: “PolicyKit files are missing”
+  # https://github.com/NixOS/nixpkgs/pull/67625#issuecomment-525788428
+  PKG_CONFIG_POLKIT_GOBJECT_1_ACTIONDIR = "/run/current-system/sw/share/polkit-1/actions";
+
   # TODO: wrapGAppsHook wraps efi capsule even though it is not elf
   dontWrapGApps = true;
   # so we need to wrap the executables manually
@@ -157,11 +259,15 @@ in stdenv.mkDerivation rec {
       "pki/fwupd-metadata/GPG-KEY-Linux-Vendor-Firmware-Service"
       "pki/fwupd-metadata/LVFS-CA.pem"
     ];
+
+    tests = {
+      installedTests = nixosTests.fwupd;
+    };
   };
 
   meta = with stdenv.lib; {
     homepage = https://fwupd.org/;
-    maintainers = with maintainers; [];
+    maintainers = with maintainers; [ jtojnar ];
     license = [ licenses.gpl2 ];
     platforms = platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/firmware/raspberrypi-wireless/default.nix b/pkgs/os-specific/linux/firmware/raspberrypi-wireless/default.nix
index 26ed2020635..e9ee91a2de7 100644
--- a/pkgs/os-specific/linux/firmware/raspberrypi-wireless/default.nix
+++ b/pkgs/os-specific/linux/firmware/raspberrypi-wireless/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "raspberrypi-wireless-firmware";
   version = "2018-08-20";
 
diff --git a/pkgs/os-specific/linux/firmware/raspberrypi/tools.nix b/pkgs/os-specific/linux/firmware/raspberrypi/tools.nix
index 321ce8ffc06..1ea2b5e4e3d 100644
--- a/pkgs/os-specific/linux/firmware/raspberrypi/tools.nix
+++ b/pkgs/os-specific/linux/firmware/raspberrypi/tools.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub, cmake, pkgconfig }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "raspberrypi-tools";
   version = "2018-10-03";
 
diff --git a/pkgs/os-specific/linux/flashbench/default.nix b/pkgs/os-specific/linux/flashbench/default.nix
index 0abd458aa8f..bf3d2ef8d6d 100644
--- a/pkgs/os-specific/linux/flashbench/default.nix
+++ b/pkgs/os-specific/linux/flashbench/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchgit }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "flashbench";
   version = "2012-06-06";
 
diff --git a/pkgs/os-specific/linux/freefall/default.nix b/pkgs/os-specific/linux/freefall/default.nix
index 09774016ef2..a6c5a6593d1 100644
--- a/pkgs/os-specific/linux/freefall/default.nix
+++ b/pkgs/os-specific/linux/freefall/default.nix
@@ -1,6 +1,6 @@
 { stdenv, kernel }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   inherit (kernel) version src;
 
   pname = "freefall";
diff --git a/pkgs/os-specific/linux/fscrypt/default.nix b/pkgs/os-specific/linux/fscrypt/default.nix
index 35e1972b574..cdd42e98f06 100644
--- a/pkgs/os-specific/linux/fscrypt/default.nix
+++ b/pkgs/os-specific/linux/fscrypt/default.nix
@@ -4,15 +4,17 @@
 
 buildGoPackage rec {
   pname = "fscrypt";
-  version = "0.2.4";
+  version = "unstable-2019-08-29";
 
   goPackagePath = "github.com/google/fscrypt";
 
+  goDeps = ./deps.nix;
+
   src = fetchFromGitHub {
     owner = "google";
     repo = "fscrypt";
-    rev = "v${version}";
-    sha256 = "10gbyqzgi30as1crvqbb4rc5p8zzbzk1q5j080h1gnz56qzwivr8";
+    rev = "8a3acda2011e9a080ee792c1e11646e6118a4930";
+    sha256 = "17h6r5lqiz0cw9vsixv48a1p78nd7bs1kncg6p4lfagl7kr5hpls";
   };
 
   buildInputs = [ pam ];
diff --git a/pkgs/os-specific/linux/fscrypt/deps.nix b/pkgs/os-specific/linux/fscrypt/deps.nix
new file mode 100644
index 00000000000..5d3e8a89a91
--- /dev/null
+++ b/pkgs/os-specific/linux/fscrypt/deps.nix
@@ -0,0 +1,66 @@
+# file generated from go.mod using vgo2nix (https://github.com/adisbladis/vgo2nix)
+[
+  {
+    goPackagePath = "github.com/golang/protobuf";
+    fetch = {
+      type = "git";
+      url = "https://github.com/golang/protobuf";
+      rev = "v1.2.0";
+      sha256 = "0kf4b59rcbb1cchfny2dm9jyznp8ri2hsb14n8iak1q8986xa0ab";
+    };
+  }
+  {
+    goPackagePath = "github.com/pkg/errors";
+    fetch = {
+      type = "git";
+      url = "https://github.com/pkg/errors";
+      rev = "v0.8.0";
+      sha256 = "001i6n71ghp2l6kdl3qq1v2vmghcz3kicv9a5wgcihrzigm75pp5";
+    };
+  }
+  {
+    goPackagePath = "github.com/urfave/cli";
+    fetch = {
+      type = "git";
+      url = "https://github.com/urfave/cli";
+      rev = "v1.20.0";
+      sha256 = "0y6f4sbzkiiwrxbl15biivj8c7qwxnvm3zl2dd3mw4wzg4x10ygj";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/crypto";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/crypto";
+      rev = "614d502a4dac";
+      sha256 = "1rcyvsl8b8pk7h8lwl0fpiflrx8zs121wi5490ln0qnvkk8d4bwy";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/net";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/net";
+      rev = "8a410e7b638d";
+      sha256 = "0hp0l8f6fir5gmgrjq0mhh5ikc0rlrm72774228800kfwqjrxxny";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/sync";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/sync";
+      rev = "1d60e4601c6f";
+      sha256 = "046jlanz2lkxq1r57x9bl6s4cvfqaic6p2xybsj8mq1120jv4rs6";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/sys";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/sys";
+      rev = "d99a578cf41b";
+      sha256 = "10q9xx4pmnq92qn6ff4xp7n1hx766wvw2rf7pqcd6rx5plgwz8cm";
+    };
+  }
+]
diff --git a/pkgs/os-specific/linux/fwts/default.nix b/pkgs/os-specific/linux/fwts/default.nix
index 07252b8bc31..b5df553a97c 100644
--- a/pkgs/os-specific/linux/fwts/default.nix
+++ b/pkgs/os-specific/linux/fwts/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "fwts";
-  version = "19.07.00";
+  version = "19.08.00";
 
   src = fetchzip {
-    url = "http://fwts.ubuntu.com/release/fwts-V${version}.tar.gz";
-    sha256 = "04h99ri3nzhxr2js2a04bcj6zm17zlybqzv528j6hr6v0pv5wn4p";
+    url = "http://fwts.ubuntu.com/release/${pname}-V${version}.tar.gz";
+    sha256 = "14v4vxvfsl008xalsmlhl9wh89xlrfffh3pky9m90flaizdzwyp4";
     stripRoot = false;
   };
 
diff --git a/pkgs/os-specific/linux/gpu-switch/default.nix b/pkgs/os-specific/linux/gpu-switch/default.nix
index 0325461763a..ea1051c5f05 100644
--- a/pkgs/os-specific/linux/gpu-switch/default.nix
+++ b/pkgs/os-specific/linux/gpu-switch/default.nix
@@ -1,6 +1,6 @@
 { stdenv, lib, fetchFromGitHub }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "gpu-switch-unstable";
   version = "2017-04-28";
   src = fetchFromGitHub {
diff --git a/pkgs/os-specific/linux/hdapsd/default.nix b/pkgs/os-specific/linux/hdapsd/default.nix
index 53924a782df..893eb4fdd99 100644
--- a/pkgs/os-specific/linux/hdapsd/default.nix
+++ b/pkgs/os-specific/linux/hdapsd/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchurl }:
 
 let version = "20141203"; in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   name = "hdapsd-"+version;
 
   src = fetchurl {
diff --git a/pkgs/os-specific/linux/hibernate/default.nix b/pkgs/os-specific/linux/hibernate/default.nix
index d2319fdcf5c..3d759001d01 100644
--- a/pkgs/os-specific/linux/hibernate/default.nix
+++ b/pkgs/os-specific/linux/hibernate/default.nix
@@ -2,7 +2,7 @@
 
 let version = "2.0";
 in
-  stdenv.mkDerivation rec {
+  stdenv.mkDerivation {
     pname = "hibernate";
     inherit version;
     src = fetchurl {
diff --git a/pkgs/os-specific/linux/hyperv-daemons/default.nix b/pkgs/os-specific/linux/hyperv-daemons/default.nix
index 36ca1eb16b4..a209f1ab4bb 100644
--- a/pkgs/os-specific/linux/hyperv-daemons/default.nix
+++ b/pkgs/os-specific/linux/hyperv-daemons/default.nix
@@ -1,7 +1,7 @@
 { stdenv, lib, python, kernel, makeWrapper, writeText }:
 
 let
-  daemons = stdenv.mkDerivation rec {
+  daemons = stdenv.mkDerivation {
     pname = "hyperv-daemons-bin";
     inherit (kernel) src version;
 
@@ -54,7 +54,7 @@ let
       WantedBy=hyperv-daemons.target
     '';
 
-in stdenv.mkDerivation rec {
+in stdenv.mkDerivation {
   pname = "hyperv-daemons";
 
   inherit (kernel) version;
diff --git a/pkgs/os-specific/linux/kbd/keymaps.nix b/pkgs/os-specific/linux/kbd/keymaps.nix
index e6e89811894..b3d5fe1b63c 100644
--- a/pkgs/os-specific/linux/kbd/keymaps.nix
+++ b/pkgs/os-specific/linux/kbd/keymaps.nix
@@ -18,7 +18,7 @@
     '';
   };
 
-  neo = stdenv.mkDerivation rec {
+  neo = stdenv.mkDerivation {
     pname = "neo";
     version = "2476";
 
diff --git a/pkgs/os-specific/linux/kernel-headers/default.nix b/pkgs/os-specific/linux/kernel-headers/default.nix
index 1e9b1c276d0..1699324546d 100644
--- a/pkgs/os-specific/linux/kernel-headers/default.nix
+++ b/pkgs/os-specific/linux/kernel-headers/default.nix
@@ -7,7 +7,8 @@ let
   makeLinuxHeaders = { src, version, patches ? [] }: stdenvNoCC.mkDerivation {
     inherit src;
 
-    name = "linux-headers-${version}";
+    pname = "linux-headers";
+    inherit version;
 
     ARCH = stdenvNoCC.hostPlatform.platform.kernelArch or stdenvNoCC.hostPlatform.kernelArch;
 
diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix
index a3b77ee8d96..ae39047a9d3 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.14.141";
+  version = "4.14.142";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "05rs411rw10hhnfzvaxmcik3pq20i1i05shvvra4bv164f0z1f8b";
+    sha256 = "1wwhnm1n1b6yzsd2zzzf9i3n4hlvgnph70p67cwahw0ik4ssayz6";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.19.nix b/pkgs/os-specific/linux/kernel/linux-4.19.nix
index fb25fbb7ddc..56d254c1ecb 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.19.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.19.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.19.69";
+  version = "4.19.71";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "11yrw8ixd5ni9rlpndqsz2ihx6k8qaf35a1lf164lkhaa85pd4f0";
+    sha256 = "1bjwkb7k82l646ryyy0jbwsnygm2qsxgcwli8bdrj844skzynlqz";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix
index 0d3ce63325f..2889dc34aba 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.4.190";
+  version = "4.4.191";
   extraMeta.branch = "4.4";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1rf28cjrrmj7mm8xqlfld6k20ddk15j4mmyarqibjx9pk9acij7y";
+    sha256 = "0x3lnq4xyj5v6r1cz4jizm4vdspws1nb806f5qczwi3yil5nm6bh";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
index 0008219efb9..d494c7bb623 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.9.190";
+  version = "4.9.191";
   extraMeta.branch = "4.9";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "05ha3snfk0vdqk9i27icwpq2if0h2jvshavn69ldwqm4h2h1r2py";
+    sha256 = "1g5p736p8zx5rmxaj56yw93jp768npl868jsn8973dny0rsbim6y";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.2.nix b/pkgs/os-specific/linux/kernel/linux-5.2.nix
index bf28ac53df0..dfce0f30398 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.2.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.2.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.2.11";
+  version = "5.2.13";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1y9kn1zny3xpmbi5an3g7hbzywnycys8chfaw6laij1xk4gq6ahc";
+    sha256 = "12hpph3iynr22mfwz7745lp01waf2kg579hr56d4pvhx4iahzdhp";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-rpi.nix b/pkgs/os-specific/linux/kernel/linux-rpi.nix
index d2e1a35cb2e..1b4700a2e39 100644
--- a/pkgs/os-specific/linux/kernel/linux-rpi.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rpi.nix
@@ -4,7 +4,7 @@ let
   modDirVersion = "4.14.98";
   tag = "1.20190215";
 in
-lib.overrideDerivation (buildLinux (args // rec {
+lib.overrideDerivation (buildLinux (args // {
   version = "${modDirVersion}-${tag}";
   inherit modDirVersion;
 
@@ -16,9 +16,9 @@ lib.overrideDerivation (buildLinux (args // rec {
   };
 
   defconfig = {
-    "armv6l-linux" = "bcmrpi_defconfig";
-    "armv7l-linux" = "bcm2709_defconfig";
-    "aarch64-linux" = "bcmrpi3_defconfig";
+    armv6l-linux = "bcmrpi_defconfig";
+    armv7l-linux = "bcm2709_defconfig";
+    aarch64-linux = "bcmrpi3_defconfig";
   }.${stdenv.hostPlatform.system} or (throw "linux_rpi not supported on '${stdenv.hostPlatform.system}'");
 
   features = {
diff --git a/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix b/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix
index 4516af19a4e..0b2ed76a4b4 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix
@@ -1,6 +1,6 @@
 { stdenv, buildPackages, fetchgit, fetchpatch, perl, buildLinux, ... } @ args:
 
-buildLinux (args // rec {
+buildLinux (args // {
   version = "5.1.2019.08.21";
   modDirVersion = "5.1.0";
 
diff --git a/pkgs/os-specific/linux/kernel/patches.nix b/pkgs/os-specific/linux/kernel/patches.nix
index edca017b3c7..b80320db282 100644
--- a/pkgs/os-specific/linux/kernel/patches.nix
+++ b/pkgs/os-specific/linux/kernel/patches.nix
@@ -1,6 +1,6 @@
 { fetchpatch }:
 
-rec {
+{
   bridge_stp_helper =
     { name = "bridge-stp-helper";
       patch = ./bridge-stp-helper.patch;
@@ -23,7 +23,7 @@ rec {
 
   cpu-cgroup-v2 = import ./cpu-cgroup-v2-patches;
 
-  tag_hardened = rec {
+  tag_hardened = {
     name = "tag-hardened";
     patch = ./tag-hardened.patch;
   };
@@ -58,7 +58,7 @@ rec {
     };
   };
 
-  export_kernel_fpu_functions = rec {
+  export_kernel_fpu_functions = {
     name = "export_kernel_fpu_functions";
     patch = ./export_kernel_fpu_functions.patch;
   };
diff --git a/pkgs/os-specific/linux/kmscube/default.nix b/pkgs/os-specific/linux/kmscube/default.nix
index f738b9f6da5..12463c736a6 100644
--- a/pkgs/os-specific/linux/kmscube/default.nix
+++ b/pkgs/os-specific/linux/kmscube/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchgit, autoreconfHook, libdrm, libX11, libGL, mesa, pkgconfig }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   name = "kmscube-2018-06-17";
 
   src = fetchgit {
diff --git a/pkgs/os-specific/linux/ledger-udev-rules/default.nix b/pkgs/os-specific/linux/ledger-udev-rules/default.nix
index 28027fd4510..96c60f6ea56 100644
--- a/pkgs/os-specific/linux/ledger-udev-rules/default.nix
+++ b/pkgs/os-specific/linux/ledger-udev-rules/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "ledger-udev-rules";
   version = "unstable-2019-02-13";
 
diff --git a/pkgs/os-specific/linux/libselinux/default.nix b/pkgs/os-specific/linux/libselinux/default.nix
index 028c008eccf..d8a2298f3d3 100644
--- a/pkgs/os-specific/linux/libselinux/default.nix
+++ b/pkgs/os-specific/linux/libselinux/default.nix
@@ -9,14 +9,14 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   pname = "libselinux";
-  version = "2.7";
+  version = "2.9";
   inherit (libsepol) se_release se_url;
 
-  outputs = [ "bin" "out" "dev" "man" "py" ];
+  outputs = [ "bin" "out" "dev" "man" ] ++ optional enablePython "py";
 
   src = fetchurl {
     url = "${se_url}/${se_release}/libselinux-${version}.tar.gz";
-    sha256 = "0mwcq78v6ngbq06xmb9dvilpg0jnl2vs9fgrpakhmmiskdvc1znh";
+    sha256 = "14r69mgmz7najf9wbizvp68q56mqx4yjbkxjlbcqg5a47s3wik0v";
   };
 
   nativeBuildInputs = [ pkgconfig ] ++ optionals enablePython [ swig python ];
@@ -35,7 +35,8 @@ stdenv.mkDerivation rec {
     "MAN3DIR=$(man)/share/man/man3"
     "MAN5DIR=$(man)/share/man/man5"
     "MAN8DIR=$(man)/share/man/man8"
-    "PYSITEDIR=$(py)/${python.sitePackages}"
+    "PYTHON=python"
+    "PYTHONLIBDIR=$(py)/${python.sitePackages}"
     "SBINDIR=$(bin)/sbin"
     "SHLIBDIR=$(out)/lib"
 
diff --git a/pkgs/os-specific/linux/libsemanage/default.nix b/pkgs/os-specific/linux/libsemanage/default.nix
index 4fe323ee23d..70b2508451b 100644
--- a/pkgs/os-specific/linux/libsemanage/default.nix
+++ b/pkgs/os-specific/linux/libsemanage/default.nix
@@ -6,25 +6,29 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   pname = "libsemanage";
-  version = "2.7";
+  version = "2.9";
   inherit (libsepol) se_release se_url;
 
   src = fetchurl {
     url = "${se_url}/${se_release}/libsemanage-${version}.tar.gz";
-    sha256 = "0xnlp1yg8b1aqc6kq3pss1i1nl06rfj4x4pyl5blasnf2ivlgs87";
-  };
+    sha256 = "075w6y3l9hiy5hicgwrmijyxmhfyd1r7cnc08qxyg4j46jfk8xi5";
+   };
+
+  outputs = [ "out" "dev" "man" ] ++ optional enablePython "py";
 
   nativeBuildInputs = [ bison flex pkgconfig ];
   buildInputs = [ libsepol libselinux bzip2 audit ]
     ++ optionals enablePython [ swig python ];
 
-  preBuild = ''
-    makeFlagsArray+=("PREFIX=$out")
-    makeFlagsArray+=("DESTDIR=$out")
-    makeFlagsArray+=("MAN3DIR=$out/share/man/man3")
-    makeFlagsArray+=("MAN5DIR=$out/share/man/man5")
-    makeFlagsArray+=("PYSITEDIR=$out/lib/${python.libPrefix}/site-packages")
-  '';
+  makeFlags = [
+    "PREFIX=$(out)"
+    "INCLUDEDIR=$(dev)/include"
+    "MAN3DIR=$(man)/share/man/man3"
+    "MAN5DIR=$(man)/share/man/man5"
+    "PYTHON=python"
+    "PYTHONLIBDIR=$(py)/${python.sitePackages}"
+    "DEFAULT_SEMANAGE_CONF_LOCATION=$(out)/etc/selinux/semanage.conf"
+  ];
 
   installTargets = [ "install" ] ++ optionals enablePython [ "install-pywrap" ];
 
diff --git a/pkgs/os-specific/linux/libsepol/default.nix b/pkgs/os-specific/linux/libsepol/default.nix
index e96ea01cce4..03bd0252c5c 100644
--- a/pkgs/os-specific/linux/libsepol/default.nix
+++ b/pkgs/os-specific/linux/libsepol/default.nix
@@ -2,15 +2,15 @@
 
 stdenv.mkDerivation rec {
   pname = "libsepol";
-  version = "2.7";
-  se_release = "20170804";
-  se_url = "https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases";
+  version = "2.9";
+  se_release = "20190315";
+  se_url = "https://github.com/SELinuxProject/selinux/releases/download";
 
   outputs = [ "bin" "out" "dev" "man" ];
 
   src = fetchurl {
     url = "${se_url}/${se_release}/libsepol-${version}.tar.gz";
-    sha256 = "1rzr90d3f1g5wy1b8sh6fgnqb9migys2zgpjmpakn6lhxkc3p7fn";
+    sha256 = "0p8x7w73jn1nysx1d7416wqrhbi0r6isrjxib7jf68fi72q14jx3";
   };
 
   nativeBuildInputs = [ flex ];
diff --git a/pkgs/os-specific/linux/logitech-udev-rules/default.nix b/pkgs/os-specific/linux/logitech-udev-rules/default.nix
index 9aa1698b766..369f412fbfc 100644
--- a/pkgs/os-specific/linux/logitech-udev-rules/default.nix
+++ b/pkgs/os-specific/linux/logitech-udev-rules/default.nix
@@ -3,7 +3,7 @@
 # ltunifi and solaar both provide udev rules but solaar's rules are more
 # up-to-date so we simply use that instead of having to maintain our own rules
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "logitech-udev-rules";
   inherit (solaar) version;
 
diff --git a/pkgs/os-specific/linux/lsiutil/default.nix b/pkgs/os-specific/linux/lsiutil/default.nix
index b2d1ca4791a..63155e66678 100644
--- a/pkgs/os-specific/linux/lsiutil/default.nix
+++ b/pkgs/os-specific/linux/lsiutil/default.nix
@@ -12,7 +12,7 @@ let
 
 in
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "lsiutils";
   inherit version;
   
diff --git a/pkgs/os-specific/linux/mba6x_bl/default.nix b/pkgs/os-specific/linux/mba6x_bl/default.nix
index 0a6fc3c977c..7c72c8a2dbf 100644
--- a/pkgs/os-specific/linux/mba6x_bl/default.nix
+++ b/pkgs/os-specific/linux/mba6x_bl/default.nix
@@ -1,6 +1,6 @@
 { fetchFromGitHub, kernel, stdenv }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   name = "mba6x_bl-2016-12-08";
 
   src = fetchFromGitHub {
diff --git a/pkgs/os-specific/linux/microcode/amd.nix b/pkgs/os-specific/linux/microcode/amd.nix
index 34f19db524c..1a24ae3b9a2 100644
--- a/pkgs/os-specific/linux/microcode/amd.nix
+++ b/pkgs/os-specific/linux/microcode/amd.nix
@@ -1,6 +1,6 @@
 { stdenv, firmwareLinuxNonfree, libarchive }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   name = "amd-ucode-${firmwareLinuxNonfree.version}";
 
   src = firmwareLinuxNonfree;
diff --git a/pkgs/os-specific/linux/miraclecast/default.nix b/pkgs/os-specific/linux/miraclecast/default.nix
index 0edf322cce5..6b67401b9b2 100644
--- a/pkgs/os-specific/linux/miraclecast/default.nix
+++ b/pkgs/os-specific/linux/miraclecast/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchFromGitHub, meson, ninja, pkgconfig
 , glib, readline, pcre, systemd, udev }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "miraclecast";
   version = "1.0-20190403";
 
diff --git a/pkgs/os-specific/linux/mmc-utils/default.nix b/pkgs/os-specific/linux/mmc-utils/default.nix
index a7f0a332beb..e0b87f2010a 100644
--- a/pkgs/os-specific/linux/mmc-utils/default.nix
+++ b/pkgs/os-specific/linux/mmc-utils/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchgit }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "mmc-utils";
   version = "2018-03-27";
 
diff --git a/pkgs/os-specific/linux/nftables/default.nix b/pkgs/os-specific/linux/nftables/default.nix
index 843676b9cca..9b4f2f1c544 100644
--- a/pkgs/os-specific/linux/nftables/default.nix
+++ b/pkgs/os-specific/linux/nftables/default.nix
@@ -7,12 +7,12 @@
 with stdenv.lib;
 
 stdenv.mkDerivation rec {
-  version = "0.9.1";
+  version = "0.9.2";
   pname = "nftables";
 
   src = fetchurl {
     url = "https://netfilter.org/projects/nftables/files/${pname}-${version}.tar.bz2";
-    sha256 = "1kjg3dykf2aw76d76viz1hm0rav57nfbdwlngawgn2slxmlbplza";
+    sha256 = "1x8kalbggjq44j4916i6vyv1rb20dlh1dcsf9xvzqsry2j063djw";
   };
 
   configureFlags = [
diff --git a/pkgs/os-specific/linux/nvidia-x11/builder.sh b/pkgs/os-specific/linux/nvidia-x11/builder.sh
index 467d930aaf5..2b1b37db344 100755
--- a/pkgs/os-specific/linux/nvidia-x11/builder.sh
+++ b/pkgs/os-specific/linux/nvidia-x11/builder.sh
@@ -62,7 +62,10 @@ installPhase() {
         sed -E "s#(libnvidia-opencl)#$i/lib/\\1#" nvidia.icd > nvidia.icd.fixed
         install -Dm644 nvidia.icd.fixed $i/etc/OpenCL/vendors/nvidia.icd
         if [ -e nvidia_icd.json.template ]; then
+            # template patching for version < 435
             sed "s#__NV_VK_ICD__#$i/lib/libGLX_nvidia.so#" nvidia_icd.json.template > nvidia_icd.json
+        fi
+        if [ -e nvidia_icd.json ]; then
             install -Dm644 nvidia_icd.json $i/share/vulkan/icd.d/nvidia.json
         fi
         if [ "$useGLVND" = "1" ]; then
diff --git a/pkgs/os-specific/linux/nvidia-x11/persistenced.nix b/pkgs/os-specific/linux/nvidia-x11/persistenced.nix
index cfe79d4c0b7..4f8a0b68664 100644
--- a/pkgs/os-specific/linux/nvidia-x11/persistenced.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/persistenced.nix
@@ -2,7 +2,7 @@ nvidia_x11: sha256:
 
 { stdenv, fetchFromGitHub, m4 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "nvidia-persistenced";
   inherit (nvidia_x11) version;
 
diff --git a/pkgs/os-specific/linux/nvidia-x11/settings.nix b/pkgs/os-specific/linux/nvidia-x11/settings.nix
index 1867c1a133a..101f61f3020 100644
--- a/pkgs/os-specific/linux/nvidia-x11/settings.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/settings.nix
@@ -40,7 +40,7 @@ let
 
 in
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "nvidia-settings";
   inherit (nvidia_x11) version;
   inherit src;
diff --git a/pkgs/os-specific/linux/pipework/default.nix b/pkgs/os-specific/linux/pipework/default.nix
index 62aa18fa643..044f75cbd6f 100644
--- a/pkgs/os-specific/linux/pipework/default.nix
+++ b/pkgs/os-specific/linux/pipework/default.nix
@@ -2,7 +2,7 @@
 , bridge-utils, iproute, lxc, openvswitch, docker, busybox, dhcpcd, dhcp
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "pipework";
   version = "2017-08-22";
   src = fetchFromGitHub {
diff --git a/pkgs/os-specific/linux/policycoreutils/default.nix b/pkgs/os-specific/linux/policycoreutils/default.nix
index fb507d4da48..9d229c50000 100644
--- a/pkgs/os-specific/linux/policycoreutils/default.nix
+++ b/pkgs/os-specific/linux/policycoreutils/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "policycoreutils";
-  version = "2.7";
+  version = "2.9";
   inherit (libsepol) se_release se_url;
 
   src = fetchurl {
     url = "${se_url}/${se_release}/policycoreutils-${version}.tar.gz";
-    sha256 = "1x742c7lkw30namhkw87yg7z384qzqjz0pvmqs0lk19v6958l6qa";
+    sha256 = "0yqg5ws5gbl1cbn8msxdk1c3ilmmx58qg5dx883kqyq0517k8g65";
   };
 
   postPatch = ''
@@ -20,13 +20,14 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ gettext ];
   buildInputs = [ libsepol libselinux libsemanage ];
 
-  preBuild = ''
-    makeFlagsArray+=("PREFIX=$out")
-    makeFlagsArray+=("DESTDIR=$out")
-    makeFlagsArray+=("BASHCOMPLETIONDIR=$out/share/bash-completion/completions")
-    makeFlagsArray+=("LOCALEDIR=$out/share/locale")
-    makeFlagsArray+=("MAN5DIR=$out/share/man/man5")
-  '';
+  makeFlags = [
+    "PREFIX=$(out)"
+    "SBINDIR=$(out)/sbin"
+    "ETCDIR=$(out)/etc"
+    "BASHCOMPLETIONDIR=$out/share/bash-completion/completions"
+    "LOCALEDIR=$(out)/share/locale"
+    "MAN5DIR=$(out)/share/man/man5"
+  ];
 
   meta = with stdenv.lib; {
     description = "SELinux policy core utilities";
diff --git a/pkgs/os-specific/linux/rewritefs/default.nix b/pkgs/os-specific/linux/rewritefs/default.nix
index b1afbfea0de..710eba642cb 100644
--- a/pkgs/os-specific/linux/rewritefs/default.nix
+++ b/pkgs/os-specific/linux/rewritefs/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub, pkgconfig, fuse, pcre }: 
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "rewritefs";
   version = "2017-08-14";
 
diff --git a/pkgs/os-specific/linux/selinux-python/default.nix b/pkgs/os-specific/linux/selinux-python/default.nix
index b8f80a0124c..2ca88c32f13 100644
--- a/pkgs/os-specific/linux/selinux-python/default.nix
+++ b/pkgs/os-specific/linux/selinux-python/default.nix
@@ -8,13 +8,13 @@ with python3.pkgs;
 
 stdenv.mkDerivation rec {
   pname = "selinux-python";
-  version = "2.7";
-  se_release = "20170804";
-  se_url = "https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases";
+  version = "2.9";
+
+  inherit (libsepol) se_release se_url;
 
   src = fetchurl {
     url = "${se_url}/${se_release}/selinux-python-${version}.tar.gz";
-    sha256 = "1va0y4b7cah7rprh04b3ylmwqgnivpkw5z2zw68nrafdbsbcn5s2";
+    sha256 = "1pjzsyay5535cxcjag7y7k193ajry0s0xc3dqv5905qd7cwval1n";
   };
 
   nativeBuildInputs = [ wrapPython ];
@@ -23,17 +23,19 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     substituteInPlace sepolicy/Makefile --replace "echo --root" "echo --prefix"
+    substituteInPlace sepolgen/src/share/Makefile --replace "/var/lib/sepolgen" \
+                                                            "\$PREFIX/var/lib/sepolgen"
   '';
 
-  preBuild = ''
-    makeFlagsArray+=("PREFIX=$out")
-    makeFlagsArray+=("DESTDIR=$out")
-    makeFlagsArray+=("LOCALEDIR=$out/share/locale")
-    makeFlagsArray+=("LIBSEPOLA=${stdenv.lib.getLib libsepol}/lib/libsepol.a")
-    makeFlagsArray+=("BASHCOMPLETIONDIR=$out/share/bash-completion/completions")
-    makeFlagsArray+=("PYTHON=${python3}/bin/python")
-    makeFlagsArray+=("PYTHONLIBDIR=lib/${python3.libPrefix}/site-packages")
-  '';
+  makeFlags = [
+    "PREFIX=$(out)"
+    "LOCALEDIR=$(out)/share/locale"
+    "BASHCOMPLETIONDIR=$(out)/share/bash-completion/completions"
+    "PYTHON=python"
+    "PYTHONLIBDIR=$(out)/${python.sitePackages}"
+    "LIBSEPOLA=${stdenv.lib.getLib libsepol}/lib/libsepol.a"
+  ];
+
 
   postFixup = ''
     wrapPythonPrograms
diff --git a/pkgs/os-specific/linux/selinux-sandbox/default.nix b/pkgs/os-specific/linux/selinux-sandbox/default.nix
index 99bbfbe7287..5343c5fae1a 100644
--- a/pkgs/os-specific/linux/selinux-sandbox/default.nix
+++ b/pkgs/os-specific/linux/selinux-sandbox/default.nix
@@ -9,12 +9,12 @@ with python3.pkgs;
 
 stdenv.mkDerivation rec {
   pname = "selinux-sandbox";
-  version = "2.7";
-  se_release = "20170804";
+  version = "2.9";
+  inherit (policycoreutils) se_release se_url;
 
   src = fetchurl {
-    url = "https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/${se_release}/selinux-sandbox-${version}.tar.gz";
-    sha256 = "0hf5chm90iapb42njaps6p5460ys3ajh5446ja544vdbh01n544l";
+    url = "${se_url}/${se_release}/selinux-sandbox-${version}.tar.gz";
+    sha256 = "0qj20jyi8v1653xdqj5yak3wwbvg5bw8f2jmx8fpahl6y1bmz481";
   };
 
   nativeBuildInputs = [ wrapPython ];
@@ -42,10 +42,10 @@ stdenv.mkDerivation rec {
       --replace "/usr/bin/test" "${coreutils}/bin/test" \
   '';
 
-  preBuild = ''
-    makeFlagsArray+=("PREFIX=$out")
-    makeFlagsArray+=("DESTDIR=$out")
-  '';
+  makeFlags = [
+    "PREFIX=$(out)"
+    "SYSCONFDIR=$(out)/etc/sysconfig"
+  ];
 
   postFixup = ''
     wrapPythonPrograms
diff --git a/pkgs/os-specific/linux/semodule-utils/default.nix b/pkgs/os-specific/linux/semodule-utils/default.nix
index 178d102381e..bf1f36835b4 100644
--- a/pkgs/os-specific/linux/semodule-utils/default.nix
+++ b/pkgs/os-specific/linux/semodule-utils/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "semodule-utils";
-  version = "2.7";
+  version = "2.9";
 
   inherit (libsepol) se_release se_url;
 
   src = fetchurl {
     url = "${se_url}/${se_release}/${pname}-${version}.tar.gz";
-    sha256 = "1fl60x4w8rn5bcwy68sy48aydwsn1a17d48slni4sfx4c8rqpjch";
+    sha256 = "01yrwnd3calmw6r8kdh8ld7i7fb250n2yqqqk9p0ymrlwsg6g0w0";
   };
 
   buildInputs = [ libsepol ];
diff --git a/pkgs/os-specific/linux/syscall_limiter/default.nix b/pkgs/os-specific/linux/syscall_limiter/default.nix
index db362613d37..ef13e5ded02 100644
--- a/pkgs/os-specific/linux/syscall_limiter/default.nix
+++ b/pkgs/os-specific/linux/syscall_limiter/default.nix
@@ -5,7 +5,7 @@
 , which
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "syscall_limiter";
   version = "2017-01-23";
 
diff --git a/pkgs/os-specific/linux/sysdig/default.nix b/pkgs/os-specific/linux/sysdig/default.nix
index ce2bd1fa99f..399244e47ee 100644
--- a/pkgs/os-specific/linux/sysdig/default.nix
+++ b/pkgs/os-specific/linux/sysdig/default.nix
@@ -5,13 +5,13 @@
 with stdenv.lib;
 stdenv.mkDerivation rec {
   pname = "sysdig";
-  version = "0.26.2";
+  version = "0.26.4";
 
   src = fetchFromGitHub {
     owner = "draios";
     repo = "sysdig";
     rev = version;
-    sha256 = "1a74cvvy3lhilibc3lzcsvs6pwrdvdx2580qgckp1lrra9gf5hga";
+    sha256 = "1v2j1ns17wyj7xl91p6wy1iwfx2fnn8af9nm939skc6229m87zzn";
   };
 
   nativeBuildInputs = [ cmake perl ];
diff --git a/pkgs/os-specific/linux/syslinux/default.nix b/pkgs/os-specific/linux/syslinux/default.nix
index 8965b5da4f4..8631ddf01d0 100644
--- a/pkgs/os-specific/linux/syslinux/default.nix
+++ b/pkgs/os-specific/linux/syslinux/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub, fetchurl, nasm, perl, python, libuuid, mtools, makeWrapper }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   name = "syslinux-2015-11-09";
 
   src = fetchFromGitHub {
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 45f4d60e4e3..4117df8cf13 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, pkgconfig, intltool, gperf, libcap, kmod
+{ stdenv, lib, fetchFromGitHub, fetchpatch, pkgconfig, intltool, gperf, libcap, kmod
 , xz, pam, acl, libuuid, m4, utillinux, libffi
 , glib, kbd, libxslt, coreutils, libgcrypt, libgpgerror, libidn2, libapparmor
 , audit, lz4, bzip2, libmicrohttpd, pcre2
@@ -15,7 +15,7 @@
 , withKexectools ? lib.any (lib.meta.platformMatch stdenv.hostPlatform) kexectools.meta.platforms, kexectools
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   version = "242";
   pname = "systemd";
 
@@ -28,6 +28,14 @@ stdenv.mkDerivation rec {
     sha256 = "0pyjvzzh8nnxv4z58n82lz1mjnzv44sylcjgkvw8sp35vx1ryxfh";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2019-15718.patch";
+      url = https://github.com/systemd/systemd/pull/13457/commits/35e528018f315798d3bffcb592b32a0d8f5162bd.patch;
+      sha256 = "0m0ypnnllx4r6a2qy1586as15i2qrzxwi1sqdp14rzdwajz1rvnv";
+    })
+  ];
+
   outputs = [ "out" "lib" "man" "dev" ];
 
   nativeBuildInputs =
diff --git a/pkgs/os-specific/linux/trace-cmd/default.nix b/pkgs/os-specific/linux/trace-cmd/default.nix
index e6571b46ee0..567dcd1068c 100644
--- a/pkgs/os-specific/linux/trace-cmd/default.nix
+++ b/pkgs/os-specific/linux/trace-cmd/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchgit, asciidoc, docbook_xsl, libxslt }:
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "trace-cmd";
   version = "2.8.3";
 
diff --git a/pkgs/os-specific/linux/trace-cmd/kernelshark.nix b/pkgs/os-specific/linux/trace-cmd/kernelshark.nix
index 8e49af77139..b73de3193d2 100644
--- a/pkgs/os-specific/linux/trace-cmd/kernelshark.nix
+++ b/pkgs/os-specific/linux/trace-cmd/kernelshark.nix
@@ -1,5 +1,5 @@
 { stdenv, mkDerivation, fetchgit, qtbase, cmake, json_c, mesa_glu, freeglut, trace-cmd, pkg-config }:
-mkDerivation rec {
+mkDerivation {
   pname = "kernelshark";
   version = "0.9.8";
 
diff --git a/pkgs/os-specific/linux/upower/default.nix b/pkgs/os-specific/linux/upower/default.nix
index 91dddb50c34..d787acae61b 100644
--- a/pkgs/os-specific/linux/upower/default.nix
+++ b/pkgs/os-specific/linux/upower/default.nix
@@ -14,7 +14,7 @@
 , libimobiledevice
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "upower";
   version = "0.99.11";
 
diff --git a/pkgs/os-specific/linux/usbguard/default.nix b/pkgs/os-specific/linux/usbguard/default.nix
index efc7406cc19..a9983561345 100644
--- a/pkgs/os-specific/linux/usbguard/default.nix
+++ b/pkgs/os-specific/linux/usbguard/default.nix
@@ -1,11 +1,8 @@
 {
   stdenv, fetchurl, lib,
-  pkgconfig, libxml2, libxslt,
-  dbus-glib, libcap_ng, libqb, libseccomp, polkit, protobuf, audit,
-  withGui ? true,
-  qtbase ? null,
-  qttools ? null,
-  qtsvg ? null,
+  pkgconfig, libxslt, libxml2, docbook_xml_dtd_45, docbook_xsl, asciidoc,
+  dbus-glib, libcap_ng, libqb, libseccomp, polkit, protobuf,
+  audit,
   libgcrypt ? null,
   libsodium ? null
 }:
@@ -15,20 +12,23 @@ with stdenv.lib;
 assert libgcrypt != null -> libsodium == null;
 
 stdenv.mkDerivation rec {
-  version = "0.7.4";
+  version = "0.7.5";
   pname = "usbguard";
 
   repo = "https://github.com/USBGuard/usbguard";
 
   src = fetchurl {
     url = "${repo}/releases/download/${pname}-${version}/${pname}-${version}.tar.gz";
-    sha256 = "1qkskd6q5cwlh2cpcsbzmmmgk6w63z0825wlb2sjwqq3kfgwjb3k";
+    sha256 = "0jj56sls13ryfgz6vajq8p4dm3grgb6rf2cmga6sckmzd4chk65b";
   };
 
   nativeBuildInputs = [
+    asciidoc
     pkgconfig
     libxslt # xsltproc
     libxml2 # xmllint
+    docbook_xml_dtd_45
+    docbook_xsl
   ];
 
   buildInputs = [
@@ -41,8 +41,7 @@ stdenv.mkDerivation rec {
     audit
   ]
   ++ (lib.optional (libgcrypt != null) libgcrypt)
-  ++ (lib.optional (libsodium != null) libsodium)
-  ++ (lib.optionals withGui [ qtbase qtsvg qttools ]);
+  ++ (lib.optional (libsodium != null) libsodium);
 
   configureFlags = [
     "--with-bundled-catch"
@@ -51,8 +50,7 @@ stdenv.mkDerivation rec {
     "--with-polkit"
   ]
   ++ (lib.optional (libgcrypt != null) "--with-crypto-library=gcrypt")
-  ++ (lib.optional (libsodium != null) "--with-crypto-library=sodium")
-  ++ (lib.optional withGui "--with-gui-qt=qt5");
+  ++ (lib.optional (libsodium != null) "--with-crypto-library=sodium");
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/os-specific/linux/usbip/default.nix b/pkgs/os-specific/linux/usbip/default.nix
index 497b5c19166..1bb92d7dce1 100644
--- a/pkgs/os-specific/linux/usbip/default.nix
+++ b/pkgs/os-specific/linux/usbip/default.nix
@@ -1,6 +1,6 @@
 { stdenv, kernel, udev, autoconf, automake, libtool }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   name = "usbip-${kernel.name}";
 
   src = kernel.src;
diff --git a/pkgs/os-specific/linux/uvcdynctrl/default.nix b/pkgs/os-specific/linux/uvcdynctrl/default.nix
index 19f59d00680..cfb93684f3b 100644
--- a/pkgs/os-specific/linux/uvcdynctrl/default.nix
+++ b/pkgs/os-specific/linux/uvcdynctrl/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub, cmake, pkgconfig, libxml2 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   version = "0.3.0";
   pname = "uvcdynctrl";
 
diff --git a/pkgs/os-specific/linux/v4l-utils/default.nix b/pkgs/os-specific/linux/v4l-utils/default.nix
index 9bb6fcdd0a0..a688f60492a 100644
--- a/pkgs/os-specific/linux/v4l-utils/default.nix
+++ b/pkgs/os-specific/linux/v4l-utils/default.nix
@@ -1,18 +1,22 @@
-{ stdenv, lib, fetchurl, pkgconfig, perl, mkDerivation
+{ stdenv, lib, fetchurl, pkgconfig, perl
 , libjpeg, udev
 , withUtils ? true
-, withGUI ? true, alsaLib, libX11, qtbase, libGLU
+, withGUI ? true, alsaLib, libX11, qtbase, libGLU, wrapQtAppsHook
 }:
 
 # See libv4l in all-packages.nix for the libs only (overrides alsa, libX11 & QT)
 
-mkDerivation rec {
+let
+  withQt = withUtils && withGUI;
+
+# we need to use stdenv.mkDerivation in order not to pollute the libv4l’s closure with Qt
+in stdenv.mkDerivation rec {
   pname = "v4l-utils";
-  version = "1.16.6";
+  version = "1.16.7";
 
   src = fetchurl {
-    url = "https://linuxtv.org/downloads/v4l-utils/${pname}-${version}.tar.bz2";
-    sha256 = "1bkqlrizx0j2rd6ybam2x17bjrpwzl4v4szmnzm3cmixis3w3npr";
+    url = "https://linuxtv.org/downloads/${pname}/${pname}-${version}.tar.bz2";
+    sha256 = "1ng0x3wj3a1ckfd00yxa4za43xms92gdp7rdag060b7p39z7m4gf";
   };
 
   outputs = [ "out" "dev" ];
@@ -29,13 +33,13 @@ mkDerivation rec {
     ln -s "$dev/include/libv4l1-videodev.h" "$dev/include/videodev.h"
   '';
 
-  nativeBuildInputs = [ pkgconfig perl ];
+  nativeBuildInputs = [ pkgconfig perl ] ++ lib.optional withQt wrapQtAppsHook;
 
-  buildInputs = [ udev ] ++ lib.optionals (withUtils && withGUI) [ alsaLib libX11 qtbase libGLU ];
+  buildInputs = [ udev ] ++ lib.optionals withQt [ alsaLib libX11 qtbase libGLU ];
 
   propagatedBuildInputs = [ libjpeg ];
 
-  NIX_CFLAGS_COMPILE = lib.optional (withUtils && withGUI) "-std=c++11";
+  NIX_CFLAGS_COMPILE = lib.optional withQt "-std=c++11";
 
   postPatch = ''
     patchShebangs .
diff --git a/pkgs/os-specific/linux/wireguard/default.nix b/pkgs/os-specific/linux/wireguard/default.nix
index 570eb4ca4ef..c2dca669616 100644
--- a/pkgs/os-specific/linux/wireguard/default.nix
+++ b/pkgs/os-specific/linux/wireguard/default.nix
@@ -3,7 +3,7 @@
 # module requires Linux >= 3.10 https://www.wireguard.io/install/#kernel-requirements
 assert stdenv.lib.versionAtLeast kernel.version "3.10";
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "wireguard";
   inherit (wireguard-tools) src version;
 
diff --git a/pkgs/os-specific/linux/zfs/default.nix b/pkgs/os-specific/linux/zfs/default.nix
index 03e11d1a8ed..1b9b5a3ba51 100644
--- a/pkgs/os-specific/linux/zfs/default.nix
+++ b/pkgs/os-specific/linux/zfs/default.nix
@@ -30,7 +30,7 @@ let
          Linux v${kernel.version} is not yet supported by zfsonlinux v${version}.
          ${stdenv.lib.optionalString (!isUnstable) "Try zfsUnstable or set the NixOS option boot.zfs.enableUnstable."}
        ''
-    else stdenv.mkDerivation rec {
+    else stdenv.mkDerivation {
       name = "zfs-${configFile}-${version}${optionalString buildKernel "-${kernel.version}"}";
 
       src = fetchFromGitHub {
@@ -163,7 +163,7 @@ in {
     ];
   };
 
-  zfsUnstable = common rec {
+  zfsUnstable = common {
     # comment/uncomment if breaking kernel versions are known
     # incompatibleKernelVersion = "4.19";
 
diff --git a/pkgs/os-specific/windows/pthread-w32/default.nix b/pkgs/os-specific/windows/pthread-w32/default.nix
index 286f4a0d41f..25706733967 100644
--- a/pkgs/os-specific/windows/pthread-w32/default.nix
+++ b/pkgs/os-specific/windows/pthread-w32/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchzip }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "pthreads-w32";
   version = "2.9.1";